Gotweb

Blob

Date:: Wed Mar 18 16:10:33 2020 UTC
Message:: parse symrefs from server capabilities and transmit them over imsg
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018, 2019, 2020 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2020 Ori Bernstein <ori@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/queue.h>
20 #include <sys/uio.h>
21 #include <sys/syslimits.h>
22 #include <sys/wait.h>
23 
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <string.h>
27 #include <errno.h>
28 #include <stdint.h>
29 #include <poll.h>
30 #include <imsg.h>
31 #include <sha1.h>
32 #include <zlib.h>
33 #include <time.h>
34 
35 #include "got_object.h"
36 #include "got_error.h"
37 #include "got_path.h"
38 #include "got_repository.h"
39 
40 #include "got_lib_sha1.h"
41 #include "got_lib_delta.h"
42 #include "got_lib_inflate.h"
43 #include "got_lib_object.h"
44 #include "got_lib_object_parse.h"
45 #include "got_lib_privsep.h"
46 #include "got_lib_pack.h"
47 
48 #ifndef MIN
49 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
50 #endif
51 
52 #ifndef nitems
53 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
54 #endif
55 
56 static const struct got_error *
57 poll_fd(int fd, int events, int timeout)
58 {
59 	struct pollfd pfd[1];
60 	int n;
61 
62 	pfd[0].fd = fd;
63 	pfd[0].events = events;
64 
65 	n = poll(pfd, 1, timeout);
66 	if (n == -1)
67 		return got_error_from_errno("poll");
68 	if (n == 0)
69 		return got_error(GOT_ERR_TIMEOUT);
70 	if (pfd[0].revents & (POLLERR | POLLNVAL))
71 		return got_error_from_errno("poll error");
72 	if (pfd[0].revents & (events | POLLHUP))
73 		return NULL;
74 
75 	return got_error(GOT_ERR_INTERRUPT);
76 }
77 
78 static const struct got_error *
79 read_imsg(struct imsgbuf *ibuf)
80 {
81 	const struct got_error *err;
82 	size_t n;
83 
84 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
85 	if (err)
86 		return err;
87 
88 	n = imsg_read(ibuf);
89 	if (n == -1) {
90 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
91 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
92 		return got_error(GOT_ERR_PRIVSEP_READ);
93 	}
94 	if (n == 0)
95 		return got_error(GOT_ERR_PRIVSEP_PIPE);
96 
97 	return NULL;
98 }
99 
100 const struct got_error *
101 got_privsep_wait_for_child(pid_t pid)
102 {
103 	int child_status;
104 
105 	if (waitpid(pid, &child_status, 0) == -1)
106 		return got_error_from_errno("waitpid");
107 
108 	if (!WIFEXITED(child_status))
109 		return got_error(GOT_ERR_PRIVSEP_DIED);
110 
111 	if (WEXITSTATUS(child_status) != 0)
112 		return got_error(GOT_ERR_PRIVSEP_EXIT);
113 
114 	return NULL;
115 }
116 
117 static const struct got_error *
118 recv_imsg_error(struct imsg *imsg, size_t datalen)
119 {
120 	struct got_imsg_error *ierr;
121 
122 	if (datalen != sizeof(*ierr))
123 		return got_error(GOT_ERR_PRIVSEP_LEN);
124 
125 	ierr = imsg->data;
126 	if (ierr->code == GOT_ERR_ERRNO) {
127 		static struct got_error serr;
128 		serr.code = GOT_ERR_ERRNO;
129 		serr.msg = strerror(ierr->errno_code);
130 		return &serr;
131 	}
132 
133 	return got_error(ierr->code);
134 }
135 
136 const struct got_error *
137 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
138     size_t min_datalen)
139 {
140 	const struct got_error *err;
141 	ssize_t n;
142 
143 	n = imsg_get(ibuf, imsg);
144 	if (n == -1)
145 		return got_error_from_errno("imsg_get");
146 
147 	while (n == 0) {
148 		err = read_imsg(ibuf);
149 		if (err)
150 			return err;
151 		n = imsg_get(ibuf, imsg);
152 		if (n == -1)
153 			return got_error_from_errno("imsg_get");
154 	}
155 
156 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
157 		return got_error(GOT_ERR_PRIVSEP_LEN);
158 
159 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
160 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
161 		return recv_imsg_error(imsg, datalen);
162 	}
163 
164 	return NULL;
165 }
166 
167 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
168 void
169 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
170 {
171 	const struct got_error *poll_err;
172 	struct got_imsg_error ierr;
173 	int ret;
174 
175 	ierr.code = err->code;
176 	if (err->code == GOT_ERR_ERRNO)
177 		ierr.errno_code = errno;
178 	else
179 		ierr.errno_code = 0;
180 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
181 	if (ret == -1) {
182 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
183 		    getprogname(), err->code, err->msg, strerror(errno));
184 		return;
185 	}
186 
187 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
188 	if (poll_err) {
189 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
190 		    getprogname(), err->code, err->msg, poll_err->msg);
191 		return;
192 	}
193 
194 	ret = imsg_flush(ibuf);
195 	if (ret == -1) {
196 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
197 		    getprogname(), err->code, err->msg, strerror(errno));
198 		return;
199 	}
200 }
201 
202 static const struct got_error *
203 flush_imsg(struct imsgbuf *ibuf)
204 {
205 	const struct got_error *err;
206 
207 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
208 	if (err)
209 		return err;
210 
211 	if (imsg_flush(ibuf) == -1)
212 		return got_error_from_errno("imsg_flush");
213 
214 	return NULL;
215 }
216 
217 const struct got_error *
218 got_privsep_send_stop(int fd)
219 {
220 	const struct got_error *err = NULL;
221 	struct imsgbuf ibuf;
222 
223 	imsg_init(&ibuf, fd);
224 
225 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
226 		return got_error_from_errno("imsg_compose STOP");
227 
228 	err = flush_imsg(&ibuf);
229 	imsg_clear(&ibuf);
230 	return err;
231 }
232 
233 const struct got_error *
234 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd)
235 {
236 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd, NULL, 0)
237 	    == -1)
238 		return got_error_from_errno("imsg_compose OBJECT_REQUEST");
239 
240 	return flush_imsg(ibuf);
241 }
242 
243 const struct got_error *
244 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
245     struct got_object_id *id, int pack_idx)
246 {
247 	const struct got_error *err = NULL;
248 	struct got_imsg_packed_object iobj, *iobjp;
249 	size_t len;
250 
251 	if (id) { /* commit is packed */
252 		iobj.idx = pack_idx;
253 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
254 		iobjp = &iobj;
255 		len = sizeof(iobj);
256 	} else {
257 		iobjp = NULL;
258 		len = 0;
259 	}
260 
261 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, iobjp, len)
262 	    == -1) {
263 		err = got_error_from_errno("imsg_compose COMMIT_REQUEST");
264 		close(fd);
265 		return err;
266 	}
267 
268 	return flush_imsg(ibuf);
269 }
270 
271 const struct got_error *
272 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
273     struct got_object_id *id, int pack_idx)
274 {
275 	const struct got_error *err = NULL;
276 	struct ibuf *wbuf;
277 	size_t len = id ? sizeof(struct got_imsg_packed_object) : 0;
278 
279 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, len);
280 	if (wbuf == NULL)
281 		return got_error_from_errno("imsg_create TREE_REQUEST");
282 
283 	if (id) { /* tree is packed */
284 		if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
285 			err = got_error_from_errno("imsg_add TREE_ENTRY");
286 			ibuf_free(wbuf);
287 			return err;
288 		}
289 
290 		if (imsg_add(wbuf, &pack_idx, sizeof(pack_idx)) == -1) {
291 			err = got_error_from_errno("imsg_add TREE_ENTRY");
292 			ibuf_free(wbuf);
293 			return err;
294 		}
295 	}
296 
297 	wbuf->fd = fd;
298 	imsg_close(ibuf, wbuf);
299 
300 	return flush_imsg(ibuf);
301 }
302 
303 const struct got_error *
304 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
305     struct got_object_id *id, int pack_idx)
306 {
307 	struct got_imsg_packed_object iobj, *iobjp;
308 	size_t len;
309 
310 	if (id) { /* tag is packed */
311 		iobj.idx = pack_idx;
312 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
313 		iobjp = &iobj;
314 		len = sizeof(iobj);
315 	} else {
316 		iobjp = NULL;
317 		len = 0;
318 	}
319 
320 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, iobjp, len)
321 	    == -1)
322 		return got_error_from_errno("imsg_compose TAG_REQUEST");
323 
324 	return flush_imsg(ibuf);
325 }
326 
327 const struct got_error *
328 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
329     struct got_object_id *id, int pack_idx)
330 {
331 	const struct got_error *err = NULL;
332 	struct got_imsg_packed_object iobj, *iobjp;
333 	size_t len;
334 
335 	if (id) { /* blob is packed */
336 		iobj.idx = pack_idx;
337 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
338 		iobjp = &iobj;
339 		len = sizeof(iobj);
340 	} else {
341 		iobjp = NULL;
342 		len = 0;
343 	}
344 
345 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, iobjp, len)
346 	    == -1) {
347 		err = got_error_from_errno("imsg_compose BLOB_REQUEST");
348 		close(infd);
349 		return err;
350 	}
351 
352 	return flush_imsg(ibuf);
353 }
354 
355 const struct got_error *
356 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
357 {
358 	const struct got_error *err = NULL;
359 
360 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
361 	    == -1) {
362 		err = got_error_from_errno("imsg_compose BLOB_OUTFD");
363 		close(outfd);
364 		return err;
365 	}
366 
367 	return flush_imsg(ibuf);
368 }
369 
370 const struct got_error *
371 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
372 {
373 	const struct got_error *err = NULL;
374 
375 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
376 	    == -1) {
377 		err = got_error_from_errno("imsg_compose TMPFD");
378 		close(fd);
379 		return err;
380 	}
381 
382 	return flush_imsg(ibuf);
383 }
384 
385 const struct got_error *
386 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
387 {
388 	struct got_imsg_object iobj;
389 
390 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
391 	iobj.type = obj->type;
392 	iobj.flags = obj->flags;
393 	iobj.hdrlen = obj->hdrlen;
394 	iobj.size = obj->size;
395 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
396 		iobj.pack_offset = obj->pack_offset;
397 		iobj.pack_idx = obj->pack_idx;
398 	}
399 
400 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
401 	    == -1)
402 		return got_error_from_errno("imsg_compose OBJECT");
403 
404 	return flush_imsg(ibuf);
405 }
406 
407 const struct got_error *
408 got_privsep_send_fetch_req(struct imsgbuf *ibuf, int fd)
409 {
410 	const struct got_error *err = NULL;
411 
412 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_REQUEST, 0, 0, fd,
413 	    NULL, 0) == -1) {
414 		err = got_error_from_errno("imsg_compose FETCH_REQUEST");
415 		close(fd);
416 		return err;
417 	}
418 	return flush_imsg(ibuf);
419 }
420 
421 const struct got_error *
422 got_privsep_send_fetch_symrefs(struct imsgbuf *ibuf,
423     struct got_pathlist_head *symrefs)
424 {
425 	const struct got_error *err = NULL;
426 	struct ibuf *wbuf;
427 	size_t len, nsymrefs = 0;
428 	struct got_pathlist_entry *pe;
429 
430 	len = sizeof(struct got_imsg_fetch_symrefs);
431 	TAILQ_FOREACH(pe, symrefs, entry) {
432 		const char *target = pe->data;
433 		len += sizeof(struct got_imsg_fetch_symref) +
434 		    pe->path_len + strlen(target);
435 		nsymrefs++;
436 	}
437 
438 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
439 		return got_error(GOT_ERR_NO_SPACE);
440 
441 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_SYMREFS, 0, 0, len);
442 	if (wbuf == NULL)
443 		return got_error_from_errno("imsg_create FETCH_SYMREFS");
444 
445 	/* Keep in sync with struct got_imsg_fetch_symrefs definition! */
446 	if (imsg_add(wbuf, &nsymrefs, sizeof(nsymrefs)) == -1) {
447 		err = got_error_from_errno("imsg_add FETCH_SYMREFS");
448 		ibuf_free(wbuf);
449 		return err;
450 	}
451 
452 	TAILQ_FOREACH(pe, symrefs, entry) {
453 		const char *name = pe->path;
454 		size_t name_len = pe->path_len;
455 		const char *target = pe->data;
456 		size_t target_len = strlen(target);
457 
458 		/* Keep in sync with struct got_imsg_fetch_symref definition! */
459 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1) {
460 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
461 			ibuf_free(wbuf);
462 			return err;
463 		}
464 		if (imsg_add(wbuf, &target_len, sizeof(target_len)) == -1) {
465 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
466 			ibuf_free(wbuf);
467 			return err;
468 		}
469 		if (imsg_add(wbuf, name, name_len) == -1) {
470 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
471 			ibuf_free(wbuf);
472 			return err;
473 		}
474 		if (imsg_add(wbuf, target, target_len) == -1) {
475 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
476 			ibuf_free(wbuf);
477 			return err;
478 		}
479 	}
480 
481 	wbuf->fd = -1;
482 	imsg_close(ibuf, wbuf);
483 	return flush_imsg(ibuf);
484 }
485 
486 const struct got_error *
487 got_privsep_send_fetch_progress(struct imsgbuf *ibuf,
488     struct got_object_id *refid, const char *refname)
489 {
490 	const struct got_error *err = NULL;
491 	struct ibuf *wbuf;
492 	size_t len, reflen = strlen(refname);
493 
494 	len = sizeof(struct got_imsg_fetch_progress) + reflen;
495 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
496 		return got_error(GOT_ERR_NO_SPACE);
497 
498 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_PROGRESS, 0, 0, len);
499 	if (wbuf == NULL)
500 		return got_error_from_errno("imsg_create FETCH_PROGRESS");
501 
502 	/* Keep in sync with struct got_imsg_fetch_progress definition! */
503 	if (imsg_add(wbuf, refid->sha1, SHA1_DIGEST_LENGTH) == -1) {
504 		err = got_error_from_errno("imsg_add FETCH_PROGRESS");
505 		ibuf_free(wbuf);
506 		return err;
507 	}
508 	if (imsg_add(wbuf, refname, reflen) == -1) {
509 		err = got_error_from_errno("imsg_add FETCH_PROGRESS");
510 		ibuf_free(wbuf);
511 		return err;
512 	}
513 
514 	wbuf->fd = -1;
515 	imsg_close(ibuf, wbuf);
516 	return flush_imsg(ibuf);
517 }
518 
519 const struct got_error *
520 got_privsep_send_fetch_done(struct imsgbuf *ibuf, struct got_object_id hash)
521 {
522 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DONE, 0, 0, -1,
523 	    hash.sha1, SHA1_DIGEST_LENGTH) == -1)
524 		return got_error_from_errno("imsg_compose FETCH");
525 	return flush_imsg(ibuf);
526 }
527 
528 
529 const struct got_error *
530 got_privsep_recv_fetch_progress(int *done, struct got_object_id **id,
531     char **refname, struct got_pathlist_head *symrefs, struct imsgbuf *ibuf)
532 {
533 	const struct got_error *err = NULL;
534 	struct imsg imsg;
535 	size_t datalen;
536 	const size_t min_datalen =
537 	    MIN(MIN(sizeof(struct got_imsg_error),
538 	    sizeof(struct got_imsg_fetch_progress)),
539 	    sizeof(struct got_imsg_fetch_symrefs));
540 	struct got_imsg_fetch_symrefs *isymrefs = NULL;
541 	size_t n, remain;
542 	off_t off;
543 
544 	*done = 0;
545 	*id = NULL;
546 	*refname = NULL;
547 
548 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
549 	if (err)
550 		return err;
551 
552 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
553 	switch (imsg.hdr.type) {
554 	case GOT_IMSG_ERROR:
555 		err = recv_imsg_error(&imsg, datalen);
556 		break;
557 	case GOT_IMSG_FETCH_SYMREFS:
558 		if (datalen < sizeof(*isymrefs)) {
559 			err = got_error(GOT_ERR_PRIVSEP_LEN);
560 			break;
561 		}
562 		if (isymrefs != NULL) {
563 			err = got_error(GOT_ERR_PRIVSEP_MSG);
564 			break;
565 		}
566 		isymrefs = (struct got_imsg_fetch_symrefs *)imsg.data;
567 		off = sizeof(*isymrefs);
568 		remain = datalen - off;
569 		for (n = 0; n < isymrefs->nsymrefs; n++) {
570 			struct got_imsg_fetch_symref *s;
571 			char *name, *target;
572 			if (remain < sizeof(struct got_imsg_fetch_symref)) {
573 				err = got_error(GOT_ERR_PRIVSEP_LEN);
574 				goto done;
575 			}
576 			s = (struct got_imsg_fetch_symref *)(imsg.data + off);
577 			off += sizeof(*s);
578 			remain -= sizeof(*s);
579 			if (remain < s->name_len) {
580 				err = got_error(GOT_ERR_PRIVSEP_LEN);
581 				goto done;
582 			}
583 			name = strndup(imsg.data + off, s->name_len);
584 			if (name == NULL) {
585 				err = got_error_from_errno("strndup");
586 				goto done;
587 			}
588 			off += s->name_len;
589 			remain -= s->name_len;
590 			if (remain < s->target_len) {
591 				err = got_error(GOT_ERR_PRIVSEP_LEN);
592 				free(name);
593 				goto done;
594 			}
595 			target = strndup(imsg.data + off, s->target_len);
596 			if (target == NULL) {
597 				err = got_error_from_errno("strndup");
598 				free(name);
599 				goto done;
600 			}
601 			off += s->target_len;
602 			remain -= s->target_len;
603 			err = got_pathlist_append(symrefs, name, target);
604 			if (err) {
605 				free(name);
606 				free(target);
607 				goto done;
608 			}
609 		}
610 		break;
611 	case GOT_IMSG_FETCH_PROGRESS:
612 		*id = malloc(sizeof(**id));
613 		if (*id == NULL) {
614 			err = got_error_from_errno("malloc");
615 			break;
616 		}
617 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
618 		if (datalen <= SHA1_DIGEST_LENGTH) {
619 			err = got_error(GOT_ERR_PRIVSEP_MSG);
620 			break;
621 		}
622 		*refname = strndup(imsg.data + SHA1_DIGEST_LENGTH,
623 		    datalen - SHA1_DIGEST_LENGTH);
624 		if (*refname == NULL) {
625 			err = got_error_from_errno("strndup");
626 			break;
627 		}
628 		break;
629 	case GOT_IMSG_FETCH_DONE:
630 		*id = malloc(sizeof(**id));
631 		if (*id == NULL) {
632 			err = got_error_from_errno("malloc");
633 			break;
634 		}
635 		if (datalen != SHA1_DIGEST_LENGTH) {
636 			err = got_error(GOT_ERR_PRIVSEP_MSG);
637 			break;
638 		}
639 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
640 		*done = 1;
641 		break;
642 	default:
643 		err = got_error(GOT_ERR_PRIVSEP_MSG);
644 		break;
645 	}
646 done:
647 	if (err) {
648 		free(*id);
649 		*id = NULL;
650 		free(*refname);
651 		*refname = NULL;
652 	}
653 	imsg_free(&imsg);
654 	return err;
655 }
656 
657 const struct got_error *
658 got_privsep_send_index_pack_req(struct imsgbuf *ibuf, int fd, struct got_object_id *hash)
659 {
660 	const struct got_error *err = NULL;
661 
662 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_REQUEST, 0, 0, fd,
663 	    hash->sha1, SHA1_DIGEST_LENGTH) == -1) {
664 		err = got_error_from_errno("imsg_compose INDEX_REQUEST");
665 		close(fd);
666 		return err;
667 	}
668 	return flush_imsg(ibuf);
669 }
670 
671 const struct got_error *
672 got_privsep_send_index_pack_done(struct imsgbuf *ibuf)
673 {
674 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_DONE, 0, 0, -1, NULL, 0) == -1)
675 		return got_error_from_errno("imsg_compose FETCH");
676 	return flush_imsg(ibuf);
677 }
678 
679 const struct got_error *
680 got_privsep_wait_index_pack_done(struct imsgbuf *ibuf)
681 {
682 	const struct got_error *err = NULL;
683 	struct imsg imsg;
684 
685 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
686 	if (err)
687 		return err;
688 	if (imsg.hdr.type == GOT_IMSG_IDXPACK_DONE)
689 		return NULL;
690 	else
691 		return got_error(GOT_ERR_PRIVSEP_MSG);
692 	imsg_free(&imsg);
693 }
694 
695 const struct got_error *
696 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
697     struct imsgbuf *ibuf)
698 {
699 	const struct got_error *err = NULL;
700 	struct got_imsg_object *iobj;
701 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
702 
703 	if (datalen != sizeof(*iobj))
704 		return got_error(GOT_ERR_PRIVSEP_LEN);
705 	iobj = imsg->data;
706 
707 	*obj = calloc(1, sizeof(**obj));
708 	if (*obj == NULL)
709 		return got_error_from_errno("calloc");
710 
711 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
712 	(*obj)->type = iobj->type;
713 	(*obj)->flags = iobj->flags;
714 	(*obj)->hdrlen = iobj->hdrlen;
715 	(*obj)->size = iobj->size;
716 	/* path_packfile is handled by caller */
717 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
718 		(*obj)->pack_offset = iobj->pack_offset;
719 		(*obj)->pack_idx = iobj->pack_idx;
720 	}
721 
722 	return err;
723 }
724 
725 const struct got_error *
726 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
727 {
728 	const struct got_error *err = NULL;
729 	struct imsg imsg;
730 	const size_t min_datalen =
731 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
732 
733 	*obj = NULL;
734 
735 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
736 	if (err)
737 		return err;
738 
739 	switch (imsg.hdr.type) {
740 	case GOT_IMSG_OBJECT:
741 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
742 		break;
743 	default:
744 		err = got_error(GOT_ERR_PRIVSEP_MSG);
745 		break;
746 	}
747 
748 	imsg_free(&imsg);
749 
750 	return err;
751 }
752 
753 static const struct got_error *
754 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
755     size_t logmsg_len)
756 {
757 	const struct got_error *err = NULL;
758 	size_t offset, remain;
759 
760 	offset = 0;
761 	remain = logmsg_len;
762 	while (remain > 0) {
763 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
764 
765 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
766 		    commit->logmsg + offset, n) == -1) {
767 			err = got_error_from_errno("imsg_compose "
768 			    "COMMIT_LOGMSG");
769 			break;
770 		}
771 
772 		err = flush_imsg(ibuf);
773 		if (err)
774 			break;
775 
776 		offset += n;
777 		remain -= n;
778 	}
779 
780 	return err;
781 }
782 
783 const struct got_error *
784 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
785 {
786 	const struct got_error *err = NULL;
787 	struct got_imsg_commit_object *icommit;
788 	uint8_t *buf;
789 	size_t len, total;
790 	struct got_object_qid *qid;
791 	size_t author_len = strlen(commit->author);
792 	size_t committer_len = strlen(commit->committer);
793 	size_t logmsg_len = strlen(commit->logmsg);
794 
795 	total = sizeof(*icommit) + author_len + committer_len +
796 	    commit->nparents * SHA1_DIGEST_LENGTH;
797 
798 	buf = malloc(total);
799 	if (buf == NULL)
800 		return got_error_from_errno("malloc");
801 
802 	icommit = (struct got_imsg_commit_object *)buf;
803 	memcpy(icommit->tree_id, commit->tree_id->sha1,
804 	    sizeof(icommit->tree_id));
805 	icommit->author_len = author_len;
806 	icommit->author_time = commit->author_time;
807 	icommit->author_gmtoff = commit->author_gmtoff;
808 	icommit->committer_len = committer_len;
809 	icommit->committer_time = commit->committer_time;
810 	icommit->committer_gmtoff = commit->committer_gmtoff;
811 	icommit->logmsg_len = logmsg_len;
812 	icommit->nparents = commit->nparents;
813 
814 	len = sizeof(*icommit);
815 	memcpy(buf + len, commit->author, author_len);
816 	len += author_len;
817 	memcpy(buf + len, commit->committer, committer_len);
818 	len += committer_len;
819 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
820 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
821 		len += SHA1_DIGEST_LENGTH;
822 	}
823 
824 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
825 		err = got_error_from_errno("imsg_compose COMMIT");
826 		goto done;
827 	}
828 
829 	if (logmsg_len == 0 ||
830 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
831 		err = flush_imsg(ibuf);
832 		if (err)
833 			goto done;
834 	}
835 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
836 done:
837 	free(buf);
838 	return err;
839 }
840 
841 static const struct got_error *
842 get_commit_from_imsg(struct got_commit_object **commit,
843     struct imsg *imsg, size_t datalen, struct imsgbuf *ibuf)
844 {
845 	const struct got_error *err = NULL;
846 	struct got_imsg_commit_object *icommit;
847 	size_t len = 0;
848 	int i;
849 
850 	if (datalen < sizeof(*icommit))
851 		return got_error(GOT_ERR_PRIVSEP_LEN);
852 
853 	icommit = imsg->data;
854 	if (datalen != sizeof(*icommit) + icommit->author_len +
855 	    icommit->committer_len +
856 	    icommit->nparents * SHA1_DIGEST_LENGTH)
857 		return got_error(GOT_ERR_PRIVSEP_LEN);
858 
859 	if (icommit->nparents < 0)
860 		return got_error(GOT_ERR_PRIVSEP_LEN);
861 
862 	len += sizeof(*icommit);
863 
864 	*commit = got_object_commit_alloc_partial();
865 	if (*commit == NULL)
866 		return got_error_from_errno(
867 		    "got_object_commit_alloc_partial");
868 
869 	memcpy((*commit)->tree_id->sha1, icommit->tree_id,
870 	    SHA1_DIGEST_LENGTH);
871 	(*commit)->author_time = icommit->author_time;
872 	(*commit)->author_gmtoff = icommit->author_gmtoff;
873 	(*commit)->committer_time = icommit->committer_time;
874 	(*commit)->committer_gmtoff = icommit->committer_gmtoff;
875 
876 	if (icommit->author_len == 0) {
877 		(*commit)->author = strdup("");
878 		if ((*commit)->author == NULL) {
879 			err = got_error_from_errno("strdup");
880 			goto done;
881 		}
882 	} else {
883 		(*commit)->author = malloc(icommit->author_len + 1);
884 		if ((*commit)->author == NULL) {
885 			err = got_error_from_errno("malloc");
886 			goto done;
887 		}
888 		memcpy((*commit)->author, imsg->data + len,
889 		    icommit->author_len);
890 		(*commit)->author[icommit->author_len] = '\0';
891 	}
892 	len += icommit->author_len;
893 
894 	if (icommit->committer_len == 0) {
895 		(*commit)->committer = strdup("");
896 		if ((*commit)->committer == NULL) {
897 			err = got_error_from_errno("strdup");
898 			goto done;
899 		}
900 	} else {
901 		(*commit)->committer =
902 		    malloc(icommit->committer_len + 1);
903 		if ((*commit)->committer == NULL) {
904 			err = got_error_from_errno("malloc");
905 			goto done;
906 		}
907 		memcpy((*commit)->committer, imsg->data + len,
908 		    icommit->committer_len);
909 		(*commit)->committer[icommit->committer_len] = '\0';
910 	}
911 	len += icommit->committer_len;
912 
913 	if (icommit->logmsg_len == 0) {
914 		(*commit)->logmsg = strdup("");
915 		if ((*commit)->logmsg == NULL) {
916 			err = got_error_from_errno("strdup");
917 			goto done;
918 		}
919 	} else {
920 		size_t offset = 0, remain = icommit->logmsg_len;
921 
922 		(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
923 		if ((*commit)->logmsg == NULL) {
924 			err = got_error_from_errno("malloc");
925 			goto done;
926 		}
927 		while (remain > 0) {
928 			struct imsg imsg_log;
929 			size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
930 			    remain);
931 
932 			err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
933 			if (err)
934 				goto done;
935 
936 			if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG) {
937 				err = got_error(GOT_ERR_PRIVSEP_MSG);
938 				goto done;
939 			}
940 
941 			memcpy((*commit)->logmsg + offset,
942 			    imsg_log.data, n);
943 			imsg_free(&imsg_log);
944 			offset += n;
945 			remain -= n;
946 		}
947 		(*commit)->logmsg[icommit->logmsg_len] = '\0';
948 	}
949 
950 	for (i = 0; i < icommit->nparents; i++) {
951 		struct got_object_qid *qid;
952 
953 		err = got_object_qid_alloc_partial(&qid);
954 		if (err)
955 			break;
956 		memcpy(qid->id, imsg->data + len +
957 		    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
958 		SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
959 		(*commit)->nparents++;
960 	}
961 done:
962 	if (err) {
963 		got_object_commit_close(*commit);
964 		*commit = NULL;
965 	}
966 	return err;
967 }
968 
969 const struct got_error *
970 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
971 {
972 	const struct got_error *err = NULL;
973 	struct imsg imsg;
974 	size_t datalen;
975 	const size_t min_datalen =
976 	    MIN(sizeof(struct got_imsg_error),
977 	    sizeof(struct got_imsg_commit_object));
978 
979 	*commit = NULL;
980 
981 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
982 	if (err)
983 		return err;
984 
985 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
986 
987 	switch (imsg.hdr.type) {
988 	case GOT_IMSG_COMMIT:
989 		err = get_commit_from_imsg(commit, &imsg, datalen, ibuf);
990 		break;
991 	default:
992 		err = got_error(GOT_ERR_PRIVSEP_MSG);
993 		break;
994 	}
995 
996 	imsg_free(&imsg);
997 
998 	return err;
999 }
1000 
1001 const struct got_error *
1002 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_pathlist_head *entries,
1003     int nentries)
1004 {
1005 	const struct got_error *err = NULL;
1006 	struct got_imsg_tree_object itree;
1007 	struct got_pathlist_entry *pe;
1008 	size_t totlen;
1009 	int nimsg; /* number of imsg queued in ibuf */
1010 
1011 	itree.nentries = nentries;
1012 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
1013 	    == -1)
1014 		return got_error_from_errno("imsg_compose TREE");
1015 
1016 	totlen = sizeof(itree);
1017 	nimsg = 1;
1018 	TAILQ_FOREACH(pe, entries, entry) {
1019 		const char *name = pe->path;
1020 		struct got_parsed_tree_entry *pte = pe->data;
1021 		struct ibuf *wbuf;
1022 		size_t namelen = strlen(name);
1023 		size_t len = sizeof(struct got_imsg_tree_entry) + namelen;
1024 
1025 		if (len > MAX_IMSGSIZE)
1026 			return got_error(GOT_ERR_NO_SPACE);
1027 
1028 		nimsg++;
1029 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
1030 			err = flush_imsg(ibuf);
1031 			if (err)
1032 				return err;
1033 			nimsg = 0;
1034 		}
1035 
1036 		wbuf = imsg_create(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, len);
1037 		if (wbuf == NULL)
1038 			return got_error_from_errno("imsg_create TREE_ENTRY");
1039 
1040 		/* Keep in sync with struct got_imsg_tree_object definition! */
1041 		if (imsg_add(wbuf, pte->id, SHA1_DIGEST_LENGTH) == -1) {
1042 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1043 			ibuf_free(wbuf);
1044 			return err;
1045 		}
1046 		if (imsg_add(wbuf, &pte->mode, sizeof(pte->mode)) == -1) {
1047 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1048 			ibuf_free(wbuf);
1049 			return err;
1050 		}
1051 
1052 		if (imsg_add(wbuf, name, namelen) == -1) {
1053 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1054 			ibuf_free(wbuf);
1055 			return err;
1056 		}
1057 
1058 		wbuf->fd = -1;
1059 		imsg_close(ibuf, wbuf);
1060 
1061 		totlen += len;
1062 	}
1063 
1064 	return flush_imsg(ibuf);
1065 }
1066 
1067 const struct got_error *
1068 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
1069 {
1070 	const struct got_error *err = NULL;
1071 	const size_t min_datalen =
1072 	    MIN(sizeof(struct got_imsg_error),
1073 	    sizeof(struct got_imsg_tree_object));
1074 	struct got_imsg_tree_object *itree;
1075 	int nentries = 0;
1076 
1077 	*tree = NULL;
1078 get_more:
1079 	err = read_imsg(ibuf);
1080 	if (err)
1081 		goto done;
1082 
1083 	for (;;) {
1084 		struct imsg imsg;
1085 		size_t n;
1086 		size_t datalen;
1087 		struct got_imsg_tree_entry *ite;
1088 		struct got_tree_entry *te = NULL;
1089 
1090 		n = imsg_get(ibuf, &imsg);
1091 		if (n == 0) {
1092 			if (*tree && (*tree)->nentries != nentries)
1093 				goto get_more;
1094 			break;
1095 		}
1096 
1097 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
1098 			return got_error(GOT_ERR_PRIVSEP_LEN);
1099 
1100 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1101 
1102 		switch (imsg.hdr.type) {
1103 		case GOT_IMSG_ERROR:
1104 			err = recv_imsg_error(&imsg, datalen);
1105 			break;
1106 		case GOT_IMSG_TREE:
1107 			/* This message should only appear once. */
1108 			if (*tree != NULL) {
1109 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1110 				break;
1111 			}
1112 			if (datalen != sizeof(*itree)) {
1113 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1114 				break;
1115 			}
1116 			itree = imsg.data;
1117 			*tree = malloc(sizeof(**tree));
1118 			if (*tree == NULL) {
1119 				err = got_error_from_errno("malloc");
1120 				break;
1121 			}
1122 			(*tree)->entries = calloc(itree->nentries,
1123 			    sizeof(struct got_tree_entry));
1124 			if ((*tree)->entries == NULL) {
1125 				err = got_error_from_errno("malloc");
1126 				break;
1127 			}
1128 			(*tree)->nentries = itree->nentries;
1129 			(*tree)->refcnt = 0;
1130 			break;
1131 		case GOT_IMSG_TREE_ENTRY:
1132 			/* This message should be preceeded by GOT_IMSG_TREE. */
1133 			if (*tree == NULL) {
1134 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1135 				break;
1136 			}
1137 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
1138 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1139 				break;
1140 			}
1141 
1142 			/* Remaining data contains the entry's name. */
1143 			datalen -= sizeof(*ite);
1144 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
1145 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1146 				break;
1147 			}
1148 			ite = imsg.data;
1149 
1150 			if (datalen + 1 > sizeof(te->name)) {
1151 				err = got_error(GOT_ERR_NO_SPACE);
1152 				break;
1153 			}
1154 			te = &(*tree)->entries[nentries];
1155 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
1156 			te->name[datalen] = '\0';
1157 
1158 			memcpy(te->id.sha1, ite->id, SHA1_DIGEST_LENGTH);
1159 			te->mode = ite->mode;
1160 			te->idx = nentries;
1161 			nentries++;
1162 			break;
1163 		default:
1164 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1165 			break;
1166 		}
1167 
1168 		imsg_free(&imsg);
1169 	}
1170 done:
1171 	if (*tree && (*tree)->nentries != nentries) {
1172 		if (err == NULL)
1173 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1174 		got_object_tree_close(*tree);
1175 		*tree = NULL;
1176 	}
1177 
1178 	return err;
1179 }
1180 
1181 const struct got_error *
1182 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
1183     const uint8_t *data)
1184 {
1185 	struct got_imsg_blob iblob;
1186 
1187 	iblob.size = size;
1188 	iblob.hdrlen = hdrlen;
1189 
1190 	if (data) {
1191 		uint8_t *buf;
1192 
1193 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
1194 			return got_error(GOT_ERR_NO_SPACE);
1195 
1196 		buf = malloc(sizeof(iblob) + size);
1197 		if (buf == NULL)
1198 			return got_error_from_errno("malloc");
1199 
1200 		memcpy(buf, &iblob, sizeof(iblob));
1201 		memcpy(buf + sizeof(iblob), data, size);
1202 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
1203 		   sizeof(iblob) + size) == -1) {
1204 			free(buf);
1205 			return got_error_from_errno("imsg_compose BLOB");
1206 		}
1207 		free(buf);
1208 	} else {
1209 		/* Data has already been written to file descriptor. */
1210 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
1211 		    sizeof(iblob)) == -1)
1212 			return got_error_from_errno("imsg_compose BLOB");
1213 	}
1214 
1215 
1216 	return flush_imsg(ibuf);
1217 }
1218 
1219 const struct got_error *
1220 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
1221     struct imsgbuf *ibuf)
1222 {
1223 	const struct got_error *err = NULL;
1224 	struct imsg imsg;
1225 	struct got_imsg_blob *iblob;
1226 	size_t datalen;
1227 
1228 	*outbuf = NULL;
1229 
1230 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1231 	if (err)
1232 		return err;
1233 
1234 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1235 
1236 	switch (imsg.hdr.type) {
1237 	case GOT_IMSG_BLOB:
1238 		if (datalen < sizeof(*iblob)) {
1239 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1240 			break;
1241 		}
1242 		iblob = imsg.data;
1243 		*size = iblob->size;
1244 		*hdrlen = iblob->hdrlen;
1245 
1246 		if (datalen == sizeof(*iblob)) {
1247 			/* Data has been written to file descriptor. */
1248 			break;
1249 		}
1250 
1251 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX) {
1252 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1253 			break;
1254 		}
1255 
1256 		*outbuf = malloc(*size);
1257 		if (*outbuf == NULL) {
1258 			err = got_error_from_errno("malloc");
1259 			break;
1260 		}
1261 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
1262 		break;
1263 	default:
1264 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1265 		break;
1266 	}
1267 
1268 	imsg_free(&imsg);
1269 
1270 	return err;
1271 }
1272 
1273 static const struct got_error *
1274 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
1275 {
1276 	const struct got_error *err = NULL;
1277 	size_t offset, remain;
1278 
1279 	offset = 0;
1280 	remain = tagmsg_len;
1281 	while (remain > 0) {
1282 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1283 
1284 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
1285 		    tag->tagmsg + offset, n) == -1) {
1286 			err = got_error_from_errno("imsg_compose TAG_TAGMSG");
1287 			break;
1288 		}
1289 
1290 		err = flush_imsg(ibuf);
1291 		if (err)
1292 			break;
1293 
1294 		offset += n;
1295 		remain -= n;
1296 	}
1297 
1298 	return err;
1299 }
1300 
1301 const struct got_error *
1302 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
1303 {
1304 	const struct got_error *err = NULL;
1305 	struct got_imsg_tag_object *itag;
1306 	uint8_t *buf;
1307 	size_t len, total;
1308 	size_t tag_len = strlen(tag->tag);
1309 	size_t tagger_len = strlen(tag->tagger);
1310 	size_t tagmsg_len = strlen(tag->tagmsg);
1311 
1312 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
1313 
1314 	buf = malloc(total);
1315 	if (buf == NULL)
1316 		return got_error_from_errno("malloc");
1317 
1318 	itag = (struct got_imsg_tag_object *)buf;
1319 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
1320 	itag->obj_type = tag->obj_type;
1321 	itag->tag_len = tag_len;
1322 	itag->tagger_len = tagger_len;
1323 	itag->tagger_time = tag->tagger_time;
1324 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1325 	itag->tagmsg_len = tagmsg_len;
1326 
1327 	len = sizeof(*itag);
1328 	memcpy(buf + len, tag->tag, tag_len);
1329 	len += tag_len;
1330 	memcpy(buf + len, tag->tagger, tagger_len);
1331 	len += tagger_len;
1332 
1333 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1334 		err = got_error_from_errno("imsg_compose TAG");
1335 		goto done;
1336 	}
1337 
1338 	if (tagmsg_len == 0 ||
1339 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1340 		err = flush_imsg(ibuf);
1341 		if (err)
1342 			goto done;
1343 	}
1344 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1345 done:
1346 	free(buf);
1347 	return err;
1348 }
1349 
1350 const struct got_error *
1351 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1352 {
1353 	const struct got_error *err = NULL;
1354 	struct imsg imsg;
1355 	struct got_imsg_tag_object *itag;
1356 	size_t len, datalen;
1357 	const size_t min_datalen =
1358 	    MIN(sizeof(struct got_imsg_error),
1359 	    sizeof(struct got_imsg_tag_object));
1360 
1361 	*tag = NULL;
1362 
1363 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1364 	if (err)
1365 		return err;
1366 
1367 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1368 	len = 0;
1369 
1370 	switch (imsg.hdr.type) {
1371 	case GOT_IMSG_TAG:
1372 		if (datalen < sizeof(*itag)) {
1373 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1374 			break;
1375 		}
1376 		itag = imsg.data;
1377 		if (datalen != sizeof(*itag) + itag->tag_len +
1378 		    itag->tagger_len) {
1379 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1380 			break;
1381 		}
1382 		len += sizeof(*itag);
1383 
1384 		*tag = calloc(1, sizeof(**tag));
1385 		if (*tag == NULL) {
1386 			err = got_error_from_errno("calloc");
1387 			break;
1388 		}
1389 
1390 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1391 
1392 		if (itag->tag_len == 0) {
1393 			(*tag)->tag = strdup("");
1394 			if ((*tag)->tag == NULL) {
1395 				err = got_error_from_errno("strdup");
1396 				break;
1397 			}
1398 		} else {
1399 			(*tag)->tag = malloc(itag->tag_len + 1);
1400 			if ((*tag)->tag == NULL) {
1401 				err = got_error_from_errno("malloc");
1402 				break;
1403 			}
1404 			memcpy((*tag)->tag, imsg.data + len,
1405 			    itag->tag_len);
1406 			(*tag)->tag[itag->tag_len] = '\0';
1407 		}
1408 		len += itag->tag_len;
1409 
1410 		(*tag)->obj_type = itag->obj_type;
1411 		(*tag)->tagger_time = itag->tagger_time;
1412 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1413 
1414 		if (itag->tagger_len == 0) {
1415 			(*tag)->tagger = strdup("");
1416 			if ((*tag)->tagger == NULL) {
1417 				err = got_error_from_errno("strdup");
1418 				break;
1419 			}
1420 		} else {
1421 			(*tag)->tagger = malloc(itag->tagger_len + 1);
1422 			if ((*tag)->tagger == NULL) {
1423 				err = got_error_from_errno("malloc");
1424 				break;
1425 			}
1426 			memcpy((*tag)->tagger, imsg.data + len,
1427 			    itag->tagger_len);
1428 			(*tag)->tagger[itag->tagger_len] = '\0';
1429 		}
1430 		len += itag->tagger_len;
1431 
1432 		if (itag->tagmsg_len == 0) {
1433 			(*tag)->tagmsg = strdup("");
1434 			if ((*tag)->tagmsg == NULL) {
1435 				err = got_error_from_errno("strdup");
1436 				break;
1437 			}
1438 		} else {
1439 			size_t offset = 0, remain = itag->tagmsg_len;
1440 
1441 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1442 			if ((*tag)->tagmsg == NULL) {
1443 				err = got_error_from_errno("malloc");
1444 				break;
1445 			}
1446 			while (remain > 0) {
1447 				struct imsg imsg_log;
1448 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1449 				    remain);
1450 
1451 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1452 				if (err)
1453 					return err;
1454 
1455 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1456 					return got_error(GOT_ERR_PRIVSEP_MSG);
1457 
1458 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1459 				    n);
1460 				imsg_free(&imsg_log);
1461 				offset += n;
1462 				remain -= n;
1463 			}
1464 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1465 		}
1466 
1467 		break;
1468 	default:
1469 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1470 		break;
1471 	}
1472 
1473 	imsg_free(&imsg);
1474 
1475 	return err;
1476 }
1477 
1478 const struct got_error *
1479 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1480     struct got_packidx *packidx)
1481 {
1482 	const struct got_error *err = NULL;
1483 	struct got_imsg_packidx ipackidx;
1484 	struct got_imsg_pack ipack;
1485 	int fd;
1486 
1487 	ipackidx.len = packidx->len;
1488 	fd = dup(packidx->fd);
1489 	if (fd == -1)
1490 		return got_error_from_errno("dup");
1491 
1492 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1493 	    sizeof(ipackidx)) == -1) {
1494 		err = got_error_from_errno("imsg_compose PACKIDX");
1495 		close(fd);
1496 		return err;
1497 	}
1498 
1499 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1500 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1501 		return got_error(GOT_ERR_NO_SPACE);
1502 	ipack.filesize = pack->filesize;
1503 
1504 	fd = dup(pack->fd);
1505 	if (fd == -1)
1506 		return got_error_from_errno("dup");
1507 
1508 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
1509 	    == -1) {
1510 		err = got_error_from_errno("imsg_compose PACK");
1511 		close(fd);
1512 		return err;
1513 	}
1514 
1515 	return flush_imsg(ibuf);
1516 }
1517 
1518 const struct got_error *
1519 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
1520     struct got_object_id *id)
1521 {
1522 	struct got_imsg_packed_object iobj;
1523 
1524 	iobj.idx = idx;
1525 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1526 
1527 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
1528 	    &iobj, sizeof(iobj)) == -1)
1529 		return got_error_from_errno("imsg_compose "
1530 		    "PACKED_OBJECT_REQUEST");
1531 
1532 	return flush_imsg(ibuf);
1533 }
1534 
1535 const struct got_error *
1536 got_privsep_send_gitconfig_parse_req(struct imsgbuf *ibuf, int fd)
1537 {
1538 	const struct got_error *err = NULL;
1539 
1540 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_PARSE_REQUEST, 0, 0, fd,
1541 	    NULL, 0) == -1) {
1542 		err = got_error_from_errno("imsg_compose "
1543 		    "GITCONFIG_PARSE_REQUEST");
1544 		close(fd);
1545 		return err;
1546 	}
1547 
1548 	return flush_imsg(ibuf);
1549 }
1550 
1551 const struct got_error *
1552 got_privsep_send_gitconfig_repository_format_version_req(struct imsgbuf *ibuf)
1553 {
1554 	if (imsg_compose(ibuf,
1555 	    GOT_IMSG_GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST, 0, 0, -1,
1556 	    NULL, 0) == -1)
1557 		return got_error_from_errno("imsg_compose "
1558 		    "GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST");
1559 
1560 	return flush_imsg(ibuf);
1561 }
1562 
1563 const struct got_error *
1564 got_privsep_send_gitconfig_author_name_req(struct imsgbuf *ibuf)
1565 {
1566 	if (imsg_compose(ibuf,
1567 	    GOT_IMSG_GITCONFIG_AUTHOR_NAME_REQUEST, 0, 0, -1, NULL, 0) == -1)
1568 		return got_error_from_errno("imsg_compose "
1569 		    "GITCONFIG_AUTHOR_NAME_REQUEST");
1570 
1571 	return flush_imsg(ibuf);
1572 }
1573 
1574 const struct got_error *
1575 got_privsep_send_gitconfig_author_email_req(struct imsgbuf *ibuf)
1576 {
1577 	if (imsg_compose(ibuf,
1578 	    GOT_IMSG_GITCONFIG_AUTHOR_EMAIL_REQUEST, 0, 0, -1, NULL, 0) == -1)
1579 		return got_error_from_errno("imsg_compose "
1580 		    "GITCONFIG_AUTHOR_EMAIL_REQUEST");
1581 
1582 	return flush_imsg(ibuf);
1583 }
1584 
1585 const struct got_error *
1586 got_privsep_send_gitconfig_remotes_req(struct imsgbuf *ibuf)
1587 {
1588 	if (imsg_compose(ibuf,
1589 	    GOT_IMSG_GITCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
1590 		return got_error_from_errno("imsg_compose "
1591 		    "GITCONFIG_REMOTE_REQUEST");
1592 
1593 	return flush_imsg(ibuf);
1594 }
1595 
1596 const struct got_error *
1597 got_privsep_send_gitconfig_owner_req(struct imsgbuf *ibuf)
1598 {
1599 	if (imsg_compose(ibuf,
1600 	    GOT_IMSG_GITCONFIG_OWNER_REQUEST, 0, 0, -1, NULL, 0) == -1)
1601 		return got_error_from_errno("imsg_compose "
1602 		    "GITCONFIG_OWNER_REQUEST");
1603 
1604 	return flush_imsg(ibuf);
1605 }
1606 
1607 const struct got_error *
1608 got_privsep_send_gitconfig_str(struct imsgbuf *ibuf, const char *value)
1609 {
1610 	size_t len = value ? strlen(value) + 1 : 0;
1611 
1612 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_STR_VAL, 0, 0, -1,
1613 	    value, len) == -1)
1614 		return got_error_from_errno("imsg_compose GITCONFIG_STR_VAL");
1615 
1616 	return flush_imsg(ibuf);
1617 }
1618 
1619 const struct got_error *
1620 got_privsep_recv_gitconfig_str(char **str, struct imsgbuf *ibuf)
1621 {
1622 	const struct got_error *err = NULL;
1623 	struct imsg imsg;
1624 	size_t datalen;
1625 	const size_t min_datalen = 0;
1626 
1627 	*str = NULL;
1628 
1629 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1630 	if (err)
1631 		return err;
1632 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1633 
1634 	switch (imsg.hdr.type) {
1635 	case GOT_IMSG_GITCONFIG_STR_VAL:
1636 		if (datalen == 0)
1637 			break;
1638 		*str = malloc(datalen);
1639 		if (*str == NULL) {
1640 			err = got_error_from_errno("malloc");
1641 			break;
1642 		}
1643 		if (strlcpy(*str, imsg.data, datalen) >= datalen)
1644 			err = got_error(GOT_ERR_NO_SPACE);
1645 		break;
1646 	default:
1647 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1648 		break;
1649 	}
1650 
1651 	imsg_free(&imsg);
1652 	return err;
1653 }
1654 
1655 const struct got_error *
1656 got_privsep_send_gitconfig_int(struct imsgbuf *ibuf, int value)
1657 {
1658 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_INT_VAL, 0, 0, -1,
1659 	    &value, sizeof(value)) == -1)
1660 		return got_error_from_errno("imsg_compose GITCONFIG_INT_VAL");
1661 
1662 	return flush_imsg(ibuf);
1663 }
1664 
1665 const struct got_error *
1666 got_privsep_recv_gitconfig_int(int *val, struct imsgbuf *ibuf)
1667 {
1668 	const struct got_error *err = NULL;
1669 	struct imsg imsg;
1670 	size_t datalen;
1671 	const size_t min_datalen =
1672 	    MIN(sizeof(struct got_imsg_error), sizeof(int));
1673 
1674 	*val = 0;
1675 
1676 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1677 	if (err)
1678 		return err;
1679 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1680 
1681 	switch (imsg.hdr.type) {
1682 	case GOT_IMSG_GITCONFIG_INT_VAL:
1683 		if (datalen != sizeof(*val)) {
1684 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1685 			break;
1686 		}
1687 		memcpy(val, imsg.data, sizeof(*val));
1688 		break;
1689 	default:
1690 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1691 		break;
1692 	}
1693 
1694 	imsg_free(&imsg);
1695 	return err;
1696 }
1697 
1698 const struct got_error *
1699 got_privsep_send_gitconfig_remotes(struct imsgbuf *ibuf,
1700     struct got_remote_repo *remotes, int nremotes)
1701 {
1702 	const struct got_error *err = NULL;
1703 	struct got_imsg_remotes iremotes;
1704 	int i;
1705 
1706 	iremotes.nremotes = nremotes;
1707 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_REMOTES, 0, 0, -1,
1708 	    &iremotes, sizeof(iremotes)) == -1)
1709 		return got_error_from_errno("imsg_compose GITCONFIG_REMOTES");
1710 
1711 	err = flush_imsg(ibuf);
1712 	imsg_clear(ibuf);
1713 	if (err)
1714 		return err;
1715 
1716 	for (i = 0; i < nremotes; i++) {
1717 		struct got_imsg_remote iremote;
1718 		size_t len = sizeof(iremote);
1719 		struct ibuf *wbuf;
1720 
1721 		iremote.name_len = strlen(remotes[i].name);
1722 		len += iremote.name_len;
1723 		iremote.url_len = strlen(remotes[i].url);
1724 		len += iremote.url_len;
1725 
1726 		wbuf = imsg_create(ibuf, GOT_IMSG_GITCONFIG_REMOTE, 0, 0, len);
1727 		if (wbuf == NULL)
1728 			return got_error_from_errno(
1729 			    "imsg_create GITCONFIG_REMOTE");
1730 
1731 		if (imsg_add(wbuf, &iremote, sizeof(iremote)) == -1) {
1732 			err = got_error_from_errno(
1733 			    "imsg_add GIITCONFIG_REMOTE");
1734 			ibuf_free(wbuf);
1735 			return err;
1736 		}
1737 
1738 		if (imsg_add(wbuf, remotes[i].name, iremote.name_len) == -1) {
1739 			err = got_error_from_errno(
1740 			    "imsg_add GIITCONFIG_REMOTE");
1741 			ibuf_free(wbuf);
1742 			return err;
1743 		}
1744 		if (imsg_add(wbuf, remotes[i].url, iremote.url_len) == -1) {
1745 			err = got_error_from_errno(
1746 			    "imsg_add GIITCONFIG_REMOTE");
1747 			ibuf_free(wbuf);
1748 			return err;
1749 		}
1750 
1751 		wbuf->fd = -1;
1752 		imsg_close(ibuf, wbuf);
1753 		err = flush_imsg(ibuf);
1754 		if (err)
1755 			return err;
1756 	}
1757 
1758 	return NULL;
1759 }
1760 
1761 const struct got_error *
1762 got_privsep_recv_gitconfig_remotes(struct got_remote_repo **remotes,
1763     int *nremotes, struct imsgbuf *ibuf)
1764 {
1765 	const struct got_error *err = NULL;
1766 	struct imsg imsg;
1767 	size_t datalen;
1768 	struct got_imsg_remotes iremotes;
1769 	struct got_imsg_remote iremote;
1770 
1771 	*remotes = NULL;
1772 	*nremotes = 0;
1773 	iremotes.nremotes = 0;
1774 
1775 	err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremotes));
1776 	if (err)
1777 		return err;
1778 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1779 
1780 	switch (imsg.hdr.type) {
1781 	case GOT_IMSG_GITCONFIG_REMOTES:
1782 		if (datalen != sizeof(iremotes)) {
1783 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1784 			break;
1785 		}
1786 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
1787 		if (iremotes.nremotes == 0) {
1788 			imsg_free(&imsg);
1789 			return NULL;
1790 		}
1791 		break;
1792 	default:
1793 		imsg_free(&imsg);
1794 		return got_error(GOT_ERR_PRIVSEP_MSG);
1795 	}
1796 
1797 	imsg_free(&imsg);
1798 
1799 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(iremote));
1800 	if (*remotes == NULL)
1801 		return got_error_from_errno("recallocarray");
1802 
1803 	while (*nremotes < iremotes.nremotes) {
1804 		struct got_remote_repo *remote;
1805 	
1806 		err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremote));
1807 		if (err)
1808 			break;
1809 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1810 
1811 		switch (imsg.hdr.type) {
1812 		case GOT_IMSG_GITCONFIG_REMOTE:
1813 			remote = &(*remotes)[*nremotes];
1814 			if (datalen < sizeof(iremote)) {
1815 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1816 				break;
1817 			}
1818 			memcpy(&iremote, imsg.data, sizeof(iremote));
1819 			if (iremote.name_len == 0 || iremote.url_len == 0 ||
1820 			    (sizeof(iremote) + iremote.name_len +
1821 			    iremote.url_len) > datalen) {
1822 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1823 				break;
1824 			}
1825 			remote->name = strndup(imsg.data + sizeof(iremote),
1826 			    iremote.name_len);
1827 			if (remote->name == NULL) {
1828 				err = got_error_from_errno("strndup");
1829 				break;
1830 			}
1831 			remote->url = strndup(imsg.data + sizeof(iremote) +
1832 			    iremote.name_len, iremote.url_len);
1833 			if (remote->url == NULL) {
1834 				err = got_error_from_errno("strndup");
1835 				free(remote->name);
1836 				break;
1837 			}
1838 			(*nremotes)++;
1839 			break;
1840 		default:
1841 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1842 			break;
1843 		}
1844 
1845 		imsg_free(&imsg);
1846 		if (err)
1847 			break;
1848 	}
1849 
1850 	if (err) {
1851 		int i;
1852 		for (i = 0; i < *nremotes; i++) {
1853 			free((*remotes)[i].name);
1854 			free((*remotes)[i].url);
1855 		}
1856 		free(*remotes);
1857 		*remotes = NULL;
1858 		*nremotes = 0;
1859 	}
1860 	return err;
1861 }
1862 
1863 const struct got_error *
1864 got_privsep_send_commit_traversal_request(struct imsgbuf *ibuf,
1865      struct got_object_id *id, int idx, const char *path)
1866 {
1867 	const struct got_error *err = NULL;
1868 	struct ibuf *wbuf;
1869 	size_t path_len = strlen(path) + 1;
1870 
1871 	wbuf = imsg_create(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_REQUEST, 0, 0,
1872 	    sizeof(struct got_imsg_commit_traversal_request) + path_len);
1873 	if (wbuf == NULL)
1874 		return got_error_from_errno(
1875 		    "imsg_create COMMIT_TRAVERSAL_REQUEST");
1876 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
1877 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1878 		ibuf_free(wbuf);
1879 		return err;
1880 	}
1881 	if (imsg_add(wbuf, &idx, sizeof(idx)) == -1) {
1882 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1883 		ibuf_free(wbuf);
1884 		return err;
1885 	}
1886 	if (imsg_add(wbuf, path, path_len) == -1) {
1887 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1888 		ibuf_free(wbuf);
1889 		return err;
1890 	}
1891 
1892 	wbuf->fd = -1;
1893 	imsg_close(ibuf, wbuf);
1894 
1895 	return flush_imsg(ibuf);
1896 }
1897 
1898 const struct got_error *
1899 got_privsep_send_traversed_commits(struct got_object_id *commit_ids, 
1900     size_t ncommits, struct imsgbuf *ibuf)
1901 {
1902 	const struct got_error *err;
1903 	struct ibuf *wbuf;
1904 	int i;
1905 
1906 	wbuf = imsg_create(ibuf, GOT_IMSG_TRAVERSED_COMMITS, 0, 0,
1907 	    sizeof(struct got_imsg_traversed_commits) +
1908 	    ncommits * SHA1_DIGEST_LENGTH);
1909 	if (wbuf == NULL)
1910 		return got_error_from_errno("imsg_create TRAVERSED_COMMITS");
1911 
1912 	if (imsg_add(wbuf, &ncommits, sizeof(ncommits)) == -1) {
1913 		err = got_error_from_errno("imsg_add TRAVERSED_COMMITS");
1914 		ibuf_free(wbuf);
1915 		return err;
1916 	}
1917 	for (i = 0; i < ncommits; i++) {
1918 		struct got_object_id *id = &commit_ids[i];
1919 		if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
1920 			err = got_error_from_errno(
1921 			    "imsg_add TRAVERSED_COMMITS");
1922 			ibuf_free(wbuf);
1923 			return err;
1924 		}
1925 	}
1926 
1927 	wbuf->fd = -1;
1928 	imsg_close(ibuf, wbuf);
1929 
1930 	return flush_imsg(ibuf);
1931 }
1932 
1933 const struct got_error *
1934 got_privsep_recv_traversed_commits(struct got_commit_object **changed_commit,
1935     struct got_object_id **changed_commit_id,
1936     struct got_object_id_queue *commit_ids, struct imsgbuf *ibuf)
1937 {
1938 	const struct got_error *err = NULL;
1939 	struct imsg imsg;
1940 	struct got_imsg_traversed_commits *icommits;
1941 	size_t datalen;
1942 	int i, done = 0;
1943 
1944 	*changed_commit = NULL;
1945 	*changed_commit_id = NULL;
1946 
1947 	while (!done) {
1948 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1949 		if (err)
1950 			return err;
1951 
1952 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1953 		switch (imsg.hdr.type) {
1954 		case GOT_IMSG_TRAVERSED_COMMITS:
1955 			icommits = imsg.data;
1956 			if (datalen != sizeof(*icommits) +
1957 			    icommits->ncommits * SHA1_DIGEST_LENGTH) {
1958 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1959 				break;
1960 			}
1961 			for (i = 0; i < icommits->ncommits; i++) {
1962 				struct got_object_qid *qid;
1963 				uint8_t *sha1 = (uint8_t *)imsg.data +
1964 				    sizeof(*icommits) + i * SHA1_DIGEST_LENGTH;
1965 				err = got_object_qid_alloc_partial(&qid);
1966 				if (err)
1967 					break;
1968 				memcpy(qid->id->sha1, sha1, SHA1_DIGEST_LENGTH);
1969 				SIMPLEQ_INSERT_TAIL(commit_ids, qid, entry);
1970 
1971 				/* The last commit may contain a change. */
1972 				if (i == icommits->ncommits - 1) {
1973 					*changed_commit_id =
1974 					    got_object_id_dup(qid->id);
1975 					if (*changed_commit_id == NULL) {
1976 						err = got_error_from_errno(
1977 						    "got_object_id_dup");
1978 						break;
1979 					}
1980 				}
1981 			}
1982 			break;
1983 		case GOT_IMSG_COMMIT:
1984 			if (*changed_commit_id == NULL) {
1985 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1986 				break;
1987 			}
1988 			err = get_commit_from_imsg(changed_commit, &imsg,
1989 			    datalen, ibuf);
1990 			break;
1991 		case GOT_IMSG_COMMIT_TRAVERSAL_DONE:
1992 			done = 1;
1993 			break;
1994 		default:
1995 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1996 			break;
1997 		}
1998 
1999 		imsg_free(&imsg);
2000 		if (err)
2001 			break;
2002 	}
2003 
2004 	if (err)
2005 		got_object_id_queue_free(commit_ids);
2006 	return err;
2007 }
2008 
2009 const struct got_error *
2010 got_privsep_send_commit_traversal_done(struct imsgbuf *ibuf)
2011 {
2012 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_DONE, 0, 0, -1,
2013 	    NULL, 0) == -1)
2014 		return got_error_from_errno("imsg_compose TRAVERSAL_DONE");
2015 
2016 	return flush_imsg(ibuf);
2017 }
2018 
2019 const struct got_error *
2020 got_privsep_unveil_exec_helpers(void)
2021 {
2022 	const char *helpers[] = {
2023 	    GOT_PATH_PROG_READ_PACK,
2024 	    GOT_PATH_PROG_READ_OBJECT,
2025 	    GOT_PATH_PROG_READ_COMMIT,
2026 	    GOT_PATH_PROG_READ_TREE,
2027 	    GOT_PATH_PROG_READ_BLOB,
2028 	    GOT_PATH_PROG_READ_TAG,
2029 	    GOT_PATH_PROG_READ_GITCONFIG,
2030 	};
2031 	int i;
2032 
2033 	for (i = 0; i < nitems(helpers); i++) {
2034 		if (unveil(helpers[i], "x") == 0)
2035 			continue;
2036 		return got_error_from_errno2("unveil", helpers[i]);
2037 	}
2038 
2039 	return NULL;
2040 }
2041 
2042 void
2043 got_privsep_exec_child(int imsg_fds[2], const char *path, const char *repo_path)
2044 {
2045 	if (close(imsg_fds[0]) != 0) {
2046 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2047 		_exit(1);
2048 	}
2049 
2050 	if (dup2(imsg_fds[1], GOT_IMSG_FD_CHILD) == -1) {
2051 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2052 		_exit(1);
2053 	}
2054 	if (closefrom(GOT_IMSG_FD_CHILD + 1) == -1) {
2055 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2056 		_exit(1);
2057 	}
2058 
2059 	if (execl(path, path, repo_path, (char *)NULL) == -1) {
2060 		fprintf(stderr, "%s: %s: %s\n", getprogname(), path,
2061 		    strerror(errno));
2062 		_exit(1);
2063 	}
2064 }