1 /*
2  * Copyright (c) 2018, 2019, 2020 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2020 Ori Bernstein <ori@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/uio.h>
20 #include <sys/wait.h>
21 
22 #include <ctype.h>
23 #include <limits.h>
24 #include <signal.h>
25 #include <stdio.h>
26 #include <stdlib.h>
27 #include <string.h>
28 #include <errno.h>
29 #include <stdint.h>
30 #include <poll.h>
31 #include <unistd.h>
32 #include <zlib.h>
33 #include <time.h>
34 
35 #include "got_compat.h"
36 
37 #include "got_object.h"
38 #include "got_error.h"
39 #include "got_path.h"
40 #include "got_repository.h"
41 
42 #include "got_lib_sha1.h"
43 #include "got_lib_delta.h"
44 #include "got_lib_inflate.h"
45 #include "got_lib_object.h"
46 #include "got_lib_object_parse.h"
47 #include "got_lib_privsep.h"
48 #include "got_lib_pack.h"
49 
50 #include "got_privsep.h"
51 
52 #ifndef MIN
53 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
54 #endif
55 
56 #ifndef nitems
57 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
58 #endif
59 
60 static const struct got_error *
61 poll_fd(int fd, int events, int timeout)
62 {
63 	struct pollfd pfd[1];
64 	struct timespec ts;
65 	sigset_t sigset;
66 	int n;
67 
68 	pfd[0].fd = fd;
69 	pfd[0].events = events;
70 
71 	ts.tv_sec = timeout;
72 	ts.tv_nsec = 0;
73 
74 	if (sigemptyset(&sigset) == -1)
75 		return got_error_from_errno("sigemptyset");
76 	if (sigaddset(&sigset, SIGWINCH) == -1)
77 		return got_error_from_errno("sigaddset");
78 
79 	n = ppoll(pfd, 1, timeout == INFTIM ? NULL : &ts, &sigset);
80 	if (n == -1)
81 		return got_error_from_errno("ppoll");
82 	if (n == 0)
83 		return got_error(GOT_ERR_TIMEOUT);
84 	if (pfd[0].revents & (POLLERR | POLLNVAL))
85 		return got_error_from_errno("poll error");
86 	if (pfd[0].revents & (events | POLLHUP))
87 		return NULL;
88 
89 	return got_error(GOT_ERR_INTERRUPT);
90 }
91 
92 static const struct got_error *
93 read_imsg(struct imsgbuf *ibuf)
94 {
95 	const struct got_error *err;
96 	size_t n;
97 
98 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
99 	if (err)
100 		return err;
101 
102 	n = imsg_read(ibuf);
103 	if (n == -1) {
104 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
105 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
106 		return got_error(GOT_ERR_PRIVSEP_READ);
107 	}
108 	if (n == 0)
109 		return got_error(GOT_ERR_PRIVSEP_PIPE);
110 
111 	return NULL;
112 }
113 
114 const struct got_error *
115 got_privsep_wait_for_child(pid_t pid)
116 {
117 	int child_status;
118 
119 	if (waitpid(pid, &child_status, 0) == -1)
120 		return got_error_from_errno("waitpid");
121 
122 	if (!WIFEXITED(child_status))
123 		return got_error(GOT_ERR_PRIVSEP_DIED);
124 
125 	if (WEXITSTATUS(child_status) != 0)
126 		return got_error(GOT_ERR_PRIVSEP_EXIT);
127 
128 	return NULL;
129 }
130 
131 static const struct got_error *
132 recv_imsg_error(struct imsg *imsg, size_t datalen)
133 {
134 	struct got_imsg_error *ierr;
135 
136 	if (datalen != sizeof(*ierr))
137 		return got_error(GOT_ERR_PRIVSEP_LEN);
138 
139 	ierr = imsg->data;
140 	if (ierr->code == GOT_ERR_ERRNO) {
141 		static struct got_error serr;
142 		serr.code = GOT_ERR_ERRNO;
143 		serr.msg = strerror(ierr->errno_code);
144 		return &serr;
145 	}
146 
147 	return got_error(ierr->code);
148 }
149 
150 const struct got_error *
151 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
152     size_t min_datalen)
153 {
154 	const struct got_error *err;
155 	ssize_t n;
156 
157 	n = imsg_get(ibuf, imsg);
158 	if (n == -1)
159 		return got_error_from_errno("imsg_get");
160 
161 	while (n == 0) {
162 		err = read_imsg(ibuf);
163 		if (err)
164 			return err;
165 		n = imsg_get(ibuf, imsg);
166 		if (n == -1)
167 			return got_error_from_errno("imsg_get");
168 	}
169 
170 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
171 		return got_error(GOT_ERR_PRIVSEP_LEN);
172 
173 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
174 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
175 		return recv_imsg_error(imsg, datalen);
176 	}
177 
178 	return NULL;
179 }
180 
181 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
182 void
183 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
184 {
185 	const struct got_error *poll_err;
186 	struct got_imsg_error ierr;
187 	int ret;
188 
189 	ierr.code = err->code;
190 	if (err->code == GOT_ERR_ERRNO)
191 		ierr.errno_code = errno;
192 	else
193 		ierr.errno_code = 0;
194 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
195 	if (ret == -1) {
196 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
197 		    getprogname(), err->code, err->msg, strerror(errno));
198 		return;
199 	}
200 
201 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
202 	if (poll_err) {
203 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
204 		    getprogname(), err->code, err->msg, poll_err->msg);
205 		return;
206 	}
207 
208 	ret = imsg_flush(ibuf);
209 	if (ret == -1) {
210 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
211 		    getprogname(), err->code, err->msg, strerror(errno));
212 		imsg_clear(ibuf);
213 		return;
214 	}
215 }
216 
217 static const struct got_error *
218 flush_imsg(struct imsgbuf *ibuf)
219 {
220 	const struct got_error *err;
221 
222 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
223 	if (err)
224 		return err;
225 
226 	if (imsg_flush(ibuf) == -1) {
227 		imsg_clear(ibuf);
228 		return got_error_from_errno("imsg_flush");
229 	}
230 
231 	return NULL;
232 }
233 
234 const struct got_error *
235 got_privsep_flush_imsg(struct imsgbuf *ibuf)
236 {
237 	return flush_imsg(ibuf);
238 }
239 
240 const struct got_error *
241 got_privsep_send_stop(int fd)
242 {
243 	const struct got_error *err = NULL;
244 	struct imsgbuf ibuf;
245 
246 	imsg_init(&ibuf, fd);
247 
248 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
249 		return got_error_from_errno("imsg_compose STOP");
250 
251 	err = flush_imsg(&ibuf);
252 	return err;
253 }
254 
255 const struct got_error *
256 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd,
257     struct got_object_id *id)
258 {
259 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd,
260 	    id, sizeof(*id)) == -1)
261 		return got_error_from_errno("imsg_compose OBJECT_REQUEST");
262 
263 	return flush_imsg(ibuf);
264 }
265 
266 const struct got_error *
267 got_privsep_send_raw_obj_req(struct imsgbuf *ibuf, int fd,
268     struct got_object_id *id)
269 {
270 	if (imsg_compose(ibuf, GOT_IMSG_RAW_OBJECT_REQUEST, 0, 0, fd,
271 	    id, sizeof(*id)) == -1)
272 		return got_error_from_errno("imsg_compose RAW_OBJECT_REQUEST");
273 
274 	return flush_imsg(ibuf);
275 }
276 
277 const struct got_error *
278 got_privsep_send_raw_obj_outfd(struct imsgbuf *ibuf, int outfd)
279 {
280 	const struct got_error *err = NULL;
281 
282 	if (imsg_compose(ibuf, GOT_IMSG_RAW_OBJECT_OUTFD, 0, 0, outfd, NULL, 0)
283 	    == -1) {
284 		err = got_error_from_errno("imsg_compose RAW_OBJECT_OUTFD");
285 		close(outfd);
286 		return err;
287 	}
288 
289 	return flush_imsg(ibuf);
290 }
291 
292 const struct got_error *
293 got_privsep_send_raw_obj(struct imsgbuf *ibuf, off_t size, size_t hdrlen,
294     uint8_t *data)
295 {
296 	const struct got_error *err = NULL;
297 	struct got_imsg_raw_obj iobj;
298 	size_t len = sizeof(iobj);
299 	struct ibuf *wbuf;
300 
301 	memset(&iobj, 0, sizeof(iobj));
302 	iobj.hdrlen = hdrlen;
303 	iobj.size = size;
304 
305 	if (data && size + hdrlen <= GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX)
306 		len += (size_t)size + hdrlen;
307 
308 	wbuf = imsg_create(ibuf, GOT_IMSG_RAW_OBJECT, 0, 0, len);
309 	if (wbuf == NULL) {
310 		err = got_error_from_errno("imsg_create RAW_OBJECT");
311 		return err;
312 	}
313 
314 	if (imsg_add(wbuf, &iobj, sizeof(iobj)) == -1)
315 		return got_error_from_errno("imsg_add RAW_OBJECT");
316 
317 	if (data && size + hdrlen <= GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX) {
318 		if (imsg_add(wbuf, data, size + hdrlen) == -1)
319 			return got_error_from_errno("imsg_add RAW_OBJECT");
320 	}
321 
322 	wbuf->fd = -1;
323 	imsg_close(ibuf, wbuf);
324 
325 	return flush_imsg(ibuf);
326 }
327 
328 const struct got_error *
329 got_privsep_recv_raw_obj(uint8_t **outbuf, off_t *size, size_t *hdrlen,
330     struct imsgbuf *ibuf)
331 {
332 	const struct got_error *err = NULL;
333 	struct imsg imsg;
334 	struct got_imsg_raw_obj *iobj;
335 	size_t datalen;
336 
337 	*outbuf = NULL;
338 
339 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
340 	if (err)
341 		return err;
342 
343 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
344 
345 	switch (imsg.hdr.type) {
346 	case GOT_IMSG_RAW_OBJECT:
347 		if (datalen < sizeof(*iobj)) {
348 			err = got_error(GOT_ERR_PRIVSEP_LEN);
349 			break;
350 		}
351 		iobj = imsg.data;
352 		*size = iobj->size;
353 		*hdrlen = iobj->hdrlen;
354 
355 		if (datalen == sizeof(*iobj)) {
356 			/* Data has been written to file descriptor. */
357 			break;
358 		}
359 
360 		if (*size < 0 ||
361 		    *size + *hdrlen > GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX) {
362 			err = got_error(GOT_ERR_PRIVSEP_LEN);
363 			break;
364 		}
365 
366 		*outbuf = malloc(*size + *hdrlen);
367 		if (*outbuf == NULL) {
368 			err = got_error_from_errno("malloc");
369 			break;
370 		}
371 		memcpy(*outbuf, imsg.data + sizeof(*iobj), *size + *hdrlen);
372 		break;
373 	default:
374 		err = got_error(GOT_ERR_PRIVSEP_MSG);
375 		break;
376 	}
377 
378 	imsg_free(&imsg);
379 
380 	return err;
381 }
382 
383 const struct got_error *
384 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
385     struct got_object_id *id, int pack_idx)
386 {
387 	const struct got_error *err = NULL;
388 	struct got_imsg_packed_object iobj;
389 	void *data;
390 	size_t len;
391 
392 	memset(&iobj, 0, sizeof(iobj));
393 	if (pack_idx != -1) { /* commit is packed */
394 		iobj.idx = pack_idx;
395 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
396 		data = &iobj;
397 		len = sizeof(iobj);
398 	} else {
399 		data = id;
400 		len = sizeof(*id);
401 	}
402 
403 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, data, len)
404 	    == -1) {
405 		err = got_error_from_errno("imsg_compose COMMIT_REQUEST");
406 		close(fd);
407 		return err;
408 	}
409 
410 	return flush_imsg(ibuf);
411 }
412 
413 const struct got_error *
414 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
415     struct got_object_id *id, int pack_idx)
416 {
417 	struct ibuf *wbuf;
418 	size_t len;
419 
420 	if (pack_idx != -1)
421 		len = sizeof(struct got_imsg_packed_object);
422 	else
423 		len = sizeof(*id);
424 
425 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, len);
426 	if (wbuf == NULL)
427 		return got_error_from_errno("imsg_create TREE_REQUEST");
428 
429 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
430 		return got_error_from_errno("imsg_add TREE_REQUEST");
431 
432 	if (pack_idx != -1) { /* tree is packed */
433 		if (imsg_add(wbuf, &pack_idx, sizeof(pack_idx)) == -1)
434 			return got_error_from_errno("imsg_add TREE_REQUEST");
435 	}
436 
437 	wbuf->fd = fd;
438 	imsg_close(ibuf, wbuf);
439 
440 	return flush_imsg(ibuf);
441 }
442 
443 const struct got_error *
444 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
445     struct got_object_id *id, int pack_idx)
446 {
447 	struct got_imsg_packed_object iobj;
448 	void *data;
449 	size_t len;
450 
451 	memset(&iobj, 0, sizeof(iobj));
452 	if (pack_idx != -1) { /* tag is packed */
453 		iobj.idx = pack_idx;
454 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
455 		data = &iobj;
456 		len = sizeof(iobj);
457 	} else {
458 		data = id;
459 		len = sizeof(*id);
460 	}
461 
462 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, data, len)
463 	    == -1)
464 		return got_error_from_errno("imsg_compose TAG_REQUEST");
465 
466 	return flush_imsg(ibuf);
467 }
468 
469 const struct got_error *
470 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
471     struct got_object_id *id, int pack_idx)
472 {
473 	const struct got_error *err = NULL;
474 	struct got_imsg_packed_object iobj;
475 	void *data;
476 	size_t len;
477 
478 	memset(&iobj, 0, sizeof(iobj));
479 	if (pack_idx != -1) { /* blob is packed */
480 		iobj.idx = pack_idx;
481 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
482 		data = &iobj;
483 		len = sizeof(iobj);
484 	} else {
485 		data = id;
486 		len = sizeof(*id);
487 	}
488 
489 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, data, len)
490 	    == -1) {
491 		err = got_error_from_errno("imsg_compose BLOB_REQUEST");
492 		close(infd);
493 		return err;
494 	}
495 
496 	return flush_imsg(ibuf);
497 }
498 
499 const struct got_error *
500 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
501 {
502 	const struct got_error *err = NULL;
503 
504 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
505 	    == -1) {
506 		err = got_error_from_errno("imsg_compose BLOB_OUTFD");
507 		close(outfd);
508 		return err;
509 	}
510 
511 	return flush_imsg(ibuf);
512 }
513 
514 static const struct got_error *
515 send_fd(struct imsgbuf *ibuf, int imsg_code, int fd)
516 {
517 	const struct got_error *err = NULL;
518 
519 	if (imsg_compose(ibuf, imsg_code, 0, 0, fd, NULL, 0) == -1) {
520 		err = got_error_from_errno("imsg_compose TMPFD");
521 		close(fd);
522 		return err;
523 	}
524 
525 	return flush_imsg(ibuf);
526 }
527 
528 const struct got_error *
529 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
530 {
531 	return send_fd(ibuf, GOT_IMSG_TMPFD, fd);
532 }
533 
534 const struct got_error *
535 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
536 {
537 	struct got_imsg_object iobj;
538 
539 	memset(&iobj, 0, sizeof(iobj));
540 
541 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
542 	iobj.type = obj->type;
543 	iobj.flags = obj->flags;
544 	iobj.hdrlen = obj->hdrlen;
545 	iobj.size = obj->size;
546 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
547 		iobj.pack_offset = obj->pack_offset;
548 		iobj.pack_idx = obj->pack_idx;
549 	}
550 
551 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
552 	    == -1)
553 		return got_error_from_errno("imsg_compose OBJECT");
554 
555 	return flush_imsg(ibuf);
556 }
557 
558 const struct got_error *
559 got_privsep_send_fetch_req(struct imsgbuf *ibuf, int fd,
560     struct got_pathlist_head *have_refs, int fetch_all_branches,
561     struct got_pathlist_head *wanted_branches,
562     struct got_pathlist_head *wanted_refs, int list_refs_only, int verbosity)
563 {
564 	const struct got_error *err = NULL;
565 	struct ibuf *wbuf;
566 	size_t len;
567 	struct got_pathlist_entry *pe;
568 	struct got_imsg_fetch_request fetchreq;
569 
570 	memset(&fetchreq, 0, sizeof(fetchreq));
571 	fetchreq.fetch_all_branches = fetch_all_branches;
572 	fetchreq.list_refs_only = list_refs_only;
573 	fetchreq.verbosity = verbosity;
574 	TAILQ_FOREACH(pe, have_refs, entry)
575 		fetchreq.n_have_refs++;
576 	TAILQ_FOREACH(pe, wanted_branches, entry)
577 		fetchreq.n_wanted_branches++;
578 	TAILQ_FOREACH(pe, wanted_refs, entry)
579 		fetchreq.n_wanted_refs++;
580 	len = sizeof(struct got_imsg_fetch_request);
581 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
582 		close(fd);
583 		return got_error(GOT_ERR_NO_SPACE);
584 	}
585 
586 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_REQUEST, 0, 0, fd,
587 	    &fetchreq, sizeof(fetchreq)) == -1)
588 		return got_error_from_errno(
589 		    "imsg_compose FETCH_SERVER_PROGRESS");
590 
591 	err = flush_imsg(ibuf);
592 	if (err) {
593 		close(fd);
594 		return err;
595 	}
596 	fd = -1;
597 
598 	TAILQ_FOREACH(pe, have_refs, entry) {
599 		const char *name = pe->path;
600 		size_t name_len = pe->path_len;
601 		struct got_object_id *id = pe->data;
602 
603 		len = sizeof(struct got_imsg_fetch_have_ref) + name_len;
604 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_HAVE_REF, 0, 0, len);
605 		if (wbuf == NULL)
606 			return got_error_from_errno("imsg_create FETCH_HAVE_REF");
607 
608 		/* Keep in sync with struct got_imsg_fetch_have_ref! */
609 		if (imsg_add(wbuf, id->sha1, sizeof(id->sha1)) == -1)
610 			return got_error_from_errno("imsg_add FETCH_HAVE_REF");
611 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
612 			return got_error_from_errno("imsg_add FETCH_HAVE_REF");
613 		if (imsg_add(wbuf, name, name_len) == -1)
614 			return got_error_from_errno("imsg_add FETCH_HAVE_REF");
615 
616 		wbuf->fd = -1;
617 		imsg_close(ibuf, wbuf);
618 		err = flush_imsg(ibuf);
619 		if (err)
620 			return err;
621 	}
622 
623 	TAILQ_FOREACH(pe, wanted_branches, entry) {
624 		const char *name = pe->path;
625 		size_t name_len = pe->path_len;
626 
627 		len = sizeof(struct got_imsg_fetch_wanted_branch) + name_len;
628 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_WANTED_BRANCH, 0, 0,
629 		    len);
630 		if (wbuf == NULL)
631 			return got_error_from_errno(
632 			    "imsg_create FETCH_WANTED_BRANCH");
633 
634 		/* Keep in sync with struct got_imsg_fetch_wanted_branch! */
635 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
636 			return got_error_from_errno(
637 			    "imsg_add FETCH_WANTED_BRANCH");
638 		if (imsg_add(wbuf, name, name_len) == -1)
639 			return got_error_from_errno(
640 			    "imsg_add FETCH_WANTED_BRANCH");
641 
642 		wbuf->fd = -1;
643 		imsg_close(ibuf, wbuf);
644 		err = flush_imsg(ibuf);
645 		if (err)
646 			return err;
647 	}
648 
649 	TAILQ_FOREACH(pe, wanted_refs, entry) {
650 		const char *name = pe->path;
651 		size_t name_len = pe->path_len;
652 
653 		len = sizeof(struct got_imsg_fetch_wanted_ref) + name_len;
654 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_WANTED_REF, 0, 0,
655 		    len);
656 		if (wbuf == NULL)
657 			return got_error_from_errno(
658 			    "imsg_create FETCH_WANTED_REF");
659 
660 		/* Keep in sync with struct got_imsg_fetch_wanted_ref! */
661 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
662 			return got_error_from_errno(
663 			    "imsg_add FETCH_WANTED_REF");
664 		if (imsg_add(wbuf, name, name_len) == -1)
665 			return got_error_from_errno(
666 			    "imsg_add FETCH_WANTED_REF");
667 
668 		wbuf->fd = -1;
669 		imsg_close(ibuf, wbuf);
670 		err = flush_imsg(ibuf);
671 		if (err)
672 			return err;
673 	}
674 
675 
676 	return NULL;
677 
678 }
679 
680 const struct got_error *
681 got_privsep_send_fetch_outfd(struct imsgbuf *ibuf, int fd)
682 {
683 	return send_fd(ibuf, GOT_IMSG_FETCH_OUTFD, fd);
684 }
685 
686 const struct got_error *
687 got_privsep_recv_fetch_progress(int *done, struct got_object_id **id,
688     char **refname, struct got_pathlist_head *symrefs, char **server_progress,
689     off_t *packfile_size, uint8_t *pack_sha1, struct imsgbuf *ibuf)
690 {
691 	const struct got_error *err = NULL;
692 	struct imsg imsg;
693 	size_t datalen;
694 	struct got_imsg_fetch_symrefs *isymrefs = NULL;
695 	size_t n, remain;
696 	off_t off;
697 	int i;
698 
699 	*done = 0;
700 	*id = NULL;
701 	*refname = NULL;
702 	*server_progress = NULL;
703 	*packfile_size = 0;
704 	memset(pack_sha1, 0, SHA1_DIGEST_LENGTH);
705 
706 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
707 	if (err)
708 		return err;
709 
710 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
711 	switch (imsg.hdr.type) {
712 	case GOT_IMSG_FETCH_SYMREFS:
713 		if (datalen < sizeof(*isymrefs)) {
714 			err = got_error(GOT_ERR_PRIVSEP_LEN);
715 			break;
716 		}
717 		if (isymrefs != NULL) {
718 			err = got_error(GOT_ERR_PRIVSEP_MSG);
719 			break;
720 		}
721 		isymrefs = (struct got_imsg_fetch_symrefs *)imsg.data;
722 		off = sizeof(*isymrefs);
723 		remain = datalen - off;
724 		for (n = 0; n < isymrefs->nsymrefs; n++) {
725 			struct got_imsg_fetch_symref *s;
726 			char *name, *target;
727 			if (remain < sizeof(struct got_imsg_fetch_symref)) {
728 				err = got_error(GOT_ERR_PRIVSEP_LEN);
729 				goto done;
730 			}
731 			s = (struct got_imsg_fetch_symref *)(imsg.data + off);
732 			off += sizeof(*s);
733 			remain -= sizeof(*s);
734 			if (remain < s->name_len) {
735 				err = got_error(GOT_ERR_PRIVSEP_LEN);
736 				goto done;
737 			}
738 			name = strndup(imsg.data + off, s->name_len);
739 			if (name == NULL) {
740 				err = got_error_from_errno("strndup");
741 				goto done;
742 			}
743 			off += s->name_len;
744 			remain -= s->name_len;
745 			if (remain < s->target_len) {
746 				err = got_error(GOT_ERR_PRIVSEP_LEN);
747 				free(name);
748 				goto done;
749 			}
750 			target = strndup(imsg.data + off, s->target_len);
751 			if (target == NULL) {
752 				err = got_error_from_errno("strndup");
753 				free(name);
754 				goto done;
755 			}
756 			off += s->target_len;
757 			remain -= s->target_len;
758 			err = got_pathlist_append(symrefs, name, target);
759 			if (err) {
760 				free(name);
761 				free(target);
762 				goto done;
763 			}
764 		}
765 		break;
766 	case GOT_IMSG_FETCH_REF:
767 		if (datalen <= SHA1_DIGEST_LENGTH) {
768 			err = got_error(GOT_ERR_PRIVSEP_MSG);
769 			break;
770 		}
771 		*id = malloc(sizeof(**id));
772 		if (*id == NULL) {
773 			err = got_error_from_errno("malloc");
774 			break;
775 		}
776 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
777 		*refname = strndup(imsg.data + SHA1_DIGEST_LENGTH,
778 		    datalen - SHA1_DIGEST_LENGTH);
779 		if (*refname == NULL) {
780 			err = got_error_from_errno("strndup");
781 			break;
782 		}
783 		break;
784 	case GOT_IMSG_FETCH_SERVER_PROGRESS:
785 		if (datalen == 0) {
786 			err = got_error(GOT_ERR_PRIVSEP_LEN);
787 			break;
788 		}
789 		*server_progress = strndup(imsg.data, datalen);
790 		if (*server_progress == NULL) {
791 			err = got_error_from_errno("strndup");
792 			break;
793 		}
794 		for (i = 0; i < datalen; i++) {
795 			if (!isprint((unsigned char)(*server_progress)[i]) &&
796 			    !isspace((unsigned char)(*server_progress)[i])) {
797 				err = got_error(GOT_ERR_PRIVSEP_MSG);
798 				free(*server_progress);
799 				*server_progress = NULL;
800 				goto done;
801 			}
802 		}
803 		break;
804 	case GOT_IMSG_FETCH_DOWNLOAD_PROGRESS:
805 		if (datalen < sizeof(*packfile_size)) {
806 			err = got_error(GOT_ERR_PRIVSEP_MSG);
807 			break;
808 		}
809 		memcpy(packfile_size, imsg.data, sizeof(*packfile_size));
810 		break;
811 	case GOT_IMSG_FETCH_DONE:
812 		if (datalen != SHA1_DIGEST_LENGTH) {
813 			err = got_error(GOT_ERR_PRIVSEP_MSG);
814 			break;
815 		}
816 		memcpy(pack_sha1, imsg.data, SHA1_DIGEST_LENGTH);
817 		*done = 1;
818 		break;
819 	default:
820 		err = got_error(GOT_ERR_PRIVSEP_MSG);
821 		break;
822 	}
823 done:
824 	if (err) {
825 		free(*id);
826 		*id = NULL;
827 		free(*refname);
828 		*refname = NULL;
829 	}
830 	imsg_free(&imsg);
831 	return err;
832 }
833 
834 static const struct got_error *
835 send_send_ref(const char *name, size_t name_len, struct got_object_id *id,
836     int delete, struct imsgbuf *ibuf)
837 {
838 	size_t len;
839 	struct ibuf *wbuf;
840 
841 	len = sizeof(struct got_imsg_send_ref) + name_len;
842 	wbuf = imsg_create(ibuf, GOT_IMSG_SEND_REF, 0, 0, len);
843 	if (wbuf == NULL)
844 		return got_error_from_errno("imsg_create SEND_REF");
845 
846 	/* Keep in sync with struct got_imsg_send_ref! */
847 	if (imsg_add(wbuf, id->sha1, sizeof(id->sha1)) == -1)
848 		return got_error_from_errno("imsg_add SEND_REF");
849 	if (imsg_add(wbuf, &delete, sizeof(delete)) == -1)
850 		return got_error_from_errno("imsg_add SEND_REF");
851 	if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1)
852 		return got_error_from_errno("imsg_add SEND_REF");
853 	if (imsg_add(wbuf, name, name_len) == -1)
854 		return got_error_from_errno("imsg_add SEND_REF");
855 
856 	wbuf->fd = -1;
857 	imsg_close(ibuf, wbuf);
858 	return flush_imsg(ibuf);
859 }
860 
861 const struct got_error *
862 got_privsep_send_send_req(struct imsgbuf *ibuf, int fd,
863     struct got_pathlist_head *have_refs,
864     struct got_pathlist_head *delete_refs,
865     int verbosity)
866 {
867 	const struct got_error *err = NULL;
868 	struct got_pathlist_entry *pe;
869 	struct got_imsg_send_request sendreq;
870 	struct got_object_id zero_id;
871 
872 	memset(&zero_id, 0, sizeof(zero_id));
873 	memset(&sendreq, 0, sizeof(sendreq));
874 	sendreq.verbosity = verbosity;
875 	TAILQ_FOREACH(pe, have_refs, entry)
876 		sendreq.nrefs++;
877 	TAILQ_FOREACH(pe, delete_refs, entry)
878 		sendreq.nrefs++;
879 	if (imsg_compose(ibuf, GOT_IMSG_SEND_REQUEST, 0, 0, fd,
880 	    &sendreq, sizeof(sendreq)) == -1) {
881 		err = got_error_from_errno(
882 		    "imsg_compose FETCH_SERVER_PROGRESS");
883 		goto done;
884 	}
885 
886 	err = flush_imsg(ibuf);
887 	if (err)
888 		goto done;
889 	fd = -1;
890 
891 	TAILQ_FOREACH(pe, have_refs, entry) {
892 		const char *name = pe->path;
893 		size_t name_len = pe->path_len;
894 		struct got_object_id *id = pe->data;
895 		err = send_send_ref(name, name_len, id, 0, ibuf);
896 		if (err)
897 			goto done;
898 	}
899 
900 	TAILQ_FOREACH(pe, delete_refs, entry) {
901 		const char *name = pe->path;
902 		size_t name_len = pe->path_len;
903 		err = send_send_ref(name, name_len, &zero_id, 1, ibuf);
904 		if (err)
905 			goto done;
906 	}
907 done:
908 	if (fd != -1 && close(fd) == -1 && err == NULL)
909 		err = got_error_from_errno("close");
910 	return err;
911 
912 }
913 
914 const struct got_error *
915 got_privsep_recv_send_remote_refs(struct got_pathlist_head *remote_refs,
916     struct imsgbuf *ibuf)
917 {
918 	const struct got_error *err = NULL;
919 	struct imsg imsg;
920 	size_t datalen;
921 	int done = 0;
922 	struct got_imsg_send_remote_ref iremote_ref;
923 	struct got_object_id *id = NULL;
924 	char *refname = NULL;
925 	struct got_pathlist_entry *new;
926 
927 	while (!done) {
928 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
929 		if (err)
930 			return err;
931 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
932 		switch (imsg.hdr.type) {
933 		case GOT_IMSG_SEND_REMOTE_REF:
934 			if (datalen < sizeof(iremote_ref)) {
935 				err = got_error(GOT_ERR_PRIVSEP_MSG);
936 				goto done;
937 			}
938 			memcpy(&iremote_ref, imsg.data, sizeof(iremote_ref));
939 			if (datalen != sizeof(iremote_ref) +
940 			    iremote_ref.name_len) {
941 				err = got_error(GOT_ERR_PRIVSEP_MSG);
942 				goto done;
943 			}
944 			id = malloc(sizeof(*id));
945 			if (id == NULL) {
946 				err = got_error_from_errno("malloc");
947 				goto done;
948 			}
949 			memcpy(id->sha1, iremote_ref.id, SHA1_DIGEST_LENGTH);
950 			refname = strndup(imsg.data + sizeof(iremote_ref),
951 			    datalen - sizeof(iremote_ref));
952 			if (refname == NULL) {
953 				err = got_error_from_errno("strndup");
954 				goto done;
955 			}
956 			err = got_pathlist_insert(&new, remote_refs,
957 			    refname, id);
958 			if (err)
959 				goto done;
960 			if (new == NULL) { /* duplicate which wasn't inserted */
961 				free(id);
962 				free(refname);
963 			}
964 			id = NULL;
965 			refname = NULL;
966 			break;
967 		case GOT_IMSG_SEND_PACK_REQUEST:
968 			if (datalen != 0) {
969 				err = got_error(GOT_ERR_PRIVSEP_MSG);
970 				goto done;
971 			}
972 			/* got-send-pack is now waiting for a pack file. */
973 			done = 1;
974 			break;
975 		default:
976 			err = got_error(GOT_ERR_PRIVSEP_MSG);
977 			break;
978 		}
979 	}
980 done:
981 	free(id);
982 	free(refname);
983 	imsg_free(&imsg);
984 	return err;
985 }
986 
987 const struct got_error *
988 got_privsep_send_packfd(struct imsgbuf *ibuf, int fd)
989 {
990 	return send_fd(ibuf, GOT_IMSG_SEND_PACKFD, fd);
991 }
992 
993 const struct got_error *
994 got_privsep_recv_send_progress(int *done, off_t *bytes_sent,
995     int *success, char **refname, struct imsgbuf *ibuf)
996 {
997 	const struct got_error *err = NULL;
998 	struct imsg imsg;
999 	size_t datalen;
1000 	struct got_imsg_send_ref_status iref_status;
1001 
1002 	/* Do not reset the current value of 'bytes_sent', it accumulates. */
1003 	*done = 0;
1004 	*success = 0;
1005 	*refname = NULL;
1006 
1007 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1008 	if (err)
1009 		return err;
1010 
1011 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1012 	switch (imsg.hdr.type) {
1013 	case GOT_IMSG_SEND_UPLOAD_PROGRESS:
1014 		if (datalen < sizeof(*bytes_sent)) {
1015 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1016 			break;
1017 		}
1018 		memcpy(bytes_sent, imsg.data, sizeof(*bytes_sent));
1019 		break;
1020 	case GOT_IMSG_SEND_REF_STATUS:
1021 		if (datalen < sizeof(iref_status)) {
1022 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1023 			break;
1024 		}
1025 		memcpy(&iref_status, imsg.data, sizeof(iref_status));
1026 		if (datalen != sizeof(iref_status) + iref_status.name_len) {
1027 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1028 			break;
1029 		}
1030 		*success = iref_status.success;
1031 		*refname = strndup(imsg.data + sizeof(iref_status),
1032 		    iref_status.name_len);
1033 		break;
1034 	case GOT_IMSG_SEND_DONE:
1035 		if (datalen != 0) {
1036 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1037 			break;
1038 		}
1039 		*done = 1;
1040 		break;
1041 	default:
1042 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1043 		break;
1044 	}
1045 
1046 	imsg_free(&imsg);
1047 	return err;
1048 }
1049 
1050 const struct got_error *
1051 got_privsep_send_index_pack_req(struct imsgbuf *ibuf, uint8_t *pack_sha1,
1052     int fd)
1053 {
1054 	const struct got_error *err = NULL;
1055 
1056 	/* Keep in sync with struct got_imsg_index_pack_request */
1057 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_REQUEST, 0, 0, fd,
1058 	    pack_sha1, SHA1_DIGEST_LENGTH) == -1) {
1059 		err = got_error_from_errno("imsg_compose INDEX_REQUEST");
1060 		close(fd);
1061 		return err;
1062 	}
1063 	return flush_imsg(ibuf);
1064 }
1065 
1066 const struct got_error *
1067 got_privsep_send_index_pack_outfd(struct imsgbuf *ibuf, int fd)
1068 {
1069 	return send_fd(ibuf, GOT_IMSG_IDXPACK_OUTFD, fd);
1070 }
1071 
1072 const struct got_error *
1073 got_privsep_recv_index_progress(int *done, int *nobj_total,
1074     int *nobj_indexed, int *nobj_loose, int *nobj_resolved,
1075     struct imsgbuf *ibuf)
1076 {
1077 	const struct got_error *err = NULL;
1078 	struct imsg imsg;
1079 	struct got_imsg_index_pack_progress *iprogress;
1080 	size_t datalen;
1081 
1082 	*done = 0;
1083 	*nobj_total = 0;
1084 	*nobj_indexed = 0;
1085 	*nobj_resolved = 0;
1086 
1087 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1088 	if (err)
1089 		return err;
1090 
1091 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1092 	switch (imsg.hdr.type) {
1093 	case GOT_IMSG_IDXPACK_PROGRESS:
1094 		if (datalen < sizeof(*iprogress)) {
1095 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1096 			break;
1097 		}
1098 		iprogress = (struct got_imsg_index_pack_progress *)imsg.data;
1099 		if (iprogress->nobj_total < 0 || iprogress->nobj_indexed < 0 ||
1100 		    iprogress->nobj_loose < 0 || iprogress->nobj_resolved < 0) {
1101 			err = got_error(GOT_ERR_RANGE);
1102 			break;
1103 		}
1104 		*nobj_total = iprogress->nobj_total;
1105 		*nobj_indexed = iprogress->nobj_indexed;
1106 		*nobj_loose = iprogress->nobj_loose;
1107 		*nobj_resolved = iprogress->nobj_resolved;
1108 		break;
1109 	case GOT_IMSG_IDXPACK_DONE:
1110 		if (datalen != 0) {
1111 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1112 			break;
1113 		}
1114 		*done = 1;
1115 		break;
1116 	default:
1117 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1118 		break;
1119 	}
1120 
1121 	imsg_free(&imsg);
1122 	return err;
1123 }
1124 
1125 const struct got_error *
1126 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
1127     struct imsgbuf *ibuf)
1128 {
1129 	struct got_imsg_object *iobj;
1130 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
1131 
1132 	if (datalen != sizeof(*iobj))
1133 		return got_error(GOT_ERR_PRIVSEP_LEN);
1134 	iobj = imsg->data;
1135 
1136 	if (iobj->pack_offset < 0)
1137 		return got_error(GOT_ERR_PACK_OFFSET);
1138 
1139 	*obj = calloc(1, sizeof(**obj));
1140 	if (*obj == NULL)
1141 		return got_error_from_errno("calloc");
1142 
1143 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
1144 	(*obj)->type = iobj->type;
1145 	(*obj)->flags = iobj->flags;
1146 	(*obj)->hdrlen = iobj->hdrlen;
1147 	(*obj)->size = iobj->size;
1148 	/* path_packfile is handled by caller */
1149 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
1150 		(*obj)->pack_offset = iobj->pack_offset;
1151 		(*obj)->pack_idx = iobj->pack_idx;
1152 	}
1153 	STAILQ_INIT(&(*obj)->deltas.entries);
1154 	return NULL;
1155 }
1156 
1157 const struct got_error *
1158 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
1159 {
1160 	const struct got_error *err = NULL;
1161 	struct imsg imsg;
1162 	const size_t min_datalen =
1163 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
1164 
1165 	*obj = NULL;
1166 
1167 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1168 	if (err)
1169 		return err;
1170 
1171 	switch (imsg.hdr.type) {
1172 	case GOT_IMSG_OBJECT:
1173 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
1174 		break;
1175 	default:
1176 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1177 		break;
1178 	}
1179 
1180 	imsg_free(&imsg);
1181 
1182 	return err;
1183 }
1184 
1185 static const struct got_error *
1186 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
1187     size_t logmsg_len)
1188 {
1189 	const struct got_error *err = NULL;
1190 	size_t offset, remain;
1191 
1192 	offset = 0;
1193 	remain = logmsg_len;
1194 	while (remain > 0) {
1195 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1196 
1197 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
1198 		    commit->logmsg + offset, n) == -1) {
1199 			err = got_error_from_errno("imsg_compose "
1200 			    "COMMIT_LOGMSG");
1201 			break;
1202 		}
1203 
1204 		err = flush_imsg(ibuf);
1205 		if (err)
1206 			break;
1207 
1208 		offset += n;
1209 		remain -= n;
1210 	}
1211 
1212 	return err;
1213 }
1214 
1215 const struct got_error *
1216 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
1217 {
1218 	const struct got_error *err = NULL;
1219 	struct got_imsg_commit_object *icommit;
1220 	uint8_t *buf;
1221 	size_t len, total;
1222 	struct got_object_qid *qid;
1223 	size_t author_len = strlen(commit->author);
1224 	size_t committer_len = strlen(commit->committer);
1225 	size_t logmsg_len = strlen(commit->logmsg);
1226 
1227 	total = sizeof(*icommit) + author_len + committer_len +
1228 	    commit->nparents * SHA1_DIGEST_LENGTH;
1229 
1230 	buf = malloc(total);
1231 	if (buf == NULL)
1232 		return got_error_from_errno("malloc");
1233 
1234 	icommit = (struct got_imsg_commit_object *)buf;
1235 	memcpy(icommit->tree_id, commit->tree_id->sha1,
1236 	    sizeof(icommit->tree_id));
1237 	icommit->author_len = author_len;
1238 	icommit->author_time = commit->author_time;
1239 	icommit->author_gmtoff = commit->author_gmtoff;
1240 	icommit->committer_len = committer_len;
1241 	icommit->committer_time = commit->committer_time;
1242 	icommit->committer_gmtoff = commit->committer_gmtoff;
1243 	icommit->logmsg_len = logmsg_len;
1244 	icommit->nparents = commit->nparents;
1245 
1246 	len = sizeof(*icommit);
1247 	memcpy(buf + len, commit->author, author_len);
1248 	len += author_len;
1249 	memcpy(buf + len, commit->committer, committer_len);
1250 	len += committer_len;
1251 	STAILQ_FOREACH(qid, &commit->parent_ids, entry) {
1252 		memcpy(buf + len, &qid->id, SHA1_DIGEST_LENGTH);
1253 		len += SHA1_DIGEST_LENGTH;
1254 	}
1255 
1256 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
1257 		err = got_error_from_errno("imsg_compose COMMIT");
1258 		goto done;
1259 	}
1260 
1261 	if (logmsg_len == 0 ||
1262 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1263 		err = flush_imsg(ibuf);
1264 		if (err)
1265 			goto done;
1266 	}
1267 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
1268 done:
1269 	free(buf);
1270 	return err;
1271 }
1272 
1273 static const struct got_error *
1274 get_commit_from_imsg(struct got_commit_object **commit,
1275     struct imsg *imsg, size_t datalen, struct imsgbuf *ibuf)
1276 {
1277 	const struct got_error *err = NULL;
1278 	struct got_imsg_commit_object *icommit;
1279 	size_t len = 0;
1280 	int i;
1281 
1282 	if (datalen < sizeof(*icommit))
1283 		return got_error(GOT_ERR_PRIVSEP_LEN);
1284 
1285 	icommit = imsg->data;
1286 	if (datalen != sizeof(*icommit) + icommit->author_len +
1287 	    icommit->committer_len +
1288 	    icommit->nparents * SHA1_DIGEST_LENGTH)
1289 		return got_error(GOT_ERR_PRIVSEP_LEN);
1290 
1291 	if (icommit->nparents < 0)
1292 		return got_error(GOT_ERR_PRIVSEP_LEN);
1293 
1294 	len += sizeof(*icommit);
1295 
1296 	*commit = got_object_commit_alloc_partial();
1297 	if (*commit == NULL)
1298 		return got_error_from_errno(
1299 		    "got_object_commit_alloc_partial");
1300 
1301 	memcpy((*commit)->tree_id->sha1, icommit->tree_id,
1302 	    SHA1_DIGEST_LENGTH);
1303 	(*commit)->author_time = icommit->author_time;
1304 	(*commit)->author_gmtoff = icommit->author_gmtoff;
1305 	(*commit)->committer_time = icommit->committer_time;
1306 	(*commit)->committer_gmtoff = icommit->committer_gmtoff;
1307 
1308 	(*commit)->author = strndup(imsg->data + len, icommit->author_len);
1309 	if ((*commit)->author == NULL) {
1310 		err = got_error_from_errno("strndup");
1311 		goto done;
1312 	}
1313 	len += icommit->author_len;
1314 
1315 	(*commit)->committer = strndup(imsg->data + len,
1316 	    icommit->committer_len);
1317 	if ((*commit)->committer == NULL) {
1318 		err = got_error_from_errno("strndup");
1319 		goto done;
1320 	}
1321 	len += icommit->committer_len;
1322 
1323 	if (icommit->logmsg_len == 0) {
1324 		(*commit)->logmsg = strdup("");
1325 		if ((*commit)->logmsg == NULL) {
1326 			err = got_error_from_errno("strdup");
1327 			goto done;
1328 		}
1329 	} else {
1330 		size_t offset = 0, remain = icommit->logmsg_len;
1331 
1332 		(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
1333 		if ((*commit)->logmsg == NULL) {
1334 			err = got_error_from_errno("malloc");
1335 			goto done;
1336 		}
1337 		while (remain > 0) {
1338 			struct imsg imsg_log;
1339 			size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1340 			    remain);
1341 
1342 			err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1343 			if (err)
1344 				goto done;
1345 
1346 			if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG) {
1347 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1348 				goto done;
1349 			}
1350 
1351 			memcpy((*commit)->logmsg + offset,
1352 			    imsg_log.data, n);
1353 			imsg_free(&imsg_log);
1354 			offset += n;
1355 			remain -= n;
1356 		}
1357 		(*commit)->logmsg[icommit->logmsg_len] = '\0';
1358 	}
1359 
1360 	for (i = 0; i < icommit->nparents; i++) {
1361 		struct got_object_qid *qid;
1362 
1363 		err = got_object_qid_alloc_partial(&qid);
1364 		if (err)
1365 			break;
1366 		memcpy(&qid->id, imsg->data + len +
1367 		    i * SHA1_DIGEST_LENGTH, sizeof(qid->id));
1368 		STAILQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
1369 		(*commit)->nparents++;
1370 	}
1371 done:
1372 	if (err) {
1373 		got_object_commit_close(*commit);
1374 		*commit = NULL;
1375 	}
1376 	return err;
1377 }
1378 
1379 const struct got_error *
1380 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
1381 {
1382 	const struct got_error *err = NULL;
1383 	struct imsg imsg;
1384 	size_t datalen;
1385 	const size_t min_datalen =
1386 	    MIN(sizeof(struct got_imsg_error),
1387 	    sizeof(struct got_imsg_commit_object));
1388 
1389 	*commit = NULL;
1390 
1391 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1392 	if (err)
1393 		return err;
1394 
1395 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1396 
1397 	switch (imsg.hdr.type) {
1398 	case GOT_IMSG_COMMIT:
1399 		err = get_commit_from_imsg(commit, &imsg, datalen, ibuf);
1400 		break;
1401 	default:
1402 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1403 		break;
1404 	}
1405 
1406 	imsg_free(&imsg);
1407 
1408 	return err;
1409 }
1410 
1411 static const struct got_error *
1412 send_tree_entries_batch(struct imsgbuf *ibuf,
1413     struct got_parsed_tree_entry *entries, int idx0, int idxN, size_t len)
1414 {
1415 	struct ibuf *wbuf;
1416 	struct got_imsg_tree_entries ientries;
1417 	int i;
1418 
1419 	memset(&ientries, 0, sizeof(ientries));
1420 
1421 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_ENTRIES, 0, 0, len);
1422 	if (wbuf == NULL)
1423 		return got_error_from_errno("imsg_create TREE_ENTRY");
1424 
1425 	ientries.nentries = idxN - idx0 + 1;
1426 	if (imsg_add(wbuf, &ientries, sizeof(ientries)) == -1)
1427 		return got_error_from_errno("imsg_add TREE_ENTRY");
1428 
1429 	for (i = idx0; i <= idxN; i++) {
1430 		struct got_parsed_tree_entry *pte = &entries[i];
1431 
1432 		/* Keep in sync with struct got_imsg_tree_object definition! */
1433 		if (imsg_add(wbuf, pte->id, SHA1_DIGEST_LENGTH) == -1)
1434 			return got_error_from_errno("imsg_add TREE_ENTRY");
1435 		if (imsg_add(wbuf, &pte->mode, sizeof(pte->mode)) == -1)
1436 			return got_error_from_errno("imsg_add TREE_ENTRY");
1437 		if (imsg_add(wbuf, &pte->namelen, sizeof(pte->namelen)) == -1)
1438 			return got_error_from_errno("imsg_add TREE_ENTRY");
1439 
1440 		/* Remaining bytes are the entry's name. */
1441 		if (imsg_add(wbuf, pte->name, pte->namelen) == -1)
1442 			return got_error_from_errno("imsg_add TREE_ENTRY");
1443 	}
1444 
1445 	wbuf->fd = -1;
1446 	imsg_close(ibuf, wbuf);
1447 	return NULL;
1448 }
1449 
1450 static const struct got_error *
1451 send_tree_entries(struct imsgbuf *ibuf, struct got_parsed_tree_entry *entries,
1452     int nentries)
1453 {
1454 	const struct got_error *err = NULL;
1455 	int i, j;
1456 	size_t entries_len = sizeof(struct got_imsg_tree_entries);
1457 
1458 	i = 0;
1459 	for (j = 0; j < nentries; j++) {
1460 		struct got_parsed_tree_entry *pte = &entries[j];
1461 		size_t len = SHA1_DIGEST_LENGTH + sizeof(pte->mode) +
1462 		    sizeof(pte->namelen) + pte->namelen;
1463 
1464 		if (j > 0 &&
1465 		    entries_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1466 			err = send_tree_entries_batch(ibuf, entries,
1467 			    i, j - 1, entries_len);
1468 			if (err)
1469 				return err;
1470 			i = j;
1471 			entries_len = sizeof(struct got_imsg_tree_entries);
1472 		}
1473 
1474 		entries_len += len;
1475 	}
1476 
1477 	if (j > 0) {
1478 		err = send_tree_entries_batch(ibuf, entries, i, j - 1,
1479 		    entries_len);
1480 		if (err)
1481 			return err;
1482 	}
1483 
1484 	return NULL;
1485 }
1486 
1487 const struct got_error *
1488 got_privsep_send_tree(struct imsgbuf *ibuf,
1489     struct got_parsed_tree_entry *entries, int nentries)
1490 {
1491 	const struct got_error *err = NULL;
1492 	struct got_imsg_tree_object itree;
1493 
1494 	memset(&itree, 0, sizeof(itree));
1495 	itree.nentries = nentries;
1496 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
1497 	    == -1)
1498 		return got_error_from_errno("imsg_compose TREE");
1499 
1500 	err = send_tree_entries(ibuf, entries, nentries);
1501 	if (err)
1502 		return err;
1503 
1504 	return flush_imsg(ibuf);
1505 }
1506 
1507 
1508 static const struct got_error *
1509 recv_tree_entries(void *data, size_t datalen, struct got_tree_object *tree,
1510     int *nentries)
1511 {
1512 	const struct got_error *err = NULL;
1513 	struct got_imsg_tree_entries *ientries;
1514 	struct got_tree_entry *te;
1515 	size_t te_offset;
1516 	size_t i;
1517 
1518 	if (datalen <= sizeof(*ientries) ||
1519 	    datalen > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
1520 		return got_error(GOT_ERR_PRIVSEP_LEN);
1521 
1522 	ientries = (struct got_imsg_tree_entries *)data;
1523 	if (ientries->nentries > INT_MAX) {
1524 		return got_error_msg(GOT_ERR_NO_SPACE,
1525 		    "too many tree entries");
1526 	}
1527 
1528 	te_offset = sizeof(*ientries);
1529 	for (i = 0; i < ientries->nentries; i++) {
1530 		struct got_imsg_tree_entry ite;
1531 		const char *te_name;
1532 		uint8_t *buf = (uint8_t *)data + te_offset;
1533 
1534 		if (te_offset >= datalen) {
1535 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1536 			break;
1537 		}
1538 
1539 		/* Might not be aligned, size is ~32 bytes. */
1540 		memcpy(&ite, buf, sizeof(ite));
1541 
1542 		if (ite.namelen >= sizeof(te->name)) {
1543 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1544 			break;
1545 		}
1546 		if (te_offset + sizeof(ite) + ite.namelen > datalen) {
1547 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1548 			break;
1549 		}
1550 
1551 		if (*nentries >= tree->nentries) {
1552 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1553 			break;
1554 		}
1555 		te = &tree->entries[*nentries];
1556 		te_name = buf + sizeof(ite);
1557 		memcpy(te->name, te_name, ite.namelen);
1558 		te->name[ite.namelen] = '\0';
1559 		memcpy(te->id.sha1, ite.id, SHA1_DIGEST_LENGTH);
1560 		te->mode = ite.mode;
1561 		te->idx = *nentries;
1562 		(*nentries)++;
1563 
1564 		te_offset += sizeof(ite) + ite.namelen;
1565 	}
1566 
1567 	return err;
1568 }
1569 
1570 const struct got_error *
1571 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
1572 {
1573 	const struct got_error *err = NULL;
1574 	const size_t min_datalen =
1575 	    MIN(sizeof(struct got_imsg_error),
1576 	    sizeof(struct got_imsg_tree_object));
1577 	struct got_imsg_tree_object *itree;
1578 	int nentries = 0;
1579 
1580 	*tree = NULL;
1581 
1582 	while (*tree == NULL || nentries < (*tree)->nentries) {
1583 		struct imsg imsg;
1584 		size_t datalen;
1585 
1586 		err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1587 		if (err)
1588 			break;
1589 
1590 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1591 
1592 		switch (imsg.hdr.type) {
1593 		case GOT_IMSG_TREE:
1594 			/* This message should only appear once. */
1595 			if (*tree != NULL) {
1596 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1597 				break;
1598 			}
1599 			if (datalen != sizeof(*itree)) {
1600 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1601 				break;
1602 			}
1603 			itree = imsg.data;
1604 			if (itree->nentries < 0) {
1605 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1606 				break;
1607 			}
1608 			*tree = malloc(sizeof(**tree));
1609 			if (*tree == NULL) {
1610 				err = got_error_from_errno("malloc");
1611 				break;
1612 			}
1613 			(*tree)->entries = calloc(itree->nentries,
1614 			    sizeof(struct got_tree_entry));
1615 			if ((*tree)->entries == NULL) {
1616 				err = got_error_from_errno("malloc");
1617 				free(*tree);
1618 				*tree = NULL;
1619 				break;
1620 			}
1621 			(*tree)->nentries = itree->nentries;
1622 			(*tree)->refcnt = 0;
1623 			break;
1624 		case GOT_IMSG_TREE_ENTRIES:
1625 			/* This message should be preceeded by GOT_IMSG_TREE. */
1626 			if (*tree == NULL) {
1627 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1628 				break;
1629 			}
1630 			err = recv_tree_entries(imsg.data, datalen,
1631 			    *tree, &nentries);
1632 			break;
1633 		default:
1634 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1635 			break;
1636 		}
1637 
1638 		imsg_free(&imsg);
1639 		if (err)
1640 			break;
1641 	}
1642 
1643 	if (*tree && (*tree)->nentries != nentries) {
1644 		if (err == NULL)
1645 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1646 		got_object_tree_close(*tree);
1647 		*tree = NULL;
1648 	}
1649 
1650 	return err;
1651 }
1652 
1653 const struct got_error *
1654 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
1655     const uint8_t *data)
1656 {
1657 	struct got_imsg_blob iblob;
1658 
1659 	memset(&iblob, 0, sizeof(iblob));
1660 	iblob.size = size;
1661 	iblob.hdrlen = hdrlen;
1662 
1663 	if (data) {
1664 		uint8_t *buf;
1665 
1666 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
1667 			return got_error(GOT_ERR_NO_SPACE);
1668 
1669 		buf = malloc(sizeof(iblob) + size);
1670 		if (buf == NULL)
1671 			return got_error_from_errno("malloc");
1672 
1673 		memcpy(buf, &iblob, sizeof(iblob));
1674 		memcpy(buf + sizeof(iblob), data, size);
1675 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
1676 		    sizeof(iblob) + size) == -1) {
1677 			free(buf);
1678 			return got_error_from_errno("imsg_compose BLOB");
1679 		}
1680 		free(buf);
1681 	} else {
1682 		/* Data has already been written to file descriptor. */
1683 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
1684 		    sizeof(iblob)) == -1)
1685 			return got_error_from_errno("imsg_compose BLOB");
1686 	}
1687 
1688 
1689 	return flush_imsg(ibuf);
1690 }
1691 
1692 const struct got_error *
1693 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
1694     struct imsgbuf *ibuf)
1695 {
1696 	const struct got_error *err = NULL;
1697 	struct imsg imsg;
1698 	struct got_imsg_blob *iblob;
1699 	size_t datalen;
1700 
1701 	*outbuf = NULL;
1702 
1703 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1704 	if (err)
1705 		return err;
1706 
1707 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1708 
1709 	switch (imsg.hdr.type) {
1710 	case GOT_IMSG_BLOB:
1711 		if (datalen < sizeof(*iblob)) {
1712 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1713 			break;
1714 		}
1715 		iblob = imsg.data;
1716 		*size = iblob->size;
1717 		*hdrlen = iblob->hdrlen;
1718 
1719 		if (datalen == sizeof(*iblob)) {
1720 			/* Data has been written to file descriptor. */
1721 			break;
1722 		}
1723 
1724 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX ||
1725 		    *size > datalen + sizeof(*iblob)) {
1726 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1727 			break;
1728 		}
1729 
1730 		*outbuf = malloc(*size);
1731 		if (*outbuf == NULL) {
1732 			err = got_error_from_errno("malloc");
1733 			break;
1734 		}
1735 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
1736 		break;
1737 	default:
1738 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1739 		break;
1740 	}
1741 
1742 	imsg_free(&imsg);
1743 
1744 	return err;
1745 }
1746 
1747 static const struct got_error *
1748 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
1749 {
1750 	const struct got_error *err = NULL;
1751 	size_t offset, remain;
1752 
1753 	offset = 0;
1754 	remain = tagmsg_len;
1755 	while (remain > 0) {
1756 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1757 
1758 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
1759 		    tag->tagmsg + offset, n) == -1) {
1760 			err = got_error_from_errno("imsg_compose TAG_TAGMSG");
1761 			break;
1762 		}
1763 
1764 		err = flush_imsg(ibuf);
1765 		if (err)
1766 			break;
1767 
1768 		offset += n;
1769 		remain -= n;
1770 	}
1771 
1772 	return err;
1773 }
1774 
1775 const struct got_error *
1776 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
1777 {
1778 	const struct got_error *err = NULL;
1779 	struct got_imsg_tag_object *itag;
1780 	uint8_t *buf;
1781 	size_t len, total;
1782 	size_t tag_len = strlen(tag->tag);
1783 	size_t tagger_len = strlen(tag->tagger);
1784 	size_t tagmsg_len = strlen(tag->tagmsg);
1785 
1786 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
1787 
1788 	buf = malloc(total);
1789 	if (buf == NULL)
1790 		return got_error_from_errno("malloc");
1791 
1792 	itag = (struct got_imsg_tag_object *)buf;
1793 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
1794 	itag->obj_type = tag->obj_type;
1795 	itag->tag_len = tag_len;
1796 	itag->tagger_len = tagger_len;
1797 	itag->tagger_time = tag->tagger_time;
1798 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1799 	itag->tagmsg_len = tagmsg_len;
1800 
1801 	len = sizeof(*itag);
1802 	memcpy(buf + len, tag->tag, tag_len);
1803 	len += tag_len;
1804 	memcpy(buf + len, tag->tagger, tagger_len);
1805 	len += tagger_len;
1806 
1807 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1808 		err = got_error_from_errno("imsg_compose TAG");
1809 		goto done;
1810 	}
1811 
1812 	if (tagmsg_len == 0 ||
1813 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1814 		err = flush_imsg(ibuf);
1815 		if (err)
1816 			goto done;
1817 	}
1818 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1819 done:
1820 	free(buf);
1821 	return err;
1822 }
1823 
1824 const struct got_error *
1825 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1826 {
1827 	const struct got_error *err = NULL;
1828 	struct imsg imsg;
1829 	struct got_imsg_tag_object *itag;
1830 	size_t len, datalen;
1831 	const size_t min_datalen =
1832 	    MIN(sizeof(struct got_imsg_error),
1833 	    sizeof(struct got_imsg_tag_object));
1834 
1835 	*tag = NULL;
1836 
1837 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1838 	if (err)
1839 		return err;
1840 
1841 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1842 	len = 0;
1843 
1844 	switch (imsg.hdr.type) {
1845 	case GOT_IMSG_TAG:
1846 		if (datalen < sizeof(*itag)) {
1847 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1848 			break;
1849 		}
1850 		itag = imsg.data;
1851 		if (datalen != sizeof(*itag) + itag->tag_len +
1852 		    itag->tagger_len) {
1853 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1854 			break;
1855 		}
1856 		len += sizeof(*itag);
1857 
1858 		*tag = calloc(1, sizeof(**tag));
1859 		if (*tag == NULL) {
1860 			err = got_error_from_errno("calloc");
1861 			break;
1862 		}
1863 
1864 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1865 
1866 		(*tag)->tag = strndup(imsg.data + len, itag->tag_len);
1867 		if ((*tag)->tag == NULL) {
1868 			err = got_error_from_errno("strndup");
1869 			break;
1870 		}
1871 		len += itag->tag_len;
1872 
1873 		(*tag)->obj_type = itag->obj_type;
1874 		(*tag)->tagger_time = itag->tagger_time;
1875 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1876 
1877 		(*tag)->tagger = strndup(imsg.data + len, itag->tagger_len);
1878 		if ((*tag)->tagger == NULL) {
1879 			err = got_error_from_errno("strndup");
1880 			break;
1881 		}
1882 		len += itag->tagger_len;
1883 
1884 		if (itag->tagmsg_len == 0) {
1885 			(*tag)->tagmsg = strdup("");
1886 			if ((*tag)->tagmsg == NULL) {
1887 				err = got_error_from_errno("strdup");
1888 				break;
1889 			}
1890 		} else {
1891 			size_t offset = 0, remain = itag->tagmsg_len;
1892 
1893 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1894 			if ((*tag)->tagmsg == NULL) {
1895 				err = got_error_from_errno("malloc");
1896 				break;
1897 			}
1898 			while (remain > 0) {
1899 				struct imsg imsg_log;
1900 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1901 				    remain);
1902 
1903 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1904 				if (err)
1905 					return err;
1906 
1907 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1908 					return got_error(GOT_ERR_PRIVSEP_MSG);
1909 
1910 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1911 				    n);
1912 				imsg_free(&imsg_log);
1913 				offset += n;
1914 				remain -= n;
1915 			}
1916 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1917 		}
1918 
1919 		break;
1920 	default:
1921 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1922 		break;
1923 	}
1924 
1925 	imsg_free(&imsg);
1926 
1927 	return err;
1928 }
1929 
1930 const struct got_error *
1931 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1932     struct got_packidx *packidx)
1933 {
1934 	const struct got_error *err = NULL;
1935 	struct got_imsg_packidx ipackidx;
1936 	struct got_imsg_pack ipack;
1937 	int fd;
1938 
1939 	memset(&ipackidx, 0, sizeof(ipackidx));
1940 	memset(&ipack, 0, sizeof(ipack));
1941 
1942 	ipackidx.len = packidx->len;
1943 	ipackidx.packfile_size = pack->filesize;
1944 	fd = dup(packidx->fd);
1945 	if (fd == -1)
1946 		return got_error_from_errno("dup");
1947 
1948 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1949 	    sizeof(ipackidx)) == -1) {
1950 		err = got_error_from_errno("imsg_compose PACKIDX");
1951 		close(fd);
1952 		return err;
1953 	}
1954 
1955 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1956 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1957 		return got_error(GOT_ERR_NO_SPACE);
1958 	ipack.filesize = pack->filesize;
1959 
1960 	fd = dup(pack->fd);
1961 	if (fd == -1)
1962 		return got_error_from_errno("dup");
1963 
1964 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
1965 	    == -1) {
1966 		err = got_error_from_errno("imsg_compose PACK");
1967 		close(fd);
1968 		return err;
1969 	}
1970 
1971 	return flush_imsg(ibuf);
1972 }
1973 
1974 const struct got_error *
1975 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
1976     struct got_object_id *id)
1977 {
1978 	struct got_imsg_packed_object iobj;
1979 
1980 	memset(&iobj, 0, sizeof(iobj));
1981 	iobj.idx = idx;
1982 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1983 
1984 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
1985 	    &iobj, sizeof(iobj)) == -1)
1986 		return got_error_from_errno("imsg_compose "
1987 		    "PACKED_OBJECT_REQUEST");
1988 
1989 	return flush_imsg(ibuf);
1990 }
1991 
1992 const struct got_error *
1993 got_privsep_send_packed_raw_obj_req(struct imsgbuf *ibuf, int idx,
1994     struct got_object_id *id)
1995 {
1996 	struct got_imsg_packed_object iobj;
1997 
1998 	memset(&iobj, 0, sizeof(iobj));
1999 	iobj.idx = idx;
2000 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
2001 
2002 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_RAW_OBJECT_REQUEST, 0, 0, -1,
2003 	    &iobj, sizeof(iobj)) == -1)
2004 		return got_error_from_errno("imsg_compose "
2005 		    "PACKED_OBJECT_REQUEST");
2006 
2007 	return flush_imsg(ibuf);
2008 }
2009 
2010 const struct got_error *
2011 got_privsep_send_gitconfig_parse_req(struct imsgbuf *ibuf, int fd)
2012 {
2013 	const struct got_error *err = NULL;
2014 
2015 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_PARSE_REQUEST, 0, 0, fd,
2016 	    NULL, 0) == -1) {
2017 		err = got_error_from_errno("imsg_compose "
2018 		    "GITCONFIG_PARSE_REQUEST");
2019 		close(fd);
2020 		return err;
2021 	}
2022 
2023 	return flush_imsg(ibuf);
2024 }
2025 
2026 const struct got_error *
2027 got_privsep_send_gitconfig_repository_format_version_req(struct imsgbuf *ibuf)
2028 {
2029 	if (imsg_compose(ibuf,
2030 	    GOT_IMSG_GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST, 0, 0, -1,
2031 	    NULL, 0) == -1)
2032 		return got_error_from_errno("imsg_compose "
2033 		    "GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST");
2034 
2035 	return flush_imsg(ibuf);
2036 }
2037 
2038 const struct got_error *
2039 got_privsep_send_gitconfig_repository_extensions_req(struct imsgbuf *ibuf)
2040 {
2041 	if (imsg_compose(ibuf,
2042 	    GOT_IMSG_GITCONFIG_REPOSITORY_EXTENSIONS_REQUEST, 0, 0, -1,
2043 	    NULL, 0) == -1)
2044 		return got_error_from_errno("imsg_compose "
2045 		    "GITCONFIG_REPOSITORY_EXTENSIONS_REQUEST");
2046 
2047 	return flush_imsg(ibuf);
2048 }
2049 
2050 
2051 const struct got_error *
2052 got_privsep_send_gitconfig_author_name_req(struct imsgbuf *ibuf)
2053 {
2054 	if (imsg_compose(ibuf,
2055 	    GOT_IMSG_GITCONFIG_AUTHOR_NAME_REQUEST, 0, 0, -1, NULL, 0) == -1)
2056 		return got_error_from_errno("imsg_compose "
2057 		    "GITCONFIG_AUTHOR_NAME_REQUEST");
2058 
2059 	return flush_imsg(ibuf);
2060 }
2061 
2062 const struct got_error *
2063 got_privsep_send_gitconfig_author_email_req(struct imsgbuf *ibuf)
2064 {
2065 	if (imsg_compose(ibuf,
2066 	    GOT_IMSG_GITCONFIG_AUTHOR_EMAIL_REQUEST, 0, 0, -1, NULL, 0) == -1)
2067 		return got_error_from_errno("imsg_compose "
2068 		    "GITCONFIG_AUTHOR_EMAIL_REQUEST");
2069 
2070 	return flush_imsg(ibuf);
2071 }
2072 
2073 const struct got_error *
2074 got_privsep_send_gitconfig_remotes_req(struct imsgbuf *ibuf)
2075 {
2076 	if (imsg_compose(ibuf,
2077 	    GOT_IMSG_GITCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
2078 		return got_error_from_errno("imsg_compose "
2079 		    "GITCONFIG_REMOTE_REQUEST");
2080 
2081 	return flush_imsg(ibuf);
2082 }
2083 
2084 const struct got_error *
2085 got_privsep_send_gitconfig_owner_req(struct imsgbuf *ibuf)
2086 {
2087 	if (imsg_compose(ibuf,
2088 	    GOT_IMSG_GITCONFIG_OWNER_REQUEST, 0, 0, -1, NULL, 0) == -1)
2089 		return got_error_from_errno("imsg_compose "
2090 		    "GITCONFIG_OWNER_REQUEST");
2091 
2092 	return flush_imsg(ibuf);
2093 }
2094 
2095 const struct got_error *
2096 got_privsep_recv_gitconfig_str(char **str, struct imsgbuf *ibuf)
2097 {
2098 	const struct got_error *err = NULL;
2099 	struct imsg imsg;
2100 	size_t datalen;
2101 
2102 	*str = NULL;
2103 
2104 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2105 	if (err)
2106 		return err;
2107 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2108 
2109 	switch (imsg.hdr.type) {
2110 	case GOT_IMSG_GITCONFIG_STR_VAL:
2111 		if (datalen == 0)
2112 			break;
2113 		/* datalen does not include terminating \0 */
2114 		*str = malloc(datalen + 1);
2115 		if (*str == NULL) {
2116 			err = got_error_from_errno("malloc");
2117 			break;
2118 		}
2119 		memcpy(*str, imsg.data, datalen);
2120 		(*str)[datalen] = '\0';
2121 		break;
2122 	default:
2123 		err = got_error(GOT_ERR_PRIVSEP_MSG);
2124 		break;
2125 	}
2126 
2127 	imsg_free(&imsg);
2128 	return err;
2129 }
2130 
2131 const struct got_error *
2132 got_privsep_recv_gitconfig_int(int *val, struct imsgbuf *ibuf)
2133 {
2134 	const struct got_error *err = NULL;
2135 	struct imsg imsg;
2136 	size_t datalen;
2137 	const size_t min_datalen =
2138 	    MIN(sizeof(struct got_imsg_error), sizeof(int));
2139 
2140 	*val = 0;
2141 
2142 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2143 	if (err)
2144 		return err;
2145 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2146 
2147 	switch (imsg.hdr.type) {
2148 	case GOT_IMSG_GITCONFIG_INT_VAL:
2149 		if (datalen != sizeof(*val)) {
2150 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2151 			break;
2152 		}
2153 		memcpy(val, imsg.data, sizeof(*val));
2154 		break;
2155 	default:
2156 		err = got_error(GOT_ERR_PRIVSEP_MSG);
2157 		break;
2158 	}
2159 
2160 	imsg_free(&imsg);
2161 	return err;
2162 }
2163 
2164 static void
2165 free_remote_data(struct got_remote_repo *remote)
2166 {
2167 	int i;
2168 
2169 	free(remote->name);
2170 	free(remote->fetch_url);
2171 	free(remote->send_url);
2172 	for (i = 0; i < remote->nfetch_branches; i++)
2173 		free(remote->fetch_branches[i]);
2174 	free(remote->fetch_branches);
2175 	for (i = 0; i < remote->nsend_branches; i++)
2176 		free(remote->send_branches[i]);
2177 	free(remote->send_branches);
2178 	for (i = 0; i < remote->nfetch_refs; i++)
2179 		free(remote->fetch_refs[i]);
2180 	free(remote->fetch_refs);
2181 }
2182 
2183 const struct got_error *
2184 got_privsep_recv_gitconfig_remotes(struct got_remote_repo **remotes,
2185     int *nremotes, struct imsgbuf *ibuf)
2186 {
2187 	const struct got_error *err = NULL;
2188 	struct imsg imsg;
2189 	size_t datalen;
2190 	struct got_imsg_remotes iremotes;
2191 	struct got_imsg_remote iremote;
2192 
2193 	*remotes = NULL;
2194 	*nremotes = 0;
2195 	iremotes.nremotes = 0;
2196 
2197 	err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremotes));
2198 	if (err)
2199 		return err;
2200 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2201 
2202 	switch (imsg.hdr.type) {
2203 	case GOT_IMSG_GITCONFIG_REMOTES:
2204 		if (datalen != sizeof(iremotes)) {
2205 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2206 			break;
2207 		}
2208 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
2209 		if (iremotes.nremotes == 0) {
2210 			imsg_free(&imsg);
2211 			return NULL;
2212 		}
2213 		break;
2214 	default:
2215 		imsg_free(&imsg);
2216 		return got_error(GOT_ERR_PRIVSEP_MSG);
2217 	}
2218 
2219 	imsg_free(&imsg);
2220 
2221 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(**remotes));
2222 	if (*remotes == NULL)
2223 		return got_error_from_errno("recallocarray");
2224 
2225 	while (*nremotes < iremotes.nremotes) {
2226 		struct got_remote_repo *remote;
2227 
2228 		err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremote));
2229 		if (err)
2230 			break;
2231 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2232 
2233 		switch (imsg.hdr.type) {
2234 		case GOT_IMSG_GITCONFIG_REMOTE:
2235 			remote = &(*remotes)[*nremotes];
2236 			memset(remote, 0, sizeof(*remote));
2237 			if (datalen < sizeof(iremote)) {
2238 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2239 				break;
2240 			}
2241 			memcpy(&iremote, imsg.data, sizeof(iremote));
2242 			if (iremote.name_len == 0 ||
2243 			    iremote.fetch_url_len == 0 ||
2244 			    iremote.send_url_len == 0 ||
2245 			    (sizeof(iremote) + iremote.name_len +
2246 			    iremote.fetch_url_len + iremote.send_url_len) > datalen) {
2247 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2248 				break;
2249 			}
2250 			remote->name = strndup(imsg.data + sizeof(iremote),
2251 			    iremote.name_len);
2252 			if (remote->name == NULL) {
2253 				err = got_error_from_errno("strndup");
2254 				break;
2255 			}
2256 			remote->fetch_url = strndup(imsg.data + sizeof(iremote) +
2257 			    iremote.name_len, iremote.fetch_url_len);
2258 			if (remote->fetch_url == NULL) {
2259 				err = got_error_from_errno("strndup");
2260 				free_remote_data(remote);
2261 				break;
2262 			}
2263 			remote->send_url = strndup(imsg.data + sizeof(iremote) +
2264 			    iremote.name_len + iremote.fetch_url_len,
2265 			    iremote.send_url_len);
2266 			if (remote->send_url == NULL) {
2267 				err = got_error_from_errno("strndup");
2268 				free_remote_data(remote);
2269 				break;
2270 			}
2271 			remote->mirror_references = iremote.mirror_references;
2272 			remote->fetch_all_branches = iremote.fetch_all_branches;
2273 			remote->nfetch_branches = 0;
2274 			remote->fetch_branches = NULL;
2275 			remote->nsend_branches = 0;
2276 			remote->send_branches = NULL;
2277 			remote->nfetch_refs = 0;
2278 			remote->fetch_refs = NULL;
2279 			(*nremotes)++;
2280 			break;
2281 		default:
2282 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2283 			break;
2284 		}
2285 
2286 		imsg_free(&imsg);
2287 		if (err)
2288 			break;
2289 	}
2290 
2291 	if (err) {
2292 		int i;
2293 		for (i = 0; i < *nremotes; i++)
2294 			free_remote_data(&(*remotes)[i]);
2295 		free(*remotes);
2296 		*remotes = NULL;
2297 		*nremotes = 0;
2298 	}
2299 	return err;
2300 }
2301 
2302 const struct got_error *
2303 got_privsep_send_gotconfig_parse_req(struct imsgbuf *ibuf, int fd)
2304 {
2305 	const struct got_error *err = NULL;
2306 
2307 	if (imsg_compose(ibuf, GOT_IMSG_GOTCONFIG_PARSE_REQUEST, 0, 0, fd,
2308 	    NULL, 0) == -1) {
2309 		err = got_error_from_errno("imsg_compose "
2310 		    "GOTCONFIG_PARSE_REQUEST");
2311 		close(fd);
2312 		return err;
2313 	}
2314 
2315 	return flush_imsg(ibuf);
2316 }
2317 
2318 const struct got_error *
2319 got_privsep_send_gotconfig_author_req(struct imsgbuf *ibuf)
2320 {
2321 	if (imsg_compose(ibuf,
2322 	    GOT_IMSG_GOTCONFIG_AUTHOR_REQUEST, 0, 0, -1, NULL, 0) == -1)
2323 		return got_error_from_errno("imsg_compose "
2324 		    "GOTCONFIG_AUTHOR_REQUEST");
2325 
2326 	return flush_imsg(ibuf);
2327 }
2328 
2329 const struct got_error *
2330 got_privsep_send_gotconfig_allowed_signers_req(struct imsgbuf *ibuf)
2331 {
2332 	if (imsg_compose(ibuf,
2333 	    GOT_IMSG_GOTCONFIG_ALLOWEDSIGNERS_REQUEST, 0, 0, -1, NULL, 0) == -1)
2334 		return got_error_from_errno("imsg_compose "
2335 		    "GOTCONFIG_ALLOWEDSIGNERS_REQUEST");
2336 
2337 	return flush_imsg(ibuf);
2338 }
2339 
2340 const struct got_error *
2341 got_privsep_send_gotconfig_revoked_signers_req(struct imsgbuf *ibuf)
2342 {
2343 	if (imsg_compose(ibuf,
2344 	    GOT_IMSG_GOTCONFIG_REVOKEDSIGNERS_REQUEST, 0, 0, -1, NULL, 0) == -1)
2345 		return got_error_from_errno("imsg_compose "
2346 		    "GOTCONFIG_REVOKEDSIGNERS_REQUEST");
2347 
2348 	return flush_imsg(ibuf);
2349 }
2350 
2351 const struct got_error *
2352 got_privsep_send_gotconfig_signer_id_req(struct imsgbuf *ibuf)
2353 {
2354 	if (imsg_compose(ibuf,
2355 	    GOT_IMSG_GOTCONFIG_SIGNERID_REQUEST, 0, 0, -1, NULL, 0) == -1)
2356 		return got_error_from_errno("imsg_compose "
2357 		    "GOTCONFIG_SIGNERID_REQUEST");
2358 
2359 	return flush_imsg(ibuf);
2360 }
2361 
2362 const struct got_error *
2363 got_privsep_send_gotconfig_remotes_req(struct imsgbuf *ibuf)
2364 {
2365 	if (imsg_compose(ibuf,
2366 	    GOT_IMSG_GOTCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
2367 		return got_error_from_errno("imsg_compose "
2368 		    "GOTCONFIG_REMOTE_REQUEST");
2369 
2370 	return flush_imsg(ibuf);
2371 }
2372 
2373 const struct got_error *
2374 got_privsep_recv_gotconfig_str(char **str, struct imsgbuf *ibuf)
2375 {
2376 	const struct got_error *err = NULL;
2377 	struct imsg imsg;
2378 	size_t datalen;
2379 
2380 	*str = NULL;
2381 
2382 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2383 	if (err)
2384 		return err;
2385 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2386 
2387 	switch (imsg.hdr.type) {
2388 	case GOT_IMSG_GOTCONFIG_STR_VAL:
2389 		if (datalen == 0)
2390 			break;
2391 		/* datalen does not include terminating \0 */
2392 		*str = malloc(datalen + 1);
2393 		if (*str == NULL) {
2394 			err = got_error_from_errno("malloc");
2395 			break;
2396 		}
2397 		memcpy(*str, imsg.data, datalen);
2398 		(*str)[datalen] = '\0';
2399 		break;
2400 	default:
2401 		err = got_error(GOT_ERR_PRIVSEP_MSG);
2402 		break;
2403 	}
2404 
2405 	imsg_free(&imsg);
2406 	return err;
2407 }
2408 
2409 const struct got_error *
2410 got_privsep_recv_gotconfig_remotes(struct got_remote_repo **remotes,
2411     int *nremotes, struct imsgbuf *ibuf)
2412 {
2413 	const struct got_error *err = NULL;
2414 	struct imsg imsg;
2415 	size_t datalen;
2416 	struct got_imsg_remotes iremotes;
2417 	struct got_imsg_remote iremote;
2418 	const size_t min_datalen =
2419 	    MIN(sizeof(struct got_imsg_error), sizeof(iremotes));
2420 
2421 	*remotes = NULL;
2422 	*nremotes = 0;
2423 	iremotes.nremotes = 0;
2424 
2425 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2426 	if (err)
2427 		return err;
2428 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2429 
2430 	switch (imsg.hdr.type) {
2431 	case GOT_IMSG_GOTCONFIG_REMOTES:
2432 		if (datalen != sizeof(iremotes)) {
2433 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2434 			break;
2435 		}
2436 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
2437 		if (iremotes.nremotes < 0) {
2438 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2439 			break;
2440 		}
2441 		if (iremotes.nremotes == 0) {
2442 			imsg_free(&imsg);
2443 			return NULL;
2444 		}
2445 		break;
2446 	default:
2447 		imsg_free(&imsg);
2448 		return got_error(GOT_ERR_PRIVSEP_MSG);
2449 	}
2450 
2451 	imsg_free(&imsg);
2452 
2453 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(**remotes));
2454 	if (*remotes == NULL)
2455 		return got_error_from_errno("recallocarray");
2456 
2457 	while (*nremotes < iremotes.nremotes) {
2458 		struct got_remote_repo *remote;
2459 		const size_t min_datalen =
2460 		    MIN(sizeof(struct got_imsg_error), sizeof(iremote));
2461 		int i;
2462 
2463 		err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2464 		if (err)
2465 			break;
2466 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2467 
2468 		switch (imsg.hdr.type) {
2469 		case GOT_IMSG_GOTCONFIG_REMOTE:
2470 			remote = &(*remotes)[*nremotes];
2471 			memset(remote, 0, sizeof(*remote));
2472 			if (datalen < sizeof(iremote)) {
2473 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2474 				break;
2475 			}
2476 			memcpy(&iremote, imsg.data, sizeof(iremote));
2477 			if (iremote.name_len == 0 ||
2478 			    (iremote.fetch_url_len == 0 &&
2479 			    iremote.send_url_len == 0) ||
2480 			    (sizeof(iremote) + iremote.name_len +
2481 			    iremote.fetch_url_len + iremote.send_url_len) >
2482 			    datalen) {
2483 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2484 				break;
2485 			}
2486 			remote->name = strndup(imsg.data + sizeof(iremote),
2487 			    iremote.name_len);
2488 			if (remote->name == NULL) {
2489 				err = got_error_from_errno("strndup");
2490 				break;
2491 			}
2492 			remote->fetch_url = strndup(imsg.data +
2493 			    sizeof(iremote) + iremote.name_len,
2494 			    iremote.fetch_url_len);
2495 			if (remote->fetch_url == NULL) {
2496 				err = got_error_from_errno("strndup");
2497 				free_remote_data(remote);
2498 				break;
2499 			}
2500 			remote->send_url = strndup(imsg.data +
2501 			    sizeof(iremote) + iremote.name_len +
2502 			    iremote.fetch_url_len, iremote.send_url_len);
2503 			if (remote->send_url == NULL) {
2504 				err = got_error_from_errno("strndup");
2505 				free_remote_data(remote);
2506 				break;
2507 			}
2508 			remote->mirror_references = iremote.mirror_references;
2509 			remote->fetch_all_branches = iremote.fetch_all_branches;
2510 			if (iremote.nfetch_branches > 0) {
2511 				remote->fetch_branches = recallocarray(NULL, 0,
2512 				    iremote.nfetch_branches, sizeof(char *));
2513 				if (remote->fetch_branches == NULL) {
2514 					err = got_error_from_errno("calloc");
2515 					free_remote_data(remote);
2516 					break;
2517 				}
2518 			}
2519 			remote->nfetch_branches = 0;
2520 			for (i = 0; i < iremote.nfetch_branches; i++) {
2521 				char *branch;
2522 				err = got_privsep_recv_gotconfig_str(&branch,
2523 				    ibuf);
2524 				if (err) {
2525 					free_remote_data(remote);
2526 					goto done;
2527 				}
2528 				remote->fetch_branches[i] = branch;
2529 				remote->nfetch_branches++;
2530 			}
2531 			if (iremote.nsend_branches > 0) {
2532 				remote->send_branches = recallocarray(NULL, 0,
2533 				    iremote.nsend_branches, sizeof(char *));
2534 				if (remote->send_branches == NULL) {
2535 					err = got_error_from_errno("calloc");
2536 					free_remote_data(remote);
2537 					break;
2538 				}
2539 			}
2540 			remote->nsend_branches = 0;
2541 			for (i = 0; i < iremote.nsend_branches; i++) {
2542 				char *branch;
2543 				err = got_privsep_recv_gotconfig_str(&branch,
2544 				    ibuf);
2545 				if (err) {
2546 					free_remote_data(remote);
2547 					goto done;
2548 				}
2549 				remote->send_branches[i] = branch;
2550 				remote->nsend_branches++;
2551 			}
2552 			if (iremote.nfetch_refs > 0) {
2553 				remote->fetch_refs = recallocarray(NULL, 0,
2554 				    iremote.nfetch_refs, sizeof(char *));
2555 				if (remote->fetch_refs == NULL) {
2556 					err = got_error_from_errno("calloc");
2557 					free_remote_data(remote);
2558 					break;
2559 				}
2560 			}
2561 			remote->nfetch_refs = 0;
2562 			for (i = 0; i < iremote.nfetch_refs; i++) {
2563 				char *ref;
2564 				err = got_privsep_recv_gotconfig_str(&ref,
2565 				    ibuf);
2566 				if (err) {
2567 					free_remote_data(remote);
2568 					goto done;
2569 				}
2570 				remote->fetch_refs[i] = ref;
2571 				remote->nfetch_refs++;
2572 			}
2573 			(*nremotes)++;
2574 			break;
2575 		default:
2576 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2577 			break;
2578 		}
2579 
2580 		imsg_free(&imsg);
2581 		if (err)
2582 			break;
2583 	}
2584 done:
2585 	if (err) {
2586 		int i;
2587 		for (i = 0; i < *nremotes; i++)
2588 			free_remote_data(&(*remotes)[i]);
2589 		free(*remotes);
2590 		*remotes = NULL;
2591 		*nremotes = 0;
2592 	}
2593 	return err;
2594 }
2595 
2596 const struct got_error *
2597 got_privsep_send_commit_traversal_request(struct imsgbuf *ibuf,
2598     struct got_object_id *id, int idx, const char *path)
2599 {
2600 	struct ibuf *wbuf;
2601 	size_t path_len = strlen(path) + 1;
2602 
2603 	wbuf = imsg_create(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_REQUEST, 0, 0,
2604 	    sizeof(struct got_imsg_commit_traversal_request) + path_len);
2605 	if (wbuf == NULL)
2606 		return got_error_from_errno(
2607 		    "imsg_create COMMIT_TRAVERSAL_REQUEST");
2608 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1)
2609 		return got_error_from_errno("imsg_add "
2610 		    "COMMIT_TRAVERSAL_REQUEST");
2611 	if (imsg_add(wbuf, &idx, sizeof(idx)) == -1)
2612 		return got_error_from_errno("imsg_add "
2613 		    "COMMIT_TRAVERSAL_REQUEST");
2614 	if (imsg_add(wbuf, path, path_len) == -1)
2615 		return got_error_from_errno("imsg_add "
2616 		    "COMMIT_TRAVERSAL_REQUEST");
2617 
2618 	wbuf->fd = -1;
2619 	imsg_close(ibuf, wbuf);
2620 
2621 	return flush_imsg(ibuf);
2622 }
2623 
2624 const struct got_error *
2625 got_privsep_recv_traversed_commits(struct got_commit_object **changed_commit,
2626     struct got_object_id **changed_commit_id,
2627     struct got_object_id_queue *commit_ids, struct imsgbuf *ibuf)
2628 {
2629 	const struct got_error *err = NULL;
2630 	struct imsg imsg;
2631 	struct got_imsg_traversed_commits *icommits;
2632 	size_t datalen;
2633 	int i, done = 0;
2634 
2635 	*changed_commit = NULL;
2636 	*changed_commit_id = NULL;
2637 
2638 	while (!done) {
2639 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2640 		if (err)
2641 			return err;
2642 
2643 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2644 		switch (imsg.hdr.type) {
2645 		case GOT_IMSG_TRAVERSED_COMMITS:
2646 			icommits = imsg.data;
2647 			if (datalen != sizeof(*icommits) +
2648 			    icommits->ncommits * SHA1_DIGEST_LENGTH) {
2649 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2650 				break;
2651 			}
2652 			for (i = 0; i < icommits->ncommits; i++) {
2653 				struct got_object_qid *qid;
2654 				uint8_t *sha1 = (uint8_t *)imsg.data +
2655 				    sizeof(*icommits) + i * SHA1_DIGEST_LENGTH;
2656 				err = got_object_qid_alloc_partial(&qid);
2657 				if (err)
2658 					break;
2659 				memcpy(qid->id.sha1, sha1, SHA1_DIGEST_LENGTH);
2660 				STAILQ_INSERT_TAIL(commit_ids, qid, entry);
2661 
2662 				/* The last commit may contain a change. */
2663 				if (i == icommits->ncommits - 1) {
2664 					*changed_commit_id =
2665 					    got_object_id_dup(&qid->id);
2666 					if (*changed_commit_id == NULL) {
2667 						err = got_error_from_errno(
2668 						    "got_object_id_dup");
2669 						break;
2670 					}
2671 				}
2672 			}
2673 			break;
2674 		case GOT_IMSG_COMMIT:
2675 			if (*changed_commit_id == NULL) {
2676 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2677 				break;
2678 			}
2679 			err = get_commit_from_imsg(changed_commit, &imsg,
2680 			    datalen, ibuf);
2681 			break;
2682 		case GOT_IMSG_COMMIT_TRAVERSAL_DONE:
2683 			done = 1;
2684 			break;
2685 		default:
2686 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2687 			break;
2688 		}
2689 
2690 		imsg_free(&imsg);
2691 		if (err)
2692 			break;
2693 	}
2694 
2695 	if (err)
2696 		got_object_id_queue_free(commit_ids);
2697 	return err;
2698 }
2699 
2700 const struct got_error *
2701 got_privsep_send_enumerated_tree(size_t *totlen, struct imsgbuf *ibuf,
2702     struct got_object_id *tree_id, const char *path,
2703     struct got_parsed_tree_entry *entries, int nentries)
2704 {
2705 	const struct got_error *err = NULL;
2706 	struct ibuf *wbuf;
2707 	size_t path_len = strlen(path);
2708 	size_t msglen;
2709 
2710 	msglen = sizeof(struct got_imsg_enumerated_tree) + path_len;
2711 	wbuf = imsg_create(ibuf, GOT_IMSG_ENUMERATED_TREE, 0, 0, msglen);
2712 	if (wbuf == NULL)
2713 		return got_error_from_errno("imsg_create ENUMERATED_TREE");
2714 
2715 	if (imsg_add(wbuf, tree_id->sha1, SHA1_DIGEST_LENGTH) == -1)
2716 		return got_error_from_errno("imsg_add ENUMERATED_TREE");
2717 	if (imsg_add(wbuf, &nentries, sizeof(nentries)) == -1)
2718 		return got_error_from_errno("imsg_add ENUMERATED_TREE");
2719 	if (imsg_add(wbuf, path, path_len) == -1)
2720 		return got_error_from_errno("imsg_add ENUMERATED_TREE");
2721 
2722 	wbuf->fd = -1;
2723 	imsg_close(ibuf, wbuf);
2724 
2725 	if (entries) {
2726 		err = send_tree_entries(ibuf, entries, nentries);
2727 		if (err)
2728 			return err;
2729 	}
2730 
2731 	return flush_imsg(ibuf);
2732 }
2733 
2734 const struct got_error *
2735 got_privsep_send_object_enumeration_request(struct imsgbuf *ibuf)
2736 {
2737 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_ENUMERATION_REQUEST,
2738 	    0, 0, -1, NULL, 0) == -1)
2739 		return got_error_from_errno("imsg_compose "
2740 		    "OBJECT_ENUMERATION_REQUEST");
2741 
2742 	return flush_imsg(ibuf);
2743 }
2744 
2745 const struct got_error *
2746 got_privsep_send_object_enumeration_done(struct imsgbuf *ibuf)
2747 {
2748 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_ENUMERATION_DONE,
2749 	    0, 0, -1, NULL, 0) == -1)
2750 		return got_error_from_errno("imsg_compose "
2751 		    "OBJECT_ENUMERATION_DONE");
2752 
2753 	return flush_imsg(ibuf);
2754 }
2755 
2756 const struct got_error *
2757 got_privsep_send_object_enumeration_incomplete(struct imsgbuf *ibuf)
2758 {
2759 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_ENUMERATION_INCOMPLETE,
2760 	    0, 0, -1, NULL, 0) == -1)
2761 		return got_error_from_errno("imsg_compose "
2762 		    "OBJECT_ENUMERATION_INCOMPLETE");
2763 
2764 	return flush_imsg(ibuf);
2765 }
2766 
2767 const struct got_error *
2768 got_privsep_send_enumerated_commit(struct imsgbuf *ibuf,
2769     struct got_object_id *id, time_t mtime)
2770 {
2771 	struct ibuf *wbuf;
2772 
2773 	wbuf = imsg_create(ibuf, GOT_IMSG_ENUMERATED_COMMIT, 0, 0,
2774 	    sizeof(struct got_imsg_enumerated_commit) + SHA1_DIGEST_LENGTH);
2775 	if (wbuf == NULL)
2776 		return got_error_from_errno("imsg_create ENUMERATED_COMMIT");
2777 
2778 	/* Keep in sync with struct got_imsg_enumerated_commit! */
2779 	if (imsg_add(wbuf, id, SHA1_DIGEST_LENGTH) == -1)
2780 		return got_error_from_errno("imsg_add ENUMERATED_COMMIT");
2781 	if (imsg_add(wbuf, &mtime, sizeof(mtime)) == -1)
2782 		return got_error_from_errno("imsg_add ENUMERATED_COMMIT");
2783 
2784 	wbuf->fd = -1;
2785 	imsg_close(ibuf, wbuf);
2786 	/* Don't flush yet, tree entries or ENUMERATION_DONE will follow. */
2787 	return NULL;
2788 }
2789 
2790 const struct got_error *
2791 got_privsep_recv_enumerated_objects(int *found_all_objects,
2792     struct imsgbuf *ibuf,
2793     got_object_enumerate_commit_cb cb_commit,
2794     got_object_enumerate_tree_cb cb_tree, void *cb_arg,
2795     struct got_repository *repo)
2796 {
2797 	const struct got_error *err = NULL;
2798 	struct imsg imsg;
2799 	struct got_imsg_enumerated_commit *icommit = NULL;
2800 	struct got_object_id commit_id;
2801 	int have_commit = 0;
2802 	time_t mtime = 0;
2803 	struct got_tree_object tree;
2804 	struct got_imsg_enumerated_tree *itree;
2805 	struct got_object_id tree_id;
2806 	char *path = NULL, *canon_path = NULL;
2807 	size_t datalen, path_len;
2808 	int nentries = -1;
2809 	int done = 0;
2810 
2811 	*found_all_objects = 0;
2812 	memset(&tree, 0, sizeof(tree));
2813 
2814 	while (!done) {
2815 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2816 		if (err)
2817 			break;
2818 
2819 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2820 		switch (imsg.hdr.type) {
2821 		case GOT_IMSG_ENUMERATED_COMMIT:
2822 			if (have_commit && nentries != -1) {
2823 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2824 				break;
2825 			}
2826 			if (datalen != sizeof(*icommit)) {
2827 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2828 				break;
2829 			}
2830 			icommit = (struct got_imsg_enumerated_commit *)imsg.data;
2831 			memcpy(commit_id.sha1, icommit->id, SHA1_DIGEST_LENGTH);
2832 			mtime = icommit->mtime;
2833 			have_commit = 1;
2834 			break;
2835 		case GOT_IMSG_ENUMERATED_TREE:
2836 			/* Should be preceeded by GOT_IMSG_ENUMERATED_COMMIT. */
2837 			if (!have_commit) {
2838 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2839 				break;
2840 			}
2841 			if (datalen < sizeof(*itree)) {
2842 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2843 				break;
2844 			}
2845 			itree = imsg.data;
2846 			path_len = datalen - sizeof(*itree);
2847 			if (path_len == 0) {
2848 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2849 				break;
2850 			}
2851 			memcpy(tree_id.sha1, itree->id, sizeof(tree_id.sha1));
2852 			free(path);
2853 			path = malloc(path_len + 1);
2854 			if (path == NULL) {
2855 				err = got_error_from_errno("malloc");
2856 				break;
2857 			}
2858 			free(canon_path);
2859 			canon_path = malloc(path_len + 1);
2860 			if (canon_path == NULL) {
2861 				err = got_error_from_errno("malloc");
2862 				break;
2863 			}
2864 			memcpy(path, (uint8_t *)imsg.data + sizeof(*itree),
2865 			    path_len);
2866 			path[path_len] = '\0';
2867 			if (!got_path_is_absolute(path)) {
2868 				err = got_error(GOT_ERR_BAD_PATH);
2869 				break;
2870 			}
2871 			if (got_path_is_root_dir(path)) {
2872 				/* XXX check what got_canonpath() does wrong */
2873 				canon_path[0] = '/';
2874 				canon_path[1] = '\0';
2875 			} else {
2876 				err = got_canonpath(path, canon_path,
2877 				    path_len + 1);
2878 				if (err)
2879 					break;
2880 			}
2881 			if (strcmp(path, canon_path) != 0) {
2882 				err = got_error(GOT_ERR_BAD_PATH);
2883 				break;
2884 			}
2885 			if (nentries != -1) {
2886 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2887 				break;
2888 			}
2889 			if (itree->nentries < -1) {
2890 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2891 				break;
2892 			}
2893 			if (itree->nentries == -1) {
2894 				/* Tree was not found in pack file. */
2895 				err = cb_tree(cb_arg, NULL, mtime, &tree_id,
2896 				    path, repo);
2897 				break;
2898 			}
2899 			if (itree->nentries > INT_MAX) {
2900 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2901 				break;
2902 			}
2903 			tree.entries = calloc(itree->nentries,
2904 			    sizeof(struct got_tree_entry));
2905 			if (tree.entries == NULL) {
2906 				err = got_error_from_errno("calloc");
2907 				break;
2908 			}
2909 			if (itree->nentries == 0) {
2910 				err = cb_tree(cb_arg, &tree, mtime, &tree_id,
2911 				    path, repo);
2912 				if (err)
2913 					break;
2914 
2915 				/* Prepare for next tree. */
2916 				free(tree.entries);
2917 				memset(&tree, 0, sizeof(tree));
2918 				nentries = -1;
2919 			} else {
2920 				tree.nentries = itree->nentries;
2921 				nentries = 0;
2922 			}
2923 			break;
2924 		case GOT_IMSG_TREE_ENTRIES:
2925 			/* Should be preceeded by GOT_IMSG_ENUMERATED_TREE. */
2926 			if (nentries <= -1) {
2927 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2928 				break;
2929 			}
2930 			err = recv_tree_entries(imsg.data, datalen,
2931 			    &tree, &nentries);
2932 			if (err)
2933 				break;
2934 			if (tree.nentries == nentries) {
2935 				err = cb_tree(cb_arg, &tree, mtime, &tree_id,
2936 				    path, repo);
2937 				if (err)
2938 					break;
2939 
2940 				/* Prepare for next tree. */
2941 				free(tree.entries);
2942 				memset(&tree, 0, sizeof(tree));
2943 				nentries = -1;
2944 			}
2945 			break;
2946 		case GOT_IMSG_TREE_ENUMERATION_DONE:
2947 			/* All trees have been found and traversed. */
2948 			if (!have_commit || path == NULL || nentries != -1) {
2949 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2950 				break;
2951 			}
2952 			err = cb_commit(cb_arg, mtime, &commit_id, repo);
2953 			if (err)
2954 				break;
2955 			have_commit = 0;
2956 			break;
2957 		case GOT_IMSG_OBJECT_ENUMERATION_DONE:
2958 			*found_all_objects = 1;
2959 			done = 1;
2960 			break;
2961 		case GOT_IMSG_OBJECT_ENUMERATION_INCOMPLETE:
2962 			done = 1;
2963 			break;
2964 		default:
2965 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2966 			break;
2967 		}
2968 
2969 		imsg_free(&imsg);
2970 		if (err)
2971 			break;
2972 	}
2973 
2974 	free(path);
2975 	free(canon_path);
2976 	free(tree.entries);
2977 	return err;
2978 }
2979 
2980 const struct got_error *
2981 got_privsep_send_raw_delta_req(struct imsgbuf *ibuf, int idx,
2982     struct got_object_id *id)
2983 {
2984 	struct got_imsg_raw_delta_request dreq;
2985 
2986 	memset(&dreq, 0, sizeof(dreq));
2987 	dreq.idx = idx;
2988 	memcpy(dreq.id, id->sha1, SHA1_DIGEST_LENGTH);
2989 
2990 	if (imsg_compose(ibuf, GOT_IMSG_RAW_DELTA_REQUEST, 0, 0, -1,
2991 	    &dreq, sizeof(dreq)) == -1)
2992 		return got_error_from_errno("imsg_compose RAW_DELTA_REQUEST");
2993 
2994 	return flush_imsg(ibuf);
2995 }
2996 
2997 const struct got_error *
2998 got_privsep_send_raw_delta_outfd(struct imsgbuf *ibuf, int fd)
2999 {
3000 	return send_fd(ibuf, GOT_IMSG_RAW_DELTA_OUTFD, fd);
3001 }
3002 
3003 const struct got_error *
3004 got_privsep_send_raw_delta(struct imsgbuf *ibuf, uint64_t base_size,
3005     uint64_t result_size,  off_t delta_size, off_t delta_compressed_size,
3006     off_t delta_offset, off_t delta_out_offset, struct got_object_id *base_id)
3007 {
3008 	struct got_imsg_raw_delta idelta;
3009 	int ret;
3010 
3011 	memset(&idelta, 0, sizeof(idelta));
3012 	idelta.base_size = base_size;
3013 	idelta.result_size = result_size;
3014 	idelta.delta_size = delta_size;
3015 	idelta.delta_compressed_size = delta_compressed_size;
3016 	idelta.delta_offset = delta_offset;
3017 	idelta.delta_out_offset = delta_out_offset;
3018 	memcpy(idelta.base_id, base_id->sha1, SHA1_DIGEST_LENGTH);
3019 
3020 	ret = imsg_compose(ibuf, GOT_IMSG_RAW_DELTA, 0, 0, -1,
3021 	    &idelta, sizeof(idelta));
3022 	if (ret == -1)
3023 		return got_error_from_errno("imsg_compose RAW_DELTA");
3024 
3025 	return flush_imsg(ibuf);
3026 }
3027 
3028 const struct got_error *
3029 got_privsep_recv_raw_delta(uint64_t *base_size, uint64_t *result_size,
3030     off_t *delta_size, off_t *delta_compressed_size, off_t *delta_offset,
3031     off_t *delta_out_offset, struct got_object_id **base_id, struct imsgbuf *ibuf)
3032 {
3033 	const struct got_error *err = NULL;
3034 	struct imsg imsg;
3035 	struct got_imsg_raw_delta *delta;
3036 	size_t datalen;
3037 
3038 	*base_size = 0;
3039 	*result_size = 0;
3040 	*delta_size = 0;
3041 	*delta_compressed_size = 0;
3042 	*delta_offset = 0;
3043 	*delta_out_offset = 0;
3044 	*base_id = NULL;
3045 
3046 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3047 	if (err)
3048 		return err;
3049 
3050 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3051 
3052 	switch (imsg.hdr.type) {
3053 	case GOT_IMSG_RAW_DELTA:
3054 		if (datalen != sizeof(*delta)) {
3055 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3056 			break;
3057 		}
3058 		delta = imsg.data;
3059 		*base_size = delta->base_size;
3060 		*result_size = delta->result_size;
3061 		*delta_size = delta->delta_size;
3062 		*delta_compressed_size = delta->delta_compressed_size;
3063 		*delta_offset = delta->delta_offset;
3064 		*delta_out_offset = delta->delta_out_offset;
3065 		*base_id = calloc(1, sizeof(**base_id));
3066 		if (*base_id == NULL) {
3067 			err = got_error_from_errno("malloc");
3068 			break;
3069 		}
3070 		memcpy((*base_id)->sha1, delta->base_id, SHA1_DIGEST_LENGTH);
3071 		break;
3072 	default:
3073 		err = got_error(GOT_ERR_PRIVSEP_MSG);
3074 		break;
3075 	}
3076 
3077 	imsg_free(&imsg);
3078 
3079 	if (err) {
3080 		free(*base_id);
3081 		*base_id = NULL;
3082 	}
3083 	return err;
3084 }
3085 
3086 static const struct got_error *
3087 send_idlist(struct imsgbuf *ibuf, struct got_object_id **ids, size_t nids)
3088 {
3089 	const struct got_error *err = NULL;
3090 	struct got_imsg_object_idlist idlist;
3091 	struct ibuf *wbuf;
3092 	size_t i;
3093 
3094 	memset(&idlist, 0, sizeof(idlist));
3095 
3096 	if (nids > GOT_IMSG_OBJ_ID_LIST_MAX_NIDS)
3097 		return got_error(GOT_ERR_NO_SPACE);
3098 
3099 	wbuf = imsg_create(ibuf, GOT_IMSG_OBJ_ID_LIST, 0, 0,
3100 	    sizeof(idlist) + nids * sizeof(**ids));
3101 	if (wbuf == NULL) {
3102 		err = got_error_from_errno("imsg_create OBJ_ID_LIST");
3103 		return err;
3104 	}
3105 
3106 	idlist.nids = nids;
3107 	if (imsg_add(wbuf, &idlist, sizeof(idlist)) == -1)
3108 		return got_error_from_errno("imsg_add OBJ_ID_LIST");
3109 
3110 	for (i = 0; i < nids; i++) {
3111 		struct got_object_id *id = ids[i];
3112 		if (imsg_add(wbuf, id, sizeof(*id)) == -1)
3113 			return got_error_from_errno("imsg_add OBJ_ID_LIST");
3114 	}
3115 
3116 	wbuf->fd = -1;
3117 	imsg_close(ibuf, wbuf);
3118 
3119 	return flush_imsg(ibuf);
3120 }
3121 
3122 const struct got_error *
3123 got_privsep_send_object_idlist(struct imsgbuf *ibuf,
3124     struct got_object_id **ids, size_t nids)
3125 {
3126 	const struct got_error *err = NULL;
3127 	struct got_object_id *idlist[GOT_IMSG_OBJ_ID_LIST_MAX_NIDS];
3128 	int i, queued = 0;
3129 
3130 	for (i = 0; i < nids; i++) {
3131 		idlist[i % nitems(idlist)] = ids[i];
3132 		queued++;
3133 		if (queued >= nitems(idlist)) {
3134 			err = send_idlist(ibuf, idlist, queued);
3135 			if (err)
3136 				return err;
3137 			queued = 0;
3138 		}
3139 	}
3140 
3141 	if (queued > 0) {
3142 		err = send_idlist(ibuf, idlist, queued);
3143 		if (err)
3144 			return err;
3145 	}
3146 
3147 	return NULL;
3148 }
3149 
3150 const struct got_error *
3151 got_privsep_send_object_idlist_done(struct imsgbuf *ibuf)
3152 {
3153 	if (imsg_compose(ibuf, GOT_IMSG_OBJ_ID_LIST_DONE, 0, 0, -1, NULL, 0)
3154 	    == -1)
3155 		return got_error_from_errno("imsg_compose OBJ_ID_LIST_DONE");
3156 
3157 	return flush_imsg(ibuf);
3158 }
3159 
3160 const struct got_error *
3161 got_privsep_recv_object_idlist(int *done, struct got_object_id **ids,
3162     size_t *nids, struct imsgbuf *ibuf)
3163 {
3164 	const struct got_error *err = NULL;
3165 	struct imsg imsg;
3166 	struct got_imsg_object_idlist *idlist;
3167 	size_t datalen;
3168 
3169 	*ids = NULL;
3170 	*done = 0;
3171 	*nids = 0;
3172 
3173 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3174 	if (err)
3175 		return err;
3176 
3177 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3178 	switch (imsg.hdr.type) {
3179 	case GOT_IMSG_OBJ_ID_LIST:
3180 		if (datalen < sizeof(*idlist)) {
3181 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3182 			break;
3183 		}
3184 		idlist = imsg.data;
3185 		if (idlist->nids > GOT_IMSG_OBJ_ID_LIST_MAX_NIDS ||
3186 		    idlist->nids * sizeof(**ids) > datalen - sizeof(*idlist)) {
3187 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3188 			break;
3189 		}
3190 		*nids = idlist->nids;
3191 		*ids = calloc(*nids, sizeof(**ids));
3192 		if (*ids == NULL) {
3193 			err = got_error_from_errno("calloc");
3194 			break;
3195 		}
3196 		memcpy(*ids, (uint8_t *)imsg.data + sizeof(*idlist),
3197 		    *nids * sizeof(**ids));
3198 		break;
3199 	case GOT_IMSG_OBJ_ID_LIST_DONE:
3200 		*done = 1;
3201 		break;
3202 	default:
3203 		err = got_error(GOT_ERR_PRIVSEP_MSG);
3204 		break;
3205 	}
3206 
3207 	imsg_free(&imsg);
3208 
3209 	return err;
3210 }
3211 
3212 const struct got_error *
3213 got_privsep_send_delta_reuse_req(struct imsgbuf *ibuf)
3214 {
3215 	if (imsg_compose(ibuf, GOT_IMSG_DELTA_REUSE_REQUEST, 0, 0, -1, NULL, 0)
3216 	    == -1)
3217 		return got_error_from_errno("imsg_compose DELTA_REUSE_REQUEST");
3218 
3219 	return flush_imsg(ibuf);
3220 }
3221 
3222 const struct got_error *
3223 got_privsep_send_reused_deltas(struct imsgbuf *ibuf,
3224     struct got_imsg_reused_delta *deltas, size_t ndeltas)
3225 {
3226 	const struct got_error *err = NULL;
3227 	struct ibuf *wbuf;
3228 	struct got_imsg_reused_deltas ideltas;
3229 	size_t i;
3230 
3231 	memset(&ideltas, 0, sizeof(ideltas));
3232 
3233 	if (ndeltas > GOT_IMSG_REUSED_DELTAS_MAX_NDELTAS)
3234 		return got_error(GOT_ERR_NO_SPACE);
3235 
3236 	wbuf = imsg_create(ibuf, GOT_IMSG_REUSED_DELTAS, 0, 0,
3237 	    sizeof(ideltas) + ndeltas * sizeof(*deltas));
3238 	if (wbuf == NULL) {
3239 		err = got_error_from_errno("imsg_create REUSED_DELTAS");
3240 		return err;
3241 	}
3242 
3243 	ideltas.ndeltas = ndeltas;
3244 	if (imsg_add(wbuf, &ideltas, sizeof(ideltas)) == -1)
3245 		return got_error_from_errno("imsg_add REUSED_DELTAS");
3246 
3247 	for (i = 0; i < ndeltas; i++) {
3248 		struct got_imsg_reused_delta *delta = &deltas[i];
3249 		if (imsg_add(wbuf, delta, sizeof(*delta)) == -1)
3250 			return got_error_from_errno("imsg_add REUSED_DELTAS");
3251 	}
3252 
3253 	wbuf->fd = -1;
3254 	imsg_close(ibuf, wbuf);
3255 
3256 	return flush_imsg(ibuf);
3257 }
3258 
3259 const struct got_error *
3260 got_privsep_send_reused_deltas_done(struct imsgbuf *ibuf)
3261 {
3262 	if (imsg_compose(ibuf, GOT_IMSG_DELTA_REUSE_DONE, 0, 0, -1, NULL, 0)
3263 	    == -1)
3264 		return got_error_from_errno("imsg_compose DELTA_REUSE_DONE");
3265 
3266 	return flush_imsg(ibuf);
3267 }
3268 
3269 const struct got_error *
3270 got_privsep_recv_reused_deltas(int *done, struct got_imsg_reused_delta *deltas,
3271     size_t *ndeltas, struct imsgbuf *ibuf)
3272 {
3273 	const struct got_error *err = NULL;
3274 	struct imsg imsg;
3275 	struct got_imsg_reused_deltas *ideltas;
3276 	size_t datalen;
3277 
3278 	*done = 0;
3279 	*ndeltas = 0;
3280 
3281 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3282 	if (err)
3283 		return err;
3284 
3285 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3286 	switch (imsg.hdr.type) {
3287 	case GOT_IMSG_REUSED_DELTAS:
3288 		if (datalen < sizeof(*ideltas)) {
3289 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3290 			break;
3291 		}
3292 		ideltas = imsg.data;
3293 		if (ideltas->ndeltas > GOT_IMSG_OBJ_ID_LIST_MAX_NIDS ||
3294 		    ideltas->ndeltas * sizeof(*deltas) >
3295 		    datalen - sizeof(*ideltas)) {
3296 			err = got_error(GOT_ERR_PRIVSEP_LEN);
3297 			break;
3298 		}
3299 		*ndeltas = ideltas->ndeltas;
3300 		memcpy(deltas, (uint8_t *)imsg.data + sizeof(*ideltas),
3301 		    *ndeltas * sizeof(*deltas));
3302 		break;
3303 	case GOT_IMSG_DELTA_REUSE_DONE:
3304 		*done = 1;
3305 		break;
3306 	default:
3307 		err = got_error(GOT_ERR_PRIVSEP_MSG);
3308 		break;
3309 	}
3310 
3311 	imsg_free(&imsg);
3312 
3313 	return err;
3314 }
3315 
3316 const struct got_error *
3317 got_privsep_init_commit_painting(struct imsgbuf *ibuf)
3318 {
3319 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_PAINTING_INIT,
3320 	    0, 0, -1, NULL, 0)
3321 	    == -1)
3322 		return got_error_from_errno("imsg_compose "
3323 		    "COMMIT_PAINTING_INIT");
3324 
3325 	return flush_imsg(ibuf);
3326 }
3327 
3328 const struct got_error *
3329 got_privsep_send_painting_request(struct imsgbuf *ibuf, int idx,
3330     struct got_object_id *id, intptr_t color)
3331 {
3332 	struct got_imsg_commit_painting_request ireq;
3333 
3334 	memset(&ireq, 0, sizeof(ireq));
3335 	memcpy(ireq.id, id->sha1, sizeof(ireq.id));
3336 	ireq.idx = idx;
3337 	ireq.color = color;
3338 
3339 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_PAINTING_REQUEST, 0, 0, -1,
3340 	    &ireq, sizeof(ireq)) == -1)
3341 		return got_error_from_errno("imsg_compose "
3342 		    "COMMIT_PAINTING_REQUEST");
3343 
3344 	return flush_imsg(ibuf);
3345 }
3346 
3347 static const struct got_error *
3348 send_painted_commits(struct got_object_id_queue *ids, int *nids,
3349     size_t remain, int present_in_pack, struct imsgbuf *ibuf)
3350 {
3351 	const struct got_error *err = NULL;
3352 	struct ibuf *wbuf = NULL;
3353 	struct got_object_qid *qid;
3354 	size_t msglen;
3355 	int ncommits;
3356 	intptr_t color;
3357 
3358 	msglen = MIN(remain, MAX_IMSGSIZE - IMSG_HEADER_SIZE);
3359 	ncommits = (msglen - sizeof(struct got_imsg_painted_commits)) /
3360 	    sizeof(struct got_imsg_painted_commit);
3361 
3362 	wbuf = imsg_create(ibuf, GOT_IMSG_PAINTED_COMMITS, 0, 0, msglen);
3363 	if (wbuf == NULL) {
3364 		err = got_error_from_errno("imsg_create PAINTED_COMMITS");
3365 		return err;
3366 	}
3367 
3368 	/* Keep in sync with struct got_imsg_painted_commits! */
3369 	if (imsg_add(wbuf, &ncommits, sizeof(ncommits)) == -1)
3370 		return got_error_from_errno("imsg_add PAINTED_COMMITS");
3371 	if (imsg_add(wbuf, &present_in_pack, sizeof(present_in_pack)) == -1)
3372 		return got_error_from_errno("imsg_add PAINTED_COMMITS");
3373 
3374 	while (ncommits > 0) {
3375 		qid = STAILQ_FIRST(ids);
3376 		STAILQ_REMOVE_HEAD(ids, entry);
3377 		ncommits--;
3378 		(*nids)--;
3379 		color = (intptr_t)qid->data;
3380 
3381 		/* Keep in sync with struct got_imsg_painted_commit! */
3382 		if (imsg_add(wbuf, qid->id.sha1, SHA1_DIGEST_LENGTH) == -1)
3383 			return got_error_from_errno("imsg_add PAINTED_COMMITS");
3384 		if (imsg_add(wbuf, &color, sizeof(color)) == -1)
3385 			return got_error_from_errno("imsg_add PAINTED_COMMITS");
3386 
3387 		got_object_qid_free(qid);
3388 	}
3389 
3390 	wbuf->fd = -1;
3391 	imsg_close(ibuf, wbuf);
3392 
3393 	return flush_imsg(ibuf);
3394 }
3395 
3396 const struct got_error *
3397 got_privsep_send_painted_commits(struct imsgbuf *ibuf,
3398     struct got_object_id_queue *ids, int *nids,
3399     int present_in_pack, int flush)
3400 {
3401 	const struct got_error *err;
3402 	size_t remain;
3403 
3404 	if (*nids <= 0)
3405 		return NULL;
3406 
3407 	do {
3408 		remain = (sizeof(struct got_imsg_painted_commits)) +
3409 		    *nids * sizeof(struct got_imsg_painted_commit);
3410 		if (flush || remain >= MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
3411 			err = send_painted_commits(ids, nids, remain,
3412 			    present_in_pack, ibuf);
3413 			if (err)
3414 				return err;
3415 		}
3416 	} while (flush && *nids > 0);
3417 
3418 	return NULL;
3419 }
3420 
3421 const struct got_error *
3422 got_privsep_send_painting_commits_done(struct imsgbuf *ibuf)
3423 {
3424 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_PAINTING_DONE,
3425 	    0, 0, -1, NULL, 0)
3426 	    == -1)
3427 		return got_error_from_errno("imsg_compose "
3428 		    "COMMIT_PAINTING_DONE");
3429 
3430 	return flush_imsg(ibuf);
3431 }
3432 
3433 const struct got_error *
3434 got_privsep_recv_painted_commits(struct got_object_id_queue *new_ids,
3435     got_privsep_recv_painted_commit_cb cb, void *cb_arg, struct imsgbuf *ibuf)
3436 {
3437 	const struct got_error *err = NULL;
3438 	struct imsg imsg;
3439 	struct got_imsg_painted_commits icommits;
3440 	struct got_imsg_painted_commit icommit;
3441 	size_t datalen;
3442 	int i;
3443 
3444 	for (;;) {
3445 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
3446 		if (err)
3447 			return err;
3448 
3449 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
3450 		if (imsg.hdr.type == GOT_IMSG_COMMIT_PAINTING_DONE)
3451 			break;
3452 		if (imsg.hdr.type != GOT_IMSG_PAINTED_COMMITS)
3453 			return got_error(GOT_ERR_PRIVSEP_MSG);
3454 
3455 		if (datalen < sizeof(icommits))
3456 			return got_error(GOT_ERR_PRIVSEP_LEN);
3457 		memcpy(&icommits, imsg.data, sizeof(icommits));
3458 		if (icommits.ncommits * sizeof(icommit) < icommits.ncommits ||
3459 		    datalen < sizeof(icommits) +
3460 		    icommits.ncommits * sizeof(icommit))
3461 			return got_error(GOT_ERR_PRIVSEP_LEN);
3462 
3463 		for (i = 0; i < icommits.ncommits; i++) {
3464 			memcpy(&icommit,
3465 			    (uint8_t *)imsg.data + sizeof(icommits) + i * sizeof(icommit),
3466 			    sizeof(icommit));
3467 
3468 			if (icommits.present_in_pack) {
3469 				struct got_object_id id;
3470 				memcpy(id.sha1, icommit.id, SHA1_DIGEST_LENGTH);
3471 				err = cb(cb_arg, &id, icommit.color);
3472 				if (err)
3473 					break;
3474 			} else {
3475 				struct got_object_qid *qid;
3476 				err = got_object_qid_alloc_partial(&qid);
3477 				if (err)
3478 					break;
3479 				memcpy(qid->id.sha1, icommit.id,
3480 				    SHA1_DIGEST_LENGTH);
3481 				qid->data = (void *)icommit.color;
3482 				STAILQ_INSERT_TAIL(new_ids, qid, entry);
3483 			}
3484 		}
3485 
3486 		imsg_free(&imsg);
3487 	}
3488 
3489 	return err;
3490 }
3491 
3492 const struct got_error *
3493 got_privsep_unveil_exec_helpers(void)
3494 {
3495 	const char *helpers[] = {
3496 	    GOT_PATH_PROG_READ_PACK,
3497 	    GOT_PATH_PROG_READ_OBJECT,
3498 	    GOT_PATH_PROG_READ_COMMIT,
3499 	    GOT_PATH_PROG_READ_TREE,
3500 	    GOT_PATH_PROG_READ_BLOB,
3501 	    GOT_PATH_PROG_READ_TAG,
3502 	    GOT_PATH_PROG_READ_GITCONFIG,
3503 	    GOT_PATH_PROG_READ_GOTCONFIG,
3504 	    GOT_PATH_PROG_READ_PATCH,
3505 	    GOT_PATH_PROG_FETCH_PACK,
3506 	    GOT_PATH_PROG_INDEX_PACK,
3507 	    GOT_PATH_PROG_SEND_PACK,
3508 	};
3509 	size_t i;
3510 
3511 	for (i = 0; i < nitems(helpers); i++) {
3512 		if (unveil(helpers[i], "x") == 0)
3513 			continue;
3514 		return got_error_from_errno2("unveil", helpers[i]);
3515 	}
3516 
3517 	return NULL;
3518 }
3519 
3520 void
3521 got_privsep_exec_child(int imsg_fds[2], const char *path, const char *repo_path)
3522 {
3523 	if (close(imsg_fds[0]) == -1) {
3524 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
3525 		_exit(1);
3526 	}
3527 
3528 	if (dup2(imsg_fds[1], GOT_IMSG_FD_CHILD) == -1) {
3529 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
3530 		_exit(1);
3531 	}
3532 
3533 	closefrom(GOT_IMSG_FD_CHILD + 1);
3534 
3535 	if (execl(path, path, repo_path, (char *)NULL) == -1) {
3536 		fprintf(stderr, "%s: %s: %s\n", getprogname(), path,
3537 		    strerror(errno));
3538 		_exit(1);
3539 	}
3540 }