1 /*
2  * Copyright (c) 2019 Ori Bernstein <ori@openbsd.org>
3  * Copyright (c) 2021 Stefan Sperling <stsp@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/queue.h>
20 #include <sys/uio.h>
21 #include <sys/time.h>
22 #include <sys/stat.h>
23 
24 #include <stdint.h>
25 #include <errno.h>
26 #include <limits.h>
27 #include <signal.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <ctype.h>
32 #include <fcntl.h>
33 #include <unistd.h>
34 #include <zlib.h>
35 #include <err.h>
36 
37 #include "got_error.h"
38 #include "got_object.h"
39 #include "got_path.h"
40 #include "got_version.h"
41 #include "got_fetch.h"
42 #include "got_reference.h"
43 
44 #include "got_lib_sha1.h"
45 #include "got_lib_delta.h"
46 #include "got_lib_object.h"
47 #include "got_lib_object_parse.h"
48 #include "got_lib_privsep.h"
49 #include "got_lib_pack.h"
50 #include "got_lib_pkt.h"
51 #include "got_lib_gitproto.h"
52 #include "got_lib_ratelimit.h"
53 #include "got_lib_poll.h"
54 
55 #ifndef nitems
56 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
57 #endif
58 
59 struct got_object *indexed;
60 static int chattygot;
61 
62 static const struct got_capability got_capabilities[] = {
63 	{ GOT_CAPA_AGENT, "got/" GOT_VERSION_STR },
64 	{ GOT_CAPA_OFS_DELTA, NULL },
65 #if 0
66 	{ GOT_CAPA_SIDE_BAND_64K, NULL },
67 #endif
68 	{ GOT_CAPA_REPORT_STATUS, NULL },
69 	{ GOT_CAPA_DELETE_REFS, NULL },
70 };
71 
72 static const struct got_error *
73 send_upload_progress(struct imsgbuf *ibuf, off_t bytes,
74     struct got_ratelimit *rl)
75 {
76 	const struct got_error *err = NULL;
77 	int elapsed = 0;
78 
79 	if (rl) {
80 		err = got_ratelimit_check(&elapsed, rl);
81 		if (err || !elapsed)
82 			return err;
83 	}
84 
85 	if (imsg_compose(ibuf, GOT_IMSG_SEND_UPLOAD_PROGRESS, 0, 0, -1,
86 	    &bytes, sizeof(bytes)) == -1)
87 		return got_error_from_errno(
88 		    "imsg_compose SEND_UPLOAD_PROGRESS");
89 
90 	return got_privsep_flush_imsg(ibuf);
91 }
92 
93 static const struct got_error *
94 send_pack_request(struct imsgbuf *ibuf)
95 {
96 	if (imsg_compose(ibuf, GOT_IMSG_SEND_PACK_REQUEST, 0, 0, -1,
97 	    NULL, 0) == -1)
98 		return got_error_from_errno("imsg_compose SEND_PACK_REQUEST");
99 	return got_privsep_flush_imsg(ibuf);
100 }
101 
102 static const struct got_error *
103 send_done(struct imsgbuf *ibuf)
104 {
105 	if (imsg_compose(ibuf, GOT_IMSG_SEND_DONE, 0, 0, -1, NULL, 0) == -1)
106 		return got_error_from_errno("imsg_compose SEND_DONE");
107 	return got_privsep_flush_imsg(ibuf);
108 }
109 
110 static const struct got_error *
111 recv_packfd(int *packfd, struct imsgbuf *ibuf)
112 {
113 	const struct got_error *err;
114 	struct imsg imsg;
115 
116 	*packfd = -1;
117 
118 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
119 	if (err)
120 		return err;
121 
122 	if (imsg.hdr.type == GOT_IMSG_STOP) {
123 		err = got_error(GOT_ERR_CANCELLED);
124 		goto done;
125 	}
126 
127 	if (imsg.hdr.type != GOT_IMSG_SEND_PACKFD) {
128 		err = got_error(GOT_ERR_PRIVSEP_MSG);
129 		goto done;
130 	}
131 
132 	if (imsg.hdr.len - IMSG_HEADER_SIZE != 0) {
133 		err = got_error(GOT_ERR_PRIVSEP_LEN);
134 		goto done;
135 	}
136 
137 	*packfd = imsg.fd;
138 done:
139 	imsg_free(&imsg);
140 	return err;
141 }
142 
143 static const struct got_error *
144 send_pack_file(int sendfd, int packfd, struct imsgbuf *ibuf)
145 {
146 	const struct got_error *err;
147 	unsigned char buf[8192];
148 	ssize_t r;
149 	off_t wtotal = 0;
150 	struct got_ratelimit rl;
151 
152 	if (lseek(packfd, 0L, SEEK_SET) == -1)
153 		return got_error_from_errno("lseek");
154 
155 	got_ratelimit_init(&rl, 0, 500);
156 
157 	for (;;) {
158 		r = read(packfd, buf, sizeof(buf));
159 		if (r == -1)
160 			return got_error_from_errno("read");
161 		if (r == 0)
162 			break;
163 		err = got_poll_write_full(sendfd, buf, r);
164 		if (err)
165 			return NULL;
166 		wtotal += r;
167 		err = send_upload_progress(ibuf, wtotal, &rl);
168 		if (err)
169 			return err;
170 	}
171 
172 	return send_upload_progress(ibuf, wtotal, NULL);
173 }
174 
175 static const struct got_error *
176 send_error(const char *buf, size_t len)
177 {
178 	static char msg[1024];
179 	size_t i;
180 
181 	for (i = 0; i < len && i < sizeof(msg) - 1; i++) {
182 		if (!isprint((unsigned char)buf[i]))
183 			return got_error_msg(GOT_ERR_BAD_PACKET,
184 			    "non-printable error message received from server");
185 		msg[i] = buf[i];
186 	}
187 	msg[i] = '\0';
188 	return got_error_msg(GOT_ERR_SEND_FAILED, msg);
189 }
190 
191 static const struct got_error *
192 send_their_ref(struct imsgbuf *ibuf, struct got_object_id *refid,
193     const char *refname)
194 {
195 	struct ibuf *wbuf;
196 	size_t len, reflen = strlen(refname);
197 
198 	len = sizeof(struct got_imsg_send_remote_ref) + reflen;
199 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
200 		return got_error(GOT_ERR_NO_SPACE);
201 
202 	wbuf = imsg_create(ibuf, GOT_IMSG_SEND_REMOTE_REF, 0, 0, len);
203 	if (wbuf == NULL)
204 		return got_error_from_errno("imsg_create SEND_REMOTE_REF");
205 
206 	/* Keep in sync with struct got_imsg_send_remote_ref definition! */
207 	if (imsg_add(wbuf, refid, sizeof(*refid)) == -1)
208 		return got_error_from_errno("imsg_add SEND_REMOTE_REF");
209 	if (imsg_add(wbuf, &reflen, sizeof(reflen)) == -1)
210 		return got_error_from_errno("imsg_add SEND_REMOTE_REF");
211 	if (imsg_add(wbuf, refname, reflen) == -1)
212 		return got_error_from_errno("imsg_add SEND_REMOTE_REF");
213 
214 	wbuf->fd = -1;
215 	imsg_close(ibuf, wbuf);
216 	return got_privsep_flush_imsg(ibuf);
217 }
218 
219 static const struct got_error *
220 send_ref_status(struct imsgbuf *ibuf, const char *refname, int success,
221     struct got_pathlist_head *refs, struct got_pathlist_head *delete_refs)
222 {
223 	struct ibuf *wbuf;
224 	size_t i, len, reflen, errmsglen = 0;
225 	struct got_pathlist_entry *pe;
226 	int ref_valid = 0;
227 	char *eol, *sp;
228 	const char *errmsg = "";
229 
230 	eol = strchr(refname, '\n');
231 	if (eol == NULL) {
232 		return got_error_msg(GOT_ERR_BAD_PACKET,
233 		    "unexpected message from server");
234 	}
235 	*eol = '\0';
236 
237 	sp = strchr(refname, ' ');
238 	if (sp != NULL) {
239 		*sp++ = '\0';
240 		errmsg = sp;
241 		errmsglen = strlen(errmsg);
242 
243 		for (i = 0; i < errmsglen; ++i) {
244 			if (!isprint((unsigned char)errmsg[i])) {
245 				return got_error_msg(GOT_ERR_BAD_PACKET,
246 				    "non-printable error message received "
247 				    "from the server");
248 			}
249 		}
250 	}
251 
252 	reflen = strlen(refname);
253 	if (!got_ref_name_is_valid(refname)) {
254 		return got_error_msg(GOT_ERR_BAD_PACKET,
255 		    "unexpected message from server");
256 	}
257 
258 	TAILQ_FOREACH(pe, refs, entry) {
259 		if (strcmp(refname, pe->path) == 0) {
260 			ref_valid = 1;
261 			break;
262 		}
263 	}
264 	if (!ref_valid) {
265 		TAILQ_FOREACH(pe, delete_refs, entry) {
266 			if (strcmp(refname, pe->path) == 0) {
267 				ref_valid = 1;
268 				break;
269 			}
270 		}
271 	}
272 	if (!ref_valid) {
273 		return got_error_msg(GOT_ERR_BAD_PACKET,
274 		    "unexpected message from server");
275 	}
276 
277 	len = sizeof(struct got_imsg_send_ref_status) + reflen + errmsglen;
278 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
279 		return got_error(GOT_ERR_NO_SPACE);
280 
281 	wbuf = imsg_create(ibuf, GOT_IMSG_SEND_REF_STATUS,
282 	    0, 0, len);
283 	if (wbuf == NULL)
284 		return got_error_from_errno("imsg_create SEND_REF_STATUS");
285 
286 	/* Keep in sync with struct got_imsg_send_ref_status definition! */
287 	if (imsg_add(wbuf, &success, sizeof(success)) == -1)
288 		return got_error_from_errno("imsg_add SEND_REF_STATUS");
289 	if (imsg_add(wbuf, &reflen, sizeof(reflen)) == -1)
290 		return got_error_from_errno("imsg_add SEND_REF_STATUS");
291 	if (imsg_add(wbuf, &errmsglen, sizeof(errmsglen)) == -1)
292 		return got_error_from_errno("imsg_add SEND_REF_STATUS");
293 	if (imsg_add(wbuf, refname, reflen) == -1)
294 		return got_error_from_errno("imsg_add SEND_REF_STATUS");
295 	if (imsg_add(wbuf, errmsg, errmsglen) == -1)
296 		return got_error_from_errno("imsg_add SEND_REF_STATUS");
297 
298 	wbuf->fd = -1;
299 	imsg_close(ibuf, wbuf);
300 	return got_privsep_flush_imsg(ibuf);
301 }
302 
303 static const struct got_error *
304 describe_refchange(int *n, int *sent_my_capabilites,
305     const char *my_capabilities, char *buf, size_t bufsize,
306     const char *refname, const char *old_hashstr, const char *new_hashstr)
307 {
308 	*n = snprintf(buf, bufsize, "%s %s %s",
309 	    old_hashstr, new_hashstr, refname);
310 	if (*n < 0 || (size_t)*n >= bufsize)
311 		return got_error(GOT_ERR_NO_SPACE);
312 
313 	/*
314 	 * We must announce our capabilities along with the first
315 	 * reference. Unfortunately, the protocol requires an embedded
316 	 * NUL as a separator between reference name and capabilities,
317 	 * which we have to deal with here.
318 	 * It also requires a linefeed for terminating packet data.
319 	 */
320 	if (!*sent_my_capabilites && my_capabilities != NULL) {
321 		int m;
322 		if (*n >= bufsize - 1)
323 			return got_error(GOT_ERR_NO_SPACE);
324 		m = snprintf(buf + *n + 1, /* offset after '\0' */
325 		    bufsize - (*n + 1), "%s\n", my_capabilities);
326 		if (m < 0 || *n + m >= bufsize)
327 			return got_error(GOT_ERR_NO_SPACE);
328 		*n += m;
329 		*sent_my_capabilites = 1;
330 	} else {
331 		*n = strlcat(buf, "\n", bufsize);
332 		if (*n >= bufsize)
333 			return got_error(GOT_ERR_NO_SPACE);
334 	}
335 
336 	return NULL;
337 }
338 
339 static const struct got_error *
340 send_pack(int fd, struct got_pathlist_head *refs,
341     struct got_pathlist_head *delete_refs, struct imsgbuf *ibuf)
342 {
343 	const struct got_error *err = NULL;
344 	char buf[GOT_PKT_MAX];
345 	const unsigned char zero_id[SHA1_DIGEST_LENGTH] = { 0 };
346 	char old_hashstr[SHA1_DIGEST_STRING_LENGTH];
347 	char new_hashstr[SHA1_DIGEST_STRING_LENGTH];
348 	struct got_pathlist_head their_refs;
349 	int is_firstpkt = 1;
350 	int n, nsent = 0;
351 	int packfd = -1;
352 	char *id_str = NULL, *refname = NULL;
353 	struct got_object_id *id = NULL;
354 	char *server_capabilities = NULL, *my_capabilities = NULL;
355 	struct got_pathlist_entry *pe;
356 	int sent_my_capabilites = 0;
357 
358 	TAILQ_INIT(&their_refs);
359 
360 	if (TAILQ_EMPTY(refs) && TAILQ_EMPTY(delete_refs))
361 		return got_error(GOT_ERR_SEND_EMPTY);
362 
363 	while (1) {
364 		err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
365 		if (err)
366 			goto done;
367 		if (n == 0)
368 			break;
369 		if (n >= 4 && strncmp(buf, "ERR ", 4) == 0) {
370 			err = send_error(&buf[4], n - 4);
371 			goto done;
372 		}
373 		free(id_str);
374 		free(refname);
375 		err = got_gitproto_parse_refline(&id_str, &refname,
376 		    &server_capabilities, buf, n);
377 		if (err)
378 			goto done;
379 		if (is_firstpkt) {
380 			if (server_capabilities == NULL) {
381 				server_capabilities = strdup("");
382 				if (server_capabilities == NULL) {
383 					err = got_error_from_errno("strdup");
384 					goto done;
385 				}
386 			}
387 			if (chattygot && server_capabilities[0] != '\0')
388 				fprintf(stderr, "%s: server capabilities: %s\n",
389 				    getprogname(), server_capabilities);
390 			err = got_gitproto_match_capabilities(&my_capabilities,
391 			    NULL, server_capabilities, got_capabilities,
392 			    nitems(got_capabilities));
393 			if (err)
394 				goto done;
395 			if (chattygot)
396 				fprintf(stderr, "%s: my capabilities:%s\n",
397 				    getprogname(),
398 				    my_capabilities ? my_capabilities : "");
399 			is_firstpkt = 0;
400 		}
401 		if (strstr(refname, "^{}")) {
402 			if (chattygot) {
403 				fprintf(stderr, "%s: ignoring %s\n",
404 				    getprogname(), refname);
405 			}
406 			continue;
407 		}
408 
409 		id = malloc(sizeof(*id));
410 		if (id == NULL) {
411 			err = got_error_from_errno("malloc");
412 			goto done;
413 		}
414 		if (!got_parse_sha1_digest(id->sha1, id_str)) {
415 			err = got_error(GOT_ERR_BAD_OBJ_ID_STR);
416 			goto done;
417 		}
418 		err = send_their_ref(ibuf, id, refname);
419 		if (err)
420 			goto done;
421 
422 		err = got_pathlist_append(&their_refs, refname, id);
423 		if (err)
424 			goto done;
425 
426 		if (chattygot)
427 			fprintf(stderr, "%s: remote has %s %s\n",
428 			    getprogname(), refname, id_str);
429 		free(id_str);
430 		id_str = NULL;
431 		refname = NULL; /* do not free; owned by their_refs */
432 		id = NULL; /* do not free; owned by their_refs */
433 	}
434 
435 	if (!TAILQ_EMPTY(delete_refs)) {
436 		if (my_capabilities == NULL ||
437 		    strstr(my_capabilities, GOT_CAPA_DELETE_REFS) == NULL) {
438 			err = got_error(GOT_ERR_CAPA_DELETE_REFS);
439 			goto done;
440 		}
441 	}
442 
443 	TAILQ_FOREACH(pe, delete_refs, entry) {
444 		const char *refname = pe->path;
445 		struct got_pathlist_entry *their_pe;
446 		struct got_object_id *their_id = NULL;
447 
448 		TAILQ_FOREACH(their_pe, &their_refs, entry) {
449 			const char *their_refname = their_pe->path;
450 			if (got_path_cmp(refname, their_refname,
451 			    strlen(refname), strlen(their_refname)) == 0) {
452 				their_id = their_pe->data;
453 				break;
454 			}
455 		}
456 		if (their_id == NULL) {
457 			err = got_error_fmt(GOT_ERR_NOT_REF,
458 			    "%s does not exist in remote repository",
459 			    refname);
460 			goto done;
461 		}
462 
463 		got_sha1_digest_to_str(their_id->sha1, old_hashstr,
464 		    sizeof(old_hashstr));
465 		got_sha1_digest_to_str(zero_id, new_hashstr,
466 		    sizeof(new_hashstr));
467 		err = describe_refchange(&n, &sent_my_capabilites,
468 		    my_capabilities, buf, sizeof(buf), refname,
469 		    old_hashstr, new_hashstr);
470 		if (err)
471 			goto done;
472 		err = got_pkt_writepkt(fd, buf, n, chattygot);
473 		if (err)
474 			goto done;
475 		if (chattygot) {
476 			fprintf(stderr, "%s: deleting %s %s\n",
477 			    getprogname(), refname, old_hashstr);
478 		}
479 		nsent++;
480 	}
481 
482 	TAILQ_FOREACH(pe, refs, entry) {
483 		const char *refname = pe->path;
484 		struct got_object_id *id = pe->data;
485 		struct got_object_id *their_id = NULL;
486 		struct got_pathlist_entry *their_pe;
487 
488 		TAILQ_FOREACH(their_pe, &their_refs, entry) {
489 			const char *their_refname = their_pe->path;
490 			if (got_path_cmp(refname, their_refname,
491 			    strlen(refname), strlen(their_refname)) == 0) {
492 				their_id = their_pe->data;
493 				break;
494 			}
495 		}
496 		if (their_id) {
497 			if (got_object_id_cmp(id, their_id) == 0) {
498 				if (chattygot) {
499 					fprintf(stderr,
500 					    "%s: no change for %s\n",
501 					    getprogname(), refname);
502 				}
503 				continue;
504 			}
505 			got_sha1_digest_to_str(their_id->sha1, old_hashstr,
506 			    sizeof(old_hashstr));
507 		} else {
508 			got_sha1_digest_to_str(zero_id, old_hashstr,
509 			    sizeof(old_hashstr));
510 		}
511 		got_sha1_digest_to_str(id->sha1, new_hashstr,
512 		    sizeof(new_hashstr));
513 		err = describe_refchange(&n, &sent_my_capabilites,
514 		    my_capabilities, buf, sizeof(buf), refname,
515 		    old_hashstr, new_hashstr);
516 		if (err)
517 			goto done;
518 		err = got_pkt_writepkt(fd, buf, n, chattygot);
519 		if (err)
520 			goto done;
521 		if (chattygot) {
522 			if (their_id) {
523 				fprintf(stderr, "%s: updating %s %s -> %s\n",
524 				    getprogname(), refname, old_hashstr,
525 				    new_hashstr);
526 			} else {
527 				fprintf(stderr, "%s: creating %s %s\n",
528 				    getprogname(), refname, new_hashstr);
529 			}
530 		}
531 		nsent++;
532 	}
533 	err = got_pkt_flushpkt(fd, chattygot);
534 	if (err)
535 		goto done;
536 
537 	err = send_pack_request(ibuf);
538 	if (err)
539 		goto done;
540 
541 	err = recv_packfd(&packfd, ibuf);
542 	if (err)
543 		goto done;
544 
545 	if (packfd != -1) {
546 		err = send_pack_file(fd, packfd, ibuf);
547 		if (err)
548 			goto done;
549 	}
550 
551 	err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
552 	if (err)
553 		goto done;
554 	if (n >= 4 && strncmp(buf, "ERR ", 4) == 0) {
555 		err = send_error(&buf[4], n - 4);
556 		goto done;
557 	} else if (n < 10 || strncmp(buf, "unpack ok\n", 10) != 0) {
558 		err = got_error_msg(GOT_ERR_BAD_PACKET,
559 		    "unexpected message from server");
560 		goto done;
561 	}
562 
563 	while (nsent > 0) {
564 		err = got_pkt_readpkt(&n, fd, buf, sizeof(buf), chattygot);
565 		if (err)
566 			goto done;
567 		if (n < 3) {
568 			err = got_error_msg(GOT_ERR_BAD_PACKET,
569 			    "unexpected message from server");
570 			goto done;
571 		} else if (n >= 4 && strncmp(buf, "ERR ", 4) == 0) {
572 			err = send_error(&buf[4], n - 4);
573 			goto done;
574 		} else if (strncmp(buf, "ok ", 3) == 0) {
575 			err = send_ref_status(ibuf, buf + 3, 1,
576 			    refs, delete_refs);
577 			if (err)
578 				goto done;
579 		} else if (strncmp(buf, "ng ", 3) == 0) {
580 			err = send_ref_status(ibuf, buf + 3, 0,
581 			    refs, delete_refs);
582 			if (err)
583 				goto done;
584 		} else {
585 			err = got_error_msg(GOT_ERR_BAD_PACKET,
586 			    "unexpected message from server");
587 			goto done;
588 		}
589 		nsent--;
590 	}
591 
592 	err = send_done(ibuf);
593 done:
594 	got_pathlist_free(&their_refs, GOT_PATHLIST_FREE_ALL);
595 	free(id_str);
596 	free(id);
597 	free(refname);
598 	free(server_capabilities);
599 	return err;
600 }
601 
602 int
603 main(int argc, char **argv)
604 {
605 	const struct got_error *err = NULL;
606 	int sendfd = -1;
607 	struct imsgbuf ibuf;
608 	struct imsg imsg;
609 	struct got_pathlist_head refs;
610 	struct got_pathlist_head delete_refs;
611 	struct got_imsg_send_request send_req;
612 	struct got_imsg_send_ref href;
613 	size_t datalen, i;
614 #if 0
615 	static int attached;
616 	while (!attached)
617 		sleep (1);
618 #endif
619 
620 	TAILQ_INIT(&refs);
621 	TAILQ_INIT(&delete_refs);
622 
623 	imsg_init(&ibuf, GOT_IMSG_FD_CHILD);
624 #ifndef PROFILE
625 	/* revoke access to most system calls */
626 	if (pledge("stdio recvfd", NULL) == -1) {
627 		err = got_error_from_errno("pledge");
628 		got_privsep_send_error(&ibuf, err);
629 		return 1;
630 	}
631 
632 	/* revoke fs access */
633 	if (landlock_no_fs() == -1) {
634 		err = got_error_from_errno("landlock_no_fs");
635 		got_privsep_send_error(&ibuf, err);
636 		return 1;
637 	}
638 	if (cap_enter() == -1) {
639 		err = got_error_from_errno("cap_enter");
640 		got_privsep_send_error(&ibuf, err);
641 		return 1;
642 	}
643 #endif
644 	if ((err = got_privsep_recv_imsg(&imsg, &ibuf, 0)) != 0) {
645 		if (err->code == GOT_ERR_PRIVSEP_PIPE)
646 			err = NULL;
647 		goto done;
648 	}
649 	if (imsg.hdr.type == GOT_IMSG_STOP)
650 		goto done;
651 	if (imsg.hdr.type != GOT_IMSG_SEND_REQUEST) {
652 		err = got_error(GOT_ERR_PRIVSEP_MSG);
653 		goto done;
654 	}
655 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
656 	if (datalen < sizeof(send_req)) {
657 		err = got_error(GOT_ERR_PRIVSEP_LEN);
658 		goto done;
659 	}
660 	memcpy(&send_req, imsg.data, sizeof(send_req));
661 	sendfd = imsg.fd;
662 	imsg_free(&imsg);
663 
664 	if (send_req.verbosity > 0)
665 		chattygot += send_req.verbosity;
666 
667 	for (i = 0; i < send_req.nrefs; i++) {
668 		struct got_object_id *id;
669 		char *refname;
670 
671 		if ((err = got_privsep_recv_imsg(&imsg, &ibuf, 0)) != 0) {
672 			if (err->code == GOT_ERR_PRIVSEP_PIPE)
673 				err = NULL;
674 			goto done;
675 		}
676 		if (imsg.hdr.type == GOT_IMSG_STOP)
677 			goto done;
678 		if (imsg.hdr.type != GOT_IMSG_SEND_REF) {
679 			err = got_error(GOT_ERR_PRIVSEP_MSG);
680 			goto done;
681 		}
682 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
683 		if (datalen < sizeof(href)) {
684 			err = got_error(GOT_ERR_PRIVSEP_LEN);
685 			goto done;
686 		}
687 		memcpy(&href, imsg.data, sizeof(href));
688 		if (datalen - sizeof(href) < href.name_len) {
689 			err = got_error(GOT_ERR_PRIVSEP_LEN);
690 			goto done;
691 		}
692 		refname = malloc(href.name_len + 1);
693 		if (refname == NULL) {
694 			err = got_error_from_errno("malloc");
695 			goto done;
696 		}
697 		memcpy(refname, imsg.data + sizeof(href), href.name_len);
698 		refname[href.name_len] = '\0';
699 
700 		/*
701 		 * Prevent sending of references that won't make any
702 		 * sense outside the local repository's context.
703 		 */
704 		if (strncmp(refname, "refs/got/", 9) == 0 ||
705 		    strncmp(refname, "refs/remotes/", 13) == 0) {
706 			err = got_error_fmt(GOT_ERR_SEND_BAD_REF,
707 			    "%s", refname);
708 			goto done;
709 		}
710 
711 		id = malloc(sizeof(*id));
712 		if (id == NULL) {
713 			free(refname);
714 			err = got_error_from_errno("malloc");
715 			goto done;
716 		}
717 		memcpy(id, &href.id, sizeof(*id));
718 		if (href.delete)
719 			err = got_pathlist_append(&delete_refs, refname, id);
720 		else
721 			err = got_pathlist_append(&refs, refname, id);
722 		if (err) {
723 			free(refname);
724 			free(id);
725 			goto done;
726 		}
727 
728 		imsg_free(&imsg);
729 	}
730 
731 	err = send_pack(sendfd, &refs, &delete_refs, &ibuf);
732 done:
733 	got_pathlist_free(&refs, GOT_PATHLIST_FREE_ALL);
734 	got_pathlist_free(&delete_refs, GOT_PATHLIST_FREE_ALL);
735 	if (sendfd != -1 && close(sendfd) == -1 && err == NULL)
736 		err = got_error_from_errno("close");
737 	if (err != NULL && err->code != GOT_ERR_CANCELLED)  {
738 		fprintf(stderr, "%s: %s\n", getprogname(), err->msg);
739 		got_privsep_send_error(&ibuf, err);
740 	}
741 
742 	exit(0);
743 }