op public repos

Blob

Date:: Wed Mar 10 22:49:22 2021 UTC
Message:: implement raw object data access; this will be required for packing
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018, 2019, 2020 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2020 Ori Bernstein <ori@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/queue.h>
20 #include <sys/uio.h>
21 #include <sys/wait.h>
22 
23 #include <ctype.h>
24 #include <limits.h>
25 #include <stdio.h>
26 #include <stdlib.h>
27 #include <string.h>
28 #include <errno.h>
29 #include <stdint.h>
30 #include <poll.h>
31 #include <imsg.h>
32 #include <sha1.h>
33 #include <unistd.h>
34 #include <zlib.h>
35 #include <time.h>
36 
37 #include "got_object.h"
38 #include "got_error.h"
39 #include "got_path.h"
40 #include "got_repository.h"
41 
42 #include "got_lib_sha1.h"
43 #include "got_lib_delta.h"
44 #include "got_lib_inflate.h"
45 #include "got_lib_object.h"
46 #include "got_lib_object_parse.h"
47 #include "got_lib_privsep.h"
48 #include "got_lib_pack.h"
49 
50 #ifndef MIN
51 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
52 #endif
53 
54 #ifndef nitems
55 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
56 #endif
57 
58 static const struct got_error *
59 poll_fd(int fd, int events, int timeout)
60 {
61 	struct pollfd pfd[1];
62 	int n;
63 
64 	pfd[0].fd = fd;
65 	pfd[0].events = events;
66 
67 	n = poll(pfd, 1, timeout);
68 	if (n == -1)
69 		return got_error_from_errno("poll");
70 	if (n == 0)
71 		return got_error(GOT_ERR_TIMEOUT);
72 	if (pfd[0].revents & (POLLERR | POLLNVAL))
73 		return got_error_from_errno("poll error");
74 	if (pfd[0].revents & (events | POLLHUP))
75 		return NULL;
76 
77 	return got_error(GOT_ERR_INTERRUPT);
78 }
79 
80 static const struct got_error *
81 read_imsg(struct imsgbuf *ibuf)
82 {
83 	const struct got_error *err;
84 	size_t n;
85 
86 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
87 	if (err)
88 		return err;
89 
90 	n = imsg_read(ibuf);
91 	if (n == -1) {
92 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
93 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
94 		return got_error(GOT_ERR_PRIVSEP_READ);
95 	}
96 	if (n == 0)
97 		return got_error(GOT_ERR_PRIVSEP_PIPE);
98 
99 	return NULL;
100 }
101 
102 const struct got_error *
103 got_privsep_wait_for_child(pid_t pid)
104 {
105 	int child_status;
106 
107 	if (waitpid(pid, &child_status, 0) == -1)
108 		return got_error_from_errno("waitpid");
109 
110 	if (!WIFEXITED(child_status))
111 		return got_error(GOT_ERR_PRIVSEP_DIED);
112 
113 	if (WEXITSTATUS(child_status) != 0)
114 		return got_error(GOT_ERR_PRIVSEP_EXIT);
115 
116 	return NULL;
117 }
118 
119 static const struct got_error *
120 recv_imsg_error(struct imsg *imsg, size_t datalen)
121 {
122 	struct got_imsg_error *ierr;
123 
124 	if (datalen != sizeof(*ierr))
125 		return got_error(GOT_ERR_PRIVSEP_LEN);
126 
127 	ierr = imsg->data;
128 	if (ierr->code == GOT_ERR_ERRNO) {
129 		static struct got_error serr;
130 		serr.code = GOT_ERR_ERRNO;
131 		serr.msg = strerror(ierr->errno_code);
132 		return &serr;
133 	}
134 
135 	return got_error(ierr->code);
136 }
137 
138 const struct got_error *
139 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
140     size_t min_datalen)
141 {
142 	const struct got_error *err;
143 	ssize_t n;
144 
145 	n = imsg_get(ibuf, imsg);
146 	if (n == -1)
147 		return got_error_from_errno("imsg_get");
148 
149 	while (n == 0) {
150 		err = read_imsg(ibuf);
151 		if (err)
152 			return err;
153 		n = imsg_get(ibuf, imsg);
154 		if (n == -1)
155 			return got_error_from_errno("imsg_get");
156 	}
157 
158 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
159 		return got_error(GOT_ERR_PRIVSEP_LEN);
160 
161 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
162 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
163 		return recv_imsg_error(imsg, datalen);
164 	}
165 
166 	return NULL;
167 }
168 
169 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
170 void
171 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
172 {
173 	const struct got_error *poll_err;
174 	struct got_imsg_error ierr;
175 	int ret;
176 
177 	ierr.code = err->code;
178 	if (err->code == GOT_ERR_ERRNO)
179 		ierr.errno_code = errno;
180 	else
181 		ierr.errno_code = 0;
182 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
183 	if (ret == -1) {
184 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
185 		    getprogname(), err->code, err->msg, strerror(errno));
186 		return;
187 	}
188 
189 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
190 	if (poll_err) {
191 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
192 		    getprogname(), err->code, err->msg, poll_err->msg);
193 		return;
194 	}
195 
196 	ret = imsg_flush(ibuf);
197 	if (ret == -1) {
198 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
199 		    getprogname(), err->code, err->msg, strerror(errno));
200 		return;
201 	}
202 }
203 
204 static const struct got_error *
205 flush_imsg(struct imsgbuf *ibuf)
206 {
207 	const struct got_error *err;
208 
209 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
210 	if (err)
211 		return err;
212 
213 	if (imsg_flush(ibuf) == -1)
214 		return got_error_from_errno("imsg_flush");
215 
216 	return NULL;
217 }
218 
219 const struct got_error *
220 got_privsep_flush_imsg(struct imsgbuf *ibuf)
221 {
222 	return flush_imsg(ibuf);
223 }
224 
225 const struct got_error *
226 got_privsep_send_stop(int fd)
227 {
228 	const struct got_error *err = NULL;
229 	struct imsgbuf ibuf;
230 
231 	imsg_init(&ibuf, fd);
232 
233 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
234 		return got_error_from_errno("imsg_compose STOP");
235 
236 	err = flush_imsg(&ibuf);
237 	imsg_clear(&ibuf);
238 	return err;
239 }
240 
241 const struct got_error *
242 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd)
243 {
244 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd, NULL, 0)
245 	    == -1)
246 		return got_error_from_errno("imsg_compose OBJECT_REQUEST");
247 
248 	return flush_imsg(ibuf);
249 }
250 
251 const struct got_error *
252 got_privsep_send_raw_obj_req(struct imsgbuf *ibuf, int fd)
253 {
254 	if (imsg_compose(ibuf, GOT_IMSG_RAW_OBJECT_REQUEST, 0, 0, fd, NULL, 0)
255 	    == -1)
256 		return got_error_from_errno("imsg_compose RAW_OBJECT_REQUEST");
257 
258 	return flush_imsg(ibuf);
259 }
260 
261 const struct got_error *
262 got_privsep_send_raw_obj_outfd(struct imsgbuf *ibuf, int outfd)
263 {
264 	const struct got_error *err = NULL;
265 
266 	if (imsg_compose(ibuf, GOT_IMSG_RAW_OBJECT_OUTFD, 0, 0, outfd, NULL, 0)
267 	    == -1) {
268 		err = got_error_from_errno("imsg_compose RAW_OBJECT_OUTFD");
269 		close(outfd);
270 		return err;
271 	}
272 
273 	return flush_imsg(ibuf);
274 }
275 
276 const struct got_error *
277 got_privsep_send_raw_obj(struct imsgbuf *ibuf, off_t size, size_t hdrlen,
278     uint8_t *data)
279 {
280 	const struct got_error *err = NULL;
281 	struct got_imsg_raw_obj iobj;
282 	size_t len = sizeof(iobj);
283 	struct ibuf *wbuf;
284 
285 	iobj.hdrlen = hdrlen;
286 	iobj.size = size;
287 
288 	if (data && size <= GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX)
289 		len += (size_t)size;
290 
291 	wbuf = imsg_create(ibuf, GOT_IMSG_RAW_OBJECT, 0, 0, len);
292 	if (wbuf == NULL) {
293 		err = got_error_from_errno("imsg_create RAW_OBJECT");
294 		return err;
295 	}
296 
297 	if (imsg_add(wbuf, &iobj, sizeof(iobj)) == -1) {
298 		err = got_error_from_errno("imsg_add RAW_OBJECT");
299 		ibuf_free(wbuf);
300 		return err;
301 	}
302 
303 	if (data && size <= GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX) {
304 		if (imsg_add(wbuf, data, size) == -1) {
305 			err = got_error_from_errno("imsg_add RAW_OBJECT");
306 			ibuf_free(wbuf);
307 			return err;
308 		}
309 	}
310 
311 	wbuf->fd = -1;
312 	imsg_close(ibuf, wbuf);
313 
314 	return flush_imsg(ibuf);
315 }
316 
317 const struct got_error *
318 got_privsep_recv_raw_obj(uint8_t **outbuf, off_t *size, size_t *hdrlen,
319     struct imsgbuf *ibuf)
320 {
321 	const struct got_error *err = NULL;
322 	struct imsg imsg;
323 	struct got_imsg_raw_obj *iobj;
324 	size_t datalen;
325 
326 	*outbuf = NULL;
327 
328 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
329 	if (err)
330 		return err;
331 
332 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
333 
334 	switch (imsg.hdr.type) {
335 	case GOT_IMSG_RAW_OBJECT:
336 		if (datalen < sizeof(*iobj)) {
337 			err = got_error(GOT_ERR_PRIVSEP_LEN);
338 			break;
339 		}
340 		iobj = imsg.data;
341 		*size = iobj->size;
342 		*hdrlen = iobj->hdrlen;
343 
344 		if (datalen == sizeof(*iobj)) {
345 			/* Data has been written to file descriptor. */
346 			break;
347 		}
348 
349 		if (*size > GOT_PRIVSEP_INLINE_OBJECT_DATA_MAX) {
350 			err = got_error(GOT_ERR_PRIVSEP_LEN);
351 			break;
352 		}
353 
354 		*outbuf = malloc(*size);
355 		if (*outbuf == NULL) {
356 			err = got_error_from_errno("malloc");
357 			break;
358 		}
359 		memcpy(*outbuf, imsg.data + sizeof(*iobj), *size);
360 		break;
361 	default:
362 		err = got_error(GOT_ERR_PRIVSEP_MSG);
363 		break;
364 	}
365 
366 	imsg_free(&imsg);
367 
368 	return err;
369 }
370 
371 const struct got_error *
372 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
373     struct got_object_id *id, int pack_idx)
374 {
375 	const struct got_error *err = NULL;
376 	struct got_imsg_packed_object iobj, *iobjp;
377 	size_t len;
378 
379 	if (id) { /* commit is packed */
380 		iobj.idx = pack_idx;
381 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
382 		iobjp = &iobj;
383 		len = sizeof(iobj);
384 	} else {
385 		iobjp = NULL;
386 		len = 0;
387 	}
388 
389 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, iobjp, len)
390 	    == -1) {
391 		err = got_error_from_errno("imsg_compose COMMIT_REQUEST");
392 		close(fd);
393 		return err;
394 	}
395 
396 	return flush_imsg(ibuf);
397 }
398 
399 const struct got_error *
400 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
401     struct got_object_id *id, int pack_idx)
402 {
403 	const struct got_error *err = NULL;
404 	struct ibuf *wbuf;
405 	size_t len = id ? sizeof(struct got_imsg_packed_object) : 0;
406 
407 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, len);
408 	if (wbuf == NULL)
409 		return got_error_from_errno("imsg_create TREE_REQUEST");
410 
411 	if (id) { /* tree is packed */
412 		if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
413 			err = got_error_from_errno("imsg_add TREE_ENTRY");
414 			ibuf_free(wbuf);
415 			return err;
416 		}
417 
418 		if (imsg_add(wbuf, &pack_idx, sizeof(pack_idx)) == -1) {
419 			err = got_error_from_errno("imsg_add TREE_ENTRY");
420 			ibuf_free(wbuf);
421 			return err;
422 		}
423 	}
424 
425 	wbuf->fd = fd;
426 	imsg_close(ibuf, wbuf);
427 
428 	return flush_imsg(ibuf);
429 }
430 
431 const struct got_error *
432 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
433     struct got_object_id *id, int pack_idx)
434 {
435 	struct got_imsg_packed_object iobj, *iobjp;
436 	size_t len;
437 
438 	if (id) { /* tag is packed */
439 		iobj.idx = pack_idx;
440 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
441 		iobjp = &iobj;
442 		len = sizeof(iobj);
443 	} else {
444 		iobjp = NULL;
445 		len = 0;
446 	}
447 
448 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, iobjp, len)
449 	    == -1)
450 		return got_error_from_errno("imsg_compose TAG_REQUEST");
451 
452 	return flush_imsg(ibuf);
453 }
454 
455 const struct got_error *
456 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
457     struct got_object_id *id, int pack_idx)
458 {
459 	const struct got_error *err = NULL;
460 	struct got_imsg_packed_object iobj, *iobjp;
461 	size_t len;
462 
463 	if (id) { /* blob is packed */
464 		iobj.idx = pack_idx;
465 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
466 		iobjp = &iobj;
467 		len = sizeof(iobj);
468 	} else {
469 		iobjp = NULL;
470 		len = 0;
471 	}
472 
473 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, iobjp, len)
474 	    == -1) {
475 		err = got_error_from_errno("imsg_compose BLOB_REQUEST");
476 		close(infd);
477 		return err;
478 	}
479 
480 	return flush_imsg(ibuf);
481 }
482 
483 const struct got_error *
484 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
485 {
486 	const struct got_error *err = NULL;
487 
488 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
489 	    == -1) {
490 		err = got_error_from_errno("imsg_compose BLOB_OUTFD");
491 		close(outfd);
492 		return err;
493 	}
494 
495 	return flush_imsg(ibuf);
496 }
497 
498 static const struct got_error *
499 send_fd(struct imsgbuf *ibuf, int imsg_code, int fd)
500 {
501 	const struct got_error *err = NULL;
502 
503 	if (imsg_compose(ibuf, imsg_code, 0, 0, fd, NULL, 0) == -1) {
504 		err = got_error_from_errno("imsg_compose TMPFD");
505 		close(fd);
506 		return err;
507 	}
508 
509 	return flush_imsg(ibuf);
510 }
511 
512 const struct got_error *
513 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
514 {
515 	return send_fd(ibuf, GOT_IMSG_TMPFD, fd);
516 }
517 
518 const struct got_error *
519 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
520 {
521 	struct got_imsg_object iobj;
522 
523 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
524 	iobj.type = obj->type;
525 	iobj.flags = obj->flags;
526 	iobj.hdrlen = obj->hdrlen;
527 	iobj.size = obj->size;
528 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
529 		iobj.pack_offset = obj->pack_offset;
530 		iobj.pack_idx = obj->pack_idx;
531 	}
532 
533 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
534 	    == -1)
535 		return got_error_from_errno("imsg_compose OBJECT");
536 
537 	return flush_imsg(ibuf);
538 }
539 
540 const struct got_error *
541 got_privsep_send_fetch_req(struct imsgbuf *ibuf, int fd,
542    struct got_pathlist_head *have_refs, int fetch_all_branches,
543    struct got_pathlist_head *wanted_branches,
544    struct got_pathlist_head *wanted_refs, int list_refs_only, int verbosity)
545 {
546 	const struct got_error *err = NULL;
547 	struct ibuf *wbuf;
548 	size_t len;
549 	struct got_pathlist_entry *pe;
550 	struct got_imsg_fetch_request fetchreq;
551 
552 	memset(&fetchreq, 0, sizeof(fetchreq));
553 	fetchreq.fetch_all_branches = fetch_all_branches;
554 	fetchreq.list_refs_only = list_refs_only;
555 	fetchreq.verbosity = verbosity;
556 	TAILQ_FOREACH(pe, have_refs, entry)
557 		fetchreq.n_have_refs++;
558 	TAILQ_FOREACH(pe, wanted_branches, entry)
559 		fetchreq.n_wanted_branches++;
560 	TAILQ_FOREACH(pe, wanted_refs, entry)
561 		fetchreq.n_wanted_refs++;
562 	len = sizeof(struct got_imsg_fetch_request);
563 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
564 		close(fd);
565 		return got_error(GOT_ERR_NO_SPACE);
566 	}
567 
568 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_REQUEST, 0, 0, fd,
569 	    &fetchreq, sizeof(fetchreq)) == -1)
570 		return got_error_from_errno(
571 		    "imsg_compose FETCH_SERVER_PROGRESS");
572 
573 	err = flush_imsg(ibuf);
574 	if (err) {
575 		close(fd);
576 		return err;
577 	}
578 	fd = -1;
579 
580 	TAILQ_FOREACH(pe, have_refs, entry) {
581 		const char *name = pe->path;
582 		size_t name_len = pe->path_len;
583 		struct got_object_id *id = pe->data;
584 
585 		len = sizeof(struct got_imsg_fetch_have_ref) + name_len;
586 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_HAVE_REF, 0, 0, len);
587 		if (wbuf == NULL)
588 			return got_error_from_errno("imsg_create FETCH_HAVE_REF");
589 
590 		/* Keep in sync with struct got_imsg_fetch_have_ref! */
591 		if (imsg_add(wbuf, id->sha1, sizeof(id->sha1)) == -1) {
592 			err = got_error_from_errno("imsg_add FETCH_HAVE_REF");
593 			ibuf_free(wbuf);
594 			return err;
595 		}
596 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1) {
597 			err = got_error_from_errno("imsg_add FETCH_HAVE_REF");
598 			ibuf_free(wbuf);
599 			return err;
600 		}
601 		if (imsg_add(wbuf, name, name_len) == -1) {
602 			err = got_error_from_errno("imsg_add FETCH_HAVE_REF");
603 			ibuf_free(wbuf);
604 			return err;
605 		}
606 
607 		wbuf->fd = -1;
608 		imsg_close(ibuf, wbuf);
609 		err = flush_imsg(ibuf);
610 		if (err)
611 			return err;
612 	}
613 
614 	TAILQ_FOREACH(pe, wanted_branches, entry) {
615 		const char *name = pe->path;
616 		size_t name_len = pe->path_len;
617 
618 		len = sizeof(struct got_imsg_fetch_wanted_branch) + name_len;
619 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_WANTED_BRANCH, 0, 0,
620 		    len);
621 		if (wbuf == NULL)
622 			return got_error_from_errno(
623 			    "imsg_create FETCH_WANTED_BRANCH");
624 
625 		/* Keep in sync with struct got_imsg_fetch_wanted_branch! */
626 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1) {
627 			err = got_error_from_errno(
628 			    "imsg_add FETCH_WANTED_BRANCH");
629 			ibuf_free(wbuf);
630 			return err;
631 		}
632 		if (imsg_add(wbuf, name, name_len) == -1) {
633 			err = got_error_from_errno(
634 			    "imsg_add FETCH_WANTED_BRANCH");
635 			ibuf_free(wbuf);
636 			return err;
637 		}
638 
639 		wbuf->fd = -1;
640 		imsg_close(ibuf, wbuf);
641 		err = flush_imsg(ibuf);
642 		if (err)
643 			return err;
644 	}
645 
646 	TAILQ_FOREACH(pe, wanted_refs, entry) {
647 		const char *name = pe->path;
648 		size_t name_len = pe->path_len;
649 
650 		len = sizeof(struct got_imsg_fetch_wanted_ref) + name_len;
651 		wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_WANTED_REF, 0, 0,
652 		    len);
653 		if (wbuf == NULL)
654 			return got_error_from_errno(
655 			    "imsg_create FETCH_WANTED_REF");
656 
657 		/* Keep in sync with struct got_imsg_fetch_wanted_ref! */
658 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1) {
659 			err = got_error_from_errno(
660 			    "imsg_add FETCH_WANTED_REF");
661 			ibuf_free(wbuf);
662 			return err;
663 		}
664 		if (imsg_add(wbuf, name, name_len) == -1) {
665 			err = got_error_from_errno(
666 			    "imsg_add FETCH_WANTED_REF");
667 			ibuf_free(wbuf);
668 			return err;
669 		}
670 
671 		wbuf->fd = -1;
672 		imsg_close(ibuf, wbuf);
673 		err = flush_imsg(ibuf);
674 		if (err)
675 			return err;
676 	}
677 
678 
679 	return NULL;
680 
681 }
682 
683 const struct got_error *
684 got_privsep_send_fetch_outfd(struct imsgbuf *ibuf, int fd)
685 {
686 	return send_fd(ibuf, GOT_IMSG_FETCH_OUTFD, fd);
687 }
688 
689 const struct got_error *
690 got_privsep_recv_fetch_progress(int *done, struct got_object_id **id,
691     char **refname, struct got_pathlist_head *symrefs, char **server_progress,
692     off_t *packfile_size, uint8_t *pack_sha1, struct imsgbuf *ibuf)
693 {
694 	const struct got_error *err = NULL;
695 	struct imsg imsg;
696 	size_t datalen;
697 	struct got_imsg_fetch_symrefs *isymrefs = NULL;
698 	size_t n, remain;
699 	off_t off;
700 	int i;
701 
702 	*done = 0;
703 	*id = NULL;
704 	*refname = NULL;
705 	*server_progress = NULL;
706 	*packfile_size = 0;
707 	memset(pack_sha1, 0, SHA1_DIGEST_LENGTH);
708 
709 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
710 	if (err)
711 		return err;
712 
713 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
714 	switch (imsg.hdr.type) {
715 	case GOT_IMSG_ERROR:
716 		if (datalen < sizeof(struct got_imsg_error)) {
717 			err = got_error(GOT_ERR_PRIVSEP_LEN);
718 			break;
719 		}
720 		err = recv_imsg_error(&imsg, datalen);
721 		break;
722 	case GOT_IMSG_FETCH_SYMREFS:
723 		if (datalen < sizeof(*isymrefs)) {
724 			err = got_error(GOT_ERR_PRIVSEP_LEN);
725 			break;
726 		}
727 		if (isymrefs != NULL) {
728 			err = got_error(GOT_ERR_PRIVSEP_MSG);
729 			break;
730 		}
731 		isymrefs = (struct got_imsg_fetch_symrefs *)imsg.data;
732 		off = sizeof(*isymrefs);
733 		remain = datalen - off;
734 		for (n = 0; n < isymrefs->nsymrefs; n++) {
735 			struct got_imsg_fetch_symref *s;
736 			char *name, *target;
737 			if (remain < sizeof(struct got_imsg_fetch_symref)) {
738 				err = got_error(GOT_ERR_PRIVSEP_LEN);
739 				goto done;
740 			}
741 			s = (struct got_imsg_fetch_symref *)(imsg.data + off);
742 			off += sizeof(*s);
743 			remain -= sizeof(*s);
744 			if (remain < s->name_len) {
745 				err = got_error(GOT_ERR_PRIVSEP_LEN);
746 				goto done;
747 			}
748 			name = strndup(imsg.data + off, s->name_len);
749 			if (name == NULL) {
750 				err = got_error_from_errno("strndup");
751 				goto done;
752 			}
753 			off += s->name_len;
754 			remain -= s->name_len;
755 			if (remain < s->target_len) {
756 				err = got_error(GOT_ERR_PRIVSEP_LEN);
757 				free(name);
758 				goto done;
759 			}
760 			target = strndup(imsg.data + off, s->target_len);
761 			if (target == NULL) {
762 				err = got_error_from_errno("strndup");
763 				free(name);
764 				goto done;
765 			}
766 			off += s->target_len;
767 			remain -= s->target_len;
768 			err = got_pathlist_append(symrefs, name, target);
769 			if (err) {
770 				free(name);
771 				free(target);
772 				goto done;
773 			}
774 		}
775 		break;
776 	case GOT_IMSG_FETCH_REF:
777 		if (datalen <= SHA1_DIGEST_LENGTH) {
778 			err = got_error(GOT_ERR_PRIVSEP_MSG);
779 			break;
780 		}
781 		*id = malloc(sizeof(**id));
782 		if (*id == NULL) {
783 			err = got_error_from_errno("malloc");
784 			break;
785 		}
786 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
787 		*refname = strndup(imsg.data + SHA1_DIGEST_LENGTH,
788 		    datalen - SHA1_DIGEST_LENGTH);
789 		if (*refname == NULL) {
790 			err = got_error_from_errno("strndup");
791 			break;
792 		}
793 		break;
794 	case GOT_IMSG_FETCH_SERVER_PROGRESS:
795 		if (datalen == 0) {
796 			err = got_error(GOT_ERR_PRIVSEP_LEN);
797 			break;
798 		}
799 		*server_progress = strndup(imsg.data, datalen);
800 		if (*server_progress == NULL) {
801 			err = got_error_from_errno("strndup");
802 			break;
803 		}
804 		for (i = 0; i < datalen; i++) {
805 			if (!isprint((unsigned char)(*server_progress)[i]) &&
806 			    !isspace((unsigned char)(*server_progress)[i])) {
807 				err = got_error(GOT_ERR_PRIVSEP_MSG);
808 				free(*server_progress);
809 				*server_progress = NULL;
810 				goto done;
811 			}
812 		}
813 		break;
814 	case GOT_IMSG_FETCH_DOWNLOAD_PROGRESS:
815 		if (datalen < sizeof(*packfile_size)) {
816 			err = got_error(GOT_ERR_PRIVSEP_MSG);
817 			break;
818 		}
819 		memcpy(packfile_size, imsg.data, sizeof(*packfile_size));
820 		break;
821 	case GOT_IMSG_FETCH_DONE:
822 		if (datalen != SHA1_DIGEST_LENGTH) {
823 			err = got_error(GOT_ERR_PRIVSEP_MSG);
824 			break;
825 		}
826 		memcpy(pack_sha1, imsg.data, SHA1_DIGEST_LENGTH);
827 		*done = 1;
828 		break;
829 	default:
830 		err = got_error(GOT_ERR_PRIVSEP_MSG);
831 		break;
832 	}
833 done:
834 	if (err) {
835 		free(*id);
836 		*id = NULL;
837 		free(*refname);
838 		*refname = NULL;
839 	}
840 	imsg_free(&imsg);
841 	return err;
842 }
843 
844 const struct got_error *
845 got_privsep_send_index_pack_req(struct imsgbuf *ibuf, uint8_t *pack_sha1,
846     int fd)
847 {
848 	const struct got_error *err = NULL;
849 
850 	/* Keep in sync with struct got_imsg_index_pack_request */
851 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_REQUEST, 0, 0, fd,
852 	    pack_sha1, SHA1_DIGEST_LENGTH) == -1) {
853 		err = got_error_from_errno("imsg_compose INDEX_REQUEST");
854 		close(fd);
855 		return err;
856 	}
857 	return flush_imsg(ibuf);
858 }
859 
860 const struct got_error *
861 got_privsep_send_index_pack_outfd(struct imsgbuf *ibuf, int fd)
862 {
863 	return send_fd(ibuf, GOT_IMSG_IDXPACK_OUTFD, fd);
864 }
865 
866 const struct got_error *
867 got_privsep_recv_index_progress(int *done, int *nobj_total,
868     int *nobj_indexed, int *nobj_loose, int *nobj_resolved,
869     struct imsgbuf *ibuf)
870 {
871 	const struct got_error *err = NULL;
872 	struct imsg imsg;
873 	struct got_imsg_index_pack_progress *iprogress;
874 	size_t datalen;
875 
876 	*done = 0;
877 	*nobj_total = 0;
878 	*nobj_indexed = 0;
879 	*nobj_resolved = 0;
880 
881 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
882 	if (err)
883 		return err;
884 
885 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
886 	switch (imsg.hdr.type) {
887 	case GOT_IMSG_ERROR:
888 		if (datalen < sizeof(struct got_imsg_error)) {
889 			err = got_error(GOT_ERR_PRIVSEP_LEN);
890 			break;
891 		}
892 		err = recv_imsg_error(&imsg, datalen);
893 		break;
894 	case GOT_IMSG_IDXPACK_PROGRESS:
895 		if (datalen < sizeof(*iprogress)) {
896 			err = got_error(GOT_ERR_PRIVSEP_LEN);
897 			break;
898 		}
899 		iprogress = (struct got_imsg_index_pack_progress *)imsg.data;
900 		*nobj_total = iprogress->nobj_total;
901 		*nobj_indexed = iprogress->nobj_indexed;
902 		*nobj_loose = iprogress->nobj_loose;
903 		*nobj_resolved = iprogress->nobj_resolved;
904 		break;
905 	case GOT_IMSG_IDXPACK_DONE:
906 		if (datalen != 0) {
907 			err = got_error(GOT_ERR_PRIVSEP_LEN);
908 			break;
909 		}
910 		*done = 1;
911 		break;
912 	default:
913 		err = got_error(GOT_ERR_PRIVSEP_MSG);
914 		break;
915 	}
916 
917 	imsg_free(&imsg);
918 	return err;
919 }
920 
921 const struct got_error *
922 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
923     struct imsgbuf *ibuf)
924 {
925 	const struct got_error *err = NULL;
926 	struct got_imsg_object *iobj;
927 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
928 
929 	if (datalen != sizeof(*iobj))
930 		return got_error(GOT_ERR_PRIVSEP_LEN);
931 	iobj = imsg->data;
932 
933 	*obj = calloc(1, sizeof(**obj));
934 	if (*obj == NULL)
935 		return got_error_from_errno("calloc");
936 
937 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
938 	(*obj)->type = iobj->type;
939 	(*obj)->flags = iobj->flags;
940 	(*obj)->hdrlen = iobj->hdrlen;
941 	(*obj)->size = iobj->size;
942 	/* path_packfile is handled by caller */
943 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
944 		(*obj)->pack_offset = iobj->pack_offset;
945 		(*obj)->pack_idx = iobj->pack_idx;
946 	}
947 
948 	return err;
949 }
950 
951 const struct got_error *
952 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
953 {
954 	const struct got_error *err = NULL;
955 	struct imsg imsg;
956 	const size_t min_datalen =
957 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
958 
959 	*obj = NULL;
960 
961 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
962 	if (err)
963 		return err;
964 
965 	switch (imsg.hdr.type) {
966 	case GOT_IMSG_OBJECT:
967 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
968 		break;
969 	default:
970 		err = got_error(GOT_ERR_PRIVSEP_MSG);
971 		break;
972 	}
973 
974 	imsg_free(&imsg);
975 
976 	return err;
977 }
978 
979 static const struct got_error *
980 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
981     size_t logmsg_len)
982 {
983 	const struct got_error *err = NULL;
984 	size_t offset, remain;
985 
986 	offset = 0;
987 	remain = logmsg_len;
988 	while (remain > 0) {
989 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
990 
991 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
992 		    commit->logmsg + offset, n) == -1) {
993 			err = got_error_from_errno("imsg_compose "
994 			    "COMMIT_LOGMSG");
995 			break;
996 		}
997 
998 		err = flush_imsg(ibuf);
999 		if (err)
1000 			break;
1001 
1002 		offset += n;
1003 		remain -= n;
1004 	}
1005 
1006 	return err;
1007 }
1008 
1009 const struct got_error *
1010 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
1011 {
1012 	const struct got_error *err = NULL;
1013 	struct got_imsg_commit_object *icommit;
1014 	uint8_t *buf;
1015 	size_t len, total;
1016 	struct got_object_qid *qid;
1017 	size_t author_len = strlen(commit->author);
1018 	size_t committer_len = strlen(commit->committer);
1019 	size_t logmsg_len = strlen(commit->logmsg);
1020 
1021 	total = sizeof(*icommit) + author_len + committer_len +
1022 	    commit->nparents * SHA1_DIGEST_LENGTH;
1023 
1024 	buf = malloc(total);
1025 	if (buf == NULL)
1026 		return got_error_from_errno("malloc");
1027 
1028 	icommit = (struct got_imsg_commit_object *)buf;
1029 	memcpy(icommit->tree_id, commit->tree_id->sha1,
1030 	    sizeof(icommit->tree_id));
1031 	icommit->author_len = author_len;
1032 	icommit->author_time = commit->author_time;
1033 	icommit->author_gmtoff = commit->author_gmtoff;
1034 	icommit->committer_len = committer_len;
1035 	icommit->committer_time = commit->committer_time;
1036 	icommit->committer_gmtoff = commit->committer_gmtoff;
1037 	icommit->logmsg_len = logmsg_len;
1038 	icommit->nparents = commit->nparents;
1039 
1040 	len = sizeof(*icommit);
1041 	memcpy(buf + len, commit->author, author_len);
1042 	len += author_len;
1043 	memcpy(buf + len, commit->committer, committer_len);
1044 	len += committer_len;
1045 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
1046 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
1047 		len += SHA1_DIGEST_LENGTH;
1048 	}
1049 
1050 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
1051 		err = got_error_from_errno("imsg_compose COMMIT");
1052 		goto done;
1053 	}
1054 
1055 	if (logmsg_len == 0 ||
1056 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1057 		err = flush_imsg(ibuf);
1058 		if (err)
1059 			goto done;
1060 	}
1061 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
1062 done:
1063 	free(buf);
1064 	return err;
1065 }
1066 
1067 static const struct got_error *
1068 get_commit_from_imsg(struct got_commit_object **commit,
1069     struct imsg *imsg, size_t datalen, struct imsgbuf *ibuf)
1070 {
1071 	const struct got_error *err = NULL;
1072 	struct got_imsg_commit_object *icommit;
1073 	size_t len = 0;
1074 	int i;
1075 
1076 	if (datalen < sizeof(*icommit))
1077 		return got_error(GOT_ERR_PRIVSEP_LEN);
1078 
1079 	icommit = imsg->data;
1080 	if (datalen != sizeof(*icommit) + icommit->author_len +
1081 	    icommit->committer_len +
1082 	    icommit->nparents * SHA1_DIGEST_LENGTH)
1083 		return got_error(GOT_ERR_PRIVSEP_LEN);
1084 
1085 	if (icommit->nparents < 0)
1086 		return got_error(GOT_ERR_PRIVSEP_LEN);
1087 
1088 	len += sizeof(*icommit);
1089 
1090 	*commit = got_object_commit_alloc_partial();
1091 	if (*commit == NULL)
1092 		return got_error_from_errno(
1093 		    "got_object_commit_alloc_partial");
1094 
1095 	memcpy((*commit)->tree_id->sha1, icommit->tree_id,
1096 	    SHA1_DIGEST_LENGTH);
1097 	(*commit)->author_time = icommit->author_time;
1098 	(*commit)->author_gmtoff = icommit->author_gmtoff;
1099 	(*commit)->committer_time = icommit->committer_time;
1100 	(*commit)->committer_gmtoff = icommit->committer_gmtoff;
1101 
1102 	if (icommit->author_len == 0) {
1103 		(*commit)->author = strdup("");
1104 		if ((*commit)->author == NULL) {
1105 			err = got_error_from_errno("strdup");
1106 			goto done;
1107 		}
1108 	} else {
1109 		(*commit)->author = malloc(icommit->author_len + 1);
1110 		if ((*commit)->author == NULL) {
1111 			err = got_error_from_errno("malloc");
1112 			goto done;
1113 		}
1114 		memcpy((*commit)->author, imsg->data + len,
1115 		    icommit->author_len);
1116 		(*commit)->author[icommit->author_len] = '\0';
1117 	}
1118 	len += icommit->author_len;
1119 
1120 	if (icommit->committer_len == 0) {
1121 		(*commit)->committer = strdup("");
1122 		if ((*commit)->committer == NULL) {
1123 			err = got_error_from_errno("strdup");
1124 			goto done;
1125 		}
1126 	} else {
1127 		(*commit)->committer =
1128 		    malloc(icommit->committer_len + 1);
1129 		if ((*commit)->committer == NULL) {
1130 			err = got_error_from_errno("malloc");
1131 			goto done;
1132 		}
1133 		memcpy((*commit)->committer, imsg->data + len,
1134 		    icommit->committer_len);
1135 		(*commit)->committer[icommit->committer_len] = '\0';
1136 	}
1137 	len += icommit->committer_len;
1138 
1139 	if (icommit->logmsg_len == 0) {
1140 		(*commit)->logmsg = strdup("");
1141 		if ((*commit)->logmsg == NULL) {
1142 			err = got_error_from_errno("strdup");
1143 			goto done;
1144 		}
1145 	} else {
1146 		size_t offset = 0, remain = icommit->logmsg_len;
1147 
1148 		(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
1149 		if ((*commit)->logmsg == NULL) {
1150 			err = got_error_from_errno("malloc");
1151 			goto done;
1152 		}
1153 		while (remain > 0) {
1154 			struct imsg imsg_log;
1155 			size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1156 			    remain);
1157 
1158 			err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1159 			if (err)
1160 				goto done;
1161 
1162 			if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG) {
1163 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1164 				goto done;
1165 			}
1166 
1167 			memcpy((*commit)->logmsg + offset,
1168 			    imsg_log.data, n);
1169 			imsg_free(&imsg_log);
1170 			offset += n;
1171 			remain -= n;
1172 		}
1173 		(*commit)->logmsg[icommit->logmsg_len] = '\0';
1174 	}
1175 
1176 	for (i = 0; i < icommit->nparents; i++) {
1177 		struct got_object_qid *qid;
1178 
1179 		err = got_object_qid_alloc_partial(&qid);
1180 		if (err)
1181 			break;
1182 		memcpy(qid->id, imsg->data + len +
1183 		    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
1184 		SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
1185 		(*commit)->nparents++;
1186 	}
1187 done:
1188 	if (err) {
1189 		got_object_commit_close(*commit);
1190 		*commit = NULL;
1191 	}
1192 	return err;
1193 }
1194 
1195 const struct got_error *
1196 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
1197 {
1198 	const struct got_error *err = NULL;
1199 	struct imsg imsg;
1200 	size_t datalen;
1201 	const size_t min_datalen =
1202 	    MIN(sizeof(struct got_imsg_error),
1203 	    sizeof(struct got_imsg_commit_object));
1204 
1205 	*commit = NULL;
1206 
1207 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1208 	if (err)
1209 		return err;
1210 
1211 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1212 
1213 	switch (imsg.hdr.type) {
1214 	case GOT_IMSG_COMMIT:
1215 		err = get_commit_from_imsg(commit, &imsg, datalen, ibuf);
1216 		break;
1217 	default:
1218 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1219 		break;
1220 	}
1221 
1222 	imsg_free(&imsg);
1223 
1224 	return err;
1225 }
1226 
1227 const struct got_error *
1228 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_pathlist_head *entries,
1229     int nentries)
1230 {
1231 	const struct got_error *err = NULL;
1232 	struct got_imsg_tree_object itree;
1233 	struct got_pathlist_entry *pe;
1234 	size_t totlen;
1235 	int nimsg; /* number of imsg queued in ibuf */
1236 
1237 	itree.nentries = nentries;
1238 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
1239 	    == -1)
1240 		return got_error_from_errno("imsg_compose TREE");
1241 
1242 	totlen = sizeof(itree);
1243 	nimsg = 1;
1244 	TAILQ_FOREACH(pe, entries, entry) {
1245 		const char *name = pe->path;
1246 		struct got_parsed_tree_entry *pte = pe->data;
1247 		struct ibuf *wbuf;
1248 		size_t namelen = strlen(name);
1249 		size_t len = sizeof(struct got_imsg_tree_entry) + namelen;
1250 
1251 		if (len > MAX_IMSGSIZE)
1252 			return got_error(GOT_ERR_NO_SPACE);
1253 
1254 		nimsg++;
1255 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
1256 			err = flush_imsg(ibuf);
1257 			if (err)
1258 				return err;
1259 			nimsg = 0;
1260 		}
1261 
1262 		wbuf = imsg_create(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, len);
1263 		if (wbuf == NULL)
1264 			return got_error_from_errno("imsg_create TREE_ENTRY");
1265 
1266 		/* Keep in sync with struct got_imsg_tree_object definition! */
1267 		if (imsg_add(wbuf, pte->id, SHA1_DIGEST_LENGTH) == -1) {
1268 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1269 			ibuf_free(wbuf);
1270 			return err;
1271 		}
1272 		if (imsg_add(wbuf, &pte->mode, sizeof(pte->mode)) == -1) {
1273 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1274 			ibuf_free(wbuf);
1275 			return err;
1276 		}
1277 
1278 		if (imsg_add(wbuf, name, namelen) == -1) {
1279 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1280 			ibuf_free(wbuf);
1281 			return err;
1282 		}
1283 
1284 		wbuf->fd = -1;
1285 		imsg_close(ibuf, wbuf);
1286 
1287 		totlen += len;
1288 	}
1289 
1290 	return flush_imsg(ibuf);
1291 }
1292 
1293 const struct got_error *
1294 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
1295 {
1296 	const struct got_error *err = NULL;
1297 	const size_t min_datalen =
1298 	    MIN(sizeof(struct got_imsg_error),
1299 	    sizeof(struct got_imsg_tree_object));
1300 	struct got_imsg_tree_object *itree;
1301 	int nentries = 0;
1302 
1303 	*tree = NULL;
1304 get_more:
1305 	err = read_imsg(ibuf);
1306 	if (err)
1307 		goto done;
1308 
1309 	for (;;) {
1310 		struct imsg imsg;
1311 		size_t n;
1312 		size_t datalen;
1313 		struct got_imsg_tree_entry *ite;
1314 		struct got_tree_entry *te = NULL;
1315 
1316 		n = imsg_get(ibuf, &imsg);
1317 		if (n == 0) {
1318 			if (*tree && (*tree)->nentries != nentries)
1319 				goto get_more;
1320 			break;
1321 		}
1322 
1323 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen) {
1324 			imsg_free(&imsg);
1325 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1326 			break;
1327 		}
1328 
1329 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1330 
1331 		switch (imsg.hdr.type) {
1332 		case GOT_IMSG_ERROR:
1333 			err = recv_imsg_error(&imsg, datalen);
1334 			break;
1335 		case GOT_IMSG_TREE:
1336 			/* This message should only appear once. */
1337 			if (*tree != NULL) {
1338 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1339 				break;
1340 			}
1341 			if (datalen != sizeof(*itree)) {
1342 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1343 				break;
1344 			}
1345 			itree = imsg.data;
1346 			*tree = malloc(sizeof(**tree));
1347 			if (*tree == NULL) {
1348 				err = got_error_from_errno("malloc");
1349 				break;
1350 			}
1351 			(*tree)->entries = calloc(itree->nentries,
1352 			    sizeof(struct got_tree_entry));
1353 			if ((*tree)->entries == NULL) {
1354 				err = got_error_from_errno("malloc");
1355 				break;
1356 			}
1357 			(*tree)->nentries = itree->nentries;
1358 			(*tree)->refcnt = 0;
1359 			break;
1360 		case GOT_IMSG_TREE_ENTRY:
1361 			/* This message should be preceeded by GOT_IMSG_TREE. */
1362 			if (*tree == NULL) {
1363 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1364 				break;
1365 			}
1366 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
1367 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1368 				break;
1369 			}
1370 
1371 			/* Remaining data contains the entry's name. */
1372 			datalen -= sizeof(*ite);
1373 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
1374 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1375 				break;
1376 			}
1377 			ite = imsg.data;
1378 
1379 			if (datalen + 1 > sizeof(te->name)) {
1380 				err = got_error(GOT_ERR_NO_SPACE);
1381 				break;
1382 			}
1383 			te = &(*tree)->entries[nentries];
1384 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
1385 			te->name[datalen] = '\0';
1386 
1387 			memcpy(te->id.sha1, ite->id, SHA1_DIGEST_LENGTH);
1388 			te->mode = ite->mode;
1389 			te->idx = nentries;
1390 			nentries++;
1391 			break;
1392 		default:
1393 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1394 			break;
1395 		}
1396 
1397 		imsg_free(&imsg);
1398 		if (err)
1399 			break;
1400 	}
1401 done:
1402 	if (*tree && (*tree)->nentries != nentries) {
1403 		if (err == NULL)
1404 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1405 		got_object_tree_close(*tree);
1406 		*tree = NULL;
1407 	}
1408 
1409 	return err;
1410 }
1411 
1412 const struct got_error *
1413 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
1414     const uint8_t *data)
1415 {
1416 	struct got_imsg_blob iblob;
1417 
1418 	iblob.size = size;
1419 	iblob.hdrlen = hdrlen;
1420 
1421 	if (data) {
1422 		uint8_t *buf;
1423 
1424 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
1425 			return got_error(GOT_ERR_NO_SPACE);
1426 
1427 		buf = malloc(sizeof(iblob) + size);
1428 		if (buf == NULL)
1429 			return got_error_from_errno("malloc");
1430 
1431 		memcpy(buf, &iblob, sizeof(iblob));
1432 		memcpy(buf + sizeof(iblob), data, size);
1433 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
1434 		    sizeof(iblob) + size) == -1) {
1435 			free(buf);
1436 			return got_error_from_errno("imsg_compose BLOB");
1437 		}
1438 		free(buf);
1439 	} else {
1440 		/* Data has already been written to file descriptor. */
1441 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
1442 		    sizeof(iblob)) == -1)
1443 			return got_error_from_errno("imsg_compose BLOB");
1444 	}
1445 
1446 
1447 	return flush_imsg(ibuf);
1448 }
1449 
1450 const struct got_error *
1451 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
1452     struct imsgbuf *ibuf)
1453 {
1454 	const struct got_error *err = NULL;
1455 	struct imsg imsg;
1456 	struct got_imsg_blob *iblob;
1457 	size_t datalen;
1458 
1459 	*outbuf = NULL;
1460 
1461 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1462 	if (err)
1463 		return err;
1464 
1465 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1466 
1467 	switch (imsg.hdr.type) {
1468 	case GOT_IMSG_BLOB:
1469 		if (datalen < sizeof(*iblob)) {
1470 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1471 			break;
1472 		}
1473 		iblob = imsg.data;
1474 		*size = iblob->size;
1475 		*hdrlen = iblob->hdrlen;
1476 
1477 		if (datalen == sizeof(*iblob)) {
1478 			/* Data has been written to file descriptor. */
1479 			break;
1480 		}
1481 
1482 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX) {
1483 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1484 			break;
1485 		}
1486 
1487 		*outbuf = malloc(*size);
1488 		if (*outbuf == NULL) {
1489 			err = got_error_from_errno("malloc");
1490 			break;
1491 		}
1492 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
1493 		break;
1494 	default:
1495 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1496 		break;
1497 	}
1498 
1499 	imsg_free(&imsg);
1500 
1501 	return err;
1502 }
1503 
1504 static const struct got_error *
1505 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
1506 {
1507 	const struct got_error *err = NULL;
1508 	size_t offset, remain;
1509 
1510 	offset = 0;
1511 	remain = tagmsg_len;
1512 	while (remain > 0) {
1513 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1514 
1515 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
1516 		    tag->tagmsg + offset, n) == -1) {
1517 			err = got_error_from_errno("imsg_compose TAG_TAGMSG");
1518 			break;
1519 		}
1520 
1521 		err = flush_imsg(ibuf);
1522 		if (err)
1523 			break;
1524 
1525 		offset += n;
1526 		remain -= n;
1527 	}
1528 
1529 	return err;
1530 }
1531 
1532 const struct got_error *
1533 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
1534 {
1535 	const struct got_error *err = NULL;
1536 	struct got_imsg_tag_object *itag;
1537 	uint8_t *buf;
1538 	size_t len, total;
1539 	size_t tag_len = strlen(tag->tag);
1540 	size_t tagger_len = strlen(tag->tagger);
1541 	size_t tagmsg_len = strlen(tag->tagmsg);
1542 
1543 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
1544 
1545 	buf = malloc(total);
1546 	if (buf == NULL)
1547 		return got_error_from_errno("malloc");
1548 
1549 	itag = (struct got_imsg_tag_object *)buf;
1550 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
1551 	itag->obj_type = tag->obj_type;
1552 	itag->tag_len = tag_len;
1553 	itag->tagger_len = tagger_len;
1554 	itag->tagger_time = tag->tagger_time;
1555 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1556 	itag->tagmsg_len = tagmsg_len;
1557 
1558 	len = sizeof(*itag);
1559 	memcpy(buf + len, tag->tag, tag_len);
1560 	len += tag_len;
1561 	memcpy(buf + len, tag->tagger, tagger_len);
1562 	len += tagger_len;
1563 
1564 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1565 		err = got_error_from_errno("imsg_compose TAG");
1566 		goto done;
1567 	}
1568 
1569 	if (tagmsg_len == 0 ||
1570 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1571 		err = flush_imsg(ibuf);
1572 		if (err)
1573 			goto done;
1574 	}
1575 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1576 done:
1577 	free(buf);
1578 	return err;
1579 }
1580 
1581 const struct got_error *
1582 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1583 {
1584 	const struct got_error *err = NULL;
1585 	struct imsg imsg;
1586 	struct got_imsg_tag_object *itag;
1587 	size_t len, datalen;
1588 	const size_t min_datalen =
1589 	    MIN(sizeof(struct got_imsg_error),
1590 	    sizeof(struct got_imsg_tag_object));
1591 
1592 	*tag = NULL;
1593 
1594 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1595 	if (err)
1596 		return err;
1597 
1598 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1599 	len = 0;
1600 
1601 	switch (imsg.hdr.type) {
1602 	case GOT_IMSG_TAG:
1603 		if (datalen < sizeof(*itag)) {
1604 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1605 			break;
1606 		}
1607 		itag = imsg.data;
1608 		if (datalen != sizeof(*itag) + itag->tag_len +
1609 		    itag->tagger_len) {
1610 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1611 			break;
1612 		}
1613 		len += sizeof(*itag);
1614 
1615 		*tag = calloc(1, sizeof(**tag));
1616 		if (*tag == NULL) {
1617 			err = got_error_from_errno("calloc");
1618 			break;
1619 		}
1620 
1621 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1622 
1623 		if (itag->tag_len == 0) {
1624 			(*tag)->tag = strdup("");
1625 			if ((*tag)->tag == NULL) {
1626 				err = got_error_from_errno("strdup");
1627 				break;
1628 			}
1629 		} else {
1630 			(*tag)->tag = malloc(itag->tag_len + 1);
1631 			if ((*tag)->tag == NULL) {
1632 				err = got_error_from_errno("malloc");
1633 				break;
1634 			}
1635 			memcpy((*tag)->tag, imsg.data + len,
1636 			    itag->tag_len);
1637 			(*tag)->tag[itag->tag_len] = '\0';
1638 		}
1639 		len += itag->tag_len;
1640 
1641 		(*tag)->obj_type = itag->obj_type;
1642 		(*tag)->tagger_time = itag->tagger_time;
1643 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1644 
1645 		if (itag->tagger_len == 0) {
1646 			(*tag)->tagger = strdup("");
1647 			if ((*tag)->tagger == NULL) {
1648 				err = got_error_from_errno("strdup");
1649 				break;
1650 			}
1651 		} else {
1652 			(*tag)->tagger = malloc(itag->tagger_len + 1);
1653 			if ((*tag)->tagger == NULL) {
1654 				err = got_error_from_errno("malloc");
1655 				break;
1656 			}
1657 			memcpy((*tag)->tagger, imsg.data + len,
1658 			    itag->tagger_len);
1659 			(*tag)->tagger[itag->tagger_len] = '\0';
1660 		}
1661 		len += itag->tagger_len;
1662 
1663 		if (itag->tagmsg_len == 0) {
1664 			(*tag)->tagmsg = strdup("");
1665 			if ((*tag)->tagmsg == NULL) {
1666 				err = got_error_from_errno("strdup");
1667 				break;
1668 			}
1669 		} else {
1670 			size_t offset = 0, remain = itag->tagmsg_len;
1671 
1672 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1673 			if ((*tag)->tagmsg == NULL) {
1674 				err = got_error_from_errno("malloc");
1675 				break;
1676 			}
1677 			while (remain > 0) {
1678 				struct imsg imsg_log;
1679 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1680 				    remain);
1681 
1682 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1683 				if (err)
1684 					return err;
1685 
1686 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1687 					return got_error(GOT_ERR_PRIVSEP_MSG);
1688 
1689 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1690 				    n);
1691 				imsg_free(&imsg_log);
1692 				offset += n;
1693 				remain -= n;
1694 			}
1695 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1696 		}
1697 
1698 		break;
1699 	default:
1700 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1701 		break;
1702 	}
1703 
1704 	imsg_free(&imsg);
1705 
1706 	return err;
1707 }
1708 
1709 const struct got_error *
1710 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1711     struct got_packidx *packidx)
1712 {
1713 	const struct got_error *err = NULL;
1714 	struct got_imsg_packidx ipackidx;
1715 	struct got_imsg_pack ipack;
1716 	int fd;
1717 
1718 	ipackidx.len = packidx->len;
1719 	fd = dup(packidx->fd);
1720 	if (fd == -1)
1721 		return got_error_from_errno("dup");
1722 
1723 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1724 	    sizeof(ipackidx)) == -1) {
1725 		err = got_error_from_errno("imsg_compose PACKIDX");
1726 		close(fd);
1727 		return err;
1728 	}
1729 
1730 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1731 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1732 		return got_error(GOT_ERR_NO_SPACE);
1733 	ipack.filesize = pack->filesize;
1734 
1735 	fd = dup(pack->fd);
1736 	if (fd == -1)
1737 		return got_error_from_errno("dup");
1738 
1739 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
1740 	    == -1) {
1741 		err = got_error_from_errno("imsg_compose PACK");
1742 		close(fd);
1743 		return err;
1744 	}
1745 
1746 	return flush_imsg(ibuf);
1747 }
1748 
1749 const struct got_error *
1750 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
1751     struct got_object_id *id)
1752 {
1753 	struct got_imsg_packed_object iobj;
1754 
1755 	iobj.idx = idx;
1756 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1757 
1758 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
1759 	    &iobj, sizeof(iobj)) == -1)
1760 		return got_error_from_errno("imsg_compose "
1761 		    "PACKED_OBJECT_REQUEST");
1762 
1763 	return flush_imsg(ibuf);
1764 }
1765 
1766 const struct got_error *
1767 got_privsep_send_packed_raw_obj_req(struct imsgbuf *ibuf, int idx,
1768     struct got_object_id *id)
1769 {
1770 	struct got_imsg_packed_object iobj;
1771 
1772 	iobj.idx = idx;
1773 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1774 
1775 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_RAW_OBJECT_REQUEST, 0, 0, -1,
1776 	    &iobj, sizeof(iobj)) == -1)
1777 		return got_error_from_errno("imsg_compose "
1778 		    "PACKED_OBJECT_REQUEST");
1779 
1780 	return flush_imsg(ibuf);
1781 }
1782 
1783 const struct got_error *
1784 got_privsep_send_gitconfig_parse_req(struct imsgbuf *ibuf, int fd)
1785 {
1786 	const struct got_error *err = NULL;
1787 
1788 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_PARSE_REQUEST, 0, 0, fd,
1789 	    NULL, 0) == -1) {
1790 		err = got_error_from_errno("imsg_compose "
1791 		    "GITCONFIG_PARSE_REQUEST");
1792 		close(fd);
1793 		return err;
1794 	}
1795 
1796 	return flush_imsg(ibuf);
1797 }
1798 
1799 const struct got_error *
1800 got_privsep_send_gitconfig_repository_format_version_req(struct imsgbuf *ibuf)
1801 {
1802 	if (imsg_compose(ibuf,
1803 	    GOT_IMSG_GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST, 0, 0, -1,
1804 	    NULL, 0) == -1)
1805 		return got_error_from_errno("imsg_compose "
1806 		    "GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST");
1807 
1808 	return flush_imsg(ibuf);
1809 }
1810 
1811 const struct got_error *
1812 got_privsep_send_gitconfig_repository_extensions_req(struct imsgbuf *ibuf)
1813 {
1814 	if (imsg_compose(ibuf,
1815 	    GOT_IMSG_GITCONFIG_REPOSITORY_EXTENSIONS_REQUEST, 0, 0, -1,
1816 	    NULL, 0) == -1)
1817 		return got_error_from_errno("imsg_compose "
1818 		    "GITCONFIG_REPOSITORY_EXTENSIONS_REQUEST");
1819 
1820 	return flush_imsg(ibuf);
1821 }
1822 
1823 
1824 const struct got_error *
1825 got_privsep_send_gitconfig_author_name_req(struct imsgbuf *ibuf)
1826 {
1827 	if (imsg_compose(ibuf,
1828 	    GOT_IMSG_GITCONFIG_AUTHOR_NAME_REQUEST, 0, 0, -1, NULL, 0) == -1)
1829 		return got_error_from_errno("imsg_compose "
1830 		    "GITCONFIG_AUTHOR_NAME_REQUEST");
1831 
1832 	return flush_imsg(ibuf);
1833 }
1834 
1835 const struct got_error *
1836 got_privsep_send_gitconfig_author_email_req(struct imsgbuf *ibuf)
1837 {
1838 	if (imsg_compose(ibuf,
1839 	    GOT_IMSG_GITCONFIG_AUTHOR_EMAIL_REQUEST, 0, 0, -1, NULL, 0) == -1)
1840 		return got_error_from_errno("imsg_compose "
1841 		    "GITCONFIG_AUTHOR_EMAIL_REQUEST");
1842 
1843 	return flush_imsg(ibuf);
1844 }
1845 
1846 const struct got_error *
1847 got_privsep_send_gitconfig_remotes_req(struct imsgbuf *ibuf)
1848 {
1849 	if (imsg_compose(ibuf,
1850 	    GOT_IMSG_GITCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
1851 		return got_error_from_errno("imsg_compose "
1852 		    "GITCONFIG_REMOTE_REQUEST");
1853 
1854 	return flush_imsg(ibuf);
1855 }
1856 
1857 const struct got_error *
1858 got_privsep_send_gitconfig_owner_req(struct imsgbuf *ibuf)
1859 {
1860 	if (imsg_compose(ibuf,
1861 	    GOT_IMSG_GITCONFIG_OWNER_REQUEST, 0, 0, -1, NULL, 0) == -1)
1862 		return got_error_from_errno("imsg_compose "
1863 		    "GITCONFIG_OWNER_REQUEST");
1864 
1865 	return flush_imsg(ibuf);
1866 }
1867 
1868 const struct got_error *
1869 got_privsep_recv_gitconfig_str(char **str, struct imsgbuf *ibuf)
1870 {
1871 	const struct got_error *err = NULL;
1872 	struct imsg imsg;
1873 	size_t datalen;
1874 	const size_t min_datalen = 0;
1875 
1876 	*str = NULL;
1877 
1878 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1879 	if (err)
1880 		return err;
1881 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1882 
1883 	switch (imsg.hdr.type) {
1884 	case GOT_IMSG_GITCONFIG_STR_VAL:
1885 		if (datalen == 0)
1886 			break;
1887 		/* datalen does not include terminating \0 */
1888 		*str = malloc(datalen + 1);
1889 		if (*str == NULL) {
1890 			err = got_error_from_errno("malloc");
1891 			break;
1892 		}
1893 		memcpy(*str, imsg.data, datalen);
1894 		(*str)[datalen] = '\0';
1895 		break;
1896 	default:
1897 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1898 		break;
1899 	}
1900 
1901 	imsg_free(&imsg);
1902 	return err;
1903 }
1904 
1905 const struct got_error *
1906 got_privsep_recv_gitconfig_int(int *val, struct imsgbuf *ibuf)
1907 {
1908 	const struct got_error *err = NULL;
1909 	struct imsg imsg;
1910 	size_t datalen;
1911 	const size_t min_datalen =
1912 	    MIN(sizeof(struct got_imsg_error), sizeof(int));
1913 
1914 	*val = 0;
1915 
1916 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1917 	if (err)
1918 		return err;
1919 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1920 
1921 	switch (imsg.hdr.type) {
1922 	case GOT_IMSG_GITCONFIG_INT_VAL:
1923 		if (datalen != sizeof(*val)) {
1924 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1925 			break;
1926 		}
1927 		memcpy(val, imsg.data, sizeof(*val));
1928 		break;
1929 	default:
1930 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1931 		break;
1932 	}
1933 
1934 	imsg_free(&imsg);
1935 	return err;
1936 }
1937 
1938 static void
1939 free_remote_data(struct got_remote_repo *remote)
1940 {
1941 	int i;
1942 
1943 	free(remote->name);
1944 	free(remote->url);
1945 	for (i = 0; i < remote->nbranches; i++)
1946 		free(remote->branches[i]);
1947 	free(remote->branches);
1948 	for (i = 0; i < remote->nrefs; i++)
1949 		free(remote->refs[i]);
1950 	free(remote->refs);
1951 }
1952 
1953 const struct got_error *
1954 got_privsep_recv_gitconfig_remotes(struct got_remote_repo **remotes,
1955     int *nremotes, struct imsgbuf *ibuf)
1956 {
1957 	const struct got_error *err = NULL;
1958 	struct imsg imsg;
1959 	size_t datalen;
1960 	struct got_imsg_remotes iremotes;
1961 	struct got_imsg_remote iremote;
1962 
1963 	*remotes = NULL;
1964 	*nremotes = 0;
1965 	iremotes.nremotes = 0;
1966 
1967 	err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremotes));
1968 	if (err)
1969 		return err;
1970 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1971 
1972 	switch (imsg.hdr.type) {
1973 	case GOT_IMSG_GITCONFIG_REMOTES:
1974 		if (datalen != sizeof(iremotes)) {
1975 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1976 			break;
1977 		}
1978 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
1979 		if (iremotes.nremotes == 0) {
1980 			imsg_free(&imsg);
1981 			return NULL;
1982 		}
1983 		break;
1984 	default:
1985 		imsg_free(&imsg);
1986 		return got_error(GOT_ERR_PRIVSEP_MSG);
1987 	}
1988 
1989 	imsg_free(&imsg);
1990 
1991 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(**remotes));
1992 	if (*remotes == NULL)
1993 		return got_error_from_errno("recallocarray");
1994 
1995 	while (*nremotes < iremotes.nremotes) {
1996 		struct got_remote_repo *remote;
1997 
1998 		err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremote));
1999 		if (err)
2000 			break;
2001 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2002 
2003 		switch (imsg.hdr.type) {
2004 		case GOT_IMSG_GITCONFIG_REMOTE:
2005 			remote = &(*remotes)[*nremotes];
2006 			memset(remote, 0, sizeof(*remote));
2007 			if (datalen < sizeof(iremote)) {
2008 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2009 				break;
2010 			}
2011 			memcpy(&iremote, imsg.data, sizeof(iremote));
2012 			if (iremote.name_len == 0 || iremote.url_len == 0 ||
2013 			    (sizeof(iremote) + iremote.name_len +
2014 			    iremote.url_len) > datalen) {
2015 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2016 				break;
2017 			}
2018 			remote->name = strndup(imsg.data + sizeof(iremote),
2019 			    iremote.name_len);
2020 			if (remote->name == NULL) {
2021 				err = got_error_from_errno("strndup");
2022 				break;
2023 			}
2024 			remote->url = strndup(imsg.data + sizeof(iremote) +
2025 			    iremote.name_len, iremote.url_len);
2026 			if (remote->url == NULL) {
2027 				err = got_error_from_errno("strndup");
2028 				free_remote_data(remote);
2029 				break;
2030 			}
2031 			remote->mirror_references = iremote.mirror_references;
2032 			remote->fetch_all_branches = iremote.fetch_all_branches;
2033 			remote->nbranches = 0;
2034 			remote->branches = NULL;
2035 			remote->nrefs = 0;
2036 			remote->refs = NULL;
2037 			(*nremotes)++;
2038 			break;
2039 		default:
2040 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2041 			break;
2042 		}
2043 
2044 		imsg_free(&imsg);
2045 		if (err)
2046 			break;
2047 	}
2048 
2049 	if (err) {
2050 		int i;
2051 		for (i = 0; i < *nremotes; i++)
2052 			free_remote_data(&(*remotes)[i]);
2053 		free(*remotes);
2054 		*remotes = NULL;
2055 		*nremotes = 0;
2056 	}
2057 	return err;
2058 }
2059 
2060 const struct got_error *
2061 got_privsep_send_gotconfig_parse_req(struct imsgbuf *ibuf, int fd)
2062 {
2063 	const struct got_error *err = NULL;
2064 
2065 	if (imsg_compose(ibuf, GOT_IMSG_GOTCONFIG_PARSE_REQUEST, 0, 0, fd,
2066 	    NULL, 0) == -1) {
2067 		err = got_error_from_errno("imsg_compose "
2068 		    "GOTCONFIG_PARSE_REQUEST");
2069 		close(fd);
2070 		return err;
2071 	}
2072 
2073 	return flush_imsg(ibuf);
2074 }
2075 
2076 const struct got_error *
2077 got_privsep_send_gotconfig_author_req(struct imsgbuf *ibuf)
2078 {
2079 	if (imsg_compose(ibuf,
2080 	    GOT_IMSG_GOTCONFIG_AUTHOR_REQUEST, 0, 0, -1, NULL, 0) == -1)
2081 		return got_error_from_errno("imsg_compose "
2082 		    "GOTCONFIG_AUTHOR_REQUEST");
2083 
2084 	return flush_imsg(ibuf);
2085 }
2086 
2087 const struct got_error *
2088 got_privsep_send_gotconfig_remotes_req(struct imsgbuf *ibuf)
2089 {
2090 	if (imsg_compose(ibuf,
2091 	    GOT_IMSG_GOTCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
2092 		return got_error_from_errno("imsg_compose "
2093 		    "GOTCONFIG_REMOTE_REQUEST");
2094 
2095 	return flush_imsg(ibuf);
2096 }
2097 
2098 const struct got_error *
2099 got_privsep_recv_gotconfig_str(char **str, struct imsgbuf *ibuf)
2100 {
2101 	const struct got_error *err = NULL;
2102 	struct imsg imsg;
2103 	size_t datalen;
2104 	const size_t min_datalen = 0;
2105 
2106 	*str = NULL;
2107 
2108 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2109 	if (err)
2110 		return err;
2111 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2112 
2113 	switch (imsg.hdr.type) {
2114 	case GOT_IMSG_ERROR:
2115 		if (datalen < sizeof(struct got_imsg_error)) {
2116 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2117 			break;
2118 		}
2119 		err = recv_imsg_error(&imsg, datalen);
2120 		break;
2121 	case GOT_IMSG_GOTCONFIG_STR_VAL:
2122 		if (datalen == 0)
2123 			break;
2124 		/* datalen does not include terminating \0 */
2125 		*str = malloc(datalen + 1);
2126 		if (*str == NULL) {
2127 			err = got_error_from_errno("malloc");
2128 			break;
2129 		}
2130 		memcpy(*str, imsg.data, datalen);
2131 		(*str)[datalen] = '\0';
2132 		break;
2133 	default:
2134 		err = got_error(GOT_ERR_PRIVSEP_MSG);
2135 		break;
2136 	}
2137 
2138 	imsg_free(&imsg);
2139 	return err;
2140 }
2141 
2142 
2143 const struct got_error *
2144 got_privsep_recv_gotconfig_remotes(struct got_remote_repo **remotes,
2145     int *nremotes, struct imsgbuf *ibuf)
2146 {
2147 	const struct got_error *err = NULL;
2148 	struct imsg imsg;
2149 	size_t datalen;
2150 	struct got_imsg_remotes iremotes;
2151 	struct got_imsg_remote iremote;
2152 	const size_t min_datalen =
2153 	    MIN(sizeof(struct got_imsg_error), sizeof(iremotes));
2154 
2155 	*remotes = NULL;
2156 	*nremotes = 0;
2157 	iremotes.nremotes = 0;
2158 
2159 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2160 	if (err)
2161 		return err;
2162 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2163 
2164 	switch (imsg.hdr.type) {
2165 	case GOT_IMSG_ERROR:
2166 		if (datalen < sizeof(struct got_imsg_error)) {
2167 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2168 			break;
2169 		}
2170 		err = recv_imsg_error(&imsg, datalen);
2171 		break;
2172 	case GOT_IMSG_GOTCONFIG_REMOTES:
2173 		if (datalen != sizeof(iremotes)) {
2174 			err = got_error(GOT_ERR_PRIVSEP_LEN);
2175 			break;
2176 		}
2177 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
2178 		if (iremotes.nremotes == 0) {
2179 			imsg_free(&imsg);
2180 			return NULL;
2181 		}
2182 		break;
2183 	default:
2184 		imsg_free(&imsg);
2185 		return got_error(GOT_ERR_PRIVSEP_MSG);
2186 	}
2187 
2188 	imsg_free(&imsg);
2189 
2190 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(**remotes));
2191 	if (*remotes == NULL)
2192 		return got_error_from_errno("recallocarray");
2193 
2194 	while (*nremotes < iremotes.nremotes) {
2195 		struct got_remote_repo *remote;
2196 		const size_t min_datalen =
2197 		    MIN(sizeof(struct got_imsg_error), sizeof(iremote));
2198 		int i;
2199 
2200 		err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
2201 		if (err)
2202 			break;
2203 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2204 
2205 		switch (imsg.hdr.type) {
2206 		case GOT_IMSG_ERROR:
2207 			if (datalen < sizeof(struct got_imsg_error)) {
2208 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2209 				break;
2210 			}
2211 			err = recv_imsg_error(&imsg, datalen);
2212 			break;
2213 		case GOT_IMSG_GOTCONFIG_REMOTE:
2214 			remote = &(*remotes)[*nremotes];
2215 			memset(remote, 0, sizeof(*remote));
2216 			if (datalen < sizeof(iremote)) {
2217 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2218 				break;
2219 			}
2220 			memcpy(&iremote, imsg.data, sizeof(iremote));
2221 			if (iremote.name_len == 0 || iremote.url_len == 0 ||
2222 			    (sizeof(iremote) + iremote.name_len +
2223 			    iremote.url_len) > datalen) {
2224 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2225 				break;
2226 			}
2227 			remote->name = strndup(imsg.data + sizeof(iremote),
2228 			    iremote.name_len);
2229 			if (remote->name == NULL) {
2230 				err = got_error_from_errno("strndup");
2231 				break;
2232 			}
2233 			remote->url = strndup(imsg.data + sizeof(iremote) +
2234 			    iremote.name_len, iremote.url_len);
2235 			if (remote->url == NULL) {
2236 				err = got_error_from_errno("strndup");
2237 				free_remote_data(remote);
2238 				break;
2239 			}
2240 			remote->mirror_references = iremote.mirror_references;
2241 			remote->fetch_all_branches = iremote.fetch_all_branches;
2242 			if (iremote.nbranches > 0) {
2243 				remote->branches = recallocarray(NULL, 0,
2244 				    iremote.nbranches, sizeof(char *));
2245 				if (remote->branches == NULL) {
2246 					err = got_error_from_errno("calloc");
2247 					free_remote_data(remote);
2248 					break;
2249 				}
2250 			}
2251 			remote->nbranches = 0;
2252 			for (i = 0; i < iremote.nbranches; i++) {
2253 				char *branch;
2254 				err = got_privsep_recv_gotconfig_str(&branch,
2255 				    ibuf);
2256 				if (err) {
2257 					free_remote_data(remote);
2258 					goto done;
2259 				}
2260 				remote->branches[i] = branch;
2261 				remote->nbranches++;
2262 			}
2263 			if (iremote.nrefs > 0) {
2264 				remote->refs = recallocarray(NULL, 0,
2265 				    iremote.nrefs, sizeof(char *));
2266 				if (remote->refs == NULL) {
2267 					err = got_error_from_errno("calloc");
2268 					free_remote_data(remote);
2269 					break;
2270 				}
2271 			}
2272 			remote->nrefs = 0;
2273 			for (i = 0; i < iremote.nrefs; i++) {
2274 				char *ref;
2275 				err = got_privsep_recv_gotconfig_str(&ref,
2276 				    ibuf);
2277 				if (err) {
2278 					free_remote_data(remote);
2279 					goto done;
2280 				}
2281 				remote->refs[i] = ref;
2282 				remote->nrefs++;
2283 			}
2284 			(*nremotes)++;
2285 			break;
2286 		default:
2287 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2288 			break;
2289 		}
2290 
2291 		imsg_free(&imsg);
2292 		if (err)
2293 			break;
2294 	}
2295 done:
2296 	if (err) {
2297 		int i;
2298 		for (i = 0; i < *nremotes; i++)
2299 			free_remote_data(&(*remotes)[i]);
2300 		free(*remotes);
2301 		*remotes = NULL;
2302 		*nremotes = 0;
2303 	}
2304 	return err;
2305 }
2306 
2307 const struct got_error *
2308 got_privsep_send_commit_traversal_request(struct imsgbuf *ibuf,
2309      struct got_object_id *id, int idx, const char *path)
2310 {
2311 	const struct got_error *err = NULL;
2312 	struct ibuf *wbuf;
2313 	size_t path_len = strlen(path) + 1;
2314 
2315 	wbuf = imsg_create(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_REQUEST, 0, 0,
2316 	    sizeof(struct got_imsg_commit_traversal_request) + path_len);
2317 	if (wbuf == NULL)
2318 		return got_error_from_errno(
2319 		    "imsg_create COMMIT_TRAVERSAL_REQUEST");
2320 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
2321 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
2322 		ibuf_free(wbuf);
2323 		return err;
2324 	}
2325 	if (imsg_add(wbuf, &idx, sizeof(idx)) == -1) {
2326 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
2327 		ibuf_free(wbuf);
2328 		return err;
2329 	}
2330 	if (imsg_add(wbuf, path, path_len) == -1) {
2331 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
2332 		ibuf_free(wbuf);
2333 		return err;
2334 	}
2335 
2336 	wbuf->fd = -1;
2337 	imsg_close(ibuf, wbuf);
2338 
2339 	return flush_imsg(ibuf);
2340 }
2341 
2342 const struct got_error *
2343 got_privsep_recv_traversed_commits(struct got_commit_object **changed_commit,
2344     struct got_object_id **changed_commit_id,
2345     struct got_object_id_queue *commit_ids, struct imsgbuf *ibuf)
2346 {
2347 	const struct got_error *err = NULL;
2348 	struct imsg imsg;
2349 	struct got_imsg_traversed_commits *icommits;
2350 	size_t datalen;
2351 	int i, done = 0;
2352 
2353 	*changed_commit = NULL;
2354 	*changed_commit_id = NULL;
2355 
2356 	while (!done) {
2357 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2358 		if (err)
2359 			return err;
2360 
2361 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2362 		switch (imsg.hdr.type) {
2363 		case GOT_IMSG_TRAVERSED_COMMITS:
2364 			icommits = imsg.data;
2365 			if (datalen != sizeof(*icommits) +
2366 			    icommits->ncommits * SHA1_DIGEST_LENGTH) {
2367 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2368 				break;
2369 			}
2370 			for (i = 0; i < icommits->ncommits; i++) {
2371 				struct got_object_qid *qid;
2372 				uint8_t *sha1 = (uint8_t *)imsg.data +
2373 				    sizeof(*icommits) + i * SHA1_DIGEST_LENGTH;
2374 				err = got_object_qid_alloc_partial(&qid);
2375 				if (err)
2376 					break;
2377 				memcpy(qid->id->sha1, sha1, SHA1_DIGEST_LENGTH);
2378 				SIMPLEQ_INSERT_TAIL(commit_ids, qid, entry);
2379 
2380 				/* The last commit may contain a change. */
2381 				if (i == icommits->ncommits - 1) {
2382 					*changed_commit_id =
2383 					    got_object_id_dup(qid->id);
2384 					if (*changed_commit_id == NULL) {
2385 						err = got_error_from_errno(
2386 						    "got_object_id_dup");
2387 						break;
2388 					}
2389 				}
2390 			}
2391 			break;
2392 		case GOT_IMSG_COMMIT:
2393 			if (*changed_commit_id == NULL) {
2394 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2395 				break;
2396 			}
2397 			err = get_commit_from_imsg(changed_commit, &imsg,
2398 			    datalen, ibuf);
2399 			break;
2400 		case GOT_IMSG_COMMIT_TRAVERSAL_DONE:
2401 			done = 1;
2402 			break;
2403 		default:
2404 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2405 			break;
2406 		}
2407 
2408 		imsg_free(&imsg);
2409 		if (err)
2410 			break;
2411 	}
2412 
2413 	if (err)
2414 		got_object_id_queue_free(commit_ids);
2415 	return err;
2416 }
2417 
2418 const struct got_error *
2419 got_privsep_unveil_exec_helpers(void)
2420 {
2421 	const char *helpers[] = {
2422 	    GOT_PATH_PROG_READ_PACK,
2423 	    GOT_PATH_PROG_READ_OBJECT,
2424 	    GOT_PATH_PROG_READ_COMMIT,
2425 	    GOT_PATH_PROG_READ_TREE,
2426 	    GOT_PATH_PROG_READ_BLOB,
2427 	    GOT_PATH_PROG_READ_TAG,
2428 	    GOT_PATH_PROG_READ_GITCONFIG,
2429 	    GOT_PATH_PROG_READ_GOTCONFIG,
2430 	    GOT_PATH_PROG_FETCH_PACK,
2431 	    GOT_PATH_PROG_INDEX_PACK,
2432 	};
2433 	size_t i;
2434 
2435 	for (i = 0; i < nitems(helpers); i++) {
2436 		if (unveil(helpers[i], "x") == 0)
2437 			continue;
2438 		return got_error_from_errno2("unveil", helpers[i]);
2439 	}
2440 
2441 	return NULL;
2442 }
2443 
2444 void
2445 got_privsep_exec_child(int imsg_fds[2], const char *path, const char *repo_path)
2446 {
2447 	if (close(imsg_fds[0]) == -1) {
2448 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2449 		_exit(1);
2450 	}
2451 
2452 	if (dup2(imsg_fds[1], GOT_IMSG_FD_CHILD) == -1) {
2453 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2454 		_exit(1);
2455 	}
2456 	if (closefrom(GOT_IMSG_FD_CHILD + 1) == -1) {
2457 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2458 		_exit(1);
2459 	}
2460 
2461 	if (execl(path, path, repo_path, (char *)NULL) == -1) {
2462 		fprintf(stderr, "%s: %s: %s\n", getprogname(), path,
2463 		    strerror(errno));
2464 		_exit(1);
2465 	}
2466 }