op public repos

Blob

Date:: Wed Mar 18 16:11:32 2020 UTC
Message:: send pack file download progress information over imsg
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018, 2019, 2020 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2020 Ori Bernstein <ori@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/queue.h>
20 #include <sys/uio.h>
21 #include <sys/syslimits.h>
22 #include <sys/wait.h>
23 
24 #include <ctype.h>
25 #include <stdio.h>
26 #include <stdlib.h>
27 #include <string.h>
28 #include <errno.h>
29 #include <stdint.h>
30 #include <poll.h>
31 #include <imsg.h>
32 #include <sha1.h>
33 #include <zlib.h>
34 #include <time.h>
35 
36 #include "got_object.h"
37 #include "got_error.h"
38 #include "got_path.h"
39 #include "got_repository.h"
40 
41 #include "got_lib_sha1.h"
42 #include "got_lib_delta.h"
43 #include "got_lib_inflate.h"
44 #include "got_lib_object.h"
45 #include "got_lib_object_parse.h"
46 #include "got_lib_privsep.h"
47 #include "got_lib_pack.h"
48 
49 #ifndef MIN
50 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
51 #endif
52 
53 #ifndef nitems
54 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
55 #endif
56 
57 static const struct got_error *
58 poll_fd(int fd, int events, int timeout)
59 {
60 	struct pollfd pfd[1];
61 	int n;
62 
63 	pfd[0].fd = fd;
64 	pfd[0].events = events;
65 
66 	n = poll(pfd, 1, timeout);
67 	if (n == -1)
68 		return got_error_from_errno("poll");
69 	if (n == 0)
70 		return got_error(GOT_ERR_TIMEOUT);
71 	if (pfd[0].revents & (POLLERR | POLLNVAL))
72 		return got_error_from_errno("poll error");
73 	if (pfd[0].revents & (events | POLLHUP))
74 		return NULL;
75 
76 	return got_error(GOT_ERR_INTERRUPT);
77 }
78 
79 static const struct got_error *
80 read_imsg(struct imsgbuf *ibuf)
81 {
82 	const struct got_error *err;
83 	size_t n;
84 
85 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
86 	if (err)
87 		return err;
88 
89 	n = imsg_read(ibuf);
90 	if (n == -1) {
91 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
92 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
93 		return got_error(GOT_ERR_PRIVSEP_READ);
94 	}
95 	if (n == 0)
96 		return got_error(GOT_ERR_PRIVSEP_PIPE);
97 
98 	return NULL;
99 }
100 
101 const struct got_error *
102 got_privsep_wait_for_child(pid_t pid)
103 {
104 	int child_status;
105 
106 	if (waitpid(pid, &child_status, 0) == -1)
107 		return got_error_from_errno("waitpid");
108 
109 	if (!WIFEXITED(child_status))
110 		return got_error(GOT_ERR_PRIVSEP_DIED);
111 
112 	if (WEXITSTATUS(child_status) != 0)
113 		return got_error(GOT_ERR_PRIVSEP_EXIT);
114 
115 	return NULL;
116 }
117 
118 static const struct got_error *
119 recv_imsg_error(struct imsg *imsg, size_t datalen)
120 {
121 	struct got_imsg_error *ierr;
122 
123 	if (datalen != sizeof(*ierr))
124 		return got_error(GOT_ERR_PRIVSEP_LEN);
125 
126 	ierr = imsg->data;
127 	if (ierr->code == GOT_ERR_ERRNO) {
128 		static struct got_error serr;
129 		serr.code = GOT_ERR_ERRNO;
130 		serr.msg = strerror(ierr->errno_code);
131 		return &serr;
132 	}
133 
134 	return got_error(ierr->code);
135 }
136 
137 const struct got_error *
138 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
139     size_t min_datalen)
140 {
141 	const struct got_error *err;
142 	ssize_t n;
143 
144 	n = imsg_get(ibuf, imsg);
145 	if (n == -1)
146 		return got_error_from_errno("imsg_get");
147 
148 	while (n == 0) {
149 		err = read_imsg(ibuf);
150 		if (err)
151 			return err;
152 		n = imsg_get(ibuf, imsg);
153 		if (n == -1)
154 			return got_error_from_errno("imsg_get");
155 	}
156 
157 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
158 		return got_error(GOT_ERR_PRIVSEP_LEN);
159 
160 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
161 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
162 		return recv_imsg_error(imsg, datalen);
163 	}
164 
165 	return NULL;
166 }
167 
168 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
169 void
170 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
171 {
172 	const struct got_error *poll_err;
173 	struct got_imsg_error ierr;
174 	int ret;
175 
176 	ierr.code = err->code;
177 	if (err->code == GOT_ERR_ERRNO)
178 		ierr.errno_code = errno;
179 	else
180 		ierr.errno_code = 0;
181 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
182 	if (ret == -1) {
183 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
184 		    getprogname(), err->code, err->msg, strerror(errno));
185 		return;
186 	}
187 
188 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
189 	if (poll_err) {
190 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
191 		    getprogname(), err->code, err->msg, poll_err->msg);
192 		return;
193 	}
194 
195 	ret = imsg_flush(ibuf);
196 	if (ret == -1) {
197 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
198 		    getprogname(), err->code, err->msg, strerror(errno));
199 		return;
200 	}
201 }
202 
203 static const struct got_error *
204 flush_imsg(struct imsgbuf *ibuf)
205 {
206 	const struct got_error *err;
207 
208 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
209 	if (err)
210 		return err;
211 
212 	if (imsg_flush(ibuf) == -1)
213 		return got_error_from_errno("imsg_flush");
214 
215 	return NULL;
216 }
217 
218 const struct got_error *
219 got_privsep_send_stop(int fd)
220 {
221 	const struct got_error *err = NULL;
222 	struct imsgbuf ibuf;
223 
224 	imsg_init(&ibuf, fd);
225 
226 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
227 		return got_error_from_errno("imsg_compose STOP");
228 
229 	err = flush_imsg(&ibuf);
230 	imsg_clear(&ibuf);
231 	return err;
232 }
233 
234 const struct got_error *
235 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd)
236 {
237 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd, NULL, 0)
238 	    == -1)
239 		return got_error_from_errno("imsg_compose OBJECT_REQUEST");
240 
241 	return flush_imsg(ibuf);
242 }
243 
244 const struct got_error *
245 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
246     struct got_object_id *id, int pack_idx)
247 {
248 	const struct got_error *err = NULL;
249 	struct got_imsg_packed_object iobj, *iobjp;
250 	size_t len;
251 
252 	if (id) { /* commit is packed */
253 		iobj.idx = pack_idx;
254 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
255 		iobjp = &iobj;
256 		len = sizeof(iobj);
257 	} else {
258 		iobjp = NULL;
259 		len = 0;
260 	}
261 
262 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, iobjp, len)
263 	    == -1) {
264 		err = got_error_from_errno("imsg_compose COMMIT_REQUEST");
265 		close(fd);
266 		return err;
267 	}
268 
269 	return flush_imsg(ibuf);
270 }
271 
272 const struct got_error *
273 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
274     struct got_object_id *id, int pack_idx)
275 {
276 	const struct got_error *err = NULL;
277 	struct ibuf *wbuf;
278 	size_t len = id ? sizeof(struct got_imsg_packed_object) : 0;
279 
280 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, len);
281 	if (wbuf == NULL)
282 		return got_error_from_errno("imsg_create TREE_REQUEST");
283 
284 	if (id) { /* tree is packed */
285 		if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
286 			err = got_error_from_errno("imsg_add TREE_ENTRY");
287 			ibuf_free(wbuf);
288 			return err;
289 		}
290 
291 		if (imsg_add(wbuf, &pack_idx, sizeof(pack_idx)) == -1) {
292 			err = got_error_from_errno("imsg_add TREE_ENTRY");
293 			ibuf_free(wbuf);
294 			return err;
295 		}
296 	}
297 
298 	wbuf->fd = fd;
299 	imsg_close(ibuf, wbuf);
300 
301 	return flush_imsg(ibuf);
302 }
303 
304 const struct got_error *
305 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
306     struct got_object_id *id, int pack_idx)
307 {
308 	struct got_imsg_packed_object iobj, *iobjp;
309 	size_t len;
310 
311 	if (id) { /* tag is packed */
312 		iobj.idx = pack_idx;
313 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
314 		iobjp = &iobj;
315 		len = sizeof(iobj);
316 	} else {
317 		iobjp = NULL;
318 		len = 0;
319 	}
320 
321 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, iobjp, len)
322 	    == -1)
323 		return got_error_from_errno("imsg_compose TAG_REQUEST");
324 
325 	return flush_imsg(ibuf);
326 }
327 
328 const struct got_error *
329 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
330     struct got_object_id *id, int pack_idx)
331 {
332 	const struct got_error *err = NULL;
333 	struct got_imsg_packed_object iobj, *iobjp;
334 	size_t len;
335 
336 	if (id) { /* blob is packed */
337 		iobj.idx = pack_idx;
338 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
339 		iobjp = &iobj;
340 		len = sizeof(iobj);
341 	} else {
342 		iobjp = NULL;
343 		len = 0;
344 	}
345 
346 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, iobjp, len)
347 	    == -1) {
348 		err = got_error_from_errno("imsg_compose BLOB_REQUEST");
349 		close(infd);
350 		return err;
351 	}
352 
353 	return flush_imsg(ibuf);
354 }
355 
356 const struct got_error *
357 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
358 {
359 	const struct got_error *err = NULL;
360 
361 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
362 	    == -1) {
363 		err = got_error_from_errno("imsg_compose BLOB_OUTFD");
364 		close(outfd);
365 		return err;
366 	}
367 
368 	return flush_imsg(ibuf);
369 }
370 
371 const struct got_error *
372 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
373 {
374 	const struct got_error *err = NULL;
375 
376 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
377 	    == -1) {
378 		err = got_error_from_errno("imsg_compose TMPFD");
379 		close(fd);
380 		return err;
381 	}
382 
383 	return flush_imsg(ibuf);
384 }
385 
386 const struct got_error *
387 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
388 {
389 	struct got_imsg_object iobj;
390 
391 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
392 	iobj.type = obj->type;
393 	iobj.flags = obj->flags;
394 	iobj.hdrlen = obj->hdrlen;
395 	iobj.size = obj->size;
396 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
397 		iobj.pack_offset = obj->pack_offset;
398 		iobj.pack_idx = obj->pack_idx;
399 	}
400 
401 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
402 	    == -1)
403 		return got_error_from_errno("imsg_compose OBJECT");
404 
405 	return flush_imsg(ibuf);
406 }
407 
408 const struct got_error *
409 got_privsep_send_fetch_req(struct imsgbuf *ibuf, int fd,
410    struct got_pathlist_head *have_refs)
411 {
412 	const struct got_error *err = NULL;
413 	struct ibuf *wbuf;
414 	size_t len, n_have_refs = 0;
415 	struct got_pathlist_entry *pe;
416 
417 	len = sizeof(struct got_imsg_fetch_symrefs);
418 	TAILQ_FOREACH(pe, have_refs, entry) {
419 		struct got_object_id *id = pe->data;
420 		len += sizeof(struct got_imsg_fetch_have_ref) +
421 		    pe->path_len + sizeof(id->sha1);
422 		n_have_refs++;
423 	}
424 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
425 		close(fd);
426 		return got_error(GOT_ERR_NO_SPACE);
427 	}
428 
429 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_REQUEST, 0, 0, len);
430 	if (wbuf == NULL) {
431 		close(fd);
432 		return got_error_from_errno("imsg_create FETCH_REQUEST");
433 	}
434 
435 	/* Keep in sync with struct got_imsg_fetch_have_refs definition! */
436 	if (imsg_add(wbuf, &n_have_refs, sizeof(n_have_refs)) == -1) {
437 		err = got_error_from_errno("imsg_add FETCH_REQUEST");
438 		ibuf_free(wbuf);
439 		close(fd);
440 		return err;
441 	}
442 
443 	TAILQ_FOREACH(pe, have_refs, entry) {
444 		const char *name = pe->path;
445 		size_t name_len = pe->path_len;
446 		struct got_object_id *id = pe->data;
447 
448 		/* Keep in sync with struct got_imsg_fetch_have_ref! */
449 		if (imsg_add(wbuf, id->sha1, sizeof(id->sha1)) == -1) {
450 			err = got_error_from_errno("imsg_add FETCH_REQUEST");
451 			ibuf_free(wbuf);
452 			close(fd);
453 			return err;
454 		}
455 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1) {
456 			err = got_error_from_errno("imsg_add FETCH_REQUEST");
457 			ibuf_free(wbuf);
458 			close(fd);
459 			return err;
460 		}
461 		if (imsg_add(wbuf, name, name_len) == -1) {
462 			err = got_error_from_errno("imsg_add FETCH_REQUEST");
463 			ibuf_free(wbuf);
464 			close(fd);
465 			return err;
466 		}
467 	}
468 
469 	wbuf->fd = fd;
470 	imsg_close(ibuf, wbuf);
471 	return flush_imsg(ibuf);
472 }
473 
474 const struct got_error *
475 got_privsep_send_fetch_symrefs(struct imsgbuf *ibuf,
476     struct got_pathlist_head *symrefs)
477 {
478 	const struct got_error *err = NULL;
479 	struct ibuf *wbuf;
480 	size_t len, nsymrefs = 0;
481 	struct got_pathlist_entry *pe;
482 
483 	len = sizeof(struct got_imsg_fetch_symrefs);
484 	TAILQ_FOREACH(pe, symrefs, entry) {
485 		const char *target = pe->data;
486 		len += sizeof(struct got_imsg_fetch_symref) +
487 		    pe->path_len + strlen(target);
488 		nsymrefs++;
489 	}
490 
491 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
492 		return got_error(GOT_ERR_NO_SPACE);
493 
494 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_SYMREFS, 0, 0, len);
495 	if (wbuf == NULL)
496 		return got_error_from_errno("imsg_create FETCH_SYMREFS");
497 
498 	/* Keep in sync with struct got_imsg_fetch_symrefs definition! */
499 	if (imsg_add(wbuf, &nsymrefs, sizeof(nsymrefs)) == -1) {
500 		err = got_error_from_errno("imsg_add FETCH_SYMREFS");
501 		ibuf_free(wbuf);
502 		return err;
503 	}
504 
505 	TAILQ_FOREACH(pe, symrefs, entry) {
506 		const char *name = pe->path;
507 		size_t name_len = pe->path_len;
508 		const char *target = pe->data;
509 		size_t target_len = strlen(target);
510 
511 		/* Keep in sync with struct got_imsg_fetch_symref definition! */
512 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1) {
513 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
514 			ibuf_free(wbuf);
515 			return err;
516 		}
517 		if (imsg_add(wbuf, &target_len, sizeof(target_len)) == -1) {
518 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
519 			ibuf_free(wbuf);
520 			return err;
521 		}
522 		if (imsg_add(wbuf, name, name_len) == -1) {
523 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
524 			ibuf_free(wbuf);
525 			return err;
526 		}
527 		if (imsg_add(wbuf, target, target_len) == -1) {
528 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
529 			ibuf_free(wbuf);
530 			return err;
531 		}
532 	}
533 
534 	wbuf->fd = -1;
535 	imsg_close(ibuf, wbuf);
536 	return flush_imsg(ibuf);
537 }
538 
539 const struct got_error *
540 got_privsep_send_fetch_ref(struct imsgbuf *ibuf,
541     struct got_object_id *refid, const char *refname)
542 {
543 	const struct got_error *err = NULL;
544 	struct ibuf *wbuf;
545 	size_t len, reflen = strlen(refname);
546 
547 	len = sizeof(struct got_imsg_fetch_ref) + reflen;
548 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
549 		return got_error(GOT_ERR_NO_SPACE);
550 
551 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_REF, 0, 0, len);
552 	if (wbuf == NULL)
553 		return got_error_from_errno("imsg_create FETCH_REF");
554 
555 	/* Keep in sync with struct got_imsg_fetch_ref definition! */
556 	if (imsg_add(wbuf, refid->sha1, SHA1_DIGEST_LENGTH) == -1) {
557 		err = got_error_from_errno("imsg_add FETCH_REF");
558 		ibuf_free(wbuf);
559 		return err;
560 	}
561 	if (imsg_add(wbuf, refname, reflen) == -1) {
562 		err = got_error_from_errno("imsg_add FETCH_REF");
563 		ibuf_free(wbuf);
564 		return err;
565 	}
566 
567 	wbuf->fd = -1;
568 	imsg_close(ibuf, wbuf);
569 	return flush_imsg(ibuf);
570 }
571 
572 const struct got_error *
573 got_privsep_send_fetch_server_progress(struct imsgbuf *ibuf, const char *msg,
574     size_t msglen)
575 {
576 	if (msglen > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
577 		return got_error(GOT_ERR_NO_SPACE);
578 
579 	if (msglen == 0)
580 		return NULL;
581 
582 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_SERVER_PROGRESS, 0, 0, -1,
583 	    msg, msglen) == -1)
584 		return got_error_from_errno(
585 		    "imsg_compose FETCH_SERVER_PROGRESS");
586 
587 	return flush_imsg(ibuf);
588 }
589 
590 const struct got_error *
591 got_privsep_send_fetch_download_progress(struct imsgbuf *ibuf, off_t bytes)
592 {
593 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DOWNLOAD_PROGRESS, 0, 0, -1,
594 	    &bytes, sizeof(bytes)) == -1)
595 		return got_error_from_errno(
596 		    "imsg_compose FETCH_DOWNLOAD_PROGRESS");
597 
598 	return flush_imsg(ibuf);
599 }
600 
601 const struct got_error *
602 got_privsep_send_fetch_done(struct imsgbuf *ibuf, struct got_object_id hash)
603 {
604 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DONE, 0, 0, -1,
605 	    hash.sha1, SHA1_DIGEST_LENGTH) == -1)
606 		return got_error_from_errno("imsg_compose FETCH");
607 	return flush_imsg(ibuf);
608 }
609 
610 
611 const struct got_error *
612 got_privsep_recv_fetch_progress(int *done, struct got_object_id **id,
613     char **refname, struct got_pathlist_head *symrefs, char **server_progress,
614     off_t *packfile_size, struct imsgbuf *ibuf)
615 {
616 	const struct got_error *err = NULL;
617 	struct imsg imsg;
618 	size_t datalen;
619 	struct got_imsg_fetch_symrefs *isymrefs = NULL;
620 	size_t n, remain;
621 	off_t off;
622 	int i;
623 
624 	*done = 0;
625 	*id = NULL;
626 	*refname = NULL;
627 	*server_progress = NULL;
628 
629 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
630 	if (err)
631 		return err;
632 
633 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
634 	switch (imsg.hdr.type) {
635 	case GOT_IMSG_ERROR:
636 		if (datalen < sizeof(struct got_imsg_error)) {
637 			err = got_error(GOT_ERR_PRIVSEP_LEN);
638 			break;
639 		}
640 		err = recv_imsg_error(&imsg, datalen);
641 		break;
642 	case GOT_IMSG_FETCH_SYMREFS:
643 		if (datalen < sizeof(*isymrefs)) {
644 			err = got_error(GOT_ERR_PRIVSEP_LEN);
645 			break;
646 		}
647 		if (isymrefs != NULL) {
648 			err = got_error(GOT_ERR_PRIVSEP_MSG);
649 			break;
650 		}
651 		isymrefs = (struct got_imsg_fetch_symrefs *)imsg.data;
652 		off = sizeof(*isymrefs);
653 		remain = datalen - off;
654 		for (n = 0; n < isymrefs->nsymrefs; n++) {
655 			struct got_imsg_fetch_symref *s;
656 			char *name, *target;
657 			if (remain < sizeof(struct got_imsg_fetch_symref)) {
658 				err = got_error(GOT_ERR_PRIVSEP_LEN);
659 				goto done;
660 			}
661 			s = (struct got_imsg_fetch_symref *)(imsg.data + off);
662 			off += sizeof(*s);
663 			remain -= sizeof(*s);
664 			if (remain < s->name_len) {
665 				err = got_error(GOT_ERR_PRIVSEP_LEN);
666 				goto done;
667 			}
668 			name = strndup(imsg.data + off, s->name_len);
669 			if (name == NULL) {
670 				err = got_error_from_errno("strndup");
671 				goto done;
672 			}
673 			off += s->name_len;
674 			remain -= s->name_len;
675 			if (remain < s->target_len) {
676 				err = got_error(GOT_ERR_PRIVSEP_LEN);
677 				free(name);
678 				goto done;
679 			}
680 			target = strndup(imsg.data + off, s->target_len);
681 			if (target == NULL) {
682 				err = got_error_from_errno("strndup");
683 				free(name);
684 				goto done;
685 			}
686 			off += s->target_len;
687 			remain -= s->target_len;
688 			err = got_pathlist_append(symrefs, name, target);
689 			if (err) {
690 				free(name);
691 				free(target);
692 				goto done;
693 			}
694 		}
695 		break;
696 	case GOT_IMSG_FETCH_REF:
697 		if (datalen <= SHA1_DIGEST_LENGTH) {
698 			err = got_error(GOT_ERR_PRIVSEP_MSG);
699 			break;
700 		}
701 		*id = malloc(sizeof(**id));
702 		if (*id == NULL) {
703 			err = got_error_from_errno("malloc");
704 			break;
705 		}
706 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
707 		*refname = strndup(imsg.data + SHA1_DIGEST_LENGTH,
708 		    datalen - SHA1_DIGEST_LENGTH);
709 		if (*refname == NULL) {
710 			err = got_error_from_errno("strndup");
711 			break;
712 		}
713 		break;
714 	case GOT_IMSG_FETCH_SERVER_PROGRESS:
715 		if (datalen == 0) {
716 			err = got_error(GOT_ERR_PRIVSEP_LEN);
717 			break;
718 		}
719 		*server_progress = strndup(imsg.data, datalen);
720 		if (*server_progress == NULL) {
721 			err = got_error_from_errno("strndup");
722 			break;
723 		}
724 		for (i = 0; i < datalen; i++) {
725 			if (!isprint((unsigned char)(*server_progress)[i]) &&
726 			    !isspace((unsigned char)(*server_progress)[i])) {
727 				err = got_error(GOT_ERR_PRIVSEP_MSG);
728 				free(*server_progress);
729 				*server_progress = NULL;
730 				goto done;
731 			}
732 		}
733 		break;
734 	case GOT_IMSG_FETCH_DOWNLOAD_PROGRESS:
735 		if (datalen < sizeof(*packfile_size)) {
736 			err = got_error(GOT_ERR_PRIVSEP_MSG);
737 			break;
738 		}
739 		memcpy(packfile_size, imsg.data, sizeof(*packfile_size));
740 		break;
741 	case GOT_IMSG_FETCH_DONE:
742 		*id = malloc(sizeof(**id));
743 		if (*id == NULL) {
744 			err = got_error_from_errno("malloc");
745 			break;
746 		}
747 		if (datalen != SHA1_DIGEST_LENGTH) {
748 			err = got_error(GOT_ERR_PRIVSEP_MSG);
749 			break;
750 		}
751 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
752 		*done = 1;
753 		break;
754 	default:
755 		err = got_error(GOT_ERR_PRIVSEP_MSG);
756 		break;
757 	}
758 done:
759 	if (err) {
760 		free(*id);
761 		*id = NULL;
762 		free(*refname);
763 		*refname = NULL;
764 	}
765 	imsg_free(&imsg);
766 	return err;
767 }
768 
769 const struct got_error *
770 got_privsep_send_index_pack_req(struct imsgbuf *ibuf, int fd, struct got_object_id *hash)
771 {
772 	const struct got_error *err = NULL;
773 
774 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_REQUEST, 0, 0, fd,
775 	    hash->sha1, SHA1_DIGEST_LENGTH) == -1) {
776 		err = got_error_from_errno("imsg_compose INDEX_REQUEST");
777 		close(fd);
778 		return err;
779 	}
780 	return flush_imsg(ibuf);
781 }
782 
783 const struct got_error *
784 got_privsep_send_index_pack_done(struct imsgbuf *ibuf)
785 {
786 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_DONE, 0, 0, -1, NULL, 0) == -1)
787 		return got_error_from_errno("imsg_compose FETCH");
788 	return flush_imsg(ibuf);
789 }
790 
791 const struct got_error *
792 got_privsep_wait_index_pack_done(struct imsgbuf *ibuf)
793 {
794 	const struct got_error *err = NULL;
795 	struct imsg imsg;
796 
797 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
798 	if (err)
799 		return err;
800 	if (imsg.hdr.type == GOT_IMSG_IDXPACK_DONE)
801 		return NULL;
802 	else
803 		return got_error(GOT_ERR_PRIVSEP_MSG);
804 	imsg_free(&imsg);
805 }
806 
807 const struct got_error *
808 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
809     struct imsgbuf *ibuf)
810 {
811 	const struct got_error *err = NULL;
812 	struct got_imsg_object *iobj;
813 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
814 
815 	if (datalen != sizeof(*iobj))
816 		return got_error(GOT_ERR_PRIVSEP_LEN);
817 	iobj = imsg->data;
818 
819 	*obj = calloc(1, sizeof(**obj));
820 	if (*obj == NULL)
821 		return got_error_from_errno("calloc");
822 
823 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
824 	(*obj)->type = iobj->type;
825 	(*obj)->flags = iobj->flags;
826 	(*obj)->hdrlen = iobj->hdrlen;
827 	(*obj)->size = iobj->size;
828 	/* path_packfile is handled by caller */
829 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
830 		(*obj)->pack_offset = iobj->pack_offset;
831 		(*obj)->pack_idx = iobj->pack_idx;
832 	}
833 
834 	return err;
835 }
836 
837 const struct got_error *
838 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
839 {
840 	const struct got_error *err = NULL;
841 	struct imsg imsg;
842 	const size_t min_datalen =
843 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
844 
845 	*obj = NULL;
846 
847 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
848 	if (err)
849 		return err;
850 
851 	switch (imsg.hdr.type) {
852 	case GOT_IMSG_OBJECT:
853 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
854 		break;
855 	default:
856 		err = got_error(GOT_ERR_PRIVSEP_MSG);
857 		break;
858 	}
859 
860 	imsg_free(&imsg);
861 
862 	return err;
863 }
864 
865 static const struct got_error *
866 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
867     size_t logmsg_len)
868 {
869 	const struct got_error *err = NULL;
870 	size_t offset, remain;
871 
872 	offset = 0;
873 	remain = logmsg_len;
874 	while (remain > 0) {
875 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
876 
877 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
878 		    commit->logmsg + offset, n) == -1) {
879 			err = got_error_from_errno("imsg_compose "
880 			    "COMMIT_LOGMSG");
881 			break;
882 		}
883 
884 		err = flush_imsg(ibuf);
885 		if (err)
886 			break;
887 
888 		offset += n;
889 		remain -= n;
890 	}
891 
892 	return err;
893 }
894 
895 const struct got_error *
896 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
897 {
898 	const struct got_error *err = NULL;
899 	struct got_imsg_commit_object *icommit;
900 	uint8_t *buf;
901 	size_t len, total;
902 	struct got_object_qid *qid;
903 	size_t author_len = strlen(commit->author);
904 	size_t committer_len = strlen(commit->committer);
905 	size_t logmsg_len = strlen(commit->logmsg);
906 
907 	total = sizeof(*icommit) + author_len + committer_len +
908 	    commit->nparents * SHA1_DIGEST_LENGTH;
909 
910 	buf = malloc(total);
911 	if (buf == NULL)
912 		return got_error_from_errno("malloc");
913 
914 	icommit = (struct got_imsg_commit_object *)buf;
915 	memcpy(icommit->tree_id, commit->tree_id->sha1,
916 	    sizeof(icommit->tree_id));
917 	icommit->author_len = author_len;
918 	icommit->author_time = commit->author_time;
919 	icommit->author_gmtoff = commit->author_gmtoff;
920 	icommit->committer_len = committer_len;
921 	icommit->committer_time = commit->committer_time;
922 	icommit->committer_gmtoff = commit->committer_gmtoff;
923 	icommit->logmsg_len = logmsg_len;
924 	icommit->nparents = commit->nparents;
925 
926 	len = sizeof(*icommit);
927 	memcpy(buf + len, commit->author, author_len);
928 	len += author_len;
929 	memcpy(buf + len, commit->committer, committer_len);
930 	len += committer_len;
931 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
932 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
933 		len += SHA1_DIGEST_LENGTH;
934 	}
935 
936 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
937 		err = got_error_from_errno("imsg_compose COMMIT");
938 		goto done;
939 	}
940 
941 	if (logmsg_len == 0 ||
942 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
943 		err = flush_imsg(ibuf);
944 		if (err)
945 			goto done;
946 	}
947 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
948 done:
949 	free(buf);
950 	return err;
951 }
952 
953 static const struct got_error *
954 get_commit_from_imsg(struct got_commit_object **commit,
955     struct imsg *imsg, size_t datalen, struct imsgbuf *ibuf)
956 {
957 	const struct got_error *err = NULL;
958 	struct got_imsg_commit_object *icommit;
959 	size_t len = 0;
960 	int i;
961 
962 	if (datalen < sizeof(*icommit))
963 		return got_error(GOT_ERR_PRIVSEP_LEN);
964 
965 	icommit = imsg->data;
966 	if (datalen != sizeof(*icommit) + icommit->author_len +
967 	    icommit->committer_len +
968 	    icommit->nparents * SHA1_DIGEST_LENGTH)
969 		return got_error(GOT_ERR_PRIVSEP_LEN);
970 
971 	if (icommit->nparents < 0)
972 		return got_error(GOT_ERR_PRIVSEP_LEN);
973 
974 	len += sizeof(*icommit);
975 
976 	*commit = got_object_commit_alloc_partial();
977 	if (*commit == NULL)
978 		return got_error_from_errno(
979 		    "got_object_commit_alloc_partial");
980 
981 	memcpy((*commit)->tree_id->sha1, icommit->tree_id,
982 	    SHA1_DIGEST_LENGTH);
983 	(*commit)->author_time = icommit->author_time;
984 	(*commit)->author_gmtoff = icommit->author_gmtoff;
985 	(*commit)->committer_time = icommit->committer_time;
986 	(*commit)->committer_gmtoff = icommit->committer_gmtoff;
987 
988 	if (icommit->author_len == 0) {
989 		(*commit)->author = strdup("");
990 		if ((*commit)->author == NULL) {
991 			err = got_error_from_errno("strdup");
992 			goto done;
993 		}
994 	} else {
995 		(*commit)->author = malloc(icommit->author_len + 1);
996 		if ((*commit)->author == NULL) {
997 			err = got_error_from_errno("malloc");
998 			goto done;
999 		}
1000 		memcpy((*commit)->author, imsg->data + len,
1001 		    icommit->author_len);
1002 		(*commit)->author[icommit->author_len] = '\0';
1003 	}
1004 	len += icommit->author_len;
1005 
1006 	if (icommit->committer_len == 0) {
1007 		(*commit)->committer = strdup("");
1008 		if ((*commit)->committer == NULL) {
1009 			err = got_error_from_errno("strdup");
1010 			goto done;
1011 		}
1012 	} else {
1013 		(*commit)->committer =
1014 		    malloc(icommit->committer_len + 1);
1015 		if ((*commit)->committer == NULL) {
1016 			err = got_error_from_errno("malloc");
1017 			goto done;
1018 		}
1019 		memcpy((*commit)->committer, imsg->data + len,
1020 		    icommit->committer_len);
1021 		(*commit)->committer[icommit->committer_len] = '\0';
1022 	}
1023 	len += icommit->committer_len;
1024 
1025 	if (icommit->logmsg_len == 0) {
1026 		(*commit)->logmsg = strdup("");
1027 		if ((*commit)->logmsg == NULL) {
1028 			err = got_error_from_errno("strdup");
1029 			goto done;
1030 		}
1031 	} else {
1032 		size_t offset = 0, remain = icommit->logmsg_len;
1033 
1034 		(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
1035 		if ((*commit)->logmsg == NULL) {
1036 			err = got_error_from_errno("malloc");
1037 			goto done;
1038 		}
1039 		while (remain > 0) {
1040 			struct imsg imsg_log;
1041 			size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1042 			    remain);
1043 
1044 			err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1045 			if (err)
1046 				goto done;
1047 
1048 			if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG) {
1049 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1050 				goto done;
1051 			}
1052 
1053 			memcpy((*commit)->logmsg + offset,
1054 			    imsg_log.data, n);
1055 			imsg_free(&imsg_log);
1056 			offset += n;
1057 			remain -= n;
1058 		}
1059 		(*commit)->logmsg[icommit->logmsg_len] = '\0';
1060 	}
1061 
1062 	for (i = 0; i < icommit->nparents; i++) {
1063 		struct got_object_qid *qid;
1064 
1065 		err = got_object_qid_alloc_partial(&qid);
1066 		if (err)
1067 			break;
1068 		memcpy(qid->id, imsg->data + len +
1069 		    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
1070 		SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
1071 		(*commit)->nparents++;
1072 	}
1073 done:
1074 	if (err) {
1075 		got_object_commit_close(*commit);
1076 		*commit = NULL;
1077 	}
1078 	return err;
1079 }
1080 
1081 const struct got_error *
1082 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
1083 {
1084 	const struct got_error *err = NULL;
1085 	struct imsg imsg;
1086 	size_t datalen;
1087 	const size_t min_datalen =
1088 	    MIN(sizeof(struct got_imsg_error),
1089 	    sizeof(struct got_imsg_commit_object));
1090 
1091 	*commit = NULL;
1092 
1093 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1094 	if (err)
1095 		return err;
1096 
1097 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1098 
1099 	switch (imsg.hdr.type) {
1100 	case GOT_IMSG_COMMIT:
1101 		err = get_commit_from_imsg(commit, &imsg, datalen, ibuf);
1102 		break;
1103 	default:
1104 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1105 		break;
1106 	}
1107 
1108 	imsg_free(&imsg);
1109 
1110 	return err;
1111 }
1112 
1113 const struct got_error *
1114 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_pathlist_head *entries,
1115     int nentries)
1116 {
1117 	const struct got_error *err = NULL;
1118 	struct got_imsg_tree_object itree;
1119 	struct got_pathlist_entry *pe;
1120 	size_t totlen;
1121 	int nimsg; /* number of imsg queued in ibuf */
1122 
1123 	itree.nentries = nentries;
1124 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
1125 	    == -1)
1126 		return got_error_from_errno("imsg_compose TREE");
1127 
1128 	totlen = sizeof(itree);
1129 	nimsg = 1;
1130 	TAILQ_FOREACH(pe, entries, entry) {
1131 		const char *name = pe->path;
1132 		struct got_parsed_tree_entry *pte = pe->data;
1133 		struct ibuf *wbuf;
1134 		size_t namelen = strlen(name);
1135 		size_t len = sizeof(struct got_imsg_tree_entry) + namelen;
1136 
1137 		if (len > MAX_IMSGSIZE)
1138 			return got_error(GOT_ERR_NO_SPACE);
1139 
1140 		nimsg++;
1141 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
1142 			err = flush_imsg(ibuf);
1143 			if (err)
1144 				return err;
1145 			nimsg = 0;
1146 		}
1147 
1148 		wbuf = imsg_create(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, len);
1149 		if (wbuf == NULL)
1150 			return got_error_from_errno("imsg_create TREE_ENTRY");
1151 
1152 		/* Keep in sync with struct got_imsg_tree_object definition! */
1153 		if (imsg_add(wbuf, pte->id, SHA1_DIGEST_LENGTH) == -1) {
1154 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1155 			ibuf_free(wbuf);
1156 			return err;
1157 		}
1158 		if (imsg_add(wbuf, &pte->mode, sizeof(pte->mode)) == -1) {
1159 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1160 			ibuf_free(wbuf);
1161 			return err;
1162 		}
1163 
1164 		if (imsg_add(wbuf, name, namelen) == -1) {
1165 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1166 			ibuf_free(wbuf);
1167 			return err;
1168 		}
1169 
1170 		wbuf->fd = -1;
1171 		imsg_close(ibuf, wbuf);
1172 
1173 		totlen += len;
1174 	}
1175 
1176 	return flush_imsg(ibuf);
1177 }
1178 
1179 const struct got_error *
1180 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
1181 {
1182 	const struct got_error *err = NULL;
1183 	const size_t min_datalen =
1184 	    MIN(sizeof(struct got_imsg_error),
1185 	    sizeof(struct got_imsg_tree_object));
1186 	struct got_imsg_tree_object *itree;
1187 	int nentries = 0;
1188 
1189 	*tree = NULL;
1190 get_more:
1191 	err = read_imsg(ibuf);
1192 	if (err)
1193 		goto done;
1194 
1195 	for (;;) {
1196 		struct imsg imsg;
1197 		size_t n;
1198 		size_t datalen;
1199 		struct got_imsg_tree_entry *ite;
1200 		struct got_tree_entry *te = NULL;
1201 
1202 		n = imsg_get(ibuf, &imsg);
1203 		if (n == 0) {
1204 			if (*tree && (*tree)->nentries != nentries)
1205 				goto get_more;
1206 			break;
1207 		}
1208 
1209 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
1210 			return got_error(GOT_ERR_PRIVSEP_LEN);
1211 
1212 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1213 
1214 		switch (imsg.hdr.type) {
1215 		case GOT_IMSG_ERROR:
1216 			err = recv_imsg_error(&imsg, datalen);
1217 			break;
1218 		case GOT_IMSG_TREE:
1219 			/* This message should only appear once. */
1220 			if (*tree != NULL) {
1221 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1222 				break;
1223 			}
1224 			if (datalen != sizeof(*itree)) {
1225 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1226 				break;
1227 			}
1228 			itree = imsg.data;
1229 			*tree = malloc(sizeof(**tree));
1230 			if (*tree == NULL) {
1231 				err = got_error_from_errno("malloc");
1232 				break;
1233 			}
1234 			(*tree)->entries = calloc(itree->nentries,
1235 			    sizeof(struct got_tree_entry));
1236 			if ((*tree)->entries == NULL) {
1237 				err = got_error_from_errno("malloc");
1238 				break;
1239 			}
1240 			(*tree)->nentries = itree->nentries;
1241 			(*tree)->refcnt = 0;
1242 			break;
1243 		case GOT_IMSG_TREE_ENTRY:
1244 			/* This message should be preceeded by GOT_IMSG_TREE. */
1245 			if (*tree == NULL) {
1246 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1247 				break;
1248 			}
1249 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
1250 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1251 				break;
1252 			}
1253 
1254 			/* Remaining data contains the entry's name. */
1255 			datalen -= sizeof(*ite);
1256 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
1257 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1258 				break;
1259 			}
1260 			ite = imsg.data;
1261 
1262 			if (datalen + 1 > sizeof(te->name)) {
1263 				err = got_error(GOT_ERR_NO_SPACE);
1264 				break;
1265 			}
1266 			te = &(*tree)->entries[nentries];
1267 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
1268 			te->name[datalen] = '\0';
1269 
1270 			memcpy(te->id.sha1, ite->id, SHA1_DIGEST_LENGTH);
1271 			te->mode = ite->mode;
1272 			te->idx = nentries;
1273 			nentries++;
1274 			break;
1275 		default:
1276 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1277 			break;
1278 		}
1279 
1280 		imsg_free(&imsg);
1281 	}
1282 done:
1283 	if (*tree && (*tree)->nentries != nentries) {
1284 		if (err == NULL)
1285 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1286 		got_object_tree_close(*tree);
1287 		*tree = NULL;
1288 	}
1289 
1290 	return err;
1291 }
1292 
1293 const struct got_error *
1294 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
1295     const uint8_t *data)
1296 {
1297 	struct got_imsg_blob iblob;
1298 
1299 	iblob.size = size;
1300 	iblob.hdrlen = hdrlen;
1301 
1302 	if (data) {
1303 		uint8_t *buf;
1304 
1305 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
1306 			return got_error(GOT_ERR_NO_SPACE);
1307 
1308 		buf = malloc(sizeof(iblob) + size);
1309 		if (buf == NULL)
1310 			return got_error_from_errno("malloc");
1311 
1312 		memcpy(buf, &iblob, sizeof(iblob));
1313 		memcpy(buf + sizeof(iblob), data, size);
1314 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
1315 		   sizeof(iblob) + size) == -1) {
1316 			free(buf);
1317 			return got_error_from_errno("imsg_compose BLOB");
1318 		}
1319 		free(buf);
1320 	} else {
1321 		/* Data has already been written to file descriptor. */
1322 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
1323 		    sizeof(iblob)) == -1)
1324 			return got_error_from_errno("imsg_compose BLOB");
1325 	}
1326 
1327 
1328 	return flush_imsg(ibuf);
1329 }
1330 
1331 const struct got_error *
1332 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
1333     struct imsgbuf *ibuf)
1334 {
1335 	const struct got_error *err = NULL;
1336 	struct imsg imsg;
1337 	struct got_imsg_blob *iblob;
1338 	size_t datalen;
1339 
1340 	*outbuf = NULL;
1341 
1342 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1343 	if (err)
1344 		return err;
1345 
1346 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1347 
1348 	switch (imsg.hdr.type) {
1349 	case GOT_IMSG_BLOB:
1350 		if (datalen < sizeof(*iblob)) {
1351 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1352 			break;
1353 		}
1354 		iblob = imsg.data;
1355 		*size = iblob->size;
1356 		*hdrlen = iblob->hdrlen;
1357 
1358 		if (datalen == sizeof(*iblob)) {
1359 			/* Data has been written to file descriptor. */
1360 			break;
1361 		}
1362 
1363 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX) {
1364 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1365 			break;
1366 		}
1367 
1368 		*outbuf = malloc(*size);
1369 		if (*outbuf == NULL) {
1370 			err = got_error_from_errno("malloc");
1371 			break;
1372 		}
1373 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
1374 		break;
1375 	default:
1376 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1377 		break;
1378 	}
1379 
1380 	imsg_free(&imsg);
1381 
1382 	return err;
1383 }
1384 
1385 static const struct got_error *
1386 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
1387 {
1388 	const struct got_error *err = NULL;
1389 	size_t offset, remain;
1390 
1391 	offset = 0;
1392 	remain = tagmsg_len;
1393 	while (remain > 0) {
1394 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1395 
1396 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
1397 		    tag->tagmsg + offset, n) == -1) {
1398 			err = got_error_from_errno("imsg_compose TAG_TAGMSG");
1399 			break;
1400 		}
1401 
1402 		err = flush_imsg(ibuf);
1403 		if (err)
1404 			break;
1405 
1406 		offset += n;
1407 		remain -= n;
1408 	}
1409 
1410 	return err;
1411 }
1412 
1413 const struct got_error *
1414 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
1415 {
1416 	const struct got_error *err = NULL;
1417 	struct got_imsg_tag_object *itag;
1418 	uint8_t *buf;
1419 	size_t len, total;
1420 	size_t tag_len = strlen(tag->tag);
1421 	size_t tagger_len = strlen(tag->tagger);
1422 	size_t tagmsg_len = strlen(tag->tagmsg);
1423 
1424 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
1425 
1426 	buf = malloc(total);
1427 	if (buf == NULL)
1428 		return got_error_from_errno("malloc");
1429 
1430 	itag = (struct got_imsg_tag_object *)buf;
1431 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
1432 	itag->obj_type = tag->obj_type;
1433 	itag->tag_len = tag_len;
1434 	itag->tagger_len = tagger_len;
1435 	itag->tagger_time = tag->tagger_time;
1436 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1437 	itag->tagmsg_len = tagmsg_len;
1438 
1439 	len = sizeof(*itag);
1440 	memcpy(buf + len, tag->tag, tag_len);
1441 	len += tag_len;
1442 	memcpy(buf + len, tag->tagger, tagger_len);
1443 	len += tagger_len;
1444 
1445 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1446 		err = got_error_from_errno("imsg_compose TAG");
1447 		goto done;
1448 	}
1449 
1450 	if (tagmsg_len == 0 ||
1451 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1452 		err = flush_imsg(ibuf);
1453 		if (err)
1454 			goto done;
1455 	}
1456 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1457 done:
1458 	free(buf);
1459 	return err;
1460 }
1461 
1462 const struct got_error *
1463 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1464 {
1465 	const struct got_error *err = NULL;
1466 	struct imsg imsg;
1467 	struct got_imsg_tag_object *itag;
1468 	size_t len, datalen;
1469 	const size_t min_datalen =
1470 	    MIN(sizeof(struct got_imsg_error),
1471 	    sizeof(struct got_imsg_tag_object));
1472 
1473 	*tag = NULL;
1474 
1475 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1476 	if (err)
1477 		return err;
1478 
1479 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1480 	len = 0;
1481 
1482 	switch (imsg.hdr.type) {
1483 	case GOT_IMSG_TAG:
1484 		if (datalen < sizeof(*itag)) {
1485 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1486 			break;
1487 		}
1488 		itag = imsg.data;
1489 		if (datalen != sizeof(*itag) + itag->tag_len +
1490 		    itag->tagger_len) {
1491 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1492 			break;
1493 		}
1494 		len += sizeof(*itag);
1495 
1496 		*tag = calloc(1, sizeof(**tag));
1497 		if (*tag == NULL) {
1498 			err = got_error_from_errno("calloc");
1499 			break;
1500 		}
1501 
1502 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1503 
1504 		if (itag->tag_len == 0) {
1505 			(*tag)->tag = strdup("");
1506 			if ((*tag)->tag == NULL) {
1507 				err = got_error_from_errno("strdup");
1508 				break;
1509 			}
1510 		} else {
1511 			(*tag)->tag = malloc(itag->tag_len + 1);
1512 			if ((*tag)->tag == NULL) {
1513 				err = got_error_from_errno("malloc");
1514 				break;
1515 			}
1516 			memcpy((*tag)->tag, imsg.data + len,
1517 			    itag->tag_len);
1518 			(*tag)->tag[itag->tag_len] = '\0';
1519 		}
1520 		len += itag->tag_len;
1521 
1522 		(*tag)->obj_type = itag->obj_type;
1523 		(*tag)->tagger_time = itag->tagger_time;
1524 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1525 
1526 		if (itag->tagger_len == 0) {
1527 			(*tag)->tagger = strdup("");
1528 			if ((*tag)->tagger == NULL) {
1529 				err = got_error_from_errno("strdup");
1530 				break;
1531 			}
1532 		} else {
1533 			(*tag)->tagger = malloc(itag->tagger_len + 1);
1534 			if ((*tag)->tagger == NULL) {
1535 				err = got_error_from_errno("malloc");
1536 				break;
1537 			}
1538 			memcpy((*tag)->tagger, imsg.data + len,
1539 			    itag->tagger_len);
1540 			(*tag)->tagger[itag->tagger_len] = '\0';
1541 		}
1542 		len += itag->tagger_len;
1543 
1544 		if (itag->tagmsg_len == 0) {
1545 			(*tag)->tagmsg = strdup("");
1546 			if ((*tag)->tagmsg == NULL) {
1547 				err = got_error_from_errno("strdup");
1548 				break;
1549 			}
1550 		} else {
1551 			size_t offset = 0, remain = itag->tagmsg_len;
1552 
1553 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1554 			if ((*tag)->tagmsg == NULL) {
1555 				err = got_error_from_errno("malloc");
1556 				break;
1557 			}
1558 			while (remain > 0) {
1559 				struct imsg imsg_log;
1560 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1561 				    remain);
1562 
1563 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1564 				if (err)
1565 					return err;
1566 
1567 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1568 					return got_error(GOT_ERR_PRIVSEP_MSG);
1569 
1570 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1571 				    n);
1572 				imsg_free(&imsg_log);
1573 				offset += n;
1574 				remain -= n;
1575 			}
1576 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1577 		}
1578 
1579 		break;
1580 	default:
1581 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1582 		break;
1583 	}
1584 
1585 	imsg_free(&imsg);
1586 
1587 	return err;
1588 }
1589 
1590 const struct got_error *
1591 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1592     struct got_packidx *packidx)
1593 {
1594 	const struct got_error *err = NULL;
1595 	struct got_imsg_packidx ipackidx;
1596 	struct got_imsg_pack ipack;
1597 	int fd;
1598 
1599 	ipackidx.len = packidx->len;
1600 	fd = dup(packidx->fd);
1601 	if (fd == -1)
1602 		return got_error_from_errno("dup");
1603 
1604 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1605 	    sizeof(ipackidx)) == -1) {
1606 		err = got_error_from_errno("imsg_compose PACKIDX");
1607 		close(fd);
1608 		return err;
1609 	}
1610 
1611 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1612 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1613 		return got_error(GOT_ERR_NO_SPACE);
1614 	ipack.filesize = pack->filesize;
1615 
1616 	fd = dup(pack->fd);
1617 	if (fd == -1)
1618 		return got_error_from_errno("dup");
1619 
1620 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
1621 	    == -1) {
1622 		err = got_error_from_errno("imsg_compose PACK");
1623 		close(fd);
1624 		return err;
1625 	}
1626 
1627 	return flush_imsg(ibuf);
1628 }
1629 
1630 const struct got_error *
1631 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
1632     struct got_object_id *id)
1633 {
1634 	struct got_imsg_packed_object iobj;
1635 
1636 	iobj.idx = idx;
1637 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1638 
1639 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
1640 	    &iobj, sizeof(iobj)) == -1)
1641 		return got_error_from_errno("imsg_compose "
1642 		    "PACKED_OBJECT_REQUEST");
1643 
1644 	return flush_imsg(ibuf);
1645 }
1646 
1647 const struct got_error *
1648 got_privsep_send_gitconfig_parse_req(struct imsgbuf *ibuf, int fd)
1649 {
1650 	const struct got_error *err = NULL;
1651 
1652 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_PARSE_REQUEST, 0, 0, fd,
1653 	    NULL, 0) == -1) {
1654 		err = got_error_from_errno("imsg_compose "
1655 		    "GITCONFIG_PARSE_REQUEST");
1656 		close(fd);
1657 		return err;
1658 	}
1659 
1660 	return flush_imsg(ibuf);
1661 }
1662 
1663 const struct got_error *
1664 got_privsep_send_gitconfig_repository_format_version_req(struct imsgbuf *ibuf)
1665 {
1666 	if (imsg_compose(ibuf,
1667 	    GOT_IMSG_GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST, 0, 0, -1,
1668 	    NULL, 0) == -1)
1669 		return got_error_from_errno("imsg_compose "
1670 		    "GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST");
1671 
1672 	return flush_imsg(ibuf);
1673 }
1674 
1675 const struct got_error *
1676 got_privsep_send_gitconfig_author_name_req(struct imsgbuf *ibuf)
1677 {
1678 	if (imsg_compose(ibuf,
1679 	    GOT_IMSG_GITCONFIG_AUTHOR_NAME_REQUEST, 0, 0, -1, NULL, 0) == -1)
1680 		return got_error_from_errno("imsg_compose "
1681 		    "GITCONFIG_AUTHOR_NAME_REQUEST");
1682 
1683 	return flush_imsg(ibuf);
1684 }
1685 
1686 const struct got_error *
1687 got_privsep_send_gitconfig_author_email_req(struct imsgbuf *ibuf)
1688 {
1689 	if (imsg_compose(ibuf,
1690 	    GOT_IMSG_GITCONFIG_AUTHOR_EMAIL_REQUEST, 0, 0, -1, NULL, 0) == -1)
1691 		return got_error_from_errno("imsg_compose "
1692 		    "GITCONFIG_AUTHOR_EMAIL_REQUEST");
1693 
1694 	return flush_imsg(ibuf);
1695 }
1696 
1697 const struct got_error *
1698 got_privsep_send_gitconfig_remotes_req(struct imsgbuf *ibuf)
1699 {
1700 	if (imsg_compose(ibuf,
1701 	    GOT_IMSG_GITCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
1702 		return got_error_from_errno("imsg_compose "
1703 		    "GITCONFIG_REMOTE_REQUEST");
1704 
1705 	return flush_imsg(ibuf);
1706 }
1707 
1708 const struct got_error *
1709 got_privsep_send_gitconfig_owner_req(struct imsgbuf *ibuf)
1710 {
1711 	if (imsg_compose(ibuf,
1712 	    GOT_IMSG_GITCONFIG_OWNER_REQUEST, 0, 0, -1, NULL, 0) == -1)
1713 		return got_error_from_errno("imsg_compose "
1714 		    "GITCONFIG_OWNER_REQUEST");
1715 
1716 	return flush_imsg(ibuf);
1717 }
1718 
1719 const struct got_error *
1720 got_privsep_send_gitconfig_str(struct imsgbuf *ibuf, const char *value)
1721 {
1722 	size_t len = value ? strlen(value) + 1 : 0;
1723 
1724 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_STR_VAL, 0, 0, -1,
1725 	    value, len) == -1)
1726 		return got_error_from_errno("imsg_compose GITCONFIG_STR_VAL");
1727 
1728 	return flush_imsg(ibuf);
1729 }
1730 
1731 const struct got_error *
1732 got_privsep_recv_gitconfig_str(char **str, struct imsgbuf *ibuf)
1733 {
1734 	const struct got_error *err = NULL;
1735 	struct imsg imsg;
1736 	size_t datalen;
1737 	const size_t min_datalen = 0;
1738 
1739 	*str = NULL;
1740 
1741 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1742 	if (err)
1743 		return err;
1744 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1745 
1746 	switch (imsg.hdr.type) {
1747 	case GOT_IMSG_GITCONFIG_STR_VAL:
1748 		if (datalen == 0)
1749 			break;
1750 		*str = malloc(datalen);
1751 		if (*str == NULL) {
1752 			err = got_error_from_errno("malloc");
1753 			break;
1754 		}
1755 		if (strlcpy(*str, imsg.data, datalen) >= datalen)
1756 			err = got_error(GOT_ERR_NO_SPACE);
1757 		break;
1758 	default:
1759 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1760 		break;
1761 	}
1762 
1763 	imsg_free(&imsg);
1764 	return err;
1765 }
1766 
1767 const struct got_error *
1768 got_privsep_send_gitconfig_int(struct imsgbuf *ibuf, int value)
1769 {
1770 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_INT_VAL, 0, 0, -1,
1771 	    &value, sizeof(value)) == -1)
1772 		return got_error_from_errno("imsg_compose GITCONFIG_INT_VAL");
1773 
1774 	return flush_imsg(ibuf);
1775 }
1776 
1777 const struct got_error *
1778 got_privsep_recv_gitconfig_int(int *val, struct imsgbuf *ibuf)
1779 {
1780 	const struct got_error *err = NULL;
1781 	struct imsg imsg;
1782 	size_t datalen;
1783 	const size_t min_datalen =
1784 	    MIN(sizeof(struct got_imsg_error), sizeof(int));
1785 
1786 	*val = 0;
1787 
1788 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1789 	if (err)
1790 		return err;
1791 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1792 
1793 	switch (imsg.hdr.type) {
1794 	case GOT_IMSG_GITCONFIG_INT_VAL:
1795 		if (datalen != sizeof(*val)) {
1796 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1797 			break;
1798 		}
1799 		memcpy(val, imsg.data, sizeof(*val));
1800 		break;
1801 	default:
1802 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1803 		break;
1804 	}
1805 
1806 	imsg_free(&imsg);
1807 	return err;
1808 }
1809 
1810 const struct got_error *
1811 got_privsep_send_gitconfig_remotes(struct imsgbuf *ibuf,
1812     struct got_remote_repo *remotes, int nremotes)
1813 {
1814 	const struct got_error *err = NULL;
1815 	struct got_imsg_remotes iremotes;
1816 	int i;
1817 
1818 	iremotes.nremotes = nremotes;
1819 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_REMOTES, 0, 0, -1,
1820 	    &iremotes, sizeof(iremotes)) == -1)
1821 		return got_error_from_errno("imsg_compose GITCONFIG_REMOTES");
1822 
1823 	err = flush_imsg(ibuf);
1824 	imsg_clear(ibuf);
1825 	if (err)
1826 		return err;
1827 
1828 	for (i = 0; i < nremotes; i++) {
1829 		struct got_imsg_remote iremote;
1830 		size_t len = sizeof(iremote);
1831 		struct ibuf *wbuf;
1832 
1833 		iremote.name_len = strlen(remotes[i].name);
1834 		len += iremote.name_len;
1835 		iremote.url_len = strlen(remotes[i].url);
1836 		len += iremote.url_len;
1837 
1838 		wbuf = imsg_create(ibuf, GOT_IMSG_GITCONFIG_REMOTE, 0, 0, len);
1839 		if (wbuf == NULL)
1840 			return got_error_from_errno(
1841 			    "imsg_create GITCONFIG_REMOTE");
1842 
1843 		if (imsg_add(wbuf, &iremote, sizeof(iremote)) == -1) {
1844 			err = got_error_from_errno(
1845 			    "imsg_add GIITCONFIG_REMOTE");
1846 			ibuf_free(wbuf);
1847 			return err;
1848 		}
1849 
1850 		if (imsg_add(wbuf, remotes[i].name, iremote.name_len) == -1) {
1851 			err = got_error_from_errno(
1852 			    "imsg_add GIITCONFIG_REMOTE");
1853 			ibuf_free(wbuf);
1854 			return err;
1855 		}
1856 		if (imsg_add(wbuf, remotes[i].url, iremote.url_len) == -1) {
1857 			err = got_error_from_errno(
1858 			    "imsg_add GIITCONFIG_REMOTE");
1859 			ibuf_free(wbuf);
1860 			return err;
1861 		}
1862 
1863 		wbuf->fd = -1;
1864 		imsg_close(ibuf, wbuf);
1865 		err = flush_imsg(ibuf);
1866 		if (err)
1867 			return err;
1868 	}
1869 
1870 	return NULL;
1871 }
1872 
1873 const struct got_error *
1874 got_privsep_recv_gitconfig_remotes(struct got_remote_repo **remotes,
1875     int *nremotes, struct imsgbuf *ibuf)
1876 {
1877 	const struct got_error *err = NULL;
1878 	struct imsg imsg;
1879 	size_t datalen;
1880 	struct got_imsg_remotes iremotes;
1881 	struct got_imsg_remote iremote;
1882 
1883 	*remotes = NULL;
1884 	*nremotes = 0;
1885 	iremotes.nremotes = 0;
1886 
1887 	err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremotes));
1888 	if (err)
1889 		return err;
1890 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1891 
1892 	switch (imsg.hdr.type) {
1893 	case GOT_IMSG_GITCONFIG_REMOTES:
1894 		if (datalen != sizeof(iremotes)) {
1895 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1896 			break;
1897 		}
1898 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
1899 		if (iremotes.nremotes == 0) {
1900 			imsg_free(&imsg);
1901 			return NULL;
1902 		}
1903 		break;
1904 	default:
1905 		imsg_free(&imsg);
1906 		return got_error(GOT_ERR_PRIVSEP_MSG);
1907 	}
1908 
1909 	imsg_free(&imsg);
1910 
1911 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(iremote));
1912 	if (*remotes == NULL)
1913 		return got_error_from_errno("recallocarray");
1914 
1915 	while (*nremotes < iremotes.nremotes) {
1916 		struct got_remote_repo *remote;
1917 	
1918 		err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremote));
1919 		if (err)
1920 			break;
1921 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1922 
1923 		switch (imsg.hdr.type) {
1924 		case GOT_IMSG_GITCONFIG_REMOTE:
1925 			remote = &(*remotes)[*nremotes];
1926 			if (datalen < sizeof(iremote)) {
1927 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1928 				break;
1929 			}
1930 			memcpy(&iremote, imsg.data, sizeof(iremote));
1931 			if (iremote.name_len == 0 || iremote.url_len == 0 ||
1932 			    (sizeof(iremote) + iremote.name_len +
1933 			    iremote.url_len) > datalen) {
1934 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1935 				break;
1936 			}
1937 			remote->name = strndup(imsg.data + sizeof(iremote),
1938 			    iremote.name_len);
1939 			if (remote->name == NULL) {
1940 				err = got_error_from_errno("strndup");
1941 				break;
1942 			}
1943 			remote->url = strndup(imsg.data + sizeof(iremote) +
1944 			    iremote.name_len, iremote.url_len);
1945 			if (remote->url == NULL) {
1946 				err = got_error_from_errno("strndup");
1947 				free(remote->name);
1948 				break;
1949 			}
1950 			(*nremotes)++;
1951 			break;
1952 		default:
1953 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1954 			break;
1955 		}
1956 
1957 		imsg_free(&imsg);
1958 		if (err)
1959 			break;
1960 	}
1961 
1962 	if (err) {
1963 		int i;
1964 		for (i = 0; i < *nremotes; i++) {
1965 			free((*remotes)[i].name);
1966 			free((*remotes)[i].url);
1967 		}
1968 		free(*remotes);
1969 		*remotes = NULL;
1970 		*nremotes = 0;
1971 	}
1972 	return err;
1973 }
1974 
1975 const struct got_error *
1976 got_privsep_send_commit_traversal_request(struct imsgbuf *ibuf,
1977      struct got_object_id *id, int idx, const char *path)
1978 {
1979 	const struct got_error *err = NULL;
1980 	struct ibuf *wbuf;
1981 	size_t path_len = strlen(path) + 1;
1982 
1983 	wbuf = imsg_create(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_REQUEST, 0, 0,
1984 	    sizeof(struct got_imsg_commit_traversal_request) + path_len);
1985 	if (wbuf == NULL)
1986 		return got_error_from_errno(
1987 		    "imsg_create COMMIT_TRAVERSAL_REQUEST");
1988 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
1989 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1990 		ibuf_free(wbuf);
1991 		return err;
1992 	}
1993 	if (imsg_add(wbuf, &idx, sizeof(idx)) == -1) {
1994 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1995 		ibuf_free(wbuf);
1996 		return err;
1997 	}
1998 	if (imsg_add(wbuf, path, path_len) == -1) {
1999 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
2000 		ibuf_free(wbuf);
2001 		return err;
2002 	}
2003 
2004 	wbuf->fd = -1;
2005 	imsg_close(ibuf, wbuf);
2006 
2007 	return flush_imsg(ibuf);
2008 }
2009 
2010 const struct got_error *
2011 got_privsep_send_traversed_commits(struct got_object_id *commit_ids, 
2012     size_t ncommits, struct imsgbuf *ibuf)
2013 {
2014 	const struct got_error *err;
2015 	struct ibuf *wbuf;
2016 	int i;
2017 
2018 	wbuf = imsg_create(ibuf, GOT_IMSG_TRAVERSED_COMMITS, 0, 0,
2019 	    sizeof(struct got_imsg_traversed_commits) +
2020 	    ncommits * SHA1_DIGEST_LENGTH);
2021 	if (wbuf == NULL)
2022 		return got_error_from_errno("imsg_create TRAVERSED_COMMITS");
2023 
2024 	if (imsg_add(wbuf, &ncommits, sizeof(ncommits)) == -1) {
2025 		err = got_error_from_errno("imsg_add TRAVERSED_COMMITS");
2026 		ibuf_free(wbuf);
2027 		return err;
2028 	}
2029 	for (i = 0; i < ncommits; i++) {
2030 		struct got_object_id *id = &commit_ids[i];
2031 		if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
2032 			err = got_error_from_errno(
2033 			    "imsg_add TRAVERSED_COMMITS");
2034 			ibuf_free(wbuf);
2035 			return err;
2036 		}
2037 	}
2038 
2039 	wbuf->fd = -1;
2040 	imsg_close(ibuf, wbuf);
2041 
2042 	return flush_imsg(ibuf);
2043 }
2044 
2045 const struct got_error *
2046 got_privsep_recv_traversed_commits(struct got_commit_object **changed_commit,
2047     struct got_object_id **changed_commit_id,
2048     struct got_object_id_queue *commit_ids, struct imsgbuf *ibuf)
2049 {
2050 	const struct got_error *err = NULL;
2051 	struct imsg imsg;
2052 	struct got_imsg_traversed_commits *icommits;
2053 	size_t datalen;
2054 	int i, done = 0;
2055 
2056 	*changed_commit = NULL;
2057 	*changed_commit_id = NULL;
2058 
2059 	while (!done) {
2060 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2061 		if (err)
2062 			return err;
2063 
2064 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2065 		switch (imsg.hdr.type) {
2066 		case GOT_IMSG_TRAVERSED_COMMITS:
2067 			icommits = imsg.data;
2068 			if (datalen != sizeof(*icommits) +
2069 			    icommits->ncommits * SHA1_DIGEST_LENGTH) {
2070 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2071 				break;
2072 			}
2073 			for (i = 0; i < icommits->ncommits; i++) {
2074 				struct got_object_qid *qid;
2075 				uint8_t *sha1 = (uint8_t *)imsg.data +
2076 				    sizeof(*icommits) + i * SHA1_DIGEST_LENGTH;
2077 				err = got_object_qid_alloc_partial(&qid);
2078 				if (err)
2079 					break;
2080 				memcpy(qid->id->sha1, sha1, SHA1_DIGEST_LENGTH);
2081 				SIMPLEQ_INSERT_TAIL(commit_ids, qid, entry);
2082 
2083 				/* The last commit may contain a change. */
2084 				if (i == icommits->ncommits - 1) {
2085 					*changed_commit_id =
2086 					    got_object_id_dup(qid->id);
2087 					if (*changed_commit_id == NULL) {
2088 						err = got_error_from_errno(
2089 						    "got_object_id_dup");
2090 						break;
2091 					}
2092 				}
2093 			}
2094 			break;
2095 		case GOT_IMSG_COMMIT:
2096 			if (*changed_commit_id == NULL) {
2097 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2098 				break;
2099 			}
2100 			err = get_commit_from_imsg(changed_commit, &imsg,
2101 			    datalen, ibuf);
2102 			break;
2103 		case GOT_IMSG_COMMIT_TRAVERSAL_DONE:
2104 			done = 1;
2105 			break;
2106 		default:
2107 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2108 			break;
2109 		}
2110 
2111 		imsg_free(&imsg);
2112 		if (err)
2113 			break;
2114 	}
2115 
2116 	if (err)
2117 		got_object_id_queue_free(commit_ids);
2118 	return err;
2119 }
2120 
2121 const struct got_error *
2122 got_privsep_send_commit_traversal_done(struct imsgbuf *ibuf)
2123 {
2124 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_DONE, 0, 0, -1,
2125 	    NULL, 0) == -1)
2126 		return got_error_from_errno("imsg_compose TRAVERSAL_DONE");
2127 
2128 	return flush_imsg(ibuf);
2129 }
2130 
2131 const struct got_error *
2132 got_privsep_unveil_exec_helpers(void)
2133 {
2134 	const char *helpers[] = {
2135 	    GOT_PATH_PROG_READ_PACK,
2136 	    GOT_PATH_PROG_READ_OBJECT,
2137 	    GOT_PATH_PROG_READ_COMMIT,
2138 	    GOT_PATH_PROG_READ_TREE,
2139 	    GOT_PATH_PROG_READ_BLOB,
2140 	    GOT_PATH_PROG_READ_TAG,
2141 	    GOT_PATH_PROG_READ_GITCONFIG,
2142 	};
2143 	int i;
2144 
2145 	for (i = 0; i < nitems(helpers); i++) {
2146 		if (unveil(helpers[i], "x") == 0)
2147 			continue;
2148 		return got_error_from_errno2("unveil", helpers[i]);
2149 	}
2150 
2151 	return NULL;
2152 }
2153 
2154 void
2155 got_privsep_exec_child(int imsg_fds[2], const char *path, const char *repo_path)
2156 {
2157 	if (close(imsg_fds[0]) != 0) {
2158 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2159 		_exit(1);
2160 	}
2161 
2162 	if (dup2(imsg_fds[1], GOT_IMSG_FD_CHILD) == -1) {
2163 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2164 		_exit(1);
2165 	}
2166 	if (closefrom(GOT_IMSG_FD_CHILD + 1) == -1) {
2167 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2168 		_exit(1);
2169 	}
2170 
2171 	if (execl(path, path, repo_path, (char *)NULL) == -1) {
2172 		fprintf(stderr, "%s: %s: %s\n", getprogname(), path,
2173 		    strerror(errno));
2174 		_exit(1);
2175 	}
2176 }