Got Mirror

Blob

Date:: Wed Mar 18 16:11:30 2020 UTC
Message:: prepare for providing refs we already have in fetch request imsg currently we always send and expect an empty list
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2018, 2019, 2020 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2020 Ori Bernstein <ori@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/queue.h>
20 #include <sys/uio.h>
21 #include <sys/syslimits.h>
22 #include <sys/wait.h>
23 
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <string.h>
27 #include <errno.h>
28 #include <stdint.h>
29 #include <poll.h>
30 #include <imsg.h>
31 #include <sha1.h>
32 #include <zlib.h>
33 #include <time.h>
34 
35 #include "got_object.h"
36 #include "got_error.h"
37 #include "got_path.h"
38 #include "got_repository.h"
39 
40 #include "got_lib_sha1.h"
41 #include "got_lib_delta.h"
42 #include "got_lib_inflate.h"
43 #include "got_lib_object.h"
44 #include "got_lib_object_parse.h"
45 #include "got_lib_privsep.h"
46 #include "got_lib_pack.h"
47 
48 #ifndef MIN
49 #define	MIN(_a,_b) ((_a) < (_b) ? (_a) : (_b))
50 #endif
51 
52 #ifndef nitems
53 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
54 #endif
55 
56 static const struct got_error *
57 poll_fd(int fd, int events, int timeout)
58 {
59 	struct pollfd pfd[1];
60 	int n;
61 
62 	pfd[0].fd = fd;
63 	pfd[0].events = events;
64 
65 	n = poll(pfd, 1, timeout);
66 	if (n == -1)
67 		return got_error_from_errno("poll");
68 	if (n == 0)
69 		return got_error(GOT_ERR_TIMEOUT);
70 	if (pfd[0].revents & (POLLERR | POLLNVAL))
71 		return got_error_from_errno("poll error");
72 	if (pfd[0].revents & (events | POLLHUP))
73 		return NULL;
74 
75 	return got_error(GOT_ERR_INTERRUPT);
76 }
77 
78 static const struct got_error *
79 read_imsg(struct imsgbuf *ibuf)
80 {
81 	const struct got_error *err;
82 	size_t n;
83 
84 	err = poll_fd(ibuf->fd, POLLIN, INFTIM);
85 	if (err)
86 		return err;
87 
88 	n = imsg_read(ibuf);
89 	if (n == -1) {
90 		if (errno == EAGAIN) /* Could be a file-descriptor leak. */
91 			return got_error(GOT_ERR_PRIVSEP_NO_FD);
92 		return got_error(GOT_ERR_PRIVSEP_READ);
93 	}
94 	if (n == 0)
95 		return got_error(GOT_ERR_PRIVSEP_PIPE);
96 
97 	return NULL;
98 }
99 
100 const struct got_error *
101 got_privsep_wait_for_child(pid_t pid)
102 {
103 	int child_status;
104 
105 	if (waitpid(pid, &child_status, 0) == -1)
106 		return got_error_from_errno("waitpid");
107 
108 	if (!WIFEXITED(child_status))
109 		return got_error(GOT_ERR_PRIVSEP_DIED);
110 
111 	if (WEXITSTATUS(child_status) != 0)
112 		return got_error(GOT_ERR_PRIVSEP_EXIT);
113 
114 	return NULL;
115 }
116 
117 static const struct got_error *
118 recv_imsg_error(struct imsg *imsg, size_t datalen)
119 {
120 	struct got_imsg_error *ierr;
121 
122 	if (datalen != sizeof(*ierr))
123 		return got_error(GOT_ERR_PRIVSEP_LEN);
124 
125 	ierr = imsg->data;
126 	if (ierr->code == GOT_ERR_ERRNO) {
127 		static struct got_error serr;
128 		serr.code = GOT_ERR_ERRNO;
129 		serr.msg = strerror(ierr->errno_code);
130 		return &serr;
131 	}
132 
133 	return got_error(ierr->code);
134 }
135 
136 const struct got_error *
137 got_privsep_recv_imsg(struct imsg *imsg, struct imsgbuf *ibuf,
138     size_t min_datalen)
139 {
140 	const struct got_error *err;
141 	ssize_t n;
142 
143 	n = imsg_get(ibuf, imsg);
144 	if (n == -1)
145 		return got_error_from_errno("imsg_get");
146 
147 	while (n == 0) {
148 		err = read_imsg(ibuf);
149 		if (err)
150 			return err;
151 		n = imsg_get(ibuf, imsg);
152 		if (n == -1)
153 			return got_error_from_errno("imsg_get");
154 	}
155 
156 	if (imsg->hdr.len < IMSG_HEADER_SIZE + min_datalen)
157 		return got_error(GOT_ERR_PRIVSEP_LEN);
158 
159 	if (imsg->hdr.type == GOT_IMSG_ERROR) {
160 		size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
161 		return recv_imsg_error(imsg, datalen);
162 	}
163 
164 	return NULL;
165 }
166 
167 /* Attempt to send an error in an imsg. Complain on stderr as a last resort. */
168 void
169 got_privsep_send_error(struct imsgbuf *ibuf, const struct got_error *err)
170 {
171 	const struct got_error *poll_err;
172 	struct got_imsg_error ierr;
173 	int ret;
174 
175 	ierr.code = err->code;
176 	if (err->code == GOT_ERR_ERRNO)
177 		ierr.errno_code = errno;
178 	else
179 		ierr.errno_code = 0;
180 	ret = imsg_compose(ibuf, GOT_IMSG_ERROR, 0, 0, -1, &ierr, sizeof(ierr));
181 	if (ret == -1) {
182 		fprintf(stderr, "%s: error %d \"%s\": imsg_compose: %s\n",
183 		    getprogname(), err->code, err->msg, strerror(errno));
184 		return;
185 	}
186 
187 	poll_err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
188 	if (poll_err) {
189 		fprintf(stderr, "%s: error %d \"%s\": poll: %s\n",
190 		    getprogname(), err->code, err->msg, poll_err->msg);
191 		return;
192 	}
193 
194 	ret = imsg_flush(ibuf);
195 	if (ret == -1) {
196 		fprintf(stderr, "%s: error %d \"%s\": imsg_flush: %s\n",
197 		    getprogname(), err->code, err->msg, strerror(errno));
198 		return;
199 	}
200 }
201 
202 static const struct got_error *
203 flush_imsg(struct imsgbuf *ibuf)
204 {
205 	const struct got_error *err;
206 
207 	err = poll_fd(ibuf->fd, POLLOUT, INFTIM);
208 	if (err)
209 		return err;
210 
211 	if (imsg_flush(ibuf) == -1)
212 		return got_error_from_errno("imsg_flush");
213 
214 	return NULL;
215 }
216 
217 const struct got_error *
218 got_privsep_send_stop(int fd)
219 {
220 	const struct got_error *err = NULL;
221 	struct imsgbuf ibuf;
222 
223 	imsg_init(&ibuf, fd);
224 
225 	if (imsg_compose(&ibuf, GOT_IMSG_STOP, 0, 0, -1, NULL, 0) == -1)
226 		return got_error_from_errno("imsg_compose STOP");
227 
228 	err = flush_imsg(&ibuf);
229 	imsg_clear(&ibuf);
230 	return err;
231 }
232 
233 const struct got_error *
234 got_privsep_send_obj_req(struct imsgbuf *ibuf, int fd)
235 {
236 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT_REQUEST, 0, 0, fd, NULL, 0)
237 	    == -1)
238 		return got_error_from_errno("imsg_compose OBJECT_REQUEST");
239 
240 	return flush_imsg(ibuf);
241 }
242 
243 const struct got_error *
244 got_privsep_send_commit_req(struct imsgbuf *ibuf, int fd,
245     struct got_object_id *id, int pack_idx)
246 {
247 	const struct got_error *err = NULL;
248 	struct got_imsg_packed_object iobj, *iobjp;
249 	size_t len;
250 
251 	if (id) { /* commit is packed */
252 		iobj.idx = pack_idx;
253 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
254 		iobjp = &iobj;
255 		len = sizeof(iobj);
256 	} else {
257 		iobjp = NULL;
258 		len = 0;
259 	}
260 
261 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_REQUEST, 0, 0, fd, iobjp, len)
262 	    == -1) {
263 		err = got_error_from_errno("imsg_compose COMMIT_REQUEST");
264 		close(fd);
265 		return err;
266 	}
267 
268 	return flush_imsg(ibuf);
269 }
270 
271 const struct got_error *
272 got_privsep_send_tree_req(struct imsgbuf *ibuf, int fd,
273     struct got_object_id *id, int pack_idx)
274 {
275 	const struct got_error *err = NULL;
276 	struct ibuf *wbuf;
277 	size_t len = id ? sizeof(struct got_imsg_packed_object) : 0;
278 
279 	wbuf = imsg_create(ibuf, GOT_IMSG_TREE_REQUEST, 0, 0, len);
280 	if (wbuf == NULL)
281 		return got_error_from_errno("imsg_create TREE_REQUEST");
282 
283 	if (id) { /* tree is packed */
284 		if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
285 			err = got_error_from_errno("imsg_add TREE_ENTRY");
286 			ibuf_free(wbuf);
287 			return err;
288 		}
289 
290 		if (imsg_add(wbuf, &pack_idx, sizeof(pack_idx)) == -1) {
291 			err = got_error_from_errno("imsg_add TREE_ENTRY");
292 			ibuf_free(wbuf);
293 			return err;
294 		}
295 	}
296 
297 	wbuf->fd = fd;
298 	imsg_close(ibuf, wbuf);
299 
300 	return flush_imsg(ibuf);
301 }
302 
303 const struct got_error *
304 got_privsep_send_tag_req(struct imsgbuf *ibuf, int fd,
305     struct got_object_id *id, int pack_idx)
306 {
307 	struct got_imsg_packed_object iobj, *iobjp;
308 	size_t len;
309 
310 	if (id) { /* tag is packed */
311 		iobj.idx = pack_idx;
312 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
313 		iobjp = &iobj;
314 		len = sizeof(iobj);
315 	} else {
316 		iobjp = NULL;
317 		len = 0;
318 	}
319 
320 	if (imsg_compose(ibuf, GOT_IMSG_TAG_REQUEST, 0, 0, fd, iobjp, len)
321 	    == -1)
322 		return got_error_from_errno("imsg_compose TAG_REQUEST");
323 
324 	return flush_imsg(ibuf);
325 }
326 
327 const struct got_error *
328 got_privsep_send_blob_req(struct imsgbuf *ibuf, int infd,
329     struct got_object_id *id, int pack_idx)
330 {
331 	const struct got_error *err = NULL;
332 	struct got_imsg_packed_object iobj, *iobjp;
333 	size_t len;
334 
335 	if (id) { /* blob is packed */
336 		iobj.idx = pack_idx;
337 		memcpy(iobj.id, id->sha1, sizeof(iobj.id));
338 		iobjp = &iobj;
339 		len = sizeof(iobj);
340 	} else {
341 		iobjp = NULL;
342 		len = 0;
343 	}
344 
345 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_REQUEST, 0, 0, infd, iobjp, len)
346 	    == -1) {
347 		err = got_error_from_errno("imsg_compose BLOB_REQUEST");
348 		close(infd);
349 		return err;
350 	}
351 
352 	return flush_imsg(ibuf);
353 }
354 
355 const struct got_error *
356 got_privsep_send_blob_outfd(struct imsgbuf *ibuf, int outfd)
357 {
358 	const struct got_error *err = NULL;
359 
360 	if (imsg_compose(ibuf, GOT_IMSG_BLOB_OUTFD, 0, 0, outfd, NULL, 0)
361 	    == -1) {
362 		err = got_error_from_errno("imsg_compose BLOB_OUTFD");
363 		close(outfd);
364 		return err;
365 	}
366 
367 	return flush_imsg(ibuf);
368 }
369 
370 const struct got_error *
371 got_privsep_send_tmpfd(struct imsgbuf *ibuf, int fd)
372 {
373 	const struct got_error *err = NULL;
374 
375 	if (imsg_compose(ibuf, GOT_IMSG_TMPFD, 0, 0, fd, NULL, 0)
376 	    == -1) {
377 		err = got_error_from_errno("imsg_compose TMPFD");
378 		close(fd);
379 		return err;
380 	}
381 
382 	return flush_imsg(ibuf);
383 }
384 
385 const struct got_error *
386 got_privsep_send_obj(struct imsgbuf *ibuf, struct got_object *obj)
387 {
388 	struct got_imsg_object iobj;
389 
390 	memcpy(iobj.id, obj->id.sha1, sizeof(iobj.id));
391 	iobj.type = obj->type;
392 	iobj.flags = obj->flags;
393 	iobj.hdrlen = obj->hdrlen;
394 	iobj.size = obj->size;
395 	if (iobj.flags & GOT_OBJ_FLAG_PACKED) {
396 		iobj.pack_offset = obj->pack_offset;
397 		iobj.pack_idx = obj->pack_idx;
398 	}
399 
400 	if (imsg_compose(ibuf, GOT_IMSG_OBJECT, 0, 0, -1, &iobj, sizeof(iobj))
401 	    == -1)
402 		return got_error_from_errno("imsg_compose OBJECT");
403 
404 	return flush_imsg(ibuf);
405 }
406 
407 const struct got_error *
408 got_privsep_send_fetch_req(struct imsgbuf *ibuf, int fd,
409    struct got_pathlist_head *have_refs)
410 {
411 	const struct got_error *err = NULL;
412 	struct ibuf *wbuf;
413 	size_t len, n_have_refs = 0;
414 	struct got_pathlist_entry *pe;
415 
416 	len = sizeof(struct got_imsg_fetch_symrefs);
417 	TAILQ_FOREACH(pe, have_refs, entry) {
418 		struct got_object_id *id = pe->data;
419 		len += sizeof(struct got_imsg_fetch_have_ref) +
420 		    pe->path_len + sizeof(id->sha1);
421 		n_have_refs++;
422 	}
423 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
424 		close(fd);
425 		return got_error(GOT_ERR_NO_SPACE);
426 	}
427 
428 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_REQUEST, 0, 0, len);
429 	if (wbuf == NULL) {
430 		close(fd);
431 		return got_error_from_errno("imsg_create FETCH_REQUEST");
432 	}
433 
434 	/* Keep in sync with struct got_imsg_fetch_have_refs definition! */
435 	if (imsg_add(wbuf, &n_have_refs, sizeof(n_have_refs)) == -1) {
436 		err = got_error_from_errno("imsg_add FETCH_REQUEST");
437 		ibuf_free(wbuf);
438 		close(fd);
439 		return err;
440 	}
441 
442 	TAILQ_FOREACH(pe, have_refs, entry) {
443 		const char *name = pe->path;
444 		size_t name_len = pe->path_len;
445 		struct got_object_id *id = pe->data;
446 
447 		/* Keep in sync with struct got_imsg_fetch_have_ref! */
448 		if (imsg_add(wbuf, id->sha1, sizeof(id->sha1)) == -1) {
449 			err = got_error_from_errno("imsg_add FETCH_REQUEST");
450 			ibuf_free(wbuf);
451 			close(fd);
452 			return err;
453 		}
454 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1) {
455 			err = got_error_from_errno("imsg_add FETCH_REQUEST");
456 			ibuf_free(wbuf);
457 			close(fd);
458 			return err;
459 		}
460 		if (imsg_add(wbuf, name, name_len) == -1) {
461 			err = got_error_from_errno("imsg_add FETCH_REQUEST");
462 			ibuf_free(wbuf);
463 			close(fd);
464 			return err;
465 		}
466 	}
467 
468 	wbuf->fd = fd;
469 	imsg_close(ibuf, wbuf);
470 	return flush_imsg(ibuf);
471 }
472 
473 const struct got_error *
474 got_privsep_send_fetch_symrefs(struct imsgbuf *ibuf,
475     struct got_pathlist_head *symrefs)
476 {
477 	const struct got_error *err = NULL;
478 	struct ibuf *wbuf;
479 	size_t len, nsymrefs = 0;
480 	struct got_pathlist_entry *pe;
481 
482 	len = sizeof(struct got_imsg_fetch_symrefs);
483 	TAILQ_FOREACH(pe, symrefs, entry) {
484 		const char *target = pe->data;
485 		len += sizeof(struct got_imsg_fetch_symref) +
486 		    pe->path_len + strlen(target);
487 		nsymrefs++;
488 	}
489 
490 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
491 		return got_error(GOT_ERR_NO_SPACE);
492 
493 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_SYMREFS, 0, 0, len);
494 	if (wbuf == NULL)
495 		return got_error_from_errno("imsg_create FETCH_SYMREFS");
496 
497 	/* Keep in sync with struct got_imsg_fetch_symrefs definition! */
498 	if (imsg_add(wbuf, &nsymrefs, sizeof(nsymrefs)) == -1) {
499 		err = got_error_from_errno("imsg_add FETCH_SYMREFS");
500 		ibuf_free(wbuf);
501 		return err;
502 	}
503 
504 	TAILQ_FOREACH(pe, symrefs, entry) {
505 		const char *name = pe->path;
506 		size_t name_len = pe->path_len;
507 		const char *target = pe->data;
508 		size_t target_len = strlen(target);
509 
510 		/* Keep in sync with struct got_imsg_fetch_symref definition! */
511 		if (imsg_add(wbuf, &name_len, sizeof(name_len)) == -1) {
512 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
513 			ibuf_free(wbuf);
514 			return err;
515 		}
516 		if (imsg_add(wbuf, &target_len, sizeof(target_len)) == -1) {
517 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
518 			ibuf_free(wbuf);
519 			return err;
520 		}
521 		if (imsg_add(wbuf, name, name_len) == -1) {
522 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
523 			ibuf_free(wbuf);
524 			return err;
525 		}
526 		if (imsg_add(wbuf, target, target_len) == -1) {
527 			err = got_error_from_errno("imsg_add FETCH_SYMREFS");
528 			ibuf_free(wbuf);
529 			return err;
530 		}
531 	}
532 
533 	wbuf->fd = -1;
534 	imsg_close(ibuf, wbuf);
535 	return flush_imsg(ibuf);
536 }
537 
538 const struct got_error *
539 got_privsep_send_fetch_progress(struct imsgbuf *ibuf,
540     struct got_object_id *refid, const char *refname)
541 {
542 	const struct got_error *err = NULL;
543 	struct ibuf *wbuf;
544 	size_t len, reflen = strlen(refname);
545 
546 	len = sizeof(struct got_imsg_fetch_progress) + reflen;
547 	if (len >= MAX_IMSGSIZE - IMSG_HEADER_SIZE)
548 		return got_error(GOT_ERR_NO_SPACE);
549 
550 	wbuf = imsg_create(ibuf, GOT_IMSG_FETCH_PROGRESS, 0, 0, len);
551 	if (wbuf == NULL)
552 		return got_error_from_errno("imsg_create FETCH_PROGRESS");
553 
554 	/* Keep in sync with struct got_imsg_fetch_progress definition! */
555 	if (imsg_add(wbuf, refid->sha1, SHA1_DIGEST_LENGTH) == -1) {
556 		err = got_error_from_errno("imsg_add FETCH_PROGRESS");
557 		ibuf_free(wbuf);
558 		return err;
559 	}
560 	if (imsg_add(wbuf, refname, reflen) == -1) {
561 		err = got_error_from_errno("imsg_add FETCH_PROGRESS");
562 		ibuf_free(wbuf);
563 		return err;
564 	}
565 
566 	wbuf->fd = -1;
567 	imsg_close(ibuf, wbuf);
568 	return flush_imsg(ibuf);
569 }
570 
571 const struct got_error *
572 got_privsep_send_fetch_done(struct imsgbuf *ibuf, struct got_object_id hash)
573 {
574 	if (imsg_compose(ibuf, GOT_IMSG_FETCH_DONE, 0, 0, -1,
575 	    hash.sha1, SHA1_DIGEST_LENGTH) == -1)
576 		return got_error_from_errno("imsg_compose FETCH");
577 	return flush_imsg(ibuf);
578 }
579 
580 
581 const struct got_error *
582 got_privsep_recv_fetch_progress(int *done, struct got_object_id **id,
583     char **refname, struct got_pathlist_head *symrefs, struct imsgbuf *ibuf)
584 {
585 	const struct got_error *err = NULL;
586 	struct imsg imsg;
587 	size_t datalen;
588 	const size_t min_datalen =
589 	    MIN(MIN(sizeof(struct got_imsg_error),
590 	    sizeof(struct got_imsg_fetch_progress)),
591 	    sizeof(struct got_imsg_fetch_symrefs));
592 	struct got_imsg_fetch_symrefs *isymrefs = NULL;
593 	size_t n, remain;
594 	off_t off;
595 
596 	*done = 0;
597 	*id = NULL;
598 	*refname = NULL;
599 
600 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
601 	if (err)
602 		return err;
603 
604 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
605 	switch (imsg.hdr.type) {
606 	case GOT_IMSG_ERROR:
607 		err = recv_imsg_error(&imsg, datalen);
608 		break;
609 	case GOT_IMSG_FETCH_SYMREFS:
610 		if (datalen < sizeof(*isymrefs)) {
611 			err = got_error(GOT_ERR_PRIVSEP_LEN);
612 			break;
613 		}
614 		if (isymrefs != NULL) {
615 			err = got_error(GOT_ERR_PRIVSEP_MSG);
616 			break;
617 		}
618 		isymrefs = (struct got_imsg_fetch_symrefs *)imsg.data;
619 		off = sizeof(*isymrefs);
620 		remain = datalen - off;
621 		for (n = 0; n < isymrefs->nsymrefs; n++) {
622 			struct got_imsg_fetch_symref *s;
623 			char *name, *target;
624 			if (remain < sizeof(struct got_imsg_fetch_symref)) {
625 				err = got_error(GOT_ERR_PRIVSEP_LEN);
626 				goto done;
627 			}
628 			s = (struct got_imsg_fetch_symref *)(imsg.data + off);
629 			off += sizeof(*s);
630 			remain -= sizeof(*s);
631 			if (remain < s->name_len) {
632 				err = got_error(GOT_ERR_PRIVSEP_LEN);
633 				goto done;
634 			}
635 			name = strndup(imsg.data + off, s->name_len);
636 			if (name == NULL) {
637 				err = got_error_from_errno("strndup");
638 				goto done;
639 			}
640 			off += s->name_len;
641 			remain -= s->name_len;
642 			if (remain < s->target_len) {
643 				err = got_error(GOT_ERR_PRIVSEP_LEN);
644 				free(name);
645 				goto done;
646 			}
647 			target = strndup(imsg.data + off, s->target_len);
648 			if (target == NULL) {
649 				err = got_error_from_errno("strndup");
650 				free(name);
651 				goto done;
652 			}
653 			off += s->target_len;
654 			remain -= s->target_len;
655 			err = got_pathlist_append(symrefs, name, target);
656 			if (err) {
657 				free(name);
658 				free(target);
659 				goto done;
660 			}
661 		}
662 		break;
663 	case GOT_IMSG_FETCH_PROGRESS:
664 		*id = malloc(sizeof(**id));
665 		if (*id == NULL) {
666 			err = got_error_from_errno("malloc");
667 			break;
668 		}
669 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
670 		if (datalen <= SHA1_DIGEST_LENGTH) {
671 			err = got_error(GOT_ERR_PRIVSEP_MSG);
672 			break;
673 		}
674 		*refname = strndup(imsg.data + SHA1_DIGEST_LENGTH,
675 		    datalen - SHA1_DIGEST_LENGTH);
676 		if (*refname == NULL) {
677 			err = got_error_from_errno("strndup");
678 			break;
679 		}
680 		break;
681 	case GOT_IMSG_FETCH_DONE:
682 		*id = malloc(sizeof(**id));
683 		if (*id == NULL) {
684 			err = got_error_from_errno("malloc");
685 			break;
686 		}
687 		if (datalen != SHA1_DIGEST_LENGTH) {
688 			err = got_error(GOT_ERR_PRIVSEP_MSG);
689 			break;
690 		}
691 		memcpy((*id)->sha1, imsg.data, SHA1_DIGEST_LENGTH);
692 		*done = 1;
693 		break;
694 	default:
695 		err = got_error(GOT_ERR_PRIVSEP_MSG);
696 		break;
697 	}
698 done:
699 	if (err) {
700 		free(*id);
701 		*id = NULL;
702 		free(*refname);
703 		*refname = NULL;
704 	}
705 	imsg_free(&imsg);
706 	return err;
707 }
708 
709 const struct got_error *
710 got_privsep_send_index_pack_req(struct imsgbuf *ibuf, int fd, struct got_object_id *hash)
711 {
712 	const struct got_error *err = NULL;
713 
714 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_REQUEST, 0, 0, fd,
715 	    hash->sha1, SHA1_DIGEST_LENGTH) == -1) {
716 		err = got_error_from_errno("imsg_compose INDEX_REQUEST");
717 		close(fd);
718 		return err;
719 	}
720 	return flush_imsg(ibuf);
721 }
722 
723 const struct got_error *
724 got_privsep_send_index_pack_done(struct imsgbuf *ibuf)
725 {
726 	if (imsg_compose(ibuf, GOT_IMSG_IDXPACK_DONE, 0, 0, -1, NULL, 0) == -1)
727 		return got_error_from_errno("imsg_compose FETCH");
728 	return flush_imsg(ibuf);
729 }
730 
731 const struct got_error *
732 got_privsep_wait_index_pack_done(struct imsgbuf *ibuf)
733 {
734 	const struct got_error *err = NULL;
735 	struct imsg imsg;
736 
737 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
738 	if (err)
739 		return err;
740 	if (imsg.hdr.type == GOT_IMSG_IDXPACK_DONE)
741 		return NULL;
742 	else
743 		return got_error(GOT_ERR_PRIVSEP_MSG);
744 	imsg_free(&imsg);
745 }
746 
747 const struct got_error *
748 got_privsep_get_imsg_obj(struct got_object **obj, struct imsg *imsg,
749     struct imsgbuf *ibuf)
750 {
751 	const struct got_error *err = NULL;
752 	struct got_imsg_object *iobj;
753 	size_t datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
754 
755 	if (datalen != sizeof(*iobj))
756 		return got_error(GOT_ERR_PRIVSEP_LEN);
757 	iobj = imsg->data;
758 
759 	*obj = calloc(1, sizeof(**obj));
760 	if (*obj == NULL)
761 		return got_error_from_errno("calloc");
762 
763 	memcpy((*obj)->id.sha1, iobj->id, SHA1_DIGEST_LENGTH);
764 	(*obj)->type = iobj->type;
765 	(*obj)->flags = iobj->flags;
766 	(*obj)->hdrlen = iobj->hdrlen;
767 	(*obj)->size = iobj->size;
768 	/* path_packfile is handled by caller */
769 	if (iobj->flags & GOT_OBJ_FLAG_PACKED) {
770 		(*obj)->pack_offset = iobj->pack_offset;
771 		(*obj)->pack_idx = iobj->pack_idx;
772 	}
773 
774 	return err;
775 }
776 
777 const struct got_error *
778 got_privsep_recv_obj(struct got_object **obj, struct imsgbuf *ibuf)
779 {
780 	const struct got_error *err = NULL;
781 	struct imsg imsg;
782 	const size_t min_datalen =
783 	    MIN(sizeof(struct got_imsg_error), sizeof(struct got_imsg_object));
784 
785 	*obj = NULL;
786 
787 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
788 	if (err)
789 		return err;
790 
791 	switch (imsg.hdr.type) {
792 	case GOT_IMSG_OBJECT:
793 		err = got_privsep_get_imsg_obj(obj, &imsg, ibuf);
794 		break;
795 	default:
796 		err = got_error(GOT_ERR_PRIVSEP_MSG);
797 		break;
798 	}
799 
800 	imsg_free(&imsg);
801 
802 	return err;
803 }
804 
805 static const struct got_error *
806 send_commit_logmsg(struct imsgbuf *ibuf, struct got_commit_object *commit,
807     size_t logmsg_len)
808 {
809 	const struct got_error *err = NULL;
810 	size_t offset, remain;
811 
812 	offset = 0;
813 	remain = logmsg_len;
814 	while (remain > 0) {
815 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
816 
817 		if (imsg_compose(ibuf, GOT_IMSG_COMMIT_LOGMSG, 0, 0, -1,
818 		    commit->logmsg + offset, n) == -1) {
819 			err = got_error_from_errno("imsg_compose "
820 			    "COMMIT_LOGMSG");
821 			break;
822 		}
823 
824 		err = flush_imsg(ibuf);
825 		if (err)
826 			break;
827 
828 		offset += n;
829 		remain -= n;
830 	}
831 
832 	return err;
833 }
834 
835 const struct got_error *
836 got_privsep_send_commit(struct imsgbuf *ibuf, struct got_commit_object *commit)
837 {
838 	const struct got_error *err = NULL;
839 	struct got_imsg_commit_object *icommit;
840 	uint8_t *buf;
841 	size_t len, total;
842 	struct got_object_qid *qid;
843 	size_t author_len = strlen(commit->author);
844 	size_t committer_len = strlen(commit->committer);
845 	size_t logmsg_len = strlen(commit->logmsg);
846 
847 	total = sizeof(*icommit) + author_len + committer_len +
848 	    commit->nparents * SHA1_DIGEST_LENGTH;
849 
850 	buf = malloc(total);
851 	if (buf == NULL)
852 		return got_error_from_errno("malloc");
853 
854 	icommit = (struct got_imsg_commit_object *)buf;
855 	memcpy(icommit->tree_id, commit->tree_id->sha1,
856 	    sizeof(icommit->tree_id));
857 	icommit->author_len = author_len;
858 	icommit->author_time = commit->author_time;
859 	icommit->author_gmtoff = commit->author_gmtoff;
860 	icommit->committer_len = committer_len;
861 	icommit->committer_time = commit->committer_time;
862 	icommit->committer_gmtoff = commit->committer_gmtoff;
863 	icommit->logmsg_len = logmsg_len;
864 	icommit->nparents = commit->nparents;
865 
866 	len = sizeof(*icommit);
867 	memcpy(buf + len, commit->author, author_len);
868 	len += author_len;
869 	memcpy(buf + len, commit->committer, committer_len);
870 	len += committer_len;
871 	SIMPLEQ_FOREACH(qid, &commit->parent_ids, entry) {
872 		memcpy(buf + len, qid->id, SHA1_DIGEST_LENGTH);
873 		len += SHA1_DIGEST_LENGTH;
874 	}
875 
876 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT, 0, 0, -1, buf, len) == -1) {
877 		err = got_error_from_errno("imsg_compose COMMIT");
878 		goto done;
879 	}
880 
881 	if (logmsg_len == 0 ||
882 	    logmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
883 		err = flush_imsg(ibuf);
884 		if (err)
885 			goto done;
886 	}
887 	err = send_commit_logmsg(ibuf, commit, logmsg_len);
888 done:
889 	free(buf);
890 	return err;
891 }
892 
893 static const struct got_error *
894 get_commit_from_imsg(struct got_commit_object **commit,
895     struct imsg *imsg, size_t datalen, struct imsgbuf *ibuf)
896 {
897 	const struct got_error *err = NULL;
898 	struct got_imsg_commit_object *icommit;
899 	size_t len = 0;
900 	int i;
901 
902 	if (datalen < sizeof(*icommit))
903 		return got_error(GOT_ERR_PRIVSEP_LEN);
904 
905 	icommit = imsg->data;
906 	if (datalen != sizeof(*icommit) + icommit->author_len +
907 	    icommit->committer_len +
908 	    icommit->nparents * SHA1_DIGEST_LENGTH)
909 		return got_error(GOT_ERR_PRIVSEP_LEN);
910 
911 	if (icommit->nparents < 0)
912 		return got_error(GOT_ERR_PRIVSEP_LEN);
913 
914 	len += sizeof(*icommit);
915 
916 	*commit = got_object_commit_alloc_partial();
917 	if (*commit == NULL)
918 		return got_error_from_errno(
919 		    "got_object_commit_alloc_partial");
920 
921 	memcpy((*commit)->tree_id->sha1, icommit->tree_id,
922 	    SHA1_DIGEST_LENGTH);
923 	(*commit)->author_time = icommit->author_time;
924 	(*commit)->author_gmtoff = icommit->author_gmtoff;
925 	(*commit)->committer_time = icommit->committer_time;
926 	(*commit)->committer_gmtoff = icommit->committer_gmtoff;
927 
928 	if (icommit->author_len == 0) {
929 		(*commit)->author = strdup("");
930 		if ((*commit)->author == NULL) {
931 			err = got_error_from_errno("strdup");
932 			goto done;
933 		}
934 	} else {
935 		(*commit)->author = malloc(icommit->author_len + 1);
936 		if ((*commit)->author == NULL) {
937 			err = got_error_from_errno("malloc");
938 			goto done;
939 		}
940 		memcpy((*commit)->author, imsg->data + len,
941 		    icommit->author_len);
942 		(*commit)->author[icommit->author_len] = '\0';
943 	}
944 	len += icommit->author_len;
945 
946 	if (icommit->committer_len == 0) {
947 		(*commit)->committer = strdup("");
948 		if ((*commit)->committer == NULL) {
949 			err = got_error_from_errno("strdup");
950 			goto done;
951 		}
952 	} else {
953 		(*commit)->committer =
954 		    malloc(icommit->committer_len + 1);
955 		if ((*commit)->committer == NULL) {
956 			err = got_error_from_errno("malloc");
957 			goto done;
958 		}
959 		memcpy((*commit)->committer, imsg->data + len,
960 		    icommit->committer_len);
961 		(*commit)->committer[icommit->committer_len] = '\0';
962 	}
963 	len += icommit->committer_len;
964 
965 	if (icommit->logmsg_len == 0) {
966 		(*commit)->logmsg = strdup("");
967 		if ((*commit)->logmsg == NULL) {
968 			err = got_error_from_errno("strdup");
969 			goto done;
970 		}
971 	} else {
972 		size_t offset = 0, remain = icommit->logmsg_len;
973 
974 		(*commit)->logmsg = malloc(icommit->logmsg_len + 1);
975 		if ((*commit)->logmsg == NULL) {
976 			err = got_error_from_errno("malloc");
977 			goto done;
978 		}
979 		while (remain > 0) {
980 			struct imsg imsg_log;
981 			size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
982 			    remain);
983 
984 			err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
985 			if (err)
986 				goto done;
987 
988 			if (imsg_log.hdr.type != GOT_IMSG_COMMIT_LOGMSG) {
989 				err = got_error(GOT_ERR_PRIVSEP_MSG);
990 				goto done;
991 			}
992 
993 			memcpy((*commit)->logmsg + offset,
994 			    imsg_log.data, n);
995 			imsg_free(&imsg_log);
996 			offset += n;
997 			remain -= n;
998 		}
999 		(*commit)->logmsg[icommit->logmsg_len] = '\0';
1000 	}
1001 
1002 	for (i = 0; i < icommit->nparents; i++) {
1003 		struct got_object_qid *qid;
1004 
1005 		err = got_object_qid_alloc_partial(&qid);
1006 		if (err)
1007 			break;
1008 		memcpy(qid->id, imsg->data + len +
1009 		    i * SHA1_DIGEST_LENGTH, sizeof(*qid->id));
1010 		SIMPLEQ_INSERT_TAIL(&(*commit)->parent_ids, qid, entry);
1011 		(*commit)->nparents++;
1012 	}
1013 done:
1014 	if (err) {
1015 		got_object_commit_close(*commit);
1016 		*commit = NULL;
1017 	}
1018 	return err;
1019 }
1020 
1021 const struct got_error *
1022 got_privsep_recv_commit(struct got_commit_object **commit, struct imsgbuf *ibuf)
1023 {
1024 	const struct got_error *err = NULL;
1025 	struct imsg imsg;
1026 	size_t datalen;
1027 	const size_t min_datalen =
1028 	    MIN(sizeof(struct got_imsg_error),
1029 	    sizeof(struct got_imsg_commit_object));
1030 
1031 	*commit = NULL;
1032 
1033 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1034 	if (err)
1035 		return err;
1036 
1037 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1038 
1039 	switch (imsg.hdr.type) {
1040 	case GOT_IMSG_COMMIT:
1041 		err = get_commit_from_imsg(commit, &imsg, datalen, ibuf);
1042 		break;
1043 	default:
1044 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1045 		break;
1046 	}
1047 
1048 	imsg_free(&imsg);
1049 
1050 	return err;
1051 }
1052 
1053 const struct got_error *
1054 got_privsep_send_tree(struct imsgbuf *ibuf, struct got_pathlist_head *entries,
1055     int nentries)
1056 {
1057 	const struct got_error *err = NULL;
1058 	struct got_imsg_tree_object itree;
1059 	struct got_pathlist_entry *pe;
1060 	size_t totlen;
1061 	int nimsg; /* number of imsg queued in ibuf */
1062 
1063 	itree.nentries = nentries;
1064 	if (imsg_compose(ibuf, GOT_IMSG_TREE, 0, 0, -1, &itree, sizeof(itree))
1065 	    == -1)
1066 		return got_error_from_errno("imsg_compose TREE");
1067 
1068 	totlen = sizeof(itree);
1069 	nimsg = 1;
1070 	TAILQ_FOREACH(pe, entries, entry) {
1071 		const char *name = pe->path;
1072 		struct got_parsed_tree_entry *pte = pe->data;
1073 		struct ibuf *wbuf;
1074 		size_t namelen = strlen(name);
1075 		size_t len = sizeof(struct got_imsg_tree_entry) + namelen;
1076 
1077 		if (len > MAX_IMSGSIZE)
1078 			return got_error(GOT_ERR_NO_SPACE);
1079 
1080 		nimsg++;
1081 		if (totlen + len >= MAX_IMSGSIZE - (IMSG_HEADER_SIZE * nimsg)) {
1082 			err = flush_imsg(ibuf);
1083 			if (err)
1084 				return err;
1085 			nimsg = 0;
1086 		}
1087 
1088 		wbuf = imsg_create(ibuf, GOT_IMSG_TREE_ENTRY, 0, 0, len);
1089 		if (wbuf == NULL)
1090 			return got_error_from_errno("imsg_create TREE_ENTRY");
1091 
1092 		/* Keep in sync with struct got_imsg_tree_object definition! */
1093 		if (imsg_add(wbuf, pte->id, SHA1_DIGEST_LENGTH) == -1) {
1094 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1095 			ibuf_free(wbuf);
1096 			return err;
1097 		}
1098 		if (imsg_add(wbuf, &pte->mode, sizeof(pte->mode)) == -1) {
1099 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1100 			ibuf_free(wbuf);
1101 			return err;
1102 		}
1103 
1104 		if (imsg_add(wbuf, name, namelen) == -1) {
1105 			err = got_error_from_errno("imsg_add TREE_ENTRY");
1106 			ibuf_free(wbuf);
1107 			return err;
1108 		}
1109 
1110 		wbuf->fd = -1;
1111 		imsg_close(ibuf, wbuf);
1112 
1113 		totlen += len;
1114 	}
1115 
1116 	return flush_imsg(ibuf);
1117 }
1118 
1119 const struct got_error *
1120 got_privsep_recv_tree(struct got_tree_object **tree, struct imsgbuf *ibuf)
1121 {
1122 	const struct got_error *err = NULL;
1123 	const size_t min_datalen =
1124 	    MIN(sizeof(struct got_imsg_error),
1125 	    sizeof(struct got_imsg_tree_object));
1126 	struct got_imsg_tree_object *itree;
1127 	int nentries = 0;
1128 
1129 	*tree = NULL;
1130 get_more:
1131 	err = read_imsg(ibuf);
1132 	if (err)
1133 		goto done;
1134 
1135 	for (;;) {
1136 		struct imsg imsg;
1137 		size_t n;
1138 		size_t datalen;
1139 		struct got_imsg_tree_entry *ite;
1140 		struct got_tree_entry *te = NULL;
1141 
1142 		n = imsg_get(ibuf, &imsg);
1143 		if (n == 0) {
1144 			if (*tree && (*tree)->nentries != nentries)
1145 				goto get_more;
1146 			break;
1147 		}
1148 
1149 		if (imsg.hdr.len < IMSG_HEADER_SIZE + min_datalen)
1150 			return got_error(GOT_ERR_PRIVSEP_LEN);
1151 
1152 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1153 
1154 		switch (imsg.hdr.type) {
1155 		case GOT_IMSG_ERROR:
1156 			err = recv_imsg_error(&imsg, datalen);
1157 			break;
1158 		case GOT_IMSG_TREE:
1159 			/* This message should only appear once. */
1160 			if (*tree != NULL) {
1161 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1162 				break;
1163 			}
1164 			if (datalen != sizeof(*itree)) {
1165 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1166 				break;
1167 			}
1168 			itree = imsg.data;
1169 			*tree = malloc(sizeof(**tree));
1170 			if (*tree == NULL) {
1171 				err = got_error_from_errno("malloc");
1172 				break;
1173 			}
1174 			(*tree)->entries = calloc(itree->nentries,
1175 			    sizeof(struct got_tree_entry));
1176 			if ((*tree)->entries == NULL) {
1177 				err = got_error_from_errno("malloc");
1178 				break;
1179 			}
1180 			(*tree)->nentries = itree->nentries;
1181 			(*tree)->refcnt = 0;
1182 			break;
1183 		case GOT_IMSG_TREE_ENTRY:
1184 			/* This message should be preceeded by GOT_IMSG_TREE. */
1185 			if (*tree == NULL) {
1186 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1187 				break;
1188 			}
1189 			if (datalen < sizeof(*ite) || datalen > MAX_IMSGSIZE) {
1190 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1191 				break;
1192 			}
1193 
1194 			/* Remaining data contains the entry's name. */
1195 			datalen -= sizeof(*ite);
1196 			if (datalen == 0 || datalen > MAX_IMSGSIZE) {
1197 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1198 				break;
1199 			}
1200 			ite = imsg.data;
1201 
1202 			if (datalen + 1 > sizeof(te->name)) {
1203 				err = got_error(GOT_ERR_NO_SPACE);
1204 				break;
1205 			}
1206 			te = &(*tree)->entries[nentries];
1207 			memcpy(te->name, imsg.data + sizeof(*ite), datalen);
1208 			te->name[datalen] = '\0';
1209 
1210 			memcpy(te->id.sha1, ite->id, SHA1_DIGEST_LENGTH);
1211 			te->mode = ite->mode;
1212 			te->idx = nentries;
1213 			nentries++;
1214 			break;
1215 		default:
1216 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1217 			break;
1218 		}
1219 
1220 		imsg_free(&imsg);
1221 	}
1222 done:
1223 	if (*tree && (*tree)->nentries != nentries) {
1224 		if (err == NULL)
1225 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1226 		got_object_tree_close(*tree);
1227 		*tree = NULL;
1228 	}
1229 
1230 	return err;
1231 }
1232 
1233 const struct got_error *
1234 got_privsep_send_blob(struct imsgbuf *ibuf, size_t size, size_t hdrlen,
1235     const uint8_t *data)
1236 {
1237 	struct got_imsg_blob iblob;
1238 
1239 	iblob.size = size;
1240 	iblob.hdrlen = hdrlen;
1241 
1242 	if (data) {
1243 		uint8_t *buf;
1244 
1245 		if (size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX)
1246 			return got_error(GOT_ERR_NO_SPACE);
1247 
1248 		buf = malloc(sizeof(iblob) + size);
1249 		if (buf == NULL)
1250 			return got_error_from_errno("malloc");
1251 
1252 		memcpy(buf, &iblob, sizeof(iblob));
1253 		memcpy(buf + sizeof(iblob), data, size);
1254 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, buf,
1255 		   sizeof(iblob) + size) == -1) {
1256 			free(buf);
1257 			return got_error_from_errno("imsg_compose BLOB");
1258 		}
1259 		free(buf);
1260 	} else {
1261 		/* Data has already been written to file descriptor. */
1262 		if (imsg_compose(ibuf, GOT_IMSG_BLOB, 0, 0, -1, &iblob,
1263 		    sizeof(iblob)) == -1)
1264 			return got_error_from_errno("imsg_compose BLOB");
1265 	}
1266 
1267 
1268 	return flush_imsg(ibuf);
1269 }
1270 
1271 const struct got_error *
1272 got_privsep_recv_blob(uint8_t **outbuf, size_t *size, size_t *hdrlen,
1273     struct imsgbuf *ibuf)
1274 {
1275 	const struct got_error *err = NULL;
1276 	struct imsg imsg;
1277 	struct got_imsg_blob *iblob;
1278 	size_t datalen;
1279 
1280 	*outbuf = NULL;
1281 
1282 	err = got_privsep_recv_imsg(&imsg, ibuf, 0);
1283 	if (err)
1284 		return err;
1285 
1286 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1287 
1288 	switch (imsg.hdr.type) {
1289 	case GOT_IMSG_BLOB:
1290 		if (datalen < sizeof(*iblob)) {
1291 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1292 			break;
1293 		}
1294 		iblob = imsg.data;
1295 		*size = iblob->size;
1296 		*hdrlen = iblob->hdrlen;
1297 
1298 		if (datalen == sizeof(*iblob)) {
1299 			/* Data has been written to file descriptor. */
1300 			break;
1301 		}
1302 
1303 		if (*size > GOT_PRIVSEP_INLINE_BLOB_DATA_MAX) {
1304 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1305 			break;
1306 		}
1307 
1308 		*outbuf = malloc(*size);
1309 		if (*outbuf == NULL) {
1310 			err = got_error_from_errno("malloc");
1311 			break;
1312 		}
1313 		memcpy(*outbuf, imsg.data + sizeof(*iblob), *size);
1314 		break;
1315 	default:
1316 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1317 		break;
1318 	}
1319 
1320 	imsg_free(&imsg);
1321 
1322 	return err;
1323 }
1324 
1325 static const struct got_error *
1326 send_tagmsg(struct imsgbuf *ibuf, struct got_tag_object *tag, size_t tagmsg_len)
1327 {
1328 	const struct got_error *err = NULL;
1329 	size_t offset, remain;
1330 
1331 	offset = 0;
1332 	remain = tagmsg_len;
1333 	while (remain > 0) {
1334 		size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE, remain);
1335 
1336 		if (imsg_compose(ibuf, GOT_IMSG_TAG_TAGMSG, 0, 0, -1,
1337 		    tag->tagmsg + offset, n) == -1) {
1338 			err = got_error_from_errno("imsg_compose TAG_TAGMSG");
1339 			break;
1340 		}
1341 
1342 		err = flush_imsg(ibuf);
1343 		if (err)
1344 			break;
1345 
1346 		offset += n;
1347 		remain -= n;
1348 	}
1349 
1350 	return err;
1351 }
1352 
1353 const struct got_error *
1354 got_privsep_send_tag(struct imsgbuf *ibuf, struct got_tag_object *tag)
1355 {
1356 	const struct got_error *err = NULL;
1357 	struct got_imsg_tag_object *itag;
1358 	uint8_t *buf;
1359 	size_t len, total;
1360 	size_t tag_len = strlen(tag->tag);
1361 	size_t tagger_len = strlen(tag->tagger);
1362 	size_t tagmsg_len = strlen(tag->tagmsg);
1363 
1364 	total = sizeof(*itag) + tag_len + tagger_len + tagmsg_len;
1365 
1366 	buf = malloc(total);
1367 	if (buf == NULL)
1368 		return got_error_from_errno("malloc");
1369 
1370 	itag = (struct got_imsg_tag_object *)buf;
1371 	memcpy(itag->id, tag->id.sha1, sizeof(itag->id));
1372 	itag->obj_type = tag->obj_type;
1373 	itag->tag_len = tag_len;
1374 	itag->tagger_len = tagger_len;
1375 	itag->tagger_time = tag->tagger_time;
1376 	itag->tagger_gmtoff = tag->tagger_gmtoff;
1377 	itag->tagmsg_len = tagmsg_len;
1378 
1379 	len = sizeof(*itag);
1380 	memcpy(buf + len, tag->tag, tag_len);
1381 	len += tag_len;
1382 	memcpy(buf + len, tag->tagger, tagger_len);
1383 	len += tagger_len;
1384 
1385 	if (imsg_compose(ibuf, GOT_IMSG_TAG, 0, 0, -1, buf, len) == -1) {
1386 		err = got_error_from_errno("imsg_compose TAG");
1387 		goto done;
1388 	}
1389 
1390 	if (tagmsg_len == 0 ||
1391 	    tagmsg_len + len > MAX_IMSGSIZE - IMSG_HEADER_SIZE) {
1392 		err = flush_imsg(ibuf);
1393 		if (err)
1394 			goto done;
1395 	}
1396 	err = send_tagmsg(ibuf, tag, tagmsg_len);
1397 done:
1398 	free(buf);
1399 	return err;
1400 }
1401 
1402 const struct got_error *
1403 got_privsep_recv_tag(struct got_tag_object **tag, struct imsgbuf *ibuf)
1404 {
1405 	const struct got_error *err = NULL;
1406 	struct imsg imsg;
1407 	struct got_imsg_tag_object *itag;
1408 	size_t len, datalen;
1409 	const size_t min_datalen =
1410 	    MIN(sizeof(struct got_imsg_error),
1411 	    sizeof(struct got_imsg_tag_object));
1412 
1413 	*tag = NULL;
1414 
1415 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1416 	if (err)
1417 		return err;
1418 
1419 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1420 	len = 0;
1421 
1422 	switch (imsg.hdr.type) {
1423 	case GOT_IMSG_TAG:
1424 		if (datalen < sizeof(*itag)) {
1425 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1426 			break;
1427 		}
1428 		itag = imsg.data;
1429 		if (datalen != sizeof(*itag) + itag->tag_len +
1430 		    itag->tagger_len) {
1431 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1432 			break;
1433 		}
1434 		len += sizeof(*itag);
1435 
1436 		*tag = calloc(1, sizeof(**tag));
1437 		if (*tag == NULL) {
1438 			err = got_error_from_errno("calloc");
1439 			break;
1440 		}
1441 
1442 		memcpy((*tag)->id.sha1, itag->id, SHA1_DIGEST_LENGTH);
1443 
1444 		if (itag->tag_len == 0) {
1445 			(*tag)->tag = strdup("");
1446 			if ((*tag)->tag == NULL) {
1447 				err = got_error_from_errno("strdup");
1448 				break;
1449 			}
1450 		} else {
1451 			(*tag)->tag = malloc(itag->tag_len + 1);
1452 			if ((*tag)->tag == NULL) {
1453 				err = got_error_from_errno("malloc");
1454 				break;
1455 			}
1456 			memcpy((*tag)->tag, imsg.data + len,
1457 			    itag->tag_len);
1458 			(*tag)->tag[itag->tag_len] = '\0';
1459 		}
1460 		len += itag->tag_len;
1461 
1462 		(*tag)->obj_type = itag->obj_type;
1463 		(*tag)->tagger_time = itag->tagger_time;
1464 		(*tag)->tagger_gmtoff = itag->tagger_gmtoff;
1465 
1466 		if (itag->tagger_len == 0) {
1467 			(*tag)->tagger = strdup("");
1468 			if ((*tag)->tagger == NULL) {
1469 				err = got_error_from_errno("strdup");
1470 				break;
1471 			}
1472 		} else {
1473 			(*tag)->tagger = malloc(itag->tagger_len + 1);
1474 			if ((*tag)->tagger == NULL) {
1475 				err = got_error_from_errno("malloc");
1476 				break;
1477 			}
1478 			memcpy((*tag)->tagger, imsg.data + len,
1479 			    itag->tagger_len);
1480 			(*tag)->tagger[itag->tagger_len] = '\0';
1481 		}
1482 		len += itag->tagger_len;
1483 
1484 		if (itag->tagmsg_len == 0) {
1485 			(*tag)->tagmsg = strdup("");
1486 			if ((*tag)->tagmsg == NULL) {
1487 				err = got_error_from_errno("strdup");
1488 				break;
1489 			}
1490 		} else {
1491 			size_t offset = 0, remain = itag->tagmsg_len;
1492 
1493 			(*tag)->tagmsg = malloc(itag->tagmsg_len + 1);
1494 			if ((*tag)->tagmsg == NULL) {
1495 				err = got_error_from_errno("malloc");
1496 				break;
1497 			}
1498 			while (remain > 0) {
1499 				struct imsg imsg_log;
1500 				size_t n = MIN(MAX_IMSGSIZE - IMSG_HEADER_SIZE,
1501 				    remain);
1502 
1503 				err = got_privsep_recv_imsg(&imsg_log, ibuf, n);
1504 				if (err)
1505 					return err;
1506 
1507 				if (imsg_log.hdr.type != GOT_IMSG_TAG_TAGMSG)
1508 					return got_error(GOT_ERR_PRIVSEP_MSG);
1509 
1510 				memcpy((*tag)->tagmsg + offset, imsg_log.data,
1511 				    n);
1512 				imsg_free(&imsg_log);
1513 				offset += n;
1514 				remain -= n;
1515 			}
1516 			(*tag)->tagmsg[itag->tagmsg_len] = '\0';
1517 		}
1518 
1519 		break;
1520 	default:
1521 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1522 		break;
1523 	}
1524 
1525 	imsg_free(&imsg);
1526 
1527 	return err;
1528 }
1529 
1530 const struct got_error *
1531 got_privsep_init_pack_child(struct imsgbuf *ibuf, struct got_pack *pack,
1532     struct got_packidx *packidx)
1533 {
1534 	const struct got_error *err = NULL;
1535 	struct got_imsg_packidx ipackidx;
1536 	struct got_imsg_pack ipack;
1537 	int fd;
1538 
1539 	ipackidx.len = packidx->len;
1540 	fd = dup(packidx->fd);
1541 	if (fd == -1)
1542 		return got_error_from_errno("dup");
1543 
1544 	if (imsg_compose(ibuf, GOT_IMSG_PACKIDX, 0, 0, fd, &ipackidx,
1545 	    sizeof(ipackidx)) == -1) {
1546 		err = got_error_from_errno("imsg_compose PACKIDX");
1547 		close(fd);
1548 		return err;
1549 	}
1550 
1551 	if (strlcpy(ipack.path_packfile, pack->path_packfile,
1552 	    sizeof(ipack.path_packfile)) >= sizeof(ipack.path_packfile))
1553 		return got_error(GOT_ERR_NO_SPACE);
1554 	ipack.filesize = pack->filesize;
1555 
1556 	fd = dup(pack->fd);
1557 	if (fd == -1)
1558 		return got_error_from_errno("dup");
1559 
1560 	if (imsg_compose(ibuf, GOT_IMSG_PACK, 0, 0, fd, &ipack, sizeof(ipack))
1561 	    == -1) {
1562 		err = got_error_from_errno("imsg_compose PACK");
1563 		close(fd);
1564 		return err;
1565 	}
1566 
1567 	return flush_imsg(ibuf);
1568 }
1569 
1570 const struct got_error *
1571 got_privsep_send_packed_obj_req(struct imsgbuf *ibuf, int idx,
1572     struct got_object_id *id)
1573 {
1574 	struct got_imsg_packed_object iobj;
1575 
1576 	iobj.idx = idx;
1577 	memcpy(iobj.id, id->sha1, sizeof(iobj.id));
1578 
1579 	if (imsg_compose(ibuf, GOT_IMSG_PACKED_OBJECT_REQUEST, 0, 0, -1,
1580 	    &iobj, sizeof(iobj)) == -1)
1581 		return got_error_from_errno("imsg_compose "
1582 		    "PACKED_OBJECT_REQUEST");
1583 
1584 	return flush_imsg(ibuf);
1585 }
1586 
1587 const struct got_error *
1588 got_privsep_send_gitconfig_parse_req(struct imsgbuf *ibuf, int fd)
1589 {
1590 	const struct got_error *err = NULL;
1591 
1592 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_PARSE_REQUEST, 0, 0, fd,
1593 	    NULL, 0) == -1) {
1594 		err = got_error_from_errno("imsg_compose "
1595 		    "GITCONFIG_PARSE_REQUEST");
1596 		close(fd);
1597 		return err;
1598 	}
1599 
1600 	return flush_imsg(ibuf);
1601 }
1602 
1603 const struct got_error *
1604 got_privsep_send_gitconfig_repository_format_version_req(struct imsgbuf *ibuf)
1605 {
1606 	if (imsg_compose(ibuf,
1607 	    GOT_IMSG_GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST, 0, 0, -1,
1608 	    NULL, 0) == -1)
1609 		return got_error_from_errno("imsg_compose "
1610 		    "GITCONFIG_REPOSITORY_FORMAT_VERSION_REQUEST");
1611 
1612 	return flush_imsg(ibuf);
1613 }
1614 
1615 const struct got_error *
1616 got_privsep_send_gitconfig_author_name_req(struct imsgbuf *ibuf)
1617 {
1618 	if (imsg_compose(ibuf,
1619 	    GOT_IMSG_GITCONFIG_AUTHOR_NAME_REQUEST, 0, 0, -1, NULL, 0) == -1)
1620 		return got_error_from_errno("imsg_compose "
1621 		    "GITCONFIG_AUTHOR_NAME_REQUEST");
1622 
1623 	return flush_imsg(ibuf);
1624 }
1625 
1626 const struct got_error *
1627 got_privsep_send_gitconfig_author_email_req(struct imsgbuf *ibuf)
1628 {
1629 	if (imsg_compose(ibuf,
1630 	    GOT_IMSG_GITCONFIG_AUTHOR_EMAIL_REQUEST, 0, 0, -1, NULL, 0) == -1)
1631 		return got_error_from_errno("imsg_compose "
1632 		    "GITCONFIG_AUTHOR_EMAIL_REQUEST");
1633 
1634 	return flush_imsg(ibuf);
1635 }
1636 
1637 const struct got_error *
1638 got_privsep_send_gitconfig_remotes_req(struct imsgbuf *ibuf)
1639 {
1640 	if (imsg_compose(ibuf,
1641 	    GOT_IMSG_GITCONFIG_REMOTES_REQUEST, 0, 0, -1, NULL, 0) == -1)
1642 		return got_error_from_errno("imsg_compose "
1643 		    "GITCONFIG_REMOTE_REQUEST");
1644 
1645 	return flush_imsg(ibuf);
1646 }
1647 
1648 const struct got_error *
1649 got_privsep_send_gitconfig_owner_req(struct imsgbuf *ibuf)
1650 {
1651 	if (imsg_compose(ibuf,
1652 	    GOT_IMSG_GITCONFIG_OWNER_REQUEST, 0, 0, -1, NULL, 0) == -1)
1653 		return got_error_from_errno("imsg_compose "
1654 		    "GITCONFIG_OWNER_REQUEST");
1655 
1656 	return flush_imsg(ibuf);
1657 }
1658 
1659 const struct got_error *
1660 got_privsep_send_gitconfig_str(struct imsgbuf *ibuf, const char *value)
1661 {
1662 	size_t len = value ? strlen(value) + 1 : 0;
1663 
1664 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_STR_VAL, 0, 0, -1,
1665 	    value, len) == -1)
1666 		return got_error_from_errno("imsg_compose GITCONFIG_STR_VAL");
1667 
1668 	return flush_imsg(ibuf);
1669 }
1670 
1671 const struct got_error *
1672 got_privsep_recv_gitconfig_str(char **str, struct imsgbuf *ibuf)
1673 {
1674 	const struct got_error *err = NULL;
1675 	struct imsg imsg;
1676 	size_t datalen;
1677 	const size_t min_datalen = 0;
1678 
1679 	*str = NULL;
1680 
1681 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1682 	if (err)
1683 		return err;
1684 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1685 
1686 	switch (imsg.hdr.type) {
1687 	case GOT_IMSG_GITCONFIG_STR_VAL:
1688 		if (datalen == 0)
1689 			break;
1690 		*str = malloc(datalen);
1691 		if (*str == NULL) {
1692 			err = got_error_from_errno("malloc");
1693 			break;
1694 		}
1695 		if (strlcpy(*str, imsg.data, datalen) >= datalen)
1696 			err = got_error(GOT_ERR_NO_SPACE);
1697 		break;
1698 	default:
1699 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1700 		break;
1701 	}
1702 
1703 	imsg_free(&imsg);
1704 	return err;
1705 }
1706 
1707 const struct got_error *
1708 got_privsep_send_gitconfig_int(struct imsgbuf *ibuf, int value)
1709 {
1710 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_INT_VAL, 0, 0, -1,
1711 	    &value, sizeof(value)) == -1)
1712 		return got_error_from_errno("imsg_compose GITCONFIG_INT_VAL");
1713 
1714 	return flush_imsg(ibuf);
1715 }
1716 
1717 const struct got_error *
1718 got_privsep_recv_gitconfig_int(int *val, struct imsgbuf *ibuf)
1719 {
1720 	const struct got_error *err = NULL;
1721 	struct imsg imsg;
1722 	size_t datalen;
1723 	const size_t min_datalen =
1724 	    MIN(sizeof(struct got_imsg_error), sizeof(int));
1725 
1726 	*val = 0;
1727 
1728 	err = got_privsep_recv_imsg(&imsg, ibuf, min_datalen);
1729 	if (err)
1730 		return err;
1731 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1732 
1733 	switch (imsg.hdr.type) {
1734 	case GOT_IMSG_GITCONFIG_INT_VAL:
1735 		if (datalen != sizeof(*val)) {
1736 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1737 			break;
1738 		}
1739 		memcpy(val, imsg.data, sizeof(*val));
1740 		break;
1741 	default:
1742 		err = got_error(GOT_ERR_PRIVSEP_MSG);
1743 		break;
1744 	}
1745 
1746 	imsg_free(&imsg);
1747 	return err;
1748 }
1749 
1750 const struct got_error *
1751 got_privsep_send_gitconfig_remotes(struct imsgbuf *ibuf,
1752     struct got_remote_repo *remotes, int nremotes)
1753 {
1754 	const struct got_error *err = NULL;
1755 	struct got_imsg_remotes iremotes;
1756 	int i;
1757 
1758 	iremotes.nremotes = nremotes;
1759 	if (imsg_compose(ibuf, GOT_IMSG_GITCONFIG_REMOTES, 0, 0, -1,
1760 	    &iremotes, sizeof(iremotes)) == -1)
1761 		return got_error_from_errno("imsg_compose GITCONFIG_REMOTES");
1762 
1763 	err = flush_imsg(ibuf);
1764 	imsg_clear(ibuf);
1765 	if (err)
1766 		return err;
1767 
1768 	for (i = 0; i < nremotes; i++) {
1769 		struct got_imsg_remote iremote;
1770 		size_t len = sizeof(iremote);
1771 		struct ibuf *wbuf;
1772 
1773 		iremote.name_len = strlen(remotes[i].name);
1774 		len += iremote.name_len;
1775 		iremote.url_len = strlen(remotes[i].url);
1776 		len += iremote.url_len;
1777 
1778 		wbuf = imsg_create(ibuf, GOT_IMSG_GITCONFIG_REMOTE, 0, 0, len);
1779 		if (wbuf == NULL)
1780 			return got_error_from_errno(
1781 			    "imsg_create GITCONFIG_REMOTE");
1782 
1783 		if (imsg_add(wbuf, &iremote, sizeof(iremote)) == -1) {
1784 			err = got_error_from_errno(
1785 			    "imsg_add GIITCONFIG_REMOTE");
1786 			ibuf_free(wbuf);
1787 			return err;
1788 		}
1789 
1790 		if (imsg_add(wbuf, remotes[i].name, iremote.name_len) == -1) {
1791 			err = got_error_from_errno(
1792 			    "imsg_add GIITCONFIG_REMOTE");
1793 			ibuf_free(wbuf);
1794 			return err;
1795 		}
1796 		if (imsg_add(wbuf, remotes[i].url, iremote.url_len) == -1) {
1797 			err = got_error_from_errno(
1798 			    "imsg_add GIITCONFIG_REMOTE");
1799 			ibuf_free(wbuf);
1800 			return err;
1801 		}
1802 
1803 		wbuf->fd = -1;
1804 		imsg_close(ibuf, wbuf);
1805 		err = flush_imsg(ibuf);
1806 		if (err)
1807 			return err;
1808 	}
1809 
1810 	return NULL;
1811 }
1812 
1813 const struct got_error *
1814 got_privsep_recv_gitconfig_remotes(struct got_remote_repo **remotes,
1815     int *nremotes, struct imsgbuf *ibuf)
1816 {
1817 	const struct got_error *err = NULL;
1818 	struct imsg imsg;
1819 	size_t datalen;
1820 	struct got_imsg_remotes iremotes;
1821 	struct got_imsg_remote iremote;
1822 
1823 	*remotes = NULL;
1824 	*nremotes = 0;
1825 	iremotes.nremotes = 0;
1826 
1827 	err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremotes));
1828 	if (err)
1829 		return err;
1830 	datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1831 
1832 	switch (imsg.hdr.type) {
1833 	case GOT_IMSG_GITCONFIG_REMOTES:
1834 		if (datalen != sizeof(iremotes)) {
1835 			err = got_error(GOT_ERR_PRIVSEP_LEN);
1836 			break;
1837 		}
1838 		memcpy(&iremotes, imsg.data, sizeof(iremotes));
1839 		if (iremotes.nremotes == 0) {
1840 			imsg_free(&imsg);
1841 			return NULL;
1842 		}
1843 		break;
1844 	default:
1845 		imsg_free(&imsg);
1846 		return got_error(GOT_ERR_PRIVSEP_MSG);
1847 	}
1848 
1849 	imsg_free(&imsg);
1850 
1851 	*remotes = recallocarray(NULL, 0, iremotes.nremotes, sizeof(iremote));
1852 	if (*remotes == NULL)
1853 		return got_error_from_errno("recallocarray");
1854 
1855 	while (*nremotes < iremotes.nremotes) {
1856 		struct got_remote_repo *remote;
1857 	
1858 		err = got_privsep_recv_imsg(&imsg, ibuf, sizeof(iremote));
1859 		if (err)
1860 			break;
1861 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
1862 
1863 		switch (imsg.hdr.type) {
1864 		case GOT_IMSG_GITCONFIG_REMOTE:
1865 			remote = &(*remotes)[*nremotes];
1866 			if (datalen < sizeof(iremote)) {
1867 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1868 				break;
1869 			}
1870 			memcpy(&iremote, imsg.data, sizeof(iremote));
1871 			if (iremote.name_len == 0 || iremote.url_len == 0 ||
1872 			    (sizeof(iremote) + iremote.name_len +
1873 			    iremote.url_len) > datalen) {
1874 				err = got_error(GOT_ERR_PRIVSEP_LEN);
1875 				break;
1876 			}
1877 			remote->name = strndup(imsg.data + sizeof(iremote),
1878 			    iremote.name_len);
1879 			if (remote->name == NULL) {
1880 				err = got_error_from_errno("strndup");
1881 				break;
1882 			}
1883 			remote->url = strndup(imsg.data + sizeof(iremote) +
1884 			    iremote.name_len, iremote.url_len);
1885 			if (remote->url == NULL) {
1886 				err = got_error_from_errno("strndup");
1887 				free(remote->name);
1888 				break;
1889 			}
1890 			(*nremotes)++;
1891 			break;
1892 		default:
1893 			err = got_error(GOT_ERR_PRIVSEP_MSG);
1894 			break;
1895 		}
1896 
1897 		imsg_free(&imsg);
1898 		if (err)
1899 			break;
1900 	}
1901 
1902 	if (err) {
1903 		int i;
1904 		for (i = 0; i < *nremotes; i++) {
1905 			free((*remotes)[i].name);
1906 			free((*remotes)[i].url);
1907 		}
1908 		free(*remotes);
1909 		*remotes = NULL;
1910 		*nremotes = 0;
1911 	}
1912 	return err;
1913 }
1914 
1915 const struct got_error *
1916 got_privsep_send_commit_traversal_request(struct imsgbuf *ibuf,
1917      struct got_object_id *id, int idx, const char *path)
1918 {
1919 	const struct got_error *err = NULL;
1920 	struct ibuf *wbuf;
1921 	size_t path_len = strlen(path) + 1;
1922 
1923 	wbuf = imsg_create(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_REQUEST, 0, 0,
1924 	    sizeof(struct got_imsg_commit_traversal_request) + path_len);
1925 	if (wbuf == NULL)
1926 		return got_error_from_errno(
1927 		    "imsg_create COMMIT_TRAVERSAL_REQUEST");
1928 	if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
1929 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1930 		ibuf_free(wbuf);
1931 		return err;
1932 	}
1933 	if (imsg_add(wbuf, &idx, sizeof(idx)) == -1) {
1934 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1935 		ibuf_free(wbuf);
1936 		return err;
1937 	}
1938 	if (imsg_add(wbuf, path, path_len) == -1) {
1939 		err = got_error_from_errno("imsg_add COMMIT_TRAVERSAL_REQUEST");
1940 		ibuf_free(wbuf);
1941 		return err;
1942 	}
1943 
1944 	wbuf->fd = -1;
1945 	imsg_close(ibuf, wbuf);
1946 
1947 	return flush_imsg(ibuf);
1948 }
1949 
1950 const struct got_error *
1951 got_privsep_send_traversed_commits(struct got_object_id *commit_ids, 
1952     size_t ncommits, struct imsgbuf *ibuf)
1953 {
1954 	const struct got_error *err;
1955 	struct ibuf *wbuf;
1956 	int i;
1957 
1958 	wbuf = imsg_create(ibuf, GOT_IMSG_TRAVERSED_COMMITS, 0, 0,
1959 	    sizeof(struct got_imsg_traversed_commits) +
1960 	    ncommits * SHA1_DIGEST_LENGTH);
1961 	if (wbuf == NULL)
1962 		return got_error_from_errno("imsg_create TRAVERSED_COMMITS");
1963 
1964 	if (imsg_add(wbuf, &ncommits, sizeof(ncommits)) == -1) {
1965 		err = got_error_from_errno("imsg_add TRAVERSED_COMMITS");
1966 		ibuf_free(wbuf);
1967 		return err;
1968 	}
1969 	for (i = 0; i < ncommits; i++) {
1970 		struct got_object_id *id = &commit_ids[i];
1971 		if (imsg_add(wbuf, id->sha1, SHA1_DIGEST_LENGTH) == -1) {
1972 			err = got_error_from_errno(
1973 			    "imsg_add TRAVERSED_COMMITS");
1974 			ibuf_free(wbuf);
1975 			return err;
1976 		}
1977 	}
1978 
1979 	wbuf->fd = -1;
1980 	imsg_close(ibuf, wbuf);
1981 
1982 	return flush_imsg(ibuf);
1983 }
1984 
1985 const struct got_error *
1986 got_privsep_recv_traversed_commits(struct got_commit_object **changed_commit,
1987     struct got_object_id **changed_commit_id,
1988     struct got_object_id_queue *commit_ids, struct imsgbuf *ibuf)
1989 {
1990 	const struct got_error *err = NULL;
1991 	struct imsg imsg;
1992 	struct got_imsg_traversed_commits *icommits;
1993 	size_t datalen;
1994 	int i, done = 0;
1995 
1996 	*changed_commit = NULL;
1997 	*changed_commit_id = NULL;
1998 
1999 	while (!done) {
2000 		err = got_privsep_recv_imsg(&imsg, ibuf, 0);
2001 		if (err)
2002 			return err;
2003 
2004 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
2005 		switch (imsg.hdr.type) {
2006 		case GOT_IMSG_TRAVERSED_COMMITS:
2007 			icommits = imsg.data;
2008 			if (datalen != sizeof(*icommits) +
2009 			    icommits->ncommits * SHA1_DIGEST_LENGTH) {
2010 				err = got_error(GOT_ERR_PRIVSEP_LEN);
2011 				break;
2012 			}
2013 			for (i = 0; i < icommits->ncommits; i++) {
2014 				struct got_object_qid *qid;
2015 				uint8_t *sha1 = (uint8_t *)imsg.data +
2016 				    sizeof(*icommits) + i * SHA1_DIGEST_LENGTH;
2017 				err = got_object_qid_alloc_partial(&qid);
2018 				if (err)
2019 					break;
2020 				memcpy(qid->id->sha1, sha1, SHA1_DIGEST_LENGTH);
2021 				SIMPLEQ_INSERT_TAIL(commit_ids, qid, entry);
2022 
2023 				/* The last commit may contain a change. */
2024 				if (i == icommits->ncommits - 1) {
2025 					*changed_commit_id =
2026 					    got_object_id_dup(qid->id);
2027 					if (*changed_commit_id == NULL) {
2028 						err = got_error_from_errno(
2029 						    "got_object_id_dup");
2030 						break;
2031 					}
2032 				}
2033 			}
2034 			break;
2035 		case GOT_IMSG_COMMIT:
2036 			if (*changed_commit_id == NULL) {
2037 				err = got_error(GOT_ERR_PRIVSEP_MSG);
2038 				break;
2039 			}
2040 			err = get_commit_from_imsg(changed_commit, &imsg,
2041 			    datalen, ibuf);
2042 			break;
2043 		case GOT_IMSG_COMMIT_TRAVERSAL_DONE:
2044 			done = 1;
2045 			break;
2046 		default:
2047 			err = got_error(GOT_ERR_PRIVSEP_MSG);
2048 			break;
2049 		}
2050 
2051 		imsg_free(&imsg);
2052 		if (err)
2053 			break;
2054 	}
2055 
2056 	if (err)
2057 		got_object_id_queue_free(commit_ids);
2058 	return err;
2059 }
2060 
2061 const struct got_error *
2062 got_privsep_send_commit_traversal_done(struct imsgbuf *ibuf)
2063 {
2064 	if (imsg_compose(ibuf, GOT_IMSG_COMMIT_TRAVERSAL_DONE, 0, 0, -1,
2065 	    NULL, 0) == -1)
2066 		return got_error_from_errno("imsg_compose TRAVERSAL_DONE");
2067 
2068 	return flush_imsg(ibuf);
2069 }
2070 
2071 const struct got_error *
2072 got_privsep_unveil_exec_helpers(void)
2073 {
2074 	const char *helpers[] = {
2075 	    GOT_PATH_PROG_READ_PACK,
2076 	    GOT_PATH_PROG_READ_OBJECT,
2077 	    GOT_PATH_PROG_READ_COMMIT,
2078 	    GOT_PATH_PROG_READ_TREE,
2079 	    GOT_PATH_PROG_READ_BLOB,
2080 	    GOT_PATH_PROG_READ_TAG,
2081 	    GOT_PATH_PROG_READ_GITCONFIG,
2082 	};
2083 	int i;
2084 
2085 	for (i = 0; i < nitems(helpers); i++) {
2086 		if (unveil(helpers[i], "x") == 0)
2087 			continue;
2088 		return got_error_from_errno2("unveil", helpers[i]);
2089 	}
2090 
2091 	return NULL;
2092 }
2093 
2094 void
2095 got_privsep_exec_child(int imsg_fds[2], const char *path, const char *repo_path)
2096 {
2097 	if (close(imsg_fds[0]) != 0) {
2098 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2099 		_exit(1);
2100 	}
2101 
2102 	if (dup2(imsg_fds[1], GOT_IMSG_FD_CHILD) == -1) {
2103 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2104 		_exit(1);
2105 	}
2106 	if (closefrom(GOT_IMSG_FD_CHILD + 1) == -1) {
2107 		fprintf(stderr, "%s: %s\n", getprogname(), strerror(errno));
2108 		_exit(1);
2109 	}
2110 
2111 	if (execl(path, path, repo_path, (char *)NULL) == -1) {
2112 		fprintf(stderr, "%s: %s: %s\n", getprogname(), path,
2113 		    strerror(errno));
2114 		_exit(1);
2115 	}
2116 }