From: Kyle Ackerman <kack@kyleackerman.net>
Subject: Gotd imsg API Utilization
To: gameoftrees@openbsd.org
Date: Mon, 17 Aug 2026 20:03:48 -0600

This diff strives to make gotd treat imsgs more opaquely.

I changed some imsg functions that we call and remove a data length
check, or two, based on the strictness of imsg_get_data.

Happy to discuss and iterate :)

diff /home/kyle/src/got
path + /home/kyle/src/got
commit - ae25db3f82d89c28505e5fc1f58b8ba693282f5b
blob - 99752a0ec1d2b96960f266745aebfcc2bba9c4b2
file + gotd/auth.c
--- gotd/auth.c
+++ gotd/auth.c
@@ -193,7 +193,6 @@ recv_authreq(struct imsg *imsg, struct gotd_imsgev *ie
 	const struct got_error *err;
 	struct imsgbuf *ibuf = &iev->ibuf;
 	struct gotd_imsg_auth iauth;
-	size_t datalen;
 	uid_t euid;
 	gid_t egid;
 	char *username = NULL;
@@ -203,12 +202,14 @@ recv_authreq(struct imsg *imsg, struct gotd_imsgev *ie
 
 	log_debug("authentication request received");
 
-	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
-	if (datalen != sizeof(iauth))
+	if(imsg_get_data(imsg, &iauth, sizeof(iauth)) == -1){
+		log_warn("imsg_get_data");
+		return NULL;
+	}
+
+	if (imsg_get_len(imsg) != 0)
 		return got_error(GOT_ERR_PRIVSEP_LEN);
 
-	memcpy(&iauth, imsg->data, datalen);
-
 	fd = imsg_get_fd(imsg);
 	if (fd == -1)
 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
@@ -254,17 +255,13 @@ recv_access_rule(struct imsg *imsg)
 	const struct got_error *err;
 	struct gotd_imsg_auth_access_rule irule;
 	enum gotd_access access;
-	size_t datalen;
 	char *identifier = NULL;
+
 	struct gotd_access_rule *rule = NULL;
 
-	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
-	if (datalen < sizeof(irule))
-		return got_error(GOT_ERR_PRIVSEP_LEN);
+	if (imsg_get_buf(imsg, &irule, sizeof(irule)) == -1)
+		return got_error_from_errno("imsg_get_buf");
 
-	memcpy(&irule, imsg->data, sizeof(irule));
-	if (datalen != sizeof(irule) + irule.identifier_len)
-		return got_error(GOT_ERR_PRIVSEP_LEN);
 	if (irule.identifier_len == 0) {
 		return got_error_msg(GOT_ERR_PRIVSEP_LEN,
 		    "empty access rule identifier");
@@ -300,10 +297,13 @@ recv_access_rule(struct imsg *imsg)
 		return got_error_msg(GOT_ERR_PRIVSEP_MSG,
 		    "invalid access rule authorization flags");
 	}
-	
-	identifier = strndup(imsg->data + sizeof(irule), irule.identifier_len);
+	identifier = malloc(irule.identifier_len + 1);
 	if (identifier == NULL)
-		return got_error_from_errno("strndup");
+		return got_error_from_errno("malloc");
+
+	if (imsg_get_strbuf(imsg, identifier, irule.identifier_len + 1) == -1)
+		return got_error_from_errno("imsg_get_strbuf");
+
 	if (strlen(identifier) != irule.identifier_len) {
 		err = got_error(GOT_ERR_PRIVSEP_LEN);
 		free(identifier);
@@ -318,6 +318,13 @@ recv_access_rule(struct imsg *imsg)
 	rule->authorization = irule.authorization;
 	rule->identifier = identifier;
 	STAILQ_INSERT_TAIL(&gotd_auth.rules, rule, entry);
+	if (imsg_get_len(imsg) != 0 ) {
+		err = got_error(GOT_ERR_PRIVSEP_LEN);
+		free(identifier);
+		free(rule);
+		return err;
+	}
+		
 	return NULL;
 }
 
commit - ae25db3f82d89c28505e5fc1f58b8ba693282f5b
blob - b21b50e035dd880e6917228f8046f3b2a3e642ce
file + gotd/gotd.c
--- gotd/gotd.c
+++ gotd/gotd.c
@@ -1903,13 +1903,13 @@ send_access_rule(struct gotd_imsgev *iev, struct gotd_
 	irule.identifier_len = strlen(rule->identifier);
 
 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_AUTH_ACCESS_RULE,
-	    0, 0, sizeof(irule) + irule.identifier_len);
+	    0, 0, sizeof(irule) + irule.identifier_len) ;
 	if (wbuf == NULL)
 		return got_error_from_errno("imsg_create AUTH_ACCESS_RULE");
 
 	if (imsg_add(wbuf, &irule, sizeof(irule)) == -1)
 		return got_error_from_errno("imsg_add AUTH_ACCESS_FULE");
-	if (imsg_add(wbuf, rule->identifier, irule.identifier_len) == -1)
+	if (ibuf_add_strbuf(wbuf, rule->identifier, irule.identifier_len + 1) == -1)
 		return got_error_from_errno("imsg_add AUTH_ACCESS_FULE");
 
 	imsg_close(&iev->ibuf, wbuf);