Merge sync of head

10 files changed, 98 insertions, 48 deletions

diff --git a/lib/libcapsicum/Makefile b/lib/libcapsicum/Makefile
index 061edfc..6ee5bb8 100644
--- a/lib/libcapsicum/Makefile
+++ b/lib/libcapsicum/Makefile
@@ -21,8 +21,7 @@ INCS+=	libcapsicum_random.h
 INCS+=	libcapsicum_service.h
 INCS+=	libcapsicum_sysctl.h
 
-DPADD=	${LIBNV}
-LDADD=	-lnv
+LIBADD=	nv
 
 CFLAGS+=-I${.CURDIR}
 CFLAGS+=-I${.CURDIR}/../libnv
diff --git a/lib/libcapsicum/libcapsicum.3 b/lib/libcapsicum/libcapsicum.3
index 9df565a..cbfd214 100644
--- a/lib/libcapsicum/libcapsicum.3
+++ b/lib/libcapsicum/libcapsicum.3
@@ -27,7 +27,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd April 14, 2014
+.Dd May 2, 2015
 .Dt LIBCAPSICUM 3
 .Os
 .Sh NAME
@@ -68,9 +68,9 @@
 .Ft "int"
 .Fn cap_send_nvlist "const cap_channel_t *chan" "const nvlist_t *nvl"
 .Ft "nvlist_t *"
-.Fn cap_recv_nvlist "const cap_channel_t *chan"
+.Fn cap_recv_nvlist "const cap_channel_t *chan" "int flags"
 .Ft "nvlist_t *"
-.Fn cap_xfer_nvlist "const cap_channel_t *chan" "nvlist_t *nvl"
+.Fn cap_xfer_nvlist "const cap_channel_t *chan" "nvlist_t *nvl" "int flags"
 .In libcapsicum_service.h
 .Ft "cap_channel_t *"
 .Fn cap_service_open "const cap_channel_t *chan" "const char *name"
@@ -171,11 +171,23 @@ Most services should provide higher level API.
 The
 .Fn cap_recv_nvlist
 function receives the given nvlist over the given capability.
+The
+.Fa flags
+argument defines what type the top nvlist is expected to be.
+If the nvlist flags do not match the flags passed to
+.Fn cap_recv_nvlist ,
+the nvlist will not be returned.
 .Pp
 The
 .Fn cap_xfer_nvlist
 function sends the given nvlist, destroys it and receives new nvlist in
 response over the given capability.
+The
+.Fa flags
+argument defines what type the top nvlist is expected to be.
+If the nvlist flags do not match the flags passed to
+.Fn cap_xfer_nvlist ,
+the nvlist will not be returned.
 It does not matter if the function succeeds or fails, the nvlist given
 for sending will always be destroyed once the function returns.
 .Pp
diff --git a/lib/libcapsicum/libcapsicum.c b/lib/libcapsicum/libcapsicum.c
index 79ca871..79c570f 100644
--- a/lib/libcapsicum/libcapsicum.c
+++ b/lib/libcapsicum/libcapsicum.c
@@ -142,7 +142,7 @@ cap_clone(const cap_channel_t *chan)
 
 	nvl = nvlist_create(0);
 	nvlist_add_string(nvl, "cmd", "clone");
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL)
 		return (NULL);
 	if (nvlist_get_number(nvl, "error") != 0) {
@@ -195,7 +195,7 @@ cap_limit_set(const cap_channel_t *chan, nvlist_t *limits)
 	nvlmsg = nvlist_create(0);
 	nvlist_add_string(nvlmsg, "cmd", "limit_set");
 	nvlist_add_nvlist(nvlmsg, "limits", limits);
-	nvlmsg = cap_xfer_nvlist(chan, nvlmsg);
+	nvlmsg = cap_xfer_nvlist(chan, nvlmsg, 0);
 	if (nvlmsg == NULL) {
 		nvlist_destroy(limits);
 		return (-1);
@@ -218,7 +218,7 @@ cap_limit_get(const cap_channel_t *chan, nvlist_t **limitsp)
 
 	nvlmsg = nvlist_create(0);
 	nvlist_add_string(nvlmsg, "cmd", "limit_get");
-	nvlmsg = cap_xfer_nvlist(chan, nvlmsg);
+	nvlmsg = cap_xfer_nvlist(chan, nvlmsg, 0);
 	if (nvlmsg == NULL)
 		return (-1);
 	error = (int)nvlist_get_number(nvlmsg, "error");
@@ -246,21 +246,21 @@ cap_send_nvlist(const cap_channel_t *chan, const nvlist_t *nvl)
 }
 
 nvlist_t *
-cap_recv_nvlist(const cap_channel_t *chan)
+cap_recv_nvlist(const cap_channel_t *chan, int flags)
 {
 
 	assert(chan != NULL);
 	assert(chan->cch_magic == CAP_CHANNEL_MAGIC);
 
-	return (nvlist_recv(chan->cch_sock));
+	return (nvlist_recv(chan->cch_sock, flags));
 }
 
 nvlist_t *
-cap_xfer_nvlist(const cap_channel_t *chan, nvlist_t *nvl)
+cap_xfer_nvlist(const cap_channel_t *chan, nvlist_t *nvl, int flags)
 {
 
 	assert(chan != NULL);
 	assert(chan->cch_magic == CAP_CHANNEL_MAGIC);
 
-	return (nvlist_xfer(chan->cch_sock, nvl));
+	return (nvlist_xfer(chan->cch_sock, nvl, flags));
 }
diff --git a/lib/libcapsicum/libcapsicum.h b/lib/libcapsicum/libcapsicum.h
index 4f8c597..c7110d8 100644
--- a/lib/libcapsicum/libcapsicum.h
+++ b/lib/libcapsicum/libcapsicum.h
@@ -105,11 +105,11 @@ int	cap_send_nvlist(const cap_channel_t *chan, const nvlist_t *nvl);
 /*
  * Function receives nvlist over the given capability.
  */
-nvlist_t *cap_recv_nvlist(const cap_channel_t *chan);
+nvlist_t *cap_recv_nvlist(const cap_channel_t *chan, int flags);
 /*
  * Function sends the given nvlist, destroys it and receives new nvlist in
  * response over the given capability.
  */
-nvlist_t *cap_xfer_nvlist(const cap_channel_t *chan, nvlist_t *nvl);
+nvlist_t *cap_xfer_nvlist(const cap_channel_t *chan, nvlist_t *nvl, int flags);
 
 #endif	/* !_LIBCAPSICUM_H_ */
diff --git a/lib/libcapsicum/libcapsicum_dns.c b/lib/libcapsicum/libcapsicum_dns.c
index 113f8dc..a180b6b 100644
--- a/lib/libcapsicum/libcapsicum_dns.c
+++ b/lib/libcapsicum/libcapsicum_dns.c
@@ -30,6 +30,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include <assert.h>
 #include <netdb.h>
 #include <stdlib.h>
 #include <string.h>
@@ -67,6 +68,8 @@ static struct hostent *
 hostent_unpack(const nvlist_t *nvl, struct hostent *hp)
 {
 	unsigned int ii, nitems;
+	char nvlname[64];
+	int n;
 
 	hostent_free(hp);
 
@@ -81,8 +84,10 @@ hostent_unpack(const nvlist_t *nvl, struct hostent *hp)
 	if (hp->h_aliases == NULL)
 		goto fail;
 	for (ii = 0; ii < nitems; ii++) {
+		n = snprintf(nvlname, sizeof(nvlname), "alias%u", ii);
+		assert(n > 0 && n < (int)sizeof(nvlname));
 		hp->h_aliases[ii] =
-		    strdup(nvlist_getf_string(nvl, "alias%u", ii));
+		    strdup(nvlist_get_string(nvl, nvlname));
 		if (hp->h_aliases[ii] == NULL)
 			goto fail;
 	}
@@ -96,7 +101,9 @@ hostent_unpack(const nvlist_t *nvl, struct hostent *hp)
 		hp->h_addr_list[ii] = malloc(hp->h_length);
 		if (hp->h_addr_list[ii] == NULL)
 			goto fail;
-		bcopy(nvlist_getf_binary(nvl, NULL, "addr%u", ii),
+		n = snprintf(nvlname, sizeof(nvlname), "addr%u", ii);
+		assert(n > 0 && n < (int)sizeof(nvlname));
+		bcopy(nvlist_get_binary(nvl, nvlname, NULL),
 		    hp->h_addr_list[ii], hp->h_length);
 	}
 	hp->h_addr_list[ii] = NULL;
@@ -125,7 +132,7 @@ cap_gethostbyname2(cap_channel_t *chan, const char *name, int type)
 	nvlist_add_string(nvl, "cmd", "gethostbyname");
 	nvlist_add_number(nvl, "family", (uint64_t)type);
 	nvlist_add_string(nvl, "name", name);
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL) {
 		h_errno = NO_RECOVERY;
 		return (NULL);
@@ -152,7 +159,7 @@ cap_gethostbyaddr(cap_channel_t *chan, const void *addr, socklen_t len,
 	nvlist_add_string(nvl, "cmd", "gethostbyaddr");
 	nvlist_add_binary(nvl, "addr", addr, (size_t)len);
 	nvlist_add_number(nvl, "family", (uint64_t)type);
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL) {
 		h_errno = NO_RECOVERY;
 		return (NULL);
@@ -208,8 +215,9 @@ cap_getaddrinfo(cap_channel_t *chan, const char *hostname, const char *servname,
 	struct addrinfo *firstai, *prevai, *curai;
 	unsigned int ii;
 	const nvlist_t *nvlai;
+	char nvlname[64];
 	nvlist_t *nvl;
-	int error;
+	int error, n;
 
 	nvl = nvlist_create(0);
 	nvlist_add_string(nvl, "cmd", "getaddrinfo");
@@ -225,7 +233,7 @@ cap_getaddrinfo(cap_channel_t *chan, const char *hostname, const char *servname,
 		nvlist_add_number(nvl, "hints.ai_protocol",
 		    (uint64_t)hints->ai_protocol);
 	}
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL)
 		return (EAI_MEMORY);
 	if (nvlist_get_number(nvl, "error") != 0) {
@@ -237,9 +245,11 @@ cap_getaddrinfo(cap_channel_t *chan, const char *hostname, const char *servname,
 	nvlai = NULL;
 	firstai = prevai = curai = NULL;
 	for (ii = 0; ; ii++) {
-		if (!nvlist_existsf_nvlist(nvl, "res%u", ii))
+		n = snprintf(nvlname, sizeof(nvlname), "res%u", ii);
+		assert(n > 0 && n < (int)sizeof(nvlname));
+		if (!nvlist_exists_nvlist(nvl, nvlname))
 			break;
-		nvlai = nvlist_getf_nvlist(nvl, "res%u", ii);
+		nvlai = nvlist_get_nvlist(nvl, nvlname);
 		curai = addrinfo_unpack(nvlai);
 		if (curai == NULL)
 			break;
@@ -273,7 +283,7 @@ cap_getnameinfo(cap_channel_t *chan, const struct sockaddr *sa, socklen_t salen,
 	nvlist_add_number(nvl, "servlen", (uint64_t)servlen);
 	nvlist_add_binary(nvl, "sa", sa, (size_t)salen);
 	nvlist_add_number(nvl, "flags", (uint64_t)flags);
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL)
 		return (EAI_MEMORY);
 	if (nvlist_get_number(nvl, "error") != 0) {
@@ -314,6 +324,8 @@ cap_dns_type_limit(cap_channel_t *chan, const char * const *types,
 {
 	nvlist_t *limits;
 	unsigned int i;
+	char nvlname[64];
+	int n;
 
 	if (cap_limit_get(chan, &limits) < 0)
 		return (-1);
@@ -321,8 +333,11 @@ cap_dns_type_limit(cap_channel_t *chan, const char * const *types,
 		limits = nvlist_create(0);
 	else
 		limit_remove(limits, "type");
-	for (i = 0; i < ntypes; i++)
-		nvlist_addf_string(limits, types[i], "type%u", i);
+	for (i = 0; i < ntypes; i++) {
+		n = snprintf(nvlname, sizeof(nvlname), "type%u", i);
+		assert(n > 0 && n < (int)sizeof(nvlname));
+		nvlist_add_string(limits, nvlname, types[i]);
+	}
 	return (cap_limit_set(chan, limits));
 }
 
@@ -332,6 +347,8 @@ cap_dns_family_limit(cap_channel_t *chan, const int *families,
 {
 	nvlist_t *limits;
 	unsigned int i;
+	char nvlname[64];
+	int n;
 
 	if (cap_limit_get(chan, &limits) < 0)
 		return (-1);
@@ -340,8 +357,9 @@ cap_dns_family_limit(cap_channel_t *chan, const int *families,
 	else
 		limit_remove(limits, "family");
 	for (i = 0; i < nfamilies; i++) {
-		nvlist_addf_number(limits, (uint64_t)families[i],
-		    "family%u", i);
+		n = snprintf(nvlname, sizeof(nvlname), "family%u", i);
+		assert(n > 0 && n < (int)sizeof(nvlname));
+		nvlist_add_number(limits, nvlname, (uint64_t)families[i]);
 	}
 	return (cap_limit_set(chan, limits));
 }
diff --git a/lib/libcapsicum/libcapsicum_grp.c b/lib/libcapsicum/libcapsicum_grp.c
index c679ce9..267ac68 100644
--- a/lib/libcapsicum/libcapsicum_grp.c
+++ b/lib/libcapsicum/libcapsicum_grp.c
@@ -94,9 +94,10 @@ group_unpack_members(const nvlist_t *nvl, char ***fieldp, char **bufferp,
     size_t *bufsizep)
 {
 	const char *mem;
-	char **outstrs, *str;
+	char **outstrs, *str, nvlname[64];
 	size_t nmem, datasize, strsize;
 	unsigned int ii;
+	int n;
 
 	if (!nvlist_exists_number(nvl, "gr_nmem")) {
 		datasize = _ALIGNBYTES + sizeof(char *);
@@ -113,7 +114,9 @@ group_unpack_members(const nvlist_t *nvl, char ***fieldp, char **bufferp,
 	nmem = (size_t)nvlist_get_number(nvl, "gr_nmem");
 	datasize = _ALIGNBYTES + sizeof(char *) * (nmem + 1);
 	for (ii = 0; ii < nmem; ii++) {
-		mem = dnvlist_getf_string(nvl, NULL, "gr_mem[%u]", ii);
+		n = snprintf(nvlname, sizeof(nvlname), "gr_mem[%u]", ii);
+		assert(n > 0 && n < (int)sizeof(nvlname));
+		mem = dnvlist_get_string(nvl, nvlname, NULL);
 		if (mem == NULL)
 			return (EINVAL);
 		datasize += strlen(mem) + 1;
@@ -125,7 +128,9 @@ group_unpack_members(const nvlist_t *nvl, char ***fieldp, char **bufferp,
 	outstrs = (char **)_ALIGN(*bufferp);
 	str = (char *)outstrs + sizeof(char *) * (nmem + 1);
 	for (ii = 0; ii < nmem; ii++) {
-		mem = nvlist_getf_string(nvl, "gr_mem[%u]", ii);
+		n = snprintf(nvlname, sizeof(nvlname), "gr_mem[%u]", ii);
+		assert(n > 0 && n < (int)sizeof(nvlname));
+		mem = nvlist_get_string(nvl, nvlname);
 		strsize = strlen(mem) + 1;
 		memcpy(str, mem, strsize);
 		outstrs[ii] = str;
@@ -190,7 +195,7 @@ cap_getgrcommon_r(cap_channel_t *chan, const char *cmd, const char *name,
 	} else {
 		abort();
 	}
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL) {
 		assert(errno != 0);
 		*result = NULL;
@@ -314,7 +319,7 @@ cap_setgroupent(cap_channel_t *chan, int stayopen)
 	nvl = nvlist_create(0);
 	nvlist_add_string(nvl, "cmd", "setgroupent");
 	nvlist_add_bool(nvl, "stayopen", stayopen != 0);
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL)
 		return (0);
 	if (nvlist_get_number(nvl, "error") != 0) {
@@ -334,7 +339,7 @@ cap_setgrent(cap_channel_t *chan)
 
 	nvl = nvlist_create(0);
 	nvlist_add_string(nvl, "cmd", "setgrent");
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL)
 		return (0);
 	if (nvlist_get_number(nvl, "error") != 0) {
@@ -355,7 +360,7 @@ cap_endgrent(cap_channel_t *chan)
 	nvl = nvlist_create(0);
 	nvlist_add_string(nvl, "cmd", "endgrent");
 	/* Ignore any errors, we have no way to report them. */
-	nvlist_destroy(cap_xfer_nvlist(chan, nvl));
+	nvlist_destroy(cap_xfer_nvlist(chan, nvl, 0));
 }
 
 int
@@ -407,6 +412,8 @@ cap_grp_limit_groups(cap_channel_t *chan, const char * const *names,
 {
 	nvlist_t *limits, *groups;
 	unsigned int i;
+	char nvlname[64];
+	int n;
 
 	if (cap_limit_get(chan, &limits) < 0)
 		return (-1);
@@ -417,10 +424,16 @@ cap_grp_limit_groups(cap_channel_t *chan, const char * const *names,
 			nvlist_free_nvlist(limits, "groups");
 	}
 	groups = nvlist_create(0);
-	for (i = 0; i < ngids; i++)
-		nvlist_addf_number(groups, (uint64_t)gids[i], "gid%u", i);
-	for (i = 0; i < nnames; i++)
-		nvlist_addf_string(groups, names[i], "name%u", i);
+	for (i = 0; i < ngids; i++) {
+		n = snprintf(nvlname, sizeof(nvlname), "gid%u", i);
+		assert(n > 0 && n < (int)sizeof(nvlname));
+		nvlist_add_number(groups, nvlname, (uint64_t)gids[i]);
+	}
+	for (i = 0; i < nnames; i++) {
+		n = snprintf(nvlname, sizeof(nvlname), "gid%u", i);
+		assert(n > 0 && n < (int)sizeof(nvlname));
+		nvlist_add_string(groups, nvlname, names[i]);
+	}
 	nvlist_move_nvlist(limits, "groups", groups);
 	return (cap_limit_set(chan, limits));
 }
diff --git a/lib/libcapsicum/libcapsicum_pwd.c b/lib/libcapsicum/libcapsicum_pwd.c
index 792fb66..32eeeb0 100644
--- a/lib/libcapsicum/libcapsicum_pwd.c
+++ b/lib/libcapsicum/libcapsicum_pwd.c
@@ -154,7 +154,7 @@ cap_getpwcommon_r(cap_channel_t *chan, const char *cmd, const char *login,
 	} else {
 		abort();
 	}
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL) {
 		assert(errno != 0);
 		*result = NULL;
@@ -278,7 +278,7 @@ cap_setpassent(cap_channel_t *chan, int stayopen)
 	nvl = nvlist_create(0);
 	nvlist_add_string(nvl, "cmd", "setpassent");
 	nvlist_add_bool(nvl, "stayopen", stayopen != 0);
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL)
 		return (0);
 	if (nvlist_get_number(nvl, "error") != 0) {
@@ -299,7 +299,7 @@ cap_set_end_pwent(cap_channel_t *chan, const char *cmd)
 	nvl = nvlist_create(0);
 	nvlist_add_string(nvl, "cmd", cmd);
 	/* Ignore any errors, we have no way to report them. */
-	nvlist_destroy(cap_xfer_nvlist(chan, nvl));
+	nvlist_destroy(cap_xfer_nvlist(chan, nvl, 0));
 }
 
 void
@@ -364,7 +364,9 @@ cap_pwd_limit_users(cap_channel_t *chan, const char * const *names,
     size_t nnames, uid_t *uids, size_t nuids)
 {
 	nvlist_t *limits, *users;
+	char nvlname[64];
 	unsigned int i;
+	int n;
 
 	if (cap_limit_get(chan, &limits) < 0)
 		return (-1);
@@ -375,10 +377,16 @@ cap_pwd_limit_users(cap_channel_t *chan, const char * const *names,
 			nvlist_free_nvlist(limits, "users");
 	}
 	users = nvlist_create(0);
-	for (i = 0; i < nuids; i++)
-		nvlist_addf_number(users, (uint64_t)uids[i], "uid%u", i);
-	for (i = 0; i < nnames; i++)
-		nvlist_addf_string(users, names[i], "name%u", i);
+	for (i = 0; i < nuids; i++) {
+		n = snprintf(nvlname, sizeof(nvlname), "uid%u", i);
+		assert(n > 0 && n < (int)sizeof(nvlname));
+		nvlist_add_number(users, nvlname, (uint64_t)uids[i]);
+	}
+	for (i = 0; i < nnames; i++) {
+		n = snprintf(nvlname, sizeof(nvlname), "name%u", i);
+		assert(n > 0 && n < (int)sizeof(nvlname));
+		nvlist_add_string(users, nvlname, names[i]);
+	}
 	nvlist_move_nvlist(limits, "users", users);
 	return (cap_limit_set(chan, limits));
 }
diff --git a/lib/libcapsicum/libcapsicum_random.c b/lib/libcapsicum/libcapsicum_random.c
index eed97e2..2c3eb36 100644
--- a/lib/libcapsicum/libcapsicum_random.c
+++ b/lib/libcapsicum/libcapsicum_random.c
@@ -57,7 +57,7 @@ cap_random_buf(cap_channel_t *chan, void *buf, size_t nbytes)
 		nvlist_add_string(nvl, "cmd", "generate");
 		nvlist_add_number(nvl, "size",
 		    (uint64_t)(left > MAXSIZE ? MAXSIZE : left));
-		nvl = cap_xfer_nvlist(chan, nvl);
+		nvl = cap_xfer_nvlist(chan, nvl, 0);
 		if (nvl == NULL)
 			return (-1);
 		if (nvlist_get_number(nvl, "error") != 0) {
diff --git a/lib/libcapsicum/libcapsicum_service.c b/lib/libcapsicum/libcapsicum_service.c
index 4127668..edfde8c 100644
--- a/lib/libcapsicum/libcapsicum_service.c
+++ b/lib/libcapsicum/libcapsicum_service.c
@@ -56,7 +56,7 @@ cap_service_open(const cap_channel_t *chan, const char *name)
 	nvlist_add_string(nvl, "service", name);
 	if (fd_is_valid(STDERR_FILENO))
 		nvlist_add_descriptor(nvl, "stderrfd", STDERR_FILENO);
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL)
 		return (NULL);
 	error = (int)nvlist_get_number(nvl, "error");
diff --git a/lib/libcapsicum/libcapsicum_sysctl.c b/lib/libcapsicum/libcapsicum_sysctl.c
index 6ea951b..fc69113 100644
--- a/lib/libcapsicum/libcapsicum_sysctl.c
+++ b/lib/libcapsicum/libcapsicum_sysctl.c
@@ -63,7 +63,7 @@ cap_sysctlbyname(cap_channel_t *chan, const char *name, void *oldp,
 		nvlist_add_number(nvl, "oldlen", (uint64_t)*oldlenp);
 	if (newp != NULL)
 		nvlist_add_binary(nvl, "newp", newp, newlen);
-	nvl = cap_xfer_nvlist(chan, nvl);
+	nvl = cap_xfer_nvlist(chan, nvl, 0);
 	if (nvl == NULL)
 		return (-1);
 	if (nvlist_get_number(nvl, "error") != 0) {