1 /*	$OpenBSD: imsg.c,v 1.19 2023/06/19 17:19:50 claudio Exp $	*/
2 
3 /*
4  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <sys/types.h>
20 #include <sys/queue.h>
21 #include <sys/socket.h>
22 #include <sys/uio.h>
23 
24 #include <errno.h>
25 #include <stdlib.h>
26 #include <string.h>
27 #include <unistd.h>
28 
29 #include "imsg.h"
30 
31 int	 imsg_fd_overhead = 0;
32 
33 static int	 imsg_get_fd(struct imsgbuf *);
34 
35 void
36 imsg_init(struct imsgbuf *ibuf, int fd)
37 {
38 	msgbuf_init(&ibuf->w);
39 	memset(&ibuf->r, 0, sizeof(ibuf->r));
40 	ibuf->fd = fd;
41 	ibuf->w.fd = fd;
42 	ibuf->pid = getpid();
43 	TAILQ_INIT(&ibuf->fds);
44 }
45 
46 ssize_t
47 imsg_read(struct imsgbuf *ibuf)
48 {
49 	struct msghdr		 msg;
50 	struct cmsghdr		*cmsg;
51 	union {
52 		struct cmsghdr hdr;
53 		char	buf[CMSG_SPACE(sizeof(int) * 1)];
54 	} cmsgbuf;
55 	struct iovec		 iov;
56 	ssize_t			 n = -1;
57 	int			 fd;
58 	struct imsg_fd		*ifd;
59 
60 	memset(&msg, 0, sizeof(msg));
61 	memset(&cmsgbuf, 0, sizeof(cmsgbuf));
62 
63 	iov.iov_base = ibuf->r.buf + ibuf->r.wpos;
64 	iov.iov_len = sizeof(ibuf->r.buf) - ibuf->r.wpos;
65 	msg.msg_iov = &iov;
66 	msg.msg_iovlen = 1;
67 	msg.msg_control = &cmsgbuf.buf;
68 	msg.msg_controllen = sizeof(cmsgbuf.buf);
69 
70 	if ((ifd = calloc(1, sizeof(struct imsg_fd))) == NULL)
71 		return (-1);
72 
73 again:
74 	if (getdtablecount() + imsg_fd_overhead +
75 	    (int)((CMSG_SPACE(sizeof(int))-CMSG_SPACE(0))/sizeof(int))
76 	    >= getdtablesize()) {
77 		errno = EAGAIN;
78 		free(ifd);
79 		return (-1);
80 	}
81 
82 	if ((n = recvmsg(ibuf->fd, &msg, 0)) == -1) {
83 		if (errno == EINTR)
84 			goto again;
85 		goto fail;
86 	}
87 
88 	ibuf->r.wpos += n;
89 
90 	for (cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL;
91 	    cmsg = CMSG_NXTHDR(&msg, cmsg)) {
92 		if (cmsg->cmsg_level == SOL_SOCKET &&
93 		    cmsg->cmsg_type == SCM_RIGHTS) {
94 			int i;
95 			int j;
96 
97 			/*
98 			 * We only accept one file descriptor.  Due to C
99 			 * padding rules, our control buffer might contain
100 			 * more than one fd, and we must close them.
101 			 */
102 			j = ((char *)cmsg + cmsg->cmsg_len -
103 			    (char *)CMSG_DATA(cmsg)) / sizeof(int);
104 			for (i = 0; i < j; i++) {
105 				fd = ((int *)CMSG_DATA(cmsg))[i];
106 				if (ifd != NULL) {
107 					ifd->fd = fd;
108 					TAILQ_INSERT_TAIL(&ibuf->fds, ifd,
109 					    entry);
110 					ifd = NULL;
111 				} else
112 					close(fd);
113 			}
114 		}
115 		/* we do not handle other ctl data level */
116 	}
117 
118 fail:
119 	free(ifd);
120 	return (n);
121 }
122 
123 ssize_t
124 imsg_get(struct imsgbuf *ibuf, struct imsg *imsg)
125 {
126 	size_t			 av, left, datalen;
127 
128 	av = ibuf->r.wpos;
129 
130 	if (IMSG_HEADER_SIZE > av)
131 		return (0);
132 
133 	memcpy(&imsg->hdr, ibuf->r.buf, sizeof(imsg->hdr));
134 	if (imsg->hdr.len < IMSG_HEADER_SIZE ||
135 	    imsg->hdr.len > MAX_IMSGSIZE) {
136 		errno = ERANGE;
137 		return (-1);
138 	}
139 	if (imsg->hdr.len > av)
140 		return (0);
141 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
142 	ibuf->r.rptr = ibuf->r.buf + IMSG_HEADER_SIZE;
143 	if (datalen == 0)
144 		imsg->data = NULL;
145 	else if ((imsg->data = malloc(datalen)) == NULL)
146 		return (-1);
147 
148 	if (imsg->hdr.flags & IMSGF_HASFD)
149 		imsg->fd = imsg_get_fd(ibuf);
150 	else
151 		imsg->fd = -1;
152 
153 	if (datalen != 0)
154 		memcpy(imsg->data, ibuf->r.rptr, datalen);
155 
156 	if (imsg->hdr.len < av) {
157 		left = av - imsg->hdr.len;
158 		memmove(&ibuf->r.buf, ibuf->r.buf + imsg->hdr.len, left);
159 		ibuf->r.wpos = left;
160 	} else
161 		ibuf->r.wpos = 0;
162 
163 	return (datalen + IMSG_HEADER_SIZE);
164 }
165 
166 int
167 imsg_compose(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid, pid_t pid,
168     int fd, const void *data, uint16_t datalen)
169 {
170 	struct ibuf	*wbuf;
171 
172 	if ((wbuf = imsg_create(ibuf, type, peerid, pid, datalen)) == NULL)
173 		return (-1);
174 
175 	if (imsg_add(wbuf, data, datalen) == -1)
176 		return (-1);
177 
178 	ibuf_fd_set(wbuf, fd);
179 	imsg_close(ibuf, wbuf);
180 
181 	return (1);
182 }
183 
184 int
185 imsg_composev(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid, pid_t pid,
186     int fd, const struct iovec *iov, int iovcnt)
187 {
188 	struct ibuf	*wbuf;
189 	int		 i, datalen = 0;
190 
191 	for (i = 0; i < iovcnt; i++)
192 		datalen += iov[i].iov_len;
193 
194 	if ((wbuf = imsg_create(ibuf, type, peerid, pid, datalen)) == NULL)
195 		return (-1);
196 
197 	for (i = 0; i < iovcnt; i++)
198 		if (imsg_add(wbuf, iov[i].iov_base, iov[i].iov_len) == -1)
199 			return (-1);
200 
201 	ibuf_fd_set(wbuf, fd);
202 	imsg_close(ibuf, wbuf);
203 
204 	return (1);
205 }
206 
207 int
208 imsg_compose_ibuf(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid,
209     pid_t pid, struct ibuf *buf)
210 {
211 	struct ibuf	*wbuf = NULL;
212 	struct imsg_hdr	 hdr;
213 	int save_errno;
214 
215 	if (ibuf_size(buf) + IMSG_HEADER_SIZE > MAX_IMSGSIZE) {
216 		errno = ERANGE;
217 		goto fail;
218 	}
219 
220 	hdr.type = type;
221 	hdr.len = ibuf_size(buf) + IMSG_HEADER_SIZE;
222 	hdr.flags = 0;
223 	hdr.peerid = peerid;
224 	if ((hdr.pid = pid) == 0)
225 		hdr.pid = ibuf->pid;
226 
227 	if ((wbuf = ibuf_open(IMSG_HEADER_SIZE)) == NULL)
228 		goto fail;
229 	if (imsg_add(wbuf, &hdr, sizeof(hdr)) == -1)
230 		goto fail;
231 
232 	ibuf_close(&ibuf->w, wbuf);
233 	ibuf_close(&ibuf->w, buf);
234 	return (1);
235 
236  fail:
237 	save_errno = errno;
238 	ibuf_free(buf);
239 	ibuf_free(wbuf);
240 	errno = save_errno;
241 	return (-1);
242 }
243 
244 struct ibuf *
245 imsg_create(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid, pid_t pid,
246     uint16_t datalen)
247 {
248 	struct ibuf	*wbuf;
249 	struct imsg_hdr	 hdr;
250 
251 	datalen += IMSG_HEADER_SIZE;
252 	if (datalen > MAX_IMSGSIZE) {
253 		errno = ERANGE;
254 		return (NULL);
255 	}
256 
257 	hdr.type = type;
258 	hdr.flags = 0;
259 	hdr.peerid = peerid;
260 	if ((hdr.pid = pid) == 0)
261 		hdr.pid = ibuf->pid;
262 	if ((wbuf = ibuf_dynamic(datalen, MAX_IMSGSIZE)) == NULL) {
263 		return (NULL);
264 	}
265 	if (imsg_add(wbuf, &hdr, sizeof(hdr)) == -1)
266 		return (NULL);
267 
268 	return (wbuf);
269 }
270 
271 int
272 imsg_add(struct ibuf *msg, const void *data, uint16_t datalen)
273 {
274 	if (datalen)
275 		if (ibuf_add(msg, data, datalen) == -1) {
276 			ibuf_free(msg);
277 			return (-1);
278 		}
279 	return (datalen);
280 }
281 
282 void
283 imsg_close(struct imsgbuf *ibuf, struct ibuf *msg)
284 {
285 	struct imsg_hdr	*hdr;
286 
287 	hdr = (struct imsg_hdr *)msg->buf;
288 
289 	hdr->flags &= ~IMSGF_HASFD;
290 	if (ibuf_fd_avail(msg))
291 		hdr->flags |= IMSGF_HASFD;
292 	hdr->len = ibuf_size(msg);
293 
294 	ibuf_close(&ibuf->w, msg);
295 }
296 
297 void
298 imsg_free(struct imsg *imsg)
299 {
300 	freezero(imsg->data, imsg->hdr.len - IMSG_HEADER_SIZE);
301 }
302 
303 static int
304 imsg_get_fd(struct imsgbuf *ibuf)
305 {
306 	int		 fd;
307 	struct imsg_fd	*ifd;
308 
309 	if ((ifd = TAILQ_FIRST(&ibuf->fds)) == NULL)
310 		return (-1);
311 
312 	fd = ifd->fd;
313 	TAILQ_REMOVE(&ibuf->fds, ifd, entry);
314 	free(ifd);
315 
316 	return (fd);
317 }
318 
319 int
320 imsg_flush(struct imsgbuf *ibuf)
321 {
322 	while (ibuf->w.queued)
323 		if (msgbuf_write(&ibuf->w) <= 0)
324 			return (-1);
325 	return (0);
326 }
327 
328 void
329 imsg_clear(struct imsgbuf *ibuf)
330 {
331 	int	fd;
332 
333 	msgbuf_clear(&ibuf->w);
334 	while ((fd = imsg_get_fd(ibuf)) != -1)
335 		close(fd);
336 }