1 /*	$OpenBSD: imsg.c,v 1.19 2023/06/19 17:19:50 claudio Exp $	*/
2 
3 /*
4  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include "compat.h"
20 
21 #include <sys/types.h>
22 #include <sys/socket.h>
23 #include <sys/uio.h>
24 
25 #include <errno.h>
26 #include <stdlib.h>
27 #include <string.h>
28 #include <unistd.h>
29 
30 #include "imsg.h"
31 
32 int	 imsg_fd_overhead = 0;
33 
34 static int	 imsg_get_fd(struct imsgbuf *);
35 
36 void
37 imsg_init(struct imsgbuf *ibuf, int fd)
38 {
39 	msgbuf_init(&ibuf->w);
40 	memset(&ibuf->r, 0, sizeof(ibuf->r));
41 	ibuf->fd = fd;
42 	ibuf->w.fd = fd;
43 	ibuf->pid = getpid();
44 	TAILQ_INIT(&ibuf->fds);
45 }
46 
47 ssize_t
48 imsg_read(struct imsgbuf *ibuf)
49 {
50 	struct msghdr		 msg;
51 	struct cmsghdr		*cmsg;
52 	union {
53 		struct cmsghdr hdr;
54 		char	buf[CMSG_SPACE(sizeof(int) * 1)];
55 	} cmsgbuf;
56 	struct iovec		 iov;
57 	ssize_t			 n = -1;
58 	int			 fd;
59 	struct imsg_fd		*ifd;
60 
61 	memset(&msg, 0, sizeof(msg));
62 	memset(&cmsgbuf, 0, sizeof(cmsgbuf));
63 
64 	iov.iov_base = ibuf->r.buf + ibuf->r.wpos;
65 	iov.iov_len = sizeof(ibuf->r.buf) - ibuf->r.wpos;
66 	msg.msg_iov = &iov;
67 	msg.msg_iovlen = 1;
68 	msg.msg_control = &cmsgbuf.buf;
69 	msg.msg_controllen = sizeof(cmsgbuf.buf);
70 
71 	if ((ifd = calloc(1, sizeof(struct imsg_fd))) == NULL)
72 		return (-1);
73 
74 again:
75 	if (getdtablecount() + imsg_fd_overhead +
76 	    (int)((CMSG_SPACE(sizeof(int))-CMSG_SPACE(0))/sizeof(int))
77 	    >= getdtablesize()) {
78 		errno = EAGAIN;
79 		free(ifd);
80 		return (-1);
81 	}
82 
83 	if ((n = recvmsg(ibuf->fd, &msg, 0)) == -1) {
84 		if (errno == EINTR)
85 			goto again;
86 		goto fail;
87 	}
88 
89 	ibuf->r.wpos += n;
90 
91 	for (cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL;
92 	    cmsg = CMSG_NXTHDR(&msg, cmsg)) {
93 		if (cmsg->cmsg_level == SOL_SOCKET &&
94 		    cmsg->cmsg_type == SCM_RIGHTS) {
95 			int i;
96 			int j;
97 
98 			/*
99 			 * We only accept one file descriptor.  Due to C
100 			 * padding rules, our control buffer might contain
101 			 * more than one fd, and we must close them.
102 			 */
103 			j = ((char *)cmsg + cmsg->cmsg_len -
104 			    (char *)CMSG_DATA(cmsg)) / sizeof(int);
105 			for (i = 0; i < j; i++) {
106 				fd = ((int *)CMSG_DATA(cmsg))[i];
107 				if (ifd != NULL) {
108 					ifd->fd = fd;
109 					TAILQ_INSERT_TAIL(&ibuf->fds, ifd,
110 					    entry);
111 					ifd = NULL;
112 				} else
113 					close(fd);
114 			}
115 		}
116 		/* we do not handle other ctl data level */
117 	}
118 
119 fail:
120 	free(ifd);
121 	return (n);
122 }
123 
124 ssize_t
125 imsg_get(struct imsgbuf *ibuf, struct imsg *imsg)
126 {
127 	size_t			 av, left, datalen;
128 
129 	av = ibuf->r.wpos;
130 
131 	if (IMSG_HEADER_SIZE > av)
132 		return (0);
133 
134 	memcpy(&imsg->hdr, ibuf->r.buf, sizeof(imsg->hdr));
135 	if (imsg->hdr.len < IMSG_HEADER_SIZE ||
136 	    imsg->hdr.len > MAX_IMSGSIZE) {
137 		errno = ERANGE;
138 		return (-1);
139 	}
140 	if (imsg->hdr.len > av)
141 		return (0);
142 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
143 	ibuf->r.rptr = ibuf->r.buf + IMSG_HEADER_SIZE;
144 	if (datalen == 0)
145 		imsg->data = NULL;
146 	else if ((imsg->data = malloc(datalen)) == NULL)
147 		return (-1);
148 
149 	if (imsg->hdr.flags & IMSGF_HASFD)
150 		imsg->fd = imsg_get_fd(ibuf);
151 	else
152 		imsg->fd = -1;
153 
154 	if (datalen != 0)
155 		memcpy(imsg->data, ibuf->r.rptr, datalen);
156 
157 	if (imsg->hdr.len < av) {
158 		left = av - imsg->hdr.len;
159 		memmove(&ibuf->r.buf, ibuf->r.buf + imsg->hdr.len, left);
160 		ibuf->r.wpos = left;
161 	} else
162 		ibuf->r.wpos = 0;
163 
164 	return (datalen + IMSG_HEADER_SIZE);
165 }
166 
167 int
168 imsg_compose(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid, pid_t pid,
169     int fd, const void *data, uint16_t datalen)
170 {
171 	struct ibuf	*wbuf;
172 
173 	if ((wbuf = imsg_create(ibuf, type, peerid, pid, datalen)) == NULL)
174 		return (-1);
175 
176 	if (imsg_add(wbuf, data, datalen) == -1)
177 		return (-1);
178 
179 	ibuf_fd_set(wbuf, fd);
180 	imsg_close(ibuf, wbuf);
181 
182 	return (1);
183 }
184 
185 int
186 imsg_composev(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid, pid_t pid,
187     int fd, const struct iovec *iov, int iovcnt)
188 {
189 	struct ibuf	*wbuf;
190 	int		 i, datalen = 0;
191 
192 	for (i = 0; i < iovcnt; i++)
193 		datalen += iov[i].iov_len;
194 
195 	if ((wbuf = imsg_create(ibuf, type, peerid, pid, datalen)) == NULL)
196 		return (-1);
197 
198 	for (i = 0; i < iovcnt; i++)
199 		if (imsg_add(wbuf, iov[i].iov_base, iov[i].iov_len) == -1)
200 			return (-1);
201 
202 	ibuf_fd_set(wbuf, fd);
203 	imsg_close(ibuf, wbuf);
204 
205 	return (1);
206 }
207 
208 int
209 imsg_compose_ibuf(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid,
210     pid_t pid, struct ibuf *buf)
211 {
212 	struct ibuf	*wbuf = NULL;
213 	struct imsg_hdr	 hdr;
214 	int save_errno;
215 
216 	if (ibuf_size(buf) + IMSG_HEADER_SIZE > MAX_IMSGSIZE) {
217 		errno = ERANGE;
218 		goto fail;
219 	}
220 
221 	hdr.type = type;
222 	hdr.len = ibuf_size(buf) + IMSG_HEADER_SIZE;
223 	hdr.flags = 0;
224 	hdr.peerid = peerid;
225 	if ((hdr.pid = pid) == 0)
226 		hdr.pid = ibuf->pid;
227 
228 	if ((wbuf = ibuf_open(IMSG_HEADER_SIZE)) == NULL)
229 		goto fail;
230 	if (imsg_add(wbuf, &hdr, sizeof(hdr)) == -1)
231 		goto fail;
232 
233 	ibuf_close(&ibuf->w, wbuf);
234 	ibuf_close(&ibuf->w, buf);
235 	return (1);
236 
237  fail:
238 	save_errno = errno;
239 	ibuf_free(buf);
240 	ibuf_free(wbuf);
241 	errno = save_errno;
242 	return (-1);
243 }
244 
245 struct ibuf *
246 imsg_create(struct imsgbuf *ibuf, uint32_t type, uint32_t peerid, pid_t pid,
247     uint16_t datalen)
248 {
249 	struct ibuf	*wbuf;
250 	struct imsg_hdr	 hdr;
251 
252 	datalen += IMSG_HEADER_SIZE;
253 	if (datalen > MAX_IMSGSIZE) {
254 		errno = ERANGE;
255 		return (NULL);
256 	}
257 
258 	hdr.type = type;
259 	hdr.flags = 0;
260 	hdr.peerid = peerid;
261 	if ((hdr.pid = pid) == 0)
262 		hdr.pid = ibuf->pid;
263 	if ((wbuf = ibuf_dynamic(datalen, MAX_IMSGSIZE)) == NULL) {
264 		return (NULL);
265 	}
266 	if (imsg_add(wbuf, &hdr, sizeof(hdr)) == -1)
267 		return (NULL);
268 
269 	return (wbuf);
270 }
271 
272 int
273 imsg_add(struct ibuf *msg, const void *data, uint16_t datalen)
274 {
275 	if (datalen)
276 		if (ibuf_add(msg, data, datalen) == -1) {
277 			ibuf_free(msg);
278 			return (-1);
279 		}
280 	return (datalen);
281 }
282 
283 void
284 imsg_close(struct imsgbuf *ibuf, struct ibuf *msg)
285 {
286 	struct imsg_hdr	*hdr;
287 
288 	hdr = (struct imsg_hdr *)msg->buf;
289 
290 	hdr->flags &= ~IMSGF_HASFD;
291 	if (ibuf_fd_avail(msg))
292 		hdr->flags |= IMSGF_HASFD;
293 	hdr->len = ibuf_size(msg);
294 
295 	ibuf_close(&ibuf->w, msg);
296 }
297 
298 void
299 imsg_free(struct imsg *imsg)
300 {
301 	freezero(imsg->data, imsg->hdr.len - IMSG_HEADER_SIZE);
302 }
303 
304 static int
305 imsg_get_fd(struct imsgbuf *ibuf)
306 {
307 	int		 fd;
308 	struct imsg_fd	*ifd;
309 
310 	if ((ifd = TAILQ_FIRST(&ibuf->fds)) == NULL)
311 		return (-1);
312 
313 	fd = ifd->fd;
314 	TAILQ_REMOVE(&ibuf->fds, ifd, entry);
315 	free(ifd);
316 
317 	return (fd);
318 }
319 
320 int
321 imsg_flush(struct imsgbuf *ibuf)
322 {
323 	while (ibuf->w.queued)
324 		if (msgbuf_write(&ibuf->w) <= 0)
325 			return (-1);
326 	return (0);
327 }
328 
329 void
330 imsg_clear(struct imsgbuf *ibuf)
331 {
332 	int	fd;
333 
334 	msgbuf_clear(&ibuf->w);
335 	while ((fd = imsg_get_fd(ibuf)) != -1)
336 		close(fd);
337 }