src/libsystemd/sd-bus/bus-socket.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <endian.h>
   4 #include <poll.h>
   5 #include <stdlib.h>
   6 #include <unistd.h>
   7
   8 #include "sd-bus.h"
   9 #include "sd-daemon.h"
  10
  11 #include "alloc-util.h"
  12 #include "bus-internal.h"
  13 #include "bus-message.h"
  14 #include "bus-socket.h"
  15 #include "fd-util.h"
  16 #include "format-util.h"
  17 #include "fs-util.h"
  18 #include "hexdecoct.h"
  19 #include "io-util.h"
  20 #include "macro.h"
  21 #include "memory-util.h"
  22 #include "path-util.h"
  23 #include "process-util.h"
  24 #include "rlimit-util.h"
  25 #include "signal-util.h"
  26 #include "stdio-util.h"
  27 #include "string-util.h"
  28 #include "user-util.h"
  29 #include "utf8.h"
  30
  31 #define SNDBUF_SIZE (8*1024*1024)
  32
  33 static void iovec_advance(struct iovec iov[], unsigned *idx, size_t size) {
  34
  35         while (size > 0) {
  36                 struct iovec *i = iov + *idx;
  37
  38                 if (i->iov_len > size) {
  39                         i->iov_base = (uint8_t*) i->iov_base + size;
  40                         i->iov_len -= size;
  41                         return;
  42                 }
  43
  44                 size -= i->iov_len;
  45
  46                 *i = IOVEC_MAKE(NULL, 0);
  47
  48                 (*idx)++;
  49         }
  50 }
  51
  52 static int append_iovec(sd_bus_message *m, const void *p, size_t sz) {
  53         assert(m);
  54         assert(p);
  55         assert(sz > 0);
  56
  57         m->iovec[m->n_iovec++] = IOVEC_MAKE((void*) p, sz);
  58
  59         return 0;
  60 }
  61
  62 static int bus_message_setup_iovec(sd_bus_message *m) {
  63         struct bus_body_part *part;
  64         unsigned n, i;
  65         int r;
  66
  67         assert(m);
  68         assert(m->sealed);
  69
  70         if (m->n_iovec > 0)
  71                 return 0;
  72
  73         assert(!m->iovec);
  74
  75         n = 1 + m->n_body_parts;
  76         if (n < ELEMENTSOF(m->iovec_fixed))
  77                 m->iovec = m->iovec_fixed;
  78         else {
  79                 m->iovec = new(struct iovec, n);
  80                 if (!m->iovec) {
  81                         r = -ENOMEM;
  82                         goto fail;
  83                 }
  84         }
  85
  86         r = append_iovec(m, m->header, BUS_MESSAGE_BODY_BEGIN(m));
  87         if (r < 0)
  88                 goto fail;
  89
  90         MESSAGE_FOREACH_PART(part, i, m)  {
  91                 r = bus_body_part_map(part);
  92                 if (r < 0)
  93                         goto fail;
  94
  95                 r = append_iovec(m, part->data, part->size);
  96                 if (r < 0)
  97                         goto fail;
  98         }
  99
 100         assert(n == m->n_iovec);
 101
 102         return 0;
 103
 104 fail:
 105         m->poisoned = true;
 106         return r;
 107 }
 108
 109 bool bus_socket_auth_needs_write(sd_bus *b) {
 110
 111         unsigned i;
 112
 113         if (b->auth_index >= ELEMENTSOF(b->auth_iovec))
 114                 return false;
 115
 116         for (i = b->auth_index; i < ELEMENTSOF(b->auth_iovec); i++) {
 117                 struct iovec *j = b->auth_iovec + i;
 118
 119                 if (j->iov_len > 0)
 120                         return true;
 121         }
 122
 123         return false;
 124 }
 125
 126 static int bus_socket_write_auth(sd_bus *b) {
 127         ssize_t k;
 128
 129         assert(b);
 130         assert(b->state == BUS_AUTHENTICATING);
 131
 132         if (!bus_socket_auth_needs_write(b))
 133                 return 0;
 134
 135         if (b->prefer_writev)
 136                 k = writev(b->output_fd, b->auth_iovec + b->auth_index, ELEMENTSOF(b->auth_iovec) - b->auth_index);
 137         else {
 138                 struct msghdr mh = {
 139                         .msg_iov = b->auth_iovec + b->auth_index,
 140                         .msg_iovlen = ELEMENTSOF(b->auth_iovec) - b->auth_index,
 141                 };
 142
 143                 k = sendmsg(b->output_fd, &mh, MSG_DONTWAIT|MSG_NOSIGNAL);
 144                 if (k < 0 && errno == ENOTSOCK) {
 145                         b->prefer_writev = true;
 146                         k = writev(b->output_fd, b->auth_iovec + b->auth_index, ELEMENTSOF(b->auth_iovec) - b->auth_index);
 147                 }
 148         }
 149
 150         if (k < 0)
 151                 return errno == EAGAIN ? 0 : -errno;
 152
 153         iovec_advance(b->auth_iovec, &b->auth_index, (size_t) k);
 154         return 1;
 155 }
 156
 157 static int bus_socket_auth_verify_client(sd_bus *b) {
 158         char *d, *e, *f, *start;
 159         sd_id128_t peer;
 160         int r;
 161
 162         assert(b);
 163
 164         /*
 165          * We expect three response lines:
 166          *   "DATA\r\n"
 167          *   "OK <server-id>\r\n"
 168          *   "AGREE_UNIX_FD\r\n"        (optional)
 169          */
 170
 171         d = memmem_safe(b->rbuffer, b->rbuffer_size, "\r\n", 2);
 172         if (!d)
 173                 return 0;
 174
 175         e = memmem(d + 2, b->rbuffer_size - (d - (char*) b->rbuffer) - 2, "\r\n", 2);
 176         if (!e)
 177                 return 0;
 178
 179         if (b->accept_fd) {
 180                 f = memmem(e + 2, b->rbuffer_size - (e - (char*) b->rbuffer) - 2, "\r\n", 2);
 181                 if (!f)
 182                         return 0;
 183
 184                 start = f + 2;
 185         } else {
 186                 f = NULL;
 187                 start = e + 2;
 188         }
 189
 190         /* Nice! We got all the lines we need. First check the DATA line. */
 191
 192         if (d - (char*) b->rbuffer == 4) {
 193                 if (memcmp(b->rbuffer, "DATA", 4))
 194                         return -EPERM;
 195         } else if (d - (char*) b->rbuffer == 3 + 32) {
 196                 /*
 197                  * Old versions of the server-side implementation of `sd-bus` replied with "OK <id>" to
 198                  * "AUTH" requests from a client, even if the "AUTH" line did not contain inlined
 199                  * arguments. Therefore, we also accept "OK <id>" here, even though it is technically the
 200                  * wrong reply. We ignore the "<id>" parameter, though, since it has no real value.
 201                  */
 202                 if (memcmp(b->rbuffer, "OK ", 3))
 203                         return -EPERM;
 204         } else
 205                 return -EPERM;
 206
 207         /* Now check the OK line. */
 208
 209         if (e - d != 2 + 3 + 32)
 210                 return -EPERM;
 211
 212         if (memcmp(d + 2, "OK ", 3))
 213                 return -EPERM;
 214
 215         b->auth = b->anonymous_auth ? BUS_AUTH_ANONYMOUS : BUS_AUTH_EXTERNAL;
 216
 217         for (unsigned i = 0; i < 32; i += 2) {
 218                 int x, y;
 219
 220                 x = unhexchar(d[2 + 3 + i]);
 221                 y = unhexchar(d[2 + 3 + i + 1]);
 222
 223                 if (x < 0 || y < 0)
 224                         return -EINVAL;
 225
 226                 peer.bytes[i/2] = ((uint8_t) x << 4 | (uint8_t) y);
 227         }
 228
 229         if (!sd_id128_is_null(b->server_id) &&
 230             !sd_id128_equal(b->server_id, peer))
 231                 return -EPERM;
 232
 233         b->server_id = peer;
 234
 235         /* And possibly check the third line, too */
 236
 237         if (f)
 238                 b->can_fds =
 239                         (f - e == STRLEN("\r\nAGREE_UNIX_FD")) &&
 240                         memcmp(e + 2, "AGREE_UNIX_FD",
 241                                STRLEN("AGREE_UNIX_FD")) == 0;
 242
 243         b->rbuffer_size -= (start - (char*) b->rbuffer);
 244         memmove(b->rbuffer, start, b->rbuffer_size);
 245
 246         r = bus_start_running(b);
 247         if (r < 0)
 248                 return r;
 249
 250         return 1;
 251 }
 252
 253 static bool line_equals(const char *s, size_t m, const char *line) {
 254         size_t l;
 255
 256         l = strlen(line);
 257         if (l != m)
 258                 return false;
 259
 260         return memcmp(s, line, l) == 0;
 261 }
 262
 263 static bool line_begins(const char *s, size_t m, const char *word) {
 264         const char *p;
 265
 266         p = memory_startswith(s, m, word);
 267         return p && (p == (s + m) || *p == ' ');
 268 }
 269
 270 static int verify_anonymous_token(sd_bus *b, const char *p, size_t l) {
 271         _cleanup_free_ char *token = NULL;
 272         size_t len;
 273         int r;
 274
 275         if (!b->anonymous_auth)
 276                 return 0;
 277
 278         if (l <= 0)
 279                 return 1;
 280
 281         assert(p[0] == ' ');
 282         p++; l--;
 283
 284         if (l % 2 != 0)
 285                 return 0;
 286
 287         r = unhexmem(p, l, (void **) &token, &len);
 288         if (r < 0)
 289                 return 0;
 290
 291         if (memchr(token, 0, len))
 292                 return 0;
 293
 294         return !!utf8_is_valid(token);
 295 }
 296
 297 static int verify_external_token(sd_bus *b, const char *p, size_t l) {
 298         _cleanup_free_ char *token = NULL;
 299         size_t len;
 300         uid_t u;
 301         int r;
 302
 303         /* We don't do any real authentication here. Instead, we if
 304          * the owner of this bus wanted authentication he should have
 305          * checked SO_PEERCRED before even creating the bus object. */
 306
 307         if (!b->anonymous_auth && !b->ucred_valid)
 308                 return 0;
 309
 310         if (l <= 0)
 311                 return 1;
 312
 313         assert(p[0] == ' ');
 314         p++; l--;
 315
 316         if (l % 2 != 0)
 317                 return 0;
 318
 319         r = unhexmem(p, l, (void**) &token, &len);
 320         if (r < 0)
 321                 return 0;
 322
 323         if (memchr(token, 0, len))
 324                 return 0;
 325
 326         r = parse_uid(token, &u);
 327         if (r < 0)
 328                 return 0;
 329
 330         /* We ignore the passed value if anonymous authentication is
 331          * on anyway. */
 332         if (!b->anonymous_auth && u != b->ucred.uid)
 333                 return 0;
 334
 335         return 1;
 336 }
 337
 338 static int bus_socket_auth_write(sd_bus *b, const char *t) {
 339         char *p;
 340         size_t l;
 341
 342         assert(b);
 343         assert(t);
 344
 345         /* We only make use of the first iovec */
 346         assert(IN_SET(b->auth_index, 0, 1));
 347
 348         l = strlen(t);
 349         p = malloc(b->auth_iovec[0].iov_len + l);
 350         if (!p)
 351                 return -ENOMEM;
 352
 353         memcpy_safe(p, b->auth_iovec[0].iov_base, b->auth_iovec[0].iov_len);
 354         memcpy(p + b->auth_iovec[0].iov_len, t, l);
 355
 356         b->auth_iovec[0].iov_base = p;
 357         b->auth_iovec[0].iov_len += l;
 358
 359         free(b->auth_buffer);
 360         b->auth_buffer = p;
 361         b->auth_index = 0;
 362         return 0;
 363 }
 364
 365 static int bus_socket_auth_write_ok(sd_bus *b) {
 366         char t[3 + 32 + 2 + 1];
 367
 368         assert(b);
 369
 370         xsprintf(t, "OK " SD_ID128_FORMAT_STR "\r\n", SD_ID128_FORMAT_VAL(b->server_id));
 371
 372         return bus_socket_auth_write(b, t);
 373 }
 374
 375 static int bus_socket_auth_verify_server(sd_bus *b) {
 376         char *e;
 377         const char *line;
 378         size_t l;
 379         bool processed = false;
 380         int r;
 381
 382         assert(b);
 383
 384         if (b->rbuffer_size < 1)
 385                 return 0;
 386
 387         /* First char must be a NUL byte */
 388         if (*(char*) b->rbuffer != 0)
 389                 return -EIO;
 390
 391         if (b->rbuffer_size < 3)
 392                 return 0;
 393
 394         /* Begin with the first line */
 395         if (b->auth_rbegin <= 0)
 396                 b->auth_rbegin = 1;
 397
 398         for (;;) {
 399                 /* Check if line is complete */
 400                 line = (char*) b->rbuffer + b->auth_rbegin;
 401                 e = memmem(line, b->rbuffer_size - b->auth_rbegin, "\r\n", 2);
 402                 if (!e)
 403                         return processed;
 404
 405                 l = e - line;
 406
 407                 if (line_begins(line, l, "AUTH ANONYMOUS")) {
 408
 409                         r = verify_anonymous_token(b,
 410                                                    line + strlen("AUTH ANONYMOUS"),
 411                                                    l - strlen("AUTH ANONYMOUS"));
 412                         if (r < 0)
 413                                 return r;
 414                         if (r == 0)
 415                                 r = bus_socket_auth_write(b, "REJECTED\r\n");
 416                         else {
 417                                 b->auth = BUS_AUTH_ANONYMOUS;
 418                                 if (l <= strlen("AUTH ANONYMOUS"))
 419                                         r = bus_socket_auth_write(b, "DATA\r\n");
 420                                 else
 421                                         r = bus_socket_auth_write_ok(b);
 422                         }
 423
 424                 } else if (line_begins(line, l, "AUTH EXTERNAL")) {
 425
 426                         r = verify_external_token(b,
 427                                                   line + strlen("AUTH EXTERNAL"),
 428                                                   l - strlen("AUTH EXTERNAL"));
 429                         if (r < 0)
 430                                 return r;
 431                         if (r == 0)
 432                                 r = bus_socket_auth_write(b, "REJECTED\r\n");
 433                         else {
 434                                 b->auth = BUS_AUTH_EXTERNAL;
 435                                 if (l <= strlen("AUTH EXTERNAL"))
 436                                         r = bus_socket_auth_write(b, "DATA\r\n");
 437                                 else
 438                                         r = bus_socket_auth_write_ok(b);
 439                         }
 440
 441                 } else if (line_begins(line, l, "AUTH"))
 442                         r = bus_socket_auth_write(b, "REJECTED EXTERNAL ANONYMOUS\r\n");
 443                 else if (line_equals(line, l, "CANCEL") ||
 444                          line_begins(line, l, "ERROR")) {
 445
 446                         b->auth = _BUS_AUTH_INVALID;
 447                         r = bus_socket_auth_write(b, "REJECTED\r\n");
 448
 449                 } else if (line_equals(line, l, "BEGIN")) {
 450
 451                         if (b->auth == _BUS_AUTH_INVALID)
 452                                 r = bus_socket_auth_write(b, "ERROR\r\n");
 453                         else {
 454                                 /* We can't leave from the auth phase
 455                                  * before we haven't written
 456                                  * everything queued, so let's check
 457                                  * that */
 458
 459                                 if (bus_socket_auth_needs_write(b))
 460                                         return 1;
 461
 462                                 b->rbuffer_size -= (e + 2 - (char*) b->rbuffer);
 463                                 memmove(b->rbuffer, e + 2, b->rbuffer_size);
 464                                 return bus_start_running(b);
 465                         }
 466
 467                 } else if (line_begins(line, l, "DATA")) {
 468
 469                         if (b->auth == _BUS_AUTH_INVALID)
 470                                 r = bus_socket_auth_write(b, "ERROR\r\n");
 471                         else {
 472                                 if (b->auth == BUS_AUTH_ANONYMOUS)
 473                                         r = verify_anonymous_token(b, line + 4, l - 4);
 474                                 else
 475                                         r = verify_external_token(b, line + 4, l - 4);
 476
 477                                 if (r < 0)
 478                                         return r;
 479                                 if (r == 0) {
 480                                         b->auth = _BUS_AUTH_INVALID;
 481                                         r = bus_socket_auth_write(b, "REJECTED\r\n");
 482                                 } else
 483                                         r = bus_socket_auth_write_ok(b);
 484                         }
 485                 } else if (line_equals(line, l, "NEGOTIATE_UNIX_FD")) {
 486                         if (b->auth == _BUS_AUTH_INVALID || !b->accept_fd)
 487                                 r = bus_socket_auth_write(b, "ERROR\r\n");
 488                         else {
 489                                 b->can_fds = true;
 490                                 r = bus_socket_auth_write(b, "AGREE_UNIX_FD\r\n");
 491                         }
 492                 } else
 493                         r = bus_socket_auth_write(b, "ERROR\r\n");
 494
 495                 if (r < 0)
 496                         return r;
 497
 498                 b->auth_rbegin = e + 2 - (char*) b->rbuffer;
 499
 500                 processed = true;
 501         }
 502 }
 503
 504 static int bus_socket_auth_verify(sd_bus *b) {
 505         assert(b);
 506
 507         if (b->is_server)
 508                 return bus_socket_auth_verify_server(b);
 509         else
 510                 return bus_socket_auth_verify_client(b);
 511 }
 512
 513 static int bus_socket_read_auth(sd_bus *b) {
 514         struct msghdr mh;
 515         struct iovec iov = {};
 516         size_t n;
 517         ssize_t k;
 518         int r;
 519         void *p;
 520         CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)) control;
 521         bool handle_cmsg = false;
 522
 523         assert(b);
 524         assert(b->state == BUS_AUTHENTICATING);
 525
 526         r = bus_socket_auth_verify(b);
 527         if (r != 0)
 528                 return r;
 529
 530         n = MAX(256u, b->rbuffer_size * 2);
 531
 532         if (n > BUS_AUTH_SIZE_MAX)
 533                 n = BUS_AUTH_SIZE_MAX;
 534
 535         if (b->rbuffer_size >= n)
 536                 return -ENOBUFS;
 537
 538         p = realloc(b->rbuffer, n);
 539         if (!p)
 540                 return -ENOMEM;
 541
 542         b->rbuffer = p;
 543
 544         iov = IOVEC_MAKE((uint8_t *)b->rbuffer + b->rbuffer_size, n - b->rbuffer_size);
 545
 546         if (b->prefer_readv) {
 547                 k = readv(b->input_fd, &iov, 1);
 548                 if (k < 0)
 549                         k = -errno;
 550         } else {
 551                 mh = (struct msghdr) {
 552                         .msg_iov = &iov,
 553                         .msg_iovlen = 1,
 554                         .msg_control = &control,
 555                         .msg_controllen = sizeof(control),
 556                 };
 557
 558                 k = recvmsg_safe(b->input_fd, &mh, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
 559                 if (k == -ENOTSOCK) {
 560                         b->prefer_readv = true;
 561                         k = readv(b->input_fd, &iov, 1);
 562                         if (k < 0)
 563                                 k = -errno;
 564                 } else
 565                         handle_cmsg = true;
 566         }
 567         if (k == -EAGAIN)
 568                 return 0;
 569         if (k < 0)
 570                 return (int) k;
 571         if (k == 0) {
 572                 if (handle_cmsg)
 573                         cmsg_close_all(&mh); /* paranoia, we shouldn't have gotten any fds on EOF */
 574                 return -ECONNRESET;
 575         }
 576
 577         b->rbuffer_size += k;
 578
 579         if (handle_cmsg) {
 580                 struct cmsghdr *cmsg;
 581
 582                 CMSG_FOREACH(cmsg, &mh)
 583                         if (cmsg->cmsg_level == SOL_SOCKET &&
 584                             cmsg->cmsg_type == SCM_RIGHTS) {
 585                                 int j;
 586
 587                                 /* Whut? We received fds during the auth
 588                                  * protocol? Somebody is playing games with
 589                                  * us. Close them all, and fail */
 590                                 j = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
 591                                 close_many((int*) CMSG_DATA(cmsg), j);
 592                                 return -EIO;
 593                         } else
 594                                 log_debug("Got unexpected auxiliary data with level=%d and type=%d",
 595                                           cmsg->cmsg_level, cmsg->cmsg_type);
 596         }
 597
 598         r = bus_socket_auth_verify(b);
 599         if (r != 0)
 600                 return r;
 601
 602         return 1;
 603 }
 604
 605 void bus_socket_setup(sd_bus *b) {
 606         assert(b);
 607
 608         /* Increase the buffers to 8 MB */
 609         (void) fd_inc_rcvbuf(b->input_fd, SNDBUF_SIZE);
 610         (void) fd_inc_sndbuf(b->output_fd, SNDBUF_SIZE);
 611
 612         b->message_version = 1;
 613         b->message_endian = 0;
 614 }
 615
 616 static void bus_get_peercred(sd_bus *b) {
 617         int r;
 618
 619         assert(b);
 620         assert(!b->ucred_valid);
 621         assert(!b->label);
 622         assert(b->n_groups == SIZE_MAX);
 623
 624         /* Get the peer for socketpair() sockets */
 625         b->ucred_valid = getpeercred(b->input_fd, &b->ucred) >= 0;
 626
 627         /* Get the SELinux context of the peer */
 628         r = getpeersec(b->input_fd, &b->label);
 629         if (r < 0 && !IN_SET(r, -EOPNOTSUPP, -ENOPROTOOPT))
 630                 log_debug_errno(r, "Failed to determine peer security context: %m");
 631
 632         /* Get the list of auxiliary groups of the peer */
 633         r = getpeergroups(b->input_fd, &b->groups);
 634         if (r >= 0)
 635                 b->n_groups = (size_t) r;
 636         else if (!IN_SET(r, -EOPNOTSUPP, -ENOPROTOOPT))
 637                 log_debug_errno(r, "Failed to determine peer's group list: %m");
 638 }
 639
 640 static int bus_socket_start_auth_client(sd_bus *b) {
 641         static const char sasl_auth_anonymous[] = {
 642                 /*
 643                  * We use an arbitrary trace-string for the ANONYMOUS authentication. It can be used by the
 644                  * message broker to aid debugging of clients. We fully anonymize the connection and use a
 645                  * static default.
 646                  */
 647                 "\0AUTH ANONYMOUS\r\n"
 648                 /* HEX a n o n y m o u s */
 649                 "DATA 616e6f6e796d6f7573\r\n"
 650         };
 651         static const char sasl_auth_external[] = {
 652                 "\0AUTH EXTERNAL\r\n"
 653                 "DATA\r\n"
 654         };
 655         static const char sasl_negotiate_unix_fd[] = {
 656                 "NEGOTIATE_UNIX_FD\r\n"
 657         };
 658         static const char sasl_begin[] = {
 659                 "BEGIN\r\n"
 660         };
 661         size_t i = 0;
 662
 663         assert(b);
 664
 665         if (b->anonymous_auth)
 666                 b->auth_iovec[i++] = IOVEC_MAKE((char*) sasl_auth_anonymous, sizeof(sasl_auth_anonymous) - 1);
 667         else
 668                 b->auth_iovec[i++] = IOVEC_MAKE((char*) sasl_auth_external, sizeof(sasl_auth_external) - 1);
 669
 670         if (b->accept_fd)
 671                 b->auth_iovec[i++] = IOVEC_MAKE_STRING(sasl_negotiate_unix_fd);
 672
 673         b->auth_iovec[i++] = IOVEC_MAKE_STRING(sasl_begin);
 674
 675         return bus_socket_write_auth(b);
 676 }
 677
 678 int bus_socket_start_auth(sd_bus *b) {
 679         assert(b);
 680
 681         bus_get_peercred(b);
 682
 683         bus_set_state(b, BUS_AUTHENTICATING);
 684         b->auth_timeout = now(CLOCK_MONOTONIC) + BUS_AUTH_TIMEOUT;
 685
 686         if (sd_is_socket(b->input_fd, AF_UNIX, 0, 0) <= 0)
 687                 b->accept_fd = false;
 688
 689         if (b->output_fd != b->input_fd)
 690                 if (sd_is_socket(b->output_fd, AF_UNIX, 0, 0) <= 0)
 691                         b->accept_fd = false;
 692
 693         if (b->is_server)
 694                 return bus_socket_read_auth(b);
 695         else
 696                 return bus_socket_start_auth_client(b);
 697 }
 698
 699 static int bus_socket_inotify_setup(sd_bus *b) {
 700         _cleanup_free_ int *new_watches = NULL;
 701         _cleanup_free_ char *absolute = NULL;
 702         size_t n = 0, done = 0, i;
 703         unsigned max_follow = 32;
 704         const char *p;
 705         int wd, r;
 706
 707         assert(b);
 708         assert(b->watch_bind);
 709         assert(b->sockaddr.sa.sa_family == AF_UNIX);
 710         assert(b->sockaddr.un.sun_path[0] != 0);
 711
 712         /* Sets up an inotify fd in case watch_bind is enabled: wait until the configured AF_UNIX file system socket
 713          * appears before connecting to it. The implemented is pretty simplistic: we just subscribe to relevant changes
 714          * to all prefix components of the path, and every time we get an event for that we try to reconnect again,
 715          * without actually caring what precisely the event we got told us. If we still can't connect we re-subscribe
 716          * to all relevant changes of anything in the path, so that our watches include any possibly newly created path
 717          * components. */
 718
 719         if (b->inotify_fd < 0) {
 720                 b->inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
 721                 if (b->inotify_fd < 0)
 722                         return -errno;
 723
 724                 b->inotify_fd = fd_move_above_stdio(b->inotify_fd);
 725         }
 726
 727         /* Make sure the path is NUL terminated */
 728         p = strndupa(b->sockaddr.un.sun_path, sizeof(b->sockaddr.un.sun_path));
 729
 730         /* Make sure the path is absolute */
 731         r = path_make_absolute_cwd(p, &absolute);
 732         if (r < 0)
 733                 goto fail;
 734
 735         /* Watch all parent directories, and don't mind any prefix that doesn't exist yet. For the innermost directory
 736          * that exists we want to know when files are created or moved into it. For all parents of it we just care if
 737          * they are removed or renamed. */
 738
 739         if (!GREEDY_REALLOC(new_watches, n + 1)) {
 740                 r = -ENOMEM;
 741                 goto fail;
 742         }
 743
 744         /* Start with the top-level directory, which is a bit simpler than the rest, since it can't be a symlink, and
 745          * always exists */
 746         wd = inotify_add_watch(b->inotify_fd, "/", IN_CREATE|IN_MOVED_TO);
 747         if (wd < 0) {
 748                 r = log_debug_errno(errno, "Failed to add inotify watch on /: %m");
 749                 goto fail;
 750         } else
 751                 new_watches[n++] = wd;
 752
 753         for (;;) {
 754                 _cleanup_free_ char *component = NULL, *prefix = NULL, *destination = NULL;
 755                 size_t n_slashes, n_component;
 756                 char *c = NULL;
 757
 758                 n_slashes = strspn(absolute + done, "/");
 759                 n_component = n_slashes + strcspn(absolute + done + n_slashes, "/");
 760
 761                 if (n_component == 0) /* The end */
 762                         break;
 763
 764                 component = strndup(absolute + done, n_component);
 765                 if (!component) {
 766                         r = -ENOMEM;
 767                         goto fail;
 768                 }
 769
 770                 /* A trailing slash? That's a directory, and not a socket then */
 771                 if (path_equal(component, "/")) {
 772                         r = -EISDIR;
 773                         goto fail;
 774                 }
 775
 776                 /* A single dot? Let's eat this up */
 777                 if (path_equal(component, "/.")) {
 778                         done += n_component;
 779                         continue;
 780                 }
 781
 782                 prefix = strndup(absolute, done + n_component);
 783                 if (!prefix) {
 784                         r = -ENOMEM;
 785                         goto fail;
 786                 }
 787
 788                 if (!GREEDY_REALLOC(new_watches, n + 1)) {
 789                         r = -ENOMEM;
 790                         goto fail;
 791                 }
 792
 793                 wd = inotify_add_watch(b->inotify_fd, prefix, IN_DELETE_SELF|IN_MOVE_SELF|IN_ATTRIB|IN_CREATE|IN_MOVED_TO|IN_DONT_FOLLOW);
 794                 log_debug("Added inotify watch for %s on bus %s: %i", prefix, strna(b->description), wd);
 795
 796                 if (wd < 0) {
 797                         if (IN_SET(errno, ENOENT, ELOOP))
 798                                 break; /* This component doesn't exist yet, or the path contains a cyclic symlink right now */
 799
 800                         r = log_debug_errno(errno, "Failed to add inotify watch on %s: %m", empty_to_root(prefix));
 801                         goto fail;
 802                 } else
 803                         new_watches[n++] = wd;
 804
 805                 /* Check if this is possibly a symlink. If so, let's follow it and watch it too. */
 806                 r = readlink_malloc(prefix, &destination);
 807                 if (r == -EINVAL) { /* not a symlink */
 808                         done += n_component;
 809                         continue;
 810                 }
 811                 if (r < 0)
 812                         goto fail;
 813
 814                 if (isempty(destination)) { /* Empty symlink target? Yuck! */
 815                         r = -EINVAL;
 816                         goto fail;
 817                 }
 818
 819                 if (max_follow <= 0) { /* Let's make sure we don't follow symlinks forever */
 820                         r = -ELOOP;
 821                         goto fail;
 822                 }
 823
 824                 if (path_is_absolute(destination)) {
 825                         /* For absolute symlinks we build the new path and start anew */
 826                         c = strjoin(destination, absolute + done + n_component);
 827                         done = 0;
 828                 } else {
 829                         _cleanup_free_ char *t = NULL;
 830
 831                         /* For relative symlinks we replace the last component, and try again */
 832                         t = strndup(absolute, done);
 833                         if (!t)
 834                                 return -ENOMEM;
 835
 836                         c = strjoin(t, "/", destination, absolute + done + n_component);
 837                 }
 838                 if (!c) {
 839                         r = -ENOMEM;
 840                         goto fail;
 841                 }
 842
 843                 free(absolute);
 844                 absolute = c;
 845
 846                 max_follow--;
 847         }
 848
 849         /* And now, let's remove all watches from the previous iteration we don't need anymore */
 850         for (i = 0; i < b->n_inotify_watches; i++) {
 851                 bool found = false;
 852                 size_t j;
 853
 854                 for (j = 0; j < n; j++)
 855                         if (new_watches[j] == b->inotify_watches[i]) {
 856                                 found = true;
 857                                 break;
 858                         }
 859
 860                 if (found)
 861                         continue;
 862
 863                 (void) inotify_rm_watch(b->inotify_fd, b->inotify_watches[i]);
 864         }
 865
 866         free_and_replace(b->inotify_watches, new_watches);
 867         b->n_inotify_watches = n;
 868
 869         return 0;
 870
 871 fail:
 872         bus_close_inotify_fd(b);
 873         return r;
 874 }
 875
 876 int bus_socket_connect(sd_bus *b) {
 877         bool inotify_done = false;
 878         int r;
 879
 880         assert(b);
 881
 882         for (;;) {
 883                 assert(b->input_fd < 0);
 884                 assert(b->output_fd < 0);
 885                 assert(b->sockaddr.sa.sa_family != AF_UNSPEC);
 886
 887                 if (DEBUG_LOGGING) {
 888                         _cleanup_free_ char *pretty = NULL;
 889                         (void) sockaddr_pretty(&b->sockaddr.sa, b->sockaddr_size, false, true, &pretty);
 890                         log_debug("sd-bus: starting bus%s%s by connecting to %s...",
 891                                   b->description ? " " : "", strempty(b->description), strnull(pretty));
 892                 }
 893
 894                 b->input_fd = socket(b->sockaddr.sa.sa_family, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
 895                 if (b->input_fd < 0)
 896                         return -errno;
 897
 898                 b->input_fd = fd_move_above_stdio(b->input_fd);
 899
 900                 b->output_fd = b->input_fd;
 901                 bus_socket_setup(b);
 902
 903                 if (connect(b->input_fd, &b->sockaddr.sa, b->sockaddr_size) < 0) {
 904                         if (errno == EINPROGRESS) {
 905
 906                                 /* If we have any inotify watches open, close them now, we don't need them anymore, as
 907                                  * we have successfully initiated a connection */
 908                                 bus_close_inotify_fd(b);
 909
 910                                 /* Note that very likely we are already in BUS_OPENING state here, as we enter it when
 911                                  * we start parsing the address string. The only reason we set the state explicitly
 912                                  * here, is to undo BUS_WATCH_BIND, in case we did the inotify magic. */
 913                                 bus_set_state(b, BUS_OPENING);
 914                                 return 1;
 915                         }
 916
 917                         if (IN_SET(errno, ENOENT, ECONNREFUSED) &&  /* ENOENT → unix socket doesn't exist at all; ECONNREFUSED → unix socket stale */
 918                             b->watch_bind &&
 919                             b->sockaddr.sa.sa_family == AF_UNIX &&
 920                             b->sockaddr.un.sun_path[0] != 0) {
 921
 922                                 /* This connection attempt failed, let's release the socket for now, and start with a
 923                                  * fresh one when reconnecting. */
 924                                 bus_close_io_fds(b);
 925
 926                                 if (inotify_done) {
 927                                         /* inotify set up already, don't do it again, just return now, and remember
 928                                          * that we are waiting for inotify events now. */
 929                                         bus_set_state(b, BUS_WATCH_BIND);
 930                                         return 1;
 931                                 }
 932
 933                                 /* This is a file system socket, and the inotify logic is enabled. Let's create the necessary inotify fd. */
 934                                 r = bus_socket_inotify_setup(b);
 935                                 if (r < 0)
 936                                         return r;
 937
 938                                 /* Let's now try to connect a second time, because in theory there's otherwise a race
 939                                  * here: the socket might have been created in the time between our first connect() and
 940                                  * the time we set up the inotify logic. But let's remember that we set up inotify now,
 941                                  * so that we don't do the connect() more than twice. */
 942                                 inotify_done = true;
 943
 944                         } else
 945                                 return -errno;
 946                 } else
 947                         break;
 948         }
 949
 950         /* Yay, established, we don't need no inotify anymore! */
 951         bus_close_inotify_fd(b);
 952
 953         return bus_socket_start_auth(b);
 954 }
 955
 956 int bus_socket_exec(sd_bus *b) {
 957         int s[2], r;
 958
 959         assert(b);
 960         assert(b->input_fd < 0);
 961         assert(b->output_fd < 0);
 962         assert(b->exec_path);
 963         assert(b->busexec_pid == 0);
 964
 965         log_debug("sd-bus: starting bus%s%s with %s...",
 966                   b->description ? " " : "", strempty(b->description), b->exec_path);
 967
 968         r = socketpair(AF_UNIX, SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0, s);
 969         if (r < 0)
 970                 return -errno;
 971
 972         r = safe_fork_full("(sd-busexec)", s+1, 1, FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS, &b->busexec_pid);
 973         if (r < 0) {
 974                 safe_close_pair(s);
 975                 return r;
 976         }
 977         if (r == 0) {
 978                 /* Child */
 979
 980                 if (rearrange_stdio(s[1], s[1], STDERR_FILENO) < 0)
 981                         _exit(EXIT_FAILURE);
 982
 983                 (void) rlimit_nofile_safe();
 984
 985                 if (b->exec_argv)
 986                         execvp(b->exec_path, b->exec_argv);
 987                 else {
 988                         const char *argv[] = { b->exec_path, NULL };
 989                         execvp(b->exec_path, (char**) argv);
 990                 }
 991
 992                 _exit(EXIT_FAILURE);
 993         }
 994
 995         safe_close(s[1]);
 996         b->output_fd = b->input_fd = fd_move_above_stdio(s[0]);
 997
 998         bus_socket_setup(b);
 999
1000         return bus_socket_start_auth(b);
1001 }
1002
1003 int bus_socket_take_fd(sd_bus *b) {
1004         assert(b);
1005
1006         bus_socket_setup(b);
1007
1008         return bus_socket_start_auth(b);
1009 }
1010
1011 int bus_socket_write_message(sd_bus *bus, sd_bus_message *m, size_t *idx) {
1012         struct iovec *iov;
1013         ssize_t k;
1014         size_t n;
1015         unsigned j;
1016         int r;
1017
1018         assert(bus);
1019         assert(m);
1020         assert(idx);
1021         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1022
1023         if (*idx >= BUS_MESSAGE_SIZE(m))
1024                 return 0;
1025
1026         r = bus_message_setup_iovec(m);
1027         if (r < 0)
1028                 return r;
1029
1030         n = m->n_iovec * sizeof(struct iovec);
1031         iov = newa(struct iovec, n);
1032         memcpy_safe(iov, m->iovec, n);
1033
1034         j = 0;
1035         iovec_advance(iov, &j, *idx);
1036
1037         if (bus->prefer_writev)
1038                 k = writev(bus->output_fd, iov, m->n_iovec);
1039         else {
1040                 struct msghdr mh = {
1041                         .msg_iov = iov,
1042                         .msg_iovlen = m->n_iovec,
1043                 };
1044
1045                 if (m->n_fds > 0 && *idx == 0) {
1046                         struct cmsghdr *control;
1047
1048                         mh.msg_controllen = CMSG_SPACE(sizeof(int) * m->n_fds);
1049                         mh.msg_control = alloca0(mh.msg_controllen);
1050                         control = CMSG_FIRSTHDR(&mh);
1051                         control->cmsg_len = CMSG_LEN(sizeof(int) * m->n_fds);
1052                         control->cmsg_level = SOL_SOCKET;
1053                         control->cmsg_type = SCM_RIGHTS;
1054                         memcpy(CMSG_DATA(control), m->fds, sizeof(int) * m->n_fds);
1055                 }
1056
1057                 k = sendmsg(bus->output_fd, &mh, MSG_DONTWAIT|MSG_NOSIGNAL);
1058                 if (k < 0 && errno == ENOTSOCK) {
1059                         bus->prefer_writev = true;
1060                         k = writev(bus->output_fd, iov, m->n_iovec);
1061                 }
1062         }
1063
1064         if (k < 0)
1065                 return errno == EAGAIN ? 0 : -errno;
1066
1067         *idx += (size_t) k;
1068         return 1;
1069 }
1070
1071 static int bus_socket_read_message_need(sd_bus *bus, size_t *need) {
1072         uint32_t a, b;
1073         uint8_t e;
1074         uint64_t sum;
1075
1076         assert(bus);
1077         assert(need);
1078         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1079
1080         if (bus->rbuffer_size < sizeof(struct bus_header)) {
1081                 *need = sizeof(struct bus_header) + 8;
1082
1083                 /* Minimum message size:
1084                  *
1085                  * Header +
1086                  *
1087                  *  Method Call: +2 string headers
1088                  *       Signal: +3 string headers
1089                  * Method Error: +1 string headers
1090                  *               +1 uint32 headers
1091                  * Method Reply: +1 uint32 headers
1092                  *
1093                  * A string header is at least 9 bytes
1094                  * A uint32 header is at least 8 bytes
1095                  *
1096                  * Hence the minimum message size of a valid message
1097                  * is header + 8 bytes */
1098
1099                 return 0;
1100         }
1101
1102         a = ((const uint32_t*) bus->rbuffer)[1];
1103         b = ((const uint32_t*) bus->rbuffer)[3];
1104
1105         e = ((const uint8_t*) bus->rbuffer)[0];
1106         if (e == BUS_LITTLE_ENDIAN) {
1107                 a = le32toh(a);
1108                 b = le32toh(b);
1109         } else if (e == BUS_BIG_ENDIAN) {
1110                 a = be32toh(a);
1111                 b = be32toh(b);
1112         } else
1113                 return -EBADMSG;
1114
1115         sum = (uint64_t) sizeof(struct bus_header) + (uint64_t) ALIGN_TO(b, 8) + (uint64_t) a;
1116         if (sum >= BUS_MESSAGE_SIZE_MAX)
1117                 return -ENOBUFS;
1118
1119         *need = (size_t) sum;
1120         return 0;
1121 }
1122
1123 static int bus_socket_make_message(sd_bus *bus, size_t size) {
1124         sd_bus_message *t = NULL;
1125         void *b;
1126         int r;
1127
1128         assert(bus);
1129         assert(bus->rbuffer_size >= size);
1130         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1131
1132         r = bus_rqueue_make_room(bus);
1133         if (r < 0)
1134                 return r;
1135
1136         if (bus->rbuffer_size > size) {
1137                 b = memdup((const uint8_t*) bus->rbuffer + size,
1138                            bus->rbuffer_size - size);
1139                 if (!b)
1140                         return -ENOMEM;
1141         } else
1142                 b = NULL;
1143
1144         r = bus_message_from_malloc(bus,
1145                                     bus->rbuffer, size,
1146                                     bus->fds, bus->n_fds,
1147                                     NULL,
1148                                     &t);
1149         if (r == -EBADMSG) {
1150                 log_debug_errno(r, "Received invalid message from connection %s, dropping.", strna(bus->description));
1151                 free(bus->rbuffer); /* We want to drop current rbuffer and proceed with whatever remains in b */
1152         } else if (r < 0) {
1153                 free(b);
1154                 return r;
1155         }
1156
1157         /* rbuffer ownership was either transferred to t, or we got EBADMSG and dropped it. */
1158         bus->rbuffer = b;
1159         bus->rbuffer_size -= size;
1160
1161         bus->fds = NULL;
1162         bus->n_fds = 0;
1163
1164         if (t) {
1165                 t->read_counter = ++bus->read_counter;
1166                 bus->rqueue[bus->rqueue_size++] = bus_message_ref_queued(t, bus);
1167                 sd_bus_message_unref(t);
1168         }
1169
1170         return 1;
1171 }
1172
1173 int bus_socket_read_message(sd_bus *bus) {
1174         struct msghdr mh;
1175         struct iovec iov = {};
1176         ssize_t k;
1177         size_t need;
1178         int r;
1179         void *b;
1180         CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)) control;
1181         bool handle_cmsg = false;
1182
1183         assert(bus);
1184         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1185
1186         r = bus_socket_read_message_need(bus, &need);
1187         if (r < 0)
1188                 return r;
1189
1190         if (bus->rbuffer_size >= need)
1191                 return bus_socket_make_message(bus, need);
1192
1193         b = realloc(bus->rbuffer, need);
1194         if (!b)
1195                 return -ENOMEM;
1196
1197         bus->rbuffer = b;
1198
1199         iov = IOVEC_MAKE((uint8_t *)bus->rbuffer + bus->rbuffer_size, need - bus->rbuffer_size);
1200
1201         if (bus->prefer_readv) {
1202                 k = readv(bus->input_fd, &iov, 1);
1203                 if (k < 0)
1204                         k = -errno;
1205         } else {
1206                 mh = (struct msghdr) {
1207                         .msg_iov = &iov,
1208                         .msg_iovlen = 1,
1209                         .msg_control = &control,
1210                         .msg_controllen = sizeof(control),
1211                 };
1212
1213                 k = recvmsg_safe(bus->input_fd, &mh, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
1214                 if (k == -ENOTSOCK) {
1215                         bus->prefer_readv = true;
1216                         k = readv(bus->input_fd, &iov, 1);
1217                         if (k < 0)
1218                                 k = -errno;
1219                 } else
1220                         handle_cmsg = true;
1221         }
1222         if (k == -EAGAIN)
1223                 return 0;
1224         if (k < 0)
1225                 return (int) k;
1226         if (k == 0) {
1227                 if (handle_cmsg)
1228                         cmsg_close_all(&mh); /* On EOF we shouldn't have gotten an fd, but let's make sure */
1229                 return -ECONNRESET;
1230         }
1231
1232         bus->rbuffer_size += k;
1233
1234         if (handle_cmsg) {
1235                 struct cmsghdr *cmsg;
1236
1237                 CMSG_FOREACH(cmsg, &mh)
1238                         if (cmsg->cmsg_level == SOL_SOCKET &&
1239                             cmsg->cmsg_type == SCM_RIGHTS) {
1240                                 int n, *f, i;
1241
1242                                 n = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
1243
1244                                 if (!bus->can_fds) {
1245                                         /* Whut? We received fds but this
1246                                          * isn't actually enabled? Close them,
1247                                          * and fail */
1248
1249                                         close_many((int*) CMSG_DATA(cmsg), n);
1250                                         return -EIO;
1251                                 }
1252
1253                                 f = reallocarray(bus->fds, bus->n_fds + n, sizeof(int));
1254                                 if (!f) {
1255                                         close_many((int*) CMSG_DATA(cmsg), n);
1256                                         return -ENOMEM;
1257                                 }
1258
1259                                 for (i = 0; i < n; i++)
1260                                         f[bus->n_fds++] = fd_move_above_stdio(((int*) CMSG_DATA(cmsg))[i]);
1261                                 bus->fds = f;
1262                         } else
1263                                 log_debug("Got unexpected auxiliary data with level=%d and type=%d",
1264                                           cmsg->cmsg_level, cmsg->cmsg_type);
1265         }
1266
1267         r = bus_socket_read_message_need(bus, &need);
1268         if (r < 0)
1269                 return r;
1270
1271         if (bus->rbuffer_size >= need)
1272                 return bus_socket_make_message(bus, need);
1273
1274         return 1;
1275 }
1276
1277 int bus_socket_process_opening(sd_bus *b) {
1278         int error = 0, events, r;
1279         socklen_t slen = sizeof(error);
1280
1281         assert(b->state == BUS_OPENING);
1282
1283         events = fd_wait_for_event(b->output_fd, POLLOUT, 0);
1284         if (events < 0)
1285                 return events;
1286         if (!(events & (POLLOUT|POLLERR|POLLHUP)))
1287                 return 0;
1288
1289         r = getsockopt(b->output_fd, SOL_SOCKET, SO_ERROR, &error, &slen);
1290         if (r < 0)
1291                 b->last_connect_error = errno;
1292         else if (error != 0)
1293                 b->last_connect_error = error;
1294         else if (events & (POLLERR|POLLHUP))
1295                 b->last_connect_error = ECONNREFUSED;
1296         else
1297                 return bus_socket_start_auth(b);
1298
1299         return bus_next_address(b);
1300 }
1301
1302 int bus_socket_process_authenticating(sd_bus *b) {
1303         int r;
1304
1305         assert(b);
1306         assert(b->state == BUS_AUTHENTICATING);
1307
1308         if (now(CLOCK_MONOTONIC) >= b->auth_timeout)
1309                 return -ETIMEDOUT;
1310
1311         r = bus_socket_write_auth(b);
1312         if (r != 0)
1313                 return r;
1314
1315         return bus_socket_read_auth(b);
1316 }
1317
1318 int bus_socket_process_watch_bind(sd_bus *b) {
1319         int r, q;
1320
1321         assert(b);
1322         assert(b->state == BUS_WATCH_BIND);
1323         assert(b->inotify_fd >= 0);
1324
1325         r = flush_fd(b->inotify_fd);
1326         if (r <= 0)
1327                 return r;
1328
1329         log_debug("Got inotify event on bus %s.", strna(b->description));
1330
1331         /* We flushed events out of the inotify fd. In that case, maybe the socket is valid now? Let's try to connect
1332          * to it again */
1333
1334         r = bus_socket_connect(b);
1335         if (r < 0)
1336                 return r;
1337
1338         q = bus_attach_io_events(b);
1339         if (q < 0)
1340                 return q;
1341
1342         q = bus_attach_inotify_event(b);
1343         if (q < 0)
1344                 return q;
1345
1346         return r;
1347 }