src/libsystemd/sd-bus/bus-socket.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <endian.h>
   4 #include <poll.h>
   5 #include <stdlib.h>
   6 #include <unistd.h>
   7
   8 #include "sd-bus.h"
   9 #include "sd-daemon.h"
  10
  11 #include "alloc-util.h"
  12 #include "bus-internal.h"
  13 #include "bus-message.h"
  14 #include "bus-socket.h"
  15 #include "fd-util.h"
  16 #include "format-util.h"
  17 #include "fs-util.h"
  18 #include "hexdecoct.h"
  19 #include "io-util.h"
  20 #include "macro.h"
  21 #include "memory-util.h"
  22 #include "path-util.h"
  23 #include "process-util.h"
  24 #include "rlimit-util.h"
  25 #include "selinux-util.h"
  26 #include "signal-util.h"
  27 #include "stdio-util.h"
  28 #include "string-util.h"
  29 #include "user-util.h"
  30 #include "utf8.h"
  31
  32 #define SNDBUF_SIZE (8*1024*1024)
  33
  34 static void iovec_advance(struct iovec iov[], unsigned *idx, size_t size) {
  35
  36         while (size > 0) {
  37                 struct iovec *i = iov + *idx;
  38
  39                 if (i->iov_len > size) {
  40                         i->iov_base = (uint8_t*) i->iov_base + size;
  41                         i->iov_len -= size;
  42                         return;
  43                 }
  44
  45                 size -= i->iov_len;
  46
  47                 *i = IOVEC_MAKE(NULL, 0);
  48
  49                 (*idx)++;
  50         }
  51 }
  52
  53 static int append_iovec(sd_bus_message *m, const void *p, size_t sz) {
  54         assert(m);
  55         assert(p);
  56         assert(sz > 0);
  57
  58         m->iovec[m->n_iovec++] = IOVEC_MAKE((void*) p, sz);
  59
  60         return 0;
  61 }
  62
  63 static int bus_message_setup_iovec(sd_bus_message *m) {
  64         struct bus_body_part *part;
  65         unsigned n, i;
  66         int r;
  67
  68         assert(m);
  69         assert(m->sealed);
  70
  71         if (m->n_iovec > 0)
  72                 return 0;
  73
  74         assert(!m->iovec);
  75
  76         n = 1 + m->n_body_parts;
  77         if (n < ELEMENTSOF(m->iovec_fixed))
  78                 m->iovec = m->iovec_fixed;
  79         else {
  80                 m->iovec = new(struct iovec, n);
  81                 if (!m->iovec) {
  82                         r = -ENOMEM;
  83                         goto fail;
  84                 }
  85         }
  86
  87         r = append_iovec(m, m->header, BUS_MESSAGE_BODY_BEGIN(m));
  88         if (r < 0)
  89                 goto fail;
  90
  91         MESSAGE_FOREACH_PART(part, i, m)  {
  92                 r = bus_body_part_map(part);
  93                 if (r < 0)
  94                         goto fail;
  95
  96                 r = append_iovec(m, part->data, part->size);
  97                 if (r < 0)
  98                         goto fail;
  99         }
 100
 101         assert(n == m->n_iovec);
 102
 103         return 0;
 104
 105 fail:
 106         m->poisoned = true;
 107         return r;
 108 }
 109
 110 bool bus_socket_auth_needs_write(sd_bus *b) {
 111
 112         unsigned i;
 113
 114         if (b->auth_index >= ELEMENTSOF(b->auth_iovec))
 115                 return false;
 116
 117         for (i = b->auth_index; i < ELEMENTSOF(b->auth_iovec); i++) {
 118                 struct iovec *j = b->auth_iovec + i;
 119
 120                 if (j->iov_len > 0)
 121                         return true;
 122         }
 123
 124         return false;
 125 }
 126
 127 static int bus_socket_write_auth(sd_bus *b) {
 128         ssize_t k;
 129
 130         assert(b);
 131         assert(b->state == BUS_AUTHENTICATING);
 132
 133         if (!bus_socket_auth_needs_write(b))
 134                 return 0;
 135
 136         if (b->prefer_writev)
 137                 k = writev(b->output_fd, b->auth_iovec + b->auth_index, ELEMENTSOF(b->auth_iovec) - b->auth_index);
 138         else {
 139                 struct msghdr mh;
 140                 zero(mh);
 141
 142                 mh.msg_iov = b->auth_iovec + b->auth_index;
 143                 mh.msg_iovlen = ELEMENTSOF(b->auth_iovec) - b->auth_index;
 144
 145                 k = sendmsg(b->output_fd, &mh, MSG_DONTWAIT|MSG_NOSIGNAL);
 146                 if (k < 0 && errno == ENOTSOCK) {
 147                         b->prefer_writev = true;
 148                         k = writev(b->output_fd, b->auth_iovec + b->auth_index, ELEMENTSOF(b->auth_iovec) - b->auth_index);
 149                 }
 150         }
 151
 152         if (k < 0)
 153                 return errno == EAGAIN ? 0 : -errno;
 154
 155         iovec_advance(b->auth_iovec, &b->auth_index, (size_t) k);
 156         return 1;
 157 }
 158
 159 static int bus_socket_auth_verify_client(sd_bus *b) {
 160         char *d, *e, *f, *start;
 161         sd_id128_t peer;
 162         int r;
 163
 164         assert(b);
 165
 166         /*
 167          * We expect three response lines:
 168          *   "DATA\r\n"
 169          *   "OK <server-id>\r\n"
 170          *   "AGREE_UNIX_FD\r\n"        (optional)
 171          */
 172
 173         d = memmem_safe(b->rbuffer, b->rbuffer_size, "\r\n", 2);
 174         if (!d)
 175                 return 0;
 176
 177         e = memmem(d + 2, b->rbuffer_size - (d - (char*) b->rbuffer) - 2, "\r\n", 2);
 178         if (!e)
 179                 return 0;
 180
 181         if (b->accept_fd) {
 182                 f = memmem(e + 2, b->rbuffer_size - (e - (char*) b->rbuffer) - 2, "\r\n", 2);
 183                 if (!f)
 184                         return 0;
 185
 186                 start = f + 2;
 187         } else {
 188                 f = NULL;
 189                 start = e + 2;
 190         }
 191
 192         /* Nice! We got all the lines we need. First check the DATA line. */
 193
 194         if (d - (char*) b->rbuffer == 4) {
 195                 if (memcmp(b->rbuffer, "DATA", 4))
 196                         return -EPERM;
 197         } else if (d - (char*) b->rbuffer == 3 + 32) {
 198                 /*
 199                  * Old versions of the server-side implementation of `sd-bus` replied with "OK <id>" to
 200                  * "AUTH" requests from a client, even if the "AUTH" line did not contain inlined
 201                  * arguments. Therefore, we also accept "OK <id>" here, even though it is technically the
 202                  * wrong reply. We ignore the "<id>" parameter, though, since it has no real value.
 203                  */
 204                 if (memcmp(b->rbuffer, "OK ", 3))
 205                         return -EPERM;
 206         } else
 207                 return -EPERM;
 208
 209         /* Now check the OK line. */
 210
 211         if (e - d != 2 + 3 + 32)
 212                 return -EPERM;
 213
 214         if (memcmp(d + 2, "OK ", 3))
 215                 return -EPERM;
 216
 217         b->auth = b->anonymous_auth ? BUS_AUTH_ANONYMOUS : BUS_AUTH_EXTERNAL;
 218
 219         for (unsigned i = 0; i < 32; i += 2) {
 220                 int x, y;
 221
 222                 x = unhexchar(d[2 + 3 + i]);
 223                 y = unhexchar(d[2 + 3 + i + 1]);
 224
 225                 if (x < 0 || y < 0)
 226                         return -EINVAL;
 227
 228                 peer.bytes[i/2] = ((uint8_t) x << 4 | (uint8_t) y);
 229         }
 230
 231         if (!sd_id128_is_null(b->server_id) &&
 232             !sd_id128_equal(b->server_id, peer))
 233                 return -EPERM;
 234
 235         b->server_id = peer;
 236
 237         /* And possibly check the third line, too */
 238
 239         if (f)
 240                 b->can_fds =
 241                         (f - e == STRLEN("\r\nAGREE_UNIX_FD")) &&
 242                         memcmp(e + 2, "AGREE_UNIX_FD",
 243                                STRLEN("AGREE_UNIX_FD")) == 0;
 244
 245         b->rbuffer_size -= (start - (char*) b->rbuffer);
 246         memmove(b->rbuffer, start, b->rbuffer_size);
 247
 248         r = bus_start_running(b);
 249         if (r < 0)
 250                 return r;
 251
 252         return 1;
 253 }
 254
 255 static bool line_equals(const char *s, size_t m, const char *line) {
 256         size_t l;
 257
 258         l = strlen(line);
 259         if (l != m)
 260                 return false;
 261
 262         return memcmp(s, line, l) == 0;
 263 }
 264
 265 static bool line_begins(const char *s, size_t m, const char *word) {
 266         const char *p;
 267
 268         p = memory_startswith(s, m, word);
 269         return p && (p == (s + m) || *p == ' ');
 270 }
 271
 272 static int verify_anonymous_token(sd_bus *b, const char *p, size_t l) {
 273         _cleanup_free_ char *token = NULL;
 274         size_t len;
 275         int r;
 276
 277         if (!b->anonymous_auth)
 278                 return 0;
 279
 280         if (l <= 0)
 281                 return 1;
 282
 283         assert(p[0] == ' ');
 284         p++; l--;
 285
 286         if (l % 2 != 0)
 287                 return 0;
 288
 289         r = unhexmem(p, l, (void **) &token, &len);
 290         if (r < 0)
 291                 return 0;
 292
 293         if (memchr(token, 0, len))
 294                 return 0;
 295
 296         return !!utf8_is_valid(token);
 297 }
 298
 299 static int verify_external_token(sd_bus *b, const char *p, size_t l) {
 300         _cleanup_free_ char *token = NULL;
 301         size_t len;
 302         uid_t u;
 303         int r;
 304
 305         /* We don't do any real authentication here. Instead, we if
 306          * the owner of this bus wanted authentication he should have
 307          * checked SO_PEERCRED before even creating the bus object. */
 308
 309         if (!b->anonymous_auth && !b->ucred_valid)
 310                 return 0;
 311
 312         if (l <= 0)
 313                 return 1;
 314
 315         assert(p[0] == ' ');
 316         p++; l--;
 317
 318         if (l % 2 != 0)
 319                 return 0;
 320
 321         r = unhexmem(p, l, (void**) &token, &len);
 322         if (r < 0)
 323                 return 0;
 324
 325         if (memchr(token, 0, len))
 326                 return 0;
 327
 328         r = parse_uid(token, &u);
 329         if (r < 0)
 330                 return 0;
 331
 332         /* We ignore the passed value if anonymous authentication is
 333          * on anyway. */
 334         if (!b->anonymous_auth && u != b->ucred.uid)
 335                 return 0;
 336
 337         return 1;
 338 }
 339
 340 static int bus_socket_auth_write(sd_bus *b, const char *t) {
 341         char *p;
 342         size_t l;
 343
 344         assert(b);
 345         assert(t);
 346
 347         /* We only make use of the first iovec */
 348         assert(IN_SET(b->auth_index, 0, 1));
 349
 350         l = strlen(t);
 351         p = malloc(b->auth_iovec[0].iov_len + l);
 352         if (!p)
 353                 return -ENOMEM;
 354
 355         memcpy_safe(p, b->auth_iovec[0].iov_base, b->auth_iovec[0].iov_len);
 356         memcpy(p + b->auth_iovec[0].iov_len, t, l);
 357
 358         b->auth_iovec[0].iov_base = p;
 359         b->auth_iovec[0].iov_len += l;
 360
 361         free(b->auth_buffer);
 362         b->auth_buffer = p;
 363         b->auth_index = 0;
 364         return 0;
 365 }
 366
 367 static int bus_socket_auth_write_ok(sd_bus *b) {
 368         char t[3 + 32 + 2 + 1];
 369
 370         assert(b);
 371
 372         xsprintf(t, "OK " SD_ID128_FORMAT_STR "\r\n", SD_ID128_FORMAT_VAL(b->server_id));
 373
 374         return bus_socket_auth_write(b, t);
 375 }
 376
 377 static int bus_socket_auth_verify_server(sd_bus *b) {
 378         char *e;
 379         const char *line;
 380         size_t l;
 381         bool processed = false;
 382         int r;
 383
 384         assert(b);
 385
 386         if (b->rbuffer_size < 1)
 387                 return 0;
 388
 389         /* First char must be a NUL byte */
 390         if (*(char*) b->rbuffer != 0)
 391                 return -EIO;
 392
 393         if (b->rbuffer_size < 3)
 394                 return 0;
 395
 396         /* Begin with the first line */
 397         if (b->auth_rbegin <= 0)
 398                 b->auth_rbegin = 1;
 399
 400         for (;;) {
 401                 /* Check if line is complete */
 402                 line = (char*) b->rbuffer + b->auth_rbegin;
 403                 e = memmem(line, b->rbuffer_size - b->auth_rbegin, "\r\n", 2);
 404                 if (!e)
 405                         return processed;
 406
 407                 l = e - line;
 408
 409                 if (line_begins(line, l, "AUTH ANONYMOUS")) {
 410
 411                         r = verify_anonymous_token(b,
 412                                                    line + strlen("AUTH ANONYMOUS"),
 413                                                    l - strlen("AUTH ANONYMOUS"));
 414                         if (r < 0)
 415                                 return r;
 416                         if (r == 0)
 417                                 r = bus_socket_auth_write(b, "REJECTED\r\n");
 418                         else {
 419                                 b->auth = BUS_AUTH_ANONYMOUS;
 420                                 if (l <= strlen("AUTH ANONYMOUS"))
 421                                         r = bus_socket_auth_write(b, "DATA\r\n");
 422                                 else
 423                                         r = bus_socket_auth_write_ok(b);
 424                         }
 425
 426                 } else if (line_begins(line, l, "AUTH EXTERNAL")) {
 427
 428                         r = verify_external_token(b,
 429                                                   line + strlen("AUTH EXTERNAL"),
 430                                                   l - strlen("AUTH EXTERNAL"));
 431                         if (r < 0)
 432                                 return r;
 433                         if (r == 0)
 434                                 r = bus_socket_auth_write(b, "REJECTED\r\n");
 435                         else {
 436                                 b->auth = BUS_AUTH_EXTERNAL;
 437                                 if (l <= strlen("AUTH EXTERNAL"))
 438                                         r = bus_socket_auth_write(b, "DATA\r\n");
 439                                 else
 440                                         r = bus_socket_auth_write_ok(b);
 441                         }
 442
 443                 } else if (line_begins(line, l, "AUTH"))
 444                         r = bus_socket_auth_write(b, "REJECTED EXTERNAL ANONYMOUS\r\n");
 445                 else if (line_equals(line, l, "CANCEL") ||
 446                          line_begins(line, l, "ERROR")) {
 447
 448                         b->auth = _BUS_AUTH_INVALID;
 449                         r = bus_socket_auth_write(b, "REJECTED\r\n");
 450
 451                 } else if (line_equals(line, l, "BEGIN")) {
 452
 453                         if (b->auth == _BUS_AUTH_INVALID)
 454                                 r = bus_socket_auth_write(b, "ERROR\r\n");
 455                         else {
 456                                 /* We can't leave from the auth phase
 457                                  * before we haven't written
 458                                  * everything queued, so let's check
 459                                  * that */
 460
 461                                 if (bus_socket_auth_needs_write(b))
 462                                         return 1;
 463
 464                                 b->rbuffer_size -= (e + 2 - (char*) b->rbuffer);
 465                                 memmove(b->rbuffer, e + 2, b->rbuffer_size);
 466                                 return bus_start_running(b);
 467                         }
 468
 469                 } else if (line_begins(line, l, "DATA")) {
 470
 471                         if (b->auth == _BUS_AUTH_INVALID)
 472                                 r = bus_socket_auth_write(b, "ERROR\r\n");
 473                         else {
 474                                 if (b->auth == BUS_AUTH_ANONYMOUS)
 475                                         r = verify_anonymous_token(b, line + 4, l - 4);
 476                                 else
 477                                         r = verify_external_token(b, line + 4, l - 4);
 478
 479                                 if (r < 0)
 480                                         return r;
 481                                 if (r == 0) {
 482                                         b->auth = _BUS_AUTH_INVALID;
 483                                         r = bus_socket_auth_write(b, "REJECTED\r\n");
 484                                 } else
 485                                         r = bus_socket_auth_write_ok(b);
 486                         }
 487                 } else if (line_equals(line, l, "NEGOTIATE_UNIX_FD")) {
 488                         if (b->auth == _BUS_AUTH_INVALID || !b->accept_fd)
 489                                 r = bus_socket_auth_write(b, "ERROR\r\n");
 490                         else {
 491                                 b->can_fds = true;
 492                                 r = bus_socket_auth_write(b, "AGREE_UNIX_FD\r\n");
 493                         }
 494                 } else
 495                         r = bus_socket_auth_write(b, "ERROR\r\n");
 496
 497                 if (r < 0)
 498                         return r;
 499
 500                 b->auth_rbegin = e + 2 - (char*) b->rbuffer;
 501
 502                 processed = true;
 503         }
 504 }
 505
 506 static int bus_socket_auth_verify(sd_bus *b) {
 507         assert(b);
 508
 509         if (b->is_server)
 510                 return bus_socket_auth_verify_server(b);
 511         else
 512                 return bus_socket_auth_verify_client(b);
 513 }
 514
 515 static int bus_socket_read_auth(sd_bus *b) {
 516         struct msghdr mh;
 517         struct iovec iov = {};
 518         size_t n;
 519         ssize_t k;
 520         int r;
 521         void *p;
 522         union {
 523                 struct cmsghdr cmsghdr;
 524                 uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)];
 525         } control;
 526         bool handle_cmsg = false;
 527
 528         assert(b);
 529         assert(b->state == BUS_AUTHENTICATING);
 530
 531         r = bus_socket_auth_verify(b);
 532         if (r != 0)
 533                 return r;
 534
 535         n = MAX(256u, b->rbuffer_size * 2);
 536
 537         if (n > BUS_AUTH_SIZE_MAX)
 538                 n = BUS_AUTH_SIZE_MAX;
 539
 540         if (b->rbuffer_size >= n)
 541                 return -ENOBUFS;
 542
 543         p = realloc(b->rbuffer, n);
 544         if (!p)
 545                 return -ENOMEM;
 546
 547         b->rbuffer = p;
 548
 549         iov = IOVEC_MAKE((uint8_t *)b->rbuffer + b->rbuffer_size, n - b->rbuffer_size);
 550
 551         if (b->prefer_readv)
 552                 k = readv(b->input_fd, &iov, 1);
 553         else {
 554                 zero(mh);
 555                 mh.msg_iov = &iov;
 556                 mh.msg_iovlen = 1;
 557                 mh.msg_control = &control;
 558                 mh.msg_controllen = sizeof(control);
 559
 560                 k = recvmsg_safe(b->input_fd, &mh, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
 561                 if (k == -ENOTSOCK) {
 562                         b->prefer_readv = true;
 563                         k = readv(b->input_fd, &iov, 1);
 564                         if (k < 0)
 565                                 k = -errno;
 566                 } else
 567                         handle_cmsg = true;
 568         }
 569         if (k == -EAGAIN)
 570                 return 0;
 571         if (k < 0)
 572                 return (int) k;
 573         if (k == 0) {
 574                 if (handle_cmsg)
 575                         cmsg_close_all(&mh); /* paranoia, we shouldn't have gotten any fds on EOF */
 576                 return -ECONNRESET;
 577         }
 578
 579         b->rbuffer_size += k;
 580
 581         if (handle_cmsg) {
 582                 struct cmsghdr *cmsg;
 583
 584                 CMSG_FOREACH(cmsg, &mh)
 585                         if (cmsg->cmsg_level == SOL_SOCKET &&
 586                             cmsg->cmsg_type == SCM_RIGHTS) {
 587                                 int j;
 588
 589                                 /* Whut? We received fds during the auth
 590                                  * protocol? Somebody is playing games with
 591                                  * us. Close them all, and fail */
 592                                 j = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
 593                                 close_many((int*) CMSG_DATA(cmsg), j);
 594                                 return -EIO;
 595                         } else
 596                                 log_debug("Got unexpected auxiliary data with level=%d and type=%d",
 597                                           cmsg->cmsg_level, cmsg->cmsg_type);
 598         }
 599
 600         r = bus_socket_auth_verify(b);
 601         if (r != 0)
 602                 return r;
 603
 604         return 1;
 605 }
 606
 607 void bus_socket_setup(sd_bus *b) {
 608         assert(b);
 609
 610         /* Increase the buffers to 8 MB */
 611         (void) fd_inc_rcvbuf(b->input_fd, SNDBUF_SIZE);
 612         (void) fd_inc_sndbuf(b->output_fd, SNDBUF_SIZE);
 613
 614         b->message_version = 1;
 615         b->message_endian = 0;
 616 }
 617
 618 static void bus_get_peercred(sd_bus *b) {
 619         int r;
 620
 621         assert(b);
 622         assert(!b->ucred_valid);
 623         assert(!b->label);
 624         assert(b->n_groups == (size_t) -1);
 625
 626         /* Get the peer for socketpair() sockets */
 627         b->ucred_valid = getpeercred(b->input_fd, &b->ucred) >= 0;
 628
 629         /* Get the SELinux context of the peer */
 630         r = getpeersec(b->input_fd, &b->label);
 631         if (r < 0 && !IN_SET(r, -EOPNOTSUPP, -ENOPROTOOPT))
 632                 log_debug_errno(r, "Failed to determine peer security context: %m");
 633
 634         /* Get the list of auxiliary groups of the peer */
 635         r = getpeergroups(b->input_fd, &b->groups);
 636         if (r >= 0)
 637                 b->n_groups = (size_t) r;
 638         else if (!IN_SET(r, -EOPNOTSUPP, -ENOPROTOOPT))
 639                 log_debug_errno(r, "Failed to determine peer's group list: %m");
 640 }
 641
 642 static int bus_socket_start_auth_client(sd_bus *b) {
 643         static const char sasl_auth_anonymous[] = {
 644                 /*
 645                  * We use an arbitrary trace-string for the ANONYMOUS authentication. It can be used by the
 646                  * message broker to aid debugging of clients. We fully anonymize the connection and use a
 647                  * static default.
 648                  */
 649                 "\0AUTH ANONYMOUS\r\n"
 650                 /* HEX a n o n y m o u s */
 651                 "DATA 616e6f6e796d6f7573\r\n"
 652         };
 653         static const char sasl_auth_external[] = {
 654                 "\0AUTH EXTERNAL\r\n"
 655                 "DATA\r\n"
 656         };
 657         static const char sasl_negotiate_unix_fd[] = {
 658                 "NEGOTIATE_UNIX_FD\r\n"
 659         };
 660         static const char sasl_begin[] = {
 661                 "BEGIN\r\n"
 662         };
 663         size_t i = 0;
 664
 665         assert(b);
 666
 667         if (b->anonymous_auth)
 668                 b->auth_iovec[i++] = IOVEC_MAKE((char*) sasl_auth_anonymous, sizeof(sasl_auth_anonymous) - 1);
 669         else
 670                 b->auth_iovec[i++] = IOVEC_MAKE((char*) sasl_auth_external, sizeof(sasl_auth_external) - 1);
 671
 672         if (b->accept_fd)
 673                 b->auth_iovec[i++] = IOVEC_MAKE_STRING(sasl_negotiate_unix_fd);
 674
 675         b->auth_iovec[i++] = IOVEC_MAKE_STRING(sasl_begin);
 676
 677         return bus_socket_write_auth(b);
 678 }
 679
 680 int bus_socket_start_auth(sd_bus *b) {
 681         assert(b);
 682
 683         bus_get_peercred(b);
 684
 685         bus_set_state(b, BUS_AUTHENTICATING);
 686         b->auth_timeout = now(CLOCK_MONOTONIC) + BUS_AUTH_TIMEOUT;
 687
 688         if (sd_is_socket(b->input_fd, AF_UNIX, 0, 0) <= 0)
 689                 b->accept_fd = false;
 690
 691         if (b->output_fd != b->input_fd)
 692                 if (sd_is_socket(b->output_fd, AF_UNIX, 0, 0) <= 0)
 693                         b->accept_fd = false;
 694
 695         if (b->is_server)
 696                 return bus_socket_read_auth(b);
 697         else
 698                 return bus_socket_start_auth_client(b);
 699 }
 700
 701 static int bus_socket_inotify_setup(sd_bus *b) {
 702         _cleanup_free_ int *new_watches = NULL;
 703         _cleanup_free_ char *absolute = NULL;
 704         size_t n_allocated = 0, n = 0, done = 0, i;
 705         unsigned max_follow = 32;
 706         const char *p;
 707         int wd, r;
 708
 709         assert(b);
 710         assert(b->watch_bind);
 711         assert(b->sockaddr.sa.sa_family == AF_UNIX);
 712         assert(b->sockaddr.un.sun_path[0] != 0);
 713
 714         /* Sets up an inotify fd in case watch_bind is enabled: wait until the configured AF_UNIX file system socket
 715          * appears before connecting to it. The implemented is pretty simplistic: we just subscribe to relevant changes
 716          * to all prefix components of the path, and every time we get an event for that we try to reconnect again,
 717          * without actually caring what precisely the event we got told us. If we still can't connect we re-subscribe
 718          * to all relevant changes of anything in the path, so that our watches include any possibly newly created path
 719          * components. */
 720
 721         if (b->inotify_fd < 0) {
 722                 b->inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
 723                 if (b->inotify_fd < 0)
 724                         return -errno;
 725
 726                 b->inotify_fd = fd_move_above_stdio(b->inotify_fd);
 727         }
 728
 729         /* Make sure the path is NUL terminated */
 730         p = strndupa(b->sockaddr.un.sun_path, sizeof(b->sockaddr.un.sun_path));
 731
 732         /* Make sure the path is absolute */
 733         r = path_make_absolute_cwd(p, &absolute);
 734         if (r < 0)
 735                 goto fail;
 736
 737         /* Watch all parent directories, and don't mind any prefix that doesn't exist yet. For the innermost directory
 738          * that exists we want to know when files are created or moved into it. For all parents of it we just care if
 739          * they are removed or renamed. */
 740
 741         if (!GREEDY_REALLOC(new_watches, n_allocated, n + 1)) {
 742                 r = -ENOMEM;
 743                 goto fail;
 744         }
 745
 746         /* Start with the top-level directory, which is a bit simpler than the rest, since it can't be a symlink, and
 747          * always exists */
 748         wd = inotify_add_watch(b->inotify_fd, "/", IN_CREATE|IN_MOVED_TO);
 749         if (wd < 0) {
 750                 r = log_debug_errno(errno, "Failed to add inotify watch on /: %m");
 751                 goto fail;
 752         } else
 753                 new_watches[n++] = wd;
 754
 755         for (;;) {
 756                 _cleanup_free_ char *component = NULL, *prefix = NULL, *destination = NULL;
 757                 size_t n_slashes, n_component;
 758                 char *c = NULL;
 759
 760                 n_slashes = strspn(absolute + done, "/");
 761                 n_component = n_slashes + strcspn(absolute + done + n_slashes, "/");
 762
 763                 if (n_component == 0) /* The end */
 764                         break;
 765
 766                 component = strndup(absolute + done, n_component);
 767                 if (!component) {
 768                         r = -ENOMEM;
 769                         goto fail;
 770                 }
 771
 772                 /* A trailing slash? That's a directory, and not a socket then */
 773                 if (path_equal(component, "/")) {
 774                         r = -EISDIR;
 775                         goto fail;
 776                 }
 777
 778                 /* A single dot? Let's eat this up */
 779                 if (path_equal(component, "/.")) {
 780                         done += n_component;
 781                         continue;
 782                 }
 783
 784                 prefix = strndup(absolute, done + n_component);
 785                 if (!prefix) {
 786                         r = -ENOMEM;
 787                         goto fail;
 788                 }
 789
 790                 if (!GREEDY_REALLOC(new_watches, n_allocated, n + 1)) {
 791                         r = -ENOMEM;
 792                         goto fail;
 793                 }
 794
 795                 wd = inotify_add_watch(b->inotify_fd, prefix, IN_DELETE_SELF|IN_MOVE_SELF|IN_ATTRIB|IN_CREATE|IN_MOVED_TO|IN_DONT_FOLLOW);
 796                 log_debug("Added inotify watch for %s on bus %s: %i", prefix, strna(b->description), wd);
 797
 798                 if (wd < 0) {
 799                         if (IN_SET(errno, ENOENT, ELOOP))
 800                                 break; /* This component doesn't exist yet, or the path contains a cyclic symlink right now */
 801
 802                         r = log_debug_errno(errno, "Failed to add inotify watch on %s: %m", empty_to_root(prefix));
 803                         goto fail;
 804                 } else
 805                         new_watches[n++] = wd;
 806
 807                 /* Check if this is possibly a symlink. If so, let's follow it and watch it too. */
 808                 r = readlink_malloc(prefix, &destination);
 809                 if (r == -EINVAL) { /* not a symlink */
 810                         done += n_component;
 811                         continue;
 812                 }
 813                 if (r < 0)
 814                         goto fail;
 815
 816                 if (isempty(destination)) { /* Empty symlink target? Yuck! */
 817                         r = -EINVAL;
 818                         goto fail;
 819                 }
 820
 821                 if (max_follow <= 0) { /* Let's make sure we don't follow symlinks forever */
 822                         r = -ELOOP;
 823                         goto fail;
 824                 }
 825
 826                 if (path_is_absolute(destination)) {
 827                         /* For absolute symlinks we build the new path and start anew */
 828                         c = strjoin(destination, absolute + done + n_component);
 829                         done = 0;
 830                 } else {
 831                         _cleanup_free_ char *t = NULL;
 832
 833                         /* For relative symlinks we replace the last component, and try again */
 834                         t = strndup(absolute, done);
 835                         if (!t)
 836                                 return -ENOMEM;
 837
 838                         c = strjoin(t, "/", destination, absolute + done + n_component);
 839                 }
 840                 if (!c) {
 841                         r = -ENOMEM;
 842                         goto fail;
 843                 }
 844
 845                 free(absolute);
 846                 absolute = c;
 847
 848                 max_follow--;
 849         }
 850
 851         /* And now, let's remove all watches from the previous iteration we don't need anymore */
 852         for (i = 0; i < b->n_inotify_watches; i++) {
 853                 bool found = false;
 854                 size_t j;
 855
 856                 for (j = 0; j < n; j++)
 857                         if (new_watches[j] == b->inotify_watches[i]) {
 858                                 found = true;
 859                                 break;
 860                         }
 861
 862                 if (found)
 863                         continue;
 864
 865                 (void) inotify_rm_watch(b->inotify_fd, b->inotify_watches[i]);
 866         }
 867
 868         free_and_replace(b->inotify_watches, new_watches);
 869         b->n_inotify_watches = n;
 870
 871         return 0;
 872
 873 fail:
 874         bus_close_inotify_fd(b);
 875         return r;
 876 }
 877
 878 int bus_socket_connect(sd_bus *b) {
 879         bool inotify_done = false;
 880         int r;
 881
 882         assert(b);
 883
 884         for (;;) {
 885                 assert(b->input_fd < 0);
 886                 assert(b->output_fd < 0);
 887                 assert(b->sockaddr.sa.sa_family != AF_UNSPEC);
 888
 889                 b->input_fd = socket(b->sockaddr.sa.sa_family, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
 890                 if (b->input_fd < 0)
 891                         return -errno;
 892
 893                 b->input_fd = fd_move_above_stdio(b->input_fd);
 894
 895                 b->output_fd = b->input_fd;
 896                 bus_socket_setup(b);
 897
 898                 if (connect(b->input_fd, &b->sockaddr.sa, b->sockaddr_size) < 0) {
 899                         if (errno == EINPROGRESS) {
 900
 901                                 /* If we have any inotify watches open, close them now, we don't need them anymore, as
 902                                  * we have successfully initiated a connection */
 903                                 bus_close_inotify_fd(b);
 904
 905                                 /* Note that very likely we are already in BUS_OPENING state here, as we enter it when
 906                                  * we start parsing the address string. The only reason we set the state explicitly
 907                                  * here, is to undo BUS_WATCH_BIND, in case we did the inotify magic. */
 908                                 bus_set_state(b, BUS_OPENING);
 909                                 return 1;
 910                         }
 911
 912                         if (IN_SET(errno, ENOENT, ECONNREFUSED) &&  /* ENOENT → unix socket doesn't exist at all; ECONNREFUSED → unix socket stale */
 913                             b->watch_bind &&
 914                             b->sockaddr.sa.sa_family == AF_UNIX &&
 915                             b->sockaddr.un.sun_path[0] != 0) {
 916
 917                                 /* This connection attempt failed, let's release the socket for now, and start with a
 918                                  * fresh one when reconnecting. */
 919                                 bus_close_io_fds(b);
 920
 921                                 if (inotify_done) {
 922                                         /* inotify set up already, don't do it again, just return now, and remember
 923                                          * that we are waiting for inotify events now. */
 924                                         bus_set_state(b, BUS_WATCH_BIND);
 925                                         return 1;
 926                                 }
 927
 928                                 /* This is a file system socket, and the inotify logic is enabled. Let's create the necessary inotify fd. */
 929                                 r = bus_socket_inotify_setup(b);
 930                                 if (r < 0)
 931                                         return r;
 932
 933                                 /* Let's now try to connect a second time, because in theory there's otherwise a race
 934                                  * here: the socket might have been created in the time between our first connect() and
 935                                  * the time we set up the inotify logic. But let's remember that we set up inotify now,
 936                                  * so that we don't do the connect() more than twice. */
 937                                 inotify_done = true;
 938
 939                         } else
 940                                 return -errno;
 941                 } else
 942                         break;
 943         }
 944
 945         /* Yay, established, we don't need no inotify anymore! */
 946         bus_close_inotify_fd(b);
 947
 948         return bus_socket_start_auth(b);
 949 }
 950
 951 int bus_socket_exec(sd_bus *b) {
 952         int s[2], r;
 953
 954         assert(b);
 955         assert(b->input_fd < 0);
 956         assert(b->output_fd < 0);
 957         assert(b->exec_path);
 958         assert(b->busexec_pid == 0);
 959
 960         r = socketpair(AF_UNIX, SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0, s);
 961         if (r < 0)
 962                 return -errno;
 963
 964         r = safe_fork_full("(sd-busexec)", s+1, 1, FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS, &b->busexec_pid);
 965         if (r < 0) {
 966                 safe_close_pair(s);
 967                 return r;
 968         }
 969         if (r == 0) {
 970                 /* Child */
 971
 972                 if (rearrange_stdio(s[1], s[1], STDERR_FILENO) < 0)
 973                         _exit(EXIT_FAILURE);
 974
 975                 (void) rlimit_nofile_safe();
 976
 977                 if (b->exec_argv)
 978                         execvp(b->exec_path, b->exec_argv);
 979                 else {
 980                         const char *argv[] = { b->exec_path, NULL };
 981                         execvp(b->exec_path, (char**) argv);
 982                 }
 983
 984                 _exit(EXIT_FAILURE);
 985         }
 986
 987         safe_close(s[1]);
 988         b->output_fd = b->input_fd = fd_move_above_stdio(s[0]);
 989
 990         bus_socket_setup(b);
 991
 992         return bus_socket_start_auth(b);
 993 }
 994
 995 int bus_socket_take_fd(sd_bus *b) {
 996         assert(b);
 997
 998         bus_socket_setup(b);
 999
1000         return bus_socket_start_auth(b);
1001 }
1002
1003 int bus_socket_write_message(sd_bus *bus, sd_bus_message *m, size_t *idx) {
1004         struct iovec *iov;
1005         ssize_t k;
1006         size_t n;
1007         unsigned j;
1008         int r;
1009
1010         assert(bus);
1011         assert(m);
1012         assert(idx);
1013         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1014
1015         if (*idx >= BUS_MESSAGE_SIZE(m))
1016                 return 0;
1017
1018         r = bus_message_setup_iovec(m);
1019         if (r < 0)
1020                 return r;
1021
1022         n = m->n_iovec * sizeof(struct iovec);
1023         iov = newa(struct iovec, n);
1024         memcpy_safe(iov, m->iovec, n);
1025
1026         j = 0;
1027         iovec_advance(iov, &j, *idx);
1028
1029         if (bus->prefer_writev)
1030                 k = writev(bus->output_fd, iov, m->n_iovec);
1031         else {
1032                 struct msghdr mh = {
1033                         .msg_iov = iov,
1034                         .msg_iovlen = m->n_iovec,
1035                 };
1036
1037                 if (m->n_fds > 0 && *idx == 0) {
1038                         struct cmsghdr *control;
1039
1040                         mh.msg_control = control = alloca(CMSG_SPACE(sizeof(int) * m->n_fds));
1041                         mh.msg_controllen = control->cmsg_len = CMSG_LEN(sizeof(int) * m->n_fds);
1042                         control->cmsg_level = SOL_SOCKET;
1043                         control->cmsg_type = SCM_RIGHTS;
1044                         memcpy(CMSG_DATA(control), m->fds, sizeof(int) * m->n_fds);
1045                 }
1046
1047                 k = sendmsg(bus->output_fd, &mh, MSG_DONTWAIT|MSG_NOSIGNAL);
1048                 if (k < 0 && errno == ENOTSOCK) {
1049                         bus->prefer_writev = true;
1050                         k = writev(bus->output_fd, iov, m->n_iovec);
1051                 }
1052         }
1053
1054         if (k < 0)
1055                 return errno == EAGAIN ? 0 : -errno;
1056
1057         *idx += (size_t) k;
1058         return 1;
1059 }
1060
1061 static int bus_socket_read_message_need(sd_bus *bus, size_t *need) {
1062         uint32_t a, b;
1063         uint8_t e;
1064         uint64_t sum;
1065
1066         assert(bus);
1067         assert(need);
1068         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1069
1070         if (bus->rbuffer_size < sizeof(struct bus_header)) {
1071                 *need = sizeof(struct bus_header) + 8;
1072
1073                 /* Minimum message size:
1074                  *
1075                  * Header +
1076                  *
1077                  *  Method Call: +2 string headers
1078                  *       Signal: +3 string headers
1079                  * Method Error: +1 string headers
1080                  *               +1 uint32 headers
1081                  * Method Reply: +1 uint32 headers
1082                  *
1083                  * A string header is at least 9 bytes
1084                  * A uint32 header is at least 8 bytes
1085                  *
1086                  * Hence the minimum message size of a valid message
1087                  * is header + 8 bytes */
1088
1089                 return 0;
1090         }
1091
1092         a = ((const uint32_t*) bus->rbuffer)[1];
1093         b = ((const uint32_t*) bus->rbuffer)[3];
1094
1095         e = ((const uint8_t*) bus->rbuffer)[0];
1096         if (e == BUS_LITTLE_ENDIAN) {
1097                 a = le32toh(a);
1098                 b = le32toh(b);
1099         } else if (e == BUS_BIG_ENDIAN) {
1100                 a = be32toh(a);
1101                 b = be32toh(b);
1102         } else
1103                 return -EBADMSG;
1104
1105         sum = (uint64_t) sizeof(struct bus_header) + (uint64_t) ALIGN_TO(b, 8) + (uint64_t) a;
1106         if (sum >= BUS_MESSAGE_SIZE_MAX)
1107                 return -ENOBUFS;
1108
1109         *need = (size_t) sum;
1110         return 0;
1111 }
1112
1113 static int bus_socket_make_message(sd_bus *bus, size_t size) {
1114         sd_bus_message *t = NULL;
1115         void *b;
1116         int r;
1117
1118         assert(bus);
1119         assert(bus->rbuffer_size >= size);
1120         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1121
1122         r = bus_rqueue_make_room(bus);
1123         if (r < 0)
1124                 return r;
1125
1126         if (bus->rbuffer_size > size) {
1127                 b = memdup((const uint8_t*) bus->rbuffer + size,
1128                            bus->rbuffer_size - size);
1129                 if (!b)
1130                         return -ENOMEM;
1131         } else
1132                 b = NULL;
1133
1134         r = bus_message_from_malloc(bus,
1135                                     bus->rbuffer, size,
1136                                     bus->fds, bus->n_fds,
1137                                     NULL,
1138                                     &t);
1139         if (r == -EBADMSG) {
1140                 log_debug_errno(r, "Received invalid message from connection %s, dropping.", strna(bus->description));
1141                 free(bus->rbuffer); /* We want to drop current rbuffer and proceed with whatever remains in b */
1142         } else if (r < 0) {
1143                 free(b);
1144                 return r;
1145         }
1146
1147         /* rbuffer ownership was either transferred to t, or we got EBADMSG and dropped it. */
1148         bus->rbuffer = b;
1149         bus->rbuffer_size -= size;
1150
1151         bus->fds = NULL;
1152         bus->n_fds = 0;
1153
1154         if (t) {
1155                 t->read_counter = ++bus->read_counter;
1156                 bus->rqueue[bus->rqueue_size++] = bus_message_ref_queued(t, bus);
1157                 sd_bus_message_unref(t);
1158         }
1159
1160         return 1;
1161 }
1162
1163 int bus_socket_read_message(sd_bus *bus) {
1164         struct msghdr mh;
1165         struct iovec iov = {};
1166         ssize_t k;
1167         size_t need;
1168         int r;
1169         void *b;
1170         union {
1171                 struct cmsghdr cmsghdr;
1172                 uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)];
1173         } control;
1174         bool handle_cmsg = false;
1175
1176         assert(bus);
1177         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1178
1179         r = bus_socket_read_message_need(bus, &need);
1180         if (r < 0)
1181                 return r;
1182
1183         if (bus->rbuffer_size >= need)
1184                 return bus_socket_make_message(bus, need);
1185
1186         b = realloc(bus->rbuffer, need);
1187         if (!b)
1188                 return -ENOMEM;
1189
1190         bus->rbuffer = b;
1191
1192         iov = IOVEC_MAKE((uint8_t *)bus->rbuffer + bus->rbuffer_size, need - bus->rbuffer_size);
1193
1194         if (bus->prefer_readv)
1195                 k = readv(bus->input_fd, &iov, 1);
1196         else {
1197                 zero(mh);
1198                 mh.msg_iov = &iov;
1199                 mh.msg_iovlen = 1;
1200                 mh.msg_control = &control;
1201                 mh.msg_controllen = sizeof(control);
1202
1203                 k = recvmsg_safe(bus->input_fd, &mh, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
1204                 if (k == -ENOTSOCK) {
1205                         bus->prefer_readv = true;
1206                         k = readv(bus->input_fd, &iov, 1);
1207                         if (k < 0)
1208                                 k = -errno;
1209                 } else
1210                         handle_cmsg = true;
1211         }
1212         if (k == -EAGAIN)
1213                 return 0;
1214         if (k < 0)
1215                 return (int) k;
1216         if (k == 0) {
1217                 if (handle_cmsg)
1218                         cmsg_close_all(&mh); /* On EOF we shouldn't have gotten an fd, but let's make sure */
1219                 return -ECONNRESET;
1220         }
1221
1222         bus->rbuffer_size += k;
1223
1224         if (handle_cmsg) {
1225                 struct cmsghdr *cmsg;
1226
1227                 CMSG_FOREACH(cmsg, &mh)
1228                         if (cmsg->cmsg_level == SOL_SOCKET &&
1229                             cmsg->cmsg_type == SCM_RIGHTS) {
1230                                 int n, *f, i;
1231
1232                                 n = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
1233
1234                                 if (!bus->can_fds) {
1235                                         /* Whut? We received fds but this
1236                                          * isn't actually enabled? Close them,
1237                                          * and fail */
1238
1239                                         close_many((int*) CMSG_DATA(cmsg), n);
1240                                         return -EIO;
1241                                 }
1242
1243                                 f = reallocarray(bus->fds, bus->n_fds + n, sizeof(int));
1244                                 if (!f) {
1245                                         close_many((int*) CMSG_DATA(cmsg), n);
1246                                         return -ENOMEM;
1247                                 }
1248
1249                                 for (i = 0; i < n; i++)
1250                                         f[bus->n_fds++] = fd_move_above_stdio(((int*) CMSG_DATA(cmsg))[i]);
1251                                 bus->fds = f;
1252                         } else
1253                                 log_debug("Got unexpected auxiliary data with level=%d and type=%d",
1254                                           cmsg->cmsg_level, cmsg->cmsg_type);
1255         }
1256
1257         r = bus_socket_read_message_need(bus, &need);
1258         if (r < 0)
1259                 return r;
1260
1261         if (bus->rbuffer_size >= need)
1262                 return bus_socket_make_message(bus, need);
1263
1264         return 1;
1265 }
1266
1267 int bus_socket_process_opening(sd_bus *b) {
1268         int error = 0;
1269         socklen_t slen = sizeof(error);
1270         struct pollfd p = {
1271                 .fd = b->output_fd,
1272                 .events = POLLOUT,
1273         };
1274         int r;
1275
1276         assert(b->state == BUS_OPENING);
1277
1278         r = poll(&p, 1, 0);
1279         if (r < 0)
1280                 return -errno;
1281
1282         if (!(p.revents & (POLLOUT|POLLERR|POLLHUP)))
1283                 return 0;
1284
1285         r = getsockopt(b->output_fd, SOL_SOCKET, SO_ERROR, &error, &slen);
1286         if (r < 0)
1287                 b->last_connect_error = errno;
1288         else if (error != 0)
1289                 b->last_connect_error = error;
1290         else if (p.revents & (POLLERR|POLLHUP))
1291                 b->last_connect_error = ECONNREFUSED;
1292         else
1293                 return bus_socket_start_auth(b);
1294
1295         return bus_next_address(b);
1296 }
1297
1298 int bus_socket_process_authenticating(sd_bus *b) {
1299         int r;
1300
1301         assert(b);
1302         assert(b->state == BUS_AUTHENTICATING);
1303
1304         if (now(CLOCK_MONOTONIC) >= b->auth_timeout)
1305                 return -ETIMEDOUT;
1306
1307         r = bus_socket_write_auth(b);
1308         if (r != 0)
1309                 return r;
1310
1311         return bus_socket_read_auth(b);
1312 }
1313
1314 int bus_socket_process_watch_bind(sd_bus *b) {
1315         int r, q;
1316
1317         assert(b);
1318         assert(b->state == BUS_WATCH_BIND);
1319         assert(b->inotify_fd >= 0);
1320
1321         r = flush_fd(b->inotify_fd);
1322         if (r <= 0)
1323                 return r;
1324
1325         log_debug("Got inotify event on bus %s.", strna(b->description));
1326
1327         /* We flushed events out of the inotify fd. In that case, maybe the socket is valid now? Let's try to connect
1328          * to it again */
1329
1330         r = bus_socket_connect(b);
1331         if (r < 0)
1332                 return r;
1333
1334         q = bus_attach_io_events(b);
1335         if (q < 0)
1336                 return q;
1337
1338         q = bus_attach_inotify_event(b);
1339         if (q < 0)
1340                 return q;
1341
1342         return r;
1343 }