src/libsystemd/sd-bus/bus-socket.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <endian.h>
   4 #include <poll.h>
   5 #include <stdlib.h>
   6 #include <unistd.h>
   7
   8 #include "sd-bus.h"
   9 #include "sd-daemon.h"
  10
  11 #include "alloc-util.h"
  12 #include "bus-internal.h"
  13 #include "bus-message.h"
  14 #include "bus-socket.h"
  15 #include "fd-util.h"
  16 #include "format-util.h"
  17 #include "fs-util.h"
  18 #include "hexdecoct.h"
  19 #include "io-util.h"
  20 #include "macro.h"
  21 #include "memory-util.h"
  22 #include "path-util.h"
  23 #include "process-util.h"
  24 #include "rlimit-util.h"
  25 #include "selinux-util.h"
  26 #include "signal-util.h"
  27 #include "stdio-util.h"
  28 #include "string-util.h"
  29 #include "user-util.h"
  30 #include "utf8.h"
  31
  32 #define SNDBUF_SIZE (8*1024*1024)
  33
  34 static void iovec_advance(struct iovec iov[], unsigned *idx, size_t size) {
  35
  36         while (size > 0) {
  37                 struct iovec *i = iov + *idx;
  38
  39                 if (i->iov_len > size) {
  40                         i->iov_base = (uint8_t*) i->iov_base + size;
  41                         i->iov_len -= size;
  42                         return;
  43                 }
  44
  45                 size -= i->iov_len;
  46
  47                 *i = IOVEC_MAKE(NULL, 0);
  48
  49                 (*idx)++;
  50         }
  51 }
  52
  53 static int append_iovec(sd_bus_message *m, const void *p, size_t sz) {
  54         assert(m);
  55         assert(p);
  56         assert(sz > 0);
  57
  58         m->iovec[m->n_iovec++] = IOVEC_MAKE((void*) p, sz);
  59
  60         return 0;
  61 }
  62
  63 static int bus_message_setup_iovec(sd_bus_message *m) {
  64         struct bus_body_part *part;
  65         unsigned n, i;
  66         int r;
  67
  68         assert(m);
  69         assert(m->sealed);
  70
  71         if (m->n_iovec > 0)
  72                 return 0;
  73
  74         assert(!m->iovec);
  75
  76         n = 1 + m->n_body_parts;
  77         if (n < ELEMENTSOF(m->iovec_fixed))
  78                 m->iovec = m->iovec_fixed;
  79         else {
  80                 m->iovec = new(struct iovec, n);
  81                 if (!m->iovec) {
  82                         r = -ENOMEM;
  83                         goto fail;
  84                 }
  85         }
  86
  87         r = append_iovec(m, m->header, BUS_MESSAGE_BODY_BEGIN(m));
  88         if (r < 0)
  89                 goto fail;
  90
  91         MESSAGE_FOREACH_PART(part, i, m)  {
  92                 r = bus_body_part_map(part);
  93                 if (r < 0)
  94                         goto fail;
  95
  96                 r = append_iovec(m, part->data, part->size);
  97                 if (r < 0)
  98                         goto fail;
  99         }
 100
 101         assert(n == m->n_iovec);
 102
 103         return 0;
 104
 105 fail:
 106         m->poisoned = true;
 107         return r;
 108 }
 109
 110 bool bus_socket_auth_needs_write(sd_bus *b) {
 111
 112         unsigned i;
 113
 114         if (b->auth_index >= ELEMENTSOF(b->auth_iovec))
 115                 return false;
 116
 117         for (i = b->auth_index; i < ELEMENTSOF(b->auth_iovec); i++) {
 118                 struct iovec *j = b->auth_iovec + i;
 119
 120                 if (j->iov_len > 0)
 121                         return true;
 122         }
 123
 124         return false;
 125 }
 126
 127 static int bus_socket_write_auth(sd_bus *b) {
 128         ssize_t k;
 129
 130         assert(b);
 131         assert(b->state == BUS_AUTHENTICATING);
 132
 133         if (!bus_socket_auth_needs_write(b))
 134                 return 0;
 135
 136         if (b->prefer_writev)
 137                 k = writev(b->output_fd, b->auth_iovec + b->auth_index, ELEMENTSOF(b->auth_iovec) - b->auth_index);
 138         else {
 139                 struct msghdr mh = {
 140                         .msg_iov = b->auth_iovec + b->auth_index,
 141                         .msg_iovlen = ELEMENTSOF(b->auth_iovec) - b->auth_index,
 142                 };
 143
 144                 k = sendmsg(b->output_fd, &mh, MSG_DONTWAIT|MSG_NOSIGNAL);
 145                 if (k < 0 && errno == ENOTSOCK) {
 146                         b->prefer_writev = true;
 147                         k = writev(b->output_fd, b->auth_iovec + b->auth_index, ELEMENTSOF(b->auth_iovec) - b->auth_index);
 148                 }
 149         }
 150
 151         if (k < 0)
 152                 return errno == EAGAIN ? 0 : -errno;
 153
 154         iovec_advance(b->auth_iovec, &b->auth_index, (size_t) k);
 155         return 1;
 156 }
 157
 158 static int bus_socket_auth_verify_client(sd_bus *b) {
 159         char *d, *e, *f, *start;
 160         sd_id128_t peer;
 161         int r;
 162
 163         assert(b);
 164
 165         /*
 166          * We expect three response lines:
 167          *   "DATA\r\n"
 168          *   "OK <server-id>\r\n"
 169          *   "AGREE_UNIX_FD\r\n"        (optional)
 170          */
 171
 172         d = memmem_safe(b->rbuffer, b->rbuffer_size, "\r\n", 2);
 173         if (!d)
 174                 return 0;
 175
 176         e = memmem(d + 2, b->rbuffer_size - (d - (char*) b->rbuffer) - 2, "\r\n", 2);
 177         if (!e)
 178                 return 0;
 179
 180         if (b->accept_fd) {
 181                 f = memmem(e + 2, b->rbuffer_size - (e - (char*) b->rbuffer) - 2, "\r\n", 2);
 182                 if (!f)
 183                         return 0;
 184
 185                 start = f + 2;
 186         } else {
 187                 f = NULL;
 188                 start = e + 2;
 189         }
 190
 191         /* Nice! We got all the lines we need. First check the DATA line. */
 192
 193         if (d - (char*) b->rbuffer == 4) {
 194                 if (memcmp(b->rbuffer, "DATA", 4))
 195                         return -EPERM;
 196         } else if (d - (char*) b->rbuffer == 3 + 32) {
 197                 /*
 198                  * Old versions of the server-side implementation of `sd-bus` replied with "OK <id>" to
 199                  * "AUTH" requests from a client, even if the "AUTH" line did not contain inlined
 200                  * arguments. Therefore, we also accept "OK <id>" here, even though it is technically the
 201                  * wrong reply. We ignore the "<id>" parameter, though, since it has no real value.
 202                  */
 203                 if (memcmp(b->rbuffer, "OK ", 3))
 204                         return -EPERM;
 205         } else
 206                 return -EPERM;
 207
 208         /* Now check the OK line. */
 209
 210         if (e - d != 2 + 3 + 32)
 211                 return -EPERM;
 212
 213         if (memcmp(d + 2, "OK ", 3))
 214                 return -EPERM;
 215
 216         b->auth = b->anonymous_auth ? BUS_AUTH_ANONYMOUS : BUS_AUTH_EXTERNAL;
 217
 218         for (unsigned i = 0; i < 32; i += 2) {
 219                 int x, y;
 220
 221                 x = unhexchar(d[2 + 3 + i]);
 222                 y = unhexchar(d[2 + 3 + i + 1]);
 223
 224                 if (x < 0 || y < 0)
 225                         return -EINVAL;
 226
 227                 peer.bytes[i/2] = ((uint8_t) x << 4 | (uint8_t) y);
 228         }
 229
 230         if (!sd_id128_is_null(b->server_id) &&
 231             !sd_id128_equal(b->server_id, peer))
 232                 return -EPERM;
 233
 234         b->server_id = peer;
 235
 236         /* And possibly check the third line, too */
 237
 238         if (f)
 239                 b->can_fds =
 240                         (f - e == STRLEN("\r\nAGREE_UNIX_FD")) &&
 241                         memcmp(e + 2, "AGREE_UNIX_FD",
 242                                STRLEN("AGREE_UNIX_FD")) == 0;
 243
 244         b->rbuffer_size -= (start - (char*) b->rbuffer);
 245         memmove(b->rbuffer, start, b->rbuffer_size);
 246
 247         r = bus_start_running(b);
 248         if (r < 0)
 249                 return r;
 250
 251         return 1;
 252 }
 253
 254 static bool line_equals(const char *s, size_t m, const char *line) {
 255         size_t l;
 256
 257         l = strlen(line);
 258         if (l != m)
 259                 return false;
 260
 261         return memcmp(s, line, l) == 0;
 262 }
 263
 264 static bool line_begins(const char *s, size_t m, const char *word) {
 265         const char *p;
 266
 267         p = memory_startswith(s, m, word);
 268         return p && (p == (s + m) || *p == ' ');
 269 }
 270
 271 static int verify_anonymous_token(sd_bus *b, const char *p, size_t l) {
 272         _cleanup_free_ char *token = NULL;
 273         size_t len;
 274         int r;
 275
 276         if (!b->anonymous_auth)
 277                 return 0;
 278
 279         if (l <= 0)
 280                 return 1;
 281
 282         assert(p[0] == ' ');
 283         p++; l--;
 284
 285         if (l % 2 != 0)
 286                 return 0;
 287
 288         r = unhexmem(p, l, (void **) &token, &len);
 289         if (r < 0)
 290                 return 0;
 291
 292         if (memchr(token, 0, len))
 293                 return 0;
 294
 295         return !!utf8_is_valid(token);
 296 }
 297
 298 static int verify_external_token(sd_bus *b, const char *p, size_t l) {
 299         _cleanup_free_ char *token = NULL;
 300         size_t len;
 301         uid_t u;
 302         int r;
 303
 304         /* We don't do any real authentication here. Instead, we if
 305          * the owner of this bus wanted authentication he should have
 306          * checked SO_PEERCRED before even creating the bus object. */
 307
 308         if (!b->anonymous_auth && !b->ucred_valid)
 309                 return 0;
 310
 311         if (l <= 0)
 312                 return 1;
 313
 314         assert(p[0] == ' ');
 315         p++; l--;
 316
 317         if (l % 2 != 0)
 318                 return 0;
 319
 320         r = unhexmem(p, l, (void**) &token, &len);
 321         if (r < 0)
 322                 return 0;
 323
 324         if (memchr(token, 0, len))
 325                 return 0;
 326
 327         r = parse_uid(token, &u);
 328         if (r < 0)
 329                 return 0;
 330
 331         /* We ignore the passed value if anonymous authentication is
 332          * on anyway. */
 333         if (!b->anonymous_auth && u != b->ucred.uid)
 334                 return 0;
 335
 336         return 1;
 337 }
 338
 339 static int bus_socket_auth_write(sd_bus *b, const char *t) {
 340         char *p;
 341         size_t l;
 342
 343         assert(b);
 344         assert(t);
 345
 346         /* We only make use of the first iovec */
 347         assert(IN_SET(b->auth_index, 0, 1));
 348
 349         l = strlen(t);
 350         p = malloc(b->auth_iovec[0].iov_len + l);
 351         if (!p)
 352                 return -ENOMEM;
 353
 354         memcpy_safe(p, b->auth_iovec[0].iov_base, b->auth_iovec[0].iov_len);
 355         memcpy(p + b->auth_iovec[0].iov_len, t, l);
 356
 357         b->auth_iovec[0].iov_base = p;
 358         b->auth_iovec[0].iov_len += l;
 359
 360         free(b->auth_buffer);
 361         b->auth_buffer = p;
 362         b->auth_index = 0;
 363         return 0;
 364 }
 365
 366 static int bus_socket_auth_write_ok(sd_bus *b) {
 367         char t[3 + 32 + 2 + 1];
 368
 369         assert(b);
 370
 371         xsprintf(t, "OK " SD_ID128_FORMAT_STR "\r\n", SD_ID128_FORMAT_VAL(b->server_id));
 372
 373         return bus_socket_auth_write(b, t);
 374 }
 375
 376 static int bus_socket_auth_verify_server(sd_bus *b) {
 377         char *e;
 378         const char *line;
 379         size_t l;
 380         bool processed = false;
 381         int r;
 382
 383         assert(b);
 384
 385         if (b->rbuffer_size < 1)
 386                 return 0;
 387
 388         /* First char must be a NUL byte */
 389         if (*(char*) b->rbuffer != 0)
 390                 return -EIO;
 391
 392         if (b->rbuffer_size < 3)
 393                 return 0;
 394
 395         /* Begin with the first line */
 396         if (b->auth_rbegin <= 0)
 397                 b->auth_rbegin = 1;
 398
 399         for (;;) {
 400                 /* Check if line is complete */
 401                 line = (char*) b->rbuffer + b->auth_rbegin;
 402                 e = memmem(line, b->rbuffer_size - b->auth_rbegin, "\r\n", 2);
 403                 if (!e)
 404                         return processed;
 405
 406                 l = e - line;
 407
 408                 if (line_begins(line, l, "AUTH ANONYMOUS")) {
 409
 410                         r = verify_anonymous_token(b,
 411                                                    line + strlen("AUTH ANONYMOUS"),
 412                                                    l - strlen("AUTH ANONYMOUS"));
 413                         if (r < 0)
 414                                 return r;
 415                         if (r == 0)
 416                                 r = bus_socket_auth_write(b, "REJECTED\r\n");
 417                         else {
 418                                 b->auth = BUS_AUTH_ANONYMOUS;
 419                                 if (l <= strlen("AUTH ANONYMOUS"))
 420                                         r = bus_socket_auth_write(b, "DATA\r\n");
 421                                 else
 422                                         r = bus_socket_auth_write_ok(b);
 423                         }
 424
 425                 } else if (line_begins(line, l, "AUTH EXTERNAL")) {
 426
 427                         r = verify_external_token(b,
 428                                                   line + strlen("AUTH EXTERNAL"),
 429                                                   l - strlen("AUTH EXTERNAL"));
 430                         if (r < 0)
 431                                 return r;
 432                         if (r == 0)
 433                                 r = bus_socket_auth_write(b, "REJECTED\r\n");
 434                         else {
 435                                 b->auth = BUS_AUTH_EXTERNAL;
 436                                 if (l <= strlen("AUTH EXTERNAL"))
 437                                         r = bus_socket_auth_write(b, "DATA\r\n");
 438                                 else
 439                                         r = bus_socket_auth_write_ok(b);
 440                         }
 441
 442                 } else if (line_begins(line, l, "AUTH"))
 443                         r = bus_socket_auth_write(b, "REJECTED EXTERNAL ANONYMOUS\r\n");
 444                 else if (line_equals(line, l, "CANCEL") ||
 445                          line_begins(line, l, "ERROR")) {
 446
 447                         b->auth = _BUS_AUTH_INVALID;
 448                         r = bus_socket_auth_write(b, "REJECTED\r\n");
 449
 450                 } else if (line_equals(line, l, "BEGIN")) {
 451
 452                         if (b->auth == _BUS_AUTH_INVALID)
 453                                 r = bus_socket_auth_write(b, "ERROR\r\n");
 454                         else {
 455                                 /* We can't leave from the auth phase
 456                                  * before we haven't written
 457                                  * everything queued, so let's check
 458                                  * that */
 459
 460                                 if (bus_socket_auth_needs_write(b))
 461                                         return 1;
 462
 463                                 b->rbuffer_size -= (e + 2 - (char*) b->rbuffer);
 464                                 memmove(b->rbuffer, e + 2, b->rbuffer_size);
 465                                 return bus_start_running(b);
 466                         }
 467
 468                 } else if (line_begins(line, l, "DATA")) {
 469
 470                         if (b->auth == _BUS_AUTH_INVALID)
 471                                 r = bus_socket_auth_write(b, "ERROR\r\n");
 472                         else {
 473                                 if (b->auth == BUS_AUTH_ANONYMOUS)
 474                                         r = verify_anonymous_token(b, line + 4, l - 4);
 475                                 else
 476                                         r = verify_external_token(b, line + 4, l - 4);
 477
 478                                 if (r < 0)
 479                                         return r;
 480                                 if (r == 0) {
 481                                         b->auth = _BUS_AUTH_INVALID;
 482                                         r = bus_socket_auth_write(b, "REJECTED\r\n");
 483                                 } else
 484                                         r = bus_socket_auth_write_ok(b);
 485                         }
 486                 } else if (line_equals(line, l, "NEGOTIATE_UNIX_FD")) {
 487                         if (b->auth == _BUS_AUTH_INVALID || !b->accept_fd)
 488                                 r = bus_socket_auth_write(b, "ERROR\r\n");
 489                         else {
 490                                 b->can_fds = true;
 491                                 r = bus_socket_auth_write(b, "AGREE_UNIX_FD\r\n");
 492                         }
 493                 } else
 494                         r = bus_socket_auth_write(b, "ERROR\r\n");
 495
 496                 if (r < 0)
 497                         return r;
 498
 499                 b->auth_rbegin = e + 2 - (char*) b->rbuffer;
 500
 501                 processed = true;
 502         }
 503 }
 504
 505 static int bus_socket_auth_verify(sd_bus *b) {
 506         assert(b);
 507
 508         if (b->is_server)
 509                 return bus_socket_auth_verify_server(b);
 510         else
 511                 return bus_socket_auth_verify_client(b);
 512 }
 513
 514 static int bus_socket_read_auth(sd_bus *b) {
 515         struct msghdr mh;
 516         struct iovec iov = {};
 517         size_t n;
 518         ssize_t k;
 519         int r;
 520         void *p;
 521         CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)) control;
 522         bool handle_cmsg = false;
 523
 524         assert(b);
 525         assert(b->state == BUS_AUTHENTICATING);
 526
 527         r = bus_socket_auth_verify(b);
 528         if (r != 0)
 529                 return r;
 530
 531         n = MAX(256u, b->rbuffer_size * 2);
 532
 533         if (n > BUS_AUTH_SIZE_MAX)
 534                 n = BUS_AUTH_SIZE_MAX;
 535
 536         if (b->rbuffer_size >= n)
 537                 return -ENOBUFS;
 538
 539         p = realloc(b->rbuffer, n);
 540         if (!p)
 541                 return -ENOMEM;
 542
 543         b->rbuffer = p;
 544
 545         iov = IOVEC_MAKE((uint8_t *)b->rbuffer + b->rbuffer_size, n - b->rbuffer_size);
 546
 547         if (b->prefer_readv) {
 548                 k = readv(b->input_fd, &iov, 1);
 549                 if (k < 0)
 550                         k = -errno;
 551         } else {
 552                 mh = (struct msghdr) {
 553                         .msg_iov = &iov,
 554                         .msg_iovlen = 1,
 555                         .msg_control = &control,
 556                         .msg_controllen = sizeof(control),
 557                 };
 558
 559                 k = recvmsg_safe(b->input_fd, &mh, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
 560                 if (k == -ENOTSOCK) {
 561                         b->prefer_readv = true;
 562                         k = readv(b->input_fd, &iov, 1);
 563                         if (k < 0)
 564                                 k = -errno;
 565                 } else
 566                         handle_cmsg = true;
 567         }
 568         if (k == -EAGAIN)
 569                 return 0;
 570         if (k < 0)
 571                 return (int) k;
 572         if (k == 0) {
 573                 if (handle_cmsg)
 574                         cmsg_close_all(&mh); /* paranoia, we shouldn't have gotten any fds on EOF */
 575                 return -ECONNRESET;
 576         }
 577
 578         b->rbuffer_size += k;
 579
 580         if (handle_cmsg) {
 581                 struct cmsghdr *cmsg;
 582
 583                 CMSG_FOREACH(cmsg, &mh)
 584                         if (cmsg->cmsg_level == SOL_SOCKET &&
 585                             cmsg->cmsg_type == SCM_RIGHTS) {
 586                                 int j;
 587
 588                                 /* Whut? We received fds during the auth
 589                                  * protocol? Somebody is playing games with
 590                                  * us. Close them all, and fail */
 591                                 j = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
 592                                 close_many((int*) CMSG_DATA(cmsg), j);
 593                                 return -EIO;
 594                         } else
 595                                 log_debug("Got unexpected auxiliary data with level=%d and type=%d",
 596                                           cmsg->cmsg_level, cmsg->cmsg_type);
 597         }
 598
 599         r = bus_socket_auth_verify(b);
 600         if (r != 0)
 601                 return r;
 602
 603         return 1;
 604 }
 605
 606 void bus_socket_setup(sd_bus *b) {
 607         assert(b);
 608
 609         /* Increase the buffers to 8 MB */
 610         (void) fd_inc_rcvbuf(b->input_fd, SNDBUF_SIZE);
 611         (void) fd_inc_sndbuf(b->output_fd, SNDBUF_SIZE);
 612
 613         b->message_version = 1;
 614         b->message_endian = 0;
 615 }
 616
 617 static void bus_get_peercred(sd_bus *b) {
 618         int r;
 619
 620         assert(b);
 621         assert(!b->ucred_valid);
 622         assert(!b->label);
 623         assert(b->n_groups == SIZE_MAX);
 624
 625         /* Get the peer for socketpair() sockets */
 626         b->ucred_valid = getpeercred(b->input_fd, &b->ucred) >= 0;
 627
 628         /* Get the SELinux context of the peer */
 629         r = getpeersec(b->input_fd, &b->label);
 630         if (r < 0 && !IN_SET(r, -EOPNOTSUPP, -ENOPROTOOPT))
 631                 log_debug_errno(r, "Failed to determine peer security context: %m");
 632
 633         /* Get the list of auxiliary groups of the peer */
 634         r = getpeergroups(b->input_fd, &b->groups);
 635         if (r >= 0)
 636                 b->n_groups = (size_t) r;
 637         else if (!IN_SET(r, -EOPNOTSUPP, -ENOPROTOOPT))
 638                 log_debug_errno(r, "Failed to determine peer's group list: %m");
 639 }
 640
 641 static int bus_socket_start_auth_client(sd_bus *b) {
 642         static const char sasl_auth_anonymous[] = {
 643                 /*
 644                  * We use an arbitrary trace-string for the ANONYMOUS authentication. It can be used by the
 645                  * message broker to aid debugging of clients. We fully anonymize the connection and use a
 646                  * static default.
 647                  */
 648                 "\0AUTH ANONYMOUS\r\n"
 649                 /* HEX a n o n y m o u s */
 650                 "DATA 616e6f6e796d6f7573\r\n"
 651         };
 652         static const char sasl_auth_external[] = {
 653                 "\0AUTH EXTERNAL\r\n"
 654                 "DATA\r\n"
 655         };
 656         static const char sasl_negotiate_unix_fd[] = {
 657                 "NEGOTIATE_UNIX_FD\r\n"
 658         };
 659         static const char sasl_begin[] = {
 660                 "BEGIN\r\n"
 661         };
 662         size_t i = 0;
 663
 664         assert(b);
 665
 666         if (b->anonymous_auth)
 667                 b->auth_iovec[i++] = IOVEC_MAKE((char*) sasl_auth_anonymous, sizeof(sasl_auth_anonymous) - 1);
 668         else
 669                 b->auth_iovec[i++] = IOVEC_MAKE((char*) sasl_auth_external, sizeof(sasl_auth_external) - 1);
 670
 671         if (b->accept_fd)
 672                 b->auth_iovec[i++] = IOVEC_MAKE_STRING(sasl_negotiate_unix_fd);
 673
 674         b->auth_iovec[i++] = IOVEC_MAKE_STRING(sasl_begin);
 675
 676         return bus_socket_write_auth(b);
 677 }
 678
 679 int bus_socket_start_auth(sd_bus *b) {
 680         assert(b);
 681
 682         bus_get_peercred(b);
 683
 684         bus_set_state(b, BUS_AUTHENTICATING);
 685         b->auth_timeout = now(CLOCK_MONOTONIC) + BUS_AUTH_TIMEOUT;
 686
 687         if (sd_is_socket(b->input_fd, AF_UNIX, 0, 0) <= 0)
 688                 b->accept_fd = false;
 689
 690         if (b->output_fd != b->input_fd)
 691                 if (sd_is_socket(b->output_fd, AF_UNIX, 0, 0) <= 0)
 692                         b->accept_fd = false;
 693
 694         if (b->is_server)
 695                 return bus_socket_read_auth(b);
 696         else
 697                 return bus_socket_start_auth_client(b);
 698 }
 699
 700 static int bus_socket_inotify_setup(sd_bus *b) {
 701         _cleanup_free_ int *new_watches = NULL;
 702         _cleanup_free_ char *absolute = NULL;
 703         size_t n = 0, done = 0, i;
 704         unsigned max_follow = 32;
 705         const char *p;
 706         int wd, r;
 707
 708         assert(b);
 709         assert(b->watch_bind);
 710         assert(b->sockaddr.sa.sa_family == AF_UNIX);
 711         assert(b->sockaddr.un.sun_path[0] != 0);
 712
 713         /* Sets up an inotify fd in case watch_bind is enabled: wait until the configured AF_UNIX file system socket
 714          * appears before connecting to it. The implemented is pretty simplistic: we just subscribe to relevant changes
 715          * to all prefix components of the path, and every time we get an event for that we try to reconnect again,
 716          * without actually caring what precisely the event we got told us. If we still can't connect we re-subscribe
 717          * to all relevant changes of anything in the path, so that our watches include any possibly newly created path
 718          * components. */
 719
 720         if (b->inotify_fd < 0) {
 721                 b->inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
 722                 if (b->inotify_fd < 0)
 723                         return -errno;
 724
 725                 b->inotify_fd = fd_move_above_stdio(b->inotify_fd);
 726         }
 727
 728         /* Make sure the path is NUL terminated */
 729         p = strndupa(b->sockaddr.un.sun_path, sizeof(b->sockaddr.un.sun_path));
 730
 731         /* Make sure the path is absolute */
 732         r = path_make_absolute_cwd(p, &absolute);
 733         if (r < 0)
 734                 goto fail;
 735
 736         /* Watch all parent directories, and don't mind any prefix that doesn't exist yet. For the innermost directory
 737          * that exists we want to know when files are created or moved into it. For all parents of it we just care if
 738          * they are removed or renamed. */
 739
 740         if (!GREEDY_REALLOC(new_watches, n + 1)) {
 741                 r = -ENOMEM;
 742                 goto fail;
 743         }
 744
 745         /* Start with the top-level directory, which is a bit simpler than the rest, since it can't be a symlink, and
 746          * always exists */
 747         wd = inotify_add_watch(b->inotify_fd, "/", IN_CREATE|IN_MOVED_TO);
 748         if (wd < 0) {
 749                 r = log_debug_errno(errno, "Failed to add inotify watch on /: %m");
 750                 goto fail;
 751         } else
 752                 new_watches[n++] = wd;
 753
 754         for (;;) {
 755                 _cleanup_free_ char *component = NULL, *prefix = NULL, *destination = NULL;
 756                 size_t n_slashes, n_component;
 757                 char *c = NULL;
 758
 759                 n_slashes = strspn(absolute + done, "/");
 760                 n_component = n_slashes + strcspn(absolute + done + n_slashes, "/");
 761
 762                 if (n_component == 0) /* The end */
 763                         break;
 764
 765                 component = strndup(absolute + done, n_component);
 766                 if (!component) {
 767                         r = -ENOMEM;
 768                         goto fail;
 769                 }
 770
 771                 /* A trailing slash? That's a directory, and not a socket then */
 772                 if (path_equal(component, "/")) {
 773                         r = -EISDIR;
 774                         goto fail;
 775                 }
 776
 777                 /* A single dot? Let's eat this up */
 778                 if (path_equal(component, "/.")) {
 779                         done += n_component;
 780                         continue;
 781                 }
 782
 783                 prefix = strndup(absolute, done + n_component);
 784                 if (!prefix) {
 785                         r = -ENOMEM;
 786                         goto fail;
 787                 }
 788
 789                 if (!GREEDY_REALLOC(new_watches, n + 1)) {
 790                         r = -ENOMEM;
 791                         goto fail;
 792                 }
 793
 794                 wd = inotify_add_watch(b->inotify_fd, prefix, IN_DELETE_SELF|IN_MOVE_SELF|IN_ATTRIB|IN_CREATE|IN_MOVED_TO|IN_DONT_FOLLOW);
 795                 log_debug("Added inotify watch for %s on bus %s: %i", prefix, strna(b->description), wd);
 796
 797                 if (wd < 0) {
 798                         if (IN_SET(errno, ENOENT, ELOOP))
 799                                 break; /* This component doesn't exist yet, or the path contains a cyclic symlink right now */
 800
 801                         r = log_debug_errno(errno, "Failed to add inotify watch on %s: %m", empty_to_root(prefix));
 802                         goto fail;
 803                 } else
 804                         new_watches[n++] = wd;
 805
 806                 /* Check if this is possibly a symlink. If so, let's follow it and watch it too. */
 807                 r = readlink_malloc(prefix, &destination);
 808                 if (r == -EINVAL) { /* not a symlink */
 809                         done += n_component;
 810                         continue;
 811                 }
 812                 if (r < 0)
 813                         goto fail;
 814
 815                 if (isempty(destination)) { /* Empty symlink target? Yuck! */
 816                         r = -EINVAL;
 817                         goto fail;
 818                 }
 819
 820                 if (max_follow <= 0) { /* Let's make sure we don't follow symlinks forever */
 821                         r = -ELOOP;
 822                         goto fail;
 823                 }
 824
 825                 if (path_is_absolute(destination)) {
 826                         /* For absolute symlinks we build the new path and start anew */
 827                         c = strjoin(destination, absolute + done + n_component);
 828                         done = 0;
 829                 } else {
 830                         _cleanup_free_ char *t = NULL;
 831
 832                         /* For relative symlinks we replace the last component, and try again */
 833                         t = strndup(absolute, done);
 834                         if (!t)
 835                                 return -ENOMEM;
 836
 837                         c = strjoin(t, "/", destination, absolute + done + n_component);
 838                 }
 839                 if (!c) {
 840                         r = -ENOMEM;
 841                         goto fail;
 842                 }
 843
 844                 free(absolute);
 845                 absolute = c;
 846
 847                 max_follow--;
 848         }
 849
 850         /* And now, let's remove all watches from the previous iteration we don't need anymore */
 851         for (i = 0; i < b->n_inotify_watches; i++) {
 852                 bool found = false;
 853                 size_t j;
 854
 855                 for (j = 0; j < n; j++)
 856                         if (new_watches[j] == b->inotify_watches[i]) {
 857                                 found = true;
 858                                 break;
 859                         }
 860
 861                 if (found)
 862                         continue;
 863
 864                 (void) inotify_rm_watch(b->inotify_fd, b->inotify_watches[i]);
 865         }
 866
 867         free_and_replace(b->inotify_watches, new_watches);
 868         b->n_inotify_watches = n;
 869
 870         return 0;
 871
 872 fail:
 873         bus_close_inotify_fd(b);
 874         return r;
 875 }
 876
 877 int bus_socket_connect(sd_bus *b) {
 878         bool inotify_done = false;
 879         int r;
 880
 881         assert(b);
 882
 883         for (;;) {
 884                 assert(b->input_fd < 0);
 885                 assert(b->output_fd < 0);
 886                 assert(b->sockaddr.sa.sa_family != AF_UNSPEC);
 887
 888                 if (DEBUG_LOGGING) {
 889                         _cleanup_free_ char *pretty = NULL;
 890                         (void) sockaddr_pretty(&b->sockaddr.sa, b->sockaddr_size, false, true, &pretty);
 891                         log_debug("sd-bus: starting bus%s%s by connecting to %s...",
 892                                   b->description ? " " : "", strempty(b->description), strnull(pretty));
 893                 }
 894
 895                 b->input_fd = socket(b->sockaddr.sa.sa_family, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
 896                 if (b->input_fd < 0)
 897                         return -errno;
 898
 899                 b->input_fd = fd_move_above_stdio(b->input_fd);
 900
 901                 b->output_fd = b->input_fd;
 902                 bus_socket_setup(b);
 903
 904                 if (connect(b->input_fd, &b->sockaddr.sa, b->sockaddr_size) < 0) {
 905                         if (errno == EINPROGRESS) {
 906
 907                                 /* If we have any inotify watches open, close them now, we don't need them anymore, as
 908                                  * we have successfully initiated a connection */
 909                                 bus_close_inotify_fd(b);
 910
 911                                 /* Note that very likely we are already in BUS_OPENING state here, as we enter it when
 912                                  * we start parsing the address string. The only reason we set the state explicitly
 913                                  * here, is to undo BUS_WATCH_BIND, in case we did the inotify magic. */
 914                                 bus_set_state(b, BUS_OPENING);
 915                                 return 1;
 916                         }
 917
 918                         if (IN_SET(errno, ENOENT, ECONNREFUSED) &&  /* ENOENT → unix socket doesn't exist at all; ECONNREFUSED → unix socket stale */
 919                             b->watch_bind &&
 920                             b->sockaddr.sa.sa_family == AF_UNIX &&
 921                             b->sockaddr.un.sun_path[0] != 0) {
 922
 923                                 /* This connection attempt failed, let's release the socket for now, and start with a
 924                                  * fresh one when reconnecting. */
 925                                 bus_close_io_fds(b);
 926
 927                                 if (inotify_done) {
 928                                         /* inotify set up already, don't do it again, just return now, and remember
 929                                          * that we are waiting for inotify events now. */
 930                                         bus_set_state(b, BUS_WATCH_BIND);
 931                                         return 1;
 932                                 }
 933
 934                                 /* This is a file system socket, and the inotify logic is enabled. Let's create the necessary inotify fd. */
 935                                 r = bus_socket_inotify_setup(b);
 936                                 if (r < 0)
 937                                         return r;
 938
 939                                 /* Let's now try to connect a second time, because in theory there's otherwise a race
 940                                  * here: the socket might have been created in the time between our first connect() and
 941                                  * the time we set up the inotify logic. But let's remember that we set up inotify now,
 942                                  * so that we don't do the connect() more than twice. */
 943                                 inotify_done = true;
 944
 945                         } else
 946                                 return -errno;
 947                 } else
 948                         break;
 949         }
 950
 951         /* Yay, established, we don't need no inotify anymore! */
 952         bus_close_inotify_fd(b);
 953
 954         return bus_socket_start_auth(b);
 955 }
 956
 957 int bus_socket_exec(sd_bus *b) {
 958         int s[2], r;
 959
 960         assert(b);
 961         assert(b->input_fd < 0);
 962         assert(b->output_fd < 0);
 963         assert(b->exec_path);
 964         assert(b->busexec_pid == 0);
 965
 966         log_debug("sd-bus: starting bus%s%s with %s...",
 967                   b->description ? " " : "", strempty(b->description), b->exec_path);
 968
 969         r = socketpair(AF_UNIX, SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0, s);
 970         if (r < 0)
 971                 return -errno;
 972
 973         r = safe_fork_full("(sd-busexec)", s+1, 1, FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS, &b->busexec_pid);
 974         if (r < 0) {
 975                 safe_close_pair(s);
 976                 return r;
 977         }
 978         if (r == 0) {
 979                 /* Child */
 980
 981                 if (rearrange_stdio(s[1], s[1], STDERR_FILENO) < 0)
 982                         _exit(EXIT_FAILURE);
 983
 984                 (void) rlimit_nofile_safe();
 985
 986                 if (b->exec_argv)
 987                         execvp(b->exec_path, b->exec_argv);
 988                 else {
 989                         const char *argv[] = { b->exec_path, NULL };
 990                         execvp(b->exec_path, (char**) argv);
 991                 }
 992
 993                 _exit(EXIT_FAILURE);
 994         }
 995
 996         safe_close(s[1]);
 997         b->output_fd = b->input_fd = fd_move_above_stdio(s[0]);
 998
 999         bus_socket_setup(b);
1000
1001         return bus_socket_start_auth(b);
1002 }
1003
1004 int bus_socket_take_fd(sd_bus *b) {
1005         assert(b);
1006
1007         bus_socket_setup(b);
1008
1009         return bus_socket_start_auth(b);
1010 }
1011
1012 int bus_socket_write_message(sd_bus *bus, sd_bus_message *m, size_t *idx) {
1013         struct iovec *iov;
1014         ssize_t k;
1015         size_t n;
1016         unsigned j;
1017         int r;
1018
1019         assert(bus);
1020         assert(m);
1021         assert(idx);
1022         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1023
1024         if (*idx >= BUS_MESSAGE_SIZE(m))
1025                 return 0;
1026
1027         r = bus_message_setup_iovec(m);
1028         if (r < 0)
1029                 return r;
1030
1031         n = m->n_iovec * sizeof(struct iovec);
1032         iov = newa(struct iovec, n);
1033         memcpy_safe(iov, m->iovec, n);
1034
1035         j = 0;
1036         iovec_advance(iov, &j, *idx);
1037
1038         if (bus->prefer_writev)
1039                 k = writev(bus->output_fd, iov, m->n_iovec);
1040         else {
1041                 struct msghdr mh = {
1042                         .msg_iov = iov,
1043                         .msg_iovlen = m->n_iovec,
1044                 };
1045
1046                 if (m->n_fds > 0 && *idx == 0) {
1047                         struct cmsghdr *control;
1048
1049                         mh.msg_controllen = CMSG_SPACE(sizeof(int) * m->n_fds);
1050                         mh.msg_control = alloca0(mh.msg_controllen);
1051                         control = CMSG_FIRSTHDR(&mh);
1052                         control->cmsg_len = CMSG_LEN(sizeof(int) * m->n_fds);
1053                         control->cmsg_level = SOL_SOCKET;
1054                         control->cmsg_type = SCM_RIGHTS;
1055                         memcpy(CMSG_DATA(control), m->fds, sizeof(int) * m->n_fds);
1056                 }
1057
1058                 k = sendmsg(bus->output_fd, &mh, MSG_DONTWAIT|MSG_NOSIGNAL);
1059                 if (k < 0 && errno == ENOTSOCK) {
1060                         bus->prefer_writev = true;
1061                         k = writev(bus->output_fd, iov, m->n_iovec);
1062                 }
1063         }
1064
1065         if (k < 0)
1066                 return errno == EAGAIN ? 0 : -errno;
1067
1068         *idx += (size_t) k;
1069         return 1;
1070 }
1071
1072 static int bus_socket_read_message_need(sd_bus *bus, size_t *need) {
1073         uint32_t a, b;
1074         uint8_t e;
1075         uint64_t sum;
1076
1077         assert(bus);
1078         assert(need);
1079         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1080
1081         if (bus->rbuffer_size < sizeof(struct bus_header)) {
1082                 *need = sizeof(struct bus_header) + 8;
1083
1084                 /* Minimum message size:
1085                  *
1086                  * Header +
1087                  *
1088                  *  Method Call: +2 string headers
1089                  *       Signal: +3 string headers
1090                  * Method Error: +1 string headers
1091                  *               +1 uint32 headers
1092                  * Method Reply: +1 uint32 headers
1093                  *
1094                  * A string header is at least 9 bytes
1095                  * A uint32 header is at least 8 bytes
1096                  *
1097                  * Hence the minimum message size of a valid message
1098                  * is header + 8 bytes */
1099
1100                 return 0;
1101         }
1102
1103         a = ((const uint32_t*) bus->rbuffer)[1];
1104         b = ((const uint32_t*) bus->rbuffer)[3];
1105
1106         e = ((const uint8_t*) bus->rbuffer)[0];
1107         if (e == BUS_LITTLE_ENDIAN) {
1108                 a = le32toh(a);
1109                 b = le32toh(b);
1110         } else if (e == BUS_BIG_ENDIAN) {
1111                 a = be32toh(a);
1112                 b = be32toh(b);
1113         } else
1114                 return -EBADMSG;
1115
1116         sum = (uint64_t) sizeof(struct bus_header) + (uint64_t) ALIGN_TO(b, 8) + (uint64_t) a;
1117         if (sum >= BUS_MESSAGE_SIZE_MAX)
1118                 return -ENOBUFS;
1119
1120         *need = (size_t) sum;
1121         return 0;
1122 }
1123
1124 static int bus_socket_make_message(sd_bus *bus, size_t size) {
1125         sd_bus_message *t = NULL;
1126         void *b;
1127         int r;
1128
1129         assert(bus);
1130         assert(bus->rbuffer_size >= size);
1131         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1132
1133         r = bus_rqueue_make_room(bus);
1134         if (r < 0)
1135                 return r;
1136
1137         if (bus->rbuffer_size > size) {
1138                 b = memdup((const uint8_t*) bus->rbuffer + size,
1139                            bus->rbuffer_size - size);
1140                 if (!b)
1141                         return -ENOMEM;
1142         } else
1143                 b = NULL;
1144
1145         r = bus_message_from_malloc(bus,
1146                                     bus->rbuffer, size,
1147                                     bus->fds, bus->n_fds,
1148                                     NULL,
1149                                     &t);
1150         if (r == -EBADMSG) {
1151                 log_debug_errno(r, "Received invalid message from connection %s, dropping.", strna(bus->description));
1152                 free(bus->rbuffer); /* We want to drop current rbuffer and proceed with whatever remains in b */
1153         } else if (r < 0) {
1154                 free(b);
1155                 return r;
1156         }
1157
1158         /* rbuffer ownership was either transferred to t, or we got EBADMSG and dropped it. */
1159         bus->rbuffer = b;
1160         bus->rbuffer_size -= size;
1161
1162         bus->fds = NULL;
1163         bus->n_fds = 0;
1164
1165         if (t) {
1166                 t->read_counter = ++bus->read_counter;
1167                 bus->rqueue[bus->rqueue_size++] = bus_message_ref_queued(t, bus);
1168                 sd_bus_message_unref(t);
1169         }
1170
1171         return 1;
1172 }
1173
1174 int bus_socket_read_message(sd_bus *bus) {
1175         struct msghdr mh;
1176         struct iovec iov = {};
1177         ssize_t k;
1178         size_t need;
1179         int r;
1180         void *b;
1181         CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)) control;
1182         bool handle_cmsg = false;
1183
1184         assert(bus);
1185         assert(IN_SET(bus->state, BUS_RUNNING, BUS_HELLO));
1186
1187         r = bus_socket_read_message_need(bus, &need);
1188         if (r < 0)
1189                 return r;
1190
1191         if (bus->rbuffer_size >= need)
1192                 return bus_socket_make_message(bus, need);
1193
1194         b = realloc(bus->rbuffer, need);
1195         if (!b)
1196                 return -ENOMEM;
1197
1198         bus->rbuffer = b;
1199
1200         iov = IOVEC_MAKE((uint8_t *)bus->rbuffer + bus->rbuffer_size, need - bus->rbuffer_size);
1201
1202         if (bus->prefer_readv) {
1203                 k = readv(bus->input_fd, &iov, 1);
1204                 if (k < 0)
1205                         k = -errno;
1206         } else {
1207                 mh = (struct msghdr) {
1208                         .msg_iov = &iov,
1209                         .msg_iovlen = 1,
1210                         .msg_control = &control,
1211                         .msg_controllen = sizeof(control),
1212                 };
1213
1214                 k = recvmsg_safe(bus->input_fd, &mh, MSG_DONTWAIT|MSG_CMSG_CLOEXEC);
1215                 if (k == -ENOTSOCK) {
1216                         bus->prefer_readv = true;
1217                         k = readv(bus->input_fd, &iov, 1);
1218                         if (k < 0)
1219                                 k = -errno;
1220                 } else
1221                         handle_cmsg = true;
1222         }
1223         if (k == -EAGAIN)
1224                 return 0;
1225         if (k < 0)
1226                 return (int) k;
1227         if (k == 0) {
1228                 if (handle_cmsg)
1229                         cmsg_close_all(&mh); /* On EOF we shouldn't have gotten an fd, but let's make sure */
1230                 return -ECONNRESET;
1231         }
1232
1233         bus->rbuffer_size += k;
1234
1235         if (handle_cmsg) {
1236                 struct cmsghdr *cmsg;
1237
1238                 CMSG_FOREACH(cmsg, &mh)
1239                         if (cmsg->cmsg_level == SOL_SOCKET &&
1240                             cmsg->cmsg_type == SCM_RIGHTS) {
1241                                 int n, *f, i;
1242
1243                                 n = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
1244
1245                                 if (!bus->can_fds) {
1246                                         /* Whut? We received fds but this
1247                                          * isn't actually enabled? Close them,
1248                                          * and fail */
1249
1250                                         close_many((int*) CMSG_DATA(cmsg), n);
1251                                         return -EIO;
1252                                 }
1253
1254                                 f = reallocarray(bus->fds, bus->n_fds + n, sizeof(int));
1255                                 if (!f) {
1256                                         close_many((int*) CMSG_DATA(cmsg), n);
1257                                         return -ENOMEM;
1258                                 }
1259
1260                                 for (i = 0; i < n; i++)
1261                                         f[bus->n_fds++] = fd_move_above_stdio(((int*) CMSG_DATA(cmsg))[i]);
1262                                 bus->fds = f;
1263                         } else
1264                                 log_debug("Got unexpected auxiliary data with level=%d and type=%d",
1265                                           cmsg->cmsg_level, cmsg->cmsg_type);
1266         }
1267
1268         r = bus_socket_read_message_need(bus, &need);
1269         if (r < 0)
1270                 return r;
1271
1272         if (bus->rbuffer_size >= need)
1273                 return bus_socket_make_message(bus, need);
1274
1275         return 1;
1276 }
1277
1278 int bus_socket_process_opening(sd_bus *b) {
1279         int error = 0, events, r;
1280         socklen_t slen = sizeof(error);
1281
1282         assert(b->state == BUS_OPENING);
1283
1284         events = fd_wait_for_event(b->output_fd, POLLOUT, 0);
1285         if (events < 0)
1286                 return events;
1287         if (!(events & (POLLOUT|POLLERR|POLLHUP)))
1288                 return 0;
1289
1290         r = getsockopt(b->output_fd, SOL_SOCKET, SO_ERROR, &error, &slen);
1291         if (r < 0)
1292                 b->last_connect_error = errno;
1293         else if (error != 0)
1294                 b->last_connect_error = error;
1295         else if (events & (POLLERR|POLLHUP))
1296                 b->last_connect_error = ECONNREFUSED;
1297         else
1298                 return bus_socket_start_auth(b);
1299
1300         return bus_next_address(b);
1301 }
1302
1303 int bus_socket_process_authenticating(sd_bus *b) {
1304         int r;
1305
1306         assert(b);
1307         assert(b->state == BUS_AUTHENTICATING);
1308
1309         if (now(CLOCK_MONOTONIC) >= b->auth_timeout)
1310                 return -ETIMEDOUT;
1311
1312         r = bus_socket_write_auth(b);
1313         if (r != 0)
1314                 return r;
1315
1316         return bus_socket_read_auth(b);
1317 }
1318
1319 int bus_socket_process_watch_bind(sd_bus *b) {
1320         int r, q;
1321
1322         assert(b);
1323         assert(b->state == BUS_WATCH_BIND);
1324         assert(b->inotify_fd >= 0);
1325
1326         r = flush_fd(b->inotify_fd);
1327         if (r <= 0)
1328                 return r;
1329
1330         log_debug("Got inotify event on bus %s.", strna(b->description));
1331
1332         /* We flushed events out of the inotify fd. In that case, maybe the socket is valid now? Let's try to connect
1333          * to it again */
1334
1335         r = bus_socket_connect(b);
1336         if (r < 0)
1337                 return r;
1338
1339         q = bus_attach_io_events(b);
1340         if (q < 0)
1341                 return q;
1342
1343         q = bus_attach_inotify_event(b);
1344         if (q < 0)
1345                 return q;
1346
1347         return r;
1348 }