| 1 |
/*----------------------------------------------------------------------* |
| 2 |
* File: fdpass.C |
| 3 |
*----------------------------------------------------------------------* |
| 4 |
* |
| 5 |
* All portions of code are copyright by their respective author/s. |
| 6 |
* Copyright (c) 2005-2006,2012 Marc Lehmann <schmorp@schmorp.de> |
| 7 |
* |
| 8 |
* This program is free software; you can redistribute it and/or modify |
| 9 |
* it under the terms of the GNU General Public License as published by |
| 10 |
* the Free Software Foundation; either version 2 of the License, or |
| 11 |
* (at your option) any later version. |
| 12 |
* |
| 13 |
* This program is distributed in the hope that it will be useful, |
| 14 |
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 15 |
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 16 |
* GNU General Public License for more details. |
| 17 |
* |
| 18 |
* You should have received a copy of the GNU General Public License |
| 19 |
* along with this program; if not, write to the Free Software |
| 20 |
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. |
| 21 |
*----------------------------------------------------------------------*/ |
| 22 |
|
| 23 |
#include "config.h" |
| 24 |
|
| 25 |
#include <stddef.h> // needed by broken bsds for NULL used in sys/uio.h |
| 26 |
#include <stdlib.h> |
| 27 |
|
| 28 |
#include <unistd.h> |
| 29 |
#include <sys/types.h> |
| 30 |
#include <sys/uio.h> |
| 31 |
#include <sys/socket.h> |
| 32 |
|
| 33 |
#include "libptytty.h" |
| 34 |
|
| 35 |
// CMSG_SPACE & CMSG_LEN are rfc2292 extensions to unix |
| 36 |
#ifndef CMSG_SPACE |
| 37 |
# define CMSG_SPACE(len) (sizeof (cmsghdr) + len) |
| 38 |
#endif |
| 39 |
|
| 40 |
#ifndef CMSG_LEN |
| 41 |
# define CMSG_LEN(len) (sizeof (cmsghdr) + len) |
| 42 |
#endif |
| 43 |
|
| 44 |
bool |
| 45 |
ptytty::send_fd (int socket, int fd) |
| 46 |
{ |
| 47 |
void *buf = malloc (CMSG_SPACE (sizeof (int))); |
| 48 |
|
| 49 |
if (!buf) |
| 50 |
return 0; |
| 51 |
|
| 52 |
msghdr msg; |
| 53 |
iovec iov; |
| 54 |
cmsghdr *cmsg; |
| 55 |
char data = 0; |
| 56 |
|
| 57 |
iov.iov_base = &data; |
| 58 |
iov.iov_len = 1; |
| 59 |
|
| 60 |
msg.msg_name = 0; |
| 61 |
msg.msg_namelen = 0; |
| 62 |
msg.msg_iov = &iov; |
| 63 |
msg.msg_iovlen = 1; |
| 64 |
msg.msg_control = buf; |
| 65 |
msg.msg_controllen = CMSG_SPACE (sizeof (int)); |
| 66 |
|
| 67 |
cmsg = CMSG_FIRSTHDR (&msg); |
| 68 |
cmsg->cmsg_level = SOL_SOCKET; |
| 69 |
cmsg->cmsg_type = SCM_RIGHTS; |
| 70 |
cmsg->cmsg_len = CMSG_LEN (sizeof (int)); |
| 71 |
|
| 72 |
*(int *)CMSG_DATA (cmsg) = fd; |
| 73 |
|
| 74 |
ssize_t result = sendmsg (socket, &msg, 0); |
| 75 |
|
| 76 |
free (buf); |
| 77 |
|
| 78 |
return result >= 0; |
| 79 |
} |
| 80 |
|
| 81 |
int |
| 82 |
ptytty::recv_fd (int socket) |
| 83 |
{ |
| 84 |
void *buf = malloc (CMSG_SPACE (sizeof (int))); |
| 85 |
|
| 86 |
if (!buf) |
| 87 |
return -1; |
| 88 |
|
| 89 |
msghdr msg; |
| 90 |
iovec iov; |
| 91 |
char data = 1; |
| 92 |
|
| 93 |
iov.iov_base = &data; |
| 94 |
iov.iov_len = 1; |
| 95 |
|
| 96 |
msg.msg_name = 0; |
| 97 |
msg.msg_namelen = 0; |
| 98 |
msg.msg_iov = &iov; |
| 99 |
msg.msg_iovlen = 1; |
| 100 |
msg.msg_control = buf; |
| 101 |
msg.msg_controllen = CMSG_SPACE (sizeof (int)); |
| 102 |
|
| 103 |
int fd = -1; |
| 104 |
|
| 105 |
if (recvmsg (socket, &msg, 0) > 0) |
| 106 |
{ |
| 107 |
// there *should* be at most one cmsg, as more should not fit |
| 108 |
// in the buffer, although this depends on somewhat sane |
| 109 |
// alignment imposed by CMSG_SPACE. |
| 110 |
cmsghdr *cmsg = CMSG_FIRSTHDR (&msg); |
| 111 |
|
| 112 |
if (cmsg) |
| 113 |
{ |
| 114 |
// some operating systems (i.e. osx) allow msg->cmsg_len to be larger than |
| 115 |
// msg.msg_controllen, so limit the size here |
| 116 |
if (cmsg->cmsg_len > CMSG_SPACE (sizeof (int))) |
| 117 |
cmsg->cmsg_len = CMSG_SPACE (sizeof (int)); |
| 118 |
|
| 119 |
if ( cmsg->cmsg_level == SOL_SOCKET |
| 120 |
&& cmsg->cmsg_type == SCM_RIGHTS |
| 121 |
&& cmsg->cmsg_len >= CMSG_LEN (sizeof (int))) |
| 122 |
{ |
| 123 |
// close any extra fds that might have been passed. |
| 124 |
// this does not work around osx/freebsd bugs where a malicious sender |
| 125 |
// can send us more fds than we can receive, leaking the extra fds, |
| 126 |
// which must be fixed in the kernel, really. |
| 127 |
for (fd = 1; cmsg->cmsg_len >= CMSG_LEN (sizeof (int) * (fd + 1)); ++fd) |
| 128 |
close (((int *)CMSG_DATA (cmsg))[fd]); |
| 129 |
|
| 130 |
// we are only interested in the first fd |
| 131 |
fd = *(int *)CMSG_DATA (cmsg); |
| 132 |
} |
| 133 |
} |
| 134 |
} |
| 135 |
|
| 136 |
free (buf); |
| 137 |
|
| 138 |
if (data != 0) |
| 139 |
{ |
| 140 |
close (fd); |
| 141 |
fd = -1; |
| 142 |
} |
| 143 |
|
| 144 |
return fd; |
| 145 |
} |
| 146 |
|
