Fix 32-bit overflow in parallels image support
[qemu-kvm/fedora.git] / nbd.c
blob337eeba87350b302a936751388982c3c983e7b68
1 /*
2 * Copyright (C) 2005 Anthony Liguori <anthony@codemonkey.ws>
4 * Network Block Device
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; under version 2 of the License.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 #include "nbd.h"
21 #include <errno.h>
22 #include <string.h>
23 #ifndef _WIN32
24 #include <sys/ioctl.h>
25 #endif
26 #ifdef __sun__
27 #include <sys/ioccom.h>
28 #endif
29 #include <ctype.h>
30 #include <inttypes.h>
32 #include "qemu_socket.h"
34 //#define DEBUG_NBD
36 #ifdef DEBUG_NBD
37 #define TRACE(msg, ...) do { \
38 LOG(msg, ## __VA_ARGS__); \
39 } while(0)
40 #else
41 #define TRACE(msg, ...) \
42 do { } while (0)
43 #endif
45 #define LOG(msg, ...) do { \
46 fprintf(stderr, "%s:%s():L%d: " msg "\n", \
47 __FILE__, __FUNCTION__, __LINE__, ## __VA_ARGS__); \
48 } while(0)
50 /* This is all part of the "official" NBD API */
52 #define NBD_REQUEST_MAGIC 0x25609513
53 #define NBD_REPLY_MAGIC 0x67446698
55 #define NBD_SET_SOCK _IO(0xab, 0)
56 #define NBD_SET_BLKSIZE _IO(0xab, 1)
57 #define NBD_SET_SIZE _IO(0xab, 2)
58 #define NBD_DO_IT _IO(0xab, 3)
59 #define NBD_CLEAR_SOCK _IO(0xab, 4)
60 #define NBD_CLEAR_QUE _IO(0xab, 5)
61 #define NBD_PRINT_DEBUG _IO(0xab, 6)
62 #define NBD_SET_SIZE_BLOCKS _IO(0xab, 7)
63 #define NBD_DISCONNECT _IO(0xab, 8)
65 /* That's all folks */
67 #define read_sync(fd, buffer, size) nbd_wr_sync(fd, buffer, size, true)
68 #define write_sync(fd, buffer, size) nbd_wr_sync(fd, buffer, size, false)
70 size_t nbd_wr_sync(int fd, void *buffer, size_t size, bool do_read)
72 size_t offset = 0;
74 while (offset < size) {
75 ssize_t len;
77 if (do_read) {
78 len = recv(fd, buffer + offset, size - offset, 0);
79 } else {
80 len = send(fd, buffer + offset, size - offset, 0);
83 if (len == -1)
84 errno = socket_error();
86 /* recoverable error */
87 if (len == -1 && (errno == EAGAIN || errno == EINTR)) {
88 continue;
91 /* eof */
92 if (len == 0) {
93 break;
96 /* unrecoverable error */
97 if (len == -1) {
98 return 0;
101 offset += len;
104 return offset;
107 int tcp_socket_outgoing(const char *address, uint16_t port)
109 int s;
110 struct in_addr in;
111 struct sockaddr_in addr;
113 s = socket(PF_INET, SOCK_STREAM, 0);
114 if (s == -1) {
115 return -1;
118 if (inet_aton(address, &in) == 0) {
119 struct hostent *ent;
121 ent = gethostbyname(address);
122 if (ent == NULL) {
123 goto error;
126 memcpy(&in, ent->h_addr, sizeof(in));
129 addr.sin_family = AF_INET;
130 addr.sin_port = htons(port);
131 memcpy(&addr.sin_addr.s_addr, &in, sizeof(in));
133 if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
134 goto error;
137 return s;
138 error:
139 closesocket(s);
140 return -1;
143 int tcp_socket_incoming(const char *address, uint16_t port)
145 int s;
146 struct in_addr in;
147 struct sockaddr_in addr;
148 int opt;
150 s = socket(PF_INET, SOCK_STREAM, 0);
151 if (s == -1) {
152 return -1;
155 if (inet_aton(address, &in) == 0) {
156 struct hostent *ent;
158 ent = gethostbyname(address);
159 if (ent == NULL) {
160 goto error;
163 memcpy(&in, ent->h_addr, sizeof(in));
166 addr.sin_family = AF_INET;
167 addr.sin_port = htons(port);
168 memcpy(&addr.sin_addr.s_addr, &in, sizeof(in));
170 opt = 1;
171 if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
172 (const void *) &opt, sizeof(opt)) == -1) {
173 goto error;
176 if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
177 goto error;
180 if (listen(s, 128) == -1) {
181 goto error;
184 return s;
185 error:
186 closesocket(s);
187 return -1;
190 #ifndef _WIN32
191 int unix_socket_incoming(const char *path)
193 int s;
194 struct sockaddr_un addr;
196 s = socket(PF_UNIX, SOCK_STREAM, 0);
197 if (s == -1) {
198 return -1;
201 memset(&addr, 0, sizeof(addr));
202 addr.sun_family = AF_UNIX;
203 pstrcpy(addr.sun_path, sizeof(addr.sun_path), path);
205 if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
206 goto error;
209 if (listen(s, 128) == -1) {
210 goto error;
213 return s;
214 error:
215 closesocket(s);
216 return -1;
219 int unix_socket_outgoing(const char *path)
221 int s;
222 struct sockaddr_un addr;
224 s = socket(PF_UNIX, SOCK_STREAM, 0);
225 if (s == -1) {
226 return -1;
229 memset(&addr, 0, sizeof(addr));
230 addr.sun_family = AF_UNIX;
231 pstrcpy(addr.sun_path, sizeof(addr.sun_path), path);
233 if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
234 goto error;
237 return s;
238 error:
239 closesocket(s);
240 return -1;
242 #else
243 int unix_socket_incoming(const char *path)
245 errno = ENOTSUP;
246 return -1;
249 int unix_socket_outgoing(const char *path)
251 errno = ENOTSUP;
252 return -1;
254 #endif
257 /* Basic flow
259 Server Client
261 Negotiate
262 Request
263 Response
264 Request
265 Response
268 Request (type == 2)
271 int nbd_negotiate(int csock, off_t size)
273 char buf[8 + 8 + 8 + 128];
275 /* Negotiate
276 [ 0 .. 7] passwd ("NBDMAGIC")
277 [ 8 .. 15] magic (0x00420281861253)
278 [16 .. 23] size
279 [24 .. 151] reserved (0)
282 TRACE("Beginning negotiation.");
283 memcpy(buf, "NBDMAGIC", 8);
284 cpu_to_be64w((uint64_t*)(buf + 8), 0x00420281861253LL);
285 cpu_to_be64w((uint64_t*)(buf + 16), size);
286 memset(buf + 24, 0, 128);
288 if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
289 LOG("write failed");
290 errno = EINVAL;
291 return -1;
294 TRACE("Negotation succeeded.");
296 return 0;
299 int nbd_receive_negotiate(int csock, off_t *size, size_t *blocksize)
301 char buf[8 + 8 + 8 + 128];
302 uint64_t magic;
304 TRACE("Receiving negotation.");
306 if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
307 LOG("read failed");
308 errno = EINVAL;
309 return -1;
312 magic = be64_to_cpup((uint64_t*)(buf + 8));
313 *size = be64_to_cpup((uint64_t*)(buf + 16));
314 *blocksize = 1024;
316 TRACE("Magic is %c%c%c%c%c%c%c%c",
317 qemu_isprint(buf[0]) ? buf[0] : '.',
318 qemu_isprint(buf[1]) ? buf[1] : '.',
319 qemu_isprint(buf[2]) ? buf[2] : '.',
320 qemu_isprint(buf[3]) ? buf[3] : '.',
321 qemu_isprint(buf[4]) ? buf[4] : '.',
322 qemu_isprint(buf[5]) ? buf[5] : '.',
323 qemu_isprint(buf[6]) ? buf[6] : '.',
324 qemu_isprint(buf[7]) ? buf[7] : '.');
325 TRACE("Magic is 0x%" PRIx64, magic);
326 TRACE("Size is %" PRIu64, *size);
328 if (memcmp(buf, "NBDMAGIC", 8) != 0) {
329 LOG("Invalid magic received");
330 errno = EINVAL;
331 return -1;
334 TRACE("Checking magic");
336 if (magic != 0x00420281861253LL) {
337 LOG("Bad magic received");
338 errno = EINVAL;
339 return -1;
341 return 0;
344 #ifndef _WIN32
345 int nbd_init(int fd, int csock, off_t size, size_t blocksize)
347 TRACE("Setting block size to %lu", (unsigned long)blocksize);
349 if (ioctl(fd, NBD_SET_BLKSIZE, blocksize) == -1) {
350 int serrno = errno;
351 LOG("Failed setting NBD block size");
352 errno = serrno;
353 return -1;
356 TRACE("Setting size to %llu block(s)",
357 (unsigned long long)(size / blocksize));
359 if (ioctl(fd, NBD_SET_SIZE_BLOCKS, size / blocksize) == -1) {
360 int serrno = errno;
361 LOG("Failed setting size (in blocks)");
362 errno = serrno;
363 return -1;
366 TRACE("Clearing NBD socket");
368 if (ioctl(fd, NBD_CLEAR_SOCK) == -1) {
369 int serrno = errno;
370 LOG("Failed clearing NBD socket");
371 errno = serrno;
372 return -1;
375 TRACE("Setting NBD socket");
377 if (ioctl(fd, NBD_SET_SOCK, csock) == -1) {
378 int serrno = errno;
379 LOG("Failed to set NBD socket");
380 errno = serrno;
381 return -1;
384 TRACE("Negotiation ended");
386 return 0;
389 int nbd_disconnect(int fd)
391 ioctl(fd, NBD_CLEAR_QUE);
392 ioctl(fd, NBD_DISCONNECT);
393 ioctl(fd, NBD_CLEAR_SOCK);
394 return 0;
397 int nbd_client(int fd, int csock)
399 int ret;
400 int serrno;
402 TRACE("Doing NBD loop");
404 ret = ioctl(fd, NBD_DO_IT);
405 serrno = errno;
407 TRACE("NBD loop returned %d: %s", ret, strerror(serrno));
409 TRACE("Clearing NBD queue");
410 ioctl(fd, NBD_CLEAR_QUE);
412 TRACE("Clearing NBD socket");
413 ioctl(fd, NBD_CLEAR_SOCK);
415 errno = serrno;
416 return ret;
418 #else
419 int nbd_init(int fd, int csock, off_t size, size_t blocksize)
421 errno = ENOTSUP;
422 return -1;
425 int nbd_disconnect(int fd)
427 errno = ENOTSUP;
428 return -1;
431 int nbd_client(int fd, int csock)
433 errno = ENOTSUP;
434 return -1;
436 #endif
438 int nbd_send_request(int csock, struct nbd_request *request)
440 uint8_t buf[4 + 4 + 8 + 8 + 4];
442 cpu_to_be32w((uint32_t*)buf, NBD_REQUEST_MAGIC);
443 cpu_to_be32w((uint32_t*)(buf + 4), request->type);
444 cpu_to_be64w((uint64_t*)(buf + 8), request->handle);
445 cpu_to_be64w((uint64_t*)(buf + 16), request->from);
446 cpu_to_be32w((uint32_t*)(buf + 24), request->len);
448 TRACE("Sending request to client");
450 if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
451 LOG("writing to socket failed");
452 errno = EINVAL;
453 return -1;
455 return 0;
459 static int nbd_receive_request(int csock, struct nbd_request *request)
461 uint8_t buf[4 + 4 + 8 + 8 + 4];
462 uint32_t magic;
464 if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
465 LOG("read failed");
466 errno = EINVAL;
467 return -1;
470 /* Request
471 [ 0 .. 3] magic (NBD_REQUEST_MAGIC)
472 [ 4 .. 7] type (0 == READ, 1 == WRITE)
473 [ 8 .. 15] handle
474 [16 .. 23] from
475 [24 .. 27] len
478 magic = be32_to_cpup((uint32_t*)buf);
479 request->type = be32_to_cpup((uint32_t*)(buf + 4));
480 request->handle = be64_to_cpup((uint64_t*)(buf + 8));
481 request->from = be64_to_cpup((uint64_t*)(buf + 16));
482 request->len = be32_to_cpup((uint32_t*)(buf + 24));
484 TRACE("Got request: "
485 "{ magic = 0x%x, .type = %d, from = %" PRIu64" , len = %u }",
486 magic, request->type, request->from, request->len);
488 if (magic != NBD_REQUEST_MAGIC) {
489 LOG("invalid magic (got 0x%x)", magic);
490 errno = EINVAL;
491 return -1;
493 return 0;
496 int nbd_receive_reply(int csock, struct nbd_reply *reply)
498 uint8_t buf[4 + 4 + 8];
499 uint32_t magic;
501 memset(buf, 0xAA, sizeof(buf));
503 if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
504 LOG("read failed");
505 errno = EINVAL;
506 return -1;
509 /* Reply
510 [ 0 .. 3] magic (NBD_REPLY_MAGIC)
511 [ 4 .. 7] error (0 == no error)
512 [ 7 .. 15] handle
515 magic = be32_to_cpup((uint32_t*)buf);
516 reply->error = be32_to_cpup((uint32_t*)(buf + 4));
517 reply->handle = be64_to_cpup((uint64_t*)(buf + 8));
519 TRACE("Got reply: "
520 "{ magic = 0x%x, .error = %d, handle = %" PRIu64" }",
521 magic, reply->error, reply->handle);
523 if (magic != NBD_REPLY_MAGIC) {
524 LOG("invalid magic (got 0x%x)", magic);
525 errno = EINVAL;
526 return -1;
528 return 0;
531 static int nbd_send_reply(int csock, struct nbd_reply *reply)
533 uint8_t buf[4 + 4 + 8];
535 /* Reply
536 [ 0 .. 3] magic (NBD_REPLY_MAGIC)
537 [ 4 .. 7] error (0 == no error)
538 [ 7 .. 15] handle
540 cpu_to_be32w((uint32_t*)buf, NBD_REPLY_MAGIC);
541 cpu_to_be32w((uint32_t*)(buf + 4), reply->error);
542 cpu_to_be64w((uint64_t*)(buf + 8), reply->handle);
544 TRACE("Sending response to client");
546 if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {
547 LOG("writing to socket failed");
548 errno = EINVAL;
549 return -1;
551 return 0;
554 int nbd_trip(BlockDriverState *bs, int csock, off_t size, uint64_t dev_offset,
555 off_t *offset, bool readonly, uint8_t *data, int data_size)
557 struct nbd_request request;
558 struct nbd_reply reply;
560 TRACE("Reading request.");
562 if (nbd_receive_request(csock, &request) == -1)
563 return -1;
565 if (request.len > data_size) {
566 LOG("len (%u) is larger than max len (%u)",
567 request.len, data_size);
568 errno = EINVAL;
569 return -1;
572 if ((request.from + request.len) < request.from) {
573 LOG("integer overflow detected! "
574 "you're probably being attacked");
575 errno = EINVAL;
576 return -1;
579 if ((request.from + request.len) > size) {
580 LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64
581 ", Offset: %" PRIu64 "\n",
582 request.from, request.len, (uint64_t)size, dev_offset);
583 LOG("requested operation past EOF--bad client?");
584 errno = EINVAL;
585 return -1;
588 TRACE("Decoding type");
590 reply.handle = request.handle;
591 reply.error = 0;
593 switch (request.type) {
594 case NBD_CMD_READ:
595 TRACE("Request type is READ");
597 if (bdrv_read(bs, (request.from + dev_offset) / 512, data,
598 request.len / 512) == -1) {
599 LOG("reading from file failed");
600 errno = EINVAL;
601 return -1;
603 *offset += request.len;
605 TRACE("Read %u byte(s)", request.len);
607 if (nbd_send_reply(csock, &reply) == -1)
608 return -1;
610 TRACE("Sending data to client");
612 if (write_sync(csock, data, request.len) != request.len) {
613 LOG("writing to socket failed");
614 errno = EINVAL;
615 return -1;
617 break;
618 case NBD_CMD_WRITE:
619 TRACE("Request type is WRITE");
621 TRACE("Reading %u byte(s)", request.len);
623 if (read_sync(csock, data, request.len) != request.len) {
624 LOG("reading from socket failed");
625 errno = EINVAL;
626 return -1;
629 if (readonly) {
630 TRACE("Server is read-only, return error");
631 reply.error = 1;
632 } else {
633 TRACE("Writing to device");
635 if (bdrv_write(bs, (request.from + dev_offset) / 512,
636 data, request.len / 512) == -1) {
637 LOG("writing to file failed");
638 errno = EINVAL;
639 return -1;
642 *offset += request.len;
645 if (nbd_send_reply(csock, &reply) == -1)
646 return -1;
647 break;
648 case NBD_CMD_DISC:
649 TRACE("Request type is DISCONNECT");
650 errno = 0;
651 return 1;
652 default:
653 LOG("invalid request type (%u) received", request.type);
654 errno = EINVAL;
655 return -1;
658 TRACE("Request/Reply complete");
660 return 0;