nscd/nscd_helper.c

   1 /* Copyright (C) 1998-2007, 2008, 2009 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, write to the Free
  17    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  18    02111-1307 USA.  */
  19
  20 #include <assert.h>
  21 #include <errno.h>
  22 #include <fcntl.h>
  23 #include <stdbool.h>
  24 #include <stddef.h>
  25 #include <string.h>
  26 #include <time.h>
  27 #include <unistd.h>
  28 #include <sys/mman.h>
  29 #include <sys/poll.h>
  30 #include <sys/socket.h>
  31 #include <sys/stat.h>
  32 #include <sys/time.h>
  33 #include <sys/uio.h>
  34 #include <sys/un.h>
  35 #include <not-cancel.h>
  36 #include <nis/rpcsvc/nis.h>
  37 #include <kernel-features.h>
  38
  39 #include "nscd-client.h"
  40
  41
  42 /* Extra time we wait if the socket is still receiving data.  This
  43    value is in milliseconds.  Note that the other side is nscd on the
  44    local machine and it is already transmitting data.  So the wait
  45    time need not be long.  */
  46 #define EXTRA_RECEIVE_TIME 200
  47
  48
  49 static int
  50 wait_on_socket (int sock, long int usectmo)
  51 {
  52   struct pollfd fds[1];
  53   fds[0].fd = sock;
  54   fds[0].events = POLLIN | POLLERR | POLLHUP;
  55   int n = __poll (fds, 1, usectmo);
  56   if (n == -1 && __builtin_expect (errno == EINTR, 0))
  57     {
  58       /* Handle the case where the poll() call is interrupted by a
  59          signal.  We cannot just use TEMP_FAILURE_RETRY since it might
  60          lead to infinite loops.  */
  61       struct timeval now;
  62       (void) __gettimeofday (&now, NULL);
  63       long int end = now.tv_sec * 1000 + usectmo + (now.tv_usec + 500) / 1000;
  64       long int timeout = usectmo;
  65       while (1)
  66         {
  67           n = __poll (fds, 1, timeout);
  68           if (n != -1 || errno != EINTR)
  69             break;
  70
  71           /* Recompute the timeout time.  */
  72           (void) __gettimeofday (&now, NULL);
  73           timeout = end - (now.tv_sec * 1000 + (now.tv_usec + 500) / 1000);
  74         }
  75     }
  76
  77   return n;
  78 }
  79
  80
  81 ssize_t
  82 __readall (int fd, void *buf, size_t len)
  83 {
  84   size_t n = len;
  85   ssize_t ret;
  86   do
  87     {
  88     again:
  89       ret = TEMP_FAILURE_RETRY (__read (fd, buf, n));
  90       if (ret <= 0)
  91         {
  92           if (__builtin_expect (ret < 0 && errno == EAGAIN, 0)
  93               /* The socket is still receiving data.  Wait a bit more.  */
  94               && wait_on_socket (fd, EXTRA_RECEIVE_TIME) > 0)
  95             goto again;
  96
  97           break;
  98         }
  99       buf = (char *) buf + ret;
 100       n -= ret;
 101     }
 102   while (n > 0);
 103   return ret < 0 ? ret : len - n;
 104 }
 105
 106
 107 ssize_t
 108 __readvall (int fd, const struct iovec *iov, int iovcnt)
 109 {
 110   ssize_t ret = TEMP_FAILURE_RETRY (__readv (fd, iov, iovcnt));
 111   if (ret <= 0)
 112     {
 113       if (__builtin_expect (ret == 0 || errno != EAGAIN, 1))
 114         /* A genuine error or no data to read.  */
 115         return ret;
 116
 117       /* The data has not all yet been received.  Do as if we have not
 118          read anything yet.  */
 119       ret = 0;
 120     }
 121
 122   size_t total = 0;
 123   for (int i = 0; i < iovcnt; ++i)
 124     total += iov[i].iov_len;
 125
 126   if (ret < total)
 127     {
 128       struct iovec iov_buf[iovcnt];
 129       ssize_t r = ret;
 130
 131       struct iovec *iovp = memcpy (iov_buf, iov, iovcnt * sizeof (*iov));
 132       do
 133         {
 134           while (iovp->iov_len <= r)
 135             {
 136               r -= iovp->iov_len;
 137               --iovcnt;
 138               ++iovp;
 139             }
 140           iovp->iov_base = (char *) iovp->iov_base + r;
 141           iovp->iov_len -= r;
 142         again:
 143           r = TEMP_FAILURE_RETRY (__readv (fd, iovp, iovcnt));
 144           if (r <= 0)
 145             {
 146               if (__builtin_expect (r < 0 && errno == EAGAIN, 0)
 147                   /* The socket is still receiving data.  Wait a bit more.  */
 148                   && wait_on_socket (fd, EXTRA_RECEIVE_TIME) > 0)
 149                 goto again;
 150
 151               break;
 152             }
 153           ret += r;
 154         }
 155       while (ret < total);
 156       if (r < 0)
 157         ret = r;
 158     }
 159   return ret;
 160 }
 161
 162
 163 static int
 164 open_socket (request_type type, const char *key, size_t keylen)
 165 {
 166   int sock;
 167
 168 #ifdef SOCK_CLOEXEC
 169 # ifndef __ASSUME_SOCK_CLOEXEC
 170   if (__have_sock_cloexec >= 0)
 171 # endif
 172     {
 173       sock = __socket (PF_UNIX, SOCK_STREAM | SOCK_CLOEXEC | SOCK_NONBLOCK, 0);
 174 # ifndef __ASSUME_SOCK_CLOEXEC
 175       if (__have_sock_cloexec == 0)
 176         __have_sock_cloexec = sock != -1 || errno != EINVAL ? 1 : -1;
 177 # endif
 178     }
 179 #endif
 180 #ifndef __ASSUME_SOCK_CLOEXEC
 181 # ifdef SOCK_CLOEXEC
 182   if (__have_sock_cloexec < 0)
 183 # endif
 184     sock = __socket (PF_UNIX, SOCK_STREAM, 0);
 185 #endif
 186   if (sock < 0)
 187     return -1;
 188
 189   struct
 190   {
 191     request_header req;
 192     char key[keylen];
 193   } reqdata;
 194   size_t real_sizeof_reqdata = sizeof (request_header) + keylen;
 195
 196 #ifndef __ASSUME_SOCK_CLOEXEC
 197 # ifdef SOCK_NONBLOCK
 198   if (__have_sock_cloexec < 0)
 199 # endif
 200     /* Make socket non-blocking.  */
 201     __fcntl (sock, F_SETFL, O_RDWR | O_NONBLOCK);
 202 #endif
 203
 204   struct sockaddr_un sun;
 205   sun.sun_family = AF_UNIX;
 206   strcpy (sun.sun_path, _PATH_NSCDSOCKET);
 207   if (__connect (sock, (struct sockaddr *) &sun, sizeof (sun)) < 0
 208       && errno != EINPROGRESS)
 209     goto out;
 210
 211   reqdata.req.version = NSCD_VERSION;
 212   reqdata.req.type = type;
 213   reqdata.req.key_len = keylen;
 214
 215   memcpy (reqdata.key, key, keylen);
 216
 217   bool first_try = true;
 218   struct timeval tvend;
 219   /* Fake initializing tvend.  */
 220   asm ("" : "=m" (tvend));
 221   while (1)
 222     {
 223 #ifndef MSG_NOSIGNAL
 224 # define MSG_NOSIGNAL 0
 225 #endif
 226       ssize_t wres = TEMP_FAILURE_RETRY (__send (sock, &reqdata,
 227                                                  real_sizeof_reqdata,
 228                                                  MSG_NOSIGNAL));
 229       if (__builtin_expect (wres == (ssize_t) real_sizeof_reqdata, 1))
 230         /* We managed to send the request.  */
 231         return sock;
 232
 233       if (wres != -1 || errno != EAGAIN)
 234         /* Something is really wrong, no chance to continue.  */
 235         break;
 236
 237       /* The daemon is busy wait for it.  */
 238       int to;
 239       struct timeval now;
 240       (void) __gettimeofday (&now, NULL);
 241       if (first_try)
 242         {
 243           tvend.tv_usec = now.tv_usec;
 244           tvend.tv_sec = now.tv_sec + 5;
 245           to = 5 * 1000;
 246           first_try = false;
 247         }
 248       else
 249         to = ((tvend.tv_sec - now.tv_sec) * 1000
 250               + (tvend.tv_usec - now.tv_usec) / 1000);
 251
 252       struct pollfd fds[1];
 253       fds[0].fd = sock;
 254       fds[0].events = POLLOUT | POLLERR | POLLHUP;
 255       if (__poll (fds, 1, to) <= 0)
 256         /* The connection timed out or broke down.  */
 257         break;
 258
 259       /* We try to write again.  */
 260     }
 261
 262  out:
 263   close_not_cancel_no_status (sock);
 264
 265   return -1;
 266 }
 267
 268
 269 void
 270 __nscd_unmap (struct mapped_database *mapped)
 271 {
 272   assert (mapped->counter == 0);
 273   __munmap ((void *) mapped->head, mapped->mapsize);
 274   free (mapped);
 275 }
 276
 277
 278 /* Try to get a file descriptor for the shared meory segment
 279    containing the database.  */
 280 static struct mapped_database *
 281 get_mapping (request_type type, const char *key,
 282              struct mapped_database **mappedp)
 283 {
 284   struct mapped_database *result = NO_MAPPING;
 285 #ifdef SCM_RIGHTS
 286   const size_t keylen = strlen (key) + 1;
 287   int saved_errno = errno;
 288
 289   int mapfd = -1;
 290   char resdata[keylen];
 291
 292   /* Open a socket and send the request.  */
 293   int sock = open_socket (type, key, keylen);
 294   if (sock < 0)
 295     goto out;
 296
 297   /* Room for the data sent along with the file descriptor.  We expect
 298      the key name back.  */
 299   uint64_t mapsize;
 300   struct iovec iov[2];
 301   iov[0].iov_base = resdata;
 302   iov[0].iov_len = keylen;
 303   iov[1].iov_base = &mapsize;
 304   iov[1].iov_len = sizeof (mapsize);
 305
 306   union
 307   {
 308     struct cmsghdr hdr;
 309     char bytes[CMSG_SPACE (sizeof (int))];
 310   } buf;
 311   struct msghdr msg = { .msg_iov = iov, .msg_iovlen = 2,
 312                         .msg_control = buf.bytes,
 313                         .msg_controllen = sizeof (buf) };
 314   struct cmsghdr *cmsg = CMSG_FIRSTHDR (&msg);
 315
 316   cmsg->cmsg_level = SOL_SOCKET;
 317   cmsg->cmsg_type = SCM_RIGHTS;
 318   cmsg->cmsg_len = CMSG_LEN (sizeof (int));
 319
 320   /* This access is well-aligned since BUF is correctly aligned for an
 321      int and CMSG_DATA preserves this alignment.  */
 322   memset (CMSG_DATA (cmsg), '\xff', sizeof (int));
 323
 324   msg.msg_controllen = cmsg->cmsg_len;
 325
 326   if (wait_on_socket (sock, 5 * 1000) <= 0)
 327     goto out_close2;
 328
 329 # ifndef MSG_CMSG_CLOEXEC
 330 #  define MSG_CMSG_CLOEXEC 0
 331 # endif
 332   ssize_t n = TEMP_FAILURE_RETRY (__recvmsg (sock, &msg, MSG_CMSG_CLOEXEC));
 333
 334   if (__builtin_expect (CMSG_FIRSTHDR (&msg) == NULL
 335                         || (CMSG_FIRSTHDR (&msg)->cmsg_len
 336                             != CMSG_LEN (sizeof (int))), 0))
 337     goto out_close2;
 338
 339   int *ip = (void *) CMSG_DATA (cmsg);
 340   mapfd = *ip;
 341
 342   if (__builtin_expect (n != keylen && n != keylen + sizeof (mapsize), 0))
 343     goto out_close;
 344
 345   if (__builtin_expect (strcmp (resdata, key) != 0, 0))
 346     goto out_close;
 347
 348   if (__builtin_expect (n == keylen, 0))
 349     {
 350       struct stat64 st;
 351       if (__builtin_expect (fstat64 (mapfd, &st) != 0, 0)
 352           || __builtin_expect (st.st_size < sizeof (struct database_pers_head),
 353                                0))
 354         goto out_close;
 355
 356       mapsize = st.st_size;
 357     }
 358
 359   /* The file is large enough, map it now.  */
 360   void *mapping = __mmap (NULL, mapsize, PROT_READ, MAP_SHARED, mapfd, 0);
 361   if (__builtin_expect (mapping != MAP_FAILED, 1))
 362     {
 363       /* Check whether the database is correct and up-to-date.  */
 364       struct database_pers_head *head = mapping;
 365
 366       if (__builtin_expect (head->version != DB_VERSION, 0)
 367           || __builtin_expect (head->header_size != sizeof (*head), 0)
 368           /* Catch some misconfiguration.  The server should catch
 369              them now but some older versions did not.  */
 370           || __builtin_expect (head->module == 0, 0)
 371           /* This really should not happen but who knows, maybe the update
 372              thread got stuck.  */
 373           || __builtin_expect (! head->nscd_certainly_running
 374                                && (head->timestamp + MAPPING_TIMEOUT
 375                                    < time (NULL)), 0))
 376         {
 377         out_unmap:
 378           __munmap (mapping, mapsize);
 379           goto out_close;
 380         }
 381
 382       size_t size = (sizeof (*head) + roundup (head->module * sizeof (ref_t),
 383                                                ALIGN)
 384                      + head->data_size);
 385
 386       if (__builtin_expect (mapsize < size, 0))
 387         goto out_unmap;
 388
 389       /* Allocate a record for the mapping.  */
 390       struct mapped_database *newp = malloc (sizeof (*newp));
 391       if (newp == NULL)
 392         /* Ugh, after all we went through the memory allocation failed.  */
 393         goto out_unmap;
 394
 395       newp->head = mapping;
 396       newp->data = ((char *) mapping + head->header_size
 397                     + roundup (head->module * sizeof (ref_t), ALIGN));
 398       newp->mapsize = size;
 399       newp->datasize = head->data_size;
 400       /* Set counter to 1 to show it is usable.  */
 401       newp->counter = 1;
 402
 403       result = newp;
 404     }
 405
 406  out_close:
 407   __close (mapfd);
 408  out_close2:
 409   __close (sock);
 410  out:
 411   __set_errno (saved_errno);
 412 #endif  /* SCM_RIGHTS */
 413
 414   struct mapped_database *oldval = *mappedp;
 415   *mappedp = result;
 416
 417   if (oldval != NULL && atomic_decrement_val (&oldval->counter) == 0)
 418     __nscd_unmap (oldval);
 419
 420   return result;
 421 }
 422
 423
 424 struct mapped_database *
 425 __nscd_get_map_ref (request_type type, const char *name,
 426                     volatile struct locked_map_ptr *mapptr, int *gc_cyclep)
 427 {
 428   struct mapped_database *cur = mapptr->mapped;
 429   if (cur == NO_MAPPING)
 430     return cur;
 431
 432   int cnt = 0;
 433   while (__builtin_expect (atomic_compare_and_exchange_val_acq (&mapptr->lock,
 434                                                                 1, 0) != 0, 0))
 435     {
 436       // XXX Best number of rounds?
 437       if (__builtin_expect (++cnt > 5, 0))
 438         return NO_MAPPING;
 439
 440       atomic_delay ();
 441     }
 442
 443   cur = mapptr->mapped;
 444
 445   if (__builtin_expect (cur != NO_MAPPING, 1))
 446     {
 447       /* If not mapped or timestamp not updated, request new map.  */
 448       if (cur == NULL
 449           || (cur->head->nscd_certainly_running == 0
 450               && cur->head->timestamp + MAPPING_TIMEOUT < time (NULL))
 451           || cur->head->data_size > cur->datasize)
 452         cur = get_mapping (type, name,
 453                            (struct mapped_database **) &mapptr->mapped);
 454
 455       if (__builtin_expect (cur != NO_MAPPING, 1))
 456         {
 457           if (__builtin_expect (((*gc_cyclep = cur->head->gc_cycle) & 1) != 0,
 458                                 0))
 459             cur = NO_MAPPING;
 460           else
 461             atomic_increment (&cur->counter);
 462         }
 463     }
 464
 465   mapptr->lock = 0;
 466
 467   return cur;
 468 }
 469
 470
 471 /* Using sizeof (hashentry) is not always correct to determine the size of
 472    the data structure as found in the nscd cache.  The program could be
 473    a 64-bit process and nscd could be a 32-bit process.  In this case
 474    sizeof (hashentry) would overestimate the size.  The following is
 475    the minimum size of such an entry, good enough for our tests here.  */
 476 #define MINIMUM_HASHENTRY_SIZE \
 477   (offsetof (struct hashentry, dellist) + sizeof (int32_t))
 478
 479
 480 /* Don't return const struct datahead *, as eventhough the record
 481    is normally constant, it can change arbitrarily during nscd
 482    garbage collection.  */
 483 struct datahead *
 484 __nscd_cache_search (request_type type, const char *key, size_t keylen,
 485                      const struct mapped_database *mapped, size_t datalen)
 486 {
 487   unsigned long int hash = __nis_hash (key, keylen) % mapped->head->module;
 488   size_t datasize = mapped->datasize;
 489
 490   ref_t trail = mapped->head->array[hash];
 491   trail = atomic_forced_read (trail);
 492   ref_t work = trail;
 493   size_t loop_cnt = datasize / (MINIMUM_HASHENTRY_SIZE
 494                                 + offsetof (struct datahead, data) / 2);
 495   int tick = 0;
 496
 497   while (work != ENDREF && work + MINIMUM_HASHENTRY_SIZE <= datasize)
 498     {
 499       struct hashentry *here = (struct hashentry *) (mapped->data + work);
 500       ref_t here_key, here_packet;
 501
 502 #ifndef _STRING_ARCH_unaligned
 503       /* Although during garbage collection when moving struct hashentry
 504          records around we first copy from old to new location and then
 505          adjust pointer from previous hashentry to it, there is no barrier
 506          between those memory writes.  It is very unlikely to hit it,
 507          so check alignment only if a misaligned load can crash the
 508          application.  */
 509       if ((uintptr_t) here & (__alignof__ (*here) - 1))
 510         return NULL;
 511 #endif
 512
 513       if (type == here->type
 514           && keylen == here->len
 515           && (here_key = atomic_forced_read (here->key)) + keylen <= datasize
 516           && memcmp (key, mapped->data + here_key, keylen) == 0
 517           && ((here_packet = atomic_forced_read (here->packet))
 518               + sizeof (struct datahead) <= datasize))
 519         {
 520           /* We found the entry.  Increment the appropriate counter.  */
 521           struct datahead *dh
 522             = (struct datahead *) (mapped->data + here_packet);
 523
 524 #ifndef _STRING_ARCH_unaligned
 525           if ((uintptr_t) dh & (__alignof__ (*dh) - 1))
 526             return NULL;
 527 #endif
 528
 529           /* See whether we must ignore the entry or whether something
 530              is wrong because garbage collection is in progress.  */
 531           if (dh->usable
 532               && here_packet + dh->allocsize <= datasize
 533               && (here_packet + offsetof (struct datahead, data) + datalen
 534                   <= datasize))
 535             return dh;
 536         }
 537
 538       work = atomic_forced_read (here->next);
 539       /* Prevent endless loops.  This should never happen but perhaps
 540          the database got corrupted, accidentally or deliberately.  */
 541       if (work == trail || loop_cnt-- == 0)
 542         break;
 543       if (tick)
 544         {
 545           struct hashentry *trailelem;
 546           trailelem = (struct hashentry *) (mapped->data + trail);
 547
 548 #ifndef _STRING_ARCH_unaligned
 549           /* We have to redo the checks.  Maybe the data changed.  */
 550           if ((uintptr_t) trailelem & (__alignof__ (*trailelem) - 1))
 551             return NULL;
 552 #endif
 553
 554           if (trail + MINIMUM_HASHENTRY_SIZE > datasize)
 555             return NULL;
 556
 557           trail = atomic_forced_read (trailelem->next);
 558         }
 559       tick = 1 - tick;
 560     }
 561
 562   return NULL;
 563 }
 564
 565
 566 /* Create a socket connected to a name. */
 567 int
 568 __nscd_open_socket (const char *key, size_t keylen, request_type type,
 569                     void *response, size_t responselen)
 570 {
 571   /* This should never happen and it is something the nscd daemon
 572      enforces, too.  He it helps to limit the amount of stack
 573      used.  */
 574   if (keylen > MAXKEYLEN)
 575     return -1;
 576
 577   int saved_errno = errno;
 578
 579   int sock = open_socket (type, key, keylen);
 580   if (sock >= 0)
 581     {
 582       /* Wait for data.  */
 583       if (wait_on_socket (sock, 5 * 1000) > 0)
 584         {
 585           ssize_t nbytes = TEMP_FAILURE_RETRY (__read (sock, response,
 586                                                        responselen));
 587           if (nbytes == (ssize_t) responselen)
 588             return sock;
 589         }
 590
 591       close_not_cancel_no_status (sock);
 592     }
 593
 594   __set_errno (saved_errno);
 595
 596   return -1;
 597 }