Fix control message decoding and add support for `ScmCredentials` #923

jonas-schievink · 2018-07-06T01:09:45Z

While #918 fixed the encoding, the decoding done by the CmsgIterator still remained broken when multiple messages are received. However, since nix didn't support any control message that could reliably be sent twice in one sendmsg call, this couldn't be tested properly.

This PR addresses this by adding SCM_CREDENTIALS support and testing all of this by passing both an SCM_CREDENTIALS and a SCM_RIGHTS message at the same time.

I've also verified that the resulting encoding is the same as for roughly equivalent C code.

asomers

Looks pretty good, especially the tests. Any idea why Travis didn't build this PR?

asomers · 2018-07-06T15:40:35Z

src/sys/socket/mod.rs

-        // (although it claims the kernel header checks this), but such
-        // a structure is clearly invalid, either way.
+        // Safe if: `self.buf` is `cmsghdr`-aligned.
+        let cmsg: &'a cmsghdr = unsafe { &*(self.buf[..mem::size_of::<cmsghdr>()].as_ptr() as *const cmsghdr) };


How do you guarantee that self.buf is correctly aligned?

The caller does. In this case its done by the CmsgSpace, which ensures alignment using a properly aligned member.

Well, it's not the caller but whoever creates the iterator. Here, the buffer comes from recvmsg and is a CmsgSpace which guarantees alignment.

asomers · 2018-07-06T15:41:44Z

src/sys/socket/mod.rs

-                        cmsg_data.as_ptr() as *const _,
-                        len))))
-            }
+        let cmsg_data = &self.buf[cmsg_align(mem::size_of::<cmsghdr>())..cmsg_len];


Up above you requird self.buf to be aligned. Here, you seem to be handling the case where it isn't. Or am I misunderstanding?

The cmsg_align just rounds up the size of cmsghdr to the right alignment. This is needed to include the right padding to reach the payload.

asomers · 2018-07-06T15:47:14Z

src/sys/socket/mod.rs

@@ -567,57 +569,95 @@ impl<'a> ControlMessage<'a> {
        }
    }

+    /// Returns the value to put into the `cmsg_type` field of the header.
+    fn type_(&self) -> libc::c_int {


I don't like trailing underscores. How about naming this method cmsg_type instead?

asomers · 2018-07-06T15:52:11Z

src/sys/socket/mod.rs

+
+            match *self {
+                ControlMessage::ScmRights(fds) => {
+                    let padlen = cmsg_align(mem::size_of_val(&cmsg)) -


It looks like padlen and buf are identical for all cases. Can you move their definitions outside of the match block?

jonas-schievink · 2018-07-06T19:46:47Z

Any idea why Travis didn't build this PR?

I added [ci skip] to the last commit as it was just updating the changelog. This causes Travis to ignore the commit which saves CI time.

(the previous commit was built by Travis and passed)

jonas-schievink · 2018-07-09T20:29:36Z

Uh, now the old test fails? That's odd.

EDIT: Uh okay the tests are really flaky - I suspect there's still some issues left

jonas-schievink · 2018-07-10T16:50:12Z

I think the issues are in qemu. I haven't managed to get any socket tests failing on my Raspberry Pi 1 (armv6) or 2 (armv7). Additionally, I wrote a test program in C (https://gist.github.com/jonas-schievink/cb6e6584a055539d2113f22d91068e2d) that works fine on bare metal but also shows this behavior under qemu. The control message encoding for nix and the test program is identical, and it's the kernel (or qemu) that strips out the second message, not our decoder doing weird stuff.

I'm going to build a smaller reproducer and report the bug to qemu, then #[ignore] the tests here.

jonas-schievink · 2018-07-10T23:42:17Z

@asomers Alright, after a long journey this might be finally done (except the commit message for
386cd04 is wrong - but I'll fix that when squashing later). Care to take another look?

asomers · 2018-07-11T15:34:55Z

test/sys/test_socket.rs

@@ -301,14 +301,36 @@ fn test_scm_credentials() {
 /// Ensure that we can send `SCM_CREDENTIALS` and `SCM_RIGHTS` with a single
 /// `sendmsg` call.
 #[cfg(any(target_os = "android", target_os = "linux"))]
+// qemu's handling of multiple cmsgs is bugged, ignore tests on non-x86-64
+#[cfg_attr(not(target_arch = "x86_64"), ignore)]


What about i386? That doesn't use qemu on FreeBSD, and I don't think it does on Linux either.

asomers · 2018-07-11T15:35:21Z

test/sys/test_socket.rs

@@ -301,14 +301,36 @@ fn test_scm_credentials() {
 /// Ensure that we can send `SCM_CREDENTIALS` and `SCM_RIGHTS` with a single
 /// `sendmsg` call.
 #[cfg(any(target_os = "android", target_os = "linux"))]
+// qemu's handling of multiple cmsgs is bugged, ignore tests on non-x86-64


Can you add an upstream bug link? Your C test case should make it easy to report.

asomers · 2018-07-11T21:10:54Z

src/sys/socket/mod.rs

-        // (although it claims the kernel header checks this), but such
-        // a structure is clearly invalid, either way.
+        // Safe if: `self.buf` is `cmsghdr`-aligned.
+        let cmsg: &'a cmsghdr = unsafe { &*(self.buf[..mem::size_of::<cmsghdr>()].as_ptr() as *const cmsghdr) };


Wrap to 80 columns, please.

asomers

Ok, now it LGTM. All it needs is a squash. @Susurrus any comments?

asomers · 2018-07-26T19:49:06Z

@jonas-schievink please squash this; then I'll merge it.

Susurrus · 2018-08-06T03:18:37Z

@asomers This all look good? You asked for it to be squashed, which is has been. We could split this up into two commits with the other one added the as_raw implementations for Pid and friends, but it's a minor nit, so I'm fine not worrying about it.

asomers

Yep, I'm cool.

asomers · 2018-08-06T03:20:15Z

bors r+

923: Fix control message *decoding* and add support for `ScmCredentials` r=asomers a=jonas-schievink While #918 fixed the *encoding*, the *decoding* done by the `CmsgIterator` still remained broken when multiple messages are received. However, since nix didn't support any control message that could reliably be sent twice in one `sendmsg` call, this couldn't be tested properly. This PR addresses this by adding `SCM_CREDENTIALS` support and testing all of this by passing both an `SCM_CREDENTIALS` and a `SCM_RIGHTS` message at the same time. I've also verified that the resulting encoding is the same as for roughly equivalent C code. Co-authored-by: Jonas Schievink <jonasschievink@gmail.com>

bors · 2018-08-06T07:50:16Z

Timed out

asomers · 2018-08-06T15:11:46Z

bors retry

923: Fix control message *decoding* and add support for `ScmCredentials` r=asomers a=jonas-schievink While #918 fixed the *encoding*, the *decoding* done by the `CmsgIterator` still remained broken when multiple messages are received. However, since nix didn't support any control message that could reliably be sent twice in one `sendmsg` call, this couldn't be tested properly. This PR addresses this by adding `SCM_CREDENTIALS` support and testing all of this by passing both an `SCM_CREDENTIALS` and a `SCM_RIGHTS` message at the same time. I've also verified that the resulting encoding is the same as for roughly equivalent C code. Co-authored-by: Jonas Schievink <jonasschievink@gmail.com>

bors · 2018-08-06T15:43:45Z

Build succeeded

asomers reviewed Jul 6, 2018

View reviewed changes

asomers requested changes Jul 11, 2018

View reviewed changes

asomers reviewed Jul 11, 2018

View reviewed changes

Fix *decoding* of cmsgs and add ScmCredentials.

9f0af44

asomers approved these changes Aug 6, 2018

View reviewed changes

bors bot merged commit 9f0af44 into nix-rust:master Aug 6, 2018

jonas-schievink deleted the scm-credentials branch October 4, 2018 16:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix control message decoding and add support for `ScmCredentials` #923

Fix control message decoding and add support for `ScmCredentials` #923

jonas-schievink commented Jul 6, 2018

asomers left a comment

asomers Jul 6, 2018

jonas-schievink Jul 6, 2018

jonas-schievink Jul 6, 2018

asomers Jul 6, 2018

jonas-schievink Jul 6, 2018

asomers Jul 6, 2018

asomers Jul 6, 2018

jonas-schievink commented Jul 6, 2018 •

edited

Loading

jonas-schievink commented Jul 9, 2018 •

edited

Loading

jonas-schievink commented Jul 10, 2018 •

edited

Loading

jonas-schievink commented Jul 10, 2018

asomers Jul 11, 2018

asomers Jul 11, 2018

asomers Jul 11, 2018

asomers left a comment

asomers commented Jul 26, 2018

Susurrus commented Aug 6, 2018

asomers left a comment

asomers commented Aug 6, 2018

bors bot commented Aug 6, 2018

asomers commented Aug 6, 2018

bors bot commented Aug 6, 2018

Fix control message *decoding* and add support for ScmCredentials #923

Fix control message *decoding* and add support for ScmCredentials #923

Conversation

jonas-schievink commented Jul 6, 2018

asomers left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jonas-schievink commented Jul 6, 2018 • edited Loading

jonas-schievink commented Jul 9, 2018 • edited Loading

jonas-schievink commented Jul 10, 2018 • edited Loading

jonas-schievink commented Jul 10, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

asomers left a comment

Choose a reason for hiding this comment

asomers commented Jul 26, 2018

Susurrus commented Aug 6, 2018

asomers left a comment

Choose a reason for hiding this comment

asomers commented Aug 6, 2018

bors bot commented Aug 6, 2018

Timed out

asomers commented Aug 6, 2018

bors bot commented Aug 6, 2018

Build succeeded

Fix control message decoding and add support for `ScmCredentials` #923

Fix control message decoding and add support for `ScmCredentials` #923

jonas-schievink commented Jul 6, 2018 •

edited

Loading

jonas-schievink commented Jul 9, 2018 •

edited

Loading

jonas-schievink commented Jul 10, 2018 •

edited

Loading