Skip to content

Commit

Permalink
Added peer ID support to sock fd.
Browse files Browse the repository at this point in the history
  • Loading branch information
gdamore committed Dec 29, 2023
1 parent 5fff85c commit f07fbf7
Show file tree
Hide file tree
Showing 12 changed files with 494 additions and 93 deletions.
2 changes: 2 additions & 0 deletions docs/man/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -302,6 +302,7 @@ if (NNG_ENABLE_DOC)
nng_mtx_unlock
nng_opts_parse
nng_random
nng_socket_pair
nng_thread_create
nng_thread_destroy
nng_thread_set_name
Expand Down Expand Up @@ -388,6 +389,7 @@ if (NNG_ENABLE_DOC)
nng_rep
nng_req
nng_respondent
nng_socket
nng_sub
nng_surveyor
nng_tcp
Expand Down
10 changes: 5 additions & 5 deletions docs/man/nng_ipc.7.adoc
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
= nng_ipc(7)
//
// Copyright 2020 Staysail Systems, Inc. <[email protected]>
// Copyright 2023 Staysail Systems, Inc. <[email protected]>
// Copyright 2018 Capitar IT Group BV <[email protected]>
//
// This document is supplied under the terms of the MIT License, a
Expand Down Expand Up @@ -107,14 +107,14 @@ except for abstract sockets, which use xref:nng_sockaddr_abstract.5.adoc[`nng_so
The following transport options are supported by this transport,
where supported by the underlying platform.

* xref:nng_ipc_options.5.adoc#NNG_OPT_IPC_PEER_GID[`NNG_OPT_IPC_PEER_GID`]
* xref:nng_ipc_options.5.adoc#NNG_OPT_IPC_PEER_PID[`NNG_OPT_IPC_PEER_PID`]
* xref:nng_ipc_options.5.adoc#NNG_OPT_IPC_PEER_UID[`NNG_OPT_IPC_PEER_UID`]
* xref:nng_ipc_options.5.adoc#NNG_OPT_IPC_PEER_ZONEID[`NNG_OPT_IPC_PEER_ZONEID`]
* xref:nng_ipc_options.5.adoc#NNG_OPT_IPC_PERMISSIONS[`NNG_OPT_IPC_PERMISSIONS`]
* xref:nng_ipc_options.5.adoc#NNG_OPT_IPC_SECURITY_DESCRIPTOR[`NNG_OPT_IPC_SECURITY_DESCRIPTOR`]
* xref:nng_options.5.adoc#NNG_OPT_LOCADDR[`NNG_OPT_LOCADDR`]
* xref:nng_options.5.adoc#NNG_OPT_REMADDR[`NNG_OPT_REMADDR`]
* xref:nng_options.5.adoc#NNG_OPT_PEER_GID[`NNG_OPT_PEER_GID`]
* xref:nng_options.5.adoc#NNG_OPT_PEER_PID[`NNG_OPT_PEER_PID`]
* xref:nng_options.5.adoc#NNG_OPT_PEER_UID[`NNG_OPT_PEER_UID`]
* xref:nng_options.5.adoc#NNG_OPT_PEER_ZONEID[`NNG_OPT_PEER_ZONEID`]
* xref:nng_options.5.adoc#NNG_OPT_URL[`NNG_OPT_URL`]

== SEE ALSO
Expand Down
64 changes: 19 additions & 45 deletions docs/man/nng_ipc_options.5.adoc
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
= nng_ipc_options(5)
//
// Copyright 2019 Staysail Systems, Inc. <[email protected]>
// Copyright 2023 Staysail Systems, Inc. <[email protected]>
// Copyright 2018 Capitar IT Group BV <[email protected]>
// Copyright 2019 Devolutions <[email protected]>
//
Expand Down Expand Up @@ -43,43 +43,9 @@ have other access restrictions.
An attempt has been made to include details about such restrictions in the
description of the option.

NOTE: The availability of any of the following options is platform-specific,
NOTE: The availability of the following options is platform-specific,
as the implementations of IPC are quite different on Windows and POSIX systems.

=== IPC Options

[[NNG_OPT_IPC_PEER_GID]]((`NNG_OPT_IPC_PEER_GID`))::
(`uint64_t`)
This read-only option provides a connected peer's primary
group id.
This is the effective group id of the peer when either the underlying
`listen()` or `connect()` calls were made, and is not forgeable.
This option is generally only available on POSIX systems.

[[NNG_OPT_IPC_PEER_PID]]((`NNG_OPT_IPC_PEER_PID`))::
(`uint64_t`)
This read-only option provides the the process id
of the connected peer.
This option is only available on Windows, Linux, and certain other systems.
+
NOTE: Applications should not assume that the process ID does not change,
as it is possible (although unsupported!) for a nefarious process to pass a
file descriptor between processes.
However, it is not possible for a nefarious application to forge the identity
of a well-behaved one using this method.

[[NNG_OPT_IPC_PEER_UID]]((`NNG_OPT_IPC_PEER_UID`))::
(`uint64_t`)
This read-only option provides a connected peer's user id.
This is the effective user id of the peer when either the underlying
`listen()` or `connect()` calls were made, and is not forgeable.
This option is generally only available on POSIX systems.

[[NNG_OPT_IPC_PEER_ZONEID]]((`NNG_OPT_IPC_PEER_ZONEID`))::
(`uint64_t`)
This read-only option provides a connected peer's the zone id.
Zones (and this option) are only supported on Solaris and illumos systems.

[[NNG_OPT_IPC_PERMISSIONS]]((`NNG_OPT_IPC_PERMISSIONS`))::
(`int`)
This write-only option may be applied to a listener to configure the
Expand Down Expand Up @@ -115,22 +81,30 @@ named pipe.
The value is a pointer, `PSECURITY_DESCRIPTOR`, and may only be
applied to listeners that have not been started yet.

=== Common Platform Specific Options

The following options are supported by this transport when the underlying platform supports them:

* xref:nng_options.5.adoc#NNG_OPT_PEER_GID[`NNG_OPT_PEER_GID`] (also available as `NNG_OPT_IPC_PEER_GID`)
* xref:nng_options.5.adoc#NNG_OPT_PEER_PID[`NNG_OPT_PEER_PID`] (also available as `NNG_OPT_IPC_PEER_PID`)
* xref:nng_options.5.adoc#NNG_OPT_PEER_UID[`NNG_OPT_PEER_UID`] (also available as `NNG_OPT_IPC_PEER_UID`)
* xref:nng_options.5.adoc#NNG_OPT_PEER_ZONEID[`NNG_OPT_PEER_ZONEID`] (also available as `NNG_OPT_IPC_PEER_ZONEID`)

=== Inherited Options

Generally, the following option values are also available for TLS objects,
when appropriate for the context:
Generally, the following option values are also available when appropriate for the context:

* xref:nng_options.5.adoc#NNG_OPT_LOCADDR[`NNG_OPT_LOCADDR`]
* xref:nng_options.5.adoc#NNG_OPT_REMADDR[`NNG_OPT_REMADDR`]

== SEE ALSO

[.text-left]
xref:nng_ipc_dialer_getopt.3ipc.adoc[nng_ipc_dialer_getopt(3ipc)],
xref:nng_ipc_dialer_setopt.3ipc.adoc[nng_ipc_dialer_setopt(3ipc)],
xref:nng_ipc_getopt.3ipc.adoc[nng_ipc_getopt(3ipc)],
xref:nng_ipc_listener_getopt.3ipc.adoc[nng_ipc_listener_getopt(3ipc)],
xref:nng_ipc_listener_setopt.3ipc.adoc[nng_ipc_listener_setopt(3ipc)],
xref:nng_ipc_setopt.3ipc.adoc[nng_ipc_setopt(3ipc)],
xref:nng_dialer_get.3.adoc[nng_dialer_get(3)],
xref:nng_dialer_set.3.adoc[nng_dialer_set(3)],
xref:nng_listener_get.3.adoc[nng_listener_get(3)],
xref:nng_listener_set.3.adoc[nng_listener_set(3)],
xref:nng_pipe_get.3.adoc[nng_pipe_get(3)],
xref:nng_options.5.adoc[nng_options(5)]
xref:nng.7.adoc[nng(7)]
xref:nng.7.adoc[nng(7)],
xref:nng_ipc.7.adoc[nng_ipc(7)]
64 changes: 50 additions & 14 deletions docs/man/nng_options.5.adoc
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
= nng_options(5)
//
// Copyright 2020 Staysail Systems, Inc. <[email protected]>
// Copyright 2023 Staysail Systems, Inc. <[email protected]>
// Copyright 2018 Capitar IT Group BV <[email protected]>
// Copyright 2019 Devolutions <[email protected]>
//
Expand Down Expand Up @@ -39,6 +39,10 @@ nng_options - socket, dialer, listener, and pipe options
#define NNG_OPT_RECVMAXSZ "recv-size-max"
#define NNG_OPT_RECONNMINT "reconnect-time-min"
#define NNG_OPT_RECONNMAXT "reconnect-time-max"
#define NNG_OPT_PEER_GID "ipc:peer-gid"
#define NNG_OPT_PEER_PID "ipc:peer-pid"
#define NNG_OPT_PEER_UID "ipc:peer-uid"
#define NNG_OPT_PEER_ZONEID "ipc:peer-zoneid"
----

== DESCRIPTION
Expand Down Expand Up @@ -328,27 +332,59 @@ This read-only option is used to obtain the 16-bit number for the socket's proto
This read-only option is used to obtain the 16-bit number of the
peer protocol for the socket.

[[NNG_OPT_PROTONAME]]
((`NNG_OPT_PROTONAME`))::
(string)
This read-only option is used to obtain the name of the socket's protocol.
[[NNG_OPT_PEER_GID]]
((`NNG_OPT_PEER_GID`))::
(`uint64_t`)
This read-only option provides a connected peer's primary group id, when known.
This is the effective group id of the peer when either the underlying
`listen()` or `connect()` calls were made, and is not forgeable.
This option is generally only available on POSIX systems, only on certain transports.

[[NNG_OPT_PEER_PID]]
((`NNG_OPT_PEER_PID`))::
(`uint64_t`)
This read-only option provides the process id of the connected peer, when known.
This option is only available on certain platforms and transports.
+
NOTE: Applications should not assume that the process ID does not change,
as it may be possible for a process to pass a file descriptor between processes.
However, it is not possible for a nefarious application to forge the identity
of a well-behaved one using this method.

[[NNG_OPT_PEER_UID]]
((`NNG_OPT_PEER_UID`))::
(`uint64_t`)
This read-only option provides a connected peer's user id.
This is the effective user id of the peer when either the underlying
`listen()` or `connect()` calls were made, and cannot be forged.
This option is generally only available on POSIX systems, on certain transports.

[[NNG_OPT_PEER_ZONEID]]
((`NNG_OPT_PEER_ZONEID`))::
(`uint64_t`)
This read-only option provides a connected peer's the zone id.
Zones (and this option) are only supported on Solaris and illumos systems, on select transports.

[[NNG_OPT_PEERNAME]]
((`NNG_OPT_PEERNAME`))::
(string)
This read-only option is used to obtain the name of the peer protocol for
the socket.
This read-only option is used to obtain the name of the peer protocol for the socket.

[[NNG_OPT_PROTONAME]]
((`NNG_OPT_PROTONAME`))::
(string)
This read-only option is used to obtain the name of the socket's protocol.

== SEE ALSO

[.text-left]
xref:nng_dialer_getopt.3.adoc[nng_dialer_getopt(3)],
xref:nng_dialer_setopt.3.adoc[nng_dialer_setopt(3)],
xref:nng_getopt.3.adoc[nng_getopt(3)],
xref:nng_listener_getopt.3.adoc[nng_listener_getopt(3)],
xref:nng_listener_setopt.3.adoc[nng_listener_setopt(3)],
xref:nng_pipe_getopt.3.adoc[nng_pipe_getopt(3)],
xref:nng_setopt.3.adoc[nng_setopt(3)],
xref:nng_dialer_get.3.adoc[nng_dialer_get(3)],
xref:nng_dialer_set.3.adoc[nng_dialer_set(3)],
xref:nng_listener_get.3.adoc[nng_listener_get(3)],
xref:nng_listener_set.3.adoc[nng_listener_set(3)],
xref:nng_pipe_get.3.adoc[nng_pipe_get(3)],
xref:nng_socket_get.3.adoc[nng_socket_get(3)],
xref:nng_socket_set.3.adoc[nng_socket_set(3)],
xref:nng_ipc_options.5.adoc[nng_ipc_options(5)],
xref:nng_tcp_options.5.adoc[nng_tcp_options(5)],
xref:nng_tls_options.5.adoc[nng_tls_options(5)],
Expand Down
3 changes: 2 additions & 1 deletion docs/man/nng_socket.7.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,8 @@ This transport uses the URL `socket://`, without further qualification.

=== Socket Address

Not documented.
The socket address will be of family `NNG_AF_UNSPEC`.
There are no further socket details available.

=== Transport Options

Expand Down
16 changes: 11 additions & 5 deletions include/nng/nng.h
Original file line number Diff line number Diff line change
Expand Up @@ -811,24 +811,30 @@ NNG_DECL nng_listener nng_pipe_listener(nng_pipe);
// this for security.
#define NNG_OPT_IPC_PERMISSIONS "ipc:permissions"

// IPC peer options may also be used in some cases with other socket types.

// Peer UID. This is only available on POSIX style systems.
#define NNG_OPT_IPC_PEER_UID "ipc:peer-uid"
#define NNG_OPT_PEER_UID "ipc:peer-uid"
#define NNG_OPT_IPC_PEER_UID NNG_OPT_PEER_UID

// Peer GID (primary group). This is only available on POSIX style systems.
#define NNG_OPT_IPC_PEER_GID "ipc:peer-gid"
#define NNG_OPT_PEER_GID "ipc:peer-gid"
#define NNG_OPT_IPC_PEER_GID NNG_OPT_PEER_GID

// Peer process ID. Available on Windows, Linux, and SunOS.
// In theory we could obtain this with the first message sent,
// In theory, we could obtain this with the first message sent,
// but we have elected not to do this for now. (Nice RFE for a FreeBSD
// guru though.)
#define NNG_OPT_IPC_PEER_PID "ipc:peer-pid"
#define NNG_OPT_PEER_PID "ipc:peer-pid"
#define NNG_OPT_IPC_PEER_PID NNG_OPT_PEER_PID

// Peer Zone ID. Only on SunOS systems. (Linux containers have no
// definable kernel identity; they are a user-land fabrication made up
// from various pieces of different namespaces. FreeBSD does have
// something called JailIDs, but it isn't obvious how to determine this,
// or even if processes can use IPC across jail boundaries.)
#define NNG_OPT_IPC_PEER_ZONEID "ipc:peer-zoneid"
#define NNG_OPT_PEER_ZONEID "ipc:peer-zoneid"
#define NNG_OPT_IPC_PEER_ZONEID NNG_OPT_PEER_ZONEID

// WebSocket Options.

Expand Down
13 changes: 13 additions & 0 deletions src/core/sockfd.c
Original file line number Diff line number Diff line change
Expand Up @@ -165,11 +165,24 @@ sfd_listener_set_fd(void *arg, const void *buf, size_t sz, nni_type t)
return (0);
}

static int
sfd_listener_get_addr(void *arg, void *buf, size_t *szp, nni_type t)
{
NNI_ARG_UNUSED(arg);
nng_sockaddr sa;
sa.s_family = NNG_AF_UNSPEC;
return (nni_copyout_sockaddr(&sa, buf, szp, t));
}

static const nni_option sfd_listener_options[] = {
{
.o_name = NNG_OPT_SOCKET_FD,
.o_set = sfd_listener_set_fd,
},
{
.o_name = NNG_OPT_LOCADDR,
.o_get = sfd_listener_get_addr,
},
{
.o_name = NULL,
},
Expand Down
1 change: 1 addition & 0 deletions src/platform/posix/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ if (NNG_PLATFORM_POSIX)
posix_ipcconn.c
posix_ipcdial.c
posix_ipclisten.c
posix_peerid.c
posix_pipe.c
posix_resolv_gai.c
posix_sockaddr.c
Expand Down
Loading

0 comments on commit f07fbf7

Please sign in to comment.