binder.c

Bug Summary

File:	d/binder.c
Warning:	line 220, column 21 Access out-of-bound array element (buffer overflow)
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name binder.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/isvv/naviserver/nsd -resource-dir /usr/local/lib/clang/15.0.0 -D _FORTIFY_SOURCE=2 -D NDEBUG -D SYSTEM_MALLOC -I ../include -I /usr/include/tcl8.6 -D HAVE_CONFIG_H -internal-isystem /usr/local/lib/clang/15.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/11/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -std=c99 -fdebug-compilation-dir=/home/isvv/naviserver/nsd -ferror-limit 19 -stack-protector 2 -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-checker alpha -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-07-23-130959-11103-1 -x c binder.c
1/*
* The contents of this file are subject to the Mozilla Public License
* Version 1.1 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
* http://mozilla.org/.
*
* Software distributed under the License is distributed on an "AS IS"
* basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
* the License for the specific language governing rights and limitations
* under the License.
*
* The Original Code is AOLserver Code and related documentation
* distributed by AOL.
*
* The Initial Developer of the Original Code is America Online,
* Inc. Portions created by AOL are Copyright (C) 1999 America Online,
* Inc. All Rights Reserved.
*
* Alternatively, the contents of this file may be used under the terms
* of the GNU General Public License (the "GPL"), in which case the
* provisions of GPL are applicable instead of those above.  If you wish
* to allow use of your version of this file only under the terms of the
* GPL and not to allow others to use your version of this file under the
* License, indicate your decision by deleting the provisions above and
* replace them with the notice and other provisions required by the GPL.
* If you do not delete the provisions above, a recipient may use your
* version of this file under either the License or the GPL.
*/


31/*
* binder.c --
*
* Support for pre-bound privileged ports for Unix
*/

37#include "nsd.h"

39#ifndef _WIN32
40# include <sys/un.h>
41# include <sys/uio.h>

43# define REQUEST_SIZE(sizeof(int) + sizeof(int) + sizeof(int) + 46)  (sizeof(int) + sizeof(int) + sizeof(int) + NS_IPADDR_SIZE46)
44# define RESPONSE_SIZE(sizeof(int)) (sizeof(int))

46typedef struct Prebind {
  size_t count;
  NS_SOCKETint sockets[1];
49} Prebind;

51#endif

53/*
* Local variables defined in this file
*/

57static Ns_Mutex      lock = NULL((void*)0);
58static Tcl_HashTable preboundTcp;
59static Tcl_HashTable preboundUdp;
60static Tcl_HashTable preboundRaw;
61static Tcl_HashTable preboundUnix;

63static bool_Bool binderRunning = NS_FALSE0;
64static NS_SOCKETint binderRequest[2]  = { NS_INVALID_SOCKET(-1), NS_INVALID_SOCKET(-1) };
65static NS_SOCKETint binderResponse[2] = { NS_INVALID_SOCKET(-1), NS_INVALID_SOCKET(-1) };

67/*
* Local functions defined in this file
*/
70#ifndef _WIN32
71static Ns_ReturnCode PrebindSockets(const char *spec)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1)));

74static void Binder(void);

76static struct Prebind* PrebindAlloc(const char *proto, size_t reuses, struct sockaddr *saPtr)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1))) NS_GNUC_NONNULL(3)__attribute__((__nonnull__(3)));

79static bool_Bool PrebindGet(const char *proto, struct sockaddr *saPtr, NS_SOCKETint *sockPtr)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1))) NS_GNUC_NONNULL(2)__attribute__((__nonnull__(2))) NS_GNUC_NONNULL(3)__attribute__((__nonnull__(3)));

82static void PrebindCloseSockets(const char *proto, struct sockaddr *saPtr, struct Prebind *pPtr)
  NS_GNUC_NONNULL(1)__attribute__((__nonnull__(1))) NS_GNUC_NONNULL(2)__attribute__((__nonnull__(2))) NS_GNUC_NONNULL(3)__attribute__((__nonnull__(3)));
84#endif


87#ifndef _WIN32
88
89/*
*----------------------------------------------------------------------
*
* PrebindAlloc --
*
*      Create a Prebind structure with potentially multiple sockets
*      binding to the identical port. This is needed for e.g. multiple
*      listeners with SO_REUSEPORT.
*
* Results:
*      Either a prebind structure or NULL inc ase of failure.
*
* Side effects:
*      Allocating memory, binding of TCP or UDP sockets.
*
*----------------------------------------------------------------------
*/
106static struct Prebind*
107PrebindAlloc(const char *proto, size_t reuses, struct sockaddr *saPtr)
108{
  struct Prebind *pPtr;

  NS_NONNULL_ASSERT(proto != NULL)((void) (0));
  NS_NONNULL_ASSERT(saPtr != NULL)((void) (0));

  pPtr = ns_malloc(sizeof(Prebind) + sizeof(NS_SOCKETint)*reuses-1);
  if (pPtr != NULL((void*)0)) {
      bool_Bool   reuseport;
      size_t i;

      pPtr->count = reuses;

      reuseport = (reuses > 1);

      for (i = 0u; i < reuses; i++) {
          if (*proto == 't') {
              pPtr->sockets[i] = Ns_SockBind(saPtr, reuseport);
          } else if (*proto == 'u') {
              pPtr->sockets[i] = Ns_SockBindUdp(saPtr, reuseport);
          } else {
              Ns_Log(Error, "prebind: invalid protocol %s", proto);
              ns_free(pPtr);
              pPtr = NULL((void*)0);
              break;
          }

          if (pPtr->sockets[i] == NS_INVALID_SOCKET(-1)) {
              Ns_LogSockaddr(Error, "prebind error on ", (const struct sockaddr *)saPtr);
              Ns_Log(Error, "prebind error: %s", strerror(errno(*__errno_location ())));
              if (i == 0) {
                  /*
                   * Could not bind to a single port. Return NULL to
                   * signal an invalid attempt.
                   */
                  ns_free(pPtr);
                  pPtr = NULL((void*)0);
                  break;
              }
          }
      }
  }
  return pPtr;
151}

153
154/*
*----------------------------------------------------------------------
*
* PrebindGet --
*
*      Get a single socket from the prebind structure. In case of
*      success, the function returns in its last argument the prebound
*      socket and removes it from the set of available sockets. When
*      all sockets are consumed the prebind structure is freed and the
*      hash entry is removed.
*
* Results:
*
*      NS_TRUE in case, there is a prebind structure for the provided
*      sockaddr or NS_FALSE on failure.
*
* Side effects:
*      Potentially freeing memory.
*
*----------------------------------------------------------------------
*/
175static bool_Bool
176PrebindGet(const char *proto, struct sockaddr *saPtr, NS_SOCKETint *sockPtr)
177{
  static Tcl_HashTable *tablePtr;
  Tcl_HashEntry        *hPtr;
  bool_Bool                  foundEntry = NS_FALSE0;

  NS_NONNULL_ASSERT(proto != NULL)((void) (0));
  NS_NONNULL_ASSERT(saPtr != NULL)((void) (0));
  NS_NONNULL_ASSERT(sockPtr != NULL)((void) (0));

  if (*proto == 't') {
25
←
Taking false branch→
      tablePtr = &preboundTcp;
  } else {
      tablePtr = &preboundUdp;
  }

  Ns_MutexLock(&lock);
  hPtr = Tcl_FindHashEntry(tablePtr, (char *)saPtr)(*((tablePtr)->findProc))(tablePtr, (const char *)((char *
)saPtr));
  if (hPtr != NULL((void*)0)) {
26
←
Assuming 'hPtr' is not equal to NULL→
27
←
Taking true branch→
      struct Prebind *pPtr;
      size_t          i;
      bool_Bool            allConsumed = NS_TRUE1;

      /*
       * We found a prebound entry.
       */
      foundEntry = NS_TRUE1;

      pPtr = (struct Prebind *)Tcl_GetHashValue(hPtr)((hPtr)->clientData);
      for (i = 0u; i < pPtr->count; i++) {
28
←
Assuming 'i' is < field 'count'→
29
←
Loop condition is true.  Entering loop body→
          /*
           * Find an entry, which is usable
           */
          if (pPtr->sockets[i] != NS_INVALID_SOCKET(-1)) {
30
←
Assuming the condition is true→
31
←
Taking true branch→
              *sockPtr = pPtr->sockets[i];
              pPtr->sockets[i] = NS_INVALID_SOCKET(-1);
              break;
          }
      }
      if (*sockPtr !=  NS_INVALID_SOCKET(-1)) {
32
←
Taking true branch→
          /*
           * Check, if there are more unconsumed entries.
           */
          for (; i32.1
'i' is < field 'count'
 < pPtr->count; i++) {
33
←
Loop condition is true.  Entering loop body→
35
←
Assuming 'i' is < field 'count'→
36
←
Loop condition is true.  Entering loop body→
              if (pPtr->sockets[i] != NS_INVALID_SOCKET(-1)) {
34
←
Taking false branch→
37
←
Access out-of-bound array element (buffer overflow)
                  /*
                   * Yes, there are more unconsumed entries.
                   */
                  allConsumed = NS_FALSE0;
                  break;
              }
          }
      }
      if (allConsumed) {
          ns_free(pPtr);
          Tcl_DeleteHashEntry(hPtr);
      }
  }
  Ns_MutexUnlock(&lock);

  return foundEntry;
237}

239
240/*
*----------------------------------------------------------------------
*
* PrebindCloseSockets --
*
*      Close the remaining prebound sockets.
*
* Results:
*
*      None.
*
* Side effects:
*      Freeing memory.
*
*----------------------------------------------------------------------
*/
256static void
257PrebindCloseSockets(const char *proto, struct sockaddr *saPtr, struct Prebind *pPtr)
258{
  size_t         i;
  unsigned short port;
  const char    *addr;
  char           ipString[NS_IPADDR_SIZE46];
  int            count = 0;

  NS_NONNULL_ASSERT(proto != NULL)((void) (0));
  NS_NONNULL_ASSERT(saPtr != NULL)((void) (0));
  NS_NONNULL_ASSERT(pPtr != NULL)((void) (0));

  addr = ns_inet_ntop((struct sockaddr *)saPtr, ipString, sizeof(ipString));
  port = Ns_SockaddrGetPort((struct sockaddr *)saPtr);

  for (i = 0u; i < pPtr->count; i++) {
      NS_SOCKETint sock = pPtr->sockets[i];

      if (sock != NS_INVALID_SOCKET(-1)) {
          count ++;
          Ns_Log(Debug, "prebind closing %s socket %d\n", proto, sock);
          (void)ns_sockcloseclose(sock);
      }
  }
  ns_free(pPtr);
  Ns_Log(Warning, "prebind: closed unused %d %s socket(s): [%s]:%hd",
         count, proto, addr, port);
284}
285#endif

287
288/*
*----------------------------------------------------------------------
*
* Ns_SockListenEx --
*
*      Create a new TCP socket bound to the specified port and
*      listening for new connections.
*
* Results:
*      Socket descriptor or -1 on error.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

305#ifndef _WIN32
306NS_SOCKETint
307Ns_SockListenEx(const char *address, unsigned short port, int backlog, bool_Bool reuseport)
308{
  NS_SOCKETint           sock = NS_INVALID_SOCKET(-1);
  struct NS_SOCKADDR_STORAGEsockaddr_storage sa;
  struct sockaddr     *saPtr = (struct sockaddr *)&sa;

  if (Ns_GetSockAddr(saPtr, address, port) == NS_OK) {
      bool_Bool found;

      found = PrebindGet("tcp", saPtr, &sock);
      if (!found) {
          /*
           * Prebind did not find a prebound entry, try to bind now.
           */
          sock = Ns_SockBind(saPtr, reuseport);
          //fprintf(stderr, "listen on port %hd binding with reuseport %d\n", port, reuseport);
      } else {
          //fprintf(stderr, "listen on port %hd already prebound\n", port);
      }

      if (sock != NS_INVALID_SOCKET(-1) && listen(sock, backlog) == -1) {
          /*
           * Can't listen; close the opened socket
           */
          ns_sockerrno_t err = ns_sockerrno(*__errno_location ());

          (void)ns_sockcloseclose(sock);
          errno(*__errno_location ()) = err;
          sock = NS_INVALID_SOCKET(-1);
          Ns_SetSockErrno(err);
      }
  } else {
      /*
       * We could not even get the sockaddr, so make clear, that saPtr
       * is invalid.
       */
      saPtr = NULL((void*)0);
  }

  /*
   * If forked binder is running and we could not allocate socket
   * directly, try to do it through the binder
   */
  if (sock == NS_INVALID_SOCKET(-1) && binderRunning && saPtr != NULL((void*)0)) {
      sock = Ns_SockBinderListen('T', address, port, backlog);
  }

  return sock;
355}
356#endif /* _WIN32 */

358
359/*
*----------------------------------------------------------------------
*
* Ns_SockListenUdp --
*
*      Listen on the UDP socket for the given IP address and port.  The
*      given address might be NULL, which implies the unspecified IP
*      address ("0.0.0.0" or "::").
*
* Results:
*      Socket descriptor or -1 on error.
*
* Side effects:
*      May create a new socket if none prebound.
*
*----------------------------------------------------------------------
*/

377NS_SOCKETint
378Ns_SockListenUdp(const char *address, unsigned short port, bool_Bool reuseport)
379{
  NS_SOCKETint        sock = NS_INVALID_SOCKET(-1);
  struct NS_SOCKADDR_STORAGEsockaddr_storage sa;
  struct sockaddr *saPtr = (struct sockaddr *)&sa;

  if (Ns_GetSockAddr(saPtr, address, port) == NS_OK) {
22
←
Assuming the condition is true→
23
←
Taking true branch→
      bool_Bool found;

387#ifndef _WIN32
      found = PrebindGet("udp", saPtr, &sock);
24
←
Calling 'PrebindGet'→
389#else
      found = NS_FALSE0;
391#endif
      if (!found) {
          /*
           * Not prebound, bind now
           */
          sock = Ns_SockBindUdp(saPtr, reuseport);
      }
  }

  /*
   * If forked binder is running and we could not allocate socket
   * directly, try to do it through the binder
   */

  if (sock == NS_INVALID_SOCKET(-1) && binderRunning) {
      sock = Ns_SockBinderListen('U', address, port, 0);
  }

  return sock;
410}

412
413/*
*----------------------------------------------------------------------
*
* Ns_SockListenRaw --
*
*      Listen on the raw socket addressed by the given protocol.
*
* Results:
*      Socket descriptor or -1 on error.
*
* Side effects:
*      May create a new socket if none prebound.
*
*----------------------------------------------------------------------
*/

429NS_SOCKETint
430Ns_SockListenRaw(int proto)
431{
  NS_SOCKETint       sock = NS_INVALID_SOCKET(-1);
  Tcl_HashEntry  *hPtr;
  Tcl_HashSearch  search;

  Ns_MutexLock(&lock);
  hPtr = Tcl_FirstHashEntry(&preboundRaw, &search);
  while (hPtr != NULL((void*)0)) {
      if (proto == PTR2INT(Tcl_GetHashValue(hPtr))((int)(intptr_t)(((hPtr)->clientData)))) {
          sock = PTR2NSSOCK(Tcl_GetHashKey(&preboundRaw, hPtr))((int)(intptr_t)(((void *) (((&preboundRaw)->keyType ==
 (1) || (&preboundRaw)->keyType == (-1)) ? (hPtr)->
key.oneWordValue : (hPtr)->key.string))));
          Tcl_DeleteHashEntry(hPtr);
          break;
      }
      hPtr = Tcl_NextHashEntry(&search);
  }
  Ns_MutexUnlock(&lock);
  if (hPtr == NULL((void*)0)) {
      /*
       * Not prebound, bind now
       */
      sock = Ns_SockBindRaw(proto);
  }

  /*
   * If forked binder is running and we could not allocate socket
   * directly, try to do it through the binder
   */

  if (sock == NS_INVALID_SOCKET(-1) && binderRunning) {
      sock = Ns_SockBinderListen('R', NULL((void*)0), 0u, proto);
  }

  return sock;
464}

466
467/*
*----------------------------------------------------------------------
*
* Ns_SockListenUnix --
*
*      Listen on the Unix-domain socket addressed by the given path.
*
* Results:
*      Socket descriptor or -1 on error.
*
* Side effects:
*      May create a new socket if none prebound. If backlog is zero,
*      DGRAM socket will be created otherwise STREAM socket
*
*----------------------------------------------------------------------
*/

484NS_SOCKETint
485Ns_SockListenUnix(const char *path, int backlog, unsigned short mode)
486{
  NS_SOCKETint      sock = NS_INVALID_SOCKET(-1);
488#ifndef _WIN32
  Tcl_HashEntry *hPtr;
  Tcl_HashSearch search;

  NS_NONNULL_ASSERT(path != NULL)((void) (0));

  /*
   * Check if already prebound
   */
  Ns_MutexLock(&lock);
  hPtr = Tcl_FirstHashEntry(&preboundUnix, &search);
  while (hPtr != NULL((void*)0)) {
      const char *value = (char*) Tcl_GetHashValue(hPtr)((hPtr)->clientData);

      if (STREQ(path, value)(((*(path)) == (*(value))) && (strcmp((path),(value))
 == 0))) {
          sock = PTR2NSSOCK(Tcl_GetHashKey(&preboundRaw, hPtr))((int)(intptr_t)(((void *) (((&preboundRaw)->keyType ==
 (1) || (&preboundRaw)->keyType == (-1)) ? (hPtr)->
key.oneWordValue : (hPtr)->key.string))));
          Tcl_DeleteHashEntry(hPtr);
          break;
      }
      hPtr = Tcl_NextHashEntry(&search);
  }
  Ns_MutexUnlock(&lock);

  if (hPtr == NULL((void*)0)) {
      /*
       * Not prebound, bind now
       */
      sock = Ns_SockBindUnix(path, backlog > 0 ? SOCK_STREAMSOCK_STREAM : SOCK_DGRAMSOCK_DGRAM, mode);
  }
  if (sock >= 0 && backlog > 0 && listen(sock, backlog) == -1) {
      /*
       * Can't listen; close the opened socket
       */
      ns_sockerrno_t err = ns_sockerrno(*__errno_location ());

      (void)ns_sockcloseclose(sock);
      errno(*__errno_location ()) = err;
      sock = NS_INVALID_SOCKET(-1);
      Ns_SetSockErrno(err);
  }

  /*
   * If forked binder is running and we could not allocate socket
   * directly, try to do it through the binder
   */

  if (sock == NS_INVALID_SOCKET(-1) && binderRunning) {
      sock = Ns_SockBinderListen('D', path, mode, backlog);
  }
537#endif /* _WIN32 */
  return sock;
539}

541
542/*
*----------------------------------------------------------------------
*
* Ns_SockBindUdp --
*
*      Create a UDP socket and bind it to the passed-in address.
*
* Results:
*      Socket descriptor or -1 on error.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

558NS_SOCKETint
559Ns_SockBindUdp(const struct sockaddr *saPtr, bool_Bool reusePort)
560{
  NS_SOCKETint sock;
  int       n = 1;

  NS_NONNULL_ASSERT(saPtr != NULL)((void) (0));

  sock = (NS_SOCKETint)socket((int)saPtr->sa_family, SOCK_DGRAMSOCK_DGRAM, 0);

  if (sock != NS_INVALID_SOCKET(-1)
      && (setsockopt(sock, SOL_SOCKET1, SO_REUSEADDR2, (char*)&n, (socklen_t)sizeof(n)) == -1
          || setsockopt(sock, SOL_SOCKET1, SO_BROADCAST6, (char*)&n, (socklen_t)sizeof(n)) == -1
          || bind(sock, saPtr, Ns_SockaddrGetSockLen(saPtr)) == -1)
      ) {
      ns_sockerrno_t err = ns_sockerrno(*__errno_location ());

      (void)ns_sockcloseclose(sock);
      sock = NS_INVALID_SOCKET(-1);
      Ns_SetSockErrno(err);
  } else {
579#if defined(SO_REUSEPORT15)
      if (reusePort) {
          int optval = 1;
          setsockopt(sock, SOL_SOCKET1, SO_REUSEPORT15, &optval, (socklen_t)sizeof(optval));
      }
584#endif
  }

  return sock;
588}

590
591/*
*----------------------------------------------------------------------
*
* Ns_SockBindUnix --
*
*      Create a Unix-domain socket and bind it to the passed-in
*      file path.
*
* Results:
*      Socket descriptor or -1 on error.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

608NS_SOCKETint
609Ns_SockBindUnix(const char *path, int socktype, unsigned short mode)
610{
611#ifdef _WIN32
  return NS_INVALID_SOCKET(-1);
613#else
  NS_SOCKETint sock;
  struct sockaddr_un addr;
  size_t pathLength;

  NS_NONNULL_ASSERT(path != NULL)((void) (0));
  pathLength = strlen(path);

  if (pathLength >= sizeof(addr.sun_path)) {
      Ns_Log(Error, "provided path exceeds maximum length: %s\n", path);
      return NS_INVALID_SOCKET(-1);
  }

  memset(&addr, 0, sizeof(addr));
  addr.sun_family = AF_UNIX1;
  memcpy(addr.sun_path, path, pathLength + 1);
  unlink(path);

  sock = socket(AF_UNIX1, socktype > 0 ? socktype : SOCK_STREAMSOCK_STREAM, 0);
  /*
   * There is a small race condition below, since the permissions on
   * the socket are checked not in an atomic fashion and might be
   * changed immediately after the bind operation. Unfortunately,
   * fchmod is not portable.
   */
  if (sock != NS_INVALID_SOCKET(-1)
      && (bind(sock, (struct sockaddr *) &addr, sizeof(addr)) == -1
          || (mode != 0u && chmod(path, mode) == -1))
      ) {
      ns_sockerrno_t err = errno(*__errno_location ());

      (void)ns_sockcloseclose(sock);
      sock = NS_INVALID_SOCKET(-1);
      Ns_SetSockErrno(err);
  }

  return sock;
650#endif /* _WIN32 */
651}

653
654/*
*----------------------------------------------------------------------
*
* Ns_SockBindRaw --
*
*      Create a raw socket. It does not bind, hence the call name
*      is not entirely correct but is on-pair with other types of
*      sockets (udp, tcp, unix).
*
* Results:
*      Socket descriptor or -1 on error.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

672NS_SOCKETint
673Ns_SockBindRaw(int proto)
674{
  NS_SOCKETint sock;

  sock = (NS_SOCKETint)socket(AF_INET2, SOCK_RAWSOCK_RAW, proto);

  if (sock == NS_INVALID_SOCKET(-1)) {
      ns_sockerrno_t err = ns_sockerrno(*__errno_location ());

      Ns_SetSockErrno(err);
  }

  return sock;
686}

688
689/*
*----------------------------------------------------------------------
*
* NsInitBinder --
*
*      Initialize the pre-bind tables.
*
* Results:
*      None.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

705void
706NsInitBinder(void)
707{
  Ns_MutexInit(&lock);
  Ns_MutexSetName(&lock, "binder");

  Tcl_InitHashTable(&preboundTcp, (int)(sizeof(struct NS_SOCKADDR_STORAGEsockaddr_storage) / sizeof(int)));
  Tcl_InitHashTable(&preboundUdp, (int)(sizeof(struct NS_SOCKADDR_STORAGEsockaddr_storage) / sizeof(int)));
  Tcl_InitHashTable(&preboundRaw, TCL_ONE_WORD_KEYS(1));
  Tcl_InitHashTable(&preboundUnix, TCL_STRING_KEYS(0));
715}

717
718/*
*----------------------------------------------------------------------
*
* NsPreBind --
*
*      Pre-bind any requested ports (called from Ns_Main at startup).
*
* Results:
*      None.
*
* Side effects:
*      May pre-bind to one or more ports.
*
*----------------------------------------------------------------------
*/

734Ns_ReturnCode
735NsPreBind(const char *args, const char *file)
736{
  Ns_ReturnCode status = NS_OK;

739#ifndef _WIN32

  if (args != NULL((void*)0)) {
      status = PrebindSockets(args);
  }

  /*
   * Check, if the bind options were provided via file. If so, parse
   * and interpret it.
   */
  if (status == NS_OK && file != NULL((void*)0)) {
      Tcl_Channel chan = Tcl_OpenFileChannel(NULL((void*)0), file, "r", 0);

      if (chan == NULL((void*)0)) {
          Ns_Log(Error, "NsPreBind: can't open file '%s': '%s'", file,
                 strerror(Tcl_GetErrno()));
      } else {
          Tcl_DString line;

          Tcl_DStringInit(&line);
          while (Tcl_Eof(chan) == 0) {
              Tcl_DStringSetLength(&line, 0);
              if (Tcl_Gets(chan, &line) > 0) {
                  status = PrebindSockets(Tcl_DStringValue(&line)((&line)->string));
                  if (status != NS_OK) {
                      break;
                  }
              }
          }
          Tcl_DStringFree(&line);
          Tcl_Close(NULL((void*)0), chan);
      }
  }
772#endif /* _WIN32 */
  return status;
774}

776
777/*
*----------------------------------------------------------------------
*
* NsClosePreBound --
*
*      Close remaining pre-bound sockets not consumed by anybody.
*
* Results:
*      None.
*
* Side effects:
*      Pre-bind hash-tables are cleaned and re-initialized.
*
*----------------------------------------------------------------------
*/

793void
794NsClosePreBound(void)
795{
796#ifndef _WIN32
  Tcl_HashEntry         *hPtr;
  Tcl_HashSearch         search;
  NS_SOCKETint              sock;
  struct sockaddr       *saPtr;

  Ns_MutexLock(&lock);

  /*
   * Close TCP sockets
   */
  hPtr = Tcl_FirstHashEntry(&preboundTcp, &search);
  while (hPtr != NULL((void*)0)) {
      saPtr = (struct sockaddr *)Tcl_GetHashKey(&preboundTcp, hPtr)((void *) (((&preboundTcp)->keyType == (1) || (&preboundTcp
)->keyType == (-1)) ? (hPtr)->key.oneWordValue : (hPtr)
->key.string));
      PrebindCloseSockets("tcp", saPtr, Tcl_GetHashValue(hPtr)((hPtr)->clientData));
      Tcl_DeleteHashEntry(hPtr);
      hPtr = Tcl_NextHashEntry(&search);
  }
  Tcl_DeleteHashTable(&preboundTcp);
  Tcl_InitHashTable(&preboundTcp, sizeof(struct NS_SOCKADDR_STORAGEsockaddr_storage)/sizeof(int));

  /*
   * Close UDP sockets
   */
  hPtr = Tcl_FirstHashEntry(&preboundUdp, &search);
  while (hPtr != NULL((void*)0)) {
      saPtr = (struct sockaddr *)Tcl_GetHashKey(&preboundUdp, hPtr)((void *) (((&preboundUdp)->keyType == (1) || (&preboundUdp
)->keyType == (-1)) ? (hPtr)->key.oneWordValue : (hPtr)
->key.string));
      PrebindCloseSockets("udp", saPtr, Tcl_GetHashValue(hPtr)((hPtr)->clientData));
      Tcl_DeleteHashEntry(hPtr);
      hPtr = Tcl_NextHashEntry(&search);
  }
  Tcl_DeleteHashTable(&preboundUdp);
  Tcl_InitHashTable(&preboundUdp, sizeof(struct NS_SOCKADDR_STORAGEsockaddr_storage)/sizeof(int));

  /*
   * Close raw sockets
   */
  hPtr = Tcl_FirstHashEntry(&preboundRaw, &search);
  while (hPtr != NULL((void*)0)) {
      int port;

      sock = PTR2NSSOCK(Tcl_GetHashKey(&preboundRaw, hPtr))((int)(intptr_t)(((void *) (((&preboundRaw)->keyType ==
 (1) || (&preboundRaw)->keyType == (-1)) ? (hPtr)->
key.oneWordValue : (hPtr)->key.string))));
      port = PTR2INT(Tcl_GetHashValue(hPtr))((int)(intptr_t)(((hPtr)->clientData)));
      Ns_Log(Warning, "prebind: closed unused raw socket: %d = %d",
             port, sock);
      (void)ns_sockcloseclose(sock);
      Tcl_DeleteHashEntry(hPtr);
      hPtr = Tcl_NextHashEntry(&search);
  }
  Tcl_DeleteHashTable(&preboundRaw);
  Tcl_InitHashTable(&preboundRaw, TCL_ONE_WORD_KEYS(1));

  /*
   * Close Unix-domain sockets
   */
  hPtr = Tcl_FirstHashEntry(&preboundUnix, &search);
  while (hPtr != NULL((void*)0)) {
      const char *addr = (char *) Tcl_GetHashKey(&preboundUnix, hPtr)((void *) (((&preboundUnix)->keyType == (1) || (&preboundUnix
)->keyType == (-1)) ? (hPtr)->key.oneWordValue : (hPtr)
->key.string));

      sock = PTR2NSSOCK(Tcl_GetHashValue(hPtr))((int)(intptr_t)(((hPtr)->clientData)));
      Ns_Log(Warning, "prebind: closed unused Unix-domain socket: [%s] %d",
             addr, sock);
      (void)ns_sockcloseclose(sock);
      Tcl_DeleteHashEntry(hPtr);
      hPtr = Tcl_NextHashEntry(&search);
  }
  Tcl_DeleteHashTable(&preboundUnix);
  Tcl_InitHashTable(&preboundUnix, TCL_STRING_KEYS(0));

  Ns_MutexUnlock(&lock);
866#endif /* _WIN32 */
867}

869
870/*
*----------------------------------------------------------------------
*
* PreBind --
*
*      Pre-bind to one or more ports in a comma-separated list:
*
*          addr:port[/protocol][#number]
*          port[/protocol][#number]
*          0/icmp[/count]
*          /path[|mode]
*
*       protocol: tcp|udp
*       mode: mode bits as used by "chmod" specified as octal value
*
*      Example: nsd -c -b /tmp/foo,localhost:9999/tcp#2,localhost:9998,udp:9997
* Results:
*      None.
*
* Side effects:
*      Sockets are left in bound state for later listen
*      in Ns_SockListen*().
*
*----------------------------------------------------------------------
*/
895#ifndef _WIN32

897static Ns_ReturnCode
898PrebindSockets(const char *spec)
899{
  Tcl_HashEntry         *hPtr;
  int                    isNew = 0, specCount = 0;
  char                  *next, *line, *lines;
  Ns_ReturnCode          status = NS_OK;
  struct NS_SOCKADDR_STORAGEsockaddr_storage sa;
  struct sockaddr       *saPtr = (struct sockaddr *)&sa;

  NS_NONNULL_ASSERT(spec != NULL)((void) (0));

  line = lines = ns_strdup(spec);

  for (; line != NULL((void*)0); line = next) {
      const char     *proto;
      char           *addr, *p, *str = NULL((void*)0), *end;
      unsigned short  port = 0u;
      long            reuses;
      struct Prebind *pPtr;

      specCount ++;
      /*
       * Find the next comma separated token.
       */
      next = strchr(line, INTCHAR(',')((int)((unsigned char)((',')))));
      if (next != NULL((void*)0)) {
          *next++ = '\0';
      }

      /*
       * Set default proto and addr.
       */
      proto = "tcp";
      addr = (char *)NS_IP_UNSPECIFIED"::";
      reuses = 1;

      /*
       * Parse reuses count
       */
      p = strrchr(line, INTCHAR('#')((int)((unsigned char)(('#')))));
      if (p != NULL((void*)0)) {
          *p++ = '\0';
          reuses = strtol(p, NULL((void*)0), 10);
          if (reuses < 1) {
              Ns_Log(Warning, "prebind: ignore invalid number of protoport reuses: '%s'", p);
              reuses = 1;
          }
      }

      /*
       * Parse "addr:port" or "port"
       *
       *    addr:port[/protocol][#number]
       *    port[/protocol][#number]
       *    0/icmp[/count]
       */
      {
          char *portStr;
          bool_Bool  hostParsedOk = Ns_HttpParseHost2(line, NS_TRUE1, &addr, &portStr, &end);

          if (hostParsedOk && line != end && addr != portStr ) {
              long l;

              if (portStr != NULL((void*)0)) {
                  l = strtol(portStr, NULL((void*)0), 10);
              } else {
                  assert(addr != NULL)((void) (0));
                  l = strtol(addr, NULL((void*)0), 10);
                  addr = (char *)NS_IP_UNSPECIFIED"::";
              }
              port = (l >= 0) ? (unsigned short)l : 0u;

              /*
               * Parse protocol
               */
              if (*line != '/' && (str = strchr(line, INTCHAR('/')((int)((unsigned char)(('/')))))) != NULL((void*)0)) {
                  *str++ = '\0';
                  proto = str;
              }
          } else {
              Ns_Log(Debug, "prebind: line <%s> was not parsed ok, must be UNIX", line);
              proto = "unix";
          }
          /*
           * Continue parsing after "addr:port|port"
           */
          line = end;
      }

      /*
       * TCP
       */
      Ns_Log(Notice, "prebind: try proto %s addr %s port %d reuses %ld",
             proto, addr, port, reuses);

      if (STREQ(proto, "tcp")(((*(proto)) == (*("tcp"))) && (strcmp((proto),("tcp"
)) == 0)) && port > 0) {
          if (Ns_GetSockAddr(saPtr, addr, port) != NS_OK) {
              Ns_Log(Error, "prebind: tcp: invalid address: [%s]:%d", addr, port);
              continue;
          }
          hPtr = Tcl_CreateHashEntry(&preboundTcp, (char *) &sa, &isNew)(*((&preboundTcp)->createProc))(&preboundTcp, (const
 char *)((char *) &sa), &isNew);
          if (isNew == 0) {
              Ns_Log(Error, "prebind: tcp: duplicate entry: [%s]:%d",
                     addr, port);
              continue;
          }

          Ns_LogSockaddr(Notice, "prebind adds", (const struct sockaddr *)saPtr);

          pPtr = PrebindAlloc(proto, (size_t)reuses, saPtr);
          if (pPtr == NULL((void*)0)) {
              Tcl_DeleteHashEntry(hPtr);
              status = NS_ERROR;
              break;
          }
          Tcl_SetHashValue(hPtr, pPtr)((hPtr)->clientData = (ClientData) (pPtr));
          Ns_Log(Notice, "prebind: tcp: [%s]:%d", addr, port);
      }

      /*
       * UDP
       */
      if (STREQ(proto, "udp")(((*(proto)) == (*("udp"))) && (strcmp((proto),("udp"
)) == 0)) && port > 0) {
          if (Ns_GetSockAddr(saPtr, addr, port) != NS_OK) {
              Ns_Log(Error, "prebind: udp: invalid address: [%s]:%d",
                     addr, port);
              continue;
          }
          hPtr = Tcl_CreateHashEntry(&preboundUdp, (char *)saPtr, &isNew)(*((&preboundUdp)->createProc))(&preboundUdp, (const
 char *)((char *)saPtr), &isNew);
          if (isNew == 0) {
              Ns_Log(Error, "prebind: udp: duplicate entry: [%s]:%d",
                     addr, port);
              continue;
          }
          pPtr = PrebindAlloc(proto, (size_t)reuses, saPtr);
          if (pPtr == NULL((void*)0)) {
              Tcl_DeleteHashEntry(hPtr);
              status = NS_ERROR;
              break;
          }
          Tcl_SetHashValue(hPtr, pPtr)((hPtr)->clientData = (ClientData) (pPtr));
          Ns_Log(Notice, "prebind: udp: [%s]:%d", addr, port);
      }

      /*
       * ICMP
       *
       * Example:
       *   0/icmp[/count]
       */
      if (strncmp(proto, "icmp", 4u) == 0) {
          long count = 1;

          /*
           * Parse count
           */
          if (str != NULL((void*)0)) {
              str = strchr(str, INTCHAR('/')((int)((unsigned char)(('/')))));
              if (str != NULL((void*)0)) {
                  *(str++) = '\0';
                  count = strtol(str, NULL((void*)0), 10);
              }
          }
          while (count--) {
              NS_SOCKETint sock = Ns_SockBindRaw(IPPROTO_ICMPIPPROTO_ICMP);
              if (sock == NS_INVALID_SOCKET(-1)) {
                  Ns_Log(Error, "prebind: bind error for icmp: %s", strerror(errno(*__errno_location ())));
                  continue;
              }
              hPtr = Tcl_CreateHashEntry(&preboundRaw, NSSOCK2PTR(sock), &isNew)(*((&preboundRaw)->createProc))(&preboundRaw, (const
 char *)(((void *)(intptr_t)(sock))), &isNew);
              if (isNew == 0) {
                  Ns_Log(Error, "prebind: icmp: duplicate entry");
                  (void)ns_sockcloseclose(sock);
                  continue;
              }
              Tcl_SetHashValue(hPtr, IPPROTO_ICMP)((hPtr)->clientData = (ClientData) (IPPROTO_ICMP));
              Ns_Log(Notice, "prebind: icmp: %d", sock);
          }
      }

      /*
       * Unix-domain socket
       * a line starting with a '/' means: path, which
       * implies a unix-domain socket.
       */
      if (STREQ(proto, "unix")(((*(proto)) == (*("unix"))) && (strcmp((proto),("unix"
)) == 0))) {
          if (Ns_PathIsAbsolute(line) == NS_TRUE1) {
              unsigned short mode = 0u;
              NS_SOCKETint      sock;

              Ns_Log(Debug, "prebind: Unix-domain socket <%s>\n", line);

              /*
               * Parse mode
               */
              str = strchr(line, INTCHAR('|')((int)((unsigned char)(('|')))));
              if (str != NULL((void*)0)) {
                  long l;

                  *(str++) = '\0';
                  l = strtol(str, NULL((void*)0), 8);
                  if (l > 0) {
                      mode = (unsigned short)l;
                  } else {
                      Ns_Log(Error, "prebind: unix: ignore invalid mode value: %s", line);
                  }
              }
              hPtr = Tcl_CreateHashEntry(&preboundUnix, (char *) line, &isNew)(*((&preboundUnix)->createProc))(&preboundUnix, (const
 char *)((char *) line), &isNew);
              if (isNew == 0) {
                  Ns_Log(Error, "prebind: unix: duplicate entry: %s", line);
                  continue;
              }
              sock = Ns_SockBindUnix(line, SOCK_STREAMSOCK_STREAM, mode);
              if (sock == NS_INVALID_SOCKET(-1)) {
                  Ns_Log(Error, "prebind: unix: %s: %s", proto, strerror(errno(*__errno_location ())));
                  Tcl_DeleteHashEntry(hPtr);
                  continue;
              }
              Tcl_SetHashValue(hPtr, NSSOCK2PTR(sock))((hPtr)->clientData = (ClientData) (((void *)(intptr_t)(sock
))));
              Ns_Log(Notice, "prebind: unix: %s = %d", line, sock);
          } else {
              Ns_Log(Warning, "prebind: invalid entry #%d: '%s'", specCount, spec);
          }
      }
  }
  ns_free(lines);

  return status;
1126}
1127#endif

1129
1130/*
*----------------------------------------------------------------------
*
* Ns_SockBinderListen --
*
*      Create a new TCP/UDP/Unix socket bound to the specified port
*      and listening for new connections.
*
*      The following types are defined:
*      T - TCP socket
*      U - UDP socket
*      D - Unix domain socket
*      R - raw socket
*
* Results:
*      Socket descriptor or -1 on error.
*
* Side effects:
*      None.
*
*----------------------------------------------------------------------
*/

1153NS_SOCKETint
1154Ns_SockBinderListen(char type, const char *address, unsigned short port, int options)
1155{
  NS_SOCKETint     sock = NS_INVALID_SOCKET(-1);
1157#ifndef _WIN32
  ns_sockerrno_t err = 0;
  ssize_t       n;
  char          data[NS_IPADDR_SIZE46];
  struct msghdr msg;
  struct iovec  iov[4];

  if (address == NULL((void*)0)) {
      address = NS_IP_UNSPECIFIED"::";
  }

  /*
   * Build and send message.
   */
  iov[0].iov_base = (void*) &options;
  iov[0].iov_len = sizeof(options);
  iov[1].iov_base = (void*) &port;
  iov[1].iov_len = sizeof(port);
  iov[2].iov_base = (void*) &type;
  iov[2].iov_len = sizeof(type);
  iov[3].iov_base = (void*) data;
  iov[3].iov_len = sizeof(data);

  strncpy(data, address, sizeof(data)-1);
  memset(&msg, 0, sizeof(msg));
  msg.msg_iov = iov;
  msg.msg_iovlen = 4;
  n = sendmsg(binderRequest[1], &msg, 0);
  if (n != REQUEST_SIZE(sizeof(int) + sizeof(int) + sizeof(int) + 46)) {
      Ns_Log(Error, "Ns_SockBinderListen: sendmsg() failed: sent %" PRIdz"zd" " bytes, '%s'",
             n, strerror(errno(*__errno_location ())));
      return -1;
  }

  /*
   * Revive reply.
   */
  iov[0].iov_base = (void*) &err;
  iov[0].iov_len = sizeof(int);
  memset(&msg, 0, sizeof(msg));
  msg.msg_iov = iov;
  msg.msg_iovlen = 1;
1199#ifdef HAVE_CMMSG1
  msg.msg_control = (void *) data;
  msg.msg_controllen = sizeof(data);
1202#else
  msg.msg_accrights = (void*) &sock;
  msg.msg_accrightslen = sizeof(sock);
1205#endif
  n = recvmsg(binderResponse[0], &msg, 0);
  if (n != RESPONSE_SIZE(sizeof(int))) {
      Ns_Log(Error, "Ns_SockBinderListen: recvmsg() failed: recv %" PRIdz"zd" " bytes, '%s'",
             n, strerror(errno(*__errno_location ())));
      return -1;
  }

1213#ifdef HAVE_CMMSG1
  {
    struct cmsghdr *c = CMSG_FIRSTHDR(&msg)((size_t) (&msg)->msg_controllen >= sizeof (struct cmsghdr
) ? (struct cmsghdr *) (&msg)->msg_control : (struct cmsghdr
 *) 0);
    if ((c != NULL((void*)0)) && c->cmsg_type == SCM_RIGHTSSCM_RIGHTS) {
        int *ptr;
        /*
         * Use memcpy to avoid alignment problems.
         */
        memcpy(&ptr, CMSG_DATA(c)((c)->__cmsg_data), sizeof(int*));
        sock = *ptr;
    }
  }
1225#endif

  /*
   * Close-on-exec, while set in the binder process by default
   * with Ns_SockBind, is not transmitted in the sendmsg and
   * must be set again.
   */

  if (sock != NS_INVALID_SOCKET(-1) && Ns_CloseOnExec(sock) != NS_OK) {
      (void)ns_sockcloseclose(sock);
      sock = NS_INVALID_SOCKET(-1);
  }
  if (err == 0) {
      Ns_Log(Notice, "Ns_SockBinderListen: listen(%s,%hu) = %d",
             address, port, sock);
  } else {
      Ns_SetSockErrno(err);
      sock = NS_INVALID_SOCKET(-1);
      Ns_Log(Error, "Ns_SockBinderListen: listen(%s,%hu) failed: '%s'",
             address, port, ns_sockstrerrorstrerror(ns_sockerrno(*__errno_location ())));
  }
1246#endif /* _WIN32 */
  return sock;
1248}

1250
1251/*
*----------------------------------------------------------------------
*
* NsForkBinder --
*
*      Fork of the bind/listen process.  This routine is called
*      by main() when the server starts as root.
*
* Results:
*      None.
*
* Side effects:
*
*      The binderRunning, binderRequest, binderResponse static
*      variables are updated.
*
*----------------------------------------------------------------------
*/

1270void
1271NsForkBinder(void)
1272{
1273#ifndef _WIN32
  pid_t pid1;
  int status;

  /*
   * Create two socket pipes, one for sending the request and one for
   * receiving the response.
   */

  if (ns_sockpair(binderRequest) != 0 || ns_sockpair(binderResponse) != 0) {
1
Assuming the condition is false→
2
←
Assuming the condition is false→
3
←
Taking false branch→
      Ns_Fatal("NsForkBinder: ns_sockpair() failed: '%s'", strerror(errno(*__errno_location ())));
  }

  /*
   * Double-fork and run as a binder until the socket pairs are
   * closed.  The server double forks to avoid problems waiting for a
   * child root process after the parent does a setuid(), something
   * which appears to confuse the process-based Linux and SGI threads.
   */

  pid1 = ns_fork();
  if (pid1 < 0) {
4
←
Assuming 'pid1' is >= 0→
5
←
Taking false branch→
      Ns_Fatal("NsForkBinder: fork() failed: '%s'", strerror(errno(*__errno_location ())));

  } else if (pid1 == 0) {
6
←
Assuming 'pid1' is equal to 0→
7
←
Taking true branch→
      pid_t pid2;

      pid2 = ns_fork();
      if (pid2 < 0) {
8
←
Assuming 'pid2' is >= 0→
9
←
Taking false branch→
          Ns_Fatal("NsForkBinder: fork() failed: '%s'", strerror(errno(*__errno_location ())));
      } else if (pid2 == 0) {
10
←
Assuming 'pid2' is equal to 0→
11
←
Taking true branch→
          /*
           * Grandchild process.
           */
          (void)ns_sockcloseclose(binderRequest[1]);
          (void)ns_sockcloseclose(binderResponse[0]);
          Binder();
12
←
Calling 'Binder'→
      } else {
          /*
           * Child process.
           */
      }
      exit(0);

  } else {
      /*
       * Parent process.
       */
      if (Ns_WaitForProcess(pid1, &status) != NS_OK) {
          Ns_Fatal("NsForkBinder: Ns_WaitForProcess(%d) failed: '%s'",
                   pid1, strerror(errno(*__errno_location ())));
      } else if (status != 0) {
          Ns_Fatal("NsForkBinder: process %d exited with nonzero status: %d",
                   pid1, status);
      }
      binderRunning = NS_TRUE1;
  }
1330#endif /* _WIN32 */
1331}

1333
1334/*
*----------------------------------------------------------------------
*
* NsStopBinder --
*
*      Close the socket to the binder after startup.  This is done
*      to avoid a possible security risk of binding to privileged
*      ports after startup.
*
* Results:
*      None.
*
* Side effects:
*      Binder process will exit.
*
*----------------------------------------------------------------------
*/

1352void
1353NsStopBinder(void)
1354{
  if (binderRunning) {
      (void)ns_sockcloseclose(binderRequest[1]);
      (void)ns_sockcloseclose(binderResponse[0]);
      (void)ns_sockcloseclose(binderRequest[0]);
      (void)ns_sockcloseclose(binderResponse[1]);
      binderRunning = NS_FALSE0;
  }
1362}

1364
1365/*
*----------------------------------------------------------------------
*
* Binder --
*
*      Child process bind/listen loop.
*
* Results:
*      None.
*
* Side effects:
*      Sockets are created and sent to the parent on request.
*
*----------------------------------------------------------------------
*/

1381#ifndef _WIN32
1382static void
1383Binder(void)
1384{
  int            options, err, sock;
  unsigned short port;
  ssize_t        n;
  char           type, address[NS_IPADDR_SIZE46];
  struct msghdr  msg;
  struct iovec   iov[4];

1392#ifdef HAVE_CMMSG1
  struct cmsghdr *c;
1394#endif

  Ns_Log(Notice, "binder: started");
  Ns_ThreadSetName("binder");

  /*
   * Endlessly listen for socket bind requests.
   */

  for (;;) {
13
←
Loop condition is true.  Entering loop body→
      /*
       * Receive a message with the following contents.
       */
      iov[0].iov_base = (void*) &options;
      iov[0].iov_len = sizeof(options);
      iov[1].iov_base = (void*) &port;
      iov[1].iov_len = sizeof(port);
      iov[2].iov_base = (void*) &type;
      iov[2].iov_len = sizeof(type);
      iov[3].iov_base = (void*) address;
      iov[3].iov_len = sizeof(address);
      memset(&msg, 0, sizeof(msg));
      msg.msg_iov = iov;
      msg.msg_iovlen = 4;
      options = 0;
      port = 0u;
      type = '\0';
      err = 0;
      do {
15
←
Loop condition is false.  Exiting loop→
          n = recvmsg(binderRequest[0], &msg, 0);
      } while (n == -1 && errno(*__errno_location ()) == NS_EINTR4);
14
←
Assuming the condition is false→
      if (n == 0) {
16
←
Assuming 'n' is not equal to 0→
17
←
Taking false branch→
          break;
      }
      if (n != REQUEST_SIZE(sizeof(int) + sizeof(int) + sizeof(int) + 46)) {
18
←
Assuming the condition is false→
19
←
Taking false branch→
          Ns_Fatal("binder: recvmsg() failed: recv %" PRIdz"zd" " bytes, '%s'", n, strerror(errno(*__errno_location ())));
      }

      /*
       * NB: Due to a bug in Solaris the child process must
       * call both bind() and listen() before returning the
       * socket.  All other Unix versions would actually allow
       * just performing the bind() in the child and allowing
       * the parent to perform the listen().
       */
      switch (type) {
20
←
Control jumps to 'case 85:'  at line 1440→
      case 'U':
          sock = Ns_SockListenUdp(address, port, NS_FALSE0);
21
←
Calling 'Ns_SockListenUdp'→
          break;
      case 'D':
          sock = Ns_SockListenUnix(address, options, port);
          break;
      case 'R':
          sock = Ns_SockListenRaw(options);
          break;
      case 'T':
      default:
          sock = Ns_SockListenEx(address, port, options, NS_FALSE0);
      }
      Ns_Log(Notice, "bind type %c addr %s port %d options %d to socket %d",
             type, address, port, options, sock);

      if (sock < 0) {
          err = errno(*__errno_location ());
      }

      iov[0].iov_base = (void*) &err;
      iov[0].iov_len = sizeof(err);
      memset(&msg, 0, sizeof(msg));
      msg.msg_iov = iov;
      msg.msg_iovlen = 1;

      if (sock != -1) {
1467#ifdef HAVE_CMMSG1
          int *pfd;

          msg.msg_control = address;
          msg.msg_controllen = sizeof(address);
          c = CMSG_FIRSTHDR(&msg)((size_t) (&msg)->msg_controllen >= sizeof (struct cmsghdr
) ? (struct cmsghdr *) (&msg)->msg_control : (struct cmsghdr
 *) 0);
          c->cmsg_level = SOL_SOCKET1;
          c->cmsg_type  = SCM_RIGHTSSCM_RIGHTS;
          /*
           * Use memcpy to avoid alignment problems.
           */
          memcpy(&pfd, CMSG_DATA(c)((c)->__cmsg_data), sizeof(int*));

          *pfd = sock;
          c->cmsg_len = CMSG_LEN(sizeof(int))((((sizeof (struct cmsghdr)) + sizeof (size_t) - 1) & (size_t
) ~(sizeof (size_t) - 1)) + (sizeof(int)));
          msg.msg_controllen = c->cmsg_len;
1483#else
          msg.msg_accrights = (void*) &sock;
          msg.msg_accrightslen = sizeof(sock);
1486#endif
      }

      do {
          n = sendmsg(binderResponse[1], &msg, 0);
      } while (n == -1 && errno(*__errno_location ()) == NS_EINTR4);
      if (n != RESPONSE_SIZE(sizeof(int))) {
          Ns_Fatal("binder: sendmsg() failed: sent %" PRIdz"zd" " bytes, '%s'", n, strerror(errno(*__errno_location ())));
      }
      if (sock != -1) {
          /*
           * Close the socket as it won't be needed in the child.
           */
          (void)ns_sockcloseclose(sock);
      }
  }
  Ns_Log(Notice, "binder: stopped");
1503}
1504#endif /* _WIN32 */

1506/*
* Local Variables:
* mode: c
* c-basic-offset: 4
* fill-column: 72
* indent-tabs-mode: nil
* End:
*/