Merge branch 'chunk-mmap'

Introduces file mmap/munmap() wrappers and provides a fallback if mmap() is not
supported. Replaces all mmap() uses by the new functions.

configure.ac

@@ -495,7 +495,7 @@ AC_CHECK_FUNC(
 )
 
 AC_CHECK_FUNCS(prctl mallinfo getpass closefrom getpwnam_r getgrnam_r getpwuid_r)
-AC_CHECK_FUNCS(fmemopen funopen)
+AC_CHECK_FUNCS(fmemopen funopen mmap)
 
 AC_CHECK_HEADERS(sys/sockio.h glob.h net/if_tun.h linux/fib_rules.h)
 AC_CHECK_HEADERS(net/pfkeyv2.h netipsec/ipsec.h netinet6/ipsec.h linux/udp.h)

src/libcharon/plugins/radattr/radattr_listener.c

@@ -19,7 +19,6 @@
 #include <sys/stat.h>
 #include <unistd.h>
 #include <fcntl.h>
-#include <sys/mman.h>
 #include <errno.h>
 
 #include <daemon.h>
@@ -110,10 +109,7 @@ static void add_radius_attribute(private_radattr_listener_t *this,
 		identification_t *id;
 		auth_cfg_t *auth;
 		char path[PATH_MAX];
-		chunk_t data;
+		chunk_t *data;
-		struct stat sb;
-		void *addr;
-		int fd;
 
 		auth = ike_sa->get_auth_cfg(ike_sa, TRUE);
 		id = auth->get(auth, AUTH_RULE_EAP_IDENTITY);
@@ -123,44 +119,16 @@ static void add_radius_attribute(private_radattr_listener_t *this,
 		}
 
 		snprintf(path, sizeof(path), "%s/%Y", this->dir, id);
-		fd = open(path, O_RDONLY);
+		data = chunk_map(path, FALSE);
-		if (fd != -1)
+		if (data)
 		{
-			if (fstat(fd, &sb) != -1)
+			if (data->len >= 2)
 			{
-				if (sb.st_size <= MAX_ATTR_SIZE)
+				DBG1(DBG_CFG, "adding RADIUS %N attribute",
-				{
+					 radius_attribute_type_names, data->ptr[0]);
-					addr = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
+				message->add_notify(message, FALSE, RADIUS_ATTRIBUTE, *data);
-					if (addr != MAP_FAILED)
-					{
-						data = chunk_create(addr, sb.st_size);
-						if (data.len >= 2)
-						{
-							DBG1(DBG_CFG, "adding RADIUS %N attribute",
-								 radius_attribute_type_names, data.ptr[0]);
-							message->add_notify(message, FALSE,
-												RADIUS_ATTRIBUTE, data);
-						}
-						munmap(addr, sb.st_size);
-					}
-					else
-					{
-						DBG1(DBG_CFG, "mapping RADIUS attribute '%s' failed: %s",
-							 path, strerror(errno));
-					}
-				}
-				else
-				{
-					DBG1(DBG_CFG, "RADIUS attribute '%s' exceeds size limit",
-						 path);
-				}
 			}
-			else
+			chunk_unmap(data);
-			{
-				DBG1(DBG_CFG, "fstat RADIUS attribute '%s' failed: %s",
-					 path, strerror(errno));
-			}
-			close(fd);
 		}
 		else
 		{

src/libcharon/plugins/stroke/stroke_cred.c

@@ -18,7 +18,6 @@
 #include <sys/stat.h>
 #include <limits.h>
 #include <libgen.h>
-#include <sys/mman.h>
 #include <fcntl.h>
 #include <errno.h>
 #include <unistd.h>
@@ -521,7 +520,16 @@ METHOD(stroke_cred_t, cache_cert, void,
 
 			if (cert->get_encoding(cert, CERT_ASN1_DER, &chunk))
 			{
-				chunk_write(chunk, buf, "crl", 022, TRUE);
+				if (chunk_write(chunk, buf, 022, TRUE))
+				{
+					DBG1(DBG_CFG, "  written crl file '%s' (%d bytes)",
+						 buf, chunk.len);
+				}
+				else
+				{
+					DBG1(DBG_CFG, "  writing crl file '%s' failed: %s",
+						 buf, strerror(errno));
+				}
 				free(chunk.ptr);
 			}
 		}
@@ -1092,46 +1100,24 @@ static bool load_shared(mem_cred_t *secrets, chunk_t line, int line_nr,
 static void load_secrets(private_stroke_cred_t *this, mem_cred_t *secrets,
 						 char *file, int level, FILE *prompt)
 {
-	int line_nr = 0, fd;
+	int line_nr = 0;
-	chunk_t src, line;
+	chunk_t *src, line;
-	struct stat sb;
-	void *addr;
 
 	DBG1(DBG_CFG, "loading secrets from '%s'", file);
-	fd = open(file, O_RDONLY);
+	src = chunk_map(file, FALSE);
-	if (fd == -1)
+	if (!src)
 	{
 		DBG1(DBG_CFG, "opening secrets file '%s' failed: %s", file,
 			 strerror(errno));
 		return;
 	}
-	if (fstat(fd, &sb) == -1)
-	{
-		DBG1(DBG_LIB, "getting file size of '%s' failed: %s", file,
-			 strerror(errno));
-		close(fd);
-		return;
-	}
-	if (sb.st_size == 0)
-	{	/* skip empty files, as mmap() complains */
-		close(fd);
-		return;
-	}
-	addr = mmap(NULL, sb.st_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-	if (addr == MAP_FAILED)
-	{
-		DBG1(DBG_LIB, "mapping '%s' failed: %s", file, strerror(errno));
-		close(fd);
-		return;
-	}
-	src = chunk_create(addr, sb.st_size);
 
 	if (!secrets)
 	{
 		secrets = mem_cred_create();
 	}
 
-	while (fetchline(&src, &line))
+	while (fetchline(src, &line))
 	{
 		chunk_t ids, token;
 		shared_key_type_t type;
@@ -1272,8 +1258,7 @@ static void load_secrets(private_stroke_cred_t *this, mem_cred_t *secrets,
 			break;
 		}
 	}
-	munmap(addr, sb.st_size);
+	chunk_unmap(src);
-	close(fd);
 
 	if (level == 0)
 	{	/* replace secrets in active credential set */

src/libfast/fast_request.c

@@ -23,7 +23,6 @@
 #include <pthread.h>
 #include <string.h>
 #include <unistd.h>
-#include <sys/mman.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 
@@ -294,31 +293,17 @@ METHOD(fast_request_t, serve, void,
 METHOD(fast_request_t, sendfile, bool,
 	private_fast_request_t *this, char *path, char *mime)
 {
-	struct stat sb;
+	chunk_t *data;
-	chunk_t data;
+	int written;
-	void *addr;
-	int fd, written;
 	char buf[24];
 
-	fd = open(path, O_RDONLY);
+	data = chunk_map(path, FALSE);
-	if (fd == -1)
+	if (!data)
 	{
 		return FALSE;
 	}
-	if (fstat(fd, &sb) == -1)
-	{
-		close(fd);
-		return FALSE;
-	}
-	addr = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
-	if (addr == MAP_FAILED)
-	{
-		close(fd);
-		return FALSE;
-	}
-
 	/* FCGX does not like large integers, print to a buffer using libc */
-	snprintf(buf, sizeof(buf), "%lld", (int64_t)sb.st_size);
+	snprintf(buf, sizeof(buf), "%lld", (int64_t)data->len);
 	FCGX_FPrintF(this->req.out, "Content-Length: %s\n", buf);
 	if (mime)
 	{
@@ -326,22 +311,18 @@ METHOD(fast_request_t, sendfile, bool,
 	}
 	FCGX_FPrintF(this->req.out, "\n");
 
-	data = chunk_create(addr, sb.st_size);
+	while (data->len)
-
-	while (data.len)
 	{
-		written = FCGX_PutStr(data.ptr, data.len, this->req.out);
+		written = FCGX_PutStr(data->ptr, data->len, this->req.out);
 		if (written == -1)
 		{
-			munmap(addr, sb.st_size);
+			chunk_unmap(data);
-			close(fd);
 			return FALSE;
 		}
-		data = chunk_skip(data, written);
+		*data = chunk_skip(*data, written);
 	}
 
-	munmap(addr, sb.st_size);
+	chunk_unmap(data);
-	close(fd);
 	return TRUE;
 }
 

src/libpts/swid/swid_inventory.c

@@ -24,7 +24,6 @@
 #include <fcntl.h>
 #include <unistd.h>
 #include <sys/stat.h>
-#include <sys/mman.h>
 #include <libgen.h>
 #include <errno.h>
 
@@ -178,40 +177,19 @@ static bool collect_tags(private_swid_inventory_t *this, char *pathname,
 		if (this->full_tags)
 		{
 			swid_tag_t *tag;
-			chunk_t xml_tag;
+			chunk_t *xml_tag;
-			struct stat sb;
-			void *addr;
-			int fd;
 
-			fd = open(abs_name, O_RDONLY);
+			xml_tag = chunk_map(abs_name, FALSE);
-			if (fd == -1)
+			if (!xml_tag)
 			{
 				DBG1(DBG_IMC, "  opening '%s' failed: %s", abs_name,
 					 strerror(errno));
 				goto end;
 			}
 
-			if (fstat(fd, &sb) == -1)
+			tag = swid_tag_create(*xml_tag, unique_seq_id);
-			{
-				DBG1(DBG_IMC, "  getting file size of '%s' failed: %s", abs_name,
-			 		 strerror(errno));
-				close(fd);
-				goto end;
-			}
-
-			addr = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
-			if (addr == MAP_FAILED)
-			{
-				DBG1(DBG_IMC, "  mapping '%s' failed: %s", abs_name,
-					 strerror(errno));
-				close(fd);
-				goto end;
-			}
-			xml_tag = chunk_create(addr, sb.st_size);
-			tag = swid_tag_create(xml_tag, unique_seq_id);
 			this->list->insert_last(this->list, tag);
-			munmap(addr, sb.st_size);
+			chunk_unmap(xml_tag);
-			close(fd);
 		}
 		else
 		{
@@ -290,5 +268,3 @@ swid_inventory_t *swid_inventory_create(bool full_tags)
 
 	return &this->public;
 }
-
-

src/libstrongswan/plugins/pem/pem_builder.c

@@ -25,7 +25,6 @@
 #include <stddef.h>
 #include <fcntl.h>
 #include <sys/types.h>
-#include <sys/mman.h>
 #include <sys/stat.h>
 
 #include <utils/debug.h>
@@ -418,39 +417,17 @@ static void *load_from_blob(chunk_t blob, credential_type_t type, int subtype,
 static void *load_from_file(char *file, credential_type_t type, int subtype,
 							identification_t *subject, x509_flag_t flags)
 {
-	void *cred = NULL;
+	void *cred;
-	struct stat sb;
+	chunk_t *chunk;
-	void *addr;
-	int fd;
 
-	fd = open(file, O_RDONLY);
+	chunk = chunk_map(file, FALSE);
-	if (fd == -1)
+	if (!chunk)
 	{
 		DBG1(DBG_LIB, "  opening '%s' failed: %s", file, strerror(errno));
 		return NULL;
 	}
-
+	cred = load_from_blob(*chunk, type, subtype, subject, flags);
-	if (fstat(fd, &sb) == -1)
+	chunk_unmap(chunk);
-	{
-		DBG1(DBG_LIB, "  getting file size of '%s' failed: %s", file,
-			 strerror(errno));
-		close(fd);
-		return NULL;
-	}
-
-	addr = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
-	if (addr == MAP_FAILED)
-	{
-		DBG1(DBG_LIB, "  mapping '%s' failed: %s", file, strerror(errno));
-		close(fd);
-		return NULL;
-	}
-
-	cred = load_from_blob(chunk_create(addr, sb.st_size), type, subtype,
-									   subject, flags);
-
-	munmap(addr, sb.st_size);
-	close(fd);
 	return cred;
 }
 

src/libstrongswan/tests/suites/test_chunk.c

@@ -14,10 +14,16 @@
  * for more details.
  */
 
-
 #include "test_suite.h"
 
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+
 #include <utils/chunk.h>
+#include <threading/thread.h>
 
 /*******************************************************************************
  * utilities
@@ -774,6 +780,116 @@ START_TEST(test_chunk_hash_static)
 }
 END_TEST
 
+/*******************************************************************************
+ * test for chunk_map and friends
+ */
+
+START_TEST(test_chunk_map)
+{
+	chunk_t *map, contents = chunk_from_chars(0x01,0x02,0x03,0x04,0x05);
+	char *path = "/tmp/strongswan-chunk-map-test";
+
+	ck_assert(chunk_write(contents, path, 022, TRUE));
+
+	/* read */
+	map = chunk_map(path, FALSE);
+	ck_assert(map != NULL);
+	ck_assert_msg(chunk_equals(*map, contents), "%B", map);
+	/* altering mapped chunk should not hurt */
+	*map = chunk_empty;
+	ck_assert(chunk_unmap(map));
+
+	/* write */
+	map = chunk_map(path, TRUE);
+	ck_assert(map != NULL);
+	ck_assert_msg(chunk_equals(*map, contents), "%B", map);
+	map->ptr[0] = 0x06;
+	ck_assert(chunk_unmap(map));
+
+	/* verify write */
+	contents.ptr[0] = 0x06;
+	map = chunk_map(path, FALSE);
+	ck_assert(map != NULL);
+	ck_assert_msg(chunk_equals(*map, contents), "%B", map);
+	ck_assert(chunk_unmap(map));
+
+	unlink(path);
+}
+END_TEST
+
+/*******************************************************************************
+ * test for chunk_from_fd
+ */
+
+START_TEST(test_chunk_from_fd_file)
+{
+	chunk_t in, contents = chunk_from_chars(0x01,0x02,0x03,0x04,0x05);
+	char *path = "/tmp/strongswan-chunk-fd-test";
+	int fd;
+
+	ck_assert(chunk_write(contents, path, 022, TRUE));
+
+	fd = open(path, O_RDONLY);
+	ck_assert(fd != -1);
+
+	ck_assert(chunk_from_fd(fd, &in));
+	close(fd);
+	ck_assert_msg(chunk_equals(in, contents), "%B", &in);
+	unlink(path);
+	free(in.ptr);
+}
+END_TEST
+
+START_TEST(test_chunk_from_fd_skt)
+{
+	chunk_t in, contents = chunk_from_chars(0x01,0x02,0x03,0x04,0x05);
+	int s[2];
+
+	ck_assert(socketpair(AF_UNIX, SOCK_STREAM, 0, s) == 0);
+	ck_assert(write(s[1], contents.ptr, contents.len) == contents.len);
+	close(s[1]);
+	ck_assert_msg(chunk_from_fd(s[0], &in), "%s", strerror(errno));
+	close(s[0]);
+	ck_assert_msg(chunk_equals(in, contents), "%B", &in);
+	free(in.ptr);
+}
+END_TEST
+
+#define FROM_FD_COUNT 8192
+
+void *chunk_from_fd_run(void *data)
+{
+	int i, fd = (uintptr_t)data;
+
+	for (i = 0; i < FROM_FD_COUNT; i++)
+	{
+		ck_assert(write(fd, &i, sizeof(i)) == sizeof(i));
+	}
+	close(fd);
+	return NULL;
+}
+
+START_TEST(test_chunk_from_fd_huge)
+{
+	thread_t *thread;
+	chunk_t in;
+	int s[2], i;
+
+	ck_assert(socketpair(AF_UNIX, SOCK_STREAM, 0, s) == 0);
+
+	thread = thread_create(chunk_from_fd_run, (void*)(uintptr_t)s[1]);
+	ck_assert_msg(chunk_from_fd(s[0], &in), "%s", strerror(errno));
+	ck_assert_int_eq(in.len, FROM_FD_COUNT * sizeof(i));
+	for (i = 0; i < FROM_FD_COUNT; i++)
+	{
+		ck_assert_int_eq(((int*)in.ptr)[i], i);
+	}
+	thread->join(thread);
+	close(s[0]);
+	free(in.ptr);
+}
+END_TEST
+
 /*******************************************************************************
  * printf_hook tests
  */
@@ -891,6 +1007,16 @@ Suite *chunk_suite_create()
 	tcase_add_test(tc, test_chunk_hash_static);
 	suite_add_tcase(s, tc);
 
+	tc = tcase_create("chunk_map");
+	tcase_add_test(tc, test_chunk_map);
+	suite_add_tcase(s, tc);
+
+	tc = tcase_create("chunk_from_fd");
+	tcase_add_test(tc, test_chunk_from_fd_file);
+	tcase_add_test(tc, test_chunk_from_fd_skt);
+	tcase_add_test(tc, test_chunk_from_fd_huge);
+	suite_add_tcase(s, tc);
+
 	tc = tcase_create("printf_hook");
 	tcase_add_loop_test(tc, test_printf_hook_hash, 0, countof(printf_hook_data));
 	tcase_add_loop_test(tc, test_printf_hook_plus, 0, countof(printf_hook_data));

src/libstrongswan/utils/chunk.c

@@ -18,6 +18,9 @@
 #include <stdio.h>
 #include <sys/types.h>
 #include <sys/stat.h>
+#ifdef HAVE_MMAP
+# include <sys/mman.h>
+#endif
 #include <fcntl.h>
 #include <unistd.h>
 #include <errno.h>
@@ -25,7 +28,6 @@
 #include <ctype.h>
 
 #include "chunk.h"
-#include "debug.h"
 
 /**
  * Empty chunk.
@@ -206,15 +208,16 @@ void chunk_split(chunk_t chunk, const char *mode, ...)
 /**
  * Described in header.
  */
-bool chunk_write(chunk_t chunk, char *path, char *label, mode_t mask, bool force)
+bool chunk_write(chunk_t chunk, char *path, mode_t mask, bool force)
 {
 	mode_t oldmask;
 	FILE *fd;
 	bool good = FALSE;
+	int tmp = 0;
 
 	if (!force && access(path, F_OK) == 0)
 	{
-		DBG1(DBG_LIB, "  %s file '%s' already exists", label, path);
+		errno = EEXIST;
 		return FALSE;
 	}
 	oldmask = umask(mask);
@@ -223,58 +226,206 @@ bool chunk_write(chunk_t chunk, char *path, char *label, mode_t mask, bool force
 	{
 		if (fwrite(chunk.ptr, sizeof(u_char), chunk.len, fd) == chunk.len)
 		{
-			DBG1(DBG_LIB, "  written %s file '%s' (%d bytes)",
-				 label, path, chunk.len);
 			good = TRUE;
 		}
 		else
 		{
-			DBG1(DBG_LIB, "  writing %s file '%s' failed: %s",
+			tmp = errno;
-				 label, path, strerror(errno));
 		}
 		fclose(fd);
 	}
 	else
 	{
-		DBG1(DBG_LIB, "  could not open %s file '%s': %s", label, path,
+		tmp = errno;
-			 strerror(errno));
 	}
 	umask(oldmask);
+	errno = tmp;
 	return good;
 }
 
 /**
  * Described in header.
  */
-chunk_t chunk_from_fd(int fd)
+bool chunk_from_fd(int fd, chunk_t *out)
 {
-	char buf[8096];
+	struct stat sb;
-	char *pos = buf;
+	char *buf, *tmp;
-	ssize_t len, total = 0;
+	ssize_t len, total = 0, bufsize;
+
+	if (fstat(fd, &sb) == 0 && S_ISREG(sb.st_mode))
+	{
+		bufsize = sb.st_size;
+	}
+	else
+	{
+		bufsize = 256;
+	}
+	buf = malloc(bufsize);
+	if (!buf)
+	{	/* for huge files */
+		return FALSE;
+	}
 
 	while (TRUE)
 	{
-		len = read(fd, pos, buf + sizeof(buf) - pos);
+		len = read(fd, buf + total, bufsize - total);
 		if (len < 0)
 		{
-			DBG1(DBG_LIB, "reading from file descriptor failed: %s",
+			free(buf);
-				 strerror(errno));
+			return FALSE;
-			return chunk_empty;
 		}
 		if (len == 0)
 		{
 			break;
 		}
 		total += len;
-		if (total == sizeof(buf))
+		if (total == bufsize)
 		{
-			DBG1(DBG_LIB, "buffer too small to read from file descriptor");
+			bufsize *= 2;
-			return chunk_empty;
+			tmp = realloc(buf, bufsize);
+			if (!tmp)
+			{
+				free(buf);
+				return FALSE;
+			}
+			buf = tmp;
 		}
 	}
-	return chunk_clone(chunk_create(buf, total));
+	if (total == 0)
+	{
+		free(buf);
+		buf = NULL;
+	}
+	else if (total < bufsize)
+	{
+		buf = realloc(buf, total);
+	}
+	*out = chunk_create(buf, total);
+	return TRUE;
 }
 
+/**
+ * Implementation for mmap()ed chunks
+ */
+typedef struct {
+	/* public chunk interface */
+	chunk_t public;
+	/* FD of open file */
+	int fd;
+	/* mmap() address */
+	void *map;
+	/* size of map */
+	size_t len;
+	/* do we write? */
+	bool wr;
+} mmaped_chunk_t;
+
+/**
+ * See header.
+ */
+chunk_t *chunk_map(char *path, bool wr)
+{
+	mmaped_chunk_t *chunk;
+	struct stat sb;
+	int tmp;
+
+	INIT(chunk,
+		.fd = open(path, wr ? O_RDWR : O_RDONLY),
+		.wr = wr,
+	);
+
+	if (chunk->fd == -1)
+	{
+		free(chunk);
+		return NULL;
+	}
+	if (fstat(chunk->fd, &sb) == -1)
+	{
+		tmp = errno;
+		chunk_unmap(&chunk->public);
+		errno = tmp;
+		return NULL;
+	}
+#ifdef HAVE_MMAP
+	chunk->len = sb.st_size;
+	/* map non-empty files only, as mmap() complains otherwise */
+	if (chunk->len)
+	{
+		/* in read-only mode, we allow writes, but don't sync to disk */
+		chunk->map = mmap(NULL, chunk->len, PROT_READ | PROT_WRITE,
+						  wr ? MAP_SHARED : MAP_PRIVATE, chunk->fd, 0);
+		if (chunk->map == MAP_FAILED)
+		{
+			tmp = errno;
+			chunk_unmap(&chunk->public);
+			errno = tmp;
+			return NULL;
+		}
+	}
+	chunk->public = chunk_create(chunk->map, chunk->len);
+#else /* !HAVE_MMAP */
+	if (!chunk_from_fd(chunk->fd, &chunk->public))
+	{
+		tmp = errno;
+		chunk_unmap(&chunk->public);
+		errno = tmp;
+		return NULL;
+	}
+	chunk->map = chunk->public.ptr;
+	chunk->len = chunk->public.len;
+#endif /* !HAVE_MMAP */
+	return &chunk->public;
+}
+
+/**
+ * See header.
+ */
+bool chunk_unmap(chunk_t *public)
+{
+	mmaped_chunk_t *chunk;
+	bool ret = FALSE;
+	int tmp = 0;
+
+	chunk = (mmaped_chunk_t*)public;
+#ifdef HAVE_MMAP
+	if (chunk->map && chunk->map != MAP_FAILED)
+	{
+		ret = munmap(chunk->map, chunk->len) == 0;
+		tmp = errno;
+	}
+#else /* !HAVE_MMAP */
+	if (chunk->wr)
+	{
+		if (lseek(chunk->fd, 0, SEEK_SET) != -1)
+		{
+			int len, total = 0;
+
+			ret = TRUE;
+			while (total < chunk->len)
+			{
+				len = write(chunk->fd, chunk->map + total, chunk->len - total);
+				if (len <= 0)
+				{
+					ret = FALSE;
+					break;
+				}
+				total += len;
+			}
+		}
+		tmp = errno;
+	}
+	else
+	{
+		ret = TRUE;
+	}
+	free(chunk->map);
+#endif /* !HAVE_MMAP */
+	close(chunk->fd);
+	free(chunk);
+	errno = tmp;
+
+	return ret;
+}
 
 /** hex conversion digits */
 static char hexdig_upper[] = "0123456789ABCDEF";

src/libstrongswan/utils/chunk.h

@@ -90,22 +90,52 @@ void chunk_split(chunk_t chunk, const char *mode, ...);
 /**
  * Write the binary contents of a chunk_t to a file
  *
+ * If the write fails, errno is set appropriately.
+ *
  * @param chunk			contents to write to file
  * @param path			path where file is written to
- * @param label			label specifying file type
  * @param mask			file mode creation mask
  * @param force			overwrite existing file by force
  * @return				TRUE if write operation was successful
  */
-bool chunk_write(chunk_t chunk, char *path, char *label, mode_t mask, bool force);
+bool chunk_write(chunk_t chunk, char *path, mode_t mask, bool force);
 
 /**
  * Store data read from FD into a chunk
  *
+ * On error, errno is set appropriately.
+ *
  * @param fd			file descriptor to read from
- * @return				chunk or chunk_empty on failure
+ * @param chunk			chunk receiving allocated buffer
+ * @return				TRUE if successful, FALSE on failure
  */
-chunk_t chunk_from_fd(int fd);
+bool chunk_from_fd(int fd, chunk_t *chunk);
+
+/**
+ * mmap() a file to a chunk
+ *
+ * The returned chunk structure is allocated from heap, but it must be freed
+ * through chunk_unmap(). A user may alter the chunk ptr or len, but must pass
+ * the chunk pointer returned from chunk_map() to chunk_unmap() after use.
+ *
+ * On error, errno is set appropriately.
+ *
+ * @param path			path of file to map
+ * @param wr			TRUE to sync writes to disk
+ * @return				mapped chunk, NULL on error
+ */
+chunk_t *chunk_map(char *path, bool wr);
+
+/**
+ * munmap() a chunk previously mapped with chunk_map()
+ *
+ * When unmapping a writeable map, the return value should be checked to
+ * ensure changes landed on disk.
+ *
+ * @param chunk			pointer returned from chunk_map()
+ * @return				TRUE of changes written back to file
+ */
+bool chunk_unmap(chunk_t *chunk);
 
 /**
  * Convert a chunk of data to hex encoding.

src/libstrongswan/utils/integrity_checker.c

@@ -22,7 +22,6 @@
 #include <fcntl.h>
 #include <errno.h>
 #include <unistd.h>
-#include <sys/mman.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 
@@ -61,40 +60,17 @@ METHOD(integrity_checker_t, build_file, u_int32_t,
 	private_integrity_checker_t *this, char *file, size_t *len)
 {
 	u_int32_t checksum;
-	chunk_t contents;
+	chunk_t *contents;
-	struct stat sb;
-	void *addr;
-	int fd;
 
-	fd = open(file, O_RDONLY);
+	contents = chunk_map(file, FALSE);
-	if (fd == -1)
+	if (!contents)
 	{
 		DBG1(DBG_LIB, "  opening '%s' failed: %s", file, strerror(errno));
 		return 0;
 	}
-
+	*len = contents->len;
-	if (fstat(fd, &sb) == -1)
+	checksum = chunk_hash_static(*contents);
-	{
+	chunk_unmap(contents);
-		DBG1(DBG_LIB, "  getting file size of '%s' failed: %s", file,
-			 strerror(errno));
-		close(fd);
-		return 0;
-	}
-
-	addr = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
-	if (addr == MAP_FAILED)
-	{
-		DBG1(DBG_LIB, "  mapping '%s' failed: %s", file, strerror(errno));
-		close(fd);
-		return 0;
-	}
-
-	*len = sb.st_size;
-	contents = chunk_create(addr, sb.st_size);
-	checksum = chunk_hash_static(contents);
-
-	munmap(addr, sb.st_size);
-	close(fd);
 
 	return checksum;
 }
@@ -318,4 +294,3 @@ integrity_checker_t *integrity_checker_create(char *checksum_library)
 	}
 	return &this->public;
 }
-

src/libtnccs/plugins/tnc_imv/tnc_imv_manager.c

@@ -21,7 +21,6 @@
 
 #include <sys/types.h>
 #include <sys/stat.h>
-#include <sys/mman.h>
 #include <unistd.h>
 #include <errno.h>
 #include <fcntl.h>

src/libtnccs/tnc/tnc.c

@@ -17,7 +17,6 @@
 
 #include <sys/types.h>
 #include <sys/stat.h>
-#include <sys/mman.h>
 #include <unistd.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -94,10 +93,8 @@ void libtnccs_deinit(void)
 static bool load_imcvs_from_config(char *filename, bool is_imc)
 {
 	bool success = FALSE;
-	int fd, line_nr = 0;
+	int line_nr = 0;
-	chunk_t src, line;
+	chunk_t *src, line;
-	struct stat sb;
-	void *addr;
 	char *label;
 
 	if (!filename || !*filename)
@@ -108,30 +105,15 @@ static bool load_imcvs_from_config(char *filename, bool is_imc)
 	label = is_imc ? "IMC" : "IMV";
 
 	DBG1(DBG_TNC, "loading %ss from '%s'", label, filename);
-	fd = open(filename, O_RDONLY);
+	src = chunk_map(filename, FALSE);
-	if (fd == -1)
+	if (!src)
 	{
 		DBG1(DBG_TNC, "opening configuration file '%s' failed: %s", filename,
 			 strerror(errno));
 		return FALSE;
 	}
-	if (fstat(fd, &sb) == -1)
-	{
-		DBG1(DBG_LIB, "getting file size of '%s' failed: %s", filename,
-			 strerror(errno));
-		close(fd);
-		return FALSE;
-	}
-	addr = mmap(NULL, sb.st_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-	if (addr == MAP_FAILED)
-	{
-		DBG1(DBG_LIB, "mapping '%s' failed: %s", filename, strerror(errno));
-		close(fd);
-		return FALSE;
-	}
-	src = chunk_create(addr, sb.st_size);
 
-	while (fetchline(&src, &line))
+	while (fetchline(src, &line))
 	{
 		char *name, *path;
 		chunk_t token;
@@ -201,8 +183,7 @@ static bool load_imcvs_from_config(char *filename, bool is_imc)
 			break;
 		}
 	}
-	munmap(addr, sb.st_size);
+	chunk_unmap(src);
-	close(fd);
 	return success;
 }
 
@@ -272,4 +253,3 @@ bool tnc_manager_register(plugin_t *plugin, plugin_feature_t *feature,
 	}
 	return TRUE;
 }
-

src/openac/openac.c

@@ -29,6 +29,7 @@
 #include <getopt.h>
 #include <ctype.h>
 #include <time.h>
+#include <errno.h>
 
 #include <library.h>
 #include <utils/debug.h>
@@ -515,11 +516,18 @@ int main(int argc, char **argv)
 		/* write the attribute certificate to file */
 		if (attr_cert->get_encoding(attr_cert, CERT_ASN1_DER, &attr_chunk))
 		{
-			if (chunk_write(attr_chunk, outfile, "attribute cert", 0022, TRUE))
+			if (chunk_write(attr_chunk, outfile, 0022, TRUE))
 			{
+				DBG1(DBG_APP, "  written attribute cert file '%s' (%d bytes)",
+						 outfile, attr_chunk.len);
 				write_serial(serial);
 				status = 0;
 			}
+			else
+			{
+				DBG1(DBG_APP, "  writing attribute cert file '%s' failed: %s",
+					 outfile, strerror(errno));
+			}
 		}
 	}
 	else

src/pki/commands/issue.c

@@ -14,6 +14,7 @@
  */
 
 #include <time.h>
+#include <errno.h>
 
 #include "pki.h"
 
@@ -382,7 +383,12 @@ static int issue()
 		{
 			chunk_t chunk;
 
-			chunk = chunk_from_fd(0);
+			if (!chunk_from_fd(0, &chunk))
+			{
+				fprintf(stderr, "%s: ", strerror(errno));
+				error = "reading certificate request failed";
+				goto end;
+			}
 			cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
 										  CERT_PKCS10_REQUEST,
 										  BUILD_BLOB, chunk, BUILD_END);
@@ -425,7 +431,12 @@ static int issue()
 		{
 			chunk_t chunk;
 
-			chunk = chunk_from_fd(0);
+			if (!chunk_from_fd(0, &chunk))
+			{
+				fprintf(stderr, "%s: ", strerror(errno));
+				error = "reading public key failed";
+				goto end;
+			}
 			public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
 										 BUILD_BLOB, chunk, BUILD_END);
 			free(chunk.ptr);
@@ -562,4 +573,3 @@ static void __attribute__ ((constructor))reg()
 		}
 	});
 }
-

src/pki/commands/keyid.c

@@ -13,6 +13,8 @@
  * for more details.
  */
 
+#include <errno.h>
+
 #include "pki.h"
 
 #include <credentials/certificates/certificate.h>
@@ -89,7 +91,11 @@ static int keyid()
 	{
 		chunk_t chunk;
 
-		chunk = chunk_from_fd(0);
+		if (!chunk_from_fd(0, &chunk))
+		{
+			fprintf(stderr, "reading input failed: %s\n", strerror(errno));
+			return 1;
+		}
 		cred = lib->creds->create(lib->creds, type, subtype,
 								  BUILD_BLOB, chunk, BUILD_END);
 		free(chunk.ptr);
@@ -165,4 +171,3 @@ static void __attribute__ ((constructor))reg()
 		}
 	});
 }
-

src/pki/commands/print.c

@@ -22,6 +22,7 @@
 #include <selectors/traffic_selector.h>
 
 #include <time.h>
+#include <errno.h>
 
 /**
  * Print public key information
@@ -510,7 +511,11 @@ static int print()
 	{
 		chunk_t chunk;
 
-		chunk = chunk_from_fd(0);
+		if (!chunk_from_fd(0, &chunk))
+		{
+			fprintf(stderr, "reading input failed: %s\n", strerror(errno));
+			return 1;
+		}
 		cred = lib->creds->create(lib->creds, type, subtype,
 								  BUILD_BLOB, chunk, BUILD_END);
 		free(chunk.ptr);

src/pki/commands/pub.c

@@ -13,6 +13,8 @@
  * for more details.
  */
 
+#include <errno.h>
+
 #include "pki.h"
 
 #include <credentials/certificates/certificate.h>
@@ -108,7 +110,11 @@ static int pub()
 	{
 		chunk_t chunk;
 
-		chunk = chunk_from_fd(0);
+		if (!chunk_from_fd(0, &chunk))
+		{
+			fprintf(stderr, "reading input failed: %s\n", strerror(errno));
+			return 1;
+		}
 		cred = lib->creds->create(lib->creds, type, subtype,
 								  BUILD_BLOB, chunk, BUILD_END);
 		free(chunk.ptr);
@@ -186,4 +192,3 @@ static void __attribute__ ((constructor))reg()
 		}
 	});
 }
-

src/pki/commands/req.c

@@ -16,6 +16,7 @@
  */
 
 #include <time.h>
+#include <errno.h>
 
 #include "pki.h"
 
@@ -118,7 +119,11 @@ static int req()
 	{
 		chunk_t chunk;
 
-		chunk = chunk_from_fd(0);
+		if (!chunk_from_fd(0, &chunk))
+		{
+			fprintf(stderr, "reading private key failed: %s\n", strerror(errno));
+			return 1;
+		}
 		private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
 									 BUILD_BLOB, chunk, BUILD_END);
 		free(chunk.ptr);

src/pki/commands/self.c

@@ -14,6 +14,7 @@
  */
 
 #include <time.h>
+#include <errno.h>
 
 #include "pki.h"
 
@@ -273,7 +274,12 @@ static int self()
 	{
 		chunk_t chunk;
 
-		chunk = chunk_from_fd(0);
+		if (!chunk_from_fd(0, &chunk))
+		{
+			fprintf(stderr, "%s: ", strerror(errno));
+			error = "reading private key failed";
+			goto end;
+		}
 		private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
 									 BUILD_BLOB, chunk, BUILD_END);
 		free(chunk.ptr);

src/pki/commands/verify.c

@@ -13,6 +13,8 @@
  * for more details.
  */
 
+#include <errno.h>
+
 #include "pki.h"
 
 #include <credentials/certificates/certificate.h>
@@ -57,7 +59,11 @@ static int verify()
 	{
 		chunk_t chunk;
 
-		chunk = chunk_from_fd(0);
+		if (!chunk_from_fd(0, &chunk))
+		{
+			fprintf(stderr, "reading certificate failed: %s\n", strerror(errno));
+			return 1;
+		}
 		cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 								  BUILD_BLOB, chunk, BUILD_END);
 		free(chunk.ptr);

src/scepclient/scepclient.c

@@ -24,6 +24,7 @@
 #include <time.h>
 #include <limits.h>
 #include <syslog.h>
+#include <errno.h>
 
 #include <library.h>
 #include <utils/debug.h>
@@ -975,9 +976,10 @@ int main(int argc, char **argv)
 		{	/* no PKCS#7 encoded CA+RA certificates, assume simple CA cert */
 
 			DBG1(DBG_APP, "unable to parse PKCS#7, assuming plain CA cert");
-			if (!chunk_write(scep_response, ca_path, "ca cert",  0022, force))
+			if (!chunk_write(scep_response, ca_path, 0022, force))
 			{
-				exit_scepclient("could not write ca cert file '%s'", ca_path);
+				exit_scepclient("could not write ca cert file '%s': %s",
+								ca_path, strerror(errno));
 			}
 		}
 		else
@@ -1031,10 +1033,10 @@ int main(int argc, char **argv)
 				}
 
 				if (!cert->get_encoding(cert, CERT_ASN1_DER, &encoding) ||
-					!chunk_write(encoding, path,
+					!chunk_write(encoding, path, 0022, force))
-								 ca_cert ? "ca cert" : "ra cert", 0022, force))
 				{
-					exit_scepclient("could not write cert file '%s'", path);
+					exit_scepclient("could not write cert file '%s': %s",
+									path, strerror(errno));
 				}
 				chunk_free(&encoding);
 			}
@@ -1149,9 +1151,10 @@ int main(int argc, char **argv)
 
 		join_paths(path, sizeof(path), REQ_PATH, file_out_pkcs10);
 
-		if (!chunk_write(pkcs10_encoding, path, "pkcs10",  0022, force))
+		if (!chunk_write(pkcs10_encoding, path, 0022, force))
 		{
-			exit_scepclient("could not write pkcs10 file '%s'", path);
+			exit_scepclient("could not write pkcs10 file '%s': %s",
+							path, strerror(errno));
 		}
 		filetype_out &= ~PKCS10;   /* delete PKCS10 flag */
 	}
@@ -1172,9 +1175,10 @@ int main(int argc, char **argv)
 
 		DBG2(DBG_APP, "building pkcs1 object:");
 		if (!private_key->get_encoding(private_key, PRIVKEY_ASN1_DER, &pkcs1) ||
-			!chunk_write(pkcs1, path, "pkcs1", 0066, force))
+			!chunk_write(pkcs1, path, 0066, force))
 		{
-			exit_scepclient("could not write pkcs1 file '%s'", path);
+			exit_scepclient("could not write pkcs1 file '%s': %s",
+							path, strerror(errno));
 		}
 		filetype_out &= ~PKCS1;   /* delete PKCS1 flag */
 	}
@@ -1236,9 +1240,10 @@ int main(int argc, char **argv)
 		{
 			exit_scepclient("encoding certificate failed");
 		}
-		if (!chunk_write(encoding, path, "self-signed cert", 0022, force))
+		if (!chunk_write(encoding, path, 0022, force))
 		{
-			exit_scepclient("could not write self-signed cert file '%s'", path);
+			exit_scepclient("could not write self-signed cert file '%s': %s",
+							path, strerror(errno));
 		}
 		chunk_free(&encoding);
 		filetype_out &= ~CERT_SELF;   /* delete CERT_SELF flag */
@@ -1300,9 +1305,10 @@ int main(int argc, char **argv)
 
 		join_paths(path, sizeof(path), REQ_PATH, file_out_pkcs7);
 
-		if (!chunk_write(pkcs7, path, "pkcs7 encrypted request", 0022, force))
+		if (!chunk_write(pkcs7, path, 0022, force))
 		{
-			exit_scepclient("could not write pkcs7 file '%s'", path);
+			exit_scepclient("could not write pkcs7 file '%s': %s",
+							path, strerror(errno));
 		}
 		filetype_out &= ~PKCS7;   /* delete PKCS7 flag */
 	}
@@ -1460,9 +1466,10 @@ int main(int argc, char **argv)
 					exit_scepclient("multiple certs received, only first stored");
 				}
 				if (!cert->get_encoding(cert, CERT_ASN1_DER, &encoding) ||
-					!chunk_write(encoding, path, "requested cert", 0022, force))
+					!chunk_write(encoding, path, 0022, force))
 				{
-					exit_scepclient("could not write cert file '%s'", path);
+					exit_scepclient("could not write cert file '%s': %s",
+									path, strerror(errno));
 				}
 				chunk_free(&encoding);
 				stored = TRUE;