chiark / gitweb /
bus: parse uid/gid/pid/tid meta data from kdbus messages
[elogind.git] / src / libsystemd-bus / bus-message.c
index c385ef5ed05b1e39387e6e447677a827c6b2a25c..092654ff4586deae02082fe6a96cc4f17e0e5dfc 100644 (file)
 ***/
 
 #include <errno.h>
+#include <fcntl.h>
 
 #include "util.h"
 #include "utf8.h"
 #include "strv.h"
+#include "time-util.h"
 
 #include "sd-bus.h"
 #include "bus-message.h"
@@ -31,7 +33,6 @@
 #include "bus-type.h"
 #include "bus-signature.h"
 
-static int message_parse_fields(sd_bus_message *m);
 static int message_append_basic(sd_bus_message *m, char type, const void *p, const void **stored);
 
 static void reset_containers(sd_bus_message *m) {
@@ -50,8 +51,6 @@ static void reset_containers(sd_bus_message *m) {
 }
 
 static void message_free(sd_bus_message *m) {
-        unsigned i;
-
         assert(m);
 
         if (m->free_header)
@@ -63,8 +62,13 @@ static void message_free(sd_bus_message *m) {
         if (m->free_body)
                 free(m->body);
 
-        for (i = 0; i < m->n_fds; i++)
-                close_nointr_nofail(m->fds[i]);
+        if (m->free_kdbus)
+                free(m->kdbus);
+
+        if (m->free_fds) {
+                close_many(m->fds, m->n_fds);
+                free(m->fds);
+        }
 
         reset_containers(m);
         free(m->root_container.signature);
@@ -224,13 +228,22 @@ static int message_append_field_uint32(sd_bus_message *m, uint8_t h, uint32_t x)
         return 0;
 }
 
-int bus_message_from_malloc(void *buffer, size_t length, sd_bus_message **ret) {
+int bus_message_from_header(
+                void *buffer,
+                size_t length,
+                int *fds,
+                unsigned n_fds,
+                const struct ucred *ucred,
+                const char *label,
+                size_t extra,
+                sd_bus_message **ret) {
+
         sd_bus_message *m;
         struct bus_header *h;
-        size_t total, fs, bs;
-        int r;
+        size_t a, label_sz;
 
         assert(buffer || length <= 0);
+        assert(fds || n_fds <= 0);
         assert(ret);
 
         if (length < sizeof(struct bus_header))
@@ -246,42 +259,85 @@ int bus_message_from_malloc(void *buffer, size_t length, sd_bus_message **ret) {
         if (h->type == _SD_BUS_MESSAGE_TYPE_INVALID)
                 return -EBADMSG;
 
-        if (h->endian == SD_BUS_NATIVE_ENDIAN) {
-                fs = h->fields_size;
-                bs = h->body_size;
-        } else if (h->endian == SD_BUS_REVERSE_ENDIAN) {
-                fs = bswap_32(h->fields_size);
-                bs = bswap_32(h->body_size);
-        } else
+        if (h->endian != SD_BUS_LITTLE_ENDIAN &&
+            h->endian != SD_BUS_BIG_ENDIAN)
                 return -EBADMSG;
 
-        total = sizeof(struct bus_header) + ALIGN_TO(fs, 8) + bs;
-        if (length != total)
-                return -EBADMSG;
+        a = ALIGN(sizeof(sd_bus_message)) + ALIGN(extra);
+
+        if (label) {
+                label_sz = strlen(label);
+                a += label_sz + 1;
+        }
 
-        m = new0(sd_bus_message, 1);
+        m = malloc0(a);
         if (!m)
                 return -ENOMEM;
 
         m->n_ref = 1;
+        m->sealed = true;
         m->header = h;
-        m->free_header = true;
+        m->fds = fds;
+        m->n_fds = n_fds;
+
+        if (ucred) {
+                m->uid = ucred->uid;
+                m->pid = ucred->pid;
+                m->gid = ucred->gid;
+                m->uid_valid = m->gid_valid = true;
+        }
+
+        if (label) {
+                m->label = (char*) m + ALIGN(sizeof(sd_bus_message)) + ALIGN(extra);
+                memcpy(m->label, label, label_sz + 1);
+        }
+
+        *ret = m;
+        return 0;
+}
+
+int bus_message_from_malloc(
+                void *buffer,
+                size_t length,
+                int *fds,
+                unsigned n_fds,
+                const struct ucred *ucred,
+                const char *label,
+                sd_bus_message **ret) {
+
+        sd_bus_message *m;
+        int r;
+
+        r = bus_message_from_header(buffer, length, fds, n_fds, ucred, label, 0, &m);
+        if (r < 0)
+                return r;
+
+        if (length != BUS_MESSAGE_SIZE(m)) {
+                r = -EBADMSG;
+                goto fail;
+        }
+
         m->fields = (uint8_t*) buffer + sizeof(struct bus_header);
-        m->body = (uint8_t*) buffer + sizeof(struct bus_header) + ALIGN_TO(fs, 8);
-        m->sealed = true;
+        m->body = (uint8_t*) buffer + sizeof(struct bus_header) + ALIGN8(BUS_MESSAGE_FIELDS_SIZE(m));
 
         m->n_iovec = 1;
         m->iovec[0].iov_base = buffer;
         m->iovec[0].iov_len = length;
 
-        r = message_parse_fields(m);
-        if (r < 0) {
-                message_free(m);
-                return r;
-        }
+        r = bus_message_parse_fields(m);
+        if (r < 0)
+                goto fail;
+
+        /* We take possession of the memory and fds now */
+        m->free_header = true;
+        m->free_fds = true;
 
         *ret = m;
         return 0;
+
+fail:
+        message_free(m);
+        return r;
 }
 
 static sd_bus_message *message_new(sd_bus *bus, uint8_t type) {
@@ -296,6 +352,7 @@ static sd_bus_message *message_new(sd_bus *bus, uint8_t type) {
         m->header->endian = SD_BUS_NATIVE_ENDIAN;
         m->header->type = type;
         m->header->version = bus ? bus->message_version : 1;
+        m->allow_fds = !bus || bus->can_fds || (bus->state != BUS_HELLO && bus->state != BUS_RUNNING);
 
         return m;
 }
@@ -318,6 +375,8 @@ int sd_bus_message_new_signal(
                 return -EINVAL;
         if (!m)
                 return -EINVAL;
+        if (bus && bus->state == BUS_UNSET)
+                return -ENOTCONN;
 
         t = message_new(bus, SD_BUS_MESSAGE_TYPE_SIGNAL);
         if (!t)
@@ -360,6 +419,8 @@ int sd_bus_message_new_method_call(
                 return -EINVAL;
         if (!m)
                 return -EINVAL;
+        if (bus && bus->state == BUS_UNSET)
+                return -ENOTCONN;
 
         t = message_new(bus, SD_BUS_MESSAGE_TYPE_METHOD_CALL);
         if (!t)
@@ -403,10 +464,14 @@ static int message_new_reply(
 
         if (!call)
                 return -EINVAL;
+        if (!call->sealed)
+                return -EPERM;
         if (call->header->type != SD_BUS_MESSAGE_TYPE_METHOD_CALL)
                 return -EINVAL;
         if (!m)
                 return -EINVAL;
+        if (bus && bus->state == BUS_UNSET)
+                return -ENOTCONN;
 
         t = message_new(bus, type);
         if (!t)
@@ -627,6 +692,13 @@ int sd_bus_message_get_tid(sd_bus_message *m, pid_t *tid) {
         return 0;
 }
 
+const char *sd_bus_message_get_label(sd_bus_message *m) {
+        if (!m)
+                return NULL;
+
+        return m->label;
+}
+
 int sd_bus_message_is_signal(sd_bus_message *m, const char *interface, const char *member) {
         if (!m)
                 return -EINVAL;
@@ -733,13 +805,18 @@ static void *message_extend_body(sd_bus_message *m, size_t align, size_t sz) {
 
 int message_append_basic(sd_bus_message *m, char type, const void *p, const void **stored) {
         struct bus_container *c;
-        size_t sz, align;
+        ssize_t align, sz;
         uint32_t k;
         void *a;
         char *e = NULL;
+        int fd = -1;
+        uint32_t fdi = 0;
+        int r;
 
         if (!m)
                 return -EINVAL;
+        if (!p)
+                return -EINVAL;
         if (m->sealed)
                 return -EPERM;
         if (!bus_type_is_basic(type))
@@ -766,11 +843,13 @@ int message_append_basic(sd_bus_message *m, char type, const void *p, const void
 
         case SD_BUS_TYPE_STRING:
         case SD_BUS_TYPE_OBJECT_PATH:
+
                 align = 4;
                 sz = 4 + strlen(p) + 1;
                 break;
 
         case SD_BUS_TYPE_SIGNATURE:
+
                 align = 1;
                 sz = 1 + strlen(p) + 1;
                 break;
@@ -784,6 +863,41 @@ int message_append_basic(sd_bus_message *m, char type, const void *p, const void
                 p = &k;
                 break;
 
+        case SD_BUS_TYPE_UNIX_FD: {
+                int z, *f;
+
+                if (!m->allow_fds) {
+                        r = -ENOTSUP;
+                        goto fail;
+                }
+
+                align = sz = 4;
+
+                z = *(int*) p;
+                if (z < 0) {
+                        r = -EINVAL;
+                        goto fail;
+                }
+
+                fd = fcntl(z, F_DUPFD_CLOEXEC, 3);
+                if (fd < 0) {
+                        r = -errno;
+                        goto fail;
+                }
+
+                f = realloc(m->fds, sizeof(int) * (m->n_fds + 1));
+                if (!f) {
+                        r = -ENOMEM;
+                        goto fail;
+                }
+
+                fdi = m->n_fds;
+                f[fdi] = fd;
+                m->fds = f;
+                m->free_fds = true;
+                break;
+        }
+
         default:
                 align = bus_type_get_alignment(type);
                 sz = bus_type_get_size(type);
@@ -795,11 +909,8 @@ int message_append_basic(sd_bus_message *m, char type, const void *p, const void
 
         a = message_extend_body(m, align, sz);
         if (!a) {
-                /* Truncate extended signature again */
-                if (e)
-                        c->signature[c->index] = 0;
-
-                return -ENOMEM;
+                r = -ENOMEM;
+                goto fail;
         }
 
         if (type == SD_BUS_TYPE_STRING || type == SD_BUS_TYPE_OBJECT_PATH) {
@@ -815,6 +926,13 @@ int message_append_basic(sd_bus_message *m, char type, const void *p, const void
 
                 if (stored)
                         *stored = (const uint8_t*) a + 1;
+        } else if (type == SD_BUS_TYPE_UNIX_FD) {
+                *(uint32_t*) a = fdi;
+
+                if (stored)
+                        *stored = a;
+
+                m->n_fds ++;
 
         } else {
                 memcpy(a, p, sz);
@@ -827,6 +945,16 @@ int message_append_basic(sd_bus_message *m, char type, const void *p, const void
                 c->index++;
 
         return 0;
+
+fail:
+        /* Truncate extended signature again */
+        if (e)
+                c->signature[c->index] = 0;
+
+        if (fd >= 0)
+                close_nointr_nofail(fd);
+
+        return r;
 }
 
 int sd_bus_message_append_basic(sd_bus_message *m, char type, const void *p) {
@@ -1133,18 +1261,89 @@ int sd_bus_message_close_container(sd_bus_message *m) {
         return 0;
 }
 
-static int message_append_ap(
+
+typedef struct {
+        const char *types;
+        unsigned n_struct;
+        unsigned n_array;
+} TypeStack;
+
+static int type_stack_push(TypeStack *stack, unsigned max, unsigned *i, const char *types, unsigned n_struct, unsigned n_array) {
+        assert(stack);
+        assert(max > 0);
+
+        if (*i >= max)
+                return -EINVAL;
+
+        stack[*i].types = types;
+        stack[*i].n_struct = n_struct;
+        stack[*i].n_array = n_array;
+        (*i)++;
+
+        return 0;
+}
+
+static int type_stack_pop(TypeStack *stack, unsigned max, unsigned *i, const char **types, unsigned *n_struct, unsigned *n_array) {
+        assert(stack);
+        assert(max > 0);
+        assert(types);
+        assert(n_struct);
+        assert(n_array);
+
+        if (*i <= 0)
+                return 0;
+
+        (*i)--;
+        *types = stack[*i].types;
+        *n_struct = stack[*i].n_struct;
+        *n_array = stack[*i].n_array;
+
+        return 1;
+}
+
+int bus_message_append_ap(
                 sd_bus_message *m,
                 const char *types,
                 va_list ap) {
 
-        const char *t;
+        unsigned n_array, n_struct;
+        TypeStack stack[BUS_CONTAINER_DEPTH];
+        unsigned stack_ptr = 0;
         int r;
 
         assert(m);
-        assert(types);
 
-        for (t = types; *t; t++) {
+        if (!types)
+                return 0;
+
+        n_array = (unsigned) -1;
+        n_struct = strlen(types);
+
+        for (;;) {
+                const char *t;
+
+                if (n_array == 0 || (n_array == (unsigned) -1 && n_struct == 0)) {
+                        r = type_stack_pop(stack, ELEMENTSOF(stack), &stack_ptr, &types, &n_struct, &n_array);
+                        if (r < 0)
+                                return r;
+                        if (r == 0)
+                                break;
+
+                        r = sd_bus_message_close_container(m);
+                        if (r < 0)
+                                return r;
+
+                        continue;
+                }
+
+                t = types;
+                if (n_array != (unsigned) -1)
+                        n_array --;
+                else {
+                        types ++;
+                        n_struct--;
+                }
+
                 switch (*t) {
 
                 case SD_BUS_TYPE_BYTE: {
@@ -1206,27 +1405,28 @@ static int message_append_ap(
                                 return r;
 
                         {
-                                unsigned i, n;
                                 char s[k + 1];
-
                                 memcpy(s, t + 1, k);
                                 s[k] = 0;
-                                t += k;
 
                                 r = sd_bus_message_open_container(m, SD_BUS_TYPE_ARRAY, s);
                                 if (r < 0)
                                         return r;
+                        }
 
-                                n = va_arg(ap, unsigned);
-                                for (i = 0; i < n; i++) {
-                                        r = message_append_ap(m, s, ap);
-                                        if (r < 0)
-                                                return r;
-                                }
-
-                                r = sd_bus_message_close_container(m);
+                        if (n_array == (unsigned) -1) {
+                                types += k;
+                                n_struct -= k;
                         }
 
+                        r = type_stack_push(stack, ELEMENTSOF(stack), &stack_ptr, types, n_struct, n_array);
+                        if (r < 0)
+                                return r;
+
+                        types = t + 1;
+                        n_struct = k;
+                        n_array = va_arg(ap, unsigned);
+
                         break;
                 }
 
@@ -1241,11 +1441,14 @@ static int message_append_ap(
                         if (r < 0)
                                 return r;
 
-                        r = message_append_ap(m, s, ap);
+                        r = type_stack_push(stack, ELEMENTSOF(stack), &stack_ptr, types, n_struct, n_array);
                         if (r < 0)
                                 return r;
 
-                        r = sd_bus_message_close_container(m);
+                        types = s;
+                        n_struct = strlen(s);
+                        n_array = (unsigned) -1;
+
                         break;
                 }
 
@@ -1266,15 +1469,20 @@ static int message_append_ap(
                                 r = sd_bus_message_open_container(m, *t == SD_BUS_TYPE_STRUCT_BEGIN ? SD_BUS_TYPE_STRUCT : SD_BUS_TYPE_DICT_ENTRY, s);
                                 if (r < 0)
                                         return r;
+                        }
 
-                                t += k - 1;
+                        if (n_array == (unsigned) -1) {
+                                types += k - 1;
+                                n_struct -= k - 1;
+                        }
 
-                                r = message_append_ap(m, s, ap);
-                                if (r < 0)
-                                        return r;
+                        r = type_stack_push(stack, ELEMENTSOF(stack), &stack_ptr, types, n_struct, n_array);
+                        if (r < 0)
+                                return r;
 
-                                r = sd_bus_message_close_container(m);
-                        }
+                        types = t + 1;
+                        n_struct = k - 2;
+                        n_array = (unsigned) -1;
 
                         break;
                 }
@@ -1299,10 +1507,10 @@ int sd_bus_message_append(sd_bus_message *m, const char *types, ...) {
         if (m->sealed)
                 return -EPERM;
         if (!types)
-                return -EINVAL;
+                return 0;
 
         va_start(ap, types);
-        r = message_append_ap(m, types, ap);
+        r = bus_message_append_ap(m, types, ap);
         va_end(ap);
 
         return r;
@@ -1356,8 +1564,7 @@ static int message_peek_body(sd_bus_message *m, size_t *rindex, size_t align, si
         return buffer_peek(m->body, BUS_MESSAGE_BODY_SIZE(m), rindex, align, nbytes, ret);
 }
 
-static bool validate_string(const char *s, size_t l) {
-        assert(s);
+static bool validate_nul(const char *s, size_t l) {
 
         /* Check for NUL chars in the string */
         if (memchr(s, 0, l))
@@ -1367,6 +1574,14 @@ static bool validate_string(const char *s, size_t l) {
         if (s[l] != 0)
                 return false;
 
+        return true;
+}
+
+static bool validate_string(const char *s, size_t l) {
+
+        if (!validate_nul(s, l))
+                return false;
+
         /* Check if valid UTF8 */
         if (!utf8_is_valid(s))
                 return false;
@@ -1375,12 +1590,8 @@ static bool validate_string(const char *s, size_t l) {
 }
 
 static bool validate_signature(const char *s, size_t l) {
-        /* Check for NUL chars in the signature */
-        if (memchr(s, 0, l))
-                return false;
 
-        /* Check for NUL termination */
-        if (s[l] != 0)
+        if (!validate_nul(s, l))
                 return false;
 
         /* Check if valid signature */
@@ -1390,6 +1601,17 @@ static bool validate_signature(const char *s, size_t l) {
         return true;
 }
 
+static bool validate_object_path(const char *s, size_t l) {
+
+        if (!validate_nul(s, l))
+                return false;
+
+        if (!object_path_is_valid(s))
+                return false;
+
+        return true;
+}
+
 int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
         struct bus_container *c;
         int r;
@@ -1401,6 +1623,8 @@ int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
                 return -EPERM;
         if (!bus_type_is_basic(type))
                 return -EINVAL;
+        if (!p)
+                return -EINVAL;
 
         c = message_get_container(m);
 
@@ -1429,8 +1653,13 @@ int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
                 if (r == 0)
                         return -EBADMSG;
 
-                if (!validate_string(q, l))
-                        return -EBADMSG;
+                if (type == SD_BUS_TYPE_OBJECT_PATH) {
+                        if (!validate_object_path(q, l))
+                                return -EBADMSG;
+                } else {
+                        if (!validate_string(q, l))
+                                return -EBADMSG;
+                }
 
                 m->rindex = rindex;
                 *(const char**) p = q;
@@ -1462,12 +1691,15 @@ int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
         }
 
         default: {
-                size_t sz, align;
+                ssize_t sz, align;
+                size_t rindex;
 
                 align = bus_type_get_alignment(type);
                 sz = bus_type_get_size(type);
+                assert(align > 0 && sz > 0);
 
-                r = message_peek_body(m, &m->rindex, align, sz, &q);
+                rindex = m->rindex;
+                r = message_peek_body(m, &rindex, align, sz, &q);
                 if (r <= 0)
                         return r;
 
@@ -1497,10 +1729,23 @@ int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
                         *(uint64_t*) p = BUS_MESSAGE_BSWAP64(m, *(uint64_t*) q);
                         break;
 
+                case SD_BUS_TYPE_UNIX_FD: {
+                        uint32_t j;
+
+                        j = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
+                        if (j >= m->n_fds)
+                                return -EBADMSG;
+
+                        *(int*) p = m->fds[j];
+                        break;
+                }
+
                 default:
                         assert_not_reached("Unknown basic type...");
                 }
 
+                        m->rindex = rindex;
+
                 break;
         }
         }
@@ -1547,7 +1792,7 @@ static int bus_message_enter_array(
         if (r <= 0)
                 return r;
 
-        if (BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q) > 67108864)
+        if (BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q) > BUS_ARRAY_MAX_SIZE)
                 return -EBADMSG;
 
         r = message_peek_body(m, &rindex, alignment, 0, NULL);
@@ -1704,6 +1949,25 @@ int sd_bus_message_enter_container(sd_bus_message *m, char type, const char *con
         if (!contents)
                 return -EINVAL;
 
+        /*
+         * We enforce a global limit on container depth, that is much
+         * higher than the 32 structs and 32 arrays the specification
+         * mandates. This is simpler to implement for us, and we need
+         * this only to ensure our container array doesn't grow
+         * without bounds. We are happy to return any data from a
+         * message as long as the data itself is valid, even if the
+         * overall message might be not.
+         *
+         * Note that the message signature is validated when
+         * parsing the headers, and that validation does check the
+         * 32/32 limit.
+         *
+         * Note that the specification defines no limits on the depth
+         * of stacked variants, but we do.
+         */
+        if (m->n_containers >= BUS_CONTAINER_DEPTH)
+                return -EBADMSG;
+
         w = realloc(m->containers, sizeof(struct bus_container) * (m->n_containers + 1));
         if (!w)
                 return -ENOMEM;
@@ -1919,15 +2183,56 @@ int sd_bus_message_rewind(sd_bus_message *m, int complete) {
 
         return !isempty(c->signature);
 }
+static int message_read_ap(
+                sd_bus_message *m,
+                const char *types,
+                va_list ap) {
 
-static int message_read_ap(sd_bus_message *m, const char *types, va_list ap) {
-        const char *t;
+        unsigned n_array, n_struct;
+        TypeStack stack[BUS_CONTAINER_DEPTH];
+        unsigned stack_ptr = 0;
         int r;
 
         assert(m);
-        assert(types);
 
-        for (t = types; *t; t++) {
+        if (!types)
+                return 0;
+
+        /* Ideally, we'd just call ourselves recursively on every
+         * complex type. However, the state of a va_list that is
+         * passed to a function is undefined after that function
+         * returns. This means we need to docode the va_list linearly
+         * in a single stackframe. We hence implement our own
+         * home-grown stack in an array. */
+
+        n_array = (unsigned) -1;
+        n_struct = strlen(types);
+
+        for (;;) {
+                const char *t;
+
+                if (n_array == 0 || (n_array == (unsigned) -1 && n_struct == 0)) {
+                        r = type_stack_pop(stack, ELEMENTSOF(stack), &stack_ptr, &types, &n_struct, &n_array);
+                        if (r < 0)
+                                return r;
+                        if (r == 0)
+                                break;
+
+                        r = sd_bus_message_exit_container(m);
+                        if (r < 0)
+                                return r;
+
+                        continue;
+                }
+
+                t = types;
+                if (n_array != (unsigned) -1)
+                        n_array --;
+                else {
+                        types ++;
+                        n_struct--;
+                }
+
                 switch (*t) {
 
                 case SD_BUS_TYPE_BYTE:
@@ -1941,11 +2246,17 @@ static int message_read_ap(sd_bus_message *m, const char *types, va_list ap) {
                 case SD_BUS_TYPE_DOUBLE:
                 case SD_BUS_TYPE_STRING:
                 case SD_BUS_TYPE_OBJECT_PATH:
-                case SD_BUS_TYPE_SIGNATURE: {
+                case SD_BUS_TYPE_SIGNATURE:
+                case SD_BUS_TYPE_UNIX_FD: {
                         void *p;
 
                         p = va_arg(ap, void*);
                         r = sd_bus_message_read_basic(m, *t, p);
+                        if (r < 0)
+                                return r;
+                        if (r == 0)
+                                return -ENXIO;
+
                         break;
                 }
 
@@ -1957,29 +2268,30 @@ static int message_read_ap(sd_bus_message *m, const char *types, va_list ap) {
                                 return r;
 
                         {
-                                unsigned i, n;
                                 char s[k + 1];
-
                                 memcpy(s, t + 1, k);
                                 s[k] = 0;
-                                t += k;
 
                                 r = sd_bus_message_enter_container(m, SD_BUS_TYPE_ARRAY, s);
                                 if (r < 0)
                                         return r;
                                 if (r == 0)
                                         return -ENXIO;
+                        }
 
-                                n = va_arg(ap, unsigned);
-                                for (i = 0; i < n; i++) {
-                                        r = message_read_ap(m, s, ap);
-                                        if (r < 0)
-                                                return r;
-                                }
-
-                                r = sd_bus_message_exit_container(m);
+                        if (n_array == (unsigned) -1) {
+                                types += k;
+                                n_struct -= k;
                         }
 
+                        r = type_stack_push(stack, ELEMENTSOF(stack), &stack_ptr, types, n_struct, n_array);
+                        if (r < 0)
+                                return r;
+
+                        types = t + 1;
+                        n_struct = k;
+                        n_array = va_arg(ap, unsigned);
+
                         break;
                 }
 
@@ -1996,13 +2308,14 @@ static int message_read_ap(sd_bus_message *m, const char *types, va_list ap) {
                         if (r == 0)
                                 return -ENXIO;
 
-                        r = message_read_ap(m, s, ap);
+                        r = type_stack_push(stack, ELEMENTSOF(stack), &stack_ptr, types, n_struct, n_array);
                         if (r < 0)
                                 return r;
-                        if (r == 0)
-                                return -ENXIO;
 
-                        r = sd_bus_message_exit_container(m);
+                        types = s;
+                        n_struct = strlen(s);
+                        n_array = (unsigned) -1;
+
                         break;
                 }
 
@@ -2024,29 +2337,27 @@ static int message_read_ap(sd_bus_message *m, const char *types, va_list ap) {
                                         return r;
                                 if (r == 0)
                                         return -ENXIO;
+                        }
 
-                                t += k - 1;
+                        if (n_array == (unsigned) -1) {
+                                types += k - 1;
+                                n_struct -= k - 1;
+                        }
 
-                                r = message_read_ap(m, s, ap);
-                                if (r < 0)
-                                        return r;
-                                if (r == 0)
-                                        return -ENXIO;
+                        r = type_stack_push(stack, ELEMENTSOF(stack), &stack_ptr, types, n_struct, n_array);
+                        if (r < 0)
+                                return r;
 
-                                r = sd_bus_message_exit_container(m);
-                        }
+                        types = t + 1;
+                        n_struct = k - 2;
+                        n_array = (unsigned) -1;
 
                         break;
                 }
 
                 default:
-                        r = -EINVAL;
+                        return -EINVAL;
                 }
-
-                if (r < 0)
-                        return r;
-                if (r == 0)
-                        return -ENXIO;
         }
 
         return 1;
@@ -2084,12 +2395,11 @@ static int message_peek_fields(
         return buffer_peek(m->fields, BUS_MESSAGE_FIELDS_SIZE(m), rindex, align, nbytes, ret);
 }
 
-static int message_peek_field_string(
+static int message_peek_field_uint32(
                 sd_bus_message *m,
                 size_t *ri,
-                const char **ret) {
+                uint32_t *ret) {
 
-        size_t l;
         int r;
         void *q;
 
@@ -2100,43 +2410,43 @@ static int message_peek_field_string(
         if (r < 0)
                 return r;
 
-        l = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
-        r = message_peek_fields(m, ri, 1, l+1, &q);
-        if (r < 0)
-                return r;
-
-        if (!validate_string(q, l))
-                return -EBADMSG;
-
         if (ret)
-                *ret = q;
+                *ret = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
 
         return 0;
 }
 
-static int message_peek_field_signature(
+static int message_peek_field_string(
                 sd_bus_message *m,
+                bool (*validate)(const char *p),
                 size_t *ri,
                 const char **ret) {
 
-        size_t l;
+        uint32_t l;
         int r;
         void *q;
 
         assert(m);
         assert(ri);
 
-        r = message_peek_fields(m, ri, 1, 1, &q);
+        r = message_peek_field_uint32(m, ri, &l);
         if (r < 0)
                 return r;
 
-        l = *(uint8_t*) q;
         r = message_peek_fields(m, ri, 1, l+1, &q);
         if (r < 0)
                 return r;
 
-        if (!validate_signature(q, l))
-                return -EBADMSG;
+        if (validate) {
+                if (!validate_nul(q, l))
+                        return -EBADMSG;
+
+                if (!validate(q))
+                        return -EBADMSG;
+        } else {
+                if (!validate_string(q, l))
+                        return -EBADMSG;
+        }
 
         if (ret)
                 *ret = q;
@@ -2144,23 +2454,32 @@ static int message_peek_field_signature(
         return 0;
 }
 
-static int message_peek_field_uint32(
+static int message_peek_field_signature(
                 sd_bus_message *m,
                 size_t *ri,
-                uint32_t *ret) {
+                const char **ret) {
 
+        size_t l;
         int r;
         void *q;
 
         assert(m);
         assert(ri);
 
-        r = message_peek_fields(m, ri, 4, 4, &q);
+        r = message_peek_fields(m, ri, 1, 1, &q);
         if (r < 0)
                 return r;
 
+        l = *(uint8_t*) q;
+        r = message_peek_fields(m, ri, 1, l+1, &q);
+        if (r < 0)
+                return r;
+
+        if (!validate_signature(q, l))
+                return -EBADMSG;
+
         if (ret)
-                *ret = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
+                *ret = q;
 
         return 0;
 }
@@ -2182,7 +2501,6 @@ static int message_skip_fields(
 
         for (;;) {
                 char t;
-                void *q;
                 size_t l;
 
                 if (array_size != (uint32_t) -1 &&
@@ -2193,10 +2511,17 @@ static int message_skip_fields(
                 if (!t)
                         return 0;
 
-                if (t == SD_BUS_TYPE_STRING ||
-                    t == SD_BUS_TYPE_OBJECT_PATH) {
+                if (t == SD_BUS_TYPE_STRING) {
+
+                        r = message_peek_field_string(m, NULL, ri, NULL);
+                        if (r < 0)
+                                return r;
+
+                        (*signature)++;
+
+                } else if (t == SD_BUS_TYPE_OBJECT_PATH) {
 
-                        r = message_peek_field_string(m, ri, NULL);
+                        r = message_peek_field_string(m, object_path_is_valid, ri, NULL);
                         if (r < 0)
                                 return r;
 
@@ -2211,10 +2536,11 @@ static int message_skip_fields(
                         (*signature)++;
 
                 } else if (bus_type_is_basic(t)) {
-                        size_t align, k;
+                        ssize_t align, k;
 
-                        align = bus_type_get_alignment(align);
-                        k = bus_type_get_size(align);
+                        align = bus_type_get_alignment(t);
+                        k = bus_type_get_size(t);
+                        assert(align > 0 && k > 0);
 
                         r = message_peek_fields(m, ri, align, k, NULL);
                         if (r < 0)
@@ -2231,7 +2557,7 @@ static int message_skip_fields(
                         assert(l >= 1);
                         {
                                 char sig[l-1], *s;
-                                size_t nas;
+                                uint32_t nas;
                                 int alignment;
 
                                 strncpy(sig, *signature + 1, l-1);
@@ -2241,12 +2567,10 @@ static int message_skip_fields(
                                 if (alignment < 0)
                                         return alignment;
 
-                                r = message_peek_fields(m, ri, 4, 4, &q);
+                                r = message_peek_field_uint32(m, ri, &nas);
                                 if (r < 0)
                                         return r;
-
-                                nas = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
-                                if (nas > 67108864)
+                                if (nas > BUS_ARRAY_MAX_SIZE)
                                         return -EBADMSG;
 
                                 r = message_peek_fields(m, ri, alignment, 0, NULL);
@@ -2297,9 +2621,10 @@ static int message_skip_fields(
         }
 }
 
-static int message_parse_fields(sd_bus_message *m) {
+int bus_message_parse_fields(sd_bus_message *m) {
         size_t ri;
         int r;
+        uint32_t unix_fds = 0;
 
         assert(m);
 
@@ -2320,45 +2645,69 @@ static int message_parse_fields(sd_bus_message *m) {
                         return -EBADMSG;
 
                 case SD_BUS_MESSAGE_HEADER_PATH:
+
+                        if (m->path)
+                                return -EBADMSG;
+
                         if (!streq(signature, "o"))
                                 return -EBADMSG;
 
-                        r = message_peek_field_string(m, &ri, &m->path);
+                        r = message_peek_field_string(m, object_path_is_valid, &ri, &m->path);
                         break;
 
                 case SD_BUS_MESSAGE_HEADER_INTERFACE:
+
+                        if (m->interface)
+                                return -EBADMSG;
+
                         if (!streq(signature, "s"))
                                 return -EBADMSG;
 
-                        r = message_peek_field_string(m, &ri, &m->interface);
+                        r = message_peek_field_string(m, interface_name_is_valid, &ri, &m->interface);
                         break;
 
                 case SD_BUS_MESSAGE_HEADER_MEMBER:
+
+                        if (m->member)
+                                return -EBADMSG;
+
                         if (!streq(signature, "s"))
                                 return -EBADMSG;
 
-                        r = message_peek_field_string(m, &ri, &m->member);
+                        r = message_peek_field_string(m, member_name_is_valid, &ri, &m->member);
                         break;
 
                 case SD_BUS_MESSAGE_HEADER_ERROR_NAME:
+
+                        if (m->error.name)
+                                return -EBADMSG;
+
                         if (!streq(signature, "s"))
                                 return -EBADMSG;
 
-                        r = message_peek_field_string(m, &ri, &m->error.name);
+                        r = message_peek_field_string(m, error_name_is_valid, &ri, &m->error.name);
                         break;
 
                 case SD_BUS_MESSAGE_HEADER_DESTINATION:
+
+                        if (m->destination)
+                                return -EBADMSG;
+
                         if (!streq(signature, "s"))
                                 return -EBADMSG;
 
-                        r = message_peek_field_string(m, &ri, &m->destination);
+                        r = message_peek_field_string(m, service_name_is_valid, &ri, &m->destination);
                         break;
 
                 case SD_BUS_MESSAGE_HEADER_SENDER:
+
+                        if (m->sender)
+                                return -EBADMSG;
+
                         if (!streq(signature, "s"))
                                 return -EBADMSG;
 
-                        r = message_peek_field_string(m, &ri, &m->sender);
+                        r = message_peek_field_string(m, service_name_is_valid, &ri, &m->sender);
                         break;
 
 
@@ -2366,6 +2715,9 @@ static int message_parse_fields(sd_bus_message *m) {
                         const char *s;
                         char *c;
 
+                        if (m->root_container.signature)
+                                return -EBADMSG;
+
                         if (!streq(signature, "g"))
                                 return -EBADMSG;
 
@@ -2379,16 +2731,39 @@ static int message_parse_fields(sd_bus_message *m) {
 
                         free(m->root_container.signature);
                         m->root_container.signature = c;
-
-                        r = 0;
                         break;
                 }
 
                 case SD_BUS_MESSAGE_HEADER_REPLY_SERIAL:
+                        if (m->reply_serial != 0)
+                                return -EBADMSG;
+
                         if (!streq(signature, "u"))
                                 return -EBADMSG;
 
                         r = message_peek_field_uint32(m, &ri, &m->reply_serial);
+                        if (r < 0)
+                                return r;
+
+                        if (m->reply_serial == 0)
+                                return -EBADMSG;
+
+                        break;
+
+                case SD_BUS_MESSAGE_HEADER_UNIX_FDS:
+                        if (unix_fds != 0)
+                                return -EBADMSG;
+
+                        if (!streq(signature, "u"))
+                                return -EBADMSG;
+
+                        r = message_peek_field_uint32(m, &ri, &unix_fds);
+                        if (r < 0)
+                                return -EBADMSG;
+
+                        if (unix_fds == 0)
+                                return -EBADMSG;
+
                         break;
 
                 default:
@@ -2399,6 +2774,9 @@ static int message_parse_fields(sd_bus_message *m) {
                         return r;
         }
 
+        if (m->n_fds != unix_fds)
+                return -EBADMSG;
+
         if (isempty(m->root_container.signature) != (BUS_MESSAGE_BODY_SIZE(m) == 0))
                 return -EBADMSG;
 
@@ -2436,37 +2814,6 @@ static int message_parse_fields(sd_bus_message *m) {
         return 0;
 }
 
-static void setup_iovec(sd_bus_message *m) {
-        assert(m);
-        assert(m->sealed);
-
-        m->n_iovec = 0;
-
-        m->iovec[m->n_iovec].iov_base = m->header;
-        m->iovec[m->n_iovec].iov_len = sizeof(*m->header);
-        m->n_iovec++;
-
-        if (m->fields) {
-                m->iovec[m->n_iovec].iov_base = m->fields;
-                m->iovec[m->n_iovec].iov_len = m->header->fields_size;
-                m->n_iovec++;
-
-                if (m->header->fields_size % 8 != 0) {
-                        static const uint8_t padding[7] = { 0, 0, 0, 0, 0, 0, 0 };
-
-                        m->iovec[m->n_iovec].iov_base = (void*) padding;
-                        m->iovec[m->n_iovec].iov_len = 8 - m->header->fields_size % 8;
-                        m->n_iovec++;
-                }
-        }
-
-        if (m->body) {
-                m->iovec[m->n_iovec].iov_base = m->body;
-                m->iovec[m->n_iovec].iov_len = m->header->body_size;
-                m->n_iovec++;
-        }
-}
-
 int bus_message_seal(sd_bus_message *m, uint64_t serial) {
         int r;
 
@@ -2494,8 +2841,6 @@ int bus_message_seal(sd_bus_message *m, uint64_t serial) {
         m->header->serial = serial;
         m->sealed = true;
 
-        setup_iovec(m);
-
         return 0;
 }
 
@@ -2557,6 +2902,16 @@ int bus_message_dump(sd_bus_message *m) {
                strna(m->error.message),
                yes_no(m->sealed));
 
+        if (m->pid != 0)
+                printf("\tpid=%lu\n", (unsigned long) m->pid);
+        if (m->tid != 0)
+                printf("\ttid=%lu\n", (unsigned long) m->tid);
+        if (m->uid_valid)
+                printf("\tuid=%lu\n", (unsigned long) m->uid);
+        if (m->gid_valid)
+                printf("\tgid=%lu\n", (unsigned long) m->gid);
+
+
         r = sd_bus_message_rewind(m, true);
         if (r < 0) {
                 log_error("Failed to rewind: %s", strerror(-r));
@@ -2711,22 +3066,31 @@ int bus_message_dump(sd_bus_message *m) {
 
 int bus_message_get_blob(sd_bus_message *m, void **buffer, size_t *sz) {
         size_t total;
-        unsigned i;
         void *p, *e;
 
         assert(m);
         assert(buffer);
         assert(sz);
 
-        for (i = 0, total = 0; i < m->n_iovec; i++)
-                total += m->iovec[i].iov_len;
+        total = BUS_MESSAGE_SIZE(m);
 
         p = malloc(total);
         if (!p)
                 return -ENOMEM;
 
-        for (i = 0, e = p; i < m->n_iovec; i++)
-                e = mempcpy(e, m->iovec[i].iov_base, m->iovec[i].iov_len);
+        e = mempcpy(p, m->header, sizeof(*m->header));
+
+        if (m->fields) {
+                e = mempcpy(e, m->fields, m->header->fields_size);
+
+                if (m->header->fields_size % 8 != 0)
+                        e = mempset(e, 0, 8 - (m->header->fields_size % 8));
+        }
+
+        if (m->body)
+                e = mempcpy(e, m->body, m->header->body_size);
+
+        assert(total == (size_t) ((uint8_t*) e - (uint8_t*) p));
 
         *buffer = p;
         *sz = total;
@@ -2764,3 +3128,57 @@ int bus_message_read_strv_extend(sd_bus_message *m, char ***l) {
 
         return 0;
 }
+
+const char* bus_message_get_arg(sd_bus_message *m, unsigned i) {
+        int r;
+        const char *t;
+        char type;
+
+        assert(m);
+
+        r = sd_bus_message_rewind(m, true);
+        if (r < 0)
+                return NULL;
+
+        while (i > 0) {
+                r = sd_bus_message_peek_type(m, &type, NULL);
+                if (r < 0)
+                        return NULL;
+
+                if (type != SD_BUS_TYPE_STRING &&
+                    type != SD_BUS_TYPE_OBJECT_PATH &&
+                    type != SD_BUS_TYPE_SIGNATURE)
+                        return NULL;
+
+                r = sd_bus_message_read_basic(m, type, &t);
+                if (r < 0)
+                        return NULL;
+
+                i--;
+        }
+
+        r = sd_bus_message_rewind(m, true);
+        if (r < 0)
+                return NULL;
+
+        return t;
+}
+
+int bus_header_size(struct bus_header *h, size_t *sum) {
+        size_t fs, bs;
+
+        assert(h);
+        assert(sum);
+
+        if (h->endian == SD_BUS_NATIVE_ENDIAN) {
+                fs = h->fields_size;
+                bs = h->body_size;
+        } else if (h->endian == SD_BUS_REVERSE_ENDIAN) {
+                fs = bswap_32(h->fields_size);
+                bs = bswap_32(h->body_size);
+        } else
+                return -EBADMSG;
+
+        *sum = sizeof(struct bus_header) + ALIGN8(fs) + bs;
+        return 0;
+}