Skip to content

feat: add ancillary data (control message) helpers for sendmsg/recvmsg#645

Open
seuros wants to merge 1 commit intorust-lang:masterfrom
seuros:ancillary-data-cmsg
Open

feat: add ancillary data (control message) helpers for sendmsg/recvmsg#645
seuros wants to merge 1 commit intorust-lang:masterfrom
seuros:ancillary-data-cmsg

Conversation

@seuros
Copy link

@seuros seuros commented Mar 20, 2026

Closes #614

Add Unix-only safe wrappers for CMSG_* operations:

  • cmsg_space(data_len) -> Option<usize>: compute control buffer size (returns None when data_len overflows c_uint, fixing a truncation path that would produce an undersized buffer)
  • ControlMessage<'a>: a parsed ancillary data entry (level, type, data)
  • ControlMessages<'a>: iterator over a received control buffer; walks via byte-offset arithmetic and ptr::read_unaligned so no aligned reference to cmsghdr is ever formed (avoids UB on 1-byte-aligned Vec buffers)
  • ControlMessageEncoder<'a>: builder for outgoing control messages; rejects payloads exceeding c_uint::MAX before calling CMSG_SPACE/CMSG_LEN to prevent buffer overflow from silent truncation

Also add a Cross CI job to run tests under QEMU on i686, aarch64, and armv7 Linux, the target families where CMSG_ALIGN factor and cmsg_len width differ from x86_64.

Enables SCM_RIGHTS file-descriptor passing without depending on libc directly (tracked by plabayo/rama#781).

I can remove the Cross tests if needed.

@seuros seuros force-pushed the ancillary-data-cmsg branch 4 times, most recently from c94de0c to c22b136 Compare March 20, 2026 21:18
Closes rust-lang#614

Add Unix-only safe wrappers for CMSG_* operations:

- `cmsg_space(data_len) -> Option<usize>`: compute control buffer size
  (returns None when data_len overflows c_uint, fixing a truncation path
  that would produce an undersized buffer)
- `ControlMessage<'a>`: a parsed ancillary data entry (level, type, data)
- `ControlMessages<'a>`: iterator over a received control buffer; walks
  via byte-offset arithmetic and ptr::read_unaligned so no aligned
  reference to cmsghdr is ever formed (avoids UB on 1-byte-aligned
  Vec<u8> buffers)
- `ControlMessageEncoder<'a>`: builder for outgoing control messages;
  rejects payloads exceeding c_uint::MAX before calling CMSG_SPACE/CMSG_LEN
  to prevent buffer overflow from silent truncation

Also add a Cross CI job to run tests under QEMU on i686, aarch64, and
armv7 Linux — the target families where CMSG_ALIGN factor and cmsg_len
width differ from x86_64.

Enables SCM_RIGHTS file-descriptor passing without depending on libc
directly (tracked by plabayo/rama#781).
@seuros seuros force-pushed the ancillary-data-cmsg branch from c22b136 to dd9b05e Compare March 20, 2026 21:31
@seuros
Copy link
Author

seuros commented Mar 20, 2026

The only remaining CI failure is FreeBSD (Cirrus CI) — this is an infrastructure flake, not a code issue:

error: failed to get `libc` as a dependency of package `socket2 v0.6.3`
Caused by: download of config.json failed
Caused by: failed to download from `https://index.crates.io/config.json`
Caused by: [60] SSL peer certificate or SSH remote key was not OK
  (SSL certificate OpenSSL verify result: unable to get local issuer certificate (20))

Cargo tries to update the crates.io index and hits an SSL cert verification failure in the Cirrus FreeBSD 14.3 VM. Unrelated to this PR! Verified manually on FreeBSD 16-Current where cargo build, cargo build --no-default-features, and all cmsg tests pass cleanly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support for ancillary data/control messages in sendmsg/recvmsg as well as the upcoming sendmmsg/recvmmsg

1 participant