cprover
piped_process.cpp
Go to the documentation of this file.
1 
5 // NOTES ON WINDOWS PIPES IMPLEMENTATION
6 //
7 // This is a note to explain the choices related to the Windows pipes
8 // implementation and to serve as information for future work on the
9 // Windows parts of this class.
10 //
11 // Windows supports two kinds of pipes: anonymous and named.
12 //
13 // Anonymous pipes can only operate in blocking mode. This is a problem for
14 // this class because blocking mode pipes (on Windows) will not allow the
15 // other end to read until the process providing the data has terminated.
16 // (You might think that this is not necessary, but in practice this is
17 // the case.) For example, if we ran
18 // echo The Jabberwocky; ping 127.0.0.1 -n 6 >nul
19 // on the command line in Windows we would see the string "The Jabberwocky"
20 // immediately, and then the command would end about 6 seconds later after the
21 // pings complete. However, a blocking pipe will see nothing until the ping
22 // command has finished, even if the echo has completed and (supposedly)
23 // written to the pipe.
24 //
25 // For the above reason, we NEED to be able to use non-blocking pipes. Since
26 // anonymous pipes cannot be non-blocking (in theory they have a named pipe
27 // underneath, but it's not clear you could hack this to be non-blocking
28 // safely), we have to use named pipes.
29 //
30 // Named pipes can be non-blocking and this is how we create them.
31 //
32 // Aside on security:
33 // Named pipes can be connected to by other processes and here we have NOT
34 // gone deep into the security handling. The default used here is to allow
35 // access from the same session token/permissions. This SHOULD be sufficient
36 // for what we need.
37 //
38 // Non-blocking pipes allow immediate reading of any data on the pipe which
39 // matches the Linux/MacOS pipe behaviour and also allows reading of the
40 // string "The Jabberwocky" from the example above before waiting for the ping
41 // command to terminate. This reading can be done with any of the usual pipe
42 // read/peek functions, so we use those.
43 //
44 // There is one problem with the approach used here, that there is no Windows
45 // function that can wait on a non-blocking pipe. There are a few options that
46 // appear like they would work (or claim they work). Details on these and why
47 // they don't work are over-viewed here:
48 // - WaitCommEvent claims it can wait for events on a handle (e.g. char
49 // written) which would be perfect. Unfortunately on a non-blocking pipe
50 // this returns immediately. Using this on a blocking pipe fails to detect
51 // that a character is written until the other process terminates in the
52 // example above, making this ineffective for what we want.
53 // - Setting the pipe timeout or changing blocking after creation. This is
54 // theoretically possible, but in practice either has no effect, or can
55 // cause a segmentation fault. This was attempted with the SetCommTimeouts
56 // function and cause segfault.
57 // - Using a wait for event function (e.g. WaitForMultipleObjects, also single
58 // object, event, etc.). These can in theory wait until an event, but have
59 // the problem that with non-blocking pipes, the wait will not happen since
60 // they return immediately. One might think they can work with a blocking
61 // pipe and a timeout (i.e. have a blocking read and a timeout thread and
62 // wait for one of them to happen to see if there is something to read or
63 // whether we could timeout). However, while this can create the right
64 // wait and timeout behaviour, since the underlying pipe is blocking this
65 // means the example above cannot read "The Jabberwocky" until the ping has
66 // finished, again undoing the interactive behaviour desired.
67 // Since none of the above work effectivley, the chosen approach is to use a
68 // non-blocking peek to see if there is anthing to read, and use a sleep and
69 // poll behaviour that might be much busier than we want. At the time of
70 // writing this has not been made smart, just a first choice option for how
71 // frequently to poll.
72 //
73 // Conclusion
74 // The implementation is written this way to mitigate the problems with what
75 // can and cannot be done with Windows pipes. It's not always pretty, but it
76 // does work and handles what we want.
77 
78 #ifdef _WIN32
79 # include "run.h" // for Windows arg quoting
80 # include "unicode.h" // for widen function
81 # include <tchar.h> // library for _tcscpy function
82 # include <util/make_unique.h>
83 # include <windows.h>
84 #else
85 # include <fcntl.h> // library for fcntl function
86 # include <poll.h> // library for poll function
87 # include <signal.h> // library for kill function
88 # include <unistd.h> // library for read/write/sleep/etc. functions
89 #endif
90 
91 # include <cstring> // library for strerror function (on linux)
92 # include <iostream>
93 # include <vector>
94 
95 # include "exception_utils.h"
96 # include "invariant.h"
97 # include "narrow.h"
98 # include "optional.h"
99 # include "piped_process.h"
100 # include "string_utils.h"
101 
102 # define BUFSIZE 2048
103 
104 #ifdef _WIN32
110 static std::wstring
111 prepare_windows_command_line(const std::vector<std::string> &commandvec)
112 {
113  std::wstring result = widen(commandvec[0]);
114  for(int i = 1; i < commandvec.size(); i++)
115  {
116  result.append(L" ");
117  result.append(quote_windows_arg(widen(commandvec[i])));
118  }
119  return result;
120 }
121 #endif
122 
123 piped_processt::piped_processt(const std::vector<std::string> &commandvec)
124 {
125 # ifdef _WIN32
126  // Security attributes for pipe creation
127  SECURITY_ATTRIBUTES sec_attr;
128  sec_attr.nLength = sizeof(SECURITY_ATTRIBUTES);
129  // Ensure pipes are inherited
130  sec_attr.bInheritHandle = TRUE;
131  // This sets the security to the default for the current session access token
132  // See following link for details
133  // https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa379560(v=vs.85) //NOLINT
134  sec_attr.lpSecurityDescriptor = NULL;
135  // Use named pipes to allow non-blocking read
136  // Build the base name for the pipes
137  std::string base_name = "\\\\.\\pipe\\cbmc\\child\\";
138  // Use process ID as a unique ID for this process at this time.
139  base_name.append(std::to_string(GetCurrentProcessId()));
140  const std::string in_name = base_name + "\\IN";
141  child_std_IN_Wr = CreateNamedPipe(
142  in_name.c_str(),
143  PIPE_ACCESS_OUTBOUND, // Writing for us
144  PIPE_TYPE_BYTE | PIPE_NOWAIT, // Bytes and non-blocking
145  PIPE_UNLIMITED_INSTANCES, // Probably doesn't matter
146  BUFSIZE,
147  BUFSIZE, // Output and input bufffer sizes
148  0, // Timeout in ms, 0 = use system default
149  // This is the timeout that WaitNamedPipe functions will wait to try
150  // and connect before aborting if no instance of the pipe is available.
151  // In practice this is not used since we connect immediately and only
152  // use one instance (no waiting for a free instance).
153  &sec_attr); // For inheritance by child
154  if(child_std_IN_Rd == INVALID_HANDLE_VALUE)
155  {
156  throw system_exceptiont("Input pipe creation failed for child_std_IN_Rd");
157  }
158  // Connect to the other side of the pipe
159  child_std_IN_Rd = CreateFile(
160  in_name.c_str(),
161  GENERIC_READ, // Read side
162  FILE_SHARE_READ | FILE_SHARE_WRITE, // Shared read/write
163  &sec_attr, // Need this for inherit
164  OPEN_EXISTING, // Opening other end
165  FILE_ATTRIBUTE_NORMAL | FILE_FLAG_NO_BUFFERING, // Normal, but don't buffer
166  NULL);
167  if(child_std_IN_Wr == INVALID_HANDLE_VALUE)
168  {
169  throw system_exceptiont("Input pipe creation failed for child_std_IN_Wr");
170  }
171  if(!SetHandleInformation(
172  child_std_IN_Rd, HANDLE_FLAG_INHERIT, HANDLE_FLAG_INHERIT))
173  {
174  throw system_exceptiont(
175  "Input pipe creation failed on SetHandleInformation");
176  }
177  const std::string out_name = base_name + "\\OUT";
178  child_std_OUT_Rd = CreateNamedPipe(
179  out_name.c_str(),
180  PIPE_ACCESS_INBOUND, // Reading for us
181  PIPE_TYPE_BYTE | PIPE_NOWAIT, // Bytes and non-blocking
182  PIPE_UNLIMITED_INSTANCES, // Probably doesn't matter
183  BUFSIZE,
184  BUFSIZE, // Output and input bufffer sizes
185  0, // Timeout in ms, 0 = use system default
186  &sec_attr); // For inheritance by child
187  if(child_std_OUT_Rd == INVALID_HANDLE_VALUE)
188  {
189  throw system_exceptiont("Output pipe creation failed for child_std_OUT_Rd");
190  }
191  child_std_OUT_Wr = CreateFile(
192  out_name.c_str(),
193  GENERIC_WRITE, // Write side
194  FILE_SHARE_READ | FILE_SHARE_WRITE, // Shared read/write
195  &sec_attr, // Need this for inherit
196  OPEN_EXISTING, // Opening other end
197  FILE_ATTRIBUTE_NORMAL | FILE_FLAG_NO_BUFFERING, // Normal, but don't buffer
198  NULL);
199  if(child_std_OUT_Wr == INVALID_HANDLE_VALUE)
200  {
201  throw system_exceptiont("Output pipe creation failed for child_std_OUT_Wr");
202  }
203  if(!SetHandleInformation(child_std_OUT_Rd, HANDLE_FLAG_INHERIT, 0))
204  {
205  throw system_exceptiont(
206  "Output pipe creation failed on SetHandleInformation");
207  }
208  // Create the child process
209  STARTUPINFOW start_info;
210  proc_info = util_make_unique<PROCESS_INFORMATION>();
211  ZeroMemory(proc_info.get(), sizeof(PROCESS_INFORMATION));
212  ZeroMemory(&start_info, sizeof(STARTUPINFOW));
213  start_info.cb = sizeof(STARTUPINFOW);
214  start_info.hStdError = child_std_OUT_Wr;
215  start_info.hStdOutput = child_std_OUT_Wr;
216  start_info.hStdInput = child_std_IN_Rd;
217  start_info.dwFlags |= STARTF_USESTDHANDLES;
218  const std::wstring cmdline = prepare_windows_command_line(commandvec);
219  // Note that we do NOT free this since it becomes part of the child
220  // and causes heap corruption in Windows if we free!
221  const BOOL success = CreateProcessW(
222  NULL, // application name, we only use the command below
223  _wcsdup(cmdline.c_str()), // command line
224  NULL, // process security attributes
225  NULL, // primary thread security attributes
226  TRUE, // handles are inherited
227  0, // creation flags
228  NULL, // use parent's environment
229  NULL, // use parent's current directory
230  &start_info, // STARTUPINFO pointer
231  proc_info.get()); // receives PROCESS_INFORMATION
232  // Close handles to the stdin and stdout pipes no longer needed by the
233  // child process. If they are not explicitly closed, there is no way to
234  // recognize that the child process has ended (but maybe we don't care).
235  CloseHandle(child_std_OUT_Wr);
236  CloseHandle(child_std_IN_Rd);
237  if(!success)
238  throw system_exceptiont("Process creation failed.");
239 # else
240 
241  if(pipe(pipe_input) == -1)
242  {
243  throw system_exceptiont("Input pipe creation failed");
244  }
245 
246  if(pipe(pipe_output) == -1)
247  {
248  throw system_exceptiont("Output pipe creation failed");
249  }
250 
251 
252  if(fcntl(pipe_output[0], F_SETFL, O_NONBLOCK) < 0)
253  {
254  throw system_exceptiont("Setting pipe non-blocking failed");
255  }
256 
257  // Create a new process for the child that will execute the
258  // command and receive information via pipes.
259  child_process_id = fork();
260  if(child_process_id == 0)
261  {
262  // child process here
263 
264  // Close pipes that will be used by the parent so we do
265  // not have our own copies and conflicts.
266  close(pipe_input[1]);
267  close(pipe_output[0]);
268 
269  // Duplicate pipes so we have the ones we need.
270  dup2(pipe_input[0], STDIN_FILENO);
271  dup2(pipe_output[1], STDOUT_FILENO);
272  dup2(pipe_output[1], STDERR_FILENO);
273 
274  // Create a char** for the arguments (all the contents of commandvec
275  // except the first element, i.e. the command itself).
276  char **args =
277  reinterpret_cast<char **>(malloc((commandvec.size()) * sizeof(char *)));
278  // Add all the arguments to the args array of char *.
279  unsigned long i = 0;
280  while(i < commandvec.size())
281  {
282  args[i] = strdup(commandvec[i].c_str());
283  i++;
284  }
285  args[i] = NULL;
286  execvp(commandvec[0].c_str(), args);
287  // The args variable will be handled by the OS if execvp succeeds, but
288  // if execvp fails then we should free it here (just in case the runtime
289  // error below continues execution.)
290  while(i > 0)
291  {
292  i--;
293  free(args[i]);
294  }
295  free(args);
296  // Only reachable if execvp failed
297  // Note that here we send to std::cerr since we are in the child process
298  // here and this is received by the parent process.
299  std::cerr << "Launching " << commandvec[0]
300  << " failed with error: " << std::strerror(errno) << std::endl;
301  abort();
302  }
303  else
304  {
305  // parent process here
306  // Close pipes to be used by the child process
307  close(pipe_input[0]);
308  close(pipe_output[1]);
309 
310  // Get stream for sending to the child process
311  command_stream = fdopen(pipe_input[1], "w");
312  }
313 # endif
315 }
316 
318 {
319 # ifdef _WIN32
320  TerminateProcess(proc_info->hProcess, 0);
321  // Disconnecting the pipes also kicks the client off, it should be killed
322  // by now, but this will also force the client off.
323  // Note that pipes are cleaned up by Windows when all handles to the pipe
324  // are closed. Disconnect may be superfluous here.
325  DisconnectNamedPipe(child_std_OUT_Rd);
326  DisconnectNamedPipe(child_std_IN_Wr);
327  CloseHandle(child_std_OUT_Rd);
328  CloseHandle(child_std_IN_Wr);
329  CloseHandle(proc_info->hProcess);
330  CloseHandle(proc_info->hThread);
331 # else
332  // Close the parent side of the remaining pipes
333  fclose(command_stream);
334  // Note that the above will call close(pipe_input[1]);
335  close(pipe_output[0]);
336  // Send signal to the child process to terminate
337  kill(child_process_id, SIGTERM);
338 # endif
339 }
340 
341 NODISCARD
343 {
345  {
347  }
348 #ifdef _WIN32
349  const auto message_size = narrow<DWORD>(message.size());
350  DWORD bytes_written = 0;
351  if(!WriteFile(
352  child_std_IN_Wr, message.c_str(), message_size, &bytes_written, NULL))
353  {
354  // Error handling with GetLastError ?
355  return send_responset::FAILED;
356  }
357  INVARIANT(
358  message_size == bytes_written,
359  "Number of bytes written to sub process must match message size.");
360 #else
361  // send message to solver process
362  int send_status = fputs(message.c_str(), command_stream);
363  fflush(command_stream);
364 
365  if(send_status == EOF)
366  {
367  return send_responset::FAILED;
368  }
369 # endif
371 }
372 
374 {
375  INVARIANT(
377  "Can only receive() from a fully initialised process");
378  std::string response = std::string("");
379  char buff[BUFSIZE];
380  bool success = true;
381 #ifdef _WIN32
382  DWORD nbytes;
383 #else
384  int nbytes;
385 #endif
386  while(success)
387  {
388 #ifdef _WIN32
389  success = ReadFile(child_std_OUT_Rd, buff, BUFSIZE, &nbytes, NULL);
390 #else
391  nbytes = read(pipe_output[0], buff, BUFSIZE);
392  // Added the status back in here to keep parity with old implementation
393  // TODO: check which statuses are really used/needed.
394  if(nbytes == 0) // Update if the pipe is stopped
396  success = nbytes > 0;
397 #endif
398  INVARIANT(
399  nbytes < BUFSIZE,
400  "More bytes cannot be read at a time, than the size of the buffer");
401  if(nbytes > 0)
402  {
403  response.append(buff, nbytes);
404  }
405  }
406  return response;
407 }
408 
410 {
411  // can_receive(PIPED_PROCESS_INFINITE_TIMEOUT) waits an ubounded time until
412  // there is some data
414  return receive();
415 }
416 
418 {
419  return process_state;
420 }
421 
423 {
424  // unwrap the optional argument here
425  const int timeout = wait_time ? narrow<int>(*wait_time) : -1;
426 #ifdef _WIN32
427  int waited_time = 0;
428  DWORD total_bytes_available = 0;
429  while(timeout < 0 || waited_time >= timeout)
430  {
431  const LPVOID lpBuffer = nullptr;
432  const DWORD nBufferSize = 0;
433  const LPDWORD lpBytesRead = nullptr;
434  const LPDWORD lpTotalBytesAvail = &total_bytes_available;
435  const LPDWORD lpBytesLeftThisMessage = nullptr;
436  PeekNamedPipe(
437  child_std_OUT_Rd,
438  lpBuffer,
439  nBufferSize,
440  lpBytesRead,
441  lpTotalBytesAvail,
442  lpBytesLeftThisMessage);
443  if(total_bytes_available > 0)
444  {
445  return true;
446  }
447 // TODO make this define and choice better
448 # define WIN_POLL_WAIT 10
449  Sleep(WIN_POLL_WAIT);
450  waited_time += WIN_POLL_WAIT;
451  }
452 #else
453  struct pollfd fds // NOLINT
454  {
455  pipe_output[0], POLLIN, 0
456  };
457  nfds_t nfds = POLLIN;
458  const int ready = poll(&fds, nfds, timeout);
459 
460  switch(ready)
461  {
462  case -1:
463  // Error case
464  // Further error handling could go here
466  // fallthrough intended
467  case 0:
468  // Timeout case
469  // Do nothing for timeout and error fallthrough, default function behaviour
470  // is to return false.
471  break;
472  default:
473  // Found some events, check for POLLIN
474  if(fds.revents & POLLIN)
475  {
476  // we can read from the pipe here
477  return true;
478  }
479  // Some revent we did not ask for or check for, can't read though.
480  }
481 # endif
482  return false;
483 }
484 
486 {
487  return can_receive(0);
488 }
489 
491 {
492  while(process_state == statet::RUNNING && !can_receive(0))
493  {
494 #ifdef _WIN32
495  Sleep(wait_time);
496 #else
497  usleep(wait_time);
498 #endif
499  }
500 }
pid_t child_process_id
statet process_state
bool can_receive()
See if this process can receive data from the other process.
piped_processt(const std::vector< std::string > &commandvec)
Initiate a new subprocess with pipes supporting communication between the parent (this process) and t...
void wait_receivable(int wait_time)
Wait for the pipe to be ready, waiting specified time between checks.
std::string receive()
Read a string from the child process' output.
send_responset send(const std::string &message)
Send a string message (command) to the child process.
FILE * command_stream
statet
Enumeration to keep track of child process state.
Definition: piped_process.h:30
statet get_status()
Get child process status.
send_responset
Enumeration for send response.
Definition: piped_process.h:37
std::string wait_receive()
Wait until a string is available and read a string from the child process' output.
Thrown when some external system fails unexpectedly.
#define NODISCARD
Definition: nodiscard.h:22
nonstd::optional< T > optionalt
Definition: optional.h:35
#define BUFSIZE
Subprocess communication with pipes.
#define PIPED_PROCESS_INFINITE_TIMEOUT
Definition: piped_process.h:20
std::string to_string(const string_not_contains_constraintt &expr)
Used for debug printing.
std::wstring widen(const char *s)
Definition: unicode.cpp:48