| 1 | /* tempname.c - generate the name of a temporary file. |
| 2 | |
| 3 | Copyright (C) 1991-2003, 2005-2007, 2009-2019 Free Software Foundation, Inc. |
| 4 | |
| 5 | This program is free software: you can redistribute it and/or modify |
| 6 | it under the terms of the GNU General Public License as published by |
| 7 | the Free Software Foundation; either version 3 of the License, or |
| 8 | (at your option) any later version. |
| 9 | |
| 10 | This program is distributed in the hope that it will be useful, |
| 11 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 13 | GNU General Public License for more details. |
| 14 | |
| 15 | You should have received a copy of the GNU General Public License |
| 16 | along with this program. If not, see <https://www.gnu.org/licenses/>. */ |
| 17 | |
| 18 | /* Extracted from glibc sysdeps/posix/tempname.c. See also tmpdir.c. */ |
| 19 | |
| 20 | #if !_LIBC |
| 21 | # include <config.h> |
| 22 | # include "tempname.h" |
| 23 | #endif |
| 24 | |
| 25 | #include <sys/types.h> |
| 26 | #include <assert.h> |
| 27 | |
| 28 | #include <errno.h> |
| 29 | #ifndef __set_errno |
| 30 | # define __set_errno(Val) errno = (Val) |
| 31 | #endif |
| 32 | |
| 33 | #include <stdio.h> |
| 34 | #ifndef P_tmpdir |
| 35 | # define P_tmpdir "/tmp" |
| 36 | #endif |
| 37 | #ifndef TMP_MAX |
| 38 | # define TMP_MAX 238328 |
| 39 | #endif |
| 40 | #ifndef __GT_FILE |
| 41 | # define __GT_FILE 0 |
| 42 | # define __GT_DIR 1 |
| 43 | # define __GT_NOCREATE 2 |
| 44 | #endif |
| 45 | #if !_LIBC && (GT_FILE != __GT_FILE || GT_DIR != __GT_DIR \ |
| 46 | || GT_NOCREATE != __GT_NOCREATE) |
| 47 | # error report this to bug-gnulib@gnu.org |
| 48 | #endif |
| 49 | |
| 50 | #include <stddef.h> |
| 51 | #include <stdlib.h> |
| 52 | #include <string.h> |
| 53 | |
| 54 | #include <fcntl.h> |
| 55 | #include <sys/time.h> |
| 56 | #include <stdint.h> |
| 57 | #include <unistd.h> |
| 58 | |
| 59 | #include <sys/stat.h> |
| 60 | |
| 61 | #if _LIBC |
| 62 | # define struct_stat64 struct stat64 |
| 63 | #else |
| 64 | # define struct_stat64 struct stat |
| 65 | # define __try_tempname try_tempname |
| 66 | # define __gen_tempname gen_tempname |
| 67 | # define __getpid getpid |
| 68 | # define __gettimeofday gettimeofday |
| 69 | # define __mkdir mkdir |
| 70 | # define __open open |
| 71 | # define __lxstat64(version, file, buf) lstat (file, buf) |
| 72 | #endif |
| 73 | |
| 74 | #ifdef _LIBC |
| 75 | # include <hp-timing.h> |
| 76 | # if HP_TIMING_AVAIL |
| 77 | # define RANDOM_BITS(Var) \ |
| 78 | if (__builtin_expect (value == UINT64_C (0), 0)) \ |
| 79 | { \ |
| 80 | /* If this is the first time this function is used initialize \ |
| 81 | the variable we accumulate the value in to some somewhat \ |
| 82 | random value. If we'd not do this programs at startup time \ |
| 83 | might have a reduced set of possible names, at least on slow \ |
| 84 | machines. */ \ |
| 85 | struct timeval tv; \ |
| 86 | __gettimeofday (&tv, NULL); \ |
| 87 | value = ((uint64_t) tv.tv_usec << 16) ^ tv.tv_sec; \ |
| 88 | } \ |
| 89 | HP_TIMING_NOW (Var) |
| 90 | # endif |
| 91 | #endif |
| 92 | |
| 93 | /* Use the widest available unsigned type if uint64_t is not |
| 94 | available. The algorithm below extracts a number less than 62**6 |
| 95 | (approximately 2**35.725) from uint64_t, so ancient hosts where |
| 96 | uintmax_t is only 32 bits lose about 3.725 bits of randomness, |
| 97 | which is better than not having mkstemp at all. */ |
| 98 | #if !defined UINT64_MAX && !defined uint64_t |
| 99 | # define uint64_t uintmax_t |
| 100 | #endif |
| 101 | |
| 102 | #if _LIBC |
| 103 | /* Return nonzero if DIR is an existent directory. */ |
| 104 | static int |
| 105 | direxists (const char *dir) |
| 106 | { |
| 107 | struct_stat64 buf; |
| 108 | return __xstat64 (_STAT_VER, dir, &buf) == 0 && S_ISDIR (buf.st_mode); |
| 109 | } |
| 110 | |
| 111 | /* Path search algorithm, for tmpnam, tmpfile, etc. If DIR is |
| 112 | non-null and exists, uses it; otherwise uses the first of $TMPDIR, |
| 113 | P_tmpdir, /tmp that exists. Copies into TMPL a template suitable |
| 114 | for use with mk[s]temp. Will fail (-1) if DIR is non-null and |
| 115 | doesn't exist, none of the searched dirs exists, or there's not |
| 116 | enough space in TMPL. */ |
| 117 | int |
| 118 | __path_search (char *tmpl, size_t tmpl_len, const char *dir, const char *pfx, |
| 119 | int try_tmpdir) |
| 120 | { |
| 121 | const char *d; |
| 122 | size_t dlen, plen; |
| 123 | |
| 124 | if (!pfx || !pfx[0]) |
| 125 | { |
| 126 | pfx = "file"; |
| 127 | plen = 4; |
| 128 | } |
| 129 | else |
| 130 | { |
| 131 | plen = strlen (pfx); |
| 132 | if (plen > 5) |
| 133 | plen = 5; |
| 134 | } |
| 135 | |
| 136 | if (try_tmpdir) |
| 137 | { |
| 138 | d = __secure_getenv ("TMPDIR"); |
| 139 | if (d != NULL && direxists (d)) |
| 140 | dir = d; |
| 141 | else if (dir != NULL && direxists (dir)) |
| 142 | /* nothing */ ; |
| 143 | else |
| 144 | dir = NULL; |
| 145 | } |
| 146 | if (dir == NULL) |
| 147 | { |
| 148 | if (direxists (P_tmpdir)) |
| 149 | dir = P_tmpdir; |
| 150 | else if (strcmp (P_tmpdir, "/tmp") != 0 && direxists ("/tmp")) |
| 151 | dir = "/tmp"; |
| 152 | else |
| 153 | { |
| 154 | __set_errno (ENOENT); |
| 155 | return -1; |
| 156 | } |
| 157 | } |
| 158 | |
| 159 | dlen = strlen (dir); |
| 160 | while (dlen > 1 && dir[dlen - 1] == '/') |
| 161 | dlen--; /* remove trailing slashes */ |
| 162 | |
| 163 | /* check we have room for "${dir}/${pfx}XXXXXX\0" */ |
| 164 | if (tmpl_len < dlen + 1 + plen + 6 + 1) |
| 165 | { |
| 166 | __set_errno (EINVAL); |
| 167 | return -1; |
| 168 | } |
| 169 | |
| 170 | sprintf (tmpl, "%.*s/%.*sXXXXXX", (int) dlen, dir, (int) plen, pfx); |
| 171 | return 0; |
| 172 | } |
| 173 | #endif /* _LIBC */ |
| 174 | |
| 175 | /* These are the characters used in temporary file names. */ |
| 176 | static const char letters[] = |
| 177 | "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; |
| 178 | |
| 179 | int |
| 180 | __try_tempname (char *tmpl, int suffixlen, void *args, |
| 181 | int (*tryfunc) (char *, void *)) |
| 182 | { |
| 183 | int len; |
| 184 | char *XXXXXX; |
| 185 | static uint64_t value; |
| 186 | uint64_t random_time_bits; |
| 187 | unsigned int count; |
| 188 | int fd = -1; |
| 189 | int save_errno = errno; |
| 190 | |
| 191 | /* A lower bound on the number of temporary files to attempt to |
| 192 | generate. The maximum total number of temporary file names that |
| 193 | can exist for a given template is 62**6. It should never be |
| 194 | necessary to try all of these combinations. Instead if a reasonable |
| 195 | number of names is tried (we define reasonable as 62**3) fail to |
| 196 | give the system administrator the chance to remove the problems. */ |
| 197 | #define ATTEMPTS_MIN (62 * 62 * 62) |
| 198 | |
| 199 | /* The number of times to attempt to generate a temporary file. To |
| 200 | conform to POSIX, this must be no smaller than TMP_MAX. */ |
| 201 | #if ATTEMPTS_MIN < TMP_MAX |
| 202 | unsigned int attempts = TMP_MAX; |
| 203 | #else |
| 204 | unsigned int attempts = ATTEMPTS_MIN; |
| 205 | #endif |
| 206 | |
| 207 | len = strlen (tmpl); |
| 208 | if (len < 6 + suffixlen || memcmp (&tmpl[len - 6 - suffixlen], "XXXXXX", 6)) |
| 209 | { |
| 210 | __set_errno (EINVAL); |
| 211 | return -1; |
| 212 | } |
| 213 | |
| 214 | /* This is where the Xs start. */ |
| 215 | XXXXXX = &tmpl[len - 6 - suffixlen]; |
| 216 | |
| 217 | /* Get some more or less random data. */ |
| 218 | #ifdef RANDOM_BITS |
| 219 | RANDOM_BITS (random_time_bits); |
| 220 | #else |
| 221 | { |
| 222 | struct timeval tv; |
| 223 | __gettimeofday (&tv, NULL); |
| 224 | random_time_bits = ((uint64_t) tv.tv_usec << 16) ^ tv.tv_sec; |
| 225 | } |
| 226 | #endif |
| 227 | value += random_time_bits ^ __getpid (); |
| 228 | |
| 229 | for (count = 0; count < attempts; value += 7777, ++count) |
| 230 | { |
| 231 | uint64_t v = value; |
| 232 | |
| 233 | /* Fill in the random bits. */ |
| 234 | XXXXXX[0] = letters[v % 62]; |
| 235 | v /= 62; |
| 236 | XXXXXX[1] = letters[v % 62]; |
| 237 | v /= 62; |
| 238 | XXXXXX[2] = letters[v % 62]; |
| 239 | v /= 62; |
| 240 | XXXXXX[3] = letters[v % 62]; |
| 241 | v /= 62; |
| 242 | XXXXXX[4] = letters[v % 62]; |
| 243 | v /= 62; |
| 244 | XXXXXX[5] = letters[v % 62]; |
| 245 | |
| 246 | fd = tryfunc (tmpl, args); |
| 247 | if (fd >= 0) |
| 248 | { |
| 249 | __set_errno (save_errno); |
| 250 | return fd; |
| 251 | } |
| 252 | else if (errno != EEXIST) |
| 253 | return -1; |
| 254 | } |
| 255 | |
| 256 | /* We got out of the loop because we ran out of combinations to try. */ |
| 257 | __set_errno (EEXIST); |
| 258 | return -1; |
| 259 | } |
| 260 | |
| 261 | static int |
| 262 | try_file (char *tmpl, void *flags) |
| 263 | { |
| 264 | int *openflags = flags; |
| 265 | return __open (tmpl, |
| 266 | (*openflags & ~O_ACCMODE) |
| 267 | | O_RDWR | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR); |
| 268 | } |
| 269 | |
| 270 | static int |
| 271 | try_dir (char *tmpl, void *flags _GL_UNUSED) |
| 272 | { |
| 273 | return __mkdir (tmpl, S_IRUSR | S_IWUSR | S_IXUSR); |
| 274 | } |
| 275 | |
| 276 | static int |
| 277 | try_nocreate (char *tmpl, void *flags _GL_UNUSED) |
| 278 | { |
| 279 | struct_stat64 st; |
| 280 | |
| 281 | if (__lxstat64 (_STAT_VER, tmpl, &st) == 0 || errno == EOVERFLOW) |
| 282 | __set_errno (EEXIST); |
| 283 | return errno == ENOENT ? 0 : -1; |
| 284 | } |
| 285 | |
| 286 | /* Generate a temporary file name based on TMPL. TMPL must match the |
| 287 | rules for mk[s]temp (i.e. end in "XXXXXX", possibly with a suffix). |
| 288 | The name constructed does not exist at the time of the call to |
| 289 | __gen_tempname. TMPL is overwritten with the result. |
| 290 | |
| 291 | KIND may be one of: |
| 292 | __GT_NOCREATE: simply verify that the name does not exist |
| 293 | at the time of the call. |
| 294 | __GT_FILE: create the file using open(O_CREAT|O_EXCL) |
| 295 | and return a read-write fd. The file is mode 0600. |
| 296 | __GT_DIR: create a directory, which will be mode 0700. |
| 297 | |
| 298 | We use a clever algorithm to get hard-to-predict names. */ |
| 299 | int |
| 300 | __gen_tempname (char *tmpl, int suffixlen, int flags, int kind) |
| 301 | { |
| 302 | int (*tryfunc) (char *, void *); |
| 303 | |
| 304 | switch (kind) |
| 305 | { |
| 306 | case __GT_FILE: |
| 307 | tryfunc = try_file; |
| 308 | break; |
| 309 | |
| 310 | case __GT_DIR: |
| 311 | tryfunc = try_dir; |
| 312 | break; |
| 313 | |
| 314 | case __GT_NOCREATE: |
| 315 | tryfunc = try_nocreate; |
| 316 | break; |
| 317 | |
| 318 | default: |
| 319 | assert (! "invalid KIND in __gen_tempname"); |
| 320 | abort (); |
| 321 | } |
| 322 | return __try_tempname (tmpl, suffixlen, &flags, tryfunc); |
| 323 | } |