dissect-image,execute: switch root hash/root hash sig storage to struct iovec

let's go one step further on our iovec'ification journey.

No change in behaviour, just rework to make struct iovec used
everywhere.

src/core/dbus-execute.c

@@ -772,7 +772,7 @@ static int property_get_root_hash(
         assert(property);
         assert(reply);
 
-        return sd_bus_message_append_array(reply, 'y', c->root_hash, c->root_hash_size);
+        return sd_bus_message_append_array(reply, 'y', c->root_hash.iov_base, c->root_hash.iov_len);
 }
 
 static int property_get_root_hash_sig(
@@ -790,7 +790,7 @@ static int property_get_root_hash_sig(
         assert(property);
         assert(reply);
 
-        return sd_bus_message_append_array(reply, 'y', c->root_hash_sig, c->root_hash_sig_size);
+        return sd_bus_message_append_array(reply, 'y', c->root_hash_sig.iov_base, c->root_hash_sig.iov_len);
 }
 
 static int property_get_root_image_options(
@@ -1915,35 +1915,30 @@ int bus_exec_context_set_transient_property(
         }
 
         if (streq(name, "RootHash")) {
-                const void *roothash_decoded;
-                size_t roothash_decoded_size;
+                struct iovec roothash_decoded;
 
-                r = sd_bus_message_read_array(message, 'y', &roothash_decoded, &roothash_decoded_size);
+                r = sd_bus_message_read_array(message, 'y', (const void**) &roothash_decoded.iov_base, &roothash_decoded.iov_len);
                 if (r < 0)
                         return r;
 
                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
-                        _cleanup_free_ char *encoded = NULL;
 
-                        if (roothash_decoded_size == 0) {
+                        if (!iovec_is_set(&roothash_decoded)) {
                                 c->root_hash_path = mfree(c->root_hash_path);
-                                c->root_hash = mfree(c->root_hash);
-                                c->root_hash_size = 0;
+                                iovec_done(&c->root_hash);
 
                                 unit_write_settingf(u, flags, name, "RootHash=");
                         } else {
-                                _cleanup_free_ void *p = NULL;
-
-                                encoded = hexmem(roothash_decoded, roothash_decoded_size);
+                                _cleanup_free_ char *encoded = hexmem(roothash_decoded.iov_base, roothash_decoded.iov_len);
                                 if (!encoded)
                                         return -ENOMEM;
 
-                                p = memdup(roothash_decoded, roothash_decoded_size);
-                                if (!p)
+                                _cleanup_(iovec_done) struct iovec p = {};
+                                if (!iovec_memdup(&roothash_decoded, &p))
                                         return -ENOMEM;
 
-                                free_and_replace(c->root_hash, p);
-                                c->root_hash_size = roothash_decoded_size;
+                                iovec_done(&c->root_hash);
+                                c->root_hash = TAKE_STRUCT(p);
                                 c->root_hash_path = mfree(c->root_hash_path);
 
                                 unit_write_settingf(u, flags, name, "RootHash=%s", encoded);
@@ -1954,43 +1949,35 @@ int bus_exec_context_set_transient_property(
         }
 
         if (streq(name, "RootHashPath")) {
-                c->root_hash_size = 0;
-                c->root_hash = mfree(c->root_hash);
-
+                iovec_done(&c->root_hash);
                 return bus_set_transient_path(u, "RootHash", &c->root_hash_path, message, flags, error);
         }
 
         if (streq(name, "RootHashSignature")) {
-                const void *roothash_sig_decoded;
-                size_t roothash_sig_decoded_size;
+                struct iovec roothash_sig_decoded;
 
-                r = sd_bus_message_read_array(message, 'y', &roothash_sig_decoded, &roothash_sig_decoded_size);
+                r = sd_bus_message_read_array(message, 'y', (const void**) &roothash_sig_decoded.iov_base, &roothash_sig_decoded.iov_len);
                 if (r < 0)
                         return r;
 
                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
-                        _cleanup_free_ char *encoded = NULL;
-
-                        if (roothash_sig_decoded_size == 0) {
+                        if (!iovec_is_set(&roothash_sig_decoded)) {
                                 c->root_hash_sig_path = mfree(c->root_hash_sig_path);
-                                c->root_hash_sig = mfree(c->root_hash_sig);
-                                c->root_hash_sig_size = 0;
+                                iovec_done(&c->root_hash_sig);
 
                                 unit_write_settingf(u, flags, name, "RootHashSignature=");
                         } else {
-                                _cleanup_free_ void *p = NULL;
-                                ssize_t len;
-
-                                len = base64mem(roothash_sig_decoded, roothash_sig_decoded_size, &encoded);
+                                _cleanup_free_ char *encoded = NULL;
+                                ssize_t len = base64mem(roothash_sig_decoded.iov_base, roothash_sig_decoded.iov_len, &encoded);
                                 if (len < 0)
                                         return -ENOMEM;
 
-                                p = memdup(roothash_sig_decoded, roothash_sig_decoded_size);
-                                if (!p)
+                                _cleanup_(iovec_done) struct iovec p = {};
+                                if (!iovec_memdup(&roothash_sig_decoded, &p))
                                         return -ENOMEM;
 
-                                free_and_replace(c->root_hash_sig, p);
-                                c->root_hash_sig_size = roothash_sig_decoded_size;
+                                iovec_done(&c->root_hash_sig);
+                                c->root_hash_sig = TAKE_STRUCT(p);
                                 c->root_hash_sig_path = mfree(c->root_hash_sig_path);
 
                                 unit_write_settingf(u, flags, name, "RootHashSignature=base64:%s", encoded);
@@ -2001,9 +1988,7 @@ int bus_exec_context_set_transient_property(
         }
 
         if (streq(name, "RootHashSignaturePath")) {
-                c->root_hash_sig_size = 0;
-                c->root_hash_sig = mfree(c->root_hash_sig);
-
+                iovec_done(&c->root_hash_sig);
                 return bus_set_transient_path(u, "RootHashSignature", &c->root_hash_sig_path, message, flags, error);
         }
 

src/core/exec-invoke.c

@@ -3583,11 +3583,9 @@ static int setup_ephemeral(
 static int verity_settings_prepare(
                 VeritySettings *verity,
                 const char *root_image,
-                const void *root_hash,
-                size_t root_hash_size,
+                const struct iovec *root_hash,
                 const char *root_hash_path,
-                const void *root_hash_sig,
-                size_t root_hash_sig_size,
+                const struct iovec *root_hash_sig,
                 const char *root_hash_sig_path,
                 const char *verity_data_path) {
 
@@ -3596,26 +3594,20 @@ static int verity_settings_prepare(
         assert(verity);
 
         if (root_hash) {
-                void *d;
+                iovec_done(&verity->root_hash);
 
-                d = memdup(root_hash, root_hash_size);
-                if (!d)
+                if (!iovec_memdup(root_hash, &verity->root_hash))
                         return -ENOMEM;
 
-                free_and_replace(verity->root_hash, d);
-                verity->root_hash_size = root_hash_size;
                 verity->designator = PARTITION_ROOT;
         }
 
         if (root_hash_sig) {
-                void *d;
+                iovec_done(&verity->root_hash_sig);
 
-                d = memdup(root_hash_sig, root_hash_sig_size);
-                if (!d)
+                if (!iovec_memdup(root_hash_sig, &verity->root_hash_sig))
                         return -ENOMEM;
 
-                free_and_replace(verity->root_hash_sig, d);
-                verity->root_hash_sig_size = root_hash_sig_size;
                 verity->designator = PARTITION_ROOT;
         }
 
@@ -3845,8 +3837,8 @@ static int apply_mount_namespace(
                 r = verity_settings_prepare(
                         &verity,
                         root_image,
-                        context->root_hash, context->root_hash_size, context->root_hash_path,
-                        context->root_hash_sig, context->root_hash_sig_size, context->root_hash_sig_path,
+                        &context->root_hash, context->root_hash_path,
+                        &context->root_hash_sig, context->root_hash_sig_path,
                         context->root_verity);
                 if (r < 0)
                         return r;

src/core/execute-serialize.c

@@ -1662,11 +1662,11 @@ static int exec_context_serialize(const ExecContext *c, FILE *f) {
         if (r < 0)
                 return r;
 
-        r = serialize_item_hexmem(f, "exec-context-root-hash", c->root_hash, c->root_hash_size);
+        r = serialize_item_hexmem(f, "exec-context-root-hash", c->root_hash.iov_base, c->root_hash.iov_len);
         if (r < 0)
                 return r;
 
-        r = serialize_item_base64mem(f, "exec-context-root-hash-sig", c->root_hash_sig, c->root_hash_sig_size);
+        r = serialize_item_base64mem(f, "exec-context-root-hash-sig", c->root_hash_sig.iov_base, c->root_hash_sig.iov_len);
         if (r < 0)
                 return r;
 
@@ -2616,13 +2616,13 @@ static int exec_context_deserialize(ExecContext *c, FILE *f) {
                         if (r < 0)
                                 return r;
                 } else if ((val = startswith(l, "exec-context-root-hash="))) {
-                        c->root_hash = mfree(c->root_hash);
-                        r = unhexmem(val, &c->root_hash, &c->root_hash_size);
+                        iovec_done(&c->root_hash);
+                        r = unhexmem(val, &c->root_hash.iov_base, &c->root_hash.iov_len);
                         if (r < 0)
                                 return r;
                 } else if ((val = startswith(l, "exec-context-root-hash-sig="))) {
-                        c->root_hash_sig = mfree(c->root_hash_sig);
-                        r= unbase64mem(val, &c->root_hash_sig, &c->root_hash_sig_size);
+                        iovec_done(&c->root_hash_sig);
+                        r= unbase64mem(val, &c->root_hash_sig.iov_base, &c->root_hash_sig.iov_len);
                         if (r < 0)
                                 return r;
                 } else if ((val = startswith(l, "exec-context-root-ephemeral="))) {

src/core/execute.c

@@ -679,11 +679,9 @@ void exec_context_done(ExecContext *c) {
         c->root_directory = mfree(c->root_directory);
         c->root_image = mfree(c->root_image);
         c->root_image_options = mount_options_free_all(c->root_image_options);
-        c->root_hash = mfree(c->root_hash);
-        c->root_hash_size = 0;
+        iovec_done(&c->root_hash);
         c->root_hash_path = mfree(c->root_hash_path);
-        c->root_hash_sig = mfree(c->root_hash_sig);
-        c->root_hash_sig_size = 0;
+        iovec_done(&c->root_hash_sig);
         c->root_hash_sig_path = mfree(c->root_hash_sig_path);
         c->root_verity = mfree(c->root_verity);
         c->extension_images = mount_image_free_many(c->extension_images, &c->n_extension_images);
@@ -1178,9 +1176,9 @@ void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
                 fprintf(f, "\n");
         }
 
-        if (c->root_hash) {
+        if (iovec_is_set(&c->root_hash)) {
                 _cleanup_free_ char *encoded = NULL;
-                encoded = hexmem(c->root_hash, c->root_hash_size);
+                encoded = hexmem(c->root_hash.iov_base, c->root_hash.iov_len);
                 if (encoded)
                         fprintf(f, "%sRootHash: %s\n", prefix, encoded);
         }
@@ -1188,10 +1186,10 @@ void exec_context_dump(const ExecContext *c, FILE* f, const char *prefix) {
         if (c->root_hash_path)
                 fprintf(f, "%sRootHash: %s\n", prefix, c->root_hash_path);
 
-        if (c->root_hash_sig) {
+        if (iovec_is_set(&c->root_hash_sig)) {
                 _cleanup_free_ char *encoded = NULL;
                 ssize_t len;
-                len = base64mem(c->root_hash_sig, c->root_hash_sig_size, &encoded);
+                len = base64mem(c->root_hash_sig.iov_base, c->root_hash_sig.iov_len, &encoded);
                 if (len)
                         fprintf(f, "%sRootHashSignature: base64:%s\n", prefix, encoded);
         }

src/core/execute.h

@@ -1,6 +1,8 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 #pragma once
 
+#include <sys/uio.h>
+
 #include "sd-id128.h"
 
 #include "bus-unit-util.h"
@@ -181,8 +183,7 @@ typedef struct ExecContext {
 
         struct rlimit *rlimit[_RLIMIT_MAX];
         char *working_directory, *root_directory, *root_image, *root_verity, *root_hash_path, *root_hash_sig_path;
-        void *root_hash, *root_hash_sig;
-        size_t root_hash_size, root_hash_sig_size;
+        struct iovec root_hash, root_hash_sig;
         LIST_HEAD(MountOptions, root_image_options);
         bool root_ephemeral;
         bool working_directory_missing_ok:1;

src/core/load-fragment.c

@@ -1714,9 +1714,7 @@ int config_parse_exec_root_hash(
                 void *data,
                 void *userdata) {
 
-        _cleanup_free_ void *roothash_decoded = NULL;
         ExecContext *c = ASSERT_PTR(data);
-        size_t roothash_decoded_size = 0;
         int r;
 
         assert(filename);
@@ -1726,8 +1724,7 @@ int config_parse_exec_root_hash(
         if (isempty(rvalue)) {
                 /* Reset if the empty string is assigned */
                 c->root_hash_path = mfree(c->root_hash_path);
-                c->root_hash = mfree(c->root_hash);
-                c->root_hash_size = 0;
+                iovec_done(&c->root_hash);
                 return 0;
         }
 
@@ -1740,24 +1737,24 @@ int config_parse_exec_root_hash(
                         return -ENOMEM;
 
                 free_and_replace(c->root_hash_path, p);
-                c->root_hash = mfree(c->root_hash);
-                c->root_hash_size = 0;
+                iovec_done(&c->root_hash);
                 return 0;
         }
 
         /* We have a roothash to decode, eg: RootHash=012345789abcdef */
-        r = unhexmem(rvalue, &roothash_decoded, &roothash_decoded_size);
+        _cleanup_(iovec_done) struct iovec roothash_decoded = {};
+        r = unhexmem(rvalue, &roothash_decoded.iov_base, &roothash_decoded.iov_len);
         if (r < 0) {
                 log_syntax(unit, LOG_WARNING, filename, line, r, "Failed to decode RootHash=, ignoring: %s", rvalue);
                 return 0;
         }
-        if (roothash_decoded_size < sizeof(sd_id128_t)) {
+        if (roothash_decoded.iov_len < sizeof(sd_id128_t)) {
                 log_syntax(unit, LOG_WARNING, filename, line, 0, "RootHash= is too short, ignoring: %s", rvalue);
                 return 0;
         }
 
-        free_and_replace(c->root_hash, roothash_decoded);
-        c->root_hash_size = roothash_decoded_size;
+        iovec_done(&c->root_hash);
+        c->root_hash = TAKE_STRUCT(roothash_decoded);
         c->root_hash_path = mfree(c->root_hash_path);
 
         return 0;
@@ -1775,10 +1772,7 @@ int config_parse_exec_root_hash_sig(
                 void *data,
                 void *userdata) {
 
-        _cleanup_free_ void *roothash_sig_decoded = NULL;
-        char *value;
         ExecContext *c = ASSERT_PTR(data);
-        size_t roothash_sig_decoded_size = 0;
         int r;
 
         assert(filename);
@@ -1788,8 +1782,7 @@ int config_parse_exec_root_hash_sig(
         if (isempty(rvalue)) {
                 /* Reset if the empty string is assigned */
                 c->root_hash_sig_path = mfree(c->root_hash_sig_path);
-                c->root_hash_sig = mfree(c->root_hash_sig);
-                c->root_hash_sig_size = 0;
+                iovec_done(&c->root_hash_sig);
                 return 0;
         }
 
@@ -1802,26 +1795,27 @@ int config_parse_exec_root_hash_sig(
                         return log_oom();
 
                 free_and_replace(c->root_hash_sig_path, p);
-                c->root_hash_sig = mfree(c->root_hash_sig);
-                c->root_hash_sig_size = 0;
+                iovec_done(&c->root_hash_sig);
                 return 0;
         }
 
-        if (!(value = startswith(rvalue, "base64:"))) {
+        const char *value = startswith(rvalue, "base64:");
+        if (!value) {
                 log_syntax(unit, LOG_WARNING, filename, line, 0,
                            "Failed to decode RootHashSignature=, not a path but doesn't start with 'base64:', ignoring: %s", rvalue);
                 return 0;
         }
 
         /* We have a roothash signature to decode, eg: RootHashSignature=base64:012345789abcdef */
-        r = unbase64mem(value, &roothash_sig_decoded, &roothash_sig_decoded_size);
+        _cleanup_(iovec_done) struct iovec roothash_sig_decoded = {};
+        r = unbase64mem(value, &roothash_sig_decoded.iov_base, &roothash_sig_decoded.iov_len);
         if (r < 0) {
                 log_syntax(unit, LOG_WARNING, filename, line, r, "Failed to decode RootHashSignature=, ignoring: %s", rvalue);
                 return 0;
         }
 
-        free_and_replace(c->root_hash_sig, roothash_sig_decoded);
-        c->root_hash_sig_size = roothash_sig_decoded_size;
+        iovec_done(&c->root_hash_sig);
+        c->root_hash_sig = TAKE_STRUCT(roothash_sig_decoded);
         c->root_hash_sig_path = mfree(c->root_hash_sig_path);
 
         return 0;

src/core/namespace.c

@@ -24,6 +24,7 @@
 #include "format-util.h"
 #include "fs-util.h"
 #include "glyph-util.h"
+#include "iovec-util.h"
 #include "label-util.h"
 #include "list.h"
 #include "lock-util.h"
@@ -1019,7 +1020,7 @@ static bool verity_has_later_duplicates(MountList *ml, const MountEntry *needle)
         assert(needle >= ml->mounts && needle < ml->mounts + ml->n_mounts);
         assert(needle->mode == MOUNT_EXTENSION_IMAGE);
 
-        if (needle->verity.root_hash_size == 0)
+        if (!iovec_is_set(&needle->verity.root_hash))
                 return false;
 
         /* Overlayfs rejects supplying the same directory inode twice as determined by filesystem UUID and
@@ -1032,10 +1033,7 @@ static bool verity_has_later_duplicates(MountList *ml, const MountEntry *needle)
         for (const MountEntry *m = needle + 1; m < ml->mounts + ml->n_mounts; m++) {
                 if (m->mode != MOUNT_EXTENSION_IMAGE)
                         continue;
-                if (memcmp_nn(m->verity.root_hash,
-                              m->verity.root_hash_size,
-                              needle->verity.root_hash,
-                              needle->verity.root_hash_size) == 0)
+                if (iovec_memcmp(&m->verity.root_hash, &needle->verity.root_hash) == 0)
                         return true;
         }
 

src/core/varlink-execute.c

@@ -790,9 +790,9 @@ int unit_exec_context_build_json(sd_json_variant **ret, const char *name, void *
                         JSON_BUILD_PAIR_STRING_NON_EMPTY("RootImage", c->root_image),
                         JSON_BUILD_PAIR_CALLBACK_NON_NULL("RootImageOptions", root_image_options_build_json, c->root_image_options),
                         SD_JSON_BUILD_PAIR_BOOLEAN("RootEphemeral", c->root_ephemeral),
-                        JSON_BUILD_PAIR_BASE64_NON_EMPTY("RootHash", c->root_hash, c->root_hash_size),
+                        JSON_BUILD_PAIR_BASE64_NON_EMPTY("RootHash", c->root_hash.iov_base, c->root_hash.iov_len),
                         JSON_BUILD_PAIR_STRING_NON_EMPTY("RootHashPath", c->root_hash_path),
-                        JSON_BUILD_PAIR_BASE64_NON_EMPTY("RootHashSignature", c->root_hash_sig, c->root_hash_sig_size),
+                        JSON_BUILD_PAIR_BASE64_NON_EMPTY("RootHashSignature", c->root_hash_sig.iov_base, c->root_hash_sig.iov_len),
                         JSON_BUILD_PAIR_STRING_NON_EMPTY("RootHashSignaturePath", c->root_hash_sig_path),
                         JSON_BUILD_PAIR_STRING_NON_EMPTY("RootVerity", c->root_verity),
                         SD_JSON_BUILD_PAIR_CALLBACK("RootImagePolicy", image_policy_build_json, c->root_image_policy),