Skip to content

Latest commit

 

History

History
151 lines (113 loc) · 5.09 KB

nng_ipc.7.adoc

File metadata and controls

151 lines (113 loc) · 5.09 KB
Raw

nng_ipc(7)

NAME

nng_ipc - IPC transport

SYNOPSIS

#include <nng/transport/ipc/ipc.h>

int nng_ipc_register(void);

DESCRIPTION

The ipc transport provides communication support between nng sockets within different processes on the same host. For POSIX platforms, this is implemented using UNIX domain sockets. For Windows, this is implemented using Windows Named Pipes. Other platforms may have different implementation strategies.

Registration

The ipc transport is generally built-in to the nng core, so no extra steps to use it should be necessary.

URI Format

This transport uses URIs using the scheme ipc://, followed by an absolute path name in the file system where the socket or named pipe should be created.

Tip
 On Windows, all names are prefixed by \\.\pipe\ and do not occupy the normal file system. On POSIX platforms, the path is taken literally, and is relative to the root directory.
Note
 If compatibility with legacy nanomsg applications is required, then pathnames must not be longer than 122 bytes, including the final NUL byte. This is because legacy versions of nanomsg cannot express URLs longer than 128 bytes, including the ipc:// prefix.
Note
 Legacy nanomsg supported relative IPC path names; modern nng does not. Therefore, always use an absolute path name if interoperability is required.

Socket Address

When using an nng_sockaddr structure, the actual structure is of type nng_sockaddr_ipc.

Transport Options

NNG_OPT_IPC_PERMISSIONS

(int) This write-only option may be applied to a listener to configure the permissions that are used on the UNIX domain socket created by that listener. This property is only supported on POSIX systems. The value is of type int, representing the normal permission bits on a file, such as 0600 (typically meaning read-write to the owner, and no permissions for anyone else.) The default is system-specific, most often 0644.

Important
 Not all systems validate these permissions. In particular, illumos and Solaris are known to ignore these permission settings when connecting.
Note
 Normally both read and write permission will be necessary for a peer dialer to connect. See your system documentation for UNIX domain sockets for more information.
Note
 The umask of the process is not applied to these bits.
Tip
 The best practice for limiting access is to place the socket in a directory writable only by the server, and only readable and searchable by clients. All mainstream POSIX systems will fail to permit a client to connect to a socket located in a diretor for which the client lacks search (execute) permission.
Tip
 Also consider using the NNG_OPT_IPC_PEER_UID property from within a a pipe notification callback (nng_pipe_notify()) to validate peer credentials.
NNG_OPT_IPC_SECURITY_DESCRIPTOR

(PSECURITY_DESCRIPTOR) This write-only option may be used on listeners on Windows platforms to configure the SECURITY_DESCRIPTOR that is used when creating the underlying named pipe. The value is a pointer, PSECURITY_DESCRIPTOR, and may only be applied to listeners that have not been started yet.

NNG_OPT_IPC_PEER_UID

(uint64_t) This read-only option may be read from a pipe to determine the peer user id. This is the effective user id of the peer when either the underlying listen() or connect() calls were made, and is not forgeable. This option is generally only available on POSIX systems.

NNG_OPT_IPC_PEER_GID

(uint64_t) This read-only option may be read from a pipe to determine the peer primary group id. This is the effective group id of the peer when either the underlying listen() or connect() calls were made, and is not forgeable. This option is generally only available on POSIX systems.

NNG_OPT_IPC_PEER_PID

(uint64_t) This read-only option may be read from a pipe to determine the process id of the peer. This option is only available on Windows, Linux, and certain other systems.

Note
 Applications should not assume that the process ID does not change, as it is possible (although unsupported!) for a nefarious process to pass a file descriptor between processes. However, it is not possible for a nefarious application to forge the identity of a well-behaved one using this method.
NNG_OPT_IPC_PEER_ZONEID

(uint64_t) This read-only option may be read from a pipe to determine the zone id of the peer. Zones (and this option) are only supported on Solaris and illumos systems.