libink/dbus: identify the caller behind a broker

On the local bus SO_PEERCRED says who is calling and the kernel is the
one saying it.  Behind a broker one connection carries every caller,
so that credential describes dbus-daemon and nothing else, and every
privileged method was refused there, root included.

Ask the bus driver instead.  libink parks the call and hands us the
sender; we ask GetConnectionUnixUser and answer when the reply lands,
through the same event loop as everything else.  Nothing blocks:
blocking in PID 1 is why libuEv exists.  That needs calls libink can
make on a connection it already has, so it gained those too.

Answers are cached, since a bus never reuses a unique name while it
runs.  Not across a restart though: a new dbus-daemon numbers from
scratch and :1.7 becomes somebody else, so the cache goes when the
broker does.  A sender name too long to key on is refused rather than
truncated, two callers sharing a truncated key would share an
identity.

Privilege is no longer uid 0 alone.  The socket is already owned by
the --with-group group, so refusing its members every method that
changes anything left a wheel user able to open the bus and unable to
reboot.  Both gates now say the same thing.

Group membership needs NSS, which the C library loads with dlopen(),
so the lookup is compiled out where Finit is built to link statically.
That leaves such a build root-only, which is worth saying out loud
rather than leaving to be discovered.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

libink/client.c

@@ -171,15 +171,8 @@ static int read_one(link_client_t *c, struct link_msg *msg)
 
 static void publish_reply(link_client_t *c, const struct link_msg *m)
 {
-	c->reply.type       = m->type;
-	c->reply.signature  = m->signature;
-	c->reply.error_name = m->error_name;
-	c->reply.path       = m->path;
-	c->reply.interface  = m->interface;
-	c->reply.member     = m->member;
-	c->reply.body       = m->body_avail ? m->body : NULL;
-	c->reply.body_len   = m->body_avail;
-	c->have_reply       = 1;
+	__msg_to_reply(&c->reply, m);
+	c->have_reply = 1;
 }
 
 /* The reply view in c->reply points into c->rxbuf and is invalidated
@@ -261,12 +254,7 @@ int link_client_call(link_client_t *c,
 		     const char *signature,
 		     const uint8_t *body, size_t body_len)
 {
-	/* Generous: Manager1 headers fit in ~150 B, but the buffer is
-	 * shared with whatever future callers throw at us, and an
-	 * overflow only manifests as a silent LINK_CALL_FAIL via
-	 * __msg_build_method_call returning -1.  1 KiB on stack
-	 * is cheap insurance. */
-	uint8_t  hdr[1024];
+	uint8_t  hdr[LINK_CALL_HDR_MAX];
 	ssize_t  hlen;
 	uint32_t serial;
 
@@ -328,54 +316,20 @@ int link_reply_get_u32(const link_reply_t *r, uint32_t *out)
 	return link_r_u32(&reader, out);
 }
 
-/* Marshal varargs into `body` (capacity `cap`) according to `sig`.
- * Returns the marshalled length on success, -1 on overflow or
- * unsupported type code. */
-static ssize_t marshal_va(uint8_t *body, size_t cap,
-			  const char *sig, va_list ap)
-{
-	link_writer_t w;
-	const char   *s;
-
-	link_writer_init(&w, body, cap);
-	for (s = sig; *s; s++) {
-		switch (*s) {
-		case 'y':
-			link_w_byte(&w, (uint8_t)va_arg(ap, int));
-			break;
-		case 'b':
-			link_w_bool(&w, va_arg(ap, int));
-			break;
-		case 'u':
-			link_w_u32(&w, va_arg(ap, uint32_t));
-			break;
-		case 's':
-			link_w_string(&w, va_arg(ap, const char *));
-			break;
-		case 'o':
-			link_w_path(&w, va_arg(ap, const char *));
-			break;
-		default:
-			return -1;
-		}
-	}
-	return link_writer_finish(&w);
-}
-
 int link_client_call_v(link_client_t *c,
 		       const char *obj_path,
 		       const char *interface,
 		       const char *member,
 		       const char *signature, ...)
 {
-	uint8_t body[1024];
+	uint8_t body[LINK_CALL_BODY_MAX];
 	ssize_t body_len = 0;
 
 	if (signature && *signature) {
 		va_list ap;
 
 		va_start(ap, signature);
-		body_len = marshal_va(body, sizeof(body), signature, ap);
+		body_len = __marshal_va(body, sizeof(body), signature, ap);
 		va_end(ap);
 		if (body_len < 0)
 			return LINK_CALL_FAIL;

libink/connection.c

@@ -5,6 +5,7 @@
  */
 
 #include <errno.h>
+#include <stdarg.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
@@ -21,6 +22,70 @@ uid_t link_connection_get_uid(const link_connection_t *conn)
 	return conn ? conn->peer_uid : (uid_t)-1;
 }
 
+/* Issue a method call and remember the serial so the reply can be
+ * handed back to `cb` when the read loop picks it up.  Nothing here
+ * waits: this is the counterpart of link_client_call() for a
+ * connection already owned by the event loop. */
+int link_connection_call(link_connection_t *conn, const char *destination,
+			 const char *path, const char *interface, const char *member,
+			 link_reply_cb_t cb, void *userdata,
+			 const char *signature, ...)
+{
+	uint8_t  body[LINK_CALL_BODY_MAX];
+	uint8_t  hdr[LINK_CALL_HDR_MAX];
+	ssize_t  blen = 0;
+	ssize_t  hlen;
+	uint32_t serial;
+	int      i;
+
+	if (!conn || conn->fd < 0 || !path || !member) {
+		errno = EINVAL;
+		return -1;
+	}
+
+	for (i = 0; i < LINK_PENDING_CAP; i++) {
+		if (!conn->pending[i].used)
+			break;
+	}
+	if (i == LINK_PENDING_CAP) {
+		errno = EBUSY;
+		return -1;
+	}
+
+	if (signature && *signature) {
+		va_list ap;
+
+		va_start(ap, signature);
+		blen = __marshal_va(body, sizeof(body), signature, ap);
+		va_end(ap);
+		if (blen < 0) {
+			errno = EMSGSIZE;
+			return -1;
+		}
+	}
+
+	serial = ++conn->next_serial;
+	hlen = __msg_build_method_call(hdr, sizeof(hdr), serial, path, interface,
+				       member, destination, signature, (uint32_t)blen);
+	if (hlen < 0) {
+		errno = EMSGSIZE;
+		return -1;
+	}
+
+	if (__io_write_all(conn->fd, hdr, (size_t)hlen) < 0)
+		return -1;
+	if (blen > 0 && __io_write_all(conn->fd, body, (size_t)blen) < 0)
+		return -1;
+
+
+	conn->pending[i].used     = 1;
+	conn->pending[i].serial   = serial;
+	conn->pending[i].cb       = cb;
+	conn->pending[i].userdata = userdata;
+
+	return 0;
+}
+
 void link_connection_close(link_connection_t *conn)
 {
 	size_t i;
@@ -28,6 +93,11 @@ void link_connection_close(link_connection_t *conn)
 	if (!conn)
 		return;
 
+
+	/* Anything waiting on this connection has to be told, or a parked
+	 * call sits forever and its caller never hears back. */
+	__dispatch_forget_conn(conn);
+
 	for (i = 0; i < conn->matches_count; i++)
 		__match_free(conn->matches[i]);
 
@@ -52,7 +122,7 @@ static int process_binary(link_connection_t *conn)
 		if (consumed < 0)
 			return -1;
 
-		if (__dispatch_message(conn, &msg) < 0)
+		if (__dispatch_message(conn, &msg, (size_t)consumed) < 0)
 			return -1;
 
 		memmove(conn->rxbuf, conn->rxbuf + consumed,

libink/dispatch.c

@@ -260,7 +260,7 @@ int __send_error(link_connection_t *conn, const struct link_msg *req,
 const char *link_call_path     (const link_call_t *c) { return c ? c->incoming.path      : NULL; }
 const char *link_call_interface(const link_call_t *c) { return c ? c->incoming.interface : NULL; }
 const char *link_call_member   (const link_call_t *c) { return c ? c->incoming.member    : NULL; }
-uid_t       link_call_uid      (const link_call_t *c) { return c ? c->conn->peer_uid     : (uid_t)-1; }
+uid_t       link_call_uid      (const link_call_t *c) { return c ? c->uid               : LINK_UID_UNKNOWN; }
 
 link_writer_t *link_call_reply(link_call_t *call)
 {
@@ -324,20 +324,213 @@ size_t link_r_pos (const link_reader_t *r)            { return r->off;
 
 /* ----------  dispatch entry point  ---------- */
 
-int __dispatch_message(link_connection_t *conn, const struct link_msg *m)
+/* ----------  replies to our own outbound calls  ---------- */
+
+/* Hand a reply to whoever issued the matching link_connection_call().
+ * Unmatched replies are dropped: a broker is free to send us things we
+ * never asked for, and that is not a reason to drop the connection. */
+static void deliver_reply(link_connection_t *conn, const struct link_msg *m)
+{
+	link_reply_cb_t  cb;
+	link_reply_t     r;
+	void            *userdata;
+	int              i;
+
+	for (i = 0; i < LINK_PENDING_CAP; i++) {
+		if (conn->pending[i].used && conn->pending[i].serial == m->reply_serial)
+			break;
+	}
+	if (i == LINK_PENDING_CAP) {
+		return;
+	}
+
+	cb       = conn->pending[i].cb;
+	userdata = conn->pending[i].userdata;
+	conn->pending[i].used = 0;
+
+	if (!cb)
+		return;
+
+	__msg_to_reply(&r, m);
+	cb(conn, &r, userdata);
+}
+
+/* ----------  calls parked while their caller is identified  ---------- */
+
+/* Every park gets a token that is never issued twice, so a resolver
+ * answering late, twice, or after its connection went away resumes
+ * nothing rather than whatever call has since taken the slot. */
+static struct link_parked *park(link_connection_t *conn, const uint8_t *frame,
+				size_t len, link_authz_t *tok)
+{
+	link_server_t *srv = conn->server;
+	int i;
+
+	if (!frame || !len || len > LINK_PARKED_MSG_MAX)
+		return NULL;
+
+	for (i = 0; i < LINK_PARKED_CAP; i++) {
+		if (!srv->parked[i].tok)
+			break;
+	}
+	if (i == LINK_PARKED_CAP)
+		return NULL;
+
+	srv->parked[i].tok  = ++srv->next_tok;
+	srv->parked[i].conn = conn;
+	srv->parked[i].len  = len;
+	memcpy(srv->parked[i].buf, frame, len);
+	*tok = srv->parked[i].tok;
+
+	return &srv->parked[i];
+}
+
+static void unpark(struct link_parked *p)
+{
+	p->tok  = 0;
+	p->conn = NULL;
+}
+
+void __dispatch_forget_conn(link_connection_t *conn)
+{
+	link_server_t *srv = conn->server;
+	int i;
+
+	/* Drop parked calls first.  A pending callback below may try to
+	 * resolve one, and resuming a dispatch on a connection that is
+	 * being torn down is no use to anyone; an invalidated slot makes
+	 * that resolve a no-op instead. */
+	if (srv) {
+		for (i = 0; i < LINK_PARKED_CAP; i++) {
+			if (srv->parked[i].conn == conn)
+				unpark(&srv->parked[i]);
+		}
+	}
+
+	for (i = 0; i < LINK_PENDING_CAP; i++) {
+		if (conn->pending[i].used && conn->pending[i].cb)
+			conn->pending[i].cb(conn, NULL, conn->pending[i].userdata);
+		conn->pending[i].used = 0;
+	}
+}
+
+static int dispatch_call(link_connection_t *conn, const struct link_msg *m,
+			 const uint8_t *frame, size_t framelen,
+			 const uid_t *known_uid);
+
+void link_uid_resolved(link_server_t *server, link_authz_t tok, uid_t uid)
+{
+	uint8_t             buf[LINK_PARKED_MSG_MAX];
+	struct link_parked *p = NULL;
+	link_connection_t  *conn;
+	struct link_msg     msg;
+	size_t              len;
+	int                 i;
+
+	if (!server || !tok)
+		return;
+
+	for (i = 0; i < LINK_PARKED_CAP; i++) {
+		if (server->parked[i].tok == tok) {
+			p = &server->parked[i];
+			break;
+		}
+	}
+	if (!p)
+		return;		/* stale handle, already answered */
+
+	/* Copy the message out and free the slot before dispatching:
+	 * the handler may park a call of its own. */
+	conn = p->conn;
+	len  = p->len;
+	memcpy(buf, p->buf, len);
+	unpark(p);
+
+	if (!conn || __msg_parse(buf, len, &msg) <= 0)
+		return;
+
+	(void)dispatch_call(conn, &msg, NULL, 0, &uid);
+}
+
+int __dispatch_message(link_connection_t *conn, const struct link_msg *m, size_t framelen)
+{
+	if (m->type == LINK_MSG_METHOD_RETURN || m->type == LINK_MSG_ERROR) {
+		deliver_reply(conn, m);
+		return 0;
+	}
+
+	if (m->type != LINK_MSG_METHOD_CALL) {
+		/* Signals from a client to PID 1 are nonsense; drop. */
+		return 0;
+	}
+
+	return dispatch_call(conn, m, conn->rxbuf, framelen, NULL);
+}
+
+/* Who may invoke a privileged method.  Without an authorizer, only
+ * root, which is what libink can decide on its own. */
+static int caller_may(link_server_t *srv, uid_t uid)
+{
+	if (uid == LINK_UID_UNKNOWN)
+		return 0;
+	if (srv && srv->authorizer)
+		return srv->authorizer(uid, srv->authz_userdata);
+
+	return uid == 0;
+}
+
+/* Ask who is calling on a broker connection, where the message is the
+ * only evidence.  Returns 0 with *uid set, 1 when the call was parked
+ * and will be dispatched again once the resolver answers, -1 when the
+ * caller cannot be identified, and -2 when we have no room to ask. */
+#define CALLER_UID_BUSY (-2)
+
+static int resolve_caller(link_connection_t *conn, const struct link_msg *m,
+			  const uint8_t *frame, size_t framelen, uid_t *uid)
+{
+	link_server_t      *srv = conn->server;
+	struct link_parked *p;
+	link_authz_t        tok;
+	int                 rc;
+
+	if (!srv || !srv->uid_resolver || !m->sender)
+		return -1;
+
+	/* Enforce the rule link.h states, rather than trusting every
+	 * resolver to remember it: a truncated sender key would let two
+	 * callers share one identity. */
+	if (strlen(m->sender) >= LINK_SENDER_MAX) {
+		return -1;
+	}
+
+	/* Park first so the resolver has somewhere to answer, then let
+	 * it release the slot immediately if it already knew. */
+	p = park(conn, frame, framelen, &tok);
+	if (!p)
+		return CALLER_UID_BUSY;
+
+	rc = srv->uid_resolver(conn, m->sender, tok, uid, srv->uid_userdata);
+	if (rc != 1)
+		unpark(p);
+
+	return rc;
+}
+
+static int dispatch_call(link_connection_t *conn, const struct link_msg *m,
+			 const uint8_t *frame, size_t framelen,
+			 const uid_t *known_uid)
 {
 	struct link_object       *o;
 	struct link_vtable_entry *e = NULL;
 	const link_method_t      *meth;
 	struct link_call          call;
 	ssize_t                  blen;
+	uid_t                    call_uid;
 	int                      rc;
 
-	if (m->type != LINK_MSG_METHOD_CALL) {
-		/* Signals and replies from a client to PID 1 are nonsense;
-		 * silently drop. */
-		return 0;
-	}
+	/* What a handler sees via link_call_uid().  Unresolved on a broker
+	 * connection until a privileged method forces the question. */
+	call_uid = known_uid ? *known_uid : conn->peer_uid;
 
 	if (!m->path || !m->member) {
 		return __send_error(conn, m,
@@ -345,6 +538,7 @@ int __dispatch_message(link_connection_t *conn, const struct link_msg *m)
 			"Method call without path or member");
 	}
 
+
 	/* Built-in DBus interfaces (Hello, Ping, Introspect, Properties)
 	 * are handled here before object-tree lookup, which means they
 	 * also run before the LINK_METHOD_PRIVILEGED authz gate further
@@ -374,24 +568,47 @@ int __dispatch_message(link_connection_t *conn, const struct link_msg *m)
 		const char *got = m->signature ? m->signature : "";
 		const char *want = meth->in_sig ? meth->in_sig : "";
 
-		if (strcmp(got, want) != 0)
+		if (strcmp(got, want) != 0) {
 			return __send_error(conn, m,
 				"org.freedesktop.DBus.Error.InvalidArgs",
 				"Argument signature mismatch");
+		}
 	}
 
-	/* Per-method authorization.  PRIVILEGED methods require uid 0;
-	 * the peer's uid was captured via SO_PEERCRED at accept time
-	 * and verified against the AUTH EXTERNAL claim, so we can trust
-	 * conn->peer_uid here. */
-	if ((meth->flags & LINK_METHOD_PRIVILEGED) && conn->peer_uid != 0) {
-		return __send_error(conn, m,
-			"org.freedesktop.DBus.Error.AccessDenied",
-			"Method requires root privileges");
+	/* Per-method authorization.  PRIVILEGED methods require uid 0.
+	 * On an ordinary connection the peer's uid was captured via
+	 * SO_PEERCRED at accept time and verified against the AUTH
+	 * EXTERNAL claim, so conn->peer_uid is the answer.  A broker
+	 * connection carries every caller at once, so who is asking has
+	 * to be established per message, which may park the call. */
+	if (meth->flags & LINK_METHOD_PRIVILEGED) {
+		if (conn->broker && !known_uid) {
+			rc = resolve_caller(conn, m, frame, framelen, &call_uid);
+			if (rc == 1)
+				return 0;	/* parked, resumed later */
+
+			if (rc == CALLER_UID_BUSY) {
+				/* Not a permission problem: root may well
+				 * be asking, we just have no slot to find
+				 * out in.  Say so, it is retryable. */
+				return __send_error(conn, m,
+					"org.freedesktop.DBus.Error.LimitsExceeded",
+					"Too many calls awaiting authorization");
+			}
+			if (rc < 0)
+				call_uid = (uid_t)-1;
+		}
+
+		if (!caller_may(conn->server, call_uid)) {
+			return __send_error(conn, m,
+				"org.freedesktop.DBus.Error.AccessDenied",
+				"Caller is not privileged for this method");
+		}
 	}
 
 	memset(&call, 0, sizeof(call));
 	call.conn     = conn;
+	call.uid      = call_uid;
 	call.incoming = *m;
 	__r_init(&call.read_cursor, m->body, m->body_avail);
 

libink/internal.h

@@ -24,9 +24,22 @@ typedef enum {
 #define LINK_AUTH_LINEBUF_SIZE 256
 #define LINK_RX_BUF_SIZE       (64 * 1024)
 #define LINK_TX_BUF_SIZE       (16 * 1024)
-#define LINK_UNIQUE_NAME_LEN   16
+#define LINK_UNIQUE_NAME_LEN   LINK_SENDER_MAX
 #define LINK_MATCH_RULE_MAX    256	/* per-peer match rule cap */
 #define LINK_MATCH_PEER_CAP    16	/* max active match rules per peer */
+#define LINK_PENDING_CAP        4	/* outbound calls awaiting a reply */
+/* Staging for an outgoing method call.  Generous on purpose: headers
+ * for the calls libink makes run to ~150 B, and both the synchronous
+ * and the connection-side path build into these, so one answer rather
+ * than a number per call site. */
+#define LINK_CALL_HDR_MAX    1024
+#define LINK_CALL_BODY_MAX   1024
+#define LINK_PARKED_CAP         4	/* inbound calls awaiting a uid */
+/* A call parked for authorization is a privileged one: an object path
+ * and at most a service name.  Finit's per-service paths alone run to
+ * 512 bytes, so leave room for the header around one.  Anything that
+ * does not fit is denied rather than held. */
+#define LINK_PARKED_MSG_MAX  1024
 
 /* Per-vtable record attached to an object's interface list. */
 struct link_vtable_entry {
@@ -46,19 +59,44 @@ struct link_object {
 
 TAILQ_HEAD(link_object_list, link_object);
 
+/* An inbound method call held while we find out who sent it.  The
+ * message is copied because rxbuf is reused as soon as we return to
+ * the read loop.  `tok` is the handle the resolver answers with, and
+ * zero when the slot is free. */
+struct link_parked {
+	link_authz_t        tok;
+	link_connection_t  *conn;
+	size_t              len;
+	uint8_t             buf[LINK_PARKED_MSG_MAX];
+};
+
 struct link_server {
 	int                       fd;
 	char                      path[LINK_PATH_MAX];
 	struct link_object_list    objects;
 	uint32_t                  next_unique_id;	/* for ":1.N" names */
+
+	/* Set by link_server_set_uid_resolver(); see link.h. */
+	link_uid_resolver_t       uid_resolver;
+	void                     *uid_userdata;
+
+	/* Set by link_server_set_authorizer(); see link.h. */
+	link_authorizer_t         authorizer;
+	void                     *authz_userdata;
+	struct link_parked        parked[LINK_PARKED_CAP];
+	link_authz_t              next_tok;
 };
 
 /* The reply being assembled inside a method handler.
  *
  * The reply body lives in conn->txbuf, not on this struct, so a
  * stack-allocated link_call (in dispatch) stays small.  Sharing the
- * connection's txbuf is safe: the event loop is single-threaded and
- * a connection only ever has one in-flight method call at a time. */
+ * connection's txbuf is safe because a reply is marshalled and sent
+ * without yielding.  Note that parking means several calls can be in
+ * flight on one connection: what is held is the request, and
+ * link_uid_resolved() resumes from a copy, so txbuf is still only
+ * ever used by one reply at a time.  An async handler that returned
+ * before writing its reply would break that. */
 struct link_call {
 	link_connection_t *conn;
 	struct link_msg    incoming;
@@ -66,6 +104,7 @@ struct link_call {
 	struct link_writer reply_writer;	/* writes into conn->txbuf */
 	int               reply_consumed;
 	int               error_sent;
+	uid_t             uid;		/* caller, resolved for a broker peer */
 };
 
 /* A parsed AddMatch rule.  Fields are NULL when the rule omits the
@@ -108,6 +147,16 @@ struct link_connection {
 
 	uint32_t            next_serial;
 
+	/* Outbound calls we made on this connection, awaiting replies.
+	 * Only a broker connection uses these today, to ask the bus
+	 * driver who a sender is. */
+	struct {
+		int              used;
+		uint32_t         serial;
+		link_reply_cb_t  cb;
+		void            *userdata;
+	} pending[LINK_PENDING_CAP];
+
 	struct link_server  *server;	/* back-pointer for dispatch */
 };
 
@@ -121,7 +170,8 @@ void __auth_generate_guid(char out[33]);
 int  __auth_client(int fd, uid_t uid);
 
 /* dispatch.c */
-int  __dispatch_message(link_connection_t *conn, const struct link_msg *m);
+int  __dispatch_message(link_connection_t *conn, const struct link_msg *m, size_t framelen);
+void __dispatch_forget_conn(link_connection_t *conn);
 int  __send_error(link_connection_t *conn, const struct link_msg *req,
 		     const char *error_name, const char *text);
 int  __send_method_return(link_connection_t *conn, const struct link_msg *req,

libink/link.h

@@ -88,6 +88,67 @@ typedef struct {
 	size_t         body_len;
 } link_reply_t;
 
+/* ----------  caller identity on a broker connection  ---------- */
+
+/* Handle for a call parked while its caller is identified.  Opaque,
+ * and safe to hold: it encodes a slot and a generation, so resolving
+ * a stale handle is a no-op rather than a use-after-free. */
+typedef uint64_t link_authz_t;
+
+/* "Nobody asked yet", distinct from any real uid.  link_call_uid()
+ * returns this on a broker connection until something forces the
+ * question, which today only a LINK_METHOD_PRIVILEGED method does. */
+#define LINK_UID_UNKNOWN ((uid_t)-1)
+
+/* A broker sets SENDER to a unique name, ":1.<u32>", so this is very
+ * generous.  Callers that key anything on a sender must reject longer
+ * names rather than truncate: two senders sharing a truncated key
+ * would share an identity. */
+#define LINK_SENDER_MAX 64
+
+/* Answer "which uid is `sender`?" for a privileged call arriving on a
+ * broker connection, where SO_PEERCRED describes the broker and not
+ * the caller.
+ *
+ * Return 0 with *uid set when the answer is already known, 1 to answer
+ * later by calling link_uid_resolved() with `tok`, or -1 when it
+ * cannot be determined, which fails the call closed.  Returning 1
+ * without ever calling link_uid_resolved() leaks the slot and leaves
+ * the caller without a reply, so always answer. */
+typedef int (*link_uid_resolver_t)(link_connection_t *conn, const char *sender,
+				   link_authz_t tok, uid_t *uid, void *userdata);
+
+void link_server_set_uid_resolver(link_server_t *server, link_uid_resolver_t cb,
+				  void *userdata);
+
+/* May `uid` invoke a LINK_METHOD_PRIVILEGED method?  Return non-zero
+ * to allow.  Who counts as privileged is the embedder's policy, not
+ * the library's; with no authorizer installed only uid 0 may. */
+typedef int (*link_authorizer_t)(uid_t uid, void *userdata);
+
+void link_server_set_authorizer(link_server_t *server, link_authorizer_t cb,
+				void *userdata);
+
+/* Complete a deferred resolve and resume the parked call.  Pass
+ * (uid_t)-1 to say the caller could not be identified, which denies
+ * it.  Resolving a handle twice, or one whose connection has since
+ * closed, does nothing. */
+void link_uid_resolved(link_server_t *server, link_authz_t tok, uid_t uid);
+
+/* Called with the reply to an outbound link_connection_call().  `reply`
+ * is NULL if the connection dropped before one arrived. */
+typedef void (*link_reply_cb_t)(link_connection_t *conn, const link_reply_t *reply,
+				void *userdata);
+
+/* Issue a method call on an established connection and invoke `cb`
+ * when the reply lands.  Unlike link_client_call() this never blocks:
+ * the reply is picked up by the normal read loop.  Argument marshalling
+ * matches link_client_call_v(). */
+int link_connection_call(link_connection_t *conn, const char *destination,
+			 const char *path, const char *interface, const char *member,
+			 link_reply_cb_t cb, void *userdata,
+			 const char *signature, ...);
+
 /* ----------  server / connection lifecycle  ---------- */
 
 /* Bind a listening socket at `path` with file mode `mode`, e.g. 0660

libink/marshal.c

@@ -376,3 +376,34 @@ int __r_array_begin(struct link_reader *r, size_t *out_end)
 	*out_end = end;
 	return 0;
 }
+
+ssize_t __marshal_va(uint8_t *body, size_t cap, const char *sig, va_list ap)
+{
+	struct link_writer w;
+	const char        *s;
+
+	__w_init(&w, body, cap);
+	for (s = sig; *s; s++) {
+		switch (*s) {
+		case 'y':
+			__w_byte(&w, (uint8_t)va_arg(ap, int));
+			break;
+		case 'b':
+			__w_bool(&w, va_arg(ap, int));
+			break;
+		case 'u':
+			__w_u32(&w, va_arg(ap, uint32_t));
+			break;
+		case 's':
+			__w_string(&w, va_arg(ap, const char *));
+			break;
+		case 'o':
+			__w_path(&w, va_arg(ap, const char *));
+			break;
+		default:
+			return -1;
+		}
+	}
+
+	return __w_finish(&w);
+}

libink/marshal.h

@@ -6,8 +6,10 @@
 #ifndef LIBINK_MARSHAL_H_
 #define LIBINK_MARSHAL_H_
 
+#include <stdarg.h>
 #include <stddef.h>
 #include <stdint.h>
+#include <sys/types.h>
 
 /* struct link_writer is defined in ink.h (public).  Field layout is
  * "opaque" per the public contract; this file's helpers manipulate
@@ -52,4 +54,10 @@ int  __r_align (struct link_reader *r, size_t n);  /* skip to n-byte boundary */
 int  __r_array_begin(struct link_reader *r, size_t *out_end);
 int  __r_done  (const struct link_reader *r);
 
+/* Marshal varargs into `body` (capacity `cap`) according to `sig`.
+ * Returns the marshalled length, or -1 on overflow or an unsupported
+ * type code.  Shared by the synchronous client and the asynchronous
+ * connection-side call. */
+ssize_t __marshal_va(uint8_t *body, size_t cap, const char *sig, va_list ap);
+
 #endif /* LIBINK_MARSHAL_H_ */

libink/proto.c

@@ -389,3 +389,15 @@ size_t __msg_header_size(const struct link_msg *m)
 	/* Generous upper bound used by callers to size send buffers. */
 	return 512;
 }
+
+void __msg_to_reply(link_reply_t *r, const struct link_msg *m)
+{
+	r->type       = m->type;
+	r->signature  = m->signature;
+	r->error_name = m->error_name;
+	r->path       = m->path;
+	r->interface  = m->interface;
+	r->member     = m->member;
+	r->body       = m->body_avail ? m->body : NULL;
+	r->body_len   = m->body_avail;
+}

libink/proto.h

@@ -60,6 +60,11 @@ struct link_msg {
  * needed, -1 on malformed input. */
 ssize_t __msg_parse(const uint8_t *buf, size_t len, struct link_msg *out);
 
+/* Project a parsed message onto the public reply view.  Shared by the
+ * synchronous client and the connection-side reply routing so the two
+ * cannot drift as link_reply_t grows. */
+void __msg_to_reply(link_reply_t *r, const struct link_msg *m);
+
 /* Compute the on-wire size of a future message header given the
  * fields we'd populate.  Used to size send buffers. */
 size_t __msg_header_size(const struct link_msg *m);

libink/server.c

@@ -159,10 +159,27 @@ int link_server_accept(link_server_t *srv, link_connection_t **out)
 
 	__auth_generate_guid(conn->guid);
 
+
 	*out = conn;
 	return 0;
 }
 
+void link_server_set_uid_resolver(link_server_t *srv, link_uid_resolver_t cb, void *userdata)
+{
+	if (!srv)
+		return;
+	srv->uid_resolver = cb;
+	srv->uid_userdata = userdata;
+}
+
+void link_server_set_authorizer(link_server_t *srv, link_authorizer_t cb, void *userdata)
+{
+	if (!srv)
+		return;
+	srv->authorizer     = cb;
+	srv->authz_userdata = userdata;
+}
+
 link_connection_t *link_server_attach(link_server_t *srv, int fd, uid_t peer_uid,
 				      unsigned int attach_flags)
 {
@@ -199,6 +216,7 @@ link_connection_t *link_server_attach(link_server_t *srv, int fd, uid_t peer_uid
 	conn->broker   = !!(attach_flags & LINK_ATTACH_BROKER);
 	__auth_generate_guid(conn->guid);
 
+
 	return conn;
 
 err_close: