zeroc-ice 3.8.2 → 3.8.3

data/dist/ice/cpp/src/Ice/SSL/SecureTransportUtil.cpp

@@ -206,25 +206,6 @@ Ice::SSL::SecureTransport::sslErrorToString(OSStatus status)
 }
 
 #if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
-CFDictionaryRef
-Ice::SSL::SecureTransport::getCertificateProperty(SecCertificateRef cert, CFTypeRef key)
-{
-    UniqueRef<CFDictionaryRef> property;
-    UniqueRef<CFArrayRef> keys(CFArrayCreate(nullptr, &key, 1, &kCFTypeArrayCallBacks));
-    UniqueRef<CFErrorRef> err;
-    UniqueRef<CFDictionaryRef> values(SecCertificateCopyValues(cert, keys.get(), &err.get()));
-    if (err)
-    {
-        ostringstream os;
-        os << "SSL transport: error getting property for certificate:\n" << sslErrorToString(err);
-        throw CertificateReadException(__FILE__, __LINE__, os.str());
-    }
-
-    assert(values);
-    property.retain(static_cast<CFDictionaryRef>(CFDictionaryGetValue(values.get(), key)));
-    return property.release();
-}
-
 namespace
 {
     //
@@ -264,12 +245,10 @@ namespace
         memset(&params, 0, sizeof(params));
         params.version = SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION;
         params.flags |= kSecKeyNoAccessControl;
-        UniqueRef<CFStringRef> passphraseHolder;
-        if (!passphrase.empty())
-        {
-            passphraseHolder.reset(toCFString(passphrase));
-            params.passphrase = passphraseHolder.get();
-        }
+        // Always pass a passphrase, even an empty one: SecItemImport rejects a PKCS12 file with
+        // errSecPassphraseRequired when params.passphrase is null, without looking at the file contents.
+        UniqueRef<CFStringRef> passphraseHolder(toCFString(passphrase));
+        params.passphrase = passphraseHolder.get();
 
         UniqueRef<CFArrayRef> items;
         SecExternalItemType importType = type;
@@ -277,6 +256,26 @@ namespace
         UniqueRef<CFStringRef> path(toCFString(file));
         OSStatus err = SecItemImport(data.get(), path.get(), &format, &importType, 0, &params, keychain, &items.get());
 
+        if (err == errSecPkcs12VerifyFailure && passphrase.empty())
+        {
+            // There are two encodings of the empty PKCS12 password, and they derive different keys. RFC 7292
+            // appendix B.1 formats every password as a NULL-terminated UTF-16BE string, which makes the empty
+            // password two 0x00 bytes; appendix B.2 step 3 instead notes that an empty password gives an empty
+            // block. openssl and keytool write the first, .NET writes either one depending on whether the
+            // password is "" or null.
+            //
+            // SecItemImport reads a CFString passphrase as the second encoding and a CFData passphrase as the
+            // raw password bytes, so retry with the two bytes appendix B.1 asks for. This mirrors .NET's own
+            // PKCS12 reader, which retries the other encoding when MAC verification fails.
+            const uint8_t emptyPassword[2] = {0, 0};
+            UniqueRef<CFDataRef> dataPassphrase(
+                CFDataCreate(kCFAllocatorDefault, emptyPassword, sizeof(emptyPassword)));
+            params.passphrase = dataPassphrase.get();
+            importType = type;
+            format = type == kSecItemTypeUnknown ? kSecFormatPKCS12 : kSecFormatUnknown;
+            err = SecItemImport(data.get(), path.get(), &format, &importType, 0, &params, keychain, &items.get());
+        }
+
         if (err != noErr)
         {
             ostringstream os;
@@ -421,6 +420,20 @@ namespace
             }
         }
 
+        // A certificate must expose a Subject Key Identifier to be imported into the keychain: the SKI is used
+        // both to locate an already-imported certificate (the query below) and as the key label that pairs the
+        // private key with the certificate (further down). Reject a certificate without one with a clear error
+        // instead of passing a null value to CFDictionarySetValue, which aborts the process. Certificates without
+        // a Subject Key Identifier are uncommon in practice, so rejecting them is acceptable.
+        if (!hash)
+        {
+            throw CertificateReadException(
+                __FILE__,
+                __LINE__,
+                "SSL transport: the certificate for key file '" + file +
+                    "' has no Subject Key Identifier extension and cannot be imported into the macOS keychain");
+        }
+
         const void* values[] = {keychain};
         UniqueRef<CFArrayRef> searchList(CFArrayCreate(kCFAllocatorDefault, values, 1, &kCFTypeArrayCallBacks));
 
@@ -510,8 +523,8 @@ namespace
         // kSecKeyLabel attribute should match the subject key identifier.
         //
         vector<SecKeychainAttribute> attributes;
-        if (hash)
         {
+            // hash is guaranteed non-null here: loadPrivateKey rejects certificates without a Subject Key Identifier.
             SecKeychainAttribute attr;
             attr.tag = kSecKeyLabel;
             attr.data = const_cast<UInt8*>(CFDataGetBytePtr(hash.get()));
@@ -536,7 +549,7 @@ namespace
         }
 
         SecKeychainAttributeList attrs;
-        attrs.attr = &attributes[0];
+        attrs.attr = attributes.data();
         attrs.count = static_cast<UInt32>(attributes.size());
         SecKeychainItemModifyAttributesAndData(reinterpret_cast<SecKeychainItemRef>(key.get()), &attrs, 0, nullptr);
 
@@ -594,10 +607,21 @@ namespace
                     break;
                 }
 
-                vector<byte> data(IceInternal::Base64::decode(string(&buffer[startpos], size)));
+                vector<std::byte> data;
+                try
+                {
+                    data = IceInternal::Base64::decode(string(&buffer[startpos], size));
+                }
+                catch (const std::invalid_argument&)
+                {
+                    throw InitializationException(
+                        __FILE__,
+                        __LINE__,
+                        "SSL transport: certificate " + file + " is not a valid PEM-encoded certificate");
+                }
                 UniqueRef<CFDataRef> certdata(CFDataCreate(
                     kCFAllocatorDefault,
-                    reinterpret_cast<uint8_t*>(&data[0]),
+                    reinterpret_cast<uint8_t*>(data.data()),
                     static_cast<CFIndex>(data.size())));
                 UniqueRef<SecCertificateRef> cert(SecCertificateCreateWithData(0, certdata.get()));
                 if (!cert)
@@ -681,7 +705,7 @@ Ice::SSL::SecureTransport::loadCertificateChain(
     if (!chain)
     {
         ostringstream os;
-        os << "SSL transport: couldn't find identity in file " << file;
+        os << "SSL transport: could not find identity in file " << file;
         throw InitializationException(__FILE__, __LINE__, os.str());
     }
 #else
@@ -698,7 +722,7 @@ Ice::SSL::SecureTransport::loadCertificateChain(
         if (SecCertificateGetTypeID() != CFGetTypeID(cert))
         {
             ostringstream os;
-            os << "SSL transport: couldn't find certificate in '" << file << "'";
+            os << "SSL transport: could not find certificate in '" << file << "'";
             throw CertificateReadException(__FILE__, __LINE__, os.str());
         }
 
@@ -715,21 +739,6 @@ Ice::SSL::SecureTransport::loadCertificateChain(
     return chain.release();
 }
 
-SecCertificateRef
-Ice::SSL::SecureTransport::loadCertificate(const string& file)
-{
-    UniqueRef<SecCertificateRef> cert;
-#if defined(ICE_USE_SECURE_TRANSPORT_IOS)
-    UniqueRef<CFArrayRef> certs(loadCerts(file));
-    assert(CFArrayGetCount(certs.get()) > 0);
-    cert.retain((SecCertificateRef)CFArrayGetValueAtIndex(certs.get(), 0));
-#else
-    UniqueRef<CFArrayRef> items(loadKeychainItems(file, kSecItemTypeCertificate, nullptr, ""));
-    cert.retain((SecCertificateRef)CFArrayGetValueAtIndex(items.get(), 0));
-#endif
-    return cert.release();
-}
-
 CFArrayRef
 Ice::SSL::SecureTransport::loadCACertificates(const string& file)
 {
@@ -857,7 +866,8 @@ Ice::SSL::SecureTransport::findCertificateChain(
             {
                 throw InitializationException(__FILE__, __LINE__, "SSL transport: invalid value '" + value + "'");
             }
-            UniqueRef<CFDataRef> v(CFDataCreate(kCFAllocatorDefault, &buffer[0], static_cast<CFIndex>(buffer.size())));
+            UniqueRef<CFDataRef> v(
+                CFDataCreate(kCFAllocatorDefault, buffer.data(), static_cast<CFIndex>(buffer.size())));
             CFDictionarySetValue(
                 query.get(),
                 field == "SUBJECTKEYID" ? kSecAttrSubjectKeyID : kSecAttrSerialNumber,
@@ -932,16 +942,28 @@ Ice::SSL::SecureTransport::findCertificateChain(
     if (err != noErr)
     {
         ostringstream os;
-        os << "SSL transport: couldn't create identity for certificate found in the keychain:\n"
+        os << "SSL transport: could not create identity for certificate found in the keychain:\n"
            << sslErrorToString(err);
         throw InitializationException(__FILE__, __LINE__, os.str());
     }
 
-    // Now lookup the identity with the label
+    // Now lookup the identity with the label. We match the identity by the certificate's label, so the
+    // certificate must have one; reject it with a clear error rather than passing a null value to
+    // CFDictionarySetValue (which aborts the process).
+    const void* label = CFDictionaryGetValue(attributes.get(), kSecAttrLabel);
+    if (label == nullptr)
+    {
+        throw InitializationException(
+            __FILE__,
+            __LINE__,
+            "SSL transport: could not create identity for certificate found in the keychain: the certificate has no "
+            "label attribute");
+    }
+
     query.reset(CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
     CFDictionarySetValue(query.get(), kSecMatchLimit, kSecMatchLimitOne);
     CFDictionarySetValue(query.get(), kSecClass, kSecClassIdentity);
-    CFDictionarySetValue(query.get(), kSecAttrLabel, (CFDataRef)CFDictionaryGetValue(attributes.get(), kSecAttrLabel));
+    CFDictionarySetValue(query.get(), kSecAttrLabel, label);
     CFDictionarySetValue(query.get(), kSecReturnRef, kCFBooleanTrue);
     err = SecItemCopyMatching(query.get(), (CFTypeRef*)&identity.get());
     if (err == noErr)
@@ -958,7 +980,7 @@ Ice::SSL::SecureTransport::findCertificateChain(
     if (err != noErr)
     {
         ostringstream os;
-        os << "SSL transport: couldn't create identity for certificate found in the keychain:\n"
+        os << "SSL transport: could not create identity for certificate found in the keychain:\n"
            << sslErrorToString(err);
         throw InitializationException(__FILE__, __LINE__, os.str());
     }

data/dist/ice/cpp/src/Ice/SSL/SecureTransportUtil.h

@@ -13,13 +13,6 @@ namespace Ice::SSL::SecureTransport
     std::string sslErrorToString(CFErrorRef);
     std::string sslErrorToString(OSStatus);
 
-#    if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
-    //
-    // Retrieve a certificate property
-    //
-    CFDictionaryRef getCertificateProperty(SecCertificateRef, CFTypeRef);
-#    endif
-
     //
     // Read certificate from a file.
     //
@@ -30,7 +23,6 @@ namespace Ice::SSL::SecureTransport
         const std::string&,
         const std::string&);
 
-    SecCertificateRef loadCertificate(const std::string&);
     ICE_API CFArrayRef loadCACertificates(const std::string&);
     ICE_API CFArrayRef findCertificateChain(const std::string&, const std::string&, const std::string&);
 

data/dist/ice/cpp/src/Ice/Selector.cpp

@@ -127,10 +127,10 @@ Selector::getNextHandler(SocketOperation& status, DWORD& count, int& error, int
             }
             else
             {
-                // This indicates a internal error with the IOCP completion port, we log the error and abort.
+                // This indicates an internal error with the IOCP completion port, we log the error and abort.
                 Ice::SocketException ex(__FILE__, __LINE__, err);
                 Ice::Error out(_instance->initializationData().logger);
-                out << "couldn't dequeue packet from completion port:\n" << ex;
+                out << "could not dequeue packet from completion port:\n" << ex;
                 std::abort();
             }
         }
@@ -478,7 +478,7 @@ Selector::startSelect()
 
     //
     // If there are ready handlers, don't block in select, just do a non-blocking
-    // select to retrieve new ready handlers from the Java selector.
+    // select to retrieve new ready handlers from the selector.
     //
     _selectNow = !_readyHandlers.empty();
 }
@@ -556,7 +556,7 @@ Selector::select(int timeout)
     }
     else if (timeout > 0)
     {
-        // kqueue use seconds, epoll use milliseconds
+        // kqueue uses seconds, epoll uses milliseconds
 #    ifdef ICE_USE_EPOLL
         timeout = timeout * 1000;
 #    endif
@@ -570,17 +570,17 @@ Selector::select(int timeout)
     while (true)
     {
 #    if defined(ICE_USE_EPOLL)
-        _count = epoll_wait(_queueFd, &_events[0], _events.size(), timeout);
+        _count = epoll_wait(_queueFd, _events.data(), _events.size(), timeout);
 #    else // ICE_USE_KQUEUE
         assert(!_events.empty());
         if (timeout >= 0)
         {
             timespec ts{.tv_sec = timeout, .tv_nsec = 0};
-            _count = kevent(_queueFd, nullptr, 0, &_events[0], static_cast<int>(_events.size()), &ts);
+            _count = kevent(_queueFd, nullptr, 0, _events.data(), static_cast<int>(_events.size()), &ts);
         }
         else
         {
-            _count = kevent(_queueFd, nullptr, 0, &_events[0], static_cast<int>(_events.size()), nullptr);
+            _count = kevent(_queueFd, nullptr, 0, _events.data(), static_cast<int>(_events.size()), nullptr);
         }
 #    endif
 
@@ -591,7 +591,7 @@ Selector::select(int timeout)
                 continue;
             }
 
-            // This indicates a internal error with the selector, we log the error and abort.
+            // This indicates an internal error with the selector, we log the error and abort.
             Ice::SocketException ex(__FILE__, __LINE__, IceInternal::getSocketErrno());
             Ice::Error out(_instance->initializationData().logger);
             out << "selector failed:\n" << ex;
@@ -640,9 +640,9 @@ Selector::updateSelector()
 {
     int rs = kevent(
         _queueFd,
-        &_changes[0],
+        _changes.data(),
         static_cast<int>(_changes.size()),
-        &_changes[0],
+        _changes.data(),
         static_cast<int>(_changes.size()),
         &zeroTimeout);
     if (rs < 0)
@@ -1120,6 +1120,9 @@ Selector::finish(EventHandler* handler, bool closeNow)
 void
 Selector::ready(EventHandler* handler, SocketOperation status, bool value)
 {
+    // Hold _mutex across the read-modify-write of handler->_ready. The run-loop thread reads _ready under _mutex
+    // (in startSelect/finishSelect, via EventHandlerWrapper), so updating it unlocked here would be a data race.
+    lock_guard lock(_mutex);
     if (((handler->_ready & status) != 0) == value)
     {
         return; // Nothing to do if ready state already correctly set.
@@ -1134,7 +1137,6 @@ Selector::ready(EventHandler* handler, SocketOperation status, bool value)
         handler->_ready = static_cast<SocketOperation>(handler->_ready & ~status);
     }
 
-    lock_guard lock(_mutex);
     std::map<EventHandler*, EventHandlerWrapperPtr>::iterator p = _wrappers.find(handler);
     assert(p != _wrappers.end());
     p->second->checkReady();

data/dist/ice/cpp/src/Ice/ServantManager.cpp

@@ -184,7 +184,7 @@ IceInternal::ServantManager::findServant(const Identity& ident, const string_vie
     lock_guard lock(_mutex);
 
     //
-    // This assert is not valid if the adapter dispatch incoming
+    // This assert is not valid if the adapter dispatches incoming
     // requests from bidir connections. This method might be called if
     // requests are received over the bidir connection after the
     // adapter was deactivated.
@@ -277,7 +277,7 @@ IceInternal::ServantManager::hasServant(const Identity& ident) const
     lock_guard lock(_mutex);
 
     //
-    // This assert is not valid if the adapter dispatch incoming
+    // This assert is not valid if the adapter dispatches incoming
     // requests from bidir connections. This method might be called if
     // requests are received over the bidir connection after the
     // adapter was deactivated.
@@ -360,7 +360,7 @@ IceInternal::ServantManager::findServantLocator(const string_view category) cons
     lock_guard lock(_mutex);
 
     //
-    // This assert is not valid if the adapter dispatch incoming
+    // This assert is not valid if the adapter dispatches incoming
     // requests from bidir connections. This method might be called if
     // requests are received over the bidir connection after the
     // adapter was deactivated.

data/dist/ice/cpp/src/Ice/Service.cpp

@@ -11,7 +11,9 @@
 #    include <winsock2.h>
 #else
 #    include "Network.h"
+#    include <algorithm>
 #    include <csignal>
+#    include <sys/resource.h>
 #    include <sys/stat.h>
 #    include <sys/types.h>
 #    ifdef ICE_USE_SYSTEMD
@@ -172,93 +174,6 @@ namespace
             DeregisterEventSource(_source);
         }
 
-        static void addKeys(const string& source, const StringConverterPtr& stringConverter)
-        {
-            HKEY hKey;
-            DWORD d;
-            //
-            // Don't need to use a wide string converter as the wide string is passed
-            // to Windows API.
-            //
-            LSTATUS err = RegCreateKeyExW(
-                HKEY_LOCAL_MACHINE,
-                stringToWstring(createKey(source), stringConverter).c_str(),
-                0,
-                const_cast<wchar_t*>(L"REG_SZ"),
-                REG_OPTION_NON_VOLATILE,
-                KEY_ALL_ACCESS,
-                0,
-                &hKey,
-                &d);
-
-            if (err != ERROR_SUCCESS)
-            {
-                throw SyscallException{__FILE__, __LINE__, "RegCreateKeyExW failed", static_cast<DWORD>(err)};
-            }
-
-            //
-            // Get the filename of this DLL.
-            //
-            wchar_t path[_MAX_PATH];
-            assert(_module != 0);
-            if (!GetModuleFileNameW(_module, path, _MAX_PATH))
-            {
-                DWORD error = GetLastError();
-                RegCloseKey(hKey);
-                throw SyscallException{__FILE__, __LINE__, "GetModuleFileNameW failed", error};
-            }
-
-            //
-            // The event resources are bundled into this DLL, therefore
-            // the "EventMessageFile" key should contain the path to this
-            // DLL.
-            //
-            err = RegSetValueExW(
-                hKey,
-                L"EventMessageFile",
-                0,
-                REG_EXPAND_SZ,
-                reinterpret_cast<unsigned char*>(path),
-                static_cast<DWORD>((wcslen(path) * sizeof(wchar_t)) + 1));
-
-            if (err == ERROR_SUCCESS)
-            {
-                //
-                // The "TypesSupported" key indicates the supported event
-                // types.
-                //
-                DWORD typesSupported = EVENTLOG_ERROR_TYPE | EVENTLOG_WARNING_TYPE | EVENTLOG_INFORMATION_TYPE;
-                err = RegSetValueExW(
-                    hKey,
-                    L"TypesSupported",
-                    0,
-                    REG_DWORD,
-                    reinterpret_cast<unsigned char*>(&typesSupported),
-                    sizeof(typesSupported));
-            }
-            if (err != ERROR_SUCCESS)
-            {
-                RegCloseKey(hKey);
-                throw SyscallException{__FILE__, __LINE__, "RegSetValueExW failed", static_cast<DWORD>(err)};
-            }
-
-            RegCloseKey(hKey);
-        }
-
-        static void removeKeys(const string& source, const StringConverterPtr& stringConverter)
-        {
-            //
-            // Don't need to use a wide string converter as the wide string is passed
-            // to Windows API.
-            //
-            LSTATUS err =
-                RegDeleteKeyW(HKEY_LOCAL_MACHINE, stringToWstring(createKey(source), stringConverter).c_str());
-            if (err != ERROR_SUCCESS)
-            {
-                throw SyscallException{__FILE__, __LINE__, "RegDeleteKeyW failed", static_cast<DWORD>(err)};
-            }
-        }
-
         virtual void print(const string& prefix, const string& message)
         {
             string s;
@@ -379,8 +294,6 @@ namespace
             ReportEventW(_source, EVENTLOG_ERROR_TYPE, 0, EVENT_LOGGER_MSG, 0, 1, 0, messages, 0);
         }
 
-        static void setModuleHandle(HMODULE module) { _module = module; }
-
     private:
         static string mangleSource(string name)
         {
@@ -395,22 +308,9 @@ namespace
             return name;
         }
 
-        static string createKey(string name)
-        {
-            //
-            // The registry key is:
-            //
-            // HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application.
-            //
-            return "SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\" + mangleSource(name);
-        }
-
         StringConverterPtr _stringConverter;
         HANDLE _source;
-        static HMODULE _module;
     };
-
-    HMODULE SMEventLoggerI::_module = 0;
 }
 
 #endif
@@ -425,6 +325,7 @@ Ice::Service::~Service()
 {
     _instance = nullptr;
     delete ctrlCHandler;
+    ctrlCHandler = nullptr;
 }
 
 bool
@@ -816,12 +717,6 @@ Ice::Service::configureService(const string& name)
     _name = name;
 }
 
-void
-Ice::Service::setModuleHandle(HMODULE module)
-{
-    SMEventLoggerI::setModuleHandle(module);
-}
-
 #else
 
 void
@@ -1385,7 +1280,10 @@ ServiceStatusManager::stopUpdate()
         }
     }
 
-    thread.join();
+    if (thread.joinable())
+    {
+        thread.join();
+    }
 }
 
 void
@@ -1469,7 +1367,8 @@ Ice::Service::runDaemon(int argc, char* argv[], InitializationData initData)
         char c = 0;
         while (true)
         {
-            if (read(fds[0], &c, 1) == -1)
+            ssize_t rc = read(fds[0], &c, 1);
+            if (rc == -1)
             {
                 if (IceInternal::interrupted())
                 {
@@ -1483,6 +1382,20 @@ Ice::Service::runDaemon(int argc, char* argv[], InitializationData initData)
                 consoleErr << IceInternal::errorToString(errno) << endl;
                 _exit(EXIT_FAILURE);
             }
+            else if (rc == 0)
+            {
+                //
+                // EOF before the readiness byte: the daemon exited during startup without signaling readiness
+                // (e.g. it was killed by a signal or aborted in a plug-in). Report a failure so supervisors don't
+                // conclude the service started successfully.
+                //
+                if (argv[0])
+                {
+                    consoleErr << argv[0] << ": ";
+                }
+                consoleErr << "daemon exited during startup before signaling readiness" << endl;
+                _exit(EXIT_FAILURE);
+            }
             break;
         }
 
@@ -1494,7 +1407,7 @@ Ice::Service::runDaemon(int argc, char* argv[], InitializationData initData)
             ssize_t rs;
             char s[16];
             string message;
-            while ((rs = read(fds[0], &s, 16)) > 0)
+            while ((rs = read(fds[0], s, sizeof(s))) > 0)
             {
                 message.append(s, static_cast<size_t>(rs));
             }
@@ -1579,13 +1492,18 @@ Ice::Service::runDaemon(int argc, char* argv[], InitializationData initData)
             // have an opportunity to use stdin/stdout/stderr if necessary. This also
             // conveniently allows the Ice.PrintProcessId property to work as expected.
             //
-            int fdMax = static_cast<int>(sysconf(_SC_OPEN_MAX));
-            if (fdMax <= 0)
+            // Bound the probe loop by the soft RLIMIT_NOFILE — the kernel never allocates a
+            // descriptor at or above it — capped so the loop stays cheap even with a very large
+            // limit (such as LimitNOFILE=infinity under systemd).
+            //
+            rlim_t fdMax = 1 << 20;
+            rlimit fdLimit{};
+            if (getrlimit(RLIMIT_NOFILE, &fdLimit) == 0)
             {
-                throw SyscallException{__FILE__, __LINE__, "sysconf failed", errno};
+                fdMax = std::min(fdMax, fdLimit.rlim_cur);
             }
 
-            for (int i = 0; i < fdMax; ++i)
+            for (int i = 0; i < static_cast<int>(fdMax); ++i)
             {
                 if (fcntl(i, F_GETFL) != -1)
                 {