1 /* 2 * Copyright (c) 1982, 1986, 1989, 1991, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94 34 * $FreeBSD: src/sys/kern/uipc_usrreq.c,v 1.54.2.10 2003/03/04 17:28:09 nectar Exp $ 35 * $DragonFly: src/sys/kern/uipc_usrreq.c,v 1.12 2004/03/05 16:57:15 hsu Exp $ 36 */ 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/kernel.h> 41 #include <sys/domain.h> 42 #include <sys/fcntl.h> 43 #include <sys/malloc.h> /* XXX must be before <sys/file.h> */ 44 #include <sys/proc.h> 45 #include <sys/file.h> 46 #include <sys/filedesc.h> 47 #include <sys/mbuf.h> 48 #include <sys/namei.h> 49 #include <sys/protosw.h> 50 #include <sys/socket.h> 51 #include <sys/socketvar.h> 52 #include <sys/resourcevar.h> 53 #include <sys/stat.h> 54 #include <sys/sysctl.h> 55 #include <sys/un.h> 56 #include <sys/unpcb.h> 57 #include <sys/vnode.h> 58 #include <sys/file2.h> 59 60 #include <vm/vm_zone.h> 61 62 static struct vm_zone *unp_zone; 63 static unp_gen_t unp_gencnt; 64 static u_int unp_count; 65 66 static struct unp_head unp_shead, unp_dhead; 67 68 /* 69 * Unix communications domain. 70 * 71 * TODO: 72 * SEQPACKET, RDM 73 * rethink name space problems 74 * need a proper out-of-band 75 * lock pushdown 76 */ 77 static struct sockaddr sun_noname = { sizeof(sun_noname), AF_LOCAL }; 78 static ino_t unp_ino; /* prototype for fake inode numbers */ 79 80 static int unp_attach (struct socket *, struct pru_attach_info *); 81 static void unp_detach (struct unpcb *); 82 static int unp_bind (struct unpcb *,struct sockaddr *, struct thread *); 83 static int unp_connect (struct socket *,struct sockaddr *, 84 struct thread *); 85 static void unp_disconnect (struct unpcb *); 86 static void unp_shutdown (struct unpcb *); 87 static void unp_drop (struct unpcb *, int); 88 static void unp_gc (void); 89 static void unp_scan (struct mbuf *, void (*)(struct file *)); 90 static void unp_mark (struct file *); 91 static void unp_discard (struct file *); 92 static int unp_internalize (struct mbuf *, struct thread *); 93 static int unp_listen (struct unpcb *, struct thread *); 94 95 static int 96 uipc_abort(struct socket *so) 97 { 98 struct unpcb *unp = sotounpcb(so); 99 100 if (unp == 0) 101 return EINVAL; 102 unp_drop(unp, ECONNABORTED); 103 unp_detach(unp); 104 sofree(so); 105 return 0; 106 } 107 108 static int 109 uipc_accept(struct socket *so, struct sockaddr **nam) 110 { 111 struct unpcb *unp = sotounpcb(so); 112 113 if (unp == 0) 114 return EINVAL; 115 116 /* 117 * Pass back name of connected socket, 118 * if it was bound and we are still connected 119 * (our peer may have closed already!). 120 */ 121 if (unp->unp_conn && unp->unp_conn->unp_addr) { 122 *nam = dup_sockaddr((struct sockaddr *)unp->unp_conn->unp_addr, 123 1); 124 } else { 125 *nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1); 126 } 127 return 0; 128 } 129 130 static int 131 uipc_attach(struct socket *so, int proto, struct pru_attach_info *ai) 132 { 133 struct unpcb *unp = sotounpcb(so); 134 135 if (unp != 0) 136 return EISCONN; 137 return unp_attach(so, ai); 138 } 139 140 static int 141 uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td) 142 { 143 struct unpcb *unp = sotounpcb(so); 144 145 if (unp == 0) 146 return EINVAL; 147 return unp_bind(unp, nam, td); 148 } 149 150 static int 151 uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 152 { 153 struct unpcb *unp = sotounpcb(so); 154 155 if (unp == 0) 156 return EINVAL; 157 return unp_connect(so, nam, td); 158 } 159 160 static int 161 uipc_connect2(struct socket *so1, struct socket *so2) 162 { 163 struct unpcb *unp = sotounpcb(so1); 164 165 if (unp == 0) 166 return EINVAL; 167 168 return unp_connect2(so1, so2); 169 } 170 171 /* control is EOPNOTSUPP */ 172 173 static int 174 uipc_detach(struct socket *so) 175 { 176 struct unpcb *unp = sotounpcb(so); 177 178 if (unp == 0) 179 return EINVAL; 180 181 unp_detach(unp); 182 return 0; 183 } 184 185 static int 186 uipc_disconnect(struct socket *so) 187 { 188 struct unpcb *unp = sotounpcb(so); 189 190 if (unp == 0) 191 return EINVAL; 192 unp_disconnect(unp); 193 return 0; 194 } 195 196 static int 197 uipc_listen(struct socket *so, struct thread *td) 198 { 199 struct unpcb *unp = sotounpcb(so); 200 201 if (unp == 0 || unp->unp_vnode == 0) 202 return EINVAL; 203 return unp_listen(unp, td); 204 } 205 206 static int 207 uipc_peeraddr(struct socket *so, struct sockaddr **nam) 208 { 209 struct unpcb *unp = sotounpcb(so); 210 211 if (unp == 0) 212 return EINVAL; 213 if (unp->unp_conn && unp->unp_conn->unp_addr) 214 *nam = dup_sockaddr((struct sockaddr *)unp->unp_conn->unp_addr, 215 1); 216 else { 217 /* 218 * XXX: It seems that this test always fails even when 219 * connection is established. So, this else clause is 220 * added as workaround to return PF_LOCAL sockaddr. 221 */ 222 *nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1); 223 } 224 return 0; 225 } 226 227 static int 228 uipc_rcvd(struct socket *so, int flags) 229 { 230 struct unpcb *unp = sotounpcb(so); 231 struct socket *so2; 232 u_long newhiwat; 233 234 if (unp == 0) 235 return EINVAL; 236 switch (so->so_type) { 237 case SOCK_DGRAM: 238 panic("uipc_rcvd DGRAM?"); 239 /*NOTREACHED*/ 240 241 case SOCK_STREAM: 242 if (unp->unp_conn == 0) 243 break; 244 so2 = unp->unp_conn->unp_socket; 245 /* 246 * Adjust backpressure on sender 247 * and wakeup any waiting to write. 248 */ 249 so2->so_snd.sb_mbmax += unp->unp_mbcnt - so->so_rcv.sb_mbcnt; 250 unp->unp_mbcnt = so->so_rcv.sb_mbcnt; 251 newhiwat = so2->so_snd.sb_hiwat + unp->unp_cc - 252 so->so_rcv.sb_cc; 253 (void)chgsbsize(so2->so_cred->cr_uidinfo, &so2->so_snd.sb_hiwat, 254 newhiwat, RLIM_INFINITY); 255 unp->unp_cc = so->so_rcv.sb_cc; 256 sowwakeup(so2); 257 break; 258 259 default: 260 panic("uipc_rcvd unknown socktype"); 261 } 262 return 0; 263 } 264 265 /* pru_rcvoob is EOPNOTSUPP */ 266 267 static int 268 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, 269 struct mbuf *control, struct thread *td) 270 { 271 int error = 0; 272 struct unpcb *unp = sotounpcb(so); 273 struct socket *so2; 274 u_long newhiwat; 275 276 if (unp == 0) { 277 error = EINVAL; 278 goto release; 279 } 280 if (flags & PRUS_OOB) { 281 error = EOPNOTSUPP; 282 goto release; 283 } 284 285 if (control && (error = unp_internalize(control, td))) 286 goto release; 287 288 switch (so->so_type) { 289 case SOCK_DGRAM: 290 { 291 struct sockaddr *from; 292 293 if (nam) { 294 if (unp->unp_conn) { 295 error = EISCONN; 296 break; 297 } 298 error = unp_connect(so, nam, td); 299 if (error) 300 break; 301 } else { 302 if (unp->unp_conn == 0) { 303 error = ENOTCONN; 304 break; 305 } 306 } 307 so2 = unp->unp_conn->unp_socket; 308 if (unp->unp_addr) 309 from = (struct sockaddr *)unp->unp_addr; 310 else 311 from = &sun_noname; 312 if (sbappendaddr(&so2->so_rcv, from, m, control)) { 313 sorwakeup(so2); 314 m = 0; 315 control = 0; 316 } else 317 error = ENOBUFS; 318 if (nam) 319 unp_disconnect(unp); 320 break; 321 } 322 323 case SOCK_STREAM: 324 /* Connect if not connected yet. */ 325 /* 326 * Note: A better implementation would complain 327 * if not equal to the peer's address. 328 */ 329 if ((so->so_state & SS_ISCONNECTED) == 0) { 330 if (nam) { 331 error = unp_connect(so, nam, td); 332 if (error) 333 break; /* XXX */ 334 } else { 335 error = ENOTCONN; 336 break; 337 } 338 } 339 340 if (so->so_state & SS_CANTSENDMORE) { 341 error = EPIPE; 342 break; 343 } 344 if (unp->unp_conn == 0) 345 panic("uipc_send connected but no connection?"); 346 so2 = unp->unp_conn->unp_socket; 347 /* 348 * Send to paired receive port, and then reduce 349 * send buffer hiwater marks to maintain backpressure. 350 * Wake up readers. 351 */ 352 if (control) { 353 if (sbappendcontrol(&so2->so_rcv, m, control)) 354 control = 0; 355 } else 356 sbappend(&so2->so_rcv, m); 357 so->so_snd.sb_mbmax -= 358 so2->so_rcv.sb_mbcnt - unp->unp_conn->unp_mbcnt; 359 unp->unp_conn->unp_mbcnt = so2->so_rcv.sb_mbcnt; 360 newhiwat = so->so_snd.sb_hiwat - 361 (so2->so_rcv.sb_cc - unp->unp_conn->unp_cc); 362 (void)chgsbsize(so->so_cred->cr_uidinfo, &so->so_snd.sb_hiwat, 363 newhiwat, RLIM_INFINITY); 364 unp->unp_conn->unp_cc = so2->so_rcv.sb_cc; 365 sorwakeup(so2); 366 m = 0; 367 break; 368 369 default: 370 panic("uipc_send unknown socktype"); 371 } 372 373 /* 374 * SEND_EOF is equivalent to a SEND followed by 375 * a SHUTDOWN. 376 */ 377 if (flags & PRUS_EOF) { 378 socantsendmore(so); 379 unp_shutdown(unp); 380 } 381 382 if (control && error != 0) 383 unp_dispose(control); 384 385 release: 386 if (control) 387 m_freem(control); 388 if (m) 389 m_freem(m); 390 return error; 391 } 392 393 static int 394 uipc_sense(struct socket *so, struct stat *sb) 395 { 396 struct unpcb *unp = sotounpcb(so); 397 struct socket *so2; 398 399 if (unp == 0) 400 return EINVAL; 401 sb->st_blksize = so->so_snd.sb_hiwat; 402 if (so->so_type == SOCK_STREAM && unp->unp_conn != 0) { 403 so2 = unp->unp_conn->unp_socket; 404 sb->st_blksize += so2->so_rcv.sb_cc; 405 } 406 sb->st_dev = NOUDEV; 407 if (unp->unp_ino == 0) /* make up a non-zero inode number */ 408 unp->unp_ino = (++unp_ino == 0) ? ++unp_ino : unp_ino; 409 sb->st_ino = unp->unp_ino; 410 return (0); 411 } 412 413 static int 414 uipc_shutdown(struct socket *so) 415 { 416 struct unpcb *unp = sotounpcb(so); 417 418 if (unp == 0) 419 return EINVAL; 420 socantsendmore(so); 421 unp_shutdown(unp); 422 return 0; 423 } 424 425 static int 426 uipc_sockaddr(struct socket *so, struct sockaddr **nam) 427 { 428 struct unpcb *unp = sotounpcb(so); 429 430 if (unp == 0) 431 return EINVAL; 432 if (unp->unp_addr) 433 *nam = dup_sockaddr((struct sockaddr *)unp->unp_addr, 1); 434 return 0; 435 } 436 437 struct pr_usrreqs uipc_usrreqs = { 438 uipc_abort, uipc_accept, uipc_attach, uipc_bind, uipc_connect, 439 uipc_connect2, pru_control_notsupp, uipc_detach, uipc_disconnect, 440 uipc_listen, uipc_peeraddr, uipc_rcvd, pru_rcvoob_notsupp, 441 uipc_send, uipc_sense, uipc_shutdown, uipc_sockaddr, 442 sosend, soreceive, sopoll 443 }; 444 445 int 446 uipc_ctloutput(so, sopt) 447 struct socket *so; 448 struct sockopt *sopt; 449 { 450 struct unpcb *unp = sotounpcb(so); 451 int error; 452 453 switch (sopt->sopt_dir) { 454 case SOPT_GET: 455 switch (sopt->sopt_name) { 456 case LOCAL_PEERCRED: 457 if (unp->unp_flags & UNP_HAVEPC) 458 error = sooptcopyout(sopt, &unp->unp_peercred, 459 sizeof(unp->unp_peercred)); 460 else { 461 if (so->so_type == SOCK_STREAM) 462 error = ENOTCONN; 463 else 464 error = EINVAL; 465 } 466 break; 467 default: 468 error = EOPNOTSUPP; 469 break; 470 } 471 break; 472 case SOPT_SET: 473 default: 474 error = EOPNOTSUPP; 475 break; 476 } 477 return (error); 478 } 479 480 /* 481 * Both send and receive buffers are allocated PIPSIZ bytes of buffering 482 * for stream sockets, although the total for sender and receiver is 483 * actually only PIPSIZ. 484 * Datagram sockets really use the sendspace as the maximum datagram size, 485 * and don't really want to reserve the sendspace. Their recvspace should 486 * be large enough for at least one max-size datagram plus address. 487 */ 488 #ifndef PIPSIZ 489 #define PIPSIZ 8192 490 #endif 491 static u_long unpst_sendspace = PIPSIZ; 492 static u_long unpst_recvspace = PIPSIZ; 493 static u_long unpdg_sendspace = 2*1024; /* really max datagram size */ 494 static u_long unpdg_recvspace = 4*1024; 495 496 static int unp_rights; /* file descriptors in flight */ 497 498 SYSCTL_DECL(_net_local_stream); 499 SYSCTL_INT(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW, 500 &unpst_sendspace, 0, ""); 501 SYSCTL_INT(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW, 502 &unpst_recvspace, 0, ""); 503 SYSCTL_DECL(_net_local_dgram); 504 SYSCTL_INT(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW, 505 &unpdg_sendspace, 0, ""); 506 SYSCTL_INT(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW, 507 &unpdg_recvspace, 0, ""); 508 SYSCTL_DECL(_net_local); 509 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0, ""); 510 511 static int 512 unp_attach(struct socket *so, struct pru_attach_info *ai) 513 { 514 struct unpcb *unp; 515 int error; 516 517 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) { 518 switch (so->so_type) { 519 520 case SOCK_STREAM: 521 error = soreserve(so, unpst_sendspace, unpst_recvspace, 522 ai->sb_rlimit); 523 break; 524 525 case SOCK_DGRAM: 526 error = soreserve(so, unpdg_sendspace, unpdg_recvspace, 527 ai->sb_rlimit); 528 break; 529 530 default: 531 panic("unp_attach"); 532 } 533 if (error) 534 return (error); 535 } 536 unp = zalloc(unp_zone); 537 if (unp == NULL) 538 return (ENOBUFS); 539 bzero(unp, sizeof *unp); 540 unp->unp_gencnt = ++unp_gencnt; 541 unp_count++; 542 LIST_INIT(&unp->unp_refs); 543 unp->unp_socket = so; 544 unp->unp_rvnode = ai->fd_rdir; /* jail cruft XXX JH */ 545 LIST_INSERT_HEAD(so->so_type == SOCK_DGRAM ? &unp_dhead 546 : &unp_shead, unp, unp_link); 547 so->so_pcb = (caddr_t)unp; 548 return (0); 549 } 550 551 static void 552 unp_detach(unp) 553 struct unpcb *unp; 554 { 555 LIST_REMOVE(unp, unp_link); 556 unp->unp_gencnt = ++unp_gencnt; 557 --unp_count; 558 if (unp->unp_vnode) { 559 unp->unp_vnode->v_socket = 0; 560 vrele(unp->unp_vnode); 561 unp->unp_vnode = 0; 562 } 563 if (unp->unp_conn) 564 unp_disconnect(unp); 565 while (!LIST_EMPTY(&unp->unp_refs)) 566 unp_drop(LIST_FIRST(&unp->unp_refs), ECONNRESET); 567 soisdisconnected(unp->unp_socket); 568 unp->unp_socket->so_pcb = 0; 569 if (unp_rights) { 570 /* 571 * Normally the receive buffer is flushed later, 572 * in sofree, but if our receive buffer holds references 573 * to descriptors that are now garbage, we will dispose 574 * of those descriptor references after the garbage collector 575 * gets them (resulting in a "panic: closef: count < 0"). 576 */ 577 sorflush(unp->unp_socket); 578 unp_gc(); 579 } 580 if (unp->unp_addr) 581 FREE(unp->unp_addr, M_SONAME); 582 zfree(unp_zone, unp); 583 } 584 585 static int 586 unp_bind(struct unpcb *unp, struct sockaddr *nam, struct thread *td) 587 { 588 struct proc *p = td->td_proc; 589 struct sockaddr_un *soun = (struct sockaddr_un *)nam; 590 struct vnode *vp; 591 struct vattr vattr; 592 int error, namelen; 593 struct nameidata nd; 594 char buf[SOCK_MAXADDRLEN]; 595 596 if (unp->unp_vnode != NULL) 597 return (EINVAL); 598 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path); 599 if (namelen <= 0) 600 return EINVAL; 601 strncpy(buf, soun->sun_path, namelen); 602 buf[namelen] = 0; /* null-terminate the string */ 603 NDINIT(&nd, NAMEI_CREATE, CNP_LOCKPARENT, UIO_SYSSPACE, buf, td); 604 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */ 605 error = namei(&nd); 606 if (error) 607 return (error); 608 vp = nd.ni_vp; 609 if (vp != NULL) { 610 NDFREE(&nd, NDF_ONLY_PNBUF); 611 if (nd.ni_dvp == vp) 612 vrele(nd.ni_dvp); 613 else 614 vput(nd.ni_dvp); 615 vrele(vp); 616 return (EADDRINUSE); 617 } 618 VATTR_NULL(&vattr); 619 vattr.va_type = VSOCK; 620 vattr.va_mode = (ACCESSPERMS & ~p->p_fd->fd_cmask); 621 VOP_LEASE(nd.ni_dvp, td, p->p_ucred, LEASE_WRITE); 622 error = VOP_CREATE(nd.ni_dvp, NCPNULL, &nd.ni_vp, &nd.ni_cnd, &vattr); 623 NDFREE(&nd, NDF_ONLY_PNBUF); 624 vput(nd.ni_dvp); 625 if (error) 626 return (error); 627 vp = nd.ni_vp; 628 vp->v_socket = unp->unp_socket; 629 unp->unp_vnode = vp; 630 unp->unp_addr = (struct sockaddr_un *)dup_sockaddr(nam, 1); 631 VOP_UNLOCK(vp, NULL, 0, td); 632 return (0); 633 } 634 635 static int 636 unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 637 { 638 struct proc *p = td->td_proc; 639 struct sockaddr_un *soun = (struct sockaddr_un *)nam; 640 struct vnode *vp; 641 struct socket *so2, *so3; 642 struct unpcb *unp, *unp2, *unp3; 643 int error, len; 644 struct nameidata nd; 645 char buf[SOCK_MAXADDRLEN]; 646 647 KKASSERT(p); 648 649 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path); 650 if (len <= 0) 651 return EINVAL; 652 strncpy(buf, soun->sun_path, len); 653 buf[len] = 0; 654 655 NDINIT(&nd, NAMEI_LOOKUP, CNP_FOLLOW | CNP_LOCKLEAF, 656 UIO_SYSSPACE, buf, td); 657 error = namei(&nd); 658 if (error) 659 return (error); 660 vp = nd.ni_vp; 661 NDFREE(&nd, NDF_ONLY_PNBUF); 662 if (vp->v_type != VSOCK) { 663 error = ENOTSOCK; 664 goto bad; 665 } 666 error = VOP_ACCESS(vp, VWRITE, p->p_ucred, td); 667 if (error) 668 goto bad; 669 so2 = vp->v_socket; 670 if (so2 == 0) { 671 error = ECONNREFUSED; 672 goto bad; 673 } 674 if (so->so_type != so2->so_type) { 675 error = EPROTOTYPE; 676 goto bad; 677 } 678 if (so->so_proto->pr_flags & PR_CONNREQUIRED) { 679 if ((so2->so_options & SO_ACCEPTCONN) == 0 || 680 (so3 = sonewconn(so2, 0)) == 0) { 681 error = ECONNREFUSED; 682 goto bad; 683 } 684 unp = sotounpcb(so); 685 unp2 = sotounpcb(so2); 686 unp3 = sotounpcb(so3); 687 if (unp2->unp_addr) 688 unp3->unp_addr = (struct sockaddr_un *) 689 dup_sockaddr((struct sockaddr *) 690 unp2->unp_addr, 1); 691 692 /* 693 * unp_peercred management: 694 * 695 * The connecter's (client's) credentials are copied 696 * from its process structure at the time of connect() 697 * (which is now). 698 */ 699 cru2x(p->p_ucred, &unp3->unp_peercred); 700 unp3->unp_flags |= UNP_HAVEPC; 701 /* 702 * The receiver's (server's) credentials are copied 703 * from the unp_peercred member of socket on which the 704 * former called listen(); unp_listen() cached that 705 * process's credentials at that time so we can use 706 * them now. 707 */ 708 KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED, 709 ("unp_connect: listener without cached peercred")); 710 memcpy(&unp->unp_peercred, &unp2->unp_peercred, 711 sizeof(unp->unp_peercred)); 712 unp->unp_flags |= UNP_HAVEPC; 713 714 so2 = so3; 715 } 716 error = unp_connect2(so, so2); 717 bad: 718 vput(vp); 719 return (error); 720 } 721 722 int 723 unp_connect2(so, so2) 724 struct socket *so; 725 struct socket *so2; 726 { 727 struct unpcb *unp = sotounpcb(so); 728 struct unpcb *unp2; 729 730 if (so2->so_type != so->so_type) 731 return (EPROTOTYPE); 732 unp2 = sotounpcb(so2); 733 unp->unp_conn = unp2; 734 switch (so->so_type) { 735 736 case SOCK_DGRAM: 737 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink); 738 soisconnected(so); 739 break; 740 741 case SOCK_STREAM: 742 unp2->unp_conn = unp; 743 soisconnected(so); 744 soisconnected(so2); 745 break; 746 747 default: 748 panic("unp_connect2"); 749 } 750 return (0); 751 } 752 753 static void 754 unp_disconnect(unp) 755 struct unpcb *unp; 756 { 757 struct unpcb *unp2 = unp->unp_conn; 758 759 if (unp2 == 0) 760 return; 761 unp->unp_conn = 0; 762 switch (unp->unp_socket->so_type) { 763 764 case SOCK_DGRAM: 765 LIST_REMOVE(unp, unp_reflink); 766 unp->unp_socket->so_state &= ~SS_ISCONNECTED; 767 break; 768 769 case SOCK_STREAM: 770 soisdisconnected(unp->unp_socket); 771 unp2->unp_conn = 0; 772 soisdisconnected(unp2->unp_socket); 773 break; 774 } 775 } 776 777 #ifdef notdef 778 void 779 unp_abort(unp) 780 struct unpcb *unp; 781 { 782 783 unp_detach(unp); 784 } 785 #endif 786 787 static int 788 prison_unpcb(struct thread *td, struct unpcb *unp) 789 { 790 struct proc *p; 791 792 if (td == NULL) 793 return (0); 794 if ((p = td->td_proc) == NULL) 795 return (0); 796 if (!p->p_ucred->cr_prison) 797 return (0); 798 if (p->p_fd->fd_rdir == unp->unp_rvnode) 799 return (0); 800 return (1); 801 } 802 803 static int 804 unp_pcblist(SYSCTL_HANDLER_ARGS) 805 { 806 int error, i, n; 807 struct unpcb *unp, **unp_list; 808 unp_gen_t gencnt; 809 struct xunpgen xug; 810 struct unp_head *head; 811 812 head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead); 813 814 KKASSERT(curproc != NULL); 815 816 /* 817 * The process of preparing the PCB list is too time-consuming and 818 * resource-intensive to repeat twice on every request. 819 */ 820 if (req->oldptr == 0) { 821 n = unp_count; 822 req->oldidx = 2 * (sizeof xug) 823 + (n + n/8) * sizeof(struct xunpcb); 824 return 0; 825 } 826 827 if (req->newptr != 0) 828 return EPERM; 829 830 /* 831 * OK, now we're committed to doing something. 832 */ 833 gencnt = unp_gencnt; 834 n = unp_count; 835 836 xug.xug_len = sizeof xug; 837 xug.xug_count = n; 838 xug.xug_gen = gencnt; 839 xug.xug_sogen = so_gencnt; 840 error = SYSCTL_OUT(req, &xug, sizeof xug); 841 if (error) 842 return error; 843 844 unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK); 845 if (unp_list == 0) 846 return ENOMEM; 847 848 for (unp = LIST_FIRST(head), i = 0; unp && i < n; 849 unp = LIST_NEXT(unp, unp_link)) { 850 if (unp->unp_gencnt <= gencnt && !prison_unpcb(req->td, unp)) 851 unp_list[i++] = unp; 852 } 853 n = i; /* in case we lost some during malloc */ 854 855 error = 0; 856 for (i = 0; i < n; i++) { 857 unp = unp_list[i]; 858 if (unp->unp_gencnt <= gencnt) { 859 struct xunpcb xu; 860 xu.xu_len = sizeof xu; 861 xu.xu_unpp = unp; 862 /* 863 * XXX - need more locking here to protect against 864 * connect/disconnect races for SMP. 865 */ 866 if (unp->unp_addr) 867 bcopy(unp->unp_addr, &xu.xu_addr, 868 unp->unp_addr->sun_len); 869 if (unp->unp_conn && unp->unp_conn->unp_addr) 870 bcopy(unp->unp_conn->unp_addr, 871 &xu.xu_caddr, 872 unp->unp_conn->unp_addr->sun_len); 873 bcopy(unp, &xu.xu_unp, sizeof *unp); 874 sotoxsocket(unp->unp_socket, &xu.xu_socket); 875 error = SYSCTL_OUT(req, &xu, sizeof xu); 876 } 877 } 878 if (!error) { 879 /* 880 * Give the user an updated idea of our state. 881 * If the generation differs from what we told 882 * her before, she knows that something happened 883 * while we were processing this request, and it 884 * might be necessary to retry. 885 */ 886 xug.xug_gen = unp_gencnt; 887 xug.xug_sogen = so_gencnt; 888 xug.xug_count = unp_count; 889 error = SYSCTL_OUT(req, &xug, sizeof xug); 890 } 891 free(unp_list, M_TEMP); 892 return error; 893 } 894 895 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLFLAG_RD, 896 (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb", 897 "List of active local datagram sockets"); 898 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLFLAG_RD, 899 (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb", 900 "List of active local stream sockets"); 901 902 static void 903 unp_shutdown(unp) 904 struct unpcb *unp; 905 { 906 struct socket *so; 907 908 if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn && 909 (so = unp->unp_conn->unp_socket)) 910 socantrcvmore(so); 911 } 912 913 static void 914 unp_drop(unp, errno) 915 struct unpcb *unp; 916 int errno; 917 { 918 struct socket *so = unp->unp_socket; 919 920 so->so_error = errno; 921 unp_disconnect(unp); 922 } 923 924 #ifdef notdef 925 void 926 unp_drain() 927 { 928 929 } 930 #endif 931 932 int 933 unp_externalize(struct mbuf *rights) 934 { 935 struct proc *p = curproc; /* XXX */ 936 int i; 937 struct cmsghdr *cm = mtod(rights, struct cmsghdr *); 938 int *fdp; 939 struct file **rp; 940 struct file *fp; 941 int newfds = (cm->cmsg_len - (CMSG_DATA(cm) - (u_char *)cm)) 942 / sizeof (struct file *); 943 int f; 944 945 /* 946 * if the new FD's will not fit, then we free them all 947 */ 948 if (!fdavail(p, newfds)) { 949 rp = (struct file **)CMSG_DATA(cm); 950 for (i = 0; i < newfds; i++) { 951 fp = *rp; 952 /* 953 * zero the pointer before calling unp_discard, 954 * since it may end up in unp_gc().. 955 */ 956 *rp++ = 0; 957 unp_discard(fp); 958 } 959 return (EMSGSIZE); 960 } 961 /* 962 * now change each pointer to an fd in the global table to 963 * an integer that is the index to the local fd table entry 964 * that we set up to point to the global one we are transferring. 965 * If sizeof (struct file *) is bigger than or equal to sizeof int, 966 * then do it in forward order. In that case, an integer will 967 * always come in the same place or before its corresponding 968 * struct file pointer. 969 * If sizeof (struct file *) is smaller than sizeof int, then 970 * do it in reverse order. 971 */ 972 if (sizeof (struct file *) >= sizeof (int)) { 973 fdp = (int *)(cm + 1); 974 rp = (struct file **)CMSG_DATA(cm); 975 for (i = 0; i < newfds; i++) { 976 if (fdalloc(p, 0, &f)) 977 panic("unp_externalize"); 978 fp = *rp++; 979 p->p_fd->fd_ofiles[f] = fp; 980 fp->f_msgcount--; 981 unp_rights--; 982 *fdp++ = f; 983 } 984 } else { 985 fdp = (int *)(cm + 1) + newfds - 1; 986 rp = (struct file **)CMSG_DATA(cm) + newfds - 1; 987 for (i = 0; i < newfds; i++) { 988 if (fdalloc(p, 0, &f)) 989 panic("unp_externalize"); 990 fp = *rp--; 991 p->p_fd->fd_ofiles[f] = fp; 992 fp->f_msgcount--; 993 unp_rights--; 994 *fdp-- = f; 995 } 996 } 997 998 /* 999 * Adjust length, in case sizeof(struct file *) and sizeof(int) 1000 * differs. 1001 */ 1002 cm->cmsg_len = CMSG_LEN(newfds * sizeof(int)); 1003 rights->m_len = cm->cmsg_len; 1004 return (0); 1005 } 1006 1007 void 1008 unp_init(void) 1009 { 1010 unp_zone = zinit("unpcb", sizeof(struct unpcb), nmbclusters, 0, 0); 1011 if (unp_zone == 0) 1012 panic("unp_init"); 1013 LIST_INIT(&unp_dhead); 1014 LIST_INIT(&unp_shead); 1015 } 1016 1017 static int 1018 unp_internalize(struct mbuf *control, struct thread *td) 1019 { 1020 struct proc *p = td->td_proc; 1021 struct filedesc *fdescp; 1022 struct cmsghdr *cm = mtod(control, struct cmsghdr *); 1023 struct file **rp; 1024 struct file *fp; 1025 int i, fd, *fdp; 1026 struct cmsgcred *cmcred; 1027 int oldfds; 1028 u_int newlen; 1029 1030 KKASSERT(p); 1031 fdescp = p->p_fd; 1032 if ((cm->cmsg_type != SCM_RIGHTS && cm->cmsg_type != SCM_CREDS) || 1033 cm->cmsg_level != SOL_SOCKET || cm->cmsg_len != control->m_len) 1034 return (EINVAL); 1035 1036 /* 1037 * Fill in credential information. 1038 */ 1039 if (cm->cmsg_type == SCM_CREDS) { 1040 cmcred = (struct cmsgcred *)(cm + 1); 1041 cmcred->cmcred_pid = p->p_pid; 1042 cmcred->cmcred_uid = p->p_ucred->cr_ruid; 1043 cmcred->cmcred_gid = p->p_ucred->cr_rgid; 1044 cmcred->cmcred_euid = p->p_ucred->cr_uid; 1045 cmcred->cmcred_ngroups = MIN(p->p_ucred->cr_ngroups, 1046 CMGROUP_MAX); 1047 for (i = 0; i < cmcred->cmcred_ngroups; i++) 1048 cmcred->cmcred_groups[i] = p->p_ucred->cr_groups[i]; 1049 return(0); 1050 } 1051 1052 oldfds = (cm->cmsg_len - sizeof (*cm)) / sizeof (int); 1053 /* 1054 * check that all the FDs passed in refer to legal OPEN files 1055 * If not, reject the entire operation. 1056 */ 1057 fdp = (int *)(cm + 1); 1058 for (i = 0; i < oldfds; i++) { 1059 fd = *fdp++; 1060 if ((unsigned)fd >= fdescp->fd_nfiles || 1061 fdescp->fd_ofiles[fd] == NULL) 1062 return (EBADF); 1063 if (fdescp->fd_ofiles[fd]->f_type == DTYPE_KQUEUE) 1064 return (EOPNOTSUPP); 1065 } 1066 /* 1067 * Now replace the integer FDs with pointers to 1068 * the associated global file table entry.. 1069 * Allocate a bigger buffer as necessary. But if an cluster is not 1070 * enough, return E2BIG. 1071 */ 1072 newlen = CMSG_LEN(oldfds * sizeof(struct file *)); 1073 if (newlen > MCLBYTES) 1074 return (E2BIG); 1075 if (newlen - control->m_len > M_TRAILINGSPACE(control)) { 1076 if (control->m_flags & M_EXT) 1077 return (E2BIG); 1078 MCLGET(control, M_WAIT); 1079 if ((control->m_flags & M_EXT) == 0) 1080 return (ENOBUFS); 1081 1082 /* copy the data to the cluster */ 1083 memcpy(mtod(control, char *), cm, cm->cmsg_len); 1084 cm = mtod(control, struct cmsghdr *); 1085 } 1086 1087 /* 1088 * Adjust length, in case sizeof(struct file *) and sizeof(int) 1089 * differs. 1090 */ 1091 control->m_len = cm->cmsg_len = newlen; 1092 1093 /* 1094 * Transform the file descriptors into struct file pointers. 1095 * If sizeof (struct file *) is bigger than or equal to sizeof int, 1096 * then do it in reverse order so that the int won't get until 1097 * we're done. 1098 * If sizeof (struct file *) is smaller than sizeof int, then 1099 * do it in forward order. 1100 */ 1101 if (sizeof (struct file *) >= sizeof (int)) { 1102 fdp = (int *)(cm + 1) + oldfds - 1; 1103 rp = (struct file **)CMSG_DATA(cm) + oldfds - 1; 1104 for (i = 0; i < oldfds; i++) { 1105 fp = fdescp->fd_ofiles[*fdp--]; 1106 *rp-- = fp; 1107 fp->f_count++; 1108 fp->f_msgcount++; 1109 unp_rights++; 1110 } 1111 } else { 1112 fdp = (int *)(cm + 1); 1113 rp = (struct file **)CMSG_DATA(cm); 1114 for (i = 0; i < oldfds; i++) { 1115 fp = fdescp->fd_ofiles[*fdp++]; 1116 *rp++ = fp; 1117 fp->f_count++; 1118 fp->f_msgcount++; 1119 unp_rights++; 1120 } 1121 } 1122 return (0); 1123 } 1124 1125 static int unp_defer, unp_gcing; 1126 1127 static void 1128 unp_gc() 1129 { 1130 struct file *fp, *nextfp; 1131 struct socket *so; 1132 struct file **extra_ref, **fpp; 1133 int nunref, i; 1134 1135 if (unp_gcing) 1136 return; 1137 unp_gcing = 1; 1138 unp_defer = 0; 1139 /* 1140 * before going through all this, set all FDs to 1141 * be NOT defered and NOT externally accessible 1142 */ 1143 LIST_FOREACH(fp, &filehead, f_list) 1144 fp->f_flag &= ~(FMARK|FDEFER); 1145 do { 1146 LIST_FOREACH(fp, &filehead, f_list) { 1147 /* 1148 * If the file is not open, skip it 1149 */ 1150 if (fp->f_count == 0) 1151 continue; 1152 /* 1153 * If we already marked it as 'defer' in a 1154 * previous pass, then try process it this time 1155 * and un-mark it 1156 */ 1157 if (fp->f_flag & FDEFER) { 1158 fp->f_flag &= ~FDEFER; 1159 unp_defer--; 1160 } else { 1161 /* 1162 * if it's not defered, then check if it's 1163 * already marked.. if so skip it 1164 */ 1165 if (fp->f_flag & FMARK) 1166 continue; 1167 /* 1168 * If all references are from messages 1169 * in transit, then skip it. it's not 1170 * externally accessible. 1171 */ 1172 if (fp->f_count == fp->f_msgcount) 1173 continue; 1174 /* 1175 * If it got this far then it must be 1176 * externally accessible. 1177 */ 1178 fp->f_flag |= FMARK; 1179 } 1180 /* 1181 * either it was defered, or it is externally 1182 * accessible and not already marked so. 1183 * Now check if it is possibly one of OUR sockets. 1184 */ 1185 if (fp->f_type != DTYPE_SOCKET || 1186 (so = (struct socket *)fp->f_data) == 0) 1187 continue; 1188 if (so->so_proto->pr_domain != &localdomain || 1189 (so->so_proto->pr_flags&PR_RIGHTS) == 0) 1190 continue; 1191 #ifdef notdef 1192 if (so->so_rcv.sb_flags & SB_LOCK) { 1193 /* 1194 * This is problematical; it's not clear 1195 * we need to wait for the sockbuf to be 1196 * unlocked (on a uniprocessor, at least), 1197 * and it's also not clear what to do 1198 * if sbwait returns an error due to receipt 1199 * of a signal. If sbwait does return 1200 * an error, we'll go into an infinite 1201 * loop. Delete all of this for now. 1202 */ 1203 (void) sbwait(&so->so_rcv); 1204 goto restart; 1205 } 1206 #endif 1207 /* 1208 * So, Ok, it's one of our sockets and it IS externally 1209 * accessible (or was defered). Now we look 1210 * to see if we hold any file descriptors in its 1211 * message buffers. Follow those links and mark them 1212 * as accessible too. 1213 */ 1214 unp_scan(so->so_rcv.sb_mb, unp_mark); 1215 } 1216 } while (unp_defer); 1217 /* 1218 * We grab an extra reference to each of the file table entries 1219 * that are not otherwise accessible and then free the rights 1220 * that are stored in messages on them. 1221 * 1222 * The bug in the orginal code is a little tricky, so I'll describe 1223 * what's wrong with it here. 1224 * 1225 * It is incorrect to simply unp_discard each entry for f_msgcount 1226 * times -- consider the case of sockets A and B that contain 1227 * references to each other. On a last close of some other socket, 1228 * we trigger a gc since the number of outstanding rights (unp_rights) 1229 * is non-zero. If during the sweep phase the gc code un_discards, 1230 * we end up doing a (full) closef on the descriptor. A closef on A 1231 * results in the following chain. Closef calls soo_close, which 1232 * calls soclose. Soclose calls first (through the switch 1233 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply 1234 * returns because the previous instance had set unp_gcing, and 1235 * we return all the way back to soclose, which marks the socket 1236 * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush 1237 * to free up the rights that are queued in messages on the socket A, 1238 * i.e., the reference on B. The sorflush calls via the dom_dispose 1239 * switch unp_dispose, which unp_scans with unp_discard. This second 1240 * instance of unp_discard just calls closef on B. 1241 * 1242 * Well, a similar chain occurs on B, resulting in a sorflush on B, 1243 * which results in another closef on A. Unfortunately, A is already 1244 * being closed, and the descriptor has already been marked with 1245 * SS_NOFDREF, and soclose panics at this point. 1246 * 1247 * Here, we first take an extra reference to each inaccessible 1248 * descriptor. Then, we call sorflush ourself, since we know 1249 * it is a Unix domain socket anyhow. After we destroy all the 1250 * rights carried in messages, we do a last closef to get rid 1251 * of our extra reference. This is the last close, and the 1252 * unp_detach etc will shut down the socket. 1253 * 1254 * 91/09/19, bsy@cs.cmu.edu 1255 */ 1256 extra_ref = malloc(nfiles * sizeof(struct file *), M_FILE, M_WAITOK); 1257 for (nunref = 0, fp = LIST_FIRST(&filehead), fpp = extra_ref; fp != 0; 1258 fp = nextfp) { 1259 nextfp = LIST_NEXT(fp, f_list); 1260 /* 1261 * If it's not open, skip it 1262 */ 1263 if (fp->f_count == 0) 1264 continue; 1265 /* 1266 * If all refs are from msgs, and it's not marked accessible 1267 * then it must be referenced from some unreachable cycle 1268 * of (shut-down) FDs, so include it in our 1269 * list of FDs to remove 1270 */ 1271 if (fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) { 1272 *fpp++ = fp; 1273 nunref++; 1274 fp->f_count++; 1275 } 1276 } 1277 /* 1278 * for each FD on our hit list, do the following two things 1279 */ 1280 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) { 1281 struct file *tfp = *fpp; 1282 if (tfp->f_type == DTYPE_SOCKET && tfp->f_data != NULL) 1283 sorflush((struct socket *)(tfp->f_data)); 1284 } 1285 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) 1286 closef(*fpp, NULL); 1287 free((caddr_t)extra_ref, M_FILE); 1288 unp_gcing = 0; 1289 } 1290 1291 void 1292 unp_dispose(struct mbuf *m) 1293 { 1294 if (m) 1295 unp_scan(m, unp_discard); 1296 } 1297 1298 static int 1299 unp_listen(struct unpcb *unp, struct thread *td) 1300 { 1301 struct proc *p = td->td_proc; 1302 1303 KKASSERT(p); 1304 cru2x(p->p_ucred, &unp->unp_peercred); 1305 unp->unp_flags |= UNP_HAVEPCCACHED; 1306 return (0); 1307 } 1308 1309 static void 1310 unp_scan(m0, op) 1311 struct mbuf *m0; 1312 void (*op) (struct file *); 1313 { 1314 struct mbuf *m; 1315 struct file **rp; 1316 struct cmsghdr *cm; 1317 int i; 1318 int qfds; 1319 1320 while (m0) { 1321 for (m = m0; m; m = m->m_next) 1322 if (m->m_type == MT_CONTROL && 1323 m->m_len >= sizeof(*cm)) { 1324 cm = mtod(m, struct cmsghdr *); 1325 if (cm->cmsg_level != SOL_SOCKET || 1326 cm->cmsg_type != SCM_RIGHTS) 1327 continue; 1328 qfds = (cm->cmsg_len - 1329 (CMSG_DATA(cm) - (u_char *)cm)) 1330 / sizeof (struct file *); 1331 rp = (struct file **)CMSG_DATA(cm); 1332 for (i = 0; i < qfds; i++) 1333 (*op)(*rp++); 1334 break; /* XXX, but saves time */ 1335 } 1336 m0 = m0->m_act; 1337 } 1338 } 1339 1340 static void 1341 unp_mark(fp) 1342 struct file *fp; 1343 { 1344 1345 if (fp->f_flag & FMARK) 1346 return; 1347 unp_defer++; 1348 fp->f_flag |= (FMARK|FDEFER); 1349 } 1350 1351 static void 1352 unp_discard(fp) 1353 struct file *fp; 1354 { 1355 1356 fp->f_msgcount--; 1357 unp_rights--; 1358 (void) closef(fp, NULL); 1359 } 1360