1 /* 2 * Copyright (c) 1982, 1986, 1989, 1991, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94 34 * $FreeBSD: src/sys/kern/uipc_usrreq.c,v 1.54.2.10 2003/03/04 17:28:09 nectar Exp $ 35 * $DragonFly: src/sys/kern/uipc_usrreq.c,v 1.22 2005/06/22 01:33:21 dillon Exp $ 36 */ 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/kernel.h> 41 #include <sys/domain.h> 42 #include <sys/fcntl.h> 43 #include <sys/malloc.h> /* XXX must be before <sys/file.h> */ 44 #include <sys/proc.h> 45 #include <sys/file.h> 46 #include <sys/filedesc.h> 47 #include <sys/mbuf.h> 48 #include <sys/nlookup.h> 49 #include <sys/protosw.h> 50 #include <sys/socket.h> 51 #include <sys/socketvar.h> 52 #include <sys/resourcevar.h> 53 #include <sys/stat.h> 54 #include <sys/mount.h> 55 #include <sys/sysctl.h> 56 #include <sys/un.h> 57 #include <sys/unpcb.h> 58 #include <sys/vnode.h> 59 #include <sys/file2.h> 60 61 #include <vm/vm_zone.h> 62 63 static struct vm_zone *unp_zone; 64 static unp_gen_t unp_gencnt; 65 static u_int unp_count; 66 67 static struct unp_head unp_shead, unp_dhead; 68 69 /* 70 * Unix communications domain. 71 * 72 * TODO: 73 * SEQPACKET, RDM 74 * rethink name space problems 75 * need a proper out-of-band 76 * lock pushdown 77 */ 78 static struct sockaddr sun_noname = { sizeof(sun_noname), AF_LOCAL }; 79 static ino_t unp_ino; /* prototype for fake inode numbers */ 80 81 static int unp_attach (struct socket *, struct pru_attach_info *); 82 static void unp_detach (struct unpcb *); 83 static int unp_bind (struct unpcb *,struct sockaddr *, struct thread *); 84 static int unp_connect (struct socket *,struct sockaddr *, 85 struct thread *); 86 static void unp_disconnect (struct unpcb *); 87 static void unp_shutdown (struct unpcb *); 88 static void unp_drop (struct unpcb *, int); 89 static void unp_gc (void); 90 static void unp_scan (struct mbuf *, void (*)(struct file *)); 91 static void unp_mark (struct file *); 92 static void unp_discard (struct file *); 93 static int unp_internalize (struct mbuf *, struct thread *); 94 static int unp_listen (struct unpcb *, struct thread *); 95 96 static int 97 uipc_abort(struct socket *so) 98 { 99 struct unpcb *unp = so->so_pcb; 100 101 if (unp == NULL) 102 return EINVAL; 103 unp_drop(unp, ECONNABORTED); 104 unp_detach(unp); 105 sofree(so); 106 return 0; 107 } 108 109 static int 110 uipc_accept(struct socket *so, struct sockaddr **nam) 111 { 112 struct unpcb *unp = so->so_pcb; 113 114 if (unp == NULL) 115 return EINVAL; 116 117 /* 118 * Pass back name of connected socket, 119 * if it was bound and we are still connected 120 * (our peer may have closed already!). 121 */ 122 if (unp->unp_conn && unp->unp_conn->unp_addr) { 123 *nam = dup_sockaddr((struct sockaddr *)unp->unp_conn->unp_addr); 124 } else { 125 *nam = dup_sockaddr((struct sockaddr *)&sun_noname); 126 } 127 return 0; 128 } 129 130 static int 131 uipc_attach(struct socket *so, int proto, struct pru_attach_info *ai) 132 { 133 struct unpcb *unp = so->so_pcb; 134 135 if (unp != NULL) 136 return EISCONN; 137 return unp_attach(so, ai); 138 } 139 140 static int 141 uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td) 142 { 143 struct unpcb *unp = so->so_pcb; 144 145 if (unp == NULL) 146 return EINVAL; 147 return unp_bind(unp, nam, td); 148 } 149 150 static int 151 uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 152 { 153 struct unpcb *unp = so->so_pcb; 154 155 if (unp == NULL) 156 return EINVAL; 157 return unp_connect(so, nam, td); 158 } 159 160 static int 161 uipc_connect2(struct socket *so1, struct socket *so2) 162 { 163 struct unpcb *unp = so1->so_pcb; 164 165 if (unp == NULL) 166 return EINVAL; 167 168 return unp_connect2(so1, so2); 169 } 170 171 /* control is EOPNOTSUPP */ 172 173 static int 174 uipc_detach(struct socket *so) 175 { 176 struct unpcb *unp = so->so_pcb; 177 178 if (unp == NULL) 179 return EINVAL; 180 181 unp_detach(unp); 182 return 0; 183 } 184 185 static int 186 uipc_disconnect(struct socket *so) 187 { 188 struct unpcb *unp = so->so_pcb; 189 190 if (unp == NULL) 191 return EINVAL; 192 unp_disconnect(unp); 193 return 0; 194 } 195 196 static int 197 uipc_listen(struct socket *so, struct thread *td) 198 { 199 struct unpcb *unp = so->so_pcb; 200 201 if (unp == NULL || unp->unp_vnode == NULL) 202 return EINVAL; 203 return unp_listen(unp, td); 204 } 205 206 static int 207 uipc_peeraddr(struct socket *so, struct sockaddr **nam) 208 { 209 struct unpcb *unp = so->so_pcb; 210 211 if (unp == NULL) 212 return EINVAL; 213 if (unp->unp_conn && unp->unp_conn->unp_addr) 214 *nam = dup_sockaddr((struct sockaddr *)unp->unp_conn->unp_addr); 215 else { 216 /* 217 * XXX: It seems that this test always fails even when 218 * connection is established. So, this else clause is 219 * added as workaround to return PF_LOCAL sockaddr. 220 */ 221 *nam = dup_sockaddr((struct sockaddr *)&sun_noname); 222 } 223 return 0; 224 } 225 226 static int 227 uipc_rcvd(struct socket *so, int flags) 228 { 229 struct unpcb *unp = so->so_pcb; 230 struct socket *so2; 231 u_long newhiwat; 232 233 if (unp == NULL) 234 return EINVAL; 235 switch (so->so_type) { 236 case SOCK_DGRAM: 237 panic("uipc_rcvd DGRAM?"); 238 /*NOTREACHED*/ 239 240 case SOCK_STREAM: 241 if (unp->unp_conn == NULL) 242 break; 243 so2 = unp->unp_conn->unp_socket; 244 /* 245 * Adjust backpressure on sender 246 * and wakeup any waiting to write. 247 */ 248 so2->so_snd.sb_mbmax += unp->unp_mbcnt - so->so_rcv.sb_mbcnt; 249 unp->unp_mbcnt = so->so_rcv.sb_mbcnt; 250 newhiwat = 251 so2->so_snd.sb_hiwat + unp->unp_cc - so->so_rcv.sb_cc; 252 chgsbsize(so2->so_cred->cr_uidinfo, &so2->so_snd.sb_hiwat, 253 newhiwat, RLIM_INFINITY); 254 unp->unp_cc = so->so_rcv.sb_cc; 255 sowwakeup(so2); 256 break; 257 258 default: 259 panic("uipc_rcvd unknown socktype"); 260 } 261 return 0; 262 } 263 264 /* pru_rcvoob is EOPNOTSUPP */ 265 266 static int 267 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, 268 struct mbuf *control, struct thread *td) 269 { 270 int error = 0; 271 struct unpcb *unp = so->so_pcb; 272 struct socket *so2; 273 u_long newhiwat; 274 275 if (unp == NULL) { 276 error = EINVAL; 277 goto release; 278 } 279 if (flags & PRUS_OOB) { 280 error = EOPNOTSUPP; 281 goto release; 282 } 283 284 if (control && (error = unp_internalize(control, td))) 285 goto release; 286 287 switch (so->so_type) { 288 case SOCK_DGRAM: 289 { 290 struct sockaddr *from; 291 292 if (nam) { 293 if (unp->unp_conn) { 294 error = EISCONN; 295 break; 296 } 297 error = unp_connect(so, nam, td); 298 if (error) 299 break; 300 } else { 301 if (unp->unp_conn == NULL) { 302 error = ENOTCONN; 303 break; 304 } 305 } 306 so2 = unp->unp_conn->unp_socket; 307 if (unp->unp_addr) 308 from = (struct sockaddr *)unp->unp_addr; 309 else 310 from = &sun_noname; 311 if (sbappendaddr(&so2->so_rcv, from, m, control)) { 312 sorwakeup(so2); 313 m = NULL; 314 control = NULL; 315 } else 316 error = ENOBUFS; 317 if (nam) 318 unp_disconnect(unp); 319 break; 320 } 321 322 case SOCK_STREAM: 323 /* Connect if not connected yet. */ 324 /* 325 * Note: A better implementation would complain 326 * if not equal to the peer's address. 327 */ 328 if (!(so->so_state & SS_ISCONNECTED)) { 329 if (nam) { 330 error = unp_connect(so, nam, td); 331 if (error) 332 break; /* XXX */ 333 } else { 334 error = ENOTCONN; 335 break; 336 } 337 } 338 339 if (so->so_state & SS_CANTSENDMORE) { 340 error = EPIPE; 341 break; 342 } 343 if (unp->unp_conn == NULL) 344 panic("uipc_send connected but no connection?"); 345 so2 = unp->unp_conn->unp_socket; 346 /* 347 * Send to paired receive port, and then reduce 348 * send buffer hiwater marks to maintain backpressure. 349 * Wake up readers. 350 */ 351 if (control) { 352 if (sbappendcontrol(&so2->so_rcv, m, control)) 353 control = NULL; 354 } else 355 sbappend(&so2->so_rcv, m); 356 so->so_snd.sb_mbmax -= 357 so2->so_rcv.sb_mbcnt - unp->unp_conn->unp_mbcnt; 358 unp->unp_conn->unp_mbcnt = so2->so_rcv.sb_mbcnt; 359 newhiwat = so->so_snd.sb_hiwat - 360 (so2->so_rcv.sb_cc - unp->unp_conn->unp_cc); 361 chgsbsize(so->so_cred->cr_uidinfo, &so->so_snd.sb_hiwat, 362 newhiwat, RLIM_INFINITY); 363 unp->unp_conn->unp_cc = so2->so_rcv.sb_cc; 364 sorwakeup(so2); 365 m = NULL; 366 break; 367 368 default: 369 panic("uipc_send unknown socktype"); 370 } 371 372 /* 373 * SEND_EOF is equivalent to a SEND followed by a SHUTDOWN. 374 */ 375 if (flags & PRUS_EOF) { 376 socantsendmore(so); 377 unp_shutdown(unp); 378 } 379 380 if (control && error != 0) 381 unp_dispose(control); 382 383 release: 384 if (control) 385 m_freem(control); 386 if (m) 387 m_freem(m); 388 return error; 389 } 390 391 static int 392 uipc_sense(struct socket *so, struct stat *sb) 393 { 394 struct unpcb *unp = so->so_pcb; 395 struct socket *so2; 396 397 if (unp == NULL) 398 return EINVAL; 399 sb->st_blksize = so->so_snd.sb_hiwat; 400 if (so->so_type == SOCK_STREAM && unp->unp_conn != NULL) { 401 so2 = unp->unp_conn->unp_socket; 402 sb->st_blksize += so2->so_rcv.sb_cc; 403 } 404 sb->st_dev = NOUDEV; 405 if (unp->unp_ino == 0) /* make up a non-zero inode number */ 406 unp->unp_ino = (++unp_ino == 0) ? ++unp_ino : unp_ino; 407 sb->st_ino = unp->unp_ino; 408 return (0); 409 } 410 411 static int 412 uipc_shutdown(struct socket *so) 413 { 414 struct unpcb *unp = so->so_pcb; 415 416 if (unp == NULL) 417 return EINVAL; 418 socantsendmore(so); 419 unp_shutdown(unp); 420 return 0; 421 } 422 423 static int 424 uipc_sockaddr(struct socket *so, struct sockaddr **nam) 425 { 426 struct unpcb *unp = so->so_pcb; 427 428 if (unp == NULL) 429 return EINVAL; 430 if (unp->unp_addr) 431 *nam = dup_sockaddr((struct sockaddr *)unp->unp_addr); 432 return 0; 433 } 434 435 struct pr_usrreqs uipc_usrreqs = { 436 uipc_abort, uipc_accept, uipc_attach, uipc_bind, uipc_connect, 437 uipc_connect2, pru_control_notsupp, uipc_detach, uipc_disconnect, 438 uipc_listen, uipc_peeraddr, uipc_rcvd, pru_rcvoob_notsupp, 439 uipc_send, uipc_sense, uipc_shutdown, uipc_sockaddr, 440 sosend, soreceive, sopoll 441 }; 442 443 int 444 uipc_ctloutput(struct socket *so, struct sockopt *sopt) 445 { 446 struct unpcb *unp = so->so_pcb; 447 int error; 448 449 switch (sopt->sopt_dir) { 450 case SOPT_GET: 451 switch (sopt->sopt_name) { 452 case LOCAL_PEERCRED: 453 if (unp->unp_flags & UNP_HAVEPC) 454 error = sooptcopyout(sopt, &unp->unp_peercred, 455 sizeof(unp->unp_peercred)); 456 else { 457 if (so->so_type == SOCK_STREAM) 458 error = ENOTCONN; 459 else 460 error = EINVAL; 461 } 462 break; 463 default: 464 error = EOPNOTSUPP; 465 break; 466 } 467 break; 468 case SOPT_SET: 469 default: 470 error = EOPNOTSUPP; 471 break; 472 } 473 return (error); 474 } 475 476 /* 477 * Both send and receive buffers are allocated PIPSIZ bytes of buffering 478 * for stream sockets, although the total for sender and receiver is 479 * actually only PIPSIZ. 480 * Datagram sockets really use the sendspace as the maximum datagram size, 481 * and don't really want to reserve the sendspace. Their recvspace should 482 * be large enough for at least one max-size datagram plus address. 483 */ 484 #ifndef PIPSIZ 485 #define PIPSIZ 8192 486 #endif 487 static u_long unpst_sendspace = PIPSIZ; 488 static u_long unpst_recvspace = PIPSIZ; 489 static u_long unpdg_sendspace = 2*1024; /* really max datagram size */ 490 static u_long unpdg_recvspace = 4*1024; 491 492 static int unp_rights; /* file descriptors in flight */ 493 494 SYSCTL_DECL(_net_local_stream); 495 SYSCTL_INT(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW, 496 &unpst_sendspace, 0, ""); 497 SYSCTL_INT(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW, 498 &unpst_recvspace, 0, ""); 499 500 SYSCTL_DECL(_net_local_dgram); 501 SYSCTL_INT(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW, 502 &unpdg_sendspace, 0, ""); 503 SYSCTL_INT(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW, 504 &unpdg_recvspace, 0, ""); 505 506 SYSCTL_DECL(_net_local); 507 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0, ""); 508 509 static int 510 unp_attach(struct socket *so, struct pru_attach_info *ai) 511 { 512 struct unpcb *unp; 513 int error; 514 515 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) { 516 switch (so->so_type) { 517 518 case SOCK_STREAM: 519 error = soreserve(so, unpst_sendspace, unpst_recvspace, 520 ai->sb_rlimit); 521 break; 522 523 case SOCK_DGRAM: 524 error = soreserve(so, unpdg_sendspace, unpdg_recvspace, 525 ai->sb_rlimit); 526 break; 527 528 default: 529 panic("unp_attach"); 530 } 531 if (error) 532 return (error); 533 } 534 unp = zalloc(unp_zone); 535 if (unp == NULL) 536 return (ENOBUFS); 537 bzero(unp, sizeof *unp); 538 unp->unp_gencnt = ++unp_gencnt; 539 unp_count++; 540 LIST_INIT(&unp->unp_refs); 541 unp->unp_socket = so; 542 unp->unp_rvnode = ai->fd_rdir; /* jail cruft XXX JH */ 543 LIST_INSERT_HEAD(so->so_type == SOCK_DGRAM ? &unp_dhead 544 : &unp_shead, unp, unp_link); 545 so->so_pcb = (caddr_t)unp; 546 return (0); 547 } 548 549 static void 550 unp_detach(struct unpcb *unp) 551 { 552 LIST_REMOVE(unp, unp_link); 553 unp->unp_gencnt = ++unp_gencnt; 554 --unp_count; 555 if (unp->unp_vnode) { 556 unp->unp_vnode->v_socket = NULL; 557 vrele(unp->unp_vnode); 558 unp->unp_vnode = NULL; 559 } 560 if (unp->unp_conn) 561 unp_disconnect(unp); 562 while (!LIST_EMPTY(&unp->unp_refs)) 563 unp_drop(LIST_FIRST(&unp->unp_refs), ECONNRESET); 564 soisdisconnected(unp->unp_socket); 565 unp->unp_socket->so_pcb = NULL; 566 if (unp_rights) { 567 /* 568 * Normally the receive buffer is flushed later, 569 * in sofree, but if our receive buffer holds references 570 * to descriptors that are now garbage, we will dispose 571 * of those descriptor references after the garbage collector 572 * gets them (resulting in a "panic: closef: count < 0"). 573 */ 574 sorflush(unp->unp_socket); 575 unp_gc(); 576 } 577 if (unp->unp_addr) 578 free(unp->unp_addr, M_SONAME); 579 zfree(unp_zone, unp); 580 } 581 582 static int 583 unp_bind(struct unpcb *unp, struct sockaddr *nam, struct thread *td) 584 { 585 struct proc *p = td->td_proc; 586 struct sockaddr_un *soun = (struct sockaddr_un *)nam; 587 struct vnode *vp; 588 struct vattr vattr; 589 int error, namelen; 590 struct nlookupdata nd; 591 char buf[SOCK_MAXADDRLEN]; 592 593 if (unp->unp_vnode != NULL) 594 return (EINVAL); 595 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path); 596 if (namelen <= 0) 597 return (EINVAL); 598 strncpy(buf, soun->sun_path, namelen); 599 buf[namelen] = 0; /* null-terminate the string */ 600 error = nlookup_init(&nd, buf, UIO_SYSSPACE, NLC_LOCKVP|NLC_CREATE); 601 if (error == 0) 602 error = nlookup(&nd); 603 if (error == 0 && nd.nl_ncp->nc_vp != NULL) 604 error = EADDRINUSE; 605 if (error) 606 goto done; 607 608 VATTR_NULL(&vattr); 609 vattr.va_type = VSOCK; 610 vattr.va_mode = (ACCESSPERMS & ~p->p_fd->fd_cmask); 611 error = VOP_NCREATE(nd.nl_ncp, &vp, nd.nl_cred, &vattr); 612 if (error == 0) { 613 vp->v_socket = unp->unp_socket; 614 unp->unp_vnode = vp; 615 unp->unp_addr = (struct sockaddr_un *)dup_sockaddr(nam); 616 VOP_UNLOCK(vp, 0, td); 617 } 618 done: 619 nlookup_done(&nd); 620 return (error); 621 } 622 623 static int 624 unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 625 { 626 struct proc *p = td->td_proc; 627 struct sockaddr_un *soun = (struct sockaddr_un *)nam; 628 struct vnode *vp; 629 struct socket *so2, *so3; 630 struct unpcb *unp, *unp2, *unp3; 631 int error, len; 632 struct nlookupdata nd; 633 char buf[SOCK_MAXADDRLEN]; 634 635 KKASSERT(p); 636 637 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path); 638 if (len <= 0) 639 return EINVAL; 640 strncpy(buf, soun->sun_path, len); 641 buf[len] = 0; 642 643 vp = NULL; 644 error = nlookup_init(&nd, buf, UIO_SYSSPACE, NLC_FOLLOW); 645 if (error == 0) 646 error = nlookup(&nd); 647 if (error == 0) 648 error = cache_vget(nd.nl_ncp, nd.nl_cred, LK_EXCLUSIVE, &vp); 649 nlookup_done(&nd); 650 if (error) 651 return (error); 652 653 if (vp->v_type != VSOCK) { 654 error = ENOTSOCK; 655 goto bad; 656 } 657 error = VOP_ACCESS(vp, VWRITE, p->p_ucred, td); 658 if (error) 659 goto bad; 660 so2 = vp->v_socket; 661 if (so2 == NULL) { 662 error = ECONNREFUSED; 663 goto bad; 664 } 665 if (so->so_type != so2->so_type) { 666 error = EPROTOTYPE; 667 goto bad; 668 } 669 if (so->so_proto->pr_flags & PR_CONNREQUIRED) { 670 if (!(so2->so_options & SO_ACCEPTCONN) || 671 (so3 = sonewconn(so2, 0)) == NULL) { 672 error = ECONNREFUSED; 673 goto bad; 674 } 675 unp = so->so_pcb; 676 unp2 = so2->so_pcb; 677 unp3 = so3->so_pcb; 678 if (unp2->unp_addr) 679 unp3->unp_addr = (struct sockaddr_un *) 680 dup_sockaddr((struct sockaddr *)unp2->unp_addr); 681 682 /* 683 * unp_peercred management: 684 * 685 * The connecter's (client's) credentials are copied 686 * from its process structure at the time of connect() 687 * (which is now). 688 */ 689 cru2x(p->p_ucred, &unp3->unp_peercred); 690 unp3->unp_flags |= UNP_HAVEPC; 691 /* 692 * The receiver's (server's) credentials are copied 693 * from the unp_peercred member of socket on which the 694 * former called listen(); unp_listen() cached that 695 * process's credentials at that time so we can use 696 * them now. 697 */ 698 KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED, 699 ("unp_connect: listener without cached peercred")); 700 memcpy(&unp->unp_peercred, &unp2->unp_peercred, 701 sizeof(unp->unp_peercred)); 702 unp->unp_flags |= UNP_HAVEPC; 703 704 so2 = so3; 705 } 706 error = unp_connect2(so, so2); 707 bad: 708 vput(vp); 709 return (error); 710 } 711 712 int 713 unp_connect2(struct socket *so, struct socket *so2) 714 { 715 struct unpcb *unp = so->so_pcb; 716 struct unpcb *unp2; 717 718 if (so2->so_type != so->so_type) 719 return (EPROTOTYPE); 720 unp2 = so2->so_pcb; 721 unp->unp_conn = unp2; 722 switch (so->so_type) { 723 724 case SOCK_DGRAM: 725 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink); 726 soisconnected(so); 727 break; 728 729 case SOCK_STREAM: 730 unp2->unp_conn = unp; 731 soisconnected(so); 732 soisconnected(so2); 733 break; 734 735 default: 736 panic("unp_connect2"); 737 } 738 return (0); 739 } 740 741 static void 742 unp_disconnect(struct unpcb *unp) 743 { 744 struct unpcb *unp2 = unp->unp_conn; 745 746 if (unp2 == NULL) 747 return; 748 749 unp->unp_conn = NULL; 750 751 switch (unp->unp_socket->so_type) { 752 case SOCK_DGRAM: 753 LIST_REMOVE(unp, unp_reflink); 754 unp->unp_socket->so_state &= ~SS_ISCONNECTED; 755 break; 756 case SOCK_STREAM: 757 soisdisconnected(unp->unp_socket); 758 unp2->unp_conn = NULL; 759 soisdisconnected(unp2->unp_socket); 760 break; 761 } 762 } 763 764 #ifdef notdef 765 void 766 unp_abort(struct unpcb *unp) 767 { 768 769 unp_detach(unp); 770 } 771 #endif 772 773 static int 774 prison_unpcb(struct thread *td, struct unpcb *unp) 775 { 776 struct proc *p; 777 778 if (td == NULL) 779 return (0); 780 if ((p = td->td_proc) == NULL) 781 return (0); 782 if (!p->p_ucred->cr_prison) 783 return (0); 784 if (p->p_fd->fd_rdir == unp->unp_rvnode) 785 return (0); 786 return (1); 787 } 788 789 static int 790 unp_pcblist(SYSCTL_HANDLER_ARGS) 791 { 792 int error, i, n; 793 struct unpcb *unp, **unp_list; 794 unp_gen_t gencnt; 795 struct unp_head *head; 796 797 head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead); 798 799 KKASSERT(curproc != NULL); 800 801 /* 802 * The process of preparing the PCB list is too time-consuming and 803 * resource-intensive to repeat twice on every request. 804 */ 805 if (req->oldptr == NULL) { 806 n = unp_count; 807 req->oldidx = (n + n/8) * sizeof(struct xunpcb); 808 return 0; 809 } 810 811 if (req->newptr != NULL) 812 return EPERM; 813 814 /* 815 * OK, now we're committed to doing something. 816 */ 817 gencnt = unp_gencnt; 818 n = unp_count; 819 820 unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK); 821 if (unp_list == NULL) 822 return ENOMEM; 823 824 for (unp = LIST_FIRST(head), i = 0; unp && i < n; 825 unp = LIST_NEXT(unp, unp_link)) { 826 if (unp->unp_gencnt <= gencnt && !prison_unpcb(req->td, unp)) 827 unp_list[i++] = unp; 828 } 829 n = i; /* in case we lost some during malloc */ 830 831 error = 0; 832 for (i = 0; i < n; i++) { 833 unp = unp_list[i]; 834 if (unp->unp_gencnt <= gencnt) { 835 struct xunpcb xu; 836 xu.xu_len = sizeof xu; 837 xu.xu_unpp = unp; 838 /* 839 * XXX - need more locking here to protect against 840 * connect/disconnect races for SMP. 841 */ 842 if (unp->unp_addr) 843 bcopy(unp->unp_addr, &xu.xu_addr, 844 unp->unp_addr->sun_len); 845 if (unp->unp_conn && unp->unp_conn->unp_addr) 846 bcopy(unp->unp_conn->unp_addr, 847 &xu.xu_caddr, 848 unp->unp_conn->unp_addr->sun_len); 849 bcopy(unp, &xu.xu_unp, sizeof *unp); 850 sotoxsocket(unp->unp_socket, &xu.xu_socket); 851 error = SYSCTL_OUT(req, &xu, sizeof xu); 852 } 853 } 854 free(unp_list, M_TEMP); 855 return error; 856 } 857 858 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLFLAG_RD, 859 (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb", 860 "List of active local datagram sockets"); 861 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLFLAG_RD, 862 (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb", 863 "List of active local stream sockets"); 864 865 static void 866 unp_shutdown(struct unpcb *unp) 867 { 868 struct socket *so; 869 870 if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn != NULL && 871 (so = unp->unp_conn->unp_socket)) 872 socantrcvmore(so); 873 } 874 875 static void 876 unp_drop(struct unpcb *unp, int errno) 877 { 878 struct socket *so = unp->unp_socket; 879 880 so->so_error = errno; 881 unp_disconnect(unp); 882 } 883 884 #ifdef notdef 885 void 886 unp_drain() 887 { 888 889 } 890 #endif 891 892 int 893 unp_externalize(struct mbuf *rights) 894 { 895 struct proc *p = curproc; /* XXX */ 896 int i; 897 struct cmsghdr *cm = mtod(rights, struct cmsghdr *); 898 int *fdp; 899 struct file **rp; 900 struct file *fp; 901 int newfds = (cm->cmsg_len - (CMSG_DATA(cm) - (u_char *)cm)) 902 / sizeof (struct file *); 903 int f; 904 905 /* 906 * if the new FD's will not fit, then we free them all 907 */ 908 if (!fdavail(p, newfds)) { 909 rp = (struct file **)CMSG_DATA(cm); 910 for (i = 0; i < newfds; i++) { 911 fp = *rp; 912 /* 913 * zero the pointer before calling unp_discard, 914 * since it may end up in unp_gc().. 915 */ 916 *rp++ = 0; 917 unp_discard(fp); 918 } 919 return (EMSGSIZE); 920 } 921 /* 922 * now change each pointer to an fd in the global table to 923 * an integer that is the index to the local fd table entry 924 * that we set up to point to the global one we are transferring. 925 * If sizeof (struct file *) is bigger than or equal to sizeof int, 926 * then do it in forward order. In that case, an integer will 927 * always come in the same place or before its corresponding 928 * struct file pointer. 929 * If sizeof (struct file *) is smaller than sizeof int, then 930 * do it in reverse order. 931 */ 932 if (sizeof (struct file *) >= sizeof (int)) { 933 fdp = (int *)(cm + 1); 934 rp = (struct file **)CMSG_DATA(cm); 935 for (i = 0; i < newfds; i++) { 936 if (fdalloc(p, 0, &f)) 937 panic("unp_externalize"); 938 fp = *rp++; 939 p->p_fd->fd_files[f].fp = fp; 940 fp->f_msgcount--; 941 unp_rights--; 942 *fdp++ = f; 943 } 944 } else { 945 fdp = (int *)(cm + 1) + newfds - 1; 946 rp = (struct file **)CMSG_DATA(cm) + newfds - 1; 947 for (i = 0; i < newfds; i++) { 948 if (fdalloc(p, 0, &f)) 949 panic("unp_externalize"); 950 fp = *rp--; 951 p->p_fd->fd_files[f].fp = fp; 952 fp->f_msgcount--; 953 unp_rights--; 954 *fdp-- = f; 955 } 956 } 957 958 /* 959 * Adjust length, in case sizeof(struct file *) and sizeof(int) 960 * differs. 961 */ 962 cm->cmsg_len = CMSG_LEN(newfds * sizeof(int)); 963 rights->m_len = cm->cmsg_len; 964 return (0); 965 } 966 967 void 968 unp_init(void) 969 { 970 unp_zone = zinit("unpcb", sizeof(struct unpcb), nmbclusters, 0, 0); 971 if (unp_zone == NULL) 972 panic("unp_init"); 973 LIST_INIT(&unp_dhead); 974 LIST_INIT(&unp_shead); 975 } 976 977 static int 978 unp_internalize(struct mbuf *control, struct thread *td) 979 { 980 struct proc *p = td->td_proc; 981 struct filedesc *fdescp; 982 struct cmsghdr *cm = mtod(control, struct cmsghdr *); 983 struct file **rp; 984 struct file *fp; 985 int i, fd, *fdp; 986 struct cmsgcred *cmcred; 987 int oldfds; 988 u_int newlen; 989 990 KKASSERT(p); 991 fdescp = p->p_fd; 992 if ((cm->cmsg_type != SCM_RIGHTS && cm->cmsg_type != SCM_CREDS) || 993 cm->cmsg_level != SOL_SOCKET || cm->cmsg_len != control->m_len) 994 return (EINVAL); 995 996 /* 997 * Fill in credential information. 998 */ 999 if (cm->cmsg_type == SCM_CREDS) { 1000 cmcred = (struct cmsgcred *)(cm + 1); 1001 cmcred->cmcred_pid = p->p_pid; 1002 cmcred->cmcred_uid = p->p_ucred->cr_ruid; 1003 cmcred->cmcred_gid = p->p_ucred->cr_rgid; 1004 cmcred->cmcred_euid = p->p_ucred->cr_uid; 1005 cmcred->cmcred_ngroups = MIN(p->p_ucred->cr_ngroups, 1006 CMGROUP_MAX); 1007 for (i = 0; i < cmcred->cmcred_ngroups; i++) 1008 cmcred->cmcred_groups[i] = p->p_ucred->cr_groups[i]; 1009 return(0); 1010 } 1011 1012 oldfds = (cm->cmsg_len - sizeof (*cm)) / sizeof (int); 1013 /* 1014 * check that all the FDs passed in refer to legal OPEN files 1015 * If not, reject the entire operation. 1016 */ 1017 fdp = (int *)(cm + 1); 1018 for (i = 0; i < oldfds; i++) { 1019 fd = *fdp++; 1020 if ((unsigned)fd >= fdescp->fd_nfiles || 1021 fdescp->fd_files[fd].fp == NULL) 1022 return (EBADF); 1023 if (fdescp->fd_files[fd].fp->f_type == DTYPE_KQUEUE) 1024 return (EOPNOTSUPP); 1025 } 1026 /* 1027 * Now replace the integer FDs with pointers to 1028 * the associated global file table entry.. 1029 * Allocate a bigger buffer as necessary. But if an cluster is not 1030 * enough, return E2BIG. 1031 */ 1032 newlen = CMSG_LEN(oldfds * sizeof(struct file *)); 1033 if (newlen > MCLBYTES) 1034 return (E2BIG); 1035 if (newlen - control->m_len > M_TRAILINGSPACE(control)) { 1036 if (control->m_flags & M_EXT) 1037 return (E2BIG); 1038 MCLGET(control, MB_WAIT); 1039 if (!(control->m_flags & M_EXT)) 1040 return (ENOBUFS); 1041 1042 /* copy the data to the cluster */ 1043 memcpy(mtod(control, char *), cm, cm->cmsg_len); 1044 cm = mtod(control, struct cmsghdr *); 1045 } 1046 1047 /* 1048 * Adjust length, in case sizeof(struct file *) and sizeof(int) 1049 * differs. 1050 */ 1051 control->m_len = cm->cmsg_len = newlen; 1052 1053 /* 1054 * Transform the file descriptors into struct file pointers. 1055 * If sizeof (struct file *) is bigger than or equal to sizeof int, 1056 * then do it in reverse order so that the int won't get until 1057 * we're done. 1058 * If sizeof (struct file *) is smaller than sizeof int, then 1059 * do it in forward order. 1060 */ 1061 if (sizeof (struct file *) >= sizeof (int)) { 1062 fdp = (int *)(cm + 1) + oldfds - 1; 1063 rp = (struct file **)CMSG_DATA(cm) + oldfds - 1; 1064 for (i = 0; i < oldfds; i++) { 1065 fp = fdescp->fd_files[*fdp--].fp; 1066 *rp-- = fp; 1067 fp->f_count++; 1068 fp->f_msgcount++; 1069 unp_rights++; 1070 } 1071 } else { 1072 fdp = (int *)(cm + 1); 1073 rp = (struct file **)CMSG_DATA(cm); 1074 for (i = 0; i < oldfds; i++) { 1075 fp = fdescp->fd_files[*fdp++].fp; 1076 *rp++ = fp; 1077 fp->f_count++; 1078 fp->f_msgcount++; 1079 unp_rights++; 1080 } 1081 } 1082 return (0); 1083 } 1084 1085 static int unp_defer; 1086 1087 static void 1088 unp_gc() 1089 { 1090 static boolean_t unp_gcing; 1091 1092 struct file *fp, *nextfp; 1093 struct socket *so; 1094 struct file **extra_ref, **fpp; 1095 int nunref, i; 1096 1097 if (unp_gcing) 1098 return; 1099 unp_gcing = TRUE; 1100 unp_defer = 0; 1101 /* 1102 * before going through all this, set all FDs to 1103 * be NOT defered and NOT externally accessible 1104 */ 1105 LIST_FOREACH(fp, &filehead, f_list) 1106 fp->f_flag &= ~(FMARK|FDEFER); 1107 do { 1108 LIST_FOREACH(fp, &filehead, f_list) { 1109 /* 1110 * If the file is not open, skip it 1111 */ 1112 if (fp->f_count == 0) 1113 continue; 1114 /* 1115 * If we already marked it as 'defer' in a 1116 * previous pass, then try process it this time 1117 * and un-mark it 1118 */ 1119 if (fp->f_flag & FDEFER) { 1120 fp->f_flag &= ~FDEFER; 1121 unp_defer--; 1122 } else { 1123 /* 1124 * if it's not defered, then check if it's 1125 * already marked.. if so skip it 1126 */ 1127 if (fp->f_flag & FMARK) 1128 continue; 1129 /* 1130 * If all references are from messages 1131 * in transit, then skip it. it's not 1132 * externally accessible. 1133 */ 1134 if (fp->f_count == fp->f_msgcount) 1135 continue; 1136 /* 1137 * If it got this far then it must be 1138 * externally accessible. 1139 */ 1140 fp->f_flag |= FMARK; 1141 } 1142 /* 1143 * either it was defered, or it is externally 1144 * accessible and not already marked so. 1145 * Now check if it is possibly one of OUR sockets. 1146 */ 1147 if (fp->f_type != DTYPE_SOCKET || 1148 (so = (struct socket *)fp->f_data) == NULL) 1149 continue; 1150 if (so->so_proto->pr_domain != &localdomain || 1151 !(so->so_proto->pr_flags & PR_RIGHTS)) 1152 continue; 1153 #ifdef notdef 1154 if (so->so_rcv.sb_flags & SB_LOCK) { 1155 /* 1156 * This is problematical; it's not clear 1157 * we need to wait for the sockbuf to be 1158 * unlocked (on a uniprocessor, at least), 1159 * and it's also not clear what to do 1160 * if sbwait returns an error due to receipt 1161 * of a signal. If sbwait does return 1162 * an error, we'll go into an infinite 1163 * loop. Delete all of this for now. 1164 */ 1165 sbwait(&so->so_rcv); 1166 goto restart; 1167 } 1168 #endif 1169 /* 1170 * So, Ok, it's one of our sockets and it IS externally 1171 * accessible (or was defered). Now we look 1172 * to see if we hold any file descriptors in its 1173 * message buffers. Follow those links and mark them 1174 * as accessible too. 1175 */ 1176 unp_scan(so->so_rcv.sb_mb, unp_mark); 1177 } 1178 } while (unp_defer); 1179 /* 1180 * We grab an extra reference to each of the file table entries 1181 * that are not otherwise accessible and then free the rights 1182 * that are stored in messages on them. 1183 * 1184 * The bug in the orginal code is a little tricky, so I'll describe 1185 * what's wrong with it here. 1186 * 1187 * It is incorrect to simply unp_discard each entry for f_msgcount 1188 * times -- consider the case of sockets A and B that contain 1189 * references to each other. On a last close of some other socket, 1190 * we trigger a gc since the number of outstanding rights (unp_rights) 1191 * is non-zero. If during the sweep phase the gc code un_discards, 1192 * we end up doing a (full) closef on the descriptor. A closef on A 1193 * results in the following chain. Closef calls soo_close, which 1194 * calls soclose. Soclose calls first (through the switch 1195 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply 1196 * returns because the previous instance had set unp_gcing, and 1197 * we return all the way back to soclose, which marks the socket 1198 * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush 1199 * to free up the rights that are queued in messages on the socket A, 1200 * i.e., the reference on B. The sorflush calls via the dom_dispose 1201 * switch unp_dispose, which unp_scans with unp_discard. This second 1202 * instance of unp_discard just calls closef on B. 1203 * 1204 * Well, a similar chain occurs on B, resulting in a sorflush on B, 1205 * which results in another closef on A. Unfortunately, A is already 1206 * being closed, and the descriptor has already been marked with 1207 * SS_NOFDREF, and soclose panics at this point. 1208 * 1209 * Here, we first take an extra reference to each inaccessible 1210 * descriptor. Then, we call sorflush ourself, since we know 1211 * it is a Unix domain socket anyhow. After we destroy all the 1212 * rights carried in messages, we do a last closef to get rid 1213 * of our extra reference. This is the last close, and the 1214 * unp_detach etc will shut down the socket. 1215 * 1216 * 91/09/19, bsy@cs.cmu.edu 1217 */ 1218 extra_ref = malloc(nfiles * sizeof(struct file *), M_FILE, M_WAITOK); 1219 for (nunref = 0, fp = LIST_FIRST(&filehead), fpp = extra_ref; 1220 fp != NULL; fp = nextfp) { 1221 nextfp = LIST_NEXT(fp, f_list); 1222 /* 1223 * If it's not open, skip it 1224 */ 1225 if (fp->f_count == 0) 1226 continue; 1227 /* 1228 * If all refs are from msgs, and it's not marked accessible 1229 * then it must be referenced from some unreachable cycle 1230 * of (shut-down) FDs, so include it in our 1231 * list of FDs to remove 1232 */ 1233 if (fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) { 1234 *fpp++ = fp; 1235 nunref++; 1236 fp->f_count++; 1237 } 1238 } 1239 /* 1240 * for each FD on our hit list, do the following two things 1241 */ 1242 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) { 1243 struct file *tfp = *fpp; 1244 if (tfp->f_type == DTYPE_SOCKET && tfp->f_data != NULL) 1245 sorflush((struct socket *)(tfp->f_data)); 1246 } 1247 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) 1248 closef(*fpp, NULL); 1249 free((caddr_t)extra_ref, M_FILE); 1250 unp_gcing = FALSE; 1251 } 1252 1253 void 1254 unp_dispose(struct mbuf *m) 1255 { 1256 if (m) 1257 unp_scan(m, unp_discard); 1258 } 1259 1260 static int 1261 unp_listen(struct unpcb *unp, struct thread *td) 1262 { 1263 struct proc *p = td->td_proc; 1264 1265 KKASSERT(p); 1266 cru2x(p->p_ucred, &unp->unp_peercred); 1267 unp->unp_flags |= UNP_HAVEPCCACHED; 1268 return (0); 1269 } 1270 1271 static void 1272 unp_scan(struct mbuf *m0, void (*op)(struct file *)) 1273 { 1274 struct mbuf *m; 1275 struct file **rp; 1276 struct cmsghdr *cm; 1277 int i; 1278 int qfds; 1279 1280 while (m0) { 1281 for (m = m0; m; m = m->m_next) 1282 if (m->m_type == MT_CONTROL && 1283 m->m_len >= sizeof(*cm)) { 1284 cm = mtod(m, struct cmsghdr *); 1285 if (cm->cmsg_level != SOL_SOCKET || 1286 cm->cmsg_type != SCM_RIGHTS) 1287 continue; 1288 qfds = (cm->cmsg_len - 1289 (CMSG_DATA(cm) - (u_char *)cm)) 1290 / sizeof (struct file *); 1291 rp = (struct file **)CMSG_DATA(cm); 1292 for (i = 0; i < qfds; i++) 1293 (*op)(*rp++); 1294 break; /* XXX, but saves time */ 1295 } 1296 m0 = m0->m_nextpkt; 1297 } 1298 } 1299 1300 static void 1301 unp_mark(struct file *fp) 1302 { 1303 1304 if (fp->f_flag & FMARK) 1305 return; 1306 unp_defer++; 1307 fp->f_flag |= (FMARK|FDEFER); 1308 } 1309 1310 static void 1311 unp_discard(struct file *fp) 1312 { 1313 1314 fp->f_msgcount--; 1315 unp_rights--; 1316 closef(fp, NULL); 1317 } 1318