1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2002 Dag-Erling Coïdan Smørgrav 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer 12 * in this position and unchanged. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of the author may not be used to endorse or promote products 17 * derived from this software without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include <sys/cdefs.h> 32 __FBSDID("$FreeBSD$"); 33 34 #include <sys/param.h> 35 #include <sys/file.h> 36 #include <sys/socket.h> 37 #include <sys/socketvar.h> 38 #include <sys/sysctl.h> 39 #include <sys/jail.h> 40 #include <sys/user.h> 41 42 #include <sys/un.h> 43 #define _WANT_UNPCB 44 #include <sys/unpcb.h> 45 46 #include <net/route.h> 47 48 #include <netinet/in.h> 49 #include <netinet/in_pcb.h> 50 #include <netinet/sctp.h> 51 #include <netinet/tcp.h> 52 #define TCPSTATES /* load state names */ 53 #include <netinet/tcp_fsm.h> 54 #include <netinet/tcp_seq.h> 55 #include <netinet/tcp_var.h> 56 #include <arpa/inet.h> 57 58 #include <capsicum_helpers.h> 59 #include <ctype.h> 60 #include <err.h> 61 #include <errno.h> 62 #include <inttypes.h> 63 #include <jail.h> 64 #include <netdb.h> 65 #include <pwd.h> 66 #include <stdarg.h> 67 #include <stdio.h> 68 #include <stdlib.h> 69 #include <string.h> 70 #include <unistd.h> 71 72 #include <libcasper.h> 73 #include <casper/cap_net.h> 74 #include <casper/cap_netdb.h> 75 #include <casper/cap_pwd.h> 76 #include <casper/cap_sysctl.h> 77 78 #define sstosin(ss) ((struct sockaddr_in *)(ss)) 79 #define sstosin6(ss) ((struct sockaddr_in6 *)(ss)) 80 #define sstosun(ss) ((struct sockaddr_un *)(ss)) 81 #define sstosa(ss) ((struct sockaddr *)(ss)) 82 83 static int opt_4; /* Show IPv4 sockets */ 84 static int opt_6; /* Show IPv6 sockets */ 85 static int opt_C; /* Show congestion control */ 86 static int opt_c; /* Show connected sockets */ 87 static int opt_i; /* Show inp_gencnt */ 88 static int opt_j; /* Show specified jail */ 89 static int opt_L; /* Don't show IPv4 or IPv6 loopback sockets */ 90 static int opt_l; /* Show listening sockets */ 91 static int opt_n; /* Don't resolve UIDs to user names */ 92 static int opt_q; /* Don't show header */ 93 static int opt_S; /* Show protocol stack if applicable */ 94 static int opt_s; /* Show protocol state if applicable */ 95 static int opt_U; /* Show remote UDP encapsulation port number */ 96 static int opt_u; /* Show Unix domain sockets */ 97 static int opt_v; /* Verbose mode */ 98 static int opt_w; /* Wide print area for addresses */ 99 100 /* 101 * Default protocols to use if no -P was defined. 102 */ 103 static const char *default_protos[] = {"sctp", "tcp", "udp", "divert" }; 104 static size_t default_numprotos = nitems(default_protos); 105 106 static int *protos; /* protocols to use */ 107 static size_t numprotos; /* allocated size of protos[] */ 108 109 static int *ports; 110 111 #define INT_BIT (sizeof(int)*CHAR_BIT) 112 #define SET_PORT(p) do { ports[p / INT_BIT] |= 1 << (p % INT_BIT); } while (0) 113 #define CHK_PORT(p) (ports[p / INT_BIT] & (1 << (p % INT_BIT))) 114 115 struct addr { 116 struct sockaddr_storage address; 117 unsigned int encaps_port; 118 int state; 119 struct addr *next; 120 }; 121 122 struct sock { 123 kvaddr_t socket; 124 kvaddr_t pcb; 125 uint64_t inp_gencnt; 126 int shown; 127 int vflag; 128 int family; 129 int proto; 130 int state; 131 const char *protoname; 132 char stack[TCP_FUNCTION_NAME_LEN_MAX]; 133 char cc[TCP_CA_NAME_MAX]; 134 struct addr *laddr; 135 struct addr *faddr; 136 struct sock *next; 137 }; 138 139 #define HASHSIZE 1009 140 static struct sock *sockhash[HASHSIZE]; 141 142 static struct xfile *xfiles; 143 static int nxfiles; 144 145 static cap_channel_t *capnet; 146 static cap_channel_t *capnetdb; 147 static cap_channel_t *capsysctl; 148 static cap_channel_t *cappwd; 149 150 static int 151 xprintf(const char *fmt, ...) 152 { 153 va_list ap; 154 int len; 155 156 va_start(ap, fmt); 157 len = vprintf(fmt, ap); 158 va_end(ap); 159 if (len < 0) 160 err(1, "printf()"); 161 return (len); 162 } 163 164 static int 165 get_proto_type(const char *proto) 166 { 167 struct protoent *pent; 168 169 if (strlen(proto) == 0) 170 return (0); 171 if (capnetdb != NULL) 172 pent = cap_getprotobyname(capnetdb, proto); 173 else 174 pent = getprotobyname(proto); 175 if (pent == NULL) { 176 warn("cap_getprotobyname"); 177 return (-1); 178 } 179 return (pent->p_proto); 180 } 181 182 static void 183 init_protos(int num) 184 { 185 int proto_count = 0; 186 187 if (num > 0) { 188 proto_count = num; 189 } else { 190 /* Find the maximum number of possible protocols. */ 191 while (getprotoent() != NULL) 192 proto_count++; 193 endprotoent(); 194 } 195 196 if ((protos = malloc(sizeof(int) * proto_count)) == NULL) 197 err(1, "malloc"); 198 numprotos = proto_count; 199 } 200 201 static int 202 parse_protos(char *protospec) 203 { 204 char *prot; 205 int proto_type, proto_index; 206 207 if (protospec == NULL) 208 return (-1); 209 210 init_protos(0); 211 proto_index = 0; 212 while ((prot = strsep(&protospec, ",")) != NULL) { 213 if (strlen(prot) == 0) 214 continue; 215 proto_type = get_proto_type(prot); 216 if (proto_type != -1) 217 protos[proto_index++] = proto_type; 218 } 219 numprotos = proto_index; 220 return (proto_index); 221 } 222 223 static void 224 parse_ports(const char *portspec) 225 { 226 const char *p, *q; 227 int port, end; 228 229 if (ports == NULL) 230 if ((ports = calloc(65536 / INT_BIT, sizeof(int))) == NULL) 231 err(1, "calloc()"); 232 p = portspec; 233 while (*p != '\0') { 234 if (!isdigit(*p)) 235 errx(1, "syntax error in port range"); 236 for (q = p; *q != '\0' && isdigit(*q); ++q) 237 /* nothing */ ; 238 for (port = 0; p < q; ++p) 239 port = port * 10 + digittoint(*p); 240 if (port < 0 || port > 65535) 241 errx(1, "invalid port number"); 242 SET_PORT(port); 243 switch (*p) { 244 case '-': 245 ++p; 246 break; 247 case ',': 248 ++p; 249 /* fall through */ 250 case '\0': 251 default: 252 continue; 253 } 254 for (q = p; *q != '\0' && isdigit(*q); ++q) 255 /* nothing */ ; 256 for (end = 0; p < q; ++p) 257 end = end * 10 + digittoint(*p); 258 if (end < port || end > 65535) 259 errx(1, "invalid port number"); 260 while (port++ < end) 261 SET_PORT(port); 262 if (*p == ',') 263 ++p; 264 } 265 } 266 267 static void 268 sockaddr(struct sockaddr_storage *ss, int af, void *addr, int port) 269 { 270 struct sockaddr_in *sin4; 271 struct sockaddr_in6 *sin6; 272 273 bzero(ss, sizeof(*ss)); 274 switch (af) { 275 case AF_INET: 276 sin4 = sstosin(ss); 277 sin4->sin_len = sizeof(*sin4); 278 sin4->sin_family = af; 279 sin4->sin_port = port; 280 sin4->sin_addr = *(struct in_addr *)addr; 281 break; 282 case AF_INET6: 283 sin6 = sstosin6(ss); 284 sin6->sin6_len = sizeof(*sin6); 285 sin6->sin6_family = af; 286 sin6->sin6_port = port; 287 sin6->sin6_addr = *(struct in6_addr *)addr; 288 #define s6_addr16 __u6_addr.__u6_addr16 289 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) { 290 sin6->sin6_scope_id = 291 ntohs(sin6->sin6_addr.s6_addr16[1]); 292 sin6->sin6_addr.s6_addr16[1] = 0; 293 } 294 break; 295 default: 296 abort(); 297 } 298 } 299 300 static void 301 free_socket(struct sock *sock) 302 { 303 struct addr *cur, *next; 304 305 cur = sock->laddr; 306 while (cur != NULL) { 307 next = cur->next; 308 free(cur); 309 cur = next; 310 } 311 cur = sock->faddr; 312 while (cur != NULL) { 313 next = cur->next; 314 free(cur); 315 cur = next; 316 } 317 free(sock); 318 } 319 320 static void 321 gather_sctp(void) 322 { 323 struct sock *sock; 324 struct addr *laddr, *prev_laddr, *faddr, *prev_faddr; 325 struct xsctp_inpcb *xinpcb; 326 struct xsctp_tcb *xstcb; 327 struct xsctp_raddr *xraddr; 328 struct xsctp_laddr *xladdr; 329 const char *varname; 330 size_t len, offset; 331 char *buf; 332 int hash, vflag; 333 int no_stcb, local_all_loopback, foreign_all_loopback; 334 335 vflag = 0; 336 if (opt_4) 337 vflag |= INP_IPV4; 338 if (opt_6) 339 vflag |= INP_IPV6; 340 341 varname = "net.inet.sctp.assoclist"; 342 if (cap_sysctlbyname(capsysctl, varname, 0, &len, 0, 0) < 0) { 343 if (errno != ENOENT) 344 err(1, "cap_sysctlbyname()"); 345 return; 346 } 347 if ((buf = (char *)malloc(len)) == NULL) { 348 err(1, "malloc()"); 349 return; 350 } 351 if (cap_sysctlbyname(capsysctl, varname, buf, &len, 0, 0) < 0) { 352 err(1, "cap_sysctlbyname()"); 353 free(buf); 354 return; 355 } 356 xinpcb = (struct xsctp_inpcb *)(void *)buf; 357 offset = sizeof(struct xsctp_inpcb); 358 while ((offset < len) && (xinpcb->last == 0)) { 359 if ((sock = calloc(1, sizeof *sock)) == NULL) 360 err(1, "malloc()"); 361 sock->socket = xinpcb->socket; 362 sock->proto = IPPROTO_SCTP; 363 sock->protoname = "sctp"; 364 if (xinpcb->maxqlen == 0) 365 sock->state = SCTP_CLOSED; 366 else 367 sock->state = SCTP_LISTEN; 368 if (xinpcb->flags & SCTP_PCB_FLAGS_BOUND_V6) { 369 sock->family = AF_INET6; 370 /* 371 * Currently there is no way to distinguish between 372 * IPv6 only sockets or dual family sockets. 373 * So mark it as dual socket. 374 */ 375 sock->vflag = INP_IPV6 | INP_IPV4; 376 } else { 377 sock->family = AF_INET; 378 sock->vflag = INP_IPV4; 379 } 380 prev_laddr = NULL; 381 local_all_loopback = 1; 382 while (offset < len) { 383 xladdr = (struct xsctp_laddr *)(void *)(buf + offset); 384 offset += sizeof(struct xsctp_laddr); 385 if (xladdr->last == 1) 386 break; 387 if ((laddr = calloc(1, sizeof(struct addr))) == NULL) 388 err(1, "malloc()"); 389 switch (xladdr->address.sa.sa_family) { 390 case AF_INET: 391 #define __IN_IS_ADDR_LOOPBACK(pina) \ 392 ((ntohl((pina)->s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) 393 if (!__IN_IS_ADDR_LOOPBACK( 394 &xladdr->address.sin.sin_addr)) 395 local_all_loopback = 0; 396 #undef __IN_IS_ADDR_LOOPBACK 397 sockaddr(&laddr->address, AF_INET, 398 &xladdr->address.sin.sin_addr, 399 htons(xinpcb->local_port)); 400 break; 401 case AF_INET6: 402 if (!IN6_IS_ADDR_LOOPBACK( 403 &xladdr->address.sin6.sin6_addr)) 404 local_all_loopback = 0; 405 sockaddr(&laddr->address, AF_INET6, 406 &xladdr->address.sin6.sin6_addr, 407 htons(xinpcb->local_port)); 408 break; 409 default: 410 errx(1, "address family %d not supported", 411 xladdr->address.sa.sa_family); 412 } 413 laddr->next = NULL; 414 if (prev_laddr == NULL) 415 sock->laddr = laddr; 416 else 417 prev_laddr->next = laddr; 418 prev_laddr = laddr; 419 } 420 if (sock->laddr == NULL) { 421 if ((sock->laddr = 422 calloc(1, sizeof(struct addr))) == NULL) 423 err(1, "malloc()"); 424 sock->laddr->address.ss_family = sock->family; 425 if (sock->family == AF_INET) 426 sock->laddr->address.ss_len = 427 sizeof(struct sockaddr_in); 428 else 429 sock->laddr->address.ss_len = 430 sizeof(struct sockaddr_in6); 431 local_all_loopback = 0; 432 } 433 if ((sock->faddr = calloc(1, sizeof(struct addr))) == NULL) 434 err(1, "malloc()"); 435 sock->faddr->address.ss_family = sock->family; 436 if (sock->family == AF_INET) 437 sock->faddr->address.ss_len = 438 sizeof(struct sockaddr_in); 439 else 440 sock->faddr->address.ss_len = 441 sizeof(struct sockaddr_in6); 442 no_stcb = 1; 443 while (offset < len) { 444 xstcb = (struct xsctp_tcb *)(void *)(buf + offset); 445 offset += sizeof(struct xsctp_tcb); 446 if (no_stcb) { 447 if (opt_l && (sock->vflag & vflag) && 448 (!opt_L || !local_all_loopback) && 449 ((xinpcb->flags & SCTP_PCB_FLAGS_UDPTYPE) || 450 (xstcb->last == 1))) { 451 hash = (int)((uintptr_t)sock->socket % 452 HASHSIZE); 453 sock->next = sockhash[hash]; 454 sockhash[hash] = sock; 455 } else { 456 free_socket(sock); 457 } 458 } 459 if (xstcb->last == 1) 460 break; 461 no_stcb = 0; 462 if (opt_c) { 463 if ((sock = calloc(1, sizeof *sock)) == NULL) 464 err(1, "malloc()"); 465 sock->socket = xinpcb->socket; 466 sock->proto = IPPROTO_SCTP; 467 sock->protoname = "sctp"; 468 sock->state = (int)xstcb->state; 469 if (xinpcb->flags & SCTP_PCB_FLAGS_BOUND_V6) { 470 sock->family = AF_INET6; 471 /* 472 * Currently there is no way to distinguish 473 * between IPv6 only sockets or dual family 474 * sockets. So mark it as dual socket. 475 */ 476 sock->vflag = INP_IPV6 | INP_IPV4; 477 } else { 478 sock->family = AF_INET; 479 sock->vflag = INP_IPV4; 480 } 481 } 482 prev_laddr = NULL; 483 local_all_loopback = 1; 484 while (offset < len) { 485 xladdr = (struct xsctp_laddr *)(void *)(buf + 486 offset); 487 offset += sizeof(struct xsctp_laddr); 488 if (xladdr->last == 1) 489 break; 490 if (!opt_c) 491 continue; 492 laddr = calloc(1, sizeof(struct addr)); 493 if (laddr == NULL) 494 err(1, "malloc()"); 495 switch (xladdr->address.sa.sa_family) { 496 case AF_INET: 497 #define __IN_IS_ADDR_LOOPBACK(pina) \ 498 ((ntohl((pina)->s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) 499 if (!__IN_IS_ADDR_LOOPBACK( 500 &xladdr->address.sin.sin_addr)) 501 local_all_loopback = 0; 502 #undef __IN_IS_ADDR_LOOPBACK 503 sockaddr(&laddr->address, AF_INET, 504 &xladdr->address.sin.sin_addr, 505 htons(xstcb->local_port)); 506 break; 507 case AF_INET6: 508 if (!IN6_IS_ADDR_LOOPBACK( 509 &xladdr->address.sin6.sin6_addr)) 510 local_all_loopback = 0; 511 sockaddr(&laddr->address, AF_INET6, 512 &xladdr->address.sin6.sin6_addr, 513 htons(xstcb->local_port)); 514 break; 515 default: 516 errx(1, 517 "address family %d not supported", 518 xladdr->address.sa.sa_family); 519 } 520 laddr->next = NULL; 521 if (prev_laddr == NULL) 522 sock->laddr = laddr; 523 else 524 prev_laddr->next = laddr; 525 prev_laddr = laddr; 526 } 527 prev_faddr = NULL; 528 foreign_all_loopback = 1; 529 while (offset < len) { 530 xraddr = (struct xsctp_raddr *)(void *)(buf + 531 offset); 532 offset += sizeof(struct xsctp_raddr); 533 if (xraddr->last == 1) 534 break; 535 if (!opt_c) 536 continue; 537 faddr = calloc(1, sizeof(struct addr)); 538 if (faddr == NULL) 539 err(1, "malloc()"); 540 switch (xraddr->address.sa.sa_family) { 541 case AF_INET: 542 #define __IN_IS_ADDR_LOOPBACK(pina) \ 543 ((ntohl((pina)->s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) 544 if (!__IN_IS_ADDR_LOOPBACK( 545 &xraddr->address.sin.sin_addr)) 546 foreign_all_loopback = 0; 547 #undef __IN_IS_ADDR_LOOPBACK 548 sockaddr(&faddr->address, AF_INET, 549 &xraddr->address.sin.sin_addr, 550 htons(xstcb->remote_port)); 551 break; 552 case AF_INET6: 553 if (!IN6_IS_ADDR_LOOPBACK( 554 &xraddr->address.sin6.sin6_addr)) 555 foreign_all_loopback = 0; 556 sockaddr(&faddr->address, AF_INET6, 557 &xraddr->address.sin6.sin6_addr, 558 htons(xstcb->remote_port)); 559 break; 560 default: 561 errx(1, 562 "address family %d not supported", 563 xraddr->address.sa.sa_family); 564 } 565 faddr->encaps_port = xraddr->encaps_port; 566 faddr->state = xraddr->state; 567 faddr->next = NULL; 568 if (prev_faddr == NULL) 569 sock->faddr = faddr; 570 else 571 prev_faddr->next = faddr; 572 prev_faddr = faddr; 573 } 574 if (opt_c) { 575 if ((sock->vflag & vflag) && 576 (!opt_L || 577 !(local_all_loopback || 578 foreign_all_loopback))) { 579 hash = (int)((uintptr_t)sock->socket % 580 HASHSIZE); 581 sock->next = sockhash[hash]; 582 sockhash[hash] = sock; 583 } else { 584 free_socket(sock); 585 } 586 } 587 } 588 xinpcb = (struct xsctp_inpcb *)(void *)(buf + offset); 589 offset += sizeof(struct xsctp_inpcb); 590 } 591 free(buf); 592 } 593 594 static void 595 gather_inet(int proto) 596 { 597 struct xinpgen *xig, *exig; 598 struct xinpcb *xip; 599 struct xtcpcb *xtp = NULL; 600 struct xsocket *so; 601 struct sock *sock; 602 struct addr *laddr, *faddr; 603 const char *varname, *protoname; 604 size_t len, bufsize; 605 void *buf; 606 int hash, retry, vflag; 607 608 vflag = 0; 609 if (opt_4) 610 vflag |= INP_IPV4; 611 if (opt_6) 612 vflag |= INP_IPV6; 613 614 switch (proto) { 615 case IPPROTO_TCP: 616 varname = "net.inet.tcp.pcblist"; 617 protoname = "tcp"; 618 break; 619 case IPPROTO_UDP: 620 varname = "net.inet.udp.pcblist"; 621 protoname = "udp"; 622 break; 623 case IPPROTO_DIVERT: 624 varname = "net.inet.divert.pcblist"; 625 protoname = "div"; 626 break; 627 default: 628 errx(1, "protocol %d not supported", proto); 629 } 630 631 buf = NULL; 632 bufsize = 8192; 633 retry = 5; 634 do { 635 for (;;) { 636 if ((buf = realloc(buf, bufsize)) == NULL) 637 err(1, "realloc()"); 638 len = bufsize; 639 if (cap_sysctlbyname(capsysctl, varname, buf, &len, 640 NULL, 0) == 0) 641 break; 642 if (errno == ENOENT) 643 goto out; 644 if (errno != ENOMEM || len != bufsize) 645 err(1, "cap_sysctlbyname()"); 646 bufsize *= 2; 647 } 648 xig = (struct xinpgen *)buf; 649 exig = (struct xinpgen *)(void *) 650 ((char *)buf + len - sizeof *exig); 651 if (xig->xig_len != sizeof *xig || 652 exig->xig_len != sizeof *exig) 653 errx(1, "struct xinpgen size mismatch"); 654 } while (xig->xig_gen != exig->xig_gen && retry--); 655 656 if (xig->xig_gen != exig->xig_gen && opt_v) 657 warnx("warning: data may be inconsistent"); 658 659 for (;;) { 660 xig = (struct xinpgen *)(void *)((char *)xig + xig->xig_len); 661 if (xig >= exig) 662 break; 663 switch (proto) { 664 case IPPROTO_TCP: 665 xtp = (struct xtcpcb *)xig; 666 xip = &xtp->xt_inp; 667 if (xtp->xt_len != sizeof(*xtp)) { 668 warnx("struct xtcpcb size mismatch"); 669 goto out; 670 } 671 protoname = xtp->t_flags & TF_TOE ? "toe" : "tcp"; 672 break; 673 case IPPROTO_UDP: 674 case IPPROTO_DIVERT: 675 xip = (struct xinpcb *)xig; 676 if (xip->xi_len != sizeof(*xip)) { 677 warnx("struct xinpcb size mismatch"); 678 goto out; 679 } 680 break; 681 default: 682 errx(1, "protocol %d not supported", proto); 683 } 684 so = &xip->xi_socket; 685 if ((xip->inp_vflag & vflag) == 0) 686 continue; 687 if (xip->inp_vflag & INP_IPV4) { 688 if ((xip->inp_fport == 0 && !opt_l) || 689 (xip->inp_fport != 0 && !opt_c)) 690 continue; 691 #define __IN_IS_ADDR_LOOPBACK(pina) \ 692 ((ntohl((pina)->s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) 693 if (opt_L && 694 (__IN_IS_ADDR_LOOPBACK(&xip->inp_faddr) || 695 __IN_IS_ADDR_LOOPBACK(&xip->inp_laddr))) 696 continue; 697 #undef __IN_IS_ADDR_LOOPBACK 698 } else if (xip->inp_vflag & INP_IPV6) { 699 if ((xip->inp_fport == 0 && !opt_l) || 700 (xip->inp_fport != 0 && !opt_c)) 701 continue; 702 if (opt_L && 703 (IN6_IS_ADDR_LOOPBACK(&xip->in6p_faddr) || 704 IN6_IS_ADDR_LOOPBACK(&xip->in6p_laddr))) 705 continue; 706 } else { 707 if (opt_v) 708 warnx("invalid vflag 0x%x", xip->inp_vflag); 709 continue; 710 } 711 if ((sock = calloc(1, sizeof(*sock))) == NULL) 712 err(1, "malloc()"); 713 if ((laddr = calloc(1, sizeof *laddr)) == NULL) 714 err(1, "malloc()"); 715 if ((faddr = calloc(1, sizeof *faddr)) == NULL) 716 err(1, "malloc()"); 717 sock->socket = so->xso_so; 718 sock->proto = proto; 719 sock->inp_gencnt = xip->inp_gencnt; 720 if (xip->inp_vflag & INP_IPV4) { 721 sock->family = AF_INET; 722 sockaddr(&laddr->address, sock->family, 723 &xip->inp_laddr, xip->inp_lport); 724 sockaddr(&faddr->address, sock->family, 725 &xip->inp_faddr, xip->inp_fport); 726 } else if (xip->inp_vflag & INP_IPV6) { 727 sock->family = AF_INET6; 728 sockaddr(&laddr->address, sock->family, 729 &xip->in6p_laddr, xip->inp_lport); 730 sockaddr(&faddr->address, sock->family, 731 &xip->in6p_faddr, xip->inp_fport); 732 } 733 if (proto == IPPROTO_TCP) 734 faddr->encaps_port = xtp->xt_encaps_port; 735 laddr->next = NULL; 736 faddr->next = NULL; 737 sock->laddr = laddr; 738 sock->faddr = faddr; 739 sock->vflag = xip->inp_vflag; 740 if (proto == IPPROTO_TCP) { 741 sock->state = xtp->t_state; 742 memcpy(sock->stack, xtp->xt_stack, 743 TCP_FUNCTION_NAME_LEN_MAX); 744 memcpy(sock->cc, xtp->xt_cc, TCP_CA_NAME_MAX); 745 } 746 sock->protoname = protoname; 747 hash = (int)((uintptr_t)sock->socket % HASHSIZE); 748 sock->next = sockhash[hash]; 749 sockhash[hash] = sock; 750 } 751 out: 752 free(buf); 753 } 754 755 static void 756 gather_unix(int proto) 757 { 758 struct xunpgen *xug, *exug; 759 struct xunpcb *xup; 760 struct sock *sock; 761 struct addr *laddr, *faddr; 762 const char *varname, *protoname; 763 size_t len, bufsize; 764 void *buf; 765 int hash, retry; 766 767 switch (proto) { 768 case SOCK_STREAM: 769 varname = "net.local.stream.pcblist"; 770 protoname = "stream"; 771 break; 772 case SOCK_DGRAM: 773 varname = "net.local.dgram.pcblist"; 774 protoname = "dgram"; 775 break; 776 case SOCK_SEQPACKET: 777 varname = "net.local.seqpacket.pcblist"; 778 protoname = "seqpac"; 779 break; 780 default: 781 abort(); 782 } 783 buf = NULL; 784 bufsize = 8192; 785 retry = 5; 786 do { 787 for (;;) { 788 if ((buf = realloc(buf, bufsize)) == NULL) 789 err(1, "realloc()"); 790 len = bufsize; 791 if (cap_sysctlbyname(capsysctl, varname, buf, &len, 792 NULL, 0) == 0) 793 break; 794 if (errno != ENOMEM || len != bufsize) 795 err(1, "cap_sysctlbyname()"); 796 bufsize *= 2; 797 } 798 xug = (struct xunpgen *)buf; 799 exug = (struct xunpgen *)(void *) 800 ((char *)buf + len - sizeof(*exug)); 801 if (xug->xug_len != sizeof(*xug) || 802 exug->xug_len != sizeof(*exug)) { 803 warnx("struct xinpgen size mismatch"); 804 goto out; 805 } 806 } while (xug->xug_gen != exug->xug_gen && retry--); 807 808 if (xug->xug_gen != exug->xug_gen && opt_v) 809 warnx("warning: data may be inconsistent"); 810 811 for (;;) { 812 xug = (struct xunpgen *)(void *)((char *)xug + xug->xug_len); 813 if (xug >= exug) 814 break; 815 xup = (struct xunpcb *)xug; 816 if (xup->xu_len != sizeof(*xup)) { 817 warnx("struct xunpcb size mismatch"); 818 goto out; 819 } 820 if ((xup->unp_conn == 0 && !opt_l) || 821 (xup->unp_conn != 0 && !opt_c)) 822 continue; 823 if ((sock = calloc(1, sizeof(*sock))) == NULL) 824 err(1, "malloc()"); 825 if ((laddr = calloc(1, sizeof *laddr)) == NULL) 826 err(1, "malloc()"); 827 if ((faddr = calloc(1, sizeof *faddr)) == NULL) 828 err(1, "malloc()"); 829 sock->socket = xup->xu_socket.xso_so; 830 sock->pcb = xup->xu_unpp; 831 sock->proto = proto; 832 sock->family = AF_UNIX; 833 sock->protoname = protoname; 834 if (xup->xu_addr.sun_family == AF_UNIX) 835 laddr->address = 836 *(struct sockaddr_storage *)(void *)&xup->xu_addr; 837 else if (xup->unp_conn != 0) 838 *(kvaddr_t*)&(faddr->address) = xup->unp_conn; 839 laddr->next = NULL; 840 faddr->next = NULL; 841 sock->laddr = laddr; 842 sock->faddr = faddr; 843 hash = (int)((uintptr_t)sock->socket % HASHSIZE); 844 sock->next = sockhash[hash]; 845 sockhash[hash] = sock; 846 } 847 out: 848 free(buf); 849 } 850 851 static void 852 getfiles(void) 853 { 854 size_t len, olen; 855 856 olen = len = sizeof(*xfiles); 857 if ((xfiles = malloc(len)) == NULL) 858 err(1, "malloc()"); 859 while (cap_sysctlbyname(capsysctl, "kern.file", xfiles, &len, 0, 0) 860 == -1) { 861 if (errno != ENOMEM || len != olen) 862 err(1, "cap_sysctlbyname()"); 863 olen = len *= 2; 864 if ((xfiles = realloc(xfiles, len)) == NULL) 865 err(1, "realloc()"); 866 } 867 if (len > 0 && xfiles->xf_size != sizeof(*xfiles)) 868 errx(1, "struct xfile size mismatch"); 869 nxfiles = len / sizeof(*xfiles); 870 } 871 872 static int 873 printaddr(struct sockaddr_storage *ss) 874 { 875 struct sockaddr_un *sun; 876 char addrstr[NI_MAXHOST] = { '\0', '\0' }; 877 int error, off, port = 0; 878 879 switch (ss->ss_family) { 880 case AF_INET: 881 if (sstosin(ss)->sin_addr.s_addr == INADDR_ANY) 882 addrstr[0] = '*'; 883 port = ntohs(sstosin(ss)->sin_port); 884 break; 885 case AF_INET6: 886 if (IN6_IS_ADDR_UNSPECIFIED(&sstosin6(ss)->sin6_addr)) 887 addrstr[0] = '*'; 888 port = ntohs(sstosin6(ss)->sin6_port); 889 break; 890 case AF_UNIX: 891 sun = sstosun(ss); 892 off = (int)((char *)&sun->sun_path - (char *)sun); 893 return (xprintf("%.*s", sun->sun_len - off, sun->sun_path)); 894 } 895 if (addrstr[0] == '\0') { 896 error = cap_getnameinfo(capnet, sstosa(ss), ss->ss_len, 897 addrstr, sizeof(addrstr), NULL, 0, NI_NUMERICHOST); 898 if (error) 899 errx(1, "cap_getnameinfo()"); 900 } 901 if (port == 0) 902 return xprintf("%s:*", addrstr); 903 else 904 return xprintf("%s:%d", addrstr, port); 905 } 906 907 static const char * 908 getprocname(pid_t pid) 909 { 910 static struct kinfo_proc proc; 911 size_t len; 912 int mib[4]; 913 914 mib[0] = CTL_KERN; 915 mib[1] = KERN_PROC; 916 mib[2] = KERN_PROC_PID; 917 mib[3] = (int)pid; 918 len = sizeof(proc); 919 if (cap_sysctl(capsysctl, mib, nitems(mib), &proc, &len, NULL, 0) 920 == -1) { 921 /* Do not warn if the process exits before we get its name. */ 922 if (errno != ESRCH) 923 warn("cap_sysctl()"); 924 return ("??"); 925 } 926 return (proc.ki_comm); 927 } 928 929 static int 930 getprocjid(pid_t pid) 931 { 932 static struct kinfo_proc proc; 933 size_t len; 934 int mib[4]; 935 936 mib[0] = CTL_KERN; 937 mib[1] = KERN_PROC; 938 mib[2] = KERN_PROC_PID; 939 mib[3] = (int)pid; 940 len = sizeof(proc); 941 if (cap_sysctl(capsysctl, mib, nitems(mib), &proc, &len, NULL, 0) 942 == -1) { 943 /* Do not warn if the process exits before we get its jid. */ 944 if (errno != ESRCH) 945 warn("cap_sysctl()"); 946 return (-1); 947 } 948 return (proc.ki_jid); 949 } 950 951 static int 952 check_ports(struct sock *s) 953 { 954 int port; 955 struct addr *addr; 956 957 if (ports == NULL) 958 return (1); 959 if ((s->family != AF_INET) && (s->family != AF_INET6)) 960 return (1); 961 for (addr = s->laddr; addr != NULL; addr = addr->next) { 962 if (s->family == AF_INET) 963 port = ntohs(sstosin(&addr->address)->sin_port); 964 else 965 port = ntohs(sstosin6(&addr->address)->sin6_port); 966 if (CHK_PORT(port)) 967 return (1); 968 } 969 for (addr = s->faddr; addr != NULL; addr = addr->next) { 970 if (s->family == AF_INET) 971 port = ntohs(sstosin(&addr->address)->sin_port); 972 else 973 port = ntohs(sstosin6(&addr->address)->sin6_port); 974 if (CHK_PORT(port)) 975 return (1); 976 } 977 return (0); 978 } 979 980 static const char * 981 sctp_conn_state(int state) 982 { 983 switch (state) { 984 case SCTP_CLOSED: 985 return "CLOSED"; 986 break; 987 case SCTP_BOUND: 988 return "BOUND"; 989 break; 990 case SCTP_LISTEN: 991 return "LISTEN"; 992 break; 993 case SCTP_COOKIE_WAIT: 994 return "COOKIE_WAIT"; 995 break; 996 case SCTP_COOKIE_ECHOED: 997 return "COOKIE_ECHOED"; 998 break; 999 case SCTP_ESTABLISHED: 1000 return "ESTABLISHED"; 1001 break; 1002 case SCTP_SHUTDOWN_SENT: 1003 return "SHUTDOWN_SENT"; 1004 break; 1005 case SCTP_SHUTDOWN_RECEIVED: 1006 return "SHUTDOWN_RECEIVED"; 1007 break; 1008 case SCTP_SHUTDOWN_ACK_SENT: 1009 return "SHUTDOWN_ACK_SENT"; 1010 break; 1011 case SCTP_SHUTDOWN_PENDING: 1012 return "SHUTDOWN_PENDING"; 1013 break; 1014 default: 1015 return "UNKNOWN"; 1016 break; 1017 } 1018 } 1019 1020 static const char * 1021 sctp_path_state(int state) 1022 { 1023 switch (state) { 1024 case SCTP_UNCONFIRMED: 1025 return "UNCONFIRMED"; 1026 break; 1027 case SCTP_ACTIVE: 1028 return "ACTIVE"; 1029 break; 1030 case SCTP_INACTIVE: 1031 return "INACTIVE"; 1032 break; 1033 default: 1034 return "UNKNOWN"; 1035 break; 1036 } 1037 } 1038 1039 static void 1040 displaysock(struct sock *s, int pos) 1041 { 1042 kvaddr_t p; 1043 int hash, first, offset; 1044 struct addr *laddr, *faddr; 1045 struct sock *s_tmp; 1046 1047 while (pos < 29) 1048 pos += xprintf(" "); 1049 pos += xprintf("%s", s->protoname); 1050 if (s->vflag & INP_IPV4) 1051 pos += xprintf("4"); 1052 if (s->vflag & INP_IPV6) 1053 pos += xprintf("6"); 1054 if (s->vflag & (INP_IPV4 | INP_IPV6)) 1055 pos += xprintf(" "); 1056 laddr = s->laddr; 1057 faddr = s->faddr; 1058 first = 1; 1059 while (laddr != NULL || faddr != NULL) { 1060 offset = 36; 1061 while (pos < offset) 1062 pos += xprintf(" "); 1063 switch (s->family) { 1064 case AF_INET: 1065 case AF_INET6: 1066 if (laddr != NULL) { 1067 pos += printaddr(&laddr->address); 1068 if (s->family == AF_INET6 && pos >= 58) 1069 pos += xprintf(" "); 1070 } 1071 offset += opt_w ? 46 : 22; 1072 while (pos < offset) 1073 pos += xprintf(" "); 1074 if (faddr != NULL) 1075 pos += printaddr(&faddr->address); 1076 offset += opt_w ? 46 : 22; 1077 break; 1078 case AF_UNIX: 1079 if ((laddr == NULL) || (faddr == NULL)) 1080 errx(1, "laddr = %p or faddr = %p is NULL", 1081 (void *)laddr, (void *)faddr); 1082 /* server */ 1083 if (laddr->address.ss_len > 0) { 1084 pos += printaddr(&laddr->address); 1085 break; 1086 } 1087 /* client */ 1088 p = *(kvaddr_t*)&(faddr->address); 1089 if (p == 0) { 1090 pos += xprintf("(not connected)"); 1091 offset += opt_w ? 92 : 44; 1092 break; 1093 } 1094 pos += xprintf("-> "); 1095 for (hash = 0; hash < HASHSIZE; ++hash) { 1096 for (s_tmp = sockhash[hash]; 1097 s_tmp != NULL; 1098 s_tmp = s_tmp->next) 1099 if (s_tmp->pcb == p) 1100 break; 1101 if (s_tmp != NULL) 1102 break; 1103 } 1104 if (s_tmp == NULL || s_tmp->laddr == NULL || 1105 s_tmp->laddr->address.ss_len == 0) 1106 pos += xprintf("??"); 1107 else 1108 pos += printaddr(&s_tmp->laddr->address); 1109 offset += opt_w ? 92 : 44; 1110 break; 1111 default: 1112 abort(); 1113 } 1114 if (opt_i) { 1115 if (s->proto == IPPROTO_TCP || 1116 s->proto == IPPROTO_UDP) { 1117 while (pos < offset) 1118 pos += xprintf(" "); 1119 pos += xprintf("%" PRIu64, s->inp_gencnt); 1120 } 1121 offset += 9; 1122 } 1123 if (opt_U) { 1124 if (faddr != NULL && 1125 ((s->proto == IPPROTO_SCTP && 1126 s->state != SCTP_CLOSED && 1127 s->state != SCTP_BOUND && 1128 s->state != SCTP_LISTEN) || 1129 (s->proto == IPPROTO_TCP && 1130 s->state != TCPS_CLOSED && 1131 s->state != TCPS_LISTEN))) { 1132 while (pos < offset) 1133 pos += xprintf(" "); 1134 pos += xprintf("%u", 1135 ntohs(faddr->encaps_port)); 1136 } 1137 offset += 7; 1138 } 1139 if (opt_s) { 1140 if (faddr != NULL && 1141 s->proto == IPPROTO_SCTP && 1142 s->state != SCTP_CLOSED && 1143 s->state != SCTP_BOUND && 1144 s->state != SCTP_LISTEN) { 1145 while (pos < offset) 1146 pos += xprintf(" "); 1147 pos += xprintf("%s", 1148 sctp_path_state(faddr->state)); 1149 } 1150 offset += 13; 1151 } 1152 if (first) { 1153 if (opt_s) { 1154 if (s->proto == IPPROTO_SCTP || 1155 s->proto == IPPROTO_TCP) { 1156 while (pos < offset) 1157 pos += xprintf(" "); 1158 switch (s->proto) { 1159 case IPPROTO_SCTP: 1160 pos += xprintf("%s", 1161 sctp_conn_state(s->state)); 1162 break; 1163 case IPPROTO_TCP: 1164 if (s->state >= 0 && 1165 s->state < TCP_NSTATES) 1166 pos += xprintf("%s", 1167 tcpstates[s->state]); 1168 else 1169 pos += xprintf("?"); 1170 break; 1171 } 1172 } 1173 offset += 13; 1174 } 1175 if (opt_S) { 1176 if (s->proto == IPPROTO_TCP) { 1177 while (pos < offset) 1178 pos += xprintf(" "); 1179 pos += xprintf("%.*s", 1180 TCP_FUNCTION_NAME_LEN_MAX, 1181 s->stack); 1182 } 1183 offset += TCP_FUNCTION_NAME_LEN_MAX + 1; 1184 } 1185 if (opt_C) { 1186 if (s->proto == IPPROTO_TCP) { 1187 while (pos < offset) 1188 pos += xprintf(" "); 1189 xprintf("%.*s", TCP_CA_NAME_MAX, s->cc); 1190 } 1191 offset += TCP_CA_NAME_MAX + 1; 1192 } 1193 } 1194 if (laddr != NULL) 1195 laddr = laddr->next; 1196 if (faddr != NULL) 1197 faddr = faddr->next; 1198 if ((laddr != NULL) || (faddr != NULL)) { 1199 xprintf("\n"); 1200 pos = 0; 1201 } 1202 first = 0; 1203 } 1204 xprintf("\n"); 1205 } 1206 1207 static void 1208 display(void) 1209 { 1210 struct passwd *pwd; 1211 struct xfile *xf; 1212 struct sock *s; 1213 int hash, n, pos; 1214 1215 if (opt_q != 1) { 1216 printf("%-8s %-10s %-5s %-2s %-6s %-*s %-*s", 1217 "USER", "COMMAND", "PID", "FD", "PROTO", 1218 opt_w ? 45 : 21, "LOCAL ADDRESS", 1219 opt_w ? 45 : 21, "FOREIGN ADDRESS"); 1220 if (opt_i) 1221 printf(" %-8s", "ID"); 1222 if (opt_U) 1223 printf(" %-6s", "ENCAPS"); 1224 if (opt_s) { 1225 printf(" %-12s", "PATH STATE"); 1226 printf(" %-12s", "CONN STATE"); 1227 } 1228 if (opt_S) 1229 printf(" %-*.*s", TCP_FUNCTION_NAME_LEN_MAX, 1230 TCP_FUNCTION_NAME_LEN_MAX, "STACK"); 1231 if (opt_C) 1232 printf(" %-.*s", TCP_CA_NAME_MAX, "CC"); 1233 printf("\n"); 1234 } 1235 cap_setpassent(cappwd, 1); 1236 for (xf = xfiles, n = 0; n < nxfiles; ++n, ++xf) { 1237 if (xf->xf_data == 0) 1238 continue; 1239 if (opt_j >= 0 && opt_j != getprocjid(xf->xf_pid)) 1240 continue; 1241 hash = (int)((uintptr_t)xf->xf_data % HASHSIZE); 1242 for (s = sockhash[hash]; s != NULL; s = s->next) { 1243 if (s->socket != xf->xf_data) 1244 continue; 1245 if (!check_ports(s)) 1246 continue; 1247 s->shown = 1; 1248 pos = 0; 1249 if (opt_n || 1250 (pwd = cap_getpwuid(cappwd, xf->xf_uid)) == NULL) 1251 pos += xprintf("%lu ", (u_long)xf->xf_uid); 1252 else 1253 pos += xprintf("%s ", pwd->pw_name); 1254 while (pos < 9) 1255 pos += xprintf(" "); 1256 pos += xprintf("%.10s", getprocname(xf->xf_pid)); 1257 while (pos < 20) 1258 pos += xprintf(" "); 1259 pos += xprintf("%lu ", (u_long)xf->xf_pid); 1260 while (pos < 26) 1261 pos += xprintf(" "); 1262 pos += xprintf("%d ", xf->xf_fd); 1263 displaysock(s, pos); 1264 } 1265 } 1266 if (opt_j >= 0) 1267 return; 1268 for (hash = 0; hash < HASHSIZE; hash++) { 1269 for (s = sockhash[hash]; s != NULL; s = s->next) { 1270 if (s->shown) 1271 continue; 1272 if (!check_ports(s)) 1273 continue; 1274 pos = 0; 1275 pos += xprintf("%-8s %-10s %-5s %-2s ", 1276 "?", "?", "?", "?"); 1277 displaysock(s, pos); 1278 } 1279 } 1280 } 1281 1282 static int 1283 set_default_protos(void) 1284 { 1285 struct protoent *prot; 1286 const char *pname; 1287 size_t pindex; 1288 1289 init_protos(default_numprotos); 1290 1291 for (pindex = 0; pindex < default_numprotos; pindex++) { 1292 pname = default_protos[pindex]; 1293 prot = cap_getprotobyname(capnetdb, pname); 1294 if (prot == NULL) 1295 err(1, "cap_getprotobyname: %s", pname); 1296 protos[pindex] = prot->p_proto; 1297 } 1298 numprotos = pindex; 1299 return (pindex); 1300 } 1301 1302 /* 1303 * Return the vnet property of the jail, or -1 on error. 1304 */ 1305 static int 1306 jail_getvnet(int jid) 1307 { 1308 struct iovec jiov[6]; 1309 int vnet; 1310 size_t len = sizeof(vnet); 1311 1312 if (sysctlbyname("kern.features.vimage", &vnet, &len, NULL, 0) != 0) 1313 return (0); 1314 1315 vnet = -1; 1316 jiov[0].iov_base = __DECONST(char *, "jid"); 1317 jiov[0].iov_len = sizeof("jid"); 1318 jiov[1].iov_base = &jid; 1319 jiov[1].iov_len = sizeof(jid); 1320 jiov[2].iov_base = __DECONST(char *, "vnet"); 1321 jiov[2].iov_len = sizeof("vnet"); 1322 jiov[3].iov_base = &vnet; 1323 jiov[3].iov_len = sizeof(vnet); 1324 jiov[4].iov_base = __DECONST(char *, "errmsg"); 1325 jiov[4].iov_len = sizeof("errmsg"); 1326 jiov[5].iov_base = jail_errmsg; 1327 jiov[5].iov_len = JAIL_ERRMSGLEN; 1328 jail_errmsg[0] = '\0'; 1329 if (jail_get(jiov, nitems(jiov), 0) < 0) { 1330 if (!jail_errmsg[0]) 1331 snprintf(jail_errmsg, JAIL_ERRMSGLEN, 1332 "jail_get: %s", strerror(errno)); 1333 return (-1); 1334 } 1335 return (vnet); 1336 } 1337 1338 static void 1339 usage(void) 1340 { 1341 fprintf(stderr, 1342 "usage: sockstat [-46CciLlnqSsUuvw] [-j jid] [-p ports] [-P protocols]\n"); 1343 exit(1); 1344 } 1345 1346 int 1347 main(int argc, char *argv[]) 1348 { 1349 cap_channel_t *capcas; 1350 cap_net_limit_t *limit; 1351 const char *pwdcmds[] = { "setpassent", "getpwuid" }; 1352 const char *pwdfields[] = { "pw_name" }; 1353 int protos_defined = -1; 1354 int o, i; 1355 1356 opt_j = -1; 1357 while ((o = getopt(argc, argv, "46Ccij:Llnp:P:qSsUuvw")) != -1) 1358 switch (o) { 1359 case '4': 1360 opt_4 = 1; 1361 break; 1362 case '6': 1363 opt_6 = 1; 1364 break; 1365 case 'C': 1366 opt_C = 1; 1367 break; 1368 case 'c': 1369 opt_c = 1; 1370 break; 1371 case 'i': 1372 opt_i = 1; 1373 break; 1374 case 'j': 1375 opt_j = jail_getid(optarg); 1376 if (opt_j < 0) 1377 errx(1, "jail_getid: %s", jail_errmsg); 1378 break; 1379 case 'L': 1380 opt_L = 1; 1381 break; 1382 case 'l': 1383 opt_l = 1; 1384 break; 1385 case 'n': 1386 opt_n = 1; 1387 break; 1388 case 'p': 1389 parse_ports(optarg); 1390 break; 1391 case 'P': 1392 protos_defined = parse_protos(optarg); 1393 break; 1394 case 'q': 1395 opt_q = 1; 1396 break; 1397 case 'S': 1398 opt_S = 1; 1399 break; 1400 case 's': 1401 opt_s = 1; 1402 break; 1403 case 'U': 1404 opt_U = 1; 1405 break; 1406 case 'u': 1407 opt_u = 1; 1408 break; 1409 case 'v': 1410 ++opt_v; 1411 break; 1412 case 'w': 1413 opt_w = 1; 1414 break; 1415 default: 1416 usage(); 1417 } 1418 1419 argc -= optind; 1420 argv += optind; 1421 1422 if (argc > 0) 1423 usage(); 1424 1425 if (opt_j > 0) { 1426 switch (jail_getvnet(opt_j)) { 1427 case -1: 1428 errx(2, "jail_getvnet: %s", jail_errmsg); 1429 case JAIL_SYS_NEW: 1430 if (jail_attach(opt_j) < 0) 1431 err(3, "jail_attach()"); 1432 /* Set back to -1 for normal output in vnet jail. */ 1433 opt_j = -1; 1434 break; 1435 default: 1436 break; 1437 } 1438 } 1439 1440 capcas = cap_init(); 1441 if (capcas == NULL) 1442 err(1, "Unable to contact Casper"); 1443 if (caph_enter_casper() < 0) 1444 err(1, "Unable to enter capability mode"); 1445 capnet = cap_service_open(capcas, "system.net"); 1446 if (capnet == NULL) 1447 err(1, "Unable to open system.net service"); 1448 capnetdb = cap_service_open(capcas, "system.netdb"); 1449 if (capnetdb == NULL) 1450 err(1, "Unable to open system.netdb service"); 1451 capsysctl = cap_service_open(capcas, "system.sysctl"); 1452 if (capsysctl == NULL) 1453 err(1, "Unable to open system.sysctl service"); 1454 cappwd = cap_service_open(capcas, "system.pwd"); 1455 if (cappwd == NULL) 1456 err(1, "Unable to open system.pwd service"); 1457 cap_close(capcas); 1458 limit = cap_net_limit_init(capnet, CAPNET_ADDR2NAME); 1459 if (limit == NULL) 1460 err(1, "Unable to init cap_net limits"); 1461 if (cap_net_limit(limit) < 0) 1462 err(1, "Unable to apply limits"); 1463 if (cap_pwd_limit_cmds(cappwd, pwdcmds, nitems(pwdcmds)) < 0) 1464 err(1, "Unable to apply pwd commands limits"); 1465 if (cap_pwd_limit_fields(cappwd, pwdfields, nitems(pwdfields)) < 0) 1466 err(1, "Unable to apply pwd commands limits"); 1467 1468 if ((!opt_4 && !opt_6) && protos_defined != -1) 1469 opt_4 = opt_6 = 1; 1470 if (!opt_4 && !opt_6 && !opt_u) 1471 opt_4 = opt_6 = opt_u = 1; 1472 if ((opt_4 || opt_6) && protos_defined == -1) 1473 protos_defined = set_default_protos(); 1474 if (!opt_c && !opt_l) 1475 opt_c = opt_l = 1; 1476 1477 if (opt_4 || opt_6) { 1478 for (i = 0; i < protos_defined; i++) 1479 if (protos[i] == IPPROTO_SCTP) 1480 gather_sctp(); 1481 else 1482 gather_inet(protos[i]); 1483 } 1484 1485 if (opt_u || (protos_defined == -1 && !opt_4 && !opt_6)) { 1486 gather_unix(SOCK_STREAM); 1487 gather_unix(SOCK_DGRAM); 1488 gather_unix(SOCK_SEQPACKET); 1489 } 1490 getfiles(); 1491 display(); 1492 exit(0); 1493 } 1494