1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #include <sys/types.h> 28 #include <sys/t_lock.h> 29 #include <sys/param.h> 30 #include <sys/systm.h> 31 #include <sys/buf.h> 32 #include <sys/conf.h> 33 #include <sys/cred.h> 34 #include <sys/kmem.h> 35 #include <sys/sysmacros.h> 36 #include <sys/vfs.h> 37 #include <sys/vfs_opreg.h> 38 #include <sys/vnode.h> 39 #include <sys/debug.h> 40 #include <sys/errno.h> 41 #include <sys/time.h> 42 #include <sys/file.h> 43 #include <sys/open.h> 44 #include <sys/user.h> 45 #include <sys/termios.h> 46 #include <sys/stream.h> 47 #include <sys/strsubr.h> 48 #include <sys/strsun.h> 49 #include <sys/esunddi.h> 50 #include <sys/flock.h> 51 #include <sys/modctl.h> 52 #include <sys/cmn_err.h> 53 #include <sys/mkdev.h> 54 #include <sys/pathname.h> 55 #include <sys/ddi.h> 56 #include <sys/stat.h> 57 #include <sys/fs/snode.h> 58 #include <sys/fs/dv_node.h> 59 #include <sys/zone.h> 60 61 #include <sys/socket.h> 62 #include <sys/socketvar.h> 63 #include <netinet/in.h> 64 #include <sys/un.h> 65 #include <sys/ucred.h> 66 67 #include <sys/tiuser.h> 68 #define _SUN_TPI_VERSION 2 69 #include <sys/tihdr.h> 70 71 #include <c2/audit.h> 72 73 #include <fs/sockfs/nl7c.h> 74 #include <fs/sockfs/sockcommon.h> 75 #include <fs/sockfs/socktpi.h> 76 #include <fs/sockfs/socktpi_impl.h> 77 #include <fs/sockfs/sodirect.h> 78 79 /* 80 * Macros that operate on struct cmsghdr. 81 * The CMSG_VALID macro does not assume that the last option buffer is padded. 82 */ 83 #define CMSG_CONTENT(cmsg) (&((cmsg)[1])) 84 #define CMSG_CONTENTLEN(cmsg) ((cmsg)->cmsg_len - sizeof (struct cmsghdr)) 85 #define CMSG_VALID(cmsg, start, end) \ 86 (ISALIGNED_cmsghdr(cmsg) && \ 87 ((uintptr_t)(cmsg) >= (uintptr_t)(start)) && \ 88 ((uintptr_t)(cmsg) < (uintptr_t)(end)) && \ 89 ((ssize_t)(cmsg)->cmsg_len >= sizeof (struct cmsghdr)) && \ 90 ((uintptr_t)(cmsg) + (cmsg)->cmsg_len <= (uintptr_t)(end))) 91 #define SO_LOCK_WAKEUP_TIME 3000 /* Wakeup time in milliseconds */ 92 93 dev_t sockdev; /* For fsid in getattr */ 94 int sockfs_defer_nl7c_init = 0; 95 96 struct socklist socklist; 97 98 struct kmem_cache *socket_cache; 99 100 static int sockfs_update(kstat_t *, int); 101 static int sockfs_snapshot(kstat_t *, void *, int); 102 extern smod_info_t *sotpi_smod_create(void); 103 104 extern void sendfile_init(); 105 106 extern void nl7c_init(void); 107 108 extern int modrootloaded; 109 110 #define ADRSTRLEN (2 * sizeof (void *) + 1) 111 /* 112 * kernel structure for passing the sockinfo data back up to the user. 113 * the strings array allows us to convert AF_UNIX addresses into strings 114 * with a common method regardless of which n-bit kernel we're running. 115 */ 116 struct k_sockinfo { 117 struct sockinfo ks_si; 118 char ks_straddr[3][ADRSTRLEN]; 119 }; 120 121 /* 122 * Translate from a device pathname (e.g. "/dev/tcp") to a vnode. 123 * Returns with the vnode held. 124 */ 125 int 126 sogetvp(char *devpath, vnode_t **vpp, int uioflag) 127 { 128 struct snode *csp; 129 vnode_t *vp, *dvp; 130 major_t maj; 131 int error; 132 133 ASSERT(uioflag == UIO_SYSSPACE || uioflag == UIO_USERSPACE); 134 135 /* 136 * Lookup the underlying filesystem vnode. 137 */ 138 error = lookupname(devpath, uioflag, FOLLOW, NULLVPP, &vp); 139 if (error) 140 return (error); 141 142 /* Check that it is the correct vnode */ 143 if (vp->v_type != VCHR) { 144 VN_RELE(vp); 145 return (ENOTSOCK); 146 } 147 148 /* 149 * If devpath went through devfs, the device should already 150 * be configured. If devpath is a mknod file, however, we 151 * need to make sure the device is properly configured. 152 * To do this, we do something similar to spec_open() 153 * except that we resolve to the minor/leaf level since 154 * we need to return a vnode. 155 */ 156 csp = VTOS(VTOS(vp)->s_commonvp); 157 if (!(csp->s_flag & SDIPSET)) { 158 char *pathname = kmem_alloc(MAXPATHLEN, KM_SLEEP); 159 error = ddi_dev_pathname(vp->v_rdev, S_IFCHR, pathname); 160 if (error == 0) 161 error = devfs_lookupname(pathname, NULLVPP, &dvp); 162 VN_RELE(vp); 163 kmem_free(pathname, MAXPATHLEN); 164 if (error != 0) 165 return (ENXIO); 166 vp = dvp; /* use the devfs vp */ 167 } 168 169 /* device is configured at this point */ 170 maj = getmajor(vp->v_rdev); 171 if (!STREAMSTAB(maj)) { 172 VN_RELE(vp); 173 return (ENOSTR); 174 } 175 176 *vpp = vp; 177 return (0); 178 } 179 180 /* 181 * Update the accessed, updated, or changed times in an sonode 182 * with the current time. 183 * 184 * Note that both SunOS 4.X and 4.4BSD sockets do not present reasonable 185 * attributes in a fstat call. (They return the current time and 0 for 186 * all timestamps, respectively.) We maintain the current timestamps 187 * here primarily so that should sockmod be popped the resulting 188 * file descriptor will behave like a stream w.r.t. the timestamps. 189 */ 190 void 191 so_update_attrs(struct sonode *so, int flag) 192 { 193 time_t now = gethrestime_sec(); 194 195 if (SOCK_IS_NONSTR(so)) 196 return; 197 198 mutex_enter(&so->so_lock); 199 so->so_flag |= flag; 200 if (flag & SOACC) 201 SOTOTPI(so)->sti_atime = now; 202 if (flag & SOMOD) 203 SOTOTPI(so)->sti_mtime = now; 204 mutex_exit(&so->so_lock); 205 } 206 207 extern so_create_func_t sock_comm_create_function; 208 extern so_destroy_func_t sock_comm_destroy_function; 209 /* 210 * Init function called when sockfs is loaded. 211 */ 212 int 213 sockinit(int fstype, char *name) 214 { 215 static const fs_operation_def_t sock_vfsops_template[] = { 216 NULL, NULL 217 }; 218 int error; 219 major_t dev; 220 char *err_str; 221 222 error = vfs_setfsops(fstype, sock_vfsops_template, NULL); 223 if (error != 0) { 224 zcmn_err(GLOBAL_ZONEID, CE_WARN, 225 "sockinit: bad vfs ops template"); 226 return (error); 227 } 228 229 error = vn_make_ops(name, socket_vnodeops_template, 230 &socket_vnodeops); 231 if (error != 0) { 232 err_str = "sockinit: bad socket vnode ops template"; 233 /* vn_make_ops() does not reset socktpi_vnodeops on failure. */ 234 socket_vnodeops = NULL; 235 goto failure; 236 } 237 238 socket_cache = kmem_cache_create("socket_cache", 239 sizeof (struct sonode), 0, sonode_constructor, 240 sonode_destructor, NULL, NULL, NULL, 0); 241 242 error = socktpi_init(); 243 if (error != 0) { 244 err_str = NULL; 245 goto failure; 246 } 247 248 error = sod_init(); 249 if (error != 0) { 250 err_str = NULL; 251 goto failure; 252 } 253 254 /* 255 * Set up the default create and destroy functions 256 */ 257 sock_comm_create_function = socket_sonode_create; 258 sock_comm_destroy_function = socket_sonode_destroy; 259 260 /* 261 * Build initial list mapping socket parameters to vnode. 262 */ 263 smod_init(); 264 smod_add(sotpi_smod_create()); 265 266 sockparams_init(); 267 268 /* 269 * If sockets are needed before init runs /sbin/soconfig 270 * it is possible to preload the sockparams list here using 271 * calls like: 272 * sockconfig(1,2,3, "/dev/tcp", 0); 273 */ 274 275 /* 276 * Create a unique dev_t for use in so_fsid. 277 */ 278 279 if ((dev = getudev()) == (major_t)-1) 280 dev = 0; 281 sockdev = makedevice(dev, 0); 282 283 mutex_init(&socklist.sl_lock, NULL, MUTEX_DEFAULT, NULL); 284 sendfile_init(); 285 if (!modrootloaded) { 286 sockfs_defer_nl7c_init = 1; 287 } else { 288 nl7c_init(); 289 } 290 291 return (0); 292 293 failure: 294 (void) vfs_freevfsops_by_type(fstype); 295 if (socket_vnodeops != NULL) 296 vn_freevnodeops(socket_vnodeops); 297 if (err_str != NULL) 298 zcmn_err(GLOBAL_ZONEID, CE_WARN, err_str); 299 return (error); 300 } 301 302 /* 303 * Caller must hold the mutex. Used to set SOLOCKED. 304 */ 305 void 306 so_lock_single(struct sonode *so) 307 { 308 ASSERT(MUTEX_HELD(&so->so_lock)); 309 310 while (so->so_flag & (SOLOCKED | SOASYNC_UNBIND)) { 311 cv_wait_stop(&so->so_single_cv, &so->so_lock, 312 SO_LOCK_WAKEUP_TIME); 313 } 314 so->so_flag |= SOLOCKED; 315 } 316 317 /* 318 * Caller must hold the mutex and pass in SOLOCKED or SOASYNC_UNBIND. 319 * Used to clear SOLOCKED or SOASYNC_UNBIND. 320 */ 321 void 322 so_unlock_single(struct sonode *so, int flag) 323 { 324 ASSERT(MUTEX_HELD(&so->so_lock)); 325 ASSERT(flag & (SOLOCKED|SOASYNC_UNBIND)); 326 ASSERT((flag & ~(SOLOCKED|SOASYNC_UNBIND)) == 0); 327 ASSERT(so->so_flag & flag); 328 /* 329 * Process the T_DISCON_IND on sti_discon_ind_mp. 330 * 331 * Call to so_drain_discon_ind will result in so_lock 332 * being dropped and re-acquired later. 333 */ 334 if (!SOCK_IS_NONSTR(so)) { 335 sotpi_info_t *sti = SOTOTPI(so); 336 337 if (sti->sti_discon_ind_mp != NULL) 338 so_drain_discon_ind(so); 339 } 340 341 cv_signal(&so->so_single_cv); 342 so->so_flag &= ~flag; 343 } 344 345 /* 346 * Caller must hold the mutex. Used to set SOREADLOCKED. 347 * If the caller wants nonblocking behavior it should set fmode. 348 */ 349 int 350 so_lock_read(struct sonode *so, int fmode) 351 { 352 ASSERT(MUTEX_HELD(&so->so_lock)); 353 354 while (so->so_flag & SOREADLOCKED) { 355 if (fmode & (FNDELAY|FNONBLOCK)) 356 return (EWOULDBLOCK); 357 cv_wait_stop(&so->so_read_cv, &so->so_lock, 358 SO_LOCK_WAKEUP_TIME); 359 } 360 so->so_flag |= SOREADLOCKED; 361 return (0); 362 } 363 364 /* 365 * Like so_lock_read above but allows signals. 366 */ 367 int 368 so_lock_read_intr(struct sonode *so, int fmode) 369 { 370 ASSERT(MUTEX_HELD(&so->so_lock)); 371 372 while (so->so_flag & SOREADLOCKED) { 373 if (fmode & (FNDELAY|FNONBLOCK)) 374 return (EWOULDBLOCK); 375 if (!cv_wait_sig(&so->so_read_cv, &so->so_lock)) 376 return (EINTR); 377 } 378 so->so_flag |= SOREADLOCKED; 379 return (0); 380 } 381 382 /* 383 * Caller must hold the mutex. Used to clear SOREADLOCKED, 384 * set in so_lock_read() or so_lock_read_intr(). 385 */ 386 void 387 so_unlock_read(struct sonode *so) 388 { 389 ASSERT(MUTEX_HELD(&so->so_lock)); 390 ASSERT(so->so_flag & SOREADLOCKED); 391 392 cv_signal(&so->so_read_cv); 393 so->so_flag &= ~SOREADLOCKED; 394 } 395 396 /* 397 * Verify that the specified offset falls within the mblk and 398 * that the resulting pointer is aligned. 399 * Returns NULL if not. 400 */ 401 void * 402 sogetoff(mblk_t *mp, t_uscalar_t offset, 403 t_uscalar_t length, uint_t align_size) 404 { 405 uintptr_t ptr1, ptr2; 406 407 ASSERT(mp && mp->b_wptr >= mp->b_rptr); 408 ptr1 = (uintptr_t)mp->b_rptr + offset; 409 ptr2 = (uintptr_t)ptr1 + length; 410 if (ptr1 < (uintptr_t)mp->b_rptr || ptr2 > (uintptr_t)mp->b_wptr) { 411 eprintline(0); 412 return (NULL); 413 } 414 if ((ptr1 & (align_size - 1)) != 0) { 415 eprintline(0); 416 return (NULL); 417 } 418 return ((void *)ptr1); 419 } 420 421 /* 422 * Return the AF_UNIX underlying filesystem vnode matching a given name. 423 * Makes sure the sending and the destination sonodes are compatible. 424 * The vnode is returned held. 425 * 426 * The underlying filesystem VSOCK vnode has a v_stream pointer that 427 * references the actual stream head (hence indirectly the actual sonode). 428 */ 429 static int 430 so_ux_lookup(struct sonode *so, struct sockaddr_un *soun, int checkaccess, 431 vnode_t **vpp) 432 { 433 vnode_t *vp; /* Underlying filesystem vnode */ 434 vnode_t *rvp; /* real vnode */ 435 vnode_t *svp; /* sockfs vnode */ 436 struct sonode *so2; 437 int error; 438 439 dprintso(so, 1, ("so_ux_lookup(%p) name <%s>\n", (void *)so, 440 soun->sun_path)); 441 442 error = lookupname(soun->sun_path, UIO_SYSSPACE, FOLLOW, NULLVPP, &vp); 443 if (error) { 444 eprintsoline(so, error); 445 return (error); 446 } 447 448 /* 449 * Traverse lofs mounts get the real vnode 450 */ 451 if (VOP_REALVP(vp, &rvp, NULL) == 0) { 452 VN_HOLD(rvp); /* hold the real vnode */ 453 VN_RELE(vp); /* release hold from lookup */ 454 vp = rvp; 455 } 456 457 if (vp->v_type != VSOCK) { 458 error = ENOTSOCK; 459 eprintsoline(so, error); 460 goto done2; 461 } 462 463 if (checkaccess) { 464 /* 465 * Check that we have permissions to access the destination 466 * vnode. This check is not done in BSD but it is required 467 * by X/Open. 468 */ 469 if (error = VOP_ACCESS(vp, VREAD|VWRITE, 0, CRED(), NULL)) { 470 eprintsoline(so, error); 471 goto done2; 472 } 473 } 474 475 /* 476 * Check if the remote socket has been closed. 477 * 478 * Synchronize with vn_rele_stream by holding v_lock while traversing 479 * v_stream->sd_vnode. 480 */ 481 mutex_enter(&vp->v_lock); 482 if (vp->v_stream == NULL) { 483 mutex_exit(&vp->v_lock); 484 if (so->so_type == SOCK_DGRAM) 485 error = EDESTADDRREQ; 486 else 487 error = ECONNREFUSED; 488 489 eprintsoline(so, error); 490 goto done2; 491 } 492 ASSERT(vp->v_stream->sd_vnode); 493 svp = vp->v_stream->sd_vnode; 494 /* 495 * holding v_lock on underlying filesystem vnode and acquiring 496 * it on sockfs vnode. Assumes that no code ever attempts to 497 * acquire these locks in the reverse order. 498 */ 499 VN_HOLD(svp); 500 mutex_exit(&vp->v_lock); 501 502 if (svp->v_type != VSOCK) { 503 error = ENOTSOCK; 504 eprintsoline(so, error); 505 goto done; 506 } 507 508 so2 = VTOSO(svp); 509 510 if (so->so_type != so2->so_type) { 511 error = EPROTOTYPE; 512 eprintsoline(so, error); 513 goto done; 514 } 515 516 VN_RELE(svp); 517 *vpp = vp; 518 return (0); 519 520 done: 521 VN_RELE(svp); 522 done2: 523 VN_RELE(vp); 524 return (error); 525 } 526 527 /* 528 * Verify peer address for connect and sendto/sendmsg. 529 * Since sendto/sendmsg would not get synchronous errors from the transport 530 * provider we have to do these ugly checks in the socket layer to 531 * preserve compatibility with SunOS 4.X. 532 */ 533 int 534 so_addr_verify(struct sonode *so, const struct sockaddr *name, 535 socklen_t namelen) 536 { 537 int family; 538 539 dprintso(so, 1, ("so_addr_verify(%p, %p, %d)\n", 540 (void *)so, (void *)name, namelen)); 541 542 ASSERT(name != NULL); 543 544 family = so->so_family; 545 switch (family) { 546 case AF_INET: 547 if (name->sa_family != family) { 548 eprintsoline(so, EAFNOSUPPORT); 549 return (EAFNOSUPPORT); 550 } 551 if (namelen != (socklen_t)sizeof (struct sockaddr_in)) { 552 eprintsoline(so, EINVAL); 553 return (EINVAL); 554 } 555 break; 556 case AF_INET6: { 557 #ifdef DEBUG 558 struct sockaddr_in6 *sin6; 559 #endif /* DEBUG */ 560 561 if (name->sa_family != family) { 562 eprintsoline(so, EAFNOSUPPORT); 563 return (EAFNOSUPPORT); 564 } 565 if (namelen != (socklen_t)sizeof (struct sockaddr_in6)) { 566 eprintsoline(so, EINVAL); 567 return (EINVAL); 568 } 569 #ifdef DEBUG 570 /* Verify that apps don't forget to clear sin6_scope_id etc */ 571 sin6 = (struct sockaddr_in6 *)name; 572 if (sin6->sin6_scope_id != 0 && 573 !IN6_IS_ADDR_LINKSCOPE(&sin6->sin6_addr)) { 574 zcmn_err(getzoneid(), CE_WARN, 575 "connect/send* with uninitialized sin6_scope_id " 576 "(%d) on socket. Pid = %d\n", 577 (int)sin6->sin6_scope_id, (int)curproc->p_pid); 578 } 579 #endif /* DEBUG */ 580 break; 581 } 582 case AF_UNIX: 583 if (SOTOTPI(so)->sti_faddr_noxlate) { 584 return (0); 585 } 586 if (namelen < (socklen_t)sizeof (short)) { 587 eprintsoline(so, ENOENT); 588 return (ENOENT); 589 } 590 if (name->sa_family != family) { 591 eprintsoline(so, EAFNOSUPPORT); 592 return (EAFNOSUPPORT); 593 } 594 /* MAXPATHLEN + soun_family + nul termination */ 595 if (namelen > (socklen_t)(MAXPATHLEN + sizeof (short) + 1)) { 596 eprintsoline(so, ENAMETOOLONG); 597 return (ENAMETOOLONG); 598 } 599 600 break; 601 602 default: 603 /* 604 * Default is don't do any length or sa_family check 605 * to allow non-sockaddr style addresses. 606 */ 607 break; 608 } 609 610 return (0); 611 } 612 613 614 /* 615 * Translate an AF_UNIX sockaddr_un to the transport internal name. 616 * Assumes caller has called so_addr_verify first. 617 */ 618 /*ARGSUSED*/ 619 int 620 so_ux_addr_xlate(struct sonode *so, struct sockaddr *name, 621 socklen_t namelen, int checkaccess, 622 void **addrp, socklen_t *addrlenp) 623 { 624 int error; 625 struct sockaddr_un *soun; 626 vnode_t *vp; 627 void *addr; 628 socklen_t addrlen; 629 sotpi_info_t *sti = SOTOTPI(so); 630 631 dprintso(so, 1, ("so_ux_addr_xlate(%p, %p, %d, %d)\n", 632 (void *)so, (void *)name, namelen, checkaccess)); 633 634 ASSERT(name != NULL); 635 ASSERT(so->so_family == AF_UNIX); 636 ASSERT(!sti->sti_faddr_noxlate); 637 ASSERT(namelen >= (socklen_t)sizeof (short)); 638 ASSERT(name->sa_family == AF_UNIX); 639 soun = (struct sockaddr_un *)name; 640 /* 641 * Lookup vnode for the specified path name and verify that 642 * it is a socket. 643 */ 644 error = so_ux_lookup(so, soun, checkaccess, &vp); 645 if (error) { 646 eprintsoline(so, error); 647 return (error); 648 } 649 /* 650 * Use the address of the peer vnode as the address to send 651 * to. We release the peer vnode here. In case it has been 652 * closed by the time the T_CONN_REQ or T_UNIDATA_REQ reaches the 653 * transport the message will get an error or be dropped. 654 */ 655 sti->sti_ux_faddr.soua_vp = vp; 656 sti->sti_ux_faddr.soua_magic = SOU_MAGIC_EXPLICIT; 657 addr = &sti->sti_ux_faddr; 658 addrlen = (socklen_t)sizeof (sti->sti_ux_faddr); 659 dprintso(so, 1, ("ux_xlate UNIX: addrlen %d, vp %p\n", 660 addrlen, (void *)vp)); 661 VN_RELE(vp); 662 *addrp = addr; 663 *addrlenp = (socklen_t)addrlen; 664 return (0); 665 } 666 667 /* 668 * Esballoc free function for messages that contain SO_FILEP option. 669 * Decrement the reference count on the file pointers using closef. 670 */ 671 void 672 fdbuf_free(struct fdbuf *fdbuf) 673 { 674 int i; 675 struct file *fp; 676 677 dprint(1, ("fdbuf_free: %d fds\n", fdbuf->fd_numfd)); 678 for (i = 0; i < fdbuf->fd_numfd; i++) { 679 /* 680 * We need pointer size alignment for fd_fds. On a LP64 681 * kernel, the required alignment is 8 bytes while 682 * the option headers and values are only 4 bytes 683 * aligned. So its safer to do a bcopy compared to 684 * assigning fdbuf->fd_fds[i] to fp. 685 */ 686 bcopy((char *)&fdbuf->fd_fds[i], (char *)&fp, sizeof (fp)); 687 dprint(1, ("fdbuf_free: [%d] = %p\n", i, (void *)fp)); 688 (void) closef(fp); 689 } 690 if (fdbuf->fd_ebuf != NULL) 691 kmem_free(fdbuf->fd_ebuf, fdbuf->fd_ebuflen); 692 kmem_free(fdbuf, fdbuf->fd_size); 693 } 694 695 /* 696 * Allocate an esballoc'ed message for AF_UNIX file descriptor passing. 697 * Waits if memory is not available. 698 */ 699 mblk_t * 700 fdbuf_allocmsg(int size, struct fdbuf *fdbuf) 701 { 702 uchar_t *buf; 703 mblk_t *mp; 704 705 dprint(1, ("fdbuf_allocmsg: size %d, %d fds\n", size, fdbuf->fd_numfd)); 706 buf = kmem_alloc(size, KM_SLEEP); 707 fdbuf->fd_ebuf = (caddr_t)buf; 708 fdbuf->fd_ebuflen = size; 709 fdbuf->fd_frtn.free_func = fdbuf_free; 710 fdbuf->fd_frtn.free_arg = (caddr_t)fdbuf; 711 712 mp = esballoc_wait(buf, size, BPRI_MED, &fdbuf->fd_frtn); 713 mp->b_datap->db_type = M_PROTO; 714 return (mp); 715 } 716 717 /* 718 * Extract file descriptors from a fdbuf. 719 * Return list in rights/rightslen. 720 */ 721 /*ARGSUSED*/ 722 static int 723 fdbuf_extract(struct fdbuf *fdbuf, void *rights, int rightslen) 724 { 725 int i, fd; 726 int *rp; 727 struct file *fp; 728 int numfd; 729 730 dprint(1, ("fdbuf_extract: %d fds, len %d\n", 731 fdbuf->fd_numfd, rightslen)); 732 733 numfd = fdbuf->fd_numfd; 734 ASSERT(rightslen == numfd * (int)sizeof (int)); 735 736 /* 737 * Allocate a file descriptor and increment the f_count. 738 * The latter is needed since we always call fdbuf_free 739 * which performs a closef. 740 */ 741 rp = (int *)rights; 742 for (i = 0; i < numfd; i++) { 743 if ((fd = ufalloc(0)) == -1) 744 goto cleanup; 745 /* 746 * We need pointer size alignment for fd_fds. On a LP64 747 * kernel, the required alignment is 8 bytes while 748 * the option headers and values are only 4 bytes 749 * aligned. So its safer to do a bcopy compared to 750 * assigning fdbuf->fd_fds[i] to fp. 751 */ 752 bcopy((char *)&fdbuf->fd_fds[i], (char *)&fp, sizeof (fp)); 753 mutex_enter(&fp->f_tlock); 754 fp->f_count++; 755 mutex_exit(&fp->f_tlock); 756 setf(fd, fp); 757 *rp++ = fd; 758 if (AU_AUDITING()) 759 audit_fdrecv(fd, fp); 760 dprint(1, ("fdbuf_extract: [%d] = %d, %p refcnt %d\n", 761 i, fd, (void *)fp, fp->f_count)); 762 } 763 return (0); 764 765 cleanup: 766 /* 767 * Undo whatever partial work the loop above has done. 768 */ 769 { 770 int j; 771 772 rp = (int *)rights; 773 for (j = 0; j < i; j++) { 774 dprint(0, 775 ("fdbuf_extract: cleanup[%d] = %d\n", j, *rp)); 776 (void) closeandsetf(*rp++, NULL); 777 } 778 } 779 780 return (EMFILE); 781 } 782 783 /* 784 * Insert file descriptors into an fdbuf. 785 * Returns a kmem_alloc'ed fdbuf. The fdbuf should be freed 786 * by calling fdbuf_free(). 787 */ 788 int 789 fdbuf_create(void *rights, int rightslen, struct fdbuf **fdbufp) 790 { 791 int numfd, i; 792 int *fds; 793 struct file *fp; 794 struct fdbuf *fdbuf; 795 int fdbufsize; 796 797 dprint(1, ("fdbuf_create: len %d\n", rightslen)); 798 799 numfd = rightslen / (int)sizeof (int); 800 801 fdbufsize = (int)FDBUF_HDRSIZE + (numfd * (int)sizeof (struct file *)); 802 fdbuf = kmem_alloc(fdbufsize, KM_SLEEP); 803 fdbuf->fd_size = fdbufsize; 804 fdbuf->fd_numfd = 0; 805 fdbuf->fd_ebuf = NULL; 806 fdbuf->fd_ebuflen = 0; 807 fds = (int *)rights; 808 for (i = 0; i < numfd; i++) { 809 if ((fp = getf(fds[i])) == NULL) { 810 fdbuf_free(fdbuf); 811 return (EBADF); 812 } 813 dprint(1, ("fdbuf_create: [%d] = %d, %p refcnt %d\n", 814 i, fds[i], (void *)fp, fp->f_count)); 815 mutex_enter(&fp->f_tlock); 816 fp->f_count++; 817 mutex_exit(&fp->f_tlock); 818 /* 819 * The maximum alignment for fdbuf (or any option header 820 * and its value) it 4 bytes. On a LP64 kernel, the alignment 821 * is not sufficient for pointers (fd_fds in this case). Since 822 * we just did a kmem_alloc (we get a double word alignment), 823 * we don't need to do anything on the send side (we loose 824 * the double word alignment because fdbuf goes after an 825 * option header (eg T_unitdata_req) which is only 4 byte 826 * aligned). We take care of this when we extract the file 827 * descriptor in fdbuf_extract or fdbuf_free. 828 */ 829 fdbuf->fd_fds[i] = fp; 830 fdbuf->fd_numfd++; 831 releasef(fds[i]); 832 if (AU_AUDITING()) 833 audit_fdsend(fds[i], fp, 0); 834 } 835 *fdbufp = fdbuf; 836 return (0); 837 } 838 839 static int 840 fdbuf_optlen(int rightslen) 841 { 842 int numfd; 843 844 numfd = rightslen / (int)sizeof (int); 845 846 return ((int)FDBUF_HDRSIZE + (numfd * (int)sizeof (struct file *))); 847 } 848 849 static t_uscalar_t 850 fdbuf_cmsglen(int fdbuflen) 851 { 852 return (t_uscalar_t)((fdbuflen - FDBUF_HDRSIZE) / 853 (int)sizeof (struct file *) * (int)sizeof (int)); 854 } 855 856 857 /* 858 * Return non-zero if the mblk and fdbuf are consistent. 859 */ 860 static int 861 fdbuf_verify(mblk_t *mp, struct fdbuf *fdbuf, int fdbuflen) 862 { 863 if (fdbuflen >= FDBUF_HDRSIZE && 864 fdbuflen == fdbuf->fd_size) { 865 frtn_t *frp = mp->b_datap->db_frtnp; 866 /* 867 * Check that the SO_FILEP portion of the 868 * message has not been modified by 869 * the loopback transport. The sending sockfs generates 870 * a message that is esballoc'ed with the free function 871 * being fdbuf_free() and where free_arg contains the 872 * identical information as the SO_FILEP content. 873 * 874 * If any of these constraints are not satisfied we 875 * silently ignore the option. 876 */ 877 ASSERT(mp); 878 if (frp != NULL && 879 frp->free_func == fdbuf_free && 880 frp->free_arg != NULL && 881 bcmp(frp->free_arg, fdbuf, fdbuflen) == 0) { 882 dprint(1, ("fdbuf_verify: fdbuf %p len %d\n", 883 (void *)fdbuf, fdbuflen)); 884 return (1); 885 } else { 886 zcmn_err(getzoneid(), CE_WARN, 887 "sockfs: mismatched fdbuf content (%p)", 888 (void *)mp); 889 return (0); 890 } 891 } else { 892 zcmn_err(getzoneid(), CE_WARN, 893 "sockfs: mismatched fdbuf len %d, %d\n", 894 fdbuflen, fdbuf->fd_size); 895 return (0); 896 } 897 } 898 899 /* 900 * When the file descriptors returned by sorecvmsg can not be passed 901 * to the application this routine will cleanup the references on 902 * the files. Start at startoff bytes into the buffer. 903 */ 904 static void 905 close_fds(void *fdbuf, int fdbuflen, int startoff) 906 { 907 int *fds = (int *)fdbuf; 908 int numfd = fdbuflen / (int)sizeof (int); 909 int i; 910 911 dprint(1, ("close_fds(%p, %d, %d)\n", fdbuf, fdbuflen, startoff)); 912 913 for (i = 0; i < numfd; i++) { 914 if (startoff < 0) 915 startoff = 0; 916 if (startoff < (int)sizeof (int)) { 917 /* 918 * This file descriptor is partially or fully after 919 * the offset 920 */ 921 dprint(0, 922 ("close_fds: cleanup[%d] = %d\n", i, fds[i])); 923 (void) closeandsetf(fds[i], NULL); 924 } 925 startoff -= (int)sizeof (int); 926 } 927 } 928 929 /* 930 * Close all file descriptors contained in the control part starting at 931 * the startoffset. 932 */ 933 void 934 so_closefds(void *control, t_uscalar_t controllen, int oldflg, 935 int startoff) 936 { 937 struct cmsghdr *cmsg; 938 939 if (control == NULL) 940 return; 941 942 if (oldflg) { 943 close_fds(control, controllen, startoff); 944 return; 945 } 946 /* Scan control part for file descriptors. */ 947 for (cmsg = (struct cmsghdr *)control; 948 CMSG_VALID(cmsg, control, (uintptr_t)control + controllen); 949 cmsg = CMSG_NEXT(cmsg)) { 950 if (cmsg->cmsg_level == SOL_SOCKET && 951 cmsg->cmsg_type == SCM_RIGHTS) { 952 close_fds(CMSG_CONTENT(cmsg), 953 (int)CMSG_CONTENTLEN(cmsg), 954 startoff - (int)sizeof (struct cmsghdr)); 955 } 956 startoff -= cmsg->cmsg_len; 957 } 958 } 959 960 /* 961 * Returns a pointer/length for the file descriptors contained 962 * in the control buffer. Returns with *fdlenp == -1 if there are no 963 * file descriptor options present. This is different than there being 964 * a zero-length file descriptor option. 965 * Fail if there are multiple SCM_RIGHT cmsgs. 966 */ 967 int 968 so_getfdopt(void *control, t_uscalar_t controllen, int oldflg, 969 void **fdsp, int *fdlenp) 970 { 971 struct cmsghdr *cmsg; 972 void *fds; 973 int fdlen; 974 975 if (control == NULL) { 976 *fdsp = NULL; 977 *fdlenp = -1; 978 return (0); 979 } 980 981 if (oldflg) { 982 *fdsp = control; 983 if (controllen == 0) 984 *fdlenp = -1; 985 else 986 *fdlenp = controllen; 987 dprint(1, ("so_getfdopt: old %d\n", *fdlenp)); 988 return (0); 989 } 990 991 fds = NULL; 992 fdlen = 0; 993 994 for (cmsg = (struct cmsghdr *)control; 995 CMSG_VALID(cmsg, control, (uintptr_t)control + controllen); 996 cmsg = CMSG_NEXT(cmsg)) { 997 if (cmsg->cmsg_level == SOL_SOCKET && 998 cmsg->cmsg_type == SCM_RIGHTS) { 999 if (fds != NULL) 1000 return (EINVAL); 1001 fds = CMSG_CONTENT(cmsg); 1002 fdlen = (int)CMSG_CONTENTLEN(cmsg); 1003 dprint(1, ("so_getfdopt: new %lu\n", 1004 (size_t)CMSG_CONTENTLEN(cmsg))); 1005 } 1006 } 1007 if (fds == NULL) { 1008 dprint(1, ("so_getfdopt: NONE\n")); 1009 *fdlenp = -1; 1010 } else 1011 *fdlenp = fdlen; 1012 *fdsp = fds; 1013 return (0); 1014 } 1015 1016 /* 1017 * Return the length of the options including any file descriptor options. 1018 */ 1019 t_uscalar_t 1020 so_optlen(void *control, t_uscalar_t controllen, int oldflg) 1021 { 1022 struct cmsghdr *cmsg; 1023 t_uscalar_t optlen = 0; 1024 t_uscalar_t len; 1025 1026 if (control == NULL) 1027 return (0); 1028 1029 if (oldflg) 1030 return ((t_uscalar_t)(sizeof (struct T_opthdr) + 1031 fdbuf_optlen(controllen))); 1032 1033 for (cmsg = (struct cmsghdr *)control; 1034 CMSG_VALID(cmsg, control, (uintptr_t)control + controllen); 1035 cmsg = CMSG_NEXT(cmsg)) { 1036 if (cmsg->cmsg_level == SOL_SOCKET && 1037 cmsg->cmsg_type == SCM_RIGHTS) { 1038 len = fdbuf_optlen((int)CMSG_CONTENTLEN(cmsg)); 1039 } else { 1040 len = (t_uscalar_t)CMSG_CONTENTLEN(cmsg); 1041 } 1042 optlen += (t_uscalar_t)(_TPI_ALIGN_TOPT(len) + 1043 sizeof (struct T_opthdr)); 1044 } 1045 dprint(1, ("so_optlen: controllen %d, flg %d -> optlen %d\n", 1046 controllen, oldflg, optlen)); 1047 return (optlen); 1048 } 1049 1050 /* 1051 * Copy options from control to the mblk. Skip any file descriptor options. 1052 */ 1053 void 1054 so_cmsg2opt(void *control, t_uscalar_t controllen, int oldflg, mblk_t *mp) 1055 { 1056 struct T_opthdr toh; 1057 struct cmsghdr *cmsg; 1058 1059 if (control == NULL) 1060 return; 1061 1062 if (oldflg) { 1063 /* No real options - caller has handled file descriptors */ 1064 return; 1065 } 1066 for (cmsg = (struct cmsghdr *)control; 1067 CMSG_VALID(cmsg, control, (uintptr_t)control + controllen); 1068 cmsg = CMSG_NEXT(cmsg)) { 1069 /* 1070 * Note: The caller handles file descriptors prior 1071 * to calling this function. 1072 */ 1073 t_uscalar_t len; 1074 1075 if (cmsg->cmsg_level == SOL_SOCKET && 1076 cmsg->cmsg_type == SCM_RIGHTS) 1077 continue; 1078 1079 len = (t_uscalar_t)CMSG_CONTENTLEN(cmsg); 1080 toh.level = cmsg->cmsg_level; 1081 toh.name = cmsg->cmsg_type; 1082 toh.len = len + (t_uscalar_t)sizeof (struct T_opthdr); 1083 toh.status = 0; 1084 1085 soappendmsg(mp, &toh, sizeof (toh)); 1086 soappendmsg(mp, CMSG_CONTENT(cmsg), len); 1087 mp->b_wptr += _TPI_ALIGN_TOPT(len) - len; 1088 ASSERT(mp->b_wptr <= mp->b_datap->db_lim); 1089 } 1090 } 1091 1092 /* 1093 * Return the length of the control message derived from the options. 1094 * Exclude SO_SRCADDR and SO_UNIX_CLOSE options. Include SO_FILEP. 1095 * When oldflg is set only include SO_FILEP. 1096 * so_opt2cmsg and so_cmsglen are inter-related since so_cmsglen 1097 * allocates the space that so_opt2cmsg fills. If one changes, the other should 1098 * also be checked for any possible impacts. 1099 */ 1100 t_uscalar_t 1101 so_cmsglen(mblk_t *mp, void *opt, t_uscalar_t optlen, int oldflg) 1102 { 1103 t_uscalar_t cmsglen = 0; 1104 struct T_opthdr *tohp; 1105 t_uscalar_t len; 1106 t_uscalar_t last_roundup = 0; 1107 1108 ASSERT(__TPI_TOPT_ISALIGNED(opt)); 1109 1110 for (tohp = (struct T_opthdr *)opt; 1111 tohp && _TPI_TOPT_VALID(tohp, opt, (uintptr_t)opt + optlen); 1112 tohp = _TPI_TOPT_NEXTHDR(opt, optlen, tohp)) { 1113 dprint(1, ("so_cmsglen: level 0x%x, name %d, len %d\n", 1114 tohp->level, tohp->name, tohp->len)); 1115 if (tohp->level == SOL_SOCKET && 1116 (tohp->name == SO_SRCADDR || 1117 tohp->name == SO_UNIX_CLOSE)) { 1118 continue; 1119 } 1120 if (tohp->level == SOL_SOCKET && tohp->name == SO_FILEP) { 1121 struct fdbuf *fdbuf; 1122 int fdbuflen; 1123 1124 fdbuf = (struct fdbuf *)_TPI_TOPT_DATA(tohp); 1125 fdbuflen = (int)_TPI_TOPT_DATALEN(tohp); 1126 1127 if (!fdbuf_verify(mp, fdbuf, fdbuflen)) 1128 continue; 1129 if (oldflg) { 1130 cmsglen += fdbuf_cmsglen(fdbuflen); 1131 continue; 1132 } 1133 len = fdbuf_cmsglen(fdbuflen); 1134 } else if (tohp->level == SOL_SOCKET && 1135 tohp->name == SCM_TIMESTAMP) { 1136 if (oldflg) 1137 continue; 1138 1139 if (get_udatamodel() == DATAMODEL_NATIVE) { 1140 len = sizeof (struct timeval); 1141 } else { 1142 len = sizeof (struct timeval32); 1143 } 1144 } else { 1145 if (oldflg) 1146 continue; 1147 len = (t_uscalar_t)_TPI_TOPT_DATALEN(tohp); 1148 } 1149 /* 1150 * Exclude roundup for last option to not set 1151 * MSG_CTRUNC when the cmsg fits but the padding doesn't fit. 1152 */ 1153 last_roundup = (t_uscalar_t) 1154 (ROUNDUP_cmsglen(len + (int)sizeof (struct cmsghdr)) - 1155 (len + (int)sizeof (struct cmsghdr))); 1156 cmsglen += (t_uscalar_t)(len + (int)sizeof (struct cmsghdr)) + 1157 last_roundup; 1158 } 1159 cmsglen -= last_roundup; 1160 dprint(1, ("so_cmsglen: optlen %d, flg %d -> cmsglen %d\n", 1161 optlen, oldflg, cmsglen)); 1162 return (cmsglen); 1163 } 1164 1165 /* 1166 * Copy options from options to the control. Convert SO_FILEP to 1167 * file descriptors. 1168 * Returns errno or zero. 1169 * so_opt2cmsg and so_cmsglen are inter-related since so_cmsglen 1170 * allocates the space that so_opt2cmsg fills. If one changes, the other should 1171 * also be checked for any possible impacts. 1172 */ 1173 int 1174 so_opt2cmsg(mblk_t *mp, void *opt, t_uscalar_t optlen, int oldflg, 1175 void *control, t_uscalar_t controllen) 1176 { 1177 struct T_opthdr *tohp; 1178 struct cmsghdr *cmsg; 1179 struct fdbuf *fdbuf; 1180 int fdbuflen; 1181 int error; 1182 #if defined(DEBUG) || defined(__lint) 1183 struct cmsghdr *cend = (struct cmsghdr *) 1184 (((uint8_t *)control) + ROUNDUP_cmsglen(controllen)); 1185 #endif 1186 cmsg = (struct cmsghdr *)control; 1187 1188 ASSERT(__TPI_TOPT_ISALIGNED(opt)); 1189 1190 for (tohp = (struct T_opthdr *)opt; 1191 tohp && _TPI_TOPT_VALID(tohp, opt, (uintptr_t)opt + optlen); 1192 tohp = _TPI_TOPT_NEXTHDR(opt, optlen, tohp)) { 1193 dprint(1, ("so_opt2cmsg: level 0x%x, name %d, len %d\n", 1194 tohp->level, tohp->name, tohp->len)); 1195 1196 if (tohp->level == SOL_SOCKET && 1197 (tohp->name == SO_SRCADDR || 1198 tohp->name == SO_UNIX_CLOSE)) { 1199 continue; 1200 } 1201 ASSERT((uintptr_t)cmsg <= (uintptr_t)control + controllen); 1202 if (tohp->level == SOL_SOCKET && tohp->name == SO_FILEP) { 1203 fdbuf = (struct fdbuf *)_TPI_TOPT_DATA(tohp); 1204 fdbuflen = (int)_TPI_TOPT_DATALEN(tohp); 1205 1206 if (!fdbuf_verify(mp, fdbuf, fdbuflen)) 1207 return (EPROTO); 1208 if (oldflg) { 1209 error = fdbuf_extract(fdbuf, control, 1210 (int)controllen); 1211 if (error != 0) 1212 return (error); 1213 continue; 1214 } else { 1215 int fdlen; 1216 1217 fdlen = (int)fdbuf_cmsglen( 1218 (int)_TPI_TOPT_DATALEN(tohp)); 1219 1220 cmsg->cmsg_level = tohp->level; 1221 cmsg->cmsg_type = SCM_RIGHTS; 1222 cmsg->cmsg_len = (socklen_t)(fdlen + 1223 sizeof (struct cmsghdr)); 1224 1225 error = fdbuf_extract(fdbuf, 1226 CMSG_CONTENT(cmsg), fdlen); 1227 if (error != 0) 1228 return (error); 1229 } 1230 } else if (tohp->level == SOL_SOCKET && 1231 tohp->name == SCM_TIMESTAMP) { 1232 timestruc_t *timestamp; 1233 1234 if (oldflg) 1235 continue; 1236 1237 cmsg->cmsg_level = tohp->level; 1238 cmsg->cmsg_type = tohp->name; 1239 1240 timestamp = 1241 (timestruc_t *)P2ROUNDUP((intptr_t)&tohp[1], 1242 sizeof (intptr_t)); 1243 1244 if (get_udatamodel() == DATAMODEL_NATIVE) { 1245 struct timeval tv; 1246 1247 cmsg->cmsg_len = sizeof (struct timeval) + 1248 sizeof (struct cmsghdr); 1249 tv.tv_sec = timestamp->tv_sec; 1250 tv.tv_usec = timestamp->tv_nsec / 1251 (NANOSEC / MICROSEC); 1252 /* 1253 * on LP64 systems, the struct timeval in 1254 * the destination will not be 8-byte aligned, 1255 * so use bcopy to avoid alignment trouble 1256 */ 1257 bcopy(&tv, CMSG_CONTENT(cmsg), sizeof (tv)); 1258 } else { 1259 struct timeval32 *time32; 1260 1261 cmsg->cmsg_len = sizeof (struct timeval32) + 1262 sizeof (struct cmsghdr); 1263 time32 = (struct timeval32 *)CMSG_CONTENT(cmsg); 1264 time32->tv_sec = (time32_t)timestamp->tv_sec; 1265 time32->tv_usec = 1266 (int32_t)(timestamp->tv_nsec / 1267 (NANOSEC / MICROSEC)); 1268 } 1269 1270 } else { 1271 if (oldflg) 1272 continue; 1273 1274 cmsg->cmsg_level = tohp->level; 1275 cmsg->cmsg_type = tohp->name; 1276 cmsg->cmsg_len = (socklen_t)(_TPI_TOPT_DATALEN(tohp) + 1277 sizeof (struct cmsghdr)); 1278 1279 /* copy content to control data part */ 1280 bcopy(&tohp[1], CMSG_CONTENT(cmsg), 1281 CMSG_CONTENTLEN(cmsg)); 1282 } 1283 /* move to next CMSG structure! */ 1284 cmsg = CMSG_NEXT(cmsg); 1285 } 1286 dprint(1, ("so_opt2cmsg: buf %p len %d; cend %p; final cmsg %p\n", 1287 control, controllen, (void *)cend, (void *)cmsg)); 1288 ASSERT(cmsg <= cend); 1289 return (0); 1290 } 1291 1292 /* 1293 * Extract the SO_SRCADDR option value if present. 1294 */ 1295 void 1296 so_getopt_srcaddr(void *opt, t_uscalar_t optlen, void **srcp, 1297 t_uscalar_t *srclenp) 1298 { 1299 struct T_opthdr *tohp; 1300 1301 ASSERT(__TPI_TOPT_ISALIGNED(opt)); 1302 1303 ASSERT(srcp != NULL && srclenp != NULL); 1304 *srcp = NULL; 1305 *srclenp = 0; 1306 1307 for (tohp = (struct T_opthdr *)opt; 1308 tohp && _TPI_TOPT_VALID(tohp, opt, (uintptr_t)opt + optlen); 1309 tohp = _TPI_TOPT_NEXTHDR(opt, optlen, tohp)) { 1310 dprint(1, ("so_getopt_srcaddr: level 0x%x, name %d, len %d\n", 1311 tohp->level, tohp->name, tohp->len)); 1312 if (tohp->level == SOL_SOCKET && 1313 tohp->name == SO_SRCADDR) { 1314 *srcp = _TPI_TOPT_DATA(tohp); 1315 *srclenp = (t_uscalar_t)_TPI_TOPT_DATALEN(tohp); 1316 } 1317 } 1318 } 1319 1320 /* 1321 * Verify if the SO_UNIX_CLOSE option is present. 1322 */ 1323 int 1324 so_getopt_unix_close(void *opt, t_uscalar_t optlen) 1325 { 1326 struct T_opthdr *tohp; 1327 1328 ASSERT(__TPI_TOPT_ISALIGNED(opt)); 1329 1330 for (tohp = (struct T_opthdr *)opt; 1331 tohp && _TPI_TOPT_VALID(tohp, opt, (uintptr_t)opt + optlen); 1332 tohp = _TPI_TOPT_NEXTHDR(opt, optlen, tohp)) { 1333 dprint(1, 1334 ("so_getopt_unix_close: level 0x%x, name %d, len %d\n", 1335 tohp->level, tohp->name, tohp->len)); 1336 if (tohp->level == SOL_SOCKET && 1337 tohp->name == SO_UNIX_CLOSE) 1338 return (1); 1339 } 1340 return (0); 1341 } 1342 1343 /* 1344 * Allocate an M_PROTO message. 1345 * 1346 * If allocation fails the behavior depends on sleepflg: 1347 * _ALLOC_NOSLEEP fail immediately 1348 * _ALLOC_INTR sleep for memory until a signal is caught 1349 * _ALLOC_SLEEP sleep forever. Don't return NULL. 1350 */ 1351 mblk_t * 1352 soallocproto(size_t size, int sleepflg, cred_t *cr) 1353 { 1354 mblk_t *mp; 1355 1356 /* Round up size for reuse */ 1357 size = MAX(size, 64); 1358 if (cr != NULL) 1359 mp = allocb_cred(size, cr, curproc->p_pid); 1360 else 1361 mp = allocb(size, BPRI_MED); 1362 1363 if (mp == NULL) { 1364 int error; /* Dummy - error not returned to caller */ 1365 1366 switch (sleepflg) { 1367 case _ALLOC_SLEEP: 1368 if (cr != NULL) { 1369 mp = allocb_cred_wait(size, STR_NOSIG, &error, 1370 cr, curproc->p_pid); 1371 } else { 1372 mp = allocb_wait(size, BPRI_MED, STR_NOSIG, 1373 &error); 1374 } 1375 ASSERT(mp); 1376 break; 1377 case _ALLOC_INTR: 1378 if (cr != NULL) { 1379 mp = allocb_cred_wait(size, 0, &error, cr, 1380 curproc->p_pid); 1381 } else { 1382 mp = allocb_wait(size, BPRI_MED, 0, &error); 1383 } 1384 if (mp == NULL) { 1385 /* Caught signal while sleeping for memory */ 1386 eprintline(ENOBUFS); 1387 return (NULL); 1388 } 1389 break; 1390 case _ALLOC_NOSLEEP: 1391 default: 1392 eprintline(ENOBUFS); 1393 return (NULL); 1394 } 1395 } 1396 DB_TYPE(mp) = M_PROTO; 1397 return (mp); 1398 } 1399 1400 /* 1401 * Allocate an M_PROTO message with a single component. 1402 * len is the length of buf. size is the amount to allocate. 1403 * 1404 * buf can be NULL with a non-zero len. 1405 * This results in a bzero'ed chunk being placed the message. 1406 */ 1407 mblk_t * 1408 soallocproto1(const void *buf, ssize_t len, ssize_t size, int sleepflg, 1409 cred_t *cr) 1410 { 1411 mblk_t *mp; 1412 1413 if (size == 0) 1414 size = len; 1415 1416 ASSERT(size >= len); 1417 /* Round up size for reuse */ 1418 size = MAX(size, 64); 1419 mp = soallocproto(size, sleepflg, cr); 1420 if (mp == NULL) 1421 return (NULL); 1422 mp->b_datap->db_type = M_PROTO; 1423 if (len != 0) { 1424 if (buf != NULL) 1425 bcopy(buf, mp->b_wptr, len); 1426 else 1427 bzero(mp->b_wptr, len); 1428 mp->b_wptr += len; 1429 } 1430 return (mp); 1431 } 1432 1433 /* 1434 * Append buf/len to mp. 1435 * The caller has to ensure that there is enough room in the mblk. 1436 * 1437 * buf can be NULL with a non-zero len. 1438 * This results in a bzero'ed chunk being placed the message. 1439 */ 1440 void 1441 soappendmsg(mblk_t *mp, const void *buf, ssize_t len) 1442 { 1443 ASSERT(mp); 1444 1445 if (len != 0) { 1446 /* Assert for room left */ 1447 ASSERT(mp->b_datap->db_lim - mp->b_wptr >= len); 1448 if (buf != NULL) 1449 bcopy(buf, mp->b_wptr, len); 1450 else 1451 bzero(mp->b_wptr, len); 1452 } 1453 mp->b_wptr += len; 1454 } 1455 1456 /* 1457 * Create a message using two kernel buffers. 1458 * If size is set that will determine the allocation size (e.g. for future 1459 * soappendmsg calls). If size is zero it is derived from the buffer 1460 * lengths. 1461 */ 1462 mblk_t * 1463 soallocproto2(const void *buf1, ssize_t len1, const void *buf2, ssize_t len2, 1464 ssize_t size, int sleepflg, cred_t *cr) 1465 { 1466 mblk_t *mp; 1467 1468 if (size == 0) 1469 size = len1 + len2; 1470 ASSERT(size >= len1 + len2); 1471 1472 mp = soallocproto1(buf1, len1, size, sleepflg, cr); 1473 if (mp) 1474 soappendmsg(mp, buf2, len2); 1475 return (mp); 1476 } 1477 1478 /* 1479 * Create a message using three kernel buffers. 1480 * If size is set that will determine the allocation size (for future 1481 * soappendmsg calls). If size is zero it is derived from the buffer 1482 * lengths. 1483 */ 1484 mblk_t * 1485 soallocproto3(const void *buf1, ssize_t len1, const void *buf2, ssize_t len2, 1486 const void *buf3, ssize_t len3, ssize_t size, int sleepflg, cred_t *cr) 1487 { 1488 mblk_t *mp; 1489 1490 if (size == 0) 1491 size = len1 + len2 +len3; 1492 ASSERT(size >= len1 + len2 + len3); 1493 1494 mp = soallocproto1(buf1, len1, size, sleepflg, cr); 1495 if (mp != NULL) { 1496 soappendmsg(mp, buf2, len2); 1497 soappendmsg(mp, buf3, len3); 1498 } 1499 return (mp); 1500 } 1501 1502 #ifdef DEBUG 1503 char * 1504 pr_state(uint_t state, uint_t mode) 1505 { 1506 static char buf[1024]; 1507 1508 buf[0] = 0; 1509 if (state & SS_ISCONNECTED) 1510 (void) strcat(buf, "ISCONNECTED "); 1511 if (state & SS_ISCONNECTING) 1512 (void) strcat(buf, "ISCONNECTING "); 1513 if (state & SS_ISDISCONNECTING) 1514 (void) strcat(buf, "ISDISCONNECTING "); 1515 if (state & SS_CANTSENDMORE) 1516 (void) strcat(buf, "CANTSENDMORE "); 1517 1518 if (state & SS_CANTRCVMORE) 1519 (void) strcat(buf, "CANTRCVMORE "); 1520 if (state & SS_ISBOUND) 1521 (void) strcat(buf, "ISBOUND "); 1522 if (state & SS_NDELAY) 1523 (void) strcat(buf, "NDELAY "); 1524 if (state & SS_NONBLOCK) 1525 (void) strcat(buf, "NONBLOCK "); 1526 1527 if (state & SS_ASYNC) 1528 (void) strcat(buf, "ASYNC "); 1529 if (state & SS_ACCEPTCONN) 1530 (void) strcat(buf, "ACCEPTCONN "); 1531 if (state & SS_SAVEDEOR) 1532 (void) strcat(buf, "SAVEDEOR "); 1533 1534 if (state & SS_RCVATMARK) 1535 (void) strcat(buf, "RCVATMARK "); 1536 if (state & SS_OOBPEND) 1537 (void) strcat(buf, "OOBPEND "); 1538 if (state & SS_HAVEOOBDATA) 1539 (void) strcat(buf, "HAVEOOBDATA "); 1540 if (state & SS_HADOOBDATA) 1541 (void) strcat(buf, "HADOOBDATA "); 1542 1543 if (mode & SM_PRIV) 1544 (void) strcat(buf, "PRIV "); 1545 if (mode & SM_ATOMIC) 1546 (void) strcat(buf, "ATOMIC "); 1547 if (mode & SM_ADDR) 1548 (void) strcat(buf, "ADDR "); 1549 if (mode & SM_CONNREQUIRED) 1550 (void) strcat(buf, "CONNREQUIRED "); 1551 1552 if (mode & SM_FDPASSING) 1553 (void) strcat(buf, "FDPASSING "); 1554 if (mode & SM_EXDATA) 1555 (void) strcat(buf, "EXDATA "); 1556 if (mode & SM_OPTDATA) 1557 (void) strcat(buf, "OPTDATA "); 1558 if (mode & SM_BYTESTREAM) 1559 (void) strcat(buf, "BYTESTREAM "); 1560 return (buf); 1561 } 1562 1563 char * 1564 pr_addr(int family, struct sockaddr *addr, t_uscalar_t addrlen) 1565 { 1566 static char buf[1024]; 1567 1568 if (addr == NULL || addrlen == 0) { 1569 (void) sprintf(buf, "(len %d) %p", addrlen, (void *)addr); 1570 return (buf); 1571 } 1572 switch (family) { 1573 case AF_INET: { 1574 struct sockaddr_in sin; 1575 1576 bcopy(addr, &sin, sizeof (sin)); 1577 1578 (void) sprintf(buf, "(len %d) %x/%d", 1579 addrlen, ntohl(sin.sin_addr.s_addr), ntohs(sin.sin_port)); 1580 break; 1581 } 1582 case AF_INET6: { 1583 struct sockaddr_in6 sin6; 1584 uint16_t *piece = (uint16_t *)&sin6.sin6_addr; 1585 1586 bcopy((char *)addr, (char *)&sin6, sizeof (sin6)); 1587 (void) sprintf(buf, "(len %d) %x:%x:%x:%x:%x:%x:%x:%x/%d", 1588 addrlen, 1589 ntohs(piece[0]), ntohs(piece[1]), 1590 ntohs(piece[2]), ntohs(piece[3]), 1591 ntohs(piece[4]), ntohs(piece[5]), 1592 ntohs(piece[6]), ntohs(piece[7]), 1593 ntohs(sin6.sin6_port)); 1594 break; 1595 } 1596 case AF_UNIX: { 1597 struct sockaddr_un *soun = (struct sockaddr_un *)addr; 1598 1599 (void) sprintf(buf, "(len %d) %s", addrlen, 1600 (soun == NULL) ? "(none)" : soun->sun_path); 1601 break; 1602 } 1603 default: 1604 (void) sprintf(buf, "(unknown af %d)", family); 1605 break; 1606 } 1607 return (buf); 1608 } 1609 1610 /* The logical equivalence operator (a if-and-only-if b) */ 1611 #define EQUIVALENT(a, b) (((a) && (b)) || (!(a) && (!(b)))) 1612 1613 /* 1614 * Verify limitations and invariants on oob state. 1615 * Return 1 if OK, otherwise 0 so that it can be used as 1616 * ASSERT(verify_oobstate(so)); 1617 */ 1618 int 1619 so_verify_oobstate(struct sonode *so) 1620 { 1621 boolean_t havemark; 1622 1623 ASSERT(MUTEX_HELD(&so->so_lock)); 1624 1625 /* 1626 * The possible state combinations are: 1627 * 0 1628 * SS_OOBPEND 1629 * SS_OOBPEND|SS_HAVEOOBDATA 1630 * SS_OOBPEND|SS_HADOOBDATA 1631 * SS_HADOOBDATA 1632 */ 1633 switch (so->so_state & (SS_OOBPEND|SS_HAVEOOBDATA|SS_HADOOBDATA)) { 1634 case 0: 1635 case SS_OOBPEND: 1636 case SS_OOBPEND|SS_HAVEOOBDATA: 1637 case SS_OOBPEND|SS_HADOOBDATA: 1638 case SS_HADOOBDATA: 1639 break; 1640 default: 1641 printf("Bad oob state 1 (%p): state %s\n", 1642 (void *)so, pr_state(so->so_state, so->so_mode)); 1643 return (0); 1644 } 1645 1646 /* SS_RCVATMARK should only be set when SS_OOBPEND is set */ 1647 if ((so->so_state & (SS_RCVATMARK|SS_OOBPEND)) == SS_RCVATMARK) { 1648 printf("Bad oob state 2 (%p): state %s\n", 1649 (void *)so, pr_state(so->so_state, so->so_mode)); 1650 return (0); 1651 } 1652 1653 /* 1654 * (havemark != 0 or SS_RCVATMARK) iff SS_OOBPEND 1655 * For TPI, the presence of a "mark" is indicated by sti_oobsigcnt. 1656 */ 1657 havemark = (SOCK_IS_NONSTR(so)) ? so->so_oobmark > 0 : 1658 SOTOTPI(so)->sti_oobsigcnt > 0; 1659 1660 if (!EQUIVALENT(havemark || (so->so_state & SS_RCVATMARK), 1661 so->so_state & SS_OOBPEND)) { 1662 printf("Bad oob state 3 (%p): state %s\n", 1663 (void *)so, pr_state(so->so_state, so->so_mode)); 1664 return (0); 1665 } 1666 1667 /* 1668 * Unless SO_OOBINLINE we have so_oobmsg != NULL iff SS_HAVEOOBDATA 1669 */ 1670 if (!(so->so_options & SO_OOBINLINE) && 1671 !EQUIVALENT(so->so_oobmsg != NULL, so->so_state & SS_HAVEOOBDATA)) { 1672 printf("Bad oob state 4 (%p): state %s\n", 1673 (void *)so, pr_state(so->so_state, so->so_mode)); 1674 return (0); 1675 } 1676 1677 if (!SOCK_IS_NONSTR(so) && 1678 SOTOTPI(so)->sti_oobsigcnt < SOTOTPI(so)->sti_oobcnt) { 1679 printf("Bad oob state 5 (%p): counts %d/%d state %s\n", 1680 (void *)so, SOTOTPI(so)->sti_oobsigcnt, 1681 SOTOTPI(so)->sti_oobcnt, 1682 pr_state(so->so_state, so->so_mode)); 1683 return (0); 1684 } 1685 1686 return (1); 1687 } 1688 #undef EQUIVALENT 1689 #endif /* DEBUG */ 1690 1691 /* initialize sockfs zone specific kstat related items */ 1692 void * 1693 sock_kstat_init(zoneid_t zoneid) 1694 { 1695 kstat_t *ksp; 1696 1697 ksp = kstat_create_zone("sockfs", 0, "sock_unix_list", "misc", 1698 KSTAT_TYPE_RAW, 0, KSTAT_FLAG_VAR_SIZE|KSTAT_FLAG_VIRTUAL, zoneid); 1699 1700 if (ksp != NULL) { 1701 ksp->ks_update = sockfs_update; 1702 ksp->ks_snapshot = sockfs_snapshot; 1703 ksp->ks_lock = &socklist.sl_lock; 1704 ksp->ks_private = (void *)(uintptr_t)zoneid; 1705 kstat_install(ksp); 1706 } 1707 1708 return (ksp); 1709 } 1710 1711 /* tear down sockfs zone specific kstat related items */ 1712 /*ARGSUSED*/ 1713 void 1714 sock_kstat_fini(zoneid_t zoneid, void *arg) 1715 { 1716 kstat_t *ksp = (kstat_t *)arg; 1717 1718 if (ksp != NULL) { 1719 ASSERT(zoneid == (zoneid_t)(uintptr_t)ksp->ks_private); 1720 kstat_delete(ksp); 1721 } 1722 } 1723 1724 /* 1725 * Zones: 1726 * Note that nactive is going to be different for each zone. 1727 * This means we require kstat to call sockfs_update and then sockfs_snapshot 1728 * for the same zone, or sockfs_snapshot will be taken into the wrong size 1729 * buffer. This is safe, but if the buffer is too small, user will not be 1730 * given details of all sockets. However, as this kstat has a ks_lock, kstat 1731 * driver will keep it locked between the update and the snapshot, so no 1732 * other process (zone) can currently get inbetween resulting in a wrong size 1733 * buffer allocation. 1734 */ 1735 static int 1736 sockfs_update(kstat_t *ksp, int rw) 1737 { 1738 uint_t nactive = 0; /* # of active AF_UNIX sockets */ 1739 struct sonode *so; /* current sonode on socklist */ 1740 zoneid_t myzoneid = (zoneid_t)(uintptr_t)ksp->ks_private; 1741 1742 ASSERT((zoneid_t)(uintptr_t)ksp->ks_private == getzoneid()); 1743 1744 if (rw == KSTAT_WRITE) { /* bounce all writes */ 1745 return (EACCES); 1746 } 1747 1748 for (so = socklist.sl_list; so != NULL; so = SOTOTPI(so)->sti_next_so) { 1749 if (so->so_count != 0 && so->so_zoneid == myzoneid) { 1750 nactive++; 1751 } 1752 } 1753 ksp->ks_ndata = nactive; 1754 ksp->ks_data_size = nactive * sizeof (struct k_sockinfo); 1755 1756 return (0); 1757 } 1758 1759 static int 1760 sockfs_snapshot(kstat_t *ksp, void *buf, int rw) 1761 { 1762 int ns; /* # of sonodes we've copied */ 1763 struct sonode *so; /* current sonode on socklist */ 1764 struct k_sockinfo *pksi; /* where we put sockinfo data */ 1765 t_uscalar_t sn_len; /* soa_len */ 1766 zoneid_t myzoneid = (zoneid_t)(uintptr_t)ksp->ks_private; 1767 sotpi_info_t *sti; 1768 1769 ASSERT((zoneid_t)(uintptr_t)ksp->ks_private == getzoneid()); 1770 1771 ksp->ks_snaptime = gethrtime(); 1772 1773 if (rw == KSTAT_WRITE) { /* bounce all writes */ 1774 return (EACCES); 1775 } 1776 1777 /* 1778 * for each sonode on the socklist, we massage the important 1779 * info into buf, in k_sockinfo format. 1780 */ 1781 pksi = (struct k_sockinfo *)buf; 1782 ns = 0; 1783 for (so = socklist.sl_list; so != NULL; so = SOTOTPI(so)->sti_next_so) { 1784 /* only stuff active sonodes and the same zone: */ 1785 if (so->so_count == 0 || so->so_zoneid != myzoneid) { 1786 continue; 1787 } 1788 1789 /* 1790 * If the sonode was activated between the update and the 1791 * snapshot, we're done - as this is only a snapshot. 1792 */ 1793 if ((caddr_t)(pksi) >= (caddr_t)buf + ksp->ks_data_size) { 1794 break; 1795 } 1796 1797 sti = SOTOTPI(so); 1798 /* copy important info into buf: */ 1799 pksi->ks_si.si_size = sizeof (struct k_sockinfo); 1800 pksi->ks_si.si_family = so->so_family; 1801 pksi->ks_si.si_type = so->so_type; 1802 pksi->ks_si.si_flag = so->so_flag; 1803 pksi->ks_si.si_state = so->so_state; 1804 pksi->ks_si.si_serv_type = sti->sti_serv_type; 1805 pksi->ks_si.si_ux_laddr_sou_magic = 1806 sti->sti_ux_laddr.soua_magic; 1807 pksi->ks_si.si_ux_faddr_sou_magic = 1808 sti->sti_ux_faddr.soua_magic; 1809 pksi->ks_si.si_laddr_soa_len = sti->sti_laddr.soa_len; 1810 pksi->ks_si.si_faddr_soa_len = sti->sti_faddr.soa_len; 1811 pksi->ks_si.si_szoneid = so->so_zoneid; 1812 pksi->ks_si.si_faddr_noxlate = sti->sti_faddr_noxlate; 1813 1814 mutex_enter(&so->so_lock); 1815 1816 if (sti->sti_laddr_sa != NULL) { 1817 ASSERT(sti->sti_laddr_sa->sa_data != NULL); 1818 sn_len = sti->sti_laddr_len; 1819 ASSERT(sn_len <= sizeof (short) + 1820 sizeof (pksi->ks_si.si_laddr_sun_path)); 1821 1822 pksi->ks_si.si_laddr_family = 1823 sti->sti_laddr_sa->sa_family; 1824 if (sn_len != 0) { 1825 /* AF_UNIX socket names are NULL terminated */ 1826 (void) strncpy(pksi->ks_si.si_laddr_sun_path, 1827 sti->sti_laddr_sa->sa_data, 1828 sizeof (pksi->ks_si.si_laddr_sun_path)); 1829 sn_len = strlen(pksi->ks_si.si_laddr_sun_path); 1830 } 1831 pksi->ks_si.si_laddr_sun_path[sn_len] = 0; 1832 } 1833 1834 if (sti->sti_faddr_sa != NULL) { 1835 ASSERT(sti->sti_faddr_sa->sa_data != NULL); 1836 sn_len = sti->sti_faddr_len; 1837 ASSERT(sn_len <= sizeof (short) + 1838 sizeof (pksi->ks_si.si_faddr_sun_path)); 1839 1840 pksi->ks_si.si_faddr_family = 1841 sti->sti_faddr_sa->sa_family; 1842 if (sn_len != 0) { 1843 (void) strncpy(pksi->ks_si.si_faddr_sun_path, 1844 sti->sti_faddr_sa->sa_data, 1845 sizeof (pksi->ks_si.si_faddr_sun_path)); 1846 sn_len = strlen(pksi->ks_si.si_faddr_sun_path); 1847 } 1848 pksi->ks_si.si_faddr_sun_path[sn_len] = 0; 1849 } 1850 1851 mutex_exit(&so->so_lock); 1852 1853 (void) sprintf(pksi->ks_straddr[0], "%p", (void *)so); 1854 (void) sprintf(pksi->ks_straddr[1], "%p", 1855 (void *)sti->sti_ux_laddr.soua_vp); 1856 (void) sprintf(pksi->ks_straddr[2], "%p", 1857 (void *)sti->sti_ux_faddr.soua_vp); 1858 1859 ns++; 1860 pksi++; 1861 } 1862 1863 ksp->ks_ndata = ns; 1864 return (0); 1865 } 1866 1867 ssize_t 1868 soreadfile(file_t *fp, uchar_t *buf, u_offset_t fileoff, int *err, size_t size) 1869 { 1870 struct uio auio; 1871 struct iovec aiov[MSG_MAXIOVLEN]; 1872 register vnode_t *vp; 1873 int ioflag, rwflag; 1874 ssize_t cnt; 1875 int error = 0; 1876 int iovcnt = 0; 1877 short fflag; 1878 1879 vp = fp->f_vnode; 1880 fflag = fp->f_flag; 1881 1882 rwflag = 0; 1883 aiov[0].iov_base = (caddr_t)buf; 1884 aiov[0].iov_len = size; 1885 iovcnt = 1; 1886 cnt = (ssize_t)size; 1887 (void) VOP_RWLOCK(vp, rwflag, NULL); 1888 1889 auio.uio_loffset = fileoff; 1890 auio.uio_iov = aiov; 1891 auio.uio_iovcnt = iovcnt; 1892 auio.uio_resid = cnt; 1893 auio.uio_segflg = UIO_SYSSPACE; 1894 auio.uio_llimit = MAXOFFSET_T; 1895 auio.uio_fmode = fflag; 1896 auio.uio_extflg = UIO_COPY_CACHED; 1897 1898 ioflag = auio.uio_fmode & (FAPPEND|FSYNC|FDSYNC|FRSYNC); 1899 1900 /* If read sync is not asked for, filter sync flags */ 1901 if ((ioflag & FRSYNC) == 0) 1902 ioflag &= ~(FSYNC|FDSYNC); 1903 error = VOP_READ(vp, &auio, ioflag, fp->f_cred, NULL); 1904 cnt -= auio.uio_resid; 1905 1906 VOP_RWUNLOCK(vp, rwflag, NULL); 1907 1908 if (error == EINTR && cnt != 0) 1909 error = 0; 1910 out: 1911 if (error != 0) { 1912 *err = error; 1913 return (0); 1914 } else { 1915 *err = 0; 1916 return (cnt); 1917 } 1918 } 1919 1920 int 1921 so_copyin(const void *from, void *to, size_t size, int fromkernel) 1922 { 1923 if (fromkernel) { 1924 bcopy(from, to, size); 1925 return (0); 1926 } 1927 return (xcopyin(from, to, size)); 1928 } 1929 1930 int 1931 so_copyout(const void *from, void *to, size_t size, int tokernel) 1932 { 1933 if (tokernel) { 1934 bcopy(from, to, size); 1935 return (0); 1936 } 1937 return (xcopyout(from, to, size)); 1938 } 1939