uipc_usrreq.c revision 255219
1/*- 2 * Copyright (c) 1982, 1986, 1989, 1991, 1993 3 * The Regents of the University of California. 4 * Copyright (c) 2004-2009 Robert N. M. Watson 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 4. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 * 31 * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94 32 */ 33 34/* 35 * UNIX Domain (Local) Sockets 36 * 37 * This is an implementation of UNIX (local) domain sockets. Each socket has 38 * an associated struct unpcb (UNIX protocol control block). Stream sockets 39 * may be connected to 0 or 1 other socket. Datagram sockets may be 40 * connected to 0, 1, or many other sockets. Sockets may be created and 41 * connected in pairs (socketpair(2)), or bound/connected to using the file 42 * system name space. For most purposes, only the receive socket buffer is 43 * used, as sending on one socket delivers directly to the receive socket 44 * buffer of a second socket. 45 * 46 * The implementation is substantially complicated by the fact that 47 * "ancillary data", such as file descriptors or credentials, may be passed 48 * across UNIX domain sockets. The potential for passing UNIX domain sockets 49 * over other UNIX domain sockets requires the implementation of a simple 50 * garbage collector to find and tear down cycles of disconnected sockets. 51 * 52 * TODO: 53 * RDM 54 * distinguish datagram size limits from flow control limits in SEQPACKET 55 * rethink name space problems 56 * need a proper out-of-band 57 */ 58 59#include <sys/cdefs.h> 60__FBSDID("$FreeBSD: head/sys/kern/uipc_usrreq.c 255219 2013-09-05 00:09:56Z pjd $"); 61 62#include "opt_ddb.h" 63 64#include <sys/param.h> 65#include <sys/capability.h> 66#include <sys/domain.h> 67#include <sys/fcntl.h> 68#include <sys/malloc.h> /* XXX must be before <sys/file.h> */ 69#include <sys/eventhandler.h> 70#include <sys/file.h> 71#include <sys/filedesc.h> 72#include <sys/kernel.h> 73#include <sys/lock.h> 74#include <sys/mbuf.h> 75#include <sys/mount.h> 76#include <sys/mutex.h> 77#include <sys/namei.h> 78#include <sys/proc.h> 79#include <sys/protosw.h> 80#include <sys/queue.h> 81#include <sys/resourcevar.h> 82#include <sys/rwlock.h> 83#include <sys/socket.h> 84#include <sys/socketvar.h> 85#include <sys/signalvar.h> 86#include <sys/stat.h> 87#include <sys/sx.h> 88#include <sys/sysctl.h> 89#include <sys/systm.h> 90#include <sys/taskqueue.h> 91#include <sys/un.h> 92#include <sys/unpcb.h> 93#include <sys/vnode.h> 94 95#include <net/vnet.h> 96 97#ifdef DDB 98#include <ddb/ddb.h> 99#endif 100 101#include <security/mac/mac_framework.h> 102 103#include <vm/uma.h> 104 105MALLOC_DECLARE(M_FILECAPS); 106 107/* 108 * Locking key: 109 * (l) Locked using list lock 110 * (g) Locked using linkage lock 111 */ 112 113static uma_zone_t unp_zone; 114static unp_gen_t unp_gencnt; /* (l) */ 115static u_int unp_count; /* (l) Count of local sockets. */ 116static ino_t unp_ino; /* Prototype for fake inode numbers. */ 117static int unp_rights; /* (g) File descriptors in flight. */ 118static struct unp_head unp_shead; /* (l) List of stream sockets. */ 119static struct unp_head unp_dhead; /* (l) List of datagram sockets. */ 120static struct unp_head unp_sphead; /* (l) List of seqpacket sockets. */ 121 122struct unp_defer { 123 SLIST_ENTRY(unp_defer) ud_link; 124 struct file *ud_fp; 125}; 126static SLIST_HEAD(, unp_defer) unp_defers; 127static int unp_defers_count; 128 129static const struct sockaddr sun_noname = { sizeof(sun_noname), AF_LOCAL }; 130 131/* 132 * Garbage collection of cyclic file descriptor/socket references occurs 133 * asynchronously in a taskqueue context in order to avoid recursion and 134 * reentrance in the UNIX domain socket, file descriptor, and socket layer 135 * code. See unp_gc() for a full description. 136 */ 137static struct timeout_task unp_gc_task; 138 139/* 140 * The close of unix domain sockets attached as SCM_RIGHTS is 141 * postponed to the taskqueue, to avoid arbitrary recursion depth. 142 * The attached sockets might have another sockets attached. 143 */ 144static struct task unp_defer_task; 145 146/* 147 * Both send and receive buffers are allocated PIPSIZ bytes of buffering for 148 * stream sockets, although the total for sender and receiver is actually 149 * only PIPSIZ. 150 * 151 * Datagram sockets really use the sendspace as the maximum datagram size, 152 * and don't really want to reserve the sendspace. Their recvspace should be 153 * large enough for at least one max-size datagram plus address. 154 */ 155#ifndef PIPSIZ 156#define PIPSIZ 8192 157#endif 158static u_long unpst_sendspace = PIPSIZ; 159static u_long unpst_recvspace = PIPSIZ; 160static u_long unpdg_sendspace = 2*1024; /* really max datagram size */ 161static u_long unpdg_recvspace = 4*1024; 162static u_long unpsp_sendspace = PIPSIZ; /* really max datagram size */ 163static u_long unpsp_recvspace = PIPSIZ; 164 165static SYSCTL_NODE(_net, PF_LOCAL, local, CTLFLAG_RW, 0, "Local domain"); 166static SYSCTL_NODE(_net_local, SOCK_STREAM, stream, CTLFLAG_RW, 0, 167 "SOCK_STREAM"); 168static SYSCTL_NODE(_net_local, SOCK_DGRAM, dgram, CTLFLAG_RW, 0, "SOCK_DGRAM"); 169static SYSCTL_NODE(_net_local, SOCK_SEQPACKET, seqpacket, CTLFLAG_RW, 0, 170 "SOCK_SEQPACKET"); 171 172SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW, 173 &unpst_sendspace, 0, "Default stream send space."); 174SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW, 175 &unpst_recvspace, 0, "Default stream receive space."); 176SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW, 177 &unpdg_sendspace, 0, "Default datagram send space."); 178SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW, 179 &unpdg_recvspace, 0, "Default datagram receive space."); 180SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, maxseqpacket, CTLFLAG_RW, 181 &unpsp_sendspace, 0, "Default seqpacket send space."); 182SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, recvspace, CTLFLAG_RW, 183 &unpsp_recvspace, 0, "Default seqpacket receive space."); 184SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0, 185 "File descriptors in flight."); 186SYSCTL_INT(_net_local, OID_AUTO, deferred, CTLFLAG_RD, 187 &unp_defers_count, 0, 188 "File descriptors deferred to taskqueue for close."); 189 190/* 191 * Locking and synchronization: 192 * 193 * Three types of locks exit in the local domain socket implementation: a 194 * global list mutex, a global linkage rwlock, and per-unpcb mutexes. Of the 195 * global locks, the list lock protects the socket count, global generation 196 * number, and stream/datagram global lists. The linkage lock protects the 197 * interconnection of unpcbs, the v_socket and unp_vnode pointers, and can be 198 * held exclusively over the acquisition of multiple unpcb locks to prevent 199 * deadlock. 200 * 201 * UNIX domain sockets each have an unpcb hung off of their so_pcb pointer, 202 * allocated in pru_attach() and freed in pru_detach(). The validity of that 203 * pointer is an invariant, so no lock is required to dereference the so_pcb 204 * pointer if a valid socket reference is held by the caller. In practice, 205 * this is always true during operations performed on a socket. Each unpcb 206 * has a back-pointer to its socket, unp_socket, which will be stable under 207 * the same circumstances. 208 * 209 * This pointer may only be safely dereferenced as long as a valid reference 210 * to the unpcb is held. Typically, this reference will be from the socket, 211 * or from another unpcb when the referring unpcb's lock is held (in order 212 * that the reference not be invalidated during use). For example, to follow 213 * unp->unp_conn->unp_socket, you need unlock the lock on unp, not unp_conn, 214 * as unp_socket remains valid as long as the reference to unp_conn is valid. 215 * 216 * Fields of unpcbss are locked using a per-unpcb lock, unp_mtx. Individual 217 * atomic reads without the lock may be performed "lockless", but more 218 * complex reads and read-modify-writes require the mutex to be held. No 219 * lock order is defined between unpcb locks -- multiple unpcb locks may be 220 * acquired at the same time only when holding the linkage rwlock 221 * exclusively, which prevents deadlocks. 222 * 223 * Blocking with UNIX domain sockets is a tricky issue: unlike most network 224 * protocols, bind() is a non-atomic operation, and connect() requires 225 * potential sleeping in the protocol, due to potentially waiting on local or 226 * distributed file systems. We try to separate "lookup" operations, which 227 * may sleep, and the IPC operations themselves, which typically can occur 228 * with relative atomicity as locks can be held over the entire operation. 229 * 230 * Another tricky issue is simultaneous multi-threaded or multi-process 231 * access to a single UNIX domain socket. These are handled by the flags 232 * UNP_CONNECTING and UNP_BINDING, which prevent concurrent connecting or 233 * binding, both of which involve dropping UNIX domain socket locks in order 234 * to perform namei() and other file system operations. 235 */ 236static struct rwlock unp_link_rwlock; 237static struct mtx unp_list_lock; 238static struct mtx unp_defers_lock; 239 240#define UNP_LINK_LOCK_INIT() rw_init(&unp_link_rwlock, \ 241 "unp_link_rwlock") 242 243#define UNP_LINK_LOCK_ASSERT() rw_assert(&unp_link_rwlock, \ 244 RA_LOCKED) 245#define UNP_LINK_UNLOCK_ASSERT() rw_assert(&unp_link_rwlock, \ 246 RA_UNLOCKED) 247 248#define UNP_LINK_RLOCK() rw_rlock(&unp_link_rwlock) 249#define UNP_LINK_RUNLOCK() rw_runlock(&unp_link_rwlock) 250#define UNP_LINK_WLOCK() rw_wlock(&unp_link_rwlock) 251#define UNP_LINK_WUNLOCK() rw_wunlock(&unp_link_rwlock) 252#define UNP_LINK_WLOCK_ASSERT() rw_assert(&unp_link_rwlock, \ 253 RA_WLOCKED) 254 255#define UNP_LIST_LOCK_INIT() mtx_init(&unp_list_lock, \ 256 "unp_list_lock", NULL, MTX_DEF) 257#define UNP_LIST_LOCK() mtx_lock(&unp_list_lock) 258#define UNP_LIST_UNLOCK() mtx_unlock(&unp_list_lock) 259 260#define UNP_DEFERRED_LOCK_INIT() mtx_init(&unp_defers_lock, \ 261 "unp_defer", NULL, MTX_DEF) 262#define UNP_DEFERRED_LOCK() mtx_lock(&unp_defers_lock) 263#define UNP_DEFERRED_UNLOCK() mtx_unlock(&unp_defers_lock) 264 265#define UNP_PCB_LOCK_INIT(unp) mtx_init(&(unp)->unp_mtx, \ 266 "unp_mtx", "unp_mtx", \ 267 MTX_DUPOK|MTX_DEF|MTX_RECURSE) 268#define UNP_PCB_LOCK_DESTROY(unp) mtx_destroy(&(unp)->unp_mtx) 269#define UNP_PCB_LOCK(unp) mtx_lock(&(unp)->unp_mtx) 270#define UNP_PCB_UNLOCK(unp) mtx_unlock(&(unp)->unp_mtx) 271#define UNP_PCB_LOCK_ASSERT(unp) mtx_assert(&(unp)->unp_mtx, MA_OWNED) 272 273static int uipc_connect2(struct socket *, struct socket *); 274static int uipc_ctloutput(struct socket *, struct sockopt *); 275static int unp_connect(struct socket *, struct sockaddr *, 276 struct thread *); 277static int unp_connectat(int, struct socket *, struct sockaddr *, 278 struct thread *); 279static int unp_connect2(struct socket *so, struct socket *so2, int); 280static void unp_disconnect(struct unpcb *unp, struct unpcb *unp2); 281static void unp_dispose(struct mbuf *); 282static void unp_shutdown(struct unpcb *); 283static void unp_drop(struct unpcb *, int); 284static void unp_gc(__unused void *, int); 285static void unp_scan(struct mbuf *, void (*)(struct filedescent **, int)); 286static void unp_discard(struct file *); 287static void unp_freerights(struct filedescent **, int); 288static void unp_init(void); 289static int unp_internalize(struct mbuf **, struct thread *); 290static void unp_internalize_fp(struct file *); 291static int unp_externalize(struct mbuf *, struct mbuf **, int); 292static int unp_externalize_fp(struct file *); 293static struct mbuf *unp_addsockcred(struct thread *, struct mbuf *); 294static void unp_process_defers(void * __unused, int); 295 296/* 297 * Definitions of protocols supported in the LOCAL domain. 298 */ 299static struct domain localdomain; 300static struct pr_usrreqs uipc_usrreqs_dgram, uipc_usrreqs_stream; 301static struct pr_usrreqs uipc_usrreqs_seqpacket; 302static struct protosw localsw[] = { 303{ 304 .pr_type = SOCK_STREAM, 305 .pr_domain = &localdomain, 306 .pr_flags = PR_CONNREQUIRED|PR_WANTRCVD|PR_RIGHTS, 307 .pr_ctloutput = &uipc_ctloutput, 308 .pr_usrreqs = &uipc_usrreqs_stream 309}, 310{ 311 .pr_type = SOCK_DGRAM, 312 .pr_domain = &localdomain, 313 .pr_flags = PR_ATOMIC|PR_ADDR|PR_RIGHTS, 314 .pr_ctloutput = &uipc_ctloutput, 315 .pr_usrreqs = &uipc_usrreqs_dgram 316}, 317{ 318 .pr_type = SOCK_SEQPACKET, 319 .pr_domain = &localdomain, 320 321 /* 322 * XXXRW: For now, PR_ADDR because soreceive will bump into them 323 * due to our use of sbappendaddr. A new sbappend variants is needed 324 * that supports both atomic record writes and control data. 325 */ 326 .pr_flags = PR_ADDR|PR_ATOMIC|PR_CONNREQUIRED|PR_WANTRCVD| 327 PR_RIGHTS, 328 .pr_usrreqs = &uipc_usrreqs_seqpacket, 329}, 330}; 331 332static struct domain localdomain = { 333 .dom_family = AF_LOCAL, 334 .dom_name = "local", 335 .dom_init = unp_init, 336 .dom_externalize = unp_externalize, 337 .dom_dispose = unp_dispose, 338 .dom_protosw = localsw, 339 .dom_protoswNPROTOSW = &localsw[sizeof(localsw)/sizeof(localsw[0])] 340}; 341DOMAIN_SET(local); 342 343static void 344uipc_abort(struct socket *so) 345{ 346 struct unpcb *unp, *unp2; 347 348 unp = sotounpcb(so); 349 KASSERT(unp != NULL, ("uipc_abort: unp == NULL")); 350 351 UNP_LINK_WLOCK(); 352 UNP_PCB_LOCK(unp); 353 unp2 = unp->unp_conn; 354 if (unp2 != NULL) { 355 UNP_PCB_LOCK(unp2); 356 unp_drop(unp2, ECONNABORTED); 357 UNP_PCB_UNLOCK(unp2); 358 } 359 UNP_PCB_UNLOCK(unp); 360 UNP_LINK_WUNLOCK(); 361} 362 363static int 364uipc_accept(struct socket *so, struct sockaddr **nam) 365{ 366 struct unpcb *unp, *unp2; 367 const struct sockaddr *sa; 368 369 /* 370 * Pass back name of connected socket, if it was bound and we are 371 * still connected (our peer may have closed already!). 372 */ 373 unp = sotounpcb(so); 374 KASSERT(unp != NULL, ("uipc_accept: unp == NULL")); 375 376 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 377 UNP_LINK_RLOCK(); 378 unp2 = unp->unp_conn; 379 if (unp2 != NULL && unp2->unp_addr != NULL) { 380 UNP_PCB_LOCK(unp2); 381 sa = (struct sockaddr *) unp2->unp_addr; 382 bcopy(sa, *nam, sa->sa_len); 383 UNP_PCB_UNLOCK(unp2); 384 } else { 385 sa = &sun_noname; 386 bcopy(sa, *nam, sa->sa_len); 387 } 388 UNP_LINK_RUNLOCK(); 389 return (0); 390} 391 392static int 393uipc_attach(struct socket *so, int proto, struct thread *td) 394{ 395 u_long sendspace, recvspace; 396 struct unpcb *unp; 397 int error; 398 399 KASSERT(so->so_pcb == NULL, ("uipc_attach: so_pcb != NULL")); 400 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) { 401 switch (so->so_type) { 402 case SOCK_STREAM: 403 sendspace = unpst_sendspace; 404 recvspace = unpst_recvspace; 405 break; 406 407 case SOCK_DGRAM: 408 sendspace = unpdg_sendspace; 409 recvspace = unpdg_recvspace; 410 break; 411 412 case SOCK_SEQPACKET: 413 sendspace = unpsp_sendspace; 414 recvspace = unpsp_recvspace; 415 break; 416 417 default: 418 panic("uipc_attach"); 419 } 420 error = soreserve(so, sendspace, recvspace); 421 if (error) 422 return (error); 423 } 424 unp = uma_zalloc(unp_zone, M_NOWAIT | M_ZERO); 425 if (unp == NULL) 426 return (ENOBUFS); 427 LIST_INIT(&unp->unp_refs); 428 UNP_PCB_LOCK_INIT(unp); 429 unp->unp_socket = so; 430 so->so_pcb = unp; 431 unp->unp_refcount = 1; 432 433 UNP_LIST_LOCK(); 434 unp->unp_gencnt = ++unp_gencnt; 435 unp_count++; 436 switch (so->so_type) { 437 case SOCK_STREAM: 438 LIST_INSERT_HEAD(&unp_shead, unp, unp_link); 439 break; 440 441 case SOCK_DGRAM: 442 LIST_INSERT_HEAD(&unp_dhead, unp, unp_link); 443 break; 444 445 case SOCK_SEQPACKET: 446 LIST_INSERT_HEAD(&unp_sphead, unp, unp_link); 447 break; 448 449 default: 450 panic("uipc_attach"); 451 } 452 UNP_LIST_UNLOCK(); 453 454 return (0); 455} 456 457static int 458uipc_bindat(int fd, struct socket *so, struct sockaddr *nam, struct thread *td) 459{ 460 struct sockaddr_un *soun = (struct sockaddr_un *)nam; 461 struct vattr vattr; 462 int error, namelen; 463 struct nameidata nd; 464 struct unpcb *unp; 465 struct vnode *vp; 466 struct mount *mp; 467 cap_rights_t rights; 468 char *buf; 469 470 unp = sotounpcb(so); 471 KASSERT(unp != NULL, ("uipc_bind: unp == NULL")); 472 473 if (soun->sun_len > sizeof(struct sockaddr_un)) 474 return (EINVAL); 475 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path); 476 if (namelen <= 0) 477 return (EINVAL); 478 479 /* 480 * We don't allow simultaneous bind() calls on a single UNIX domain 481 * socket, so flag in-progress operations, and return an error if an 482 * operation is already in progress. 483 * 484 * Historically, we have not allowed a socket to be rebound, so this 485 * also returns an error. Not allowing re-binding simplifies the 486 * implementation and avoids a great many possible failure modes. 487 */ 488 UNP_PCB_LOCK(unp); 489 if (unp->unp_vnode != NULL) { 490 UNP_PCB_UNLOCK(unp); 491 return (EINVAL); 492 } 493 if (unp->unp_flags & UNP_BINDING) { 494 UNP_PCB_UNLOCK(unp); 495 return (EALREADY); 496 } 497 unp->unp_flags |= UNP_BINDING; 498 UNP_PCB_UNLOCK(unp); 499 500 buf = malloc(namelen + 1, M_TEMP, M_WAITOK); 501 bcopy(soun->sun_path, buf, namelen); 502 buf[namelen] = 0; 503 504restart: 505 NDINIT_ATRIGHTS(&nd, CREATE, NOFOLLOW | LOCKPARENT | SAVENAME, 506 UIO_SYSSPACE, buf, fd, cap_rights_init(&rights, CAP_BINDAT), td); 507/* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */ 508 error = namei(&nd); 509 if (error) 510 goto error; 511 vp = nd.ni_vp; 512 if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { 513 NDFREE(&nd, NDF_ONLY_PNBUF); 514 if (nd.ni_dvp == vp) 515 vrele(nd.ni_dvp); 516 else 517 vput(nd.ni_dvp); 518 if (vp != NULL) { 519 vrele(vp); 520 error = EADDRINUSE; 521 goto error; 522 } 523 error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH); 524 if (error) 525 goto error; 526 goto restart; 527 } 528 VATTR_NULL(&vattr); 529 vattr.va_type = VSOCK; 530 vattr.va_mode = (ACCESSPERMS & ~td->td_proc->p_fd->fd_cmask); 531#ifdef MAC 532 error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd, 533 &vattr); 534#endif 535 if (error == 0) 536 error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr); 537 NDFREE(&nd, NDF_ONLY_PNBUF); 538 vput(nd.ni_dvp); 539 if (error) { 540 vn_finished_write(mp); 541 goto error; 542 } 543 vp = nd.ni_vp; 544 ASSERT_VOP_ELOCKED(vp, "uipc_bind"); 545 soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK); 546 547 UNP_LINK_WLOCK(); 548 UNP_PCB_LOCK(unp); 549 VOP_UNP_BIND(vp, unp->unp_socket); 550 unp->unp_vnode = vp; 551 unp->unp_addr = soun; 552 unp->unp_flags &= ~UNP_BINDING; 553 UNP_PCB_UNLOCK(unp); 554 UNP_LINK_WUNLOCK(); 555 VOP_UNLOCK(vp, 0); 556 vn_finished_write(mp); 557 free(buf, M_TEMP); 558 return (0); 559 560error: 561 UNP_PCB_LOCK(unp); 562 unp->unp_flags &= ~UNP_BINDING; 563 UNP_PCB_UNLOCK(unp); 564 free(buf, M_TEMP); 565 return (error); 566} 567 568static int 569uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td) 570{ 571 572 return (uipc_bindat(AT_FDCWD, so, nam, td)); 573} 574 575static int 576uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 577{ 578 int error; 579 580 KASSERT(td == curthread, ("uipc_connect: td != curthread")); 581 UNP_LINK_WLOCK(); 582 error = unp_connect(so, nam, td); 583 UNP_LINK_WUNLOCK(); 584 return (error); 585} 586 587static int 588uipc_connectat(int fd, struct socket *so, struct sockaddr *nam, 589 struct thread *td) 590{ 591 int error; 592 593 KASSERT(td == curthread, ("uipc_connectat: td != curthread")); 594 UNP_LINK_WLOCK(); 595 error = unp_connectat(fd, so, nam, td); 596 UNP_LINK_WUNLOCK(); 597 return (error); 598} 599 600static void 601uipc_close(struct socket *so) 602{ 603 struct unpcb *unp, *unp2; 604 605 unp = sotounpcb(so); 606 KASSERT(unp != NULL, ("uipc_close: unp == NULL")); 607 608 UNP_LINK_WLOCK(); 609 UNP_PCB_LOCK(unp); 610 unp2 = unp->unp_conn; 611 if (unp2 != NULL) { 612 UNP_PCB_LOCK(unp2); 613 unp_disconnect(unp, unp2); 614 UNP_PCB_UNLOCK(unp2); 615 } 616 UNP_PCB_UNLOCK(unp); 617 UNP_LINK_WUNLOCK(); 618} 619 620static int 621uipc_connect2(struct socket *so1, struct socket *so2) 622{ 623 struct unpcb *unp, *unp2; 624 int error; 625 626 UNP_LINK_WLOCK(); 627 unp = so1->so_pcb; 628 KASSERT(unp != NULL, ("uipc_connect2: unp == NULL")); 629 UNP_PCB_LOCK(unp); 630 unp2 = so2->so_pcb; 631 KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL")); 632 UNP_PCB_LOCK(unp2); 633 error = unp_connect2(so1, so2, PRU_CONNECT2); 634 UNP_PCB_UNLOCK(unp2); 635 UNP_PCB_UNLOCK(unp); 636 UNP_LINK_WUNLOCK(); 637 return (error); 638} 639 640static void 641uipc_detach(struct socket *so) 642{ 643 struct unpcb *unp, *unp2; 644 struct sockaddr_un *saved_unp_addr; 645 struct vnode *vp; 646 int freeunp, local_unp_rights; 647 648 unp = sotounpcb(so); 649 KASSERT(unp != NULL, ("uipc_detach: unp == NULL")); 650 651 UNP_LINK_WLOCK(); 652 UNP_LIST_LOCK(); 653 UNP_PCB_LOCK(unp); 654 LIST_REMOVE(unp, unp_link); 655 unp->unp_gencnt = ++unp_gencnt; 656 --unp_count; 657 UNP_LIST_UNLOCK(); 658 659 /* 660 * XXXRW: Should assert vp->v_socket == so. 661 */ 662 if ((vp = unp->unp_vnode) != NULL) { 663 VOP_UNP_DETACH(vp); 664 unp->unp_vnode = NULL; 665 } 666 unp2 = unp->unp_conn; 667 if (unp2 != NULL) { 668 UNP_PCB_LOCK(unp2); 669 unp_disconnect(unp, unp2); 670 UNP_PCB_UNLOCK(unp2); 671 } 672 673 /* 674 * We hold the linkage lock exclusively, so it's OK to acquire 675 * multiple pcb locks at a time. 676 */ 677 while (!LIST_EMPTY(&unp->unp_refs)) { 678 struct unpcb *ref = LIST_FIRST(&unp->unp_refs); 679 680 UNP_PCB_LOCK(ref); 681 unp_drop(ref, ECONNRESET); 682 UNP_PCB_UNLOCK(ref); 683 } 684 local_unp_rights = unp_rights; 685 UNP_LINK_WUNLOCK(); 686 unp->unp_socket->so_pcb = NULL; 687 saved_unp_addr = unp->unp_addr; 688 unp->unp_addr = NULL; 689 unp->unp_refcount--; 690 freeunp = (unp->unp_refcount == 0); 691 if (saved_unp_addr != NULL) 692 free(saved_unp_addr, M_SONAME); 693 if (freeunp) { 694 UNP_PCB_LOCK_DESTROY(unp); 695 uma_zfree(unp_zone, unp); 696 } else 697 UNP_PCB_UNLOCK(unp); 698 if (vp) 699 vrele(vp); 700 if (local_unp_rights) 701 taskqueue_enqueue_timeout(taskqueue_thread, &unp_gc_task, -1); 702} 703 704static int 705uipc_disconnect(struct socket *so) 706{ 707 struct unpcb *unp, *unp2; 708 709 unp = sotounpcb(so); 710 KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL")); 711 712 UNP_LINK_WLOCK(); 713 UNP_PCB_LOCK(unp); 714 unp2 = unp->unp_conn; 715 if (unp2 != NULL) { 716 UNP_PCB_LOCK(unp2); 717 unp_disconnect(unp, unp2); 718 UNP_PCB_UNLOCK(unp2); 719 } 720 UNP_PCB_UNLOCK(unp); 721 UNP_LINK_WUNLOCK(); 722 return (0); 723} 724 725static int 726uipc_listen(struct socket *so, int backlog, struct thread *td) 727{ 728 struct unpcb *unp; 729 int error; 730 731 unp = sotounpcb(so); 732 KASSERT(unp != NULL, ("uipc_listen: unp == NULL")); 733 734 UNP_PCB_LOCK(unp); 735 if (unp->unp_vnode == NULL) { 736 UNP_PCB_UNLOCK(unp); 737 return (EINVAL); 738 } 739 740 SOCK_LOCK(so); 741 error = solisten_proto_check(so); 742 if (error == 0) { 743 cru2x(td->td_ucred, &unp->unp_peercred); 744 unp->unp_flags |= UNP_HAVEPCCACHED; 745 solisten_proto(so, backlog); 746 } 747 SOCK_UNLOCK(so); 748 UNP_PCB_UNLOCK(unp); 749 return (error); 750} 751 752static int 753uipc_peeraddr(struct socket *so, struct sockaddr **nam) 754{ 755 struct unpcb *unp, *unp2; 756 const struct sockaddr *sa; 757 758 unp = sotounpcb(so); 759 KASSERT(unp != NULL, ("uipc_peeraddr: unp == NULL")); 760 761 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 762 UNP_LINK_RLOCK(); 763 /* 764 * XXX: It seems that this test always fails even when connection is 765 * established. So, this else clause is added as workaround to 766 * return PF_LOCAL sockaddr. 767 */ 768 unp2 = unp->unp_conn; 769 if (unp2 != NULL) { 770 UNP_PCB_LOCK(unp2); 771 if (unp2->unp_addr != NULL) 772 sa = (struct sockaddr *) unp2->unp_addr; 773 else 774 sa = &sun_noname; 775 bcopy(sa, *nam, sa->sa_len); 776 UNP_PCB_UNLOCK(unp2); 777 } else { 778 sa = &sun_noname; 779 bcopy(sa, *nam, sa->sa_len); 780 } 781 UNP_LINK_RUNLOCK(); 782 return (0); 783} 784 785static int 786uipc_rcvd(struct socket *so, int flags) 787{ 788 struct unpcb *unp, *unp2; 789 struct socket *so2; 790 u_int mbcnt, sbcc; 791 u_long newhiwat; 792 793 unp = sotounpcb(so); 794 KASSERT(unp != NULL, ("uipc_rcvd: unp == NULL")); 795 796 if (so->so_type != SOCK_STREAM && so->so_type != SOCK_SEQPACKET) 797 panic("uipc_rcvd socktype %d", so->so_type); 798 799 /* 800 * Adjust backpressure on sender and wakeup any waiting to write. 801 * 802 * The unp lock is acquired to maintain the validity of the unp_conn 803 * pointer; no lock on unp2 is required as unp2->unp_socket will be 804 * static as long as we don't permit unp2 to disconnect from unp, 805 * which is prevented by the lock on unp. We cache values from 806 * so_rcv to avoid holding the so_rcv lock over the entire 807 * transaction on the remote so_snd. 808 */ 809 SOCKBUF_LOCK(&so->so_rcv); 810 mbcnt = so->so_rcv.sb_mbcnt; 811 sbcc = so->so_rcv.sb_cc; 812 SOCKBUF_UNLOCK(&so->so_rcv); 813 UNP_PCB_LOCK(unp); 814 unp2 = unp->unp_conn; 815 if (unp2 == NULL) { 816 UNP_PCB_UNLOCK(unp); 817 return (0); 818 } 819 so2 = unp2->unp_socket; 820 SOCKBUF_LOCK(&so2->so_snd); 821 so2->so_snd.sb_mbmax += unp->unp_mbcnt - mbcnt; 822 newhiwat = so2->so_snd.sb_hiwat + unp->unp_cc - sbcc; 823 (void)chgsbsize(so2->so_cred->cr_uidinfo, &so2->so_snd.sb_hiwat, 824 newhiwat, RLIM_INFINITY); 825 sowwakeup_locked(so2); 826 unp->unp_mbcnt = mbcnt; 827 unp->unp_cc = sbcc; 828 UNP_PCB_UNLOCK(unp); 829 return (0); 830} 831 832static int 833uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, 834 struct mbuf *control, struct thread *td) 835{ 836 struct unpcb *unp, *unp2; 837 struct socket *so2; 838 u_int mbcnt_delta, sbcc; 839 u_int newhiwat; 840 int error = 0; 841 842 unp = sotounpcb(so); 843 KASSERT(unp != NULL, ("uipc_send: unp == NULL")); 844 845 if (flags & PRUS_OOB) { 846 error = EOPNOTSUPP; 847 goto release; 848 } 849 if (control != NULL && (error = unp_internalize(&control, td))) 850 goto release; 851 if ((nam != NULL) || (flags & PRUS_EOF)) 852 UNP_LINK_WLOCK(); 853 else 854 UNP_LINK_RLOCK(); 855 switch (so->so_type) { 856 case SOCK_DGRAM: 857 { 858 const struct sockaddr *from; 859 860 unp2 = unp->unp_conn; 861 if (nam != NULL) { 862 UNP_LINK_WLOCK_ASSERT(); 863 if (unp2 != NULL) { 864 error = EISCONN; 865 break; 866 } 867 error = unp_connect(so, nam, td); 868 if (error) 869 break; 870 unp2 = unp->unp_conn; 871 } 872 873 /* 874 * Because connect() and send() are non-atomic in a sendto() 875 * with a target address, it's possible that the socket will 876 * have disconnected before the send() can run. In that case 877 * return the slightly counter-intuitive but otherwise 878 * correct error that the socket is not connected. 879 */ 880 if (unp2 == NULL) { 881 error = ENOTCONN; 882 break; 883 } 884 /* Lockless read. */ 885 if (unp2->unp_flags & UNP_WANTCRED) 886 control = unp_addsockcred(td, control); 887 UNP_PCB_LOCK(unp); 888 if (unp->unp_addr != NULL) 889 from = (struct sockaddr *)unp->unp_addr; 890 else 891 from = &sun_noname; 892 so2 = unp2->unp_socket; 893 SOCKBUF_LOCK(&so2->so_rcv); 894 if (sbappendaddr_locked(&so2->so_rcv, from, m, control)) { 895 sorwakeup_locked(so2); 896 m = NULL; 897 control = NULL; 898 } else { 899 SOCKBUF_UNLOCK(&so2->so_rcv); 900 error = ENOBUFS; 901 } 902 if (nam != NULL) { 903 UNP_LINK_WLOCK_ASSERT(); 904 UNP_PCB_LOCK(unp2); 905 unp_disconnect(unp, unp2); 906 UNP_PCB_UNLOCK(unp2); 907 } 908 UNP_PCB_UNLOCK(unp); 909 break; 910 } 911 912 case SOCK_SEQPACKET: 913 case SOCK_STREAM: 914 if ((so->so_state & SS_ISCONNECTED) == 0) { 915 if (nam != NULL) { 916 UNP_LINK_WLOCK_ASSERT(); 917 error = unp_connect(so, nam, td); 918 if (error) 919 break; /* XXX */ 920 } else { 921 error = ENOTCONN; 922 break; 923 } 924 } 925 926 /* Lockless read. */ 927 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 928 error = EPIPE; 929 break; 930 } 931 932 /* 933 * Because connect() and send() are non-atomic in a sendto() 934 * with a target address, it's possible that the socket will 935 * have disconnected before the send() can run. In that case 936 * return the slightly counter-intuitive but otherwise 937 * correct error that the socket is not connected. 938 * 939 * Locking here must be done carefully: the linkage lock 940 * prevents interconnections between unpcbs from changing, so 941 * we can traverse from unp to unp2 without acquiring unp's 942 * lock. Socket buffer locks follow unpcb locks, so we can 943 * acquire both remote and lock socket buffer locks. 944 */ 945 unp2 = unp->unp_conn; 946 if (unp2 == NULL) { 947 error = ENOTCONN; 948 break; 949 } 950 so2 = unp2->unp_socket; 951 UNP_PCB_LOCK(unp2); 952 SOCKBUF_LOCK(&so2->so_rcv); 953 if (unp2->unp_flags & UNP_WANTCRED) { 954 /* 955 * Credentials are passed only once on SOCK_STREAM 956 * and SOCK_SEQPACKET. 957 */ 958 unp2->unp_flags &= ~UNP_WANTCRED; 959 control = unp_addsockcred(td, control); 960 } 961 /* 962 * Send to paired receive port, and then reduce send buffer 963 * hiwater marks to maintain backpressure. Wake up readers. 964 */ 965 switch (so->so_type) { 966 case SOCK_STREAM: 967 if (control != NULL) { 968 if (sbappendcontrol_locked(&so2->so_rcv, m, 969 control)) 970 control = NULL; 971 } else 972 sbappend_locked(&so2->so_rcv, m); 973 break; 974 975 case SOCK_SEQPACKET: { 976 const struct sockaddr *from; 977 978 from = &sun_noname; 979 if (sbappendaddr_locked(&so2->so_rcv, from, m, 980 control)) 981 control = NULL; 982 break; 983 } 984 } 985 986 /* 987 * XXXRW: While fine for SOCK_STREAM, this conflates maximum 988 * datagram size and back-pressure for SOCK_SEQPACKET, which 989 * can lead to undesired return of EMSGSIZE on send instead 990 * of more desirable blocking. 991 */ 992 mbcnt_delta = so2->so_rcv.sb_mbcnt - unp2->unp_mbcnt; 993 unp2->unp_mbcnt = so2->so_rcv.sb_mbcnt; 994 sbcc = so2->so_rcv.sb_cc; 995 sorwakeup_locked(so2); 996 997 SOCKBUF_LOCK(&so->so_snd); 998 if ((int)so->so_snd.sb_hiwat >= (int)(sbcc - unp2->unp_cc)) 999 newhiwat = so->so_snd.sb_hiwat - (sbcc - unp2->unp_cc); 1000 else 1001 newhiwat = 0; 1002 (void)chgsbsize(so->so_cred->cr_uidinfo, &so->so_snd.sb_hiwat, 1003 newhiwat, RLIM_INFINITY); 1004 so->so_snd.sb_mbmax -= mbcnt_delta; 1005 SOCKBUF_UNLOCK(&so->so_snd); 1006 unp2->unp_cc = sbcc; 1007 UNP_PCB_UNLOCK(unp2); 1008 m = NULL; 1009 break; 1010 1011 default: 1012 panic("uipc_send unknown socktype"); 1013 } 1014 1015 /* 1016 * PRUS_EOF is equivalent to pru_send followed by pru_shutdown. 1017 */ 1018 if (flags & PRUS_EOF) { 1019 UNP_PCB_LOCK(unp); 1020 socantsendmore(so); 1021 unp_shutdown(unp); 1022 UNP_PCB_UNLOCK(unp); 1023 } 1024 1025 if ((nam != NULL) || (flags & PRUS_EOF)) 1026 UNP_LINK_WUNLOCK(); 1027 else 1028 UNP_LINK_RUNLOCK(); 1029 1030 if (control != NULL && error != 0) 1031 unp_dispose(control); 1032 1033release: 1034 if (control != NULL) 1035 m_freem(control); 1036 if (m != NULL) 1037 m_freem(m); 1038 return (error); 1039} 1040 1041static int 1042uipc_sense(struct socket *so, struct stat *sb) 1043{ 1044 struct unpcb *unp, *unp2; 1045 struct socket *so2; 1046 1047 unp = sotounpcb(so); 1048 KASSERT(unp != NULL, ("uipc_sense: unp == NULL")); 1049 1050 sb->st_blksize = so->so_snd.sb_hiwat; 1051 UNP_LINK_RLOCK(); 1052 UNP_PCB_LOCK(unp); 1053 unp2 = unp->unp_conn; 1054 if ((so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET) && 1055 unp2 != NULL) { 1056 so2 = unp2->unp_socket; 1057 sb->st_blksize += so2->so_rcv.sb_cc; 1058 } 1059 sb->st_dev = NODEV; 1060 if (unp->unp_ino == 0) 1061 unp->unp_ino = (++unp_ino == 0) ? ++unp_ino : unp_ino; 1062 sb->st_ino = unp->unp_ino; 1063 UNP_PCB_UNLOCK(unp); 1064 UNP_LINK_RUNLOCK(); 1065 return (0); 1066} 1067 1068static int 1069uipc_shutdown(struct socket *so) 1070{ 1071 struct unpcb *unp; 1072 1073 unp = sotounpcb(so); 1074 KASSERT(unp != NULL, ("uipc_shutdown: unp == NULL")); 1075 1076 UNP_LINK_WLOCK(); 1077 UNP_PCB_LOCK(unp); 1078 socantsendmore(so); 1079 unp_shutdown(unp); 1080 UNP_PCB_UNLOCK(unp); 1081 UNP_LINK_WUNLOCK(); 1082 return (0); 1083} 1084 1085static int 1086uipc_sockaddr(struct socket *so, struct sockaddr **nam) 1087{ 1088 struct unpcb *unp; 1089 const struct sockaddr *sa; 1090 1091 unp = sotounpcb(so); 1092 KASSERT(unp != NULL, ("uipc_sockaddr: unp == NULL")); 1093 1094 *nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 1095 UNP_PCB_LOCK(unp); 1096 if (unp->unp_addr != NULL) 1097 sa = (struct sockaddr *) unp->unp_addr; 1098 else 1099 sa = &sun_noname; 1100 bcopy(sa, *nam, sa->sa_len); 1101 UNP_PCB_UNLOCK(unp); 1102 return (0); 1103} 1104 1105static struct pr_usrreqs uipc_usrreqs_dgram = { 1106 .pru_abort = uipc_abort, 1107 .pru_accept = uipc_accept, 1108 .pru_attach = uipc_attach, 1109 .pru_bind = uipc_bind, 1110 .pru_bindat = uipc_bindat, 1111 .pru_connect = uipc_connect, 1112 .pru_connectat = uipc_connectat, 1113 .pru_connect2 = uipc_connect2, 1114 .pru_detach = uipc_detach, 1115 .pru_disconnect = uipc_disconnect, 1116 .pru_listen = uipc_listen, 1117 .pru_peeraddr = uipc_peeraddr, 1118 .pru_rcvd = uipc_rcvd, 1119 .pru_send = uipc_send, 1120 .pru_sense = uipc_sense, 1121 .pru_shutdown = uipc_shutdown, 1122 .pru_sockaddr = uipc_sockaddr, 1123 .pru_soreceive = soreceive_dgram, 1124 .pru_close = uipc_close, 1125}; 1126 1127static struct pr_usrreqs uipc_usrreqs_seqpacket = { 1128 .pru_abort = uipc_abort, 1129 .pru_accept = uipc_accept, 1130 .pru_attach = uipc_attach, 1131 .pru_bind = uipc_bind, 1132 .pru_bindat = uipc_bindat, 1133 .pru_connect = uipc_connect, 1134 .pru_connectat = uipc_connectat, 1135 .pru_connect2 = uipc_connect2, 1136 .pru_detach = uipc_detach, 1137 .pru_disconnect = uipc_disconnect, 1138 .pru_listen = uipc_listen, 1139 .pru_peeraddr = uipc_peeraddr, 1140 .pru_rcvd = uipc_rcvd, 1141 .pru_send = uipc_send, 1142 .pru_sense = uipc_sense, 1143 .pru_shutdown = uipc_shutdown, 1144 .pru_sockaddr = uipc_sockaddr, 1145 .pru_soreceive = soreceive_generic, /* XXX: or...? */ 1146 .pru_close = uipc_close, 1147}; 1148 1149static struct pr_usrreqs uipc_usrreqs_stream = { 1150 .pru_abort = uipc_abort, 1151 .pru_accept = uipc_accept, 1152 .pru_attach = uipc_attach, 1153 .pru_bind = uipc_bind, 1154 .pru_bindat = uipc_bindat, 1155 .pru_connect = uipc_connect, 1156 .pru_connectat = uipc_connectat, 1157 .pru_connect2 = uipc_connect2, 1158 .pru_detach = uipc_detach, 1159 .pru_disconnect = uipc_disconnect, 1160 .pru_listen = uipc_listen, 1161 .pru_peeraddr = uipc_peeraddr, 1162 .pru_rcvd = uipc_rcvd, 1163 .pru_send = uipc_send, 1164 .pru_sense = uipc_sense, 1165 .pru_shutdown = uipc_shutdown, 1166 .pru_sockaddr = uipc_sockaddr, 1167 .pru_soreceive = soreceive_generic, 1168 .pru_close = uipc_close, 1169}; 1170 1171static int 1172uipc_ctloutput(struct socket *so, struct sockopt *sopt) 1173{ 1174 struct unpcb *unp; 1175 struct xucred xu; 1176 int error, optval; 1177 1178 if (sopt->sopt_level != 0) 1179 return (EINVAL); 1180 1181 unp = sotounpcb(so); 1182 KASSERT(unp != NULL, ("uipc_ctloutput: unp == NULL")); 1183 error = 0; 1184 switch (sopt->sopt_dir) { 1185 case SOPT_GET: 1186 switch (sopt->sopt_name) { 1187 case LOCAL_PEERCRED: 1188 UNP_PCB_LOCK(unp); 1189 if (unp->unp_flags & UNP_HAVEPC) 1190 xu = unp->unp_peercred; 1191 else { 1192 if (so->so_type == SOCK_STREAM) 1193 error = ENOTCONN; 1194 else 1195 error = EINVAL; 1196 } 1197 UNP_PCB_UNLOCK(unp); 1198 if (error == 0) 1199 error = sooptcopyout(sopt, &xu, sizeof(xu)); 1200 break; 1201 1202 case LOCAL_CREDS: 1203 /* Unlocked read. */ 1204 optval = unp->unp_flags & UNP_WANTCRED ? 1 : 0; 1205 error = sooptcopyout(sopt, &optval, sizeof(optval)); 1206 break; 1207 1208 case LOCAL_CONNWAIT: 1209 /* Unlocked read. */ 1210 optval = unp->unp_flags & UNP_CONNWAIT ? 1 : 0; 1211 error = sooptcopyout(sopt, &optval, sizeof(optval)); 1212 break; 1213 1214 default: 1215 error = EOPNOTSUPP; 1216 break; 1217 } 1218 break; 1219 1220 case SOPT_SET: 1221 switch (sopt->sopt_name) { 1222 case LOCAL_CREDS: 1223 case LOCAL_CONNWAIT: 1224 error = sooptcopyin(sopt, &optval, sizeof(optval), 1225 sizeof(optval)); 1226 if (error) 1227 break; 1228 1229#define OPTSET(bit) do { \ 1230 UNP_PCB_LOCK(unp); \ 1231 if (optval) \ 1232 unp->unp_flags |= bit; \ 1233 else \ 1234 unp->unp_flags &= ~bit; \ 1235 UNP_PCB_UNLOCK(unp); \ 1236} while (0) 1237 1238 switch (sopt->sopt_name) { 1239 case LOCAL_CREDS: 1240 OPTSET(UNP_WANTCRED); 1241 break; 1242 1243 case LOCAL_CONNWAIT: 1244 OPTSET(UNP_CONNWAIT); 1245 break; 1246 1247 default: 1248 break; 1249 } 1250 break; 1251#undef OPTSET 1252 default: 1253 error = ENOPROTOOPT; 1254 break; 1255 } 1256 break; 1257 1258 default: 1259 error = EOPNOTSUPP; 1260 break; 1261 } 1262 return (error); 1263} 1264 1265static int 1266unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 1267{ 1268 1269 return (unp_connectat(AT_FDCWD, so, nam, td)); 1270} 1271 1272static int 1273unp_connectat(int fd, struct socket *so, struct sockaddr *nam, 1274 struct thread *td) 1275{ 1276 struct sockaddr_un *soun = (struct sockaddr_un *)nam; 1277 struct vnode *vp; 1278 struct socket *so2, *so3; 1279 struct unpcb *unp, *unp2, *unp3; 1280 struct nameidata nd; 1281 char buf[SOCK_MAXADDRLEN]; 1282 struct sockaddr *sa; 1283 cap_rights_t rights; 1284 int error, len; 1285 1286 UNP_LINK_WLOCK_ASSERT(); 1287 1288 unp = sotounpcb(so); 1289 KASSERT(unp != NULL, ("unp_connect: unp == NULL")); 1290 1291 if (nam->sa_len > sizeof(struct sockaddr_un)) 1292 return (EINVAL); 1293 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path); 1294 if (len <= 0) 1295 return (EINVAL); 1296 bcopy(soun->sun_path, buf, len); 1297 buf[len] = 0; 1298 1299 UNP_PCB_LOCK(unp); 1300 if (unp->unp_flags & UNP_CONNECTING) { 1301 UNP_PCB_UNLOCK(unp); 1302 return (EALREADY); 1303 } 1304 UNP_LINK_WUNLOCK(); 1305 unp->unp_flags |= UNP_CONNECTING; 1306 UNP_PCB_UNLOCK(unp); 1307 1308 sa = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK); 1309 NDINIT_ATRIGHTS(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF, 1310 UIO_SYSSPACE, buf, fd, cap_rights_init(&rights, CAP_CONNECTAT), td); 1311 error = namei(&nd); 1312 if (error) 1313 vp = NULL; 1314 else 1315 vp = nd.ni_vp; 1316 ASSERT_VOP_LOCKED(vp, "unp_connect"); 1317 NDFREE(&nd, NDF_ONLY_PNBUF); 1318 if (error) 1319 goto bad; 1320 1321 if (vp->v_type != VSOCK) { 1322 error = ENOTSOCK; 1323 goto bad; 1324 } 1325#ifdef MAC 1326 error = mac_vnode_check_open(td->td_ucred, vp, VWRITE | VREAD); 1327 if (error) 1328 goto bad; 1329#endif 1330 error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td); 1331 if (error) 1332 goto bad; 1333 1334 unp = sotounpcb(so); 1335 KASSERT(unp != NULL, ("unp_connect: unp == NULL")); 1336 1337 /* 1338 * Lock linkage lock for two reasons: make sure v_socket is stable, 1339 * and to protect simultaneous locking of multiple pcbs. 1340 */ 1341 UNP_LINK_WLOCK(); 1342 VOP_UNP_CONNECT(vp, &so2); 1343 if (so2 == NULL) { 1344 error = ECONNREFUSED; 1345 goto bad2; 1346 } 1347 if (so->so_type != so2->so_type) { 1348 error = EPROTOTYPE; 1349 goto bad2; 1350 } 1351 if (so->so_proto->pr_flags & PR_CONNREQUIRED) { 1352 if (so2->so_options & SO_ACCEPTCONN) { 1353 CURVNET_SET(so2->so_vnet); 1354 so3 = sonewconn(so2, 0); 1355 CURVNET_RESTORE(); 1356 } else 1357 so3 = NULL; 1358 if (so3 == NULL) { 1359 error = ECONNREFUSED; 1360 goto bad2; 1361 } 1362 unp = sotounpcb(so); 1363 unp2 = sotounpcb(so2); 1364 unp3 = sotounpcb(so3); 1365 UNP_PCB_LOCK(unp); 1366 UNP_PCB_LOCK(unp2); 1367 UNP_PCB_LOCK(unp3); 1368 if (unp2->unp_addr != NULL) { 1369 bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len); 1370 unp3->unp_addr = (struct sockaddr_un *) sa; 1371 sa = NULL; 1372 } 1373 1374 /* 1375 * The connector's (client's) credentials are copied from its 1376 * process structure at the time of connect() (which is now). 1377 */ 1378 cru2x(td->td_ucred, &unp3->unp_peercred); 1379 unp3->unp_flags |= UNP_HAVEPC; 1380 1381 /* 1382 * The receiver's (server's) credentials are copied from the 1383 * unp_peercred member of socket on which the former called 1384 * listen(); uipc_listen() cached that process's credentials 1385 * at that time so we can use them now. 1386 */ 1387 KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED, 1388 ("unp_connect: listener without cached peercred")); 1389 memcpy(&unp->unp_peercred, &unp2->unp_peercred, 1390 sizeof(unp->unp_peercred)); 1391 unp->unp_flags |= UNP_HAVEPC; 1392 if (unp2->unp_flags & UNP_WANTCRED) 1393 unp3->unp_flags |= UNP_WANTCRED; 1394 UNP_PCB_UNLOCK(unp3); 1395 UNP_PCB_UNLOCK(unp2); 1396 UNP_PCB_UNLOCK(unp); 1397#ifdef MAC 1398 mac_socketpeer_set_from_socket(so, so3); 1399 mac_socketpeer_set_from_socket(so3, so); 1400#endif 1401 1402 so2 = so3; 1403 } 1404 unp = sotounpcb(so); 1405 KASSERT(unp != NULL, ("unp_connect: unp == NULL")); 1406 unp2 = sotounpcb(so2); 1407 KASSERT(unp2 != NULL, ("unp_connect: unp2 == NULL")); 1408 UNP_PCB_LOCK(unp); 1409 UNP_PCB_LOCK(unp2); 1410 error = unp_connect2(so, so2, PRU_CONNECT); 1411 UNP_PCB_UNLOCK(unp2); 1412 UNP_PCB_UNLOCK(unp); 1413bad2: 1414 UNP_LINK_WUNLOCK(); 1415bad: 1416 if (vp != NULL) 1417 vput(vp); 1418 free(sa, M_SONAME); 1419 UNP_LINK_WLOCK(); 1420 UNP_PCB_LOCK(unp); 1421 unp->unp_flags &= ~UNP_CONNECTING; 1422 UNP_PCB_UNLOCK(unp); 1423 return (error); 1424} 1425 1426static int 1427unp_connect2(struct socket *so, struct socket *so2, int req) 1428{ 1429 struct unpcb *unp; 1430 struct unpcb *unp2; 1431 1432 unp = sotounpcb(so); 1433 KASSERT(unp != NULL, ("unp_connect2: unp == NULL")); 1434 unp2 = sotounpcb(so2); 1435 KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL")); 1436 1437 UNP_LINK_WLOCK_ASSERT(); 1438 UNP_PCB_LOCK_ASSERT(unp); 1439 UNP_PCB_LOCK_ASSERT(unp2); 1440 1441 if (so2->so_type != so->so_type) 1442 return (EPROTOTYPE); 1443 unp->unp_conn = unp2; 1444 1445 switch (so->so_type) { 1446 case SOCK_DGRAM: 1447 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink); 1448 soisconnected(so); 1449 break; 1450 1451 case SOCK_STREAM: 1452 case SOCK_SEQPACKET: 1453 unp2->unp_conn = unp; 1454 if (req == PRU_CONNECT && 1455 ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT)) 1456 soisconnecting(so); 1457 else 1458 soisconnected(so); 1459 soisconnected(so2); 1460 break; 1461 1462 default: 1463 panic("unp_connect2"); 1464 } 1465 return (0); 1466} 1467 1468static void 1469unp_disconnect(struct unpcb *unp, struct unpcb *unp2) 1470{ 1471 struct socket *so; 1472 1473 KASSERT(unp2 != NULL, ("unp_disconnect: unp2 == NULL")); 1474 1475 UNP_LINK_WLOCK_ASSERT(); 1476 UNP_PCB_LOCK_ASSERT(unp); 1477 UNP_PCB_LOCK_ASSERT(unp2); 1478 1479 unp->unp_conn = NULL; 1480 switch (unp->unp_socket->so_type) { 1481 case SOCK_DGRAM: 1482 LIST_REMOVE(unp, unp_reflink); 1483 so = unp->unp_socket; 1484 SOCK_LOCK(so); 1485 so->so_state &= ~SS_ISCONNECTED; 1486 SOCK_UNLOCK(so); 1487 break; 1488 1489 case SOCK_STREAM: 1490 case SOCK_SEQPACKET: 1491 soisdisconnected(unp->unp_socket); 1492 unp2->unp_conn = NULL; 1493 soisdisconnected(unp2->unp_socket); 1494 break; 1495 } 1496} 1497 1498/* 1499 * unp_pcblist() walks the global list of struct unpcb's to generate a 1500 * pointer list, bumping the refcount on each unpcb. It then copies them out 1501 * sequentially, validating the generation number on each to see if it has 1502 * been detached. All of this is necessary because copyout() may sleep on 1503 * disk I/O. 1504 */ 1505static int 1506unp_pcblist(SYSCTL_HANDLER_ARGS) 1507{ 1508 int error, i, n; 1509 int freeunp; 1510 struct unpcb *unp, **unp_list; 1511 unp_gen_t gencnt; 1512 struct xunpgen *xug; 1513 struct unp_head *head; 1514 struct xunpcb *xu; 1515 1516 switch ((intptr_t)arg1) { 1517 case SOCK_STREAM: 1518 head = &unp_shead; 1519 break; 1520 1521 case SOCK_DGRAM: 1522 head = &unp_dhead; 1523 break; 1524 1525 case SOCK_SEQPACKET: 1526 head = &unp_sphead; 1527 break; 1528 1529 default: 1530 panic("unp_pcblist: arg1 %d", (int)(intptr_t)arg1); 1531 } 1532 1533 /* 1534 * The process of preparing the PCB list is too time-consuming and 1535 * resource-intensive to repeat twice on every request. 1536 */ 1537 if (req->oldptr == NULL) { 1538 n = unp_count; 1539 req->oldidx = 2 * (sizeof *xug) 1540 + (n + n/8) * sizeof(struct xunpcb); 1541 return (0); 1542 } 1543 1544 if (req->newptr != NULL) 1545 return (EPERM); 1546 1547 /* 1548 * OK, now we're committed to doing something. 1549 */ 1550 xug = malloc(sizeof(*xug), M_TEMP, M_WAITOK); 1551 UNP_LIST_LOCK(); 1552 gencnt = unp_gencnt; 1553 n = unp_count; 1554 UNP_LIST_UNLOCK(); 1555 1556 xug->xug_len = sizeof *xug; 1557 xug->xug_count = n; 1558 xug->xug_gen = gencnt; 1559 xug->xug_sogen = so_gencnt; 1560 error = SYSCTL_OUT(req, xug, sizeof *xug); 1561 if (error) { 1562 free(xug, M_TEMP); 1563 return (error); 1564 } 1565 1566 unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK); 1567 1568 UNP_LIST_LOCK(); 1569 for (unp = LIST_FIRST(head), i = 0; unp && i < n; 1570 unp = LIST_NEXT(unp, unp_link)) { 1571 UNP_PCB_LOCK(unp); 1572 if (unp->unp_gencnt <= gencnt) { 1573 if (cr_cansee(req->td->td_ucred, 1574 unp->unp_socket->so_cred)) { 1575 UNP_PCB_UNLOCK(unp); 1576 continue; 1577 } 1578 unp_list[i++] = unp; 1579 unp->unp_refcount++; 1580 } 1581 UNP_PCB_UNLOCK(unp); 1582 } 1583 UNP_LIST_UNLOCK(); 1584 n = i; /* In case we lost some during malloc. */ 1585 1586 error = 0; 1587 xu = malloc(sizeof(*xu), M_TEMP, M_WAITOK | M_ZERO); 1588 for (i = 0; i < n; i++) { 1589 unp = unp_list[i]; 1590 UNP_PCB_LOCK(unp); 1591 unp->unp_refcount--; 1592 if (unp->unp_refcount != 0 && unp->unp_gencnt <= gencnt) { 1593 xu->xu_len = sizeof *xu; 1594 xu->xu_unpp = unp; 1595 /* 1596 * XXX - need more locking here to protect against 1597 * connect/disconnect races for SMP. 1598 */ 1599 if (unp->unp_addr != NULL) 1600 bcopy(unp->unp_addr, &xu->xu_addr, 1601 unp->unp_addr->sun_len); 1602 if (unp->unp_conn != NULL && 1603 unp->unp_conn->unp_addr != NULL) 1604 bcopy(unp->unp_conn->unp_addr, 1605 &xu->xu_caddr, 1606 unp->unp_conn->unp_addr->sun_len); 1607 bcopy(unp, &xu->xu_unp, sizeof *unp); 1608 sotoxsocket(unp->unp_socket, &xu->xu_socket); 1609 UNP_PCB_UNLOCK(unp); 1610 error = SYSCTL_OUT(req, xu, sizeof *xu); 1611 } else { 1612 freeunp = (unp->unp_refcount == 0); 1613 UNP_PCB_UNLOCK(unp); 1614 if (freeunp) { 1615 UNP_PCB_LOCK_DESTROY(unp); 1616 uma_zfree(unp_zone, unp); 1617 } 1618 } 1619 } 1620 free(xu, M_TEMP); 1621 if (!error) { 1622 /* 1623 * Give the user an updated idea of our state. If the 1624 * generation differs from what we told her before, she knows 1625 * that something happened while we were processing this 1626 * request, and it might be necessary to retry. 1627 */ 1628 xug->xug_gen = unp_gencnt; 1629 xug->xug_sogen = so_gencnt; 1630 xug->xug_count = unp_count; 1631 error = SYSCTL_OUT(req, xug, sizeof *xug); 1632 } 1633 free(unp_list, M_TEMP); 1634 free(xug, M_TEMP); 1635 return (error); 1636} 1637 1638SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLTYPE_OPAQUE | CTLFLAG_RD, 1639 (void *)(intptr_t)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb", 1640 "List of active local datagram sockets"); 1641SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLTYPE_OPAQUE | CTLFLAG_RD, 1642 (void *)(intptr_t)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb", 1643 "List of active local stream sockets"); 1644SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist, 1645 CTLTYPE_OPAQUE | CTLFLAG_RD, 1646 (void *)(intptr_t)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb", 1647 "List of active local seqpacket sockets"); 1648 1649static void 1650unp_shutdown(struct unpcb *unp) 1651{ 1652 struct unpcb *unp2; 1653 struct socket *so; 1654 1655 UNP_LINK_WLOCK_ASSERT(); 1656 UNP_PCB_LOCK_ASSERT(unp); 1657 1658 unp2 = unp->unp_conn; 1659 if ((unp->unp_socket->so_type == SOCK_STREAM || 1660 (unp->unp_socket->so_type == SOCK_SEQPACKET)) && unp2 != NULL) { 1661 so = unp2->unp_socket; 1662 if (so != NULL) 1663 socantrcvmore(so); 1664 } 1665} 1666 1667static void 1668unp_drop(struct unpcb *unp, int errno) 1669{ 1670 struct socket *so = unp->unp_socket; 1671 struct unpcb *unp2; 1672 1673 UNP_LINK_WLOCK_ASSERT(); 1674 UNP_PCB_LOCK_ASSERT(unp); 1675 1676 so->so_error = errno; 1677 unp2 = unp->unp_conn; 1678 if (unp2 == NULL) 1679 return; 1680 UNP_PCB_LOCK(unp2); 1681 unp_disconnect(unp, unp2); 1682 UNP_PCB_UNLOCK(unp2); 1683} 1684 1685static void 1686unp_freerights(struct filedescent **fdep, int fdcount) 1687{ 1688 struct file *fp; 1689 int i; 1690 1691 KASSERT(fdcount > 0, ("%s: fdcount %d", __func__, fdcount)); 1692 1693 for (i = 0; i < fdcount; i++) { 1694 fp = fdep[i]->fde_file; 1695 filecaps_free(&fdep[i]->fde_caps); 1696 unp_discard(fp); 1697 } 1698 free(fdep[0], M_FILECAPS); 1699} 1700 1701static int 1702unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags) 1703{ 1704 struct thread *td = curthread; /* XXX */ 1705 struct cmsghdr *cm = mtod(control, struct cmsghdr *); 1706 int i; 1707 int *fdp; 1708 struct filedesc *fdesc = td->td_proc->p_fd; 1709 struct filedescent *fde, **fdep; 1710 void *data; 1711 socklen_t clen = control->m_len, datalen; 1712 int error, newfds; 1713 u_int newlen; 1714 1715 UNP_LINK_UNLOCK_ASSERT(); 1716 1717 error = 0; 1718 if (controlp != NULL) /* controlp == NULL => free control messages */ 1719 *controlp = NULL; 1720 while (cm != NULL) { 1721 if (sizeof(*cm) > clen || cm->cmsg_len > clen) { 1722 error = EINVAL; 1723 break; 1724 } 1725 data = CMSG_DATA(cm); 1726 datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data; 1727 if (cm->cmsg_level == SOL_SOCKET 1728 && cm->cmsg_type == SCM_RIGHTS) { 1729 newfds = datalen / sizeof(*fdep); 1730 if (newfds == 0) 1731 goto next; 1732 fdep = data; 1733 1734 /* If we're not outputting the descriptors free them. */ 1735 if (error || controlp == NULL) { 1736 unp_freerights(fdep, newfds); 1737 goto next; 1738 } 1739 FILEDESC_XLOCK(fdesc); 1740 1741 /* 1742 * Now change each pointer to an fd in the global 1743 * table to an integer that is the index to the local 1744 * fd table entry that we set up to point to the 1745 * global one we are transferring. 1746 */ 1747 newlen = newfds * sizeof(int); 1748 *controlp = sbcreatecontrol(NULL, newlen, 1749 SCM_RIGHTS, SOL_SOCKET); 1750 if (*controlp == NULL) { 1751 FILEDESC_XUNLOCK(fdesc); 1752 error = E2BIG; 1753 unp_freerights(fdep, newfds); 1754 goto next; 1755 } 1756 1757 fdp = (int *) 1758 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 1759 if (fdallocn(td, 0, fdp, newfds) != 0) { 1760 FILEDESC_XUNLOCK(td->td_proc->p_fd); 1761 error = EMSGSIZE; 1762 unp_freerights(fdep, newfds); 1763 m_freem(*controlp); 1764 *controlp = NULL; 1765 goto next; 1766 } 1767 for (i = 0; i < newfds; i++, fdp++) { 1768 fde = &fdesc->fd_ofiles[*fdp]; 1769 fde->fde_file = fdep[i]->fde_file; 1770 filecaps_move(&fdep[i]->fde_caps, 1771 &fde->fde_caps); 1772 if ((flags & MSG_CMSG_CLOEXEC) != 0) 1773 fde->fde_flags |= UF_EXCLOSE; 1774 unp_externalize_fp(fde->fde_file); 1775 } 1776 FILEDESC_XUNLOCK(fdesc); 1777 free(fdep[0], M_FILECAPS); 1778 } else { 1779 /* We can just copy anything else across. */ 1780 if (error || controlp == NULL) 1781 goto next; 1782 *controlp = sbcreatecontrol(NULL, datalen, 1783 cm->cmsg_type, cm->cmsg_level); 1784 if (*controlp == NULL) { 1785 error = ENOBUFS; 1786 goto next; 1787 } 1788 bcopy(data, 1789 CMSG_DATA(mtod(*controlp, struct cmsghdr *)), 1790 datalen); 1791 } 1792 controlp = &(*controlp)->m_next; 1793 1794next: 1795 if (CMSG_SPACE(datalen) < clen) { 1796 clen -= CMSG_SPACE(datalen); 1797 cm = (struct cmsghdr *) 1798 ((caddr_t)cm + CMSG_SPACE(datalen)); 1799 } else { 1800 clen = 0; 1801 cm = NULL; 1802 } 1803 } 1804 1805 m_freem(control); 1806 return (error); 1807} 1808 1809static void 1810unp_zone_change(void *tag) 1811{ 1812 1813 uma_zone_set_max(unp_zone, maxsockets); 1814} 1815 1816static void 1817unp_init(void) 1818{ 1819 1820#ifdef VIMAGE 1821 if (!IS_DEFAULT_VNET(curvnet)) 1822 return; 1823#endif 1824 unp_zone = uma_zcreate("unpcb", sizeof(struct unpcb), NULL, NULL, 1825 NULL, NULL, UMA_ALIGN_PTR, 0); 1826 if (unp_zone == NULL) 1827 panic("unp_init"); 1828 uma_zone_set_max(unp_zone, maxsockets); 1829 uma_zone_set_warning(unp_zone, "kern.ipc.maxsockets limit reached"); 1830 EVENTHANDLER_REGISTER(maxsockets_change, unp_zone_change, 1831 NULL, EVENTHANDLER_PRI_ANY); 1832 LIST_INIT(&unp_dhead); 1833 LIST_INIT(&unp_shead); 1834 LIST_INIT(&unp_sphead); 1835 SLIST_INIT(&unp_defers); 1836 TIMEOUT_TASK_INIT(taskqueue_thread, &unp_gc_task, 0, unp_gc, NULL); 1837 TASK_INIT(&unp_defer_task, 0, unp_process_defers, NULL); 1838 UNP_LINK_LOCK_INIT(); 1839 UNP_LIST_LOCK_INIT(); 1840 UNP_DEFERRED_LOCK_INIT(); 1841} 1842 1843static int 1844unp_internalize(struct mbuf **controlp, struct thread *td) 1845{ 1846 struct mbuf *control = *controlp; 1847 struct proc *p = td->td_proc; 1848 struct filedesc *fdesc = p->p_fd; 1849 struct bintime *bt; 1850 struct cmsghdr *cm = mtod(control, struct cmsghdr *); 1851 struct cmsgcred *cmcred; 1852 struct filedescent *fde, **fdep, *fdev; 1853 struct file *fp; 1854 struct timeval *tv; 1855 int i, fd, *fdp; 1856 void *data; 1857 socklen_t clen = control->m_len, datalen; 1858 int error, oldfds; 1859 u_int newlen; 1860 1861 UNP_LINK_UNLOCK_ASSERT(); 1862 1863 error = 0; 1864 *controlp = NULL; 1865 while (cm != NULL) { 1866 if (sizeof(*cm) > clen || cm->cmsg_level != SOL_SOCKET 1867 || cm->cmsg_len > clen) { 1868 error = EINVAL; 1869 goto out; 1870 } 1871 data = CMSG_DATA(cm); 1872 datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data; 1873 1874 switch (cm->cmsg_type) { 1875 /* 1876 * Fill in credential information. 1877 */ 1878 case SCM_CREDS: 1879 *controlp = sbcreatecontrol(NULL, sizeof(*cmcred), 1880 SCM_CREDS, SOL_SOCKET); 1881 if (*controlp == NULL) { 1882 error = ENOBUFS; 1883 goto out; 1884 } 1885 cmcred = (struct cmsgcred *) 1886 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 1887 cmcred->cmcred_pid = p->p_pid; 1888 cmcred->cmcred_uid = td->td_ucred->cr_ruid; 1889 cmcred->cmcred_gid = td->td_ucred->cr_rgid; 1890 cmcred->cmcred_euid = td->td_ucred->cr_uid; 1891 cmcred->cmcred_ngroups = MIN(td->td_ucred->cr_ngroups, 1892 CMGROUP_MAX); 1893 for (i = 0; i < cmcred->cmcred_ngroups; i++) 1894 cmcred->cmcred_groups[i] = 1895 td->td_ucred->cr_groups[i]; 1896 break; 1897 1898 case SCM_RIGHTS: 1899 oldfds = datalen / sizeof (int); 1900 if (oldfds == 0) 1901 break; 1902 /* 1903 * Check that all the FDs passed in refer to legal 1904 * files. If not, reject the entire operation. 1905 */ 1906 fdp = data; 1907 FILEDESC_SLOCK(fdesc); 1908 for (i = 0; i < oldfds; i++) { 1909 fd = *fdp++; 1910 if (fget_locked(fdesc, fd) == NULL) { 1911 FILEDESC_SUNLOCK(fdesc); 1912 error = EBADF; 1913 goto out; 1914 } 1915 fp = fdesc->fd_ofiles[fd].fde_file; 1916 if (!(fp->f_ops->fo_flags & DFLAG_PASSABLE)) { 1917 FILEDESC_SUNLOCK(fdesc); 1918 error = EOPNOTSUPP; 1919 goto out; 1920 } 1921 1922 } 1923 1924 /* 1925 * Now replace the integer FDs with pointers to the 1926 * file structure and capability rights. 1927 */ 1928 newlen = oldfds * sizeof(fdep[0]); 1929 *controlp = sbcreatecontrol(NULL, newlen, 1930 SCM_RIGHTS, SOL_SOCKET); 1931 if (*controlp == NULL) { 1932 FILEDESC_SUNLOCK(fdesc); 1933 error = E2BIG; 1934 goto out; 1935 } 1936 fdp = data; 1937 fdep = (struct filedescent **) 1938 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 1939 fdev = malloc(sizeof(*fdev) * oldfds, M_FILECAPS, 1940 M_WAITOK); 1941 for (i = 0; i < oldfds; i++, fdev++, fdp++) { 1942 fde = &fdesc->fd_ofiles[*fdp]; 1943 fdep[i] = fdev; 1944 fdep[i]->fde_file = fde->fde_file; 1945 filecaps_copy(&fde->fde_caps, 1946 &fdep[i]->fde_caps); 1947 unp_internalize_fp(fdep[i]->fde_file); 1948 } 1949 FILEDESC_SUNLOCK(fdesc); 1950 break; 1951 1952 case SCM_TIMESTAMP: 1953 *controlp = sbcreatecontrol(NULL, sizeof(*tv), 1954 SCM_TIMESTAMP, SOL_SOCKET); 1955 if (*controlp == NULL) { 1956 error = ENOBUFS; 1957 goto out; 1958 } 1959 tv = (struct timeval *) 1960 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 1961 microtime(tv); 1962 break; 1963 1964 case SCM_BINTIME: 1965 *controlp = sbcreatecontrol(NULL, sizeof(*bt), 1966 SCM_BINTIME, SOL_SOCKET); 1967 if (*controlp == NULL) { 1968 error = ENOBUFS; 1969 goto out; 1970 } 1971 bt = (struct bintime *) 1972 CMSG_DATA(mtod(*controlp, struct cmsghdr *)); 1973 bintime(bt); 1974 break; 1975 1976 default: 1977 error = EINVAL; 1978 goto out; 1979 } 1980 1981 controlp = &(*controlp)->m_next; 1982 if (CMSG_SPACE(datalen) < clen) { 1983 clen -= CMSG_SPACE(datalen); 1984 cm = (struct cmsghdr *) 1985 ((caddr_t)cm + CMSG_SPACE(datalen)); 1986 } else { 1987 clen = 0; 1988 cm = NULL; 1989 } 1990 } 1991 1992out: 1993 m_freem(control); 1994 return (error); 1995} 1996 1997static struct mbuf * 1998unp_addsockcred(struct thread *td, struct mbuf *control) 1999{ 2000 struct mbuf *m, *n, *n_prev; 2001 struct sockcred *sc; 2002 const struct cmsghdr *cm; 2003 int ngroups; 2004 int i; 2005 2006 ngroups = MIN(td->td_ucred->cr_ngroups, CMGROUP_MAX); 2007 m = sbcreatecontrol(NULL, SOCKCREDSIZE(ngroups), SCM_CREDS, SOL_SOCKET); 2008 if (m == NULL) 2009 return (control); 2010 2011 sc = (struct sockcred *) CMSG_DATA(mtod(m, struct cmsghdr *)); 2012 sc->sc_uid = td->td_ucred->cr_ruid; 2013 sc->sc_euid = td->td_ucred->cr_uid; 2014 sc->sc_gid = td->td_ucred->cr_rgid; 2015 sc->sc_egid = td->td_ucred->cr_gid; 2016 sc->sc_ngroups = ngroups; 2017 for (i = 0; i < sc->sc_ngroups; i++) 2018 sc->sc_groups[i] = td->td_ucred->cr_groups[i]; 2019 2020 /* 2021 * Unlink SCM_CREDS control messages (struct cmsgcred), since just 2022 * created SCM_CREDS control message (struct sockcred) has another 2023 * format. 2024 */ 2025 if (control != NULL) 2026 for (n = control, n_prev = NULL; n != NULL;) { 2027 cm = mtod(n, struct cmsghdr *); 2028 if (cm->cmsg_level == SOL_SOCKET && 2029 cm->cmsg_type == SCM_CREDS) { 2030 if (n_prev == NULL) 2031 control = n->m_next; 2032 else 2033 n_prev->m_next = n->m_next; 2034 n = m_free(n); 2035 } else { 2036 n_prev = n; 2037 n = n->m_next; 2038 } 2039 } 2040 2041 /* Prepend it to the head. */ 2042 m->m_next = control; 2043 return (m); 2044} 2045 2046static struct unpcb * 2047fptounp(struct file *fp) 2048{ 2049 struct socket *so; 2050 2051 if (fp->f_type != DTYPE_SOCKET) 2052 return (NULL); 2053 if ((so = fp->f_data) == NULL) 2054 return (NULL); 2055 if (so->so_proto->pr_domain != &localdomain) 2056 return (NULL); 2057 return sotounpcb(so); 2058} 2059 2060static void 2061unp_discard(struct file *fp) 2062{ 2063 struct unp_defer *dr; 2064 2065 if (unp_externalize_fp(fp)) { 2066 dr = malloc(sizeof(*dr), M_TEMP, M_WAITOK); 2067 dr->ud_fp = fp; 2068 UNP_DEFERRED_LOCK(); 2069 SLIST_INSERT_HEAD(&unp_defers, dr, ud_link); 2070 UNP_DEFERRED_UNLOCK(); 2071 atomic_add_int(&unp_defers_count, 1); 2072 taskqueue_enqueue(taskqueue_thread, &unp_defer_task); 2073 } else 2074 (void) closef(fp, (struct thread *)NULL); 2075} 2076 2077static void 2078unp_process_defers(void *arg __unused, int pending) 2079{ 2080 struct unp_defer *dr; 2081 SLIST_HEAD(, unp_defer) drl; 2082 int count; 2083 2084 SLIST_INIT(&drl); 2085 for (;;) { 2086 UNP_DEFERRED_LOCK(); 2087 if (SLIST_FIRST(&unp_defers) == NULL) { 2088 UNP_DEFERRED_UNLOCK(); 2089 break; 2090 } 2091 SLIST_SWAP(&unp_defers, &drl, unp_defer); 2092 UNP_DEFERRED_UNLOCK(); 2093 count = 0; 2094 while ((dr = SLIST_FIRST(&drl)) != NULL) { 2095 SLIST_REMOVE_HEAD(&drl, ud_link); 2096 closef(dr->ud_fp, NULL); 2097 free(dr, M_TEMP); 2098 count++; 2099 } 2100 atomic_add_int(&unp_defers_count, -count); 2101 } 2102} 2103 2104static void 2105unp_internalize_fp(struct file *fp) 2106{ 2107 struct unpcb *unp; 2108 2109 UNP_LINK_WLOCK(); 2110 if ((unp = fptounp(fp)) != NULL) { 2111 unp->unp_file = fp; 2112 unp->unp_msgcount++; 2113 } 2114 fhold(fp); 2115 unp_rights++; 2116 UNP_LINK_WUNLOCK(); 2117} 2118 2119static int 2120unp_externalize_fp(struct file *fp) 2121{ 2122 struct unpcb *unp; 2123 int ret; 2124 2125 UNP_LINK_WLOCK(); 2126 if ((unp = fptounp(fp)) != NULL) { 2127 unp->unp_msgcount--; 2128 ret = 1; 2129 } else 2130 ret = 0; 2131 unp_rights--; 2132 UNP_LINK_WUNLOCK(); 2133 return (ret); 2134} 2135 2136/* 2137 * unp_defer indicates whether additional work has been defered for a future 2138 * pass through unp_gc(). It is thread local and does not require explicit 2139 * synchronization. 2140 */ 2141static int unp_marked; 2142static int unp_unreachable; 2143 2144static void 2145unp_accessable(struct filedescent **fdep, int fdcount) 2146{ 2147 struct unpcb *unp; 2148 struct file *fp; 2149 int i; 2150 2151 for (i = 0; i < fdcount; i++) { 2152 fp = fdep[i]->fde_file; 2153 if ((unp = fptounp(fp)) == NULL) 2154 continue; 2155 if (unp->unp_gcflag & UNPGC_REF) 2156 continue; 2157 unp->unp_gcflag &= ~UNPGC_DEAD; 2158 unp->unp_gcflag |= UNPGC_REF; 2159 unp_marked++; 2160 } 2161} 2162 2163static void 2164unp_gc_process(struct unpcb *unp) 2165{ 2166 struct socket *soa; 2167 struct socket *so; 2168 struct file *fp; 2169 2170 /* Already processed. */ 2171 if (unp->unp_gcflag & UNPGC_SCANNED) 2172 return; 2173 fp = unp->unp_file; 2174 2175 /* 2176 * Check for a socket potentially in a cycle. It must be in a 2177 * queue as indicated by msgcount, and this must equal the file 2178 * reference count. Note that when msgcount is 0 the file is NULL. 2179 */ 2180 if ((unp->unp_gcflag & UNPGC_REF) == 0 && fp && 2181 unp->unp_msgcount != 0 && fp->f_count == unp->unp_msgcount) { 2182 unp->unp_gcflag |= UNPGC_DEAD; 2183 unp_unreachable++; 2184 return; 2185 } 2186 2187 /* 2188 * Mark all sockets we reference with RIGHTS. 2189 */ 2190 so = unp->unp_socket; 2191 SOCKBUF_LOCK(&so->so_rcv); 2192 unp_scan(so->so_rcv.sb_mb, unp_accessable); 2193 SOCKBUF_UNLOCK(&so->so_rcv); 2194 2195 /* 2196 * Mark all sockets in our accept queue. 2197 */ 2198 ACCEPT_LOCK(); 2199 TAILQ_FOREACH(soa, &so->so_comp, so_list) { 2200 SOCKBUF_LOCK(&soa->so_rcv); 2201 unp_scan(soa->so_rcv.sb_mb, unp_accessable); 2202 SOCKBUF_UNLOCK(&soa->so_rcv); 2203 } 2204 ACCEPT_UNLOCK(); 2205 unp->unp_gcflag |= UNPGC_SCANNED; 2206} 2207 2208static int unp_recycled; 2209SYSCTL_INT(_net_local, OID_AUTO, recycled, CTLFLAG_RD, &unp_recycled, 0, 2210 "Number of unreachable sockets claimed by the garbage collector."); 2211 2212static int unp_taskcount; 2213SYSCTL_INT(_net_local, OID_AUTO, taskcount, CTLFLAG_RD, &unp_taskcount, 0, 2214 "Number of times the garbage collector has run."); 2215 2216static void 2217unp_gc(__unused void *arg, int pending) 2218{ 2219 struct unp_head *heads[] = { &unp_dhead, &unp_shead, &unp_sphead, 2220 NULL }; 2221 struct unp_head **head; 2222 struct file *f, **unref; 2223 struct unpcb *unp; 2224 int i, total; 2225 2226 unp_taskcount++; 2227 UNP_LIST_LOCK(); 2228 /* 2229 * First clear all gc flags from previous runs. 2230 */ 2231 for (head = heads; *head != NULL; head++) 2232 LIST_FOREACH(unp, *head, unp_link) 2233 unp->unp_gcflag = 0; 2234 2235 /* 2236 * Scan marking all reachable sockets with UNPGC_REF. Once a socket 2237 * is reachable all of the sockets it references are reachable. 2238 * Stop the scan once we do a complete loop without discovering 2239 * a new reachable socket. 2240 */ 2241 do { 2242 unp_unreachable = 0; 2243 unp_marked = 0; 2244 for (head = heads; *head != NULL; head++) 2245 LIST_FOREACH(unp, *head, unp_link) 2246 unp_gc_process(unp); 2247 } while (unp_marked); 2248 UNP_LIST_UNLOCK(); 2249 if (unp_unreachable == 0) 2250 return; 2251 2252 /* 2253 * Allocate space for a local list of dead unpcbs. 2254 */ 2255 unref = malloc(unp_unreachable * sizeof(struct file *), 2256 M_TEMP, M_WAITOK); 2257 2258 /* 2259 * Iterate looking for sockets which have been specifically marked 2260 * as as unreachable and store them locally. 2261 */ 2262 UNP_LINK_RLOCK(); 2263 UNP_LIST_LOCK(); 2264 for (total = 0, head = heads; *head != NULL; head++) 2265 LIST_FOREACH(unp, *head, unp_link) 2266 if ((unp->unp_gcflag & UNPGC_DEAD) != 0) { 2267 f = unp->unp_file; 2268 if (unp->unp_msgcount == 0 || f == NULL || 2269 f->f_count != unp->unp_msgcount) 2270 continue; 2271 unref[total++] = f; 2272 fhold(f); 2273 KASSERT(total <= unp_unreachable, 2274 ("unp_gc: incorrect unreachable count.")); 2275 } 2276 UNP_LIST_UNLOCK(); 2277 UNP_LINK_RUNLOCK(); 2278 2279 /* 2280 * Now flush all sockets, free'ing rights. This will free the 2281 * struct files associated with these sockets but leave each socket 2282 * with one remaining ref. 2283 */ 2284 for (i = 0; i < total; i++) { 2285 struct socket *so; 2286 2287 so = unref[i]->f_data; 2288 CURVNET_SET(so->so_vnet); 2289 sorflush(so); 2290 CURVNET_RESTORE(); 2291 } 2292 2293 /* 2294 * And finally release the sockets so they can be reclaimed. 2295 */ 2296 for (i = 0; i < total; i++) 2297 fdrop(unref[i], NULL); 2298 unp_recycled += total; 2299 free(unref, M_TEMP); 2300} 2301 2302static void 2303unp_dispose(struct mbuf *m) 2304{ 2305 2306 if (m) 2307 unp_scan(m, unp_freerights); 2308} 2309 2310static void 2311unp_scan(struct mbuf *m0, void (*op)(struct filedescent **, int)) 2312{ 2313 struct mbuf *m; 2314 struct cmsghdr *cm; 2315 void *data; 2316 socklen_t clen, datalen; 2317 2318 while (m0 != NULL) { 2319 for (m = m0; m; m = m->m_next) { 2320 if (m->m_type != MT_CONTROL) 2321 continue; 2322 2323 cm = mtod(m, struct cmsghdr *); 2324 clen = m->m_len; 2325 2326 while (cm != NULL) { 2327 if (sizeof(*cm) > clen || cm->cmsg_len > clen) 2328 break; 2329 2330 data = CMSG_DATA(cm); 2331 datalen = (caddr_t)cm + cm->cmsg_len 2332 - (caddr_t)data; 2333 2334 if (cm->cmsg_level == SOL_SOCKET && 2335 cm->cmsg_type == SCM_RIGHTS) { 2336 (*op)(data, datalen / 2337 sizeof(struct filedescent *)); 2338 } 2339 2340 if (CMSG_SPACE(datalen) < clen) { 2341 clen -= CMSG_SPACE(datalen); 2342 cm = (struct cmsghdr *) 2343 ((caddr_t)cm + CMSG_SPACE(datalen)); 2344 } else { 2345 clen = 0; 2346 cm = NULL; 2347 } 2348 } 2349 } 2350 m0 = m0->m_act; 2351 } 2352} 2353 2354/* 2355 * A helper function called by VFS before socket-type vnode reclamation. 2356 * For an active vnode it clears unp_vnode pointer and decrements unp_vnode 2357 * use count. 2358 */ 2359void 2360vfs_unp_reclaim(struct vnode *vp) 2361{ 2362 struct socket *so; 2363 struct unpcb *unp; 2364 int active; 2365 2366 ASSERT_VOP_ELOCKED(vp, "vfs_unp_reclaim"); 2367 KASSERT(vp->v_type == VSOCK, 2368 ("vfs_unp_reclaim: vp->v_type != VSOCK")); 2369 2370 active = 0; 2371 UNP_LINK_WLOCK(); 2372 VOP_UNP_CONNECT(vp, &so); 2373 if (so == NULL) 2374 goto done; 2375 unp = sotounpcb(so); 2376 if (unp == NULL) 2377 goto done; 2378 UNP_PCB_LOCK(unp); 2379 if (unp->unp_vnode == vp) { 2380 VOP_UNP_DETACH(vp); 2381 unp->unp_vnode = NULL; 2382 active = 1; 2383 } 2384 UNP_PCB_UNLOCK(unp); 2385done: 2386 UNP_LINK_WUNLOCK(); 2387 if (active) 2388 vunref(vp); 2389} 2390 2391#ifdef DDB 2392static void 2393db_print_indent(int indent) 2394{ 2395 int i; 2396 2397 for (i = 0; i < indent; i++) 2398 db_printf(" "); 2399} 2400 2401static void 2402db_print_unpflags(int unp_flags) 2403{ 2404 int comma; 2405 2406 comma = 0; 2407 if (unp_flags & UNP_HAVEPC) { 2408 db_printf("%sUNP_HAVEPC", comma ? ", " : ""); 2409 comma = 1; 2410 } 2411 if (unp_flags & UNP_HAVEPCCACHED) { 2412 db_printf("%sUNP_HAVEPCCACHED", comma ? ", " : ""); 2413 comma = 1; 2414 } 2415 if (unp_flags & UNP_WANTCRED) { 2416 db_printf("%sUNP_WANTCRED", comma ? ", " : ""); 2417 comma = 1; 2418 } 2419 if (unp_flags & UNP_CONNWAIT) { 2420 db_printf("%sUNP_CONNWAIT", comma ? ", " : ""); 2421 comma = 1; 2422 } 2423 if (unp_flags & UNP_CONNECTING) { 2424 db_printf("%sUNP_CONNECTING", comma ? ", " : ""); 2425 comma = 1; 2426 } 2427 if (unp_flags & UNP_BINDING) { 2428 db_printf("%sUNP_BINDING", comma ? ", " : ""); 2429 comma = 1; 2430 } 2431} 2432 2433static void 2434db_print_xucred(int indent, struct xucred *xu) 2435{ 2436 int comma, i; 2437 2438 db_print_indent(indent); 2439 db_printf("cr_version: %u cr_uid: %u cr_ngroups: %d\n", 2440 xu->cr_version, xu->cr_uid, xu->cr_ngroups); 2441 db_print_indent(indent); 2442 db_printf("cr_groups: "); 2443 comma = 0; 2444 for (i = 0; i < xu->cr_ngroups; i++) { 2445 db_printf("%s%u", comma ? ", " : "", xu->cr_groups[i]); 2446 comma = 1; 2447 } 2448 db_printf("\n"); 2449} 2450 2451static void 2452db_print_unprefs(int indent, struct unp_head *uh) 2453{ 2454 struct unpcb *unp; 2455 int counter; 2456 2457 counter = 0; 2458 LIST_FOREACH(unp, uh, unp_reflink) { 2459 if (counter % 4 == 0) 2460 db_print_indent(indent); 2461 db_printf("%p ", unp); 2462 if (counter % 4 == 3) 2463 db_printf("\n"); 2464 counter++; 2465 } 2466 if (counter != 0 && counter % 4 != 0) 2467 db_printf("\n"); 2468} 2469 2470DB_SHOW_COMMAND(unpcb, db_show_unpcb) 2471{ 2472 struct unpcb *unp; 2473 2474 if (!have_addr) { 2475 db_printf("usage: show unpcb <addr>\n"); 2476 return; 2477 } 2478 unp = (struct unpcb *)addr; 2479 2480 db_printf("unp_socket: %p unp_vnode: %p\n", unp->unp_socket, 2481 unp->unp_vnode); 2482 2483 db_printf("unp_ino: %ju unp_conn: %p\n", (uintmax_t)unp->unp_ino, 2484 unp->unp_conn); 2485 2486 db_printf("unp_refs:\n"); 2487 db_print_unprefs(2, &unp->unp_refs); 2488 2489 /* XXXRW: Would be nice to print the full address, if any. */ 2490 db_printf("unp_addr: %p\n", unp->unp_addr); 2491 2492 db_printf("unp_cc: %d unp_mbcnt: %d unp_gencnt: %llu\n", 2493 unp->unp_cc, unp->unp_mbcnt, 2494 (unsigned long long)unp->unp_gencnt); 2495 2496 db_printf("unp_flags: %x (", unp->unp_flags); 2497 db_print_unpflags(unp->unp_flags); 2498 db_printf(")\n"); 2499 2500 db_printf("unp_peercred:\n"); 2501 db_print_xucred(2, &unp->unp_peercred); 2502 2503 db_printf("unp_refcount: %u\n", unp->unp_refcount); 2504} 2505#endif 2506