2 * Copyright (c) 2000-2007 Apple Inc. All rights reserved.
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
29 * Copyright (c) 1982, 1986, 1989, 1991, 1993
30 * The Regents of the University of California. All rights reserved.
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60 * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/domain.h>
73 #include <sys/fcntl.h>
74 #include <sys/malloc.h> /* XXX must be before <sys/file.h> */
75 #include <sys/file_internal.h>
76 #include <sys/filedesc.h>
79 #include <sys/namei.h>
80 #include <sys/proc_internal.h>
81 #include <sys/kauth.h>
82 #include <sys/protosw.h>
83 #include <sys/socket.h>
84 #include <sys/socketvar.h>
86 #include <sys/sysctl.h>
88 #include <sys/unpcb.h>
89 #include <sys/vnode_internal.h>
90 #include <sys/kdebug.h>
92 #include <kern/zalloc.h>
93 #include <kern/locks.h>
95 #if CONFIG_MACF_SOCKET
96 #include <security/mac_framework.h>
97 #endif /* MAC_SOCKET */
99 #define f_msgcount f_fglob->fg_msgcount
100 #define f_cred f_fglob->fg_cred
101 #define f_ops f_fglob->fg_ops
102 #define f_offset f_fglob->fg_offset
103 #define f_data f_fglob->fg_data
104 struct zone
*unp_zone
;
105 static unp_gen_t unp_gencnt
;
106 static u_int unp_count
;
108 static lck_attr_t
*unp_mtx_attr
;
109 static lck_grp_t
*unp_mtx_grp
;
110 static lck_grp_attr_t
*unp_mtx_grp_attr
;
111 static lck_rw_t
*unp_list_mtx
;
113 extern lck_mtx_t
*uipc_lock
;
114 static struct unp_head unp_shead
, unp_dhead
;
117 * Unix communications domain.
121 * rethink name space problems
122 * need a proper out-of-band
125 static struct sockaddr sun_noname
= { sizeof (sun_noname
), AF_LOCAL
, { 0 } };
126 static ino_t unp_ino
; /* prototype for fake inode numbers */
128 static int unp_attach(struct socket
*);
129 static void unp_detach(struct unpcb
*);
130 static int unp_bind(struct unpcb
*, struct sockaddr
*, proc_t
);
131 static int unp_connect(struct socket
*, struct sockaddr
*, proc_t
);
132 static void unp_disconnect(struct unpcb
*);
133 static void unp_shutdown(struct unpcb
*);
134 static void unp_drop(struct unpcb
*, int);
135 __private_extern__
void unp_gc(void);
136 static void unp_scan(struct mbuf
*, void (*)(struct fileglob
*));
137 static void unp_mark(struct fileglob
*);
138 static void unp_discard(struct fileglob
*);
139 static void unp_discard_fdlocked(struct fileglob
*, proc_t
);
140 static int unp_internalize(struct mbuf
*, proc_t
);
141 static int unp_listen(struct unpcb
*, proc_t
);
143 /* TODO: this should be in header file */
144 extern int fdgetf_noref(proc_t
, int, struct fileproc
**);
147 uipc_abort(struct socket
*so
)
149 struct unpcb
*unp
= sotounpcb(so
);
153 unp_drop(unp
, ECONNABORTED
);
160 uipc_accept(struct socket
*so
, struct sockaddr
**nam
)
162 struct unpcb
*unp
= sotounpcb(so
);
168 * Pass back name of connected socket,
169 * if it was bound and we are still connected
170 * (our peer may have closed already!).
172 if (unp
->unp_conn
&& unp
->unp_conn
->unp_addr
) {
173 *nam
= dup_sockaddr((struct sockaddr
*)
174 unp
->unp_conn
->unp_addr
, 1);
176 *nam
= dup_sockaddr((struct sockaddr
*)&sun_noname
, 1);
187 uipc_attach(struct socket
*so
, __unused
int proto
, __unused proc_t p
)
189 struct unpcb
*unp
= sotounpcb(so
);
193 return (unp_attach(so
));
197 uipc_bind(struct socket
*so
, struct sockaddr
*nam
, proc_t p
)
199 struct unpcb
*unp
= sotounpcb(so
);
204 return (unp_bind(unp
, nam
, p
));
210 * unp_connect:??? [See elsewhere in this file]
213 uipc_connect(struct socket
*so
, struct sockaddr
*nam
, proc_t p
)
215 struct unpcb
*unp
= sotounpcb(so
);
219 return (unp_connect(so
, nam
, p
));
225 * unp_connect2:EPROTOTYPE Protocol wrong type for socket
226 * unp_connect2:EINVAL Invalid argument
229 uipc_connect2(struct socket
*so1
, struct socket
*so2
)
231 struct unpcb
*unp
= sotounpcb(so1
);
236 return (unp_connect2(so1
, so2
));
239 /* control is EOPNOTSUPP */
242 uipc_detach(struct socket
*so
)
244 struct unpcb
*unp
= sotounpcb(so
);
254 uipc_disconnect(struct socket
*so
)
256 struct unpcb
*unp
= sotounpcb(so
);
269 uipc_listen(struct socket
*so
, __unused proc_t p
)
271 struct unpcb
*unp
= sotounpcb(so
);
273 if (unp
== 0 || unp
->unp_vnode
== 0)
275 return (unp_listen(unp
, p
));
279 uipc_peeraddr(struct socket
*so
, struct sockaddr
**nam
)
281 struct unpcb
*unp
= sotounpcb(so
);
285 if (unp
->unp_conn
!= NULL
&& unp
->unp_conn
->unp_addr
!= NULL
) {
286 *nam
= dup_sockaddr((struct sockaddr
*)
287 unp
->unp_conn
->unp_addr
, 1);
289 *nam
= dup_sockaddr((struct sockaddr
*)&sun_noname
, 1);
295 uipc_rcvd(struct socket
*so
, __unused
int flags
)
297 struct unpcb
*unp
= sotounpcb(so
);
302 switch (so
->so_type
) {
304 panic("uipc_rcvd DGRAM?");
308 #define rcv (&so->so_rcv)
309 #define snd (&so2->so_snd)
310 if (unp
->unp_conn
== 0)
312 so2
= unp
->unp_conn
->unp_socket
;
314 * Adjust backpressure on sender
315 * and wakeup any waiting to write.
317 snd
->sb_mbmax
+= unp
->unp_mbcnt
- rcv
->sb_mbcnt
;
318 unp
->unp_mbcnt
= rcv
->sb_mbcnt
;
319 snd
->sb_hiwat
+= unp
->unp_cc
- rcv
->sb_cc
;
320 unp
->unp_cc
= rcv
->sb_cc
;
327 panic("uipc_rcvd unknown socktype");
332 /* pru_rcvoob is EOPNOTSUPP */
341 * unp_internalize:EINVAL
342 * unp_internalize:EBADF
343 * unp_connect:EAFNOSUPPORT Address family not supported
344 * unp_connect:EINVAL Invalid argument
345 * unp_connect:ENOTSOCK Not a socket
346 * unp_connect:ECONNREFUSED Connection refused
347 * unp_connect:EISCONN Socket is connected
348 * unp_connect:EPROTOTYPE Protocol wrong type for socket
350 * sbappendaddr:ENOBUFS [5th argument, contents modified]
351 * sbappendaddr:??? [whatever a filter author chooses]
354 uipc_send(struct socket
*so
, int flags
, struct mbuf
*m
, struct sockaddr
*nam
,
355 struct mbuf
*control
, proc_t p
)
358 struct unpcb
*unp
= sotounpcb(so
);
365 if (flags
& PRUS_OOB
) {
371 /* release global lock to avoid deadlock (4436174) */
372 socket_unlock(so
, 0);
373 error
= unp_internalize(control
, p
);
379 switch (so
->so_type
) {
382 struct sockaddr
*from
;
389 error
= unp_connect(so
, nam
, p
);
393 if (unp
->unp_conn
== 0) {
398 so2
= unp
->unp_conn
->unp_socket
;
400 from
= (struct sockaddr
*)unp
->unp_addr
;
404 * sbappendaddr() will fail when the receiver runs out of
405 * space; in contrast to SOCK_STREAM, we will lose messages
406 * for the SOCK_DGRAM case when the receiver's queue overflows.
407 * SB_UNIX on the socket buffer implies that the callee will
408 * not free the control message, if any, because we would need
409 * to call unp_dispose() on it.
411 if (sbappendaddr(&so2
->so_rcv
, from
, m
, control
, &error
)) {
414 } else if (control
!= NULL
&& error
== 0) {
415 /* A socket filter took control; don't touch it */
426 #define rcv (&so2->so_rcv)
427 #define snd (&so->so_snd)
428 /* Connect if not connected yet. */
430 * Note: A better implementation would complain
431 * if not equal to the peer's address.
433 if ((so
->so_state
& SS_ISCONNECTED
) == 0) {
435 error
= unp_connect(so
, nam
, p
);
444 if (so
->so_state
& SS_CANTSENDMORE
) {
448 if (unp
->unp_conn
== 0)
449 panic("uipc_send connected but no connection?");
450 so2
= unp
->unp_conn
->unp_socket
;
452 * Send to paired receive port, and then reduce send buffer
453 * hiwater marks to maintain backpressure. Wake up readers.
454 * SB_UNIX flag will allow new record to be appended to the
455 * receiver's queue even when it is already full. It is
456 * possible, however, that append might fail. In that case,
457 * we will need to call unp_dispose() on the control message;
458 * the callee will not free it since SB_UNIX is set.
460 didreceive
= control
?
461 sbappendcontrol(rcv
, m
, control
, &error
) : sbappend(rcv
, m
);
463 snd
->sb_mbmax
-= rcv
->sb_mbcnt
- unp
->unp_conn
->unp_mbcnt
;
464 unp
->unp_conn
->unp_mbcnt
= rcv
->sb_mbcnt
;
465 snd
->sb_hiwat
-= rcv
->sb_cc
- unp
->unp_conn
->unp_cc
;
466 unp
->unp_conn
->unp_cc
= rcv
->sb_cc
;
470 } else if (control
!= NULL
&& error
== 0) {
471 /* A socket filter took control; don't touch it */
481 panic("uipc_send unknown socktype");
485 * SEND_EOF is equivalent to a SEND followed by
488 if (flags
& PRUS_EOF
) {
493 if (control
&& error
!= 0) {
494 socket_unlock(so
, 0);
495 unp_dispose(control
);
508 uipc_sense(struct socket
*so
, void *ub
, int isstat64
)
510 struct unpcb
*unp
= sotounpcb(so
);
517 blksize
= so
->so_snd
.sb_hiwat
;
518 if (so
->so_type
== SOCK_STREAM
&& unp
->unp_conn
!= 0) {
519 so2
= unp
->unp_conn
->unp_socket
;
520 blksize
+= so2
->so_rcv
.sb_cc
;
522 if (unp
->unp_ino
== 0)
523 unp
->unp_ino
= unp_ino
++;
528 sb64
= (struct stat64
*)ub
;
529 sb64
->st_blksize
= blksize
;
530 sb64
->st_dev
= NODEV
;
531 sb64
->st_ino
= (ino64_t
)unp
->unp_ino
;
535 sb
= (struct stat
*)ub
;
536 sb
->st_blksize
= blksize
;
538 sb
->st_ino
= (ino_t
)unp
->unp_ino
;
548 * Notes: This is not strictly correct, as unp_shutdown() also calls
549 * socantrcvmore(). These should maybe both be conditionalized
550 * on the 'how' argument in soshutdown() as called from the
551 * shutdown() system call.
554 uipc_shutdown(struct socket
*so
)
556 struct unpcb
*unp
= sotounpcb(so
);
567 * EINVAL Invalid argument
570 uipc_sockaddr(struct socket
*so
, struct sockaddr
**nam
)
572 struct unpcb
*unp
= sotounpcb(so
);
576 if (unp
->unp_addr
!= NULL
) {
577 *nam
= dup_sockaddr((struct sockaddr
*)unp
->unp_addr
, 1);
579 *nam
= dup_sockaddr((struct sockaddr
*)&sun_noname
, 1);
584 struct pr_usrreqs uipc_usrreqs
= {
585 uipc_abort
, uipc_accept
, uipc_attach
, uipc_bind
, uipc_connect
,
586 uipc_connect2
, pru_control_notsupp
, uipc_detach
, uipc_disconnect
,
587 uipc_listen
, uipc_peeraddr
, uipc_rcvd
, pru_rcvoob_notsupp
,
588 uipc_send
, uipc_sense
, uipc_shutdown
, uipc_sockaddr
,
589 sosend
, soreceive
, pru_sopoll_notsupp
593 uipc_ctloutput(struct socket
*so
, struct sockopt
*sopt
)
595 struct unpcb
*unp
= sotounpcb(so
);
598 switch (sopt
->sopt_dir
) {
600 switch (sopt
->sopt_name
) {
602 if (unp
->unp_flags
& UNP_HAVEPC
) {
603 error
= sooptcopyout(sopt
, &unp
->unp_peercred
,
604 sizeof (unp
->unp_peercred
));
606 if (so
->so_type
== SOCK_STREAM
)
626 * Both send and receive buffers are allocated PIPSIZ bytes of buffering
627 * for stream sockets, although the total for sender and receiver is
628 * actually only PIPSIZ.
629 * Datagram sockets really use the sendspace as the maximum datagram size,
630 * and don't really want to reserve the sendspace. Their recvspace should
631 * be large enough for at least one max-size datagram plus address.
636 static u_long unpst_sendspace
= PIPSIZ
;
637 static u_long unpst_recvspace
= PIPSIZ
;
638 static u_long unpdg_sendspace
= 2*1024; /* really max datagram size */
639 static u_long unpdg_recvspace
= 4*1024;
641 static int unp_rights
; /* file descriptors in flight */
642 static int unp_disposed
; /* discarded file descriptors */
644 SYSCTL_DECL(_net_local_stream
);
645 SYSCTL_INT(_net_local_stream
, OID_AUTO
, sendspace
, CTLFLAG_RW
,
646 &unpst_sendspace
, 0, "");
647 SYSCTL_INT(_net_local_stream
, OID_AUTO
, recvspace
, CTLFLAG_RW
,
648 &unpst_recvspace
, 0, "");
649 SYSCTL_DECL(_net_local_dgram
);
650 SYSCTL_INT(_net_local_dgram
, OID_AUTO
, maxdgram
, CTLFLAG_RW
,
651 &unpdg_sendspace
, 0, "");
652 SYSCTL_INT(_net_local_dgram
, OID_AUTO
, recvspace
, CTLFLAG_RW
,
653 &unpdg_recvspace
, 0, "");
654 SYSCTL_DECL(_net_local
);
655 SYSCTL_INT(_net_local
, OID_AUTO
, inflight
, CTLFLAG_RD
, &unp_rights
, 0, "");
663 unp_attach(struct socket
*so
)
668 if (so
->so_snd
.sb_hiwat
== 0 || so
->so_rcv
.sb_hiwat
== 0) {
669 switch (so
->so_type
) {
672 error
= soreserve(so
, unpst_sendspace
, unpst_recvspace
);
676 error
= soreserve(so
, unpdg_sendspace
, unpdg_recvspace
);
685 unp
= (struct unpcb
*)zalloc(unp_zone
);
688 bzero(unp
, sizeof (*unp
));
689 lck_rw_lock_exclusive(unp_list_mtx
);
690 LIST_INIT(&unp
->unp_refs
);
691 unp
->unp_socket
= so
;
692 unp
->unp_gencnt
= ++unp_gencnt
;
694 LIST_INSERT_HEAD(so
->so_type
== SOCK_DGRAM
?
695 &unp_dhead
: &unp_shead
, unp
, unp_link
);
696 so
->so_pcb
= (caddr_t
)unp
;
698 * Mark AF_UNIX socket buffers accordingly so that:
700 * a. In the SOCK_STREAM case, socket buffer append won't fail due to
701 * the lack of space; this essentially loosens the sbspace() check,
702 * since there is disconnect between sosend() and uipc_send() with
703 * respect to flow control that might result in our dropping the
704 * data in uipc_send(). By setting this, we allow for slightly
705 * more records to be appended to the receiving socket to avoid
706 * losing data (which we can't afford in the SOCK_STREAM case).
707 * Flow control still takes place since we adjust the sender's
708 * hiwat during each send. This doesn't affect the SOCK_DGRAM
709 * case and append would still fail when the queue overflows.
711 * b. In the presence of control messages containing internalized
712 * file descriptors, the append routines will not free them since
713 * we'd need to undo the work first via unp_dispose().
715 so
->so_rcv
.sb_flags
|= SB_UNIX
;
716 so
->so_snd
.sb_flags
|= SB_UNIX
;
717 lck_rw_done(unp_list_mtx
);
722 unp_detach(struct unpcb
*unp
)
724 lck_rw_lock_exclusive(unp_list_mtx
);
725 LIST_REMOVE(unp
, unp_link
);
726 unp
->unp_gencnt
= ++unp_gencnt
;
727 lck_rw_done(unp_list_mtx
);
729 if (unp
->unp_vnode
) {
730 struct vnode
*tvp
= unp
->unp_vnode
;
731 unp
->unp_vnode
->v_socket
= NULL
;
732 unp
->unp_vnode
= NULL
;
733 vnode_rele(tvp
); /* drop the usecount */
737 while (unp
->unp_refs
.lh_first
)
738 unp_drop(unp
->unp_refs
.lh_first
, ECONNRESET
);
739 soisdisconnected(unp
->unp_socket
);
740 /* makes sure we're getting dealloced */
741 unp
->unp_socket
->so_flags
|= SOF_PCBCLEARING
;
742 unp
->unp_socket
->so_pcb
= NULL
;
745 * Normally the receive buffer is flushed later,
746 * in sofree, but if our receive buffer holds references
747 * to descriptors that are now garbage, we will dispose
748 * of those descriptor references after the garbage collector
749 * gets them (resulting in a "panic: closef: count < 0").
751 sorflush(unp
->unp_socket
);
753 /* Per domain mutex deadlock avoidance */
754 socket_unlock(unp
->unp_socket
, 0);
756 socket_lock(unp
->unp_socket
, 0);
759 FREE(unp
->unp_addr
, M_SONAME
);
760 zfree(unp_zone
, unp
);
768 * namei:??? [anything namei can return]
769 * vnode_authorize:??? [anything vnode_authorize can return]
771 * Notes: p at this point is the current process, as this function is
772 * only called by sobind().
777 struct sockaddr
*nam
,
780 struct sockaddr_un
*soun
= (struct sockaddr_un
*)nam
;
781 struct vnode
*vp
, *dvp
;
782 struct vnode_attr va
;
783 vfs_context_t ctx
= vfs_context_current();
786 char buf
[SOCK_MAXADDRLEN
];
788 if (nam
->sa_family
!= 0 && nam
->sa_family
!= AF_UNIX
) {
789 return (EAFNOSUPPORT
);
792 if (unp
->unp_vnode
!= NULL
)
794 namelen
= soun
->sun_len
- offsetof(struct sockaddr_un
, sun_path
);
798 strlcpy(buf
, soun
->sun_path
, namelen
+1);
799 NDINIT(&nd
, CREATE
, FOLLOW
| LOCKPARENT
, UIO_SYSSPACE32
,
800 CAST_USER_ADDR_T(buf
), ctx
);
801 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
811 * need to do this before the vnode_put of dvp
812 * since we may have to release an fs_nodelock
823 VATTR_SET(&va
, va_type
, VSOCK
);
824 VATTR_SET(&va
, va_mode
, (ACCESSPERMS
& ~p
->p_fd
->fd_cmask
));
826 #if CONFIG_MACF_SOCKET
828 * This is #if MAC_SOCKET, because it affects the connection rate
829 * of Unix domain dockets that is critical for server performance
831 error
= mac_vnode_check_create(ctx
,
832 nd
.ni_dvp
, &nd
.ni_cnd
, &va
);
835 #endif /* MAC_SOCKET */
836 /* authorize before creating */
837 error
= vnode_authorize(dvp
, NULL
, KAUTH_VNODE_ADD_FILE
, ctx
);
840 /* create the socket */
841 error
= vn_create(dvp
, &vp
, &nd
.ni_cnd
, &va
, 0, ctx
);
850 vnode_ref(vp
); /* gain a longterm reference */
851 vp
->v_socket
= unp
->unp_socket
;
853 unp
->unp_addr
= (struct sockaddr_un
*)dup_sockaddr(nam
, 1);
854 vnode_put(vp
); /* drop the iocount */
862 * EAFNOSUPPORT Address family not supported
863 * EINVAL Invalid argument
864 * ENOTSOCK Not a socket
865 * ECONNREFUSED Connection refused
866 * EPROTOTYPE Protocol wrong type for socket
867 * EISCONN Socket is connected
868 * unp_connect2:EPROTOTYPE Protocol wrong type for socket
869 * unp_connect2:EINVAL Invalid argument
870 * namei:??? [anything namei can return]
871 * vnode_authorize:???? [anything vnode_authorize can return]
873 * Notes: p at this point is the current process, as this function is
874 * only called by sosend(), sendfile(), and soconnectlock().
877 unp_connect(struct socket
*so
, struct sockaddr
*nam
, __unused proc_t p
)
879 struct sockaddr_un
*soun
= (struct sockaddr_un
*)nam
;
881 struct socket
*so2
, *so3
;
882 struct unpcb
*unp
, *unp2
, *unp3
;
883 vfs_context_t ctx
= vfs_context_current();
886 char buf
[SOCK_MAXADDRLEN
];
888 if (nam
->sa_family
!= 0 && nam
->sa_family
!= AF_UNIX
) {
889 return (EAFNOSUPPORT
);
894 len
= nam
->sa_len
- offsetof(struct sockaddr_un
, sun_path
);
898 strlcpy(buf
, soun
->sun_path
, len
+1);
900 NDINIT(&nd
, LOOKUP
, FOLLOW
| LOCKLEAF
, UIO_SYSSPACE32
,
901 CAST_USER_ADDR_T(buf
), ctx
);
908 if (vp
->v_type
!= VSOCK
) {
913 error
= vnode_authorize(vp
, NULL
, KAUTH_VNODE_WRITE_DATA
, ctx
);
917 if (so2
== 0 || so2
->so_pcb
== NULL
) {
918 error
= ECONNREFUSED
;
922 /* make sure the socket can't go away while we're connecting */
925 if (so
->so_type
!= so2
->so_type
) {
931 * Check if socket was connected while we were trying to
932 * acquire the funnel.
933 * XXX - probably shouldn't return an error for SOCK_DGRAM
935 if ((so
->so_state
& SS_ISCONNECTED
) != 0) {
940 if (so
->so_proto
->pr_flags
& PR_CONNREQUIRED
) {
941 if ((so2
->so_options
& SO_ACCEPTCONN
) == 0 ||
942 (so3
= sonewconn(so2
, 0, nam
)) == 0) {
943 error
= ECONNREFUSED
;
947 unp2
= sotounpcb(so2
);
948 unp3
= sotounpcb(so3
);
950 unp3
->unp_addr
= (struct sockaddr_un
*)
951 dup_sockaddr((struct sockaddr
*)unp2
->unp_addr
, 1);
954 * unp_peercred management:
956 * The connecter's (client's) credentials are copied
957 * from its process structure at the time of connect()
960 cru2x(vfs_context_ucred(ctx
), &unp3
->unp_peercred
);
961 unp3
->unp_flags
|= UNP_HAVEPC
;
963 * The receiver's (server's) credentials are copied
964 * from the unp_peercred member of socket on which the
965 * former called listen(); unp_listen() cached that
966 * process's credentials at that time so we can use
969 KASSERT(unp2
->unp_flags
& UNP_HAVEPCCACHED
,
970 ("unp_connect: listener without cached peercred"));
971 memcpy(&unp
->unp_peercred
, &unp2
->unp_peercred
,
972 sizeof (unp
->unp_peercred
));
973 unp
->unp_flags
|= UNP_HAVEPC
;
975 #if CONFIG_MACF_SOCKET
976 /* XXXMAC: recursive lock: SOCK_LOCK(so); */
977 mac_socketpeer_label_associate_socket(so
, so3
);
978 mac_socketpeer_label_associate_socket(so3
, so
);
979 /* XXXMAC: SOCK_UNLOCK(so); */
980 #endif /* MAC_SOCKET */
981 so2
->so_usecount
--; /* drop reference taken on so2 */
983 so3
->so_usecount
++; /* make sure we keep it around */
985 error
= unp_connect2(so
, so2
);
988 so2
->so_usecount
--; /* release count on socket */
995 * EPROTOTYPE Protocol wrong type for socket
996 * EINVAL Invalid argument
999 unp_connect2(struct socket
*so
, struct socket
*so2
)
1001 struct unpcb
*unp
= sotounpcb(so
);
1004 if (so2
->so_type
!= so
->so_type
)
1005 return (EPROTOTYPE
);
1006 unp2
= sotounpcb(so2
);
1008 /* Verify both sockets are still opened */
1009 if (unp
== 0 || unp2
== 0)
1012 unp
->unp_conn
= unp2
;
1013 switch (so
->so_type
) {
1016 LIST_INSERT_HEAD(&unp2
->unp_refs
, unp
, unp_reflink
);
1021 /* This takes care of socketpair */
1022 if (!(unp
->unp_flags
& UNP_HAVEPC
) &&
1023 !(unp2
->unp_flags
& UNP_HAVEPC
)) {
1024 cru2x(kauth_cred_get(), &unp
->unp_peercred
);
1025 unp
->unp_flags
|= UNP_HAVEPC
;
1027 cru2x(kauth_cred_get(), &unp2
->unp_peercred
);
1028 unp2
->unp_flags
|= UNP_HAVEPC
;
1030 unp2
->unp_conn
= unp
;
1036 panic("unp_connect2");
1042 unp_disconnect(struct unpcb
*unp
)
1044 struct unpcb
*unp2
= unp
->unp_conn
;
1048 unp
->unp_conn
= NULL
;
1049 switch (unp
->unp_socket
->so_type
) {
1052 lck_rw_lock_exclusive(unp_list_mtx
);
1053 LIST_REMOVE(unp
, unp_reflink
);
1054 lck_rw_done(unp_list_mtx
);
1055 unp
->unp_socket
->so_state
&= ~SS_ISCONNECTED
;
1059 soisdisconnected(unp
->unp_socket
);
1060 unp2
->unp_conn
= NULL
;
1061 soisdisconnected(unp2
->unp_socket
);
1068 unp_abort(struct unpcb
*unp
)
1076 unp_pcblist SYSCTL_HANDLER_ARGS
1078 #pragma unused(oidp,arg2)
1080 struct unpcb
*unp
, **unp_list
;
1083 struct unp_head
*head
;
1085 lck_rw_lock_shared(unp_list_mtx
);
1086 head
= ((intptr_t)arg1
== SOCK_DGRAM
? &unp_dhead
: &unp_shead
);
1089 * The process of preparing the PCB list is too time-consuming and
1090 * resource-intensive to repeat twice on every request.
1092 if (req
->oldptr
== USER_ADDR_NULL
) {
1094 req
->oldidx
= 2 * sizeof (xug
) + (n
+ n
/ 8) *
1095 sizeof (struct xunpcb
);
1096 lck_rw_done(unp_list_mtx
);
1100 if (req
->newptr
!= USER_ADDR_NULL
) {
1101 lck_rw_done(unp_list_mtx
);
1106 * OK, now we're committed to doing something.
1108 gencnt
= unp_gencnt
;
1111 bzero(&xug
, sizeof (xug
));
1112 xug
.xug_len
= sizeof (xug
);
1114 xug
.xug_gen
= gencnt
;
1115 xug
.xug_sogen
= so_gencnt
;
1116 error
= SYSCTL_OUT(req
, &xug
, sizeof (xug
));
1118 lck_rw_done(unp_list_mtx
);
1123 * We are done if there is no pcb
1126 lck_rw_done(unp_list_mtx
);
1130 MALLOC(unp_list
, struct unpcb
**, n
* sizeof (*unp_list
),
1132 if (unp_list
== 0) {
1133 lck_rw_done(unp_list_mtx
);
1137 for (unp
= head
->lh_first
, i
= 0; unp
&& i
< n
;
1138 unp
= unp
->unp_link
.le_next
) {
1139 if (unp
->unp_gencnt
<= gencnt
)
1140 unp_list
[i
++] = unp
;
1142 n
= i
; /* in case we lost some during malloc */
1145 for (i
= 0; i
< n
; i
++) {
1147 if (unp
->unp_gencnt
<= gencnt
) {
1150 bzero(&xu
, sizeof (xu
));
1151 xu
.xu_len
= sizeof (xu
);
1152 xu
.xu_unpp
= (struct unpcb_compat
*)unp
;
1154 * XXX - need more locking here to protect against
1155 * connect/disconnect races for SMP.
1158 bcopy(unp
->unp_addr
, &xu
.xu_addr
,
1159 unp
->unp_addr
->sun_len
);
1160 if (unp
->unp_conn
&& unp
->unp_conn
->unp_addr
)
1161 bcopy(unp
->unp_conn
->unp_addr
,
1163 unp
->unp_conn
->unp_addr
->sun_len
);
1164 bcopy(unp
, &xu
.xu_unp
, sizeof (xu
.xu_unp
));
1165 sotoxsocket(unp
->unp_socket
, &xu
.xu_socket
);
1166 error
= SYSCTL_OUT(req
, &xu
, sizeof (xu
));
1171 * Give the user an updated idea of our state.
1172 * If the generation differs from what we told
1173 * her before, she knows that something happened
1174 * while we were processing this request, and it
1175 * might be necessary to retry.
1177 bzero(&xug
, sizeof (xug
));
1178 xug
.xug_len
= sizeof (xug
);
1179 xug
.xug_gen
= unp_gencnt
;
1180 xug
.xug_sogen
= so_gencnt
;
1181 xug
.xug_count
= unp_count
;
1182 error
= SYSCTL_OUT(req
, &xug
, sizeof (xug
));
1184 FREE(unp_list
, M_TEMP
);
1185 lck_rw_done(unp_list_mtx
);
1189 SYSCTL_PROC(_net_local_dgram
, OID_AUTO
, pcblist
, CTLFLAG_RD
,
1190 (caddr_t
)(long)SOCK_DGRAM
, 0, unp_pcblist
, "S,xunpcb",
1191 "List of active local datagram sockets");
1192 SYSCTL_PROC(_net_local_stream
, OID_AUTO
, pcblist
, CTLFLAG_RD
,
1193 (caddr_t
)(long)SOCK_STREAM
, 0, unp_pcblist
, "S,xunpcb",
1194 "List of active local stream sockets");
1197 unp_shutdown(struct unpcb
*unp
)
1201 if (unp
->unp_socket
->so_type
== SOCK_STREAM
&& unp
->unp_conn
&&
1202 (so
= unp
->unp_conn
->unp_socket
))
1207 unp_drop(struct unpcb
*unp
, int errno
)
1209 struct socket
*so
= unp
->unp_socket
;
1211 so
->so_error
= errno
;
1212 unp_disconnect(unp
);
1224 * Returns: 0 Success
1225 * EMSGSIZE The new fd's will not fit
1226 * ENOBUFS Cannot alloc struct fileproc
1229 unp_externalize(struct mbuf
*rights
)
1231 proc_t p
= current_proc(); /* XXX */
1233 struct cmsghdr
*cm
= mtod(rights
, struct cmsghdr
*);
1234 struct fileglob
**rp
= (struct fileglob
**)(cm
+ 1);
1235 struct fileproc
*fp
;
1236 struct fileglob
*fg
;
1237 int newfds
= (cm
->cmsg_len
- sizeof (*cm
)) / sizeof (int);
1243 * if the new FD's will not fit, then we free them all
1245 if (!fdavail(p
, newfds
)) {
1246 for (i
= 0; i
< newfds
; i
++) {
1248 unp_discard_fdlocked(fg
, p
);
1256 * now change each pointer to an fd in the global table to
1257 * an integer that is the index to the local fd table entry
1258 * that we set up to point to the global one we are transferring.
1259 * XXX (1) this assumes a pointer and int are the same size...!
1260 * XXX (2) allocation failures should be non-fatal
1262 for (i
= 0; i
< newfds
; i
++) {
1263 #if CONFIG_MACF_SOCKET
1265 * If receive access is denied, don't pass along
1266 * and error message, just discard the descriptor.
1268 if (mac_file_check_receive(kauth_cred_get(), *rp
)) {
1271 unp_discard_fdlocked(fg
, p
);
1275 if (fdalloc(p
, 0, &f
))
1276 panic("unp_externalize:fdalloc");
1278 MALLOC_ZONE(fp
, struct fileproc
*, sizeof (struct fileproc
),
1279 M_FILEPROC
, M_WAITOK
);
1281 panic("unp_externalize: MALLOC_ZONE");
1282 bzero(fp
, sizeof (struct fileproc
));
1286 procfdtbl_releasefd(p
, f
, fp
);
1287 (void) OSAddAtomic(-1, (volatile SInt32
*)&unp_rights
);
1298 unp_zone
= zinit(sizeof (struct unpcb
),
1299 (nmbclusters
* sizeof (struct unpcb
)), 4096, "unpzone");
1303 LIST_INIT(&unp_dhead
);
1304 LIST_INIT(&unp_shead
);
1307 * allocate lock group attribute and group for udp pcb mutexes
1309 unp_mtx_grp_attr
= lck_grp_attr_alloc_init();
1311 unp_mtx_grp
= lck_grp_alloc_init("unp_list", unp_mtx_grp_attr
);
1313 unp_mtx_attr
= lck_attr_alloc_init();
1315 if ((unp_list_mtx
= lck_rw_alloc_init(unp_mtx_grp
,
1316 unp_mtx_attr
)) == NULL
)
1317 return; /* pretty much dead if this fails... */
1322 #define MIN(a, b) (((a) < (b)) ? (a) : (b))
1326 * Returns: 0 Success
1328 * fdgetf_noref:EBADF
1331 unp_internalize(struct mbuf
*control
, proc_t p
)
1333 struct cmsghdr
*cm
= mtod(control
, struct cmsghdr
*);
1334 struct fileglob
**rp
;
1335 struct fileproc
*fp
;
1339 /* 64bit: cmsg_len is 'uint32_t', m_len is 'long' */
1340 if (cm
->cmsg_type
!= SCM_RIGHTS
|| cm
->cmsg_level
!= SOL_SOCKET
||
1341 (unsigned long)cm
->cmsg_len
!= (unsigned long)control
->m_len
) {
1344 oldfds
= (cm
->cmsg_len
- sizeof (*cm
)) / sizeof (int);
1347 rp
= (struct fileglob
**)(cm
+ 1);
1349 for (i
= 0; i
< oldfds
; i
++) {
1350 if ((error
= fdgetf_noref(p
, *(int *)rp
++, NULL
)) != 0) {
1355 rp
= (struct fileglob
**)(cm
+ 1);
1357 for (i
= 0; i
< oldfds
; i
++) {
1358 (void) fdgetf_noref(p
, *(int *)rp
, &fp
);
1359 fg_insertuipc(fp
->f_fglob
);
1360 *rp
++ = fp
->f_fglob
;
1361 (void) OSAddAtomic(1, (volatile SInt32
*)&unp_rights
);
1368 static int unp_defer
, unp_gcing
, unp_gcwait
;
1369 static thread_t unp_gcthread
= NULL
;
1371 /* always called under uipc_lock */
1375 if (unp_gcthread
== current_thread())
1378 while (unp_gcing
!= 0) {
1380 msleep(&unp_gcing
, uipc_lock
, 0 , "unp_gc_wait", NULL
);
1385 __private_extern__
void
1388 struct fileglob
*fg
, *nextfg
;
1390 static struct fileglob
**extra_ref
;
1391 struct fileglob
**fpp
;
1393 int need_gcwakeup
= 0;
1395 lck_mtx_lock(uipc_lock
);
1397 lck_mtx_unlock(uipc_lock
);
1402 unp_gcthread
= current_thread();
1403 lck_mtx_unlock(uipc_lock
);
1405 * before going through all this, set all FDs to
1406 * be NOT defered and NOT externally accessible
1408 for (fg
= fmsghead
.lh_first
; fg
!= 0; fg
= fg
->f_msglist
.le_next
) {
1409 lck_mtx_lock(&fg
->fg_lock
);
1410 fg
->fg_flag
&= ~(FMARK
|FDEFER
);
1411 lck_mtx_unlock(&fg
->fg_lock
);
1414 for (fg
= fmsghead
.lh_first
; fg
!= 0;
1415 fg
= fg
->f_msglist
.le_next
) {
1416 lck_mtx_lock(&fg
->fg_lock
);
1418 * If the file is not open, skip it
1420 if (fg
->fg_count
== 0) {
1421 lck_mtx_unlock(&fg
->fg_lock
);
1425 * If we already marked it as 'defer' in a
1426 * previous pass, then try process it this time
1429 if (fg
->fg_flag
& FDEFER
) {
1430 fg
->fg_flag
&= ~FDEFER
;
1434 * if it's not defered, then check if it's
1435 * already marked.. if so skip it
1437 if (fg
->fg_flag
& FMARK
) {
1438 lck_mtx_unlock(&fg
->fg_lock
);
1442 * If all references are from messages
1443 * in transit, then skip it. it's not
1444 * externally accessible.
1446 if (fg
->fg_count
== fg
->fg_msgcount
) {
1447 lck_mtx_unlock(&fg
->fg_lock
);
1451 * If it got this far then it must be
1452 * externally accessible.
1454 fg
->fg_flag
|= FMARK
;
1457 * either it was defered, or it is externally
1458 * accessible and not already marked so.
1459 * Now check if it is possibly one of OUR sockets.
1461 if (fg
->fg_type
!= DTYPE_SOCKET
||
1462 (so
= (struct socket
*)fg
->fg_data
) == 0) {
1463 lck_mtx_unlock(&fg
->fg_lock
);
1466 if (so
->so_proto
->pr_domain
!= &localdomain
||
1467 (so
->so_proto
->pr_flags
&PR_RIGHTS
) == 0) {
1468 lck_mtx_unlock(&fg
->fg_lock
);
1473 * if this code is enabled need to run
1474 * under network funnel
1476 if (so
->so_rcv
.sb_flags
& SB_LOCK
) {
1478 * This is problematical; it's not clear
1479 * we need to wait for the sockbuf to be
1480 * unlocked (on a uniprocessor, at least),
1481 * and it's also not clear what to do
1482 * if sbwait returns an error due to receipt
1483 * of a signal. If sbwait does return
1484 * an error, we'll go into an infinite
1485 * loop. Delete all of this for now.
1487 (void) sbwait(&so
->so_rcv
);
1492 * So, Ok, it's one of our sockets and it IS externally
1493 * accessible (or was defered). Now we look
1494 * to see if we hold any file descriptors in its
1495 * message buffers. Follow those links and mark them
1496 * as accessible too.
1498 * In case a file is passed onto itself we need to
1499 * release the file lock.
1501 lck_mtx_unlock(&fg
->fg_lock
);
1503 unp_scan(so
->so_rcv
.sb_mb
, unp_mark
);
1505 } while (unp_defer
);
1507 * We grab an extra reference to each of the file table entries
1508 * that are not otherwise accessible and then free the rights
1509 * that are stored in messages on them.
1511 * The bug in the orginal code is a little tricky, so I'll describe
1512 * what's wrong with it here.
1514 * It is incorrect to simply unp_discard each entry for f_msgcount
1515 * times -- consider the case of sockets A and B that contain
1516 * references to each other. On a last close of some other socket,
1517 * we trigger a gc since the number of outstanding rights (unp_rights)
1518 * is non-zero. If during the sweep phase the gc code un_discards,
1519 * we end up doing a (full) closef on the descriptor. A closef on A
1520 * results in the following chain. Closef calls soo_close, which
1521 * calls soclose. Soclose calls first (through the switch
1522 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply
1523 * returns because the previous instance had set unp_gcing, and
1524 * we return all the way back to soclose, which marks the socket
1525 * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush
1526 * to free up the rights that are queued in messages on the socket A,
1527 * i.e., the reference on B. The sorflush calls via the dom_dispose
1528 * switch unp_dispose, which unp_scans with unp_discard. This second
1529 * instance of unp_discard just calls closef on B.
1531 * Well, a similar chain occurs on B, resulting in a sorflush on B,
1532 * which results in another closef on A. Unfortunately, A is already
1533 * being closed, and the descriptor has already been marked with
1534 * SS_NOFDREF, and soclose panics at this point.
1536 * Here, we first take an extra reference to each inaccessible
1537 * descriptor. Then, we call sorflush ourself, since we know
1538 * it is a Unix domain socket anyhow. After we destroy all the
1539 * rights carried in messages, we do a last closef to get rid
1540 * of our extra reference. This is the last close, and the
1541 * unp_detach etc will shut down the socket.
1543 * 91/09/19, bsy@cs.cmu.edu
1545 extra_ref
= _MALLOC(nfiles
* sizeof (struct fileglob
*),
1546 M_FILEGLOB
, M_WAITOK
);
1547 for (nunref
= 0, fg
= fmsghead
.lh_first
, fpp
= extra_ref
; fg
!= 0;
1549 lck_mtx_lock(&fg
->fg_lock
);
1551 nextfg
= fg
->f_msglist
.le_next
;
1553 * If it's not open, skip it
1555 if (fg
->fg_count
== 0) {
1556 lck_mtx_unlock(&fg
->fg_lock
);
1560 * If all refs are from msgs, and it's not marked accessible
1561 * then it must be referenced from some unreachable cycle
1562 * of (shut-down) FDs, so include it in our
1563 * list of FDs to remove
1565 if (fg
->fg_count
== fg
->fg_msgcount
&& !(fg
->fg_flag
& FMARK
)) {
1570 lck_mtx_unlock(&fg
->fg_lock
);
1573 * for each FD on our hit list, do the following two things
1575 for (i
= nunref
, fpp
= extra_ref
; --i
>= 0; ++fpp
) {
1576 struct fileglob
*tfg
;
1580 if (tfg
->fg_type
== DTYPE_SOCKET
&& tfg
->fg_data
!= NULL
) {
1581 so
= (struct socket
*)(tfg
->fg_data
);
1587 socket_unlock(so
, 0);
1590 for (i
= nunref
, fpp
= extra_ref
; --i
>= 0; ++fpp
)
1591 closef_locked((struct fileproc
*)0, *fpp
, (proc_t
)NULL
);
1593 lck_mtx_lock(uipc_lock
);
1595 unp_gcthread
= NULL
;
1597 if (unp_gcwait
!= 0) {
1601 lck_mtx_unlock(uipc_lock
);
1603 if (need_gcwakeup
!= 0)
1605 FREE((caddr_t
)extra_ref
, M_FILEGLOB
);
1609 unp_dispose(struct mbuf
*m
)
1612 unp_scan(m
, unp_discard
);
1617 * Returns: 0 Success
1620 unp_listen(struct unpcb
*unp
, proc_t p
)
1622 kauth_cred_t safecred
= kauth_cred_proc_ref(p
);
1623 cru2x(safecred
, &unp
->unp_peercred
);
1624 kauth_cred_unref(&safecred
);
1625 unp
->unp_flags
|= UNP_HAVEPCCACHED
;
1629 /* should run under kernel funnel */
1631 unp_scan(struct mbuf
*m0
, void (*op
)(struct fileglob
*))
1634 struct fileglob
**rp
;
1640 for (m
= m0
; m
; m
= m
->m_next
)
1641 if (m
->m_type
== MT_CONTROL
&&
1642 (size_t)m
->m_len
>= sizeof (*cm
)) {
1643 cm
= mtod(m
, struct cmsghdr
*);
1644 if (cm
->cmsg_level
!= SOL_SOCKET
||
1645 cm
->cmsg_type
!= SCM_RIGHTS
)
1647 qfds
= (cm
->cmsg_len
- sizeof (*cm
)) /
1648 sizeof (struct fileglob
*);
1649 rp
= (struct fileglob
**)(cm
+ 1);
1650 for (i
= 0; i
< qfds
; i
++)
1652 break; /* XXX, but saves time */
1658 /* should run under kernel funnel */
1660 unp_mark(struct fileglob
*fg
)
1662 lck_mtx_lock(&fg
->fg_lock
);
1664 if (fg
->fg_flag
& FMARK
) {
1665 lck_mtx_unlock(&fg
->fg_lock
);
1668 fg
->fg_flag
|= (FMARK
|FDEFER
);
1670 lck_mtx_unlock(&fg
->fg_lock
);
1675 /* should run under kernel funnel */
1677 unp_discard(struct fileglob
*fg
)
1679 proc_t p
= current_proc(); /* XXX */
1681 (void) OSAddAtomic(1, (volatile SInt32
*)&unp_disposed
);
1684 unp_discard_fdlocked(fg
, p
);
1688 unp_discard_fdlocked(struct fileglob
*fg
, proc_t p
)
1692 (void) OSAddAtomic(-1, (volatile SInt32
*)&unp_rights
);
1693 (void) closef_locked((struct fileproc
*)0, fg
, p
);