1/*
2 * Copyright (c) 2000-2015 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1982, 1986, 1989, 1991, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94
61 */
62/*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69#include <sys/param.h>
70#include <sys/systm.h>
71#include <sys/kernel.h>
72#include <sys/domain.h>
73#include <sys/fcntl.h>
74#include <sys/malloc.h> /* XXX must be before <sys/file.h> */
75#include <sys/file_internal.h>
76#include <sys/guarded.h>
77#include <sys/filedesc.h>
78#include <sys/lock.h>
79#include <sys/mbuf.h>
80#include <sys/namei.h>
81#include <sys/proc_internal.h>
82#include <sys/kauth.h>
83#include <sys/protosw.h>
84#include <sys/socket.h>
85#include <sys/socketvar.h>
86#include <sys/stat.h>
87#include <sys/sysctl.h>
88#include <sys/un.h>
89#include <sys/unpcb.h>
90#include <sys/vnode_internal.h>
91#include <sys/kdebug.h>
92#include <sys/mcache.h>
93
94#include <kern/zalloc.h>
95#include <kern/locks.h>
96
97#if CONFIG_MACF
98#include <security/mac_framework.h>
99#endif /* CONFIG_MACF */
100
101#include <mach/vm_param.h>
102
103/*
104 * Maximum number of FDs that can be passed in an mbuf
105 */
106#define UIPC_MAX_CMSG_FD 512
107
108#define f_msgcount f_fglob->fg_msgcount
109#define f_cred f_fglob->fg_cred
110#define f_ops f_fglob->fg_ops
111#define f_offset f_fglob->fg_offset
112#define f_data f_fglob->fg_data
113struct zone *unp_zone;
114static unp_gen_t unp_gencnt;
115static u_int unp_count;
116
117static lck_attr_t *unp_mtx_attr;
118static lck_grp_t *unp_mtx_grp;
119static lck_grp_attr_t *unp_mtx_grp_attr;
120static lck_rw_t *unp_list_mtx;
121
122static lck_mtx_t *unp_disconnect_lock;
123static lck_mtx_t *unp_connect_lock;
124static u_int disconnect_in_progress;
125
126extern lck_mtx_t *uipc_lock;
127static struct unp_head unp_shead, unp_dhead;
128
129/*
130 * mDNSResponder tracing. When enabled, endpoints connected to
131 * /var/run/mDNSResponder will be traced; during each send on
132 * the traced socket, we log the PID and process name of the
133 * sending process. We also print out a bit of info related
134 * to the data itself; this assumes ipc_msg_hdr in dnssd_ipc.h
135 * of mDNSResponder stays the same.
136 */
137#define MDNSRESPONDER_PATH "/var/run/mDNSResponder"
138
139static int unpst_tracemdns; /* enable tracing */
140
141#define MDNS_IPC_MSG_HDR_VERSION_1 1
142
143struct mdns_ipc_msg_hdr {
144 uint32_t version;
145 uint32_t datalen;
146 uint32_t ipc_flags;
147 uint32_t op;
148 union {
149 void *context;
150 uint32_t u32[2];
151 } __attribute__((packed));
152 uint32_t reg_index;
153} __attribute__((packed));
154
155/*
156 * Unix communications domain.
157 *
158 * TODO:
159 * SEQPACKET, RDM
160 * rethink name space problems
161 * need a proper out-of-band
162 * lock pushdown
163 */
164static struct sockaddr sun_noname = { sizeof (sun_noname), AF_LOCAL, { 0 } };
165static ino_t unp_ino; /* prototype for fake inode numbers */
166
167static int unp_attach(struct socket *);
168static void unp_detach(struct unpcb *);
169static int unp_bind(struct unpcb *, struct sockaddr *, proc_t);
170static int unp_connect(struct socket *, struct sockaddr *, proc_t);
171static void unp_disconnect(struct unpcb *);
172static void unp_shutdown(struct unpcb *);
173static void unp_drop(struct unpcb *, int);
174__private_extern__ void unp_gc(void);
175static void unp_scan(struct mbuf *, void (*)(struct fileglob *, void *arg), void *arg);
176static void unp_mark(struct fileglob *, __unused void *);
177static void unp_discard(struct fileglob *, void *);
178static int unp_internalize(struct mbuf *, proc_t);
179static int unp_listen(struct unpcb *, proc_t);
180static void unpcb_to_compat(struct unpcb *, struct unpcb_compat *);
181static void unp_get_locks_in_order(struct socket *so, struct socket *conn_so);
182
183static void
184unp_get_locks_in_order(struct socket *so, struct socket *conn_so)
185{
186 if (so < conn_so) {
187 socket_lock(conn_so, 1);
188 } else {
189 struct unpcb *unp = sotounpcb(so);
190 unp->unp_flags |= UNP_DONTDISCONNECT;
191 unp->rw_thrcount++;
192 socket_unlock(so, 0);
193
194 /* Get the locks in the correct order */
195 socket_lock(conn_so, 1);
196 socket_lock(so, 0);
197 unp->rw_thrcount--;
198 if (unp->rw_thrcount == 0) {
199 unp->unp_flags &= ~UNP_DONTDISCONNECT;
200 wakeup(unp);
201 }
202 }
203}
204
205static int
206uipc_abort(struct socket *so)
207{
208 struct unpcb *unp = sotounpcb(so);
209
210 if (unp == 0)
211 return (EINVAL);
212 unp_drop(unp, ECONNABORTED);
213 unp_detach(unp);
214 sofree(so);
215 return (0);
216}
217
218static int
219uipc_accept(struct socket *so, struct sockaddr **nam)
220{
221 struct unpcb *unp = sotounpcb(so);
222
223 if (unp == 0)
224 return (EINVAL);
225
226 /*
227 * Pass back name of connected socket,
228 * if it was bound and we are still connected
229 * (our peer may have closed already!).
230 */
231 if (unp->unp_conn && unp->unp_conn->unp_addr) {
232 *nam = dup_sockaddr((struct sockaddr *)
233 unp->unp_conn->unp_addr, 1);
234 } else {
235 *nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1);
236 }
237 return (0);
238}
239
240/*
241 * Returns: 0 Success
242 * EISCONN
243 * unp_attach:
244 */
245static int
246uipc_attach(struct socket *so, __unused int proto, __unused proc_t p)
247{
248 struct unpcb *unp = sotounpcb(so);
249
250 if (unp != 0)
251 return (EISCONN);
252 return (unp_attach(so));
253}
254
255static int
256uipc_bind(struct socket *so, struct sockaddr *nam, proc_t p)
257{
258 struct unpcb *unp = sotounpcb(so);
259
260 if (unp == 0)
261 return (EINVAL);
262
263 return (unp_bind(unp, nam, p));
264}
265
266/*
267 * Returns: 0 Success
268 * EINVAL
269 * unp_connect:??? [See elsewhere in this file]
270 */
271static int
272uipc_connect(struct socket *so, struct sockaddr *nam, proc_t p)
273{
274 struct unpcb *unp = sotounpcb(so);
275
276 if (unp == 0)
277 return (EINVAL);
278 return (unp_connect(so, nam, p));
279}
280
281/*
282 * Returns: 0 Success
283 * EINVAL
284 * unp_connect2:EPROTOTYPE Protocol wrong type for socket
285 * unp_connect2:EINVAL Invalid argument
286 */
287static int
288uipc_connect2(struct socket *so1, struct socket *so2)
289{
290 struct unpcb *unp = sotounpcb(so1);
291
292 if (unp == 0)
293 return (EINVAL);
294
295 return (unp_connect2(so1, so2));
296}
297
298/* control is EOPNOTSUPP */
299
300static int
301uipc_detach(struct socket *so)
302{
303 struct unpcb *unp = sotounpcb(so);
304
305 if (unp == 0)
306 return (EINVAL);
307
308 LCK_MTX_ASSERT(&unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
309 unp_detach(unp);
310 return (0);
311}
312
313static int
314uipc_disconnect(struct socket *so)
315{
316 struct unpcb *unp = sotounpcb(so);
317
318 if (unp == 0)
319 return (EINVAL);
320 unp_disconnect(unp);
321 return (0);
322}
323
324/*
325 * Returns: 0 Success
326 * EINVAL
327 */
328static int
329uipc_listen(struct socket *so, __unused proc_t p)
330{
331 struct unpcb *unp = sotounpcb(so);
332
333 if (unp == 0 || unp->unp_vnode == 0)
334 return (EINVAL);
335 return (unp_listen(unp, p));
336}
337
338static int
339uipc_peeraddr(struct socket *so, struct sockaddr **nam)
340{
341 struct unpcb *unp = sotounpcb(so);
342
343 if (unp == NULL)
344 return (EINVAL);
345 if (unp->unp_conn != NULL && unp->unp_conn->unp_addr != NULL) {
346 *nam = dup_sockaddr((struct sockaddr *)
347 unp->unp_conn->unp_addr, 1);
348 } else {
349 *nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1);
350 }
351 return (0);
352}
353
354static int
355uipc_rcvd(struct socket *so, __unused int flags)
356{
357 struct unpcb *unp = sotounpcb(so);
358 struct socket *so2;
359
360 if (unp == 0)
361 return (EINVAL);
362 switch (so->so_type) {
363 case SOCK_DGRAM:
364 panic("uipc_rcvd DGRAM?");
365 /*NOTREACHED*/
366
367 case SOCK_STREAM:
368#define rcv (&so->so_rcv)
369#define snd (&so2->so_snd)
370 if (unp->unp_conn == 0)
371 break;
372
373 so2 = unp->unp_conn->unp_socket;
374 unp_get_locks_in_order(so, so2);
375 /*
376 * Adjust backpressure on sender
377 * and wakeup any waiting to write.
378 */
379 snd->sb_mbmax += unp->unp_mbcnt - rcv->sb_mbcnt;
380 unp->unp_mbcnt = rcv->sb_mbcnt;
381 snd->sb_hiwat += unp->unp_cc - rcv->sb_cc;
382 unp->unp_cc = rcv->sb_cc;
383 sowwakeup(so2);
384
385 socket_unlock(so2, 1);
386
387#undef snd
388#undef rcv
389 break;
390
391 default:
392 panic("uipc_rcvd unknown socktype");
393 }
394 return (0);
395}
396
397/* pru_rcvoob is EOPNOTSUPP */
398
399/*
400 * Returns: 0 Success
401 * EINVAL
402 * EOPNOTSUPP
403 * EPIPE
404 * ENOTCONN
405 * EISCONN
406 * unp_internalize:EINVAL
407 * unp_internalize:EBADF
408 * unp_connect:EAFNOSUPPORT Address family not supported
409 * unp_connect:EINVAL Invalid argument
410 * unp_connect:ENOTSOCK Not a socket
411 * unp_connect:ECONNREFUSED Connection refused
412 * unp_connect:EISCONN Socket is connected
413 * unp_connect:EPROTOTYPE Protocol wrong type for socket
414 * unp_connect:???
415 * sbappendaddr:ENOBUFS [5th argument, contents modified]
416 * sbappendaddr:??? [whatever a filter author chooses]
417 */
418static int
419uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
420 struct mbuf *control, proc_t p)
421{
422 int error = 0;
423 struct unpcb *unp = sotounpcb(so);
424 struct socket *so2;
425
426 if (unp == 0) {
427 error = EINVAL;
428 goto release;
429 }
430 if (flags & PRUS_OOB) {
431 error = EOPNOTSUPP;
432 goto release;
433 }
434
435 if (control) {
436 /* release lock to avoid deadlock (4436174) */
437 socket_unlock(so, 0);
438 error = unp_internalize(control, p);
439 socket_lock(so, 0);
440 if (error)
441 goto release;
442 }
443
444 switch (so->so_type) {
445 case SOCK_DGRAM:
446 {
447 struct sockaddr *from;
448
449 if (nam) {
450 if (unp->unp_conn) {
451 error = EISCONN;
452 break;
453 }
454 error = unp_connect(so, nam, p);
455 if (error)
456 break;
457 } else {
458 if (unp->unp_conn == 0) {
459 error = ENOTCONN;
460 break;
461 }
462 }
463
464 so2 = unp->unp_conn->unp_socket;
465 if (so != so2)
466 unp_get_locks_in_order(so, so2);
467
468 if (unp->unp_addr)
469 from = (struct sockaddr *)unp->unp_addr;
470 else
471 from = &sun_noname;
472 /*
473 * sbappendaddr() will fail when the receiver runs out of
474 * space; in contrast to SOCK_STREAM, we will lose messages
475 * for the SOCK_DGRAM case when the receiver's queue overflows.
476 * SB_UNIX on the socket buffer implies that the callee will
477 * not free the control message, if any, because we would need
478 * to call unp_dispose() on it.
479 */
480 if (sbappendaddr(&so2->so_rcv, from, m, control, &error)) {
481 control = NULL;
482 sorwakeup(so2);
483 } else if (control != NULL && error == 0) {
484 /* A socket filter took control; don't touch it */
485 control = NULL;
486 }
487
488 if (so != so2)
489 socket_unlock(so2, 1);
490
491 m = NULL;
492 if (nam)
493 unp_disconnect(unp);
494 break;
495 }
496
497 case SOCK_STREAM: {
498 int didreceive = 0;
499#define rcv (&so2->so_rcv)
500#define snd (&so->so_snd)
501 /* Connect if not connected yet. */
502 /*
503 * Note: A better implementation would complain
504 * if not equal to the peer's address.
505 */
506 if ((so->so_state & SS_ISCONNECTED) == 0) {
507 if (nam) {
508 error = unp_connect(so, nam, p);
509 if (error)
510 break; /* XXX */
511 } else {
512 error = ENOTCONN;
513 break;
514 }
515 }
516
517 if (so->so_state & SS_CANTSENDMORE) {
518 error = EPIPE;
519 break;
520 }
521 if (unp->unp_conn == 0)
522 panic("uipc_send connected but no connection?");
523
524 so2 = unp->unp_conn->unp_socket;
525 unp_get_locks_in_order(so, so2);
526
527 /* Check socket state again as we might have unlocked the socket
528 * while trying to get the locks in order
529 */
530
531 if ((so->so_state & SS_CANTSENDMORE)) {
532 error = EPIPE;
533 socket_unlock(so2, 1);
534 break;
535 }
536
537 if (unp->unp_flags & UNP_TRACE_MDNS) {
538 struct mdns_ipc_msg_hdr hdr;
539
540 if (mbuf_copydata(m, 0, sizeof (hdr), &hdr) == 0 &&
541 hdr.version == ntohl(MDNS_IPC_MSG_HDR_VERSION_1)) {
542 printf("%s[mDNSResponder] pid=%d (%s): op=0x%x\n",
543 __func__, p->p_pid, p->p_comm, ntohl(hdr.op));
544 }
545 }
546
547 /*
548 * Send to paired receive port, and then reduce send buffer
549 * hiwater marks to maintain backpressure. Wake up readers.
550 * SB_UNIX flag will allow new record to be appended to the
551 * receiver's queue even when it is already full. It is
552 * possible, however, that append might fail. In that case,
553 * we will need to call unp_dispose() on the control message;
554 * the callee will not free it since SB_UNIX is set.
555 */
556 didreceive = control ?
557 sbappendcontrol(rcv, m, control, &error) : sbappend(rcv, m);
558
559 snd->sb_mbmax -= rcv->sb_mbcnt - unp->unp_conn->unp_mbcnt;
560 unp->unp_conn->unp_mbcnt = rcv->sb_mbcnt;
561 if ((int32_t)snd->sb_hiwat >=
562 (int32_t)(rcv->sb_cc - unp->unp_conn->unp_cc)) {
563 snd->sb_hiwat -= rcv->sb_cc - unp->unp_conn->unp_cc;
564 } else {
565 snd->sb_hiwat = 0;
566 }
567 unp->unp_conn->unp_cc = rcv->sb_cc;
568 if (didreceive) {
569 control = NULL;
570 sorwakeup(so2);
571 } else if (control != NULL && error == 0) {
572 /* A socket filter took control; don't touch it */
573 control = NULL;
574 }
575
576 socket_unlock(so2, 1);
577 m = NULL;
578#undef snd
579#undef rcv
580 }
581 break;
582
583 default:
584 panic("uipc_send unknown socktype");
585 }
586
587 /*
588 * SEND_EOF is equivalent to a SEND followed by
589 * a SHUTDOWN.
590 */
591 if (flags & PRUS_EOF) {
592 socantsendmore(so);
593 unp_shutdown(unp);
594 }
595
596 if (control && error != 0) {
597 socket_unlock(so, 0);
598 unp_dispose(control);
599 socket_lock(so, 0);
600 }
601
602release:
603 if (control)
604 m_freem(control);
605 if (m)
606 m_freem(m);
607 return (error);
608}
609
610static int
611uipc_sense(struct socket *so, void *ub, int isstat64)
612{
613 struct unpcb *unp = sotounpcb(so);
614 struct socket *so2;
615 blksize_t blksize;
616
617 if (unp == 0)
618 return (EINVAL);
619
620 blksize = so->so_snd.sb_hiwat;
621 if (so->so_type == SOCK_STREAM && unp->unp_conn != 0) {
622 so2 = unp->unp_conn->unp_socket;
623 blksize += so2->so_rcv.sb_cc;
624 }
625 if (unp->unp_ino == 0)
626 unp->unp_ino = unp_ino++;
627
628 if (isstat64 != 0) {
629 struct stat64 *sb64;
630
631 sb64 = (struct stat64 *)ub;
632 sb64->st_blksize = blksize;
633 sb64->st_dev = NODEV;
634 sb64->st_ino = (ino64_t)unp->unp_ino;
635 } else {
636 struct stat *sb;
637
638 sb = (struct stat *)ub;
639 sb->st_blksize = blksize;
640 sb->st_dev = NODEV;
641 sb->st_ino = (ino_t)(uintptr_t)unp->unp_ino;
642 }
643
644 return (0);
645}
646
647/*
648 * Returns: 0 Success
649 * EINVAL
650 *
651 * Notes: This is not strictly correct, as unp_shutdown() also calls
652 * socantrcvmore(). These should maybe both be conditionalized
653 * on the 'how' argument in soshutdown() as called from the
654 * shutdown() system call.
655 */
656static int
657uipc_shutdown(struct socket *so)
658{
659 struct unpcb *unp = sotounpcb(so);
660
661 if (unp == 0)
662 return (EINVAL);
663 socantsendmore(so);
664 unp_shutdown(unp);
665 return (0);
666}
667
668/*
669 * Returns: 0 Success
670 * EINVAL Invalid argument
671 */
672static int
673uipc_sockaddr(struct socket *so, struct sockaddr **nam)
674{
675 struct unpcb *unp = sotounpcb(so);
676
677 if (unp == NULL)
678 return (EINVAL);
679 if (unp->unp_addr != NULL) {
680 *nam = dup_sockaddr((struct sockaddr *)unp->unp_addr, 1);
681 } else {
682 *nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1);
683 }
684 return (0);
685}
686
687struct pr_usrreqs uipc_usrreqs = {
688 .pru_abort = uipc_abort,
689 .pru_accept = uipc_accept,
690 .pru_attach = uipc_attach,
691 .pru_bind = uipc_bind,
692 .pru_connect = uipc_connect,
693 .pru_connect2 = uipc_connect2,
694 .pru_detach = uipc_detach,
695 .pru_disconnect = uipc_disconnect,
696 .pru_listen = uipc_listen,
697 .pru_peeraddr = uipc_peeraddr,
698 .pru_rcvd = uipc_rcvd,
699 .pru_send = uipc_send,
700 .pru_sense = uipc_sense,
701 .pru_shutdown = uipc_shutdown,
702 .pru_sockaddr = uipc_sockaddr,
703 .pru_sosend = sosend,
704 .pru_soreceive = soreceive,
705};
706
707int
708uipc_ctloutput(struct socket *so, struct sockopt *sopt)
709{
710 struct unpcb *unp = sotounpcb(so);
711 int error = 0;
712 pid_t peerpid;
713 struct socket *peerso;
714
715 switch (sopt->sopt_dir) {
716 case SOPT_GET:
717 switch (sopt->sopt_name) {
718 case LOCAL_PEERCRED:
719 if (unp->unp_flags & UNP_HAVEPC) {
720 error = sooptcopyout(sopt, &unp->unp_peercred,
721 sizeof (unp->unp_peercred));
722 } else {
723 if (so->so_type == SOCK_STREAM)
724 error = ENOTCONN;
725 else
726 error = EINVAL;
727 }
728 break;
729 case LOCAL_PEERPID:
730 case LOCAL_PEEREPID:
731 if (unp->unp_conn == NULL) {
732 error = ENOTCONN;
733 break;
734 }
735 peerso = unp->unp_conn->unp_socket;
736 if (peerso == NULL)
737 panic("peer is connected but has no socket?");
738 unp_get_locks_in_order(so, peerso);
739 if (sopt->sopt_name == LOCAL_PEEREPID &&
740 peerso->so_flags & SOF_DELEGATED)
741 peerpid = peerso->e_pid;
742 else
743 peerpid = peerso->last_pid;
744 socket_unlock(peerso, 1);
745 error = sooptcopyout(sopt, &peerpid, sizeof (peerpid));
746 break;
747 case LOCAL_PEERUUID:
748 case LOCAL_PEEREUUID:
749 if (unp->unp_conn == NULL) {
750 error = ENOTCONN;
751 break;
752 }
753 peerso = unp->unp_conn->unp_socket;
754 if (peerso == NULL)
755 panic("peer is connected but has no socket?");
756 unp_get_locks_in_order(so, peerso);
757 if (sopt->sopt_name == LOCAL_PEEREUUID &&
758 peerso->so_flags & SOF_DELEGATED)
759 error = sooptcopyout(sopt, &peerso->e_uuid,
760 sizeof (peerso->e_uuid));
761 else
762 error = sooptcopyout(sopt, &peerso->last_uuid,
763 sizeof (peerso->last_uuid));
764 socket_unlock(peerso, 1);
765 break;
766 default:
767 error = EOPNOTSUPP;
768 break;
769 }
770 break;
771 case SOPT_SET:
772 default:
773 error = EOPNOTSUPP;
774 break;
775 }
776
777 return (error);
778}
779
780/*
781 * Both send and receive buffers are allocated PIPSIZ bytes of buffering
782 * for stream sockets, although the total for sender and receiver is
783 * actually only PIPSIZ.
784 * Datagram sockets really use the sendspace as the maximum datagram size,
785 * and don't really want to reserve the sendspace. Their recvspace should
786 * be large enough for at least one max-size datagram plus address.
787 */
788#ifndef PIPSIZ
789#define PIPSIZ 8192
790#endif
791static u_int32_t unpst_sendspace = PIPSIZ;
792static u_int32_t unpst_recvspace = PIPSIZ;
793static u_int32_t unpdg_sendspace = 2*1024; /* really max datagram size */
794static u_int32_t unpdg_recvspace = 4*1024;
795
796static int unp_rights; /* file descriptors in flight */
797static int unp_disposed; /* discarded file descriptors */
798
799SYSCTL_DECL(_net_local_stream);
800SYSCTL_INT(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW | CTLFLAG_LOCKED,
801 &unpst_sendspace, 0, "");
802SYSCTL_INT(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW | CTLFLAG_LOCKED,
803 &unpst_recvspace, 0, "");
804SYSCTL_INT(_net_local_stream, OID_AUTO, tracemdns, CTLFLAG_RW | CTLFLAG_LOCKED,
805 &unpst_tracemdns, 0, "");
806SYSCTL_DECL(_net_local_dgram);
807SYSCTL_INT(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW | CTLFLAG_LOCKED,
808 &unpdg_sendspace, 0, "");
809SYSCTL_INT(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW | CTLFLAG_LOCKED,
810 &unpdg_recvspace, 0, "");
811SYSCTL_DECL(_net_local);
812SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD | CTLFLAG_LOCKED, &unp_rights, 0, "");
813
814/*
815 * Returns: 0 Success
816 * ENOBUFS
817 * soreserve:ENOBUFS
818 */
819static int
820unp_attach(struct socket *so)
821{
822 struct unpcb *unp;
823 int error = 0;
824
825 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
826 switch (so->so_type) {
827
828 case SOCK_STREAM:
829 error = soreserve(so, unpst_sendspace, unpst_recvspace);
830 break;
831
832 case SOCK_DGRAM:
833 error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
834 break;
835
836 default:
837 panic("unp_attach");
838 }
839 if (error)
840 return (error);
841 }
842 unp = (struct unpcb *)zalloc(unp_zone);
843 if (unp == NULL)
844 return (ENOBUFS);
845 bzero(unp, sizeof (*unp));
846
847 lck_mtx_init(&unp->unp_mtx,
848 unp_mtx_grp, unp_mtx_attr);
849
850 lck_rw_lock_exclusive(unp_list_mtx);
851 LIST_INIT(&unp->unp_refs);
852 unp->unp_socket = so;
853 unp->unp_gencnt = ++unp_gencnt;
854 unp_count++;
855 LIST_INSERT_HEAD(so->so_type == SOCK_DGRAM ?
856 &unp_dhead : &unp_shead, unp, unp_link);
857 lck_rw_done(unp_list_mtx);
858 so->so_pcb = (caddr_t)unp;
859 /*
860 * Mark AF_UNIX socket buffers accordingly so that:
861 *
862 * a. In the SOCK_STREAM case, socket buffer append won't fail due to
863 * the lack of space; this essentially loosens the sbspace() check,
864 * since there is disconnect between sosend() and uipc_send() with
865 * respect to flow control that might result in our dropping the
866 * data in uipc_send(). By setting this, we allow for slightly
867 * more records to be appended to the receiving socket to avoid
868 * losing data (which we can't afford in the SOCK_STREAM case).
869 * Flow control still takes place since we adjust the sender's
870 * hiwat during each send. This doesn't affect the SOCK_DGRAM
871 * case and append would still fail when the queue overflows.
872 *
873 * b. In the presence of control messages containing internalized
874 * file descriptors, the append routines will not free them since
875 * we'd need to undo the work first via unp_dispose().
876 */
877 so->so_rcv.sb_flags |= SB_UNIX;
878 so->so_snd.sb_flags |= SB_UNIX;
879 return (0);
880}
881
882static void
883unp_detach(struct unpcb *unp)
884{
885 int so_locked = 1;
886
887 lck_rw_lock_exclusive(unp_list_mtx);
888 LIST_REMOVE(unp, unp_link);
889 --unp_count;
890 ++unp_gencnt;
891 lck_rw_done(unp_list_mtx);
892 if (unp->unp_vnode) {
893 struct vnode *tvp = NULL;
894 socket_unlock(unp->unp_socket, 0);
895
896 /* Holding unp_connect_lock will avoid a race between
897 * a thread closing the listening socket and a thread
898 * connecting to it.
899 */
900 lck_mtx_lock(unp_connect_lock);
901 socket_lock(unp->unp_socket, 0);
902 if (unp->unp_vnode) {
903 tvp = unp->unp_vnode;
904 unp->unp_vnode->v_socket = NULL;
905 unp->unp_vnode = NULL;
906 }
907 lck_mtx_unlock(unp_connect_lock);
908 if (tvp != NULL)
909 vnode_rele(tvp); /* drop the usecount */
910 }
911 if (unp->unp_conn)
912 unp_disconnect(unp);
913 while (unp->unp_refs.lh_first) {
914 struct unpcb *unp2 = NULL;
915
916 /* This datagram socket is connected to one or more
917 * sockets. In order to avoid a race condition between removing
918 * this reference and closing the connected socket, we need
919 * to check disconnect_in_progress
920 */
921 if (so_locked == 1) {
922 socket_unlock(unp->unp_socket, 0);
923 so_locked = 0;
924 }
925 lck_mtx_lock(unp_disconnect_lock);
926 while (disconnect_in_progress != 0) {
927 (void)msleep((caddr_t)&disconnect_in_progress, unp_disconnect_lock,
928 PSOCK, "disconnect", NULL);
929 }
930 disconnect_in_progress = 1;
931 lck_mtx_unlock(unp_disconnect_lock);
932
933 /* Now we are sure that any unpcb socket disconnect is not happening */
934 if (unp->unp_refs.lh_first != NULL) {
935 unp2 = unp->unp_refs.lh_first;
936 socket_lock(unp2->unp_socket, 1);
937 }
938
939 lck_mtx_lock(unp_disconnect_lock);
940 disconnect_in_progress = 0;
941 wakeup(&disconnect_in_progress);
942 lck_mtx_unlock(unp_disconnect_lock);
943
944 if (unp2 != NULL) {
945 /* We already locked this socket and have a reference on it */
946 unp_drop(unp2, ECONNRESET);
947 socket_unlock(unp2->unp_socket, 1);
948 }
949 }
950
951 if (so_locked == 0) {
952 socket_lock(unp->unp_socket, 0);
953 so_locked = 1;
954 }
955 soisdisconnected(unp->unp_socket);
956 /* makes sure we're getting dealloced */
957 unp->unp_socket->so_flags |= SOF_PCBCLEARING;
958}
959
960/*
961 * Returns: 0 Success
962 * EAFNOSUPPORT
963 * EINVAL
964 * EADDRINUSE
965 * namei:??? [anything namei can return]
966 * vnode_authorize:??? [anything vnode_authorize can return]
967 *
968 * Notes: p at this point is the current process, as this function is
969 * only called by sobind().
970 */
971static int
972unp_bind(
973 struct unpcb *unp,
974 struct sockaddr *nam,
975 proc_t p)
976{
977 struct sockaddr_un *soun = (struct sockaddr_un *)nam;
978 struct vnode *vp, *dvp;
979 struct vnode_attr va;
980 vfs_context_t ctx = vfs_context_current();
981 int error, namelen;
982 struct nameidata nd;
983 struct socket *so = unp->unp_socket;
984 char buf[SOCK_MAXADDRLEN];
985
986 if (nam->sa_family != 0 && nam->sa_family != AF_UNIX) {
987 return (EAFNOSUPPORT);
988 }
989
990 /*
991 * Check if the socket is already bound to an address
992 */
993 if (unp->unp_vnode != NULL)
994 return (EINVAL);
995 /*
996 * Check if the socket may have been shut down
997 */
998 if ((so->so_state & (SS_CANTRCVMORE | SS_CANTSENDMORE)) ==
999 (SS_CANTRCVMORE | SS_CANTSENDMORE))
1000 return (EINVAL);
1001
1002 namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
1003 if (namelen <= 0)
1004 return (EINVAL);
1005 /*
1006 * Note: sun_path is not a zero terminated "C" string
1007 */
1008 if (namelen >= SOCK_MAXADDRLEN)
1009 return (EINVAL);
1010 bcopy(soun->sun_path, buf, namelen);
1011 buf[namelen] = 0;
1012
1013 socket_unlock(so, 0);
1014
1015 NDINIT(&nd, CREATE, OP_MKFIFO, FOLLOW | LOCKPARENT, UIO_SYSSPACE,
1016 CAST_USER_ADDR_T(buf), ctx);
1017 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
1018 error = namei(&nd);
1019 if (error) {
1020 socket_lock(so, 0);
1021 return (error);
1022 }
1023 dvp = nd.ni_dvp;
1024 vp = nd.ni_vp;
1025
1026 if (vp != NULL) {
1027 /*
1028 * need to do this before the vnode_put of dvp
1029 * since we may have to release an fs_nodelock
1030 */
1031 nameidone(&nd);
1032
1033 vnode_put(dvp);
1034 vnode_put(vp);
1035
1036 socket_lock(so, 0);
1037 return (EADDRINUSE);
1038 }
1039
1040 VATTR_INIT(&va);
1041 VATTR_SET(&va, va_type, VSOCK);
1042 VATTR_SET(&va, va_mode, (ACCESSPERMS & ~p->p_fd->fd_cmask));
1043
1044#if CONFIG_MACF
1045 error = mac_vnode_check_create(ctx,
1046 nd.ni_dvp, &nd.ni_cnd, &va);
1047
1048 if (error == 0)
1049#endif /* CONFIG_MACF */
1050#if CONFIG_MACF_SOCKET_SUBSET
1051 error = mac_vnode_check_uipc_bind(ctx,
1052 nd.ni_dvp, &nd.ni_cnd, &va);
1053
1054 if (error == 0)
1055#endif /* MAC_SOCKET_SUBSET */
1056 /* authorize before creating */
1057 error = vnode_authorize(dvp, NULL, KAUTH_VNODE_ADD_FILE, ctx);
1058
1059 if (!error) {
1060 /* create the socket */
1061 error = vn_create(dvp, &vp, &nd, &va, 0, 0, NULL, ctx);
1062 }
1063
1064 nameidone(&nd);
1065 vnode_put(dvp);
1066
1067 if (error) {
1068 socket_lock(so, 0);
1069 return (error);
1070 }
1071 vnode_ref(vp); /* gain a longterm reference */
1072 socket_lock(so, 0);
1073 vp->v_socket = unp->unp_socket;
1074 unp->unp_vnode = vp;
1075 unp->unp_addr = (struct sockaddr_un *)dup_sockaddr(nam, 1);
1076 vnode_put(vp); /* drop the iocount */
1077
1078 return (0);
1079}
1080
1081
1082/*
1083 * Returns: 0 Success
1084 * EAFNOSUPPORT Address family not supported
1085 * EINVAL Invalid argument
1086 * ENOTSOCK Not a socket
1087 * ECONNREFUSED Connection refused
1088 * EPROTOTYPE Protocol wrong type for socket
1089 * EISCONN Socket is connected
1090 * unp_connect2:EPROTOTYPE Protocol wrong type for socket
1091 * unp_connect2:EINVAL Invalid argument
1092 * namei:??? [anything namei can return]
1093 * vnode_authorize:???? [anything vnode_authorize can return]
1094 *
1095 * Notes: p at this point is the current process, as this function is
1096 * only called by sosend(), sendfile(), and soconnectlock().
1097 */
1098static int
1099unp_connect(struct socket *so, struct sockaddr *nam, __unused proc_t p)
1100{
1101 struct sockaddr_un *soun = (struct sockaddr_un *)nam;
1102 struct vnode *vp;
1103 struct socket *so2, *so3, *list_so=NULL;
1104 struct unpcb *unp, *unp2, *unp3;
1105 vfs_context_t ctx = vfs_context_current();
1106 int error, len;
1107 struct nameidata nd;
1108 char buf[SOCK_MAXADDRLEN];
1109
1110 if (nam->sa_family != 0 && nam->sa_family != AF_UNIX) {
1111 return (EAFNOSUPPORT);
1112 }
1113
1114 unp = sotounpcb(so);
1115 so2 = so3 = NULL;
1116
1117 len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
1118 if (len <= 0)
1119 return (EINVAL);
1120 /*
1121 * Note: sun_path is not a zero terminated "C" string
1122 */
1123 if (len >= SOCK_MAXADDRLEN)
1124 return (EINVAL);
1125 bcopy(soun->sun_path, buf, len);
1126 buf[len] = 0;
1127
1128 socket_unlock(so, 0);
1129
1130 NDINIT(&nd, LOOKUP, OP_LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE,
1131 CAST_USER_ADDR_T(buf), ctx);
1132 error = namei(&nd);
1133 if (error) {
1134 socket_lock(so, 0);
1135 return (error);
1136 }
1137 nameidone(&nd);
1138 vp = nd.ni_vp;
1139 if (vp->v_type != VSOCK) {
1140 error = ENOTSOCK;
1141 socket_lock(so, 0);
1142 goto out;
1143 }
1144
1145#if CONFIG_MACF_SOCKET_SUBSET
1146 error = mac_vnode_check_uipc_connect(ctx, vp, so);
1147 if (error) {
1148 socket_lock(so, 0);
1149 goto out;
1150 }
1151#endif /* MAC_SOCKET_SUBSET */
1152
1153 error = vnode_authorize(vp, NULL, KAUTH_VNODE_WRITE_DATA, ctx);
1154 if (error) {
1155 socket_lock(so, 0);
1156 goto out;
1157 }
1158
1159 lck_mtx_lock(unp_connect_lock);
1160
1161 if (vp->v_socket == 0) {
1162 lck_mtx_unlock(unp_connect_lock);
1163 error = ECONNREFUSED;
1164 socket_lock(so, 0);
1165 goto out;
1166 }
1167
1168 socket_lock(vp->v_socket, 1); /* Get a reference on the listening socket */
1169 so2 = vp->v_socket;
1170 lck_mtx_unlock(unp_connect_lock);
1171
1172
1173 if (so2->so_pcb == NULL) {
1174 error = ECONNREFUSED;
1175 if (so != so2) {
1176 socket_unlock(so2, 1);
1177 socket_lock(so, 0);
1178 } else {
1179 /* Release the reference held for the listen socket */
1180 VERIFY(so2->so_usecount > 0);
1181 so2->so_usecount--;
1182 }
1183 goto out;
1184 }
1185
1186 if (so < so2) {
1187 socket_unlock(so2, 0);
1188 socket_lock(so, 0);
1189 socket_lock(so2, 0);
1190 } else if (so > so2) {
1191 socket_lock(so, 0);
1192 }
1193 /*
1194 * Check if socket was connected while we were trying to
1195 * get the socket locks in order.
1196 * XXX - probably shouldn't return an error for SOCK_DGRAM
1197 */
1198 if ((so->so_state & SS_ISCONNECTED) != 0) {
1199 error = EISCONN;
1200 goto decref_out;
1201 }
1202
1203 if (so->so_type != so2->so_type) {
1204 error = EPROTOTYPE;
1205 goto decref_out;
1206 }
1207
1208 if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
1209 /* Release the incoming socket but keep a reference */
1210 socket_unlock(so, 0);
1211
1212 if ((so2->so_options & SO_ACCEPTCONN) == 0 ||
1213 (so3 = sonewconn(so2, 0, nam)) == 0) {
1214 error = ECONNREFUSED;
1215 if (so != so2) {
1216 socket_unlock(so2, 1);
1217 socket_lock(so, 0);
1218 } else {
1219 socket_lock(so, 0);
1220 /* Release the reference held for
1221 * listen socket.
1222 */
1223 VERIFY(so2->so_usecount > 0);
1224 so2->so_usecount--;
1225 }
1226 goto out;
1227 }
1228 unp2 = sotounpcb(so2);
1229 unp3 = sotounpcb(so3);
1230 if (unp2->unp_addr)
1231 unp3->unp_addr = (struct sockaddr_un *)
1232 dup_sockaddr((struct sockaddr *)unp2->unp_addr, 1);
1233
1234 /*
1235 * unp_peercred management:
1236 *
1237 * The connecter's (client's) credentials are copied
1238 * from its process structure at the time of connect()
1239 * (which is now).
1240 */
1241 cru2x(vfs_context_ucred(ctx), &unp3->unp_peercred);
1242 unp3->unp_flags |= UNP_HAVEPC;
1243 /*
1244 * The receiver's (server's) credentials are copied
1245 * from the unp_peercred member of socket on which the
1246 * former called listen(); unp_listen() cached that
1247 * process's credentials at that time so we can use
1248 * them now.
1249 */
1250 KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED,
1251 ("unp_connect: listener without cached peercred"));
1252
1253 /* Here we need to have both so and so2 locks and so2
1254 * is already locked. Lock ordering is required.
1255 */
1256 if (so < so2) {
1257 socket_unlock(so2, 0);
1258 socket_lock(so, 0);
1259 socket_lock(so2, 0);
1260 } else {
1261 socket_lock(so, 0);
1262 }
1263
1264 /* Check again if the socket state changed when its lock was released */
1265 if ((so->so_state & SS_ISCONNECTED) != 0) {
1266 error = EISCONN;
1267 socket_unlock(so2, 1);
1268 socket_lock(so3, 0);
1269 sofreelastref(so3, 1);
1270 goto out;
1271 }
1272 memcpy(&unp->unp_peercred, &unp2->unp_peercred,
1273 sizeof (unp->unp_peercred));
1274 unp->unp_flags |= UNP_HAVEPC;
1275
1276#if CONFIG_MACF_SOCKET
1277 /* XXXMAC: recursive lock: SOCK_LOCK(so); */
1278 mac_socketpeer_label_associate_socket(so, so3);
1279 mac_socketpeer_label_associate_socket(so3, so);
1280 /* XXXMAC: SOCK_UNLOCK(so); */
1281#endif /* MAC_SOCKET */
1282
1283 /* Hold the reference on listening socket until the end */
1284 socket_unlock(so2, 0);
1285 list_so = so2;
1286
1287 /* Lock ordering doesn't matter because so3 was just created */
1288 socket_lock(so3, 1);
1289 so2 = so3;
1290
1291 /*
1292 * Enable tracing for mDNSResponder endpoints. (The use
1293 * of sizeof instead of strlen below takes the null
1294 * terminating character into account.)
1295 */
1296 if (unpst_tracemdns &&
1297 !strncmp(soun->sun_path, MDNSRESPONDER_PATH,
1298 sizeof (MDNSRESPONDER_PATH))) {
1299 unp->unp_flags |= UNP_TRACE_MDNS;
1300 unp2->unp_flags |= UNP_TRACE_MDNS;
1301 }
1302 }
1303
1304 error = unp_connect2(so, so2);
1305
1306decref_out:
1307 if (so2 != NULL) {
1308 if (so != so2) {
1309 socket_unlock(so2, 1);
1310 } else {
1311 /* Release the extra reference held for the listen socket.
1312 * This is possible only for SOCK_DGRAM sockets. We refuse
1313 * connecting to the same socket for SOCK_STREAM sockets.
1314 */
1315 VERIFY(so2->so_usecount > 0);
1316 so2->so_usecount--;
1317 }
1318 }
1319
1320 if (list_so != NULL) {
1321 socket_lock(list_so, 0);
1322 socket_unlock(list_so, 1);
1323 }
1324
1325out:
1326 LCK_MTX_ASSERT(&unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1327 vnode_put(vp);
1328 return (error);
1329}
1330
1331/*
1332 * Returns: 0 Success
1333 * EPROTOTYPE Protocol wrong type for socket
1334 * EINVAL Invalid argument
1335 */
1336int
1337unp_connect2(struct socket *so, struct socket *so2)
1338{
1339 struct unpcb *unp = sotounpcb(so);
1340 struct unpcb *unp2;
1341
1342 if (so2->so_type != so->so_type)
1343 return (EPROTOTYPE);
1344
1345 unp2 = sotounpcb(so2);
1346
1347 LCK_MTX_ASSERT(&unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1348 LCK_MTX_ASSERT(&unp2->unp_mtx, LCK_MTX_ASSERT_OWNED);
1349
1350 /* Verify both sockets are still opened */
1351 if (unp == 0 || unp2 == 0)
1352 return (EINVAL);
1353
1354 unp->unp_conn = unp2;
1355 so2->so_usecount++;
1356
1357 switch (so->so_type) {
1358
1359 case SOCK_DGRAM:
1360 LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
1361
1362 if (so != so2) {
1363 /* Avoid lock order reversals due to drop/acquire in soisconnected. */
1364 /* Keep an extra reference on so2 that will be dropped
1365 * soon after getting the locks in order
1366 */
1367 socket_unlock(so2, 0);
1368 soisconnected(so);
1369 unp_get_locks_in_order(so, so2);
1370 VERIFY(so2->so_usecount > 0);
1371 so2->so_usecount--;
1372 } else {
1373 soisconnected(so);
1374 }
1375
1376 break;
1377
1378 case SOCK_STREAM:
1379 /* This takes care of socketpair */
1380 if (!(unp->unp_flags & UNP_HAVEPC) &&
1381 !(unp2->unp_flags & UNP_HAVEPC)) {
1382 cru2x(kauth_cred_get(), &unp->unp_peercred);
1383 unp->unp_flags |= UNP_HAVEPC;
1384
1385 cru2x(kauth_cred_get(), &unp2->unp_peercred);
1386 unp2->unp_flags |= UNP_HAVEPC;
1387 }
1388 unp2->unp_conn = unp;
1389 so->so_usecount++;
1390
1391 /* Avoid lock order reversals due to drop/acquire in soisconnected. */
1392 socket_unlock(so, 0);
1393 soisconnected(so2);
1394
1395 /* Keep an extra reference on so2, that will be dropped soon after
1396 * getting the locks in order again.
1397 */
1398 socket_unlock(so2, 0);
1399
1400 socket_lock(so, 0);
1401 soisconnected(so);
1402
1403 unp_get_locks_in_order(so, so2);
1404 /* Decrement the extra reference left before */
1405 VERIFY(so2->so_usecount > 0);
1406 so2->so_usecount--;
1407 break;
1408
1409 default:
1410 panic("unknown socket type %d in unp_connect2", so->so_type);
1411 }
1412 LCK_MTX_ASSERT(&unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1413 LCK_MTX_ASSERT(&unp2->unp_mtx, LCK_MTX_ASSERT_OWNED);
1414 return (0);
1415}
1416
1417static void
1418unp_disconnect(struct unpcb *unp)
1419{
1420 struct unpcb *unp2 = NULL;
1421 struct socket *so2 = NULL, *so;
1422 struct socket *waitso;
1423 int so_locked = 1, strdisconn = 0;
1424
1425 so = unp->unp_socket;
1426 if (unp->unp_conn == NULL) {
1427 return;
1428 }
1429 lck_mtx_lock(unp_disconnect_lock);
1430 while (disconnect_in_progress != 0) {
1431 if (so_locked == 1) {
1432 socket_unlock(so, 0);
1433 so_locked = 0;
1434 }
1435 (void)msleep((caddr_t)&disconnect_in_progress, unp_disconnect_lock,
1436 PSOCK, "disconnect", NULL);
1437 }
1438 disconnect_in_progress = 1;
1439 lck_mtx_unlock(unp_disconnect_lock);
1440
1441 if (so_locked == 0) {
1442 socket_lock(so, 0);
1443 so_locked = 1;
1444 }
1445
1446 unp2 = unp->unp_conn;
1447
1448 if (unp2 == 0 || unp2->unp_socket == NULL) {
1449 goto out;
1450 }
1451 so2 = unp2->unp_socket;
1452
1453try_again:
1454 if (so == so2) {
1455 if (so_locked == 0) {
1456 socket_lock(so, 0);
1457 }
1458 waitso = so;
1459 } else if (so < so2) {
1460 if (so_locked == 0) {
1461 socket_lock(so, 0);
1462 }
1463 socket_lock(so2, 1);
1464 waitso = so2;
1465 } else {
1466 if (so_locked == 1) {
1467 socket_unlock(so, 0);
1468 }
1469 socket_lock(so2, 1);
1470 socket_lock(so, 0);
1471 waitso = so;
1472 }
1473 so_locked = 1;
1474
1475 LCK_MTX_ASSERT(&unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1476 LCK_MTX_ASSERT(&unp2->unp_mtx, LCK_MTX_ASSERT_OWNED);
1477
1478 /* Check for the UNP_DONTDISCONNECT flag, if it
1479 * is set, release both sockets and go to sleep
1480 */
1481
1482 if ((((struct unpcb *)waitso->so_pcb)->unp_flags & UNP_DONTDISCONNECT) != 0) {
1483 if (so != so2) {
1484 socket_unlock(so2, 1);
1485 }
1486 so_locked = 0;
1487
1488 (void)msleep(waitso->so_pcb, &unp->unp_mtx,
1489 PSOCK | PDROP, "unpdisconnect", NULL);
1490 goto try_again;
1491 }
1492
1493 if (unp->unp_conn == NULL) {
1494 panic("unp_conn became NULL after sleep");
1495 }
1496
1497 unp->unp_conn = NULL;
1498 VERIFY(so2->so_usecount > 0);
1499 so2->so_usecount--;
1500
1501 if (unp->unp_flags & UNP_TRACE_MDNS)
1502 unp->unp_flags &= ~UNP_TRACE_MDNS;
1503
1504 switch (unp->unp_socket->so_type) {
1505
1506 case SOCK_DGRAM:
1507 LIST_REMOVE(unp, unp_reflink);
1508 unp->unp_socket->so_state &= ~SS_ISCONNECTED;
1509 if (so != so2)
1510 socket_unlock(so2, 1);
1511 break;
1512
1513 case SOCK_STREAM:
1514 unp2->unp_conn = NULL;
1515 VERIFY(so->so_usecount > 0);
1516 so->so_usecount--;
1517
1518 /* Set the socket state correctly but do a wakeup later when
1519 * we release all locks except the socket lock, this will avoid
1520 * a deadlock.
1521 */
1522 unp->unp_socket->so_state &= ~(SS_ISCONNECTING|SS_ISCONNECTED|SS_ISDISCONNECTING);
1523 unp->unp_socket->so_state |= (SS_CANTRCVMORE|SS_CANTSENDMORE|SS_ISDISCONNECTED);
1524
1525 unp2->unp_socket->so_state &= ~(SS_ISCONNECTING|SS_ISCONNECTED|SS_ISDISCONNECTING);
1526 unp->unp_socket->so_state |= (SS_CANTRCVMORE|SS_CANTSENDMORE|SS_ISDISCONNECTED);
1527
1528 if (unp2->unp_flags & UNP_TRACE_MDNS)
1529 unp2->unp_flags &= ~UNP_TRACE_MDNS;
1530
1531 strdisconn = 1;
1532 break;
1533 default:
1534 panic("unknown socket type %d", so->so_type);
1535 }
1536out:
1537 lck_mtx_lock(unp_disconnect_lock);
1538 disconnect_in_progress = 0;
1539 wakeup(&disconnect_in_progress);
1540 lck_mtx_unlock(unp_disconnect_lock);
1541
1542 if (strdisconn) {
1543 socket_unlock(so, 0);
1544 soisdisconnected(so2);
1545 socket_unlock(so2, 1);
1546
1547 socket_lock(so,0);
1548 soisdisconnected(so);
1549 }
1550 LCK_MTX_ASSERT(&unp->unp_mtx, LCK_MTX_ASSERT_OWNED);
1551 return;
1552}
1553
1554/*
1555 * unpcb_to_compat copies specific bits of a unpcb to a unpcb_compat format.
1556 * The unpcb_compat data structure is passed to user space and must not change.
1557 */
1558static void
1559unpcb_to_compat(struct unpcb *up, struct unpcb_compat *cp)
1560{
1561#if defined(__LP64__)
1562 cp->unp_link.le_next = (u_int32_t)
1563 VM_KERNEL_ADDRPERM(up->unp_link.le_next);
1564 cp->unp_link.le_prev = (u_int32_t)
1565 VM_KERNEL_ADDRPERM(up->unp_link.le_prev);
1566#else
1567 cp->unp_link.le_next = (struct unpcb_compat *)
1568 VM_KERNEL_ADDRPERM(up->unp_link.le_next);
1569 cp->unp_link.le_prev = (struct unpcb_compat **)
1570 VM_KERNEL_ADDRPERM(up->unp_link.le_prev);
1571#endif
1572 cp->unp_socket = (_UNPCB_PTR(struct socket *))
1573 VM_KERNEL_ADDRPERM(up->unp_socket);
1574 cp->unp_vnode = (_UNPCB_PTR(struct vnode *))
1575 VM_KERNEL_ADDRPERM(up->unp_vnode);
1576 cp->unp_ino = up->unp_ino;
1577 cp->unp_conn = (_UNPCB_PTR(struct unpcb_compat *))
1578 VM_KERNEL_ADDRPERM(up->unp_conn);
1579 cp->unp_refs = (u_int32_t)VM_KERNEL_ADDRPERM(up->unp_refs.lh_first);
1580#if defined(__LP64__)
1581 cp->unp_reflink.le_next =
1582 (u_int32_t)VM_KERNEL_ADDRPERM(up->unp_reflink.le_next);
1583 cp->unp_reflink.le_prev =
1584 (u_int32_t)VM_KERNEL_ADDRPERM(up->unp_reflink.le_prev);
1585#else
1586 cp->unp_reflink.le_next =
1587 (struct unpcb_compat *)VM_KERNEL_ADDRPERM(up->unp_reflink.le_next);
1588 cp->unp_reflink.le_prev =
1589 (struct unpcb_compat **)VM_KERNEL_ADDRPERM(up->unp_reflink.le_prev);
1590#endif
1591 cp->unp_addr = (_UNPCB_PTR(struct sockaddr_un *))
1592 VM_KERNEL_ADDRPERM(up->unp_addr);
1593 cp->unp_cc = up->unp_cc;
1594 cp->unp_mbcnt = up->unp_mbcnt;
1595 cp->unp_gencnt = up->unp_gencnt;
1596}
1597
1598static int
1599unp_pcblist SYSCTL_HANDLER_ARGS
1600{
1601#pragma unused(oidp,arg2)
1602 int error, i, n;
1603 struct unpcb *unp, **unp_list;
1604 unp_gen_t gencnt;
1605 struct xunpgen xug;
1606 struct unp_head *head;
1607
1608 lck_rw_lock_shared(unp_list_mtx);
1609 head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead);
1610
1611 /*
1612 * The process of preparing the PCB list is too time-consuming and
1613 * resource-intensive to repeat twice on every request.
1614 */
1615 if (req->oldptr == USER_ADDR_NULL) {
1616 n = unp_count;
1617 req->oldidx = 2 * sizeof (xug) + (n + n / 8) *
1618 sizeof (struct xunpcb);
1619 lck_rw_done(unp_list_mtx);
1620 return (0);
1621 }
1622
1623 if (req->newptr != USER_ADDR_NULL) {
1624 lck_rw_done(unp_list_mtx);
1625 return (EPERM);
1626 }
1627
1628 /*
1629 * OK, now we're committed to doing something.
1630 */
1631 gencnt = unp_gencnt;
1632 n = unp_count;
1633
1634 bzero(&xug, sizeof (xug));
1635 xug.xug_len = sizeof (xug);
1636 xug.xug_count = n;
1637 xug.xug_gen = gencnt;
1638 xug.xug_sogen = so_gencnt;
1639 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1640 if (error) {
1641 lck_rw_done(unp_list_mtx);
1642 return (error);
1643 }
1644
1645 /*
1646 * We are done if there is no pcb
1647 */
1648 if (n == 0) {
1649 lck_rw_done(unp_list_mtx);
1650 return (0);
1651 }
1652
1653 MALLOC(unp_list, struct unpcb **, n * sizeof (*unp_list),
1654 M_TEMP, M_WAITOK);
1655 if (unp_list == 0) {
1656 lck_rw_done(unp_list_mtx);
1657 return (ENOMEM);
1658 }
1659
1660 for (unp = head->lh_first, i = 0; unp && i < n;
1661 unp = unp->unp_link.le_next) {
1662 if (unp->unp_gencnt <= gencnt)
1663 unp_list[i++] = unp;
1664 }
1665 n = i; /* in case we lost some during malloc */
1666
1667 error = 0;
1668 for (i = 0; i < n; i++) {
1669 unp = unp_list[i];
1670 if (unp->unp_gencnt <= gencnt) {
1671 struct xunpcb xu;
1672
1673 bzero(&xu, sizeof (xu));
1674 xu.xu_len = sizeof (xu);
1675 xu.xu_unpp = (_UNPCB_PTR(struct unpcb_compat *))
1676 VM_KERNEL_ADDRPERM(unp);
1677 /*
1678 * XXX - need more locking here to protect against
1679 * connect/disconnect races for SMP.
1680 */
1681 if (unp->unp_addr)
1682 bcopy(unp->unp_addr, &xu.xu_addr,
1683 unp->unp_addr->sun_len);
1684 if (unp->unp_conn && unp->unp_conn->unp_addr)
1685 bcopy(unp->unp_conn->unp_addr,
1686 &xu.xu_caddr,
1687 unp->unp_conn->unp_addr->sun_len);
1688 unpcb_to_compat(unp, &xu.xu_unp);
1689 sotoxsocket(unp->unp_socket, &xu.xu_socket);
1690 error = SYSCTL_OUT(req, &xu, sizeof (xu));
1691 }
1692 }
1693 if (!error) {
1694 /*
1695 * Give the user an updated idea of our state.
1696 * If the generation differs from what we told
1697 * her before, she knows that something happened
1698 * while we were processing this request, and it
1699 * might be necessary to retry.
1700 */
1701 bzero(&xug, sizeof (xug));
1702 xug.xug_len = sizeof (xug);
1703 xug.xug_gen = unp_gencnt;
1704 xug.xug_sogen = so_gencnt;
1705 xug.xug_count = unp_count;
1706 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1707 }
1708 FREE(unp_list, M_TEMP);
1709 lck_rw_done(unp_list_mtx);
1710 return (error);
1711}
1712
1713SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist,
1714 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
1715 (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
1716 "List of active local datagram sockets");
1717SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist,
1718 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
1719 (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
1720 "List of active local stream sockets");
1721
1722#if !CONFIG_EMBEDDED
1723
1724static int
1725unp_pcblist64 SYSCTL_HANDLER_ARGS
1726{
1727#pragma unused(oidp,arg2)
1728 int error, i, n;
1729 struct unpcb *unp, **unp_list;
1730 unp_gen_t gencnt;
1731 struct xunpgen xug;
1732 struct unp_head *head;
1733
1734 lck_rw_lock_shared(unp_list_mtx);
1735 head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead);
1736
1737 /*
1738 * The process of preparing the PCB list is too time-consuming and
1739 * resource-intensive to repeat twice on every request.
1740 */
1741 if (req->oldptr == USER_ADDR_NULL) {
1742 n = unp_count;
1743 req->oldidx = 2 * sizeof (xug) + (n + n / 8) *
1744 (sizeof (struct xunpcb64));
1745 lck_rw_done(unp_list_mtx);
1746 return (0);
1747 }
1748
1749 if (req->newptr != USER_ADDR_NULL) {
1750 lck_rw_done(unp_list_mtx);
1751 return (EPERM);
1752 }
1753
1754 /*
1755 * OK, now we're committed to doing something.
1756 */
1757 gencnt = unp_gencnt;
1758 n = unp_count;
1759
1760 bzero(&xug, sizeof (xug));
1761 xug.xug_len = sizeof (xug);
1762 xug.xug_count = n;
1763 xug.xug_gen = gencnt;
1764 xug.xug_sogen = so_gencnt;
1765 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1766 if (error) {
1767 lck_rw_done(unp_list_mtx);
1768 return (error);
1769 }
1770
1771 /*
1772 * We are done if there is no pcb
1773 */
1774 if (n == 0) {
1775 lck_rw_done(unp_list_mtx);
1776 return (0);
1777 }
1778
1779 MALLOC(unp_list, struct unpcb **, n * sizeof (*unp_list),
1780 M_TEMP, M_WAITOK);
1781 if (unp_list == 0) {
1782 lck_rw_done(unp_list_mtx);
1783 return (ENOMEM);
1784 }
1785
1786 for (unp = head->lh_first, i = 0; unp && i < n;
1787 unp = unp->unp_link.le_next) {
1788 if (unp->unp_gencnt <= gencnt)
1789 unp_list[i++] = unp;
1790 }
1791 n = i; /* in case we lost some during malloc */
1792
1793 error = 0;
1794 for (i = 0; i < n; i++) {
1795 unp = unp_list[i];
1796 if (unp->unp_gencnt <= gencnt) {
1797 struct xunpcb64 xu;
1798 size_t xu_len = sizeof(struct xunpcb64);
1799
1800 bzero(&xu, xu_len);
1801 xu.xu_len = xu_len;
1802 xu.xu_unpp = (u_int64_t)VM_KERNEL_ADDRPERM(unp);
1803 xu.xunp_link.le_next = (u_int64_t)
1804 VM_KERNEL_ADDRPERM(unp->unp_link.le_next);
1805 xu.xunp_link.le_prev = (u_int64_t)
1806 VM_KERNEL_ADDRPERM(unp->unp_link.le_prev);
1807 xu.xunp_socket = (u_int64_t)
1808 VM_KERNEL_ADDRPERM(unp->unp_socket);
1809 xu.xunp_vnode = (u_int64_t)
1810 VM_KERNEL_ADDRPERM(unp->unp_vnode);
1811 xu.xunp_ino = unp->unp_ino;
1812 xu.xunp_conn = (u_int64_t)
1813 VM_KERNEL_ADDRPERM(unp->unp_conn);
1814 xu.xunp_refs = (u_int64_t)
1815 VM_KERNEL_ADDRPERM(unp->unp_refs.lh_first);
1816 xu.xunp_reflink.le_next = (u_int64_t)
1817 VM_KERNEL_ADDRPERM(unp->unp_reflink.le_next);
1818 xu.xunp_reflink.le_prev = (u_int64_t)
1819 VM_KERNEL_ADDRPERM(unp->unp_reflink.le_prev);
1820 xu.xunp_cc = unp->unp_cc;
1821 xu.xunp_mbcnt = unp->unp_mbcnt;
1822 xu.xunp_gencnt = unp->unp_gencnt;
1823
1824 if (unp->unp_socket)
1825 sotoxsocket64(unp->unp_socket, &xu.xu_socket);
1826
1827 /*
1828 * XXX - need more locking here to protect against
1829 * connect/disconnect races for SMP.
1830 */
1831 if (unp->unp_addr)
1832 bcopy(unp->unp_addr, &xu.xunp_addr,
1833 unp->unp_addr->sun_len);
1834 if (unp->unp_conn && unp->unp_conn->unp_addr)
1835 bcopy(unp->unp_conn->unp_addr,
1836 &xu.xunp_caddr,
1837 unp->unp_conn->unp_addr->sun_len);
1838
1839 error = SYSCTL_OUT(req, &xu, xu_len);
1840 }
1841 }
1842 if (!error) {
1843 /*
1844 * Give the user an updated idea of our state.
1845 * If the generation differs from what we told
1846 * her before, she knows that something happened
1847 * while we were processing this request, and it
1848 * might be necessary to retry.
1849 */
1850 bzero(&xug, sizeof (xug));
1851 xug.xug_len = sizeof (xug);
1852 xug.xug_gen = unp_gencnt;
1853 xug.xug_sogen = so_gencnt;
1854 xug.xug_count = unp_count;
1855 error = SYSCTL_OUT(req, &xug, sizeof (xug));
1856 }
1857 FREE(unp_list, M_TEMP);
1858 lck_rw_done(unp_list_mtx);
1859 return (error);
1860}
1861
1862SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist64,
1863 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
1864 (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist64, "S,xunpcb64",
1865 "List of active local datagram sockets 64 bit");
1866SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist64,
1867 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
1868 (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist64, "S,xunpcb64",
1869 "List of active local stream sockets 64 bit");
1870
1871#endif /* !CONFIG_EMBEDDED */
1872
1873static void
1874unp_shutdown(struct unpcb *unp)
1875{
1876 struct socket *so = unp->unp_socket;
1877 struct socket *so2;
1878 if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn) {
1879 so2 = unp->unp_conn->unp_socket;
1880 unp_get_locks_in_order(so, so2);
1881 socantrcvmore(so2);
1882 socket_unlock(so2, 1);
1883 }
1884}
1885
1886static void
1887unp_drop(struct unpcb *unp, int errno)
1888{
1889 struct socket *so = unp->unp_socket;
1890
1891 so->so_error = errno;
1892 unp_disconnect(unp);
1893}
1894
1895/*
1896 * Returns: 0 Success
1897 * EMSGSIZE The new fd's will not fit
1898 * ENOBUFS Cannot alloc struct fileproc
1899 */
1900int
1901unp_externalize(struct mbuf *rights)
1902{
1903 proc_t p = current_proc(); /* XXX */
1904 int i;
1905 struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
1906 struct fileglob **rp = (struct fileglob **)(cm + 1);
1907 int *fds = (int *)(cm + 1);
1908 struct fileproc *fp;
1909 struct fileproc **fileproc_l;
1910 int newfds = (cm->cmsg_len - sizeof (*cm)) / sizeof (int);
1911 int f, error = 0;
1912
1913 MALLOC(fileproc_l, struct fileproc **,
1914 newfds * sizeof (struct fileproc *), M_TEMP, M_WAITOK);
1915 if (fileproc_l == NULL) {
1916 error = ENOMEM;
1917 goto discard;
1918 }
1919
1920 proc_fdlock(p);
1921
1922 /*
1923 * if the new FD's will not fit, then we free them all
1924 */
1925 if (!fdavail(p, newfds)) {
1926 proc_fdunlock(p);
1927 error = EMSGSIZE;
1928 goto discard;
1929 }
1930 /*
1931 * now change each pointer to an fd in the global table to
1932 * an integer that is the index to the local fd table entry
1933 * that we set up to point to the global one we are transferring.
1934 * XXX (1) this assumes a pointer and int are the same size,
1935 * XXX or the mbuf can hold the expansion
1936 * XXX (2) allocation failures should be non-fatal
1937 */
1938 for (i = 0; i < newfds; i++) {
1939#if CONFIG_MACF_SOCKET
1940 /*
1941 * If receive access is denied, don't pass along
1942 * and error message, just discard the descriptor.
1943 */
1944 if (mac_file_check_receive(kauth_cred_get(), rp[i])) {
1945 proc_fdunlock(p);
1946 unp_discard(rp[i], p);
1947 fds[i] = 0;
1948 proc_fdlock(p);
1949 continue;
1950 }
1951#endif
1952 if (fdalloc(p, 0, &f))
1953 panic("unp_externalize:fdalloc");
1954 fp = fileproc_alloc_init(NULL);
1955 if (fp == NULL)
1956 panic("unp_externalize: MALLOC_ZONE");
1957 fp->f_iocount = 0;
1958 fp->f_fglob = rp[i];
1959 if (fg_removeuipc_mark(rp[i])) {
1960
1961 /*
1962 * Take an iocount on the fp for completing the
1963 * removal from the global msg queue
1964 */
1965 fp->f_iocount++;
1966 fileproc_l[i] = fp;
1967 } else {
1968 fileproc_l[i] = NULL;
1969 }
1970 procfdtbl_releasefd(p, f, fp);
1971 fds[i] = f;
1972 }
1973 proc_fdunlock(p);
1974
1975 for (i = 0; i < newfds; i++) {
1976 if (fileproc_l[i] != NULL) {
1977 VERIFY(fileproc_l[i]->f_fglob != NULL &&
1978 (fileproc_l[i]->f_fglob->fg_lflags & FG_RMMSGQ));
1979 VERIFY(fds[i] >= 0);
1980 fg_removeuipc(fileproc_l[i]->f_fglob);
1981
1982 /* Drop the iocount */
1983 fp_drop(p, fds[i], fileproc_l[i], 0);
1984 fileproc_l[i] = NULL;
1985 }
1986 if (fds[i] != 0)
1987 (void) OSAddAtomic(-1, &unp_rights);
1988 }
1989
1990discard:
1991 if (fileproc_l != NULL)
1992 FREE(fileproc_l, M_TEMP);
1993 if (error) {
1994 for (i = 0; i < newfds; i++) {
1995 unp_discard(*rp, p);
1996 *rp++ = NULL;
1997 }
1998 }
1999 return (error);
2000}
2001
2002void
2003unp_init(void)
2004{
2005 _CASSERT(UIPC_MAX_CMSG_FD >= (MCLBYTES / sizeof(int)));
2006 unp_zone = zinit(sizeof (struct unpcb),
2007 (nmbclusters * sizeof (struct unpcb)), 4096, "unpzone");
2008
2009 if (unp_zone == 0)
2010 panic("unp_init");
2011 LIST_INIT(&unp_dhead);
2012 LIST_INIT(&unp_shead);
2013
2014 /*
2015 * allocate lock group attribute and group for udp pcb mutexes
2016 */
2017 unp_mtx_grp_attr = lck_grp_attr_alloc_init();
2018
2019 unp_mtx_grp = lck_grp_alloc_init("unp_list", unp_mtx_grp_attr);
2020
2021 unp_mtx_attr = lck_attr_alloc_init();
2022
2023 if ((unp_list_mtx = lck_rw_alloc_init(unp_mtx_grp,
2024 unp_mtx_attr)) == NULL)
2025 return; /* pretty much dead if this fails... */
2026
2027 if ((unp_disconnect_lock = lck_mtx_alloc_init(unp_mtx_grp,
2028 unp_mtx_attr)) == NULL)
2029 return;
2030
2031 if ((unp_connect_lock = lck_mtx_alloc_init(unp_mtx_grp,
2032 unp_mtx_attr)) == NULL)
2033 return;
2034}
2035
2036#ifndef MIN
2037#define MIN(a, b) (((a) < (b)) ? (a) : (b))
2038#endif
2039
2040/*
2041 * Returns: 0 Success
2042 * EINVAL
2043 * fdgetf_noref:EBADF
2044 */
2045static int
2046unp_internalize(struct mbuf *control, proc_t p)
2047{
2048 struct cmsghdr *cm = mtod(control, struct cmsghdr *);
2049 int *fds;
2050 struct fileglob **rp;
2051 struct fileproc *fp;
2052 int i, error;
2053 int oldfds;
2054 uint8_t fg_ins[UIPC_MAX_CMSG_FD / 8];
2055
2056 /* 64bit: cmsg_len is 'uint32_t', m_len is 'long' */
2057 if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET ||
2058 (socklen_t)cm->cmsg_len != (socklen_t)control->m_len) {
2059 return (EINVAL);
2060 }
2061 oldfds = (cm->cmsg_len - sizeof (*cm)) / sizeof (int);
2062 bzero(fg_ins, sizeof(fg_ins));
2063
2064 proc_fdlock(p);
2065 fds = (int *)(cm + 1);
2066
2067 for (i = 0; i < oldfds; i++) {
2068 struct fileproc *tmpfp;
2069 if (((error = fdgetf_noref(p, fds[i], &tmpfp)) != 0)) {
2070 proc_fdunlock(p);
2071 return (error);
2072 } else if (!file_issendable(p, tmpfp)) {
2073 proc_fdunlock(p);
2074 return (EINVAL);
2075 } else if (FP_ISGUARDED(tmpfp, GUARD_SOCKET_IPC)) {
2076 error = fp_guard_exception(p,
2077 fds[i], tmpfp, kGUARD_EXC_SOCKET_IPC);
2078 proc_fdunlock(p);
2079 return (error);
2080 }
2081 }
2082 rp = (struct fileglob **)(cm + 1);
2083
2084 /* On K64 we need to walk backwards because a fileglob * is twice the size of an fd
2085 * and doing them in-order would result in stomping over unprocessed fd's
2086 */
2087 for (i = (oldfds - 1); i >= 0; i--) {
2088 (void) fdgetf_noref(p, fds[i], &fp);
2089 if (fg_insertuipc_mark(fp->f_fglob))
2090 fg_ins[i / 8] |= 0x80 >> (i % 8);
2091 rp[i] = fp->f_fglob;
2092 }
2093 proc_fdunlock(p);
2094
2095 for (i = 0; i < oldfds; i++) {
2096 if (fg_ins[i / 8] & (0x80 >> (i % 8))) {
2097 VERIFY(rp[i]->fg_lflags & FG_INSMSGQ);
2098 fg_insertuipc(rp[i]);
2099 }
2100 (void) OSAddAtomic(1, &unp_rights);
2101 }
2102
2103 return (0);
2104}
2105
2106static int unp_defer, unp_gcing, unp_gcwait;
2107static thread_t unp_gcthread = NULL;
2108
2109/* always called under uipc_lock */
2110void
2111unp_gc_wait(void)
2112{
2113 if (unp_gcthread == current_thread())
2114 return;
2115
2116 while (unp_gcing != 0) {
2117 unp_gcwait = 1;
2118 msleep(&unp_gcing, uipc_lock, 0 , "unp_gc_wait", NULL);
2119 }
2120}
2121
2122
2123__private_extern__ void
2124unp_gc(void)
2125{
2126 struct fileglob *fg, *nextfg;
2127 struct socket *so;
2128 static struct fileglob **extra_ref;
2129 struct fileglob **fpp;
2130 int nunref, i;
2131 int need_gcwakeup = 0;
2132
2133 lck_mtx_lock(uipc_lock);
2134 if (unp_gcing) {
2135 lck_mtx_unlock(uipc_lock);
2136 return;
2137 }
2138 unp_gcing = 1;
2139 unp_defer = 0;
2140 unp_gcthread = current_thread();
2141 lck_mtx_unlock(uipc_lock);
2142 /*
2143 * before going through all this, set all FDs to
2144 * be NOT defered and NOT externally accessible
2145 */
2146 for (fg = fmsghead.lh_first; fg != 0; fg = fg->f_msglist.le_next) {
2147 lck_mtx_lock(&fg->fg_lock);
2148 fg->fg_flag &= ~(FMARK|FDEFER);
2149 lck_mtx_unlock(&fg->fg_lock);
2150 }
2151 do {
2152 for (fg = fmsghead.lh_first; fg != 0;
2153 fg = fg->f_msglist.le_next) {
2154 lck_mtx_lock(&fg->fg_lock);
2155 /*
2156 * If the file is not open, skip it
2157 */
2158 if (fg->fg_count == 0) {
2159 lck_mtx_unlock(&fg->fg_lock);
2160 continue;
2161 }
2162 /*
2163 * If we already marked it as 'defer' in a
2164 * previous pass, then try process it this time
2165 * and un-mark it
2166 */
2167 if (fg->fg_flag & FDEFER) {
2168 fg->fg_flag &= ~FDEFER;
2169 unp_defer--;
2170 } else {
2171 /*
2172 * if it's not defered, then check if it's
2173 * already marked.. if so skip it
2174 */
2175 if (fg->fg_flag & FMARK) {
2176 lck_mtx_unlock(&fg->fg_lock);
2177 continue;
2178 }
2179 /*
2180 * If all references are from messages
2181 * in transit, then skip it. it's not
2182 * externally accessible.
2183 */
2184 if (fg->fg_count == fg->fg_msgcount) {
2185 lck_mtx_unlock(&fg->fg_lock);
2186 continue;
2187 }
2188 /*
2189 * If it got this far then it must be
2190 * externally accessible.
2191 */
2192 fg->fg_flag |= FMARK;
2193 }
2194 /*
2195 * either it was defered, or it is externally
2196 * accessible and not already marked so.
2197 * Now check if it is possibly one of OUR sockets.
2198 */
2199 if (FILEGLOB_DTYPE(fg) != DTYPE_SOCKET ||
2200 (so = (struct socket *)fg->fg_data) == 0) {
2201 lck_mtx_unlock(&fg->fg_lock);
2202 continue;
2203 }
2204 if (so->so_proto->pr_domain != localdomain ||
2205 (so->so_proto->pr_flags&PR_RIGHTS) == 0) {
2206 lck_mtx_unlock(&fg->fg_lock);
2207 continue;
2208 }
2209#ifdef notdef
2210 if (so->so_rcv.sb_flags & SB_LOCK) {
2211 /*
2212 * This is problematical; it's not clear
2213 * we need to wait for the sockbuf to be
2214 * unlocked (on a uniprocessor, at least),
2215 * and it's also not clear what to do
2216 * if sbwait returns an error due to receipt
2217 * of a signal. If sbwait does return
2218 * an error, we'll go into an infinite
2219 * loop. Delete all of this for now.
2220 */
2221 (void) sbwait(&so->so_rcv);
2222 goto restart;
2223 }
2224#endif
2225 /*
2226 * So, Ok, it's one of our sockets and it IS externally
2227 * accessible (or was defered). Now we look
2228 * to see if we hold any file descriptors in its
2229 * message buffers. Follow those links and mark them
2230 * as accessible too.
2231 *
2232 * In case a file is passed onto itself we need to
2233 * release the file lock.
2234 */
2235 lck_mtx_unlock(&fg->fg_lock);
2236
2237 unp_scan(so->so_rcv.sb_mb, unp_mark, 0);
2238 }
2239 } while (unp_defer);
2240 /*
2241 * We grab an extra reference to each of the file table entries
2242 * that are not otherwise accessible and then free the rights
2243 * that are stored in messages on them.
2244 *
2245 * The bug in the orginal code is a little tricky, so I'll describe
2246 * what's wrong with it here.
2247 *
2248 * It is incorrect to simply unp_discard each entry for f_msgcount
2249 * times -- consider the case of sockets A and B that contain
2250 * references to each other. On a last close of some other socket,
2251 * we trigger a gc since the number of outstanding rights (unp_rights)
2252 * is non-zero. If during the sweep phase the gc code un_discards,
2253 * we end up doing a (full) closef on the descriptor. A closef on A
2254 * results in the following chain. Closef calls soo_close, which
2255 * calls soclose. Soclose calls first (through the switch
2256 * uipc_usrreq) unp_detach, which re-invokes unp_gc. Unp_gc simply
2257 * returns because the previous instance had set unp_gcing, and
2258 * we return all the way back to soclose, which marks the socket
2259 * with SS_NOFDREF, and then calls sofree. Sofree calls sorflush
2260 * to free up the rights that are queued in messages on the socket A,
2261 * i.e., the reference on B. The sorflush calls via the dom_dispose
2262 * switch unp_dispose, which unp_scans with unp_discard. This second
2263 * instance of unp_discard just calls closef on B.
2264 *
2265 * Well, a similar chain occurs on B, resulting in a sorflush on B,
2266 * which results in another closef on A. Unfortunately, A is already
2267 * being closed, and the descriptor has already been marked with
2268 * SS_NOFDREF, and soclose panics at this point.
2269 *
2270 * Here, we first take an extra reference to each inaccessible
2271 * descriptor. Then, we call sorflush ourself, since we know
2272 * it is a Unix domain socket anyhow. After we destroy all the
2273 * rights carried in messages, we do a last closef to get rid
2274 * of our extra reference. This is the last close, and the
2275 * unp_detach etc will shut down the socket.
2276 *
2277 * 91/09/19, bsy@cs.cmu.edu
2278 */
2279 extra_ref = _MALLOC(nfiles * sizeof (struct fileglob *),
2280 M_FILEGLOB, M_WAITOK);
2281 if (extra_ref == NULL)
2282 goto bail;
2283 for (nunref = 0, fg = fmsghead.lh_first, fpp = extra_ref; fg != 0;
2284 fg = nextfg) {
2285 lck_mtx_lock(&fg->fg_lock);
2286
2287 nextfg = fg->f_msglist.le_next;
2288 /*
2289 * If it's not open, skip it
2290 */
2291 if (fg->fg_count == 0) {
2292 lck_mtx_unlock(&fg->fg_lock);
2293 continue;
2294 }
2295 /*
2296 * If all refs are from msgs, and it's not marked accessible
2297 * then it must be referenced from some unreachable cycle
2298 * of (shut-down) FDs, so include it in our
2299 * list of FDs to remove
2300 */
2301 if (fg->fg_count == fg->fg_msgcount && !(fg->fg_flag & FMARK)) {
2302 fg->fg_count++;
2303 *fpp++ = fg;
2304 nunref++;
2305 }
2306 lck_mtx_unlock(&fg->fg_lock);
2307 }
2308 /*
2309 * for each FD on our hit list, do the following two things
2310 */
2311 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) {
2312 struct fileglob *tfg;
2313
2314 tfg = *fpp;
2315
2316 if (FILEGLOB_DTYPE(tfg) == DTYPE_SOCKET &&
2317 tfg->fg_data != NULL) {
2318 so = (struct socket *)(tfg->fg_data);
2319
2320 socket_lock(so, 0);
2321
2322 sorflush(so);
2323
2324 socket_unlock(so, 0);
2325 }
2326 }
2327 for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp)
2328 closef_locked((struct fileproc *)0, *fpp, (proc_t)NULL);
2329
2330 FREE((caddr_t)extra_ref, M_FILEGLOB);
2331bail:
2332 lck_mtx_lock(uipc_lock);
2333 unp_gcing = 0;
2334 unp_gcthread = NULL;
2335
2336 if (unp_gcwait != 0) {
2337 unp_gcwait = 0;
2338 need_gcwakeup = 1;
2339 }
2340 lck_mtx_unlock(uipc_lock);
2341
2342 if (need_gcwakeup != 0)
2343 wakeup(&unp_gcing);
2344}
2345
2346void
2347unp_dispose(struct mbuf *m)
2348{
2349 if (m) {
2350 unp_scan(m, unp_discard, NULL);
2351 }
2352}
2353
2354/*
2355 * Returns: 0 Success
2356 */
2357static int
2358unp_listen(struct unpcb *unp, proc_t p)
2359{
2360 kauth_cred_t safecred = kauth_cred_proc_ref(p);
2361 cru2x(safecred, &unp->unp_peercred);
2362 kauth_cred_unref(&safecred);
2363 unp->unp_flags |= UNP_HAVEPCCACHED;
2364 return (0);
2365}
2366
2367static void
2368unp_scan(struct mbuf *m0, void (*op)(struct fileglob *, void *arg), void *arg)
2369{
2370 struct mbuf *m;
2371 struct fileglob **rp;
2372 struct cmsghdr *cm;
2373 int i;
2374 int qfds;
2375
2376 while (m0) {
2377 for (m = m0; m; m = m->m_next)
2378 if (m->m_type == MT_CONTROL &&
2379 (size_t)m->m_len >= sizeof (*cm)) {
2380 cm = mtod(m, struct cmsghdr *);
2381 if (cm->cmsg_level != SOL_SOCKET ||
2382 cm->cmsg_type != SCM_RIGHTS)
2383 continue;
2384 qfds = (cm->cmsg_len - sizeof (*cm)) /
2385 sizeof (int);
2386 rp = (struct fileglob **)(cm + 1);
2387 for (i = 0; i < qfds; i++)
2388 (*op)(*rp++, arg);
2389 break; /* XXX, but saves time */
2390 }
2391 m0 = m0->m_act;
2392 }
2393}
2394
2395static void
2396unp_mark(struct fileglob *fg, __unused void *arg)
2397{
2398 lck_mtx_lock(&fg->fg_lock);
2399
2400 if (fg->fg_flag & FMARK) {
2401 lck_mtx_unlock(&fg->fg_lock);
2402 return;
2403 }
2404 fg->fg_flag |= (FMARK|FDEFER);
2405
2406 lck_mtx_unlock(&fg->fg_lock);
2407
2408 unp_defer++;
2409}
2410
2411static void
2412unp_discard(struct fileglob *fg, void *p)
2413{
2414 if (p == NULL)
2415 p = current_proc(); /* XXX */
2416
2417 (void) OSAddAtomic(1, &unp_disposed);
2418 if (fg_removeuipc_mark(fg)) {
2419 VERIFY(fg->fg_lflags & FG_RMMSGQ);
2420 fg_removeuipc(fg);
2421 }
2422 (void) OSAddAtomic(-1, &unp_rights);
2423
2424 proc_fdlock(p);
2425 (void) closef_locked((struct fileproc *)0, fg, p);
2426 proc_fdunlock(p);
2427}
2428
2429int
2430unp_lock(struct socket *so, int refcount, void * lr)
2431 {
2432 void * lr_saved;
2433 if (lr == 0)
2434 lr_saved = (void *) __builtin_return_address(0);
2435 else lr_saved = lr;
2436
2437 if (so->so_pcb) {
2438 lck_mtx_lock(&((struct unpcb *)so->so_pcb)->unp_mtx);
2439 } else {
2440 panic("unp_lock: so=%p NO PCB! lr=%p ref=0x%x\n",
2441 so, lr_saved, so->so_usecount);
2442 }
2443
2444 if (so->so_usecount < 0)
2445 panic("unp_lock: so=%p so_pcb=%p lr=%p ref=0x%x\n",
2446 so, so->so_pcb, lr_saved, so->so_usecount);
2447
2448 if (refcount) {
2449 VERIFY(so->so_usecount > 0);
2450 so->so_usecount++;
2451 }
2452 so->lock_lr[so->next_lock_lr] = lr_saved;
2453 so->next_lock_lr = (so->next_lock_lr+1) % SO_LCKDBG_MAX;
2454 return (0);
2455}
2456
2457int
2458unp_unlock(struct socket *so, int refcount, void * lr)
2459{
2460 void * lr_saved;
2461 lck_mtx_t * mutex_held = NULL;
2462 struct unpcb *unp = sotounpcb(so);
2463
2464 if (lr == 0)
2465 lr_saved = (void *) __builtin_return_address(0);
2466 else lr_saved = lr;
2467
2468 if (refcount)
2469 so->so_usecount--;
2470
2471 if (so->so_usecount < 0)
2472 panic("unp_unlock: so=%p usecount=%x\n", so, so->so_usecount);
2473 if (so->so_pcb == NULL) {
2474 panic("unp_unlock: so=%p NO PCB usecount=%x\n", so, so->so_usecount);
2475 } else {
2476 mutex_held = &((struct unpcb *)so->so_pcb)->unp_mtx;
2477 }
2478 LCK_MTX_ASSERT(mutex_held, LCK_MTX_ASSERT_OWNED);
2479 so->unlock_lr[so->next_unlock_lr] = lr_saved;
2480 so->next_unlock_lr = (so->next_unlock_lr+1) % SO_LCKDBG_MAX;
2481
2482 if (so->so_usecount == 0 && (so->so_flags & SOF_PCBCLEARING)) {
2483 sofreelastref(so, 1);
2484
2485 if (unp->unp_addr)
2486 FREE(unp->unp_addr, M_SONAME);
2487
2488 lck_mtx_unlock(mutex_held);
2489
2490 lck_mtx_destroy(&unp->unp_mtx, unp_mtx_grp);
2491 zfree(unp_zone, unp);
2492
2493 unp_gc();
2494 } else {
2495 lck_mtx_unlock(mutex_held);
2496 }
2497
2498 return (0);
2499}
2500
2501lck_mtx_t *
2502unp_getlock(struct socket *so, __unused int flags)
2503{
2504 struct unpcb *unp = (struct unpcb *)so->so_pcb;
2505
2506
2507 if (so->so_pcb) {
2508 if (so->so_usecount < 0)
2509 panic("unp_getlock: so=%p usecount=%x\n", so, so->so_usecount);
2510 return(&unp->unp_mtx);
2511 } else {
2512 panic("unp_getlock: so=%p NULL so_pcb\n", so);
2513 return (so->so_proto->pr_domain->dom_mtx);
2514 }
2515}
2516