1 /*-
2 * Copyright (c) 2005 Robert N. M. Watson
3 * Copyright (c) 2015 Mark Johnston
4 * Copyright (c) 2022 Gleb Smirnoff <glebius@FreeBSD.org>
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/param.h>
30 #include <sys/jail.h>
31 #include <sys/socket.h>
32 #include <sys/stat.h>
33 #include <sys/sysctl.h>
34 #include <sys/time.h>
35 #include <sys/resource.h>
36 #include <sys/un.h>
37 #include <sys/wait.h>
38
39 #include <err.h>
40 #include <errno.h>
41 #include <fcntl.h>
42 #include <jail.h>
43 #include <limits.h>
44 #include <stdio.h>
45 #include <stdlib.h>
46 #include <string.h>
47 #include <unistd.h>
48
49 #include <atf-c.h>
50
51 #if !defined(TEST_PROTO)
52 #error Need TEST_PROTO defined to SOCK_STREAM or SOCK_DGRAM
53 #endif
54
55 /*
56 * UNIX domain sockets allow file descriptors to be passed via "ancillary
57 * data", or control messages. This regression test is intended to exercise
58 * this facility, both performing some basic tests that it operates, and also
59 * causing some kernel edge cases to execute, such as garbage collection when
60 * there are cyclic file descriptor references. Right now we test only with
61 * stream sockets, but ideally we'd also test with datagram sockets.
62 */
63
64 static void
domainsocketpair(int * fdp)65 domainsocketpair(int *fdp)
66 {
67
68 ATF_REQUIRE_MSG(socketpair(PF_UNIX, TEST_PROTO, 0, fdp) != -1,
69 "socketpair(PF_UNIX, %u) failed: %s", TEST_PROTO, strerror(errno));
70 }
71
72 static void
closesocketpair(int * fdp)73 closesocketpair(int *fdp)
74 {
75
76 close(fdp[0]);
77 close(fdp[1]);
78 }
79
80 static void
devnull(int * fdp)81 devnull(int *fdp)
82 {
83 int fd;
84
85 fd = open("/dev/null", O_RDONLY);
86 ATF_REQUIRE_MSG(fd != -1, "open failed: %s", strerror(errno));
87 *fdp = fd;
88 }
89
90 static void
tempfile(int * fdp)91 tempfile(int *fdp)
92 {
93 char path[PATH_MAX];
94 int fd;
95
96 snprintf(path, PATH_MAX, "%s/unix_passfd.XXXXXXXXXXXXXXX",
97 getenv("TMPDIR") == NULL ? "/tmp" : getenv("TMPDIR"));
98 fd = mkstemp(path);
99 ATF_REQUIRE_MSG(fd != -1, "mkstemp(%s) failed", path);
100 (void)unlink(path);
101 *fdp = fd;
102 }
103
104 static void
dofstat(int fd,struct stat * sb)105 dofstat(int fd, struct stat *sb)
106 {
107
108 ATF_REQUIRE_MSG(fstat(fd, sb) == 0,
109 "fstat failed: %s", strerror(errno));
110 }
111
112 static int
getnfds(void)113 getnfds(void)
114 {
115 size_t len;
116 int mib[4], n, rc;
117
118 len = sizeof(n);
119 mib[0] = CTL_KERN;
120 mib[1] = KERN_PROC;
121 mib[2] = KERN_PROC_NFDS;
122 mib[3] = 0;
123
124 rc = sysctl(mib, 4, &n, &len, NULL, 0);
125 ATF_REQUIRE_MSG(rc != -1, "sysctl(KERN_PROC_NFDS) failed");
126 return (n);
127 }
128
129 static int
openfiles(void)130 openfiles(void)
131 {
132 int files;
133 size_t len = sizeof(files);
134
135 ATF_REQUIRE(sysctlbyname("kern.openfiles", &files, &len, NULL, 0) == 0);
136
137 return (files);
138 }
139
140 static void
putfds(char * buf,int fd,int nfds)141 putfds(char *buf, int fd, int nfds)
142 {
143 struct cmsghdr *cm;
144 int *fdp, i;
145
146 cm = (struct cmsghdr *)buf;
147 cm->cmsg_len = CMSG_LEN(nfds * sizeof(int));
148 cm->cmsg_level = SOL_SOCKET;
149 cm->cmsg_type = SCM_RIGHTS;
150 for (fdp = (int *)CMSG_DATA(cm), i = 0; i < nfds; i++)
151 *fdp++ = fd;
152 }
153
154 static void
samefile(struct stat * sb1,struct stat * sb2)155 samefile(struct stat *sb1, struct stat *sb2)
156 {
157
158 ATF_REQUIRE_MSG(sb1->st_dev == sb2->st_dev, "different device");
159 ATF_REQUIRE_MSG(sb1->st_ino == sb2->st_ino, "different inode");
160 }
161
162 static ssize_t
sendfd_payload(int sockfd,int send_fd,void * payload,size_t paylen)163 sendfd_payload(int sockfd, int send_fd, void *payload, size_t paylen)
164 {
165 struct iovec iovec;
166 char message[CMSG_SPACE(sizeof(int))];
167 struct msghdr msghdr;
168
169 bzero(&msghdr, sizeof(msghdr));
170 bzero(&message, sizeof(message));
171
172 msghdr.msg_control = message;
173 msghdr.msg_controllen = sizeof(message);
174
175 iovec.iov_base = payload;
176 iovec.iov_len = paylen;
177
178 msghdr.msg_iov = &iovec;
179 msghdr.msg_iovlen = 1;
180
181 putfds(message, send_fd, 1);
182 return (sendmsg(sockfd, &msghdr, 0));
183 }
184
185 static void
sendfd(int sockfd,int send_fd)186 sendfd(int sockfd, int send_fd)
187 {
188 ssize_t len;
189 char ch;
190
191 ch = 0;
192 len = sendfd_payload(sockfd, send_fd, &ch, sizeof(ch));
193 ATF_REQUIRE_MSG(len == sizeof(ch),
194 "sendmsg: %zd bytes sent; expected %zu; %s", len, sizeof(ch),
195 strerror(errno));
196 }
197
198 static bool
localcreds(int sockfd)199 localcreds(int sockfd)
200 {
201 socklen_t sz;
202 int rc, val;
203
204 sz = sizeof(val);
205 rc = getsockopt(sockfd, 0, LOCAL_CREDS, &val, &sz);
206 ATF_REQUIRE_MSG(rc != -1, "getsockopt(LOCAL_CREDS) failed: %s",
207 strerror(errno));
208 return (val != 0);
209 }
210
211 static ssize_t
recvfd_payload(int sockfd,int * recv_fd,void * buf,size_t buflen,size_t cmsgsz,int recvmsg_flags)212 recvfd_payload(int sockfd, int *recv_fd, void *buf, size_t buflen,
213 size_t cmsgsz, int recvmsg_flags)
214 {
215 struct cmsghdr *cmsghdr;
216 struct msghdr msghdr;
217 struct iovec iovec;
218 char *message;
219 ssize_t len;
220 bool foundcreds;
221
222 bzero(&msghdr, sizeof(msghdr));
223 message = malloc(cmsgsz);
224 ATF_REQUIRE(message != NULL);
225
226 msghdr.msg_control = message;
227 msghdr.msg_controllen = cmsgsz;
228
229 iovec.iov_base = buf;
230 iovec.iov_len = buflen;
231
232 msghdr.msg_iov = &iovec;
233 msghdr.msg_iovlen = 1;
234
235 len = recvmsg(sockfd, &msghdr, recvmsg_flags);
236 ATF_REQUIRE_MSG(len != -1, "recvmsg failed: %s", strerror(errno));
237
238 cmsghdr = CMSG_FIRSTHDR(&msghdr);
239 ATF_REQUIRE_MSG(cmsghdr != NULL,
240 "recvmsg: did not receive control message");
241 foundcreds = false;
242 *recv_fd = -1;
243 for (; cmsghdr != NULL; cmsghdr = CMSG_NXTHDR(&msghdr, cmsghdr)) {
244 if (cmsghdr->cmsg_level == SOL_SOCKET &&
245 cmsghdr->cmsg_type == SCM_RIGHTS &&
246 cmsghdr->cmsg_len == CMSG_LEN(sizeof(int))) {
247 memcpy(recv_fd, CMSG_DATA(cmsghdr), sizeof(int));
248 ATF_REQUIRE(*recv_fd != -1);
249 } else if (cmsghdr->cmsg_level == SOL_SOCKET &&
250 cmsghdr->cmsg_type == SCM_CREDS)
251 foundcreds = true;
252 }
253 ATF_REQUIRE_MSG(*recv_fd != -1,
254 "recvmsg: did not receive single-fd message");
255 ATF_REQUIRE_MSG(!localcreds(sockfd) || foundcreds,
256 "recvmsg: expected credentials were not received");
257 ATF_REQUIRE_MSG((msghdr.msg_flags & MSG_TRUNC) == 0,
258 "recvmsg: MSG_TRUNC is set while buffer is sufficient");
259
260 return (len);
261 }
262
263 static void
recvfd(int sockfd,int * recv_fd,int flags)264 recvfd(int sockfd, int *recv_fd, int flags)
265 {
266 ssize_t len;
267 char ch = 0;
268
269 len = recvfd_payload(sockfd, recv_fd, &ch, sizeof(ch),
270 CMSG_SPACE(sizeof(int)), flags);
271 ATF_REQUIRE_MSG((size_t)len == sizeof(ch),
272 "recvmsg: %zd bytes received; expected %zd", len, sizeof(ch));
273 }
274
275 #if TEST_PROTO == SOCK_STREAM
276 #define LOCAL_SENDSPACE_SYSCTL "net.local.stream.sendspace"
277 #define LOCAL_RECVSPACE_SYSCTL "net.local.stream.recvspace"
278 #elif TEST_PROTO == SOCK_DGRAM
279 #define LOCAL_SENDSPACE_SYSCTL "net.local.dgram.maxdgram"
280 #define LOCAL_RECVSPACE_SYSCTL "net.local.dgram.recvspace"
281 #endif
282
283 static u_long
getsendspace(void)284 getsendspace(void)
285 {
286 u_long sendspace;
287
288 ATF_REQUIRE_MSG(sysctlbyname(LOCAL_SENDSPACE_SYSCTL, &sendspace,
289 &(size_t){sizeof(u_long)}, NULL, 0) != -1,
290 "sysctl %s failed: %s", LOCAL_SENDSPACE_SYSCTL, strerror(errno));
291
292 return (sendspace);
293 }
294
295 static u_long
getrecvspace(void)296 getrecvspace(void)
297 {
298 u_long recvspace;
299
300 ATF_REQUIRE_MSG(sysctlbyname(LOCAL_RECVSPACE_SYSCTL, &recvspace,
301 &(size_t){sizeof(u_long)}, NULL, 0) != -1,
302 "sysctl %s failed: %s", LOCAL_RECVSPACE_SYSCTL, strerror(errno));
303
304 return (recvspace);
305 }
306
307 /*
308 * Fill socket to a state when next max sized send would fail with EAGAIN.
309 */
310 static void
fill(int fd)311 fill(int fd)
312 {
313 u_long sendspace;
314 void *buf;
315
316 sendspace = getsendspace();
317 ATF_REQUIRE((buf = malloc(sendspace)) != NULL);
318
319 ATF_REQUIRE_MSG(fcntl(fd, F_SETFL, O_NONBLOCK) != -1,
320 "fcntl(O_NONBLOCK) failed: %s", strerror(errno));
321
322 #if TEST_PROTO == SOCK_STREAM
323 do {} while (send(fd, buf, sendspace, 0) == (ssize_t)sendspace);
324 #elif TEST_PROTO == SOCK_DGRAM
325 u_long recvspace = getrecvspace();
326
327 for (ssize_t sent = 0;
328 sent + sendspace + sizeof(struct sockaddr) < recvspace;
329 sent += sendspace + sizeof(struct sockaddr))
330 ATF_REQUIRE(send(fd, buf, sendspace, 0) == (ssize_t)sendspace);
331 #endif
332 free(buf);
333 }
334
335 /*
336 * Put a temporary file into a UNIX domain socket, then take it out and make
337 * sure it's the same file. First time around, don't close the reference
338 * after sending.
339 */
340 ATF_TC_WITHOUT_HEAD(simple_send_fd);
ATF_TC_BODY(simple_send_fd,tc)341 ATF_TC_BODY(simple_send_fd, tc)
342 {
343 struct stat getfd_stat, putfd_stat;
344 int fd[2], getfd, putfd;
345
346 domainsocketpair(fd);
347 tempfile(&putfd);
348 dofstat(putfd, &putfd_stat);
349 sendfd(fd[0], putfd);
350 recvfd(fd[1], &getfd, 0);
351 dofstat(getfd, &getfd_stat);
352 samefile(&putfd_stat, &getfd_stat);
353 close(putfd);
354 close(getfd);
355 closesocketpair(fd);
356 }
357
358 /*
359 * Like simple_send_fd but also sets MSG_CMSG_CLOEXEC and checks that the
360 * received file descriptor has the FD_CLOEXEC flag set.
361 */
362 ATF_TC_WITHOUT_HEAD(simple_send_fd_msg_cmsg_cloexec);
ATF_TC_BODY(simple_send_fd_msg_cmsg_cloexec,tc)363 ATF_TC_BODY(simple_send_fd_msg_cmsg_cloexec, tc)
364 {
365 struct stat getfd_stat, putfd_stat;
366 int fd[2], getfd, putfd;
367
368 domainsocketpair(fd);
369 tempfile(&putfd);
370 dofstat(putfd, &putfd_stat);
371 sendfd(fd[0], putfd);
372 recvfd(fd[1], &getfd, MSG_CMSG_CLOEXEC);
373 dofstat(getfd, &getfd_stat);
374 samefile(&putfd_stat, &getfd_stat);
375 ATF_REQUIRE_EQ_MSG(fcntl(getfd, F_GETFD) & FD_CLOEXEC, FD_CLOEXEC,
376 "FD_CLOEXEC not set on the received file descriptor");
377 close(putfd);
378 close(getfd);
379 closesocketpair(fd);
380 }
381
382 /*
383 * Same as simple_send_fd, only close the file reference after sending, so that
384 * the only reference is the descriptor in the UNIX domain socket buffer.
385 */
386 ATF_TC_WITHOUT_HEAD(send_and_close);
ATF_TC_BODY(send_and_close,tc)387 ATF_TC_BODY(send_and_close, tc)
388 {
389 struct stat getfd_stat, putfd_stat;
390 int fd[2], getfd, putfd;
391
392 domainsocketpair(fd);
393 tempfile(&putfd);
394 dofstat(putfd, &putfd_stat);
395 sendfd(fd[0], putfd);
396 close(putfd);
397 recvfd(fd[1], &getfd, 0);
398 dofstat(getfd, &getfd_stat);
399 samefile(&putfd_stat, &getfd_stat);
400 close(getfd);
401 closesocketpair(fd);
402 }
403
404 /*
405 * Put a temporary file into a UNIX domain socket, then close both endpoints
406 * causing garbage collection to kick off.
407 */
408 ATF_TC_WITHOUT_HEAD(send_and_cancel);
ATF_TC_BODY(send_and_cancel,tc)409 ATF_TC_BODY(send_and_cancel, tc)
410 {
411 int fd[2], putfd;
412
413 domainsocketpair(fd);
414 tempfile(&putfd);
415 sendfd(fd[0], putfd);
416 close(putfd);
417 closesocketpair(fd);
418 }
419
420 /*
421 * Send file then shutdown receive side to exercise unp_dispose() call
422 * via soshutdown(). Check that shutdown(SHUT_RD) would gc the file
423 * reference sitting in the receive buffer. There is no good way of
424 * checking that except using global open file count.
425 */
426 ATF_TC_WITHOUT_HEAD(send_and_shutdown);
ATF_TC_BODY(send_and_shutdown,tc)427 ATF_TC_BODY(send_and_shutdown, tc)
428 {
429 int fd[2], putfd, nfiles;
430
431 domainsocketpair(fd);
432 tempfile(&putfd);
433 sendfd(fd[0], putfd);
434 nfiles = openfiles();
435 close(putfd);
436 ATF_REQUIRE(openfiles() == nfiles);
437 shutdown(fd[1], SHUT_RD);
438 ATF_REQUIRE(openfiles() == nfiles - 1);
439 closesocketpair(fd);
440 }
441
442 /*
443 * Send maximum possible SCM_RIGHTS message.
444 * Internally the file descriptors are converted from integers to pointers
445 * and stored in a single mbuf cluster. Check that we can not send too much
446 * and that we can successfully send maximum possible amount. Check that we
447 * can not exploit getrlimit(3).
448 */
449 #define MAXFDS ((MCLBYTES - _ALIGN(sizeof(struct cmsghdr)))/sizeof(void *))
450 ATF_TC_WITHOUT_HEAD(send_a_lot);
ATF_TC_BODY(send_a_lot,tc)451 ATF_TC_BODY(send_a_lot, tc)
452 {
453 struct msghdr msghdr;
454 struct iovec iov;
455 struct rlimit rlim;
456 int fd[2], nfds;
457 char *cmsg, ch;
458
459 domainsocketpair(fd);
460 cmsg = malloc(CMSG_SPACE((MAXFDS + 1) * sizeof(int)));
461 ATF_REQUIRE(cmsg != NULL);
462 iov.iov_base = &ch;
463 iov.iov_len = sizeof(ch);
464 msghdr = (struct msghdr ){
465 .msg_control = cmsg,
466 .msg_controllen = CMSG_LEN((MAXFDS + 1) * sizeof(int)),
467 .msg_iov = &iov,
468 .msg_iovlen = 1,
469 };
470
471 /* Sending too much fails. */
472 putfds(cmsg, fd[0], MAXFDS + 1);
473 ATF_REQUIRE(sendmsg(fd[0], &msghdr, 0) == -1);
474 ATF_REQUIRE(errno == EMSGSIZE);
475
476 /* Sending just the right amount works and everything is received. */
477 putfds(cmsg, fd[0], MAXFDS);
478 msghdr.msg_controllen = CMSG_LEN(MAXFDS * sizeof(int));
479 ATF_REQUIRE(sendmsg(fd[0], &msghdr, 0) == 1);
480 nfds = getnfds();
481 ATF_REQUIRE(recvmsg(fd[1], &msghdr, 0) == 1);
482 ATF_REQUIRE(getnfds() == (int)(nfds + MAXFDS));
483
484 /* Limit our process open files... */
485 ATF_REQUIRE(getrlimit(RLIMIT_NOFILE, &rlim) == 0);
486 nfds = rlim.rlim_cur = getnfds();
487 ATF_REQUIRE(setrlimit(RLIMIT_NOFILE, &rlim) == 0);
488
489 /* ... and try to receive a single descriptor. */
490 putfds(cmsg, fd[0], 1);
491 msghdr.msg_controllen = CMSG_LEN(sizeof(int));
492 ATF_REQUIRE(sendmsg(fd[0], &msghdr, 0) == 1);
493 ATF_REQUIRE(recvmsg(fd[1], &msghdr, 0) == -1);
494 /* Such attempt shall fail with EMFILE. */
495 ATF_REQUIRE(errno == EMFILE);
496 ATF_REQUIRE(getnfds() == nfds);
497 #if TEST_PROTO == SOCK_STREAM
498 /*
499 * For the SOCK_STREAM the above attempt shall free the control in
500 * the kernel, so that socket isn't left in a stuck state. Next read
501 * shall bring us the normal data only. The stream data shall not
502 * miss a byte.
503 */
504 ATF_REQUIRE(recvmsg(fd[1], &msghdr, 0) == 1);
505 ATF_REQUIRE(msghdr.msg_controllen == 0);
506 #elif TEST_PROTO == SOCK_DGRAM
507 /*
508 * For SOCK_DGRAM there are two options for the previously failed
509 * syscall: strip the control leaving datagram in the socket or
510 * drop the whole datagram. Our implementation drops the whole
511 * datagram.
512 */
513 ATF_REQUIRE(recvmsg(fd[1], &msghdr, MSG_DONTWAIT) == -1);
514 ATF_REQUIRE(errno == EAGAIN);
515 #endif
516 }
517
518 /*
519 * Exersize condition when SCM_RIGHTS is successfully internalized, but
520 * message delivery fails due to receive buffer overflow. Check that no
521 * file descriptors are leaked.
522 */
523 ATF_TC_WITHOUT_HEAD(send_overflow);
ATF_TC_BODY(send_overflow,tc)524 ATF_TC_BODY(send_overflow, tc)
525 {
526 void *buf;
527 ssize_t len;
528 int fd[2], putfd, nfiles;
529 int sendspace;
530
531 sendspace = (int)getsendspace();
532 ATF_REQUIRE((buf = malloc(sendspace)) != NULL);
533
534 domainsocketpair(fd);
535 fill(fd[0]);
536 nfiles = openfiles();
537 tempfile(&putfd);
538 len = sendfd_payload(fd[0], putfd, buf, sendspace);
539 #if TEST_PROTO == SOCK_STREAM
540 ATF_REQUIRE_MSG(len == -1 && errno == EAGAIN,
541 "sendmsg: %zd bytes sent, errno %d", len, errno);
542 #elif TEST_PROTO == SOCK_DGRAM
543 ATF_REQUIRE_MSG(len == -1 && errno == ENOBUFS,
544 "sendmsg: %zd bytes sent, errno %d", len, errno);
545 #endif
546 close(putfd);
547 ATF_REQUIRE(nfiles == openfiles());
548 closesocketpair(fd);
549 }
550
551 /*
552 * Make sure that we do not receive descriptors with MSG_PEEK.
553 */
554 ATF_TC_WITHOUT_HEAD(peek);
ATF_TC_BODY(peek,tc)555 ATF_TC_BODY(peek, tc)
556 {
557 int fd[2], getfd, putfd, nfds;
558
559 domainsocketpair(fd);
560 tempfile(&putfd);
561 nfds = getnfds();
562 sendfd(fd[0], putfd);
563 ATF_REQUIRE(getnfds() == nfds);
564
565 /* First make MSG_PEEK recvmsg(2)... */
566 char cbuf[CMSG_SPACE(sizeof(int))];
567 char buf[1];
568 struct iovec iov = {
569 .iov_base = buf,
570 .iov_len = sizeof(buf)
571 };
572 struct msghdr msghdr = {
573 .msg_iov = &iov,
574 .msg_iovlen = 1,
575 .msg_control = cbuf,
576 .msg_controllen = sizeof(cbuf),
577 };
578 ATF_REQUIRE(1 == recvmsg(fd[1], &msghdr, MSG_PEEK));
579 for (struct cmsghdr *cmsghdr = CMSG_FIRSTHDR(&msghdr);
580 cmsghdr != NULL; cmsghdr = CMSG_NXTHDR(&msghdr, cmsghdr)) {
581 /* Usually this is some garbage. */
582 printf("level %d type %d len %u\n",
583 cmsghdr->cmsg_level, cmsghdr->cmsg_type, cmsghdr->cmsg_len);
584 }
585
586 /* ... and make sure we did not receive any descriptors! */
587 ATF_REQUIRE(getnfds() == nfds);
588
589 /* Now really receive a descriptor. */
590 recvfd(fd[1], &getfd, 0);
591 ATF_REQUIRE(getnfds() == nfds + 1);
592 close(putfd);
593 close(getfd);
594 closesocketpair(fd);
595 }
596
597 /*
598 * Send two files. Then receive them. Make sure they are returned in the
599 * right order, and both get there.
600 */
601 ATF_TC_WITHOUT_HEAD(two_files);
ATF_TC_BODY(two_files,tc)602 ATF_TC_BODY(two_files, tc)
603 {
604 struct stat getfd_1_stat, getfd_2_stat, putfd_1_stat, putfd_2_stat;
605 int fd[2], getfd_1, getfd_2, putfd_1, putfd_2;
606
607 domainsocketpair(fd);
608 tempfile(&putfd_1);
609 tempfile(&putfd_2);
610 dofstat(putfd_1, &putfd_1_stat);
611 dofstat(putfd_2, &putfd_2_stat);
612 sendfd(fd[0], putfd_1);
613 sendfd(fd[0], putfd_2);
614 close(putfd_1);
615 close(putfd_2);
616 recvfd(fd[1], &getfd_1, 0);
617 recvfd(fd[1], &getfd_2, 0);
618 dofstat(getfd_1, &getfd_1_stat);
619 dofstat(getfd_2, &getfd_2_stat);
620 samefile(&putfd_1_stat, &getfd_1_stat);
621 samefile(&putfd_2_stat, &getfd_2_stat);
622 close(getfd_1);
623 close(getfd_2);
624 closesocketpair(fd);
625 }
626
627 /*
628 * Big bundling test. Send an endpoint of the UNIX domain socket over itself,
629 * closing the door behind it.
630 */
631 ATF_TC_WITHOUT_HEAD(bundle);
ATF_TC_BODY(bundle,tc)632 ATF_TC_BODY(bundle, tc)
633 {
634 int fd[2], getfd;
635
636 domainsocketpair(fd);
637
638 sendfd(fd[0], fd[0]);
639 close(fd[0]);
640 recvfd(fd[1], &getfd, 0);
641 close(getfd);
642 close(fd[1]);
643 }
644
645 /*
646 * Big bundling test part two: Send an endpoint of the UNIX domain socket over
647 * itself, close the door behind it, and never remove it from the other end.
648 */
649 ATF_TC_WITHOUT_HEAD(bundle_cancel);
ATF_TC_BODY(bundle_cancel,tc)650 ATF_TC_BODY(bundle_cancel, tc)
651 {
652 int fd[2];
653
654 domainsocketpair(fd);
655 sendfd(fd[0], fd[0]);
656 sendfd(fd[1], fd[0]);
657 closesocketpair(fd);
658 }
659
660 /*
661 * Test for PR 151758: Send an character device over the UNIX domain socket
662 * and then close both sockets to orphan the device.
663 */
664 ATF_TC_WITHOUT_HEAD(devfs_orphan);
ATF_TC_BODY(devfs_orphan,tc)665 ATF_TC_BODY(devfs_orphan, tc)
666 {
667 int fd[2], putfd;
668
669 domainsocketpair(fd);
670 devnull(&putfd);
671 sendfd(fd[0], putfd);
672 close(putfd);
673 closesocketpair(fd);
674 }
675
676 /*
677 * Test for PR 181741. Receiver sets LOCAL_CREDS, and kernel prepends a
678 * control message to the data. Sender sends large payload using a non-blocking
679 * socket. Payload + SCM_RIGHTS + LOCAL_CREDS hit socket buffer limit, and
680 * receiver receives truncated data.
681 */
682 ATF_TC_WITHOUT_HEAD(rights_creds_payload);
ATF_TC_BODY(rights_creds_payload,tc)683 ATF_TC_BODY(rights_creds_payload, tc)
684 {
685 const int on = 1;
686 u_long sendspace;
687 ssize_t len, rlen;
688 void *buf;
689 int fd[2], getfd, putfd, rc;
690
691 sendspace = getsendspace();
692 buf = calloc(1, sendspace);
693 ATF_REQUIRE(buf != NULL);
694
695 domainsocketpair(fd);
696 tempfile(&putfd);
697
698 rc = fcntl(fd[0], F_SETFL, O_NONBLOCK);
699 ATF_REQUIRE_MSG(rc != -1, "fcntl(O_NONBLOCK) failed: %s",
700 strerror(errno));
701 rc = setsockopt(fd[1], 0, LOCAL_CREDS, &on, sizeof(on));
702 ATF_REQUIRE_MSG(rc != -1, "setsockopt(LOCAL_CREDS) failed: %s",
703 strerror(errno));
704
705 len = sendfd_payload(fd[0], putfd, buf, sendspace);
706 ATF_REQUIRE_MSG(len != -1 , "sendmsg failed: %s", strerror(errno));
707 #if TEST_PROTO == SOCK_STREAM
708 ATF_REQUIRE_MSG((size_t)len < sendspace,
709 "sendmsg: %zd bytes sent, expected < %lu", len, sendspace);
710 #endif
711 #if TEST_PROTO == SOCK_DGRAM
712 /*
713 * sendmsg(2) can't truncate datagrams, only recvmsg(2) can. There are
714 * two options for the kernel here: either accept the datagram with
715 * slight overcommit of the socket buffer space or return ENOBUFS for a
716 * datagram that is smaller or equal to the socket buffer space. Our
717 * implementation does overcommit. Explanation is simple: from our
718 * side we see space available, we have no idea that remote side has
719 * LOCAL_CREDS set. From our side we expect sendmsg(2) to succeed.
720 */
721 ATF_REQUIRE_MSG((size_t)len == sendspace,
722 "sendmsg: %zd bytes sent, expected %lu", len, sendspace);
723 #endif
724 rlen = recvfd_payload(fd[1], &getfd, buf, len,
725 CMSG_SPACE(SOCKCREDSIZE(CMGROUP_MAX)) + CMSG_SPACE(sizeof(int)), 0);
726 ATF_REQUIRE_MSG(rlen == len,
727 "recvmsg: %zd bytes received; expected %zd", rlen, len);
728
729 close(putfd);
730 close(getfd);
731 closesocketpair(fd);
732 }
733
734 static void
send_cmsg(int sockfd,void * cmsg,size_t cmsgsz)735 send_cmsg(int sockfd, void *cmsg, size_t cmsgsz)
736 {
737 struct iovec iov;
738 struct msghdr msghdr;
739 ssize_t len;
740 char ch;
741
742 ch = 0;
743 bzero(&msghdr, sizeof(msghdr));
744
745 iov.iov_base = &ch;
746 iov.iov_len = sizeof(ch);
747 msghdr.msg_control = cmsg;
748 msghdr.msg_controllen = cmsgsz;
749 msghdr.msg_iov = &iov;
750 msghdr.msg_iovlen = 1;
751
752 len = sendmsg(sockfd, &msghdr, 0);
753 ATF_REQUIRE_MSG(len != -1,
754 "sendmsg failed: %s", strerror(errno));
755 ATF_REQUIRE_MSG(len == sizeof(ch),
756 "sendmsg: %zd bytes sent; expected %zu", len, sizeof(ch));
757 }
758
759 static void
recv_cmsg(int sockfd,char * cmsg,size_t cmsgsz,int flags)760 recv_cmsg(int sockfd, char *cmsg, size_t cmsgsz, int flags)
761 {
762 struct iovec iov;
763 struct msghdr msghdr;
764 ssize_t len;
765 char ch;
766
767 ch = 0;
768 bzero(&msghdr, sizeof(msghdr));
769
770 iov.iov_base = &ch;
771 iov.iov_len = sizeof(ch);
772 msghdr.msg_control = cmsg;
773 msghdr.msg_controllen = cmsgsz;
774 msghdr.msg_iov = &iov;
775 msghdr.msg_iovlen = 1;
776
777 len = recvmsg(sockfd, &msghdr, 0);
778 ATF_REQUIRE_MSG(len != -1,
779 "recvmsg failed: %s", strerror(errno));
780 ATF_REQUIRE_MSG(len == sizeof(ch),
781 "recvmsg: %zd bytes received; expected %zu", len, sizeof(ch));
782 ATF_REQUIRE_MSG((msghdr.msg_flags & flags) == flags,
783 "recvmsg: got flags %#x; expected %#x", msghdr.msg_flags, flags);
784 }
785
786 /*
787 * Test for PR 131876. Receiver uses a control message buffer that is too
788 * small for the incoming SCM_RIGHTS message, so the message is truncated.
789 * The kernel must not leak the copied right into the receiver's namespace.
790 */
791 ATF_TC_WITHOUT_HEAD(truncated_rights);
ATF_TC_BODY(truncated_rights,tc)792 ATF_TC_BODY(truncated_rights, tc)
793 {
794 char *message;
795 int fd[2], nfds, putfd, rc;
796
797 domainsocketpair(fd);
798 devnull(&putfd);
799 nfds = getnfds();
800
801 /*
802 * Case 1: Send a single descriptor and truncate the message.
803 */
804 message = malloc(CMSG_SPACE(sizeof(int)));
805 ATF_REQUIRE(message != NULL);
806 putfds(message, putfd, 1);
807 send_cmsg(fd[0], message, CMSG_LEN(sizeof(int)));
808 recv_cmsg(fd[1], message, CMSG_LEN(0), MSG_CTRUNC);
809 ATF_REQUIRE(getnfds() == nfds);
810 free(message);
811
812 /*
813 * Case 2a: Send two descriptors in separate messages, and truncate at
814 * the boundary between the two messages. We should still
815 * receive the first message.
816 */
817 message = malloc(CMSG_SPACE(sizeof(int)) * 2);
818 ATF_REQUIRE(message != NULL);
819 putfds(message, putfd, 1);
820 putfds(message + CMSG_SPACE(sizeof(int)), putfd, 1);
821 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int)) * 2);
822 recv_cmsg(fd[1], message, CMSG_SPACE(sizeof(int)), MSG_CTRUNC);
823 rc = close(*(int *)CMSG_DATA(message));
824 ATF_REQUIRE_MSG(rc == 0, "close failed: %s", strerror(errno));
825 ATF_REQUIRE(getnfds() == nfds);
826 free(message);
827
828 /*
829 * Case 2b: Send two descriptors in separate messages, and truncate
830 * before the end of the first message.
831 */
832 message = malloc(CMSG_SPACE(sizeof(int)) * 2);
833 ATF_REQUIRE(message != NULL);
834 putfds(message, putfd, 1);
835 putfds(message + CMSG_SPACE(sizeof(int)), putfd, 1);
836 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int)) * 2);
837 recv_cmsg(fd[1], message, CMSG_SPACE(0), MSG_CTRUNC);
838 ATF_REQUIRE(getnfds() == nfds);
839 free(message);
840
841 /*
842 * Case 2c: Send two descriptors in separate messages, and truncate
843 * after the end of the first message. We should still
844 * receive the first message.
845 */
846 message = malloc(CMSG_SPACE(sizeof(int)) * 2);
847 ATF_REQUIRE(message != NULL);
848 putfds(message, putfd, 1);
849 putfds(message + CMSG_SPACE(sizeof(int)), putfd, 1);
850 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int)) * 2);
851 recv_cmsg(fd[1], message, CMSG_SPACE(sizeof(int)) + CMSG_SPACE(0),
852 MSG_CTRUNC);
853 rc = close(*(int *)CMSG_DATA(message));
854 ATF_REQUIRE_MSG(rc == 0, "close failed: %s", strerror(errno));
855 ATF_REQUIRE(getnfds() == nfds);
856 free(message);
857
858 /*
859 * Case 3: Send three descriptors in the same message, and leave space
860 * only for the first when receiving the message.
861 */
862 message = malloc(CMSG_SPACE(sizeof(int) * 3));
863 ATF_REQUIRE(message != NULL);
864 putfds(message, putfd, 3);
865 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int) * 3));
866 recv_cmsg(fd[1], message, CMSG_SPACE(sizeof(int)), MSG_CTRUNC);
867 ATF_REQUIRE(getnfds() == nfds);
868 free(message);
869
870 close(putfd);
871 closesocketpair(fd);
872 }
873
874 /*
875 * Ensure that an attempt to copy a SCM_RIGHTS message to the recipient
876 * fails. In this case the kernel must dispose of the externalized rights
877 * rather than leaking them into the recipient's file descriptor table.
878 */
879 ATF_TC_WITHOUT_HEAD(copyout_rights_error);
ATF_TC_BODY(copyout_rights_error,tc)880 ATF_TC_BODY(copyout_rights_error, tc)
881 {
882 struct iovec iovec;
883 struct msghdr msghdr;
884 char buf[16];
885 ssize_t len;
886 int fd[2], error, nfds, putfd;
887
888 memset(buf, 0, sizeof(buf));
889 domainsocketpair(fd);
890 devnull(&putfd);
891 nfds = getnfds();
892
893 len = sendfd_payload(fd[0], putfd, buf, sizeof(buf));
894 ATF_REQUIRE_MSG(len != -1, "sendmsg failed: %s", strerror(errno));
895
896 bzero(&msghdr, sizeof(msghdr));
897
898 iovec.iov_base = buf;
899 iovec.iov_len = sizeof(buf);
900 msghdr.msg_control = (char *)-1; /* trigger EFAULT */
901 msghdr.msg_controllen = CMSG_SPACE(sizeof(int));
902 msghdr.msg_iov = &iovec;
903 msghdr.msg_iovlen = 1;
904
905 len = recvmsg(fd[1], &msghdr, 0);
906 error = errno;
907 ATF_REQUIRE_MSG(len == -1, "recvmsg succeeded: %zd", len);
908 ATF_REQUIRE_MSG(errno == EFAULT, "expected EFAULT, got %d (%s)",
909 error, strerror(errno));
910
911 /* Verify that no FDs were leaked. */
912 ATF_REQUIRE(getnfds() == nfds);
913
914 close(putfd);
915 closesocketpair(fd);
916 }
917
918 /*
919 * Verify that we can handle empty rights messages.
920 */
921 ATF_TC_WITHOUT_HEAD(empty_rights_message);
ATF_TC_BODY(empty_rights_message,tc)922 ATF_TC_BODY(empty_rights_message, tc)
923 {
924 struct iovec iov;
925 struct msghdr msghdr;
926 struct cmsghdr cmsg;
927 char *cm, message[CMSG_SPACE(0) + CMSG_SPACE(sizeof(int))];
928 ssize_t len;
929 int error, fd[2], putfd;
930
931 domainsocketpair(fd);
932 devnull(&putfd);
933
934 memset(&msghdr, 0, sizeof(msghdr));
935 iov.iov_base = NULL;
936 iov.iov_len = 0;
937 msghdr.msg_iov = &iov;
938 msghdr.msg_iovlen = 1;
939
940 /*
941 * Try sending incorrect empty message. On 64-bit platforms, where
942 * CMSG_SPACE(0) > sizeof(struct cmsghdr), this will exercise
943 * an edge case.
944 */
945 cmsg = (struct cmsghdr ){
946 .cmsg_len = sizeof(struct cmsghdr), /* not CMSG_LEN(0)! */
947 .cmsg_level = SOL_SOCKET,
948 .cmsg_type = SCM_RIGHTS,
949 };
950 msghdr.msg_control = &cmsg;
951 msghdr.msg_controllen = CMSG_SPACE(0);
952
953 len = sendmsg(fd[0], &msghdr, 0);
954 if (CMSG_LEN(0) != sizeof(struct cmsghdr))
955 ATF_REQUIRE(len == -1 && errno == EINVAL);
956 else
957 ATF_REQUIRE(len == 0);
958
959 /*
960 * Try sending an empty message followed by a non-empty message.
961 */
962 cm = message;
963 putfds(cm, -1, 0);
964 cm += CMSG_SPACE(0);
965 putfds(cm, putfd, 1);
966 msghdr.msg_control = message;
967 msghdr.msg_controllen = sizeof(message);
968
969 len = sendmsg(fd[0], &msghdr, 0);
970 ATF_REQUIRE_MSG(len == 0, "sendmsg failed: %s", strerror(errno));
971
972 /* Only the non-empty message should be received. */
973 len = recvmsg(fd[1], &msghdr, 0);
974 ATF_REQUIRE_MSG(len == 0, "recvmsg failed: %s", strerror(errno));
975 ATF_REQUIRE(msghdr.msg_controllen == CMSG_SPACE(sizeof(int)));
976 error = close(*(int *)CMSG_DATA(msghdr.msg_control));
977 ATF_REQUIRE_MSG(error == 0, "close failed: %s", strerror(errno));
978
979 /*
980 * Now try sending with the non-empty message before the empty message.
981 */
982 cm = message;
983 putfds(cm, putfd, 1);
984 cm += CMSG_SPACE(sizeof(int));
985 putfds(cm, -1, 0);
986
987 memset(&msghdr, 0, sizeof(msghdr));
988 iov.iov_base = NULL;
989 iov.iov_len = 0;
990 msghdr.msg_control = message;
991 msghdr.msg_controllen = CMSG_SPACE(sizeof(int));
992 msghdr.msg_iov = &iov;
993 msghdr.msg_iovlen = 1;
994
995 len = sendmsg(fd[0], &msghdr, 0);
996 ATF_REQUIRE_MSG(len == 0, "sendmsg failed: %s", strerror(errno));
997
998 /* Only the non-empty message should be received. */
999 len = recvmsg(fd[1], &msghdr, 0);
1000 ATF_REQUIRE_MSG(len == 0, "recvmsg failed: %s", strerror(errno));
1001 ATF_REQUIRE(msghdr.msg_controllen == CMSG_SPACE(sizeof(int)));
1002 error = close(*(int *)CMSG_DATA(msghdr.msg_control));
1003 ATF_REQUIRE_MSG(error == 0, "close failed: %s", strerror(errno));
1004
1005 (void)close(putfd);
1006 }
1007
1008 /*
1009 * Check that sending control creates records in a stream socket, making it
1010 * behave like a seqpacket socket. If we stack several control+data writes
1011 * on a stream socket, we won't be able to read them all at once, even if we
1012 * provide a buffer large enough to receive all at once.
1013 *
1014 * XXXGL: adding MSG_WAITALL to the recvmsg() flags will make this test stuck.
1015 */
1016 ATF_TC_WITHOUT_HEAD(control_creates_records);
ATF_TC_BODY(control_creates_records,tc)1017 ATF_TC_BODY(control_creates_records, tc)
1018 {
1019 int fd[2], putfd, getfd;
1020 char buf[2];
1021 ssize_t rlen;
1022
1023 domainsocketpair(fd);
1024 tempfile(&putfd);
1025
1026 for (int i = 1; i <= 2; i++)
1027 ATF_REQUIRE(sendfd_payload(fd[0], putfd, buf, 1) == 1);
1028 ATF_REQUIRE(close(putfd) == 0);
1029 for (int i = 1; i <= 2; i++) {
1030 rlen = recvfd_payload(fd[1], &getfd, buf, 2,
1031 CMSG_SPACE(sizeof(int)) * 2, 0);
1032 ATF_REQUIRE_MSG(rlen == 1,
1033 "recvmsg: %zd bytes received; expected 1", rlen);
1034 ATF_REQUIRE(close(getfd) == 0);
1035 }
1036 closesocketpair(fd);
1037 }
1038
1039 ATF_TC_WITH_CLEANUP(cross_jail_dirfd);
ATF_TC_HEAD(cross_jail_dirfd,tc)1040 ATF_TC_HEAD(cross_jail_dirfd, tc)
1041 {
1042 atf_tc_set_md_var(tc, "require.user", "root");
1043 }
ATF_TC_BODY(cross_jail_dirfd,tc)1044 ATF_TC_BODY(cross_jail_dirfd, tc)
1045 {
1046 int error, sock[2], jid1, jid2, status;
1047 pid_t pid1, pid2;
1048
1049 domainsocketpair(sock);
1050
1051 error = mkdir("./a", 0755);
1052 ATF_REQUIRE(error == 0);
1053 error = mkdir("./b", 0755);
1054 ATF_REQUIRE(error == 0);
1055 error = mkdir("./c", 0755);
1056 ATF_REQUIRE(error == 0);
1057 error = mkdir("./a/c", 0755);
1058 ATF_REQUIRE(error == 0);
1059
1060 jid1 = jail_setv(JAIL_CREATE,
1061 "name", "passfd_test_cross_jail_dirfd1",
1062 "path", "./a",
1063 "persist", NULL,
1064 NULL);
1065 ATF_REQUIRE_MSG(jid1 >= 0, "jail_setv: %s", jail_errmsg);
1066
1067 jid2 = jail_setv(JAIL_CREATE,
1068 "name", "passfd_test_cross_jail_dirfd2",
1069 "path", "./b",
1070 "persist", NULL,
1071 NULL);
1072 ATF_REQUIRE_MSG(jid2 >= 0, "jail_setv: %s", jail_errmsg);
1073
1074 pid1 = fork();
1075 ATF_REQUIRE(pid1 >= 0);
1076 if (pid1 == 0) {
1077 ssize_t len;
1078 int dfd, error;
1079 char ch;
1080
1081 error = jail_attach(jid1);
1082 if (error != 0)
1083 err(1, "jail_attach");
1084
1085 dfd = open(".", O_RDONLY | O_DIRECTORY);
1086 if (dfd < 0)
1087 err(1, "open(\".\") in jail %d", jid1);
1088
1089 ch = 0;
1090 len = sendfd_payload(sock[0], dfd, &ch, sizeof(ch));
1091 if (len == -1)
1092 err(1, "sendmsg");
1093
1094 _exit(0);
1095 }
1096
1097 pid2 = fork();
1098 ATF_REQUIRE(pid2 >= 0);
1099 if (pid2 == 0) {
1100 ssize_t len;
1101 int dfd, dfd2, error, fd;
1102 char ch;
1103
1104 error = jail_attach(jid2);
1105 if (error != 0)
1106 err(1, "jail_attach");
1107
1108 /* Get a directory from outside the jail root. */
1109 len = recvfd_payload(sock[1], &dfd, &ch, sizeof(ch),
1110 CMSG_SPACE(sizeof(int)), 0);
1111 if (len == -1)
1112 err(1, "recvmsg");
1113
1114 if ((fcntl(dfd, F_GETFD) & FD_RESOLVE_BENEATH) == 0)
1115 errx(1, "dfd does not have FD_RESOLVE_BENEATH set");
1116
1117 /* Make sure we can't chdir. */
1118 error = fchdir(dfd);
1119 if (error == 0)
1120 errx(1, "fchdir succeeded");
1121 if (errno != ENOTCAPABLE)
1122 err(1, "fchdir");
1123
1124 /* Make sure a dotdot access fails. */
1125 fd = openat(dfd, "../c", O_RDONLY | O_DIRECTORY);
1126 if (fd >= 0)
1127 errx(1, "openat(\"../c\") succeeded");
1128 if (errno != ENOTCAPABLE)
1129 err(1, "openat");
1130
1131 /* Accesses within the sender's jail root are ok. */
1132 fd = openat(dfd, "c", O_RDONLY | O_DIRECTORY);
1133 if (fd < 0)
1134 err(1, "openat(\"c\")");
1135
1136 dfd2 = openat(dfd, "", O_EMPTY_PATH | O_RDONLY | O_DIRECTORY);
1137 if (dfd2 < 0)
1138 err(1, "openat(\"\")");
1139 if ((fcntl(dfd2, F_GETFD) & FD_RESOLVE_BENEATH) == 0)
1140 errx(1, "dfd2 does not have FD_RESOLVE_BENEATH set");
1141
1142 _exit(0);
1143 }
1144
1145 error = waitpid(pid1, &status, 0);
1146 ATF_REQUIRE(error != -1);
1147 ATF_REQUIRE(WIFEXITED(status));
1148 ATF_REQUIRE(WEXITSTATUS(status) == 0);
1149 error = waitpid(pid2, &status, 0);
1150 ATF_REQUIRE(error != -1);
1151 ATF_REQUIRE(WIFEXITED(status));
1152 ATF_REQUIRE(WEXITSTATUS(status) == 0);
1153
1154 closesocketpair(sock);
1155 }
ATF_TC_CLEANUP(cross_jail_dirfd,tc)1156 ATF_TC_CLEANUP(cross_jail_dirfd, tc)
1157 {
1158 int jid;
1159
1160 jid = jail_getid("passfd_test_cross_jail_dirfd1");
1161 if (jid >= 0 && jail_remove(jid) != 0)
1162 err(1, "jail_remove");
1163 jid = jail_getid("passfd_test_cross_jail_dirfd2");
1164 if (jid >= 0 && jail_remove(jid) != 0)
1165 err(1, "jail_remove");
1166 }
1167
ATF_TP_ADD_TCS(tp)1168 ATF_TP_ADD_TCS(tp)
1169 {
1170
1171 ATF_TP_ADD_TC(tp, simple_send_fd);
1172 ATF_TP_ADD_TC(tp, simple_send_fd_msg_cmsg_cloexec);
1173 ATF_TP_ADD_TC(tp, send_and_close);
1174 ATF_TP_ADD_TC(tp, send_and_cancel);
1175 ATF_TP_ADD_TC(tp, send_and_shutdown);
1176 ATF_TP_ADD_TC(tp, send_a_lot);
1177 ATF_TP_ADD_TC(tp, send_overflow);
1178 ATF_TP_ADD_TC(tp, peek);
1179 ATF_TP_ADD_TC(tp, two_files);
1180 ATF_TP_ADD_TC(tp, bundle);
1181 ATF_TP_ADD_TC(tp, bundle_cancel);
1182 ATF_TP_ADD_TC(tp, devfs_orphan);
1183 ATF_TP_ADD_TC(tp, rights_creds_payload);
1184 ATF_TP_ADD_TC(tp, truncated_rights);
1185 ATF_TP_ADD_TC(tp, copyout_rights_error);
1186 ATF_TP_ADD_TC(tp, empty_rights_message);
1187 ATF_TP_ADD_TC(tp, control_creates_records);
1188 ATF_TP_ADD_TC(tp, cross_jail_dirfd);
1189
1190 return (atf_no_error());
1191 }
1192