1 /*-
2 * Copyright (c) 2005 Robert N. M. Watson
3 * Copyright (c) 2015 Mark Johnston
4 * Copyright (c) 2022 Gleb Smirnoff <glebius@FreeBSD.org>
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/param.h>
30 #include <sys/jail.h>
31 #include <sys/socket.h>
32 #include <sys/stat.h>
33 #include <sys/sysctl.h>
34 #include <sys/time.h>
35 #include <sys/resource.h>
36 #include <sys/un.h>
37 #include <sys/wait.h>
38
39 #include <err.h>
40 #include <errno.h>
41 #include <fcntl.h>
42 #include <jail.h>
43 #include <limits.h>
44 #include <stdio.h>
45 #include <stdlib.h>
46 #include <string.h>
47 #include <unistd.h>
48
49 #include <atf-c.h>
50
51 #if !defined(TEST_PROTO)
52 #error Need TEST_PROTO defined to SOCK_STREAM or SOCK_DGRAM
53 #endif
54
55 /*
56 * UNIX domain sockets allow file descriptors to be passed via "ancillary
57 * data", or control messages. This regression test is intended to exercise
58 * this facility, both performing some basic tests that it operates, and also
59 * causing some kernel edge cases to execute, such as garbage collection when
60 * there are cyclic file descriptor references. Right now we test only with
61 * stream sockets, but ideally we'd also test with datagram sockets.
62 */
63
64 static void
domainsocketpair(int * fdp)65 domainsocketpair(int *fdp)
66 {
67
68 ATF_REQUIRE_MSG(socketpair(PF_UNIX, TEST_PROTO, 0, fdp) != -1,
69 "socketpair(PF_UNIX, %u) failed: %s", TEST_PROTO, strerror(errno));
70 }
71
72 static void
closesocketpair(int * fdp)73 closesocketpair(int *fdp)
74 {
75
76 close(fdp[0]);
77 close(fdp[1]);
78 }
79
80 static void
devnull(int * fdp)81 devnull(int *fdp)
82 {
83 int fd;
84
85 fd = open("/dev/null", O_RDONLY);
86 ATF_REQUIRE_MSG(fd != -1, "open failed: %s", strerror(errno));
87 *fdp = fd;
88 }
89
90 static void
tempfile(int * fdp)91 tempfile(int *fdp)
92 {
93 char path[PATH_MAX];
94 int fd;
95
96 snprintf(path, PATH_MAX, "%s/unix_passfd.XXXXXXXXXXXXXXX",
97 getenv("TMPDIR") == NULL ? "/tmp" : getenv("TMPDIR"));
98 fd = mkstemp(path);
99 ATF_REQUIRE_MSG(fd != -1, "mkstemp(%s) failed", path);
100 (void)unlink(path);
101 *fdp = fd;
102 }
103
104 static void
dofstat(int fd,struct stat * sb)105 dofstat(int fd, struct stat *sb)
106 {
107
108 ATF_REQUIRE_MSG(fstat(fd, sb) == 0,
109 "fstat failed: %s", strerror(errno));
110 }
111
112 static int
getnfds(void)113 getnfds(void)
114 {
115 size_t len;
116 int mib[4], n, rc;
117
118 len = sizeof(n);
119 mib[0] = CTL_KERN;
120 mib[1] = KERN_PROC;
121 mib[2] = KERN_PROC_NFDS;
122 mib[3] = 0;
123
124 rc = sysctl(mib, 4, &n, &len, NULL, 0);
125 ATF_REQUIRE_MSG(rc != -1, "sysctl(KERN_PROC_NFDS) failed");
126 return (n);
127 }
128
129 static int
openfiles(void)130 openfiles(void)
131 {
132 int files;
133 size_t len = sizeof(files);
134
135 ATF_REQUIRE(sysctlbyname("kern.openfiles", &files, &len, NULL, 0) == 0);
136
137 return (files);
138 }
139
140 static void
putfds(char * buf,int fd,int nfds)141 putfds(char *buf, int fd, int nfds)
142 {
143 struct cmsghdr *cm;
144 int *fdp, i;
145
146 cm = (struct cmsghdr *)buf;
147 cm->cmsg_len = CMSG_LEN(nfds * sizeof(int));
148 cm->cmsg_level = SOL_SOCKET;
149 cm->cmsg_type = SCM_RIGHTS;
150 for (fdp = (int *)CMSG_DATA(cm), i = 0; i < nfds; i++)
151 *fdp++ = fd;
152 }
153
154 static void
samefile(struct stat * sb1,struct stat * sb2)155 samefile(struct stat *sb1, struct stat *sb2)
156 {
157
158 ATF_REQUIRE_MSG(sb1->st_dev == sb2->st_dev, "different device");
159 ATF_REQUIRE_MSG(sb1->st_ino == sb2->st_ino, "different inode");
160 }
161
162 static ssize_t
sendfd_payload(int sockfd,int send_fd,void * payload,size_t paylen)163 sendfd_payload(int sockfd, int send_fd, void *payload, size_t paylen)
164 {
165 struct iovec iovec;
166 char message[CMSG_SPACE(sizeof(int))];
167 struct msghdr msghdr;
168
169 bzero(&msghdr, sizeof(msghdr));
170 bzero(&message, sizeof(message));
171
172 msghdr.msg_control = message;
173 msghdr.msg_controllen = sizeof(message);
174
175 iovec.iov_base = payload;
176 iovec.iov_len = paylen;
177
178 msghdr.msg_iov = &iovec;
179 msghdr.msg_iovlen = 1;
180
181 putfds(message, send_fd, 1);
182 return (sendmsg(sockfd, &msghdr, 0));
183 }
184
185 static void
sendfd(int sockfd,int send_fd)186 sendfd(int sockfd, int send_fd)
187 {
188 ssize_t len;
189 char ch;
190
191 ch = 0;
192 len = sendfd_payload(sockfd, send_fd, &ch, sizeof(ch));
193 ATF_REQUIRE_MSG(len == sizeof(ch),
194 "sendmsg: %zd bytes sent; expected %zu; %s", len, sizeof(ch),
195 strerror(errno));
196 }
197
198 static bool
localcreds(int sockfd)199 localcreds(int sockfd)
200 {
201 socklen_t sz;
202 int rc, val;
203
204 sz = sizeof(val);
205 rc = getsockopt(sockfd, 0, LOCAL_CREDS, &val, &sz);
206 ATF_REQUIRE_MSG(rc != -1, "getsockopt(LOCAL_CREDS) failed: %s",
207 strerror(errno));
208 return (val != 0);
209 }
210
211 static bool
passrights(int sockfd)212 passrights(int sockfd)
213 {
214 socklen_t sz;
215 int rc, val;
216
217 sz = sizeof(val);
218 rc = getsockopt(sockfd, SOL_SOCKET, SO_PASSRIGHTS, &val, &sz);
219 ATF_REQUIRE_MSG(rc != -1, "getsockopt(SO_PASSRIGHTS) failed: %s",
220 strerror(errno));
221 return (val != 0);
222 }
223
224 static ssize_t
recvfd_payload_cmsg(int sockfd,void * buf,size_t buflen,struct msghdr * msghdr,int recvmsg_flags)225 recvfd_payload_cmsg(int sockfd, void *buf, size_t buflen, struct msghdr *msghdr,
226 int recvmsg_flags)
227 {
228 struct iovec iovec;
229
230 iovec.iov_base = buf;
231 iovec.iov_len = buflen;
232
233 msghdr->msg_iov = &iovec;
234 msghdr->msg_iovlen = 1;
235
236 return (recvmsg(sockfd, msghdr, recvmsg_flags));
237 }
238
239 static ssize_t
recvfd_payload(int sockfd,int * recv_fd,void * buf,size_t buflen,size_t cmsgsz,int recvmsg_flags)240 recvfd_payload(int sockfd, int *recv_fd, void *buf, size_t buflen,
241 size_t cmsgsz, int recvmsg_flags)
242 {
243 struct cmsghdr *cmsghdr;
244 struct msghdr msghdr;
245 char *message;
246 ssize_t len;
247 bool foundcreds;
248
249 bzero(&msghdr, sizeof(msghdr));
250 message = malloc(cmsgsz);
251 ATF_REQUIRE(message != NULL);
252
253 msghdr.msg_control = message;
254 msghdr.msg_controllen = cmsgsz;
255
256 len = recvfd_payload_cmsg(sockfd, buf, buflen, &msghdr, recvmsg_flags);
257 ATF_REQUIRE_MSG(len != -1, "recvmsg failed: %s", strerror(errno));
258
259 cmsghdr = CMSG_FIRSTHDR(&msghdr);
260 ATF_REQUIRE_MSG(cmsghdr != NULL,
261 "recvmsg: did not receive control message");
262 foundcreds = false;
263 *recv_fd = -1;
264 for (; cmsghdr != NULL; cmsghdr = CMSG_NXTHDR(&msghdr, cmsghdr)) {
265 if (cmsghdr->cmsg_level == SOL_SOCKET &&
266 cmsghdr->cmsg_type == SCM_RIGHTS &&
267 cmsghdr->cmsg_len == CMSG_LEN(sizeof(int))) {
268 memcpy(recv_fd, CMSG_DATA(cmsghdr), sizeof(int));
269 ATF_REQUIRE(*recv_fd != -1);
270 } else if (cmsghdr->cmsg_level == SOL_SOCKET &&
271 cmsghdr->cmsg_type == SCM_CREDS)
272 foundcreds = true;
273 }
274 ATF_REQUIRE_MSG(*recv_fd != -1,
275 "recvmsg: did not receive single-fd message");
276 ATF_REQUIRE_MSG(!localcreds(sockfd) || foundcreds,
277 "recvmsg: expected credentials were not received");
278 ATF_REQUIRE_MSG((msghdr.msg_flags & MSG_TRUNC) == 0,
279 "recvmsg: MSG_TRUNC is set while buffer is sufficient");
280
281 return (len);
282 }
283
284 static void
recvfd(int sockfd,int * recv_fd,int flags)285 recvfd(int sockfd, int *recv_fd, int flags)
286 {
287 ssize_t len;
288 char ch = 0;
289
290 len = recvfd_payload(sockfd, recv_fd, &ch, sizeof(ch),
291 CMSG_SPACE(sizeof(int)), flags);
292 ATF_REQUIRE_MSG((size_t)len == sizeof(ch),
293 "recvmsg: %zd bytes received; expected %zd", len, sizeof(ch));
294 }
295
296 #if TEST_PROTO == SOCK_STREAM
297 #define LOCAL_SENDSPACE_SYSCTL "net.local.stream.sendspace"
298 #define LOCAL_RECVSPACE_SYSCTL "net.local.stream.recvspace"
299 #elif TEST_PROTO == SOCK_DGRAM
300 #define LOCAL_SENDSPACE_SYSCTL "net.local.dgram.maxdgram"
301 #define LOCAL_RECVSPACE_SYSCTL "net.local.dgram.recvspace"
302 #endif
303
304 static u_long
getsendspace(void)305 getsendspace(void)
306 {
307 u_long sendspace;
308
309 ATF_REQUIRE_MSG(sysctlbyname(LOCAL_SENDSPACE_SYSCTL, &sendspace,
310 &(size_t){sizeof(u_long)}, NULL, 0) != -1,
311 "sysctl %s failed: %s", LOCAL_SENDSPACE_SYSCTL, strerror(errno));
312
313 return (sendspace);
314 }
315
316 static u_long
getrecvspace(void)317 getrecvspace(void)
318 {
319 u_long recvspace;
320
321 ATF_REQUIRE_MSG(sysctlbyname(LOCAL_RECVSPACE_SYSCTL, &recvspace,
322 &(size_t){sizeof(u_long)}, NULL, 0) != -1,
323 "sysctl %s failed: %s", LOCAL_RECVSPACE_SYSCTL, strerror(errno));
324
325 return (recvspace);
326 }
327
328 /*
329 * Fill socket to a state when next max sized send would fail with EAGAIN.
330 */
331 static void
fill(int fd)332 fill(int fd)
333 {
334 u_long sendspace;
335 void *buf;
336
337 sendspace = getsendspace();
338 ATF_REQUIRE((buf = malloc(sendspace)) != NULL);
339
340 ATF_REQUIRE_MSG(fcntl(fd, F_SETFL, O_NONBLOCK) != -1,
341 "fcntl(O_NONBLOCK) failed: %s", strerror(errno));
342
343 #if TEST_PROTO == SOCK_STREAM
344 do {} while (send(fd, buf, sendspace, 0) == (ssize_t)sendspace);
345 #elif TEST_PROTO == SOCK_DGRAM
346 u_long recvspace = getrecvspace();
347
348 for (ssize_t sent = 0;
349 sent + sendspace + sizeof(struct sockaddr) < recvspace;
350 sent += sendspace + sizeof(struct sockaddr))
351 ATF_REQUIRE(send(fd, buf, sendspace, 0) == (ssize_t)sendspace);
352 #endif
353 free(buf);
354 }
355
356 /*
357 * Put a temporary file into a UNIX domain socket, then take it out and make
358 * sure it's the same file. First time around, don't close the reference
359 * after sending.
360 */
361 ATF_TC_WITHOUT_HEAD(simple_send_fd);
ATF_TC_BODY(simple_send_fd,tc)362 ATF_TC_BODY(simple_send_fd, tc)
363 {
364 struct stat getfd_stat, putfd_stat;
365 int fd[2], getfd, putfd;
366
367 domainsocketpair(fd);
368 tempfile(&putfd);
369 dofstat(putfd, &putfd_stat);
370 sendfd(fd[0], putfd);
371 recvfd(fd[1], &getfd, 0);
372 dofstat(getfd, &getfd_stat);
373 samefile(&putfd_stat, &getfd_stat);
374 close(putfd);
375 close(getfd);
376 closesocketpair(fd);
377 }
378
379 /*
380 * Like simple_send_fd but also sets MSG_CMSG_CLOEXEC and checks that the
381 * received file descriptor has the FD_CLOEXEC flag set.
382 */
383 ATF_TC_WITHOUT_HEAD(simple_send_fd_msg_cmsg_cloexec);
ATF_TC_BODY(simple_send_fd_msg_cmsg_cloexec,tc)384 ATF_TC_BODY(simple_send_fd_msg_cmsg_cloexec, tc)
385 {
386 struct stat getfd_stat, putfd_stat;
387 int fd[2], getfd, putfd;
388
389 domainsocketpair(fd);
390 tempfile(&putfd);
391 dofstat(putfd, &putfd_stat);
392 sendfd(fd[0], putfd);
393 recvfd(fd[1], &getfd, MSG_CMSG_CLOEXEC);
394 dofstat(getfd, &getfd_stat);
395 samefile(&putfd_stat, &getfd_stat);
396 ATF_REQUIRE_EQ_MSG(fcntl(getfd, F_GETFD) & FD_CLOEXEC, FD_CLOEXEC,
397 "FD_CLOEXEC not set on the received file descriptor");
398 close(putfd);
399 close(getfd);
400 closesocketpair(fd);
401 }
402
403 /*
404 * Like simple_send_fd but also sets MSG_CMSG_CLOFORK and checks that the
405 * received file descriptor has the FD_CLOFORK flag set.
406 */
407 ATF_TC_WITHOUT_HEAD(simple_send_fd_msg_cmsg_clofork);
ATF_TC_BODY(simple_send_fd_msg_cmsg_clofork,tc)408 ATF_TC_BODY(simple_send_fd_msg_cmsg_clofork, tc)
409 {
410 struct stat getfd_stat, putfd_stat;
411 int fd[2], getfd, putfd;
412
413 domainsocketpair(fd);
414 tempfile(&putfd);
415 dofstat(putfd, &putfd_stat);
416 sendfd(fd[0], putfd);
417 recvfd(fd[1], &getfd, MSG_CMSG_CLOFORK);
418 dofstat(getfd, &getfd_stat);
419 samefile(&putfd_stat, &getfd_stat);
420 ATF_REQUIRE_EQ_MSG(fcntl(getfd, F_GETFD) & FD_CLOFORK, FD_CLOFORK,
421 "FD_CLOFORK not set on the received file descriptor");
422 close(putfd);
423 close(getfd);
424 closesocketpair(fd);
425 }
426
427 /*
428 * Same as simple_send_fd, only close the file reference after sending, so that
429 * the only reference is the descriptor in the UNIX domain socket buffer.
430 */
431 ATF_TC_WITHOUT_HEAD(send_and_close);
ATF_TC_BODY(send_and_close,tc)432 ATF_TC_BODY(send_and_close, tc)
433 {
434 struct stat getfd_stat, putfd_stat;
435 int fd[2], getfd, putfd;
436
437 domainsocketpair(fd);
438 tempfile(&putfd);
439 dofstat(putfd, &putfd_stat);
440 sendfd(fd[0], putfd);
441 close(putfd);
442 recvfd(fd[1], &getfd, 0);
443 dofstat(getfd, &getfd_stat);
444 samefile(&putfd_stat, &getfd_stat);
445 close(getfd);
446 closesocketpair(fd);
447 }
448
449 /*
450 * Put a temporary file into a UNIX domain socket, then close both endpoints
451 * causing garbage collection to kick off.
452 */
453 ATF_TC_WITHOUT_HEAD(send_and_cancel);
ATF_TC_BODY(send_and_cancel,tc)454 ATF_TC_BODY(send_and_cancel, tc)
455 {
456 int fd[2], putfd;
457
458 domainsocketpair(fd);
459 tempfile(&putfd);
460 sendfd(fd[0], putfd);
461 close(putfd);
462 closesocketpair(fd);
463 }
464
465 /*
466 * Send file then shutdown receive side to exercise unp_dispose() call
467 * via soshutdown(). Check that shutdown(SHUT_RD) would gc the file
468 * reference sitting in the receive buffer. There is no good way of
469 * checking that except using global open file count.
470 */
471 ATF_TC_WITHOUT_HEAD(send_and_shutdown);
ATF_TC_BODY(send_and_shutdown,tc)472 ATF_TC_BODY(send_and_shutdown, tc)
473 {
474 int fd[2], putfd, nfiles;
475
476 domainsocketpair(fd);
477 tempfile(&putfd);
478 sendfd(fd[0], putfd);
479 nfiles = openfiles();
480 close(putfd);
481 ATF_REQUIRE(openfiles() == nfiles);
482 shutdown(fd[1], SHUT_RD);
483 ATF_REQUIRE(openfiles() == nfiles - 1);
484 closesocketpair(fd);
485 }
486
487 /*
488 * Send maximum possible SCM_RIGHTS message.
489 * Internally the file descriptors are converted from integers to pointers
490 * and stored in a single mbuf cluster. Check that we can not send too much
491 * and that we can successfully send maximum possible amount. Check that we
492 * can not exploit getrlimit(3).
493 */
494 #define MAXFDS ((MCLBYTES - _ALIGN(sizeof(struct cmsghdr)))/sizeof(void *))
495 ATF_TC_WITHOUT_HEAD(send_a_lot);
ATF_TC_BODY(send_a_lot,tc)496 ATF_TC_BODY(send_a_lot, tc)
497 {
498 struct msghdr msghdr;
499 struct iovec iov;
500 struct rlimit rlim;
501 int fd[2], nfds;
502 char *cmsg, ch;
503
504 domainsocketpair(fd);
505 cmsg = malloc(CMSG_SPACE((MAXFDS + 1) * sizeof(int)));
506 ATF_REQUIRE(cmsg != NULL);
507 iov.iov_base = &ch;
508 iov.iov_len = sizeof(ch);
509 msghdr = (struct msghdr ){
510 .msg_control = cmsg,
511 .msg_controllen = CMSG_LEN((MAXFDS + 1) * sizeof(int)),
512 .msg_iov = &iov,
513 .msg_iovlen = 1,
514 };
515
516 /* Sending too much fails. */
517 putfds(cmsg, fd[0], MAXFDS + 1);
518 ATF_REQUIRE(sendmsg(fd[0], &msghdr, 0) == -1);
519 ATF_REQUIRE(errno == EMSGSIZE);
520
521 /* Sending just the right amount works and everything is received. */
522 putfds(cmsg, fd[0], MAXFDS);
523 msghdr.msg_controllen = CMSG_LEN(MAXFDS * sizeof(int));
524 ATF_REQUIRE(sendmsg(fd[0], &msghdr, 0) == 1);
525 nfds = getnfds();
526 ATF_REQUIRE(recvmsg(fd[1], &msghdr, 0) == 1);
527 ATF_REQUIRE(getnfds() == (int)(nfds + MAXFDS));
528
529 /* Limit our process open files... */
530 ATF_REQUIRE(getrlimit(RLIMIT_NOFILE, &rlim) == 0);
531 nfds = rlim.rlim_cur = getnfds();
532 ATF_REQUIRE(setrlimit(RLIMIT_NOFILE, &rlim) == 0);
533
534 /* ... and try to receive a single descriptor. */
535 putfds(cmsg, fd[0], 1);
536 msghdr.msg_controllen = CMSG_LEN(sizeof(int));
537 ATF_REQUIRE(sendmsg(fd[0], &msghdr, 0) == 1);
538 ATF_REQUIRE(recvmsg(fd[1], &msghdr, 0) == -1);
539 /* Such attempt shall fail with EMFILE. */
540 ATF_REQUIRE(errno == EMFILE);
541 ATF_REQUIRE(getnfds() == nfds);
542 #if TEST_PROTO == SOCK_STREAM
543 /*
544 * For the SOCK_STREAM the above attempt shall free the control in
545 * the kernel, so that socket isn't left in a stuck state. Next read
546 * shall bring us the normal data only. The stream data shall not
547 * miss a byte.
548 */
549 ATF_REQUIRE(recvmsg(fd[1], &msghdr, 0) == 1);
550 ATF_REQUIRE(msghdr.msg_controllen == 0);
551 #elif TEST_PROTO == SOCK_DGRAM
552 /*
553 * For SOCK_DGRAM there are two options for the previously failed
554 * syscall: strip the control leaving datagram in the socket or
555 * drop the whole datagram. Our implementation drops the whole
556 * datagram.
557 */
558 ATF_REQUIRE(recvmsg(fd[1], &msghdr, MSG_DONTWAIT) == -1);
559 ATF_REQUIRE(errno == EAGAIN);
560 #endif
561 }
562
563 /*
564 * Exersize condition when SCM_RIGHTS is successfully internalized, but
565 * message delivery fails due to receive buffer overflow. Check that no
566 * file descriptors are leaked.
567 */
568 ATF_TC_WITHOUT_HEAD(send_overflow);
ATF_TC_BODY(send_overflow,tc)569 ATF_TC_BODY(send_overflow, tc)
570 {
571 void *buf;
572 ssize_t len;
573 int fd[2], putfd, nfiles;
574 int sendspace;
575
576 sendspace = (int)getsendspace();
577 ATF_REQUIRE((buf = malloc(sendspace)) != NULL);
578
579 domainsocketpair(fd);
580 fill(fd[0]);
581 nfiles = openfiles();
582 tempfile(&putfd);
583 len = sendfd_payload(fd[0], putfd, buf, sendspace);
584 #if TEST_PROTO == SOCK_STREAM
585 ATF_REQUIRE_MSG(len == -1 && errno == EAGAIN,
586 "sendmsg: %zd bytes sent, errno %d", len, errno);
587 #elif TEST_PROTO == SOCK_DGRAM
588 ATF_REQUIRE_MSG(len == -1 && errno == ENOBUFS,
589 "sendmsg: %zd bytes sent, errno %d", len, errno);
590 #endif
591 close(putfd);
592 ATF_REQUIRE(nfiles == openfiles());
593 closesocketpair(fd);
594 }
595
596 ATF_TC_WITHOUT_HEAD(send_rejected);
ATF_TC_BODY(send_rejected,tc)597 ATF_TC_BODY(send_rejected, tc)
598 {
599 ssize_t len;
600 int fd[2], optval, putfd, rc;
601 char ch;
602
603 domainsocketpair(fd);
604 ATF_REQUIRE_MSG(passrights(fd[0]),
605 "socketpair socket not initialized with SO_PASSRIGHTS");
606 ATF_REQUIRE_MSG(passrights(fd[1]),
607 "socketpair socket not initialized with SO_PASSRIGHTS");
608
609 tempfile(&putfd);
610
611 /* Toggle SO_PASSRIGHTS off on the receiver side. */
612 optval = 0;
613 rc = setsockopt(fd[1], SOL_SOCKET, SO_PASSRIGHTS, &optval,
614 sizeof(optval));
615 ATF_REQUIRE_MSG(rc != -1, "setsockopt(SO_PASSRIGHTS) failed: %s",
616 strerror(errno));
617 /* Confirm that the sender-side didn't reflect that... */
618 ATF_REQUIRE_MSG(passrights(fd[0]),
619 "setsockopt(SO_PASSRIGHTS) switched the sender");
620 /* ... and that the receiver-side did. */
621 ATF_REQUIRE_MSG(!passrights(fd[1]),
622 "setsockopt(SO_PASSRIGHTS) did not switch the receiver");
623
624 ch = 0;
625 len = sendfd_payload(fd[0], putfd, &ch, sizeof(ch));
626 ATF_REQUIRE_MSG(len == -1,
627 "sending SCM_RIGHTS with SO_PASSRIGHTS disabled on peer did not fail");
628 ATF_REQUIRE_MSG(errno == EPERM,
629 "bad SCM_RIGHTS failure: %s", strerror(errno));
630 closesocketpair(fd);
631 }
632
633 ATF_TC_WITHOUT_HEAD(send_rejected_late);
ATF_TC_BODY(send_rejected_late,tc)634 ATF_TC_BODY(send_rejected_late, tc)
635 {
636 struct cmsghdr *cmsghdr;
637 struct msghdr msghdr;
638 ssize_t len;
639 char cmsgbuf[CMSG_SPACE(sizeof(int))];
640 int fd[2], nfds, optval, putfd, rc;
641 char ch;
642 #define MAGIC_VAL 42
643
644 domainsocketpair(fd);
645 tempfile(&putfd);
646
647 nfds = getnfds();
648
649 ch = MAGIC_VAL;
650 len = sendfd_payload(fd[0], putfd, &ch, sizeof(ch));
651 ATF_REQUIRE_MSG(len == sizeof(ch),
652 "valid send of SCM_RIGHTS failed: %s", strerror(errno));
653
654 /*
655 * Toggle SO_PASSRIGHTS off on the receiver side. The subsequent recv
656 * should actually succeed, we just won't have an fd installed.
657 */
658 optval = 0;
659 rc = setsockopt(fd[1], SOL_SOCKET, SO_PASSRIGHTS, &optval,
660 sizeof(optval));
661 ATF_REQUIRE_MSG(rc != -1, "setsockopt(SO_PASSRIGHTS) failed: %s",
662 strerror(errno));
663
664 bzero(&msghdr, sizeof(msghdr));
665 msghdr.msg_control = &cmsgbuf[0];
666 msghdr.msg_controllen = sizeof(cmsgbuf);
667
668 ch = 0;
669 len = recvfd_payload_cmsg(fd[1], &ch, sizeof(ch), &msghdr, 0);
670 /* We want to confirm that we still received the sent byte... */
671 ATF_REQUIRE_MSG(len == sizeof(ch), "recvmsg should have returned data");
672 ATF_REQUIRE_MSG(ch == MAGIC_VAL, "recvmsg returned garbage? %d", ch);
673
674 /* ... and make sure we did not receive any descriptors! */
675 cmsghdr = CMSG_FIRSTHDR(&msghdr);
676 ATF_REQUIRE_MSG(cmsghdr == NULL || cmsghdr->cmsg_type != SCM_RIGHTS,
677 "recvmsg unexpectedly received a descriptor");
678 ATF_REQUIRE(getnfds() == nfds);
679 closesocketpair(fd);
680 }
681
682 ATF_TC_WITHOUT_HEAD(send_rejected_noinherit);
ATF_TC_BODY(send_rejected_noinherit,tc)683 ATF_TC_BODY(send_rejected_noinherit, tc)
684 {
685 struct sockaddr_un sun;
686 int clsock, connsock, ls, optval, rc;
687
688 ls = socket(AF_UNIX, SOCK_STREAM, 0);
689 ATF_REQUIRE(ls != -1);
690
691 optval = 0;
692 rc = setsockopt(ls, SOL_SOCKET, SO_PASSRIGHTS, &optval,
693 sizeof(optval));
694 ATF_REQUIRE_MSG(rc != -1, "setsockopt(SO_PASSRIGHTS) failed: %s",
695 strerror(errno));
696
697 memset(&sun, 0, sizeof(sun));
698 sun.sun_len = sizeof(sun);
699 sun.sun_family = AF_UNIX;
700 snprintf(sun.sun_path, sizeof(sun.sun_path), "listen.sock");
701 rc = bind(ls, (struct sockaddr *)&sun, sizeof(sun));
702 ATF_REQUIRE_MSG(rc == 0, "bind failed: %s", strerror(errno));
703 rc = listen(ls, 0);
704 ATF_REQUIRE_MSG(rc == 0, "listen failed: %s", strerror(errno));
705
706 ATF_REQUIRE_MSG(!passrights(ls),
707 "listening socket lost its SO_PASSRIGHTS setting");
708
709 connsock = socket(AF_UNIX, SOCK_STREAM, 0);
710 ATF_REQUIRE_MSG(connsock != -1, "connect failed: %s", strerror(errno));
711
712 rc = connect(connsock, (const struct sockaddr *)&sun,
713 sizeof(sun));
714 ATF_REQUIRE_MSG(rc == 0, "connect failed: %s", strerror(errno));
715
716 /*
717 * Finally, accept(4) and confirm that the new socket has
718 * SO_PASSRIGHTS set.
719 */
720 clsock = accept(ls, NULL, NULL);
721 ATF_REQUIRE_MSG(clsock >= 0, "accept failed: %s", strerror(errno));
722
723 ATF_REQUIRE_MSG(passrights(clsock),
724 "inherited socket should enable SO_PASSRIGHTS");
725 close(clsock);
726 close(connsock);
727 close(ls);
728 }
729
730 /*
731 * Make sure that we do not receive descriptors with MSG_PEEK.
732 */
733 ATF_TC_WITHOUT_HEAD(peek);
ATF_TC_BODY(peek,tc)734 ATF_TC_BODY(peek, tc)
735 {
736 int fd[2], getfd, putfd, nfds;
737
738 domainsocketpair(fd);
739 tempfile(&putfd);
740 nfds = getnfds();
741 sendfd(fd[0], putfd);
742 ATF_REQUIRE(getnfds() == nfds);
743
744 /* First make MSG_PEEK recvmsg(2)... */
745 char cbuf[CMSG_SPACE(sizeof(int))];
746 char buf[1];
747 struct iovec iov = {
748 .iov_base = buf,
749 .iov_len = sizeof(buf)
750 };
751 struct msghdr msghdr = {
752 .msg_iov = &iov,
753 .msg_iovlen = 1,
754 .msg_control = cbuf,
755 .msg_controllen = sizeof(cbuf),
756 };
757 ATF_REQUIRE(1 == recvmsg(fd[1], &msghdr, MSG_PEEK));
758 for (struct cmsghdr *cmsghdr = CMSG_FIRSTHDR(&msghdr);
759 cmsghdr != NULL; cmsghdr = CMSG_NXTHDR(&msghdr, cmsghdr)) {
760 /* Usually this is some garbage. */
761 printf("level %d type %d len %u\n",
762 cmsghdr->cmsg_level, cmsghdr->cmsg_type, cmsghdr->cmsg_len);
763 }
764
765 /* ... and make sure we did not receive any descriptors! */
766 ATF_REQUIRE(getnfds() == nfds);
767
768 /* Now really receive a descriptor. */
769 recvfd(fd[1], &getfd, 0);
770 ATF_REQUIRE(getnfds() == nfds + 1);
771 close(putfd);
772 close(getfd);
773 closesocketpair(fd);
774 }
775
776 /*
777 * Send two files. Then receive them. Make sure they are returned in the
778 * right order, and both get there.
779 */
780 ATF_TC_WITHOUT_HEAD(two_files);
ATF_TC_BODY(two_files,tc)781 ATF_TC_BODY(two_files, tc)
782 {
783 struct stat getfd_1_stat, getfd_2_stat, putfd_1_stat, putfd_2_stat;
784 int fd[2], getfd_1, getfd_2, putfd_1, putfd_2;
785
786 domainsocketpair(fd);
787 tempfile(&putfd_1);
788 tempfile(&putfd_2);
789 dofstat(putfd_1, &putfd_1_stat);
790 dofstat(putfd_2, &putfd_2_stat);
791 sendfd(fd[0], putfd_1);
792 sendfd(fd[0], putfd_2);
793 close(putfd_1);
794 close(putfd_2);
795 recvfd(fd[1], &getfd_1, 0);
796 recvfd(fd[1], &getfd_2, 0);
797 dofstat(getfd_1, &getfd_1_stat);
798 dofstat(getfd_2, &getfd_2_stat);
799 samefile(&putfd_1_stat, &getfd_1_stat);
800 samefile(&putfd_2_stat, &getfd_2_stat);
801 close(getfd_1);
802 close(getfd_2);
803 closesocketpair(fd);
804 }
805
806 /*
807 * Big bundling test. Send an endpoint of the UNIX domain socket over itself,
808 * closing the door behind it.
809 */
810 ATF_TC_WITHOUT_HEAD(bundle);
ATF_TC_BODY(bundle,tc)811 ATF_TC_BODY(bundle, tc)
812 {
813 int fd[2], getfd;
814
815 domainsocketpair(fd);
816
817 sendfd(fd[0], fd[0]);
818 close(fd[0]);
819 recvfd(fd[1], &getfd, 0);
820 close(getfd);
821 close(fd[1]);
822 }
823
824 /*
825 * Big bundling test part two: Send an endpoint of the UNIX domain socket over
826 * itself, close the door behind it, and never remove it from the other end.
827 */
828 ATF_TC_WITHOUT_HEAD(bundle_cancel);
ATF_TC_BODY(bundle_cancel,tc)829 ATF_TC_BODY(bundle_cancel, tc)
830 {
831 int fd[2];
832
833 domainsocketpair(fd);
834 sendfd(fd[0], fd[0]);
835 sendfd(fd[1], fd[0]);
836 closesocketpair(fd);
837 }
838
839 /*
840 * Test for PR 151758: Send an character device over the UNIX domain socket
841 * and then close both sockets to orphan the device.
842 */
843 ATF_TC_WITHOUT_HEAD(devfs_orphan);
ATF_TC_BODY(devfs_orphan,tc)844 ATF_TC_BODY(devfs_orphan, tc)
845 {
846 int fd[2], putfd;
847
848 domainsocketpair(fd);
849 devnull(&putfd);
850 sendfd(fd[0], putfd);
851 close(putfd);
852 closesocketpair(fd);
853 }
854
855 /*
856 * Test for PR 181741. Receiver sets LOCAL_CREDS, and kernel prepends a
857 * control message to the data. Sender sends large payload using a non-blocking
858 * socket. Payload + SCM_RIGHTS + LOCAL_CREDS hit socket buffer limit, and
859 * receiver receives truncated data.
860 */
861 ATF_TC_WITHOUT_HEAD(rights_creds_payload);
ATF_TC_BODY(rights_creds_payload,tc)862 ATF_TC_BODY(rights_creds_payload, tc)
863 {
864 const int on = 1;
865 u_long sendspace;
866 ssize_t len, rlen;
867 void *buf;
868 int fd[2], getfd, putfd, rc;
869
870 sendspace = getsendspace();
871 buf = calloc(1, sendspace);
872 ATF_REQUIRE(buf != NULL);
873
874 domainsocketpair(fd);
875 tempfile(&putfd);
876
877 rc = fcntl(fd[0], F_SETFL, O_NONBLOCK);
878 ATF_REQUIRE_MSG(rc != -1, "fcntl(O_NONBLOCK) failed: %s",
879 strerror(errno));
880 rc = setsockopt(fd[1], 0, LOCAL_CREDS, &on, sizeof(on));
881 ATF_REQUIRE_MSG(rc != -1, "setsockopt(LOCAL_CREDS) failed: %s",
882 strerror(errno));
883
884 len = sendfd_payload(fd[0], putfd, buf, sendspace);
885 ATF_REQUIRE_MSG(len != -1 , "sendmsg failed: %s", strerror(errno));
886 #if TEST_PROTO == SOCK_STREAM
887 ATF_REQUIRE_MSG((size_t)len < sendspace,
888 "sendmsg: %zd bytes sent, expected < %lu", len, sendspace);
889 #endif
890 #if TEST_PROTO == SOCK_DGRAM
891 /*
892 * sendmsg(2) can't truncate datagrams, only recvmsg(2) can. There are
893 * two options for the kernel here: either accept the datagram with
894 * slight overcommit of the socket buffer space or return ENOBUFS for a
895 * datagram that is smaller or equal to the socket buffer space. Our
896 * implementation does overcommit. Explanation is simple: from our
897 * side we see space available, we have no idea that remote side has
898 * LOCAL_CREDS set. From our side we expect sendmsg(2) to succeed.
899 */
900 ATF_REQUIRE_MSG((size_t)len == sendspace,
901 "sendmsg: %zd bytes sent, expected %lu", len, sendspace);
902 #endif
903 rlen = recvfd_payload(fd[1], &getfd, buf, len,
904 CMSG_SPACE(SOCKCREDSIZE(CMGROUP_MAX)) + CMSG_SPACE(sizeof(int)), 0);
905 ATF_REQUIRE_MSG(rlen == len,
906 "recvmsg: %zd bytes received; expected %zd", rlen, len);
907
908 close(putfd);
909 close(getfd);
910 closesocketpair(fd);
911 }
912
913 static void
send_cmsg(int sockfd,void * cmsg,size_t cmsgsz)914 send_cmsg(int sockfd, void *cmsg, size_t cmsgsz)
915 {
916 struct iovec iov;
917 struct msghdr msghdr;
918 ssize_t len;
919 char ch;
920
921 ch = 0;
922 bzero(&msghdr, sizeof(msghdr));
923
924 iov.iov_base = &ch;
925 iov.iov_len = sizeof(ch);
926 msghdr.msg_control = cmsg;
927 msghdr.msg_controllen = cmsgsz;
928 msghdr.msg_iov = &iov;
929 msghdr.msg_iovlen = 1;
930
931 len = sendmsg(sockfd, &msghdr, 0);
932 ATF_REQUIRE_MSG(len != -1,
933 "sendmsg failed: %s", strerror(errno));
934 ATF_REQUIRE_MSG(len == sizeof(ch),
935 "sendmsg: %zd bytes sent; expected %zu", len, sizeof(ch));
936 }
937
938 static void
recv_cmsg(int sockfd,char * cmsg,size_t cmsgsz,int flags)939 recv_cmsg(int sockfd, char *cmsg, size_t cmsgsz, int flags)
940 {
941 struct iovec iov;
942 struct msghdr msghdr;
943 ssize_t len;
944 char ch;
945
946 ch = 0;
947 bzero(&msghdr, sizeof(msghdr));
948
949 iov.iov_base = &ch;
950 iov.iov_len = sizeof(ch);
951 msghdr.msg_control = cmsg;
952 msghdr.msg_controllen = cmsgsz;
953 msghdr.msg_iov = &iov;
954 msghdr.msg_iovlen = 1;
955
956 len = recvmsg(sockfd, &msghdr, 0);
957 ATF_REQUIRE_MSG(len != -1,
958 "recvmsg failed: %s", strerror(errno));
959 ATF_REQUIRE_MSG(len == sizeof(ch),
960 "recvmsg: %zd bytes received; expected %zu", len, sizeof(ch));
961 ATF_REQUIRE_MSG((msghdr.msg_flags & flags) == flags,
962 "recvmsg: got flags %#x; expected %#x", msghdr.msg_flags, flags);
963 }
964
965 /*
966 * Test for PR 131876. Receiver uses a control message buffer that is too
967 * small for the incoming SCM_RIGHTS message, so the message is truncated.
968 * The kernel must not leak the copied right into the receiver's namespace.
969 */
970 ATF_TC_WITHOUT_HEAD(truncated_rights);
ATF_TC_BODY(truncated_rights,tc)971 ATF_TC_BODY(truncated_rights, tc)
972 {
973 char *message;
974 int fd[2], nfds, putfd, rc;
975
976 domainsocketpair(fd);
977 devnull(&putfd);
978 nfds = getnfds();
979
980 /*
981 * Case 1: Send a single descriptor and truncate the message.
982 */
983 message = malloc(CMSG_SPACE(sizeof(int)));
984 ATF_REQUIRE(message != NULL);
985 putfds(message, putfd, 1);
986 send_cmsg(fd[0], message, CMSG_LEN(sizeof(int)));
987 recv_cmsg(fd[1], message, CMSG_LEN(0), MSG_CTRUNC);
988 ATF_REQUIRE(getnfds() == nfds);
989 free(message);
990
991 /*
992 * Case 2a: Send two descriptors in separate messages, and truncate at
993 * the boundary between the two messages. We should still
994 * receive the first message.
995 */
996 message = malloc(CMSG_SPACE(sizeof(int)) * 2);
997 ATF_REQUIRE(message != NULL);
998 putfds(message, putfd, 1);
999 putfds(message + CMSG_SPACE(sizeof(int)), putfd, 1);
1000 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int)) * 2);
1001 recv_cmsg(fd[1], message, CMSG_SPACE(sizeof(int)), MSG_CTRUNC);
1002 rc = close(*(int *)CMSG_DATA(message));
1003 ATF_REQUIRE_MSG(rc == 0, "close failed: %s", strerror(errno));
1004 ATF_REQUIRE(getnfds() == nfds);
1005 free(message);
1006
1007 /*
1008 * Case 2b: Send two descriptors in separate messages, and truncate
1009 * before the end of the first message.
1010 */
1011 message = malloc(CMSG_SPACE(sizeof(int)) * 2);
1012 ATF_REQUIRE(message != NULL);
1013 putfds(message, putfd, 1);
1014 putfds(message + CMSG_SPACE(sizeof(int)), putfd, 1);
1015 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int)) * 2);
1016 recv_cmsg(fd[1], message, CMSG_SPACE(0), MSG_CTRUNC);
1017 ATF_REQUIRE(getnfds() == nfds);
1018 free(message);
1019
1020 /*
1021 * Case 2c: Send two descriptors in separate messages, and truncate
1022 * after the end of the first message. We should still
1023 * receive the first message.
1024 */
1025 message = malloc(CMSG_SPACE(sizeof(int)) * 2);
1026 ATF_REQUIRE(message != NULL);
1027 putfds(message, putfd, 1);
1028 putfds(message + CMSG_SPACE(sizeof(int)), putfd, 1);
1029 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int)) * 2);
1030 recv_cmsg(fd[1], message, CMSG_SPACE(sizeof(int)) + CMSG_SPACE(0),
1031 MSG_CTRUNC);
1032 rc = close(*(int *)CMSG_DATA(message));
1033 ATF_REQUIRE_MSG(rc == 0, "close failed: %s", strerror(errno));
1034 ATF_REQUIRE(getnfds() == nfds);
1035 free(message);
1036
1037 /*
1038 * Case 3: Send three descriptors in the same message, and leave space
1039 * only for the first when receiving the message.
1040 */
1041 message = malloc(CMSG_SPACE(sizeof(int) * 3));
1042 ATF_REQUIRE(message != NULL);
1043 putfds(message, putfd, 3);
1044 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int) * 3));
1045 recv_cmsg(fd[1], message, CMSG_SPACE(sizeof(int)), MSG_CTRUNC);
1046 ATF_REQUIRE(getnfds() == nfds);
1047 free(message);
1048
1049 close(putfd);
1050 closesocketpair(fd);
1051 }
1052
1053 /*
1054 * Ensure that an attempt to copy a SCM_RIGHTS message to the recipient
1055 * fails. In this case the kernel must dispose of the externalized rights
1056 * rather than leaking them into the recipient's file descriptor table.
1057 */
1058 ATF_TC_WITHOUT_HEAD(copyout_rights_error);
ATF_TC_BODY(copyout_rights_error,tc)1059 ATF_TC_BODY(copyout_rights_error, tc)
1060 {
1061 struct iovec iovec;
1062 struct msghdr msghdr;
1063 char buf[16];
1064 ssize_t len;
1065 int fd[2], error, nfds, putfd;
1066
1067 memset(buf, 0, sizeof(buf));
1068 domainsocketpair(fd);
1069 devnull(&putfd);
1070 nfds = getnfds();
1071
1072 len = sendfd_payload(fd[0], putfd, buf, sizeof(buf));
1073 ATF_REQUIRE_MSG(len != -1, "sendmsg failed: %s", strerror(errno));
1074
1075 bzero(&msghdr, sizeof(msghdr));
1076
1077 iovec.iov_base = buf;
1078 iovec.iov_len = sizeof(buf);
1079 msghdr.msg_control = (char *)-1; /* trigger EFAULT */
1080 msghdr.msg_controllen = CMSG_SPACE(sizeof(int));
1081 msghdr.msg_iov = &iovec;
1082 msghdr.msg_iovlen = 1;
1083
1084 len = recvmsg(fd[1], &msghdr, 0);
1085 error = errno;
1086 ATF_REQUIRE_MSG(len == -1, "recvmsg succeeded: %zd", len);
1087 ATF_REQUIRE_MSG(errno == EFAULT, "expected EFAULT, got %d (%s)",
1088 error, strerror(errno));
1089
1090 /* Verify that no FDs were leaked. */
1091 ATF_REQUIRE(getnfds() == nfds);
1092
1093 close(putfd);
1094 closesocketpair(fd);
1095 }
1096
1097 /*
1098 * Exercise handling of errors from unp_externalize().
1099 */
1100 ATF_TC_WITHOUT_HEAD(externalize_error_partial_read);
ATF_TC_BODY(externalize_error_partial_read,tc)1101 ATF_TC_BODY(externalize_error_partial_read, tc)
1102 {
1103 struct iovec iovec;
1104 struct msghdr msghdr;
1105 struct rlimit rl, orl;
1106 struct stat sb;
1107 char cmsgbuf[CMSG_SPACE(sizeof(int))];
1108 char msg1[16];
1109 char *fill, *rbuf;
1110 size_t fillsz;
1111 #if TEST_PROTO == SOCK_STREAM
1112 size_t got;
1113 #endif
1114 ssize_t len;
1115 int fd[2], nfds, putfd;
1116
1117 memset(msg1, 'A', sizeof(msg1));
1118
1119 domainsocketpair(fd);
1120 devnull(&putfd);
1121 dofstat(putfd, &sb);
1122 nfds = getnfds();
1123
1124 #if TEST_PROTO == SOCK_STREAM
1125 fillsz = (size_t)getrecvspace() * 3 / 5;
1126 #elif TEST_PROTO == SOCK_DGRAM
1127 fillsz = 128;
1128 #endif
1129
1130 fill = malloc(fillsz);
1131 ATF_REQUIRE(fill != NULL);
1132 memset(fill, 'B', fillsz);
1133 rbuf = malloc(sizeof(msg1) + fillsz);
1134 ATF_REQUIRE(rbuf != NULL);
1135
1136 /*
1137 * The first message carries the rights and a small payload; the second
1138 * queues more data behind it, so that the read below leaves the receive
1139 * buffer non-empty.
1140 */
1141 len = sendfd_payload(fd[0], putfd, msg1, sizeof(msg1));
1142 ATF_REQUIRE_MSG(len == (ssize_t)sizeof(msg1),
1143 "sendmsg: %zd bytes sent; expected %zu: %s", len, sizeof(msg1),
1144 strerror(errno));
1145 len = send(fd[0], fill, fillsz, 0);
1146 ATF_REQUIRE_MSG(len == (ssize_t)fillsz,
1147 "send: %zd bytes sent; expected %zu: %s", len, fillsz,
1148 strerror(errno));
1149
1150 /*
1151 * Use fd limits to force receive to fail.
1152 */
1153 ATF_REQUIRE_MSG(getrlimit(RLIMIT_NOFILE, &orl) == 0,
1154 "getrlimit failed: %s", strerror(errno));
1155 rl = orl;
1156 rl.rlim_cur = 1;
1157 ATF_REQUIRE_MSG(setrlimit(RLIMIT_NOFILE, &rl) == 0,
1158 "setrlimit failed: %s", strerror(errno));
1159
1160 bzero(&msghdr, sizeof(msghdr));
1161 iovec.iov_base = rbuf;
1162 iovec.iov_len = sizeof(msg1);
1163 msghdr.msg_iov = &iovec;
1164 msghdr.msg_iovlen = 1;
1165 msghdr.msg_control = cmsgbuf;
1166 msghdr.msg_controllen = sizeof(cmsgbuf);
1167
1168 ATF_REQUIRE_ERRNO(EMFILE, recvmsg(fd[1], &msghdr, 0) == -1);
1169
1170 ATF_REQUIRE_MSG(setrlimit(RLIMIT_NOFILE, &orl) == 0,
1171 "setrlimit failed: %s", strerror(errno));
1172
1173 /* The rights must have been disposed of rather than installed. */
1174 ATF_REQUIRE_MSG(getnfds() == nfds, "descriptor leaked");
1175
1176 /*
1177 * The failed read must leave the socket usable with both payloads still
1178 * queued.
1179 */
1180 #if TEST_PROTO == SOCK_STREAM
1181 for (got = 0; got < sizeof(msg1) + fillsz; got += (size_t)len) {
1182 len = recv(fd[1], rbuf + got, sizeof(msg1) + fillsz - got, 0);
1183 if (len <= 0)
1184 break;
1185 }
1186 ATF_REQUIRE_MSG(got == sizeof(msg1) + fillsz,
1187 "recovered %zu of %zu bytes after the failed read: %s", got,
1188 sizeof(msg1) + fillsz, strerror(errno));
1189 ATF_REQUIRE_MSG(memcmp(rbuf, msg1, sizeof(msg1)) == 0,
1190 "first payload corrupted");
1191 ATF_REQUIRE_MSG(memcmp(rbuf + sizeof(msg1), fill, fillsz) == 0,
1192 "second payload corrupted");
1193 #elif TEST_PROTO == SOCK_DGRAM
1194 /*
1195 * For datagrams, soreceive_dgram() dequeues the record before
1196 * processing control messages, so the first datagram's payload is
1197 * consumed even when externalize fails. Only the second datagram
1198 * should remain queued.
1199 */
1200 len = recv(fd[1], rbuf, fillsz, 0);
1201 ATF_REQUIRE_MSG(len == (ssize_t)fillsz,
1202 "second datagram: got %zd bytes, expected %zu: %s", len, fillsz,
1203 strerror(errno));
1204 ATF_REQUIRE_MSG(memcmp(rbuf, fill, fillsz) == 0,
1205 "second payload corrupted");
1206 #endif
1207
1208 dofstat(putfd, &sb);
1209
1210 free(rbuf);
1211 free(fill);
1212 close(putfd);
1213 closesocketpair(fd);
1214 }
1215
1216 /*
1217 * Verify that we can handle empty rights messages.
1218 */
1219 ATF_TC_WITHOUT_HEAD(empty_rights_message);
ATF_TC_BODY(empty_rights_message,tc)1220 ATF_TC_BODY(empty_rights_message, tc)
1221 {
1222 struct iovec iov;
1223 struct msghdr msghdr;
1224 struct cmsghdr cmsg;
1225 char *cm, message[CMSG_SPACE(0) + CMSG_SPACE(sizeof(int))];
1226 ssize_t len;
1227 int error, fd[2], putfd;
1228
1229 domainsocketpair(fd);
1230 devnull(&putfd);
1231
1232 memset(&msghdr, 0, sizeof(msghdr));
1233 iov.iov_base = NULL;
1234 iov.iov_len = 0;
1235 msghdr.msg_iov = &iov;
1236 msghdr.msg_iovlen = 1;
1237
1238 /*
1239 * Try sending incorrect empty message. On 64-bit platforms, where
1240 * CMSG_SPACE(0) > sizeof(struct cmsghdr), this will exercise
1241 * an edge case.
1242 */
1243 cmsg = (struct cmsghdr ){
1244 .cmsg_len = sizeof(struct cmsghdr), /* not CMSG_LEN(0)! */
1245 .cmsg_level = SOL_SOCKET,
1246 .cmsg_type = SCM_RIGHTS,
1247 };
1248 msghdr.msg_control = &cmsg;
1249 msghdr.msg_controllen = CMSG_SPACE(0);
1250
1251 len = sendmsg(fd[0], &msghdr, 0);
1252 if (CMSG_LEN(0) != sizeof(struct cmsghdr))
1253 ATF_REQUIRE(len == -1 && errno == EINVAL);
1254 else
1255 ATF_REQUIRE(len == 0);
1256
1257 /*
1258 * Try sending an empty message followed by a non-empty message.
1259 */
1260 cm = message;
1261 putfds(cm, -1, 0);
1262 cm += CMSG_SPACE(0);
1263 putfds(cm, putfd, 1);
1264 msghdr.msg_control = message;
1265 msghdr.msg_controllen = sizeof(message);
1266
1267 len = sendmsg(fd[0], &msghdr, 0);
1268 ATF_REQUIRE_MSG(len == 0, "sendmsg failed: %s", strerror(errno));
1269
1270 /* Only the non-empty message should be received. */
1271 len = recvmsg(fd[1], &msghdr, 0);
1272 ATF_REQUIRE_MSG(len == 0, "recvmsg failed: %s", strerror(errno));
1273 ATF_REQUIRE(msghdr.msg_controllen == CMSG_SPACE(sizeof(int)));
1274 error = close(*(int *)CMSG_DATA(msghdr.msg_control));
1275 ATF_REQUIRE_MSG(error == 0, "close failed: %s", strerror(errno));
1276
1277 /*
1278 * Now try sending with the non-empty message before the empty message.
1279 */
1280 cm = message;
1281 putfds(cm, putfd, 1);
1282 cm += CMSG_SPACE(sizeof(int));
1283 putfds(cm, -1, 0);
1284
1285 memset(&msghdr, 0, sizeof(msghdr));
1286 iov.iov_base = NULL;
1287 iov.iov_len = 0;
1288 msghdr.msg_control = message;
1289 msghdr.msg_controllen = CMSG_SPACE(sizeof(int));
1290 msghdr.msg_iov = &iov;
1291 msghdr.msg_iovlen = 1;
1292
1293 len = sendmsg(fd[0], &msghdr, 0);
1294 ATF_REQUIRE_MSG(len == 0, "sendmsg failed: %s", strerror(errno));
1295
1296 /* Only the non-empty message should be received. */
1297 len = recvmsg(fd[1], &msghdr, 0);
1298 ATF_REQUIRE_MSG(len == 0, "recvmsg failed: %s", strerror(errno));
1299 ATF_REQUIRE(msghdr.msg_controllen == CMSG_SPACE(sizeof(int)));
1300 error = close(*(int *)CMSG_DATA(msghdr.msg_control));
1301 ATF_REQUIRE_MSG(error == 0, "close failed: %s", strerror(errno));
1302
1303 (void)close(putfd);
1304 }
1305
1306 /*
1307 * Exercise a corner case where the receiving socket buffer has exactly enough
1308 * space for a single fd cmsg.
1309 */
1310 ATF_TC_WITHOUT_HEAD(nonblocking_passfd_ctl_space);
ATF_TC_BODY(nonblocking_passfd_ctl_space,tc)1311 ATF_TC_BODY(nonblocking_passfd_ctl_space, tc)
1312 {
1313 static char chunk[65536];
1314 size_t chunksz, room;
1315 ssize_t n;
1316 int delivered, fd[2], putfd;
1317
1318 devnull(&putfd);
1319 chunksz = getsendspace();
1320 ATF_REQUIRE(chunksz <= sizeof(chunk));
1321
1322 /*
1323 * How much space does a single internalized fd take?
1324 */
1325 domainsocketpair(fd);
1326 ATF_REQUIRE_MSG(sendfd_payload(fd[0], putfd, chunk, 0) == 0,
1327 "sendmsg: %s", strerror(errno));
1328 ATF_REQUIRE_MSG(fcntl(fd[0], F_SETFL, O_NONBLOCK) != -1,
1329 "fcntl: %s", strerror(errno));
1330 for (room = 0; (n = send(fd[0], chunk, chunksz, 0)) > 0; )
1331 room += (size_t)n;
1332 ATF_REQUIRE(errno == EAGAIN || errno == ENOBUFS);
1333 closesocketpair(fd);
1334
1335 /*
1336 * Fill the socket buffer, leaving exactly enough room for a single fd
1337 * cmsg.
1338 */
1339 domainsocketpair(fd);
1340 for (size_t sofar = 0; sofar < room; sofar += (size_t)n) {
1341 size_t req;
1342
1343 req = room - sofar;
1344 if (req > chunksz)
1345 req = chunksz;
1346 n = send(fd[0], chunk, (size_t)req, 0);
1347 ATF_REQUIRE_MSG(n > 0, "fill send: %s", strerror(errno));
1348 }
1349 ATF_REQUIRE_MSG(fcntl(fd[0], F_SETFL, O_NONBLOCK) != -1,
1350 "fcntl: %s", strerror(errno));
1351 ATF_REQUIRE_MSG(sendfd_payload(fd[0], putfd, chunk, 0) == 0,
1352 "zero-length sendmsg with SCM_RIGHTS failed: %s", strerror(errno));
1353
1354 /* Drain receiver and verify the fd was delivered. */
1355 delivered = 0;
1356 {
1357 static char buf[1 << 20];
1358 char cmsgbuf[CMSG_SPACE(sizeof(int) * 8)];
1359 struct iovec iov;
1360 struct msghdr msghdr;
1361
1362 memset(&msghdr, 0, sizeof(msghdr));
1363 iov.iov_base = buf;
1364 iov.iov_len = sizeof(buf);
1365 msghdr.msg_iov = &iov;
1366 msghdr.msg_iovlen = 1;
1367 msghdr.msg_control = cmsgbuf;
1368 msghdr.msg_controllen = sizeof(cmsgbuf);
1369 while ((n = recvmsg(fd[1], &msghdr, MSG_DONTWAIT)) >= 0) {
1370 for (struct cmsghdr *cm = CMSG_FIRSTHDR(&msghdr);
1371 cm != NULL; cm = CMSG_NXTHDR(&msghdr, cm)) {
1372 if (cm->cmsg_level == SOL_SOCKET &&
1373 cm->cmsg_type == SCM_RIGHTS) {
1374 int rxfd;
1375
1376 memcpy(&rxfd, CMSG_DATA(cm),
1377 sizeof(rxfd));
1378 ATF_CHECK(close(rxfd) == 0);
1379 delivered++;
1380 }
1381 }
1382 msghdr.msg_controllen = sizeof(cmsgbuf);
1383 }
1384 }
1385 ATF_CHECK_MSG(delivered == 1, "expected 1 fd delivered, got %d",
1386 delivered);
1387
1388 closesocketpair(fd);
1389 ATF_CHECK(close(putfd) == 0);
1390 }
1391
1392 /*
1393 * Check that sending control creates records in a stream socket, making it
1394 * behave like a seqpacket socket. If we stack several control+data writes
1395 * on a stream socket, we won't be able to read them all at once, even if we
1396 * provide a buffer large enough to receive all at once.
1397 *
1398 * XXXGL: adding MSG_WAITALL to the recvmsg() flags will make this test stuck.
1399 */
1400 ATF_TC_WITHOUT_HEAD(control_creates_records);
ATF_TC_BODY(control_creates_records,tc)1401 ATF_TC_BODY(control_creates_records, tc)
1402 {
1403 int fd[2], putfd, getfd;
1404 char buf[2];
1405 ssize_t rlen;
1406
1407 domainsocketpair(fd);
1408 tempfile(&putfd);
1409
1410 for (int i = 1; i <= 2; i++)
1411 ATF_REQUIRE(sendfd_payload(fd[0], putfd, buf, 1) == 1);
1412 ATF_REQUIRE(close(putfd) == 0);
1413 for (int i = 1; i <= 2; i++) {
1414 rlen = recvfd_payload(fd[1], &getfd, buf, 2,
1415 CMSG_SPACE(sizeof(int)) * 2, 0);
1416 ATF_REQUIRE_MSG(rlen == 1,
1417 "recvmsg: %zd bytes received; expected 1", rlen);
1418 ATF_REQUIRE(close(getfd) == 0);
1419 }
1420 closesocketpair(fd);
1421 }
1422
1423 ATF_TC_WITH_CLEANUP(cross_jail_dirfd);
ATF_TC_HEAD(cross_jail_dirfd,tc)1424 ATF_TC_HEAD(cross_jail_dirfd, tc)
1425 {
1426 atf_tc_set_md_var(tc, "require.user", "root");
1427 }
ATF_TC_BODY(cross_jail_dirfd,tc)1428 ATF_TC_BODY(cross_jail_dirfd, tc)
1429 {
1430 int error, sock[2], jid1, jid2, status;
1431 pid_t pid1, pid2;
1432
1433 domainsocketpair(sock);
1434
1435 error = mkdir("./a", 0755);
1436 ATF_REQUIRE(error == 0);
1437 error = mkdir("./b", 0755);
1438 ATF_REQUIRE(error == 0);
1439 error = mkdir("./c", 0755);
1440 ATF_REQUIRE(error == 0);
1441 error = mkdir("./a/c", 0755);
1442 ATF_REQUIRE(error == 0);
1443
1444 jid1 = jail_setv(JAIL_CREATE,
1445 "name", "passfd_test_cross_jail_dirfd1",
1446 "path", "./a",
1447 "persist", NULL,
1448 NULL);
1449 ATF_REQUIRE_MSG(jid1 >= 0, "jail_setv: %s", jail_errmsg);
1450
1451 jid2 = jail_setv(JAIL_CREATE,
1452 "name", "passfd_test_cross_jail_dirfd2",
1453 "path", "./b",
1454 "persist", NULL,
1455 NULL);
1456 ATF_REQUIRE_MSG(jid2 >= 0, "jail_setv: %s", jail_errmsg);
1457
1458 pid1 = fork();
1459 ATF_REQUIRE(pid1 >= 0);
1460 if (pid1 == 0) {
1461 ssize_t len;
1462 int dfd, error;
1463 char ch;
1464
1465 error = jail_attach(jid1);
1466 if (error != 0)
1467 err(1, "jail_attach");
1468
1469 dfd = open(".", O_RDONLY | O_DIRECTORY);
1470 if (dfd < 0)
1471 err(1, "open(\".\") in jail %d", jid1);
1472
1473 ch = 0;
1474 len = sendfd_payload(sock[0], dfd, &ch, sizeof(ch));
1475 if (len == -1)
1476 err(1, "sendmsg");
1477
1478 _exit(0);
1479 }
1480
1481 pid2 = fork();
1482 ATF_REQUIRE(pid2 >= 0);
1483 if (pid2 == 0) {
1484 ssize_t len;
1485 int dfd, dfd2, error, fd;
1486 char ch;
1487
1488 error = jail_attach(jid2);
1489 if (error != 0)
1490 err(1, "jail_attach");
1491
1492 /* Get a directory from outside the jail root. */
1493 len = recvfd_payload(sock[1], &dfd, &ch, sizeof(ch),
1494 CMSG_SPACE(sizeof(int)), 0);
1495 if (len == -1)
1496 err(1, "recvmsg");
1497
1498 if ((fcntl(dfd, F_GETFD) & FD_RESOLVE_BENEATH) == 0)
1499 errx(1, "dfd does not have FD_RESOLVE_BENEATH set");
1500
1501 /* Make sure we can't chdir. */
1502 error = fchdir(dfd);
1503 if (error == 0)
1504 errx(1, "fchdir succeeded");
1505 if (errno != ENOTCAPABLE)
1506 err(1, "fchdir");
1507
1508 /* Make sure a dotdot access fails. */
1509 fd = openat(dfd, "../c", O_RDONLY | O_DIRECTORY);
1510 if (fd >= 0)
1511 errx(1, "openat(\"../c\") succeeded");
1512 if (errno != ENOTCAPABLE)
1513 err(1, "openat");
1514
1515 /* Accesses within the sender's jail root are ok. */
1516 fd = openat(dfd, "c", O_RDONLY | O_DIRECTORY);
1517 if (fd < 0)
1518 err(1, "openat(\"c\")");
1519
1520 dfd2 = openat(dfd, "", O_EMPTY_PATH | O_RDONLY | O_DIRECTORY);
1521 if (dfd2 < 0)
1522 err(1, "openat(\"\")");
1523 if ((fcntl(dfd2, F_GETFD) & FD_RESOLVE_BENEATH) == 0)
1524 errx(1, "dfd2 does not have FD_RESOLVE_BENEATH set");
1525
1526 _exit(0);
1527 }
1528
1529 error = waitpid(pid1, &status, 0);
1530 ATF_REQUIRE(error != -1);
1531 ATF_REQUIRE(WIFEXITED(status));
1532 ATF_REQUIRE(WEXITSTATUS(status) == 0);
1533 error = waitpid(pid2, &status, 0);
1534 ATF_REQUIRE(error != -1);
1535 ATF_REQUIRE(WIFEXITED(status));
1536 ATF_REQUIRE(WEXITSTATUS(status) == 0);
1537
1538 closesocketpair(sock);
1539 }
ATF_TC_CLEANUP(cross_jail_dirfd,tc)1540 ATF_TC_CLEANUP(cross_jail_dirfd, tc)
1541 {
1542 int jid;
1543
1544 jid = jail_getid("passfd_test_cross_jail_dirfd1");
1545 if (jid >= 0 && jail_remove(jid) != 0)
1546 err(1, "jail_remove");
1547 jid = jail_getid("passfd_test_cross_jail_dirfd2");
1548 if (jid >= 0 && jail_remove(jid) != 0)
1549 err(1, "jail_remove");
1550 }
1551
1552 /*
1553 * Verify that FD_RESOLVE_BENEATH is preserved when an fd is passed over a UNIX
1554 * domain socket.
1555 */
1556 ATF_TC_WITHOUT_HEAD(resolve_beneath_preserved);
ATF_TC_BODY(resolve_beneath_preserved,tc)1557 ATF_TC_BODY(resolve_beneath_preserved, tc)
1558 {
1559 int fd[2], getfd, putfd, fdflags;
1560
1561 domainsocketpair(fd);
1562 tempfile(&putfd);
1563
1564 fdflags = fcntl(putfd, F_GETFD);
1565 ATF_REQUIRE(fdflags != -1);
1566 ATF_REQUIRE(fcntl(putfd, F_SETFD, fdflags | FD_RESOLVE_BENEATH) != -1);
1567 ATF_REQUIRE((fcntl(putfd, F_GETFD) & FD_RESOLVE_BENEATH) != 0);
1568
1569 sendfd(fd[0], putfd);
1570 recvfd(fd[1], &getfd, 0);
1571
1572 fdflags = fcntl(getfd, F_GETFD);
1573 ATF_REQUIRE(fdflags != -1);
1574 ATF_REQUIRE_MSG((fdflags & FD_RESOLVE_BENEATH) != 0,
1575 "FD_RESOLVE_BENEATH was not preserved across SCM_RIGHTS transfer");
1576
1577 ATF_REQUIRE(close(putfd) == 0);
1578 ATF_REQUIRE(close(getfd) == 0);
1579 closesocketpair(fd);
1580 }
1581
1582 ATF_TC_WITHOUT_HEAD(listening_socket);
ATF_TC_BODY(listening_socket,tc)1583 ATF_TC_BODY(listening_socket, tc)
1584 {
1585 struct sockaddr_un sun;
1586 int error, ls, s[2];
1587
1588 ls = socket(AF_UNIX, SOCK_STREAM, 0);
1589 ATF_REQUIRE(ls != -1);
1590
1591 memset(&sun, 0, sizeof(sun));
1592 sun.sun_len = sizeof(sun);
1593 sun.sun_family = AF_UNIX;
1594 snprintf(sun.sun_path, sizeof(sun.sun_path), "listen.sock");
1595 error = bind(ls, (struct sockaddr *)&sun, sizeof(sun));
1596 ATF_REQUIRE_MSG(error == 0, "bind failed: %s", strerror(errno));
1597 error = listen(ls, 0);
1598
1599 error = socketpair(AF_UNIX, SOCK_STREAM, 0, s);
1600 ATF_REQUIRE_MSG(error == 0, "socketpair failed: %s", strerror(errno));
1601
1602 sendfd(s[0], ls);
1603 sendfd(s[0], s[0]);
1604 sendfd(s[0], s[1]);
1605 close(ls);
1606 close(s[0]);
1607 close(s[1]);
1608 }
1609
ATF_TP_ADD_TCS(tp)1610 ATF_TP_ADD_TCS(tp)
1611 {
1612
1613 ATF_TP_ADD_TC(tp, simple_send_fd);
1614 ATF_TP_ADD_TC(tp, simple_send_fd_msg_cmsg_cloexec);
1615 ATF_TP_ADD_TC(tp, simple_send_fd_msg_cmsg_clofork);
1616 ATF_TP_ADD_TC(tp, send_and_close);
1617 ATF_TP_ADD_TC(tp, send_and_cancel);
1618 ATF_TP_ADD_TC(tp, send_and_shutdown);
1619 ATF_TP_ADD_TC(tp, send_a_lot);
1620 ATF_TP_ADD_TC(tp, send_overflow);
1621 ATF_TP_ADD_TC(tp, send_rejected);
1622 ATF_TP_ADD_TC(tp, send_rejected_late);
1623 ATF_TP_ADD_TC(tp, send_rejected_noinherit);
1624 ATF_TP_ADD_TC(tp, peek);
1625 ATF_TP_ADD_TC(tp, two_files);
1626 ATF_TP_ADD_TC(tp, bundle);
1627 ATF_TP_ADD_TC(tp, bundle_cancel);
1628 ATF_TP_ADD_TC(tp, devfs_orphan);
1629 ATF_TP_ADD_TC(tp, rights_creds_payload);
1630 ATF_TP_ADD_TC(tp, truncated_rights);
1631 ATF_TP_ADD_TC(tp, copyout_rights_error);
1632 ATF_TP_ADD_TC(tp, externalize_error_partial_read);
1633 ATF_TP_ADD_TC(tp, empty_rights_message);
1634 ATF_TP_ADD_TC(tp, nonblocking_passfd_ctl_space);
1635 ATF_TP_ADD_TC(tp, control_creates_records);
1636 ATF_TP_ADD_TC(tp, cross_jail_dirfd);
1637 ATF_TP_ADD_TC(tp, resolve_beneath_preserved);
1638 ATF_TP_ADD_TC(tp, listening_socket);
1639
1640 return (atf_no_error());
1641 }
1642