1 /*-
2 * Copyright (c) 1982, 1986, 1989, 1990, 1993
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 */
30
31 #include <sys/cdefs.h>
32 #include "opt_capsicum.h"
33 #include "opt_sctp.h"
34 #include "opt_ktrace.h"
35
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/capsicum.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/mutex.h>
42 #include <sys/sysproto.h>
43 #include <sys/malloc.h>
44 #include <sys/filedesc.h>
45 #include <sys/event.h>
46 #include <sys/proc.h>
47 #include <sys/fcntl.h>
48 #include <sys/file.h>
49 #include <sys/filio.h>
50 #include <sys/jail.h>
51 #include <sys/mount.h>
52 #include <sys/mbuf.h>
53 #include <sys/protosw.h>
54 #include <sys/sf_buf.h>
55 #include <sys/sysent.h>
56 #include <sys/socket.h>
57 #include <sys/socketvar.h>
58 #include <sys/signalvar.h>
59 #include <sys/syscall.h>
60 #include <sys/syscallsubr.h>
61 #include <sys/sysctl.h>
62 #include <sys/uio.h>
63 #include <sys/vnode.h>
64 #ifdef KTRACE
65 #include <sys/ktrace.h>
66 #endif
67 #ifdef COMPAT_FREEBSD32
68 #include <compat/freebsd32/freebsd32.h>
69 #include <compat/freebsd32/freebsd32_syscall.h>
70 #include <compat/freebsd32/freebsd32_util.h>
71 #endif
72
73 #include <net/vnet.h>
74
75 #include <security/audit/audit.h>
76 #include <security/mac/mac_framework.h>
77
78 #include <netinet/sctp.h>
79 #include <netinet/sctp_os_bsd.h>
80 #include <netinet/sctp_peeloff.h>
81
82 static struct syscall_helper_data sctp_syscalls[] = {
83 SYSCALL_INIT_HELPER_F(sctp_peeloff, SYF_CAPENABLED),
84 SYSCALL_INIT_HELPER_F(sctp_generic_sendmsg, SYF_CAPENABLED),
85 SYSCALL_INIT_HELPER_F(sctp_generic_sendmsg_iov, SYF_CAPENABLED),
86 SYSCALL_INIT_HELPER_F(sctp_generic_recvmsg, SYF_CAPENABLED),
87 SYSCALL_INIT_LAST
88 };
89
90 #ifdef COMPAT_FREEBSD32
91 static struct syscall_helper_data sctp32_syscalls[] = {
92 SYSCALL32_INIT_HELPER_COMPAT(sctp_peeloff),
93 SYSCALL32_INIT_HELPER_COMPAT(sctp_generic_sendmsg),
94 SYSCALL32_INIT_HELPER_COMPAT(sctp_generic_sendmsg_iov),
95 SYSCALL32_INIT_HELPER_COMPAT(sctp_generic_recvmsg),
96 SYSCALL_INIT_LAST
97 };
98 #endif
99
100 int
sctp_syscalls_init(void)101 sctp_syscalls_init(void)
102 {
103 int error;
104
105 error = syscall_helper_register(sctp_syscalls, SY_THR_STATIC_KLD);
106 if (error != 0)
107 return (error);
108 #ifdef COMPAT_FREEBSD32
109 error = syscall32_helper_register(sctp32_syscalls, SY_THR_STATIC_KLD);
110 if (error != 0)
111 return (error);
112 #endif
113 return (0);
114 }
115
116 #ifdef SCTP
117 SYSINIT(sctp_syscalls, SI_SUB_SYSCALLS, SI_ORDER_ANY, sctp_syscalls_init, NULL);
118 #endif
119
120 int
sctp_syscalls_uninit(void)121 sctp_syscalls_uninit(void)
122 {
123 int error;
124
125 #ifdef COMPAT_FREEBSD32
126 error = syscall32_helper_unregister(sctp32_syscalls);
127 if (error != 0)
128 return (error);
129 #endif
130 error = syscall_helper_unregister(sctp_syscalls);
131 if (error != 0)
132 return (error);
133 return (0);
134 }
135
136 /*
137 * SCTP syscalls.
138 */
139 int
sys_sctp_peeloff(struct thread * td,struct sctp_peeloff_args * uap)140 sys_sctp_peeloff(struct thread *td, struct sctp_peeloff_args *uap)
141 {
142 struct file *headfp, *nfp = NULL;
143 struct socket *head, *so;
144 struct filecaps fcaps;
145 cap_rights_t rights;
146 u_int fflag;
147 int error, fd;
148
149 AUDIT_ARG_FD(uap->sd);
150 error = getsock_cap(td, uap->sd,
151 cap_rights_init_one(&rights, CAP_PEELOFF), &headfp, &fcaps);
152 if (error != 0)
153 goto done2;
154 fflag = atomic_load_int(&headfp->f_flag);
155 head = headfp->f_data;
156 if (head->so_proto->pr_protocol != IPPROTO_SCTP) {
157 error = EOPNOTSUPP;
158 goto done;
159 }
160 error = sctp_can_peel_off(head, (sctp_assoc_t)uap->name);
161 if (error != 0)
162 goto done;
163 /*
164 * At this point we know we do have a assoc to pull
165 * we proceed to get the fd setup. This may block
166 * but that is ok.
167 */
168
169 error = falloc_caps(td, &nfp, &fd, 0, &fcaps);
170 if (error != 0)
171 goto done;
172 td->td_retval[0] = fd;
173
174 CURVNET_SET(head->so_vnet);
175 so = sopeeloff(head);
176 if (so == NULL) {
177 error = ENOMEM;
178 goto noconnection;
179 }
180 finit(nfp, fflag, DTYPE_SOCKET, so, &socketops);
181 error = sctp_do_peeloff(head, so, (sctp_assoc_t)uap->name);
182 if (error != 0)
183 goto noconnection;
184 if (head->so_sigio != NULL)
185 fsetown(fgetown(&head->so_sigio), &so->so_sigio);
186
187 noconnection:
188 /*
189 * close the new descriptor, assuming someone hasn't ripped it
190 * out from under us.
191 */
192 if (error != 0)
193 fdclose(td, nfp, fd);
194
195 /*
196 * Release explicitly held references before returning.
197 */
198 CURVNET_RESTORE();
199 done:
200 if (nfp != NULL)
201 fdrop(nfp, td);
202 fdrop(headfp, td);
203 done2:
204 return (error);
205 }
206
207 int
sys_sctp_generic_sendmsg(struct thread * td,struct sctp_generic_sendmsg_args * uap)208 sys_sctp_generic_sendmsg(struct thread *td, struct sctp_generic_sendmsg_args *uap)
209 {
210 struct sctp_sndrcvinfo sinfo, *u_sinfo = NULL;
211 struct socket *so;
212 struct file *fp = NULL;
213 struct sockaddr *to = NULL;
214 #ifdef KTRACE
215 struct uio *ktruio = NULL;
216 #endif
217 struct uio auio;
218 struct iovec iov[1];
219 cap_rights_t rights;
220 int error = 0, len;
221
222 if (uap->sinfo != NULL) {
223 error = copyin(uap->sinfo, &sinfo, sizeof (sinfo));
224 if (error != 0)
225 return (error);
226 u_sinfo = &sinfo;
227 }
228
229 cap_rights_init_one(&rights, CAP_SEND);
230 if (uap->tolen != 0) {
231 error = getsockaddr(&to, uap->to, uap->tolen);
232 if (error != 0) {
233 to = NULL;
234 goto sctp_bad2;
235 }
236 cap_rights_set_one(&rights, CAP_CONNECT);
237 }
238
239 AUDIT_ARG_FD(uap->sd);
240 error = getsock(td, uap->sd, &rights, &fp);
241 if (error != 0)
242 goto sctp_bad;
243 #ifdef KTRACE
244 if (to && (KTRPOINT(td, KTR_STRUCT)))
245 ktrsockaddr(to);
246 #endif
247
248 iov[0].iov_base = uap->msg;
249 iov[0].iov_len = uap->mlen;
250
251 so = (struct socket *)fp->f_data;
252 if (so->so_proto->pr_protocol != IPPROTO_SCTP) {
253 error = EOPNOTSUPP;
254 goto sctp_bad;
255 }
256 #ifdef MAC
257 error = mac_socket_check_send(td->td_ucred, so);
258 if (error != 0)
259 goto sctp_bad;
260 #endif /* MAC */
261
262 auio.uio_iov = iov;
263 auio.uio_iovcnt = 1;
264 auio.uio_segflg = UIO_USERSPACE;
265 auio.uio_rw = UIO_WRITE;
266 auio.uio_td = td;
267 auio.uio_offset = 0; /* XXX */
268 auio.uio_resid = 0;
269 #ifdef KTRACE
270 if (KTRPOINT(td, KTR_GENIO))
271 ktruio = cloneuio(&auio);
272 #endif /* KTRACE */
273 len = auio.uio_resid = uap->mlen;
274 CURVNET_SET(so->so_vnet);
275 error = sctp_lower_sosend(so, to, &auio, (struct mbuf *)NULL,
276 (struct mbuf *)NULL, uap->flags, u_sinfo, td);
277 CURVNET_RESTORE();
278 if (error != 0) {
279 if (auio.uio_resid != len && (error == ERESTART ||
280 error == EINTR || error == EWOULDBLOCK))
281 error = 0;
282 /* Generation of SIGPIPE can be controlled per socket. */
283 if (error == EPIPE && !(so->so_options & SO_NOSIGPIPE) &&
284 !(uap->flags & MSG_NOSIGNAL)) {
285 PROC_LOCK(td->td_proc);
286 tdsignal(td, SIGPIPE);
287 PROC_UNLOCK(td->td_proc);
288 }
289 }
290 if (error == 0)
291 td->td_retval[0] = len - auio.uio_resid;
292 #ifdef KTRACE
293 if (ktruio != NULL) {
294 if (error == 0)
295 ktruio->uio_resid = td->td_retval[0];
296 ktrgenio(uap->sd, UIO_WRITE, ktruio, error);
297 }
298 #endif /* KTRACE */
299 sctp_bad:
300 if (fp != NULL)
301 fdrop(fp, td);
302 sctp_bad2:
303 free(to, M_SONAME);
304 return (error);
305 }
306
307 int
sys_sctp_generic_sendmsg_iov(struct thread * td,struct sctp_generic_sendmsg_iov_args * uap)308 sys_sctp_generic_sendmsg_iov(struct thread *td, struct sctp_generic_sendmsg_iov_args *uap)
309 {
310 struct sctp_sndrcvinfo sinfo, *u_sinfo = NULL;
311 struct socket *so;
312 struct file *fp = NULL;
313 struct sockaddr *to = NULL;
314 #ifdef KTRACE
315 struct uio *ktruio = NULL;
316 #endif
317 struct uio auio;
318 struct iovec *iov, *tiov;
319 cap_rights_t rights;
320 ssize_t len;
321 int error, i;
322
323 if (uap->sinfo != NULL) {
324 error = copyin(uap->sinfo, &sinfo, sizeof (sinfo));
325 if (error != 0)
326 return (error);
327 u_sinfo = &sinfo;
328 }
329 cap_rights_init_one(&rights, CAP_SEND);
330 if (uap->tolen != 0) {
331 error = getsockaddr(&to, uap->to, uap->tolen);
332 if (error != 0) {
333 to = NULL;
334 goto sctp_bad2;
335 }
336 cap_rights_set_one(&rights, CAP_CONNECT);
337 }
338
339 AUDIT_ARG_FD(uap->sd);
340 error = getsock(td, uap->sd, &rights, &fp);
341 if (error != 0)
342 goto sctp_bad1;
343
344 #ifdef COMPAT_FREEBSD32
345 if (SV_CURPROC_FLAG(SV_ILP32))
346 error = freebsd32_copyiniov((struct iovec32 *)uap->iov,
347 uap->iovlen, &iov, EMSGSIZE);
348 else
349 #endif
350 error = copyiniov(uap->iov, uap->iovlen, &iov, EMSGSIZE);
351 if (error != 0)
352 goto sctp_bad1;
353 #ifdef KTRACE
354 if (to && (KTRPOINT(td, KTR_STRUCT)))
355 ktrsockaddr(to);
356 #endif
357
358 so = (struct socket *)fp->f_data;
359 if (so->so_proto->pr_protocol != IPPROTO_SCTP) {
360 error = EOPNOTSUPP;
361 goto sctp_bad;
362 }
363 #ifdef MAC
364 error = mac_socket_check_send(td->td_ucred, so);
365 if (error != 0)
366 goto sctp_bad;
367 #endif /* MAC */
368
369 auio.uio_iov = iov;
370 auio.uio_iovcnt = uap->iovlen;
371 auio.uio_segflg = UIO_USERSPACE;
372 auio.uio_rw = UIO_WRITE;
373 auio.uio_td = td;
374 auio.uio_offset = 0; /* XXX */
375 auio.uio_resid = 0;
376 tiov = iov;
377 for (i = 0; i <uap->iovlen; i++, tiov++) {
378 if ((auio.uio_resid += tiov->iov_len) < 0) {
379 error = EINVAL;
380 goto sctp_bad;
381 }
382 }
383 #ifdef KTRACE
384 if (KTRPOINT(td, KTR_GENIO))
385 ktruio = cloneuio(&auio);
386 #endif /* KTRACE */
387 len = auio.uio_resid;
388 CURVNET_SET(so->so_vnet);
389 error = sctp_lower_sosend(so, to, &auio,
390 (struct mbuf *)NULL, (struct mbuf *)NULL,
391 uap->flags, u_sinfo, td);
392 CURVNET_RESTORE();
393 if (error != 0) {
394 if (auio.uio_resid != len && (error == ERESTART ||
395 error == EINTR || error == EWOULDBLOCK))
396 error = 0;
397 /* Generation of SIGPIPE can be controlled per socket */
398 if (error == EPIPE && !(so->so_options & SO_NOSIGPIPE) &&
399 !(uap->flags & MSG_NOSIGNAL)) {
400 PROC_LOCK(td->td_proc);
401 tdsignal(td, SIGPIPE);
402 PROC_UNLOCK(td->td_proc);
403 }
404 }
405 if (error == 0)
406 td->td_retval[0] = len - auio.uio_resid;
407 #ifdef KTRACE
408 if (ktruio != NULL) {
409 if (error == 0)
410 ktruio->uio_resid = td->td_retval[0];
411 ktrgenio(uap->sd, UIO_WRITE, ktruio, error);
412 }
413 #endif /* KTRACE */
414 sctp_bad:
415 free(iov, M_IOV);
416 sctp_bad1:
417 if (fp != NULL)
418 fdrop(fp, td);
419 sctp_bad2:
420 free(to, M_SONAME);
421 return (error);
422 }
423
424 int
sys_sctp_generic_recvmsg(struct thread * td,struct sctp_generic_recvmsg_args * uap)425 sys_sctp_generic_recvmsg(struct thread *td, struct sctp_generic_recvmsg_args *uap)
426 {
427 uint8_t sockbufstore[256];
428 struct uio auio;
429 struct iovec *iov, *tiov;
430 struct sctp_sndrcvinfo sinfo;
431 struct socket *so;
432 struct file *fp = NULL;
433 struct sockaddr *fromsa;
434 cap_rights_t rights;
435 #ifdef KTRACE
436 struct uio *ktruio = NULL;
437 #endif
438 ssize_t len;
439 int error, fromlen, i, msg_flags;
440
441 AUDIT_ARG_FD(uap->sd);
442 error = getsock(td, uap->sd, cap_rights_init_one(&rights, CAP_RECV),
443 &fp);
444 if (error != 0)
445 return (error);
446 #ifdef COMPAT_FREEBSD32
447 if (SV_CURPROC_FLAG(SV_ILP32))
448 error = freebsd32_copyiniov((struct iovec32 *)uap->iov,
449 uap->iovlen, &iov, EMSGSIZE);
450 else
451 #endif
452 error = copyiniov(uap->iov, uap->iovlen, &iov, EMSGSIZE);
453 if (error != 0)
454 goto out1;
455
456 so = fp->f_data;
457 if (so->so_proto->pr_protocol != IPPROTO_SCTP) {
458 error = EOPNOTSUPP;
459 goto out;
460 }
461 #ifdef MAC
462 error = mac_socket_check_receive(td->td_ucred, so);
463 if (error != 0)
464 goto out;
465 #endif /* MAC */
466
467 if (uap->fromlenaddr != NULL) {
468 error = copyin(uap->fromlenaddr, &fromlen, sizeof (fromlen));
469 if (error != 0)
470 goto out;
471 } else {
472 fromlen = 0;
473 }
474 if (uap->msg_flags) {
475 error = copyin(uap->msg_flags, &msg_flags, sizeof (int));
476 if (error != 0)
477 goto out;
478 } else {
479 msg_flags = 0;
480 }
481 auio.uio_iov = iov;
482 auio.uio_iovcnt = uap->iovlen;
483 auio.uio_segflg = UIO_USERSPACE;
484 auio.uio_rw = UIO_READ;
485 auio.uio_td = td;
486 auio.uio_offset = 0; /* XXX */
487 auio.uio_resid = 0;
488 tiov = iov;
489 for (i = 0; i <uap->iovlen; i++, tiov++) {
490 if ((auio.uio_resid += tiov->iov_len) < 0) {
491 error = EINVAL;
492 goto out;
493 }
494 }
495 len = auio.uio_resid;
496 fromsa = (struct sockaddr *)sockbufstore;
497
498 #ifdef KTRACE
499 if (KTRPOINT(td, KTR_GENIO))
500 ktruio = cloneuio(&auio);
501 #endif /* KTRACE */
502 memset(&sinfo, 0, sizeof(struct sctp_sndrcvinfo));
503 CURVNET_SET(so->so_vnet);
504 error = sctp_sorecvmsg(so, &auio, (struct mbuf **)NULL,
505 fromsa, fromlen, &msg_flags,
506 (struct sctp_sndrcvinfo *)&sinfo, 1);
507 CURVNET_RESTORE();
508 if (error != 0) {
509 if (auio.uio_resid != len && (error == ERESTART ||
510 error == EINTR || error == EWOULDBLOCK))
511 error = 0;
512 } else {
513 if (uap->sinfo)
514 error = copyout(&sinfo, uap->sinfo, sizeof (sinfo));
515 }
516 #ifdef KTRACE
517 if (ktruio != NULL) {
518 ktruio->uio_resid = len - auio.uio_resid;
519 ktrgenio(uap->sd, UIO_READ, ktruio, error);
520 }
521 #endif /* KTRACE */
522 if (error != 0)
523 goto out;
524 td->td_retval[0] = len - auio.uio_resid;
525
526 if (fromlen && uap->from) {
527 len = fromlen;
528 if (len <= 0 || fromsa == NULL)
529 len = 0;
530 else {
531 len = MIN(len, fromsa->sa_len);
532 error = copyout(fromsa, uap->from, (size_t)len);
533 if (error != 0)
534 goto out;
535 }
536 error = copyout(&len, uap->fromlenaddr, sizeof (socklen_t));
537 if (error != 0)
538 goto out;
539 }
540 #ifdef KTRACE
541 if (KTRPOINT(td, KTR_STRUCT))
542 ktrsockaddr(fromsa);
543 #endif
544 if (uap->msg_flags) {
545 error = copyout(&msg_flags, uap->msg_flags, sizeof (int));
546 if (error != 0)
547 goto out;
548 }
549 out:
550 free(iov, M_IOV);
551 out1:
552 if (fp != NULL)
553 fdrop(fp, td);
554
555 return (error);
556 }
557