1 /*-
2 * Copyright (c) 2005 Robert N. M. Watson
3 * Copyright (c) 2015 Mark Johnston
4 * Copyright (c) 2022 Gleb Smirnoff <glebius@FreeBSD.org>
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/param.h>
30 #include <sys/jail.h>
31 #include <sys/socket.h>
32 #include <sys/stat.h>
33 #include <sys/sysctl.h>
34 #include <sys/time.h>
35 #include <sys/resource.h>
36 #include <sys/un.h>
37 #include <sys/wait.h>
38
39 #include <err.h>
40 #include <errno.h>
41 #include <fcntl.h>
42 #include <jail.h>
43 #include <limits.h>
44 #include <stdio.h>
45 #include <stdlib.h>
46 #include <string.h>
47 #include <unistd.h>
48
49 #include <atf-c.h>
50
51 #if !defined(TEST_PROTO)
52 #error Need TEST_PROTO defined to SOCK_STREAM or SOCK_DGRAM
53 #endif
54
55 /*
56 * UNIX domain sockets allow file descriptors to be passed via "ancillary
57 * data", or control messages. This regression test is intended to exercise
58 * this facility, both performing some basic tests that it operates, and also
59 * causing some kernel edge cases to execute, such as garbage collection when
60 * there are cyclic file descriptor references. Right now we test only with
61 * stream sockets, but ideally we'd also test with datagram sockets.
62 */
63
64 static void
domainsocketpair(int * fdp)65 domainsocketpair(int *fdp)
66 {
67
68 ATF_REQUIRE_MSG(socketpair(PF_UNIX, TEST_PROTO, 0, fdp) != -1,
69 "socketpair(PF_UNIX, %u) failed: %s", TEST_PROTO, strerror(errno));
70 }
71
72 static void
closesocketpair(int * fdp)73 closesocketpair(int *fdp)
74 {
75
76 close(fdp[0]);
77 close(fdp[1]);
78 }
79
80 static void
devnull(int * fdp)81 devnull(int *fdp)
82 {
83 int fd;
84
85 fd = open("/dev/null", O_RDONLY);
86 ATF_REQUIRE_MSG(fd != -1, "open failed: %s", strerror(errno));
87 *fdp = fd;
88 }
89
90 static void
tempfile(int * fdp)91 tempfile(int *fdp)
92 {
93 char path[PATH_MAX];
94 int fd;
95
96 snprintf(path, PATH_MAX, "%s/unix_passfd.XXXXXXXXXXXXXXX",
97 getenv("TMPDIR") == NULL ? "/tmp" : getenv("TMPDIR"));
98 fd = mkstemp(path);
99 ATF_REQUIRE_MSG(fd != -1, "mkstemp(%s) failed", path);
100 (void)unlink(path);
101 *fdp = fd;
102 }
103
104 static void
dofstat(int fd,struct stat * sb)105 dofstat(int fd, struct stat *sb)
106 {
107
108 ATF_REQUIRE_MSG(fstat(fd, sb) == 0,
109 "fstat failed: %s", strerror(errno));
110 }
111
112 static int
getnfds(void)113 getnfds(void)
114 {
115 size_t len;
116 int mib[4], n, rc;
117
118 len = sizeof(n);
119 mib[0] = CTL_KERN;
120 mib[1] = KERN_PROC;
121 mib[2] = KERN_PROC_NFDS;
122 mib[3] = 0;
123
124 rc = sysctl(mib, 4, &n, &len, NULL, 0);
125 ATF_REQUIRE_MSG(rc != -1, "sysctl(KERN_PROC_NFDS) failed");
126 return (n);
127 }
128
129 static int
openfiles(void)130 openfiles(void)
131 {
132 int files;
133 size_t len = sizeof(files);
134
135 ATF_REQUIRE(sysctlbyname("kern.openfiles", &files, &len, NULL, 0) == 0);
136
137 return (files);
138 }
139
140 static void
putfds(char * buf,int fd,int nfds)141 putfds(char *buf, int fd, int nfds)
142 {
143 struct cmsghdr *cm;
144 int *fdp, i;
145
146 cm = (struct cmsghdr *)buf;
147 cm->cmsg_len = CMSG_LEN(nfds * sizeof(int));
148 cm->cmsg_level = SOL_SOCKET;
149 cm->cmsg_type = SCM_RIGHTS;
150 for (fdp = (int *)CMSG_DATA(cm), i = 0; i < nfds; i++)
151 *fdp++ = fd;
152 }
153
154 static void
samefile(struct stat * sb1,struct stat * sb2)155 samefile(struct stat *sb1, struct stat *sb2)
156 {
157
158 ATF_REQUIRE_MSG(sb1->st_dev == sb2->st_dev, "different device");
159 ATF_REQUIRE_MSG(sb1->st_ino == sb2->st_ino, "different inode");
160 }
161
162 static ssize_t
sendfd_payload(int sockfd,int send_fd,void * payload,size_t paylen)163 sendfd_payload(int sockfd, int send_fd, void *payload, size_t paylen)
164 {
165 struct iovec iovec;
166 char message[CMSG_SPACE(sizeof(int))];
167 struct msghdr msghdr;
168
169 bzero(&msghdr, sizeof(msghdr));
170 bzero(&message, sizeof(message));
171
172 msghdr.msg_control = message;
173 msghdr.msg_controllen = sizeof(message);
174
175 iovec.iov_base = payload;
176 iovec.iov_len = paylen;
177
178 msghdr.msg_iov = &iovec;
179 msghdr.msg_iovlen = 1;
180
181 putfds(message, send_fd, 1);
182 return (sendmsg(sockfd, &msghdr, 0));
183 }
184
185 static void
sendfd(int sockfd,int send_fd)186 sendfd(int sockfd, int send_fd)
187 {
188 ssize_t len;
189 char ch;
190
191 ch = 0;
192 len = sendfd_payload(sockfd, send_fd, &ch, sizeof(ch));
193 ATF_REQUIRE_MSG(len == sizeof(ch),
194 "sendmsg: %zd bytes sent; expected %zu; %s", len, sizeof(ch),
195 strerror(errno));
196 }
197
198 static bool
localcreds(int sockfd)199 localcreds(int sockfd)
200 {
201 socklen_t sz;
202 int rc, val;
203
204 sz = sizeof(val);
205 rc = getsockopt(sockfd, 0, LOCAL_CREDS, &val, &sz);
206 ATF_REQUIRE_MSG(rc != -1, "getsockopt(LOCAL_CREDS) failed: %s",
207 strerror(errno));
208 return (val != 0);
209 }
210
211 static ssize_t
recvfd_payload(int sockfd,int * recv_fd,void * buf,size_t buflen,size_t cmsgsz,int recvmsg_flags)212 recvfd_payload(int sockfd, int *recv_fd, void *buf, size_t buflen,
213 size_t cmsgsz, int recvmsg_flags)
214 {
215 struct cmsghdr *cmsghdr;
216 struct msghdr msghdr;
217 struct iovec iovec;
218 char *message;
219 ssize_t len;
220 bool foundcreds;
221
222 bzero(&msghdr, sizeof(msghdr));
223 message = malloc(cmsgsz);
224 ATF_REQUIRE(message != NULL);
225
226 msghdr.msg_control = message;
227 msghdr.msg_controllen = cmsgsz;
228
229 iovec.iov_base = buf;
230 iovec.iov_len = buflen;
231
232 msghdr.msg_iov = &iovec;
233 msghdr.msg_iovlen = 1;
234
235 len = recvmsg(sockfd, &msghdr, recvmsg_flags);
236 ATF_REQUIRE_MSG(len != -1, "recvmsg failed: %s", strerror(errno));
237
238 cmsghdr = CMSG_FIRSTHDR(&msghdr);
239 ATF_REQUIRE_MSG(cmsghdr != NULL,
240 "recvmsg: did not receive control message");
241 foundcreds = false;
242 *recv_fd = -1;
243 for (; cmsghdr != NULL; cmsghdr = CMSG_NXTHDR(&msghdr, cmsghdr)) {
244 if (cmsghdr->cmsg_level == SOL_SOCKET &&
245 cmsghdr->cmsg_type == SCM_RIGHTS &&
246 cmsghdr->cmsg_len == CMSG_LEN(sizeof(int))) {
247 memcpy(recv_fd, CMSG_DATA(cmsghdr), sizeof(int));
248 ATF_REQUIRE(*recv_fd != -1);
249 } else if (cmsghdr->cmsg_level == SOL_SOCKET &&
250 cmsghdr->cmsg_type == SCM_CREDS)
251 foundcreds = true;
252 }
253 ATF_REQUIRE_MSG(*recv_fd != -1,
254 "recvmsg: did not receive single-fd message");
255 ATF_REQUIRE_MSG(!localcreds(sockfd) || foundcreds,
256 "recvmsg: expected credentials were not received");
257 ATF_REQUIRE_MSG((msghdr.msg_flags & MSG_TRUNC) == 0,
258 "recvmsg: MSG_TRUNC is set while buffer is sufficient");
259
260 return (len);
261 }
262
263 static void
recvfd(int sockfd,int * recv_fd,int flags)264 recvfd(int sockfd, int *recv_fd, int flags)
265 {
266 ssize_t len;
267 char ch = 0;
268
269 len = recvfd_payload(sockfd, recv_fd, &ch, sizeof(ch),
270 CMSG_SPACE(sizeof(int)), flags);
271 ATF_REQUIRE_MSG((size_t)len == sizeof(ch),
272 "recvmsg: %zd bytes received; expected %zd", len, sizeof(ch));
273 }
274
275 #if TEST_PROTO == SOCK_STREAM
276 #define LOCAL_SENDSPACE_SYSCTL "net.local.stream.sendspace"
277 #define LOCAL_RECVSPACE_SYSCTL "net.local.stream.recvspace"
278 #elif TEST_PROTO == SOCK_DGRAM
279 #define LOCAL_SENDSPACE_SYSCTL "net.local.dgram.maxdgram"
280 #define LOCAL_RECVSPACE_SYSCTL "net.local.dgram.recvspace"
281 #endif
282
283 static u_long
getsendspace(void)284 getsendspace(void)
285 {
286 u_long sendspace;
287
288 ATF_REQUIRE_MSG(sysctlbyname(LOCAL_SENDSPACE_SYSCTL, &sendspace,
289 &(size_t){sizeof(u_long)}, NULL, 0) != -1,
290 "sysctl %s failed: %s", LOCAL_SENDSPACE_SYSCTL, strerror(errno));
291
292 return (sendspace);
293 }
294
295 static u_long
getrecvspace(void)296 getrecvspace(void)
297 {
298 u_long recvspace;
299
300 ATF_REQUIRE_MSG(sysctlbyname(LOCAL_RECVSPACE_SYSCTL, &recvspace,
301 &(size_t){sizeof(u_long)}, NULL, 0) != -1,
302 "sysctl %s failed: %s", LOCAL_RECVSPACE_SYSCTL, strerror(errno));
303
304 return (recvspace);
305 }
306
307 /*
308 * Fill socket to a state when next max sized send would fail with EAGAIN.
309 */
310 static void
fill(int fd)311 fill(int fd)
312 {
313 u_long sendspace;
314 void *buf;
315
316 sendspace = getsendspace();
317 ATF_REQUIRE((buf = malloc(sendspace)) != NULL);
318
319 ATF_REQUIRE_MSG(fcntl(fd, F_SETFL, O_NONBLOCK) != -1,
320 "fcntl(O_NONBLOCK) failed: %s", strerror(errno));
321
322 #if TEST_PROTO == SOCK_STREAM
323 do {} while (send(fd, buf, sendspace, 0) == (ssize_t)sendspace);
324 #elif TEST_PROTO == SOCK_DGRAM
325 u_long recvspace = getrecvspace();
326
327 for (ssize_t sent = 0;
328 sent + sendspace + sizeof(struct sockaddr) < recvspace;
329 sent += sendspace + sizeof(struct sockaddr))
330 ATF_REQUIRE(send(fd, buf, sendspace, 0) == (ssize_t)sendspace);
331 #endif
332 free(buf);
333 }
334
335 /*
336 * Put a temporary file into a UNIX domain socket, then take it out and make
337 * sure it's the same file. First time around, don't close the reference
338 * after sending.
339 */
340 ATF_TC_WITHOUT_HEAD(simple_send_fd);
ATF_TC_BODY(simple_send_fd,tc)341 ATF_TC_BODY(simple_send_fd, tc)
342 {
343 struct stat getfd_stat, putfd_stat;
344 int fd[2], getfd, putfd;
345
346 domainsocketpair(fd);
347 tempfile(&putfd);
348 dofstat(putfd, &putfd_stat);
349 sendfd(fd[0], putfd);
350 recvfd(fd[1], &getfd, 0);
351 dofstat(getfd, &getfd_stat);
352 samefile(&putfd_stat, &getfd_stat);
353 close(putfd);
354 close(getfd);
355 closesocketpair(fd);
356 }
357
358 /*
359 * Like simple_send_fd but also sets MSG_CMSG_CLOEXEC and checks that the
360 * received file descriptor has the FD_CLOEXEC flag set.
361 */
362 ATF_TC_WITHOUT_HEAD(simple_send_fd_msg_cmsg_cloexec);
ATF_TC_BODY(simple_send_fd_msg_cmsg_cloexec,tc)363 ATF_TC_BODY(simple_send_fd_msg_cmsg_cloexec, tc)
364 {
365 struct stat getfd_stat, putfd_stat;
366 int fd[2], getfd, putfd;
367
368 domainsocketpair(fd);
369 tempfile(&putfd);
370 dofstat(putfd, &putfd_stat);
371 sendfd(fd[0], putfd);
372 recvfd(fd[1], &getfd, MSG_CMSG_CLOEXEC);
373 dofstat(getfd, &getfd_stat);
374 samefile(&putfd_stat, &getfd_stat);
375 ATF_REQUIRE_EQ_MSG(fcntl(getfd, F_GETFD) & FD_CLOEXEC, FD_CLOEXEC,
376 "FD_CLOEXEC not set on the received file descriptor");
377 close(putfd);
378 close(getfd);
379 closesocketpair(fd);
380 }
381
382 /*
383 * Like simple_send_fd but also sets MSG_CMSG_CLOFORK and checks that the
384 * received file descriptor has the FD_CLOFORK flag set.
385 */
386 ATF_TC_WITHOUT_HEAD(simple_send_fd_msg_cmsg_clofork);
ATF_TC_BODY(simple_send_fd_msg_cmsg_clofork,tc)387 ATF_TC_BODY(simple_send_fd_msg_cmsg_clofork, tc)
388 {
389 struct stat getfd_stat, putfd_stat;
390 int fd[2], getfd, putfd;
391
392 domainsocketpair(fd);
393 tempfile(&putfd);
394 dofstat(putfd, &putfd_stat);
395 sendfd(fd[0], putfd);
396 recvfd(fd[1], &getfd, MSG_CMSG_CLOFORK);
397 dofstat(getfd, &getfd_stat);
398 samefile(&putfd_stat, &getfd_stat);
399 ATF_REQUIRE_EQ_MSG(fcntl(getfd, F_GETFD) & FD_CLOFORK, FD_CLOFORK,
400 "FD_CLOFORK not set on the received file descriptor");
401 close(putfd);
402 close(getfd);
403 closesocketpair(fd);
404 }
405
406 /*
407 * Same as simple_send_fd, only close the file reference after sending, so that
408 * the only reference is the descriptor in the UNIX domain socket buffer.
409 */
410 ATF_TC_WITHOUT_HEAD(send_and_close);
ATF_TC_BODY(send_and_close,tc)411 ATF_TC_BODY(send_and_close, tc)
412 {
413 struct stat getfd_stat, putfd_stat;
414 int fd[2], getfd, putfd;
415
416 domainsocketpair(fd);
417 tempfile(&putfd);
418 dofstat(putfd, &putfd_stat);
419 sendfd(fd[0], putfd);
420 close(putfd);
421 recvfd(fd[1], &getfd, 0);
422 dofstat(getfd, &getfd_stat);
423 samefile(&putfd_stat, &getfd_stat);
424 close(getfd);
425 closesocketpair(fd);
426 }
427
428 /*
429 * Put a temporary file into a UNIX domain socket, then close both endpoints
430 * causing garbage collection to kick off.
431 */
432 ATF_TC_WITHOUT_HEAD(send_and_cancel);
ATF_TC_BODY(send_and_cancel,tc)433 ATF_TC_BODY(send_and_cancel, tc)
434 {
435 int fd[2], putfd;
436
437 domainsocketpair(fd);
438 tempfile(&putfd);
439 sendfd(fd[0], putfd);
440 close(putfd);
441 closesocketpair(fd);
442 }
443
444 /*
445 * Send file then shutdown receive side to exercise unp_dispose() call
446 * via soshutdown(). Check that shutdown(SHUT_RD) would gc the file
447 * reference sitting in the receive buffer. There is no good way of
448 * checking that except using global open file count.
449 */
450 ATF_TC_WITHOUT_HEAD(send_and_shutdown);
ATF_TC_BODY(send_and_shutdown,tc)451 ATF_TC_BODY(send_and_shutdown, tc)
452 {
453 int fd[2], putfd, nfiles;
454
455 domainsocketpair(fd);
456 tempfile(&putfd);
457 sendfd(fd[0], putfd);
458 nfiles = openfiles();
459 close(putfd);
460 ATF_REQUIRE(openfiles() == nfiles);
461 shutdown(fd[1], SHUT_RD);
462 ATF_REQUIRE(openfiles() == nfiles - 1);
463 closesocketpair(fd);
464 }
465
466 /*
467 * Send maximum possible SCM_RIGHTS message.
468 * Internally the file descriptors are converted from integers to pointers
469 * and stored in a single mbuf cluster. Check that we can not send too much
470 * and that we can successfully send maximum possible amount. Check that we
471 * can not exploit getrlimit(3).
472 */
473 #define MAXFDS ((MCLBYTES - _ALIGN(sizeof(struct cmsghdr)))/sizeof(void *))
474 ATF_TC_WITHOUT_HEAD(send_a_lot);
ATF_TC_BODY(send_a_lot,tc)475 ATF_TC_BODY(send_a_lot, tc)
476 {
477 struct msghdr msghdr;
478 struct iovec iov;
479 struct rlimit rlim;
480 int fd[2], nfds;
481 char *cmsg, ch;
482
483 domainsocketpair(fd);
484 cmsg = malloc(CMSG_SPACE((MAXFDS + 1) * sizeof(int)));
485 ATF_REQUIRE(cmsg != NULL);
486 iov.iov_base = &ch;
487 iov.iov_len = sizeof(ch);
488 msghdr = (struct msghdr ){
489 .msg_control = cmsg,
490 .msg_controllen = CMSG_LEN((MAXFDS + 1) * sizeof(int)),
491 .msg_iov = &iov,
492 .msg_iovlen = 1,
493 };
494
495 /* Sending too much fails. */
496 putfds(cmsg, fd[0], MAXFDS + 1);
497 ATF_REQUIRE(sendmsg(fd[0], &msghdr, 0) == -1);
498 ATF_REQUIRE(errno == EMSGSIZE);
499
500 /* Sending just the right amount works and everything is received. */
501 putfds(cmsg, fd[0], MAXFDS);
502 msghdr.msg_controllen = CMSG_LEN(MAXFDS * sizeof(int));
503 ATF_REQUIRE(sendmsg(fd[0], &msghdr, 0) == 1);
504 nfds = getnfds();
505 ATF_REQUIRE(recvmsg(fd[1], &msghdr, 0) == 1);
506 ATF_REQUIRE(getnfds() == (int)(nfds + MAXFDS));
507
508 /* Limit our process open files... */
509 ATF_REQUIRE(getrlimit(RLIMIT_NOFILE, &rlim) == 0);
510 nfds = rlim.rlim_cur = getnfds();
511 ATF_REQUIRE(setrlimit(RLIMIT_NOFILE, &rlim) == 0);
512
513 /* ... and try to receive a single descriptor. */
514 putfds(cmsg, fd[0], 1);
515 msghdr.msg_controllen = CMSG_LEN(sizeof(int));
516 ATF_REQUIRE(sendmsg(fd[0], &msghdr, 0) == 1);
517 ATF_REQUIRE(recvmsg(fd[1], &msghdr, 0) == -1);
518 /* Such attempt shall fail with EMFILE. */
519 ATF_REQUIRE(errno == EMFILE);
520 ATF_REQUIRE(getnfds() == nfds);
521 #if TEST_PROTO == SOCK_STREAM
522 /*
523 * For the SOCK_STREAM the above attempt shall free the control in
524 * the kernel, so that socket isn't left in a stuck state. Next read
525 * shall bring us the normal data only. The stream data shall not
526 * miss a byte.
527 */
528 ATF_REQUIRE(recvmsg(fd[1], &msghdr, 0) == 1);
529 ATF_REQUIRE(msghdr.msg_controllen == 0);
530 #elif TEST_PROTO == SOCK_DGRAM
531 /*
532 * For SOCK_DGRAM there are two options for the previously failed
533 * syscall: strip the control leaving datagram in the socket or
534 * drop the whole datagram. Our implementation drops the whole
535 * datagram.
536 */
537 ATF_REQUIRE(recvmsg(fd[1], &msghdr, MSG_DONTWAIT) == -1);
538 ATF_REQUIRE(errno == EAGAIN);
539 #endif
540 }
541
542 /*
543 * Exersize condition when SCM_RIGHTS is successfully internalized, but
544 * message delivery fails due to receive buffer overflow. Check that no
545 * file descriptors are leaked.
546 */
547 ATF_TC_WITHOUT_HEAD(send_overflow);
ATF_TC_BODY(send_overflow,tc)548 ATF_TC_BODY(send_overflow, tc)
549 {
550 void *buf;
551 ssize_t len;
552 int fd[2], putfd, nfiles;
553 int sendspace;
554
555 sendspace = (int)getsendspace();
556 ATF_REQUIRE((buf = malloc(sendspace)) != NULL);
557
558 domainsocketpair(fd);
559 fill(fd[0]);
560 nfiles = openfiles();
561 tempfile(&putfd);
562 len = sendfd_payload(fd[0], putfd, buf, sendspace);
563 #if TEST_PROTO == SOCK_STREAM
564 ATF_REQUIRE_MSG(len == -1 && errno == EAGAIN,
565 "sendmsg: %zd bytes sent, errno %d", len, errno);
566 #elif TEST_PROTO == SOCK_DGRAM
567 ATF_REQUIRE_MSG(len == -1 && errno == ENOBUFS,
568 "sendmsg: %zd bytes sent, errno %d", len, errno);
569 #endif
570 close(putfd);
571 ATF_REQUIRE(nfiles == openfiles());
572 closesocketpair(fd);
573 }
574
575 /*
576 * Make sure that we do not receive descriptors with MSG_PEEK.
577 */
578 ATF_TC_WITHOUT_HEAD(peek);
ATF_TC_BODY(peek,tc)579 ATF_TC_BODY(peek, tc)
580 {
581 int fd[2], getfd, putfd, nfds;
582
583 domainsocketpair(fd);
584 tempfile(&putfd);
585 nfds = getnfds();
586 sendfd(fd[0], putfd);
587 ATF_REQUIRE(getnfds() == nfds);
588
589 /* First make MSG_PEEK recvmsg(2)... */
590 char cbuf[CMSG_SPACE(sizeof(int))];
591 char buf[1];
592 struct iovec iov = {
593 .iov_base = buf,
594 .iov_len = sizeof(buf)
595 };
596 struct msghdr msghdr = {
597 .msg_iov = &iov,
598 .msg_iovlen = 1,
599 .msg_control = cbuf,
600 .msg_controllen = sizeof(cbuf),
601 };
602 ATF_REQUIRE(1 == recvmsg(fd[1], &msghdr, MSG_PEEK));
603 for (struct cmsghdr *cmsghdr = CMSG_FIRSTHDR(&msghdr);
604 cmsghdr != NULL; cmsghdr = CMSG_NXTHDR(&msghdr, cmsghdr)) {
605 /* Usually this is some garbage. */
606 printf("level %d type %d len %u\n",
607 cmsghdr->cmsg_level, cmsghdr->cmsg_type, cmsghdr->cmsg_len);
608 }
609
610 /* ... and make sure we did not receive any descriptors! */
611 ATF_REQUIRE(getnfds() == nfds);
612
613 /* Now really receive a descriptor. */
614 recvfd(fd[1], &getfd, 0);
615 ATF_REQUIRE(getnfds() == nfds + 1);
616 close(putfd);
617 close(getfd);
618 closesocketpair(fd);
619 }
620
621 /*
622 * Send two files. Then receive them. Make sure they are returned in the
623 * right order, and both get there.
624 */
625 ATF_TC_WITHOUT_HEAD(two_files);
ATF_TC_BODY(two_files,tc)626 ATF_TC_BODY(two_files, tc)
627 {
628 struct stat getfd_1_stat, getfd_2_stat, putfd_1_stat, putfd_2_stat;
629 int fd[2], getfd_1, getfd_2, putfd_1, putfd_2;
630
631 domainsocketpair(fd);
632 tempfile(&putfd_1);
633 tempfile(&putfd_2);
634 dofstat(putfd_1, &putfd_1_stat);
635 dofstat(putfd_2, &putfd_2_stat);
636 sendfd(fd[0], putfd_1);
637 sendfd(fd[0], putfd_2);
638 close(putfd_1);
639 close(putfd_2);
640 recvfd(fd[1], &getfd_1, 0);
641 recvfd(fd[1], &getfd_2, 0);
642 dofstat(getfd_1, &getfd_1_stat);
643 dofstat(getfd_2, &getfd_2_stat);
644 samefile(&putfd_1_stat, &getfd_1_stat);
645 samefile(&putfd_2_stat, &getfd_2_stat);
646 close(getfd_1);
647 close(getfd_2);
648 closesocketpair(fd);
649 }
650
651 /*
652 * Big bundling test. Send an endpoint of the UNIX domain socket over itself,
653 * closing the door behind it.
654 */
655 ATF_TC_WITHOUT_HEAD(bundle);
ATF_TC_BODY(bundle,tc)656 ATF_TC_BODY(bundle, tc)
657 {
658 int fd[2], getfd;
659
660 domainsocketpair(fd);
661
662 sendfd(fd[0], fd[0]);
663 close(fd[0]);
664 recvfd(fd[1], &getfd, 0);
665 close(getfd);
666 close(fd[1]);
667 }
668
669 /*
670 * Big bundling test part two: Send an endpoint of the UNIX domain socket over
671 * itself, close the door behind it, and never remove it from the other end.
672 */
673 ATF_TC_WITHOUT_HEAD(bundle_cancel);
ATF_TC_BODY(bundle_cancel,tc)674 ATF_TC_BODY(bundle_cancel, tc)
675 {
676 int fd[2];
677
678 domainsocketpair(fd);
679 sendfd(fd[0], fd[0]);
680 sendfd(fd[1], fd[0]);
681 closesocketpair(fd);
682 }
683
684 /*
685 * Test for PR 151758: Send an character device over the UNIX domain socket
686 * and then close both sockets to orphan the device.
687 */
688 ATF_TC_WITHOUT_HEAD(devfs_orphan);
ATF_TC_BODY(devfs_orphan,tc)689 ATF_TC_BODY(devfs_orphan, tc)
690 {
691 int fd[2], putfd;
692
693 domainsocketpair(fd);
694 devnull(&putfd);
695 sendfd(fd[0], putfd);
696 close(putfd);
697 closesocketpair(fd);
698 }
699
700 /*
701 * Test for PR 181741. Receiver sets LOCAL_CREDS, and kernel prepends a
702 * control message to the data. Sender sends large payload using a non-blocking
703 * socket. Payload + SCM_RIGHTS + LOCAL_CREDS hit socket buffer limit, and
704 * receiver receives truncated data.
705 */
706 ATF_TC_WITHOUT_HEAD(rights_creds_payload);
ATF_TC_BODY(rights_creds_payload,tc)707 ATF_TC_BODY(rights_creds_payload, tc)
708 {
709 const int on = 1;
710 u_long sendspace;
711 ssize_t len, rlen;
712 void *buf;
713 int fd[2], getfd, putfd, rc;
714
715 sendspace = getsendspace();
716 buf = calloc(1, sendspace);
717 ATF_REQUIRE(buf != NULL);
718
719 domainsocketpair(fd);
720 tempfile(&putfd);
721
722 rc = fcntl(fd[0], F_SETFL, O_NONBLOCK);
723 ATF_REQUIRE_MSG(rc != -1, "fcntl(O_NONBLOCK) failed: %s",
724 strerror(errno));
725 rc = setsockopt(fd[1], 0, LOCAL_CREDS, &on, sizeof(on));
726 ATF_REQUIRE_MSG(rc != -1, "setsockopt(LOCAL_CREDS) failed: %s",
727 strerror(errno));
728
729 len = sendfd_payload(fd[0], putfd, buf, sendspace);
730 ATF_REQUIRE_MSG(len != -1 , "sendmsg failed: %s", strerror(errno));
731 #if TEST_PROTO == SOCK_STREAM
732 ATF_REQUIRE_MSG((size_t)len < sendspace,
733 "sendmsg: %zd bytes sent, expected < %lu", len, sendspace);
734 #endif
735 #if TEST_PROTO == SOCK_DGRAM
736 /*
737 * sendmsg(2) can't truncate datagrams, only recvmsg(2) can. There are
738 * two options for the kernel here: either accept the datagram with
739 * slight overcommit of the socket buffer space or return ENOBUFS for a
740 * datagram that is smaller or equal to the socket buffer space. Our
741 * implementation does overcommit. Explanation is simple: from our
742 * side we see space available, we have no idea that remote side has
743 * LOCAL_CREDS set. From our side we expect sendmsg(2) to succeed.
744 */
745 ATF_REQUIRE_MSG((size_t)len == sendspace,
746 "sendmsg: %zd bytes sent, expected %lu", len, sendspace);
747 #endif
748 rlen = recvfd_payload(fd[1], &getfd, buf, len,
749 CMSG_SPACE(SOCKCREDSIZE(CMGROUP_MAX)) + CMSG_SPACE(sizeof(int)), 0);
750 ATF_REQUIRE_MSG(rlen == len,
751 "recvmsg: %zd bytes received; expected %zd", rlen, len);
752
753 close(putfd);
754 close(getfd);
755 closesocketpair(fd);
756 }
757
758 static void
send_cmsg(int sockfd,void * cmsg,size_t cmsgsz)759 send_cmsg(int sockfd, void *cmsg, size_t cmsgsz)
760 {
761 struct iovec iov;
762 struct msghdr msghdr;
763 ssize_t len;
764 char ch;
765
766 ch = 0;
767 bzero(&msghdr, sizeof(msghdr));
768
769 iov.iov_base = &ch;
770 iov.iov_len = sizeof(ch);
771 msghdr.msg_control = cmsg;
772 msghdr.msg_controllen = cmsgsz;
773 msghdr.msg_iov = &iov;
774 msghdr.msg_iovlen = 1;
775
776 len = sendmsg(sockfd, &msghdr, 0);
777 ATF_REQUIRE_MSG(len != -1,
778 "sendmsg failed: %s", strerror(errno));
779 ATF_REQUIRE_MSG(len == sizeof(ch),
780 "sendmsg: %zd bytes sent; expected %zu", len, sizeof(ch));
781 }
782
783 static void
recv_cmsg(int sockfd,char * cmsg,size_t cmsgsz,int flags)784 recv_cmsg(int sockfd, char *cmsg, size_t cmsgsz, int flags)
785 {
786 struct iovec iov;
787 struct msghdr msghdr;
788 ssize_t len;
789 char ch;
790
791 ch = 0;
792 bzero(&msghdr, sizeof(msghdr));
793
794 iov.iov_base = &ch;
795 iov.iov_len = sizeof(ch);
796 msghdr.msg_control = cmsg;
797 msghdr.msg_controllen = cmsgsz;
798 msghdr.msg_iov = &iov;
799 msghdr.msg_iovlen = 1;
800
801 len = recvmsg(sockfd, &msghdr, 0);
802 ATF_REQUIRE_MSG(len != -1,
803 "recvmsg failed: %s", strerror(errno));
804 ATF_REQUIRE_MSG(len == sizeof(ch),
805 "recvmsg: %zd bytes received; expected %zu", len, sizeof(ch));
806 ATF_REQUIRE_MSG((msghdr.msg_flags & flags) == flags,
807 "recvmsg: got flags %#x; expected %#x", msghdr.msg_flags, flags);
808 }
809
810 /*
811 * Test for PR 131876. Receiver uses a control message buffer that is too
812 * small for the incoming SCM_RIGHTS message, so the message is truncated.
813 * The kernel must not leak the copied right into the receiver's namespace.
814 */
815 ATF_TC_WITHOUT_HEAD(truncated_rights);
ATF_TC_BODY(truncated_rights,tc)816 ATF_TC_BODY(truncated_rights, tc)
817 {
818 char *message;
819 int fd[2], nfds, putfd, rc;
820
821 domainsocketpair(fd);
822 devnull(&putfd);
823 nfds = getnfds();
824
825 /*
826 * Case 1: Send a single descriptor and truncate the message.
827 */
828 message = malloc(CMSG_SPACE(sizeof(int)));
829 ATF_REQUIRE(message != NULL);
830 putfds(message, putfd, 1);
831 send_cmsg(fd[0], message, CMSG_LEN(sizeof(int)));
832 recv_cmsg(fd[1], message, CMSG_LEN(0), MSG_CTRUNC);
833 ATF_REQUIRE(getnfds() == nfds);
834 free(message);
835
836 /*
837 * Case 2a: Send two descriptors in separate messages, and truncate at
838 * the boundary between the two messages. We should still
839 * receive the first message.
840 */
841 message = malloc(CMSG_SPACE(sizeof(int)) * 2);
842 ATF_REQUIRE(message != NULL);
843 putfds(message, putfd, 1);
844 putfds(message + CMSG_SPACE(sizeof(int)), putfd, 1);
845 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int)) * 2);
846 recv_cmsg(fd[1], message, CMSG_SPACE(sizeof(int)), MSG_CTRUNC);
847 rc = close(*(int *)CMSG_DATA(message));
848 ATF_REQUIRE_MSG(rc == 0, "close failed: %s", strerror(errno));
849 ATF_REQUIRE(getnfds() == nfds);
850 free(message);
851
852 /*
853 * Case 2b: Send two descriptors in separate messages, and truncate
854 * before the end of the first message.
855 */
856 message = malloc(CMSG_SPACE(sizeof(int)) * 2);
857 ATF_REQUIRE(message != NULL);
858 putfds(message, putfd, 1);
859 putfds(message + CMSG_SPACE(sizeof(int)), putfd, 1);
860 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int)) * 2);
861 recv_cmsg(fd[1], message, CMSG_SPACE(0), MSG_CTRUNC);
862 ATF_REQUIRE(getnfds() == nfds);
863 free(message);
864
865 /*
866 * Case 2c: Send two descriptors in separate messages, and truncate
867 * after the end of the first message. We should still
868 * receive the first message.
869 */
870 message = malloc(CMSG_SPACE(sizeof(int)) * 2);
871 ATF_REQUIRE(message != NULL);
872 putfds(message, putfd, 1);
873 putfds(message + CMSG_SPACE(sizeof(int)), putfd, 1);
874 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int)) * 2);
875 recv_cmsg(fd[1], message, CMSG_SPACE(sizeof(int)) + CMSG_SPACE(0),
876 MSG_CTRUNC);
877 rc = close(*(int *)CMSG_DATA(message));
878 ATF_REQUIRE_MSG(rc == 0, "close failed: %s", strerror(errno));
879 ATF_REQUIRE(getnfds() == nfds);
880 free(message);
881
882 /*
883 * Case 3: Send three descriptors in the same message, and leave space
884 * only for the first when receiving the message.
885 */
886 message = malloc(CMSG_SPACE(sizeof(int) * 3));
887 ATF_REQUIRE(message != NULL);
888 putfds(message, putfd, 3);
889 send_cmsg(fd[0], message, CMSG_SPACE(sizeof(int) * 3));
890 recv_cmsg(fd[1], message, CMSG_SPACE(sizeof(int)), MSG_CTRUNC);
891 ATF_REQUIRE(getnfds() == nfds);
892 free(message);
893
894 close(putfd);
895 closesocketpair(fd);
896 }
897
898 /*
899 * Ensure that an attempt to copy a SCM_RIGHTS message to the recipient
900 * fails. In this case the kernel must dispose of the externalized rights
901 * rather than leaking them into the recipient's file descriptor table.
902 */
903 ATF_TC_WITHOUT_HEAD(copyout_rights_error);
ATF_TC_BODY(copyout_rights_error,tc)904 ATF_TC_BODY(copyout_rights_error, tc)
905 {
906 struct iovec iovec;
907 struct msghdr msghdr;
908 char buf[16];
909 ssize_t len;
910 int fd[2], error, nfds, putfd;
911
912 memset(buf, 0, sizeof(buf));
913 domainsocketpair(fd);
914 devnull(&putfd);
915 nfds = getnfds();
916
917 len = sendfd_payload(fd[0], putfd, buf, sizeof(buf));
918 ATF_REQUIRE_MSG(len != -1, "sendmsg failed: %s", strerror(errno));
919
920 bzero(&msghdr, sizeof(msghdr));
921
922 iovec.iov_base = buf;
923 iovec.iov_len = sizeof(buf);
924 msghdr.msg_control = (char *)-1; /* trigger EFAULT */
925 msghdr.msg_controllen = CMSG_SPACE(sizeof(int));
926 msghdr.msg_iov = &iovec;
927 msghdr.msg_iovlen = 1;
928
929 len = recvmsg(fd[1], &msghdr, 0);
930 error = errno;
931 ATF_REQUIRE_MSG(len == -1, "recvmsg succeeded: %zd", len);
932 ATF_REQUIRE_MSG(errno == EFAULT, "expected EFAULT, got %d (%s)",
933 error, strerror(errno));
934
935 /* Verify that no FDs were leaked. */
936 ATF_REQUIRE(getnfds() == nfds);
937
938 close(putfd);
939 closesocketpair(fd);
940 }
941
942 /*
943 * Verify that we can handle empty rights messages.
944 */
945 ATF_TC_WITHOUT_HEAD(empty_rights_message);
ATF_TC_BODY(empty_rights_message,tc)946 ATF_TC_BODY(empty_rights_message, tc)
947 {
948 struct iovec iov;
949 struct msghdr msghdr;
950 struct cmsghdr cmsg;
951 char *cm, message[CMSG_SPACE(0) + CMSG_SPACE(sizeof(int))];
952 ssize_t len;
953 int error, fd[2], putfd;
954
955 domainsocketpair(fd);
956 devnull(&putfd);
957
958 memset(&msghdr, 0, sizeof(msghdr));
959 iov.iov_base = NULL;
960 iov.iov_len = 0;
961 msghdr.msg_iov = &iov;
962 msghdr.msg_iovlen = 1;
963
964 /*
965 * Try sending incorrect empty message. On 64-bit platforms, where
966 * CMSG_SPACE(0) > sizeof(struct cmsghdr), this will exercise
967 * an edge case.
968 */
969 cmsg = (struct cmsghdr ){
970 .cmsg_len = sizeof(struct cmsghdr), /* not CMSG_LEN(0)! */
971 .cmsg_level = SOL_SOCKET,
972 .cmsg_type = SCM_RIGHTS,
973 };
974 msghdr.msg_control = &cmsg;
975 msghdr.msg_controllen = CMSG_SPACE(0);
976
977 len = sendmsg(fd[0], &msghdr, 0);
978 if (CMSG_LEN(0) != sizeof(struct cmsghdr))
979 ATF_REQUIRE(len == -1 && errno == EINVAL);
980 else
981 ATF_REQUIRE(len == 0);
982
983 /*
984 * Try sending an empty message followed by a non-empty message.
985 */
986 cm = message;
987 putfds(cm, -1, 0);
988 cm += CMSG_SPACE(0);
989 putfds(cm, putfd, 1);
990 msghdr.msg_control = message;
991 msghdr.msg_controllen = sizeof(message);
992
993 len = sendmsg(fd[0], &msghdr, 0);
994 ATF_REQUIRE_MSG(len == 0, "sendmsg failed: %s", strerror(errno));
995
996 /* Only the non-empty message should be received. */
997 len = recvmsg(fd[1], &msghdr, 0);
998 ATF_REQUIRE_MSG(len == 0, "recvmsg failed: %s", strerror(errno));
999 ATF_REQUIRE(msghdr.msg_controllen == CMSG_SPACE(sizeof(int)));
1000 error = close(*(int *)CMSG_DATA(msghdr.msg_control));
1001 ATF_REQUIRE_MSG(error == 0, "close failed: %s", strerror(errno));
1002
1003 /*
1004 * Now try sending with the non-empty message before the empty message.
1005 */
1006 cm = message;
1007 putfds(cm, putfd, 1);
1008 cm += CMSG_SPACE(sizeof(int));
1009 putfds(cm, -1, 0);
1010
1011 memset(&msghdr, 0, sizeof(msghdr));
1012 iov.iov_base = NULL;
1013 iov.iov_len = 0;
1014 msghdr.msg_control = message;
1015 msghdr.msg_controllen = CMSG_SPACE(sizeof(int));
1016 msghdr.msg_iov = &iov;
1017 msghdr.msg_iovlen = 1;
1018
1019 len = sendmsg(fd[0], &msghdr, 0);
1020 ATF_REQUIRE_MSG(len == 0, "sendmsg failed: %s", strerror(errno));
1021
1022 /* Only the non-empty message should be received. */
1023 len = recvmsg(fd[1], &msghdr, 0);
1024 ATF_REQUIRE_MSG(len == 0, "recvmsg failed: %s", strerror(errno));
1025 ATF_REQUIRE(msghdr.msg_controllen == CMSG_SPACE(sizeof(int)));
1026 error = close(*(int *)CMSG_DATA(msghdr.msg_control));
1027 ATF_REQUIRE_MSG(error == 0, "close failed: %s", strerror(errno));
1028
1029 (void)close(putfd);
1030 }
1031
1032 /*
1033 * Check that sending control creates records in a stream socket, making it
1034 * behave like a seqpacket socket. If we stack several control+data writes
1035 * on a stream socket, we won't be able to read them all at once, even if we
1036 * provide a buffer large enough to receive all at once.
1037 *
1038 * XXXGL: adding MSG_WAITALL to the recvmsg() flags will make this test stuck.
1039 */
1040 ATF_TC_WITHOUT_HEAD(control_creates_records);
ATF_TC_BODY(control_creates_records,tc)1041 ATF_TC_BODY(control_creates_records, tc)
1042 {
1043 int fd[2], putfd, getfd;
1044 char buf[2];
1045 ssize_t rlen;
1046
1047 domainsocketpair(fd);
1048 tempfile(&putfd);
1049
1050 for (int i = 1; i <= 2; i++)
1051 ATF_REQUIRE(sendfd_payload(fd[0], putfd, buf, 1) == 1);
1052 ATF_REQUIRE(close(putfd) == 0);
1053 for (int i = 1; i <= 2; i++) {
1054 rlen = recvfd_payload(fd[1], &getfd, buf, 2,
1055 CMSG_SPACE(sizeof(int)) * 2, 0);
1056 ATF_REQUIRE_MSG(rlen == 1,
1057 "recvmsg: %zd bytes received; expected 1", rlen);
1058 ATF_REQUIRE(close(getfd) == 0);
1059 }
1060 closesocketpair(fd);
1061 }
1062
1063 ATF_TC_WITH_CLEANUP(cross_jail_dirfd);
ATF_TC_HEAD(cross_jail_dirfd,tc)1064 ATF_TC_HEAD(cross_jail_dirfd, tc)
1065 {
1066 atf_tc_set_md_var(tc, "require.user", "root");
1067 }
ATF_TC_BODY(cross_jail_dirfd,tc)1068 ATF_TC_BODY(cross_jail_dirfd, tc)
1069 {
1070 int error, sock[2], jid1, jid2, status;
1071 pid_t pid1, pid2;
1072
1073 domainsocketpair(sock);
1074
1075 error = mkdir("./a", 0755);
1076 ATF_REQUIRE(error == 0);
1077 error = mkdir("./b", 0755);
1078 ATF_REQUIRE(error == 0);
1079 error = mkdir("./c", 0755);
1080 ATF_REQUIRE(error == 0);
1081 error = mkdir("./a/c", 0755);
1082 ATF_REQUIRE(error == 0);
1083
1084 jid1 = jail_setv(JAIL_CREATE,
1085 "name", "passfd_test_cross_jail_dirfd1",
1086 "path", "./a",
1087 "persist", NULL,
1088 NULL);
1089 ATF_REQUIRE_MSG(jid1 >= 0, "jail_setv: %s", jail_errmsg);
1090
1091 jid2 = jail_setv(JAIL_CREATE,
1092 "name", "passfd_test_cross_jail_dirfd2",
1093 "path", "./b",
1094 "persist", NULL,
1095 NULL);
1096 ATF_REQUIRE_MSG(jid2 >= 0, "jail_setv: %s", jail_errmsg);
1097
1098 pid1 = fork();
1099 ATF_REQUIRE(pid1 >= 0);
1100 if (pid1 == 0) {
1101 ssize_t len;
1102 int dfd, error;
1103 char ch;
1104
1105 error = jail_attach(jid1);
1106 if (error != 0)
1107 err(1, "jail_attach");
1108
1109 dfd = open(".", O_RDONLY | O_DIRECTORY);
1110 if (dfd < 0)
1111 err(1, "open(\".\") in jail %d", jid1);
1112
1113 ch = 0;
1114 len = sendfd_payload(sock[0], dfd, &ch, sizeof(ch));
1115 if (len == -1)
1116 err(1, "sendmsg");
1117
1118 _exit(0);
1119 }
1120
1121 pid2 = fork();
1122 ATF_REQUIRE(pid2 >= 0);
1123 if (pid2 == 0) {
1124 ssize_t len;
1125 int dfd, dfd2, error, fd;
1126 char ch;
1127
1128 error = jail_attach(jid2);
1129 if (error != 0)
1130 err(1, "jail_attach");
1131
1132 /* Get a directory from outside the jail root. */
1133 len = recvfd_payload(sock[1], &dfd, &ch, sizeof(ch),
1134 CMSG_SPACE(sizeof(int)), 0);
1135 if (len == -1)
1136 err(1, "recvmsg");
1137
1138 if ((fcntl(dfd, F_GETFD) & FD_RESOLVE_BENEATH) == 0)
1139 errx(1, "dfd does not have FD_RESOLVE_BENEATH set");
1140
1141 /* Make sure we can't chdir. */
1142 error = fchdir(dfd);
1143 if (error == 0)
1144 errx(1, "fchdir succeeded");
1145 if (errno != ENOTCAPABLE)
1146 err(1, "fchdir");
1147
1148 /* Make sure a dotdot access fails. */
1149 fd = openat(dfd, "../c", O_RDONLY | O_DIRECTORY);
1150 if (fd >= 0)
1151 errx(1, "openat(\"../c\") succeeded");
1152 if (errno != ENOTCAPABLE)
1153 err(1, "openat");
1154
1155 /* Accesses within the sender's jail root are ok. */
1156 fd = openat(dfd, "c", O_RDONLY | O_DIRECTORY);
1157 if (fd < 0)
1158 err(1, "openat(\"c\")");
1159
1160 dfd2 = openat(dfd, "", O_EMPTY_PATH | O_RDONLY | O_DIRECTORY);
1161 if (dfd2 < 0)
1162 err(1, "openat(\"\")");
1163 if ((fcntl(dfd2, F_GETFD) & FD_RESOLVE_BENEATH) == 0)
1164 errx(1, "dfd2 does not have FD_RESOLVE_BENEATH set");
1165
1166 _exit(0);
1167 }
1168
1169 error = waitpid(pid1, &status, 0);
1170 ATF_REQUIRE(error != -1);
1171 ATF_REQUIRE(WIFEXITED(status));
1172 ATF_REQUIRE(WEXITSTATUS(status) == 0);
1173 error = waitpid(pid2, &status, 0);
1174 ATF_REQUIRE(error != -1);
1175 ATF_REQUIRE(WIFEXITED(status));
1176 ATF_REQUIRE(WEXITSTATUS(status) == 0);
1177
1178 closesocketpair(sock);
1179 }
ATF_TC_CLEANUP(cross_jail_dirfd,tc)1180 ATF_TC_CLEANUP(cross_jail_dirfd, tc)
1181 {
1182 int jid;
1183
1184 jid = jail_getid("passfd_test_cross_jail_dirfd1");
1185 if (jid >= 0 && jail_remove(jid) != 0)
1186 err(1, "jail_remove");
1187 jid = jail_getid("passfd_test_cross_jail_dirfd2");
1188 if (jid >= 0 && jail_remove(jid) != 0)
1189 err(1, "jail_remove");
1190 }
1191
ATF_TP_ADD_TCS(tp)1192 ATF_TP_ADD_TCS(tp)
1193 {
1194
1195 ATF_TP_ADD_TC(tp, simple_send_fd);
1196 ATF_TP_ADD_TC(tp, simple_send_fd_msg_cmsg_cloexec);
1197 ATF_TP_ADD_TC(tp, simple_send_fd_msg_cmsg_clofork);
1198 ATF_TP_ADD_TC(tp, send_and_close);
1199 ATF_TP_ADD_TC(tp, send_and_cancel);
1200 ATF_TP_ADD_TC(tp, send_and_shutdown);
1201 ATF_TP_ADD_TC(tp, send_a_lot);
1202 ATF_TP_ADD_TC(tp, send_overflow);
1203 ATF_TP_ADD_TC(tp, peek);
1204 ATF_TP_ADD_TC(tp, two_files);
1205 ATF_TP_ADD_TC(tp, bundle);
1206 ATF_TP_ADD_TC(tp, bundle_cancel);
1207 ATF_TP_ADD_TC(tp, devfs_orphan);
1208 ATF_TP_ADD_TC(tp, rights_creds_payload);
1209 ATF_TP_ADD_TC(tp, truncated_rights);
1210 ATF_TP_ADD_TC(tp, copyout_rights_error);
1211 ATF_TP_ADD_TC(tp, empty_rights_message);
1212 ATF_TP_ADD_TC(tp, control_creates_records);
1213 ATF_TP_ADD_TC(tp, cross_jail_dirfd);
1214
1215 return (atf_no_error());
1216 }
1217