xref: /freebsd/sys/kern/uipc_usrreq.c (revision 43960f159d60217fcb3c5c03095effdb77a0f291)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	From: @(#)uipc_usrreq.c	8.3 (Berkeley) 1/4/94
34  * $FreeBSD$
35  */
36 
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/kernel.h>
40 #include <sys/domain.h>
41 #include <sys/fcntl.h>
42 #include <sys/malloc.h>		/* XXX must be before <sys/file.h> */
43 #include <sys/file.h>
44 #include <sys/filedesc.h>
45 #include <sys/mbuf.h>
46 #include <sys/namei.h>
47 #include <sys/proc.h>
48 #include <sys/protosw.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/resourcevar.h>
52 #include <sys/stat.h>
53 #include <sys/sysctl.h>
54 #include <sys/un.h>
55 #include <sys/unpcb.h>
56 #include <sys/vnode.h>
57 #include <sys/jail.h>
58 
59 #include <vm/vm_zone.h>
60 
61 static	struct vm_zone *unp_zone;
62 static	unp_gen_t unp_gencnt;
63 static	u_int unp_count;
64 
65 static	struct unp_head unp_shead, unp_dhead;
66 
67 /*
68  * Unix communications domain.
69  *
70  * TODO:
71  *	SEQPACKET, RDM
72  *	rethink name space problems
73  *	need a proper out-of-band
74  *	lock pushdown
75  */
76 static struct	sockaddr sun_noname = { sizeof(sun_noname), AF_LOCAL };
77 static ino_t	unp_ino;		/* prototype for fake inode numbers */
78 
79 static int     unp_attach __P((struct socket *));
80 static void    unp_detach __P((struct unpcb *));
81 static int     unp_bind __P((struct unpcb *,struct sockaddr *, struct proc *));
82 static int     unp_connect __P((struct socket *,struct sockaddr *,
83 				struct proc *));
84 static void    unp_disconnect __P((struct unpcb *));
85 static void    unp_shutdown __P((struct unpcb *));
86 static void    unp_drop __P((struct unpcb *, int));
87 static void    unp_gc __P((void));
88 static void    unp_scan __P((struct mbuf *, void (*)(struct file *)));
89 static void    unp_mark __P((struct file *));
90 static void    unp_discard __P((struct file *));
91 static int     unp_internalize __P((struct mbuf *, struct proc *));
92 
93 static int
94 uipc_abort(struct socket *so)
95 {
96 	struct unpcb *unp = sotounpcb(so);
97 
98 	if (unp == 0)
99 		return EINVAL;
100 	unp_drop(unp, ECONNABORTED);
101 	return 0;
102 }
103 
104 static int
105 uipc_accept(struct socket *so, struct sockaddr **nam)
106 {
107 	struct unpcb *unp = sotounpcb(so);
108 
109 	if (unp == 0)
110 		return EINVAL;
111 
112 	/*
113 	 * Pass back name of connected socket,
114 	 * if it was bound and we are still connected
115 	 * (our peer may have closed already!).
116 	 */
117 	if (unp->unp_conn && unp->unp_conn->unp_addr) {
118 		*nam = dup_sockaddr((struct sockaddr *)unp->unp_conn->unp_addr,
119 				    1);
120 	} else {
121 		*nam = dup_sockaddr((struct sockaddr *)&sun_noname, 1);
122 	}
123 	return 0;
124 }
125 
126 static int
127 uipc_attach(struct socket *so, int proto, struct proc *p)
128 {
129 	struct unpcb *unp = sotounpcb(so);
130 
131 	if (unp != 0)
132 		return EISCONN;
133 	return unp_attach(so);
134 }
135 
136 static int
137 uipc_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
138 {
139 	struct unpcb *unp = sotounpcb(so);
140 
141 	if (unp == 0)
142 		return EINVAL;
143 
144 	return unp_bind(unp, nam, p);
145 }
146 
147 static int
148 uipc_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
149 {
150 	struct unpcb *unp = sotounpcb(so);
151 
152 	if (unp == 0)
153 		return EINVAL;
154 	return unp_connect(so, nam, curproc);
155 }
156 
157 static int
158 uipc_connect2(struct socket *so1, struct socket *so2)
159 {
160 	struct unpcb *unp = sotounpcb(so1);
161 
162 	if (unp == 0)
163 		return EINVAL;
164 
165 	return unp_connect2(so1, so2);
166 }
167 
168 /* control is EOPNOTSUPP */
169 
170 static int
171 uipc_detach(struct socket *so)
172 {
173 	struct unpcb *unp = sotounpcb(so);
174 
175 	if (unp == 0)
176 		return EINVAL;
177 
178 	unp_detach(unp);
179 	return 0;
180 }
181 
182 static int
183 uipc_disconnect(struct socket *so)
184 {
185 	struct unpcb *unp = sotounpcb(so);
186 
187 	if (unp == 0)
188 		return EINVAL;
189 	unp_disconnect(unp);
190 	return 0;
191 }
192 
193 static int
194 uipc_listen(struct socket *so, struct proc *p)
195 {
196 	struct unpcb *unp = sotounpcb(so);
197 
198 	if (unp == 0 || unp->unp_vnode == 0)
199 		return EINVAL;
200 	return 0;
201 }
202 
203 static int
204 uipc_peeraddr(struct socket *so, struct sockaddr **nam)
205 {
206 	struct unpcb *unp = sotounpcb(so);
207 
208 	if (unp == 0)
209 		return EINVAL;
210 	if (unp->unp_conn && unp->unp_conn->unp_addr)
211 		*nam = dup_sockaddr((struct sockaddr *)unp->unp_conn->unp_addr,
212 				    1);
213 	return 0;
214 }
215 
216 static int
217 uipc_rcvd(struct socket *so, int flags)
218 {
219 	struct unpcb *unp = sotounpcb(so);
220 	struct socket *so2;
221 	u_long newhiwat;
222 
223 	if (unp == 0)
224 		return EINVAL;
225 	switch (so->so_type) {
226 	case SOCK_DGRAM:
227 		panic("uipc_rcvd DGRAM?");
228 		/*NOTREACHED*/
229 
230 	case SOCK_STREAM:
231 		if (unp->unp_conn == 0)
232 			break;
233 		so2 = unp->unp_conn->unp_socket;
234 		/*
235 		 * Adjust backpressure on sender
236 		 * and wakeup any waiting to write.
237 		 */
238 		so2->so_snd.sb_mbmax += unp->unp_mbcnt - so->so_rcv.sb_mbcnt;
239 		unp->unp_mbcnt = so->so_rcv.sb_mbcnt;
240 		newhiwat = so2->so_snd.sb_hiwat + unp->unp_cc -
241 		    so->so_rcv.sb_cc;
242 		(void)chgsbsize(so2->so_cred->cr_uidinfo, &so2->so_snd.sb_hiwat,
243 		    newhiwat, RLIM_INFINITY);
244 		unp->unp_cc = so->so_rcv.sb_cc;
245 		sowwakeup(so2);
246 		break;
247 
248 	default:
249 		panic("uipc_rcvd unknown socktype");
250 	}
251 	return 0;
252 }
253 
254 /* pru_rcvoob is EOPNOTSUPP */
255 
256 static int
257 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
258 	  struct mbuf *control, struct proc *p)
259 {
260 	int error = 0;
261 	struct unpcb *unp = sotounpcb(so);
262 	struct socket *so2;
263 	u_long newhiwat;
264 
265 	if (unp == 0) {
266 		error = EINVAL;
267 		goto release;
268 	}
269 	if (flags & PRUS_OOB) {
270 		error = EOPNOTSUPP;
271 		goto release;
272 	}
273 
274 	if (control && (error = unp_internalize(control, p)))
275 		goto release;
276 
277 	switch (so->so_type) {
278 	case SOCK_DGRAM:
279 	{
280 		struct sockaddr *from;
281 
282 		if (nam) {
283 			if (unp->unp_conn) {
284 				error = EISCONN;
285 				break;
286 			}
287 			error = unp_connect(so, nam, p);
288 			if (error)
289 				break;
290 		} else {
291 			if (unp->unp_conn == 0) {
292 				error = ENOTCONN;
293 				break;
294 			}
295 		}
296 		so2 = unp->unp_conn->unp_socket;
297 		if (unp->unp_addr)
298 			from = (struct sockaddr *)unp->unp_addr;
299 		else
300 			from = &sun_noname;
301 		if (sbappendaddr(&so2->so_rcv, from, m, control)) {
302 			sorwakeup(so2);
303 			m = 0;
304 			control = 0;
305 		} else
306 			error = ENOBUFS;
307 		if (nam)
308 			unp_disconnect(unp);
309 		break;
310 	}
311 
312 	case SOCK_STREAM:
313 		/* Connect if not connected yet. */
314 		/*
315 		 * Note: A better implementation would complain
316 		 * if not equal to the peer's address.
317 		 */
318 		if ((so->so_state & SS_ISCONNECTED) == 0) {
319 			if (nam) {
320 				error = unp_connect(so, nam, p);
321 				if (error)
322 					break;	/* XXX */
323 			} else {
324 				error = ENOTCONN;
325 				break;
326 			}
327 		}
328 
329 		if (so->so_state & SS_CANTSENDMORE) {
330 			error = EPIPE;
331 			break;
332 		}
333 		if (unp->unp_conn == 0)
334 			panic("uipc_send connected but no connection?");
335 		so2 = unp->unp_conn->unp_socket;
336 		/*
337 		 * Send to paired receive port, and then reduce
338 		 * send buffer hiwater marks to maintain backpressure.
339 		 * Wake up readers.
340 		 */
341 		if (control) {
342 			if (sbappendcontrol(&so2->so_rcv, m, control))
343 				control = 0;
344 		} else
345 			sbappend(&so2->so_rcv, m);
346 		so->so_snd.sb_mbmax -=
347 			so2->so_rcv.sb_mbcnt - unp->unp_conn->unp_mbcnt;
348 		unp->unp_conn->unp_mbcnt = so2->so_rcv.sb_mbcnt;
349 		newhiwat = so->so_snd.sb_hiwat -
350 		    (so2->so_rcv.sb_cc - unp->unp_conn->unp_cc);
351 		(void)chgsbsize(so->so_cred->cr_uidinfo, &so->so_snd.sb_hiwat,
352 		    newhiwat, RLIM_INFINITY);
353 		unp->unp_conn->unp_cc = so2->so_rcv.sb_cc;
354 		sorwakeup(so2);
355 		m = 0;
356 		break;
357 
358 	default:
359 		panic("uipc_send unknown socktype");
360 	}
361 
362 	/*
363 	 * SEND_EOF is equivalent to a SEND followed by
364 	 * a SHUTDOWN.
365 	 */
366 	if (flags & PRUS_EOF) {
367 		socantsendmore(so);
368 		unp_shutdown(unp);
369 	}
370 
371 	if (control && error != 0)
372 		unp_dispose(control);
373 
374 release:
375 	if (control)
376 		m_freem(control);
377 	if (m)
378 		m_freem(m);
379 	return error;
380 }
381 
382 static int
383 uipc_sense(struct socket *so, struct stat *sb)
384 {
385 	struct unpcb *unp = sotounpcb(so);
386 	struct socket *so2;
387 
388 	if (unp == 0)
389 		return EINVAL;
390 	sb->st_blksize = so->so_snd.sb_hiwat;
391 	if (so->so_type == SOCK_STREAM && unp->unp_conn != 0) {
392 		so2 = unp->unp_conn->unp_socket;
393 		sb->st_blksize += so2->so_rcv.sb_cc;
394 	}
395 	sb->st_dev = NOUDEV;
396 	if (unp->unp_ino == 0)
397 		unp->unp_ino = unp_ino++;
398 	sb->st_ino = unp->unp_ino;
399 	return (0);
400 }
401 
402 static int
403 uipc_shutdown(struct socket *so)
404 {
405 	struct unpcb *unp = sotounpcb(so);
406 
407 	if (unp == 0)
408 		return EINVAL;
409 	socantsendmore(so);
410 	unp_shutdown(unp);
411 	return 0;
412 }
413 
414 static int
415 uipc_sockaddr(struct socket *so, struct sockaddr **nam)
416 {
417 	struct unpcb *unp = sotounpcb(so);
418 
419 	if (unp == 0)
420 		return EINVAL;
421 	if (unp->unp_addr)
422 		*nam = dup_sockaddr((struct sockaddr *)unp->unp_addr, 1);
423 	return 0;
424 }
425 
426 struct pr_usrreqs uipc_usrreqs = {
427 	uipc_abort, uipc_accept, uipc_attach, uipc_bind, uipc_connect,
428 	uipc_connect2, pru_control_notsupp, uipc_detach, uipc_disconnect,
429 	uipc_listen, uipc_peeraddr, uipc_rcvd, pru_rcvoob_notsupp,
430 	uipc_send, uipc_sense, uipc_shutdown, uipc_sockaddr,
431 	sosend, soreceive, sopoll
432 };
433 
434 /*
435  * Both send and receive buffers are allocated PIPSIZ bytes of buffering
436  * for stream sockets, although the total for sender and receiver is
437  * actually only PIPSIZ.
438  * Datagram sockets really use the sendspace as the maximum datagram size,
439  * and don't really want to reserve the sendspace.  Their recvspace should
440  * be large enough for at least one max-size datagram plus address.
441  */
442 #ifndef PIPSIZ
443 #define	PIPSIZ	8192
444 #endif
445 static u_long	unpst_sendspace = PIPSIZ;
446 static u_long	unpst_recvspace = PIPSIZ;
447 static u_long	unpdg_sendspace = 2*1024;	/* really max datagram size */
448 static u_long	unpdg_recvspace = 4*1024;
449 
450 static int	unp_rights;			/* file descriptors in flight */
451 
452 SYSCTL_DECL(_net_local_stream);
453 SYSCTL_INT(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
454 	   &unpst_sendspace, 0, "");
455 SYSCTL_INT(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
456 	   &unpst_recvspace, 0, "");
457 SYSCTL_DECL(_net_local_dgram);
458 SYSCTL_INT(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
459 	   &unpdg_sendspace, 0, "");
460 SYSCTL_INT(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
461 	   &unpdg_recvspace, 0, "");
462 SYSCTL_DECL(_net_local);
463 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0, "");
464 
465 static int
466 unp_attach(so)
467 	struct socket *so;
468 {
469 	register struct unpcb *unp;
470 	int error;
471 
472 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
473 		switch (so->so_type) {
474 
475 		case SOCK_STREAM:
476 			error = soreserve(so, unpst_sendspace, unpst_recvspace);
477 			break;
478 
479 		case SOCK_DGRAM:
480 			error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
481 			break;
482 
483 		default:
484 			panic("unp_attach");
485 		}
486 		if (error)
487 			return (error);
488 	}
489 	unp = zalloc(unp_zone);
490 	if (unp == NULL)
491 		return (ENOBUFS);
492 	bzero(unp, sizeof *unp);
493 	unp->unp_gencnt = ++unp_gencnt;
494 	unp_count++;
495 	LIST_INIT(&unp->unp_refs);
496 	unp->unp_socket = so;
497 	unp->unp_rvnode = curproc->p_fd->fd_rdir;
498 	LIST_INSERT_HEAD(so->so_type == SOCK_DGRAM ? &unp_dhead
499 			 : &unp_shead, unp, unp_link);
500 	so->so_pcb = (caddr_t)unp;
501 	return (0);
502 }
503 
504 static void
505 unp_detach(unp)
506 	register struct unpcb *unp;
507 {
508 	LIST_REMOVE(unp, unp_link);
509 	unp->unp_gencnt = ++unp_gencnt;
510 	--unp_count;
511 	if (unp->unp_vnode) {
512 		unp->unp_vnode->v_socket = 0;
513 		vrele(unp->unp_vnode);
514 		unp->unp_vnode = 0;
515 	}
516 	if (unp->unp_conn)
517 		unp_disconnect(unp);
518 	while (!LIST_EMPTY(&unp->unp_refs))
519 		unp_drop(LIST_FIRST(&unp->unp_refs), ECONNRESET);
520 	soisdisconnected(unp->unp_socket);
521 	unp->unp_socket->so_pcb = 0;
522 	if (unp_rights) {
523 		/*
524 		 * Normally the receive buffer is flushed later,
525 		 * in sofree, but if our receive buffer holds references
526 		 * to descriptors that are now garbage, we will dispose
527 		 * of those descriptor references after the garbage collector
528 		 * gets them (resulting in a "panic: closef: count < 0").
529 		 */
530 		sorflush(unp->unp_socket);
531 		unp_gc();
532 	}
533 	if (unp->unp_addr)
534 		FREE(unp->unp_addr, M_SONAME);
535 	zfree(unp_zone, unp);
536 }
537 
538 static int
539 unp_bind(unp, nam, p)
540 	struct unpcb *unp;
541 	struct sockaddr *nam;
542 	struct proc *p;
543 {
544 	struct sockaddr_un *soun = (struct sockaddr_un *)nam;
545 	struct vnode *vp;
546 	struct mount *mp;
547 	struct vattr vattr;
548 	int error, namelen;
549 	struct nameidata nd;
550 	char buf[SOCK_MAXADDRLEN];
551 
552 	if (unp->unp_vnode != NULL)
553 		return (EINVAL);
554 	namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
555 	if (namelen <= 0)
556 		return EINVAL;
557 	strncpy(buf, soun->sun_path, namelen);
558 	buf[namelen] = 0;	/* null-terminate the string */
559 restart:
560 	NDINIT(&nd, CREATE, NOFOLLOW | LOCKPARENT, UIO_SYSSPACE,
561 	    buf, p);
562 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
563 	error = namei(&nd);
564 	if (error)
565 		return (error);
566 	vp = nd.ni_vp;
567 	if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
568 		NDFREE(&nd, NDF_ONLY_PNBUF);
569 		if (nd.ni_dvp == vp)
570 			vrele(nd.ni_dvp);
571 		else
572 			vput(nd.ni_dvp);
573 		if (vp != NULL) {
574 			vrele(vp);
575 			return (EADDRINUSE);
576 		}
577 		if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0)
578 			return (error);
579 		goto restart;
580 	}
581 	VATTR_NULL(&vattr);
582 	vattr.va_type = VSOCK;
583 	vattr.va_mode = (ACCESSPERMS & ~p->p_fd->fd_cmask);
584 	VOP_LEASE(nd.ni_dvp, p, p->p_ucred, LEASE_WRITE);
585 	error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
586 	NDFREE(&nd, NDF_ONLY_PNBUF);
587 	vput(nd.ni_dvp);
588 	if (error)
589 		return (error);
590 	vp = nd.ni_vp;
591 	vp->v_socket = unp->unp_socket;
592 	unp->unp_vnode = vp;
593 	unp->unp_addr = (struct sockaddr_un *)dup_sockaddr(nam, 1);
594 	VOP_UNLOCK(vp, 0, p);
595 	vn_finished_write(mp);
596 	return (0);
597 }
598 
599 static int
600 unp_connect(so, nam, p)
601 	struct socket *so;
602 	struct sockaddr *nam;
603 	struct proc *p;
604 {
605 	register struct sockaddr_un *soun = (struct sockaddr_un *)nam;
606 	register struct vnode *vp;
607 	register struct socket *so2, *so3;
608 	struct unpcb *unp2, *unp3;
609 	int error, len;
610 	struct nameidata nd;
611 	char buf[SOCK_MAXADDRLEN];
612 
613 	len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
614 	if (len <= 0)
615 		return EINVAL;
616 	strncpy(buf, soun->sun_path, len);
617 	buf[len] = 0;
618 
619 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, buf, p);
620 	error = namei(&nd);
621 	if (error)
622 		return (error);
623 	vp = nd.ni_vp;
624 	NDFREE(&nd, NDF_ONLY_PNBUF);
625 	if (vp->v_type != VSOCK) {
626 		error = ENOTSOCK;
627 		goto bad;
628 	}
629 	error = VOP_ACCESS(vp, VWRITE, p->p_ucred, p);
630 	if (error)
631 		goto bad;
632 	so2 = vp->v_socket;
633 	if (so2 == 0) {
634 		error = ECONNREFUSED;
635 		goto bad;
636 	}
637 	if (so->so_type != so2->so_type) {
638 		error = EPROTOTYPE;
639 		goto bad;
640 	}
641 	if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
642 		if ((so2->so_options & SO_ACCEPTCONN) == 0 ||
643 		    (so3 = sonewconn3(so2, 0, p)) == 0) {
644 			error = ECONNREFUSED;
645 			goto bad;
646 		}
647 		unp2 = sotounpcb(so2);
648 		unp3 = sotounpcb(so3);
649 		if (unp2->unp_addr)
650 			unp3->unp_addr = (struct sockaddr_un *)
651 				dup_sockaddr((struct sockaddr *)
652 					     unp2->unp_addr, 1);
653 		so2 = so3;
654 	}
655 	error = unp_connect2(so, so2);
656 bad:
657 	vput(vp);
658 	return (error);
659 }
660 
661 int
662 unp_connect2(so, so2)
663 	register struct socket *so;
664 	register struct socket *so2;
665 {
666 	register struct unpcb *unp = sotounpcb(so);
667 	register struct unpcb *unp2;
668 
669 	if (so2->so_type != so->so_type)
670 		return (EPROTOTYPE);
671 	unp2 = sotounpcb(so2);
672 	unp->unp_conn = unp2;
673 	switch (so->so_type) {
674 
675 	case SOCK_DGRAM:
676 		LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
677 		soisconnected(so);
678 		break;
679 
680 	case SOCK_STREAM:
681 		unp2->unp_conn = unp;
682 		soisconnected(so);
683 		soisconnected(so2);
684 		break;
685 
686 	default:
687 		panic("unp_connect2");
688 	}
689 	return (0);
690 }
691 
692 static void
693 unp_disconnect(unp)
694 	struct unpcb *unp;
695 {
696 	register struct unpcb *unp2 = unp->unp_conn;
697 
698 	if (unp2 == 0)
699 		return;
700 	unp->unp_conn = 0;
701 	switch (unp->unp_socket->so_type) {
702 
703 	case SOCK_DGRAM:
704 		LIST_REMOVE(unp, unp_reflink);
705 		unp->unp_socket->so_state &= ~SS_ISCONNECTED;
706 		break;
707 
708 	case SOCK_STREAM:
709 		soisdisconnected(unp->unp_socket);
710 		unp2->unp_conn = 0;
711 		soisdisconnected(unp2->unp_socket);
712 		break;
713 	}
714 }
715 
716 #ifdef notdef
717 void
718 unp_abort(unp)
719 	struct unpcb *unp;
720 {
721 
722 	unp_detach(unp);
723 }
724 #endif
725 
726 static int
727 prison_unpcb(struct proc *p, struct unpcb *unp)
728 {
729 	if (!jailed(p->p_ucred))
730 		return (0);
731 	if (p->p_fd->fd_rdir == unp->unp_rvnode)
732 		return (0);
733 	return (1);
734 }
735 
736 static int
737 unp_pcblist(SYSCTL_HANDLER_ARGS)
738 {
739 	int error, i, n;
740 	struct unpcb *unp, **unp_list;
741 	unp_gen_t gencnt;
742 	struct xunpgen xug;
743 	struct unp_head *head;
744 
745 	head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead);
746 
747 	/*
748 	 * The process of preparing the PCB list is too time-consuming and
749 	 * resource-intensive to repeat twice on every request.
750 	 */
751 	if (req->oldptr == 0) {
752 		n = unp_count;
753 		req->oldidx = 2 * (sizeof xug)
754 			+ (n + n/8) * sizeof(struct xunpcb);
755 		return 0;
756 	}
757 
758 	if (req->newptr != 0)
759 		return EPERM;
760 
761 	/*
762 	 * OK, now we're committed to doing something.
763 	 */
764 	gencnt = unp_gencnt;
765 	n = unp_count;
766 
767 	xug.xug_len = sizeof xug;
768 	xug.xug_count = n;
769 	xug.xug_gen = gencnt;
770 	xug.xug_sogen = so_gencnt;
771 	error = SYSCTL_OUT(req, &xug, sizeof xug);
772 	if (error)
773 		return error;
774 
775 	unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK);
776 	if (unp_list == 0)
777 		return ENOMEM;
778 
779 	for (unp = LIST_FIRST(head), i = 0; unp && i < n;
780 	     unp = LIST_NEXT(unp, unp_link)) {
781 		if (unp->unp_gencnt <= gencnt && !prison_unpcb(req->p, unp))
782 			unp_list[i++] = unp;
783 	}
784 	n = i;			/* in case we lost some during malloc */
785 
786 	error = 0;
787 	for (i = 0; i < n; i++) {
788 		unp = unp_list[i];
789 		if (unp->unp_gencnt <= gencnt) {
790 			struct xunpcb xu;
791 			xu.xu_len = sizeof xu;
792 			xu.xu_unpp = unp;
793 			/*
794 			 * XXX - need more locking here to protect against
795 			 * connect/disconnect races for SMP.
796 			 */
797 			if (unp->unp_addr)
798 				bcopy(unp->unp_addr, &xu.xu_addr,
799 				      unp->unp_addr->sun_len);
800 			if (unp->unp_conn && unp->unp_conn->unp_addr)
801 				bcopy(unp->unp_conn->unp_addr,
802 				      &xu.xu_caddr,
803 				      unp->unp_conn->unp_addr->sun_len);
804 			bcopy(unp, &xu.xu_unp, sizeof *unp);
805 			sotoxsocket(unp->unp_socket, &xu.xu_socket);
806 			error = SYSCTL_OUT(req, &xu, sizeof xu);
807 		}
808 	}
809 	if (!error) {
810 		/*
811 		 * Give the user an updated idea of our state.
812 		 * If the generation differs from what we told
813 		 * her before, she knows that something happened
814 		 * while we were processing this request, and it
815 		 * might be necessary to retry.
816 		 */
817 		xug.xug_gen = unp_gencnt;
818 		xug.xug_sogen = so_gencnt;
819 		xug.xug_count = unp_count;
820 		error = SYSCTL_OUT(req, &xug, sizeof xug);
821 	}
822 	free(unp_list, M_TEMP);
823 	return error;
824 }
825 
826 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLFLAG_RD,
827 	    (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
828 	    "List of active local datagram sockets");
829 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLFLAG_RD,
830 	    (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
831 	    "List of active local stream sockets");
832 
833 static void
834 unp_shutdown(unp)
835 	struct unpcb *unp;
836 {
837 	struct socket *so;
838 
839 	if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn &&
840 	    (so = unp->unp_conn->unp_socket))
841 		socantrcvmore(so);
842 }
843 
844 static void
845 unp_drop(unp, errno)
846 	struct unpcb *unp;
847 	int errno;
848 {
849 	struct socket *so = unp->unp_socket;
850 
851 	so->so_error = errno;
852 	unp_disconnect(unp);
853 	if (so->so_head) {
854 		LIST_REMOVE(unp, unp_link);
855 		unp->unp_gencnt = ++unp_gencnt;
856 		unp_count--;
857 		so->so_pcb = (caddr_t) 0;
858 		if (unp->unp_addr)
859 			FREE(unp->unp_addr, M_SONAME);
860 		zfree(unp_zone, unp);
861 		sofree(so);
862 	}
863 }
864 
865 #ifdef notdef
866 void
867 unp_drain()
868 {
869 
870 }
871 #endif
872 
873 int
874 unp_externalize(rights)
875 	struct mbuf *rights;
876 {
877 	struct proc *p = curproc;		/* XXX */
878 	register int i;
879 	register struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
880 	register int *fdp;
881 	register struct file **rp;
882 	register struct file *fp;
883 	int newfds = (cm->cmsg_len - (CMSG_DATA(cm) - (u_char *)cm))
884 		/ sizeof (struct file *);
885 	int f;
886 
887 	/*
888 	 * if the new FD's will not fit, then we free them all
889 	 */
890 	if (!fdavail(p, newfds)) {
891 		rp = (struct file **)CMSG_DATA(cm);
892 		for (i = 0; i < newfds; i++) {
893 			fp = *rp;
894 			/*
895 			 * zero the pointer before calling unp_discard,
896 			 * since it may end up in unp_gc()..
897 			 */
898 			*rp++ = 0;
899 			unp_discard(fp);
900 		}
901 		return (EMSGSIZE);
902 	}
903 	/*
904 	 * now change each pointer to an fd in the global table to
905 	 * an integer that is the index to the local fd table entry
906 	 * that we set up to point to the global one we are transferring.
907 	 * If sizeof (struct file *) is bigger than or equal to sizeof int,
908 	 * then do it in forward order. In that case, an integer will
909 	 * always come in the same place or before its corresponding
910 	 * struct file pointer.
911 	 * If sizeof (struct file *) is smaller than sizeof int, then
912 	 * do it in reverse order.
913 	 */
914 	if (sizeof (struct file *) >= sizeof (int)) {
915 		fdp = (int *)(cm + 1);
916 		rp = (struct file **)CMSG_DATA(cm);
917 		for (i = 0; i < newfds; i++) {
918 			if (fdalloc(p, 0, &f))
919 				panic("unp_externalize");
920 			fp = *rp++;
921 			p->p_fd->fd_ofiles[f] = fp;
922 			fp->f_msgcount--;
923 			unp_rights--;
924 			*fdp++ = f;
925 		}
926 	} else {
927 		fdp = (int *)(cm + 1) + newfds - 1;
928 		rp = (struct file **)CMSG_DATA(cm) + newfds - 1;
929 		for (i = 0; i < newfds; i++) {
930 			if (fdalloc(p, 0, &f))
931 				panic("unp_externalize");
932 			fp = *rp--;
933 			p->p_fd->fd_ofiles[f] = fp;
934 			fp->f_msgcount--;
935 			unp_rights--;
936 			*fdp-- = f;
937 		}
938 	}
939 
940 	/*
941 	 * Adjust length, in case sizeof(struct file *) and sizeof(int)
942 	 * differs.
943 	 */
944 	cm->cmsg_len = CMSG_LEN(newfds * sizeof(int));
945 	rights->m_len = cm->cmsg_len;
946 	return (0);
947 }
948 
949 void
950 unp_init(void)
951 {
952 	unp_zone = zinit("unpcb", sizeof(struct unpcb), nmbclusters, 0, 0);
953 	if (unp_zone == 0)
954 		panic("unp_init");
955 	LIST_INIT(&unp_dhead);
956 	LIST_INIT(&unp_shead);
957 }
958 
959 #ifndef MIN
960 #define	MIN(a,b) (((a)<(b))?(a):(b))
961 #endif
962 
963 static int
964 unp_internalize(control, p)
965 	struct mbuf *control;
966 	struct proc *p;
967 {
968 	struct filedesc *fdescp = p->p_fd;
969 	register struct cmsghdr *cm = mtod(control, struct cmsghdr *);
970 	register struct file **rp;
971 	register struct file *fp;
972 	register int i, fd, *fdp;
973 	register struct cmsgcred *cmcred;
974 	int oldfds;
975 	u_int newlen;
976 
977 	if ((cm->cmsg_type != SCM_RIGHTS && cm->cmsg_type != SCM_CREDS) ||
978 	    cm->cmsg_level != SOL_SOCKET || cm->cmsg_len != control->m_len)
979 		return (EINVAL);
980 
981 	/*
982 	 * Fill in credential information.
983 	 */
984 	if (cm->cmsg_type == SCM_CREDS) {
985 		cmcred = (struct cmsgcred *)(cm + 1);
986 		cmcred->cmcred_pid = p->p_pid;
987 		cmcred->cmcred_uid = p->p_cred->p_ruid;
988 		cmcred->cmcred_gid = p->p_cred->p_rgid;
989 		cmcred->cmcred_euid = p->p_ucred->cr_uid;
990 		cmcred->cmcred_ngroups = MIN(p->p_ucred->cr_ngroups,
991 							CMGROUP_MAX);
992 		for (i = 0; i < cmcred->cmcred_ngroups; i++)
993 			cmcred->cmcred_groups[i] = p->p_ucred->cr_groups[i];
994 		return(0);
995 	}
996 
997 	oldfds = (cm->cmsg_len - sizeof (*cm)) / sizeof (int);
998 	/*
999 	 * check that all the FDs passed in refer to legal OPEN files
1000 	 * If not, reject the entire operation.
1001 	 */
1002 	fdp = (int *)(cm + 1);
1003 	for (i = 0; i < oldfds; i++) {
1004 		fd = *fdp++;
1005 		if ((unsigned)fd >= fdescp->fd_nfiles ||
1006 		    fdescp->fd_ofiles[fd] == NULL)
1007 			return (EBADF);
1008 	}
1009 	/*
1010 	 * Now replace the integer FDs with pointers to
1011 	 * the associated global file table entry..
1012 	 * Allocate a bigger buffer as necessary. But if an cluster is not
1013 	 * enough, return E2BIG.
1014 	 */
1015 	newlen = CMSG_LEN(oldfds * sizeof(struct file *));
1016 	if (newlen > MCLBYTES)
1017 		return (E2BIG);
1018 	if (newlen - control->m_len > M_TRAILINGSPACE(control)) {
1019 		if (control->m_flags & M_EXT)
1020 			return (E2BIG);
1021 		MCLGET(control, M_TRYWAIT);
1022 		if ((control->m_flags & M_EXT) == 0)
1023 			return (ENOBUFS);
1024 
1025 		/* copy the data to the cluster */
1026 		memcpy(mtod(control, char *), cm, cm->cmsg_len);
1027 		cm = mtod(control, struct cmsghdr *);
1028 	}
1029 
1030 	/*
1031 	 * Adjust length, in case sizeof(struct file *) and sizeof(int)
1032 	 * differs.
1033 	 */
1034 	control->m_len = cm->cmsg_len = newlen;
1035 
1036 	/*
1037 	 * Transform the file descriptors into struct file pointers.
1038 	 * If sizeof (struct file *) is bigger than or equal to sizeof int,
1039 	 * then do it in reverse order so that the int won't get until
1040 	 * we're done.
1041 	 * If sizeof (struct file *) is smaller than sizeof int, then
1042 	 * do it in forward order.
1043 	 */
1044 	if (sizeof (struct file *) >= sizeof (int)) {
1045 		fdp = (int *)(cm + 1) + oldfds - 1;
1046 		rp = (struct file **)CMSG_DATA(cm) + oldfds - 1;
1047 		for (i = 0; i < oldfds; i++) {
1048 			fp = fdescp->fd_ofiles[*fdp--];
1049 			*rp-- = fp;
1050 			fp->f_count++;
1051 			fp->f_msgcount++;
1052 			unp_rights++;
1053 		}
1054 	} else {
1055 		fdp = (int *)(cm + 1);
1056 		rp = (struct file **)CMSG_DATA(cm);
1057 		for (i = 0; i < oldfds; i++) {
1058 			fp = fdescp->fd_ofiles[*fdp++];
1059 			*rp++ = fp;
1060 			fp->f_count++;
1061 			fp->f_msgcount++;
1062 			unp_rights++;
1063 		}
1064 	}
1065 	return (0);
1066 }
1067 
1068 static int	unp_defer, unp_gcing;
1069 
1070 static void
1071 unp_gc()
1072 {
1073 	register struct file *fp, *nextfp;
1074 	register struct socket *so;
1075 	struct file **extra_ref, **fpp;
1076 	int nunref, i;
1077 
1078 	if (unp_gcing)
1079 		return;
1080 	unp_gcing = 1;
1081 	unp_defer = 0;
1082 	/*
1083 	 * before going through all this, set all FDs to
1084 	 * be NOT defered and NOT externally accessible
1085 	 */
1086 	LIST_FOREACH(fp, &filehead, f_list)
1087 		fp->f_flag &= ~(FMARK|FDEFER);
1088 	do {
1089 		LIST_FOREACH(fp, &filehead, f_list) {
1090 			/*
1091 			 * If the file is not open, skip it
1092 			 */
1093 			if (fp->f_count == 0)
1094 				continue;
1095 			/*
1096 			 * If we already marked it as 'defer'  in a
1097 			 * previous pass, then try process it this time
1098 			 * and un-mark it
1099 			 */
1100 			if (fp->f_flag & FDEFER) {
1101 				fp->f_flag &= ~FDEFER;
1102 				unp_defer--;
1103 			} else {
1104 				/*
1105 				 * if it's not defered, then check if it's
1106 				 * already marked.. if so skip it
1107 				 */
1108 				if (fp->f_flag & FMARK)
1109 					continue;
1110 				/*
1111 				 * If all references are from messages
1112 				 * in transit, then skip it. it's not
1113 				 * externally accessible.
1114 				 */
1115 				if (fp->f_count == fp->f_msgcount)
1116 					continue;
1117 				/*
1118 				 * If it got this far then it must be
1119 				 * externally accessible.
1120 				 */
1121 				fp->f_flag |= FMARK;
1122 			}
1123 			/*
1124 			 * either it was defered, or it is externally
1125 			 * accessible and not already marked so.
1126 			 * Now check if it is possibly one of OUR sockets.
1127 			 */
1128 			if (fp->f_type != DTYPE_SOCKET ||
1129 			    (so = (struct socket *)fp->f_data) == 0)
1130 				continue;
1131 			if (so->so_proto->pr_domain != &localdomain ||
1132 			    (so->so_proto->pr_flags&PR_RIGHTS) == 0)
1133 				continue;
1134 #ifdef notdef
1135 			if (so->so_rcv.sb_flags & SB_LOCK) {
1136 				/*
1137 				 * This is problematical; it's not clear
1138 				 * we need to wait for the sockbuf to be
1139 				 * unlocked (on a uniprocessor, at least),
1140 				 * and it's also not clear what to do
1141 				 * if sbwait returns an error due to receipt
1142 				 * of a signal.  If sbwait does return
1143 				 * an error, we'll go into an infinite
1144 				 * loop.  Delete all of this for now.
1145 				 */
1146 				(void) sbwait(&so->so_rcv);
1147 				goto restart;
1148 			}
1149 #endif
1150 			/*
1151 			 * So, Ok, it's one of our sockets and it IS externally
1152 			 * accessible (or was defered). Now we look
1153 			 * to see if we hold any file descriptors in its
1154 			 * message buffers. Follow those links and mark them
1155 			 * as accessible too.
1156 			 */
1157 			unp_scan(so->so_rcv.sb_mb, unp_mark);
1158 		}
1159 	} while (unp_defer);
1160 	/*
1161 	 * We grab an extra reference to each of the file table entries
1162 	 * that are not otherwise accessible and then free the rights
1163 	 * that are stored in messages on them.
1164 	 *
1165 	 * The bug in the orginal code is a little tricky, so I'll describe
1166 	 * what's wrong with it here.
1167 	 *
1168 	 * It is incorrect to simply unp_discard each entry for f_msgcount
1169 	 * times -- consider the case of sockets A and B that contain
1170 	 * references to each other.  On a last close of some other socket,
1171 	 * we trigger a gc since the number of outstanding rights (unp_rights)
1172 	 * is non-zero.  If during the sweep phase the gc code un_discards,
1173 	 * we end up doing a (full) closef on the descriptor.  A closef on A
1174 	 * results in the following chain.  Closef calls soo_close, which
1175 	 * calls soclose.   Soclose calls first (through the switch
1176 	 * uipc_usrreq) unp_detach, which re-invokes unp_gc.  Unp_gc simply
1177 	 * returns because the previous instance had set unp_gcing, and
1178 	 * we return all the way back to soclose, which marks the socket
1179 	 * with SS_NOFDREF, and then calls sofree.  Sofree calls sorflush
1180 	 * to free up the rights that are queued in messages on the socket A,
1181 	 * i.e., the reference on B.  The sorflush calls via the dom_dispose
1182 	 * switch unp_dispose, which unp_scans with unp_discard.  This second
1183 	 * instance of unp_discard just calls closef on B.
1184 	 *
1185 	 * Well, a similar chain occurs on B, resulting in a sorflush on B,
1186 	 * which results in another closef on A.  Unfortunately, A is already
1187 	 * being closed, and the descriptor has already been marked with
1188 	 * SS_NOFDREF, and soclose panics at this point.
1189 	 *
1190 	 * Here, we first take an extra reference to each inaccessible
1191 	 * descriptor.  Then, we call sorflush ourself, since we know
1192 	 * it is a Unix domain socket anyhow.  After we destroy all the
1193 	 * rights carried in messages, we do a last closef to get rid
1194 	 * of our extra reference.  This is the last close, and the
1195 	 * unp_detach etc will shut down the socket.
1196 	 *
1197 	 * 91/09/19, bsy@cs.cmu.edu
1198 	 */
1199 	extra_ref = malloc(nfiles * sizeof(struct file *), M_FILE, M_WAITOK);
1200 	for (nunref = 0, fp = LIST_FIRST(&filehead), fpp = extra_ref; fp != 0;
1201 	    fp = nextfp) {
1202 		nextfp = LIST_NEXT(fp, f_list);
1203 		/*
1204 		 * If it's not open, skip it
1205 		 */
1206 		if (fp->f_count == 0)
1207 			continue;
1208 		/*
1209 		 * If all refs are from msgs, and it's not marked accessible
1210 		 * then it must be referenced from some unreachable cycle
1211 		 * of (shut-down) FDs, so include it in our
1212 		 * list of FDs to remove
1213 		 */
1214 		if (fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) {
1215 			*fpp++ = fp;
1216 			nunref++;
1217 			fp->f_count++;
1218 		}
1219 	}
1220 	/*
1221 	 * for each FD on our hit list, do the following two things
1222 	 */
1223 	for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) {
1224 		struct file *tfp = *fpp;
1225 		if (tfp->f_type == DTYPE_SOCKET && tfp->f_data != NULL)
1226 			sorflush((struct socket *)(tfp->f_data));
1227 	}
1228 	for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp)
1229 		closef(*fpp, (struct proc *) NULL);
1230 	free((caddr_t)extra_ref, M_FILE);
1231 	unp_gcing = 0;
1232 }
1233 
1234 void
1235 unp_dispose(m)
1236 	struct mbuf *m;
1237 {
1238 
1239 	if (m)
1240 		unp_scan(m, unp_discard);
1241 }
1242 
1243 static void
1244 unp_scan(m0, op)
1245 	register struct mbuf *m0;
1246 	void (*op) __P((struct file *));
1247 {
1248 	register struct mbuf *m;
1249 	register struct file **rp;
1250 	register struct cmsghdr *cm;
1251 	register int i;
1252 	int qfds;
1253 
1254 	while (m0) {
1255 		for (m = m0; m; m = m->m_next)
1256 			if (m->m_type == MT_CONTROL &&
1257 			    m->m_len >= sizeof(*cm)) {
1258 				cm = mtod(m, struct cmsghdr *);
1259 				if (cm->cmsg_level != SOL_SOCKET ||
1260 				    cm->cmsg_type != SCM_RIGHTS)
1261 					continue;
1262 				qfds = (cm->cmsg_len -
1263 					(CMSG_DATA(cm) - (u_char *)cm))
1264 						/ sizeof (struct file *);
1265 				rp = (struct file **)CMSG_DATA(cm);
1266 				for (i = 0; i < qfds; i++)
1267 					(*op)(*rp++);
1268 				break;		/* XXX, but saves time */
1269 			}
1270 		m0 = m0->m_act;
1271 	}
1272 }
1273 
1274 static void
1275 unp_mark(fp)
1276 	struct file *fp;
1277 {
1278 
1279 	if (fp->f_flag & FMARK)
1280 		return;
1281 	unp_defer++;
1282 	fp->f_flag |= (FMARK|FDEFER);
1283 }
1284 
1285 static void
1286 unp_discard(fp)
1287 	struct file *fp;
1288 {
1289 
1290 	fp->f_msgcount--;
1291 	unp_rights--;
1292 	(void) closef(fp, (struct proc *)NULL);
1293 }
1294