1 /* $NetBSD: svc_vc.c,v 1.7 2000/08/03 00:01:53 fvdl Exp $ */ 2 3 /*- 4 * SPDX-License-Identifier: BSD-3-Clause 5 * 6 * Copyright (c) 2009, Sun Microsystems, Inc. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions are met: 11 * - Redistributions of source code must retain the above copyright notice, 12 * this list of conditions and the following disclaimer. 13 * - Redistributions in binary form must reproduce the above copyright notice, 14 * this list of conditions and the following disclaimer in the documentation 15 * and/or other materials provided with the distribution. 16 * - Neither the name of Sun Microsystems, Inc. nor the names of its 17 * contributors may be used to endorse or promote products derived 18 * from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 21 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 24 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #if defined(LIBC_SCCS) && !defined(lint) 34 static char *sccsid2 = "@(#)svc_tcp.c 1.21 87/08/11 Copyr 1984 Sun Micro"; 35 static char *sccsid = "@(#)svc_tcp.c 2.2 88/08/01 4.0 RPCSRC"; 36 #endif 37 #include <sys/cdefs.h> 38 /* 39 * svc_vc.c, Server side for Connection Oriented based RPC. 40 * 41 * Actually implements two flavors of transporter - 42 * a tcp rendezvouser (a listner and connection establisher) 43 * and a record/tcp stream. 44 */ 45 46 #include "opt_kern_tls.h" 47 48 #include <sys/param.h> 49 #include <sys/limits.h> 50 #include <sys/lock.h> 51 #include <sys/kernel.h> 52 #include <sys/ktls.h> 53 #include <sys/malloc.h> 54 #include <sys/mbuf.h> 55 #include <sys/mutex.h> 56 #include <sys/proc.h> 57 #include <sys/protosw.h> 58 #include <sys/queue.h> 59 #include <sys/socket.h> 60 #include <sys/socketvar.h> 61 #include <sys/sx.h> 62 #include <sys/systm.h> 63 #include <sys/uio.h> 64 65 #include <net/vnet.h> 66 67 #include <netinet/tcp.h> 68 69 #include <rpc/rpc.h> 70 #include <rpc/rpcsec_tls.h> 71 72 #include <rpc/krpc.h> 73 #include <rpc/rpc_com.h> 74 75 #include <security/mac/mac_framework.h> 76 77 SYSCTL_NODE(_kern, OID_AUTO, rpc, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 78 "RPC"); 79 SYSCTL_NODE(_kern_rpc, OID_AUTO, tls, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 80 "TLS"); 81 SYSCTL_NODE(_kern_rpc, OID_AUTO, unenc, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 82 "unencrypted"); 83 84 KRPC_VNET_DEFINE_STATIC(uint64_t, svc_vc_rx_msgbytes) = 0; 85 SYSCTL_U64(_kern_rpc_unenc, OID_AUTO, rx_msgbytes, CTLFLAG_KRPC_VNET | CTLFLAG_RW, 86 &KRPC_VNET_NAME(svc_vc_rx_msgbytes), 0, "Count of non-TLS rx bytes"); 87 88 KRPC_VNET_DEFINE_STATIC(uint64_t, svc_vc_rx_msgcnt) = 0; 89 SYSCTL_U64(_kern_rpc_unenc, OID_AUTO, rx_msgcnt, CTLFLAG_KRPC_VNET | CTLFLAG_RW, 90 &KRPC_VNET_NAME(svc_vc_rx_msgcnt), 0, "Count of non-TLS rx messages"); 91 92 KRPC_VNET_DEFINE_STATIC(uint64_t, svc_vc_tx_msgbytes) = 0; 93 SYSCTL_U64(_kern_rpc_unenc, OID_AUTO, tx_msgbytes, CTLFLAG_KRPC_VNET | CTLFLAG_RW, 94 &KRPC_VNET_NAME(svc_vc_tx_msgbytes), 0, "Count of non-TLS tx bytes"); 95 96 KRPC_VNET_DEFINE_STATIC(uint64_t, svc_vc_tx_msgcnt) = 0; 97 SYSCTL_U64(_kern_rpc_unenc, OID_AUTO, tx_msgcnt, CTLFLAG_KRPC_VNET | CTLFLAG_RW, 98 &KRPC_VNET_NAME(svc_vc_tx_msgcnt), 0, "Count of non-TLS tx messages"); 99 100 KRPC_VNET_DEFINE_STATIC(uint64_t, svc_vc_tls_alerts) = 0; 101 SYSCTL_U64(_kern_rpc_tls, OID_AUTO, alerts, 102 CTLFLAG_KRPC_VNET | CTLFLAG_RW, &KRPC_VNET_NAME(svc_vc_tls_alerts), 0, 103 "Count of TLS alert messages"); 104 105 KRPC_VNET_DEFINE(uint64_t, svc_vc_tls_handshake_failed) = 0; 106 SYSCTL_U64(_kern_rpc_tls, OID_AUTO, handshake_failed, 107 CTLFLAG_KRPC_VNET | CTLFLAG_RW, 108 &KRPC_VNET_NAME(svc_vc_tls_handshake_failed), 0, 109 "Count of TLS failed handshakes"); 110 111 KRPC_VNET_DEFINE(uint64_t, svc_vc_tls_handshake_success) = 0; 112 SYSCTL_U64(_kern_rpc_tls, OID_AUTO, handshake_success, 113 CTLFLAG_KRPC_VNET | CTLFLAG_RW, 114 &KRPC_VNET_NAME(svc_vc_tls_handshake_success), 0, 115 "Count of TLS successful handshakes"); 116 117 KRPC_VNET_DEFINE_STATIC(uint64_t, svc_vc_tls_rx_msgbytes) = 0; 118 SYSCTL_U64(_kern_rpc_tls, OID_AUTO, rx_msgbytes, 119 CTLFLAG_KRPC_VNET | CTLFLAG_RW, &KRPC_VNET_NAME(svc_vc_tls_rx_msgbytes), 0, 120 "Count of TLS rx bytes"); 121 122 KRPC_VNET_DEFINE_STATIC(uint64_t, svc_vc_tls_rx_msgcnt) = 0; 123 SYSCTL_U64(_kern_rpc_tls, OID_AUTO, rx_msgcnt, 124 CTLFLAG_KRPC_VNET | CTLFLAG_RW, &KRPC_VNET_NAME(svc_vc_tls_rx_msgcnt), 0, 125 "Count of TLS rx messages"); 126 127 KRPC_VNET_DEFINE_STATIC(uint64_t, svc_vc_tls_tx_msgbytes) = 0; 128 SYSCTL_U64(_kern_rpc_tls, OID_AUTO, tx_msgbytes, 129 CTLFLAG_KRPC_VNET | CTLFLAG_RW, &KRPC_VNET_NAME(svc_vc_tls_tx_msgbytes), 0, 130 "Count of TLS tx bytes"); 131 132 KRPC_VNET_DEFINE_STATIC(uint64_t, svc_vc_tls_tx_msgcnt) = 0; 133 SYSCTL_U64(_kern_rpc_tls, OID_AUTO, tx_msgcnt, 134 CTLFLAG_KRPC_VNET | CTLFLAG_RW, &KRPC_VNET_NAME(svc_vc_tls_tx_msgcnt), 0, 135 "Count of TLS tx messages"); 136 137 static bool_t svc_vc_rendezvous_recv(SVCXPRT *, struct rpc_msg *, 138 struct sockaddr **, struct mbuf **); 139 static enum xprt_stat svc_vc_rendezvous_stat(SVCXPRT *); 140 static void svc_vc_rendezvous_destroy(SVCXPRT *); 141 static bool_t svc_vc_null(void); 142 static void svc_vc_destroy(SVCXPRT *); 143 static enum xprt_stat svc_vc_stat(SVCXPRT *); 144 static bool_t svc_vc_ack(SVCXPRT *, uint32_t *); 145 static bool_t svc_vc_recv(SVCXPRT *, struct rpc_msg *, 146 struct sockaddr **, struct mbuf **); 147 static bool_t svc_vc_reply(SVCXPRT *, struct rpc_msg *, 148 struct sockaddr *, struct mbuf *, uint32_t *seq); 149 static bool_t svc_vc_control(SVCXPRT *xprt, const u_int rq, void *in); 150 static bool_t svc_vc_rendezvous_control (SVCXPRT *xprt, const u_int rq, 151 void *in); 152 static void svc_vc_backchannel_destroy(SVCXPRT *); 153 static enum xprt_stat svc_vc_backchannel_stat(SVCXPRT *); 154 static bool_t svc_vc_backchannel_recv(SVCXPRT *, struct rpc_msg *, 155 struct sockaddr **, struct mbuf **); 156 static bool_t svc_vc_backchannel_reply(SVCXPRT *, struct rpc_msg *, 157 struct sockaddr *, struct mbuf *, uint32_t *); 158 static bool_t svc_vc_backchannel_control(SVCXPRT *xprt, const u_int rq, 159 void *in); 160 static SVCXPRT *svc_vc_create_conn(SVCPOOL *pool, struct socket *so, 161 struct sockaddr *raddr); 162 static int svc_vc_accept(struct socket *head, struct socket **sop); 163 static int svc_vc_soupcall(struct socket *so, void *arg, int waitflag); 164 static int svc_vc_rendezvous_soupcall(struct socket *, void *, int); 165 166 static const struct xp_ops svc_vc_rendezvous_ops = { 167 .xp_recv = svc_vc_rendezvous_recv, 168 .xp_stat = svc_vc_rendezvous_stat, 169 .xp_reply = (bool_t (*)(SVCXPRT *, struct rpc_msg *, 170 struct sockaddr *, struct mbuf *, uint32_t *))svc_vc_null, 171 .xp_destroy = svc_vc_rendezvous_destroy, 172 .xp_control = svc_vc_rendezvous_control 173 }; 174 175 static const struct xp_ops svc_vc_ops = { 176 .xp_recv = svc_vc_recv, 177 .xp_stat = svc_vc_stat, 178 .xp_ack = svc_vc_ack, 179 .xp_reply = svc_vc_reply, 180 .xp_destroy = svc_vc_destroy, 181 .xp_control = svc_vc_control 182 }; 183 184 static const struct xp_ops svc_vc_backchannel_ops = { 185 .xp_recv = svc_vc_backchannel_recv, 186 .xp_stat = svc_vc_backchannel_stat, 187 .xp_reply = svc_vc_backchannel_reply, 188 .xp_destroy = svc_vc_backchannel_destroy, 189 .xp_control = svc_vc_backchannel_control 190 }; 191 192 /* 193 * Usage: 194 * xprt = svc_vc_create(sock, send_buf_size, recv_buf_size); 195 * 196 * Creates, registers, and returns a (rpc) tcp based transporter. 197 * Once *xprt is initialized, it is registered as a transporter 198 * see (svc.h, xprt_register). This routine returns 199 * a NULL if a problem occurred. 200 * 201 * The filedescriptor passed in is expected to refer to a bound, but 202 * not yet connected socket. 203 * 204 * Since streams do buffered io similar to stdio, the caller can specify 205 * how big the send and receive buffers are via the second and third parms; 206 * 0 => use the system default. 207 */ 208 SVCXPRT * 209 svc_vc_create(SVCPOOL *pool, struct socket *so, size_t sendsize, 210 size_t recvsize) 211 { 212 SVCXPRT *xprt; 213 struct sockaddr* sa; 214 int error; 215 216 SOCK_LOCK(so); 217 if (so->so_state & (SS_ISCONNECTED|SS_ISDISCONNECTED)) { 218 SOCK_UNLOCK(so); 219 CURVNET_SET(so->so_vnet); 220 error = so->so_proto->pr_peeraddr(so, &sa); 221 CURVNET_RESTORE(); 222 if (error) 223 return (NULL); 224 xprt = svc_vc_create_conn(pool, so, sa); 225 free(sa, M_SONAME); 226 return (xprt); 227 } 228 SOCK_UNLOCK(so); 229 230 xprt = svc_xprt_alloc(); 231 sx_init(&xprt->xp_lock, "xprt->xp_lock"); 232 xprt->xp_pool = pool; 233 xprt->xp_socket = so; 234 xprt->xp_p1 = NULL; 235 xprt->xp_p2 = NULL; 236 xprt->xp_ops = &svc_vc_rendezvous_ops; 237 238 CURVNET_SET(so->so_vnet); 239 error = so->so_proto->pr_sockaddr(so, &sa); 240 CURVNET_RESTORE(); 241 if (error) { 242 goto cleanup_svc_vc_create; 243 } 244 245 memcpy(&xprt->xp_ltaddr, sa, sa->sa_len); 246 free(sa, M_SONAME); 247 248 xprt_register(xprt); 249 250 solisten(so, -1, curthread); 251 252 SOLISTEN_LOCK(so); 253 xprt->xp_upcallset = 1; 254 solisten_upcall_set(so, svc_vc_rendezvous_soupcall, xprt); 255 SOLISTEN_UNLOCK(so); 256 257 return (xprt); 258 259 cleanup_svc_vc_create: 260 sx_destroy(&xprt->xp_lock); 261 svc_xprt_free(xprt); 262 263 return (NULL); 264 } 265 266 /* 267 * Create a new transport for a socket optained via soaccept(). 268 */ 269 SVCXPRT * 270 svc_vc_create_conn(SVCPOOL *pool, struct socket *so, struct sockaddr *raddr) 271 { 272 SVCXPRT *xprt; 273 struct cf_conn *cd; 274 struct sockaddr* sa = NULL; 275 struct sockopt opt; 276 int one = 1; 277 int error; 278 279 bzero(&opt, sizeof(struct sockopt)); 280 opt.sopt_dir = SOPT_SET; 281 opt.sopt_level = SOL_SOCKET; 282 opt.sopt_name = SO_KEEPALIVE; 283 opt.sopt_val = &one; 284 opt.sopt_valsize = sizeof(one); 285 error = sosetopt(so, &opt); 286 if (error) { 287 return (NULL); 288 } 289 290 if (so->so_proto->pr_protocol == IPPROTO_TCP) { 291 bzero(&opt, sizeof(struct sockopt)); 292 opt.sopt_dir = SOPT_SET; 293 opt.sopt_level = IPPROTO_TCP; 294 opt.sopt_name = TCP_NODELAY; 295 opt.sopt_val = &one; 296 opt.sopt_valsize = sizeof(one); 297 error = sosetopt(so, &opt); 298 if (error) { 299 return (NULL); 300 } 301 } 302 303 cd = mem_alloc(sizeof(*cd)); 304 cd->strm_stat = XPRT_IDLE; 305 306 xprt = svc_xprt_alloc(); 307 sx_init(&xprt->xp_lock, "xprt->xp_lock"); 308 xprt->xp_pool = pool; 309 xprt->xp_socket = so; 310 xprt->xp_p1 = cd; 311 xprt->xp_p2 = NULL; 312 xprt->xp_ops = &svc_vc_ops; 313 314 /* 315 * See http://www.connectathon.org/talks96/nfstcp.pdf - client 316 * has a 5 minute timer, server has a 6 minute timer. 317 */ 318 xprt->xp_idletimeout = 6 * 60; 319 320 memcpy(&xprt->xp_rtaddr, raddr, raddr->sa_len); 321 322 CURVNET_SET(so->so_vnet); 323 error = so->so_proto->pr_sockaddr(so, &sa); 324 CURVNET_RESTORE(); 325 if (error) 326 goto cleanup_svc_vc_create; 327 328 memcpy(&xprt->xp_ltaddr, sa, sa->sa_len); 329 free(sa, M_SONAME); 330 331 xprt_register(xprt); 332 333 SOCKBUF_LOCK(&so->so_rcv); 334 xprt->xp_upcallset = 1; 335 soupcall_set(so, SO_RCV, svc_vc_soupcall, xprt); 336 SOCKBUF_UNLOCK(&so->so_rcv); 337 338 /* 339 * Throw the transport into the active list in case it already 340 * has some data buffered. 341 */ 342 sx_xlock(&xprt->xp_lock); 343 xprt_active(xprt); 344 sx_xunlock(&xprt->xp_lock); 345 346 return (xprt); 347 cleanup_svc_vc_create: 348 sx_destroy(&xprt->xp_lock); 349 svc_xprt_free(xprt); 350 mem_free(cd, sizeof(*cd)); 351 352 return (NULL); 353 } 354 355 /* 356 * Create a new transport for a backchannel on a clnt_vc socket. 357 */ 358 SVCXPRT * 359 svc_vc_create_backchannel(SVCPOOL *pool) 360 { 361 SVCXPRT *xprt = NULL; 362 struct cf_conn *cd = NULL; 363 364 cd = mem_alloc(sizeof(*cd)); 365 cd->strm_stat = XPRT_IDLE; 366 367 xprt = svc_xprt_alloc(); 368 sx_init(&xprt->xp_lock, "xprt->xp_lock"); 369 xprt->xp_pool = pool; 370 xprt->xp_socket = NULL; 371 xprt->xp_p1 = cd; 372 xprt->xp_p2 = NULL; 373 xprt->xp_ops = &svc_vc_backchannel_ops; 374 return (xprt); 375 } 376 377 /* 378 * This does all of the accept except the final call to soaccept. The 379 * caller will call soaccept after dropping its locks (soaccept may 380 * call malloc). 381 */ 382 int 383 svc_vc_accept(struct socket *head, struct socket **sop) 384 { 385 struct socket *so; 386 int error = 0; 387 short nbio; 388 389 KASSERT(SOLISTENING(head), 390 ("%s: socket %p is not listening", __func__, head)); 391 392 #ifdef MAC 393 error = mac_socket_check_accept(curthread->td_ucred, head); 394 if (error != 0) 395 goto done; 396 #endif 397 /* 398 * XXXGL: we want non-blocking semantics. The socket could be a 399 * socket created by kernel as well as socket shared with userland, 400 * so we can't be sure about presense of SS_NBIO. We also shall not 401 * toggle it on the socket, since that may surprise userland. So we 402 * set SS_NBIO only temporarily. 403 */ 404 SOLISTEN_LOCK(head); 405 nbio = head->so_state & SS_NBIO; 406 head->so_state |= SS_NBIO; 407 error = solisten_dequeue(head, &so, 0); 408 head->so_state &= (nbio & ~SS_NBIO); 409 if (error) 410 goto done; 411 412 so->so_state |= nbio; 413 *sop = so; 414 415 /* connection has been removed from the listen queue */ 416 KNOTE_UNLOCKED(&head->so_rdsel.si_note, 0); 417 done: 418 return (error); 419 } 420 421 /*ARGSUSED*/ 422 static bool_t 423 svc_vc_rendezvous_recv(SVCXPRT *xprt, struct rpc_msg *msg, 424 struct sockaddr **addrp, struct mbuf **mp) 425 { 426 struct socket *so = NULL; 427 struct sockaddr *sa = NULL; 428 int error; 429 SVCXPRT *new_xprt; 430 431 /* 432 * The socket upcall calls xprt_active() which will eventually 433 * cause the server to call us here. We attempt to accept a 434 * connection from the socket and turn it into a new 435 * transport. If the accept fails, we have drained all pending 436 * connections so we call xprt_inactive(). 437 */ 438 sx_xlock(&xprt->xp_lock); 439 440 error = svc_vc_accept(xprt->xp_socket, &so); 441 442 if (error == EWOULDBLOCK) { 443 /* 444 * We must re-test for new connections after taking 445 * the lock to protect us in the case where a new 446 * connection arrives after our call to accept fails 447 * with EWOULDBLOCK. 448 */ 449 SOLISTEN_LOCK(xprt->xp_socket); 450 if (TAILQ_EMPTY(&xprt->xp_socket->sol_comp)) 451 xprt_inactive_self(xprt); 452 SOLISTEN_UNLOCK(xprt->xp_socket); 453 sx_xunlock(&xprt->xp_lock); 454 return (FALSE); 455 } 456 457 if (error) { 458 SOLISTEN_LOCK(xprt->xp_socket); 459 if (xprt->xp_upcallset) { 460 xprt->xp_upcallset = 0; 461 soupcall_clear(xprt->xp_socket, SO_RCV); 462 } 463 SOLISTEN_UNLOCK(xprt->xp_socket); 464 xprt_inactive_self(xprt); 465 sx_xunlock(&xprt->xp_lock); 466 return (FALSE); 467 } 468 469 sx_xunlock(&xprt->xp_lock); 470 471 sa = NULL; 472 error = soaccept(so, &sa); 473 474 if (error) { 475 /* 476 * XXX not sure if I need to call sofree or soclose here. 477 */ 478 if (sa) 479 free(sa, M_SONAME); 480 return (FALSE); 481 } 482 483 /* 484 * svc_vc_create_conn will call xprt_register - we don't need 485 * to do anything with the new connection except derefence it. 486 */ 487 new_xprt = svc_vc_create_conn(xprt->xp_pool, so, sa); 488 if (!new_xprt) { 489 soclose(so); 490 } else { 491 SVC_RELEASE(new_xprt); 492 } 493 494 free(sa, M_SONAME); 495 496 return (FALSE); /* there is never an rpc msg to be processed */ 497 } 498 499 /*ARGSUSED*/ 500 static enum xprt_stat 501 svc_vc_rendezvous_stat(SVCXPRT *xprt) 502 { 503 504 return (XPRT_IDLE); 505 } 506 507 static void 508 svc_vc_destroy_common(SVCXPRT *xprt) 509 { 510 uint32_t reterr; 511 512 if (xprt->xp_socket) { 513 if ((xprt->xp_tls & (RPCTLS_FLAGS_HANDSHAKE | 514 RPCTLS_FLAGS_HANDSHFAIL)) != 0) { 515 if ((xprt->xp_tls & RPCTLS_FLAGS_HANDSHAKE) != 0) { 516 /* 517 * If the upcall fails, the socket has 518 * probably been closed via the rpctlssd 519 * daemon having crashed or been 520 * restarted, so just ignore returned stat. 521 */ 522 rpctls_srv_disconnect(xprt->xp_sslsec, 523 xprt->xp_sslusec, xprt->xp_sslrefno, 524 xprt->xp_sslproc, &reterr); 525 } 526 /* Must sorele() to get rid of reference. */ 527 CURVNET_SET(xprt->xp_socket->so_vnet); 528 sorele(xprt->xp_socket); 529 CURVNET_RESTORE(); 530 } else 531 (void)soclose(xprt->xp_socket); 532 } 533 534 if (xprt->xp_netid) 535 (void) mem_free(xprt->xp_netid, strlen(xprt->xp_netid) + 1); 536 svc_xprt_free(xprt); 537 } 538 539 static void 540 svc_vc_rendezvous_destroy(SVCXPRT *xprt) 541 { 542 543 SOLISTEN_LOCK(xprt->xp_socket); 544 if (xprt->xp_upcallset) { 545 xprt->xp_upcallset = 0; 546 solisten_upcall_set(xprt->xp_socket, NULL, NULL); 547 } 548 SOLISTEN_UNLOCK(xprt->xp_socket); 549 550 svc_vc_destroy_common(xprt); 551 } 552 553 static void 554 svc_vc_destroy(SVCXPRT *xprt) 555 { 556 struct cf_conn *cd = (struct cf_conn *)xprt->xp_p1; 557 CLIENT *cl = (CLIENT *)xprt->xp_p2; 558 559 SOCKBUF_LOCK(&xprt->xp_socket->so_rcv); 560 if (xprt->xp_upcallset) { 561 xprt->xp_upcallset = 0; 562 if (xprt->xp_socket->so_rcv.sb_upcall != NULL) 563 soupcall_clear(xprt->xp_socket, SO_RCV); 564 } 565 SOCKBUF_UNLOCK(&xprt->xp_socket->so_rcv); 566 567 if (cl != NULL) 568 CLNT_RELEASE(cl); 569 570 svc_vc_destroy_common(xprt); 571 572 if (cd->mreq) 573 m_freem(cd->mreq); 574 if (cd->mpending) 575 m_freem(cd->mpending); 576 mem_free(cd, sizeof(*cd)); 577 } 578 579 static void 580 svc_vc_backchannel_destroy(SVCXPRT *xprt) 581 { 582 struct cf_conn *cd = (struct cf_conn *)xprt->xp_p1; 583 struct mbuf *m, *m2; 584 585 svc_xprt_free(xprt); 586 m = cd->mreq; 587 while (m != NULL) { 588 m2 = m; 589 m = m->m_nextpkt; 590 m_freem(m2); 591 } 592 mem_free(cd, sizeof(*cd)); 593 } 594 595 /*ARGSUSED*/ 596 static bool_t 597 svc_vc_control(SVCXPRT *xprt, const u_int rq, void *in) 598 { 599 return (FALSE); 600 } 601 602 static bool_t 603 svc_vc_rendezvous_control(SVCXPRT *xprt, const u_int rq, void *in) 604 { 605 606 return (FALSE); 607 } 608 609 static bool_t 610 svc_vc_backchannel_control(SVCXPRT *xprt, const u_int rq, void *in) 611 { 612 613 return (FALSE); 614 } 615 616 static enum xprt_stat 617 svc_vc_stat(SVCXPRT *xprt) 618 { 619 struct cf_conn *cd; 620 621 cd = (struct cf_conn *)(xprt->xp_p1); 622 623 if (cd->strm_stat == XPRT_DIED) 624 return (XPRT_DIED); 625 626 if (cd->mreq != NULL && cd->resid == 0 && cd->eor) 627 return (XPRT_MOREREQS); 628 629 if (soreadable(xprt->xp_socket)) 630 return (XPRT_MOREREQS); 631 632 return (XPRT_IDLE); 633 } 634 635 static bool_t 636 svc_vc_ack(SVCXPRT *xprt, uint32_t *ack) 637 { 638 639 *ack = atomic_load_acq_32(&xprt->xp_snt_cnt); 640 *ack -= sbused(&xprt->xp_socket->so_snd); 641 return (TRUE); 642 } 643 644 static enum xprt_stat 645 svc_vc_backchannel_stat(SVCXPRT *xprt) 646 { 647 struct cf_conn *cd; 648 649 cd = (struct cf_conn *)(xprt->xp_p1); 650 651 if (cd->mreq != NULL) 652 return (XPRT_MOREREQS); 653 654 return (XPRT_IDLE); 655 } 656 657 /* 658 * If we have an mbuf chain in cd->mpending, try to parse a record from it, 659 * leaving the result in cd->mreq. If we don't have a complete record, leave 660 * the partial result in cd->mreq and try to read more from the socket. 661 */ 662 static int 663 svc_vc_process_pending(SVCXPRT *xprt) 664 { 665 struct cf_conn *cd = (struct cf_conn *) xprt->xp_p1; 666 struct socket *so = xprt->xp_socket; 667 struct mbuf *m; 668 669 /* 670 * If cd->resid is non-zero, we have part of the 671 * record already, otherwise we are expecting a record 672 * marker. 673 */ 674 if (!cd->resid && cd->mpending) { 675 /* 676 * See if there is enough data buffered to 677 * make up a record marker. Make sure we can 678 * handle the case where the record marker is 679 * split across more than one mbuf. 680 */ 681 size_t n = 0; 682 uint32_t header; 683 684 m = cd->mpending; 685 while (n < sizeof(uint32_t) && m) { 686 n += m->m_len; 687 m = m->m_next; 688 } 689 if (n < sizeof(uint32_t)) { 690 so->so_rcv.sb_lowat = sizeof(uint32_t) - n; 691 return (FALSE); 692 } 693 m_copydata(cd->mpending, 0, sizeof(header), 694 (char *)&header); 695 header = ntohl(header); 696 cd->eor = (header & 0x80000000) != 0; 697 cd->resid = header & 0x7fffffff; 698 m_adj(cd->mpending, sizeof(uint32_t)); 699 } 700 701 /* 702 * Start pulling off mbufs from cd->mpending 703 * until we either have a complete record or 704 * we run out of data. We use m_split to pull 705 * data - it will pull as much as possible and 706 * split the last mbuf if necessary. 707 */ 708 while (cd->mpending && cd->resid) { 709 m = cd->mpending; 710 if (cd->mpending->m_next 711 || cd->mpending->m_len > cd->resid) 712 cd->mpending = m_split(cd->mpending, 713 cd->resid, M_WAITOK); 714 else 715 cd->mpending = NULL; 716 if (cd->mreq) 717 m_last(cd->mreq)->m_next = m; 718 else 719 cd->mreq = m; 720 while (m) { 721 cd->resid -= m->m_len; 722 m = m->m_next; 723 } 724 } 725 726 /* 727 * Block receive upcalls if we have more data pending, 728 * otherwise report our need. 729 */ 730 if (cd->mpending) 731 so->so_rcv.sb_lowat = INT_MAX; 732 else 733 so->so_rcv.sb_lowat = 734 imax(1, imin(cd->resid, so->so_rcv.sb_hiwat / 2)); 735 return (TRUE); 736 } 737 738 static bool_t 739 svc_vc_recv(SVCXPRT *xprt, struct rpc_msg *msg, 740 struct sockaddr **addrp, struct mbuf **mp) 741 { 742 struct cf_conn *cd = (struct cf_conn *) xprt->xp_p1; 743 struct uio uio; 744 struct mbuf *m, *ctrl; 745 struct socket* so = xprt->xp_socket; 746 XDR xdrs; 747 int error, rcvflag; 748 uint32_t reterr, xid_plus_direction[2]; 749 struct cmsghdr *cmsg; 750 struct tls_get_record tgr; 751 enum clnt_stat ret; 752 753 /* 754 * Serialise access to the socket and our own record parsing 755 * state. 756 */ 757 sx_xlock(&xprt->xp_lock); 758 759 for (;;) { 760 /* If we have no request ready, check pending queue. */ 761 while (cd->mpending && 762 (cd->mreq == NULL || cd->resid != 0 || !cd->eor)) { 763 if (!svc_vc_process_pending(xprt)) 764 break; 765 } 766 767 /* Process and return complete request in cd->mreq. */ 768 if (cd->mreq != NULL && cd->resid == 0 && cd->eor) { 769 770 /* 771 * Now, check for a backchannel reply. 772 * The XID is in the first uint32_t of the reply 773 * and the message direction is the second one. 774 */ 775 if ((cd->mreq->m_len >= sizeof(xid_plus_direction) || 776 m_length(cd->mreq, NULL) >= 777 sizeof(xid_plus_direction)) && 778 xprt->xp_p2 != NULL) { 779 m_copydata(cd->mreq, 0, 780 sizeof(xid_plus_direction), 781 (char *)xid_plus_direction); 782 xid_plus_direction[0] = 783 ntohl(xid_plus_direction[0]); 784 xid_plus_direction[1] = 785 ntohl(xid_plus_direction[1]); 786 /* Check message direction. */ 787 if (xid_plus_direction[1] == REPLY) { 788 clnt_bck_svccall(xprt->xp_p2, 789 cd->mreq, 790 xid_plus_direction[0]); 791 cd->mreq = NULL; 792 continue; 793 } 794 } 795 796 xdrmbuf_create(&xdrs, cd->mreq, XDR_DECODE); 797 cd->mreq = NULL; 798 799 /* Check for next request in a pending queue. */ 800 svc_vc_process_pending(xprt); 801 if (cd->mreq == NULL || cd->resid != 0) { 802 SOCKBUF_LOCK(&so->so_rcv); 803 if (!soreadable(so)) 804 xprt_inactive_self(xprt); 805 SOCKBUF_UNLOCK(&so->so_rcv); 806 } 807 808 sx_xunlock(&xprt->xp_lock); 809 810 if (! xdr_callmsg(&xdrs, msg)) { 811 XDR_DESTROY(&xdrs); 812 return (FALSE); 813 } 814 815 *addrp = NULL; 816 *mp = xdrmbuf_getall(&xdrs); 817 XDR_DESTROY(&xdrs); 818 819 return (TRUE); 820 } 821 822 /* 823 * If receiving is disabled so that a TLS handshake can be 824 * done by the rpctlssd daemon, return FALSE here. 825 */ 826 rcvflag = MSG_DONTWAIT; 827 if ((xprt->xp_tls & RPCTLS_FLAGS_HANDSHAKE) != 0) 828 rcvflag |= MSG_TLSAPPDATA; 829 tryagain: 830 if (xprt->xp_dontrcv) { 831 sx_xunlock(&xprt->xp_lock); 832 return (FALSE); 833 } 834 835 /* 836 * The socket upcall calls xprt_active() which will eventually 837 * cause the server to call us here. We attempt to 838 * read as much as possible from the socket and put 839 * the result in cd->mpending. If the read fails, 840 * we have drained both cd->mpending and the socket so 841 * we can call xprt_inactive(). 842 */ 843 uio.uio_resid = 1000000000; 844 uio.uio_td = curthread; 845 ctrl = m = NULL; 846 error = soreceive(so, NULL, &uio, &m, &ctrl, &rcvflag); 847 848 if (error == EWOULDBLOCK) { 849 /* 850 * We must re-test for readability after 851 * taking the lock to protect us in the case 852 * where a new packet arrives on the socket 853 * after our call to soreceive fails with 854 * EWOULDBLOCK. 855 */ 856 SOCKBUF_LOCK(&so->so_rcv); 857 if (!soreadable(so)) 858 xprt_inactive_self(xprt); 859 SOCKBUF_UNLOCK(&so->so_rcv); 860 sx_xunlock(&xprt->xp_lock); 861 return (FALSE); 862 } 863 864 /* 865 * A return of ENXIO indicates that there is an 866 * alert record at the head of the 867 * socket's receive queue, for TLS connections. 868 * This record needs to be handled in userland 869 * via an SSL_read() call, so do an upcall to the daemon. 870 */ 871 KRPC_CURVNET_SET(so->so_vnet); 872 if ((xprt->xp_tls & RPCTLS_FLAGS_HANDSHAKE) != 0 && 873 error == ENXIO) { 874 KRPC_VNET(svc_vc_tls_alerts)++; 875 KRPC_CURVNET_RESTORE(); 876 /* Disable reception. */ 877 xprt->xp_dontrcv = TRUE; 878 sx_xunlock(&xprt->xp_lock); 879 ret = rpctls_srv_handlerecord(xprt->xp_sslsec, 880 xprt->xp_sslusec, xprt->xp_sslrefno, 881 xprt->xp_sslproc, &reterr); 882 sx_xlock(&xprt->xp_lock); 883 xprt->xp_dontrcv = FALSE; 884 if (ret != RPC_SUCCESS || reterr != RPCTLSERR_OK) { 885 /* 886 * All we can do is soreceive() it and 887 * then toss it. 888 */ 889 rcvflag = MSG_DONTWAIT; 890 goto tryagain; 891 } 892 sx_xunlock(&xprt->xp_lock); 893 xprt_active(xprt); /* Harmless if already active. */ 894 return (FALSE); 895 } 896 897 if (error) { 898 KRPC_CURVNET_RESTORE(); 899 SOCKBUF_LOCK(&so->so_rcv); 900 if (xprt->xp_upcallset) { 901 xprt->xp_upcallset = 0; 902 soupcall_clear(so, SO_RCV); 903 } 904 SOCKBUF_UNLOCK(&so->so_rcv); 905 xprt_inactive_self(xprt); 906 cd->strm_stat = XPRT_DIED; 907 sx_xunlock(&xprt->xp_lock); 908 return (FALSE); 909 } 910 911 if (!m) { 912 KRPC_CURVNET_RESTORE(); 913 /* 914 * EOF - the other end has closed the socket. 915 */ 916 xprt_inactive_self(xprt); 917 cd->strm_stat = XPRT_DIED; 918 sx_xunlock(&xprt->xp_lock); 919 return (FALSE); 920 } 921 922 /* Process any record header(s). */ 923 if (ctrl != NULL) { 924 cmsg = mtod(ctrl, struct cmsghdr *); 925 if (cmsg->cmsg_type == TLS_GET_RECORD && 926 cmsg->cmsg_len == CMSG_LEN(sizeof(tgr))) { 927 memcpy(&tgr, CMSG_DATA(cmsg), sizeof(tgr)); 928 /* 929 * TLS_RLTYPE_ALERT records should be handled 930 * since soreceive() would have returned 931 * ENXIO. Just throw any other 932 * non-TLS_RLTYPE_APP records away. 933 */ 934 if (tgr.tls_type != TLS_RLTYPE_APP) { 935 m_freem(m); 936 m_free(ctrl); 937 rcvflag = MSG_DONTWAIT | MSG_TLSAPPDATA; 938 KRPC_CURVNET_RESTORE(); 939 goto tryagain; 940 } 941 KRPC_VNET(svc_vc_tls_rx_msgcnt)++; 942 KRPC_VNET(svc_vc_tls_rx_msgbytes) += 943 1000000000 - uio.uio_resid; 944 } 945 m_free(ctrl); 946 } else { 947 KRPC_VNET(svc_vc_rx_msgcnt)++; 948 KRPC_VNET(svc_vc_rx_msgbytes) += 1000000000 - 949 uio.uio_resid; 950 } 951 KRPC_CURVNET_RESTORE(); 952 953 if (cd->mpending) 954 m_last(cd->mpending)->m_next = m; 955 else 956 cd->mpending = m; 957 } 958 } 959 960 static bool_t 961 svc_vc_backchannel_recv(SVCXPRT *xprt, struct rpc_msg *msg, 962 struct sockaddr **addrp, struct mbuf **mp) 963 { 964 struct cf_conn *cd = (struct cf_conn *) xprt->xp_p1; 965 struct ct_data *ct; 966 struct mbuf *m; 967 XDR xdrs; 968 969 sx_xlock(&xprt->xp_lock); 970 ct = (struct ct_data *)xprt->xp_p2; 971 if (ct == NULL) { 972 sx_xunlock(&xprt->xp_lock); 973 return (FALSE); 974 } 975 mtx_lock(&ct->ct_lock); 976 m = cd->mreq; 977 if (m == NULL) { 978 xprt_inactive_self(xprt); 979 mtx_unlock(&ct->ct_lock); 980 sx_xunlock(&xprt->xp_lock); 981 return (FALSE); 982 } 983 cd->mreq = m->m_nextpkt; 984 mtx_unlock(&ct->ct_lock); 985 sx_xunlock(&xprt->xp_lock); 986 987 xdrmbuf_create(&xdrs, m, XDR_DECODE); 988 if (! xdr_callmsg(&xdrs, msg)) { 989 XDR_DESTROY(&xdrs); 990 return (FALSE); 991 } 992 *addrp = NULL; 993 *mp = xdrmbuf_getall(&xdrs); 994 XDR_DESTROY(&xdrs); 995 return (TRUE); 996 } 997 998 static bool_t 999 svc_vc_reply(SVCXPRT *xprt, struct rpc_msg *msg, 1000 struct sockaddr *addr, struct mbuf *m, uint32_t *seq) 1001 { 1002 XDR xdrs; 1003 struct mbuf *mrep; 1004 bool_t stat = TRUE; 1005 int error, len, maxextsiz; 1006 #ifdef KERN_TLS 1007 u_int maxlen; 1008 #endif 1009 1010 /* 1011 * Leave space for record mark. 1012 */ 1013 mrep = m_gethdr(M_WAITOK, MT_DATA); 1014 mrep->m_data += sizeof(uint32_t); 1015 1016 xdrmbuf_create(&xdrs, mrep, XDR_ENCODE); 1017 1018 if (msg->rm_reply.rp_stat == MSG_ACCEPTED && 1019 msg->rm_reply.rp_acpt.ar_stat == SUCCESS) { 1020 if (!xdr_replymsg(&xdrs, msg)) 1021 stat = FALSE; 1022 else 1023 xdrmbuf_append(&xdrs, m); 1024 } else { 1025 stat = xdr_replymsg(&xdrs, msg); 1026 } 1027 1028 if (stat) { 1029 m_fixhdr(mrep); 1030 1031 /* 1032 * Prepend a record marker containing the reply length. 1033 */ 1034 M_PREPEND(mrep, sizeof(uint32_t), M_WAITOK); 1035 len = mrep->m_pkthdr.len; 1036 *mtod(mrep, uint32_t *) = 1037 htonl(0x80000000 | (len - sizeof(uint32_t))); 1038 1039 /* For RPC-over-TLS, copy mrep to a chain of ext_pgs. */ 1040 KRPC_CURVNET_SET(xprt->xp_socket->so_vnet); 1041 if ((xprt->xp_tls & RPCTLS_FLAGS_HANDSHAKE) != 0) { 1042 /* 1043 * Copy the mbuf chain to a chain of 1044 * ext_pgs mbuf(s) as required by KERN_TLS. 1045 */ 1046 maxextsiz = TLS_MAX_MSG_SIZE_V10_2; 1047 #ifdef KERN_TLS 1048 if (rpctls_getinfo(&maxlen, false, false)) 1049 maxextsiz = min(maxextsiz, maxlen); 1050 #endif 1051 mrep = _rpc_copym_into_ext_pgs(mrep, maxextsiz); 1052 KRPC_VNET(svc_vc_tls_tx_msgcnt)++; 1053 KRPC_VNET(svc_vc_tls_tx_msgbytes) += len; 1054 } else { 1055 KRPC_VNET(svc_vc_tx_msgcnt)++; 1056 KRPC_VNET(svc_vc_tx_msgbytes) += len; 1057 } 1058 KRPC_CURVNET_RESTORE(); 1059 atomic_add_32(&xprt->xp_snd_cnt, len); 1060 /* 1061 * sosend consumes mreq. 1062 */ 1063 error = sosend(xprt->xp_socket, NULL, NULL, mrep, NULL, 1064 0, curthread); 1065 if (!error) { 1066 atomic_add_rel_32(&xprt->xp_snt_cnt, len); 1067 if (seq) 1068 *seq = xprt->xp_snd_cnt; 1069 stat = TRUE; 1070 } else 1071 atomic_subtract_32(&xprt->xp_snd_cnt, len); 1072 } else { 1073 m_freem(mrep); 1074 } 1075 1076 XDR_DESTROY(&xdrs); 1077 1078 return (stat); 1079 } 1080 1081 static bool_t 1082 svc_vc_backchannel_reply(SVCXPRT *xprt, struct rpc_msg *msg, 1083 struct sockaddr *addr, struct mbuf *m, uint32_t *seq) 1084 { 1085 struct ct_data *ct; 1086 XDR xdrs; 1087 struct mbuf *mrep; 1088 bool_t stat = TRUE; 1089 int error, maxextsiz; 1090 #ifdef KERN_TLS 1091 u_int maxlen; 1092 #endif 1093 1094 /* 1095 * Leave space for record mark. 1096 */ 1097 mrep = m_gethdr(M_WAITOK, MT_DATA); 1098 mrep->m_data += sizeof(uint32_t); 1099 1100 xdrmbuf_create(&xdrs, mrep, XDR_ENCODE); 1101 1102 if (msg->rm_reply.rp_stat == MSG_ACCEPTED && 1103 msg->rm_reply.rp_acpt.ar_stat == SUCCESS) { 1104 if (!xdr_replymsg(&xdrs, msg)) 1105 stat = FALSE; 1106 else 1107 xdrmbuf_append(&xdrs, m); 1108 } else { 1109 stat = xdr_replymsg(&xdrs, msg); 1110 } 1111 1112 if (stat) { 1113 m_fixhdr(mrep); 1114 1115 /* 1116 * Prepend a record marker containing the reply length. 1117 */ 1118 M_PREPEND(mrep, sizeof(uint32_t), M_WAITOK); 1119 *mtod(mrep, uint32_t *) = 1120 htonl(0x80000000 | (mrep->m_pkthdr.len 1121 - sizeof(uint32_t))); 1122 1123 /* For RPC-over-TLS, copy mrep to a chain of ext_pgs. */ 1124 if ((xprt->xp_tls & RPCTLS_FLAGS_HANDSHAKE) != 0) { 1125 /* 1126 * Copy the mbuf chain to a chain of 1127 * ext_pgs mbuf(s) as required by KERN_TLS. 1128 */ 1129 maxextsiz = TLS_MAX_MSG_SIZE_V10_2; 1130 #ifdef KERN_TLS 1131 if (rpctls_getinfo(&maxlen, false, false)) 1132 maxextsiz = min(maxextsiz, maxlen); 1133 #endif 1134 mrep = _rpc_copym_into_ext_pgs(mrep, maxextsiz); 1135 } 1136 sx_xlock(&xprt->xp_lock); 1137 ct = (struct ct_data *)xprt->xp_p2; 1138 if (ct != NULL) 1139 error = sosend(ct->ct_socket, NULL, NULL, mrep, NULL, 1140 0, curthread); 1141 else 1142 error = EPIPE; 1143 sx_xunlock(&xprt->xp_lock); 1144 if (!error) { 1145 stat = TRUE; 1146 } 1147 } else { 1148 m_freem(mrep); 1149 } 1150 1151 XDR_DESTROY(&xdrs); 1152 1153 return (stat); 1154 } 1155 1156 static bool_t 1157 svc_vc_null(void) 1158 { 1159 1160 return (FALSE); 1161 } 1162 1163 static int 1164 svc_vc_soupcall(struct socket *so, void *arg, int waitflag) 1165 { 1166 SVCXPRT *xprt = (SVCXPRT *) arg; 1167 1168 if (soreadable(xprt->xp_socket)) 1169 xprt_active(xprt); 1170 return (SU_OK); 1171 } 1172 1173 static int 1174 svc_vc_rendezvous_soupcall(struct socket *head, void *arg, int waitflag) 1175 { 1176 SVCXPRT *xprt = (SVCXPRT *) arg; 1177 1178 if (!TAILQ_EMPTY(&head->sol_comp)) 1179 xprt_active(xprt); 1180 return (SU_OK); 1181 } 1182 1183 #if 0 1184 /* 1185 * Get the effective UID of the sending process. Used by rpcbind, keyserv 1186 * and rpc.yppasswdd on AF_LOCAL. 1187 */ 1188 int 1189 __rpc_get_local_uid(SVCXPRT *transp, uid_t *uid) { 1190 int sock, ret; 1191 gid_t egid; 1192 uid_t euid; 1193 struct sockaddr *sa; 1194 1195 sock = transp->xp_fd; 1196 sa = (struct sockaddr *)transp->xp_rtaddr; 1197 if (sa->sa_family == AF_LOCAL) { 1198 ret = getpeereid(sock, &euid, &egid); 1199 if (ret == 0) 1200 *uid = euid; 1201 return (ret); 1202 } else 1203 return (-1); 1204 } 1205 #endif 1206