1 /* $NetBSD: svc_vc.c,v 1.7 2000/08/03 00:01:53 fvdl Exp $ */ 2 3 /*- 4 * SPDX-License-Identifier: BSD-3-Clause 5 * 6 * Copyright (c) 2009, Sun Microsystems, Inc. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions are met: 11 * - Redistributions of source code must retain the above copyright notice, 12 * this list of conditions and the following disclaimer. 13 * - Redistributions in binary form must reproduce the above copyright notice, 14 * this list of conditions and the following disclaimer in the documentation 15 * and/or other materials provided with the distribution. 16 * - Neither the name of Sun Microsystems, Inc. nor the names of its 17 * contributors may be used to endorse or promote products derived 18 * from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 21 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 24 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #if defined(LIBC_SCCS) && !defined(lint) 34 static char *sccsid2 = "@(#)svc_tcp.c 1.21 87/08/11 Copyr 1984 Sun Micro"; 35 static char *sccsid = "@(#)svc_tcp.c 2.2 88/08/01 4.0 RPCSRC"; 36 #endif 37 #include <sys/cdefs.h> 38 __FBSDID("$FreeBSD$"); 39 40 /* 41 * svc_vc.c, Server side for Connection Oriented based RPC. 42 * 43 * Actually implements two flavors of transporter - 44 * a tcp rendezvouser (a listner and connection establisher) 45 * and a record/tcp stream. 46 */ 47 48 #include "opt_kern_tls.h" 49 50 #include <sys/param.h> 51 #include <sys/limits.h> 52 #include <sys/lock.h> 53 #include <sys/kernel.h> 54 #include <sys/ktls.h> 55 #include <sys/malloc.h> 56 #include <sys/mbuf.h> 57 #include <sys/mutex.h> 58 #include <sys/proc.h> 59 #include <sys/protosw.h> 60 #include <sys/queue.h> 61 #include <sys/socket.h> 62 #include <sys/socketvar.h> 63 #include <sys/sx.h> 64 #include <sys/systm.h> 65 #include <sys/uio.h> 66 67 #include <net/vnet.h> 68 69 #include <netinet/tcp.h> 70 71 #include <rpc/rpc.h> 72 #include <rpc/rpcsec_tls.h> 73 74 #include <rpc/krpc.h> 75 #include <rpc/rpc_com.h> 76 77 #include <security/mac/mac_framework.h> 78 79 static bool_t svc_vc_rendezvous_recv(SVCXPRT *, struct rpc_msg *, 80 struct sockaddr **, struct mbuf **); 81 static enum xprt_stat svc_vc_rendezvous_stat(SVCXPRT *); 82 static void svc_vc_rendezvous_destroy(SVCXPRT *); 83 static bool_t svc_vc_null(void); 84 static void svc_vc_destroy(SVCXPRT *); 85 static enum xprt_stat svc_vc_stat(SVCXPRT *); 86 static bool_t svc_vc_ack(SVCXPRT *, uint32_t *); 87 static bool_t svc_vc_recv(SVCXPRT *, struct rpc_msg *, 88 struct sockaddr **, struct mbuf **); 89 static bool_t svc_vc_reply(SVCXPRT *, struct rpc_msg *, 90 struct sockaddr *, struct mbuf *, uint32_t *seq); 91 static bool_t svc_vc_control(SVCXPRT *xprt, const u_int rq, void *in); 92 static bool_t svc_vc_rendezvous_control (SVCXPRT *xprt, const u_int rq, 93 void *in); 94 static void svc_vc_backchannel_destroy(SVCXPRT *); 95 static enum xprt_stat svc_vc_backchannel_stat(SVCXPRT *); 96 static bool_t svc_vc_backchannel_recv(SVCXPRT *, struct rpc_msg *, 97 struct sockaddr **, struct mbuf **); 98 static bool_t svc_vc_backchannel_reply(SVCXPRT *, struct rpc_msg *, 99 struct sockaddr *, struct mbuf *, uint32_t *); 100 static bool_t svc_vc_backchannel_control(SVCXPRT *xprt, const u_int rq, 101 void *in); 102 static SVCXPRT *svc_vc_create_conn(SVCPOOL *pool, struct socket *so, 103 struct sockaddr *raddr); 104 static int svc_vc_accept(struct socket *head, struct socket **sop); 105 static int svc_vc_soupcall(struct socket *so, void *arg, int waitflag); 106 static int svc_vc_rendezvous_soupcall(struct socket *, void *, int); 107 108 static const struct xp_ops svc_vc_rendezvous_ops = { 109 .xp_recv = svc_vc_rendezvous_recv, 110 .xp_stat = svc_vc_rendezvous_stat, 111 .xp_reply = (bool_t (*)(SVCXPRT *, struct rpc_msg *, 112 struct sockaddr *, struct mbuf *, uint32_t *))svc_vc_null, 113 .xp_destroy = svc_vc_rendezvous_destroy, 114 .xp_control = svc_vc_rendezvous_control 115 }; 116 117 static const struct xp_ops svc_vc_ops = { 118 .xp_recv = svc_vc_recv, 119 .xp_stat = svc_vc_stat, 120 .xp_ack = svc_vc_ack, 121 .xp_reply = svc_vc_reply, 122 .xp_destroy = svc_vc_destroy, 123 .xp_control = svc_vc_control 124 }; 125 126 static const struct xp_ops svc_vc_backchannel_ops = { 127 .xp_recv = svc_vc_backchannel_recv, 128 .xp_stat = svc_vc_backchannel_stat, 129 .xp_reply = svc_vc_backchannel_reply, 130 .xp_destroy = svc_vc_backchannel_destroy, 131 .xp_control = svc_vc_backchannel_control 132 }; 133 134 /* 135 * Usage: 136 * xprt = svc_vc_create(sock, send_buf_size, recv_buf_size); 137 * 138 * Creates, registers, and returns a (rpc) tcp based transporter. 139 * Once *xprt is initialized, it is registered as a transporter 140 * see (svc.h, xprt_register). This routine returns 141 * a NULL if a problem occurred. 142 * 143 * The filedescriptor passed in is expected to refer to a bound, but 144 * not yet connected socket. 145 * 146 * Since streams do buffered io similar to stdio, the caller can specify 147 * how big the send and receive buffers are via the second and third parms; 148 * 0 => use the system default. 149 */ 150 SVCXPRT * 151 svc_vc_create(SVCPOOL *pool, struct socket *so, size_t sendsize, 152 size_t recvsize) 153 { 154 SVCXPRT *xprt; 155 struct sockaddr* sa; 156 int error; 157 158 SOCK_LOCK(so); 159 if (so->so_state & (SS_ISCONNECTED|SS_ISDISCONNECTED)) { 160 SOCK_UNLOCK(so); 161 CURVNET_SET(so->so_vnet); 162 error = so->so_proto->pr_usrreqs->pru_peeraddr(so, &sa); 163 CURVNET_RESTORE(); 164 if (error) 165 return (NULL); 166 xprt = svc_vc_create_conn(pool, so, sa); 167 free(sa, M_SONAME); 168 return (xprt); 169 } 170 SOCK_UNLOCK(so); 171 172 xprt = svc_xprt_alloc(); 173 sx_init(&xprt->xp_lock, "xprt->xp_lock"); 174 xprt->xp_pool = pool; 175 xprt->xp_socket = so; 176 xprt->xp_p1 = NULL; 177 xprt->xp_p2 = NULL; 178 xprt->xp_ops = &svc_vc_rendezvous_ops; 179 180 CURVNET_SET(so->so_vnet); 181 error = so->so_proto->pr_usrreqs->pru_sockaddr(so, &sa); 182 CURVNET_RESTORE(); 183 if (error) { 184 goto cleanup_svc_vc_create; 185 } 186 187 memcpy(&xprt->xp_ltaddr, sa, sa->sa_len); 188 free(sa, M_SONAME); 189 190 xprt_register(xprt); 191 192 solisten(so, -1, curthread); 193 194 SOLISTEN_LOCK(so); 195 xprt->xp_upcallset = 1; 196 solisten_upcall_set(so, svc_vc_rendezvous_soupcall, xprt); 197 SOLISTEN_UNLOCK(so); 198 199 return (xprt); 200 201 cleanup_svc_vc_create: 202 sx_destroy(&xprt->xp_lock); 203 svc_xprt_free(xprt); 204 205 return (NULL); 206 } 207 208 /* 209 * Create a new transport for a socket optained via soaccept(). 210 */ 211 SVCXPRT * 212 svc_vc_create_conn(SVCPOOL *pool, struct socket *so, struct sockaddr *raddr) 213 { 214 SVCXPRT *xprt; 215 struct cf_conn *cd; 216 struct sockaddr* sa = NULL; 217 struct sockopt opt; 218 int one = 1; 219 int error; 220 221 bzero(&opt, sizeof(struct sockopt)); 222 opt.sopt_dir = SOPT_SET; 223 opt.sopt_level = SOL_SOCKET; 224 opt.sopt_name = SO_KEEPALIVE; 225 opt.sopt_val = &one; 226 opt.sopt_valsize = sizeof(one); 227 error = sosetopt(so, &opt); 228 if (error) { 229 return (NULL); 230 } 231 232 if (so->so_proto->pr_protocol == IPPROTO_TCP) { 233 bzero(&opt, sizeof(struct sockopt)); 234 opt.sopt_dir = SOPT_SET; 235 opt.sopt_level = IPPROTO_TCP; 236 opt.sopt_name = TCP_NODELAY; 237 opt.sopt_val = &one; 238 opt.sopt_valsize = sizeof(one); 239 error = sosetopt(so, &opt); 240 if (error) { 241 return (NULL); 242 } 243 } 244 245 cd = mem_alloc(sizeof(*cd)); 246 cd->strm_stat = XPRT_IDLE; 247 248 xprt = svc_xprt_alloc(); 249 sx_init(&xprt->xp_lock, "xprt->xp_lock"); 250 xprt->xp_pool = pool; 251 xprt->xp_socket = so; 252 xprt->xp_p1 = cd; 253 xprt->xp_p2 = NULL; 254 xprt->xp_ops = &svc_vc_ops; 255 256 /* 257 * See http://www.connectathon.org/talks96/nfstcp.pdf - client 258 * has a 5 minute timer, server has a 6 minute timer. 259 */ 260 xprt->xp_idletimeout = 6 * 60; 261 262 memcpy(&xprt->xp_rtaddr, raddr, raddr->sa_len); 263 264 CURVNET_SET(so->so_vnet); 265 error = so->so_proto->pr_usrreqs->pru_sockaddr(so, &sa); 266 CURVNET_RESTORE(); 267 if (error) 268 goto cleanup_svc_vc_create; 269 270 memcpy(&xprt->xp_ltaddr, sa, sa->sa_len); 271 free(sa, M_SONAME); 272 273 xprt_register(xprt); 274 275 SOCKBUF_LOCK(&so->so_rcv); 276 xprt->xp_upcallset = 1; 277 soupcall_set(so, SO_RCV, svc_vc_soupcall, xprt); 278 SOCKBUF_UNLOCK(&so->so_rcv); 279 280 /* 281 * Throw the transport into the active list in case it already 282 * has some data buffered. 283 */ 284 sx_xlock(&xprt->xp_lock); 285 xprt_active(xprt); 286 sx_xunlock(&xprt->xp_lock); 287 288 return (xprt); 289 cleanup_svc_vc_create: 290 sx_destroy(&xprt->xp_lock); 291 svc_xprt_free(xprt); 292 mem_free(cd, sizeof(*cd)); 293 294 return (NULL); 295 } 296 297 /* 298 * Create a new transport for a backchannel on a clnt_vc socket. 299 */ 300 SVCXPRT * 301 svc_vc_create_backchannel(SVCPOOL *pool) 302 { 303 SVCXPRT *xprt = NULL; 304 struct cf_conn *cd = NULL; 305 306 cd = mem_alloc(sizeof(*cd)); 307 cd->strm_stat = XPRT_IDLE; 308 309 xprt = svc_xprt_alloc(); 310 sx_init(&xprt->xp_lock, "xprt->xp_lock"); 311 xprt->xp_pool = pool; 312 xprt->xp_socket = NULL; 313 xprt->xp_p1 = cd; 314 xprt->xp_p2 = NULL; 315 xprt->xp_ops = &svc_vc_backchannel_ops; 316 return (xprt); 317 } 318 319 /* 320 * This does all of the accept except the final call to soaccept. The 321 * caller will call soaccept after dropping its locks (soaccept may 322 * call malloc). 323 */ 324 int 325 svc_vc_accept(struct socket *head, struct socket **sop) 326 { 327 struct socket *so; 328 int error = 0; 329 short nbio; 330 331 KASSERT(SOLISTENING(head), 332 ("%s: socket %p is not listening", __func__, head)); 333 334 #ifdef MAC 335 error = mac_socket_check_accept(curthread->td_ucred, head); 336 if (error != 0) 337 goto done; 338 #endif 339 /* 340 * XXXGL: we want non-blocking semantics. The socket could be a 341 * socket created by kernel as well as socket shared with userland, 342 * so we can't be sure about presense of SS_NBIO. We also shall not 343 * toggle it on the socket, since that may surprise userland. So we 344 * set SS_NBIO only temporarily. 345 */ 346 SOLISTEN_LOCK(head); 347 nbio = head->so_state & SS_NBIO; 348 head->so_state |= SS_NBIO; 349 error = solisten_dequeue(head, &so, 0); 350 head->so_state &= (nbio & ~SS_NBIO); 351 if (error) 352 goto done; 353 354 so->so_state |= nbio; 355 *sop = so; 356 357 /* connection has been removed from the listen queue */ 358 KNOTE_UNLOCKED(&head->so_rdsel.si_note, 0); 359 done: 360 return (error); 361 } 362 363 /*ARGSUSED*/ 364 static bool_t 365 svc_vc_rendezvous_recv(SVCXPRT *xprt, struct rpc_msg *msg, 366 struct sockaddr **addrp, struct mbuf **mp) 367 { 368 struct socket *so = NULL; 369 struct sockaddr *sa = NULL; 370 int error; 371 SVCXPRT *new_xprt; 372 373 /* 374 * The socket upcall calls xprt_active() which will eventually 375 * cause the server to call us here. We attempt to accept a 376 * connection from the socket and turn it into a new 377 * transport. If the accept fails, we have drained all pending 378 * connections so we call xprt_inactive(). 379 */ 380 sx_xlock(&xprt->xp_lock); 381 382 error = svc_vc_accept(xprt->xp_socket, &so); 383 384 if (error == EWOULDBLOCK) { 385 /* 386 * We must re-test for new connections after taking 387 * the lock to protect us in the case where a new 388 * connection arrives after our call to accept fails 389 * with EWOULDBLOCK. 390 */ 391 SOLISTEN_LOCK(xprt->xp_socket); 392 if (TAILQ_EMPTY(&xprt->xp_socket->sol_comp)) 393 xprt_inactive_self(xprt); 394 SOLISTEN_UNLOCK(xprt->xp_socket); 395 sx_xunlock(&xprt->xp_lock); 396 return (FALSE); 397 } 398 399 if (error) { 400 SOLISTEN_LOCK(xprt->xp_socket); 401 if (xprt->xp_upcallset) { 402 xprt->xp_upcallset = 0; 403 soupcall_clear(xprt->xp_socket, SO_RCV); 404 } 405 SOLISTEN_UNLOCK(xprt->xp_socket); 406 xprt_inactive_self(xprt); 407 sx_xunlock(&xprt->xp_lock); 408 return (FALSE); 409 } 410 411 sx_xunlock(&xprt->xp_lock); 412 413 sa = NULL; 414 error = soaccept(so, &sa); 415 416 if (error) { 417 /* 418 * XXX not sure if I need to call sofree or soclose here. 419 */ 420 if (sa) 421 free(sa, M_SONAME); 422 return (FALSE); 423 } 424 425 /* 426 * svc_vc_create_conn will call xprt_register - we don't need 427 * to do anything with the new connection except derefence it. 428 */ 429 new_xprt = svc_vc_create_conn(xprt->xp_pool, so, sa); 430 if (!new_xprt) { 431 soclose(so); 432 } else { 433 SVC_RELEASE(new_xprt); 434 } 435 436 free(sa, M_SONAME); 437 438 return (FALSE); /* there is never an rpc msg to be processed */ 439 } 440 441 /*ARGSUSED*/ 442 static enum xprt_stat 443 svc_vc_rendezvous_stat(SVCXPRT *xprt) 444 { 445 446 return (XPRT_IDLE); 447 } 448 449 static void 450 svc_vc_destroy_common(SVCXPRT *xprt) 451 { 452 enum clnt_stat stat; 453 uint32_t reterr; 454 455 if (xprt->xp_socket) { 456 if ((xprt->xp_tls & (RPCTLS_FLAGS_HANDSHAKE | 457 RPCTLS_FLAGS_HANDSHFAIL)) != 0) { 458 if ((xprt->xp_tls & RPCTLS_FLAGS_HANDSHAKE) != 0) { 459 /* 460 * If the upcall fails, the socket has 461 * probably been closed via the rpctlssd 462 * daemon having crashed or been 463 * restarted, so just ignore returned stat. 464 */ 465 stat = rpctls_srv_disconnect(xprt->xp_sslsec, 466 xprt->xp_sslusec, xprt->xp_sslrefno, 467 &reterr); 468 } 469 /* Must sorele() to get rid of reference. */ 470 CURVNET_SET(xprt->xp_socket->so_vnet); 471 sorele(xprt->xp_socket); 472 CURVNET_RESTORE(); 473 } else 474 (void)soclose(xprt->xp_socket); 475 } 476 477 if (xprt->xp_netid) 478 (void) mem_free(xprt->xp_netid, strlen(xprt->xp_netid) + 1); 479 svc_xprt_free(xprt); 480 } 481 482 static void 483 svc_vc_rendezvous_destroy(SVCXPRT *xprt) 484 { 485 486 SOLISTEN_LOCK(xprt->xp_socket); 487 if (xprt->xp_upcallset) { 488 xprt->xp_upcallset = 0; 489 solisten_upcall_set(xprt->xp_socket, NULL, NULL); 490 } 491 SOLISTEN_UNLOCK(xprt->xp_socket); 492 493 svc_vc_destroy_common(xprt); 494 } 495 496 static void 497 svc_vc_destroy(SVCXPRT *xprt) 498 { 499 struct cf_conn *cd = (struct cf_conn *)xprt->xp_p1; 500 CLIENT *cl = (CLIENT *)xprt->xp_p2; 501 502 SOCKBUF_LOCK(&xprt->xp_socket->so_rcv); 503 if (xprt->xp_upcallset) { 504 xprt->xp_upcallset = 0; 505 if (xprt->xp_socket->so_rcv.sb_upcall != NULL) 506 soupcall_clear(xprt->xp_socket, SO_RCV); 507 } 508 SOCKBUF_UNLOCK(&xprt->xp_socket->so_rcv); 509 510 if (cl != NULL) 511 CLNT_RELEASE(cl); 512 513 svc_vc_destroy_common(xprt); 514 515 if (cd->mreq) 516 m_freem(cd->mreq); 517 if (cd->mpending) 518 m_freem(cd->mpending); 519 mem_free(cd, sizeof(*cd)); 520 } 521 522 static void 523 svc_vc_backchannel_destroy(SVCXPRT *xprt) 524 { 525 struct cf_conn *cd = (struct cf_conn *)xprt->xp_p1; 526 struct mbuf *m, *m2; 527 528 svc_xprt_free(xprt); 529 m = cd->mreq; 530 while (m != NULL) { 531 m2 = m; 532 m = m->m_nextpkt; 533 m_freem(m2); 534 } 535 mem_free(cd, sizeof(*cd)); 536 } 537 538 /*ARGSUSED*/ 539 static bool_t 540 svc_vc_control(SVCXPRT *xprt, const u_int rq, void *in) 541 { 542 return (FALSE); 543 } 544 545 static bool_t 546 svc_vc_rendezvous_control(SVCXPRT *xprt, const u_int rq, void *in) 547 { 548 549 return (FALSE); 550 } 551 552 static bool_t 553 svc_vc_backchannel_control(SVCXPRT *xprt, const u_int rq, void *in) 554 { 555 556 return (FALSE); 557 } 558 559 static enum xprt_stat 560 svc_vc_stat(SVCXPRT *xprt) 561 { 562 struct cf_conn *cd; 563 564 cd = (struct cf_conn *)(xprt->xp_p1); 565 566 if (cd->strm_stat == XPRT_DIED) 567 return (XPRT_DIED); 568 569 if (cd->mreq != NULL && cd->resid == 0 && cd->eor) 570 return (XPRT_MOREREQS); 571 572 if (soreadable(xprt->xp_socket)) 573 return (XPRT_MOREREQS); 574 575 return (XPRT_IDLE); 576 } 577 578 static bool_t 579 svc_vc_ack(SVCXPRT *xprt, uint32_t *ack) 580 { 581 582 *ack = atomic_load_acq_32(&xprt->xp_snt_cnt); 583 *ack -= sbused(&xprt->xp_socket->so_snd); 584 return (TRUE); 585 } 586 587 static enum xprt_stat 588 svc_vc_backchannel_stat(SVCXPRT *xprt) 589 { 590 struct cf_conn *cd; 591 592 cd = (struct cf_conn *)(xprt->xp_p1); 593 594 if (cd->mreq != NULL) 595 return (XPRT_MOREREQS); 596 597 return (XPRT_IDLE); 598 } 599 600 /* 601 * If we have an mbuf chain in cd->mpending, try to parse a record from it, 602 * leaving the result in cd->mreq. If we don't have a complete record, leave 603 * the partial result in cd->mreq and try to read more from the socket. 604 */ 605 static int 606 svc_vc_process_pending(SVCXPRT *xprt) 607 { 608 struct cf_conn *cd = (struct cf_conn *) xprt->xp_p1; 609 struct socket *so = xprt->xp_socket; 610 struct mbuf *m; 611 612 /* 613 * If cd->resid is non-zero, we have part of the 614 * record already, otherwise we are expecting a record 615 * marker. 616 */ 617 if (!cd->resid && cd->mpending) { 618 /* 619 * See if there is enough data buffered to 620 * make up a record marker. Make sure we can 621 * handle the case where the record marker is 622 * split across more than one mbuf. 623 */ 624 size_t n = 0; 625 uint32_t header; 626 627 m = cd->mpending; 628 while (n < sizeof(uint32_t) && m) { 629 n += m->m_len; 630 m = m->m_next; 631 } 632 if (n < sizeof(uint32_t)) { 633 so->so_rcv.sb_lowat = sizeof(uint32_t) - n; 634 return (FALSE); 635 } 636 m_copydata(cd->mpending, 0, sizeof(header), 637 (char *)&header); 638 header = ntohl(header); 639 cd->eor = (header & 0x80000000) != 0; 640 cd->resid = header & 0x7fffffff; 641 m_adj(cd->mpending, sizeof(uint32_t)); 642 } 643 644 /* 645 * Start pulling off mbufs from cd->mpending 646 * until we either have a complete record or 647 * we run out of data. We use m_split to pull 648 * data - it will pull as much as possible and 649 * split the last mbuf if necessary. 650 */ 651 while (cd->mpending && cd->resid) { 652 m = cd->mpending; 653 if (cd->mpending->m_next 654 || cd->mpending->m_len > cd->resid) 655 cd->mpending = m_split(cd->mpending, 656 cd->resid, M_WAITOK); 657 else 658 cd->mpending = NULL; 659 if (cd->mreq) 660 m_last(cd->mreq)->m_next = m; 661 else 662 cd->mreq = m; 663 while (m) { 664 cd->resid -= m->m_len; 665 m = m->m_next; 666 } 667 } 668 669 /* 670 * Block receive upcalls if we have more data pending, 671 * otherwise report our need. 672 */ 673 if (cd->mpending) 674 so->so_rcv.sb_lowat = INT_MAX; 675 else 676 so->so_rcv.sb_lowat = 677 imax(1, imin(cd->resid, so->so_rcv.sb_hiwat / 2)); 678 return (TRUE); 679 } 680 681 static bool_t 682 svc_vc_recv(SVCXPRT *xprt, struct rpc_msg *msg, 683 struct sockaddr **addrp, struct mbuf **mp) 684 { 685 struct cf_conn *cd = (struct cf_conn *) xprt->xp_p1; 686 struct uio uio; 687 struct mbuf *m, *ctrl; 688 struct socket* so = xprt->xp_socket; 689 XDR xdrs; 690 int error, rcvflag; 691 uint32_t reterr, xid_plus_direction[2]; 692 struct cmsghdr *cmsg; 693 struct tls_get_record tgr; 694 enum clnt_stat ret; 695 696 /* 697 * Serialise access to the socket and our own record parsing 698 * state. 699 */ 700 sx_xlock(&xprt->xp_lock); 701 702 for (;;) { 703 /* If we have no request ready, check pending queue. */ 704 while (cd->mpending && 705 (cd->mreq == NULL || cd->resid != 0 || !cd->eor)) { 706 if (!svc_vc_process_pending(xprt)) 707 break; 708 } 709 710 /* Process and return complete request in cd->mreq. */ 711 if (cd->mreq != NULL && cd->resid == 0 && cd->eor) { 712 713 /* 714 * Now, check for a backchannel reply. 715 * The XID is in the first uint32_t of the reply 716 * and the message direction is the second one. 717 */ 718 if ((cd->mreq->m_len >= sizeof(xid_plus_direction) || 719 m_length(cd->mreq, NULL) >= 720 sizeof(xid_plus_direction)) && 721 xprt->xp_p2 != NULL) { 722 m_copydata(cd->mreq, 0, 723 sizeof(xid_plus_direction), 724 (char *)xid_plus_direction); 725 xid_plus_direction[0] = 726 ntohl(xid_plus_direction[0]); 727 xid_plus_direction[1] = 728 ntohl(xid_plus_direction[1]); 729 /* Check message direction. */ 730 if (xid_plus_direction[1] == REPLY) { 731 clnt_bck_svccall(xprt->xp_p2, 732 cd->mreq, 733 xid_plus_direction[0]); 734 cd->mreq = NULL; 735 continue; 736 } 737 } 738 739 xdrmbuf_create(&xdrs, cd->mreq, XDR_DECODE); 740 cd->mreq = NULL; 741 742 /* Check for next request in a pending queue. */ 743 svc_vc_process_pending(xprt); 744 if (cd->mreq == NULL || cd->resid != 0) { 745 SOCKBUF_LOCK(&so->so_rcv); 746 if (!soreadable(so)) 747 xprt_inactive_self(xprt); 748 SOCKBUF_UNLOCK(&so->so_rcv); 749 } 750 751 sx_xunlock(&xprt->xp_lock); 752 753 if (! xdr_callmsg(&xdrs, msg)) { 754 XDR_DESTROY(&xdrs); 755 return (FALSE); 756 } 757 758 *addrp = NULL; 759 *mp = xdrmbuf_getall(&xdrs); 760 XDR_DESTROY(&xdrs); 761 762 return (TRUE); 763 } 764 765 /* 766 * If receiving is disabled so that a TLS handshake can be 767 * done by the rpctlssd daemon, return FALSE here. 768 */ 769 rcvflag = MSG_DONTWAIT; 770 if ((xprt->xp_tls & RPCTLS_FLAGS_HANDSHAKE) != 0) 771 rcvflag |= MSG_TLSAPPDATA; 772 tryagain: 773 if (xprt->xp_dontrcv) { 774 sx_xunlock(&xprt->xp_lock); 775 return (FALSE); 776 } 777 778 /* 779 * The socket upcall calls xprt_active() which will eventually 780 * cause the server to call us here. We attempt to 781 * read as much as possible from the socket and put 782 * the result in cd->mpending. If the read fails, 783 * we have drained both cd->mpending and the socket so 784 * we can call xprt_inactive(). 785 */ 786 uio.uio_resid = 1000000000; 787 uio.uio_td = curthread; 788 ctrl = m = NULL; 789 error = soreceive(so, NULL, &uio, &m, &ctrl, &rcvflag); 790 791 if (error == EWOULDBLOCK) { 792 /* 793 * We must re-test for readability after 794 * taking the lock to protect us in the case 795 * where a new packet arrives on the socket 796 * after our call to soreceive fails with 797 * EWOULDBLOCK. 798 */ 799 SOCKBUF_LOCK(&so->so_rcv); 800 if (!soreadable(so)) 801 xprt_inactive_self(xprt); 802 SOCKBUF_UNLOCK(&so->so_rcv); 803 sx_xunlock(&xprt->xp_lock); 804 return (FALSE); 805 } 806 807 /* 808 * A return of ENXIO indicates that there is a 809 * non-application data record at the head of the 810 * socket's receive queue, for TLS connections. 811 * This record needs to be handled in userland 812 * via an SSL_read() call, so do an upcall to the daemon. 813 */ 814 if ((xprt->xp_tls & RPCTLS_FLAGS_HANDSHAKE) != 0 && 815 error == ENXIO) { 816 /* Disable reception. */ 817 xprt->xp_dontrcv = TRUE; 818 sx_xunlock(&xprt->xp_lock); 819 ret = rpctls_srv_handlerecord(xprt->xp_sslsec, 820 xprt->xp_sslusec, xprt->xp_sslrefno, 821 &reterr); 822 sx_xlock(&xprt->xp_lock); 823 xprt->xp_dontrcv = FALSE; 824 if (ret != RPC_SUCCESS || reterr != RPCTLSERR_OK) { 825 /* 826 * All we can do is soreceive() it and 827 * then toss it. 828 */ 829 rcvflag = MSG_DONTWAIT; 830 goto tryagain; 831 } 832 sx_xunlock(&xprt->xp_lock); 833 xprt_active(xprt); /* Harmless if already active. */ 834 return (FALSE); 835 } 836 837 if (error) { 838 SOCKBUF_LOCK(&so->so_rcv); 839 if (xprt->xp_upcallset) { 840 xprt->xp_upcallset = 0; 841 soupcall_clear(so, SO_RCV); 842 } 843 SOCKBUF_UNLOCK(&so->so_rcv); 844 xprt_inactive_self(xprt); 845 cd->strm_stat = XPRT_DIED; 846 sx_xunlock(&xprt->xp_lock); 847 return (FALSE); 848 } 849 850 if (!m) { 851 /* 852 * EOF - the other end has closed the socket. 853 */ 854 xprt_inactive_self(xprt); 855 cd->strm_stat = XPRT_DIED; 856 sx_xunlock(&xprt->xp_lock); 857 return (FALSE); 858 } 859 860 /* Process any record header(s). */ 861 if (ctrl != NULL) { 862 cmsg = mtod(ctrl, struct cmsghdr *); 863 if (cmsg->cmsg_type == TLS_GET_RECORD && 864 cmsg->cmsg_len == CMSG_LEN(sizeof(tgr))) { 865 memcpy(&tgr, CMSG_DATA(cmsg), sizeof(tgr)); 866 /* 867 * This should have been handled by 868 * the rpctls_svc_handlerecord() 869 * upcall. If not, all we can do is 870 * toss it away. 871 */ 872 if (tgr.tls_type != TLS_RLTYPE_APP) { 873 m_freem(m); 874 m_free(ctrl); 875 rcvflag = MSG_DONTWAIT | MSG_TLSAPPDATA; 876 goto tryagain; 877 } 878 } 879 m_free(ctrl); 880 } 881 882 if (cd->mpending) 883 m_last(cd->mpending)->m_next = m; 884 else 885 cd->mpending = m; 886 } 887 } 888 889 static bool_t 890 svc_vc_backchannel_recv(SVCXPRT *xprt, struct rpc_msg *msg, 891 struct sockaddr **addrp, struct mbuf **mp) 892 { 893 struct cf_conn *cd = (struct cf_conn *) xprt->xp_p1; 894 struct ct_data *ct; 895 struct mbuf *m; 896 XDR xdrs; 897 898 sx_xlock(&xprt->xp_lock); 899 ct = (struct ct_data *)xprt->xp_p2; 900 if (ct == NULL) { 901 sx_xunlock(&xprt->xp_lock); 902 return (FALSE); 903 } 904 mtx_lock(&ct->ct_lock); 905 m = cd->mreq; 906 if (m == NULL) { 907 xprt_inactive_self(xprt); 908 mtx_unlock(&ct->ct_lock); 909 sx_xunlock(&xprt->xp_lock); 910 return (FALSE); 911 } 912 cd->mreq = m->m_nextpkt; 913 mtx_unlock(&ct->ct_lock); 914 sx_xunlock(&xprt->xp_lock); 915 916 xdrmbuf_create(&xdrs, m, XDR_DECODE); 917 if (! xdr_callmsg(&xdrs, msg)) { 918 XDR_DESTROY(&xdrs); 919 return (FALSE); 920 } 921 *addrp = NULL; 922 *mp = xdrmbuf_getall(&xdrs); 923 XDR_DESTROY(&xdrs); 924 return (TRUE); 925 } 926 927 static bool_t 928 svc_vc_reply(SVCXPRT *xprt, struct rpc_msg *msg, 929 struct sockaddr *addr, struct mbuf *m, uint32_t *seq) 930 { 931 XDR xdrs; 932 struct mbuf *mrep; 933 bool_t stat = TRUE; 934 int error, len, maxextsiz; 935 #ifdef KERN_TLS 936 u_int maxlen; 937 #endif 938 939 /* 940 * Leave space for record mark. 941 */ 942 mrep = m_gethdr(M_WAITOK, MT_DATA); 943 mrep->m_data += sizeof(uint32_t); 944 945 xdrmbuf_create(&xdrs, mrep, XDR_ENCODE); 946 947 if (msg->rm_reply.rp_stat == MSG_ACCEPTED && 948 msg->rm_reply.rp_acpt.ar_stat == SUCCESS) { 949 if (!xdr_replymsg(&xdrs, msg)) 950 stat = FALSE; 951 else 952 xdrmbuf_append(&xdrs, m); 953 } else { 954 stat = xdr_replymsg(&xdrs, msg); 955 } 956 957 if (stat) { 958 m_fixhdr(mrep); 959 960 /* 961 * Prepend a record marker containing the reply length. 962 */ 963 M_PREPEND(mrep, sizeof(uint32_t), M_WAITOK); 964 len = mrep->m_pkthdr.len; 965 *mtod(mrep, uint32_t *) = 966 htonl(0x80000000 | (len - sizeof(uint32_t))); 967 968 /* For RPC-over-TLS, copy mrep to a chain of ext_pgs. */ 969 if ((xprt->xp_tls & RPCTLS_FLAGS_HANDSHAKE) != 0) { 970 /* 971 * Copy the mbuf chain to a chain of 972 * ext_pgs mbuf(s) as required by KERN_TLS. 973 */ 974 maxextsiz = TLS_MAX_MSG_SIZE_V10_2; 975 #ifdef KERN_TLS 976 if (rpctls_getinfo(&maxlen, false, false)) 977 maxextsiz = min(maxextsiz, maxlen); 978 #endif 979 mrep = _rpc_copym_into_ext_pgs(mrep, maxextsiz); 980 } 981 atomic_add_32(&xprt->xp_snd_cnt, len); 982 /* 983 * sosend consumes mreq. 984 */ 985 error = sosend(xprt->xp_socket, NULL, NULL, mrep, NULL, 986 0, curthread); 987 if (!error) { 988 atomic_add_rel_32(&xprt->xp_snt_cnt, len); 989 if (seq) 990 *seq = xprt->xp_snd_cnt; 991 stat = TRUE; 992 } else 993 atomic_subtract_32(&xprt->xp_snd_cnt, len); 994 } else { 995 m_freem(mrep); 996 } 997 998 XDR_DESTROY(&xdrs); 999 1000 return (stat); 1001 } 1002 1003 static bool_t 1004 svc_vc_backchannel_reply(SVCXPRT *xprt, struct rpc_msg *msg, 1005 struct sockaddr *addr, struct mbuf *m, uint32_t *seq) 1006 { 1007 struct ct_data *ct; 1008 XDR xdrs; 1009 struct mbuf *mrep; 1010 bool_t stat = TRUE; 1011 int error, maxextsiz; 1012 #ifdef KERN_TLS 1013 u_int maxlen; 1014 #endif 1015 1016 /* 1017 * Leave space for record mark. 1018 */ 1019 mrep = m_gethdr(M_WAITOK, MT_DATA); 1020 mrep->m_data += sizeof(uint32_t); 1021 1022 xdrmbuf_create(&xdrs, mrep, XDR_ENCODE); 1023 1024 if (msg->rm_reply.rp_stat == MSG_ACCEPTED && 1025 msg->rm_reply.rp_acpt.ar_stat == SUCCESS) { 1026 if (!xdr_replymsg(&xdrs, msg)) 1027 stat = FALSE; 1028 else 1029 xdrmbuf_append(&xdrs, m); 1030 } else { 1031 stat = xdr_replymsg(&xdrs, msg); 1032 } 1033 1034 if (stat) { 1035 m_fixhdr(mrep); 1036 1037 /* 1038 * Prepend a record marker containing the reply length. 1039 */ 1040 M_PREPEND(mrep, sizeof(uint32_t), M_WAITOK); 1041 *mtod(mrep, uint32_t *) = 1042 htonl(0x80000000 | (mrep->m_pkthdr.len 1043 - sizeof(uint32_t))); 1044 1045 /* For RPC-over-TLS, copy mrep to a chain of ext_pgs. */ 1046 if ((xprt->xp_tls & RPCTLS_FLAGS_HANDSHAKE) != 0) { 1047 /* 1048 * Copy the mbuf chain to a chain of 1049 * ext_pgs mbuf(s) as required by KERN_TLS. 1050 */ 1051 maxextsiz = TLS_MAX_MSG_SIZE_V10_2; 1052 #ifdef KERN_TLS 1053 if (rpctls_getinfo(&maxlen, false, false)) 1054 maxextsiz = min(maxextsiz, maxlen); 1055 #endif 1056 mrep = _rpc_copym_into_ext_pgs(mrep, maxextsiz); 1057 } 1058 sx_xlock(&xprt->xp_lock); 1059 ct = (struct ct_data *)xprt->xp_p2; 1060 if (ct != NULL) 1061 error = sosend(ct->ct_socket, NULL, NULL, mrep, NULL, 1062 0, curthread); 1063 else 1064 error = EPIPE; 1065 sx_xunlock(&xprt->xp_lock); 1066 if (!error) { 1067 stat = TRUE; 1068 } 1069 } else { 1070 m_freem(mrep); 1071 } 1072 1073 XDR_DESTROY(&xdrs); 1074 1075 return (stat); 1076 } 1077 1078 static bool_t 1079 svc_vc_null() 1080 { 1081 1082 return (FALSE); 1083 } 1084 1085 static int 1086 svc_vc_soupcall(struct socket *so, void *arg, int waitflag) 1087 { 1088 SVCXPRT *xprt = (SVCXPRT *) arg; 1089 1090 if (soreadable(xprt->xp_socket)) 1091 xprt_active(xprt); 1092 return (SU_OK); 1093 } 1094 1095 static int 1096 svc_vc_rendezvous_soupcall(struct socket *head, void *arg, int waitflag) 1097 { 1098 SVCXPRT *xprt = (SVCXPRT *) arg; 1099 1100 if (!TAILQ_EMPTY(&head->sol_comp)) 1101 xprt_active(xprt); 1102 return (SU_OK); 1103 } 1104 1105 #if 0 1106 /* 1107 * Get the effective UID of the sending process. Used by rpcbind, keyserv 1108 * and rpc.yppasswdd on AF_LOCAL. 1109 */ 1110 int 1111 __rpc_get_local_uid(SVCXPRT *transp, uid_t *uid) { 1112 int sock, ret; 1113 gid_t egid; 1114 uid_t euid; 1115 struct sockaddr *sa; 1116 1117 sock = transp->xp_fd; 1118 sa = (struct sockaddr *)transp->xp_rtaddr; 1119 if (sa->sa_family == AF_LOCAL) { 1120 ret = getpeereid(sock, &euid, &egid); 1121 if (ret == 0) 1122 *uid = euid; 1123 return (ret); 1124 } else 1125 return (-1); 1126 } 1127 #endif 1128