1 /* $NetBSD: fstat.c,v 1.113 2019/09/06 17:08:22 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 1988, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 #ifndef lint 34 __COPYRIGHT("@(#) Copyright (c) 1988, 1993\ 35 The Regents of the University of California. All rights reserved."); 36 #endif /* not lint */ 37 38 #ifndef lint 39 #if 0 40 static char sccsid[] = "@(#)fstat.c 8.3 (Berkeley) 5/2/95"; 41 #else 42 __RCSID("$NetBSD: fstat.c,v 1.113 2019/09/06 17:08:22 christos Exp $"); 43 #endif 44 #endif /* not lint */ 45 46 #include <sys/types.h> 47 #include <sys/param.h> 48 #include <sys/time.h> 49 #include <sys/proc.h> 50 #include <sys/stat.h> 51 #include <sys/vnode.h> 52 #include <sys/socket.h> 53 #include <sys/socketvar.h> 54 #include <sys/domain.h> 55 #include <sys/protosw.h> 56 #include <sys/unpcb.h> 57 #include <sys/sysctl.h> 58 #include <sys/filedesc.h> 59 #include <sys/pipe.h> 60 #define _KERNEL 61 #include <sys/mount.h> 62 #undef _KERNEL 63 #define _KERNEL 64 #include <sys/file.h> 65 #include <ufs/ufs/inode.h> 66 #include <ufs/ufs/ufsmount.h> 67 #undef _KERNEL 68 #define NFS 69 #include <nfs/nfsproto.h> 70 #include <nfs/rpcv2.h> 71 #include <nfs/nfs.h> 72 #include <nfs/nfsnode.h> 73 #undef NFS 74 #include <msdosfs/denode.h> 75 #include <msdosfs/bpb.h> 76 #define _KERNEL 77 #include <msdosfs/msdosfsmount.h> 78 #undef _KERNEL 79 #define _KERNEL 80 #include <miscfs/genfs/layer.h> 81 #undef _KERNEL 82 83 #include <net/route.h> 84 #include <netinet/in.h> 85 #include <netinet/in_systm.h> 86 #include <netinet/ip.h> 87 #include <netinet/in_pcb.h> 88 89 #ifdef INET6 90 #include <netinet/ip6.h> 91 #include <netinet6/in6.h> 92 #include <netinet6/ip6_var.h> 93 #include <netinet6/in6_pcb.h> 94 #endif 95 96 #include <netatalk/at.h> 97 #include <netatalk/ddp_var.h> 98 99 #include <netdb.h> 100 #include <arpa/inet.h> 101 102 #include <ctype.h> 103 #include <errno.h> 104 #include <kvm.h> 105 #include <limits.h> 106 #include <nlist.h> 107 #include <paths.h> 108 #include <pwd.h> 109 #include <stdio.h> 110 #include <stdlib.h> 111 #include <string.h> 112 #include <unistd.h> 113 #include <err.h> 114 #include <util.h> 115 116 #include "fstat.h" 117 118 #define TEXT -1 119 #define CDIR -2 120 #define RDIR -3 121 #define TRACE -4 122 123 typedef struct devs { 124 struct devs *next; 125 long fsid; 126 ino_t ino; 127 const char *name; 128 } DEVS; 129 static DEVS *devs; 130 131 static int fsflg, /* show files on same filesystem as file(s) argument */ 132 pflg, /* show files open by a particular pid */ 133 uflg; /* show files open by a particular (effective) user */ 134 static int checkfile; /* true if restricting to particular files or filesystems */ 135 static int nflg; /* (numerical) display f.s. and rdev as dev_t */ 136 static int Aflg; /* prefix with address of file structure */ 137 static int Oflg; /* print offset instead of size */ 138 int vflg; /* display errors in locating kernel data objects etc... */ 139 140 static fdfile_t **ofiles; /* buffer of pointers to file structures */ 141 static int fstat_maxfiles; 142 #define ALLOC_OFILES(d) \ 143 if ((d) > fstat_maxfiles) { \ 144 size_t len = (d) * sizeof(fdfile_t *); \ 145 free(ofiles); \ 146 ofiles = malloc(len); \ 147 if (ofiles == NULL) { \ 148 err(1, "malloc(%zu)", len); \ 149 } \ 150 fstat_maxfiles = (d); \ 151 } 152 153 kvm_t *kd; 154 155 static const char *const dtypes[] = { 156 DTYPE_NAMES 157 }; 158 159 static void dofiles(struct kinfo_proc2 *); 160 static int ext2fs_filestat(struct vnode *, struct filestat *); 161 static int getfname(const char *); 162 static void getinetproto(char *, size_t, int); 163 static void getatproto(char *, size_t, int); 164 static char *getmnton(struct mount *); 165 static const char *layer_filestat(struct vnode *, struct filestat *); 166 static int msdosfs_filestat(struct vnode *, struct filestat *); 167 static int nfs_filestat(struct vnode *, struct filestat *); 168 static const char *inet_addrstr(char *, size_t, const struct in_addr *, 169 uint16_t, bool); 170 #ifdef INET6 171 static const char *inet6_addrstr(char *, size_t, const struct in6_addr *, 172 uint16_t, bool); 173 #endif 174 static const char *at_addrstr(char *, size_t, const struct sockaddr_at *); 175 static void socktrans(struct file *, struct socket *, int); 176 static void misctrans(struct file *, int); 177 static int ufs_filestat(struct vnode *, struct filestat *); 178 static void usage(void) __dead; 179 static const char *vfilestat(struct vnode *, struct filestat *); 180 static void vtrans(struct file *, struct vnode *, int, int, long); 181 static void ftrans(fdfile_t *, int); 182 static void ptrans(struct file *, struct pipe *, int); 183 static void kdriver_init(void); 184 185 int 186 main(int argc, char **argv) 187 { 188 struct passwd *passwd; 189 struct kinfo_proc2 *p, *plast; 190 int arg, ch, what; 191 char *memf, *nlistf; 192 char buf[_POSIX2_LINE_MAX]; 193 int cnt; 194 gid_t egid = getegid(); 195 196 (void)setegid(getgid()); 197 arg = 0; 198 what = KERN_PROC_ALL; 199 nlistf = memf = NULL; 200 while ((ch = getopt(argc, argv, "fnAOp:u:vN:M:")) != -1) 201 switch((char)ch) { 202 case 'f': 203 fsflg = 1; 204 break; 205 case 'M': 206 memf = optarg; 207 break; 208 case 'N': 209 nlistf = optarg; 210 break; 211 case 'n': 212 nflg = 1; 213 break; 214 case 'A': 215 Aflg = 1; 216 break; 217 case 'O': 218 Oflg = 1; 219 break; 220 case 'p': 221 if (pflg++) 222 usage(); 223 if (!isdigit((unsigned char)*optarg)) { 224 warnx("-p requires a process id"); 225 usage(); 226 } 227 what = KERN_PROC_PID; 228 arg = atoi(optarg); 229 break; 230 case 'u': 231 if (uflg++) 232 usage(); 233 if (!(passwd = getpwnam(optarg))) { 234 errx(1, "%s: unknown uid", optarg); 235 } 236 what = KERN_PROC_UID; 237 arg = passwd->pw_uid; 238 break; 239 case 'v': 240 vflg = 1; 241 break; 242 case '?': 243 default: 244 usage(); 245 } 246 247 kdriver_init(); 248 249 if (*(argv += optind)) { 250 for (; *argv; ++argv) { 251 if (getfname(*argv)) 252 checkfile = 1; 253 } 254 if (!checkfile) /* file(s) specified, but none accessible */ 255 exit(1); 256 } 257 258 ALLOC_OFILES(256); /* reserve space for file pointers */ 259 260 if (fsflg && !checkfile) { 261 /* -f with no files means use wd */ 262 if (getfname(".") == 0) 263 exit(1); 264 checkfile = 1; 265 } 266 267 /* 268 * Discard setgid privileges. If not the running kernel, we toss 269 * them away totally so that bad guys can't print interesting stuff 270 * from kernel memory, otherwise switch back to kmem for the 271 * duration of the kvm_openfiles() call. 272 */ 273 if (nlistf != NULL || memf != NULL) 274 (void)setgid(getgid()); 275 else 276 (void)setegid(egid); 277 278 if ((kd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY, buf)) == NULL) 279 errx(1, "%s", buf); 280 281 /* get rid of it now anyway */ 282 if (nlistf == NULL && memf == NULL) 283 (void)setgid(getgid()); 284 285 if ((p = kvm_getproc2(kd, what, arg, sizeof *p, &cnt)) == NULL) { 286 errx(1, "%s", kvm_geterr(kd)); 287 } 288 if (Aflg) 289 (void)printf("%-*s ", 2*(int)(sizeof(void*)), "ADDR"); 290 if (nflg) 291 (void)printf( 292 "USER CMD PID FD DEV INUM MODE %s R/W", 293 Oflg ? " OFFS" : "SZ|DV" ); 294 else 295 (void)printf( 296 "USER CMD PID FD MOUNT INUM MODE %s R/W", 297 Oflg ? " OFFS" : "SZ|DV" ); 298 299 if (checkfile && fsflg == 0) 300 (void)printf(" NAME\n"); 301 else 302 (void)putchar('\n'); 303 304 for (plast = &p[cnt]; p < plast; ++p) { 305 if (p->p_stat == SZOMB) 306 continue; 307 dofiles(p); 308 } 309 return 0; 310 } 311 312 static const char *Uname, *Comm; 313 pid_t Pid; 314 315 #define PREFIX(i) (void)printf("%-8.8s %-10s %5d", Uname, Comm, Pid); \ 316 switch(i) { \ 317 case TEXT: \ 318 (void)printf(" text"); \ 319 break; \ 320 case CDIR: \ 321 (void)printf(" wd"); \ 322 break; \ 323 case RDIR: \ 324 (void)printf(" root"); \ 325 break; \ 326 case TRACE: \ 327 (void)printf(" tr"); \ 328 break; \ 329 default: \ 330 (void)printf(" %4d", i); \ 331 break; \ 332 } 333 334 static struct kinfo_drivers *kdriver; 335 static size_t kdriverlen; 336 337 static int 338 kdriver_comp(const void *a, const void *b) 339 { 340 const struct kinfo_drivers *ka = a; 341 const struct kinfo_drivers *kb = b; 342 int kac = ka->d_cmajor == -1 ? 0 : ka->d_cmajor; 343 int kbc = kb->d_cmajor == -1 ? 0 : kb->d_cmajor; 344 int kab = ka->d_bmajor == -1 ? 0 : ka->d_bmajor; 345 int kbb = kb->d_bmajor == -1 ? 0 : kb->d_bmajor; 346 int c = kac - kbc; 347 if (c == 0) 348 return kab - kbb; 349 else 350 return c; 351 } 352 353 static const char * 354 kdriver_search(int type, dev_t num) 355 { 356 struct kinfo_drivers k, *kp; 357 static char buf[64]; 358 359 if (nflg) 360 goto out; 361 362 if (type == VBLK) { 363 k.d_bmajor = num; 364 k.d_cmajor = -1; 365 } else { 366 k.d_bmajor = -1; 367 k.d_cmajor = num; 368 } 369 kp = bsearch(&k, kdriver, kdriverlen, sizeof(*kdriver), kdriver_comp); 370 if (kp) 371 return kp->d_name; 372 out: 373 snprintf(buf, sizeof(buf), "%llu", (unsigned long long)num); 374 return buf; 375 } 376 377 378 static void 379 kdriver_init(void) 380 { 381 size_t sz; 382 int error; 383 static const int name[2] = { CTL_KERN, KERN_DRIVERS }; 384 385 error = sysctl(name, __arraycount(name), NULL, &sz, NULL, 0); 386 if (error == -1) { 387 warn("sysctl kern.drivers"); 388 return; 389 } 390 391 if (sz % sizeof(*kdriver)) { 392 warnx("bad size %zu for kern.drivers", sz); 393 return; 394 } 395 396 kdriver = malloc(sz); 397 if (kdriver == NULL) { 398 warn("malloc"); 399 return; 400 } 401 402 error = sysctl(name, __arraycount(name), kdriver, &sz, NULL, 0); 403 if (error == -1) { 404 warn("sysctl kern.drivers"); 405 return; 406 } 407 408 kdriverlen = sz / sizeof(*kdriver); 409 qsort(kdriver, kdriverlen, sizeof(*kdriver), kdriver_comp); 410 #ifdef DEBUG 411 for (size_t i = 0; i < kdriverlen; i++) 412 printf("%d %d %s\n", kdriver[i].d_cmajor, kdriver[i].d_bmajor, 413 kdriver[i].d_name); 414 #endif 415 } 416 417 /* 418 * print open files attributed to this process 419 */ 420 static void 421 dofiles(struct kinfo_proc2 *p) 422 { 423 int i; 424 struct filedesc filed; 425 struct cwdinfo cwdi; 426 struct fdtab dt; 427 428 Uname = user_from_uid(p->p_uid, 0); 429 Pid = p->p_pid; 430 Comm = p->p_comm; 431 432 if (p->p_fd == 0 || p->p_cwdi == 0) 433 return; 434 if (!KVM_READ(p->p_fd, &filed, sizeof (filed))) { 435 warnx("can't read filedesc at %p for pid %d", 436 (void *)(uintptr_t)p->p_fd, Pid); 437 return; 438 } 439 if (filed.fd_lastfile == -1) 440 return; 441 if (!KVM_READ(p->p_cwdi, &cwdi, sizeof(cwdi))) { 442 warnx("can't read cwdinfo at %p for pid %d", 443 (void *)(uintptr_t)p->p_cwdi, Pid); 444 return; 445 } 446 if (!KVM_READ(filed.fd_dt, &dt, sizeof(dt))) { 447 warnx("can't read dtab at %p for pid %d", filed.fd_dt, Pid); 448 return; 449 } 450 if ((unsigned)filed.fd_lastfile >= dt.dt_nfiles || 451 filed.fd_freefile > filed.fd_lastfile + 1) { 452 dprintf("filedesc corrupted at %p for pid %d", 453 (void *)(uintptr_t)p->p_fd, Pid); 454 return; 455 } 456 /* 457 * root directory vnode, if one 458 */ 459 if (cwdi.cwdi_rdir) 460 vtrans(NULL, cwdi.cwdi_rdir, RDIR, FREAD, (long)cwdi.cwdi_rdir); 461 /* 462 * current working directory vnode 463 */ 464 vtrans(NULL, cwdi.cwdi_cdir, CDIR, FREAD, (long)cwdi.cwdi_cdir); 465 #if 0 466 /* 467 * Disable for now, since p->p_tracep appears to point to a ktr_desc * 468 * ktrace vnode, if one 469 */ 470 if (p->p_tracep) 471 ftrans(p->p_tracep, TRACE); 472 #endif 473 /* 474 * open files 475 */ 476 #define FPSIZE (sizeof (fdfile_t *)) 477 ALLOC_OFILES(filed.fd_lastfile+1); 478 if (!KVM_READ(&filed.fd_dt->dt_ff, ofiles, 479 (filed.fd_lastfile+1) * FPSIZE)) { 480 dprintf("can't read file structures at %p for pid %d", 481 &filed.fd_dt->dt_ff, Pid); 482 return; 483 } 484 for (i = 0; i <= filed.fd_lastfile; i++) { 485 if (ofiles[i] == NULL) 486 continue; 487 ftrans(ofiles[i], i); 488 } 489 } 490 491 static void 492 ftrans(fdfile_t *fp, int i) 493 { 494 struct file file; 495 fdfile_t fdfile; 496 497 if (!KVM_READ(fp, &fdfile, sizeof(fdfile))) { 498 dprintf("can't read file %d at %p for pid %d", 499 i, fp, Pid); 500 return; 501 } 502 if (fdfile.ff_file == NULL) { 503 dprintf("null ff_file for %d at %p for pid %d", 504 i, fp, Pid); 505 return; 506 } 507 if (!KVM_READ(fdfile.ff_file, &file, sizeof(file))) { 508 dprintf("can't read file %d at %p for pid %d", 509 i, fdfile.ff_file, Pid); 510 return; 511 } 512 if (Aflg && file.f_type != DTYPE_VNODE && checkfile == 0) 513 (void)printf("%*lx ", 514 2*(int)(sizeof(void*)), (long)fdfile.ff_file); 515 switch (file.f_type) { 516 case DTYPE_VNODE: 517 vtrans(&file, file.f_data, i, file.f_flag, (long)fdfile.ff_file); 518 break; 519 case DTYPE_SOCKET: 520 socktrans(&file, file.f_data, i); 521 break; 522 case DTYPE_PIPE: 523 if (checkfile == 0) 524 ptrans(&file, file.f_data, i); 525 break; 526 case DTYPE_MISC: 527 case DTYPE_KQUEUE: 528 case DTYPE_CRYPTO: 529 case DTYPE_MQUEUE: 530 case DTYPE_SEM: 531 if (checkfile == 0) 532 misctrans(&file, i); 533 break; 534 default: 535 dprintf("unknown file type %d for file %d of pid %d", 536 file.f_type, i, Pid); 537 break; 538 } 539 } 540 541 static const char dead[] = "dead"; 542 static const char *vnode_tag[] = { 543 VNODE_TAGS 544 }; 545 546 static const char * 547 vfilestat(struct vnode *vp, struct filestat *fsp) 548 { 549 const char *badtype = NULL; 550 551 if (vp->v_type == VNON) 552 badtype = "none"; 553 else if (vp->v_type == VBAD) 554 badtype = "bad"; 555 else 556 switch (vp->v_tag) { 557 case VT_NON: 558 badtype = dead; 559 break; 560 case VT_UFS: 561 case VT_LFS: 562 case VT_MFS: 563 if (!ufs_filestat(vp, fsp)) 564 badtype = "error"; 565 break; 566 case VT_MSDOSFS: 567 if (!msdosfs_filestat(vp, fsp)) 568 badtype = "error"; 569 break; 570 case VT_NFS: 571 if (!nfs_filestat(vp, fsp)) 572 badtype = "error"; 573 break; 574 case VT_EXT2FS: 575 if (!ext2fs_filestat(vp, fsp)) 576 badtype = "error"; 577 break; 578 case VT_ISOFS: 579 if (!isofs_filestat(vp, fsp)) 580 badtype = "error"; 581 break; 582 case VT_NTFS: 583 if (!ntfs_filestat(vp, fsp)) 584 badtype = "error"; 585 break; 586 case VT_PTYFS: 587 if (!ptyfs_filestat(vp, fsp)) 588 badtype = "error"; 589 break; 590 case VT_TMPFS: 591 if (!tmpfs_filestat(vp, fsp)) 592 badtype = "error"; 593 break; 594 case VT_NULL: 595 case VT_OVERLAY: 596 case VT_UMAP: 597 badtype = layer_filestat(vp, fsp); 598 break; 599 default: { 600 static char unknown[10]; 601 (void)snprintf(unknown, sizeof unknown, "%s(%#x)", 602 (size_t)vp->v_tag < __arraycount(vnode_tag) ? 603 vnode_tag[vp->v_tag] : "?", vp->v_tag); 604 badtype = unknown; 605 break; 606 } 607 } 608 return badtype; 609 } 610 611 static int 612 checkfs(struct vnode *vp, struct vnode *vn, struct filestat *fst, 613 const char **type, const char **fname) 614 { 615 *fname = NULL; 616 if (!KVM_READ(vp, vn, sizeof(*vn))) { 617 dprintf("can't read vnode at %p for pid %d", vp, Pid); 618 return 0; 619 } 620 *type = vfilestat(vn, fst); 621 if (checkfile) { 622 int fsmatch = 0; 623 DEVS *d; 624 #if 0 625 if (*type && *type != dead) 626 return 0; 627 #endif 628 for (d = devs; d != NULL; d = d->next) { 629 if (d->fsid == fst->fsid) { 630 fsmatch = 1; 631 if (d->ino == fst->fileid) { 632 *fname = d->name; 633 break; 634 } 635 } 636 } 637 if (fsmatch == 0 || (*fname == NULL && fsflg == 0)) 638 return 0; 639 } 640 return 1; 641 } 642 643 static void 644 vprint(struct vnode *vn, struct filestat *fst) 645 { 646 switch (vn->v_type) { 647 case VBLK: 648 case VCHR: { 649 const char *name; 650 651 if (nflg || ((name = devname(fst->rdev, vn->v_type == VCHR ? 652 S_IFCHR : S_IFBLK)) == NULL)) 653 (void)printf(" %s,%-2llu", 654 kdriver_search(vn->v_type, major(fst->rdev)), 655 (unsigned long long)minor(fst->rdev)); 656 else 657 (void)printf(" %6s", name); 658 break; 659 } 660 default: 661 (void)printf(" %6lld", (long long)fst->size); 662 } 663 } 664 665 void 666 oprint(struct file *fp, const char *str) 667 { 668 if (Oflg) 669 (void)printf(" %6lld", (long long)(fp ? fp->f_offset : 0)); 670 fputs(str, stdout); 671 } 672 673 static void 674 vtrans(struct file *fp, struct vnode *vp, int i, int flag, long addr) 675 { 676 struct vnode vn; 677 char mode[15], rw[3]; 678 const char *badtype, *filename; 679 struct filestat fst; 680 681 if (!checkfs(vp, &vn, &fst, &badtype, &filename)) 682 return; 683 684 if (Aflg) 685 (void)printf("%*lx ", 2*(int)(sizeof(void*)), addr); 686 PREFIX(i); 687 if (badtype == dead) { 688 char buf[1024]; 689 (void)snprintb(buf, sizeof(buf), VNODE_FLAGBITS, 690 vn.v_iflag | vn.v_vflag | vn.v_uflag); 691 (void)printf(" flags %s\n", buf); 692 return; 693 } else if (badtype) { 694 (void)printf(" - - %10s -\n", badtype); 695 return; 696 } 697 if (nflg) 698 (void)printf(" %3llu,%-2llu", 699 (unsigned long long)major(fst.fsid), 700 (unsigned long long)minor(fst.fsid)); 701 else 702 (void)printf(" %-8s", getmnton(vn.v_mount)); 703 if (nflg) 704 (void)snprintf(mode, sizeof mode, "%6o", fst.mode); 705 else 706 strmode(fst.mode, mode); 707 (void)printf(" %8"PRIu64" %*s", fst.fileid, nflg ? 5 : 10, mode); 708 if (Oflg) { 709 oprint(fp, ""); 710 } else { 711 vprint(&vn, &fst); 712 } 713 rw[0] = '\0'; 714 if (flag & FREAD) 715 (void)strlcat(rw, "r", sizeof(rw)); 716 if (flag & FWRITE) 717 (void)strlcat(rw, "w", sizeof(rw)); 718 (void)printf(" %-2s", rw); 719 if (filename && !fsflg) 720 (void)printf(" %s", filename); 721 (void)putchar('\n'); 722 } 723 724 static int 725 ufs_filestat(struct vnode *vp, struct filestat *fsp) 726 { 727 struct inode inode; 728 struct ufsmount ufsmount; 729 union dinode { 730 struct ufs1_dinode dp1; 731 struct ufs2_dinode dp2; 732 } dip; 733 734 if (!KVM_READ(VTOI(vp), &inode, sizeof (inode))) { 735 dprintf("can't read inode at %p for pid %d", VTOI(vp), Pid); 736 return 0; 737 } 738 739 if (!KVM_READ(inode.i_ump, &ufsmount, sizeof (struct ufsmount))) { 740 dprintf("can't read ufsmount at %p for pid %d", inode.i_ump, Pid); 741 return 0; 742 } 743 744 switch (ufsmount.um_fstype) { 745 case UFS1: 746 if (!KVM_READ(inode.i_din.ffs1_din, &dip, 747 sizeof(struct ufs1_dinode))) { 748 dprintf("can't read dinode at %p for pid %d", 749 inode.i_din.ffs1_din, Pid); 750 return 0; 751 } 752 fsp->rdev = dip.dp1.di_rdev; 753 break; 754 case UFS2: 755 if (!KVM_READ(inode.i_din.ffs2_din, &dip, 756 sizeof(struct ufs2_dinode))) { 757 dprintf("can't read dinode at %p for pid %d", 758 inode.i_din.ffs2_din, Pid); 759 return 0; 760 } 761 fsp->rdev = dip.dp2.di_rdev; 762 break; 763 default: 764 dprintf("unknown ufs type %ld for pid %d", 765 ufsmount.um_fstype, Pid); 766 break; 767 } 768 fsp->fsid = inode.i_dev & 0xffff; 769 fsp->fileid = inode.i_number; 770 fsp->mode = (mode_t)inode.i_mode; 771 fsp->size = inode.i_size; 772 773 return 1; 774 } 775 776 static int 777 ext2fs_filestat(struct vnode *vp, struct filestat *fsp) 778 { 779 struct inode inode; 780 struct ext2fs_dinode dinode; 781 782 if (!KVM_READ(VTOI(vp), &inode, sizeof (inode))) { 783 dprintf("can't read inode at %p for pid %d", VTOI(vp), Pid); 784 return 0; 785 } 786 fsp->fsid = inode.i_dev & 0xffff; 787 fsp->fileid = inode.i_number; 788 789 if (!KVM_READ(inode.i_din.e2fs_din, &dinode, sizeof dinode)) { 790 dprintf("can't read ext2fs_dinode at %p for pid %d", 791 inode.i_din.e2fs_din, Pid); 792 return 0; 793 } 794 fsp->mode = dinode.e2di_mode; 795 fsp->size = dinode.e2di_size; 796 fsp->rdev = dinode.e2di_rdev; 797 798 return 1; 799 } 800 801 static int 802 nfs_filestat(struct vnode *vp, struct filestat *fsp) 803 { 804 struct nfsnode nfsnode; 805 struct vattr va; 806 807 if (!KVM_READ(VTONFS(vp), &nfsnode, sizeof (nfsnode))) { 808 dprintf("can't read nfsnode at %p for pid %d", VTONFS(vp), 809 Pid); 810 return 0; 811 } 812 if (!KVM_READ(nfsnode.n_vattr, &va, sizeof(va))) { 813 dprintf("can't read vnode attributes at %p for pid %d", 814 nfsnode.n_vattr, Pid); 815 return 0; 816 } 817 fsp->fsid = va.va_fsid; 818 fsp->fileid = va.va_fileid; 819 fsp->size = nfsnode.n_size; 820 fsp->rdev = va.va_rdev; 821 fsp->mode = (mode_t)va.va_mode | getftype(vp->v_type); 822 823 return 1; 824 } 825 826 static int 827 msdosfs_filestat(struct vnode *vp, struct filestat *fsp) 828 { 829 struct denode de; 830 struct msdosfsmount mp; 831 832 if (!KVM_READ(VTONFS(vp), &de, sizeof(de))) { 833 dprintf("can't read denode at %p for pid %d", VTONFS(vp), 834 Pid); 835 return 0; 836 } 837 if (!KVM_READ(de.de_pmp, &mp, sizeof(mp))) { 838 dprintf("can't read mount struct at %p for pid %d", de.de_pmp, 839 Pid); 840 return 0; 841 } 842 843 fsp->fsid = de.de_dev & 0xffff; 844 fsp->fileid = 0; /* XXX see msdosfs_vptofh() for more info */ 845 fsp->size = de.de_FileSize; 846 fsp->rdev = 0; /* msdosfs doesn't support device files */ 847 fsp->mode = (0777 & mp.pm_mask) | getftype(vp->v_type); 848 return 1; 849 } 850 851 static const char * 852 layer_filestat(struct vnode *vp, struct filestat *fsp) 853 { 854 struct layer_node layer_node; 855 struct mount mount; 856 struct vnode vn; 857 const char *badtype; 858 859 if (!KVM_READ(VTOLAYER(vp), &layer_node, sizeof(layer_node))) { 860 dprintf("can't read layer_node at %p for pid %d", 861 VTOLAYER(vp), Pid); 862 return "error"; 863 } 864 if (!KVM_READ(vp->v_mount, &mount, sizeof(struct mount))) { 865 dprintf("can't read mount struct at %p for pid %d", 866 vp->v_mount, Pid); 867 return "error"; 868 } 869 vp = layer_node.layer_lowervp; 870 if (!KVM_READ(vp, &vn, sizeof(struct vnode))) { 871 dprintf("can't read vnode at %p for pid %d", vp, Pid); 872 return "error"; 873 } 874 if ((badtype = vfilestat(&vn, fsp)) == NULL) 875 fsp->fsid = mount.mnt_stat.f_fsidx.__fsid_val[0]; 876 return badtype; 877 } 878 879 static char * 880 getmnton(struct mount *m) 881 { 882 static struct mount mount; 883 static struct mtab { 884 struct mtab *next; 885 struct mount *m; 886 char mntonname[MNAMELEN]; 887 } *mhead = NULL; 888 struct mtab *mt; 889 890 for (mt = mhead; mt != NULL; mt = mt->next) 891 if (m == mt->m) 892 return mt->mntonname; 893 if (!KVM_READ(m, &mount, sizeof(struct mount))) { 894 warnx("can't read mount table at %p", m); 895 return NULL; 896 } 897 if ((mt = malloc(sizeof (struct mtab))) == NULL) { 898 err(1, "malloc(%u)", (unsigned int)sizeof(struct mtab)); 899 } 900 mt->m = m; 901 (void)memmove(&mt->mntonname[0], &mount.mnt_stat.f_mntonname[0], 902 MNAMELEN); 903 mt->next = mhead; 904 mhead = mt; 905 return mt->mntonname; 906 } 907 908 static const char * 909 inet_addrstr(char *buf, size_t len, const struct in_addr *a, uint16_t p, bool isdg) 910 { 911 char addr[256], serv[256]; 912 struct sockaddr_in sin; 913 const int niflags = 914 (nflg ? (NI_NUMERICHOST|NI_NUMERICSERV) : 0) | 915 (isdg ? NI_DGRAM : 0); 916 917 918 (void)memset(&sin, 0, sizeof(sin)); 919 sin.sin_family = AF_INET; 920 sin.sin_len = sizeof(sin); 921 sin.sin_addr = *a; 922 sin.sin_port = htons(p); 923 924 serv[0] = '\0'; 925 926 if (getnameinfo((struct sockaddr *)&sin, sin.sin_len, 927 addr, sizeof(addr), serv, sizeof(serv), niflags)) { 928 if (inet_ntop(AF_INET, a, addr, sizeof(addr)) == NULL) 929 strlcpy(addr, "invalid", sizeof(addr)); 930 } 931 932 if (serv[0] == '\0') 933 snprintf(serv, sizeof(serv), "%u", p); 934 935 if (a->s_addr == INADDR_ANY) { 936 if (p == 0) 937 buf[0] = '\0'; 938 else 939 snprintf(buf, len, "*:%s", serv); 940 return buf; 941 } 942 943 snprintf(buf, len, "%s:%s", addr, serv); 944 return buf; 945 } 946 947 #ifdef INET6 948 static const char * 949 inet6_addrstr(char *buf, size_t len, const struct in6_addr *a, uint16_t p, bool isdg) 950 { 951 char addr[256], serv[256]; 952 struct sockaddr_in6 sin6; 953 const int niflags = 954 (nflg ? (NI_NUMERICHOST|NI_NUMERICSERV) : 0) | 955 (isdg ? NI_DGRAM : 0); 956 957 (void)memset(&sin6, 0, sizeof(sin6)); 958 sin6.sin6_family = AF_INET6; 959 sin6.sin6_len = sizeof(sin6); 960 sin6.sin6_addr = *a; 961 sin6.sin6_port = htons(p); 962 963 inet6_getscopeid(&sin6, INET6_IS_ADDR_LINKLOCAL); 964 serv[0] = '\0'; 965 966 if (getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len, 967 addr, sizeof(addr), serv, sizeof(serv), niflags)) { 968 if (inet_ntop(AF_INET6, a, addr, sizeof(addr)) == NULL) 969 strlcpy(addr, "invalid", sizeof(addr)); 970 } 971 972 if (serv[0] == '\0') 973 snprintf(serv, sizeof(serv), "%u", p); 974 975 if (IN6_IS_ADDR_UNSPECIFIED(a)) { 976 if (p == 0) 977 buf[0] = '\0'; 978 else 979 snprintf(buf, len, "*:%s", serv); 980 return buf; 981 } 982 983 if (strchr(addr, ':') == NULL) 984 snprintf(buf, len, "%s:%s", addr, serv); 985 else 986 snprintf(buf, len, "[%s]:%s", addr, serv); 987 988 return buf; 989 } 990 #endif 991 992 static const char * 993 at_addrstr(char *buf, size_t len, const struct sockaddr_at *sat) 994 { 995 const struct netrange *nr = &sat->sat_range.r_netrange; 996 const struct at_addr *at = &sat->sat_addr; 997 char addr[64], phase[64], range[64]; 998 999 if (sat->sat_port || at->s_net || at->s_node) { 1000 if (at->s_net || at->s_node) 1001 snprintf(addr, sizeof(addr), "%u.%u:%u", 1002 ntohs(at->s_net), at->s_node, sat->sat_port); 1003 else 1004 snprintf(addr, sizeof(addr), "*:%u", sat->sat_port); 1005 } else 1006 addr[0] = '\0'; 1007 1008 if (nr->nr_phase) 1009 snprintf(phase, sizeof(phase), " phase %u", nr->nr_phase); 1010 else 1011 phase[0] = '\0'; 1012 1013 if (nr->nr_firstnet || nr->nr_lastnet) 1014 snprintf(range, sizeof(range), " range [%u-%u]", 1015 ntohs(nr->nr_firstnet), ntohs(nr->nr_lastnet)); 1016 else 1017 range[0] = '\0'; 1018 1019 snprintf(buf, len, "%s%s%s", addr, phase, range); 1020 return buf; 1021 } 1022 1023 static void 1024 socktrans(struct file *f, struct socket *sock, int i) 1025 { 1026 static const char *stypename[] = { 1027 "unused", /* 0 */ 1028 "stream", /* 1 */ 1029 "dgram", /* 2 */ 1030 "raw", /* 3 */ 1031 "rdm", /* 4 */ 1032 "seqpak" /* 5 */ 1033 }; 1034 #define STYPEMAX 5 1035 struct socket so; 1036 struct protosw proto; 1037 struct domain dom; 1038 struct inpcb inpcb; 1039 #ifdef INET6 1040 struct in6pcb in6pcb; 1041 #endif 1042 struct unpcb unpcb; 1043 struct ddpcb ddpcb; 1044 int len; 1045 char dname[32]; 1046 char lbuf[512], fbuf[512], pbuf[24]; 1047 bool isdgram; 1048 1049 pbuf[0] = '\0'; 1050 /* fill in socket */ 1051 if (!KVM_READ(sock, &so, sizeof(struct socket))) { 1052 dprintf("can't read sock at %p", sock); 1053 goto bad; 1054 } 1055 1056 /* fill in protosw entry */ 1057 if (!KVM_READ(so.so_proto, &proto, sizeof(struct protosw))) { 1058 dprintf("can't read protosw at %p", so.so_proto); 1059 goto bad; 1060 } 1061 1062 /* fill in domain */ 1063 if (!KVM_READ(proto.pr_domain, &dom, sizeof(struct domain))) { 1064 dprintf("can't read domain at %p", proto.pr_domain); 1065 goto bad; 1066 } 1067 1068 if (checkfile && dom.dom_family != AF_LOCAL) 1069 return; 1070 1071 if ((len = kvm_read(kd, (u_long)dom.dom_name, dname, 1072 sizeof(dname) - 1)) != sizeof(dname) -1) { 1073 dprintf("can't read domain name at %p", dom.dom_name); 1074 dname[0] = '\0'; 1075 } 1076 else 1077 dname[len] = '\0'; 1078 1079 /* 1080 * protocol specific formatting 1081 * 1082 * Try to find interesting things to print. For TCP, the interesting 1083 * thing is the address of the tcpcb, for UDP and others, just the 1084 * inpcb (socket pcb). For UNIX domain, its the address of the socket 1085 * pcb and the address of the connected pcb (if connected). Otherwise 1086 * just print the protocol number and address of the socket itself. 1087 * The idea is not to duplicate netstat, but to make available enough 1088 * information for further analysis. 1089 */ 1090 fbuf[0] = '\0'; 1091 lbuf[0] = '\0'; 1092 isdgram = false; 1093 switch(dom.dom_family) { 1094 case AF_INET: 1095 getinetproto(pbuf, sizeof(pbuf), proto.pr_protocol); 1096 switch (proto.pr_protocol) { 1097 case IPPROTO_UDP: 1098 isdgram = true; 1099 /* FALLTHROUGH */ 1100 case IPPROTO_TCP: 1101 if (so.so_pcb == NULL) 1102 break; 1103 if (kvm_read(kd, (u_long)so.so_pcb, (char *)&inpcb, 1104 sizeof(inpcb)) != sizeof(inpcb)) { 1105 dprintf("can't read inpcb at %p", so.so_pcb); 1106 goto bad; 1107 } 1108 inet_addrstr(lbuf, sizeof(lbuf), &inpcb.inp_laddr, 1109 ntohs(inpcb.inp_lport), isdgram); 1110 inet_addrstr(fbuf, sizeof(fbuf), &inpcb.inp_faddr, 1111 ntohs(inpcb.inp_fport), isdgram); 1112 break; 1113 default: 1114 break; 1115 } 1116 break; 1117 #ifdef INET6 1118 case AF_INET6: 1119 getinetproto(pbuf, sizeof(pbuf), proto.pr_protocol); 1120 switch (proto.pr_protocol) { 1121 case IPPROTO_UDP: 1122 isdgram = true; 1123 /* FALLTHROUGH */ 1124 case IPPROTO_TCP: 1125 if (so.so_pcb == NULL) 1126 break; 1127 if (kvm_read(kd, (u_long)so.so_pcb, (char *)&in6pcb, 1128 sizeof(in6pcb)) != sizeof(in6pcb)) { 1129 dprintf("can't read in6pcb at %p", so.so_pcb); 1130 goto bad; 1131 } 1132 inet6_addrstr(lbuf, sizeof(lbuf), &in6pcb.in6p_laddr, 1133 ntohs(in6pcb.in6p_lport), isdgram); 1134 inet6_addrstr(fbuf, sizeof(fbuf), &in6pcb.in6p_faddr, 1135 ntohs(in6pcb.in6p_fport), isdgram); 1136 break; 1137 default: 1138 break; 1139 } 1140 break; 1141 #endif 1142 case AF_LOCAL: 1143 /* print address of pcb and connected pcb */ 1144 if (so.so_pcb) { 1145 char shoconn[4], *cp; 1146 void *pcb[2]; 1147 size_t p = 0; 1148 1149 pcb[0] = so.so_pcb; 1150 1151 cp = shoconn; 1152 if (!(so.so_state & SS_CANTRCVMORE)) 1153 *cp++ = '<'; 1154 *cp++ = '-'; 1155 if (!(so.so_state & SS_CANTSENDMORE)) 1156 *cp++ = '>'; 1157 *cp = '\0'; 1158 again: 1159 if (kvm_read(kd, (u_long)pcb[p], (char *)&unpcb, 1160 sizeof(struct unpcb)) != sizeof(struct unpcb)){ 1161 dprintf("can't read unpcb at %p", so.so_pcb); 1162 goto bad; 1163 } 1164 if (checkfile) { 1165 struct vnode vn; 1166 struct filestat fst; 1167 const char *badtype, *filename; 1168 if (unpcb.unp_vnode == NULL) 1169 return; 1170 if (!checkfs(unpcb.unp_vnode, &vn, &fst, 1171 &badtype, &filename)) 1172 return; 1173 } 1174 1175 if (unpcb.unp_addr) { 1176 struct sockaddr_un *sun = 1177 malloc(unpcb.unp_addrlen); 1178 if (sun == NULL) 1179 err(1, "malloc(%zu)", 1180 unpcb.unp_addrlen); 1181 if (kvm_read(kd, (u_long)unpcb.unp_addr, 1182 sun, unpcb.unp_addrlen) != 1183 (ssize_t)unpcb.unp_addrlen) { 1184 dprintf("can't read sun at %p", 1185 unpcb.unp_addr); 1186 free(sun); 1187 } else { 1188 snprintf(fbuf, sizeof(fbuf), " %s %s %s", 1189 shoconn, sun->sun_path, 1190 p == 0 ? "[creat]" : "[using]"); 1191 free(sun); 1192 break; 1193 } 1194 } 1195 if (unpcb.unp_conn) { 1196 if (p == 0) { 1197 pcb[++p] = unpcb.unp_conn; 1198 goto again; 1199 } else 1200 snprintf(fbuf, sizeof(fbuf), 1201 " %p %s %p", pcb[0], shoconn, 1202 pcb[1]); 1203 } 1204 } 1205 break; 1206 case AF_APPLETALK: 1207 getatproto(pbuf, sizeof(pbuf), proto.pr_protocol); 1208 if (so.so_pcb) { 1209 if (kvm_read(kd, (u_long)so.so_pcb, (char *)&ddpcb, 1210 sizeof(ddpcb)) != sizeof(ddpcb)){ 1211 dprintf("can't read ddpcb at %p", so.so_pcb); 1212 goto bad; 1213 } 1214 at_addrstr(fbuf, sizeof(fbuf), &ddpcb.ddp_fsat); 1215 at_addrstr(lbuf, sizeof(lbuf), &ddpcb.ddp_lsat); 1216 } 1217 break; 1218 default: 1219 /* print protocol number and socket address */ 1220 snprintf(fbuf, sizeof(fbuf), " %d %jx", proto.pr_protocol, 1221 (uintmax_t)(uintptr_t)sock); 1222 break; 1223 } 1224 PREFIX(i); 1225 if ((u_short)so.so_type > STYPEMAX) 1226 (void)printf("* %s ?%d", dname, so.so_type); 1227 else 1228 (void)printf("* %s %s", dname, stypename[so.so_type]); 1229 1230 if (pbuf[0]) 1231 printf("%s", pbuf); 1232 if (fbuf[0] || lbuf[0]) 1233 printf(" %s%s%s", fbuf, (fbuf[0] && lbuf[0]) ? " <-> " : "", 1234 lbuf); 1235 else if (so.so_pcb) 1236 printf(" %jx", (uintmax_t)(uintptr_t)so.so_pcb); 1237 oprint(f, "\n"); 1238 return; 1239 bad: 1240 (void)printf("* error\n"); 1241 } 1242 1243 static void 1244 ptrans(struct file *fp, struct pipe *cpipe, int i) 1245 { 1246 struct pipe cp; 1247 1248 PREFIX(i); 1249 1250 /* fill in pipe */ 1251 if (!KVM_READ(cpipe, &cp, sizeof(struct pipe))) { 1252 dprintf("can't read pipe at %p", cpipe); 1253 goto bad; 1254 } 1255 1256 /* pipe descriptor is either read or write, never both */ 1257 (void)printf("* pipe %p %s %p %s%s%s", cpipe, 1258 (fp->f_flag & FWRITE) ? "->" : "<-", 1259 cp.pipe_peer, 1260 (fp->f_flag & FWRITE) ? "w" : "r", 1261 (fp->f_flag & FNONBLOCK) ? "n" : "", 1262 (cp.pipe_state & PIPE_ASYNC) ? "a" : ""); 1263 oprint(fp, "\n"); 1264 return; 1265 bad: 1266 (void)printf("* error\n"); 1267 } 1268 1269 static void 1270 misctrans(struct file *file, int i) 1271 { 1272 1273 PREFIX(i); 1274 pmisc(file, dtypes[file->f_type]); 1275 } 1276 1277 /* 1278 * getinetproto -- 1279 * print name of protocol number 1280 */ 1281 static void 1282 getinetproto(char *buf, size_t len, int number) 1283 { 1284 const char *cp; 1285 1286 switch (number) { 1287 case IPPROTO_IP: 1288 cp = "ip"; break; 1289 case IPPROTO_ICMP: 1290 cp ="icmp"; break; 1291 case IPPROTO_GGP: 1292 cp ="ggp"; break; 1293 case IPPROTO_TCP: 1294 cp ="tcp"; break; 1295 case IPPROTO_EGP: 1296 cp ="egp"; break; 1297 case IPPROTO_PUP: 1298 cp ="pup"; break; 1299 case IPPROTO_UDP: 1300 cp ="udp"; break; 1301 case IPPROTO_IDP: 1302 cp ="idp"; break; 1303 case IPPROTO_RAW: 1304 cp ="raw"; break; 1305 case IPPROTO_ICMPV6: 1306 cp ="icmp6"; break; 1307 default: 1308 (void)snprintf(buf, len, " %d", number); 1309 return; 1310 } 1311 (void)snprintf(buf, len, " %s", cp); 1312 } 1313 1314 /* 1315 * getatproto -- 1316 * print name of protocol number 1317 */ 1318 static void 1319 getatproto(char *buf, size_t len, int number) 1320 { 1321 const char *cp; 1322 1323 switch (number) { 1324 case ATPROTO_DDP: 1325 cp = "ddp"; break; 1326 case ATPROTO_AARP: 1327 cp ="aarp"; break; 1328 default: 1329 (void)snprintf(buf, len, " %d", number); 1330 return; 1331 } 1332 (void)snprintf(buf, len, " %s", cp); 1333 } 1334 1335 static int 1336 getfname(const char *filename) 1337 { 1338 struct stat statbuf; 1339 DEVS *cur; 1340 1341 if (stat(filename, &statbuf)) { 1342 warn("stat(%s)", filename); 1343 return 0; 1344 } 1345 if ((cur = malloc(sizeof(*cur))) == NULL) { 1346 err(1, "malloc(%zu)", sizeof(*cur)); 1347 } 1348 cur->next = devs; 1349 devs = cur; 1350 1351 cur->ino = statbuf.st_ino; 1352 cur->fsid = statbuf.st_dev & 0xffff; 1353 cur->name = filename; 1354 return 1; 1355 } 1356 1357 mode_t 1358 getftype(enum vtype v_type) 1359 { 1360 mode_t ftype; 1361 1362 switch (v_type) { 1363 case VREG: 1364 ftype = S_IFREG; 1365 break; 1366 case VDIR: 1367 ftype = S_IFDIR; 1368 break; 1369 case VBLK: 1370 ftype = S_IFBLK; 1371 break; 1372 case VCHR: 1373 ftype = S_IFCHR; 1374 break; 1375 case VLNK: 1376 ftype = S_IFLNK; 1377 break; 1378 case VSOCK: 1379 ftype = S_IFSOCK; 1380 break; 1381 case VFIFO: 1382 ftype = S_IFIFO; 1383 break; 1384 default: 1385 ftype = 0; 1386 break; 1387 }; 1388 1389 return ftype; 1390 } 1391 1392 static void 1393 usage(void) 1394 { 1395 (void)fprintf(stderr, "Usage: %s [-Afnv] [-M core] [-N system] " 1396 "[-p pid] [-u user] [file ...]\n", getprogname()); 1397 exit(1); 1398 } 1399