fstat.c revision 1.10 1 /*-
2 * Copyright (c) 1988, 1993
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by the University of
16 * California, Berkeley and its contributors.
17 * 4. Neither the name of the University nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #ifndef lint
35 static char copyright[] =
36 "@(#) Copyright (c) 1988, 1993\n\
37 The Regents of the University of California. All rights reserved.\n";
38 #endif /* not lint */
39
40 #ifndef lint
41 static char sccsid[] = "@(#)fstat.c 8.1 (Berkeley) 6/6/93";
42 #endif /* not lint */
43
44 #include <sys/param.h>
45 #include <sys/time.h>
46 #include <sys/proc.h>
47 #include <sys/user.h>
48 #include <sys/stat.h>
49 #include <sys/vnode.h>
50 #include <sys/socket.h>
51 #include <sys/socketvar.h>
52 #include <sys/domain.h>
53 #include <sys/protosw.h>
54 #include <sys/unpcb.h>
55 #include <sys/sysctl.h>
56 #include <sys/filedesc.h>
57 #define KERNEL
58 #include <sys/file.h>
59 #include <ufs/ufs/quota.h>
60 #include <ufs/ufs/inode.h>
61 #undef KERNEL
62 #define NFS
63 #include <sys/mount.h>
64 #include <nfs/nfsv2.h>
65 #include <nfs/rpcv2.h>
66 #include <nfs/nfs.h>
67 #include <nfs/nfsnode.h>
68 #undef NFS
69
70 #include <net/route.h>
71 #include <netinet/in.h>
72 #include <netinet/in_systm.h>
73 #include <netinet/ip.h>
74 #include <netinet/in_pcb.h>
75
76 #include <ctype.h>
77 #include <errno.h>
78 #include <kvm.h>
79 #include <nlist.h>
80 #include <paths.h>
81 #include <pwd.h>
82 #include <stdio.h>
83 #include <stdlib.h>
84 #include <string.h>
85
86 #define TEXT -1
87 #define CDIR -2
88 #define RDIR -3
89 #define TRACE -4
90
91 typedef struct devs {
92 struct devs *next;
93 long fsid;
94 ino_t ino;
95 char *name;
96 } DEVS;
97 DEVS *devs;
98
99 struct filestat {
100 long fsid;
101 long fileid;
102 mode_t mode;
103 u_long size;
104 dev_t rdev;
105 };
106
107 #ifdef notdef
108 struct nlist nl[] = {
109 { "" },
110 };
111 #endif
112
113 int fsflg, /* show files on same filesystem as file(s) argument */
114 pflg, /* show files open by a particular pid */
115 uflg; /* show files open by a particular (effective) user */
116 int checkfile; /* true if restricting to particular files or filesystems */
117 int nflg; /* (numerical) display f.s. and rdev as dev_t */
118 int vflg; /* display errors in locating kernel data objects etc... */
119
120 #define dprintf if (vflg) fprintf
121
122 struct file **ofiles; /* buffer of pointers to file structures */
123 int maxfiles;
124 #define ALLOC_OFILES(d) \
125 if ((d) > maxfiles) { \
126 free(ofiles); \
127 ofiles = malloc((d) * sizeof(struct file *)); \
128 if (ofiles == NULL) { \
129 fprintf(stderr, "fstat: %s\n", strerror(errno)); \
130 exit(1); \
131 } \
132 maxfiles = (d); \
133 }
134
135 /*
136 * a kvm_read that returns true if everything is read
137 */
138 #define KVM_READ(kaddr, paddr, len) \
139 (kvm_read(kd, (u_long)(kaddr), (char *)(paddr), (len)) == (len))
140
141 kvm_t *kd;
142
143 int ufs_filestat(), nfs_filestat();
144 void dofiles(), getinetproto(), socktrans();
145 void usage(), vtrans();
146
147 main(argc, argv)
148 int argc;
149 char **argv;
150 {
151 extern char *optarg;
152 extern int optind;
153 register struct passwd *passwd;
154 struct kinfo_proc *p, *plast;
155 int arg, ch, what;
156 char *memf, *nlistf;
157 int cnt;
158
159 arg = 0;
160 what = KERN_PROC_ALL;
161 nlistf = memf = NULL;
162 while ((ch = getopt(argc, argv, "fnp:u:vNM")) != EOF)
163 switch((char)ch) {
164 case 'f':
165 fsflg = 1;
166 break;
167 case 'M':
168 memf = optarg;
169 break;
170 case 'N':
171 nlistf = optarg;
172 break;
173 case 'n':
174 nflg = 1;
175 break;
176 case 'p':
177 if (pflg++)
178 usage();
179 if (!isdigit(*optarg)) {
180 fprintf(stderr,
181 "fstat: -p requires a process id\n");
182 usage();
183 }
184 what = KERN_PROC_PID;
185 arg = atoi(optarg);
186 break;
187 case 'u':
188 if (uflg++)
189 usage();
190 if (!(passwd = getpwnam(optarg))) {
191 fprintf(stderr, "%s: unknown uid\n",
192 optarg);
193 exit(1);
194 }
195 what = KERN_PROC_UID;
196 arg = passwd->pw_uid;
197 break;
198 case 'v':
199 vflg = 1;
200 break;
201 case '?':
202 default:
203 usage();
204 }
205
206 if (*(argv += optind)) {
207 for (; *argv; ++argv) {
208 if (getfname(*argv))
209 checkfile = 1;
210 }
211 if (!checkfile) /* file(s) specified, but none accessable */
212 exit(1);
213 }
214
215 ALLOC_OFILES(256); /* reserve space for file pointers */
216
217 if (fsflg && !checkfile) {
218 /* -f with no files means use wd */
219 if (getfname(".") == 0)
220 exit(1);
221 checkfile = 1;
222 }
223
224 /*
225 * Discard setgid privileges if not the running kernel so that bad
226 * guys can't print interesting stuff from kernel memory.
227 */
228 if (nlistf != NULL || memf != NULL)
229 setgid(getgid());
230
231 if ((kd = kvm_open(nlistf, memf, NULL, O_RDONLY, NULL)) == NULL) {
232 fprintf(stderr, "fstat: %s\n", kvm_geterr(kd));
233 exit(1);
234 }
235 #ifdef notdef
236 if (kvm_nlist(kd, nl) != 0) {
237 fprintf(stderr, "fstat: no namelist: %s\n", kvm_geterr(kd));
238 exit(1);
239 }
240 #endif
241 if ((p = kvm_getprocs(kd, what, arg, &cnt)) == NULL) {
242 fprintf(stderr, "fstat: %s\n", kvm_geterr(kd));
243 exit(1);
244 }
245 if (nflg)
246 printf("%s",
247 "USER CMD PID FD DEV INUM MODE SZ|DV R/W");
248 else
249 printf("%s",
250 "USER CMD PID FD MOUNT INUM MODE SZ|DV R/W");
251 if (checkfile && fsflg == 0)
252 printf(" NAME\n");
253 else
254 putchar('\n');
255
256 for (plast = &p[cnt]; p < plast; ++p) {
257 if (p->kp_proc.p_stat == SZOMB)
258 continue;
259 dofiles(p);
260 }
261 exit(0);
262 }
263
264 char *Uname, *Comm;
265 int Pid;
266
267 #define PREFIX(i) printf("%-8.8s %-10s %5d", Uname, Comm, Pid); \
268 switch(i) { \
269 case TEXT: \
270 printf(" text"); \
271 break; \
272 case CDIR: \
273 printf(" wd"); \
274 break; \
275 case RDIR: \
276 printf(" root"); \
277 break; \
278 case TRACE: \
279 printf(" tr"); \
280 break; \
281 default: \
282 printf(" %4d", i); \
283 break; \
284 }
285
286 /*
287 * print open files attributed to this process
288 */
289 void
290 dofiles(kp)
291 struct kinfo_proc *kp;
292 {
293 int i, last;
294 struct file file;
295 struct filedesc0 filed0;
296 #define filed filed0.fd_fd
297 struct proc *p = &kp->kp_proc;
298 struct eproc *ep = &kp->kp_eproc;
299
300 extern char *user_from_uid();
301
302 Uname = user_from_uid(ep->e_ucred.cr_uid, 0);
303 Pid = p->p_pid;
304 Comm = p->p_comm;
305
306 if (p->p_fd == NULL)
307 return;
308 if (!KVM_READ(p->p_fd, &filed0, sizeof (filed0))) {
309 dprintf(stderr, "can't read filedesc at %x for pid %d\n",
310 p->p_fd, Pid);
311 return;
312 }
313 /*
314 * root directory vnode, if one
315 */
316 if (filed.fd_rdir)
317 vtrans(filed.fd_rdir, RDIR, FREAD);
318 /*
319 * current working directory vnode
320 */
321 vtrans(filed.fd_cdir, CDIR, FREAD);
322 /*
323 * ktrace vnode, if one
324 */
325 if (p->p_tracep)
326 vtrans(p->p_tracep, TRACE, FREAD|FWRITE);
327 /*
328 * open files
329 */
330 #define FPSIZE (sizeof (struct file *))
331 ALLOC_OFILES(filed.fd_lastfile+1);
332 if (filed.fd_nfiles > NDFILE) {
333 if (!KVM_READ(filed.fd_ofiles, ofiles,
334 (filed.fd_lastfile+1) * FPSIZE)) {
335 dprintf(stderr,
336 "can't read file structures at %x for pid %d\n",
337 filed.fd_ofiles, Pid);
338 return;
339 }
340 } else
341 bcopy(filed0.fd_dfiles, ofiles, (filed.fd_lastfile+1) * FPSIZE);
342 for (i = 0; i <= filed.fd_lastfile; i++) {
343 if (ofiles[i] == NULL)
344 continue;
345 if (!KVM_READ(ofiles[i], &file, sizeof (struct file))) {
346 dprintf(stderr, "can't read file %d at %x for pid %d\n",
347 i, ofiles[i], Pid);
348 continue;
349 }
350 if (file.f_type == DTYPE_VNODE)
351 vtrans((struct vnode *)file.f_data, i, file.f_flag);
352 else if (file.f_type == DTYPE_SOCKET) {
353 if (checkfile == 0)
354 socktrans((struct socket *)file.f_data, i);
355 }
356 else {
357 dprintf(stderr,
358 "unknown file type %d for file %d of pid %d\n",
359 file.f_type, i, Pid);
360 }
361 }
362 }
363
364 void
365 vtrans(vp, i, flag)
366 struct vnode *vp;
367 int i;
368 int flag;
369 {
370 struct vnode vn;
371 struct filestat fst;
372 char rw[3], mode[15];
373 char *badtype = NULL, *filename, *getmnton();
374
375 filename = badtype = NULL;
376 if (!KVM_READ(vp, &vn, sizeof (struct vnode))) {
377 dprintf(stderr, "can't read vnode at %x for pid %d\n",
378 vp, Pid);
379 return;
380 }
381 if (vn.v_type == VNON || vn.v_tag == VT_NON)
382 badtype = "none";
383 else if (vn.v_type == VBAD)
384 badtype = "bad";
385 else
386 switch (vn.v_tag) {
387 case VT_UFS:
388 if (!ufs_filestat(&vn, &fst))
389 badtype = "error";
390 break;
391 case VT_MFS:
392 if (!ufs_filestat(&vn, &fst))
393 badtype = "error";
394 break;
395 case VT_NFS:
396 if (!nfs_filestat(&vn, &fst))
397 badtype = "error";
398 break;
399 default: {
400 static char unknown[10];
401 sprintf(badtype = unknown, "?(%x)", vn.v_tag);
402 break;;
403 }
404 }
405 if (checkfile) {
406 int fsmatch = 0;
407 register DEVS *d;
408
409 if (badtype)
410 return;
411 for (d = devs; d != NULL; d = d->next)
412 if (d->fsid == fst.fsid) {
413 fsmatch = 1;
414 if (d->ino == fst.fileid) {
415 filename = d->name;
416 break;
417 }
418 }
419 if (fsmatch == 0 || (filename == NULL && fsflg == 0))
420 return;
421 }
422 PREFIX(i);
423 if (badtype) {
424 (void)printf(" - - %10s -\n", badtype);
425 return;
426 }
427 if (nflg)
428 (void)printf(" %2d,%-2d", major(fst.fsid), minor(fst.fsid));
429 else
430 (void)printf(" %-8s", getmnton(vn.v_mount));
431 if (nflg)
432 (void)sprintf(mode, "%o", fst.mode);
433 else
434 strmode(fst.mode, mode);
435 (void)printf(" %6d %10s", fst.fileid, mode);
436 switch (vn.v_type) {
437 case VBLK:
438 case VCHR: {
439 char *name;
440
441 if (nflg || ((name = devname(fst.rdev, vn.v_type == VCHR ?
442 S_IFCHR : S_IFBLK)) == NULL))
443 printf(" %2d,%-2d", major(fst.rdev), minor(fst.rdev));
444 else
445 printf(" %6s", name);
446 break;
447 }
448 default:
449 printf(" %6d", fst.size);
450 }
451 rw[0] = '\0';
452 if (flag & FREAD)
453 strcat(rw, "r");
454 if (flag & FWRITE)
455 strcat(rw, "w");
456 printf(" %2s", rw);
457 if (filename && !fsflg)
458 printf(" %s", filename);
459 putchar('\n');
460 }
461
462 int
463 ufs_filestat(vp, fsp)
464 struct vnode *vp;
465 struct filestat *fsp;
466 {
467 #ifdef notyet
468 struct inode inode;
469
470 if (!KVM_READ(VTOI(vp), &inode, sizeof (inode))) {
471 dprintf(stderr, "can't read inode at %x for pid %d\n",
472 VTOI(vp), Pid);
473 return 0;
474 }
475 fsp->fsid = inode.i_dev & 0xffff;
476 fsp->fileid = (long)inode.i_number;
477 fsp->mode = (mode_t)inode.i_mode;
478 fsp->size = (u_long)inode.i_size;
479 fsp->rdev = inode.i_rdev;
480 #else
481 struct inode *inode;
482
483 inode = VTOI(vp);
484 fsp->fsid = inode->i_dev & 0xffff;
485 fsp->fileid = (long)inode->i_number;
486 fsp->mode = (mode_t)inode->i_mode;
487 fsp->size = (u_long)inode->i_size;
488 fsp->rdev = inode->i_rdev;
489 #endif
490
491 return 1;
492 }
493
494 int
495 nfs_filestat(vp, fsp)
496 struct vnode *vp;
497 struct filestat *fsp;
498 {
499 #ifdef notyet
500 struct nfsnode nfsnode;
501 register mode_t mode;
502
503 if (!KVM_READ(VTONFS(vp), &nfsnode, sizeof (nfsnode))) {
504 dprintf(stderr, "can't read nfsnode at %x for pid %d\n",
505 VTONFS(vp), Pid);
506 return 0;
507 }
508 fsp->fsid = nfsnode.n_vattr.va_fsid;
509 fsp->fileid = nfsnode.n_vattr.va_fileid;
510 fsp->size = nfsnode.n_size;
511 fsp->rdev = nfsnode.n_vattr.va_rdev;
512 mode = (mode_t)nfsnode.n_vattr.va_mode;
513 switch (vp->v_type) {
514 case VREG:
515 mode |= S_IFREG;
516 break;
517 case VDIR:
518 mode |= S_IFDIR;
519 break;
520 case VBLK:
521 mode |= S_IFBLK;
522 break;
523 case VCHR:
524 mode |= S_IFCHR;
525 break;
526 case VLNK:
527 mode |= S_IFLNK;
528 break;
529 case VSOCK:
530 mode |= S_IFSOCK;
531 break;
532 case VFIFO:
533 mode |= S_IFIFO;
534 break;
535 };
536 fsp->mode = mode;
537
538 return 1;
539 #else
540 return 0;
541 #endif
542 }
543
544
545 char *
546 getmnton(m)
547 struct mount *m;
548 {
549 static struct mount mount;
550 static struct mtab {
551 struct mtab *next;
552 struct mount *m;
553 char mntonname[MNAMELEN];
554 } *mhead = NULL;
555 register struct mtab *mt;
556
557 for (mt = mhead; mt != NULL; mt = mt->next)
558 if (m == mt->m)
559 return (mt->mntonname);
560 if (!KVM_READ(m, &mount, sizeof(struct mount))) {
561 fprintf(stderr, "can't read mount table at %x\n", m);
562 return (NULL);
563 }
564 if ((mt = malloc(sizeof (struct mtab))) == NULL) {
565 fprintf(stderr, "fstat: %s\n", strerror(errno));
566 exit(1);
567 }
568 mt->m = m;
569 bcopy(&mount.mnt_stat.f_mntonname[0], &mt->mntonname[0], MNAMELEN);
570 mt->next = mhead;
571 mhead = mt;
572 return (mt->mntonname);
573 }
574
575 void
576 socktrans(sock, i)
577 struct socket *sock;
578 int i;
579 {
580 static char *stypename[] = {
581 "unused", /* 0 */
582 "stream", /* 1 */
583 "dgram", /* 2 */
584 "raw", /* 3 */
585 "rdm", /* 4 */
586 "seqpak" /* 5 */
587 };
588 #define STYPEMAX 5
589 struct socket so;
590 struct protosw proto;
591 struct domain dom;
592 struct inpcb inpcb;
593 struct unpcb unpcb;
594 int len;
595 char dname[32], *strcpy();
596
597 PREFIX(i);
598
599 /* fill in socket */
600 if (!KVM_READ(sock, &so, sizeof(struct socket))) {
601 dprintf(stderr, "can't read sock at %x\n", sock);
602 goto bad;
603 }
604
605 /* fill in protosw entry */
606 if (!KVM_READ(so.so_proto, &proto, sizeof(struct protosw))) {
607 dprintf(stderr, "can't read protosw at %x", so.so_proto);
608 goto bad;
609 }
610
611 /* fill in domain */
612 if (!KVM_READ(proto.pr_domain, &dom, sizeof(struct domain))) {
613 dprintf(stderr, "can't read domain at %x\n", proto.pr_domain);
614 goto bad;
615 }
616
617 if ((len = kvm_read(kd, (u_long)dom.dom_name, dname,
618 sizeof(dname) - 1)) < 0) {
619 dprintf(stderr, "can't read domain name at %x\n",
620 dom.dom_name);
621 dname[0] = '\0';
622 }
623 else
624 dname[len] = '\0';
625
626 if ((u_short)so.so_type > STYPEMAX)
627 printf("* %s ?%d", dname, so.so_type);
628 else
629 printf("* %s %s", dname, stypename[so.so_type]);
630
631 /*
632 * protocol specific formatting
633 *
634 * Try to find interesting things to print. For tcp, the interesting
635 * thing is the address of the tcpcb, for udp and others, just the
636 * inpcb (socket pcb). For unix domain, its the address of the socket
637 * pcb and the address of the connected pcb (if connected). Otherwise
638 * just print the protocol number and address of the socket itself.
639 * The idea is not to duplicate netstat, but to make available enough
640 * information for further analysis.
641 */
642 switch(dom.dom_family) {
643 case AF_INET:
644 getinetproto(proto.pr_protocol);
645 if (proto.pr_protocol == IPPROTO_TCP ) {
646 if (so.so_pcb) {
647 if (kvm_read(kd, (u_long)so.so_pcb,
648 (char *)&inpcb, sizeof(struct inpcb))
649 != sizeof(struct inpcb)) {
650 dprintf(stderr,
651 "can't read inpcb at %x\n",
652 so.so_pcb);
653 goto bad;
654 }
655 printf(" %x", (int)inpcb.inp_ppcb);
656 }
657 }
658 else if (so.so_pcb)
659 printf(" %x", (int)so.so_pcb);
660 break;
661 case AF_UNIX:
662 /* print address of pcb and connected pcb */
663 if (so.so_pcb) {
664 printf(" %x", (int)so.so_pcb);
665 if (kvm_read(kd, (u_long)so.so_pcb, (char *)&unpcb,
666 sizeof(struct unpcb)) != sizeof(struct unpcb)){
667 dprintf(stderr, "can't read unpcb at %x\n",
668 so.so_pcb);
669 goto bad;
670 }
671 if (unpcb.unp_conn) {
672 char shoconn[4], *cp;
673
674 cp = shoconn;
675 if (!(so.so_state & SS_CANTRCVMORE))
676 *cp++ = '<';
677 *cp++ = '-';
678 if (!(so.so_state & SS_CANTSENDMORE))
679 *cp++ = '>';
680 *cp = '\0';
681 printf(" %s %x", shoconn,
682 (int)unpcb.unp_conn);
683 }
684 }
685 break;
686 default:
687 /* print protocol number and socket address */
688 printf(" %d %x", proto.pr_protocol, (int)sock);
689 }
690 printf("\n");
691 return;
692 bad:
693 printf("* error\n");
694 }
695
696 /*
697 * getinetproto --
698 * print name of protocol number
699 */
700 void
701 getinetproto(number)
702 int number;
703 {
704 char *cp;
705
706 switch(number) {
707 case IPPROTO_IP:
708 cp = "ip"; break;
709 case IPPROTO_ICMP:
710 cp ="icmp"; break;
711 case IPPROTO_GGP:
712 cp ="ggp"; break;
713 case IPPROTO_TCP:
714 cp ="tcp"; break;
715 case IPPROTO_EGP:
716 cp ="egp"; break;
717 case IPPROTO_PUP:
718 cp ="pup"; break;
719 case IPPROTO_UDP:
720 cp ="udp"; break;
721 case IPPROTO_IDP:
722 cp ="idp"; break;
723 case IPPROTO_RAW:
724 cp ="raw"; break;
725 default:
726 printf(" %d", number);
727 return;
728 }
729 printf(" %s", cp);
730 }
731
732 getfname(filename)
733 char *filename;
734 {
735 struct stat statbuf;
736 DEVS *cur;
737
738 if (stat(filename, &statbuf)) {
739 fprintf(stderr, "fstat: %s: %s\n", filename, strerror(errno));
740 return(0);
741 }
742 if ((cur = malloc(sizeof(DEVS))) == NULL) {
743 fprintf(stderr, "fstat: %s\n", strerror(errno));
744 exit(1);
745 }
746 cur->next = devs;
747 devs = cur;
748
749 cur->ino = statbuf.st_ino;
750 cur->fsid = statbuf.st_dev & 0xffff;
751 cur->name = filename;
752 return(1);
753 }
754
755 void
756 usage()
757 {
758 (void)fprintf(stderr,
759 "usage: fstat [-fnv] [-p pid] [-u user] [-N system] [-M core] [file ...]\n");
760 exit(1);
761 }
762