fstat.c revision 1.102
1 /* $NetBSD: fstat.c,v 1.102 2013/10/19 00:28:38 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 1988, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 #ifndef lint 34 __COPYRIGHT("@(#) Copyright (c) 1988, 1993\ 35 The Regents of the University of California. All rights reserved."); 36 #endif /* not lint */ 37 38 #ifndef lint 39 #if 0 40 static char sccsid[] = "@(#)fstat.c 8.3 (Berkeley) 5/2/95"; 41 #else 42 __RCSID("$NetBSD: fstat.c,v 1.102 2013/10/19 00:28:38 christos Exp $"); 43 #endif 44 #endif /* not lint */ 45 46 #include <sys/types.h> 47 #include <sys/param.h> 48 #include <sys/time.h> 49 #include <sys/proc.h> 50 #include <sys/stat.h> 51 #include <sys/vnode.h> 52 #include <sys/socket.h> 53 #include <sys/socketvar.h> 54 #include <sys/domain.h> 55 #include <sys/protosw.h> 56 #include <sys/unpcb.h> 57 #include <sys/sysctl.h> 58 #include <sys/filedesc.h> 59 #include <sys/pipe.h> 60 #define _KERNEL 61 #include <sys/mount.h> 62 #undef _KERNEL 63 #define _KERNEL 64 #include <sys/file.h> 65 #include <ufs/ufs/inode.h> 66 #include <ufs/ufs/ufsmount.h> 67 #undef _KERNEL 68 #define NFS 69 #include <nfs/nfsproto.h> 70 #include <nfs/rpcv2.h> 71 #include <nfs/nfs.h> 72 #include <nfs/nfsnode.h> 73 #undef NFS 74 #include <msdosfs/denode.h> 75 #include <msdosfs/bpb.h> 76 #define _KERNEL 77 #include <msdosfs/msdosfsmount.h> 78 #undef _KERNEL 79 #define _KERNEL 80 #include <miscfs/genfs/layer.h> 81 #undef _KERNEL 82 83 #include <net/route.h> 84 #include <netinet/in.h> 85 #include <netinet/in_systm.h> 86 #include <netinet/ip.h> 87 #include <netinet/in_pcb.h> 88 89 #ifdef INET6 90 #include <netinet/ip6.h> 91 #include <netinet6/in6.h> 92 #include <netinet6/ip6_var.h> 93 #include <netinet6/in6_pcb.h> 94 #endif 95 96 #include <netatalk/at.h> 97 #include <netatalk/ddp_var.h> 98 99 #include <netdb.h> 100 #include <arpa/inet.h> 101 102 #include <ctype.h> 103 #include <errno.h> 104 #include <kvm.h> 105 #include <limits.h> 106 #include <nlist.h> 107 #include <paths.h> 108 #include <pwd.h> 109 #include <stdio.h> 110 #include <stdlib.h> 111 #include <string.h> 112 #include <unistd.h> 113 #include <err.h> 114 #include <util.h> 115 116 #include "fstat.h" 117 118 #define TEXT -1 119 #define CDIR -2 120 #define RDIR -3 121 #define TRACE -4 122 123 typedef struct devs { 124 struct devs *next; 125 long fsid; 126 ino_t ino; 127 const char *name; 128 } DEVS; 129 static DEVS *devs; 130 131 static int fsflg, /* show files on same filesystem as file(s) argument */ 132 pflg, /* show files open by a particular pid */ 133 uflg; /* show files open by a particular (effective) user */ 134 static int checkfile; /* true if restricting to particular files or filesystems */ 135 static int nflg; /* (numerical) display f.s. and rdev as dev_t */ 136 int vflg; /* display errors in locating kernel data objects etc... */ 137 138 static fdfile_t **ofiles; /* buffer of pointers to file structures */ 139 static int fstat_maxfiles; 140 #define ALLOC_OFILES(d) \ 141 if ((d) > fstat_maxfiles) { \ 142 size_t len = (d) * sizeof(fdfile_t *); \ 143 free(ofiles); \ 144 ofiles = malloc(len); \ 145 if (ofiles == NULL) { \ 146 err(1, "malloc(%zu)", len); \ 147 } \ 148 fstat_maxfiles = (d); \ 149 } 150 151 kvm_t *kd; 152 153 static const char *const dtypes[] = { 154 DTYPE_NAMES 155 }; 156 157 static void dofiles(struct kinfo_proc2 *); 158 static int ext2fs_filestat(struct vnode *, struct filestat *); 159 static int getfname(const char *); 160 static void getinetproto(int); 161 static void getatproto(int); 162 static char *getmnton(struct mount *); 163 static const char *layer_filestat(struct vnode *, struct filestat *); 164 static int msdosfs_filestat(struct vnode *, struct filestat *); 165 static int nfs_filestat(struct vnode *, struct filestat *); 166 static const char *inet_addrstr(char *, size_t, const struct in_addr *, 167 uint16_t); 168 #ifdef INET6 169 static const char *inet6_addrstr(char *, size_t, const struct in6_addr *, 170 uint16_t); 171 #endif 172 static const char *at_addrstr(char *, size_t, const struct sockaddr_at *); 173 static void socktrans(struct socket *, int); 174 static void misctrans(struct file *, int); 175 static int ufs_filestat(struct vnode *, struct filestat *); 176 static void usage(void) __dead; 177 static const char *vfilestat(struct vnode *, struct filestat *); 178 static void vtrans(struct vnode *, int, int); 179 static void ftrans(fdfile_t *, int); 180 static void ptrans(struct file *, struct pipe *, int); 181 static void kdriver_init(void); 182 183 int 184 main(int argc, char **argv) 185 { 186 struct passwd *passwd; 187 struct kinfo_proc2 *p, *plast; 188 int arg, ch, what; 189 char *memf, *nlistf; 190 char buf[_POSIX2_LINE_MAX]; 191 int cnt; 192 gid_t egid = getegid(); 193 194 (void)setegid(getgid()); 195 arg = 0; 196 what = KERN_PROC_ALL; 197 nlistf = memf = NULL; 198 while ((ch = getopt(argc, argv, "fnp:u:vN:M:")) != -1) 199 switch((char)ch) { 200 case 'f': 201 fsflg = 1; 202 break; 203 case 'M': 204 memf = optarg; 205 break; 206 case 'N': 207 nlistf = optarg; 208 break; 209 case 'n': 210 nflg = 1; 211 break; 212 case 'p': 213 if (pflg++) 214 usage(); 215 if (!isdigit((unsigned char)*optarg)) { 216 warnx("-p requires a process id"); 217 usage(); 218 } 219 what = KERN_PROC_PID; 220 arg = atoi(optarg); 221 break; 222 case 'u': 223 if (uflg++) 224 usage(); 225 if (!(passwd = getpwnam(optarg))) { 226 errx(1, "%s: unknown uid", optarg); 227 } 228 what = KERN_PROC_UID; 229 arg = passwd->pw_uid; 230 break; 231 case 'v': 232 vflg = 1; 233 break; 234 case '?': 235 default: 236 usage(); 237 } 238 239 kdriver_init(); 240 241 if (*(argv += optind)) { 242 for (; *argv; ++argv) { 243 if (getfname(*argv)) 244 checkfile = 1; 245 } 246 if (!checkfile) /* file(s) specified, but none accessible */ 247 exit(1); 248 } 249 250 ALLOC_OFILES(256); /* reserve space for file pointers */ 251 252 if (fsflg && !checkfile) { 253 /* -f with no files means use wd */ 254 if (getfname(".") == 0) 255 exit(1); 256 checkfile = 1; 257 } 258 259 /* 260 * Discard setgid privileges. If not the running kernel, we toss 261 * them away totally so that bad guys can't print interesting stuff 262 * from kernel memory, otherwise switch back to kmem for the 263 * duration of the kvm_openfiles() call. 264 */ 265 if (nlistf != NULL || memf != NULL) 266 (void)setgid(getgid()); 267 else 268 (void)setegid(egid); 269 270 if ((kd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY, buf)) == NULL) 271 errx(1, "%s", buf); 272 273 /* get rid of it now anyway */ 274 if (nlistf == NULL && memf == NULL) 275 (void)setgid(getgid()); 276 277 if ((p = kvm_getproc2(kd, what, arg, sizeof *p, &cnt)) == NULL) { 278 errx(1, "%s", kvm_geterr(kd)); 279 } 280 if (nflg) 281 (void)printf("%s", 282 "USER CMD PID FD DEV INUM MODE SZ|DV R/W"); 283 else 284 (void)printf("%s", 285 "USER CMD PID FD MOUNT INUM MODE SZ|DV R/W"); 286 if (checkfile && fsflg == 0) 287 (void)printf(" NAME\n"); 288 else 289 (void)putchar('\n'); 290 291 for (plast = &p[cnt]; p < plast; ++p) { 292 if (p->p_stat == SZOMB) 293 continue; 294 dofiles(p); 295 } 296 return 0; 297 } 298 299 static const char *Uname, *Comm; 300 pid_t Pid; 301 302 #define PREFIX(i) (void)printf("%-8.8s %-10s %5d", Uname, Comm, Pid); \ 303 switch(i) { \ 304 case TEXT: \ 305 (void)printf(" text"); \ 306 break; \ 307 case CDIR: \ 308 (void)printf(" wd"); \ 309 break; \ 310 case RDIR: \ 311 (void)printf(" root"); \ 312 break; \ 313 case TRACE: \ 314 (void)printf(" tr"); \ 315 break; \ 316 default: \ 317 (void)printf(" %4d", i); \ 318 break; \ 319 } 320 321 static struct kinfo_drivers *kdriver; 322 static size_t kdriverlen; 323 324 static int 325 kdriver_comp(const void *a, const void *b) 326 { 327 const struct kinfo_drivers *ka = a; 328 const struct kinfo_drivers *kb = b; 329 int kac = ka->d_cmajor == -1 ? 0 : ka->d_cmajor; 330 int kbc = kb->d_cmajor == -1 ? 0 : kb->d_cmajor; 331 int kab = ka->d_bmajor == -1 ? 0 : ka->d_bmajor; 332 int kbb = kb->d_bmajor == -1 ? 0 : kb->d_bmajor; 333 int c = kac - kbc; 334 if (c == 0) 335 return kab - kbb; 336 else 337 return c; 338 } 339 340 static const char * 341 kdriver_search(int type, dev_t num) 342 { 343 struct kinfo_drivers k, *kp; 344 static char buf[64]; 345 346 if (nflg) 347 goto out; 348 349 if (type == VBLK) { 350 k.d_bmajor = num; 351 k.d_cmajor = -1; 352 } else { 353 k.d_bmajor = -1; 354 k.d_cmajor = num; 355 } 356 kp = bsearch(&k, kdriver, kdriverlen, sizeof(*kdriver), kdriver_comp); 357 if (kp) 358 return kp->d_name; 359 out: 360 snprintf(buf, sizeof(buf), "%llu", (unsigned long long)num); 361 return buf; 362 } 363 364 365 static void 366 kdriver_init(void) 367 { 368 size_t sz; 369 int error; 370 static const int name[2] = { CTL_KERN, KERN_DRIVERS }; 371 372 error = sysctl(name, __arraycount(name), NULL, &sz, NULL, 0); 373 if (error == -1) { 374 warn("sysctl kern.drivers"); 375 return; 376 } 377 378 if (sz % sizeof(*kdriver)) { 379 warnx("bad size %zu for kern.drivers", sz); 380 return; 381 } 382 383 kdriver = malloc(sz); 384 if (kdriver == NULL) { 385 warn("malloc"); 386 return; 387 } 388 389 error = sysctl(name, __arraycount(name), kdriver, &sz, NULL, 0); 390 if (error == -1) { 391 warn("sysctl kern.drivers"); 392 return; 393 } 394 395 kdriverlen = sz / sizeof(*kdriver); 396 qsort(kdriver, kdriverlen, sizeof(*kdriver), kdriver_comp); 397 #ifdef DEBUG 398 for (size_t i = 0; i < kdriverlen; i++) 399 printf("%d %d %s\n", kdriver[i].d_cmajor, kdriver[i].d_bmajor, 400 kdriver[i].d_name); 401 #endif 402 } 403 404 /* 405 * print open files attributed to this process 406 */ 407 static void 408 dofiles(struct kinfo_proc2 *p) 409 { 410 int i; 411 struct filedesc filed; 412 struct cwdinfo cwdi; 413 struct fdtab dt; 414 415 Uname = user_from_uid(p->p_uid, 0); 416 Pid = p->p_pid; 417 Comm = p->p_comm; 418 419 if (p->p_fd == 0 || p->p_cwdi == 0) 420 return; 421 if (!KVM_READ(p->p_fd, &filed, sizeof (filed))) { 422 warnx("can't read filedesc at %p for pid %d", 423 (void *)(uintptr_t)p->p_fd, Pid); 424 return; 425 } 426 if (filed.fd_lastfile == -1) 427 return; 428 if (!KVM_READ(p->p_cwdi, &cwdi, sizeof(cwdi))) { 429 warnx("can't read cwdinfo at %p for pid %d", 430 (void *)(uintptr_t)p->p_cwdi, Pid); 431 return; 432 } 433 if (!KVM_READ(filed.fd_dt, &dt, sizeof(dt))) { 434 warnx("can't read dtab at %p for pid %d", filed.fd_dt, Pid); 435 return; 436 } 437 if ((unsigned)filed.fd_lastfile >= dt.dt_nfiles || 438 filed.fd_freefile > filed.fd_lastfile + 1) { 439 dprintf("filedesc corrupted at %p for pid %d", 440 (void *)(uintptr_t)p->p_fd, Pid); 441 return; 442 } 443 /* 444 * root directory vnode, if one 445 */ 446 if (cwdi.cwdi_rdir) 447 vtrans(cwdi.cwdi_rdir, RDIR, FREAD); 448 /* 449 * current working directory vnode 450 */ 451 vtrans(cwdi.cwdi_cdir, CDIR, FREAD); 452 #if 0 453 /* 454 * Disable for now, since p->p_tracep appears to point to a ktr_desc * 455 * ktrace vnode, if one 456 */ 457 if (p->p_tracep) 458 ftrans(p->p_tracep, TRACE); 459 #endif 460 /* 461 * open files 462 */ 463 #define FPSIZE (sizeof (fdfile_t *)) 464 ALLOC_OFILES(filed.fd_lastfile+1); 465 if (!KVM_READ(&filed.fd_dt->dt_ff, ofiles, 466 (filed.fd_lastfile+1) * FPSIZE)) { 467 dprintf("can't read file structures at %p for pid %d", 468 &filed.fd_dt->dt_ff, Pid); 469 return; 470 } 471 for (i = 0; i <= filed.fd_lastfile; i++) { 472 if (ofiles[i] == NULL) 473 continue; 474 ftrans(ofiles[i], i); 475 } 476 } 477 478 static void 479 ftrans(fdfile_t *fp, int i) 480 { 481 struct file file; 482 fdfile_t fdfile; 483 484 if (!KVM_READ(fp, &fdfile, sizeof(fdfile))) { 485 dprintf("can't read file %d at %p for pid %d", 486 i, fp, Pid); 487 return; 488 } 489 if (fdfile.ff_file == NULL) { 490 dprintf("null ff_file for %d at %p for pid %d", 491 i, fp, Pid); 492 return; 493 } 494 if (!KVM_READ(fdfile.ff_file, &file, sizeof(file))) { 495 dprintf("can't read file %d at %p for pid %d", 496 i, fdfile.ff_file, Pid); 497 return; 498 } 499 switch (file.f_type) { 500 case DTYPE_VNODE: 501 vtrans(file.f_data, i, file.f_flag); 502 break; 503 case DTYPE_SOCKET: 504 if (checkfile == 0) 505 socktrans(file.f_data, i); 506 break; 507 case DTYPE_PIPE: 508 if (checkfile == 0) 509 ptrans(&file, file.f_data, i); 510 break; 511 case DTYPE_MISC: 512 case DTYPE_KQUEUE: 513 case DTYPE_CRYPTO: 514 case DTYPE_MQUEUE: 515 case DTYPE_SEM: 516 if (checkfile == 0) 517 misctrans(&file, i); 518 break; 519 default: 520 dprintf("unknown file type %d for file %d of pid %d", 521 file.f_type, i, Pid); 522 break; 523 } 524 } 525 526 static const char dead[] = "dead"; 527 528 static const char * 529 vfilestat(struct vnode *vp, struct filestat *fsp) 530 { 531 const char *badtype = NULL; 532 533 if (vp->v_type == VNON) 534 badtype = "none"; 535 else if (vp->v_type == VBAD) 536 badtype = "bad"; 537 else 538 switch (vp->v_tag) { 539 case VT_NON: 540 badtype = dead; 541 break; 542 case VT_UFS: 543 case VT_LFS: 544 case VT_MFS: 545 if (!ufs_filestat(vp, fsp)) 546 badtype = "error"; 547 break; 548 case VT_MSDOSFS: 549 if (!msdosfs_filestat(vp, fsp)) 550 badtype = "error"; 551 break; 552 case VT_NFS: 553 if (!nfs_filestat(vp, fsp)) 554 badtype = "error"; 555 break; 556 case VT_EXT2FS: 557 if (!ext2fs_filestat(vp, fsp)) 558 badtype = "error"; 559 break; 560 case VT_ISOFS: 561 if (!isofs_filestat(vp, fsp)) 562 badtype = "error"; 563 break; 564 case VT_NTFS: 565 if (!ntfs_filestat(vp, fsp)) 566 badtype = "error"; 567 break; 568 case VT_PTYFS: 569 if (!ptyfs_filestat(vp, fsp)) 570 badtype = "error"; 571 break; 572 case VT_TMPFS: 573 if (!tmpfs_filestat(vp, fsp)) 574 badtype = "error"; 575 break; 576 case VT_NULL: 577 case VT_OVERLAY: 578 case VT_UMAP: 579 badtype = layer_filestat(vp, fsp); 580 break; 581 default: { 582 static char unknown[10]; 583 (void)snprintf(unknown, sizeof unknown, 584 "?(%x)", vp->v_tag); 585 badtype = unknown; 586 break; 587 } 588 } 589 return badtype; 590 } 591 592 static void 593 vtrans(struct vnode *vp, int i, int flag) 594 { 595 struct vnode vn; 596 struct filestat fst; 597 char mode[15], rw[3]; 598 const char *badtype, *filename; 599 600 filename = NULL; 601 if (!KVM_READ(vp, &vn, sizeof(struct vnode))) { 602 dprintf("can't read vnode at %p for pid %d", vp, Pid); 603 return; 604 } 605 badtype = vfilestat(&vn, &fst); 606 if (checkfile) { 607 int fsmatch = 0; 608 DEVS *d; 609 610 if (badtype && badtype != dead) 611 return; 612 for (d = devs; d != NULL; d = d->next) 613 if (d->fsid == fst.fsid) { 614 fsmatch = 1; 615 if (d->ino == fst.fileid) { 616 filename = d->name; 617 break; 618 } 619 } 620 if (fsmatch == 0 || (filename == NULL && fsflg == 0)) 621 return; 622 } 623 PREFIX(i); 624 if (badtype == dead) { 625 char buf[1024]; 626 (void)snprintb(buf, sizeof(buf), VNODE_FLAGBITS, 627 vn.v_iflag | vn.v_vflag | vn.v_uflag); 628 (void)printf(" flags %s\n", buf); 629 return; 630 } else if (badtype) { 631 (void)printf(" - - %10s -\n", badtype); 632 return; 633 } 634 if (nflg) 635 (void)printf(" %2llu,%-2llu", 636 (unsigned long long)major(fst.fsid), 637 (unsigned long long)minor(fst.fsid)); 638 else 639 (void)printf(" %-8s", getmnton(vn.v_mount)); 640 if (nflg) 641 (void)snprintf(mode, sizeof mode, "%o", fst.mode); 642 else 643 strmode(fst.mode, mode); 644 (void)printf(" %7"PRIu64" %*s", fst.fileid, nflg ? 5 : 10, mode); 645 switch (vn.v_type) { 646 case VBLK: 647 case VCHR: { 648 char *name; 649 650 if (nflg || ((name = devname(fst.rdev, vn.v_type == VCHR ? 651 S_IFCHR : S_IFBLK)) == NULL)) 652 (void)printf(" %s,%-2llu", 653 kdriver_search(vn.v_type, major(fst.rdev)), 654 (unsigned long long)minor(fst.rdev)); 655 else 656 (void)printf(" %6s", name); 657 break; 658 } 659 default: 660 (void)printf(" %6lld", (long long)fst.size); 661 } 662 rw[0] = '\0'; 663 if (flag & FREAD) 664 (void)strlcat(rw, "r", sizeof(rw)); 665 if (flag & FWRITE) 666 (void)strlcat(rw, "w", sizeof(rw)); 667 (void)printf(" %-2s", rw); 668 if (filename && !fsflg) 669 (void)printf(" %s", filename); 670 (void)putchar('\n'); 671 } 672 673 static int 674 ufs_filestat(struct vnode *vp, struct filestat *fsp) 675 { 676 struct inode inode; 677 struct ufsmount ufsmount; 678 union dinode { 679 struct ufs1_dinode dp1; 680 struct ufs2_dinode dp2; 681 } dip; 682 683 if (!KVM_READ(VTOI(vp), &inode, sizeof (inode))) { 684 dprintf("can't read inode at %p for pid %d", VTOI(vp), Pid); 685 return 0; 686 } 687 688 if (!KVM_READ(inode.i_ump, &ufsmount, sizeof (struct ufsmount))) { 689 dprintf("can't read ufsmount at %p for pid %d", inode.i_ump, Pid); 690 return 0; 691 } 692 693 switch (ufsmount.um_fstype) { 694 case UFS1: 695 if (!KVM_READ(inode.i_din.ffs1_din, &dip, 696 sizeof(struct ufs1_dinode))) { 697 dprintf("can't read dinode at %p for pid %d", 698 inode.i_din.ffs1_din, Pid); 699 return 0; 700 } 701 fsp->rdev = dip.dp1.di_rdev; 702 break; 703 case UFS2: 704 if (!KVM_READ(inode.i_din.ffs2_din, &dip, 705 sizeof(struct ufs2_dinode))) { 706 dprintf("can't read dinode at %p for pid %d", 707 inode.i_din.ffs2_din, Pid); 708 return 0; 709 } 710 fsp->rdev = dip.dp2.di_rdev; 711 break; 712 default: 713 dprintf("unknown ufs type %ld for pid %d", 714 ufsmount.um_fstype, Pid); 715 break; 716 } 717 fsp->fsid = inode.i_dev & 0xffff; 718 fsp->fileid = inode.i_number; 719 fsp->mode = (mode_t)inode.i_mode; 720 fsp->size = inode.i_size; 721 722 return 1; 723 } 724 725 static int 726 ext2fs_filestat(struct vnode *vp, struct filestat *fsp) 727 { 728 struct inode inode; 729 struct ext2fs_dinode dinode; 730 731 if (!KVM_READ(VTOI(vp), &inode, sizeof (inode))) { 732 dprintf("can't read inode at %p for pid %d", VTOI(vp), Pid); 733 return 0; 734 } 735 fsp->fsid = inode.i_dev & 0xffff; 736 fsp->fileid = inode.i_number; 737 738 if (!KVM_READ(inode.i_din.e2fs_din, &dinode, sizeof dinode)) { 739 dprintf("can't read ext2fs_dinode at %p for pid %d", 740 inode.i_din.e2fs_din, Pid); 741 return 0; 742 } 743 fsp->mode = dinode.e2di_mode; 744 fsp->size = dinode.e2di_size; 745 fsp->rdev = dinode.e2di_rdev; 746 747 return 1; 748 } 749 750 static int 751 nfs_filestat(struct vnode *vp, struct filestat *fsp) 752 { 753 struct nfsnode nfsnode; 754 struct vattr va; 755 756 if (!KVM_READ(VTONFS(vp), &nfsnode, sizeof (nfsnode))) { 757 dprintf("can't read nfsnode at %p for pid %d", VTONFS(vp), 758 Pid); 759 return 0; 760 } 761 if (!KVM_READ(nfsnode.n_vattr, &va, sizeof(va))) { 762 dprintf("can't read vnode attributes at %p for pid %d", 763 nfsnode.n_vattr, Pid); 764 return 0; 765 } 766 fsp->fsid = va.va_fsid; 767 fsp->fileid = va.va_fileid; 768 fsp->size = nfsnode.n_size; 769 fsp->rdev = va.va_rdev; 770 fsp->mode = (mode_t)va.va_mode | getftype(vp->v_type); 771 772 return 1; 773 } 774 775 static int 776 msdosfs_filestat(struct vnode *vp, struct filestat *fsp) 777 { 778 struct denode de; 779 struct msdosfsmount mp; 780 781 if (!KVM_READ(VTONFS(vp), &de, sizeof(de))) { 782 dprintf("can't read denode at %p for pid %d", VTONFS(vp), 783 Pid); 784 return 0; 785 } 786 if (!KVM_READ(de.de_pmp, &mp, sizeof(mp))) { 787 dprintf("can't read mount struct at %p for pid %d", de.de_pmp, 788 Pid); 789 return 0; 790 } 791 792 fsp->fsid = de.de_dev & 0xffff; 793 fsp->fileid = 0; /* XXX see msdosfs_vptofh() for more info */ 794 fsp->size = de.de_FileSize; 795 fsp->rdev = 0; /* msdosfs doesn't support device files */ 796 fsp->mode = (0777 & mp.pm_mask) | getftype(vp->v_type); 797 return 1; 798 } 799 800 static const char * 801 layer_filestat(struct vnode *vp, struct filestat *fsp) 802 { 803 struct layer_node layer_node; 804 struct mount mount; 805 struct vnode vn; 806 const char *badtype; 807 808 if (!KVM_READ(VTOLAYER(vp), &layer_node, sizeof(layer_node))) { 809 dprintf("can't read layer_node at %p for pid %d", 810 VTOLAYER(vp), Pid); 811 return "error"; 812 } 813 if (!KVM_READ(vp->v_mount, &mount, sizeof(struct mount))) { 814 dprintf("can't read mount struct at %p for pid %d", 815 vp->v_mount, Pid); 816 return "error"; 817 } 818 vp = layer_node.layer_lowervp; 819 if (!KVM_READ(vp, &vn, sizeof(struct vnode))) { 820 dprintf("can't read vnode at %p for pid %d", vp, Pid); 821 return "error"; 822 } 823 if ((badtype = vfilestat(&vn, fsp)) == NULL) 824 fsp->fsid = mount.mnt_stat.f_fsidx.__fsid_val[0]; 825 return badtype; 826 } 827 828 static char * 829 getmnton(struct mount *m) 830 { 831 static struct mount mount; 832 static struct mtab { 833 struct mtab *next; 834 struct mount *m; 835 char mntonname[MNAMELEN]; 836 } *mhead = NULL; 837 struct mtab *mt; 838 839 for (mt = mhead; mt != NULL; mt = mt->next) 840 if (m == mt->m) 841 return mt->mntonname; 842 if (!KVM_READ(m, &mount, sizeof(struct mount))) { 843 warnx("can't read mount table at %p", m); 844 return NULL; 845 } 846 if ((mt = malloc(sizeof (struct mtab))) == NULL) { 847 err(1, "malloc(%u)", (unsigned int)sizeof(struct mtab)); 848 } 849 mt->m = m; 850 (void)memmove(&mt->mntonname[0], &mount.mnt_stat.f_mntonname[0], 851 MNAMELEN); 852 mt->next = mhead; 853 mhead = mt; 854 return mt->mntonname; 855 } 856 857 static const char * 858 inet_addrstr(char *buf, size_t len, const struct in_addr *a, uint16_t p) 859 { 860 char addr[256], serv[256]; 861 struct sockaddr_in sin; 862 const int niflags = nflg ? (NI_NUMERICHOST|NI_NUMERICSERV) : 0; 863 864 (void)memset(&sin, 0, sizeof(sin)); 865 sin.sin_family = AF_INET; 866 sin.sin_len = sizeof(sin); 867 sin.sin_addr = *a; 868 sin.sin_port = htons(p); 869 870 serv[0] = '\0'; 871 872 if (getnameinfo((struct sockaddr *)&sin, sin.sin_len, 873 addr, sizeof(addr), serv, sizeof(serv), niflags)) { 874 if (inet_ntop(AF_INET, a, addr, sizeof(addr)) == NULL) 875 strlcpy(addr, "invalid", sizeof(addr)); 876 } 877 878 if (serv[0] == '\0') 879 snprintf(serv, sizeof(serv), "%u", p); 880 881 if (a->s_addr == INADDR_ANY) { 882 if (p == 0) 883 buf[0] = '\0'; 884 else 885 snprintf(buf, len, "*:%s", serv); 886 return buf; 887 } 888 889 snprintf(buf, len, "%s:%s", addr, serv); 890 return buf; 891 } 892 893 #ifdef INET6 894 static const char * 895 inet6_addrstr(char *buf, size_t len, const struct in6_addr *a, uint16_t p) 896 { 897 char addr[256], serv[256]; 898 struct sockaddr_in6 sin6; 899 const int niflags = nflg ? (NI_NUMERICHOST|NI_NUMERICSERV) : 0; 900 901 (void)memset(&sin6, 0, sizeof(sin6)); 902 sin6.sin6_family = AF_INET6; 903 sin6.sin6_len = sizeof(sin6); 904 sin6.sin6_addr = *a; 905 sin6.sin6_port = htons(p); 906 907 inet6_putscopeid(&sin6, 1); 908 serv[0] = '\0'; 909 910 if (getnameinfo((struct sockaddr *)&sin6, sin6.sin6_len, 911 addr, sizeof(addr), serv, sizeof(serv), niflags)) { 912 if (inet_ntop(AF_INET6, a, addr, sizeof(addr)) == NULL) 913 strlcpy(addr, "invalid", sizeof(addr)); 914 } 915 916 if (serv[0] == '\0') 917 snprintf(serv, sizeof(serv), "%u", p); 918 919 if (IN6_IS_ADDR_UNSPECIFIED(a)) { 920 if (p == 0) 921 buf[0] = '\0'; 922 else 923 snprintf(buf, len, "*:%s", serv); 924 return buf; 925 } 926 927 if (strchr(addr, ':') == NULL) 928 snprintf(buf, len, "%s:%s", addr, serv); 929 else 930 snprintf(buf, len, "[%s]:%s", addr, serv); 931 932 return buf; 933 } 934 #endif 935 936 static const char * 937 at_addrstr(char *buf, size_t len, const struct sockaddr_at *sat) 938 { 939 const struct netrange *nr = &sat->sat_range.r_netrange; 940 const struct at_addr *at = &sat->sat_addr; 941 char addr[64], phase[64], range[64]; 942 943 if (sat->sat_port || at->s_net || at->s_node) { 944 if (at->s_net || at->s_node) 945 snprintf(addr, sizeof(addr), "%u.%u:%u", 946 ntohs(at->s_net), at->s_node, sat->sat_port); 947 else 948 snprintf(addr, sizeof(addr), "*:%u", sat->sat_port); 949 } else 950 addr[0] = '\0'; 951 952 if (nr->nr_phase) 953 snprintf(phase, sizeof(phase), " phase %u", nr->nr_phase); 954 else 955 phase[0] = '\0'; 956 957 if (nr->nr_firstnet || nr->nr_lastnet) 958 snprintf(range, sizeof(range), " range [%u-%u]", 959 ntohs(nr->nr_firstnet), ntohs(nr->nr_lastnet)); 960 else 961 range[0] = '\0'; 962 963 snprintf(buf, len, "%s%s%s", addr, phase, range); 964 return buf; 965 } 966 967 static void 968 socktrans(struct socket *sock, int i) 969 { 970 static const char *stypename[] = { 971 "unused", /* 0 */ 972 "stream", /* 1 */ 973 "dgram", /* 2 */ 974 "raw", /* 3 */ 975 "rdm", /* 4 */ 976 "seqpak" /* 5 */ 977 }; 978 #define STYPEMAX 5 979 struct socket so; 980 struct protosw proto; 981 struct domain dom; 982 struct inpcb inpcb; 983 #ifdef INET6 984 struct in6pcb in6pcb; 985 #endif 986 struct unpcb unpcb; 987 struct ddpcb ddpcb; 988 int len; 989 char dname[32]; 990 char lbuf[512], fbuf[512]; 991 PREFIX(i); 992 993 /* fill in socket */ 994 if (!KVM_READ(sock, &so, sizeof(struct socket))) { 995 dprintf("can't read sock at %p", sock); 996 goto bad; 997 } 998 999 /* fill in protosw entry */ 1000 if (!KVM_READ(so.so_proto, &proto, sizeof(struct protosw))) { 1001 dprintf("can't read protosw at %p", so.so_proto); 1002 goto bad; 1003 } 1004 1005 /* fill in domain */ 1006 if (!KVM_READ(proto.pr_domain, &dom, sizeof(struct domain))) { 1007 dprintf("can't read domain at %p", proto.pr_domain); 1008 goto bad; 1009 } 1010 1011 if ((len = kvm_read(kd, (u_long)dom.dom_name, dname, 1012 sizeof(dname) - 1)) != sizeof(dname) -1) { 1013 dprintf("can't read domain name at %p", dom.dom_name); 1014 dname[0] = '\0'; 1015 } 1016 else 1017 dname[len] = '\0'; 1018 1019 if ((u_short)so.so_type > STYPEMAX) 1020 (void)printf("* %s ?%d", dname, so.so_type); 1021 else 1022 (void)printf("* %s %s", dname, stypename[so.so_type]); 1023 1024 /* 1025 * protocol specific formatting 1026 * 1027 * Try to find interesting things to print. For TCP, the interesting 1028 * thing is the address of the tcpcb, for UDP and others, just the 1029 * inpcb (socket pcb). For UNIX domain, its the address of the socket 1030 * pcb and the address of the connected pcb (if connected). Otherwise 1031 * just print the protocol number and address of the socket itself. 1032 * The idea is not to duplicate netstat, but to make available enough 1033 * information for further analysis. 1034 */ 1035 fbuf[0] = '\0'; 1036 lbuf[0] = '\0'; 1037 switch(dom.dom_family) { 1038 case AF_INET: 1039 getinetproto(proto.pr_protocol); 1040 switch (proto.pr_protocol) { 1041 case IPPROTO_TCP: 1042 case IPPROTO_UDP: 1043 if (so.so_pcb == NULL) 1044 break; 1045 if (kvm_read(kd, (u_long)so.so_pcb, (char *)&inpcb, 1046 sizeof(inpcb)) != sizeof(inpcb)) { 1047 dprintf("can't read inpcb at %p", so.so_pcb); 1048 goto bad; 1049 } 1050 inet_addrstr(lbuf, sizeof(lbuf), &inpcb.inp_laddr, 1051 ntohs(inpcb.inp_lport)); 1052 inet_addrstr(fbuf, sizeof(fbuf), &inpcb.inp_faddr, 1053 ntohs(inpcb.inp_fport)); 1054 break; 1055 default: 1056 break; 1057 } 1058 break; 1059 #ifdef INET6 1060 case AF_INET6: 1061 getinetproto(proto.pr_protocol); 1062 switch (proto.pr_protocol) { 1063 case IPPROTO_TCP: 1064 case IPPROTO_UDP: 1065 if (so.so_pcb == NULL) 1066 break; 1067 if (kvm_read(kd, (u_long)so.so_pcb, (char *)&in6pcb, 1068 sizeof(in6pcb)) != sizeof(in6pcb)) { 1069 dprintf("can't read in6pcb at %p", so.so_pcb); 1070 goto bad; 1071 } 1072 inet6_addrstr(lbuf, sizeof(lbuf), &in6pcb.in6p_laddr, 1073 ntohs(in6pcb.in6p_lport)); 1074 inet6_addrstr(fbuf, sizeof(fbuf), &in6pcb.in6p_faddr, 1075 ntohs(in6pcb.in6p_fport)); 1076 break; 1077 default: 1078 break; 1079 } 1080 break; 1081 #endif 1082 case AF_LOCAL: 1083 /* print address of pcb and connected pcb */ 1084 if (so.so_pcb) { 1085 char shoconn[4], *cp; 1086 void *pcb[2]; 1087 size_t p = 0; 1088 1089 pcb[0] = so.so_pcb; 1090 1091 cp = shoconn; 1092 if (!(so.so_state & SS_CANTRCVMORE)) 1093 *cp++ = '<'; 1094 *cp++ = '-'; 1095 if (!(so.so_state & SS_CANTSENDMORE)) 1096 *cp++ = '>'; 1097 *cp = '\0'; 1098 again: 1099 if (kvm_read(kd, (u_long)pcb[p], (char *)&unpcb, 1100 sizeof(struct unpcb)) != sizeof(struct unpcb)){ 1101 dprintf("can't read unpcb at %p", so.so_pcb); 1102 goto bad; 1103 } 1104 1105 if (unpcb.unp_addr) { 1106 struct sockaddr_un *sun = 1107 malloc(unpcb.unp_addrlen); 1108 if (sun == NULL) 1109 err(1, "malloc(%zu)", 1110 unpcb.unp_addrlen); 1111 if (kvm_read(kd, (u_long)unpcb.unp_addr, 1112 sun, unpcb.unp_addrlen) != 1113 (ssize_t)unpcb.unp_addrlen) { 1114 dprintf("can't read sun at %p", 1115 unpcb.unp_addr); 1116 free(sun); 1117 } else { 1118 snprintf(fbuf, sizeof(fbuf), " %s %s %s", 1119 shoconn, sun->sun_path, 1120 p == 0 ? "[creat]" : "[using]"); 1121 free(sun); 1122 break; 1123 } 1124 } 1125 if (unpcb.unp_conn) { 1126 if (p == 0) { 1127 pcb[++p] = unpcb.unp_conn; 1128 goto again; 1129 } else 1130 snprintf(fbuf, sizeof(fbuf), 1131 " %p %s %p", pcb[0], shoconn, 1132 pcb[1]); 1133 } 1134 } 1135 break; 1136 case AF_APPLETALK: 1137 getatproto(proto.pr_protocol); 1138 if (so.so_pcb) { 1139 if (kvm_read(kd, (u_long)so.so_pcb, (char *)&ddpcb, 1140 sizeof(ddpcb)) != sizeof(ddpcb)){ 1141 dprintf("can't read ddpcb at %p", so.so_pcb); 1142 goto bad; 1143 } 1144 at_addrstr(fbuf, sizeof(fbuf), &ddpcb.ddp_fsat); 1145 at_addrstr(lbuf, sizeof(lbuf), &ddpcb.ddp_lsat); 1146 } 1147 break; 1148 default: 1149 /* print protocol number and socket address */ 1150 snprintf(fbuf, sizeof(fbuf), " %d %jx", proto.pr_protocol, 1151 (uintmax_t)(uintptr_t)sock); 1152 break; 1153 } 1154 if (fbuf[0] || lbuf[0]) 1155 printf(" %s%s%s", fbuf, (fbuf[0] && lbuf[0]) ? " <-> " : "", 1156 lbuf); 1157 else if (so.so_pcb) 1158 printf(" %jx", (uintmax_t)(uintptr_t)so.so_pcb); 1159 (void)printf("\n"); 1160 return; 1161 bad: 1162 (void)printf("* error\n"); 1163 } 1164 1165 static void 1166 ptrans(struct file *fp, struct pipe *cpipe, int i) 1167 { 1168 struct pipe cp; 1169 1170 PREFIX(i); 1171 1172 /* fill in pipe */ 1173 if (!KVM_READ(cpipe, &cp, sizeof(struct pipe))) { 1174 dprintf("can't read pipe at %p", cpipe); 1175 goto bad; 1176 } 1177 1178 /* pipe descriptor is either read or write, never both */ 1179 (void)printf("* pipe %p %s %p %s%s%s", cpipe, 1180 (fp->f_flag & FWRITE) ? "->" : "<-", 1181 cp.pipe_peer, 1182 (fp->f_flag & FWRITE) ? "w" : "r", 1183 (fp->f_flag & FNONBLOCK) ? "n" : "", 1184 (cp.pipe_state & PIPE_ASYNC) ? "a" : ""); 1185 (void)printf("\n"); 1186 return; 1187 bad: 1188 (void)printf("* error\n"); 1189 } 1190 1191 static void 1192 misctrans(struct file *file, int i) 1193 { 1194 1195 PREFIX(i); 1196 pmisc(file, dtypes[file->f_type]); 1197 } 1198 1199 /* 1200 * getinetproto -- 1201 * print name of protocol number 1202 */ 1203 static void 1204 getinetproto(int number) 1205 { 1206 const char *cp; 1207 1208 switch (number) { 1209 case IPPROTO_IP: 1210 cp = "ip"; break; 1211 case IPPROTO_ICMP: 1212 cp ="icmp"; break; 1213 case IPPROTO_GGP: 1214 cp ="ggp"; break; 1215 case IPPROTO_TCP: 1216 cp ="tcp"; break; 1217 case IPPROTO_EGP: 1218 cp ="egp"; break; 1219 case IPPROTO_PUP: 1220 cp ="pup"; break; 1221 case IPPROTO_UDP: 1222 cp ="udp"; break; 1223 case IPPROTO_IDP: 1224 cp ="idp"; break; 1225 case IPPROTO_RAW: 1226 cp ="raw"; break; 1227 case IPPROTO_ICMPV6: 1228 cp ="icmp6"; break; 1229 default: 1230 (void)printf(" %d", number); 1231 return; 1232 } 1233 (void)printf(" %s", cp); 1234 } 1235 1236 /* 1237 * getatproto -- 1238 * print name of protocol number 1239 */ 1240 static void 1241 getatproto(int number) 1242 { 1243 const char *cp; 1244 1245 switch (number) { 1246 case ATPROTO_DDP: 1247 cp = "ddp"; break; 1248 case ATPROTO_AARP: 1249 cp ="aarp"; break; 1250 default: 1251 (void)printf(" %d", number); 1252 return; 1253 } 1254 (void)printf(" %s", cp); 1255 } 1256 1257 static int 1258 getfname(const char *filename) 1259 { 1260 struct stat statbuf; 1261 DEVS *cur; 1262 1263 if (stat(filename, &statbuf)) { 1264 warn("stat(%s)", filename); 1265 return 0; 1266 } 1267 if ((cur = malloc(sizeof(*cur))) == NULL) { 1268 err(1, "malloc(%zu)", sizeof(*cur)); 1269 } 1270 cur->next = devs; 1271 devs = cur; 1272 1273 cur->ino = statbuf.st_ino; 1274 cur->fsid = statbuf.st_dev & 0xffff; 1275 cur->name = filename; 1276 return 1; 1277 } 1278 1279 mode_t 1280 getftype(enum vtype v_type) 1281 { 1282 mode_t ftype; 1283 1284 switch (v_type) { 1285 case VREG: 1286 ftype = S_IFREG; 1287 break; 1288 case VDIR: 1289 ftype = S_IFDIR; 1290 break; 1291 case VBLK: 1292 ftype = S_IFBLK; 1293 break; 1294 case VCHR: 1295 ftype = S_IFCHR; 1296 break; 1297 case VLNK: 1298 ftype = S_IFLNK; 1299 break; 1300 case VSOCK: 1301 ftype = S_IFSOCK; 1302 break; 1303 case VFIFO: 1304 ftype = S_IFIFO; 1305 break; 1306 default: 1307 ftype = 0; 1308 break; 1309 }; 1310 1311 return ftype; 1312 } 1313 1314 static void 1315 usage(void) 1316 { 1317 (void)fprintf(stderr, "Usage: %s [-fnv] [-p pid] [-u user] " 1318 "[-N system] [-M core] [file ...]\n", getprogname()); 1319 exit(1); 1320 } 1321
Indexes created Sun Sep 21 14:09:52 GMT 2025