fstat.c revision 1.15 1 /*-
2 * Copyright (c) 1988, 1993
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by the University of
16 * California, Berkeley and its contributors.
17 * 4. Neither the name of the University nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #ifndef lint
35 static char copyright[] =
36 "@(#) Copyright (c) 1988, 1993\n\
37 The Regents of the University of California. All rights reserved.\n";
38 #endif /* not lint */
39
40 #ifndef lint
41 /*static char sccsid[] = "from: @(#)fstat.c 8.3 (Berkeley) 5/2/95;*/
42 static char *rcsid = "$Id: fstat.c,v 1.15 1996/02/20 16:04:47 fvdl Exp $";
43 #endif /* not lint */
44
45 #include <sys/param.h>
46 #include <sys/time.h>
47 #include <sys/proc.h>
48 #include <sys/user.h>
49 #include <sys/stat.h>
50 #include <sys/vnode.h>
51 #include <sys/socket.h>
52 #include <sys/socketvar.h>
53 #include <sys/domain.h>
54 #include <sys/protosw.h>
55 #include <sys/unpcb.h>
56 #include <sys/sysctl.h>
57 #include <sys/filedesc.h>
58 #define _KERNEL
59 #include <sys/file.h>
60 #include <ufs/ufs/quota.h>
61 #include <ufs/ufs/inode.h>
62 #undef _KERNEL
63 #define NFS
64 #include <sys/mount.h>
65 #include <nfs/nfsproto.h>
66 #include <nfs/rpcv2.h>
67 #include <nfs/nfs.h>
68 #include <nfs/nfsnode.h>
69 #undef NFS
70
71 #include <net/route.h>
72 #include <netinet/in.h>
73 #include <netinet/in_systm.h>
74 #include <netinet/ip.h>
75 #include <netinet/in_pcb.h>
76
77 #include <ctype.h>
78 #include <errno.h>
79 #include <kvm.h>
80 #include <limits.h>
81 #include <nlist.h>
82 #include <paths.h>
83 #include <pwd.h>
84 #include <stdio.h>
85 #include <stdlib.h>
86 #include <string.h>
87
88 #define TEXT -1
89 #define CDIR -2
90 #define RDIR -3
91 #define TRACE -4
92
93 typedef struct devs {
94 struct devs *next;
95 long fsid;
96 ino_t ino;
97 char *name;
98 } DEVS;
99 DEVS *devs;
100
101 struct filestat {
102 long fsid;
103 long fileid;
104 mode_t mode;
105 u_long size;
106 dev_t rdev;
107 };
108
109 #ifdef notdef
110 struct nlist nl[] = {
111 { "" },
112 };
113 #endif
114
115 int fsflg, /* show files on same filesystem as file(s) argument */
116 pflg, /* show files open by a particular pid */
117 uflg; /* show files open by a particular (effective) user */
118 int checkfile; /* true if restricting to particular files or filesystems */
119 int nflg; /* (numerical) display f.s. and rdev as dev_t */
120 int vflg; /* display errors in locating kernel data objects etc... */
121
122 #define dprintf if (vflg) fprintf
123
124 struct file **ofiles; /* buffer of pointers to file structures */
125 int maxfiles;
126 #define ALLOC_OFILES(d) \
127 if ((d) > maxfiles) { \
128 free(ofiles); \
129 ofiles = malloc((d) * sizeof(struct file *)); \
130 if (ofiles == NULL) { \
131 fprintf(stderr, "fstat: %s\n", strerror(errno)); \
132 exit(1); \
133 } \
134 maxfiles = (d); \
135 }
136
137 /*
138 * a kvm_read that returns true if everything is read
139 */
140 #define KVM_READ(kaddr, paddr, len) \
141 (kvm_read(kd, (u_long)(kaddr), (char *)(paddr), (len)) == (len))
142
143 kvm_t *kd;
144
145 int ufs_filestat(), nfs_filestat();
146 void dofiles(), getinetproto(), socktrans();
147 void usage(), vtrans();
148
149 main(argc, argv)
150 int argc;
151 char **argv;
152 {
153 extern char *optarg;
154 extern int optind;
155 register struct passwd *passwd;
156 struct kinfo_proc *p, *plast;
157 int arg, ch, what;
158 char *memf, *nlistf;
159 char buf[_POSIX2_LINE_MAX];
160 int cnt;
161
162 arg = 0;
163 what = KERN_PROC_ALL;
164 nlistf = memf = NULL;
165 while ((ch = getopt(argc, argv, "fnp:u:vNM")) != EOF)
166 switch((char)ch) {
167 case 'f':
168 fsflg = 1;
169 break;
170 case 'M':
171 memf = optarg;
172 break;
173 case 'N':
174 nlistf = optarg;
175 break;
176 case 'n':
177 nflg = 1;
178 break;
179 case 'p':
180 if (pflg++)
181 usage();
182 if (!isdigit(*optarg)) {
183 fprintf(stderr,
184 "fstat: -p requires a process id\n");
185 usage();
186 }
187 what = KERN_PROC_PID;
188 arg = atoi(optarg);
189 break;
190 case 'u':
191 if (uflg++)
192 usage();
193 if (!(passwd = getpwnam(optarg))) {
194 fprintf(stderr, "%s: unknown uid\n",
195 optarg);
196 exit(1);
197 }
198 what = KERN_PROC_UID;
199 arg = passwd->pw_uid;
200 break;
201 case 'v':
202 vflg = 1;
203 break;
204 case '?':
205 default:
206 usage();
207 }
208
209 if (*(argv += optind)) {
210 for (; *argv; ++argv) {
211 if (getfname(*argv))
212 checkfile = 1;
213 }
214 if (!checkfile) /* file(s) specified, but none accessable */
215 exit(1);
216 }
217
218 ALLOC_OFILES(256); /* reserve space for file pointers */
219
220 if (fsflg && !checkfile) {
221 /* -f with no files means use wd */
222 if (getfname(".") == 0)
223 exit(1);
224 checkfile = 1;
225 }
226
227 /*
228 * Discard setgid privileges if not the running kernel so that bad
229 * guys can't print interesting stuff from kernel memory.
230 */
231 if (nlistf != NULL || memf != NULL)
232 setgid(getgid());
233
234 if ((kd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY, buf)) == NULL) {
235 fprintf(stderr, "fstat: %s\n", buf);
236 exit(1);
237 }
238 #ifdef notdef
239 if (kvm_nlist(kd, nl) != 0) {
240 fprintf(stderr, "fstat: no namelist: %s\n", kvm_geterr(kd));
241 exit(1);
242 }
243 #endif
244 if ((p = kvm_getprocs(kd, what, arg, &cnt)) == NULL) {
245 fprintf(stderr, "fstat: %s\n", kvm_geterr(kd));
246 exit(1);
247 }
248 if (nflg)
249 printf("%s",
250 "USER CMD PID FD DEV INUM MODE SZ|DV R/W");
251 else
252 printf("%s",
253 "USER CMD PID FD MOUNT INUM MODE SZ|DV R/W");
254 if (checkfile && fsflg == 0)
255 printf(" NAME\n");
256 else
257 putchar('\n');
258
259 for (plast = &p[cnt]; p < plast; ++p) {
260 if (p->kp_proc.p_stat == SZOMB)
261 continue;
262 dofiles(p);
263 }
264 exit(0);
265 }
266
267 char *Uname, *Comm;
268 int Pid;
269
270 #define PREFIX(i) printf("%-8.8s %-10s %5d", Uname, Comm, Pid); \
271 switch(i) { \
272 case TEXT: \
273 printf(" text"); \
274 break; \
275 case CDIR: \
276 printf(" wd"); \
277 break; \
278 case RDIR: \
279 printf(" root"); \
280 break; \
281 case TRACE: \
282 printf(" tr"); \
283 break; \
284 default: \
285 printf(" %4d", i); \
286 break; \
287 }
288
289 /*
290 * print open files attributed to this process
291 */
292 void
293 dofiles(kp)
294 struct kinfo_proc *kp;
295 {
296 int i, last;
297 struct file file;
298 struct filedesc0 filed0;
299 #define filed filed0.fd_fd
300 struct proc *p = &kp->kp_proc;
301 struct eproc *ep = &kp->kp_eproc;
302
303 extern char *user_from_uid();
304
305 Uname = user_from_uid(ep->e_ucred.cr_uid, 0);
306 Pid = p->p_pid;
307 Comm = p->p_comm;
308
309 if (p->p_fd == NULL)
310 return;
311 if (!KVM_READ(p->p_fd, &filed0, sizeof (filed0))) {
312 dprintf(stderr, "can't read filedesc at %x for pid %d\n",
313 p->p_fd, Pid);
314 return;
315 }
316 if (filed.fd_nfiles < 0 || filed.fd_lastfile >= filed.fd_nfiles ||
317 filed.fd_freefile > filed.fd_lastfile + 1) {
318 dprintf(stderr, "filedesc corrupted at %x for pid %d\n",
319 p->p_fd, Pid);
320 return;
321 }
322 /*
323 * root directory vnode, if one
324 */
325 if (filed.fd_rdir)
326 vtrans(filed.fd_rdir, RDIR, FREAD);
327 /*
328 * current working directory vnode
329 */
330 vtrans(filed.fd_cdir, CDIR, FREAD);
331 /*
332 * ktrace vnode, if one
333 */
334 if (p->p_tracep)
335 vtrans(p->p_tracep, TRACE, FREAD|FWRITE);
336 /*
337 * open files
338 */
339 #define FPSIZE (sizeof (struct file *))
340 ALLOC_OFILES(filed.fd_lastfile+1);
341 if (filed.fd_nfiles > NDFILE) {
342 if (!KVM_READ(filed.fd_ofiles, ofiles,
343 (filed.fd_lastfile+1) * FPSIZE)) {
344 dprintf(stderr,
345 "can't read file structures at %x for pid %d\n",
346 filed.fd_ofiles, Pid);
347 return;
348 }
349 } else
350 bcopy(filed0.fd_dfiles, ofiles, (filed.fd_lastfile+1) * FPSIZE);
351 for (i = 0; i <= filed.fd_lastfile; i++) {
352 if (ofiles[i] == NULL)
353 continue;
354 if (!KVM_READ(ofiles[i], &file, sizeof (struct file))) {
355 dprintf(stderr, "can't read file %d at %x for pid %d\n",
356 i, ofiles[i], Pid);
357 continue;
358 }
359 if (file.f_type == DTYPE_VNODE)
360 vtrans((struct vnode *)file.f_data, i, file.f_flag);
361 else if (file.f_type == DTYPE_SOCKET) {
362 if (checkfile == 0)
363 socktrans((struct socket *)file.f_data, i);
364 }
365 else {
366 dprintf(stderr,
367 "unknown file type %d for file %d of pid %d\n",
368 file.f_type, i, Pid);
369 }
370 }
371 }
372
373 void
374 vtrans(vp, i, flag)
375 struct vnode *vp;
376 int i;
377 int flag;
378 {
379 struct vnode vn;
380 struct filestat fst;
381 char rw[3], mode[15];
382 char *badtype = NULL, *filename, *getmnton();
383
384 filename = badtype = NULL;
385 if (!KVM_READ(vp, &vn, sizeof (struct vnode))) {
386 dprintf(stderr, "can't read vnode at %x for pid %d\n",
387 vp, Pid);
388 return;
389 }
390 if (vn.v_type == VNON || vn.v_tag == VT_NON)
391 badtype = "none";
392 else if (vn.v_type == VBAD)
393 badtype = "bad";
394 else
395 switch (vn.v_tag) {
396 case VT_UFS:
397 if (!ufs_filestat(&vn, &fst))
398 badtype = "error";
399 break;
400 case VT_MFS:
401 if (!ufs_filestat(&vn, &fst))
402 badtype = "error";
403 break;
404 case VT_NFS:
405 if (!nfs_filestat(&vn, &fst))
406 badtype = "error";
407 break;
408 default: {
409 static char unknown[10];
410 sprintf(badtype = unknown, "?(%x)", vn.v_tag);
411 break;;
412 }
413 }
414 if (checkfile) {
415 int fsmatch = 0;
416 register DEVS *d;
417
418 if (badtype)
419 return;
420 for (d = devs; d != NULL; d = d->next)
421 if (d->fsid == fst.fsid) {
422 fsmatch = 1;
423 if (d->ino == fst.fileid) {
424 filename = d->name;
425 break;
426 }
427 }
428 if (fsmatch == 0 || (filename == NULL && fsflg == 0))
429 return;
430 }
431 PREFIX(i);
432 if (badtype) {
433 (void)printf(" - - %10s -\n", badtype);
434 return;
435 }
436 if (nflg)
437 (void)printf(" %2d,%-2d", major(fst.fsid), minor(fst.fsid));
438 else
439 (void)printf(" %-8s", getmnton(vn.v_mount));
440 if (nflg)
441 (void)sprintf(mode, "%o", fst.mode);
442 else
443 strmode(fst.mode, mode);
444 (void)printf(" %6d %10s", fst.fileid, mode);
445 switch (vn.v_type) {
446 case VBLK:
447 case VCHR: {
448 char *name;
449
450 if (nflg || ((name = devname(fst.rdev, vn.v_type == VCHR ?
451 S_IFCHR : S_IFBLK)) == NULL))
452 printf(" %2d,%-2d", major(fst.rdev), minor(fst.rdev));
453 else
454 printf(" %6s", name);
455 break;
456 }
457 default:
458 printf(" %6d", fst.size);
459 }
460 rw[0] = '\0';
461 if (flag & FREAD)
462 strcat(rw, "r");
463 if (flag & FWRITE)
464 strcat(rw, "w");
465 printf(" %2s", rw);
466 if (filename && !fsflg)
467 printf(" %s", filename);
468 putchar('\n');
469 }
470
471 int
472 ufs_filestat(vp, fsp)
473 struct vnode *vp;
474 struct filestat *fsp;
475 {
476 struct inode inode;
477
478 if (!KVM_READ(VTOI(vp), &inode, sizeof (inode))) {
479 dprintf(stderr, "can't read inode at %x for pid %d\n",
480 VTOI(vp), Pid);
481 return 0;
482 }
483 fsp->fsid = inode.i_dev & 0xffff;
484 fsp->fileid = (long)inode.i_number;
485 fsp->mode = (mode_t)inode.i_mode;
486 fsp->size = (u_long)inode.i_size;
487 fsp->rdev = inode.i_rdev;
488
489 return 1;
490 }
491
492 int
493 nfs_filestat(vp, fsp)
494 struct vnode *vp;
495 struct filestat *fsp;
496 {
497 struct nfsnode nfsnode;
498 register mode_t mode;
499
500 if (!KVM_READ(VTONFS(vp), &nfsnode, sizeof (nfsnode))) {
501 dprintf(stderr, "can't read nfsnode at %x for pid %d\n",
502 VTONFS(vp), Pid);
503 return 0;
504 }
505 fsp->fsid = nfsnode.n_vattr.va_fsid;
506 fsp->fileid = nfsnode.n_vattr.va_fileid;
507 fsp->size = nfsnode.n_size;
508 fsp->rdev = nfsnode.n_vattr.va_rdev;
509 mode = (mode_t)nfsnode.n_vattr.va_mode;
510 switch (vp->v_type) {
511 case VREG:
512 mode |= S_IFREG;
513 break;
514 case VDIR:
515 mode |= S_IFDIR;
516 break;
517 case VBLK:
518 mode |= S_IFBLK;
519 break;
520 case VCHR:
521 mode |= S_IFCHR;
522 break;
523 case VLNK:
524 mode |= S_IFLNK;
525 break;
526 case VSOCK:
527 mode |= S_IFSOCK;
528 break;
529 case VFIFO:
530 mode |= S_IFIFO;
531 break;
532 };
533 fsp->mode = mode;
534
535 return 1;
536 }
537
538
539 char *
540 getmnton(m)
541 struct mount *m;
542 {
543 static struct mount mount;
544 static struct mtab {
545 struct mtab *next;
546 struct mount *m;
547 char mntonname[MNAMELEN];
548 } *mhead = NULL;
549 register struct mtab *mt;
550
551 for (mt = mhead; mt != NULL; mt = mt->next)
552 if (m == mt->m)
553 return (mt->mntonname);
554 if (!KVM_READ(m, &mount, sizeof(struct mount))) {
555 fprintf(stderr, "can't read mount table at %x\n", m);
556 return (NULL);
557 }
558 if ((mt = malloc(sizeof (struct mtab))) == NULL) {
559 fprintf(stderr, "fstat: %s\n", strerror(errno));
560 exit(1);
561 }
562 mt->m = m;
563 bcopy(&mount.mnt_stat.f_mntonname[0], &mt->mntonname[0], MNAMELEN);
564 mt->next = mhead;
565 mhead = mt;
566 return (mt->mntonname);
567 }
568
569 void
570 socktrans(sock, i)
571 struct socket *sock;
572 int i;
573 {
574 static char *stypename[] = {
575 "unused", /* 0 */
576 "stream", /* 1 */
577 "dgram", /* 2 */
578 "raw", /* 3 */
579 "rdm", /* 4 */
580 "seqpak" /* 5 */
581 };
582 #define STYPEMAX 5
583 struct socket so;
584 struct protosw proto;
585 struct domain dom;
586 struct inpcb inpcb;
587 struct unpcb unpcb;
588 int len;
589 char dname[32], *strcpy();
590
591 PREFIX(i);
592
593 /* fill in socket */
594 if (!KVM_READ(sock, &so, sizeof(struct socket))) {
595 dprintf(stderr, "can't read sock at %x\n", sock);
596 goto bad;
597 }
598
599 /* fill in protosw entry */
600 if (!KVM_READ(so.so_proto, &proto, sizeof(struct protosw))) {
601 dprintf(stderr, "can't read protosw at %x", so.so_proto);
602 goto bad;
603 }
604
605 /* fill in domain */
606 if (!KVM_READ(proto.pr_domain, &dom, sizeof(struct domain))) {
607 dprintf(stderr, "can't read domain at %x\n", proto.pr_domain);
608 goto bad;
609 }
610
611 if ((len = kvm_read(kd, (u_long)dom.dom_name, dname,
612 sizeof(dname) - 1)) < 0) {
613 dprintf(stderr, "can't read domain name at %x\n",
614 dom.dom_name);
615 dname[0] = '\0';
616 }
617 else
618 dname[len] = '\0';
619
620 if ((u_short)so.so_type > STYPEMAX)
621 printf("* %s ?%d", dname, so.so_type);
622 else
623 printf("* %s %s", dname, stypename[so.so_type]);
624
625 /*
626 * protocol specific formatting
627 *
628 * Try to find interesting things to print. For tcp, the interesting
629 * thing is the address of the tcpcb, for udp and others, just the
630 * inpcb (socket pcb). For unix domain, its the address of the socket
631 * pcb and the address of the connected pcb (if connected). Otherwise
632 * just print the protocol number and address of the socket itself.
633 * The idea is not to duplicate netstat, but to make available enough
634 * information for further analysis.
635 */
636 switch(dom.dom_family) {
637 case AF_INET:
638 getinetproto(proto.pr_protocol);
639 if (proto.pr_protocol == IPPROTO_TCP ) {
640 if (so.so_pcb) {
641 if (kvm_read(kd, (u_long)so.so_pcb,
642 (char *)&inpcb, sizeof(struct inpcb))
643 != sizeof(struct inpcb)) {
644 dprintf(stderr,
645 "can't read inpcb at %x\n",
646 so.so_pcb);
647 goto bad;
648 }
649 printf(" %lx", (long)inpcb.inp_ppcb);
650 }
651 }
652 else if (so.so_pcb)
653 printf(" %lx", (long)so.so_pcb);
654 break;
655 case AF_UNIX:
656 /* print address of pcb and connected pcb */
657 if (so.so_pcb) {
658 printf(" %lx", (long)so.so_pcb);
659 if (kvm_read(kd, (u_long)so.so_pcb, (char *)&unpcb,
660 sizeof(struct unpcb)) != sizeof(struct unpcb)){
661 dprintf(stderr, "can't read unpcb at %x\n",
662 so.so_pcb);
663 goto bad;
664 }
665 if (unpcb.unp_conn) {
666 char shoconn[4], *cp;
667
668 cp = shoconn;
669 if (!(so.so_state & SS_CANTRCVMORE))
670 *cp++ = '<';
671 *cp++ = '-';
672 if (!(so.so_state & SS_CANTSENDMORE))
673 *cp++ = '>';
674 *cp = '\0';
675 printf(" %s %lx", shoconn,
676 (long)unpcb.unp_conn);
677 }
678 }
679 break;
680 default:
681 /* print protocol number and socket address */
682 printf(" %d %lx", proto.pr_protocol, (long)sock);
683 }
684 printf("\n");
685 return;
686 bad:
687 printf("* error\n");
688 }
689
690 /*
691 * getinetproto --
692 * print name of protocol number
693 */
694 void
695 getinetproto(number)
696 int number;
697 {
698 char *cp;
699
700 switch(number) {
701 case IPPROTO_IP:
702 cp = "ip"; break;
703 case IPPROTO_ICMP:
704 cp ="icmp"; break;
705 case IPPROTO_GGP:
706 cp ="ggp"; break;
707 case IPPROTO_TCP:
708 cp ="tcp"; break;
709 case IPPROTO_EGP:
710 cp ="egp"; break;
711 case IPPROTO_PUP:
712 cp ="pup"; break;
713 case IPPROTO_UDP:
714 cp ="udp"; break;
715 case IPPROTO_IDP:
716 cp ="idp"; break;
717 case IPPROTO_RAW:
718 cp ="raw"; break;
719 default:
720 printf(" %d", number);
721 return;
722 }
723 printf(" %s", cp);
724 }
725
726 getfname(filename)
727 char *filename;
728 {
729 struct stat statbuf;
730 DEVS *cur;
731
732 if (stat(filename, &statbuf)) {
733 fprintf(stderr, "fstat: %s: %s\n", filename, strerror(errno));
734 return(0);
735 }
736 if ((cur = malloc(sizeof(DEVS))) == NULL) {
737 fprintf(stderr, "fstat: %s\n", strerror(errno));
738 exit(1);
739 }
740 cur->next = devs;
741 devs = cur;
742
743 cur->ino = statbuf.st_ino;
744 cur->fsid = statbuf.st_dev & 0xffff;
745 cur->name = filename;
746 return(1);
747 }
748
749 void
750 usage()
751 {
752 (void)fprintf(stderr,
753 "usage: fstat [-fnv] [-p pid] [-u user] [-N system] [-M core] [file ...]\n");
754 exit(1);
755 }
756