URL https://opencores.org/ocsvn/or1k/or1k/trunk

Subversion Repositories or1k

[/] [or1k/] [trunk/] [linux/] [linux-2.4/] [net/] [core/] [scm.c] - Blame information for rev 1765

Details | Compare with Previous | View Log


/* scm.c - Socket level control messages processing.
 *
 * Author:      Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
 *              Alignment and value checking mods by Craig Metz
 *
 *              This program is free software; you can redistribute it and/or
 *              modify it under the terms of the GNU General Public License
 *              as published by the Free Software Foundation; either version
 *              2 of the License, or (at your option) any later version.
 */
 
#include <linux/signal.h>
#include <linux/errno.h>
#include <linux/sched.h>
#include <linux/mm.h>
#include <linux/kernel.h>
#include <linux/major.h>
#include <linux/stat.h>
#include <linux/socket.h>
#include <linux/file.h>
#include <linux/fcntl.h>
#include <linux/net.h>
#include <linux/interrupt.h>
#include <linux/netdevice.h>
 
#include <asm/system.h>
#include <asm/uaccess.h>
 
#include <net/protocol.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <net/scm.h>
 
 
/*
 *      Only allow a user to send credentials, that they could set with
 *      setu(g)id.
 */
 
static __inline__ int scm_check_creds(struct ucred *creds)
{
        if ((creds->pid == current->pid || capable(CAP_SYS_ADMIN)) &&
            ((creds->uid == current->uid || creds->uid == current->euid ||
              creds->uid == current->suid) || capable(CAP_SETUID)) &&
            ((creds->gid == current->gid || creds->gid == current->egid ||
              creds->gid == current->sgid) || capable(CAP_SETGID))) {
               return 0;
        }
        return -EPERM;
}
 
static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
{
        int *fdp = (int*)CMSG_DATA(cmsg);
        struct scm_fp_list *fpl = *fplp;
        struct file **fpp;
        int i, num;
 
        num = (cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr)))/sizeof(int);
 
        if (num <= 0)
                return 0;
 
        if (num > SCM_MAX_FD)
                return -EINVAL;
 
        if (!fpl)
        {
                fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL);
                if (!fpl)
                        return -ENOMEM;
                *fplp = fpl;
                fpl->count = 0;
        }
        fpp = &fpl->fp[fpl->count];
 
        if (fpl->count + num > SCM_MAX_FD)
                return -EINVAL;
 
        /*
         *      Verify the descriptors and increment the usage count.
         */
 
        for (i=0; i< num; i++)
        {
                int fd = fdp[i];
                struct file *file;
 
                if (fd < 0 || !(file = fget(fd)))
                        return -EBADF;
                *fpp++ = file;
                fpl->count++;
        }
        return num;
}
 
void __scm_destroy(struct scm_cookie *scm)
{
        struct scm_fp_list *fpl = scm->fp;
        int i;
 
        if (fpl) {
                scm->fp = NULL;
                for (i=fpl->count-1; i>=0; i--)
                        fput(fpl->fp[i]);
                kfree(fpl);
        }
}
 
int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
{
        struct cmsghdr *cmsg;
        int err;
 
        for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg))
        {
                err = -EINVAL;
 
                /* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
                /* The first check was omitted in <= 2.2.5. The reasoning was
                   that parser checks cmsg_len in any case, so that
                   additional check would be work duplication.
                   But if cmsg_level is not SOL_SOCKET, we do not check
                   for too short ancillary data object at all! Oops.
                   OK, let's add it...
                 */
                if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
                    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
                                    + cmsg->cmsg_len) > msg->msg_controllen)
                        goto error;
 
                if (cmsg->cmsg_level != SOL_SOCKET)
                        continue;
 
                switch (cmsg->cmsg_type)
                {
                case SCM_RIGHTS:
                        err=scm_fp_copy(cmsg, &p->fp);
                        if (err<0)
                                goto error;
                        break;
                case SCM_CREDENTIALS:
                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
                                goto error;
                        memcpy(&p->creds, CMSG_DATA(cmsg), sizeof(struct ucred));
                        err = scm_check_creds(&p->creds);
                        if (err)
                                goto error;
                        break;
                default:
                        goto error;
                }
        }
 
        if (p->fp && !p->fp->count)
        {
                kfree(p->fp);
                p->fp = NULL;
        }
        return 0;
 
error:
        scm_destroy(p);
        return err;
}
 
int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
{
        struct cmsghdr *cm = (struct cmsghdr*)msg->msg_control;
        struct cmsghdr cmhdr;
        int cmlen = CMSG_LEN(len);
        int err;
 
        if (cm==NULL || msg->msg_controllen < sizeof(*cm)) {
                msg->msg_flags |= MSG_CTRUNC;
                return 0; /* XXX: return error? check spec. */
        }
        if (msg->msg_controllen < cmlen) {
                msg->msg_flags |= MSG_CTRUNC;
                cmlen = msg->msg_controllen;
        }
        cmhdr.cmsg_level = level;
        cmhdr.cmsg_type = type;
        cmhdr.cmsg_len = cmlen;
 
        err = -EFAULT;
        if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
                goto out;
        if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
                goto out;
        cmlen = CMSG_SPACE(len);
        msg->msg_control += cmlen;
        msg->msg_controllen -= cmlen;
        err = 0;
out:
        return err;
}
 
void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
{
        struct cmsghdr *cm = (struct cmsghdr*)msg->msg_control;
 
        int fdmax = 0;
        int fdnum = scm->fp->count;
        struct file **fp = scm->fp->fp;
        int *cmfptr;
        int err = 0, i;
 
        if (msg->msg_controllen > sizeof(struct cmsghdr))
                fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr))
                         / sizeof(int));
 
        if (fdnum < fdmax)
                fdmax = fdnum;
 
        for (i=0, cmfptr=(int*)CMSG_DATA(cm); i<fdmax; i++, cmfptr++)
        {
                int new_fd;
                err = get_unused_fd();
                if (err < 0)
                        break;
                new_fd = err;
                err = put_user(new_fd, cmfptr);
                if (err) {
                        put_unused_fd(new_fd);
                        break;
                }
                /* Bump the usage count and install the file. */
                get_file(fp[i]);
                fd_install(new_fd, fp[i]);
        }
 
        if (i > 0)
        {
                int cmlen = CMSG_LEN(i*sizeof(int));
                if (!err)
                        err = put_user(SOL_SOCKET, &cm->cmsg_level);
                if (!err)
                        err = put_user(SCM_RIGHTS, &cm->cmsg_type);
                if (!err)
                        err = put_user(cmlen, &cm->cmsg_len);
                if (!err) {
                        cmlen = CMSG_SPACE(i*sizeof(int));
                        msg->msg_control += cmlen;
                        msg->msg_controllen -= cmlen;
                }
        }
        if (i < fdnum || (fdnum && fdmax <= 0))
                msg->msg_flags |= MSG_CTRUNC;
 
        /*
         * All of the files that fit in the message have had their
         * usage counts incremented, so we just free the list.
         */
        __scm_destroy(scm);
}
 
struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
{
        struct scm_fp_list *new_fpl;
        int i;
 
        if (!fpl)
                return NULL;
 
        new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
        if (new_fpl) {
                for (i=fpl->count-1; i>=0; i--)
                        get_file(fpl->fp[i]);
                memcpy(new_fpl, fpl, sizeof(*fpl));
        }
        return new_fpl;
}

Browse

Tools

Subversion Repositories or1k

[/] [or1k/] [trunk/] [linux/] [linux-2.4/] [net/] [core/] [scm.c] - Blame information for rev 1765

Line No.	Rev	Author	Line
1	1278	phoenix	`/* scm.c - Socket level control messages processing.`
2			`*`
3			`* Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>`
4			`* Alignment and value checking mods by Craig Metz`
5			`*`
6			`* This program is free software; you can redistribute it and/or`
7			`* modify it under the terms of the GNU General Public License`
8			`* as published by the Free Software Foundation; either version`
9			`* 2 of the License, or (at your option) any later version.`
10			`*/`
11
12			`#include <linux/signal.h>`
13			`#include <linux/errno.h>`
14			`#include <linux/sched.h>`
15			`#include <linux/mm.h>`
16			`#include <linux/kernel.h>`
17			`#include <linux/major.h>`
18			`#include <linux/stat.h>`
19			`#include <linux/socket.h>`
20			`#include <linux/file.h>`
21			`#include <linux/fcntl.h>`
22			`#include <linux/net.h>`
23			`#include <linux/interrupt.h>`
24			`#include <linux/netdevice.h>`
25
26			`#include <asm/system.h>`
27			`#include <asm/uaccess.h>`
28
29			`#include <net/protocol.h>`
30			`#include <linux/skbuff.h>`
31			`#include <net/sock.h>`
32			`#include <net/scm.h>`
33
34
35			`/*`
36			`* Only allow a user to send credentials, that they could set with`
37			`* setu(g)id.`
38			`*/`
39
40			`static __inline__ int scm_check_creds(struct ucred *creds)`
41			`{`
42			`if ((creds->pid == current->pid \|\| capable(CAP_SYS_ADMIN)) &&`
43			`((creds->uid == current->uid \|\| creds->uid == current->euid \|\|`
44			`creds->uid == current->suid) \|\| capable(CAP_SETUID)) &&`
45			`((creds->gid == current->gid \|\| creds->gid == current->egid \|\|`
46			`creds->gid == current->sgid) \|\| capable(CAP_SETGID))) {`
47			`return 0;`
48			`}`
49			`return -EPERM;`
50			`}`
51
52			`static int scm_fp_copy(struct cmsghdr cmsg, struct scm_fp_list *fplp)`
53			`{`
54			`int fdp = (int)CMSG_DATA(cmsg);`
55			`struct scm_fp_list fpl = fplp;`
56			`struct file **fpp;`
57			`int i, num;`
58
59			`num = (cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr)))/sizeof(int);`
60
61			`if (num <= 0)`
62			`return 0;`
63
64			`if (num > SCM_MAX_FD)`
65			`return -EINVAL;`
66
67			`if (!fpl)`
68			`{`
69			`fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL);`
70			`if (!fpl)`
71			`return -ENOMEM;`
72			`*fplp = fpl;`
73			`fpl->count = 0;`
74			`}`
75			`fpp = &fpl->fp[fpl->count];`
76
77			`if (fpl->count + num > SCM_MAX_FD)`
78			`return -EINVAL;`
79
80			`/*`
81			`* Verify the descriptors and increment the usage count.`
82			`*/`
83
84			`for (i=0; i< num; i++)`
85			`{`
86			`int fd = fdp[i];`
87			`struct file *file;`
88
89			`if (fd < 0 \|\| !(file = fget(fd)))`
90			`return -EBADF;`
91			`*fpp++ = file;`
92			`fpl->count++;`
93			`}`
94			`return num;`
95			`}`
96
97			`void __scm_destroy(struct scm_cookie *scm)`
98			`{`
99			`struct scm_fp_list *fpl = scm->fp;`
100			`int i;`
101
102			`if (fpl) {`
103			`scm->fp = NULL;`
104			`for (i=fpl->count-1; i>=0; i--)`
105			`fput(fpl->fp[i]);`
106			`kfree(fpl);`
107			`}`
108			`}`
109
110			`int __scm_send(struct socket sock, struct msghdr msg, struct scm_cookie *p)`
111			`{`
112			`struct cmsghdr *cmsg;`
113			`int err;`
114
115			`for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg))`
116			`{`
117			`err = -EINVAL;`
118
119			`/* Verify that cmsg_len is at least sizeof(struct cmsghdr) */`
120			`/* The first check was omitted in <= 2.2.5. The reasoning was`
121			`that parser checks cmsg_len in any case, so that`
122			`additional check would be work duplication.`
123			`But if cmsg_level is not SOL_SOCKET, we do not check`
124			`for too short ancillary data object at all! Oops.`
125			`OK, let's add it...`
126			`*/`
127			`if (cmsg->cmsg_len < sizeof(struct cmsghdr) \|\|`
128			`(unsigned long)(((char)cmsg - (char)msg->msg_control)`
129			`+ cmsg->cmsg_len) > msg->msg_controllen)`
130			`goto error;`
131
132			`if (cmsg->cmsg_level != SOL_SOCKET)`
133			`continue;`
134
135			`switch (cmsg->cmsg_type)`
136			`{`
137			`case SCM_RIGHTS:`
138			`err=scm_fp_copy(cmsg, &p->fp);`
139			`if (err<0)`
140			`goto error;`
141			`break;`
142			`case SCM_CREDENTIALS:`
143			`if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))`
144			`goto error;`
145			`memcpy(&p->creds, CMSG_DATA(cmsg), sizeof(struct ucred));`
146			`err = scm_check_creds(&p->creds);`
147			`if (err)`
148			`goto error;`
149			`break;`
150			`default:`
151			`goto error;`
152			`}`
153			`}`
154
155			`if (p->fp && !p->fp->count)`
156			`{`
157			`kfree(p->fp);`
158			`p->fp = NULL;`
159			`}`
160			`return 0;`
161
162			`error:`
163			`scm_destroy(p);`
164			`return err;`
165			`}`
166
167			`int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)`
168			`{`
169			`struct cmsghdr cm = (struct cmsghdr)msg->msg_control;`
170			`struct cmsghdr cmhdr;`
171			`int cmlen = CMSG_LEN(len);`
172			`int err;`
173
174			`if (cm==NULL \|\| msg->msg_controllen < sizeof(*cm)) {`
175			`msg->msg_flags \|= MSG_CTRUNC;`
176			`return 0; /* XXX: return error? check spec. */`
177			`}`
178			`if (msg->msg_controllen < cmlen) {`
179			`msg->msg_flags \|= MSG_CTRUNC;`
180			`cmlen = msg->msg_controllen;`
181			`}`
182			`cmhdr.cmsg_level = level;`
183			`cmhdr.cmsg_type = type;`
184			`cmhdr.cmsg_len = cmlen;`
185
186			`err = -EFAULT;`
187			`if (copy_to_user(cm, &cmhdr, sizeof cmhdr))`
188			`goto out;`
189			`if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))`
190			`goto out;`
191			`cmlen = CMSG_SPACE(len);`
192			`msg->msg_control += cmlen;`
193			`msg->msg_controllen -= cmlen;`
194			`err = 0;`
195			`out:`
196			`return err;`
197			`}`
198
199			`void scm_detach_fds(struct msghdr msg, struct scm_cookie scm)`
200			`{`
201			`struct cmsghdr cm = (struct cmsghdr)msg->msg_control;`
202
203			`int fdmax = 0;`
204			`int fdnum = scm->fp->count;`
205			`struct file **fp = scm->fp->fp;`
206			`int *cmfptr;`
207			`int err = 0, i;`
208
209			`if (msg->msg_controllen > sizeof(struct cmsghdr))`
210			`fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr))`
211			`/ sizeof(int));`
212
213			`if (fdnum < fdmax)`
214			`fdmax = fdnum;`
215
216			`for (i=0, cmfptr=(int*)CMSG_DATA(cm); i<fdmax; i++, cmfptr++)`
217			`{`
218			`int new_fd;`
219			`err = get_unused_fd();`
220			`if (err < 0)`
221			`break;`
222			`new_fd = err;`
223			`err = put_user(new_fd, cmfptr);`
224			`if (err) {`
225			`put_unused_fd(new_fd);`
226			`break;`
227			`}`
228			`/* Bump the usage count and install the file. */`
229			`get_file(fp[i]);`
230			`fd_install(new_fd, fp[i]);`
231			`}`
232
233			`if (i > 0)`
234			`{`
235			`int cmlen = CMSG_LEN(i*sizeof(int));`
236			`if (!err)`
237			`err = put_user(SOL_SOCKET, &cm->cmsg_level);`
238			`if (!err)`
239			`err = put_user(SCM_RIGHTS, &cm->cmsg_type);`
240			`if (!err)`
241			`err = put_user(cmlen, &cm->cmsg_len);`
242			`if (!err) {`
243			`cmlen = CMSG_SPACE(i*sizeof(int));`
244			`msg->msg_control += cmlen;`
245			`msg->msg_controllen -= cmlen;`
246			`}`
247			`}`
248			`if (i < fdnum \|\| (fdnum && fdmax <= 0))`
249			`msg->msg_flags \|= MSG_CTRUNC;`
250
251			`/*`
252			`* All of the files that fit in the message have had their`
253			`* usage counts incremented, so we just free the list.`
254			`*/`
255			`__scm_destroy(scm);`
256			`}`
257
258			`struct scm_fp_list scm_fp_dup(struct scm_fp_list fpl)`
259			`{`
260			`struct scm_fp_list *new_fpl;`
261			`int i;`
262
263			`if (!fpl)`
264			`return NULL;`
265
266			`new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);`
267			`if (new_fpl) {`
268			`for (i=fpl->count-1; i>=0; i--)`
269			`get_file(fpl->fp[i]);`
270			`memcpy(new_fpl, fpl, sizeof(*fpl));`
271			`}`
272			`return new_fpl;`
273			`}`