From 4c7609f41f8c404601cc2d10cfc7b5a379050636 Mon Sep 17 00:00:00 2001 From: green Date: Thu, 17 Jun 1999 23:54:50 +0000 Subject: [PATCH] Reviewed by: the cast of thousands This is the change to struct sockets that gets rid of so_uid and replaces it with a much more useful struct pcred *so_cred. This is here to be able to do socket-level credential checks (i.e. IPFW uid/gid support, to be added to HEAD soon). Along with this comes an update to pidentd which greatly simplifies the code necessary to get a uid from a socket. Soon to come: a sysctl() interface to finding individual sockets' credentials. --- sys/kern/uipc_sockbuf.c | 8 +++++--- sys/kern/uipc_socket.c | 15 +++++++++++---- sys/kern/uipc_socket2.c | 8 +++++--- sys/netinet/in_pcb.c | 8 +++++--- sys/sys/param.h | 4 ++-- sys/sys/socketvar.h | 4 ++-- 6 files changed, 30 insertions(+), 17 deletions(-) diff --git a/sys/kern/uipc_sockbuf.c b/sys/kern/uipc_sockbuf.c index 26c924396b27..2583e3bbef56 100644 --- a/sys/kern/uipc_sockbuf.c +++ b/sys/kern/uipc_sockbuf.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)uipc_socket2.c 8.1 (Berkeley) 6/10/93 - * $Id: uipc_socket2.c,v 1.45 1999/05/03 23:57:24 billf Exp $ + * $Id: uipc_socket2.c,v 1.46 1999/05/10 18:15:40 peter Exp $ */ #include @@ -213,7 +213,9 @@ sonewconn(head, connstatus) so->so_state = head->so_state | SS_NOFDREF; so->so_proto = head->so_proto; so->so_timeo = head->so_timeo; - so->so_uid = head->so_uid; + so->so_cred = head->so_cred; + if (so->so_cred) + so->so_cred->p_refcnt++; (void) soreserve(so, head->so_snd.sb_hiwat, head->so_rcv.sb_hiwat); if ((*so->so_proto->pr_usrreqs->pru_attach)(so, 0, NULL)) { @@ -915,7 +917,7 @@ sotoxsocket(struct socket *so, struct xsocket *xso) xso->so_oobmark = so->so_oobmark; sbtoxsockbuf(&so->so_snd, &xso->so_snd); sbtoxsockbuf(&so->so_rcv, &xso->so_rcv); - xso->so_uid = so->so_uid; + xso->so_uid = so->so_cred ? so->so_cred->pc_ucred->cr_uid : -1; } /* diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 8e911b668346..3bda374aba2e 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -31,18 +31,19 @@ * SUCH DAMAGE. * * @(#)uipc_socket.c 8.3 (Berkeley) 4/15/94 - * $Id: uipc_socket.c,v 1.58 1999/05/21 15:54:40 ache Exp $ + * $Id: uipc_socket.c,v 1.59 1999/06/04 02:27:02 peter Exp $ */ #include #include -#include #include #include #include #include #include +#include #include +#include #include #include #include @@ -124,8 +125,10 @@ socreate(dom, aso, type, proto, p) TAILQ_INIT(&so->so_incomp); TAILQ_INIT(&so->so_comp); so->so_type = type; - if (p != 0) - so->so_uid = p->p_ucred->cr_uid; + if (p) { + so->so_cred = p->p_cred; + so->so_cred->p_refcnt++; + } else so->so_cred = NULL; so->so_proto = prp; error = (*prp->pr_usrreqs->pru_attach)(so, proto, p); if (error) { @@ -156,6 +159,10 @@ sodealloc(so) struct socket *so; { so->so_gencnt = ++so_gencnt; + if (so->so_cred && --so->so_cred->p_refcnt == 0) { + crfree(so->so_cred->pc_ucred); + FREE(so->so_cred, M_SUBPROC); + } zfreei(so->so_zone, so); } diff --git a/sys/kern/uipc_socket2.c b/sys/kern/uipc_socket2.c index 26c924396b27..2583e3bbef56 100644 --- a/sys/kern/uipc_socket2.c +++ b/sys/kern/uipc_socket2.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)uipc_socket2.c 8.1 (Berkeley) 6/10/93 - * $Id: uipc_socket2.c,v 1.45 1999/05/03 23:57:24 billf Exp $ + * $Id: uipc_socket2.c,v 1.46 1999/05/10 18:15:40 peter Exp $ */ #include @@ -213,7 +213,9 @@ sonewconn(head, connstatus) so->so_state = head->so_state | SS_NOFDREF; so->so_proto = head->so_proto; so->so_timeo = head->so_timeo; - so->so_uid = head->so_uid; + so->so_cred = head->so_cred; + if (so->so_cred) + so->so_cred->p_refcnt++; (void) soreserve(so, head->so_snd.sb_hiwat, head->so_rcv.sb_hiwat); if ((*so->so_proto->pr_usrreqs->pru_attach)(so, 0, NULL)) { @@ -915,7 +917,7 @@ sotoxsocket(struct socket *so, struct xsocket *xso) xso->so_oobmark = so->so_oobmark; sbtoxsockbuf(&so->so_snd, &xso->so_snd); sbtoxsockbuf(&so->so_rcv, &xso->so_rcv); - xso->so_uid = so->so_uid; + xso->so_uid = so->so_cred ? so->so_cred->pc_ucred->cr_uid : -1; } /* diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c index 2f13bf173fca..d66e598652f9 100644 --- a/sys/netinet/in_pcb.c +++ b/sys/netinet/in_pcb.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)in_pcb.c 8.4 (Berkeley) 5/24/95 - * $Id: in_pcb.c,v 1.48 1999/04/27 11:17:31 phk Exp $ + * $Id: in_pcb.c,v 1.49 1999/04/28 11:37:44 phk Exp $ */ #include @@ -202,7 +202,7 @@ in_pcbbind(inp, nam, p) return (EACCES); if (p && p->p_prison) prison = 1; - if (so->so_uid && + if (so->so_cred && !IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) { t = in_pcblookup_local(inp->inp_pcbinfo, sin->sin_addr, lport, @@ -212,7 +212,9 @@ in_pcbbind(inp, nam, p) ntohl(t->inp_laddr.s_addr) != INADDR_ANY || (t->inp_socket->so_options & SO_REUSEPORT) == 0) && - (so->so_uid != t->inp_socket->so_uid)) + (t->inp_socket->so_cred) && + (so->so_cred->p_ruid != + t->inp_socket->so_cred->p_ruid)) return (EADDRINUSE); } t = in_pcblookup_local(pcbinfo, sin->sin_addr, diff --git a/sys/sys/param.h b/sys/sys/param.h index 44409c2770d0..95abf0d67b0c 100644 --- a/sys/sys/param.h +++ b/sys/sys/param.h @@ -36,7 +36,7 @@ * SUCH DAMAGE. * * @(#)param.h 8.3 (Berkeley) 4/4/95 - * $Id: param.h,v 1.47 1999/05/11 19:54:57 phk Exp $ + * $Id: param.h,v 1.48 1999/05/31 11:29:15 phk Exp $ */ #ifndef _SYS_PARAM_H_ @@ -46,7 +46,7 @@ #define BSD4_3 1 #define BSD4_4 1 #undef __FreeBSD_version -#define __FreeBSD_version 400006 /* Master, propagated to newvers */ +#define __FreeBSD_version 400007 /* Master, propagated to newvers */ #ifndef NULL #define NULL 0 diff --git a/sys/sys/socketvar.h b/sys/sys/socketvar.h index 6257eb9e6865..8fb052c297c5 100644 --- a/sys/sys/socketvar.h +++ b/sys/sys/socketvar.h @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)socketvar.h 8.3 (Berkeley) 2/19/95 - * $Id: socketvar.h,v 1.36 1999/02/01 21:16:31 newton Exp $ + * $Id: socketvar.h,v 1.37 1999/04/04 21:41:28 dt Exp $ */ #ifndef _SYS_SOCKETVAR_H_ @@ -105,7 +105,7 @@ struct socket { void (*so_upcall) __P((struct socket *, void *, int)); void *so_upcallarg; - uid_t so_uid; /* who opened the socket */ + struct pcred *so_cred; /* user credentials */ /* NB: generation count must not be first; easiest to make it last. */ so_gen_t so_gencnt; /* generation count */ void *so_emuldata; /* private data for emulators */