int
devfs_filestat(struct vnode *vp, struct filestat *fsp)
{
struct devfs_dirent devfs_dirent;
struct mount mount;
struct vnode vnode;
if (!KVM_READ(vp->v_data, &devfs_dirent, sizeof (devfs_dirent))) {
dprintf(stderr, "can't read devfs_dirent at %p for pid %d\n",
(void *)vp->v_data, Pid);
return 0;
}
if (!KVM_READ(vp->v_mount, &mount, sizeof (mount))) {
dprintf(stderr, "can't read mount at %p for pid %d\n",
(void *)vp->v_mount, Pid);
return 0;
}
if (!KVM_READ(devfs_dirent.de_vnode, &vnode, sizeof (vnode))) {
dprintf(stderr, "can't read vnode at %p for pid %d\n",
(void *)devfs_dirent.de_vnode, Pid);
return 0;
}
fsp->fsid = (long)(uint32_t)mount.mnt_stat.f_fsid.val[0];
fsp->fileid = devfs_dirent.de_inode;
fsp->mode = (devfs_dirent.de_mode & ~S_IFMT) | S_IFCHR;
fsp->size = 0;
fsp->rdev = dev2udev(vnode.v_rdev);
return 1;
}
void
dommap(struct kinfo_proc *kp)
{
vm_map_t map;
struct vmspace vmspace;
struct vm_map_entry entry;
vm_map_entry_t entryp;
struct vm_object object;
vm_object_t objp;
int prot, fflags;
if (!KVM_READ(kp->ki_vmspace, &vmspace, sizeof(vmspace))) {
dprintf(stderr,
"can't read vmspace at %p for pid %d\n",
(void *)kp->ki_vmspace, Pid);
return;
}
map = &vmspace.vm_map;
for (entryp = map->header.next;
entryp != &kp->ki_vmspace->vm_map.header; entryp = entry.next) {
if (!KVM_READ(entryp, &entry, sizeof(entry))) {
dprintf(stderr,
"can't read vm_map_entry at %p for pid %d\n",
(void *)entryp, Pid);
return;
}
if (entry.eflags & MAP_ENTRY_IS_SUB_MAP)
continue;
if ((objp = entry.object.vm_object) == NULL)
continue;
for (; objp; objp = object.backing_object) {
if (!KVM_READ(objp, &object, sizeof(object))) {
dprintf(stderr,
"can't read vm_object at %p for pid %d\n",
(void *)objp, Pid);
return;
}
}
prot = entry.protection;
fflags = (prot & VM_PROT_READ ? FREAD : 0) |
(prot & VM_PROT_WRITE ? FWRITE : 0);
switch (object.type) {
case OBJT_VNODE:
vtrans((struct vnode *)object.handle, MMAP, fflags);
break;
default:
break;
}
}
}
void
pipetrans(struct pipe *pi, int i, int flag)
{
struct pipe pip;
char rw[3];
PREFIX(i);
/* fill in socket */
if (!KVM_READ(pi, &pip, sizeof(struct pipe))) {
dprintf(stderr, "can't read pipe at %p\n", (void *)pi);
goto bad;
}
printf("* pipe %8lx <-> %8lx", (u_long)pi, (u_long)pip.pipe_peer);
printf(" %6d", (int)pip.pipe_buffer.cnt);
rw[0] = '\0';
if (flag & FREAD)
strcat(rw, "r");
if (flag & FWRITE)
strcat(rw, "w");
printf(" %2s", rw);
putchar('\n');
return;
bad:
printf("* error\n");
}
char *
getmnton(struct mount *m)
{
static struct mount mount;
static struct mtab {
struct mtab *next;
struct mount *m;
char mntonname[MNAMELEN];
} *mhead = NULL;
struct mtab *mt;
for (mt = mhead; mt != NULL; mt = mt->next)
if (m == mt->m)
return (mt->mntonname);
if (!KVM_READ(m, &mount, sizeof(struct mount))) {
warn("can't read mount table at %p", m);
return (NULL);
}
if ((mt = malloc(sizeof (struct mtab))) == NULL)
err(1, "malloc");
mt->m = m;
bcopy(&mount.mnt_stat.f_mntonname[0], &mt->mntonname[0], MNAMELEN);
mt->next = mhead;
mhead = mt;
return (mt->mntonname);
}
int
ufs_filestat(struct vnode *vp, struct filestat *fsp)
{
struct inode inode;
if (!KVM_READ(VTOI(vp), &inode, sizeof (inode))) {
dprintf(stderr, "can't read inode at %p for pid %d\n",
(void *)VTOI(vp), Pid);
return 0;
}
/*
* The st_dev from stat(2) is a dev_t. These kernel structures
* contain cdev pointers. We need to convert to dev_t to make
* comparisons
*/
fsp->fsid = dev2udev(inode.i_dev);
fsp->fileid = (long)inode.i_number;
fsp->mode = (mode_t)inode.i_mode;
fsp->size = (u_long)inode.i_size;
#if should_be_but_is_hard
/* XXX - need to load i_ump and i_din[12] from kernel memory */
if (inode.i_ump->um_fstype == UFS1)
fsp->rdev = inode.i_din1->di_rdev;
else
fsp->rdev = inode.i_din2->di_rdev;
#else
fsp->rdev = 0;
#endif
return 1;
}
void
pipetrans(struct pipe *pipe, int i)
{
struct pipe pi;
void *maxaddr;
PREFIX(i);
printf(" ");
/* fill in socket */
if (!KVM_READ(pipe, &pi, sizeof(struct pipe))) {
dprintf("can't read pipe at %p", pipe);
goto bad;
}
/*
* We don't have enough space to fit both peer and own address, so
* we select the higher address so both ends of the pipe have the
* same visible addr. (it's the higher address because when the other
* end closes, it becomes 0)
*/
maxaddr = MAX(pipe, pi.pipe_peer);
printf("pipe %p state: %s%s%s\n", maxaddr,
(pi.pipe_state & PIPE_WANTR) ? "R" : "",
(pi.pipe_state & PIPE_WANTW) ? "W" : "",
(pi.pipe_state & PIPE_EOF) ? "E" : "");
return;
bad:
printf("* error\n");
}
char *
kdevtoname(struct cdev *dev)
{
struct cdev si;
if (!KVM_READ(dev, &si, sizeof si))
return (NULL);
return (strdup(si.__si_namebuf));
}
/*
* Read the cdev structure in the kernel in order to work out the
* associated dev_t
*/
dev_t
dev2udev(struct cdev *dev)
{
struct cdev_priv priv;
if (KVM_READ(cdev2priv(dev), &priv, sizeof priv)) {
return ((dev_t)priv.cdp_inode);
} else {
dprintf(stderr, "can't convert cdev *%p to a dev_t\n", dev);
return -1;
}
}
int
ptyfs_filestat(struct vnode *vp, struct filestat *fsp)
{
struct ptyfsnode pn;
struct specnode sn;
struct mount mt;
if (!KVM_READ(VTOPTYFS(vp), &pn, sizeof(pn))) {
dprintf("can't read ptyfs_node at %p for pid %d",
VTOPTYFS(vp), Pid);
return 0;
}
if (!KVM_READ(vp->v_mount, &mt, sizeof(mt))) {
dprintf("can't read mount at %p for pid %d",
VTOPTYFS(vp), Pid);
return 0;
}
fsp->fsid = mt.mnt_stat.f_fsidx.__fsid_val[0];
fsp->fileid = pn.ptyfs_fileno;
fsp->mode = pn.ptyfs_mode;
fsp->size = 0;
switch (pn.ptyfs_type) {
case PTYFSpts:
case PTYFSptc:
if (!KVM_READ(vp->v_specnode, &sn, sizeof(sn))) {
dprintf("can't read specnode at %p for pid %d",
vp->v_specnode, Pid);
return 0;
}
fsp->rdev = sn.sn_rdev;
fsp->mode |= S_IFCHR;
break;
case PTYFSroot:
fsp->rdev = 0;
fsp->mode |= S_IFDIR;
break;
}
return 1;
}
int
nfs_filestat(struct vnode *vp, struct filestat *fsp)
{
struct nfsnode nfsnode;
mode_t mode;
if (!KVM_READ(VTONFS(vp), &nfsnode, sizeof (nfsnode))) {
dprintf(stderr, "can't read nfsnode at %p for pid %d\n",
(void *)VTONFS(vp), Pid);
return 0;
}
fsp->fsid = nfsnode.n_vattr.va_fsid;
fsp->fileid = nfsnode.n_vattr.va_fileid;
fsp->size = nfsnode.n_size;
fsp->rdev = nfsnode.n_vattr.va_rdev;
mode = (mode_t)nfsnode.n_vattr.va_mode;
switch (vp->v_type) {
case VREG:
mode |= S_IFREG;
break;
case VDIR:
mode |= S_IFDIR;
break;
case VBLK:
mode |= S_IFBLK;
break;
case VCHR:
mode |= S_IFCHR;
break;
case VLNK:
mode |= S_IFLNK;
break;
case VSOCK:
mode |= S_IFSOCK;
break;
case VFIFO:
mode |= S_IFIFO;
break;
case VNON:
case VBAD:
case VMARKER:
return 0;
};
fsp->mode = mode;
return 1;
}
int
xfs_filestat(struct vnode *vp, struct filestat *fsp)
{
struct xfs_node xfs_node;
if (!KVM_READ(VNODE_TO_XNODE(vp), &xfs_node, sizeof (xfs_node))) {
dprintf("can't read xfs_node at %p for pid %ld",
VTOI(vp), (long)Pid);
return 0;
}
fsp->fsid = xfs_node.attr.va_fsid;
fsp->fileid = (long)xfs_node.attr.va_fileid;
fsp->mode = xfs_node.attr.va_mode;
fsp->size = xfs_node.attr.va_size;
fsp->rdev = xfs_node.attr.va_rdev;
return 1;
}
int
ext2fs_filestat(struct vnode *vp, struct filestat *fsp)
{
struct inode inode;
if (!KVM_READ(VTOI(vp), &inode, sizeof (inode))) {
dprintf("can't read inode at %p for pid %ld",
VTOI(vp), (long)Pid);
return 0;
}
fsp->fsid = inode.i_dev & 0xffff;
fsp->fileid = (long)inode.i_number;
fsp->mode = inode.i_e2fs_mode;
fsp->size = inode.i_e2fs_size;
fsp->rdev = 0; /* XXX */
return 1;
}
void
ptstrans(struct tty *tp, int i, int flag)
{
struct tty tty;
char *name;
char rw[3];
dev_t rdev;
PREFIX(i);
/* Obtain struct tty. */
if (!KVM_READ(tp, &tty, sizeof(struct tty))) {
dprintf(stderr, "can't read tty at %p\n", (void *)tp);
goto bad;
}
/* Figure out the device name. */
name = kdevtoname(tty.t_dev);
if (name == NULL) {
dprintf(stderr, "can't determine tty name at %p\n", (void *)tp);
goto bad;
}
rw[0] = '\0';
if (flag & FREAD)
strcat(rw, "r");
if (flag & FWRITE)
strcat(rw, "w");
printf("* pseudo-terminal master ");
if (nflg || !name) {
rdev = dev2udev(tty.t_dev);
printf("%10d,%-2d", major(rdev), minor(rdev));
} else {
printf("%10s", name);
}
printf(" %2s\n", rw);
free(name);
return;
bad:
printf("* error\n");
}
void
systracetrans(struct fsystrace *f, int i)
{
struct fsystrace fi;
PREFIX(i);
printf(" ");
/* fill it in */
if (!KVM_READ(f, &fi, sizeof(fi))) {
dprintf("can't read fsystrace at %p", f);
goto bad;
}
printf("systrace %p npol %d\n", f, fi.npolicies);
return;
bad:
printf("* error\n");
}
void
kqueuetrans(struct kqueue *kq, int i)
{
struct kqueue kqi;
PREFIX(i);
printf(" ");
/* fill it in */
if (!KVM_READ(kq, &kqi, sizeof(struct kqueue))) {
dprintf("can't read kqueue at %p", kq);
goto bad;
}
printf("kqueue %p %d state: %s%s\n", kq, kqi.kq_count,
(kqi.kq_state & KQ_SEL) ? "S" : "",
(kqi.kq_state & KQ_SLEEP) ? "W" : "");
return;
bad:
printf("* error\n");
}
void
vtrans(struct vnode *vp, int i, int flag)
{
struct vnode vn;
struct filestat fst;
char rw[3], mode[15], tagstr[12], *tagptr;
const char *badtype, *filename;
filename = badtype = NULL;
if (!KVM_READ(vp, &vn, sizeof (struct vnode))) {
dprintf(stderr, "can't read vnode at %p for pid %d\n",
(void *)vp, Pid);
return;
}
if (!KVM_READ(&vp->v_tag, &tagptr, sizeof tagptr) ||
!KVM_READ(tagptr, tagstr, sizeof tagstr)) {
dprintf(stderr, "can't read v_tag at %p for pid %d\n",
(void *)vp, Pid);
return;
}
tagstr[sizeof(tagstr) - 1] = '\0';
if (vn.v_type == VNON)
badtype = "none";
else if (vn.v_type == VBAD)
badtype = "bad";
else {
if (!strcmp("ufs", tagstr)) {
if (!ufs_filestat(&vn, &fst))
badtype = "error";
} else if (!strcmp("devfs", tagstr)) {
if (!devfs_filestat(&vn, &fst))
badtype = "error";
} else if (!strcmp("nfs", tagstr)) {
if (!nfs_filestat(&vn, &fst))
badtype = "error";
} else if (!strcmp("msdosfs", tagstr)) {
if (!msdosfs_filestat(&vn, &fst))
badtype = "error";
} else if (!strcmp("isofs", tagstr)) {
if (!isofs_filestat(&vn, &fst))
badtype = "error";
#ifdef ZFS
} else if (!strcmp("zfs", tagstr)) {
if (!zfs_filestat(&vn, &fst))
badtype = "error";
#endif
} else {
static char unknown[32];
snprintf(unknown, sizeof unknown, "?(%s)", tagstr);
badtype = unknown;
}
}
if (checkfile) {
int fsmatch = 0;
DEVS *d;
if (badtype)
return;
for (d = devs; d != NULL; d = d->next)
if (d->fsid == fst.fsid) {
fsmatch = 1;
if (d->ino == fst.fileid) {
filename = d->name;
break;
}
}
if (fsmatch == 0 || (filename == NULL && fsflg == 0))
return;
}
PREFIX(i);
if (badtype) {
(void)printf(" - - %10s -\n", badtype);
return;
}
if (nflg)
(void)printf(" %2d,%-2d", major(fst.fsid), minor(fst.fsid));
else
(void)printf(" %-8s", getmnton(vn.v_mount));
if (nflg)
(void)sprintf(mode, "%o", fst.mode);
else
strmode(fst.mode, mode);
(void)printf(" %6ld %10s", fst.fileid, mode);
switch (vn.v_type) {
case VBLK:
case VCHR: {
char *name;
name = kdevtoname(vn.v_rdev);
if (nflg || !name)
printf(" %2d,%-2d", major(fst.rdev), minor(fst.rdev));
else {
printf(" %6s", name);
free(name);
}
break;
}
default:
printf(" %6lu", fst.size);
}
rw[0] = '\0';
if (flag & FREAD)
strcat(rw, "r");
if (flag & FWRITE)
strcat(rw, "w");
printf(" %2s", rw);
if (filename && !fsflg)
printf(" %s", filename);
putchar('\n');
}
int
null_filestat(struct vnode *vp, struct filestat *fsp)
{
struct null_node node;
struct filestat fst;
struct vnode vn;
int fail = 1;
memset(&fst, 0, sizeof fst);
if (!KVM_READ(VTONULL(vp), &node, sizeof (node))) {
dprintf("can't read node at %p for pid %ld",
VTONULL(vp), (long)Pid);
return 0;
}
/*
* Attempt to find information that might be useful.
*/
if (node.null_lowervp) {
if (!KVM_READ(node.null_lowervp, &vn, sizeof (vn))) {
dprintf("can't read vnode at %p for pid %ld",
node.null_lowervp, (long)Pid);
return 0;
}
fail = 0;
if (vn.v_type == VNON || vn.v_tag == VT_NON)
fail = 1;
else if (vn.v_type == VBAD)
fail = 1;
else
switch (vn.v_tag) {
case VT_UFS:
case VT_MFS:
if (!ufs_filestat(&vn, &fst))
fail = 1;
break;
case VT_NFS:
if (!nfs_filestat(&vn, &fst))
fail = 1;
break;
case VT_EXT2FS:
if (!ext2fs_filestat(&vn, &fst))
fail = 1;
break;
case VT_ISOFS:
if (!isofs_filestat(&vn, &fst))
fail = 1;
break;
case VT_MSDOSFS:
if (!msdos_filestat(&vn, &fst))
fail = 1;
break;
case VT_XFS:
if (!xfs_filestat(&vn, &fst))
fail = 1;
break;
default:
break;
}
}
fsp->fsid = (long)node.null_vnode;
if (fail)
fsp->fileid = (long)node.null_lowervp;
else
fsp->fileid = fst.fileid;
fsp->mode = fst.mode;
fsp->size = fst.mode;
fsp->rdev = fst.mode;
return 1;
}
void
vtrans(struct vnode *vp, int i, int flag, off_t offset)
{
struct vnode vn;
struct filestat fst;
char rw[3], mode[17];
char *badtype = NULL, *filename;
filename = badtype = NULL;
if (!KVM_READ(vp, &vn, sizeof (struct vnode))) {
dprintf("can't read vnode at %p for pid %ld", vp, (long)Pid);
return;
}
if (vn.v_type == VNON || vn.v_tag == VT_NON)
badtype = "none";
else if (vn.v_type == VBAD)
badtype = "bad";
else
switch (vn.v_tag) {
case VT_UFS:
case VT_MFS:
if (!ufs_filestat(&vn, &fst))
badtype = "error";
break;
case VT_NFS:
if (!nfs_filestat(&vn, &fst))
badtype = "error";
break;
case VT_EXT2FS:
if (!ext2fs_filestat(&vn, &fst))
badtype = "error";
break;
case VT_ISOFS:
if (!isofs_filestat(&vn, &fst))
badtype = "error";
break;
case VT_MSDOSFS:
if (!msdos_filestat(&vn, &fst))
badtype = "error";
break;
case VT_XFS:
if (!xfs_filestat(&vn, &fst))
badtype = "error";
break;
case VT_NULL:
if (!null_filestat(&vn, &fst))
badtype = "error";
break;
default: {
static char unknown[30];
snprintf(badtype = unknown, sizeof unknown,
"?(%x)", vn.v_tag);
break;
}
}
if (checkfile) {
int fsmatch = 0;
DEVS *d;
if (badtype)
return;
for (d = devs; d != NULL; d = d->next)
if (d->fsid == fst.fsid) {
fsmatch = 1;
if (d->ino == fst.fileid) {
filename = d->name;
break;
}
}
if (fsmatch == 0 || (filename == NULL && fsflg == 0))
return;
}
PREFIX(i);
if (badtype) {
(void)printf(" - - %10s -\n", badtype);
return;
}
if (nflg)
(void)printf(" %2ld,%-2ld", (long)major(fst.fsid),
(long)minor(fst.fsid));
else
(void)printf(" %-8s", getmnton(vn.v_mount));
if (nflg)
(void)snprintf(mode, sizeof mode, "%o", fst.mode);
else
strmode(fst.mode, mode);
(void)printf(" %6ld %11s", fst.fileid, mode);
rw[0] = '\0';
if (flag & FREAD)
strlcat(rw, "r", sizeof rw);
if (flag & FWRITE)
strlcat(rw, "w", sizeof rw);
printf(" %2s", rw);
switch (vn.v_type) {
case VBLK:
case VCHR: {
char *name;
if (nflg || ((name = devname(fst.rdev, vn.v_type == VCHR ?
S_IFCHR : S_IFBLK)) == NULL))
printf(" %2d,%-3d", major(fst.rdev), minor(fst.rdev));
else
printf(" %7s", name);
if (oflg)
printf(" ");
break;
}
default:
printf(" %8lld", (long long)fst.size);
if (oflg)
printf(":%-8lld", (long long)offset);
}
if (filename && !fsflg)
printf(" %s", filename);
putchar('\n');
}
void
socktrans(struct socket *sock, int i)
{
static const char *stypename[] = {
"unused", /* 0 */
"stream", /* 1 */
"dgram", /* 2 */
"raw", /* 3 */
"rdm", /* 4 */
"seqpak" /* 5 */
};
#define STYPEMAX 5
struct socket so;
struct protosw proto;
struct domain dom;
struct inpcb inpcb;
struct unpcb unpcb;
int len;
char dname[32];
PREFIX(i);
/* fill in socket */
if (!KVM_READ(sock, &so, sizeof(struct socket))) {
dprintf(stderr, "can't read sock at %p\n", (void *)sock);
goto bad;
}
/* fill in protosw entry */
if (!KVM_READ(so.so_proto, &proto, sizeof(struct protosw))) {
dprintf(stderr, "can't read protosw at %p",
(void *)so.so_proto);
goto bad;
}
/* fill in domain */
if (!KVM_READ(proto.pr_domain, &dom, sizeof(struct domain))) {
dprintf(stderr, "can't read domain at %p\n",
(void *)proto.pr_domain);
goto bad;
}
if ((len = kvm_read(kd, (u_long)dom.dom_name, dname,
sizeof(dname) - 1)) < 0) {
dprintf(stderr, "can't read domain name at %p\n",
(void *)dom.dom_name);
dname[0] = '\0';
}
else
dname[len] = '\0';
if ((u_short)so.so_type > STYPEMAX)
printf("* %s ?%d", dname, so.so_type);
else
printf("* %s %s", dname, stypename[so.so_type]);
/*
* protocol specific formatting
*
* Try to find interesting things to print. For tcp, the interesting
* thing is the address of the tcpcb, for udp and others, just the
* inpcb (socket pcb). For unix domain, its the address of the socket
* pcb and the address of the connected pcb (if connected). Otherwise
* just print the protocol number and address of the socket itself.
* The idea is not to duplicate netstat, but to make available enough
* information for further analysis.
*/
switch(dom.dom_family) {
case AF_INET:
case AF_INET6:
getinetproto(proto.pr_protocol);
if (proto.pr_protocol == IPPROTO_TCP ) {
if (so.so_pcb) {
if (kvm_read(kd, (u_long)so.so_pcb,
(char *)&inpcb, sizeof(struct inpcb))
!= sizeof(struct inpcb)) {
dprintf(stderr,
"can't read inpcb at %p\n",
(void *)so.so_pcb);
goto bad;
}
printf(" %lx", (u_long)inpcb.inp_ppcb);
}
}
else if (so.so_pcb)
printf(" %lx", (u_long)so.so_pcb);
break;
case AF_UNIX:
/* print address of pcb and connected pcb */
if (so.so_pcb) {
printf(" %lx", (u_long)so.so_pcb);
if (kvm_read(kd, (u_long)so.so_pcb, (char *)&unpcb,
sizeof(struct unpcb)) != sizeof(struct unpcb)){
dprintf(stderr, "can't read unpcb at %p\n",
(void *)so.so_pcb);
goto bad;
}
if (unpcb.unp_conn) {
char shoconn[4], *cp;
cp = shoconn;
if (!(so.so_rcv.sb_state & SBS_CANTRCVMORE))
*cp++ = '<';
*cp++ = '-';
if (!(so.so_snd.sb_state & SBS_CANTSENDMORE))
*cp++ = '>';
*cp = '\0';
printf(" %s %lx", shoconn,
(u_long)unpcb.unp_conn);
}
}
break;
default:
/* print protocol number and socket address */
printf(" %d %lx", proto.pr_protocol, (u_long)sock);
}
printf("\n");
return;
bad:
printf("* error\n");
}
void
socktrans(struct socket *sock, int i)
{
static char *stypename[] = {
"unused", /* 0 */
"stream", /* 1 */
"dgram", /* 2 */
"raw", /* 3 */
"rdm", /* 4 */
"seqpak" /* 5 */
};
#define STYPEMAX 5
struct socket so;
struct protosw proto;
struct domain dom;
struct inpcb inpcb;
struct unpcb unpcb;
int len;
char dname[32];
#ifdef INET6
char xaddrbuf[NI_MAXHOST + 2];
#endif
PREFIX(i);
/* fill in socket */
if (!KVM_READ(sock, &so, sizeof(struct socket))) {
dprintf("can't read sock at %p", sock);
goto bad;
}
/* fill in protosw entry */
if (!KVM_READ(so.so_proto, &proto, sizeof(struct protosw))) {
dprintf("can't read protosw at %p", so.so_proto);
goto bad;
}
/* fill in domain */
if (!KVM_READ(proto.pr_domain, &dom, sizeof(struct domain))) {
dprintf("can't read domain at %p", proto.pr_domain);
goto bad;
}
if ((len = kvm_read(kd, (u_long)dom.dom_name, dname,
sizeof(dname) - 1)) != sizeof(dname) -1) {
dprintf("can't read domain name at %p", dom.dom_name);
dname[0] = '\0';
} else
dname[len] = '\0';
if ((u_short)so.so_type > STYPEMAX)
printf("* %s ?%d", dname, so.so_type);
else
printf("* %s %s", dname, stypename[so.so_type]);
/*
* protocol specific formatting
*
* Try to find interesting things to print. For tcp, the interesting
* thing is the address of the tcpcb, for udp and others, just the
* inpcb (socket pcb). For unix domain, its the address of the socket
* pcb and the address of the connected pcb (if connected). Otherwise
* just print the protocol number and address of the socket itself.
* The idea is not to duplicate netstat, but to make available enough
* information for further analysis.
*/
switch(dom.dom_family) {
case AF_INET:
getinetproto(proto.pr_protocol);
if (proto.pr_protocol == IPPROTO_TCP) {
if (so.so_pcb == NULL)
break;
if (kvm_read(kd, (u_long)so.so_pcb, (char *)&inpcb,
sizeof(struct inpcb)) != sizeof(struct inpcb)) {
dprintf("can't read inpcb at %p", so.so_pcb);
goto bad;
}
printf(" %p", inpcb.inp_ppcb);
printf(" %s:%d",
inpcb.inp_laddr.s_addr == INADDR_ANY ? "*" :
inet_ntoa(inpcb.inp_laddr),
ntohs(inpcb.inp_lport));
if (inpcb.inp_fport) {
if (so.so_state & SS_CONNECTOUT)
printf(" --> ");
else
printf(" <-- ");
printf("%s:%d",
inpcb.inp_faddr.s_addr == INADDR_ANY ? "*" :
inet_ntoa(inpcb.inp_faddr),
ntohs(inpcb.inp_fport));
}
} else if (proto.pr_protocol == IPPROTO_UDP) {
if (so.so_pcb == NULL)
break;
if (kvm_read(kd, (u_long)so.so_pcb, (char *)&inpcb,
sizeof(struct inpcb)) != sizeof(struct inpcb)) {
dprintf("can't read inpcb at %p", so.so_pcb);
goto bad;
}
printf(" %s:%d",
inpcb.inp_laddr.s_addr == INADDR_ANY ? "*" :
inet_ntoa(inpcb.inp_laddr),
ntohs(inpcb.inp_lport));
if (inpcb.inp_fport)
printf(" <-> %s:%d",
inpcb.inp_faddr.s_addr == INADDR_ANY ? "*" :
inet_ntoa(inpcb.inp_faddr),
ntohs(inpcb.inp_fport));
} else if (so.so_pcb)
printf(" %p", so.so_pcb);
break;
#ifdef INET6
case AF_INET6:
getinetproto(proto.pr_protocol);
if (proto.pr_protocol == IPPROTO_TCP) {
if (so.so_pcb == NULL)
break;
if (kvm_read(kd, (u_long)so.so_pcb, (char *)&inpcb,
sizeof(struct inpcb)) != sizeof(struct inpcb)) {
dprintf("can't read inpcb at %p", so.so_pcb);
goto bad;
}
printf(" %p", inpcb.inp_ppcb);
snprintf(xaddrbuf, sizeof(xaddrbuf), "[%s]",
inet6_addrstr(&inpcb.inp_laddr6));
printf(" %s:%d",
IN6_IS_ADDR_UNSPECIFIED(&inpcb.inp_laddr6) ? "*" :
xaddrbuf,
ntohs(inpcb.inp_lport));
if (inpcb.inp_fport) {
if (so.so_state & SS_CONNECTOUT)
printf(" --> ");
else
printf(" <-- ");
snprintf(xaddrbuf, sizeof(xaddrbuf), "[%s]",
inet6_addrstr(&inpcb.inp_faddr6));
printf("%s:%d",
IN6_IS_ADDR_UNSPECIFIED(&inpcb.inp_faddr6) ? "*" :
xaddrbuf,
ntohs(inpcb.inp_fport));
}
} else if (proto.pr_protocol == IPPROTO_UDP) {
if (so.so_pcb == NULL)
break;
if (kvm_read(kd, (u_long)so.so_pcb, (char *)&inpcb,
sizeof(struct inpcb)) != sizeof(struct inpcb)) {
dprintf("can't read inpcb at %p", so.so_pcb);
goto bad;
}
snprintf(xaddrbuf, sizeof(xaddrbuf), "[%s]",
inet6_addrstr(&inpcb.inp_laddr6));
printf(" %s:%d",
IN6_IS_ADDR_UNSPECIFIED(&inpcb.inp_laddr6) ? "*" :
xaddrbuf,
ntohs(inpcb.inp_lport));
if (inpcb.inp_fport) {
snprintf(xaddrbuf, sizeof(xaddrbuf), "[%s]",
inet6_addrstr(&inpcb.inp_faddr6));
printf(" <-> %s:%d",
IN6_IS_ADDR_UNSPECIFIED(&inpcb.inp_faddr6) ? "*" :
xaddrbuf,
ntohs(inpcb.inp_fport));
}
} else if (so.so_pcb)
printf(" %p", so.so_pcb);
break;
#endif
case AF_UNIX:
/* print address of pcb and connected pcb */
if (so.so_pcb) {
printf(" %p", so.so_pcb);
if (kvm_read(kd, (u_long)so.so_pcb, (char *)&unpcb,
sizeof(struct unpcb)) != sizeof(struct unpcb)){
dprintf("can't read unpcb at %p", so.so_pcb);
goto bad;
}
if (unpcb.unp_conn) {
char shoconn[4], *cp;
cp = shoconn;
if (!(so.so_state & SS_CANTRCVMORE))
*cp++ = '<';
*cp++ = '-';
if (!(so.so_state & SS_CANTSENDMORE))
*cp++ = '>';
*cp = '\0';
printf(" %s %p", shoconn,
unpcb.unp_conn);
}
}
break;
default:
/* print protocol number and socket address */
printf(" %d %p", proto.pr_protocol, sock);
}
printf("\n");
return;
bad:
printf("* error\n");
}
/*
* print open files attributed to this process
*/
void
dofiles(struct kinfo_proc2 *kp)
{
int i;
struct file file;
struct filedesc0 filed0;
#define filed filed0.fd_fd
Uname = user_from_uid(kp->p_uid, 0);
Pid = kp->p_pid;
Comm = kp->p_comm;
if (kp->p_fd == 0)
return;
if (!KVM_READ(kp->p_fd, &filed0, sizeof (filed0))) {
dprintf("can't read filedesc at %p for pid %ld",
(void *)(u_long)kp->p_fd, (long)Pid);
return;
}
if (filed.fd_nfiles < 0 || filed.fd_lastfile >= filed.fd_nfiles ||
filed.fd_freefile > filed.fd_lastfile + 1) {
dprintf("filedesc corrupted at %p for pid %ld",
(void *)(u_long)kp->p_fd, (long)Pid);
return;
}
/*
* root directory vnode, if one
*/
if (filed.fd_rdir)
vtrans(filed.fd_rdir, RDIR, FREAD, 0);
/*
* current working directory vnode
*/
vtrans(filed.fd_cdir, CDIR, FREAD, 0);
/*
* ktrace vnode, if one
*/
if (kp->p_tracep)
vtrans((struct vnode *)(u_long)kp->p_tracep, TRACE, FREAD|FWRITE, 0);
/*
* open files
*/
#define FPSIZE (sizeof (struct file *))
ALLOC_OFILES(filed.fd_lastfile+1);
if (filed.fd_nfiles > NDFILE) {
if (!KVM_READ(filed.fd_ofiles, ofiles,
(filed.fd_lastfile+1) * FPSIZE)) {
dprintf("can't read file structures at %p for pid %ld",
filed.fd_ofiles, (long)Pid);
return;
}
} else
bcopy(filed0.fd_dfiles, ofiles, (filed.fd_lastfile+1) * FPSIZE);
for (i = 0; i <= filed.fd_lastfile; i++) {
if (ofiles[i] == NULL)
continue;
if (!KVM_READ(ofiles[i], &file, sizeof (struct file))) {
dprintf("can't read file %d at %p for pid %ld",
i, ofiles[i], (long)Pid);
continue;
}
if (file.f_type == DTYPE_VNODE)
vtrans((struct vnode *)file.f_data, i, file.f_flag,
file.f_offset);
else if (file.f_type == DTYPE_SOCKET) {
if (checkfile == 0)
socktrans((struct socket *)file.f_data, i);
} else if (file.f_type == DTYPE_PIPE) {
if (checkfile == 0)
pipetrans((struct pipe *)file.f_data, i);
} else if (file.f_type == DTYPE_KQUEUE) {
if (checkfile == 0)
kqueuetrans((struct kqueue *)file.f_data, i);
} else if (file.f_type == DTYPE_CRYPTO) {
if (checkfile == 0)
cryptotrans(file.f_data, i);
} else if (file.f_type == DTYPE_SYSTRACE) {
if (checkfile == 0)
systracetrans((struct fsystrace *)file.f_data, i);
} else {
dprintf("unknown file type %d for file %d of pid %ld",
file.f_type, i, (long)Pid);
}
}
}
/*
* print open files attributed to this process
*/
void
dofiles(struct kinfo_proc *kp)
{
int i;
struct file file;
struct filedesc filed;
Uname = user_from_uid(kp->ki_uid, 0);
Pid = kp->ki_pid;
Comm = kp->ki_comm;
if (kp->ki_fd == NULL)
return;
if (!KVM_READ(kp->ki_fd, &filed, sizeof (filed))) {
dprintf(stderr, "can't read filedesc at %p for pid %d\n",
(void *)kp->ki_fd, Pid);
return;
}
/*
* root directory vnode, if one
*/
if (filed.fd_rdir)
vtrans(filed.fd_rdir, RDIR, FREAD);
/*
* current working directory vnode
*/
if (filed.fd_cdir)
vtrans(filed.fd_cdir, CDIR, FREAD);
/*
* jail root, if any.
*/
if (filed.fd_jdir)
vtrans(filed.fd_jdir, JDIR, FREAD);
/*
* ktrace vnode, if one
*/
if (kp->ki_tracep)
vtrans(kp->ki_tracep, TRACE, FREAD|FWRITE);
/*
* text vnode, if one
*/
if (kp->ki_textvp)
vtrans(kp->ki_textvp, TEXT, FREAD);
/*
* open files
*/
#define FPSIZE (sizeof (struct file *))
#define MAX_LASTFILE (0x1000000)
/* Sanity check on filed.fd_lastfile */
if (filed.fd_lastfile <= -1 || filed.fd_lastfile > MAX_LASTFILE)
return;
ALLOC_OFILES(filed.fd_lastfile+1);
if (!KVM_READ(filed.fd_ofiles, ofiles,
(filed.fd_lastfile+1) * FPSIZE)) {
dprintf(stderr,
"can't read file structures at %p for pid %d\n",
(void *)filed.fd_ofiles, Pid);
return;
}
for (i = 0; i <= filed.fd_lastfile; i++) {
if (ofiles[i] == NULL)
continue;
if (!KVM_READ(ofiles[i], &file, sizeof (struct file))) {
dprintf(stderr, "can't read file %d at %p for pid %d\n",
i, (void *)ofiles[i], Pid);
continue;
}
if (file.f_type == DTYPE_VNODE)
vtrans(file.f_vnode, i, file.f_flag);
else if (file.f_type == DTYPE_SOCKET) {
if (checkfile == 0)
socktrans(file.f_data, i);
}
#ifdef DTYPE_PIPE
else if (file.f_type == DTYPE_PIPE) {
if (checkfile == 0)
pipetrans(file.f_data, i, file.f_flag);
}
#endif
#ifdef DTYPE_FIFO
else if (file.f_type == DTYPE_FIFO) {
if (checkfile == 0)
vtrans(file.f_vnode, i, file.f_flag);
}
#endif
#ifdef DTYPE_PTS
else if (file.f_type == DTYPE_PTS) {
if (checkfile == 0)
ptstrans(file.f_data, i, file.f_flag);
}
#endif
else {
dprintf(stderr,
"unknown file type %d for file %d of pid %d\n",
file.f_type, i, Pid);
}
}
}
