Bug #6415
closedsockets created via t_open/t_bind not shown by pfiles
100%
Description
We encountered an instance where rpcbind wasn't properly reporting an open file via pfiles. After a bit of digging to find this, the following is the final analysis:
This is exactly the purpose of the userland function dotli() in pfiles. However, with the change for dfc0fed81813380fb526f1a003d3be17ab26ce3b (illumos#3686), this code can obviously never work:
strcmd.sc_cmd = TI_GETMYNAME; if (pr_ioctl(Pr, fd, _I_CMD, &strcmd, sizeof (strcmd)) == 0) show_sockaddr("sockname", (void *)&strcmd.sc_buf, 0); strcmd.sc_cmd = TI_GETPEERNAME; if (pr_ioctl(Pr, fd, _I_CMD, &strcmd, sizeof (strcmd)) == 0) show_sockaddr("peername", (void *)&strcmd.sc_buf, 0);
Note that we always pass a 0 length to show_sockaddr(); however, this change introduced a shortcut check that bails out when length is 0. So since then, TLI socket names have been broken. This should instead pass the proper length obtained from the ioctl. With this change, we now see:
5: S_IFCHR mode:0000 dev:545,0 ino:57437 uid:0 gid:0 rdev:67,116 O_RDWR sockname: AF_INET6 :: port: 62129 /devices/pseudo/udp6@0:udp6 offset:0
We're not done yet, though. In the GZ, these paths are links to the /devices paths, which end in :udp (for example) and are correctly identified by pfiles as TLI endpoints. In zones, however, the /dev paths are the only paths there are, and libproc correctly presents them to pfiles as /dev/udp (for example). These are not sent through dotli() and thus are not shown, either. So we also need to try the last component of the filename if there's no : in it when checking for known TLI endpoints. With this, I now also get:
5: S_IFCHR mode:0000 dev:546,3 ino:22746 uid:0 gid:0 rdev:67,24 O_RDWR sockname: AF_INET6 :: port: 50612 /dev/udp6 offset:0
Updated by Electric Monk almost 7 years ago
- Status changed from New to Closed
git commit 6357b94b54238e954e002562d0e89a2fefd982e1
commit 6357b94b54238e954e002562d0e89a2fefd982e1 Author: Keith M Wesolowski <wesolows@foobazco.org> Date: 2015-11-03T21:36:16.000Z 6415 sockets created via t_open/t_bind not shown by pfiles 6432 TLI sockets aren't detected correctly by pfiles in a NGZ Reviewed by: Robert Mustacchi <rm@joyent.com> Reviewed by: Garrett D'Amore <garrett@damore.org> Reviewed by: Mohamed A. Khalfella <khalfella@gmail.com> Approved by: Matthew Ahrens <mahrens@delphix.com>