Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netinet/in_pcb.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (c) 1982, 1986, 1991, 1993, 1995 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 4. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 * 29 * @(#)in_pcb.c 8.4 (Berkeley) 5/24/95 30 * $FreeBSD: releng/6.4/sys/netinet/in_pcb.c 174871 2007-12-22 20:06:54Z rwatson $ 31 */ 32 33 #include "opt_ipsec.h" 34 #include "opt_inet6.h" 35 #include "opt_mac.h" 36 37 #include <sys/param.h> 38 #include <sys/systm.h> 39 #include <sys/mac.h> 40 #include <sys/malloc.h> 41 #include <sys/mbuf.h> 42 #include <sys/domain.h> 43 #include <sys/protosw.h> 44 #include <sys/socket.h> 45 #include <sys/socketvar.h> 46 #include <sys/proc.h> 47 #include <sys/jail.h> 48 #include <sys/kernel.h> 49 #include <sys/sysctl.h> 50 51 #include <vm/uma.h> 52 53 #include <net/if.h> 54 #include <net/if_types.h> 55 #include <net/route.h> 56 57 #include <netinet/in.h> 58 #include <netinet/in_pcb.h> 59 #include <netinet/in_var.h> 60 #include <netinet/ip_var.h> 61 #include <netinet/tcp_var.h> 62 #include <netinet/udp.h> 63 #include <netinet/udp_var.h> 64 #ifdef INET6 65 #include <netinet/ip6.h> 66 #include <netinet6/ip6_var.h> 67 #endif /* INET6 */ 68 69 #ifdef IPSEC 70 #include <netinet6/ipsec.h> 71 #include <netkey/key.h> 72 #endif /* IPSEC */ 73 74 #ifdef FAST_IPSEC 75 #if defined(IPSEC) || defined(IPSEC_ESP) 76 #error "Bad idea: don't compile with both IPSEC and FAST_IPSEC!" 77 #endif 78 79 #include <netipsec/ipsec.h> 80 #include <netipsec/key.h> 81 #endif /* FAST_IPSEC */ 82 83 /* 84 * These configure the range of local port addresses assigned to 85 * "unspecified" outgoing connections/packets/whatever. 86 */ 87 int ipport_lowfirstauto = IPPORT_RESERVED - 1; /* 1023 */ 88 int ipport_lowlastauto = IPPORT_RESERVEDSTART; /* 600 */ 89 int ipport_firstauto = IPPORT_HIFIRSTAUTO; /* 49152 */ 90 int ipport_lastauto = IPPORT_HILASTAUTO; /* 65535 */ 91 int ipport_hifirstauto = IPPORT_HIFIRSTAUTO; /* 49152 */ 92 int ipport_hilastauto = IPPORT_HILASTAUTO; /* 65535 */ 93 94 /* 95 * Reserved ports accessible only to root. There are significant 96 * security considerations that must be accounted for when changing these, 97 * but the security benefits can be great. Please be careful. 98 */ 99 int ipport_reservedhigh = IPPORT_RESERVED - 1; /* 1023 */ 100 int ipport_reservedlow = 0; 101 102 /* Variables dealing with random ephemeral port allocation. */ 103 int ipport_randomized = 1; /* user controlled via sysctl */ 104 int ipport_randomcps = 10; /* user controlled via sysctl */ 105 int ipport_randomtime = 45; /* user controlled via sysctl */ 106 int ipport_stoprandom = 0; /* toggled by ipport_tick */ 107 int ipport_tcpallocs; 108 int ipport_tcplastcount; 109 110 #define RANGECHK(var, min, max) \ 111 if ((var) < (min)) { (var) = (min); } \ 112 else if ((var) > (max)) { (var) = (max); } 113 114 static int 115 sysctl_net_ipport_check(SYSCTL_HANDLER_ARGS) 116 { 117 int error; 118 119 error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req); 120 if (error == 0) { 121 RANGECHK(ipport_lowfirstauto, 1, IPPORT_RESERVED - 1); 122 RANGECHK(ipport_lowlastauto, 1, IPPORT_RESERVED - 1); 123 RANGECHK(ipport_firstauto, IPPORT_RESERVED, IPPORT_MAX); 124 RANGECHK(ipport_lastauto, IPPORT_RESERVED, IPPORT_MAX); 125 RANGECHK(ipport_hifirstauto, IPPORT_RESERVED, IPPORT_MAX); 126 RANGECHK(ipport_hilastauto, IPPORT_RESERVED, IPPORT_MAX); 127 } 128 return (error); 129 } 130 131 #undef RANGECHK 132 133 SYSCTL_NODE(_net_inet_ip, IPPROTO_IP, portrange, CTLFLAG_RW, 0, "IP Ports"); 134 135 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowfirst, CTLTYPE_INT|CTLFLAG_RW, 136 &ipport_lowfirstauto, 0, &sysctl_net_ipport_check, "I", ""); 137 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowlast, CTLTYPE_INT|CTLFLAG_RW, 138 &ipport_lowlastauto, 0, &sysctl_net_ipport_check, "I", ""); 139 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, first, CTLTYPE_INT|CTLFLAG_RW, 140 &ipport_firstauto, 0, &sysctl_net_ipport_check, "I", ""); 141 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, last, CTLTYPE_INT|CTLFLAG_RW, 142 &ipport_lastauto, 0, &sysctl_net_ipport_check, "I", ""); 143 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hifirst, CTLTYPE_INT|CTLFLAG_RW, 144 &ipport_hifirstauto, 0, &sysctl_net_ipport_check, "I", ""); 145 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast, CTLTYPE_INT|CTLFLAG_RW, 146 &ipport_hilastauto, 0, &sysctl_net_ipport_check, "I", ""); 147 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, reservedhigh, 148 CTLFLAG_RW|CTLFLAG_SECURE, &ipport_reservedhigh, 0, ""); 149 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, reservedlow, 150 CTLFLAG_RW|CTLFLAG_SECURE, &ipport_reservedlow, 0, ""); 151 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, randomized, CTLFLAG_RW, 152 &ipport_randomized, 0, "Enable random port allocation"); 153 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, randomcps, CTLFLAG_RW, 154 &ipport_randomcps, 0, "Maximum number of random port " 155 "allocations before switching to a sequental one"); 156 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, randomtime, CTLFLAG_RW, 157 &ipport_randomtime, 0, "Minimum time to keep sequental port " 158 "allocation before switching to a random one"); 159 160 /* 161 * in_pcb.c: manage the Protocol Control Blocks. 162 * 163 * NOTE: It is assumed that most of these functions will be called with 164 * the pcbinfo lock held, and often, the inpcb lock held, as these utility 165 * functions often modify hash chains or addresses in pcbs. 166 */ 167 168 /* 169 * Allocate a PCB and associate it with the socket. 170 * On success return with the PCB locked. 171 */ 172 int 173 in_pcballoc(struct socket *so, struct inpcbinfo *pcbinfo) 174 { 175 struct inpcb *inp; 176 int error; 177 178 INP_INFO_WLOCK_ASSERT(pcbinfo); 179 error = 0; 180 inp = uma_zalloc(pcbinfo->ipi_zone, M_NOWAIT); 181 if (inp == NULL) 182 return (ENOBUFS); 183 bzero(inp, inp_zero_size); 184 inp->inp_pcbinfo = pcbinfo; 185 inp->inp_socket = so; 186 #ifdef MAC 187 error = mac_init_inpcb(inp, M_NOWAIT); 188 if (error != 0) 189 goto out; 190 SOCK_LOCK(so); 191 mac_create_inpcb_from_socket(so, inp); 192 SOCK_UNLOCK(so); 193 #endif 194 #if defined(IPSEC) || defined(FAST_IPSEC) 195 #ifdef FAST_IPSEC 196 error = ipsec_init_policy(so, &inp->inp_sp); 197 #else 198 error = ipsec_init_pcbpolicy(so, &inp->inp_sp); 199 #endif 200 if (error != 0) { 201 #ifdef MAC 202 mac_destroy_inpcb(inp); 203 #endif 204 goto out; 205 } 206 #endif /*IPSEC*/ 207 #if defined(INET6) 208 if (INP_SOCKAF(so) == AF_INET6) { 209 inp->inp_vflag |= INP_IPV6PROTO; 210 if (ip6_v6only) 211 inp->inp_flags |= IN6P_IPV6_V6ONLY; 212 } 213 #endif 214 LIST_INSERT_HEAD(pcbinfo->listhead, inp, inp_list); 215 pcbinfo->ipi_count++; 216 so->so_pcb = (caddr_t)inp; 217 #ifdef INET6 218 if (ip6_auto_flowlabel) 219 inp->inp_flags |= IN6P_AUTOFLOWLABEL; 220 #endif 221 INP_LOCK(inp); 222 inp->inp_gencnt = ++pcbinfo->ipi_gencnt; 223 224 #if defined(IPSEC) || defined(FAST_IPSEC) || defined(MAC) 225 out: 226 if (error != 0) 227 uma_zfree(pcbinfo->ipi_zone, inp); 228 #endif 229 return (error); 230 } 231 232 int 233 in_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct ucred *cred) 234 { 235 int anonport, error; 236 237 INP_INFO_WLOCK_ASSERT(inp->inp_pcbinfo); 238 INP_LOCK_ASSERT(inp); 239 240 if (inp->inp_lport != 0 || inp->inp_laddr.s_addr != INADDR_ANY) 241 return (EINVAL); 242 anonport = inp->inp_lport == 0 && (nam == NULL || 243 ((struct sockaddr_in *)nam)->sin_port == 0); 244 error = in_pcbbind_setup(inp, nam, &inp->inp_laddr.s_addr, 245 &inp->inp_lport, cred); 246 if (error) 247 return (error); 248 if (in_pcbinshash(inp) != 0) { 249 inp->inp_laddr.s_addr = INADDR_ANY; 250 inp->inp_lport = 0; 251 return (EAGAIN); 252 } 253 if (anonport) 254 inp->inp_flags |= INP_ANONPORT; 255 return (0); 256 } 257 258 /* 259 * Set up a bind operation on a PCB, performing port allocation 260 * as required, but do not actually modify the PCB. Callers can 261 * either complete the bind by setting inp_laddr/inp_lport and 262 * calling in_pcbinshash(), or they can just use the resulting 263 * port and address to authorise the sending of a once-off packet. 264 * 265 * On error, the values of *laddrp and *lportp are not changed. 266 */ 267 int 268 in_pcbbind_setup(struct inpcb *inp, struct sockaddr *nam, in_addr_t *laddrp, 269 u_short *lportp, struct ucred *cred) 270 { 271 struct socket *so = inp->inp_socket; 272 unsigned short *lastport; 273 struct sockaddr_in *sin; 274 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; 275 struct in_addr laddr; 276 u_short lport = 0; 277 int wild = 0, reuseport = (so->so_options & SO_REUSEPORT); 278 int error, prison = 0; 279 int dorandom; 280 281 INP_INFO_WLOCK_ASSERT(pcbinfo); 282 INP_LOCK_ASSERT(inp); 283 284 if (TAILQ_EMPTY(&in_ifaddrhead)) /* XXX broken! */ 285 return (EADDRNOTAVAIL); 286 laddr.s_addr = *laddrp; 287 if (nam != NULL && laddr.s_addr != INADDR_ANY) 288 return (EINVAL); 289 if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0) 290 wild = 1; 291 if (nam) { 292 sin = (struct sockaddr_in *)nam; 293 if (nam->sa_len != sizeof (*sin)) 294 return (EINVAL); 295 #ifdef notdef 296 /* 297 * We should check the family, but old programs 298 * incorrectly fail to initialize it. 299 */ 300 if (sin->sin_family != AF_INET) 301 return (EAFNOSUPPORT); 302 #endif 303 if (sin->sin_addr.s_addr != INADDR_ANY) 304 if (prison_ip(cred, 0, &sin->sin_addr.s_addr)) 305 return(EINVAL); 306 if (sin->sin_port != *lportp) { 307 /* Don't allow the port to change. */ 308 if (*lportp != 0) 309 return (EINVAL); 310 lport = sin->sin_port; 311 } 312 /* NB: lport is left as 0 if the port isn't being changed. */ 313 if (IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) { 314 /* 315 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast; 316 * allow complete duplication of binding if 317 * SO_REUSEPORT is set, or if SO_REUSEADDR is set 318 * and a multicast address is bound on both 319 * new and duplicated sockets. 320 */ 321 if (so->so_options & SO_REUSEADDR) 322 reuseport = SO_REUSEADDR|SO_REUSEPORT; 323 } else if (sin->sin_addr.s_addr != INADDR_ANY) { 324 sin->sin_port = 0; /* yech... */ 325 bzero(&sin->sin_zero, sizeof(sin->sin_zero)); 326 if (ifa_ifwithaddr((struct sockaddr *)sin) == 0) 327 return (EADDRNOTAVAIL); 328 } 329 laddr = sin->sin_addr; 330 if (lport) { 331 struct inpcb *t; 332 /* GROSS */ 333 if (ntohs(lport) <= ipport_reservedhigh && 334 ntohs(lport) >= ipport_reservedlow && 335 suser_cred(cred, SUSER_ALLOWJAIL)) 336 return (EACCES); 337 if (jailed(cred)) 338 prison = 1; 339 if (!IN_MULTICAST(ntohl(sin->sin_addr.s_addr)) && 340 suser_cred(so->so_cred, SUSER_ALLOWJAIL) != 0) { 341 t = in_pcblookup_local(inp->inp_pcbinfo, 342 sin->sin_addr, lport, 343 prison ? 0 : INPLOOKUP_WILDCARD); 344 /* 345 * XXX 346 * This entire block sorely needs a rewrite. 347 */ 348 if (t && 349 ((t->inp_vflag & INP_TIMEWAIT) == 0) && 350 (so->so_type != SOCK_STREAM || 351 ntohl(t->inp_faddr.s_addr) == INADDR_ANY) && 352 (ntohl(sin->sin_addr.s_addr) != INADDR_ANY || 353 ntohl(t->inp_laddr.s_addr) != INADDR_ANY || 354 (t->inp_socket->so_options & 355 SO_REUSEPORT) == 0) && 356 (so->so_cred->cr_uid != 357 t->inp_socket->so_cred->cr_uid)) 358 return (EADDRINUSE); 359 } 360 if (prison && prison_ip(cred, 0, &sin->sin_addr.s_addr)) 361 return (EADDRNOTAVAIL); 362 t = in_pcblookup_local(pcbinfo, sin->sin_addr, 363 lport, prison ? 0 : wild); 364 if (t && (t->inp_vflag & INP_TIMEWAIT)) { 365 if ((reuseport & intotw(t)->tw_so_options) == 0) 366 return (EADDRINUSE); 367 } else 368 if (t && 369 (reuseport & t->inp_socket->so_options) == 0) { 370 #if defined(INET6) 371 if (ntohl(sin->sin_addr.s_addr) != 372 INADDR_ANY || 373 ntohl(t->inp_laddr.s_addr) != 374 INADDR_ANY || 375 INP_SOCKAF(so) == 376 INP_SOCKAF(t->inp_socket)) 377 #endif /* defined(INET6) */ 378 return (EADDRINUSE); 379 } 380 } 381 } 382 if (*lportp != 0) 383 lport = *lportp; 384 if (lport == 0) { 385 u_short first, last; 386 int count; 387 388 if (laddr.s_addr != INADDR_ANY) 389 if (prison_ip(cred, 0, &laddr.s_addr)) 390 return (EINVAL); 391 392 if (inp->inp_flags & INP_HIGHPORT) { 393 first = ipport_hifirstauto; /* sysctl */ 394 last = ipport_hilastauto; 395 lastport = &pcbinfo->lasthi; 396 } else if (inp->inp_flags & INP_LOWPORT) { 397 if ((error = suser_cred(cred, SUSER_ALLOWJAIL)) != 0) 398 return error; 399 first = ipport_lowfirstauto; /* 1023 */ 400 last = ipport_lowlastauto; /* 600 */ 401 lastport = &pcbinfo->lastlow; 402 } else { 403 first = ipport_firstauto; /* sysctl */ 404 last = ipport_lastauto; 405 lastport = &pcbinfo->lastport; 406 } 407 /* 408 * For UDP, use random port allocation as long as the user 409 * allows it. For TCP (and as of yet unknown) connections, 410 * use random port allocation only if the user allows it AND 411 * ipport_tick() allows it. 412 */ 413 if (ipport_randomized && 414 (!ipport_stoprandom || pcbinfo == &udbinfo)) 415 dorandom = 1; 416 else 417 dorandom = 0; 418 /* 419 * It makes no sense to do random port allocation if 420 * we have the only port available. 421 */ 422 if (first == last) 423 dorandom = 0; 424 /* Make sure to not include UDP packets in the count. */ 425 if (pcbinfo != &udbinfo) 426 ipport_tcpallocs++; 427 /* 428 * Simple check to ensure all ports are not used up causing 429 * a deadlock here. 430 * 431 * We split the two cases (up and down) so that the direction 432 * is not being tested on each round of the loop. 433 */ 434 if (first > last) { 435 /* 436 * counting down 437 */ 438 if (dorandom) 439 *lastport = first - 440 (arc4random() % (first - last)); 441 count = first - last; 442 443 do { 444 if (count-- < 0) /* completely used? */ 445 return (EADDRNOTAVAIL); 446 --*lastport; 447 if (*lastport > first || *lastport < last) 448 *lastport = first; 449 lport = htons(*lastport); 450 } while (in_pcblookup_local(pcbinfo, laddr, lport, 451 wild)); 452 } else { 453 /* 454 * counting up 455 */ 456 if (dorandom) 457 *lastport = first + 458 (arc4random() % (last - first)); 459 count = last - first; 460 461 do { 462 if (count-- < 0) /* completely used? */ 463 return (EADDRNOTAVAIL); 464 ++*lastport; 465 if (*lastport < first || *lastport > last) 466 *lastport = first; 467 lport = htons(*lastport); 468 } while (in_pcblookup_local(pcbinfo, laddr, lport, 469 wild)); 470 } 471 } 472 if (prison_ip(cred, 0, &laddr.s_addr)) 473 return (EINVAL); 474 *laddrp = laddr.s_addr; 475 *lportp = lport; 476 return (0); 477 } 478 479 /* 480 * Connect from a socket to a specified address. 481 * Both address and port must be specified in argument sin. 482 * If don't have a local address for this socket yet, 483 * then pick one. 484 */ 485 int 486 in_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct ucred *cred) 487 { 488 u_short lport, fport; 489 in_addr_t laddr, faddr; 490 int anonport, error; 491 492 INP_INFO_WLOCK_ASSERT(inp->inp_pcbinfo); 493 INP_LOCK_ASSERT(inp); 494 495 lport = inp->inp_lport; 496 laddr = inp->inp_laddr.s_addr; 497 anonport = (lport == 0); 498 error = in_pcbconnect_setup(inp, nam, &laddr, &lport, &faddr, &fport, 499 NULL, cred); 500 if (error) 501 return (error); 502 503 /* Do the initial binding of the local address if required. */ 504 if (inp->inp_laddr.s_addr == INADDR_ANY && inp->inp_lport == 0) { 505 inp->inp_lport = lport; 506 inp->inp_laddr.s_addr = laddr; 507 if (in_pcbinshash(inp) != 0) { 508 inp->inp_laddr.s_addr = INADDR_ANY; 509 inp->inp_lport = 0; 510 return (EAGAIN); 511 } 512 } 513 514 /* Commit the remaining changes. */ 515 inp->inp_lport = lport; 516 inp->inp_laddr.s_addr = laddr; 517 inp->inp_faddr.s_addr = faddr; 518 inp->inp_fport = fport; 519 in_pcbrehash(inp); 520 #ifdef IPSEC 521 if (inp->inp_socket->so_type == SOCK_STREAM) 522 ipsec_pcbconn(inp->inp_sp); 523 #endif 524 if (anonport) 525 inp->inp_flags |= INP_ANONPORT; 526 return (0); 527 } 528 529 /* 530 * Set up for a connect from a socket to the specified address. 531 * On entry, *laddrp and *lportp should contain the current local 532 * address and port for the PCB; these are updated to the values 533 * that should be placed in inp_laddr and inp_lport to complete 534 * the connect. 535 * 536 * On success, *faddrp and *fportp will be set to the remote address 537 * and port. These are not updated in the error case. 538 * 539 * If the operation fails because the connection already exists, 540 * *oinpp will be set to the PCB of that connection so that the 541 * caller can decide to override it. In all other cases, *oinpp 542 * is set to NULL. 543 */ 544 int 545 in_pcbconnect_setup(struct inpcb *inp, struct sockaddr *nam, 546 in_addr_t *laddrp, u_short *lportp, in_addr_t *faddrp, u_short *fportp, 547 struct inpcb **oinpp, struct ucred *cred) 548 { 549 struct sockaddr_in *sin = (struct sockaddr_in *)nam; 550 struct in_ifaddr *ia; 551 struct sockaddr_in sa; 552 struct ucred *socred; 553 struct inpcb *oinp; 554 struct in_addr laddr, faddr; 555 u_short lport, fport; 556 int error; 557 558 INP_INFO_WLOCK_ASSERT(inp->inp_pcbinfo); 559 INP_LOCK_ASSERT(inp); 560 561 if (oinpp != NULL) 562 *oinpp = NULL; 563 if (nam->sa_len != sizeof (*sin)) 564 return (EINVAL); 565 if (sin->sin_family != AF_INET) 566 return (EAFNOSUPPORT); 567 if (sin->sin_port == 0) 568 return (EADDRNOTAVAIL); 569 laddr.s_addr = *laddrp; 570 lport = *lportp; 571 faddr = sin->sin_addr; 572 fport = sin->sin_port; 573 socred = inp->inp_socket->so_cred; 574 if (laddr.s_addr == INADDR_ANY && jailed(socred)) { 575 bzero(&sa, sizeof(sa)); 576 sa.sin_addr.s_addr = htonl(prison_getip(socred)); 577 sa.sin_len = sizeof(sa); 578 sa.sin_family = AF_INET; 579 error = in_pcbbind_setup(inp, (struct sockaddr *)&sa, 580 &laddr.s_addr, &lport, cred); 581 if (error) 582 return (error); 583 } 584 if (!TAILQ_EMPTY(&in_ifaddrhead)) { 585 /* 586 * If the destination address is INADDR_ANY, 587 * use the primary local address. 588 * If the supplied address is INADDR_BROADCAST, 589 * and the primary interface supports broadcast, 590 * choose the broadcast address for that interface. 591 */ 592 if (faddr.s_addr == INADDR_ANY) 593 faddr = IA_SIN(TAILQ_FIRST(&in_ifaddrhead))->sin_addr; 594 else if (faddr.s_addr == (u_long)INADDR_BROADCAST && 595 (TAILQ_FIRST(&in_ifaddrhead)->ia_ifp->if_flags & 596 IFF_BROADCAST)) 597 faddr = satosin(&TAILQ_FIRST( 598 &in_ifaddrhead)->ia_broadaddr)->sin_addr; 599 } 600 if (laddr.s_addr == INADDR_ANY) { 601 struct route sro; 602 603 bzero(&sro, sizeof(sro)); 604 ia = (struct in_ifaddr *)0; 605 /* 606 * If route is known our src addr is taken from the i/f, 607 * else punt. 608 */ 609 if ((inp->inp_socket->so_options & SO_DONTROUTE) == 0) { 610 /* Find out route to destination */ 611 sro.ro_dst.sa_family = AF_INET; 612 sro.ro_dst.sa_len = sizeof(struct sockaddr_in); 613 ((struct sockaddr_in *)&sro.ro_dst)->sin_addr = faddr; 614 rtalloc_ign(&sro, RTF_CLONING); 615 } 616 /* 617 * If we found a route, use the address 618 * corresponding to the outgoing interface. 619 */ 620 if (sro.ro_rt) { 621 ia = ifatoia(sro.ro_rt->rt_ifa); 622 RTFREE(sro.ro_rt); 623 } 624 if (ia == 0) { 625 bzero(&sa, sizeof(sa)); 626 sa.sin_addr = faddr; 627 sa.sin_len = sizeof(sa); 628 sa.sin_family = AF_INET; 629 630 ia = ifatoia(ifa_ifwithdstaddr(sintosa(&sa))); 631 if (ia == 0) 632 ia = ifatoia(ifa_ifwithnet(sintosa(&sa))); 633 if (ia == 0) 634 return (ENETUNREACH); 635 } 636 /* 637 * If the destination address is multicast and an outgoing 638 * interface has been set as a multicast option, use the 639 * address of that interface as our source address. 640 */ 641 if (IN_MULTICAST(ntohl(faddr.s_addr)) && 642 inp->inp_moptions != NULL) { 643 struct ip_moptions *imo; 644 struct ifnet *ifp; 645 646 imo = inp->inp_moptions; 647 if (imo->imo_multicast_ifp != NULL) { 648 ifp = imo->imo_multicast_ifp; 649 TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) 650 if (ia->ia_ifp == ifp) 651 break; 652 if (ia == 0) 653 return (EADDRNOTAVAIL); 654 } 655 } 656 laddr = ia->ia_addr.sin_addr; 657 } 658 659 oinp = in_pcblookup_hash(inp->inp_pcbinfo, faddr, fport, laddr, lport, 660 0, NULL); 661 if (oinp != NULL) { 662 if (oinpp != NULL) 663 *oinpp = oinp; 664 return (EADDRINUSE); 665 } 666 if (lport == 0) { 667 error = in_pcbbind_setup(inp, NULL, &laddr.s_addr, &lport, 668 cred); 669 if (error) 670 return (error); 671 } 672 *laddrp = laddr.s_addr; 673 *lportp = lport; 674 *faddrp = faddr.s_addr; 675 *fportp = fport; 676 return (0); 677 } 678 679 void 680 in_pcbdisconnect(struct inpcb *inp) 681 { 682 683 INP_INFO_WLOCK_ASSERT(inp->inp_pcbinfo); 684 INP_LOCK_ASSERT(inp); 685 686 inp->inp_faddr.s_addr = INADDR_ANY; 687 inp->inp_fport = 0; 688 in_pcbrehash(inp); 689 #ifdef IPSEC 690 ipsec_pcbdisconn(inp->inp_sp); 691 #endif 692 if (inp->inp_socket->so_state & SS_NOFDREF) 693 in_pcbdetach(inp); 694 } 695 696 void 697 in_pcbdetach(struct inpcb *inp) 698 { 699 struct socket *so = inp->inp_socket; 700 struct inpcbinfo *ipi = inp->inp_pcbinfo; 701 702 INP_INFO_WLOCK_ASSERT(ipi); 703 INP_LOCK_ASSERT(inp); 704 705 #if defined(IPSEC) || defined(FAST_IPSEC) 706 ipsec4_delete_pcbpolicy(inp); 707 #endif /*IPSEC*/ 708 inp->inp_gencnt = ++ipi->ipi_gencnt; 709 in_pcbremlists(inp); 710 if (so) { 711 ACCEPT_LOCK(); 712 SOCK_LOCK(so); 713 so->so_pcb = NULL; 714 sotryfree(so); 715 } 716 if (inp->inp_options) 717 (void)m_free(inp->inp_options); 718 ip_freemoptions(inp->inp_moptions); 719 inp->inp_vflag = 0; 720 721 #ifdef MAC 722 mac_destroy_inpcb(inp); 723 #endif 724 INP_UNLOCK(inp); 725 uma_zfree(ipi->ipi_zone, inp); 726 } 727 728 struct sockaddr * 729 in_sockaddr(in_port_t port, struct in_addr *addr_p) 730 { 731 struct sockaddr_in *sin; 732 733 MALLOC(sin, struct sockaddr_in *, sizeof *sin, M_SONAME, 734 M_WAITOK | M_ZERO); 735 sin->sin_family = AF_INET; 736 sin->sin_len = sizeof(*sin); 737 sin->sin_addr = *addr_p; 738 sin->sin_port = port; 739 740 return (struct sockaddr *)sin; 741 } 742 743 /* 744 * The wrapper function will pass down the pcbinfo for this function to lock. 745 * The socket must have a valid 746 * (i.e., non-nil) PCB, but it should be impossible to get an invalid one 747 * except through a kernel programming error, so it is acceptable to panic 748 * (or in this case trap) if the PCB is invalid. (Actually, we don't trap 749 * because there actually /is/ a programming error somewhere... XXX) 750 */ 751 int 752 in_setsockaddr(struct socket *so, struct sockaddr **nam, 753 struct inpcbinfo *pcbinfo) 754 { 755 struct inpcb *inp; 756 struct in_addr addr; 757 in_port_t port; 758 759 INP_INFO_RLOCK(pcbinfo); 760 inp = sotoinpcb(so); 761 if (!inp) { 762 INP_INFO_RUNLOCK(pcbinfo); 763 return ECONNRESET; 764 } 765 INP_LOCK(inp); 766 port = inp->inp_lport; 767 addr = inp->inp_laddr; 768 INP_UNLOCK(inp); 769 INP_INFO_RUNLOCK(pcbinfo); 770 771 *nam = in_sockaddr(port, &addr); 772 return 0; 773 } 774 775 /* 776 * The wrapper function will pass down the pcbinfo for this function to lock. 777 */ 778 int 779 in_setpeeraddr(struct socket *so, struct sockaddr **nam, 780 struct inpcbinfo *pcbinfo) 781 { 782 struct inpcb *inp; 783 struct in_addr addr; 784 in_port_t port; 785 786 INP_INFO_RLOCK(pcbinfo); 787 inp = sotoinpcb(so); 788 if (!inp) { 789 INP_INFO_RUNLOCK(pcbinfo); 790 return ECONNRESET; 791 } 792 INP_LOCK(inp); 793 port = inp->inp_fport; 794 addr = inp->inp_faddr; 795 INP_UNLOCK(inp); 796 INP_INFO_RUNLOCK(pcbinfo); 797 798 *nam = in_sockaddr(port, &addr); 799 return 0; 800 } 801 802 void 803 in_pcbnotifyall(struct inpcbinfo *pcbinfo, struct in_addr faddr, int errno, 804 struct inpcb *(*notify)(struct inpcb *, int)) 805 { 806 struct inpcb *inp, *ninp; 807 struct inpcbhead *head; 808 809 INP_INFO_WLOCK(pcbinfo); 810 head = pcbinfo->listhead; 811 for (inp = LIST_FIRST(head); inp != NULL; inp = ninp) { 812 INP_LOCK(inp); 813 ninp = LIST_NEXT(inp, inp_list); 814 #ifdef INET6 815 if ((inp->inp_vflag & INP_IPV4) == 0) { 816 INP_UNLOCK(inp); 817 continue; 818 } 819 #endif 820 if (inp->inp_faddr.s_addr != faddr.s_addr || 821 inp->inp_socket == NULL) { 822 INP_UNLOCK(inp); 823 continue; 824 } 825 if ((*notify)(inp, errno)) 826 INP_UNLOCK(inp); 827 } 828 INP_INFO_WUNLOCK(pcbinfo); 829 } 830 831 void 832 in_pcbpurgeif0(struct inpcbinfo *pcbinfo, struct ifnet *ifp) 833 { 834 struct inpcb *inp; 835 struct ip_moptions *imo; 836 int i, gap; 837 838 INP_INFO_RLOCK(pcbinfo); 839 LIST_FOREACH(inp, pcbinfo->listhead, inp_list) { 840 INP_LOCK(inp); 841 imo = inp->inp_moptions; 842 if ((inp->inp_vflag & INP_IPV4) && 843 imo != NULL) { 844 /* 845 * Unselect the outgoing interface if it is being 846 * detached. 847 */ 848 if (imo->imo_multicast_ifp == ifp) 849 imo->imo_multicast_ifp = NULL; 850 851 /* 852 * Drop multicast group membership if we joined 853 * through the interface being detached. 854 */ 855 for (i = 0, gap = 0; i < imo->imo_num_memberships; 856 i++) { 857 if (imo->imo_membership[i]->inm_ifp == ifp) { 858 in_delmulti(imo->imo_membership[i]); 859 gap++; 860 } else if (gap != 0) 861 imo->imo_membership[i - gap] = 862 imo->imo_membership[i]; 863 } 864 imo->imo_num_memberships -= gap; 865 } 866 INP_UNLOCK(inp); 867 } 868 INP_INFO_RUNLOCK(pcbinfo); 869 } 870 871 /* 872 * Lookup a PCB based on the local address and port. 873 */ 874 #define INP_LOOKUP_MAPPED_PCB_COST 3 875 struct inpcb * 876 in_pcblookup_local(struct inpcbinfo *pcbinfo, struct in_addr laddr, 877 u_int lport_arg, int wild_okay) 878 { 879 struct inpcb *inp; 880 #ifdef INET6 881 int matchwild = 3 + INP_LOOKUP_MAPPED_PCB_COST; 882 #else 883 int matchwild = 3; 884 #endif 885 int wildcard; 886 u_short lport = lport_arg; 887 888 INP_INFO_WLOCK_ASSERT(pcbinfo); 889 890 if (!wild_okay) { 891 struct inpcbhead *head; 892 /* 893 * Look for an unconnected (wildcard foreign addr) PCB that 894 * matches the local address and port we're looking for. 895 */ 896 head = &pcbinfo->hashbase[INP_PCBHASH(INADDR_ANY, lport, 0, pcbinfo->hashmask)]; 897 LIST_FOREACH(inp, head, inp_hash) { 898 #ifdef INET6 899 if ((inp->inp_vflag & INP_IPV4) == 0) 900 continue; 901 #endif 902 if (inp->inp_faddr.s_addr == INADDR_ANY && 903 inp->inp_laddr.s_addr == laddr.s_addr && 904 inp->inp_lport == lport) { 905 /* 906 * Found. 907 */ 908 return (inp); 909 } 910 } 911 /* 912 * Not found. 913 */ 914 return (NULL); 915 } else { 916 struct inpcbporthead *porthash; 917 struct inpcbport *phd; 918 struct inpcb *match = NULL; 919 /* 920 * Best fit PCB lookup. 921 * 922 * First see if this local port is in use by looking on the 923 * port hash list. 924 */ 925 porthash = &pcbinfo->porthashbase[INP_PCBPORTHASH(lport, 926 pcbinfo->porthashmask)]; 927 LIST_FOREACH(phd, porthash, phd_hash) { 928 if (phd->phd_port == lport) 929 break; 930 } 931 if (phd != NULL) { 932 /* 933 * Port is in use by one or more PCBs. Look for best 934 * fit. 935 */ 936 LIST_FOREACH(inp, &phd->phd_pcblist, inp_portlist) { 937 wildcard = 0; 938 #ifdef INET6 939 if ((inp->inp_vflag & INP_IPV4) == 0) 940 continue; 941 /* 942 * We never select the PCB that has 943 * INP_IPV6 flag and is bound to :: if 944 * we have another PCB which is bound 945 * to 0.0.0.0. If a PCB has the 946 * INP_IPV6 flag, then we set its cost 947 * higher than IPv4 only PCBs. 948 * 949 * Note that the case only happens 950 * when a socket is bound to ::, under 951 * the condition that the use of the 952 * mapped address is allowed. 953 */ 954 if ((inp->inp_vflag & INP_IPV6) != 0) 955 wildcard += INP_LOOKUP_MAPPED_PCB_COST; 956 #endif 957 if (inp->inp_faddr.s_addr != INADDR_ANY) 958 wildcard++; 959 if (inp->inp_laddr.s_addr != INADDR_ANY) { 960 if (laddr.s_addr == INADDR_ANY) 961 wildcard++; 962 else if (inp->inp_laddr.s_addr != laddr.s_addr) 963 continue; 964 } else { 965 if (laddr.s_addr != INADDR_ANY) 966 wildcard++; 967 } 968 if (wildcard < matchwild) { 969 match = inp; 970 matchwild = wildcard; 971 if (matchwild == 0) { 972 break; 973 } 974 } 975 } 976 } 977 return (match); 978 } 979 } 980 #undef INP_LOOKUP_MAPPED_PCB_COST 981 982 /* 983 * Lookup PCB in hash list. 984 */ 985 struct inpcb * 986 in_pcblookup_hash(struct inpcbinfo *pcbinfo, struct in_addr faddr, 987 u_int fport_arg, struct in_addr laddr, u_int lport_arg, int wildcard, 988 struct ifnet *ifp) 989 { 990 struct inpcbhead *head; 991 struct inpcb *inp; 992 u_short fport = fport_arg, lport = lport_arg; 993 994 INP_INFO_RLOCK_ASSERT(pcbinfo); 995 /* 996 * First look for an exact match. 997 */ 998 head = &pcbinfo->hashbase[INP_PCBHASH(faddr.s_addr, lport, fport, pcbinfo->hashmask)]; 999 LIST_FOREACH(inp, head, inp_hash) { 1000 #ifdef INET6 1001 if ((inp->inp_vflag & INP_IPV4) == 0) 1002 continue; 1003 #endif 1004 if (inp->inp_faddr.s_addr == faddr.s_addr && 1005 inp->inp_laddr.s_addr == laddr.s_addr && 1006 inp->inp_fport == fport && 1007 inp->inp_lport == lport) { 1008 /* 1009 * Found. 1010 */ 1011 return (inp); 1012 } 1013 } 1014 if (wildcard) { 1015 struct inpcb *local_wild = NULL; 1016 #if defined(INET6) 1017 struct inpcb *local_wild_mapped = NULL; 1018 #endif /* defined(INET6) */ 1019 1020 head = &pcbinfo->hashbase[INP_PCBHASH(INADDR_ANY, lport, 0, pcbinfo->hashmask)]; 1021 LIST_FOREACH(inp, head, inp_hash) { 1022 #ifdef INET6 1023 if ((inp->inp_vflag & INP_IPV4) == 0) 1024 continue; 1025 #endif 1026 if (inp->inp_faddr.s_addr == INADDR_ANY && 1027 inp->inp_lport == lport) { 1028 if (ifp && ifp->if_type == IFT_FAITH && 1029 (inp->inp_flags & INP_FAITH) == 0) 1030 continue; 1031 if (inp->inp_laddr.s_addr == laddr.s_addr) 1032 return (inp); 1033 else if (inp->inp_laddr.s_addr == INADDR_ANY) { 1034 #if defined(INET6) 1035 if (INP_CHECK_SOCKAF(inp->inp_socket, 1036 AF_INET6)) 1037 local_wild_mapped = inp; 1038 else 1039 #endif /* defined(INET6) */ 1040 local_wild = inp; 1041 } 1042 } 1043 } 1044 #if defined(INET6) 1045 if (local_wild == NULL) 1046 return (local_wild_mapped); 1047 #endif /* defined(INET6) */ 1048 return (local_wild); 1049 } 1050 1051 /* 1052 * Not found. 1053 */ 1054 return (NULL); 1055 } 1056 1057 /* 1058 * Insert PCB onto various hash lists. 1059 */ 1060 int 1061 in_pcbinshash(struct inpcb *inp) 1062 { 1063 struct inpcbhead *pcbhash; 1064 struct inpcbporthead *pcbporthash; 1065 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; 1066 struct inpcbport *phd; 1067 u_int32_t hashkey_faddr; 1068 1069 INP_INFO_WLOCK_ASSERT(pcbinfo); 1070 #ifdef INET6 1071 if (inp->inp_vflag & INP_IPV6) 1072 hashkey_faddr = inp->in6p_faddr.s6_addr32[3] /* XXX */; 1073 else 1074 #endif /* INET6 */ 1075 hashkey_faddr = inp->inp_faddr.s_addr; 1076 1077 pcbhash = &pcbinfo->hashbase[INP_PCBHASH(hashkey_faddr, 1078 inp->inp_lport, inp->inp_fport, pcbinfo->hashmask)]; 1079 1080 pcbporthash = &pcbinfo->porthashbase[INP_PCBPORTHASH(inp->inp_lport, 1081 pcbinfo->porthashmask)]; 1082 1083 /* 1084 * Go through port list and look for a head for this lport. 1085 */ 1086 LIST_FOREACH(phd, pcbporthash, phd_hash) { 1087 if (phd->phd_port == inp->inp_lport) 1088 break; 1089 } 1090 /* 1091 * If none exists, malloc one and tack it on. 1092 */ 1093 if (phd == NULL) { 1094 MALLOC(phd, struct inpcbport *, sizeof(struct inpcbport), M_PCB, M_NOWAIT); 1095 if (phd == NULL) { 1096 return (ENOBUFS); /* XXX */ 1097 } 1098 phd->phd_port = inp->inp_lport; 1099 LIST_INIT(&phd->phd_pcblist); 1100 LIST_INSERT_HEAD(pcbporthash, phd, phd_hash); 1101 } 1102 inp->inp_phd = phd; 1103 LIST_INSERT_HEAD(&phd->phd_pcblist, inp, inp_portlist); 1104 LIST_INSERT_HEAD(pcbhash, inp, inp_hash); 1105 return (0); 1106 } 1107 1108 /* 1109 * Move PCB to the proper hash bucket when { faddr, fport } have been 1110 * changed. NOTE: This does not handle the case of the lport changing (the 1111 * hashed port list would have to be updated as well), so the lport must 1112 * not change after in_pcbinshash() has been called. 1113 */ 1114 void 1115 in_pcbrehash(struct inpcb *inp) 1116 { 1117 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; 1118 struct inpcbhead *head; 1119 u_int32_t hashkey_faddr; 1120 1121 INP_INFO_WLOCK_ASSERT(pcbinfo); 1122 INP_LOCK_ASSERT(inp); 1123 #ifdef INET6 1124 if (inp->inp_vflag & INP_IPV6) 1125 hashkey_faddr = inp->in6p_faddr.s6_addr32[3] /* XXX */; 1126 else 1127 #endif /* INET6 */ 1128 hashkey_faddr = inp->inp_faddr.s_addr; 1129 1130 head = &pcbinfo->hashbase[INP_PCBHASH(hashkey_faddr, 1131 inp->inp_lport, inp->inp_fport, pcbinfo->hashmask)]; 1132 1133 LIST_REMOVE(inp, inp_hash); 1134 LIST_INSERT_HEAD(head, inp, inp_hash); 1135 } 1136 1137 /* 1138 * Remove PCB from various lists. 1139 */ 1140 void 1141 in_pcbremlists(struct inpcb *inp) 1142 { 1143 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; 1144 1145 INP_INFO_WLOCK_ASSERT(pcbinfo); 1146 INP_LOCK_ASSERT(inp); 1147 1148 inp->inp_gencnt = ++pcbinfo->ipi_gencnt; 1149 if (inp->inp_lport) { 1150 struct inpcbport *phd = inp->inp_phd; 1151 1152 LIST_REMOVE(inp, inp_hash); 1153 LIST_REMOVE(inp, inp_portlist); 1154 if (LIST_FIRST(&phd->phd_pcblist) == NULL) { 1155 LIST_REMOVE(phd, phd_hash); 1156 free(phd, M_PCB); 1157 } 1158 } 1159 LIST_REMOVE(inp, inp_list); 1160 pcbinfo->ipi_count--; 1161 } 1162 1163 /* 1164 * A set label operation has occurred at the socket layer, propagate the 1165 * label change into the in_pcb for the socket. 1166 */ 1167 void 1168 in_pcbsosetlabel(struct socket *so) 1169 { 1170 #ifdef MAC 1171 struct inpcb *inp; 1172 1173 inp = (struct inpcb *)so->so_pcb; 1174 INP_LOCK(inp); 1175 SOCK_LOCK(so); 1176 mac_inpcb_sosetlabel(so, inp); 1177 SOCK_UNLOCK(so); 1178 INP_UNLOCK(inp); 1179 #endif 1180 } 1181 1182 /* 1183 * ipport_tick runs once per second, determining if random port 1184 * allocation should be continued. If more than ipport_randomcps 1185 * ports have been allocated in the last second, then we return to 1186 * sequential port allocation. We return to random allocation only 1187 * once we drop below ipport_randomcps for at least ipport_randomtime 1188 * seconds. 1189 */ 1190 1191 void 1192 ipport_tick(void *xtp) 1193 { 1194 if (ipport_tcpallocs > ipport_tcplastcount + ipport_randomcps) { 1195 ipport_stoprandom = ipport_randomtime; 1196 } else { 1197 if (ipport_stoprandom > 0) 1198 ipport_stoprandom--; 1199 } 1200 ipport_tcplastcount = ipport_tcpallocs; 1201 callout_reset(&ipport_tick_callout, hz, ipport_tick, NULL); 1202 }
Cache object: c7cade5f607e2e04ac4831cbfcc7854e
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]