1 /*-
2 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3 * The Regents of the University of California.
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 4. Neither the name of the University nor the names of its contributors
15 * may be used to endorse or promote products derived from this software
16 * without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 *
30 * @(#)udp_usrreq.c 8.6 (Berkeley) 5/23/95
31 */
32
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35
36 #include "opt_ipfw.h"
37 #include "opt_inet6.h"
38 #include "opt_ipsec.h"
39 #include "opt_mac.h"
40
41 #include <sys/param.h>
42 #include <sys/domain.h>
43 #include <sys/eventhandler.h>
44 #include <sys/jail.h>
45 #include <sys/kernel.h>
46 #include <sys/lock.h>
47 #include <sys/malloc.h>
48 #include <sys/mbuf.h>
49 #include <sys/priv.h>
50 #include <sys/proc.h>
51 #include <sys/protosw.h>
52 #include <sys/signalvar.h>
53 #include <sys/socket.h>
54 #include <sys/socketvar.h>
55 #include <sys/sx.h>
56 #include <sys/sysctl.h>
57 #include <sys/syslog.h>
58 #include <sys/systm.h>
59
60 #include <vm/uma.h>
61
62 #include <net/if.h>
63 #include <net/route.h>
64
65 #include <netinet/in.h>
66 #include <netinet/in_pcb.h>
67 #include <netinet/in_systm.h>
68 #include <netinet/in_var.h>
69 #include <netinet/ip.h>
70 #ifdef INET6
71 #include <netinet/ip6.h>
72 #endif
73 #include <netinet/ip_icmp.h>
74 #include <netinet/icmp_var.h>
75 #include <netinet/ip_var.h>
76 #include <netinet/ip_options.h>
77 #ifdef INET6
78 #include <netinet6/ip6_var.h>
79 #endif
80 #include <netinet/udp.h>
81 #include <netinet/udp_var.h>
82
83 #ifdef IPSEC
84 #include <netipsec/ipsec.h>
85 #endif
86
87 #include <machine/in_cksum.h>
88
89 #include <security/mac/mac_framework.h>
90
91 /*
92 * UDP protocol implementation.
93 * Per RFC 768, August, 1980.
94 */
95
96 /*
97 * BSD 4.2 defaulted the udp checksum to be off. Turning off udp checksums
98 * removes the only data integrity mechanism for packets and malformed
99 * packets that would otherwise be discarded due to bad checksums, and may
100 * cause problems (especially for NFS data blocks).
101 */
102 static int udp_cksum = 1;
103 SYSCTL_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum, CTLFLAG_RW, &udp_cksum,
104 0, "");
105
106 int udp_log_in_vain = 0;
107 SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_RW,
108 &udp_log_in_vain, 0, "Log all incoming UDP packets");
109
110 int udp_blackhole = 0;
111 SYSCTL_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_RW, &udp_blackhole, 0,
112 "Do not send port unreachables for refused connects");
113
114 u_long udp_sendspace = 9216; /* really max datagram size */
115 /* 40 1K datagrams */
116 SYSCTL_ULONG(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram, CTLFLAG_RW,
117 &udp_sendspace, 0, "Maximum outgoing UDP datagram size");
118
119 u_long udp_recvspace = 40 * (1024 +
120 #ifdef INET6
121 sizeof(struct sockaddr_in6)
122 #else
123 sizeof(struct sockaddr_in)
124 #endif
125 );
126
127 SYSCTL_ULONG(_net_inet_udp, UDPCTL_RECVSPACE, recvspace, CTLFLAG_RW,
128 &udp_recvspace, 0, "Maximum space for incoming UDP datagrams");
129
130 struct inpcbhead udb; /* from udp_var.h */
131 struct inpcbinfo udbinfo;
132
133 #ifndef UDBHASHSIZE
134 #define UDBHASHSIZE 16
135 #endif
136
137 struct udpstat udpstat; /* from udp_var.h */
138 SYSCTL_STRUCT(_net_inet_udp, UDPCTL_STATS, stats, CTLFLAG_RW, &udpstat,
139 udpstat, "UDP statistics (struct udpstat, netinet/udp_var.h)");
140
141 static void udp_detach(struct socket *so);
142 static int udp_output(struct inpcb *, struct mbuf *, struct sockaddr *,
143 struct mbuf *, struct thread *);
144
145 static void
146 udp_zone_change(void *tag)
147 {
148
149 uma_zone_set_max(udbinfo.ipi_zone, maxsockets);
150 }
151
152 static int
153 udp_inpcb_init(void *mem, int size, int flags)
154 {
155 struct inpcb *inp;
156
157 inp = mem;
158 INP_LOCK_INIT(inp, "inp", "udpinp");
159 return (0);
160 }
161
162 void
163 udp_init(void)
164 {
165
166 INP_INFO_LOCK_INIT(&udbinfo, "udp");
167 LIST_INIT(&udb);
168 udbinfo.ipi_listhead = &udb;
169 udbinfo.ipi_hashbase = hashinit(UDBHASHSIZE, M_PCB,
170 &udbinfo.ipi_hashmask);
171 udbinfo.ipi_porthashbase = hashinit(UDBHASHSIZE, M_PCB,
172 &udbinfo.ipi_porthashmask);
173 udbinfo.ipi_zone = uma_zcreate("udpcb", sizeof(struct inpcb), NULL,
174 NULL, udp_inpcb_init, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
175 uma_zone_set_max(udbinfo.ipi_zone, maxsockets);
176 EVENTHANDLER_REGISTER(maxsockets_change, udp_zone_change, NULL,
177 EVENTHANDLER_PRI_ANY);
178 }
179
180 /*
181 * Subroutine of udp_input(), which appends the provided mbuf chain to the
182 * passed pcb/socket. The caller must provide a sockaddr_in via udp_in that
183 * contains the source address. If the socket ends up being an IPv6 socket,
184 * udp_append() will convert to a sockaddr_in6 before passing the address
185 * into the socket code.
186 */
187 static void
188 udp_append(struct inpcb *inp, struct ip *ip, struct mbuf *n, int off,
189 struct sockaddr_in *udp_in)
190 {
191 struct sockaddr *append_sa;
192 struct socket *so;
193 struct mbuf *opts = 0;
194 #ifdef INET6
195 struct sockaddr_in6 udp_in6;
196 #endif
197
198 INP_LOCK_ASSERT(inp);
199
200 #ifdef IPSEC
201 /* Check AH/ESP integrity. */
202 if (ipsec4_in_reject(n, inp)) {
203 m_freem(n);
204 ipsec4stat.in_polvio++;
205 return;
206 }
207 #endif /* IPSEC */
208 #ifdef MAC
209 if (mac_check_inpcb_deliver(inp, n) != 0) {
210 m_freem(n);
211 return;
212 }
213 #endif
214 if (inp->inp_flags & INP_CONTROLOPTS ||
215 inp->inp_socket->so_options & (SO_TIMESTAMP | SO_BINTIME)) {
216 #ifdef INET6
217 if (inp->inp_vflag & INP_IPV6) {
218 int savedflags;
219
220 savedflags = inp->inp_flags;
221 inp->inp_flags &= ~INP_UNMAPPABLEOPTS;
222 ip6_savecontrol(inp, n, &opts);
223 inp->inp_flags = savedflags;
224 } else
225 #endif
226 ip_savecontrol(inp, &opts, ip, n);
227 }
228 #ifdef INET6
229 if (inp->inp_vflag & INP_IPV6) {
230 bzero(&udp_in6, sizeof(udp_in6));
231 udp_in6.sin6_len = sizeof(udp_in6);
232 udp_in6.sin6_family = AF_INET6;
233 in6_sin_2_v4mapsin6(udp_in, &udp_in6);
234 append_sa = (struct sockaddr *)&udp_in6;
235 } else
236 #endif
237 append_sa = (struct sockaddr *)udp_in;
238 m_adj(n, off);
239
240 so = inp->inp_socket;
241 SOCKBUF_LOCK(&so->so_rcv);
242 if (sbappendaddr_locked(&so->so_rcv, append_sa, n, opts) == 0) {
243 SOCKBUF_UNLOCK(&so->so_rcv);
244 m_freem(n);
245 if (opts)
246 m_freem(opts);
247 udpstat.udps_fullsock++;
248 } else
249 sorwakeup_locked(so);
250 }
251
252 void
253 udp_input(struct mbuf *m, int off)
254 {
255 int iphlen = off;
256 struct ip *ip;
257 struct udphdr *uh;
258 struct ifnet *ifp;
259 struct inpcb *inp;
260 int len;
261 struct ip save_ip;
262 struct sockaddr_in udp_in;
263 #ifdef IPFIREWALL_FORWARD
264 struct m_tag *fwd_tag;
265 #endif
266
267 ifp = m->m_pkthdr.rcvif;
268 udpstat.udps_ipackets++;
269
270 /*
271 * Strip IP options, if any; should skip this, make available to
272 * user, and use on returned packets, but we don't yet have a way to
273 * check the checksum with options still present.
274 */
275 if (iphlen > sizeof (struct ip)) {
276 ip_stripoptions(m, (struct mbuf *)0);
277 iphlen = sizeof(struct ip);
278 }
279
280 /*
281 * Get IP and UDP header together in first mbuf.
282 */
283 ip = mtod(m, struct ip *);
284 if (m->m_len < iphlen + sizeof(struct udphdr)) {
285 if ((m = m_pullup(m, iphlen + sizeof(struct udphdr))) == 0) {
286 udpstat.udps_hdrops++;
287 return;
288 }
289 ip = mtod(m, struct ip *);
290 }
291 uh = (struct udphdr *)((caddr_t)ip + iphlen);
292
293 /*
294 * Destination port of 0 is illegal, based on RFC768.
295 */
296 if (uh->uh_dport == 0)
297 goto badunlocked;
298
299 /*
300 * Construct sockaddr format source address. Stuff source address
301 * and datagram in user buffer.
302 */
303 bzero(&udp_in, sizeof(udp_in));
304 udp_in.sin_len = sizeof(udp_in);
305 udp_in.sin_family = AF_INET;
306 udp_in.sin_port = uh->uh_sport;
307 udp_in.sin_addr = ip->ip_src;
308
309 /*
310 * Make mbuf data length reflect UDP length. If not enough data to
311 * reflect UDP length, drop.
312 */
313 len = ntohs((u_short)uh->uh_ulen);
314 if (ip->ip_len != len) {
315 if (len > ip->ip_len || len < sizeof(struct udphdr)) {
316 udpstat.udps_badlen++;
317 goto badunlocked;
318 }
319 m_adj(m, len - ip->ip_len);
320 /* ip->ip_len = len; */
321 }
322
323 /*
324 * Save a copy of the IP header in case we want restore it for
325 * sending an ICMP error message in response.
326 */
327 if (!udp_blackhole)
328 save_ip = *ip;
329 else
330 memset(&save_ip, 0, sizeof(save_ip));
331
332 /*
333 * Checksum extended UDP header and data.
334 */
335 if (uh->uh_sum) {
336 u_short uh_sum;
337
338 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
339 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
340 uh_sum = m->m_pkthdr.csum_data;
341 else
342 uh_sum = in_pseudo(ip->ip_src.s_addr,
343 ip->ip_dst.s_addr, htonl((u_short)len +
344 m->m_pkthdr.csum_data + IPPROTO_UDP));
345 uh_sum ^= 0xffff;
346 } else {
347 char b[9];
348
349 bcopy(((struct ipovly *)ip)->ih_x1, b, 9);
350 bzero(((struct ipovly *)ip)->ih_x1, 9);
351 ((struct ipovly *)ip)->ih_len = uh->uh_ulen;
352 uh_sum = in_cksum(m, len + sizeof (struct ip));
353 bcopy(b, ((struct ipovly *)ip)->ih_x1, 9);
354 }
355 if (uh_sum) {
356 udpstat.udps_badsum++;
357 m_freem(m);
358 return;
359 }
360 } else
361 udpstat.udps_nosum++;
362
363 #ifdef IPFIREWALL_FORWARD
364 /*
365 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
366 */
367 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
368 if (fwd_tag != NULL) {
369 struct sockaddr_in *next_hop;
370
371 /*
372 * Do the hack.
373 */
374 next_hop = (struct sockaddr_in *)(fwd_tag + 1);
375 ip->ip_dst = next_hop->sin_addr;
376 uh->uh_dport = ntohs(next_hop->sin_port);
377
378 /*
379 * Remove the tag from the packet. We don't need it anymore.
380 */
381 m_tag_delete(m, fwd_tag);
382 }
383 #endif
384
385 INP_INFO_RLOCK(&udbinfo);
386 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
387 in_broadcast(ip->ip_dst, ifp)) {
388 struct inpcb *last;
389 struct ip_moptions *imo;
390
391 last = NULL;
392 LIST_FOREACH(inp, &udb, inp_list) {
393 if (inp->inp_lport != uh->uh_dport)
394 continue;
395 #ifdef INET6
396 if ((inp->inp_vflag & INP_IPV4) == 0)
397 continue;
398 #endif
399 if (inp->inp_laddr.s_addr != INADDR_ANY &&
400 inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
401 continue;
402 if (inp->inp_faddr.s_addr != INADDR_ANY &&
403 inp->inp_faddr.s_addr != ip->ip_src.s_addr)
404 continue;
405 /*
406 * XXX: Do not check source port of incoming datagram
407 * unless inp_connect() has been called to bind the
408 * fport part of the 4-tuple; the source could be
409 * trying to talk to us with an ephemeral port.
410 */
411 if (inp->inp_fport != 0 &&
412 inp->inp_fport != uh->uh_sport)
413 continue;
414
415 INP_LOCK(inp);
416
417 /*
418 * Handle socket delivery policy for any-source
419 * and source-specific multicast. [RFC3678]
420 */
421 imo = inp->inp_moptions;
422 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) &&
423 imo != NULL) {
424 struct sockaddr_in sin;
425 struct in_msource *ims;
426 int blocked, mode;
427 size_t idx;
428
429 bzero(&sin, sizeof(struct sockaddr_in));
430 sin.sin_len = sizeof(struct sockaddr_in);
431 sin.sin_family = AF_INET;
432 sin.sin_addr = ip->ip_dst;
433
434 blocked = 0;
435 idx = imo_match_group(imo, ifp,
436 (struct sockaddr *)&sin);
437 if (idx == -1) {
438 /*
439 * No group membership for this socket.
440 * Do not bump udps_noportbcast, as
441 * this will happen further down.
442 */
443 blocked++;
444 } else {
445 /*
446 * Check for a multicast source filter
447 * entry on this socket for this group.
448 * MCAST_EXCLUDE is the default
449 * behaviour. It means default accept;
450 * entries, if present, denote sources
451 * to be excluded from delivery.
452 */
453 ims = imo_match_source(imo, idx,
454 (struct sockaddr *)&udp_in);
455 mode = imo->imo_mfilters[idx].imf_fmode;
456 if ((ims != NULL &&
457 mode == MCAST_EXCLUDE) ||
458 (ims == NULL &&
459 mode == MCAST_INCLUDE)) {
460 #ifdef DIAGNOSTIC
461 if (bootverbose) {
462 printf("%s: blocked by"
463 " source filter\n",
464 __func__);
465 }
466 #endif
467 udpstat.udps_filtermcast++;
468 blocked++;
469 }
470 }
471 if (blocked != 0) {
472 INP_UNLOCK(inp);
473 continue;
474 }
475 }
476 if (last != NULL) {
477 struct mbuf *n;
478
479 n = m_copy(m, 0, M_COPYALL);
480 if (n != NULL)
481 udp_append(last, ip, n, iphlen +
482 sizeof(struct udphdr), &udp_in);
483 INP_UNLOCK(last);
484 }
485 last = inp;
486 /*
487 * Don't look for additional matches if this one does
488 * not have either the SO_REUSEPORT or SO_REUSEADDR
489 * socket options set. This heuristic avoids
490 * searching through all pcbs in the common case of a
491 * non-shared port. It assumes that an application
492 * will never clear these options after setting them.
493 */
494 if ((last->inp_socket->so_options &
495 (SO_REUSEPORT|SO_REUSEADDR)) == 0)
496 break;
497 }
498
499 if (last == NULL) {
500 /*
501 * No matching pcb found; discard datagram. (No need
502 * to send an ICMP Port Unreachable for a broadcast
503 * or multicast datgram.)
504 */
505 udpstat.udps_noportbcast++;
506 goto badheadlocked;
507 }
508 udp_append(last, ip, m, iphlen + sizeof(struct udphdr),
509 &udp_in);
510 INP_UNLOCK(last);
511 INP_INFO_RUNLOCK(&udbinfo);
512 return;
513 }
514
515 /*
516 * Locate pcb for datagram.
517 */
518 inp = in_pcblookup_hash(&udbinfo, ip->ip_src, uh->uh_sport,
519 ip->ip_dst, uh->uh_dport, 1, ifp);
520 if (inp == NULL) {
521 if (udp_log_in_vain) {
522 char buf[4*sizeof "123"];
523
524 strcpy(buf, inet_ntoa(ip->ip_dst));
525 log(LOG_INFO,
526 "Connection attempt to UDP %s:%d from %s:%d\n",
527 buf, ntohs(uh->uh_dport), inet_ntoa(ip->ip_src),
528 ntohs(uh->uh_sport));
529 }
530 udpstat.udps_noport++;
531 if (m->m_flags & (M_BCAST | M_MCAST)) {
532 udpstat.udps_noportbcast++;
533 goto badheadlocked;
534 }
535 if (udp_blackhole)
536 goto badheadlocked;
537 if (badport_bandlim(BANDLIM_ICMP_UNREACH) < 0)
538 goto badheadlocked;
539 *ip = save_ip;
540 ip->ip_len += iphlen;
541 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
542 INP_INFO_RUNLOCK(&udbinfo);
543 return;
544 }
545
546 /*
547 * Check the minimum TTL for socket.
548 */
549 INP_LOCK(inp);
550 if (inp->inp_ip_minttl && inp->inp_ip_minttl > ip->ip_ttl)
551 goto badheadlocked;
552 udp_append(inp, ip, m, iphlen + sizeof(struct udphdr), &udp_in);
553 INP_UNLOCK(inp);
554 INP_INFO_RUNLOCK(&udbinfo);
555 return;
556
557 badheadlocked:
558 if (inp)
559 INP_UNLOCK(inp);
560 INP_INFO_RUNLOCK(&udbinfo);
561 badunlocked:
562 m_freem(m);
563 }
564
565 /*
566 * Notify a udp user of an asynchronous error; just wake up so that they can
567 * collect error status.
568 */
569 struct inpcb *
570 udp_notify(struct inpcb *inp, int errno)
571 {
572
573 inp->inp_socket->so_error = errno;
574 sorwakeup(inp->inp_socket);
575 sowwakeup(inp->inp_socket);
576 return (inp);
577 }
578
579 void
580 udp_ctlinput(int cmd, struct sockaddr *sa, void *vip)
581 {
582 struct ip *ip = vip;
583 struct udphdr *uh;
584 struct in_addr faddr;
585 struct inpcb *inp;
586
587 faddr = ((struct sockaddr_in *)sa)->sin_addr;
588 if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
589 return;
590
591 /*
592 * Redirects don't need to be handled up here.
593 */
594 if (PRC_IS_REDIRECT(cmd))
595 return;
596
597 /*
598 * Hostdead is ugly because it goes linearly through all PCBs.
599 *
600 * XXX: We never get this from ICMP, otherwise it makes an excellent
601 * DoS attack on machines with many connections.
602 */
603 if (cmd == PRC_HOSTDEAD)
604 ip = NULL;
605 else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0)
606 return;
607 if (ip != NULL) {
608 uh = (struct udphdr *)((caddr_t)ip + (ip->ip_hl << 2));
609 INP_INFO_RLOCK(&udbinfo);
610 inp = in_pcblookup_hash(&udbinfo, faddr, uh->uh_dport,
611 ip->ip_src, uh->uh_sport, 0, NULL);
612 if (inp != NULL) {
613 INP_LOCK(inp);
614 if (inp->inp_socket != NULL) {
615 udp_notify(inp, inetctlerrmap[cmd]);
616 }
617 INP_UNLOCK(inp);
618 }
619 INP_INFO_RUNLOCK(&udbinfo);
620 } else
621 in_pcbnotifyall(&udbinfo, faddr, inetctlerrmap[cmd],
622 udp_notify);
623 }
624
625 static int
626 udp_pcblist(SYSCTL_HANDLER_ARGS)
627 {
628 int error, i, n;
629 struct inpcb *inp, **inp_list;
630 inp_gen_t gencnt;
631 struct xinpgen xig;
632
633 /*
634 * The process of preparing the PCB list is too time-consuming and
635 * resource-intensive to repeat twice on every request.
636 */
637 if (req->oldptr == 0) {
638 n = udbinfo.ipi_count;
639 req->oldidx = 2 * (sizeof xig)
640 + (n + n/8) * sizeof(struct xinpcb);
641 return (0);
642 }
643
644 if (req->newptr != 0)
645 return (EPERM);
646
647 /*
648 * OK, now we're committed to doing something.
649 */
650 INP_INFO_RLOCK(&udbinfo);
651 gencnt = udbinfo.ipi_gencnt;
652 n = udbinfo.ipi_count;
653 INP_INFO_RUNLOCK(&udbinfo);
654
655 error = sysctl_wire_old_buffer(req, 2 * (sizeof xig)
656 + n * sizeof(struct xinpcb));
657 if (error != 0)
658 return (error);
659
660 xig.xig_len = sizeof xig;
661 xig.xig_count = n;
662 xig.xig_gen = gencnt;
663 xig.xig_sogen = so_gencnt;
664 error = SYSCTL_OUT(req, &xig, sizeof xig);
665 if (error)
666 return (error);
667
668 inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
669 if (inp_list == 0)
670 return (ENOMEM);
671
672 INP_INFO_RLOCK(&udbinfo);
673 for (inp = LIST_FIRST(udbinfo.ipi_listhead), i = 0; inp && i < n;
674 inp = LIST_NEXT(inp, inp_list)) {
675 INP_LOCK(inp);
676 if (inp->inp_gencnt <= gencnt &&
677 cr_canseesocket(req->td->td_ucred, inp->inp_socket) == 0)
678 inp_list[i++] = inp;
679 INP_UNLOCK(inp);
680 }
681 INP_INFO_RUNLOCK(&udbinfo);
682 n = i;
683
684 error = 0;
685 for (i = 0; i < n; i++) {
686 inp = inp_list[i];
687 INP_LOCK(inp);
688 if (inp->inp_gencnt <= gencnt) {
689 struct xinpcb xi;
690 bzero(&xi, sizeof(xi));
691 xi.xi_len = sizeof xi;
692 /* XXX should avoid extra copy */
693 bcopy(inp, &xi.xi_inp, sizeof *inp);
694 if (inp->inp_socket)
695 sotoxsocket(inp->inp_socket, &xi.xi_socket);
696 xi.xi_inp.inp_gencnt = inp->inp_gencnt;
697 INP_UNLOCK(inp);
698 error = SYSCTL_OUT(req, &xi, sizeof xi);
699 } else
700 INP_UNLOCK(inp);
701 }
702 if (!error) {
703 /*
704 * Give the user an updated idea of our state. If the
705 * generation differs from what we told her before, she knows
706 * that something happened while we were processing this
707 * request, and it might be necessary to retry.
708 */
709 INP_INFO_RLOCK(&udbinfo);
710 xig.xig_gen = udbinfo.ipi_gencnt;
711 xig.xig_sogen = so_gencnt;
712 xig.xig_count = udbinfo.ipi_count;
713 INP_INFO_RUNLOCK(&udbinfo);
714 error = SYSCTL_OUT(req, &xig, sizeof xig);
715 }
716 free(inp_list, M_TEMP);
717 return (error);
718 }
719
720 SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist, CTLFLAG_RD, 0, 0,
721 udp_pcblist, "S,xinpcb", "List of active UDP sockets");
722
723 static int
724 udp_getcred(SYSCTL_HANDLER_ARGS)
725 {
726 struct xucred xuc;
727 struct sockaddr_in addrs[2];
728 struct inpcb *inp;
729 int error;
730
731 error = priv_check(req->td, PRIV_NETINET_GETCRED);
732 if (error)
733 return (error);
734 error = SYSCTL_IN(req, addrs, sizeof(addrs));
735 if (error)
736 return (error);
737 INP_INFO_RLOCK(&udbinfo);
738 inp = in_pcblookup_hash(&udbinfo, addrs[1].sin_addr, addrs[1].sin_port,
739 addrs[0].sin_addr, addrs[0].sin_port, 1, NULL);
740 if (inp == NULL || inp->inp_socket == NULL) {
741 error = ENOENT;
742 goto out;
743 }
744 error = cr_canseesocket(req->td->td_ucred, inp->inp_socket);
745 if (error)
746 goto out;
747 cru2x(inp->inp_socket->so_cred, &xuc);
748 out:
749 INP_INFO_RUNLOCK(&udbinfo);
750 if (error == 0)
751 error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
752 return (error);
753 }
754
755 SYSCTL_PROC(_net_inet_udp, OID_AUTO, getcred,
756 CTLTYPE_OPAQUE|CTLFLAG_RW|CTLFLAG_PRISON, 0, 0,
757 udp_getcred, "S,xucred", "Get the xucred of a UDP connection");
758
759 static int
760 udp_output(struct inpcb *inp, struct mbuf *m, struct sockaddr *addr,
761 struct mbuf *control, struct thread *td)
762 {
763 struct udpiphdr *ui;
764 int len = m->m_pkthdr.len;
765 struct in_addr faddr, laddr;
766 struct cmsghdr *cm;
767 struct sockaddr_in *sin, src;
768 int error = 0;
769 int ipflags;
770 u_short fport, lport;
771 int unlock_udbinfo;
772
773 /*
774 * udp_output() may need to temporarily bind or connect the current
775 * inpcb. As such, we don't know up front whether we will need the
776 * pcbinfo lock or not. Do any work to decide what is needed up
777 * front before acquiring any locks.
778 */
779 if (len + sizeof(struct udpiphdr) > IP_MAXPACKET) {
780 if (control)
781 m_freem(control);
782 m_freem(m);
783 return (EMSGSIZE);
784 }
785
786 src.sin_family = 0;
787 if (control != NULL) {
788 /*
789 * XXX: Currently, we assume all the optional information is
790 * stored in a single mbuf.
791 */
792 if (control->m_next) {
793 m_freem(control);
794 m_freem(m);
795 return (EINVAL);
796 }
797 for (; control->m_len > 0;
798 control->m_data += CMSG_ALIGN(cm->cmsg_len),
799 control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
800 cm = mtod(control, struct cmsghdr *);
801 if (control->m_len < sizeof(*cm) || cm->cmsg_len == 0
802 || cm->cmsg_len > control->m_len) {
803 error = EINVAL;
804 break;
805 }
806 if (cm->cmsg_level != IPPROTO_IP)
807 continue;
808
809 switch (cm->cmsg_type) {
810 case IP_SENDSRCADDR:
811 if (cm->cmsg_len !=
812 CMSG_LEN(sizeof(struct in_addr))) {
813 error = EINVAL;
814 break;
815 }
816 bzero(&src, sizeof(src));
817 src.sin_family = AF_INET;
818 src.sin_len = sizeof(src);
819 src.sin_port = inp->inp_lport;
820 src.sin_addr =
821 *(struct in_addr *)CMSG_DATA(cm);
822 break;
823
824 default:
825 error = ENOPROTOOPT;
826 break;
827 }
828 if (error)
829 break;
830 }
831 m_freem(control);
832 }
833 if (error) {
834 m_freem(m);
835 return (error);
836 }
837
838 if (src.sin_family == AF_INET || addr != NULL) {
839 INP_INFO_WLOCK(&udbinfo);
840 unlock_udbinfo = 1;
841 } else
842 unlock_udbinfo = 0;
843 INP_LOCK(inp);
844
845 #ifdef MAC
846 mac_create_mbuf_from_inpcb(inp, m);
847 #endif
848
849 /*
850 * If the IP_SENDSRCADDR control message was specified, override the
851 * source address for this datagram. Its use is invalidated if the
852 * address thus specified is incomplete or clobbers other inpcbs.
853 */
854 laddr = inp->inp_laddr;
855 lport = inp->inp_lport;
856 if (src.sin_family == AF_INET) {
857 if ((lport == 0) ||
858 (laddr.s_addr == INADDR_ANY &&
859 src.sin_addr.s_addr == INADDR_ANY)) {
860 error = EINVAL;
861 goto release;
862 }
863 error = in_pcbbind_setup(inp, (struct sockaddr *)&src,
864 &laddr.s_addr, &lport, td->td_ucred);
865 if (error)
866 goto release;
867 }
868
869 if (addr) {
870 sin = (struct sockaddr_in *)addr;
871 if (jailed(td->td_ucred))
872 prison_remote_ip(td->td_ucred, 0,
873 &sin->sin_addr.s_addr);
874 if (inp->inp_faddr.s_addr != INADDR_ANY) {
875 error = EISCONN;
876 goto release;
877 }
878 error = in_pcbconnect_setup(inp, addr, &laddr.s_addr, &lport,
879 &faddr.s_addr, &fport, NULL, td->td_ucred);
880 if (error)
881 goto release;
882
883 /* Commit the local port if newly assigned. */
884 if (inp->inp_laddr.s_addr == INADDR_ANY &&
885 inp->inp_lport == 0) {
886 /*
887 * Remember addr if jailed, to prevent rebinding.
888 */
889 if (jailed(td->td_ucred))
890 inp->inp_laddr = laddr;
891 inp->inp_lport = lport;
892 if (in_pcbinshash(inp) != 0) {
893 inp->inp_lport = 0;
894 error = EAGAIN;
895 goto release;
896 }
897 inp->inp_flags |= INP_ANONPORT;
898 }
899 } else {
900 faddr = inp->inp_faddr;
901 fport = inp->inp_fport;
902 if (faddr.s_addr == INADDR_ANY) {
903 error = ENOTCONN;
904 goto release;
905 }
906 }
907
908 /*
909 * Calculate data length and get a mbuf for UDP, IP, and possible
910 * link-layer headers. Immediate slide the data pointer back forward
911 * since we won't use that space at this layer.
912 */
913 M_PREPEND(m, sizeof(struct udpiphdr) + max_linkhdr, M_DONTWAIT);
914 if (m == NULL) {
915 error = ENOBUFS;
916 goto release;
917 }
918 m->m_data += max_linkhdr;
919 m->m_len -= max_linkhdr;
920 m->m_pkthdr.len -= max_linkhdr;
921
922 /*
923 * Fill in mbuf with extended UDP header and addresses and length put
924 * into network format.
925 */
926 ui = mtod(m, struct udpiphdr *);
927 bzero(ui->ui_x1, sizeof(ui->ui_x1)); /* XXX still needed? */
928 ui->ui_pr = IPPROTO_UDP;
929 ui->ui_src = laddr;
930 ui->ui_dst = faddr;
931 ui->ui_sport = lport;
932 ui->ui_dport = fport;
933 ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
934
935 /*
936 * Set the Don't Fragment bit in the IP header.
937 */
938 if (inp->inp_flags & INP_DONTFRAG) {
939 struct ip *ip;
940
941 ip = (struct ip *)&ui->ui_i;
942 ip->ip_off |= IP_DF;
943 }
944
945 ipflags = 0;
946 if (inp->inp_socket->so_options & SO_DONTROUTE)
947 ipflags |= IP_ROUTETOIF;
948 if (inp->inp_socket->so_options & SO_BROADCAST)
949 ipflags |= IP_ALLOWBROADCAST;
950 if (inp->inp_flags & INP_ONESBCAST)
951 ipflags |= IP_SENDONES;
952
953 /*
954 * Set up checksum and output datagram.
955 */
956 if (udp_cksum) {
957 if (inp->inp_flags & INP_ONESBCAST)
958 faddr.s_addr = INADDR_BROADCAST;
959 ui->ui_sum = in_pseudo(ui->ui_src.s_addr, faddr.s_addr,
960 htons((u_short)len + sizeof(struct udphdr) + IPPROTO_UDP));
961 m->m_pkthdr.csum_flags = CSUM_UDP;
962 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
963 } else
964 ui->ui_sum = 0;
965 ((struct ip *)ui)->ip_len = sizeof (struct udpiphdr) + len;
966 ((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl; /* XXX */
967 ((struct ip *)ui)->ip_tos = inp->inp_ip_tos; /* XXX */
968 udpstat.udps_opackets++;
969
970 if (unlock_udbinfo)
971 INP_INFO_WUNLOCK(&udbinfo);
972 error = ip_output(m, inp->inp_options, NULL, ipflags,
973 inp->inp_moptions, inp);
974 INP_UNLOCK(inp);
975 return (error);
976
977 release:
978 INP_UNLOCK(inp);
979 if (unlock_udbinfo)
980 INP_INFO_WUNLOCK(&udbinfo);
981 m_freem(m);
982 return (error);
983 }
984
985 static void
986 udp_abort(struct socket *so)
987 {
988 struct inpcb *inp;
989
990 inp = sotoinpcb(so);
991 KASSERT(inp != NULL, ("udp_abort: inp == NULL"));
992 INP_INFO_WLOCK(&udbinfo);
993 INP_LOCK(inp);
994 if (inp->inp_faddr.s_addr != INADDR_ANY) {
995 in_pcbdisconnect(inp);
996 inp->inp_laddr.s_addr = INADDR_ANY;
997 soisdisconnected(so);
998 }
999 INP_UNLOCK(inp);
1000 INP_INFO_WUNLOCK(&udbinfo);
1001 }
1002
1003 static int
1004 udp_attach(struct socket *so, int proto, struct thread *td)
1005 {
1006 struct inpcb *inp;
1007 int error;
1008
1009 inp = sotoinpcb(so);
1010 KASSERT(inp == NULL, ("udp_attach: inp != NULL"));
1011 error = soreserve(so, udp_sendspace, udp_recvspace);
1012 if (error)
1013 return (error);
1014 INP_INFO_WLOCK(&udbinfo);
1015 error = in_pcballoc(so, &udbinfo);
1016 if (error) {
1017 INP_INFO_WUNLOCK(&udbinfo);
1018 return (error);
1019 }
1020
1021 inp = (struct inpcb *)so->so_pcb;
1022 INP_INFO_WUNLOCK(&udbinfo);
1023 inp->inp_vflag |= INP_IPV4;
1024 inp->inp_ip_ttl = ip_defttl;
1025 INP_UNLOCK(inp);
1026 return (0);
1027 }
1028
1029 static int
1030 udp_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
1031 {
1032 struct inpcb *inp;
1033 int error;
1034
1035 inp = sotoinpcb(so);
1036 KASSERT(inp != NULL, ("udp_bind: inp == NULL"));
1037 INP_INFO_WLOCK(&udbinfo);
1038 INP_LOCK(inp);
1039 error = in_pcbbind(inp, nam, td->td_ucred);
1040 INP_UNLOCK(inp);
1041 INP_INFO_WUNLOCK(&udbinfo);
1042 return (error);
1043 }
1044
1045 static void
1046 udp_close(struct socket *so)
1047 {
1048 struct inpcb *inp;
1049
1050 inp = sotoinpcb(so);
1051 KASSERT(inp != NULL, ("udp_close: inp == NULL"));
1052 INP_INFO_WLOCK(&udbinfo);
1053 INP_LOCK(inp);
1054 if (inp->inp_faddr.s_addr != INADDR_ANY) {
1055 in_pcbdisconnect(inp);
1056 inp->inp_laddr.s_addr = INADDR_ANY;
1057 soisdisconnected(so);
1058 }
1059 INP_UNLOCK(inp);
1060 INP_INFO_WUNLOCK(&udbinfo);
1061 }
1062
1063 static int
1064 udp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1065 {
1066 struct inpcb *inp;
1067 int error;
1068 struct sockaddr_in *sin;
1069
1070 inp = sotoinpcb(so);
1071 KASSERT(inp != NULL, ("udp_connect: inp == NULL"));
1072 INP_INFO_WLOCK(&udbinfo);
1073 INP_LOCK(inp);
1074 if (inp->inp_faddr.s_addr != INADDR_ANY) {
1075 INP_UNLOCK(inp);
1076 INP_INFO_WUNLOCK(&udbinfo);
1077 return (EISCONN);
1078 }
1079 sin = (struct sockaddr_in *)nam;
1080 if (jailed(td->td_ucred))
1081 prison_remote_ip(td->td_ucred, 0, &sin->sin_addr.s_addr);
1082 error = in_pcbconnect(inp, nam, td->td_ucred);
1083 if (error == 0)
1084 soisconnected(so);
1085 INP_UNLOCK(inp);
1086 INP_INFO_WUNLOCK(&udbinfo);
1087 return (error);
1088 }
1089
1090 static void
1091 udp_detach(struct socket *so)
1092 {
1093 struct inpcb *inp;
1094
1095 inp = sotoinpcb(so);
1096 KASSERT(inp != NULL, ("udp_detach: inp == NULL"));
1097 KASSERT(inp->inp_faddr.s_addr == INADDR_ANY,
1098 ("udp_detach: not disconnected"));
1099 INP_INFO_WLOCK(&udbinfo);
1100 INP_LOCK(inp);
1101 in_pcbdetach(inp);
1102 in_pcbfree(inp);
1103 INP_INFO_WUNLOCK(&udbinfo);
1104 }
1105
1106 static int
1107 udp_disconnect(struct socket *so)
1108 {
1109 struct inpcb *inp;
1110
1111 inp = sotoinpcb(so);
1112 KASSERT(inp != NULL, ("udp_disconnect: inp == NULL"));
1113 INP_INFO_WLOCK(&udbinfo);
1114 INP_LOCK(inp);
1115 if (inp->inp_faddr.s_addr == INADDR_ANY) {
1116 INP_INFO_WUNLOCK(&udbinfo);
1117 INP_UNLOCK(inp);
1118 return (ENOTCONN);
1119 }
1120
1121 in_pcbdisconnect(inp);
1122 inp->inp_laddr.s_addr = INADDR_ANY;
1123 SOCK_LOCK(so);
1124 so->so_state &= ~SS_ISCONNECTED; /* XXX */
1125 SOCK_UNLOCK(so);
1126 INP_UNLOCK(inp);
1127 INP_INFO_WUNLOCK(&udbinfo);
1128 return (0);
1129 }
1130
1131 static int
1132 udp_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
1133 struct mbuf *control, struct thread *td)
1134 {
1135 struct inpcb *inp;
1136
1137 inp = sotoinpcb(so);
1138 KASSERT(inp != NULL, ("udp_send: inp == NULL"));
1139 return (udp_output(inp, m, addr, control, td));
1140 }
1141
1142 int
1143 udp_shutdown(struct socket *so)
1144 {
1145 struct inpcb *inp;
1146
1147 inp = sotoinpcb(so);
1148 KASSERT(inp != NULL, ("udp_shutdown: inp == NULL"));
1149 INP_LOCK(inp);
1150 socantsendmore(so);
1151 INP_UNLOCK(inp);
1152 return (0);
1153 }
1154
1155 struct pr_usrreqs udp_usrreqs = {
1156 .pru_abort = udp_abort,
1157 .pru_attach = udp_attach,
1158 .pru_bind = udp_bind,
1159 .pru_connect = udp_connect,
1160 .pru_control = in_control,
1161 .pru_detach = udp_detach,
1162 .pru_disconnect = udp_disconnect,
1163 .pru_peeraddr = in_getpeeraddr,
1164 .pru_send = udp_send,
1165 .pru_sosend = sosend_dgram,
1166 .pru_shutdown = udp_shutdown,
1167 .pru_sockaddr = in_getsockaddr,
1168 .pru_sosetlabel = in_pcbsosetlabel,
1169 .pru_close = udp_close,
1170 };
Cache object: 6b827ef231ea292034332f08b2d4b942
|