Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netinet6/in6_src.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* $NetBSD: in6_src.c,v 1.91 2022/11/04 09:01:53 ozaki-r Exp $ */ 2 /* $KAME: in6_src.c,v 1.159 2005/10/19 01:40:32 t-momose Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 /* 34 * Copyright (c) 1982, 1986, 1991, 1993 35 * The Regents of the University of California. All rights reserved. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 3. All advertising materials mentioning features or use of this software 46 * must display the following acknowledgement: 47 * This product includes software developed by the University of 48 * California, Berkeley and its contributors. 49 * 4. Neither the name of the University nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 56 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 63 * SUCH DAMAGE. 64 * 65 * @(#)in_pcb.c 8.2 (Berkeley) 1/4/94 66 */ 67 68 #include <sys/cdefs.h> 69 __KERNEL_RCSID(0, "$NetBSD: in6_src.c,v 1.91 2022/11/04 09:01:53 ozaki-r Exp $"); 70 71 #ifdef _KERNEL_OPT 72 #include "opt_inet.h" 73 #endif 74 75 #include <sys/param.h> 76 #include <sys/systm.h> 77 #include <sys/malloc.h> 78 #include <sys/mbuf.h> 79 #include <sys/protosw.h> 80 #include <sys/socket.h> 81 #include <sys/socketvar.h> 82 #include <sys/ioctl.h> 83 #include <sys/errno.h> 84 #include <sys/time.h> 85 #include <sys/kernel.h> 86 #include <sys/proc.h> 87 #include <sys/kauth.h> 88 89 #include <net/if.h> 90 #include <net/if_types.h> 91 #include <net/route.h> 92 93 #include <netinet/in.h> 94 #include <netinet/in_var.h> 95 #include <netinet/in_systm.h> 96 #include <netinet/ip.h> 97 #include <netinet/in_pcb.h> 98 #include <netinet/portalgo.h> 99 #include <netinet6/in6_var.h> 100 #include <netinet/ip6.h> 101 #include <netinet6/in6_pcb.h> 102 #include <netinet6/ip6_var.h> 103 #include <netinet6/ip6_private.h> 104 #include <netinet6/nd6.h> 105 #include <netinet6/scope6_var.h> 106 107 #ifdef MIP6 108 #include <netinet6/mip6.h> 109 #include <netinet6/mip6_var.h> 110 #include "mip.h" 111 #if NMIP > 0 112 #include <net/if_mip.h> 113 #endif /* NMIP > 0 */ 114 #endif /* MIP6 */ 115 116 #include <netinet/tcp_vtw.h> 117 118 #define ADDR_LABEL_NOTAPP (-1) 119 struct in6_addrpolicy defaultaddrpolicy; 120 121 int ip6_prefer_tempaddr = 0; 122 123 static int in6_selectif(struct sockaddr_in6 *, struct ip6_pktopts *, 124 struct ip6_moptions *, struct route *, struct ifnet **, struct psref *); 125 126 static struct in6_addrpolicy *lookup_addrsel_policy(struct sockaddr_in6 *); 127 128 static void init_policy_queue(void); 129 static int add_addrsel_policyent(struct in6_addrpolicy *); 130 static int delete_addrsel_policyent(struct in6_addrpolicy *); 131 static int walk_addrsel_policy(int (*)(struct in6_addrpolicy *, void *), 132 void *); 133 static int dump_addrsel_policyent(struct in6_addrpolicy *, void *); 134 static struct in6_addrpolicy *match_addrsel_policy(struct sockaddr_in6 *); 135 136 #define IFA6_IS_VALIDATED(ia) \ 137 (((ia)->ia6_flags & (IN6_IFF_TENTATIVE | IN6_IFF_DETACHED)) == 0) 138 139 /* 140 * Return an IPv6 address, which is the most appropriate for a given 141 * destination and user specified options. 142 * If necessary, this function lookups the routing table and returns 143 * an entry to the caller for later use. 144 */ 145 #if 0 /* disabled ad-hoc */ 146 #define REPLACE(r) do {\ 147 char _buf1[INET6_ADDRSTRLEN], _buf2[INET6_ADDRSTRLEN]; \ 148 if ((r) < sizeof(ip6stat.ip6s_sources_rule) / \ 149 sizeof(ip6stat.ip6s_sources_rule[0])) /* check for safety */ \ 150 ip6stat.ip6s_sources_rule[(r)]++; \ 151 printf("%s: replace %s with %s by %d\n", __func__, ia_best ? \ 152 IN6_PRINT(_buf1, &ia_best->ia_addr.sin6_addr) : "none", \ 153 IN6_PRINT(_buf2, &ia->ia_addr.sin6_addr), (r)); \ 154 goto replace; \ 155 } while(/*CONSTCOND*/0) 156 #define NEXT(r) do {\ 157 if ((r) < sizeof(ip6stat.ip6s_sources_rule) / \ 158 sizeof(ip6stat.ip6s_sources_rule[0])) /* check for safety */ \ 159 ip6stat.ip6s_sources_rule[(r)]++; \ 160 printf("%s: keep %s against %s by %d\n", ia_best ? \ 161 IN6_PRINT(_buf1, &ia_best->ia_addr.sin6_addr) : "none", \ 162 IN6_PRINT(_buf2, &ia->ia_addr.sin6_addr), (r)); \ 163 goto next; /* XXX: we can't use 'continue' here */ \ 164 } while(/*CONSTCOND*/0) 165 #define BREAK(r) do { \ 166 if ((r) < sizeof(ip6stat.ip6s_sources_rule) / \ 167 sizeof(ip6stat.ip6s_sources_rule[0])) /* check for safety */ \ 168 ip6stat.ip6s_sources_rule[(r)]++; \ 169 goto out; /* XXX: we can't use 'break' here */ \ 170 } while(/*CONSTCOND*/0) 171 #else 172 #define REPLACE(r) goto replace 173 #define NEXT(r) goto next 174 #define BREAK(r) goto out 175 #endif 176 177 /* 178 * Called inside pserialize critical section. Don't sleep/block. 179 */ 180 static struct in6_ifaddr * 181 in6_select_best_ia(struct sockaddr_in6 *dstsock, struct in6_addr *dst, 182 const struct ifnet *ifp, const struct ip6_pktopts *opts, 183 const u_int32_t odstzone) 184 { 185 struct in6_ifaddr *ia, *ia_best = NULL; 186 int dst_scope = -1, best_scope = -1, best_matchlen = -1; 187 struct in6_addrpolicy *dst_policy = NULL, *best_policy = NULL; 188 189 IN6_ADDRLIST_READER_FOREACH(ia) { 190 int new_scope = -1, new_matchlen = -1; 191 struct in6_addrpolicy *new_policy = NULL; 192 u_int32_t srczone, osrczone, dstzone; 193 struct in6_addr src; 194 struct ifnet *ifp1 = ia->ia_ifp; 195 int prefer_tempaddr; 196 197 /* 198 * We'll never take an address that breaks the scope zone 199 * of the destination. We also skip an address if its zone 200 * does not contain the outgoing interface. 201 * XXX: we should probably use sin6_scope_id here. 202 */ 203 if (in6_setscope(dst, ifp1, &dstzone) || 204 odstzone != dstzone) { 205 continue; 206 } 207 src = ia->ia_addr.sin6_addr; 208 209 /* Skip the scope test in impossible cases */ 210 if (!(ifp->if_flags & IFF_LOOPBACK) && 211 IN6_IS_ADDR_LOOPBACK(&src)) 212 continue; 213 214 if (in6_setscope(&src, ifp, &osrczone) || 215 in6_setscope(&src, ifp1, &srczone) || 216 osrczone != srczone) { 217 continue; 218 } 219 220 /* avoid unusable addresses */ 221 if ((ia->ia6_flags & (IN6_IFF_DUPLICATED | IN6_IFF_ANYCAST))) 222 continue; 223 if (!ip6_use_deprecated && IFA6_IS_DEPRECATED(ia)) 224 continue; 225 226 #if defined(MIP6) && NMIP > 0 227 /* avoid unusable home addresses. */ 228 if ((ia->ia6_flags & IN6_IFF_HOME) && 229 !mip6_ifa6_is_addr_valid_hoa(ia)) 230 continue; 231 #endif /* MIP6 && NMIP > 0 */ 232 233 /* Rule 1: Prefer same address */ 234 if (IN6_ARE_ADDR_EQUAL(dst, &ia->ia_addr.sin6_addr)) { 235 ia_best = ia; 236 BREAK(1); /* there should be no better candidate */ 237 } 238 239 if (ia_best == NULL) 240 REPLACE(1); 241 242 /* Rule 2: Prefer appropriate scope */ 243 if (dst_scope < 0) 244 dst_scope = in6_addrscope(dst); 245 new_scope = in6_addrscope(&ia->ia_addr.sin6_addr); 246 if (IN6_ARE_SCOPE_CMP(best_scope, new_scope) < 0) { 247 if (IN6_ARE_SCOPE_CMP(best_scope, dst_scope) < 0) 248 REPLACE(2); 249 NEXT(2); 250 } else if (IN6_ARE_SCOPE_CMP(new_scope, best_scope) < 0) { 251 if (IN6_ARE_SCOPE_CMP(new_scope, dst_scope) < 0) 252 NEXT(2); 253 REPLACE(2); 254 } 255 256 /* 257 * Rule 3: Avoid deprecated addresses. Note that the case of 258 * !ip6_use_deprecated is already rejected above. 259 * Treat unvalidated addresses as deprecated here. 260 */ 261 if (IFA6_IS_VALIDATED(ia_best) && !IFA6_IS_VALIDATED(ia)) 262 NEXT(3); 263 if (!IFA6_IS_VALIDATED(ia_best) && IFA6_IS_VALIDATED(ia)) 264 REPLACE(3); 265 if (!IFA6_IS_DEPRECATED(ia_best) && IFA6_IS_DEPRECATED(ia)) 266 NEXT(3); 267 if (IFA6_IS_DEPRECATED(ia_best) && !IFA6_IS_DEPRECATED(ia)) 268 REPLACE(3); 269 270 /* Rule 4: Prefer home addresses */ 271 #if defined(MIP6) && NMIP > 0 272 if (!MIP6_IS_MN) 273 goto skip_rule4; 274 275 if ((ia_best->ia6_flags & IN6_IFF_HOME) == 0 && 276 (ia->ia6_flags & IN6_IFF_HOME) == 0) { 277 /* both address are not home addresses. */ 278 goto skip_rule4; 279 } 280 281 /* 282 * If SA is simultaneously a home address and care-of 283 * address and SB is not, then prefer SA. Similarly, 284 * if SB is simultaneously a home address and care-of 285 * address and SA is not, then prefer SB. 286 */ 287 if (((ia_best->ia6_flags & IN6_IFF_HOME) != 0 && 288 ia_best->ia_ifp->if_type != IFT_MIP) 289 && 290 ((ia->ia6_flags & IN6_IFF_HOME) != 0 && 291 ia->ia_ifp->if_type == IFT_MIP)) 292 NEXT(4); 293 if (((ia_best->ia6_flags & IN6_IFF_HOME) != 0 && 294 ia_best->ia_ifp->if_type == IFT_MIP) 295 && 296 ((ia->ia6_flags & IN6_IFF_HOME) != 0 && 297 ia->ia_ifp->if_type != IFT_MIP)) 298 REPLACE(4); 299 if (ip6po_usecoa == 0) { 300 /* 301 * If SA is just a home address and SB is just 302 * a care-of address, then prefer 303 * SA. Similarly, if SB is just a home address 304 * and SA is just a care-of address, then 305 * prefer SB. 306 */ 307 if ((ia_best->ia6_flags & IN6_IFF_HOME) != 0 && 308 (ia->ia6_flags & IN6_IFF_HOME) == 0) { 309 NEXT(4); 310 } 311 if ((ia_best->ia6_flags & IN6_IFF_HOME) == 0 && 312 (ia->ia6_flags & IN6_IFF_HOME) != 0) { 313 REPLACE(4); 314 } 315 } else { 316 /* 317 * a sender don't want to use a home address 318 * because: 319 * 320 * 1) we cannot use. (ex. NS or NA to global 321 * addresses.) 322 * 323 * 2) a user specified not to use. 324 * (ex. mip6control -u) 325 */ 326 if ((ia_best->ia6_flags & IN6_IFF_HOME) == 0 && 327 (ia->ia6_flags & IN6_IFF_HOME) != 0) { 328 /* XXX breaks stat */ 329 NEXT(0); 330 } 331 if ((ia_best->ia6_flags & IN6_IFF_HOME) != 0 && 332 (ia->ia6_flags & IN6_IFF_HOME) == 0) { 333 /* XXX breaks stat */ 334 REPLACE(0); 335 } 336 } 337 skip_rule4: 338 #endif /* MIP6 && NMIP > 0 */ 339 340 /* Rule 5: Prefer outgoing interface */ 341 if (ia_best->ia_ifp == ifp && ia->ia_ifp != ifp) 342 NEXT(5); 343 if (ia_best->ia_ifp != ifp && ia->ia_ifp == ifp) 344 REPLACE(5); 345 346 /* 347 * Rule 6: Prefer matching label 348 * Note that best_policy should be non-NULL here. 349 */ 350 if (dst_policy == NULL) 351 dst_policy = lookup_addrsel_policy(dstsock); 352 if (dst_policy->label != ADDR_LABEL_NOTAPP) { 353 new_policy = lookup_addrsel_policy(&ia->ia_addr); 354 if (dst_policy->label == best_policy->label && 355 dst_policy->label != new_policy->label) 356 NEXT(6); 357 if (dst_policy->label != best_policy->label && 358 dst_policy->label == new_policy->label) 359 REPLACE(6); 360 } 361 362 /* 363 * Rule 7: Prefer public addresses. 364 * We allow users to reverse the logic by configuring 365 * a sysctl variable, so that privacy conscious users can 366 * always prefer temporary addresses. 367 */ 368 if (opts == NULL || 369 opts->ip6po_prefer_tempaddr == IP6PO_TEMPADDR_SYSTEM) { 370 prefer_tempaddr = ip6_prefer_tempaddr; 371 } else if (opts->ip6po_prefer_tempaddr == 372 IP6PO_TEMPADDR_NOTPREFER) { 373 prefer_tempaddr = 0; 374 } else 375 prefer_tempaddr = 1; 376 if (!(ia_best->ia6_flags & IN6_IFF_TEMPORARY) && 377 (ia->ia6_flags & IN6_IFF_TEMPORARY)) { 378 if (prefer_tempaddr) 379 REPLACE(7); 380 else 381 NEXT(7); 382 } 383 if ((ia_best->ia6_flags & IN6_IFF_TEMPORARY) && 384 !(ia->ia6_flags & IN6_IFF_TEMPORARY)) { 385 if (prefer_tempaddr) 386 NEXT(7); 387 else 388 REPLACE(7); 389 } 390 391 /* 392 * Rule 8: prefer addresses on alive interfaces. 393 * This is a KAME specific rule. 394 */ 395 if ((ia_best->ia_ifp->if_flags & IFF_UP) && 396 !(ia->ia_ifp->if_flags & IFF_UP)) 397 NEXT(8); 398 if (!(ia_best->ia_ifp->if_flags & IFF_UP) && 399 (ia->ia_ifp->if_flags & IFF_UP)) 400 REPLACE(8); 401 402 /* 403 * Rule 9: prefer addresses on "preferred" interfaces. 404 * This is a KAME specific rule. 405 */ 406 #ifdef notyet /* until introducing address selection */ 407 #define NDI_BEST ND_IFINFO(ia_best->ia_ifp) 408 #define NDI_NEW ND_IFINFO(ia->ia_ifp) 409 if ((NDI_BEST->flags & ND6_IFF_PREFER_SOURCE) && 410 !(NDI_NEW->flags & ND6_IFF_PREFER_SOURCE)) 411 NEXT(9); 412 if (!(NDI_BEST->flags & ND6_IFF_PREFER_SOURCE) && 413 (NDI_NEW->flags & ND6_IFF_PREFER_SOURCE)) 414 REPLACE(9); 415 #undef NDI_BEST 416 #undef NDI_NEW 417 #endif 418 419 /* 420 * Rule 14: Use longest matching prefix. 421 * Note: in the address selection draft, this rule is 422 * documented as "Rule 8". However, since it is also 423 * documented that this rule can be overridden, we assign 424 * a large number so that it is easy to assign smaller numbers 425 * to more preferred rules. 426 */ 427 new_matchlen = in6_matchlen(&ia->ia_addr.sin6_addr, dst); 428 if (best_matchlen < new_matchlen) 429 REPLACE(14); 430 if (new_matchlen < best_matchlen) 431 NEXT(14); 432 433 /* Rule 15 is reserved. */ 434 435 /* 436 * Last resort: just keep the current candidate. 437 * Or, do we need more rules? 438 */ 439 continue; 440 441 replace: 442 ia_best = ia; 443 best_scope = (new_scope >= 0 ? new_scope : 444 in6_addrscope(&ia_best->ia_addr.sin6_addr)); 445 best_policy = (new_policy ? new_policy : 446 lookup_addrsel_policy(&ia_best->ia_addr)); 447 best_matchlen = (new_matchlen >= 0 ? new_matchlen : 448 in6_matchlen(&ia_best->ia_addr.sin6_addr, 449 dst)); 450 451 next: 452 continue; 453 454 out: 455 break; 456 } 457 458 return ia_best; 459 } 460 #undef REPLACE 461 #undef BREAK 462 #undef NEXT 463 464 int 465 in6_selectsrc(struct sockaddr_in6 *dstsock, struct ip6_pktopts *opts, 466 struct ip6_moptions *mopts, struct route *ro, struct in6_addr *laddr, 467 struct ifnet **ifpp, struct psref *psref, struct in6_addr *ret_ia6) 468 { 469 struct in6_addr dst; 470 struct ifnet *ifp = NULL; 471 struct in6_ifaddr *ia = NULL; 472 struct in6_pktinfo *pi = NULL; 473 u_int32_t odstzone; 474 int error = 0, iferror; 475 #if defined(MIP6) && NMIP > 0 476 u_int8_t ip6po_usecoa = 0; 477 #endif /* MIP6 && NMIP > 0 */ 478 struct psref local_psref; 479 int bound = curlwp_bind(); 480 #define PSREF (psref == NULL) ? &local_psref : psref 481 int s; 482 483 KASSERT((ifpp != NULL && psref != NULL) || 484 (ifpp == NULL && psref == NULL)); 485 486 dst = dstsock->sin6_addr; /* make a copy for local operation */ 487 if (ifpp) 488 *ifpp = NULL; 489 490 /* 491 * Try to determine the outgoing interface for the given destination. 492 * We do this regardless of whether the socket is bound, since the 493 * caller may need this information as a side effect of the call 494 * to this function (e.g., for identifying the appropriate scope zone 495 * ID). 496 */ 497 iferror = in6_selectif(dstsock, opts, mopts, ro, &ifp, PSREF); 498 if (ifpp != NULL) 499 *ifpp = ifp; 500 501 /* 502 * If the source address is explicitly specified by the caller, 503 * check if the requested source address is indeed a unicast address 504 * assigned to the node, and can be used as the packet's source 505 * address. If everything is okay, use the address as source. 506 */ 507 if (opts && (pi = opts->ip6po_pktinfo) && 508 !IN6_IS_ADDR_UNSPECIFIED(&pi->ipi6_addr)) { 509 struct sockaddr_in6 srcsock; 510 struct in6_ifaddr *ia6; 511 int _s; 512 struct ifaddr *ifa; 513 514 /* 515 * Determine the appropriate zone id of the source based on 516 * the zone of the destination and the outgoing interface. 517 * If the specified address is ambiguous wrt the scope zone, 518 * the interface must be specified; otherwise, ifa_ifwithaddr() 519 * will fail matching the address. 520 */ 521 memset(&srcsock, 0, sizeof(srcsock)); 522 srcsock.sin6_family = AF_INET6; 523 srcsock.sin6_len = sizeof(srcsock); 524 srcsock.sin6_addr = pi->ipi6_addr; 525 if (ifp) { 526 error = in6_setscope(&srcsock.sin6_addr, ifp, NULL); 527 if (error != 0) 528 goto exit; 529 } 530 531 _s = pserialize_read_enter(); 532 ifa = ifa_ifwithaddr(sin6tosa(&srcsock)); 533 if ((ia6 = ifatoia6(ifa)) == NULL || 534 ia6->ia6_flags & 535 (IN6_IFF_ANYCAST | IN6_IFF_NOTREADY)) { 536 pserialize_read_exit(_s); 537 error = EADDRNOTAVAIL; 538 goto exit; 539 } 540 pi->ipi6_addr = srcsock.sin6_addr; /* XXX: this overrides pi */ 541 if (ifpp) 542 *ifpp = ifp; 543 *ret_ia6 = ia6->ia_addr.sin6_addr; 544 pserialize_read_exit(_s); 545 goto exit; 546 } 547 548 /* 549 * If the socket has already bound the source, just use it. We don't 550 * care at the moment whether in6_selectif() succeeded above, even 551 * though it would eventually cause an error. 552 */ 553 if (laddr && !IN6_IS_ADDR_UNSPECIFIED(laddr)) { 554 *ret_ia6 = *laddr; 555 goto exit; 556 } 557 558 /* 559 * The outgoing interface is crucial in the general selection procedure 560 * below. If it is not known at this point, we fail. 561 */ 562 if (ifp == NULL) { 563 error = iferror; 564 goto exit; 565 } 566 567 /* 568 * If the address is not yet determined, choose the best one based on 569 * the outgoing interface and the destination address. 570 */ 571 572 #if defined(MIP6) && NMIP > 0 573 /* 574 * a caller can specify IP6PO_USECOA to not to use a home 575 * address. for example, the case that the neighbour 576 * unreachability detection to the global address. 577 */ 578 if (opts != NULL && 579 (opts->ip6po_flags & IP6PO_USECOA) != 0) { 580 ip6po_usecoa = 1; 581 } 582 #endif /* MIP6 && NMIP > 0 */ 583 584 error = in6_setscope(&dst, ifp, &odstzone); 585 if (error != 0) 586 goto exit; 587 588 s = pserialize_read_enter(); 589 590 ia = in6_select_best_ia(dstsock, &dst, ifp, opts, odstzone); 591 if (ia == NULL) { 592 pserialize_read_exit(s); 593 error = EADDRNOTAVAIL; 594 goto exit; 595 } 596 *ret_ia6 = ia->ia_addr.sin6_addr; 597 598 pserialize_read_exit(s); 599 exit: 600 if (ifpp == NULL) 601 if_put(ifp, PSREF); 602 curlwp_bindx(bound); 603 return error; 604 #undef PSREF 605 } 606 607 int 608 in6_selectroute(struct sockaddr_in6 *dstsock, struct ip6_pktopts *opts, 609 struct route **ro, struct rtentry **retrt, bool count_discard) 610 { 611 int error = 0; 612 struct rtentry *rt = NULL; 613 union { 614 struct sockaddr dst; 615 struct sockaddr_in dst4; 616 struct sockaddr_in6 dst6; 617 } u; 618 619 KASSERT(ro != NULL); 620 KASSERT(*ro != NULL); 621 KASSERT(retrt != NULL); 622 623 #if 0 624 if (dstsock->sin6_addr.s6_addr32[0] == 0 && 625 dstsock->sin6_addr.s6_addr32[1] == 0 && 626 !IN6_IS_ADDR_LOOPBACK(&dstsock->sin6_addr)) { 627 char ip6buf[INET6_ADDRSTRLEN]; 628 printf("%s: strange destination %s\n", __func__, 629 IN6_PRINT(ip6buf, &dstsock->sin6_addr)); 630 } else { 631 char ip6buf[INET6_ADDRSTRLEN]; 632 printf("%s: destination = %s%%%d\n", __func__, 633 IN6_PRINT(ip6buf, &dstsock->sin6_addr), 634 dstsock->sin6_scope_id); /* for debug */ 635 } 636 #endif 637 638 /* 639 * If the next hop address for the packet is specified by the caller, 640 * use it as the gateway. 641 */ 642 if (opts && opts->ip6po_nexthop) { 643 struct route *ron; 644 struct sockaddr_in6 *sin6_next; 645 646 sin6_next = satosin6(opts->ip6po_nexthop); 647 648 /* at this moment, we only support AF_INET6 next hops */ 649 if (sin6_next->sin6_family != AF_INET6) { 650 IP6_STATINC(IP6_STAT_ODROPPED); 651 error = EAFNOSUPPORT; /* or should we proceed? */ 652 goto done; 653 } 654 655 /* 656 * If the next hop is an IPv6 address, then the node identified 657 * by that address must be a neighbor of the sending host. 658 */ 659 ron = &opts->ip6po_nextroute; 660 rt = rtcache_lookup(ron, sin6tosa(sin6_next)); 661 if (rt == NULL || (rt->rt_flags & RTF_GATEWAY) != 0 || 662 !nd6_is_addr_neighbor(sin6_next, rt->rt_ifp)) { 663 if (rt != NULL) { 664 if (count_discard) 665 in6_ifstat_inc(rt->rt_ifp, 666 ifs6_out_discard); 667 rtcache_unref(rt, ron); 668 rt = NULL; 669 } 670 rtcache_free(ron); 671 error = EHOSTUNREACH; 672 goto done; 673 } 674 *ro = ron; 675 676 goto done; 677 } 678 679 /* 680 * Use a cached route if it exists and is valid, else try to allocate 681 * a new one. Note that we should check the address family of the 682 * cached destination, in case of sharing the cache with IPv4. 683 * 684 * for V4 mapped addresses we want to pick up the v4 route 685 * see PR kern/56348 686 */ 687 if (IN6_IS_ADDR_V4MAPPED(&dstsock->sin6_addr)) { 688 in6_sin6_2_sin(&u.dst4, dstsock); 689 } else { 690 u.dst6 = *dstsock; 691 u.dst6.sin6_scope_id = 0; 692 } 693 694 rt = rtcache_lookup1(*ro, &u.dst, 1); 695 696 if (rt == NULL) 697 error = EHOSTUNREACH; 698 699 /* 700 * Check if the outgoing interface conflicts with 701 * the interface specified by ipi6_ifindex (if specified). 702 * Note that loopback interface is always okay. 703 * (this may happen when we are sending a packet to one of 704 * our own addresses.) 705 */ 706 if (opts && opts->ip6po_pktinfo && opts->ip6po_pktinfo->ipi6_ifindex) { 707 if (rt != NULL && !(rt->rt_ifp->if_flags & IFF_LOOPBACK) && 708 rt->rt_ifp->if_index != opts->ip6po_pktinfo->ipi6_ifindex) { 709 if (count_discard) 710 in6_ifstat_inc(rt->rt_ifp, ifs6_out_discard); 711 error = EHOSTUNREACH; 712 rt = NULL; 713 } 714 } 715 716 done: 717 if (error == EHOSTUNREACH) 718 IP6_STATINC(IP6_STAT_NOROUTE); 719 *retrt = rt; 720 return error; 721 } 722 723 static int 724 in6_selectif(struct sockaddr_in6 *dstsock, struct ip6_pktopts *opts, 725 struct ip6_moptions *mopts, struct route *ro, struct ifnet **retifp, 726 struct psref *psref) 727 { 728 int error = 0; 729 struct rtentry *rt = NULL; 730 struct in6_addr *dst; 731 struct in6_pktinfo *pi = NULL; 732 733 KASSERT(retifp != NULL); 734 *retifp = NULL; 735 dst = &dstsock->sin6_addr; 736 737 /* If the caller specify the outgoing interface explicitly, use it. */ 738 if (opts && (pi = opts->ip6po_pktinfo) != NULL && pi->ipi6_ifindex) { 739 /* XXX boundary check is assumed to be already done. */ 740 *retifp = if_get_byindex(pi->ipi6_ifindex, psref); 741 if (*retifp != NULL) 742 return 0; 743 goto getroute; 744 } 745 746 /* 747 * If the destination address is a multicast address and the outgoing 748 * interface for the address is specified by the caller, use it. 749 */ 750 if (IN6_IS_ADDR_MULTICAST(dst) && mopts != NULL) { 751 *retifp = if_get_byindex(mopts->im6o_multicast_if_index, psref); 752 if (*retifp != NULL) 753 return 0; /* we do not need a route for multicast. */ 754 } 755 756 getroute: 757 error = in6_selectroute(dstsock, opts, &ro, &rt, false); 758 if (error != 0) 759 return error; 760 761 *retifp = if_get_byindex(rt->rt_ifp->if_index, psref); 762 763 /* 764 * do not use a rejected or black hole route. 765 * XXX: this check should be done in the L2 output routine. 766 * However, if we skipped this check here, we'd see the following 767 * scenario: 768 * - install a rejected route for a scoped address prefix 769 * (like fe80::/10) 770 * - send a packet to a destination that matches the scoped prefix, 771 * with ambiguity about the scope zone. 772 * - pick the outgoing interface from the route, and disambiguate the 773 * scope zone with the interface. 774 * - ip6_output() would try to get another route with the "new" 775 * destination, which may be valid. 776 * - we'd see no error on output. 777 * Although this may not be very harmful, it should still be confusing. 778 * We thus reject the case here. 779 */ 780 if ((rt->rt_flags & (RTF_REJECT | RTF_BLACKHOLE))) { 781 error = (rt->rt_flags & RTF_HOST ? EHOSTUNREACH : ENETUNREACH); 782 /* XXX: ifp can be returned with psref even if error */ 783 goto out; 784 } 785 786 /* 787 * Adjust the "outgoing" interface. If we're going to loop the packet 788 * back to ourselves, the ifp would be the loopback interface. 789 * However, we'd rather know the interface associated to the 790 * destination address (which should probably be one of our own 791 * addresses.) 792 */ 793 if (rt->rt_ifa->ifa_ifp != *retifp && 794 !if_is_deactivated(rt->rt_ifa->ifa_ifp)) { 795 if_put(*retifp, psref); 796 *retifp = rt->rt_ifa->ifa_ifp; 797 if_acquire(*retifp, psref); 798 } 799 out: 800 rtcache_unref(rt, ro); 801 return error; 802 } 803 804 /* 805 * Default hop limit selection. The precedence is as follows: 806 * 1. Hoplimit value specified via ioctl. 807 * 2. (If the outgoing interface is detected) the current 808 * hop limit of the interface specified by router advertisement. 809 * 3. The system default hoplimit. 810 */ 811 int 812 in6pcb_selecthlim(struct inpcb *inp, struct ifnet *ifp) 813 { 814 if (inp && in6p_hops6(inp) >= 0) 815 return in6p_hops6(inp); 816 else if (ifp) 817 return (ND_IFINFO(ifp)->chlim); 818 else 819 return (ip6_defhlim); 820 } 821 822 int 823 in6pcb_selecthlim_rt(struct inpcb *inp) 824 { 825 struct rtentry *rt; 826 827 if (inp == NULL) 828 return in6pcb_selecthlim(inp, NULL); 829 830 rt = rtcache_validate(&inp->inp_route); 831 if (rt != NULL) { 832 int ret = in6pcb_selecthlim(inp, rt->rt_ifp); 833 rtcache_unref(rt, &inp->inp_route); 834 return ret; 835 } else 836 return in6pcb_selecthlim(inp, NULL); 837 } 838 839 /* 840 * Find an empty port and set it to the specified PCB. 841 */ 842 int 843 in6pcb_set_port(struct sockaddr_in6 *sin6, struct inpcb *inp, struct lwp *l) 844 { 845 struct socket *so = inp->inp_socket; 846 struct inpcbtable *table = inp->inp_table; 847 u_int16_t lport, *lastport; 848 enum kauth_network_req req; 849 int error = 0; 850 851 if (inp->inp_flags & IN6P_LOWPORT) { 852 #ifndef IPNOPRIVPORTS 853 req = KAUTH_REQ_NETWORK_BIND_PRIVPORT; 854 #else 855 req = KAUTH_REQ_NETWORK_BIND_PORT; 856 #endif 857 lastport = &table->inpt_lastlow; 858 } else { 859 req = KAUTH_REQ_NETWORK_BIND_PORT; 860 861 lastport = &table->inpt_lastport; 862 } 863 864 /* XXX-kauth: KAUTH_REQ_NETWORK_BIND_AUTOASSIGN_{,PRIV}PORT */ 865 error = kauth_authorize_network(l->l_cred, KAUTH_NETWORK_BIND, req, so, 866 sin6, NULL); 867 if (error) 868 return (EACCES); 869 870 /* 871 * Use RFC6056 randomized port selection 872 */ 873 error = portalgo_randport(&lport, inp, l->l_cred); 874 if (error) 875 return error; 876 877 inp->inp_flags |= IN6P_ANONPORT; 878 *lastport = lport; 879 inp->inp_lport = htons(lport); 880 in6pcb_set_state(inp, INP_BOUND); 881 return (0); /* success */ 882 } 883 884 void 885 addrsel_policy_init(void) 886 { 887 init_policy_queue(); 888 889 /* initialize the "last resort" policy */ 890 memset(&defaultaddrpolicy, 0, sizeof(defaultaddrpolicy)); 891 defaultaddrpolicy.label = ADDR_LABEL_NOTAPP; 892 } 893 894 /* 895 * XXX: NOMPSAFE if a policy is set 896 */ 897 static struct in6_addrpolicy * 898 lookup_addrsel_policy(struct sockaddr_in6 *key) 899 { 900 struct in6_addrpolicy *match = NULL; 901 902 match = match_addrsel_policy(key); 903 904 if (match == NULL) 905 match = &defaultaddrpolicy; 906 else 907 match->use++; 908 909 return (match); 910 } 911 912 /* 913 * Subroutines to manage the address selection policy table via sysctl. 914 */ 915 struct sel_walkarg { 916 size_t w_total; 917 size_t w_given; 918 void * w_where; 919 void *w_limit; 920 }; 921 922 int sysctl_net_inet6_addrctlpolicy(SYSCTLFN_ARGS); 923 int 924 sysctl_net_inet6_addrctlpolicy(SYSCTLFN_ARGS) 925 { 926 int error = 0; 927 int s; 928 929 s = splsoftnet(); 930 931 if (newp) { 932 error = EPERM; 933 goto end; 934 } 935 if (oldp && oldlenp == NULL) { 936 error = EINVAL; 937 goto end; 938 } 939 if (oldp || oldlenp) { 940 struct sel_walkarg w; 941 size_t oldlen = *oldlenp; 942 943 memset(&w, 0, sizeof(w)); 944 w.w_given = oldlen; 945 w.w_where = oldp; 946 if (oldp) 947 w.w_limit = (char *)oldp + oldlen; 948 949 error = walk_addrsel_policy(dump_addrsel_policyent, &w); 950 951 *oldlenp = w.w_total; 952 if (oldp && w.w_total > oldlen && error == 0) 953 error = ENOMEM; 954 } 955 956 end: 957 splx(s); 958 959 return (error); 960 } 961 962 int 963 in6_src_ioctl(u_long cmd, void *data) 964 { 965 int i; 966 struct in6_addrpolicy ent0; 967 968 if (cmd != SIOCAADDRCTL_POLICY && cmd != SIOCDADDRCTL_POLICY) 969 return (EOPNOTSUPP); /* check for safety */ 970 971 ent0 = *(struct in6_addrpolicy *)data; 972 973 if (ent0.label == ADDR_LABEL_NOTAPP) 974 return (EINVAL); 975 /* check if the prefix mask is consecutive. */ 976 if (in6_mask2len(&ent0.addrmask.sin6_addr, NULL) < 0) 977 return (EINVAL); 978 /* clear trailing garbages (if any) of the prefix address. */ 979 for (i = 0; i < 4; i++) { 980 ent0.addr.sin6_addr.s6_addr32[i] &= 981 ent0.addrmask.sin6_addr.s6_addr32[i]; 982 } 983 ent0.use = 0; 984 985 switch (cmd) { 986 case SIOCAADDRCTL_POLICY: 987 return (add_addrsel_policyent(&ent0)); 988 case SIOCDADDRCTL_POLICY: 989 return (delete_addrsel_policyent(&ent0)); 990 } 991 992 return (0); /* XXX: compromise compilers */ 993 } 994 995 /* 996 * The followings are implementation of the policy table using a 997 * simple tail queue. 998 * XXX such details should be hidden. 999 * XXX implementation using binary tree should be more efficient. 1000 */ 1001 struct addrsel_policyent { 1002 TAILQ_ENTRY(addrsel_policyent) ape_entry; 1003 struct in6_addrpolicy ape_policy; 1004 }; 1005 1006 TAILQ_HEAD(addrsel_policyhead, addrsel_policyent); 1007 1008 struct addrsel_policyhead addrsel_policytab; 1009 1010 static void 1011 init_policy_queue(void) 1012 { 1013 TAILQ_INIT(&addrsel_policytab); 1014 } 1015 1016 static int 1017 add_addrsel_policyent(struct in6_addrpolicy *newpolicy) 1018 { 1019 struct addrsel_policyent *newpol, *pol; 1020 1021 /* duplication check */ 1022 TAILQ_FOREACH(pol, &addrsel_policytab, ape_entry) { 1023 if (IN6_ARE_ADDR_EQUAL(&newpolicy->addr.sin6_addr, 1024 &pol->ape_policy.addr.sin6_addr) && 1025 IN6_ARE_ADDR_EQUAL(&newpolicy->addrmask.sin6_addr, 1026 &pol->ape_policy.addrmask.sin6_addr)) { 1027 return (EEXIST); /* or override it? */ 1028 } 1029 } 1030 1031 newpol = malloc(sizeof(*newpol), M_IFADDR, M_WAITOK|M_ZERO); 1032 1033 /* XXX: should validate entry */ 1034 newpol->ape_policy = *newpolicy; 1035 1036 TAILQ_INSERT_TAIL(&addrsel_policytab, newpol, ape_entry); 1037 1038 return (0); 1039 } 1040 1041 static int 1042 delete_addrsel_policyent(struct in6_addrpolicy *key) 1043 { 1044 struct addrsel_policyent *pol; 1045 1046 /* search for the entry in the table */ 1047 for (pol = TAILQ_FIRST(&addrsel_policytab); pol; 1048 pol = TAILQ_NEXT(pol, ape_entry)) { 1049 if (IN6_ARE_ADDR_EQUAL(&key->addr.sin6_addr, 1050 &pol->ape_policy.addr.sin6_addr) && 1051 IN6_ARE_ADDR_EQUAL(&key->addrmask.sin6_addr, 1052 &pol->ape_policy.addrmask.sin6_addr)) { 1053 break; 1054 } 1055 } 1056 if (pol == NULL) { 1057 return (ESRCH); 1058 } 1059 1060 TAILQ_REMOVE(&addrsel_policytab, pol, ape_entry); 1061 1062 return (0); 1063 } 1064 1065 static int 1066 walk_addrsel_policy(int (*callback)(struct in6_addrpolicy *, void *), void *w) 1067 { 1068 struct addrsel_policyent *pol; 1069 int error = 0; 1070 1071 TAILQ_FOREACH(pol, &addrsel_policytab, ape_entry) { 1072 if ((error = (*callback)(&pol->ape_policy, w)) != 0) 1073 return error; 1074 } 1075 1076 return error; 1077 } 1078 1079 static int 1080 dump_addrsel_policyent(struct in6_addrpolicy *pol, void *arg) 1081 { 1082 int error = 0; 1083 struct sel_walkarg *w = arg; 1084 1085 if (w->w_where && (char *)w->w_where + sizeof(*pol) <= (char *)w->w_limit) { 1086 if ((error = copyout(pol, w->w_where, sizeof(*pol))) != 0) 1087 return error; 1088 w->w_where = (char *)w->w_where + sizeof(*pol); 1089 } 1090 w->w_total += sizeof(*pol); 1091 1092 return error; 1093 } 1094 1095 static struct in6_addrpolicy * 1096 match_addrsel_policy(struct sockaddr_in6 *key) 1097 { 1098 struct addrsel_policyent *pent; 1099 struct in6_addrpolicy *bestpol = NULL, *pol; 1100 int matchlen, bestmatchlen = -1; 1101 u_char *mp, *ep, *k, *p, m; 1102 1103 for (pent = TAILQ_FIRST(&addrsel_policytab); pent; 1104 pent = TAILQ_NEXT(pent, ape_entry)) { 1105 matchlen = 0; 1106 1107 pol = &pent->ape_policy; 1108 mp = (u_char *)&pol->addrmask.sin6_addr; 1109 ep = mp + 16; /* XXX: scope field? */ 1110 k = (u_char *)&key->sin6_addr; 1111 p = (u_char *)&pol->addr.sin6_addr; 1112 for (; mp < ep && *mp; mp++, k++, p++) { 1113 m = *mp; 1114 if ((*k & m) != *p) 1115 goto next; /* not match */ 1116 if (m == 0xff) /* short cut for a typical case */ 1117 matchlen += 8; 1118 else { 1119 while (m >= 0x80) { 1120 matchlen++; 1121 m <<= 1; 1122 } 1123 } 1124 } 1125 1126 /* matched. check if this is better than the current best. */ 1127 if (bestpol == NULL || 1128 matchlen > bestmatchlen) { 1129 bestpol = pol; 1130 bestmatchlen = matchlen; 1131 } 1132 1133 next: 1134 continue; 1135 } 1136 1137 return (bestpol); 1138 }
Cache object: 72ecf8fa354fa7ae6393f1092e59981b
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]