udp6_usrreq.c revision 272663
1/*- 2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 3 * Copyright (c) 2010-2011 Juniper Networks, Inc. 4 * Copyright (c) 2014 Kevin Lo 5 * All rights reserved. 6 * 7 * Portions of this software were developed by Robert N. M. Watson under 8 * contract to Juniper Networks, Inc. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. Neither the name of the project nor the names of its contributors 19 * may be used to endorse or promote products derived from this software 20 * without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * $KAME: udp6_usrreq.c,v 1.27 2001/05/21 05:45:10 jinmei Exp $ 35 * $KAME: udp6_output.c,v 1.31 2001/05/21 16:39:15 jinmei Exp $ 36 */ 37 38/*- 39 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995 40 * The Regents of the University of California. 41 * All rights reserved. 42 * 43 * Redistribution and use in source and binary forms, with or without 44 * modification, are permitted provided that the following conditions 45 * are met: 46 * 1. Redistributions of source code must retain the above copyright 47 * notice, this list of conditions and the following disclaimer. 48 * 2. Redistributions in binary form must reproduce the above copyright 49 * notice, this list of conditions and the following disclaimer in the 50 * documentation and/or other materials provided with the distribution. 51 * 4. Neither the name of the University nor the names of its contributors 52 * may be used to endorse or promote products derived from this software 53 * without specific prior written permission. 54 * 55 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 56 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 57 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 58 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 59 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 60 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 61 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 62 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 63 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 64 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 65 * SUCH DAMAGE. 66 * 67 * @(#)udp_usrreq.c 8.6 (Berkeley) 5/23/95 68 */ 69 70#include <sys/cdefs.h> 71__FBSDID("$FreeBSD: stable/10/sys/netinet6/udp6_usrreq.c 272663 2014-10-06 17:12:03Z tuexen $"); 72 73#include "opt_inet.h" 74#include "opt_inet6.h" 75#include "opt_ipfw.h" 76#include "opt_ipsec.h" 77#include "opt_kdtrace.h" 78 79#include <sys/param.h> 80#include <sys/jail.h> 81#include <sys/kernel.h> 82#include <sys/lock.h> 83#include <sys/mbuf.h> 84#include <sys/priv.h> 85#include <sys/proc.h> 86#include <sys/protosw.h> 87#include <sys/sdt.h> 88#include <sys/signalvar.h> 89#include <sys/socket.h> 90#include <sys/socketvar.h> 91#include <sys/sx.h> 92#include <sys/sysctl.h> 93#include <sys/syslog.h> 94#include <sys/systm.h> 95 96#include <net/if.h> 97#include <net/if_types.h> 98#include <net/route.h> 99 100#include <netinet/in.h> 101#include <netinet/in_kdtrace.h> 102#include <netinet/in_pcb.h> 103#include <netinet/in_systm.h> 104#include <netinet/in_var.h> 105#include <netinet/ip.h> 106#include <netinet/ip_icmp.h> 107#include <netinet/ip6.h> 108#include <netinet/icmp_var.h> 109#include <netinet/icmp6.h> 110#include <netinet/ip_var.h> 111#include <netinet/udp.h> 112#include <netinet/udp_var.h> 113#include <netinet/udplite.h> 114 115#include <netinet6/ip6protosw.h> 116#include <netinet6/ip6_var.h> 117#include <netinet6/in6_pcb.h> 118#include <netinet6/udp6_var.h> 119#include <netinet6/scope6_var.h> 120 121#ifdef IPSEC 122#include <netipsec/ipsec.h> 123#include <netipsec/ipsec6.h> 124#endif /* IPSEC */ 125 126#include <security/mac/mac_framework.h> 127 128/* 129 * UDP protocol implementation. 130 * Per RFC 768, August, 1980. 131 */ 132 133extern struct protosw inetsw[]; 134static void udp6_detach(struct socket *so); 135 136static void 137udp6_append(struct inpcb *inp, struct mbuf *n, int off, 138 struct sockaddr_in6 *fromsa) 139{ 140 struct socket *so; 141 struct mbuf *opts; 142 143 INP_LOCK_ASSERT(inp); 144 145#ifdef IPSEC 146 /* Check AH/ESP integrity. */ 147 if (ipsec6_in_reject(n, inp)) { 148 m_freem(n); 149 IPSEC6STAT_INC(ips_in_polvio); 150 return; 151 } 152#endif /* IPSEC */ 153#ifdef MAC 154 if (mac_inpcb_check_deliver(inp, n) != 0) { 155 m_freem(n); 156 return; 157 } 158#endif 159 opts = NULL; 160 if (inp->inp_flags & INP_CONTROLOPTS || 161 inp->inp_socket->so_options & SO_TIMESTAMP) 162 ip6_savecontrol(inp, n, &opts); 163 m_adj(n, off + sizeof(struct udphdr)); 164 165 so = inp->inp_socket; 166 SOCKBUF_LOCK(&so->so_rcv); 167 if (sbappendaddr_locked(&so->so_rcv, (struct sockaddr *)fromsa, n, 168 opts) == 0) { 169 SOCKBUF_UNLOCK(&so->so_rcv); 170 m_freem(n); 171 if (opts) 172 m_freem(opts); 173 UDPSTAT_INC(udps_fullsock); 174 } else 175 sorwakeup_locked(so); 176} 177 178int 179udp6_input(struct mbuf **mp, int *offp, int proto) 180{ 181 struct mbuf *m = *mp; 182 struct ifnet *ifp; 183 struct ip6_hdr *ip6; 184 struct udphdr *uh; 185 struct inpcb *inp; 186 struct inpcbinfo *pcbinfo; 187 struct udpcb *up; 188 int off = *offp; 189 int cscov_partial; 190 int plen, ulen; 191 struct sockaddr_in6 fromsa; 192 struct m_tag *fwd_tag; 193 uint16_t uh_sum; 194 uint8_t nxt; 195 196 ifp = m->m_pkthdr.rcvif; 197 ip6 = mtod(m, struct ip6_hdr *); 198 199 if (faithprefix_p != NULL && (*faithprefix_p)(&ip6->ip6_dst)) { 200 /* XXX send icmp6 host/port unreach? */ 201 m_freem(m); 202 return (IPPROTO_DONE); 203 } 204 205#ifndef PULLDOWN_TEST 206 IP6_EXTHDR_CHECK(m, off, sizeof(struct udphdr), IPPROTO_DONE); 207 ip6 = mtod(m, struct ip6_hdr *); 208 uh = (struct udphdr *)((caddr_t)ip6 + off); 209#else 210 IP6_EXTHDR_GET(uh, struct udphdr *, m, off, sizeof(*uh)); 211 if (!uh) 212 return (IPPROTO_DONE); 213#endif 214 215 UDPSTAT_INC(udps_ipackets); 216 217 /* 218 * Destination port of 0 is illegal, based on RFC768. 219 */ 220 if (uh->uh_dport == 0) 221 goto badunlocked; 222 223 plen = ntohs(ip6->ip6_plen) - off + sizeof(*ip6); 224 ulen = ntohs((u_short)uh->uh_ulen); 225 226 nxt = ip6->ip6_nxt; 227 cscov_partial = (nxt == IPPROTO_UDPLITE) ? 1 : 0; 228 if (nxt == IPPROTO_UDPLITE) { 229 /* Zero means checksum over the complete packet. */ 230 if (ulen == 0) 231 ulen = plen; 232 if (ulen == plen) 233 cscov_partial = 0; 234 if ((ulen < sizeof(struct udphdr)) || (ulen > plen)) { 235 /* XXX: What is the right UDPLite MIB counter? */ 236 goto badunlocked; 237 } 238 } else { 239 if ((ulen < sizeof(struct udphdr)) || (plen != ulen)) { 240 UDPSTAT_INC(udps_badlen); 241 goto badunlocked; 242 } 243 } 244 245 if ((m->m_pkthdr.csum_flags & CSUM_DATA_VALID_IPV6) && 246 !cscov_partial) { 247 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) 248 uh_sum = m->m_pkthdr.csum_data; 249 else 250 uh_sum = in6_cksum_pseudo(ip6, ulen, nxt, 251 m->m_pkthdr.csum_data); 252 uh_sum ^= 0xffff; 253 } else 254 uh_sum = in6_cksum_partial(m, nxt, off, plen, ulen); 255 256 if (uh_sum != 0) { 257 UDPSTAT_INC(udps_badsum); 258 /*goto badunlocked;*/ 259 } 260 261 /* 262 * Construct sockaddr format source address. 263 */ 264 init_sin6(&fromsa, m); 265 fromsa.sin6_port = uh->uh_sport; 266 267 pcbinfo = get_inpcbinfo(nxt); 268 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 269 struct inpcb *last; 270 struct inpcbhead *pcblist; 271 struct ip6_moptions *imo; 272 273 INP_INFO_RLOCK(pcbinfo); 274 /* 275 * In the event that laddr should be set to the link-local 276 * address (this happens in RIPng), the multicast address 277 * specified in the received packet will not match laddr. To 278 * handle this situation, matching is relaxed if the 279 * receiving interface is the same as one specified in the 280 * socket and if the destination multicast address matches 281 * one of the multicast groups specified in the socket. 282 */ 283 284 /* 285 * KAME note: traditionally we dropped udpiphdr from mbuf 286 * here. We need udphdr for IPsec processing so we do that 287 * later. 288 */ 289 pcblist = get_pcblist(nxt); 290 last = NULL; 291 LIST_FOREACH(inp, pcblist, inp_list) { 292 if ((inp->inp_vflag & INP_IPV6) == 0) 293 continue; 294 if (inp->inp_lport != uh->uh_dport) 295 continue; 296 if (inp->inp_fport != 0 && 297 inp->inp_fport != uh->uh_sport) 298 continue; 299 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) { 300 if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, 301 &ip6->ip6_dst)) 302 continue; 303 } 304 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) { 305 if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, 306 &ip6->ip6_src) || 307 inp->inp_fport != uh->uh_sport) 308 continue; 309 } 310 311 /* 312 * XXXRW: Because we weren't holding either the inpcb 313 * or the hash lock when we checked for a match 314 * before, we should probably recheck now that the 315 * inpcb lock is (supposed to be) held. 316 */ 317 318 /* 319 * Handle socket delivery policy for any-source 320 * and source-specific multicast. [RFC3678] 321 */ 322 imo = inp->in6p_moptions; 323 if (imo && IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 324 struct sockaddr_in6 mcaddr; 325 int blocked; 326 327 INP_RLOCK(inp); 328 329 bzero(&mcaddr, sizeof(struct sockaddr_in6)); 330 mcaddr.sin6_len = sizeof(struct sockaddr_in6); 331 mcaddr.sin6_family = AF_INET6; 332 mcaddr.sin6_addr = ip6->ip6_dst; 333 334 blocked = im6o_mc_filter(imo, ifp, 335 (struct sockaddr *)&mcaddr, 336 (struct sockaddr *)&fromsa); 337 if (blocked != MCAST_PASS) { 338 if (blocked == MCAST_NOTGMEMBER) 339 IP6STAT_INC(ip6s_notmember); 340 if (blocked == MCAST_NOTSMEMBER || 341 blocked == MCAST_MUTED) 342 UDPSTAT_INC(udps_filtermcast); 343 INP_RUNLOCK(inp); /* XXX */ 344 continue; 345 } 346 347 INP_RUNLOCK(inp); 348 } 349 if (last != NULL) { 350 struct mbuf *n; 351 352 if ((n = m_copy(m, 0, M_COPYALL)) != NULL) { 353 INP_RLOCK(last); 354 up = intoudpcb(last); 355 if (up->u_tun_func == NULL) { 356 udp6_append(last, n, off, &fromsa); 357 } else { 358 /* 359 * Engage the tunneling 360 * protocol we will have to 361 * leave the info_lock up, 362 * since we are hunting 363 * through multiple UDP's. 364 * 365 */ 366 (*up->u_tun_func)(n, off, last); 367 } 368 INP_RUNLOCK(last); 369 } 370 } 371 last = inp; 372 /* 373 * Don't look for additional matches if this one does 374 * not have either the SO_REUSEPORT or SO_REUSEADDR 375 * socket options set. This heuristic avoids 376 * searching through all pcbs in the common case of a 377 * non-shared port. It assumes that an application 378 * will never clear these options after setting them. 379 */ 380 if ((last->inp_socket->so_options & 381 (SO_REUSEPORT|SO_REUSEADDR)) == 0) 382 break; 383 } 384 385 if (last == NULL) { 386 /* 387 * No matching pcb found; discard datagram. (No need 388 * to send an ICMP Port Unreachable for a broadcast 389 * or multicast datgram.) 390 */ 391 UDPSTAT_INC(udps_noport); 392 UDPSTAT_INC(udps_noportmcast); 393 goto badheadlocked; 394 } 395 INP_RLOCK(last); 396 INP_INFO_RUNLOCK(pcbinfo); 397 up = intoudpcb(last); 398 UDP_PROBE(receive, NULL, last, ip6, last, uh); 399 if (up->u_tun_func == NULL) { 400 udp6_append(last, m, off, &fromsa); 401 } else { 402 /* 403 * Engage the tunneling protocol. 404 */ 405 (*up->u_tun_func)(m, off, last); 406 } 407 INP_RUNLOCK(last); 408 return (IPPROTO_DONE); 409 } 410 /* 411 * Locate pcb for datagram. 412 */ 413 414 /* 415 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain. 416 */ 417 if ((m->m_flags & M_IP6_NEXTHOP) && 418 (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) { 419 struct sockaddr_in6 *next_hop6; 420 421 next_hop6 = (struct sockaddr_in6 *)(fwd_tag + 1); 422 423 /* 424 * Transparently forwarded. Pretend to be the destination. 425 * Already got one like this? 426 */ 427 inp = in6_pcblookup_mbuf(pcbinfo, &ip6->ip6_src, 428 uh->uh_sport, &ip6->ip6_dst, uh->uh_dport, 429 INPLOOKUP_RLOCKPCB, m->m_pkthdr.rcvif, m); 430 if (!inp) { 431 /* 432 * It's new. Try to find the ambushing socket. 433 * Because we've rewritten the destination address, 434 * any hardware-generated hash is ignored. 435 */ 436 inp = in6_pcblookup(pcbinfo, &ip6->ip6_src, 437 uh->uh_sport, &next_hop6->sin6_addr, 438 next_hop6->sin6_port ? htons(next_hop6->sin6_port) : 439 uh->uh_dport, INPLOOKUP_WILDCARD | 440 INPLOOKUP_RLOCKPCB, m->m_pkthdr.rcvif); 441 } 442 /* Remove the tag from the packet. We don't need it anymore. */ 443 m_tag_delete(m, fwd_tag); 444 m->m_flags &= ~M_IP6_NEXTHOP; 445 } else 446 inp = in6_pcblookup_mbuf(pcbinfo, &ip6->ip6_src, 447 uh->uh_sport, &ip6->ip6_dst, uh->uh_dport, 448 INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB, 449 m->m_pkthdr.rcvif, m); 450 if (inp == NULL) { 451 if (udp_log_in_vain) { 452 char ip6bufs[INET6_ADDRSTRLEN]; 453 char ip6bufd[INET6_ADDRSTRLEN]; 454 455 log(LOG_INFO, 456 "Connection attempt to UDP [%s]:%d from [%s]:%d\n", 457 ip6_sprintf(ip6bufd, &ip6->ip6_dst), 458 ntohs(uh->uh_dport), 459 ip6_sprintf(ip6bufs, &ip6->ip6_src), 460 ntohs(uh->uh_sport)); 461 } 462 UDPSTAT_INC(udps_noport); 463 if (m->m_flags & M_MCAST) { 464 printf("UDP6: M_MCAST is set in a unicast packet.\n"); 465 UDPSTAT_INC(udps_noportmcast); 466 goto badunlocked; 467 } 468 if (V_udp_blackhole) 469 goto badunlocked; 470 if (badport_bandlim(BANDLIM_ICMP6_UNREACH) < 0) 471 goto badunlocked; 472 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT, 0); 473 return (IPPROTO_DONE); 474 } 475 INP_RLOCK_ASSERT(inp); 476 up = intoudpcb(inp); 477 if (cscov_partial) { 478 if (up->u_rxcslen == 0 || up->u_rxcslen > ulen) { 479 INP_RUNLOCK(inp); 480 m_freem(m); 481 return (IPPROTO_DONE); 482 } 483 } 484 UDP_PROBE(receive, NULL, inp, ip6, inp, uh); 485 if (up->u_tun_func == NULL) { 486 udp6_append(inp, m, off, &fromsa); 487 } else { 488 /* 489 * Engage the tunneling protocol. 490 */ 491 492 (*up->u_tun_func)(m, off, inp); 493 } 494 INP_RUNLOCK(inp); 495 return (IPPROTO_DONE); 496 497badheadlocked: 498 INP_INFO_RUNLOCK(pcbinfo); 499badunlocked: 500 if (m) 501 m_freem(m); 502 return (IPPROTO_DONE); 503} 504 505static void 506udp6_common_ctlinput(int cmd, struct sockaddr *sa, void *d, 507 struct inpcbinfo *pcbinfo) 508{ 509 struct udphdr uh; 510 struct ip6_hdr *ip6; 511 struct mbuf *m; 512 int off = 0; 513 struct ip6ctlparam *ip6cp = NULL; 514 const struct sockaddr_in6 *sa6_src = NULL; 515 void *cmdarg; 516 struct inpcb *(*notify)(struct inpcb *, int) = udp_notify; 517 struct udp_portonly { 518 u_int16_t uh_sport; 519 u_int16_t uh_dport; 520 } *uhp; 521 522 if (sa->sa_family != AF_INET6 || 523 sa->sa_len != sizeof(struct sockaddr_in6)) 524 return; 525 526 if ((unsigned)cmd >= PRC_NCMDS) 527 return; 528 if (PRC_IS_REDIRECT(cmd)) 529 notify = in6_rtchange, d = NULL; 530 else if (cmd == PRC_HOSTDEAD) 531 d = NULL; 532 else if (inet6ctlerrmap[cmd] == 0) 533 return; 534 535 /* if the parameter is from icmp6, decode it. */ 536 if (d != NULL) { 537 ip6cp = (struct ip6ctlparam *)d; 538 m = ip6cp->ip6c_m; 539 ip6 = ip6cp->ip6c_ip6; 540 off = ip6cp->ip6c_off; 541 cmdarg = ip6cp->ip6c_cmdarg; 542 sa6_src = ip6cp->ip6c_src; 543 } else { 544 m = NULL; 545 ip6 = NULL; 546 cmdarg = NULL; 547 sa6_src = &sa6_any; 548 } 549 550 if (ip6) { 551 /* 552 * XXX: We assume that when IPV6 is non NULL, 553 * M and OFF are valid. 554 */ 555 556 /* Check if we can safely examine src and dst ports. */ 557 if (m->m_pkthdr.len < off + sizeof(*uhp)) 558 return; 559 560 bzero(&uh, sizeof(uh)); 561 m_copydata(m, off, sizeof(*uhp), (caddr_t)&uh); 562 563 (void)in6_pcbnotify(pcbinfo, sa, uh.uh_dport, 564 (struct sockaddr *)ip6cp->ip6c_src, uh.uh_sport, cmd, 565 cmdarg, notify); 566 } else 567 (void)in6_pcbnotify(pcbinfo, sa, 0, 568 (const struct sockaddr *)sa6_src, 0, cmd, cmdarg, notify); 569} 570 571void 572udp6_ctlinput(int cmd, struct sockaddr *sa, void *d) 573{ 574 575 return (udp6_common_ctlinput(cmd, sa, d, &V_udbinfo)); 576} 577 578void 579udplite6_ctlinput(int cmd, struct sockaddr *sa, void *d) 580{ 581 582 return (udp6_common_ctlinput(cmd, sa, d, &V_ulitecbinfo)); 583} 584 585static int 586udp6_getcred(SYSCTL_HANDLER_ARGS) 587{ 588 struct xucred xuc; 589 struct sockaddr_in6 addrs[2]; 590 struct inpcb *inp; 591 int error; 592 593 error = priv_check(req->td, PRIV_NETINET_GETCRED); 594 if (error) 595 return (error); 596 597 if (req->newlen != sizeof(addrs)) 598 return (EINVAL); 599 if (req->oldlen != sizeof(struct xucred)) 600 return (EINVAL); 601 error = SYSCTL_IN(req, addrs, sizeof(addrs)); 602 if (error) 603 return (error); 604 if ((error = sa6_embedscope(&addrs[0], V_ip6_use_defzone)) != 0 || 605 (error = sa6_embedscope(&addrs[1], V_ip6_use_defzone)) != 0) { 606 return (error); 607 } 608 inp = in6_pcblookup(&V_udbinfo, &addrs[1].sin6_addr, 609 addrs[1].sin6_port, &addrs[0].sin6_addr, addrs[0].sin6_port, 610 INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB, NULL); 611 if (inp != NULL) { 612 INP_RLOCK_ASSERT(inp); 613 if (inp->inp_socket == NULL) 614 error = ENOENT; 615 if (error == 0) 616 error = cr_canseesocket(req->td->td_ucred, 617 inp->inp_socket); 618 if (error == 0) 619 cru2x(inp->inp_cred, &xuc); 620 INP_RUNLOCK(inp); 621 } else 622 error = ENOENT; 623 if (error == 0) 624 error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred)); 625 return (error); 626} 627 628SYSCTL_PROC(_net_inet6_udp6, OID_AUTO, getcred, CTLTYPE_OPAQUE|CTLFLAG_RW, 0, 629 0, udp6_getcred, "S,xucred", "Get the xucred of a UDP6 connection"); 630 631static int 632udp6_output(struct inpcb *inp, struct mbuf *m, struct sockaddr *addr6, 633 struct mbuf *control, struct thread *td) 634{ 635 u_int32_t ulen = m->m_pkthdr.len; 636 u_int32_t plen = sizeof(struct udphdr) + ulen; 637 struct ip6_hdr *ip6; 638 struct udphdr *udp6; 639 struct in6_addr *laddr, *faddr, in6a; 640 struct sockaddr_in6 *sin6 = NULL; 641 struct ifnet *oifp = NULL; 642 int cscov_partial = 0; 643 int scope_ambiguous = 0; 644 u_short fport; 645 int error = 0; 646 uint8_t nxt; 647 uint16_t cscov = 0; 648 struct ip6_pktopts *optp, opt; 649 int af = AF_INET6, hlen = sizeof(struct ip6_hdr); 650 int flags; 651 struct sockaddr_in6 tmp; 652 653 INP_WLOCK_ASSERT(inp); 654 INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo); 655 656 if (addr6) { 657 /* addr6 has been validated in udp6_send(). */ 658 sin6 = (struct sockaddr_in6 *)addr6; 659 660 /* protect *sin6 from overwrites */ 661 tmp = *sin6; 662 sin6 = &tmp; 663 664 /* 665 * Application should provide a proper zone ID or the use of 666 * default zone IDs should be enabled. Unfortunately, some 667 * applications do not behave as it should, so we need a 668 * workaround. Even if an appropriate ID is not determined, 669 * we'll see if we can determine the outgoing interface. If we 670 * can, determine the zone ID based on the interface below. 671 */ 672 if (sin6->sin6_scope_id == 0 && !V_ip6_use_defzone) 673 scope_ambiguous = 1; 674 if ((error = sa6_embedscope(sin6, V_ip6_use_defzone)) != 0) 675 return (error); 676 } 677 678 if (control) { 679 if ((error = ip6_setpktopts(control, &opt, 680 inp->in6p_outputopts, td->td_ucred, IPPROTO_UDP)) != 0) 681 goto release; 682 optp = &opt; 683 } else 684 optp = inp->in6p_outputopts; 685 686 if (sin6) { 687 faddr = &sin6->sin6_addr; 688 689 /* 690 * Since we saw no essential reason for calling in_pcbconnect, 691 * we get rid of such kind of logic, and call in6_selectsrc 692 * and in6_pcbsetport in order to fill in the local address 693 * and the local port. 694 */ 695 if (sin6->sin6_port == 0) { 696 error = EADDRNOTAVAIL; 697 goto release; 698 } 699 700 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) { 701 /* how about ::ffff:0.0.0.0 case? */ 702 error = EISCONN; 703 goto release; 704 } 705 706 fport = sin6->sin6_port; /* allow 0 port */ 707 708 if (IN6_IS_ADDR_V4MAPPED(faddr)) { 709 if ((inp->inp_flags & IN6P_IPV6_V6ONLY)) { 710 /* 711 * I believe we should explicitly discard the 712 * packet when mapped addresses are disabled, 713 * rather than send the packet as an IPv6 one. 714 * If we chose the latter approach, the packet 715 * might be sent out on the wire based on the 716 * default route, the situation which we'd 717 * probably want to avoid. 718 * (20010421 jinmei@kame.net) 719 */ 720 error = EINVAL; 721 goto release; 722 } 723 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) && 724 !IN6_IS_ADDR_V4MAPPED(&inp->in6p_laddr)) { 725 /* 726 * when remote addr is an IPv4-mapped address, 727 * local addr should not be an IPv6 address, 728 * since you cannot determine how to map IPv6 729 * source address to IPv4. 730 */ 731 error = EINVAL; 732 goto release; 733 } 734 735 af = AF_INET; 736 } 737 738 if (!IN6_IS_ADDR_V4MAPPED(faddr)) { 739 error = in6_selectsrc(sin6, optp, inp, NULL, 740 td->td_ucred, &oifp, &in6a); 741 if (error) 742 goto release; 743 if (oifp && scope_ambiguous && 744 (error = in6_setscope(&sin6->sin6_addr, 745 oifp, NULL))) { 746 goto release; 747 } 748 laddr = &in6a; 749 } else 750 laddr = &inp->in6p_laddr; /* XXX */ 751 if (laddr == NULL) { 752 if (error == 0) 753 error = EADDRNOTAVAIL; 754 goto release; 755 } 756 if (inp->inp_lport == 0 && 757 (error = in6_pcbsetport(laddr, inp, td->td_ucred)) != 0) { 758 /* Undo an address bind that may have occurred. */ 759 inp->in6p_laddr = in6addr_any; 760 goto release; 761 } 762 } else { 763 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) { 764 error = ENOTCONN; 765 goto release; 766 } 767 if (IN6_IS_ADDR_V4MAPPED(&inp->in6p_faddr)) { 768 if ((inp->inp_flags & IN6P_IPV6_V6ONLY)) { 769 /* 770 * XXX: this case would happen when the 771 * application sets the V6ONLY flag after 772 * connecting the foreign address. 773 * Such applications should be fixed, 774 * so we bark here. 775 */ 776 log(LOG_INFO, "udp6_output: IPV6_V6ONLY " 777 "option was set for a connected socket\n"); 778 error = EINVAL; 779 goto release; 780 } else 781 af = AF_INET; 782 } 783 laddr = &inp->in6p_laddr; 784 faddr = &inp->in6p_faddr; 785 fport = inp->inp_fport; 786 } 787 788 if (af == AF_INET) 789 hlen = sizeof(struct ip); 790 791 /* 792 * Calculate data length and get a mbuf 793 * for UDP and IP6 headers. 794 */ 795 M_PREPEND(m, hlen + sizeof(struct udphdr), M_NOWAIT); 796 if (m == 0) { 797 error = ENOBUFS; 798 goto release; 799 } 800 801 /* 802 * Stuff checksum and output datagram. 803 */ 804 nxt = (inp->inp_socket->so_proto->pr_protocol == IPPROTO_UDP) ? 805 IPPROTO_UDP : IPPROTO_UDPLITE; 806 udp6 = (struct udphdr *)(mtod(m, caddr_t) + hlen); 807 udp6->uh_sport = inp->inp_lport; /* lport is always set in the PCB */ 808 udp6->uh_dport = fport; 809 if (nxt == IPPROTO_UDPLITE) { 810 struct udpcb *up; 811 812 up = intoudpcb(inp); 813 cscov = up->u_txcslen; 814 if (cscov >= plen) 815 cscov = 0; 816 udp6->uh_ulen = htons(cscov); 817 /* 818 * For UDP-Lite, checksum coverage length of zero means 819 * the entire UDPLite packet is covered by the checksum. 820 */ 821 cscov_partial = (cscov == 0) ? 0 : 1; 822 } else if (plen <= 0xffff) 823 udp6->uh_ulen = htons((u_short)plen); 824 else 825 udp6->uh_ulen = 0; 826 udp6->uh_sum = 0; 827 828 switch (af) { 829 case AF_INET6: 830 ip6 = mtod(m, struct ip6_hdr *); 831 ip6->ip6_flow = inp->inp_flow & IPV6_FLOWINFO_MASK; 832 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 833 ip6->ip6_vfc |= IPV6_VERSION; 834 ip6->ip6_plen = htons((u_short)plen); 835 ip6->ip6_nxt = nxt; 836 ip6->ip6_hlim = in6_selecthlim(inp, NULL); 837 ip6->ip6_src = *laddr; 838 ip6->ip6_dst = *faddr; 839 840 if (cscov_partial) { 841 if ((udp6->uh_sum = in6_cksum_partial(m, nxt, 842 sizeof(struct ip6_hdr), plen, cscov)) == 0) 843 udp6->uh_sum = 0xffff; 844 } else { 845 udp6->uh_sum = in6_cksum_pseudo(ip6, plen, nxt, 0); 846 m->m_pkthdr.csum_flags = CSUM_UDP_IPV6; 847 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum); 848 } 849 850 flags = 0; 851 852 UDP_PROBE(send, NULL, inp, ip6, inp, udp6); 853 UDPSTAT_INC(udps_opackets); 854 error = ip6_output(m, optp, NULL, flags, inp->in6p_moptions, 855 NULL, inp); 856 break; 857 case AF_INET: 858 error = EAFNOSUPPORT; 859 goto release; 860 } 861 goto releaseopt; 862 863release: 864 m_freem(m); 865 866releaseopt: 867 if (control) { 868 ip6_clearpktopts(&opt, -1); 869 m_freem(control); 870 } 871 return (error); 872} 873 874static void 875udp6_abort(struct socket *so) 876{ 877 struct inpcb *inp; 878 struct inpcbinfo *pcbinfo; 879 880 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol); 881 inp = sotoinpcb(so); 882 KASSERT(inp != NULL, ("udp6_abort: inp == NULL")); 883 884#ifdef INET 885 if (inp->inp_vflag & INP_IPV4) { 886 struct pr_usrreqs *pru; 887 888 pru = inetsw[ip_protox[IPPROTO_UDP]].pr_usrreqs; 889 (*pru->pru_abort)(so); 890 return; 891 } 892#endif 893 894 INP_WLOCK(inp); 895 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) { 896 INP_HASH_WLOCK(pcbinfo); 897 in6_pcbdisconnect(inp); 898 inp->in6p_laddr = in6addr_any; 899 INP_HASH_WUNLOCK(pcbinfo); 900 soisdisconnected(so); 901 } 902 INP_WUNLOCK(inp); 903} 904 905static int 906udp6_attach(struct socket *so, int proto, struct thread *td) 907{ 908 struct inpcb *inp; 909 struct inpcbinfo *pcbinfo; 910 int error; 911 912 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol); 913 inp = sotoinpcb(so); 914 KASSERT(inp == NULL, ("udp6_attach: inp != NULL")); 915 916 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) { 917 error = soreserve(so, udp_sendspace, udp_recvspace); 918 if (error) 919 return (error); 920 } 921 INP_INFO_WLOCK(pcbinfo); 922 error = in_pcballoc(so, pcbinfo); 923 if (error) { 924 INP_INFO_WUNLOCK(pcbinfo); 925 return (error); 926 } 927 inp = (struct inpcb *)so->so_pcb; 928 inp->inp_vflag |= INP_IPV6; 929 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) 930 inp->inp_vflag |= INP_IPV4; 931 inp->in6p_hops = -1; /* use kernel default */ 932 inp->in6p_cksum = -1; /* just to be sure */ 933 /* 934 * XXX: ugly!! 935 * IPv4 TTL initialization is necessary for an IPv6 socket as well, 936 * because the socket may be bound to an IPv6 wildcard address, 937 * which may match an IPv4-mapped IPv6 address. 938 */ 939 inp->inp_ip_ttl = V_ip_defttl; 940 941 error = udp_newudpcb(inp); 942 if (error) { 943 in_pcbdetach(inp); 944 in_pcbfree(inp); 945 INP_INFO_WUNLOCK(pcbinfo); 946 return (error); 947 } 948 INP_WUNLOCK(inp); 949 INP_INFO_WUNLOCK(pcbinfo); 950 return (0); 951} 952 953static int 954udp6_bind(struct socket *so, struct sockaddr *nam, struct thread *td) 955{ 956 struct inpcb *inp; 957 struct inpcbinfo *pcbinfo; 958 int error; 959 960 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol); 961 inp = sotoinpcb(so); 962 KASSERT(inp != NULL, ("udp6_bind: inp == NULL")); 963 964 INP_WLOCK(inp); 965 INP_HASH_WLOCK(pcbinfo); 966 inp->inp_vflag &= ~INP_IPV4; 967 inp->inp_vflag |= INP_IPV6; 968 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) { 969 struct sockaddr_in6 *sin6_p; 970 971 sin6_p = (struct sockaddr_in6 *)nam; 972 973 if (IN6_IS_ADDR_UNSPECIFIED(&sin6_p->sin6_addr)) 974 inp->inp_vflag |= INP_IPV4; 975#ifdef INET 976 else if (IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr)) { 977 struct sockaddr_in sin; 978 979 in6_sin6_2_sin(&sin, sin6_p); 980 inp->inp_vflag |= INP_IPV4; 981 inp->inp_vflag &= ~INP_IPV6; 982 error = in_pcbbind(inp, (struct sockaddr *)&sin, 983 td->td_ucred); 984 goto out; 985 } 986#endif 987 } 988 989 error = in6_pcbbind(inp, nam, td->td_ucred); 990#ifdef INET 991out: 992#endif 993 INP_HASH_WUNLOCK(pcbinfo); 994 INP_WUNLOCK(inp); 995 return (error); 996} 997 998static void 999udp6_close(struct socket *so) 1000{ 1001 struct inpcb *inp; 1002 struct inpcbinfo *pcbinfo; 1003 1004 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol); 1005 inp = sotoinpcb(so); 1006 KASSERT(inp != NULL, ("udp6_close: inp == NULL")); 1007 1008#ifdef INET 1009 if (inp->inp_vflag & INP_IPV4) { 1010 struct pr_usrreqs *pru; 1011 1012 pru = inetsw[ip_protox[IPPROTO_UDP]].pr_usrreqs; 1013 (*pru->pru_disconnect)(so); 1014 return; 1015 } 1016#endif 1017 INP_WLOCK(inp); 1018 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) { 1019 INP_HASH_WLOCK(pcbinfo); 1020 in6_pcbdisconnect(inp); 1021 inp->in6p_laddr = in6addr_any; 1022 INP_HASH_WUNLOCK(pcbinfo); 1023 soisdisconnected(so); 1024 } 1025 INP_WUNLOCK(inp); 1026} 1027 1028static int 1029udp6_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 1030{ 1031 struct inpcb *inp; 1032 struct inpcbinfo *pcbinfo; 1033 struct sockaddr_in6 *sin6; 1034 int error; 1035 1036 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol); 1037 inp = sotoinpcb(so); 1038 sin6 = (struct sockaddr_in6 *)nam; 1039 KASSERT(inp != NULL, ("udp6_connect: inp == NULL")); 1040 1041 /* 1042 * XXXRW: Need to clarify locking of v4/v6 flags. 1043 */ 1044 INP_WLOCK(inp); 1045#ifdef INET 1046 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 1047 struct sockaddr_in sin; 1048 1049 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) { 1050 error = EINVAL; 1051 goto out; 1052 } 1053 if (inp->inp_faddr.s_addr != INADDR_ANY) { 1054 error = EISCONN; 1055 goto out; 1056 } 1057 in6_sin6_2_sin(&sin, sin6); 1058 inp->inp_vflag |= INP_IPV4; 1059 inp->inp_vflag &= ~INP_IPV6; 1060 error = prison_remote_ip4(td->td_ucred, &sin.sin_addr); 1061 if (error != 0) 1062 goto out; 1063 INP_HASH_WLOCK(pcbinfo); 1064 error = in_pcbconnect(inp, (struct sockaddr *)&sin, 1065 td->td_ucred); 1066 INP_HASH_WUNLOCK(pcbinfo); 1067 if (error == 0) 1068 soisconnected(so); 1069 goto out; 1070 } 1071#endif 1072 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) { 1073 error = EISCONN; 1074 goto out; 1075 } 1076 inp->inp_vflag &= ~INP_IPV4; 1077 inp->inp_vflag |= INP_IPV6; 1078 error = prison_remote_ip6(td->td_ucred, &sin6->sin6_addr); 1079 if (error != 0) 1080 goto out; 1081 INP_HASH_WLOCK(pcbinfo); 1082 error = in6_pcbconnect(inp, nam, td->td_ucred); 1083 INP_HASH_WUNLOCK(pcbinfo); 1084 if (error == 0) 1085 soisconnected(so); 1086out: 1087 INP_WUNLOCK(inp); 1088 return (error); 1089} 1090 1091static void 1092udp6_detach(struct socket *so) 1093{ 1094 struct inpcb *inp; 1095 struct inpcbinfo *pcbinfo; 1096 struct udpcb *up; 1097 1098 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol); 1099 inp = sotoinpcb(so); 1100 KASSERT(inp != NULL, ("udp6_detach: inp == NULL")); 1101 1102 INP_INFO_WLOCK(pcbinfo); 1103 INP_WLOCK(inp); 1104 up = intoudpcb(inp); 1105 KASSERT(up != NULL, ("%s: up == NULL", __func__)); 1106 in_pcbdetach(inp); 1107 in_pcbfree(inp); 1108 INP_INFO_WUNLOCK(pcbinfo); 1109 udp_discardcb(up); 1110} 1111 1112static int 1113udp6_disconnect(struct socket *so) 1114{ 1115 struct inpcb *inp; 1116 struct inpcbinfo *pcbinfo; 1117 int error; 1118 1119 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol); 1120 inp = sotoinpcb(so); 1121 KASSERT(inp != NULL, ("udp6_disconnect: inp == NULL")); 1122 1123#ifdef INET 1124 if (inp->inp_vflag & INP_IPV4) { 1125 struct pr_usrreqs *pru; 1126 1127 pru = inetsw[ip_protox[IPPROTO_UDP]].pr_usrreqs; 1128 (void)(*pru->pru_disconnect)(so); 1129 return (0); 1130 } 1131#endif 1132 1133 INP_WLOCK(inp); 1134 1135 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) { 1136 error = ENOTCONN; 1137 goto out; 1138 } 1139 1140 INP_HASH_WLOCK(pcbinfo); 1141 in6_pcbdisconnect(inp); 1142 inp->in6p_laddr = in6addr_any; 1143 INP_HASH_WUNLOCK(pcbinfo); 1144 SOCK_LOCK(so); 1145 so->so_state &= ~SS_ISCONNECTED; /* XXX */ 1146 SOCK_UNLOCK(so); 1147out: 1148 INP_WUNLOCK(inp); 1149 return (0); 1150} 1151 1152static int 1153udp6_send(struct socket *so, int flags, struct mbuf *m, 1154 struct sockaddr *addr, struct mbuf *control, struct thread *td) 1155{ 1156 struct inpcb *inp; 1157 struct inpcbinfo *pcbinfo; 1158 int error = 0; 1159 1160 pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol); 1161 inp = sotoinpcb(so); 1162 KASSERT(inp != NULL, ("udp6_send: inp == NULL")); 1163 1164 INP_WLOCK(inp); 1165 if (addr) { 1166 if (addr->sa_len != sizeof(struct sockaddr_in6)) { 1167 error = EINVAL; 1168 goto bad; 1169 } 1170 if (addr->sa_family != AF_INET6) { 1171 error = EAFNOSUPPORT; 1172 goto bad; 1173 } 1174 } 1175 1176#ifdef INET 1177 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) { 1178 int hasv4addr; 1179 struct sockaddr_in6 *sin6 = 0; 1180 1181 if (addr == 0) 1182 hasv4addr = (inp->inp_vflag & INP_IPV4); 1183 else { 1184 sin6 = (struct sockaddr_in6 *)addr; 1185 hasv4addr = IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr) 1186 ? 1 : 0; 1187 } 1188 if (hasv4addr) { 1189 struct pr_usrreqs *pru; 1190 1191 /* 1192 * XXXRW: We release UDP-layer locks before calling 1193 * udp_send() in order to avoid recursion. However, 1194 * this does mean there is a short window where inp's 1195 * fields are unstable. Could this lead to a 1196 * potential race in which the factors causing us to 1197 * select the UDPv4 output routine are invalidated? 1198 */ 1199 INP_WUNLOCK(inp); 1200 if (sin6) 1201 in6_sin6_2_sin_in_sock(addr); 1202 pru = inetsw[ip_protox[IPPROTO_UDP]].pr_usrreqs; 1203 /* addr will just be freed in sendit(). */ 1204 return ((*pru->pru_send)(so, flags, m, addr, control, 1205 td)); 1206 } 1207 } 1208#endif 1209#ifdef MAC 1210 mac_inpcb_create_mbuf(inp, m); 1211#endif 1212 INP_HASH_WLOCK(pcbinfo); 1213 error = udp6_output(inp, m, addr, control, td); 1214 INP_HASH_WUNLOCK(pcbinfo); 1215#ifdef INET 1216#endif 1217 INP_WUNLOCK(inp); 1218 return (error); 1219 1220bad: 1221 INP_WUNLOCK(inp); 1222 m_freem(m); 1223 return (error); 1224} 1225 1226struct pr_usrreqs udp6_usrreqs = { 1227 .pru_abort = udp6_abort, 1228 .pru_attach = udp6_attach, 1229 .pru_bind = udp6_bind, 1230 .pru_connect = udp6_connect, 1231 .pru_control = in6_control, 1232 .pru_detach = udp6_detach, 1233 .pru_disconnect = udp6_disconnect, 1234 .pru_peeraddr = in6_mapped_peeraddr, 1235 .pru_send = udp6_send, 1236 .pru_shutdown = udp_shutdown, 1237 .pru_sockaddr = in6_mapped_sockaddr, 1238 .pru_soreceive = soreceive_dgram, 1239 .pru_sosend = sosend_dgram, 1240 .pru_sosetlabel = in_pcbsosetlabel, 1241 .pru_close = udp6_close 1242}; 1243