xref: /dflybsd-src/sys/netinet/udp_usrreq.c (revision ad20c46d58e3188f09065bcb9f092ae5890cbef0)
1 /*
2  * Copyright (c) 2004 Jeffrey Hsu.  All rights reserved.
3  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
4  *	The Regents of the University of California.  All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. All advertising materials mentioning features or use of this software
15  *    must display the following acknowledgement:
16  *	This product includes software developed by the University of
17  *	California, Berkeley and its contributors.
18  * 4. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)udp_usrreq.c	8.6 (Berkeley) 5/23/95
35  * $FreeBSD: src/sys/netinet/udp_usrreq.c,v 1.64.2.18 2003/01/24 05:11:34 sam Exp $
36  * $DragonFly: src/sys/netinet/udp_usrreq.c,v 1.25 2004/06/07 02:36:22 dillon Exp $
37  */
38 
39 #include "opt_ipsec.h"
40 #include "opt_inet6.h"
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/kernel.h>
45 #include <sys/malloc.h>
46 #include <sys/mbuf.h>
47 #include <sys/domain.h>
48 #include <sys/proc.h>
49 #include <sys/protosw.h>
50 #include <sys/socket.h>
51 #include <sys/socketvar.h>
52 #include <sys/sysctl.h>
53 #include <sys/syslog.h>
54 #include <sys/in_cksum.h>
55 
56 #include <machine/stdarg.h>
57 
58 #include <vm/vm_zone.h>
59 
60 #include <net/if.h>
61 #include <net/route.h>
62 
63 #include <netinet/in.h>
64 #include <netinet/in_systm.h>
65 #include <netinet/ip.h>
66 #ifdef INET6
67 #include <netinet/ip6.h>
68 #endif
69 #include <netinet/in_pcb.h>
70 #include <netinet/in_var.h>
71 #include <netinet/ip_var.h>
72 #ifdef INET6
73 #include <netinet6/ip6_var.h>
74 #endif
75 #include <netinet/ip_icmp.h>
76 #include <netinet/icmp_var.h>
77 #include <netinet/udp.h>
78 #include <netinet/udp_var.h>
79 
80 #ifdef FAST_IPSEC
81 #include <netipsec/ipsec.h>
82 #endif /*FAST_IPSEC*/
83 
84 #ifdef IPSEC
85 #include <netinet6/ipsec.h>
86 #endif /*IPSEC*/
87 
88 /*
89  * UDP protocol implementation.
90  * Per RFC 768, August, 1980.
91  */
92 #ifndef	COMPAT_42
93 static int	udpcksum = 1;
94 #else
95 static int	udpcksum = 0;		/* XXX */
96 #endif
97 SYSCTL_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum, CTLFLAG_RW,
98 		&udpcksum, 0, "");
99 
100 int	log_in_vain = 0;
101 SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_RW,
102     &log_in_vain, 0, "Log all incoming UDP packets");
103 
104 static int	blackhole = 0;
105 SYSCTL_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_RW,
106 	&blackhole, 0, "Do not send port unreachables for refused connects");
107 
108 static int	strict_mcast_mship = 1;
109 SYSCTL_INT(_net_inet_udp, OID_AUTO, strict_mcast_mship, CTLFLAG_RW,
110 	&strict_mcast_mship, 0, "Only send multicast to member sockets");
111 
112 struct	inpcbinfo udbinfo;
113 
114 #ifndef UDBHASHSIZE
115 #define UDBHASHSIZE 16
116 #endif
117 
118 struct	udpstat udpstat;	/* from udp_var.h */
119 SYSCTL_STRUCT(_net_inet_udp, UDPCTL_STATS, stats, CTLFLAG_RW,
120     &udpstat, udpstat, "UDP statistics (struct udpstat, netinet/udp_var.h)");
121 
122 static struct	sockaddr_in udp_in = { sizeof(udp_in), AF_INET };
123 #ifdef INET6
124 struct udp_in6 {
125 	struct sockaddr_in6	uin6_sin;
126 	u_char			uin6_init_done : 1;
127 } udp_in6 = {
128 	{ sizeof(udp_in6.uin6_sin), AF_INET6 },
129 	0
130 };
131 struct udp_ip6 {
132 	struct ip6_hdr		uip6_ip6;
133 	u_char			uip6_init_done : 1;
134 } udp_ip6;
135 #endif /* INET6 */
136 
137 static void udp_append (struct inpcb *last, struct ip *ip,
138 			    struct mbuf *n, int off);
139 #ifdef INET6
140 static void ip_2_ip6_hdr (struct ip6_hdr *ip6, struct ip *ip);
141 #endif
142 
143 static int udp_detach (struct socket *so);
144 static	int udp_output (struct inpcb *, struct mbuf *, struct sockaddr *,
145 			    struct mbuf *, struct thread *);
146 
147 void
148 udp_init()
149 {
150 	in_pcbinfo_init(&udbinfo);
151 	udbinfo.hashbase = hashinit(UDBHASHSIZE, M_PCB, &udbinfo.hashmask);
152 	udbinfo.porthashbase = hashinit(UDBHASHSIZE, M_PCB,
153 					&udbinfo.porthashmask);
154 	udbinfo.wildcardhashbase = hashinit(UDBHASHSIZE, M_PCB,
155 					    &udbinfo.wildcardhashmask);
156 	udbinfo.ipi_zone = zinit("udpcb", sizeof(struct inpcb), maxsockets,
157 				 ZONE_INTERRUPT, 0);
158 	udp_thread_init();
159 }
160 
161 /*
162  * Check multicast packets to make sure they are only sent to sockets with
163  * multicast memberships for the packet's destination address and arrival
164  * interface.  Multicast packets to multicast-unaware sockets are also
165  * disallowed.
166  *
167  * Returns 0 if the packet is acceptable, -1 if it is not.
168  */
169 static __inline
170 int
171 check_multicast_membership(struct ip *ip, struct inpcb *inp, struct mbuf *m)
172 {
173 	int mshipno;
174 	struct ip_moptions *mopt;
175 
176 	if (strict_mcast_mship == 0 ||
177 	    !IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
178 		return(0);
179 	}
180 	mopt = inp->inp_moptions;
181 	if (mopt == NULL)
182 		return(-1);
183 	for (mshipno = 0; mshipno <= mopt->imo_num_memberships; ++mshipno) {
184 		if (ip->ip_dst.s_addr == mopt->imo_membership[mshipno]->inm_addr.s_addr &&
185 		    m->m_pkthdr.rcvif == mopt->imo_membership[mshipno]->inm_ifp) {
186 			return(0);
187 		}
188 	}
189 	return(-1);
190 }
191 
192 void
193 udp_input(struct mbuf *m, ...)
194 {
195 	int iphlen;
196 	struct ip *ip;
197 	struct udphdr *uh;
198 	struct inpcb *inp;
199 	struct mbuf *opts = 0;
200 	int len, off, proto;
201 	struct ip save_ip;
202 	struct sockaddr *append_sa;
203 	__va_list ap;
204 
205 	__va_start(ap, m);
206 	off = __va_arg(ap, int);
207 	proto = __va_arg(ap, int);
208 	__va_end(ap);
209 
210 	iphlen = off;
211 	udpstat.udps_ipackets++;
212 
213 	/*
214 	 * Strip IP options, if any; should skip this,
215 	 * make available to user, and use on returned packets,
216 	 * but we don't yet have a way to check the checksum
217 	 * with options still present.
218 	 */
219 	if (iphlen > sizeof (struct ip)) {
220 		ip_stripoptions(m);
221 		iphlen = sizeof(struct ip);
222 	}
223 
224 	/*
225 	 * IP and UDP headers are together in first mbuf.
226 	 * Already checked and pulled up in ip_demux().
227 	 */
228 	KASSERT(m->m_len >= iphlen + sizeof(struct udphdr),
229 	    ("UDP header not in one mbuf"));
230 
231 	ip = mtod(m, struct ip *);
232 	uh = (struct udphdr *)((caddr_t)ip + iphlen);
233 
234 	/* destination port of 0 is illegal, based on RFC768. */
235 	if (uh->uh_dport == 0)
236 		goto bad;
237 
238 	/*
239 	 * Make mbuf data length reflect UDP length.
240 	 * If not enough data to reflect UDP length, drop.
241 	 */
242 	len = ntohs((u_short)uh->uh_ulen);
243 	if (ip->ip_len != len) {
244 		if (len > ip->ip_len || len < sizeof(struct udphdr)) {
245 			udpstat.udps_badlen++;
246 			goto bad;
247 		}
248 		m_adj(m, len - ip->ip_len);
249 		/* ip->ip_len = len; */
250 	}
251 	/*
252 	 * Save a copy of the IP header in case we want restore it
253 	 * for sending an ICMP error message in response.
254 	 */
255 	save_ip = *ip;
256 
257 	/*
258 	 * Checksum extended UDP header and data.
259 	 */
260 	if (uh->uh_sum) {
261 		if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
262 			if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
263 				uh->uh_sum = m->m_pkthdr.csum_data;
264 			else
265 	                	uh->uh_sum = in_pseudo(ip->ip_src.s_addr,
266 				    ip->ip_dst.s_addr, htonl((u_short)len +
267 				    m->m_pkthdr.csum_data + IPPROTO_UDP));
268 			uh->uh_sum ^= 0xffff;
269 		} else {
270 			char b[9];
271 			bcopy(((struct ipovly *)ip)->ih_x1, b, 9);
272 			bzero(((struct ipovly *)ip)->ih_x1, 9);
273 			((struct ipovly *)ip)->ih_len = uh->uh_ulen;
274 			uh->uh_sum = in_cksum(m, len + sizeof (struct ip));
275 			bcopy(b, ((struct ipovly *)ip)->ih_x1, 9);
276 		}
277 		if (uh->uh_sum) {
278 			udpstat.udps_badsum++;
279 			m_freem(m);
280 			return;
281 		}
282 	} else
283 		udpstat.udps_nosum++;
284 
285 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
286 	    in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) {
287 		struct inpcb *last;
288 		/*
289 		 * Deliver a multicast or broadcast datagram to *all* sockets
290 		 * for which the local and remote addresses and ports match
291 		 * those of the incoming datagram.  This allows more than
292 		 * one process to receive multi/broadcasts on the same port.
293 		 * (This really ought to be done for unicast datagrams as
294 		 * well, but that would cause problems with existing
295 		 * applications that open both address-specific sockets and
296 		 * a wildcard socket listening to the same port -- they would
297 		 * end up receiving duplicates of every unicast datagram.
298 		 * Those applications open the multiple sockets to overcome an
299 		 * inadequacy of the UDP socket interface, but for backwards
300 		 * compatibility we avoid the problem here rather than
301 		 * fixing the interface.  Maybe 4.5BSD will remedy this?)
302 		 */
303 
304 		/*
305 		 * Construct sockaddr format source address.
306 		 */
307 		udp_in.sin_port = uh->uh_sport;
308 		udp_in.sin_addr = ip->ip_src;
309 		/*
310 		 * Locate pcb(s) for datagram.
311 		 * (Algorithm copied from raw_intr().)
312 		 */
313 		last = NULL;
314 #ifdef INET6
315 		udp_in6.uin6_init_done = udp_ip6.uip6_init_done = 0;
316 #endif
317 		LIST_FOREACH(inp, &udbinfo.pcblisthead, inp_list) {
318 			if (inp->inp_flags & INP_PLACEMARKER)
319 				continue;
320 #ifdef INET6
321 			if ((inp->inp_vflag & INP_IPV4) == 0)
322 				continue;
323 #endif
324 			if (inp->inp_lport != uh->uh_dport)
325 				continue;
326 			if (inp->inp_laddr.s_addr != INADDR_ANY) {
327 				if (inp->inp_laddr.s_addr !=
328 				    ip->ip_dst.s_addr)
329 					continue;
330 			}
331 			if (inp->inp_faddr.s_addr != INADDR_ANY) {
332 				if (inp->inp_faddr.s_addr !=
333 				    ip->ip_src.s_addr ||
334 				    inp->inp_fport != uh->uh_sport)
335 					continue;
336 			}
337 
338 			if (check_multicast_membership(ip, inp, m) < 0)
339 				continue;
340 
341 			if (last != NULL) {
342 				struct mbuf *n;
343 
344 #ifdef IPSEC
345 				/* check AH/ESP integrity. */
346 				if (ipsec4_in_reject_so(m, last->inp_socket))
347 					ipsecstat.in_polvio++;
348 					/* do not inject data to pcb */
349 				else
350 #endif /*IPSEC*/
351 #ifdef FAST_IPSEC
352 				/* check AH/ESP integrity. */
353 				if (ipsec4_in_reject(m, last))
354 					;
355 				else
356 #endif /*FAST_IPSEC*/
357 				if ((n = m_copy(m, 0, M_COPYALL)) != NULL)
358 					udp_append(last, ip, n,
359 						   iphlen +
360 						   sizeof(struct udphdr));
361 			}
362 			last = inp;
363 			/*
364 			 * Don't look for additional matches if this one does
365 			 * not have either the SO_REUSEPORT or SO_REUSEADDR
366 			 * socket options set.  This heuristic avoids searching
367 			 * through all pcbs in the common case of a non-shared
368 			 * port.  It * assumes that an application will never
369 			 * clear these options after setting them.
370 			 */
371 			if ((last->inp_socket->so_options&(SO_REUSEPORT|SO_REUSEADDR)) == 0)
372 				break;
373 		}
374 
375 		if (last == NULL) {
376 			/*
377 			 * No matching pcb found; discard datagram.
378 			 * (No need to send an ICMP Port Unreachable
379 			 * for a broadcast or multicast datgram.)
380 			 */
381 			udpstat.udps_noportbcast++;
382 			goto bad;
383 		}
384 #ifdef IPSEC
385 		/* check AH/ESP integrity. */
386 		if (ipsec4_in_reject_so(m, last->inp_socket)) {
387 			ipsecstat.in_polvio++;
388 			goto bad;
389 		}
390 #endif /*IPSEC*/
391 #ifdef FAST_IPSEC
392 		/* check AH/ESP integrity. */
393 		if (ipsec4_in_reject(m, last))
394 			goto bad;
395 #endif /*FAST_IPSEC*/
396 		udp_append(last, ip, m, iphlen + sizeof(struct udphdr));
397 		return;
398 	}
399 	/*
400 	 * Locate pcb for datagram.
401 	 */
402 	inp = in_pcblookup_hash(&udbinfo, ip->ip_src, uh->uh_sport,
403 	    ip->ip_dst, uh->uh_dport, 1, m->m_pkthdr.rcvif);
404 	if (inp == NULL) {
405 		if (log_in_vain) {
406 			char buf[4*sizeof "123"];
407 
408 			strcpy(buf, inet_ntoa(ip->ip_dst));
409 			log(LOG_INFO,
410 			    "Connection attempt to UDP %s:%d from %s:%d\n",
411 			    buf, ntohs(uh->uh_dport), inet_ntoa(ip->ip_src),
412 			    ntohs(uh->uh_sport));
413 		}
414 		udpstat.udps_noport++;
415 		if (m->m_flags & (M_BCAST | M_MCAST)) {
416 			udpstat.udps_noportbcast++;
417 			goto bad;
418 		}
419 		if (blackhole)
420 			goto bad;
421 #ifdef ICMP_BANDLIM
422 		if (badport_bandlim(BANDLIM_ICMP_UNREACH) < 0)
423 			goto bad;
424 #endif
425 		*ip = save_ip;
426 		ip->ip_len += iphlen;
427 		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
428 		return;
429 	}
430 #ifdef IPSEC
431 	if (ipsec4_in_reject_so(m, inp->inp_socket)) {
432 		ipsecstat.in_polvio++;
433 		goto bad;
434 	}
435 #endif /*IPSEC*/
436 #ifdef FAST_IPSEC
437 	if (ipsec4_in_reject(m, inp))
438 		goto bad;
439 #endif /*FAST_IPSEC*/
440 
441 	/*
442 	 * Construct sockaddr format source address.
443 	 * Stuff source address and datagram in user buffer.
444 	 */
445 	udp_in.sin_port = uh->uh_sport;
446 	udp_in.sin_addr = ip->ip_src;
447 	if (inp->inp_flags & INP_CONTROLOPTS
448 	    || inp->inp_socket->so_options & SO_TIMESTAMP) {
449 #ifdef INET6
450 		if (inp->inp_vflag & INP_IPV6) {
451 			int savedflags;
452 
453 			ip_2_ip6_hdr(&udp_ip6.uip6_ip6, ip);
454 			savedflags = inp->inp_flags;
455 			inp->inp_flags &= ~INP_UNMAPPABLEOPTS;
456 			ip6_savecontrol(inp, &opts, &udp_ip6.uip6_ip6, m);
457 			inp->inp_flags = savedflags;
458 		} else
459 #endif
460 		ip_savecontrol(inp, &opts, ip, m);
461 	}
462  	m_adj(m, iphlen + sizeof(struct udphdr));
463 #ifdef INET6
464 	if (inp->inp_vflag & INP_IPV6) {
465 		in6_sin_2_v4mapsin6(&udp_in, &udp_in6.uin6_sin);
466 		append_sa = (struct sockaddr *)&udp_in6;
467 	} else
468 #endif
469 	append_sa = (struct sockaddr *)&udp_in;
470 	if (sbappendaddr(&inp->inp_socket->so_rcv, append_sa, m, opts) == 0) {
471 		udpstat.udps_fullsock++;
472 		goto bad;
473 	}
474 	sorwakeup(inp->inp_socket);
475 	return;
476 bad:
477 	m_freem(m);
478 	if (opts)
479 		m_freem(opts);
480 	return;
481 }
482 
483 #ifdef INET6
484 static void
485 ip_2_ip6_hdr(ip6, ip)
486 	struct ip6_hdr *ip6;
487 	struct ip *ip;
488 {
489 	bzero(ip6, sizeof(*ip6));
490 
491 	ip6->ip6_vfc = IPV6_VERSION;
492 	ip6->ip6_plen = ip->ip_len;
493 	ip6->ip6_nxt = ip->ip_p;
494 	ip6->ip6_hlim = ip->ip_ttl;
495 	ip6->ip6_src.s6_addr32[2] = ip6->ip6_dst.s6_addr32[2] =
496 		IPV6_ADDR_INT32_SMP;
497 	ip6->ip6_src.s6_addr32[3] = ip->ip_src.s_addr;
498 	ip6->ip6_dst.s6_addr32[3] = ip->ip_dst.s_addr;
499 }
500 #endif
501 
502 /*
503  * subroutine of udp_input(), mainly for source code readability.
504  * caller must properly init udp_ip6 and udp_in6 beforehand.
505  */
506 static void
507 udp_append(last, ip, n, off)
508 	struct inpcb *last;
509 	struct ip *ip;
510 	struct mbuf *n;
511 	int off;
512 {
513 	struct sockaddr *append_sa;
514 	struct mbuf *opts = 0;
515 
516 	if (last->inp_flags & INP_CONTROLOPTS ||
517 	    last->inp_socket->so_options & SO_TIMESTAMP) {
518 #ifdef INET6
519 		if (last->inp_vflag & INP_IPV6) {
520 			int savedflags;
521 
522 			if (udp_ip6.uip6_init_done == 0) {
523 				ip_2_ip6_hdr(&udp_ip6.uip6_ip6, ip);
524 				udp_ip6.uip6_init_done = 1;
525 			}
526 			savedflags = last->inp_flags;
527 			last->inp_flags &= ~INP_UNMAPPABLEOPTS;
528 			ip6_savecontrol(last, &opts, &udp_ip6.uip6_ip6, n);
529 			last->inp_flags = savedflags;
530 		} else
531 #endif
532 		ip_savecontrol(last, &opts, ip, n);
533 	}
534 #ifdef INET6
535 	if (last->inp_vflag & INP_IPV6) {
536 		if (udp_in6.uin6_init_done == 0) {
537 			in6_sin_2_v4mapsin6(&udp_in, &udp_in6.uin6_sin);
538 			udp_in6.uin6_init_done = 1;
539 		}
540 		append_sa = (struct sockaddr *)&udp_in6.uin6_sin;
541 	} else
542 #endif
543 	append_sa = (struct sockaddr *)&udp_in;
544 	m_adj(n, off);
545 	if (sbappendaddr(&last->inp_socket->so_rcv, append_sa, n, opts) == 0) {
546 		m_freem(n);
547 		if (opts)
548 			m_freem(opts);
549 		udpstat.udps_fullsock++;
550 	} else
551 		sorwakeup(last->inp_socket);
552 }
553 
554 /*
555  * Notify a udp user of an asynchronous error;
556  * just wake up so that he can collect error status.
557  */
558 void
559 udp_notify(inp, errno)
560 	struct inpcb *inp;
561 	int errno;
562 {
563 	inp->inp_socket->so_error = errno;
564 	sorwakeup(inp->inp_socket);
565 	sowwakeup(inp->inp_socket);
566 }
567 
568 void
569 udp_ctlinput(cmd, sa, vip)
570 	int cmd;
571 	struct sockaddr *sa;
572 	void *vip;
573 {
574 	struct ip *ip = vip;
575 	struct udphdr *uh;
576 	void (*notify) (struct inpcb *, int) = udp_notify;
577         struct in_addr faddr;
578 	struct inpcb *inp;
579 	int s;
580 
581 	faddr = ((struct sockaddr_in *)sa)->sin_addr;
582 	if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
583         	return;
584 
585 	if (PRC_IS_REDIRECT(cmd)) {
586 		ip = 0;
587 		notify = in_rtchange;
588 	} else if (cmd == PRC_HOSTDEAD)
589 		ip = 0;
590 	else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0)
591 		return;
592 	if (ip) {
593 		s = splnet();
594 		uh = (struct udphdr *)((caddr_t)ip + (ip->ip_hl << 2));
595 		inp = in_pcblookup_hash(&udbinfo, faddr, uh->uh_dport,
596                     ip->ip_src, uh->uh_sport, 0, NULL);
597 		if (inp != NULL && inp->inp_socket != NULL)
598 			(*notify)(inp, inetctlerrmap[cmd]);
599 		splx(s);
600 	} else
601 		in_pcbnotifyall(&udbinfo.pcblisthead, faddr, inetctlerrmap[cmd],
602 		    notify);
603 }
604 
605 static int
606 udp_pcblist(SYSCTL_HANDLER_ARGS)
607 {
608 	int error, i, n;
609 	struct inpcb *inp;
610 	struct inpcb *marker;
611 	inp_gen_t gencnt;
612 	struct xinpgen xig;
613 	struct xinpcb xi;
614 
615 	/*
616 	 * The process of preparing the TCB list is too time-consuming and
617 	 * resource-intensive to repeat twice on every request.
618 	 */
619 	if (req->oldptr == 0) {
620 		n = udbinfo.ipi_count;
621 		req->oldidx = 2 * (sizeof xig)
622 			+ (n + n/8) * sizeof(struct xinpcb);
623 		return 0;
624 	}
625 
626 	if (req->newptr != 0)
627 		return EPERM;
628 
629 	/*
630 	 * OK, now we're committed to doing something.
631 	 */
632 	gencnt = udbinfo.ipi_gencnt;
633 	n = udbinfo.ipi_count;
634 
635 	xig.xig_len = sizeof xig;
636 	xig.xig_count = n;
637 	xig.xig_gen = gencnt;
638 	xig.xig_sogen = so_gencnt;
639 	xig.xig_cpu = 0;
640 	error = SYSCTL_OUT(req, &xig, sizeof xig);
641 	if (error)
642 		return error;
643 
644 	marker = malloc(sizeof(struct inpcb), M_TEMP, M_WAITOK|M_ZERO);
645 	marker->inp_flags |= INP_PLACEMARKER;
646 
647 	LIST_INSERT_HEAD(&udbinfo.pcblisthead, marker, inp_list);
648 	i = 0;
649 	while ((inp = LIST_NEXT(marker, inp_list)) != NULL && i < n) {
650 		LIST_REMOVE(marker, inp_list);
651 		LIST_INSERT_AFTER(inp, marker, inp_list);
652 		if (inp->inp_flags & INP_PLACEMARKER)
653 			continue;
654 		if (inp->inp_gencnt > gencnt)
655 			continue;
656 		if (prison_xinpcb(req->td, inp))
657 			continue;
658 		xi.xi_len = sizeof xi;
659 		bcopy(inp, &xi.xi_inp, sizeof *inp);
660 		if (inp->inp_socket)
661 			sotoxsocket(inp->inp_socket, &xi.xi_socket);
662 		if ((error = SYSCTL_OUT(req, &xi, sizeof xi)) != 0)
663 			break;
664 		++i;
665 	}
666 	LIST_REMOVE(marker, inp_list);
667 	if (error == 0 && i < n) {
668 		bzero(&xi, sizeof(xi));
669 		xi.xi_len = sizeof(xi);
670 		while (i < n) {
671 			if ((error = SYSCTL_OUT(req, &xi, sizeof(xi))) != 0)
672 				break;
673 			++i;
674 		}
675 	}
676 	if (error == 0) {
677 		/*
678 		 * Give the user an updated idea of our state.
679 		 * If the generation differs from what we told
680 		 * her before, she knows that something happened
681 		 * while we were processing this request, and it
682 		 * might be necessary to retry.
683 		 */
684 		xig.xig_gen = udbinfo.ipi_gencnt;
685 		xig.xig_sogen = so_gencnt;
686 		xig.xig_count = udbinfo.ipi_count;
687 		error = SYSCTL_OUT(req, &xig, sizeof xig);
688 	}
689 	free(marker, M_TEMP);
690 	return error;
691 }
692 
693 SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist, CTLFLAG_RD, 0, 0,
694 	    udp_pcblist, "S,xinpcb", "List of active UDP sockets");
695 
696 static int
697 udp_getcred(SYSCTL_HANDLER_ARGS)
698 {
699 	struct sockaddr_in addrs[2];
700 	struct inpcb *inp;
701 	int error, s;
702 
703 	error = suser(req->td);
704 	if (error)
705 		return (error);
706 	error = SYSCTL_IN(req, addrs, sizeof(addrs));
707 	if (error)
708 		return (error);
709 	s = splnet();
710 	inp = in_pcblookup_hash(&udbinfo, addrs[1].sin_addr, addrs[1].sin_port,
711 				addrs[0].sin_addr, addrs[0].sin_port, 1, NULL);
712 	if (inp == NULL || inp->inp_socket == NULL) {
713 		error = ENOENT;
714 		goto out;
715 	}
716 	error = SYSCTL_OUT(req, inp->inp_socket->so_cred, sizeof(struct ucred));
717 out:
718 	splx(s);
719 	return (error);
720 }
721 
722 SYSCTL_PROC(_net_inet_udp, OID_AUTO, getcred, CTLTYPE_OPAQUE|CTLFLAG_RW,
723     0, 0, udp_getcred, "S,ucred", "Get the ucred of a UDP connection");
724 
725 static int
726 udp_output(inp, m, dstaddr, control, td)
727 	struct inpcb *inp;
728 	struct mbuf *m;
729 	struct sockaddr *dstaddr;
730 	struct mbuf *control;
731 	struct thread *td;
732 {
733 	struct udpiphdr *ui;
734 	int len = m->m_pkthdr.len;
735 	struct sockaddr_in *sin;	/* really is initialized before use */
736 	int error = 0;
737 
738 	if (len + sizeof(struct udpiphdr) > IP_MAXPACKET) {
739 		error = EMSGSIZE;
740 		goto release;
741 	}
742 
743 	if (inp->inp_lport == 0) {	/* unbound socket */
744 		error = in_pcbbind(inp, (struct sockaddr *)NULL, td);
745 		if (error)
746 			goto release;
747 		in_pcbinswildcardhash(inp);
748 	}
749 
750 	if (dstaddr != NULL) {		/* destination address specified */
751 		if (inp->inp_faddr.s_addr != INADDR_ANY) {
752 			/* already connected */
753 			error = EISCONN;
754 			goto release;
755 		}
756 		sin = (struct sockaddr_in *)dstaddr;
757 		prison_remote_ip(td, 0, &sin->sin_addr.s_addr);
758 	} else {
759 		if (inp->inp_faddr.s_addr == INADDR_ANY) {
760 			/* no destination specified and not already connected */
761 			error = ENOTCONN;
762 			goto release;
763 		}
764 		sin = NULL;
765 	}
766 
767 	/*
768 	 * Calculate data length and get a mbuf
769 	 * for UDP and IP headers.
770 	 */
771 	M_PREPEND(m, sizeof(struct udpiphdr), MB_DONTWAIT);
772 	if (m == 0) {
773 		error = ENOBUFS;
774 		goto release;
775 	}
776 
777 	/*
778 	 * Fill in mbuf with extended UDP header
779 	 * and addresses and length put into network format.
780 	 */
781 	ui = mtod(m, struct udpiphdr *);
782 	bzero(ui->ui_x1, sizeof(ui->ui_x1));	/* XXX still needed? */
783 	ui->ui_pr = IPPROTO_UDP;
784 
785 	/*
786 	 * Set destination address.
787 	 */
788 	if (dstaddr != NULL) {			/* use specified destination */
789 		ui->ui_dst = sin->sin_addr;
790 		ui->ui_dport = sin->sin_port;
791 	} else {				/* use connected destination */
792 		ui->ui_dst = inp->inp_faddr;
793 		ui->ui_dport = inp->inp_fport;
794 	}
795 
796 	/*
797 	 * Set source address.
798 	 */
799 	if (inp->inp_laddr.s_addr == INADDR_ANY) {
800 		struct sockaddr_in *if_sin;
801 
802 		KASSERT(dstaddr != NULL,
803 		    ("connected UDP socket without local addr: "
804 		     "lport %d, faddr %x, fport %d",
805 		     inp->inp_lport, inp->inp_faddr.s_addr, inp->inp_fport));
806 
807 		/* Look up outgoing interface. */
808 		if ((error = in_pcbladdr(inp, dstaddr, &if_sin)))
809 			goto release;
810 		ui->ui_src = if_sin->sin_addr;	/* use address of interface */
811 	} else {
812 		ui->ui_src = inp->inp_laddr;	/* use non-null bound address */
813 	}
814 	ui->ui_sport = inp->inp_lport;
815 	KASSERT(inp->inp_lport != 0, ("inp lport should have been bound"));
816 
817 	ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
818 
819 	/*
820 	 * Set up checksum and output datagram.
821 	 */
822 	if (udpcksum) {
823         	ui->ui_sum = in_pseudo(ui->ui_src.s_addr, ui->ui_dst.s_addr,
824 		    htons((u_short)len + sizeof(struct udphdr) + IPPROTO_UDP));
825 		m->m_pkthdr.csum_flags = CSUM_UDP;
826 		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
827 	} else {
828 		ui->ui_sum = 0;
829 	}
830 	((struct ip *)ui)->ip_len = sizeof (struct udpiphdr) + len;
831 	((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl;	/* XXX */
832 	((struct ip *)ui)->ip_tos = inp->inp_ip_tos;	/* XXX */
833 	udpstat.udps_opackets++;
834 
835 	error = ip_output(m, inp->inp_options, &inp->inp_route,
836 	    (inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)),
837 	    inp->inp_moptions, inp);
838 
839 	return (error);
840 
841 release:
842 	m_freem(m);
843 	return (error);
844 }
845 
846 u_long	udp_sendspace = 9216;		/* really max datagram size */
847 					/* 40 1K datagrams */
848 SYSCTL_INT(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram, CTLFLAG_RW,
849     &udp_sendspace, 0, "Maximum outgoing UDP datagram size");
850 
851 u_long	udp_recvspace = 40 * (1024 +
852 #ifdef INET6
853 				      sizeof(struct sockaddr_in6)
854 #else
855 				      sizeof(struct sockaddr_in)
856 #endif
857 				      );
858 SYSCTL_INT(_net_inet_udp, UDPCTL_RECVSPACE, recvspace, CTLFLAG_RW,
859     &udp_recvspace, 0, "Maximum incoming UDP datagram size");
860 
861 static int
862 udp_abort(struct socket *so)
863 {
864 	struct inpcb *inp;
865 	int s;
866 
867 	inp = sotoinpcb(so);
868 	if (inp == 0)
869 		return EINVAL;	/* ??? possible? panic instead? */
870 	soisdisconnected(so);
871 	s = splnet();
872 	in_pcbdetach(inp);
873 	splx(s);
874 	return 0;
875 }
876 
877 static int
878 udp_attach(struct socket *so, int proto, struct pru_attach_info *ai)
879 {
880 	struct inpcb *inp;
881 	int s, error;
882 
883 	inp = sotoinpcb(so);
884 	if (inp != 0)
885 		return EINVAL;
886 
887 	error = soreserve(so, udp_sendspace, udp_recvspace, ai->sb_rlimit);
888 	if (error)
889 		return error;
890 	s = splnet();
891 	error = in_pcballoc(so, &udbinfo);
892 	splx(s);
893 	if (error)
894 		return error;
895 
896 	inp = (struct inpcb *)so->so_pcb;
897 	inp->inp_vflag |= INP_IPV4;
898 	inp->inp_ip_ttl = ip_defttl;
899 	return 0;
900 }
901 
902 static int
903 udp_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
904 {
905 	struct sockaddr_in *sin = (struct sockaddr_in *)nam;
906 	struct inpcb *inp;
907 	int s, error;
908 
909 	inp = sotoinpcb(so);
910 	if (inp == 0)
911 		return EINVAL;
912 	s = splnet();
913 	error = in_pcbbind(inp, nam, td);
914 	splx(s);
915 	if (error == 0) {
916 		if (sin->sin_addr.s_addr != INADDR_ANY)
917 			inp->inp_flags |= INP_WASBOUND_NOTANY;
918 		in_pcbinswildcardhash(inp);
919 	}
920 	return error;
921 }
922 
923 static int
924 udp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
925 {
926 	struct inpcb *inp;
927 	int s, error;
928 	struct sockaddr_in *sin;
929 
930 	inp = sotoinpcb(so);
931 	if (inp == 0)
932 		return EINVAL;
933 	if (inp->inp_faddr.s_addr != INADDR_ANY)
934 		return EISCONN;
935 	error = 0;
936 	s = splnet();
937 	if (td->td_proc && td->td_proc->p_ucred->cr_prison != NULL &&
938 	    inp->inp_laddr.s_addr == INADDR_ANY) {
939 		error = in_pcbbind(inp, NULL, td);
940 	}
941 	if (error == 0) {
942 		sin = (struct sockaddr_in *)nam;
943 		prison_remote_ip(td, 0, &sin->sin_addr.s_addr);
944 		if (inp->inp_flags & INP_WILDCARD)
945 			in_pcbremwildcardhash(inp);
946 		error = in_pcbconnect(inp, nam, td);
947 	}
948 	splx(s);
949 	if (error == 0)
950 		soisconnected(so);
951 	else if (error == EAFNOSUPPORT) {	/* connection dissolved */
952 		/*
953 		 * Follow traditional BSD behavior and retain
954 		 * the local port binding.  But, fix the old misbehavior
955 		 * of overwriting any previously bound local address.
956 		 */
957 		if (!(inp->inp_flags & INP_WASBOUND_NOTANY))
958 			inp->inp_laddr.s_addr = INADDR_ANY;
959 		in_pcbinswildcardhash(inp);
960 	}
961 	return error;
962 }
963 
964 static int
965 udp_detach(struct socket *so)
966 {
967 	struct inpcb *inp;
968 	int s;
969 
970 	inp = sotoinpcb(so);
971 	if (inp == 0)
972 		return EINVAL;
973 	s = splnet();
974 	in_pcbdetach(inp);
975 	splx(s);
976 	return 0;
977 }
978 
979 static int
980 udp_disconnect(struct socket *so)
981 {
982 	struct inpcb *inp;
983 	int s;
984 
985 	inp = sotoinpcb(so);
986 	if (inp == 0)
987 		return EINVAL;
988 	if (inp->inp_faddr.s_addr == INADDR_ANY)
989 		return ENOTCONN;
990 
991 	s = splnet();
992 	in_pcbdisconnect(inp);
993 	splx(s);
994 	so->so_state &= ~SS_ISCONNECTED;		/* XXX */
995 	return 0;
996 }
997 
998 static int
999 udp_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
1000 	    struct mbuf *control, struct thread *td)
1001 {
1002 	struct inpcb *inp;
1003 
1004 	inp = sotoinpcb(so);
1005 	if (inp == 0) {
1006 		m_freem(m);
1007 		return EINVAL;
1008 	}
1009 	return udp_output(inp, m, addr, control, td);
1010 }
1011 
1012 int
1013 udp_shutdown(struct socket *so)
1014 {
1015 	struct inpcb *inp;
1016 
1017 	inp = sotoinpcb(so);
1018 	if (inp == 0)
1019 		return EINVAL;
1020 	socantsendmore(so);
1021 	return 0;
1022 }
1023 
1024 struct pr_usrreqs udp_usrreqs = {
1025 	udp_abort, pru_accept_notsupp, udp_attach, udp_bind, udp_connect,
1026 	pru_connect2_notsupp, in_control, udp_detach, udp_disconnect,
1027 	pru_listen_notsupp, in_setpeeraddr, pru_rcvd_notsupp,
1028 	pru_rcvoob_notsupp, udp_send, pru_sense_null, udp_shutdown,
1029 	in_setsockaddr, sosendudp, soreceive, sopoll
1030 };
1031 
1032