1 /* $OpenBSD: in_pcb.c,v 1.255 2021/03/10 10:21:48 jsg Exp $ */ 2 /* $NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $ */ 3 4 /* 5 * Copyright (c) 1982, 1986, 1991, 1993 6 * The Regents of the University of California. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 * 32 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 33 * 34 * NRL grants permission for redistribution and use in source and binary 35 * forms, with or without modification, of the software and documentation 36 * created at NRL provided that the following conditions are met: 37 * 38 * 1. Redistributions of source code must retain the above copyright 39 * notice, this list of conditions and the following disclaimer. 40 * 2. Redistributions in binary form must reproduce the above copyright 41 * notice, this list of conditions and the following disclaimer in the 42 * documentation and/or other materials provided with the distribution. 43 * 3. All advertising materials mentioning features or use of this software 44 * must display the following acknowledgements: 45 * This product includes software developed by the University of 46 * California, Berkeley and its contributors. 47 * This product includes software developed at the Information 48 * Technology Division, US Naval Research Laboratory. 49 * 4. Neither the name of the NRL nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS 54 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 56 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR 57 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 58 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 59 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 60 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 61 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 62 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 63 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 64 * 65 * The views and conclusions contained in the software and documentation 66 * are those of the authors and should not be interpreted as representing 67 * official policies, either expressed or implied, of the US Naval 68 * Research Laboratory (NRL). 69 */ 70 71 #include "pf.h" 72 73 #include <sys/param.h> 74 #include <sys/systm.h> 75 #include <sys/mbuf.h> 76 #include <sys/protosw.h> 77 #include <sys/socket.h> 78 #include <sys/socketvar.h> 79 #include <sys/domain.h> 80 #include <sys/mount.h> 81 #include <sys/pool.h> 82 #include <sys/proc.h> 83 84 #include <net/if.h> 85 #include <net/if_var.h> 86 #include <net/pfvar.h> 87 #include <net/route.h> 88 89 #include <netinet/in.h> 90 #include <netinet/in_var.h> 91 #include <netinet/ip.h> 92 #include <netinet/ip_var.h> 93 #include <netinet/in_pcb.h> 94 #ifdef IPSEC 95 #include <netinet/ip_esp.h> 96 #endif /* IPSEC */ 97 98 #include "stoeplitz.h" 99 #if NSTOEPLITZ > 0 100 #include <net/toeplitz.h> 101 #endif 102 103 const struct in_addr zeroin_addr; 104 105 union { 106 struct in_addr za_in; 107 struct in6_addr za_in6; 108 } zeroin46_addr; 109 110 /* 111 * These configure the range of local port addresses assigned to 112 * "unspecified" outgoing connections/packets/whatever. 113 */ 114 int ipport_firstauto = IPPORT_RESERVED; 115 int ipport_lastauto = IPPORT_USERRESERVED; 116 int ipport_hifirstauto = IPPORT_HIFIRSTAUTO; 117 int ipport_hilastauto = IPPORT_HILASTAUTO; 118 119 struct baddynamicports baddynamicports; 120 struct baddynamicports rootonlyports; 121 struct pool inpcb_pool; 122 123 int in_pcbresize (struct inpcbtable *, int); 124 125 #define INPCBHASH_LOADFACTOR(_x) (((_x) * 3) / 4) 126 127 struct inpcbhead *in_pcbhash(struct inpcbtable *, int, 128 const struct in_addr *, u_short, const struct in_addr *, u_short); 129 struct inpcbhead *in_pcblhash(struct inpcbtable *, int, u_short); 130 131 /* 132 * in_pcb is used for inet and inet6. in6_pcb only contains special 133 * IPv6 cases. So the internet initializer is used for both domains. 134 */ 135 void 136 in_init(void) 137 { 138 pool_init(&inpcb_pool, sizeof(struct inpcb), 0, 139 IPL_SOFTNET, 0, "inpcb", NULL); 140 } 141 142 struct inpcbhead * 143 in_pcbhash(struct inpcbtable *table, int rdom, 144 const struct in_addr *faddr, u_short fport, 145 const struct in_addr *laddr, u_short lport) 146 { 147 SIPHASH_CTX ctx; 148 u_int32_t nrdom = htonl(rdom); 149 150 SipHash24_Init(&ctx, &table->inpt_key); 151 SipHash24_Update(&ctx, &nrdom, sizeof(nrdom)); 152 SipHash24_Update(&ctx, faddr, sizeof(*faddr)); 153 SipHash24_Update(&ctx, &fport, sizeof(fport)); 154 SipHash24_Update(&ctx, laddr, sizeof(*laddr)); 155 SipHash24_Update(&ctx, &lport, sizeof(lport)); 156 157 return (&table->inpt_hashtbl[SipHash24_End(&ctx) & table->inpt_mask]); 158 } 159 160 struct inpcbhead * 161 in_pcblhash(struct inpcbtable *table, int rdom, u_short lport) 162 { 163 SIPHASH_CTX ctx; 164 u_int32_t nrdom = htonl(rdom); 165 166 SipHash24_Init(&ctx, &table->inpt_lkey); 167 SipHash24_Update(&ctx, &nrdom, sizeof(nrdom)); 168 SipHash24_Update(&ctx, &lport, sizeof(lport)); 169 170 return (&table->inpt_lhashtbl[SipHash24_End(&ctx) & table->inpt_lmask]); 171 } 172 173 void 174 in_pcbinit(struct inpcbtable *table, int hashsize) 175 { 176 177 TAILQ_INIT(&table->inpt_queue); 178 table->inpt_hashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, 179 &table->inpt_mask); 180 if (table->inpt_hashtbl == NULL) 181 panic("in_pcbinit: hashinit failed"); 182 table->inpt_lhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, 183 &table->inpt_lmask); 184 if (table->inpt_lhashtbl == NULL) 185 panic("in_pcbinit: hashinit failed for lport"); 186 table->inpt_count = 0; 187 table->inpt_size = hashsize; 188 arc4random_buf(&table->inpt_key, sizeof(table->inpt_key)); 189 arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey)); 190 } 191 192 /* 193 * Check if the specified port is invalid for dynamic allocation. 194 */ 195 int 196 in_baddynamic(u_int16_t port, u_int16_t proto) 197 { 198 switch (proto) { 199 case IPPROTO_TCP: 200 return (DP_ISSET(baddynamicports.tcp, port)); 201 case IPPROTO_UDP: 202 #ifdef IPSEC 203 /* Cannot preset this as it is a sysctl */ 204 if (port == udpencap_port) 205 return (1); 206 #endif 207 return (DP_ISSET(baddynamicports.udp, port)); 208 default: 209 return (0); 210 } 211 } 212 213 int 214 in_rootonly(u_int16_t port, u_int16_t proto) 215 { 216 switch (proto) { 217 case IPPROTO_TCP: 218 return (port < IPPORT_RESERVED || 219 DP_ISSET(rootonlyports.tcp, port)); 220 case IPPROTO_UDP: 221 return (port < IPPORT_RESERVED || 222 DP_ISSET(rootonlyports.udp, port)); 223 default: 224 return (0); 225 } 226 } 227 228 int 229 in_pcballoc(struct socket *so, struct inpcbtable *table) 230 { 231 struct inpcb *inp; 232 struct inpcbhead *head; 233 234 NET_ASSERT_LOCKED(); 235 236 inp = pool_get(&inpcb_pool, PR_NOWAIT|PR_ZERO); 237 if (inp == NULL) 238 return (ENOBUFS); 239 inp->inp_table = table; 240 inp->inp_socket = so; 241 refcnt_init(&inp->inp_refcnt); 242 inp->inp_seclevel[SL_AUTH] = IPSEC_AUTH_LEVEL_DEFAULT; 243 inp->inp_seclevel[SL_ESP_TRANS] = IPSEC_ESP_TRANS_LEVEL_DEFAULT; 244 inp->inp_seclevel[SL_ESP_NETWORK] = IPSEC_ESP_NETWORK_LEVEL_DEFAULT; 245 inp->inp_seclevel[SL_IPCOMP] = IPSEC_IPCOMP_LEVEL_DEFAULT; 246 inp->inp_rtableid = curproc->p_p->ps_rtableid; 247 inp->inp_hops = -1; 248 #ifdef INET6 249 /* 250 * Small change in this function to set the INP_IPV6 flag so routines 251 * outside pcb-specific routines don't need to use sotopf(), and all 252 * of its pointer chasing, later. 253 */ 254 if (sotopf(so) == PF_INET6) 255 inp->inp_flags = INP_IPV6; 256 inp->inp_cksum6 = -1; 257 #endif /* INET6 */ 258 259 if (table->inpt_count++ > INPCBHASH_LOADFACTOR(table->inpt_size)) 260 (void)in_pcbresize(table, table->inpt_size * 2); 261 TAILQ_INSERT_HEAD(&table->inpt_queue, inp, inp_queue); 262 head = in_pcblhash(table, inp->inp_rtableid, inp->inp_lport); 263 LIST_INSERT_HEAD(head, inp, inp_lhash); 264 #ifdef INET6 265 if (sotopf(so) == PF_INET6) 266 head = in6_pcbhash(table, rtable_l2(inp->inp_rtableid), 267 &inp->inp_faddr6, inp->inp_fport, 268 &inp->inp_laddr6, inp->inp_lport); 269 else 270 #endif /* INET6 */ 271 head = in_pcbhash(table, rtable_l2(inp->inp_rtableid), 272 &inp->inp_faddr, inp->inp_fport, 273 &inp->inp_laddr, inp->inp_lport); 274 LIST_INSERT_HEAD(head, inp, inp_hash); 275 so->so_pcb = inp; 276 277 return (0); 278 } 279 280 int 281 in_pcbbind(struct inpcb *inp, struct mbuf *nam, struct proc *p) 282 { 283 struct socket *so = inp->inp_socket; 284 u_int16_t lport = 0; 285 int wild = 0; 286 void *laddr = &zeroin46_addr; 287 int error; 288 289 if (inp->inp_lport) 290 return (EINVAL); 291 292 if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0 && 293 ((so->so_proto->pr_flags & PR_CONNREQUIRED) == 0 || 294 (so->so_options & SO_ACCEPTCONN) == 0)) 295 wild = INPLOOKUP_WILDCARD; 296 297 switch (sotopf(so)) { 298 #ifdef INET6 299 case PF_INET6: 300 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6)) 301 return (EINVAL); 302 wild |= INPLOOKUP_IPV6; 303 304 if (nam) { 305 struct sockaddr_in6 *sin6; 306 307 if ((error = in6_nam2sin6(nam, &sin6))) 308 return (error); 309 if ((error = in6_pcbaddrisavail(inp, sin6, wild, p))) 310 return (error); 311 laddr = &sin6->sin6_addr; 312 lport = sin6->sin6_port; 313 } 314 break; 315 #endif 316 case PF_INET: 317 if (inp->inp_laddr.s_addr != INADDR_ANY) 318 return (EINVAL); 319 320 if (nam) { 321 struct sockaddr_in *sin; 322 323 if ((error = in_nam2sin(nam, &sin))) 324 return (error); 325 if ((error = in_pcbaddrisavail(inp, sin, wild, p))) 326 return (error); 327 laddr = &sin->sin_addr; 328 lport = sin->sin_port; 329 } 330 break; 331 default: 332 return (EINVAL); 333 } 334 335 if (lport == 0) { 336 if ((error = in_pcbpickport(&lport, laddr, wild, inp, p))) 337 return (error); 338 } else { 339 if (in_rootonly(ntohs(lport), so->so_proto->pr_protocol) && 340 suser(p) != 0) 341 return (EACCES); 342 } 343 if (nam) { 344 switch (sotopf(so)) { 345 #ifdef INET6 346 case PF_INET6: 347 inp->inp_laddr6 = *(struct in6_addr *)laddr; 348 break; 349 #endif 350 case PF_INET: 351 inp->inp_laddr = *(struct in_addr *)laddr; 352 break; 353 } 354 } 355 inp->inp_lport = lport; 356 in_pcbrehash(inp); 357 return (0); 358 } 359 360 int 361 in_pcbaddrisavail(struct inpcb *inp, struct sockaddr_in *sin, int wild, 362 struct proc *p) 363 { 364 struct socket *so = inp->inp_socket; 365 struct inpcbtable *table = inp->inp_table; 366 u_int16_t lport = sin->sin_port; 367 int reuseport = (so->so_options & SO_REUSEPORT); 368 369 if (IN_MULTICAST(sin->sin_addr.s_addr)) { 370 /* 371 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast; 372 * allow complete duplication of binding if 373 * SO_REUSEPORT is set, or if SO_REUSEADDR is set 374 * and a multicast address is bound on both 375 * new and duplicated sockets. 376 */ 377 if (so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) 378 reuseport = SO_REUSEADDR|SO_REUSEPORT; 379 } else if (sin->sin_addr.s_addr != INADDR_ANY) { 380 /* 381 * we must check that we are binding to an address we 382 * own except when: 383 * - SO_BINDANY is set or 384 * - we are binding a UDP socket to 255.255.255.255 or 385 * - we are binding a UDP socket to one of our broadcast 386 * addresses 387 */ 388 if (!ISSET(so->so_options, SO_BINDANY) && 389 !(so->so_type == SOCK_DGRAM && 390 sin->sin_addr.s_addr == INADDR_BROADCAST) && 391 !(so->so_type == SOCK_DGRAM && 392 in_broadcast(sin->sin_addr, inp->inp_rtableid))) { 393 struct ifaddr *ia; 394 395 sin->sin_port = 0; 396 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 397 ia = ifa_ifwithaddr(sintosa(sin), inp->inp_rtableid); 398 sin->sin_port = lport; 399 400 if (ia == NULL) 401 return (EADDRNOTAVAIL); 402 } 403 } 404 if (lport) { 405 struct inpcb *t; 406 407 if (so->so_euid) { 408 t = in_pcblookup_local(table, &sin->sin_addr, lport, 409 INPLOOKUP_WILDCARD, inp->inp_rtableid); 410 if (t && (so->so_euid != t->inp_socket->so_euid)) 411 return (EADDRINUSE); 412 } 413 t = in_pcblookup_local(table, &sin->sin_addr, lport, 414 wild, inp->inp_rtableid); 415 if (t && (reuseport & t->inp_socket->so_options) == 0) 416 return (EADDRINUSE); 417 } 418 419 return (0); 420 } 421 422 int 423 in_pcbpickport(u_int16_t *lport, void *laddr, int wild, struct inpcb *inp, 424 struct proc *p) 425 { 426 struct socket *so = inp->inp_socket; 427 struct inpcbtable *table = inp->inp_table; 428 u_int16_t first, last, lower, higher, candidate, localport; 429 int count; 430 431 if (inp->inp_flags & INP_HIGHPORT) { 432 first = ipport_hifirstauto; /* sysctl */ 433 last = ipport_hilastauto; 434 } else if (inp->inp_flags & INP_LOWPORT) { 435 if (suser(p)) 436 return (EACCES); 437 first = IPPORT_RESERVED-1; /* 1023 */ 438 last = 600; /* not IPPORT_RESERVED/2 */ 439 } else { 440 first = ipport_firstauto; /* sysctl */ 441 last = ipport_lastauto; 442 } 443 if (first < last) { 444 lower = first; 445 higher = last; 446 } else { 447 lower = last; 448 higher = first; 449 } 450 451 /* 452 * Simple check to ensure all ports are not used up causing 453 * a deadlock here. 454 */ 455 456 count = higher - lower; 457 candidate = lower + arc4random_uniform(count); 458 459 do { 460 if (count-- < 0) /* completely used? */ 461 return (EADDRNOTAVAIL); 462 ++candidate; 463 if (candidate < lower || candidate > higher) 464 candidate = lower; 465 localport = htons(candidate); 466 } while (in_baddynamic(candidate, so->so_proto->pr_protocol) || 467 in_pcblookup_local(table, laddr, localport, wild, 468 inp->inp_rtableid)); 469 *lport = localport; 470 471 return (0); 472 } 473 474 /* 475 * Connect from a socket to a specified address. 476 * Both address and port must be specified in argument sin. 477 * If don't have a local address for this socket yet, 478 * then pick one. 479 */ 480 int 481 in_pcbconnect(struct inpcb *inp, struct mbuf *nam) 482 { 483 struct in_addr *ina = NULL; 484 struct sockaddr_in *sin; 485 int error; 486 487 #ifdef INET6 488 if (sotopf(inp->inp_socket) == PF_INET6) 489 return (in6_pcbconnect(inp, nam)); 490 KASSERT((inp->inp_flags & INP_IPV6) == 0); 491 #endif /* INET6 */ 492 493 if ((error = in_nam2sin(nam, &sin))) 494 return (error); 495 if (sin->sin_port == 0) 496 return (EADDRNOTAVAIL); 497 error = in_pcbselsrc(&ina, sin, inp); 498 if (error) 499 return (error); 500 501 if (in_pcbhashlookup(inp->inp_table, sin->sin_addr, sin->sin_port, 502 *ina, inp->inp_lport, inp->inp_rtableid) != NULL) 503 return (EADDRINUSE); 504 505 KASSERT(inp->inp_laddr.s_addr == INADDR_ANY || inp->inp_lport); 506 507 if (inp->inp_laddr.s_addr == INADDR_ANY) { 508 if (inp->inp_lport == 0) { 509 error = in_pcbbind(inp, NULL, curproc); 510 if (error) 511 return (error); 512 if (in_pcbhashlookup(inp->inp_table, sin->sin_addr, 513 sin->sin_port, *ina, inp->inp_lport, 514 inp->inp_rtableid) != NULL) { 515 inp->inp_lport = 0; 516 return (EADDRINUSE); 517 } 518 } 519 inp->inp_laddr = *ina; 520 } 521 inp->inp_faddr = sin->sin_addr; 522 inp->inp_fport = sin->sin_port; 523 in_pcbrehash(inp); 524 #if NSTOEPLITZ > 0 525 inp->inp_flowid = stoeplitz_ip4port(inp->inp_faddr.s_addr, 526 inp->inp_laddr.s_addr, inp->inp_fport, inp->inp_lport); 527 #endif 528 #ifdef IPSEC 529 { 530 /* Cause an IPsec SA to be established. */ 531 /* error is just ignored */ 532 ipsp_spd_inp(NULL, AF_INET, 0, &error, IPSP_DIRECTION_OUT, 533 NULL, inp, NULL); 534 } 535 #endif 536 return (0); 537 } 538 539 void 540 in_pcbdisconnect(struct inpcb *inp) 541 { 542 #if NPF > 0 543 if (inp->inp_pf_sk) { 544 pf_remove_divert_state(inp->inp_pf_sk); 545 /* pf_remove_divert_state() may have detached the state */ 546 pf_inp_unlink(inp); 547 } 548 #endif 549 switch (sotopf(inp->inp_socket)) { 550 #ifdef INET6 551 case PF_INET6: 552 inp->inp_faddr6 = in6addr_any; 553 break; 554 #endif 555 case PF_INET: 556 inp->inp_faddr.s_addr = INADDR_ANY; 557 break; 558 } 559 560 inp->inp_fport = 0; 561 inp->inp_flowid = 0; 562 in_pcbrehash(inp); 563 if (inp->inp_socket->so_state & SS_NOFDREF) 564 in_pcbdetach(inp); 565 } 566 567 void 568 in_pcbdetach(struct inpcb *inp) 569 { 570 struct socket *so = inp->inp_socket; 571 572 NET_ASSERT_LOCKED(); 573 574 so->so_pcb = NULL; 575 /* 576 * As long as the NET_LOCK() is the default lock for Internet 577 * sockets, do not release it to not introduce new sleeping 578 * points. 579 */ 580 sofree(so, SL_NOUNLOCK); 581 m_freem(inp->inp_options); 582 if (inp->inp_route.ro_rt) { 583 rtfree(inp->inp_route.ro_rt); 584 inp->inp_route.ro_rt = NULL; 585 } 586 #ifdef INET6 587 if (inp->inp_flags & INP_IPV6) { 588 ip6_freepcbopts(inp->inp_outputopts6); 589 ip6_freemoptions(inp->inp_moptions6); 590 } else 591 #endif 592 ip_freemoptions(inp->inp_moptions); 593 #if NPF > 0 594 if (inp->inp_pf_sk) { 595 pf_remove_divert_state(inp->inp_pf_sk); 596 /* pf_remove_divert_state() may have detached the state */ 597 pf_inp_unlink(inp); 598 } 599 #endif 600 LIST_REMOVE(inp, inp_lhash); 601 LIST_REMOVE(inp, inp_hash); 602 TAILQ_REMOVE(&inp->inp_table->inpt_queue, inp, inp_queue); 603 inp->inp_table->inpt_count--; 604 in_pcbunref(inp); 605 } 606 607 struct inpcb * 608 in_pcbref(struct inpcb *inp) 609 { 610 if (inp != NULL) 611 refcnt_take(&inp->inp_refcnt); 612 return inp; 613 } 614 615 void 616 in_pcbunref(struct inpcb *inp) 617 { 618 if (refcnt_rele(&inp->inp_refcnt)) { 619 KASSERT((LIST_NEXT(inp, inp_hash) == NULL) || 620 (LIST_NEXT(inp, inp_hash) == _Q_INVALID)); 621 KASSERT((LIST_NEXT(inp, inp_lhash) == NULL) || 622 (LIST_NEXT(inp, inp_lhash) == _Q_INVALID)); 623 KASSERT((TAILQ_NEXT(inp, inp_queue) == NULL) || 624 (TAILQ_NEXT(inp, inp_queue) == _Q_INVALID)); 625 pool_put(&inpcb_pool, inp); 626 } 627 } 628 629 void 630 in_setsockaddr(struct inpcb *inp, struct mbuf *nam) 631 { 632 struct sockaddr_in *sin; 633 634 nam->m_len = sizeof(*sin); 635 sin = mtod(nam, struct sockaddr_in *); 636 memset(sin, 0, sizeof(*sin)); 637 sin->sin_family = AF_INET; 638 sin->sin_len = sizeof(*sin); 639 sin->sin_port = inp->inp_lport; 640 sin->sin_addr = inp->inp_laddr; 641 } 642 643 void 644 in_setpeeraddr(struct inpcb *inp, struct mbuf *nam) 645 { 646 struct sockaddr_in *sin; 647 648 #ifdef INET6 649 if (sotopf(inp->inp_socket) == PF_INET6) { 650 in6_setpeeraddr(inp, nam); 651 return; 652 } 653 #endif /* INET6 */ 654 655 nam->m_len = sizeof(*sin); 656 sin = mtod(nam, struct sockaddr_in *); 657 memset(sin, 0, sizeof(*sin)); 658 sin->sin_family = AF_INET; 659 sin->sin_len = sizeof(*sin); 660 sin->sin_port = inp->inp_fport; 661 sin->sin_addr = inp->inp_faddr; 662 } 663 664 /* 665 * Pass some notification to all connections of a protocol 666 * associated with address dst. The "usual action" will be 667 * taken, depending on the ctlinput cmd. The caller must filter any 668 * cmds that are uninteresting (e.g., no error in the map). 669 * Call the protocol specific routine (if any) to report 670 * any errors for each matching socket. 671 */ 672 void 673 in_pcbnotifyall(struct inpcbtable *table, struct sockaddr *dst, u_int rtable, 674 int errno, void (*notify)(struct inpcb *, int)) 675 { 676 struct inpcb *inp, *ninp; 677 struct in_addr faddr; 678 u_int rdomain; 679 680 NET_ASSERT_LOCKED(); 681 682 #ifdef INET6 683 /* 684 * See in6_pcbnotify() for IPv6 codepath. By the time this 685 * gets called, the addresses passed are either definitely IPv4 or 686 * IPv6; *_pcbnotify() never gets called with v4-mapped v6 addresses. 687 */ 688 #endif /* INET6 */ 689 690 if (dst->sa_family != AF_INET) 691 return; 692 faddr = satosin(dst)->sin_addr; 693 if (faddr.s_addr == INADDR_ANY) 694 return; 695 696 rdomain = rtable_l2(rtable); 697 TAILQ_FOREACH_SAFE(inp, &table->inpt_queue, inp_queue, ninp) { 698 #ifdef INET6 699 if (inp->inp_flags & INP_IPV6) 700 continue; 701 #endif 702 if (inp->inp_faddr.s_addr != faddr.s_addr || 703 rtable_l2(inp->inp_rtableid) != rdomain || 704 inp->inp_socket == NULL) { 705 continue; 706 } 707 if (notify) 708 (*notify)(inp, errno); 709 } 710 } 711 712 /* 713 * Check for alternatives when higher level complains 714 * about service problems. For now, invalidate cached 715 * routing information. If the route was created dynamically 716 * (by a redirect), time to try a default gateway again. 717 */ 718 void 719 in_losing(struct inpcb *inp) 720 { 721 struct rtentry *rt = inp->inp_route.ro_rt; 722 723 if (rt) { 724 inp->inp_route.ro_rt = NULL; 725 726 if (rt->rt_flags & RTF_DYNAMIC) { 727 struct ifnet *ifp; 728 729 ifp = if_get(rt->rt_ifidx); 730 /* 731 * If the interface is gone, all its attached 732 * route entries have been removed from the table, 733 * so we're dealing with a stale cache and have 734 * nothing to do. 735 */ 736 if (ifp != NULL) 737 rtdeletemsg(rt, ifp, inp->inp_rtableid); 738 if_put(ifp); 739 } 740 /* 741 * A new route can be allocated 742 * the next time output is attempted. 743 * rtfree() needs to be called in anycase because the inp 744 * is still holding a reference to rt. 745 */ 746 rtfree(rt); 747 } 748 } 749 750 /* 751 * After a routing change, flush old routing 752 * and allocate a (hopefully) better one. 753 */ 754 void 755 in_rtchange(struct inpcb *inp, int errno) 756 { 757 if (inp->inp_route.ro_rt) { 758 rtfree(inp->inp_route.ro_rt); 759 inp->inp_route.ro_rt = 0; 760 /* 761 * A new route can be allocated the next time 762 * output is attempted. 763 */ 764 } 765 } 766 767 struct inpcb * 768 in_pcblookup_local(struct inpcbtable *table, void *laddrp, u_int lport_arg, 769 int flags, u_int rtable) 770 { 771 struct inpcb *inp, *match = NULL; 772 int matchwild = 3, wildcard; 773 u_int16_t lport = lport_arg; 774 struct in_addr laddr = *(struct in_addr *)laddrp; 775 #ifdef INET6 776 struct in6_addr *laddr6 = (struct in6_addr *)laddrp; 777 #endif 778 struct inpcbhead *head; 779 u_int rdomain; 780 781 rdomain = rtable_l2(rtable); 782 head = in_pcblhash(table, rdomain, lport); 783 LIST_FOREACH(inp, head, inp_lhash) { 784 if (rtable_l2(inp->inp_rtableid) != rdomain) 785 continue; 786 if (inp->inp_lport != lport) 787 continue; 788 wildcard = 0; 789 #ifdef INET6 790 if (ISSET(flags, INPLOOKUP_IPV6)) { 791 if (!ISSET(inp->inp_flags, INP_IPV6)) 792 continue; 793 794 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6)) 795 wildcard++; 796 797 if (!IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6, laddr6)) { 798 if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6) || 799 IN6_IS_ADDR_UNSPECIFIED(laddr6)) 800 wildcard++; 801 else 802 continue; 803 } 804 805 } else 806 #endif /* INET6 */ 807 { 808 #ifdef INET6 809 if (ISSET(inp->inp_flags, INP_IPV6)) 810 continue; 811 #endif /* INET6 */ 812 813 if (inp->inp_faddr.s_addr != INADDR_ANY) 814 wildcard++; 815 816 if (inp->inp_laddr.s_addr != laddr.s_addr) { 817 if (inp->inp_laddr.s_addr == INADDR_ANY || 818 laddr.s_addr == INADDR_ANY) 819 wildcard++; 820 else 821 continue; 822 } 823 824 } 825 if ((!wildcard || (flags & INPLOOKUP_WILDCARD)) && 826 wildcard < matchwild) { 827 match = inp; 828 if ((matchwild = wildcard) == 0) 829 break; 830 } 831 } 832 return (match); 833 } 834 835 struct rtentry * 836 in_pcbrtentry(struct inpcb *inp) 837 { 838 struct route *ro; 839 840 ro = &inp->inp_route; 841 842 /* check if route is still valid */ 843 if (!rtisvalid(ro->ro_rt)) { 844 rtfree(ro->ro_rt); 845 ro->ro_rt = NULL; 846 } 847 848 /* 849 * No route yet, so try to acquire one. 850 */ 851 if (ro->ro_rt == NULL) { 852 #ifdef INET6 853 memset(ro, 0, sizeof(struct route_in6)); 854 #else 855 memset(ro, 0, sizeof(struct route)); 856 #endif 857 858 switch(sotopf(inp->inp_socket)) { 859 #ifdef INET6 860 case PF_INET6: 861 if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6)) 862 break; 863 ro->ro_dst.sa_family = AF_INET6; 864 ro->ro_dst.sa_len = sizeof(struct sockaddr_in6); 865 satosin6(&ro->ro_dst)->sin6_addr = inp->inp_faddr6; 866 ro->ro_tableid = inp->inp_rtableid; 867 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, 868 &inp->inp_laddr6.s6_addr32[0], ro->ro_tableid); 869 break; 870 #endif /* INET6 */ 871 case PF_INET: 872 if (inp->inp_faddr.s_addr == INADDR_ANY) 873 break; 874 ro->ro_dst.sa_family = AF_INET; 875 ro->ro_dst.sa_len = sizeof(struct sockaddr_in); 876 satosin(&ro->ro_dst)->sin_addr = inp->inp_faddr; 877 ro->ro_tableid = inp->inp_rtableid; 878 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, 879 &inp->inp_laddr.s_addr, ro->ro_tableid); 880 break; 881 } 882 } 883 return (ro->ro_rt); 884 } 885 886 /* 887 * Return an IPv4 address, which is the most appropriate for a given 888 * destination. 889 * If necessary, this function lookups the routing table and returns 890 * an entry to the caller for later use. 891 */ 892 int 893 in_pcbselsrc(struct in_addr **insrc, struct sockaddr_in *sin, 894 struct inpcb *inp) 895 { 896 struct ip_moptions *mopts = inp->inp_moptions; 897 struct route *ro = &inp->inp_route; 898 struct in_addr *laddr = &inp->inp_laddr; 899 u_int rtableid = inp->inp_rtableid; 900 struct sockaddr *ip4_source = NULL; 901 902 struct sockaddr_in *sin2; 903 struct in_ifaddr *ia = NULL; 904 905 /* 906 * If the socket(if any) is already bound, use that bound address 907 * unless it is INADDR_ANY or INADDR_BROADCAST. 908 */ 909 if (laddr && laddr->s_addr != INADDR_ANY && 910 laddr->s_addr != INADDR_BROADCAST) { 911 *insrc = laddr; 912 return (0); 913 } 914 915 /* 916 * If the destination address is multicast and an outgoing 917 * interface has been set as a multicast option, use the 918 * address of that interface as our source address. 919 */ 920 if (IN_MULTICAST(sin->sin_addr.s_addr) && mopts != NULL) { 921 struct ifnet *ifp; 922 923 ifp = if_get(mopts->imo_ifidx); 924 if (ifp != NULL) { 925 if (ifp->if_rdomain == rtable_l2(rtableid)) 926 IFP_TO_IA(ifp, ia); 927 if (ia == NULL) { 928 if_put(ifp); 929 return (EADDRNOTAVAIL); 930 } 931 932 *insrc = &ia->ia_addr.sin_addr; 933 if_put(ifp); 934 return (0); 935 } 936 } 937 938 /* 939 * If route is known or can be allocated now, 940 * our src addr is taken from the i/f, else punt. 941 */ 942 if (!rtisvalid(ro->ro_rt) || (ro->ro_tableid != rtableid) || 943 (satosin(&ro->ro_dst)->sin_addr.s_addr != sin->sin_addr.s_addr)) { 944 rtfree(ro->ro_rt); 945 ro->ro_rt = NULL; 946 } 947 if (ro->ro_rt == NULL) { 948 /* No route yet, so try to acquire one */ 949 ro->ro_dst.sa_family = AF_INET; 950 ro->ro_dst.sa_len = sizeof(struct sockaddr_in); 951 satosin(&ro->ro_dst)->sin_addr = sin->sin_addr; 952 ro->ro_tableid = rtableid; 953 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, NULL, ro->ro_tableid); 954 955 /* 956 * It is important to zero out the rest of the 957 * struct sockaddr_in when mixing v6 & v4! 958 */ 959 sin2 = satosin(&ro->ro_dst); 960 memset(sin2->sin_zero, 0, sizeof(sin2->sin_zero)); 961 } 962 963 /* 964 * If we found a route, use the address 965 * corresponding to the outgoing interface. 966 */ 967 if (ro->ro_rt != NULL) 968 ia = ifatoia(ro->ro_rt->rt_ifa); 969 970 /* 971 * Use preferred source address if : 972 * - destination is not onlink 973 * - preferred source address is set 974 * - output interface is UP 975 */ 976 if (ro->ro_rt && !(ro->ro_rt->rt_flags & RTF_LLINFO) && 977 !(ro->ro_rt->rt_flags & RTF_HOST)) { 978 ip4_source = rtable_getsource(rtableid, AF_INET); 979 if (ip4_source != NULL) { 980 struct ifaddr *ifa; 981 if ((ifa = ifa_ifwithaddr(ip4_source, rtableid)) != 982 NULL && ISSET(ifa->ifa_ifp->if_flags, IFF_UP)) { 983 *insrc = &satosin(ip4_source)->sin_addr; 984 return (0); 985 } 986 } 987 } 988 989 if (ia == NULL) 990 return (EADDRNOTAVAIL); 991 992 *insrc = &ia->ia_addr.sin_addr; 993 return (0); 994 } 995 996 void 997 in_pcbrehash(struct inpcb *inp) 998 { 999 struct inpcbtable *table = inp->inp_table; 1000 struct inpcbhead *head; 1001 1002 NET_ASSERT_LOCKED(); 1003 1004 LIST_REMOVE(inp, inp_lhash); 1005 head = in_pcblhash(table, inp->inp_rtableid, inp->inp_lport); 1006 LIST_INSERT_HEAD(head, inp, inp_lhash); 1007 LIST_REMOVE(inp, inp_hash); 1008 #ifdef INET6 1009 if (inp->inp_flags & INP_IPV6) 1010 head = in6_pcbhash(table, rtable_l2(inp->inp_rtableid), 1011 &inp->inp_faddr6, inp->inp_fport, 1012 &inp->inp_laddr6, inp->inp_lport); 1013 else 1014 #endif /* INET6 */ 1015 head = in_pcbhash(table, rtable_l2(inp->inp_rtableid), 1016 &inp->inp_faddr, inp->inp_fport, 1017 &inp->inp_laddr, inp->inp_lport); 1018 LIST_INSERT_HEAD(head, inp, inp_hash); 1019 } 1020 1021 int 1022 in_pcbresize(struct inpcbtable *table, int hashsize) 1023 { 1024 u_long nmask, nlmask; 1025 int osize; 1026 void *nhashtbl, *nlhashtbl, *ohashtbl, *olhashtbl; 1027 struct inpcb *inp; 1028 1029 ohashtbl = table->inpt_hashtbl; 1030 olhashtbl = table->inpt_lhashtbl; 1031 osize = table->inpt_size; 1032 1033 nhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nmask); 1034 if (nhashtbl == NULL) 1035 return ENOBUFS; 1036 nlhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nlmask); 1037 if (nlhashtbl == NULL) { 1038 hashfree(nhashtbl, hashsize, M_PCB); 1039 return ENOBUFS; 1040 } 1041 table->inpt_hashtbl = nhashtbl; 1042 table->inpt_lhashtbl = nlhashtbl; 1043 table->inpt_mask = nmask; 1044 table->inpt_lmask = nlmask; 1045 table->inpt_size = hashsize; 1046 arc4random_buf(&table->inpt_key, sizeof(table->inpt_key)); 1047 arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey)); 1048 1049 TAILQ_FOREACH(inp, &table->inpt_queue, inp_queue) { 1050 in_pcbrehash(inp); 1051 } 1052 hashfree(ohashtbl, osize, M_PCB); 1053 hashfree(olhashtbl, osize, M_PCB); 1054 1055 return (0); 1056 } 1057 1058 #ifdef DIAGNOSTIC 1059 int in_pcbnotifymiss = 0; 1060 #endif 1061 1062 /* 1063 * The in(6)_pcbhashlookup functions are used to locate connected sockets 1064 * quickly: 1065 * faddr.fport <-> laddr.lport 1066 * No wildcard matching is done so that listening sockets are not found. 1067 * If the functions return NULL in(6)_pcblookup_listen can be used to 1068 * find a listening/bound socket that may accept the connection. 1069 * After those two lookups no other are necessary. 1070 */ 1071 struct inpcb * 1072 in_pcbhashlookup(struct inpcbtable *table, struct in_addr faddr, 1073 u_int fport_arg, struct in_addr laddr, u_int lport_arg, u_int rtable) 1074 { 1075 struct inpcbhead *head; 1076 struct inpcb *inp; 1077 u_int16_t fport = fport_arg, lport = lport_arg; 1078 u_int rdomain; 1079 1080 rdomain = rtable_l2(rtable); 1081 head = in_pcbhash(table, rdomain, &faddr, fport, &laddr, lport); 1082 LIST_FOREACH(inp, head, inp_hash) { 1083 #ifdef INET6 1084 if (inp->inp_flags & INP_IPV6) 1085 continue; /*XXX*/ 1086 #endif 1087 if (inp->inp_faddr.s_addr == faddr.s_addr && 1088 inp->inp_fport == fport && inp->inp_lport == lport && 1089 inp->inp_laddr.s_addr == laddr.s_addr && 1090 rtable_l2(inp->inp_rtableid) == rdomain) { 1091 /* 1092 * Move this PCB to the head of hash chain so that 1093 * repeated accesses are quicker. This is analogous to 1094 * the historic single-entry PCB cache. 1095 */ 1096 if (inp != LIST_FIRST(head)) { 1097 LIST_REMOVE(inp, inp_hash); 1098 LIST_INSERT_HEAD(head, inp, inp_hash); 1099 } 1100 break; 1101 } 1102 } 1103 #ifdef DIAGNOSTIC 1104 if (inp == NULL && in_pcbnotifymiss) { 1105 printf("%s: faddr=%08x fport=%d laddr=%08x lport=%d rdom=%u\n", 1106 __func__, ntohl(faddr.s_addr), ntohs(fport), 1107 ntohl(laddr.s_addr), ntohs(lport), rdomain); 1108 } 1109 #endif 1110 return (inp); 1111 } 1112 1113 /* 1114 * The in(6)_pcblookup_listen functions are used to locate listening 1115 * sockets quickly. This are sockets with unspecified foreign address 1116 * and port: 1117 * *.* <-> laddr.lport 1118 * *.* <-> *.lport 1119 */ 1120 struct inpcb * 1121 in_pcblookup_listen(struct inpcbtable *table, struct in_addr laddr, 1122 u_int lport_arg, struct mbuf *m, u_int rtable) 1123 { 1124 struct inpcbhead *head; 1125 const struct in_addr *key1, *key2; 1126 struct inpcb *inp; 1127 u_int16_t lport = lport_arg; 1128 u_int rdomain; 1129 1130 key1 = &laddr; 1131 key2 = &zeroin_addr; 1132 #if NPF > 0 1133 if (m && m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) { 1134 struct pf_divert *divert; 1135 1136 divert = pf_find_divert(m); 1137 KASSERT(divert != NULL); 1138 switch (divert->type) { 1139 case PF_DIVERT_TO: 1140 key1 = key2 = &divert->addr.v4; 1141 lport = divert->port; 1142 break; 1143 case PF_DIVERT_REPLY: 1144 return (NULL); 1145 default: 1146 panic("%s: unknown divert type %d, mbuf %p, divert %p", 1147 __func__, divert->type, m, divert); 1148 } 1149 } else if (m && m->m_pkthdr.pf.flags & PF_TAG_TRANSLATE_LOCALHOST) { 1150 /* 1151 * Redirected connections should not be treated the same 1152 * as connections directed to 127.0.0.0/8 since localhost 1153 * can only be accessed from the host itself. 1154 * For example portmap(8) grants more permissions for 1155 * connections to the socket bound to 127.0.0.1 than 1156 * to the * socket. 1157 */ 1158 key1 = &zeroin_addr; 1159 key2 = &laddr; 1160 } 1161 #endif 1162 1163 rdomain = rtable_l2(rtable); 1164 head = in_pcbhash(table, rdomain, &zeroin_addr, 0, key1, lport); 1165 LIST_FOREACH(inp, head, inp_hash) { 1166 #ifdef INET6 1167 if (inp->inp_flags & INP_IPV6) 1168 continue; /*XXX*/ 1169 #endif 1170 if (inp->inp_lport == lport && inp->inp_fport == 0 && 1171 inp->inp_laddr.s_addr == key1->s_addr && 1172 inp->inp_faddr.s_addr == INADDR_ANY && 1173 rtable_l2(inp->inp_rtableid) == rdomain) 1174 break; 1175 } 1176 if (inp == NULL && key1->s_addr != key2->s_addr) { 1177 head = in_pcbhash(table, rdomain, 1178 &zeroin_addr, 0, key2, lport); 1179 LIST_FOREACH(inp, head, inp_hash) { 1180 #ifdef INET6 1181 if (inp->inp_flags & INP_IPV6) 1182 continue; /*XXX*/ 1183 #endif 1184 if (inp->inp_lport == lport && inp->inp_fport == 0 && 1185 inp->inp_laddr.s_addr == key2->s_addr && 1186 inp->inp_faddr.s_addr == INADDR_ANY && 1187 rtable_l2(inp->inp_rtableid) == rdomain) 1188 break; 1189 } 1190 } 1191 /* 1192 * Move this PCB to the head of hash chain so that 1193 * repeated accesses are quicker. This is analogous to 1194 * the historic single-entry PCB cache. 1195 */ 1196 if (inp != NULL && inp != LIST_FIRST(head)) { 1197 LIST_REMOVE(inp, inp_hash); 1198 LIST_INSERT_HEAD(head, inp, inp_hash); 1199 } 1200 #ifdef DIAGNOSTIC 1201 if (inp == NULL && in_pcbnotifymiss) { 1202 printf("%s: laddr=%08x lport=%d rdom=%u\n", 1203 __func__, ntohl(laddr.s_addr), ntohs(lport), rdomain); 1204 } 1205 #endif 1206 return (inp); 1207 } 1208