1 /* $OpenBSD: in_pcb.c,v 1.247 2018/10/04 17:33:41 bluhm Exp $ */ 2 /* $NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $ */ 3 4 /* 5 * Copyright (c) 1982, 1986, 1991, 1993 6 * The Regents of the University of California. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 * 32 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 33 * 34 * NRL grants permission for redistribution and use in source and binary 35 * forms, with or without modification, of the software and documentation 36 * created at NRL provided that the following conditions are met: 37 * 38 * 1. Redistributions of source code must retain the above copyright 39 * notice, this list of conditions and the following disclaimer. 40 * 2. Redistributions in binary form must reproduce the above copyright 41 * notice, this list of conditions and the following disclaimer in the 42 * documentation and/or other materials provided with the distribution. 43 * 3. All advertising materials mentioning features or use of this software 44 * must display the following acknowledgements: 45 * This product includes software developed by the University of 46 * California, Berkeley and its contributors. 47 * This product includes software developed at the Information 48 * Technology Division, US Naval Research Laboratory. 49 * 4. Neither the name of the NRL nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS 54 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 56 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR 57 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 58 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 59 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 60 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 61 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 62 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 63 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 64 * 65 * The views and conclusions contained in the software and documentation 66 * are those of the authors and should not be interpreted as representing 67 * official policies, either expressed or implied, of the US Naval 68 * Research Laboratory (NRL). 69 */ 70 71 #include "pf.h" 72 73 #include <sys/param.h> 74 #include <sys/systm.h> 75 #include <sys/mbuf.h> 76 #include <sys/protosw.h> 77 #include <sys/socket.h> 78 #include <sys/socketvar.h> 79 #include <sys/domain.h> 80 #include <sys/mount.h> 81 #include <sys/pool.h> 82 #include <sys/proc.h> 83 84 #include <net/if.h> 85 #include <net/if_var.h> 86 #include <net/pfvar.h> 87 #include <net/route.h> 88 89 #include <netinet/in.h> 90 #include <netinet/in_var.h> 91 #include <netinet/ip.h> 92 #include <netinet/ip_var.h> 93 #include <netinet/in_pcb.h> 94 #ifdef IPSEC 95 #include <netinet/ip_esp.h> 96 #endif /* IPSEC */ 97 98 const struct in_addr zeroin_addr; 99 100 union { 101 struct in_addr za_in; 102 struct in6_addr za_in6; 103 } zeroin46_addr; 104 105 /* 106 * These configure the range of local port addresses assigned to 107 * "unspecified" outgoing connections/packets/whatever. 108 */ 109 int ipport_firstauto = IPPORT_RESERVED; 110 int ipport_lastauto = IPPORT_USERRESERVED; 111 int ipport_hifirstauto = IPPORT_HIFIRSTAUTO; 112 int ipport_hilastauto = IPPORT_HILASTAUTO; 113 114 struct baddynamicports baddynamicports; 115 struct baddynamicports rootonlyports; 116 struct pool inpcb_pool; 117 int inpcb_pool_initialized = 0; 118 119 int in_pcbresize (struct inpcbtable *, int); 120 121 #define INPCBHASH_LOADFACTOR(_x) (((_x) * 3) / 4) 122 123 struct inpcbhead *in_pcbhash(struct inpcbtable *, int, 124 const struct in_addr *, u_short, const struct in_addr *, u_short); 125 struct inpcbhead *in_pcblhash(struct inpcbtable *, int, u_short); 126 127 struct inpcbhead * 128 in_pcbhash(struct inpcbtable *table, int rdom, 129 const struct in_addr *faddr, u_short fport, 130 const struct in_addr *laddr, u_short lport) 131 { 132 SIPHASH_CTX ctx; 133 u_int32_t nrdom = htonl(rdom); 134 135 SipHash24_Init(&ctx, &table->inpt_key); 136 SipHash24_Update(&ctx, &nrdom, sizeof(nrdom)); 137 SipHash24_Update(&ctx, faddr, sizeof(*faddr)); 138 SipHash24_Update(&ctx, &fport, sizeof(fport)); 139 SipHash24_Update(&ctx, laddr, sizeof(*laddr)); 140 SipHash24_Update(&ctx, &lport, sizeof(lport)); 141 142 return (&table->inpt_hashtbl[SipHash24_End(&ctx) & table->inpt_mask]); 143 } 144 145 struct inpcbhead * 146 in_pcblhash(struct inpcbtable *table, int rdom, u_short lport) 147 { 148 SIPHASH_CTX ctx; 149 u_int32_t nrdom = htonl(rdom); 150 151 SipHash24_Init(&ctx, &table->inpt_lkey); 152 SipHash24_Update(&ctx, &nrdom, sizeof(nrdom)); 153 SipHash24_Update(&ctx, &lport, sizeof(lport)); 154 155 return (&table->inpt_lhashtbl[SipHash24_End(&ctx) & table->inpt_lmask]); 156 } 157 158 void 159 in_pcbinit(struct inpcbtable *table, int hashsize) 160 { 161 162 TAILQ_INIT(&table->inpt_queue); 163 table->inpt_hashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, 164 &table->inpt_mask); 165 if (table->inpt_hashtbl == NULL) 166 panic("in_pcbinit: hashinit failed"); 167 table->inpt_lhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, 168 &table->inpt_lmask); 169 if (table->inpt_lhashtbl == NULL) 170 panic("in_pcbinit: hashinit failed for lport"); 171 table->inpt_count = 0; 172 table->inpt_size = hashsize; 173 arc4random_buf(&table->inpt_key, sizeof(table->inpt_key)); 174 arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey)); 175 } 176 177 /* 178 * Check if the specified port is invalid for dynamic allocation. 179 */ 180 int 181 in_baddynamic(u_int16_t port, u_int16_t proto) 182 { 183 switch (proto) { 184 case IPPROTO_TCP: 185 return (DP_ISSET(baddynamicports.tcp, port)); 186 case IPPROTO_UDP: 187 #ifdef IPSEC 188 /* Cannot preset this as it is a sysctl */ 189 if (port == udpencap_port) 190 return (1); 191 #endif 192 return (DP_ISSET(baddynamicports.udp, port)); 193 default: 194 return (0); 195 } 196 } 197 198 int 199 in_rootonly(u_int16_t port, u_int16_t proto) 200 { 201 switch (proto) { 202 case IPPROTO_TCP: 203 return (port < IPPORT_RESERVED || 204 DP_ISSET(rootonlyports.tcp, port)); 205 case IPPROTO_UDP: 206 return (port < IPPORT_RESERVED || 207 DP_ISSET(rootonlyports.udp, port)); 208 default: 209 return (0); 210 } 211 } 212 213 int 214 in_pcballoc(struct socket *so, struct inpcbtable *table) 215 { 216 struct inpcb *inp; 217 struct inpcbhead *head; 218 219 NET_ASSERT_LOCKED(); 220 221 if (inpcb_pool_initialized == 0) { 222 pool_init(&inpcb_pool, sizeof(struct inpcb), 0, 223 IPL_SOFTNET, 0, "inpcbpl", NULL); 224 inpcb_pool_initialized = 1; 225 } 226 inp = pool_get(&inpcb_pool, PR_NOWAIT|PR_ZERO); 227 if (inp == NULL) 228 return (ENOBUFS); 229 inp->inp_table = table; 230 inp->inp_socket = so; 231 refcnt_init(&inp->inp_refcnt); 232 inp->inp_seclevel[SL_AUTH] = IPSEC_AUTH_LEVEL_DEFAULT; 233 inp->inp_seclevel[SL_ESP_TRANS] = IPSEC_ESP_TRANS_LEVEL_DEFAULT; 234 inp->inp_seclevel[SL_ESP_NETWORK] = IPSEC_ESP_NETWORK_LEVEL_DEFAULT; 235 inp->inp_seclevel[SL_IPCOMP] = IPSEC_IPCOMP_LEVEL_DEFAULT; 236 inp->inp_rtableid = curproc->p_p->ps_rtableid; 237 inp->inp_hops = -1; 238 #ifdef INET6 239 /* 240 * Small change in this function to set the INP_IPV6 flag so routines 241 * outside pcb-specific routines don't need to use sotopf(), and all 242 * of its pointer chasing, later. 243 */ 244 if (sotopf(so) == PF_INET6) 245 inp->inp_flags = INP_IPV6; 246 inp->inp_cksum6 = -1; 247 #endif /* INET6 */ 248 249 if (table->inpt_count++ > INPCBHASH_LOADFACTOR(table->inpt_size)) 250 (void)in_pcbresize(table, table->inpt_size * 2); 251 TAILQ_INSERT_HEAD(&table->inpt_queue, inp, inp_queue); 252 head = in_pcblhash(table, inp->inp_rtableid, inp->inp_lport); 253 LIST_INSERT_HEAD(head, inp, inp_lhash); 254 #ifdef INET6 255 if (sotopf(so) == PF_INET6) 256 head = in6_pcbhash(table, rtable_l2(inp->inp_rtableid), 257 &inp->inp_faddr6, inp->inp_fport, 258 &inp->inp_laddr6, inp->inp_lport); 259 else 260 #endif /* INET6 */ 261 head = in_pcbhash(table, rtable_l2(inp->inp_rtableid), 262 &inp->inp_faddr, inp->inp_fport, 263 &inp->inp_laddr, inp->inp_lport); 264 LIST_INSERT_HEAD(head, inp, inp_hash); 265 so->so_pcb = inp; 266 267 return (0); 268 } 269 270 int 271 in_pcbbind(struct inpcb *inp, struct mbuf *nam, struct proc *p) 272 { 273 struct socket *so = inp->inp_socket; 274 u_int16_t lport = 0; 275 int wild = 0; 276 void *laddr = &zeroin46_addr; 277 int error; 278 279 if (inp->inp_lport) 280 return (EINVAL); 281 282 if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0 && 283 ((so->so_proto->pr_flags & PR_CONNREQUIRED) == 0 || 284 (so->so_options & SO_ACCEPTCONN) == 0)) 285 wild = INPLOOKUP_WILDCARD; 286 287 switch (sotopf(so)) { 288 #ifdef INET6 289 case PF_INET6: 290 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6)) 291 return (EINVAL); 292 wild |= INPLOOKUP_IPV6; 293 294 if (nam) { 295 struct sockaddr_in6 *sin6; 296 297 if ((error = in6_nam2sin6(nam, &sin6))) 298 return (error); 299 if ((error = in6_pcbaddrisavail(inp, sin6, wild, p))) 300 return (error); 301 laddr = &sin6->sin6_addr; 302 lport = sin6->sin6_port; 303 } 304 break; 305 #endif 306 case PF_INET: 307 if (inp->inp_laddr.s_addr != INADDR_ANY) 308 return (EINVAL); 309 310 if (nam) { 311 struct sockaddr_in *sin; 312 313 if ((error = in_nam2sin(nam, &sin))) 314 return (error); 315 if ((error = in_pcbaddrisavail(inp, sin, wild, p))) 316 return (error); 317 laddr = &sin->sin_addr; 318 lport = sin->sin_port; 319 } 320 break; 321 default: 322 return (EINVAL); 323 } 324 325 if (lport == 0) { 326 if ((error = in_pcbpickport(&lport, laddr, wild, inp, p))) 327 return (error); 328 } else { 329 if (in_rootonly(ntohs(lport), so->so_proto->pr_protocol) && 330 suser(p) != 0) 331 return (EACCES); 332 } 333 if (nam) { 334 switch (sotopf(so)) { 335 #ifdef INET6 336 case PF_INET6: 337 inp->inp_laddr6 = *(struct in6_addr *)laddr; 338 break; 339 #endif 340 case PF_INET: 341 inp->inp_laddr = *(struct in_addr *)laddr; 342 break; 343 } 344 } 345 inp->inp_lport = lport; 346 in_pcbrehash(inp); 347 return (0); 348 } 349 350 int 351 in_pcbaddrisavail(struct inpcb *inp, struct sockaddr_in *sin, int wild, 352 struct proc *p) 353 { 354 struct socket *so = inp->inp_socket; 355 struct inpcbtable *table = inp->inp_table; 356 u_int16_t lport = sin->sin_port; 357 int reuseport = (so->so_options & SO_REUSEPORT); 358 359 if (IN_MULTICAST(sin->sin_addr.s_addr)) { 360 /* 361 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast; 362 * allow complete duplication of binding if 363 * SO_REUSEPORT is set, or if SO_REUSEADDR is set 364 * and a multicast address is bound on both 365 * new and duplicated sockets. 366 */ 367 if (so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) 368 reuseport = SO_REUSEADDR|SO_REUSEPORT; 369 } else if (sin->sin_addr.s_addr != INADDR_ANY) { 370 /* 371 * we must check that we are binding to an address we 372 * own except when: 373 * - SO_BINDANY is set or 374 * - we are binding a UDP socket to 255.255.255.255 or 375 * - we are binding a UDP socket to one of our broadcast 376 * addresses 377 */ 378 if (!ISSET(so->so_options, SO_BINDANY) && 379 !(so->so_type == SOCK_DGRAM && 380 sin->sin_addr.s_addr == INADDR_BROADCAST) && 381 !(so->so_type == SOCK_DGRAM && 382 in_broadcast(sin->sin_addr, inp->inp_rtableid))) { 383 struct ifaddr *ia; 384 385 sin->sin_port = 0; 386 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 387 ia = ifa_ifwithaddr(sintosa(sin), inp->inp_rtableid); 388 sin->sin_port = lport; 389 390 if (ia == NULL) 391 return (EADDRNOTAVAIL); 392 } 393 } 394 if (lport) { 395 struct inpcb *t; 396 397 if (so->so_euid) { 398 t = in_pcblookup_local(table, &sin->sin_addr, lport, 399 INPLOOKUP_WILDCARD, inp->inp_rtableid); 400 if (t && (so->so_euid != t->inp_socket->so_euid)) 401 return (EADDRINUSE); 402 } 403 t = in_pcblookup_local(table, &sin->sin_addr, lport, 404 wild, inp->inp_rtableid); 405 if (t && (reuseport & t->inp_socket->so_options) == 0) 406 return (EADDRINUSE); 407 } 408 409 return (0); 410 } 411 412 int 413 in_pcbpickport(u_int16_t *lport, void *laddr, int wild, struct inpcb *inp, 414 struct proc *p) 415 { 416 struct socket *so = inp->inp_socket; 417 struct inpcbtable *table = inp->inp_table; 418 u_int16_t first, last, lower, higher, candidate, localport; 419 int count; 420 421 if (inp->inp_flags & INP_HIGHPORT) { 422 first = ipport_hifirstauto; /* sysctl */ 423 last = ipport_hilastauto; 424 } else if (inp->inp_flags & INP_LOWPORT) { 425 if (suser(p)) 426 return (EACCES); 427 first = IPPORT_RESERVED-1; /* 1023 */ 428 last = 600; /* not IPPORT_RESERVED/2 */ 429 } else { 430 first = ipport_firstauto; /* sysctl */ 431 last = ipport_lastauto; 432 } 433 if (first < last) { 434 lower = first; 435 higher = last; 436 } else { 437 lower = last; 438 higher = first; 439 } 440 441 /* 442 * Simple check to ensure all ports are not used up causing 443 * a deadlock here. 444 */ 445 446 count = higher - lower; 447 candidate = lower + arc4random_uniform(count); 448 449 do { 450 if (count-- < 0) /* completely used? */ 451 return (EADDRNOTAVAIL); 452 ++candidate; 453 if (candidate < lower || candidate > higher) 454 candidate = lower; 455 localport = htons(candidate); 456 } while (in_baddynamic(candidate, so->so_proto->pr_protocol) || 457 in_pcblookup_local(table, laddr, localport, wild, 458 inp->inp_rtableid)); 459 *lport = localport; 460 461 return (0); 462 } 463 464 /* 465 * Connect from a socket to a specified address. 466 * Both address and port must be specified in argument sin. 467 * If don't have a local address for this socket yet, 468 * then pick one. 469 */ 470 int 471 in_pcbconnect(struct inpcb *inp, struct mbuf *nam) 472 { 473 struct in_addr *ina = NULL; 474 struct sockaddr_in *sin; 475 int error; 476 477 #ifdef INET6 478 if (sotopf(inp->inp_socket) == PF_INET6) 479 return (in6_pcbconnect(inp, nam)); 480 KASSERT((inp->inp_flags & INP_IPV6) == 0); 481 #endif /* INET6 */ 482 483 if ((error = in_nam2sin(nam, &sin))) 484 return (error); 485 if (sin->sin_port == 0) 486 return (EADDRNOTAVAIL); 487 error = in_pcbselsrc(&ina, sin, inp); 488 if (error) 489 return (error); 490 491 if (in_pcbhashlookup(inp->inp_table, sin->sin_addr, sin->sin_port, 492 *ina, inp->inp_lport, inp->inp_rtableid) != NULL) 493 return (EADDRINUSE); 494 495 KASSERT(inp->inp_laddr.s_addr == INADDR_ANY || inp->inp_lport); 496 497 if (inp->inp_laddr.s_addr == INADDR_ANY) { 498 if (inp->inp_lport == 0) { 499 error = in_pcbbind(inp, NULL, curproc); 500 if (error) 501 return (error); 502 if (in_pcbhashlookup(inp->inp_table, sin->sin_addr, 503 sin->sin_port, *ina, inp->inp_lport, 504 inp->inp_rtableid) != NULL) { 505 inp->inp_lport = 0; 506 return (EADDRINUSE); 507 } 508 } 509 inp->inp_laddr = *ina; 510 } 511 inp->inp_faddr = sin->sin_addr; 512 inp->inp_fport = sin->sin_port; 513 in_pcbrehash(inp); 514 #ifdef IPSEC 515 { 516 /* Cause an IPsec SA to be established. */ 517 /* error is just ignored */ 518 ipsp_spd_inp(NULL, AF_INET, 0, &error, IPSP_DIRECTION_OUT, 519 NULL, inp, NULL); 520 } 521 #endif 522 return (0); 523 } 524 525 void 526 in_pcbdisconnect(struct inpcb *inp) 527 { 528 switch (sotopf(inp->inp_socket)) { 529 #ifdef INET6 530 case PF_INET6: 531 inp->inp_faddr6 = in6addr_any; 532 break; 533 #endif 534 case PF_INET: 535 inp->inp_faddr.s_addr = INADDR_ANY; 536 break; 537 } 538 539 inp->inp_fport = 0; 540 in_pcbrehash(inp); 541 if (inp->inp_socket->so_state & SS_NOFDREF) 542 in_pcbdetach(inp); 543 } 544 545 void 546 in_pcbdetach(struct inpcb *inp) 547 { 548 struct socket *so = inp->inp_socket; 549 550 NET_ASSERT_LOCKED(); 551 552 so->so_pcb = NULL; 553 /* 554 * As long as the NET_LOCK() is the default lock for Internet 555 * sockets, do not release it to not introduce new sleeping 556 * points. 557 */ 558 sofree(so, SL_NOUNLOCK); 559 m_freem(inp->inp_options); 560 if (inp->inp_route.ro_rt) { 561 rtfree(inp->inp_route.ro_rt); 562 inp->inp_route.ro_rt = NULL; 563 } 564 #ifdef INET6 565 if (inp->inp_flags & INP_IPV6) { 566 ip6_freepcbopts(inp->inp_outputopts6); 567 ip6_freemoptions(inp->inp_moptions6); 568 } else 569 #endif 570 ip_freemoptions(inp->inp_moptions); 571 #if NPF > 0 572 if (inp->inp_pf_sk) { 573 pf_remove_divert_state(inp->inp_pf_sk); 574 /* pf_remove_divert_state() may have detached the state */ 575 pf_inp_unlink(inp); 576 } 577 #endif 578 LIST_REMOVE(inp, inp_lhash); 579 LIST_REMOVE(inp, inp_hash); 580 TAILQ_REMOVE(&inp->inp_table->inpt_queue, inp, inp_queue); 581 inp->inp_table->inpt_count--; 582 in_pcbunref(inp); 583 } 584 585 struct inpcb * 586 in_pcbref(struct inpcb *inp) 587 { 588 if (inp != NULL) 589 refcnt_take(&inp->inp_refcnt); 590 return inp; 591 } 592 593 void 594 in_pcbunref(struct inpcb *inp) 595 { 596 if (refcnt_rele(&inp->inp_refcnt)) { 597 KASSERT((LIST_NEXT(inp, inp_hash) == NULL) || 598 (LIST_NEXT(inp, inp_hash) == _Q_INVALID)); 599 KASSERT((LIST_NEXT(inp, inp_lhash) == NULL) || 600 (LIST_NEXT(inp, inp_lhash) == _Q_INVALID)); 601 KASSERT((TAILQ_NEXT(inp, inp_queue) == NULL) || 602 (TAILQ_NEXT(inp, inp_queue) == _Q_INVALID)); 603 pool_put(&inpcb_pool, inp); 604 } 605 } 606 607 void 608 in_setsockaddr(struct inpcb *inp, struct mbuf *nam) 609 { 610 struct sockaddr_in *sin; 611 612 nam->m_len = sizeof(*sin); 613 sin = mtod(nam, struct sockaddr_in *); 614 memset(sin, 0, sizeof(*sin)); 615 sin->sin_family = AF_INET; 616 sin->sin_len = sizeof(*sin); 617 sin->sin_port = inp->inp_lport; 618 sin->sin_addr = inp->inp_laddr; 619 } 620 621 void 622 in_setpeeraddr(struct inpcb *inp, struct mbuf *nam) 623 { 624 struct sockaddr_in *sin; 625 626 #ifdef INET6 627 if (sotopf(inp->inp_socket) == PF_INET6) { 628 in6_setpeeraddr(inp, nam); 629 return; 630 } 631 #endif /* INET6 */ 632 633 nam->m_len = sizeof(*sin); 634 sin = mtod(nam, struct sockaddr_in *); 635 memset(sin, 0, sizeof(*sin)); 636 sin->sin_family = AF_INET; 637 sin->sin_len = sizeof(*sin); 638 sin->sin_port = inp->inp_fport; 639 sin->sin_addr = inp->inp_faddr; 640 } 641 642 /* 643 * Pass some notification to all connections of a protocol 644 * associated with address dst. The "usual action" will be 645 * taken, depending on the ctlinput cmd. The caller must filter any 646 * cmds that are uninteresting (e.g., no error in the map). 647 * Call the protocol specific routine (if any) to report 648 * any errors for each matching socket. 649 */ 650 void 651 in_pcbnotifyall(struct inpcbtable *table, struct sockaddr *dst, u_int rtable, 652 int errno, void (*notify)(struct inpcb *, int)) 653 { 654 struct inpcb *inp, *ninp; 655 struct in_addr faddr; 656 u_int rdomain; 657 658 NET_ASSERT_LOCKED(); 659 660 #ifdef INET6 661 /* 662 * See in6_pcbnotify() for IPv6 codepath. By the time this 663 * gets called, the addresses passed are either definitely IPv4 or 664 * IPv6; *_pcbnotify() never gets called with v4-mapped v6 addresses. 665 */ 666 #endif /* INET6 */ 667 668 if (dst->sa_family != AF_INET) 669 return; 670 faddr = satosin(dst)->sin_addr; 671 if (faddr.s_addr == INADDR_ANY) 672 return; 673 674 rdomain = rtable_l2(rtable); 675 TAILQ_FOREACH_SAFE(inp, &table->inpt_queue, inp_queue, ninp) { 676 #ifdef INET6 677 if (inp->inp_flags & INP_IPV6) 678 continue; 679 #endif 680 if (inp->inp_faddr.s_addr != faddr.s_addr || 681 rtable_l2(inp->inp_rtableid) != rdomain || 682 inp->inp_socket == NULL) { 683 continue; 684 } 685 if (notify) 686 (*notify)(inp, errno); 687 } 688 } 689 690 /* 691 * Check for alternatives when higher level complains 692 * about service problems. For now, invalidate cached 693 * routing information. If the route was created dynamically 694 * (by a redirect), time to try a default gateway again. 695 */ 696 void 697 in_losing(struct inpcb *inp) 698 { 699 struct rtentry *rt = inp->inp_route.ro_rt; 700 701 if (rt) { 702 inp->inp_route.ro_rt = NULL; 703 704 if (rt->rt_flags & RTF_DYNAMIC) { 705 struct ifnet *ifp; 706 707 ifp = if_get(rt->rt_ifidx); 708 /* 709 * If the interface is gone, all its attached 710 * route entries have been removed from the table, 711 * so we're dealing with a stale cache and have 712 * nothing to do. 713 */ 714 if (ifp != NULL) 715 rtdeletemsg(rt, ifp, inp->inp_rtableid); 716 if_put(ifp); 717 } 718 /* 719 * A new route can be allocated 720 * the next time output is attempted. 721 * rtfree() needs to be called in anycase because the inp 722 * is still holding a reference to rt. 723 */ 724 rtfree(rt); 725 } 726 } 727 728 /* 729 * After a routing change, flush old routing 730 * and allocate a (hopefully) better one. 731 */ 732 void 733 in_rtchange(struct inpcb *inp, int errno) 734 { 735 if (inp->inp_route.ro_rt) { 736 rtfree(inp->inp_route.ro_rt); 737 inp->inp_route.ro_rt = 0; 738 /* 739 * A new route can be allocated the next time 740 * output is attempted. 741 */ 742 } 743 } 744 745 struct inpcb * 746 in_pcblookup_local(struct inpcbtable *table, void *laddrp, u_int lport_arg, 747 int flags, u_int rtable) 748 { 749 struct inpcb *inp, *match = NULL; 750 int matchwild = 3, wildcard; 751 u_int16_t lport = lport_arg; 752 struct in_addr laddr = *(struct in_addr *)laddrp; 753 #ifdef INET6 754 struct in6_addr *laddr6 = (struct in6_addr *)laddrp; 755 #endif 756 struct inpcbhead *head; 757 u_int rdomain; 758 759 rdomain = rtable_l2(rtable); 760 head = in_pcblhash(table, rdomain, lport); 761 LIST_FOREACH(inp, head, inp_lhash) { 762 if (rtable_l2(inp->inp_rtableid) != rdomain) 763 continue; 764 if (inp->inp_lport != lport) 765 continue; 766 wildcard = 0; 767 #ifdef INET6 768 if (ISSET(flags, INPLOOKUP_IPV6)) { 769 if (!ISSET(inp->inp_flags, INP_IPV6)) 770 continue; 771 772 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6)) 773 wildcard++; 774 775 if (!IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6, laddr6)) { 776 if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6) || 777 IN6_IS_ADDR_UNSPECIFIED(laddr6)) 778 wildcard++; 779 else 780 continue; 781 } 782 783 } else 784 #endif /* INET6 */ 785 { 786 #ifdef INET6 787 if (ISSET(inp->inp_flags, INP_IPV6)) 788 continue; 789 #endif /* INET6 */ 790 791 if (inp->inp_faddr.s_addr != INADDR_ANY) 792 wildcard++; 793 794 if (inp->inp_laddr.s_addr != laddr.s_addr) { 795 if (inp->inp_laddr.s_addr == INADDR_ANY || 796 laddr.s_addr == INADDR_ANY) 797 wildcard++; 798 else 799 continue; 800 } 801 802 } 803 if ((!wildcard || (flags & INPLOOKUP_WILDCARD)) && 804 wildcard < matchwild) { 805 match = inp; 806 if ((matchwild = wildcard) == 0) 807 break; 808 } 809 } 810 return (match); 811 } 812 813 struct rtentry * 814 in_pcbrtentry(struct inpcb *inp) 815 { 816 struct route *ro; 817 818 ro = &inp->inp_route; 819 820 /* check if route is still valid */ 821 if (!rtisvalid(ro->ro_rt)) { 822 rtfree(ro->ro_rt); 823 ro->ro_rt = NULL; 824 } 825 826 /* 827 * No route yet, so try to acquire one. 828 */ 829 if (ro->ro_rt == NULL) { 830 #ifdef INET6 831 memset(ro, 0, sizeof(struct route_in6)); 832 #else 833 memset(ro, 0, sizeof(struct route)); 834 #endif 835 836 switch(sotopf(inp->inp_socket)) { 837 #ifdef INET6 838 case PF_INET6: 839 if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6)) 840 break; 841 ro->ro_dst.sa_family = AF_INET6; 842 ro->ro_dst.sa_len = sizeof(struct sockaddr_in6); 843 satosin6(&ro->ro_dst)->sin6_addr = inp->inp_faddr6; 844 ro->ro_tableid = inp->inp_rtableid; 845 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, 846 &inp->inp_laddr6.s6_addr32[0], ro->ro_tableid); 847 break; 848 #endif /* INET6 */ 849 case PF_INET: 850 if (inp->inp_faddr.s_addr == INADDR_ANY) 851 break; 852 ro->ro_dst.sa_family = AF_INET; 853 ro->ro_dst.sa_len = sizeof(struct sockaddr_in); 854 satosin(&ro->ro_dst)->sin_addr = inp->inp_faddr; 855 ro->ro_tableid = inp->inp_rtableid; 856 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, 857 &inp->inp_laddr.s_addr, ro->ro_tableid); 858 break; 859 } 860 } 861 return (ro->ro_rt); 862 } 863 864 /* 865 * Return an IPv4 address, which is the most appropriate for a given 866 * destination. 867 * If necessary, this function lookups the routing table and returns 868 * an entry to the caller for later use. 869 */ 870 int 871 in_pcbselsrc(struct in_addr **insrc, struct sockaddr_in *sin, 872 struct inpcb *inp) 873 { 874 struct ip_moptions *mopts = inp->inp_moptions; 875 struct route *ro = &inp->inp_route; 876 struct in_addr *laddr = &inp->inp_laddr; 877 u_int rtableid = inp->inp_rtableid; 878 879 struct sockaddr_in *sin2; 880 struct in_ifaddr *ia = NULL; 881 882 /* 883 * If the socket(if any) is already bound, use that bound address 884 * unless it is INADDR_ANY or INADDR_BROADCAST. 885 */ 886 if (laddr && laddr->s_addr != INADDR_ANY && 887 laddr->s_addr != INADDR_BROADCAST) { 888 *insrc = laddr; 889 return (0); 890 } 891 892 /* 893 * If the destination address is multicast and an outgoing 894 * interface has been set as a multicast option, use the 895 * address of that interface as our source address. 896 */ 897 if (IN_MULTICAST(sin->sin_addr.s_addr) && mopts != NULL) { 898 struct ifnet *ifp; 899 900 ifp = if_get(mopts->imo_ifidx); 901 if (ifp != NULL) { 902 if (ifp->if_rdomain == rtable_l2(rtableid)) 903 IFP_TO_IA(ifp, ia); 904 if (ia == NULL) { 905 if_put(ifp); 906 return (EADDRNOTAVAIL); 907 } 908 909 *insrc = &ia->ia_addr.sin_addr; 910 if_put(ifp); 911 return (0); 912 } 913 } 914 /* 915 * If route is known or can be allocated now, 916 * our src addr is taken from the i/f, else punt. 917 */ 918 if (!rtisvalid(ro->ro_rt) || (ro->ro_tableid != rtableid) || 919 (satosin(&ro->ro_dst)->sin_addr.s_addr != sin->sin_addr.s_addr)) { 920 rtfree(ro->ro_rt); 921 ro->ro_rt = NULL; 922 } 923 if (ro->ro_rt == NULL) { 924 /* No route yet, so try to acquire one */ 925 ro->ro_dst.sa_family = AF_INET; 926 ro->ro_dst.sa_len = sizeof(struct sockaddr_in); 927 satosin(&ro->ro_dst)->sin_addr = sin->sin_addr; 928 ro->ro_tableid = rtableid; 929 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, NULL, ro->ro_tableid); 930 931 /* 932 * It is important to zero out the rest of the 933 * struct sockaddr_in when mixing v6 & v4! 934 */ 935 sin2 = satosin(&ro->ro_dst); 936 memset(sin2->sin_zero, 0, sizeof(sin2->sin_zero)); 937 } 938 /* 939 * If we found a route, use the address 940 * corresponding to the outgoing interface. 941 */ 942 if (ro->ro_rt != NULL) 943 ia = ifatoia(ro->ro_rt->rt_ifa); 944 945 if (ia == NULL) 946 return (EADDRNOTAVAIL); 947 948 *insrc = &ia->ia_addr.sin_addr; 949 return (0); 950 } 951 952 void 953 in_pcbrehash(struct inpcb *inp) 954 { 955 struct inpcbtable *table = inp->inp_table; 956 struct inpcbhead *head; 957 958 NET_ASSERT_LOCKED(); 959 960 LIST_REMOVE(inp, inp_lhash); 961 head = in_pcblhash(table, inp->inp_rtableid, inp->inp_lport); 962 LIST_INSERT_HEAD(head, inp, inp_lhash); 963 LIST_REMOVE(inp, inp_hash); 964 #ifdef INET6 965 if (inp->inp_flags & INP_IPV6) 966 head = in6_pcbhash(table, rtable_l2(inp->inp_rtableid), 967 &inp->inp_faddr6, inp->inp_fport, 968 &inp->inp_laddr6, inp->inp_lport); 969 else 970 #endif /* INET6 */ 971 head = in_pcbhash(table, rtable_l2(inp->inp_rtableid), 972 &inp->inp_faddr, inp->inp_fport, 973 &inp->inp_laddr, inp->inp_lport); 974 LIST_INSERT_HEAD(head, inp, inp_hash); 975 } 976 977 int 978 in_pcbresize(struct inpcbtable *table, int hashsize) 979 { 980 u_long nmask, nlmask; 981 int osize; 982 void *nhashtbl, *nlhashtbl, *ohashtbl, *olhashtbl; 983 struct inpcb *inp; 984 985 ohashtbl = table->inpt_hashtbl; 986 olhashtbl = table->inpt_lhashtbl; 987 osize = table->inpt_size; 988 989 nhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nmask); 990 if (nhashtbl == NULL) 991 return ENOBUFS; 992 nlhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nlmask); 993 if (nlhashtbl == NULL) { 994 hashfree(nhashtbl, hashsize, M_PCB); 995 return ENOBUFS; 996 } 997 table->inpt_hashtbl = nhashtbl; 998 table->inpt_lhashtbl = nlhashtbl; 999 table->inpt_mask = nmask; 1000 table->inpt_lmask = nlmask; 1001 table->inpt_size = hashsize; 1002 arc4random_buf(&table->inpt_key, sizeof(table->inpt_key)); 1003 arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey)); 1004 1005 TAILQ_FOREACH(inp, &table->inpt_queue, inp_queue) { 1006 in_pcbrehash(inp); 1007 } 1008 hashfree(ohashtbl, osize, M_PCB); 1009 hashfree(olhashtbl, osize, M_PCB); 1010 1011 return (0); 1012 } 1013 1014 #ifdef DIAGNOSTIC 1015 int in_pcbnotifymiss = 0; 1016 #endif 1017 1018 /* 1019 * The in(6)_pcbhashlookup functions are used to locate connected sockets 1020 * quickly: 1021 * faddr.fport <-> laddr.lport 1022 * No wildcard matching is done so that listening sockets are not found. 1023 * If the functions return NULL in(6)_pcblookup_listen can be used to 1024 * find a listening/bound socket that may accept the connection. 1025 * After those two lookups no other are necessary. 1026 */ 1027 struct inpcb * 1028 in_pcbhashlookup(struct inpcbtable *table, struct in_addr faddr, 1029 u_int fport_arg, struct in_addr laddr, u_int lport_arg, u_int rtable) 1030 { 1031 struct inpcbhead *head; 1032 struct inpcb *inp; 1033 u_int16_t fport = fport_arg, lport = lport_arg; 1034 u_int rdomain; 1035 1036 rdomain = rtable_l2(rtable); 1037 head = in_pcbhash(table, rdomain, &faddr, fport, &laddr, lport); 1038 LIST_FOREACH(inp, head, inp_hash) { 1039 #ifdef INET6 1040 if (inp->inp_flags & INP_IPV6) 1041 continue; /*XXX*/ 1042 #endif 1043 if (inp->inp_faddr.s_addr == faddr.s_addr && 1044 inp->inp_fport == fport && inp->inp_lport == lport && 1045 inp->inp_laddr.s_addr == laddr.s_addr && 1046 rtable_l2(inp->inp_rtableid) == rdomain) { 1047 /* 1048 * Move this PCB to the head of hash chain so that 1049 * repeated accesses are quicker. This is analogous to 1050 * the historic single-entry PCB cache. 1051 */ 1052 if (inp != LIST_FIRST(head)) { 1053 LIST_REMOVE(inp, inp_hash); 1054 LIST_INSERT_HEAD(head, inp, inp_hash); 1055 } 1056 break; 1057 } 1058 } 1059 #ifdef DIAGNOSTIC 1060 if (inp == NULL && in_pcbnotifymiss) { 1061 printf("%s: faddr=%08x fport=%d laddr=%08x lport=%d rdom=%u\n", 1062 __func__, ntohl(faddr.s_addr), ntohs(fport), 1063 ntohl(laddr.s_addr), ntohs(lport), rdomain); 1064 } 1065 #endif 1066 return (inp); 1067 } 1068 1069 /* 1070 * The in(6)_pcblookup_listen functions are used to locate listening 1071 * sockets quickly. This are sockets with unspecified foreign address 1072 * and port: 1073 * *.* <-> laddr.lport 1074 * *.* <-> *.lport 1075 */ 1076 struct inpcb * 1077 in_pcblookup_listen(struct inpcbtable *table, struct in_addr laddr, 1078 u_int lport_arg, struct mbuf *m, u_int rtable) 1079 { 1080 struct inpcbhead *head; 1081 const struct in_addr *key1, *key2; 1082 struct inpcb *inp; 1083 u_int16_t lport = lport_arg; 1084 u_int rdomain; 1085 1086 key1 = &laddr; 1087 key2 = &zeroin_addr; 1088 #if NPF > 0 1089 if (m && m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) { 1090 struct pf_divert *divert; 1091 1092 divert = pf_find_divert(m); 1093 KASSERT(divert != NULL); 1094 switch (divert->type) { 1095 case PF_DIVERT_TO: 1096 key1 = key2 = &divert->addr.v4; 1097 lport = divert->port; 1098 break; 1099 case PF_DIVERT_REPLY: 1100 return (NULL); 1101 default: 1102 panic("%s: unknown divert type %d, mbuf %p, divert %p", 1103 __func__, divert->type, m, divert); 1104 } 1105 } else if (m && m->m_pkthdr.pf.flags & PF_TAG_TRANSLATE_LOCALHOST) { 1106 /* 1107 * Redirected connections should not be treated the same 1108 * as connections directed to 127.0.0.0/8 since localhost 1109 * can only be accessed from the host itself. 1110 * For example portmap(8) grants more permissions for 1111 * connections to the socket bound to 127.0.0.1 than 1112 * to the * socket. 1113 */ 1114 key1 = &zeroin_addr; 1115 key2 = &laddr; 1116 } 1117 #endif 1118 1119 rdomain = rtable_l2(rtable); 1120 head = in_pcbhash(table, rdomain, &zeroin_addr, 0, key1, lport); 1121 LIST_FOREACH(inp, head, inp_hash) { 1122 #ifdef INET6 1123 if (inp->inp_flags & INP_IPV6) 1124 continue; /*XXX*/ 1125 #endif 1126 if (inp->inp_lport == lport && inp->inp_fport == 0 && 1127 inp->inp_laddr.s_addr == key1->s_addr && 1128 inp->inp_faddr.s_addr == INADDR_ANY && 1129 rtable_l2(inp->inp_rtableid) == rdomain) 1130 break; 1131 } 1132 if (inp == NULL && key1->s_addr != key2->s_addr) { 1133 head = in_pcbhash(table, rdomain, 1134 &zeroin_addr, 0, key2, lport); 1135 LIST_FOREACH(inp, head, inp_hash) { 1136 #ifdef INET6 1137 if (inp->inp_flags & INP_IPV6) 1138 continue; /*XXX*/ 1139 #endif 1140 if (inp->inp_lport == lport && inp->inp_fport == 0 && 1141 inp->inp_laddr.s_addr == key2->s_addr && 1142 inp->inp_faddr.s_addr == INADDR_ANY && 1143 rtable_l2(inp->inp_rtableid) == rdomain) 1144 break; 1145 } 1146 } 1147 /* 1148 * Move this PCB to the head of hash chain so that 1149 * repeated accesses are quicker. This is analogous to 1150 * the historic single-entry PCB cache. 1151 */ 1152 if (inp != NULL && inp != LIST_FIRST(head)) { 1153 LIST_REMOVE(inp, inp_hash); 1154 LIST_INSERT_HEAD(head, inp, inp_hash); 1155 } 1156 #ifdef DIAGNOSTIC 1157 if (inp == NULL && in_pcbnotifymiss) { 1158 printf("%s: laddr=%08x lport=%d rdom=%u\n", 1159 __func__, ntohl(laddr.s_addr), ntohs(lport), rdomain); 1160 } 1161 #endif 1162 return (inp); 1163 } 1164