1 /* $OpenBSD: in_pcb.c,v 1.246 2018/09/20 18:59:10 bluhm Exp $ */ 2 /* $NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $ */ 3 4 /* 5 * Copyright (c) 1982, 1986, 1991, 1993 6 * The Regents of the University of California. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 * 32 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 33 * 34 * NRL grants permission for redistribution and use in source and binary 35 * forms, with or without modification, of the software and documentation 36 * created at NRL provided that the following conditions are met: 37 * 38 * 1. Redistributions of source code must retain the above copyright 39 * notice, this list of conditions and the following disclaimer. 40 * 2. Redistributions in binary form must reproduce the above copyright 41 * notice, this list of conditions and the following disclaimer in the 42 * documentation and/or other materials provided with the distribution. 43 * 3. All advertising materials mentioning features or use of this software 44 * must display the following acknowledgements: 45 * This product includes software developed by the University of 46 * California, Berkeley and its contributors. 47 * This product includes software developed at the Information 48 * Technology Division, US Naval Research Laboratory. 49 * 4. Neither the name of the NRL nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS 54 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 56 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR 57 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 58 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 59 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 60 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 61 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 62 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 63 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 64 * 65 * The views and conclusions contained in the software and documentation 66 * are those of the authors and should not be interpreted as representing 67 * official policies, either expressed or implied, of the US Naval 68 * Research Laboratory (NRL). 69 */ 70 71 #include "pf.h" 72 73 #include <sys/param.h> 74 #include <sys/systm.h> 75 #include <sys/mbuf.h> 76 #include <sys/protosw.h> 77 #include <sys/socket.h> 78 #include <sys/socketvar.h> 79 #include <sys/domain.h> 80 #include <sys/mount.h> 81 #include <sys/pool.h> 82 #include <sys/proc.h> 83 84 #include <net/if.h> 85 #include <net/if_var.h> 86 #include <net/pfvar.h> 87 #include <net/route.h> 88 89 #include <netinet/in.h> 90 #include <netinet/in_var.h> 91 #include <netinet/ip.h> 92 #include <netinet/ip_var.h> 93 #include <netinet/in_pcb.h> 94 #ifdef IPSEC 95 #include <netinet/ip_esp.h> 96 #endif /* IPSEC */ 97 98 const struct in_addr zeroin_addr; 99 100 union { 101 struct in_addr za_in; 102 struct in6_addr za_in6; 103 } zeroin46_addr; 104 105 /* 106 * These configure the range of local port addresses assigned to 107 * "unspecified" outgoing connections/packets/whatever. 108 */ 109 int ipport_firstauto = IPPORT_RESERVED; 110 int ipport_lastauto = IPPORT_USERRESERVED; 111 int ipport_hifirstauto = IPPORT_HIFIRSTAUTO; 112 int ipport_hilastauto = IPPORT_HILASTAUTO; 113 114 /* Protect PCB table queues, lookup hashes and existence of inpcb. */ 115 struct mutex inpcbtable_mtx = MUTEX_INITIALIZER(IPL_SOFTNET); 116 117 struct baddynamicports baddynamicports; 118 struct baddynamicports rootonlyports; 119 struct pool inpcb_pool; 120 int inpcb_pool_initialized = 0; 121 122 void in_pcbrehash_locked(struct inpcb *); 123 int in_pcbresize(struct inpcbtable *, int); 124 125 #define INPCBHASH_LOADFACTOR(_x) (((_x) * 3) / 4) 126 127 struct inpcbhead *in_pcbhash(struct inpcbtable *, int, 128 const struct in_addr *, u_short, const struct in_addr *, u_short); 129 struct inpcbhead *in_pcblhash(struct inpcbtable *, int, u_short); 130 131 struct inpcbhead * 132 in_pcbhash(struct inpcbtable *table, int rdom, 133 const struct in_addr *faddr, u_short fport, 134 const struct in_addr *laddr, u_short lport) 135 { 136 SIPHASH_CTX ctx; 137 u_int32_t nrdom = htonl(rdom); 138 139 SipHash24_Init(&ctx, &table->inpt_key); 140 SipHash24_Update(&ctx, &nrdom, sizeof(nrdom)); 141 SipHash24_Update(&ctx, faddr, sizeof(*faddr)); 142 SipHash24_Update(&ctx, &fport, sizeof(fport)); 143 SipHash24_Update(&ctx, laddr, sizeof(*laddr)); 144 SipHash24_Update(&ctx, &lport, sizeof(lport)); 145 146 return (&table->inpt_hashtbl[SipHash24_End(&ctx) & table->inpt_mask]); 147 } 148 149 struct inpcbhead * 150 in_pcblhash(struct inpcbtable *table, int rdom, u_short lport) 151 { 152 SIPHASH_CTX ctx; 153 u_int32_t nrdom = htonl(rdom); 154 155 SipHash24_Init(&ctx, &table->inpt_lkey); 156 SipHash24_Update(&ctx, &nrdom, sizeof(nrdom)); 157 SipHash24_Update(&ctx, &lport, sizeof(lport)); 158 159 return (&table->inpt_lhashtbl[SipHash24_End(&ctx) & table->inpt_lmask]); 160 } 161 162 void 163 in_pcbinit(struct inpcbtable *table, int hashsize) 164 { 165 166 mtx_enter(&inpcbtable_mtx); 167 TAILQ_INIT(&table->inpt_queue); 168 table->inpt_hashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, 169 &table->inpt_mask); 170 if (table->inpt_hashtbl == NULL) 171 panic("in_pcbinit: hashinit failed"); 172 table->inpt_lhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, 173 &table->inpt_lmask); 174 if (table->inpt_lhashtbl == NULL) 175 panic("in_pcbinit: hashinit failed for lport"); 176 table->inpt_count = 0; 177 table->inpt_size = hashsize; 178 arc4random_buf(&table->inpt_key, sizeof(table->inpt_key)); 179 arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey)); 180 mtx_leave(&inpcbtable_mtx); 181 } 182 183 /* 184 * Check if the specified port is invalid for dynamic allocation. 185 */ 186 int 187 in_baddynamic(u_int16_t port, u_int16_t proto) 188 { 189 switch (proto) { 190 case IPPROTO_TCP: 191 return (DP_ISSET(baddynamicports.tcp, port)); 192 case IPPROTO_UDP: 193 #ifdef IPSEC 194 /* Cannot preset this as it is a sysctl */ 195 if (port == udpencap_port) 196 return (1); 197 #endif 198 return (DP_ISSET(baddynamicports.udp, port)); 199 default: 200 return (0); 201 } 202 } 203 204 int 205 in_rootonly(u_int16_t port, u_int16_t proto) 206 { 207 switch (proto) { 208 case IPPROTO_TCP: 209 return (port < IPPORT_RESERVED || 210 DP_ISSET(rootonlyports.tcp, port)); 211 case IPPROTO_UDP: 212 return (port < IPPORT_RESERVED || 213 DP_ISSET(rootonlyports.udp, port)); 214 default: 215 return (0); 216 } 217 } 218 219 int 220 in_pcballoc(struct socket *so, struct inpcbtable *table) 221 { 222 struct inpcb *inp; 223 struct inpcbhead *head; 224 225 NET_ASSERT_LOCKED(); 226 227 if (inpcb_pool_initialized == 0) { 228 pool_init(&inpcb_pool, sizeof(struct inpcb), 0, 229 IPL_SOFTNET, 0, "inpcbpl", NULL); 230 inpcb_pool_initialized = 1; 231 } 232 inp = pool_get(&inpcb_pool, PR_NOWAIT|PR_ZERO); 233 if (inp == NULL) 234 return (ENOBUFS); 235 inp->inp_table = table; 236 inp->inp_socket = so; 237 refcnt_init(&inp->inp_refcnt); 238 inp->inp_seclevel[SL_AUTH] = IPSEC_AUTH_LEVEL_DEFAULT; 239 inp->inp_seclevel[SL_ESP_TRANS] = IPSEC_ESP_TRANS_LEVEL_DEFAULT; 240 inp->inp_seclevel[SL_ESP_NETWORK] = IPSEC_ESP_NETWORK_LEVEL_DEFAULT; 241 inp->inp_seclevel[SL_IPCOMP] = IPSEC_IPCOMP_LEVEL_DEFAULT; 242 inp->inp_rtableid = curproc->p_p->ps_rtableid; 243 inp->inp_hops = -1; 244 #ifdef INET6 245 /* 246 * Small change in this function to set the INP_IPV6 flag so routines 247 * outside pcb-specific routines don't need to use sotopf(), and all 248 * of its pointer chasing, later. 249 */ 250 if (sotopf(so) == PF_INET6) 251 inp->inp_flags = INP_IPV6; 252 inp->inp_cksum6 = -1; 253 #endif /* INET6 */ 254 255 mtx_enter(&inpcbtable_mtx); 256 if (table->inpt_count++ > INPCBHASH_LOADFACTOR(table->inpt_size)) 257 (void)in_pcbresize(table, table->inpt_size * 2); 258 TAILQ_INSERT_HEAD(&table->inpt_queue, inp, inp_queue); 259 head = in_pcblhash(table, inp->inp_rtableid, inp->inp_lport); 260 LIST_INSERT_HEAD(head, inp, inp_lhash); 261 #ifdef INET6 262 if (sotopf(so) == PF_INET6) 263 head = in6_pcbhash(table, rtable_l2(inp->inp_rtableid), 264 &inp->inp_faddr6, inp->inp_fport, 265 &inp->inp_laddr6, inp->inp_lport); 266 else 267 #endif /* INET6 */ 268 head = in_pcbhash(table, rtable_l2(inp->inp_rtableid), 269 &inp->inp_faddr, inp->inp_fport, 270 &inp->inp_laddr, inp->inp_lport); 271 LIST_INSERT_HEAD(head, inp, inp_hash); 272 mtx_leave(&inpcbtable_mtx); 273 274 so->so_pcb = inp; 275 276 return (0); 277 } 278 279 int 280 in_pcbbind(struct inpcb *inp, struct mbuf *nam, struct proc *p) 281 { 282 struct socket *so = inp->inp_socket; 283 u_int16_t lport = 0; 284 int wild = 0; 285 void *laddr = &zeroin46_addr; 286 int error; 287 288 if (inp->inp_lport) 289 return (EINVAL); 290 291 if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0 && 292 ((so->so_proto->pr_flags & PR_CONNREQUIRED) == 0 || 293 (so->so_options & SO_ACCEPTCONN) == 0)) 294 wild = INPLOOKUP_WILDCARD; 295 296 switch (sotopf(so)) { 297 #ifdef INET6 298 case PF_INET6: 299 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6)) 300 return (EINVAL); 301 wild |= INPLOOKUP_IPV6; 302 303 if (nam) { 304 struct sockaddr_in6 *sin6; 305 306 if ((error = in6_nam2sin6(nam, &sin6))) 307 return (error); 308 if ((error = in6_pcbaddrisavail(inp, sin6, wild, p))) 309 return (error); 310 laddr = &sin6->sin6_addr; 311 lport = sin6->sin6_port; 312 } 313 break; 314 #endif 315 case PF_INET: 316 if (inp->inp_laddr.s_addr != INADDR_ANY) 317 return (EINVAL); 318 319 if (nam) { 320 struct sockaddr_in *sin; 321 322 if ((error = in_nam2sin(nam, &sin))) 323 return (error); 324 if ((error = in_pcbaddrisavail(inp, sin, wild, p))) 325 return (error); 326 laddr = &sin->sin_addr; 327 lport = sin->sin_port; 328 } 329 break; 330 default: 331 return (EINVAL); 332 } 333 334 if (lport == 0) { 335 if ((error = in_pcbpickport(&lport, laddr, wild, inp, p))) 336 return (error); 337 } else { 338 if (in_rootonly(ntohs(lport), so->so_proto->pr_protocol) && 339 suser(p) != 0) 340 return (EACCES); 341 } 342 if (nam) { 343 switch (sotopf(so)) { 344 #ifdef INET6 345 case PF_INET6: 346 inp->inp_laddr6 = *(struct in6_addr *)laddr; 347 break; 348 #endif 349 case PF_INET: 350 inp->inp_laddr = *(struct in_addr *)laddr; 351 break; 352 } 353 } 354 inp->inp_lport = lport; 355 in_pcbrehash(inp); 356 return (0); 357 } 358 359 int 360 in_pcbaddrisavail(struct inpcb *inp, struct sockaddr_in *sin, int wild, 361 struct proc *p) 362 { 363 struct socket *so = inp->inp_socket; 364 struct inpcbtable *table = inp->inp_table; 365 u_int16_t lport = sin->sin_port; 366 int reuseport = (so->so_options & SO_REUSEPORT); 367 368 if (IN_MULTICAST(sin->sin_addr.s_addr)) { 369 /* 370 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast; 371 * allow complete duplication of binding if 372 * SO_REUSEPORT is set, or if SO_REUSEADDR is set 373 * and a multicast address is bound on both 374 * new and duplicated sockets. 375 */ 376 if (so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) 377 reuseport = SO_REUSEADDR|SO_REUSEPORT; 378 } else if (sin->sin_addr.s_addr != INADDR_ANY) { 379 /* 380 * we must check that we are binding to an address we 381 * own except when: 382 * - SO_BINDANY is set or 383 * - we are binding a UDP socket to 255.255.255.255 or 384 * - we are binding a UDP socket to one of our broadcast 385 * addresses 386 */ 387 if (!ISSET(so->so_options, SO_BINDANY) && 388 !(so->so_type == SOCK_DGRAM && 389 sin->sin_addr.s_addr == INADDR_BROADCAST) && 390 !(so->so_type == SOCK_DGRAM && 391 in_broadcast(sin->sin_addr, inp->inp_rtableid))) { 392 struct ifaddr *ia; 393 394 sin->sin_port = 0; 395 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 396 ia = ifa_ifwithaddr(sintosa(sin), inp->inp_rtableid); 397 sin->sin_port = lport; 398 399 if (ia == NULL) 400 return (EADDRNOTAVAIL); 401 } 402 } 403 if (lport) { 404 struct inpcb *t; 405 406 if (so->so_euid) { 407 t = in_pcblookup_local(table, &sin->sin_addr, lport, 408 INPLOOKUP_WILDCARD, inp->inp_rtableid); 409 if (t && (so->so_euid != t->inp_socket->so_euid)) 410 return (EADDRINUSE); 411 } 412 t = in_pcblookup_local(table, &sin->sin_addr, lport, 413 wild, inp->inp_rtableid); 414 if (t && (reuseport & t->inp_socket->so_options) == 0) 415 return (EADDRINUSE); 416 } 417 418 return (0); 419 } 420 421 int 422 in_pcbpickport(u_int16_t *lport, void *laddr, int wild, struct inpcb *inp, 423 struct proc *p) 424 { 425 struct socket *so = inp->inp_socket; 426 struct inpcbtable *table = inp->inp_table; 427 u_int16_t first, last, lower, higher, candidate, localport; 428 int count; 429 430 if (inp->inp_flags & INP_HIGHPORT) { 431 first = ipport_hifirstauto; /* sysctl */ 432 last = ipport_hilastauto; 433 } else if (inp->inp_flags & INP_LOWPORT) { 434 if (suser(p)) 435 return (EACCES); 436 first = IPPORT_RESERVED-1; /* 1023 */ 437 last = 600; /* not IPPORT_RESERVED/2 */ 438 } else { 439 first = ipport_firstauto; /* sysctl */ 440 last = ipport_lastauto; 441 } 442 if (first < last) { 443 lower = first; 444 higher = last; 445 } else { 446 lower = last; 447 higher = first; 448 } 449 450 /* 451 * Simple check to ensure all ports are not used up causing 452 * a deadlock here. 453 */ 454 455 count = higher - lower; 456 candidate = lower + arc4random_uniform(count); 457 458 do { 459 if (count-- < 0) /* completely used? */ 460 return (EADDRNOTAVAIL); 461 ++candidate; 462 if (candidate < lower || candidate > higher) 463 candidate = lower; 464 localport = htons(candidate); 465 } while (in_baddynamic(candidate, so->so_proto->pr_protocol) || 466 in_pcblookup_local(table, laddr, localport, wild, 467 inp->inp_rtableid)); 468 *lport = localport; 469 470 return (0); 471 } 472 473 /* 474 * Connect from a socket to a specified address. 475 * Both address and port must be specified in argument sin. 476 * If don't have a local address for this socket yet, 477 * then pick one. 478 */ 479 int 480 in_pcbconnect(struct inpcb *inp, struct mbuf *nam) 481 { 482 struct in_addr *ina = NULL; 483 struct sockaddr_in *sin; 484 int error; 485 486 #ifdef INET6 487 if (sotopf(inp->inp_socket) == PF_INET6) 488 return (in6_pcbconnect(inp, nam)); 489 KASSERT((inp->inp_flags & INP_IPV6) == 0); 490 #endif /* INET6 */ 491 492 if ((error = in_nam2sin(nam, &sin))) 493 return (error); 494 if (sin->sin_port == 0) 495 return (EADDRNOTAVAIL); 496 error = in_pcbselsrc(&ina, sin, inp); 497 if (error) 498 return (error); 499 500 if (in_pcbhashlookup(inp->inp_table, sin->sin_addr, sin->sin_port, 501 *ina, inp->inp_lport, inp->inp_rtableid) != NULL) 502 return (EADDRINUSE); 503 504 KASSERT(inp->inp_laddr.s_addr == INADDR_ANY || inp->inp_lport); 505 506 if (inp->inp_laddr.s_addr == INADDR_ANY) { 507 if (inp->inp_lport == 0) { 508 error = in_pcbbind(inp, NULL, curproc); 509 if (error) 510 return (error); 511 if (in_pcbhashlookup(inp->inp_table, sin->sin_addr, 512 sin->sin_port, *ina, inp->inp_lport, 513 inp->inp_rtableid) != NULL) { 514 inp->inp_lport = 0; 515 return (EADDRINUSE); 516 } 517 } 518 inp->inp_laddr = *ina; 519 } 520 inp->inp_faddr = sin->sin_addr; 521 inp->inp_fport = sin->sin_port; 522 in_pcbrehash(inp); 523 #ifdef IPSEC 524 { 525 /* Cause an IPsec SA to be established. */ 526 /* error is just ignored */ 527 ipsp_spd_inp(NULL, AF_INET, 0, &error, IPSP_DIRECTION_OUT, 528 NULL, inp, NULL); 529 } 530 #endif 531 return (0); 532 } 533 534 void 535 in_pcbdisconnect(struct inpcb *inp) 536 { 537 switch (sotopf(inp->inp_socket)) { 538 #ifdef INET6 539 case PF_INET6: 540 inp->inp_faddr6 = in6addr_any; 541 break; 542 #endif 543 case PF_INET: 544 inp->inp_faddr.s_addr = INADDR_ANY; 545 break; 546 } 547 548 inp->inp_fport = 0; 549 in_pcbrehash(inp); 550 if (inp->inp_socket->so_state & SS_NOFDREF) 551 in_pcbdetach(inp); 552 } 553 554 void 555 in_pcbdetach(struct inpcb *inp) 556 { 557 struct socket *so; 558 559 NET_ASSERT_LOCKED(); 560 561 mtx_enter(&inp->inp_mtx); 562 so = inp->inp_socket; 563 inp->inp_socket = NULL; 564 mtx_leave(&inp->inp_mtx); 565 566 so->so_pcb = NULL; 567 /* 568 * As long as the NET_LOCK() is the default lock for Internet 569 * sockets, do not release it to not introduce new sleeping 570 * points. 571 */ 572 sofree(so, SL_NOUNLOCK); 573 m_freem(inp->inp_options); 574 if (inp->inp_route.ro_rt) { 575 rtfree(inp->inp_route.ro_rt); 576 inp->inp_route.ro_rt = NULL; 577 } 578 #ifdef INET6 579 if (inp->inp_flags & INP_IPV6) { 580 ip6_freepcbopts(inp->inp_outputopts6); 581 ip6_freemoptions(inp->inp_moptions6); 582 } else 583 #endif 584 ip_freemoptions(inp->inp_moptions); 585 #if NPF > 0 586 if (inp->inp_pf_sk) { 587 pf_remove_divert_state(inp->inp_pf_sk); 588 /* pf_remove_divert_state() may have detached the state */ 589 pf_inp_unlink(inp); 590 } 591 #endif 592 mtx_enter(&inpcbtable_mtx); 593 LIST_REMOVE(inp, inp_lhash); 594 LIST_REMOVE(inp, inp_hash); 595 TAILQ_REMOVE(&inp->inp_table->inpt_queue, inp, inp_queue); 596 inp->inp_table->inpt_count--; 597 mtx_leave(&inpcbtable_mtx); 598 in_pcbunref(inp); 599 } 600 601 struct inpcb * 602 in_pcbref(struct inpcb *inp) 603 { 604 if (inp != NULL) 605 refcnt_take(&inp->inp_refcnt); 606 return inp; 607 } 608 609 void 610 in_pcbunref(struct inpcb *inp) 611 { 612 if (refcnt_rele(&inp->inp_refcnt)) { 613 KASSERT(inp->inp_socket == NULL); 614 KASSERT((LIST_NEXT(inp, inp_hash) == NULL) || 615 (LIST_NEXT(inp, inp_hash) == _Q_INVALID)); 616 KASSERT((LIST_NEXT(inp, inp_lhash) == NULL) || 617 (LIST_NEXT(inp, inp_lhash) == _Q_INVALID)); 618 KASSERT((TAILQ_NEXT(inp, inp_queue) == NULL) || 619 (TAILQ_NEXT(inp, inp_queue) == _Q_INVALID)); 620 pool_put(&inpcb_pool, inp); 621 } 622 } 623 624 void 625 in_setsockaddr(struct inpcb *inp, struct mbuf *nam) 626 { 627 struct sockaddr_in *sin; 628 629 nam->m_len = sizeof(*sin); 630 sin = mtod(nam, struct sockaddr_in *); 631 memset(sin, 0, sizeof(*sin)); 632 sin->sin_family = AF_INET; 633 sin->sin_len = sizeof(*sin); 634 sin->sin_port = inp->inp_lport; 635 sin->sin_addr = inp->inp_laddr; 636 } 637 638 void 639 in_setpeeraddr(struct inpcb *inp, struct mbuf *nam) 640 { 641 struct sockaddr_in *sin; 642 643 #ifdef INET6 644 if (sotopf(inp->inp_socket) == PF_INET6) { 645 in6_setpeeraddr(inp, nam); 646 return; 647 } 648 #endif /* INET6 */ 649 650 nam->m_len = sizeof(*sin); 651 sin = mtod(nam, struct sockaddr_in *); 652 memset(sin, 0, sizeof(*sin)); 653 sin->sin_family = AF_INET; 654 sin->sin_len = sizeof(*sin); 655 sin->sin_port = inp->inp_fport; 656 sin->sin_addr = inp->inp_faddr; 657 } 658 659 /* 660 * Pass some notification to all connections of a protocol 661 * associated with address dst. The "usual action" will be 662 * taken, depending on the ctlinput cmd. The caller must filter any 663 * cmds that are uninteresting (e.g., no error in the map). 664 * Call the protocol specific routine (if any) to report 665 * any errors for each matching socket. 666 */ 667 void 668 in_pcbnotifyall(struct inpcbtable *table, struct sockaddr *dst, u_int rtable, 669 int errno, void (*notify)(struct inpcb *, int)) 670 { 671 struct inpcb *inp, *ninp; 672 struct in_addr faddr; 673 u_int rdomain; 674 675 NET_ASSERT_LOCKED(); 676 677 #ifdef INET6 678 /* 679 * See in6_pcbnotify() for IPv6 codepath. By the time this 680 * gets called, the addresses passed are either definitely IPv4 or 681 * IPv6; *_pcbnotify() never gets called with v4-mapped v6 addresses. 682 */ 683 #endif /* INET6 */ 684 685 if (dst->sa_family != AF_INET) 686 return; 687 faddr = satosin(dst)->sin_addr; 688 if (faddr.s_addr == INADDR_ANY) 689 return; 690 691 rdomain = rtable_l2(rtable); 692 KERNEL_LOCK(); 693 mtx_enter(&inpcbtable_mtx); 694 TAILQ_FOREACH_SAFE(inp, &table->inpt_queue, inp_queue, ninp) { 695 #ifdef INET6 696 if (inp->inp_flags & INP_IPV6) 697 continue; 698 #endif 699 if (inp->inp_faddr.s_addr != faddr.s_addr || 700 rtable_l2(inp->inp_rtableid) != rdomain || 701 inp->inp_socket == NULL) { 702 continue; 703 } 704 /* 705 * The notify functions may grab the kernel lock. Sometimes 706 * we already hold the kernel lock when we acquire the pcb 707 * mutex. So do an extra kernel lock before the mutex outside 708 * of this loop. XXXSMP 709 */ 710 if (notify) 711 (*notify)(inp, errno); 712 } 713 mtx_leave(&inpcbtable_mtx); 714 KERNEL_UNLOCK(); 715 } 716 717 /* 718 * Check for alternatives when higher level complains 719 * about service problems. For now, invalidate cached 720 * routing information. If the route was created dynamically 721 * (by a redirect), time to try a default gateway again. 722 */ 723 void 724 in_losing(struct inpcb *inp) 725 { 726 struct rtentry *rt = inp->inp_route.ro_rt; 727 728 if (rt) { 729 inp->inp_route.ro_rt = NULL; 730 731 if (rt->rt_flags & RTF_DYNAMIC) { 732 struct ifnet *ifp; 733 734 ifp = if_get(rt->rt_ifidx); 735 /* 736 * If the interface is gone, all its attached 737 * route entries have been removed from the table, 738 * so we're dealing with a stale cache and have 739 * nothing to do. 740 */ 741 if (ifp != NULL) 742 rtdeletemsg(rt, ifp, inp->inp_rtableid); 743 if_put(ifp); 744 } 745 /* 746 * A new route can be allocated 747 * the next time output is attempted. 748 * rtfree() needs to be called in anycase because the inp 749 * is still holding a reference to rt. 750 */ 751 rtfree(rt); 752 } 753 } 754 755 /* 756 * After a routing change, flush old routing 757 * and allocate a (hopefully) better one. 758 */ 759 void 760 in_rtchange(struct inpcb *inp, int errno) 761 { 762 if (inp->inp_route.ro_rt) { 763 rtfree(inp->inp_route.ro_rt); 764 inp->inp_route.ro_rt = 0; 765 /* 766 * A new route can be allocated the next time 767 * output is attempted. 768 */ 769 } 770 } 771 772 struct inpcb * 773 in_pcblookup_local(struct inpcbtable *table, void *laddrp, u_int lport_arg, 774 int flags, u_int rtable) 775 { 776 struct inpcb *inp, *match = NULL; 777 int matchwild = 3, wildcard; 778 u_int16_t lport = lport_arg; 779 struct in_addr laddr = *(struct in_addr *)laddrp; 780 #ifdef INET6 781 struct in6_addr *laddr6 = (struct in6_addr *)laddrp; 782 #endif 783 struct inpcbhead *head; 784 u_int rdomain; 785 786 rdomain = rtable_l2(rtable); 787 mtx_enter(&inpcbtable_mtx); 788 head = in_pcblhash(table, rdomain, lport); 789 LIST_FOREACH(inp, head, inp_lhash) { 790 if (rtable_l2(inp->inp_rtableid) != rdomain) 791 continue; 792 if (inp->inp_lport != lport) 793 continue; 794 wildcard = 0; 795 #ifdef INET6 796 if (ISSET(flags, INPLOOKUP_IPV6)) { 797 if (!ISSET(inp->inp_flags, INP_IPV6)) 798 continue; 799 800 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6)) 801 wildcard++; 802 803 if (!IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6, laddr6)) { 804 if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6) || 805 IN6_IS_ADDR_UNSPECIFIED(laddr6)) 806 wildcard++; 807 else 808 continue; 809 } 810 811 } else 812 #endif /* INET6 */ 813 { 814 #ifdef INET6 815 if (ISSET(inp->inp_flags, INP_IPV6)) 816 continue; 817 #endif /* INET6 */ 818 819 if (inp->inp_faddr.s_addr != INADDR_ANY) 820 wildcard++; 821 822 if (inp->inp_laddr.s_addr != laddr.s_addr) { 823 if (inp->inp_laddr.s_addr == INADDR_ANY || 824 laddr.s_addr == INADDR_ANY) 825 wildcard++; 826 else 827 continue; 828 } 829 830 } 831 if ((!wildcard || (flags & INPLOOKUP_WILDCARD)) && 832 wildcard < matchwild) { 833 match = inp; 834 if ((matchwild = wildcard) == 0) 835 break; 836 } 837 } 838 mtx_leave(&inpcbtable_mtx); 839 840 return (match); 841 } 842 843 struct rtentry * 844 in_pcbrtentry(struct inpcb *inp) 845 { 846 struct route *ro; 847 848 ro = &inp->inp_route; 849 850 /* check if route is still valid */ 851 if (!rtisvalid(ro->ro_rt)) { 852 rtfree(ro->ro_rt); 853 ro->ro_rt = NULL; 854 } 855 856 /* 857 * No route yet, so try to acquire one. 858 */ 859 if (ro->ro_rt == NULL) { 860 #ifdef INET6 861 memset(ro, 0, sizeof(struct route_in6)); 862 #else 863 memset(ro, 0, sizeof(struct route)); 864 #endif 865 866 switch(sotopf(inp->inp_socket)) { 867 #ifdef INET6 868 case PF_INET6: 869 if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6)) 870 break; 871 ro->ro_dst.sa_family = AF_INET6; 872 ro->ro_dst.sa_len = sizeof(struct sockaddr_in6); 873 satosin6(&ro->ro_dst)->sin6_addr = inp->inp_faddr6; 874 ro->ro_tableid = inp->inp_rtableid; 875 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, 876 &inp->inp_laddr6.s6_addr32[0], ro->ro_tableid); 877 break; 878 #endif /* INET6 */ 879 case PF_INET: 880 if (inp->inp_faddr.s_addr == INADDR_ANY) 881 break; 882 ro->ro_dst.sa_family = AF_INET; 883 ro->ro_dst.sa_len = sizeof(struct sockaddr_in); 884 satosin(&ro->ro_dst)->sin_addr = inp->inp_faddr; 885 ro->ro_tableid = inp->inp_rtableid; 886 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, 887 &inp->inp_laddr.s_addr, ro->ro_tableid); 888 break; 889 } 890 } 891 return (ro->ro_rt); 892 } 893 894 /* 895 * Return an IPv4 address, which is the most appropriate for a given 896 * destination. 897 * If necessary, this function lookups the routing table and returns 898 * an entry to the caller for later use. 899 */ 900 int 901 in_pcbselsrc(struct in_addr **insrc, struct sockaddr_in *sin, 902 struct inpcb *inp) 903 { 904 struct ip_moptions *mopts = inp->inp_moptions; 905 struct route *ro = &inp->inp_route; 906 struct in_addr *laddr = &inp->inp_laddr; 907 u_int rtableid = inp->inp_rtableid; 908 909 struct sockaddr_in *sin2; 910 struct in_ifaddr *ia = NULL; 911 912 /* 913 * If the socket(if any) is already bound, use that bound address 914 * unless it is INADDR_ANY or INADDR_BROADCAST. 915 */ 916 if (laddr && laddr->s_addr != INADDR_ANY && 917 laddr->s_addr != INADDR_BROADCAST) { 918 *insrc = laddr; 919 return (0); 920 } 921 922 /* 923 * If the destination address is multicast and an outgoing 924 * interface has been set as a multicast option, use the 925 * address of that interface as our source address. 926 */ 927 if (IN_MULTICAST(sin->sin_addr.s_addr) && mopts != NULL) { 928 struct ifnet *ifp; 929 930 ifp = if_get(mopts->imo_ifidx); 931 if (ifp != NULL) { 932 if (ifp->if_rdomain == rtable_l2(rtableid)) 933 IFP_TO_IA(ifp, ia); 934 if (ia == NULL) { 935 if_put(ifp); 936 return (EADDRNOTAVAIL); 937 } 938 939 *insrc = &ia->ia_addr.sin_addr; 940 if_put(ifp); 941 return (0); 942 } 943 } 944 /* 945 * If route is known or can be allocated now, 946 * our src addr is taken from the i/f, else punt. 947 */ 948 if (!rtisvalid(ro->ro_rt) || (ro->ro_tableid != rtableid) || 949 (satosin(&ro->ro_dst)->sin_addr.s_addr != sin->sin_addr.s_addr)) { 950 rtfree(ro->ro_rt); 951 ro->ro_rt = NULL; 952 } 953 if (ro->ro_rt == NULL) { 954 /* No route yet, so try to acquire one */ 955 ro->ro_dst.sa_family = AF_INET; 956 ro->ro_dst.sa_len = sizeof(struct sockaddr_in); 957 satosin(&ro->ro_dst)->sin_addr = sin->sin_addr; 958 ro->ro_tableid = rtableid; 959 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, NULL, ro->ro_tableid); 960 961 /* 962 * It is important to zero out the rest of the 963 * struct sockaddr_in when mixing v6 & v4! 964 */ 965 sin2 = satosin(&ro->ro_dst); 966 memset(sin2->sin_zero, 0, sizeof(sin2->sin_zero)); 967 } 968 /* 969 * If we found a route, use the address 970 * corresponding to the outgoing interface. 971 */ 972 if (ro->ro_rt != NULL) 973 ia = ifatoia(ro->ro_rt->rt_ifa); 974 975 if (ia == NULL) 976 return (EADDRNOTAVAIL); 977 978 *insrc = &ia->ia_addr.sin_addr; 979 return (0); 980 } 981 982 void 983 in_pcbrehash(struct inpcb *inp) 984 { 985 mtx_enter(&inpcbtable_mtx); 986 in_pcbrehash_locked(inp); 987 mtx_leave(&inpcbtable_mtx); 988 } 989 990 void 991 in_pcbrehash_locked(struct inpcb *inp) 992 { 993 struct inpcbtable *table = inp->inp_table; 994 struct inpcbhead *head; 995 996 NET_ASSERT_LOCKED(); 997 MUTEX_ASSERT_LOCKED(&inpcbtable_mtx); 998 999 LIST_REMOVE(inp, inp_lhash); 1000 head = in_pcblhash(table, inp->inp_rtableid, inp->inp_lport); 1001 LIST_INSERT_HEAD(head, inp, inp_lhash); 1002 LIST_REMOVE(inp, inp_hash); 1003 #ifdef INET6 1004 if (inp->inp_flags & INP_IPV6) 1005 head = in6_pcbhash(table, rtable_l2(inp->inp_rtableid), 1006 &inp->inp_faddr6, inp->inp_fport, 1007 &inp->inp_laddr6, inp->inp_lport); 1008 else 1009 #endif /* INET6 */ 1010 head = in_pcbhash(table, rtable_l2(inp->inp_rtableid), 1011 &inp->inp_faddr, inp->inp_fport, 1012 &inp->inp_laddr, inp->inp_lport); 1013 LIST_INSERT_HEAD(head, inp, inp_hash); 1014 } 1015 1016 int 1017 in_pcbresize(struct inpcbtable *table, int hashsize) 1018 { 1019 u_long nmask, nlmask; 1020 int osize; 1021 void *nhashtbl, *nlhashtbl, *ohashtbl, *olhashtbl; 1022 struct inpcb *inp; 1023 1024 MUTEX_ASSERT_LOCKED(&inpcbtable_mtx); 1025 1026 ohashtbl = table->inpt_hashtbl; 1027 olhashtbl = table->inpt_lhashtbl; 1028 osize = table->inpt_size; 1029 1030 nhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nmask); 1031 if (nhashtbl == NULL) 1032 return ENOBUFS; 1033 nlhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nlmask); 1034 if (nlhashtbl == NULL) { 1035 hashfree(nhashtbl, hashsize, M_PCB); 1036 return ENOBUFS; 1037 } 1038 table->inpt_hashtbl = nhashtbl; 1039 table->inpt_lhashtbl = nlhashtbl; 1040 table->inpt_mask = nmask; 1041 table->inpt_lmask = nlmask; 1042 table->inpt_size = hashsize; 1043 arc4random_buf(&table->inpt_key, sizeof(table->inpt_key)); 1044 arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey)); 1045 1046 TAILQ_FOREACH(inp, &table->inpt_queue, inp_queue) { 1047 in_pcbrehash_locked(inp); 1048 } 1049 hashfree(ohashtbl, osize, M_PCB); 1050 hashfree(olhashtbl, osize, M_PCB); 1051 1052 return (0); 1053 } 1054 1055 #ifdef DIAGNOSTIC 1056 int in_pcbnotifymiss = 0; 1057 #endif 1058 1059 /* 1060 * The in(6)_pcbhashlookup functions are used to locate connected sockets 1061 * quickly: 1062 * faddr.fport <-> laddr.lport 1063 * No wildcard matching is done so that listening sockets are not found. 1064 * If the functions return NULL in(6)_pcblookup_listen can be used to 1065 * find a listening/bound socket that may accept the connection. 1066 * After those two lookups no other are necessary. 1067 */ 1068 struct inpcb * 1069 in_pcbhashlookup(struct inpcbtable *table, struct in_addr faddr, 1070 u_int fport_arg, struct in_addr laddr, u_int lport_arg, u_int rtable) 1071 { 1072 struct inpcbhead *head; 1073 struct inpcb *inp; 1074 u_int16_t fport = fport_arg, lport = lport_arg; 1075 u_int rdomain; 1076 1077 rdomain = rtable_l2(rtable); 1078 mtx_enter(&inpcbtable_mtx); 1079 head = in_pcbhash(table, rdomain, &faddr, fport, &laddr, lport); 1080 LIST_FOREACH(inp, head, inp_hash) { 1081 #ifdef INET6 1082 if (inp->inp_flags & INP_IPV6) 1083 continue; /*XXX*/ 1084 #endif 1085 if (inp->inp_faddr.s_addr == faddr.s_addr && 1086 inp->inp_fport == fport && inp->inp_lport == lport && 1087 inp->inp_laddr.s_addr == laddr.s_addr && 1088 rtable_l2(inp->inp_rtableid) == rdomain) { 1089 /* 1090 * Move this PCB to the head of hash chain so that 1091 * repeated accesses are quicker. This is analogous to 1092 * the historic single-entry PCB cache. 1093 */ 1094 if (inp != LIST_FIRST(head)) { 1095 LIST_REMOVE(inp, inp_hash); 1096 LIST_INSERT_HEAD(head, inp, inp_hash); 1097 } 1098 break; 1099 } 1100 } 1101 mtx_leave(&inpcbtable_mtx); 1102 #ifdef DIAGNOSTIC 1103 if (inp == NULL && in_pcbnotifymiss) { 1104 printf("%s: faddr=%08x fport=%d laddr=%08x lport=%d rdom=%u\n", 1105 __func__, ntohl(faddr.s_addr), ntohs(fport), 1106 ntohl(laddr.s_addr), ntohs(lport), rdomain); 1107 } 1108 #endif 1109 return (inp); 1110 } 1111 1112 /* 1113 * The in(6)_pcblookup_listen functions are used to locate listening 1114 * sockets quickly. This are sockets with unspecified foreign address 1115 * and port: 1116 * *.* <-> laddr.lport 1117 * *.* <-> *.lport 1118 */ 1119 struct inpcb * 1120 in_pcblookup_listen(struct inpcbtable *table, struct in_addr laddr, 1121 u_int lport_arg, struct mbuf *m, u_int rtable) 1122 { 1123 struct inpcbhead *head; 1124 const struct in_addr *key1, *key2; 1125 struct inpcb *inp; 1126 u_int16_t lport = lport_arg; 1127 u_int rdomain; 1128 1129 key1 = &laddr; 1130 key2 = &zeroin_addr; 1131 #if NPF > 0 1132 if (m && m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) { 1133 struct pf_divert *divert; 1134 1135 divert = pf_find_divert(m); 1136 KASSERT(divert != NULL); 1137 switch (divert->type) { 1138 case PF_DIVERT_TO: 1139 key1 = key2 = &divert->addr.v4; 1140 lport = divert->port; 1141 break; 1142 case PF_DIVERT_REPLY: 1143 return (NULL); 1144 default: 1145 panic("%s: unknown divert type %d, mbuf %p, divert %p", 1146 __func__, divert->type, m, divert); 1147 } 1148 } else if (m && m->m_pkthdr.pf.flags & PF_TAG_TRANSLATE_LOCALHOST) { 1149 /* 1150 * Redirected connections should not be treated the same 1151 * as connections directed to 127.0.0.0/8 since localhost 1152 * can only be accessed from the host itself. 1153 * For example portmap(8) grants more permissions for 1154 * connections to the socket bound to 127.0.0.1 than 1155 * to the * socket. 1156 */ 1157 key1 = &zeroin_addr; 1158 key2 = &laddr; 1159 } 1160 #endif 1161 1162 rdomain = rtable_l2(rtable); 1163 mtx_enter(&inpcbtable_mtx); 1164 head = in_pcbhash(table, rdomain, &zeroin_addr, 0, key1, lport); 1165 LIST_FOREACH(inp, head, inp_hash) { 1166 #ifdef INET6 1167 if (inp->inp_flags & INP_IPV6) 1168 continue; /*XXX*/ 1169 #endif 1170 if (inp->inp_lport == lport && inp->inp_fport == 0 && 1171 inp->inp_laddr.s_addr == key1->s_addr && 1172 inp->inp_faddr.s_addr == INADDR_ANY && 1173 rtable_l2(inp->inp_rtableid) == rdomain) 1174 break; 1175 } 1176 if (inp == NULL && key1->s_addr != key2->s_addr) { 1177 head = in_pcbhash(table, rdomain, 1178 &zeroin_addr, 0, key2, lport); 1179 LIST_FOREACH(inp, head, inp_hash) { 1180 #ifdef INET6 1181 if (inp->inp_flags & INP_IPV6) 1182 continue; /*XXX*/ 1183 #endif 1184 if (inp->inp_lport == lport && inp->inp_fport == 0 && 1185 inp->inp_laddr.s_addr == key2->s_addr && 1186 inp->inp_faddr.s_addr == INADDR_ANY && 1187 rtable_l2(inp->inp_rtableid) == rdomain) 1188 break; 1189 } 1190 } 1191 /* 1192 * Move this PCB to the head of hash chain so that 1193 * repeated accesses are quicker. This is analogous to 1194 * the historic single-entry PCB cache. 1195 */ 1196 if (inp != NULL && inp != LIST_FIRST(head)) { 1197 LIST_REMOVE(inp, inp_hash); 1198 LIST_INSERT_HEAD(head, inp, inp_hash); 1199 } 1200 mtx_leave(&inpcbtable_mtx); 1201 #ifdef DIAGNOSTIC 1202 if (inp == NULL && in_pcbnotifymiss) { 1203 printf("%s: laddr=%08x lport=%d rdom=%u\n", 1204 __func__, ntohl(laddr.s_addr), ntohs(lport), rdomain); 1205 } 1206 #endif 1207 return (inp); 1208 } 1209