xref: /openbsd-src/sys/netinet/in_pcb.c (revision d89ec533011f513df1010f142a111086a0785f09)
1 /*	$OpenBSD: in_pcb.c,v 1.256 2021/10/25 22:20:47 bluhm Exp $	*/
2 /*	$NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $	*/
3 
4 /*
5  * Copyright (c) 1982, 1986, 1991, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	@(#)COPYRIGHT	1.1 (NRL) 17 January 1995
33  *
34  * NRL grants permission for redistribution and use in source and binary
35  * forms, with or without modification, of the software and documentation
36  * created at NRL provided that the following conditions are met:
37  *
38  * 1. Redistributions of source code must retain the above copyright
39  *    notice, this list of conditions and the following disclaimer.
40  * 2. Redistributions in binary form must reproduce the above copyright
41  *    notice, this list of conditions and the following disclaimer in the
42  *    documentation and/or other materials provided with the distribution.
43  * 3. All advertising materials mentioning features or use of this software
44  *    must display the following acknowledgements:
45  *	This product includes software developed by the University of
46  *	California, Berkeley and its contributors.
47  *	This product includes software developed at the Information
48  *	Technology Division, US Naval Research Laboratory.
49  * 4. Neither the name of the NRL nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
54  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
55  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
56  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
57  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
58  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
59  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
60  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
61  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
62  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
63  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
64  *
65  * The views and conclusions contained in the software and documentation
66  * are those of the authors and should not be interpreted as representing
67  * official policies, either expressed or implied, of the US Naval
68  * Research Laboratory (NRL).
69  */
70 
71 #include "pf.h"
72 
73 #include <sys/param.h>
74 #include <sys/systm.h>
75 #include <sys/mbuf.h>
76 #include <sys/protosw.h>
77 #include <sys/socket.h>
78 #include <sys/socketvar.h>
79 #include <sys/domain.h>
80 #include <sys/mount.h>
81 #include <sys/pool.h>
82 #include <sys/proc.h>
83 
84 #include <net/if.h>
85 #include <net/if_var.h>
86 #include <net/pfvar.h>
87 #include <net/route.h>
88 
89 #include <netinet/in.h>
90 #include <netinet/in_var.h>
91 #include <netinet/ip.h>
92 #include <netinet/ip_var.h>
93 #include <netinet/in_pcb.h>
94 #ifdef IPSEC
95 #include <netinet/ip_esp.h>
96 #endif /* IPSEC */
97 
98 #include "stoeplitz.h"
99 #if NSTOEPLITZ > 0
100 #include <net/toeplitz.h>
101 #endif
102 
103 const struct in_addr zeroin_addr;
104 
105 union {
106 	struct in_addr	za_in;
107 	struct in6_addr	za_in6;
108 } zeroin46_addr;
109 
110 /*
111  * These configure the range of local port addresses assigned to
112  * "unspecified" outgoing connections/packets/whatever.
113  */
114 int ipport_firstauto = IPPORT_RESERVED;
115 int ipport_lastauto = IPPORT_USERRESERVED;
116 int ipport_hifirstauto = IPPORT_HIFIRSTAUTO;
117 int ipport_hilastauto = IPPORT_HILASTAUTO;
118 
119 struct baddynamicports baddynamicports;
120 struct baddynamicports rootonlyports;
121 struct pool inpcb_pool;
122 
123 int in_pcbresize (struct inpcbtable *, int);
124 
125 #define	INPCBHASH_LOADFACTOR(_x)	(((_x) * 3) / 4)
126 
127 struct inpcbhead *in_pcbhash(struct inpcbtable *, int,
128     const struct in_addr *, u_short, const struct in_addr *, u_short);
129 struct inpcbhead *in_pcblhash(struct inpcbtable *, int, u_short);
130 
131 /*
132  * in_pcb is used for inet and inet6.  in6_pcb only contains special
133  * IPv6 cases.  So the internet initializer is used for both domains.
134  */
135 void
136 in_init(void)
137 {
138 	pool_init(&inpcb_pool, sizeof(struct inpcb), 0,
139 	    IPL_SOFTNET, 0, "inpcb", NULL);
140 }
141 
142 struct inpcbhead *
143 in_pcbhash(struct inpcbtable *table, int rdom,
144     const struct in_addr *faddr, u_short fport,
145     const struct in_addr *laddr, u_short lport)
146 {
147 	SIPHASH_CTX ctx;
148 	u_int32_t nrdom = htonl(rdom);
149 
150 	SipHash24_Init(&ctx, &table->inpt_key);
151 	SipHash24_Update(&ctx, &nrdom, sizeof(nrdom));
152 	SipHash24_Update(&ctx, faddr, sizeof(*faddr));
153 	SipHash24_Update(&ctx, &fport, sizeof(fport));
154 	SipHash24_Update(&ctx, laddr, sizeof(*laddr));
155 	SipHash24_Update(&ctx, &lport, sizeof(lport));
156 
157 	return (&table->inpt_hashtbl[SipHash24_End(&ctx) & table->inpt_mask]);
158 }
159 
160 struct inpcbhead *
161 in_pcblhash(struct inpcbtable *table, int rdom, u_short lport)
162 {
163 	SIPHASH_CTX ctx;
164 	u_int32_t nrdom = htonl(rdom);
165 
166 	SipHash24_Init(&ctx, &table->inpt_lkey);
167 	SipHash24_Update(&ctx, &nrdom, sizeof(nrdom));
168 	SipHash24_Update(&ctx, &lport, sizeof(lport));
169 
170 	return (&table->inpt_lhashtbl[SipHash24_End(&ctx) & table->inpt_lmask]);
171 }
172 
173 void
174 in_pcbinit(struct inpcbtable *table, int hashsize)
175 {
176 
177 	TAILQ_INIT(&table->inpt_queue);
178 	table->inpt_hashtbl = hashinit(hashsize, M_PCB, M_NOWAIT,
179 	    &table->inpt_mask);
180 	if (table->inpt_hashtbl == NULL)
181 		panic("in_pcbinit: hashinit failed");
182 	table->inpt_lhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT,
183 	    &table->inpt_lmask);
184 	if (table->inpt_lhashtbl == NULL)
185 		panic("in_pcbinit: hashinit failed for lport");
186 	table->inpt_count = 0;
187 	table->inpt_size = hashsize;
188 	arc4random_buf(&table->inpt_key, sizeof(table->inpt_key));
189 	arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey));
190 }
191 
192 /*
193  * Check if the specified port is invalid for dynamic allocation.
194  */
195 int
196 in_baddynamic(u_int16_t port, u_int16_t proto)
197 {
198 	switch (proto) {
199 	case IPPROTO_TCP:
200 		return (DP_ISSET(baddynamicports.tcp, port));
201 	case IPPROTO_UDP:
202 #ifdef IPSEC
203 		/* Cannot preset this as it is a sysctl */
204 		if (port == udpencap_port)
205 			return (1);
206 #endif
207 		return (DP_ISSET(baddynamicports.udp, port));
208 	default:
209 		return (0);
210 	}
211 }
212 
213 int
214 in_rootonly(u_int16_t port, u_int16_t proto)
215 {
216 	switch (proto) {
217 	case IPPROTO_TCP:
218 		return (port < IPPORT_RESERVED ||
219 		    DP_ISSET(rootonlyports.tcp, port));
220 	case IPPROTO_UDP:
221 		return (port < IPPORT_RESERVED ||
222 		    DP_ISSET(rootonlyports.udp, port));
223 	default:
224 		return (0);
225 	}
226 }
227 
228 int
229 in_pcballoc(struct socket *so, struct inpcbtable *table)
230 {
231 	struct inpcb *inp;
232 	struct inpcbhead *head;
233 
234 	NET_ASSERT_LOCKED();
235 
236 	inp = pool_get(&inpcb_pool, PR_NOWAIT|PR_ZERO);
237 	if (inp == NULL)
238 		return (ENOBUFS);
239 	inp->inp_table = table;
240 	inp->inp_socket = so;
241 	refcnt_init(&inp->inp_refcnt);
242 	inp->inp_seclevel[SL_AUTH] = IPSEC_AUTH_LEVEL_DEFAULT;
243 	inp->inp_seclevel[SL_ESP_TRANS] = IPSEC_ESP_TRANS_LEVEL_DEFAULT;
244 	inp->inp_seclevel[SL_ESP_NETWORK] = IPSEC_ESP_NETWORK_LEVEL_DEFAULT;
245 	inp->inp_seclevel[SL_IPCOMP] = IPSEC_IPCOMP_LEVEL_DEFAULT;
246 	inp->inp_rtableid = curproc->p_p->ps_rtableid;
247 	inp->inp_hops = -1;
248 #ifdef INET6
249 	/*
250 	 * Small change in this function to set the INP_IPV6 flag so routines
251 	 * outside pcb-specific routines don't need to use sotopf(), and all
252 	 * of its pointer chasing, later.
253 	 */
254 	if (sotopf(so) == PF_INET6)
255 		inp->inp_flags = INP_IPV6;
256 	inp->inp_cksum6 = -1;
257 #endif /* INET6 */
258 
259 	if (table->inpt_count++ > INPCBHASH_LOADFACTOR(table->inpt_size))
260 		(void)in_pcbresize(table, table->inpt_size * 2);
261 	TAILQ_INSERT_HEAD(&table->inpt_queue, inp, inp_queue);
262 	head = in_pcblhash(table, inp->inp_rtableid, inp->inp_lport);
263 	LIST_INSERT_HEAD(head, inp, inp_lhash);
264 #ifdef INET6
265 	if (sotopf(so) == PF_INET6)
266 		head = in6_pcbhash(table, rtable_l2(inp->inp_rtableid),
267 		    &inp->inp_faddr6, inp->inp_fport,
268 		    &inp->inp_laddr6, inp->inp_lport);
269 	else
270 #endif /* INET6 */
271 		head = in_pcbhash(table, rtable_l2(inp->inp_rtableid),
272 		    &inp->inp_faddr, inp->inp_fport,
273 		    &inp->inp_laddr, inp->inp_lport);
274 	LIST_INSERT_HEAD(head, inp, inp_hash);
275 	so->so_pcb = inp;
276 
277 	return (0);
278 }
279 
280 int
281 in_pcbbind(struct inpcb *inp, struct mbuf *nam, struct proc *p)
282 {
283 	struct socket *so = inp->inp_socket;
284 	u_int16_t lport = 0;
285 	int wild = 0;
286 	void *laddr = &zeroin46_addr;
287 	int error;
288 
289 	if (inp->inp_lport)
290 		return (EINVAL);
291 
292 	if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0 &&
293 	    ((so->so_proto->pr_flags & PR_CONNREQUIRED) == 0 ||
294 	     (so->so_options & SO_ACCEPTCONN) == 0))
295 		wild = INPLOOKUP_WILDCARD;
296 
297 	switch (sotopf(so)) {
298 #ifdef INET6
299 	case PF_INET6:
300 		if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6))
301 			return (EINVAL);
302 		wild |= INPLOOKUP_IPV6;
303 
304 		if (nam) {
305 			struct sockaddr_in6 *sin6;
306 
307 			if ((error = in6_nam2sin6(nam, &sin6)))
308 				return (error);
309 			if ((error = in6_pcbaddrisavail(inp, sin6, wild, p)))
310 				return (error);
311 			laddr = &sin6->sin6_addr;
312 			lport = sin6->sin6_port;
313 		}
314 		break;
315 #endif
316 	case PF_INET:
317 		if (inp->inp_laddr.s_addr != INADDR_ANY)
318 			return (EINVAL);
319 
320 		if (nam) {
321 			struct sockaddr_in *sin;
322 
323 			if ((error = in_nam2sin(nam, &sin)))
324 				return (error);
325 			if ((error = in_pcbaddrisavail(inp, sin, wild, p)))
326 				return (error);
327 			laddr = &sin->sin_addr;
328 			lport = sin->sin_port;
329 		}
330 		break;
331 	default:
332 		return (EINVAL);
333 	}
334 
335 	if (lport == 0) {
336 		if ((error = in_pcbpickport(&lport, laddr, wild, inp, p)))
337 			return (error);
338 	} else {
339 		if (in_rootonly(ntohs(lport), so->so_proto->pr_protocol) &&
340 		    suser(p) != 0)
341 			return (EACCES);
342 	}
343 	if (nam) {
344 		switch (sotopf(so)) {
345 #ifdef INET6
346 		case PF_INET6:
347 			inp->inp_laddr6 = *(struct in6_addr *)laddr;
348 			break;
349 #endif
350 		case PF_INET:
351 			inp->inp_laddr = *(struct in_addr *)laddr;
352 			break;
353 		}
354 	}
355 	inp->inp_lport = lport;
356 	in_pcbrehash(inp);
357 	return (0);
358 }
359 
360 int
361 in_pcbaddrisavail(struct inpcb *inp, struct sockaddr_in *sin, int wild,
362     struct proc *p)
363 {
364 	struct socket *so = inp->inp_socket;
365 	struct inpcbtable *table = inp->inp_table;
366 	u_int16_t lport = sin->sin_port;
367 	int reuseport = (so->so_options & SO_REUSEPORT);
368 
369 	if (IN_MULTICAST(sin->sin_addr.s_addr)) {
370 		/*
371 		 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
372 		 * allow complete duplication of binding if
373 		 * SO_REUSEPORT is set, or if SO_REUSEADDR is set
374 		 * and a multicast address is bound on both
375 		 * new and duplicated sockets.
376 		 */
377 		if (so->so_options & (SO_REUSEADDR|SO_REUSEPORT))
378 			reuseport = SO_REUSEADDR|SO_REUSEPORT;
379 	} else if (sin->sin_addr.s_addr != INADDR_ANY) {
380 		/*
381 		 * we must check that we are binding to an address we
382 		 * own except when:
383 		 * - SO_BINDANY is set or
384 		 * - we are binding a UDP socket to 255.255.255.255 or
385 		 * - we are binding a UDP socket to one of our broadcast
386 		 *   addresses
387 		 */
388 		if (!ISSET(so->so_options, SO_BINDANY) &&
389 		    !(so->so_type == SOCK_DGRAM &&
390 		    sin->sin_addr.s_addr == INADDR_BROADCAST) &&
391 		    !(so->so_type == SOCK_DGRAM &&
392 		    in_broadcast(sin->sin_addr, inp->inp_rtableid))) {
393 			struct ifaddr *ia;
394 
395 			sin->sin_port = 0;
396 			memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
397 			ia = ifa_ifwithaddr(sintosa(sin), inp->inp_rtableid);
398 			sin->sin_port = lport;
399 
400 			if (ia == NULL)
401 				return (EADDRNOTAVAIL);
402 		}
403 	}
404 	if (lport) {
405 		struct inpcb *t;
406 
407 		if (so->so_euid) {
408 			t = in_pcblookup_local(table, &sin->sin_addr, lport,
409 			    INPLOOKUP_WILDCARD, inp->inp_rtableid);
410 			if (t && (so->so_euid != t->inp_socket->so_euid))
411 				return (EADDRINUSE);
412 		}
413 		t = in_pcblookup_local(table, &sin->sin_addr, lport,
414 		    wild, inp->inp_rtableid);
415 		if (t && (reuseport & t->inp_socket->so_options) == 0)
416 			return (EADDRINUSE);
417 	}
418 
419 	return (0);
420 }
421 
422 int
423 in_pcbpickport(u_int16_t *lport, void *laddr, int wild, struct inpcb *inp,
424     struct proc *p)
425 {
426 	struct socket *so = inp->inp_socket;
427 	struct inpcbtable *table = inp->inp_table;
428 	u_int16_t first, last, lower, higher, candidate, localport;
429 	int count;
430 
431 	if (inp->inp_flags & INP_HIGHPORT) {
432 		first = ipport_hifirstauto;	/* sysctl */
433 		last = ipport_hilastauto;
434 	} else if (inp->inp_flags & INP_LOWPORT) {
435 		if (suser(p))
436 			return (EACCES);
437 		first = IPPORT_RESERVED-1; /* 1023 */
438 		last = 600;		   /* not IPPORT_RESERVED/2 */
439 	} else {
440 		first = ipport_firstauto;	/* sysctl */
441 		last = ipport_lastauto;
442 	}
443 	if (first < last) {
444 		lower = first;
445 		higher = last;
446 	} else {
447 		lower = last;
448 		higher = first;
449 	}
450 
451 	/*
452 	 * Simple check to ensure all ports are not used up causing
453 	 * a deadlock here.
454 	 */
455 
456 	count = higher - lower;
457 	candidate = lower + arc4random_uniform(count);
458 
459 	do {
460 		if (count-- < 0)	/* completely used? */
461 			return (EADDRNOTAVAIL);
462 		++candidate;
463 		if (candidate < lower || candidate > higher)
464 			candidate = lower;
465 		localport = htons(candidate);
466 	} while (in_baddynamic(candidate, so->so_proto->pr_protocol) ||
467 	    in_pcblookup_local(table, laddr, localport, wild,
468 	    inp->inp_rtableid));
469 	*lport = localport;
470 
471 	return (0);
472 }
473 
474 /*
475  * Connect from a socket to a specified address.
476  * Both address and port must be specified in argument sin.
477  * If don't have a local address for this socket yet,
478  * then pick one.
479  */
480 int
481 in_pcbconnect(struct inpcb *inp, struct mbuf *nam)
482 {
483 	struct in_addr *ina = NULL;
484 	struct sockaddr_in *sin;
485 	int error;
486 
487 #ifdef INET6
488 	if (sotopf(inp->inp_socket) == PF_INET6)
489 		return (in6_pcbconnect(inp, nam));
490 	KASSERT((inp->inp_flags & INP_IPV6) == 0);
491 #endif /* INET6 */
492 
493 	if ((error = in_nam2sin(nam, &sin)))
494 		return (error);
495 	if (sin->sin_port == 0)
496 		return (EADDRNOTAVAIL);
497 	error = in_pcbselsrc(&ina, sin, inp);
498 	if (error)
499 		return (error);
500 
501 	if (in_pcbhashlookup(inp->inp_table, sin->sin_addr, sin->sin_port,
502 	    *ina, inp->inp_lport, inp->inp_rtableid) != NULL)
503 		return (EADDRINUSE);
504 
505 	KASSERT(inp->inp_laddr.s_addr == INADDR_ANY || inp->inp_lport);
506 
507 	if (inp->inp_laddr.s_addr == INADDR_ANY) {
508 		if (inp->inp_lport == 0) {
509 			error = in_pcbbind(inp, NULL, curproc);
510 			if (error)
511 				return (error);
512 			if (in_pcbhashlookup(inp->inp_table, sin->sin_addr,
513 			    sin->sin_port, *ina, inp->inp_lport,
514 			    inp->inp_rtableid) != NULL) {
515 				inp->inp_lport = 0;
516 				return (EADDRINUSE);
517 			}
518 		}
519 		inp->inp_laddr = *ina;
520 	}
521 	inp->inp_faddr = sin->sin_addr;
522 	inp->inp_fport = sin->sin_port;
523 	in_pcbrehash(inp);
524 #if NSTOEPLITZ > 0
525 	inp->inp_flowid = stoeplitz_ip4port(inp->inp_faddr.s_addr,
526 	    inp->inp_laddr.s_addr, inp->inp_fport, inp->inp_lport);
527 #endif
528 	return (0);
529 }
530 
531 void
532 in_pcbdisconnect(struct inpcb *inp)
533 {
534 #if NPF > 0
535 	if (inp->inp_pf_sk) {
536 		pf_remove_divert_state(inp->inp_pf_sk);
537 		/* pf_remove_divert_state() may have detached the state */
538 		pf_inp_unlink(inp);
539 	}
540 #endif
541 	switch (sotopf(inp->inp_socket)) {
542 #ifdef INET6
543 	case PF_INET6:
544 		inp->inp_faddr6 = in6addr_any;
545 		break;
546 #endif
547 	case PF_INET:
548 		inp->inp_faddr.s_addr = INADDR_ANY;
549 		break;
550 	}
551 
552 	inp->inp_fport = 0;
553 	inp->inp_flowid = 0;
554 	in_pcbrehash(inp);
555 	if (inp->inp_socket->so_state & SS_NOFDREF)
556 		in_pcbdetach(inp);
557 }
558 
559 void
560 in_pcbdetach(struct inpcb *inp)
561 {
562 	struct socket *so = inp->inp_socket;
563 
564 	NET_ASSERT_LOCKED();
565 
566 	so->so_pcb = NULL;
567 	/*
568 	 * As long as the NET_LOCK() is the default lock for Internet
569 	 * sockets, do not release it to not introduce new sleeping
570 	 * points.
571 	 */
572 	sofree(so, SL_NOUNLOCK);
573 	m_freem(inp->inp_options);
574 	if (inp->inp_route.ro_rt) {
575 		rtfree(inp->inp_route.ro_rt);
576 		inp->inp_route.ro_rt = NULL;
577 	}
578 #ifdef INET6
579 	if (inp->inp_flags & INP_IPV6) {
580 		ip6_freepcbopts(inp->inp_outputopts6);
581 		ip6_freemoptions(inp->inp_moptions6);
582 	} else
583 #endif
584 		ip_freemoptions(inp->inp_moptions);
585 #if NPF > 0
586 	if (inp->inp_pf_sk) {
587 		pf_remove_divert_state(inp->inp_pf_sk);
588 		/* pf_remove_divert_state() may have detached the state */
589 		pf_inp_unlink(inp);
590 	}
591 #endif
592 	LIST_REMOVE(inp, inp_lhash);
593 	LIST_REMOVE(inp, inp_hash);
594 	TAILQ_REMOVE(&inp->inp_table->inpt_queue, inp, inp_queue);
595 	inp->inp_table->inpt_count--;
596 	in_pcbunref(inp);
597 }
598 
599 struct inpcb *
600 in_pcbref(struct inpcb *inp)
601 {
602 	if (inp != NULL)
603 		refcnt_take(&inp->inp_refcnt);
604 	return inp;
605 }
606 
607 void
608 in_pcbunref(struct inpcb *inp)
609 {
610 	if (refcnt_rele(&inp->inp_refcnt)) {
611 		KASSERT((LIST_NEXT(inp, inp_hash) == NULL) ||
612 		    (LIST_NEXT(inp, inp_hash) == _Q_INVALID));
613 		KASSERT((LIST_NEXT(inp, inp_lhash) == NULL) ||
614 		    (LIST_NEXT(inp, inp_lhash) == _Q_INVALID));
615 		KASSERT((TAILQ_NEXT(inp, inp_queue) == NULL) ||
616 		    (TAILQ_NEXT(inp, inp_queue) == _Q_INVALID));
617 		pool_put(&inpcb_pool, inp);
618 	}
619 }
620 
621 void
622 in_setsockaddr(struct inpcb *inp, struct mbuf *nam)
623 {
624 	struct sockaddr_in *sin;
625 
626 	nam->m_len = sizeof(*sin);
627 	sin = mtod(nam, struct sockaddr_in *);
628 	memset(sin, 0, sizeof(*sin));
629 	sin->sin_family = AF_INET;
630 	sin->sin_len = sizeof(*sin);
631 	sin->sin_port = inp->inp_lport;
632 	sin->sin_addr = inp->inp_laddr;
633 }
634 
635 void
636 in_setpeeraddr(struct inpcb *inp, struct mbuf *nam)
637 {
638 	struct sockaddr_in *sin;
639 
640 #ifdef INET6
641 	if (sotopf(inp->inp_socket) == PF_INET6) {
642 		in6_setpeeraddr(inp, nam);
643 		return;
644 	}
645 #endif /* INET6 */
646 
647 	nam->m_len = sizeof(*sin);
648 	sin = mtod(nam, struct sockaddr_in *);
649 	memset(sin, 0, sizeof(*sin));
650 	sin->sin_family = AF_INET;
651 	sin->sin_len = sizeof(*sin);
652 	sin->sin_port = inp->inp_fport;
653 	sin->sin_addr = inp->inp_faddr;
654 }
655 
656 /*
657  * Pass some notification to all connections of a protocol
658  * associated with address dst.  The "usual action" will be
659  * taken, depending on the ctlinput cmd.  The caller must filter any
660  * cmds that are uninteresting (e.g., no error in the map).
661  * Call the protocol specific routine (if any) to report
662  * any errors for each matching socket.
663  */
664 void
665 in_pcbnotifyall(struct inpcbtable *table, struct sockaddr *dst, u_int rtable,
666     int errno, void (*notify)(struct inpcb *, int))
667 {
668 	struct inpcb *inp, *ninp;
669 	struct in_addr faddr;
670 	u_int rdomain;
671 
672 	NET_ASSERT_LOCKED();
673 
674 #ifdef INET6
675 	/*
676 	 * See in6_pcbnotify() for IPv6 codepath.  By the time this
677 	 * gets called, the addresses passed are either definitely IPv4 or
678 	 * IPv6; *_pcbnotify() never gets called with v4-mapped v6 addresses.
679 	 */
680 #endif /* INET6 */
681 
682 	if (dst->sa_family != AF_INET)
683 		return;
684 	faddr = satosin(dst)->sin_addr;
685 	if (faddr.s_addr == INADDR_ANY)
686 		return;
687 
688 	rdomain = rtable_l2(rtable);
689 	TAILQ_FOREACH_SAFE(inp, &table->inpt_queue, inp_queue, ninp) {
690 #ifdef INET6
691 		if (inp->inp_flags & INP_IPV6)
692 			continue;
693 #endif
694 		if (inp->inp_faddr.s_addr != faddr.s_addr ||
695 		    rtable_l2(inp->inp_rtableid) != rdomain ||
696 		    inp->inp_socket == NULL) {
697 			continue;
698 		}
699 		if (notify)
700 			(*notify)(inp, errno);
701 	}
702 }
703 
704 /*
705  * Check for alternatives when higher level complains
706  * about service problems.  For now, invalidate cached
707  * routing information.  If the route was created dynamically
708  * (by a redirect), time to try a default gateway again.
709  */
710 void
711 in_losing(struct inpcb *inp)
712 {
713 	struct rtentry *rt = inp->inp_route.ro_rt;
714 
715 	if (rt) {
716 		inp->inp_route.ro_rt = NULL;
717 
718 		if (rt->rt_flags & RTF_DYNAMIC) {
719 			struct ifnet *ifp;
720 
721 			ifp = if_get(rt->rt_ifidx);
722 			/*
723 			 * If the interface is gone, all its attached
724 			 * route entries have been removed from the table,
725 			 * so we're dealing with a stale cache and have
726 			 * nothing to do.
727 			 */
728 			if (ifp != NULL)
729 				rtdeletemsg(rt, ifp, inp->inp_rtableid);
730 			if_put(ifp);
731 		}
732 		/*
733 		 * A new route can be allocated
734 		 * the next time output is attempted.
735 		 * rtfree() needs to be called in anycase because the inp
736 		 * is still holding a reference to rt.
737 		 */
738 		rtfree(rt);
739 	}
740 }
741 
742 /*
743  * After a routing change, flush old routing
744  * and allocate a (hopefully) better one.
745  */
746 void
747 in_rtchange(struct inpcb *inp, int errno)
748 {
749 	if (inp->inp_route.ro_rt) {
750 		rtfree(inp->inp_route.ro_rt);
751 		inp->inp_route.ro_rt = 0;
752 		/*
753 		 * A new route can be allocated the next time
754 		 * output is attempted.
755 		 */
756 	}
757 }
758 
759 struct inpcb *
760 in_pcblookup_local(struct inpcbtable *table, void *laddrp, u_int lport_arg,
761     int flags, u_int rtable)
762 {
763 	struct inpcb *inp, *match = NULL;
764 	int matchwild = 3, wildcard;
765 	u_int16_t lport = lport_arg;
766 	struct in_addr laddr = *(struct in_addr *)laddrp;
767 #ifdef INET6
768 	struct in6_addr *laddr6 = (struct in6_addr *)laddrp;
769 #endif
770 	struct inpcbhead *head;
771 	u_int rdomain;
772 
773 	rdomain = rtable_l2(rtable);
774 	head = in_pcblhash(table, rdomain, lport);
775 	LIST_FOREACH(inp, head, inp_lhash) {
776 		if (rtable_l2(inp->inp_rtableid) != rdomain)
777 			continue;
778 		if (inp->inp_lport != lport)
779 			continue;
780 		wildcard = 0;
781 #ifdef INET6
782 		if (ISSET(flags, INPLOOKUP_IPV6)) {
783 			if (!ISSET(inp->inp_flags, INP_IPV6))
784 				continue;
785 
786 			if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6))
787 				wildcard++;
788 
789 			if (!IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6, laddr6)) {
790 				if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6) ||
791 				    IN6_IS_ADDR_UNSPECIFIED(laddr6))
792 					wildcard++;
793 				else
794 					continue;
795 			}
796 
797 		} else
798 #endif /* INET6 */
799 		{
800 #ifdef INET6
801 			if (ISSET(inp->inp_flags, INP_IPV6))
802 				continue;
803 #endif /* INET6 */
804 
805 			if (inp->inp_faddr.s_addr != INADDR_ANY)
806 				wildcard++;
807 
808 			if (inp->inp_laddr.s_addr != laddr.s_addr) {
809 				if (inp->inp_laddr.s_addr == INADDR_ANY ||
810 				    laddr.s_addr == INADDR_ANY)
811 					wildcard++;
812 				else
813 					continue;
814 			}
815 
816 		}
817 		if ((!wildcard || (flags & INPLOOKUP_WILDCARD)) &&
818 		    wildcard < matchwild) {
819 			match = inp;
820 			if ((matchwild = wildcard) == 0)
821 				break;
822 		}
823 	}
824 	return (match);
825 }
826 
827 struct rtentry *
828 in_pcbrtentry(struct inpcb *inp)
829 {
830 	struct route *ro;
831 
832 	ro = &inp->inp_route;
833 
834 	/* check if route is still valid */
835 	if (!rtisvalid(ro->ro_rt)) {
836 		rtfree(ro->ro_rt);
837 		ro->ro_rt = NULL;
838 	}
839 
840 	/*
841 	 * No route yet, so try to acquire one.
842 	 */
843 	if (ro->ro_rt == NULL) {
844 #ifdef INET6
845 		memset(ro, 0, sizeof(struct route_in6));
846 #else
847 		memset(ro, 0, sizeof(struct route));
848 #endif
849 
850 		switch(sotopf(inp->inp_socket)) {
851 #ifdef INET6
852 		case PF_INET6:
853 			if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6))
854 				break;
855 			ro->ro_dst.sa_family = AF_INET6;
856 			ro->ro_dst.sa_len = sizeof(struct sockaddr_in6);
857 			satosin6(&ro->ro_dst)->sin6_addr = inp->inp_faddr6;
858 			ro->ro_tableid = inp->inp_rtableid;
859 			ro->ro_rt = rtalloc_mpath(&ro->ro_dst,
860 			    &inp->inp_laddr6.s6_addr32[0], ro->ro_tableid);
861 			break;
862 #endif /* INET6 */
863 		case PF_INET:
864 			if (inp->inp_faddr.s_addr == INADDR_ANY)
865 				break;
866 			ro->ro_dst.sa_family = AF_INET;
867 			ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
868 			satosin(&ro->ro_dst)->sin_addr = inp->inp_faddr;
869 			ro->ro_tableid = inp->inp_rtableid;
870 			ro->ro_rt = rtalloc_mpath(&ro->ro_dst,
871 			    &inp->inp_laddr.s_addr, ro->ro_tableid);
872 			break;
873 		}
874 	}
875 	return (ro->ro_rt);
876 }
877 
878 /*
879  * Return an IPv4 address, which is the most appropriate for a given
880  * destination.
881  * If necessary, this function lookups the routing table and returns
882  * an entry to the caller for later use.
883  */
884 int
885 in_pcbselsrc(struct in_addr **insrc, struct sockaddr_in *sin,
886     struct inpcb *inp)
887 {
888 	struct ip_moptions *mopts = inp->inp_moptions;
889 	struct route *ro = &inp->inp_route;
890 	struct in_addr *laddr = &inp->inp_laddr;
891 	u_int rtableid = inp->inp_rtableid;
892 	struct sockaddr	*ip4_source = NULL;
893 
894 	struct sockaddr_in *sin2;
895 	struct in_ifaddr *ia = NULL;
896 
897 	/*
898 	 * If the socket(if any) is already bound, use that bound address
899 	 * unless it is INADDR_ANY or INADDR_BROADCAST.
900 	 */
901 	if (laddr && laddr->s_addr != INADDR_ANY &&
902 	    laddr->s_addr != INADDR_BROADCAST) {
903 		*insrc = laddr;
904 		return (0);
905 	}
906 
907 	/*
908 	 * If the destination address is multicast and an outgoing
909 	 * interface has been set as a multicast option, use the
910 	 * address of that interface as our source address.
911 	 */
912 	if (IN_MULTICAST(sin->sin_addr.s_addr) && mopts != NULL) {
913 		struct ifnet *ifp;
914 
915 		ifp = if_get(mopts->imo_ifidx);
916 		if (ifp != NULL) {
917 			if (ifp->if_rdomain == rtable_l2(rtableid))
918 				IFP_TO_IA(ifp, ia);
919 			if (ia == NULL) {
920 				if_put(ifp);
921 				return (EADDRNOTAVAIL);
922 			}
923 
924 			*insrc = &ia->ia_addr.sin_addr;
925 			if_put(ifp);
926 			return (0);
927 		}
928 	}
929 
930 	/*
931 	 * If route is known or can be allocated now,
932 	 * our src addr is taken from the i/f, else punt.
933 	 */
934 	if (!rtisvalid(ro->ro_rt) || (ro->ro_tableid != rtableid) ||
935 	    (satosin(&ro->ro_dst)->sin_addr.s_addr != sin->sin_addr.s_addr)) {
936 		rtfree(ro->ro_rt);
937 		ro->ro_rt = NULL;
938 	}
939 	if (ro->ro_rt == NULL) {
940 		/* No route yet, so try to acquire one */
941 		ro->ro_dst.sa_family = AF_INET;
942 		ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
943 		satosin(&ro->ro_dst)->sin_addr = sin->sin_addr;
944 		ro->ro_tableid = rtableid;
945 		ro->ro_rt = rtalloc_mpath(&ro->ro_dst, NULL, ro->ro_tableid);
946 
947 		/*
948 		 * It is important to zero out the rest of the
949 		 * struct sockaddr_in when mixing v6 & v4!
950 		 */
951 		sin2 = satosin(&ro->ro_dst);
952 		memset(sin2->sin_zero, 0, sizeof(sin2->sin_zero));
953 	}
954 
955 	/*
956 	 * If we found a route, use the address
957 	 * corresponding to the outgoing interface.
958 	 */
959 	if (ro->ro_rt != NULL)
960 		ia = ifatoia(ro->ro_rt->rt_ifa);
961 
962 	/*
963 	 * Use preferred source address if :
964 	 * - destination is not onlink
965 	 * - preferred source address is set
966 	 * - output interface is UP
967 	 */
968 	if (ro->ro_rt && !(ro->ro_rt->rt_flags & RTF_LLINFO) &&
969 	    !(ro->ro_rt->rt_flags & RTF_HOST)) {
970 		ip4_source = rtable_getsource(rtableid, AF_INET);
971 		if (ip4_source != NULL) {
972 			struct ifaddr *ifa;
973 			if ((ifa = ifa_ifwithaddr(ip4_source, rtableid)) !=
974 			    NULL && ISSET(ifa->ifa_ifp->if_flags, IFF_UP)) {
975 				*insrc = &satosin(ip4_source)->sin_addr;
976 				return (0);
977 			}
978 		}
979 	}
980 
981 	if (ia == NULL)
982 		return (EADDRNOTAVAIL);
983 
984 	*insrc = &ia->ia_addr.sin_addr;
985 	return (0);
986 }
987 
988 void
989 in_pcbrehash(struct inpcb *inp)
990 {
991 	struct inpcbtable *table = inp->inp_table;
992 	struct inpcbhead *head;
993 
994 	NET_ASSERT_LOCKED();
995 
996 	LIST_REMOVE(inp, inp_lhash);
997 	head = in_pcblhash(table, inp->inp_rtableid, inp->inp_lport);
998 	LIST_INSERT_HEAD(head, inp, inp_lhash);
999 	LIST_REMOVE(inp, inp_hash);
1000 #ifdef INET6
1001 	if (inp->inp_flags & INP_IPV6)
1002 		head = in6_pcbhash(table, rtable_l2(inp->inp_rtableid),
1003 		    &inp->inp_faddr6, inp->inp_fport,
1004 		    &inp->inp_laddr6, inp->inp_lport);
1005 	else
1006 #endif /* INET6 */
1007 		head = in_pcbhash(table, rtable_l2(inp->inp_rtableid),
1008 		    &inp->inp_faddr, inp->inp_fport,
1009 		    &inp->inp_laddr, inp->inp_lport);
1010 	LIST_INSERT_HEAD(head, inp, inp_hash);
1011 }
1012 
1013 int
1014 in_pcbresize(struct inpcbtable *table, int hashsize)
1015 {
1016 	u_long nmask, nlmask;
1017 	int osize;
1018 	void *nhashtbl, *nlhashtbl, *ohashtbl, *olhashtbl;
1019 	struct inpcb *inp;
1020 
1021 	ohashtbl = table->inpt_hashtbl;
1022 	olhashtbl = table->inpt_lhashtbl;
1023 	osize = table->inpt_size;
1024 
1025 	nhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nmask);
1026 	if (nhashtbl == NULL)
1027 		return ENOBUFS;
1028 	nlhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nlmask);
1029 	if (nlhashtbl == NULL) {
1030 		hashfree(nhashtbl, hashsize, M_PCB);
1031 		return ENOBUFS;
1032 	}
1033 	table->inpt_hashtbl = nhashtbl;
1034 	table->inpt_lhashtbl = nlhashtbl;
1035 	table->inpt_mask = nmask;
1036 	table->inpt_lmask = nlmask;
1037 	table->inpt_size = hashsize;
1038 	arc4random_buf(&table->inpt_key, sizeof(table->inpt_key));
1039 	arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey));
1040 
1041 	TAILQ_FOREACH(inp, &table->inpt_queue, inp_queue) {
1042 		in_pcbrehash(inp);
1043 	}
1044 	hashfree(ohashtbl, osize, M_PCB);
1045 	hashfree(olhashtbl, osize, M_PCB);
1046 
1047 	return (0);
1048 }
1049 
1050 #ifdef DIAGNOSTIC
1051 int	in_pcbnotifymiss = 0;
1052 #endif
1053 
1054 /*
1055  * The in(6)_pcbhashlookup functions are used to locate connected sockets
1056  * quickly:
1057  *     faddr.fport <-> laddr.lport
1058  * No wildcard matching is done so that listening sockets are not found.
1059  * If the functions return NULL in(6)_pcblookup_listen can be used to
1060  * find a listening/bound socket that may accept the connection.
1061  * After those two lookups no other are necessary.
1062  */
1063 struct inpcb *
1064 in_pcbhashlookup(struct inpcbtable *table, struct in_addr faddr,
1065     u_int fport_arg, struct in_addr laddr, u_int lport_arg, u_int rtable)
1066 {
1067 	struct inpcbhead *head;
1068 	struct inpcb *inp;
1069 	u_int16_t fport = fport_arg, lport = lport_arg;
1070 	u_int rdomain;
1071 
1072 	rdomain = rtable_l2(rtable);
1073 	head = in_pcbhash(table, rdomain, &faddr, fport, &laddr, lport);
1074 	LIST_FOREACH(inp, head, inp_hash) {
1075 #ifdef INET6
1076 		if (inp->inp_flags & INP_IPV6)
1077 			continue;	/*XXX*/
1078 #endif
1079 		if (inp->inp_faddr.s_addr == faddr.s_addr &&
1080 		    inp->inp_fport == fport && inp->inp_lport == lport &&
1081 		    inp->inp_laddr.s_addr == laddr.s_addr &&
1082 		    rtable_l2(inp->inp_rtableid) == rdomain) {
1083 			/*
1084 			 * Move this PCB to the head of hash chain so that
1085 			 * repeated accesses are quicker.  This is analogous to
1086 			 * the historic single-entry PCB cache.
1087 			 */
1088 			if (inp != LIST_FIRST(head)) {
1089 				LIST_REMOVE(inp, inp_hash);
1090 				LIST_INSERT_HEAD(head, inp, inp_hash);
1091 			}
1092 			break;
1093 		}
1094 	}
1095 #ifdef DIAGNOSTIC
1096 	if (inp == NULL && in_pcbnotifymiss) {
1097 		printf("%s: faddr=%08x fport=%d laddr=%08x lport=%d rdom=%u\n",
1098 		    __func__, ntohl(faddr.s_addr), ntohs(fport),
1099 		    ntohl(laddr.s_addr), ntohs(lport), rdomain);
1100 	}
1101 #endif
1102 	return (inp);
1103 }
1104 
1105 /*
1106  * The in(6)_pcblookup_listen functions are used to locate listening
1107  * sockets quickly.  This are sockets with unspecified foreign address
1108  * and port:
1109  *		*.*     <-> laddr.lport
1110  *		*.*     <->     *.lport
1111  */
1112 struct inpcb *
1113 in_pcblookup_listen(struct inpcbtable *table, struct in_addr laddr,
1114     u_int lport_arg, struct mbuf *m, u_int rtable)
1115 {
1116 	struct inpcbhead *head;
1117 	const struct in_addr *key1, *key2;
1118 	struct inpcb *inp;
1119 	u_int16_t lport = lport_arg;
1120 	u_int rdomain;
1121 
1122 	key1 = &laddr;
1123 	key2 = &zeroin_addr;
1124 #if NPF > 0
1125 	if (m && m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) {
1126 		struct pf_divert *divert;
1127 
1128 		divert = pf_find_divert(m);
1129 		KASSERT(divert != NULL);
1130 		switch (divert->type) {
1131 		case PF_DIVERT_TO:
1132 			key1 = key2 = &divert->addr.v4;
1133 			lport = divert->port;
1134 			break;
1135 		case PF_DIVERT_REPLY:
1136 			return (NULL);
1137 		default:
1138 			panic("%s: unknown divert type %d, mbuf %p, divert %p",
1139 			    __func__, divert->type, m, divert);
1140 		}
1141 	} else if (m && m->m_pkthdr.pf.flags & PF_TAG_TRANSLATE_LOCALHOST) {
1142 		/*
1143 		 * Redirected connections should not be treated the same
1144 		 * as connections directed to 127.0.0.0/8 since localhost
1145 		 * can only be accessed from the host itself.
1146 		 * For example portmap(8) grants more permissions for
1147 		 * connections to the socket bound to 127.0.0.1 than
1148 		 * to the * socket.
1149 		 */
1150 		key1 = &zeroin_addr;
1151 		key2 = &laddr;
1152 	}
1153 #endif
1154 
1155 	rdomain = rtable_l2(rtable);
1156 	head = in_pcbhash(table, rdomain, &zeroin_addr, 0, key1, lport);
1157 	LIST_FOREACH(inp, head, inp_hash) {
1158 #ifdef INET6
1159 		if (inp->inp_flags & INP_IPV6)
1160 			continue;	/*XXX*/
1161 #endif
1162 		if (inp->inp_lport == lport && inp->inp_fport == 0 &&
1163 		    inp->inp_laddr.s_addr == key1->s_addr &&
1164 		    inp->inp_faddr.s_addr == INADDR_ANY &&
1165 		    rtable_l2(inp->inp_rtableid) == rdomain)
1166 			break;
1167 	}
1168 	if (inp == NULL && key1->s_addr != key2->s_addr) {
1169 		head = in_pcbhash(table, rdomain,
1170 		    &zeroin_addr, 0, key2, lport);
1171 		LIST_FOREACH(inp, head, inp_hash) {
1172 #ifdef INET6
1173 			if (inp->inp_flags & INP_IPV6)
1174 				continue;	/*XXX*/
1175 #endif
1176 			if (inp->inp_lport == lport && inp->inp_fport == 0 &&
1177 			    inp->inp_laddr.s_addr == key2->s_addr &&
1178 			    inp->inp_faddr.s_addr == INADDR_ANY &&
1179 			    rtable_l2(inp->inp_rtableid) == rdomain)
1180 				break;
1181 		}
1182 	}
1183 	/*
1184 	 * Move this PCB to the head of hash chain so that
1185 	 * repeated accesses are quicker.  This is analogous to
1186 	 * the historic single-entry PCB cache.
1187 	 */
1188 	if (inp != NULL && inp != LIST_FIRST(head)) {
1189 		LIST_REMOVE(inp, inp_hash);
1190 		LIST_INSERT_HEAD(head, inp, inp_hash);
1191 	}
1192 #ifdef DIAGNOSTIC
1193 	if (inp == NULL && in_pcbnotifymiss) {
1194 		printf("%s: laddr=%08x lport=%d rdom=%u\n",
1195 		    __func__, ntohl(laddr.s_addr), ntohs(lport), rdomain);
1196 	}
1197 #endif
1198 	return (inp);
1199 }
1200