1 /* $OpenBSD: in_pcb.c,v 1.256 2021/10/25 22:20:47 bluhm Exp $ */ 2 /* $NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $ */ 3 4 /* 5 * Copyright (c) 1982, 1986, 1991, 1993 6 * The Regents of the University of California. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 * 32 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995 33 * 34 * NRL grants permission for redistribution and use in source and binary 35 * forms, with or without modification, of the software and documentation 36 * created at NRL provided that the following conditions are met: 37 * 38 * 1. Redistributions of source code must retain the above copyright 39 * notice, this list of conditions and the following disclaimer. 40 * 2. Redistributions in binary form must reproduce the above copyright 41 * notice, this list of conditions and the following disclaimer in the 42 * documentation and/or other materials provided with the distribution. 43 * 3. All advertising materials mentioning features or use of this software 44 * must display the following acknowledgements: 45 * This product includes software developed by the University of 46 * California, Berkeley and its contributors. 47 * This product includes software developed at the Information 48 * Technology Division, US Naval Research Laboratory. 49 * 4. Neither the name of the NRL nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS 54 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A 56 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR 57 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 58 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 59 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 60 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 61 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 62 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 63 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 64 * 65 * The views and conclusions contained in the software and documentation 66 * are those of the authors and should not be interpreted as representing 67 * official policies, either expressed or implied, of the US Naval 68 * Research Laboratory (NRL). 69 */ 70 71 #include "pf.h" 72 73 #include <sys/param.h> 74 #include <sys/systm.h> 75 #include <sys/mbuf.h> 76 #include <sys/protosw.h> 77 #include <sys/socket.h> 78 #include <sys/socketvar.h> 79 #include <sys/domain.h> 80 #include <sys/mount.h> 81 #include <sys/pool.h> 82 #include <sys/proc.h> 83 84 #include <net/if.h> 85 #include <net/if_var.h> 86 #include <net/pfvar.h> 87 #include <net/route.h> 88 89 #include <netinet/in.h> 90 #include <netinet/in_var.h> 91 #include <netinet/ip.h> 92 #include <netinet/ip_var.h> 93 #include <netinet/in_pcb.h> 94 #ifdef IPSEC 95 #include <netinet/ip_esp.h> 96 #endif /* IPSEC */ 97 98 #include "stoeplitz.h" 99 #if NSTOEPLITZ > 0 100 #include <net/toeplitz.h> 101 #endif 102 103 const struct in_addr zeroin_addr; 104 105 union { 106 struct in_addr za_in; 107 struct in6_addr za_in6; 108 } zeroin46_addr; 109 110 /* 111 * These configure the range of local port addresses assigned to 112 * "unspecified" outgoing connections/packets/whatever. 113 */ 114 int ipport_firstauto = IPPORT_RESERVED; 115 int ipport_lastauto = IPPORT_USERRESERVED; 116 int ipport_hifirstauto = IPPORT_HIFIRSTAUTO; 117 int ipport_hilastauto = IPPORT_HILASTAUTO; 118 119 struct baddynamicports baddynamicports; 120 struct baddynamicports rootonlyports; 121 struct pool inpcb_pool; 122 123 int in_pcbresize (struct inpcbtable *, int); 124 125 #define INPCBHASH_LOADFACTOR(_x) (((_x) * 3) / 4) 126 127 struct inpcbhead *in_pcbhash(struct inpcbtable *, int, 128 const struct in_addr *, u_short, const struct in_addr *, u_short); 129 struct inpcbhead *in_pcblhash(struct inpcbtable *, int, u_short); 130 131 /* 132 * in_pcb is used for inet and inet6. in6_pcb only contains special 133 * IPv6 cases. So the internet initializer is used for both domains. 134 */ 135 void 136 in_init(void) 137 { 138 pool_init(&inpcb_pool, sizeof(struct inpcb), 0, 139 IPL_SOFTNET, 0, "inpcb", NULL); 140 } 141 142 struct inpcbhead * 143 in_pcbhash(struct inpcbtable *table, int rdom, 144 const struct in_addr *faddr, u_short fport, 145 const struct in_addr *laddr, u_short lport) 146 { 147 SIPHASH_CTX ctx; 148 u_int32_t nrdom = htonl(rdom); 149 150 SipHash24_Init(&ctx, &table->inpt_key); 151 SipHash24_Update(&ctx, &nrdom, sizeof(nrdom)); 152 SipHash24_Update(&ctx, faddr, sizeof(*faddr)); 153 SipHash24_Update(&ctx, &fport, sizeof(fport)); 154 SipHash24_Update(&ctx, laddr, sizeof(*laddr)); 155 SipHash24_Update(&ctx, &lport, sizeof(lport)); 156 157 return (&table->inpt_hashtbl[SipHash24_End(&ctx) & table->inpt_mask]); 158 } 159 160 struct inpcbhead * 161 in_pcblhash(struct inpcbtable *table, int rdom, u_short lport) 162 { 163 SIPHASH_CTX ctx; 164 u_int32_t nrdom = htonl(rdom); 165 166 SipHash24_Init(&ctx, &table->inpt_lkey); 167 SipHash24_Update(&ctx, &nrdom, sizeof(nrdom)); 168 SipHash24_Update(&ctx, &lport, sizeof(lport)); 169 170 return (&table->inpt_lhashtbl[SipHash24_End(&ctx) & table->inpt_lmask]); 171 } 172 173 void 174 in_pcbinit(struct inpcbtable *table, int hashsize) 175 { 176 177 TAILQ_INIT(&table->inpt_queue); 178 table->inpt_hashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, 179 &table->inpt_mask); 180 if (table->inpt_hashtbl == NULL) 181 panic("in_pcbinit: hashinit failed"); 182 table->inpt_lhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, 183 &table->inpt_lmask); 184 if (table->inpt_lhashtbl == NULL) 185 panic("in_pcbinit: hashinit failed for lport"); 186 table->inpt_count = 0; 187 table->inpt_size = hashsize; 188 arc4random_buf(&table->inpt_key, sizeof(table->inpt_key)); 189 arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey)); 190 } 191 192 /* 193 * Check if the specified port is invalid for dynamic allocation. 194 */ 195 int 196 in_baddynamic(u_int16_t port, u_int16_t proto) 197 { 198 switch (proto) { 199 case IPPROTO_TCP: 200 return (DP_ISSET(baddynamicports.tcp, port)); 201 case IPPROTO_UDP: 202 #ifdef IPSEC 203 /* Cannot preset this as it is a sysctl */ 204 if (port == udpencap_port) 205 return (1); 206 #endif 207 return (DP_ISSET(baddynamicports.udp, port)); 208 default: 209 return (0); 210 } 211 } 212 213 int 214 in_rootonly(u_int16_t port, u_int16_t proto) 215 { 216 switch (proto) { 217 case IPPROTO_TCP: 218 return (port < IPPORT_RESERVED || 219 DP_ISSET(rootonlyports.tcp, port)); 220 case IPPROTO_UDP: 221 return (port < IPPORT_RESERVED || 222 DP_ISSET(rootonlyports.udp, port)); 223 default: 224 return (0); 225 } 226 } 227 228 int 229 in_pcballoc(struct socket *so, struct inpcbtable *table) 230 { 231 struct inpcb *inp; 232 struct inpcbhead *head; 233 234 NET_ASSERT_LOCKED(); 235 236 inp = pool_get(&inpcb_pool, PR_NOWAIT|PR_ZERO); 237 if (inp == NULL) 238 return (ENOBUFS); 239 inp->inp_table = table; 240 inp->inp_socket = so; 241 refcnt_init(&inp->inp_refcnt); 242 inp->inp_seclevel[SL_AUTH] = IPSEC_AUTH_LEVEL_DEFAULT; 243 inp->inp_seclevel[SL_ESP_TRANS] = IPSEC_ESP_TRANS_LEVEL_DEFAULT; 244 inp->inp_seclevel[SL_ESP_NETWORK] = IPSEC_ESP_NETWORK_LEVEL_DEFAULT; 245 inp->inp_seclevel[SL_IPCOMP] = IPSEC_IPCOMP_LEVEL_DEFAULT; 246 inp->inp_rtableid = curproc->p_p->ps_rtableid; 247 inp->inp_hops = -1; 248 #ifdef INET6 249 /* 250 * Small change in this function to set the INP_IPV6 flag so routines 251 * outside pcb-specific routines don't need to use sotopf(), and all 252 * of its pointer chasing, later. 253 */ 254 if (sotopf(so) == PF_INET6) 255 inp->inp_flags = INP_IPV6; 256 inp->inp_cksum6 = -1; 257 #endif /* INET6 */ 258 259 if (table->inpt_count++ > INPCBHASH_LOADFACTOR(table->inpt_size)) 260 (void)in_pcbresize(table, table->inpt_size * 2); 261 TAILQ_INSERT_HEAD(&table->inpt_queue, inp, inp_queue); 262 head = in_pcblhash(table, inp->inp_rtableid, inp->inp_lport); 263 LIST_INSERT_HEAD(head, inp, inp_lhash); 264 #ifdef INET6 265 if (sotopf(so) == PF_INET6) 266 head = in6_pcbhash(table, rtable_l2(inp->inp_rtableid), 267 &inp->inp_faddr6, inp->inp_fport, 268 &inp->inp_laddr6, inp->inp_lport); 269 else 270 #endif /* INET6 */ 271 head = in_pcbhash(table, rtable_l2(inp->inp_rtableid), 272 &inp->inp_faddr, inp->inp_fport, 273 &inp->inp_laddr, inp->inp_lport); 274 LIST_INSERT_HEAD(head, inp, inp_hash); 275 so->so_pcb = inp; 276 277 return (0); 278 } 279 280 int 281 in_pcbbind(struct inpcb *inp, struct mbuf *nam, struct proc *p) 282 { 283 struct socket *so = inp->inp_socket; 284 u_int16_t lport = 0; 285 int wild = 0; 286 void *laddr = &zeroin46_addr; 287 int error; 288 289 if (inp->inp_lport) 290 return (EINVAL); 291 292 if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0 && 293 ((so->so_proto->pr_flags & PR_CONNREQUIRED) == 0 || 294 (so->so_options & SO_ACCEPTCONN) == 0)) 295 wild = INPLOOKUP_WILDCARD; 296 297 switch (sotopf(so)) { 298 #ifdef INET6 299 case PF_INET6: 300 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6)) 301 return (EINVAL); 302 wild |= INPLOOKUP_IPV6; 303 304 if (nam) { 305 struct sockaddr_in6 *sin6; 306 307 if ((error = in6_nam2sin6(nam, &sin6))) 308 return (error); 309 if ((error = in6_pcbaddrisavail(inp, sin6, wild, p))) 310 return (error); 311 laddr = &sin6->sin6_addr; 312 lport = sin6->sin6_port; 313 } 314 break; 315 #endif 316 case PF_INET: 317 if (inp->inp_laddr.s_addr != INADDR_ANY) 318 return (EINVAL); 319 320 if (nam) { 321 struct sockaddr_in *sin; 322 323 if ((error = in_nam2sin(nam, &sin))) 324 return (error); 325 if ((error = in_pcbaddrisavail(inp, sin, wild, p))) 326 return (error); 327 laddr = &sin->sin_addr; 328 lport = sin->sin_port; 329 } 330 break; 331 default: 332 return (EINVAL); 333 } 334 335 if (lport == 0) { 336 if ((error = in_pcbpickport(&lport, laddr, wild, inp, p))) 337 return (error); 338 } else { 339 if (in_rootonly(ntohs(lport), so->so_proto->pr_protocol) && 340 suser(p) != 0) 341 return (EACCES); 342 } 343 if (nam) { 344 switch (sotopf(so)) { 345 #ifdef INET6 346 case PF_INET6: 347 inp->inp_laddr6 = *(struct in6_addr *)laddr; 348 break; 349 #endif 350 case PF_INET: 351 inp->inp_laddr = *(struct in_addr *)laddr; 352 break; 353 } 354 } 355 inp->inp_lport = lport; 356 in_pcbrehash(inp); 357 return (0); 358 } 359 360 int 361 in_pcbaddrisavail(struct inpcb *inp, struct sockaddr_in *sin, int wild, 362 struct proc *p) 363 { 364 struct socket *so = inp->inp_socket; 365 struct inpcbtable *table = inp->inp_table; 366 u_int16_t lport = sin->sin_port; 367 int reuseport = (so->so_options & SO_REUSEPORT); 368 369 if (IN_MULTICAST(sin->sin_addr.s_addr)) { 370 /* 371 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast; 372 * allow complete duplication of binding if 373 * SO_REUSEPORT is set, or if SO_REUSEADDR is set 374 * and a multicast address is bound on both 375 * new and duplicated sockets. 376 */ 377 if (so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) 378 reuseport = SO_REUSEADDR|SO_REUSEPORT; 379 } else if (sin->sin_addr.s_addr != INADDR_ANY) { 380 /* 381 * we must check that we are binding to an address we 382 * own except when: 383 * - SO_BINDANY is set or 384 * - we are binding a UDP socket to 255.255.255.255 or 385 * - we are binding a UDP socket to one of our broadcast 386 * addresses 387 */ 388 if (!ISSET(so->so_options, SO_BINDANY) && 389 !(so->so_type == SOCK_DGRAM && 390 sin->sin_addr.s_addr == INADDR_BROADCAST) && 391 !(so->so_type == SOCK_DGRAM && 392 in_broadcast(sin->sin_addr, inp->inp_rtableid))) { 393 struct ifaddr *ia; 394 395 sin->sin_port = 0; 396 memset(sin->sin_zero, 0, sizeof(sin->sin_zero)); 397 ia = ifa_ifwithaddr(sintosa(sin), inp->inp_rtableid); 398 sin->sin_port = lport; 399 400 if (ia == NULL) 401 return (EADDRNOTAVAIL); 402 } 403 } 404 if (lport) { 405 struct inpcb *t; 406 407 if (so->so_euid) { 408 t = in_pcblookup_local(table, &sin->sin_addr, lport, 409 INPLOOKUP_WILDCARD, inp->inp_rtableid); 410 if (t && (so->so_euid != t->inp_socket->so_euid)) 411 return (EADDRINUSE); 412 } 413 t = in_pcblookup_local(table, &sin->sin_addr, lport, 414 wild, inp->inp_rtableid); 415 if (t && (reuseport & t->inp_socket->so_options) == 0) 416 return (EADDRINUSE); 417 } 418 419 return (0); 420 } 421 422 int 423 in_pcbpickport(u_int16_t *lport, void *laddr, int wild, struct inpcb *inp, 424 struct proc *p) 425 { 426 struct socket *so = inp->inp_socket; 427 struct inpcbtable *table = inp->inp_table; 428 u_int16_t first, last, lower, higher, candidate, localport; 429 int count; 430 431 if (inp->inp_flags & INP_HIGHPORT) { 432 first = ipport_hifirstauto; /* sysctl */ 433 last = ipport_hilastauto; 434 } else if (inp->inp_flags & INP_LOWPORT) { 435 if (suser(p)) 436 return (EACCES); 437 first = IPPORT_RESERVED-1; /* 1023 */ 438 last = 600; /* not IPPORT_RESERVED/2 */ 439 } else { 440 first = ipport_firstauto; /* sysctl */ 441 last = ipport_lastauto; 442 } 443 if (first < last) { 444 lower = first; 445 higher = last; 446 } else { 447 lower = last; 448 higher = first; 449 } 450 451 /* 452 * Simple check to ensure all ports are not used up causing 453 * a deadlock here. 454 */ 455 456 count = higher - lower; 457 candidate = lower + arc4random_uniform(count); 458 459 do { 460 if (count-- < 0) /* completely used? */ 461 return (EADDRNOTAVAIL); 462 ++candidate; 463 if (candidate < lower || candidate > higher) 464 candidate = lower; 465 localport = htons(candidate); 466 } while (in_baddynamic(candidate, so->so_proto->pr_protocol) || 467 in_pcblookup_local(table, laddr, localport, wild, 468 inp->inp_rtableid)); 469 *lport = localport; 470 471 return (0); 472 } 473 474 /* 475 * Connect from a socket to a specified address. 476 * Both address and port must be specified in argument sin. 477 * If don't have a local address for this socket yet, 478 * then pick one. 479 */ 480 int 481 in_pcbconnect(struct inpcb *inp, struct mbuf *nam) 482 { 483 struct in_addr *ina = NULL; 484 struct sockaddr_in *sin; 485 int error; 486 487 #ifdef INET6 488 if (sotopf(inp->inp_socket) == PF_INET6) 489 return (in6_pcbconnect(inp, nam)); 490 KASSERT((inp->inp_flags & INP_IPV6) == 0); 491 #endif /* INET6 */ 492 493 if ((error = in_nam2sin(nam, &sin))) 494 return (error); 495 if (sin->sin_port == 0) 496 return (EADDRNOTAVAIL); 497 error = in_pcbselsrc(&ina, sin, inp); 498 if (error) 499 return (error); 500 501 if (in_pcbhashlookup(inp->inp_table, sin->sin_addr, sin->sin_port, 502 *ina, inp->inp_lport, inp->inp_rtableid) != NULL) 503 return (EADDRINUSE); 504 505 KASSERT(inp->inp_laddr.s_addr == INADDR_ANY || inp->inp_lport); 506 507 if (inp->inp_laddr.s_addr == INADDR_ANY) { 508 if (inp->inp_lport == 0) { 509 error = in_pcbbind(inp, NULL, curproc); 510 if (error) 511 return (error); 512 if (in_pcbhashlookup(inp->inp_table, sin->sin_addr, 513 sin->sin_port, *ina, inp->inp_lport, 514 inp->inp_rtableid) != NULL) { 515 inp->inp_lport = 0; 516 return (EADDRINUSE); 517 } 518 } 519 inp->inp_laddr = *ina; 520 } 521 inp->inp_faddr = sin->sin_addr; 522 inp->inp_fport = sin->sin_port; 523 in_pcbrehash(inp); 524 #if NSTOEPLITZ > 0 525 inp->inp_flowid = stoeplitz_ip4port(inp->inp_faddr.s_addr, 526 inp->inp_laddr.s_addr, inp->inp_fport, inp->inp_lport); 527 #endif 528 return (0); 529 } 530 531 void 532 in_pcbdisconnect(struct inpcb *inp) 533 { 534 #if NPF > 0 535 if (inp->inp_pf_sk) { 536 pf_remove_divert_state(inp->inp_pf_sk); 537 /* pf_remove_divert_state() may have detached the state */ 538 pf_inp_unlink(inp); 539 } 540 #endif 541 switch (sotopf(inp->inp_socket)) { 542 #ifdef INET6 543 case PF_INET6: 544 inp->inp_faddr6 = in6addr_any; 545 break; 546 #endif 547 case PF_INET: 548 inp->inp_faddr.s_addr = INADDR_ANY; 549 break; 550 } 551 552 inp->inp_fport = 0; 553 inp->inp_flowid = 0; 554 in_pcbrehash(inp); 555 if (inp->inp_socket->so_state & SS_NOFDREF) 556 in_pcbdetach(inp); 557 } 558 559 void 560 in_pcbdetach(struct inpcb *inp) 561 { 562 struct socket *so = inp->inp_socket; 563 564 NET_ASSERT_LOCKED(); 565 566 so->so_pcb = NULL; 567 /* 568 * As long as the NET_LOCK() is the default lock for Internet 569 * sockets, do not release it to not introduce new sleeping 570 * points. 571 */ 572 sofree(so, SL_NOUNLOCK); 573 m_freem(inp->inp_options); 574 if (inp->inp_route.ro_rt) { 575 rtfree(inp->inp_route.ro_rt); 576 inp->inp_route.ro_rt = NULL; 577 } 578 #ifdef INET6 579 if (inp->inp_flags & INP_IPV6) { 580 ip6_freepcbopts(inp->inp_outputopts6); 581 ip6_freemoptions(inp->inp_moptions6); 582 } else 583 #endif 584 ip_freemoptions(inp->inp_moptions); 585 #if NPF > 0 586 if (inp->inp_pf_sk) { 587 pf_remove_divert_state(inp->inp_pf_sk); 588 /* pf_remove_divert_state() may have detached the state */ 589 pf_inp_unlink(inp); 590 } 591 #endif 592 LIST_REMOVE(inp, inp_lhash); 593 LIST_REMOVE(inp, inp_hash); 594 TAILQ_REMOVE(&inp->inp_table->inpt_queue, inp, inp_queue); 595 inp->inp_table->inpt_count--; 596 in_pcbunref(inp); 597 } 598 599 struct inpcb * 600 in_pcbref(struct inpcb *inp) 601 { 602 if (inp != NULL) 603 refcnt_take(&inp->inp_refcnt); 604 return inp; 605 } 606 607 void 608 in_pcbunref(struct inpcb *inp) 609 { 610 if (refcnt_rele(&inp->inp_refcnt)) { 611 KASSERT((LIST_NEXT(inp, inp_hash) == NULL) || 612 (LIST_NEXT(inp, inp_hash) == _Q_INVALID)); 613 KASSERT((LIST_NEXT(inp, inp_lhash) == NULL) || 614 (LIST_NEXT(inp, inp_lhash) == _Q_INVALID)); 615 KASSERT((TAILQ_NEXT(inp, inp_queue) == NULL) || 616 (TAILQ_NEXT(inp, inp_queue) == _Q_INVALID)); 617 pool_put(&inpcb_pool, inp); 618 } 619 } 620 621 void 622 in_setsockaddr(struct inpcb *inp, struct mbuf *nam) 623 { 624 struct sockaddr_in *sin; 625 626 nam->m_len = sizeof(*sin); 627 sin = mtod(nam, struct sockaddr_in *); 628 memset(sin, 0, sizeof(*sin)); 629 sin->sin_family = AF_INET; 630 sin->sin_len = sizeof(*sin); 631 sin->sin_port = inp->inp_lport; 632 sin->sin_addr = inp->inp_laddr; 633 } 634 635 void 636 in_setpeeraddr(struct inpcb *inp, struct mbuf *nam) 637 { 638 struct sockaddr_in *sin; 639 640 #ifdef INET6 641 if (sotopf(inp->inp_socket) == PF_INET6) { 642 in6_setpeeraddr(inp, nam); 643 return; 644 } 645 #endif /* INET6 */ 646 647 nam->m_len = sizeof(*sin); 648 sin = mtod(nam, struct sockaddr_in *); 649 memset(sin, 0, sizeof(*sin)); 650 sin->sin_family = AF_INET; 651 sin->sin_len = sizeof(*sin); 652 sin->sin_port = inp->inp_fport; 653 sin->sin_addr = inp->inp_faddr; 654 } 655 656 /* 657 * Pass some notification to all connections of a protocol 658 * associated with address dst. The "usual action" will be 659 * taken, depending on the ctlinput cmd. The caller must filter any 660 * cmds that are uninteresting (e.g., no error in the map). 661 * Call the protocol specific routine (if any) to report 662 * any errors for each matching socket. 663 */ 664 void 665 in_pcbnotifyall(struct inpcbtable *table, struct sockaddr *dst, u_int rtable, 666 int errno, void (*notify)(struct inpcb *, int)) 667 { 668 struct inpcb *inp, *ninp; 669 struct in_addr faddr; 670 u_int rdomain; 671 672 NET_ASSERT_LOCKED(); 673 674 #ifdef INET6 675 /* 676 * See in6_pcbnotify() for IPv6 codepath. By the time this 677 * gets called, the addresses passed are either definitely IPv4 or 678 * IPv6; *_pcbnotify() never gets called with v4-mapped v6 addresses. 679 */ 680 #endif /* INET6 */ 681 682 if (dst->sa_family != AF_INET) 683 return; 684 faddr = satosin(dst)->sin_addr; 685 if (faddr.s_addr == INADDR_ANY) 686 return; 687 688 rdomain = rtable_l2(rtable); 689 TAILQ_FOREACH_SAFE(inp, &table->inpt_queue, inp_queue, ninp) { 690 #ifdef INET6 691 if (inp->inp_flags & INP_IPV6) 692 continue; 693 #endif 694 if (inp->inp_faddr.s_addr != faddr.s_addr || 695 rtable_l2(inp->inp_rtableid) != rdomain || 696 inp->inp_socket == NULL) { 697 continue; 698 } 699 if (notify) 700 (*notify)(inp, errno); 701 } 702 } 703 704 /* 705 * Check for alternatives when higher level complains 706 * about service problems. For now, invalidate cached 707 * routing information. If the route was created dynamically 708 * (by a redirect), time to try a default gateway again. 709 */ 710 void 711 in_losing(struct inpcb *inp) 712 { 713 struct rtentry *rt = inp->inp_route.ro_rt; 714 715 if (rt) { 716 inp->inp_route.ro_rt = NULL; 717 718 if (rt->rt_flags & RTF_DYNAMIC) { 719 struct ifnet *ifp; 720 721 ifp = if_get(rt->rt_ifidx); 722 /* 723 * If the interface is gone, all its attached 724 * route entries have been removed from the table, 725 * so we're dealing with a stale cache and have 726 * nothing to do. 727 */ 728 if (ifp != NULL) 729 rtdeletemsg(rt, ifp, inp->inp_rtableid); 730 if_put(ifp); 731 } 732 /* 733 * A new route can be allocated 734 * the next time output is attempted. 735 * rtfree() needs to be called in anycase because the inp 736 * is still holding a reference to rt. 737 */ 738 rtfree(rt); 739 } 740 } 741 742 /* 743 * After a routing change, flush old routing 744 * and allocate a (hopefully) better one. 745 */ 746 void 747 in_rtchange(struct inpcb *inp, int errno) 748 { 749 if (inp->inp_route.ro_rt) { 750 rtfree(inp->inp_route.ro_rt); 751 inp->inp_route.ro_rt = 0; 752 /* 753 * A new route can be allocated the next time 754 * output is attempted. 755 */ 756 } 757 } 758 759 struct inpcb * 760 in_pcblookup_local(struct inpcbtable *table, void *laddrp, u_int lport_arg, 761 int flags, u_int rtable) 762 { 763 struct inpcb *inp, *match = NULL; 764 int matchwild = 3, wildcard; 765 u_int16_t lport = lport_arg; 766 struct in_addr laddr = *(struct in_addr *)laddrp; 767 #ifdef INET6 768 struct in6_addr *laddr6 = (struct in6_addr *)laddrp; 769 #endif 770 struct inpcbhead *head; 771 u_int rdomain; 772 773 rdomain = rtable_l2(rtable); 774 head = in_pcblhash(table, rdomain, lport); 775 LIST_FOREACH(inp, head, inp_lhash) { 776 if (rtable_l2(inp->inp_rtableid) != rdomain) 777 continue; 778 if (inp->inp_lport != lport) 779 continue; 780 wildcard = 0; 781 #ifdef INET6 782 if (ISSET(flags, INPLOOKUP_IPV6)) { 783 if (!ISSET(inp->inp_flags, INP_IPV6)) 784 continue; 785 786 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6)) 787 wildcard++; 788 789 if (!IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6, laddr6)) { 790 if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6) || 791 IN6_IS_ADDR_UNSPECIFIED(laddr6)) 792 wildcard++; 793 else 794 continue; 795 } 796 797 } else 798 #endif /* INET6 */ 799 { 800 #ifdef INET6 801 if (ISSET(inp->inp_flags, INP_IPV6)) 802 continue; 803 #endif /* INET6 */ 804 805 if (inp->inp_faddr.s_addr != INADDR_ANY) 806 wildcard++; 807 808 if (inp->inp_laddr.s_addr != laddr.s_addr) { 809 if (inp->inp_laddr.s_addr == INADDR_ANY || 810 laddr.s_addr == INADDR_ANY) 811 wildcard++; 812 else 813 continue; 814 } 815 816 } 817 if ((!wildcard || (flags & INPLOOKUP_WILDCARD)) && 818 wildcard < matchwild) { 819 match = inp; 820 if ((matchwild = wildcard) == 0) 821 break; 822 } 823 } 824 return (match); 825 } 826 827 struct rtentry * 828 in_pcbrtentry(struct inpcb *inp) 829 { 830 struct route *ro; 831 832 ro = &inp->inp_route; 833 834 /* check if route is still valid */ 835 if (!rtisvalid(ro->ro_rt)) { 836 rtfree(ro->ro_rt); 837 ro->ro_rt = NULL; 838 } 839 840 /* 841 * No route yet, so try to acquire one. 842 */ 843 if (ro->ro_rt == NULL) { 844 #ifdef INET6 845 memset(ro, 0, sizeof(struct route_in6)); 846 #else 847 memset(ro, 0, sizeof(struct route)); 848 #endif 849 850 switch(sotopf(inp->inp_socket)) { 851 #ifdef INET6 852 case PF_INET6: 853 if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6)) 854 break; 855 ro->ro_dst.sa_family = AF_INET6; 856 ro->ro_dst.sa_len = sizeof(struct sockaddr_in6); 857 satosin6(&ro->ro_dst)->sin6_addr = inp->inp_faddr6; 858 ro->ro_tableid = inp->inp_rtableid; 859 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, 860 &inp->inp_laddr6.s6_addr32[0], ro->ro_tableid); 861 break; 862 #endif /* INET6 */ 863 case PF_INET: 864 if (inp->inp_faddr.s_addr == INADDR_ANY) 865 break; 866 ro->ro_dst.sa_family = AF_INET; 867 ro->ro_dst.sa_len = sizeof(struct sockaddr_in); 868 satosin(&ro->ro_dst)->sin_addr = inp->inp_faddr; 869 ro->ro_tableid = inp->inp_rtableid; 870 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, 871 &inp->inp_laddr.s_addr, ro->ro_tableid); 872 break; 873 } 874 } 875 return (ro->ro_rt); 876 } 877 878 /* 879 * Return an IPv4 address, which is the most appropriate for a given 880 * destination. 881 * If necessary, this function lookups the routing table and returns 882 * an entry to the caller for later use. 883 */ 884 int 885 in_pcbselsrc(struct in_addr **insrc, struct sockaddr_in *sin, 886 struct inpcb *inp) 887 { 888 struct ip_moptions *mopts = inp->inp_moptions; 889 struct route *ro = &inp->inp_route; 890 struct in_addr *laddr = &inp->inp_laddr; 891 u_int rtableid = inp->inp_rtableid; 892 struct sockaddr *ip4_source = NULL; 893 894 struct sockaddr_in *sin2; 895 struct in_ifaddr *ia = NULL; 896 897 /* 898 * If the socket(if any) is already bound, use that bound address 899 * unless it is INADDR_ANY or INADDR_BROADCAST. 900 */ 901 if (laddr && laddr->s_addr != INADDR_ANY && 902 laddr->s_addr != INADDR_BROADCAST) { 903 *insrc = laddr; 904 return (0); 905 } 906 907 /* 908 * If the destination address is multicast and an outgoing 909 * interface has been set as a multicast option, use the 910 * address of that interface as our source address. 911 */ 912 if (IN_MULTICAST(sin->sin_addr.s_addr) && mopts != NULL) { 913 struct ifnet *ifp; 914 915 ifp = if_get(mopts->imo_ifidx); 916 if (ifp != NULL) { 917 if (ifp->if_rdomain == rtable_l2(rtableid)) 918 IFP_TO_IA(ifp, ia); 919 if (ia == NULL) { 920 if_put(ifp); 921 return (EADDRNOTAVAIL); 922 } 923 924 *insrc = &ia->ia_addr.sin_addr; 925 if_put(ifp); 926 return (0); 927 } 928 } 929 930 /* 931 * If route is known or can be allocated now, 932 * our src addr is taken from the i/f, else punt. 933 */ 934 if (!rtisvalid(ro->ro_rt) || (ro->ro_tableid != rtableid) || 935 (satosin(&ro->ro_dst)->sin_addr.s_addr != sin->sin_addr.s_addr)) { 936 rtfree(ro->ro_rt); 937 ro->ro_rt = NULL; 938 } 939 if (ro->ro_rt == NULL) { 940 /* No route yet, so try to acquire one */ 941 ro->ro_dst.sa_family = AF_INET; 942 ro->ro_dst.sa_len = sizeof(struct sockaddr_in); 943 satosin(&ro->ro_dst)->sin_addr = sin->sin_addr; 944 ro->ro_tableid = rtableid; 945 ro->ro_rt = rtalloc_mpath(&ro->ro_dst, NULL, ro->ro_tableid); 946 947 /* 948 * It is important to zero out the rest of the 949 * struct sockaddr_in when mixing v6 & v4! 950 */ 951 sin2 = satosin(&ro->ro_dst); 952 memset(sin2->sin_zero, 0, sizeof(sin2->sin_zero)); 953 } 954 955 /* 956 * If we found a route, use the address 957 * corresponding to the outgoing interface. 958 */ 959 if (ro->ro_rt != NULL) 960 ia = ifatoia(ro->ro_rt->rt_ifa); 961 962 /* 963 * Use preferred source address if : 964 * - destination is not onlink 965 * - preferred source address is set 966 * - output interface is UP 967 */ 968 if (ro->ro_rt && !(ro->ro_rt->rt_flags & RTF_LLINFO) && 969 !(ro->ro_rt->rt_flags & RTF_HOST)) { 970 ip4_source = rtable_getsource(rtableid, AF_INET); 971 if (ip4_source != NULL) { 972 struct ifaddr *ifa; 973 if ((ifa = ifa_ifwithaddr(ip4_source, rtableid)) != 974 NULL && ISSET(ifa->ifa_ifp->if_flags, IFF_UP)) { 975 *insrc = &satosin(ip4_source)->sin_addr; 976 return (0); 977 } 978 } 979 } 980 981 if (ia == NULL) 982 return (EADDRNOTAVAIL); 983 984 *insrc = &ia->ia_addr.sin_addr; 985 return (0); 986 } 987 988 void 989 in_pcbrehash(struct inpcb *inp) 990 { 991 struct inpcbtable *table = inp->inp_table; 992 struct inpcbhead *head; 993 994 NET_ASSERT_LOCKED(); 995 996 LIST_REMOVE(inp, inp_lhash); 997 head = in_pcblhash(table, inp->inp_rtableid, inp->inp_lport); 998 LIST_INSERT_HEAD(head, inp, inp_lhash); 999 LIST_REMOVE(inp, inp_hash); 1000 #ifdef INET6 1001 if (inp->inp_flags & INP_IPV6) 1002 head = in6_pcbhash(table, rtable_l2(inp->inp_rtableid), 1003 &inp->inp_faddr6, inp->inp_fport, 1004 &inp->inp_laddr6, inp->inp_lport); 1005 else 1006 #endif /* INET6 */ 1007 head = in_pcbhash(table, rtable_l2(inp->inp_rtableid), 1008 &inp->inp_faddr, inp->inp_fport, 1009 &inp->inp_laddr, inp->inp_lport); 1010 LIST_INSERT_HEAD(head, inp, inp_hash); 1011 } 1012 1013 int 1014 in_pcbresize(struct inpcbtable *table, int hashsize) 1015 { 1016 u_long nmask, nlmask; 1017 int osize; 1018 void *nhashtbl, *nlhashtbl, *ohashtbl, *olhashtbl; 1019 struct inpcb *inp; 1020 1021 ohashtbl = table->inpt_hashtbl; 1022 olhashtbl = table->inpt_lhashtbl; 1023 osize = table->inpt_size; 1024 1025 nhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nmask); 1026 if (nhashtbl == NULL) 1027 return ENOBUFS; 1028 nlhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nlmask); 1029 if (nlhashtbl == NULL) { 1030 hashfree(nhashtbl, hashsize, M_PCB); 1031 return ENOBUFS; 1032 } 1033 table->inpt_hashtbl = nhashtbl; 1034 table->inpt_lhashtbl = nlhashtbl; 1035 table->inpt_mask = nmask; 1036 table->inpt_lmask = nlmask; 1037 table->inpt_size = hashsize; 1038 arc4random_buf(&table->inpt_key, sizeof(table->inpt_key)); 1039 arc4random_buf(&table->inpt_lkey, sizeof(table->inpt_lkey)); 1040 1041 TAILQ_FOREACH(inp, &table->inpt_queue, inp_queue) { 1042 in_pcbrehash(inp); 1043 } 1044 hashfree(ohashtbl, osize, M_PCB); 1045 hashfree(olhashtbl, osize, M_PCB); 1046 1047 return (0); 1048 } 1049 1050 #ifdef DIAGNOSTIC 1051 int in_pcbnotifymiss = 0; 1052 #endif 1053 1054 /* 1055 * The in(6)_pcbhashlookup functions are used to locate connected sockets 1056 * quickly: 1057 * faddr.fport <-> laddr.lport 1058 * No wildcard matching is done so that listening sockets are not found. 1059 * If the functions return NULL in(6)_pcblookup_listen can be used to 1060 * find a listening/bound socket that may accept the connection. 1061 * After those two lookups no other are necessary. 1062 */ 1063 struct inpcb * 1064 in_pcbhashlookup(struct inpcbtable *table, struct in_addr faddr, 1065 u_int fport_arg, struct in_addr laddr, u_int lport_arg, u_int rtable) 1066 { 1067 struct inpcbhead *head; 1068 struct inpcb *inp; 1069 u_int16_t fport = fport_arg, lport = lport_arg; 1070 u_int rdomain; 1071 1072 rdomain = rtable_l2(rtable); 1073 head = in_pcbhash(table, rdomain, &faddr, fport, &laddr, lport); 1074 LIST_FOREACH(inp, head, inp_hash) { 1075 #ifdef INET6 1076 if (inp->inp_flags & INP_IPV6) 1077 continue; /*XXX*/ 1078 #endif 1079 if (inp->inp_faddr.s_addr == faddr.s_addr && 1080 inp->inp_fport == fport && inp->inp_lport == lport && 1081 inp->inp_laddr.s_addr == laddr.s_addr && 1082 rtable_l2(inp->inp_rtableid) == rdomain) { 1083 /* 1084 * Move this PCB to the head of hash chain so that 1085 * repeated accesses are quicker. This is analogous to 1086 * the historic single-entry PCB cache. 1087 */ 1088 if (inp != LIST_FIRST(head)) { 1089 LIST_REMOVE(inp, inp_hash); 1090 LIST_INSERT_HEAD(head, inp, inp_hash); 1091 } 1092 break; 1093 } 1094 } 1095 #ifdef DIAGNOSTIC 1096 if (inp == NULL && in_pcbnotifymiss) { 1097 printf("%s: faddr=%08x fport=%d laddr=%08x lport=%d rdom=%u\n", 1098 __func__, ntohl(faddr.s_addr), ntohs(fport), 1099 ntohl(laddr.s_addr), ntohs(lport), rdomain); 1100 } 1101 #endif 1102 return (inp); 1103 } 1104 1105 /* 1106 * The in(6)_pcblookup_listen functions are used to locate listening 1107 * sockets quickly. This are sockets with unspecified foreign address 1108 * and port: 1109 * *.* <-> laddr.lport 1110 * *.* <-> *.lport 1111 */ 1112 struct inpcb * 1113 in_pcblookup_listen(struct inpcbtable *table, struct in_addr laddr, 1114 u_int lport_arg, struct mbuf *m, u_int rtable) 1115 { 1116 struct inpcbhead *head; 1117 const struct in_addr *key1, *key2; 1118 struct inpcb *inp; 1119 u_int16_t lport = lport_arg; 1120 u_int rdomain; 1121 1122 key1 = &laddr; 1123 key2 = &zeroin_addr; 1124 #if NPF > 0 1125 if (m && m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) { 1126 struct pf_divert *divert; 1127 1128 divert = pf_find_divert(m); 1129 KASSERT(divert != NULL); 1130 switch (divert->type) { 1131 case PF_DIVERT_TO: 1132 key1 = key2 = &divert->addr.v4; 1133 lport = divert->port; 1134 break; 1135 case PF_DIVERT_REPLY: 1136 return (NULL); 1137 default: 1138 panic("%s: unknown divert type %d, mbuf %p, divert %p", 1139 __func__, divert->type, m, divert); 1140 } 1141 } else if (m && m->m_pkthdr.pf.flags & PF_TAG_TRANSLATE_LOCALHOST) { 1142 /* 1143 * Redirected connections should not be treated the same 1144 * as connections directed to 127.0.0.0/8 since localhost 1145 * can only be accessed from the host itself. 1146 * For example portmap(8) grants more permissions for 1147 * connections to the socket bound to 127.0.0.1 than 1148 * to the * socket. 1149 */ 1150 key1 = &zeroin_addr; 1151 key2 = &laddr; 1152 } 1153 #endif 1154 1155 rdomain = rtable_l2(rtable); 1156 head = in_pcbhash(table, rdomain, &zeroin_addr, 0, key1, lport); 1157 LIST_FOREACH(inp, head, inp_hash) { 1158 #ifdef INET6 1159 if (inp->inp_flags & INP_IPV6) 1160 continue; /*XXX*/ 1161 #endif 1162 if (inp->inp_lport == lport && inp->inp_fport == 0 && 1163 inp->inp_laddr.s_addr == key1->s_addr && 1164 inp->inp_faddr.s_addr == INADDR_ANY && 1165 rtable_l2(inp->inp_rtableid) == rdomain) 1166 break; 1167 } 1168 if (inp == NULL && key1->s_addr != key2->s_addr) { 1169 head = in_pcbhash(table, rdomain, 1170 &zeroin_addr, 0, key2, lport); 1171 LIST_FOREACH(inp, head, inp_hash) { 1172 #ifdef INET6 1173 if (inp->inp_flags & INP_IPV6) 1174 continue; /*XXX*/ 1175 #endif 1176 if (inp->inp_lport == lport && inp->inp_fport == 0 && 1177 inp->inp_laddr.s_addr == key2->s_addr && 1178 inp->inp_faddr.s_addr == INADDR_ANY && 1179 rtable_l2(inp->inp_rtableid) == rdomain) 1180 break; 1181 } 1182 } 1183 /* 1184 * Move this PCB to the head of hash chain so that 1185 * repeated accesses are quicker. This is analogous to 1186 * the historic single-entry PCB cache. 1187 */ 1188 if (inp != NULL && inp != LIST_FIRST(head)) { 1189 LIST_REMOVE(inp, inp_hash); 1190 LIST_INSERT_HEAD(head, inp, inp_hash); 1191 } 1192 #ifdef DIAGNOSTIC 1193 if (inp == NULL && in_pcbnotifymiss) { 1194 printf("%s: laddr=%08x lport=%d rdom=%u\n", 1195 __func__, ntohl(laddr.s_addr), ntohs(lport), rdomain); 1196 } 1197 #endif 1198 return (inp); 1199 } 1200