xref: /openbsd-src/sys/netinet/udp_usrreq.c (revision aa997e528a848ca5596493c2a801bdd6fb26ae61)
1 /*	$OpenBSD: udp_usrreq.c,v 1.246 2018/04/06 10:59:11 bluhm Exp $	*/
2 /*	$NetBSD: udp_usrreq.c,v 1.28 1996/03/16 23:54:03 christos Exp $	*/
3 
4 /*
5  * Copyright (c) 1982, 1986, 1988, 1990, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	@(#)COPYRIGHT	1.1 (NRL) 17 January 1995
33  *
34  * NRL grants permission for redistribution and use in source and binary
35  * forms, with or without modification, of the software and documentation
36  * created at NRL provided that the following conditions are met:
37  *
38  * 1. Redistributions of source code must retain the above copyright
39  *    notice, this list of conditions and the following disclaimer.
40  * 2. Redistributions in binary form must reproduce the above copyright
41  *    notice, this list of conditions and the following disclaimer in the
42  *    documentation and/or other materials provided with the distribution.
43  * 3. All advertising materials mentioning features or use of this software
44  *    must display the following acknowledgements:
45  * 	This product includes software developed by the University of
46  * 	California, Berkeley and its contributors.
47  * 	This product includes software developed at the Information
48  * 	Technology Division, US Naval Research Laboratory.
49  * 4. Neither the name of the NRL nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
54  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
55  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
56  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
57  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
58  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
59  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
60  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
61  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
62  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
63  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
64  *
65  * The views and conclusions contained in the software and documentation
66  * are those of the authors and should not be interpreted as representing
67  * official policies, either expressed or implied, of the US Naval
68  * Research Laboratory (NRL).
69  */
70 
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/mbuf.h>
74 #include <sys/protosw.h>
75 #include <sys/socket.h>
76 #include <sys/socketvar.h>
77 #include <sys/sysctl.h>
78 #include <sys/domain.h>
79 
80 #include <net/if.h>
81 #include <net/if_var.h>
82 #include <net/if_media.h>
83 #include <net/route.h>
84 
85 #include <netinet/in.h>
86 #include <netinet/in_var.h>
87 #include <netinet/ip.h>
88 #include <netinet/in_pcb.h>
89 #include <netinet/ip_var.h>
90 #include <netinet/ip_icmp.h>
91 #include <netinet/udp.h>
92 #include <netinet/udp_var.h>
93 
94 #ifdef IPSEC
95 #include <netinet/ip_ipsp.h>
96 #include <netinet/ip_esp.h>
97 #endif
98 
99 #ifdef INET6
100 #include <netinet6/in6_var.h>
101 #include <netinet6/ip6_var.h>
102 #include <netinet6/ip6protosw.h>
103 #endif /* INET6 */
104 
105 #include "pf.h"
106 #if NPF > 0
107 #include <net/pfvar.h>
108 #endif
109 
110 #ifdef PIPEX
111 #include <netinet/if_ether.h>
112 #include <net/pipex.h>
113 #endif
114 
115 #include "vxlan.h"
116 #if NVXLAN > 0
117 #include <net/if_vxlan.h>
118 #endif
119 
120 /*
121  * UDP protocol implementation.
122  * Per RFC 768, August, 1980.
123  */
124 int	udpcksum = 1;
125 
126 u_int	udp_sendspace = 9216;		/* really max datagram size */
127 u_int	udp_recvspace = 40 * (1024 + sizeof(struct sockaddr_in));
128 					/* 40 1K datagrams */
129 
130 int *udpctl_vars[UDPCTL_MAXID] = UDPCTL_VARS;
131 
132 struct	inpcbtable udbtable;
133 struct	cpumem *udpcounters;
134 
135 int	udp_output(struct inpcb *, struct mbuf *, struct mbuf *, struct mbuf *);
136 void	udp_notify(struct inpcb *, int);
137 int	udp_sysctl_udpstat(void *, size_t *, void *);
138 
139 #ifndef	UDB_INITIAL_HASH_SIZE
140 #define	UDB_INITIAL_HASH_SIZE	128
141 #endif
142 
143 void
144 udp_init(void)
145 {
146 	udpcounters = counters_alloc(udps_ncounters);
147 	in_pcbinit(&udbtable, UDB_INITIAL_HASH_SIZE);
148 }
149 
150 int
151 udp_input(struct mbuf **mp, int *offp, int proto, int af)
152 {
153 	struct mbuf *m = *mp;
154 	int iphlen = *offp;
155 	struct ip *ip = NULL;
156 	struct udphdr *uh;
157 	struct inpcb *inp = NULL;
158 	struct mbuf *opts = NULL;
159 	struct ip save_ip;
160 	int len;
161 	u_int16_t savesum;
162 	union {
163 		struct sockaddr sa;
164 		struct sockaddr_in sin;
165 #ifdef INET6
166 		struct sockaddr_in6 sin6;
167 #endif /* INET6 */
168 	} srcsa, dstsa;
169 #ifdef INET6
170 	struct ip6_hdr *ip6 = NULL;
171 #endif /* INET6 */
172 #ifdef IPSEC
173 	struct m_tag *mtag;
174 	struct tdb_ident *tdbi;
175 	struct tdb *tdb;
176 	int error, protoff;
177 #endif /* IPSEC */
178 #if defined(IPSEC) || defined(PIPEX)
179 	u_int32_t ipsecflowinfo = 0;
180 #endif /* define(IPSEC) || defined(PIPEX) */
181 
182 	udpstat_inc(udps_ipackets);
183 
184 	IP6_EXTHDR_GET(uh, struct udphdr *, m, iphlen, sizeof(struct udphdr));
185 	if (!uh) {
186 		udpstat_inc(udps_hdrops);
187 		return IPPROTO_DONE;
188 	}
189 
190 	/* Check for illegal destination port 0 */
191 	if (uh->uh_dport == 0) {
192 		udpstat_inc(udps_noport);
193 		goto bad;
194 	}
195 
196 	/*
197 	 * Make mbuf data length reflect UDP length.
198 	 * If not enough data to reflect UDP length, drop.
199 	 */
200 	len = ntohs((u_int16_t)uh->uh_ulen);
201 	switch (af) {
202 	case AF_INET:
203 		if (m->m_pkthdr.len - iphlen != len) {
204 			if (len > (m->m_pkthdr.len - iphlen) ||
205 			    len < sizeof(struct udphdr)) {
206 				udpstat_inc(udps_badlen);
207 				goto bad;
208 			}
209 			m_adj(m, len - (m->m_pkthdr.len - iphlen));
210 		}
211 		ip = mtod(m, struct ip *);
212 		/*
213 		 * Save a copy of the IP header in case we want restore it
214 		 * for sending an ICMP error message in response.
215 		 */
216 		save_ip = *ip;
217 		break;
218 #ifdef INET6
219 	case AF_INET6:
220 		/* jumbograms */
221 		if (len == 0 && m->m_pkthdr.len - iphlen > 0xffff)
222 			len = m->m_pkthdr.len - iphlen;
223 		if (len != m->m_pkthdr.len - iphlen) {
224 			udpstat_inc(udps_badlen);
225 			goto bad;
226 		}
227 		ip6 = mtod(m, struct ip6_hdr *);
228 		break;
229 #endif /* INET6 */
230 	default:
231 		unhandled_af(af);
232 	}
233 
234 	/*
235 	 * Checksum extended UDP header and data.
236 	 * from W.R.Stevens: check incoming udp cksums even if
237 	 *	udpcksum is not set.
238 	 */
239 	savesum = uh->uh_sum;
240 	if (uh->uh_sum == 0) {
241 		udpstat_inc(udps_nosum);
242 #ifdef INET6
243 		/*
244 		 * In IPv6, the UDP checksum is ALWAYS used.
245 		 */
246 		if (ip6)
247 			goto bad;
248 #endif /* INET6 */
249 	} else {
250 		if ((m->m_pkthdr.csum_flags & M_UDP_CSUM_IN_OK) == 0) {
251 			if (m->m_pkthdr.csum_flags & M_UDP_CSUM_IN_BAD) {
252 				udpstat_inc(udps_badsum);
253 				goto bad;
254 			}
255 			udpstat_inc(udps_inswcsum);
256 
257 			if (ip)
258 				uh->uh_sum = in4_cksum(m, IPPROTO_UDP,
259 				    iphlen, len);
260 #ifdef INET6
261 			else if (ip6)
262 				uh->uh_sum = in6_cksum(m, IPPROTO_UDP,
263 				    iphlen, len);
264 #endif /* INET6 */
265 			if (uh->uh_sum != 0) {
266 				udpstat_inc(udps_badsum);
267 				goto bad;
268 			}
269 		}
270 	}
271 
272 #ifdef IPSEC
273 	if (udpencap_enable && udpencap_port &&
274 #if NPF > 0
275 	    !(m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) &&
276 #endif
277 	    uh->uh_dport == htons(udpencap_port)) {
278 		u_int32_t spi;
279 		int skip = iphlen + sizeof(struct udphdr);
280 
281 		if (m->m_pkthdr.len - skip < sizeof(u_int32_t)) {
282 			/* packet too short */
283 			m_freem(m);
284 			return IPPROTO_DONE;
285 		}
286 		m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
287 		/*
288 		 * decapsulate if the SPI is not zero, otherwise pass
289 		 * to userland
290 		 */
291 		if (spi != 0) {
292 			if ((m = *mp = m_pullup(m, skip)) == NULL) {
293 				udpstat_inc(udps_hdrops);
294 				return IPPROTO_DONE;
295 			}
296 
297 			/* remove the UDP header */
298 			bcopy(mtod(m, u_char *),
299 			    mtod(m, u_char *) + sizeof(struct udphdr), iphlen);
300 			m_adj(m, sizeof(struct udphdr));
301 			skip -= sizeof(struct udphdr);
302 
303 			espstat_inc(esps_udpencin);
304 			protoff = af == AF_INET ? offsetof(struct ip, ip_p) :
305 			    offsetof(struct ip6_hdr, ip6_nxt);
306 			ipsec_common_input(m, skip, protoff,
307 			    af, IPPROTO_ESP, 1);
308 			return IPPROTO_DONE;
309 		}
310 	}
311 #endif
312 
313 	switch (af) {
314 	case AF_INET:
315 		bzero(&srcsa, sizeof(struct sockaddr_in));
316 		srcsa.sin.sin_len = sizeof(struct sockaddr_in);
317 		srcsa.sin.sin_family = AF_INET;
318 		srcsa.sin.sin_port = uh->uh_sport;
319 		srcsa.sin.sin_addr = ip->ip_src;
320 
321 		bzero(&dstsa, sizeof(struct sockaddr_in));
322 		dstsa.sin.sin_len = sizeof(struct sockaddr_in);
323 		dstsa.sin.sin_family = AF_INET;
324 		dstsa.sin.sin_port = uh->uh_dport;
325 		dstsa.sin.sin_addr = ip->ip_dst;
326 		break;
327 #ifdef INET6
328 	case AF_INET6:
329 		bzero(&srcsa, sizeof(struct sockaddr_in6));
330 		srcsa.sin6.sin6_len = sizeof(struct sockaddr_in6);
331 		srcsa.sin6.sin6_family = AF_INET6;
332 		srcsa.sin6.sin6_port = uh->uh_sport;
333 #if 0 /*XXX inbound flowinfo */
334 		srcsa.sin6.sin6_flowinfo = htonl(0x0fffffff) & ip6->ip6_flow;
335 #endif
336 		/* KAME hack: recover scopeid */
337 		in6_recoverscope(&srcsa.sin6, &ip6->ip6_src);
338 
339 		bzero(&dstsa, sizeof(struct sockaddr_in6));
340 		dstsa.sin6.sin6_len = sizeof(struct sockaddr_in6);
341 		dstsa.sin6.sin6_family = AF_INET6;
342 		dstsa.sin6.sin6_port = uh->uh_dport;
343 #if 0 /*XXX inbound flowinfo */
344 		dstsa.sin6.sin6_flowinfo = htonl(0x0fffffff) & ip6->ip6_flow;
345 #endif
346 		/* KAME hack: recover scopeid */
347 		in6_recoverscope(&dstsa.sin6, &ip6->ip6_dst);
348 		break;
349 #endif /* INET6 */
350 	}
351 
352 #if NVXLAN > 0
353 	if (vxlan_enable > 0 &&
354 #if NPF > 0
355 	    !(m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) &&
356 #endif
357 	    vxlan_lookup(m, uh, iphlen, &srcsa.sa, &dstsa.sa) != 0)
358 		return IPPROTO_DONE;
359 #endif
360 
361 	if (m->m_flags & (M_BCAST|M_MCAST)) {
362 		struct inpcb *last;
363 		/*
364 		 * Deliver a multicast or broadcast datagram to *all* sockets
365 		 * for which the local and remote addresses and ports match
366 		 * those of the incoming datagram.  This allows more than
367 		 * one process to receive multi/broadcasts on the same port.
368 		 * (This really ought to be done for unicast datagrams as
369 		 * well, but that would cause problems with existing
370 		 * applications that open both address-specific sockets and
371 		 * a wildcard socket listening to the same port -- they would
372 		 * end up receiving duplicates of every unicast datagram.
373 		 * Those applications open the multiple sockets to overcome an
374 		 * inadequacy of the UDP socket interface, but for backwards
375 		 * compatibility we avoid the problem here rather than
376 		 * fixing the interface.  Maybe 4.5BSD will remedy this?)
377 		 */
378 
379 		iphlen += sizeof(struct udphdr);
380 
381 		/*
382 		 * Locate pcb(s) for datagram.
383 		 * (Algorithm copied from raw_intr().)
384 		 */
385 		last = NULL;
386 		NET_ASSERT_LOCKED();
387 		TAILQ_FOREACH(inp, &udbtable.inpt_queue, inp_queue) {
388 			if (inp->inp_socket->so_state & SS_CANTRCVMORE)
389 				continue;
390 #ifdef INET6
391 			/* don't accept it if AF does not match */
392 			if (ip6 && !(inp->inp_flags & INP_IPV6))
393 				continue;
394 			if (!ip6 && (inp->inp_flags & INP_IPV6))
395 				continue;
396 #endif
397 			if (rtable_l2(inp->inp_rtableid) !=
398 			    rtable_l2(m->m_pkthdr.ph_rtableid))
399 				continue;
400 			if (inp->inp_lport != uh->uh_dport)
401 				continue;
402 #ifdef INET6
403 			if (ip6) {
404 				if (inp->inp_ip6_minhlim &&
405 				    inp->inp_ip6_minhlim > ip6->ip6_hlim)
406 					continue;
407 				if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6))
408 					if (!IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6,
409 					    &ip6->ip6_dst))
410 						continue;
411 			} else
412 #endif /* INET6 */
413 			{
414 				if (inp->inp_ip_minttl &&
415 				    inp->inp_ip_minttl > ip->ip_ttl)
416 					continue;
417 
418 				if (inp->inp_laddr.s_addr != INADDR_ANY) {
419 					if (inp->inp_laddr.s_addr !=
420 					    ip->ip_dst.s_addr)
421 						continue;
422 				}
423 			}
424 #ifdef INET6
425 			if (ip6) {
426 				if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6))
427 					if (!IN6_ARE_ADDR_EQUAL(&inp->inp_faddr6,
428 					    &ip6->ip6_src) ||
429 					    inp->inp_fport != uh->uh_sport)
430 						continue;
431 			} else
432 #endif /* INET6 */
433 			if (inp->inp_faddr.s_addr != INADDR_ANY) {
434 				if (inp->inp_faddr.s_addr !=
435 				    ip->ip_src.s_addr ||
436 				    inp->inp_fport != uh->uh_sport)
437 					continue;
438 			}
439 
440 			if (last != NULL) {
441 				struct mbuf *n;
442 
443 				n = m_copym(m, 0, M_COPYALL, M_NOWAIT);
444 				if (n != NULL) {
445 #ifdef INET6
446 					if (ip6 && (last->inp_flags &
447 					    IN6P_CONTROLOPTS ||
448 					    last->inp_socket->so_options &
449 					    SO_TIMESTAMP))
450 						ip6_savecontrol(last, n, &opts);
451 #endif /* INET6 */
452 					if (ip && (last->inp_flags &
453 					    INP_CONTROLOPTS ||
454 					    last->inp_socket->so_options &
455 					    SO_TIMESTAMP))
456 						ip_savecontrol(last, &opts,
457 						    ip, n);
458 
459 					m_adj(n, iphlen);
460 					if (sbappendaddr(last->inp_socket,
461 					    &last->inp_socket->so_rcv,
462 					    &srcsa.sa, n, opts) == 0) {
463 						m_freem(n);
464 						m_freem(opts);
465 						udpstat_inc(udps_fullsock);
466 					} else
467 						sorwakeup(last->inp_socket);
468 					opts = NULL;
469 				}
470 			}
471 			last = inp;
472 			/*
473 			 * Don't look for additional matches if this one does
474 			 * not have either the SO_REUSEPORT or SO_REUSEADDR
475 			 * socket options set.  This heuristic avoids searching
476 			 * through all pcbs in the common case of a non-shared
477 			 * port.  It assumes that an application will never
478 			 * clear these options after setting them.
479 			 */
480 			if ((last->inp_socket->so_options & (SO_REUSEPORT |
481 			    SO_REUSEADDR)) == 0)
482 				break;
483 		}
484 
485 		if (last == NULL) {
486 			/*
487 			 * No matching pcb found; discard datagram.
488 			 * (No need to send an ICMP Port Unreachable
489 			 * for a broadcast or multicast datgram.)
490 			 */
491 			udpstat_inc(udps_noportbcast);
492 			goto bad;
493 		}
494 
495 #ifdef INET6
496 		if (ip6 && (last->inp_flags & IN6P_CONTROLOPTS ||
497 		    last->inp_socket->so_options & SO_TIMESTAMP))
498 			ip6_savecontrol(last, m, &opts);
499 #endif /* INET6 */
500 		if (ip && (last->inp_flags & INP_CONTROLOPTS ||
501 		    last->inp_socket->so_options & SO_TIMESTAMP))
502 			ip_savecontrol(last, &opts, ip, m);
503 
504 		m_adj(m, iphlen);
505 		if (sbappendaddr(last->inp_socket, &last->inp_socket->so_rcv,
506 		    &srcsa.sa, m, opts) == 0) {
507 			udpstat_inc(udps_fullsock);
508 			goto bad;
509 		}
510 		sorwakeup(last->inp_socket);
511 		return IPPROTO_DONE;
512 	}
513 	/*
514 	 * Locate pcb for datagram.
515 	 */
516 #if NPF > 0
517 	inp = pf_inp_lookup(m);
518 #endif
519 	if (inp == NULL) {
520 #ifdef INET6
521 		if (ip6)
522 			inp = in6_pcbhashlookup(&udbtable, &ip6->ip6_src,
523 			    uh->uh_sport, &ip6->ip6_dst, uh->uh_dport,
524 			    m->m_pkthdr.ph_rtableid);
525 		else
526 #endif /* INET6 */
527 		inp = in_pcbhashlookup(&udbtable, ip->ip_src, uh->uh_sport,
528 		    ip->ip_dst, uh->uh_dport, m->m_pkthdr.ph_rtableid);
529 	}
530 	if (inp == 0) {
531 		udpstat_inc(udps_pcbhashmiss);
532 #ifdef INET6
533 		if (ip6) {
534 			inp = in6_pcblookup_listen(&udbtable, &ip6->ip6_dst,
535 			    uh->uh_dport, m, m->m_pkthdr.ph_rtableid);
536 		} else
537 #endif /* INET6 */
538 		inp = in_pcblookup_listen(&udbtable, ip->ip_dst,
539 		    uh->uh_dport, m, m->m_pkthdr.ph_rtableid);
540 		if (inp == 0) {
541 			udpstat_inc(udps_noport);
542 			if (m->m_flags & (M_BCAST | M_MCAST)) {
543 				udpstat_inc(udps_noportbcast);
544 				goto bad;
545 			}
546 #ifdef INET6
547 			if (ip6) {
548 				uh->uh_sum = savesum;
549 				icmp6_error(m, ICMP6_DST_UNREACH,
550 				    ICMP6_DST_UNREACH_NOPORT,0);
551 			} else
552 #endif /* INET6 */
553 			{
554 				*ip = save_ip;
555 				uh->uh_sum = savesum;
556 				icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT,
557 				    0, 0);
558 			}
559 			return IPPROTO_DONE;
560 		}
561 	}
562 	KASSERT(sotoinpcb(inp->inp_socket) == inp);
563 	soassertlocked(inp->inp_socket);
564 
565 #ifdef INET6
566 	if (ip6 && inp->inp_ip6_minhlim &&
567 	    inp->inp_ip6_minhlim > ip6->ip6_hlim) {
568 		goto bad;
569 	} else
570 #endif
571 	if (ip && inp->inp_ip_minttl &&
572 	    inp->inp_ip_minttl > ip->ip_ttl) {
573 		goto bad;
574 	}
575 
576 #if NPF > 0
577 	if (inp->inp_socket->so_state & SS_ISCONNECTED)
578 		pf_inp_link(m, inp);
579 #endif
580 
581 #ifdef IPSEC
582 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
583 	if (mtag != NULL) {
584 		tdbi = (struct tdb_ident *)(mtag + 1);
585 		tdb = gettdb(tdbi->rdomain, tdbi->spi,
586 		    &tdbi->dst, tdbi->proto);
587 	} else
588 		tdb = NULL;
589 	ipsp_spd_lookup(m, af, iphlen, &error,
590 	    IPSP_DIRECTION_IN, tdb, inp, 0);
591 	if (error) {
592 		udpstat_inc(udps_nosec);
593 		goto bad;
594 	}
595 	/* create ipsec options while we know that tdb cannot be modified */
596 	if (tdb && tdb->tdb_ids)
597 		ipsecflowinfo = tdb->tdb_ids->id_flow;
598 #endif /*IPSEC */
599 
600 	opts = NULL;
601 #ifdef INET6
602 	if (ip6 && (inp->inp_flags & IN6P_CONTROLOPTS ||
603 	    inp->inp_socket->so_options & SO_TIMESTAMP))
604 		ip6_savecontrol(inp, m, &opts);
605 #endif /* INET6 */
606 	if (ip && (inp->inp_flags & INP_CONTROLOPTS ||
607 	    inp->inp_socket->so_options & SO_TIMESTAMP))
608 		ip_savecontrol(inp, &opts, ip, m);
609 #ifdef INET6
610 	if (ip6 && (inp->inp_flags & IN6P_RECVDSTPORT)) {
611 		struct mbuf **mp = &opts;
612 
613 		while (*mp)
614 			mp = &(*mp)->m_next;
615 		*mp = sbcreatecontrol((caddr_t)&uh->uh_dport, sizeof(u_int16_t),
616 		    IPV6_RECVDSTPORT, IPPROTO_IPV6);
617 	}
618 #endif /* INET6 */
619 	if (ip && (inp->inp_flags & INP_RECVDSTPORT)) {
620 		struct mbuf **mp = &opts;
621 
622 		while (*mp)
623 			mp = &(*mp)->m_next;
624 		*mp = sbcreatecontrol((caddr_t)&uh->uh_dport, sizeof(u_int16_t),
625 		    IP_RECVDSTPORT, IPPROTO_IP);
626 	}
627 #ifdef IPSEC
628 	if (ipsecflowinfo && (inp->inp_flags & INP_IPSECFLOWINFO)) {
629 		struct mbuf **mp = &opts;
630 
631 		while (*mp)
632 			mp = &(*mp)->m_next;
633 		*mp = sbcreatecontrol((caddr_t)&ipsecflowinfo,
634 		    sizeof(u_int32_t), IP_IPSECFLOWINFO, IPPROTO_IP);
635 	}
636 #endif
637 #ifdef PIPEX
638 	if (pipex_enable && inp->inp_pipex) {
639 		struct pipex_session *session;
640 		int off = iphlen + sizeof(struct udphdr);
641 		if ((session = pipex_l2tp_lookup_session(m, off)) != NULL) {
642 			if ((m = *mp = pipex_l2tp_input(m, off, session,
643 			    ipsecflowinfo)) == NULL) {
644 				m_freem(opts);
645 				/* the packet is handled by PIPEX */
646 				return IPPROTO_DONE;
647 			}
648 		}
649 	}
650 #endif
651 
652 	iphlen += sizeof(struct udphdr);
653 	m_adj(m, iphlen);
654 	if (sbappendaddr(inp->inp_socket, &inp->inp_socket->so_rcv, &srcsa.sa,
655 	    m, opts) == 0) {
656 		udpstat_inc(udps_fullsock);
657 		goto bad;
658 	}
659 	sorwakeup(inp->inp_socket);
660 	return IPPROTO_DONE;
661 bad:
662 	m_freem(m);
663 	m_freem(opts);
664 	return IPPROTO_DONE;
665 }
666 
667 /*
668  * Notify a udp user of an asynchronous error;
669  * just wake up so that he can collect error status.
670  */
671 void
672 udp_notify(struct inpcb *inp, int errno)
673 {
674 	inp->inp_socket->so_error = errno;
675 	sorwakeup(inp->inp_socket);
676 	sowwakeup(inp->inp_socket);
677 }
678 
679 #ifdef INET6
680 void
681 udp6_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *d)
682 {
683 	struct udphdr uh;
684 	struct sockaddr_in6 sa6;
685 	struct ip6_hdr *ip6;
686 	struct mbuf *m;
687 	int off;
688 	void *cmdarg;
689 	struct ip6ctlparam *ip6cp = NULL;
690 	struct udp_portonly {
691 		u_int16_t uh_sport;
692 		u_int16_t uh_dport;
693 	} *uhp;
694 	void (*notify)(struct inpcb *, int) = udp_notify;
695 
696 	if (sa == NULL)
697 		return;
698 	if (sa->sa_family != AF_INET6 ||
699 	    sa->sa_len != sizeof(struct sockaddr_in6))
700 		return;
701 
702 	if ((unsigned)cmd >= PRC_NCMDS)
703 		return;
704 	if (PRC_IS_REDIRECT(cmd))
705 		notify = in_rtchange, d = NULL;
706 	else if (cmd == PRC_HOSTDEAD)
707 		d = NULL;
708 	else if (cmd == PRC_MSGSIZE)
709 		; /* special code is present, see below */
710 	else if (inet6ctlerrmap[cmd] == 0)
711 		return;
712 
713 	/* if the parameter is from icmp6, decode it. */
714 	if (d != NULL) {
715 		ip6cp = (struct ip6ctlparam *)d;
716 		m = ip6cp->ip6c_m;
717 		ip6 = ip6cp->ip6c_ip6;
718 		off = ip6cp->ip6c_off;
719 		cmdarg = ip6cp->ip6c_cmdarg;
720 	} else {
721 		m = NULL;
722 		ip6 = NULL;
723 		cmdarg = NULL;
724 		/* XXX: translate addresses into internal form */
725 		sa6 = *satosin6(sa);
726 		if (in6_embedscope(&sa6.sin6_addr, &sa6, NULL)) {
727 			/* should be impossible */
728 			return;
729 		}
730 	}
731 
732 	if (ip6cp && ip6cp->ip6c_finaldst) {
733 		bzero(&sa6, sizeof(sa6));
734 		sa6.sin6_family = AF_INET6;
735 		sa6.sin6_len = sizeof(sa6);
736 		sa6.sin6_addr = *ip6cp->ip6c_finaldst;
737 		/* XXX: assuming M is valid in this case */
738 		sa6.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.ph_ifidx,
739 		    ip6cp->ip6c_finaldst);
740 		if (in6_embedscope(ip6cp->ip6c_finaldst, &sa6, NULL)) {
741 			/* should be impossible */
742 			return;
743 		}
744 	} else {
745 		/* XXX: translate addresses into internal form */
746 		sa6 = *satosin6(sa);
747 		if (in6_embedscope(&sa6.sin6_addr, &sa6, NULL)) {
748 			/* should be impossible */
749 			return;
750 		}
751 	}
752 
753 	if (ip6) {
754 		/*
755 		 * XXX: We assume that when IPV6 is non NULL,
756 		 * M and OFF are valid.
757 		 */
758 		struct sockaddr_in6 sa6_src;
759 
760 		/* check if we can safely examine src and dst ports */
761 		if (m->m_pkthdr.len < off + sizeof(*uhp))
762 			return;
763 
764 		bzero(&uh, sizeof(uh));
765 		m_copydata(m, off, sizeof(*uhp), (caddr_t)&uh);
766 
767 		bzero(&sa6_src, sizeof(sa6_src));
768 		sa6_src.sin6_family = AF_INET6;
769 		sa6_src.sin6_len = sizeof(sa6_src);
770 		sa6_src.sin6_addr = ip6->ip6_src;
771 		sa6_src.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.ph_ifidx,
772 		    &ip6->ip6_src);
773 		if (in6_embedscope(&sa6_src.sin6_addr, &sa6_src, NULL)) {
774 			/* should be impossible */
775 			return;
776 		}
777 
778 		if (cmd == PRC_MSGSIZE) {
779 			int valid = 0;
780 
781 			/*
782 			 * Check to see if we have a valid UDP socket
783 			 * corresponding to the address in the ICMPv6 message
784 			 * payload.
785 			 */
786 			if (in6_pcbhashlookup(&udbtable, &sa6.sin6_addr,
787 			    uh.uh_dport, &sa6_src.sin6_addr, uh.uh_sport,
788 			    rdomain))
789 				valid = 1;
790 #if 0
791 			/*
792 			 * As the use of sendto(2) is fairly popular,
793 			 * we may want to allow non-connected pcb too.
794 			 * But it could be too weak against attacks...
795 			 * We should at least check if the local address (= s)
796 			 * is really ours.
797 			 */
798 			else if (in6_pcblookup_listen(&udbtable,
799 			    &sa6_src.sin6_addr, uh.uh_sport, NULL,
800 			    rdomain))
801 				valid = 1;
802 #endif
803 
804 			/*
805 			 * Depending on the value of "valid" and routing table
806 			 * size (mtudisc_{hi,lo}wat), we will:
807 			 * - recalculate the new MTU and create the
808 			 *   corresponding routing entry, or
809 			 * - ignore the MTU change notification.
810 			 */
811 			icmp6_mtudisc_update((struct ip6ctlparam *)d, valid);
812 
813 			/*
814 			 * regardless of if we called icmp6_mtudisc_update(),
815 			 * we need to call in6_pcbnotify(), to notify path
816 			 * MTU change to the userland (2292bis-02), because
817 			 * some unconnected sockets may share the same
818 			 * destination and want to know the path MTU.
819 			 */
820 		}
821 
822 		(void) in6_pcbnotify(&udbtable, &sa6, uh.uh_dport,
823 		    &sa6_src, uh.uh_sport, rdomain, cmd, cmdarg, notify);
824 	} else {
825 		(void) in6_pcbnotify(&udbtable, &sa6, 0,
826 		    &sa6_any, 0, rdomain, cmd, cmdarg, notify);
827 	}
828 }
829 #endif
830 
831 void
832 udp_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v)
833 {
834 	struct ip *ip = v;
835 	struct udphdr *uhp;
836 	struct in_addr faddr;
837 	struct inpcb *inp;
838 	void (*notify)(struct inpcb *, int) = udp_notify;
839 	int errno;
840 
841 	if (sa == NULL)
842 		return;
843 	if (sa->sa_family != AF_INET ||
844 	    sa->sa_len != sizeof(struct sockaddr_in))
845 		return;
846 	faddr = satosin(sa)->sin_addr;
847 	if (faddr.s_addr == INADDR_ANY)
848 		return;
849 
850 	if ((unsigned)cmd >= PRC_NCMDS)
851 		return;
852 	errno = inetctlerrmap[cmd];
853 	if (PRC_IS_REDIRECT(cmd))
854 		notify = in_rtchange, ip = 0;
855 	else if (cmd == PRC_HOSTDEAD)
856 		ip = 0;
857 	else if (errno == 0)
858 		return;
859 	if (ip) {
860 		uhp = (struct udphdr *)((caddr_t)ip + (ip->ip_hl << 2));
861 
862 #ifdef IPSEC
863 		/* PMTU discovery for udpencap */
864 		if (cmd == PRC_MSGSIZE && ip_mtudisc && udpencap_enable &&
865 		    udpencap_port && uhp->uh_sport == htons(udpencap_port)) {
866 			udpencap_ctlinput(cmd, sa, rdomain, v);
867 			return;
868 		}
869 #endif
870 		inp = in_pcbhashlookup(&udbtable,
871 		    ip->ip_dst, uhp->uh_dport, ip->ip_src, uhp->uh_sport,
872 		    rdomain);
873 		if (inp && inp->inp_socket != NULL)
874 			notify(inp, errno);
875 	} else
876 		in_pcbnotifyall(&udbtable, sa, rdomain, errno, notify);
877 }
878 
879 int
880 udp_output(struct inpcb *inp, struct mbuf *m, struct mbuf *addr,
881     struct mbuf *control)
882 {
883 	struct sockaddr_in *sin = NULL;
884 	struct udpiphdr *ui;
885 	u_int32_t ipsecflowinfo = 0;
886 	struct sockaddr_in src_sin;
887 	int len = m->m_pkthdr.len;
888 	struct in_addr *laddr;
889 	int error = 0;
890 
891 #ifdef DIAGNOSTIC
892 	if ((inp->inp_flags & INP_IPV6) != 0)
893 		panic("IPv6 inpcb to %s", __func__);
894 #endif
895 
896 	/*
897 	 * Compute the packet length of the IP header, and
898 	 * punt if the length looks bogus.
899 	 */
900 	if ((len + sizeof(struct udpiphdr)) > IP_MAXPACKET) {
901 		error = EMSGSIZE;
902 		goto release;
903 	}
904 
905 	memset(&src_sin, 0, sizeof(src_sin));
906 
907 	if (control) {
908 		u_int clen;
909 		struct cmsghdr *cm;
910 		caddr_t cmsgs;
911 
912 		/*
913 		 * XXX: Currently, we assume all the optional information is
914 		 * stored in a single mbuf.
915 		 */
916 		if (control->m_next) {
917 			error = EINVAL;
918 			goto release;
919 		}
920 
921 		clen = control->m_len;
922 		cmsgs = mtod(control, caddr_t);
923 		do {
924 			if (clen < CMSG_LEN(0)) {
925 				error = EINVAL;
926 				goto release;
927 			}
928 			cm = (struct cmsghdr *)cmsgs;
929 			if (cm->cmsg_len < CMSG_LEN(0) ||
930 			    CMSG_ALIGN(cm->cmsg_len) > clen) {
931 				error = EINVAL;
932 				goto release;
933 			}
934 #ifdef IPSEC
935 			if ((inp->inp_flags & INP_IPSECFLOWINFO) != 0 &&
936 			    cm->cmsg_len == CMSG_LEN(sizeof(ipsecflowinfo)) &&
937 			    cm->cmsg_level == IPPROTO_IP &&
938 			    cm->cmsg_type == IP_IPSECFLOWINFO) {
939 				ipsecflowinfo = *(u_int32_t *)CMSG_DATA(cm);
940 			} else
941 #endif
942 			if (cm->cmsg_len == CMSG_LEN(sizeof(struct in_addr)) &&
943 			    cm->cmsg_level == IPPROTO_IP &&
944 			    cm->cmsg_type == IP_SENDSRCADDR) {
945 				memcpy(&src_sin.sin_addr, CMSG_DATA(cm),
946 				    sizeof(struct in_addr));
947 				src_sin.sin_family = AF_INET;
948 				src_sin.sin_len = sizeof(src_sin);
949 				/* no check on reuse when sin->sin_port == 0 */
950 				if ((error = in_pcbaddrisavail(inp, &src_sin,
951 				    0, curproc)))
952 					goto release;
953 			}
954 			clen -= CMSG_ALIGN(cm->cmsg_len);
955 			cmsgs += CMSG_ALIGN(cm->cmsg_len);
956 		} while (clen);
957 	}
958 
959 	if (addr) {
960 		if ((error = in_nam2sin(addr, &sin)))
961 			goto release;
962 		if (sin->sin_port == 0) {
963 			error = EADDRNOTAVAIL;
964 			goto release;
965 		}
966 		if (inp->inp_faddr.s_addr != INADDR_ANY) {
967 			error = EISCONN;
968 			goto release;
969 		}
970 		error = in_pcbselsrc(&laddr, sin, inp);
971 		if (error)
972 			goto release;
973 
974 		if (inp->inp_lport == 0) {
975 			error = in_pcbbind(inp, NULL, curproc);
976 			if (error)
977 				goto release;
978 		}
979 
980 		if (src_sin.sin_len > 0 &&
981 		    src_sin.sin_addr.s_addr != INADDR_ANY &&
982 		    src_sin.sin_addr.s_addr != inp->inp_laddr.s_addr) {
983 			src_sin.sin_port = inp->inp_lport;
984 			if (inp->inp_laddr.s_addr != INADDR_ANY &&
985 			    (error =
986 			    in_pcbaddrisavail(inp, &src_sin, 0, curproc)))
987 				goto release;
988 			laddr = &src_sin.sin_addr;
989 		}
990 	} else {
991 		if (inp->inp_faddr.s_addr == INADDR_ANY) {
992 			error = ENOTCONN;
993 			goto release;
994 		}
995 		laddr = &inp->inp_laddr;
996 	}
997 
998 	/*
999 	 * Calculate data length and get a mbuf
1000 	 * for UDP and IP headers.
1001 	 */
1002 	M_PREPEND(m, sizeof(struct udpiphdr), M_DONTWAIT);
1003 	if (m == NULL) {
1004 		error = ENOBUFS;
1005 		goto bail;
1006 	}
1007 
1008 	/*
1009 	 * Fill in mbuf with extended UDP header
1010 	 * and addresses and length put into network format.
1011 	 */
1012 	ui = mtod(m, struct udpiphdr *);
1013 	bzero(ui->ui_x1, sizeof ui->ui_x1);
1014 	ui->ui_pr = IPPROTO_UDP;
1015 	ui->ui_len = htons((u_int16_t)len + sizeof (struct udphdr));
1016 	ui->ui_src = *laddr;
1017 	ui->ui_dst = sin ? sin->sin_addr : inp->inp_faddr;
1018 	ui->ui_sport = inp->inp_lport;
1019 	ui->ui_dport = sin ? sin->sin_port : inp->inp_fport;
1020 	ui->ui_ulen = ui->ui_len;
1021 	((struct ip *)ui)->ip_len = htons(sizeof (struct udpiphdr) + len);
1022 	((struct ip *)ui)->ip_ttl = inp->inp_ip.ip_ttl;
1023 	((struct ip *)ui)->ip_tos = inp->inp_ip.ip_tos;
1024 	if (udpcksum)
1025 		m->m_pkthdr.csum_flags |= M_UDP_CSUM_OUT;
1026 
1027 	udpstat_inc(udps_opackets);
1028 
1029 	/* force routing table */
1030 	m->m_pkthdr.ph_rtableid = inp->inp_rtableid;
1031 
1032 #if NPF > 0
1033 	if (inp->inp_socket->so_state & SS_ISCONNECTED)
1034 		m->m_pkthdr.pf.inp = inp;
1035 #endif
1036 
1037 	error = ip_output(m, inp->inp_options, &inp->inp_route,
1038 	    (inp->inp_socket->so_options & SO_BROADCAST), inp->inp_moptions,
1039 	    inp, ipsecflowinfo);
1040 	if (error == EACCES)	/* translate pf(4) error for userland */
1041 		error = EHOSTUNREACH;
1042 
1043 bail:
1044 	m_freem(control);
1045 	return (error);
1046 
1047 release:
1048 	m_freem(m);
1049 	goto bail;
1050 }
1051 
1052 /*ARGSUSED*/
1053 int
1054 udp_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *addr,
1055     struct mbuf *control, struct proc *p)
1056 {
1057 	struct inpcb *inp;
1058 	int error = 0;
1059 
1060 	soassertlocked(so);
1061 
1062 	if (req == PRU_CONTROL) {
1063 #ifdef INET6
1064 		if (sotopf(so) == PF_INET6)
1065 			return (in6_control(so, (u_long)m, (caddr_t)addr,
1066 			    (struct ifnet *)control));
1067 		else
1068 #endif /* INET6 */
1069 			return (in_control(so, (u_long)m, (caddr_t)addr,
1070 			    (struct ifnet *)control));
1071 	}
1072 
1073 	inp = sotoinpcb(so);
1074 	if (inp == NULL) {
1075 		error = EINVAL;
1076 		goto release;
1077 	}
1078 
1079 	/*
1080 	 * Note: need to block udp_input while changing
1081 	 * the udp pcb queue and/or pcb addresses.
1082 	 */
1083 	switch (req) {
1084 
1085 	case PRU_BIND:
1086 		error = in_pcbbind(inp, addr, p);
1087 		break;
1088 
1089 	case PRU_LISTEN:
1090 		error = EOPNOTSUPP;
1091 		break;
1092 
1093 	case PRU_CONNECT:
1094 #ifdef INET6
1095 		if (inp->inp_flags & INP_IPV6) {
1096 			if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6)) {
1097 				error = EISCONN;
1098 				break;
1099 			}
1100 			error = in6_pcbconnect(inp, addr);
1101 		} else
1102 #endif /* INET6 */
1103 		{
1104 			if (inp->inp_faddr.s_addr != INADDR_ANY) {
1105 				error = EISCONN;
1106 				break;
1107 			}
1108 			error = in_pcbconnect(inp, addr);
1109 		}
1110 
1111 		if (error == 0)
1112 			soisconnected(so);
1113 		break;
1114 
1115 	case PRU_CONNECT2:
1116 		error = EOPNOTSUPP;
1117 		break;
1118 
1119 	case PRU_ACCEPT:
1120 		error = EOPNOTSUPP;
1121 		break;
1122 
1123 	case PRU_DISCONNECT:
1124 #ifdef INET6
1125 		if (inp->inp_flags & INP_IPV6) {
1126 			if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6)) {
1127 				error = ENOTCONN;
1128 				break;
1129 			}
1130 		} else
1131 #endif /* INET6 */
1132 		{
1133 			if (inp->inp_faddr.s_addr == INADDR_ANY) {
1134 				error = ENOTCONN;
1135 				break;
1136 			}
1137 		}
1138 
1139 #ifdef INET6
1140 		if (inp->inp_flags & INP_IPV6)
1141 			inp->inp_laddr6 = in6addr_any;
1142 		else
1143 #endif /* INET6 */
1144 			inp->inp_laddr.s_addr = INADDR_ANY;
1145 		in_pcbdisconnect(inp);
1146 
1147 		so->so_state &= ~SS_ISCONNECTED;		/* XXX */
1148 		break;
1149 
1150 	case PRU_SHUTDOWN:
1151 		socantsendmore(so);
1152 		break;
1153 
1154 	case PRU_SEND:
1155 #ifdef PIPEX
1156 		if (inp->inp_pipex) {
1157 			struct pipex_session *session;
1158 
1159 			if (addr != NULL)
1160 				session =
1161 				    pipex_l2tp_userland_lookup_session(m,
1162 					mtod(addr, struct sockaddr *));
1163 			else
1164 #ifdef INET6
1165 			if (inp->inp_flags & INP_IPV6)
1166 				session =
1167 				    pipex_l2tp_userland_lookup_session_ipv6(
1168 					m, inp->inp_faddr6);
1169 			else
1170 #endif
1171 				session =
1172 				    pipex_l2tp_userland_lookup_session_ipv4(
1173 					m, inp->inp_faddr);
1174 			if (session != NULL)
1175 				if ((m = pipex_l2tp_userland_output(
1176 				    m, session)) == NULL) {
1177 					error = ENOMEM;
1178 					goto release;
1179 				}
1180 		}
1181 #endif
1182 
1183 #ifdef INET6
1184 		if (inp->inp_flags & INP_IPV6)
1185 			error = udp6_output(inp, m, addr, control);
1186 		else
1187 #endif
1188 			error = udp_output(inp, m, addr, control);
1189 		return (error);
1190 
1191 	case PRU_ABORT:
1192 		soisdisconnected(so);
1193 		in_pcbdetach(inp);
1194 		break;
1195 
1196 	case PRU_SOCKADDR:
1197 #ifdef INET6
1198 		if (inp->inp_flags & INP_IPV6)
1199 			in6_setsockaddr(inp, addr);
1200 		else
1201 #endif /* INET6 */
1202 			in_setsockaddr(inp, addr);
1203 		break;
1204 
1205 	case PRU_PEERADDR:
1206 #ifdef INET6
1207 		if (inp->inp_flags & INP_IPV6)
1208 			in6_setpeeraddr(inp, addr);
1209 		else
1210 #endif /* INET6 */
1211 			in_setpeeraddr(inp, addr);
1212 		break;
1213 
1214 	case PRU_SENSE:
1215 		/*
1216 		 * stat: don't bother with a blocksize.
1217 		 */
1218 		/*
1219 		 * Perhaps Path MTU might be returned for a connected
1220 		 * UDP socket in this case.
1221 		 */
1222 		return (0);
1223 
1224 	case PRU_SENDOOB:
1225 	case PRU_FASTTIMO:
1226 	case PRU_SLOWTIMO:
1227 	case PRU_PROTORCV:
1228 	case PRU_PROTOSEND:
1229 		error =  EOPNOTSUPP;
1230 		break;
1231 
1232 	case PRU_RCVD:
1233 	case PRU_RCVOOB:
1234 		return (EOPNOTSUPP);	/* do not free mbuf's */
1235 
1236 	default:
1237 		panic("udp_usrreq");
1238 	}
1239 
1240 release:
1241 	m_freem(control);
1242 	m_freem(m);
1243 	return (error);
1244 }
1245 
1246 int
1247 udp_attach(struct socket *so, int proto)
1248 {
1249 	int error;
1250 
1251 	if (so->so_pcb != NULL)
1252 		return EINVAL;
1253 
1254 	if ((error = soreserve(so, udp_sendspace, udp_recvspace)))
1255 		return error;
1256 
1257 	NET_ASSERT_LOCKED();
1258 	if ((error = in_pcballoc(so, &udbtable)))
1259 		return error;
1260 #ifdef INET6
1261 	if (sotoinpcb(so)->inp_flags & INP_IPV6)
1262 		sotoinpcb(so)->inp_ipv6.ip6_hlim = ip6_defhlim;
1263 	else
1264 #endif /* INET6 */
1265 		sotoinpcb(so)->inp_ip.ip_ttl = ip_defttl;
1266 	return 0;
1267 }
1268 
1269 int
1270 udp_detach(struct socket *so)
1271 {
1272 	struct inpcb *inp;
1273 
1274 	soassertlocked(so);
1275 
1276 	inp = sotoinpcb(so);
1277 	if (inp == NULL)
1278 		return (EINVAL);
1279 
1280 	in_pcbdetach(inp);
1281 	return (0);
1282 }
1283 
1284 /*
1285  * Sysctl for udp variables.
1286  */
1287 int
1288 udp_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
1289     size_t newlen)
1290 {
1291 	int error;
1292 
1293 	/* All sysctl names at this level are terminal. */
1294 	if (namelen != 1)
1295 		return (ENOTDIR);
1296 
1297 	switch (name[0]) {
1298 	case UDPCTL_BADDYNAMIC:
1299 		NET_LOCK();
1300 		error = sysctl_struct(oldp, oldlenp, newp, newlen,
1301 		    baddynamicports.udp, sizeof(baddynamicports.udp));
1302 		NET_UNLOCK();
1303 		return (error);
1304 
1305 	case UDPCTL_ROOTONLY:
1306 		if (newp && securelevel > 0)
1307 			return (EPERM);
1308 		NET_LOCK();
1309 		error = sysctl_struct(oldp, oldlenp, newp, newlen,
1310 		    rootonlyports.udp, sizeof(rootonlyports.udp));
1311 		NET_UNLOCK();
1312 		return (error);
1313 
1314 	case UDPCTL_STATS:
1315 		if (newp != NULL)
1316 			return (EPERM);
1317 
1318 		return (udp_sysctl_udpstat(oldp, oldlenp, newp));
1319 
1320 	default:
1321 		if (name[0] < UDPCTL_MAXID) {
1322 			NET_LOCK();
1323 			error = sysctl_int_arr(udpctl_vars, name, namelen,
1324 			    oldp, oldlenp, newp, newlen);
1325 			NET_UNLOCK();
1326 			return (error);
1327 		}
1328 		return (ENOPROTOOPT);
1329 	}
1330 	/* NOTREACHED */
1331 }
1332 
1333 int
1334 udp_sysctl_udpstat(void *oldp, size_t *oldlenp, void *newp)
1335 {
1336 	uint64_t counters[udps_ncounters];
1337 	struct udpstat udpstat;
1338 	u_long *words = (u_long *)&udpstat;
1339 	int i;
1340 
1341 	CTASSERT(sizeof(udpstat) == (nitems(counters) * sizeof(u_long)));
1342 	memset(&udpstat, 0, sizeof udpstat);
1343 	counters_read(udpcounters, counters, nitems(counters));
1344 
1345 	for (i = 0; i < nitems(counters); i++)
1346 		words[i] = (u_long)counters[i];
1347 
1348 	return (sysctl_rdstruct(oldp, oldlenp, newp,
1349 	    &udpstat, sizeof(udpstat)));
1350 }
1351