1 /*-
2 * Copyright (c) 1982, 1986, 1991, 1993, 1995
3 * The Regents of the University of California.
4 * Copyright (c) 2007-2009 Robert N. M. Watson
5 * Copyright (c) 2010-2011 Juniper Networks, Inc.
6 * All rights reserved.
7 *
8 * Portions of this software were developed by Robert N. M. Watson under
9 * contract to Juniper Networks, Inc.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 * 4. Neither the name of the University nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 *
35 * @(#)in_pcb.c 8.4 (Berkeley) 5/24/95
36 */
37
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
40
41 #include "opt_ddb.h"
42 #include "opt_ipsec.h"
43 #include "opt_inet.h"
44 #include "opt_inet6.h"
45 #include "opt_pcbgroup.h"
46 #include "opt_rss.h"
47 #include "opt_mpath.h"
48
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/lock.h>
52 #include <sys/malloc.h>
53 #include <sys/mbuf.h>
54 #include <sys/callout.h>
55 #include <sys/eventhandler.h>
56 #include <sys/domain.h>
57 #include <sys/protosw.h>
58 #include <sys/rmlock.h>
59 #include <sys/socket.h>
60 #include <sys/socketvar.h>
61 #include <sys/priv.h>
62 #include <sys/proc.h>
63 #include <sys/refcount.h>
64 #include <sys/jail.h>
65 #include <sys/kernel.h>
66 #include <sys/sysctl.h>
67
68 #ifdef DDB
69 #include <ddb/ddb.h>
70 #endif
71
72 #include <vm/uma.h>
73
74 #include <net/if.h>
75 #include <net/if_var.h>
76 #include <net/if_llatbl.h>
77 #include <net/if_types.h>
78 #include <net/route.h>
79 #include <net/rss_config.h>
80 #include <net/vnet.h>
81
82 #include <net/if_dl.h>
83 #include <net/ethernet.h>
84
85
86 #if defined(INET) || defined(INET6)
87 #include <netinet/in.h>
88 #include <netinet/in_pcb.h>
89 #include <netinet/ip_var.h>
90 #include <netinet/tcp_var.h>
91 #include <netinet/udp.h>
92 #include <netinet/udp_var.h>
93 #endif
94 #ifdef INET
95 #include <netinet/in_var.h>
96 #include <netinet/if_ether.h>
97 #endif
98 #ifdef INET6
99 #include <netinet/ip6.h>
100 #include <netinet6/in6_pcb.h>
101 #include <netinet6/in6_var.h>
102 #include <netinet6/ip6_var.h>
103 #include <netinet6/nd6.h>
104 #endif /* INET6 */
105
106
107 #ifdef IPSEC
108 #include <netipsec/ipsec.h>
109 #include <netipsec/key.h>
110 #endif /* IPSEC */
111
112 #include <security/mac/mac_framework.h>
113
114 static struct callout ipport_tick_callout;
115
116 /*
117 * These configure the range of local port addresses assigned to
118 * "unspecified" outgoing connections/packets/whatever.
119 */
120 VNET_DEFINE(int, ipport_lowfirstauto) = IPPORT_RESERVED - 1; /* 1023 */
121 VNET_DEFINE(int, ipport_lowlastauto) = IPPORT_RESERVEDSTART; /* 600 */
122 VNET_DEFINE(int, ipport_firstauto) = IPPORT_EPHEMERALFIRST; /* 10000 */
123 VNET_DEFINE(int, ipport_lastauto) = IPPORT_EPHEMERALLAST; /* 65535 */
124 VNET_DEFINE(int, ipport_hifirstauto) = IPPORT_HIFIRSTAUTO; /* 49152 */
125 VNET_DEFINE(int, ipport_hilastauto) = IPPORT_HILASTAUTO; /* 65535 */
126
127 /*
128 * Reserved ports accessible only to root. There are significant
129 * security considerations that must be accounted for when changing these,
130 * but the security benefits can be great. Please be careful.
131 */
132 VNET_DEFINE(int, ipport_reservedhigh) = IPPORT_RESERVED - 1; /* 1023 */
133 VNET_DEFINE(int, ipport_reservedlow);
134
135 /* Variables dealing with random ephemeral port allocation. */
136 VNET_DEFINE(int, ipport_randomized) = 1; /* user controlled via sysctl */
137 VNET_DEFINE(int, ipport_randomcps) = 10; /* user controlled via sysctl */
138 VNET_DEFINE(int, ipport_randomtime) = 45; /* user controlled via sysctl */
139 VNET_DEFINE(int, ipport_stoprandom); /* toggled by ipport_tick */
140 VNET_DEFINE(int, ipport_tcpallocs);
141 static VNET_DEFINE(int, ipport_tcplastcount);
142
143 #define V_ipport_tcplastcount VNET(ipport_tcplastcount)
144
145 extern u_int inpcb_rt_cache_enable;
146
147 static void in_pcbremlists(struct inpcb *inp);
148 #ifdef INET
149 static struct inpcb *in_pcblookup_hash_locked(struct inpcbinfo *pcbinfo,
150 struct in_addr faddr, u_int fport_arg,
151 struct in_addr laddr, u_int lport_arg,
152 int lookupflags, struct ifnet *ifp);
153
154 #define RANGECHK(var, min, max) \
155 if ((var) < (min)) { (var) = (min); } \
156 else if ((var) > (max)) { (var) = (max); }
157
158 static int
sysctl_net_ipport_check(SYSCTL_HANDLER_ARGS)159 sysctl_net_ipport_check(SYSCTL_HANDLER_ARGS)
160 {
161 int error;
162
163 error = sysctl_handle_int(oidp, arg1, arg2, req);
164 if (error == 0) {
165 RANGECHK(V_ipport_lowfirstauto, 1, IPPORT_RESERVED - 1);
166 RANGECHK(V_ipport_lowlastauto, 1, IPPORT_RESERVED - 1);
167 RANGECHK(V_ipport_firstauto, IPPORT_RESERVED, IPPORT_MAX);
168 RANGECHK(V_ipport_lastauto, IPPORT_RESERVED, IPPORT_MAX);
169 RANGECHK(V_ipport_hifirstauto, IPPORT_RESERVED, IPPORT_MAX);
170 RANGECHK(V_ipport_hilastauto, IPPORT_RESERVED, IPPORT_MAX);
171 }
172 return (error);
173 }
174
175 #undef RANGECHK
176
177 static SYSCTL_NODE(_net_inet_ip, IPPROTO_IP, portrange, CTLFLAG_RW, 0,
178 "IP Ports");
179
180 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowfirst,
181 CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW,
182 &VNET_NAME(ipport_lowfirstauto), 0, &sysctl_net_ipport_check, "I", "");
183 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowlast,
184 CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW,
185 &VNET_NAME(ipport_lowlastauto), 0, &sysctl_net_ipport_check, "I", "");
186 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, first,
187 CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW,
188 &VNET_NAME(ipport_firstauto), 0, &sysctl_net_ipport_check, "I", "");
189 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, last,
190 CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW,
191 &VNET_NAME(ipport_lastauto), 0, &sysctl_net_ipport_check, "I", "");
192 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hifirst,
193 CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW,
194 &VNET_NAME(ipport_hifirstauto), 0, &sysctl_net_ipport_check, "I", "");
195 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast,
196 CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW,
197 &VNET_NAME(ipport_hilastauto), 0, &sysctl_net_ipport_check, "I", "");
198 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, reservedhigh,
199 CTLFLAG_VNET | CTLFLAG_RW | CTLFLAG_SECURE,
200 &VNET_NAME(ipport_reservedhigh), 0, "");
201 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, reservedlow,
202 CTLFLAG_RW|CTLFLAG_SECURE, &VNET_NAME(ipport_reservedlow), 0, "");
203 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, randomized,
204 CTLFLAG_VNET | CTLFLAG_RW,
205 &VNET_NAME(ipport_randomized), 0, "Enable random port allocation");
206 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, randomcps,
207 CTLFLAG_VNET | CTLFLAG_RW,
208 &VNET_NAME(ipport_randomcps), 0, "Maximum number of random port "
209 "allocations before switching to a sequental one");
210 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, randomtime,
211 CTLFLAG_VNET | CTLFLAG_RW,
212 &VNET_NAME(ipport_randomtime), 0,
213 "Minimum time to keep sequental port "
214 "allocation before switching to a random one");
215 #endif /* INET */
216
217 /*
218 * in_pcb.c: manage the Protocol Control Blocks.
219 *
220 * NOTE: It is assumed that most of these functions will be called with
221 * the pcbinfo lock held, and often, the inpcb lock held, as these utility
222 * functions often modify hash chains or addresses in pcbs.
223 */
224
225 /*
226 * Initialize an inpcbinfo -- we should be able to reduce the number of
227 * arguments in time.
228 */
229 void
in_pcbinfo_init(struct inpcbinfo * pcbinfo,const char * name,struct inpcbhead * listhead,int hash_nelements,int porthash_nelements,char * inpcbzone_name,uma_init inpcbzone_init,uma_fini inpcbzone_fini,uint32_t inpcbzone_flags,u_int hashfields)230 in_pcbinfo_init(struct inpcbinfo *pcbinfo, const char *name,
231 struct inpcbhead *listhead, int hash_nelements, int porthash_nelements,
232 char *inpcbzone_name, uma_init inpcbzone_init, uma_fini inpcbzone_fini,
233 uint32_t inpcbzone_flags, u_int hashfields)
234 {
235
236 INP_INFO_LOCK_INIT(pcbinfo, name);
237 INP_HASH_LOCK_INIT(pcbinfo, "pcbinfohash"); /* XXXRW: argument? */
238 INP_LIST_LOCK_INIT(pcbinfo, "pcbinfolist");
239 #ifdef VIMAGE
240 pcbinfo->ipi_vnet = curvnet;
241 #endif
242 pcbinfo->ipi_listhead = listhead;
243 LIST_INIT(pcbinfo->ipi_listhead);
244 pcbinfo->ipi_count = 0;
245 pcbinfo->ipi_hashbase = hashinit(hash_nelements, M_PCB,
246 &pcbinfo->ipi_hashmask);
247 pcbinfo->ipi_porthashbase = hashinit(porthash_nelements, M_PCB,
248 &pcbinfo->ipi_porthashmask);
249 #ifdef PCBGROUP
250 in_pcbgroup_init(pcbinfo, hashfields, hash_nelements);
251 #endif
252 pcbinfo->ipi_zone = uma_zcreate(inpcbzone_name, sizeof(struct inpcb),
253 NULL, NULL, inpcbzone_init, inpcbzone_fini, UMA_ALIGN_PTR,
254 inpcbzone_flags);
255 uma_zone_set_max(pcbinfo->ipi_zone, maxsockets);
256 uma_zone_set_warning(pcbinfo->ipi_zone,
257 "kern.ipc.maxsockets limit reached");
258 }
259
260 /*
261 * Destroy an inpcbinfo.
262 */
263 void
in_pcbinfo_destroy(struct inpcbinfo * pcbinfo)264 in_pcbinfo_destroy(struct inpcbinfo *pcbinfo)
265 {
266
267 KASSERT(pcbinfo->ipi_count == 0,
268 ("%s: ipi_count = %u", __func__, pcbinfo->ipi_count));
269
270 hashdestroy(pcbinfo->ipi_hashbase, M_PCB, pcbinfo->ipi_hashmask);
271 hashdestroy(pcbinfo->ipi_porthashbase, M_PCB,
272 pcbinfo->ipi_porthashmask);
273 #ifdef PCBGROUP
274 in_pcbgroup_destroy(pcbinfo);
275 #endif
276 uma_zdestroy(pcbinfo->ipi_zone);
277 INP_LIST_LOCK_DESTROY(pcbinfo);
278 INP_HASH_LOCK_DESTROY(pcbinfo);
279 INP_INFO_LOCK_DESTROY(pcbinfo);
280 }
281
282 /*
283 * Allocate a PCB and associate it with the socket.
284 * On success return with the PCB locked.
285 */
286 int
in_pcballoc(struct socket * so,struct inpcbinfo * pcbinfo)287 in_pcballoc(struct socket *so, struct inpcbinfo *pcbinfo)
288 {
289 struct inpcb *inp;
290 int error;
291
292 #ifdef INVARIANTS
293 if (pcbinfo == &V_tcbinfo) {
294 INP_INFO_RLOCK_ASSERT(pcbinfo);
295 } else {
296 INP_INFO_WLOCK_ASSERT(pcbinfo);
297 }
298 #endif
299
300 error = 0;
301 inp = uma_zalloc(pcbinfo->ipi_zone, M_NOWAIT);
302 if (inp == NULL)
303 return (ENOBUFS);
304 bzero(inp, inp_zero_size);
305 inp->inp_pcbinfo = pcbinfo;
306 inp->inp_socket = so;
307 inp->inp_cred = crhold(so->so_cred);
308 inp->inp_inc.inc_fibnum = so->so_fibnum;
309 #ifdef MAC
310 error = mac_inpcb_init(inp, M_NOWAIT);
311 if (error != 0)
312 goto out;
313 mac_inpcb_create(so, inp);
314 #endif
315 #ifdef IPSEC
316 error = ipsec_init_policy(so, &inp->inp_sp);
317 if (error != 0) {
318 #ifdef MAC
319 mac_inpcb_destroy(inp);
320 #endif
321 goto out;
322 }
323 #endif /*IPSEC*/
324 #ifdef INET6
325 if (INP_SOCKAF(so) == AF_INET6) {
326 inp->inp_vflag |= INP_IPV6PROTO;
327 if (V_ip6_v6only)
328 inp->inp_flags |= IN6P_IPV6_V6ONLY;
329 }
330 #endif
331 INP_WLOCK(inp);
332 INP_LIST_WLOCK(pcbinfo);
333 LIST_INSERT_HEAD(pcbinfo->ipi_listhead, inp, inp_list);
334 pcbinfo->ipi_count++;
335 so->so_pcb = (caddr_t)inp;
336 #ifdef INET6
337 if (V_ip6_auto_flowlabel)
338 inp->inp_flags |= IN6P_AUTOFLOWLABEL;
339 #endif
340 inp->inp_gencnt = ++pcbinfo->ipi_gencnt;
341 refcount_init(&inp->inp_refcount, 1); /* Reference from inpcbinfo */
342 INP_LIST_WUNLOCK(pcbinfo);
343 #if defined(IPSEC) || defined(MAC)
344 out:
345 if (error != 0) {
346 crfree(inp->inp_cred);
347 uma_zfree(pcbinfo->ipi_zone, inp);
348 }
349 #endif
350 return (error);
351 }
352
353 #ifdef INET
354 int
in_pcbbind(struct inpcb * inp,struct sockaddr * nam,struct ucred * cred)355 in_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct ucred *cred)
356 {
357 int anonport, error;
358
359 INP_WLOCK_ASSERT(inp);
360 INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);
361
362 if (inp->inp_lport != 0 || inp->inp_laddr.s_addr != INADDR_ANY)
363 return (EINVAL);
364 anonport = nam == NULL || ((struct sockaddr_in *)nam)->sin_port == 0;
365 error = in_pcbbind_setup(inp, nam, &inp->inp_laddr.s_addr,
366 &inp->inp_lport, cred);
367 if (error)
368 return (error);
369 if (in_pcbinshash(inp) != 0) {
370 inp->inp_laddr.s_addr = INADDR_ANY;
371 inp->inp_lport = 0;
372 return (EAGAIN);
373 }
374 if (anonport)
375 inp->inp_flags |= INP_ANONPORT;
376 return (0);
377 }
378 #endif
379
380 /*
381 * Select a local port (number) to use.
382 */
383 #if defined(INET) || defined(INET6)
384 int
in_pcb_lport(struct inpcb * inp,struct in_addr * laddrp,u_short * lportp,struct ucred * cred,int lookupflags)385 in_pcb_lport(struct inpcb *inp, struct in_addr *laddrp, u_short *lportp,
386 struct ucred *cred, int lookupflags)
387 {
388 struct inpcbinfo *pcbinfo;
389 struct inpcb *tmpinp;
390 unsigned short *lastport;
391 int count, dorandom, error;
392 u_short aux, first, last, lport;
393 #ifdef INET
394 struct in_addr laddr;
395 #endif
396
397 pcbinfo = inp->inp_pcbinfo;
398
399 /*
400 * Because no actual state changes occur here, a global write lock on
401 * the pcbinfo isn't required.
402 */
403 INP_LOCK_ASSERT(inp);
404 INP_HASH_LOCK_ASSERT(pcbinfo);
405
406 if (inp->inp_flags & INP_HIGHPORT) {
407 first = V_ipport_hifirstauto; /* sysctl */
408 last = V_ipport_hilastauto;
409 lastport = &pcbinfo->ipi_lasthi;
410 } else if (inp->inp_flags & INP_LOWPORT) {
411 error = priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 0);
412 if (error)
413 return (error);
414 first = V_ipport_lowfirstauto; /* 1023 */
415 last = V_ipport_lowlastauto; /* 600 */
416 lastport = &pcbinfo->ipi_lastlow;
417 } else {
418 first = V_ipport_firstauto; /* sysctl */
419 last = V_ipport_lastauto;
420 lastport = &pcbinfo->ipi_lastport;
421 }
422 /*
423 * For UDP(-Lite), use random port allocation as long as the user
424 * allows it. For TCP (and as of yet unknown) connections,
425 * use random port allocation only if the user allows it AND
426 * ipport_tick() allows it.
427 */
428 if (V_ipport_randomized &&
429 (!V_ipport_stoprandom || pcbinfo == &V_udbinfo ||
430 pcbinfo == &V_ulitecbinfo))
431 dorandom = 1;
432 else
433 dorandom = 0;
434 /*
435 * It makes no sense to do random port allocation if
436 * we have the only port available.
437 */
438 if (first == last)
439 dorandom = 0;
440 /* Make sure to not include UDP(-Lite) packets in the count. */
441 if (pcbinfo != &V_udbinfo || pcbinfo != &V_ulitecbinfo)
442 V_ipport_tcpallocs++;
443 /*
444 * Instead of having two loops further down counting up or down
445 * make sure that first is always <= last and go with only one
446 * code path implementing all logic.
447 */
448 if (first > last) {
449 aux = first;
450 first = last;
451 last = aux;
452 }
453
454 #ifdef INET
455 /* Make the compiler happy. */
456 laddr.s_addr = 0;
457 if ((inp->inp_vflag & (INP_IPV4|INP_IPV6)) == INP_IPV4) {
458 KASSERT(laddrp != NULL, ("%s: laddrp NULL for v4 inp %p",
459 __func__, inp));
460 laddr = *laddrp;
461 }
462 #endif
463 tmpinp = NULL; /* Make compiler happy. */
464 lport = *lportp;
465
466 if (dorandom)
467 *lastport = first + (arc4random() % (last - first));
468
469 count = last - first;
470
471 do {
472 if (count-- < 0) /* completely used? */
473 return (EADDRNOTAVAIL);
474 ++*lastport;
475 if (*lastport < first || *lastport > last)
476 *lastport = first;
477 lport = htons(*lastport);
478
479 #ifdef INET6
480 if ((inp->inp_vflag & INP_IPV6) != 0)
481 tmpinp = in6_pcblookup_local(pcbinfo,
482 &inp->in6p_laddr, lport, lookupflags, cred);
483 #endif
484 #if defined(INET) && defined(INET6)
485 else
486 #endif
487 #ifdef INET
488 tmpinp = in_pcblookup_local(pcbinfo, laddr,
489 lport, lookupflags, cred);
490 #endif
491 } while (tmpinp != NULL);
492
493 #ifdef INET
494 if ((inp->inp_vflag & (INP_IPV4|INP_IPV6)) == INP_IPV4)
495 laddrp->s_addr = laddr.s_addr;
496 #endif
497 *lportp = lport;
498
499 return (0);
500 }
501
502 /*
503 * Return cached socket options.
504 */
505 short
inp_so_options(const struct inpcb * inp)506 inp_so_options(const struct inpcb *inp)
507 {
508 short so_options;
509
510 so_options = 0;
511
512 if ((inp->inp_flags2 & INP_REUSEPORT) != 0)
513 so_options |= SO_REUSEPORT;
514 if ((inp->inp_flags2 & INP_REUSEADDR) != 0)
515 so_options |= SO_REUSEADDR;
516 return (so_options);
517 }
518
519 /*
520 * in_rt_valid() both checks for, and attempts to ensure, that a cached route
521 * is present on a socket. It will call in_pcbrtalloc() if conditions are
522 * right (i.e. routing is enabled on the socket) and required (no route cached
523 * already or the cached rout is no longer valid). A route can only be
524 * installed if the caller passes the inp with a write lock, but the route may
525 * be used if a read lock is held.
526 */
527
528 int
in_rt_valid(struct inpcb * inp)529 in_rt_valid(struct inpcb *inp)
530 {
531 struct radix_node_head *rnh;
532
533 INP_WLOCK_ASSERT(inp);
534
535 if (inpcb_rt_cache_enable == 0)
536 return (0);
537 if (inp->inp_socket == NULL)
538 return (0);
539 if (inp->inp_socket->so_options & SO_DONTROUTE)
540 return (0);
541 if (inp->inp_vflag & INP_IPV6PROTO)
542 rnh = rt_tables_get_rnh(0, AF_INET6);
543 else
544 rnh = rt_tables_get_rnh(inp->inp_inc.inc_fibnum, AF_INET);
545 if (inp->inp_rt != NULL &&
546 (inp->inp_rt->rt_flags & RTF_UP) &&
547 inp->inp_rt_gen == rnh->rnh_gen)
548 return (1);
549 /*
550 * This will handle selectively replacing one field or the other or
551 * merely updating the inpcb's routing generation count.
552 */
553 in_pcbrtalloc(inp);
554 return (inp->inp_rt != NULL && inp->inp_rt->rt_ifp != NULL);
555 }
556
557 /*
558 * in_pcbrtalloc will install or update a cached route on an inpcb.
559 */
560
561 void
in_pcbrtalloc(struct inpcb * inp)562 in_pcbrtalloc(struct inpcb *inp)
563 {
564 struct rtentry *rt;
565 struct radix_node_head *rnh = NULL;
566 int gen;
567 struct route_in6 iproute;
568 struct ifaddr *ifa;
569 struct sockaddr_dl *sdl;
570 #ifdef INET6
571 struct route_in6 *sro6 = NULL;
572 struct sockaddr_in6 *sin6 = NULL;
573 #endif
574 #ifdef INET
575 struct sockaddr_in *sin = NULL;
576 struct route *sro = NULL;
577 #endif
578 INP_WLOCK_ASSERT(inp);
579
580 if (inpcb_rt_cache_enable == 0)
581 return;
582
583 if (inp->inp_socket->so_options & SO_DONTROUTE)
584 return;
585
586 if (inp->inp_vflag & INP_IPV6PROTO) {
587 #ifdef INET6
588 sro6 = &iproute;
589 bzero(sro6, sizeof(*sro6));
590 rnh = rt_tables_get_rnh(0, AF_INET6);
591 sin6 = (struct sockaddr_in6 *)&sro6->ro_dst;
592 sin6->sin6_family = AF_INET6;
593 sin6->sin6_len = sizeof(struct sockaddr_in6);
594 sin6->sin6_addr = inp->in6p_faddr;
595 #endif
596 } else {
597 #ifdef INET
598 sro = (struct route *)&iproute;
599 bzero(sro, sizeof(*sro));
600 rnh = rt_tables_get_rnh(inp->inp_inc.inc_fibnum, AF_INET);
601 sin = (struct sockaddr_in *)&sro->ro_dst;
602 sin->sin_family = AF_INET;
603 sin->sin_len = sizeof(struct sockaddr_in);
604 sin->sin_addr.s_addr = inp->inp_faddr.s_addr;
605 #endif
606
607 }
608 if (inp->inp_rt != NULL &&
609 inp->inp_rt_gen == rnh->rnh_gen) {
610 KASSERT(inp->inp_rt->rt_flags & RTF_UP,
611 ("gen count unchanged but route invalid"));
612 rt = inp->inp_rt;
613 return;
614 }
615 resolve:
616
617 gen = rnh->rnh_gen;
618
619 if (inp->inp_vflag & INP_IPV6PROTO) {
620 #ifdef INET6
621 #ifdef RADIX_MPATH
622 rtalloc_mpath((struct route *)sro6,
623 ntohl(sin6->sin6_addr.s6_addr32[3]));
624 #else
625 sro6->ro_rt = rtalloc1(&((struct route *)sro6)
626 ->ro_dst, 0, 0UL);
627 if (sro6->ro_rt)
628 RT_UNLOCK(sro6->ro_rt);
629 #endif
630 rt = sro6->ro_rt;
631 #endif
632 } else {
633 #ifdef INET
634 #ifdef RADIX_MPATH
635 rtalloc_mpath_fib(sro, ntohl(inp->inp_faddr.s_addr),
636 inp->inp_inc.inc_fibnum);
637 #else
638 rtalloc_ign_fib(sro, 0, inp->inp_inc.inc_fibnum);
639 #endif
640 rt = sro->ro_rt;
641 #endif
642 }
643
644 if (inp->inp_rt != NULL) {
645 if (rt == inp->inp_rt) {
646 /* The route is unchanged so we drop the added
647 * reference and update reference count.
648 */
649 RTFREE(rt);
650 inp->inp_rt_gen = gen;
651
652 /* The route has been validated and the generation
653 * count updated so we're done here.
654 */
655 return;
656 }
657 RTFREE(inp->inp_rt);
658 inp->inp_rt = NULL;
659 }
660
661 if (inp->inp_prepend != NULL) {
662 free(inp->inp_prepend, M_TEMP);
663 inp->inp_prepend = NULL;
664 }
665 if (rt == NULL)
666 return;
667 ifa = rt->rt_ifp->if_addr;
668 KASSERT(ifa != NULL, ("%s: no lladdr!\n", __func__));
669 sdl = (struct sockaddr_dl *)ifa->ifa_addr;
670 if (sdl->sdl_type != IFT_ETHER)
671 goto done;
672 inp->inp_prepend = malloc(ETHER_HDR_LEN, M_TEMP, M_WAITOK);
673 inp->inp_plen = ETHER_HDR_LEN;
674 #ifdef INET6
675 if ((inp->inp_vflag & INP_IPV6PROTO) &&
676 nd6_resolve(rt->rt_ifp, 0, NULL, (struct sockaddr *)sin6, inp->inp_prepend, NULL)) {
677 RTFREE(rt);
678 free(inp->inp_prepend, M_TEMP);
679 inp->inp_prepend = NULL;
680 return;
681 } else
682 #endif
683 {
684 #ifdef INET
685 if (arpresolve(rt->rt_ifp, 0, NULL, (struct sockaddr *)sin, inp->inp_prepend, NULL)) {
686 RTFREE(rt);
687 return;
688 }
689 #endif
690 }
691 done:
692 if (gen != rnh->rnh_gen) {
693 /*
694 * The routing tree was updated some time after we read its
695 * generation counter.
696 */
697 RTFREE(rt);
698 free(inp->inp_prepend, M_TEMP);
699 inp->inp_prepend = NULL;
700 goto resolve;
701 }
702
703 inp->inp_rt = rt;
704 inp->inp_rt_gen = gen;
705 }
706
707 #endif /* INET || INET6 */
708
709 /*
710 * Check if a new BINDMULTI socket is allowed to be created.
711 *
712 * ni points to the new inp.
713 * oi points to the exisitng inp.
714 *
715 * This checks whether the existing inp also has BINDMULTI and
716 * whether the credentials match.
717 */
718 int
in_pcbbind_check_bindmulti(const struct inpcb * ni,const struct inpcb * oi)719 in_pcbbind_check_bindmulti(const struct inpcb *ni, const struct inpcb *oi)
720 {
721 /* Check permissions match */
722 if ((ni->inp_flags2 & INP_BINDMULTI) &&
723 (ni->inp_cred->cr_uid !=
724 oi->inp_cred->cr_uid))
725 return (0);
726
727 /* Check the existing inp has BINDMULTI set */
728 if ((ni->inp_flags2 & INP_BINDMULTI) &&
729 ((oi->inp_flags2 & INP_BINDMULTI) == 0))
730 return (0);
731
732 /*
733 * We're okay - either INP_BINDMULTI isn't set on ni, or
734 * it is and it matches the checks.
735 */
736 return (1);
737 }
738
739 #ifdef INET
740 /*
741 * Set up a bind operation on a PCB, performing port allocation
742 * as required, but do not actually modify the PCB. Callers can
743 * either complete the bind by setting inp_laddr/inp_lport and
744 * calling in_pcbinshash(), or they can just use the resulting
745 * port and address to authorise the sending of a once-off packet.
746 *
747 * On error, the values of *laddrp and *lportp are not changed.
748 */
749 int
in_pcbbind_setup(struct inpcb * inp,struct sockaddr * nam,in_addr_t * laddrp,u_short * lportp,struct ucred * cred)750 in_pcbbind_setup(struct inpcb *inp, struct sockaddr *nam, in_addr_t *laddrp,
751 u_short *lportp, struct ucred *cred)
752 {
753 struct socket *so = inp->inp_socket;
754 struct sockaddr_in *sin;
755 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
756 struct in_addr laddr;
757 u_short lport = 0;
758 int lookupflags = 0, reuseport = (so->so_options & SO_REUSEPORT);
759 int error;
760
761 /*
762 * No state changes, so read locks are sufficient here.
763 */
764 INP_LOCK_ASSERT(inp);
765 INP_HASH_LOCK_ASSERT(pcbinfo);
766
767 if (TAILQ_EMPTY(&V_in_ifaddrhead)) /* XXX broken! */
768 return (EADDRNOTAVAIL);
769 laddr.s_addr = *laddrp;
770 if (nam != NULL && laddr.s_addr != INADDR_ANY)
771 return (EINVAL);
772 if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0)
773 lookupflags = INPLOOKUP_WILDCARD;
774 if (nam == NULL) {
775 if ((error = prison_local_ip4(cred, &laddr)) != 0)
776 return (error);
777 } else {
778 sin = (struct sockaddr_in *)nam;
779 if (nam->sa_len != sizeof (*sin))
780 return (EINVAL);
781 #ifdef notdef
782 /*
783 * We should check the family, but old programs
784 * incorrectly fail to initialize it.
785 */
786 if (sin->sin_family != AF_INET)
787 return (EAFNOSUPPORT);
788 #endif
789 error = prison_local_ip4(cred, &sin->sin_addr);
790 if (error)
791 return (error);
792 if (sin->sin_port != *lportp) {
793 /* Don't allow the port to change. */
794 if (*lportp != 0)
795 return (EINVAL);
796 lport = sin->sin_port;
797 }
798 /* NB: lport is left as 0 if the port isn't being changed. */
799 if (IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
800 /*
801 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
802 * allow complete duplication of binding if
803 * SO_REUSEPORT is set, or if SO_REUSEADDR is set
804 * and a multicast address is bound on both
805 * new and duplicated sockets.
806 */
807 if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) != 0)
808 reuseport = SO_REUSEADDR|SO_REUSEPORT;
809 } else if (sin->sin_addr.s_addr != INADDR_ANY) {
810 sin->sin_port = 0; /* yech... */
811 bzero(&sin->sin_zero, sizeof(sin->sin_zero));
812 /*
813 * Is the address a local IP address?
814 * If INP_BINDANY is set, then the socket may be bound
815 * to any endpoint address, local or not.
816 */
817 if ((inp->inp_flags & INP_BINDANY) == 0 &&
818 ifa_ifwithaddr_check((struct sockaddr *)sin) == 0)
819 return (EADDRNOTAVAIL);
820 }
821 laddr = sin->sin_addr;
822 if (lport) {
823 struct inpcb *t;
824 struct tcptw *tw;
825
826 /* GROSS */
827 if (ntohs(lport) <= V_ipport_reservedhigh &&
828 ntohs(lport) >= V_ipport_reservedlow &&
829 priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT,
830 0))
831 return (EACCES);
832 if (!IN_MULTICAST(ntohl(sin->sin_addr.s_addr)) &&
833 priv_check_cred(inp->inp_cred,
834 PRIV_NETINET_REUSEPORT, 0) != 0) {
835 t = in_pcblookup_local(pcbinfo, sin->sin_addr,
836 lport, INPLOOKUP_WILDCARD, cred);
837 /*
838 * XXX
839 * This entire block sorely needs a rewrite.
840 */
841 if (t &&
842 ((inp->inp_flags2 & INP_BINDMULTI) == 0) &&
843 ((t->inp_flags & INP_TIMEWAIT) == 0) &&
844 (so->so_type != SOCK_STREAM ||
845 ntohl(t->inp_faddr.s_addr) == INADDR_ANY) &&
846 (ntohl(sin->sin_addr.s_addr) != INADDR_ANY ||
847 ntohl(t->inp_laddr.s_addr) != INADDR_ANY ||
848 (t->inp_flags2 & INP_REUSEPORT) == 0) &&
849 (inp->inp_cred->cr_uid !=
850 t->inp_cred->cr_uid))
851 return (EADDRINUSE);
852
853 /*
854 * If the socket is a BINDMULTI socket, then
855 * the credentials need to match and the
856 * original socket also has to have been bound
857 * with BINDMULTI.
858 */
859 if (t && (! in_pcbbind_check_bindmulti(inp, t)))
860 return (EADDRINUSE);
861 }
862 t = in_pcblookup_local(pcbinfo, sin->sin_addr,
863 lport, lookupflags, cred);
864 if (t && (t->inp_flags & INP_TIMEWAIT)) {
865 /*
866 * XXXRW: If an incpb has had its timewait
867 * state recycled, we treat the address as
868 * being in use (for now). This is better
869 * than a panic, but not desirable.
870 */
871 tw = intotw(t);
872 if (tw == NULL ||
873 (reuseport & tw->tw_so_options) == 0)
874 return (EADDRINUSE);
875 } else if (t &&
876 ((inp->inp_flags2 & INP_BINDMULTI) == 0) &&
877 (reuseport & inp_so_options(t)) == 0) {
878 #ifdef INET6
879 if (ntohl(sin->sin_addr.s_addr) !=
880 INADDR_ANY ||
881 ntohl(t->inp_laddr.s_addr) !=
882 INADDR_ANY ||
883 (inp->inp_vflag & INP_IPV6PROTO) == 0 ||
884 (t->inp_vflag & INP_IPV6PROTO) == 0)
885 #endif
886 return (EADDRINUSE);
887 if (t && (! in_pcbbind_check_bindmulti(inp, t)))
888 return (EADDRINUSE);
889 }
890 }
891 }
892 if (*lportp != 0)
893 lport = *lportp;
894 if (lport == 0) {
895 error = in_pcb_lport(inp, &laddr, &lport, cred, lookupflags);
896 if (error != 0)
897 return (error);
898
899 }
900 *laddrp = laddr.s_addr;
901 *lportp = lport;
902 return (0);
903 }
904
905 /*
906 * Connect from a socket to a specified address.
907 * Both address and port must be specified in argument sin.
908 * If don't have a local address for this socket yet,
909 * then pick one.
910 */
911 int
in_pcbconnect_mbuf(struct inpcb * inp,struct sockaddr * nam,struct ucred * cred,struct mbuf * m)912 in_pcbconnect_mbuf(struct inpcb *inp, struct sockaddr *nam,
913 struct ucred *cred, struct mbuf *m)
914 {
915 u_short lport, fport;
916 in_addr_t laddr, faddr;
917 int anonport, error;
918
919 INP_WLOCK_ASSERT(inp);
920 INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);
921
922 lport = inp->inp_lport;
923 laddr = inp->inp_laddr.s_addr;
924 anonport = (lport == 0);
925 error = in_pcbconnect_setup(inp, nam, &laddr, &lport, &faddr, &fport,
926 NULL, cred);
927 if (error)
928 return (error);
929
930 /* Do the initial binding of the local address if required. */
931 if (inp->inp_laddr.s_addr == INADDR_ANY && inp->inp_lport == 0) {
932 inp->inp_lport = lport;
933 inp->inp_laddr.s_addr = laddr;
934 if (in_pcbinshash(inp) != 0) {
935 inp->inp_laddr.s_addr = INADDR_ANY;
936 inp->inp_lport = 0;
937 return (EAGAIN);
938 }
939 }
940
941 /* Commit the remaining changes. */
942 inp->inp_lport = lport;
943 inp->inp_laddr.s_addr = laddr;
944 inp->inp_faddr.s_addr = faddr;
945 inp->inp_fport = fport;
946
947 in_pcbrehash_mbuf(inp, m);
948
949 if (anonport)
950 inp->inp_flags |= INP_ANONPORT;
951 return (0);
952 }
953
954 int
in_pcbconnect(struct inpcb * inp,struct sockaddr * nam,struct ucred * cred)955 in_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct ucred *cred)
956 {
957
958 return (in_pcbconnect_mbuf(inp, nam, cred, NULL));
959 }
960
961 /*
962 * Do proper source address selection on an unbound socket in case
963 * of connect. Take jails into account as well.
964 */
965 int
in_pcbladdr(struct inpcb * inp,struct in_addr * faddr,struct in_addr * laddr,struct ucred * cred)966 in_pcbladdr(struct inpcb *inp, struct in_addr *faddr, struct in_addr *laddr,
967 struct ucred *cred)
968 {
969 struct ifaddr *ifa;
970 struct sockaddr *sa;
971 struct sockaddr_in *sin;
972 struct route sro;
973 int error;
974
975 KASSERT(laddr != NULL, ("%s: laddr NULL", __func__));
976
977 /*
978 * Bypass source address selection and use the primary jail IP
979 * if requested.
980 */
981 if (cred != NULL && !prison_saddrsel_ip4(cred, laddr))
982 return (0);
983
984 error = 0;
985 bzero(&sro, sizeof(sro));
986
987 sin = (struct sockaddr_in *)&sro.ro_dst;
988 sin->sin_family = AF_INET;
989 sin->sin_len = sizeof(struct sockaddr_in);
990 sin->sin_addr.s_addr = faddr->s_addr;
991
992 /*
993 * If route is known our src addr is taken from the i/f,
994 * else punt.
995 *
996 * Find out route to destination.
997 */
998 if ((inp->inp_socket->so_options & SO_DONTROUTE) == 0)
999 rtalloc_ign_fib(&sro, 0, inp->inp_inc.inc_fibnum);
1000
1001 /*
1002 * If we found a route, use the address corresponding to
1003 * the outgoing interface.
1004 *
1005 * Otherwise assume faddr is reachable on a directly connected
1006 * network and try to find a corresponding interface to take
1007 * the source address from.
1008 */
1009 if (sro.ro_rt == NULL || sro.ro_rt->rt_ifp == NULL) {
1010 struct in_ifaddr *ia;
1011 struct ifnet *ifp;
1012
1013 ia = ifatoia(ifa_ifwithdstaddr((struct sockaddr *)sin,
1014 inp->inp_socket->so_fibnum));
1015 if (ia == NULL)
1016 ia = ifatoia(ifa_ifwithnet((struct sockaddr *)sin, 0,
1017 inp->inp_socket->so_fibnum));
1018 if (ia == NULL) {
1019 error = ENETUNREACH;
1020 goto done;
1021 }
1022
1023 if (cred == NULL || !prison_flag(cred, PR_IP4)) {
1024 laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1025 ifa_free(&ia->ia_ifa);
1026 goto done;
1027 }
1028
1029 ifp = ia->ia_ifp;
1030 ifa_free(&ia->ia_ifa);
1031 ia = NULL;
1032 IF_ADDR_RLOCK(ifp);
1033 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1034
1035 sa = ifa->ifa_addr;
1036 if (sa->sa_family != AF_INET)
1037 continue;
1038 sin = (struct sockaddr_in *)sa;
1039 if (prison_check_ip4(cred, &sin->sin_addr) == 0) {
1040 ia = (struct in_ifaddr *)ifa;
1041 break;
1042 }
1043 }
1044 if (ia != NULL) {
1045 laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1046 IF_ADDR_RUNLOCK(ifp);
1047 goto done;
1048 }
1049 IF_ADDR_RUNLOCK(ifp);
1050
1051 /* 3. As a last resort return the 'default' jail address. */
1052 error = prison_get_ip4(cred, laddr);
1053 goto done;
1054 }
1055
1056 /*
1057 * If the outgoing interface on the route found is not
1058 * a loopback interface, use the address from that interface.
1059 * In case of jails do those three steps:
1060 * 1. check if the interface address belongs to the jail. If so use it.
1061 * 2. check if we have any address on the outgoing interface
1062 * belonging to this jail. If so use it.
1063 * 3. as a last resort return the 'default' jail address.
1064 */
1065 if ((sro.ro_rt->rt_ifp->if_flags & IFF_LOOPBACK) == 0) {
1066 struct in_ifaddr *ia;
1067 struct ifnet *ifp;
1068
1069 /* If not jailed, use the default returned. */
1070 if (cred == NULL || !prison_flag(cred, PR_IP4)) {
1071 ia = (struct in_ifaddr *)sro.ro_rt->rt_ifa;
1072 laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1073 goto done;
1074 }
1075
1076 /* Jailed. */
1077 /* 1. Check if the iface address belongs to the jail. */
1078 sin = (struct sockaddr_in *)sro.ro_rt->rt_ifa->ifa_addr;
1079 if (prison_check_ip4(cred, &sin->sin_addr) == 0) {
1080 ia = (struct in_ifaddr *)sro.ro_rt->rt_ifa;
1081 laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1082 goto done;
1083 }
1084
1085 /*
1086 * 2. Check if we have any address on the outgoing interface
1087 * belonging to this jail.
1088 */
1089 ia = NULL;
1090 ifp = sro.ro_rt->rt_ifp;
1091 IF_ADDR_RLOCK(ifp);
1092 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1093 sa = ifa->ifa_addr;
1094 if (sa->sa_family != AF_INET)
1095 continue;
1096 sin = (struct sockaddr_in *)sa;
1097 if (prison_check_ip4(cred, &sin->sin_addr) == 0) {
1098 ia = (struct in_ifaddr *)ifa;
1099 break;
1100 }
1101 }
1102 if (ia != NULL) {
1103 laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1104 IF_ADDR_RUNLOCK(ifp);
1105 goto done;
1106 }
1107 IF_ADDR_RUNLOCK(ifp);
1108
1109 /* 3. As a last resort return the 'default' jail address. */
1110 error = prison_get_ip4(cred, laddr);
1111 goto done;
1112 }
1113
1114 /*
1115 * The outgoing interface is marked with 'loopback net', so a route
1116 * to ourselves is here.
1117 * Try to find the interface of the destination address and then
1118 * take the address from there. That interface is not necessarily
1119 * a loopback interface.
1120 * In case of jails, check that it is an address of the jail
1121 * and if we cannot find, fall back to the 'default' jail address.
1122 */
1123 if ((sro.ro_rt->rt_ifp->if_flags & IFF_LOOPBACK) != 0) {
1124 struct sockaddr_in sain;
1125 struct in_ifaddr *ia;
1126
1127 bzero(&sain, sizeof(struct sockaddr_in));
1128 sain.sin_family = AF_INET;
1129 sain.sin_len = sizeof(struct sockaddr_in);
1130 sain.sin_addr.s_addr = faddr->s_addr;
1131
1132 ia = ifatoia(ifa_ifwithdstaddr(sintosa(&sain),
1133 inp->inp_socket->so_fibnum));
1134 if (ia == NULL)
1135 ia = ifatoia(ifa_ifwithnet(sintosa(&sain), 0,
1136 inp->inp_socket->so_fibnum));
1137 if (ia == NULL)
1138 ia = ifatoia(ifa_ifwithaddr(sintosa(&sain)));
1139
1140 if (cred == NULL || !prison_flag(cred, PR_IP4)) {
1141 if (ia == NULL) {
1142 error = ENETUNREACH;
1143 goto done;
1144 }
1145 laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1146 ifa_free(&ia->ia_ifa);
1147 goto done;
1148 }
1149
1150 /* Jailed. */
1151 if (ia != NULL) {
1152 struct ifnet *ifp;
1153
1154 ifp = ia->ia_ifp;
1155 ifa_free(&ia->ia_ifa);
1156 ia = NULL;
1157 IF_ADDR_RLOCK(ifp);
1158 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1159
1160 sa = ifa->ifa_addr;
1161 if (sa->sa_family != AF_INET)
1162 continue;
1163 sin = (struct sockaddr_in *)sa;
1164 if (prison_check_ip4(cred,
1165 &sin->sin_addr) == 0) {
1166 ia = (struct in_ifaddr *)ifa;
1167 break;
1168 }
1169 }
1170 if (ia != NULL) {
1171 laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1172 IF_ADDR_RUNLOCK(ifp);
1173 goto done;
1174 }
1175 IF_ADDR_RUNLOCK(ifp);
1176 }
1177
1178 /* 3. As a last resort return the 'default' jail address. */
1179 error = prison_get_ip4(cred, laddr);
1180 goto done;
1181 }
1182
1183 done:
1184 if (sro.ro_rt != NULL)
1185 RTFREE(sro.ro_rt);
1186 return (error);
1187 }
1188
1189 /*
1190 * Set up for a connect from a socket to the specified address.
1191 * On entry, *laddrp and *lportp should contain the current local
1192 * address and port for the PCB; these are updated to the values
1193 * that should be placed in inp_laddr and inp_lport to complete
1194 * the connect.
1195 *
1196 * On success, *faddrp and *fportp will be set to the remote address
1197 * and port. These are not updated in the error case.
1198 *
1199 * If the operation fails because the connection already exists,
1200 * *oinpp will be set to the PCB of that connection so that the
1201 * caller can decide to override it. In all other cases, *oinpp
1202 * is set to NULL.
1203 */
1204 int
in_pcbconnect_setup(struct inpcb * inp,struct sockaddr * nam,in_addr_t * laddrp,u_short * lportp,in_addr_t * faddrp,u_short * fportp,struct inpcb ** oinpp,struct ucred * cred)1205 in_pcbconnect_setup(struct inpcb *inp, struct sockaddr *nam,
1206 in_addr_t *laddrp, u_short *lportp, in_addr_t *faddrp, u_short *fportp,
1207 struct inpcb **oinpp, struct ucred *cred)
1208 {
1209 struct rm_priotracker in_ifa_tracker;
1210 struct sockaddr_in *sin = (struct sockaddr_in *)nam;
1211 struct in_ifaddr *ia;
1212 struct inpcb *oinp;
1213 struct in_addr laddr, faddr;
1214 u_short lport, fport;
1215 int error;
1216
1217 /*
1218 * Because a global state change doesn't actually occur here, a read
1219 * lock is sufficient.
1220 */
1221 INP_LOCK_ASSERT(inp);
1222 INP_HASH_LOCK_ASSERT(inp->inp_pcbinfo);
1223
1224 if (oinpp != NULL)
1225 *oinpp = NULL;
1226 if (nam->sa_len != sizeof (*sin))
1227 return (EINVAL);
1228 if (sin->sin_family != AF_INET)
1229 return (EAFNOSUPPORT);
1230 if (sin->sin_port == 0)
1231 return (EADDRNOTAVAIL);
1232 laddr.s_addr = *laddrp;
1233 lport = *lportp;
1234 faddr = sin->sin_addr;
1235 fport = sin->sin_port;
1236
1237 if (!TAILQ_EMPTY(&V_in_ifaddrhead)) {
1238 /*
1239 * If the destination address is INADDR_ANY,
1240 * use the primary local address.
1241 * If the supplied address is INADDR_BROADCAST,
1242 * and the primary interface supports broadcast,
1243 * choose the broadcast address for that interface.
1244 */
1245 if (faddr.s_addr == INADDR_ANY) {
1246 IN_IFADDR_RLOCK(&in_ifa_tracker);
1247 faddr =
1248 IA_SIN(TAILQ_FIRST(&V_in_ifaddrhead))->sin_addr;
1249 IN_IFADDR_RUNLOCK(&in_ifa_tracker);
1250 if (cred != NULL &&
1251 (error = prison_get_ip4(cred, &faddr)) != 0)
1252 return (error);
1253 } else if (faddr.s_addr == (u_long)INADDR_BROADCAST) {
1254 IN_IFADDR_RLOCK(&in_ifa_tracker);
1255 if (TAILQ_FIRST(&V_in_ifaddrhead)->ia_ifp->if_flags &
1256 IFF_BROADCAST)
1257 faddr = satosin(&TAILQ_FIRST(
1258 &V_in_ifaddrhead)->ia_broadaddr)->sin_addr;
1259 IN_IFADDR_RUNLOCK(&in_ifa_tracker);
1260 }
1261 }
1262 if (laddr.s_addr == INADDR_ANY) {
1263 error = in_pcbladdr(inp, &faddr, &laddr, cred);
1264 /*
1265 * If the destination address is multicast and an outgoing
1266 * interface has been set as a multicast option, prefer the
1267 * address of that interface as our source address.
1268 */
1269 if (IN_MULTICAST(ntohl(faddr.s_addr)) &&
1270 inp->inp_moptions != NULL) {
1271 struct ip_moptions *imo;
1272 struct ifnet *ifp;
1273
1274 imo = inp->inp_moptions;
1275 if (imo->imo_multicast_ifp != NULL) {
1276 ifp = imo->imo_multicast_ifp;
1277 IN_IFADDR_RLOCK(&in_ifa_tracker);
1278 TAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) {
1279 if ((ia->ia_ifp == ifp) &&
1280 (cred == NULL ||
1281 prison_check_ip4(cred,
1282 &ia->ia_addr.sin_addr) == 0))
1283 break;
1284 }
1285 if (ia == NULL)
1286 error = EADDRNOTAVAIL;
1287 else {
1288 laddr = ia->ia_addr.sin_addr;
1289 error = 0;
1290 }
1291 IN_IFADDR_RUNLOCK(&in_ifa_tracker);
1292 }
1293 }
1294 if (error)
1295 return (error);
1296 }
1297 oinp = in_pcblookup_hash_locked(inp->inp_pcbinfo, faddr, fport,
1298 laddr, lport, 0, NULL);
1299 if (oinp != NULL) {
1300 if (oinpp != NULL)
1301 *oinpp = oinp;
1302 return (EADDRINUSE);
1303 }
1304 if (lport == 0) {
1305 error = in_pcbbind_setup(inp, NULL, &laddr.s_addr, &lport,
1306 cred);
1307 if (error)
1308 return (error);
1309 }
1310 *laddrp = laddr.s_addr;
1311 *lportp = lport;
1312 *faddrp = faddr.s_addr;
1313 *fportp = fport;
1314 return (0);
1315 }
1316
1317 void
in_pcbdisconnect(struct inpcb * inp)1318 in_pcbdisconnect(struct inpcb *inp)
1319 {
1320
1321 INP_WLOCK_ASSERT(inp);
1322 INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);
1323
1324 if (inp->inp_rt != NULL) {
1325 RTFREE(inp->inp_rt);
1326 inp->inp_rt = NULL;
1327 }
1328 if (inp->inp_ifaddr != NULL) {
1329 ifa_free(&inp->inp_ifaddr->ia_ifa);
1330 inp->inp_ifaddr = NULL;
1331 }
1332 if (inp->inp_prepend != NULL) {
1333 free(inp->inp_prepend, M_DEVBUF);
1334 inp->inp_prepend = NULL;
1335 }
1336
1337 inp->inp_faddr.s_addr = INADDR_ANY;
1338 inp->inp_fport = 0;
1339 in_pcbrehash(inp);
1340 }
1341 #endif /* INET */
1342
1343 /*
1344 * in_pcbdetach() is responsibe for disassociating a socket from an inpcb.
1345 * For most protocols, this will be invoked immediately prior to calling
1346 * in_pcbfree(). However, with TCP the inpcb may significantly outlive the
1347 * socket, in which case in_pcbfree() is deferred.
1348 */
1349 void
in_pcbdetach(struct inpcb * inp)1350 in_pcbdetach(struct inpcb *inp)
1351 {
1352
1353 KASSERT(inp->inp_socket != NULL, ("%s: inp_socket == NULL", __func__));
1354
1355 inp->inp_socket->so_pcb = NULL;
1356 inp->inp_socket = NULL;
1357 }
1358
1359 /*
1360 * in_pcbref() bumps the reference count on an inpcb in order to maintain
1361 * stability of an inpcb pointer despite the inpcb lock being released. This
1362 * is used in TCP when the inpcbinfo lock needs to be acquired or upgraded,
1363 * but where the inpcb lock may already held, or when acquiring a reference
1364 * via a pcbgroup.
1365 *
1366 * in_pcbref() should be used only to provide brief memory stability, and
1367 * must always be followed by a call to INP_WLOCK() and in_pcbrele() to
1368 * garbage collect the inpcb if it has been in_pcbfree()'d from another
1369 * context. Until in_pcbrele() has returned that the inpcb is still valid,
1370 * lock and rele are the *only* safe operations that may be performed on the
1371 * inpcb.
1372 *
1373 * While the inpcb will not be freed, releasing the inpcb lock means that the
1374 * connection's state may change, so the caller should be careful to
1375 * revalidate any cached state on reacquiring the lock. Drop the reference
1376 * using in_pcbrele().
1377 */
1378 void
in_pcbref(struct inpcb * inp)1379 in_pcbref(struct inpcb *inp)
1380 {
1381
1382 KASSERT(inp->inp_refcount > 0, ("%s: refcount 0", __func__));
1383
1384 refcount_acquire(&inp->inp_refcount);
1385 }
1386
1387 /*
1388 * Drop a refcount on an inpcb elevated using in_pcbref(); because a call to
1389 * in_pcbfree() may have been made between in_pcbref() and in_pcbrele(), we
1390 * return a flag indicating whether or not the inpcb remains valid. If it is
1391 * valid, we return with the inpcb lock held.
1392 *
1393 * Notice that, unlike in_pcbref(), the inpcb lock must be held to drop a
1394 * reference on an inpcb. Historically more work was done here (actually, in
1395 * in_pcbfree_internal()) but has been moved to in_pcbfree() to avoid the
1396 * need for the pcbinfo lock in in_pcbrele(). Deferring the free is entirely
1397 * about memory stability (and continued use of the write lock).
1398 */
1399 int
in_pcbrele_rlocked(struct inpcb * inp)1400 in_pcbrele_rlocked(struct inpcb *inp)
1401 {
1402 struct inpcbinfo *pcbinfo;
1403
1404 KASSERT(inp->inp_refcount > 0, ("%s: refcount 0", __func__));
1405
1406 INP_RLOCK_ASSERT(inp);
1407
1408 if (refcount_release(&inp->inp_refcount) == 0) {
1409 /*
1410 * If the inpcb has been freed, let the caller know, even if
1411 * this isn't the last reference.
1412 */
1413 if (inp->inp_flags2 & INP_FREED) {
1414 INP_RUNLOCK(inp);
1415 return (1);
1416 }
1417 return (0);
1418 }
1419
1420 KASSERT(inp->inp_socket == NULL, ("%s: inp_socket != NULL", __func__));
1421
1422 INP_RUNLOCK(inp);
1423 pcbinfo = inp->inp_pcbinfo;
1424 uma_zfree(pcbinfo->ipi_zone, inp);
1425 return (1);
1426 }
1427
1428 int
in_pcbrele_wlocked(struct inpcb * inp)1429 in_pcbrele_wlocked(struct inpcb *inp)
1430 {
1431 struct inpcbinfo *pcbinfo;
1432
1433 KASSERT(inp->inp_refcount > 0, ("%s: refcount 0", __func__));
1434
1435 INP_WLOCK_ASSERT(inp);
1436
1437 if (refcount_release(&inp->inp_refcount) == 0) {
1438 /*
1439 * If the inpcb has been freed, let the caller know, even if
1440 * this isn't the last reference.
1441 */
1442 if (inp->inp_flags2 & INP_FREED) {
1443 INP_WUNLOCK(inp);
1444 return (1);
1445 }
1446 return (0);
1447 }
1448
1449 KASSERT(inp->inp_socket == NULL, ("%s: inp_socket != NULL", __func__));
1450
1451 INP_WUNLOCK(inp);
1452 pcbinfo = inp->inp_pcbinfo;
1453 uma_zfree(pcbinfo->ipi_zone, inp);
1454 return (1);
1455 }
1456
1457 /*
1458 * Temporary wrapper.
1459 */
1460 int
in_pcbrele(struct inpcb * inp)1461 in_pcbrele(struct inpcb *inp)
1462 {
1463
1464 return (in_pcbrele_wlocked(inp));
1465 }
1466
1467 /*
1468 * Unconditionally schedule an inpcb to be freed by decrementing its
1469 * reference count, which should occur only after the inpcb has been detached
1470 * from its socket. If another thread holds a temporary reference (acquired
1471 * using in_pcbref()) then the free is deferred until that reference is
1472 * released using in_pcbrele(), but the inpcb is still unlocked. Almost all
1473 * work, including removal from global lists, is done in this context, where
1474 * the pcbinfo lock is held.
1475 */
1476 void
in_pcbfree(struct inpcb * inp)1477 in_pcbfree(struct inpcb *inp)
1478 {
1479 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
1480
1481 KASSERT(inp->inp_socket == NULL, ("%s: inp_socket != NULL", __func__));
1482
1483 #ifdef INVARIANTS
1484 if (pcbinfo == &V_tcbinfo) {
1485 INP_INFO_LOCK_ASSERT(pcbinfo);
1486 } else {
1487 INP_INFO_WLOCK_ASSERT(pcbinfo);
1488 }
1489 #endif
1490 INP_WLOCK_ASSERT(inp);
1491
1492 if (inp->inp_rt != NULL) {
1493 RTFREE(inp->inp_rt);
1494 inp->inp_rt = NULL;
1495 #ifdef INET
1496 KASSERT(inp->inp_ifaddr != NULL, ("route valid but ifaddr not set"));
1497 ifa_free(&inp->inp_ifaddr->ia_ifa);
1498 inp->inp_ifaddr = NULL;
1499 #endif
1500 }
1501 if (inp->inp_prepend != NULL) {
1502 free(inp->inp_prepend, M_DEVBUF);
1503 inp->inp_prepend = NULL;
1504 }
1505
1506 /* XXXRW: Do as much as possible here. */
1507 #ifdef IPSEC
1508 if (inp->inp_sp != NULL)
1509 ipsec_delete_pcbpolicy(inp);
1510 #endif
1511 INP_LIST_WLOCK(pcbinfo);
1512 inp->inp_gencnt = ++pcbinfo->ipi_gencnt;
1513 in_pcbremlists(inp);
1514 INP_LIST_WUNLOCK(pcbinfo);
1515 #ifdef INET6
1516 if (inp->inp_vflag & INP_IPV6PROTO) {
1517 ip6_freepcbopts(inp->in6p_outputopts);
1518 if (inp->in6p_moptions != NULL)
1519 ip6_freemoptions(inp->in6p_moptions);
1520 }
1521 #endif
1522 if (inp->inp_options)
1523 (void)m_free(inp->inp_options);
1524 #ifdef INET
1525 if (inp->inp_moptions != NULL)
1526 inp_freemoptions(inp->inp_moptions);
1527 #endif
1528 inp->inp_vflag = 0;
1529 inp->inp_flags2 |= INP_FREED;
1530 crfree(inp->inp_cred);
1531 #ifdef MAC
1532 mac_inpcb_destroy(inp);
1533 #endif
1534 if (!in_pcbrele_wlocked(inp))
1535 INP_WUNLOCK(inp);
1536 }
1537
1538 /*
1539 * in_pcbdrop() removes an inpcb from hashed lists, releasing its address and
1540 * port reservation, and preventing it from being returned by inpcb lookups.
1541 *
1542 * It is used by TCP to mark an inpcb as unused and avoid future packet
1543 * delivery or event notification when a socket remains open but TCP has
1544 * closed. This might occur as a result of a shutdown()-initiated TCP close
1545 * or a RST on the wire, and allows the port binding to be reused while still
1546 * maintaining the invariant that so_pcb always points to a valid inpcb until
1547 * in_pcbdetach().
1548 *
1549 * XXXRW: Possibly in_pcbdrop() should also prevent future notifications by
1550 * in_pcbnotifyall() and in_pcbpurgeif0()?
1551 */
1552 void
in_pcbdrop(struct inpcb * inp)1553 in_pcbdrop(struct inpcb *inp)
1554 {
1555
1556 INP_WLOCK_ASSERT(inp);
1557
1558 /*
1559 * XXXRW: Possibly we should protect the setting of INP_DROPPED with
1560 * the hash lock...?
1561 */
1562 inp->inp_flags |= INP_DROPPED;
1563 if (inp->inp_flags & INP_INHASHLIST) {
1564 struct inpcbport *phd = inp->inp_phd;
1565
1566 INP_HASH_WLOCK(inp->inp_pcbinfo);
1567 LIST_REMOVE(inp, inp_hash);
1568 LIST_REMOVE(inp, inp_portlist);
1569 if (LIST_FIRST(&phd->phd_pcblist) == NULL) {
1570 LIST_REMOVE(phd, phd_hash);
1571 free(phd, M_PCB);
1572 }
1573 INP_HASH_WUNLOCK(inp->inp_pcbinfo);
1574 inp->inp_flags &= ~INP_INHASHLIST;
1575 #ifdef PCBGROUP
1576 in_pcbgroup_remove(inp);
1577 #endif
1578 }
1579 }
1580
1581 #ifdef INET
1582 /*
1583 * Common routines to return the socket addresses associated with inpcbs.
1584 */
1585 struct sockaddr *
in_sockaddr(in_port_t port,struct in_addr * addr_p)1586 in_sockaddr(in_port_t port, struct in_addr *addr_p)
1587 {
1588 struct sockaddr_in *sin;
1589
1590 sin = malloc(sizeof *sin, M_SONAME,
1591 M_WAITOK | M_ZERO);
1592 sin->sin_family = AF_INET;
1593 sin->sin_len = sizeof(*sin);
1594 sin->sin_addr = *addr_p;
1595 sin->sin_port = port;
1596
1597 return (struct sockaddr *)sin;
1598 }
1599
1600 int
in_getsockaddr(struct socket * so,struct sockaddr ** nam)1601 in_getsockaddr(struct socket *so, struct sockaddr **nam)
1602 {
1603 struct inpcb *inp;
1604 struct in_addr addr;
1605 in_port_t port;
1606
1607 inp = sotoinpcb(so);
1608 KASSERT(inp != NULL, ("in_getsockaddr: inp == NULL"));
1609
1610 INP_RLOCK(inp);
1611 port = inp->inp_lport;
1612 addr = inp->inp_laddr;
1613 INP_RUNLOCK(inp);
1614
1615 *nam = in_sockaddr(port, &addr);
1616 return 0;
1617 }
1618
1619 int
in_getpeeraddr(struct socket * so,struct sockaddr ** nam)1620 in_getpeeraddr(struct socket *so, struct sockaddr **nam)
1621 {
1622 struct inpcb *inp;
1623 struct in_addr addr;
1624 in_port_t port;
1625
1626 inp = sotoinpcb(so);
1627 KASSERT(inp != NULL, ("in_getpeeraddr: inp == NULL"));
1628
1629 INP_RLOCK(inp);
1630 port = inp->inp_fport;
1631 addr = inp->inp_faddr;
1632 INP_RUNLOCK(inp);
1633
1634 *nam = in_sockaddr(port, &addr);
1635 return 0;
1636 }
1637
1638 void
in_pcbnotifyall(struct inpcbinfo * pcbinfo,struct in_addr faddr,int errno,struct inpcb * (* notify)(struct inpcb *,int))1639 in_pcbnotifyall(struct inpcbinfo *pcbinfo, struct in_addr faddr, int errno,
1640 struct inpcb *(*notify)(struct inpcb *, int))
1641 {
1642 struct inpcb *inp, *inp_temp;
1643
1644 INP_INFO_WLOCK(pcbinfo);
1645 LIST_FOREACH_SAFE(inp, pcbinfo->ipi_listhead, inp_list, inp_temp) {
1646 INP_WLOCK(inp);
1647 #ifdef INET6
1648 if ((inp->inp_vflag & INP_IPV4) == 0) {
1649 INP_WUNLOCK(inp);
1650 continue;
1651 }
1652 #endif
1653 if (inp->inp_faddr.s_addr != faddr.s_addr ||
1654 inp->inp_socket == NULL) {
1655 INP_WUNLOCK(inp);
1656 continue;
1657 }
1658 if ((*notify)(inp, errno))
1659 INP_WUNLOCK(inp);
1660 }
1661 INP_INFO_WUNLOCK(pcbinfo);
1662 }
1663
1664 void
in_pcbpurgeif0(struct inpcbinfo * pcbinfo,struct ifnet * ifp)1665 in_pcbpurgeif0(struct inpcbinfo *pcbinfo, struct ifnet *ifp)
1666 {
1667 struct inpcb *inp;
1668 struct ip_moptions *imo;
1669 int i, gap;
1670
1671 INP_INFO_WLOCK(pcbinfo);
1672 LIST_FOREACH(inp, pcbinfo->ipi_listhead, inp_list) {
1673 INP_WLOCK(inp);
1674 imo = inp->inp_moptions;
1675 if ((inp->inp_vflag & INP_IPV4) &&
1676 imo != NULL) {
1677 /*
1678 * Unselect the outgoing interface if it is being
1679 * detached.
1680 */
1681 if (imo->imo_multicast_ifp == ifp)
1682 imo->imo_multicast_ifp = NULL;
1683
1684 /*
1685 * Drop multicast group membership if we joined
1686 * through the interface being detached.
1687 */
1688 for (i = 0, gap = 0; i < imo->imo_num_memberships;
1689 i++) {
1690 if (imo->imo_membership[i]->inm_ifp == ifp) {
1691 in_delmulti(imo->imo_membership[i]);
1692 gap++;
1693 } else if (gap != 0)
1694 imo->imo_membership[i - gap] =
1695 imo->imo_membership[i];
1696 }
1697 imo->imo_num_memberships -= gap;
1698 }
1699 INP_WUNLOCK(inp);
1700 }
1701 INP_INFO_WUNLOCK(pcbinfo);
1702 }
1703
1704 /*
1705 * Lookup a PCB based on the local address and port. Caller must hold the
1706 * hash lock. No inpcb locks or references are acquired.
1707 */
1708 #define INP_LOOKUP_MAPPED_PCB_COST 3
1709 struct inpcb *
in_pcblookup_local(struct inpcbinfo * pcbinfo,struct in_addr laddr,u_short lport,int lookupflags,struct ucred * cred)1710 in_pcblookup_local(struct inpcbinfo *pcbinfo, struct in_addr laddr,
1711 u_short lport, int lookupflags, struct ucred *cred)
1712 {
1713 struct inpcb *inp;
1714 #ifdef INET6
1715 int matchwild = 3 + INP_LOOKUP_MAPPED_PCB_COST;
1716 #else
1717 int matchwild = 3;
1718 #endif
1719 int wildcard;
1720
1721 KASSERT((lookupflags & ~(INPLOOKUP_WILDCARD)) == 0,
1722 ("%s: invalid lookup flags %d", __func__, lookupflags));
1723
1724 INP_HASH_LOCK_ASSERT(pcbinfo);
1725
1726 if ((lookupflags & INPLOOKUP_WILDCARD) == 0) {
1727 struct inpcbhead *head;
1728 /*
1729 * Look for an unconnected (wildcard foreign addr) PCB that
1730 * matches the local address and port we're looking for.
1731 */
1732 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport,
1733 0, pcbinfo->ipi_hashmask)];
1734 LIST_FOREACH(inp, head, inp_hash) {
1735 #ifdef INET6
1736 /* XXX inp locking */
1737 if ((inp->inp_vflag & INP_IPV4) == 0)
1738 continue;
1739 #endif
1740 if (inp->inp_faddr.s_addr == INADDR_ANY &&
1741 inp->inp_laddr.s_addr == laddr.s_addr &&
1742 inp->inp_lport == lport) {
1743 /*
1744 * Found?
1745 */
1746 if (cred == NULL ||
1747 prison_equal_ip4(cred->cr_prison,
1748 inp->inp_cred->cr_prison))
1749 return (inp);
1750 }
1751 }
1752 /*
1753 * Not found.
1754 */
1755 return (NULL);
1756 } else {
1757 struct inpcbporthead *porthash;
1758 struct inpcbport *phd;
1759 struct inpcb *match = NULL;
1760 /*
1761 * Best fit PCB lookup.
1762 *
1763 * First see if this local port is in use by looking on the
1764 * port hash list.
1765 */
1766 porthash = &pcbinfo->ipi_porthashbase[INP_PCBPORTHASH(lport,
1767 pcbinfo->ipi_porthashmask)];
1768 LIST_FOREACH(phd, porthash, phd_hash) {
1769 if (phd->phd_port == lport)
1770 break;
1771 }
1772 if (phd != NULL) {
1773 /*
1774 * Port is in use by one or more PCBs. Look for best
1775 * fit.
1776 */
1777 LIST_FOREACH(inp, &phd->phd_pcblist, inp_portlist) {
1778 wildcard = 0;
1779 if (cred != NULL &&
1780 !prison_equal_ip4(inp->inp_cred->cr_prison,
1781 cred->cr_prison))
1782 continue;
1783 #ifdef INET6
1784 /* XXX inp locking */
1785 if ((inp->inp_vflag & INP_IPV4) == 0)
1786 continue;
1787 /*
1788 * We never select the PCB that has
1789 * INP_IPV6 flag and is bound to :: if
1790 * we have another PCB which is bound
1791 * to 0.0.0.0. If a PCB has the
1792 * INP_IPV6 flag, then we set its cost
1793 * higher than IPv4 only PCBs.
1794 *
1795 * Note that the case only happens
1796 * when a socket is bound to ::, under
1797 * the condition that the use of the
1798 * mapped address is allowed.
1799 */
1800 if ((inp->inp_vflag & INP_IPV6) != 0)
1801 wildcard += INP_LOOKUP_MAPPED_PCB_COST;
1802 #endif
1803 if (inp->inp_faddr.s_addr != INADDR_ANY)
1804 wildcard++;
1805 if (inp->inp_laddr.s_addr != INADDR_ANY) {
1806 if (laddr.s_addr == INADDR_ANY)
1807 wildcard++;
1808 else if (inp->inp_laddr.s_addr != laddr.s_addr)
1809 continue;
1810 } else {
1811 if (laddr.s_addr != INADDR_ANY)
1812 wildcard++;
1813 }
1814 if (wildcard < matchwild) {
1815 match = inp;
1816 matchwild = wildcard;
1817 if (matchwild == 0)
1818 break;
1819 }
1820 }
1821 }
1822 return (match);
1823 }
1824 }
1825 #undef INP_LOOKUP_MAPPED_PCB_COST
1826
1827 #ifdef PCBGROUP
1828 /*
1829 * Lookup PCB in hash list, using pcbgroup tables.
1830 */
1831 static struct inpcb *
in_pcblookup_group(struct inpcbinfo * pcbinfo,struct inpcbgroup * pcbgroup,struct in_addr faddr,u_int fport_arg,struct in_addr laddr,u_int lport_arg,int lookupflags,struct ifnet * ifp)1832 in_pcblookup_group(struct inpcbinfo *pcbinfo, struct inpcbgroup *pcbgroup,
1833 struct in_addr faddr, u_int fport_arg, struct in_addr laddr,
1834 u_int lport_arg, int lookupflags, struct ifnet *ifp)
1835 {
1836 struct inpcbhead *head;
1837 struct inpcb *inp, *tmpinp;
1838 u_short fport = fport_arg, lport = lport_arg;
1839
1840 /*
1841 * First look for an exact match.
1842 */
1843 tmpinp = NULL;
1844 INP_GROUP_LOCK(pcbgroup);
1845 head = &pcbgroup->ipg_hashbase[INP_PCBHASH(faddr.s_addr, lport, fport,
1846 pcbgroup->ipg_hashmask)];
1847 LIST_FOREACH(inp, head, inp_pcbgrouphash) {
1848 #ifdef INET6
1849 /* XXX inp locking */
1850 if ((inp->inp_vflag & INP_IPV4) == 0)
1851 continue;
1852 #endif
1853 if (inp->inp_faddr.s_addr == faddr.s_addr &&
1854 inp->inp_laddr.s_addr == laddr.s_addr &&
1855 inp->inp_fport == fport &&
1856 inp->inp_lport == lport) {
1857 /*
1858 * XXX We should be able to directly return
1859 * the inp here, without any checks.
1860 * Well unless both bound with SO_REUSEPORT?
1861 */
1862 if (prison_flag(inp->inp_cred, PR_IP4))
1863 goto found;
1864 if (tmpinp == NULL)
1865 tmpinp = inp;
1866 }
1867 }
1868 if (tmpinp != NULL) {
1869 inp = tmpinp;
1870 goto found;
1871 }
1872
1873 #ifdef RSS
1874 /*
1875 * For incoming connections, we may wish to do a wildcard
1876 * match for an RSS-local socket.
1877 */
1878 if ((lookupflags & INPLOOKUP_WILDCARD) != 0) {
1879 struct inpcb *local_wild = NULL, *local_exact = NULL;
1880 #ifdef INET6
1881 struct inpcb *local_wild_mapped = NULL;
1882 #endif
1883 struct inpcb *jail_wild = NULL;
1884 struct inpcbhead *head;
1885 int injail;
1886
1887 /*
1888 * Order of socket selection - we always prefer jails.
1889 * 1. jailed, non-wild.
1890 * 2. jailed, wild.
1891 * 3. non-jailed, non-wild.
1892 * 4. non-jailed, wild.
1893 */
1894
1895 head = &pcbgroup->ipg_hashbase[INP_PCBHASH(INADDR_ANY,
1896 lport, 0, pcbgroup->ipg_hashmask)];
1897 LIST_FOREACH(inp, head, inp_pcbgrouphash) {
1898 #ifdef INET6
1899 /* XXX inp locking */
1900 if ((inp->inp_vflag & INP_IPV4) == 0)
1901 continue;
1902 #endif
1903 if (inp->inp_faddr.s_addr != INADDR_ANY ||
1904 inp->inp_lport != lport)
1905 continue;
1906
1907 injail = prison_flag(inp->inp_cred, PR_IP4);
1908 if (injail) {
1909 if (prison_check_ip4(inp->inp_cred,
1910 &laddr) != 0)
1911 continue;
1912 } else {
1913 if (local_exact != NULL)
1914 continue;
1915 }
1916
1917 if (inp->inp_laddr.s_addr == laddr.s_addr) {
1918 if (injail)
1919 goto found;
1920 else
1921 local_exact = inp;
1922 } else if (inp->inp_laddr.s_addr == INADDR_ANY) {
1923 #ifdef INET6
1924 /* XXX inp locking, NULL check */
1925 if (inp->inp_vflag & INP_IPV6PROTO)
1926 local_wild_mapped = inp;
1927 else
1928 #endif
1929 if (injail)
1930 jail_wild = inp;
1931 else
1932 local_wild = inp;
1933 }
1934 } /* LIST_FOREACH */
1935
1936 inp = jail_wild;
1937 if (inp == NULL)
1938 inp = local_exact;
1939 if (inp == NULL)
1940 inp = local_wild;
1941 #ifdef INET6
1942 if (inp == NULL)
1943 inp = local_wild_mapped;
1944 #endif
1945 if (inp != NULL)
1946 goto found;
1947 }
1948 #endif
1949
1950 /*
1951 * Then look for a wildcard match, if requested.
1952 */
1953 if ((lookupflags & INPLOOKUP_WILDCARD) != 0) {
1954 struct inpcb *local_wild = NULL, *local_exact = NULL;
1955 #ifdef INET6
1956 struct inpcb *local_wild_mapped = NULL;
1957 #endif
1958 struct inpcb *jail_wild = NULL;
1959 struct inpcbhead *head;
1960 int injail;
1961
1962 /*
1963 * Order of socket selection - we always prefer jails.
1964 * 1. jailed, non-wild.
1965 * 2. jailed, wild.
1966 * 3. non-jailed, non-wild.
1967 * 4. non-jailed, wild.
1968 */
1969 head = &pcbinfo->ipi_wildbase[INP_PCBHASH(INADDR_ANY, lport,
1970 0, pcbinfo->ipi_wildmask)];
1971 LIST_FOREACH(inp, head, inp_pcbgroup_wild) {
1972 #ifdef INET6
1973 /* XXX inp locking */
1974 if ((inp->inp_vflag & INP_IPV4) == 0)
1975 continue;
1976 #endif
1977 if (inp->inp_faddr.s_addr != INADDR_ANY ||
1978 inp->inp_lport != lport)
1979 continue;
1980
1981 injail = prison_flag(inp->inp_cred, PR_IP4);
1982 if (injail) {
1983 if (prison_check_ip4(inp->inp_cred,
1984 &laddr) != 0)
1985 continue;
1986 } else {
1987 if (local_exact != NULL)
1988 continue;
1989 }
1990
1991 if (inp->inp_laddr.s_addr == laddr.s_addr) {
1992 if (injail)
1993 goto found;
1994 else
1995 local_exact = inp;
1996 } else if (inp->inp_laddr.s_addr == INADDR_ANY) {
1997 #ifdef INET6
1998 /* XXX inp locking, NULL check */
1999 if (inp->inp_vflag & INP_IPV6PROTO)
2000 local_wild_mapped = inp;
2001 else
2002 #endif
2003 if (injail)
2004 jail_wild = inp;
2005 else
2006 local_wild = inp;
2007 }
2008 } /* LIST_FOREACH */
2009 inp = jail_wild;
2010 if (inp == NULL)
2011 inp = local_exact;
2012 if (inp == NULL)
2013 inp = local_wild;
2014 #ifdef INET6
2015 if (inp == NULL)
2016 inp = local_wild_mapped;
2017 #endif
2018 if (inp != NULL)
2019 goto found;
2020 } /* if (lookupflags & INPLOOKUP_WILDCARD) */
2021 INP_GROUP_UNLOCK(pcbgroup);
2022 return (NULL);
2023
2024 found:
2025 in_pcbref(inp);
2026 INP_GROUP_UNLOCK(pcbgroup);
2027 if (lookupflags & INPLOOKUP_WLOCKPCB) {
2028 INP_WLOCK(inp);
2029 if (in_pcbrele_wlocked(inp))
2030 return (NULL);
2031 } else if (lookupflags & INPLOOKUP_RLOCKPCB) {
2032 INP_RLOCK(inp);
2033 if (in_pcbrele_rlocked(inp))
2034 return (NULL);
2035 } else
2036 panic("%s: locking bug", __func__);
2037 return (inp);
2038 }
2039 #endif /* PCBGROUP */
2040
2041 /*
2042 * Lookup PCB in hash list, using pcbinfo tables. This variation assumes
2043 * that the caller has locked the hash list, and will not perform any further
2044 * locking or reference operations on either the hash list or the connection.
2045 */
2046 static struct inpcb *
in_pcblookup_hash_locked(struct inpcbinfo * pcbinfo,struct in_addr faddr,u_int fport_arg,struct in_addr laddr,u_int lport_arg,int lookupflags,struct ifnet * ifp)2047 in_pcblookup_hash_locked(struct inpcbinfo *pcbinfo, struct in_addr faddr,
2048 u_int fport_arg, struct in_addr laddr, u_int lport_arg, int lookupflags,
2049 struct ifnet *ifp)
2050 {
2051 struct inpcbhead *head;
2052 struct inpcb *inp, *tmpinp;
2053 u_short fport = fport_arg, lport = lport_arg;
2054
2055 KASSERT((lookupflags & ~(INPLOOKUP_WILDCARD)) == 0,
2056 ("%s: invalid lookup flags %d", __func__, lookupflags));
2057
2058 INP_HASH_LOCK_ASSERT(pcbinfo);
2059
2060 /*
2061 * First look for an exact match.
2062 */
2063 tmpinp = NULL;
2064 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr.s_addr, lport, fport,
2065 pcbinfo->ipi_hashmask)];
2066 LIST_FOREACH(inp, head, inp_hash) {
2067 #ifdef INET6
2068 /* XXX inp locking */
2069 if ((inp->inp_vflag & INP_IPV4) == 0)
2070 continue;
2071 #endif
2072 if (inp->inp_faddr.s_addr == faddr.s_addr &&
2073 inp->inp_laddr.s_addr == laddr.s_addr &&
2074 inp->inp_fport == fport &&
2075 inp->inp_lport == lport) {
2076 /*
2077 * XXX We should be able to directly return
2078 * the inp here, without any checks.
2079 * Well unless both bound with SO_REUSEPORT?
2080 */
2081 if (prison_flag(inp->inp_cred, PR_IP4))
2082 return (inp);
2083 if (tmpinp == NULL)
2084 tmpinp = inp;
2085 }
2086 }
2087 if (tmpinp != NULL)
2088 return (tmpinp);
2089
2090 /*
2091 * Then look for a wildcard match, if requested.
2092 */
2093 if ((lookupflags & INPLOOKUP_WILDCARD) != 0) {
2094 struct inpcb *local_wild = NULL, *local_exact = NULL;
2095 #ifdef INET6
2096 struct inpcb *local_wild_mapped = NULL;
2097 #endif
2098 struct inpcb *jail_wild = NULL;
2099 int injail;
2100
2101 /*
2102 * Order of socket selection - we always prefer jails.
2103 * 1. jailed, non-wild.
2104 * 2. jailed, wild.
2105 * 3. non-jailed, non-wild.
2106 * 4. non-jailed, wild.
2107 */
2108
2109 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport,
2110 0, pcbinfo->ipi_hashmask)];
2111 LIST_FOREACH(inp, head, inp_hash) {
2112 #ifdef INET6
2113 /* XXX inp locking */
2114 if ((inp->inp_vflag & INP_IPV4) == 0)
2115 continue;
2116 #endif
2117 if (inp->inp_faddr.s_addr != INADDR_ANY ||
2118 inp->inp_lport != lport)
2119 continue;
2120
2121 injail = prison_flag(inp->inp_cred, PR_IP4);
2122 if (injail) {
2123 if (prison_check_ip4(inp->inp_cred,
2124 &laddr) != 0)
2125 continue;
2126 } else {
2127 if (local_exact != NULL)
2128 continue;
2129 }
2130
2131 if (inp->inp_laddr.s_addr == laddr.s_addr) {
2132 if (injail)
2133 return (inp);
2134 else
2135 local_exact = inp;
2136 } else if (inp->inp_laddr.s_addr == INADDR_ANY) {
2137 #ifdef INET6
2138 /* XXX inp locking, NULL check */
2139 if (inp->inp_vflag & INP_IPV6PROTO)
2140 local_wild_mapped = inp;
2141 else
2142 #endif
2143 if (injail)
2144 jail_wild = inp;
2145 else
2146 local_wild = inp;
2147 }
2148 } /* LIST_FOREACH */
2149 if (jail_wild != NULL)
2150 return (jail_wild);
2151 if (local_exact != NULL)
2152 return (local_exact);
2153 if (local_wild != NULL)
2154 return (local_wild);
2155 #ifdef INET6
2156 if (local_wild_mapped != NULL)
2157 return (local_wild_mapped);
2158 #endif
2159 } /* if ((lookupflags & INPLOOKUP_WILDCARD) != 0) */
2160
2161 return (NULL);
2162 }
2163
2164 /*
2165 * Lookup PCB in hash list, using pcbinfo tables. This variation locks the
2166 * hash list lock, and will return the inpcb locked (i.e., requires
2167 * INPLOOKUP_LOCKPCB).
2168 */
2169 static struct inpcb *
in_pcblookup_hash(struct inpcbinfo * pcbinfo,struct in_addr faddr,u_int fport,struct in_addr laddr,u_int lport,int lookupflags,struct ifnet * ifp)2170 in_pcblookup_hash(struct inpcbinfo *pcbinfo, struct in_addr faddr,
2171 u_int fport, struct in_addr laddr, u_int lport, int lookupflags,
2172 struct ifnet *ifp)
2173 {
2174 struct inpcb *inp;
2175
2176 INP_HASH_RLOCK(pcbinfo);
2177 inp = in_pcblookup_hash_locked(pcbinfo, faddr, fport, laddr, lport,
2178 (lookupflags & ~(INPLOOKUP_RLOCKPCB | INPLOOKUP_WLOCKPCB)), ifp);
2179 if (inp != NULL) {
2180 in_pcbref(inp);
2181 INP_HASH_RUNLOCK(pcbinfo);
2182 if (lookupflags & INPLOOKUP_WLOCKPCB) {
2183 INP_WLOCK(inp);
2184 if (in_pcbrele_wlocked(inp))
2185 return (NULL);
2186 } else if (lookupflags & INPLOOKUP_RLOCKPCB) {
2187 INP_RLOCK(inp);
2188 if (in_pcbrele_rlocked(inp))
2189 return (NULL);
2190 } else
2191 panic("%s: locking bug", __func__);
2192 } else
2193 INP_HASH_RUNLOCK(pcbinfo);
2194 return (inp);
2195 }
2196
2197 /*
2198 * Public inpcb lookup routines, accepting a 4-tuple, and optionally, an mbuf
2199 * from which a pre-calculated hash value may be extracted.
2200 *
2201 * Possibly more of this logic should be in in_pcbgroup.c.
2202 */
2203 struct inpcb *
in_pcblookup(struct inpcbinfo * pcbinfo,struct in_addr faddr,u_int fport,struct in_addr laddr,u_int lport,int lookupflags,struct ifnet * ifp)2204 in_pcblookup(struct inpcbinfo *pcbinfo, struct in_addr faddr, u_int fport,
2205 struct in_addr laddr, u_int lport, int lookupflags, struct ifnet *ifp)
2206 {
2207 #if defined(PCBGROUP) && !defined(RSS)
2208 struct inpcbgroup *pcbgroup;
2209 #endif
2210
2211 KASSERT((lookupflags & ~INPLOOKUP_MASK) == 0,
2212 ("%s: invalid lookup flags %d", __func__, lookupflags));
2213 KASSERT((lookupflags & (INPLOOKUP_RLOCKPCB | INPLOOKUP_WLOCKPCB)) != 0,
2214 ("%s: LOCKPCB not set", __func__));
2215
2216 /*
2217 * When not using RSS, use connection groups in preference to the
2218 * reservation table when looking up 4-tuples. When using RSS, just
2219 * use the reservation table, due to the cost of the Toeplitz hash
2220 * in software.
2221 *
2222 * XXXRW: This policy belongs in the pcbgroup code, as in principle
2223 * we could be doing RSS with a non-Toeplitz hash that is affordable
2224 * in software.
2225 */
2226 #if defined(PCBGROUP) && !defined(RSS)
2227 if (in_pcbgroup_enabled(pcbinfo)) {
2228 pcbgroup = in_pcbgroup_bytuple(pcbinfo, laddr, lport, faddr,
2229 fport);
2230 return (in_pcblookup_group(pcbinfo, pcbgroup, faddr, fport,
2231 laddr, lport, lookupflags, ifp));
2232 }
2233 #endif
2234 return (in_pcblookup_hash(pcbinfo, faddr, fport, laddr, lport,
2235 lookupflags, ifp));
2236 }
2237
2238 struct inpcb *
in_pcblookup_mbuf(struct inpcbinfo * pcbinfo,struct in_addr faddr,u_int fport,struct in_addr laddr,u_int lport,int lookupflags,struct ifnet * ifp,struct mbuf * m)2239 in_pcblookup_mbuf(struct inpcbinfo *pcbinfo, struct in_addr faddr,
2240 u_int fport, struct in_addr laddr, u_int lport, int lookupflags,
2241 struct ifnet *ifp, struct mbuf *m)
2242 {
2243 #ifdef PCBGROUP
2244 struct inpcbgroup *pcbgroup;
2245 #endif
2246
2247 KASSERT((lookupflags & ~INPLOOKUP_MASK) == 0,
2248 ("%s: invalid lookup flags %d", __func__, lookupflags));
2249 KASSERT((lookupflags & (INPLOOKUP_RLOCKPCB | INPLOOKUP_WLOCKPCB)) != 0,
2250 ("%s: LOCKPCB not set", __func__));
2251
2252 #ifdef PCBGROUP
2253 /*
2254 * If we can use a hardware-generated hash to look up the connection
2255 * group, use that connection group to find the inpcb. Otherwise
2256 * fall back on a software hash -- or the reservation table if we're
2257 * using RSS.
2258 *
2259 * XXXRW: As above, that policy belongs in the pcbgroup code.
2260 */
2261 if (in_pcbgroup_enabled(pcbinfo) &&
2262 !(M_HASHTYPE_TEST(m, M_HASHTYPE_NONE))) {
2263 pcbgroup = in_pcbgroup_byhash(pcbinfo, M_HASHTYPE_GET(m),
2264 m->m_pkthdr.flowid);
2265 if (pcbgroup != NULL)
2266 return (in_pcblookup_group(pcbinfo, pcbgroup, faddr,
2267 fport, laddr, lport, lookupflags, ifp));
2268 #ifndef RSS
2269 pcbgroup = in_pcbgroup_bytuple(pcbinfo, laddr, lport, faddr,
2270 fport);
2271 return (in_pcblookup_group(pcbinfo, pcbgroup, faddr, fport,
2272 laddr, lport, lookupflags, ifp));
2273 #endif
2274 }
2275 #endif
2276 return (in_pcblookup_hash(pcbinfo, faddr, fport, laddr, lport,
2277 lookupflags, ifp));
2278 }
2279 #endif /* INET */
2280
2281 /*
2282 * Insert PCB onto various hash lists.
2283 */
2284 static int
in_pcbinshash_internal(struct inpcb * inp,int do_pcbgroup_update)2285 in_pcbinshash_internal(struct inpcb *inp, int do_pcbgroup_update)
2286 {
2287 struct inpcbhead *pcbhash;
2288 struct inpcbporthead *pcbporthash;
2289 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
2290 struct inpcbport *phd;
2291 u_int32_t hashkey_faddr;
2292
2293 INP_WLOCK_ASSERT(inp);
2294 INP_HASH_WLOCK_ASSERT(pcbinfo);
2295
2296 KASSERT((inp->inp_flags & INP_INHASHLIST) == 0,
2297 ("in_pcbinshash: INP_INHASHLIST"));
2298
2299 #ifdef INET6
2300 if (inp->inp_vflag & INP_IPV6)
2301 hashkey_faddr = INP6_PCBHASHKEY(&inp->in6p_faddr);
2302 else
2303 #endif
2304 hashkey_faddr = inp->inp_faddr.s_addr;
2305
2306 pcbhash = &pcbinfo->ipi_hashbase[INP_PCBHASH(hashkey_faddr,
2307 inp->inp_lport, inp->inp_fport, pcbinfo->ipi_hashmask)];
2308
2309 pcbporthash = &pcbinfo->ipi_porthashbase[
2310 INP_PCBPORTHASH(inp->inp_lport, pcbinfo->ipi_porthashmask)];
2311
2312 /*
2313 * Go through port list and look for a head for this lport.
2314 */
2315 LIST_FOREACH(phd, pcbporthash, phd_hash) {
2316 if (phd->phd_port == inp->inp_lport)
2317 break;
2318 }
2319 /*
2320 * If none exists, malloc one and tack it on.
2321 */
2322 if (phd == NULL) {
2323 phd = malloc(sizeof(struct inpcbport), M_PCB, M_NOWAIT);
2324 if (phd == NULL) {
2325 return (ENOBUFS); /* XXX */
2326 }
2327 phd->phd_port = inp->inp_lport;
2328 LIST_INIT(&phd->phd_pcblist);
2329 LIST_INSERT_HEAD(pcbporthash, phd, phd_hash);
2330 }
2331 inp->inp_phd = phd;
2332 LIST_INSERT_HEAD(&phd->phd_pcblist, inp, inp_portlist);
2333 LIST_INSERT_HEAD(pcbhash, inp, inp_hash);
2334 inp->inp_flags |= INP_INHASHLIST;
2335 #ifdef PCBGROUP
2336 if (do_pcbgroup_update)
2337 in_pcbgroup_update(inp);
2338 #endif
2339 return (0);
2340 }
2341
2342 /*
2343 * For now, there are two public interfaces to insert an inpcb into the hash
2344 * lists -- one that does update pcbgroups, and one that doesn't. The latter
2345 * is used only in the TCP syncache, where in_pcbinshash is called before the
2346 * full 4-tuple is set for the inpcb, and we don't want to install in the
2347 * pcbgroup until later.
2348 *
2349 * XXXRW: This seems like a misfeature. in_pcbinshash should always update
2350 * connection groups, and partially initialised inpcbs should not be exposed
2351 * to either reservation hash tables or pcbgroups.
2352 */
2353 int
in_pcbinshash(struct inpcb * inp)2354 in_pcbinshash(struct inpcb *inp)
2355 {
2356
2357 return (in_pcbinshash_internal(inp, 1));
2358 }
2359
2360 int
in_pcbinshash_nopcbgroup(struct inpcb * inp)2361 in_pcbinshash_nopcbgroup(struct inpcb *inp)
2362 {
2363
2364 return (in_pcbinshash_internal(inp, 0));
2365 }
2366
2367 /*
2368 * Move PCB to the proper hash bucket when { faddr, fport } have been
2369 * changed. NOTE: This does not handle the case of the lport changing (the
2370 * hashed port list would have to be updated as well), so the lport must
2371 * not change after in_pcbinshash() has been called.
2372 */
2373 void
in_pcbrehash_mbuf(struct inpcb * inp,struct mbuf * m)2374 in_pcbrehash_mbuf(struct inpcb *inp, struct mbuf *m)
2375 {
2376 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
2377 struct inpcbhead *head;
2378 u_int32_t hashkey_faddr;
2379
2380 INP_WLOCK_ASSERT(inp);
2381 INP_HASH_WLOCK_ASSERT(pcbinfo);
2382
2383 KASSERT(inp->inp_flags & INP_INHASHLIST,
2384 ("in_pcbrehash: !INP_INHASHLIST"));
2385
2386 #ifdef INET6
2387 if (inp->inp_vflag & INP_IPV6)
2388 hashkey_faddr = INP6_PCBHASHKEY(&inp->in6p_faddr);
2389 else
2390 #endif
2391 hashkey_faddr = inp->inp_faddr.s_addr;
2392
2393 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(hashkey_faddr,
2394 inp->inp_lport, inp->inp_fport, pcbinfo->ipi_hashmask)];
2395
2396 LIST_REMOVE(inp, inp_hash);
2397 LIST_INSERT_HEAD(head, inp, inp_hash);
2398
2399 #ifdef PCBGROUP
2400 if (m != NULL)
2401 in_pcbgroup_update_mbuf(inp, m);
2402 else
2403 in_pcbgroup_update(inp);
2404 #endif
2405 }
2406
2407 void
in_pcbrehash(struct inpcb * inp)2408 in_pcbrehash(struct inpcb *inp)
2409 {
2410
2411 in_pcbrehash_mbuf(inp, NULL);
2412 }
2413
2414 /*
2415 * Remove PCB from various lists.
2416 */
2417 static void
in_pcbremlists(struct inpcb * inp)2418 in_pcbremlists(struct inpcb *inp)
2419 {
2420 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
2421
2422 #ifdef INVARIANTS
2423 if (pcbinfo == &V_tcbinfo) {
2424 INP_INFO_RLOCK_ASSERT(pcbinfo);
2425 } else {
2426 INP_INFO_WLOCK_ASSERT(pcbinfo);
2427 }
2428 #endif
2429
2430 INP_WLOCK_ASSERT(inp);
2431 INP_LIST_WLOCK_ASSERT(pcbinfo);
2432
2433 inp->inp_gencnt = ++pcbinfo->ipi_gencnt;
2434 if (inp->inp_flags & INP_INHASHLIST) {
2435 struct inpcbport *phd = inp->inp_phd;
2436
2437 INP_HASH_WLOCK(pcbinfo);
2438 LIST_REMOVE(inp, inp_hash);
2439 LIST_REMOVE(inp, inp_portlist);
2440 if (LIST_FIRST(&phd->phd_pcblist) == NULL) {
2441 LIST_REMOVE(phd, phd_hash);
2442 free(phd, M_PCB);
2443 }
2444 INP_HASH_WUNLOCK(pcbinfo);
2445 inp->inp_flags &= ~INP_INHASHLIST;
2446 }
2447 LIST_REMOVE(inp, inp_list);
2448 pcbinfo->ipi_count--;
2449 #ifdef PCBGROUP
2450 in_pcbgroup_remove(inp);
2451 #endif
2452 }
2453
2454 /*
2455 * A set label operation has occurred at the socket layer, propagate the
2456 * label change into the in_pcb for the socket.
2457 */
2458 void
in_pcbsosetlabel(struct socket * so)2459 in_pcbsosetlabel(struct socket *so)
2460 {
2461 #ifdef MAC
2462 struct inpcb *inp;
2463
2464 inp = sotoinpcb(so);
2465 KASSERT(inp != NULL, ("in_pcbsosetlabel: so->so_pcb == NULL"));
2466
2467 INP_WLOCK(inp);
2468 SOCK_LOCK(so);
2469 mac_inpcb_sosetlabel(so, inp);
2470 SOCK_UNLOCK(so);
2471 INP_WUNLOCK(inp);
2472 #endif
2473 }
2474
2475 /*
2476 * ipport_tick runs once per second, determining if random port allocation
2477 * should be continued. If more than ipport_randomcps ports have been
2478 * allocated in the last second, then we return to sequential port
2479 * allocation. We return to random allocation only once we drop below
2480 * ipport_randomcps for at least ipport_randomtime seconds.
2481 */
2482 static void
ipport_tick(void * xtp)2483 ipport_tick(void *xtp)
2484 {
2485 VNET_ITERATOR_DECL(vnet_iter);
2486
2487 VNET_LIST_RLOCK_NOSLEEP();
2488 VNET_FOREACH(vnet_iter) {
2489 CURVNET_SET(vnet_iter); /* XXX appease INVARIANTS here */
2490 if (V_ipport_tcpallocs <=
2491 V_ipport_tcplastcount + V_ipport_randomcps) {
2492 if (V_ipport_stoprandom > 0)
2493 V_ipport_stoprandom--;
2494 } else
2495 V_ipport_stoprandom = V_ipport_randomtime;
2496 V_ipport_tcplastcount = V_ipport_tcpallocs;
2497 CURVNET_RESTORE();
2498 }
2499 VNET_LIST_RUNLOCK_NOSLEEP();
2500 callout_reset(&ipport_tick_callout, hz, ipport_tick, NULL);
2501 }
2502
2503 static void
ip_fini(void * xtp)2504 ip_fini(void *xtp)
2505 {
2506
2507 callout_stop(&ipport_tick_callout);
2508 }
2509
2510 /*
2511 * The ipport_callout should start running at about the time we attach the
2512 * inet or inet6 domains.
2513 */
2514 static void
ipport_tick_init(const void * unused __unused)2515 ipport_tick_init(const void *unused __unused)
2516 {
2517
2518 /* Start ipport_tick. */
2519 callout_init(&ipport_tick_callout, 1);
2520 callout_reset(&ipport_tick_callout, 1, ipport_tick, NULL);
2521 EVENTHANDLER_REGISTER(shutdown_pre_sync, ip_fini, NULL,
2522 SHUTDOWN_PRI_DEFAULT);
2523 }
2524 SYSINIT(ipport_tick_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE,
2525 ipport_tick_init, NULL);
2526
2527 void
inp_wlock(struct inpcb * inp)2528 inp_wlock(struct inpcb *inp)
2529 {
2530
2531 INP_WLOCK(inp);
2532 }
2533
2534 void
inp_wunlock(struct inpcb * inp)2535 inp_wunlock(struct inpcb *inp)
2536 {
2537
2538 INP_WUNLOCK(inp);
2539 }
2540
2541 void
inp_rlock(struct inpcb * inp)2542 inp_rlock(struct inpcb *inp)
2543 {
2544
2545 INP_RLOCK(inp);
2546 }
2547
2548 void
inp_runlock(struct inpcb * inp)2549 inp_runlock(struct inpcb *inp)
2550 {
2551
2552 INP_RUNLOCK(inp);
2553 }
2554
2555 #ifdef INVARIANTS
2556 void
inp_lock_assert(struct inpcb * inp)2557 inp_lock_assert(struct inpcb *inp)
2558 {
2559
2560 INP_WLOCK_ASSERT(inp);
2561 }
2562
2563 void
inp_unlock_assert(struct inpcb * inp)2564 inp_unlock_assert(struct inpcb *inp)
2565 {
2566
2567 INP_UNLOCK_ASSERT(inp);
2568 }
2569 #endif
2570
2571 void
inp_apply_all(void (* func)(struct inpcb *,void *),void * arg)2572 inp_apply_all(void (*func)(struct inpcb *, void *), void *arg)
2573 {
2574 struct inpcb *inp;
2575
2576 INP_INFO_WLOCK(&V_tcbinfo);
2577 LIST_FOREACH(inp, V_tcbinfo.ipi_listhead, inp_list) {
2578 INP_WLOCK(inp);
2579 func(inp, arg);
2580 INP_WUNLOCK(inp);
2581 }
2582 INP_INFO_WUNLOCK(&V_tcbinfo);
2583 }
2584
2585 struct socket *
inp_inpcbtosocket(struct inpcb * inp)2586 inp_inpcbtosocket(struct inpcb *inp)
2587 {
2588
2589 INP_WLOCK_ASSERT(inp);
2590 return (inp->inp_socket);
2591 }
2592
2593 struct tcpcb *
inp_inpcbtotcpcb(struct inpcb * inp)2594 inp_inpcbtotcpcb(struct inpcb *inp)
2595 {
2596
2597 INP_WLOCK_ASSERT(inp);
2598 return ((struct tcpcb *)inp->inp_ppcb);
2599 }
2600
2601 int
inp_ip_tos_get(const struct inpcb * inp)2602 inp_ip_tos_get(const struct inpcb *inp)
2603 {
2604
2605 return (inp->inp_ip_tos);
2606 }
2607
2608 void
inp_ip_tos_set(struct inpcb * inp,int val)2609 inp_ip_tos_set(struct inpcb *inp, int val)
2610 {
2611
2612 inp->inp_ip_tos = val;
2613 }
2614
2615 void
inp_4tuple_get(struct inpcb * inp,uint32_t * laddr,uint16_t * lp,uint32_t * faddr,uint16_t * fp)2616 inp_4tuple_get(struct inpcb *inp, uint32_t *laddr, uint16_t *lp,
2617 uint32_t *faddr, uint16_t *fp)
2618 {
2619
2620 INP_LOCK_ASSERT(inp);
2621 *laddr = inp->inp_laddr.s_addr;
2622 *faddr = inp->inp_faddr.s_addr;
2623 *lp = inp->inp_lport;
2624 *fp = inp->inp_fport;
2625 }
2626
2627 struct inpcb *
so_sotoinpcb(struct socket * so)2628 so_sotoinpcb(struct socket *so)
2629 {
2630
2631 return (sotoinpcb(so));
2632 }
2633
2634 struct tcpcb *
so_sototcpcb(struct socket * so)2635 so_sototcpcb(struct socket *so)
2636 {
2637
2638 return (sototcpcb(so));
2639 }
2640
2641 #ifdef DDB
2642 static void
db_print_indent(int indent)2643 db_print_indent(int indent)
2644 {
2645 int i;
2646
2647 for (i = 0; i < indent; i++)
2648 db_printf(" ");
2649 }
2650
2651 static void
db_print_inconninfo(struct in_conninfo * inc,const char * name,int indent)2652 db_print_inconninfo(struct in_conninfo *inc, const char *name, int indent)
2653 {
2654 char faddr_str[48], laddr_str[48];
2655
2656 db_print_indent(indent);
2657 db_printf("%s at %p\n", name, inc);
2658
2659 indent += 2;
2660
2661 #ifdef INET6
2662 if (inc->inc_flags & INC_ISIPV6) {
2663 /* IPv6. */
2664 ip6_sprintf(laddr_str, &inc->inc6_laddr);
2665 ip6_sprintf(faddr_str, &inc->inc6_faddr);
2666 } else
2667 #endif
2668 {
2669 /* IPv4. */
2670 inet_ntoa_r(inc->inc_laddr, laddr_str);
2671 inet_ntoa_r(inc->inc_faddr, faddr_str);
2672 }
2673 db_print_indent(indent);
2674 db_printf("inc_laddr %s inc_lport %u\n", laddr_str,
2675 ntohs(inc->inc_lport));
2676 db_print_indent(indent);
2677 db_printf("inc_faddr %s inc_fport %u\n", faddr_str,
2678 ntohs(inc->inc_fport));
2679 }
2680
2681 static void
db_print_inpflags(int inp_flags)2682 db_print_inpflags(int inp_flags)
2683 {
2684 int comma;
2685
2686 comma = 0;
2687 if (inp_flags & INP_RECVOPTS) {
2688 db_printf("%sINP_RECVOPTS", comma ? ", " : "");
2689 comma = 1;
2690 }
2691 if (inp_flags & INP_RECVRETOPTS) {
2692 db_printf("%sINP_RECVRETOPTS", comma ? ", " : "");
2693 comma = 1;
2694 }
2695 if (inp_flags & INP_RECVDSTADDR) {
2696 db_printf("%sINP_RECVDSTADDR", comma ? ", " : "");
2697 comma = 1;
2698 }
2699 if (inp_flags & INP_HDRINCL) {
2700 db_printf("%sINP_HDRINCL", comma ? ", " : "");
2701 comma = 1;
2702 }
2703 if (inp_flags & INP_HIGHPORT) {
2704 db_printf("%sINP_HIGHPORT", comma ? ", " : "");
2705 comma = 1;
2706 }
2707 if (inp_flags & INP_LOWPORT) {
2708 db_printf("%sINP_LOWPORT", comma ? ", " : "");
2709 comma = 1;
2710 }
2711 if (inp_flags & INP_ANONPORT) {
2712 db_printf("%sINP_ANONPORT", comma ? ", " : "");
2713 comma = 1;
2714 }
2715 if (inp_flags & INP_RECVIF) {
2716 db_printf("%sINP_RECVIF", comma ? ", " : "");
2717 comma = 1;
2718 }
2719 if (inp_flags & INP_MTUDISC) {
2720 db_printf("%sINP_MTUDISC", comma ? ", " : "");
2721 comma = 1;
2722 }
2723 if (inp_flags & INP_RECVTTL) {
2724 db_printf("%sINP_RECVTTL", comma ? ", " : "");
2725 comma = 1;
2726 }
2727 if (inp_flags & INP_DONTFRAG) {
2728 db_printf("%sINP_DONTFRAG", comma ? ", " : "");
2729 comma = 1;
2730 }
2731 if (inp_flags & INP_RECVTOS) {
2732 db_printf("%sINP_RECVTOS", comma ? ", " : "");
2733 comma = 1;
2734 }
2735 if (inp_flags & IN6P_IPV6_V6ONLY) {
2736 db_printf("%sIN6P_IPV6_V6ONLY", comma ? ", " : "");
2737 comma = 1;
2738 }
2739 if (inp_flags & IN6P_PKTINFO) {
2740 db_printf("%sIN6P_PKTINFO", comma ? ", " : "");
2741 comma = 1;
2742 }
2743 if (inp_flags & IN6P_HOPLIMIT) {
2744 db_printf("%sIN6P_HOPLIMIT", comma ? ", " : "");
2745 comma = 1;
2746 }
2747 if (inp_flags & IN6P_HOPOPTS) {
2748 db_printf("%sIN6P_HOPOPTS", comma ? ", " : "");
2749 comma = 1;
2750 }
2751 if (inp_flags & IN6P_DSTOPTS) {
2752 db_printf("%sIN6P_DSTOPTS", comma ? ", " : "");
2753 comma = 1;
2754 }
2755 if (inp_flags & IN6P_RTHDR) {
2756 db_printf("%sIN6P_RTHDR", comma ? ", " : "");
2757 comma = 1;
2758 }
2759 if (inp_flags & IN6P_RTHDRDSTOPTS) {
2760 db_printf("%sIN6P_RTHDRDSTOPTS", comma ? ", " : "");
2761 comma = 1;
2762 }
2763 if (inp_flags & IN6P_TCLASS) {
2764 db_printf("%sIN6P_TCLASS", comma ? ", " : "");
2765 comma = 1;
2766 }
2767 if (inp_flags & IN6P_AUTOFLOWLABEL) {
2768 db_printf("%sIN6P_AUTOFLOWLABEL", comma ? ", " : "");
2769 comma = 1;
2770 }
2771 if (inp_flags & INP_TIMEWAIT) {
2772 db_printf("%sINP_TIMEWAIT", comma ? ", " : "");
2773 comma = 1;
2774 }
2775 if (inp_flags & INP_ONESBCAST) {
2776 db_printf("%sINP_ONESBCAST", comma ? ", " : "");
2777 comma = 1;
2778 }
2779 if (inp_flags & INP_DROPPED) {
2780 db_printf("%sINP_DROPPED", comma ? ", " : "");
2781 comma = 1;
2782 }
2783 if (inp_flags & INP_SOCKREF) {
2784 db_printf("%sINP_SOCKREF", comma ? ", " : "");
2785 comma = 1;
2786 }
2787 if (inp_flags & IN6P_RFC2292) {
2788 db_printf("%sIN6P_RFC2292", comma ? ", " : "");
2789 comma = 1;
2790 }
2791 if (inp_flags & IN6P_MTU) {
2792 db_printf("IN6P_MTU%s", comma ? ", " : "");
2793 comma = 1;
2794 }
2795 }
2796
2797 static void
db_print_inpvflag(u_char inp_vflag)2798 db_print_inpvflag(u_char inp_vflag)
2799 {
2800 int comma;
2801
2802 comma = 0;
2803 if (inp_vflag & INP_IPV4) {
2804 db_printf("%sINP_IPV4", comma ? ", " : "");
2805 comma = 1;
2806 }
2807 if (inp_vflag & INP_IPV6) {
2808 db_printf("%sINP_IPV6", comma ? ", " : "");
2809 comma = 1;
2810 }
2811 if (inp_vflag & INP_IPV6PROTO) {
2812 db_printf("%sINP_IPV6PROTO", comma ? ", " : "");
2813 comma = 1;
2814 }
2815 }
2816
2817 static void
db_print_inpcb(struct inpcb * inp,const char * name,int indent)2818 db_print_inpcb(struct inpcb *inp, const char *name, int indent)
2819 {
2820
2821 db_print_indent(indent);
2822 db_printf("%s at %p\n", name, inp);
2823
2824 indent += 2;
2825
2826 db_print_indent(indent);
2827 db_printf("inp_flow: 0x%x\n", inp->inp_flow);
2828
2829 db_print_inconninfo(&inp->inp_inc, "inp_conninfo", indent);
2830
2831 db_print_indent(indent);
2832 db_printf("inp_ppcb: %p inp_pcbinfo: %p inp_socket: %p\n",
2833 inp->inp_ppcb, inp->inp_pcbinfo, inp->inp_socket);
2834
2835 db_print_indent(indent);
2836 db_printf("inp_label: %p inp_flags: 0x%x (",
2837 inp->inp_label, inp->inp_flags);
2838 db_print_inpflags(inp->inp_flags);
2839 db_printf(")\n");
2840
2841 db_print_indent(indent);
2842 db_printf("inp_sp: %p inp_vflag: 0x%x (", inp->inp_sp,
2843 inp->inp_vflag);
2844 db_print_inpvflag(inp->inp_vflag);
2845 db_printf(")\n");
2846
2847 db_print_indent(indent);
2848 db_printf("inp_ip_ttl: %d inp_ip_p: %d inp_ip_minttl: %d\n",
2849 inp->inp_ip_ttl, inp->inp_ip_p, inp->inp_ip_minttl);
2850
2851 db_print_indent(indent);
2852 #ifdef INET6
2853 if (inp->inp_vflag & INP_IPV6) {
2854 db_printf("in6p_options: %p in6p_outputopts: %p "
2855 "in6p_moptions: %p\n", inp->in6p_options,
2856 inp->in6p_outputopts, inp->in6p_moptions);
2857 db_printf("in6p_icmp6filt: %p in6p_cksum %d "
2858 "in6p_hops %u\n", inp->in6p_icmp6filt, inp->in6p_cksum,
2859 inp->in6p_hops);
2860 } else
2861 #endif
2862 {
2863 db_printf("inp_ip_tos: %d inp_ip_options: %p "
2864 "inp_ip_moptions: %p\n", inp->inp_ip_tos,
2865 inp->inp_options, inp->inp_moptions);
2866 }
2867
2868 db_print_indent(indent);
2869 db_printf("inp_phd: %p inp_gencnt: %ju\n", inp->inp_phd,
2870 (uintmax_t)inp->inp_gencnt);
2871 }
2872
DB_SHOW_COMMAND(inpcb,db_show_inpcb)2873 DB_SHOW_COMMAND(inpcb, db_show_inpcb)
2874 {
2875 struct inpcb *inp;
2876
2877 if (!have_addr) {
2878 db_printf("usage: show inpcb <addr>\n");
2879 return;
2880 }
2881 inp = (struct inpcb *)addr;
2882
2883 db_print_inpcb(inp, "inpcb", 0);
2884 }
2885 #endif /* DDB */
2886