1/*
2 * Copyright (c) 2000-2018 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)udp_usrreq.c 8.6 (Berkeley) 5/23/95
61 */
62
63#include <sys/param.h>
64#include <sys/systm.h>
65#include <sys/kernel.h>
66#include <sys/malloc.h>
67#include <sys/mbuf.h>
68#include <sys/domain.h>
69#include <sys/protosw.h>
70#include <sys/socket.h>
71#include <sys/socketvar.h>
72#include <sys/sysctl.h>
73#include <sys/syslog.h>
74#include <sys/mcache.h>
75#include <net/ntstat.h>
76
77#include <kern/zalloc.h>
78#include <mach/boolean.h>
79
80#include <net/if.h>
81#include <net/if_types.h>
82#include <net/route.h>
83#include <net/dlil.h>
84#include <net/net_api_stats.h>
85
86#include <netinet/in.h>
87#include <netinet/in_systm.h>
88#include <netinet/in_tclass.h>
89#include <netinet/ip.h>
90#if INET6
91#include <netinet/ip6.h>
92#endif /* INET6 */
93#include <netinet/in_pcb.h>
94#include <netinet/in_var.h>
95#include <netinet/ip_var.h>
96#if INET6
97#include <netinet6/in6_pcb.h>
98#include <netinet6/ip6_var.h>
99#include <netinet6/udp6_var.h>
100#endif /* INET6 */
101#include <netinet/ip_icmp.h>
102#include <netinet/icmp_var.h>
103#include <netinet/udp.h>
104#include <netinet/udp_var.h>
105#include <sys/kdebug.h>
106
107#if IPSEC
108#include <netinet6/ipsec.h>
109#include <netinet6/esp.h>
110extern int ipsec_bypass;
111extern int esp_udp_encap_port;
112#endif /* IPSEC */
113
114#if NECP
115#include <net/necp.h>
116#endif /* NECP */
117
118#if FLOW_DIVERT
119#include <netinet/flow_divert.h>
120#endif /* FLOW_DIVERT */
121
122#if CONTENT_FILTER
123#include <net/content_filter.h>
124#endif /* CONTENT_FILTER */
125
126#define DBG_LAYER_IN_BEG NETDBG_CODE(DBG_NETUDP, 0)
127#define DBG_LAYER_IN_END NETDBG_CODE(DBG_NETUDP, 2)
128#define DBG_LAYER_OUT_BEG NETDBG_CODE(DBG_NETUDP, 1)
129#define DBG_LAYER_OUT_END NETDBG_CODE(DBG_NETUDP, 3)
130#define DBG_FNC_UDP_INPUT NETDBG_CODE(DBG_NETUDP, (5 << 8))
131#define DBG_FNC_UDP_OUTPUT NETDBG_CODE(DBG_NETUDP, (6 << 8) | 1)
132
133/*
134 * UDP protocol implementation.
135 * Per RFC 768, August, 1980.
136 */
137#ifndef COMPAT_42
138static int udpcksum = 1;
139#else
140static int udpcksum = 0; /* XXX */
141#endif
142SYSCTL_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum,
143 CTLFLAG_RW | CTLFLAG_LOCKED, &udpcksum, 0, "");
144
145int udp_log_in_vain = 0;
146SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_RW | CTLFLAG_LOCKED,
147 &udp_log_in_vain, 0, "Log all incoming UDP packets");
148
149static int blackhole = 0;
150SYSCTL_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_RW | CTLFLAG_LOCKED,
151 &blackhole, 0, "Do not send port unreachables for refused connects");
152
153struct inpcbhead udb; /* from udp_var.h */
154#define udb6 udb /* for KAME src sync over BSD*'s */
155struct inpcbinfo udbinfo;
156
157#ifndef UDBHASHSIZE
158#define UDBHASHSIZE 16
159#endif
160
161/* Garbage collection performed during most recent udp_gc() run */
162static boolean_t udp_gc_done = FALSE;
163
164#if IPFIREWALL
165extern int fw_verbose;
166extern void ipfwsyslog(int level, const char *format, ...);
167extern void ipfw_stealth_stats_incr_udp(void);
168
169/* Apple logging, log to ipfw.log */
170#define log_in_vain_log(a) { \
171 if ((udp_log_in_vain == 3) && (fw_verbose == 2)) { \
172 ipfwsyslog a; \
173 } else if ((udp_log_in_vain == 4) && (fw_verbose == 2)) { \
174 ipfw_stealth_stats_incr_udp(); \
175 } else { \
176 log a; \
177 } \
178}
179#else /* !IPFIREWALL */
180#define log_in_vain_log(a) { log a; }
181#endif /* !IPFIREWALL */
182
183static int udp_getstat SYSCTL_HANDLER_ARGS;
184struct udpstat udpstat; /* from udp_var.h */
185SYSCTL_PROC(_net_inet_udp, UDPCTL_STATS, stats,
186 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
187 0, 0, udp_getstat, "S,udpstat",
188 "UDP statistics (struct udpstat, netinet/udp_var.h)");
189
190SYSCTL_INT(_net_inet_udp, OID_AUTO, pcbcount,
191 CTLFLAG_RD | CTLFLAG_LOCKED, &udbinfo.ipi_count, 0,
192 "Number of active PCBs");
193
194__private_extern__ int udp_use_randomport = 1;
195SYSCTL_INT(_net_inet_udp, OID_AUTO, randomize_ports,
196 CTLFLAG_RW | CTLFLAG_LOCKED, &udp_use_randomport, 0,
197 "Randomize UDP port numbers");
198
199#if INET6
200struct udp_in6 {
201 struct sockaddr_in6 uin6_sin;
202 u_char uin6_init_done : 1;
203};
204struct udp_ip6 {
205 struct ip6_hdr uip6_ip6;
206 u_char uip6_init_done : 1;
207};
208
209int udp_abort(struct socket *);
210int udp_attach(struct socket *, int, struct proc *);
211int udp_bind(struct socket *, struct sockaddr *, struct proc *);
212int udp_connect(struct socket *, struct sockaddr *, struct proc *);
213int udp_connectx(struct socket *, struct sockaddr *,
214 struct sockaddr *, struct proc *, uint32_t, sae_associd_t,
215 sae_connid_t *, uint32_t, void *, uint32_t, struct uio *, user_ssize_t *);
216int udp_detach(struct socket *);
217int udp_disconnect(struct socket *);
218int udp_disconnectx(struct socket *, sae_associd_t, sae_connid_t);
219int udp_send(struct socket *, int, struct mbuf *, struct sockaddr *,
220 struct mbuf *, struct proc *);
221static void udp_append(struct inpcb *, struct ip *, struct mbuf *, int,
222 struct sockaddr_in *, struct udp_in6 *, struct udp_ip6 *, struct ifnet *);
223#else /* !INET6 */
224static void udp_append(struct inpcb *, struct ip *, struct mbuf *, int,
225 struct sockaddr_in *, struct ifnet *);
226#endif /* !INET6 */
227static int udp_input_checksum(struct mbuf *, struct udphdr *, int, int);
228int udp_output(struct inpcb *, struct mbuf *, struct sockaddr *,
229 struct mbuf *, struct proc *);
230static void ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip);
231static void udp_gc(struct inpcbinfo *);
232
233struct pr_usrreqs udp_usrreqs = {
234 .pru_abort = udp_abort,
235 .pru_attach = udp_attach,
236 .pru_bind = udp_bind,
237 .pru_connect = udp_connect,
238 .pru_connectx = udp_connectx,
239 .pru_control = in_control,
240 .pru_detach = udp_detach,
241 .pru_disconnect = udp_disconnect,
242 .pru_disconnectx = udp_disconnectx,
243 .pru_peeraddr = in_getpeeraddr,
244 .pru_send = udp_send,
245 .pru_shutdown = udp_shutdown,
246 .pru_sockaddr = in_getsockaddr,
247 .pru_sosend = sosend,
248 .pru_soreceive = soreceive,
249 .pru_soreceive_list = soreceive_list,
250};
251
252void
253udp_init(struct protosw *pp, struct domain *dp)
254{
255#pragma unused(dp)
256 static int udp_initialized = 0;
257 vm_size_t str_size;
258 struct inpcbinfo *pcbinfo;
259
260 VERIFY((pp->pr_flags & (PR_INITIALIZED|PR_ATTACHED)) == PR_ATTACHED);
261
262 if (udp_initialized)
263 return;
264 udp_initialized = 1;
265 uint32_t pool_size = (nmbclusters << MCLSHIFT) >> MBSHIFT;
266 if (pool_size >= 96) {
267 /* Improves 10GbE UDP performance. */
268 udp_recvspace = 786896;
269 }
270 LIST_INIT(&udb);
271 udbinfo.ipi_listhead = &udb;
272 udbinfo.ipi_hashbase = hashinit(UDBHASHSIZE, M_PCB,
273 &udbinfo.ipi_hashmask);
274 udbinfo.ipi_porthashbase = hashinit(UDBHASHSIZE, M_PCB,
275 &udbinfo.ipi_porthashmask);
276 str_size = (vm_size_t) sizeof (struct inpcb);
277 udbinfo.ipi_zone = zinit(str_size, 80000*str_size, 8192, "udpcb");
278
279 pcbinfo = &udbinfo;
280 /*
281 * allocate lock group attribute and group for udp pcb mutexes
282 */
283 pcbinfo->ipi_lock_grp_attr = lck_grp_attr_alloc_init();
284 pcbinfo->ipi_lock_grp = lck_grp_alloc_init("udppcb",
285 pcbinfo->ipi_lock_grp_attr);
286 pcbinfo->ipi_lock_attr = lck_attr_alloc_init();
287 if ((pcbinfo->ipi_lock = lck_rw_alloc_init(pcbinfo->ipi_lock_grp,
288 pcbinfo->ipi_lock_attr)) == NULL) {
289 panic("%s: unable to allocate PCB lock\n", __func__);
290 /* NOTREACHED */
291 }
292
293 udbinfo.ipi_gc = udp_gc;
294 in_pcbinfo_attach(&udbinfo);
295}
296
297void
298udp_input(struct mbuf *m, int iphlen)
299{
300 struct ip *ip;
301 struct udphdr *uh;
302 struct inpcb *inp;
303 struct mbuf *opts = NULL;
304 int len, isbroadcast;
305 struct ip save_ip;
306 struct sockaddr *append_sa;
307 struct inpcbinfo *pcbinfo = &udbinfo;
308 struct sockaddr_in udp_in;
309 struct ip_moptions *imo = NULL;
310 int foundmembership = 0, ret = 0;
311#if INET6
312 struct udp_in6 udp_in6;
313 struct udp_ip6 udp_ip6;
314#endif /* INET6 */
315 struct ifnet *ifp = m->m_pkthdr.rcvif;
316 boolean_t cell = IFNET_IS_CELLULAR(ifp);
317 boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
318 boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
319
320 bzero(&udp_in, sizeof (udp_in));
321 udp_in.sin_len = sizeof (struct sockaddr_in);
322 udp_in.sin_family = AF_INET;
323#if INET6
324 bzero(&udp_in6, sizeof (udp_in6));
325 udp_in6.uin6_sin.sin6_len = sizeof (struct sockaddr_in6);
326 udp_in6.uin6_sin.sin6_family = AF_INET6;
327#endif /* INET6 */
328
329 udpstat.udps_ipackets++;
330
331 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
332
333 /* Expect 32-bit aligned data pointer on strict-align platforms */
334 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
335
336 /*
337 * Strip IP options, if any; should skip this,
338 * make available to user, and use on returned packets,
339 * but we don't yet have a way to check the checksum
340 * with options still present.
341 */
342 if (iphlen > sizeof (struct ip)) {
343 ip_stripoptions(m);
344 iphlen = sizeof (struct ip);
345 }
346
347 /*
348 * Get IP and UDP header together in first mbuf.
349 */
350 ip = mtod(m, struct ip *);
351 if (m->m_len < iphlen + sizeof (struct udphdr)) {
352 m = m_pullup(m, iphlen + sizeof (struct udphdr));
353 if (m == NULL) {
354 udpstat.udps_hdrops++;
355 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
356 0, 0, 0, 0, 0);
357 return;
358 }
359 ip = mtod(m, struct ip *);
360 }
361 uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
362
363 /* destination port of 0 is illegal, based on RFC768. */
364 if (uh->uh_dport == 0) {
365 IF_UDP_STATINC(ifp, port0);
366 goto bad;
367 }
368
369 KERNEL_DEBUG(DBG_LAYER_IN_BEG, uh->uh_dport, uh->uh_sport,
370 ip->ip_src.s_addr, ip->ip_dst.s_addr, uh->uh_ulen);
371
372 /*
373 * Make mbuf data length reflect UDP length.
374 * If not enough data to reflect UDP length, drop.
375 */
376 len = ntohs((u_short)uh->uh_ulen);
377 if (ip->ip_len != len) {
378 if (len > ip->ip_len || len < sizeof (struct udphdr)) {
379 udpstat.udps_badlen++;
380 IF_UDP_STATINC(ifp, badlength);
381 goto bad;
382 }
383 m_adj(m, len - ip->ip_len);
384 /* ip->ip_len = len; */
385 }
386 /*
387 * Save a copy of the IP header in case we want restore it
388 * for sending an ICMP error message in response.
389 */
390 save_ip = *ip;
391
392 /*
393 * Checksum extended UDP header and data.
394 */
395 if (udp_input_checksum(m, uh, iphlen, len))
396 goto bad;
397
398 isbroadcast = in_broadcast(ip->ip_dst, ifp);
399
400 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || isbroadcast) {
401 int reuse_sock = 0, mcast_delivered = 0;
402
403 lck_rw_lock_shared(pcbinfo->ipi_lock);
404 /*
405 * Deliver a multicast or broadcast datagram to *all* sockets
406 * for which the local and remote addresses and ports match
407 * those of the incoming datagram. This allows more than
408 * one process to receive multi/broadcasts on the same port.
409 * (This really ought to be done for unicast datagrams as
410 * well, but that would cause problems with existing
411 * applications that open both address-specific sockets and
412 * a wildcard socket listening to the same port -- they would
413 * end up receiving duplicates of every unicast datagram.
414 * Those applications open the multiple sockets to overcome an
415 * inadequacy of the UDP socket interface, but for backwards
416 * compatibility we avoid the problem here rather than
417 * fixing the interface. Maybe 4.5BSD will remedy this?)
418 */
419
420 /*
421 * Construct sockaddr format source address.
422 */
423 udp_in.sin_port = uh->uh_sport;
424 udp_in.sin_addr = ip->ip_src;
425 /*
426 * Locate pcb(s) for datagram.
427 * (Algorithm copied from raw_intr().)
428 */
429#if INET6
430 udp_in6.uin6_init_done = udp_ip6.uip6_init_done = 0;
431#endif /* INET6 */
432 LIST_FOREACH(inp, &udb, inp_list) {
433#if IPSEC
434 int skipit;
435#endif /* IPSEC */
436
437 if (inp->inp_socket == NULL)
438 continue;
439 if (inp != sotoinpcb(inp->inp_socket)) {
440 panic("%s: bad so back ptr inp=%p\n",
441 __func__, inp);
442 /* NOTREACHED */
443 }
444#if INET6
445 if ((inp->inp_vflag & INP_IPV4) == 0)
446 continue;
447#endif /* INET6 */
448 if (inp_restricted_recv(inp, ifp))
449 continue;
450
451 if ((inp->inp_moptions == NULL) &&
452 (ntohl(ip->ip_dst.s_addr) !=
453 INADDR_ALLHOSTS_GROUP) && (isbroadcast == 0))
454 continue;
455
456 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) ==
457 WNT_STOPUSING)
458 continue;
459
460 udp_lock(inp->inp_socket, 1, 0);
461
462 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) ==
463 WNT_STOPUSING) {
464 udp_unlock(inp->inp_socket, 1, 0);
465 continue;
466 }
467
468 if (inp->inp_lport != uh->uh_dport) {
469 udp_unlock(inp->inp_socket, 1, 0);
470 continue;
471 }
472 if (inp->inp_laddr.s_addr != INADDR_ANY) {
473 if (inp->inp_laddr.s_addr !=
474 ip->ip_dst.s_addr) {
475 udp_unlock(inp->inp_socket, 1, 0);
476 continue;
477 }
478 }
479 if (inp->inp_faddr.s_addr != INADDR_ANY) {
480 if (inp->inp_faddr.s_addr !=
481 ip->ip_src.s_addr ||
482 inp->inp_fport != uh->uh_sport) {
483 udp_unlock(inp->inp_socket, 1, 0);
484 continue;
485 }
486 }
487
488 if (isbroadcast == 0 && (ntohl(ip->ip_dst.s_addr) !=
489 INADDR_ALLHOSTS_GROUP)) {
490 struct sockaddr_in group;
491 int blocked;
492
493 if ((imo = inp->inp_moptions) == NULL) {
494 udp_unlock(inp->inp_socket, 1, 0);
495 continue;
496 }
497 IMO_LOCK(imo);
498
499 bzero(&group, sizeof (struct sockaddr_in));
500 group.sin_len = sizeof (struct sockaddr_in);
501 group.sin_family = AF_INET;
502 group.sin_addr = ip->ip_dst;
503
504 blocked = imo_multi_filter(imo, ifp,
505 &group, &udp_in);
506 if (blocked == MCAST_PASS)
507 foundmembership = 1;
508
509 IMO_UNLOCK(imo);
510 if (!foundmembership) {
511 udp_unlock(inp->inp_socket, 1, 0);
512 if (blocked == MCAST_NOTSMEMBER ||
513 blocked == MCAST_MUTED)
514 udpstat.udps_filtermcast++;
515 continue;
516 }
517 foundmembership = 0;
518 }
519
520 reuse_sock = (inp->inp_socket->so_options &
521 (SO_REUSEPORT|SO_REUSEADDR));
522
523#if NECP
524 skipit = 0;
525 if (!necp_socket_is_allowed_to_send_recv_v4(inp,
526 uh->uh_dport, uh->uh_sport, &ip->ip_dst,
527 &ip->ip_src, ifp, NULL, NULL, NULL)) {
528 /* do not inject data to pcb */
529 skipit = 1;
530 }
531 if (skipit == 0)
532#endif /* NECP */
533 {
534 struct mbuf *n = NULL;
535
536 if (reuse_sock)
537 n = m_copy(m, 0, M_COPYALL);
538#if INET6
539 udp_append(inp, ip, m,
540 iphlen + sizeof (struct udphdr),
541 &udp_in, &udp_in6, &udp_ip6, ifp);
542#else /* !INET6 */
543 udp_append(inp, ip, m,
544 iphlen + sizeof (struct udphdr),
545 &udp_in, ifp);
546#endif /* !INET6 */
547 mcast_delivered++;
548
549 m = n;
550 }
551 udp_unlock(inp->inp_socket, 1, 0);
552
553 /*
554 * Don't look for additional matches if this one does
555 * not have either the SO_REUSEPORT or SO_REUSEADDR
556 * socket options set. This heuristic avoids searching
557 * through all pcbs in the common case of a non-shared
558 * port. It assumes that an application will never
559 * clear these options after setting them.
560 */
561 if (reuse_sock == 0 || m == NULL)
562 break;
563
564 /*
565 * Expect 32-bit aligned data pointer on strict-align
566 * platforms.
567 */
568 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
569 /*
570 * Recompute IP and UDP header pointers for new mbuf
571 */
572 ip = mtod(m, struct ip *);
573 uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
574 }
575 lck_rw_done(pcbinfo->ipi_lock);
576
577 if (mcast_delivered == 0) {
578 /*
579 * No matching pcb found; discard datagram.
580 * (No need to send an ICMP Port Unreachable
581 * for a broadcast or multicast datgram.)
582 */
583 udpstat.udps_noportbcast++;
584 IF_UDP_STATINC(ifp, port_unreach);
585 goto bad;
586 }
587
588 /* free the extra copy of mbuf or skipped by IPSec */
589 if (m != NULL)
590 m_freem(m);
591 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
592 return;
593 }
594
595#if IPSEC
596 /*
597 * UDP to port 4500 with a payload where the first four bytes are
598 * not zero is a UDP encapsulated IPSec packet. Packets where
599 * the payload is one byte and that byte is 0xFF are NAT keepalive
600 * packets. Decapsulate the ESP packet and carry on with IPSec input
601 * or discard the NAT keep-alive.
602 */
603 if (ipsec_bypass == 0 && (esp_udp_encap_port & 0xFFFF) != 0 &&
604 uh->uh_dport == ntohs((u_short)esp_udp_encap_port)) {
605 int payload_len = len - sizeof (struct udphdr) > 4 ? 4 :
606 len - sizeof (struct udphdr);
607
608 if (m->m_len < iphlen + sizeof (struct udphdr) + payload_len) {
609 if ((m = m_pullup(m, iphlen + sizeof (struct udphdr) +
610 payload_len)) == NULL) {
611 udpstat.udps_hdrops++;
612 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
613 0, 0, 0, 0, 0);
614 return;
615 }
616 /*
617 * Expect 32-bit aligned data pointer on strict-align
618 * platforms.
619 */
620 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
621
622 ip = mtod(m, struct ip *);
623 uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
624 }
625 /* Check for NAT keepalive packet */
626 if (payload_len == 1 && *(u_int8_t *)
627 ((caddr_t)uh + sizeof (struct udphdr)) == 0xFF) {
628 m_freem(m);
629 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
630 0, 0, 0, 0, 0);
631 return;
632 } else if (payload_len == 4 && *(u_int32_t *)(void *)
633 ((caddr_t)uh + sizeof (struct udphdr)) != 0) {
634 /* UDP encapsulated IPSec packet to pass through NAT */
635 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
636 0, 0, 0, 0, 0);
637 /* preserve the udp header */
638 esp4_input(m, iphlen + sizeof (struct udphdr));
639 return;
640 }
641 }
642#endif /* IPSEC */
643
644 /*
645 * Locate pcb for datagram.
646 */
647 inp = in_pcblookup_hash(&udbinfo, ip->ip_src, uh->uh_sport,
648 ip->ip_dst, uh->uh_dport, 1, ifp);
649 if (inp == NULL) {
650 IF_UDP_STATINC(ifp, port_unreach);
651
652 if (udp_log_in_vain) {
653 char buf[MAX_IPv4_STR_LEN];
654 char buf2[MAX_IPv4_STR_LEN];
655
656 /* check src and dst address */
657 if (udp_log_in_vain < 3) {
658 log(LOG_INFO, "Connection attempt to "
659 "UDP %s:%d from %s:%d\n", inet_ntop(AF_INET,
660 &ip->ip_dst, buf, sizeof (buf)),
661 ntohs(uh->uh_dport), inet_ntop(AF_INET,
662 &ip->ip_src, buf2, sizeof (buf2)),
663 ntohs(uh->uh_sport));
664 } else if (!(m->m_flags & (M_BCAST | M_MCAST)) &&
665 ip->ip_dst.s_addr != ip->ip_src.s_addr) {
666 log_in_vain_log((LOG_INFO,
667 "Stealth Mode connection attempt to "
668 "UDP %s:%d from %s:%d\n", inet_ntop(AF_INET,
669 &ip->ip_dst, buf, sizeof (buf)),
670 ntohs(uh->uh_dport), inet_ntop(AF_INET,
671 &ip->ip_src, buf2, sizeof (buf2)),
672 ntohs(uh->uh_sport)))
673 }
674 }
675 udpstat.udps_noport++;
676 if (m->m_flags & (M_BCAST | M_MCAST)) {
677 udpstat.udps_noportbcast++;
678 goto bad;
679 }
680#if ICMP_BANDLIM
681 if (badport_bandlim(BANDLIM_ICMP_UNREACH) < 0)
682 goto bad;
683#endif /* ICMP_BANDLIM */
684 if (blackhole)
685 if (ifp && ifp->if_type != IFT_LOOP)
686 goto bad;
687 *ip = save_ip;
688 ip->ip_len += iphlen;
689 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
690 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
691 return;
692 }
693 udp_lock(inp->inp_socket, 1, 0);
694
695 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
696 udp_unlock(inp->inp_socket, 1, 0);
697 IF_UDP_STATINC(ifp, cleanup);
698 goto bad;
699 }
700#if NECP
701 if (!necp_socket_is_allowed_to_send_recv_v4(inp, uh->uh_dport,
702 uh->uh_sport, &ip->ip_dst, &ip->ip_src, ifp, NULL, NULL, NULL)) {
703 udp_unlock(inp->inp_socket, 1, 0);
704 IF_UDP_STATINC(ifp, badipsec);
705 goto bad;
706 }
707#endif /* NECP */
708
709 /*
710 * Construct sockaddr format source address.
711 * Stuff source address and datagram in user buffer.
712 */
713 udp_in.sin_port = uh->uh_sport;
714 udp_in.sin_addr = ip->ip_src;
715 if ((inp->inp_flags & INP_CONTROLOPTS) != 0 ||
716 (inp->inp_socket->so_options & SO_TIMESTAMP) != 0 ||
717 (inp->inp_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
718 (inp->inp_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
719#if INET6
720 if (inp->inp_vflag & INP_IPV6) {
721 int savedflags;
722
723 ip_2_ip6_hdr(&udp_ip6.uip6_ip6, ip);
724 savedflags = inp->inp_flags;
725 inp->inp_flags &= ~INP_UNMAPPABLEOPTS;
726 ret = ip6_savecontrol(inp, m, &opts);
727 inp->inp_flags = savedflags;
728 } else
729#endif /* INET6 */
730 {
731 ret = ip_savecontrol(inp, &opts, ip, m);
732 }
733 if (ret != 0) {
734 udp_unlock(inp->inp_socket, 1, 0);
735 goto bad;
736 }
737 }
738 m_adj(m, iphlen + sizeof (struct udphdr));
739
740 KERNEL_DEBUG(DBG_LAYER_IN_END, uh->uh_dport, uh->uh_sport,
741 save_ip.ip_src.s_addr, save_ip.ip_dst.s_addr, uh->uh_ulen);
742
743#if INET6
744 if (inp->inp_vflag & INP_IPV6) {
745 in6_sin_2_v4mapsin6(&udp_in, &udp_in6.uin6_sin);
746 append_sa = (struct sockaddr *)&udp_in6.uin6_sin;
747 } else
748#endif /* INET6 */
749 {
750 append_sa = (struct sockaddr *)&udp_in;
751 }
752 if (nstat_collect) {
753 INP_ADD_STAT(inp, cell, wifi, wired, rxpackets, 1);
754 INP_ADD_STAT(inp, cell, wifi, wired, rxbytes, m->m_pkthdr.len);
755 inp_set_activity_bitmap(inp);
756 }
757 so_recv_data_stat(inp->inp_socket, m, 0);
758 if (sbappendaddr(&inp->inp_socket->so_rcv, append_sa,
759 m, opts, NULL) == 0) {
760 udpstat.udps_fullsock++;
761 } else {
762 sorwakeup(inp->inp_socket);
763 }
764 udp_unlock(inp->inp_socket, 1, 0);
765 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
766 return;
767bad:
768 m_freem(m);
769 if (opts)
770 m_freem(opts);
771 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
772}
773
774#if INET6
775static void
776ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip)
777{
778 bzero(ip6, sizeof (*ip6));
779
780 ip6->ip6_vfc = IPV6_VERSION;
781 ip6->ip6_plen = ip->ip_len;
782 ip6->ip6_nxt = ip->ip_p;
783 ip6->ip6_hlim = ip->ip_ttl;
784 if (ip->ip_src.s_addr) {
785 ip6->ip6_src.s6_addr32[2] = IPV6_ADDR_INT32_SMP;
786 ip6->ip6_src.s6_addr32[3] = ip->ip_src.s_addr;
787 }
788 if (ip->ip_dst.s_addr) {
789 ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_SMP;
790 ip6->ip6_dst.s6_addr32[3] = ip->ip_dst.s_addr;
791 }
792}
793#endif /* INET6 */
794
795/*
796 * subroutine of udp_input(), mainly for source code readability.
797 */
798static void
799#if INET6
800udp_append(struct inpcb *last, struct ip *ip, struct mbuf *n, int off,
801 struct sockaddr_in *pudp_in, struct udp_in6 *pudp_in6,
802 struct udp_ip6 *pudp_ip6, struct ifnet *ifp)
803#else /* !INET6 */
804udp_append(struct inpcb *last, struct ip *ip, struct mbuf *n, int off,
805 struct sockaddr_in *pudp_in, struct ifnet *ifp)
806#endif /* !INET6 */
807{
808 struct sockaddr *append_sa;
809 struct mbuf *opts = 0;
810 boolean_t cell = IFNET_IS_CELLULAR(ifp);
811 boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
812 boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
813 int ret = 0;
814
815#if CONFIG_MACF_NET
816 if (mac_inpcb_check_deliver(last, n, AF_INET, SOCK_DGRAM) != 0) {
817 m_freem(n);
818 return;
819 }
820#endif /* CONFIG_MACF_NET */
821 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
822 (last->inp_socket->so_options & SO_TIMESTAMP) != 0 ||
823 (last->inp_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
824 (last->inp_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
825#if INET6
826 if (last->inp_vflag & INP_IPV6) {
827 int savedflags;
828
829 if (pudp_ip6->uip6_init_done == 0) {
830 ip_2_ip6_hdr(&pudp_ip6->uip6_ip6, ip);
831 pudp_ip6->uip6_init_done = 1;
832 }
833 savedflags = last->inp_flags;
834 last->inp_flags &= ~INP_UNMAPPABLEOPTS;
835 ret = ip6_savecontrol(last, n, &opts);
836 if (ret != 0) {
837 last->inp_flags = savedflags;
838 goto error;
839 }
840 last->inp_flags = savedflags;
841 } else
842#endif /* INET6 */
843 {
844 ret = ip_savecontrol(last, &opts, ip, n);
845 if (ret != 0) {
846 goto error;
847 }
848 }
849 }
850#if INET6
851 if (last->inp_vflag & INP_IPV6) {
852 if (pudp_in6->uin6_init_done == 0) {
853 in6_sin_2_v4mapsin6(pudp_in, &pudp_in6->uin6_sin);
854 pudp_in6->uin6_init_done = 1;
855 }
856 append_sa = (struct sockaddr *)&pudp_in6->uin6_sin;
857 } else
858#endif /* INET6 */
859 append_sa = (struct sockaddr *)pudp_in;
860 if (nstat_collect) {
861 INP_ADD_STAT(last, cell, wifi, wired, rxpackets, 1);
862 INP_ADD_STAT(last, cell, wifi, wired, rxbytes,
863 n->m_pkthdr.len);
864 inp_set_activity_bitmap(last);
865 }
866 so_recv_data_stat(last->inp_socket, n, 0);
867 m_adj(n, off);
868 if (sbappendaddr(&last->inp_socket->so_rcv, append_sa,
869 n, opts, NULL) == 0) {
870 udpstat.udps_fullsock++;
871 } else {
872 sorwakeup(last->inp_socket);
873 }
874 return;
875error:
876 m_freem(n);
877 m_freem(opts);
878}
879
880/*
881 * Notify a udp user of an asynchronous error;
882 * just wake up so that he can collect error status.
883 */
884void
885udp_notify(struct inpcb *inp, int errno)
886{
887 inp->inp_socket->so_error = errno;
888 sorwakeup(inp->inp_socket);
889 sowwakeup(inp->inp_socket);
890}
891
892void
893udp_ctlinput(int cmd, struct sockaddr *sa, void *vip, __unused struct ifnet * ifp)
894{
895 struct ip *ip = vip;
896 void (*notify)(struct inpcb *, int) = udp_notify;
897 struct in_addr faddr;
898 struct inpcb *inp = NULL;
899
900 faddr = ((struct sockaddr_in *)(void *)sa)->sin_addr;
901 if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
902 return;
903
904 if (PRC_IS_REDIRECT(cmd)) {
905 ip = 0;
906 notify = in_rtchange;
907 } else if (cmd == PRC_HOSTDEAD) {
908 ip = 0;
909 } else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0) {
910 return;
911 }
912 if (ip) {
913 struct udphdr uh;
914
915 bcopy(((caddr_t)ip + (ip->ip_hl << 2)), &uh, sizeof (uh));
916 inp = in_pcblookup_hash(&udbinfo, faddr, uh.uh_dport,
917 ip->ip_src, uh.uh_sport, 0, NULL);
918 if (inp != NULL && inp->inp_socket != NULL) {
919 udp_lock(inp->inp_socket, 1, 0);
920 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) ==
921 WNT_STOPUSING) {
922 udp_unlock(inp->inp_socket, 1, 0);
923 return;
924 }
925 (*notify)(inp, inetctlerrmap[cmd]);
926 udp_unlock(inp->inp_socket, 1, 0);
927 }
928 } else {
929 in_pcbnotifyall(&udbinfo, faddr, inetctlerrmap[cmd], notify);
930 }
931}
932
933int
934udp_ctloutput(struct socket *so, struct sockopt *sopt)
935{
936 int error = 0, optval = 0;
937 struct inpcb *inp;
938
939 /* Allow <SOL_SOCKET,SO_FLUSH> at this level */
940 if (sopt->sopt_level != IPPROTO_UDP &&
941 !(sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_FLUSH))
942 return (ip_ctloutput(so, sopt));
943
944 inp = sotoinpcb(so);
945
946 switch (sopt->sopt_dir) {
947 case SOPT_SET:
948 switch (sopt->sopt_name) {
949 case UDP_NOCKSUM:
950 /* This option is settable only for UDP over IPv4 */
951 if (!(inp->inp_vflag & INP_IPV4)) {
952 error = EINVAL;
953 break;
954 }
955
956 if ((error = sooptcopyin(sopt, &optval, sizeof (optval),
957 sizeof (optval))) != 0)
958 break;
959
960 if (optval != 0)
961 inp->inp_flags |= INP_UDP_NOCKSUM;
962 else
963 inp->inp_flags &= ~INP_UDP_NOCKSUM;
964 break;
965 case UDP_KEEPALIVE_OFFLOAD:
966 {
967 struct udp_keepalive_offload ka;
968 /*
969 * If the socket is not connected, the stack will
970 * not know the destination address to put in the
971 * keepalive datagram. Return an error now instead
972 * of failing later.
973 */
974 if (!(so->so_state & SS_ISCONNECTED)) {
975 error = EINVAL;
976 break;
977 }
978 if (sopt->sopt_valsize != sizeof(ka)) {
979 error = EINVAL;
980 break;
981 }
982 if ((error = sooptcopyin(sopt, &ka, sizeof(ka),
983 sizeof(ka))) != 0)
984 break;
985
986 /* application should specify the type */
987 if (ka.ka_type == 0)
988 return (EINVAL);
989
990 if (ka.ka_interval == 0) {
991 /*
992 * if interval is 0, disable the offload
993 * mechanism
994 */
995 if (inp->inp_keepalive_data != NULL)
996 FREE(inp->inp_keepalive_data,
997 M_TEMP);
998 inp->inp_keepalive_data = NULL;
999 inp->inp_keepalive_datalen = 0;
1000 inp->inp_keepalive_interval = 0;
1001 inp->inp_keepalive_type = 0;
1002 inp->inp_flags2 &= ~INP2_KEEPALIVE_OFFLOAD;
1003 } else {
1004 if (inp->inp_keepalive_data != NULL) {
1005 FREE(inp->inp_keepalive_data,
1006 M_TEMP);
1007 inp->inp_keepalive_data = NULL;
1008 }
1009
1010 inp->inp_keepalive_datalen = min(
1011 ka.ka_data_len,
1012 UDP_KEEPALIVE_OFFLOAD_DATA_SIZE);
1013 if (inp->inp_keepalive_datalen > 0) {
1014 MALLOC(inp->inp_keepalive_data,
1015 u_int8_t *,
1016 inp->inp_keepalive_datalen,
1017 M_TEMP, M_WAITOK);
1018 if (inp->inp_keepalive_data == NULL) {
1019 inp->inp_keepalive_datalen = 0;
1020 error = ENOMEM;
1021 break;
1022 }
1023 bcopy(ka.ka_data,
1024 inp->inp_keepalive_data,
1025 inp->inp_keepalive_datalen);
1026 } else {
1027 inp->inp_keepalive_datalen = 0;
1028 }
1029 inp->inp_keepalive_interval =
1030 min(UDP_KEEPALIVE_INTERVAL_MAX_SECONDS,
1031 ka.ka_interval);
1032 inp->inp_keepalive_type = ka.ka_type;
1033 inp->inp_flags2 |= INP2_KEEPALIVE_OFFLOAD;
1034 }
1035 break;
1036 }
1037 case SO_FLUSH:
1038 if ((error = sooptcopyin(sopt, &optval, sizeof (optval),
1039 sizeof (optval))) != 0)
1040 break;
1041
1042 error = inp_flush(inp, optval);
1043 break;
1044
1045 default:
1046 error = ENOPROTOOPT;
1047 break;
1048 }
1049 break;
1050
1051 case SOPT_GET:
1052 switch (sopt->sopt_name) {
1053 case UDP_NOCKSUM:
1054 optval = inp->inp_flags & INP_UDP_NOCKSUM;
1055 break;
1056
1057 default:
1058 error = ENOPROTOOPT;
1059 break;
1060 }
1061 if (error == 0)
1062 error = sooptcopyout(sopt, &optval, sizeof (optval));
1063 break;
1064 }
1065 return (error);
1066}
1067
1068static int
1069udp_pcblist SYSCTL_HANDLER_ARGS
1070{
1071#pragma unused(oidp, arg1, arg2)
1072 int error, i, n;
1073 struct inpcb *inp, **inp_list;
1074 inp_gen_t gencnt;
1075 struct xinpgen xig;
1076
1077 /*
1078 * The process of preparing the TCB list is too time-consuming and
1079 * resource-intensive to repeat twice on every request.
1080 */
1081 lck_rw_lock_exclusive(udbinfo.ipi_lock);
1082 if (req->oldptr == USER_ADDR_NULL) {
1083 n = udbinfo.ipi_count;
1084 req->oldidx = 2 * (sizeof (xig))
1085 + (n + n/8) * sizeof (struct xinpcb);
1086 lck_rw_done(udbinfo.ipi_lock);
1087 return (0);
1088 }
1089
1090 if (req->newptr != USER_ADDR_NULL) {
1091 lck_rw_done(udbinfo.ipi_lock);
1092 return (EPERM);
1093 }
1094
1095 /*
1096 * OK, now we're committed to doing something.
1097 */
1098 gencnt = udbinfo.ipi_gencnt;
1099 n = udbinfo.ipi_count;
1100
1101 bzero(&xig, sizeof (xig));
1102 xig.xig_len = sizeof (xig);
1103 xig.xig_count = n;
1104 xig.xig_gen = gencnt;
1105 xig.xig_sogen = so_gencnt;
1106 error = SYSCTL_OUT(req, &xig, sizeof (xig));
1107 if (error) {
1108 lck_rw_done(udbinfo.ipi_lock);
1109 return (error);
1110 }
1111 /*
1112 * We are done if there is no pcb
1113 */
1114 if (n == 0) {
1115 lck_rw_done(udbinfo.ipi_lock);
1116 return (0);
1117 }
1118
1119 inp_list = _MALLOC(n * sizeof (*inp_list), M_TEMP, M_WAITOK);
1120 if (inp_list == 0) {
1121 lck_rw_done(udbinfo.ipi_lock);
1122 return (ENOMEM);
1123 }
1124
1125 for (inp = LIST_FIRST(udbinfo.ipi_listhead), i = 0; inp && i < n;
1126 inp = LIST_NEXT(inp, inp_list)) {
1127 if (inp->inp_gencnt <= gencnt &&
1128 inp->inp_state != INPCB_STATE_DEAD)
1129 inp_list[i++] = inp;
1130 }
1131 n = i;
1132
1133 error = 0;
1134 for (i = 0; i < n; i++) {
1135 struct xinpcb xi;
1136
1137 inp = inp_list[i];
1138
1139 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING)
1140 continue;
1141 udp_lock(inp->inp_socket, 1, 0);
1142 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
1143 udp_unlock(inp->inp_socket, 1, 0);
1144 continue;
1145 }
1146 if (inp->inp_gencnt > gencnt) {
1147 udp_unlock(inp->inp_socket, 1, 0);
1148 continue;
1149 }
1150
1151 bzero(&xi, sizeof (xi));
1152 xi.xi_len = sizeof (xi);
1153 /* XXX should avoid extra copy */
1154 inpcb_to_compat(inp, &xi.xi_inp);
1155 if (inp->inp_socket)
1156 sotoxsocket(inp->inp_socket, &xi.xi_socket);
1157
1158 udp_unlock(inp->inp_socket, 1, 0);
1159
1160 error = SYSCTL_OUT(req, &xi, sizeof (xi));
1161 }
1162 if (!error) {
1163 /*
1164 * Give the user an updated idea of our state.
1165 * If the generation differs from what we told
1166 * her before, she knows that something happened
1167 * while we were processing this request, and it
1168 * might be necessary to retry.
1169 */
1170 bzero(&xig, sizeof (xig));
1171 xig.xig_len = sizeof (xig);
1172 xig.xig_gen = udbinfo.ipi_gencnt;
1173 xig.xig_sogen = so_gencnt;
1174 xig.xig_count = udbinfo.ipi_count;
1175 error = SYSCTL_OUT(req, &xig, sizeof (xig));
1176 }
1177 FREE(inp_list, M_TEMP);
1178 lck_rw_done(udbinfo.ipi_lock);
1179 return (error);
1180}
1181
1182SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist,
1183 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist,
1184 "S,xinpcb", "List of active UDP sockets");
1185
1186#if !CONFIG_EMBEDDED
1187
1188static int
1189udp_pcblist64 SYSCTL_HANDLER_ARGS
1190{
1191#pragma unused(oidp, arg1, arg2)
1192 int error, i, n;
1193 struct inpcb *inp, **inp_list;
1194 inp_gen_t gencnt;
1195 struct xinpgen xig;
1196
1197 /*
1198 * The process of preparing the TCB list is too time-consuming and
1199 * resource-intensive to repeat twice on every request.
1200 */
1201 lck_rw_lock_shared(udbinfo.ipi_lock);
1202 if (req->oldptr == USER_ADDR_NULL) {
1203 n = udbinfo.ipi_count;
1204 req->oldidx =
1205 2 * (sizeof (xig)) + (n + n/8) * sizeof (struct xinpcb64);
1206 lck_rw_done(udbinfo.ipi_lock);
1207 return (0);
1208 }
1209
1210 if (req->newptr != USER_ADDR_NULL) {
1211 lck_rw_done(udbinfo.ipi_lock);
1212 return (EPERM);
1213 }
1214
1215 /*
1216 * OK, now we're committed to doing something.
1217 */
1218 gencnt = udbinfo.ipi_gencnt;
1219 n = udbinfo.ipi_count;
1220
1221 bzero(&xig, sizeof (xig));
1222 xig.xig_len = sizeof (xig);
1223 xig.xig_count = n;
1224 xig.xig_gen = gencnt;
1225 xig.xig_sogen = so_gencnt;
1226 error = SYSCTL_OUT(req, &xig, sizeof (xig));
1227 if (error) {
1228 lck_rw_done(udbinfo.ipi_lock);
1229 return (error);
1230 }
1231 /*
1232 * We are done if there is no pcb
1233 */
1234 if (n == 0) {
1235 lck_rw_done(udbinfo.ipi_lock);
1236 return (0);
1237 }
1238
1239 inp_list = _MALLOC(n * sizeof (*inp_list), M_TEMP, M_WAITOK);
1240 if (inp_list == 0) {
1241 lck_rw_done(udbinfo.ipi_lock);
1242 return (ENOMEM);
1243 }
1244
1245 for (inp = LIST_FIRST(udbinfo.ipi_listhead), i = 0; inp && i < n;
1246 inp = LIST_NEXT(inp, inp_list)) {
1247 if (inp->inp_gencnt <= gencnt &&
1248 inp->inp_state != INPCB_STATE_DEAD)
1249 inp_list[i++] = inp;
1250 }
1251 n = i;
1252
1253 error = 0;
1254 for (i = 0; i < n; i++) {
1255 struct xinpcb64 xi;
1256
1257 inp = inp_list[i];
1258
1259 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING)
1260 continue;
1261 udp_lock(inp->inp_socket, 1, 0);
1262 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
1263 udp_unlock(inp->inp_socket, 1, 0);
1264 continue;
1265 }
1266 if (inp->inp_gencnt > gencnt) {
1267 udp_unlock(inp->inp_socket, 1, 0);
1268 continue;
1269 }
1270
1271 bzero(&xi, sizeof (xi));
1272 xi.xi_len = sizeof (xi);
1273 inpcb_to_xinpcb64(inp, &xi);
1274 if (inp->inp_socket)
1275 sotoxsocket64(inp->inp_socket, &xi.xi_socket);
1276
1277 udp_unlock(inp->inp_socket, 1, 0);
1278
1279 error = SYSCTL_OUT(req, &xi, sizeof (xi));
1280 }
1281 if (!error) {
1282 /*
1283 * Give the user an updated idea of our state.
1284 * If the generation differs from what we told
1285 * her before, she knows that something happened
1286 * while we were processing this request, and it
1287 * might be necessary to retry.
1288 */
1289 bzero(&xig, sizeof (xig));
1290 xig.xig_len = sizeof (xig);
1291 xig.xig_gen = udbinfo.ipi_gencnt;
1292 xig.xig_sogen = so_gencnt;
1293 xig.xig_count = udbinfo.ipi_count;
1294 error = SYSCTL_OUT(req, &xig, sizeof (xig));
1295 }
1296 FREE(inp_list, M_TEMP);
1297 lck_rw_done(udbinfo.ipi_lock);
1298 return (error);
1299}
1300
1301SYSCTL_PROC(_net_inet_udp, OID_AUTO, pcblist64,
1302 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist64,
1303 "S,xinpcb64", "List of active UDP sockets");
1304
1305#endif /* !CONFIG_EMBEDDED */
1306
1307static int
1308udp_pcblist_n SYSCTL_HANDLER_ARGS
1309{
1310#pragma unused(oidp, arg1, arg2)
1311 return (get_pcblist_n(IPPROTO_UDP, req, &udbinfo));
1312}
1313
1314SYSCTL_PROC(_net_inet_udp, OID_AUTO, pcblist_n,
1315 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist_n,
1316 "S,xinpcb_n", "List of active UDP sockets");
1317
1318__private_extern__ void
1319udp_get_ports_used(uint32_t ifindex, int protocol, uint32_t flags,
1320 bitstr_t *bitfield)
1321{
1322 inpcb_get_ports_used(ifindex, protocol, flags, bitfield,
1323 &udbinfo);
1324}
1325
1326__private_extern__ uint32_t
1327udp_count_opportunistic(unsigned int ifindex, u_int32_t flags)
1328{
1329 return (inpcb_count_opportunistic(ifindex, &udbinfo, flags));
1330}
1331
1332__private_extern__ uint32_t
1333udp_find_anypcb_byaddr(struct ifaddr *ifa)
1334{
1335 return (inpcb_find_anypcb_byaddr(ifa, &udbinfo));
1336}
1337
1338static int
1339udp_check_pktinfo(struct mbuf *control, struct ifnet **outif,
1340 struct in_addr *laddr)
1341{
1342 struct cmsghdr *cm = 0;
1343 struct in_pktinfo *pktinfo;
1344 struct ifnet *ifp;
1345
1346 if (outif != NULL)
1347 *outif = NULL;
1348
1349 /*
1350 * XXX: Currently, we assume all the optional information is stored
1351 * in a single mbuf.
1352 */
1353 if (control->m_next)
1354 return (EINVAL);
1355
1356 if (control->m_len < CMSG_LEN(0))
1357 return (EINVAL);
1358
1359 for (cm = M_FIRST_CMSGHDR(control); cm;
1360 cm = M_NXT_CMSGHDR(control, cm)) {
1361 if (cm->cmsg_len < sizeof (struct cmsghdr) ||
1362 cm->cmsg_len > control->m_len)
1363 return (EINVAL);
1364
1365 if (cm->cmsg_level != IPPROTO_IP || cm->cmsg_type != IP_PKTINFO)
1366 continue;
1367
1368 if (cm->cmsg_len != CMSG_LEN(sizeof (struct in_pktinfo)))
1369 return (EINVAL);
1370
1371 pktinfo = (struct in_pktinfo *)(void *)CMSG_DATA(cm);
1372
1373 /* Check for a valid ifindex in pktinfo */
1374 ifnet_head_lock_shared();
1375
1376 if (pktinfo->ipi_ifindex > if_index) {
1377 ifnet_head_done();
1378 return (ENXIO);
1379 }
1380
1381 /*
1382 * If ipi_ifindex is specified it takes precedence
1383 * over ipi_spec_dst.
1384 */
1385 if (pktinfo->ipi_ifindex) {
1386 ifp = ifindex2ifnet[pktinfo->ipi_ifindex];
1387 if (ifp == NULL) {
1388 ifnet_head_done();
1389 return (ENXIO);
1390 }
1391 if (outif != NULL) {
1392 ifnet_reference(ifp);
1393 *outif = ifp;
1394 }
1395 ifnet_head_done();
1396 laddr->s_addr = INADDR_ANY;
1397 break;
1398 }
1399
1400 ifnet_head_done();
1401
1402 /*
1403 * Use the provided ipi_spec_dst address for temp
1404 * source address.
1405 */
1406 *laddr = pktinfo->ipi_spec_dst;
1407 break;
1408 }
1409 return (0);
1410}
1411
1412int
1413udp_output(struct inpcb *inp, struct mbuf *m, struct sockaddr *addr,
1414 struct mbuf *control, struct proc *p)
1415{
1416 struct udpiphdr *ui;
1417 int len = m->m_pkthdr.len;
1418 struct sockaddr_in *sin;
1419 struct in_addr origladdr, laddr, faddr, pi_laddr;
1420 u_short lport, fport;
1421 int error = 0, udp_dodisconnect = 0, pktinfo = 0;
1422 struct socket *so = inp->inp_socket;
1423 int soopts = 0;
1424 struct mbuf *inpopts;
1425 struct ip_moptions *mopts;
1426 struct route ro;
1427 struct ip_out_args ipoa;
1428#if CONTENT_FILTER
1429 struct m_tag *cfil_tag = NULL;
1430 bool cfil_faddr_use = false;
1431 uint32_t cfil_so_state_change_cnt = 0;
1432 short cfil_so_options = 0;
1433 struct sockaddr *cfil_faddr = NULL;
1434#endif
1435
1436 bzero(&ipoa, sizeof(ipoa));
1437 ipoa.ipoa_boundif = IFSCOPE_NONE;
1438 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF;
1439
1440 struct ifnet *outif = NULL;
1441 struct flowadv *adv = &ipoa.ipoa_flowadv;
1442 int sotc = SO_TC_UNSPEC;
1443 int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
1444 struct ifnet *origoutifp = NULL;
1445 int flowadv = 0;
1446
1447 /* Enable flow advisory only when connected */
1448 flowadv = (so->so_state & SS_ISCONNECTED) ? 1 : 0;
1449 pi_laddr.s_addr = INADDR_ANY;
1450
1451 KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
1452
1453 socket_lock_assert_owned(so);
1454
1455#if CONTENT_FILTER
1456 /*
1457 * If socket is subject to UDP Content Filter and no addr is passed in,
1458 * retrieve CFIL saved state from mbuf and use it if necessary.
1459 */
1460 if (so->so_cfil_db && !addr) {
1461 cfil_tag = cfil_udp_get_socket_state(m, &cfil_so_state_change_cnt, &cfil_so_options, &cfil_faddr);
1462 if (cfil_tag) {
1463 sin = (struct sockaddr_in *)(void *)cfil_faddr;
1464 if (inp && inp->inp_faddr.s_addr == INADDR_ANY) {
1465 /*
1466 * Socket is unconnected, simply use the saved faddr as 'addr' to go through
1467 * the connect/disconnect logic.
1468 */
1469 addr = (struct sockaddr *)cfil_faddr;
1470 } else if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
1471 (inp->inp_fport != sin->sin_port ||
1472 inp->inp_faddr.s_addr != sin->sin_addr.s_addr)) {
1473 /*
1474 * Socket is connected but socket state and dest addr/port changed.
1475 * We need to use the saved faddr info.
1476 */
1477 cfil_faddr_use = true;
1478 }
1479 }
1480 }
1481#endif
1482
1483 if (control != NULL) {
1484 sotc = so_tc_from_control(control, &netsvctype);
1485 VERIFY(outif == NULL);
1486 error = udp_check_pktinfo(control, &outif, &pi_laddr);
1487 m_freem(control);
1488 control = NULL;
1489 if (error)
1490 goto release;
1491 pktinfo++;
1492 if (outif != NULL)
1493 ipoa.ipoa_boundif = outif->if_index;
1494 }
1495 if (sotc == SO_TC_UNSPEC) {
1496 sotc = so->so_traffic_class;
1497 netsvctype = so->so_netsvctype;
1498 }
1499
1500 KERNEL_DEBUG(DBG_LAYER_OUT_BEG, inp->inp_fport, inp->inp_lport,
1501 inp->inp_laddr.s_addr, inp->inp_faddr.s_addr,
1502 (htons((u_short)len + sizeof (struct udphdr))));
1503
1504 if (len + sizeof (struct udpiphdr) > IP_MAXPACKET) {
1505 error = EMSGSIZE;
1506 goto release;
1507 }
1508
1509 if (flowadv && INP_WAIT_FOR_IF_FEEDBACK(inp)) {
1510 /*
1511 * The socket is flow-controlled, drop the packets
1512 * until the inp is not flow controlled
1513 */
1514 error = ENOBUFS;
1515 goto release;
1516 }
1517 /*
1518 * If socket was bound to an ifindex, tell ip_output about it.
1519 * If the ancillary IP_PKTINFO option contains an interface index,
1520 * it takes precedence over the one specified by IP_BOUND_IF.
1521 */
1522 if (ipoa.ipoa_boundif == IFSCOPE_NONE &&
1523 (inp->inp_flags & INP_BOUND_IF)) {
1524 VERIFY(inp->inp_boundifp != NULL);
1525 ifnet_reference(inp->inp_boundifp); /* for this routine */
1526 if (outif != NULL)
1527 ifnet_release(outif);
1528 outif = inp->inp_boundifp;
1529 ipoa.ipoa_boundif = outif->if_index;
1530 }
1531 if (INP_NO_CELLULAR(inp))
1532 ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
1533 if (INP_NO_EXPENSIVE(inp))
1534 ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
1535 if (INP_AWDL_UNRESTRICTED(inp))
1536 ipoa.ipoa_flags |= IPOAF_AWDL_UNRESTRICTED;
1537 ipoa.ipoa_sotc = sotc;
1538 ipoa.ipoa_netsvctype = netsvctype;
1539 soopts |= IP_OUTARGS;
1540
1541 /*
1542 * If there was a routing change, discard cached route and check
1543 * that we have a valid source address. Reacquire a new source
1544 * address if INADDR_ANY was specified.
1545 *
1546 * If we are using cfil saved state, go through this cache cleanup
1547 * so that we can get a new route.
1548 */
1549 if (ROUTE_UNUSABLE(&inp->inp_route)
1550#if CONTENT_FILTER
1551 || cfil_faddr_use
1552#endif
1553 ) {
1554 struct in_ifaddr *ia = NULL;
1555
1556 ROUTE_RELEASE(&inp->inp_route);
1557
1558 /* src address is gone? */
1559 if (inp->inp_laddr.s_addr != INADDR_ANY &&
1560 (ia = ifa_foraddr(inp->inp_laddr.s_addr)) == NULL) {
1561 if (!(inp->inp_flags & INP_INADDR_ANY) ||
1562 (so->so_state & SS_ISCONNECTED)) {
1563 /*
1564 * Rdar://5448998
1565 * If the source address is gone, return an
1566 * error if:
1567 * - the source was specified
1568 * - the socket was already connected
1569 */
1570 soevent(so, (SO_FILT_HINT_LOCKED |
1571 SO_FILT_HINT_NOSRCADDR));
1572 error = EADDRNOTAVAIL;
1573 goto release;
1574 } else {
1575 /* new src will be set later */
1576 inp->inp_laddr.s_addr = INADDR_ANY;
1577 inp->inp_last_outifp = NULL;
1578 }
1579 }
1580 if (ia != NULL)
1581 IFA_REMREF(&ia->ia_ifa);
1582 }
1583
1584 /*
1585 * IP_PKTINFO option check. If a temporary scope or src address
1586 * is provided, use it for this packet only and make sure we forget
1587 * it after sending this datagram.
1588 */
1589 if (pi_laddr.s_addr != INADDR_ANY ||
1590 (ipoa.ipoa_boundif != IFSCOPE_NONE && pktinfo)) {
1591 /* temp src address for this datagram only */
1592 laddr = pi_laddr;
1593 origladdr.s_addr = INADDR_ANY;
1594 /* we don't want to keep the laddr or route */
1595 udp_dodisconnect = 1;
1596 /* remember we don't care about src addr */
1597 inp->inp_flags |= INP_INADDR_ANY;
1598 } else {
1599 origladdr = laddr = inp->inp_laddr;
1600 }
1601
1602 origoutifp = inp->inp_last_outifp;
1603 faddr = inp->inp_faddr;
1604 lport = inp->inp_lport;
1605 fport = inp->inp_fport;
1606
1607#if CONTENT_FILTER
1608 if (cfil_faddr_use)
1609 {
1610 faddr = ((struct sockaddr_in *)(void *)cfil_faddr)->sin_addr;
1611 fport = ((struct sockaddr_in *)(void *)cfil_faddr)->sin_port;
1612 }
1613#endif
1614
1615 if (addr) {
1616 sin = (struct sockaddr_in *)(void *)addr;
1617 if (faddr.s_addr != INADDR_ANY) {
1618 error = EISCONN;
1619 goto release;
1620 }
1621 if (lport == 0) {
1622 /*
1623 * In case we don't have a local port set, go through
1624 * the full connect. We don't have a local port yet
1625 * (i.e., we can't be looked up), so it's not an issue
1626 * if the input runs at the same time we do this.
1627 */
1628 /* if we have a source address specified, use that */
1629 if (pi_laddr.s_addr != INADDR_ANY)
1630 inp->inp_laddr = pi_laddr;
1631 /*
1632 * If a scope is specified, use it. Scope from
1633 * IP_PKTINFO takes precendence over the the scope
1634 * set via INP_BOUND_IF.
1635 */
1636 error = in_pcbconnect(inp, addr, p, ipoa.ipoa_boundif,
1637 &outif);
1638 if (error)
1639 goto release;
1640
1641 laddr = inp->inp_laddr;
1642 lport = inp->inp_lport;
1643 faddr = inp->inp_faddr;
1644 fport = inp->inp_fport;
1645 udp_dodisconnect = 1;
1646
1647 /* synch up in case in_pcbladdr() overrides */
1648 if (outif != NULL && ipoa.ipoa_boundif != IFSCOPE_NONE)
1649 ipoa.ipoa_boundif = outif->if_index;
1650 } else {
1651 /*
1652 * Fast path case
1653 *
1654 * We have a full address and a local port; use those
1655 * info to build the packet without changing the pcb
1656 * and interfering with the input path. See 3851370.
1657 *
1658 * Scope from IP_PKTINFO takes precendence over the
1659 * the scope set via INP_BOUND_IF.
1660 */
1661 if (laddr.s_addr == INADDR_ANY) {
1662 if ((error = in_pcbladdr(inp, addr, &laddr,
1663 ipoa.ipoa_boundif, &outif, 0)) != 0)
1664 goto release;
1665 /*
1666 * from pcbconnect: remember we don't
1667 * care about src addr.
1668 */
1669 inp->inp_flags |= INP_INADDR_ANY;
1670
1671 /* synch up in case in_pcbladdr() overrides */
1672 if (outif != NULL &&
1673 ipoa.ipoa_boundif != IFSCOPE_NONE)
1674 ipoa.ipoa_boundif = outif->if_index;
1675 }
1676
1677 faddr = sin->sin_addr;
1678 fport = sin->sin_port;
1679 }
1680 } else {
1681 if (faddr.s_addr == INADDR_ANY) {
1682 error = ENOTCONN;
1683 goto release;
1684 }
1685 }
1686
1687#if CONFIG_MACF_NET
1688 mac_mbuf_label_associate_inpcb(inp, m);
1689#endif /* CONFIG_MACF_NET */
1690
1691 if (inp->inp_flowhash == 0)
1692 inp->inp_flowhash = inp_calc_flowhash(inp);
1693
1694 if (fport == htons(53) && !(so->so_flags1 & SOF1_DNS_COUNTED)) {
1695 so->so_flags1 |= SOF1_DNS_COUNTED;
1696 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_dns);
1697 }
1698
1699 /*
1700 * Calculate data length and get a mbuf
1701 * for UDP and IP headers.
1702 */
1703 M_PREPEND(m, sizeof (struct udpiphdr), M_DONTWAIT, 1);
1704 if (m == 0) {
1705 error = ENOBUFS;
1706 goto abort;
1707 }
1708
1709 /*
1710 * Fill in mbuf with extended UDP header
1711 * and addresses and length put into network format.
1712 */
1713 ui = mtod(m, struct udpiphdr *);
1714 bzero(ui->ui_x1, sizeof (ui->ui_x1)); /* XXX still needed? */
1715 ui->ui_pr = IPPROTO_UDP;
1716 ui->ui_src = laddr;
1717 ui->ui_dst = faddr;
1718 ui->ui_sport = lport;
1719 ui->ui_dport = fport;
1720 ui->ui_ulen = htons((u_short)len + sizeof (struct udphdr));
1721
1722 /*
1723 * Set up checksum to pseudo header checksum and output datagram.
1724 *
1725 * Treat flows to be CLAT46'd as IPv6 flow and compute checksum
1726 * no matter what, as IPv6 mandates checksum for UDP.
1727 *
1728 * Here we only compute the one's complement sum of the pseudo header.
1729 * The payload computation and final complement is delayed to much later
1730 * in IP processing to decide if remaining computation needs to be done
1731 * through offload.
1732 *
1733 * That is communicated by setting CSUM_UDP in csum_flags.
1734 * The offset of checksum from the start of ULP header is communicated
1735 * through csum_data.
1736 *
1737 * Note since this already contains the pseudo checksum header, any
1738 * later operation at IP layer that modify the values used here must
1739 * update the checksum as well (for example NAT etc).
1740 */
1741 if ((inp->inp_flags2 & INP2_CLAT46_FLOW) ||
1742 (udpcksum && !(inp->inp_flags & INP_UDP_NOCKSUM))) {
1743 ui->ui_sum = in_pseudo(ui->ui_src.s_addr, ui->ui_dst.s_addr,
1744 htons((u_short)len + sizeof (struct udphdr) + IPPROTO_UDP));
1745 m->m_pkthdr.csum_flags = (CSUM_UDP|CSUM_ZERO_INVERT);
1746 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
1747 } else {
1748 ui->ui_sum = 0;
1749 }
1750 ((struct ip *)ui)->ip_len = sizeof (struct udpiphdr) + len;
1751 ((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl; /* XXX */
1752 ((struct ip *)ui)->ip_tos = inp->inp_ip_tos; /* XXX */
1753 udpstat.udps_opackets++;
1754
1755 KERNEL_DEBUG(DBG_LAYER_OUT_END, ui->ui_dport, ui->ui_sport,
1756 ui->ui_src.s_addr, ui->ui_dst.s_addr, ui->ui_ulen);
1757
1758#if NECP
1759 {
1760 necp_kernel_policy_id policy_id;
1761 necp_kernel_policy_id skip_policy_id;
1762 u_int32_t route_rule_id;
1763
1764 /*
1765 * We need a route to perform NECP route rule checks
1766 */
1767 if (net_qos_policy_restricted != 0 &&
1768 ROUTE_UNUSABLE(&inp->inp_route)) {
1769 struct sockaddr_in to;
1770 struct sockaddr_in from;
1771
1772 ROUTE_RELEASE(&inp->inp_route);
1773
1774 bzero(&from, sizeof(struct sockaddr_in));
1775 from.sin_family = AF_INET;
1776 from.sin_len = sizeof(struct sockaddr_in);
1777 from.sin_addr = laddr;
1778
1779 bzero(&to, sizeof(struct sockaddr_in));
1780 to.sin_family = AF_INET;
1781 to.sin_len = sizeof(struct sockaddr_in);
1782 to.sin_addr = faddr;
1783
1784 inp->inp_route.ro_dst.sa_family = AF_INET;
1785 inp->inp_route.ro_dst.sa_len = sizeof(struct sockaddr_in);
1786 ((struct sockaddr_in *)(void *)&inp->inp_route.ro_dst)->sin_addr =
1787 faddr;
1788
1789 rtalloc_scoped(&inp->inp_route, ipoa.ipoa_boundif);
1790
1791 inp_update_necp_policy(inp, (struct sockaddr *)&from,
1792 (struct sockaddr *)&to, ipoa.ipoa_boundif);
1793 inp->inp_policyresult.results.qos_marking_gencount = 0;
1794 }
1795
1796 if (!necp_socket_is_allowed_to_send_recv_v4(inp, lport, fport,
1797 &laddr, &faddr, NULL, &policy_id, &route_rule_id, &skip_policy_id)) {
1798 error = EHOSTUNREACH;
1799 goto abort;
1800 }
1801
1802 necp_mark_packet_from_socket(m, inp, policy_id, route_rule_id, skip_policy_id);
1803
1804 if (net_qos_policy_restricted != 0) {
1805 necp_socket_update_qos_marking(inp,
1806 inp->inp_route.ro_rt, NULL, route_rule_id);
1807 }
1808 }
1809#endif /* NECP */
1810 if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED))
1811 ipoa.ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
1812
1813#if IPSEC
1814 if (inp->inp_sp != NULL && ipsec_setsocket(m, inp->inp_socket) != 0) {
1815 error = ENOBUFS;
1816 goto abort;
1817 }
1818#endif /* IPSEC */
1819
1820 inpopts = inp->inp_options;
1821#if CONTENT_FILTER
1822 if (cfil_tag && (inp->inp_socket->so_options != cfil_so_options))
1823 soopts |= (cfil_so_options & (SO_DONTROUTE | SO_BROADCAST));
1824 else
1825#endif
1826 soopts |= (inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST));
1827
1828 mopts = inp->inp_moptions;
1829 if (mopts != NULL) {
1830 IMO_LOCK(mopts);
1831 IMO_ADDREF_LOCKED(mopts);
1832 if (IN_MULTICAST(ntohl(ui->ui_dst.s_addr)) &&
1833 mopts->imo_multicast_ifp != NULL) {
1834 /* no reference needed */
1835 inp->inp_last_outifp = mopts->imo_multicast_ifp;
1836
1837 }
1838 IMO_UNLOCK(mopts);
1839 }
1840
1841 /* Copy the cached route and take an extra reference */
1842 inp_route_copyout(inp, &ro);
1843
1844 set_packet_service_class(m, so, sotc, 0);
1845 m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
1846 m->m_pkthdr.pkt_flowid = inp->inp_flowhash;
1847 m->m_pkthdr.pkt_proto = IPPROTO_UDP;
1848 m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC);
1849 if (flowadv)
1850 m->m_pkthdr.pkt_flags |= PKTF_FLOW_ADV;
1851 m->m_pkthdr.tx_udp_pid = so->last_pid;
1852 if (so->so_flags & SOF_DELEGATED)
1853 m->m_pkthdr.tx_udp_e_pid = so->e_pid;
1854 else
1855 m->m_pkthdr.tx_udp_e_pid = 0;
1856
1857 if (ipoa.ipoa_boundif != IFSCOPE_NONE)
1858 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
1859
1860 if (laddr.s_addr != INADDR_ANY)
1861 ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
1862
1863 inp->inp_sndinprog_cnt++;
1864
1865 socket_unlock(so, 0);
1866 error = ip_output(m, inpopts, &ro, soopts, mopts, &ipoa);
1867 m = NULL;
1868 socket_lock(so, 0);
1869 if (mopts != NULL)
1870 IMO_REMREF(mopts);
1871
1872 if (error == 0 && nstat_collect) {
1873 boolean_t cell, wifi, wired;
1874
1875 if (ro.ro_rt != NULL) {
1876 cell = IFNET_IS_CELLULAR(ro.ro_rt->rt_ifp);
1877 wifi = (!cell && IFNET_IS_WIFI(ro.ro_rt->rt_ifp));
1878 wired = (!wifi && IFNET_IS_WIRED(ro.ro_rt->rt_ifp));
1879 } else {
1880 cell = wifi = wired = FALSE;
1881 }
1882 INP_ADD_STAT(inp, cell, wifi, wired, txpackets, 1);
1883 INP_ADD_STAT(inp, cell, wifi, wired, txbytes, len);
1884 inp_set_activity_bitmap(inp);
1885 }
1886
1887 if (flowadv && (adv->code == FADV_FLOW_CONTROLLED ||
1888 adv->code == FADV_SUSPENDED)) {
1889 /*
1890 * return a hint to the application that
1891 * the packet has been dropped
1892 */
1893 error = ENOBUFS;
1894 inp_set_fc_state(inp, adv->code);
1895 }
1896
1897 VERIFY(inp->inp_sndinprog_cnt > 0);
1898 if ( --inp->inp_sndinprog_cnt == 0)
1899 inp->inp_flags &= ~(INP_FC_FEEDBACK);
1900
1901 /* Synchronize PCB cached route */
1902 inp_route_copyin(inp, &ro);
1903
1904abort:
1905 if (udp_dodisconnect) {
1906 /* Always discard the cached route for unconnected socket */
1907 ROUTE_RELEASE(&inp->inp_route);
1908 in_pcbdisconnect(inp);
1909 inp->inp_laddr = origladdr; /* XXX rehash? */
1910 /* no reference needed */
1911 inp->inp_last_outifp = origoutifp;
1912
1913 } else if (inp->inp_route.ro_rt != NULL) {
1914 struct rtentry *rt = inp->inp_route.ro_rt;
1915 struct ifnet *outifp;
1916
1917 if (rt->rt_flags & (RTF_MULTICAST|RTF_BROADCAST))
1918 rt = NULL; /* unusable */
1919
1920#if CONTENT_FILTER
1921 /*
1922 * Discard temporary route for cfil case
1923 */
1924 if (cfil_faddr_use)
1925 rt = NULL; /* unusable */
1926#endif
1927
1928 /*
1929 * Always discard if it is a multicast or broadcast route.
1930 */
1931 if (rt == NULL)
1932 ROUTE_RELEASE(&inp->inp_route);
1933
1934 /*
1935 * If the destination route is unicast, update outifp with
1936 * that of the route interface used by IP.
1937 */
1938 if (rt != NULL &&
1939 (outifp = rt->rt_ifp) != inp->inp_last_outifp) {
1940 inp->inp_last_outifp = outifp; /* no reference needed */
1941
1942 so->so_pktheadroom = P2ROUNDUP(
1943 sizeof(struct udphdr) +
1944 sizeof(struct ip) +
1945 ifnet_hdrlen(outifp) +
1946 ifnet_mbuf_packetpreamblelen(outifp),
1947 sizeof(u_int32_t));
1948 }
1949 } else {
1950 ROUTE_RELEASE(&inp->inp_route);
1951 }
1952
1953 /*
1954 * If output interface was cellular/expensive, and this socket is
1955 * denied access to it, generate an event.
1956 */
1957 if (error != 0 && (ipoa.ipoa_retflags & IPOARF_IFDENIED) &&
1958 (INP_NO_CELLULAR(inp) || INP_NO_EXPENSIVE(inp)))
1959 soevent(so, (SO_FILT_HINT_LOCKED|SO_FILT_HINT_IFDENIED));
1960
1961release:
1962 KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_END, error, 0, 0, 0, 0);
1963
1964 if (m != NULL)
1965 m_freem(m);
1966
1967 if (outif != NULL)
1968 ifnet_release(outif);
1969
1970#if CONTENT_FILTER
1971 if (cfil_tag)
1972 m_tag_free(cfil_tag);
1973#endif
1974
1975 return (error);
1976}
1977
1978u_int32_t udp_sendspace = 9216; /* really max datagram size */
1979/* 187 1K datagrams (approx 192 KB) */
1980u_int32_t udp_recvspace = 187 * (1024 +
1981#if INET6
1982 sizeof (struct sockaddr_in6)
1983#else /* !INET6 */
1984 sizeof (struct sockaddr_in)
1985#endif /* !INET6 */
1986 );
1987
1988/* Check that the values of udp send and recv space do not exceed sb_max */
1989static int
1990sysctl_udp_sospace(struct sysctl_oid *oidp, void *arg1, int arg2,
1991 struct sysctl_req *req)
1992{
1993#pragma unused(arg1, arg2)
1994 u_int32_t new_value = 0, *space_p = NULL;
1995 int changed = 0, error = 0;
1996 u_quad_t sb_effective_max = (sb_max/(MSIZE+MCLBYTES)) * MCLBYTES;
1997
1998 switch (oidp->oid_number) {
1999 case UDPCTL_RECVSPACE:
2000 space_p = &udp_recvspace;
2001 break;
2002 case UDPCTL_MAXDGRAM:
2003 space_p = &udp_sendspace;
2004 break;
2005 default:
2006 return (EINVAL);
2007 }
2008 error = sysctl_io_number(req, *space_p, sizeof (u_int32_t),
2009 &new_value, &changed);
2010 if (changed) {
2011 if (new_value > 0 && new_value <= sb_effective_max)
2012 *space_p = new_value;
2013 else
2014 error = ERANGE;
2015 }
2016 return (error);
2017}
2018
2019SYSCTL_PROC(_net_inet_udp, UDPCTL_RECVSPACE, recvspace,
2020 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &udp_recvspace, 0,
2021 &sysctl_udp_sospace, "IU", "Maximum incoming UDP datagram size");
2022
2023SYSCTL_PROC(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram,
2024 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &udp_sendspace, 0,
2025 &sysctl_udp_sospace, "IU", "Maximum outgoing UDP datagram size");
2026
2027int
2028udp_abort(struct socket *so)
2029{
2030 struct inpcb *inp;
2031
2032 inp = sotoinpcb(so);
2033 if (inp == NULL) {
2034 panic("%s: so=%p null inp\n", __func__, so);
2035 /* NOTREACHED */
2036 }
2037 soisdisconnected(so);
2038 in_pcbdetach(inp);
2039 return (0);
2040}
2041
2042int
2043udp_attach(struct socket *so, int proto, struct proc *p)
2044{
2045#pragma unused(proto)
2046 struct inpcb *inp;
2047 int error;
2048
2049 inp = sotoinpcb(so);
2050 if (inp != NULL) {
2051 panic("%s so=%p inp=%p\n", __func__, so, inp);
2052 /* NOTREACHED */
2053 }
2054 error = in_pcballoc(so, &udbinfo, p);
2055 if (error != 0)
2056 return (error);
2057 error = soreserve(so, udp_sendspace, udp_recvspace);
2058 if (error != 0)
2059 return (error);
2060 inp = (struct inpcb *)so->so_pcb;
2061 inp->inp_vflag |= INP_IPV4;
2062 inp->inp_ip_ttl = ip_defttl;
2063 if (nstat_collect)
2064 nstat_udp_new_pcb(inp);
2065 return (0);
2066}
2067
2068int
2069udp_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
2070{
2071 struct inpcb *inp;
2072 int error;
2073
2074 if (nam->sa_family != 0 && nam->sa_family != AF_INET &&
2075 nam->sa_family != AF_INET6)
2076 return (EAFNOSUPPORT);
2077
2078 inp = sotoinpcb(so);
2079 if (inp == NULL)
2080 return (EINVAL);
2081 error = in_pcbbind(inp, nam, p);
2082
2083#if NECP
2084 /* Update NECP client with bind result if not in middle of connect */
2085 if (error == 0 &&
2086 (inp->inp_flags2 & INP2_CONNECT_IN_PROGRESS) &&
2087 !uuid_is_null(inp->necp_client_uuid)) {
2088 socket_unlock(so, 0);
2089 necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
2090 socket_lock(so, 0);
2091 }
2092#endif /* NECP */
2093
2094 return (error);
2095}
2096
2097int
2098udp_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
2099{
2100 struct inpcb *inp;
2101 int error;
2102
2103 inp = sotoinpcb(so);
2104 if (inp == NULL)
2105 return (EINVAL);
2106 if (inp->inp_faddr.s_addr != INADDR_ANY)
2107 return (EISCONN);
2108
2109 if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
2110 so->so_flags1 |= SOF1_CONNECT_COUNTED;
2111 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
2112 }
2113
2114#if NECP
2115#if FLOW_DIVERT
2116 if (necp_socket_should_use_flow_divert(inp)) {
2117 uint32_t fd_ctl_unit =
2118 necp_socket_get_flow_divert_control_unit(inp);
2119 if (fd_ctl_unit > 0) {
2120 error = flow_divert_pcb_init(so, fd_ctl_unit);
2121 if (error == 0) {
2122 error = flow_divert_connect_out(so, nam, p);
2123 }
2124 } else {
2125 error = ENETDOWN;
2126 }
2127 return (error);
2128 }
2129#endif /* FLOW_DIVERT */
2130#endif /* NECP */
2131
2132 error = in_pcbconnect(inp, nam, p, IFSCOPE_NONE, NULL);
2133 if (error == 0) {
2134#if NECP
2135 /* Update NECP client with connected five-tuple */
2136 if (!uuid_is_null(inp->necp_client_uuid)) {
2137 socket_unlock(so, 0);
2138 necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
2139 socket_lock(so, 0);
2140 }
2141#endif /* NECP */
2142
2143 soisconnected(so);
2144 if (inp->inp_flowhash == 0)
2145 inp->inp_flowhash = inp_calc_flowhash(inp);
2146 }
2147 return (error);
2148}
2149
2150int
2151udp_connectx_common(struct socket *so, int af, struct sockaddr *src, struct sockaddr *dst,
2152 struct proc *p, uint32_t ifscope, sae_associd_t aid, sae_connid_t *pcid,
2153 uint32_t flags, void *arg, uint32_t arglen,
2154 struct uio *uio, user_ssize_t *bytes_written)
2155{
2156#pragma unused(aid, flags, arg, arglen)
2157 struct inpcb *inp = sotoinpcb(so);
2158 int error = 0;
2159 user_ssize_t datalen = 0;
2160
2161 if (inp == NULL)
2162 return (EINVAL);
2163
2164 VERIFY(dst != NULL);
2165
2166 ASSERT(!(inp->inp_flags2 & INP2_CONNECT_IN_PROGRESS));
2167 inp->inp_flags2 |= INP2_CONNECT_IN_PROGRESS;
2168
2169#if NECP
2170 inp_update_necp_policy(inp, src, dst, ifscope);
2171#endif /* NECP */
2172
2173 /* bind socket to the specified interface, if requested */
2174 if (ifscope != IFSCOPE_NONE &&
2175 (error = inp_bindif(inp, ifscope, NULL)) != 0) {
2176 goto done;
2177 }
2178
2179 /* if source address and/or port is specified, bind to it */
2180 if (src != NULL) {
2181 error = sobindlock(so, src, 0); /* already locked */
2182 if (error != 0) {
2183 goto done;
2184 }
2185 }
2186
2187 switch (af) {
2188 case AF_INET:
2189 error = udp_connect(so, dst, p);
2190 break;
2191#if INET6
2192 case AF_INET6:
2193 error = udp6_connect(so, dst, p);
2194 break;
2195#endif /* INET6 */
2196 default:
2197 VERIFY(0);
2198 /* NOTREACHED */
2199 }
2200
2201 if (error != 0) {
2202 goto done;
2203 }
2204
2205 /*
2206 * If there is data, copy it. DATA_IDEMPOTENT is ignored.
2207 * CONNECT_RESUME_ON_READ_WRITE is ignored.
2208 */
2209 if (uio != NULL) {
2210 socket_unlock(so, 0);
2211
2212 VERIFY(bytes_written != NULL);
2213
2214 datalen = uio_resid(uio);
2215 error = so->so_proto->pr_usrreqs->pru_sosend(so, NULL,
2216 (uio_t)uio, NULL, NULL, 0);
2217 socket_lock(so, 0);
2218
2219 /* If error returned is EMSGSIZE, for example, disconnect */
2220 if (error == 0 || error == EWOULDBLOCK)
2221 *bytes_written = datalen - uio_resid(uio);
2222 else
2223 (void) so->so_proto->pr_usrreqs->pru_disconnectx(so,
2224 SAE_ASSOCID_ANY, SAE_CONNID_ANY);
2225 /*
2226 * mask the EWOULDBLOCK error so that the caller
2227 * knows that atleast the connect was successful.
2228 */
2229 if (error == EWOULDBLOCK)
2230 error = 0;
2231 }
2232
2233 if (error == 0 && pcid != NULL)
2234 *pcid = 1; /* there is only 1 connection for UDP */
2235
2236done:
2237 inp->inp_flags2 &= ~INP2_CONNECT_IN_PROGRESS;
2238 return (error);
2239}
2240
2241int
2242udp_connectx(struct socket *so, struct sockaddr *src,
2243 struct sockaddr *dst, struct proc *p, uint32_t ifscope,
2244 sae_associd_t aid, sae_connid_t *pcid, uint32_t flags, void *arg,
2245 uint32_t arglen, struct uio *uio, user_ssize_t *bytes_written)
2246{
2247 return (udp_connectx_common(so, AF_INET, src, dst,
2248 p, ifscope, aid, pcid, flags, arg, arglen, uio, bytes_written));
2249}
2250
2251int
2252udp_detach(struct socket *so)
2253{
2254 struct inpcb *inp;
2255
2256 inp = sotoinpcb(so);
2257 if (inp == NULL) {
2258 panic("%s: so=%p null inp\n", __func__, so);
2259 /* NOTREACHED */
2260 }
2261
2262 /*
2263 * If this is a socket that does not want to wakeup the device
2264 * for it's traffic, the application might be waiting for
2265 * close to complete before going to sleep. Send a notification
2266 * for this kind of sockets
2267 */
2268 if (so->so_options & SO_NOWAKEFROMSLEEP)
2269 socket_post_kev_msg_closed(so);
2270
2271 in_pcbdetach(inp);
2272 inp->inp_state = INPCB_STATE_DEAD;
2273 return (0);
2274}
2275
2276int
2277udp_disconnect(struct socket *so)
2278{
2279 struct inpcb *inp;
2280
2281 inp = sotoinpcb(so);
2282 if (inp == NULL
2283#if NECP
2284 || (necp_socket_should_use_flow_divert(inp))
2285#endif /* NECP */
2286 )
2287 return (inp == NULL ? EINVAL : EPROTOTYPE);
2288 if (inp->inp_faddr.s_addr == INADDR_ANY)
2289 return (ENOTCONN);
2290
2291 in_pcbdisconnect(inp);
2292
2293 /* reset flow controlled state, just in case */
2294 inp_reset_fc_state(inp);
2295
2296 inp->inp_laddr.s_addr = INADDR_ANY;
2297 so->so_state &= ~SS_ISCONNECTED; /* XXX */
2298 inp->inp_last_outifp = NULL;
2299
2300 return (0);
2301}
2302
2303int
2304udp_disconnectx(struct socket *so, sae_associd_t aid, sae_connid_t cid)
2305{
2306#pragma unused(cid)
2307 if (aid != SAE_ASSOCID_ANY && aid != SAE_ASSOCID_ALL)
2308 return (EINVAL);
2309
2310 return (udp_disconnect(so));
2311}
2312
2313int
2314udp_send(struct socket *so, int flags, struct mbuf *m,
2315 struct sockaddr *addr, struct mbuf *control, struct proc *p)
2316{
2317#ifndef FLOW_DIVERT
2318#pragma unused(flags)
2319#endif /* !(FLOW_DIVERT) */
2320 struct inpcb *inp;
2321
2322 inp = sotoinpcb(so);
2323 if (inp == NULL) {
2324 if (m != NULL)
2325 m_freem(m);
2326 if (control != NULL)
2327 m_freem(control);
2328 return (EINVAL);
2329 }
2330
2331#if NECP
2332#if FLOW_DIVERT
2333 if (necp_socket_should_use_flow_divert(inp)) {
2334 /* Implicit connect */
2335 return (flow_divert_implicit_data_out(so, flags, m, addr,
2336 control, p));
2337 }
2338#endif /* FLOW_DIVERT */
2339#endif /* NECP */
2340
2341 return (udp_output(inp, m, addr, control, p));
2342}
2343
2344int
2345udp_shutdown(struct socket *so)
2346{
2347 struct inpcb *inp;
2348
2349 inp = sotoinpcb(so);
2350 if (inp == NULL)
2351 return (EINVAL);
2352 socantsendmore(so);
2353 return (0);
2354}
2355
2356int
2357udp_lock(struct socket *so, int refcount, void *debug)
2358{
2359 void *lr_saved;
2360
2361 if (debug == NULL)
2362 lr_saved = __builtin_return_address(0);
2363 else
2364 lr_saved = debug;
2365
2366 if (so->so_pcb != NULL) {
2367 LCK_MTX_ASSERT(&((struct inpcb *)so->so_pcb)->inpcb_mtx,
2368 LCK_MTX_ASSERT_NOTOWNED);
2369 lck_mtx_lock(&((struct inpcb *)so->so_pcb)->inpcb_mtx);
2370 } else {
2371 panic("%s: so=%p NO PCB! lr=%p lrh= %s\n", __func__,
2372 so, lr_saved, solockhistory_nr(so));
2373 /* NOTREACHED */
2374 }
2375 if (refcount)
2376 so->so_usecount++;
2377
2378 so->lock_lr[so->next_lock_lr] = lr_saved;
2379 so->next_lock_lr = (so->next_lock_lr+1) % SO_LCKDBG_MAX;
2380 return (0);
2381}
2382
2383int
2384udp_unlock(struct socket *so, int refcount, void *debug)
2385{
2386 void *lr_saved;
2387
2388 if (debug == NULL)
2389 lr_saved = __builtin_return_address(0);
2390 else
2391 lr_saved = debug;
2392
2393 if (refcount) {
2394 VERIFY(so->so_usecount > 0);
2395 so->so_usecount--;
2396 }
2397 if (so->so_pcb == NULL) {
2398 panic("%s: so=%p NO PCB! lr=%p lrh= %s\n", __func__,
2399 so, lr_saved, solockhistory_nr(so));
2400 /* NOTREACHED */
2401 } else {
2402 LCK_MTX_ASSERT(&((struct inpcb *)so->so_pcb)->inpcb_mtx,
2403 LCK_MTX_ASSERT_OWNED);
2404 so->unlock_lr[so->next_unlock_lr] = lr_saved;
2405 so->next_unlock_lr = (so->next_unlock_lr+1) % SO_LCKDBG_MAX;
2406 lck_mtx_unlock(&((struct inpcb *)so->so_pcb)->inpcb_mtx);
2407 }
2408 return (0);
2409}
2410
2411lck_mtx_t *
2412udp_getlock(struct socket *so, int flags)
2413{
2414#pragma unused(flags)
2415 struct inpcb *inp = sotoinpcb(so);
2416
2417 if (so->so_pcb == NULL) {
2418 panic("%s: so=%p NULL so_pcb lrh= %s\n", __func__,
2419 so, solockhistory_nr(so));
2420 /* NOTREACHED */
2421 }
2422 return (&inp->inpcb_mtx);
2423}
2424
2425/*
2426 * UDP garbage collector callback (inpcb_timer_func_t).
2427 *
2428 * Returns > 0 to keep timer active.
2429 */
2430static void
2431udp_gc(struct inpcbinfo *ipi)
2432{
2433 struct inpcb *inp, *inpnxt;
2434 struct socket *so;
2435
2436 if (lck_rw_try_lock_exclusive(ipi->ipi_lock) == FALSE) {
2437 if (udp_gc_done == TRUE) {
2438 udp_gc_done = FALSE;
2439 /* couldn't get the lock, must lock next time */
2440 atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2441 return;
2442 }
2443 lck_rw_lock_exclusive(ipi->ipi_lock);
2444 }
2445
2446 udp_gc_done = TRUE;
2447
2448 for (inp = udb.lh_first; inp != NULL; inp = inpnxt) {
2449 inpnxt = inp->inp_list.le_next;
2450
2451 /*
2452 * Skip unless it's STOPUSING; garbage collector will
2453 * be triggered by in_pcb_checkstate() upon setting
2454 * wantcnt to that value. If the PCB is already dead,
2455 * keep gc active to anticipate wantcnt changing.
2456 */
2457 if (inp->inp_wantcnt != WNT_STOPUSING)
2458 continue;
2459
2460 /*
2461 * Skip if busy, no hurry for cleanup. Keep gc active
2462 * and try the lock again during next round.
2463 */
2464 if (!socket_try_lock(inp->inp_socket)) {
2465 atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2466 continue;
2467 }
2468
2469 /*
2470 * Keep gc active unless usecount is 0.
2471 */
2472 so = inp->inp_socket;
2473 if (so->so_usecount == 0) {
2474 if (inp->inp_state != INPCB_STATE_DEAD) {
2475#if INET6
2476 if (SOCK_CHECK_DOM(so, PF_INET6))
2477 in6_pcbdetach(inp);
2478 else
2479#endif /* INET6 */
2480 in_pcbdetach(inp);
2481 }
2482 in_pcbdispose(inp);
2483 } else {
2484 socket_unlock(so, 0);
2485 atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2486 }
2487 }
2488 lck_rw_done(ipi->ipi_lock);
2489}
2490
2491static int
2492udp_getstat SYSCTL_HANDLER_ARGS
2493{
2494#pragma unused(oidp, arg1, arg2)
2495 if (req->oldptr == USER_ADDR_NULL)
2496 req->oldlen = (size_t)sizeof (struct udpstat);
2497
2498 return (SYSCTL_OUT(req, &udpstat, MIN(sizeof (udpstat), req->oldlen)));
2499}
2500
2501void
2502udp_in_cksum_stats(u_int32_t len)
2503{
2504 udpstat.udps_rcv_swcsum++;
2505 udpstat.udps_rcv_swcsum_bytes += len;
2506}
2507
2508void
2509udp_out_cksum_stats(u_int32_t len)
2510{
2511 udpstat.udps_snd_swcsum++;
2512 udpstat.udps_snd_swcsum_bytes += len;
2513}
2514
2515#if INET6
2516void
2517udp_in6_cksum_stats(u_int32_t len)
2518{
2519 udpstat.udps_rcv6_swcsum++;
2520 udpstat.udps_rcv6_swcsum_bytes += len;
2521}
2522
2523void
2524udp_out6_cksum_stats(u_int32_t len)
2525{
2526 udpstat.udps_snd6_swcsum++;
2527 udpstat.udps_snd6_swcsum_bytes += len;
2528}
2529#endif /* INET6 */
2530
2531/*
2532 * Checksum extended UDP header and data.
2533 */
2534static int
2535udp_input_checksum(struct mbuf *m, struct udphdr *uh, int off, int ulen)
2536{
2537 struct ifnet *ifp = m->m_pkthdr.rcvif;
2538 struct ip *ip = mtod(m, struct ip *);
2539 struct ipovly *ipov = (struct ipovly *)ip;
2540
2541 if (uh->uh_sum == 0) {
2542 udpstat.udps_nosum++;
2543 return (0);
2544 }
2545
2546 /* ip_stripoptions() must have been called before we get here */
2547 ASSERT((ip->ip_hl << 2) == sizeof (*ip));
2548
2549 if ((hwcksum_rx || (ifp->if_flags & IFF_LOOPBACK) ||
2550 (m->m_pkthdr.pkt_flags & PKTF_LOOP)) &&
2551 (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)) {
2552 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
2553 uh->uh_sum = m->m_pkthdr.csum_rx_val;
2554 } else {
2555 uint32_t sum = m->m_pkthdr.csum_rx_val;
2556 uint32_t start = m->m_pkthdr.csum_rx_start;
2557 int32_t trailer = (m_pktlen(m) - (off + ulen));
2558
2559 /*
2560 * Perform 1's complement adjustment of octets
2561 * that got included/excluded in the hardware-
2562 * calculated checksum value. Ignore cases
2563 * where the value already includes the entire
2564 * IP header span, as the sum for those octets
2565 * would already be 0 by the time we get here;
2566 * IP has already performed its header checksum
2567 * checks. If we do need to adjust, restore
2568 * the original fields in the IP header when
2569 * computing the adjustment value. Also take
2570 * care of any trailing bytes and subtract out
2571 * their partial sum.
2572 */
2573 ASSERT(trailer >= 0);
2574 if ((m->m_pkthdr.csum_flags & CSUM_PARTIAL) &&
2575 ((start != 0 && start != off) || trailer != 0)) {
2576 uint32_t swbytes = (uint32_t)trailer;
2577
2578 if (start < off) {
2579 ip->ip_len += sizeof (*ip);
2580#if BYTE_ORDER != BIG_ENDIAN
2581 HTONS(ip->ip_len);
2582 HTONS(ip->ip_off);
2583#endif /* BYTE_ORDER != BIG_ENDIAN */
2584 }
2585 /* callee folds in sum */
2586 sum = m_adj_sum16(m, start, off, ulen, sum);
2587 if (off > start)
2588 swbytes += (off - start);
2589 else
2590 swbytes += (start - off);
2591
2592 if (start < off) {
2593#if BYTE_ORDER != BIG_ENDIAN
2594 NTOHS(ip->ip_off);
2595 NTOHS(ip->ip_len);
2596#endif /* BYTE_ORDER != BIG_ENDIAN */
2597 ip->ip_len -= sizeof (*ip);
2598 }
2599
2600 if (swbytes != 0)
2601 udp_in_cksum_stats(swbytes);
2602 if (trailer != 0)
2603 m_adj(m, -trailer);
2604 }
2605
2606 /* callee folds in sum */
2607 uh->uh_sum = in_pseudo(ip->ip_src.s_addr,
2608 ip->ip_dst.s_addr, sum + htonl(ulen + IPPROTO_UDP));
2609 }
2610 uh->uh_sum ^= 0xffff;
2611 } else {
2612 uint16_t ip_sum;
2613 char b[9];
2614
2615 bcopy(ipov->ih_x1, b, sizeof (ipov->ih_x1));
2616 bzero(ipov->ih_x1, sizeof (ipov->ih_x1));
2617 ip_sum = ipov->ih_len;
2618 ipov->ih_len = uh->uh_ulen;
2619 uh->uh_sum = in_cksum(m, ulen + sizeof (struct ip));
2620 bcopy(b, ipov->ih_x1, sizeof (ipov->ih_x1));
2621 ipov->ih_len = ip_sum;
2622
2623 udp_in_cksum_stats(ulen);
2624 }
2625
2626 if (uh->uh_sum != 0) {
2627 udpstat.udps_badsum++;
2628 IF_UDP_STATINC(ifp, badchksum);
2629 return (-1);
2630 }
2631
2632 return (0);
2633}
2634
2635void
2636udp_fill_keepalive_offload_frames(ifnet_t ifp,
2637 struct ifnet_keepalive_offload_frame *frames_array,
2638 u_int32_t frames_array_count, size_t frame_data_offset,
2639 u_int32_t *used_frames_count)
2640{
2641 struct inpcb *inp;
2642 inp_gen_t gencnt;
2643 u_int32_t frame_index = *used_frames_count;
2644
2645 if (ifp == NULL || frames_array == NULL ||
2646 frames_array_count == 0 ||
2647 frame_index >= frames_array_count ||
2648 frame_data_offset >= IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE)
2649 return;
2650
2651 lck_rw_lock_shared(udbinfo.ipi_lock);
2652 gencnt = udbinfo.ipi_gencnt;
2653 LIST_FOREACH(inp, udbinfo.ipi_listhead, inp_list) {
2654 struct socket *so;
2655 u_int8_t *data;
2656 struct ifnet_keepalive_offload_frame *frame;
2657 struct mbuf *m = NULL;
2658
2659 if (frame_index >= frames_array_count)
2660 break;
2661
2662 if (inp->inp_gencnt > gencnt ||
2663 inp->inp_state == INPCB_STATE_DEAD)
2664 continue;
2665
2666 if ((so = inp->inp_socket) == NULL ||
2667 (so->so_state & SS_DEFUNCT))
2668 continue;
2669 /*
2670 * check for keepalive offload flag without socket
2671 * lock to avoid a deadlock
2672 */
2673 if (!(inp->inp_flags2 & INP2_KEEPALIVE_OFFLOAD)) {
2674 continue;
2675 }
2676
2677 udp_lock(so, 1, 0);
2678 if (!(inp->inp_vflag & (INP_IPV4 | INP_IPV6))) {
2679 udp_unlock(so, 1, 0);
2680 continue;
2681 }
2682 if ((inp->inp_vflag & INP_IPV4) &&
2683 (inp->inp_laddr.s_addr == INADDR_ANY ||
2684 inp->inp_faddr.s_addr == INADDR_ANY)) {
2685 udp_unlock(so, 1, 0);
2686 continue;
2687 }
2688 if ((inp->inp_vflag & INP_IPV6) &&
2689 (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) ||
2690 IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))) {
2691 udp_unlock(so, 1, 0);
2692 continue;
2693 }
2694 if (inp->inp_lport == 0 || inp->inp_fport == 0) {
2695 udp_unlock(so, 1, 0);
2696 continue;
2697 }
2698 if (inp->inp_last_outifp == NULL ||
2699 inp->inp_last_outifp->if_index != ifp->if_index) {
2700 udp_unlock(so, 1, 0);
2701 continue;
2702 }
2703 if ((inp->inp_vflag & INP_IPV4)) {
2704 if ((frame_data_offset + sizeof(struct udpiphdr) +
2705 inp->inp_keepalive_datalen) >
2706 IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2707 udp_unlock(so, 1, 0);
2708 continue;
2709 }
2710 if ((sizeof(struct udpiphdr) +
2711 inp->inp_keepalive_datalen) > _MHLEN) {
2712 udp_unlock(so, 1, 0);
2713 continue;
2714 }
2715 } else {
2716 if ((frame_data_offset + sizeof(struct ip6_hdr) +
2717 sizeof(struct udphdr) +
2718 inp->inp_keepalive_datalen) >
2719 IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2720 udp_unlock(so, 1, 0);
2721 continue;
2722 }
2723 if ((sizeof(struct ip6_hdr) + sizeof(struct udphdr) +
2724 inp->inp_keepalive_datalen) > _MHLEN) {
2725 udp_unlock(so, 1, 0);
2726 continue;
2727 }
2728 }
2729 MGETHDR(m, M_WAIT, MT_HEADER);
2730 if (m == NULL) {
2731 udp_unlock(so, 1, 0);
2732 continue;
2733 }
2734 /*
2735 * This inp has all the information that is needed to
2736 * generate an offload frame.
2737 */
2738 if (inp->inp_vflag & INP_IPV4) {
2739 struct ip *ip;
2740 struct udphdr *udp;
2741
2742 frame = &frames_array[frame_index];
2743 frame->length = frame_data_offset +
2744 sizeof(struct udpiphdr) +
2745 inp->inp_keepalive_datalen;
2746 frame->ether_type =
2747 IFNET_KEEPALIVE_OFFLOAD_FRAME_ETHERTYPE_IPV4;
2748 frame->interval = inp->inp_keepalive_interval;
2749 switch (inp->inp_keepalive_type) {
2750 case UDP_KEEPALIVE_OFFLOAD_TYPE_AIRPLAY:
2751 frame->type =
2752 IFNET_KEEPALIVE_OFFLOAD_FRAME_AIRPLAY;
2753 break;
2754 default:
2755 break;
2756 }
2757 data = mtod(m, u_int8_t *);
2758 bzero(data, sizeof(struct udpiphdr));
2759 ip = (__typeof__(ip))(void *)data;
2760 udp = (__typeof__(udp))(void *) (data +
2761 sizeof(struct ip));
2762 m->m_len = sizeof(struct udpiphdr);
2763 data = data + sizeof(struct udpiphdr);
2764 if (inp->inp_keepalive_datalen > 0 &&
2765 inp->inp_keepalive_data != NULL) {
2766 bcopy(inp->inp_keepalive_data, data,
2767 inp->inp_keepalive_datalen);
2768 m->m_len += inp->inp_keepalive_datalen;
2769 }
2770 m->m_pkthdr.len = m->m_len;
2771
2772 ip->ip_v = IPVERSION;
2773 ip->ip_hl = (sizeof(struct ip) >> 2);
2774 ip->ip_p = IPPROTO_UDP;
2775 ip->ip_len = htons(sizeof(struct udpiphdr) +
2776 (u_short)inp->inp_keepalive_datalen);
2777 ip->ip_ttl = inp->inp_ip_ttl;
2778 ip->ip_tos |= (inp->inp_ip_tos & ~IPTOS_ECN_MASK);
2779 ip->ip_src = inp->inp_laddr;
2780 ip->ip_dst = inp->inp_faddr;
2781 ip->ip_sum = in_cksum_hdr_opt(ip);
2782
2783 udp->uh_sport = inp->inp_lport;
2784 udp->uh_dport = inp->inp_fport;
2785 udp->uh_ulen = htons(sizeof(struct udphdr) +
2786 (u_short)inp->inp_keepalive_datalen);
2787
2788 if (!(inp->inp_flags & INP_UDP_NOCKSUM)) {
2789 udp->uh_sum = in_pseudo(ip->ip_src.s_addr,
2790 ip->ip_dst.s_addr,
2791 htons(sizeof(struct udphdr) +
2792 (u_short)inp->inp_keepalive_datalen +
2793 IPPROTO_UDP));
2794 m->m_pkthdr.csum_flags =
2795 (CSUM_UDP|CSUM_ZERO_INVERT);
2796 m->m_pkthdr.csum_data = offsetof(struct udphdr,
2797 uh_sum);
2798 }
2799 m->m_pkthdr.pkt_proto = IPPROTO_UDP;
2800 in_delayed_cksum(m);
2801 bcopy(m->m_data, frame->data + frame_data_offset,
2802 m->m_len);
2803 } else {
2804 struct ip6_hdr *ip6;
2805 struct udphdr *udp6;
2806
2807 VERIFY(inp->inp_vflag & INP_IPV6);
2808 frame = &frames_array[frame_index];
2809 frame->length = frame_data_offset +
2810 sizeof(struct ip6_hdr) +
2811 sizeof(struct udphdr) +
2812 inp->inp_keepalive_datalen;
2813 frame->ether_type =
2814 IFNET_KEEPALIVE_OFFLOAD_FRAME_ETHERTYPE_IPV6;
2815 frame->interval = inp->inp_keepalive_interval;
2816 switch (inp->inp_keepalive_type) {
2817 case UDP_KEEPALIVE_OFFLOAD_TYPE_AIRPLAY:
2818 frame->type =
2819 IFNET_KEEPALIVE_OFFLOAD_FRAME_AIRPLAY;
2820 break;
2821 default:
2822 break;
2823 }
2824 data = mtod(m, u_int8_t *);
2825 bzero(data, sizeof(struct ip6_hdr) + sizeof(struct udphdr));
2826 ip6 = (__typeof__(ip6))(void *)data;
2827 udp6 = (__typeof__(udp6))(void *)(data +
2828 sizeof(struct ip6_hdr));
2829 m->m_len = sizeof(struct ip6_hdr) +
2830 sizeof(struct udphdr);
2831 data = data + (sizeof(struct ip6_hdr) +
2832 sizeof(struct udphdr));
2833 if (inp->inp_keepalive_datalen > 0 &&
2834 inp->inp_keepalive_data != NULL) {
2835 bcopy(inp->inp_keepalive_data, data,
2836 inp->inp_keepalive_datalen);
2837 m->m_len += inp->inp_keepalive_datalen;
2838 }
2839 m->m_pkthdr.len = m->m_len;
2840 ip6->ip6_flow = inp->inp_flow & IPV6_FLOWINFO_MASK;
2841 ip6->ip6_flow = ip6->ip6_flow & ~IPV6_FLOW_ECN_MASK;
2842 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
2843 ip6->ip6_vfc |= IPV6_VERSION;
2844 ip6->ip6_nxt = IPPROTO_UDP;
2845 ip6->ip6_hlim = ip6_defhlim;
2846 ip6->ip6_plen = htons(sizeof(struct udphdr) +
2847 (u_short)inp->inp_keepalive_datalen);
2848 ip6->ip6_src = inp->in6p_laddr;
2849 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src))
2850 ip6->ip6_src.s6_addr16[1] = 0;
2851
2852 ip6->ip6_dst = inp->in6p_faddr;
2853 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst))
2854 ip6->ip6_dst.s6_addr16[1] = 0;
2855
2856 udp6->uh_sport = inp->in6p_lport;
2857 udp6->uh_dport = inp->in6p_fport;
2858 udp6->uh_ulen = htons(sizeof(struct udphdr) +
2859 (u_short)inp->inp_keepalive_datalen);
2860 if (!(inp->inp_flags & INP_UDP_NOCKSUM)) {
2861 udp6->uh_sum = in6_pseudo(&ip6->ip6_src,
2862 &ip6->ip6_dst,
2863 htonl(sizeof(struct udphdr) +
2864 (u_short)inp->inp_keepalive_datalen +
2865 IPPROTO_UDP));
2866 m->m_pkthdr.csum_flags =
2867 (CSUM_UDPIPV6|CSUM_ZERO_INVERT);
2868 m->m_pkthdr.csum_data = offsetof(struct udphdr,
2869 uh_sum);
2870 }
2871 m->m_pkthdr.pkt_proto = IPPROTO_UDP;
2872 in6_delayed_cksum(m);
2873 bcopy(m->m_data, frame->data + frame_data_offset,
2874 m->m_len);
2875 }
2876 if (m != NULL) {
2877 m_freem(m);
2878 m = NULL;
2879 }
2880 frame_index++;
2881 udp_unlock(so, 1, 0);
2882 }
2883 lck_rw_done(udbinfo.ipi_lock);
2884 *used_frames_count = frame_index;
2885}
2886