1 | /* |
2 | * Copyright (c) 2003-2017 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /* |
29 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
30 | * All rights reserved. |
31 | * |
32 | * Redistribution and use in source and binary forms, with or without |
33 | * modification, are permitted provided that the following conditions |
34 | * are met: |
35 | * 1. Redistributions of source code must retain the above copyright |
36 | * notice, this list of conditions and the following disclaimer. |
37 | * 2. Redistributions in binary form must reproduce the above copyright |
38 | * notice, this list of conditions and the following disclaimer in the |
39 | * documentation and/or other materials provided with the distribution. |
40 | * 3. Neither the name of the project nor the names of its contributors |
41 | * may be used to endorse or promote products derived from this software |
42 | * without specific prior written permission. |
43 | * |
44 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
45 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
46 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
47 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
48 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
49 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
50 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
51 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
52 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
53 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
54 | * SUCH DAMAGE. |
55 | * |
56 | */ |
57 | |
58 | /* |
59 | * Copyright (c) 1982, 1986, 1991, 1993 |
60 | * The Regents of the University of California. All rights reserved. |
61 | * |
62 | * Redistribution and use in source and binary forms, with or without |
63 | * modification, are permitted provided that the following conditions |
64 | * are met: |
65 | * 1. Redistributions of source code must retain the above copyright |
66 | * notice, this list of conditions and the following disclaimer. |
67 | * 2. Redistributions in binary form must reproduce the above copyright |
68 | * notice, this list of conditions and the following disclaimer in the |
69 | * documentation and/or other materials provided with the distribution. |
70 | * 3. All advertising materials mentioning features or use of this software |
71 | * must display the following acknowledgement: |
72 | * This product includes software developed by the University of |
73 | * California, Berkeley and its contributors. |
74 | * 4. Neither the name of the University nor the names of its contributors |
75 | * may be used to endorse or promote products derived from this software |
76 | * without specific prior written permission. |
77 | * |
78 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
79 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
80 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
81 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
82 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
83 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
84 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
85 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
86 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
87 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
88 | * SUCH DAMAGE. |
89 | * |
90 | * @(#)in_pcb.c 8.2 (Berkeley) 1/4/94 |
91 | */ |
92 | |
93 | #include <sys/param.h> |
94 | #include <sys/systm.h> |
95 | #include <sys/malloc.h> |
96 | #include <sys/mbuf.h> |
97 | #include <sys/domain.h> |
98 | #include <sys/protosw.h> |
99 | #include <sys/socket.h> |
100 | #include <sys/socketvar.h> |
101 | #include <sys/sockio.h> |
102 | #include <sys/errno.h> |
103 | #include <sys/time.h> |
104 | #include <sys/proc.h> |
105 | #include <sys/kauth.h> |
106 | #include <sys/priv.h> |
107 | |
108 | #include <net/if.h> |
109 | #include <net/if_types.h> |
110 | #include <net/route.h> |
111 | #include <net/ntstat.h> |
112 | |
113 | #include <netinet/in.h> |
114 | #include <netinet/in_var.h> |
115 | #include <netinet/in_systm.h> |
116 | #include <netinet/ip6.h> |
117 | #include <netinet/ip_var.h> |
118 | #include <netinet6/ip6_var.h> |
119 | #include <netinet6/nd6.h> |
120 | #include <netinet/in_pcb.h> |
121 | #include <netinet6/in6_pcb.h> |
122 | #include <net/if_types.h> |
123 | #include <net/if_var.h> |
124 | |
125 | #include <kern/kern_types.h> |
126 | #include <kern/zalloc.h> |
127 | |
128 | #if IPSEC |
129 | #include <netinet6/ipsec.h> |
130 | #if INET6 |
131 | #include <netinet6/ipsec6.h> |
132 | #endif |
133 | #include <netinet6/ah.h> |
134 | #if INET6 |
135 | #include <netinet6/ah6.h> |
136 | #endif |
137 | #include <netkey/key.h> |
138 | #endif /* IPSEC */ |
139 | |
140 | #if NECP |
141 | #include <net/necp.h> |
142 | #endif /* NECP */ |
143 | |
144 | /* |
145 | * in6_pcblookup_local_and_cleanup does everything |
146 | * in6_pcblookup_local does but it checks for a socket |
147 | * that's going away. Since we know that the lock is |
148 | * held read+write when this function is called, we |
149 | * can safely dispose of this socket like the slow |
150 | * timer would usually do and return NULL. This is |
151 | * great for bind. |
152 | */ |
153 | static struct inpcb * |
154 | in6_pcblookup_local_and_cleanup(struct inpcbinfo *pcbinfo, |
155 | struct in6_addr *laddr, u_int lport_arg, int wild_okay) |
156 | { |
157 | struct inpcb *inp; |
158 | |
159 | /* Perform normal lookup */ |
160 | inp = in6_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay); |
161 | |
162 | /* Check if we found a match but it's waiting to be disposed */ |
163 | if (inp != NULL && inp->inp_wantcnt == WNT_STOPUSING) { |
164 | struct socket *so = inp->inp_socket; |
165 | |
166 | socket_lock(so, 0); |
167 | |
168 | if (so->so_usecount == 0) { |
169 | if (inp->inp_state != INPCB_STATE_DEAD) |
170 | in6_pcbdetach(inp); |
171 | in_pcbdispose(inp); /* will unlock & destroy */ |
172 | inp = NULL; |
173 | } else { |
174 | socket_unlock(so, 0); |
175 | } |
176 | } |
177 | |
178 | return (inp); |
179 | } |
180 | |
181 | /* |
182 | * Bind an INPCB to an address and/or port. This routine should not alter |
183 | * the caller-supplied local address "nam". |
184 | */ |
185 | int |
186 | in6_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct proc *p) |
187 | { |
188 | struct socket *so = inp->inp_socket; |
189 | struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; |
190 | u_short lport = 0; |
191 | int wild = 0, reuseport = (so->so_options & SO_REUSEPORT); |
192 | struct ifnet *outif = NULL; |
193 | struct sockaddr_in6 sin6; |
194 | #if !CONFIG_EMBEDDED |
195 | int error; |
196 | kauth_cred_t cred; |
197 | #endif /* !CONFIG_EMBEDDED */ |
198 | |
199 | if (!in6_ifaddrs) /* XXX broken! */ |
200 | return (EADDRNOTAVAIL); |
201 | if (!(so->so_options & (SO_REUSEADDR|SO_REUSEPORT))) |
202 | wild = 1; |
203 | |
204 | socket_unlock(so, 0); /* keep reference */ |
205 | lck_rw_lock_exclusive(pcbinfo->ipi_lock); |
206 | if (inp->inp_lport || !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) { |
207 | /* another thread completed the bind */ |
208 | lck_rw_done(pcbinfo->ipi_lock); |
209 | socket_lock(so, 0); |
210 | return (EINVAL); |
211 | } |
212 | |
213 | bzero(&sin6, sizeof (sin6)); |
214 | if (nam != NULL) { |
215 | if (nam->sa_len != sizeof (struct sockaddr_in6)) { |
216 | lck_rw_done(pcbinfo->ipi_lock); |
217 | socket_lock(so, 0); |
218 | return (EINVAL); |
219 | } |
220 | /* |
221 | * family check. |
222 | */ |
223 | if (nam->sa_family != AF_INET6) { |
224 | lck_rw_done(pcbinfo->ipi_lock); |
225 | socket_lock(so, 0); |
226 | return (EAFNOSUPPORT); |
227 | } |
228 | lport = SIN6(nam)->sin6_port; |
229 | |
230 | *(&sin6) = *SIN6(nam); |
231 | |
232 | /* KAME hack: embed scopeid */ |
233 | if (in6_embedscope(&sin6.sin6_addr, &sin6, inp, NULL, |
234 | NULL) != 0) { |
235 | lck_rw_done(pcbinfo->ipi_lock); |
236 | socket_lock(so, 0); |
237 | return (EINVAL); |
238 | } |
239 | |
240 | /* Sanitize local copy for address searches */ |
241 | sin6.sin6_flowinfo = 0; |
242 | sin6.sin6_scope_id = 0; |
243 | sin6.sin6_port = 0; |
244 | |
245 | if (IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) { |
246 | /* |
247 | * Treat SO_REUSEADDR as SO_REUSEPORT for multicast; |
248 | * allow compepte duplication of binding if |
249 | * SO_REUSEPORT is set, or if SO_REUSEADDR is set |
250 | * and a multicast address is bound on both |
251 | * new and duplicated sockets. |
252 | */ |
253 | if (so->so_options & SO_REUSEADDR) |
254 | reuseport = SO_REUSEADDR|SO_REUSEPORT; |
255 | } else if (!IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) { |
256 | struct ifaddr *ifa; |
257 | |
258 | ifa = ifa_ifwithaddr(SA(&sin6)); |
259 | if (ifa == NULL) { |
260 | lck_rw_done(pcbinfo->ipi_lock); |
261 | socket_lock(so, 0); |
262 | return (EADDRNOTAVAIL); |
263 | } else { |
264 | /* |
265 | * XXX: bind to an anycast address might |
266 | * accidentally cause sending a packet with |
267 | * anycast source address. We should allow |
268 | * to bind to a deprecated address, since |
269 | * the application dare to use it. |
270 | */ |
271 | IFA_LOCK_SPIN(ifa); |
272 | if (((struct in6_ifaddr *)ifa)->ia6_flags & |
273 | (IN6_IFF_ANYCAST | IN6_IFF_NOTREADY| |
274 | IN6_IFF_DETACHED | IN6_IFF_CLAT46)) { |
275 | IFA_UNLOCK(ifa); |
276 | IFA_REMREF(ifa); |
277 | lck_rw_done(pcbinfo->ipi_lock); |
278 | socket_lock(so, 0); |
279 | return (EADDRNOTAVAIL); |
280 | } |
281 | /* |
282 | * Opportunistically determine the outbound |
283 | * interface that may be used; this may not |
284 | * hold true if we end up using a route |
285 | * going over a different interface, e.g. |
286 | * when sending to a local address. This |
287 | * will get updated again after sending. |
288 | */ |
289 | outif = ifa->ifa_ifp; |
290 | IFA_UNLOCK(ifa); |
291 | IFA_REMREF(ifa); |
292 | } |
293 | } |
294 | if (lport != 0) { |
295 | struct inpcb *t; |
296 | uid_t u; |
297 | |
298 | #if !CONFIG_EMBEDDED |
299 | if (ntohs(lport) < IPV6PORT_RESERVED && |
300 | !IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) { |
301 | cred = kauth_cred_proc_ref(p); |
302 | error = priv_check_cred(cred, |
303 | PRIV_NETINET_RESERVEDPORT, 0); |
304 | kauth_cred_unref(&cred); |
305 | if (error != 0) { |
306 | lck_rw_done(pcbinfo->ipi_lock); |
307 | socket_lock(so, 0); |
308 | return (EACCES); |
309 | } |
310 | } |
311 | #endif /* !CONFIG_EMBEDDED */ |
312 | if (!IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr) && |
313 | (u = kauth_cred_getuid(so->so_cred)) != 0) { |
314 | t = in6_pcblookup_local_and_cleanup(pcbinfo, |
315 | &sin6.sin6_addr, lport, |
316 | INPLOOKUP_WILDCARD); |
317 | if (t != NULL && (!IN6_IS_ADDR_UNSPECIFIED( |
318 | &sin6.sin6_addr) || |
319 | !IN6_IS_ADDR_UNSPECIFIED(&t->in6p_laddr) || |
320 | !(t->inp_socket->so_options & |
321 | SO_REUSEPORT)) && (u != kauth_cred_getuid( |
322 | t->inp_socket->so_cred)) && |
323 | !(t->inp_socket->so_flags & |
324 | SOF_REUSESHAREUID)) { |
325 | lck_rw_done(pcbinfo->ipi_lock); |
326 | socket_lock(so, 0); |
327 | return (EADDRINUSE); |
328 | } |
329 | if (!(inp->inp_flags & IN6P_IPV6_V6ONLY) && |
330 | IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) { |
331 | struct sockaddr_in sin; |
332 | |
333 | in6_sin6_2_sin(&sin, &sin6); |
334 | t = in_pcblookup_local_and_cleanup( |
335 | pcbinfo, sin.sin_addr, lport, |
336 | INPLOOKUP_WILDCARD); |
337 | if (t != NULL && |
338 | !(t->inp_socket->so_options & |
339 | SO_REUSEPORT) && |
340 | (kauth_cred_getuid(so->so_cred) != |
341 | kauth_cred_getuid(t->inp_socket-> |
342 | so_cred)) && (t->inp_laddr.s_addr != |
343 | INADDR_ANY || SOCK_DOM(so) == |
344 | SOCK_DOM(t->inp_socket))) { |
345 | lck_rw_done(pcbinfo->ipi_lock); |
346 | socket_lock(so, 0); |
347 | return (EADDRINUSE); |
348 | } |
349 | } |
350 | } |
351 | t = in6_pcblookup_local_and_cleanup(pcbinfo, |
352 | &sin6.sin6_addr, lport, wild); |
353 | if (t != NULL && |
354 | (reuseport & t->inp_socket->so_options) == 0) { |
355 | lck_rw_done(pcbinfo->ipi_lock); |
356 | socket_lock(so, 0); |
357 | return (EADDRINUSE); |
358 | } |
359 | if (!(inp->inp_flags & IN6P_IPV6_V6ONLY) && |
360 | IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) { |
361 | struct sockaddr_in sin; |
362 | |
363 | in6_sin6_2_sin(&sin, &sin6); |
364 | t = in_pcblookup_local_and_cleanup(pcbinfo, |
365 | sin.sin_addr, lport, wild); |
366 | if (t != NULL && (reuseport & |
367 | t->inp_socket->so_options) == 0 && |
368 | (t->inp_laddr.s_addr != INADDR_ANY || |
369 | SOCK_DOM(so) == SOCK_DOM(t->inp_socket))) { |
370 | lck_rw_done(pcbinfo->ipi_lock); |
371 | socket_lock(so, 0); |
372 | return (EADDRINUSE); |
373 | } |
374 | } |
375 | } |
376 | } |
377 | |
378 | socket_lock(so, 0); |
379 | /* |
380 | * We unlocked socket's protocol lock for a long time. |
381 | * The socket might have been dropped/defuncted. |
382 | * Checking if world has changed since. |
383 | */ |
384 | if (inp->inp_state == INPCB_STATE_DEAD) { |
385 | lck_rw_done(pcbinfo->ipi_lock); |
386 | return (ECONNABORTED); |
387 | } |
388 | |
389 | /* check if the socket got bound when the lock was released */ |
390 | if (inp->inp_lport || !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) { |
391 | lck_rw_done(pcbinfo->ipi_lock); |
392 | return (EINVAL); |
393 | } |
394 | |
395 | if (!IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) { |
396 | inp->in6p_laddr = sin6.sin6_addr; |
397 | inp->in6p_last_outifp = outif; |
398 | } |
399 | |
400 | if (lport == 0) { |
401 | int e; |
402 | if ((e = in6_pcbsetport(&inp->in6p_laddr, inp, p, 1)) != 0) { |
403 | /* Undo any address bind from above. */ |
404 | inp->in6p_laddr = in6addr_any; |
405 | inp->in6p_last_outifp = NULL; |
406 | lck_rw_done(pcbinfo->ipi_lock); |
407 | return (e); |
408 | } |
409 | } else { |
410 | inp->inp_lport = lport; |
411 | if (in_pcbinshash(inp, 1) != 0) { |
412 | inp->in6p_laddr = in6addr_any; |
413 | inp->inp_lport = 0; |
414 | inp->in6p_last_outifp = NULL; |
415 | lck_rw_done(pcbinfo->ipi_lock); |
416 | return (EAGAIN); |
417 | } |
418 | } |
419 | lck_rw_done(pcbinfo->ipi_lock); |
420 | sflt_notify(so, sock_evt_bound, NULL); |
421 | return (0); |
422 | } |
423 | |
424 | /* |
425 | * Transform old in6_pcbconnect() into an inner subroutine for new |
426 | * in6_pcbconnect(); do some validity-checking on the remote address |
427 | * (in "nam") and then determine local host address (i.e., which |
428 | * interface) to use to access that remote host. |
429 | * |
430 | * This routine may alter the caller-supplied remote address "nam". |
431 | * |
432 | * This routine might return an ifp with a reference held if the caller |
433 | * provides a non-NULL outif, even in the error case. The caller is |
434 | * responsible for releasing its reference. |
435 | */ |
436 | int |
437 | in6_pcbladdr(struct inpcb *inp, struct sockaddr *nam, |
438 | struct in6_addr *plocal_addr6, struct ifnet **outif) |
439 | { |
440 | struct in6_addr *addr6 = NULL; |
441 | struct in6_addr src_storage; |
442 | int error = 0; |
443 | unsigned int ifscope; |
444 | |
445 | if (outif != NULL) |
446 | *outif = NULL; |
447 | if (nam->sa_len != sizeof (struct sockaddr_in6)) |
448 | return (EINVAL); |
449 | if (SIN6(nam)->sin6_family != AF_INET6) |
450 | return (EAFNOSUPPORT); |
451 | if (SIN6(nam)->sin6_port == 0) |
452 | return (EADDRNOTAVAIL); |
453 | |
454 | /* KAME hack: embed scopeid */ |
455 | if (in6_embedscope(&SIN6(nam)->sin6_addr, SIN6(nam), inp, NULL, NULL) != 0) |
456 | return (EINVAL); |
457 | |
458 | if (in6_ifaddrs) { |
459 | /* |
460 | * If the destination address is UNSPECIFIED addr, |
461 | * use the loopback addr, e.g ::1. |
462 | */ |
463 | if (IN6_IS_ADDR_UNSPECIFIED(&SIN6(nam)->sin6_addr)) |
464 | SIN6(nam)->sin6_addr = in6addr_loopback; |
465 | } |
466 | |
467 | ifscope = (inp->inp_flags & INP_BOUND_IF) ? |
468 | inp->inp_boundifp->if_index : IFSCOPE_NONE; |
469 | |
470 | /* |
471 | * XXX: in6_selectsrc might replace the bound local address |
472 | * with the address specified by setsockopt(IPV6_PKTINFO). |
473 | * Is it the intended behavior? |
474 | * |
475 | * in6_selectsrc() might return outif with its reference held |
476 | * even in the error case; caller always needs to release it |
477 | * if non-NULL. |
478 | */ |
479 | addr6 = in6_selectsrc(SIN6(nam), inp->in6p_outputopts, inp, |
480 | &inp->in6p_route, outif, &src_storage, ifscope, &error); |
481 | |
482 | if (outif != NULL) { |
483 | struct rtentry *rt = inp->in6p_route.ro_rt; |
484 | /* |
485 | * If in6_selectsrc() returns a route, it should be one |
486 | * which points to the same ifp as outif. Just in case |
487 | * it isn't, use the one from the route for consistency. |
488 | * Otherwise if there is no route, leave outif alone as |
489 | * it could still be useful to the caller. |
490 | */ |
491 | if (rt != NULL && rt->rt_ifp != *outif) { |
492 | ifnet_reference(rt->rt_ifp); /* for caller */ |
493 | if (*outif != NULL) |
494 | ifnet_release(*outif); |
495 | *outif = rt->rt_ifp; |
496 | } |
497 | } |
498 | |
499 | if (addr6 == NULL) { |
500 | if (outif != NULL && (*outif) != NULL && |
501 | inp_restricted_send(inp, *outif)) { |
502 | soevent(inp->inp_socket, |
503 | (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED)); |
504 | error = EHOSTUNREACH; |
505 | } |
506 | if (error == 0) |
507 | error = EADDRNOTAVAIL; |
508 | return (error); |
509 | } |
510 | |
511 | *plocal_addr6 = *addr6; |
512 | /* |
513 | * Don't do pcblookup call here; return interface in |
514 | * plocal_addr6 and exit to caller, that will do the lookup. |
515 | */ |
516 | return (0); |
517 | } |
518 | |
519 | /* |
520 | * Outer subroutine: |
521 | * Connect from a socket to a specified address. |
522 | * Both address and port must be specified in argument sin. |
523 | * If don't have a local address for this socket yet, |
524 | * then pick one. |
525 | */ |
526 | int |
527 | in6_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct proc *p) |
528 | { |
529 | struct in6_addr addr6; |
530 | struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)(void *)nam; |
531 | struct inpcb *pcb; |
532 | int error = 0; |
533 | struct ifnet *outif = NULL; |
534 | struct socket *so = inp->inp_socket; |
535 | |
536 | #if CONTENT_FILTER |
537 | if (so) |
538 | so->so_state_change_cnt++; |
539 | #endif |
540 | |
541 | if (so->so_proto->pr_protocol == IPPROTO_UDP && |
542 | sin6->sin6_port == htons(53) && !(so->so_flags1 & SOF1_DNS_COUNTED)) { |
543 | so->so_flags1 |= SOF1_DNS_COUNTED; |
544 | INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_dns); |
545 | } |
546 | |
547 | /* |
548 | * Call inner routine, to assign local interface address. |
549 | * in6_pcbladdr() may automatically fill in sin6_scope_id. |
550 | * |
551 | * in6_pcbladdr() might return an ifp with its reference held |
552 | * even in the error case, so make sure that it's released |
553 | * whenever it's non-NULL. |
554 | */ |
555 | if ((error = in6_pcbladdr(inp, nam, &addr6, &outif)) != 0) { |
556 | if (outif != NULL && inp_restricted_send(inp, outif)) |
557 | soevent(so, |
558 | (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED)); |
559 | goto done; |
560 | } |
561 | socket_unlock(so, 0); |
562 | pcb = in6_pcblookup_hash(inp->inp_pcbinfo, &sin6->sin6_addr, |
563 | sin6->sin6_port, IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) ? |
564 | &addr6 : &inp->in6p_laddr, inp->inp_lport, 0, NULL); |
565 | socket_lock(so, 0); |
566 | if (pcb != NULL) { |
567 | in_pcb_checkstate(pcb, WNT_RELEASE, pcb == inp ? 1 : 0); |
568 | error = EADDRINUSE; |
569 | goto done; |
570 | } |
571 | if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) { |
572 | if (inp->inp_lport == 0) { |
573 | error = in6_pcbbind(inp, NULL, p); |
574 | if (error) |
575 | goto done; |
576 | } |
577 | inp->in6p_laddr = addr6; |
578 | inp->in6p_last_outifp = outif; /* no reference needed */ |
579 | inp->in6p_flags |= INP_IN6ADDR_ANY; |
580 | } |
581 | if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->ipi_lock)) { |
582 | /* lock inversion issue, mostly with udp multicast packets */ |
583 | socket_unlock(so, 0); |
584 | lck_rw_lock_exclusive(inp->inp_pcbinfo->ipi_lock); |
585 | socket_lock(so, 0); |
586 | } |
587 | inp->in6p_faddr = sin6->sin6_addr; |
588 | inp->inp_fport = sin6->sin6_port; |
589 | if (nstat_collect && SOCK_PROTO(so) == IPPROTO_UDP) |
590 | nstat_pcb_invalidate_cache(inp); |
591 | in_pcbrehash(inp); |
592 | lck_rw_done(inp->inp_pcbinfo->ipi_lock); |
593 | |
594 | done: |
595 | if (outif != NULL) |
596 | ifnet_release(outif); |
597 | |
598 | return (error); |
599 | } |
600 | |
601 | void |
602 | in6_pcbdisconnect(struct inpcb *inp) |
603 | { |
604 | struct socket *so = inp->inp_socket; |
605 | |
606 | #if CONTENT_FILTER |
607 | if (so) |
608 | so->so_state_change_cnt++; |
609 | #endif |
610 | |
611 | if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->ipi_lock)) { |
612 | /* lock inversion issue, mostly with udp multicast packets */ |
613 | socket_unlock(so, 0); |
614 | lck_rw_lock_exclusive(inp->inp_pcbinfo->ipi_lock); |
615 | socket_lock(so, 0); |
616 | } |
617 | if (nstat_collect && SOCK_PROTO(so) == IPPROTO_UDP) |
618 | nstat_pcb_cache(inp); |
619 | bzero((caddr_t)&inp->in6p_faddr, sizeof (inp->in6p_faddr)); |
620 | inp->inp_fport = 0; |
621 | /* clear flowinfo - RFC 6437 */ |
622 | inp->inp_flow &= ~IPV6_FLOWLABEL_MASK; |
623 | in_pcbrehash(inp); |
624 | lck_rw_done(inp->inp_pcbinfo->ipi_lock); |
625 | /* |
626 | * A multipath subflow socket would have its SS_NOFDREF set by default, |
627 | * so check for SOF_MP_SUBFLOW socket flag before detaching the PCB; |
628 | * when the socket is closed for real, SOF_MP_SUBFLOW would be cleared. |
629 | */ |
630 | if (!(so->so_flags & SOF_MP_SUBFLOW) && (so->so_state & SS_NOFDREF)) |
631 | in6_pcbdetach(inp); |
632 | } |
633 | |
634 | void |
635 | in6_pcbdetach(struct inpcb *inp) |
636 | { |
637 | struct socket *so = inp->inp_socket; |
638 | |
639 | if (so->so_pcb == NULL) { |
640 | /* PCB has been disposed */ |
641 | panic("%s: inp=%p so=%p proto=%d so_pcb is null!\n" , __func__, |
642 | inp, so, SOCK_PROTO(so)); |
643 | /* NOTREACHED */ |
644 | } |
645 | |
646 | #if IPSEC |
647 | if (inp->in6p_sp != NULL) { |
648 | (void) ipsec6_delete_pcbpolicy(inp); |
649 | } |
650 | #endif /* IPSEC */ |
651 | |
652 | if (inp->inp_stat != NULL && SOCK_PROTO(so) == IPPROTO_UDP) { |
653 | if (inp->inp_stat->rxpackets == 0 && inp->inp_stat->txpackets == 0) { |
654 | INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet6_dgram_no_data); |
655 | } |
656 | } |
657 | |
658 | /* |
659 | * Let NetworkStatistics know this PCB is going away |
660 | * before we detach it. |
661 | */ |
662 | if (nstat_collect && |
663 | (SOCK_PROTO(so) == IPPROTO_TCP || SOCK_PROTO(so) == IPPROTO_UDP)) |
664 | nstat_pcb_detach(inp); |
665 | /* mark socket state as dead */ |
666 | if (in_pcb_checkstate(inp, WNT_STOPUSING, 1) != WNT_STOPUSING) { |
667 | panic("%s: so=%p proto=%d couldn't set to STOPUSING\n" , |
668 | __func__, so, SOCK_PROTO(so)); |
669 | /* NOTREACHED */ |
670 | } |
671 | |
672 | if (!(so->so_flags & SOF_PCBCLEARING)) { |
673 | struct ip_moptions *imo; |
674 | struct ip6_moptions *im6o; |
675 | |
676 | inp->inp_vflag = 0; |
677 | if (inp->in6p_options != NULL) { |
678 | m_freem(inp->in6p_options); |
679 | inp->in6p_options = NULL; |
680 | } |
681 | ip6_freepcbopts(inp->in6p_outputopts); |
682 | ROUTE_RELEASE(&inp->in6p_route); |
683 | /* free IPv4 related resources in case of mapped addr */ |
684 | if (inp->inp_options != NULL) { |
685 | (void) m_free(inp->inp_options); |
686 | inp->inp_options = NULL; |
687 | } |
688 | im6o = inp->in6p_moptions; |
689 | inp->in6p_moptions = NULL; |
690 | |
691 | imo = inp->inp_moptions; |
692 | inp->inp_moptions = NULL; |
693 | |
694 | sofreelastref(so, 0); |
695 | inp->inp_state = INPCB_STATE_DEAD; |
696 | /* makes sure we're not called twice from so_close */ |
697 | so->so_flags |= SOF_PCBCLEARING; |
698 | |
699 | inpcb_gc_sched(inp->inp_pcbinfo, INPCB_TIMER_FAST); |
700 | |
701 | /* |
702 | * See inp_join_group() for why we need to unlock |
703 | */ |
704 | if (im6o != NULL || imo != NULL) { |
705 | socket_unlock(so, 0); |
706 | if (im6o != NULL) |
707 | IM6O_REMREF(im6o); |
708 | if (imo != NULL) |
709 | IMO_REMREF(imo); |
710 | socket_lock(so, 0); |
711 | } |
712 | } |
713 | } |
714 | |
715 | struct sockaddr * |
716 | in6_sockaddr(in_port_t port, struct in6_addr *addr_p) |
717 | { |
718 | struct sockaddr_in6 *sin6; |
719 | |
720 | MALLOC(sin6, struct sockaddr_in6 *, sizeof (*sin6), M_SONAME, M_WAITOK); |
721 | if (sin6 == NULL) |
722 | return (NULL); |
723 | bzero(sin6, sizeof (*sin6)); |
724 | sin6->sin6_family = AF_INET6; |
725 | sin6->sin6_len = sizeof (*sin6); |
726 | sin6->sin6_port = port; |
727 | sin6->sin6_addr = *addr_p; |
728 | |
729 | /* would be good to use sa6_recoverscope(), except for locking */ |
730 | if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) |
731 | sin6->sin6_scope_id = ntohs(sin6->sin6_addr.s6_addr16[1]); |
732 | else |
733 | sin6->sin6_scope_id = 0; /* XXX */ |
734 | if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) |
735 | sin6->sin6_addr.s6_addr16[1] = 0; |
736 | |
737 | return ((struct sockaddr *)sin6); |
738 | } |
739 | |
740 | void |
741 | in6_sockaddr_s(in_port_t port, struct in6_addr *addr_p, |
742 | struct sockaddr_in6 *sin6) |
743 | { |
744 | bzero(sin6, sizeof (*sin6)); |
745 | sin6->sin6_family = AF_INET6; |
746 | sin6->sin6_len = sizeof (*sin6); |
747 | sin6->sin6_port = port; |
748 | sin6->sin6_addr = *addr_p; |
749 | |
750 | /* would be good to use sa6_recoverscope(), except for locking */ |
751 | if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) |
752 | sin6->sin6_scope_id = ntohs(sin6->sin6_addr.s6_addr16[1]); |
753 | else |
754 | sin6->sin6_scope_id = 0; /* XXX */ |
755 | if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) |
756 | sin6->sin6_addr.s6_addr16[1] = 0; |
757 | } |
758 | |
759 | /* |
760 | * The calling convention of in6_getsockaddr() and in6_getpeeraddr() was |
761 | * modified to match the pru_sockaddr() and pru_peeraddr() entry points |
762 | * in struct pr_usrreqs, so that protocols can just reference then directly |
763 | * without the need for a wrapper function. |
764 | */ |
765 | int |
766 | in6_getsockaddr(struct socket *so, struct sockaddr **nam) |
767 | { |
768 | struct inpcb *inp; |
769 | struct in6_addr addr; |
770 | in_port_t port; |
771 | |
772 | if ((inp = sotoinpcb(so)) == NULL) |
773 | return (EINVAL); |
774 | |
775 | port = inp->inp_lport; |
776 | addr = inp->in6p_laddr; |
777 | |
778 | *nam = in6_sockaddr(port, &addr); |
779 | if (*nam == NULL) |
780 | return (ENOBUFS); |
781 | return (0); |
782 | } |
783 | |
784 | int |
785 | in6_getsockaddr_s(struct socket *so, struct sockaddr_in6 *ss) |
786 | { |
787 | struct inpcb *inp; |
788 | struct in6_addr addr; |
789 | in_port_t port; |
790 | |
791 | VERIFY(ss != NULL); |
792 | bzero(ss, sizeof (*ss)); |
793 | |
794 | if ((inp = sotoinpcb(so)) == NULL) |
795 | return (EINVAL); |
796 | |
797 | port = inp->inp_lport; |
798 | addr = inp->in6p_laddr; |
799 | |
800 | in6_sockaddr_s(port, &addr, ss); |
801 | return (0); |
802 | } |
803 | |
804 | int |
805 | in6_getpeeraddr(struct socket *so, struct sockaddr **nam) |
806 | { |
807 | struct inpcb *inp; |
808 | struct in6_addr addr; |
809 | in_port_t port; |
810 | |
811 | if ((inp = sotoinpcb(so)) == NULL) |
812 | return (EINVAL); |
813 | |
814 | port = inp->inp_fport; |
815 | addr = inp->in6p_faddr; |
816 | |
817 | *nam = in6_sockaddr(port, &addr); |
818 | if (*nam == NULL) |
819 | return (ENOBUFS); |
820 | return (0); |
821 | } |
822 | |
823 | int |
824 | in6_mapped_sockaddr(struct socket *so, struct sockaddr **nam) |
825 | { |
826 | struct inpcb *inp = sotoinpcb(so); |
827 | int error; |
828 | |
829 | if (inp == NULL) |
830 | return (EINVAL); |
831 | if (inp->inp_vflag & INP_IPV4) { |
832 | error = in_getsockaddr(so, nam); |
833 | if (error == 0) |
834 | error = in6_sin_2_v4mapsin6_in_sock(nam); |
835 | } else { |
836 | /* scope issues will be handled in in6_getsockaddr(). */ |
837 | error = in6_getsockaddr(so, nam); |
838 | } |
839 | return (error); |
840 | } |
841 | |
842 | int |
843 | in6_mapped_peeraddr(struct socket *so, struct sockaddr **nam) |
844 | { |
845 | struct inpcb *inp = sotoinpcb(so); |
846 | int error; |
847 | |
848 | if (inp == NULL) |
849 | return (EINVAL); |
850 | if (inp->inp_vflag & INP_IPV4) { |
851 | error = in_getpeeraddr(so, nam); |
852 | if (error == 0) |
853 | error = in6_sin_2_v4mapsin6_in_sock(nam); |
854 | } else { |
855 | /* scope issues will be handled in in6_getpeeraddr(). */ |
856 | error = in6_getpeeraddr(so, nam); |
857 | } |
858 | return (error); |
859 | } |
860 | |
861 | /* |
862 | * Pass some notification to all connections of a protocol |
863 | * associated with address dst. The local address and/or port numbers |
864 | * may be specified to limit the search. The "usual action" will be |
865 | * taken, depending on the ctlinput cmd. The caller must filter any |
866 | * cmds that are uninteresting (e.g., no error in the map). |
867 | * Call the protocol specific routine (if any) to report |
868 | * any errors for each matching socket. |
869 | */ |
870 | void |
871 | in6_pcbnotify(struct inpcbinfo *pcbinfo, struct sockaddr *dst, u_int fport_arg, |
872 | const struct sockaddr *src, u_int lport_arg, int cmd, void *cmdarg, |
873 | void (*notify)(struct inpcb *, int)) |
874 | { |
875 | struct inpcbhead *head = pcbinfo->ipi_listhead; |
876 | struct inpcb *inp, *ninp; |
877 | struct sockaddr_in6 sa6_src, *sa6_dst; |
878 | u_short fport = fport_arg, lport = lport_arg; |
879 | u_int32_t flowinfo; |
880 | int errno; |
881 | |
882 | if ((unsigned)cmd >= PRC_NCMDS || dst->sa_family != AF_INET6) |
883 | return; |
884 | |
885 | sa6_dst = (struct sockaddr_in6 *)(void *)dst; |
886 | if (IN6_IS_ADDR_UNSPECIFIED(&sa6_dst->sin6_addr)) |
887 | return; |
888 | |
889 | /* |
890 | * note that src can be NULL when we get notify by local fragmentation. |
891 | */ |
892 | sa6_src = (src == NULL) ? |
893 | sa6_any : *(struct sockaddr_in6 *)(uintptr_t)(size_t)src; |
894 | flowinfo = sa6_src.sin6_flowinfo; |
895 | |
896 | /* |
897 | * Redirects go to all references to the destination, |
898 | * and use in6_rtchange to invalidate the route cache. |
899 | * Dead host indications: also use in6_rtchange to invalidate |
900 | * the cache, and deliver the error to all the sockets. |
901 | * Otherwise, if we have knowledge of the local port and address, |
902 | * deliver only to that socket. |
903 | */ |
904 | if (PRC_IS_REDIRECT(cmd) || cmd == PRC_HOSTDEAD) { |
905 | fport = 0; |
906 | lport = 0; |
907 | bzero((caddr_t)&sa6_src.sin6_addr, sizeof (sa6_src.sin6_addr)); |
908 | |
909 | if (cmd != PRC_HOSTDEAD) |
910 | notify = in6_rtchange; |
911 | } |
912 | errno = inet6ctlerrmap[cmd]; |
913 | lck_rw_lock_shared(pcbinfo->ipi_lock); |
914 | for (inp = LIST_FIRST(head); inp != NULL; inp = ninp) { |
915 | ninp = LIST_NEXT(inp, inp_list); |
916 | |
917 | if (!(inp->inp_vflag & INP_IPV6)) |
918 | continue; |
919 | |
920 | /* |
921 | * If the error designates a new path MTU for a destination |
922 | * and the application (associated with this socket) wanted to |
923 | * know the value, notify. Note that we notify for all |
924 | * disconnected sockets if the corresponding application |
925 | * wanted. This is because some UDP applications keep sending |
926 | * sockets disconnected. |
927 | * XXX: should we avoid to notify the value to TCP sockets? |
928 | */ |
929 | if (cmd == PRC_MSGSIZE) |
930 | ip6_notify_pmtu(inp, (struct sockaddr_in6 *)(void *)dst, |
931 | (u_int32_t *)cmdarg); |
932 | |
933 | /* |
934 | * Detect if we should notify the error. If no source and |
935 | * destination ports are specifed, but non-zero flowinfo and |
936 | * local address match, notify the error. This is the case |
937 | * when the error is delivered with an encrypted buffer |
938 | * by ESP. Otherwise, just compare addresses and ports |
939 | * as usual. |
940 | */ |
941 | if (lport == 0 && fport == 0 && flowinfo && |
942 | inp->inp_socket != NULL && |
943 | flowinfo == (inp->inp_flow & IPV6_FLOWLABEL_MASK) && |
944 | IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, &sa6_src.sin6_addr)) |
945 | goto do_notify; |
946 | else if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, |
947 | &sa6_dst->sin6_addr) || inp->inp_socket == NULL || |
948 | (lport && inp->inp_lport != lport) || |
949 | (!IN6_IS_ADDR_UNSPECIFIED(&sa6_src.sin6_addr) && |
950 | !IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, |
951 | &sa6_src.sin6_addr)) || (fport && inp->inp_fport != fport)) |
952 | continue; |
953 | |
954 | do_notify: |
955 | if (notify) { |
956 | if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == |
957 | WNT_STOPUSING) |
958 | continue; |
959 | socket_lock(inp->inp_socket, 1); |
960 | (*notify)(inp, errno); |
961 | (void) in_pcb_checkstate(inp, WNT_RELEASE, 1); |
962 | socket_unlock(inp->inp_socket, 1); |
963 | } |
964 | } |
965 | lck_rw_done(pcbinfo->ipi_lock); |
966 | } |
967 | |
968 | /* |
969 | * Lookup a PCB based on the local address and port. |
970 | */ |
971 | struct inpcb * |
972 | in6_pcblookup_local(struct inpcbinfo *pcbinfo, struct in6_addr *laddr, |
973 | u_int lport_arg, int wild_okay) |
974 | { |
975 | struct inpcb *inp; |
976 | int matchwild = 3, wildcard; |
977 | u_short lport = lport_arg; |
978 | struct inpcbporthead *porthash; |
979 | struct inpcb *match = NULL; |
980 | struct inpcbport *phd; |
981 | |
982 | if (!wild_okay) { |
983 | struct inpcbhead *head; |
984 | /* |
985 | * Look for an unconnected (wildcard foreign addr) PCB that |
986 | * matches the local address and port we're looking for. |
987 | */ |
988 | head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0, |
989 | pcbinfo->ipi_hashmask)]; |
990 | LIST_FOREACH(inp, head, inp_hash) { |
991 | if (!(inp->inp_vflag & INP_IPV6)) |
992 | continue; |
993 | if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) && |
994 | IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) && |
995 | inp->inp_lport == lport) { |
996 | /* |
997 | * Found. |
998 | */ |
999 | return (inp); |
1000 | } |
1001 | } |
1002 | /* |
1003 | * Not found. |
1004 | */ |
1005 | return (NULL); |
1006 | } |
1007 | /* |
1008 | * Best fit PCB lookup. |
1009 | * |
1010 | * First see if this local port is in use by looking on the |
1011 | * port hash list. |
1012 | */ |
1013 | porthash = &pcbinfo->ipi_porthashbase[INP_PCBPORTHASH(lport, |
1014 | pcbinfo->ipi_porthashmask)]; |
1015 | LIST_FOREACH(phd, porthash, phd_hash) { |
1016 | if (phd->phd_port == lport) |
1017 | break; |
1018 | } |
1019 | if (phd != NULL) { |
1020 | /* |
1021 | * Port is in use by one or more PCBs. Look for best |
1022 | * fit. |
1023 | */ |
1024 | LIST_FOREACH(inp, &phd->phd_pcblist, inp_portlist) { |
1025 | wildcard = 0; |
1026 | if (!(inp->inp_vflag & INP_IPV6)) |
1027 | continue; |
1028 | if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) |
1029 | wildcard++; |
1030 | if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) { |
1031 | if (IN6_IS_ADDR_UNSPECIFIED(laddr)) |
1032 | wildcard++; |
1033 | else if (!IN6_ARE_ADDR_EQUAL( |
1034 | &inp->in6p_laddr, laddr)) |
1035 | continue; |
1036 | } else { |
1037 | if (!IN6_IS_ADDR_UNSPECIFIED(laddr)) |
1038 | wildcard++; |
1039 | } |
1040 | if (wildcard < matchwild) { |
1041 | match = inp; |
1042 | matchwild = wildcard; |
1043 | if (matchwild == 0) { |
1044 | break; |
1045 | } |
1046 | } |
1047 | } |
1048 | } |
1049 | return (match); |
1050 | } |
1051 | |
1052 | /* |
1053 | * Check for alternatives when higher level complains |
1054 | * about service problems. For now, invalidate cached |
1055 | * routing information. If the route was created dynamically |
1056 | * (by a redirect), time to try a default gateway again. |
1057 | */ |
1058 | void |
1059 | in6_losing(struct inpcb *in6p) |
1060 | { |
1061 | struct rtentry *rt; |
1062 | |
1063 | if ((rt = in6p->in6p_route.ro_rt) != NULL) { |
1064 | RT_LOCK(rt); |
1065 | if (rt->rt_flags & RTF_DYNAMIC) { |
1066 | /* |
1067 | * Prevent another thread from modifying rt_key, |
1068 | * rt_gateway via rt_setgate() after the rt_lock |
1069 | * is dropped by marking the route as defunct. |
1070 | */ |
1071 | rt->rt_flags |= RTF_CONDEMNED; |
1072 | RT_UNLOCK(rt); |
1073 | (void) rtrequest(RTM_DELETE, rt_key(rt), |
1074 | rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL); |
1075 | } else { |
1076 | RT_UNLOCK(rt); |
1077 | } |
1078 | /* |
1079 | * A new route can be allocated |
1080 | * the next time output is attempted. |
1081 | */ |
1082 | } |
1083 | ROUTE_RELEASE(&in6p->in6p_route); |
1084 | } |
1085 | |
1086 | /* |
1087 | * After a routing change, flush old routing |
1088 | * and allocate a (hopefully) better one. |
1089 | */ |
1090 | void |
1091 | in6_rtchange(struct inpcb *inp, int errno) |
1092 | { |
1093 | #pragma unused(errno) |
1094 | /* |
1095 | * A new route can be allocated the next time |
1096 | * output is attempted. |
1097 | */ |
1098 | ROUTE_RELEASE(&inp->in6p_route); |
1099 | } |
1100 | |
1101 | /* |
1102 | * Check if PCB exists hash list. Also returns uid and gid of socket |
1103 | */ |
1104 | int |
1105 | in6_pcblookup_hash_exists(struct inpcbinfo *pcbinfo, struct in6_addr *faddr, |
1106 | u_int fport_arg, struct in6_addr *laddr, u_int lport_arg, int wildcard, |
1107 | uid_t *uid, gid_t *gid, struct ifnet *ifp) |
1108 | { |
1109 | struct inpcbhead *head; |
1110 | struct inpcb *inp; |
1111 | u_short fport = fport_arg, lport = lport_arg; |
1112 | int found; |
1113 | |
1114 | *uid = UID_MAX; |
1115 | *gid = GID_MAX; |
1116 | |
1117 | lck_rw_lock_shared(pcbinfo->ipi_lock); |
1118 | |
1119 | /* |
1120 | * First look for an exact match. |
1121 | */ |
1122 | head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr->s6_addr32[3] /* XXX */, |
1123 | lport, fport, pcbinfo->ipi_hashmask)]; |
1124 | LIST_FOREACH(inp, head, inp_hash) { |
1125 | if (!(inp->inp_vflag & INP_IPV6)) |
1126 | continue; |
1127 | |
1128 | if (inp_restricted_recv(inp, ifp)) |
1129 | continue; |
1130 | |
1131 | if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) && |
1132 | IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) && |
1133 | inp->inp_fport == fport && |
1134 | inp->inp_lport == lport) { |
1135 | if ((found = (inp->inp_socket != NULL))) { |
1136 | /* |
1137 | * Found. Check if pcb is still valid |
1138 | */ |
1139 | *uid = kauth_cred_getuid( |
1140 | inp->inp_socket->so_cred); |
1141 | *gid = kauth_cred_getgid( |
1142 | inp->inp_socket->so_cred); |
1143 | } |
1144 | lck_rw_done(pcbinfo->ipi_lock); |
1145 | return (found); |
1146 | } |
1147 | } |
1148 | if (wildcard) { |
1149 | struct inpcb *local_wild = NULL; |
1150 | |
1151 | head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0, |
1152 | pcbinfo->ipi_hashmask)]; |
1153 | LIST_FOREACH(inp, head, inp_hash) { |
1154 | if (!(inp->inp_vflag & INP_IPV6)) |
1155 | continue; |
1156 | |
1157 | if (inp_restricted_recv(inp, ifp)) |
1158 | continue; |
1159 | |
1160 | if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) && |
1161 | inp->inp_lport == lport) { |
1162 | if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, |
1163 | laddr)) { |
1164 | found = (inp->inp_socket != NULL); |
1165 | if (found) { |
1166 | *uid = kauth_cred_getuid( |
1167 | inp->inp_socket->so_cred); |
1168 | *gid = kauth_cred_getgid( |
1169 | inp->inp_socket->so_cred); |
1170 | } |
1171 | lck_rw_done(pcbinfo->ipi_lock); |
1172 | return (found); |
1173 | } else if (IN6_IS_ADDR_UNSPECIFIED( |
1174 | &inp->in6p_laddr)) { |
1175 | local_wild = inp; |
1176 | } |
1177 | } |
1178 | } |
1179 | if (local_wild) { |
1180 | if ((found = (local_wild->inp_socket != NULL))) { |
1181 | *uid = kauth_cred_getuid( |
1182 | local_wild->inp_socket->so_cred); |
1183 | *gid = kauth_cred_getgid( |
1184 | local_wild->inp_socket->so_cred); |
1185 | } |
1186 | lck_rw_done(pcbinfo->ipi_lock); |
1187 | return (found); |
1188 | } |
1189 | } |
1190 | |
1191 | /* |
1192 | * Not found. |
1193 | */ |
1194 | lck_rw_done(pcbinfo->ipi_lock); |
1195 | return (0); |
1196 | } |
1197 | |
1198 | /* |
1199 | * Lookup PCB in hash list. |
1200 | */ |
1201 | struct inpcb * |
1202 | in6_pcblookup_hash(struct inpcbinfo *pcbinfo, struct in6_addr *faddr, |
1203 | u_int fport_arg, struct in6_addr *laddr, u_int lport_arg, int wildcard, |
1204 | struct ifnet *ifp) |
1205 | { |
1206 | struct inpcbhead *head; |
1207 | struct inpcb *inp; |
1208 | u_short fport = fport_arg, lport = lport_arg; |
1209 | |
1210 | lck_rw_lock_shared(pcbinfo->ipi_lock); |
1211 | |
1212 | /* |
1213 | * First look for an exact match. |
1214 | */ |
1215 | head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr->s6_addr32[3] /* XXX */, |
1216 | lport, fport, pcbinfo->ipi_hashmask)]; |
1217 | LIST_FOREACH(inp, head, inp_hash) { |
1218 | if (!(inp->inp_vflag & INP_IPV6)) |
1219 | continue; |
1220 | |
1221 | if (inp_restricted_recv(inp, ifp)) |
1222 | continue; |
1223 | |
1224 | if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) && |
1225 | IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) && |
1226 | inp->inp_fport == fport && |
1227 | inp->inp_lport == lport) { |
1228 | /* |
1229 | * Found. Check if pcb is still valid |
1230 | */ |
1231 | if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) != |
1232 | WNT_STOPUSING) { |
1233 | lck_rw_done(pcbinfo->ipi_lock); |
1234 | return (inp); |
1235 | } else { |
1236 | /* it's there but dead, say it isn't found */ |
1237 | lck_rw_done(pcbinfo->ipi_lock); |
1238 | return (NULL); |
1239 | } |
1240 | } |
1241 | } |
1242 | if (wildcard) { |
1243 | struct inpcb *local_wild = NULL; |
1244 | |
1245 | head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0, |
1246 | pcbinfo->ipi_hashmask)]; |
1247 | LIST_FOREACH(inp, head, inp_hash) { |
1248 | if (!(inp->inp_vflag & INP_IPV6)) |
1249 | continue; |
1250 | |
1251 | if (inp_restricted_recv(inp, ifp)) |
1252 | continue; |
1253 | |
1254 | if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) && |
1255 | inp->inp_lport == lport) { |
1256 | if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, |
1257 | laddr)) { |
1258 | if (in_pcb_checkstate(inp, WNT_ACQUIRE, |
1259 | 0) != WNT_STOPUSING) { |
1260 | lck_rw_done(pcbinfo->ipi_lock); |
1261 | return (inp); |
1262 | } else { |
1263 | /* dead; say it isn't found */ |
1264 | lck_rw_done(pcbinfo->ipi_lock); |
1265 | return (NULL); |
1266 | } |
1267 | } else if (IN6_IS_ADDR_UNSPECIFIED( |
1268 | &inp->in6p_laddr)) { |
1269 | local_wild = inp; |
1270 | } |
1271 | } |
1272 | } |
1273 | if (local_wild && in_pcb_checkstate(local_wild, |
1274 | WNT_ACQUIRE, 0) != WNT_STOPUSING) { |
1275 | lck_rw_done(pcbinfo->ipi_lock); |
1276 | return (local_wild); |
1277 | } else { |
1278 | lck_rw_done(pcbinfo->ipi_lock); |
1279 | return (NULL); |
1280 | } |
1281 | } |
1282 | |
1283 | /* |
1284 | * Not found. |
1285 | */ |
1286 | lck_rw_done(pcbinfo->ipi_lock); |
1287 | return (NULL); |
1288 | } |
1289 | |
1290 | void |
1291 | init_sin6(struct sockaddr_in6 *sin6, struct mbuf *m) |
1292 | { |
1293 | struct ip6_hdr *ip; |
1294 | |
1295 | ip = mtod(m, struct ip6_hdr *); |
1296 | bzero(sin6, sizeof (*sin6)); |
1297 | sin6->sin6_len = sizeof (*sin6); |
1298 | sin6->sin6_family = AF_INET6; |
1299 | sin6->sin6_addr = ip->ip6_src; |
1300 | if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) { |
1301 | sin6->sin6_addr.s6_addr16[1] = 0; |
1302 | if ((m->m_pkthdr.pkt_flags & (PKTF_LOOP|PKTF_IFAINFO)) == |
1303 | (PKTF_LOOP|PKTF_IFAINFO)) |
1304 | sin6->sin6_scope_id = m->m_pkthdr.src_ifindex; |
1305 | else if (m->m_pkthdr.rcvif != NULL) |
1306 | sin6->sin6_scope_id = m->m_pkthdr.rcvif->if_index; |
1307 | } |
1308 | } |
1309 | |
1310 | /* |
1311 | * The following routines implement this scheme: |
1312 | * |
1313 | * Callers of ip6_output() that intend to cache the route in the inpcb pass |
1314 | * a local copy of the struct route to ip6_output(). Using a local copy of |
1315 | * the cached route significantly simplifies things as IP no longer has to |
1316 | * worry about having exclusive access to the passed in struct route, since |
1317 | * it's defined in the caller's stack; in essence, this allows for a lock- |
1318 | * less operation when updating the struct route at the IP level and below, |
1319 | * whenever necessary. The scheme works as follows: |
1320 | * |
1321 | * Prior to dropping the socket's lock and calling ip6_output(), the caller |
1322 | * copies the struct route from the inpcb into its stack, and adds a reference |
1323 | * to the cached route entry, if there was any. The socket's lock is then |
1324 | * dropped and ip6_output() is called with a pointer to the copy of struct |
1325 | * route defined on the stack (not to the one in the inpcb.) |
1326 | * |
1327 | * Upon returning from ip6_output(), the caller then acquires the socket's |
1328 | * lock and synchronizes the cache; if there is no route cached in the inpcb, |
1329 | * it copies the local copy of struct route (which may or may not contain any |
1330 | * route) back into the cache; otherwise, if the inpcb has a route cached in |
1331 | * it, the one in the local copy will be freed, if there's any. Trashing the |
1332 | * cached route in the inpcb can be avoided because ip6_output() is single- |
1333 | * threaded per-PCB (i.e. multiple transmits on a PCB are always serialized |
1334 | * by the socket/transport layer.) |
1335 | */ |
1336 | void |
1337 | in6p_route_copyout(struct inpcb *inp, struct route_in6 *dst) |
1338 | { |
1339 | struct route_in6 *src = &inp->in6p_route; |
1340 | |
1341 | socket_lock_assert_owned(inp->inp_socket); |
1342 | |
1343 | /* Minor sanity check */ |
1344 | if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET6) |
1345 | panic("%s: wrong or corrupted route: %p" , __func__, src); |
1346 | |
1347 | route_copyout((struct route *)dst, (struct route *)src, sizeof (*dst)); |
1348 | } |
1349 | |
1350 | void |
1351 | in6p_route_copyin(struct inpcb *inp, struct route_in6 *src) |
1352 | { |
1353 | struct route_in6 *dst = &inp->in6p_route; |
1354 | |
1355 | socket_lock_assert_owned(inp->inp_socket); |
1356 | |
1357 | /* Minor sanity check */ |
1358 | if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET6) |
1359 | panic("%s: wrong or corrupted route: %p" , __func__, src); |
1360 | |
1361 | route_copyin((struct route *)src, (struct route *)dst, sizeof (*src)); |
1362 | } |
1363 | |