1/*
2 * Copyright (c) 2000-2021, 2023 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)udp_usrreq.c 8.6 (Berkeley) 5/23/95
61 */
62
63#include <sys/param.h>
64#include <sys/systm.h>
65#include <sys/kernel.h>
66#include <sys/malloc.h>
67#include <sys/mbuf.h>
68#include <sys/domain.h>
69#include <sys/protosw.h>
70#include <sys/socket.h>
71#include <sys/socketvar.h>
72#include <sys/sysctl.h>
73#include <sys/syslog.h>
74#include <sys/mcache.h>
75#include <net/ntstat.h>
76
77#include <kern/zalloc.h>
78#include <mach/boolean.h>
79#include <pexpert/pexpert.h>
80
81#include <net/if.h>
82#include <net/if_types.h>
83#include <net/route.h>
84#include <net/dlil.h>
85#include <net/net_api_stats.h>
86
87#include <netinet/in.h>
88#include <netinet/in_systm.h>
89#include <netinet/in_tclass.h>
90#include <netinet/ip.h>
91#include <netinet/ip6.h>
92#include <netinet/in_pcb.h>
93#include <netinet/in_var.h>
94#include <netinet/ip_var.h>
95#include <netinet6/in6_pcb.h>
96#include <netinet6/ip6_var.h>
97#include <netinet6/udp6_var.h>
98#include <netinet/ip_icmp.h>
99#include <netinet/icmp_var.h>
100#include <netinet/udp.h>
101#include <netinet/udp_var.h>
102#include <netinet/udp_log.h>
103#include <sys/kdebug.h>
104
105#if IPSEC
106#include <netinet6/ipsec.h>
107#include <netinet6/esp.h>
108#include <netkey/key.h>
109extern int ipsec_bypass;
110extern int esp_udp_encap_port;
111#endif /* IPSEC */
112
113#if NECP
114#include <net/necp.h>
115#endif /* NECP */
116
117#if FLOW_DIVERT
118#include <netinet/flow_divert.h>
119#endif /* FLOW_DIVERT */
120
121#if CONTENT_FILTER
122#include <net/content_filter.h>
123#endif /* CONTENT_FILTER */
124
125#if SKYWALK
126#include <skywalk/core/skywalk_var.h>
127#endif /* SKYWALK */
128
129#include <net/sockaddr_utils.h>
130
131#define DBG_LAYER_IN_BEG NETDBG_CODE(DBG_NETUDP, 0)
132#define DBG_LAYER_IN_END NETDBG_CODE(DBG_NETUDP, 2)
133#define DBG_LAYER_OUT_BEG NETDBG_CODE(DBG_NETUDP, 1)
134#define DBG_LAYER_OUT_END NETDBG_CODE(DBG_NETUDP, 3)
135#define DBG_FNC_UDP_INPUT NETDBG_CODE(DBG_NETUDP, (5 << 8))
136#define DBG_FNC_UDP_OUTPUT NETDBG_CODE(DBG_NETUDP, (6 << 8) | 1)
137
138/*
139 * UDP protocol implementation.
140 * Per RFC 768, August, 1980.
141 */
142#ifndef COMPAT_42
143static int udpcksum = 1;
144#else
145static int udpcksum = 0; /* XXX */
146#endif
147SYSCTL_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum,
148 CTLFLAG_RW | CTLFLAG_LOCKED, &udpcksum, 0, "");
149
150int udp_log_in_vain = 0;
151SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_RW | CTLFLAG_LOCKED,
152 &udp_log_in_vain, 0, "Log all incoming UDP packets");
153
154static int blackhole = 0;
155SYSCTL_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_RW | CTLFLAG_LOCKED,
156 &blackhole, 0, "Do not send port unreachables for refused connects");
157
158static KALLOC_TYPE_DEFINE(inpcbzone, struct inpcb, NET_KT_DEFAULT);
159
160struct inpcbhead udb; /* from udp_var.h */
161#define udb6 udb /* for KAME src sync over BSD*'s */
162struct inpcbinfo udbinfo;
163
164#ifndef UDBHASHSIZE
165#define UDBHASHSIZE 16
166#endif
167
168/* Garbage collection performed during most recent udp_gc() run */
169static boolean_t udp_gc_done = FALSE;
170
171#define log_in_vain_log(a) { log a; }
172
173static int udp_getstat SYSCTL_HANDLER_ARGS;
174struct udpstat udpstat; /* from udp_var.h */
175SYSCTL_PROC(_net_inet_udp, UDPCTL_STATS, stats,
176 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
177 0, 0, udp_getstat, "S,udpstat",
178 "UDP statistics (struct udpstat, netinet/udp_var.h)");
179
180SYSCTL_INT(_net_inet_udp, OID_AUTO, pcbcount,
181 CTLFLAG_RD | CTLFLAG_LOCKED, &udbinfo.ipi_count, 0,
182 "Number of active PCBs");
183
184__private_extern__ int udp_use_randomport = 1;
185SYSCTL_INT(_net_inet_udp, OID_AUTO, randomize_ports,
186 CTLFLAG_RW | CTLFLAG_LOCKED, &udp_use_randomport, 0,
187 "Randomize UDP port numbers");
188
189struct udp_in6 {
190 struct sockaddr_in6 uin6_sin;
191 u_char uin6_init_done : 1;
192};
193struct udp_ip6 {
194 struct ip6_hdr uip6_ip6;
195 u_char uip6_init_done : 1;
196};
197
198int udp_abort(struct socket *);
199int udp_attach(struct socket *, int, struct proc *);
200int udp_bind(struct socket *, struct sockaddr *, struct proc *);
201int udp_connect(struct socket *, struct sockaddr *, struct proc *);
202int udp_connectx(struct socket *, struct sockaddr *,
203 struct sockaddr *, struct proc *, uint32_t, sae_associd_t,
204 sae_connid_t *, uint32_t, void *, uint32_t, struct uio *, user_ssize_t *);
205int udp_detach(struct socket *);
206int udp_disconnect(struct socket *);
207int udp_disconnectx(struct socket *, sae_associd_t, sae_connid_t);
208int udp_send(struct socket *, int, struct mbuf *, struct sockaddr *,
209 struct mbuf *, struct proc *);
210static void udp_append(struct inpcb *, struct ip *, struct mbuf *, int,
211 struct sockaddr_in *, struct udp_in6 *, struct udp_ip6 *, struct ifnet *);
212static int udp_input_checksum(struct mbuf *, struct udphdr *, int, int);
213int udp_output(struct inpcb *, struct mbuf *, struct sockaddr *,
214 struct mbuf *, struct proc *);
215static void ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip);
216static void udp_gc(struct inpcbinfo *);
217static int udp_defunct(struct socket *);
218
219struct pr_usrreqs udp_usrreqs = {
220 .pru_abort = udp_abort,
221 .pru_attach = udp_attach,
222 .pru_bind = udp_bind,
223 .pru_connect = udp_connect,
224 .pru_connectx = udp_connectx,
225 .pru_control = in_control,
226 .pru_detach = udp_detach,
227 .pru_disconnect = udp_disconnect,
228 .pru_disconnectx = udp_disconnectx,
229 .pru_peeraddr = in_getpeeraddr,
230 .pru_send = udp_send,
231 .pru_shutdown = udp_shutdown,
232 .pru_sockaddr = in_getsockaddr,
233 .pru_sosend = sosend,
234 .pru_soreceive = soreceive,
235 .pru_defunct = udp_defunct,
236};
237
238void
239udp_init(struct protosw *pp, struct domain *dp)
240{
241#pragma unused(dp)
242 static int udp_initialized = 0;
243 struct inpcbinfo *pcbinfo;
244
245 VERIFY((pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
246
247 if (udp_initialized) {
248 return;
249 }
250 udp_initialized = 1;
251 uint32_t pool_size = (nmbclusters << MCLSHIFT) >> MBSHIFT;
252 if (pool_size >= 96) {
253 /* Improves 10GbE UDP performance. */
254 udp_recvspace = 786896;
255 }
256
257 if (PE_parse_boot_argn(arg_string: "udp_log", arg_ptr: &udp_log_enable_flags, max_arg: sizeof(udp_log_enable_flags))) {
258 os_log(OS_LOG_DEFAULT, "udp_init: set udp_log_enable_flags to 0x%x", udp_log_enable_flags);
259 }
260
261 LIST_INIT(&udb);
262 udbinfo.ipi_listhead = &udb;
263 udbinfo.ipi_hashbase = hashinit(UDBHASHSIZE, M_PCB,
264 hashmask: &udbinfo.ipi_hashmask);
265 udbinfo.ipi_porthashbase = hashinit(UDBHASHSIZE, M_PCB,
266 hashmask: &udbinfo.ipi_porthashmask);
267 udbinfo.ipi_zone = inpcbzone;
268
269 pcbinfo = &udbinfo;
270 /*
271 * allocate lock group and attribute for udp pcb mutexes
272 */
273 pcbinfo->ipi_lock_grp = lck_grp_alloc_init(grp_name: "udppcb",
274 LCK_GRP_ATTR_NULL);
275 lck_attr_setdefault(attr: &pcbinfo->ipi_lock_attr);
276 lck_rw_init(lck: &pcbinfo->ipi_lock, grp: pcbinfo->ipi_lock_grp,
277 attr: &pcbinfo->ipi_lock_attr);
278
279 udbinfo.ipi_gc = udp_gc;
280 in_pcbinfo_attach(&udbinfo);
281}
282
283void
284udp_input(struct mbuf *m, int iphlen)
285{
286 struct ip *ip;
287 struct udphdr *uh;
288 struct inpcb *inp;
289 struct mbuf *opts = NULL;
290 int len, isbroadcast;
291 struct ip save_ip;
292 struct sockaddr *append_sa = NULL;
293 struct sockaddr *append_da = NULL;
294 struct inpcbinfo *pcbinfo = &udbinfo;
295 struct sockaddr_in udp_in;
296 struct sockaddr_in udp_dst;
297 struct ip_moptions *imo = NULL;
298 int foundmembership = 0, ret = 0;
299 struct udp_in6 udp_in6;
300 struct udp_in6 udp_dst6;
301 struct udp_ip6 udp_ip6;
302 struct ifnet *ifp = m->m_pkthdr.rcvif;
303 boolean_t cell = IFNET_IS_CELLULAR(ifp);
304 boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
305 boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
306 u_int16_t pf_tag = 0;
307 boolean_t is_wake_pkt = false;
308 boolean_t check_cfil = cfil_filter_present();
309
310 SOCKADDR_ZERO(&udp_in, sizeof(udp_in));
311 udp_in.sin_len = sizeof(struct sockaddr_in);
312 udp_in.sin_family = AF_INET;
313 bzero(s: &udp_in6, n: sizeof(udp_in6));
314 udp_in6.uin6_sin.sin6_len = sizeof(struct sockaddr_in6);
315 udp_in6.uin6_sin.sin6_family = AF_INET6;
316
317 if (m->m_flags & M_PKTHDR) {
318 pf_tag = m_pftag(m)->pftag_tag;
319 if (m->m_pkthdr.pkt_flags & PKTF_WAKE_PKT) {
320 is_wake_pkt = true;
321 }
322 }
323
324 udpstat.udps_ipackets++;
325
326 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
327
328 /* Expect 32-bit aligned data pointer on strict-align platforms */
329 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
330
331 m_add_crumb(m, PKT_CRUMB_UDP_INPUT);
332
333 /*
334 * Strip IP options, if any; should skip this,
335 * make available to user, and use on returned packets,
336 * but we don't yet have a way to check the checksum
337 * with options still present.
338 */
339 if (iphlen > sizeof(struct ip)) {
340 ip_stripoptions(m);
341 iphlen = sizeof(struct ip);
342 }
343
344 /*
345 * Get IP and UDP header together in first mbuf.
346 */
347 ip = mtod(m, struct ip *);
348 if (m->m_len < iphlen + sizeof(struct udphdr)) {
349 m = m_pullup(m, iphlen + sizeof(struct udphdr));
350 if (m == NULL) {
351 udpstat.udps_hdrops++;
352 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
353 0, 0, 0, 0, 0);
354 return;
355 }
356 ip = mtod(m, struct ip *);
357 }
358 uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
359
360 /* destination port of 0 is illegal, based on RFC768. */
361 if (uh->uh_dport == 0) {
362 IF_UDP_STATINC(ifp, port0);
363 goto bad;
364 }
365
366 KERNEL_DEBUG(DBG_LAYER_IN_BEG, uh->uh_dport, uh->uh_sport,
367 ip->ip_src.s_addr, ip->ip_dst.s_addr, uh->uh_ulen);
368
369 /*
370 * Make mbuf data length reflect UDP length.
371 * If not enough data to reflect UDP length, drop.
372 */
373 len = ntohs((u_short)uh->uh_ulen);
374 if (ip->ip_len != len) {
375 if (len > ip->ip_len || len < sizeof(struct udphdr)) {
376 udpstat.udps_badlen++;
377 IF_UDP_STATINC(ifp, badlength);
378 goto bad;
379 }
380 m_adj(m, len - ip->ip_len);
381 /* ip->ip_len = len; */
382 }
383 /*
384 * Save a copy of the IP header in case we want restore it
385 * for sending an ICMP error message in response.
386 */
387 save_ip = *ip;
388
389 /*
390 * Checksum extended UDP header and data.
391 */
392 if (udp_input_checksum(m, uh, iphlen, len)) {
393 goto bad;
394 }
395
396 isbroadcast = in_broadcast(ip->ip_dst, ifp);
397
398 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || isbroadcast) {
399 int reuse_sock = 0, mcast_delivered = 0;
400
401 lck_rw_lock_shared(lck: &pcbinfo->ipi_lock);
402 /*
403 * Deliver a multicast or broadcast datagram to *all* sockets
404 * for which the local and remote addresses and ports match
405 * those of the incoming datagram. This allows more than
406 * one process to receive multi/broadcasts on the same port.
407 * (This really ought to be done for unicast datagrams as
408 * well, but that would cause problems with existing
409 * applications that open both address-specific sockets and
410 * a wildcard socket listening to the same port -- they would
411 * end up receiving duplicates of every unicast datagram.
412 * Those applications open the multiple sockets to overcome an
413 * inadequacy of the UDP socket interface, but for backwards
414 * compatibility we avoid the problem here rather than
415 * fixing the interface. Maybe 4.5BSD will remedy this?)
416 */
417
418 /*
419 * Construct sockaddr format source address.
420 */
421 udp_in.sin_port = uh->uh_sport;
422 udp_in.sin_addr = ip->ip_src;
423 /*
424 * Locate pcb(s) for datagram.
425 * (Algorithm copied from raw_intr().)
426 */
427 udp_in6.uin6_init_done = udp_ip6.uip6_init_done = 0;
428 LIST_FOREACH(inp, &udb, inp_list) {
429#if IPSEC
430 int skipit;
431#endif /* IPSEC */
432
433 if (inp->inp_socket == NULL) {
434 continue;
435 }
436 if (inp != sotoinpcb(inp->inp_socket)) {
437 panic("%s: bad so back ptr inp=%p",
438 __func__, inp);
439 /* NOTREACHED */
440 }
441 if ((inp->inp_vflag & INP_IPV4) == 0) {
442 continue;
443 }
444 if (inp_restricted_recv(inp, ifp)) {
445 continue;
446 }
447
448 if ((inp->inp_moptions == NULL) &&
449 (ntohl(ip->ip_dst.s_addr) !=
450 INADDR_ALLHOSTS_GROUP) && (isbroadcast == 0)) {
451 continue;
452 }
453 /*
454 * Skip unbound sockets before taking the lock on the socket as
455 * the test with the destination port in the header will fail
456 */
457 if (inp->inp_lport == 0) {
458 continue;
459 }
460
461 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) ==
462 WNT_STOPUSING) {
463 continue;
464 }
465
466 udp_lock(inp->inp_socket, 1, 0);
467
468 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) ==
469 WNT_STOPUSING) {
470 udp_unlock(inp->inp_socket, 1, 0);
471 continue;
472 }
473
474 if (inp->inp_lport != uh->uh_dport) {
475 udp_unlock(inp->inp_socket, 1, 0);
476 continue;
477 }
478 if (inp->inp_laddr.s_addr != INADDR_ANY) {
479 if (inp->inp_laddr.s_addr !=
480 ip->ip_dst.s_addr) {
481 udp_unlock(inp->inp_socket, 1, 0);
482 continue;
483 }
484 }
485 if (inp->inp_faddr.s_addr != INADDR_ANY) {
486 if (inp->inp_faddr.s_addr !=
487 ip->ip_src.s_addr ||
488 inp->inp_fport != uh->uh_sport) {
489 udp_unlock(inp->inp_socket, 1, 0);
490 continue;
491 }
492 }
493
494 if (isbroadcast == 0 && (ntohl(ip->ip_dst.s_addr) !=
495 INADDR_ALLHOSTS_GROUP)) {
496 struct sockaddr_in group;
497 int blocked;
498
499 if ((imo = inp->inp_moptions) == NULL) {
500 udp_unlock(inp->inp_socket, 1, 0);
501 continue;
502 }
503 IMO_LOCK(imo);
504
505 SOCKADDR_ZERO(&group, sizeof(struct sockaddr_in));
506 group.sin_len = sizeof(struct sockaddr_in);
507 group.sin_family = AF_INET;
508 group.sin_addr = ip->ip_dst;
509
510 blocked = imo_multi_filter(imo, ifp,
511 &group, &udp_in);
512 if (blocked == MCAST_PASS) {
513 foundmembership = 1;
514 }
515
516 IMO_UNLOCK(imo);
517 if (!foundmembership) {
518 udp_unlock(inp->inp_socket, 1, 0);
519 if (blocked == MCAST_NOTSMEMBER ||
520 blocked == MCAST_MUTED) {
521 udpstat.udps_filtermcast++;
522 }
523 continue;
524 }
525 foundmembership = 0;
526 }
527
528 reuse_sock = (inp->inp_socket->so_options &
529 (SO_REUSEPORT | SO_REUSEADDR));
530
531#if NECP
532 skipit = 0;
533 if (!necp_socket_is_allowed_to_send_recv_v4(inp,
534 local_port: uh->uh_dport, remote_port: uh->uh_sport, local_addr: &ip->ip_dst,
535 remote_addr: &ip->ip_src, input_interface: ifp, pf_tag, NULL, NULL, NULL, NULL)) {
536 /* do not inject data to pcb */
537 skipit = 1;
538 }
539 if (skipit == 0)
540#endif /* NECP */
541 {
542 struct mbuf *n = NULL;
543
544 if (reuse_sock) {
545 n = m_copy(m, 0, M_COPYALL);
546 }
547 udp_append(inp, ip, m,
548 iphlen + sizeof(struct udphdr),
549 &udp_in, &udp_in6, &udp_ip6, ifp);
550 mcast_delivered++;
551
552 m = n;
553 }
554 if (is_wake_pkt) {
555 soevent(so: inp->inp_socket, SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
556 }
557
558 udp_unlock(inp->inp_socket, 1, 0);
559
560
561 /*
562 * Don't look for additional matches if this one does
563 * not have either the SO_REUSEPORT or SO_REUSEADDR
564 * socket options set. This heuristic avoids searching
565 * through all pcbs in the common case of a non-shared
566 * port. It assumes that an application will never
567 * clear these options after setting them.
568 */
569 if (reuse_sock == 0 || m == NULL) {
570 break;
571 }
572
573 /*
574 * Expect 32-bit aligned data pointer on strict-align
575 * platforms.
576 */
577 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
578 /*
579 * Recompute IP and UDP header pointers for new mbuf
580 */
581 ip = mtod(m, struct ip *);
582 uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
583 }
584 lck_rw_done(lck: &pcbinfo->ipi_lock);
585
586 if (mcast_delivered == 0) {
587 /*
588 * No matching pcb found; discard datagram.
589 * (No need to send an ICMP Port Unreachable
590 * for a broadcast or multicast datgram.)
591 */
592 udpstat.udps_noportbcast++;
593 IF_UDP_STATINC(ifp, port_unreach);
594 goto bad;
595 }
596
597 /* free the extra copy of mbuf or skipped by IPsec */
598 if (m != NULL) {
599 m_freem(m);
600 }
601 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
602 return;
603 }
604
605#if IPSEC
606 /*
607 * UDP to port 4500 with a payload where the first four bytes are
608 * not zero is a UDP encapsulated IPsec packet. Packets where
609 * the payload is one byte and that byte is 0xFF are NAT keepalive
610 * packets. Decapsulate the ESP packet and carry on with IPsec input
611 * or discard the NAT keep-alive.
612 */
613 if (ipsec_bypass == 0 && (esp_udp_encap_port & 0xFFFF) != 0 &&
614 (uh->uh_dport == ntohs((u_short)esp_udp_encap_port) ||
615 uh->uh_sport == ntohs((u_short)esp_udp_encap_port))) {
616 /*
617 * Check if ESP or keepalive:
618 * 1. If the destination port of the incoming packet is 4500.
619 * 2. If the source port of the incoming packet is 4500,
620 * then check the SADB to match IP address and port.
621 */
622 bool check_esp = true;
623 if (uh->uh_dport != ntohs((u_short)esp_udp_encap_port)) {
624 check_esp = key_checksa_present(AF_INET, src: (caddr_t)&ip->ip_dst,
625 dst: (caddr_t)&ip->ip_src, src_port: uh->uh_dport,
626 dst_port: uh->uh_sport, IFSCOPE_NONE, IFSCOPE_NONE);
627 }
628
629 if (check_esp) {
630 int payload_len = len - sizeof(struct udphdr) > 4 ? 4 :
631 len - sizeof(struct udphdr);
632
633 if (m->m_len < iphlen + sizeof(struct udphdr) + payload_len) {
634 if ((m = m_pullup(m, iphlen + sizeof(struct udphdr) +
635 payload_len)) == NULL) {
636 udpstat.udps_hdrops++;
637 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
638 0, 0, 0, 0, 0);
639 return;
640 }
641 /*
642 * Expect 32-bit aligned data pointer on strict-align
643 * platforms.
644 */
645 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
646
647 ip = mtod(m, struct ip *);
648 uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
649 }
650 /* Check for NAT keepalive packet */
651 if (payload_len == 1 && *(u_int8_t *)
652 ((caddr_t)uh + sizeof(struct udphdr)) == 0xFF) {
653 m_freem(m);
654 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
655 0, 0, 0, 0, 0);
656 return;
657 } else if (payload_len == 4 && *(u_int32_t *)(void *)
658 ((caddr_t)uh + sizeof(struct udphdr)) != 0) {
659 /* UDP encapsulated IPsec packet to pass through NAT */
660 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
661 0, 0, 0, 0, 0);
662 /* preserve the udp header */
663 esp4_input(m, off: iphlen + sizeof(struct udphdr));
664 return;
665 }
666 }
667 }
668#endif /* IPSEC */
669
670 /*
671 * Locate pcb for datagram.
672 */
673 inp = in_pcblookup_hash(&udbinfo, ip->ip_src, uh->uh_sport,
674 ip->ip_dst, uh->uh_dport, 1, ifp);
675 if (inp == NULL) {
676 IF_UDP_STATINC(ifp, port_unreach);
677
678 if (udp_log_in_vain) {
679 char buf[MAX_IPv4_STR_LEN];
680 char buf2[MAX_IPv4_STR_LEN];
681
682 /* check src and dst address */
683 if (udp_log_in_vain < 3) {
684 log(LOG_INFO, "Connection attempt to "
685 "UDP %s:%d from %s:%d\n", inet_ntop(AF_INET,
686 &ip->ip_dst, buf, sizeof(buf)),
687 ntohs(uh->uh_dport), inet_ntop(AF_INET,
688 &ip->ip_src, buf2, sizeof(buf2)),
689 ntohs(uh->uh_sport));
690 } else if (!(m->m_flags & (M_BCAST | M_MCAST)) &&
691 ip->ip_dst.s_addr != ip->ip_src.s_addr) {
692 log_in_vain_log((LOG_INFO,
693 "Stealth Mode connection attempt to "
694 "UDP %s:%d from %s:%d\n", inet_ntop(AF_INET,
695 &ip->ip_dst, buf, sizeof(buf)),
696 ntohs(uh->uh_dport), inet_ntop(AF_INET,
697 &ip->ip_src, buf2, sizeof(buf2)),
698 ntohs(uh->uh_sport)))
699 }
700 }
701 udpstat.udps_noport++;
702 if (m->m_flags & (M_BCAST | M_MCAST)) {
703 udpstat.udps_noportbcast++;
704 goto bad;
705 }
706 if (blackhole) {
707 if (ifp && ifp->if_type != IFT_LOOP) {
708 goto bad;
709 }
710 }
711 *ip = save_ip;
712 ip->ip_len += iphlen;
713 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
714 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
715 return;
716 }
717 udp_lock(inp->inp_socket, 1, 0);
718
719 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
720 udp_unlock(inp->inp_socket, 1, 0);
721 IF_UDP_STATINC(ifp, cleanup);
722 goto bad;
723 }
724#if NECP
725 if (!necp_socket_is_allowed_to_send_recv_v4(inp, local_port: uh->uh_dport,
726 remote_port: uh->uh_sport, local_addr: &ip->ip_dst, remote_addr: &ip->ip_src, input_interface: ifp, pf_tag, NULL, NULL, NULL, NULL)) {
727 udp_unlock(inp->inp_socket, 1, 0);
728 IF_UDP_STATINC(ifp, badipsec);
729 goto bad;
730 }
731#endif /* NECP */
732
733 /*
734 * Construct sockaddr format source address.
735 * Stuff source address and datagram in user buffer.
736 */
737 udp_in.sin_port = uh->uh_sport;
738 udp_in.sin_addr = ip->ip_src;
739 if ((inp->inp_flags & INP_CONTROLOPTS) != 0 ||
740 SOFLOW_ENABLED(inp->inp_socket) ||
741 SO_RECV_CONTROL_OPTS(inp->inp_socket)) {
742 if (inp->inp_vflag & INP_IPV6 || inp->inp_vflag & INP_V4MAPPEDV6) {
743 int savedflags;
744
745 ip_2_ip6_hdr(ip6: &udp_ip6.uip6_ip6, ip);
746 savedflags = inp->inp_flags;
747 inp->inp_flags &= ~INP_UNMAPPABLEOPTS;
748 ret = ip6_savecontrol(inp, m, &opts);
749 inp->inp_flags = savedflags;
750 } else {
751 ret = ip_savecontrol(inp, &opts, ip, m);
752 }
753 if (ret != 0) {
754 udp_unlock(inp->inp_socket, 1, 0);
755 goto bad;
756 }
757 }
758 m_adj(m, iphlen + sizeof(struct udphdr));
759
760 KERNEL_DEBUG(DBG_LAYER_IN_END, uh->uh_dport, uh->uh_sport,
761 save_ip.ip_src.s_addr, save_ip.ip_dst.s_addr, uh->uh_ulen);
762
763 if (inp->inp_vflag & INP_IPV6) {
764 in6_sin_2_v4mapsin6(sin: &udp_in, sin6: &udp_in6.uin6_sin);
765 append_sa = SA(&udp_in6.uin6_sin);
766 } else {
767 append_sa = SA(&udp_in);
768 }
769 if (nstat_collect) {
770 INP_ADD_STAT(inp, cell, wifi, wired, rxpackets, 1);
771 INP_ADD_STAT(inp, cell, wifi, wired, rxbytes, m->m_pkthdr.len);
772 inp_set_activity_bitmap(inp);
773 }
774#if CONTENT_FILTER && NECP
775 if (check_cfil && inp != NULL && inp->inp_policyresult.results.filter_control_unit == 0) {
776 if (inp->inp_vflag & INP_IPV6) {
777 bzero(s: &udp_dst6, n: sizeof(udp_dst6));
778 udp_dst6.uin6_sin.sin6_len = sizeof(struct sockaddr_in6);
779 udp_dst6.uin6_sin.sin6_family = AF_INET6;
780 in6_sin_2_v4mapsin6(sin: &udp_dst, sin6: &udp_dst6.uin6_sin);
781 append_da = SA(&udp_dst6.uin6_sin);
782 } else {
783 SOCKADDR_ZERO(&udp_dst, sizeof(udp_dst));
784 udp_dst.sin_len = sizeof(struct sockaddr_in);
785 udp_dst.sin_family = AF_INET;
786 udp_dst.sin_port = uh->uh_dport;
787 udp_dst.sin_addr = ip->ip_dst;
788 append_da = SA(&udp_dst);
789 }
790 // Override the dst input here so NECP can pick up the policy
791 // and CFIL can find an existing control socket.
792 necp_socket_find_policy_match(inp, override_local_addr: append_da, override_remote_addr: append_sa, override_bound_interface: 0);
793 }
794#endif /* CONTENT_FILTER and NECP */
795 so_recv_data_stat(inp->inp_socket, m, 0);
796 if (sbappendaddr(sb: &inp->inp_socket->so_rcv, asa: append_sa,
797 m0: m, control: opts, NULL) == 0) {
798 udpstat.udps_fullsock++;
799 } else {
800 sorwakeup(so: inp->inp_socket);
801 }
802 if (is_wake_pkt) {
803 soevent(so: inp->inp_socket, SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
804 }
805 udp_unlock(inp->inp_socket, 1, 0);
806 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
807 return;
808bad:
809 m_freem(m);
810 if (opts) {
811 m_freem(opts);
812 }
813 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
814}
815
816static void
817ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip)
818{
819 bzero(s: ip6, n: sizeof(*ip6));
820
821 ip6->ip6_vfc = IPV6_VERSION;
822 ip6->ip6_plen = ip->ip_len;
823 ip6->ip6_nxt = ip->ip_p;
824 ip6->ip6_hlim = ip->ip_ttl;
825 if (ip->ip_src.s_addr) {
826 ip6->ip6_src.s6_addr32[2] = IPV6_ADDR_INT32_SMP;
827 ip6->ip6_src.s6_addr32[3] = ip->ip_src.s_addr;
828 }
829 if (ip->ip_dst.s_addr) {
830 ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_SMP;
831 ip6->ip6_dst.s6_addr32[3] = ip->ip_dst.s_addr;
832 }
833}
834
835/*
836 * subroutine of udp_input(), mainly for source code readability.
837 */
838static void
839udp_append(struct inpcb *last, struct ip *ip, struct mbuf *n, int off,
840 struct sockaddr_in *pudp_in, struct udp_in6 *pudp_in6,
841 struct udp_ip6 *pudp_ip6, struct ifnet *ifp)
842{
843 struct sockaddr *append_sa;
844 struct mbuf *opts = 0;
845 boolean_t cell = IFNET_IS_CELLULAR(ifp);
846 boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
847 boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
848 int ret = 0;
849
850 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
851 SOFLOW_ENABLED(last->inp_socket) ||
852 SO_RECV_CONTROL_OPTS(last->inp_socket)) {
853 if (last->inp_vflag & INP_IPV6 || last->inp_vflag & INP_V4MAPPEDV6) {
854 int savedflags;
855
856 if (pudp_ip6->uip6_init_done == 0) {
857 ip_2_ip6_hdr(ip6: &pudp_ip6->uip6_ip6, ip);
858 pudp_ip6->uip6_init_done = 1;
859 }
860 savedflags = last->inp_flags;
861 last->inp_flags &= ~INP_UNMAPPABLEOPTS;
862 ret = ip6_savecontrol(last, n, &opts);
863 if (ret != 0) {
864 last->inp_flags = savedflags;
865 goto error;
866 }
867 last->inp_flags = savedflags;
868 } else {
869 ret = ip_savecontrol(last, &opts, ip, n);
870 if (ret != 0) {
871 goto error;
872 }
873 }
874 }
875 if (last->inp_vflag & INP_IPV6) {
876 if (pudp_in6->uin6_init_done == 0) {
877 in6_sin_2_v4mapsin6(sin: pudp_in, sin6: &pudp_in6->uin6_sin);
878 pudp_in6->uin6_init_done = 1;
879 }
880 append_sa = SA(&pudp_in6->uin6_sin);
881 } else {
882 append_sa = SA(pudp_in);
883 }
884 if (nstat_collect) {
885 INP_ADD_STAT(last, cell, wifi, wired, rxpackets, 1);
886 INP_ADD_STAT(last, cell, wifi, wired, rxbytes,
887 n->m_pkthdr.len);
888 inp_set_activity_bitmap(inp: last);
889 }
890 so_recv_data_stat(last->inp_socket, n, 0);
891 m_adj(n, off);
892 if (sbappendaddr(sb: &last->inp_socket->so_rcv, asa: append_sa,
893 m0: n, control: opts, NULL) == 0) {
894 udpstat.udps_fullsock++;
895 } else {
896 sorwakeup(so: last->inp_socket);
897 }
898 return;
899error:
900 m_freem(n);
901 m_freem(opts);
902}
903
904/*
905 * Notify a udp user of an asynchronous error;
906 * just wake up so that he can collect error status.
907 */
908void
909udp_notify(struct inpcb *inp, int errno)
910{
911 inp->inp_socket->so_error = (u_short)errno;
912 sorwakeup(so: inp->inp_socket);
913 sowwakeup(so: inp->inp_socket);
914}
915
916void
917udp_ctlinput(int cmd, struct sockaddr *sa, void *vip, __unused struct ifnet * ifp)
918{
919 struct ipctlparam *ctl_param = vip;
920 struct ip *ip = NULL;
921 struct mbuf *m = NULL;
922 void (*notify)(struct inpcb *, int) = udp_notify;
923 struct in_addr faddr;
924 struct inpcb *inp = NULL;
925 struct icmp *icp = NULL;
926 size_t off;
927
928 if (ctl_param != NULL) {
929 ip = ctl_param->ipc_icmp_ip;
930 icp = ctl_param->ipc_icmp;
931 m = ctl_param->ipc_m;
932 off = ctl_param->ipc_off;
933 } else {
934 ip = NULL;
935 icp = NULL;
936 m = NULL;
937 off = 0;
938 }
939
940 faddr = SIN(sa)->sin_addr;
941 if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY) {
942 return;
943 }
944
945 if (PRC_IS_REDIRECT(cmd)) {
946 ip = 0;
947 notify = in_rtchange;
948 } else if (cmd == PRC_HOSTDEAD) {
949 ip = 0;
950 } else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0) {
951 return;
952 }
953 if (ip) {
954 struct udphdr uh;
955
956 /* Check if we can safely get the ports from the UDP header */
957 if (m == NULL ||
958 (m->m_len < off + sizeof(uh))) {
959 /* Insufficient length */
960 return;
961 }
962
963 bcopy(src: m_mtod_current(m) + off, dst: &uh, n: sizeof(uh));
964 inp = in_pcblookup_hash(&udbinfo, faddr, uh.uh_dport,
965 ip->ip_src, uh.uh_sport, 0, NULL);
966
967 if (inp != NULL && inp->inp_socket != NULL) {
968 udp_lock(inp->inp_socket, 1, 0);
969 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) ==
970 WNT_STOPUSING) {
971 udp_unlock(inp->inp_socket, 1, 0);
972 return;
973 }
974 if (cmd == PRC_MSGSIZE && !uuid_is_null(uu: inp->necp_client_uuid)) {
975 uuid_t null_uuid;
976 uuid_clear(uu: null_uuid);
977 necp_update_flow_protoctl_event(netagent_uuid: null_uuid, client_id: inp->necp_client_uuid,
978 PRC_MSGSIZE, ntohs(icp->icmp_nextmtu), protoctl_event_tcp_seq_num: 0);
979 /*
980 * Avoid calling udp_notify() to set so_error
981 * when using Network.framework since the notification
982 * of PRC_MSGSIZE has been delivered through NECP.
983 */
984 } else {
985 (*notify)(inp, inetctlerrmap[cmd]);
986 }
987 udp_unlock(inp->inp_socket, 1, 0);
988 }
989#if SKYWALK
990 else {
991 union sockaddr_in_4_6 sock_laddr;
992 struct protoctl_ev_val prctl_ev_val;
993 bzero(s: &prctl_ev_val, n: sizeof(prctl_ev_val));
994 bzero(s: &sock_laddr, n: sizeof(sock_laddr));
995
996 if (cmd == PRC_MSGSIZE) {
997 prctl_ev_val.val = ntohs(icp->icmp_nextmtu);
998 }
999
1000 sock_laddr.sin.sin_family = AF_INET;
1001 sock_laddr.sin.sin_len = sizeof(sock_laddr.sin);
1002 sock_laddr.sin.sin_addr = ip->ip_src;
1003
1004 protoctl_event_enqueue_nwk_wq_entry(ifp,
1005 SA(&sock_laddr), p_raddr: sa,
1006 lport: uh.uh_sport, rport: uh.uh_dport, IPPROTO_UDP,
1007 protoctl_event_code: cmd, p_protoctl_ev_val: &prctl_ev_val);
1008 }
1009#endif /* SKYWALK */
1010 } else {
1011 in_pcbnotifyall(&udbinfo, faddr, inetctlerrmap[cmd], notify);
1012 }
1013}
1014
1015int
1016udp_ctloutput(struct socket *so, struct sockopt *sopt)
1017{
1018 int error = 0, optval = 0;
1019 struct inpcb *inp;
1020
1021 /* Allow <SOL_SOCKET,SO_FLUSH> at this level */
1022 if (sopt->sopt_level != IPPROTO_UDP &&
1023 !(sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_FLUSH)) {
1024 if (SOCK_CHECK_DOM(so, PF_INET6)) {
1025 error = ip6_ctloutput(so, sopt);
1026 } else {
1027 error = ip_ctloutput(so, sopt);
1028 }
1029 return error;
1030 }
1031
1032 inp = sotoinpcb(so);
1033
1034 switch (sopt->sopt_dir) {
1035 case SOPT_SET:
1036 switch (sopt->sopt_name) {
1037 case UDP_NOCKSUM:
1038 /* This option is settable only for UDP over IPv4 */
1039 if (!(inp->inp_vflag & INP_IPV4)) {
1040 error = EINVAL;
1041 break;
1042 }
1043
1044 if ((error = sooptcopyin(sopt, &optval, len: sizeof(optval),
1045 minlen: sizeof(optval))) != 0) {
1046 break;
1047 }
1048
1049 if (optval != 0) {
1050 inp->inp_flags |= INP_UDP_NOCKSUM;
1051 } else {
1052 inp->inp_flags &= ~INP_UDP_NOCKSUM;
1053 }
1054 break;
1055 case UDP_KEEPALIVE_OFFLOAD:
1056 {
1057 struct udp_keepalive_offload ka;
1058 /*
1059 * If the socket is not connected, the stack will
1060 * not know the destination address to put in the
1061 * keepalive datagram. Return an error now instead
1062 * of failing later.
1063 */
1064 if (!(so->so_state & SS_ISCONNECTED)) {
1065 error = EINVAL;
1066 break;
1067 }
1068 if (sopt->sopt_valsize != sizeof(ka)) {
1069 error = EINVAL;
1070 break;
1071 }
1072 if ((error = sooptcopyin(sopt, &ka, len: sizeof(ka),
1073 minlen: sizeof(ka))) != 0) {
1074 break;
1075 }
1076
1077 /* application should specify the type */
1078 if (ka.ka_type == 0) {
1079 return EINVAL;
1080 }
1081
1082 if (ka.ka_interval == 0) {
1083 /*
1084 * if interval is 0, disable the offload
1085 * mechanism
1086 */
1087 if (inp->inp_keepalive_data != NULL) {
1088 kfree_data(inp->inp_keepalive_data,
1089 inp->inp_keepalive_datalen);
1090 }
1091 inp->inp_keepalive_data = NULL;
1092 inp->inp_keepalive_datalen = 0;
1093 inp->inp_keepalive_interval = 0;
1094 inp->inp_keepalive_type = 0;
1095 inp->inp_flags2 &= ~INP2_KEEPALIVE_OFFLOAD;
1096 } else {
1097 if (inp->inp_keepalive_data != NULL) {
1098 kfree_data(inp->inp_keepalive_data,
1099 inp->inp_keepalive_datalen);
1100 inp->inp_keepalive_data = NULL;
1101 }
1102
1103 inp->inp_keepalive_datalen = (uint8_t)min(
1104 a: ka.ka_data_len,
1105 UDP_KEEPALIVE_OFFLOAD_DATA_SIZE);
1106 if (inp->inp_keepalive_datalen > 0) {
1107 inp->inp_keepalive_data = (u_int8_t *)kalloc_data(
1108 inp->inp_keepalive_datalen, Z_WAITOK);
1109 if (inp->inp_keepalive_data == NULL) {
1110 inp->inp_keepalive_datalen = 0;
1111 error = ENOMEM;
1112 break;
1113 }
1114 bcopy(src: ka.ka_data,
1115 dst: inp->inp_keepalive_data,
1116 n: inp->inp_keepalive_datalen);
1117 } else {
1118 inp->inp_keepalive_datalen = 0;
1119 }
1120 inp->inp_keepalive_interval = (uint8_t)
1121 min(UDP_KEEPALIVE_INTERVAL_MAX_SECONDS,
1122 b: ka.ka_interval);
1123 inp->inp_keepalive_type = ka.ka_type;
1124 inp->inp_flags2 |= INP2_KEEPALIVE_OFFLOAD;
1125 }
1126 break;
1127 }
1128 case SO_FLUSH:
1129 if ((error = sooptcopyin(sopt, &optval, len: sizeof(optval),
1130 minlen: sizeof(optval))) != 0) {
1131 break;
1132 }
1133
1134 error = inp_flush(inp, optval);
1135 break;
1136
1137 default:
1138 error = ENOPROTOOPT;
1139 break;
1140 }
1141 break;
1142
1143 case SOPT_GET:
1144 switch (sopt->sopt_name) {
1145 case UDP_NOCKSUM:
1146 optval = inp->inp_flags & INP_UDP_NOCKSUM;
1147 break;
1148
1149 default:
1150 error = ENOPROTOOPT;
1151 break;
1152 }
1153 if (error == 0) {
1154 error = sooptcopyout(sopt, data: &optval, len: sizeof(optval));
1155 }
1156 break;
1157 }
1158 return error;
1159}
1160
1161static int
1162udp_pcblist SYSCTL_HANDLER_ARGS
1163{
1164#pragma unused(oidp, arg1, arg2)
1165 int error, i, n, sz;
1166 struct inpcb *inp, **inp_list;
1167 inp_gen_t gencnt;
1168 struct xinpgen xig;
1169
1170 /*
1171 * The process of preparing the TCB list is too time-consuming and
1172 * resource-intensive to repeat twice on every request.
1173 */
1174 lck_rw_lock_exclusive(lck: &udbinfo.ipi_lock);
1175 if (req->oldptr == USER_ADDR_NULL) {
1176 n = udbinfo.ipi_count;
1177 req->oldidx = 2 * (sizeof(xig))
1178 + (n + n / 8) * sizeof(struct xinpcb);
1179 lck_rw_done(lck: &udbinfo.ipi_lock);
1180 return 0;
1181 }
1182
1183 if (req->newptr != USER_ADDR_NULL) {
1184 lck_rw_done(lck: &udbinfo.ipi_lock);
1185 return EPERM;
1186 }
1187
1188 /*
1189 * OK, now we're committed to doing something.
1190 */
1191 gencnt = udbinfo.ipi_gencnt;
1192 sz = n = udbinfo.ipi_count;
1193
1194 bzero(s: &xig, n: sizeof(xig));
1195 xig.xig_len = sizeof(xig);
1196 xig.xig_count = n;
1197 xig.xig_gen = gencnt;
1198 xig.xig_sogen = so_gencnt;
1199 error = SYSCTL_OUT(req, &xig, sizeof(xig));
1200 if (error) {
1201 lck_rw_done(lck: &udbinfo.ipi_lock);
1202 return error;
1203 }
1204 /*
1205 * We are done if there is no pcb
1206 */
1207 if (n == 0) {
1208 lck_rw_done(lck: &udbinfo.ipi_lock);
1209 return 0;
1210 }
1211
1212 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1213 if (inp_list == NULL) {
1214 lck_rw_done(lck: &udbinfo.ipi_lock);
1215 return ENOMEM;
1216 }
1217
1218 for (inp = LIST_FIRST(udbinfo.ipi_listhead), i = 0; inp && i < n;
1219 inp = LIST_NEXT(inp, inp_list)) {
1220 if (inp->inp_gencnt <= gencnt &&
1221 inp->inp_state != INPCB_STATE_DEAD) {
1222 inp_list[i++] = inp;
1223 }
1224 }
1225 n = i;
1226
1227 error = 0;
1228 for (i = 0; i < n; i++) {
1229 struct xinpcb xi;
1230
1231 inp = inp_list[i];
1232
1233 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING) {
1234 continue;
1235 }
1236 udp_lock(inp->inp_socket, 1, 0);
1237 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
1238 udp_unlock(inp->inp_socket, 1, 0);
1239 continue;
1240 }
1241 if (inp->inp_gencnt > gencnt) {
1242 udp_unlock(inp->inp_socket, 1, 0);
1243 continue;
1244 }
1245
1246 bzero(s: &xi, n: sizeof(xi));
1247 xi.xi_len = sizeof(xi);
1248 /* XXX should avoid extra copy */
1249 inpcb_to_compat(inp, &xi.xi_inp);
1250 if (inp->inp_socket) {
1251 sotoxsocket(so: inp->inp_socket, xso: &xi.xi_socket);
1252 }
1253
1254 udp_unlock(inp->inp_socket, 1, 0);
1255
1256 error = SYSCTL_OUT(req, &xi, sizeof(xi));
1257 }
1258 if (!error) {
1259 /*
1260 * Give the user an updated idea of our state.
1261 * If the generation differs from what we told
1262 * her before, she knows that something happened
1263 * while we were processing this request, and it
1264 * might be necessary to retry.
1265 */
1266 bzero(s: &xig, n: sizeof(xig));
1267 xig.xig_len = sizeof(xig);
1268 xig.xig_gen = udbinfo.ipi_gencnt;
1269 xig.xig_sogen = so_gencnt;
1270 xig.xig_count = udbinfo.ipi_count;
1271 error = SYSCTL_OUT(req, &xig, sizeof(xig));
1272 }
1273
1274 lck_rw_done(lck: &udbinfo.ipi_lock);
1275 kfree_type(struct inpcb *, sz, inp_list);
1276 return error;
1277}
1278
1279SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist,
1280 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist,
1281 "S,xinpcb", "List of active UDP sockets");
1282
1283#if XNU_TARGET_OS_OSX
1284
1285static int
1286udp_pcblist64 SYSCTL_HANDLER_ARGS
1287{
1288#pragma unused(oidp, arg1, arg2)
1289 int error, i, n, sz;
1290 struct inpcb *inp, **inp_list;
1291 inp_gen_t gencnt;
1292 struct xinpgen xig;
1293
1294 /*
1295 * The process of preparing the TCB list is too time-consuming and
1296 * resource-intensive to repeat twice on every request.
1297 */
1298 lck_rw_lock_shared(lck: &udbinfo.ipi_lock);
1299 if (req->oldptr == USER_ADDR_NULL) {
1300 n = udbinfo.ipi_count;
1301 req->oldidx =
1302 2 * (sizeof(xig)) + (n + n / 8) * sizeof(struct xinpcb64);
1303 lck_rw_done(lck: &udbinfo.ipi_lock);
1304 return 0;
1305 }
1306
1307 if (req->newptr != USER_ADDR_NULL) {
1308 lck_rw_done(lck: &udbinfo.ipi_lock);
1309 return EPERM;
1310 }
1311
1312 /*
1313 * OK, now we're committed to doing something.
1314 */
1315 gencnt = udbinfo.ipi_gencnt;
1316 sz = n = udbinfo.ipi_count;
1317
1318 bzero(s: &xig, n: sizeof(xig));
1319 xig.xig_len = sizeof(xig);
1320 xig.xig_count = n;
1321 xig.xig_gen = gencnt;
1322 xig.xig_sogen = so_gencnt;
1323 error = SYSCTL_OUT(req, &xig, sizeof(xig));
1324 if (error) {
1325 lck_rw_done(lck: &udbinfo.ipi_lock);
1326 return error;
1327 }
1328 /*
1329 * We are done if there is no pcb
1330 */
1331 if (n == 0) {
1332 lck_rw_done(lck: &udbinfo.ipi_lock);
1333 return 0;
1334 }
1335
1336 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1337 if (inp_list == NULL) {
1338 lck_rw_done(lck: &udbinfo.ipi_lock);
1339 return ENOMEM;
1340 }
1341
1342 for (inp = LIST_FIRST(udbinfo.ipi_listhead), i = 0; inp && i < n;
1343 inp = LIST_NEXT(inp, inp_list)) {
1344 if (inp->inp_gencnt <= gencnt &&
1345 inp->inp_state != INPCB_STATE_DEAD) {
1346 inp_list[i++] = inp;
1347 }
1348 }
1349 n = i;
1350
1351 error = 0;
1352 for (i = 0; i < n; i++) {
1353 struct xinpcb64 xi;
1354
1355 inp = inp_list[i];
1356
1357 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING) {
1358 continue;
1359 }
1360 udp_lock(inp->inp_socket, 1, 0);
1361 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
1362 udp_unlock(inp->inp_socket, 1, 0);
1363 continue;
1364 }
1365 if (inp->inp_gencnt > gencnt) {
1366 udp_unlock(inp->inp_socket, 1, 0);
1367 continue;
1368 }
1369
1370 bzero(s: &xi, n: sizeof(xi));
1371 xi.xi_len = sizeof(xi);
1372 inpcb_to_xinpcb64(inp, &xi);
1373 if (inp->inp_socket) {
1374 sotoxsocket64(so: inp->inp_socket, xso: &xi.xi_socket);
1375 }
1376
1377 udp_unlock(inp->inp_socket, 1, 0);
1378
1379 error = SYSCTL_OUT(req, &xi, sizeof(xi));
1380 }
1381 if (!error) {
1382 /*
1383 * Give the user an updated idea of our state.
1384 * If the generation differs from what we told
1385 * her before, she knows that something happened
1386 * while we were processing this request, and it
1387 * might be necessary to retry.
1388 */
1389 bzero(s: &xig, n: sizeof(xig));
1390 xig.xig_len = sizeof(xig);
1391 xig.xig_gen = udbinfo.ipi_gencnt;
1392 xig.xig_sogen = so_gencnt;
1393 xig.xig_count = udbinfo.ipi_count;
1394 error = SYSCTL_OUT(req, &xig, sizeof(xig));
1395 }
1396
1397 lck_rw_done(lck: &udbinfo.ipi_lock);
1398 kfree_type(struct inpcb *, sz, inp_list);
1399 return error;
1400}
1401
1402SYSCTL_PROC(_net_inet_udp, OID_AUTO, pcblist64,
1403 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist64,
1404 "S,xinpcb64", "List of active UDP sockets");
1405
1406#endif /* XNU_TARGET_OS_OSX */
1407
1408static int
1409udp_pcblist_n SYSCTL_HANDLER_ARGS
1410{
1411#pragma unused(oidp, arg1, arg2)
1412 return get_pcblist_n(IPPROTO_UDP, req, &udbinfo);
1413}
1414
1415SYSCTL_PROC(_net_inet_udp, OID_AUTO, pcblist_n,
1416 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist_n,
1417 "S,xinpcb_n", "List of active UDP sockets");
1418
1419__private_extern__ void
1420udp_get_ports_used(ifnet_t ifp, int protocol, uint32_t flags,
1421 bitstr_t *bitfield)
1422{
1423 inpcb_get_ports_used(ifp, protocol, flags, bitfield,
1424 &udbinfo);
1425}
1426
1427__private_extern__ uint32_t
1428udp_count_opportunistic(unsigned int ifindex, u_int32_t flags)
1429{
1430 return inpcb_count_opportunistic(ifindex, &udbinfo, flags);
1431}
1432
1433__private_extern__ uint32_t
1434udp_find_anypcb_byaddr(struct ifaddr *ifa)
1435{
1436#if SKYWALK
1437 if (netns_is_enabled()) {
1438 return netns_find_anyres_byaddr(ifa, IPPROTO_UDP);
1439 } else
1440#endif /* SKYWALK */
1441 return inpcb_find_anypcb_byaddr(ifa, &udbinfo);
1442}
1443
1444static int
1445udp_check_pktinfo(struct mbuf *control, struct ifnet **outif,
1446 struct in_addr *laddr)
1447{
1448 struct cmsghdr *cm = 0;
1449 struct in_pktinfo *pktinfo;
1450 struct ifnet *ifp;
1451
1452 if (outif != NULL) {
1453 *outif = NULL;
1454 }
1455
1456 /*
1457 * XXX: Currently, we assume all the optional information is stored
1458 * in a single mbuf.
1459 */
1460 if (control->m_next) {
1461 return EINVAL;
1462 }
1463
1464 if (control->m_len < CMSG_LEN(0)) {
1465 return EINVAL;
1466 }
1467
1468 for (cm = M_FIRST_CMSGHDR(control);
1469 is_cmsg_valid(control, cmsg: cm);
1470 cm = M_NXT_CMSGHDR(control, cm)) {
1471 if (cm->cmsg_level != IPPROTO_IP ||
1472 cm->cmsg_type != IP_PKTINFO) {
1473 continue;
1474 }
1475
1476 if (cm->cmsg_len != CMSG_LEN(sizeof(struct in_pktinfo))) {
1477 return EINVAL;
1478 }
1479
1480 pktinfo = (struct in_pktinfo *)(void *)CMSG_DATA(cm);
1481
1482 /* Check for a valid ifindex in pktinfo */
1483 ifnet_head_lock_shared();
1484
1485 if (pktinfo->ipi_ifindex > if_index) {
1486 ifnet_head_done();
1487 return ENXIO;
1488 }
1489
1490 /*
1491 * If ipi_ifindex is specified it takes precedence
1492 * over ipi_spec_dst.
1493 */
1494 if (pktinfo->ipi_ifindex) {
1495 ifp = ifindex2ifnet[pktinfo->ipi_ifindex];
1496 if (ifp == NULL) {
1497 ifnet_head_done();
1498 return ENXIO;
1499 }
1500 if (outif != NULL) {
1501 ifnet_reference(interface: ifp);
1502 *outif = ifp;
1503 }
1504 ifnet_head_done();
1505 laddr->s_addr = INADDR_ANY;
1506 break;
1507 }
1508
1509 ifnet_head_done();
1510
1511 /*
1512 * Use the provided ipi_spec_dst address for temp
1513 * source address.
1514 */
1515 *laddr = pktinfo->ipi_spec_dst;
1516 break;
1517 }
1518 return 0;
1519}
1520
1521int
1522udp_output(struct inpcb *inp, struct mbuf *m, struct sockaddr *addr,
1523 struct mbuf *control, struct proc *p)
1524{
1525 struct udpiphdr *ui;
1526 int len = m->m_pkthdr.len;
1527 struct sockaddr_in *sin;
1528 struct in_addr origladdr, laddr, faddr, pi_laddr;
1529 u_short lport, fport;
1530 int error = 0, udp_dodisconnect = 0, pktinfo = 0;
1531 struct socket *so = inp->inp_socket;
1532 int soopts = 0;
1533 struct mbuf *inpopts;
1534 struct ip_moptions *mopts;
1535 struct route ro;
1536 struct ip_out_args ipoa;
1537 bool sndinprog_cnt_used = false;
1538#if CONTENT_FILTER
1539 struct m_tag *cfil_tag = NULL;
1540 bool cfil_faddr_use = false;
1541 uint32_t cfil_so_state_change_cnt = 0;
1542 uint32_t cfil_so_options = 0;
1543 struct sockaddr *cfil_faddr = NULL;
1544#endif
1545 bool check_qos_marking_again = (so->so_flags1 & SOF1_QOSMARKING_POLICY_OVERRIDE) ? FALSE : TRUE;
1546
1547 bzero(s: &ipoa, n: sizeof(ipoa));
1548 ipoa.ipoa_boundif = IFSCOPE_NONE;
1549 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF;
1550
1551 struct ifnet *outif = NULL;
1552 struct flowadv *adv = &ipoa.ipoa_flowadv;
1553 int sotc = SO_TC_UNSPEC;
1554 int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
1555 struct ifnet *origoutifp = NULL;
1556 int flowadv = 0;
1557 int tos = IPTOS_UNSPEC;
1558
1559 /* Enable flow advisory only when connected */
1560 flowadv = (so->so_state & SS_ISCONNECTED) ? 1 : 0;
1561 pi_laddr.s_addr = INADDR_ANY;
1562
1563 KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
1564
1565 socket_lock_assert_owned(so);
1566
1567#if CONTENT_FILTER
1568 /*
1569 * If socket is subject to UDP Content Filter and no addr is passed in,
1570 * retrieve CFIL saved state from mbuf and use it if necessary.
1571 */
1572 if (CFIL_DGRAM_FILTERED(so) && !addr) {
1573 cfil_tag = cfil_dgram_get_socket_state(m, state_change_cnt: &cfil_so_state_change_cnt, options: &cfil_so_options, faddr: &cfil_faddr, NULL);
1574 if (cfil_tag) {
1575 sin = SIN(cfil_faddr);
1576 if (inp && inp->inp_faddr.s_addr == INADDR_ANY) {
1577 /*
1578 * Socket is unconnected, simply use the saved faddr as 'addr' to go through
1579 * the connect/disconnect logic.
1580 */
1581 addr = SA(cfil_faddr);
1582 } else if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
1583 (inp->inp_fport != sin->sin_port ||
1584 inp->inp_faddr.s_addr != sin->sin_addr.s_addr)) {
1585 /*
1586 * Socket is connected but socket state and dest addr/port changed.
1587 * We need to use the saved faddr info.
1588 */
1589 cfil_faddr_use = true;
1590 }
1591 }
1592 }
1593#endif
1594
1595 if (control != NULL) {
1596 tos = so_tos_from_control(control);
1597 sotc = so_tc_from_control(control, &netsvctype);
1598 VERIFY(outif == NULL);
1599 error = udp_check_pktinfo(control, outif: &outif, laddr: &pi_laddr);
1600 m_freem(control);
1601 control = NULL;
1602 if (error) {
1603 goto release;
1604 }
1605 if (outif != NULL) {
1606 pktinfo++;
1607 ipoa.ipoa_boundif = outif->if_index;
1608 }
1609 }
1610 if (sotc == SO_TC_UNSPEC) {
1611 sotc = so->so_traffic_class;
1612 netsvctype = so->so_netsvctype;
1613 }
1614
1615 KERNEL_DEBUG(DBG_LAYER_OUT_BEG, inp->inp_fport, inp->inp_lport,
1616 inp->inp_laddr.s_addr, inp->inp_faddr.s_addr,
1617 (htons((u_short)len + sizeof(struct udphdr))));
1618
1619 if (len + sizeof(struct udpiphdr) > IP_MAXPACKET) {
1620 error = EMSGSIZE;
1621 goto release;
1622 }
1623
1624 if (flowadv && INP_WAIT_FOR_IF_FEEDBACK(inp)) {
1625 /*
1626 * The socket is flow-controlled, drop the packets
1627 * until the inp is not flow controlled
1628 */
1629 error = ENOBUFS;
1630 goto release;
1631 }
1632 /*
1633 * If socket was bound to an ifindex, tell ip_output about it.
1634 * If the ancillary IP_PKTINFO option contains an interface index,
1635 * it takes precedence over the one specified by IP_BOUND_IF.
1636 */
1637 if (ipoa.ipoa_boundif == IFSCOPE_NONE &&
1638 (inp->inp_flags & INP_BOUND_IF)) {
1639 VERIFY(inp->inp_boundifp != NULL);
1640 ifnet_reference(interface: inp->inp_boundifp); /* for this routine */
1641 if (outif != NULL) {
1642 ifnet_release(interface: outif);
1643 }
1644 outif = inp->inp_boundifp;
1645 ipoa.ipoa_boundif = outif->if_index;
1646 }
1647 if (INP_NO_CELLULAR(inp)) {
1648 ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
1649 }
1650 if (INP_NO_EXPENSIVE(inp)) {
1651 ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
1652 }
1653 if (INP_NO_CONSTRAINED(inp)) {
1654 ipoa.ipoa_flags |= IPOAF_NO_CONSTRAINED;
1655 }
1656 if (INP_AWDL_UNRESTRICTED(inp)) {
1657 ipoa.ipoa_flags |= IPOAF_AWDL_UNRESTRICTED;
1658 }
1659 if (INP_MANAGEMENT_ALLOWED(inp)) {
1660 ipoa.ipoa_flags |= IPOAF_MANAGEMENT_ALLOWED;
1661 }
1662 ipoa.ipoa_sotc = sotc;
1663 ipoa.ipoa_netsvctype = netsvctype;
1664 soopts |= IP_OUTARGS;
1665
1666 /*
1667 * If there was a routing change, discard cached route and check
1668 * that we have a valid source address. Reacquire a new source
1669 * address if INADDR_ANY was specified.
1670 *
1671 * If we are using cfil saved state, go through this cache cleanup
1672 * so that we can get a new route.
1673 */
1674 if (ROUTE_UNUSABLE(&inp->inp_route)
1675#if CONTENT_FILTER
1676 || cfil_faddr_use
1677#endif
1678 ) {
1679 struct in_ifaddr *ia = NULL;
1680
1681 ROUTE_RELEASE(&inp->inp_route);
1682
1683 /* src address is gone? */
1684 if (inp->inp_laddr.s_addr != INADDR_ANY &&
1685 (ia = ifa_foraddr(inp->inp_laddr.s_addr)) == NULL) {
1686 if (!(inp->inp_flags & INP_INADDR_ANY) ||
1687 (so->so_state & SS_ISCONNECTED)) {
1688 /*
1689 * Rdar://5448998
1690 * If the source address is gone, return an
1691 * error if:
1692 * - the source was specified
1693 * - the socket was already connected
1694 */
1695 soevent(so, hint: (SO_FILT_HINT_LOCKED |
1696 SO_FILT_HINT_NOSRCADDR));
1697 error = EADDRNOTAVAIL;
1698 goto release;
1699 } else {
1700 /* new src will be set later */
1701 inp->inp_laddr.s_addr = INADDR_ANY;
1702 inp->inp_last_outifp = NULL;
1703#if SKYWALK
1704 if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
1705 netns_set_ifnet(token: &inp->inp_netns_token, NULL);
1706 }
1707#endif /* SKYWALK */
1708 }
1709 }
1710 if (ia != NULL) {
1711 ifa_remref(ifa: &ia->ia_ifa);
1712 }
1713 }
1714
1715 /*
1716 * IP_PKTINFO option check. If a temporary scope or src address
1717 * is provided, use it for this packet only and make sure we forget
1718 * it after sending this datagram.
1719 */
1720 if (pi_laddr.s_addr != INADDR_ANY ||
1721 (ipoa.ipoa_boundif != IFSCOPE_NONE && pktinfo)) {
1722 /* temp src address for this datagram only */
1723 laddr = pi_laddr;
1724 origladdr.s_addr = INADDR_ANY;
1725 /* we don't want to keep the laddr or route */
1726 udp_dodisconnect = 1;
1727 /* remember we don't care about src addr */
1728 inp->inp_flags |= INP_INADDR_ANY;
1729 } else {
1730 origladdr = laddr = inp->inp_laddr;
1731 }
1732
1733 origoutifp = inp->inp_last_outifp;
1734 faddr = inp->inp_faddr;
1735 lport = inp->inp_lport;
1736 fport = inp->inp_fport;
1737
1738#if CONTENT_FILTER
1739 if (cfil_faddr_use) {
1740 faddr = SIN(cfil_faddr)->sin_addr;
1741 fport = SIN(cfil_faddr)->sin_port;
1742 }
1743#endif
1744 inp->inp_sndinprog_cnt++;
1745 sndinprog_cnt_used = true;
1746
1747 if (addr) {
1748 sin = SIN(addr);
1749 if (faddr.s_addr != INADDR_ANY) {
1750 error = EISCONN;
1751 goto release;
1752 }
1753 if (lport == 0) {
1754 /*
1755 * In case we don't have a local port set, go through
1756 * the full connect. We don't have a local port yet
1757 * (i.e., we can't be looked up), so it's not an issue
1758 * if the input runs at the same time we do this.
1759 */
1760 /* if we have a source address specified, use that */
1761 if (pi_laddr.s_addr != INADDR_ANY) {
1762 inp->inp_laddr = pi_laddr;
1763 }
1764 /*
1765 * If a scope is specified, use it. Scope from
1766 * IP_PKTINFO takes precendence over the the scope
1767 * set via INP_BOUND_IF.
1768 */
1769 error = in_pcbconnect(inp, addr, p, ipoa.ipoa_boundif,
1770 &outif);
1771 if (error) {
1772 goto release;
1773 }
1774
1775 laddr = inp->inp_laddr;
1776 lport = inp->inp_lport;
1777 faddr = inp->inp_faddr;
1778 fport = inp->inp_fport;
1779 udp_dodisconnect = 1;
1780
1781 /* synch up in case in_pcbladdr() overrides */
1782 if (outif != NULL && ipoa.ipoa_boundif != IFSCOPE_NONE) {
1783 ipoa.ipoa_boundif = outif->if_index;
1784 }
1785 } else {
1786 /*
1787 * Fast path case
1788 *
1789 * We have a full address and a local port; use those
1790 * info to build the packet without changing the pcb
1791 * and interfering with the input path. See 3851370.
1792 *
1793 * Scope from IP_PKTINFO takes precendence over the
1794 * the scope set via INP_BOUND_IF.
1795 */
1796 if (laddr.s_addr == INADDR_ANY) {
1797 if ((error = in_pcbladdr(inp, addr, &laddr,
1798 ipoa.ipoa_boundif, &outif, 0)) != 0) {
1799 goto release;
1800 }
1801 /*
1802 * from pcbconnect: remember we don't
1803 * care about src addr.
1804 */
1805 inp->inp_flags |= INP_INADDR_ANY;
1806
1807 /* synch up in case in_pcbladdr() overrides */
1808 if (outif != NULL &&
1809 ipoa.ipoa_boundif != IFSCOPE_NONE) {
1810 ipoa.ipoa_boundif = outif->if_index;
1811 }
1812 }
1813
1814 faddr = sin->sin_addr;
1815 fport = sin->sin_port;
1816 }
1817 } else {
1818 if (faddr.s_addr == INADDR_ANY) {
1819 error = ENOTCONN;
1820 goto release;
1821 }
1822 }
1823
1824 if (inp->inp_flowhash == 0) {
1825 inp_calc_flowhash(inp);
1826 ASSERT(inp->inp_flowhash != 0);
1827 }
1828
1829 if (fport == htons(53) && !(so->so_flags1 & SOF1_DNS_COUNTED)) {
1830 so->so_flags1 |= SOF1_DNS_COUNTED;
1831 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_dns);
1832 }
1833
1834 /*
1835 * Calculate data length and get a mbuf
1836 * for UDP and IP headers.
1837 */
1838 M_PREPEND(m, sizeof(struct udpiphdr), M_DONTWAIT, 1);
1839 if (m == 0) {
1840 error = ENOBUFS;
1841 goto abort;
1842 }
1843
1844 /*
1845 * Fill in mbuf with extended UDP header
1846 * and addresses and length put into network format.
1847 */
1848 ui = mtod(m, struct udpiphdr *);
1849 bzero(s: ui->ui_x1, n: sizeof(ui->ui_x1)); /* XXX still needed? */
1850 ui->ui_pr = IPPROTO_UDP;
1851 ui->ui_src = laddr;
1852 ui->ui_dst = faddr;
1853 ui->ui_sport = lport;
1854 ui->ui_dport = fport;
1855 ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
1856
1857 /*
1858 * Set the Don't Fragment bit in the IP header.
1859 */
1860 if (inp->inp_flags2 & INP2_DONTFRAG) {
1861 struct ip *ip;
1862
1863 ip = (struct ip *)&ui->ui_i;
1864 ip->ip_off |= IP_DF;
1865 }
1866
1867 /*
1868 * Set up checksum to pseudo header checksum and output datagram.
1869 *
1870 * Treat flows to be CLAT46'd as IPv6 flow and compute checksum
1871 * no matter what, as IPv6 mandates checksum for UDP.
1872 *
1873 * Here we only compute the one's complement sum of the pseudo header.
1874 * The payload computation and final complement is delayed to much later
1875 * in IP processing to decide if remaining computation needs to be done
1876 * through offload.
1877 *
1878 * That is communicated by setting CSUM_UDP in csum_flags.
1879 * The offset of checksum from the start of ULP header is communicated
1880 * through csum_data.
1881 *
1882 * Note since this already contains the pseudo checksum header, any
1883 * later operation at IP layer that modify the values used here must
1884 * update the checksum as well (for example NAT etc).
1885 */
1886 if ((inp->inp_flags2 & INP2_CLAT46_FLOW) ||
1887 (udpcksum && !(inp->inp_flags & INP_UDP_NOCKSUM))) {
1888 ui->ui_sum = in_pseudo(ui->ui_src.s_addr, ui->ui_dst.s_addr,
1889 htons((u_short)len + sizeof(struct udphdr) + IPPROTO_UDP));
1890 m->m_pkthdr.csum_flags = (CSUM_UDP | CSUM_ZERO_INVERT);
1891 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
1892 } else {
1893 ui->ui_sum = 0;
1894 }
1895 ((struct ip *)ui)->ip_len = (uint16_t)(sizeof(struct udpiphdr) + len);
1896 ((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl; /* XXX */
1897 if (tos != IPTOS_UNSPEC) {
1898 ((struct ip *)ui)->ip_tos = (uint8_t)(tos & IPTOS_MASK);
1899 } else {
1900 ((struct ip *)ui)->ip_tos = inp->inp_ip_tos; /* XXX */
1901 }
1902 udpstat.udps_opackets++;
1903
1904 KERNEL_DEBUG(DBG_LAYER_OUT_END, ui->ui_dport, ui->ui_sport,
1905 ui->ui_src.s_addr, ui->ui_dst.s_addr, ui->ui_ulen);
1906
1907#if NECP
1908 {
1909 necp_kernel_policy_id policy_id;
1910 necp_kernel_policy_id skip_policy_id;
1911 u_int32_t route_rule_id;
1912 u_int32_t pass_flags;
1913
1914 /*
1915 * We need a route to perform NECP route rule checks
1916 */
1917 if (net_qos_policy_restricted != 0 &&
1918 ROUTE_UNUSABLE(&inp->inp_route)) {
1919 struct sockaddr_in to;
1920 struct sockaddr_in from;
1921
1922 ROUTE_RELEASE(&inp->inp_route);
1923
1924 SOCKADDR_ZERO(&from, sizeof(struct sockaddr_in));
1925 from.sin_family = AF_INET;
1926 from.sin_len = sizeof(struct sockaddr_in);
1927 from.sin_addr = laddr;
1928
1929 SOCKADDR_ZERO(&to, sizeof(struct sockaddr_in));
1930 to.sin_family = AF_INET;
1931 to.sin_len = sizeof(struct sockaddr_in);
1932 to.sin_addr = faddr;
1933
1934 inp->inp_route.ro_dst.sa_family = AF_INET;
1935 inp->inp_route.ro_dst.sa_len = sizeof(struct sockaddr_in);
1936 SIN(&inp->inp_route.ro_dst)->sin_addr = faddr;
1937
1938 rtalloc_scoped(&inp->inp_route, ipoa.ipoa_boundif);
1939
1940 inp_update_necp_policy(inp, SA(&from),
1941 SA(&to), ipoa.ipoa_boundif);
1942 inp->inp_policyresult.results.qos_marking_gencount = 0;
1943 }
1944
1945 if (!necp_socket_is_allowed_to_send_recv_v4(inp, local_port: lport, remote_port: fport,
1946 local_addr: &laddr, remote_addr: &faddr, NULL, pf_tag: 0, return_policy_id: &policy_id, return_route_rule_id: &route_rule_id, return_skip_policy_id: &skip_policy_id, return_pass_flags: &pass_flags)) {
1947 error = EHOSTUNREACH;
1948 goto abort;
1949 }
1950
1951 necp_mark_packet_from_socket(packet: m, inp, policy_id, route_rule_id, skip_policy_id, pass_flags);
1952
1953 if (net_qos_policy_restricted != 0) {
1954 necp_socket_update_qos_marking(inp, route: inp->inp_route.ro_rt, route_rule_id);
1955 }
1956 }
1957#endif /* NECP */
1958 if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
1959 ipoa.ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
1960 }
1961 if (check_qos_marking_again) {
1962 ipoa.ipoa_flags |= IPOAF_REDO_QOSMARKING_POLICY;
1963 }
1964 ipoa.qos_marking_gencount = inp->inp_policyresult.results.qos_marking_gencount;
1965
1966#if IPSEC
1967 if (inp->inp_sp != NULL && ipsec_setsocket(m, inp->inp_socket) != 0) {
1968 error = ENOBUFS;
1969 goto abort;
1970 }
1971#endif /* IPSEC */
1972
1973 inpopts = inp->inp_options;
1974#if CONTENT_FILTER
1975 if (cfil_tag && (inp->inp_socket->so_options != cfil_so_options)) {
1976 soopts |= (cfil_so_options & (SO_DONTROUTE | SO_BROADCAST));
1977 } else
1978#endif
1979 soopts |= (inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST));
1980
1981 mopts = inp->inp_moptions;
1982 if (mopts != NULL) {
1983 IMO_LOCK(mopts);
1984 IMO_ADDREF_LOCKED(mopts);
1985 if (IN_MULTICAST(ntohl(ui->ui_dst.s_addr)) &&
1986 mopts->imo_multicast_ifp != NULL) {
1987 /* no reference needed */
1988 inp->inp_last_outifp = mopts->imo_multicast_ifp;
1989#if SKYWALK
1990 if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
1991 netns_set_ifnet(token: &inp->inp_netns_token,
1992 ifp: inp->inp_last_outifp);
1993 }
1994#endif /* SKYWALK */
1995 }
1996 IMO_UNLOCK(mopts);
1997 }
1998
1999 /* Copy the cached route and take an extra reference */
2000 inp_route_copyout(inp, &ro);
2001
2002 set_packet_service_class(m, so, sotc, 0);
2003 m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
2004 m->m_pkthdr.pkt_flowid = inp->inp_flowhash;
2005 m->m_pkthdr.pkt_proto = IPPROTO_UDP;
2006 m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC);
2007 if (flowadv) {
2008 m->m_pkthdr.pkt_flags |= PKTF_FLOW_ADV;
2009 }
2010 m->m_pkthdr.tx_udp_pid = so->last_pid;
2011 if (so->so_flags & SOF_DELEGATED) {
2012 m->m_pkthdr.tx_udp_e_pid = so->e_pid;
2013 } else {
2014 m->m_pkthdr.tx_udp_e_pid = 0;
2015 }
2016#if (DEBUG || DEVELOPMENT)
2017 if (so->so_flags & SOF_MARK_WAKE_PKT) {
2018 so->so_flags &= ~SOF_MARK_WAKE_PKT;
2019 m->m_pkthdr.pkt_flags |= PKTF_WAKE_PKT;
2020 }
2021#endif /* (DEBUG || DEVELOPMENT) */
2022
2023 m_add_crumb(m, PKT_CRUMB_UDP_OUTPUT);
2024
2025 if (ipoa.ipoa_boundif != IFSCOPE_NONE) {
2026 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
2027 }
2028
2029 if (laddr.s_addr != INADDR_ANY) {
2030 ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
2031 }
2032
2033 socket_unlock(so, refcount: 0);
2034 error = ip_output(m, inpopts, &ro, soopts, mopts, &ipoa);
2035 m = NULL;
2036 socket_lock(so, refcount: 0);
2037 if (mopts != NULL) {
2038 IMO_REMREF(mopts);
2039 }
2040
2041 if (check_qos_marking_again) {
2042 inp->inp_policyresult.results.qos_marking_gencount = ipoa.qos_marking_gencount;
2043
2044 if (ipoa.ipoa_flags & IPOAF_QOSMARKING_ALLOWED) {
2045 inp->inp_socket->so_flags1 |= SOF1_QOSMARKING_ALLOWED;
2046 } else {
2047 inp->inp_socket->so_flags1 &= ~SOF1_QOSMARKING_ALLOWED;
2048 }
2049 }
2050
2051 if (error == 0 && nstat_collect) {
2052 boolean_t cell, wifi, wired;
2053
2054 if (ro.ro_rt != NULL) {
2055 cell = IFNET_IS_CELLULAR(ro.ro_rt->rt_ifp);
2056 wifi = (!cell && IFNET_IS_WIFI(ro.ro_rt->rt_ifp));
2057 wired = (!wifi && IFNET_IS_WIRED(ro.ro_rt->rt_ifp));
2058 } else {
2059 cell = wifi = wired = FALSE;
2060 }
2061 INP_ADD_STAT(inp, cell, wifi, wired, txpackets, 1);
2062 INP_ADD_STAT(inp, cell, wifi, wired, txbytes, len);
2063 inp_set_activity_bitmap(inp);
2064 }
2065
2066 if (flowadv && (adv->code == FADV_FLOW_CONTROLLED ||
2067 adv->code == FADV_SUSPENDED)) {
2068 /*
2069 * return a hint to the application that
2070 * the packet has been dropped
2071 */
2072 error = ENOBUFS;
2073 inp_set_fc_state(inp, advcode: adv->code);
2074 }
2075
2076 /* Synchronize PCB cached route */
2077 inp_route_copyin(inp, &ro);
2078
2079 if (inp->inp_route.ro_rt != NULL) {
2080 if (IS_LOCALNET_ROUTE(inp->inp_route.ro_rt)) {
2081 inp->inp_flags2 |= INP2_LAST_ROUTE_LOCAL;
2082 } else {
2083 inp->inp_flags2 &= ~INP2_LAST_ROUTE_LOCAL;
2084 }
2085 }
2086
2087abort:
2088 if (udp_dodisconnect) {
2089 /* Always discard the cached route for unconnected socket */
2090 ROUTE_RELEASE(&inp->inp_route);
2091 in_pcbdisconnect(inp);
2092 inp->inp_laddr = origladdr; /* XXX rehash? */
2093 /* no reference needed */
2094 inp->inp_last_outifp = origoutifp;
2095#if SKYWALK
2096 if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2097 netns_set_ifnet(token: &inp->inp_netns_token,
2098 ifp: inp->inp_last_outifp);
2099 }
2100#endif /* SKYWALK */
2101 } else if (inp->inp_route.ro_rt != NULL) {
2102 struct rtentry *rt = inp->inp_route.ro_rt;
2103 struct ifnet *outifp;
2104
2105 if (rt->rt_flags & (RTF_MULTICAST | RTF_BROADCAST)) {
2106 rt = NULL; /* unusable */
2107 }
2108#if CONTENT_FILTER
2109 /*
2110 * Discard temporary route for cfil case
2111 */
2112 if (cfil_faddr_use) {
2113 rt = NULL; /* unusable */
2114 }
2115#endif
2116
2117 /*
2118 * Always discard if it is a multicast or broadcast route.
2119 */
2120 if (rt == NULL) {
2121 ROUTE_RELEASE(&inp->inp_route);
2122 }
2123
2124 /*
2125 * If the destination route is unicast, update outifp with
2126 * that of the route interface used by IP.
2127 */
2128 if (rt != NULL &&
2129 (outifp = rt->rt_ifp) != inp->inp_last_outifp) {
2130 inp->inp_last_outifp = outifp; /* no reference needed */
2131#if SKYWALK
2132 if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2133 netns_set_ifnet(token: &inp->inp_netns_token,
2134 ifp: inp->inp_last_outifp);
2135 }
2136#endif /* SKYWALK */
2137
2138 so->so_pktheadroom = (uint16_t)P2ROUNDUP(
2139 sizeof(struct udphdr) +
2140 sizeof(struct ip) +
2141 ifnet_hdrlen(outifp) +
2142 ifnet_mbuf_packetpreamblelen(outifp),
2143 sizeof(u_int32_t));
2144 }
2145 } else {
2146 ROUTE_RELEASE(&inp->inp_route);
2147 }
2148
2149 /*
2150 * If output interface was cellular/expensive, and this socket is
2151 * denied access to it, generate an event.
2152 */
2153 if (error != 0 && (ipoa.ipoa_flags & IPOAF_R_IFDENIED) &&
2154 (INP_NO_CELLULAR(inp) || INP_NO_EXPENSIVE(inp) || INP_NO_CONSTRAINED(inp))) {
2155 soevent(so, hint: (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
2156 }
2157
2158release:
2159 KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_END, error, 0, 0, 0, 0);
2160
2161 if (m != NULL) {
2162 m_freem(m);
2163 }
2164
2165 if (outif != NULL) {
2166 ifnet_release(interface: outif);
2167 }
2168
2169#if CONTENT_FILTER
2170 if (cfil_tag) {
2171 m_tag_free(cfil_tag);
2172 }
2173#endif
2174 if (sndinprog_cnt_used) {
2175 VERIFY(inp->inp_sndinprog_cnt > 0);
2176 if (--inp->inp_sndinprog_cnt == 0) {
2177 inp->inp_flags &= ~(INP_FC_FEEDBACK);
2178 if (inp->inp_sndingprog_waiters > 0) {
2179 wakeup(chan: &inp->inp_sndinprog_cnt);
2180 }
2181 }
2182 sndinprog_cnt_used = false;
2183 }
2184
2185 return error;
2186}
2187
2188u_int32_t udp_sendspace = 9216; /* really max datagram size */
2189/* 187 1K datagrams (approx 192 KB) */
2190u_int32_t udp_recvspace = 187 * (1024 + sizeof(struct sockaddr_in6));
2191
2192/* Check that the values of udp send and recv space do not exceed sb_max */
2193static int
2194sysctl_udp_sospace(struct sysctl_oid *oidp, void *arg1, int arg2,
2195 struct sysctl_req *req)
2196{
2197#pragma unused(arg1, arg2)
2198 u_int32_t new_value = 0, *space_p = NULL;
2199 int changed = 0, error = 0;
2200
2201 switch (oidp->oid_number) {
2202 case UDPCTL_RECVSPACE:
2203 space_p = &udp_recvspace;
2204 break;
2205 case UDPCTL_MAXDGRAM:
2206 space_p = &udp_sendspace;
2207 break;
2208 default:
2209 return EINVAL;
2210 }
2211 error = sysctl_io_number(req, bigValue: *space_p, valueSize: sizeof(u_int32_t),
2212 pValue: &new_value, changed: &changed);
2213 if (changed) {
2214 if (new_value > 0 && new_value <= sb_max) {
2215 *space_p = new_value;
2216 } else {
2217 error = ERANGE;
2218 }
2219 }
2220 return error;
2221}
2222
2223SYSCTL_PROC(_net_inet_udp, UDPCTL_RECVSPACE, recvspace,
2224 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &udp_recvspace, 0,
2225 &sysctl_udp_sospace, "IU", "Maximum incoming UDP datagram size");
2226
2227SYSCTL_PROC(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram,
2228 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &udp_sendspace, 0,
2229 &sysctl_udp_sospace, "IU", "Maximum outgoing UDP datagram size");
2230
2231int
2232udp_abort(struct socket *so)
2233{
2234 struct inpcb *inp;
2235
2236 inp = sotoinpcb(so);
2237 if (inp == NULL) {
2238 panic("%s: so=%p null inp", __func__, so);
2239 /* NOTREACHED */
2240 }
2241 soisdisconnected(so);
2242 in_pcbdetach(inp);
2243 return 0;
2244}
2245
2246int
2247udp_attach(struct socket *so, int proto, struct proc *p)
2248{
2249#pragma unused(proto)
2250 struct inpcb *inp;
2251 int error;
2252
2253 error = soreserve(so, sndcc: udp_sendspace, rcvcc: udp_recvspace);
2254 if (error != 0) {
2255 return error;
2256 }
2257 inp = sotoinpcb(so);
2258 if (inp != NULL) {
2259 panic("%s so=%p inp=%p", __func__, so, inp);
2260 /* NOTREACHED */
2261 }
2262 error = in_pcballoc(so, &udbinfo, p);
2263 if (error != 0) {
2264 return error;
2265 }
2266 inp = (struct inpcb *)so->so_pcb;
2267 inp->inp_vflag |= INP_IPV4;
2268 inp->inp_ip_ttl = (uint8_t)ip_defttl;
2269 if (nstat_collect) {
2270 nstat_udp_new_pcb(inp);
2271 }
2272 return 0;
2273}
2274
2275int
2276udp_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
2277{
2278 struct inpcb *inp;
2279 int error;
2280
2281 if (nam->sa_family != 0 && nam->sa_family != AF_INET &&
2282 nam->sa_family != AF_INET6) {
2283 return EAFNOSUPPORT;
2284 }
2285
2286 inp = sotoinpcb(so);
2287 if (inp == NULL) {
2288 return EINVAL;
2289 }
2290 error = in_pcbbind(inp, nam, p);
2291
2292#if NECP
2293 /* Update NECP client with bind result if not in middle of connect */
2294 if (error == 0 &&
2295 (inp->inp_flags2 & INP2_CONNECT_IN_PROGRESS) &&
2296 !uuid_is_null(uu: inp->necp_client_uuid)) {
2297 socket_unlock(so, refcount: 0);
2298 necp_client_assign_from_socket(pid: so->last_pid, client_id: inp->necp_client_uuid, inp);
2299 socket_lock(so, refcount: 0);
2300 }
2301#endif /* NECP */
2302
2303 UDP_LOG_BIND(inp, error);
2304
2305 return error;
2306}
2307
2308int
2309udp_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
2310{
2311 struct inpcb *inp;
2312 int error;
2313
2314 inp = sotoinpcb(so);
2315 if (inp == NULL) {
2316 return EINVAL;
2317 }
2318 if (inp->inp_faddr.s_addr != INADDR_ANY) {
2319 return EISCONN;
2320 }
2321
2322 if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
2323 so->so_flags1 |= SOF1_CONNECT_COUNTED;
2324 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
2325 }
2326
2327#if NECP
2328#if FLOW_DIVERT
2329 if (necp_socket_should_use_flow_divert(inp)) {
2330 error = flow_divert_pcb_init(so);
2331 if (error == 0) {
2332 error = flow_divert_connect_out(so, to: nam, p);
2333 }
2334 UDP_LOG_CONNECT(inp, error);
2335 return error;
2336 } else {
2337 so->so_flags1 |= SOF1_FLOW_DIVERT_SKIP;
2338 }
2339#endif /* FLOW_DIVERT */
2340#endif /* NECP */
2341
2342 error = in_pcbconnect(inp, nam, p, IFSCOPE_NONE, NULL);
2343 if (error == 0) {
2344#if NECP
2345 /* Update NECP client with connected five-tuple */
2346 if (!uuid_is_null(uu: inp->necp_client_uuid)) {
2347 socket_unlock(so, refcount: 0);
2348 necp_client_assign_from_socket(pid: so->last_pid, client_id: inp->necp_client_uuid, inp);
2349 socket_lock(so, refcount: 0);
2350 }
2351#endif /* NECP */
2352
2353 soisconnected(so);
2354 if (inp->inp_flowhash == 0) {
2355 inp_calc_flowhash(inp);
2356 ASSERT(inp->inp_flowhash != 0);
2357 }
2358 inp->inp_connect_timestamp = mach_continuous_time();
2359 }
2360 UDP_LOG_CONNECT(inp, error);
2361 return error;
2362}
2363
2364int
2365udp_connectx_common(struct socket *so, int af, struct sockaddr *src, struct sockaddr *dst,
2366 struct proc *p, uint32_t ifscope, sae_associd_t aid, sae_connid_t *pcid,
2367 uint32_t flags, void *arg, uint32_t arglen,
2368 struct uio *uio, user_ssize_t *bytes_written)
2369{
2370#pragma unused(aid, flags, arg, arglen)
2371 struct inpcb *inp = sotoinpcb(so);
2372 int error = 0;
2373 user_ssize_t datalen = 0;
2374
2375 if (inp == NULL) {
2376 return EINVAL;
2377 }
2378
2379 VERIFY(dst != NULL);
2380
2381 ASSERT(!(inp->inp_flags2 & INP2_CONNECT_IN_PROGRESS));
2382 inp->inp_flags2 |= INP2_CONNECT_IN_PROGRESS;
2383
2384#if NECP
2385 inp_update_necp_policy(inp, src, dst, ifscope);
2386#endif /* NECP */
2387
2388 /* bind socket to the specified interface, if requested */
2389 if (ifscope != IFSCOPE_NONE &&
2390 (error = inp_bindif(inp, ifscope, NULL)) != 0) {
2391 goto done;
2392 }
2393
2394 /* if source address and/or port is specified, bind to it */
2395 if (src != NULL) {
2396 error = sobindlock(so, nam: src, dolock: 0); /* already locked */
2397 if (error != 0) {
2398 goto done;
2399 }
2400 }
2401
2402 switch (af) {
2403 case AF_INET:
2404 error = udp_connect(so, nam: dst, p);
2405 break;
2406 case AF_INET6:
2407 error = udp6_connect(so, dst, p);
2408 break;
2409 default:
2410 VERIFY(0);
2411 /* NOTREACHED */
2412 }
2413
2414 if (error != 0) {
2415 goto done;
2416 }
2417
2418 /*
2419 * If there is data, copy it. DATA_IDEMPOTENT is ignored.
2420 * CONNECT_RESUME_ON_READ_WRITE is ignored.
2421 */
2422 if (uio != NULL) {
2423 socket_unlock(so, refcount: 0);
2424
2425 VERIFY(bytes_written != NULL);
2426
2427 datalen = uio_resid(a_uio: uio);
2428 error = so->so_proto->pr_usrreqs->pru_sosend(so, NULL,
2429 (uio_t)uio, NULL, NULL, 0);
2430 socket_lock(so, refcount: 0);
2431
2432 /* If error returned is EMSGSIZE, for example, disconnect */
2433 if (error == 0 || error == EWOULDBLOCK) {
2434 *bytes_written = datalen - uio_resid(a_uio: uio);
2435 } else {
2436 (void) so->so_proto->pr_usrreqs->pru_disconnectx(so,
2437 SAE_ASSOCID_ANY, SAE_CONNID_ANY);
2438 }
2439 /*
2440 * mask the EWOULDBLOCK error so that the caller
2441 * knows that atleast the connect was successful.
2442 */
2443 if (error == EWOULDBLOCK) {
2444 error = 0;
2445 }
2446 }
2447
2448 if (error == 0 && pcid != NULL) {
2449 *pcid = 1; /* there is only 1 connection for UDP */
2450 }
2451done:
2452 inp->inp_flags2 &= ~INP2_CONNECT_IN_PROGRESS;
2453 return error;
2454}
2455
2456int
2457udp_connectx(struct socket *so, struct sockaddr *src,
2458 struct sockaddr *dst, struct proc *p, uint32_t ifscope,
2459 sae_associd_t aid, sae_connid_t *pcid, uint32_t flags, void *arg,
2460 uint32_t arglen, struct uio *uio, user_ssize_t *bytes_written)
2461{
2462 return udp_connectx_common(so, AF_INET, src, dst,
2463 p, ifscope, aid, pcid, flags, arg, arglen, uio, bytes_written);
2464}
2465
2466int
2467udp_detach(struct socket *so)
2468{
2469 struct inpcb *inp;
2470
2471 inp = sotoinpcb(so);
2472 if (inp == NULL) {
2473 panic("%s: so=%p null inp", __func__, so);
2474 /* NOTREACHED */
2475 }
2476
2477 /*
2478 * If this is a socket that does not want to wakeup the device
2479 * for it's traffic, the application might be waiting for
2480 * close to complete before going to sleep. Send a notification
2481 * for this kind of sockets
2482 */
2483 if (so->so_options & SO_NOWAKEFROMSLEEP) {
2484 socket_post_kev_msg_closed(so);
2485 }
2486
2487 UDP_LOG_CONNECTION_SUMMARY(inp);
2488
2489 in_pcbdetach(inp);
2490 inp->inp_state = INPCB_STATE_DEAD;
2491 return 0;
2492}
2493
2494int
2495udp_disconnect(struct socket *so)
2496{
2497 struct inpcb *inp;
2498
2499 inp = sotoinpcb(so);
2500 if (inp == NULL) {
2501 return EINVAL;
2502 }
2503 if (inp->inp_faddr.s_addr == INADDR_ANY) {
2504 return ENOTCONN;
2505 }
2506
2507 UDP_LOG_CONNECTION_SUMMARY(inp);
2508
2509 in_pcbdisconnect(inp);
2510
2511 /* reset flow controlled state, just in case */
2512 inp_reset_fc_state(inp);
2513
2514 inp->inp_laddr.s_addr = INADDR_ANY;
2515 so->so_state &= ~SS_ISCONNECTED; /* XXX */
2516 inp->inp_last_outifp = NULL;
2517#if SKYWALK
2518 if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2519 netns_set_ifnet(token: &inp->inp_netns_token, NULL);
2520 }
2521#endif /* SKYWALK */
2522
2523 return 0;
2524}
2525
2526int
2527udp_disconnectx(struct socket *so, sae_associd_t aid, sae_connid_t cid)
2528{
2529#pragma unused(cid)
2530 if (aid != SAE_ASSOCID_ANY && aid != SAE_ASSOCID_ALL) {
2531 return EINVAL;
2532 }
2533
2534 return udp_disconnect(so);
2535}
2536
2537int
2538udp_send(struct socket *so, int flags, struct mbuf *m,
2539 struct sockaddr *addr, struct mbuf *control, struct proc *p)
2540{
2541#ifndef FLOW_DIVERT
2542#pragma unused(flags)
2543#endif /* !(FLOW_DIVERT) */
2544 struct inpcb *inp;
2545 int error;
2546
2547 inp = sotoinpcb(so);
2548 if (inp == NULL) {
2549 if (m != NULL) {
2550 m_freem(m);
2551 }
2552 if (control != NULL) {
2553 m_freem(control);
2554 }
2555 return EINVAL;
2556 }
2557
2558#if NECP
2559#if FLOW_DIVERT
2560 if (necp_socket_should_use_flow_divert(inp)) {
2561 /* Implicit connect */
2562 return flow_divert_implicit_data_out(so, flags, data: m, to: addr,
2563 control, p);
2564 } else {
2565 so->so_flags1 |= SOF1_FLOW_DIVERT_SKIP;
2566 }
2567#endif /* FLOW_DIVERT */
2568#endif /* NECP */
2569
2570#if SKYWALK
2571 sk_protect_t protect = sk_async_transmit_protect();
2572#endif /* SKYWALK */
2573 error = udp_output(inp, m, addr, control, p);
2574#if SKYWALK
2575 sk_async_transmit_unprotect(protect);
2576#endif /* SKYWALK */
2577
2578 return error;
2579}
2580
2581int
2582udp_shutdown(struct socket *so)
2583{
2584 struct inpcb *inp;
2585
2586 inp = sotoinpcb(so);
2587 if (inp == NULL) {
2588 return EINVAL;
2589 }
2590 socantsendmore(so);
2591 return 0;
2592}
2593
2594int
2595udp_lock(struct socket *so, int refcount, void *debug)
2596{
2597 void *lr_saved;
2598
2599 if (debug == NULL) {
2600 lr_saved = __builtin_return_address(0);
2601 } else {
2602 lr_saved = debug;
2603 }
2604
2605 if (so->so_pcb != NULL) {
2606 LCK_MTX_ASSERT(&((struct inpcb *)so->so_pcb)->inpcb_mtx,
2607 LCK_MTX_ASSERT_NOTOWNED);
2608 lck_mtx_lock(lck: &((struct inpcb *)so->so_pcb)->inpcb_mtx);
2609 } else {
2610 panic("%s: so=%p NO PCB! lr=%p lrh= %s", __func__,
2611 so, lr_saved, solockhistory_nr(so));
2612 /* NOTREACHED */
2613 }
2614 if (refcount) {
2615 so->so_usecount++;
2616 }
2617
2618 so->lock_lr[so->next_lock_lr] = lr_saved;
2619 so->next_lock_lr = (so->next_lock_lr + 1) % SO_LCKDBG_MAX;
2620 return 0;
2621}
2622
2623int
2624udp_unlock(struct socket *so, int refcount, void *debug)
2625{
2626 void *lr_saved;
2627
2628 if (debug == NULL) {
2629 lr_saved = __builtin_return_address(0);
2630 } else {
2631 lr_saved = debug;
2632 }
2633
2634 if (refcount) {
2635 VERIFY(so->so_usecount > 0);
2636 so->so_usecount--;
2637 }
2638 if (so->so_pcb == NULL) {
2639 panic("%s: so=%p NO PCB! lr=%p lrh= %s", __func__,
2640 so, lr_saved, solockhistory_nr(so));
2641 /* NOTREACHED */
2642 } else {
2643 LCK_MTX_ASSERT(&((struct inpcb *)so->so_pcb)->inpcb_mtx,
2644 LCK_MTX_ASSERT_OWNED);
2645 so->unlock_lr[so->next_unlock_lr] = lr_saved;
2646 so->next_unlock_lr = (so->next_unlock_lr + 1) % SO_LCKDBG_MAX;
2647 lck_mtx_unlock(lck: &((struct inpcb *)so->so_pcb)->inpcb_mtx);
2648 }
2649 return 0;
2650}
2651
2652lck_mtx_t *
2653udp_getlock(struct socket *so, int flags)
2654{
2655#pragma unused(flags)
2656 struct inpcb *inp = sotoinpcb(so);
2657
2658 if (so->so_pcb == NULL) {
2659 panic("%s: so=%p NULL so_pcb lrh= %s", __func__,
2660 so, solockhistory_nr(so));
2661 /* NOTREACHED */
2662 }
2663 return &inp->inpcb_mtx;
2664}
2665
2666/*
2667 * UDP garbage collector callback (inpcb_timer_func_t).
2668 *
2669 * Returns > 0 to keep timer active.
2670 */
2671static void
2672udp_gc(struct inpcbinfo *ipi)
2673{
2674 struct inpcb *inp, *inpnxt;
2675 struct socket *so;
2676
2677 if (lck_rw_try_lock_exclusive(lck: &ipi->ipi_lock) == FALSE) {
2678 if (udp_gc_done == TRUE) {
2679 udp_gc_done = FALSE;
2680 /* couldn't get the lock, must lock next time */
2681 os_atomic_inc(&ipi->ipi_gc_req.intimer_fast, relaxed);
2682 return;
2683 }
2684 lck_rw_lock_exclusive(lck: &ipi->ipi_lock);
2685 }
2686
2687 udp_gc_done = TRUE;
2688
2689 for (inp = udb.lh_first; inp != NULL; inp = inpnxt) {
2690 inpnxt = inp->inp_list.le_next;
2691
2692 /*
2693 * Skip unless it's STOPUSING; garbage collector will
2694 * be triggered by in_pcb_checkstate() upon setting
2695 * wantcnt to that value. If the PCB is already dead,
2696 * keep gc active to anticipate wantcnt changing.
2697 */
2698 if (inp->inp_wantcnt != WNT_STOPUSING) {
2699 continue;
2700 }
2701
2702 /*
2703 * Skip if busy, no hurry for cleanup. Keep gc active
2704 * and try the lock again during next round.
2705 */
2706 if (!socket_try_lock(so: inp->inp_socket)) {
2707 os_atomic_inc(&ipi->ipi_gc_req.intimer_fast, relaxed);
2708 continue;
2709 }
2710
2711 /*
2712 * Keep gc active unless usecount is 0.
2713 */
2714 so = inp->inp_socket;
2715 if (so->so_usecount == 0) {
2716 if (inp->inp_state != INPCB_STATE_DEAD) {
2717 if (SOCK_CHECK_DOM(so, PF_INET6)) {
2718 in6_pcbdetach(inp);
2719 } else {
2720 in_pcbdetach(inp);
2721 }
2722 }
2723 in_pcbdispose(inp);
2724 } else {
2725 socket_unlock(so, refcount: 0);
2726 os_atomic_inc(&ipi->ipi_gc_req.intimer_fast, relaxed);
2727 }
2728 }
2729 lck_rw_done(lck: &ipi->ipi_lock);
2730}
2731
2732static int
2733udp_getstat SYSCTL_HANDLER_ARGS
2734{
2735#pragma unused(oidp, arg1, arg2)
2736 if (req->oldptr == USER_ADDR_NULL) {
2737 req->oldlen = (size_t)sizeof(struct udpstat);
2738 }
2739
2740 return SYSCTL_OUT(req, &udpstat, MIN(sizeof(udpstat), req->oldlen));
2741}
2742
2743void
2744udp_in_cksum_stats(u_int32_t len)
2745{
2746 udpstat.udps_rcv_swcsum++;
2747 udpstat.udps_rcv_swcsum_bytes += len;
2748}
2749
2750void
2751udp_out_cksum_stats(u_int32_t len)
2752{
2753 udpstat.udps_snd_swcsum++;
2754 udpstat.udps_snd_swcsum_bytes += len;
2755}
2756
2757void
2758udp_in6_cksum_stats(u_int32_t len)
2759{
2760 udpstat.udps_rcv6_swcsum++;
2761 udpstat.udps_rcv6_swcsum_bytes += len;
2762}
2763
2764void
2765udp_out6_cksum_stats(u_int32_t len)
2766{
2767 udpstat.udps_snd6_swcsum++;
2768 udpstat.udps_snd6_swcsum_bytes += len;
2769}
2770
2771/*
2772 * Checksum extended UDP header and data.
2773 */
2774static int
2775udp_input_checksum(struct mbuf *m, struct udphdr *uh, int off, int ulen)
2776{
2777 struct ifnet *ifp = m->m_pkthdr.rcvif;
2778 struct ip *ip = mtod(m, struct ip *);
2779 struct ipovly *ipov = (struct ipovly *)ip;
2780
2781 if (uh->uh_sum == 0) {
2782 udpstat.udps_nosum++;
2783 return 0;
2784 }
2785
2786 /* ip_stripoptions() must have been called before we get here */
2787 ASSERT((ip->ip_hl << 2) == sizeof(*ip));
2788
2789 if ((hwcksum_rx || (ifp->if_flags & IFF_LOOPBACK) ||
2790 (m->m_pkthdr.pkt_flags & PKTF_LOOP)) &&
2791 (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)) {
2792 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
2793 uh->uh_sum = m->m_pkthdr.csum_rx_val;
2794 } else {
2795 uint32_t sum = m->m_pkthdr.csum_rx_val;
2796 uint32_t start = m->m_pkthdr.csum_rx_start;
2797 int32_t trailer = (m_pktlen(m) - (off + ulen));
2798
2799 /*
2800 * Perform 1's complement adjustment of octets
2801 * that got included/excluded in the hardware-
2802 * calculated checksum value. Ignore cases
2803 * where the value already includes the entire
2804 * IP header span, as the sum for those octets
2805 * would already be 0 by the time we get here;
2806 * IP has already performed its header checksum
2807 * checks. If we do need to adjust, restore
2808 * the original fields in the IP header when
2809 * computing the adjustment value. Also take
2810 * care of any trailing bytes and subtract out
2811 * their partial sum.
2812 */
2813 ASSERT(trailer >= 0);
2814 if ((m->m_pkthdr.csum_flags & CSUM_PARTIAL) &&
2815 ((start != 0 && start != off) || trailer != 0)) {
2816 uint32_t swbytes = (uint32_t)trailer;
2817
2818 if (start < off) {
2819 ip->ip_len += sizeof(*ip);
2820#if BYTE_ORDER != BIG_ENDIAN
2821 HTONS(ip->ip_len);
2822 HTONS(ip->ip_off);
2823#endif /* BYTE_ORDER != BIG_ENDIAN */
2824 }
2825 /* callee folds in sum */
2826 sum = m_adj_sum16(m, start, off, ulen, sum);
2827 if (off > start) {
2828 swbytes += (off - start);
2829 } else {
2830 swbytes += (start - off);
2831 }
2832
2833 if (start < off) {
2834#if BYTE_ORDER != BIG_ENDIAN
2835 NTOHS(ip->ip_off);
2836 NTOHS(ip->ip_len);
2837#endif /* BYTE_ORDER != BIG_ENDIAN */
2838 ip->ip_len -= sizeof(*ip);
2839 }
2840
2841 if (swbytes != 0) {
2842 udp_in_cksum_stats(len: swbytes);
2843 }
2844 if (trailer != 0) {
2845 m_adj(m, -trailer);
2846 }
2847 }
2848
2849 /* callee folds in sum */
2850 uh->uh_sum = in_pseudo(ip->ip_src.s_addr,
2851 ip->ip_dst.s_addr, sum + htonl(ulen + IPPROTO_UDP));
2852 }
2853 uh->uh_sum ^= 0xffff;
2854 } else {
2855 uint16_t ip_sum;
2856 char b[9];
2857
2858 bcopy(src: ipov->ih_x1, dst: b, n: sizeof(ipov->ih_x1));
2859 bzero(s: ipov->ih_x1, n: sizeof(ipov->ih_x1));
2860 ip_sum = ipov->ih_len;
2861 ipov->ih_len = uh->uh_ulen;
2862 uh->uh_sum = in_cksum(m, ulen + sizeof(struct ip));
2863 bcopy(src: b, dst: ipov->ih_x1, n: sizeof(ipov->ih_x1));
2864 ipov->ih_len = ip_sum;
2865
2866 udp_in_cksum_stats(len: ulen);
2867 }
2868
2869 if (uh->uh_sum != 0) {
2870 udpstat.udps_badsum++;
2871 IF_UDP_STATINC(ifp, badchksum);
2872 return -1;
2873 }
2874
2875 return 0;
2876}
2877
2878void
2879udp_fill_keepalive_offload_frames(ifnet_t ifp,
2880 struct ifnet_keepalive_offload_frame *frames_array,
2881 u_int32_t frames_array_count, size_t frame_data_offset,
2882 u_int32_t *used_frames_count)
2883{
2884 struct inpcb *inp;
2885 inp_gen_t gencnt;
2886 u_int32_t frame_index = *used_frames_count;
2887
2888 if (ifp == NULL || frames_array == NULL ||
2889 frames_array_count == 0 ||
2890 frame_index >= frames_array_count ||
2891 frame_data_offset >= IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2892 return;
2893 }
2894
2895 lck_rw_lock_shared(lck: &udbinfo.ipi_lock);
2896 gencnt = udbinfo.ipi_gencnt;
2897 LIST_FOREACH(inp, udbinfo.ipi_listhead, inp_list) {
2898 struct socket *so;
2899 u_int8_t *data;
2900 struct ifnet_keepalive_offload_frame *frame;
2901 struct mbuf *m = NULL;
2902
2903 if (frame_index >= frames_array_count) {
2904 break;
2905 }
2906
2907 if (inp->inp_gencnt > gencnt ||
2908 inp->inp_state == INPCB_STATE_DEAD) {
2909 continue;
2910 }
2911
2912 if ((so = inp->inp_socket) == NULL ||
2913 (so->so_state & SS_DEFUNCT)) {
2914 continue;
2915 }
2916 /*
2917 * check for keepalive offload flag without socket
2918 * lock to avoid a deadlock
2919 */
2920 if (!(inp->inp_flags2 & INP2_KEEPALIVE_OFFLOAD)) {
2921 continue;
2922 }
2923
2924 udp_lock(so, refcount: 1, debug: 0);
2925 if (!(inp->inp_vflag & (INP_IPV4 | INP_IPV6))) {
2926 udp_unlock(so, refcount: 1, debug: 0);
2927 continue;
2928 }
2929 if ((inp->inp_vflag & INP_IPV4) &&
2930 (inp->inp_laddr.s_addr == INADDR_ANY ||
2931 inp->inp_faddr.s_addr == INADDR_ANY)) {
2932 udp_unlock(so, refcount: 1, debug: 0);
2933 continue;
2934 }
2935 if ((inp->inp_vflag & INP_IPV6) &&
2936 (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) ||
2937 IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))) {
2938 udp_unlock(so, refcount: 1, debug: 0);
2939 continue;
2940 }
2941 if (inp->inp_lport == 0 || inp->inp_fport == 0) {
2942 udp_unlock(so, refcount: 1, debug: 0);
2943 continue;
2944 }
2945 if (inp->inp_last_outifp == NULL ||
2946 inp->inp_last_outifp->if_index != ifp->if_index) {
2947 udp_unlock(so, refcount: 1, debug: 0);
2948 continue;
2949 }
2950 if ((inp->inp_vflag & INP_IPV4)) {
2951 if ((frame_data_offset + sizeof(struct udpiphdr) +
2952 inp->inp_keepalive_datalen) >
2953 IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2954 udp_unlock(so, refcount: 1, debug: 0);
2955 continue;
2956 }
2957 if ((sizeof(struct udpiphdr) +
2958 inp->inp_keepalive_datalen) > _MHLEN) {
2959 udp_unlock(so, refcount: 1, debug: 0);
2960 continue;
2961 }
2962 } else {
2963 if ((frame_data_offset + sizeof(struct ip6_hdr) +
2964 sizeof(struct udphdr) +
2965 inp->inp_keepalive_datalen) >
2966 IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2967 udp_unlock(so, refcount: 1, debug: 0);
2968 continue;
2969 }
2970 if ((sizeof(struct ip6_hdr) + sizeof(struct udphdr) +
2971 inp->inp_keepalive_datalen) > _MHLEN) {
2972 udp_unlock(so, refcount: 1, debug: 0);
2973 continue;
2974 }
2975 }
2976 MGETHDR(m, M_WAIT, MT_HEADER);
2977 if (m == NULL) {
2978 udp_unlock(so, refcount: 1, debug: 0);
2979 continue;
2980 }
2981 /*
2982 * This inp has all the information that is needed to
2983 * generate an offload frame.
2984 */
2985 if (inp->inp_vflag & INP_IPV4) {
2986 struct ip *ip;
2987 struct udphdr *udp;
2988
2989 frame = &frames_array[frame_index];
2990 frame->length = (uint8_t)(frame_data_offset +
2991 sizeof(struct udpiphdr) +
2992 inp->inp_keepalive_datalen);
2993 frame->ether_type =
2994 IFNET_KEEPALIVE_OFFLOAD_FRAME_ETHERTYPE_IPV4;
2995 frame->interval = inp->inp_keepalive_interval;
2996 switch (inp->inp_keepalive_type) {
2997 case UDP_KEEPALIVE_OFFLOAD_TYPE_AIRPLAY:
2998 frame->type =
2999 IFNET_KEEPALIVE_OFFLOAD_FRAME_AIRPLAY;
3000 break;
3001 default:
3002 break;
3003 }
3004 data = mtod(m, u_int8_t *);
3005 bzero(s: data, n: sizeof(struct udpiphdr));
3006 ip = (__typeof__(ip))(void *)data;
3007 udp = (__typeof__(udp))(void *) (data +
3008 sizeof(struct ip));
3009 m->m_len = sizeof(struct udpiphdr);
3010 data = data + sizeof(struct udpiphdr);
3011 if (inp->inp_keepalive_datalen > 0 &&
3012 inp->inp_keepalive_data != NULL) {
3013 bcopy(src: inp->inp_keepalive_data, dst: data,
3014 n: inp->inp_keepalive_datalen);
3015 m->m_len += inp->inp_keepalive_datalen;
3016 }
3017 m->m_pkthdr.len = m->m_len;
3018
3019 ip->ip_v = IPVERSION;
3020 ip->ip_hl = (sizeof(struct ip) >> 2);
3021 ip->ip_p = IPPROTO_UDP;
3022 ip->ip_len = htons(sizeof(struct udpiphdr) +
3023 (u_short)inp->inp_keepalive_datalen);
3024 ip->ip_ttl = inp->inp_ip_ttl;
3025 ip->ip_tos |= (inp->inp_ip_tos & ~IPTOS_ECN_MASK);
3026 ip->ip_src = inp->inp_laddr;
3027 ip->ip_dst = inp->inp_faddr;
3028 ip->ip_sum = in_cksum_hdr_opt(ip);
3029
3030 udp->uh_sport = inp->inp_lport;
3031 udp->uh_dport = inp->inp_fport;
3032 udp->uh_ulen = htons(sizeof(struct udphdr) +
3033 (u_short)inp->inp_keepalive_datalen);
3034
3035 if (!(inp->inp_flags & INP_UDP_NOCKSUM)) {
3036 udp->uh_sum = in_pseudo(ip->ip_src.s_addr,
3037 ip->ip_dst.s_addr,
3038 htons(sizeof(struct udphdr) +
3039 (u_short)inp->inp_keepalive_datalen +
3040 IPPROTO_UDP));
3041 m->m_pkthdr.csum_flags =
3042 (CSUM_UDP | CSUM_ZERO_INVERT);
3043 m->m_pkthdr.csum_data = offsetof(struct udphdr,
3044 uh_sum);
3045 }
3046 m->m_pkthdr.pkt_proto = IPPROTO_UDP;
3047 in_delayed_cksum(m);
3048 bcopy(src: m_mtod_current(m), dst: frame->data + frame_data_offset,
3049 n: m->m_len);
3050 } else {
3051 struct ip6_hdr *ip6;
3052 struct udphdr *udp6;
3053
3054 VERIFY(inp->inp_vflag & INP_IPV6);
3055 frame = &frames_array[frame_index];
3056 frame->length = (uint8_t)(frame_data_offset +
3057 sizeof(struct ip6_hdr) +
3058 sizeof(struct udphdr) +
3059 inp->inp_keepalive_datalen);
3060 frame->ether_type =
3061 IFNET_KEEPALIVE_OFFLOAD_FRAME_ETHERTYPE_IPV6;
3062 frame->interval = inp->inp_keepalive_interval;
3063 switch (inp->inp_keepalive_type) {
3064 case UDP_KEEPALIVE_OFFLOAD_TYPE_AIRPLAY:
3065 frame->type =
3066 IFNET_KEEPALIVE_OFFLOAD_FRAME_AIRPLAY;
3067 break;
3068 default:
3069 break;
3070 }
3071 data = mtod(m, u_int8_t *);
3072 bzero(s: data, n: sizeof(struct ip6_hdr) + sizeof(struct udphdr));
3073 ip6 = (__typeof__(ip6))(void *)data;
3074 udp6 = (__typeof__(udp6))(void *)(data +
3075 sizeof(struct ip6_hdr));
3076 m->m_len = sizeof(struct ip6_hdr) +
3077 sizeof(struct udphdr);
3078 data = data + (sizeof(struct ip6_hdr) +
3079 sizeof(struct udphdr));
3080 if (inp->inp_keepalive_datalen > 0 &&
3081 inp->inp_keepalive_data != NULL) {
3082 bcopy(src: inp->inp_keepalive_data, dst: data,
3083 n: inp->inp_keepalive_datalen);
3084 m->m_len += inp->inp_keepalive_datalen;
3085 }
3086 m->m_pkthdr.len = m->m_len;
3087 ip6->ip6_flow = inp->inp_flow & IPV6_FLOWINFO_MASK;
3088 ip6->ip6_flow = ip6->ip6_flow & ~IPV6_FLOW_ECN_MASK;
3089 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
3090 ip6->ip6_vfc |= IPV6_VERSION;
3091 ip6->ip6_nxt = IPPROTO_UDP;
3092 ip6->ip6_hlim = (uint8_t)ip6_defhlim;
3093 ip6->ip6_plen = htons(sizeof(struct udphdr) +
3094 (u_short)inp->inp_keepalive_datalen);
3095 ip6->ip6_src = inp->in6p_laddr;
3096 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
3097 ip6->ip6_src.s6_addr16[1] = 0;
3098 }
3099
3100 ip6->ip6_dst = inp->in6p_faddr;
3101 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
3102 ip6->ip6_dst.s6_addr16[1] = 0;
3103 }
3104
3105 udp6->uh_sport = inp->in6p_lport;
3106 udp6->uh_dport = inp->in6p_fport;
3107 udp6->uh_ulen = htons(sizeof(struct udphdr) +
3108 (u_short)inp->inp_keepalive_datalen);
3109 if (!(inp->inp_flags & INP_UDP_NOCKSUM)) {
3110 udp6->uh_sum = in6_pseudo(&ip6->ip6_src,
3111 &ip6->ip6_dst,
3112 htonl(sizeof(struct udphdr) +
3113 (u_short)inp->inp_keepalive_datalen +
3114 IPPROTO_UDP));
3115 m->m_pkthdr.csum_flags =
3116 (CSUM_UDPIPV6 | CSUM_ZERO_INVERT);
3117 m->m_pkthdr.csum_data = offsetof(struct udphdr,
3118 uh_sum);
3119 }
3120 m->m_pkthdr.pkt_proto = IPPROTO_UDP;
3121 in6_delayed_cksum(m);
3122 bcopy(src: m_mtod_current(m), dst: frame->data + frame_data_offset, n: m->m_len);
3123 }
3124 if (m != NULL) {
3125 m_freem(m);
3126 m = NULL;
3127 }
3128 frame_index++;
3129 udp_unlock(so, refcount: 1, debug: 0);
3130 }
3131 lck_rw_done(lck: &udbinfo.ipi_lock);
3132 *used_frames_count = frame_index;
3133}
3134
3135int
3136udp_defunct(struct socket *so)
3137{
3138 struct ip_moptions *imo;
3139 struct inpcb *inp;
3140
3141 inp = sotoinpcb(so);
3142 if (inp == NULL) {
3143 return EINVAL;
3144 }
3145
3146 imo = inp->inp_moptions;
3147 if (imo != NULL) {
3148 struct proc *p = current_proc();
3149
3150 SODEFUNCTLOG("%s[%d, %s]: defuncting so 0x%llu drop multicast memberships",
3151 __func__, proc_pid(p), proc_best_name(p),
3152 so->so_gencnt);
3153
3154 inp->inp_moptions = NULL;
3155
3156 IMO_REMREF(imo);
3157 }
3158
3159 return 0;
3160}
3161