]> git.saurik.com Git - apple/xnu.git/blob - bsd/netinet/in_pcb.c
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-2422.1.72.tar.gz
[apple/xnu.git] / bsd / netinet / in_pcb.c
1 /*
2 * Copyright (c) 2000-2013 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1991, 1993, 1995
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)in_pcb.c 8.4 (Berkeley) 5/24/95
61 * $FreeBSD: src/sys/netinet/in_pcb.c,v 1.59.2.17 2001/08/13 16:26:17 ume Exp $
62 */
63
64 #include <sys/param.h>
65 #include <sys/systm.h>
66 #include <sys/malloc.h>
67 #include <sys/mbuf.h>
68 #include <sys/domain.h>
69 #include <sys/protosw.h>
70 #include <sys/socket.h>
71 #include <sys/socketvar.h>
72 #include <sys/proc.h>
73 #include <sys/kernel.h>
74 #include <sys/sysctl.h>
75 #include <sys/mcache.h>
76 #include <sys/kauth.h>
77 #include <sys/priv.h>
78 #include <sys/proc_uuid_policy.h>
79 #include <sys/syslog.h>
80
81 #include <libkern/OSAtomic.h>
82 #include <kern/locks.h>
83
84 #include <machine/limits.h>
85
86 #include <kern/zalloc.h>
87
88 #include <net/if.h>
89 #include <net/if_types.h>
90 #include <net/route.h>
91 #include <net/flowhash.h>
92 #include <net/flowadv.h>
93
94 #include <netinet/in.h>
95 #include <netinet/in_pcb.h>
96 #include <netinet/in_var.h>
97 #include <netinet/ip_var.h>
98 #if INET6
99 #include <netinet/ip6.h>
100 #include <netinet6/ip6_var.h>
101 #endif /* INET6 */
102
103 #if IPSEC
104 #include <netinet6/ipsec.h>
105 #include <netkey/key.h>
106 #endif /* IPSEC */
107
108 #include <sys/kdebug.h>
109 #include <sys/random.h>
110
111 #include <dev/random/randomdev.h>
112 #include <mach/boolean.h>
113
114 #if FLOW_DIVERT
115 #include <netinet/flow_divert.h>
116 #endif
117
118 static lck_grp_t *inpcb_lock_grp;
119 static lck_attr_t *inpcb_lock_attr;
120 static lck_grp_attr_t *inpcb_lock_grp_attr;
121 decl_lck_mtx_data(static, inpcb_lock); /* global INPCB lock */
122 decl_lck_mtx_data(static, inpcb_timeout_lock);
123
124 static TAILQ_HEAD(, inpcbinfo) inpcb_head = TAILQ_HEAD_INITIALIZER(inpcb_head);
125
126 static u_int16_t inpcb_timeout_run = 0; /* INPCB timer is scheduled to run */
127 static boolean_t inpcb_garbage_collecting = FALSE; /* gc timer is scheduled */
128 static boolean_t inpcb_ticking = FALSE; /* "slow" timer is scheduled */
129 static boolean_t inpcb_fast_timer_on = FALSE;
130 static void inpcb_sched_timeout(struct timeval *);
131 static void inpcb_timeout(void *);
132 int inpcb_timeout_lazy = 10; /* 10 seconds leeway for lazy timers */
133 extern int tvtohz(struct timeval *);
134
135 #if CONFIG_PROC_UUID_POLICY
136 static void inp_update_cellular_policy(struct inpcb *, boolean_t);
137 #if FLOW_DIVERT
138 static void inp_update_flow_divert_policy(struct inpcb *, boolean_t);
139 #endif /* FLOW_DIVERT */
140 #endif /* !CONFIG_PROC_UUID_POLICY */
141
142 #if IPSEC
143 extern int ipsec_bypass;
144 #endif /* IPSEC */
145
146 #define DBG_FNC_PCB_LOOKUP NETDBG_CODE(DBG_NETTCP, (6 << 8))
147 #define DBG_FNC_PCB_HLOOKUP NETDBG_CODE(DBG_NETTCP, ((6 << 8) | 1))
148
149 /*
150 * These configure the range of local port addresses assigned to
151 * "unspecified" outgoing connections/packets/whatever.
152 */
153 int ipport_lowfirstauto = IPPORT_RESERVED - 1; /* 1023 */
154 int ipport_lowlastauto = IPPORT_RESERVEDSTART; /* 600 */
155 int ipport_firstauto = IPPORT_HIFIRSTAUTO; /* 49152 */
156 int ipport_lastauto = IPPORT_HILASTAUTO; /* 65535 */
157 int ipport_hifirstauto = IPPORT_HIFIRSTAUTO; /* 49152 */
158 int ipport_hilastauto = IPPORT_HILASTAUTO; /* 65535 */
159
160 #define RANGECHK(var, min, max) \
161 if ((var) < (min)) { (var) = (min); } \
162 else if ((var) > (max)) { (var) = (max); }
163
164 static int
165 sysctl_net_ipport_check SYSCTL_HANDLER_ARGS
166 {
167 #pragma unused(arg1, arg2)
168 int error;
169
170 error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req);
171 if (!error) {
172 RANGECHK(ipport_lowfirstauto, 1, IPPORT_RESERVED - 1);
173 RANGECHK(ipport_lowlastauto, 1, IPPORT_RESERVED - 1);
174 RANGECHK(ipport_firstauto, IPPORT_RESERVED, USHRT_MAX);
175 RANGECHK(ipport_lastauto, IPPORT_RESERVED, USHRT_MAX);
176 RANGECHK(ipport_hifirstauto, IPPORT_RESERVED, USHRT_MAX);
177 RANGECHK(ipport_hilastauto, IPPORT_RESERVED, USHRT_MAX);
178 }
179 return (error);
180 }
181
182 #undef RANGECHK
183
184 SYSCTL_NODE(_net_inet_ip, IPPROTO_IP, portrange,
185 CTLFLAG_RW|CTLFLAG_LOCKED, 0, "IP Ports");
186
187 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowfirst,
188 CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,
189 &ipport_lowfirstauto, 0, &sysctl_net_ipport_check, "I", "");
190 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowlast,
191 CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,
192 &ipport_lowlastauto, 0, &sysctl_net_ipport_check, "I", "");
193 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, first,
194 CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,
195 &ipport_firstauto, 0, &sysctl_net_ipport_check, "I", "");
196 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, last,
197 CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,
198 &ipport_lastauto, 0, &sysctl_net_ipport_check, "I", "");
199 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hifirst,
200 CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,
201 &ipport_hifirstauto, 0, &sysctl_net_ipport_check, "I", "");
202 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast,
203 CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,
204 &ipport_hilastauto, 0, &sysctl_net_ipport_check, "I", "");
205
206 extern int udp_use_randomport;
207 extern int tcp_use_randomport;
208
209 /* Structs used for flowhash computation */
210 struct inp_flowhash_key_addr {
211 union {
212 struct in_addr v4;
213 struct in6_addr v6;
214 u_int8_t addr8[16];
215 u_int16_t addr16[8];
216 u_int32_t addr32[4];
217 } infha;
218 };
219
220 struct inp_flowhash_key {
221 struct inp_flowhash_key_addr infh_laddr;
222 struct inp_flowhash_key_addr infh_faddr;
223 u_int32_t infh_lport;
224 u_int32_t infh_fport;
225 u_int32_t infh_af;
226 u_int32_t infh_proto;
227 u_int32_t infh_rand1;
228 u_int32_t infh_rand2;
229 };
230
231 static u_int32_t inp_hash_seed = 0;
232
233 static int infc_cmp(const struct inpcb *, const struct inpcb *);
234
235 /* Flags used by inp_fc_getinp */
236 #define INPFC_SOLOCKED 0x1
237 #define INPFC_REMOVE 0x2
238 static struct inpcb *inp_fc_getinp(u_int32_t, u_int32_t);
239
240 static void inp_fc_feedback(struct inpcb *);
241 extern void tcp_remove_from_time_wait(struct inpcb *inp);
242
243 decl_lck_mtx_data(static, inp_fc_lck);
244
245 RB_HEAD(inp_fc_tree, inpcb) inp_fc_tree;
246 RB_PROTOTYPE(inp_fc_tree, inpcb, infc_link, infc_cmp);
247 RB_GENERATE(inp_fc_tree, inpcb, infc_link, infc_cmp);
248
249 /*
250 * Use this inp as a key to find an inp in the flowhash tree.
251 * Accesses to it are protected by inp_fc_lck.
252 */
253 struct inpcb key_inp;
254
255 /*
256 * in_pcb.c: manage the Protocol Control Blocks.
257 */
258
259 void
260 in_pcbinit(void)
261 {
262 static int inpcb_initialized = 0;
263
264 VERIFY(!inpcb_initialized);
265 inpcb_initialized = 1;
266
267 inpcb_lock_grp_attr = lck_grp_attr_alloc_init();
268 inpcb_lock_grp = lck_grp_alloc_init("inpcb", inpcb_lock_grp_attr);
269 inpcb_lock_attr = lck_attr_alloc_init();
270 lck_mtx_init(&inpcb_lock, inpcb_lock_grp, inpcb_lock_attr);
271 lck_mtx_init(&inpcb_timeout_lock, inpcb_lock_grp, inpcb_lock_attr);
272
273 /*
274 * Initialize data structures required to deliver
275 * flow advisories.
276 */
277 lck_mtx_init(&inp_fc_lck, inpcb_lock_grp, inpcb_lock_attr);
278 lck_mtx_lock(&inp_fc_lck);
279 RB_INIT(&inp_fc_tree);
280 bzero(&key_inp, sizeof(key_inp));
281 lck_mtx_unlock(&inp_fc_lck);
282 }
283
284 #define INPCB_HAVE_TIMER_REQ(req) (((req).intimer_lazy > 0) || \
285 ((req).intimer_fast > 0) || ((req).intimer_nodelay > 0))
286 static void
287 inpcb_timeout(void *arg)
288 {
289 #pragma unused(arg)
290 struct inpcbinfo *ipi;
291 boolean_t t, gc;
292 struct intimercount gccnt, tmcnt;
293 struct timeval leeway;
294
295 /*
296 * Update coarse-grained networking timestamp (in sec.); the idea
297 * is to piggy-back on the timeout callout to update the counter
298 * returnable via net_uptime().
299 */
300 net_update_uptime();
301
302 lck_mtx_lock_spin(&inpcb_timeout_lock);
303 gc = inpcb_garbage_collecting;
304 inpcb_garbage_collecting = FALSE;
305 bzero(&gccnt, sizeof(gccnt));
306 bzero(&tmcnt, sizeof(tmcnt));
307
308 t = inpcb_ticking;
309 inpcb_ticking = FALSE;
310
311 if (gc || t) {
312 lck_mtx_unlock(&inpcb_timeout_lock);
313
314 lck_mtx_lock(&inpcb_lock);
315 TAILQ_FOREACH(ipi, &inpcb_head, ipi_entry) {
316 if (INPCB_HAVE_TIMER_REQ(ipi->ipi_gc_req)) {
317 bzero(&ipi->ipi_gc_req,
318 sizeof(ipi->ipi_gc_req));
319 if (gc && ipi->ipi_gc != NULL) {
320 ipi->ipi_gc(ipi);
321 gccnt.intimer_lazy +=
322 ipi->ipi_gc_req.intimer_lazy;
323 gccnt.intimer_fast +=
324 ipi->ipi_gc_req.intimer_fast;
325 gccnt.intimer_nodelay +=
326 ipi->ipi_gc_req.intimer_nodelay;
327 }
328 }
329 if (INPCB_HAVE_TIMER_REQ(ipi->ipi_timer_req)) {
330 bzero(&ipi->ipi_timer_req,
331 sizeof(ipi->ipi_timer_req));
332 if (t && ipi->ipi_timer != NULL) {
333 ipi->ipi_timer(ipi);
334 tmcnt.intimer_lazy +=
335 ipi->ipi_timer_req.intimer_lazy;
336 tmcnt.intimer_lazy +=
337 ipi->ipi_timer_req.intimer_fast;
338 tmcnt.intimer_nodelay +=
339 ipi->ipi_timer_req.intimer_nodelay;
340 }
341 }
342 }
343 lck_mtx_unlock(&inpcb_lock);
344 lck_mtx_lock_spin(&inpcb_timeout_lock);
345 }
346
347 /* lock was dropped above, so check first before overriding */
348 if (!inpcb_garbage_collecting)
349 inpcb_garbage_collecting = INPCB_HAVE_TIMER_REQ(gccnt);
350 if (!inpcb_ticking)
351 inpcb_ticking = INPCB_HAVE_TIMER_REQ(tmcnt);
352
353 /* re-arm the timer if there's work to do */
354 inpcb_timeout_run--;
355 VERIFY(inpcb_timeout_run >= 0 && inpcb_timeout_run < 2);
356
357 bzero(&leeway, sizeof(leeway));
358 leeway.tv_sec = inpcb_timeout_lazy;
359 if (gccnt.intimer_nodelay > 0 || tmcnt.intimer_nodelay > 0)
360 inpcb_sched_timeout(NULL);
361 else if ((gccnt.intimer_fast + tmcnt.intimer_fast) <= 5)
362 /* be lazy when idle with little activity */
363 inpcb_sched_timeout(&leeway);
364 else
365 inpcb_sched_timeout(NULL);
366
367 lck_mtx_unlock(&inpcb_timeout_lock);
368 }
369
370 static void
371 inpcb_sched_timeout(struct timeval *leeway)
372 {
373 lck_mtx_assert(&inpcb_timeout_lock, LCK_MTX_ASSERT_OWNED);
374
375 if (inpcb_timeout_run == 0 &&
376 (inpcb_garbage_collecting || inpcb_ticking)) {
377 lck_mtx_convert_spin(&inpcb_timeout_lock);
378 inpcb_timeout_run++;
379 if (leeway == NULL) {
380 inpcb_fast_timer_on = TRUE;
381 timeout(inpcb_timeout, NULL, hz);
382 } else {
383 inpcb_fast_timer_on = FALSE;
384 timeout_with_leeway(inpcb_timeout, NULL, hz,
385 tvtohz(leeway));
386 }
387 } else if (inpcb_timeout_run == 1 &&
388 leeway == NULL && !inpcb_fast_timer_on) {
389 /*
390 * Since the request was for a fast timer but the
391 * scheduled timer is a lazy timer, try to schedule
392 * another instance of fast timer also
393 */
394 lck_mtx_convert_spin(&inpcb_timeout_lock);
395 inpcb_timeout_run++;
396 inpcb_fast_timer_on = TRUE;
397 timeout(inpcb_timeout, NULL, hz);
398 }
399 }
400
401 void
402 inpcb_gc_sched(struct inpcbinfo *ipi, u_int32_t type)
403 {
404 struct timeval leeway;
405 lck_mtx_lock_spin(&inpcb_timeout_lock);
406 inpcb_garbage_collecting = TRUE;
407 switch (type) {
408 case INPCB_TIMER_NODELAY:
409 atomic_add_32(&ipi->ipi_gc_req.intimer_nodelay, 1);
410 inpcb_sched_timeout(NULL);
411 break;
412 case INPCB_TIMER_FAST:
413 atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
414 inpcb_sched_timeout(NULL);
415 break;
416 default:
417 atomic_add_32(&ipi->ipi_gc_req.intimer_lazy, 1);
418 leeway.tv_sec = inpcb_timeout_lazy;
419 leeway.tv_usec = 0;
420 inpcb_sched_timeout(&leeway);
421 break;
422 }
423 lck_mtx_unlock(&inpcb_timeout_lock);
424 }
425
426 void
427 inpcb_timer_sched(struct inpcbinfo *ipi, u_int32_t type)
428 {
429 struct timeval leeway;
430 lck_mtx_lock_spin(&inpcb_timeout_lock);
431 inpcb_ticking = TRUE;
432 switch (type) {
433 case INPCB_TIMER_NODELAY:
434 atomic_add_32(&ipi->ipi_timer_req.intimer_nodelay, 1);
435 inpcb_sched_timeout(NULL);
436 break;
437 case INPCB_TIMER_FAST:
438 atomic_add_32(&ipi->ipi_timer_req.intimer_fast, 1);
439 inpcb_sched_timeout(NULL);
440 break;
441 default:
442 atomic_add_32(&ipi->ipi_timer_req.intimer_lazy, 1);
443 leeway.tv_sec = inpcb_timeout_lazy;
444 leeway.tv_usec = 0;
445 inpcb_sched_timeout(&leeway);
446 break;
447 }
448 lck_mtx_unlock(&inpcb_timeout_lock);
449 }
450
451 void
452 in_pcbinfo_attach(struct inpcbinfo *ipi)
453 {
454 struct inpcbinfo *ipi0;
455
456 lck_mtx_lock(&inpcb_lock);
457 TAILQ_FOREACH(ipi0, &inpcb_head, ipi_entry) {
458 if (ipi0 == ipi) {
459 panic("%s: ipi %p already in the list\n",
460 __func__, ipi);
461 /* NOTREACHED */
462 }
463 }
464 TAILQ_INSERT_TAIL(&inpcb_head, ipi, ipi_entry);
465 lck_mtx_unlock(&inpcb_lock);
466 }
467
468 int
469 in_pcbinfo_detach(struct inpcbinfo *ipi)
470 {
471 struct inpcbinfo *ipi0;
472 int error = 0;
473
474 lck_mtx_lock(&inpcb_lock);
475 TAILQ_FOREACH(ipi0, &inpcb_head, ipi_entry) {
476 if (ipi0 == ipi)
477 break;
478 }
479 if (ipi0 != NULL)
480 TAILQ_REMOVE(&inpcb_head, ipi0, ipi_entry);
481 else
482 error = ENXIO;
483 lck_mtx_unlock(&inpcb_lock);
484
485 return (error);
486 }
487
488 /*
489 * Allocate a PCB and associate it with the socket.
490 *
491 * Returns: 0 Success
492 * ENOBUFS
493 * ENOMEM
494 * ipsec_init_policy:??? [IPSEC]
495 */
496 int
497 in_pcballoc(struct socket *so, struct inpcbinfo *pcbinfo, struct proc *p)
498 {
499 #pragma unused(p)
500 struct inpcb *inp;
501 caddr_t temp;
502 #if CONFIG_MACF_NET
503 int mac_error;
504 #endif /* CONFIG_MACF_NET */
505
506 if (!so->cached_in_sock_layer) {
507 inp = (struct inpcb *)zalloc(pcbinfo->ipi_zone);
508 if (inp == NULL)
509 return (ENOBUFS);
510 bzero((caddr_t)inp, sizeof (*inp));
511 } else {
512 inp = (struct inpcb *)(void *)so->so_saved_pcb;
513 temp = inp->inp_saved_ppcb;
514 bzero((caddr_t)inp, sizeof (*inp));
515 inp->inp_saved_ppcb = temp;
516 }
517
518 inp->inp_gencnt = ++pcbinfo->ipi_gencnt;
519 inp->inp_pcbinfo = pcbinfo;
520 inp->inp_socket = so;
521 #if CONFIG_MACF_NET
522 mac_error = mac_inpcb_label_init(inp, M_WAITOK);
523 if (mac_error != 0) {
524 if (!so->cached_in_sock_layer)
525 zfree(pcbinfo->ipi_zone, inp);
526 return (mac_error);
527 }
528 mac_inpcb_label_associate(so, inp);
529 #endif /* CONFIG_MACF_NET */
530 /* make sure inp_stat is always 64-bit aligned */
531 inp->inp_stat = (struct inp_stat *)P2ROUNDUP(inp->inp_stat_store,
532 sizeof (u_int64_t));
533 if (((uintptr_t)inp->inp_stat - (uintptr_t)inp->inp_stat_store) +
534 sizeof (*inp->inp_stat) > sizeof (inp->inp_stat_store)) {
535 panic("%s: insufficient space to align inp_stat", __func__);
536 /* NOTREACHED */
537 }
538
539 /* make sure inp_cstat is always 64-bit aligned */
540 inp->inp_cstat = (struct inp_stat *)P2ROUNDUP(inp->inp_cstat_store,
541 sizeof (u_int64_t));
542 if (((uintptr_t)inp->inp_cstat - (uintptr_t)inp->inp_cstat_store) +
543 sizeof (*inp->inp_cstat) > sizeof (inp->inp_cstat_store)) {
544 panic("%s: insufficient space to align inp_cstat", __func__);
545 /* NOTREACHED */
546 }
547
548 /* make sure inp_wstat is always 64-bit aligned */
549 inp->inp_wstat = (struct inp_stat *)P2ROUNDUP(inp->inp_wstat_store,
550 sizeof (u_int64_t));
551 if (((uintptr_t)inp->inp_wstat - (uintptr_t)inp->inp_wstat_store) +
552 sizeof (*inp->inp_wstat) > sizeof (inp->inp_wstat_store)) {
553 panic("%s: insufficient space to align inp_wstat", __func__);
554 /* NOTREACHED */
555 }
556
557 so->so_pcb = (caddr_t)inp;
558
559 if (so->so_proto->pr_flags & PR_PCBLOCK) {
560 lck_mtx_init(&inp->inpcb_mtx, pcbinfo->ipi_lock_grp,
561 pcbinfo->ipi_lock_attr);
562 }
563
564
565 #if INET6
566 if (SOCK_DOM(so) == PF_INET6 && !ip6_mapped_addr_on)
567 inp->inp_flags |= IN6P_IPV6_V6ONLY;
568
569 if (ip6_auto_flowlabel)
570 inp->inp_flags |= IN6P_AUTOFLOWLABEL;
571 #endif /* INET6 */
572
573 (void) inp_update_policy(inp);
574
575 lck_rw_lock_exclusive(pcbinfo->ipi_lock);
576 inp->inp_gencnt = ++pcbinfo->ipi_gencnt;
577 LIST_INSERT_HEAD(pcbinfo->ipi_listhead, inp, inp_list);
578 pcbinfo->ipi_count++;
579 lck_rw_done(pcbinfo->ipi_lock);
580 return (0);
581 }
582
583 /*
584 * in_pcblookup_local_and_cleanup does everything
585 * in_pcblookup_local does but it checks for a socket
586 * that's going away. Since we know that the lock is
587 * held read+write when this funciton is called, we
588 * can safely dispose of this socket like the slow
589 * timer would usually do and return NULL. This is
590 * great for bind.
591 */
592 struct inpcb *
593 in_pcblookup_local_and_cleanup(struct inpcbinfo *pcbinfo, struct in_addr laddr,
594 u_int lport_arg, int wild_okay)
595 {
596 struct inpcb *inp;
597
598 /* Perform normal lookup */
599 inp = in_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay);
600
601 /* Check if we found a match but it's waiting to be disposed */
602 if (inp != NULL && inp->inp_wantcnt == WNT_STOPUSING) {
603 struct socket *so = inp->inp_socket;
604
605 lck_mtx_lock(&inp->inpcb_mtx);
606
607 if (so->so_usecount == 0) {
608 if (inp->inp_state != INPCB_STATE_DEAD)
609 in_pcbdetach(inp);
610 in_pcbdispose(inp); /* will unlock & destroy */
611 inp = NULL;
612 } else {
613 lck_mtx_unlock(&inp->inpcb_mtx);
614 }
615 }
616
617 return (inp);
618 }
619
620 static void
621 in_pcb_conflict_post_msg(u_int16_t port)
622 {
623 /*
624 * Radar 5523020 send a kernel event notification if a
625 * non-participating socket tries to bind the port a socket
626 * who has set SOF_NOTIFYCONFLICT owns.
627 */
628 struct kev_msg ev_msg;
629 struct kev_in_portinuse in_portinuse;
630
631 bzero(&in_portinuse, sizeof (struct kev_in_portinuse));
632 bzero(&ev_msg, sizeof (struct kev_msg));
633 in_portinuse.port = ntohs(port); /* port in host order */
634 in_portinuse.req_pid = proc_selfpid();
635 ev_msg.vendor_code = KEV_VENDOR_APPLE;
636 ev_msg.kev_class = KEV_NETWORK_CLASS;
637 ev_msg.kev_subclass = KEV_INET_SUBCLASS;
638 ev_msg.event_code = KEV_INET_PORTINUSE;
639 ev_msg.dv[0].data_ptr = &in_portinuse;
640 ev_msg.dv[0].data_length = sizeof (struct kev_in_portinuse);
641 ev_msg.dv[1].data_length = 0;
642 kev_post_msg(&ev_msg);
643 }
644
645 /*
646 * Bind an INPCB to an address and/or port. This routine should not alter
647 * the caller-supplied local address "nam".
648 *
649 * Returns: 0 Success
650 * EADDRNOTAVAIL Address not available.
651 * EINVAL Invalid argument
652 * EAFNOSUPPORT Address family not supported [notdef]
653 * EACCES Permission denied
654 * EADDRINUSE Address in use
655 * EAGAIN Resource unavailable, try again
656 * priv_check_cred:EPERM Operation not permitted
657 */
658 int
659 in_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct proc *p)
660 {
661 struct socket *so = inp->inp_socket;
662 unsigned short *lastport;
663 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
664 u_short lport = 0, rand_port = 0;
665 int wild = 0, reuseport = (so->so_options & SO_REUSEPORT);
666 int error, randomport, conflict = 0;
667 kauth_cred_t cred;
668
669 if (TAILQ_EMPTY(&in_ifaddrhead)) /* XXX broken! */
670 return (EADDRNOTAVAIL);
671 if (inp->inp_lport != 0 || inp->inp_laddr.s_addr != INADDR_ANY)
672 return (EINVAL);
673 if (!(so->so_options & (SO_REUSEADDR|SO_REUSEPORT)))
674 wild = 1;
675 socket_unlock(so, 0); /* keep reference on socket */
676 lck_rw_lock_exclusive(pcbinfo->ipi_lock);
677 if (nam != NULL) {
678 struct ifnet *outif = NULL;
679
680 if (nam->sa_len != sizeof (struct sockaddr_in)) {
681 lck_rw_done(pcbinfo->ipi_lock);
682 socket_lock(so, 0);
683 return (EINVAL);
684 }
685 #if 0
686 /*
687 * We should check the family, but old programs
688 * incorrectly fail to initialize it.
689 */
690 if (nam->sa_family != AF_INET) {
691 lck_rw_done(pcbinfo->ipi_lock);
692 socket_lock(so, 0);
693 return (EAFNOSUPPORT);
694 }
695 #endif /* 0 */
696 lport = SIN(nam)->sin_port;
697
698 if (IN_MULTICAST(ntohl(SIN(nam)->sin_addr.s_addr))) {
699 /*
700 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
701 * allow complete duplication of binding if
702 * SO_REUSEPORT is set, or if SO_REUSEADDR is set
703 * and a multicast address is bound on both
704 * new and duplicated sockets.
705 */
706 if (so->so_options & SO_REUSEADDR)
707 reuseport = SO_REUSEADDR|SO_REUSEPORT;
708 } else if (SIN(nam)->sin_addr.s_addr != INADDR_ANY) {
709 struct sockaddr_in sin;
710 struct ifaddr *ifa;
711
712 /* Sanitized for interface address searches */
713 bzero(&sin, sizeof (sin));
714 sin.sin_family = AF_INET;
715 sin.sin_len = sizeof (struct sockaddr_in);
716 sin.sin_addr.s_addr = SIN(nam)->sin_addr.s_addr;
717
718 ifa = ifa_ifwithaddr(SA(&sin));
719 if (ifa == NULL) {
720 lck_rw_done(pcbinfo->ipi_lock);
721 socket_lock(so, 0);
722 return (EADDRNOTAVAIL);
723 } else {
724 /*
725 * Opportunistically determine the outbound
726 * interface that may be used; this may not
727 * hold true if we end up using a route
728 * going over a different interface, e.g.
729 * when sending to a local address. This
730 * will get updated again after sending.
731 */
732 IFA_LOCK(ifa);
733 outif = ifa->ifa_ifp;
734 IFA_UNLOCK(ifa);
735 IFA_REMREF(ifa);
736 }
737 }
738 if (lport != 0) {
739 struct inpcb *t;
740 uid_t u;
741
742 /* GROSS */
743 if (ntohs(lport) < IPPORT_RESERVED) {
744 cred = kauth_cred_proc_ref(p);
745 error = priv_check_cred(cred,
746 PRIV_NETINET_RESERVEDPORT, 0);
747 kauth_cred_unref(&cred);
748 if (error != 0) {
749 lck_rw_done(pcbinfo->ipi_lock);
750 socket_lock(so, 0);
751 return (EACCES);
752 }
753 }
754 if (!IN_MULTICAST(ntohl(SIN(nam)->sin_addr.s_addr)) &&
755 (u = kauth_cred_getuid(so->so_cred)) != 0 &&
756 (t = in_pcblookup_local_and_cleanup(
757 inp->inp_pcbinfo, SIN(nam)->sin_addr, lport,
758 INPLOOKUP_WILDCARD)) != NULL &&
759 (SIN(nam)->sin_addr.s_addr != INADDR_ANY ||
760 t->inp_laddr.s_addr != INADDR_ANY ||
761 !(t->inp_socket->so_options & SO_REUSEPORT)) &&
762 (u != kauth_cred_getuid(t->inp_socket->so_cred)) &&
763 !(t->inp_socket->so_flags & SOF_REUSESHAREUID) &&
764 (SIN(nam)->sin_addr.s_addr != INADDR_ANY ||
765 t->inp_laddr.s_addr != INADDR_ANY)) {
766 if ((t->inp_socket->so_flags &
767 SOF_NOTIFYCONFLICT) &&
768 !(so->so_flags & SOF_NOTIFYCONFLICT))
769 conflict = 1;
770
771 lck_rw_done(pcbinfo->ipi_lock);
772
773 if (conflict)
774 in_pcb_conflict_post_msg(lport);
775
776 socket_lock(so, 0);
777 return (EADDRINUSE);
778 }
779 t = in_pcblookup_local_and_cleanup(pcbinfo,
780 SIN(nam)->sin_addr, lport, wild);
781 if (t != NULL &&
782 (reuseport & t->inp_socket->so_options) == 0) {
783 #if INET6
784 if (SIN(nam)->sin_addr.s_addr != INADDR_ANY ||
785 t->inp_laddr.s_addr != INADDR_ANY ||
786 SOCK_DOM(so) != PF_INET6 ||
787 SOCK_DOM(t->inp_socket) != PF_INET6)
788 #endif /* INET6 */
789 {
790
791 if ((t->inp_socket->so_flags &
792 SOF_NOTIFYCONFLICT) &&
793 !(so->so_flags & SOF_NOTIFYCONFLICT))
794 conflict = 1;
795
796 lck_rw_done(pcbinfo->ipi_lock);
797
798 if (conflict)
799 in_pcb_conflict_post_msg(lport);
800 socket_lock(so, 0);
801 return (EADDRINUSE);
802 }
803 }
804 }
805 inp->inp_laddr = SIN(nam)->sin_addr;
806 inp->inp_last_outifp = outif;
807 }
808 if (lport == 0) {
809 u_short first, last;
810 int count;
811
812 randomport = (so->so_flags & SOF_BINDRANDOMPORT) ||
813 (so->so_type == SOCK_STREAM ? tcp_use_randomport :
814 udp_use_randomport);
815
816 /*
817 * TODO:
818 *
819 * The following should be moved into its own routine and
820 * thus can be shared with in6_pcbsetport(); the latter
821 * currently duplicates the logic.
822 */
823
824 inp->inp_flags |= INP_ANONPORT;
825
826 if (inp->inp_flags & INP_HIGHPORT) {
827 first = ipport_hifirstauto; /* sysctl */
828 last = ipport_hilastauto;
829 lastport = &pcbinfo->ipi_lasthi;
830 } else if (inp->inp_flags & INP_LOWPORT) {
831 cred = kauth_cred_proc_ref(p);
832 error = priv_check_cred(cred,
833 PRIV_NETINET_RESERVEDPORT, 0);
834 kauth_cred_unref(&cred);
835 if (error != 0) {
836 lck_rw_done(pcbinfo->ipi_lock);
837 socket_lock(so, 0);
838 return (error);
839 }
840 first = ipport_lowfirstauto; /* 1023 */
841 last = ipport_lowlastauto; /* 600 */
842 lastport = &pcbinfo->ipi_lastlow;
843 } else {
844 first = ipport_firstauto; /* sysctl */
845 last = ipport_lastauto;
846 lastport = &pcbinfo->ipi_lastport;
847 }
848 /* No point in randomizing if only one port is available */
849
850 if (first == last)
851 randomport = 0;
852 /*
853 * Simple check to ensure all ports are not used up causing
854 * a deadlock here.
855 *
856 * We split the two cases (up and down) so that the direction
857 * is not being tested on each round of the loop.
858 */
859 if (first > last) {
860 /*
861 * counting down
862 */
863 if (randomport) {
864 read_random(&rand_port, sizeof (rand_port));
865 *lastport =
866 first - (rand_port % (first - last));
867 }
868 count = first - last;
869
870 do {
871 if (count-- < 0) { /* completely used? */
872 lck_rw_done(pcbinfo->ipi_lock);
873 socket_lock(so, 0);
874 inp->inp_laddr.s_addr = INADDR_ANY;
875 inp->inp_last_outifp = NULL;
876 return (EADDRNOTAVAIL);
877 }
878 --*lastport;
879 if (*lastport > first || *lastport < last)
880 *lastport = first;
881 lport = htons(*lastport);
882 } while (in_pcblookup_local_and_cleanup(pcbinfo,
883 inp->inp_laddr, lport, wild));
884 } else {
885 /*
886 * counting up
887 */
888 if (randomport) {
889 read_random(&rand_port, sizeof (rand_port));
890 *lastport =
891 first + (rand_port % (first - last));
892 }
893 count = last - first;
894
895 do {
896 if (count-- < 0) { /* completely used? */
897 lck_rw_done(pcbinfo->ipi_lock);
898 socket_lock(so, 0);
899 inp->inp_laddr.s_addr = INADDR_ANY;
900 inp->inp_last_outifp = NULL;
901 return (EADDRNOTAVAIL);
902 }
903 ++*lastport;
904 if (*lastport < first || *lastport > last)
905 *lastport = first;
906 lport = htons(*lastport);
907 } while (in_pcblookup_local_and_cleanup(pcbinfo,
908 inp->inp_laddr, lport, wild));
909 }
910 }
911 socket_lock(so, 0);
912 inp->inp_lport = lport;
913 if (in_pcbinshash(inp, 1) != 0) {
914 inp->inp_laddr.s_addr = INADDR_ANY;
915 inp->inp_lport = 0;
916 inp->inp_last_outifp = NULL;
917 lck_rw_done(pcbinfo->ipi_lock);
918 return (EAGAIN);
919 }
920 lck_rw_done(pcbinfo->ipi_lock);
921 sflt_notify(so, sock_evt_bound, NULL);
922 return (0);
923 }
924
925 /*
926 * Transform old in_pcbconnect() into an inner subroutine for new
927 * in_pcbconnect(); do some validity-checking on the remote address
928 * (in "nam") and then determine local host address (i.e., which
929 * interface) to use to access that remote host.
930 *
931 * This routine may alter the caller-supplied remote address "nam".
932 *
933 * The caller may override the bound-to-interface setting of the socket
934 * by specifying the ifscope parameter (e.g. from IP_PKTINFO.)
935 *
936 * This routine might return an ifp with a reference held if the caller
937 * provides a non-NULL outif, even in the error case. The caller is
938 * responsible for releasing its reference.
939 *
940 * Returns: 0 Success
941 * EINVAL Invalid argument
942 * EAFNOSUPPORT Address family not supported
943 * EADDRNOTAVAIL Address not available
944 */
945 int
946 in_pcbladdr(struct inpcb *inp, struct sockaddr *nam, struct in_addr *laddr,
947 unsigned int ifscope, struct ifnet **outif)
948 {
949 boolean_t nocell = (inp->inp_flags & INP_NO_IFT_CELLULAR);
950 struct route *ro = &inp->inp_route;
951 struct in_ifaddr *ia = NULL;
952 struct sockaddr_in sin;
953 int error = 0;
954
955 if (outif != NULL)
956 *outif = NULL;
957 if (nam->sa_len != sizeof (struct sockaddr_in))
958 return (EINVAL);
959 if (SIN(nam)->sin_family != AF_INET)
960 return (EAFNOSUPPORT);
961 if (SIN(nam)->sin_port == 0)
962 return (EADDRNOTAVAIL);
963
964 /*
965 * If the destination address is INADDR_ANY,
966 * use the primary local address.
967 * If the supplied address is INADDR_BROADCAST,
968 * and the primary interface supports broadcast,
969 * choose the broadcast address for that interface.
970 */
971 if (SIN(nam)->sin_addr.s_addr == INADDR_ANY ||
972 SIN(nam)->sin_addr.s_addr == (u_int32_t)INADDR_BROADCAST) {
973 lck_rw_lock_shared(in_ifaddr_rwlock);
974 if (!TAILQ_EMPTY(&in_ifaddrhead)) {
975 ia = TAILQ_FIRST(&in_ifaddrhead);
976 IFA_LOCK_SPIN(&ia->ia_ifa);
977 if (SIN(nam)->sin_addr.s_addr == INADDR_ANY) {
978 SIN(nam)->sin_addr = IA_SIN(ia)->sin_addr;
979 } else if (ia->ia_ifp->if_flags & IFF_BROADCAST) {
980 SIN(nam)->sin_addr =
981 SIN(&ia->ia_broadaddr)->sin_addr;
982 }
983 IFA_UNLOCK(&ia->ia_ifa);
984 ia = NULL;
985 }
986 lck_rw_done(in_ifaddr_rwlock);
987 }
988 /*
989 * Otherwise, if the socket has already bound the source, just use it.
990 */
991 if (inp->inp_laddr.s_addr != INADDR_ANY) {
992 VERIFY(ia == NULL);
993 *laddr = inp->inp_laddr;
994 return (0);
995 }
996
997 /*
998 * If the ifscope is specified by the caller (e.g. IP_PKTINFO)
999 * then it overrides the sticky ifscope set for the socket.
1000 */
1001 if (ifscope == IFSCOPE_NONE && (inp->inp_flags & INP_BOUND_IF))
1002 ifscope = inp->inp_boundifp->if_index;
1003
1004 /*
1005 * If route is known or can be allocated now,
1006 * our src addr is taken from the i/f, else punt.
1007 * Note that we should check the address family of the cached
1008 * destination, in case of sharing the cache with IPv6.
1009 */
1010 if (ro->ro_rt != NULL)
1011 RT_LOCK_SPIN(ro->ro_rt);
1012 if (ROUTE_UNUSABLE(ro) || ro->ro_dst.sa_family != AF_INET ||
1013 SIN(&ro->ro_dst)->sin_addr.s_addr != SIN(nam)->sin_addr.s_addr ||
1014 (inp->inp_socket->so_options & SO_DONTROUTE)) {
1015 if (ro->ro_rt != NULL)
1016 RT_UNLOCK(ro->ro_rt);
1017 ROUTE_RELEASE(ro);
1018 }
1019 if (!(inp->inp_socket->so_options & SO_DONTROUTE) &&
1020 (ro->ro_rt == NULL || ro->ro_rt->rt_ifp == NULL)) {
1021 if (ro->ro_rt != NULL)
1022 RT_UNLOCK(ro->ro_rt);
1023 ROUTE_RELEASE(ro);
1024 /* No route yet, so try to acquire one */
1025 bzero(&ro->ro_dst, sizeof (struct sockaddr_in));
1026 ro->ro_dst.sa_family = AF_INET;
1027 ro->ro_dst.sa_len = sizeof (struct sockaddr_in);
1028 SIN(&ro->ro_dst)->sin_addr = SIN(nam)->sin_addr;
1029 rtalloc_scoped(ro, ifscope);
1030 if (ro->ro_rt != NULL)
1031 RT_LOCK_SPIN(ro->ro_rt);
1032 }
1033 /* Sanitized local copy for interface address searches */
1034 bzero(&sin, sizeof (sin));
1035 sin.sin_family = AF_INET;
1036 sin.sin_len = sizeof (struct sockaddr_in);
1037 sin.sin_addr.s_addr = SIN(nam)->sin_addr.s_addr;
1038 /*
1039 * If we did not find (or use) a route, assume dest is reachable
1040 * on a directly connected network and try to find a corresponding
1041 * interface to take the source address from.
1042 */
1043 if (ro->ro_rt == NULL) {
1044 VERIFY(ia == NULL);
1045 ia = ifatoia(ifa_ifwithdstaddr(SA(&sin)));
1046 if (ia == NULL)
1047 ia = ifatoia(ifa_ifwithnet_scoped(SA(&sin), ifscope));
1048 error = ((ia == NULL) ? ENETUNREACH : 0);
1049 goto done;
1050 }
1051 RT_LOCK_ASSERT_HELD(ro->ro_rt);
1052 /*
1053 * If the outgoing interface on the route found is not
1054 * a loopback interface, use the address from that interface.
1055 */
1056 if (!(ro->ro_rt->rt_ifp->if_flags & IFF_LOOPBACK)) {
1057 VERIFY(ia == NULL);
1058 /*
1059 * If the route points to a cellular interface and the
1060 * caller forbids our using interfaces of such type,
1061 * pretend that there is no route.
1062 */
1063 if (nocell && IFNET_IS_CELLULAR(ro->ro_rt->rt_ifp)) {
1064 RT_UNLOCK(ro->ro_rt);
1065 ROUTE_RELEASE(ro);
1066 error = EHOSTUNREACH;
1067 } else {
1068 /* Become a regular mutex */
1069 RT_CONVERT_LOCK(ro->ro_rt);
1070 ia = ifatoia(ro->ro_rt->rt_ifa);
1071 IFA_ADDREF(&ia->ia_ifa);
1072 RT_UNLOCK(ro->ro_rt);
1073 error = 0;
1074 }
1075 goto done;
1076 }
1077 VERIFY(ro->ro_rt->rt_ifp->if_flags & IFF_LOOPBACK);
1078 RT_UNLOCK(ro->ro_rt);
1079 /*
1080 * The outgoing interface is marked with 'loopback net', so a route
1081 * to ourselves is here.
1082 * Try to find the interface of the destination address and then
1083 * take the address from there. That interface is not necessarily
1084 * a loopback interface.
1085 */
1086 VERIFY(ia == NULL);
1087 ia = ifatoia(ifa_ifwithdstaddr(SA(&sin)));
1088 if (ia == NULL)
1089 ia = ifatoia(ifa_ifwithaddr_scoped(SA(&sin), ifscope));
1090 if (ia == NULL)
1091 ia = ifatoia(ifa_ifwithnet_scoped(SA(&sin), ifscope));
1092 if (ia == NULL) {
1093 RT_LOCK(ro->ro_rt);
1094 ia = ifatoia(ro->ro_rt->rt_ifa);
1095 if (ia != NULL)
1096 IFA_ADDREF(&ia->ia_ifa);
1097 RT_UNLOCK(ro->ro_rt);
1098 }
1099 error = ((ia == NULL) ? ENETUNREACH : 0);
1100
1101 done:
1102 /*
1103 * If the destination address is multicast and an outgoing
1104 * interface has been set as a multicast option, use the
1105 * address of that interface as our source address.
1106 */
1107 if (error == 0 && IN_MULTICAST(ntohl(SIN(nam)->sin_addr.s_addr)) &&
1108 inp->inp_moptions != NULL) {
1109 struct ip_moptions *imo;
1110 struct ifnet *ifp;
1111
1112 imo = inp->inp_moptions;
1113 IMO_LOCK(imo);
1114 if (imo->imo_multicast_ifp != NULL && (ia == NULL ||
1115 ia->ia_ifp != imo->imo_multicast_ifp)) {
1116 ifp = imo->imo_multicast_ifp;
1117 if (ia != NULL)
1118 IFA_REMREF(&ia->ia_ifa);
1119 lck_rw_lock_shared(in_ifaddr_rwlock);
1120 TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
1121 if (ia->ia_ifp == ifp)
1122 break;
1123 }
1124 if (ia != NULL)
1125 IFA_ADDREF(&ia->ia_ifa);
1126 lck_rw_done(in_ifaddr_rwlock);
1127 if (ia == NULL)
1128 error = EADDRNOTAVAIL;
1129 }
1130 IMO_UNLOCK(imo);
1131 }
1132 /*
1133 * Don't do pcblookup call here; return interface in laddr
1134 * and exit to caller, that will do the lookup.
1135 */
1136 if (ia != NULL) {
1137 /*
1138 * If the source address belongs to a cellular interface
1139 * and the socket forbids our using interfaces of such
1140 * type, pretend that there is no source address.
1141 */
1142 IFA_LOCK_SPIN(&ia->ia_ifa);
1143 if (nocell && IFNET_IS_CELLULAR(ia->ia_ifa.ifa_ifp)) {
1144 IFA_UNLOCK(&ia->ia_ifa);
1145 error = EHOSTUNREACH;
1146 } else if (error == 0) {
1147 *laddr = ia->ia_addr.sin_addr;
1148 if (outif != NULL) {
1149 struct ifnet *ifp;
1150
1151 if (ro->ro_rt != NULL)
1152 ifp = ro->ro_rt->rt_ifp;
1153 else
1154 ifp = ia->ia_ifp;
1155
1156 VERIFY(ifp != NULL);
1157 IFA_CONVERT_LOCK(&ia->ia_ifa);
1158 ifnet_reference(ifp); /* for caller */
1159 if (*outif != NULL)
1160 ifnet_release(*outif);
1161 *outif = ifp;
1162 }
1163 IFA_UNLOCK(&ia->ia_ifa);
1164 } else {
1165 IFA_UNLOCK(&ia->ia_ifa);
1166 }
1167 IFA_REMREF(&ia->ia_ifa);
1168 ia = NULL;
1169 }
1170
1171 if (nocell && error == EHOSTUNREACH) {
1172 soevent(inp->inp_socket, (SO_FILT_HINT_LOCKED |
1173 SO_FILT_HINT_IFDENIED));
1174 }
1175
1176 return (error);
1177 }
1178
1179 /*
1180 * Outer subroutine:
1181 * Connect from a socket to a specified address.
1182 * Both address and port must be specified in argument sin.
1183 * If don't have a local address for this socket yet,
1184 * then pick one.
1185 *
1186 * The caller may override the bound-to-interface setting of the socket
1187 * by specifying the ifscope parameter (e.g. from IP_PKTINFO.)
1188 */
1189 int
1190 in_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct proc *p,
1191 unsigned int ifscope, struct ifnet **outif)
1192 {
1193 struct in_addr laddr;
1194 struct sockaddr_in *sin = (struct sockaddr_in *)(void *)nam;
1195 struct inpcb *pcb;
1196 int error;
1197
1198 /*
1199 * Call inner routine, to assign local interface address.
1200 */
1201 if ((error = in_pcbladdr(inp, nam, &laddr, ifscope, outif)) != 0)
1202 return (error);
1203
1204 socket_unlock(inp->inp_socket, 0);
1205 pcb = in_pcblookup_hash(inp->inp_pcbinfo, sin->sin_addr, sin->sin_port,
1206 inp->inp_laddr.s_addr ? inp->inp_laddr : laddr,
1207 inp->inp_lport, 0, NULL);
1208 socket_lock(inp->inp_socket, 0);
1209
1210 /*
1211 * Check if the socket is still in a valid state. When we unlock this
1212 * embryonic socket, it can get aborted if another thread is closing
1213 * the listener (radar 7947600).
1214 */
1215 if ((inp->inp_socket->so_flags & SOF_ABORTED) != 0)
1216 return (ECONNREFUSED);
1217
1218 if (pcb != NULL) {
1219 in_pcb_checkstate(pcb, WNT_RELEASE, pcb == inp ? 1 : 0);
1220 return (EADDRINUSE);
1221 }
1222 if (inp->inp_laddr.s_addr == INADDR_ANY) {
1223 if (inp->inp_lport == 0) {
1224 error = in_pcbbind(inp, NULL, p);
1225 if (error)
1226 return (error);
1227 }
1228 if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->ipi_lock)) {
1229 /*
1230 * Lock inversion issue, mostly with udp
1231 * multicast packets.
1232 */
1233 socket_unlock(inp->inp_socket, 0);
1234 lck_rw_lock_exclusive(inp->inp_pcbinfo->ipi_lock);
1235 socket_lock(inp->inp_socket, 0);
1236 }
1237 inp->inp_laddr = laddr;
1238 /* no reference needed */
1239 inp->inp_last_outifp = (outif != NULL) ? *outif : NULL;
1240 inp->inp_flags |= INP_INADDR_ANY;
1241 } else {
1242 if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->ipi_lock)) {
1243 /*
1244 * Lock inversion issue, mostly with udp
1245 * multicast packets.
1246 */
1247 socket_unlock(inp->inp_socket, 0);
1248 lck_rw_lock_exclusive(inp->inp_pcbinfo->ipi_lock);
1249 socket_lock(inp->inp_socket, 0);
1250 }
1251 }
1252 inp->inp_faddr = sin->sin_addr;
1253 inp->inp_fport = sin->sin_port;
1254 in_pcbrehash(inp);
1255 lck_rw_done(inp->inp_pcbinfo->ipi_lock);
1256 return (0);
1257 }
1258
1259 void
1260 in_pcbdisconnect(struct inpcb *inp)
1261 {
1262 struct socket *so = inp->inp_socket;
1263
1264 inp->inp_faddr.s_addr = INADDR_ANY;
1265 inp->inp_fport = 0;
1266
1267 if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->ipi_lock)) {
1268 /* lock inversion issue, mostly with udp multicast packets */
1269 socket_unlock(so, 0);
1270 lck_rw_lock_exclusive(inp->inp_pcbinfo->ipi_lock);
1271 socket_lock(so, 0);
1272 }
1273
1274 in_pcbrehash(inp);
1275 lck_rw_done(inp->inp_pcbinfo->ipi_lock);
1276 /*
1277 * A multipath subflow socket would have its SS_NOFDREF set by default,
1278 * so check for SOF_MP_SUBFLOW socket flag before detaching the PCB;
1279 * when the socket is closed for real, SOF_MP_SUBFLOW would be cleared.
1280 */
1281 if (!(so->so_flags & SOF_MP_SUBFLOW) && (so->so_state & SS_NOFDREF))
1282 in_pcbdetach(inp);
1283 }
1284
1285 void
1286 in_pcbdetach(struct inpcb *inp)
1287 {
1288 struct socket *so = inp->inp_socket;
1289
1290 if (so->so_pcb == NULL) {
1291 /* PCB has been disposed */
1292 panic("%s: inp=%p so=%p proto=%d so_pcb is null!\n", __func__,
1293 inp, so, SOCK_PROTO(so));
1294 /* NOTREACHED */
1295 }
1296
1297 #if IPSEC
1298 if (inp->inp_sp != NULL) {
1299 (void) ipsec4_delete_pcbpolicy(inp);
1300 }
1301 #endif /* IPSEC */
1302
1303 /* mark socket state as dead */
1304 if (in_pcb_checkstate(inp, WNT_STOPUSING, 1) != WNT_STOPUSING) {
1305 panic("%s: so=%p proto=%d couldn't set to STOPUSING\n",
1306 __func__, so, SOCK_PROTO(so));
1307 /* NOTREACHED */
1308 }
1309
1310 if (!(so->so_flags & SOF_PCBCLEARING)) {
1311 struct ip_moptions *imo;
1312
1313 inp->inp_vflag = 0;
1314 if (inp->inp_options != NULL) {
1315 (void) m_free(inp->inp_options);
1316 inp->inp_options = NULL;
1317 }
1318 ROUTE_RELEASE(&inp->inp_route);
1319 imo = inp->inp_moptions;
1320 inp->inp_moptions = NULL;
1321 if (imo != NULL)
1322 IMO_REMREF(imo);
1323 sofreelastref(so, 0);
1324 inp->inp_state = INPCB_STATE_DEAD;
1325 /* makes sure we're not called twice from so_close */
1326 so->so_flags |= SOF_PCBCLEARING;
1327
1328 inpcb_gc_sched(inp->inp_pcbinfo, INPCB_TIMER_FAST);
1329 }
1330 }
1331
1332
1333 void
1334 in_pcbdispose(struct inpcb *inp)
1335 {
1336 struct socket *so = inp->inp_socket;
1337 struct inpcbinfo *ipi = inp->inp_pcbinfo;
1338
1339 if (so != NULL && so->so_usecount != 0) {
1340 panic("%s: so %p [%d,%d] usecount %d lockhistory %s\n",
1341 __func__, so, SOCK_DOM(so), SOCK_TYPE(so), so->so_usecount,
1342 solockhistory_nr(so));
1343 /* NOTREACHED */
1344 } else if (inp->inp_wantcnt != WNT_STOPUSING) {
1345 if (so != NULL) {
1346 panic_plain("%s: inp %p invalid wantcnt %d, so %p "
1347 "[%d,%d] usecount %d retaincnt %d state 0x%x "
1348 "flags 0x%x lockhistory %s\n", __func__, inp,
1349 inp->inp_wantcnt, so, SOCK_DOM(so), SOCK_TYPE(so),
1350 so->so_usecount, so->so_retaincnt, so->so_state,
1351 so->so_flags, solockhistory_nr(so));
1352 /* NOTREACHED */
1353 } else {
1354 panic("%s: inp %p invalid wantcnt %d no socket\n",
1355 __func__, inp, inp->inp_wantcnt);
1356 /* NOTREACHED */
1357 }
1358 }
1359
1360 lck_rw_assert(ipi->ipi_lock, LCK_RW_ASSERT_EXCLUSIVE);
1361
1362 inp->inp_gencnt = ++ipi->ipi_gencnt;
1363 /* access ipi in in_pcbremlists */
1364 in_pcbremlists(inp);
1365
1366 if (so != NULL) {
1367 if (so->so_proto->pr_flags & PR_PCBLOCK) {
1368 sofreelastref(so, 0);
1369 if (so->so_rcv.sb_cc > 0 || so->so_snd.sb_cc > 0) {
1370 /*
1371 * selthreadclear() already called
1372 * during sofreelastref() above.
1373 */
1374 sbrelease(&so->so_rcv);
1375 sbrelease(&so->so_snd);
1376 }
1377 if (so->so_head != NULL) {
1378 panic("%s: so=%p head still exist\n",
1379 __func__, so);
1380 /* NOTREACHED */
1381 }
1382 lck_mtx_unlock(&inp->inpcb_mtx);
1383 lck_mtx_destroy(&inp->inpcb_mtx, ipi->ipi_lock_grp);
1384 }
1385 /* makes sure we're not called twice from so_close */
1386 so->so_flags |= SOF_PCBCLEARING;
1387 so->so_saved_pcb = (caddr_t)inp;
1388 so->so_pcb = NULL;
1389 inp->inp_socket = NULL;
1390 #if CONFIG_MACF_NET
1391 mac_inpcb_label_destroy(inp);
1392 #endif /* CONFIG_MACF_NET */
1393 /*
1394 * In case there a route cached after a detach (possible
1395 * in the tcp case), make sure that it is freed before
1396 * we deallocate the structure.
1397 */
1398 ROUTE_RELEASE(&inp->inp_route);
1399 if (!so->cached_in_sock_layer) {
1400 zfree(ipi->ipi_zone, inp);
1401 }
1402 sodealloc(so);
1403 }
1404 }
1405
1406 /*
1407 * The calling convention of in_getsockaddr() and in_getpeeraddr() was
1408 * modified to match the pru_sockaddr() and pru_peeraddr() entry points
1409 * in struct pr_usrreqs, so that protocols can just reference then directly
1410 * without the need for a wrapper function.
1411 */
1412 int
1413 in_getsockaddr(struct socket *so, struct sockaddr **nam)
1414 {
1415 struct inpcb *inp;
1416 struct sockaddr_in *sin;
1417
1418 /*
1419 * Do the malloc first in case it blocks.
1420 */
1421 MALLOC(sin, struct sockaddr_in *, sizeof (*sin), M_SONAME, M_WAITOK);
1422 if (sin == NULL)
1423 return (ENOBUFS);
1424 bzero(sin, sizeof (*sin));
1425 sin->sin_family = AF_INET;
1426 sin->sin_len = sizeof (*sin);
1427
1428 if ((inp = sotoinpcb(so)) == NULL) {
1429 FREE(sin, M_SONAME);
1430 return (EINVAL);
1431 }
1432 sin->sin_port = inp->inp_lport;
1433 sin->sin_addr = inp->inp_laddr;
1434
1435 *nam = (struct sockaddr *)sin;
1436 return (0);
1437 }
1438
1439 int
1440 in_getsockaddr_s(struct socket *so, struct sockaddr_storage *ss)
1441 {
1442 struct sockaddr_in *sin = SIN(ss);
1443 struct inpcb *inp;
1444
1445 VERIFY(ss != NULL);
1446 bzero(ss, sizeof (*ss));
1447
1448 sin->sin_family = AF_INET;
1449 sin->sin_len = sizeof (*sin);
1450
1451 if ((inp = sotoinpcb(so)) == NULL ||
1452 (inp->inp_flags2 & INP2_WANT_FLOW_DIVERT))
1453 return (inp == NULL ? EINVAL : EPROTOTYPE);
1454
1455 sin->sin_port = inp->inp_lport;
1456 sin->sin_addr = inp->inp_laddr;
1457 return (0);
1458 }
1459
1460 int
1461 in_getpeeraddr(struct socket *so, struct sockaddr **nam)
1462 {
1463 struct inpcb *inp;
1464 struct sockaddr_in *sin;
1465
1466 /*
1467 * Do the malloc first in case it blocks.
1468 */
1469 MALLOC(sin, struct sockaddr_in *, sizeof (*sin), M_SONAME, M_WAITOK);
1470 if (sin == NULL)
1471 return (ENOBUFS);
1472 bzero((caddr_t)sin, sizeof (*sin));
1473 sin->sin_family = AF_INET;
1474 sin->sin_len = sizeof (*sin);
1475
1476 if ((inp = sotoinpcb(so)) == NULL) {
1477 FREE(sin, M_SONAME);
1478 return (EINVAL);
1479 }
1480 sin->sin_port = inp->inp_fport;
1481 sin->sin_addr = inp->inp_faddr;
1482
1483 *nam = (struct sockaddr *)sin;
1484 return (0);
1485 }
1486
1487 int
1488 in_getpeeraddr_s(struct socket *so, struct sockaddr_storage *ss)
1489 {
1490 struct sockaddr_in *sin = SIN(ss);
1491 struct inpcb *inp;
1492
1493 VERIFY(ss != NULL);
1494 bzero(ss, sizeof (*ss));
1495
1496 sin->sin_family = AF_INET;
1497 sin->sin_len = sizeof (*sin);
1498
1499 if ((inp = sotoinpcb(so)) == NULL ||
1500 (inp->inp_flags2 & INP2_WANT_FLOW_DIVERT)) {
1501 return (inp == NULL ? EINVAL : EPROTOTYPE);
1502 }
1503
1504 sin->sin_port = inp->inp_fport;
1505 sin->sin_addr = inp->inp_faddr;
1506 return (0);
1507 }
1508
1509 void
1510 in_pcbnotifyall(struct inpcbinfo *pcbinfo, struct in_addr faddr,
1511 int errno, void (*notify)(struct inpcb *, int))
1512 {
1513 struct inpcb *inp;
1514
1515 lck_rw_lock_shared(pcbinfo->ipi_lock);
1516
1517 LIST_FOREACH(inp, pcbinfo->ipi_listhead, inp_list) {
1518 #if INET6
1519 if (!(inp->inp_vflag & INP_IPV4))
1520 continue;
1521 #endif /* INET6 */
1522 if (inp->inp_faddr.s_addr != faddr.s_addr ||
1523 inp->inp_socket == NULL)
1524 continue;
1525 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING)
1526 continue;
1527 socket_lock(inp->inp_socket, 1);
1528 (*notify)(inp, errno);
1529 (void) in_pcb_checkstate(inp, WNT_RELEASE, 1);
1530 socket_unlock(inp->inp_socket, 1);
1531 }
1532 lck_rw_done(pcbinfo->ipi_lock);
1533 }
1534
1535 /*
1536 * Check for alternatives when higher level complains
1537 * about service problems. For now, invalidate cached
1538 * routing information. If the route was created dynamically
1539 * (by a redirect), time to try a default gateway again.
1540 */
1541 void
1542 in_losing(struct inpcb *inp)
1543 {
1544 boolean_t release = FALSE;
1545 struct rtentry *rt;
1546 struct rt_addrinfo info;
1547
1548 if ((rt = inp->inp_route.ro_rt) != NULL) {
1549 struct in_ifaddr *ia = NULL;
1550
1551 bzero((caddr_t)&info, sizeof (info));
1552 RT_LOCK(rt);
1553 info.rti_info[RTAX_DST] =
1554 (struct sockaddr *)&inp->inp_route.ro_dst;
1555 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1556 info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1557 rt_missmsg(RTM_LOSING, &info, rt->rt_flags, 0);
1558 if (rt->rt_flags & RTF_DYNAMIC) {
1559 /*
1560 * Prevent another thread from modifying rt_key,
1561 * rt_gateway via rt_setgate() after rt_lock is
1562 * dropped by marking the route as defunct.
1563 */
1564 rt->rt_flags |= RTF_CONDEMNED;
1565 RT_UNLOCK(rt);
1566 (void) rtrequest(RTM_DELETE, rt_key(rt),
1567 rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
1568 } else {
1569 RT_UNLOCK(rt);
1570 }
1571 /* if the address is gone keep the old route in the pcb */
1572 if (inp->inp_laddr.s_addr != INADDR_ANY &&
1573 (ia = ifa_foraddr(inp->inp_laddr.s_addr)) != NULL) {
1574 /*
1575 * Address is around; ditch the route. A new route
1576 * can be allocated the next time output is attempted.
1577 */
1578 release = TRUE;
1579 }
1580 if (ia != NULL)
1581 IFA_REMREF(&ia->ia_ifa);
1582 }
1583 if (rt == NULL || release)
1584 ROUTE_RELEASE(&inp->inp_route);
1585 }
1586
1587 /*
1588 * After a routing change, flush old routing
1589 * and allocate a (hopefully) better one.
1590 */
1591 void
1592 in_rtchange(struct inpcb *inp, int errno)
1593 {
1594 #pragma unused(errno)
1595 boolean_t release = FALSE;
1596 struct rtentry *rt;
1597
1598 if ((rt = inp->inp_route.ro_rt) != NULL) {
1599 struct in_ifaddr *ia = NULL;
1600
1601 /* if address is gone, keep the old route */
1602 if (inp->inp_laddr.s_addr != INADDR_ANY &&
1603 (ia = ifa_foraddr(inp->inp_laddr.s_addr)) != NULL) {
1604 /*
1605 * Address is around; ditch the route. A new route
1606 * can be allocated the next time output is attempted.
1607 */
1608 release = TRUE;
1609 }
1610 if (ia != NULL)
1611 IFA_REMREF(&ia->ia_ifa);
1612 }
1613 if (rt == NULL || release)
1614 ROUTE_RELEASE(&inp->inp_route);
1615 }
1616
1617 /*
1618 * Lookup a PCB based on the local address and port.
1619 */
1620 struct inpcb *
1621 in_pcblookup_local(struct inpcbinfo *pcbinfo, struct in_addr laddr,
1622 unsigned int lport_arg, int wild_okay)
1623 {
1624 struct inpcb *inp;
1625 int matchwild = 3, wildcard;
1626 u_short lport = lport_arg;
1627
1628 KERNEL_DEBUG(DBG_FNC_PCB_LOOKUP | DBG_FUNC_START, 0, 0, 0, 0, 0);
1629
1630 if (!wild_okay) {
1631 struct inpcbhead *head;
1632 /*
1633 * Look for an unconnected (wildcard foreign addr) PCB that
1634 * matches the local address and port we're looking for.
1635 */
1636 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
1637 pcbinfo->ipi_hashmask)];
1638 LIST_FOREACH(inp, head, inp_hash) {
1639 #if INET6
1640 if (!(inp->inp_vflag & INP_IPV4))
1641 continue;
1642 #endif /* INET6 */
1643 if (inp->inp_faddr.s_addr == INADDR_ANY &&
1644 inp->inp_laddr.s_addr == laddr.s_addr &&
1645 inp->inp_lport == lport) {
1646 /*
1647 * Found.
1648 */
1649 return (inp);
1650 }
1651 }
1652 /*
1653 * Not found.
1654 */
1655 KERNEL_DEBUG(DBG_FNC_PCB_LOOKUP | DBG_FUNC_END, 0, 0, 0, 0, 0);
1656 return (NULL);
1657 } else {
1658 struct inpcbporthead *porthash;
1659 struct inpcbport *phd;
1660 struct inpcb *match = NULL;
1661 /*
1662 * Best fit PCB lookup.
1663 *
1664 * First see if this local port is in use by looking on the
1665 * port hash list.
1666 */
1667 porthash = &pcbinfo->ipi_porthashbase[INP_PCBPORTHASH(lport,
1668 pcbinfo->ipi_porthashmask)];
1669 LIST_FOREACH(phd, porthash, phd_hash) {
1670 if (phd->phd_port == lport)
1671 break;
1672 }
1673 if (phd != NULL) {
1674 /*
1675 * Port is in use by one or more PCBs. Look for best
1676 * fit.
1677 */
1678 LIST_FOREACH(inp, &phd->phd_pcblist, inp_portlist) {
1679 wildcard = 0;
1680 #if INET6
1681 if (!(inp->inp_vflag & INP_IPV4))
1682 continue;
1683 #endif /* INET6 */
1684 if (inp->inp_faddr.s_addr != INADDR_ANY)
1685 wildcard++;
1686 if (inp->inp_laddr.s_addr != INADDR_ANY) {
1687 if (laddr.s_addr == INADDR_ANY)
1688 wildcard++;
1689 else if (inp->inp_laddr.s_addr !=
1690 laddr.s_addr)
1691 continue;
1692 } else {
1693 if (laddr.s_addr != INADDR_ANY)
1694 wildcard++;
1695 }
1696 if (wildcard < matchwild) {
1697 match = inp;
1698 matchwild = wildcard;
1699 if (matchwild == 0) {
1700 break;
1701 }
1702 }
1703 }
1704 }
1705 KERNEL_DEBUG(DBG_FNC_PCB_LOOKUP | DBG_FUNC_END, match,
1706 0, 0, 0, 0);
1707 return (match);
1708 }
1709 }
1710
1711 /*
1712 * Check if PCB exists in hash list.
1713 */
1714 int
1715 in_pcblookup_hash_exists(struct inpcbinfo *pcbinfo, struct in_addr faddr,
1716 u_int fport_arg, struct in_addr laddr, u_int lport_arg, int wildcard,
1717 uid_t *uid, gid_t *gid, struct ifnet *ifp)
1718 {
1719 struct inpcbhead *head;
1720 struct inpcb *inp;
1721 u_short fport = fport_arg, lport = lport_arg;
1722 int found = 0;
1723 struct inpcb *local_wild = NULL;
1724 #if INET6
1725 struct inpcb *local_wild_mapped = NULL;
1726 #endif /* INET6 */
1727
1728 *uid = UID_MAX;
1729 *gid = GID_MAX;
1730
1731 /*
1732 * We may have found the pcb in the last lookup - check this first.
1733 */
1734
1735 lck_rw_lock_shared(pcbinfo->ipi_lock);
1736
1737 /*
1738 * First look for an exact match.
1739 */
1740 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr.s_addr, lport, fport,
1741 pcbinfo->ipi_hashmask)];
1742 LIST_FOREACH(inp, head, inp_hash) {
1743 #if INET6
1744 if (!(inp->inp_vflag & INP_IPV4))
1745 continue;
1746 #endif /* INET6 */
1747 if (inp_restricted(inp, ifp))
1748 continue;
1749
1750 if (ifp != NULL && IFNET_IS_CELLULAR(ifp) &&
1751 (inp->inp_flags & INP_NO_IFT_CELLULAR))
1752 continue;
1753
1754 if (inp->inp_faddr.s_addr == faddr.s_addr &&
1755 inp->inp_laddr.s_addr == laddr.s_addr &&
1756 inp->inp_fport == fport &&
1757 inp->inp_lport == lport) {
1758 if ((found = (inp->inp_socket != NULL))) {
1759 /*
1760 * Found.
1761 */
1762 *uid = kauth_cred_getuid(
1763 inp->inp_socket->so_cred);
1764 *gid = kauth_cred_getgid(
1765 inp->inp_socket->so_cred);
1766 }
1767 lck_rw_done(pcbinfo->ipi_lock);
1768 return (found);
1769 }
1770 }
1771
1772 if (!wildcard) {
1773 /*
1774 * Not found.
1775 */
1776 lck_rw_done(pcbinfo->ipi_lock);
1777 return (0);
1778 }
1779
1780 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
1781 pcbinfo->ipi_hashmask)];
1782 LIST_FOREACH(inp, head, inp_hash) {
1783 #if INET6
1784 if (!(inp->inp_vflag & INP_IPV4))
1785 continue;
1786 #endif /* INET6 */
1787 if (inp_restricted(inp, ifp))
1788 continue;
1789
1790 if (ifp != NULL && IFNET_IS_CELLULAR(ifp) &&
1791 (inp->inp_flags & INP_NO_IFT_CELLULAR))
1792 continue;
1793
1794 if (inp->inp_faddr.s_addr == INADDR_ANY &&
1795 inp->inp_lport == lport) {
1796 if (inp->inp_laddr.s_addr == laddr.s_addr) {
1797 if ((found = (inp->inp_socket != NULL))) {
1798 *uid = kauth_cred_getuid(
1799 inp->inp_socket->so_cred);
1800 *gid = kauth_cred_getgid(
1801 inp->inp_socket->so_cred);
1802 }
1803 lck_rw_done(pcbinfo->ipi_lock);
1804 return (found);
1805 } else if (inp->inp_laddr.s_addr == INADDR_ANY) {
1806 #if INET6
1807 if (inp->inp_socket &&
1808 SOCK_CHECK_DOM(inp->inp_socket, PF_INET6))
1809 local_wild_mapped = inp;
1810 else
1811 #endif /* INET6 */
1812 local_wild = inp;
1813 }
1814 }
1815 }
1816 if (local_wild == NULL) {
1817 #if INET6
1818 if (local_wild_mapped != NULL) {
1819 if ((found = (local_wild_mapped->inp_socket != NULL))) {
1820 *uid = kauth_cred_getuid(
1821 local_wild_mapped->inp_socket->so_cred);
1822 *gid = kauth_cred_getgid(
1823 local_wild_mapped->inp_socket->so_cred);
1824 }
1825 lck_rw_done(pcbinfo->ipi_lock);
1826 return (found);
1827 }
1828 #endif /* INET6 */
1829 lck_rw_done(pcbinfo->ipi_lock);
1830 return (0);
1831 }
1832 if ((found = (local_wild->inp_socket != NULL))) {
1833 *uid = kauth_cred_getuid(
1834 local_wild->inp_socket->so_cred);
1835 *gid = kauth_cred_getgid(
1836 local_wild->inp_socket->so_cred);
1837 }
1838 lck_rw_done(pcbinfo->ipi_lock);
1839 return (found);
1840 }
1841
1842 /*
1843 * Lookup PCB in hash list.
1844 */
1845 struct inpcb *
1846 in_pcblookup_hash(struct inpcbinfo *pcbinfo, struct in_addr faddr,
1847 u_int fport_arg, struct in_addr laddr, u_int lport_arg, int wildcard,
1848 struct ifnet *ifp)
1849 {
1850 struct inpcbhead *head;
1851 struct inpcb *inp;
1852 u_short fport = fport_arg, lport = lport_arg;
1853 struct inpcb *local_wild = NULL;
1854 #if INET6
1855 struct inpcb *local_wild_mapped = NULL;
1856 #endif /* INET6 */
1857
1858 /*
1859 * We may have found the pcb in the last lookup - check this first.
1860 */
1861
1862 lck_rw_lock_shared(pcbinfo->ipi_lock);
1863
1864 /*
1865 * First look for an exact match.
1866 */
1867 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr.s_addr, lport, fport,
1868 pcbinfo->ipi_hashmask)];
1869 LIST_FOREACH(inp, head, inp_hash) {
1870 #if INET6
1871 if (!(inp->inp_vflag & INP_IPV4))
1872 continue;
1873 #endif /* INET6 */
1874 if (inp_restricted(inp, ifp))
1875 continue;
1876
1877 if (ifp != NULL && IFNET_IS_CELLULAR(ifp) &&
1878 (inp->inp_flags & INP_NO_IFT_CELLULAR))
1879 continue;
1880
1881 if (inp->inp_faddr.s_addr == faddr.s_addr &&
1882 inp->inp_laddr.s_addr == laddr.s_addr &&
1883 inp->inp_fport == fport &&
1884 inp->inp_lport == lport) {
1885 /*
1886 * Found.
1887 */
1888 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) !=
1889 WNT_STOPUSING) {
1890 lck_rw_done(pcbinfo->ipi_lock);
1891 return (inp);
1892 } else {
1893 /* it's there but dead, say it isn't found */
1894 lck_rw_done(pcbinfo->ipi_lock);
1895 return (NULL);
1896 }
1897 }
1898 }
1899
1900 if (!wildcard) {
1901 /*
1902 * Not found.
1903 */
1904 lck_rw_done(pcbinfo->ipi_lock);
1905 return (NULL);
1906 }
1907
1908 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
1909 pcbinfo->ipi_hashmask)];
1910 LIST_FOREACH(inp, head, inp_hash) {
1911 #if INET6
1912 if (!(inp->inp_vflag & INP_IPV4))
1913 continue;
1914 #endif /* INET6 */
1915 if (inp_restricted(inp, ifp))
1916 continue;
1917
1918 if (ifp != NULL && IFNET_IS_CELLULAR(ifp) &&
1919 (inp->inp_flags & INP_NO_IFT_CELLULAR))
1920 continue;
1921
1922 if (inp->inp_faddr.s_addr == INADDR_ANY &&
1923 inp->inp_lport == lport) {
1924 if (inp->inp_laddr.s_addr == laddr.s_addr) {
1925 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) !=
1926 WNT_STOPUSING) {
1927 lck_rw_done(pcbinfo->ipi_lock);
1928 return (inp);
1929 } else {
1930 /* it's dead; say it isn't found */
1931 lck_rw_done(pcbinfo->ipi_lock);
1932 return (NULL);
1933 }
1934 } else if (inp->inp_laddr.s_addr == INADDR_ANY) {
1935 #if INET6
1936 if (SOCK_CHECK_DOM(inp->inp_socket, PF_INET6))
1937 local_wild_mapped = inp;
1938 else
1939 #endif /* INET6 */
1940 local_wild = inp;
1941 }
1942 }
1943 }
1944 if (local_wild == NULL) {
1945 #if INET6
1946 if (local_wild_mapped != NULL) {
1947 if (in_pcb_checkstate(local_wild_mapped,
1948 WNT_ACQUIRE, 0) != WNT_STOPUSING) {
1949 lck_rw_done(pcbinfo->ipi_lock);
1950 return (local_wild_mapped);
1951 } else {
1952 /* it's dead; say it isn't found */
1953 lck_rw_done(pcbinfo->ipi_lock);
1954 return (NULL);
1955 }
1956 }
1957 #endif /* INET6 */
1958 lck_rw_done(pcbinfo->ipi_lock);
1959 return (NULL);
1960 }
1961 if (in_pcb_checkstate(local_wild, WNT_ACQUIRE, 0) != WNT_STOPUSING) {
1962 lck_rw_done(pcbinfo->ipi_lock);
1963 return (local_wild);
1964 }
1965 /*
1966 * It's either not found or is already dead.
1967 */
1968 lck_rw_done(pcbinfo->ipi_lock);
1969 return (NULL);
1970 }
1971
1972 /*
1973 * Insert PCB onto various hash lists.
1974 */
1975 int
1976 in_pcbinshash(struct inpcb *inp, int locked)
1977 {
1978 struct inpcbhead *pcbhash;
1979 struct inpcbporthead *pcbporthash;
1980 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
1981 struct inpcbport *phd;
1982 u_int32_t hashkey_faddr;
1983
1984 if (!locked) {
1985 if (!lck_rw_try_lock_exclusive(pcbinfo->ipi_lock)) {
1986 /*
1987 * Lock inversion issue, mostly with udp
1988 * multicast packets
1989 */
1990 socket_unlock(inp->inp_socket, 0);
1991 lck_rw_lock_exclusive(pcbinfo->ipi_lock);
1992 socket_lock(inp->inp_socket, 0);
1993 if (inp->inp_state == INPCB_STATE_DEAD) {
1994 /*
1995 * The socket got dropped when
1996 * it was unlocked
1997 */
1998 lck_rw_done(pcbinfo->ipi_lock);
1999 return (ECONNABORTED);
2000 }
2001 }
2002 }
2003
2004 #if INET6
2005 if (inp->inp_vflag & INP_IPV6)
2006 hashkey_faddr = inp->in6p_faddr.s6_addr32[3] /* XXX */;
2007 else
2008 #endif /* INET6 */
2009 hashkey_faddr = inp->inp_faddr.s_addr;
2010
2011 inp->inp_hash_element = INP_PCBHASH(hashkey_faddr, inp->inp_lport,
2012 inp->inp_fport, pcbinfo->ipi_hashmask);
2013
2014 pcbhash = &pcbinfo->ipi_hashbase[inp->inp_hash_element];
2015
2016 pcbporthash = &pcbinfo->ipi_porthashbase[INP_PCBPORTHASH(inp->inp_lport,
2017 pcbinfo->ipi_porthashmask)];
2018
2019 /*
2020 * Go through port list and look for a head for this lport.
2021 */
2022 LIST_FOREACH(phd, pcbporthash, phd_hash) {
2023 if (phd->phd_port == inp->inp_lport)
2024 break;
2025 }
2026
2027 VERIFY(inp->inp_state != INPCB_STATE_DEAD);
2028
2029 /*
2030 * If none exists, malloc one and tack it on.
2031 */
2032 if (phd == NULL) {
2033 MALLOC(phd, struct inpcbport *, sizeof (struct inpcbport),
2034 M_PCB, M_WAITOK);
2035 if (phd == NULL) {
2036 if (!locked)
2037 lck_rw_done(pcbinfo->ipi_lock);
2038 return (ENOBUFS); /* XXX */
2039 }
2040 phd->phd_port = inp->inp_lport;
2041 LIST_INIT(&phd->phd_pcblist);
2042 LIST_INSERT_HEAD(pcbporthash, phd, phd_hash);
2043 }
2044 inp->inp_phd = phd;
2045 LIST_INSERT_HEAD(&phd->phd_pcblist, inp, inp_portlist);
2046 LIST_INSERT_HEAD(pcbhash, inp, inp_hash);
2047 if (!locked)
2048 lck_rw_done(pcbinfo->ipi_lock);
2049 return (0);
2050 }
2051
2052 /*
2053 * Move PCB to the proper hash bucket when { faddr, fport } have been
2054 * changed. NOTE: This does not handle the case of the lport changing (the
2055 * hashed port list would have to be updated as well), so the lport must
2056 * not change after in_pcbinshash() has been called.
2057 */
2058 void
2059 in_pcbrehash(struct inpcb *inp)
2060 {
2061 struct inpcbhead *head;
2062 u_int32_t hashkey_faddr;
2063
2064 #if INET6
2065 if (inp->inp_vflag & INP_IPV6)
2066 hashkey_faddr = inp->in6p_faddr.s6_addr32[3] /* XXX */;
2067 else
2068 #endif /* INET6 */
2069 hashkey_faddr = inp->inp_faddr.s_addr;
2070
2071 inp->inp_hash_element = INP_PCBHASH(hashkey_faddr, inp->inp_lport,
2072 inp->inp_fport, inp->inp_pcbinfo->ipi_hashmask);
2073 head = &inp->inp_pcbinfo->ipi_hashbase[inp->inp_hash_element];
2074
2075 LIST_REMOVE(inp, inp_hash);
2076 LIST_INSERT_HEAD(head, inp, inp_hash);
2077 }
2078
2079 /*
2080 * Remove PCB from various lists.
2081 * Must be called pcbinfo lock is held in exclusive mode.
2082 */
2083 void
2084 in_pcbremlists(struct inpcb *inp)
2085 {
2086 inp->inp_gencnt = ++inp->inp_pcbinfo->ipi_gencnt;
2087
2088 if (inp->inp_lport) {
2089 struct inpcbport *phd = inp->inp_phd;
2090
2091 LIST_REMOVE(inp, inp_hash);
2092 LIST_REMOVE(inp, inp_portlist);
2093 if (phd != NULL && (LIST_FIRST(&phd->phd_pcblist) == NULL)) {
2094 LIST_REMOVE(phd, phd_hash);
2095 FREE(phd, M_PCB);
2096 }
2097 }
2098
2099 if (inp->inp_flags2 & INP2_TIMEWAIT) {
2100 /* Remove from time-wait queue */
2101 tcp_remove_from_time_wait(inp);
2102 inp->inp_flags2 &= ~INP2_TIMEWAIT;
2103 VERIFY(inp->inp_pcbinfo->ipi_twcount != 0);
2104 inp->inp_pcbinfo->ipi_twcount--;
2105 } else {
2106 /* Remove from global inp list if it is not time-wait */
2107 LIST_REMOVE(inp, inp_list);
2108 }
2109
2110 if (inp->inp_flags2 & INP2_IN_FCTREE) {
2111 inp_fc_getinp(inp->inp_flowhash, (INPFC_SOLOCKED|INPFC_REMOVE));
2112 VERIFY(!(inp->inp_flags2 & INP2_IN_FCTREE));
2113 }
2114
2115 inp->inp_pcbinfo->ipi_count--;
2116 }
2117
2118 /*
2119 * Mechanism used to defer the memory release of PCBs
2120 * The pcb list will contain the pcb until the reaper can clean it up if
2121 * the following conditions are met:
2122 * 1) state "DEAD",
2123 * 2) wantcnt is STOPUSING
2124 * 3) usecount is 0
2125 * This function will be called to either mark the pcb as
2126 */
2127 int
2128 in_pcb_checkstate(struct inpcb *pcb, int mode, int locked)
2129 {
2130 volatile UInt32 *wantcnt = (volatile UInt32 *)&pcb->inp_wantcnt;
2131 UInt32 origwant;
2132 UInt32 newwant;
2133
2134 switch (mode) {
2135 case WNT_STOPUSING:
2136 /*
2137 * Try to mark the pcb as ready for recycling. CAS with
2138 * STOPUSING, if success we're good, if it's in use, will
2139 * be marked later
2140 */
2141 if (locked == 0)
2142 socket_lock(pcb->inp_socket, 1);
2143 pcb->inp_state = INPCB_STATE_DEAD;
2144
2145 stopusing:
2146 if (pcb->inp_socket->so_usecount < 0) {
2147 panic("%s: pcb=%p so=%p usecount is negative\n",
2148 __func__, pcb, pcb->inp_socket);
2149 /* NOTREACHED */
2150 }
2151 if (locked == 0)
2152 socket_unlock(pcb->inp_socket, 1);
2153
2154 inpcb_gc_sched(pcb->inp_pcbinfo, INPCB_TIMER_FAST);
2155
2156 origwant = *wantcnt;
2157 if ((UInt16) origwant == 0xffff) /* should stop using */
2158 return (WNT_STOPUSING);
2159 newwant = 0xffff;
2160 if ((UInt16) origwant == 0) {
2161 /* try to mark it as unsuable now */
2162 OSCompareAndSwap(origwant, newwant, wantcnt);
2163 }
2164 return (WNT_STOPUSING);
2165 break;
2166
2167 case WNT_ACQUIRE:
2168 /*
2169 * Try to increase reference to pcb. If WNT_STOPUSING
2170 * should bail out. If socket state DEAD, try to set count
2171 * to STOPUSING, return failed otherwise increase cnt.
2172 */
2173 do {
2174 origwant = *wantcnt;
2175 if ((UInt16) origwant == 0xffff) {
2176 /* should stop using */
2177 return (WNT_STOPUSING);
2178 }
2179 newwant = origwant + 1;
2180 } while (!OSCompareAndSwap(origwant, newwant, wantcnt));
2181 return (WNT_ACQUIRE);
2182 break;
2183
2184 case WNT_RELEASE:
2185 /*
2186 * Release reference. If result is null and pcb state
2187 * is DEAD, set wanted bit to STOPUSING
2188 */
2189 if (locked == 0)
2190 socket_lock(pcb->inp_socket, 1);
2191
2192 do {
2193 origwant = *wantcnt;
2194 if ((UInt16) origwant == 0x0) {
2195 panic("%s: pcb=%p release with zero count",
2196 __func__, pcb);
2197 /* NOTREACHED */
2198 }
2199 if ((UInt16) origwant == 0xffff) {
2200 /* should stop using */
2201 if (locked == 0)
2202 socket_unlock(pcb->inp_socket, 1);
2203 return (WNT_STOPUSING);
2204 }
2205 newwant = origwant - 1;
2206 } while (!OSCompareAndSwap(origwant, newwant, wantcnt));
2207
2208 if (pcb->inp_state == INPCB_STATE_DEAD)
2209 goto stopusing;
2210 if (pcb->inp_socket->so_usecount < 0) {
2211 panic("%s: RELEASE pcb=%p so=%p usecount is negative\n",
2212 __func__, pcb, pcb->inp_socket);
2213 /* NOTREACHED */
2214 }
2215
2216 if (locked == 0)
2217 socket_unlock(pcb->inp_socket, 1);
2218 return (WNT_RELEASE);
2219 break;
2220
2221 default:
2222 panic("%s: so=%p not a valid state =%x\n", __func__,
2223 pcb->inp_socket, mode);
2224 /* NOTREACHED */
2225 }
2226
2227 /* NOTREACHED */
2228 return (mode);
2229 }
2230
2231 /*
2232 * inpcb_to_compat copies specific bits of an inpcb to a inpcb_compat.
2233 * The inpcb_compat data structure is passed to user space and must
2234 * not change. We intentionally avoid copying pointers.
2235 */
2236 void
2237 inpcb_to_compat(struct inpcb *inp, struct inpcb_compat *inp_compat)
2238 {
2239 bzero(inp_compat, sizeof (*inp_compat));
2240 inp_compat->inp_fport = inp->inp_fport;
2241 inp_compat->inp_lport = inp->inp_lport;
2242 inp_compat->nat_owner = 0;
2243 inp_compat->nat_cookie = 0;
2244 inp_compat->inp_gencnt = inp->inp_gencnt;
2245 inp_compat->inp_flags = inp->inp_flags;
2246 inp_compat->inp_flow = inp->inp_flow;
2247 inp_compat->inp_vflag = inp->inp_vflag;
2248 inp_compat->inp_ip_ttl = inp->inp_ip_ttl;
2249 inp_compat->inp_ip_p = inp->inp_ip_p;
2250 inp_compat->inp_dependfaddr.inp6_foreign =
2251 inp->inp_dependfaddr.inp6_foreign;
2252 inp_compat->inp_dependladdr.inp6_local =
2253 inp->inp_dependladdr.inp6_local;
2254 inp_compat->inp_depend4.inp4_ip_tos = inp->inp_depend4.inp4_ip_tos;
2255 inp_compat->inp_depend6.inp6_hlim = 0;
2256 inp_compat->inp_depend6.inp6_cksum = inp->inp_depend6.inp6_cksum;
2257 inp_compat->inp_depend6.inp6_ifindex = 0;
2258 inp_compat->inp_depend6.inp6_hops = inp->inp_depend6.inp6_hops;
2259 }
2260
2261 void
2262 inpcb_to_xinpcb64(struct inpcb *inp, struct xinpcb64 *xinp)
2263 {
2264 xinp->inp_fport = inp->inp_fport;
2265 xinp->inp_lport = inp->inp_lport;
2266 xinp->inp_gencnt = inp->inp_gencnt;
2267 xinp->inp_flags = inp->inp_flags;
2268 xinp->inp_flow = inp->inp_flow;
2269 xinp->inp_vflag = inp->inp_vflag;
2270 xinp->inp_ip_ttl = inp->inp_ip_ttl;
2271 xinp->inp_ip_p = inp->inp_ip_p;
2272 xinp->inp_dependfaddr.inp6_foreign = inp->inp_dependfaddr.inp6_foreign;
2273 xinp->inp_dependladdr.inp6_local = inp->inp_dependladdr.inp6_local;
2274 xinp->inp_depend4.inp4_ip_tos = inp->inp_depend4.inp4_ip_tos;
2275 xinp->inp_depend6.inp6_hlim = 0;
2276 xinp->inp_depend6.inp6_cksum = inp->inp_depend6.inp6_cksum;
2277 xinp->inp_depend6.inp6_ifindex = 0;
2278 xinp->inp_depend6.inp6_hops = inp->inp_depend6.inp6_hops;
2279 }
2280
2281 /*
2282 * The following routines implement this scheme:
2283 *
2284 * Callers of ip_output() that intend to cache the route in the inpcb pass
2285 * a local copy of the struct route to ip_output(). Using a local copy of
2286 * the cached route significantly simplifies things as IP no longer has to
2287 * worry about having exclusive access to the passed in struct route, since
2288 * it's defined in the caller's stack; in essence, this allows for a lock-
2289 * less operation when updating the struct route at the IP level and below,
2290 * whenever necessary. The scheme works as follows:
2291 *
2292 * Prior to dropping the socket's lock and calling ip_output(), the caller
2293 * copies the struct route from the inpcb into its stack, and adds a reference
2294 * to the cached route entry, if there was any. The socket's lock is then
2295 * dropped and ip_output() is called with a pointer to the copy of struct
2296 * route defined on the stack (not to the one in the inpcb.)
2297 *
2298 * Upon returning from ip_output(), the caller then acquires the socket's
2299 * lock and synchronizes the cache; if there is no route cached in the inpcb,
2300 * it copies the local copy of struct route (which may or may not contain any
2301 * route) back into the cache; otherwise, if the inpcb has a route cached in
2302 * it, the one in the local copy will be freed, if there's any. Trashing the
2303 * cached route in the inpcb can be avoided because ip_output() is single-
2304 * threaded per-PCB (i.e. multiple transmits on a PCB are always serialized
2305 * by the socket/transport layer.)
2306 */
2307 void
2308 inp_route_copyout(struct inpcb *inp, struct route *dst)
2309 {
2310 struct route *src = &inp->inp_route;
2311
2312 lck_mtx_assert(&inp->inpcb_mtx, LCK_MTX_ASSERT_OWNED);
2313
2314 /*
2315 * If the route in the PCB is stale or not for IPv4, blow it away;
2316 * this is possible in the case of IPv4-mapped address case.
2317 */
2318 if (ROUTE_UNUSABLE(src) || rt_key(src->ro_rt)->sa_family != AF_INET)
2319 ROUTE_RELEASE(src);
2320
2321 route_copyout(dst, src, sizeof (*dst));
2322 }
2323
2324 void
2325 inp_route_copyin(struct inpcb *inp, struct route *src)
2326 {
2327 struct route *dst = &inp->inp_route;
2328
2329 lck_mtx_assert(&inp->inpcb_mtx, LCK_MTX_ASSERT_OWNED);
2330
2331 /* Minor sanity check */
2332 if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET)
2333 panic("%s: wrong or corrupted route: %p", __func__, src);
2334
2335 route_copyin(src, dst, sizeof (*src));
2336 }
2337
2338 /*
2339 * Handler for setting IP_FORCE_OUT_IFP/IP_BOUND_IF/IPV6_BOUND_IF socket option.
2340 */
2341 int
2342 inp_bindif(struct inpcb *inp, unsigned int ifscope, struct ifnet **pifp)
2343 {
2344 struct ifnet *ifp = NULL;
2345
2346 ifnet_head_lock_shared();
2347 if ((ifscope > (unsigned)if_index) || (ifscope != IFSCOPE_NONE &&
2348 (ifp = ifindex2ifnet[ifscope]) == NULL)) {
2349 ifnet_head_done();
2350 return (ENXIO);
2351 }
2352 ifnet_head_done();
2353
2354 VERIFY(ifp != NULL || ifscope == IFSCOPE_NONE);
2355
2356 /*
2357 * A zero interface scope value indicates an "unbind".
2358 * Otherwise, take in whatever value the app desires;
2359 * the app may already know the scope (or force itself
2360 * to such a scope) ahead of time before the interface
2361 * gets attached. It doesn't matter either way; any
2362 * route lookup from this point on will require an
2363 * exact match for the embedded interface scope.
2364 */
2365 inp->inp_boundifp = ifp;
2366 if (inp->inp_boundifp == NULL)
2367 inp->inp_flags &= ~INP_BOUND_IF;
2368 else
2369 inp->inp_flags |= INP_BOUND_IF;
2370
2371 /* Blow away any cached route in the PCB */
2372 ROUTE_RELEASE(&inp->inp_route);
2373
2374 if (pifp != NULL)
2375 *pifp = ifp;
2376
2377 return (0);
2378 }
2379
2380 /*
2381 * Handler for setting IP_NO_IFT_CELLULAR/IPV6_NO_IFT_CELLULAR socket option,
2382 * as well as for setting PROC_UUID_NO_CELLULAR policy.
2383 */
2384 void
2385 inp_set_nocellular(struct inpcb *inp)
2386 {
2387 inp->inp_flags |= INP_NO_IFT_CELLULAR;
2388
2389 /* Blow away any cached route in the PCB */
2390 ROUTE_RELEASE(&inp->inp_route);
2391 }
2392
2393 /*
2394 * Handler for clearing IP_NO_IFT_CELLULAR/IPV6_NO_IFT_CELLULAR socket option,
2395 * as well as for clearing PROC_UUID_NO_CELLULAR policy.
2396 */
2397 void
2398 inp_clear_nocellular(struct inpcb *inp)
2399 {
2400 struct socket *so = inp->inp_socket;
2401
2402 /*
2403 * SO_RESTRICT_DENY_CELLULAR socket restriction issued on the socket
2404 * has a higher precendence than INP_NO_IFT_CELLULAR. Clear the flag
2405 * if and only if the socket is unrestricted.
2406 */
2407 if (so != NULL && !(so->so_restrictions & SO_RESTRICT_DENY_CELLULAR)) {
2408 inp->inp_flags &= ~INP_NO_IFT_CELLULAR;
2409
2410 /* Blow away any cached route in the PCB */
2411 ROUTE_RELEASE(&inp->inp_route);
2412 }
2413 }
2414
2415 #if FLOW_DIVERT
2416 /*
2417 * Called when PROC_UUID_FLOW_DIVERT is set.
2418 */
2419 void
2420 inp_set_flow_divert(struct inpcb *inp)
2421 {
2422 inp->inp_flags2 |= INP2_WANT_FLOW_DIVERT;
2423 }
2424
2425 /*
2426 * Called when PROC_UUID_FLOW_DIVERT is cleared.
2427 */
2428 void
2429 inp_clear_flow_divert(struct inpcb *inp)
2430 {
2431 inp->inp_flags2 &= ~INP2_WANT_FLOW_DIVERT;
2432 }
2433 #endif /* FLOW_DIVERT */
2434
2435 /*
2436 * Calculate flow hash for an inp, used by an interface to identify a
2437 * flow. When an interface provides flow control advisory, this flow
2438 * hash is used as an identifier.
2439 */
2440 u_int32_t
2441 inp_calc_flowhash(struct inpcb *inp)
2442 {
2443 struct inp_flowhash_key fh __attribute__((aligned(8)));
2444 u_int32_t flowhash = 0;
2445 struct inpcb *tmp_inp = NULL;
2446
2447 if (inp_hash_seed == 0)
2448 inp_hash_seed = RandomULong();
2449
2450 bzero(&fh, sizeof (fh));
2451
2452 bcopy(&inp->inp_dependladdr, &fh.infh_laddr, sizeof (fh.infh_laddr));
2453 bcopy(&inp->inp_dependfaddr, &fh.infh_faddr, sizeof (fh.infh_faddr));
2454
2455 fh.infh_lport = inp->inp_lport;
2456 fh.infh_fport = inp->inp_fport;
2457 fh.infh_af = (inp->inp_vflag & INP_IPV6) ? AF_INET6 : AF_INET;
2458 fh.infh_proto = inp->inp_ip_p;
2459 fh.infh_rand1 = RandomULong();
2460 fh.infh_rand2 = RandomULong();
2461
2462 try_again:
2463 flowhash = net_flowhash(&fh, sizeof (fh), inp_hash_seed);
2464 if (flowhash == 0) {
2465 /* try to get a non-zero flowhash */
2466 inp_hash_seed = RandomULong();
2467 goto try_again;
2468 }
2469
2470 inp->inp_flowhash = flowhash;
2471
2472 /* Insert the inp into inp_fc_tree */
2473 lck_mtx_lock_spin(&inp_fc_lck);
2474 tmp_inp = RB_FIND(inp_fc_tree, &inp_fc_tree, inp);
2475 if (tmp_inp != NULL) {
2476 /*
2477 * There is a different inp with the same flowhash.
2478 * There can be a collision on flow hash but the
2479 * probability is low. Let's recompute the
2480 * flowhash.
2481 */
2482 lck_mtx_unlock(&inp_fc_lck);
2483 /* recompute hash seed */
2484 inp_hash_seed = RandomULong();
2485 goto try_again;
2486 }
2487
2488 RB_INSERT(inp_fc_tree, &inp_fc_tree, inp);
2489 inp->inp_flags2 |= INP2_IN_FCTREE;
2490 lck_mtx_unlock(&inp_fc_lck);
2491
2492 return (flowhash);
2493 }
2494
2495 void
2496 inp_flowadv(uint32_t flowhash)
2497 {
2498 struct inpcb *inp;
2499
2500 inp = inp_fc_getinp(flowhash, 0);
2501
2502 if (inp == NULL)
2503 return;
2504 inp_fc_feedback(inp);
2505 }
2506
2507 /*
2508 * Function to compare inp_fc_entries in inp flow control tree
2509 */
2510 static inline int
2511 infc_cmp(const struct inpcb *inp1, const struct inpcb *inp2)
2512 {
2513 return (memcmp(&(inp1->inp_flowhash), &(inp2->inp_flowhash),
2514 sizeof(inp1->inp_flowhash)));
2515 }
2516
2517 static struct inpcb *
2518 inp_fc_getinp(u_int32_t flowhash, u_int32_t flags)
2519 {
2520 struct inpcb *inp = NULL;
2521 int locked = (flags & INPFC_SOLOCKED) ? 1 : 0;
2522
2523 lck_mtx_lock_spin(&inp_fc_lck);
2524 key_inp.inp_flowhash = flowhash;
2525 inp = RB_FIND(inp_fc_tree, &inp_fc_tree, &key_inp);
2526 if (inp == NULL) {
2527 /* inp is not present, return */
2528 lck_mtx_unlock(&inp_fc_lck);
2529 return (NULL);
2530 }
2531
2532 if (flags & INPFC_REMOVE) {
2533 RB_REMOVE(inp_fc_tree, &inp_fc_tree, inp);
2534 lck_mtx_unlock(&inp_fc_lck);
2535
2536 bzero(&(inp->infc_link), sizeof (inp->infc_link));
2537 inp->inp_flags2 &= ~INP2_IN_FCTREE;
2538 return (NULL);
2539 }
2540
2541 if (in_pcb_checkstate(inp, WNT_ACQUIRE, locked) == WNT_STOPUSING)
2542 inp = NULL;
2543 lck_mtx_unlock(&inp_fc_lck);
2544
2545 return (inp);
2546 }
2547
2548 static void
2549 inp_fc_feedback(struct inpcb *inp)
2550 {
2551 struct socket *so = inp->inp_socket;
2552
2553 /* we already hold a want_cnt on this inp, socket can't be null */
2554 VERIFY(so != NULL);
2555 socket_lock(so, 1);
2556
2557 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
2558 socket_unlock(so, 1);
2559 return;
2560 }
2561
2562 /*
2563 * Return if the connection is not in flow-controlled state.
2564 * This can happen if the connection experienced
2565 * loss while it was in flow controlled state
2566 */
2567 if (!INP_WAIT_FOR_IF_FEEDBACK(inp)) {
2568 socket_unlock(so, 1);
2569 return;
2570 }
2571 inp_reset_fc_state(inp);
2572
2573 if (SOCK_TYPE(so) == SOCK_STREAM)
2574 inp_fc_unthrottle_tcp(inp);
2575
2576 socket_unlock(so, 1);
2577 }
2578
2579 void
2580 inp_reset_fc_state(struct inpcb *inp)
2581 {
2582 struct socket *so = inp->inp_socket;
2583 int suspended = (INP_IS_FLOW_SUSPENDED(inp)) ? 1 : 0;
2584 int needwakeup = (INP_WAIT_FOR_IF_FEEDBACK(inp)) ? 1 : 0;
2585
2586 inp->inp_flags &= ~(INP_FLOW_CONTROLLED | INP_FLOW_SUSPENDED);
2587
2588 if (suspended) {
2589 so->so_flags &= ~(SOF_SUSPENDED);
2590 soevent(so, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_RESUME));
2591 }
2592
2593 if (inp->inp_sndinprog_cnt > 0)
2594 inp->inp_flags |= INP_FC_FEEDBACK;
2595
2596 /* Give a write wakeup to unblock the socket */
2597 if (needwakeup)
2598 sowwakeup(so);
2599 }
2600
2601 int
2602 inp_set_fc_state(struct inpcb *inp, int advcode)
2603 {
2604 struct inpcb *tmp_inp = NULL;
2605 /*
2606 * If there was a feedback from the interface when
2607 * send operation was in progress, we should ignore
2608 * this flow advisory to avoid a race between setting
2609 * flow controlled state and receiving feedback from
2610 * the interface
2611 */
2612 if (inp->inp_flags & INP_FC_FEEDBACK)
2613 return (0);
2614
2615 inp->inp_flags &= ~(INP_FLOW_CONTROLLED | INP_FLOW_SUSPENDED);
2616 if ((tmp_inp = inp_fc_getinp(inp->inp_flowhash,
2617 INPFC_SOLOCKED)) != NULL) {
2618 if (in_pcb_checkstate(tmp_inp, WNT_RELEASE, 1) == WNT_STOPUSING)
2619 return (0);
2620 VERIFY(tmp_inp == inp);
2621 switch (advcode) {
2622 case FADV_FLOW_CONTROLLED:
2623 inp->inp_flags |= INP_FLOW_CONTROLLED;
2624 break;
2625 case FADV_SUSPENDED:
2626 inp->inp_flags |= INP_FLOW_SUSPENDED;
2627 soevent(inp->inp_socket,
2628 (SO_FILT_HINT_LOCKED | SO_FILT_HINT_SUSPEND));
2629
2630 /* Record the fact that suspend event was sent */
2631 inp->inp_socket->so_flags |= SOF_SUSPENDED;
2632 break;
2633 }
2634 return (1);
2635 }
2636 return (0);
2637 }
2638
2639 /*
2640 * Handler for SO_FLUSH socket option.
2641 */
2642 int
2643 inp_flush(struct inpcb *inp, int optval)
2644 {
2645 u_int32_t flowhash = inp->inp_flowhash;
2646 struct ifnet *rtifp, *oifp;
2647
2648 /* Either all classes or one of the valid ones */
2649 if (optval != SO_TC_ALL && !SO_VALID_TC(optval))
2650 return (EINVAL);
2651
2652 /* We need a flow hash for identification */
2653 if (flowhash == 0)
2654 return (0);
2655
2656 /* Grab the interfaces from the route and pcb */
2657 rtifp = ((inp->inp_route.ro_rt != NULL) ?
2658 inp->inp_route.ro_rt->rt_ifp : NULL);
2659 oifp = inp->inp_last_outifp;
2660
2661 if (rtifp != NULL)
2662 if_qflush_sc(rtifp, so_tc2msc(optval), flowhash, NULL, NULL, 0);
2663 if (oifp != NULL && oifp != rtifp)
2664 if_qflush_sc(oifp, so_tc2msc(optval), flowhash, NULL, NULL, 0);
2665
2666 return (0);
2667 }
2668
2669 /*
2670 * Clear the INP_INADDR_ANY flag (special case for PPP only)
2671 */
2672 void
2673 inp_clear_INP_INADDR_ANY(struct socket *so)
2674 {
2675 struct inpcb *inp = NULL;
2676
2677 socket_lock(so, 1);
2678 inp = sotoinpcb(so);
2679 if (inp) {
2680 inp->inp_flags &= ~INP_INADDR_ANY;
2681 }
2682 socket_unlock(so, 1);
2683 }
2684
2685 void
2686 inp_get_soprocinfo(struct inpcb *inp, struct so_procinfo *soprocinfo)
2687 {
2688 struct socket *so = inp->inp_socket;
2689
2690 soprocinfo->spi_pid = so->last_pid;
2691 /*
2692 * When not delegated, the effective pid is the same as the real pid
2693 */
2694 if (so->so_flags & SOF_DELEGATED)
2695 soprocinfo->spi_epid = so->e_pid;
2696 else
2697 soprocinfo->spi_epid = so->last_pid;
2698 }
2699
2700 int
2701 inp_findinpcb_procinfo(struct inpcbinfo *pcbinfo, uint32_t flowhash,
2702 struct so_procinfo *soprocinfo)
2703 {
2704 struct inpcb *inp = NULL;
2705 int found = 0;
2706
2707 bzero(soprocinfo, sizeof (struct so_procinfo));
2708
2709 if (!flowhash)
2710 return (-1);
2711
2712 lck_rw_lock_shared(pcbinfo->ipi_lock);
2713 LIST_FOREACH(inp, pcbinfo->ipi_listhead, inp_list) {
2714 if (inp->inp_state != INPCB_STATE_DEAD &&
2715 inp->inp_socket != NULL &&
2716 inp->inp_flowhash == flowhash) {
2717 found = 1;
2718 inp_get_soprocinfo(inp, soprocinfo);
2719 break;
2720 }
2721 }
2722 lck_rw_done(pcbinfo->ipi_lock);
2723
2724 return (found);
2725 }
2726
2727 #if CONFIG_PROC_UUID_POLICY
2728 static void
2729 inp_update_cellular_policy(struct inpcb *inp, boolean_t set)
2730 {
2731 struct socket *so = inp->inp_socket;
2732 int before, after;
2733
2734 VERIFY(so != NULL);
2735 VERIFY(inp->inp_state != INPCB_STATE_DEAD);
2736
2737 before = (inp->inp_flags & INP_NO_IFT_CELLULAR);
2738 if (set) {
2739 inp_set_nocellular(inp);
2740 } else {
2741 inp_clear_nocellular(inp);
2742 }
2743 after = (inp->inp_flags & INP_NO_IFT_CELLULAR);
2744 if (net_io_policy_log && (before != after)) {
2745 static const char *ok = "OK";
2746 static const char *nok = "NOACCESS";
2747 uuid_string_t euuid_buf;
2748 pid_t epid;
2749
2750 if (so->so_flags & SOF_DELEGATED) {
2751 uuid_unparse(so->e_uuid, euuid_buf);
2752 epid = so->e_pid;
2753 } else {
2754 uuid_unparse(so->last_uuid, euuid_buf);
2755 epid = so->last_pid;
2756 }
2757
2758 /* allow this socket to generate another notification event */
2759 so->so_ifdenied_notifies = 0;
2760
2761 log(LOG_DEBUG, "%s: so 0x%llx [%d,%d] epid %d "
2762 "euuid %s%s %s->%s\n", __func__,
2763 (uint64_t)VM_KERNEL_ADDRPERM(so), SOCK_DOM(so),
2764 SOCK_TYPE(so), epid, euuid_buf,
2765 (so->so_flags & SOF_DELEGATED) ?
2766 " [delegated]" : "",
2767 ((before < after) ? ok : nok),
2768 ((before < after) ? nok : ok));
2769 }
2770 }
2771
2772 #if FLOW_DIVERT
2773 static void
2774 inp_update_flow_divert_policy(struct inpcb *inp, boolean_t set)
2775 {
2776 struct socket *so = inp->inp_socket;
2777 int before, after;
2778
2779 VERIFY(so != NULL);
2780 VERIFY(inp->inp_state != INPCB_STATE_DEAD);
2781
2782 if (set && !(inp->inp_flags2 & INP2_WANT_FLOW_DIVERT)) {
2783 set = !flow_divert_is_dns_service(so);
2784 }
2785
2786 before = (inp->inp_flags2 & INP2_WANT_FLOW_DIVERT);
2787 if (set) {
2788 inp_set_flow_divert(inp);
2789 } else {
2790 inp_clear_flow_divert(inp);
2791 }
2792 after = (inp->inp_flags2 & INP2_WANT_FLOW_DIVERT);
2793 if (net_io_policy_log && (before != after)) {
2794 static const char *wanted = "WANTED";
2795 static const char *unwanted = "UNWANTED";
2796 uuid_string_t euuid_buf;
2797 pid_t epid;
2798
2799 if (so->so_flags & SOF_DELEGATED) {
2800 uuid_unparse(so->e_uuid, euuid_buf);
2801 epid = so->e_pid;
2802 } else {
2803 uuid_unparse(so->last_uuid, euuid_buf);
2804 epid = so->last_pid;
2805 }
2806
2807 log(LOG_DEBUG, "%s: so 0x%llx [%d,%d] epid %d "
2808 "euuid %s%s %s->%s\n", __func__,
2809 (uint64_t)VM_KERNEL_ADDRPERM(so), SOCK_DOM(so),
2810 SOCK_TYPE(so), epid, euuid_buf,
2811 (so->so_flags & SOF_DELEGATED) ?
2812 " [delegated]" : "",
2813 ((before < after) ? unwanted : wanted),
2814 ((before < after) ? wanted : unwanted));
2815 }
2816 }
2817 #endif /* FLOW_DIVERT */
2818 #endif /* !CONFIG_PROC_UUID_POLICY */
2819
2820 int
2821 inp_update_policy(struct inpcb *inp)
2822 {
2823 #if CONFIG_PROC_UUID_POLICY
2824 struct socket *so = inp->inp_socket;
2825 uint32_t pflags = 0;
2826 int32_t ogencnt;
2827 int err = 0;
2828
2829 if (!net_io_policy_uuid ||
2830 so == NULL || inp->inp_state == INPCB_STATE_DEAD)
2831 return (0);
2832
2833 /*
2834 * Kernel-created sockets that aren't delegating other sockets
2835 * are currently exempted from UUID policy checks.
2836 */
2837 if (so->last_pid == 0 && !(so->so_flags & SOF_DELEGATED))
2838 return (0);
2839
2840 ogencnt = so->so_policy_gencnt;
2841 err = proc_uuid_policy_lookup(((so->so_flags & SOF_DELEGATED) ?
2842 so->e_uuid : so->last_uuid), &pflags, &so->so_policy_gencnt);
2843
2844 /*
2845 * Discard cached generation count if the entry is gone (ENOENT),
2846 * so that we go thru the checks below.
2847 */
2848 if (err == ENOENT && ogencnt != 0)
2849 so->so_policy_gencnt = 0;
2850
2851 /*
2852 * If the generation count has changed, inspect the policy flags
2853 * and act accordingly. If a policy flag was previously set and
2854 * the UUID is no longer present in the table (ENOENT), treat it
2855 * as if the flag has been cleared.
2856 */
2857 if ((err == 0 || err == ENOENT) && ogencnt != so->so_policy_gencnt) {
2858 /* update cellular policy for this socket */
2859 if (err == 0 && (pflags & PROC_UUID_NO_CELLULAR)) {
2860 inp_update_cellular_policy(inp, TRUE);
2861 } else if (!(pflags & PROC_UUID_NO_CELLULAR)) {
2862 inp_update_cellular_policy(inp, FALSE);
2863 }
2864 #if FLOW_DIVERT
2865 /* update flow divert policy for this socket */
2866 if (err == 0 && (pflags & PROC_UUID_FLOW_DIVERT)) {
2867 inp_update_flow_divert_policy(inp, TRUE);
2868 } else if (!(pflags & PROC_UUID_FLOW_DIVERT)) {
2869 inp_update_flow_divert_policy(inp, FALSE);
2870 }
2871 #endif /* FLOW_DIVERT */
2872 }
2873
2874 return ((err == ENOENT) ? 0 : err);
2875 #else /* !CONFIG_PROC_UUID_POLICY */
2876 #pragma unused(inp)
2877 return (0);
2878 #endif /* !CONFIG_PROC_UUID_POLICY */
2879 }
2880
2881 boolean_t
2882 inp_restricted(struct inpcb *inp, struct ifnet *ifp)
2883 {
2884 VERIFY(inp != NULL);
2885
2886 if (!sorestrictrecv)
2887 return (FALSE);
2888
2889 if (ifp == NULL || !(ifp->if_eflags & IFEF_RESTRICTED_RECV))
2890 return (FALSE);
2891
2892 if (inp->inp_flags & INP_RECV_ANYIF)
2893 return (FALSE);
2894
2895 if ((inp->inp_flags & INP_BOUND_IF) && inp->inp_boundifp == ifp)
2896 return (FALSE);
2897
2898 return (TRUE);
2899 }
mirror of XNU