2 * Copyright (c) 2000-2019 Apple Inc. All rights reserved.
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
29 * Copyright (c) 1982, 1986, 1991, 1993, 1995
30 * The Regents of the University of California. All rights reserved.
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60 * @(#)in_pcb.c 8.4 (Berkeley) 5/24/95
61 * $FreeBSD: src/sys/netinet/in_pcb.c,v 1.59.2.17 2001/08/13 16:26:17 ume Exp $
64 #include <sys/param.h>
65 #include <sys/systm.h>
66 #include <sys/malloc.h>
68 #include <sys/domain.h>
69 #include <sys/protosw.h>
70 #include <sys/socket.h>
71 #include <sys/socketvar.h>
73 #include <sys/kernel.h>
74 #include <sys/sysctl.h>
75 #include <sys/mcache.h>
76 #include <sys/kauth.h>
78 #include <sys/proc_uuid_policy.h>
79 #include <sys/syslog.h>
83 #include <libkern/OSAtomic.h>
84 #include <kern/locks.h>
86 #include <machine/limits.h>
88 #include <kern/zalloc.h>
91 #include <net/if_types.h>
92 #include <net/route.h>
93 #include <net/flowhash.h>
94 #include <net/flowadv.h>
95 #include <net/nat464_utils.h>
96 #include <net/ntstat.h>
97 #include <net/restricted_in_port.h>
99 #include <netinet/in.h>
100 #include <netinet/in_pcb.h>
101 #include <netinet/in_var.h>
102 #include <netinet/ip_var.h>
105 #include <netinet/ip6.h>
106 #include <netinet6/ip6_var.h>
109 #include <sys/kdebug.h>
110 #include <sys/random.h>
112 #include <dev/random/randomdev.h>
113 #include <mach/boolean.h>
115 #include <pexpert/pexpert.h>
118 #include <net/necp.h>
121 #include <sys/stat.h>
123 #include <sys/vnode.h>
127 extern const char *proc_name_address(struct proc
*);
129 static lck_grp_t
*inpcb_lock_grp
;
130 static lck_attr_t
*inpcb_lock_attr
;
131 static lck_grp_attr_t
*inpcb_lock_grp_attr
;
132 decl_lck_mtx_data(static, inpcb_lock
); /* global INPCB lock */
133 decl_lck_mtx_data(static, inpcb_timeout_lock
);
135 static TAILQ_HEAD(, inpcbinfo
) inpcb_head
= TAILQ_HEAD_INITIALIZER(inpcb_head
);
137 static u_int16_t inpcb_timeout_run
= 0; /* INPCB timer is scheduled to run */
138 static boolean_t inpcb_garbage_collecting
= FALSE
; /* gc timer is scheduled */
139 static boolean_t inpcb_ticking
= FALSE
; /* "slow" timer is scheduled */
140 static boolean_t inpcb_fast_timer_on
= FALSE
;
142 #define INPCB_GCREQ_THRESHOLD 50000
144 static thread_call_t inpcb_thread_call
, inpcb_fast_thread_call
;
145 static void inpcb_sched_timeout(void);
146 static void inpcb_sched_lazy_timeout(void);
147 static void _inpcb_sched_timeout(unsigned int);
148 static void inpcb_timeout(void *, void *);
149 const int inpcb_timeout_lazy
= 10; /* 10 seconds leeway for lazy timers */
150 extern int tvtohz(struct timeval
*);
152 #if CONFIG_PROC_UUID_POLICY
153 static void inp_update_cellular_policy(struct inpcb
*, boolean_t
);
155 static void inp_update_necp_want_app_policy(struct inpcb
*, boolean_t
);
157 #endif /* !CONFIG_PROC_UUID_POLICY */
159 #define DBG_FNC_PCB_LOOKUP NETDBG_CODE(DBG_NETTCP, (6 << 8))
160 #define DBG_FNC_PCB_HLOOKUP NETDBG_CODE(DBG_NETTCP, ((6 << 8) | 1))
163 * These configure the range of local port addresses assigned to
164 * "unspecified" outgoing connections/packets/whatever.
166 int ipport_lowfirstauto
= IPPORT_RESERVED
- 1; /* 1023 */
167 int ipport_lowlastauto
= IPPORT_RESERVEDSTART
; /* 600 */
168 int ipport_firstauto
= IPPORT_HIFIRSTAUTO
; /* 49152 */
169 int ipport_lastauto
= IPPORT_HILASTAUTO
; /* 65535 */
170 int ipport_hifirstauto
= IPPORT_HIFIRSTAUTO
; /* 49152 */
171 int ipport_hilastauto
= IPPORT_HILASTAUTO
; /* 65535 */
173 #define RANGECHK(var, min, max) \
174 if ((var) < (min)) { (var) = (min); } \
175 else if ((var) > (max)) { (var) = (max); }
178 sysctl_net_ipport_check SYSCTL_HANDLER_ARGS
180 #pragma unused(arg1, arg2)
182 #if (DEBUG | DEVELOPMENT)
183 int old_value
= *(int *)oidp
->oid_arg1
;
185 * For unit testing allow a non-superuser process with the
186 * proper entitlement to modify the variables
189 if (proc_suser(current_proc()) != 0 &&
190 (error
= priv_check_cred(kauth_cred_get(),
191 PRIV_NETINET_RESERVEDPORT
, 0))) {
195 #endif /* (DEBUG | DEVELOPMENT) */
197 error
= sysctl_handle_int(oidp
, oidp
->oid_arg1
, oidp
->oid_arg2
, req
);
199 RANGECHK(ipport_lowfirstauto
, 1, IPPORT_RESERVED
- 1);
200 RANGECHK(ipport_lowlastauto
, 1, IPPORT_RESERVED
- 1);
201 RANGECHK(ipport_firstauto
, IPPORT_RESERVED
, USHRT_MAX
);
202 RANGECHK(ipport_lastauto
, IPPORT_RESERVED
, USHRT_MAX
);
203 RANGECHK(ipport_hifirstauto
, IPPORT_RESERVED
, USHRT_MAX
);
204 RANGECHK(ipport_hilastauto
, IPPORT_RESERVED
, USHRT_MAX
);
207 #if (DEBUG | DEVELOPMENT)
208 os_log(OS_LOG_DEFAULT
,
209 "%s:%u sysctl net.restricted_port.verbose: %d -> %d)",
210 proc_best_name(current_proc()), proc_selfpid(),
211 old_value
, *(int *)oidp
->oid_arg1
);
212 #endif /* (DEBUG | DEVELOPMENT) */
219 SYSCTL_NODE(_net_inet_ip
, IPPROTO_IP
, portrange
,
220 CTLFLAG_RW
| CTLFLAG_LOCKED
, 0, "IP Ports");
222 #if (DEBUG | DEVELOPMENT)
223 #define CTLFAGS_IP_PORTRANGE (CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED | CTLFLAG_ANYBODY)
225 #define CTLFAGS_IP_PORTRANGE (CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED)
226 #endif /* (DEBUG | DEVELOPMENT) */
228 SYSCTL_PROC(_net_inet_ip_portrange
, OID_AUTO
, lowfirst
,
229 CTLFAGS_IP_PORTRANGE
,
230 &ipport_lowfirstauto
, 0, &sysctl_net_ipport_check
, "I", "");
231 SYSCTL_PROC(_net_inet_ip_portrange
, OID_AUTO
, lowlast
,
232 CTLFAGS_IP_PORTRANGE
,
233 &ipport_lowlastauto
, 0, &sysctl_net_ipport_check
, "I", "");
234 SYSCTL_PROC(_net_inet_ip_portrange
, OID_AUTO
, first
,
235 CTLFAGS_IP_PORTRANGE
,
236 &ipport_firstauto
, 0, &sysctl_net_ipport_check
, "I", "");
237 SYSCTL_PROC(_net_inet_ip_portrange
, OID_AUTO
, last
,
238 CTLFAGS_IP_PORTRANGE
,
239 &ipport_lastauto
, 0, &sysctl_net_ipport_check
, "I", "");
240 SYSCTL_PROC(_net_inet_ip_portrange
, OID_AUTO
, hifirst
,
241 CTLFAGS_IP_PORTRANGE
,
242 &ipport_hifirstauto
, 0, &sysctl_net_ipport_check
, "I", "");
243 SYSCTL_PROC(_net_inet_ip_portrange
, OID_AUTO
, hilast
,
244 CTLFAGS_IP_PORTRANGE
,
245 &ipport_hilastauto
, 0, &sysctl_net_ipport_check
, "I", "");
247 static uint32_t apn_fallbk_debug
= 0;
248 #define apn_fallbk_log(x) do { if (apn_fallbk_debug >= 1) log x; } while (0)
251 static boolean_t apn_fallbk_enabled
= TRUE
;
253 SYSCTL_DECL(_net_inet
);
254 SYSCTL_NODE(_net_inet
, OID_AUTO
, apn_fallback
, CTLFLAG_RW
| CTLFLAG_LOCKED
, 0, "APN Fallback");
255 SYSCTL_UINT(_net_inet_apn_fallback
, OID_AUTO
, enable
, CTLFLAG_RW
| CTLFLAG_LOCKED
,
256 &apn_fallbk_enabled
, 0, "APN fallback enable");
257 SYSCTL_UINT(_net_inet_apn_fallback
, OID_AUTO
, debug
, CTLFLAG_RW
| CTLFLAG_LOCKED
,
258 &apn_fallbk_debug
, 0, "APN fallback debug enable");
260 static boolean_t apn_fallbk_enabled
= FALSE
;
263 extern int udp_use_randomport
;
264 extern int tcp_use_randomport
;
266 /* Structs used for flowhash computation */
267 struct inp_flowhash_key_addr
{
277 struct inp_flowhash_key
{
278 struct inp_flowhash_key_addr infh_laddr
;
279 struct inp_flowhash_key_addr infh_faddr
;
280 u_int32_t infh_lport
;
281 u_int32_t infh_fport
;
283 u_int32_t infh_proto
;
284 u_int32_t infh_rand1
;
285 u_int32_t infh_rand2
;
288 static u_int32_t inp_hash_seed
= 0;
290 static int infc_cmp(const struct inpcb
*, const struct inpcb
*);
292 /* Flags used by inp_fc_getinp */
293 #define INPFC_SOLOCKED 0x1
294 #define INPFC_REMOVE 0x2
295 static struct inpcb
*inp_fc_getinp(u_int32_t
, u_int32_t
);
297 static void inp_fc_feedback(struct inpcb
*);
298 extern void tcp_remove_from_time_wait(struct inpcb
*inp
);
300 decl_lck_mtx_data(static, inp_fc_lck
);
302 RB_HEAD(inp_fc_tree
, inpcb
) inp_fc_tree
;
303 RB_PROTOTYPE(inp_fc_tree
, inpcb
, infc_link
, infc_cmp
);
304 RB_GENERATE(inp_fc_tree
, inpcb
, infc_link
, infc_cmp
);
307 * Use this inp as a key to find an inp in the flowhash tree.
308 * Accesses to it are protected by inp_fc_lck.
310 struct inpcb key_inp
;
313 * in_pcb.c: manage the Protocol Control Blocks.
319 static int inpcb_initialized
= 0;
321 VERIFY(!inpcb_initialized
);
322 inpcb_initialized
= 1;
324 inpcb_lock_grp_attr
= lck_grp_attr_alloc_init();
325 inpcb_lock_grp
= lck_grp_alloc_init("inpcb", inpcb_lock_grp_attr
);
326 inpcb_lock_attr
= lck_attr_alloc_init();
327 lck_mtx_init(&inpcb_lock
, inpcb_lock_grp
, inpcb_lock_attr
);
328 lck_mtx_init(&inpcb_timeout_lock
, inpcb_lock_grp
, inpcb_lock_attr
);
329 inpcb_thread_call
= thread_call_allocate_with_priority(inpcb_timeout
,
330 NULL
, THREAD_CALL_PRIORITY_KERNEL
);
331 inpcb_fast_thread_call
= thread_call_allocate_with_priority(
332 inpcb_timeout
, NULL
, THREAD_CALL_PRIORITY_KERNEL
);
333 if (inpcb_thread_call
== NULL
|| inpcb_fast_thread_call
== NULL
) {
334 panic("unable to alloc the inpcb thread call");
338 * Initialize data structures required to deliver
341 lck_mtx_init(&inp_fc_lck
, inpcb_lock_grp
, inpcb_lock_attr
);
342 lck_mtx_lock(&inp_fc_lck
);
343 RB_INIT(&inp_fc_tree
);
344 bzero(&key_inp
, sizeof(key_inp
));
345 lck_mtx_unlock(&inp_fc_lck
);
348 #define INPCB_HAVE_TIMER_REQ(req) (((req).intimer_lazy > 0) || \
349 ((req).intimer_fast > 0) || ((req).intimer_nodelay > 0))
351 inpcb_timeout(void *arg0
, void *arg1
)
353 #pragma unused(arg0, arg1)
354 struct inpcbinfo
*ipi
;
356 struct intimercount gccnt
, tmcnt
;
359 * Update coarse-grained networking timestamp (in sec.); the idea
360 * is to piggy-back on the timeout callout to update the counter
361 * returnable via net_uptime().
365 bzero(&gccnt
, sizeof(gccnt
));
366 bzero(&tmcnt
, sizeof(tmcnt
));
368 lck_mtx_lock_spin(&inpcb_timeout_lock
);
369 gc
= inpcb_garbage_collecting
;
370 inpcb_garbage_collecting
= FALSE
;
373 inpcb_ticking
= FALSE
;
376 lck_mtx_unlock(&inpcb_timeout_lock
);
378 lck_mtx_lock(&inpcb_lock
);
379 TAILQ_FOREACH(ipi
, &inpcb_head
, ipi_entry
) {
380 if (INPCB_HAVE_TIMER_REQ(ipi
->ipi_gc_req
)) {
381 bzero(&ipi
->ipi_gc_req
,
382 sizeof(ipi
->ipi_gc_req
));
383 if (gc
&& ipi
->ipi_gc
!= NULL
) {
385 gccnt
.intimer_lazy
+=
386 ipi
->ipi_gc_req
.intimer_lazy
;
387 gccnt
.intimer_fast
+=
388 ipi
->ipi_gc_req
.intimer_fast
;
389 gccnt
.intimer_nodelay
+=
390 ipi
->ipi_gc_req
.intimer_nodelay
;
393 if (INPCB_HAVE_TIMER_REQ(ipi
->ipi_timer_req
)) {
394 bzero(&ipi
->ipi_timer_req
,
395 sizeof(ipi
->ipi_timer_req
));
396 if (t
&& ipi
->ipi_timer
!= NULL
) {
398 tmcnt
.intimer_lazy
+=
399 ipi
->ipi_timer_req
.intimer_lazy
;
400 tmcnt
.intimer_fast
+=
401 ipi
->ipi_timer_req
.intimer_fast
;
402 tmcnt
.intimer_nodelay
+=
403 ipi
->ipi_timer_req
.intimer_nodelay
;
407 lck_mtx_unlock(&inpcb_lock
);
408 lck_mtx_lock_spin(&inpcb_timeout_lock
);
411 /* lock was dropped above, so check first before overriding */
412 if (!inpcb_garbage_collecting
) {
413 inpcb_garbage_collecting
= INPCB_HAVE_TIMER_REQ(gccnt
);
415 if (!inpcb_ticking
) {
416 inpcb_ticking
= INPCB_HAVE_TIMER_REQ(tmcnt
);
419 /* re-arm the timer if there's work to do */
421 VERIFY(inpcb_timeout_run
>= 0 && inpcb_timeout_run
< 2);
423 if (gccnt
.intimer_nodelay
> 0 || tmcnt
.intimer_nodelay
> 0) {
424 inpcb_sched_timeout();
425 } else if ((gccnt
.intimer_fast
+ tmcnt
.intimer_fast
) <= 5) {
426 /* be lazy when idle with little activity */
427 inpcb_sched_lazy_timeout();
429 inpcb_sched_timeout();
432 lck_mtx_unlock(&inpcb_timeout_lock
);
436 inpcb_sched_timeout(void)
438 _inpcb_sched_timeout(0);
442 inpcb_sched_lazy_timeout(void)
444 _inpcb_sched_timeout(inpcb_timeout_lazy
);
448 _inpcb_sched_timeout(unsigned int offset
)
450 uint64_t deadline
, leeway
;
452 clock_interval_to_deadline(1, NSEC_PER_SEC
, &deadline
);
453 LCK_MTX_ASSERT(&inpcb_timeout_lock
, LCK_MTX_ASSERT_OWNED
);
454 if (inpcb_timeout_run
== 0 &&
455 (inpcb_garbage_collecting
|| inpcb_ticking
)) {
456 lck_mtx_convert_spin(&inpcb_timeout_lock
);
459 inpcb_fast_timer_on
= TRUE
;
460 thread_call_enter_delayed(inpcb_thread_call
,
463 inpcb_fast_timer_on
= FALSE
;
464 clock_interval_to_absolutetime_interval(offset
,
465 NSEC_PER_SEC
, &leeway
);
466 thread_call_enter_delayed_with_leeway(
467 inpcb_thread_call
, NULL
, deadline
, leeway
,
468 THREAD_CALL_DELAY_LEEWAY
);
470 } else if (inpcb_timeout_run
== 1 &&
471 offset
== 0 && !inpcb_fast_timer_on
) {
473 * Since the request was for a fast timer but the
474 * scheduled timer is a lazy timer, try to schedule
475 * another instance of fast timer also.
477 lck_mtx_convert_spin(&inpcb_timeout_lock
);
479 inpcb_fast_timer_on
= TRUE
;
480 thread_call_enter_delayed(inpcb_fast_thread_call
, deadline
);
485 inpcb_gc_sched(struct inpcbinfo
*ipi
, u_int32_t type
)
489 lck_mtx_lock_spin(&inpcb_timeout_lock
);
490 inpcb_garbage_collecting
= TRUE
;
491 gccnt
= ipi
->ipi_gc_req
.intimer_nodelay
+
492 ipi
->ipi_gc_req
.intimer_fast
;
494 if (gccnt
> INPCB_GCREQ_THRESHOLD
) {
495 type
= INPCB_TIMER_FAST
;
499 case INPCB_TIMER_NODELAY
:
500 atomic_add_32(&ipi
->ipi_gc_req
.intimer_nodelay
, 1);
501 inpcb_sched_timeout();
503 case INPCB_TIMER_FAST
:
504 atomic_add_32(&ipi
->ipi_gc_req
.intimer_fast
, 1);
505 inpcb_sched_timeout();
508 atomic_add_32(&ipi
->ipi_gc_req
.intimer_lazy
, 1);
509 inpcb_sched_lazy_timeout();
512 lck_mtx_unlock(&inpcb_timeout_lock
);
516 inpcb_timer_sched(struct inpcbinfo
*ipi
, u_int32_t type
)
518 lck_mtx_lock_spin(&inpcb_timeout_lock
);
519 inpcb_ticking
= TRUE
;
521 case INPCB_TIMER_NODELAY
:
522 atomic_add_32(&ipi
->ipi_timer_req
.intimer_nodelay
, 1);
523 inpcb_sched_timeout();
525 case INPCB_TIMER_FAST
:
526 atomic_add_32(&ipi
->ipi_timer_req
.intimer_fast
, 1);
527 inpcb_sched_timeout();
530 atomic_add_32(&ipi
->ipi_timer_req
.intimer_lazy
, 1);
531 inpcb_sched_lazy_timeout();
534 lck_mtx_unlock(&inpcb_timeout_lock
);
538 in_pcbinfo_attach(struct inpcbinfo
*ipi
)
540 struct inpcbinfo
*ipi0
;
542 lck_mtx_lock(&inpcb_lock
);
543 TAILQ_FOREACH(ipi0
, &inpcb_head
, ipi_entry
) {
545 panic("%s: ipi %p already in the list\n",
550 TAILQ_INSERT_TAIL(&inpcb_head
, ipi
, ipi_entry
);
551 lck_mtx_unlock(&inpcb_lock
);
555 in_pcbinfo_detach(struct inpcbinfo
*ipi
)
557 struct inpcbinfo
*ipi0
;
560 lck_mtx_lock(&inpcb_lock
);
561 TAILQ_FOREACH(ipi0
, &inpcb_head
, ipi_entry
) {
567 TAILQ_REMOVE(&inpcb_head
, ipi0
, ipi_entry
);
571 lck_mtx_unlock(&inpcb_lock
);
577 * Allocate a PCB and associate it with the socket.
584 in_pcballoc(struct socket
*so
, struct inpcbinfo
*pcbinfo
, struct proc
*p
)
591 #endif /* CONFIG_MACF_NET */
593 if ((so
->so_flags1
& SOF1_CACHED_IN_SOCK_LAYER
) == 0) {
594 inp
= (struct inpcb
*)zalloc(pcbinfo
->ipi_zone
);
598 bzero((caddr_t
)inp
, sizeof(*inp
));
600 inp
= (struct inpcb
*)(void *)so
->so_saved_pcb
;
601 temp
= inp
->inp_saved_ppcb
;
602 bzero((caddr_t
)inp
, sizeof(*inp
));
603 inp
->inp_saved_ppcb
= temp
;
606 inp
->inp_gencnt
= ++pcbinfo
->ipi_gencnt
;
607 inp
->inp_pcbinfo
= pcbinfo
;
608 inp
->inp_socket
= so
;
610 mac_error
= mac_inpcb_label_init(inp
, M_WAITOK
);
611 if (mac_error
!= 0) {
612 if ((so
->so_flags1
& SOF1_CACHED_IN_SOCK_LAYER
) == 0) {
613 zfree(pcbinfo
->ipi_zone
, inp
);
617 mac_inpcb_label_associate(so
, inp
);
618 #endif /* CONFIG_MACF_NET */
619 /* make sure inp_stat is always 64-bit aligned */
620 inp
->inp_stat
= (struct inp_stat
*)P2ROUNDUP(inp
->inp_stat_store
,
622 if (((uintptr_t)inp
->inp_stat
- (uintptr_t)inp
->inp_stat_store
) +
623 sizeof(*inp
->inp_stat
) > sizeof(inp
->inp_stat_store
)) {
624 panic("%s: insufficient space to align inp_stat", __func__
);
628 /* make sure inp_cstat is always 64-bit aligned */
629 inp
->inp_cstat
= (struct inp_stat
*)P2ROUNDUP(inp
->inp_cstat_store
,
631 if (((uintptr_t)inp
->inp_cstat
- (uintptr_t)inp
->inp_cstat_store
) +
632 sizeof(*inp
->inp_cstat
) > sizeof(inp
->inp_cstat_store
)) {
633 panic("%s: insufficient space to align inp_cstat", __func__
);
637 /* make sure inp_wstat is always 64-bit aligned */
638 inp
->inp_wstat
= (struct inp_stat
*)P2ROUNDUP(inp
->inp_wstat_store
,
640 if (((uintptr_t)inp
->inp_wstat
- (uintptr_t)inp
->inp_wstat_store
) +
641 sizeof(*inp
->inp_wstat
) > sizeof(inp
->inp_wstat_store
)) {
642 panic("%s: insufficient space to align inp_wstat", __func__
);
646 /* make sure inp_Wstat is always 64-bit aligned */
647 inp
->inp_Wstat
= (struct inp_stat
*)P2ROUNDUP(inp
->inp_Wstat_store
,
649 if (((uintptr_t)inp
->inp_Wstat
- (uintptr_t)inp
->inp_Wstat_store
) +
650 sizeof(*inp
->inp_Wstat
) > sizeof(inp
->inp_Wstat_store
)) {
651 panic("%s: insufficient space to align inp_Wstat", __func__
);
655 so
->so_pcb
= (caddr_t
)inp
;
657 if (so
->so_proto
->pr_flags
& PR_PCBLOCK
) {
658 lck_mtx_init(&inp
->inpcb_mtx
, pcbinfo
->ipi_lock_grp
,
659 pcbinfo
->ipi_lock_attr
);
663 if (SOCK_DOM(so
) == PF_INET6
&& !ip6_mapped_addr_on
) {
664 inp
->inp_flags
|= IN6P_IPV6_V6ONLY
;
667 if (ip6_auto_flowlabel
) {
668 inp
->inp_flags
|= IN6P_AUTOFLOWLABEL
;
671 if (intcoproc_unrestricted
) {
672 inp
->inp_flags2
|= INP2_INTCOPROC_ALLOWED
;
675 (void) inp_update_policy(inp
);
677 lck_rw_lock_exclusive(pcbinfo
->ipi_lock
);
678 inp
->inp_gencnt
= ++pcbinfo
->ipi_gencnt
;
679 LIST_INSERT_HEAD(pcbinfo
->ipi_listhead
, inp
, inp_list
);
680 pcbinfo
->ipi_count
++;
681 lck_rw_done(pcbinfo
->ipi_lock
);
686 * in_pcblookup_local_and_cleanup does everything
687 * in_pcblookup_local does but it checks for a socket
688 * that's going away. Since we know that the lock is
689 * held read+write when this function is called, we
690 * can safely dispose of this socket like the slow
691 * timer would usually do and return NULL. This is
695 in_pcblookup_local_and_cleanup(struct inpcbinfo
*pcbinfo
, struct in_addr laddr
,
696 u_int lport_arg
, int wild_okay
)
700 /* Perform normal lookup */
701 inp
= in_pcblookup_local(pcbinfo
, laddr
, lport_arg
, wild_okay
);
703 /* Check if we found a match but it's waiting to be disposed */
704 if (inp
!= NULL
&& inp
->inp_wantcnt
== WNT_STOPUSING
) {
705 struct socket
*so
= inp
->inp_socket
;
709 if (so
->so_usecount
== 0) {
710 if (inp
->inp_state
!= INPCB_STATE_DEAD
) {
713 in_pcbdispose(inp
); /* will unlock & destroy */
716 socket_unlock(so
, 0);
724 in_pcb_conflict_post_msg(u_int16_t port
)
727 * Radar 5523020 send a kernel event notification if a
728 * non-participating socket tries to bind the port a socket
729 * who has set SOF_NOTIFYCONFLICT owns.
731 struct kev_msg ev_msg
;
732 struct kev_in_portinuse in_portinuse
;
734 bzero(&in_portinuse
, sizeof(struct kev_in_portinuse
));
735 bzero(&ev_msg
, sizeof(struct kev_msg
));
736 in_portinuse
.port
= ntohs(port
); /* port in host order */
737 in_portinuse
.req_pid
= proc_selfpid();
738 ev_msg
.vendor_code
= KEV_VENDOR_APPLE
;
739 ev_msg
.kev_class
= KEV_NETWORK_CLASS
;
740 ev_msg
.kev_subclass
= KEV_INET_SUBCLASS
;
741 ev_msg
.event_code
= KEV_INET_PORTINUSE
;
742 ev_msg
.dv
[0].data_ptr
= &in_portinuse
;
743 ev_msg
.dv
[0].data_length
= sizeof(struct kev_in_portinuse
);
744 ev_msg
.dv
[1].data_length
= 0;
745 dlil_post_complete_msg(NULL
, &ev_msg
);
749 * Bind an INPCB to an address and/or port. This routine should not alter
750 * the caller-supplied local address "nam".
753 * EADDRNOTAVAIL Address not available.
754 * EINVAL Invalid argument
755 * EAFNOSUPPORT Address family not supported [notdef]
756 * EACCES Permission denied
757 * EADDRINUSE Address in use
758 * EAGAIN Resource unavailable, try again
759 * priv_check_cred:EPERM Operation not permitted
762 in_pcbbind(struct inpcb
*inp
, struct sockaddr
*nam
, struct proc
*p
)
764 struct socket
*so
= inp
->inp_socket
;
765 unsigned short *lastport
;
766 struct inpcbinfo
*pcbinfo
= inp
->inp_pcbinfo
;
767 u_short lport
= 0, rand_port
= 0;
768 int wild
= 0, reuseport
= (so
->so_options
& SO_REUSEPORT
);
769 int error
, randomport
, conflict
= 0;
770 boolean_t anonport
= FALSE
;
772 struct in_addr laddr
;
773 struct ifnet
*outif
= NULL
;
775 if (TAILQ_EMPTY(&in_ifaddrhead
)) { /* XXX broken! */
776 return EADDRNOTAVAIL
;
778 if (!(so
->so_options
& (SO_REUSEADDR
| SO_REUSEPORT
))) {
782 bzero(&laddr
, sizeof(laddr
));
784 socket_unlock(so
, 0); /* keep reference on socket */
785 lck_rw_lock_exclusive(pcbinfo
->ipi_lock
);
786 if (inp
->inp_lport
!= 0 || inp
->inp_laddr
.s_addr
!= INADDR_ANY
) {
787 /* another thread completed the bind */
788 lck_rw_done(pcbinfo
->ipi_lock
);
794 if (nam
->sa_len
!= sizeof(struct sockaddr_in
)) {
795 lck_rw_done(pcbinfo
->ipi_lock
);
801 * We should check the family, but old programs
802 * incorrectly fail to initialize it.
804 if (nam
->sa_family
!= AF_INET
) {
805 lck_rw_done(pcbinfo
->ipi_lock
);
810 lport
= SIN(nam
)->sin_port
;
812 if (IN_MULTICAST(ntohl(SIN(nam
)->sin_addr
.s_addr
))) {
814 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
815 * allow complete duplication of binding if
816 * SO_REUSEPORT is set, or if SO_REUSEADDR is set
817 * and a multicast address is bound on both
818 * new and duplicated sockets.
820 if (so
->so_options
& SO_REUSEADDR
) {
821 reuseport
= SO_REUSEADDR
| SO_REUSEPORT
;
823 } else if (SIN(nam
)->sin_addr
.s_addr
!= INADDR_ANY
) {
824 struct sockaddr_in sin
;
827 /* Sanitized for interface address searches */
828 bzero(&sin
, sizeof(sin
));
829 sin
.sin_family
= AF_INET
;
830 sin
.sin_len
= sizeof(struct sockaddr_in
);
831 sin
.sin_addr
.s_addr
= SIN(nam
)->sin_addr
.s_addr
;
833 ifa
= ifa_ifwithaddr(SA(&sin
));
835 lck_rw_done(pcbinfo
->ipi_lock
);
837 return EADDRNOTAVAIL
;
840 * Opportunistically determine the outbound
841 * interface that may be used; this may not
842 * hold true if we end up using a route
843 * going over a different interface, e.g.
844 * when sending to a local address. This
845 * will get updated again after sending.
848 outif
= ifa
->ifa_ifp
;
860 if (ntohs(lport
) < IPPORT_RESERVED
&&
861 SIN(nam
)->sin_addr
.s_addr
!= 0 &&
862 !(inp
->inp_flags2
& INP2_EXTERNAL_PORT
)) {
863 cred
= kauth_cred_proc_ref(p
);
864 error
= priv_check_cred(cred
,
865 PRIV_NETINET_RESERVEDPORT
, 0);
866 kauth_cred_unref(&cred
);
868 lck_rw_done(pcbinfo
->ipi_lock
);
873 #endif /* !CONFIG_EMBEDDED */
875 * Check wether the process is allowed to bind to a restricted port
877 if (!current_task_can_use_restricted_in_port(lport
,
878 so
->so_proto
->pr_protocol
, PORT_FLAGS_BSD
)) {
879 lck_rw_done(pcbinfo
->ipi_lock
);
884 if (!IN_MULTICAST(ntohl(SIN(nam
)->sin_addr
.s_addr
)) &&
885 (u
= kauth_cred_getuid(so
->so_cred
)) != 0 &&
886 (t
= in_pcblookup_local_and_cleanup(
887 inp
->inp_pcbinfo
, SIN(nam
)->sin_addr
, lport
,
888 INPLOOKUP_WILDCARD
)) != NULL
&&
889 (SIN(nam
)->sin_addr
.s_addr
!= INADDR_ANY
||
890 t
->inp_laddr
.s_addr
!= INADDR_ANY
||
891 !(t
->inp_socket
->so_options
& SO_REUSEPORT
)) &&
892 (u
!= kauth_cred_getuid(t
->inp_socket
->so_cred
)) &&
893 !(t
->inp_socket
->so_flags
& SOF_REUSESHAREUID
) &&
894 (SIN(nam
)->sin_addr
.s_addr
!= INADDR_ANY
||
895 t
->inp_laddr
.s_addr
!= INADDR_ANY
) &&
896 (!(t
->inp_flags2
& INP2_EXTERNAL_PORT
) ||
897 !(inp
->inp_flags2
& INP2_EXTERNAL_PORT
) ||
898 uuid_compare(t
->necp_client_uuid
, inp
->necp_client_uuid
) != 0)) {
899 if ((t
->inp_socket
->so_flags
&
900 SOF_NOTIFYCONFLICT
) &&
901 !(so
->so_flags
& SOF_NOTIFYCONFLICT
)) {
905 lck_rw_done(pcbinfo
->ipi_lock
);
908 in_pcb_conflict_post_msg(lport
);
914 t
= in_pcblookup_local_and_cleanup(pcbinfo
,
915 SIN(nam
)->sin_addr
, lport
, wild
);
917 (reuseport
& t
->inp_socket
->so_options
) == 0 &&
918 (!(t
->inp_flags2
& INP2_EXTERNAL_PORT
) ||
919 !(inp
->inp_flags2
& INP2_EXTERNAL_PORT
) ||
920 uuid_compare(t
->necp_client_uuid
, inp
->necp_client_uuid
) != 0)) {
922 if (SIN(nam
)->sin_addr
.s_addr
!= INADDR_ANY
||
923 t
->inp_laddr
.s_addr
!= INADDR_ANY
||
924 SOCK_DOM(so
) != PF_INET6
||
925 SOCK_DOM(t
->inp_socket
) != PF_INET6
)
928 if ((t
->inp_socket
->so_flags
&
929 SOF_NOTIFYCONFLICT
) &&
930 !(so
->so_flags
& SOF_NOTIFYCONFLICT
)) {
934 lck_rw_done(pcbinfo
->ipi_lock
);
937 in_pcb_conflict_post_msg(lport
);
944 laddr
= SIN(nam
)->sin_addr
;
952 * Override wild = 1 for implicit bind (mainly used by connect)
953 * For implicit bind (lport == 0), we always use an unused port,
954 * so REUSEADDR|REUSEPORT don't apply
958 randomport
= (so
->so_flags
& SOF_BINDRANDOMPORT
) ||
959 (so
->so_type
== SOCK_STREAM
? tcp_use_randomport
:
963 * Even though this looks similar to the code in
964 * in6_pcbsetport, the v6 vs v4 checks are different.
967 if (inp
->inp_flags
& INP_HIGHPORT
) {
968 first
= ipport_hifirstauto
; /* sysctl */
969 last
= ipport_hilastauto
;
970 lastport
= &pcbinfo
->ipi_lasthi
;
971 } else if (inp
->inp_flags
& INP_LOWPORT
) {
972 cred
= kauth_cred_proc_ref(p
);
973 error
= priv_check_cred(cred
,
974 PRIV_NETINET_RESERVEDPORT
, 0);
975 kauth_cred_unref(&cred
);
977 lck_rw_done(pcbinfo
->ipi_lock
);
981 first
= ipport_lowfirstauto
; /* 1023 */
982 last
= ipport_lowlastauto
; /* 600 */
983 lastport
= &pcbinfo
->ipi_lastlow
;
985 first
= ipport_firstauto
; /* sysctl */
986 last
= ipport_lastauto
;
987 lastport
= &pcbinfo
->ipi_lastport
;
989 /* No point in randomizing if only one port is available */
995 * Simple check to ensure all ports are not used up causing
998 * We split the two cases (up and down) so that the direction
999 * is not being tested on each round of the loop.
1002 struct in_addr lookup_addr
;
1008 read_frandom(&rand_port
, sizeof(rand_port
));
1010 first
- (rand_port
% (first
- last
));
1012 count
= first
- last
;
1014 lookup_addr
= (laddr
.s_addr
!= INADDR_ANY
) ? laddr
:
1019 if (count
-- < 0) { /* completely used? */
1020 lck_rw_done(pcbinfo
->ipi_lock
);
1022 return EADDRNOTAVAIL
;
1025 if (*lastport
> first
|| *lastport
< last
) {
1028 lport
= htons(*lastport
);
1031 * Skip if this is a restricted port as we do not want to
1032 * restricted ports as ephemeral
1034 if (IS_RESTRICTED_IN_PORT(lport
)) {
1038 found
= in_pcblookup_local_and_cleanup(pcbinfo
,
1039 lookup_addr
, lport
, wild
) == NULL
;
1042 struct in_addr lookup_addr
;
1048 read_frandom(&rand_port
, sizeof(rand_port
));
1050 first
+ (rand_port
% (first
- last
));
1052 count
= last
- first
;
1054 lookup_addr
= (laddr
.s_addr
!= INADDR_ANY
) ? laddr
:
1059 if (count
-- < 0) { /* completely used? */
1060 lck_rw_done(pcbinfo
->ipi_lock
);
1062 return EADDRNOTAVAIL
;
1065 if (*lastport
< first
|| *lastport
> last
) {
1068 lport
= htons(*lastport
);
1071 * Skip if this is a restricted port as we do not want to
1072 * restricted ports as ephemeral
1074 if (IS_RESTRICTED_IN_PORT(lport
)) {
1078 found
= in_pcblookup_local_and_cleanup(pcbinfo
,
1079 lookup_addr
, lport
, wild
) == NULL
;
1086 * We unlocked socket's protocol lock for a long time.
1087 * The socket might have been dropped/defuncted.
1088 * Checking if world has changed since.
1090 if (inp
->inp_state
== INPCB_STATE_DEAD
) {
1091 lck_rw_done(pcbinfo
->ipi_lock
);
1092 return ECONNABORTED
;
1095 if (inp
->inp_lport
!= 0 || inp
->inp_laddr
.s_addr
!= INADDR_ANY
) {
1096 lck_rw_done(pcbinfo
->ipi_lock
);
1100 if (laddr
.s_addr
!= INADDR_ANY
) {
1101 inp
->inp_laddr
= laddr
;
1102 inp
->inp_last_outifp
= outif
;
1104 inp
->inp_lport
= lport
;
1106 inp
->inp_flags
|= INP_ANONPORT
;
1109 if (in_pcbinshash(inp
, 1) != 0) {
1110 inp
->inp_laddr
.s_addr
= INADDR_ANY
;
1111 inp
->inp_last_outifp
= NULL
;
1115 inp
->inp_flags
&= ~INP_ANONPORT
;
1117 lck_rw_done(pcbinfo
->ipi_lock
);
1120 lck_rw_done(pcbinfo
->ipi_lock
);
1121 sflt_notify(so
, sock_evt_bound
, NULL
);
1125 #define APN_FALLBACK_IP_FILTER(a) \
1126 (IN_LINKLOCAL(ntohl((a)->sin_addr.s_addr)) || \
1127 IN_LOOPBACK(ntohl((a)->sin_addr.s_addr)) || \
1128 IN_ZERONET(ntohl((a)->sin_addr.s_addr)) || \
1129 IN_MULTICAST(ntohl((a)->sin_addr.s_addr)) || \
1130 IN_PRIVATE(ntohl((a)->sin_addr.s_addr)))
1132 #define APN_FALLBACK_NOTIF_INTERVAL 2 /* Magic Number */
1133 static uint64_t last_apn_fallback
= 0;
1136 apn_fallback_required(proc_t proc
, struct socket
*so
, struct sockaddr_in
*p_dstv4
)
1139 struct sockaddr_storage lookup_default_addr
;
1140 struct rtentry
*rt
= NULL
;
1142 VERIFY(proc
!= NULL
);
1144 if (apn_fallbk_enabled
== FALSE
) {
1148 if (proc
== kernproc
) {
1152 if (so
&& (so
->so_options
& SO_NOAPNFALLBK
)) {
1156 timenow
= net_uptime();
1157 if ((timenow
- last_apn_fallback
) < APN_FALLBACK_NOTIF_INTERVAL
) {
1158 apn_fallbk_log((LOG_INFO
, "APN fallback notification throttled.\n"));
1162 if (p_dstv4
&& APN_FALLBACK_IP_FILTER(p_dstv4
)) {
1166 /* Check if we have unscoped IPv6 default route through cellular */
1167 bzero(&lookup_default_addr
, sizeof(lookup_default_addr
));
1168 lookup_default_addr
.ss_family
= AF_INET6
;
1169 lookup_default_addr
.ss_len
= sizeof(struct sockaddr_in6
);
1171 rt
= rtalloc1((struct sockaddr
*)&lookup_default_addr
, 0, 0);
1173 apn_fallbk_log((LOG_INFO
, "APN fallback notification could not find "
1174 "unscoped default IPv6 route.\n"));
1178 if (!IFNET_IS_CELLULAR(rt
->rt_ifp
)) {
1180 apn_fallbk_log((LOG_INFO
, "APN fallback notification could not find "
1181 "unscoped default IPv6 route through cellular interface.\n"));
1186 * We have a default IPv6 route, ensure that
1187 * we do not have IPv4 default route before triggering
1193 bzero(&lookup_default_addr
, sizeof(lookup_default_addr
));
1194 lookup_default_addr
.ss_family
= AF_INET
;
1195 lookup_default_addr
.ss_len
= sizeof(struct sockaddr_in
);
1197 rt
= rtalloc1((struct sockaddr
*)&lookup_default_addr
, 0, 0);
1202 apn_fallbk_log((LOG_INFO
, "APN fallback notification found unscoped "
1203 "IPv4 default route!\n"));
1209 * We disable APN fallback if the binary is not a third-party app.
1210 * Note that platform daemons use their process name as a
1211 * bundle ID so we filter out bundle IDs without dots.
1213 const char *bundle_id
= cs_identity_get(proc
);
1214 if (bundle_id
== NULL
||
1215 bundle_id
[0] == '\0' ||
1216 strchr(bundle_id
, '.') == NULL
||
1217 strncmp(bundle_id
, "com.apple.", sizeof("com.apple.") - 1) == 0) {
1218 apn_fallbk_log((LOG_INFO
, "Abort: APN fallback notification found first-"
1219 "party bundle ID \"%s\"!\n", (bundle_id
? bundle_id
: "NULL")));
1226 * The Apple App Store IPv6 requirement started on
1227 * June 1st, 2016 at 12:00:00 AM PDT.
1228 * We disable APN fallback if the binary is more recent than that.
1229 * We check both atime and birthtime since birthtime is not always supported.
1231 static const long ipv6_start_date
= 1464764400L;
1232 vfs_context_t context
;
1236 bzero(&sb
, sizeof(struct stat64
));
1237 context
= vfs_context_create(NULL
);
1238 vn_stat_error
= vn_stat(proc
->p_textvp
, &sb
, NULL
, 1, 0, context
);
1239 (void)vfs_context_rele(context
);
1241 if (vn_stat_error
!= 0 ||
1242 sb
.st_atimespec
.tv_sec
>= ipv6_start_date
||
1243 sb
.st_birthtimespec
.tv_sec
>= ipv6_start_date
) {
1244 apn_fallbk_log((LOG_INFO
, "Abort: APN fallback notification found binary "
1245 "too recent! (err %d atime %ld mtime %ld ctime %ld birthtime %ld)\n",
1246 vn_stat_error
, sb
.st_atimespec
.tv_sec
, sb
.st_mtimespec
.tv_sec
,
1247 sb
.st_ctimespec
.tv_sec
, sb
.st_birthtimespec
.tv_sec
));
1255 apn_fallback_trigger(proc_t proc
, struct socket
*so
)
1258 struct kev_msg ev_msg
;
1259 struct kev_netevent_apnfallbk_data apnfallbk_data
;
1261 last_apn_fallback
= net_uptime();
1262 pid
= proc_pid(proc
);
1263 uuid_t application_uuid
;
1264 uuid_clear(application_uuid
);
1265 proc_getexecutableuuid(proc
, application_uuid
,
1266 sizeof(application_uuid
));
1268 bzero(&ev_msg
, sizeof(struct kev_msg
));
1269 ev_msg
.vendor_code
= KEV_VENDOR_APPLE
;
1270 ev_msg
.kev_class
= KEV_NETWORK_CLASS
;
1271 ev_msg
.kev_subclass
= KEV_NETEVENT_SUBCLASS
;
1272 ev_msg
.event_code
= KEV_NETEVENT_APNFALLBACK
;
1274 bzero(&apnfallbk_data
, sizeof(apnfallbk_data
));
1276 if (so
->so_flags
& SOF_DELEGATED
) {
1277 apnfallbk_data
.epid
= so
->e_pid
;
1278 uuid_copy(apnfallbk_data
.euuid
, so
->e_uuid
);
1280 apnfallbk_data
.epid
= so
->last_pid
;
1281 uuid_copy(apnfallbk_data
.euuid
, so
->last_uuid
);
1284 ev_msg
.dv
[0].data_ptr
= &apnfallbk_data
;
1285 ev_msg
.dv
[0].data_length
= sizeof(apnfallbk_data
);
1286 kev_post_msg(&ev_msg
);
1287 apn_fallbk_log((LOG_INFO
, "APN fallback notification issued.\n"));
1291 * Transform old in_pcbconnect() into an inner subroutine for new
1292 * in_pcbconnect(); do some validity-checking on the remote address
1293 * (in "nam") and then determine local host address (i.e., which
1294 * interface) to use to access that remote host.
1296 * This routine may alter the caller-supplied remote address "nam".
1298 * The caller may override the bound-to-interface setting of the socket
1299 * by specifying the ifscope parameter (e.g. from IP_PKTINFO.)
1301 * This routine might return an ifp with a reference held if the caller
1302 * provides a non-NULL outif, even in the error case. The caller is
1303 * responsible for releasing its reference.
1305 * Returns: 0 Success
1306 * EINVAL Invalid argument
1307 * EAFNOSUPPORT Address family not supported
1308 * EADDRNOTAVAIL Address not available
1311 in_pcbladdr(struct inpcb
*inp
, struct sockaddr
*nam
, struct in_addr
*laddr
,
1312 unsigned int ifscope
, struct ifnet
**outif
, int raw
)
1314 struct route
*ro
= &inp
->inp_route
;
1315 struct in_ifaddr
*ia
= NULL
;
1316 struct sockaddr_in sin
;
1318 boolean_t restricted
= FALSE
;
1320 if (outif
!= NULL
) {
1323 if (nam
->sa_len
!= sizeof(struct sockaddr_in
)) {
1326 if (SIN(nam
)->sin_family
!= AF_INET
) {
1327 return EAFNOSUPPORT
;
1329 if (raw
== 0 && SIN(nam
)->sin_port
== 0) {
1330 return EADDRNOTAVAIL
;
1334 * If the destination address is INADDR_ANY,
1335 * use the primary local address.
1336 * If the supplied address is INADDR_BROADCAST,
1337 * and the primary interface supports broadcast,
1338 * choose the broadcast address for that interface.
1340 if (raw
== 0 && (SIN(nam
)->sin_addr
.s_addr
== INADDR_ANY
||
1341 SIN(nam
)->sin_addr
.s_addr
== (u_int32_t
)INADDR_BROADCAST
)) {
1342 lck_rw_lock_shared(in_ifaddr_rwlock
);
1343 if (!TAILQ_EMPTY(&in_ifaddrhead
)) {
1344 ia
= TAILQ_FIRST(&in_ifaddrhead
);
1345 IFA_LOCK_SPIN(&ia
->ia_ifa
);
1346 if (SIN(nam
)->sin_addr
.s_addr
== INADDR_ANY
) {
1347 SIN(nam
)->sin_addr
= IA_SIN(ia
)->sin_addr
;
1348 } else if (ia
->ia_ifp
->if_flags
& IFF_BROADCAST
) {
1349 SIN(nam
)->sin_addr
=
1350 SIN(&ia
->ia_broadaddr
)->sin_addr
;
1352 IFA_UNLOCK(&ia
->ia_ifa
);
1355 lck_rw_done(in_ifaddr_rwlock
);
1358 * Otherwise, if the socket has already bound the source, just use it.
1360 if (inp
->inp_laddr
.s_addr
!= INADDR_ANY
) {
1362 *laddr
= inp
->inp_laddr
;
1367 * If the ifscope is specified by the caller (e.g. IP_PKTINFO)
1368 * then it overrides the sticky ifscope set for the socket.
1370 if (ifscope
== IFSCOPE_NONE
&& (inp
->inp_flags
& INP_BOUND_IF
)) {
1371 ifscope
= inp
->inp_boundifp
->if_index
;
1375 * If route is known or can be allocated now,
1376 * our src addr is taken from the i/f, else punt.
1377 * Note that we should check the address family of the cached
1378 * destination, in case of sharing the cache with IPv6.
1380 if (ro
->ro_rt
!= NULL
) {
1381 RT_LOCK_SPIN(ro
->ro_rt
);
1383 if (ROUTE_UNUSABLE(ro
) || ro
->ro_dst
.sa_family
!= AF_INET
||
1384 SIN(&ro
->ro_dst
)->sin_addr
.s_addr
!= SIN(nam
)->sin_addr
.s_addr
||
1385 (inp
->inp_socket
->so_options
& SO_DONTROUTE
)) {
1386 if (ro
->ro_rt
!= NULL
) {
1387 RT_UNLOCK(ro
->ro_rt
);
1391 if (!(inp
->inp_socket
->so_options
& SO_DONTROUTE
) &&
1392 (ro
->ro_rt
== NULL
|| ro
->ro_rt
->rt_ifp
== NULL
)) {
1393 if (ro
->ro_rt
!= NULL
) {
1394 RT_UNLOCK(ro
->ro_rt
);
1397 /* No route yet, so try to acquire one */
1398 bzero(&ro
->ro_dst
, sizeof(struct sockaddr_in
));
1399 ro
->ro_dst
.sa_family
= AF_INET
;
1400 ro
->ro_dst
.sa_len
= sizeof(struct sockaddr_in
);
1401 SIN(&ro
->ro_dst
)->sin_addr
= SIN(nam
)->sin_addr
;
1402 rtalloc_scoped(ro
, ifscope
);
1403 if (ro
->ro_rt
!= NULL
) {
1404 RT_LOCK_SPIN(ro
->ro_rt
);
1407 /* Sanitized local copy for interface address searches */
1408 bzero(&sin
, sizeof(sin
));
1409 sin
.sin_family
= AF_INET
;
1410 sin
.sin_len
= sizeof(struct sockaddr_in
);
1411 sin
.sin_addr
.s_addr
= SIN(nam
)->sin_addr
.s_addr
;
1413 * If we did not find (or use) a route, assume dest is reachable
1414 * on a directly connected network and try to find a corresponding
1415 * interface to take the source address from.
1417 if (ro
->ro_rt
== NULL
) {
1418 proc_t proc
= current_proc();
1421 ia
= ifatoia(ifa_ifwithdstaddr(SA(&sin
)));
1423 ia
= ifatoia(ifa_ifwithnet_scoped(SA(&sin
), ifscope
));
1425 error
= ((ia
== NULL
) ? ENETUNREACH
: 0);
1427 if (apn_fallback_required(proc
, inp
->inp_socket
,
1429 apn_fallback_trigger(proc
, inp
->inp_socket
);
1434 RT_LOCK_ASSERT_HELD(ro
->ro_rt
);
1436 * If the outgoing interface on the route found is not
1437 * a loopback interface, use the address from that interface.
1439 if (!(ro
->ro_rt
->rt_ifp
->if_flags
& IFF_LOOPBACK
)) {
1442 * If the route points to a cellular interface and the
1443 * caller forbids our using interfaces of such type,
1444 * pretend that there is no route.
1445 * Apply the same logic for expensive interfaces.
1447 if (inp_restricted_send(inp
, ro
->ro_rt
->rt_ifp
)) {
1448 RT_UNLOCK(ro
->ro_rt
);
1450 error
= EHOSTUNREACH
;
1453 /* Become a regular mutex */
1454 RT_CONVERT_LOCK(ro
->ro_rt
);
1455 ia
= ifatoia(ro
->ro_rt
->rt_ifa
);
1456 IFA_ADDREF(&ia
->ia_ifa
);
1459 * Mark the control block for notification of
1460 * a possible flow that might undergo clat46
1463 * We defer the decision to a later point when
1464 * inpcb is being disposed off.
1465 * The reason is that we only want to send notification
1466 * if the flow was ever used to send data.
1468 if (IS_INTF_CLAT46(ro
->ro_rt
->rt_ifp
)) {
1469 inp
->inp_flags2
|= INP2_CLAT46_FLOW
;
1472 RT_UNLOCK(ro
->ro_rt
);
1477 VERIFY(ro
->ro_rt
->rt_ifp
->if_flags
& IFF_LOOPBACK
);
1478 RT_UNLOCK(ro
->ro_rt
);
1480 * The outgoing interface is marked with 'loopback net', so a route
1481 * to ourselves is here.
1482 * Try to find the interface of the destination address and then
1483 * take the address from there. That interface is not necessarily
1484 * a loopback interface.
1487 ia
= ifatoia(ifa_ifwithdstaddr(SA(&sin
)));
1489 ia
= ifatoia(ifa_ifwithaddr_scoped(SA(&sin
), ifscope
));
1492 ia
= ifatoia(ifa_ifwithnet_scoped(SA(&sin
), ifscope
));
1496 ia
= ifatoia(ro
->ro_rt
->rt_ifa
);
1498 IFA_ADDREF(&ia
->ia_ifa
);
1500 RT_UNLOCK(ro
->ro_rt
);
1502 error
= ((ia
== NULL
) ? ENETUNREACH
: 0);
1506 * If the destination address is multicast and an outgoing
1507 * interface has been set as a multicast option, use the
1508 * address of that interface as our source address.
1510 if (IN_MULTICAST(ntohl(SIN(nam
)->sin_addr
.s_addr
)) &&
1511 inp
->inp_moptions
!= NULL
) {
1512 struct ip_moptions
*imo
;
1515 imo
= inp
->inp_moptions
;
1517 if (imo
->imo_multicast_ifp
!= NULL
&& (ia
== NULL
||
1518 ia
->ia_ifp
!= imo
->imo_multicast_ifp
)) {
1519 ifp
= imo
->imo_multicast_ifp
;
1521 IFA_REMREF(&ia
->ia_ifa
);
1523 lck_rw_lock_shared(in_ifaddr_rwlock
);
1524 TAILQ_FOREACH(ia
, &in_ifaddrhead
, ia_link
) {
1525 if (ia
->ia_ifp
== ifp
) {
1530 IFA_ADDREF(&ia
->ia_ifa
);
1532 lck_rw_done(in_ifaddr_rwlock
);
1534 error
= EADDRNOTAVAIL
;
1542 * Don't do pcblookup call here; return interface in laddr
1543 * and exit to caller, that will do the lookup.
1547 * If the source address belongs to a cellular interface
1548 * and the socket forbids our using interfaces of such
1549 * type, pretend that there is no source address.
1550 * Apply the same logic for expensive interfaces.
1552 IFA_LOCK_SPIN(&ia
->ia_ifa
);
1553 if (inp_restricted_send(inp
, ia
->ia_ifa
.ifa_ifp
)) {
1554 IFA_UNLOCK(&ia
->ia_ifa
);
1555 error
= EHOSTUNREACH
;
1557 } else if (error
== 0) {
1558 *laddr
= ia
->ia_addr
.sin_addr
;
1559 if (outif
!= NULL
) {
1562 if (ro
->ro_rt
!= NULL
) {
1563 ifp
= ro
->ro_rt
->rt_ifp
;
1568 VERIFY(ifp
!= NULL
);
1569 IFA_CONVERT_LOCK(&ia
->ia_ifa
);
1570 ifnet_reference(ifp
); /* for caller */
1571 if (*outif
!= NULL
) {
1572 ifnet_release(*outif
);
1576 IFA_UNLOCK(&ia
->ia_ifa
);
1578 IFA_UNLOCK(&ia
->ia_ifa
);
1580 IFA_REMREF(&ia
->ia_ifa
);
1584 if (restricted
&& error
== EHOSTUNREACH
) {
1585 soevent(inp
->inp_socket
, (SO_FILT_HINT_LOCKED
|
1586 SO_FILT_HINT_IFDENIED
));
1594 * Connect from a socket to a specified address.
1595 * Both address and port must be specified in argument sin.
1596 * If don't have a local address for this socket yet,
1599 * The caller may override the bound-to-interface setting of the socket
1600 * by specifying the ifscope parameter (e.g. from IP_PKTINFO.)
1603 in_pcbconnect(struct inpcb
*inp
, struct sockaddr
*nam
, struct proc
*p
,
1604 unsigned int ifscope
, struct ifnet
**outif
)
1606 struct in_addr laddr
;
1607 struct sockaddr_in
*sin
= (struct sockaddr_in
*)(void *)nam
;
1610 struct socket
*so
= inp
->inp_socket
;
1614 so
->so_state_change_cnt
++;
1619 * Call inner routine, to assign local interface address.
1621 if ((error
= in_pcbladdr(inp
, nam
, &laddr
, ifscope
, outif
, 0)) != 0) {
1625 socket_unlock(so
, 0);
1626 pcb
= in_pcblookup_hash(inp
->inp_pcbinfo
, sin
->sin_addr
, sin
->sin_port
,
1627 inp
->inp_laddr
.s_addr
? inp
->inp_laddr
: laddr
,
1628 inp
->inp_lport
, 0, NULL
);
1632 * Check if the socket is still in a valid state. When we unlock this
1633 * embryonic socket, it can get aborted if another thread is closing
1634 * the listener (radar 7947600).
1636 if ((so
->so_flags
& SOF_ABORTED
) != 0) {
1637 return ECONNREFUSED
;
1641 in_pcb_checkstate(pcb
, WNT_RELEASE
, pcb
== inp
? 1 : 0);
1644 if (inp
->inp_laddr
.s_addr
== INADDR_ANY
) {
1645 if (inp
->inp_lport
== 0) {
1646 error
= in_pcbbind(inp
, NULL
, p
);
1651 if (!lck_rw_try_lock_exclusive(inp
->inp_pcbinfo
->ipi_lock
)) {
1653 * Lock inversion issue, mostly with udp
1654 * multicast packets.
1656 socket_unlock(so
, 0);
1657 lck_rw_lock_exclusive(inp
->inp_pcbinfo
->ipi_lock
);
1660 inp
->inp_laddr
= laddr
;
1661 /* no reference needed */
1662 inp
->inp_last_outifp
= (outif
!= NULL
) ? *outif
: NULL
;
1663 inp
->inp_flags
|= INP_INADDR_ANY
;
1666 * Usage of IP_PKTINFO, without local port already
1667 * speficified will cause kernel to panic,
1668 * see rdar://problem/18508185.
1669 * For now returning error to avoid a kernel panic
1670 * This routines can be refactored and handle this better
1673 if (inp
->inp_lport
== 0) {
1676 if (!lck_rw_try_lock_exclusive(inp
->inp_pcbinfo
->ipi_lock
)) {
1678 * Lock inversion issue, mostly with udp
1679 * multicast packets.
1681 socket_unlock(so
, 0);
1682 lck_rw_lock_exclusive(inp
->inp_pcbinfo
->ipi_lock
);
1686 inp
->inp_faddr
= sin
->sin_addr
;
1687 inp
->inp_fport
= sin
->sin_port
;
1688 if (nstat_collect
&& SOCK_PROTO(so
) == IPPROTO_UDP
) {
1689 nstat_pcb_invalidate_cache(inp
);
1692 lck_rw_done(inp
->inp_pcbinfo
->ipi_lock
);
1697 in_pcbdisconnect(struct inpcb
*inp
)
1699 struct socket
*so
= inp
->inp_socket
;
1701 if (nstat_collect
&& SOCK_PROTO(so
) == IPPROTO_UDP
) {
1702 nstat_pcb_cache(inp
);
1705 inp
->inp_faddr
.s_addr
= INADDR_ANY
;
1710 so
->so_state_change_cnt
++;
1714 if (!lck_rw_try_lock_exclusive(inp
->inp_pcbinfo
->ipi_lock
)) {
1715 /* lock inversion issue, mostly with udp multicast packets */
1716 socket_unlock(so
, 0);
1717 lck_rw_lock_exclusive(inp
->inp_pcbinfo
->ipi_lock
);
1722 lck_rw_done(inp
->inp_pcbinfo
->ipi_lock
);
1724 * A multipath subflow socket would have its SS_NOFDREF set by default,
1725 * so check for SOF_MP_SUBFLOW socket flag before detaching the PCB;
1726 * when the socket is closed for real, SOF_MP_SUBFLOW would be cleared.
1728 if (!(so
->so_flags
& SOF_MP_SUBFLOW
) && (so
->so_state
& SS_NOFDREF
)) {
1734 in_pcbdetach(struct inpcb
*inp
)
1736 struct socket
*so
= inp
->inp_socket
;
1738 if (so
->so_pcb
== NULL
) {
1739 /* PCB has been disposed */
1740 panic("%s: inp=%p so=%p proto=%d so_pcb is null!\n", __func__
,
1741 inp
, so
, SOCK_PROTO(so
));
1746 if (inp
->inp_sp
!= NULL
) {
1747 (void) ipsec4_delete_pcbpolicy(inp
);
1751 if (inp
->inp_stat
!= NULL
&& SOCK_PROTO(so
) == IPPROTO_UDP
) {
1752 if (inp
->inp_stat
->rxpackets
== 0 && inp
->inp_stat
->txpackets
== 0) {
1753 INC_ATOMIC_INT64_LIM(net_api_stats
.nas_socket_inet_dgram_no_data
);
1758 * Let NetworkStatistics know this PCB is going away
1759 * before we detach it.
1761 if (nstat_collect
&&
1762 (SOCK_PROTO(so
) == IPPROTO_TCP
|| SOCK_PROTO(so
) == IPPROTO_UDP
)) {
1763 nstat_pcb_detach(inp
);
1766 /* Free memory buffer held for generating keep alives */
1767 if (inp
->inp_keepalive_data
!= NULL
) {
1768 FREE(inp
->inp_keepalive_data
, M_TEMP
);
1769 inp
->inp_keepalive_data
= NULL
;
1772 /* mark socket state as dead */
1773 if (in_pcb_checkstate(inp
, WNT_STOPUSING
, 1) != WNT_STOPUSING
) {
1774 panic("%s: so=%p proto=%d couldn't set to STOPUSING\n",
1775 __func__
, so
, SOCK_PROTO(so
));
1779 if (!(so
->so_flags
& SOF_PCBCLEARING
)) {
1780 struct ip_moptions
*imo
;
1783 if (inp
->inp_options
!= NULL
) {
1784 (void) m_free(inp
->inp_options
);
1785 inp
->inp_options
= NULL
;
1787 ROUTE_RELEASE(&inp
->inp_route
);
1788 imo
= inp
->inp_moptions
;
1789 inp
->inp_moptions
= NULL
;
1790 sofreelastref(so
, 0);
1791 inp
->inp_state
= INPCB_STATE_DEAD
;
1794 * Enqueue an event to send kernel event notification
1795 * if the flow has to CLAT46 for data packets
1797 if (inp
->inp_flags2
& INP2_CLAT46_FLOW
) {
1799 * If there has been any exchange of data bytes
1801 * Schedule a notification to report that flow is
1802 * using client side translation.
1804 if (inp
->inp_stat
!= NULL
&&
1805 (inp
->inp_stat
->txbytes
!= 0 ||
1806 inp
->inp_stat
->rxbytes
!= 0)) {
1807 if (so
->so_flags
& SOF_DELEGATED
) {
1808 in6_clat46_event_enqueue_nwk_wq_entry(
1809 IN6_CLAT46_EVENT_V4_FLOW
,
1813 in6_clat46_event_enqueue_nwk_wq_entry(
1814 IN6_CLAT46_EVENT_V4_FLOW
,
1821 /* makes sure we're not called twice from so_close */
1822 so
->so_flags
|= SOF_PCBCLEARING
;
1824 inpcb_gc_sched(inp
->inp_pcbinfo
, INPCB_TIMER_FAST
);
1827 * See inp_join_group() for why we need to unlock
1830 socket_unlock(so
, 0);
1839 in_pcbdispose(struct inpcb
*inp
)
1841 struct socket
*so
= inp
->inp_socket
;
1842 struct inpcbinfo
*ipi
= inp
->inp_pcbinfo
;
1844 if (so
!= NULL
&& so
->so_usecount
!= 0) {
1845 panic("%s: so %p [%d,%d] usecount %d lockhistory %s\n",
1846 __func__
, so
, SOCK_DOM(so
), SOCK_TYPE(so
), so
->so_usecount
,
1847 solockhistory_nr(so
));
1849 } else if (inp
->inp_wantcnt
!= WNT_STOPUSING
) {
1851 panic_plain("%s: inp %p invalid wantcnt %d, so %p "
1852 "[%d,%d] usecount %d retaincnt %d state 0x%x "
1853 "flags 0x%x lockhistory %s\n", __func__
, inp
,
1854 inp
->inp_wantcnt
, so
, SOCK_DOM(so
), SOCK_TYPE(so
),
1855 so
->so_usecount
, so
->so_retaincnt
, so
->so_state
,
1856 so
->so_flags
, solockhistory_nr(so
));
1859 panic("%s: inp %p invalid wantcnt %d no socket\n",
1860 __func__
, inp
, inp
->inp_wantcnt
);
1865 LCK_RW_ASSERT(ipi
->ipi_lock
, LCK_RW_ASSERT_EXCLUSIVE
);
1867 inp
->inp_gencnt
= ++ipi
->ipi_gencnt
;
1868 /* access ipi in in_pcbremlists */
1869 in_pcbremlists(inp
);
1872 if (so
->so_proto
->pr_flags
& PR_PCBLOCK
) {
1873 sofreelastref(so
, 0);
1874 if (so
->so_rcv
.sb_cc
> 0 || so
->so_snd
.sb_cc
> 0) {
1876 * selthreadclear() already called
1877 * during sofreelastref() above.
1879 sbrelease(&so
->so_rcv
);
1880 sbrelease(&so
->so_snd
);
1882 if (so
->so_head
!= NULL
) {
1883 panic("%s: so=%p head still exist\n",
1887 lck_mtx_unlock(&inp
->inpcb_mtx
);
1890 necp_inpcb_remove_cb(inp
);
1893 lck_mtx_destroy(&inp
->inpcb_mtx
, ipi
->ipi_lock_grp
);
1895 /* makes sure we're not called twice from so_close */
1896 so
->so_flags
|= SOF_PCBCLEARING
;
1897 so
->so_saved_pcb
= (caddr_t
)inp
;
1899 inp
->inp_socket
= NULL
;
1901 mac_inpcb_label_destroy(inp
);
1902 #endif /* CONFIG_MACF_NET */
1904 necp_inpcb_dispose(inp
);
1907 * In case there a route cached after a detach (possible
1908 * in the tcp case), make sure that it is freed before
1909 * we deallocate the structure.
1911 ROUTE_RELEASE(&inp
->inp_route
);
1912 if ((so
->so_flags1
& SOF1_CACHED_IN_SOCK_LAYER
) == 0) {
1913 zfree(ipi
->ipi_zone
, inp
);
1920 * The calling convention of in_getsockaddr() and in_getpeeraddr() was
1921 * modified to match the pru_sockaddr() and pru_peeraddr() entry points
1922 * in struct pr_usrreqs, so that protocols can just reference then directly
1923 * without the need for a wrapper function.
1926 in_getsockaddr(struct socket
*so
, struct sockaddr
**nam
)
1929 struct sockaddr_in
*sin
;
1932 * Do the malloc first in case it blocks.
1934 MALLOC(sin
, struct sockaddr_in
*, sizeof(*sin
), M_SONAME
, M_WAITOK
);
1938 bzero(sin
, sizeof(*sin
));
1939 sin
->sin_family
= AF_INET
;
1940 sin
->sin_len
= sizeof(*sin
);
1942 if ((inp
= sotoinpcb(so
)) == NULL
) {
1943 FREE(sin
, M_SONAME
);
1946 sin
->sin_port
= inp
->inp_lport
;
1947 sin
->sin_addr
= inp
->inp_laddr
;
1949 *nam
= (struct sockaddr
*)sin
;
1954 in_getsockaddr_s(struct socket
*so
, struct sockaddr_in
*ss
)
1956 struct sockaddr_in
*sin
= ss
;
1960 bzero(ss
, sizeof(*ss
));
1962 sin
->sin_family
= AF_INET
;
1963 sin
->sin_len
= sizeof(*sin
);
1965 if ((inp
= sotoinpcb(so
)) == NULL
) {
1969 sin
->sin_port
= inp
->inp_lport
;
1970 sin
->sin_addr
= inp
->inp_laddr
;
1975 in_getpeeraddr(struct socket
*so
, struct sockaddr
**nam
)
1978 struct sockaddr_in
*sin
;
1981 * Do the malloc first in case it blocks.
1983 MALLOC(sin
, struct sockaddr_in
*, sizeof(*sin
), M_SONAME
, M_WAITOK
);
1987 bzero((caddr_t
)sin
, sizeof(*sin
));
1988 sin
->sin_family
= AF_INET
;
1989 sin
->sin_len
= sizeof(*sin
);
1991 if ((inp
= sotoinpcb(so
)) == NULL
) {
1992 FREE(sin
, M_SONAME
);
1995 sin
->sin_port
= inp
->inp_fport
;
1996 sin
->sin_addr
= inp
->inp_faddr
;
1998 *nam
= (struct sockaddr
*)sin
;
2003 in_pcbnotifyall(struct inpcbinfo
*pcbinfo
, struct in_addr faddr
,
2004 int errno
, void (*notify
)(struct inpcb
*, int))
2008 lck_rw_lock_shared(pcbinfo
->ipi_lock
);
2010 LIST_FOREACH(inp
, pcbinfo
->ipi_listhead
, inp_list
) {
2012 if (!(inp
->inp_vflag
& INP_IPV4
)) {
2016 if (inp
->inp_faddr
.s_addr
!= faddr
.s_addr
||
2017 inp
->inp_socket
== NULL
) {
2020 if (in_pcb_checkstate(inp
, WNT_ACQUIRE
, 0) == WNT_STOPUSING
) {
2023 socket_lock(inp
->inp_socket
, 1);
2024 (*notify
)(inp
, errno
);
2025 (void) in_pcb_checkstate(inp
, WNT_RELEASE
, 1);
2026 socket_unlock(inp
->inp_socket
, 1);
2028 lck_rw_done(pcbinfo
->ipi_lock
);
2032 * Check for alternatives when higher level complains
2033 * about service problems. For now, invalidate cached
2034 * routing information. If the route was created dynamically
2035 * (by a redirect), time to try a default gateway again.
2038 in_losing(struct inpcb
*inp
)
2040 boolean_t release
= FALSE
;
2043 if ((rt
= inp
->inp_route
.ro_rt
) != NULL
) {
2044 struct in_ifaddr
*ia
= NULL
;
2047 if (rt
->rt_flags
& RTF_DYNAMIC
) {
2049 * Prevent another thread from modifying rt_key,
2050 * rt_gateway via rt_setgate() after rt_lock is
2051 * dropped by marking the route as defunct.
2053 rt
->rt_flags
|= RTF_CONDEMNED
;
2055 (void) rtrequest(RTM_DELETE
, rt_key(rt
),
2056 rt
->rt_gateway
, rt_mask(rt
), rt
->rt_flags
, NULL
);
2060 /* if the address is gone keep the old route in the pcb */
2061 if (inp
->inp_laddr
.s_addr
!= INADDR_ANY
&&
2062 (ia
= ifa_foraddr(inp
->inp_laddr
.s_addr
)) != NULL
) {
2064 * Address is around; ditch the route. A new route
2065 * can be allocated the next time output is attempted.
2070 IFA_REMREF(&ia
->ia_ifa
);
2073 if (rt
== NULL
|| release
) {
2074 ROUTE_RELEASE(&inp
->inp_route
);
2079 * After a routing change, flush old routing
2080 * and allocate a (hopefully) better one.
2083 in_rtchange(struct inpcb
*inp
, int errno
)
2085 #pragma unused(errno)
2086 boolean_t release
= FALSE
;
2089 if ((rt
= inp
->inp_route
.ro_rt
) != NULL
) {
2090 struct in_ifaddr
*ia
= NULL
;
2092 /* if address is gone, keep the old route */
2093 if (inp
->inp_laddr
.s_addr
!= INADDR_ANY
&&
2094 (ia
= ifa_foraddr(inp
->inp_laddr
.s_addr
)) != NULL
) {
2096 * Address is around; ditch the route. A new route
2097 * can be allocated the next time output is attempted.
2102 IFA_REMREF(&ia
->ia_ifa
);
2105 if (rt
== NULL
|| release
) {
2106 ROUTE_RELEASE(&inp
->inp_route
);
2111 * Lookup a PCB based on the local address and port.
2114 in_pcblookup_local(struct inpcbinfo
*pcbinfo
, struct in_addr laddr
,
2115 unsigned int lport_arg
, int wild_okay
)
2118 int matchwild
= 3, wildcard
;
2119 u_short lport
= lport_arg
;
2121 KERNEL_DEBUG(DBG_FNC_PCB_LOOKUP
| DBG_FUNC_START
, 0, 0, 0, 0, 0);
2124 struct inpcbhead
*head
;
2126 * Look for an unconnected (wildcard foreign addr) PCB that
2127 * matches the local address and port we're looking for.
2129 head
= &pcbinfo
->ipi_hashbase
[INP_PCBHASH(INADDR_ANY
, lport
, 0,
2130 pcbinfo
->ipi_hashmask
)];
2131 LIST_FOREACH(inp
, head
, inp_hash
) {
2133 if (!(inp
->inp_vflag
& INP_IPV4
)) {
2137 if (inp
->inp_faddr
.s_addr
== INADDR_ANY
&&
2138 inp
->inp_laddr
.s_addr
== laddr
.s_addr
&&
2139 inp
->inp_lport
== lport
) {
2149 KERNEL_DEBUG(DBG_FNC_PCB_LOOKUP
| DBG_FUNC_END
, 0, 0, 0, 0, 0);
2152 struct inpcbporthead
*porthash
;
2153 struct inpcbport
*phd
;
2154 struct inpcb
*match
= NULL
;
2156 * Best fit PCB lookup.
2158 * First see if this local port is in use by looking on the
2161 porthash
= &pcbinfo
->ipi_porthashbase
[INP_PCBPORTHASH(lport
,
2162 pcbinfo
->ipi_porthashmask
)];
2163 LIST_FOREACH(phd
, porthash
, phd_hash
) {
2164 if (phd
->phd_port
== lport
) {
2170 * Port is in use by one or more PCBs. Look for best
2173 LIST_FOREACH(inp
, &phd
->phd_pcblist
, inp_portlist
) {
2176 if (!(inp
->inp_vflag
& INP_IPV4
)) {
2180 if (inp
->inp_faddr
.s_addr
!= INADDR_ANY
) {
2183 if (inp
->inp_laddr
.s_addr
!= INADDR_ANY
) {
2184 if (laddr
.s_addr
== INADDR_ANY
) {
2186 } else if (inp
->inp_laddr
.s_addr
!=
2191 if (laddr
.s_addr
!= INADDR_ANY
) {
2195 if (wildcard
< matchwild
) {
2197 matchwild
= wildcard
;
2198 if (matchwild
== 0) {
2204 KERNEL_DEBUG(DBG_FNC_PCB_LOOKUP
| DBG_FUNC_END
, match
,
2211 * Check if PCB exists in hash list.
2214 in_pcblookup_hash_exists(struct inpcbinfo
*pcbinfo
, struct in_addr faddr
,
2215 u_int fport_arg
, struct in_addr laddr
, u_int lport_arg
, int wildcard
,
2216 uid_t
*uid
, gid_t
*gid
, struct ifnet
*ifp
)
2218 struct inpcbhead
*head
;
2220 u_short fport
= fport_arg
, lport
= lport_arg
;
2222 struct inpcb
*local_wild
= NULL
;
2224 struct inpcb
*local_wild_mapped
= NULL
;
2231 * We may have found the pcb in the last lookup - check this first.
2234 lck_rw_lock_shared(pcbinfo
->ipi_lock
);
2237 * First look for an exact match.
2239 head
= &pcbinfo
->ipi_hashbase
[INP_PCBHASH(faddr
.s_addr
, lport
, fport
,
2240 pcbinfo
->ipi_hashmask
)];
2241 LIST_FOREACH(inp
, head
, inp_hash
) {
2243 if (!(inp
->inp_vflag
& INP_IPV4
)) {
2247 if (inp_restricted_recv(inp
, ifp
)) {
2252 if (!necp_socket_is_allowed_to_recv_on_interface(inp
, ifp
)) {
2257 if (inp
->inp_faddr
.s_addr
== faddr
.s_addr
&&
2258 inp
->inp_laddr
.s_addr
== laddr
.s_addr
&&
2259 inp
->inp_fport
== fport
&&
2260 inp
->inp_lport
== lport
) {
2261 if ((found
= (inp
->inp_socket
!= NULL
))) {
2265 *uid
= kauth_cred_getuid(
2266 inp
->inp_socket
->so_cred
);
2267 *gid
= kauth_cred_getgid(
2268 inp
->inp_socket
->so_cred
);
2270 lck_rw_done(pcbinfo
->ipi_lock
);
2279 lck_rw_done(pcbinfo
->ipi_lock
);
2283 head
= &pcbinfo
->ipi_hashbase
[INP_PCBHASH(INADDR_ANY
, lport
, 0,
2284 pcbinfo
->ipi_hashmask
)];
2285 LIST_FOREACH(inp
, head
, inp_hash
) {
2287 if (!(inp
->inp_vflag
& INP_IPV4
)) {
2291 if (inp_restricted_recv(inp
, ifp
)) {
2296 if (!necp_socket_is_allowed_to_recv_on_interface(inp
, ifp
)) {
2301 if (inp
->inp_faddr
.s_addr
== INADDR_ANY
&&
2302 inp
->inp_lport
== lport
) {
2303 if (inp
->inp_laddr
.s_addr
== laddr
.s_addr
) {
2304 if ((found
= (inp
->inp_socket
!= NULL
))) {
2305 *uid
= kauth_cred_getuid(
2306 inp
->inp_socket
->so_cred
);
2307 *gid
= kauth_cred_getgid(
2308 inp
->inp_socket
->so_cred
);
2310 lck_rw_done(pcbinfo
->ipi_lock
);
2312 } else if (inp
->inp_laddr
.s_addr
== INADDR_ANY
) {
2314 if (inp
->inp_socket
&&
2315 SOCK_CHECK_DOM(inp
->inp_socket
, PF_INET6
)) {
2316 local_wild_mapped
= inp
;
2323 if (local_wild
== NULL
) {
2325 if (local_wild_mapped
!= NULL
) {
2326 if ((found
= (local_wild_mapped
->inp_socket
!= NULL
))) {
2327 *uid
= kauth_cred_getuid(
2328 local_wild_mapped
->inp_socket
->so_cred
);
2329 *gid
= kauth_cred_getgid(
2330 local_wild_mapped
->inp_socket
->so_cred
);
2332 lck_rw_done(pcbinfo
->ipi_lock
);
2336 lck_rw_done(pcbinfo
->ipi_lock
);
2339 if ((found
= (local_wild
->inp_socket
!= NULL
))) {
2340 *uid
= kauth_cred_getuid(
2341 local_wild
->inp_socket
->so_cred
);
2342 *gid
= kauth_cred_getgid(
2343 local_wild
->inp_socket
->so_cred
);
2345 lck_rw_done(pcbinfo
->ipi_lock
);
2350 * Lookup PCB in hash list.
2353 in_pcblookup_hash(struct inpcbinfo
*pcbinfo
, struct in_addr faddr
,
2354 u_int fport_arg
, struct in_addr laddr
, u_int lport_arg
, int wildcard
,
2357 struct inpcbhead
*head
;
2359 u_short fport
= fport_arg
, lport
= lport_arg
;
2360 struct inpcb
*local_wild
= NULL
;
2362 struct inpcb
*local_wild_mapped
= NULL
;
2366 * We may have found the pcb in the last lookup - check this first.
2369 lck_rw_lock_shared(pcbinfo
->ipi_lock
);
2372 * First look for an exact match.
2374 head
= &pcbinfo
->ipi_hashbase
[INP_PCBHASH(faddr
.s_addr
, lport
, fport
,
2375 pcbinfo
->ipi_hashmask
)];
2376 LIST_FOREACH(inp
, head
, inp_hash
) {
2378 if (!(inp
->inp_vflag
& INP_IPV4
)) {
2382 if (inp_restricted_recv(inp
, ifp
)) {
2387 if (!necp_socket_is_allowed_to_recv_on_interface(inp
, ifp
)) {
2392 if (inp
->inp_faddr
.s_addr
== faddr
.s_addr
&&
2393 inp
->inp_laddr
.s_addr
== laddr
.s_addr
&&
2394 inp
->inp_fport
== fport
&&
2395 inp
->inp_lport
== lport
) {
2399 if (in_pcb_checkstate(inp
, WNT_ACQUIRE
, 0) !=
2401 lck_rw_done(pcbinfo
->ipi_lock
);
2404 /* it's there but dead, say it isn't found */
2405 lck_rw_done(pcbinfo
->ipi_lock
);
2415 lck_rw_done(pcbinfo
->ipi_lock
);
2419 head
= &pcbinfo
->ipi_hashbase
[INP_PCBHASH(INADDR_ANY
, lport
, 0,
2420 pcbinfo
->ipi_hashmask
)];
2421 LIST_FOREACH(inp
, head
, inp_hash
) {
2423 if (!(inp
->inp_vflag
& INP_IPV4
)) {
2427 if (inp_restricted_recv(inp
, ifp
)) {
2432 if (!necp_socket_is_allowed_to_recv_on_interface(inp
, ifp
)) {
2437 if (inp
->inp_faddr
.s_addr
== INADDR_ANY
&&
2438 inp
->inp_lport
== lport
) {
2439 if (inp
->inp_laddr
.s_addr
== laddr
.s_addr
) {
2440 if (in_pcb_checkstate(inp
, WNT_ACQUIRE
, 0) !=
2442 lck_rw_done(pcbinfo
->ipi_lock
);
2445 /* it's dead; say it isn't found */
2446 lck_rw_done(pcbinfo
->ipi_lock
);
2449 } else if (inp
->inp_laddr
.s_addr
== INADDR_ANY
) {
2451 if (SOCK_CHECK_DOM(inp
->inp_socket
, PF_INET6
)) {
2452 local_wild_mapped
= inp
;
2459 if (local_wild
== NULL
) {
2461 if (local_wild_mapped
!= NULL
) {
2462 if (in_pcb_checkstate(local_wild_mapped
,
2463 WNT_ACQUIRE
, 0) != WNT_STOPUSING
) {
2464 lck_rw_done(pcbinfo
->ipi_lock
);
2465 return local_wild_mapped
;
2467 /* it's dead; say it isn't found */
2468 lck_rw_done(pcbinfo
->ipi_lock
);
2473 lck_rw_done(pcbinfo
->ipi_lock
);
2476 if (in_pcb_checkstate(local_wild
, WNT_ACQUIRE
, 0) != WNT_STOPUSING
) {
2477 lck_rw_done(pcbinfo
->ipi_lock
);
2481 * It's either not found or is already dead.
2483 lck_rw_done(pcbinfo
->ipi_lock
);
2488 * @brief Insert PCB onto various hash lists.
2490 * @param inp Pointer to internet protocol control block
2491 * @param locked Implies if ipi_lock (protecting pcb list)
2492 * is already locked or not.
2494 * @return int error on failure and 0 on success
2497 in_pcbinshash(struct inpcb
*inp
, int locked
)
2499 struct inpcbhead
*pcbhash
;
2500 struct inpcbporthead
*pcbporthash
;
2501 struct inpcbinfo
*pcbinfo
= inp
->inp_pcbinfo
;
2502 struct inpcbport
*phd
;
2503 u_int32_t hashkey_faddr
;
2506 if (!lck_rw_try_lock_exclusive(pcbinfo
->ipi_lock
)) {
2508 * Lock inversion issue, mostly with udp
2511 socket_unlock(inp
->inp_socket
, 0);
2512 lck_rw_lock_exclusive(pcbinfo
->ipi_lock
);
2513 socket_lock(inp
->inp_socket
, 0);
2518 * This routine or its caller may have given up
2519 * socket's protocol lock briefly.
2520 * During that time the socket may have been dropped.
2521 * Safe-guarding against that.
2523 if (inp
->inp_state
== INPCB_STATE_DEAD
) {
2525 lck_rw_done(pcbinfo
->ipi_lock
);
2527 return ECONNABORTED
;
2532 if (inp
->inp_vflag
& INP_IPV6
) {
2533 hashkey_faddr
= inp
->in6p_faddr
.s6_addr32
[3] /* XXX */;
2536 hashkey_faddr
= inp
->inp_faddr
.s_addr
;
2538 inp
->inp_hash_element
= INP_PCBHASH(hashkey_faddr
, inp
->inp_lport
,
2539 inp
->inp_fport
, pcbinfo
->ipi_hashmask
);
2541 pcbhash
= &pcbinfo
->ipi_hashbase
[inp
->inp_hash_element
];
2543 pcbporthash
= &pcbinfo
->ipi_porthashbase
[INP_PCBPORTHASH(inp
->inp_lport
,
2544 pcbinfo
->ipi_porthashmask
)];
2547 * Go through port list and look for a head for this lport.
2549 LIST_FOREACH(phd
, pcbporthash
, phd_hash
) {
2550 if (phd
->phd_port
== inp
->inp_lport
) {
2556 * If none exists, malloc one and tack it on.
2559 MALLOC(phd
, struct inpcbport
*, sizeof(struct inpcbport
),
2563 lck_rw_done(pcbinfo
->ipi_lock
);
2565 return ENOBUFS
; /* XXX */
2567 phd
->phd_port
= inp
->inp_lport
;
2568 LIST_INIT(&phd
->phd_pcblist
);
2569 LIST_INSERT_HEAD(pcbporthash
, phd
, phd_hash
);
2572 VERIFY(!(inp
->inp_flags2
& INP2_INHASHLIST
));
2576 LIST_INSERT_HEAD(&phd
->phd_pcblist
, inp
, inp_portlist
);
2577 LIST_INSERT_HEAD(pcbhash
, inp
, inp_hash
);
2578 inp
->inp_flags2
|= INP2_INHASHLIST
;
2581 lck_rw_done(pcbinfo
->ipi_lock
);
2585 // This call catches the original setting of the local address
2586 inp_update_necp_policy(inp
, NULL
, NULL
, 0);
2593 * Move PCB to the proper hash bucket when { faddr, fport } have been
2594 * changed. NOTE: This does not handle the case of the lport changing (the
2595 * hashed port list would have to be updated as well), so the lport must
2596 * not change after in_pcbinshash() has been called.
2599 in_pcbrehash(struct inpcb
*inp
)
2601 struct inpcbhead
*head
;
2602 u_int32_t hashkey_faddr
;
2605 if (inp
->inp_vflag
& INP_IPV6
) {
2606 hashkey_faddr
= inp
->in6p_faddr
.s6_addr32
[3] /* XXX */;
2609 hashkey_faddr
= inp
->inp_faddr
.s_addr
;
2611 inp
->inp_hash_element
= INP_PCBHASH(hashkey_faddr
, inp
->inp_lport
,
2612 inp
->inp_fport
, inp
->inp_pcbinfo
->ipi_hashmask
);
2613 head
= &inp
->inp_pcbinfo
->ipi_hashbase
[inp
->inp_hash_element
];
2615 if (inp
->inp_flags2
& INP2_INHASHLIST
) {
2616 LIST_REMOVE(inp
, inp_hash
);
2617 inp
->inp_flags2
&= ~INP2_INHASHLIST
;
2620 VERIFY(!(inp
->inp_flags2
& INP2_INHASHLIST
));
2621 LIST_INSERT_HEAD(head
, inp
, inp_hash
);
2622 inp
->inp_flags2
|= INP2_INHASHLIST
;
2625 // This call catches updates to the remote addresses
2626 inp_update_necp_policy(inp
, NULL
, NULL
, 0);
2631 * Remove PCB from various lists.
2632 * Must be called pcbinfo lock is held in exclusive mode.
2635 in_pcbremlists(struct inpcb
*inp
)
2637 inp
->inp_gencnt
= ++inp
->inp_pcbinfo
->ipi_gencnt
;
2640 * Check if it's in hashlist -- an inp is placed in hashlist when
2641 * it's local port gets assigned. So it should also be present
2644 if (inp
->inp_flags2
& INP2_INHASHLIST
) {
2645 struct inpcbport
*phd
= inp
->inp_phd
;
2647 VERIFY(phd
!= NULL
&& inp
->inp_lport
> 0);
2649 LIST_REMOVE(inp
, inp_hash
);
2650 inp
->inp_hash
.le_next
= NULL
;
2651 inp
->inp_hash
.le_prev
= NULL
;
2653 LIST_REMOVE(inp
, inp_portlist
);
2654 inp
->inp_portlist
.le_next
= NULL
;
2655 inp
->inp_portlist
.le_prev
= NULL
;
2656 if (LIST_EMPTY(&phd
->phd_pcblist
)) {
2657 LIST_REMOVE(phd
, phd_hash
);
2660 inp
->inp_phd
= NULL
;
2661 inp
->inp_flags2
&= ~INP2_INHASHLIST
;
2663 VERIFY(!(inp
->inp_flags2
& INP2_INHASHLIST
));
2665 if (inp
->inp_flags2
& INP2_TIMEWAIT
) {
2666 /* Remove from time-wait queue */
2667 tcp_remove_from_time_wait(inp
);
2668 inp
->inp_flags2
&= ~INP2_TIMEWAIT
;
2669 VERIFY(inp
->inp_pcbinfo
->ipi_twcount
!= 0);
2670 inp
->inp_pcbinfo
->ipi_twcount
--;
2672 /* Remove from global inp list if it is not time-wait */
2673 LIST_REMOVE(inp
, inp_list
);
2676 if (inp
->inp_flags2
& INP2_IN_FCTREE
) {
2677 inp_fc_getinp(inp
->inp_flowhash
, (INPFC_SOLOCKED
| INPFC_REMOVE
));
2678 VERIFY(!(inp
->inp_flags2
& INP2_IN_FCTREE
));
2681 inp
->inp_pcbinfo
->ipi_count
--;
2685 * Mechanism used to defer the memory release of PCBs
2686 * The pcb list will contain the pcb until the reaper can clean it up if
2687 * the following conditions are met:
2689 * 2) wantcnt is STOPUSING
2691 * This function will be called to either mark the pcb as
2694 in_pcb_checkstate(struct inpcb
*pcb
, int mode
, int locked
)
2696 volatile UInt32
*wantcnt
= (volatile UInt32
*)&pcb
->inp_wantcnt
;
2703 * Try to mark the pcb as ready for recycling. CAS with
2704 * STOPUSING, if success we're good, if it's in use, will
2708 socket_lock(pcb
->inp_socket
, 1);
2710 pcb
->inp_state
= INPCB_STATE_DEAD
;
2713 if (pcb
->inp_socket
->so_usecount
< 0) {
2714 panic("%s: pcb=%p so=%p usecount is negative\n",
2715 __func__
, pcb
, pcb
->inp_socket
);
2719 socket_unlock(pcb
->inp_socket
, 1);
2722 inpcb_gc_sched(pcb
->inp_pcbinfo
, INPCB_TIMER_FAST
);
2724 origwant
= *wantcnt
;
2725 if ((UInt16
) origwant
== 0xffff) { /* should stop using */
2726 return WNT_STOPUSING
;
2729 if ((UInt16
) origwant
== 0) {
2730 /* try to mark it as unsuable now */
2731 OSCompareAndSwap(origwant
, newwant
, wantcnt
);
2733 return WNT_STOPUSING
;
2737 * Try to increase reference to pcb. If WNT_STOPUSING
2738 * should bail out. If socket state DEAD, try to set count
2739 * to STOPUSING, return failed otherwise increase cnt.
2742 origwant
= *wantcnt
;
2743 if ((UInt16
) origwant
== 0xffff) {
2744 /* should stop using */
2745 return WNT_STOPUSING
;
2747 newwant
= origwant
+ 1;
2748 } while (!OSCompareAndSwap(origwant
, newwant
, wantcnt
));
2753 * Release reference. If result is null and pcb state
2754 * is DEAD, set wanted bit to STOPUSING
2757 socket_lock(pcb
->inp_socket
, 1);
2761 origwant
= *wantcnt
;
2762 if ((UInt16
) origwant
== 0x0) {
2763 panic("%s: pcb=%p release with zero count",
2767 if ((UInt16
) origwant
== 0xffff) {
2768 /* should stop using */
2770 socket_unlock(pcb
->inp_socket
, 1);
2772 return WNT_STOPUSING
;
2774 newwant
= origwant
- 1;
2775 } while (!OSCompareAndSwap(origwant
, newwant
, wantcnt
));
2777 if (pcb
->inp_state
== INPCB_STATE_DEAD
) {
2780 if (pcb
->inp_socket
->so_usecount
< 0) {
2781 panic("%s: RELEASE pcb=%p so=%p usecount is negative\n",
2782 __func__
, pcb
, pcb
->inp_socket
);
2787 socket_unlock(pcb
->inp_socket
, 1);
2792 panic("%s: so=%p not a valid state =%x\n", __func__
,
2793 pcb
->inp_socket
, mode
);
2802 * inpcb_to_compat copies specific bits of an inpcb to a inpcb_compat.
2803 * The inpcb_compat data structure is passed to user space and must
2804 * not change. We intentionally avoid copying pointers.
2807 inpcb_to_compat(struct inpcb
*inp
, struct inpcb_compat
*inp_compat
)
2809 bzero(inp_compat
, sizeof(*inp_compat
));
2810 inp_compat
->inp_fport
= inp
->inp_fport
;
2811 inp_compat
->inp_lport
= inp
->inp_lport
;
2812 inp_compat
->nat_owner
= 0;
2813 inp_compat
->nat_cookie
= 0;
2814 inp_compat
->inp_gencnt
= inp
->inp_gencnt
;
2815 inp_compat
->inp_flags
= inp
->inp_flags
;
2816 inp_compat
->inp_flow
= inp
->inp_flow
;
2817 inp_compat
->inp_vflag
= inp
->inp_vflag
;
2818 inp_compat
->inp_ip_ttl
= inp
->inp_ip_ttl
;
2819 inp_compat
->inp_ip_p
= inp
->inp_ip_p
;
2820 inp_compat
->inp_dependfaddr
.inp6_foreign
=
2821 inp
->inp_dependfaddr
.inp6_foreign
;
2822 inp_compat
->inp_dependladdr
.inp6_local
=
2823 inp
->inp_dependladdr
.inp6_local
;
2824 inp_compat
->inp_depend4
.inp4_ip_tos
= inp
->inp_depend4
.inp4_ip_tos
;
2825 inp_compat
->inp_depend6
.inp6_hlim
= 0;
2826 inp_compat
->inp_depend6
.inp6_cksum
= inp
->inp_depend6
.inp6_cksum
;
2827 inp_compat
->inp_depend6
.inp6_ifindex
= 0;
2828 inp_compat
->inp_depend6
.inp6_hops
= inp
->inp_depend6
.inp6_hops
;
2831 #if !CONFIG_EMBEDDED
2833 inpcb_to_xinpcb64(struct inpcb
*inp
, struct xinpcb64
*xinp
)
2835 xinp
->inp_fport
= inp
->inp_fport
;
2836 xinp
->inp_lport
= inp
->inp_lport
;
2837 xinp
->inp_gencnt
= inp
->inp_gencnt
;
2838 xinp
->inp_flags
= inp
->inp_flags
;
2839 xinp
->inp_flow
= inp
->inp_flow
;
2840 xinp
->inp_vflag
= inp
->inp_vflag
;
2841 xinp
->inp_ip_ttl
= inp
->inp_ip_ttl
;
2842 xinp
->inp_ip_p
= inp
->inp_ip_p
;
2843 xinp
->inp_dependfaddr
.inp6_foreign
= inp
->inp_dependfaddr
.inp6_foreign
;
2844 xinp
->inp_dependladdr
.inp6_local
= inp
->inp_dependladdr
.inp6_local
;
2845 xinp
->inp_depend4
.inp4_ip_tos
= inp
->inp_depend4
.inp4_ip_tos
;
2846 xinp
->inp_depend6
.inp6_hlim
= 0;
2847 xinp
->inp_depend6
.inp6_cksum
= inp
->inp_depend6
.inp6_cksum
;
2848 xinp
->inp_depend6
.inp6_ifindex
= 0;
2849 xinp
->inp_depend6
.inp6_hops
= inp
->inp_depend6
.inp6_hops
;
2851 #endif /* !CONFIG_EMBEDDED */
2854 * The following routines implement this scheme:
2856 * Callers of ip_output() that intend to cache the route in the inpcb pass
2857 * a local copy of the struct route to ip_output(). Using a local copy of
2858 * the cached route significantly simplifies things as IP no longer has to
2859 * worry about having exclusive access to the passed in struct route, since
2860 * it's defined in the caller's stack; in essence, this allows for a lock-
2861 * less operation when updating the struct route at the IP level and below,
2862 * whenever necessary. The scheme works as follows:
2864 * Prior to dropping the socket's lock and calling ip_output(), the caller
2865 * copies the struct route from the inpcb into its stack, and adds a reference
2866 * to the cached route entry, if there was any. The socket's lock is then
2867 * dropped and ip_output() is called with a pointer to the copy of struct
2868 * route defined on the stack (not to the one in the inpcb.)
2870 * Upon returning from ip_output(), the caller then acquires the socket's
2871 * lock and synchronizes the cache; if there is no route cached in the inpcb,
2872 * it copies the local copy of struct route (which may or may not contain any
2873 * route) back into the cache; otherwise, if the inpcb has a route cached in
2874 * it, the one in the local copy will be freed, if there's any. Trashing the
2875 * cached route in the inpcb can be avoided because ip_output() is single-
2876 * threaded per-PCB (i.e. multiple transmits on a PCB are always serialized
2877 * by the socket/transport layer.)
2880 inp_route_copyout(struct inpcb
*inp
, struct route
*dst
)
2882 struct route
*src
= &inp
->inp_route
;
2884 socket_lock_assert_owned(inp
->inp_socket
);
2887 * If the route in the PCB is stale or not for IPv4, blow it away;
2888 * this is possible in the case of IPv4-mapped address case.
2890 if (ROUTE_UNUSABLE(src
) || rt_key(src
->ro_rt
)->sa_family
!= AF_INET
) {
2894 route_copyout(dst
, src
, sizeof(*dst
));
2898 inp_route_copyin(struct inpcb
*inp
, struct route
*src
)
2900 struct route
*dst
= &inp
->inp_route
;
2902 socket_lock_assert_owned(inp
->inp_socket
);
2904 /* Minor sanity check */
2905 if (src
->ro_rt
!= NULL
&& rt_key(src
->ro_rt
)->sa_family
!= AF_INET
) {
2906 panic("%s: wrong or corrupted route: %p", __func__
, src
);
2909 route_copyin(src
, dst
, sizeof(*src
));
2913 * Handler for setting IP_BOUND_IF/IPV6_BOUND_IF socket option.
2916 inp_bindif(struct inpcb
*inp
, unsigned int ifscope
, struct ifnet
**pifp
)
2918 struct ifnet
*ifp
= NULL
;
2920 ifnet_head_lock_shared();
2921 if ((ifscope
> (unsigned)if_index
) || (ifscope
!= IFSCOPE_NONE
&&
2922 (ifp
= ifindex2ifnet
[ifscope
]) == NULL
)) {
2928 VERIFY(ifp
!= NULL
|| ifscope
== IFSCOPE_NONE
);
2931 * A zero interface scope value indicates an "unbind".
2932 * Otherwise, take in whatever value the app desires;
2933 * the app may already know the scope (or force itself
2934 * to such a scope) ahead of time before the interface
2935 * gets attached. It doesn't matter either way; any
2936 * route lookup from this point on will require an
2937 * exact match for the embedded interface scope.
2939 inp
->inp_boundifp
= ifp
;
2940 if (inp
->inp_boundifp
== NULL
) {
2941 inp
->inp_flags
&= ~INP_BOUND_IF
;
2943 inp
->inp_flags
|= INP_BOUND_IF
;
2946 /* Blow away any cached route in the PCB */
2947 ROUTE_RELEASE(&inp
->inp_route
);
2957 * Handler for setting IP_NO_IFT_CELLULAR/IPV6_NO_IFT_CELLULAR socket option,
2958 * as well as for setting PROC_UUID_NO_CELLULAR policy.
2961 inp_set_nocellular(struct inpcb
*inp
)
2963 inp
->inp_flags
|= INP_NO_IFT_CELLULAR
;
2965 /* Blow away any cached route in the PCB */
2966 ROUTE_RELEASE(&inp
->inp_route
);
2970 * Handler for clearing IP_NO_IFT_CELLULAR/IPV6_NO_IFT_CELLULAR socket option,
2971 * as well as for clearing PROC_UUID_NO_CELLULAR policy.
2974 inp_clear_nocellular(struct inpcb
*inp
)
2976 struct socket
*so
= inp
->inp_socket
;
2979 * SO_RESTRICT_DENY_CELLULAR socket restriction issued on the socket
2980 * has a higher precendence than INP_NO_IFT_CELLULAR. Clear the flag
2981 * if and only if the socket is unrestricted.
2983 if (so
!= NULL
&& !(so
->so_restrictions
& SO_RESTRICT_DENY_CELLULAR
)) {
2984 inp
->inp_flags
&= ~INP_NO_IFT_CELLULAR
;
2986 /* Blow away any cached route in the PCB */
2987 ROUTE_RELEASE(&inp
->inp_route
);
2992 inp_set_noexpensive(struct inpcb
*inp
)
2994 inp
->inp_flags2
|= INP2_NO_IFF_EXPENSIVE
;
2996 /* Blow away any cached route in the PCB */
2997 ROUTE_RELEASE(&inp
->inp_route
);
3001 inp_set_noconstrained(struct inpcb
*inp
)
3003 inp
->inp_flags2
|= INP2_NO_IFF_CONSTRAINED
;
3005 /* Blow away any cached route in the PCB */
3006 ROUTE_RELEASE(&inp
->inp_route
);
3010 inp_set_awdl_unrestricted(struct inpcb
*inp
)
3012 inp
->inp_flags2
|= INP2_AWDL_UNRESTRICTED
;
3014 /* Blow away any cached route in the PCB */
3015 ROUTE_RELEASE(&inp
->inp_route
);
3019 inp_get_awdl_unrestricted(struct inpcb
*inp
)
3021 return (inp
->inp_flags2
& INP2_AWDL_UNRESTRICTED
) ? TRUE
: FALSE
;
3025 inp_clear_awdl_unrestricted(struct inpcb
*inp
)
3027 inp
->inp_flags2
&= ~INP2_AWDL_UNRESTRICTED
;
3029 /* Blow away any cached route in the PCB */
3030 ROUTE_RELEASE(&inp
->inp_route
);
3034 inp_set_intcoproc_allowed(struct inpcb
*inp
)
3036 inp
->inp_flags2
|= INP2_INTCOPROC_ALLOWED
;
3038 /* Blow away any cached route in the PCB */
3039 ROUTE_RELEASE(&inp
->inp_route
);
3043 inp_get_intcoproc_allowed(struct inpcb
*inp
)
3045 return (inp
->inp_flags2
& INP2_INTCOPROC_ALLOWED
) ? TRUE
: FALSE
;
3049 inp_clear_intcoproc_allowed(struct inpcb
*inp
)
3051 inp
->inp_flags2
&= ~INP2_INTCOPROC_ALLOWED
;
3053 /* Blow away any cached route in the PCB */
3054 ROUTE_RELEASE(&inp
->inp_route
);
3059 * Called when PROC_UUID_NECP_APP_POLICY is set.
3062 inp_set_want_app_policy(struct inpcb
*inp
)
3064 inp
->inp_flags2
|= INP2_WANT_APP_POLICY
;
3068 * Called when PROC_UUID_NECP_APP_POLICY is cleared.
3071 inp_clear_want_app_policy(struct inpcb
*inp
)
3073 inp
->inp_flags2
&= ~INP2_WANT_APP_POLICY
;
3078 * Calculate flow hash for an inp, used by an interface to identify a
3079 * flow. When an interface provides flow control advisory, this flow
3080 * hash is used as an identifier.
3083 inp_calc_flowhash(struct inpcb
*inp
)
3085 struct inp_flowhash_key fh
__attribute__((aligned(8)));
3086 u_int32_t flowhash
= 0;
3087 struct inpcb
*tmp_inp
= NULL
;
3089 if (inp_hash_seed
== 0) {
3090 inp_hash_seed
= RandomULong();
3093 bzero(&fh
, sizeof(fh
));
3095 bcopy(&inp
->inp_dependladdr
, &fh
.infh_laddr
, sizeof(fh
.infh_laddr
));
3096 bcopy(&inp
->inp_dependfaddr
, &fh
.infh_faddr
, sizeof(fh
.infh_faddr
));
3098 fh
.infh_lport
= inp
->inp_lport
;
3099 fh
.infh_fport
= inp
->inp_fport
;
3100 fh
.infh_af
= (inp
->inp_vflag
& INP_IPV6
) ? AF_INET6
: AF_INET
;
3101 fh
.infh_proto
= inp
->inp_ip_p
;
3102 fh
.infh_rand1
= RandomULong();
3103 fh
.infh_rand2
= RandomULong();
3106 flowhash
= net_flowhash(&fh
, sizeof(fh
), inp_hash_seed
);
3107 if (flowhash
== 0) {
3108 /* try to get a non-zero flowhash */
3109 inp_hash_seed
= RandomULong();
3113 inp
->inp_flowhash
= flowhash
;
3115 /* Insert the inp into inp_fc_tree */
3116 lck_mtx_lock_spin(&inp_fc_lck
);
3117 tmp_inp
= RB_FIND(inp_fc_tree
, &inp_fc_tree
, inp
);
3118 if (tmp_inp
!= NULL
) {
3120 * There is a different inp with the same flowhash.
3121 * There can be a collision on flow hash but the
3122 * probability is low. Let's recompute the
3125 lck_mtx_unlock(&inp_fc_lck
);
3126 /* recompute hash seed */
3127 inp_hash_seed
= RandomULong();
3131 RB_INSERT(inp_fc_tree
, &inp_fc_tree
, inp
);
3132 inp
->inp_flags2
|= INP2_IN_FCTREE
;
3133 lck_mtx_unlock(&inp_fc_lck
);
3139 inp_flowadv(uint32_t flowhash
)
3143 inp
= inp_fc_getinp(flowhash
, 0);
3148 inp_fc_feedback(inp
);
3152 * Function to compare inp_fc_entries in inp flow control tree
3155 infc_cmp(const struct inpcb
*inp1
, const struct inpcb
*inp2
)
3157 return memcmp(&(inp1
->inp_flowhash
), &(inp2
->inp_flowhash
),
3158 sizeof(inp1
->inp_flowhash
));
3161 static struct inpcb
*
3162 inp_fc_getinp(u_int32_t flowhash
, u_int32_t flags
)
3164 struct inpcb
*inp
= NULL
;
3165 int locked
= (flags
& INPFC_SOLOCKED
) ? 1 : 0;
3167 lck_mtx_lock_spin(&inp_fc_lck
);
3168 key_inp
.inp_flowhash
= flowhash
;
3169 inp
= RB_FIND(inp_fc_tree
, &inp_fc_tree
, &key_inp
);
3171 /* inp is not present, return */
3172 lck_mtx_unlock(&inp_fc_lck
);
3176 if (flags
& INPFC_REMOVE
) {
3177 RB_REMOVE(inp_fc_tree
, &inp_fc_tree
, inp
);
3178 lck_mtx_unlock(&inp_fc_lck
);
3180 bzero(&(inp
->infc_link
), sizeof(inp
->infc_link
));
3181 inp
->inp_flags2
&= ~INP2_IN_FCTREE
;
3185 if (in_pcb_checkstate(inp
, WNT_ACQUIRE
, locked
) == WNT_STOPUSING
) {
3188 lck_mtx_unlock(&inp_fc_lck
);
3194 inp_fc_feedback(struct inpcb
*inp
)
3196 struct socket
*so
= inp
->inp_socket
;
3198 /* we already hold a want_cnt on this inp, socket can't be null */
3202 if (in_pcb_checkstate(inp
, WNT_RELEASE
, 1) == WNT_STOPUSING
) {
3203 socket_unlock(so
, 1);
3207 if (inp
->inp_sndinprog_cnt
> 0) {
3208 inp
->inp_flags
|= INP_FC_FEEDBACK
;
3212 * Return if the connection is not in flow-controlled state.
3213 * This can happen if the connection experienced
3214 * loss while it was in flow controlled state
3216 if (!INP_WAIT_FOR_IF_FEEDBACK(inp
)) {
3217 socket_unlock(so
, 1);
3220 inp_reset_fc_state(inp
);
3222 if (SOCK_TYPE(so
) == SOCK_STREAM
) {
3223 inp_fc_unthrottle_tcp(inp
);
3226 socket_unlock(so
, 1);
3230 inp_reset_fc_state(struct inpcb
*inp
)
3232 struct socket
*so
= inp
->inp_socket
;
3233 int suspended
= (INP_IS_FLOW_SUSPENDED(inp
)) ? 1 : 0;
3234 int needwakeup
= (INP_WAIT_FOR_IF_FEEDBACK(inp
)) ? 1 : 0;
3236 inp
->inp_flags
&= ~(INP_FLOW_CONTROLLED
| INP_FLOW_SUSPENDED
);
3239 so
->so_flags
&= ~(SOF_SUSPENDED
);
3240 soevent(so
, (SO_FILT_HINT_LOCKED
| SO_FILT_HINT_RESUME
));
3243 /* Give a write wakeup to unblock the socket */
3250 inp_set_fc_state(struct inpcb
*inp
, int advcode
)
3252 struct inpcb
*tmp_inp
= NULL
;
3254 * If there was a feedback from the interface when
3255 * send operation was in progress, we should ignore
3256 * this flow advisory to avoid a race between setting
3257 * flow controlled state and receiving feedback from
3260 if (inp
->inp_flags
& INP_FC_FEEDBACK
) {
3264 inp
->inp_flags
&= ~(INP_FLOW_CONTROLLED
| INP_FLOW_SUSPENDED
);
3265 if ((tmp_inp
= inp_fc_getinp(inp
->inp_flowhash
,
3266 INPFC_SOLOCKED
)) != NULL
) {
3267 if (in_pcb_checkstate(tmp_inp
, WNT_RELEASE
, 1) == WNT_STOPUSING
) {
3270 VERIFY(tmp_inp
== inp
);
3272 case FADV_FLOW_CONTROLLED
:
3273 inp
->inp_flags
|= INP_FLOW_CONTROLLED
;
3275 case FADV_SUSPENDED
:
3276 inp
->inp_flags
|= INP_FLOW_SUSPENDED
;
3277 soevent(inp
->inp_socket
,
3278 (SO_FILT_HINT_LOCKED
| SO_FILT_HINT_SUSPEND
));
3280 /* Record the fact that suspend event was sent */
3281 inp
->inp_socket
->so_flags
|= SOF_SUSPENDED
;
3290 * Handler for SO_FLUSH socket option.
3293 inp_flush(struct inpcb
*inp
, int optval
)
3295 u_int32_t flowhash
= inp
->inp_flowhash
;
3296 struct ifnet
*rtifp
, *oifp
;
3298 /* Either all classes or one of the valid ones */
3299 if (optval
!= SO_TC_ALL
&& !SO_VALID_TC(optval
)) {
3303 /* We need a flow hash for identification */
3304 if (flowhash
== 0) {
3308 /* Grab the interfaces from the route and pcb */
3309 rtifp
= ((inp
->inp_route
.ro_rt
!= NULL
) ?
3310 inp
->inp_route
.ro_rt
->rt_ifp
: NULL
);
3311 oifp
= inp
->inp_last_outifp
;
3313 if (rtifp
!= NULL
) {
3314 if_qflush_sc(rtifp
, so_tc2msc(optval
), flowhash
, NULL
, NULL
, 0);
3316 if (oifp
!= NULL
&& oifp
!= rtifp
) {
3317 if_qflush_sc(oifp
, so_tc2msc(optval
), flowhash
, NULL
, NULL
, 0);
3324 * Clear the INP_INADDR_ANY flag (special case for PPP only)
3327 inp_clear_INP_INADDR_ANY(struct socket
*so
)
3329 struct inpcb
*inp
= NULL
;
3332 inp
= sotoinpcb(so
);
3334 inp
->inp_flags
&= ~INP_INADDR_ANY
;
3336 socket_unlock(so
, 1);
3340 inp_get_soprocinfo(struct inpcb
*inp
, struct so_procinfo
*soprocinfo
)
3342 struct socket
*so
= inp
->inp_socket
;
3344 soprocinfo
->spi_pid
= so
->last_pid
;
3345 strlcpy(&soprocinfo
->spi_proc_name
[0], &inp
->inp_last_proc_name
[0],
3346 sizeof(soprocinfo
->spi_proc_name
));
3347 if (so
->last_pid
!= 0) {
3348 uuid_copy(soprocinfo
->spi_uuid
, so
->last_uuid
);
3351 * When not delegated, the effective pid is the same as the real pid
3353 if (so
->so_flags
& SOF_DELEGATED
) {
3354 soprocinfo
->spi_delegated
= 1;
3355 soprocinfo
->spi_epid
= so
->e_pid
;
3356 uuid_copy(soprocinfo
->spi_euuid
, so
->e_uuid
);
3358 soprocinfo
->spi_delegated
= 0;
3359 soprocinfo
->spi_epid
= so
->last_pid
;
3361 strlcpy(&soprocinfo
->spi_e_proc_name
[0], &inp
->inp_e_proc_name
[0],
3362 sizeof(soprocinfo
->spi_e_proc_name
));
3366 inp_findinpcb_procinfo(struct inpcbinfo
*pcbinfo
, uint32_t flowhash
,
3367 struct so_procinfo
*soprocinfo
)
3369 struct inpcb
*inp
= NULL
;
3372 bzero(soprocinfo
, sizeof(struct so_procinfo
));
3378 lck_rw_lock_shared(pcbinfo
->ipi_lock
);
3379 LIST_FOREACH(inp
, pcbinfo
->ipi_listhead
, inp_list
) {
3380 if (inp
->inp_state
!= INPCB_STATE_DEAD
&&
3381 inp
->inp_socket
!= NULL
&&
3382 inp
->inp_flowhash
== flowhash
) {
3384 inp_get_soprocinfo(inp
, soprocinfo
);
3388 lck_rw_done(pcbinfo
->ipi_lock
);
3393 #if CONFIG_PROC_UUID_POLICY
3395 inp_update_cellular_policy(struct inpcb
*inp
, boolean_t set
)
3397 struct socket
*so
= inp
->inp_socket
;
3401 VERIFY(inp
->inp_state
!= INPCB_STATE_DEAD
);
3403 before
= INP_NO_CELLULAR(inp
);
3405 inp_set_nocellular(inp
);
3407 inp_clear_nocellular(inp
);
3409 after
= INP_NO_CELLULAR(inp
);
3410 if (net_io_policy_log
&& (before
!= after
)) {
3411 static const char *ok
= "OK";
3412 static const char *nok
= "NOACCESS";
3413 uuid_string_t euuid_buf
;
3416 if (so
->so_flags
& SOF_DELEGATED
) {
3417 uuid_unparse(so
->e_uuid
, euuid_buf
);
3420 uuid_unparse(so
->last_uuid
, euuid_buf
);
3421 epid
= so
->last_pid
;
3424 /* allow this socket to generate another notification event */
3425 so
->so_ifdenied_notifies
= 0;
3427 log(LOG_DEBUG
, "%s: so 0x%llx [%d,%d] epid %d "
3428 "euuid %s%s %s->%s\n", __func__
,
3429 (uint64_t)VM_KERNEL_ADDRPERM(so
), SOCK_DOM(so
),
3430 SOCK_TYPE(so
), epid
, euuid_buf
,
3431 (so
->so_flags
& SOF_DELEGATED
) ?
3432 " [delegated]" : "",
3433 ((before
< after
) ? ok
: nok
),
3434 ((before
< after
) ? nok
: ok
));
3440 inp_update_necp_want_app_policy(struct inpcb
*inp
, boolean_t set
)
3442 struct socket
*so
= inp
->inp_socket
;
3446 VERIFY(inp
->inp_state
!= INPCB_STATE_DEAD
);
3448 before
= (inp
->inp_flags2
& INP2_WANT_APP_POLICY
);
3450 inp_set_want_app_policy(inp
);
3452 inp_clear_want_app_policy(inp
);
3454 after
= (inp
->inp_flags2
& INP2_WANT_APP_POLICY
);
3455 if (net_io_policy_log
&& (before
!= after
)) {
3456 static const char *wanted
= "WANTED";
3457 static const char *unwanted
= "UNWANTED";
3458 uuid_string_t euuid_buf
;
3461 if (so
->so_flags
& SOF_DELEGATED
) {
3462 uuid_unparse(so
->e_uuid
, euuid_buf
);
3465 uuid_unparse(so
->last_uuid
, euuid_buf
);
3466 epid
= so
->last_pid
;
3469 log(LOG_DEBUG
, "%s: so 0x%llx [%d,%d] epid %d "
3470 "euuid %s%s %s->%s\n", __func__
,
3471 (uint64_t)VM_KERNEL_ADDRPERM(so
), SOCK_DOM(so
),
3472 SOCK_TYPE(so
), epid
, euuid_buf
,
3473 (so
->so_flags
& SOF_DELEGATED
) ?
3474 " [delegated]" : "",
3475 ((before
< after
) ? unwanted
: wanted
),
3476 ((before
< after
) ? wanted
: unwanted
));
3480 #endif /* !CONFIG_PROC_UUID_POLICY */
3484 inp_update_necp_policy(struct inpcb
*inp
, struct sockaddr
*override_local_addr
, struct sockaddr
*override_remote_addr
, u_int override_bound_interface
)
3486 necp_socket_find_policy_match(inp
, override_local_addr
, override_remote_addr
, override_bound_interface
);
3487 if (necp_socket_should_rescope(inp
) &&
3488 inp
->inp_lport
== 0 &&
3489 inp
->inp_laddr
.s_addr
== INADDR_ANY
&&
3490 IN6_IS_ADDR_UNSPECIFIED(&inp
->in6p_laddr
)) {
3491 // If we should rescope, and the socket is not yet bound
3492 inp_bindif(inp
, necp_socket_get_rescope_if_index(inp
), NULL
);
3498 inp_update_policy(struct inpcb
*inp
)
3500 #if CONFIG_PROC_UUID_POLICY
3501 struct socket
*so
= inp
->inp_socket
;
3502 uint32_t pflags
= 0;
3505 uint8_t *lookup_uuid
= NULL
;
3507 if (!net_io_policy_uuid
||
3508 so
== NULL
|| inp
->inp_state
== INPCB_STATE_DEAD
) {
3513 * Kernel-created sockets that aren't delegating other sockets
3514 * are currently exempted from UUID policy checks.
3516 if (so
->last_pid
== 0 && !(so
->so_flags
& SOF_DELEGATED
)) {
3520 #if defined(XNU_TARGET_OS_OSX)
3521 if (so
->so_rpid
> 0) {
3522 lookup_uuid
= so
->so_ruuid
;
3523 ogencnt
= so
->so_policy_gencnt
;
3524 err
= proc_uuid_policy_lookup(lookup_uuid
, &pflags
, &so
->so_policy_gencnt
);
3527 if (lookup_uuid
== NULL
|| err
== ENOENT
) {
3528 lookup_uuid
= ((so
->so_flags
& SOF_DELEGATED
) ? so
->e_uuid
: so
->last_uuid
);
3529 ogencnt
= so
->so_policy_gencnt
;
3530 err
= proc_uuid_policy_lookup(lookup_uuid
, &pflags
, &so
->so_policy_gencnt
);
3534 * Discard cached generation count if the entry is gone (ENOENT),
3535 * so that we go thru the checks below.
3537 if (err
== ENOENT
&& ogencnt
!= 0) {
3538 so
->so_policy_gencnt
= 0;
3542 * If the generation count has changed, inspect the policy flags
3543 * and act accordingly. If a policy flag was previously set and
3544 * the UUID is no longer present in the table (ENOENT), treat it
3545 * as if the flag has been cleared.
3547 if ((err
== 0 || err
== ENOENT
) && ogencnt
!= so
->so_policy_gencnt
) {
3548 /* update cellular policy for this socket */
3549 if (err
== 0 && (pflags
& PROC_UUID_NO_CELLULAR
)) {
3550 inp_update_cellular_policy(inp
, TRUE
);
3551 } else if (!(pflags
& PROC_UUID_NO_CELLULAR
)) {
3552 inp_update_cellular_policy(inp
, FALSE
);
3555 /* update necp want app policy for this socket */
3556 if (err
== 0 && (pflags
& PROC_UUID_NECP_APP_POLICY
)) {
3557 inp_update_necp_want_app_policy(inp
, TRUE
);
3558 } else if (!(pflags
& PROC_UUID_NECP_APP_POLICY
)) {
3559 inp_update_necp_want_app_policy(inp
, FALSE
);
3564 return (err
== ENOENT
) ? 0 : err
;
3565 #else /* !CONFIG_PROC_UUID_POLICY */
3568 #endif /* !CONFIG_PROC_UUID_POLICY */
3571 static unsigned int log_restricted
;
3572 SYSCTL_DECL(_net_inet
);
3573 SYSCTL_INT(_net_inet
, OID_AUTO
, log_restricted
,
3574 CTLFLAG_RW
| CTLFLAG_LOCKED
, &log_restricted
, 0,
3575 "Log network restrictions");
3577 * Called when we need to enforce policy restrictions in the input path.
3579 * Returns TRUE if we're not allowed to receive data, otherwise FALSE.
3582 _inp_restricted_recv(struct inpcb
*inp
, struct ifnet
*ifp
)
3584 VERIFY(inp
!= NULL
);
3587 * Inbound restrictions.
3589 if (!sorestrictrecv
) {
3597 if (IFNET_IS_CELLULAR(ifp
) && INP_NO_CELLULAR(inp
)) {
3601 if (IFNET_IS_EXPENSIVE(ifp
) && INP_NO_EXPENSIVE(inp
)) {
3605 if (IFNET_IS_CONSTRAINED(ifp
) && INP_NO_CONSTRAINED(inp
)) {
3609 if (IFNET_IS_AWDL_RESTRICTED(ifp
) && !INP_AWDL_UNRESTRICTED(inp
)) {
3613 if (!(ifp
->if_eflags
& IFEF_RESTRICTED_RECV
)) {
3617 if (inp
->inp_flags
& INP_RECV_ANYIF
) {
3621 if ((inp
->inp_flags
& INP_BOUND_IF
) && inp
->inp_boundifp
== ifp
) {
3625 if (IFNET_IS_INTCOPROC(ifp
) && !INP_INTCOPROC_ALLOWED(inp
)) {
3633 inp_restricted_recv(struct inpcb
*inp
, struct ifnet
*ifp
)
3637 ret
= _inp_restricted_recv(inp
, ifp
);
3638 if (ret
== TRUE
&& log_restricted
) {
3639 printf("pid %d (%s) is unable to receive packets on %s\n",
3640 current_proc()->p_pid
, proc_best_name(current_proc()),
3647 * Called when we need to enforce policy restrictions in the output path.
3649 * Returns TRUE if we're not allowed to send data out, otherwise FALSE.
3652 _inp_restricted_send(struct inpcb
*inp
, struct ifnet
*ifp
)
3654 VERIFY(inp
!= NULL
);
3657 * Outbound restrictions.
3659 if (!sorestrictsend
) {
3667 if (IFNET_IS_CELLULAR(ifp
) && INP_NO_CELLULAR(inp
)) {
3671 if (IFNET_IS_EXPENSIVE(ifp
) && INP_NO_EXPENSIVE(inp
)) {
3675 if (IFNET_IS_CONSTRAINED(ifp
) && INP_NO_CONSTRAINED(inp
)) {
3679 if (IFNET_IS_AWDL_RESTRICTED(ifp
) && !INP_AWDL_UNRESTRICTED(inp
)) {
3683 if (IFNET_IS_INTCOPROC(ifp
) && !INP_INTCOPROC_ALLOWED(inp
)) {
3691 inp_restricted_send(struct inpcb
*inp
, struct ifnet
*ifp
)
3695 ret
= _inp_restricted_send(inp
, ifp
);
3696 if (ret
== TRUE
&& log_restricted
) {
3697 printf("pid %d (%s) is unable to transmit packets on %s\n",
3698 current_proc()->p_pid
, proc_best_name(current_proc()),
3705 inp_count_sndbytes(struct inpcb
*inp
, u_int32_t th_ack
)
3707 struct ifnet
*ifp
= inp
->inp_last_outifp
;
3708 struct socket
*so
= inp
->inp_socket
;
3709 if (ifp
!= NULL
&& !(so
->so_flags
& SOF_MP_SUBFLOW
) &&
3710 (ifp
->if_type
== IFT_CELLULAR
|| IFNET_IS_WIFI(ifp
))) {
3713 so
->so_snd
.sb_flags
|= SB_SNDBYTE_CNT
;
3716 * There can be data outstanding before the connection
3717 * becomes established -- TFO case
3719 if (so
->so_snd
.sb_cc
> 0) {
3720 inp_incr_sndbytes_total(so
, so
->so_snd
.sb_cc
);
3723 unsent
= inp_get_sndbytes_allunsent(so
, th_ack
);
3725 inp_incr_sndbytes_unsent(so
, unsent
);
3731 inp_incr_sndbytes_total(struct socket
*so
, int32_t len
)
3733 struct inpcb
*inp
= (struct inpcb
*)so
->so_pcb
;
3734 struct ifnet
*ifp
= inp
->inp_last_outifp
;
3737 VERIFY(ifp
->if_sndbyte_total
>= 0);
3738 OSAddAtomic64(len
, &ifp
->if_sndbyte_total
);
3743 inp_decr_sndbytes_total(struct socket
*so
, int32_t len
)
3745 struct inpcb
*inp
= (struct inpcb
*)so
->so_pcb
;
3746 struct ifnet
*ifp
= inp
->inp_last_outifp
;
3749 VERIFY(ifp
->if_sndbyte_total
>= len
);
3750 OSAddAtomic64(-len
, &ifp
->if_sndbyte_total
);
3755 inp_incr_sndbytes_unsent(struct socket
*so
, int32_t len
)
3757 struct inpcb
*inp
= (struct inpcb
*)so
->so_pcb
;
3758 struct ifnet
*ifp
= inp
->inp_last_outifp
;
3761 VERIFY(ifp
->if_sndbyte_unsent
>= 0);
3762 OSAddAtomic64(len
, &ifp
->if_sndbyte_unsent
);
3767 inp_decr_sndbytes_unsent(struct socket
*so
, int32_t len
)
3769 if (so
== NULL
|| !(so
->so_snd
.sb_flags
& SB_SNDBYTE_CNT
)) {
3773 struct inpcb
*inp
= (struct inpcb
*)so
->so_pcb
;
3774 struct ifnet
*ifp
= inp
->inp_last_outifp
;
3777 if (ifp
->if_sndbyte_unsent
>= len
) {
3778 OSAddAtomic64(-len
, &ifp
->if_sndbyte_unsent
);
3780 ifp
->if_sndbyte_unsent
= 0;
3786 inp_decr_sndbytes_allunsent(struct socket
*so
, u_int32_t th_ack
)
3790 if (so
== NULL
|| !(so
->so_snd
.sb_flags
& SB_SNDBYTE_CNT
)) {
3794 len
= inp_get_sndbytes_allunsent(so
, th_ack
);
3795 inp_decr_sndbytes_unsent(so
, len
);
3800 inp_set_activity_bitmap(struct inpcb
*inp
)
3802 in_stat_set_activity_bitmap(&inp
->inp_nw_activity
, net_uptime());
3806 inp_get_activity_bitmap(struct inpcb
*inp
, activity_bitmap_t
*ab
)
3808 bcopy(&inp
->inp_nw_activity
, ab
, sizeof(*ab
));
3812 inp_update_last_owner(struct socket
*so
, struct proc
*p
, struct proc
*ep
)
3814 struct inpcb
*inp
= (struct inpcb
*)so
->so_pcb
;
3821 strlcpy(&inp
->inp_last_proc_name
[0], proc_name_address(p
), sizeof(inp
->inp_last_proc_name
));
3823 if (so
->so_flags
& SOF_DELEGATED
) {
3825 strlcpy(&inp
->inp_e_proc_name
[0], proc_name_address(ep
), sizeof(inp
->inp_e_proc_name
));
3827 inp
->inp_e_proc_name
[0] = 0;
3830 inp
->inp_e_proc_name
[0] = 0;
3835 inp_copy_last_owner(struct socket
*so
, struct socket
*head
)
3837 struct inpcb
*inp
= (struct inpcb
*)so
->so_pcb
;
3838 struct inpcb
*head_inp
= (struct inpcb
*)head
->so_pcb
;
3840 if (inp
== NULL
|| head_inp
== NULL
) {
3844 strlcpy(&inp
->inp_last_proc_name
[0], &head_inp
->inp_last_proc_name
[0], sizeof(inp
->inp_last_proc_name
));
3845 strlcpy(&inp
->inp_e_proc_name
[0], &head_inp
->inp_e_proc_name
[0], sizeof(inp
->inp_e_proc_name
));