X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/6601e61aa18bf4f09af135ff61fc7f4771d23b06..e2d2fc5c71f7d145cba7267989251af45e3bb5ba:/bsd/netinet/in_pcb.c diff --git a/bsd/netinet/in_pcb.c b/bsd/netinet/in_pcb.c index c3b56f784..51eeca0b3 100644 --- a/bsd/netinet/in_pcb.c +++ b/bsd/netinet/in_pcb.c @@ -1,23 +1,29 @@ /* - * Copyright (c) 2000-2004 Apple Computer, Inc. All rights reserved. + * Copyright (c) 2000-2011 Apple Inc. All rights reserved. * - * @APPLE_LICENSE_HEADER_START@ + * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ * - * The contents of this file constitute Original Code as defined in and - * are subject to the Apple Public Source License Version 1.1 (the - * "License"). You may not use this file except in compliance with the - * License. Please obtain a copy of the License at - * http://www.apple.com/publicsource and read it before using this file. + * This file contains Original Code and/or Modifications of Original Code + * as defined in and that are subject to the Apple Public Source License + * Version 2.0 (the 'License'). You may not use this file except in + * compliance with the License. The rights granted to you under the License + * may not be used to create, or enable the creation or redistribution of, + * unlawful or unlicensed copies of an Apple operating system, or to + * circumvent, violate, or enable the circumvention or violation of, any + * terms of an Apple operating system software license agreement. * - * This Original Code and all software distributed under the License are - * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER + * Please obtain a copy of the License at + * http://www.opensource.apple.com/apsl/ and read it before using this file. + * + * The Original Code and all software distributed under the License are + * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. Please see the - * License for the specific language governing rights and limitations - * under the License. + * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. + * Please see the License for the specific language governing rights and + * limitations under the License. * - * @APPLE_LICENSE_HEADER_END@ + * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ */ /* * Copyright (c) 1982, 1986, 1991, 1993, 1995 @@ -69,6 +75,9 @@ #endif #include #include +#include +#include +#include #include #include @@ -98,14 +107,12 @@ #endif /* IPSEC */ #include +#include #if IPSEC extern int ipsec_bypass; -extern lck_mtx_t *sadb_mutex; #endif -extern u_long route_generation; - #define DBG_FNC_PCB_LOOKUP NETDBG_CODE(DBG_NETTCP, (6 << 8)) #define DBG_FNC_PCB_HLOOKUP NETDBG_CODE(DBG_NETTCP, ((6 << 8) | 1)) @@ -134,6 +141,7 @@ int ipport_hilastauto = IPPORT_HILASTAUTO; /* 65535 */ static int sysctl_net_ipport_check SYSCTL_HANDLER_ARGS { +#pragma unused(arg1, arg2) int error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req); if (!error) { @@ -149,21 +157,24 @@ sysctl_net_ipport_check SYSCTL_HANDLER_ARGS #undef RANGECHK -SYSCTL_NODE(_net_inet_ip, IPPROTO_IP, portrange, CTLFLAG_RW, 0, "IP Ports"); +SYSCTL_NODE(_net_inet_ip, IPPROTO_IP, portrange, CTLFLAG_RW|CTLFLAG_LOCKED, 0, "IP Ports"); -SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowfirst, CTLTYPE_INT|CTLFLAG_RW, +SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowfirst, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED, &ipport_lowfirstauto, 0, &sysctl_net_ipport_check, "I", ""); -SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowlast, CTLTYPE_INT|CTLFLAG_RW, +SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowlast, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED, &ipport_lowlastauto, 0, &sysctl_net_ipport_check, "I", ""); -SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, first, CTLTYPE_INT|CTLFLAG_RW, +SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, first, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED, &ipport_firstauto, 0, &sysctl_net_ipport_check, "I", ""); -SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, last, CTLTYPE_INT|CTLFLAG_RW, +SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, last, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED, &ipport_lastauto, 0, &sysctl_net_ipport_check, "I", ""); -SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hifirst, CTLTYPE_INT|CTLFLAG_RW, +SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hifirst, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED, &ipport_hifirstauto, 0, &sysctl_net_ipport_check, "I", ""); -SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast, CTLTYPE_INT|CTLFLAG_RW, +SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED, &ipport_hilastauto, 0, &sysctl_net_ipport_check, "I", ""); +extern int udp_use_randomport; +extern int tcp_use_randomport; + /* * in_pcb.c: manage the Protocol Control Blocks. * @@ -174,19 +185,24 @@ SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast, CTLTYPE_INT|CTLFLAG_RW, /* * Allocate a PCB and associate it with the socket. + * + * Returns: 0 Success + * ENOBUFS + * ENOMEM + * ipsec_init_policy:??? [IPSEC] */ int -in_pcballoc(so, pcbinfo, p) - struct socket *so; - struct inpcbinfo *pcbinfo; - struct proc *p; +in_pcballoc(struct socket *so, struct inpcbinfo *pcbinfo, __unused struct proc *p) { - register struct inpcb *inp; + struct inpcb *inp; caddr_t temp; #if IPSEC #ifndef __APPLE__ int error; #endif +#endif +#if CONFIG_MACF_NET + int mac_error; #endif if (so->cached_in_sock_layer == 0) { @@ -211,22 +227,32 @@ in_pcballoc(so, pcbinfo, p) inp->inp_gencnt = ++pcbinfo->ipi_gencnt; inp->inp_pcbinfo = pcbinfo; inp->inp_socket = so; +#if CONFIG_MACF_NET + mac_error = mac_inpcb_label_init(inp, M_WAITOK); + if (mac_error != 0) { + if (so->cached_in_sock_layer == 0) + zfree(pcbinfo->ipi_zone, inp); + return (mac_error); + } + mac_inpcb_label_associate(so, inp); +#endif + // make sure inp_stat is always 64bit aligned + inp->inp_stat = (struct inp_stat*)P2ROUNDUP(inp->inp_stat_store, sizeof(u_int64_t)); + if (((uintptr_t)inp->inp_stat - (uintptr_t)inp->inp_stat_store) + + sizeof(*inp->inp_stat) > sizeof(inp->inp_stat_store)) { + panic("insufficient space to align inp_stat"); + } + so->so_pcb = (caddr_t)inp; if (so->so_proto->pr_flags & PR_PCBLOCK) { - inp->inpcb_mtx = lck_mtx_alloc_init(pcbinfo->mtx_grp, pcbinfo->mtx_attr); - if (inp->inpcb_mtx == NULL) { - printf("in_pcballoc: can't alloc mutex! so=%x\n", so); - return(ENOMEM); - } + lck_mtx_init(&inp->inpcb_mtx, pcbinfo->mtx_grp, pcbinfo->mtx_attr); } #if IPSEC #ifndef __APPLE__ if (ipsec_bypass == 0) { - lck_mtx_lock(sadb_mutex); error = ipsec_init_policy(so, &inp->inp_sp); - lck_mtx_unlock(sadb_mutex); if (error != 0) { zfree(pcbinfo->ipi_zone, inp); return error; @@ -234,7 +260,7 @@ in_pcballoc(so, pcbinfo, p) } #endif #endif /*IPSEC*/ -#if defined(INET6) +#if INET6 if (INP_SOCKAF(so) == AF_INET6 && !ip6_mapped_addr_on) inp->inp_flags |= IN6P_IPV6_V6ONLY; #endif @@ -251,19 +277,94 @@ in_pcballoc(so, pcbinfo, p) return (0); } + +/* + in_pcblookup_local_and_cleanup does everything + in_pcblookup_local does but it checks for a socket + that's going away. Since we know that the lock is + held read+write when this funciton is called, we + can safely dispose of this socket like the slow + timer would usually do and return NULL. This is + great for bind. +*/ +struct inpcb* +in_pcblookup_local_and_cleanup( + struct inpcbinfo *pcbinfo, + struct in_addr laddr, + u_int lport_arg, + int wild_okay) +{ + struct inpcb *inp; + + /* Perform normal lookup */ + inp = in_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay); + + /* Check if we found a match but it's waiting to be disposed */ + if (inp && inp->inp_wantcnt == WNT_STOPUSING) { + struct socket *so = inp->inp_socket; + + lck_mtx_lock(&inp->inpcb_mtx); + + if (so->so_usecount == 0) { + if (inp->inp_state != INPCB_STATE_DEAD) + in_pcbdetach(inp); + in_pcbdispose(inp); + inp = NULL; + } + else { + lck_mtx_unlock(&inp->inpcb_mtx); + } + } + + return inp; +} + +#ifdef __APPLE_API_PRIVATE +static void +in_pcb_conflict_post_msg(u_int16_t port) +{ + /* + * Radar 5523020 send a kernel event notification if a non-participating socket tries to bind + * the port a socket who has set SOF_NOTIFYCONFLICT owns. + */ + struct kev_msg ev_msg; + struct kev_in_portinuse in_portinuse; + + bzero(&in_portinuse, sizeof(struct kev_in_portinuse)); + bzero(&ev_msg, sizeof(struct kev_msg)); + in_portinuse.port = ntohs(port); /* port in host order */ + in_portinuse.req_pid = proc_selfpid(); + ev_msg.vendor_code = KEV_VENDOR_APPLE; + ev_msg.kev_class = KEV_NETWORK_CLASS; + ev_msg.kev_subclass = KEV_INET_SUBCLASS; + ev_msg.event_code = KEV_INET_PORTINUSE; + ev_msg.dv[0].data_ptr = &in_portinuse; + ev_msg.dv[0].data_length = sizeof(struct kev_in_portinuse); + ev_msg.dv[1].data_length = 0; + kev_post_msg(&ev_msg); +} +#endif +/* + * Returns: 0 Success + * EADDRNOTAVAIL Address not available. + * EINVAL Invalid argument + * EAFNOSUPPORT Address family not supported [notdef] + * EACCES Permission denied + * EADDRINUSE Address in use + * EAGAIN Resource unavailable, try again + * priv_check_cred:EPERM Operation not permitted + */ int -in_pcbbind(inp, nam, p) - register struct inpcb *inp; - struct sockaddr *nam; - struct proc *p; +in_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct proc *p) { - register struct socket *so = inp->inp_socket; + struct socket *so = inp->inp_socket; unsigned short *lastport; struct sockaddr_in *sin; struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; - u_short lport = 0; + u_short lport = 0, rand_port = 0; int wild = 0, reuseport = (so->so_options & SO_REUSEPORT); - int error; + int error, randomport, conflict = 0; + kauth_cred_t cred; if (TAILQ_EMPTY(&in_ifaddrhead)) /* XXX broken! */ return (EADDRNOTAVAIL); @@ -274,6 +375,8 @@ in_pcbbind(inp, nam, p) socket_unlock(so, 0); /* keep reference on socket */ lck_rw_lock_exclusive(pcbinfo->mtx); if (nam) { + unsigned int outif = 0; + sin = (struct sockaddr_in *)nam; if (nam->sa_len != sizeof (*sin)) { lck_rw_done(pcbinfo->mtx); @@ -311,44 +414,67 @@ in_pcbbind(inp, nam, p) return (EADDRNOTAVAIL); } else { - ifafree(ifa); + IFA_LOCK(ifa); + outif = ifa->ifa_ifp->if_index; + IFA_UNLOCK(ifa); + IFA_REMREF(ifa); } } if (lport) { struct inpcb *t; /* GROSS */ - if (ntohs(lport) < IPPORT_RESERVED && p && - proc_suser(p)) { - lck_rw_done(pcbinfo->mtx); - socket_lock(so, 0); - return (EACCES); +#if !CONFIG_EMBEDDED + if (ntohs(lport) < IPPORT_RESERVED) { + cred = kauth_cred_proc_ref(p); + error = priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 0); + kauth_cred_unref(&cred); + if (error != 0) { + lck_rw_done(pcbinfo->mtx); + socket_lock(so, 0); + return (EACCES); + } } +#endif if (so->so_uid && !IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) { - t = in_pcblookup_local(inp->inp_pcbinfo, + t = in_pcblookup_local_and_cleanup(inp->inp_pcbinfo, sin->sin_addr, lport, INPLOOKUP_WILDCARD); if (t && (ntohl(sin->sin_addr.s_addr) != INADDR_ANY || ntohl(t->inp_laddr.s_addr) != INADDR_ANY || (t->inp_socket->so_options & SO_REUSEPORT) == 0) && - (so->so_uid != t->inp_socket->so_uid)) { + (so->so_uid != t->inp_socket->so_uid) && + ((t->inp_socket->so_flags & SOF_REUSESHAREUID) == 0)) { #if INET6 if (ntohl(sin->sin_addr.s_addr) != INADDR_ANY || ntohl(t->inp_laddr.s_addr) != INADDR_ANY || INP_SOCKAF(so) == - INP_SOCKAF(t->inp_socket)) { -#endif /* defined(INET6) */ + INP_SOCKAF(t->inp_socket)) +#endif /* INET6 */ + { +#ifdef __APPLE_API_PRIVATE + + if ((t->inp_socket->so_flags & SOF_NOTIFYCONFLICT) && ((so->so_flags & SOF_NOTIFYCONFLICT) == 0)) + conflict = 1; + + lck_rw_done(pcbinfo->mtx); + + if (conflict) + in_pcb_conflict_post_msg(lport); +#else lck_rw_done(pcbinfo->mtx); +#endif /* __APPLE_API_PRIVATE */ + socket_lock(so, 0); return (EADDRINUSE); } } } - t = in_pcblookup_local(pcbinfo, sin->sin_addr, + t = in_pcblookup_local_and_cleanup(pcbinfo, sin->sin_addr, lport, wild); if (t && (reuseport & t->inp_socket->so_options) == 0) { @@ -359,20 +485,36 @@ in_pcbbind(inp, nam, p) ntohl(t->inp_laddr.s_addr) != INADDR_ANY || INP_SOCKAF(so) == - INP_SOCKAF(t->inp_socket)) { -#endif /* defined(INET6) */ + INP_SOCKAF(t->inp_socket)) +#endif /* INET6 */ + { +#ifdef __APPLE_API_PRIVATE + + if ((t->inp_socket->so_flags & SOF_NOTIFYCONFLICT) && ((so->so_flags & SOF_NOTIFYCONFLICT) == 0)) + conflict = 1; + lck_rw_done(pcbinfo->mtx); + + if (conflict) + in_pcb_conflict_post_msg(lport); +#else + lck_rw_done(pcbinfo->mtx); +#endif /* __APPLE_API_PRIVATE */ socket_lock(so, 0); return (EADDRINUSE); } } } inp->inp_laddr = sin->sin_addr; + inp->inp_last_outif = outif; } if (lport == 0) { u_short first, last; int count; + randomport = (so->so_flags & SOF_BINDRANDOMPORT) || + (so->so_type == SOCK_STREAM ? tcp_use_randomport : udp_use_randomport); + inp->inp_flags |= INP_ANONPORT; if (inp->inp_flags & INP_HIGHPORT) { @@ -380,7 +522,10 @@ in_pcbbind(inp, nam, p) last = ipport_hilastauto; lastport = &pcbinfo->lasthi; } else if (inp->inp_flags & INP_LOWPORT) { - if (p && (error = proc_suser(p))) { + cred = kauth_cred_proc_ref(p); + error = priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 0); + kauth_cred_unref(&cred); + if (error != 0) { lck_rw_done(pcbinfo->mtx); socket_lock(so, 0); return error; @@ -393,6 +538,10 @@ in_pcbbind(inp, nam, p) last = ipport_lastauto; lastport = &pcbinfo->lastport; } + /* No point in randomizing if only one port is available */ + + if (first == last) + randomport = 0; /* * Simple check to ensure all ports are not used up causing * a deadlock here. @@ -404,6 +553,10 @@ in_pcbbind(inp, nam, p) /* * counting down */ + if (randomport) { + read_random(&rand_port, sizeof(rand_port)); + *lastport = first - (rand_port % (first - last)); + } count = first - last; do { @@ -411,18 +564,23 @@ in_pcbbind(inp, nam, p) lck_rw_done(pcbinfo->mtx); socket_lock(so, 0); inp->inp_laddr.s_addr = INADDR_ANY; + inp->inp_last_outif = 0; return (EADDRNOTAVAIL); } --*lastport; if (*lastport > first || *lastport < last) *lastport = first; lport = htons(*lastport); - } while (in_pcblookup_local(pcbinfo, + } while (in_pcblookup_local_and_cleanup(pcbinfo, inp->inp_laddr, lport, wild)); } else { /* * counting up */ + if (randomport) { + read_random(&rand_port, sizeof(rand_port)); + *lastport = first + (rand_port % (first - last)); + } count = last - first; do { @@ -430,13 +588,14 @@ in_pcbbind(inp, nam, p) lck_rw_done(pcbinfo->mtx); socket_lock(so, 0); inp->inp_laddr.s_addr = INADDR_ANY; + inp->inp_last_outif = 0; return (EADDRNOTAVAIL); } ++*lastport; if (*lastport < first || *lastport > last) *lastport = first; lport = htons(*lastport); - } while (in_pcblookup_local(pcbinfo, + } while (in_pcblookup_local_and_cleanup(pcbinfo, inp->inp_laddr, lport, wild)); } } @@ -445,10 +604,12 @@ in_pcbbind(inp, nam, p) if (in_pcbinshash(inp, 1) != 0) { inp->inp_laddr.s_addr = INADDR_ANY; inp->inp_lport = 0; + inp->inp_last_outif = 0; lck_rw_done(pcbinfo->mtx); return (EAGAIN); } lck_rw_done(pcbinfo->mtx); + sflt_notify(so, sock_evt_bound, NULL); return (0); } @@ -462,16 +623,18 @@ in_pcbbind(inp, nam, p) * slightly different version for T/TCP. (This is more than * a bit of a kludge, but cleaning up the internal interfaces would * have forced minor changes in every protocol). + * + * Returns: 0 Success + * EINVAL Invalid argument + * EAFNOSUPPORT Address family not supported + * EADDRNOTAVAIL Address not available */ - int -in_pcbladdr(inp, nam, plocal_sin) - register struct inpcb *inp; - struct sockaddr *nam; - struct sockaddr_in **plocal_sin; +in_pcbladdr(struct inpcb *inp, struct sockaddr *nam, + struct sockaddr_in *plocal_sin, unsigned int *out_ifscope) { struct in_ifaddr *ia; - register struct sockaddr_in *sin = (struct sockaddr_in *)nam; + struct sockaddr_in *sin = (struct sockaddr_in *)nam; if (nam->sa_len != sizeof (*sin)) return (EINVAL); @@ -479,8 +642,10 @@ in_pcbladdr(inp, nam, plocal_sin) return (EAFNOSUPPORT); if (sin->sin_port == 0) return (EADDRNOTAVAIL); - lck_mtx_lock(rt_mtx); + + lck_rw_lock_shared(in_ifaddr_rwlock); if (!TAILQ_EMPTY(&in_ifaddrhead)) { + ia = TAILQ_FIRST(&in_ifaddrhead); /* * If the destination address is INADDR_ANY, * use the primary local address. @@ -491,16 +656,34 @@ in_pcbladdr(inp, nam, plocal_sin) #define satosin(sa) ((struct sockaddr_in *)(sa)) #define sintosa(sin) ((struct sockaddr *)(sin)) #define ifatoia(ifa) ((struct in_ifaddr *)(ifa)) + IFA_LOCK_SPIN(&ia->ia_ifa); if (sin->sin_addr.s_addr == INADDR_ANY) - sin->sin_addr = IA_SIN(TAILQ_FIRST(&in_ifaddrhead))->sin_addr; - else if (sin->sin_addr.s_addr == (u_long)INADDR_BROADCAST && - (TAILQ_FIRST(&in_ifaddrhead)->ia_ifp->if_flags & IFF_BROADCAST)) - sin->sin_addr = satosin(&TAILQ_FIRST(&in_ifaddrhead)->ia_broadaddr)->sin_addr; + sin->sin_addr = IA_SIN(ia)->sin_addr; + else if (sin->sin_addr.s_addr == (u_int32_t)INADDR_BROADCAST && + (ia->ia_ifp->if_flags & IFF_BROADCAST)) + sin->sin_addr = satosin(&ia->ia_broadaddr)->sin_addr; + IFA_UNLOCK(&ia->ia_ifa); + ia = NULL; } - if (inp->inp_laddr.s_addr == INADDR_ANY) { - register struct route *ro; + lck_rw_done(in_ifaddr_rwlock); + if (inp->inp_laddr.s_addr == INADDR_ANY) { + struct route *ro; + unsigned int ifscope = IFSCOPE_NONE; + unsigned int nocell; + /* + * If the socket is bound to a specifc interface, the + * optional scoped takes precedence over that if it + * is set by the caller. + */ ia = (struct in_ifaddr *)0; + + if (out_ifscope != NULL && *out_ifscope != IFSCOPE_NONE) + ifscope = *out_ifscope; + else if (inp->inp_flags & INP_BOUND_IF) + ifscope = inp->inp_boundif; + + nocell = (inp->inp_flags & INP_NO_IFT_CELLULAR) ? 1 : 0; /* * If route is known or can be allocated now, * our src addr is taken from the i/f, else punt. @@ -508,25 +691,43 @@ in_pcbladdr(inp, nam, plocal_sin) * destination, in case of sharing the cache with IPv6. */ ro = &inp->inp_route; - if (ro->ro_rt && - (ro->ro_dst.sa_family != AF_INET || - satosin(&ro->ro_dst)->sin_addr.s_addr != - sin->sin_addr.s_addr || - inp->inp_socket->so_options & SO_DONTROUTE || + if (ro->ro_rt != NULL) + RT_LOCK_SPIN(ro->ro_rt); + if (ro->ro_rt && (ro->ro_dst.sa_family != AF_INET || + satosin(&ro->ro_dst)->sin_addr.s_addr != + sin->sin_addr.s_addr || + inp->inp_socket->so_options & SO_DONTROUTE || ro->ro_rt->generation_id != route_generation)) { - rtfree_locked(ro->ro_rt); - ro->ro_rt = (struct rtentry *)0; + RT_UNLOCK(ro->ro_rt); + rtfree(ro->ro_rt); + ro->ro_rt = NULL; } if ((inp->inp_socket->so_options & SO_DONTROUTE) == 0 && /*XXX*/ - (ro->ro_rt == (struct rtentry *)0 || - ro->ro_rt->rt_ifp == 0)) { + (ro->ro_rt == NULL || ro->ro_rt->rt_ifp == NULL)) { + if (ro->ro_rt != NULL) + RT_UNLOCK(ro->ro_rt); /* No route yet, so try to acquire one */ bzero(&ro->ro_dst, sizeof(struct sockaddr_in)); ro->ro_dst.sa_family = AF_INET; ro->ro_dst.sa_len = sizeof(struct sockaddr_in); ((struct sockaddr_in *) &ro->ro_dst)->sin_addr = sin->sin_addr; - rtalloc_ign_locked(ro, 0UL); + rtalloc_scoped(ro, ifscope); + if (ro->ro_rt != NULL) + RT_LOCK_SPIN(ro->ro_rt); + } + /* + * If the route points to a cellular interface and the + * caller forbids our using interfaces of such type, + * pretend that there is no route. + */ + if (nocell && ro->ro_rt != NULL) { + RT_LOCK_ASSERT_HELD(ro->ro_rt); + if (ro->ro_rt->rt_ifp->if_type == IFT_CELLULAR) { + RT_UNLOCK(ro->ro_rt); + rtfree(ro->ro_rt); + ro->ro_rt = NULL; + } } /* * If we found a route, use the address @@ -534,10 +735,16 @@ in_pcbladdr(inp, nam, plocal_sin) * unless it is the loopback (in case a route * to our address on another net goes to loopback). */ - if (ro->ro_rt && !(ro->ro_rt->rt_ifp->if_flags & IFF_LOOPBACK)) { - ia = ifatoia(ro->ro_rt->rt_ifa); - if (ia) - ifaref(&ia->ia_ifa); + if (ro->ro_rt != NULL) { + /* Become a regular mutex */ + RT_CONVERT_LOCK(ro->ro_rt); + if (!(ro->ro_rt->rt_ifp->if_flags & IFF_LOOPBACK)) { + ia = ifatoia(ro->ro_rt->rt_ifa); + if (ia) { + IFA_ADDREF(&ia->ia_ifa); + } + } + RT_UNLOCK(ro->ro_rt); } if (ia == 0) { u_short fport = sin->sin_port; @@ -545,18 +752,29 @@ in_pcbladdr(inp, nam, plocal_sin) sin->sin_port = 0; ia = ifatoia(ifa_ifwithdstaddr(sintosa(sin))); if (ia == 0) { - ia = ifatoia(ifa_ifwithnet(sintosa(sin))); + ia = ifatoia(ifa_ifwithnet_scoped(sintosa(sin), + ifscope)); } sin->sin_port = fport; if (ia == 0) { + lck_rw_lock_shared(in_ifaddr_rwlock); ia = TAILQ_FIRST(&in_ifaddrhead); if (ia) - ifaref(&ia->ia_ifa); + IFA_ADDREF(&ia->ia_ifa); + lck_rw_done(in_ifaddr_rwlock); } - if (ia == 0) { - lck_mtx_unlock(rt_mtx); - return (EADDRNOTAVAIL); + /* + * If the source address belongs to a cellular interface + * and the socket forbids our using interfaces of such + * type, pretend that there is no source address. + */ + if (nocell && ia != NULL && + ia->ia_ifa.ifa_ifp->if_type == IFT_CELLULAR) { + IFA_REMREF(&ia->ia_ifa); + ia = NULL; } + if (ia == 0) + return (EADDRNOTAVAIL); } /* * If the destination address is multicast and an outgoing @@ -569,29 +787,38 @@ in_pcbladdr(inp, nam, plocal_sin) struct ifnet *ifp; imo = inp->inp_moptions; + IMO_LOCK(imo); if (imo->imo_multicast_ifp != NULL && (ia == NULL || ia->ia_ifp != imo->imo_multicast_ifp)) { ifp = imo->imo_multicast_ifp; if (ia) - ifafree(&ia->ia_ifa); - TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) + IFA_REMREF(&ia->ia_ifa); + lck_rw_lock_shared(in_ifaddr_rwlock); + TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) { if (ia->ia_ifp == ifp) break; + } + if (ia) + IFA_ADDREF(&ia->ia_ifa); + lck_rw_done(in_ifaddr_rwlock); if (ia == 0) { - lck_mtx_unlock(rt_mtx); + IMO_UNLOCK(imo); return (EADDRNOTAVAIL); } - ifaref(ia); } + IMO_UNLOCK(imo); } /* * Don't do pcblookup call here; return interface in plocal_sin * and exit to caller, that will do the lookup. */ - *plocal_sin = &ia->ia_addr; - ifafree(&ia->ia_ifa); + IFA_LOCK_SPIN(&ia->ia_ifa); + *plocal_sin = ia->ia_addr; + if (out_ifscope != NULL) + *out_ifscope = ia->ia_ifp->if_index; + IFA_UNLOCK(&ia->ia_ifa); + IFA_REMREF(&ia->ia_ifa); } - lck_mtx_unlock(rt_mtx); return(0); } @@ -603,12 +830,9 @@ in_pcbladdr(inp, nam, plocal_sin) * then pick one. */ int -in_pcbconnect(inp, nam, p) - register struct inpcb *inp; - struct sockaddr *nam; - struct proc *p; +in_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct proc *p, unsigned int *ifscope) { - struct sockaddr_in *ifaddr; + struct sockaddr_in ifaddr; struct sockaddr_in *sin = (struct sockaddr_in *)nam; struct inpcb *pcb; int error; @@ -616,16 +840,25 @@ in_pcbconnect(inp, nam, p) /* * Call inner routine, to assign local interface address. */ - if ((error = in_pcbladdr(inp, nam, &ifaddr)) != 0) + if ((error = in_pcbladdr(inp, nam, &ifaddr, ifscope)) != 0) return(error); socket_unlock(inp->inp_socket, 0); pcb = in_pcblookup_hash(inp->inp_pcbinfo, sin->sin_addr, sin->sin_port, - inp->inp_laddr.s_addr ? inp->inp_laddr : ifaddr->sin_addr, + inp->inp_laddr.s_addr ? inp->inp_laddr : ifaddr.sin_addr, inp->inp_lport, 0, NULL); socket_lock(inp->inp_socket, 0); + + /* Check if the socket is still in a valid state. When we unlock this + * embryonic socket, it can get aborted if another thread is closing + * the listener (radar 7947600). + */ + if ((inp->inp_socket->so_flags & SOF_ABORTED) != 0) { + return ECONNREFUSED; + } + if (pcb != NULL) { - in_pcb_checkstate(pcb, WNT_RELEASE, 0); + in_pcb_checkstate(pcb, WNT_RELEASE, pcb == inp ? 1 : 0); return (EADDRINUSE); } if (inp->inp_laddr.s_addr == INADDR_ANY) { @@ -640,7 +873,8 @@ in_pcbconnect(inp, nam, p) lck_rw_lock_exclusive(inp->inp_pcbinfo->mtx); socket_lock(inp->inp_socket, 0); } - inp->inp_laddr = ifaddr->sin_addr; + inp->inp_laddr = ifaddr.sin_addr; + inp->inp_last_outif = ifscope ? *ifscope : IFSCOPE_NONE; inp->inp_flags |= INP_INADDR_ANY; } else { @@ -659,8 +893,7 @@ in_pcbconnect(inp, nam, p) } void -in_pcbdisconnect(inp) - struct inpcb *inp; +in_pcbdisconnect(struct inpcb *inp) { inp->inp_faddr.s_addr = INADDR_ANY; @@ -681,28 +914,24 @@ in_pcbdisconnect(inp) } void -in_pcbdetach(inp) - struct inpcb *inp; +in_pcbdetach(struct inpcb *inp) { struct socket *so = inp->inp_socket; - struct rtentry *rt = inp->inp_route.ro_rt; if (so->so_pcb == 0) { /* we've been called twice */ - panic("in_pcbdetach: inp=%x so=%x proto=%x so_pcb is null!\n", + panic("in_pcbdetach: inp=%p so=%p proto=%d so_pcb is null!\n", inp, so, so->so_proto->pr_protocol); } #if IPSEC if (ipsec_bypass == 0) { - lck_mtx_lock(sadb_mutex); ipsec4_delete_pcbpolicy(inp); - lck_mtx_unlock(sadb_mutex); } #endif /*IPSEC*/ /* mark socket state as dead */ if (in_pcb_checkstate(inp, WNT_STOPUSING, 1) != WNT_STOPUSING) - panic("in_pcbdetach so=%x prot=%x couldn't set to STOPUSING\n", so, so->so_proto->pr_protocol); + panic("in_pcbdetach so=%p prot=%x couldn't set to STOPUSING\n", so, so->so_proto->pr_protocol); #if TEMPDEBUG if (so->cached_in_sock_layer) @@ -711,31 +940,20 @@ in_pcbdetach(inp) printf("in_pcbdetach for allocated socket %x flags=%x\n", so, so->so_flags); #endif if ((so->so_flags & SOF_PCBCLEARING) == 0) { + struct rtentry *rt; + struct ip_moptions *imo; + inp->inp_vflag = 0; if (inp->inp_options) (void)m_free(inp->inp_options); - if (rt) { - /* - * route deletion requires reference count to be <= zero - */ - lck_mtx_lock(rt_mtx); - if ((rt->rt_flags & RTF_DELCLONE) && - (rt->rt_flags & RTF_WASCLONED) && - (rt->rt_refcnt <= 1)) { - rtunref(rt); - rt->rt_flags &= ~RTF_UP; - rtrequest_locked(RTM_DELETE, rt_key(rt), - rt->rt_gateway, rt_mask(rt), - rt->rt_flags, (struct rtentry **)0); - } - else { - rtfree_locked(rt); - inp->inp_route.ro_rt = 0; - } - lck_mtx_unlock(rt_mtx); + if ((rt = inp->inp_route.ro_rt) != NULL) { + inp->inp_route.ro_rt = NULL; + rtfree(rt); } - ip_freemoptions(inp->inp_moptions); + imo = inp->inp_moptions; inp->inp_moptions = NULL; + if (imo != NULL) + IMO_REMREF(imo); sofreelastref(so, 0); inp->inp_state = INPCB_STATE_DEAD; so->so_flags |= SOF_PCBCLEARING; /* makes sure we're not called twice from so_close */ @@ -744,21 +962,22 @@ in_pcbdetach(inp) void -in_pcbdispose(inp) - struct inpcb *inp; +in_pcbdispose(struct inpcb *inp) { struct socket *so = inp->inp_socket; struct inpcbinfo *ipi = inp->inp_pcbinfo; #if TEMPDEBUG if (inp->inp_state != INPCB_STATE_DEAD) { - printf("in_pcbdispose: not dead yet? so=%x\n", so); + printf("in_pcbdispose: not dead yet? so=%p\n", so); } #endif - if (so && so->so_usecount != 0) - panic("in_pcbdispose: use count=%x so=%x\n", so->so_usecount, so); + panic("%s: so %p so_usecount %d so_lockhistory %s\n", + __func__, so, so->so_usecount, + (so != NULL) ? solockhistory_nr(so) : "--"); + lck_rw_assert(ipi->mtx, LCK_RW_ASSERT_EXCLUSIVE); inp->inp_gencnt = ++ipi->ipi_gencnt; /*### access ipi in in_pcbremlists */ @@ -769,22 +988,33 @@ in_pcbdispose(inp) sofreelastref(so, 0); if (so->so_rcv.sb_cc || so->so_snd.sb_cc) { #if TEMPDEBUG - printf("in_pcbdispose sb not cleaned up so=%x rc_cci=%x snd_cc=%x\n", + printf("in_pcbdispose sb not cleaned up so=%p rc_cci=%x snd_cc=%x\n", so, so->so_rcv.sb_cc, so->so_snd.sb_cc); #endif sbrelease(&so->so_rcv); sbrelease(&so->so_snd); } if (so->so_head != NULL) - panic("in_pcbdispose, so=%x head still exist\n", so); - lck_mtx_unlock(inp->inpcb_mtx); - lck_mtx_free(inp->inpcb_mtx, ipi->mtx_grp); + panic("in_pcbdispose, so=%p head still exist\n", so); + lck_mtx_unlock(&inp->inpcb_mtx); + lck_mtx_destroy(&inp->inpcb_mtx, ipi->mtx_grp); } so->so_flags |= SOF_PCBCLEARING; /* makes sure we're not called twice from so_close */ - so->so_saved_pcb = (caddr_t) inp; + so->so_saved_pcb = (caddr_t) inp; so->so_pcb = 0; inp->inp_socket = 0; - inp->reserved[0] = so; +#if CONFIG_MACF_NET + mac_inpcb_label_destroy(inp); +#endif + /* + * In case there a route cached after a detach (possible + * in the tcp case), make sure that it is freed before + * we deallocate the structure. + */ + if (inp->inp_route.ro_rt != NULL) { + rtfree(inp->inp_route.ro_rt); + inp->inp_route.ro_rt = NULL; + } if (so->cached_in_sock_layer == 0) { zfree(ipi->ipi_zone, inp); } @@ -792,7 +1022,7 @@ in_pcbdispose(inp) } #if TEMPDEBUG else - printf("in_pcbdispose: no socket for inp=%x\n", inp); + printf("in_pcbdispose: no socket for inp=%p\n", inp); #endif } @@ -805,14 +1035,16 @@ in_pcbdispose(inp) * except through a kernel programming error, so it is acceptable to panic * (or in this case trap) if the PCB is invalid. (Actually, we don't trap * because there actually /is/ a programming error somewhere... XXX) + * + * Returns: 0 Success + * ENOBUFS No buffer space available + * ECONNRESET Connection reset */ int -in_setsockaddr(so, nam) - struct socket *so; - struct sockaddr **nam; +in_setsockaddr(struct socket *so, struct sockaddr **nam) { - register struct inpcb *inp; - register struct sockaddr_in *sin; + struct inpcb *inp; + struct sockaddr_in *sin; /* * Do the malloc first in case it blocks. @@ -837,12 +1069,10 @@ in_setsockaddr(so, nam) } int -in_setpeeraddr(so, nam) - struct socket *so; - struct sockaddr **nam; +in_setpeeraddr(struct socket *so, struct sockaddr **nam) { struct inpcb *inp; - register struct sockaddr_in *sin; + struct sockaddr_in *sin; /* * Do the malloc first in case it blocks. @@ -867,10 +1097,8 @@ in_setpeeraddr(so, nam) } void -in_pcbnotifyall(pcbinfo, faddr, errno, notify) - struct inpcbinfo *pcbinfo; - struct in_addr faddr; - void (*notify) (struct inpcb *, int); +in_pcbnotifyall(struct inpcbinfo *pcbinfo, struct in_addr faddr, + int errno, void (*notify)(struct inpcb *, int)) { struct inpcb *inp; @@ -894,44 +1122,6 @@ in_pcbnotifyall(pcbinfo, faddr, errno, notify) lck_rw_done(pcbinfo->mtx); } -void -in_pcbpurgeif0( - struct inpcb *head, - struct ifnet *ifp) -{ - struct inpcb *inp; - struct ip_moptions *imo; - int i, gap; - - for (inp = head; inp != NULL; inp = LIST_NEXT(inp, inp_list)) { - imo = inp->inp_moptions; - if ((inp->inp_vflag & INP_IPV4) && - imo != NULL) { - /* - * Unselect the outgoing interface if it is being - * detached. - */ - if (imo->imo_multicast_ifp == ifp) - imo->imo_multicast_ifp = NULL; - - /* - * Drop multicast group membership if we joined - * through the interface being detached. - */ - for (i = 0, gap = 0; i < imo->imo_num_memberships; - i++) { - if (imo->imo_membership[i]->inm_ifp == ifp) { - in_delmulti(&imo->imo_membership[i]); - gap++; - } else if (gap != 0) - imo->imo_membership[i - gap] = - imo->imo_membership[i]; - } - imo->imo_num_memberships -= gap; - } - } -} - /* * Check for alternatives when higher level complains * about service problems. For now, invalidate cached @@ -939,27 +1129,41 @@ in_pcbpurgeif0( * (by a redirect), time to try a default gateway again. */ void -in_losing(inp) - struct inpcb *inp; +in_losing(struct inpcb *inp) { - register struct rtentry *rt; + struct rtentry *rt; struct rt_addrinfo info; - if ((rt = inp->inp_route.ro_rt)) { - lck_mtx_lock(rt_mtx); + if ((rt = inp->inp_route.ro_rt) != NULL) { + struct in_ifaddr *ia; + bzero((caddr_t)&info, sizeof(info)); + RT_LOCK(rt); info.rti_info[RTAX_DST] = (struct sockaddr *)&inp->inp_route.ro_dst; info.rti_info[RTAX_GATEWAY] = rt->rt_gateway; info.rti_info[RTAX_NETMASK] = rt_mask(rt); rt_missmsg(RTM_LOSING, &info, rt->rt_flags, 0); - if (rt->rt_flags & RTF_DYNAMIC) - (void) rtrequest_locked(RTM_DELETE, rt_key(rt), + if (rt->rt_flags & RTF_DYNAMIC) { + /* + * Prevent another thread from modifying rt_key, + * rt_gateway via rt_setgate() after rt_lock is + * dropped by marking the route as defunct. + */ + rt->rt_flags |= RTF_CONDEMNED; + RT_UNLOCK(rt); + (void) rtrequest(RTM_DELETE, rt_key(rt), rt->rt_gateway, rt_mask(rt), rt->rt_flags, (struct rtentry **)0); - inp->inp_route.ro_rt = 0; - rtfree_locked(rt); - lck_mtx_unlock(rt_mtx); + } else { + RT_UNLOCK(rt); + } + /* if the address is gone keep the old route in the pcb */ + if ((ia = ifa_foraddr(inp->inp_laddr.s_addr)) != NULL) { + inp->inp_route.ro_rt = NULL; + rtfree(rt); + IFA_REMREF(&ia->ia_ifa); + } /* * A new route can be allocated * the next time output is attempted. @@ -972,15 +1176,19 @@ in_losing(inp) * and allocate a (hopefully) better one. */ void -in_rtchange(inp, errno) - register struct inpcb *inp; - int errno; +in_rtchange(struct inpcb *inp, __unused int errno) { - if (inp->inp_route.ro_rt) { - if ((ifa_foraddr(inp->inp_laddr.s_addr)) == 0) + struct rtentry *rt; + + if ((rt = inp->inp_route.ro_rt) != NULL) { + struct in_ifaddr *ia; + + if ((ia = ifa_foraddr(inp->inp_laddr.s_addr)) == NULL) { return; /* we can't remove the route now. not sure if still ok to use src */ - rtfree(inp->inp_route.ro_rt); - inp->inp_route.ro_rt = 0; + } + IFA_REMREF(&ia->ia_ifa); + rtfree(rt); + inp->inp_route.ro_rt = NULL; /* * A new route can be allocated the next time * output is attempted. @@ -992,13 +1200,10 @@ in_rtchange(inp, errno) * Lookup a PCB based on the local address and port. */ struct inpcb * -in_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay) - struct inpcbinfo *pcbinfo; - struct in_addr laddr; - u_int lport_arg; - int wild_okay; +in_pcblookup_local(struct inpcbinfo *pcbinfo, struct in_addr laddr, + unsigned int lport_arg, int wild_okay) { - register struct inpcb *inp; + struct inpcb *inp; int matchwild = 3, wildcard; u_short lport = lport_arg; @@ -1082,6 +1287,131 @@ in_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay) } } +/* + * Check if PCB exists in hash list. + */ +int +in_pcblookup_hash_exists( + struct inpcbinfo *pcbinfo, + struct in_addr faddr, + u_int fport_arg, + struct in_addr laddr, + u_int lport_arg, + int wildcard, + uid_t *uid, + gid_t *gid, + __unused struct ifnet *ifp) +{ + struct inpcbhead *head; + struct inpcb *inp; + u_short fport = fport_arg, lport = lport_arg; + int found; + + *uid = UID_MAX; + *gid = GID_MAX; + + /* + * We may have found the pcb in the last lookup - check this first. + */ + + lck_rw_lock_shared(pcbinfo->mtx); + + /* + * First look for an exact match. + */ + head = &pcbinfo->hashbase[INP_PCBHASH(faddr.s_addr, lport, fport, + pcbinfo->hashmask)]; + LIST_FOREACH(inp, head, inp_hash) { +#if INET6 + if ((inp->inp_vflag & INP_IPV4) == 0) + continue; +#endif + if (inp->inp_faddr.s_addr == faddr.s_addr && + inp->inp_laddr.s_addr == laddr.s_addr && + inp->inp_fport == fport && + inp->inp_lport == lport) { + if ((found = (inp->inp_socket != NULL))) { + /* + * Found. + */ + *uid = inp->inp_socket->so_uid; + *gid = inp->inp_socket->so_gid; + } + lck_rw_done(pcbinfo->mtx); + return (found); + } + } + if (wildcard) { + struct inpcb *local_wild = NULL; +#if INET6 + struct inpcb *local_wild_mapped = NULL; +#endif + + head = &pcbinfo->hashbase[INP_PCBHASH(INADDR_ANY, lport, 0, + pcbinfo->hashmask)]; + LIST_FOREACH(inp, head, inp_hash) { +#if INET6 + if ((inp->inp_vflag & INP_IPV4) == 0) + continue; +#endif + if (inp->inp_faddr.s_addr == INADDR_ANY && + inp->inp_lport == lport) { +#if defined(NFAITH) && NFAITH > 0 + if (ifp && ifp->if_type == IFT_FAITH && + (inp->inp_flags & INP_FAITH) == 0) + continue; +#endif + if (inp->inp_laddr.s_addr == laddr.s_addr) { + if ((found = (inp->inp_socket != NULL))) { + *uid = inp->inp_socket->so_uid; + *gid = inp->inp_socket->so_gid; + } + lck_rw_done(pcbinfo->mtx); + return (found); + } + else if (inp->inp_laddr.s_addr == INADDR_ANY) { +#if INET6 + if (inp->inp_socket && + INP_CHECK_SOCKAF(inp->inp_socket, + AF_INET6)) + local_wild_mapped = inp; + else +#endif /* INET6 */ + local_wild = inp; + } + } + } + if (local_wild == NULL) { +#if INET6 + if (local_wild_mapped != NULL) { + if ((found = (local_wild_mapped->inp_socket != NULL))) { + *uid = local_wild_mapped->inp_socket->so_uid; + *gid = local_wild_mapped->inp_socket->so_gid; + } + lck_rw_done(pcbinfo->mtx); + return (found); + } +#endif /* INET6 */ + lck_rw_done(pcbinfo->mtx); + return (0); + } + if (local_wild != NULL) { + if ((found = (local_wild->inp_socket != NULL))) { + *uid = local_wild->inp_socket->so_uid; + *gid = local_wild->inp_socket->so_gid; + } + lck_rw_done(pcbinfo->mtx); + return (found); + } + } + + /* + * Not found. + */ + lck_rw_done(pcbinfo->mtx); + return (0); +} + /* * Lookup PCB in hash list. */ @@ -1093,10 +1423,10 @@ in_pcblookup_hash( struct in_addr laddr, u_int lport_arg, int wildcard, - struct ifnet *ifp) + __unused struct ifnet *ifp) { struct inpcbhead *head; - register struct inpcb *inp; + struct inpcb *inp; u_short fport = fport_arg, lport = lport_arg; /* @@ -1161,18 +1491,18 @@ in_pcblookup_hash( } } else if (inp->inp_laddr.s_addr == INADDR_ANY) { -#if defined(INET6) +#if INET6 if (INP_CHECK_SOCKAF(inp->inp_socket, AF_INET6)) local_wild_mapped = inp; else -#endif /* defined(INET6) */ +#endif /* INET6 */ local_wild = inp; } } } -#if defined(INET6) if (local_wild == NULL) { +#if INET6 if (local_wild_mapped != NULL) { if (in_pcb_checkstate(local_wild_mapped, WNT_ACQUIRE, 0) != WNT_STOPUSING) { lck_rw_done(pcbinfo->mtx); @@ -1183,10 +1513,10 @@ in_pcblookup_hash( return(NULL); } } +#endif /* INET6 */ lck_rw_done(pcbinfo->mtx); return (NULL); } -#endif /* defined(INET6) */ if (in_pcb_checkstate(local_wild, WNT_ACQUIRE, 0) != WNT_STOPUSING) { lck_rw_done(pcbinfo->mtx); return (local_wild); @@ -1208,9 +1538,7 @@ in_pcblookup_hash( * Insert PCB onto various hash lists. */ int -in_pcbinshash(inp, locked) - struct inpcb *inp; - int locked; /* list already locked exclusive */ +in_pcbinshash(struct inpcb *inp, int locked) { struct inpcbhead *pcbhash; struct inpcbporthead *pcbporthash; @@ -1218,6 +1546,20 @@ in_pcbinshash(inp, locked) struct inpcbport *phd; u_int32_t hashkey_faddr; + if (!locked) { + if (!lck_rw_try_lock_exclusive(pcbinfo->mtx)) { + /*lock inversion issue, mostly with udp multicast packets */ + socket_unlock(inp->inp_socket, 0); + lck_rw_lock_exclusive(pcbinfo->mtx); + socket_lock(inp->inp_socket, 0); + if (inp->inp_state == INPCB_STATE_DEAD) { + /* The socket got dropped when it was unlocked */ + lck_rw_done(pcbinfo->mtx); + return(ECONNABORTED); + } + } + } + #if INET6 if (inp->inp_vflag & INP_IPV6) hashkey_faddr = inp->in6p_faddr.s6_addr32[3] /* XXX */; @@ -1227,15 +1569,6 @@ in_pcbinshash(inp, locked) inp->hash_element = INP_PCBHASH(hashkey_faddr, inp->inp_lport, inp->inp_fport, pcbinfo->hashmask); - if (!locked) { - if (!lck_rw_try_lock_exclusive(pcbinfo->mtx)) { - /*lock inversion issue, mostly with udp multicast packets */ - socket_unlock(inp->inp_socket, 0); - lck_rw_lock_exclusive(pcbinfo->mtx); - socket_lock(inp->inp_socket, 0); - } - } - pcbhash = &pcbinfo->hashbase[inp->hash_element]; pcbporthash = &pcbinfo->porthashbase[INP_PCBPORTHASH(inp->inp_lport, @@ -1277,8 +1610,7 @@ in_pcbinshash(inp, locked) * not change after in_pcbinshash() has been called. */ void -in_pcbrehash(inp) - struct inpcb *inp; +in_pcbrehash(struct inpcb *inp) { struct inpcbhead *head; u_int32_t hashkey_faddr; @@ -1302,8 +1634,7 @@ in_pcbrehash(inp) */ //###LOCK must be called with list lock held void -in_pcbremlists(inp) - struct inpcb *inp; +in_pcbremlists(struct inpcb *inp) { inp->inp_gencnt = ++inp->inp_pcbinfo->ipi_gencnt; @@ -1321,371 +1652,6 @@ in_pcbremlists(inp) inp->inp_pcbinfo->ipi_count--; } -static void in_pcb_detach_port( struct inpcb *inp); -int -in_pcb_grab_port (struct inpcbinfo *pcbinfo, - u_short options, - struct in_addr laddr, - u_short *lport, - struct in_addr faddr, - u_short fport, - u_int cookie, - u_char owner_id) -{ - struct inpcb *inp, *pcb; - struct sockaddr_in sin; - struct proc *p = current_proc(); - int stat; - - - pcbinfo->nat_dummy_socket.so_pcb = 0; - pcbinfo->nat_dummy_socket.so_options = 0; - if (*lport) { - /* The grabber wants a particular port */ - - if (faddr.s_addr || fport) { - /* - * This is either the second half of an active connect, or - * it's from the acceptance of an incoming connection. - */ - if (laddr.s_addr == 0) { - pcbinfo->nat_dummy_socket.so_pcb = (caddr_t)pcbinfo->nat_dummy_pcb; - return EINVAL; - } - - inp = in_pcblookup_hash(pcbinfo, faddr, fport, laddr, *lport, 0, NULL); - if (inp) { - /* pcb was found, its count was upped. need to decrease it here */ - in_pcb_checkstate(inp, WNT_RELEASE, 0); - if (!(IN_MULTICAST(ntohl(laddr.s_addr)))) { - pcbinfo->nat_dummy_socket.so_pcb = (caddr_t)pcbinfo->nat_dummy_pcb; - return (EADDRINUSE); - } - } - - stat = in_pcballoc(&pcbinfo->nat_dummy_socket, pcbinfo, p); - if (stat) { - pcbinfo->nat_dummy_socket.so_pcb = (caddr_t)pcbinfo->nat_dummy_pcb; - return stat; - } - pcb = sotoinpcb(&pcbinfo->nat_dummy_socket); - pcb->inp_vflag |= INP_IPV4; - - pcb->inp_lport = *lport; - pcb->inp_laddr.s_addr = laddr.s_addr; - - pcb->inp_faddr = faddr; - pcb->inp_fport = fport; - - lck_rw_lock_exclusive(pcbinfo->mtx); - in_pcbinshash(pcb, 1); - lck_rw_done(pcbinfo->mtx); - } - else { - /* - * This is either a bind for a passive socket, or it's the - * first part of bind-connect sequence (not likely since an - * ephemeral port is usually used in this case). Or, it's - * the result of a connection acceptance when the foreign - * address/port cannot be provided (which requires the SO_REUSEADDR - * flag if laddr is not multicast). - */ - - stat = in_pcballoc(&pcbinfo->nat_dummy_socket, pcbinfo, p); - if (stat) { - pcbinfo->nat_dummy_socket.so_pcb = (caddr_t)pcbinfo->nat_dummy_pcb; - return stat; - } - pcb = sotoinpcb(&pcbinfo->nat_dummy_socket); - pcb->inp_vflag |= INP_IPV4; - - pcbinfo->nat_dummy_socket.so_options = options; - bzero(&sin, sizeof(struct sockaddr_in)); - sin.sin_len = sizeof(struct sockaddr_in); - sin.sin_family = AF_INET; - sin.sin_addr.s_addr = laddr.s_addr; - sin.sin_port = *lport; - - socket_lock(&pcbinfo->nat_dummy_socket, 1); - stat = in_pcbbind((struct inpcb *) pcbinfo->nat_dummy_socket.so_pcb, - (struct sockaddr *) &sin, p); - if (stat) { - socket_unlock(&pcbinfo->nat_dummy_socket, 1); /*detach first */ - in_pcb_detach_port(pcb); /* will restore dummy pcb */ - return stat; - } - socket_unlock(&pcbinfo->nat_dummy_socket, 1); - } - } - else { - /* The grabber wants an ephemeral port */ - - stat = in_pcballoc(&pcbinfo->nat_dummy_socket, pcbinfo, p); - if (stat) { - pcbinfo->nat_dummy_socket.so_pcb = (caddr_t)pcbinfo->nat_dummy_pcb; - return stat; - } - pcb = sotoinpcb(&pcbinfo->nat_dummy_socket); - pcb->inp_vflag |= INP_IPV4; - - bzero(&sin, sizeof(struct sockaddr_in)); - sin.sin_len = sizeof(struct sockaddr_in); - sin.sin_family = AF_INET; - sin.sin_addr.s_addr = laddr.s_addr; - sin.sin_port = 0; - - if (faddr.s_addr || fport) { - /* - * Not sure if this case will be used - could occur when connect - * is called, skipping the bind. - */ - - if (laddr.s_addr == 0) { - in_pcb_detach_port(pcb); /* restores dummy pcb */ - return EINVAL; - } - - socket_lock(&pcbinfo->nat_dummy_socket, 1); - stat = in_pcbbind((struct inpcb *) pcbinfo->nat_dummy_socket.so_pcb, - (struct sockaddr *) &sin, p); - if (stat) { - socket_unlock(&pcbinfo->nat_dummy_socket, 1); - in_pcb_detach_port(pcb); /* restores dummy pcb */ - return stat; - } - - socket_unlock(&pcbinfo->nat_dummy_socket, 1); - inp = in_pcblookup_hash(pcbinfo, faddr, fport, - pcb->inp_laddr, pcb->inp_lport, 0, NULL); - if (inp) { - /* pcb was found, its count was upped. need to decrease it here */ - in_pcb_checkstate(inp, WNT_RELEASE, 0); - in_pcb_detach_port(pcb); - return (EADDRINUSE); - } - - lck_rw_lock_exclusive(pcbinfo->mtx); - pcb->inp_faddr = faddr; - pcb->inp_fport = fport; - in_pcbrehash(pcb); - lck_rw_done(pcbinfo->mtx); - } - else { - /* - * This is a simple bind of an ephemeral port. The local addr - * may or may not be defined. - */ - - socket_lock(&pcbinfo->nat_dummy_socket, 1); - stat = in_pcbbind((struct inpcb *) pcbinfo->nat_dummy_socket.so_pcb, - (struct sockaddr *) &sin, p); - if (stat) { - socket_unlock(&pcbinfo->nat_dummy_socket, 1); - in_pcb_detach_port(pcb); - return stat; - } - socket_unlock(&pcbinfo->nat_dummy_socket, 1); - } - *lport = pcb->inp_lport; - } - - - pcb->nat_owner = owner_id; - pcb->nat_cookie = cookie; - pcb->inp_ppcb = (caddr_t) pcbinfo->dummy_cb; - pcbinfo->nat_dummy_socket.so_pcb = (caddr_t)pcbinfo->nat_dummy_pcb; /* restores dummypcb */ - return 0; -} - -/* 3962035 - in_pcb_letgo_port needs a special case function for detaching */ -static void -in_pcb_detach_port( - struct inpcb *inp) -{ - struct socket *so = inp->inp_socket; - struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; - - if (so != &pcbinfo->nat_dummy_socket) - panic("in_pcb_detach_port: not a dummy_sock: so=%x, inp=%x\n", so, inp); - inp->inp_gencnt = ++pcbinfo->ipi_gencnt; - /*### access ipi in in_pcbremlists */ - in_pcbremlists(inp); - - inp->inp_socket = 0; - inp->reserved[0] = so; - zfree(pcbinfo->ipi_zone, inp); - pcbinfo->nat_dummy_socket.so_pcb = (caddr_t)pcbinfo->nat_dummy_pcb; /* restores dummypcb */ -} - -int -in_pcb_letgo_port(struct inpcbinfo *pcbinfo, struct in_addr laddr, u_short lport, - struct in_addr faddr, u_short fport, u_char owner_id) -{ - struct inpcbhead *head; - register struct inpcb *inp; - - - /* - * First look for an exact match. - */ - - lck_rw_lock_exclusive(pcbinfo->mtx); - head = &pcbinfo->hashbase[INP_PCBHASH(faddr.s_addr, lport, fport, pcbinfo->hashmask)]; - for (inp = head->lh_first; inp != NULL; inp = inp->inp_hash.le_next) { - if (inp->inp_faddr.s_addr == faddr.s_addr && - inp->inp_laddr.s_addr == laddr.s_addr && - inp->inp_fport == fport && - inp->inp_lport == lport && - inp->nat_owner == owner_id) { - /* - * Found. - */ - in_pcb_detach_port(inp); - lck_rw_done(pcbinfo->mtx); - return 0; - } - } - - lck_rw_done(pcbinfo->mtx); - return ENOENT; -} - -u_char -in_pcb_get_owner(struct inpcbinfo *pcbinfo, - struct in_addr laddr, u_short lport, - struct in_addr faddr, u_short fport, - u_int *cookie) - -{ - struct inpcb *inp; - u_char owner_id = INPCB_NO_OWNER; - struct inpcbport *phd; - struct inpcbporthead *porthash; - - - if (IN_MULTICAST(laddr.s_addr)) { - /* - * Walk through PCB's looking for registered - * owners. - */ - - lck_rw_lock_shared(pcbinfo->mtx); - porthash = &pcbinfo->porthashbase[INP_PCBPORTHASH(lport, - pcbinfo->porthashmask)]; - for (phd = porthash->lh_first; phd != NULL; phd = phd->phd_hash.le_next) { - if (phd->phd_port == lport) - break; - } - - if (phd == 0) { - lck_rw_done(pcbinfo->mtx); - return INPCB_NO_OWNER; - } - - owner_id = INPCB_NO_OWNER; - for (inp = phd->phd_pcblist.lh_first; inp != NULL; - inp = inp->inp_portlist.le_next) { - - if (inp->inp_laddr.s_addr == laddr.s_addr) { - if (inp->nat_owner == 0) - owner_id |= INPCB_OWNED_BY_X; - else - owner_id |= inp->nat_owner; - } - } - - lck_rw_done(pcbinfo->mtx); - return owner_id; - } - else { - inp = in_pcblookup_hash(pcbinfo, faddr, fport, - laddr, lport, 1, NULL); - if (inp) { - /* pcb was found, its count was upped. need to decrease it here */ - /* if we found it, that pcb is already locked by the caller */ - if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) - return(INPCB_NO_OWNER); - - if (inp->nat_owner) { - owner_id = inp->nat_owner; - *cookie = inp->nat_cookie; - } - else { - owner_id = INPCB_OWNED_BY_X; - } - } - else - owner_id = INPCB_NO_OWNER; - - return owner_id; - } -} - -int -in_pcb_new_share_client(struct inpcbinfo *pcbinfo, u_char *owner_id) -{ - - int i; - - - for (i=0; i < INPCB_MAX_IDS; i++) { - if ((pcbinfo->all_owners & (1 << i)) == 0) { - pcbinfo->all_owners |= (1 << i); - *owner_id = (1 << i); - return 0; - } - } - - return ENOSPC; -} - -int -in_pcb_rem_share_client(struct inpcbinfo *pcbinfo, u_char owner_id) -{ - struct inpcb *inp; - - - lck_rw_lock_exclusive(pcbinfo->mtx); - if (pcbinfo->all_owners & owner_id) { - pcbinfo->all_owners &= ~owner_id; - for (inp = pcbinfo->listhead->lh_first; inp != NULL; inp = inp->inp_list.le_next) { - if (inp->nat_owner & owner_id) { - if (inp->nat_owner == owner_id) - /* - * Deallocate the pcb - */ - in_pcb_detach_port(inp); - else - inp->nat_owner &= ~owner_id; - } - } - } - else { - lck_rw_done(pcbinfo->mtx); - return ENOENT; - } - - lck_rw_done(pcbinfo->mtx); - return 0; -} - - - -void in_pcb_nat_init(struct inpcbinfo *pcbinfo, int afamily, - int pfamily, int protocol) -{ - int stat; - struct proc *p = current_proc(); - - bzero(&pcbinfo->nat_dummy_socket, sizeof(struct socket)); - pcbinfo->nat_dummy_socket.so_proto = pffindproto_locked(afamily, pfamily, protocol); - pcbinfo->all_owners = 0; - stat = in_pcballoc(&pcbinfo->nat_dummy_socket, pcbinfo, p); - if (stat) - panic("in_pcb_nat_init: can't alloc fakepcb err=%\n", stat); - pcbinfo->nat_dummy_pcb = pcbinfo->nat_dummy_socket.so_pcb; -} - /* Mechanism used to defer the memory release of PCBs * The pcb list will contain the pcb until the ripper can clean it up if * the following conditions are met: 1) state "DEAD", 2) wantcnt is STOPUSING @@ -1694,12 +1660,11 @@ void in_pcb_nat_init(struct inpcbinfo *pcbinfo, int afamily, */ int in_pcb_checkstate(struct inpcb *pcb, int mode, int locked) - { volatile UInt32 *wantcnt = (volatile UInt32 *)&pcb->inp_wantcnt; - UInt32 origwant; - UInt32 newwant; + UInt32 origwant; + UInt32 newwant; switch (mode) { @@ -1710,9 +1675,10 @@ in_pcb_checkstate(struct inpcb *pcb, int mode, int locked) if (locked == 0) socket_lock(pcb->inp_socket, 1); pcb->inp_state = INPCB_STATE_DEAD; + stopusing: if (pcb->inp_socket->so_usecount < 0) - panic("in_pcb_checkstate STOP pcb=%x so=%x usecount is negative\n", pcb, pcb->inp_socket); + panic("in_pcb_checkstate STOP pcb=%p so=%p usecount is negative\n", pcb, pcb->inp_socket); if (locked == 0) socket_unlock(pcb->inp_socket, 1); @@ -1721,7 +1687,7 @@ stopusing: return (WNT_STOPUSING); newwant = 0xffff; if ((UInt16) origwant == 0) {/* try to mark it as unsuable now */ - OSCompareAndSwap(origwant, newwant, (UInt32 *) wantcnt) ; + OSCompareAndSwap(origwant, newwant, wantcnt) ; } return (WNT_STOPUSING); break; @@ -1735,11 +1701,11 @@ stopusing: do { origwant = *wantcnt; if ((UInt16) origwant == 0xffff ) {/* should stop using */ -// printf("in_pcb_checkstate: ACQ PCB was STOPUSING while release. odd pcb=%x\n", pcb); +// printf("in_pcb_checkstate: ACQ PCB was STOPUSING while release. odd pcb=%p\n", pcb); return (WNT_STOPUSING); } newwant = origwant + 1; - } while (!OSCompareAndSwap(origwant, newwant, (UInt32 *) wantcnt)); + } while (!OSCompareAndSwap(origwant, newwant, wantcnt)); return (WNT_ACQUIRE); break; @@ -1753,22 +1719,22 @@ stopusing: do { origwant = *wantcnt; if ((UInt16) origwant == 0x0 ) - panic("in_pcb_checkstate pcb=%x release with zero count", pcb); + panic("in_pcb_checkstate pcb=%p release with zero count", pcb); if ((UInt16) origwant == 0xffff ) {/* should stop using */ #if TEMPDEBUG - printf("in_pcb_checkstate: REL PCB was STOPUSING while release. odd pcb=%x\n", pcb); + printf("in_pcb_checkstate: REL PCB was STOPUSING while release. odd pcb=%p\n", pcb); #endif if (locked == 0) socket_unlock(pcb->inp_socket, 1); return (WNT_STOPUSING); } newwant = origwant - 1; - } while (!OSCompareAndSwap(origwant, newwant, (UInt32 *) wantcnt)); + } while (!OSCompareAndSwap(origwant, newwant, wantcnt)); if (pcb->inp_state == INPCB_STATE_DEAD) goto stopusing; if (pcb->inp_socket->so_usecount < 0) - panic("in_pcb_checkstate RELEASE pcb=%x so=%x usecount is negative\n", pcb, pcb->inp_socket); + panic("in_pcb_checkstate RELEASE pcb=%p so=%p usecount is negative\n", pcb, pcb->inp_socket); if (locked == 0) socket_unlock(pcb->inp_socket, 1); @@ -1777,7 +1743,7 @@ stopusing: default: - panic("in_pcb_checkstate: so=%x not a valid state =%x\n", pcb->inp_socket, mode); + panic("in_pcb_checkstate: so=%p not a valid state =%x\n", pcb->inp_socket, mode); } /* NOTREACHED */ @@ -1787,8 +1753,7 @@ stopusing: /* * inpcb_to_compat copies specific bits of an inpcb to a inpcb_compat. * The inpcb_compat data structure is passed to user space and must - * not change. We intentionally avoid copying pointers. The socket is - * the one exception, though we probably shouldn't copy that either. + * not change. We intentionally avoid copying pointers. */ void inpcb_to_compat( @@ -1798,7 +1763,6 @@ inpcb_to_compat( bzero(inp_compat, sizeof(*inp_compat)); inp_compat->inp_fport = inp->inp_fport; inp_compat->inp_lport = inp->inp_lport; - inp_compat->inp_socket = inp->inp_socket; inp_compat->nat_owner = inp->nat_owner; inp_compat->nat_cookie = inp->nat_cookie; inp_compat->inp_gencnt = inp->inp_gencnt; @@ -1812,17 +1776,142 @@ inpcb_to_compat( inp_compat->inp_depend4.inp4_ip_tos = inp->inp_depend4.inp4_ip_tos; inp_compat->inp_depend6.inp6_hlim = inp->inp_depend6.inp6_hlim; inp_compat->inp_depend6.inp6_cksum = inp->inp_depend6.inp6_cksum; - inp_compat->inp6_ifindex = inp->inp6_ifindex; + inp_compat->inp_depend6.inp6_ifindex = inp->inp_depend6.inp6_ifindex; inp_compat->inp_depend6.inp6_hops = inp->inp_depend6.inp6_hops; } -#ifndef __APPLE__ -prison_xinpcb(struct proc *p, struct inpcb *inp) +#if !CONFIG_EMBEDDED + +void +inpcb_to_xinpcb64( + struct inpcb *inp, + struct xinpcb64 *xinp) { - if (!p->p_prison) - return (0); - if (ntohl(inp->inp_laddr.s_addr) == p->p_prison->pr_ip) - return (0); - return (1); + xinp->inp_fport = inp->inp_fport; + xinp->inp_lport = inp->inp_lport; + xinp->inp_gencnt = inp->inp_gencnt; + xinp->inp_flags = inp->inp_flags; + xinp->inp_flow = inp->inp_flow; + xinp->inp_vflag = inp->inp_vflag; + xinp->inp_ip_ttl = inp->inp_ip_ttl; + xinp->inp_ip_p = inp->inp_ip_p; + xinp->inp_dependfaddr.inp6_foreign = inp->inp_dependfaddr.inp6_foreign; + xinp->inp_dependladdr.inp6_local = inp->inp_dependladdr.inp6_local; + xinp->inp_depend4.inp4_ip_tos = inp->inp_depend4.inp4_ip_tos; + xinp->inp_depend6.inp6_hlim = inp->inp_depend6.inp6_hlim; + xinp->inp_depend6.inp6_cksum = inp->inp_depend6.inp6_cksum; + xinp->inp_depend6.inp6_ifindex = inp->inp_depend6.inp6_ifindex; + xinp->inp_depend6.inp6_hops = inp->inp_depend6.inp6_hops; +} + +#endif /* !CONFIG_EMBEDDED */ + + +/* + * The following routines implement this scheme: + * + * Callers of ip_output() that intend to cache the route in the inpcb pass + * a local copy of the struct route to ip_output(). Using a local copy of + * the cached route significantly simplifies things as IP no longer has to + * worry about having exclusive access to the passed in struct route, since + * it's defined in the caller's stack; in essence, this allows for a lock- + * less operation when updating the struct route at the IP level and below, + * whenever necessary. The scheme works as follows: + * + * Prior to dropping the socket's lock and calling ip_output(), the caller + * copies the struct route from the inpcb into its stack, and adds a reference + * to the cached route entry, if there was any. The socket's lock is then + * dropped and ip_output() is called with a pointer to the copy of struct + * route defined on the stack (not to the one in the inpcb.) + * + * Upon returning from ip_output(), the caller then acquires the socket's + * lock and synchronizes the cache; if there is no route cached in the inpcb, + * it copies the local copy of struct route (which may or may not contain any + * route) back into the cache; otherwise, if the inpcb has a route cached in + * it, the one in the local copy will be freed, if there's any. Trashing the + * cached route in the inpcb can be avoided because ip_output() is single- + * threaded per-PCB (i.e. multiple transmits on a PCB are always serialized + * by the socket/transport layer.) + */ +void +inp_route_copyout(struct inpcb *inp, struct route *dst) +{ + struct route *src = &inp->inp_route; + + lck_mtx_assert(&inp->inpcb_mtx, LCK_MTX_ASSERT_OWNED); + + /* + * If the route in the PCB is not for IPv4, blow it away; + * this is possible in the case of IPv4-mapped address case. + */ + if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET) { + rtfree(src->ro_rt); + src->ro_rt = NULL; + } + + route_copyout(dst, src, sizeof(*dst)); +} + +void +inp_route_copyin(struct inpcb *inp, struct route *src) +{ + struct route *dst = &inp->inp_route; + + lck_mtx_assert(&inp->inpcb_mtx, LCK_MTX_ASSERT_OWNED); + + /* Minor sanity check */ + if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET) + panic("%s: wrong or corrupted route: %p", __func__, src); + + route_copyin(src, dst, sizeof(*src)); +} + +/* + * Handler for setting IP_FORCE_OUT_IFP/IP_BOUND_IF/IPV6_BOUND_IF socket option. + */ +void +inp_bindif(struct inpcb *inp, unsigned int ifscope) +{ + /* + * A zero interface scope value indicates an "unbind". + * Otherwise, take in whatever value the app desires; + * the app may already know the scope (or force itself + * to such a scope) ahead of time before the interface + * gets attached. It doesn't matter either way; any + * route lookup from this point on will require an + * exact match for the embedded interface scope. + */ + inp->inp_boundif = ifscope; + if (inp->inp_boundif == IFSCOPE_NONE) + inp->inp_flags &= ~INP_BOUND_IF; + else + inp->inp_flags |= INP_BOUND_IF; + + /* Blow away any cached route in the PCB */ + if (inp->inp_route.ro_rt != NULL) { + rtfree(inp->inp_route.ro_rt); + inp->inp_route.ro_rt = NULL; + } +} + +/* + * Handler for setting IP_NO_IFT_CELLULAR/IPV6_NO_IFT_CELLULAR socket option. + */ +int +inp_nocellular(struct inpcb *inp, unsigned int val) +{ + if (val) { + inp->inp_flags |= INP_NO_IFT_CELLULAR; + } else if (inp->inp_flags & INP_NO_IFT_CELLULAR) { + /* once set, it cannot be unset */ + return (EINVAL); + } + + /* Blow away any cached route in the PCB */ + if (inp->inp_route.ro_rt != NULL) { + rtfree(inp->inp_route.ro_rt); + inp->inp_route.ro_rt = NULL; + } + + return (0); } -#endif