xref: /xnu-8792.61.2/bsd/netinet/udp_usrreq.c (revision 42e220869062b56f8d7d0726fd4c88954f87902c)
1 /*
2  * Copyright (c) 2000-2021 Apple Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 /*
29  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
30  *	The Regents of the University of California.  All rights reserved.
31  *
32  * Redistribution and use in source and binary forms, with or without
33  * modification, are permitted provided that the following conditions
34  * are met:
35  * 1. Redistributions of source code must retain the above copyright
36  *    notice, this list of conditions and the following disclaimer.
37  * 2. Redistributions in binary form must reproduce the above copyright
38  *    notice, this list of conditions and the following disclaimer in the
39  *    documentation and/or other materials provided with the distribution.
40  * 3. All advertising materials mentioning features or use of this software
41  *    must display the following acknowledgement:
42  *	This product includes software developed by the University of
43  *	California, Berkeley and its contributors.
44  * 4. Neither the name of the University nor the names of its contributors
45  *    may be used to endorse or promote products derived from this software
46  *    without specific prior written permission.
47  *
48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58  * SUCH DAMAGE.
59  *
60  *	@(#)udp_usrreq.c	8.6 (Berkeley) 5/23/95
61  */
62 
63 #include <sys/param.h>
64 #include <sys/systm.h>
65 #include <sys/kernel.h>
66 #include <sys/malloc.h>
67 #include <sys/mbuf.h>
68 #include <sys/domain.h>
69 #include <sys/protosw.h>
70 #include <sys/socket.h>
71 #include <sys/socketvar.h>
72 #include <sys/sysctl.h>
73 #include <sys/syslog.h>
74 #include <sys/mcache.h>
75 #include <net/ntstat.h>
76 
77 #include <kern/zalloc.h>
78 #include <mach/boolean.h>
79 
80 #include <net/if.h>
81 #include <net/if_types.h>
82 #include <net/route.h>
83 #include <net/dlil.h>
84 #include <net/net_api_stats.h>
85 
86 #include <netinet/in.h>
87 #include <netinet/in_systm.h>
88 #include <netinet/in_tclass.h>
89 #include <netinet/ip.h>
90 #include <netinet/ip6.h>
91 #include <netinet/in_pcb.h>
92 #include <netinet/in_var.h>
93 #include <netinet/ip_var.h>
94 #include <netinet6/in6_pcb.h>
95 #include <netinet6/ip6_var.h>
96 #include <netinet6/udp6_var.h>
97 #include <netinet/ip_icmp.h>
98 #include <netinet/icmp_var.h>
99 #include <netinet/udp.h>
100 #include <netinet/udp_var.h>
101 #include <sys/kdebug.h>
102 
103 #if IPSEC
104 #include <netinet6/ipsec.h>
105 #include <netinet6/esp.h>
106 #include <netkey/key.h>
107 extern int ipsec_bypass;
108 extern int esp_udp_encap_port;
109 #endif /* IPSEC */
110 
111 #if NECP
112 #include <net/necp.h>
113 #endif /* NECP */
114 
115 #if FLOW_DIVERT
116 #include <netinet/flow_divert.h>
117 #endif /* FLOW_DIVERT */
118 
119 #if CONTENT_FILTER
120 #include <net/content_filter.h>
121 #endif /* CONTENT_FILTER */
122 
123 #if SKYWALK
124 #include <skywalk/core/skywalk_var.h>
125 #endif /* SKYWALK */
126 
127 #define DBG_LAYER_IN_BEG        NETDBG_CODE(DBG_NETUDP, 0)
128 #define DBG_LAYER_IN_END        NETDBG_CODE(DBG_NETUDP, 2)
129 #define DBG_LAYER_OUT_BEG       NETDBG_CODE(DBG_NETUDP, 1)
130 #define DBG_LAYER_OUT_END       NETDBG_CODE(DBG_NETUDP, 3)
131 #define DBG_FNC_UDP_INPUT       NETDBG_CODE(DBG_NETUDP, (5 << 8))
132 #define DBG_FNC_UDP_OUTPUT      NETDBG_CODE(DBG_NETUDP, (6 << 8) | 1)
133 
134 /*
135  * UDP protocol implementation.
136  * Per RFC 768, August, 1980.
137  */
138 #ifndef COMPAT_42
139 static int udpcksum = 1;
140 #else
141 static int udpcksum = 0;                /* XXX */
142 #endif
143 SYSCTL_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum,
144     CTLFLAG_RW | CTLFLAG_LOCKED, &udpcksum, 0, "");
145 
146 int udp_log_in_vain = 0;
147 SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_RW | CTLFLAG_LOCKED,
148     &udp_log_in_vain, 0, "Log all incoming UDP packets");
149 
150 static int blackhole = 0;
151 SYSCTL_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_RW | CTLFLAG_LOCKED,
152     &blackhole, 0, "Do not send port unreachables for refused connects");
153 
154 struct inpcbhead udb;           /* from udp_var.h */
155 #define udb6    udb  /* for KAME src sync over BSD*'s */
156 struct inpcbinfo udbinfo;
157 
158 #ifndef UDBHASHSIZE
159 #define UDBHASHSIZE 16
160 #endif
161 
162 /* Garbage collection performed during most recent udp_gc() run */
163 static boolean_t udp_gc_done = FALSE;
164 
165 #define log_in_vain_log(a) { log a; }
166 
167 static int udp_getstat SYSCTL_HANDLER_ARGS;
168 struct  udpstat udpstat;        /* from udp_var.h */
169 SYSCTL_PROC(_net_inet_udp, UDPCTL_STATS, stats,
170     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
171     0, 0, udp_getstat, "S,udpstat",
172     "UDP statistics (struct udpstat, netinet/udp_var.h)");
173 
174 SYSCTL_INT(_net_inet_udp, OID_AUTO, pcbcount,
175     CTLFLAG_RD | CTLFLAG_LOCKED, &udbinfo.ipi_count, 0,
176     "Number of active PCBs");
177 
178 __private_extern__ int udp_use_randomport = 1;
179 SYSCTL_INT(_net_inet_udp, OID_AUTO, randomize_ports,
180     CTLFLAG_RW | CTLFLAG_LOCKED, &udp_use_randomport, 0,
181     "Randomize UDP port numbers");
182 
183 struct udp_in6 {
184 	struct sockaddr_in6     uin6_sin;
185 	u_char                  uin6_init_done : 1;
186 };
187 struct udp_ip6 {
188 	struct ip6_hdr          uip6_ip6;
189 	u_char                  uip6_init_done : 1;
190 };
191 
192 int udp_abort(struct socket *);
193 int udp_attach(struct socket *, int, struct proc *);
194 int udp_bind(struct socket *, struct sockaddr *, struct proc *);
195 int udp_connect(struct socket *, struct sockaddr *, struct proc *);
196 int udp_connectx(struct socket *, struct sockaddr *,
197     struct sockaddr *, struct proc *, uint32_t, sae_associd_t,
198     sae_connid_t *, uint32_t, void *, uint32_t, struct uio *, user_ssize_t *);
199 int udp_detach(struct socket *);
200 int udp_disconnect(struct socket *);
201 int udp_disconnectx(struct socket *, sae_associd_t, sae_connid_t);
202 int udp_send(struct socket *, int, struct mbuf *, struct sockaddr *,
203     struct mbuf *, struct proc *);
204 static void udp_append(struct inpcb *, struct ip *, struct mbuf *, int,
205     struct sockaddr_in *, struct udp_in6 *, struct udp_ip6 *, struct ifnet *);
206 static int udp_input_checksum(struct mbuf *, struct udphdr *, int, int);
207 int udp_output(struct inpcb *, struct mbuf *, struct sockaddr *,
208     struct mbuf *, struct proc *);
209 static void ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip);
210 static void udp_gc(struct inpcbinfo *);
211 static int udp_defunct(struct socket *);
212 
213 struct pr_usrreqs udp_usrreqs = {
214 	.pru_abort =            udp_abort,
215 	.pru_attach =           udp_attach,
216 	.pru_bind =             udp_bind,
217 	.pru_connect =          udp_connect,
218 	.pru_connectx =         udp_connectx,
219 	.pru_control =          in_control,
220 	.pru_detach =           udp_detach,
221 	.pru_disconnect =       udp_disconnect,
222 	.pru_disconnectx =      udp_disconnectx,
223 	.pru_peeraddr =         in_getpeeraddr,
224 	.pru_send =             udp_send,
225 	.pru_shutdown =         udp_shutdown,
226 	.pru_sockaddr =         in_getsockaddr,
227 	.pru_sosend =           sosend,
228 	.pru_soreceive =        soreceive,
229 	.pru_soreceive_list =   soreceive_list,
230 	.pru_defunct =          udp_defunct,
231 };
232 
233 void
udp_init(struct protosw * pp,struct domain * dp)234 udp_init(struct protosw *pp, struct domain *dp)
235 {
236 #pragma unused(dp)
237 	static int udp_initialized = 0;
238 	struct inpcbinfo        *pcbinfo;
239 
240 	VERIFY((pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
241 
242 	if (udp_initialized) {
243 		return;
244 	}
245 	udp_initialized = 1;
246 	uint32_t pool_size = (nmbclusters << MCLSHIFT) >> MBSHIFT;
247 	if (pool_size >= 96) {
248 		/* Improves 10GbE UDP performance. */
249 		udp_recvspace = 786896;
250 	}
251 	LIST_INIT(&udb);
252 	udbinfo.ipi_listhead = &udb;
253 	udbinfo.ipi_hashbase = hashinit(UDBHASHSIZE, M_PCB,
254 	    &udbinfo.ipi_hashmask);
255 	udbinfo.ipi_porthashbase = hashinit(UDBHASHSIZE, M_PCB,
256 	    &udbinfo.ipi_porthashmask);
257 	udbinfo.ipi_zone = zone_create("udpcb", sizeof(struct inpcb), ZC_NONE);
258 
259 	pcbinfo = &udbinfo;
260 	/*
261 	 * allocate lock group and attribute for udp pcb mutexes
262 	 */
263 	pcbinfo->ipi_lock_grp = lck_grp_alloc_init("udppcb",
264 	    LCK_GRP_ATTR_NULL);
265 	lck_attr_setdefault(&pcbinfo->ipi_lock_attr);
266 	lck_rw_init(&pcbinfo->ipi_lock, pcbinfo->ipi_lock_grp,
267 	    &pcbinfo->ipi_lock_attr);
268 
269 	udbinfo.ipi_gc = udp_gc;
270 	in_pcbinfo_attach(&udbinfo);
271 }
272 
273 void
udp_input(struct mbuf * m,int iphlen)274 udp_input(struct mbuf *m, int iphlen)
275 {
276 	struct ip *ip;
277 	struct udphdr *uh;
278 	struct inpcb *inp;
279 	struct mbuf *opts = NULL;
280 	int len, isbroadcast;
281 	struct ip save_ip;
282 	struct sockaddr *append_sa;
283 	struct inpcbinfo *pcbinfo = &udbinfo;
284 	struct sockaddr_in udp_in;
285 	struct ip_moptions *imo = NULL;
286 	int foundmembership = 0, ret = 0;
287 	struct udp_in6 udp_in6;
288 	struct udp_ip6 udp_ip6;
289 	struct ifnet *ifp = m->m_pkthdr.rcvif;
290 	boolean_t cell = IFNET_IS_CELLULAR(ifp);
291 	boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
292 	boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
293 	u_int16_t pf_tag = 0;
294 	boolean_t is_wake_pkt = false;
295 
296 	bzero(&udp_in, sizeof(udp_in));
297 	udp_in.sin_len = sizeof(struct sockaddr_in);
298 	udp_in.sin_family = AF_INET;
299 	bzero(&udp_in6, sizeof(udp_in6));
300 	udp_in6.uin6_sin.sin6_len = sizeof(struct sockaddr_in6);
301 	udp_in6.uin6_sin.sin6_family = AF_INET6;
302 
303 	if (m->m_flags & M_PKTHDR) {
304 		pf_tag = m_pftag(m)->pftag_tag;
305 		if (m->m_pkthdr.pkt_flags & PKTF_WAKE_PKT) {
306 			is_wake_pkt = true;
307 		}
308 	}
309 
310 	udpstat.udps_ipackets++;
311 
312 	KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
313 
314 	/* Expect 32-bit aligned data pointer on strict-align platforms */
315 	MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
316 
317 	m_add_crumb(m, PKT_CRUMB_UDP_INPUT);
318 
319 	/*
320 	 * Strip IP options, if any; should skip this,
321 	 * make available to user, and use on returned packets,
322 	 * but we don't yet have a way to check the checksum
323 	 * with options still present.
324 	 */
325 	if (iphlen > sizeof(struct ip)) {
326 		ip_stripoptions(m);
327 		iphlen = sizeof(struct ip);
328 	}
329 
330 	/*
331 	 * Get IP and UDP header together in first mbuf.
332 	 */
333 	ip = mtod(m, struct ip *);
334 	if (m->m_len < iphlen + sizeof(struct udphdr)) {
335 		m = m_pullup(m, iphlen + sizeof(struct udphdr));
336 		if (m == NULL) {
337 			udpstat.udps_hdrops++;
338 			KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
339 			    0, 0, 0, 0, 0);
340 			return;
341 		}
342 		ip = mtod(m, struct ip *);
343 	}
344 	uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
345 
346 	/* destination port of 0 is illegal, based on RFC768. */
347 	if (uh->uh_dport == 0) {
348 		IF_UDP_STATINC(ifp, port0);
349 		goto bad;
350 	}
351 
352 	KERNEL_DEBUG(DBG_LAYER_IN_BEG, uh->uh_dport, uh->uh_sport,
353 	    ip->ip_src.s_addr, ip->ip_dst.s_addr, uh->uh_ulen);
354 
355 	/*
356 	 * Make mbuf data length reflect UDP length.
357 	 * If not enough data to reflect UDP length, drop.
358 	 */
359 	len = ntohs((u_short)uh->uh_ulen);
360 	if (ip->ip_len != len) {
361 		if (len > ip->ip_len || len < sizeof(struct udphdr)) {
362 			udpstat.udps_badlen++;
363 			IF_UDP_STATINC(ifp, badlength);
364 			goto bad;
365 		}
366 		m_adj(m, len - ip->ip_len);
367 		/* ip->ip_len = len; */
368 	}
369 	/*
370 	 * Save a copy of the IP header in case we want restore it
371 	 * for sending an ICMP error message in response.
372 	 */
373 	save_ip = *ip;
374 
375 	/*
376 	 * Checksum extended UDP header and data.
377 	 */
378 	if (udp_input_checksum(m, uh, iphlen, len)) {
379 		goto bad;
380 	}
381 
382 	isbroadcast = in_broadcast(ip->ip_dst, ifp);
383 
384 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || isbroadcast) {
385 		int reuse_sock = 0, mcast_delivered = 0;
386 
387 		lck_rw_lock_shared(&pcbinfo->ipi_lock);
388 		/*
389 		 * Deliver a multicast or broadcast datagram to *all* sockets
390 		 * for which the local and remote addresses and ports match
391 		 * those of the incoming datagram.  This allows more than
392 		 * one process to receive multi/broadcasts on the same port.
393 		 * (This really ought to be done for unicast datagrams as
394 		 * well, but that would cause problems with existing
395 		 * applications that open both address-specific sockets and
396 		 * a wildcard socket listening to the same port -- they would
397 		 * end up receiving duplicates of every unicast datagram.
398 		 * Those applications open the multiple sockets to overcome an
399 		 * inadequacy of the UDP socket interface, but for backwards
400 		 * compatibility we avoid the problem here rather than
401 		 * fixing the interface.  Maybe 4.5BSD will remedy this?)
402 		 */
403 
404 		/*
405 		 * Construct sockaddr format source address.
406 		 */
407 		udp_in.sin_port = uh->uh_sport;
408 		udp_in.sin_addr = ip->ip_src;
409 		/*
410 		 * Locate pcb(s) for datagram.
411 		 * (Algorithm copied from raw_intr().)
412 		 */
413 		udp_in6.uin6_init_done = udp_ip6.uip6_init_done = 0;
414 		LIST_FOREACH(inp, &udb, inp_list) {
415 #if IPSEC
416 			int skipit;
417 #endif /* IPSEC */
418 
419 			if (inp->inp_socket == NULL) {
420 				continue;
421 			}
422 			if (inp != sotoinpcb(inp->inp_socket)) {
423 				panic("%s: bad so back ptr inp=%p",
424 				    __func__, inp);
425 				/* NOTREACHED */
426 			}
427 			if ((inp->inp_vflag & INP_IPV4) == 0) {
428 				continue;
429 			}
430 			if (inp_restricted_recv(inp, ifp)) {
431 				continue;
432 			}
433 
434 			if ((inp->inp_moptions == NULL) &&
435 			    (ntohl(ip->ip_dst.s_addr) !=
436 			    INADDR_ALLHOSTS_GROUP) && (isbroadcast == 0)) {
437 				continue;
438 			}
439 			/*
440 			 * Skip unbound sockets before taking the lock on the socket as
441 			 * the test with the destination port in the header will fail
442 			 */
443 			if (inp->inp_lport == 0) {
444 				continue;
445 			}
446 
447 			if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) ==
448 			    WNT_STOPUSING) {
449 				continue;
450 			}
451 
452 			udp_lock(inp->inp_socket, 1, 0);
453 
454 			if (in_pcb_checkstate(inp, WNT_RELEASE, 1) ==
455 			    WNT_STOPUSING) {
456 				udp_unlock(inp->inp_socket, 1, 0);
457 				continue;
458 			}
459 
460 			if (inp->inp_lport != uh->uh_dport) {
461 				udp_unlock(inp->inp_socket, 1, 0);
462 				continue;
463 			}
464 			if (inp->inp_laddr.s_addr != INADDR_ANY) {
465 				if (inp->inp_laddr.s_addr !=
466 				    ip->ip_dst.s_addr) {
467 					udp_unlock(inp->inp_socket, 1, 0);
468 					continue;
469 				}
470 			}
471 			if (inp->inp_faddr.s_addr != INADDR_ANY) {
472 				if (inp->inp_faddr.s_addr !=
473 				    ip->ip_src.s_addr ||
474 				    inp->inp_fport != uh->uh_sport) {
475 					udp_unlock(inp->inp_socket, 1, 0);
476 					continue;
477 				}
478 			}
479 
480 			if (isbroadcast == 0 && (ntohl(ip->ip_dst.s_addr) !=
481 			    INADDR_ALLHOSTS_GROUP)) {
482 				struct sockaddr_in group;
483 				int blocked;
484 
485 				if ((imo = inp->inp_moptions) == NULL) {
486 					udp_unlock(inp->inp_socket, 1, 0);
487 					continue;
488 				}
489 				IMO_LOCK(imo);
490 
491 				bzero(&group, sizeof(struct sockaddr_in));
492 				group.sin_len = sizeof(struct sockaddr_in);
493 				group.sin_family = AF_INET;
494 				group.sin_addr = ip->ip_dst;
495 
496 				blocked = imo_multi_filter(imo, ifp,
497 				    &group, &udp_in);
498 				if (blocked == MCAST_PASS) {
499 					foundmembership = 1;
500 				}
501 
502 				IMO_UNLOCK(imo);
503 				if (!foundmembership) {
504 					udp_unlock(inp->inp_socket, 1, 0);
505 					if (blocked == MCAST_NOTSMEMBER ||
506 					    blocked == MCAST_MUTED) {
507 						udpstat.udps_filtermcast++;
508 					}
509 					continue;
510 				}
511 				foundmembership = 0;
512 			}
513 
514 			reuse_sock = (inp->inp_socket->so_options &
515 			    (SO_REUSEPORT | SO_REUSEADDR));
516 
517 #if NECP
518 			skipit = 0;
519 			if (!necp_socket_is_allowed_to_send_recv_v4(inp,
520 			    uh->uh_dport, uh->uh_sport, &ip->ip_dst,
521 			    &ip->ip_src, ifp, pf_tag, NULL, NULL, NULL, NULL)) {
522 				/* do not inject data to pcb */
523 				skipit = 1;
524 			}
525 			if (skipit == 0)
526 #endif /* NECP */
527 			{
528 				struct mbuf *n = NULL;
529 
530 				if (reuse_sock) {
531 					n = m_copy(m, 0, M_COPYALL);
532 				}
533 				udp_append(inp, ip, m,
534 				    iphlen + sizeof(struct udphdr),
535 				    &udp_in, &udp_in6, &udp_ip6, ifp);
536 				mcast_delivered++;
537 
538 				m = n;
539 			}
540 			if (is_wake_pkt) {
541 				soevent(inp->inp_socket, SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
542 			}
543 
544 			udp_unlock(inp->inp_socket, 1, 0);
545 
546 
547 			/*
548 			 * Don't look for additional matches if this one does
549 			 * not have either the SO_REUSEPORT or SO_REUSEADDR
550 			 * socket options set.  This heuristic avoids searching
551 			 * through all pcbs in the common case of a non-shared
552 			 * port.  It assumes that an application will never
553 			 * clear these options after setting them.
554 			 */
555 			if (reuse_sock == 0 || m == NULL) {
556 				break;
557 			}
558 
559 			/*
560 			 * Expect 32-bit aligned data pointer on strict-align
561 			 * platforms.
562 			 */
563 			MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
564 			/*
565 			 * Recompute IP and UDP header pointers for new mbuf
566 			 */
567 			ip = mtod(m, struct ip *);
568 			uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
569 		}
570 		lck_rw_done(&pcbinfo->ipi_lock);
571 
572 		if (mcast_delivered == 0) {
573 			/*
574 			 * No matching pcb found; discard datagram.
575 			 * (No need to send an ICMP Port Unreachable
576 			 * for a broadcast or multicast datgram.)
577 			 */
578 			udpstat.udps_noportbcast++;
579 			IF_UDP_STATINC(ifp, port_unreach);
580 			goto bad;
581 		}
582 
583 		/* free the extra copy of mbuf or skipped by IPsec */
584 		if (m != NULL) {
585 			m_freem(m);
586 		}
587 		KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
588 		return;
589 	}
590 
591 #if IPSEC
592 	/*
593 	 * UDP to port 4500 with a payload where the first four bytes are
594 	 * not zero is a UDP encapsulated IPsec packet. Packets where
595 	 * the payload is one byte and that byte is 0xFF are NAT keepalive
596 	 * packets. Decapsulate the ESP packet and carry on with IPsec input
597 	 * or discard the NAT keep-alive.
598 	 */
599 	if (ipsec_bypass == 0 && (esp_udp_encap_port & 0xFFFF) != 0 &&
600 	    (uh->uh_dport == ntohs((u_short)esp_udp_encap_port) ||
601 	    uh->uh_sport == ntohs((u_short)esp_udp_encap_port))) {
602 		/*
603 		 * Check if ESP or keepalive:
604 		 *      1. If the destination port of the incoming packet is 4500.
605 		 *      2. If the source port of the incoming packet is 4500,
606 		 *         then check the SADB to match IP address and port.
607 		 */
608 		bool check_esp = true;
609 		if (uh->uh_dport != ntohs((u_short)esp_udp_encap_port)) {
610 			check_esp = key_checksa_present(AF_INET, (caddr_t)&ip->ip_dst,
611 			    (caddr_t)&ip->ip_src, uh->uh_dport,
612 			    uh->uh_sport, IFSCOPE_NONE, IFSCOPE_NONE);
613 		}
614 
615 		if (check_esp) {
616 			int payload_len = len - sizeof(struct udphdr) > 4 ? 4 :
617 			    len - sizeof(struct udphdr);
618 
619 			if (m->m_len < iphlen + sizeof(struct udphdr) + payload_len) {
620 				if ((m = m_pullup(m, iphlen + sizeof(struct udphdr) +
621 				    payload_len)) == NULL) {
622 					udpstat.udps_hdrops++;
623 					KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
624 					    0, 0, 0, 0, 0);
625 					return;
626 				}
627 				/*
628 				 * Expect 32-bit aligned data pointer on strict-align
629 				 * platforms.
630 				 */
631 				MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
632 
633 				ip = mtod(m, struct ip *);
634 				uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
635 			}
636 			/* Check for NAT keepalive packet */
637 			if (payload_len == 1 && *(u_int8_t *)
638 			    ((caddr_t)uh + sizeof(struct udphdr)) == 0xFF) {
639 				m_freem(m);
640 				KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
641 				    0, 0, 0, 0, 0);
642 				return;
643 			} else if (payload_len == 4 && *(u_int32_t *)(void *)
644 			    ((caddr_t)uh + sizeof(struct udphdr)) != 0) {
645 				/* UDP encapsulated IPsec packet to pass through NAT */
646 				KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
647 				    0, 0, 0, 0, 0);
648 				/* preserve the udp header */
649 				esp4_input(m, iphlen + sizeof(struct udphdr));
650 				return;
651 			}
652 		}
653 	}
654 #endif /* IPSEC */
655 
656 	/*
657 	 * Locate pcb for datagram.
658 	 */
659 	inp = in_pcblookup_hash(&udbinfo, ip->ip_src, uh->uh_sport,
660 	    ip->ip_dst, uh->uh_dport, 1, ifp);
661 	if (inp == NULL) {
662 		IF_UDP_STATINC(ifp, port_unreach);
663 
664 		if (udp_log_in_vain) {
665 			char buf[MAX_IPv4_STR_LEN];
666 			char buf2[MAX_IPv4_STR_LEN];
667 
668 			/* check src and dst address */
669 			if (udp_log_in_vain < 3) {
670 				log(LOG_INFO, "Connection attempt to "
671 				    "UDP %s:%d from %s:%d\n", inet_ntop(AF_INET,
672 				    &ip->ip_dst, buf, sizeof(buf)),
673 				    ntohs(uh->uh_dport), inet_ntop(AF_INET,
674 				    &ip->ip_src, buf2, sizeof(buf2)),
675 				    ntohs(uh->uh_sport));
676 			} else if (!(m->m_flags & (M_BCAST | M_MCAST)) &&
677 			    ip->ip_dst.s_addr != ip->ip_src.s_addr) {
678 				log_in_vain_log((LOG_INFO,
679 				    "Stealth Mode connection attempt to "
680 				    "UDP %s:%d from %s:%d\n", inet_ntop(AF_INET,
681 				    &ip->ip_dst, buf, sizeof(buf)),
682 				    ntohs(uh->uh_dport), inet_ntop(AF_INET,
683 				    &ip->ip_src, buf2, sizeof(buf2)),
684 				    ntohs(uh->uh_sport)))
685 			}
686 		}
687 		udpstat.udps_noport++;
688 		if (m->m_flags & (M_BCAST | M_MCAST)) {
689 			udpstat.udps_noportbcast++;
690 			goto bad;
691 		}
692 		if (blackhole) {
693 			if (ifp && ifp->if_type != IFT_LOOP) {
694 				goto bad;
695 			}
696 		}
697 		*ip = save_ip;
698 		ip->ip_len += iphlen;
699 		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
700 		KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
701 		return;
702 	}
703 	udp_lock(inp->inp_socket, 1, 0);
704 
705 	if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
706 		udp_unlock(inp->inp_socket, 1, 0);
707 		IF_UDP_STATINC(ifp, cleanup);
708 		goto bad;
709 	}
710 #if NECP
711 	if (!necp_socket_is_allowed_to_send_recv_v4(inp, uh->uh_dport,
712 	    uh->uh_sport, &ip->ip_dst, &ip->ip_src, ifp, pf_tag, NULL, NULL, NULL, NULL)) {
713 		udp_unlock(inp->inp_socket, 1, 0);
714 		IF_UDP_STATINC(ifp, badipsec);
715 		goto bad;
716 	}
717 #endif /* NECP */
718 
719 	/*
720 	 * Construct sockaddr format source address.
721 	 * Stuff source address and datagram in user buffer.
722 	 */
723 	udp_in.sin_port = uh->uh_sport;
724 	udp_in.sin_addr = ip->ip_src;
725 	if ((inp->inp_flags & INP_CONTROLOPTS) != 0 ||
726 	    SOFLOW_ENABLED(inp->inp_socket) ||
727 	    SO_RECV_CONTROL_OPTS(inp->inp_socket)) {
728 		if (inp->inp_vflag & INP_IPV6 || inp->inp_vflag & INP_V4MAPPEDV6) {
729 			int savedflags;
730 
731 			ip_2_ip6_hdr(&udp_ip6.uip6_ip6, ip);
732 			savedflags = inp->inp_flags;
733 			inp->inp_flags &= ~INP_UNMAPPABLEOPTS;
734 			ret = ip6_savecontrol(inp, m, &opts);
735 			inp->inp_flags = savedflags;
736 		} else {
737 			ret = ip_savecontrol(inp, &opts, ip, m);
738 		}
739 		if (ret != 0) {
740 			udp_unlock(inp->inp_socket, 1, 0);
741 			goto bad;
742 		}
743 	}
744 	m_adj(m, iphlen + sizeof(struct udphdr));
745 
746 	KERNEL_DEBUG(DBG_LAYER_IN_END, uh->uh_dport, uh->uh_sport,
747 	    save_ip.ip_src.s_addr, save_ip.ip_dst.s_addr, uh->uh_ulen);
748 
749 	if (inp->inp_vflag & INP_IPV6) {
750 		in6_sin_2_v4mapsin6(&udp_in, &udp_in6.uin6_sin);
751 		append_sa = (struct sockaddr *)&udp_in6.uin6_sin;
752 	} else {
753 		append_sa = (struct sockaddr *)&udp_in;
754 	}
755 	if (nstat_collect) {
756 		INP_ADD_STAT(inp, cell, wifi, wired, rxpackets, 1);
757 		INP_ADD_STAT(inp, cell, wifi, wired, rxbytes, m->m_pkthdr.len);
758 		inp_set_activity_bitmap(inp);
759 	}
760 	so_recv_data_stat(inp->inp_socket, m, 0);
761 	if (sbappendaddr(&inp->inp_socket->so_rcv, append_sa,
762 	    m, opts, NULL) == 0) {
763 		udpstat.udps_fullsock++;
764 	} else {
765 		sorwakeup(inp->inp_socket);
766 	}
767 	if (is_wake_pkt) {
768 		soevent(inp->inp_socket, SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
769 	}
770 	udp_unlock(inp->inp_socket, 1, 0);
771 	KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
772 	return;
773 bad:
774 	m_freem(m);
775 	if (opts) {
776 		m_freem(opts);
777 	}
778 	KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
779 }
780 
781 static void
ip_2_ip6_hdr(struct ip6_hdr * ip6,struct ip * ip)782 ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip)
783 {
784 	bzero(ip6, sizeof(*ip6));
785 
786 	ip6->ip6_vfc = IPV6_VERSION;
787 	ip6->ip6_plen = ip->ip_len;
788 	ip6->ip6_nxt = ip->ip_p;
789 	ip6->ip6_hlim = ip->ip_ttl;
790 	if (ip->ip_src.s_addr) {
791 		ip6->ip6_src.s6_addr32[2] = IPV6_ADDR_INT32_SMP;
792 		ip6->ip6_src.s6_addr32[3] = ip->ip_src.s_addr;
793 	}
794 	if (ip->ip_dst.s_addr) {
795 		ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_SMP;
796 		ip6->ip6_dst.s6_addr32[3] = ip->ip_dst.s_addr;
797 	}
798 }
799 
800 /*
801  * subroutine of udp_input(), mainly for source code readability.
802  */
803 static void
udp_append(struct inpcb * last,struct ip * ip,struct mbuf * n,int off,struct sockaddr_in * pudp_in,struct udp_in6 * pudp_in6,struct udp_ip6 * pudp_ip6,struct ifnet * ifp)804 udp_append(struct inpcb *last, struct ip *ip, struct mbuf *n, int off,
805     struct sockaddr_in *pudp_in, struct udp_in6 *pudp_in6,
806     struct udp_ip6 *pudp_ip6, struct ifnet *ifp)
807 {
808 	struct sockaddr *append_sa;
809 	struct mbuf *opts = 0;
810 	boolean_t cell = IFNET_IS_CELLULAR(ifp);
811 	boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
812 	boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
813 	int ret = 0;
814 
815 	if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
816 	    SOFLOW_ENABLED(last->inp_socket) ||
817 	    SO_RECV_CONTROL_OPTS(last->inp_socket)) {
818 		if (last->inp_vflag & INP_IPV6 || last->inp_vflag & INP_V4MAPPEDV6) {
819 			int savedflags;
820 
821 			if (pudp_ip6->uip6_init_done == 0) {
822 				ip_2_ip6_hdr(&pudp_ip6->uip6_ip6, ip);
823 				pudp_ip6->uip6_init_done = 1;
824 			}
825 			savedflags = last->inp_flags;
826 			last->inp_flags &= ~INP_UNMAPPABLEOPTS;
827 			ret = ip6_savecontrol(last, n, &opts);
828 			if (ret != 0) {
829 				last->inp_flags = savedflags;
830 				goto error;
831 			}
832 			last->inp_flags = savedflags;
833 		} else {
834 			ret = ip_savecontrol(last, &opts, ip, n);
835 			if (ret != 0) {
836 				goto error;
837 			}
838 		}
839 	}
840 	if (last->inp_vflag & INP_IPV6) {
841 		if (pudp_in6->uin6_init_done == 0) {
842 			in6_sin_2_v4mapsin6(pudp_in, &pudp_in6->uin6_sin);
843 			pudp_in6->uin6_init_done = 1;
844 		}
845 		append_sa = (struct sockaddr *)&pudp_in6->uin6_sin;
846 	} else {
847 		append_sa = (struct sockaddr *)pudp_in;
848 	}
849 	if (nstat_collect) {
850 		INP_ADD_STAT(last, cell, wifi, wired, rxpackets, 1);
851 		INP_ADD_STAT(last, cell, wifi, wired, rxbytes,
852 		    n->m_pkthdr.len);
853 		inp_set_activity_bitmap(last);
854 	}
855 	so_recv_data_stat(last->inp_socket, n, 0);
856 	m_adj(n, off);
857 	if (sbappendaddr(&last->inp_socket->so_rcv, append_sa,
858 	    n, opts, NULL) == 0) {
859 		udpstat.udps_fullsock++;
860 	} else {
861 		sorwakeup(last->inp_socket);
862 	}
863 	return;
864 error:
865 	m_freem(n);
866 	m_freem(opts);
867 }
868 
869 /*
870  * Notify a udp user of an asynchronous error;
871  * just wake up so that he can collect error status.
872  */
873 void
udp_notify(struct inpcb * inp,int errno)874 udp_notify(struct inpcb *inp, int errno)
875 {
876 	inp->inp_socket->so_error = (u_short)errno;
877 	sorwakeup(inp->inp_socket);
878 	sowwakeup(inp->inp_socket);
879 }
880 
881 void
udp_ctlinput(int cmd,struct sockaddr * sa,void * vip,__unused struct ifnet * ifp)882 udp_ctlinput(int cmd, struct sockaddr *sa, void *vip, __unused struct ifnet * ifp)
883 {
884 	struct ipctlparam *ctl_param = vip;
885 	struct ip *ip = NULL;
886 	struct mbuf *m = NULL;
887 	void (*notify)(struct inpcb *, int) = udp_notify;
888 	struct in_addr faddr;
889 	struct inpcb *inp = NULL;
890 	struct icmp *icp = NULL;
891 	size_t off;
892 
893 	if (ctl_param != NULL) {
894 		ip = ctl_param->ipc_icmp_ip;
895 		icp = ctl_param->ipc_icmp;
896 		m = ctl_param->ipc_m;
897 		off = ctl_param->ipc_off;
898 	} else {
899 		ip = NULL;
900 		icp = NULL;
901 		m = NULL;
902 		off = 0;
903 	}
904 
905 	faddr = ((struct sockaddr_in *)(void *)sa)->sin_addr;
906 	if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY) {
907 		return;
908 	}
909 
910 	if (PRC_IS_REDIRECT(cmd)) {
911 		ip = 0;
912 		notify = in_rtchange;
913 	} else if (cmd == PRC_HOSTDEAD) {
914 		ip = 0;
915 	} else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0) {
916 		return;
917 	}
918 	if (ip) {
919 		struct udphdr uh;
920 
921 		/* Check if we can safely get the ports from the UDP header */
922 		if (m == NULL ||
923 		    (m->m_len < off + sizeof(uh))) {
924 			/* Insufficient length */
925 			return;
926 		}
927 
928 		bcopy(m->m_data + off, &uh, sizeof(uh));
929 		inp = in_pcblookup_hash(&udbinfo, faddr, uh.uh_dport,
930 		    ip->ip_src, uh.uh_sport, 0, NULL);
931 
932 		if (inp != NULL && inp->inp_socket != NULL) {
933 			udp_lock(inp->inp_socket, 1, 0);
934 			if (in_pcb_checkstate(inp, WNT_RELEASE, 1) ==
935 			    WNT_STOPUSING) {
936 				udp_unlock(inp->inp_socket, 1, 0);
937 				return;
938 			}
939 			if (cmd == PRC_MSGSIZE && !uuid_is_null(inp->necp_client_uuid)) {
940 				uuid_t null_uuid;
941 				uuid_clear(null_uuid);
942 				necp_update_flow_protoctl_event(null_uuid, inp->necp_client_uuid,
943 				    PRC_MSGSIZE, ntohs(icp->icmp_nextmtu), 0);
944 				/*
945 				 * Avoid calling udp_notify() to set so_error
946 				 * when using Network.framework since the notification
947 				 * of PRC_MSGSIZE has been delivered through NECP.
948 				 */
949 			} else {
950 				(*notify)(inp, inetctlerrmap[cmd]);
951 			}
952 			udp_unlock(inp->inp_socket, 1, 0);
953 		}
954 #if SKYWALK
955 		else {
956 			union sockaddr_in_4_6 sock_laddr;
957 			struct protoctl_ev_val prctl_ev_val;
958 			bzero(&prctl_ev_val, sizeof(prctl_ev_val));
959 			bzero(&sock_laddr, sizeof(sock_laddr));
960 
961 			if (cmd == PRC_MSGSIZE) {
962 				prctl_ev_val.val = ntohs(icp->icmp_nextmtu);
963 			}
964 
965 			sock_laddr.sin.sin_family = AF_INET;
966 			sock_laddr.sin.sin_len = sizeof(sock_laddr.sin);
967 			sock_laddr.sin.sin_addr = ip->ip_src;
968 
969 			protoctl_event_enqueue_nwk_wq_entry(ifp,
970 			    (struct sockaddr *)&sock_laddr, sa,
971 			    uh.uh_sport, uh.uh_dport, IPPROTO_UDP,
972 			    cmd, &prctl_ev_val);
973 		}
974 #endif /* SKYWALK */
975 	} else {
976 		in_pcbnotifyall(&udbinfo, faddr, inetctlerrmap[cmd], notify);
977 	}
978 }
979 
980 int
udp_ctloutput(struct socket * so,struct sockopt * sopt)981 udp_ctloutput(struct socket *so, struct sockopt *sopt)
982 {
983 	int     error = 0, optval = 0;
984 	struct  inpcb *inp;
985 
986 	/* Allow <SOL_SOCKET,SO_FLUSH> at this level */
987 	if (sopt->sopt_level != IPPROTO_UDP &&
988 	    !(sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_FLUSH)) {
989 		if (SOCK_CHECK_DOM(so, PF_INET6)) {
990 			error = ip6_ctloutput(so, sopt);
991 		} else {
992 			error = ip_ctloutput(so, sopt);
993 		}
994 		return error;
995 	}
996 
997 	inp = sotoinpcb(so);
998 
999 	switch (sopt->sopt_dir) {
1000 	case SOPT_SET:
1001 		switch (sopt->sopt_name) {
1002 		case UDP_NOCKSUM:
1003 			/* This option is settable only for UDP over IPv4 */
1004 			if (!(inp->inp_vflag & INP_IPV4)) {
1005 				error = EINVAL;
1006 				break;
1007 			}
1008 
1009 			if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
1010 			    sizeof(optval))) != 0) {
1011 				break;
1012 			}
1013 
1014 			if (optval != 0) {
1015 				inp->inp_flags |= INP_UDP_NOCKSUM;
1016 			} else {
1017 				inp->inp_flags &= ~INP_UDP_NOCKSUM;
1018 			}
1019 			break;
1020 		case UDP_KEEPALIVE_OFFLOAD:
1021 		{
1022 			struct udp_keepalive_offload ka;
1023 			/*
1024 			 * If the socket is not connected, the stack will
1025 			 * not know the destination address to put in the
1026 			 * keepalive datagram. Return an error now instead
1027 			 * of failing later.
1028 			 */
1029 			if (!(so->so_state & SS_ISCONNECTED)) {
1030 				error = EINVAL;
1031 				break;
1032 			}
1033 			if (sopt->sopt_valsize != sizeof(ka)) {
1034 				error = EINVAL;
1035 				break;
1036 			}
1037 			if ((error = sooptcopyin(sopt, &ka, sizeof(ka),
1038 			    sizeof(ka))) != 0) {
1039 				break;
1040 			}
1041 
1042 			/* application should specify the type */
1043 			if (ka.ka_type == 0) {
1044 				return EINVAL;
1045 			}
1046 
1047 			if (ka.ka_interval == 0) {
1048 				/*
1049 				 * if interval is 0, disable the offload
1050 				 * mechanism
1051 				 */
1052 				if (inp->inp_keepalive_data != NULL) {
1053 					kfree_data(inp->inp_keepalive_data,
1054 					    inp->inp_keepalive_datalen);
1055 				}
1056 				inp->inp_keepalive_data = NULL;
1057 				inp->inp_keepalive_datalen = 0;
1058 				inp->inp_keepalive_interval = 0;
1059 				inp->inp_keepalive_type = 0;
1060 				inp->inp_flags2 &= ~INP2_KEEPALIVE_OFFLOAD;
1061 			} else {
1062 				if (inp->inp_keepalive_data != NULL) {
1063 					kfree_data(inp->inp_keepalive_data,
1064 					    inp->inp_keepalive_datalen);
1065 					inp->inp_keepalive_data = NULL;
1066 				}
1067 
1068 				inp->inp_keepalive_datalen = (uint8_t)min(
1069 					ka.ka_data_len,
1070 					UDP_KEEPALIVE_OFFLOAD_DATA_SIZE);
1071 				if (inp->inp_keepalive_datalen > 0) {
1072 					inp->inp_keepalive_data = (u_int8_t *)kalloc_data(
1073 						inp->inp_keepalive_datalen, Z_WAITOK);
1074 					if (inp->inp_keepalive_data == NULL) {
1075 						inp->inp_keepalive_datalen = 0;
1076 						error = ENOMEM;
1077 						break;
1078 					}
1079 					bcopy(ka.ka_data,
1080 					    inp->inp_keepalive_data,
1081 					    inp->inp_keepalive_datalen);
1082 				} else {
1083 					inp->inp_keepalive_datalen = 0;
1084 				}
1085 				inp->inp_keepalive_interval = (uint8_t)
1086 				    min(UDP_KEEPALIVE_INTERVAL_MAX_SECONDS,
1087 				    ka.ka_interval);
1088 				inp->inp_keepalive_type = ka.ka_type;
1089 				inp->inp_flags2 |= INP2_KEEPALIVE_OFFLOAD;
1090 			}
1091 			break;
1092 		}
1093 		case SO_FLUSH:
1094 			if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
1095 			    sizeof(optval))) != 0) {
1096 				break;
1097 			}
1098 
1099 			error = inp_flush(inp, optval);
1100 			break;
1101 
1102 		default:
1103 			error = ENOPROTOOPT;
1104 			break;
1105 		}
1106 		break;
1107 
1108 	case SOPT_GET:
1109 		switch (sopt->sopt_name) {
1110 		case UDP_NOCKSUM:
1111 			optval = inp->inp_flags & INP_UDP_NOCKSUM;
1112 			break;
1113 
1114 		default:
1115 			error = ENOPROTOOPT;
1116 			break;
1117 		}
1118 		if (error == 0) {
1119 			error = sooptcopyout(sopt, &optval, sizeof(optval));
1120 		}
1121 		break;
1122 	}
1123 	return error;
1124 }
1125 
1126 static int
1127 udp_pcblist SYSCTL_HANDLER_ARGS
1128 {
1129 #pragma unused(oidp, arg1, arg2)
1130 	int error, i, n, sz;
1131 	struct inpcb *inp, **inp_list;
1132 	inp_gen_t gencnt;
1133 	struct xinpgen xig;
1134 
1135 	/*
1136 	 * The process of preparing the TCB list is too time-consuming and
1137 	 * resource-intensive to repeat twice on every request.
1138 	 */
1139 	lck_rw_lock_exclusive(&udbinfo.ipi_lock);
1140 	if (req->oldptr == USER_ADDR_NULL) {
1141 		n = udbinfo.ipi_count;
1142 		req->oldidx = 2 * (sizeof(xig))
1143 		    + (n + n / 8) * sizeof(struct xinpcb);
1144 		lck_rw_done(&udbinfo.ipi_lock);
1145 		return 0;
1146 	}
1147 
1148 	if (req->newptr != USER_ADDR_NULL) {
1149 		lck_rw_done(&udbinfo.ipi_lock);
1150 		return EPERM;
1151 	}
1152 
1153 	/*
1154 	 * OK, now we're committed to doing something.
1155 	 */
1156 	gencnt = udbinfo.ipi_gencnt;
1157 	sz = n = udbinfo.ipi_count;
1158 
1159 	bzero(&xig, sizeof(xig));
1160 	xig.xig_len = sizeof(xig);
1161 	xig.xig_count = n;
1162 	xig.xig_gen = gencnt;
1163 	xig.xig_sogen = so_gencnt;
1164 	error = SYSCTL_OUT(req, &xig, sizeof(xig));
1165 	if (error) {
1166 		lck_rw_done(&udbinfo.ipi_lock);
1167 		return error;
1168 	}
1169 	/*
1170 	 * We are done if there is no pcb
1171 	 */
1172 	if (n == 0) {
1173 		lck_rw_done(&udbinfo.ipi_lock);
1174 		return 0;
1175 	}
1176 
1177 	inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1178 	if (inp_list == NULL) {
1179 		lck_rw_done(&udbinfo.ipi_lock);
1180 		return ENOMEM;
1181 	}
1182 
1183 	for (inp = LIST_FIRST(udbinfo.ipi_listhead), i = 0; inp && i < n;
1184 	    inp = LIST_NEXT(inp, inp_list)) {
1185 		if (inp->inp_gencnt <= gencnt &&
1186 		    inp->inp_state != INPCB_STATE_DEAD) {
1187 			inp_list[i++] = inp;
1188 		}
1189 	}
1190 	n = i;
1191 
1192 	error = 0;
1193 	for (i = 0; i < n; i++) {
1194 		struct xinpcb xi;
1195 
1196 		inp = inp_list[i];
1197 
1198 		if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING) {
1199 			continue;
1200 		}
1201 		udp_lock(inp->inp_socket, 1, 0);
1202 		if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
1203 			udp_unlock(inp->inp_socket, 1, 0);
1204 			continue;
1205 		}
1206 		if (inp->inp_gencnt > gencnt) {
1207 			udp_unlock(inp->inp_socket, 1, 0);
1208 			continue;
1209 		}
1210 
1211 		bzero(&xi, sizeof(xi));
1212 		xi.xi_len = sizeof(xi);
1213 		/* XXX should avoid extra copy */
1214 		inpcb_to_compat(inp, &xi.xi_inp);
1215 		if (inp->inp_socket) {
1216 			sotoxsocket(inp->inp_socket, &xi.xi_socket);
1217 		}
1218 
1219 		udp_unlock(inp->inp_socket, 1, 0);
1220 
1221 		error = SYSCTL_OUT(req, &xi, sizeof(xi));
1222 	}
1223 	if (!error) {
1224 		/*
1225 		 * Give the user an updated idea of our state.
1226 		 * If the generation differs from what we told
1227 		 * her before, she knows that something happened
1228 		 * while we were processing this request, and it
1229 		 * might be necessary to retry.
1230 		 */
1231 		bzero(&xig, sizeof(xig));
1232 		xig.xig_len = sizeof(xig);
1233 		xig.xig_gen = udbinfo.ipi_gencnt;
1234 		xig.xig_sogen = so_gencnt;
1235 		xig.xig_count = udbinfo.ipi_count;
1236 		error = SYSCTL_OUT(req, &xig, sizeof(xig));
1237 	}
1238 
1239 	lck_rw_done(&udbinfo.ipi_lock);
1240 	kfree_type(struct inpcb *, sz, inp_list);
1241 	return error;
1242 }
1243 
1244 SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist,
1245     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist,
1246     "S,xinpcb", "List of active UDP sockets");
1247 
1248 #if XNU_TARGET_OS_OSX
1249 
1250 static int
1251 udp_pcblist64 SYSCTL_HANDLER_ARGS
1252 {
1253 #pragma unused(oidp, arg1, arg2)
1254 	int error, i, n, sz;
1255 	struct inpcb *inp, **inp_list;
1256 	inp_gen_t gencnt;
1257 	struct xinpgen xig;
1258 
1259 	/*
1260 	 * The process of preparing the TCB list is too time-consuming and
1261 	 * resource-intensive to repeat twice on every request.
1262 	 */
1263 	lck_rw_lock_shared(&udbinfo.ipi_lock);
1264 	if (req->oldptr == USER_ADDR_NULL) {
1265 		n = udbinfo.ipi_count;
1266 		req->oldidx =
1267 		    2 * (sizeof(xig)) + (n + n / 8) * sizeof(struct xinpcb64);
1268 		lck_rw_done(&udbinfo.ipi_lock);
1269 		return 0;
1270 	}
1271 
1272 	if (req->newptr != USER_ADDR_NULL) {
1273 		lck_rw_done(&udbinfo.ipi_lock);
1274 		return EPERM;
1275 	}
1276 
1277 	/*
1278 	 * OK, now we're committed to doing something.
1279 	 */
1280 	gencnt = udbinfo.ipi_gencnt;
1281 	sz = n = udbinfo.ipi_count;
1282 
1283 	bzero(&xig, sizeof(xig));
1284 	xig.xig_len = sizeof(xig);
1285 	xig.xig_count = n;
1286 	xig.xig_gen = gencnt;
1287 	xig.xig_sogen = so_gencnt;
1288 	error = SYSCTL_OUT(req, &xig, sizeof(xig));
1289 	if (error) {
1290 		lck_rw_done(&udbinfo.ipi_lock);
1291 		return error;
1292 	}
1293 	/*
1294 	 * We are done if there is no pcb
1295 	 */
1296 	if (n == 0) {
1297 		lck_rw_done(&udbinfo.ipi_lock);
1298 		return 0;
1299 	}
1300 
1301 	inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1302 	if (inp_list == NULL) {
1303 		lck_rw_done(&udbinfo.ipi_lock);
1304 		return ENOMEM;
1305 	}
1306 
1307 	for (inp = LIST_FIRST(udbinfo.ipi_listhead), i = 0; inp && i < n;
1308 	    inp = LIST_NEXT(inp, inp_list)) {
1309 		if (inp->inp_gencnt <= gencnt &&
1310 		    inp->inp_state != INPCB_STATE_DEAD) {
1311 			inp_list[i++] = inp;
1312 		}
1313 	}
1314 	n = i;
1315 
1316 	error = 0;
1317 	for (i = 0; i < n; i++) {
1318 		struct xinpcb64 xi;
1319 
1320 		inp = inp_list[i];
1321 
1322 		if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING) {
1323 			continue;
1324 		}
1325 		udp_lock(inp->inp_socket, 1, 0);
1326 		if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
1327 			udp_unlock(inp->inp_socket, 1, 0);
1328 			continue;
1329 		}
1330 		if (inp->inp_gencnt > gencnt) {
1331 			udp_unlock(inp->inp_socket, 1, 0);
1332 			continue;
1333 		}
1334 
1335 		bzero(&xi, sizeof(xi));
1336 		xi.xi_len = sizeof(xi);
1337 		inpcb_to_xinpcb64(inp, &xi);
1338 		if (inp->inp_socket) {
1339 			sotoxsocket64(inp->inp_socket, &xi.xi_socket);
1340 		}
1341 
1342 		udp_unlock(inp->inp_socket, 1, 0);
1343 
1344 		error = SYSCTL_OUT(req, &xi, sizeof(xi));
1345 	}
1346 	if (!error) {
1347 		/*
1348 		 * Give the user an updated idea of our state.
1349 		 * If the generation differs from what we told
1350 		 * her before, she knows that something happened
1351 		 * while we were processing this request, and it
1352 		 * might be necessary to retry.
1353 		 */
1354 		bzero(&xig, sizeof(xig));
1355 		xig.xig_len = sizeof(xig);
1356 		xig.xig_gen = udbinfo.ipi_gencnt;
1357 		xig.xig_sogen = so_gencnt;
1358 		xig.xig_count = udbinfo.ipi_count;
1359 		error = SYSCTL_OUT(req, &xig, sizeof(xig));
1360 	}
1361 
1362 	lck_rw_done(&udbinfo.ipi_lock);
1363 	kfree_type(struct inpcb *, sz, inp_list);
1364 	return error;
1365 }
1366 
1367 SYSCTL_PROC(_net_inet_udp, OID_AUTO, pcblist64,
1368     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist64,
1369     "S,xinpcb64", "List of active UDP sockets");
1370 
1371 #endif /* XNU_TARGET_OS_OSX */
1372 
1373 static int
1374 udp_pcblist_n SYSCTL_HANDLER_ARGS
1375 {
1376 #pragma unused(oidp, arg1, arg2)
1377 	return get_pcblist_n(IPPROTO_UDP, req, &udbinfo);
1378 }
1379 
1380 SYSCTL_PROC(_net_inet_udp, OID_AUTO, pcblist_n,
1381     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist_n,
1382     "S,xinpcb_n", "List of active UDP sockets");
1383 
1384 __private_extern__ void
udp_get_ports_used(ifnet_t ifp,int protocol,uint32_t flags,bitstr_t * bitfield)1385 udp_get_ports_used(ifnet_t ifp, int protocol, uint32_t flags,
1386     bitstr_t *bitfield)
1387 {
1388 	inpcb_get_ports_used(ifp, protocol, flags, bitfield,
1389 	    &udbinfo);
1390 }
1391 
1392 __private_extern__ uint32_t
udp_count_opportunistic(unsigned int ifindex,u_int32_t flags)1393 udp_count_opportunistic(unsigned int ifindex, u_int32_t flags)
1394 {
1395 	return inpcb_count_opportunistic(ifindex, &udbinfo, flags);
1396 }
1397 
1398 __private_extern__ uint32_t
udp_find_anypcb_byaddr(struct ifaddr * ifa)1399 udp_find_anypcb_byaddr(struct ifaddr *ifa)
1400 {
1401 #if SKYWALK
1402 	if (netns_is_enabled()) {
1403 		return netns_find_anyres_byaddr(ifa, IPPROTO_UDP);
1404 	} else
1405 #endif /* SKYWALK */
1406 	return inpcb_find_anypcb_byaddr(ifa, &udbinfo);
1407 }
1408 
1409 static int
udp_check_pktinfo(struct mbuf * control,struct ifnet ** outif,struct in_addr * laddr)1410 udp_check_pktinfo(struct mbuf *control, struct ifnet **outif,
1411     struct in_addr *laddr)
1412 {
1413 	struct cmsghdr *cm = 0;
1414 	struct in_pktinfo *pktinfo;
1415 	struct ifnet *ifp;
1416 
1417 	if (outif != NULL) {
1418 		*outif = NULL;
1419 	}
1420 
1421 	/*
1422 	 * XXX: Currently, we assume all the optional information is stored
1423 	 * in a single mbuf.
1424 	 */
1425 	if (control->m_next) {
1426 		return EINVAL;
1427 	}
1428 
1429 	if (control->m_len < CMSG_LEN(0)) {
1430 		return EINVAL;
1431 	}
1432 
1433 	for (cm = M_FIRST_CMSGHDR(control);
1434 	    is_cmsg_valid(control, cm);
1435 	    cm = M_NXT_CMSGHDR(control, cm)) {
1436 		if (cm->cmsg_level != IPPROTO_IP ||
1437 		    cm->cmsg_type != IP_PKTINFO) {
1438 			continue;
1439 		}
1440 
1441 		if (cm->cmsg_len != CMSG_LEN(sizeof(struct in_pktinfo))) {
1442 			return EINVAL;
1443 		}
1444 
1445 		pktinfo =  (struct in_pktinfo *)(void *)CMSG_DATA(cm);
1446 
1447 		/* Check for a valid ifindex in pktinfo */
1448 		ifnet_head_lock_shared();
1449 
1450 		if (pktinfo->ipi_ifindex > if_index) {
1451 			ifnet_head_done();
1452 			return ENXIO;
1453 		}
1454 
1455 		/*
1456 		 * If ipi_ifindex is specified it takes precedence
1457 		 * over ipi_spec_dst.
1458 		 */
1459 		if (pktinfo->ipi_ifindex) {
1460 			ifp = ifindex2ifnet[pktinfo->ipi_ifindex];
1461 			if (ifp == NULL) {
1462 				ifnet_head_done();
1463 				return ENXIO;
1464 			}
1465 			if (outif != NULL) {
1466 				ifnet_reference(ifp);
1467 				*outif = ifp;
1468 			}
1469 			ifnet_head_done();
1470 			laddr->s_addr = INADDR_ANY;
1471 			break;
1472 		}
1473 
1474 		ifnet_head_done();
1475 
1476 		/*
1477 		 * Use the provided ipi_spec_dst address for temp
1478 		 * source address.
1479 		 */
1480 		*laddr = pktinfo->ipi_spec_dst;
1481 		break;
1482 	}
1483 	return 0;
1484 }
1485 
1486 int
udp_output(struct inpcb * inp,struct mbuf * m,struct sockaddr * addr,struct mbuf * control,struct proc * p)1487 udp_output(struct inpcb *inp, struct mbuf *m, struct sockaddr *addr,
1488     struct mbuf *control, struct proc *p)
1489 {
1490 	struct udpiphdr *ui;
1491 	int len = m->m_pkthdr.len;
1492 	struct sockaddr_in *sin;
1493 	struct in_addr origladdr, laddr, faddr, pi_laddr;
1494 	u_short lport, fport;
1495 	int error = 0, udp_dodisconnect = 0, pktinfo = 0;
1496 	struct socket *so = inp->inp_socket;
1497 	int soopts = 0;
1498 	struct mbuf *inpopts;
1499 	struct ip_moptions *mopts;
1500 	struct route ro;
1501 	struct ip_out_args ipoa;
1502 	bool sndinprog_cnt_used = false;
1503 #if CONTENT_FILTER
1504 	struct m_tag *cfil_tag = NULL;
1505 	bool cfil_faddr_use = false;
1506 	uint32_t cfil_so_state_change_cnt = 0;
1507 	uint32_t cfil_so_options = 0;
1508 	struct sockaddr *cfil_faddr = NULL;
1509 #endif
1510 	bool check_qos_marking_again = (so->so_flags1 & SOF1_QOSMARKING_POLICY_OVERRIDE) ? FALSE : TRUE;
1511 
1512 	bzero(&ipoa, sizeof(ipoa));
1513 	ipoa.ipoa_boundif = IFSCOPE_NONE;
1514 	ipoa.ipoa_flags = IPOAF_SELECT_SRCIF;
1515 
1516 	struct ifnet *outif = NULL;
1517 	struct flowadv *adv = &ipoa.ipoa_flowadv;
1518 	int sotc = SO_TC_UNSPEC;
1519 	int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
1520 	struct ifnet *origoutifp = NULL;
1521 	int flowadv = 0;
1522 	int tos = IPTOS_UNSPEC;
1523 
1524 	/* Enable flow advisory only when connected */
1525 	flowadv = (so->so_state & SS_ISCONNECTED) ? 1 : 0;
1526 	pi_laddr.s_addr = INADDR_ANY;
1527 
1528 	KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
1529 
1530 	socket_lock_assert_owned(so);
1531 
1532 #if CONTENT_FILTER
1533 	/*
1534 	 * If socket is subject to UDP Content Filter and no addr is passed in,
1535 	 * retrieve CFIL saved state from mbuf and use it if necessary.
1536 	 */
1537 	if (CFIL_DGRAM_FILTERED(so) && !addr) {
1538 		cfil_tag = cfil_dgram_get_socket_state(m, &cfil_so_state_change_cnt, &cfil_so_options, &cfil_faddr, NULL);
1539 		if (cfil_tag) {
1540 			sin = (struct sockaddr_in *)(void *)cfil_faddr;
1541 			if (inp && inp->inp_faddr.s_addr == INADDR_ANY) {
1542 				/*
1543 				 * Socket is unconnected, simply use the saved faddr as 'addr' to go through
1544 				 * the connect/disconnect logic.
1545 				 */
1546 				addr = (struct sockaddr *)cfil_faddr;
1547 			} else if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
1548 			    (inp->inp_fport != sin->sin_port ||
1549 			    inp->inp_faddr.s_addr != sin->sin_addr.s_addr)) {
1550 				/*
1551 				 * Socket is connected but socket state and dest addr/port changed.
1552 				 * We need to use the saved faddr info.
1553 				 */
1554 				cfil_faddr_use = true;
1555 			}
1556 		}
1557 	}
1558 #endif
1559 
1560 	if (control != NULL) {
1561 		tos = so_tos_from_control(control);
1562 		sotc = so_tc_from_control(control, &netsvctype);
1563 		VERIFY(outif == NULL);
1564 		error = udp_check_pktinfo(control, &outif, &pi_laddr);
1565 		m_freem(control);
1566 		control = NULL;
1567 		if (error) {
1568 			goto release;
1569 		}
1570 		pktinfo++;
1571 		if (outif != NULL) {
1572 			ipoa.ipoa_boundif = outif->if_index;
1573 		}
1574 	}
1575 	if (sotc == SO_TC_UNSPEC) {
1576 		sotc = so->so_traffic_class;
1577 		netsvctype = so->so_netsvctype;
1578 	}
1579 
1580 	KERNEL_DEBUG(DBG_LAYER_OUT_BEG, inp->inp_fport, inp->inp_lport,
1581 	    inp->inp_laddr.s_addr, inp->inp_faddr.s_addr,
1582 	    (htons((u_short)len + sizeof(struct udphdr))));
1583 
1584 	if (len + sizeof(struct udpiphdr) > IP_MAXPACKET) {
1585 		error = EMSGSIZE;
1586 		goto release;
1587 	}
1588 
1589 	if (flowadv && INP_WAIT_FOR_IF_FEEDBACK(inp)) {
1590 		/*
1591 		 * The socket is flow-controlled, drop the packets
1592 		 * until the inp is not flow controlled
1593 		 */
1594 		error = ENOBUFS;
1595 		goto release;
1596 	}
1597 	/*
1598 	 * If socket was bound to an ifindex, tell ip_output about it.
1599 	 * If the ancillary IP_PKTINFO option contains an interface index,
1600 	 * it takes precedence over the one specified by IP_BOUND_IF.
1601 	 */
1602 	if (ipoa.ipoa_boundif == IFSCOPE_NONE &&
1603 	    (inp->inp_flags & INP_BOUND_IF)) {
1604 		VERIFY(inp->inp_boundifp != NULL);
1605 		ifnet_reference(inp->inp_boundifp);     /* for this routine */
1606 		if (outif != NULL) {
1607 			ifnet_release(outif);
1608 		}
1609 		outif = inp->inp_boundifp;
1610 		ipoa.ipoa_boundif = outif->if_index;
1611 	}
1612 	if (INP_NO_CELLULAR(inp)) {
1613 		ipoa.ipoa_flags |=  IPOAF_NO_CELLULAR;
1614 	}
1615 	if (INP_NO_EXPENSIVE(inp)) {
1616 		ipoa.ipoa_flags |=  IPOAF_NO_EXPENSIVE;
1617 	}
1618 	if (INP_NO_CONSTRAINED(inp)) {
1619 		ipoa.ipoa_flags |=  IPOAF_NO_CONSTRAINED;
1620 	}
1621 	if (INP_AWDL_UNRESTRICTED(inp)) {
1622 		ipoa.ipoa_flags |=  IPOAF_AWDL_UNRESTRICTED;
1623 	}
1624 	ipoa.ipoa_sotc = sotc;
1625 	ipoa.ipoa_netsvctype = netsvctype;
1626 	soopts |= IP_OUTARGS;
1627 
1628 	/*
1629 	 * If there was a routing change, discard cached route and check
1630 	 * that we have a valid source address.  Reacquire a new source
1631 	 * address if INADDR_ANY was specified.
1632 	 *
1633 	 * If we are using cfil saved state, go through this cache cleanup
1634 	 * so that we can get a new route.
1635 	 */
1636 	if (ROUTE_UNUSABLE(&inp->inp_route)
1637 #if CONTENT_FILTER
1638 	    || cfil_faddr_use
1639 #endif
1640 	    ) {
1641 		struct in_ifaddr *ia = NULL;
1642 
1643 		ROUTE_RELEASE(&inp->inp_route);
1644 
1645 		/* src address is gone? */
1646 		if (inp->inp_laddr.s_addr != INADDR_ANY &&
1647 		    (ia = ifa_foraddr(inp->inp_laddr.s_addr)) == NULL) {
1648 			if (!(inp->inp_flags & INP_INADDR_ANY) ||
1649 			    (so->so_state & SS_ISCONNECTED)) {
1650 				/*
1651 				 * Rdar://5448998
1652 				 * If the source address is gone, return an
1653 				 * error if:
1654 				 * - the source was specified
1655 				 * - the socket was already connected
1656 				 */
1657 				soevent(so, (SO_FILT_HINT_LOCKED |
1658 				    SO_FILT_HINT_NOSRCADDR));
1659 				error = EADDRNOTAVAIL;
1660 				goto release;
1661 			} else {
1662 				/* new src will be set later */
1663 				inp->inp_laddr.s_addr = INADDR_ANY;
1664 				inp->inp_last_outifp = NULL;
1665 #if SKYWALK
1666 				if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
1667 					netns_set_ifnet(&inp->inp_netns_token, NULL);
1668 				}
1669 #endif /* SKYWALK */
1670 			}
1671 		}
1672 		if (ia != NULL) {
1673 			IFA_REMREF(&ia->ia_ifa);
1674 		}
1675 	}
1676 
1677 	/*
1678 	 * IP_PKTINFO option check.  If a temporary scope or src address
1679 	 * is provided, use it for this packet only and make sure we forget
1680 	 * it after sending this datagram.
1681 	 */
1682 	if (pi_laddr.s_addr != INADDR_ANY ||
1683 	    (ipoa.ipoa_boundif != IFSCOPE_NONE && pktinfo)) {
1684 		/* temp src address for this datagram only */
1685 		laddr = pi_laddr;
1686 		origladdr.s_addr = INADDR_ANY;
1687 		/* we don't want to keep the laddr or route */
1688 		udp_dodisconnect = 1;
1689 		/* remember we don't care about src addr */
1690 		inp->inp_flags |= INP_INADDR_ANY;
1691 	} else {
1692 		origladdr = laddr = inp->inp_laddr;
1693 	}
1694 
1695 	origoutifp = inp->inp_last_outifp;
1696 	faddr = inp->inp_faddr;
1697 	lport = inp->inp_lport;
1698 	fport = inp->inp_fport;
1699 
1700 #if CONTENT_FILTER
1701 	if (cfil_faddr_use) {
1702 		faddr = ((struct sockaddr_in *)(void *)cfil_faddr)->sin_addr;
1703 		fport = ((struct sockaddr_in *)(void *)cfil_faddr)->sin_port;
1704 	}
1705 #endif
1706 	inp->inp_sndinprog_cnt++;
1707 	sndinprog_cnt_used = true;
1708 
1709 	if (addr) {
1710 		sin = (struct sockaddr_in *)(void *)addr;
1711 		if (faddr.s_addr != INADDR_ANY) {
1712 			error = EISCONN;
1713 			goto release;
1714 		}
1715 		if (lport == 0) {
1716 			/*
1717 			 * In case we don't have a local port set, go through
1718 			 * the full connect.  We don't have a local port yet
1719 			 * (i.e., we can't be looked up), so it's not an issue
1720 			 * if the input runs at the same time we do this.
1721 			 */
1722 			/* if we have a source address specified, use that */
1723 			if (pi_laddr.s_addr != INADDR_ANY) {
1724 				inp->inp_laddr = pi_laddr;
1725 			}
1726 			/*
1727 			 * If a scope is specified, use it.  Scope from
1728 			 * IP_PKTINFO takes precendence over the the scope
1729 			 * set via INP_BOUND_IF.
1730 			 */
1731 			error = in_pcbconnect(inp, addr, p, ipoa.ipoa_boundif,
1732 			    &outif);
1733 			if (error) {
1734 				goto release;
1735 			}
1736 
1737 			laddr = inp->inp_laddr;
1738 			lport = inp->inp_lport;
1739 			faddr = inp->inp_faddr;
1740 			fport = inp->inp_fport;
1741 			udp_dodisconnect = 1;
1742 
1743 			/* synch up in case in_pcbladdr() overrides */
1744 			if (outif != NULL && ipoa.ipoa_boundif != IFSCOPE_NONE) {
1745 				ipoa.ipoa_boundif = outif->if_index;
1746 			}
1747 		} else {
1748 			/*
1749 			 * Fast path case
1750 			 *
1751 			 * We have a full address and a local port; use those
1752 			 * info to build the packet without changing the pcb
1753 			 * and interfering with the input path. See 3851370.
1754 			 *
1755 			 * Scope from IP_PKTINFO takes precendence over the
1756 			 * the scope set via INP_BOUND_IF.
1757 			 */
1758 			if (laddr.s_addr == INADDR_ANY) {
1759 				if ((error = in_pcbladdr(inp, addr, &laddr,
1760 				    ipoa.ipoa_boundif, &outif, 0)) != 0) {
1761 					goto release;
1762 				}
1763 				/*
1764 				 * from pcbconnect: remember we don't
1765 				 * care about src addr.
1766 				 */
1767 				inp->inp_flags |= INP_INADDR_ANY;
1768 
1769 				/* synch up in case in_pcbladdr() overrides */
1770 				if (outif != NULL &&
1771 				    ipoa.ipoa_boundif != IFSCOPE_NONE) {
1772 					ipoa.ipoa_boundif = outif->if_index;
1773 				}
1774 			}
1775 
1776 			faddr = sin->sin_addr;
1777 			fport = sin->sin_port;
1778 		}
1779 	} else {
1780 		if (faddr.s_addr == INADDR_ANY) {
1781 			error = ENOTCONN;
1782 			goto release;
1783 		}
1784 	}
1785 
1786 	if (inp->inp_flowhash == 0) {
1787 		inp_calc_flowhash(inp);
1788 		ASSERT(inp->inp_flowhash != 0);
1789 	}
1790 
1791 	if (fport == htons(53) && !(so->so_flags1 & SOF1_DNS_COUNTED)) {
1792 		so->so_flags1 |= SOF1_DNS_COUNTED;
1793 		INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_dns);
1794 	}
1795 
1796 	/*
1797 	 * Calculate data length and get a mbuf
1798 	 * for UDP and IP headers.
1799 	 */
1800 	M_PREPEND(m, sizeof(struct udpiphdr), M_DONTWAIT, 1);
1801 	if (m == 0) {
1802 		error = ENOBUFS;
1803 		goto abort;
1804 	}
1805 
1806 	/*
1807 	 * Fill in mbuf with extended UDP header
1808 	 * and addresses and length put into network format.
1809 	 */
1810 	ui = mtod(m, struct udpiphdr *);
1811 	bzero(ui->ui_x1, sizeof(ui->ui_x1));    /* XXX still needed? */
1812 	ui->ui_pr = IPPROTO_UDP;
1813 	ui->ui_src = laddr;
1814 	ui->ui_dst = faddr;
1815 	ui->ui_sport = lport;
1816 	ui->ui_dport = fport;
1817 	ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
1818 
1819 	/*
1820 	 * Set the Don't Fragment bit in the IP header.
1821 	 */
1822 	if (inp->inp_flags2 & INP2_DONTFRAG) {
1823 		struct ip *ip;
1824 
1825 		ip = (struct ip *)&ui->ui_i;
1826 		ip->ip_off |= IP_DF;
1827 	}
1828 
1829 	/*
1830 	 * Set up checksum to pseudo header checksum and output datagram.
1831 	 *
1832 	 * Treat flows to be CLAT46'd as IPv6 flow and compute checksum
1833 	 * no matter what, as IPv6 mandates checksum for UDP.
1834 	 *
1835 	 * Here we only compute the one's complement sum of the pseudo header.
1836 	 * The payload computation and final complement is delayed to much later
1837 	 * in IP processing to decide if remaining computation needs to be done
1838 	 * through offload.
1839 	 *
1840 	 * That is communicated by setting CSUM_UDP in csum_flags.
1841 	 * The offset of checksum from the start of ULP header is communicated
1842 	 * through csum_data.
1843 	 *
1844 	 * Note since this already contains the pseudo checksum header, any
1845 	 * later operation at IP layer that modify the values used here must
1846 	 * update the checksum as well (for example NAT etc).
1847 	 */
1848 	if ((inp->inp_flags2 & INP2_CLAT46_FLOW) ||
1849 	    (udpcksum && !(inp->inp_flags & INP_UDP_NOCKSUM))) {
1850 		ui->ui_sum = in_pseudo(ui->ui_src.s_addr, ui->ui_dst.s_addr,
1851 		    htons((u_short)len + sizeof(struct udphdr) + IPPROTO_UDP));
1852 		m->m_pkthdr.csum_flags = (CSUM_UDP | CSUM_ZERO_INVERT);
1853 		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
1854 	} else {
1855 		ui->ui_sum = 0;
1856 	}
1857 	((struct ip *)ui)->ip_len = (uint16_t)(sizeof(struct udpiphdr) + len);
1858 	((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl;    /* XXX */
1859 	if (tos != IPTOS_UNSPEC) {
1860 		((struct ip *)ui)->ip_tos = (uint8_t)(tos & IPTOS_MASK);
1861 	} else {
1862 		((struct ip *)ui)->ip_tos = inp->inp_ip_tos;    /* XXX */
1863 	}
1864 	udpstat.udps_opackets++;
1865 
1866 	KERNEL_DEBUG(DBG_LAYER_OUT_END, ui->ui_dport, ui->ui_sport,
1867 	    ui->ui_src.s_addr, ui->ui_dst.s_addr, ui->ui_ulen);
1868 
1869 #if NECP
1870 	{
1871 		necp_kernel_policy_id policy_id;
1872 		necp_kernel_policy_id skip_policy_id;
1873 		u_int32_t route_rule_id;
1874 		u_int32_t pass_flags;
1875 
1876 		/*
1877 		 * We need a route to perform NECP route rule checks
1878 		 */
1879 		if (net_qos_policy_restricted != 0 &&
1880 		    ROUTE_UNUSABLE(&inp->inp_route)) {
1881 			struct sockaddr_in to;
1882 			struct sockaddr_in from;
1883 
1884 			ROUTE_RELEASE(&inp->inp_route);
1885 
1886 			bzero(&from, sizeof(struct sockaddr_in));
1887 			from.sin_family = AF_INET;
1888 			from.sin_len = sizeof(struct sockaddr_in);
1889 			from.sin_addr = laddr;
1890 
1891 			bzero(&to, sizeof(struct sockaddr_in));
1892 			to.sin_family = AF_INET;
1893 			to.sin_len = sizeof(struct sockaddr_in);
1894 			to.sin_addr = faddr;
1895 
1896 			inp->inp_route.ro_dst.sa_family = AF_INET;
1897 			inp->inp_route.ro_dst.sa_len = sizeof(struct sockaddr_in);
1898 			((struct sockaddr_in *)(void *)&inp->inp_route.ro_dst)->sin_addr =
1899 			    faddr;
1900 
1901 			rtalloc_scoped(&inp->inp_route, ipoa.ipoa_boundif);
1902 
1903 			inp_update_necp_policy(inp, (struct sockaddr *)&from,
1904 			    (struct sockaddr *)&to, ipoa.ipoa_boundif);
1905 			inp->inp_policyresult.results.qos_marking_gencount = 0;
1906 		}
1907 
1908 		if (!necp_socket_is_allowed_to_send_recv_v4(inp, lport, fport,
1909 		    &laddr, &faddr, NULL, 0, &policy_id, &route_rule_id, &skip_policy_id, &pass_flags)) {
1910 			error = EHOSTUNREACH;
1911 			goto abort;
1912 		}
1913 
1914 		necp_mark_packet_from_socket(m, inp, policy_id, route_rule_id, skip_policy_id, pass_flags);
1915 
1916 		if (net_qos_policy_restricted != 0) {
1917 			necp_socket_update_qos_marking(inp, inp->inp_route.ro_rt, route_rule_id);
1918 		}
1919 	}
1920 #endif /* NECP */
1921 	if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
1922 		ipoa.ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
1923 	}
1924 	if (check_qos_marking_again) {
1925 		ipoa.ipoa_flags |= IPOAF_REDO_QOSMARKING_POLICY;
1926 	}
1927 	ipoa.qos_marking_gencount = inp->inp_policyresult.results.qos_marking_gencount;
1928 
1929 #if IPSEC
1930 	if (inp->inp_sp != NULL && ipsec_setsocket(m, inp->inp_socket) != 0) {
1931 		error = ENOBUFS;
1932 		goto abort;
1933 	}
1934 #endif /* IPSEC */
1935 
1936 	inpopts = inp->inp_options;
1937 #if CONTENT_FILTER
1938 	if (cfil_tag && (inp->inp_socket->so_options != cfil_so_options)) {
1939 		soopts |= (cfil_so_options & (SO_DONTROUTE | SO_BROADCAST));
1940 	} else
1941 #endif
1942 	soopts |= (inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST));
1943 
1944 	mopts = inp->inp_moptions;
1945 	if (mopts != NULL) {
1946 		IMO_LOCK(mopts);
1947 		IMO_ADDREF_LOCKED(mopts);
1948 		if (IN_MULTICAST(ntohl(ui->ui_dst.s_addr)) &&
1949 		    mopts->imo_multicast_ifp != NULL) {
1950 			/* no reference needed */
1951 			inp->inp_last_outifp = mopts->imo_multicast_ifp;
1952 #if SKYWALK
1953 			if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
1954 				netns_set_ifnet(&inp->inp_netns_token,
1955 				    inp->inp_last_outifp);
1956 			}
1957 #endif /* SKYWALK */
1958 		}
1959 		IMO_UNLOCK(mopts);
1960 	}
1961 
1962 	/* Copy the cached route and take an extra reference */
1963 	inp_route_copyout(inp, &ro);
1964 
1965 	set_packet_service_class(m, so, sotc, 0);
1966 	m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
1967 	m->m_pkthdr.pkt_flowid = inp->inp_flowhash;
1968 	m->m_pkthdr.pkt_proto = IPPROTO_UDP;
1969 	m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC);
1970 	if (flowadv) {
1971 		m->m_pkthdr.pkt_flags |= PKTF_FLOW_ADV;
1972 	}
1973 	m->m_pkthdr.tx_udp_pid = so->last_pid;
1974 	if (so->so_flags & SOF_DELEGATED) {
1975 		m->m_pkthdr.tx_udp_e_pid = so->e_pid;
1976 	} else {
1977 		m->m_pkthdr.tx_udp_e_pid = 0;
1978 	}
1979 #if (DEBUG || DEVELOPMENT)
1980 	if (so->so_flags & SOF_MARK_WAKE_PKT) {
1981 		so->so_flags &= ~SOF_MARK_WAKE_PKT;
1982 		m->m_pkthdr.pkt_flags |= PKTF_WAKE_PKT;
1983 	}
1984 #endif /* (DEBUG || DEVELOPMENT) */
1985 
1986 	m_add_crumb(m, PKT_CRUMB_UDP_OUTPUT);
1987 
1988 	if (ipoa.ipoa_boundif != IFSCOPE_NONE) {
1989 		ipoa.ipoa_flags |= IPOAF_BOUND_IF;
1990 	}
1991 
1992 	if (laddr.s_addr != INADDR_ANY) {
1993 		ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
1994 	}
1995 
1996 	socket_unlock(so, 0);
1997 	error = ip_output(m, inpopts, &ro, soopts, mopts, &ipoa);
1998 	m = NULL;
1999 	socket_lock(so, 0);
2000 	if (mopts != NULL) {
2001 		IMO_REMREF(mopts);
2002 	}
2003 
2004 	if (check_qos_marking_again) {
2005 		inp->inp_policyresult.results.qos_marking_gencount = ipoa.qos_marking_gencount;
2006 
2007 		if (ipoa.ipoa_flags & IPOAF_QOSMARKING_ALLOWED) {
2008 			inp->inp_socket->so_flags1 |= SOF1_QOSMARKING_ALLOWED;
2009 		} else {
2010 			inp->inp_socket->so_flags1 &= ~SOF1_QOSMARKING_ALLOWED;
2011 		}
2012 	}
2013 
2014 	if (error == 0 && nstat_collect) {
2015 		boolean_t cell, wifi, wired;
2016 
2017 		if (ro.ro_rt != NULL) {
2018 			cell = IFNET_IS_CELLULAR(ro.ro_rt->rt_ifp);
2019 			wifi = (!cell && IFNET_IS_WIFI(ro.ro_rt->rt_ifp));
2020 			wired = (!wifi && IFNET_IS_WIRED(ro.ro_rt->rt_ifp));
2021 		} else {
2022 			cell = wifi = wired = FALSE;
2023 		}
2024 		INP_ADD_STAT(inp, cell, wifi, wired, txpackets, 1);
2025 		INP_ADD_STAT(inp, cell, wifi, wired, txbytes, len);
2026 		inp_set_activity_bitmap(inp);
2027 	}
2028 
2029 	if (flowadv && (adv->code == FADV_FLOW_CONTROLLED ||
2030 	    adv->code == FADV_SUSPENDED)) {
2031 		/*
2032 		 * return a hint to the application that
2033 		 * the packet has been dropped
2034 		 */
2035 		error = ENOBUFS;
2036 		inp_set_fc_state(inp, adv->code);
2037 	}
2038 
2039 	/* Synchronize PCB cached route */
2040 	inp_route_copyin(inp, &ro);
2041 
2042 abort:
2043 	if (udp_dodisconnect) {
2044 		/* Always discard the cached route for unconnected socket */
2045 		ROUTE_RELEASE(&inp->inp_route);
2046 		in_pcbdisconnect(inp);
2047 		inp->inp_laddr = origladdr;     /* XXX rehash? */
2048 		/* no reference needed */
2049 		inp->inp_last_outifp = origoutifp;
2050 #if SKYWALK
2051 		if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2052 			netns_set_ifnet(&inp->inp_netns_token,
2053 			    inp->inp_last_outifp);
2054 		}
2055 #endif /* SKYWALK */
2056 	} else if (inp->inp_route.ro_rt != NULL) {
2057 		struct rtentry *rt = inp->inp_route.ro_rt;
2058 		struct ifnet *outifp;
2059 
2060 		if (rt->rt_flags & (RTF_MULTICAST | RTF_BROADCAST)) {
2061 			rt = NULL;      /* unusable */
2062 		}
2063 #if CONTENT_FILTER
2064 		/*
2065 		 * Discard temporary route for cfil case
2066 		 */
2067 		if (cfil_faddr_use) {
2068 			rt = NULL;      /* unusable */
2069 		}
2070 #endif
2071 
2072 		/*
2073 		 * Always discard if it is a multicast or broadcast route.
2074 		 */
2075 		if (rt == NULL) {
2076 			ROUTE_RELEASE(&inp->inp_route);
2077 		}
2078 
2079 		/*
2080 		 * If the destination route is unicast, update outifp with
2081 		 * that of the route interface used by IP.
2082 		 */
2083 		if (rt != NULL &&
2084 		    (outifp = rt->rt_ifp) != inp->inp_last_outifp) {
2085 			inp->inp_last_outifp = outifp; /* no reference needed */
2086 #if SKYWALK
2087 			if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2088 				netns_set_ifnet(&inp->inp_netns_token,
2089 				    inp->inp_last_outifp);
2090 			}
2091 #endif /* SKYWALK */
2092 
2093 			so->so_pktheadroom = (uint16_t)P2ROUNDUP(
2094 				sizeof(struct udphdr) +
2095 				sizeof(struct ip) +
2096 				ifnet_hdrlen(outifp) +
2097 				ifnet_mbuf_packetpreamblelen(outifp),
2098 				sizeof(u_int32_t));
2099 		}
2100 	} else {
2101 		ROUTE_RELEASE(&inp->inp_route);
2102 	}
2103 
2104 	/*
2105 	 * If output interface was cellular/expensive, and this socket is
2106 	 * denied access to it, generate an event.
2107 	 */
2108 	if (error != 0 && (ipoa.ipoa_flags & IPOAF_R_IFDENIED) &&
2109 	    (INP_NO_CELLULAR(inp) || INP_NO_EXPENSIVE(inp) || INP_NO_CONSTRAINED(inp))) {
2110 		soevent(so, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
2111 	}
2112 
2113 release:
2114 	KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_END, error, 0, 0, 0, 0);
2115 
2116 	if (m != NULL) {
2117 		m_freem(m);
2118 	}
2119 
2120 	if (outif != NULL) {
2121 		ifnet_release(outif);
2122 	}
2123 
2124 #if CONTENT_FILTER
2125 	if (cfil_tag) {
2126 		m_tag_free(cfil_tag);
2127 	}
2128 #endif
2129 	if (sndinprog_cnt_used) {
2130 		VERIFY(inp->inp_sndinprog_cnt > 0);
2131 		if (--inp->inp_sndinprog_cnt == 0) {
2132 			inp->inp_flags &= ~(INP_FC_FEEDBACK);
2133 			if (inp->inp_sndingprog_waiters > 0) {
2134 				wakeup(&inp->inp_sndinprog_cnt);
2135 			}
2136 		}
2137 		sndinprog_cnt_used = false;
2138 	}
2139 
2140 	return error;
2141 }
2142 
2143 u_int32_t       udp_sendspace = 9216;           /* really max datagram size */
2144 /* 187 1K datagrams (approx 192 KB) */
2145 u_int32_t       udp_recvspace = 187 * (1024 + sizeof(struct sockaddr_in6));
2146 
2147 /* Check that the values of udp send and recv space do not exceed sb_max */
2148 static int
sysctl_udp_sospace(struct sysctl_oid * oidp,void * arg1,int arg2,struct sysctl_req * req)2149 sysctl_udp_sospace(struct sysctl_oid *oidp, void *arg1, int arg2,
2150     struct sysctl_req *req)
2151 {
2152 #pragma unused(arg1, arg2)
2153 	u_int32_t new_value = 0, *space_p = NULL;
2154 	int changed = 0, error = 0;
2155 	u_quad_t sb_effective_max = (sb_max / (MSIZE + MCLBYTES)) * MCLBYTES;
2156 
2157 	switch (oidp->oid_number) {
2158 	case UDPCTL_RECVSPACE:
2159 		space_p = &udp_recvspace;
2160 		break;
2161 	case UDPCTL_MAXDGRAM:
2162 		space_p = &udp_sendspace;
2163 		break;
2164 	default:
2165 		return EINVAL;
2166 	}
2167 	error = sysctl_io_number(req, *space_p, sizeof(u_int32_t),
2168 	    &new_value, &changed);
2169 	if (changed) {
2170 		if (new_value > 0 && new_value <= sb_effective_max) {
2171 			*space_p = new_value;
2172 		} else {
2173 			error = ERANGE;
2174 		}
2175 	}
2176 	return error;
2177 }
2178 
2179 SYSCTL_PROC(_net_inet_udp, UDPCTL_RECVSPACE, recvspace,
2180     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &udp_recvspace, 0,
2181     &sysctl_udp_sospace, "IU", "Maximum incoming UDP datagram size");
2182 
2183 SYSCTL_PROC(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram,
2184     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &udp_sendspace, 0,
2185     &sysctl_udp_sospace, "IU", "Maximum outgoing UDP datagram size");
2186 
2187 int
udp_abort(struct socket * so)2188 udp_abort(struct socket *so)
2189 {
2190 	struct inpcb *inp;
2191 
2192 	inp = sotoinpcb(so);
2193 	if (inp == NULL) {
2194 		panic("%s: so=%p null inp", __func__, so);
2195 		/* NOTREACHED */
2196 	}
2197 	soisdisconnected(so);
2198 	in_pcbdetach(inp);
2199 	return 0;
2200 }
2201 
2202 int
udp_attach(struct socket * so,int proto,struct proc * p)2203 udp_attach(struct socket *so, int proto, struct proc *p)
2204 {
2205 #pragma unused(proto)
2206 	struct inpcb *inp;
2207 	int error;
2208 
2209 	error = soreserve(so, udp_sendspace, udp_recvspace);
2210 	if (error != 0) {
2211 		return error;
2212 	}
2213 	inp = sotoinpcb(so);
2214 	if (inp != NULL) {
2215 		panic("%s so=%p inp=%p", __func__, so, inp);
2216 		/* NOTREACHED */
2217 	}
2218 	error = in_pcballoc(so, &udbinfo, p);
2219 	if (error != 0) {
2220 		return error;
2221 	}
2222 	inp = (struct inpcb *)so->so_pcb;
2223 	inp->inp_vflag |= INP_IPV4;
2224 	inp->inp_ip_ttl = (uint8_t)ip_defttl;
2225 	if (nstat_collect) {
2226 		nstat_udp_new_pcb(inp);
2227 	}
2228 	return 0;
2229 }
2230 
2231 int
udp_bind(struct socket * so,struct sockaddr * nam,struct proc * p)2232 udp_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
2233 {
2234 	struct inpcb *inp;
2235 	int error;
2236 
2237 	if (nam->sa_family != 0 && nam->sa_family != AF_INET &&
2238 	    nam->sa_family != AF_INET6) {
2239 		return EAFNOSUPPORT;
2240 	}
2241 
2242 	inp = sotoinpcb(so);
2243 	if (inp == NULL) {
2244 		return EINVAL;
2245 	}
2246 	error = in_pcbbind(inp, nam, p);
2247 
2248 #if NECP
2249 	/* Update NECP client with bind result if not in middle of connect */
2250 	if (error == 0 &&
2251 	    (inp->inp_flags2 & INP2_CONNECT_IN_PROGRESS) &&
2252 	    !uuid_is_null(inp->necp_client_uuid)) {
2253 		socket_unlock(so, 0);
2254 		necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
2255 		socket_lock(so, 0);
2256 	}
2257 #endif /* NECP */
2258 
2259 	return error;
2260 }
2261 
2262 int
udp_connect(struct socket * so,struct sockaddr * nam,struct proc * p)2263 udp_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
2264 {
2265 	struct inpcb *inp;
2266 	int error;
2267 
2268 	inp = sotoinpcb(so);
2269 	if (inp == NULL) {
2270 		return EINVAL;
2271 	}
2272 	if (inp->inp_faddr.s_addr != INADDR_ANY) {
2273 		return EISCONN;
2274 	}
2275 
2276 	if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
2277 		so->so_flags1 |= SOF1_CONNECT_COUNTED;
2278 		INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
2279 	}
2280 
2281 #if NECP
2282 #if FLOW_DIVERT
2283 	if (necp_socket_should_use_flow_divert(inp)) {
2284 		error = flow_divert_pcb_init(so);
2285 		if (error == 0) {
2286 			error = flow_divert_connect_out(so, nam, p);
2287 		}
2288 		return error;
2289 	}
2290 #endif /* FLOW_DIVERT */
2291 #endif /* NECP */
2292 
2293 	error = in_pcbconnect(inp, nam, p, IFSCOPE_NONE, NULL);
2294 	if (error == 0) {
2295 #if NECP
2296 		/* Update NECP client with connected five-tuple */
2297 		if (!uuid_is_null(inp->necp_client_uuid)) {
2298 			socket_unlock(so, 0);
2299 			necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
2300 			socket_lock(so, 0);
2301 		}
2302 #endif /* NECP */
2303 
2304 		soisconnected(so);
2305 		if (inp->inp_flowhash == 0) {
2306 			inp_calc_flowhash(inp);
2307 			ASSERT(inp->inp_flowhash != 0);
2308 		}
2309 	}
2310 	return error;
2311 }
2312 
2313 int
udp_connectx_common(struct socket * so,int af,struct sockaddr * src,struct sockaddr * dst,struct proc * p,uint32_t ifscope,sae_associd_t aid,sae_connid_t * pcid,uint32_t flags,void * arg,uint32_t arglen,struct uio * uio,user_ssize_t * bytes_written)2314 udp_connectx_common(struct socket *so, int af, struct sockaddr *src, struct sockaddr *dst,
2315     struct proc *p, uint32_t ifscope, sae_associd_t aid, sae_connid_t *pcid,
2316     uint32_t flags, void *arg, uint32_t arglen,
2317     struct uio *uio, user_ssize_t *bytes_written)
2318 {
2319 #pragma unused(aid, flags, arg, arglen)
2320 	struct inpcb *inp = sotoinpcb(so);
2321 	int error = 0;
2322 	user_ssize_t datalen = 0;
2323 
2324 	if (inp == NULL) {
2325 		return EINVAL;
2326 	}
2327 
2328 	VERIFY(dst != NULL);
2329 
2330 	ASSERT(!(inp->inp_flags2 & INP2_CONNECT_IN_PROGRESS));
2331 	inp->inp_flags2 |= INP2_CONNECT_IN_PROGRESS;
2332 
2333 #if NECP
2334 	inp_update_necp_policy(inp, src, dst, ifscope);
2335 #endif /* NECP */
2336 
2337 	/* bind socket to the specified interface, if requested */
2338 	if (ifscope != IFSCOPE_NONE &&
2339 	    (error = inp_bindif(inp, ifscope, NULL)) != 0) {
2340 		goto done;
2341 	}
2342 
2343 	/* if source address and/or port is specified, bind to it */
2344 	if (src != NULL) {
2345 		error = sobindlock(so, src, 0); /* already locked */
2346 		if (error != 0) {
2347 			goto done;
2348 		}
2349 	}
2350 
2351 	switch (af) {
2352 	case AF_INET:
2353 		error = udp_connect(so, dst, p);
2354 		break;
2355 	case AF_INET6:
2356 		error = udp6_connect(so, dst, p);
2357 		break;
2358 	default:
2359 		VERIFY(0);
2360 		/* NOTREACHED */
2361 	}
2362 
2363 	if (error != 0) {
2364 		goto done;
2365 	}
2366 
2367 	/*
2368 	 * If there is data, copy it. DATA_IDEMPOTENT is ignored.
2369 	 * CONNECT_RESUME_ON_READ_WRITE is ignored.
2370 	 */
2371 	if (uio != NULL) {
2372 		socket_unlock(so, 0);
2373 
2374 		VERIFY(bytes_written != NULL);
2375 
2376 		datalen = uio_resid(uio);
2377 		error = so->so_proto->pr_usrreqs->pru_sosend(so, NULL,
2378 		    (uio_t)uio, NULL, NULL, 0);
2379 		socket_lock(so, 0);
2380 
2381 		/* If error returned is EMSGSIZE, for example, disconnect */
2382 		if (error == 0 || error == EWOULDBLOCK) {
2383 			*bytes_written = datalen - uio_resid(uio);
2384 		} else {
2385 			(void) so->so_proto->pr_usrreqs->pru_disconnectx(so,
2386 			    SAE_ASSOCID_ANY, SAE_CONNID_ANY);
2387 		}
2388 		/*
2389 		 * mask the EWOULDBLOCK error so that the caller
2390 		 * knows that atleast the connect was successful.
2391 		 */
2392 		if (error == EWOULDBLOCK) {
2393 			error = 0;
2394 		}
2395 	}
2396 
2397 	if (error == 0 && pcid != NULL) {
2398 		*pcid = 1;      /* there is only 1 connection for UDP */
2399 	}
2400 done:
2401 	inp->inp_flags2 &= ~INP2_CONNECT_IN_PROGRESS;
2402 	return error;
2403 }
2404 
2405 int
udp_connectx(struct socket * so,struct sockaddr * src,struct sockaddr * dst,struct proc * p,uint32_t ifscope,sae_associd_t aid,sae_connid_t * pcid,uint32_t flags,void * arg,uint32_t arglen,struct uio * uio,user_ssize_t * bytes_written)2406 udp_connectx(struct socket *so, struct sockaddr *src,
2407     struct sockaddr *dst, struct proc *p, uint32_t ifscope,
2408     sae_associd_t aid, sae_connid_t *pcid, uint32_t flags, void *arg,
2409     uint32_t arglen, struct uio *uio, user_ssize_t *bytes_written)
2410 {
2411 	return udp_connectx_common(so, AF_INET, src, dst,
2412 	           p, ifscope, aid, pcid, flags, arg, arglen, uio, bytes_written);
2413 }
2414 
2415 int
udp_detach(struct socket * so)2416 udp_detach(struct socket *so)
2417 {
2418 	struct inpcb *inp;
2419 
2420 	inp = sotoinpcb(so);
2421 	if (inp == NULL) {
2422 		panic("%s: so=%p null inp", __func__, so);
2423 		/* NOTREACHED */
2424 	}
2425 
2426 	/*
2427 	 * If this is a socket that does not want to wakeup the device
2428 	 * for it's traffic, the application might be waiting for
2429 	 * close to complete before going to sleep. Send a notification
2430 	 * for this kind of sockets
2431 	 */
2432 	if (so->so_options & SO_NOWAKEFROMSLEEP) {
2433 		socket_post_kev_msg_closed(so);
2434 	}
2435 
2436 	in_pcbdetach(inp);
2437 	inp->inp_state = INPCB_STATE_DEAD;
2438 	return 0;
2439 }
2440 
2441 int
udp_disconnect(struct socket * so)2442 udp_disconnect(struct socket *so)
2443 {
2444 	struct inpcb *inp;
2445 
2446 	inp = sotoinpcb(so);
2447 	if (inp == NULL) {
2448 		return EINVAL;
2449 	}
2450 	if (inp->inp_faddr.s_addr == INADDR_ANY) {
2451 		return ENOTCONN;
2452 	}
2453 
2454 	in_pcbdisconnect(inp);
2455 
2456 	/* reset flow controlled state, just in case */
2457 	inp_reset_fc_state(inp);
2458 
2459 	inp->inp_laddr.s_addr = INADDR_ANY;
2460 	so->so_state &= ~SS_ISCONNECTED;                /* XXX */
2461 	inp->inp_last_outifp = NULL;
2462 #if SKYWALK
2463 	if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2464 		netns_set_ifnet(&inp->inp_netns_token, NULL);
2465 	}
2466 #endif /* SKYWALK */
2467 
2468 	return 0;
2469 }
2470 
2471 int
udp_disconnectx(struct socket * so,sae_associd_t aid,sae_connid_t cid)2472 udp_disconnectx(struct socket *so, sae_associd_t aid, sae_connid_t cid)
2473 {
2474 #pragma unused(cid)
2475 	if (aid != SAE_ASSOCID_ANY && aid != SAE_ASSOCID_ALL) {
2476 		return EINVAL;
2477 	}
2478 
2479 	return udp_disconnect(so);
2480 }
2481 
2482 int
udp_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * addr,struct mbuf * control,struct proc * p)2483 udp_send(struct socket *so, int flags, struct mbuf *m,
2484     struct sockaddr *addr, struct mbuf *control, struct proc *p)
2485 {
2486 #ifndef FLOW_DIVERT
2487 #pragma unused(flags)
2488 #endif /* !(FLOW_DIVERT) */
2489 	struct inpcb *inp;
2490 	int error;
2491 
2492 	inp = sotoinpcb(so);
2493 	if (inp == NULL) {
2494 		if (m != NULL) {
2495 			m_freem(m);
2496 		}
2497 		if (control != NULL) {
2498 			m_freem(control);
2499 		}
2500 		return EINVAL;
2501 	}
2502 
2503 #if NECP
2504 #if FLOW_DIVERT
2505 	if (necp_socket_should_use_flow_divert(inp)) {
2506 		/* Implicit connect */
2507 		return flow_divert_implicit_data_out(so, flags, m, addr,
2508 		           control, p);
2509 	}
2510 #endif /* FLOW_DIVERT */
2511 #endif /* NECP */
2512 
2513 #if SKYWALK
2514 	sk_protect_t protect = sk_async_transmit_protect();
2515 #endif /* SKYWALK */
2516 	error = udp_output(inp, m, addr, control, p);
2517 #if SKYWALK
2518 	sk_async_transmit_unprotect(protect);
2519 #endif /* SKYWALK */
2520 
2521 	return error;
2522 }
2523 
2524 int
udp_shutdown(struct socket * so)2525 udp_shutdown(struct socket *so)
2526 {
2527 	struct inpcb *inp;
2528 
2529 	inp = sotoinpcb(so);
2530 	if (inp == NULL) {
2531 		return EINVAL;
2532 	}
2533 	socantsendmore(so);
2534 	return 0;
2535 }
2536 
2537 int
udp_lock(struct socket * so,int refcount,void * debug)2538 udp_lock(struct socket *so, int refcount, void *debug)
2539 {
2540 	void *lr_saved;
2541 
2542 	if (debug == NULL) {
2543 		lr_saved = __builtin_return_address(0);
2544 	} else {
2545 		lr_saved = debug;
2546 	}
2547 
2548 	if (so->so_pcb != NULL) {
2549 		LCK_MTX_ASSERT(&((struct inpcb *)so->so_pcb)->inpcb_mtx,
2550 		    LCK_MTX_ASSERT_NOTOWNED);
2551 		lck_mtx_lock(&((struct inpcb *)so->so_pcb)->inpcb_mtx);
2552 	} else {
2553 		panic("%s: so=%p NO PCB! lr=%p lrh= %s", __func__,
2554 		    so, lr_saved, solockhistory_nr(so));
2555 		/* NOTREACHED */
2556 	}
2557 	if (refcount) {
2558 		so->so_usecount++;
2559 	}
2560 
2561 	so->lock_lr[so->next_lock_lr] = lr_saved;
2562 	so->next_lock_lr = (so->next_lock_lr + 1) % SO_LCKDBG_MAX;
2563 	return 0;
2564 }
2565 
2566 int
udp_unlock(struct socket * so,int refcount,void * debug)2567 udp_unlock(struct socket *so, int refcount, void *debug)
2568 {
2569 	void *lr_saved;
2570 
2571 	if (debug == NULL) {
2572 		lr_saved = __builtin_return_address(0);
2573 	} else {
2574 		lr_saved = debug;
2575 	}
2576 
2577 	if (refcount) {
2578 		VERIFY(so->so_usecount > 0);
2579 		so->so_usecount--;
2580 	}
2581 	if (so->so_pcb == NULL) {
2582 		panic("%s: so=%p NO PCB! lr=%p lrh= %s", __func__,
2583 		    so, lr_saved, solockhistory_nr(so));
2584 		/* NOTREACHED */
2585 	} else {
2586 		LCK_MTX_ASSERT(&((struct inpcb *)so->so_pcb)->inpcb_mtx,
2587 		    LCK_MTX_ASSERT_OWNED);
2588 		so->unlock_lr[so->next_unlock_lr] = lr_saved;
2589 		so->next_unlock_lr = (so->next_unlock_lr + 1) % SO_LCKDBG_MAX;
2590 		lck_mtx_unlock(&((struct inpcb *)so->so_pcb)->inpcb_mtx);
2591 	}
2592 	return 0;
2593 }
2594 
2595 lck_mtx_t *
udp_getlock(struct socket * so,int flags)2596 udp_getlock(struct socket *so, int flags)
2597 {
2598 #pragma unused(flags)
2599 	struct inpcb *inp = sotoinpcb(so);
2600 
2601 	if (so->so_pcb == NULL) {
2602 		panic("%s: so=%p NULL so_pcb lrh= %s", __func__,
2603 		    so, solockhistory_nr(so));
2604 		/* NOTREACHED */
2605 	}
2606 	return &inp->inpcb_mtx;
2607 }
2608 
2609 /*
2610  * UDP garbage collector callback (inpcb_timer_func_t).
2611  *
2612  * Returns > 0 to keep timer active.
2613  */
2614 static void
udp_gc(struct inpcbinfo * ipi)2615 udp_gc(struct inpcbinfo *ipi)
2616 {
2617 	struct inpcb *inp, *inpnxt;
2618 	struct socket *so;
2619 
2620 	if (lck_rw_try_lock_exclusive(&ipi->ipi_lock) == FALSE) {
2621 		if (udp_gc_done == TRUE) {
2622 			udp_gc_done = FALSE;
2623 			/* couldn't get the lock, must lock next time */
2624 			atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2625 			return;
2626 		}
2627 		lck_rw_lock_exclusive(&ipi->ipi_lock);
2628 	}
2629 
2630 	udp_gc_done = TRUE;
2631 
2632 	for (inp = udb.lh_first; inp != NULL; inp = inpnxt) {
2633 		inpnxt = inp->inp_list.le_next;
2634 
2635 		/*
2636 		 * Skip unless it's STOPUSING; garbage collector will
2637 		 * be triggered by in_pcb_checkstate() upon setting
2638 		 * wantcnt to that value.  If the PCB is already dead,
2639 		 * keep gc active to anticipate wantcnt changing.
2640 		 */
2641 		if (inp->inp_wantcnt != WNT_STOPUSING) {
2642 			continue;
2643 		}
2644 
2645 		/*
2646 		 * Skip if busy, no hurry for cleanup.  Keep gc active
2647 		 * and try the lock again during next round.
2648 		 */
2649 		if (!socket_try_lock(inp->inp_socket)) {
2650 			atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2651 			continue;
2652 		}
2653 
2654 		/*
2655 		 * Keep gc active unless usecount is 0.
2656 		 */
2657 		so = inp->inp_socket;
2658 		if (so->so_usecount == 0) {
2659 			if (inp->inp_state != INPCB_STATE_DEAD) {
2660 				if (SOCK_CHECK_DOM(so, PF_INET6)) {
2661 					in6_pcbdetach(inp);
2662 				} else {
2663 					in_pcbdetach(inp);
2664 				}
2665 			}
2666 			in_pcbdispose(inp);
2667 		} else {
2668 			socket_unlock(so, 0);
2669 			atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2670 		}
2671 	}
2672 	lck_rw_done(&ipi->ipi_lock);
2673 }
2674 
2675 static int
2676 udp_getstat SYSCTL_HANDLER_ARGS
2677 {
2678 #pragma unused(oidp, arg1, arg2)
2679 	if (req->oldptr == USER_ADDR_NULL) {
2680 		req->oldlen = (size_t)sizeof(struct udpstat);
2681 	}
2682 
2683 	return SYSCTL_OUT(req, &udpstat, MIN(sizeof(udpstat), req->oldlen));
2684 }
2685 
2686 void
udp_in_cksum_stats(u_int32_t len)2687 udp_in_cksum_stats(u_int32_t len)
2688 {
2689 	udpstat.udps_rcv_swcsum++;
2690 	udpstat.udps_rcv_swcsum_bytes += len;
2691 }
2692 
2693 void
udp_out_cksum_stats(u_int32_t len)2694 udp_out_cksum_stats(u_int32_t len)
2695 {
2696 	udpstat.udps_snd_swcsum++;
2697 	udpstat.udps_snd_swcsum_bytes += len;
2698 }
2699 
2700 void
udp_in6_cksum_stats(u_int32_t len)2701 udp_in6_cksum_stats(u_int32_t len)
2702 {
2703 	udpstat.udps_rcv6_swcsum++;
2704 	udpstat.udps_rcv6_swcsum_bytes += len;
2705 }
2706 
2707 void
udp_out6_cksum_stats(u_int32_t len)2708 udp_out6_cksum_stats(u_int32_t len)
2709 {
2710 	udpstat.udps_snd6_swcsum++;
2711 	udpstat.udps_snd6_swcsum_bytes += len;
2712 }
2713 
2714 /*
2715  * Checksum extended UDP header and data.
2716  */
2717 static int
udp_input_checksum(struct mbuf * m,struct udphdr * uh,int off,int ulen)2718 udp_input_checksum(struct mbuf *m, struct udphdr *uh, int off, int ulen)
2719 {
2720 	struct ifnet *ifp = m->m_pkthdr.rcvif;
2721 	struct ip *ip = mtod(m, struct ip *);
2722 	struct ipovly *ipov = (struct ipovly *)ip;
2723 
2724 	if (uh->uh_sum == 0) {
2725 		udpstat.udps_nosum++;
2726 		return 0;
2727 	}
2728 
2729 	/* ip_stripoptions() must have been called before we get here */
2730 	ASSERT((ip->ip_hl << 2) == sizeof(*ip));
2731 
2732 	if ((hwcksum_rx || (ifp->if_flags & IFF_LOOPBACK) ||
2733 	    (m->m_pkthdr.pkt_flags & PKTF_LOOP)) &&
2734 	    (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)) {
2735 		if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
2736 			uh->uh_sum = m->m_pkthdr.csum_rx_val;
2737 		} else {
2738 			uint32_t sum = m->m_pkthdr.csum_rx_val;
2739 			uint32_t start = m->m_pkthdr.csum_rx_start;
2740 			int32_t trailer = (m_pktlen(m) - (off + ulen));
2741 
2742 			/*
2743 			 * Perform 1's complement adjustment of octets
2744 			 * that got included/excluded in the hardware-
2745 			 * calculated checksum value.  Ignore cases
2746 			 * where the value already includes the entire
2747 			 * IP header span, as the sum for those octets
2748 			 * would already be 0 by the time we get here;
2749 			 * IP has already performed its header checksum
2750 			 * checks.  If we do need to adjust, restore
2751 			 * the original fields in the IP header when
2752 			 * computing the adjustment value.  Also take
2753 			 * care of any trailing bytes and subtract out
2754 			 * their partial sum.
2755 			 */
2756 			ASSERT(trailer >= 0);
2757 			if ((m->m_pkthdr.csum_flags & CSUM_PARTIAL) &&
2758 			    ((start != 0 && start != off) || trailer != 0)) {
2759 				uint32_t swbytes = (uint32_t)trailer;
2760 
2761 				if (start < off) {
2762 					ip->ip_len += sizeof(*ip);
2763 #if BYTE_ORDER != BIG_ENDIAN
2764 					HTONS(ip->ip_len);
2765 					HTONS(ip->ip_off);
2766 #endif /* BYTE_ORDER != BIG_ENDIAN */
2767 				}
2768 				/* callee folds in sum */
2769 				sum = m_adj_sum16(m, start, off, ulen, sum);
2770 				if (off > start) {
2771 					swbytes += (off - start);
2772 				} else {
2773 					swbytes += (start - off);
2774 				}
2775 
2776 				if (start < off) {
2777 #if BYTE_ORDER != BIG_ENDIAN
2778 					NTOHS(ip->ip_off);
2779 					NTOHS(ip->ip_len);
2780 #endif /* BYTE_ORDER != BIG_ENDIAN */
2781 					ip->ip_len -= sizeof(*ip);
2782 				}
2783 
2784 				if (swbytes != 0) {
2785 					udp_in_cksum_stats(swbytes);
2786 				}
2787 				if (trailer != 0) {
2788 					m_adj(m, -trailer);
2789 				}
2790 			}
2791 
2792 			/* callee folds in sum */
2793 			uh->uh_sum = in_pseudo(ip->ip_src.s_addr,
2794 			    ip->ip_dst.s_addr, sum + htonl(ulen + IPPROTO_UDP));
2795 		}
2796 		uh->uh_sum ^= 0xffff;
2797 	} else {
2798 		uint16_t ip_sum;
2799 		char b[9];
2800 
2801 		bcopy(ipov->ih_x1, b, sizeof(ipov->ih_x1));
2802 		bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
2803 		ip_sum = ipov->ih_len;
2804 		ipov->ih_len = uh->uh_ulen;
2805 		uh->uh_sum = in_cksum(m, ulen + sizeof(struct ip));
2806 		bcopy(b, ipov->ih_x1, sizeof(ipov->ih_x1));
2807 		ipov->ih_len = ip_sum;
2808 
2809 		udp_in_cksum_stats(ulen);
2810 	}
2811 
2812 	if (uh->uh_sum != 0) {
2813 		udpstat.udps_badsum++;
2814 		IF_UDP_STATINC(ifp, badchksum);
2815 		return -1;
2816 	}
2817 
2818 	return 0;
2819 }
2820 
2821 void
udp_fill_keepalive_offload_frames(ifnet_t ifp,struct ifnet_keepalive_offload_frame * frames_array,u_int32_t frames_array_count,size_t frame_data_offset,u_int32_t * used_frames_count)2822 udp_fill_keepalive_offload_frames(ifnet_t ifp,
2823     struct ifnet_keepalive_offload_frame *frames_array,
2824     u_int32_t frames_array_count, size_t frame_data_offset,
2825     u_int32_t *used_frames_count)
2826 {
2827 	struct inpcb *inp;
2828 	inp_gen_t gencnt;
2829 	u_int32_t frame_index = *used_frames_count;
2830 
2831 	if (ifp == NULL || frames_array == NULL ||
2832 	    frames_array_count == 0 ||
2833 	    frame_index >= frames_array_count ||
2834 	    frame_data_offset >= IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2835 		return;
2836 	}
2837 
2838 	lck_rw_lock_shared(&udbinfo.ipi_lock);
2839 	gencnt = udbinfo.ipi_gencnt;
2840 	LIST_FOREACH(inp, udbinfo.ipi_listhead, inp_list) {
2841 		struct socket *so;
2842 		u_int8_t *data;
2843 		struct ifnet_keepalive_offload_frame *frame;
2844 		struct mbuf *m = NULL;
2845 
2846 		if (frame_index >= frames_array_count) {
2847 			break;
2848 		}
2849 
2850 		if (inp->inp_gencnt > gencnt ||
2851 		    inp->inp_state == INPCB_STATE_DEAD) {
2852 			continue;
2853 		}
2854 
2855 		if ((so = inp->inp_socket) == NULL ||
2856 		    (so->so_state & SS_DEFUNCT)) {
2857 			continue;
2858 		}
2859 		/*
2860 		 * check for keepalive offload flag without socket
2861 		 * lock to avoid a deadlock
2862 		 */
2863 		if (!(inp->inp_flags2 & INP2_KEEPALIVE_OFFLOAD)) {
2864 			continue;
2865 		}
2866 
2867 		udp_lock(so, 1, 0);
2868 		if (!(inp->inp_vflag & (INP_IPV4 | INP_IPV6))) {
2869 			udp_unlock(so, 1, 0);
2870 			continue;
2871 		}
2872 		if ((inp->inp_vflag & INP_IPV4) &&
2873 		    (inp->inp_laddr.s_addr == INADDR_ANY ||
2874 		    inp->inp_faddr.s_addr == INADDR_ANY)) {
2875 			udp_unlock(so, 1, 0);
2876 			continue;
2877 		}
2878 		if ((inp->inp_vflag & INP_IPV6) &&
2879 		    (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) ||
2880 		    IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))) {
2881 			udp_unlock(so, 1, 0);
2882 			continue;
2883 		}
2884 		if (inp->inp_lport == 0 || inp->inp_fport == 0) {
2885 			udp_unlock(so, 1, 0);
2886 			continue;
2887 		}
2888 		if (inp->inp_last_outifp == NULL ||
2889 		    inp->inp_last_outifp->if_index != ifp->if_index) {
2890 			udp_unlock(so, 1, 0);
2891 			continue;
2892 		}
2893 		if ((inp->inp_vflag & INP_IPV4)) {
2894 			if ((frame_data_offset + sizeof(struct udpiphdr) +
2895 			    inp->inp_keepalive_datalen) >
2896 			    IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2897 				udp_unlock(so, 1, 0);
2898 				continue;
2899 			}
2900 			if ((sizeof(struct udpiphdr) +
2901 			    inp->inp_keepalive_datalen) > _MHLEN) {
2902 				udp_unlock(so, 1, 0);
2903 				continue;
2904 			}
2905 		} else {
2906 			if ((frame_data_offset + sizeof(struct ip6_hdr) +
2907 			    sizeof(struct udphdr) +
2908 			    inp->inp_keepalive_datalen) >
2909 			    IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2910 				udp_unlock(so, 1, 0);
2911 				continue;
2912 			}
2913 			if ((sizeof(struct ip6_hdr) + sizeof(struct udphdr) +
2914 			    inp->inp_keepalive_datalen) > _MHLEN) {
2915 				udp_unlock(so, 1, 0);
2916 				continue;
2917 			}
2918 		}
2919 		MGETHDR(m, M_WAIT, MT_HEADER);
2920 		if (m == NULL) {
2921 			udp_unlock(so, 1, 0);
2922 			continue;
2923 		}
2924 		/*
2925 		 * This inp has all the information that is needed to
2926 		 * generate an offload frame.
2927 		 */
2928 		if (inp->inp_vflag & INP_IPV4) {
2929 			struct ip *ip;
2930 			struct udphdr *udp;
2931 
2932 			frame = &frames_array[frame_index];
2933 			frame->length = (uint8_t)(frame_data_offset +
2934 			    sizeof(struct udpiphdr) +
2935 			    inp->inp_keepalive_datalen);
2936 			frame->ether_type =
2937 			    IFNET_KEEPALIVE_OFFLOAD_FRAME_ETHERTYPE_IPV4;
2938 			frame->interval = inp->inp_keepalive_interval;
2939 			switch (inp->inp_keepalive_type) {
2940 			case UDP_KEEPALIVE_OFFLOAD_TYPE_AIRPLAY:
2941 				frame->type =
2942 				    IFNET_KEEPALIVE_OFFLOAD_FRAME_AIRPLAY;
2943 				break;
2944 			default:
2945 				break;
2946 			}
2947 			data = mtod(m, u_int8_t *);
2948 			bzero(data, sizeof(struct udpiphdr));
2949 			ip = (__typeof__(ip))(void *)data;
2950 			udp = (__typeof__(udp))(void *) (data +
2951 			    sizeof(struct ip));
2952 			m->m_len = sizeof(struct udpiphdr);
2953 			data = data + sizeof(struct udpiphdr);
2954 			if (inp->inp_keepalive_datalen > 0 &&
2955 			    inp->inp_keepalive_data != NULL) {
2956 				bcopy(inp->inp_keepalive_data, data,
2957 				    inp->inp_keepalive_datalen);
2958 				m->m_len += inp->inp_keepalive_datalen;
2959 			}
2960 			m->m_pkthdr.len = m->m_len;
2961 
2962 			ip->ip_v = IPVERSION;
2963 			ip->ip_hl = (sizeof(struct ip) >> 2);
2964 			ip->ip_p = IPPROTO_UDP;
2965 			ip->ip_len = htons(sizeof(struct udpiphdr) +
2966 			    (u_short)inp->inp_keepalive_datalen);
2967 			ip->ip_ttl = inp->inp_ip_ttl;
2968 			ip->ip_tos |= (inp->inp_ip_tos & ~IPTOS_ECN_MASK);
2969 			ip->ip_src = inp->inp_laddr;
2970 			ip->ip_dst = inp->inp_faddr;
2971 			ip->ip_sum = in_cksum_hdr_opt(ip);
2972 
2973 			udp->uh_sport = inp->inp_lport;
2974 			udp->uh_dport = inp->inp_fport;
2975 			udp->uh_ulen = htons(sizeof(struct udphdr) +
2976 			    (u_short)inp->inp_keepalive_datalen);
2977 
2978 			if (!(inp->inp_flags & INP_UDP_NOCKSUM)) {
2979 				udp->uh_sum = in_pseudo(ip->ip_src.s_addr,
2980 				    ip->ip_dst.s_addr,
2981 				    htons(sizeof(struct udphdr) +
2982 				    (u_short)inp->inp_keepalive_datalen +
2983 				    IPPROTO_UDP));
2984 				m->m_pkthdr.csum_flags =
2985 				    (CSUM_UDP | CSUM_ZERO_INVERT);
2986 				m->m_pkthdr.csum_data = offsetof(struct udphdr,
2987 				    uh_sum);
2988 			}
2989 			m->m_pkthdr.pkt_proto = IPPROTO_UDP;
2990 			in_delayed_cksum(m);
2991 			bcopy(m->m_data, frame->data + frame_data_offset,
2992 			    m->m_len);
2993 		} else {
2994 			struct ip6_hdr *ip6;
2995 			struct udphdr *udp6;
2996 
2997 			VERIFY(inp->inp_vflag & INP_IPV6);
2998 			frame = &frames_array[frame_index];
2999 			frame->length = (uint8_t)(frame_data_offset +
3000 			    sizeof(struct ip6_hdr) +
3001 			    sizeof(struct udphdr) +
3002 			    inp->inp_keepalive_datalen);
3003 			frame->ether_type =
3004 			    IFNET_KEEPALIVE_OFFLOAD_FRAME_ETHERTYPE_IPV6;
3005 			frame->interval = inp->inp_keepalive_interval;
3006 			switch (inp->inp_keepalive_type) {
3007 			case UDP_KEEPALIVE_OFFLOAD_TYPE_AIRPLAY:
3008 				frame->type =
3009 				    IFNET_KEEPALIVE_OFFLOAD_FRAME_AIRPLAY;
3010 				break;
3011 			default:
3012 				break;
3013 			}
3014 			data = mtod(m, u_int8_t *);
3015 			bzero(data, sizeof(struct ip6_hdr) + sizeof(struct udphdr));
3016 			ip6 = (__typeof__(ip6))(void *)data;
3017 			udp6 = (__typeof__(udp6))(void *)(data +
3018 			    sizeof(struct ip6_hdr));
3019 			m->m_len = sizeof(struct ip6_hdr) +
3020 			    sizeof(struct udphdr);
3021 			data = data + (sizeof(struct ip6_hdr) +
3022 			    sizeof(struct udphdr));
3023 			if (inp->inp_keepalive_datalen > 0 &&
3024 			    inp->inp_keepalive_data != NULL) {
3025 				bcopy(inp->inp_keepalive_data, data,
3026 				    inp->inp_keepalive_datalen);
3027 				m->m_len += inp->inp_keepalive_datalen;
3028 			}
3029 			m->m_pkthdr.len = m->m_len;
3030 			ip6->ip6_flow = inp->inp_flow & IPV6_FLOWINFO_MASK;
3031 			ip6->ip6_flow = ip6->ip6_flow & ~IPV6_FLOW_ECN_MASK;
3032 			ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
3033 			ip6->ip6_vfc |= IPV6_VERSION;
3034 			ip6->ip6_nxt = IPPROTO_UDP;
3035 			ip6->ip6_hlim = (uint8_t)ip6_defhlim;
3036 			ip6->ip6_plen = htons(sizeof(struct udphdr) +
3037 			    (u_short)inp->inp_keepalive_datalen);
3038 			ip6->ip6_src = inp->in6p_laddr;
3039 			if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
3040 				ip6->ip6_src.s6_addr16[1] = 0;
3041 			}
3042 
3043 			ip6->ip6_dst = inp->in6p_faddr;
3044 			if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
3045 				ip6->ip6_dst.s6_addr16[1] = 0;
3046 			}
3047 
3048 			udp6->uh_sport = inp->in6p_lport;
3049 			udp6->uh_dport = inp->in6p_fport;
3050 			udp6->uh_ulen = htons(sizeof(struct udphdr) +
3051 			    (u_short)inp->inp_keepalive_datalen);
3052 			if (!(inp->inp_flags & INP_UDP_NOCKSUM)) {
3053 				udp6->uh_sum = in6_pseudo(&ip6->ip6_src,
3054 				    &ip6->ip6_dst,
3055 				    htonl(sizeof(struct udphdr) +
3056 				    (u_short)inp->inp_keepalive_datalen +
3057 				    IPPROTO_UDP));
3058 				m->m_pkthdr.csum_flags =
3059 				    (CSUM_UDPIPV6 | CSUM_ZERO_INVERT);
3060 				m->m_pkthdr.csum_data = offsetof(struct udphdr,
3061 				    uh_sum);
3062 			}
3063 			m->m_pkthdr.pkt_proto = IPPROTO_UDP;
3064 			in6_delayed_cksum(m);
3065 			bcopy(m->m_data, frame->data + frame_data_offset,
3066 			    m->m_len);
3067 		}
3068 		if (m != NULL) {
3069 			m_freem(m);
3070 			m = NULL;
3071 		}
3072 		frame_index++;
3073 		udp_unlock(so, 1, 0);
3074 	}
3075 	lck_rw_done(&udbinfo.ipi_lock);
3076 	*used_frames_count = frame_index;
3077 }
3078 
3079 int
udp_defunct(struct socket * so)3080 udp_defunct(struct socket *so)
3081 {
3082 	struct ip_moptions *imo;
3083 	struct inpcb *inp;
3084 
3085 	inp = sotoinpcb(so);
3086 	if (inp == NULL) {
3087 		return EINVAL;
3088 	}
3089 
3090 	imo = inp->inp_moptions;
3091 	if (imo != NULL) {
3092 		struct proc *p = current_proc();
3093 
3094 		SODEFUNCTLOG("%s[%d, %s]: defuncting so 0x%llu drop multicast memberships",
3095 		    __func__, proc_pid(p), proc_best_name(p),
3096 		    so->so_gencnt);
3097 
3098 		inp->inp_moptions = NULL;
3099 
3100 		IMO_REMREF(imo);
3101 	}
3102 
3103 	return 0;
3104 }
3105