1 /*
2 * Copyright (c) 2000-2022 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /* $FreeBSD: src/sys/netinet6/udp6_usrreq.c,v 1.6.2.6 2001/07/29 19:32:40 ume Exp $ */
30 /* $KAME: udp6_usrreq.c,v 1.27 2001/05/21 05:45:10 jinmei Exp $ */
31
32 /*
33 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
34 * All rights reserved.
35 *
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
38 * are met:
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. Neither the name of the project nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 */
60
61 /*
62 * Copyright (c) 1982, 1986, 1989, 1993
63 * The Regents of the University of California. All rights reserved.
64 *
65 * Redistribution and use in source and binary forms, with or without
66 * modification, are permitted provided that the following conditions
67 * are met:
68 * 1. Redistributions of source code must retain the above copyright
69 * notice, this list of conditions and the following disclaimer.
70 * 2. Redistributions in binary form must reproduce the above copyright
71 * notice, this list of conditions and the following disclaimer in the
72 * documentation and/or other materials provided with the distribution.
73 * 3. All advertising materials mentioning features or use of this software
74 * must display the following acknowledgement:
75 * This product includes software developed by the University of
76 * California, Berkeley and its contributors.
77 * 4. Neither the name of the University nor the names of its contributors
78 * may be used to endorse or promote products derived from this software
79 * without specific prior written permission.
80 *
81 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
82 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
83 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
84 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
85 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
86 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
87 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
88 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
89 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
90 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
91 * SUCH DAMAGE.
92 *
93 * @(#)udp_var.h 8.1 (Berkeley) 6/10/93
94 */
95 #include <sys/kernel.h>
96 #include <sys/malloc.h>
97 #include <sys/mbuf.h>
98 #include <sys/param.h>
99 #include <sys/protosw.h>
100 #include <sys/socket.h>
101 #include <sys/socketvar.h>
102 #include <sys/sysctl.h>
103 #include <sys/errno.h>
104 #include <sys/stat.h>
105 #include <sys/systm.h>
106 #include <sys/syslog.h>
107 #include <sys/proc.h>
108 #include <sys/kauth.h>
109
110 #include <net/if.h>
111 #include <net/route.h>
112 #include <net/if_types.h>
113 #include <net/ntstat.h>
114 #include <net/dlil.h>
115 #include <net/net_api_stats.h>
116
117 #include <netinet/in.h>
118 #include <netinet/in_systm.h>
119 #include <netinet/ip.h>
120 #include <netinet/in_pcb.h>
121 #include <netinet/in_var.h>
122 #include <netinet/ip_var.h>
123 #include <netinet/udp.h>
124 #include <netinet/udp_var.h>
125 #include <netinet/udp_log.h>
126
127 #include <netinet/ip6.h>
128 #include <netinet6/ip6_var.h>
129 #include <netinet6/in6_pcb.h>
130 #include <netinet/icmp6.h>
131 #include <netinet6/udp6_var.h>
132 #include <netinet6/ip6protosw.h>
133
134 #if IPSEC
135 #include <netinet6/ipsec.h>
136 #include <netinet6/ipsec6.h>
137 #include <netinet6/esp6.h>
138 #include <netkey/key.h>
139 extern int ipsec_bypass;
140 extern int esp_udp_encap_port;
141 #endif /* IPSEC */
142
143 #if NECP
144 #include <net/necp.h>
145 #endif /* NECP */
146
147 #if FLOW_DIVERT
148 #include <netinet/flow_divert.h>
149 #endif /* FLOW_DIVERT */
150
151 #if CONTENT_FILTER
152 #include <net/content_filter.h>
153 #endif /* CONTENT_FILTER */
154
155 #if SKYWALK
156 #include <skywalk/core/skywalk_var.h>
157 #endif /* SKYWALK */
158
159 #include <net/sockaddr_utils.h>
160
161 /*
162 * UDP protocol inplementation.
163 * Per RFC 768, August, 1980.
164 */
165
166 static int udp6_abort(struct socket *);
167 static int udp6_attach(struct socket *, int, struct proc *);
168 static int udp6_bind(struct socket *, struct sockaddr *, struct proc *);
169 static int udp6_connectx(struct socket *, struct sockaddr *,
170 struct sockaddr *, struct proc *, uint32_t, sae_associd_t,
171 sae_connid_t *, uint32_t, void *, uint32_t, struct uio *, user_ssize_t *);
172 static int udp6_detach(struct socket *);
173 static int udp6_disconnect(struct socket *);
174 static int udp6_disconnectx(struct socket *, sae_associd_t, sae_connid_t);
175 static int udp6_send(struct socket *, int, struct mbuf *, struct sockaddr *,
176 struct mbuf *, struct proc *);
177 static void udp6_append(struct inpcb *, struct ip6_hdr *,
178 struct sockaddr_in6 *, struct mbuf *, int, struct ifnet *);
179 static int udp6_input_checksum(struct mbuf *, struct udphdr *, int, int);
180 static int udp6_defunct(struct socket *);
181
182 struct pr_usrreqs udp6_usrreqs = {
183 .pru_abort = udp6_abort,
184 .pru_attach = udp6_attach,
185 .pru_bind = udp6_bind,
186 .pru_connect = udp6_connect,
187 .pru_connectx = udp6_connectx,
188 .pru_control = in6_control,
189 .pru_detach = udp6_detach,
190 .pru_disconnect = udp6_disconnect,
191 .pru_disconnectx = udp6_disconnectx,
192 .pru_peeraddr = in6_mapped_peeraddr,
193 .pru_send = udp6_send,
194 .pru_shutdown = udp_shutdown,
195 .pru_sockaddr = in6_mapped_sockaddr,
196 .pru_sosend = sosend,
197 .pru_soreceive = soreceive,
198 .pru_defunct = udp6_defunct,
199 };
200
201 /*
202 * subroutine of udp6_input(), mainly for source code readability.
203 */
204 static void
udp6_append(struct inpcb * last,struct ip6_hdr * ip6,struct sockaddr_in6 * udp_in6,struct mbuf * n,int off,struct ifnet * ifp)205 udp6_append(struct inpcb *last, struct ip6_hdr *ip6,
206 struct sockaddr_in6 *udp_in6, struct mbuf *n, int off, struct ifnet *ifp)
207 {
208 #pragma unused(ip6)
209 struct mbuf *opts = NULL;
210 int ret = 0;
211 boolean_t cell = IFNET_IS_CELLULAR(ifp);
212 boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
213 boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
214
215 if ((last->in6p_flags & INP_CONTROLOPTS) != 0 ||
216 SOFLOW_ENABLED(last->in6p_socket) ||
217 SO_RECV_CONTROL_OPTS(last->in6p_socket)) {
218 ret = ip6_savecontrol(last, n, &opts);
219 if (ret != 0) {
220 m_freem(n);
221 m_freem(opts);
222 return;
223 }
224 }
225 m_adj(n, off);
226 if (nstat_collect) {
227 INP_ADD_STAT(last, cell, wifi, wired, rxpackets, 1);
228 INP_ADD_STAT(last, cell, wifi, wired, rxbytes, n->m_pkthdr.len);
229 inp_set_activity_bitmap(last);
230 }
231 so_recv_data_stat(last->in6p_socket, n, 0);
232 if (sbappendaddr(&last->in6p_socket->so_rcv,
233 SA(udp_in6), n, opts, NULL) == 0) {
234 udpstat.udps_fullsock++;
235 } else {
236 sorwakeup(last->in6p_socket);
237 }
238 }
239
240 int
udp6_input(struct mbuf ** mp,int * offp,int proto)241 udp6_input(struct mbuf **mp, int *offp, int proto)
242 {
243 #pragma unused(proto)
244 struct mbuf *m = *mp;
245 struct ifnet *ifp;
246 struct ip6_hdr *ip6;
247 struct udphdr *uh;
248 struct inpcb *in6p;
249 struct mbuf *opts = NULL;
250 int off = *offp;
251 int plen, ulen, ret = 0;
252 boolean_t cell, wifi, wired;
253 struct sockaddr_in6 udp_in6;
254 struct inpcbinfo *pcbinfo = &udbinfo;
255 struct sockaddr_in6 fromsa;
256 u_int16_t pf_tag = 0;
257 boolean_t is_wake_pkt = false;
258
259 IP6_EXTHDR_CHECK(m, off, sizeof(struct udphdr), return IPPROTO_DONE);
260
261 /* Expect 32-bit aligned data pointer on strict-align platforms */
262 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
263
264 ifp = m->m_pkthdr.rcvif;
265 ip6 = mtod(m, struct ip6_hdr *);
266 cell = IFNET_IS_CELLULAR(ifp);
267 wifi = (!cell && IFNET_IS_WIFI(ifp));
268 wired = (!wifi && IFNET_IS_WIRED(ifp));
269
270 if (m->m_flags & M_PKTHDR) {
271 pf_tag = m_pftag(m)->pftag_tag;
272 if (m->m_pkthdr.pkt_flags & PKTF_WAKE_PKT) {
273 is_wake_pkt = true;
274 }
275 }
276
277 udpstat.udps_ipackets++;
278
279 plen = ntohs(ip6->ip6_plen) - off + sizeof(*ip6);
280 uh = (struct udphdr *)(void *)((caddr_t)ip6 + off);
281 ulen = ntohs((u_short)uh->uh_ulen);
282
283 if (plen != ulen) {
284 udpstat.udps_badlen++;
285 IF_UDP_STATINC(ifp, badlength);
286 goto bad;
287 }
288
289 /* destination port of 0 is illegal, based on RFC768. */
290 if (uh->uh_dport == 0) {
291 IF_UDP_STATINC(ifp, port0);
292 goto bad;
293 }
294
295 /*
296 * Checksum extended UDP header and data.
297 */
298 if (udp6_input_checksum(m, uh, off, ulen)) {
299 goto bad;
300 }
301
302 /*
303 * Construct sockaddr format source address.
304 */
305 init_sin6(&fromsa, m);
306 fromsa.sin6_port = uh->uh_sport;
307
308 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
309 int reuse_sock = 0, mcast_delivered = 0;
310 struct ip6_moptions *imo;
311
312 /*
313 * Deliver a multicast datagram to all sockets
314 * for which the local and remote addresses and ports match
315 * those of the incoming datagram. This allows more than
316 * one process to receive multicasts on the same port.
317 * (This really ought to be done for unicast datagrams as
318 * well, but that would cause problems with existing
319 * applications that open both address-specific sockets and
320 * a wildcard socket listening to the same port -- they would
321 * end up receiving duplicates of every unicast datagram.
322 * Those applications open the multiple sockets to overcome an
323 * inadequacy of the UDP socket interface, but for backwards
324 * compatibility we avoid the problem here rather than
325 * fixing the interface. Maybe 4.5BSD will remedy this?)
326 */
327
328 /*
329 * In a case that laddr should be set to the link-local
330 * address (this happens in RIPng), the multicast address
331 * specified in the received packet does not match with
332 * laddr. To cure this situation, the matching is relaxed
333 * if the receiving interface is the same as one specified
334 * in the socket and if the destination multicast address
335 * matches one of the multicast groups specified in the socket.
336 */
337
338 /*
339 * Construct sockaddr format source address.
340 */
341 init_sin6(&udp_in6, m); /* general init */
342 udp_in6.sin6_port = uh->uh_sport;
343 /*
344 * KAME note: usually we drop udphdr from mbuf here.
345 * We need udphdr for IPsec processing so we do that later.
346 */
347
348 /*
349 * Locate pcb(s) for datagram.
350 * (Algorithm copied from raw_intr().)
351 */
352 lck_rw_lock_shared(&pcbinfo->ipi_lock);
353
354 LIST_FOREACH(in6p, &udb, inp_list) {
355 #if IPSEC
356 int skipit;
357 #endif /* IPSEC */
358
359 if ((in6p->inp_vflag & INP_IPV6) == 0) {
360 continue;
361 }
362
363 if (inp_restricted_recv(in6p, ifp)) {
364 continue;
365 }
366 /*
367 * Skip unbound sockets before taking the lock on the socket as
368 * the test with the destination port in the header will fail
369 */
370 if (in6p->in6p_lport == 0) {
371 continue;
372 }
373
374 if (in_pcb_checkstate(in6p, WNT_ACQUIRE, 0) ==
375 WNT_STOPUSING) {
376 continue;
377 }
378
379 udp_lock(in6p->in6p_socket, 1, 0);
380
381 if (in_pcb_checkstate(in6p, WNT_RELEASE, 1) ==
382 WNT_STOPUSING) {
383 udp_unlock(in6p->in6p_socket, 1, 0);
384 continue;
385 }
386 if (in6p->in6p_lport != uh->uh_dport) {
387 udp_unlock(in6p->in6p_socket, 1, 0);
388 continue;
389 }
390
391 /*
392 * Handle socket delivery policy for any-source
393 * and source-specific multicast. [RFC3678]
394 */
395 imo = in6p->in6p_moptions;
396 if (imo && IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
397 struct sockaddr_in6 mcaddr;
398 int blocked;
399
400 IM6O_LOCK(imo);
401 SOCKADDR_ZERO(&mcaddr, sizeof(struct sockaddr_in6));
402 mcaddr.sin6_len = sizeof(struct sockaddr_in6);
403 mcaddr.sin6_family = AF_INET6;
404 mcaddr.sin6_addr = ip6->ip6_dst;
405
406 blocked = im6o_mc_filter(imo, ifp,
407 &mcaddr, &fromsa);
408 IM6O_UNLOCK(imo);
409 if (blocked != MCAST_PASS) {
410 udp_unlock(in6p->in6p_socket, 1, 0);
411 if (blocked == MCAST_NOTSMEMBER ||
412 blocked == MCAST_MUTED) {
413 udpstat.udps_filtermcast++;
414 }
415 continue;
416 }
417 }
418 if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) &&
419 (!in6_are_addr_equal_scoped(&in6p->in6p_faddr,
420 &ip6->ip6_src, in6p->inp_fifscope, ifp->if_index) ||
421 in6p->in6p_fport != uh->uh_sport)) {
422 udp_unlock(in6p->in6p_socket, 1, 0);
423 continue;
424 }
425
426 reuse_sock = in6p->inp_socket->so_options &
427 (SO_REUSEPORT | SO_REUSEADDR);
428
429 #if NECP
430 skipit = 0;
431 if (!necp_socket_is_allowed_to_send_recv_v6(in6p,
432 uh->uh_dport, uh->uh_sport, &ip6->ip6_dst,
433 &ip6->ip6_src, ifp, pf_tag, NULL, NULL, NULL, NULL)) {
434 /* do not inject data to pcb */
435 skipit = 1;
436 }
437 if (skipit == 0)
438 #endif /* NECP */
439 {
440 struct mbuf *n = NULL;
441 /*
442 * KAME NOTE: do not
443 * m_copy(m, offset, ...) below.
444 * sbappendaddr() expects M_PKTHDR,
445 * and m_copy() will copy M_PKTHDR
446 * only if offset is 0.
447 */
448 if (reuse_sock) {
449 n = m_copy(m, 0, M_COPYALL);
450 }
451 udp6_append(in6p, ip6, &udp_in6, m,
452 off + sizeof(struct udphdr), ifp);
453 mcast_delivered++;
454 m = n;
455 }
456 if (is_wake_pkt) {
457 soevent(in6p->in6p_socket,
458 SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
459 }
460 udp_unlock(in6p->in6p_socket, 1, 0);
461
462 /*
463 * Don't look for additional matches if this one does
464 * not have either the SO_REUSEPORT or SO_REUSEADDR
465 * socket options set. This heuristic avoids searching
466 * through all pcbs in the common case of a non-shared
467 * port. It assumes that an application will never
468 * clear these options after setting them.
469 */
470 if (reuse_sock == 0 || m == NULL) {
471 break;
472 }
473
474 /*
475 * Expect 32-bit aligned data pointer on strict-align
476 * platforms.
477 */
478 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
479
480 /*
481 * Recompute IP and UDP header pointers for new mbuf
482 */
483 ip6 = mtod(m, struct ip6_hdr *);
484 uh = (struct udphdr *)(void *)((caddr_t)ip6 + off);
485 }
486 lck_rw_done(&pcbinfo->ipi_lock);
487
488 if (mcast_delivered == 0) {
489 /*
490 * No matching pcb found; discard datagram.
491 * (No need to send an ICMP Port Unreachable
492 * for a broadcast or multicast datgram.)
493 */
494 udpstat.udps_noport++;
495 udpstat.udps_noportmcast++;
496 IF_UDP_STATINC(ifp, port_unreach);
497 goto bad;
498 }
499
500 /* free the extra copy of mbuf or skipped by NECP */
501 if (m != NULL) {
502 m_freem(m);
503 }
504 return IPPROTO_DONE;
505 }
506
507 #if IPSEC
508 /*
509 * UDP to port 4500 with a payload where the first four bytes are
510 * not zero is a UDP encapsulated IPsec packet. Packets where
511 * the payload is one byte and that byte is 0xFF are NAT keepalive
512 * packets. Decapsulate the ESP packet and carry on with IPsec input
513 * or discard the NAT keep-alive.
514 */
515 if (ipsec_bypass == 0 && (esp_udp_encap_port & 0xFFFF) != 0 &&
516 (uh->uh_dport == ntohs((u_short)esp_udp_encap_port) ||
517 uh->uh_sport == ntohs((u_short)esp_udp_encap_port))) {
518 /*
519 * Check if ESP or keepalive:
520 * 1. If the destination port of the incoming packet is 4500.
521 * 2. If the source port of the incoming packet is 4500,
522 * then check the SADB to match IP address and port.
523 */
524 bool check_esp = true;
525 if (uh->uh_dport != ntohs((u_short)esp_udp_encap_port)) {
526 check_esp = key_checksa_present(AF_INET6, (caddr_t)&ip6->ip6_dst,
527 (caddr_t)&ip6->ip6_src, uh->uh_dport,
528 uh->uh_sport, ip6_input_getdstifscope(m), ip6_input_getsrcifscope(m));
529 }
530
531 if (check_esp) {
532 int payload_len = ulen - sizeof(struct udphdr) > 4 ? 4 :
533 ulen - sizeof(struct udphdr);
534
535 if (m->m_len < off + sizeof(struct udphdr) + payload_len) {
536 if ((m = m_pullup(m, off + sizeof(struct udphdr) +
537 payload_len)) == NULL) {
538 udpstat.udps_hdrops++;
539 goto bad;
540 }
541 /*
542 * Expect 32-bit aligned data pointer on strict-align
543 * platforms.
544 */
545 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
546
547 ip6 = mtod(m, struct ip6_hdr *);
548 uh = (struct udphdr *)(void *)((caddr_t)ip6 + off);
549 }
550 /* Check for NAT keepalive packet */
551 if (payload_len == 1 && *(u_int8_t*)
552 ((caddr_t)uh + sizeof(struct udphdr)) == 0xFF) {
553 goto bad;
554 } else if (payload_len == 4 && *(u_int32_t*)(void *)
555 ((caddr_t)uh + sizeof(struct udphdr)) != 0) {
556 /* UDP encapsulated IPsec packet to pass through NAT */
557 /* preserve the udp header */
558 *offp = off + sizeof(struct udphdr);
559 return esp6_input(mp, offp, IPPROTO_UDP);
560 }
561 }
562 }
563 #endif /* IPSEC */
564
565 /*
566 * Locate pcb for datagram.
567 */
568 in6p = in6_pcblookup_hash(&udbinfo, &ip6->ip6_src, uh->uh_sport, ip6_input_getsrcifscope(m),
569 &ip6->ip6_dst, uh->uh_dport, ip6_input_getdstifscope(m), 1, m->m_pkthdr.rcvif);
570 if (in6p == NULL) {
571 IF_UDP_STATINC(ifp, port_unreach);
572
573 if (udp_log_in_vain) {
574 char buf[INET6_ADDRSTRLEN];
575
576 strlcpy(buf, ip6_sprintf(&ip6->ip6_dst), sizeof(buf));
577 if (udp_log_in_vain < 3) {
578 log(LOG_INFO, "Connection attempt to UDP "
579 "%s:%d from %s:%d\n", buf,
580 ntohs(uh->uh_dport),
581 ip6_sprintf(&ip6->ip6_src),
582 ntohs(uh->uh_sport));
583 } else if (!(m->m_flags & (M_BCAST | M_MCAST)) &&
584 !in6_are_addr_equal_scoped(&ip6->ip6_dst, &ip6->ip6_src, ip6_input_getdstifscope(m), ip6_input_getsrcifscope(m))) {
585 log(LOG_INFO, "Connection attempt "
586 "to UDP %s:%d from %s:%d\n", buf,
587 ntohs(uh->uh_dport),
588 ip6_sprintf(&ip6->ip6_src),
589 ntohs(uh->uh_sport));
590 }
591 }
592 udpstat.udps_noport++;
593 if (m->m_flags & M_MCAST) {
594 printf("UDP6: M_MCAST is set in a unicast packet.\n");
595 udpstat.udps_noportmcast++;
596 IF_UDP_STATINC(ifp, badmcast);
597 goto bad;
598 }
599 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT, 0);
600 return IPPROTO_DONE;
601 }
602
603 /*
604 * Construct sockaddr format source address.
605 * Stuff source address and datagram in user buffer.
606 */
607 udp_lock(in6p->in6p_socket, 1, 0);
608
609 #if NECP
610 if (!necp_socket_is_allowed_to_send_recv_v6(in6p, uh->uh_dport,
611 uh->uh_sport, &ip6->ip6_dst, &ip6->ip6_src, ifp, pf_tag, NULL, NULL, NULL, NULL)) {
612 in_pcb_checkstate(in6p, WNT_RELEASE, 1);
613 udp_unlock(in6p->in6p_socket, 1, 0);
614 IF_UDP_STATINC(ifp, badipsec);
615 goto bad;
616 }
617 #endif /* NECP */
618
619 if (in_pcb_checkstate(in6p, WNT_RELEASE, 1) == WNT_STOPUSING) {
620 udp_unlock(in6p->in6p_socket, 1, 0);
621 IF_UDP_STATINC(ifp, cleanup);
622 goto bad;
623 }
624
625 init_sin6(&udp_in6, m); /* general init */
626 udp_in6.sin6_port = uh->uh_sport;
627 if ((in6p->in6p_flags & INP_CONTROLOPTS) != 0 ||
628 SOFLOW_ENABLED(in6p->in6p_socket) ||
629 SO_RECV_CONTROL_OPTS(in6p->in6p_socket)) {
630 ret = ip6_savecontrol(in6p, m, &opts);
631 if (ret != 0) {
632 udp_unlock(in6p->in6p_socket, 1, 0);
633 goto bad;
634 }
635 }
636 m_adj(m, off + sizeof(struct udphdr));
637 if (nstat_collect) {
638 INP_ADD_STAT(in6p, cell, wifi, wired, rxpackets, 1);
639 INP_ADD_STAT(in6p, cell, wifi, wired, rxbytes, m->m_pkthdr.len);
640 inp_set_activity_bitmap(in6p);
641 }
642 so_recv_data_stat(in6p->in6p_socket, m, 0);
643 if (sbappendaddr(&in6p->in6p_socket->so_rcv,
644 SA(&udp_in6), m, opts, NULL) == 0) {
645 m = NULL;
646 opts = NULL;
647 udpstat.udps_fullsock++;
648 udp_unlock(in6p->in6p_socket, 1, 0);
649 goto bad;
650 }
651 if (is_wake_pkt) {
652 soevent(in6p->in6p_socket, SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
653 }
654 sorwakeup(in6p->in6p_socket);
655 udp_unlock(in6p->in6p_socket, 1, 0);
656 return IPPROTO_DONE;
657 bad:
658 if (m != NULL) {
659 m_freem(m);
660 }
661 if (opts != NULL) {
662 m_freem(opts);
663 }
664 return IPPROTO_DONE;
665 }
666
667 void
udp6_ctlinput(int cmd,struct sockaddr * sa,void * d,__unused struct ifnet * ifp)668 udp6_ctlinput(int cmd, struct sockaddr *sa, void *d, __unused struct ifnet *ifp)
669 {
670 struct udphdr uh;
671 struct ip6_hdr *ip6;
672 struct mbuf *m;
673 int off = 0;
674 struct ip6ctlparam *ip6cp = NULL;
675 struct icmp6_hdr *icmp6 = NULL;
676 const struct sockaddr_in6 *sa6_src = NULL;
677 void *cmdarg = NULL;
678 void (*notify)(struct inpcb *, int) = udp_notify;
679 struct inpcb *in6p;
680 struct udp_portonly {
681 u_int16_t uh_sport;
682 u_int16_t uh_dport;
683 } *uhp;
684
685 if (sa->sa_family != AF_INET6 ||
686 sa->sa_len != sizeof(struct sockaddr_in6)) {
687 return;
688 }
689
690 if ((unsigned)cmd >= PRC_NCMDS) {
691 return;
692 }
693 if (PRC_IS_REDIRECT(cmd)) {
694 notify = in6_rtchange;
695 d = NULL;
696 } else if (cmd == PRC_HOSTDEAD) {
697 d = NULL;
698 } else if (inet6ctlerrmap[cmd] == 0) {
699 return;
700 }
701
702 /* if the parameter is from icmp6, decode it. */
703 if (d != NULL) {
704 ip6cp = (struct ip6ctlparam *)d;
705 icmp6 = ip6cp->ip6c_icmp6;
706 m = ip6cp->ip6c_m;
707 ip6 = ip6cp->ip6c_ip6;
708 off = ip6cp->ip6c_off;
709 cmdarg = ip6cp->ip6c_cmdarg;
710 sa6_src = ip6cp->ip6c_src;
711 } else {
712 m = NULL;
713 ip6 = NULL;
714 cmdarg = NULL;
715 sa6_src = &sa6_any;
716 }
717
718 if (ip6 != NULL) {
719 #if SKYWALK
720 union sockaddr_in_4_6 sock_laddr;
721 struct protoctl_ev_val prctl_ev_val;
722 #endif /* SKYWALK */
723 /*
724 * XXX: We assume that when IPV6 is non NULL,
725 * M and OFF are valid.
726 */
727 /* check if we can safely examine src and dst ports */
728 if (m->m_pkthdr.len < off + sizeof(*uhp)) {
729 return;
730 }
731
732 bzero(&uh, sizeof(uh));
733 m_copydata(m, off, sizeof(*uhp), (caddr_t)&uh);
734
735 in6p = in6_pcblookup_hash(&udbinfo, &ip6->ip6_dst, uh.uh_dport, ip6_input_getdstifscope(m),
736 &ip6->ip6_src, uh.uh_sport, ip6_input_getsrcifscope(m), 0, NULL);
737 if (cmd == PRC_MSGSIZE && in6p != NULL && !uuid_is_null(in6p->necp_client_uuid)) {
738 uuid_t null_uuid;
739 uuid_clear(null_uuid);
740 necp_update_flow_protoctl_event(null_uuid, in6p->necp_client_uuid,
741 PRC_MSGSIZE, ntohl(icmp6->icmp6_mtu), 0);
742 /*
743 * Avoid setting so_error when using Network.framework
744 * since the notification of PRC_MSGSIZE has been delivered
745 * through NECP.
746 */
747 in6_pcbnotify(&udbinfo, sa, uh.uh_dport,
748 SA(ip6cp->ip6c_src), uh.uh_sport,
749 cmd, cmdarg, NULL);
750 } else {
751 in6_pcbnotify(&udbinfo, sa, uh.uh_dport,
752 SA(ip6cp->ip6c_src), uh.uh_sport,
753 cmd, cmdarg, notify);
754 }
755 #if SKYWALK
756 bzero(&prctl_ev_val, sizeof(prctl_ev_val));
757 bzero(&sock_laddr, sizeof(sock_laddr));
758
759 if (cmd == PRC_MSGSIZE && icmp6 != NULL) {
760 prctl_ev_val.val = ntohl(icmp6->icmp6_mtu);
761 }
762 sock_laddr.sin6.sin6_family = AF_INET6;
763 sock_laddr.sin6.sin6_len = sizeof(sock_laddr.sin6);
764 sock_laddr.sin6.sin6_addr = ip6->ip6_src;
765
766 protoctl_event_enqueue_nwk_wq_entry(ifp,
767 SA(&sock_laddr), sa,
768 uh.uh_sport, uh.uh_dport, IPPROTO_UDP,
769 cmd, &prctl_ev_val);
770 #endif /* SKYWALK */
771 }
772 /*
773 * XXX The else condition here was broken for a long time.
774 * Fixing it made us deliver notification correctly but broke
775 * some frameworks that didn't handle it well.
776 * For now we have removed it and will revisit it later.
777 */
778 }
779
780 static int
udp6_abort(struct socket * so)781 udp6_abort(struct socket *so)
782 {
783 struct inpcb *inp;
784
785 inp = sotoinpcb(so);
786 if (inp == NULL) {
787 panic("%s: so=%p null inp", __func__, so);
788 /* NOTREACHED */
789 }
790 soisdisconnected(so);
791 in6_pcbdetach(inp);
792 return 0;
793 }
794
795 static int
udp6_attach(struct socket * so,int proto,struct proc * p)796 udp6_attach(struct socket *so, int proto, struct proc *p)
797 {
798 #pragma unused(proto)
799 struct inpcb *inp;
800 int error;
801
802 if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
803 error = soreserve(so, udp_sendspace, udp_recvspace);
804 if (error) {
805 return error;
806 }
807 }
808
809 inp = sotoinpcb(so);
810 if (inp != NULL) {
811 return EINVAL;
812 }
813
814 error = in_pcballoc(so, &udbinfo, p);
815 if (error) {
816 return error;
817 }
818
819 inp = (struct inpcb *)so->so_pcb;
820 inp->inp_vflag |= INP_IPV6;
821 if (ip6_mapped_addr_on) {
822 inp->inp_vflag |= INP_IPV4;
823 }
824 inp->in6p_hops = -1; /* use kernel default */
825 inp->in6p_cksum = -1; /* just to be sure */
826 /*
827 * XXX: ugly!!
828 * IPv4 TTL initialization is necessary for an IPv6 socket as well,
829 * because the socket may be bound to an IPv6 wildcard address,
830 * which may match an IPv4-mapped IPv6 address.
831 */
832 inp->inp_ip_ttl = (u_char)ip_defttl;
833 if (nstat_collect) {
834 nstat_udp_new_pcb(inp);
835 }
836 return 0;
837 }
838
839 static int
udp6_bind(struct socket * so,struct sockaddr * nam,struct proc * p)840 udp6_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
841 {
842 struct inpcb *inp;
843 int error;
844
845 inp = sotoinpcb(so);
846 if (inp == NULL) {
847 return EINVAL;
848 }
849 /*
850 * Another thread won the binding race so do not change inp_vflag
851 */
852 if (inp->inp_flags2 & INP2_BIND_IN_PROGRESS) {
853 return EINVAL;
854 }
855
856 const uint8_t old_flags = inp->inp_vflag;
857 inp->inp_vflag &= ~INP_IPV4;
858 inp->inp_vflag |= INP_IPV6;
859
860 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
861 struct sockaddr_in6 *sin6_p;
862
863 sin6_p = SIN6(nam);
864
865 if (IN6_IS_ADDR_UNSPECIFIED(&sin6_p->sin6_addr)) {
866 inp->inp_vflag |= INP_IPV4;
867 inp->inp_vflag &= ~INP_V4MAPPEDV6;
868 } else if (IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr)) {
869 struct sockaddr_in sin;
870
871 in6_sin6_2_sin(&sin, sin6_p);
872 inp->inp_vflag |= INP_IPV4;
873 inp->inp_vflag &= ~INP_IPV6;
874 inp->inp_vflag |= INP_V4MAPPEDV6;
875
876 error = in_pcbbind(inp, SA(&sin), p);
877 if (error != 0) {
878 inp->inp_vflag = old_flags;
879 }
880 return error;
881 }
882 }
883
884 error = in6_pcbbind(inp, nam, p);
885 if (error != 0) {
886 inp->inp_vflag = old_flags;
887 }
888
889 UDP_LOG_BIND(inp, error);
890
891 return error;
892 }
893
894 int
udp6_connect(struct socket * so,struct sockaddr * nam,struct proc * p)895 udp6_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
896 {
897 struct inpcb *inp;
898 int error;
899 struct sockaddr_in6 *sin6_p = SIN6(nam);
900
901 #if defined(NECP) && defined(FLOW_DIVERT)
902 int should_use_flow_divert = 0;
903 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
904
905 inp = sotoinpcb(so);
906 if (inp == NULL) {
907 return EINVAL;
908 }
909
910 #if defined(NECP) && defined(FLOW_DIVERT)
911 should_use_flow_divert = necp_socket_should_use_flow_divert(inp);
912 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
913
914 /*
915 * It is possible that the socket is bound to v4 mapped v6 address.
916 * Post that do not allow connect to a v6 endpoint.
917 */
918 if (inp->inp_vflag & INP_V4MAPPEDV6 &&
919 !IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr)) {
920 if (IN6_IS_ADDR_UNSPECIFIED(&sin6_p->sin6_addr)) {
921 sin6_p->sin6_addr.s6_addr[10] = 0xff;
922 sin6_p->sin6_addr.s6_addr[11] = 0xff;
923 } else {
924 return EINVAL;
925 }
926 }
927
928 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
929 if (IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr)) {
930 struct sockaddr_in sin;
931 const uint8_t old_flags = inp->inp_vflag;
932
933 if (inp->inp_faddr.s_addr != INADDR_ANY) {
934 return EISCONN;
935 }
936
937 if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
938 so->so_flags1 |= SOF1_CONNECT_COUNTED;
939 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
940 }
941
942 in6_sin6_2_sin(&sin, sin6_p);
943 #if defined(NECP) && defined(FLOW_DIVERT)
944 if (should_use_flow_divert) {
945 goto do_flow_divert;
946 }
947 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
948 inp->inp_vflag |= INP_IPV4;
949 inp->inp_vflag &= ~INP_IPV6;
950 inp->inp_vflag |= INP_V4MAPPEDV6;
951
952 error = in_pcbconnect(inp, SA(&sin), p, IFSCOPE_NONE, NULL);
953 if (error == 0) {
954 #if NECP
955 /* Update NECP client with connected five-tuple */
956 if (!uuid_is_null(inp->necp_client_uuid)) {
957 socket_unlock(so, 0);
958 necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
959 socket_lock(so, 0);
960 }
961 #endif /* NECP */
962 soisconnected(so);
963 } else {
964 inp->inp_vflag = old_flags;
965 }
966 UDP_LOG_CONNECT(inp, error);
967 return error;
968 }
969 }
970
971 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
972 return EISCONN;
973 }
974
975 if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
976 so->so_flags1 |= SOF1_CONNECT_COUNTED;
977 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet6_dgram_connected);
978 }
979
980 #if defined(NECP) && defined(FLOW_DIVERT)
981 do_flow_divert:
982 if (should_use_flow_divert) {
983 error = flow_divert_pcb_init(so);
984 if (error == 0) {
985 error = flow_divert_connect_out(so, nam, p);
986 }
987 return error;
988 }
989 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
990
991 error = in6_pcbconnect(inp, nam, p);
992 if (error == 0) {
993 /* should be non mapped addr */
994 if (ip6_mapped_addr_on ||
995 (inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
996 inp->inp_vflag &= ~INP_IPV4;
997 inp->inp_vflag |= INP_IPV6;
998 }
999 #if NECP
1000 /* Update NECP client with connected five-tuple */
1001 if (!uuid_is_null(inp->necp_client_uuid)) {
1002 socket_unlock(so, 0);
1003 necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
1004 socket_lock(so, 0);
1005 }
1006 #endif /* NECP */
1007 soisconnected(so);
1008 if (inp->inp_flowhash == 0) {
1009 inp_calc_flowhash(inp);
1010 ASSERT(inp->inp_flowhash != 0);
1011 }
1012 /* update flowinfo - RFC 6437 */
1013 if (inp->inp_flow == 0 &&
1014 inp->in6p_flags & IN6P_AUTOFLOWLABEL) {
1015 inp->inp_flow &= ~IPV6_FLOWLABEL_MASK;
1016 inp->inp_flow |=
1017 (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
1018 }
1019 inp->inp_connect_timestamp = mach_continuous_time();
1020 }
1021 UDP_LOG_CONNECT(inp, error);
1022 return error;
1023 }
1024
1025 static int
udp6_connectx(struct socket * so,struct sockaddr * src,struct sockaddr * dst,struct proc * p,uint32_t ifscope,sae_associd_t aid,sae_connid_t * pcid,uint32_t flags,void * arg,uint32_t arglen,struct uio * uio,user_ssize_t * bytes_written)1026 udp6_connectx(struct socket *so, struct sockaddr *src,
1027 struct sockaddr *dst, struct proc *p, uint32_t ifscope,
1028 sae_associd_t aid, sae_connid_t *pcid, uint32_t flags, void *arg,
1029 uint32_t arglen, struct uio *uio, user_ssize_t *bytes_written)
1030 {
1031 return udp_connectx_common(so, AF_INET6, src, dst,
1032 p, ifscope, aid, pcid, flags, arg, arglen, uio, bytes_written);
1033 }
1034
1035 static int
udp6_detach(struct socket * so)1036 udp6_detach(struct socket *so)
1037 {
1038 struct inpcb *inp;
1039
1040 inp = sotoinpcb(so);
1041 if (inp == NULL) {
1042 return EINVAL;
1043 }
1044
1045 UDP_LOG_CONNECTION_SUMMARY(inp);
1046
1047 in6_pcbdetach(inp);
1048 return 0;
1049 }
1050
1051 static int
udp6_disconnect(struct socket * so)1052 udp6_disconnect(struct socket *so)
1053 {
1054 struct inpcb *inp;
1055
1056 inp = sotoinpcb(so);
1057 if (inp == NULL
1058 #if NECP
1059 || (necp_socket_should_use_flow_divert(inp))
1060 #endif /* NECP */
1061 ) {
1062 return inp == NULL ? EINVAL : EPROTOTYPE;
1063 }
1064
1065 if (inp->inp_vflag & INP_IPV4) {
1066 struct pr_usrreqs *pru;
1067
1068 pru = ip_protox[IPPROTO_UDP]->pr_usrreqs;
1069 return (*pru->pru_disconnect)(so);
1070 }
1071
1072 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1073 return ENOTCONN;
1074 }
1075
1076 UDP_LOG_CONNECTION_SUMMARY(inp);
1077
1078 in6_pcbdisconnect(inp);
1079
1080 /* reset flow-controlled state, just in case */
1081 inp_reset_fc_state(inp);
1082
1083 inp->in6p_laddr = in6addr_any;
1084 inp->inp_lifscope = IFSCOPE_NONE;
1085 inp->in6p_last_outifp = NULL;
1086 #if SKYWALK
1087 if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
1088 netns_set_ifnet(&inp->inp_netns_token, NULL);
1089 }
1090 #endif /* SKYWALK */
1091
1092 so->so_state &= ~SS_ISCONNECTED; /* XXX */
1093 return 0;
1094 }
1095
1096 static int
udp6_disconnectx(struct socket * so,sae_associd_t aid,sae_connid_t cid)1097 udp6_disconnectx(struct socket *so, sae_associd_t aid, sae_connid_t cid)
1098 {
1099 #pragma unused(cid)
1100 if (aid != SAE_ASSOCID_ANY && aid != SAE_ASSOCID_ALL) {
1101 return EINVAL;
1102 }
1103
1104 return udp6_disconnect(so);
1105 }
1106
1107 static int
udp6_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * addr,struct mbuf * control,struct proc * p)1108 udp6_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
1109 struct mbuf *control, struct proc *p)
1110 {
1111 struct inpcb *inp;
1112 int error = 0;
1113 #if defined(NECP) && defined(FLOW_DIVERT)
1114 int should_use_flow_divert = 0;
1115 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
1116 #if CONTENT_FILTER
1117 struct m_tag *cfil_tag = NULL;
1118 struct sockaddr *cfil_faddr = NULL;
1119 #endif
1120
1121 inp = sotoinpcb(so);
1122 if (inp == NULL) {
1123 error = EINVAL;
1124 goto bad;
1125 }
1126
1127 #if CONTENT_FILTER
1128 //If socket is subject to UDP Content Filter and unconnected, get addr from tag.
1129 if (CFIL_DGRAM_FILTERED(so) && !addr && IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1130 cfil_tag = cfil_dgram_get_socket_state(m, NULL, NULL, &cfil_faddr, NULL);
1131 if (cfil_tag) {
1132 addr = SA(cfil_faddr);
1133 }
1134 }
1135 #endif
1136
1137 #if defined(NECP) && defined(FLOW_DIVERT)
1138 should_use_flow_divert = necp_socket_should_use_flow_divert(inp);
1139 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
1140
1141 if (addr != NULL) {
1142 if (addr->sa_len != sizeof(struct sockaddr_in6)) {
1143 error = EINVAL;
1144 goto bad;
1145 }
1146 if (addr->sa_family != AF_INET6) {
1147 error = EAFNOSUPPORT;
1148 goto bad;
1149 }
1150 }
1151
1152 if (ip6_mapped_addr_on || (inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
1153 int hasv4addr;
1154 struct sockaddr_in6 *sin6 = NULL;
1155
1156 if (addr == NULL) {
1157 hasv4addr = (inp->inp_vflag & INP_IPV4);
1158 } else {
1159 sin6 = SIN6(addr);
1160 hasv4addr =
1161 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr) ? 1 : 0;
1162 }
1163 if (hasv4addr) {
1164 struct pr_usrreqs *pru;
1165
1166 if (sin6 != NULL) {
1167 in6_sin6_2_sin_in_sock(addr);
1168 }
1169 #if defined(NECP) && defined(FLOW_DIVERT)
1170 if (should_use_flow_divert) {
1171 goto do_flow_divert;
1172 }
1173 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
1174 pru = ip_protox[IPPROTO_UDP]->pr_usrreqs;
1175 error = ((*pru->pru_send)(so, flags, m, addr,
1176 control, p));
1177 #if CONTENT_FILTER
1178 if (cfil_tag) {
1179 m_tag_free(cfil_tag);
1180 }
1181 #endif
1182 /* addr will just be freed in sendit(). */
1183 return error;
1184 }
1185 }
1186
1187 #if defined(NECP) && defined(FLOW_DIVERT)
1188 do_flow_divert:
1189 if (should_use_flow_divert) {
1190 /* Implicit connect */
1191 error = flow_divert_implicit_data_out(so, flags, m, addr, control, p);
1192 #if CONTENT_FILTER
1193 if (cfil_tag) {
1194 m_tag_free(cfil_tag);
1195 }
1196 #endif
1197 return error;
1198 }
1199 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
1200
1201 #if SKYWALK
1202 sk_protect_t protect = sk_async_transmit_protect();
1203 #endif /* SKYWALK */
1204 error = udp6_output(inp, m, addr, control, p);
1205 #if SKYWALK
1206 sk_async_transmit_unprotect(protect);
1207 #endif /* SKYWALK */
1208
1209 #if CONTENT_FILTER
1210 if (cfil_tag) {
1211 m_tag_free(cfil_tag);
1212 }
1213 #endif
1214 return error;
1215
1216 bad:
1217 VERIFY(error != 0);
1218
1219 if (m != NULL) {
1220 m_freem(m);
1221 }
1222 if (control != NULL) {
1223 m_freem(control);
1224 }
1225 #if CONTENT_FILTER
1226 if (cfil_tag) {
1227 m_tag_free(cfil_tag);
1228 }
1229 #endif
1230 return error;
1231 }
1232
1233 /*
1234 * Checksum extended UDP header and data.
1235 */
1236 static int
udp6_input_checksum(struct mbuf * m,struct udphdr * uh,int off,int ulen)1237 udp6_input_checksum(struct mbuf *m, struct udphdr *uh, int off, int ulen)
1238 {
1239 struct ifnet *ifp = m->m_pkthdr.rcvif;
1240 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1241
1242 if (!(m->m_pkthdr.csum_flags & CSUM_DATA_VALID) &&
1243 uh->uh_sum == 0) {
1244 /* UDP/IPv6 checksum is mandatory (RFC2460) */
1245
1246 /*
1247 * If checksum was already validated, ignore this check.
1248 * This is necessary for transport-mode ESP, which may be
1249 * getting UDP payloads without checksums when the network
1250 * has a NAT64.
1251 */
1252 udpstat.udps_nosum++;
1253 goto badsum;
1254 }
1255
1256 if ((hwcksum_rx || (ifp->if_flags & IFF_LOOPBACK) ||
1257 (m->m_pkthdr.pkt_flags & PKTF_LOOP)) &&
1258 (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)) {
1259 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
1260 uh->uh_sum = m->m_pkthdr.csum_rx_val;
1261 } else {
1262 uint32_t sum = m->m_pkthdr.csum_rx_val;
1263 uint32_t start = m->m_pkthdr.csum_rx_start;
1264 int32_t trailer = (m_pktlen(m) - (off + ulen));
1265
1266 /*
1267 * Perform 1's complement adjustment of octets
1268 * that got included/excluded in the hardware-
1269 * calculated checksum value. Also take care
1270 * of any trailing bytes and subtract out
1271 * their partial sum.
1272 */
1273 ASSERT(trailer >= 0);
1274 if ((m->m_pkthdr.csum_flags & CSUM_PARTIAL) &&
1275 (start != off || trailer != 0)) {
1276 uint32_t swbytes = (uint32_t)trailer;
1277 uint16_t s = 0, d = 0;
1278
1279 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
1280 s = ip6->ip6_src.s6_addr16[1];
1281 ip6->ip6_src.s6_addr16[1] = 0;
1282 }
1283 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
1284 d = ip6->ip6_dst.s6_addr16[1];
1285 ip6->ip6_dst.s6_addr16[1] = 0;
1286 }
1287
1288 /* callee folds in sum */
1289 sum = m_adj_sum16(m, start, off, ulen, sum);
1290 if (off > start) {
1291 swbytes += (off - start);
1292 } else {
1293 swbytes += (start - off);
1294 }
1295
1296 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
1297 ip6->ip6_src.s6_addr16[1] = s;
1298 }
1299 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
1300 ip6->ip6_dst.s6_addr16[1] = d;
1301 }
1302
1303 if (swbytes != 0) {
1304 udp_in_cksum_stats(swbytes);
1305 }
1306 if (trailer != 0) {
1307 m_adj(m, -trailer);
1308 }
1309 }
1310
1311 uh->uh_sum = in6_pseudo(&ip6->ip6_src, &ip6->ip6_dst,
1312 sum + htonl(ulen + IPPROTO_UDP));
1313 }
1314 uh->uh_sum ^= 0xffff;
1315 } else {
1316 udp_in6_cksum_stats(ulen);
1317 uh->uh_sum = in6_cksum(m, IPPROTO_UDP, off, ulen);
1318 }
1319
1320 if (uh->uh_sum != 0) {
1321 badsum:
1322 udpstat.udps_badsum++;
1323 IF_UDP_STATINC(ifp, badchksum);
1324 return -1;
1325 }
1326
1327 return 0;
1328 }
1329
1330 int
udp6_defunct(struct socket * so)1331 udp6_defunct(struct socket *so)
1332 {
1333 struct ip_moptions *imo;
1334 struct ip6_moptions *im6o;
1335 struct inpcb *inp;
1336
1337 inp = sotoinpcb(so);
1338 if (inp == NULL) {
1339 return EINVAL;
1340 }
1341
1342 im6o = inp->in6p_moptions;
1343 inp->in6p_moptions = NULL;
1344 if (im6o != NULL) {
1345 struct proc *p = current_proc();
1346
1347 SODEFUNCTLOG("%s[%d, %s]: defuncting so 0x%llu drop ipv6 multicast memberships",
1348 __func__, proc_pid(p), proc_best_name(p),
1349 so->so_gencnt);
1350 IM6O_REMREF(im6o);
1351 }
1352 imo = inp->inp_moptions;
1353 if (imo != NULL) {
1354 struct proc *p = current_proc();
1355
1356 SODEFUNCTLOG("%s[%d, %s]: defuncting so 0x%llu drop ipv4 multicast memberships",
1357 __func__, proc_pid(p), proc_best_name(p),
1358 so->so_gencnt);
1359
1360 inp->inp_moptions = NULL;
1361
1362 IMO_REMREF(imo);
1363 }
1364
1365 return 0;
1366 }
1367