xref: /xnu-11417.121.6/bsd/netinet6/udp6_usrreq.c (revision a1e26a70f38d1d7daa7b49b258e2f8538ad81650)
1 /*
2  * Copyright (c) 2000-2024 Apple Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 
29 /*	$FreeBSD: src/sys/netinet6/udp6_usrreq.c,v 1.6.2.6 2001/07/29 19:32:40 ume Exp $	*/
30 /*	$KAME: udp6_usrreq.c,v 1.27 2001/05/21 05:45:10 jinmei Exp $	*/
31 
32 /*
33  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
34  * All rights reserved.
35  *
36  * Redistribution and use in source and binary forms, with or without
37  * modification, are permitted provided that the following conditions
38  * are met:
39  * 1. Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  * 2. Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in the
43  *    documentation and/or other materials provided with the distribution.
44  * 3. Neither the name of the project nor the names of its contributors
45  *    may be used to endorse or promote products derived from this software
46  *    without specific prior written permission.
47  *
48  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58  * SUCH DAMAGE.
59  */
60 
61 /*
62  * Copyright (c) 1982, 1986, 1989, 1993
63  *	The Regents of the University of California.  All rights reserved.
64  *
65  * Redistribution and use in source and binary forms, with or without
66  * modification, are permitted provided that the following conditions
67  * are met:
68  * 1. Redistributions of source code must retain the above copyright
69  *    notice, this list of conditions and the following disclaimer.
70  * 2. Redistributions in binary form must reproduce the above copyright
71  *    notice, this list of conditions and the following disclaimer in the
72  *    documentation and/or other materials provided with the distribution.
73  * 3. All advertising materials mentioning features or use of this software
74  *    must display the following acknowledgement:
75  *	This product includes software developed by the University of
76  *	California, Berkeley and its contributors.
77  * 4. Neither the name of the University nor the names of its contributors
78  *    may be used to endorse or promote products derived from this software
79  *    without specific prior written permission.
80  *
81  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
82  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
83  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
84  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
85  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
86  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
87  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
88  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
89  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
90  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
91  * SUCH DAMAGE.
92  *
93  *	@(#)udp_var.h	8.1 (Berkeley) 6/10/93
94  */
95 #include <sys/kernel.h>
96 #include <sys/malloc.h>
97 #include <sys/mbuf.h>
98 #include <sys/param.h>
99 #include <sys/protosw.h>
100 #include <sys/socket.h>
101 #include <sys/socketvar.h>
102 #include <sys/sysctl.h>
103 #include <sys/errno.h>
104 #include <sys/stat.h>
105 #include <sys/systm.h>
106 #include <sys/syslog.h>
107 #include <sys/proc.h>
108 #include <sys/kauth.h>
109 
110 #include <net/if.h>
111 #include <net/route.h>
112 #include <net/if_types.h>
113 #include <net/ntstat.h>
114 #include <net/dlil.h>
115 #include <net/net_api_stats.h>
116 #include <net/droptap.h>
117 
118 #include <netinet/in.h>
119 #include <netinet/in_systm.h>
120 #include <netinet/ip.h>
121 #include <netinet/in_pcb.h>
122 #include <netinet/in_var.h>
123 #include <netinet/ip_var.h>
124 #include <netinet/udp.h>
125 #include <netinet/udp_var.h>
126 #include <netinet/udp_log.h>
127 
128 #include <netinet/ip6.h>
129 #include <netinet6/ip6_var.h>
130 #include <netinet6/in6_pcb.h>
131 #include <netinet/icmp6.h>
132 #include <netinet6/udp6_var.h>
133 #include <netinet6/ip6protosw.h>
134 
135 #if IPSEC
136 #include <netinet6/ipsec.h>
137 #include <netinet6/ipsec6.h>
138 #include <netinet6/esp6.h>
139 #include <netkey/key.h>
140 extern int ipsec_bypass;
141 extern int esp_udp_encap_port;
142 #endif /* IPSEC */
143 
144 #if NECP
145 #include <net/necp.h>
146 #endif /* NECP */
147 
148 #if FLOW_DIVERT
149 #include <netinet/flow_divert.h>
150 #endif /* FLOW_DIVERT */
151 
152 #if CONTENT_FILTER
153 #include <net/content_filter.h>
154 #endif /* CONTENT_FILTER */
155 
156 #if SKYWALK
157 #include <skywalk/core/skywalk_var.h>
158 #endif /* SKYWALK */
159 
160 #include <net/sockaddr_utils.h>
161 
162 /*
163  * UDP protocol inplementation.
164  * Per RFC 768, August, 1980.
165  */
166 
167 static int udp6_abort(struct socket *);
168 static int udp6_attach(struct socket *, int, struct proc *);
169 static int udp6_bind(struct socket *, struct sockaddr *, struct proc *);
170 static int udp6_connectx(struct socket *, struct sockaddr *,
171     struct sockaddr *, struct proc *, uint32_t, sae_associd_t,
172     sae_connid_t *, uint32_t, void *, uint32_t, struct uio *, user_ssize_t *);
173 static  int udp6_detach(struct socket *);
174 static int udp6_disconnect(struct socket *);
175 static int udp6_disconnectx(struct socket *, sae_associd_t, sae_connid_t);
176 static int udp6_send(struct socket *, int, struct mbuf *, struct sockaddr *,
177     struct mbuf *, struct proc *);
178 static void udp6_append(struct inpcb *, struct ip6_hdr *,
179     struct sockaddr_in6 *, struct mbuf *, int, struct ifnet *);
180 static int udp6_input_checksum(struct mbuf *, struct udphdr *, int, int);
181 static int udp6_defunct(struct socket *);
182 
183 struct pr_usrreqs udp6_usrreqs = {
184 	.pru_abort =            udp6_abort,
185 	.pru_attach =           udp6_attach,
186 	.pru_bind =             udp6_bind,
187 	.pru_connect =          udp6_connect,
188 	.pru_connectx =         udp6_connectx,
189 	.pru_control =          in6_control,
190 	.pru_detach =           udp6_detach,
191 	.pru_disconnect =       udp6_disconnect,
192 	.pru_disconnectx =      udp6_disconnectx,
193 	.pru_peeraddr =         in6_mapped_peeraddr,
194 	.pru_send =             udp6_send,
195 	.pru_shutdown =         udp_shutdown,
196 	.pru_sockaddr =         in6_mapped_sockaddr,
197 	.pru_sosend =           sosend,
198 	.pru_soreceive =        soreceive,
199 	.pru_defunct =          udp6_defunct,
200 };
201 
202 /*
203  * subroutine of udp6_input(), mainly for source code readability.
204  */
205 static void
udp6_append(struct inpcb * last,struct ip6_hdr * ip6,struct sockaddr_in6 * udp_in6,struct mbuf * n,int off,struct ifnet * ifp)206 udp6_append(struct inpcb *last, struct ip6_hdr *ip6,
207     struct sockaddr_in6 *udp_in6, struct mbuf *n, int off, struct ifnet *ifp)
208 {
209 #pragma unused(ip6)
210 	struct mbuf *__single opts = NULL;
211 	int ret = 0;
212 
213 	if ((last->in6p_flags & INP_CONTROLOPTS) != 0 ||
214 	    SOFLOW_ENABLED(last->in6p_socket) ||
215 	    SO_RECV_CONTROL_OPTS(last->in6p_socket)) {
216 		ret = ip6_savecontrol(last, n, &opts);
217 		if (ret != 0) {
218 			UDP_LOG(last, "ip_savecontrol error %d", ret);
219 			m_freem(n);
220 			m_freem(opts);
221 			return;
222 		}
223 	}
224 	m_adj(n, off);
225 	if (nstat_collect) {
226 		stats_functional_type ifnet_count_type = IFNET_COUNT_TYPE(ifp);
227 		INP_ADD_STAT(last, ifnet_count_type, rxpackets, 1);
228 		INP_ADD_STAT(last, ifnet_count_type, rxbytes, n->m_pkthdr.len);
229 		inp_set_activity_bitmap(last);
230 	}
231 	so_recv_data_stat(last->in6p_socket, n, 0);
232 	if (sbappendaddr(&last->in6p_socket->so_rcv,
233 	    SA(udp_in6), n, opts, NULL) == 0) {
234 		UDP_LOG(last, "sbappendaddr full receive socket buffer");
235 		udpstat.udps_fullsock++;
236 	} else {
237 		sorwakeup(last->in6p_socket);
238 	}
239 }
240 
241 int
udp6_input(struct mbuf ** mp,int * offp,int proto)242 udp6_input(struct mbuf **mp, int *offp, int proto)
243 {
244 #pragma unused(proto)
245 	struct mbuf *m = *mp;
246 	struct ifnet *__single ifp;
247 	struct ip6_hdr *ip6;
248 	struct udphdr *uh;
249 	struct inpcb *__single in6p;
250 	struct  mbuf *__single opts = NULL;
251 	int off = *offp;
252 	int plen, ulen, ret = 0;
253 	stats_functional_type ifnet_count_type = stats_functional_type_none;
254 	struct sockaddr_in6 udp_in6;
255 	struct inpcbinfo *__single pcbinfo = &udbinfo;
256 	struct sockaddr_in6 fromsa;
257 	u_int16_t pf_tag = 0;
258 	boolean_t is_wake_pkt = false;
259 	drop_reason_t drop_reason = DROP_REASON_UNSPECIFIED;
260 
261 	IP6_EXTHDR_CHECK(m, off, sizeof(struct udphdr), return IPPROTO_DONE);
262 
263 	/* Expect 32-bit aligned data pointer on strict-align platforms */
264 	MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
265 
266 	ifp = m->m_pkthdr.rcvif;
267 	ip6 = mtod(m, struct ip6_hdr *);
268 
269 	if (m->m_flags & M_PKTHDR) {
270 		pf_tag = m_pftag(m)->pftag_tag;
271 		if (m->m_pkthdr.pkt_flags & PKTF_WAKE_PKT) {
272 			is_wake_pkt = true;
273 		}
274 	}
275 
276 	udpstat.udps_ipackets++;
277 
278 	plen = ntohs(ip6->ip6_plen) - off + sizeof(*ip6);
279 	uh = (struct udphdr *)(void *)((caddr_t)ip6 + off);
280 	ulen = ntohs((u_short)uh->uh_ulen);
281 
282 	if (plen != ulen) {
283 		udpstat.udps_badlen++;
284 		IF_UDP_STATINC(ifp, badlength);
285 		drop_reason = DROP_REASON_IP_BAD_LENGTH;
286 		goto bad;
287 	}
288 
289 	/* destination port of 0 is illegal, based on RFC768. */
290 	if (uh->uh_dport == 0) {
291 		IF_UDP_STATINC(ifp, port0);
292 		drop_reason = DROP_REASON_IP_ILLEGAL_PORT;
293 		goto bad;
294 	}
295 
296 	/*
297 	 * Checksum extended UDP header and data.
298 	 */
299 	if (udp6_input_checksum(m, uh, off, ulen)) {
300 		drop_reason = DROP_REASON_IP_BAD_CHECKSUM;
301 		goto bad;
302 	}
303 
304 	/*
305 	 * Construct sockaddr format source address.
306 	 */
307 	init_sin6(&fromsa, m);
308 	fromsa.sin6_port = uh->uh_sport;
309 
310 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
311 		int reuse_sock = 0, mcast_delivered = 0;
312 		struct ip6_moptions *imo;
313 
314 		/*
315 		 * Deliver a multicast datagram to all sockets
316 		 * for which the local and remote addresses and ports match
317 		 * those of the incoming datagram.  This allows more than
318 		 * one process to receive multicasts on the same port.
319 		 * (This really ought to be done for unicast datagrams as
320 		 * well, but that would cause problems with existing
321 		 * applications that open both address-specific sockets and
322 		 * a wildcard socket listening to the same port -- they would
323 		 * end up receiving duplicates of every unicast datagram.
324 		 * Those applications open the multiple sockets to overcome an
325 		 * inadequacy of the UDP socket interface, but for backwards
326 		 * compatibility we avoid the problem here rather than
327 		 * fixing the interface.  Maybe 4.5BSD will remedy this?)
328 		 */
329 
330 		/*
331 		 * In a case that laddr should be set to the link-local
332 		 * address (this happens in RIPng), the multicast address
333 		 * specified in the received packet does not match with
334 		 * laddr. To cure this situation, the matching is relaxed
335 		 * if the receiving interface is the same as one specified
336 		 * in the socket and if the destination multicast address
337 		 * matches one of the multicast groups specified in the socket.
338 		 */
339 
340 		/*
341 		 * Construct sockaddr format source address.
342 		 */
343 		init_sin6(&udp_in6, m); /* general init */
344 		udp_in6.sin6_port = uh->uh_sport;
345 		/*
346 		 * KAME note: usually we drop udphdr from mbuf here.
347 		 * We need udphdr for IPsec processing so we do that later.
348 		 */
349 
350 		/*
351 		 * Locate pcb(s) for datagram.
352 		 * (Algorithm copied from raw_intr().)
353 		 */
354 		lck_rw_lock_shared(&pcbinfo->ipi_lock);
355 
356 		LIST_FOREACH(in6p, &udb, inp_list) {
357 #if IPSEC
358 			int skipit;
359 #endif /* IPSEC */
360 
361 			if ((in6p->inp_vflag & INP_IPV6) == 0) {
362 				continue;
363 			}
364 
365 			if (inp_restricted_recv(in6p, ifp)) {
366 				continue;
367 			}
368 			/*
369 			 * Skip unbound sockets before taking the lock on the socket as
370 			 * the test with the destination port in the header will fail
371 			 */
372 			if (in6p->in6p_lport == 0) {
373 				continue;
374 			}
375 
376 			if (in_pcb_checkstate(in6p, WNT_ACQUIRE, 0) ==
377 			    WNT_STOPUSING) {
378 				continue;
379 			}
380 
381 			udp_lock(in6p->in6p_socket, 1, 0);
382 
383 			if (in_pcb_checkstate(in6p, WNT_RELEASE, 1) ==
384 			    WNT_STOPUSING) {
385 				udp_unlock(in6p->in6p_socket, 1, 0);
386 				continue;
387 			}
388 			if (in6p->in6p_lport != uh->uh_dport) {
389 				udp_unlock(in6p->in6p_socket, 1, 0);
390 				continue;
391 			}
392 
393 			/*
394 			 * Handle socket delivery policy for any-source
395 			 * and source-specific multicast. [RFC3678]
396 			 */
397 			imo = in6p->in6p_moptions;
398 			if (imo && IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
399 				struct sockaddr_in6 mcaddr;
400 				int blocked;
401 
402 				IM6O_LOCK(imo);
403 				SOCKADDR_ZERO(&mcaddr, sizeof(struct sockaddr_in6));
404 				mcaddr.sin6_len = sizeof(struct sockaddr_in6);
405 				mcaddr.sin6_family = AF_INET6;
406 				mcaddr.sin6_addr = ip6->ip6_dst;
407 
408 				blocked = im6o_mc_filter(imo, ifp,
409 				    &mcaddr, &fromsa);
410 				IM6O_UNLOCK(imo);
411 				if (blocked != MCAST_PASS) {
412 					udp_unlock(in6p->in6p_socket, 1, 0);
413 					if (blocked == MCAST_NOTSMEMBER ||
414 					    blocked == MCAST_MUTED) {
415 						udpstat.udps_filtermcast++;
416 					}
417 					continue;
418 				}
419 			}
420 			if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) &&
421 			    (!in6_are_addr_equal_scoped(&in6p->in6p_faddr,
422 			    &ip6->ip6_src, in6p->inp_fifscope, ifp->if_index) ||
423 			    in6p->in6p_fport != uh->uh_sport)) {
424 				udp_unlock(in6p->in6p_socket, 1, 0);
425 				continue;
426 			}
427 
428 			reuse_sock = in6p->inp_socket->so_options &
429 			    (SO_REUSEPORT | SO_REUSEADDR);
430 
431 #if NECP
432 			skipit = 0;
433 			if (!necp_socket_is_allowed_to_send_recv_v6(in6p,
434 			    uh->uh_dport, uh->uh_sport, &ip6->ip6_dst,
435 			    &ip6->ip6_src, ifp, pf_tag, NULL, NULL, NULL, NULL)) {
436 				/* do not inject data to pcb */
437 				skipit = 1;
438 				UDP_LOG_DROP_NECP(ip6, uh, in6p, false);
439 			}
440 			if (skipit == 0)
441 #endif /* NECP */
442 			{
443 				struct mbuf *__single n = NULL;
444 				/*
445 				 * KAME NOTE: do not
446 				 * m_copy(m, offset, ...) below.
447 				 * sbappendaddr() expects M_PKTHDR,
448 				 * and m_copy() will copy M_PKTHDR
449 				 * only if offset is 0.
450 				 */
451 				if (reuse_sock) {
452 					n = m_copy(m, 0, M_COPYALL);
453 				}
454 				udp6_append(in6p, ip6, &udp_in6, m,
455 				    off + sizeof(struct udphdr), ifp);
456 				mcast_delivered++;
457 				m = n;
458 			}
459 			if (is_wake_pkt) {
460 				soevent(in6p->in6p_socket,
461 				    SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
462 			}
463 			udp_unlock(in6p->in6p_socket, 1, 0);
464 
465 			/*
466 			 * Don't look for additional matches if this one does
467 			 * not have either the SO_REUSEPORT or SO_REUSEADDR
468 			 * socket options set.  This heuristic avoids searching
469 			 * through all pcbs in the common case of a non-shared
470 			 * port.  It assumes that an application will never
471 			 * clear these options after setting them.
472 			 */
473 			if (reuse_sock == 0 || m == NULL) {
474 				break;
475 			}
476 
477 			/*
478 			 * Expect 32-bit aligned data pointer on strict-align
479 			 * platforms.
480 			 */
481 			MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
482 
483 			/*
484 			 * Recompute IP and UDP header pointers for new mbuf
485 			 */
486 			ip6 = mtod(m, struct ip6_hdr *);
487 			uh = (struct udphdr *)(void *)((caddr_t)ip6 + off);
488 		}
489 		lck_rw_done(&pcbinfo->ipi_lock);
490 
491 		if (mcast_delivered == 0) {
492 			/*
493 			 * No matching pcb found; discard datagram.
494 			 * (No need to send an ICMP Port Unreachable
495 			 * for a broadcast or multicast datgram.)
496 			 */
497 			udpstat.udps_noport++;
498 			udpstat.udps_noportmcast++;
499 			IF_UDP_STATINC(ifp, port_unreach);
500 			drop_reason = DROP_REASON_IP_UNREACHABLE_PORT;
501 			goto bad;
502 		}
503 
504 		/* free the extra copy of mbuf or skipped by NECP */
505 		if (m != NULL) {
506 			m_freem(m);
507 		}
508 		return IPPROTO_DONE;
509 	}
510 
511 #if IPSEC
512 	/*
513 	 * UDP to port 4500 with a payload where the first four bytes are
514 	 * not zero is a UDP encapsulated IPsec packet. Packets where
515 	 * the payload is one byte and that byte is 0xFF are NAT keepalive
516 	 * packets. Decapsulate the ESP packet and carry on with IPsec input
517 	 * or discard the NAT keep-alive.
518 	 */
519 	if (ipsec_bypass == 0 && (esp_udp_encap_port & 0xFFFF) != 0 &&
520 	    (uh->uh_dport == ntohs((u_short)esp_udp_encap_port) ||
521 	    uh->uh_sport == ntohs((u_short)esp_udp_encap_port))) {
522 		union sockaddr_in_4_6 src = {};
523 		union sockaddr_in_4_6 dst = {};
524 
525 		ipsec_fill_ip6_sockaddr_4_6_with_ifscope(&src, &ip6->ip6_src,
526 		    uh->uh_sport, ip6_input_getsrcifscope(m));
527 		ipsec_fill_ip6_sockaddr_4_6_with_ifscope(&dst, &ip6->ip6_dst,
528 		    uh->uh_dport, ip6_input_getdstifscope(m));
529 
530 		/*
531 		 * Check if ESP or keepalive:
532 		 *      1. If the destination port of the incoming packet is 4500.
533 		 *      2. If the source port of the incoming packet is 4500,
534 		 *         then check the SADB to match IP address and port.
535 		 */
536 		bool check_esp = true;
537 		if (uh->uh_dport != ntohs((u_short)esp_udp_encap_port)) {
538 			check_esp = key_checksa_present(&dst, &src);
539 		}
540 
541 		if (check_esp) {
542 			int payload_len = ulen - sizeof(struct udphdr) > 4 ? 4 :
543 			    ulen - sizeof(struct udphdr);
544 
545 			if (m->m_len < off + sizeof(struct udphdr) + payload_len) {
546 				if ((m = m_pullup(m, off + sizeof(struct udphdr) +
547 				    payload_len)) == NULL) {
548 					udpstat.udps_hdrops++;
549 					goto bad;
550 				}
551 				/*
552 				 * Expect 32-bit aligned data pointer on strict-align
553 				 * platforms.
554 				 */
555 				MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
556 
557 				ip6 = mtod(m, struct ip6_hdr *);
558 				uh = (struct udphdr *)(void *)((caddr_t)ip6 + off);
559 			}
560 			/* Check for NAT keepalive packet */
561 			if (payload_len == 1 && *(u_int8_t*)
562 			    ((caddr_t)uh + sizeof(struct udphdr)) == 0xFF) {
563 				goto bad;
564 			} else if (payload_len == 4 && *(u_int32_t*)(void *)
565 			    ((caddr_t)uh + sizeof(struct udphdr)) != 0) {
566 				/* UDP encapsulated IPsec packet to pass through NAT */
567 				/* preserve the udp header */
568 				*offp = off + sizeof(struct udphdr);
569 				return esp6_input(mp, offp, IPPROTO_UDP);
570 			}
571 		}
572 	}
573 #endif /* IPSEC */
574 
575 	/*
576 	 * Locate pcb for datagram.
577 	 */
578 	in6p = in6_pcblookup_hash(&udbinfo, &ip6->ip6_src, uh->uh_sport, ip6_input_getsrcifscope(m),
579 	    &ip6->ip6_dst, uh->uh_dport, ip6_input_getdstifscope(m), 1, m->m_pkthdr.rcvif);
580 	if (in6p == NULL) {
581 		IF_UDP_STATINC(ifp, port_unreach);
582 
583 		if (udp_log_in_vain) {
584 			char buf[INET6_ADDRSTRLEN];
585 
586 			strlcpy(buf, ip6_sprintf(&ip6->ip6_dst), sizeof(buf));
587 			if (udp_log_in_vain < 3) {
588 				log(LOG_INFO, "Connection attempt to UDP "
589 				    "%s:%d from %s:%d\n", buf,
590 				    ntohs(uh->uh_dport),
591 				    ip6_sprintf(&ip6->ip6_src),
592 				    ntohs(uh->uh_sport));
593 			} else if (!(m->m_flags & (M_BCAST | M_MCAST)) &&
594 			    !in6_are_addr_equal_scoped(&ip6->ip6_dst, &ip6->ip6_src, ip6_input_getdstifscope(m), ip6_input_getsrcifscope(m))) {
595 				log(LOG_INFO, "Connection attempt "
596 				    "to UDP %s:%d from %s:%d\n", buf,
597 				    ntohs(uh->uh_dport),
598 				    ip6_sprintf(&ip6->ip6_src),
599 				    ntohs(uh->uh_sport));
600 			}
601 		}
602 		udpstat.udps_noport++;
603 		if (m->m_flags & M_MCAST) {
604 			printf("UDP6: M_MCAST is set in a unicast packet.\n");
605 			udpstat.udps_noportmcast++;
606 			IF_UDP_STATINC(ifp, badmcast);
607 			drop_reason = DROP_REASON_IP_MULTICAST_NO_PORT;
608 			goto bad;
609 		}
610 		icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT, 0);
611 		return IPPROTO_DONE;
612 	}
613 
614 	/*
615 	 * Construct sockaddr format source address.
616 	 * Stuff source address and datagram in user buffer.
617 	 */
618 	udp_lock(in6p->in6p_socket, 1, 0);
619 
620 #if NECP
621 	if (!necp_socket_is_allowed_to_send_recv_v6(in6p, uh->uh_dport,
622 	    uh->uh_sport, &ip6->ip6_dst, &ip6->ip6_src, ifp, pf_tag, NULL, NULL, NULL, NULL)) {
623 		in_pcb_checkstate(in6p, WNT_RELEASE, 1);
624 		UDP_LOG_DROP_NECP(ip6, uh, in6p, false);
625 		udp_unlock(in6p->in6p_socket, 1, 0);
626 		IF_UDP_STATINC(ifp, badipsec);
627 		drop_reason = DROP_REASON_IP_NECP_POLICY_DROP;
628 		goto bad;
629 	}
630 #endif /* NECP */
631 
632 	if (in_pcb_checkstate(in6p, WNT_RELEASE, 1) == WNT_STOPUSING) {
633 		udp_unlock(in6p->in6p_socket, 1, 0);
634 		IF_UDP_STATINC(ifp, cleanup);
635 		goto bad;
636 	}
637 
638 	init_sin6(&udp_in6, m); /* general init */
639 	udp_in6.sin6_port = uh->uh_sport;
640 	if ((in6p->in6p_flags & INP_CONTROLOPTS) != 0 ||
641 	    SOFLOW_ENABLED(in6p->in6p_socket) ||
642 	    SO_RECV_CONTROL_OPTS(in6p->in6p_socket)) {
643 		ret = ip6_savecontrol(in6p, m, &opts);
644 		if (ret != 0) {
645 			UDP_LOG(in6p, "ip_savecontrol error %d", ret);
646 			udp_unlock(in6p->in6p_socket, 1, 0);
647 			drop_reason = DROP_REASON_IP_ENOBUFS;
648 			goto bad;
649 		}
650 	}
651 	m_adj(m, off + sizeof(struct udphdr));
652 	if (nstat_collect) {
653 		ifnet_count_type = IFNET_COUNT_TYPE(ifp);
654 		INP_ADD_STAT(in6p, ifnet_count_type, rxpackets, 1);
655 		INP_ADD_STAT(in6p, ifnet_count_type, rxbytes, m->m_pkthdr.len);
656 		inp_set_activity_bitmap(in6p);
657 	}
658 	so_recv_data_stat(in6p->in6p_socket, m, 0);
659 	if (sbappendaddr(&in6p->in6p_socket->so_rcv,
660 	    SA(&udp_in6), m, opts, NULL) == 0) {
661 		UDP_LOG(in6p, "sbappendaddr full receive socket buffer");
662 		m = NULL;
663 		opts = NULL;
664 		udpstat.udps_fullsock++;
665 		udp_unlock(in6p->in6p_socket, 1, 0);
666 		goto bad;
667 	}
668 	if (is_wake_pkt) {
669 		soevent(in6p->in6p_socket, SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
670 	}
671 	sorwakeup(in6p->in6p_socket);
672 	udp_unlock(in6p->in6p_socket, 1, 0);
673 	return IPPROTO_DONE;
674 bad:
675 	if (m != NULL) {
676 		m_drop(m, DROPTAP_FLAG_DIR_IN | DROPTAP_FLAG_L2_MISSING, drop_reason, NULL, 0);
677 	}
678 	if (opts != NULL) {
679 		m_freem(opts);
680 	}
681 	return IPPROTO_DONE;
682 }
683 
684 void
udp6_ctlinput(int cmd,struct sockaddr * sa,void * d,__unused struct ifnet * ifp)685 udp6_ctlinput(int cmd, struct sockaddr *sa, void *d, __unused struct ifnet *ifp)
686 {
687 	struct udphdr uh;
688 	struct ip6_hdr *ip6;
689 	struct mbuf *m;
690 	int off = 0;
691 	struct ip6ctlparam *__single ip6cp = NULL;
692 	struct icmp6_hdr *__single icmp6 = NULL;
693 	const struct sockaddr_in6 *__single sa6_src = NULL;
694 	void *__single cmdarg = NULL;
695 	void (*notify)(struct inpcb *, int) = udp_notify;
696 	struct inpcb *__single in6p;
697 	struct udp_portonly {
698 		u_int16_t uh_sport;
699 		u_int16_t uh_dport;
700 	} *uhp;
701 
702 	if (sa->sa_family != AF_INET6 ||
703 	    sa->sa_len != sizeof(struct sockaddr_in6)) {
704 		return;
705 	}
706 
707 	if ((unsigned)cmd >= PRC_NCMDS) {
708 		return;
709 	}
710 	if (PRC_IS_REDIRECT(cmd)) {
711 		notify = in6_rtchange;
712 		d = NULL;
713 	} else if (cmd == PRC_HOSTDEAD) {
714 		d = NULL;
715 	} else if (inet6ctlerrmap[cmd] == 0) {
716 		return;
717 	}
718 
719 	/* if the parameter is from icmp6, decode it. */
720 	if (d != NULL) {
721 		ip6cp = (struct ip6ctlparam *)d;
722 		icmp6 = ip6cp->ip6c_icmp6;
723 		m = ip6cp->ip6c_m;
724 		ip6 = ip6cp->ip6c_ip6;
725 		off = ip6cp->ip6c_off;
726 		cmdarg = ip6cp->ip6c_cmdarg;
727 		sa6_src = ip6cp->ip6c_src;
728 	} else {
729 		m = NULL;
730 		ip6 = NULL;
731 		cmdarg = NULL;
732 		sa6_src = &sa6_any;
733 	}
734 
735 	if (ip6 != NULL) {
736 #if SKYWALK
737 		union sockaddr_in_4_6 sock_laddr;
738 		struct protoctl_ev_val prctl_ev_val;
739 #endif /* SKYWALK */
740 		/*
741 		 * XXX: We assume that when IPV6 is non NULL,
742 		 * M and OFF are valid.
743 		 */
744 		/* check if we can safely examine src and dst ports */
745 		if (m->m_pkthdr.len < off + sizeof(*uhp)) {
746 			return;
747 		}
748 
749 		bzero(&uh, sizeof(uh));
750 		m_copydata(m, off, sizeof(*uhp), (caddr_t)&uh);
751 
752 		in6p = in6_pcblookup_hash(&udbinfo, &ip6->ip6_dst, uh.uh_dport, ip6_input_getdstifscope(m),
753 		    &ip6->ip6_src, uh.uh_sport, ip6_input_getsrcifscope(m), 0, NULL);
754 		if (cmd == PRC_MSGSIZE && in6p != NULL && !uuid_is_null(in6p->necp_client_uuid)) {
755 			uuid_t null_uuid;
756 			uuid_clear(null_uuid);
757 			necp_update_flow_protoctl_event(null_uuid, in6p->necp_client_uuid,
758 			    PRC_MSGSIZE, ntohl(icmp6->icmp6_mtu), 0);
759 			/*
760 			 * Avoid setting so_error when using Network.framework
761 			 * since the notification of PRC_MSGSIZE has been delivered
762 			 * through NECP.
763 			 */
764 			in6_pcbnotify(&udbinfo, sa, uh.uh_dport,
765 			    SA(ip6cp->ip6c_src), uh.uh_sport,
766 			    cmd, cmdarg, NULL);
767 		} else {
768 			in6_pcbnotify(&udbinfo, sa, uh.uh_dport,
769 			    SA(ip6cp->ip6c_src), uh.uh_sport,
770 			    cmd, cmdarg, notify);
771 		}
772 #if SKYWALK
773 		bzero(&prctl_ev_val, sizeof(prctl_ev_val));
774 		bzero(&sock_laddr, sizeof(sock_laddr));
775 
776 		if (cmd == PRC_MSGSIZE && icmp6 != NULL) {
777 			prctl_ev_val.val = ntohl(icmp6->icmp6_mtu);
778 		}
779 		sock_laddr.sin6.sin6_family = AF_INET6;
780 		sock_laddr.sin6.sin6_len = sizeof(sock_laddr.sin6);
781 		sock_laddr.sin6.sin6_addr = ip6->ip6_src;
782 
783 		protoctl_event_enqueue_nwk_wq_entry(ifp,
784 		    SA(&sock_laddr), sa,
785 		    uh.uh_sport, uh.uh_dport, IPPROTO_UDP,
786 		    cmd, &prctl_ev_val);
787 #endif /* SKYWALK */
788 	}
789 	/*
790 	 * XXX The else condition here was broken for a long time.
791 	 * Fixing it made us deliver notification correctly but broke
792 	 * some frameworks that didn't handle it well.
793 	 * For now we have removed it and will revisit it later.
794 	 */
795 }
796 
797 static int
udp6_abort(struct socket * so)798 udp6_abort(struct socket *so)
799 {
800 	struct inpcb *__single inp;
801 
802 	inp = sotoinpcb(so);
803 	if (inp == NULL) {
804 		panic("%s: so=%p null inp", __func__, so);
805 		/* NOTREACHED */
806 	}
807 	soisdisconnected(so);
808 	in6_pcbdetach(inp);
809 	return 0;
810 }
811 
812 static int
udp6_attach(struct socket * so,int proto,struct proc * p)813 udp6_attach(struct socket *so, int proto, struct proc *p)
814 {
815 #pragma unused(proto)
816 	struct inpcb *__single inp;
817 	int error;
818 
819 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
820 		error = soreserve(so, udp_sendspace, udp_recvspace);
821 		if (error) {
822 			return error;
823 		}
824 	}
825 
826 	inp = sotoinpcb(so);
827 	if (inp != NULL) {
828 		return EINVAL;
829 	}
830 
831 	error = in_pcballoc(so, &udbinfo, p);
832 	if (error) {
833 		return error;
834 	}
835 
836 	inp = (struct inpcb *)so->so_pcb;
837 	inp->inp_vflag |= INP_IPV6;
838 	if (ip6_mapped_addr_on) {
839 		inp->inp_vflag |= INP_IPV4;
840 	}
841 	inp->in6p_hops = -1;    /* use kernel default */
842 	inp->in6p_cksum = -1;   /* just to be sure */
843 	/*
844 	 * XXX: ugly!!
845 	 * IPv4 TTL initialization is necessary for an IPv6 socket as well,
846 	 * because the socket may be bound to an IPv6 wildcard address,
847 	 * which may match an IPv4-mapped IPv6 address.
848 	 */
849 	inp->inp_ip_ttl = (u_char)ip_defttl;
850 	if (nstat_collect) {
851 		nstat_udp_new_pcb(inp);
852 	}
853 	return 0;
854 }
855 
856 static int
udp6_bind(struct socket * so,struct sockaddr * nam,struct proc * p)857 udp6_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
858 {
859 	struct inpcb *__single inp;
860 	int error;
861 
862 	inp = sotoinpcb(so);
863 	if (inp == NULL) {
864 		return EINVAL;
865 	}
866 	inp_enter_bind_in_progress(so);
867 
868 	const uint8_t old_flags = inp->inp_vflag;
869 	inp->inp_vflag &= ~INP_IPV4;
870 	inp->inp_vflag |= INP_IPV6;
871 
872 	if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
873 		struct sockaddr_in6 *__single sin6_p;
874 
875 		sin6_p = SIN6(nam);
876 
877 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6_p->sin6_addr)) {
878 			inp->inp_vflag |= INP_IPV4;
879 			inp->inp_vflag &= ~INP_V4MAPPEDV6;
880 		} else if (IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr)) {
881 			struct sockaddr_in sin;
882 
883 			in6_sin6_2_sin(&sin, sin6_p);
884 			inp->inp_vflag |= INP_IPV4;
885 			inp->inp_vflag &= ~INP_IPV6;
886 			inp->inp_vflag |= INP_V4MAPPEDV6;
887 
888 			error = in_pcbbind(inp, SA(&sin), NULL, p);
889 			if (error != 0) {
890 				inp->inp_vflag = old_flags;
891 			}
892 			goto out;
893 		}
894 	}
895 
896 	error = in6_pcbbind(inp, nam, NULL, p);
897 	if (error != 0) {
898 		inp->inp_vflag = old_flags;
899 	}
900 out:
901 	UDP_LOG_BIND(inp, error);
902 
903 	inp_exit_bind_in_progress(so);
904 
905 	return error;
906 }
907 
908 int
udp6_connect(struct socket * so,struct sockaddr * nam,struct proc * p)909 udp6_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
910 {
911 	struct inpcb *__single inp;
912 	int error;
913 	struct sockaddr_in6 *__single sin6_p = SIN6(nam);
914 
915 #if defined(NECP) && defined(FLOW_DIVERT)
916 	int should_use_flow_divert = 0;
917 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
918 
919 	inp = sotoinpcb(so);
920 	if (inp == NULL) {
921 		return EINVAL;
922 	}
923 
924 	inp_enter_bind_in_progress(so);
925 
926 #if defined(NECP) && defined(FLOW_DIVERT)
927 	should_use_flow_divert = necp_socket_should_use_flow_divert(inp);
928 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
929 
930 	/*
931 	 * It is possible that the socket is bound to v4 mapped v6 address.
932 	 * Post that do not allow connect to a v6 endpoint.
933 	 */
934 	if (inp->inp_vflag & INP_V4MAPPEDV6 &&
935 	    !IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr)) {
936 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6_p->sin6_addr)) {
937 			sin6_p->sin6_addr.s6_addr[10] = 0xff;
938 			sin6_p->sin6_addr.s6_addr[11] = 0xff;
939 		} else {
940 			error = EINVAL;
941 			goto done;
942 		}
943 	}
944 
945 	if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
946 		if (IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr)) {
947 			struct sockaddr_in sin;
948 			const uint8_t old_flags = inp->inp_vflag;
949 
950 			if (inp->inp_faddr.s_addr != INADDR_ANY) {
951 				error = EISCONN;
952 				goto done;
953 			}
954 			/*
955 			 * If bound to an IPv6 address, we cannot connect to
956 			 * an IPv4 mapped address
957 			 */
958 			if (inp->inp_vflag == INP_IPV6) {
959 				error = EINVAL;
960 				goto done;
961 			}
962 
963 			if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
964 				so->so_flags1 |= SOF1_CONNECT_COUNTED;
965 				INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
966 			}
967 
968 			in6_sin6_2_sin(&sin, sin6_p);
969 #if defined(NECP) && defined(FLOW_DIVERT)
970 			if (should_use_flow_divert) {
971 				goto do_flow_divert;
972 			}
973 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
974 			inp->inp_vflag |= INP_IPV4;
975 			inp->inp_vflag &= ~INP_IPV6;
976 			inp->inp_vflag |= INP_V4MAPPEDV6;
977 
978 			error = in_pcbconnect(inp, SA(&sin), p, IFSCOPE_NONE, NULL);
979 			if (error == 0) {
980 #if NECP
981 				/* Update NECP client with connected five-tuple */
982 				if (!uuid_is_null(inp->necp_client_uuid)) {
983 					socket_unlock(so, 0);
984 					necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
985 					socket_lock(so, 0);
986 				}
987 #endif /* NECP */
988 				soisconnected(so);
989 			} else {
990 				inp->inp_vflag = old_flags;
991 			}
992 			goto done;
993 		}
994 	}
995 
996 	/*
997 	 * If bound to an IPv4 mapped address, we cannot connect to
998 	 * an IPv6 address
999 	 */
1000 	if (inp->inp_vflag == INP_IPV4) {
1001 		error = EINVAL;
1002 		goto done;
1003 	}
1004 
1005 	if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1006 		error = EISCONN;
1007 		goto done;
1008 	}
1009 
1010 	if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
1011 		so->so_flags1 |= SOF1_CONNECT_COUNTED;
1012 		INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet6_dgram_connected);
1013 	}
1014 
1015 #if defined(NECP) && defined(FLOW_DIVERT)
1016 do_flow_divert:
1017 	if (should_use_flow_divert) {
1018 		error = flow_divert_pcb_init(so);
1019 		if (error == 0) {
1020 			error = flow_divert_connect_out(so, nam, p);
1021 		}
1022 		goto done;
1023 	}
1024 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
1025 
1026 	error = in6_pcbconnect(inp, nam, p);
1027 	if (error == 0) {
1028 		/* should be non mapped addr */
1029 		if (ip6_mapped_addr_on ||
1030 		    (inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
1031 			inp->inp_vflag &= ~INP_IPV4;
1032 			inp->inp_vflag |= INP_IPV6;
1033 		}
1034 #if NECP
1035 		/* Update NECP client with connected five-tuple */
1036 		if (!uuid_is_null(inp->necp_client_uuid)) {
1037 			socket_unlock(so, 0);
1038 			necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
1039 			socket_lock(so, 0);
1040 		}
1041 #endif /* NECP */
1042 		soisconnected(so);
1043 		if (inp->inp_flowhash == 0) {
1044 			inp_calc_flowhash(inp);
1045 			ASSERT(inp->inp_flowhash != 0);
1046 		}
1047 		/* update flowinfo - RFC 6437 */
1048 		if (inp->inp_flow == 0 &&
1049 		    inp->in6p_flags & IN6P_AUTOFLOWLABEL) {
1050 			inp->inp_flow &= ~IPV6_FLOWLABEL_MASK;
1051 			inp->inp_flow |=
1052 			    (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
1053 		}
1054 		inp->inp_connect_timestamp = mach_continuous_time();
1055 	}
1056 done:
1057 	UDP_LOG_CONNECT(inp, error);
1058 
1059 	inp_exit_bind_in_progress(so);
1060 
1061 	return error;
1062 }
1063 
1064 static int
udp6_connectx(struct socket * so,struct sockaddr * src,struct sockaddr * dst,struct proc * p,uint32_t ifscope,sae_associd_t aid,sae_connid_t * pcid,uint32_t flags,void * arg,uint32_t arglen,struct uio * uio,user_ssize_t * bytes_written)1065 udp6_connectx(struct socket *so, struct sockaddr *src,
1066     struct sockaddr *dst, struct proc *p, uint32_t ifscope,
1067     sae_associd_t aid, sae_connid_t *pcid, uint32_t flags, void *arg,
1068     uint32_t arglen, struct uio *uio, user_ssize_t *bytes_written)
1069 {
1070 	return udp_connectx_common(so, AF_INET6, src, dst,
1071 	           p, ifscope, aid, pcid, flags, arg, arglen, uio, bytes_written);
1072 }
1073 
1074 static int
udp6_detach(struct socket * so)1075 udp6_detach(struct socket *so)
1076 {
1077 	struct inpcb *__single inp;
1078 
1079 	inp = sotoinpcb(so);
1080 	if (inp == NULL) {
1081 		return EINVAL;
1082 	}
1083 
1084 	UDP_LOG_CONNECTION_SUMMARY(inp);
1085 
1086 	in6_pcbdetach(inp);
1087 	return 0;
1088 }
1089 
1090 static int
udp6_disconnect(struct socket * so)1091 udp6_disconnect(struct socket *so)
1092 {
1093 	struct inpcb *__single inp;
1094 
1095 	inp = sotoinpcb(so);
1096 	if (inp == NULL
1097 #if NECP
1098 	    || (necp_socket_should_use_flow_divert(inp))
1099 #endif /* NECP */
1100 	    ) {
1101 		return inp == NULL ? EINVAL : EPROTOTYPE;
1102 	}
1103 
1104 	if (inp->inp_vflag & INP_IPV4) {
1105 		struct pr_usrreqs *__single pru;
1106 
1107 		pru = ip_protox[IPPROTO_UDP]->pr_usrreqs;
1108 		return (*pru->pru_disconnect)(so);
1109 	}
1110 
1111 	if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1112 		return ENOTCONN;
1113 	}
1114 
1115 	UDP_LOG_CONNECTION_SUMMARY(inp);
1116 
1117 	in6_pcbdisconnect(inp);
1118 
1119 	/* reset flow-controlled state, just in case */
1120 	inp_reset_fc_state(inp);
1121 
1122 	inp->in6p_laddr = in6addr_any;
1123 	inp->inp_lifscope = IFSCOPE_NONE;
1124 	inp->in6p_last_outifp = NULL;
1125 #if SKYWALK
1126 	if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
1127 		netns_set_ifnet(&inp->inp_netns_token, NULL);
1128 	}
1129 #endif /* SKYWALK */
1130 
1131 	so->so_state &= ~SS_ISCONNECTED;                /* XXX */
1132 	return 0;
1133 }
1134 
1135 static int
udp6_disconnectx(struct socket * so,sae_associd_t aid,sae_connid_t cid)1136 udp6_disconnectx(struct socket *so, sae_associd_t aid, sae_connid_t cid)
1137 {
1138 #pragma unused(cid)
1139 	if (aid != SAE_ASSOCID_ANY && aid != SAE_ASSOCID_ALL) {
1140 		return EINVAL;
1141 	}
1142 
1143 	return udp6_disconnect(so);
1144 }
1145 
1146 static int
udp6_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * addr,struct mbuf * control,struct proc * p)1147 udp6_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
1148     struct mbuf *control, struct proc *p)
1149 {
1150 	struct inpcb *__single inp;
1151 	int error = 0;
1152 #if defined(NECP) && defined(FLOW_DIVERT)
1153 	int should_use_flow_divert = 0;
1154 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
1155 #if CONTENT_FILTER
1156 	struct m_tag *__single cfil_tag = NULL;
1157 	struct sockaddr *__single cfil_faddr = NULL;
1158 #endif
1159 
1160 	inp = sotoinpcb(so);
1161 	if (inp == NULL) {
1162 		error = EINVAL;
1163 		goto bad;
1164 	}
1165 
1166 #if CONTENT_FILTER
1167 	/* If socket is subject to UDP Content Filter and unconnected, get addr from tag. */
1168 	if (CFIL_DGRAM_FILTERED(so) && !addr && IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1169 		cfil_tag = cfil_dgram_get_socket_state(m, NULL, NULL, &cfil_faddr, NULL);
1170 		if (cfil_tag) {
1171 			addr = SA(cfil_faddr);
1172 		}
1173 	}
1174 #endif
1175 
1176 #if defined(NECP) && defined(FLOW_DIVERT)
1177 	should_use_flow_divert = necp_socket_should_use_flow_divert(inp);
1178 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
1179 
1180 	if (addr != NULL) {
1181 		if (addr->sa_len != sizeof(struct sockaddr_in6)) {
1182 			error = EINVAL;
1183 			goto bad;
1184 		}
1185 		if (addr->sa_family != AF_INET6) {
1186 			error = EAFNOSUPPORT;
1187 			goto bad;
1188 		}
1189 	}
1190 
1191 	if (ip6_mapped_addr_on || (inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
1192 		int hasv4addr;
1193 		struct sockaddr_in6 *__single sin6 = NULL;
1194 
1195 		if (addr == NULL) {
1196 			hasv4addr = (inp->inp_vflag & INP_IPV4);
1197 		} else {
1198 			sin6 = SIN6(addr);
1199 			hasv4addr =
1200 			    IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr) ? 1 : 0;
1201 		}
1202 		if (hasv4addr) {
1203 			struct pr_usrreqs *__single pru;
1204 
1205 			if (sin6 != NULL) {
1206 				in6_sin6_2_sin_in_sock(addr);
1207 			}
1208 #if defined(NECP) && defined(FLOW_DIVERT)
1209 			if (should_use_flow_divert) {
1210 				goto do_flow_divert;
1211 			}
1212 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
1213 			pru = ip_protox[IPPROTO_UDP]->pr_usrreqs;
1214 			error = ((*pru->pru_send)(so, flags, m, addr,
1215 			    control, p));
1216 #if CONTENT_FILTER
1217 			if (cfil_tag) {
1218 				m_tag_free(cfil_tag);
1219 			}
1220 #endif
1221 			/* addr will just be freed in sendit(). */
1222 			return error;
1223 		}
1224 	}
1225 
1226 #if defined(NECP) && defined(FLOW_DIVERT)
1227 do_flow_divert:
1228 	if (should_use_flow_divert) {
1229 		/* Implicit connect */
1230 		error = flow_divert_implicit_data_out(so, flags, m, addr, control, p);
1231 #if CONTENT_FILTER
1232 		if (cfil_tag) {
1233 			m_tag_free(cfil_tag);
1234 		}
1235 #endif
1236 		return error;
1237 	}
1238 #endif /* defined(NECP) && defined(FLOW_DIVERT) */
1239 
1240 	so_update_tx_data_stats(so, 1, m->m_pkthdr.len);
1241 
1242 	in_pcb_check_management_entitled(inp);
1243 	in_pcb_check_ultra_constrained_entitled(inp);
1244 
1245 #if SKYWALK
1246 	sk_protect_t __single protect = sk_async_transmit_protect();
1247 #endif /* SKYWALK */
1248 	error = udp6_output(inp, m, addr, control, p);
1249 #if SKYWALK
1250 	sk_async_transmit_unprotect(protect);
1251 #endif /* SKYWALK */
1252 
1253 #if CONTENT_FILTER
1254 	if (cfil_tag) {
1255 		m_tag_free(cfil_tag);
1256 	}
1257 #endif
1258 	return error;
1259 
1260 bad:
1261 	VERIFY(error != 0);
1262 
1263 	if (m != NULL) {
1264 		m_freem(m);
1265 	}
1266 	if (control != NULL) {
1267 		m_freem(control);
1268 	}
1269 #if CONTENT_FILTER
1270 	if (cfil_tag) {
1271 		m_tag_free(cfil_tag);
1272 	}
1273 #endif
1274 	return error;
1275 }
1276 
1277 /*
1278  * Checksum extended UDP header and data.
1279  */
1280 static int
udp6_input_checksum(struct mbuf * m,struct udphdr * uh,int off,int ulen)1281 udp6_input_checksum(struct mbuf *m, struct udphdr *uh, int off, int ulen)
1282 {
1283 	struct ifnet *__single ifp = m->m_pkthdr.rcvif;
1284 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1285 
1286 	if (!(m->m_pkthdr.csum_flags & CSUM_DATA_VALID) &&
1287 	    uh->uh_sum == 0) {
1288 		/* UDP/IPv6 checksum is mandatory (RFC2460) */
1289 
1290 		/*
1291 		 * If checksum was already validated, ignore this check.
1292 		 * This is necessary for transport-mode ESP, which may be
1293 		 * getting UDP payloads without checksums when the network
1294 		 * has a NAT64.
1295 		 */
1296 		udpstat.udps_nosum++;
1297 		goto badsum;
1298 	}
1299 
1300 	if ((hwcksum_rx || (ifp->if_flags & IFF_LOOPBACK) ||
1301 	    (m->m_pkthdr.pkt_flags & PKTF_LOOP)) &&
1302 	    (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)) {
1303 		if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
1304 			uh->uh_sum = m->m_pkthdr.csum_rx_val;
1305 		} else {
1306 			uint32_t sum = m->m_pkthdr.csum_rx_val;
1307 			uint32_t start = m->m_pkthdr.csum_rx_start;
1308 			int32_t trailer = (m_pktlen(m) - (off + ulen));
1309 
1310 			/*
1311 			 * Perform 1's complement adjustment of octets
1312 			 * that got included/excluded in the hardware-
1313 			 * calculated checksum value.  Also take care
1314 			 * of any trailing bytes and subtract out
1315 			 * their partial sum.
1316 			 */
1317 			ASSERT(trailer >= 0);
1318 			if ((m->m_pkthdr.csum_flags & CSUM_PARTIAL) &&
1319 			    (start != off || trailer != 0)) {
1320 				uint32_t swbytes = (uint32_t)trailer;
1321 				uint16_t s = 0, d = 0;
1322 
1323 				if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
1324 					s = ip6->ip6_src.s6_addr16[1];
1325 					ip6->ip6_src.s6_addr16[1] = 0;
1326 				}
1327 				if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
1328 					d = ip6->ip6_dst.s6_addr16[1];
1329 					ip6->ip6_dst.s6_addr16[1] = 0;
1330 				}
1331 
1332 				/* callee folds in sum */
1333 				sum = m_adj_sum16(m, start, off, ulen, sum);
1334 				if (off > start) {
1335 					swbytes += (off - start);
1336 				} else {
1337 					swbytes += (start - off);
1338 				}
1339 
1340 				if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
1341 					ip6->ip6_src.s6_addr16[1] = s;
1342 				}
1343 				if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
1344 					ip6->ip6_dst.s6_addr16[1] = d;
1345 				}
1346 
1347 				if (swbytes != 0) {
1348 					udp_in_cksum_stats(swbytes);
1349 				}
1350 				if (trailer != 0) {
1351 					m_adj(m, -trailer);
1352 				}
1353 			}
1354 
1355 			uh->uh_sum = in6_pseudo(&ip6->ip6_src, &ip6->ip6_dst,
1356 			    sum + htonl(ulen + IPPROTO_UDP));
1357 		}
1358 		uh->uh_sum ^= 0xffff;
1359 	} else {
1360 		udp_in6_cksum_stats(ulen);
1361 		uh->uh_sum = in6_cksum(m, IPPROTO_UDP, off, ulen);
1362 	}
1363 
1364 	if (uh->uh_sum != 0) {
1365 badsum:
1366 		udpstat.udps_badsum++;
1367 		IF_UDP_STATINC(ifp, badchksum);
1368 		return -1;
1369 	}
1370 
1371 	return 0;
1372 }
1373 
1374 int
udp6_defunct(struct socket * so)1375 udp6_defunct(struct socket *so)
1376 {
1377 	struct ip_moptions *__single imo;
1378 	struct ip6_moptions *__single im6o;
1379 	struct inpcb *__single inp;
1380 
1381 	inp = sotoinpcb(so);
1382 	if (inp == NULL) {
1383 		return EINVAL;
1384 	}
1385 
1386 	im6o = inp->in6p_moptions;
1387 	inp->in6p_moptions = NULL;
1388 	if (im6o != NULL) {
1389 		struct proc *p = current_proc();
1390 
1391 		SODEFUNCTLOG("%s[%d, %s]: defuncting so 0x%llu drop ipv6 multicast memberships",
1392 		    __func__, proc_pid(p), proc_best_name(p),
1393 		    so->so_gencnt);
1394 		IM6O_REMREF(im6o);
1395 	}
1396 	imo = inp->inp_moptions;
1397 	if (imo != NULL) {
1398 		struct proc *__single p = current_proc();
1399 
1400 		SODEFUNCTLOG("%s[%d, %s]: defuncting so 0x%llu drop ipv4 multicast memberships",
1401 		    __func__, proc_pid(p), proc_best_name(p),
1402 		    so->so_gencnt);
1403 
1404 		inp->inp_moptions = NULL;
1405 
1406 		IMO_REMREF(imo);
1407 	}
1408 
1409 	return 0;
1410 }
1411