1 /*
2 * Copyright (c) 2000-2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)udp_usrreq.c 8.6 (Berkeley) 5/23/95
61 */
62
63 #include <sys/param.h>
64 #include <sys/systm.h>
65 #include <sys/kernel.h>
66 #include <sys/malloc.h>
67 #include <sys/mbuf.h>
68 #include <sys/domain.h>
69 #include <sys/protosw.h>
70 #include <sys/socket.h>
71 #include <sys/socketvar.h>
72 #include <sys/sysctl.h>
73 #include <sys/syslog.h>
74 #include <sys/mcache.h>
75 #include <net/ntstat.h>
76
77 #include <kern/zalloc.h>
78 #include <mach/boolean.h>
79
80 #include <net/if.h>
81 #include <net/if_types.h>
82 #include <net/route.h>
83 #include <net/dlil.h>
84 #include <net/net_api_stats.h>
85
86 #include <netinet/in.h>
87 #include <netinet/in_systm.h>
88 #include <netinet/in_tclass.h>
89 #include <netinet/ip.h>
90 #include <netinet/ip6.h>
91 #include <netinet/in_pcb.h>
92 #include <netinet/in_var.h>
93 #include <netinet/ip_var.h>
94 #include <netinet6/in6_pcb.h>
95 #include <netinet6/ip6_var.h>
96 #include <netinet6/udp6_var.h>
97 #include <netinet/ip_icmp.h>
98 #include <netinet/icmp_var.h>
99 #include <netinet/udp.h>
100 #include <netinet/udp_var.h>
101 #include <sys/kdebug.h>
102
103 #if IPSEC
104 #include <netinet6/ipsec.h>
105 #include <netinet6/esp.h>
106 #include <netkey/key.h>
107 extern int ipsec_bypass;
108 extern int esp_udp_encap_port;
109 #endif /* IPSEC */
110
111 #if NECP
112 #include <net/necp.h>
113 #endif /* NECP */
114
115 #if FLOW_DIVERT
116 #include <netinet/flow_divert.h>
117 #endif /* FLOW_DIVERT */
118
119 #if CONTENT_FILTER
120 #include <net/content_filter.h>
121 #endif /* CONTENT_FILTER */
122
123 #if SKYWALK
124 #include <skywalk/core/skywalk_var.h>
125 #endif /* SKYWALK */
126
127 #define DBG_LAYER_IN_BEG NETDBG_CODE(DBG_NETUDP, 0)
128 #define DBG_LAYER_IN_END NETDBG_CODE(DBG_NETUDP, 2)
129 #define DBG_LAYER_OUT_BEG NETDBG_CODE(DBG_NETUDP, 1)
130 #define DBG_LAYER_OUT_END NETDBG_CODE(DBG_NETUDP, 3)
131 #define DBG_FNC_UDP_INPUT NETDBG_CODE(DBG_NETUDP, (5 << 8))
132 #define DBG_FNC_UDP_OUTPUT NETDBG_CODE(DBG_NETUDP, (6 << 8) | 1)
133
134 /*
135 * UDP protocol implementation.
136 * Per RFC 768, August, 1980.
137 */
138 #ifndef COMPAT_42
139 static int udpcksum = 1;
140 #else
141 static int udpcksum = 0; /* XXX */
142 #endif
143 SYSCTL_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum,
144 CTLFLAG_RW | CTLFLAG_LOCKED, &udpcksum, 0, "");
145
146 int udp_log_in_vain = 0;
147 SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_RW | CTLFLAG_LOCKED,
148 &udp_log_in_vain, 0, "Log all incoming UDP packets");
149
150 static int blackhole = 0;
151 SYSCTL_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_RW | CTLFLAG_LOCKED,
152 &blackhole, 0, "Do not send port unreachables for refused connects");
153
154 struct inpcbhead udb; /* from udp_var.h */
155 #define udb6 udb /* for KAME src sync over BSD*'s */
156 struct inpcbinfo udbinfo;
157
158 #ifndef UDBHASHSIZE
159 #define UDBHASHSIZE 16
160 #endif
161
162 /* Garbage collection performed during most recent udp_gc() run */
163 static boolean_t udp_gc_done = FALSE;
164
165 #define log_in_vain_log(a) { log a; }
166
167 static int udp_getstat SYSCTL_HANDLER_ARGS;
168 struct udpstat udpstat; /* from udp_var.h */
169 SYSCTL_PROC(_net_inet_udp, UDPCTL_STATS, stats,
170 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
171 0, 0, udp_getstat, "S,udpstat",
172 "UDP statistics (struct udpstat, netinet/udp_var.h)");
173
174 SYSCTL_INT(_net_inet_udp, OID_AUTO, pcbcount,
175 CTLFLAG_RD | CTLFLAG_LOCKED, &udbinfo.ipi_count, 0,
176 "Number of active PCBs");
177
178 __private_extern__ int udp_use_randomport = 1;
179 SYSCTL_INT(_net_inet_udp, OID_AUTO, randomize_ports,
180 CTLFLAG_RW | CTLFLAG_LOCKED, &udp_use_randomport, 0,
181 "Randomize UDP port numbers");
182
183 struct udp_in6 {
184 struct sockaddr_in6 uin6_sin;
185 u_char uin6_init_done : 1;
186 };
187 struct udp_ip6 {
188 struct ip6_hdr uip6_ip6;
189 u_char uip6_init_done : 1;
190 };
191
192 int udp_abort(struct socket *);
193 int udp_attach(struct socket *, int, struct proc *);
194 int udp_bind(struct socket *, struct sockaddr *, struct proc *);
195 int udp_connect(struct socket *, struct sockaddr *, struct proc *);
196 int udp_connectx(struct socket *, struct sockaddr *,
197 struct sockaddr *, struct proc *, uint32_t, sae_associd_t,
198 sae_connid_t *, uint32_t, void *, uint32_t, struct uio *, user_ssize_t *);
199 int udp_detach(struct socket *);
200 int udp_disconnect(struct socket *);
201 int udp_disconnectx(struct socket *, sae_associd_t, sae_connid_t);
202 int udp_send(struct socket *, int, struct mbuf *, struct sockaddr *,
203 struct mbuf *, struct proc *);
204 static void udp_append(struct inpcb *, struct ip *, struct mbuf *, int,
205 struct sockaddr_in *, struct udp_in6 *, struct udp_ip6 *, struct ifnet *);
206 static int udp_input_checksum(struct mbuf *, struct udphdr *, int, int);
207 int udp_output(struct inpcb *, struct mbuf *, struct sockaddr *,
208 struct mbuf *, struct proc *);
209 static void ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip);
210 static void udp_gc(struct inpcbinfo *);
211
212 struct pr_usrreqs udp_usrreqs = {
213 .pru_abort = udp_abort,
214 .pru_attach = udp_attach,
215 .pru_bind = udp_bind,
216 .pru_connect = udp_connect,
217 .pru_connectx = udp_connectx,
218 .pru_control = in_control,
219 .pru_detach = udp_detach,
220 .pru_disconnect = udp_disconnect,
221 .pru_disconnectx = udp_disconnectx,
222 .pru_peeraddr = in_getpeeraddr,
223 .pru_send = udp_send,
224 .pru_shutdown = udp_shutdown,
225 .pru_sockaddr = in_getsockaddr,
226 .pru_sosend = sosend,
227 .pru_soreceive = soreceive,
228 .pru_soreceive_list = soreceive_list,
229 };
230
231 void
udp_init(struct protosw * pp,struct domain * dp)232 udp_init(struct protosw *pp, struct domain *dp)
233 {
234 #pragma unused(dp)
235 static int udp_initialized = 0;
236 struct inpcbinfo *pcbinfo;
237
238 VERIFY((pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
239
240 if (udp_initialized) {
241 return;
242 }
243 udp_initialized = 1;
244 uint32_t pool_size = (nmbclusters << MCLSHIFT) >> MBSHIFT;
245 if (pool_size >= 96) {
246 /* Improves 10GbE UDP performance. */
247 udp_recvspace = 786896;
248 }
249 LIST_INIT(&udb);
250 udbinfo.ipi_listhead = &udb;
251 udbinfo.ipi_hashbase = hashinit(UDBHASHSIZE, M_PCB,
252 &udbinfo.ipi_hashmask);
253 udbinfo.ipi_porthashbase = hashinit(UDBHASHSIZE, M_PCB,
254 &udbinfo.ipi_porthashmask);
255 udbinfo.ipi_zone = zone_create("udpcb", sizeof(struct inpcb), ZC_NONE);
256
257 pcbinfo = &udbinfo;
258 /*
259 * allocate lock group and attribute for udp pcb mutexes
260 */
261 pcbinfo->ipi_lock_grp = lck_grp_alloc_init("udppcb",
262 LCK_GRP_ATTR_NULL);
263 lck_attr_setdefault(&pcbinfo->ipi_lock_attr);
264 lck_rw_init(&pcbinfo->ipi_lock, pcbinfo->ipi_lock_grp,
265 &pcbinfo->ipi_lock_attr);
266
267 udbinfo.ipi_gc = udp_gc;
268 in_pcbinfo_attach(&udbinfo);
269 }
270
271 void
udp_input(struct mbuf * m,int iphlen)272 udp_input(struct mbuf *m, int iphlen)
273 {
274 struct ip *ip;
275 struct udphdr *uh;
276 struct inpcb *inp;
277 struct mbuf *opts = NULL;
278 int len, isbroadcast;
279 struct ip save_ip;
280 struct sockaddr *append_sa;
281 struct inpcbinfo *pcbinfo = &udbinfo;
282 struct sockaddr_in udp_in;
283 struct ip_moptions *imo = NULL;
284 int foundmembership = 0, ret = 0;
285 struct udp_in6 udp_in6;
286 struct udp_ip6 udp_ip6;
287 struct ifnet *ifp = m->m_pkthdr.rcvif;
288 boolean_t cell = IFNET_IS_CELLULAR(ifp);
289 boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
290 boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
291 u_int16_t pf_tag = 0;
292 boolean_t is_wake_pkt = false;
293
294 bzero(&udp_in, sizeof(udp_in));
295 udp_in.sin_len = sizeof(struct sockaddr_in);
296 udp_in.sin_family = AF_INET;
297 bzero(&udp_in6, sizeof(udp_in6));
298 udp_in6.uin6_sin.sin6_len = sizeof(struct sockaddr_in6);
299 udp_in6.uin6_sin.sin6_family = AF_INET6;
300
301 if (m->m_flags & M_PKTHDR) {
302 pf_tag = m_pftag(m)->pftag_tag;
303 if (m->m_pkthdr.pkt_flags & PKTF_WAKE_PKT) {
304 is_wake_pkt = true;
305 }
306 }
307
308 udpstat.udps_ipackets++;
309
310 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
311
312 /* Expect 32-bit aligned data pointer on strict-align platforms */
313 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
314
315 m_add_crumb(m, PKT_CRUMB_UDP_INPUT);
316
317 /*
318 * Strip IP options, if any; should skip this,
319 * make available to user, and use on returned packets,
320 * but we don't yet have a way to check the checksum
321 * with options still present.
322 */
323 if (iphlen > sizeof(struct ip)) {
324 ip_stripoptions(m);
325 iphlen = sizeof(struct ip);
326 }
327
328 /*
329 * Get IP and UDP header together in first mbuf.
330 */
331 ip = mtod(m, struct ip *);
332 if (m->m_len < iphlen + sizeof(struct udphdr)) {
333 m = m_pullup(m, iphlen + sizeof(struct udphdr));
334 if (m == NULL) {
335 udpstat.udps_hdrops++;
336 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
337 0, 0, 0, 0, 0);
338 return;
339 }
340 ip = mtod(m, struct ip *);
341 }
342 uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
343
344 /* destination port of 0 is illegal, based on RFC768. */
345 if (uh->uh_dport == 0) {
346 IF_UDP_STATINC(ifp, port0);
347 goto bad;
348 }
349
350 KERNEL_DEBUG(DBG_LAYER_IN_BEG, uh->uh_dport, uh->uh_sport,
351 ip->ip_src.s_addr, ip->ip_dst.s_addr, uh->uh_ulen);
352
353 /*
354 * Make mbuf data length reflect UDP length.
355 * If not enough data to reflect UDP length, drop.
356 */
357 len = ntohs((u_short)uh->uh_ulen);
358 if (ip->ip_len != len) {
359 if (len > ip->ip_len || len < sizeof(struct udphdr)) {
360 udpstat.udps_badlen++;
361 IF_UDP_STATINC(ifp, badlength);
362 goto bad;
363 }
364 m_adj(m, len - ip->ip_len);
365 /* ip->ip_len = len; */
366 }
367 /*
368 * Save a copy of the IP header in case we want restore it
369 * for sending an ICMP error message in response.
370 */
371 save_ip = *ip;
372
373 /*
374 * Checksum extended UDP header and data.
375 */
376 if (udp_input_checksum(m, uh, iphlen, len)) {
377 goto bad;
378 }
379
380 isbroadcast = in_broadcast(ip->ip_dst, ifp);
381
382 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || isbroadcast) {
383 int reuse_sock = 0, mcast_delivered = 0;
384
385 lck_rw_lock_shared(&pcbinfo->ipi_lock);
386 /*
387 * Deliver a multicast or broadcast datagram to *all* sockets
388 * for which the local and remote addresses and ports match
389 * those of the incoming datagram. This allows more than
390 * one process to receive multi/broadcasts on the same port.
391 * (This really ought to be done for unicast datagrams as
392 * well, but that would cause problems with existing
393 * applications that open both address-specific sockets and
394 * a wildcard socket listening to the same port -- they would
395 * end up receiving duplicates of every unicast datagram.
396 * Those applications open the multiple sockets to overcome an
397 * inadequacy of the UDP socket interface, but for backwards
398 * compatibility we avoid the problem here rather than
399 * fixing the interface. Maybe 4.5BSD will remedy this?)
400 */
401
402 /*
403 * Construct sockaddr format source address.
404 */
405 udp_in.sin_port = uh->uh_sport;
406 udp_in.sin_addr = ip->ip_src;
407 /*
408 * Locate pcb(s) for datagram.
409 * (Algorithm copied from raw_intr().)
410 */
411 udp_in6.uin6_init_done = udp_ip6.uip6_init_done = 0;
412 LIST_FOREACH(inp, &udb, inp_list) {
413 #if IPSEC
414 int skipit;
415 #endif /* IPSEC */
416
417 if (inp->inp_socket == NULL) {
418 continue;
419 }
420 if (inp != sotoinpcb(inp->inp_socket)) {
421 panic("%s: bad so back ptr inp=%p",
422 __func__, inp);
423 /* NOTREACHED */
424 }
425 if ((inp->inp_vflag & INP_IPV4) == 0) {
426 continue;
427 }
428 if (inp_restricted_recv(inp, ifp)) {
429 continue;
430 }
431
432 if ((inp->inp_moptions == NULL) &&
433 (ntohl(ip->ip_dst.s_addr) !=
434 INADDR_ALLHOSTS_GROUP) && (isbroadcast == 0)) {
435 continue;
436 }
437 /*
438 * Skip unbound sockets before taking the lock on the socket as
439 * the test with the destination port in the header will fail
440 */
441 if (inp->inp_lport == 0) {
442 continue;
443 }
444
445 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) ==
446 WNT_STOPUSING) {
447 continue;
448 }
449
450 udp_lock(inp->inp_socket, 1, 0);
451
452 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) ==
453 WNT_STOPUSING) {
454 udp_unlock(inp->inp_socket, 1, 0);
455 continue;
456 }
457
458 if (inp->inp_lport != uh->uh_dport) {
459 udp_unlock(inp->inp_socket, 1, 0);
460 continue;
461 }
462 if (inp->inp_laddr.s_addr != INADDR_ANY) {
463 if (inp->inp_laddr.s_addr !=
464 ip->ip_dst.s_addr) {
465 udp_unlock(inp->inp_socket, 1, 0);
466 continue;
467 }
468 }
469 if (inp->inp_faddr.s_addr != INADDR_ANY) {
470 if (inp->inp_faddr.s_addr !=
471 ip->ip_src.s_addr ||
472 inp->inp_fport != uh->uh_sport) {
473 udp_unlock(inp->inp_socket, 1, 0);
474 continue;
475 }
476 }
477
478 if (isbroadcast == 0 && (ntohl(ip->ip_dst.s_addr) !=
479 INADDR_ALLHOSTS_GROUP)) {
480 struct sockaddr_in group;
481 int blocked;
482
483 if ((imo = inp->inp_moptions) == NULL) {
484 udp_unlock(inp->inp_socket, 1, 0);
485 continue;
486 }
487 IMO_LOCK(imo);
488
489 bzero(&group, sizeof(struct sockaddr_in));
490 group.sin_len = sizeof(struct sockaddr_in);
491 group.sin_family = AF_INET;
492 group.sin_addr = ip->ip_dst;
493
494 blocked = imo_multi_filter(imo, ifp,
495 &group, &udp_in);
496 if (blocked == MCAST_PASS) {
497 foundmembership = 1;
498 }
499
500 IMO_UNLOCK(imo);
501 if (!foundmembership) {
502 udp_unlock(inp->inp_socket, 1, 0);
503 if (blocked == MCAST_NOTSMEMBER ||
504 blocked == MCAST_MUTED) {
505 udpstat.udps_filtermcast++;
506 }
507 continue;
508 }
509 foundmembership = 0;
510 }
511
512 reuse_sock = (inp->inp_socket->so_options &
513 (SO_REUSEPORT | SO_REUSEADDR));
514
515 #if NECP
516 skipit = 0;
517 if (!necp_socket_is_allowed_to_send_recv_v4(inp,
518 uh->uh_dport, uh->uh_sport, &ip->ip_dst,
519 &ip->ip_src, ifp, pf_tag, NULL, NULL, NULL, NULL)) {
520 /* do not inject data to pcb */
521 skipit = 1;
522 }
523 if (skipit == 0)
524 #endif /* NECP */
525 {
526 struct mbuf *n = NULL;
527
528 if (reuse_sock) {
529 n = m_copy(m, 0, M_COPYALL);
530 }
531 udp_append(inp, ip, m,
532 iphlen + sizeof(struct udphdr),
533 &udp_in, &udp_in6, &udp_ip6, ifp);
534 mcast_delivered++;
535
536 m = n;
537 }
538 if (is_wake_pkt) {
539 soevent(inp->inp_socket, SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
540 }
541
542 udp_unlock(inp->inp_socket, 1, 0);
543
544
545 /*
546 * Don't look for additional matches if this one does
547 * not have either the SO_REUSEPORT or SO_REUSEADDR
548 * socket options set. This heuristic avoids searching
549 * through all pcbs in the common case of a non-shared
550 * port. It assumes that an application will never
551 * clear these options after setting them.
552 */
553 if (reuse_sock == 0 || m == NULL) {
554 break;
555 }
556
557 /*
558 * Expect 32-bit aligned data pointer on strict-align
559 * platforms.
560 */
561 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
562 /*
563 * Recompute IP and UDP header pointers for new mbuf
564 */
565 ip = mtod(m, struct ip *);
566 uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
567 }
568 lck_rw_done(&pcbinfo->ipi_lock);
569
570 if (mcast_delivered == 0) {
571 /*
572 * No matching pcb found; discard datagram.
573 * (No need to send an ICMP Port Unreachable
574 * for a broadcast or multicast datgram.)
575 */
576 udpstat.udps_noportbcast++;
577 IF_UDP_STATINC(ifp, port_unreach);
578 goto bad;
579 }
580
581 /* free the extra copy of mbuf or skipped by IPsec */
582 if (m != NULL) {
583 m_freem(m);
584 }
585 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
586 return;
587 }
588
589 #if IPSEC
590 /*
591 * UDP to port 4500 with a payload where the first four bytes are
592 * not zero is a UDP encapsulated IPsec packet. Packets where
593 * the payload is one byte and that byte is 0xFF are NAT keepalive
594 * packets. Decapsulate the ESP packet and carry on with IPsec input
595 * or discard the NAT keep-alive.
596 */
597 if (ipsec_bypass == 0 && (esp_udp_encap_port & 0xFFFF) != 0 &&
598 (uh->uh_dport == ntohs((u_short)esp_udp_encap_port) ||
599 uh->uh_sport == ntohs((u_short)esp_udp_encap_port))) {
600 /*
601 * Check if ESP or keepalive:
602 * 1. If the destination port of the incoming packet is 4500.
603 * 2. If the source port of the incoming packet is 4500,
604 * then check the SADB to match IP address and port.
605 */
606 bool check_esp = true;
607 if (uh->uh_dport != ntohs((u_short)esp_udp_encap_port)) {
608 check_esp = key_checksa_present(AF_INET, (caddr_t)&ip->ip_dst,
609 (caddr_t)&ip->ip_src, uh->uh_dport,
610 uh->uh_sport, IFSCOPE_NONE, IFSCOPE_NONE);
611 }
612
613 if (check_esp) {
614 int payload_len = len - sizeof(struct udphdr) > 4 ? 4 :
615 len - sizeof(struct udphdr);
616
617 if (m->m_len < iphlen + sizeof(struct udphdr) + payload_len) {
618 if ((m = m_pullup(m, iphlen + sizeof(struct udphdr) +
619 payload_len)) == NULL) {
620 udpstat.udps_hdrops++;
621 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
622 0, 0, 0, 0, 0);
623 return;
624 }
625 /*
626 * Expect 32-bit aligned data pointer on strict-align
627 * platforms.
628 */
629 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
630
631 ip = mtod(m, struct ip *);
632 uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
633 }
634 /* Check for NAT keepalive packet */
635 if (payload_len == 1 && *(u_int8_t *)
636 ((caddr_t)uh + sizeof(struct udphdr)) == 0xFF) {
637 m_freem(m);
638 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
639 0, 0, 0, 0, 0);
640 return;
641 } else if (payload_len == 4 && *(u_int32_t *)(void *)
642 ((caddr_t)uh + sizeof(struct udphdr)) != 0) {
643 /* UDP encapsulated IPsec packet to pass through NAT */
644 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
645 0, 0, 0, 0, 0);
646 /* preserve the udp header */
647 esp4_input(m, iphlen + sizeof(struct udphdr));
648 return;
649 }
650 }
651 }
652 #endif /* IPSEC */
653
654 /*
655 * Locate pcb for datagram.
656 */
657 inp = in_pcblookup_hash(&udbinfo, ip->ip_src, uh->uh_sport,
658 ip->ip_dst, uh->uh_dport, 1, ifp);
659 if (inp == NULL) {
660 IF_UDP_STATINC(ifp, port_unreach);
661
662 if (udp_log_in_vain) {
663 char buf[MAX_IPv4_STR_LEN];
664 char buf2[MAX_IPv4_STR_LEN];
665
666 /* check src and dst address */
667 if (udp_log_in_vain < 3) {
668 log(LOG_INFO, "Connection attempt to "
669 "UDP %s:%d from %s:%d\n", inet_ntop(AF_INET,
670 &ip->ip_dst, buf, sizeof(buf)),
671 ntohs(uh->uh_dport), inet_ntop(AF_INET,
672 &ip->ip_src, buf2, sizeof(buf2)),
673 ntohs(uh->uh_sport));
674 } else if (!(m->m_flags & (M_BCAST | M_MCAST)) &&
675 ip->ip_dst.s_addr != ip->ip_src.s_addr) {
676 log_in_vain_log((LOG_INFO,
677 "Stealth Mode connection attempt to "
678 "UDP %s:%d from %s:%d\n", inet_ntop(AF_INET,
679 &ip->ip_dst, buf, sizeof(buf)),
680 ntohs(uh->uh_dport), inet_ntop(AF_INET,
681 &ip->ip_src, buf2, sizeof(buf2)),
682 ntohs(uh->uh_sport)))
683 }
684 }
685 udpstat.udps_noport++;
686 if (m->m_flags & (M_BCAST | M_MCAST)) {
687 udpstat.udps_noportbcast++;
688 goto bad;
689 }
690 if (blackhole) {
691 if (ifp && ifp->if_type != IFT_LOOP) {
692 goto bad;
693 }
694 }
695 *ip = save_ip;
696 ip->ip_len += iphlen;
697 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
698 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
699 return;
700 }
701 udp_lock(inp->inp_socket, 1, 0);
702
703 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
704 udp_unlock(inp->inp_socket, 1, 0);
705 IF_UDP_STATINC(ifp, cleanup);
706 goto bad;
707 }
708 #if NECP
709 if (!necp_socket_is_allowed_to_send_recv_v4(inp, uh->uh_dport,
710 uh->uh_sport, &ip->ip_dst, &ip->ip_src, ifp, pf_tag, NULL, NULL, NULL, NULL)) {
711 udp_unlock(inp->inp_socket, 1, 0);
712 IF_UDP_STATINC(ifp, badipsec);
713 goto bad;
714 }
715 #endif /* NECP */
716
717 /*
718 * Construct sockaddr format source address.
719 * Stuff source address and datagram in user buffer.
720 */
721 udp_in.sin_port = uh->uh_sport;
722 udp_in.sin_addr = ip->ip_src;
723 if ((inp->inp_flags & INP_CONTROLOPTS) != 0 ||
724 SOFLOW_ENABLED(inp->inp_socket) ||
725 SO_RECV_CONTROL_OPTS(inp->inp_socket)) {
726 if (inp->inp_vflag & INP_IPV6 || inp->inp_vflag & INP_V4MAPPEDV6) {
727 int savedflags;
728
729 ip_2_ip6_hdr(&udp_ip6.uip6_ip6, ip);
730 savedflags = inp->inp_flags;
731 inp->inp_flags &= ~INP_UNMAPPABLEOPTS;
732 ret = ip6_savecontrol(inp, m, &opts);
733 inp->inp_flags = savedflags;
734 } else {
735 ret = ip_savecontrol(inp, &opts, ip, m);
736 }
737 if (ret != 0) {
738 udp_unlock(inp->inp_socket, 1, 0);
739 goto bad;
740 }
741 }
742 m_adj(m, iphlen + sizeof(struct udphdr));
743
744 KERNEL_DEBUG(DBG_LAYER_IN_END, uh->uh_dport, uh->uh_sport,
745 save_ip.ip_src.s_addr, save_ip.ip_dst.s_addr, uh->uh_ulen);
746
747 if (inp->inp_vflag & INP_IPV6) {
748 in6_sin_2_v4mapsin6(&udp_in, &udp_in6.uin6_sin);
749 append_sa = (struct sockaddr *)&udp_in6.uin6_sin;
750 } else {
751 append_sa = (struct sockaddr *)&udp_in;
752 }
753 if (nstat_collect) {
754 INP_ADD_STAT(inp, cell, wifi, wired, rxpackets, 1);
755 INP_ADD_STAT(inp, cell, wifi, wired, rxbytes, m->m_pkthdr.len);
756 inp_set_activity_bitmap(inp);
757 }
758 so_recv_data_stat(inp->inp_socket, m, 0);
759 if (sbappendaddr(&inp->inp_socket->so_rcv, append_sa,
760 m, opts, NULL) == 0) {
761 udpstat.udps_fullsock++;
762 } else {
763 sorwakeup(inp->inp_socket);
764 }
765 if (is_wake_pkt) {
766 soevent(inp->inp_socket, SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
767 }
768 udp_unlock(inp->inp_socket, 1, 0);
769 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
770 return;
771 bad:
772 m_freem(m);
773 if (opts) {
774 m_freem(opts);
775 }
776 KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
777 }
778
779 static void
ip_2_ip6_hdr(struct ip6_hdr * ip6,struct ip * ip)780 ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip)
781 {
782 bzero(ip6, sizeof(*ip6));
783
784 ip6->ip6_vfc = IPV6_VERSION;
785 ip6->ip6_plen = ip->ip_len;
786 ip6->ip6_nxt = ip->ip_p;
787 ip6->ip6_hlim = ip->ip_ttl;
788 if (ip->ip_src.s_addr) {
789 ip6->ip6_src.s6_addr32[2] = IPV6_ADDR_INT32_SMP;
790 ip6->ip6_src.s6_addr32[3] = ip->ip_src.s_addr;
791 }
792 if (ip->ip_dst.s_addr) {
793 ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_SMP;
794 ip6->ip6_dst.s6_addr32[3] = ip->ip_dst.s_addr;
795 }
796 }
797
798 /*
799 * subroutine of udp_input(), mainly for source code readability.
800 */
801 static void
udp_append(struct inpcb * last,struct ip * ip,struct mbuf * n,int off,struct sockaddr_in * pudp_in,struct udp_in6 * pudp_in6,struct udp_ip6 * pudp_ip6,struct ifnet * ifp)802 udp_append(struct inpcb *last, struct ip *ip, struct mbuf *n, int off,
803 struct sockaddr_in *pudp_in, struct udp_in6 *pudp_in6,
804 struct udp_ip6 *pudp_ip6, struct ifnet *ifp)
805 {
806 struct sockaddr *append_sa;
807 struct mbuf *opts = 0;
808 boolean_t cell = IFNET_IS_CELLULAR(ifp);
809 boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
810 boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
811 int ret = 0;
812
813 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
814 SOFLOW_ENABLED(last->inp_socket) ||
815 SO_RECV_CONTROL_OPTS(last->inp_socket)) {
816 if (last->inp_vflag & INP_IPV6 || last->inp_vflag & INP_V4MAPPEDV6) {
817 int savedflags;
818
819 if (pudp_ip6->uip6_init_done == 0) {
820 ip_2_ip6_hdr(&pudp_ip6->uip6_ip6, ip);
821 pudp_ip6->uip6_init_done = 1;
822 }
823 savedflags = last->inp_flags;
824 last->inp_flags &= ~INP_UNMAPPABLEOPTS;
825 ret = ip6_savecontrol(last, n, &opts);
826 if (ret != 0) {
827 last->inp_flags = savedflags;
828 goto error;
829 }
830 last->inp_flags = savedflags;
831 } else {
832 ret = ip_savecontrol(last, &opts, ip, n);
833 if (ret != 0) {
834 goto error;
835 }
836 }
837 }
838 if (last->inp_vflag & INP_IPV6) {
839 if (pudp_in6->uin6_init_done == 0) {
840 in6_sin_2_v4mapsin6(pudp_in, &pudp_in6->uin6_sin);
841 pudp_in6->uin6_init_done = 1;
842 }
843 append_sa = (struct sockaddr *)&pudp_in6->uin6_sin;
844 } else {
845 append_sa = (struct sockaddr *)pudp_in;
846 }
847 if (nstat_collect) {
848 INP_ADD_STAT(last, cell, wifi, wired, rxpackets, 1);
849 INP_ADD_STAT(last, cell, wifi, wired, rxbytes,
850 n->m_pkthdr.len);
851 inp_set_activity_bitmap(last);
852 }
853 so_recv_data_stat(last->inp_socket, n, 0);
854 m_adj(n, off);
855 if (sbappendaddr(&last->inp_socket->so_rcv, append_sa,
856 n, opts, NULL) == 0) {
857 udpstat.udps_fullsock++;
858 } else {
859 sorwakeup(last->inp_socket);
860 }
861 return;
862 error:
863 m_freem(n);
864 m_freem(opts);
865 }
866
867 /*
868 * Notify a udp user of an asynchronous error;
869 * just wake up so that he can collect error status.
870 */
871 void
udp_notify(struct inpcb * inp,int errno)872 udp_notify(struct inpcb *inp, int errno)
873 {
874 inp->inp_socket->so_error = (u_short)errno;
875 sorwakeup(inp->inp_socket);
876 sowwakeup(inp->inp_socket);
877 }
878
879 void
udp_ctlinput(int cmd,struct sockaddr * sa,void * vip,__unused struct ifnet * ifp)880 udp_ctlinput(int cmd, struct sockaddr *sa, void *vip, __unused struct ifnet * ifp)
881 {
882 struct ipctlparam *ctl_param = vip;
883 struct ip *ip = NULL;
884 struct mbuf *m = NULL;
885 void (*notify)(struct inpcb *, int) = udp_notify;
886 struct in_addr faddr;
887 struct inpcb *inp = NULL;
888 struct icmp *icp = NULL;
889 size_t off;
890
891 if (ctl_param != NULL) {
892 ip = ctl_param->ipc_icmp_ip;
893 icp = ctl_param->ipc_icmp;
894 m = ctl_param->ipc_m;
895 off = ctl_param->ipc_off;
896 } else {
897 ip = NULL;
898 icp = NULL;
899 m = NULL;
900 off = 0;
901 }
902
903 faddr = ((struct sockaddr_in *)(void *)sa)->sin_addr;
904 if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY) {
905 return;
906 }
907
908 if (PRC_IS_REDIRECT(cmd)) {
909 ip = 0;
910 notify = in_rtchange;
911 } else if (cmd == PRC_HOSTDEAD) {
912 ip = 0;
913 } else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0) {
914 return;
915 }
916 if (ip) {
917 struct udphdr uh;
918
919 /* Check if we can safely get the ports from the UDP header */
920 if (m == NULL ||
921 (m->m_len < off + sizeof(uh))) {
922 /* Insufficient length */
923 return;
924 }
925
926 bcopy(m->m_data + off, &uh, sizeof(uh));
927 inp = in_pcblookup_hash(&udbinfo, faddr, uh.uh_dport,
928 ip->ip_src, uh.uh_sport, 0, NULL);
929
930 if (inp != NULL && inp->inp_socket != NULL) {
931 udp_lock(inp->inp_socket, 1, 0);
932 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) ==
933 WNT_STOPUSING) {
934 udp_unlock(inp->inp_socket, 1, 0);
935 return;
936 }
937 if (cmd == PRC_MSGSIZE && !uuid_is_null(inp->necp_client_uuid)) {
938 uuid_t null_uuid;
939 uuid_clear(null_uuid);
940 necp_update_flow_protoctl_event(null_uuid, inp->necp_client_uuid,
941 PRC_MSGSIZE, ntohs(icp->icmp_nextmtu), 0);
942 /*
943 * Avoid calling udp_notify() to set so_error
944 * when using Network.framework since the notification
945 * of PRC_MSGSIZE has been delivered through NECP.
946 */
947 } else {
948 (*notify)(inp, inetctlerrmap[cmd]);
949 }
950 udp_unlock(inp->inp_socket, 1, 0);
951 }
952 #if SKYWALK
953 else {
954 union sockaddr_in_4_6 sock_laddr;
955 struct protoctl_ev_val prctl_ev_val;
956 bzero(&prctl_ev_val, sizeof(prctl_ev_val));
957 bzero(&sock_laddr, sizeof(sock_laddr));
958
959 if (cmd == PRC_MSGSIZE) {
960 prctl_ev_val.val = ntohs(icp->icmp_nextmtu);
961 }
962
963 sock_laddr.sin.sin_family = AF_INET;
964 sock_laddr.sin.sin_len = sizeof(sock_laddr.sin);
965 sock_laddr.sin.sin_addr = ip->ip_src;
966
967 protoctl_event_enqueue_nwk_wq_entry(ifp,
968 (struct sockaddr *)&sock_laddr, sa,
969 uh.uh_sport, uh.uh_dport, IPPROTO_UDP,
970 cmd, &prctl_ev_val);
971 }
972 #endif /* SKYWALK */
973 } else {
974 in_pcbnotifyall(&udbinfo, faddr, inetctlerrmap[cmd], notify);
975 }
976 }
977
978 int
udp_ctloutput(struct socket * so,struct sockopt * sopt)979 udp_ctloutput(struct socket *so, struct sockopt *sopt)
980 {
981 int error = 0, optval = 0;
982 struct inpcb *inp;
983
984 /* Allow <SOL_SOCKET,SO_FLUSH> at this level */
985 if (sopt->sopt_level != IPPROTO_UDP &&
986 !(sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_FLUSH)) {
987 if (SOCK_CHECK_DOM(so, PF_INET6)) {
988 error = ip6_ctloutput(so, sopt);
989 } else {
990 error = ip_ctloutput(so, sopt);
991 }
992 return error;
993 }
994
995 inp = sotoinpcb(so);
996
997 switch (sopt->sopt_dir) {
998 case SOPT_SET:
999 switch (sopt->sopt_name) {
1000 case UDP_NOCKSUM:
1001 /* This option is settable only for UDP over IPv4 */
1002 if (!(inp->inp_vflag & INP_IPV4)) {
1003 error = EINVAL;
1004 break;
1005 }
1006
1007 if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
1008 sizeof(optval))) != 0) {
1009 break;
1010 }
1011
1012 if (optval != 0) {
1013 inp->inp_flags |= INP_UDP_NOCKSUM;
1014 } else {
1015 inp->inp_flags &= ~INP_UDP_NOCKSUM;
1016 }
1017 break;
1018 case UDP_KEEPALIVE_OFFLOAD:
1019 {
1020 struct udp_keepalive_offload ka;
1021 /*
1022 * If the socket is not connected, the stack will
1023 * not know the destination address to put in the
1024 * keepalive datagram. Return an error now instead
1025 * of failing later.
1026 */
1027 if (!(so->so_state & SS_ISCONNECTED)) {
1028 error = EINVAL;
1029 break;
1030 }
1031 if (sopt->sopt_valsize != sizeof(ka)) {
1032 error = EINVAL;
1033 break;
1034 }
1035 if ((error = sooptcopyin(sopt, &ka, sizeof(ka),
1036 sizeof(ka))) != 0) {
1037 break;
1038 }
1039
1040 /* application should specify the type */
1041 if (ka.ka_type == 0) {
1042 return EINVAL;
1043 }
1044
1045 if (ka.ka_interval == 0) {
1046 /*
1047 * if interval is 0, disable the offload
1048 * mechanism
1049 */
1050 if (inp->inp_keepalive_data != NULL) {
1051 kfree_data(inp->inp_keepalive_data,
1052 inp->inp_keepalive_datalen);
1053 }
1054 inp->inp_keepalive_data = NULL;
1055 inp->inp_keepalive_datalen = 0;
1056 inp->inp_keepalive_interval = 0;
1057 inp->inp_keepalive_type = 0;
1058 inp->inp_flags2 &= ~INP2_KEEPALIVE_OFFLOAD;
1059 } else {
1060 if (inp->inp_keepalive_data != NULL) {
1061 kfree_data(inp->inp_keepalive_data,
1062 inp->inp_keepalive_datalen);
1063 inp->inp_keepalive_data = NULL;
1064 }
1065
1066 inp->inp_keepalive_datalen = (uint8_t)min(
1067 ka.ka_data_len,
1068 UDP_KEEPALIVE_OFFLOAD_DATA_SIZE);
1069 if (inp->inp_keepalive_datalen > 0) {
1070 inp->inp_keepalive_data = (u_int8_t *)kalloc_data(
1071 inp->inp_keepalive_datalen, Z_WAITOK);
1072 if (inp->inp_keepalive_data == NULL) {
1073 inp->inp_keepalive_datalen = 0;
1074 error = ENOMEM;
1075 break;
1076 }
1077 bcopy(ka.ka_data,
1078 inp->inp_keepalive_data,
1079 inp->inp_keepalive_datalen);
1080 } else {
1081 inp->inp_keepalive_datalen = 0;
1082 }
1083 inp->inp_keepalive_interval = (uint8_t)
1084 min(UDP_KEEPALIVE_INTERVAL_MAX_SECONDS,
1085 ka.ka_interval);
1086 inp->inp_keepalive_type = ka.ka_type;
1087 inp->inp_flags2 |= INP2_KEEPALIVE_OFFLOAD;
1088 }
1089 break;
1090 }
1091 case SO_FLUSH:
1092 if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
1093 sizeof(optval))) != 0) {
1094 break;
1095 }
1096
1097 error = inp_flush(inp, optval);
1098 break;
1099
1100 default:
1101 error = ENOPROTOOPT;
1102 break;
1103 }
1104 break;
1105
1106 case SOPT_GET:
1107 switch (sopt->sopt_name) {
1108 case UDP_NOCKSUM:
1109 optval = inp->inp_flags & INP_UDP_NOCKSUM;
1110 break;
1111
1112 default:
1113 error = ENOPROTOOPT;
1114 break;
1115 }
1116 if (error == 0) {
1117 error = sooptcopyout(sopt, &optval, sizeof(optval));
1118 }
1119 break;
1120 }
1121 return error;
1122 }
1123
1124 static int
1125 udp_pcblist SYSCTL_HANDLER_ARGS
1126 {
1127 #pragma unused(oidp, arg1, arg2)
1128 int error, i, n, sz;
1129 struct inpcb *inp, **inp_list;
1130 inp_gen_t gencnt;
1131 struct xinpgen xig;
1132
1133 /*
1134 * The process of preparing the TCB list is too time-consuming and
1135 * resource-intensive to repeat twice on every request.
1136 */
1137 lck_rw_lock_exclusive(&udbinfo.ipi_lock);
1138 if (req->oldptr == USER_ADDR_NULL) {
1139 n = udbinfo.ipi_count;
1140 req->oldidx = 2 * (sizeof(xig))
1141 + (n + n / 8) * sizeof(struct xinpcb);
1142 lck_rw_done(&udbinfo.ipi_lock);
1143 return 0;
1144 }
1145
1146 if (req->newptr != USER_ADDR_NULL) {
1147 lck_rw_done(&udbinfo.ipi_lock);
1148 return EPERM;
1149 }
1150
1151 /*
1152 * OK, now we're committed to doing something.
1153 */
1154 gencnt = udbinfo.ipi_gencnt;
1155 sz = n = udbinfo.ipi_count;
1156
1157 bzero(&xig, sizeof(xig));
1158 xig.xig_len = sizeof(xig);
1159 xig.xig_count = n;
1160 xig.xig_gen = gencnt;
1161 xig.xig_sogen = so_gencnt;
1162 error = SYSCTL_OUT(req, &xig, sizeof(xig));
1163 if (error) {
1164 lck_rw_done(&udbinfo.ipi_lock);
1165 return error;
1166 }
1167 /*
1168 * We are done if there is no pcb
1169 */
1170 if (n == 0) {
1171 lck_rw_done(&udbinfo.ipi_lock);
1172 return 0;
1173 }
1174
1175 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1176 if (inp_list == NULL) {
1177 lck_rw_done(&udbinfo.ipi_lock);
1178 return ENOMEM;
1179 }
1180
1181 for (inp = LIST_FIRST(udbinfo.ipi_listhead), i = 0; inp && i < n;
1182 inp = LIST_NEXT(inp, inp_list)) {
1183 if (inp->inp_gencnt <= gencnt &&
1184 inp->inp_state != INPCB_STATE_DEAD) {
1185 inp_list[i++] = inp;
1186 }
1187 }
1188 n = i;
1189
1190 error = 0;
1191 for (i = 0; i < n; i++) {
1192 struct xinpcb xi;
1193
1194 inp = inp_list[i];
1195
1196 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING) {
1197 continue;
1198 }
1199 udp_lock(inp->inp_socket, 1, 0);
1200 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
1201 udp_unlock(inp->inp_socket, 1, 0);
1202 continue;
1203 }
1204 if (inp->inp_gencnt > gencnt) {
1205 udp_unlock(inp->inp_socket, 1, 0);
1206 continue;
1207 }
1208
1209 bzero(&xi, sizeof(xi));
1210 xi.xi_len = sizeof(xi);
1211 /* XXX should avoid extra copy */
1212 inpcb_to_compat(inp, &xi.xi_inp);
1213 if (inp->inp_socket) {
1214 sotoxsocket(inp->inp_socket, &xi.xi_socket);
1215 }
1216
1217 udp_unlock(inp->inp_socket, 1, 0);
1218
1219 error = SYSCTL_OUT(req, &xi, sizeof(xi));
1220 }
1221 if (!error) {
1222 /*
1223 * Give the user an updated idea of our state.
1224 * If the generation differs from what we told
1225 * her before, she knows that something happened
1226 * while we were processing this request, and it
1227 * might be necessary to retry.
1228 */
1229 bzero(&xig, sizeof(xig));
1230 xig.xig_len = sizeof(xig);
1231 xig.xig_gen = udbinfo.ipi_gencnt;
1232 xig.xig_sogen = so_gencnt;
1233 xig.xig_count = udbinfo.ipi_count;
1234 error = SYSCTL_OUT(req, &xig, sizeof(xig));
1235 }
1236
1237 lck_rw_done(&udbinfo.ipi_lock);
1238 kfree_type(struct inpcb *, sz, inp_list);
1239 return error;
1240 }
1241
1242 SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist,
1243 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist,
1244 "S,xinpcb", "List of active UDP sockets");
1245
1246 #if XNU_TARGET_OS_OSX
1247
1248 static int
1249 udp_pcblist64 SYSCTL_HANDLER_ARGS
1250 {
1251 #pragma unused(oidp, arg1, arg2)
1252 int error, i, n, sz;
1253 struct inpcb *inp, **inp_list;
1254 inp_gen_t gencnt;
1255 struct xinpgen xig;
1256
1257 /*
1258 * The process of preparing the TCB list is too time-consuming and
1259 * resource-intensive to repeat twice on every request.
1260 */
1261 lck_rw_lock_shared(&udbinfo.ipi_lock);
1262 if (req->oldptr == USER_ADDR_NULL) {
1263 n = udbinfo.ipi_count;
1264 req->oldidx =
1265 2 * (sizeof(xig)) + (n + n / 8) * sizeof(struct xinpcb64);
1266 lck_rw_done(&udbinfo.ipi_lock);
1267 return 0;
1268 }
1269
1270 if (req->newptr != USER_ADDR_NULL) {
1271 lck_rw_done(&udbinfo.ipi_lock);
1272 return EPERM;
1273 }
1274
1275 /*
1276 * OK, now we're committed to doing something.
1277 */
1278 gencnt = udbinfo.ipi_gencnt;
1279 sz = n = udbinfo.ipi_count;
1280
1281 bzero(&xig, sizeof(xig));
1282 xig.xig_len = sizeof(xig);
1283 xig.xig_count = n;
1284 xig.xig_gen = gencnt;
1285 xig.xig_sogen = so_gencnt;
1286 error = SYSCTL_OUT(req, &xig, sizeof(xig));
1287 if (error) {
1288 lck_rw_done(&udbinfo.ipi_lock);
1289 return error;
1290 }
1291 /*
1292 * We are done if there is no pcb
1293 */
1294 if (n == 0) {
1295 lck_rw_done(&udbinfo.ipi_lock);
1296 return 0;
1297 }
1298
1299 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1300 if (inp_list == NULL) {
1301 lck_rw_done(&udbinfo.ipi_lock);
1302 return ENOMEM;
1303 }
1304
1305 for (inp = LIST_FIRST(udbinfo.ipi_listhead), i = 0; inp && i < n;
1306 inp = LIST_NEXT(inp, inp_list)) {
1307 if (inp->inp_gencnt <= gencnt &&
1308 inp->inp_state != INPCB_STATE_DEAD) {
1309 inp_list[i++] = inp;
1310 }
1311 }
1312 n = i;
1313
1314 error = 0;
1315 for (i = 0; i < n; i++) {
1316 struct xinpcb64 xi;
1317
1318 inp = inp_list[i];
1319
1320 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING) {
1321 continue;
1322 }
1323 udp_lock(inp->inp_socket, 1, 0);
1324 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
1325 udp_unlock(inp->inp_socket, 1, 0);
1326 continue;
1327 }
1328 if (inp->inp_gencnt > gencnt) {
1329 udp_unlock(inp->inp_socket, 1, 0);
1330 continue;
1331 }
1332
1333 bzero(&xi, sizeof(xi));
1334 xi.xi_len = sizeof(xi);
1335 inpcb_to_xinpcb64(inp, &xi);
1336 if (inp->inp_socket) {
1337 sotoxsocket64(inp->inp_socket, &xi.xi_socket);
1338 }
1339
1340 udp_unlock(inp->inp_socket, 1, 0);
1341
1342 error = SYSCTL_OUT(req, &xi, sizeof(xi));
1343 }
1344 if (!error) {
1345 /*
1346 * Give the user an updated idea of our state.
1347 * If the generation differs from what we told
1348 * her before, she knows that something happened
1349 * while we were processing this request, and it
1350 * might be necessary to retry.
1351 */
1352 bzero(&xig, sizeof(xig));
1353 xig.xig_len = sizeof(xig);
1354 xig.xig_gen = udbinfo.ipi_gencnt;
1355 xig.xig_sogen = so_gencnt;
1356 xig.xig_count = udbinfo.ipi_count;
1357 error = SYSCTL_OUT(req, &xig, sizeof(xig));
1358 }
1359
1360 lck_rw_done(&udbinfo.ipi_lock);
1361 kfree_type(struct inpcb *, sz, inp_list);
1362 return error;
1363 }
1364
1365 SYSCTL_PROC(_net_inet_udp, OID_AUTO, pcblist64,
1366 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist64,
1367 "S,xinpcb64", "List of active UDP sockets");
1368
1369 #endif /* XNU_TARGET_OS_OSX */
1370
1371 static int
1372 udp_pcblist_n SYSCTL_HANDLER_ARGS
1373 {
1374 #pragma unused(oidp, arg1, arg2)
1375 return get_pcblist_n(IPPROTO_UDP, req, &udbinfo);
1376 }
1377
1378 SYSCTL_PROC(_net_inet_udp, OID_AUTO, pcblist_n,
1379 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist_n,
1380 "S,xinpcb_n", "List of active UDP sockets");
1381
1382 __private_extern__ void
udp_get_ports_used(ifnet_t ifp,int protocol,uint32_t flags,bitstr_t * bitfield)1383 udp_get_ports_used(ifnet_t ifp, int protocol, uint32_t flags,
1384 bitstr_t *bitfield)
1385 {
1386 inpcb_get_ports_used(ifp, protocol, flags, bitfield,
1387 &udbinfo);
1388 }
1389
1390 __private_extern__ uint32_t
udp_count_opportunistic(unsigned int ifindex,u_int32_t flags)1391 udp_count_opportunistic(unsigned int ifindex, u_int32_t flags)
1392 {
1393 return inpcb_count_opportunistic(ifindex, &udbinfo, flags);
1394 }
1395
1396 __private_extern__ uint32_t
udp_find_anypcb_byaddr(struct ifaddr * ifa)1397 udp_find_anypcb_byaddr(struct ifaddr *ifa)
1398 {
1399 #if SKYWALK
1400 if (netns_is_enabled()) {
1401 return netns_find_anyres_byaddr(ifa, IPPROTO_UDP);
1402 } else
1403 #endif /* SKYWALK */
1404 return inpcb_find_anypcb_byaddr(ifa, &udbinfo);
1405 }
1406
1407 static int
udp_check_pktinfo(struct mbuf * control,struct ifnet ** outif,struct in_addr * laddr)1408 udp_check_pktinfo(struct mbuf *control, struct ifnet **outif,
1409 struct in_addr *laddr)
1410 {
1411 struct cmsghdr *cm = 0;
1412 struct in_pktinfo *pktinfo;
1413 struct ifnet *ifp;
1414
1415 if (outif != NULL) {
1416 *outif = NULL;
1417 }
1418
1419 /*
1420 * XXX: Currently, we assume all the optional information is stored
1421 * in a single mbuf.
1422 */
1423 if (control->m_next) {
1424 return EINVAL;
1425 }
1426
1427 if (control->m_len < CMSG_LEN(0)) {
1428 return EINVAL;
1429 }
1430
1431 for (cm = M_FIRST_CMSGHDR(control);
1432 is_cmsg_valid(control, cm);
1433 cm = M_NXT_CMSGHDR(control, cm)) {
1434 if (cm->cmsg_level != IPPROTO_IP ||
1435 cm->cmsg_type != IP_PKTINFO) {
1436 continue;
1437 }
1438
1439 if (cm->cmsg_len != CMSG_LEN(sizeof(struct in_pktinfo))) {
1440 return EINVAL;
1441 }
1442
1443 pktinfo = (struct in_pktinfo *)(void *)CMSG_DATA(cm);
1444
1445 /* Check for a valid ifindex in pktinfo */
1446 ifnet_head_lock_shared();
1447
1448 if (pktinfo->ipi_ifindex > if_index) {
1449 ifnet_head_done();
1450 return ENXIO;
1451 }
1452
1453 /*
1454 * If ipi_ifindex is specified it takes precedence
1455 * over ipi_spec_dst.
1456 */
1457 if (pktinfo->ipi_ifindex) {
1458 ifp = ifindex2ifnet[pktinfo->ipi_ifindex];
1459 if (ifp == NULL) {
1460 ifnet_head_done();
1461 return ENXIO;
1462 }
1463 if (outif != NULL) {
1464 ifnet_reference(ifp);
1465 *outif = ifp;
1466 }
1467 ifnet_head_done();
1468 laddr->s_addr = INADDR_ANY;
1469 break;
1470 }
1471
1472 ifnet_head_done();
1473
1474 /*
1475 * Use the provided ipi_spec_dst address for temp
1476 * source address.
1477 */
1478 *laddr = pktinfo->ipi_spec_dst;
1479 break;
1480 }
1481 return 0;
1482 }
1483
1484 int
udp_output(struct inpcb * inp,struct mbuf * m,struct sockaddr * addr,struct mbuf * control,struct proc * p)1485 udp_output(struct inpcb *inp, struct mbuf *m, struct sockaddr *addr,
1486 struct mbuf *control, struct proc *p)
1487 {
1488 struct udpiphdr *ui;
1489 int len = m->m_pkthdr.len;
1490 struct sockaddr_in *sin;
1491 struct in_addr origladdr, laddr, faddr, pi_laddr;
1492 u_short lport, fport;
1493 int error = 0, udp_dodisconnect = 0, pktinfo = 0;
1494 struct socket *so = inp->inp_socket;
1495 int soopts = 0;
1496 struct mbuf *inpopts;
1497 struct ip_moptions *mopts;
1498 struct route ro;
1499 struct ip_out_args ipoa;
1500 bool sndinprog_cnt_used = false;
1501 #if CONTENT_FILTER
1502 struct m_tag *cfil_tag = NULL;
1503 bool cfil_faddr_use = false;
1504 uint32_t cfil_so_state_change_cnt = 0;
1505 uint32_t cfil_so_options = 0;
1506 struct sockaddr *cfil_faddr = NULL;
1507 #endif
1508 bool check_qos_marking_again = (so->so_flags1 & SOF1_QOSMARKING_POLICY_OVERRIDE) ? FALSE : TRUE;
1509
1510 bzero(&ipoa, sizeof(ipoa));
1511 ipoa.ipoa_boundif = IFSCOPE_NONE;
1512 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF;
1513
1514 struct ifnet *outif = NULL;
1515 struct flowadv *adv = &ipoa.ipoa_flowadv;
1516 int sotc = SO_TC_UNSPEC;
1517 int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
1518 struct ifnet *origoutifp = NULL;
1519 int flowadv = 0;
1520 int tos = IPTOS_UNSPEC;
1521
1522 /* Enable flow advisory only when connected */
1523 flowadv = (so->so_state & SS_ISCONNECTED) ? 1 : 0;
1524 pi_laddr.s_addr = INADDR_ANY;
1525
1526 KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
1527
1528 socket_lock_assert_owned(so);
1529
1530 #if CONTENT_FILTER
1531 /*
1532 * If socket is subject to UDP Content Filter and no addr is passed in,
1533 * retrieve CFIL saved state from mbuf and use it if necessary.
1534 */
1535 if (CFIL_DGRAM_FILTERED(so) && !addr) {
1536 cfil_tag = cfil_dgram_get_socket_state(m, &cfil_so_state_change_cnt, &cfil_so_options, &cfil_faddr, NULL);
1537 if (cfil_tag) {
1538 sin = (struct sockaddr_in *)(void *)cfil_faddr;
1539 if (inp && inp->inp_faddr.s_addr == INADDR_ANY) {
1540 /*
1541 * Socket is unconnected, simply use the saved faddr as 'addr' to go through
1542 * the connect/disconnect logic.
1543 */
1544 addr = (struct sockaddr *)cfil_faddr;
1545 } else if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
1546 (inp->inp_fport != sin->sin_port ||
1547 inp->inp_faddr.s_addr != sin->sin_addr.s_addr)) {
1548 /*
1549 * Socket is connected but socket state and dest addr/port changed.
1550 * We need to use the saved faddr info.
1551 */
1552 cfil_faddr_use = true;
1553 }
1554 }
1555 }
1556 #endif
1557
1558 if (control != NULL) {
1559 tos = so_tos_from_control(control);
1560 sotc = so_tc_from_control(control, &netsvctype);
1561 VERIFY(outif == NULL);
1562 error = udp_check_pktinfo(control, &outif, &pi_laddr);
1563 m_freem(control);
1564 control = NULL;
1565 if (error) {
1566 goto release;
1567 }
1568 pktinfo++;
1569 if (outif != NULL) {
1570 ipoa.ipoa_boundif = outif->if_index;
1571 }
1572 }
1573 if (sotc == SO_TC_UNSPEC) {
1574 sotc = so->so_traffic_class;
1575 netsvctype = so->so_netsvctype;
1576 }
1577
1578 KERNEL_DEBUG(DBG_LAYER_OUT_BEG, inp->inp_fport, inp->inp_lport,
1579 inp->inp_laddr.s_addr, inp->inp_faddr.s_addr,
1580 (htons((u_short)len + sizeof(struct udphdr))));
1581
1582 if (len + sizeof(struct udpiphdr) > IP_MAXPACKET) {
1583 error = EMSGSIZE;
1584 goto release;
1585 }
1586
1587 if (flowadv && INP_WAIT_FOR_IF_FEEDBACK(inp)) {
1588 /*
1589 * The socket is flow-controlled, drop the packets
1590 * until the inp is not flow controlled
1591 */
1592 error = ENOBUFS;
1593 goto release;
1594 }
1595 /*
1596 * If socket was bound to an ifindex, tell ip_output about it.
1597 * If the ancillary IP_PKTINFO option contains an interface index,
1598 * it takes precedence over the one specified by IP_BOUND_IF.
1599 */
1600 if (ipoa.ipoa_boundif == IFSCOPE_NONE &&
1601 (inp->inp_flags & INP_BOUND_IF)) {
1602 VERIFY(inp->inp_boundifp != NULL);
1603 ifnet_reference(inp->inp_boundifp); /* for this routine */
1604 if (outif != NULL) {
1605 ifnet_release(outif);
1606 }
1607 outif = inp->inp_boundifp;
1608 ipoa.ipoa_boundif = outif->if_index;
1609 }
1610 if (INP_NO_CELLULAR(inp)) {
1611 ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
1612 }
1613 if (INP_NO_EXPENSIVE(inp)) {
1614 ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
1615 }
1616 if (INP_NO_CONSTRAINED(inp)) {
1617 ipoa.ipoa_flags |= IPOAF_NO_CONSTRAINED;
1618 }
1619 if (INP_AWDL_UNRESTRICTED(inp)) {
1620 ipoa.ipoa_flags |= IPOAF_AWDL_UNRESTRICTED;
1621 }
1622 ipoa.ipoa_sotc = sotc;
1623 ipoa.ipoa_netsvctype = netsvctype;
1624 soopts |= IP_OUTARGS;
1625
1626 /*
1627 * If there was a routing change, discard cached route and check
1628 * that we have a valid source address. Reacquire a new source
1629 * address if INADDR_ANY was specified.
1630 *
1631 * If we are using cfil saved state, go through this cache cleanup
1632 * so that we can get a new route.
1633 */
1634 if (ROUTE_UNUSABLE(&inp->inp_route)
1635 #if CONTENT_FILTER
1636 || cfil_faddr_use
1637 #endif
1638 ) {
1639 struct in_ifaddr *ia = NULL;
1640
1641 ROUTE_RELEASE(&inp->inp_route);
1642
1643 /* src address is gone? */
1644 if (inp->inp_laddr.s_addr != INADDR_ANY &&
1645 (ia = ifa_foraddr(inp->inp_laddr.s_addr)) == NULL) {
1646 if (!(inp->inp_flags & INP_INADDR_ANY) ||
1647 (so->so_state & SS_ISCONNECTED)) {
1648 /*
1649 * Rdar://5448998
1650 * If the source address is gone, return an
1651 * error if:
1652 * - the source was specified
1653 * - the socket was already connected
1654 */
1655 soevent(so, (SO_FILT_HINT_LOCKED |
1656 SO_FILT_HINT_NOSRCADDR));
1657 error = EADDRNOTAVAIL;
1658 goto release;
1659 } else {
1660 /* new src will be set later */
1661 inp->inp_laddr.s_addr = INADDR_ANY;
1662 inp->inp_last_outifp = NULL;
1663 #if SKYWALK
1664 if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
1665 netns_set_ifnet(&inp->inp_netns_token, NULL);
1666 }
1667 #endif /* SKYWALK */
1668 }
1669 }
1670 if (ia != NULL) {
1671 IFA_REMREF(&ia->ia_ifa);
1672 }
1673 }
1674
1675 /*
1676 * IP_PKTINFO option check. If a temporary scope or src address
1677 * is provided, use it for this packet only and make sure we forget
1678 * it after sending this datagram.
1679 */
1680 if (pi_laddr.s_addr != INADDR_ANY ||
1681 (ipoa.ipoa_boundif != IFSCOPE_NONE && pktinfo)) {
1682 /* temp src address for this datagram only */
1683 laddr = pi_laddr;
1684 origladdr.s_addr = INADDR_ANY;
1685 /* we don't want to keep the laddr or route */
1686 udp_dodisconnect = 1;
1687 /* remember we don't care about src addr */
1688 inp->inp_flags |= INP_INADDR_ANY;
1689 } else {
1690 origladdr = laddr = inp->inp_laddr;
1691 }
1692
1693 origoutifp = inp->inp_last_outifp;
1694 faddr = inp->inp_faddr;
1695 lport = inp->inp_lport;
1696 fport = inp->inp_fport;
1697
1698 #if CONTENT_FILTER
1699 if (cfil_faddr_use) {
1700 faddr = ((struct sockaddr_in *)(void *)cfil_faddr)->sin_addr;
1701 fport = ((struct sockaddr_in *)(void *)cfil_faddr)->sin_port;
1702 }
1703 #endif
1704 inp->inp_sndinprog_cnt++;
1705 sndinprog_cnt_used = true;
1706
1707 if (addr) {
1708 sin = (struct sockaddr_in *)(void *)addr;
1709 if (faddr.s_addr != INADDR_ANY) {
1710 error = EISCONN;
1711 goto release;
1712 }
1713 if (lport == 0) {
1714 /*
1715 * In case we don't have a local port set, go through
1716 * the full connect. We don't have a local port yet
1717 * (i.e., we can't be looked up), so it's not an issue
1718 * if the input runs at the same time we do this.
1719 */
1720 /* if we have a source address specified, use that */
1721 if (pi_laddr.s_addr != INADDR_ANY) {
1722 inp->inp_laddr = pi_laddr;
1723 }
1724 /*
1725 * If a scope is specified, use it. Scope from
1726 * IP_PKTINFO takes precendence over the the scope
1727 * set via INP_BOUND_IF.
1728 */
1729 error = in_pcbconnect(inp, addr, p, ipoa.ipoa_boundif,
1730 &outif);
1731 if (error) {
1732 goto release;
1733 }
1734
1735 laddr = inp->inp_laddr;
1736 lport = inp->inp_lport;
1737 faddr = inp->inp_faddr;
1738 fport = inp->inp_fport;
1739 udp_dodisconnect = 1;
1740
1741 /* synch up in case in_pcbladdr() overrides */
1742 if (outif != NULL && ipoa.ipoa_boundif != IFSCOPE_NONE) {
1743 ipoa.ipoa_boundif = outif->if_index;
1744 }
1745 } else {
1746 /*
1747 * Fast path case
1748 *
1749 * We have a full address and a local port; use those
1750 * info to build the packet without changing the pcb
1751 * and interfering with the input path. See 3851370.
1752 *
1753 * Scope from IP_PKTINFO takes precendence over the
1754 * the scope set via INP_BOUND_IF.
1755 */
1756 if (laddr.s_addr == INADDR_ANY) {
1757 if ((error = in_pcbladdr(inp, addr, &laddr,
1758 ipoa.ipoa_boundif, &outif, 0)) != 0) {
1759 goto release;
1760 }
1761 /*
1762 * from pcbconnect: remember we don't
1763 * care about src addr.
1764 */
1765 inp->inp_flags |= INP_INADDR_ANY;
1766
1767 /* synch up in case in_pcbladdr() overrides */
1768 if (outif != NULL &&
1769 ipoa.ipoa_boundif != IFSCOPE_NONE) {
1770 ipoa.ipoa_boundif = outif->if_index;
1771 }
1772 }
1773
1774 faddr = sin->sin_addr;
1775 fport = sin->sin_port;
1776 }
1777 } else {
1778 if (faddr.s_addr == INADDR_ANY) {
1779 error = ENOTCONN;
1780 goto release;
1781 }
1782 }
1783
1784 if (inp->inp_flowhash == 0) {
1785 inp_calc_flowhash(inp);
1786 ASSERT(inp->inp_flowhash != 0);
1787 }
1788
1789 if (fport == htons(53) && !(so->so_flags1 & SOF1_DNS_COUNTED)) {
1790 so->so_flags1 |= SOF1_DNS_COUNTED;
1791 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_dns);
1792 }
1793
1794 /*
1795 * Calculate data length and get a mbuf
1796 * for UDP and IP headers.
1797 */
1798 M_PREPEND(m, sizeof(struct udpiphdr), M_DONTWAIT, 1);
1799 if (m == 0) {
1800 error = ENOBUFS;
1801 goto abort;
1802 }
1803
1804 /*
1805 * Fill in mbuf with extended UDP header
1806 * and addresses and length put into network format.
1807 */
1808 ui = mtod(m, struct udpiphdr *);
1809 bzero(ui->ui_x1, sizeof(ui->ui_x1)); /* XXX still needed? */
1810 ui->ui_pr = IPPROTO_UDP;
1811 ui->ui_src = laddr;
1812 ui->ui_dst = faddr;
1813 ui->ui_sport = lport;
1814 ui->ui_dport = fport;
1815 ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
1816
1817 /*
1818 * Set the Don't Fragment bit in the IP header.
1819 */
1820 if (inp->inp_flags2 & INP2_DONTFRAG) {
1821 struct ip *ip;
1822
1823 ip = (struct ip *)&ui->ui_i;
1824 ip->ip_off |= IP_DF;
1825 }
1826
1827 /*
1828 * Set up checksum to pseudo header checksum and output datagram.
1829 *
1830 * Treat flows to be CLAT46'd as IPv6 flow and compute checksum
1831 * no matter what, as IPv6 mandates checksum for UDP.
1832 *
1833 * Here we only compute the one's complement sum of the pseudo header.
1834 * The payload computation and final complement is delayed to much later
1835 * in IP processing to decide if remaining computation needs to be done
1836 * through offload.
1837 *
1838 * That is communicated by setting CSUM_UDP in csum_flags.
1839 * The offset of checksum from the start of ULP header is communicated
1840 * through csum_data.
1841 *
1842 * Note since this already contains the pseudo checksum header, any
1843 * later operation at IP layer that modify the values used here must
1844 * update the checksum as well (for example NAT etc).
1845 */
1846 if ((inp->inp_flags2 & INP2_CLAT46_FLOW) ||
1847 (udpcksum && !(inp->inp_flags & INP_UDP_NOCKSUM))) {
1848 ui->ui_sum = in_pseudo(ui->ui_src.s_addr, ui->ui_dst.s_addr,
1849 htons((u_short)len + sizeof(struct udphdr) + IPPROTO_UDP));
1850 m->m_pkthdr.csum_flags = (CSUM_UDP | CSUM_ZERO_INVERT);
1851 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
1852 } else {
1853 ui->ui_sum = 0;
1854 }
1855 ((struct ip *)ui)->ip_len = (uint16_t)(sizeof(struct udpiphdr) + len);
1856 ((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl; /* XXX */
1857 if (tos != IPTOS_UNSPEC) {
1858 ((struct ip *)ui)->ip_tos = (uint8_t)(tos & IPTOS_MASK);
1859 } else {
1860 ((struct ip *)ui)->ip_tos = inp->inp_ip_tos; /* XXX */
1861 }
1862 udpstat.udps_opackets++;
1863
1864 KERNEL_DEBUG(DBG_LAYER_OUT_END, ui->ui_dport, ui->ui_sport,
1865 ui->ui_src.s_addr, ui->ui_dst.s_addr, ui->ui_ulen);
1866
1867 #if NECP
1868 {
1869 necp_kernel_policy_id policy_id;
1870 necp_kernel_policy_id skip_policy_id;
1871 u_int32_t route_rule_id;
1872 u_int32_t pass_flags;
1873
1874 /*
1875 * We need a route to perform NECP route rule checks
1876 */
1877 if (net_qos_policy_restricted != 0 &&
1878 ROUTE_UNUSABLE(&inp->inp_route)) {
1879 struct sockaddr_in to;
1880 struct sockaddr_in from;
1881
1882 ROUTE_RELEASE(&inp->inp_route);
1883
1884 bzero(&from, sizeof(struct sockaddr_in));
1885 from.sin_family = AF_INET;
1886 from.sin_len = sizeof(struct sockaddr_in);
1887 from.sin_addr = laddr;
1888
1889 bzero(&to, sizeof(struct sockaddr_in));
1890 to.sin_family = AF_INET;
1891 to.sin_len = sizeof(struct sockaddr_in);
1892 to.sin_addr = faddr;
1893
1894 inp->inp_route.ro_dst.sa_family = AF_INET;
1895 inp->inp_route.ro_dst.sa_len = sizeof(struct sockaddr_in);
1896 ((struct sockaddr_in *)(void *)&inp->inp_route.ro_dst)->sin_addr =
1897 faddr;
1898
1899 rtalloc_scoped(&inp->inp_route, ipoa.ipoa_boundif);
1900
1901 inp_update_necp_policy(inp, (struct sockaddr *)&from,
1902 (struct sockaddr *)&to, ipoa.ipoa_boundif);
1903 inp->inp_policyresult.results.qos_marking_gencount = 0;
1904 }
1905
1906 if (!necp_socket_is_allowed_to_send_recv_v4(inp, lport, fport,
1907 &laddr, &faddr, NULL, 0, &policy_id, &route_rule_id, &skip_policy_id, &pass_flags)) {
1908 error = EHOSTUNREACH;
1909 goto abort;
1910 }
1911
1912 necp_mark_packet_from_socket(m, inp, policy_id, route_rule_id, skip_policy_id, pass_flags);
1913
1914 if (net_qos_policy_restricted != 0) {
1915 necp_socket_update_qos_marking(inp, inp->inp_route.ro_rt, route_rule_id);
1916 }
1917 }
1918 #endif /* NECP */
1919 if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
1920 ipoa.ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
1921 }
1922 if (check_qos_marking_again) {
1923 ipoa.ipoa_flags |= IPOAF_REDO_QOSMARKING_POLICY;
1924 }
1925 ipoa.qos_marking_gencount = inp->inp_policyresult.results.qos_marking_gencount;
1926
1927 #if IPSEC
1928 if (inp->inp_sp != NULL && ipsec_setsocket(m, inp->inp_socket) != 0) {
1929 error = ENOBUFS;
1930 goto abort;
1931 }
1932 #endif /* IPSEC */
1933
1934 inpopts = inp->inp_options;
1935 #if CONTENT_FILTER
1936 if (cfil_tag && (inp->inp_socket->so_options != cfil_so_options)) {
1937 soopts |= (cfil_so_options & (SO_DONTROUTE | SO_BROADCAST));
1938 } else
1939 #endif
1940 soopts |= (inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST));
1941
1942 mopts = inp->inp_moptions;
1943 if (mopts != NULL) {
1944 IMO_LOCK(mopts);
1945 IMO_ADDREF_LOCKED(mopts);
1946 if (IN_MULTICAST(ntohl(ui->ui_dst.s_addr)) &&
1947 mopts->imo_multicast_ifp != NULL) {
1948 /* no reference needed */
1949 inp->inp_last_outifp = mopts->imo_multicast_ifp;
1950 #if SKYWALK
1951 if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
1952 netns_set_ifnet(&inp->inp_netns_token,
1953 inp->inp_last_outifp);
1954 }
1955 #endif /* SKYWALK */
1956 }
1957 IMO_UNLOCK(mopts);
1958 }
1959
1960 /* Copy the cached route and take an extra reference */
1961 inp_route_copyout(inp, &ro);
1962
1963 set_packet_service_class(m, so, sotc, 0);
1964 m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
1965 m->m_pkthdr.pkt_flowid = inp->inp_flowhash;
1966 m->m_pkthdr.pkt_proto = IPPROTO_UDP;
1967 m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC);
1968 if (flowadv) {
1969 m->m_pkthdr.pkt_flags |= PKTF_FLOW_ADV;
1970 }
1971 m->m_pkthdr.tx_udp_pid = so->last_pid;
1972 if (so->so_flags & SOF_DELEGATED) {
1973 m->m_pkthdr.tx_udp_e_pid = so->e_pid;
1974 } else {
1975 m->m_pkthdr.tx_udp_e_pid = 0;
1976 }
1977 #if (DEBUG || DEVELOPMENT)
1978 if (so->so_flags & SOF_MARK_WAKE_PKT) {
1979 so->so_flags &= ~SOF_MARK_WAKE_PKT;
1980 m->m_pkthdr.pkt_flags |= PKTF_WAKE_PKT;
1981 }
1982 #endif /* (DEBUG || DEVELOPMENT) */
1983
1984 m_add_crumb(m, PKT_CRUMB_UDP_OUTPUT);
1985
1986 if (ipoa.ipoa_boundif != IFSCOPE_NONE) {
1987 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
1988 }
1989
1990 if (laddr.s_addr != INADDR_ANY) {
1991 ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
1992 }
1993
1994 socket_unlock(so, 0);
1995 error = ip_output(m, inpopts, &ro, soopts, mopts, &ipoa);
1996 m = NULL;
1997 socket_lock(so, 0);
1998 if (mopts != NULL) {
1999 IMO_REMREF(mopts);
2000 }
2001
2002 if (check_qos_marking_again) {
2003 inp->inp_policyresult.results.qos_marking_gencount = ipoa.qos_marking_gencount;
2004
2005 if (ipoa.ipoa_flags & IPOAF_QOSMARKING_ALLOWED) {
2006 inp->inp_socket->so_flags1 |= SOF1_QOSMARKING_ALLOWED;
2007 } else {
2008 inp->inp_socket->so_flags1 &= ~SOF1_QOSMARKING_ALLOWED;
2009 }
2010 }
2011
2012 if (error == 0 && nstat_collect) {
2013 boolean_t cell, wifi, wired;
2014
2015 if (ro.ro_rt != NULL) {
2016 cell = IFNET_IS_CELLULAR(ro.ro_rt->rt_ifp);
2017 wifi = (!cell && IFNET_IS_WIFI(ro.ro_rt->rt_ifp));
2018 wired = (!wifi && IFNET_IS_WIRED(ro.ro_rt->rt_ifp));
2019 } else {
2020 cell = wifi = wired = FALSE;
2021 }
2022 INP_ADD_STAT(inp, cell, wifi, wired, txpackets, 1);
2023 INP_ADD_STAT(inp, cell, wifi, wired, txbytes, len);
2024 inp_set_activity_bitmap(inp);
2025 }
2026
2027 if (flowadv && (adv->code == FADV_FLOW_CONTROLLED ||
2028 adv->code == FADV_SUSPENDED)) {
2029 /*
2030 * return a hint to the application that
2031 * the packet has been dropped
2032 */
2033 error = ENOBUFS;
2034 inp_set_fc_state(inp, adv->code);
2035 }
2036
2037 /* Synchronize PCB cached route */
2038 inp_route_copyin(inp, &ro);
2039
2040 abort:
2041 if (udp_dodisconnect) {
2042 /* Always discard the cached route for unconnected socket */
2043 ROUTE_RELEASE(&inp->inp_route);
2044 in_pcbdisconnect(inp);
2045 inp->inp_laddr = origladdr; /* XXX rehash? */
2046 /* no reference needed */
2047 inp->inp_last_outifp = origoutifp;
2048 #if SKYWALK
2049 if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2050 netns_set_ifnet(&inp->inp_netns_token,
2051 inp->inp_last_outifp);
2052 }
2053 #endif /* SKYWALK */
2054 } else if (inp->inp_route.ro_rt != NULL) {
2055 struct rtentry *rt = inp->inp_route.ro_rt;
2056 struct ifnet *outifp;
2057
2058 if (rt->rt_flags & (RTF_MULTICAST | RTF_BROADCAST)) {
2059 rt = NULL; /* unusable */
2060 }
2061 #if CONTENT_FILTER
2062 /*
2063 * Discard temporary route for cfil case
2064 */
2065 if (cfil_faddr_use) {
2066 rt = NULL; /* unusable */
2067 }
2068 #endif
2069
2070 /*
2071 * Always discard if it is a multicast or broadcast route.
2072 */
2073 if (rt == NULL) {
2074 ROUTE_RELEASE(&inp->inp_route);
2075 }
2076
2077 /*
2078 * If the destination route is unicast, update outifp with
2079 * that of the route interface used by IP.
2080 */
2081 if (rt != NULL &&
2082 (outifp = rt->rt_ifp) != inp->inp_last_outifp) {
2083 inp->inp_last_outifp = outifp; /* no reference needed */
2084 #if SKYWALK
2085 if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2086 netns_set_ifnet(&inp->inp_netns_token,
2087 inp->inp_last_outifp);
2088 }
2089 #endif /* SKYWALK */
2090
2091 so->so_pktheadroom = (uint16_t)P2ROUNDUP(
2092 sizeof(struct udphdr) +
2093 sizeof(struct ip) +
2094 ifnet_hdrlen(outifp) +
2095 ifnet_mbuf_packetpreamblelen(outifp),
2096 sizeof(u_int32_t));
2097 }
2098 } else {
2099 ROUTE_RELEASE(&inp->inp_route);
2100 }
2101
2102 /*
2103 * If output interface was cellular/expensive, and this socket is
2104 * denied access to it, generate an event.
2105 */
2106 if (error != 0 && (ipoa.ipoa_flags & IPOAF_R_IFDENIED) &&
2107 (INP_NO_CELLULAR(inp) || INP_NO_EXPENSIVE(inp) || INP_NO_CONSTRAINED(inp))) {
2108 soevent(so, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
2109 }
2110
2111 release:
2112 KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_END, error, 0, 0, 0, 0);
2113
2114 if (m != NULL) {
2115 m_freem(m);
2116 }
2117
2118 if (outif != NULL) {
2119 ifnet_release(outif);
2120 }
2121
2122 #if CONTENT_FILTER
2123 if (cfil_tag) {
2124 m_tag_free(cfil_tag);
2125 }
2126 #endif
2127 if (sndinprog_cnt_used) {
2128 VERIFY(inp->inp_sndinprog_cnt > 0);
2129 if (--inp->inp_sndinprog_cnt == 0) {
2130 inp->inp_flags &= ~(INP_FC_FEEDBACK);
2131 if (inp->inp_sndingprog_waiters > 0) {
2132 wakeup(&inp->inp_sndinprog_cnt);
2133 }
2134 }
2135 sndinprog_cnt_used = false;
2136 }
2137
2138 return error;
2139 }
2140
2141 u_int32_t udp_sendspace = 9216; /* really max datagram size */
2142 /* 187 1K datagrams (approx 192 KB) */
2143 u_int32_t udp_recvspace = 187 * (1024 + sizeof(struct sockaddr_in6));
2144
2145 /* Check that the values of udp send and recv space do not exceed sb_max */
2146 static int
sysctl_udp_sospace(struct sysctl_oid * oidp,void * arg1,int arg2,struct sysctl_req * req)2147 sysctl_udp_sospace(struct sysctl_oid *oidp, void *arg1, int arg2,
2148 struct sysctl_req *req)
2149 {
2150 #pragma unused(arg1, arg2)
2151 u_int32_t new_value = 0, *space_p = NULL;
2152 int changed = 0, error = 0;
2153 u_quad_t sb_effective_max = (sb_max / (MSIZE + MCLBYTES)) * MCLBYTES;
2154
2155 switch (oidp->oid_number) {
2156 case UDPCTL_RECVSPACE:
2157 space_p = &udp_recvspace;
2158 break;
2159 case UDPCTL_MAXDGRAM:
2160 space_p = &udp_sendspace;
2161 break;
2162 default:
2163 return EINVAL;
2164 }
2165 error = sysctl_io_number(req, *space_p, sizeof(u_int32_t),
2166 &new_value, &changed);
2167 if (changed) {
2168 if (new_value > 0 && new_value <= sb_effective_max) {
2169 *space_p = new_value;
2170 } else {
2171 error = ERANGE;
2172 }
2173 }
2174 return error;
2175 }
2176
2177 SYSCTL_PROC(_net_inet_udp, UDPCTL_RECVSPACE, recvspace,
2178 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &udp_recvspace, 0,
2179 &sysctl_udp_sospace, "IU", "Maximum incoming UDP datagram size");
2180
2181 SYSCTL_PROC(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram,
2182 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &udp_sendspace, 0,
2183 &sysctl_udp_sospace, "IU", "Maximum outgoing UDP datagram size");
2184
2185 int
udp_abort(struct socket * so)2186 udp_abort(struct socket *so)
2187 {
2188 struct inpcb *inp;
2189
2190 inp = sotoinpcb(so);
2191 if (inp == NULL) {
2192 panic("%s: so=%p null inp", __func__, so);
2193 /* NOTREACHED */
2194 }
2195 soisdisconnected(so);
2196 in_pcbdetach(inp);
2197 return 0;
2198 }
2199
2200 int
udp_attach(struct socket * so,int proto,struct proc * p)2201 udp_attach(struct socket *so, int proto, struct proc *p)
2202 {
2203 #pragma unused(proto)
2204 struct inpcb *inp;
2205 int error;
2206
2207 error = soreserve(so, udp_sendspace, udp_recvspace);
2208 if (error != 0) {
2209 return error;
2210 }
2211 inp = sotoinpcb(so);
2212 if (inp != NULL) {
2213 panic("%s so=%p inp=%p", __func__, so, inp);
2214 /* NOTREACHED */
2215 }
2216 error = in_pcballoc(so, &udbinfo, p);
2217 if (error != 0) {
2218 return error;
2219 }
2220 inp = (struct inpcb *)so->so_pcb;
2221 inp->inp_vflag |= INP_IPV4;
2222 inp->inp_ip_ttl = (uint8_t)ip_defttl;
2223 if (nstat_collect) {
2224 nstat_udp_new_pcb(inp);
2225 }
2226 return 0;
2227 }
2228
2229 int
udp_bind(struct socket * so,struct sockaddr * nam,struct proc * p)2230 udp_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
2231 {
2232 struct inpcb *inp;
2233 int error;
2234
2235 if (nam->sa_family != 0 && nam->sa_family != AF_INET &&
2236 nam->sa_family != AF_INET6) {
2237 return EAFNOSUPPORT;
2238 }
2239
2240 inp = sotoinpcb(so);
2241 if (inp == NULL) {
2242 return EINVAL;
2243 }
2244 error = in_pcbbind(inp, nam, p);
2245
2246 #if NECP
2247 /* Update NECP client with bind result if not in middle of connect */
2248 if (error == 0 &&
2249 (inp->inp_flags2 & INP2_CONNECT_IN_PROGRESS) &&
2250 !uuid_is_null(inp->necp_client_uuid)) {
2251 socket_unlock(so, 0);
2252 necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
2253 socket_lock(so, 0);
2254 }
2255 #endif /* NECP */
2256
2257 return error;
2258 }
2259
2260 int
udp_connect(struct socket * so,struct sockaddr * nam,struct proc * p)2261 udp_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
2262 {
2263 struct inpcb *inp;
2264 int error;
2265
2266 inp = sotoinpcb(so);
2267 if (inp == NULL) {
2268 return EINVAL;
2269 }
2270 if (inp->inp_faddr.s_addr != INADDR_ANY) {
2271 return EISCONN;
2272 }
2273
2274 if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
2275 so->so_flags1 |= SOF1_CONNECT_COUNTED;
2276 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
2277 }
2278
2279 #if NECP
2280 #if FLOW_DIVERT
2281 if (necp_socket_should_use_flow_divert(inp)) {
2282 error = flow_divert_pcb_init(so);
2283 if (error == 0) {
2284 error = flow_divert_connect_out(so, nam, p);
2285 }
2286 return error;
2287 }
2288 #endif /* FLOW_DIVERT */
2289 #endif /* NECP */
2290
2291 error = in_pcbconnect(inp, nam, p, IFSCOPE_NONE, NULL);
2292 if (error == 0) {
2293 #if NECP
2294 /* Update NECP client with connected five-tuple */
2295 if (!uuid_is_null(inp->necp_client_uuid)) {
2296 socket_unlock(so, 0);
2297 necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
2298 socket_lock(so, 0);
2299 }
2300 #endif /* NECP */
2301
2302 soisconnected(so);
2303 if (inp->inp_flowhash == 0) {
2304 inp_calc_flowhash(inp);
2305 ASSERT(inp->inp_flowhash != 0);
2306 }
2307 }
2308 return error;
2309 }
2310
2311 int
udp_connectx_common(struct socket * so,int af,struct sockaddr * src,struct sockaddr * dst,struct proc * p,uint32_t ifscope,sae_associd_t aid,sae_connid_t * pcid,uint32_t flags,void * arg,uint32_t arglen,struct uio * uio,user_ssize_t * bytes_written)2312 udp_connectx_common(struct socket *so, int af, struct sockaddr *src, struct sockaddr *dst,
2313 struct proc *p, uint32_t ifscope, sae_associd_t aid, sae_connid_t *pcid,
2314 uint32_t flags, void *arg, uint32_t arglen,
2315 struct uio *uio, user_ssize_t *bytes_written)
2316 {
2317 #pragma unused(aid, flags, arg, arglen)
2318 struct inpcb *inp = sotoinpcb(so);
2319 int error = 0;
2320 user_ssize_t datalen = 0;
2321
2322 if (inp == NULL) {
2323 return EINVAL;
2324 }
2325
2326 VERIFY(dst != NULL);
2327
2328 ASSERT(!(inp->inp_flags2 & INP2_CONNECT_IN_PROGRESS));
2329 inp->inp_flags2 |= INP2_CONNECT_IN_PROGRESS;
2330
2331 #if NECP
2332 inp_update_necp_policy(inp, src, dst, ifscope);
2333 #endif /* NECP */
2334
2335 /* bind socket to the specified interface, if requested */
2336 if (ifscope != IFSCOPE_NONE &&
2337 (error = inp_bindif(inp, ifscope, NULL)) != 0) {
2338 goto done;
2339 }
2340
2341 /* if source address and/or port is specified, bind to it */
2342 if (src != NULL) {
2343 error = sobindlock(so, src, 0); /* already locked */
2344 if (error != 0) {
2345 goto done;
2346 }
2347 }
2348
2349 switch (af) {
2350 case AF_INET:
2351 error = udp_connect(so, dst, p);
2352 break;
2353 case AF_INET6:
2354 error = udp6_connect(so, dst, p);
2355 break;
2356 default:
2357 VERIFY(0);
2358 /* NOTREACHED */
2359 }
2360
2361 if (error != 0) {
2362 goto done;
2363 }
2364
2365 /*
2366 * If there is data, copy it. DATA_IDEMPOTENT is ignored.
2367 * CONNECT_RESUME_ON_READ_WRITE is ignored.
2368 */
2369 if (uio != NULL) {
2370 socket_unlock(so, 0);
2371
2372 VERIFY(bytes_written != NULL);
2373
2374 datalen = uio_resid(uio);
2375 error = so->so_proto->pr_usrreqs->pru_sosend(so, NULL,
2376 (uio_t)uio, NULL, NULL, 0);
2377 socket_lock(so, 0);
2378
2379 /* If error returned is EMSGSIZE, for example, disconnect */
2380 if (error == 0 || error == EWOULDBLOCK) {
2381 *bytes_written = datalen - uio_resid(uio);
2382 } else {
2383 (void) so->so_proto->pr_usrreqs->pru_disconnectx(so,
2384 SAE_ASSOCID_ANY, SAE_CONNID_ANY);
2385 }
2386 /*
2387 * mask the EWOULDBLOCK error so that the caller
2388 * knows that atleast the connect was successful.
2389 */
2390 if (error == EWOULDBLOCK) {
2391 error = 0;
2392 }
2393 }
2394
2395 if (error == 0 && pcid != NULL) {
2396 *pcid = 1; /* there is only 1 connection for UDP */
2397 }
2398 done:
2399 inp->inp_flags2 &= ~INP2_CONNECT_IN_PROGRESS;
2400 return error;
2401 }
2402
2403 int
udp_connectx(struct socket * so,struct sockaddr * src,struct sockaddr * dst,struct proc * p,uint32_t ifscope,sae_associd_t aid,sae_connid_t * pcid,uint32_t flags,void * arg,uint32_t arglen,struct uio * uio,user_ssize_t * bytes_written)2404 udp_connectx(struct socket *so, struct sockaddr *src,
2405 struct sockaddr *dst, struct proc *p, uint32_t ifscope,
2406 sae_associd_t aid, sae_connid_t *pcid, uint32_t flags, void *arg,
2407 uint32_t arglen, struct uio *uio, user_ssize_t *bytes_written)
2408 {
2409 return udp_connectx_common(so, AF_INET, src, dst,
2410 p, ifscope, aid, pcid, flags, arg, arglen, uio, bytes_written);
2411 }
2412
2413 int
udp_detach(struct socket * so)2414 udp_detach(struct socket *so)
2415 {
2416 struct inpcb *inp;
2417
2418 inp = sotoinpcb(so);
2419 if (inp == NULL) {
2420 panic("%s: so=%p null inp", __func__, so);
2421 /* NOTREACHED */
2422 }
2423
2424 /*
2425 * If this is a socket that does not want to wakeup the device
2426 * for it's traffic, the application might be waiting for
2427 * close to complete before going to sleep. Send a notification
2428 * for this kind of sockets
2429 */
2430 if (so->so_options & SO_NOWAKEFROMSLEEP) {
2431 socket_post_kev_msg_closed(so);
2432 }
2433
2434 in_pcbdetach(inp);
2435 inp->inp_state = INPCB_STATE_DEAD;
2436 return 0;
2437 }
2438
2439 int
udp_disconnect(struct socket * so)2440 udp_disconnect(struct socket *so)
2441 {
2442 struct inpcb *inp;
2443
2444 inp = sotoinpcb(so);
2445 if (inp == NULL) {
2446 return EINVAL;
2447 }
2448 if (inp->inp_faddr.s_addr == INADDR_ANY) {
2449 return ENOTCONN;
2450 }
2451
2452 in_pcbdisconnect(inp);
2453
2454 /* reset flow controlled state, just in case */
2455 inp_reset_fc_state(inp);
2456
2457 inp->inp_laddr.s_addr = INADDR_ANY;
2458 so->so_state &= ~SS_ISCONNECTED; /* XXX */
2459 inp->inp_last_outifp = NULL;
2460 #if SKYWALK
2461 if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2462 netns_set_ifnet(&inp->inp_netns_token, NULL);
2463 }
2464 #endif /* SKYWALK */
2465
2466 return 0;
2467 }
2468
2469 int
udp_disconnectx(struct socket * so,sae_associd_t aid,sae_connid_t cid)2470 udp_disconnectx(struct socket *so, sae_associd_t aid, sae_connid_t cid)
2471 {
2472 #pragma unused(cid)
2473 if (aid != SAE_ASSOCID_ANY && aid != SAE_ASSOCID_ALL) {
2474 return EINVAL;
2475 }
2476
2477 return udp_disconnect(so);
2478 }
2479
2480 int
udp_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * addr,struct mbuf * control,struct proc * p)2481 udp_send(struct socket *so, int flags, struct mbuf *m,
2482 struct sockaddr *addr, struct mbuf *control, struct proc *p)
2483 {
2484 #ifndef FLOW_DIVERT
2485 #pragma unused(flags)
2486 #endif /* !(FLOW_DIVERT) */
2487 struct inpcb *inp;
2488 int error;
2489
2490 inp = sotoinpcb(so);
2491 if (inp == NULL) {
2492 if (m != NULL) {
2493 m_freem(m);
2494 }
2495 if (control != NULL) {
2496 m_freem(control);
2497 }
2498 return EINVAL;
2499 }
2500
2501 #if NECP
2502 #if FLOW_DIVERT
2503 if (necp_socket_should_use_flow_divert(inp)) {
2504 /* Implicit connect */
2505 return flow_divert_implicit_data_out(so, flags, m, addr,
2506 control, p);
2507 }
2508 #endif /* FLOW_DIVERT */
2509 #endif /* NECP */
2510
2511 #if SKYWALK
2512 sk_protect_t protect = sk_async_transmit_protect();
2513 #endif /* SKYWALK */
2514 error = udp_output(inp, m, addr, control, p);
2515 #if SKYWALK
2516 sk_async_transmit_unprotect(protect);
2517 #endif /* SKYWALK */
2518
2519 return error;
2520 }
2521
2522 int
udp_shutdown(struct socket * so)2523 udp_shutdown(struct socket *so)
2524 {
2525 struct inpcb *inp;
2526
2527 inp = sotoinpcb(so);
2528 if (inp == NULL) {
2529 return EINVAL;
2530 }
2531 socantsendmore(so);
2532 return 0;
2533 }
2534
2535 int
udp_lock(struct socket * so,int refcount,void * debug)2536 udp_lock(struct socket *so, int refcount, void *debug)
2537 {
2538 void *lr_saved;
2539
2540 if (debug == NULL) {
2541 lr_saved = __builtin_return_address(0);
2542 } else {
2543 lr_saved = debug;
2544 }
2545
2546 if (so->so_pcb != NULL) {
2547 LCK_MTX_ASSERT(&((struct inpcb *)so->so_pcb)->inpcb_mtx,
2548 LCK_MTX_ASSERT_NOTOWNED);
2549 lck_mtx_lock(&((struct inpcb *)so->so_pcb)->inpcb_mtx);
2550 } else {
2551 panic("%s: so=%p NO PCB! lr=%p lrh= %s", __func__,
2552 so, lr_saved, solockhistory_nr(so));
2553 /* NOTREACHED */
2554 }
2555 if (refcount) {
2556 so->so_usecount++;
2557 }
2558
2559 so->lock_lr[so->next_lock_lr] = lr_saved;
2560 so->next_lock_lr = (so->next_lock_lr + 1) % SO_LCKDBG_MAX;
2561 return 0;
2562 }
2563
2564 int
udp_unlock(struct socket * so,int refcount,void * debug)2565 udp_unlock(struct socket *so, int refcount, void *debug)
2566 {
2567 void *lr_saved;
2568
2569 if (debug == NULL) {
2570 lr_saved = __builtin_return_address(0);
2571 } else {
2572 lr_saved = debug;
2573 }
2574
2575 if (refcount) {
2576 VERIFY(so->so_usecount > 0);
2577 so->so_usecount--;
2578 }
2579 if (so->so_pcb == NULL) {
2580 panic("%s: so=%p NO PCB! lr=%p lrh= %s", __func__,
2581 so, lr_saved, solockhistory_nr(so));
2582 /* NOTREACHED */
2583 } else {
2584 LCK_MTX_ASSERT(&((struct inpcb *)so->so_pcb)->inpcb_mtx,
2585 LCK_MTX_ASSERT_OWNED);
2586 so->unlock_lr[so->next_unlock_lr] = lr_saved;
2587 so->next_unlock_lr = (so->next_unlock_lr + 1) % SO_LCKDBG_MAX;
2588 lck_mtx_unlock(&((struct inpcb *)so->so_pcb)->inpcb_mtx);
2589 }
2590 return 0;
2591 }
2592
2593 lck_mtx_t *
udp_getlock(struct socket * so,int flags)2594 udp_getlock(struct socket *so, int flags)
2595 {
2596 #pragma unused(flags)
2597 struct inpcb *inp = sotoinpcb(so);
2598
2599 if (so->so_pcb == NULL) {
2600 panic("%s: so=%p NULL so_pcb lrh= %s", __func__,
2601 so, solockhistory_nr(so));
2602 /* NOTREACHED */
2603 }
2604 return &inp->inpcb_mtx;
2605 }
2606
2607 /*
2608 * UDP garbage collector callback (inpcb_timer_func_t).
2609 *
2610 * Returns > 0 to keep timer active.
2611 */
2612 static void
udp_gc(struct inpcbinfo * ipi)2613 udp_gc(struct inpcbinfo *ipi)
2614 {
2615 struct inpcb *inp, *inpnxt;
2616 struct socket *so;
2617
2618 if (lck_rw_try_lock_exclusive(&ipi->ipi_lock) == FALSE) {
2619 if (udp_gc_done == TRUE) {
2620 udp_gc_done = FALSE;
2621 /* couldn't get the lock, must lock next time */
2622 atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2623 return;
2624 }
2625 lck_rw_lock_exclusive(&ipi->ipi_lock);
2626 }
2627
2628 udp_gc_done = TRUE;
2629
2630 for (inp = udb.lh_first; inp != NULL; inp = inpnxt) {
2631 inpnxt = inp->inp_list.le_next;
2632
2633 /*
2634 * Skip unless it's STOPUSING; garbage collector will
2635 * be triggered by in_pcb_checkstate() upon setting
2636 * wantcnt to that value. If the PCB is already dead,
2637 * keep gc active to anticipate wantcnt changing.
2638 */
2639 if (inp->inp_wantcnt != WNT_STOPUSING) {
2640 continue;
2641 }
2642
2643 /*
2644 * Skip if busy, no hurry for cleanup. Keep gc active
2645 * and try the lock again during next round.
2646 */
2647 if (!socket_try_lock(inp->inp_socket)) {
2648 atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2649 continue;
2650 }
2651
2652 /*
2653 * Keep gc active unless usecount is 0.
2654 */
2655 so = inp->inp_socket;
2656 if (so->so_usecount == 0) {
2657 if (inp->inp_state != INPCB_STATE_DEAD) {
2658 if (SOCK_CHECK_DOM(so, PF_INET6)) {
2659 in6_pcbdetach(inp);
2660 } else {
2661 in_pcbdetach(inp);
2662 }
2663 }
2664 in_pcbdispose(inp);
2665 } else {
2666 socket_unlock(so, 0);
2667 atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2668 }
2669 }
2670 lck_rw_done(&ipi->ipi_lock);
2671 }
2672
2673 static int
2674 udp_getstat SYSCTL_HANDLER_ARGS
2675 {
2676 #pragma unused(oidp, arg1, arg2)
2677 if (req->oldptr == USER_ADDR_NULL) {
2678 req->oldlen = (size_t)sizeof(struct udpstat);
2679 }
2680
2681 return SYSCTL_OUT(req, &udpstat, MIN(sizeof(udpstat), req->oldlen));
2682 }
2683
2684 void
udp_in_cksum_stats(u_int32_t len)2685 udp_in_cksum_stats(u_int32_t len)
2686 {
2687 udpstat.udps_rcv_swcsum++;
2688 udpstat.udps_rcv_swcsum_bytes += len;
2689 }
2690
2691 void
udp_out_cksum_stats(u_int32_t len)2692 udp_out_cksum_stats(u_int32_t len)
2693 {
2694 udpstat.udps_snd_swcsum++;
2695 udpstat.udps_snd_swcsum_bytes += len;
2696 }
2697
2698 void
udp_in6_cksum_stats(u_int32_t len)2699 udp_in6_cksum_stats(u_int32_t len)
2700 {
2701 udpstat.udps_rcv6_swcsum++;
2702 udpstat.udps_rcv6_swcsum_bytes += len;
2703 }
2704
2705 void
udp_out6_cksum_stats(u_int32_t len)2706 udp_out6_cksum_stats(u_int32_t len)
2707 {
2708 udpstat.udps_snd6_swcsum++;
2709 udpstat.udps_snd6_swcsum_bytes += len;
2710 }
2711
2712 /*
2713 * Checksum extended UDP header and data.
2714 */
2715 static int
udp_input_checksum(struct mbuf * m,struct udphdr * uh,int off,int ulen)2716 udp_input_checksum(struct mbuf *m, struct udphdr *uh, int off, int ulen)
2717 {
2718 struct ifnet *ifp = m->m_pkthdr.rcvif;
2719 struct ip *ip = mtod(m, struct ip *);
2720 struct ipovly *ipov = (struct ipovly *)ip;
2721
2722 if (uh->uh_sum == 0) {
2723 udpstat.udps_nosum++;
2724 return 0;
2725 }
2726
2727 /* ip_stripoptions() must have been called before we get here */
2728 ASSERT((ip->ip_hl << 2) == sizeof(*ip));
2729
2730 if ((hwcksum_rx || (ifp->if_flags & IFF_LOOPBACK) ||
2731 (m->m_pkthdr.pkt_flags & PKTF_LOOP)) &&
2732 (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)) {
2733 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
2734 uh->uh_sum = m->m_pkthdr.csum_rx_val;
2735 } else {
2736 uint32_t sum = m->m_pkthdr.csum_rx_val;
2737 uint32_t start = m->m_pkthdr.csum_rx_start;
2738 int32_t trailer = (m_pktlen(m) - (off + ulen));
2739
2740 /*
2741 * Perform 1's complement adjustment of octets
2742 * that got included/excluded in the hardware-
2743 * calculated checksum value. Ignore cases
2744 * where the value already includes the entire
2745 * IP header span, as the sum for those octets
2746 * would already be 0 by the time we get here;
2747 * IP has already performed its header checksum
2748 * checks. If we do need to adjust, restore
2749 * the original fields in the IP header when
2750 * computing the adjustment value. Also take
2751 * care of any trailing bytes and subtract out
2752 * their partial sum.
2753 */
2754 ASSERT(trailer >= 0);
2755 if ((m->m_pkthdr.csum_flags & CSUM_PARTIAL) &&
2756 ((start != 0 && start != off) || trailer != 0)) {
2757 uint32_t swbytes = (uint32_t)trailer;
2758
2759 if (start < off) {
2760 ip->ip_len += sizeof(*ip);
2761 #if BYTE_ORDER != BIG_ENDIAN
2762 HTONS(ip->ip_len);
2763 HTONS(ip->ip_off);
2764 #endif /* BYTE_ORDER != BIG_ENDIAN */
2765 }
2766 /* callee folds in sum */
2767 sum = m_adj_sum16(m, start, off, ulen, sum);
2768 if (off > start) {
2769 swbytes += (off - start);
2770 } else {
2771 swbytes += (start - off);
2772 }
2773
2774 if (start < off) {
2775 #if BYTE_ORDER != BIG_ENDIAN
2776 NTOHS(ip->ip_off);
2777 NTOHS(ip->ip_len);
2778 #endif /* BYTE_ORDER != BIG_ENDIAN */
2779 ip->ip_len -= sizeof(*ip);
2780 }
2781
2782 if (swbytes != 0) {
2783 udp_in_cksum_stats(swbytes);
2784 }
2785 if (trailer != 0) {
2786 m_adj(m, -trailer);
2787 }
2788 }
2789
2790 /* callee folds in sum */
2791 uh->uh_sum = in_pseudo(ip->ip_src.s_addr,
2792 ip->ip_dst.s_addr, sum + htonl(ulen + IPPROTO_UDP));
2793 }
2794 uh->uh_sum ^= 0xffff;
2795 } else {
2796 uint16_t ip_sum;
2797 char b[9];
2798
2799 bcopy(ipov->ih_x1, b, sizeof(ipov->ih_x1));
2800 bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
2801 ip_sum = ipov->ih_len;
2802 ipov->ih_len = uh->uh_ulen;
2803 uh->uh_sum = in_cksum(m, ulen + sizeof(struct ip));
2804 bcopy(b, ipov->ih_x1, sizeof(ipov->ih_x1));
2805 ipov->ih_len = ip_sum;
2806
2807 udp_in_cksum_stats(ulen);
2808 }
2809
2810 if (uh->uh_sum != 0) {
2811 udpstat.udps_badsum++;
2812 IF_UDP_STATINC(ifp, badchksum);
2813 return -1;
2814 }
2815
2816 return 0;
2817 }
2818
2819 void
udp_fill_keepalive_offload_frames(ifnet_t ifp,struct ifnet_keepalive_offload_frame * frames_array,u_int32_t frames_array_count,size_t frame_data_offset,u_int32_t * used_frames_count)2820 udp_fill_keepalive_offload_frames(ifnet_t ifp,
2821 struct ifnet_keepalive_offload_frame *frames_array,
2822 u_int32_t frames_array_count, size_t frame_data_offset,
2823 u_int32_t *used_frames_count)
2824 {
2825 struct inpcb *inp;
2826 inp_gen_t gencnt;
2827 u_int32_t frame_index = *used_frames_count;
2828
2829 if (ifp == NULL || frames_array == NULL ||
2830 frames_array_count == 0 ||
2831 frame_index >= frames_array_count ||
2832 frame_data_offset >= IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2833 return;
2834 }
2835
2836 lck_rw_lock_shared(&udbinfo.ipi_lock);
2837 gencnt = udbinfo.ipi_gencnt;
2838 LIST_FOREACH(inp, udbinfo.ipi_listhead, inp_list) {
2839 struct socket *so;
2840 u_int8_t *data;
2841 struct ifnet_keepalive_offload_frame *frame;
2842 struct mbuf *m = NULL;
2843
2844 if (frame_index >= frames_array_count) {
2845 break;
2846 }
2847
2848 if (inp->inp_gencnt > gencnt ||
2849 inp->inp_state == INPCB_STATE_DEAD) {
2850 continue;
2851 }
2852
2853 if ((so = inp->inp_socket) == NULL ||
2854 (so->so_state & SS_DEFUNCT)) {
2855 continue;
2856 }
2857 /*
2858 * check for keepalive offload flag without socket
2859 * lock to avoid a deadlock
2860 */
2861 if (!(inp->inp_flags2 & INP2_KEEPALIVE_OFFLOAD)) {
2862 continue;
2863 }
2864
2865 udp_lock(so, 1, 0);
2866 if (!(inp->inp_vflag & (INP_IPV4 | INP_IPV6))) {
2867 udp_unlock(so, 1, 0);
2868 continue;
2869 }
2870 if ((inp->inp_vflag & INP_IPV4) &&
2871 (inp->inp_laddr.s_addr == INADDR_ANY ||
2872 inp->inp_faddr.s_addr == INADDR_ANY)) {
2873 udp_unlock(so, 1, 0);
2874 continue;
2875 }
2876 if ((inp->inp_vflag & INP_IPV6) &&
2877 (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) ||
2878 IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))) {
2879 udp_unlock(so, 1, 0);
2880 continue;
2881 }
2882 if (inp->inp_lport == 0 || inp->inp_fport == 0) {
2883 udp_unlock(so, 1, 0);
2884 continue;
2885 }
2886 if (inp->inp_last_outifp == NULL ||
2887 inp->inp_last_outifp->if_index != ifp->if_index) {
2888 udp_unlock(so, 1, 0);
2889 continue;
2890 }
2891 if ((inp->inp_vflag & INP_IPV4)) {
2892 if ((frame_data_offset + sizeof(struct udpiphdr) +
2893 inp->inp_keepalive_datalen) >
2894 IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2895 udp_unlock(so, 1, 0);
2896 continue;
2897 }
2898 if ((sizeof(struct udpiphdr) +
2899 inp->inp_keepalive_datalen) > _MHLEN) {
2900 udp_unlock(so, 1, 0);
2901 continue;
2902 }
2903 } else {
2904 if ((frame_data_offset + sizeof(struct ip6_hdr) +
2905 sizeof(struct udphdr) +
2906 inp->inp_keepalive_datalen) >
2907 IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2908 udp_unlock(so, 1, 0);
2909 continue;
2910 }
2911 if ((sizeof(struct ip6_hdr) + sizeof(struct udphdr) +
2912 inp->inp_keepalive_datalen) > _MHLEN) {
2913 udp_unlock(so, 1, 0);
2914 continue;
2915 }
2916 }
2917 MGETHDR(m, M_WAIT, MT_HEADER);
2918 if (m == NULL) {
2919 udp_unlock(so, 1, 0);
2920 continue;
2921 }
2922 /*
2923 * This inp has all the information that is needed to
2924 * generate an offload frame.
2925 */
2926 if (inp->inp_vflag & INP_IPV4) {
2927 struct ip *ip;
2928 struct udphdr *udp;
2929
2930 frame = &frames_array[frame_index];
2931 frame->length = (uint8_t)(frame_data_offset +
2932 sizeof(struct udpiphdr) +
2933 inp->inp_keepalive_datalen);
2934 frame->ether_type =
2935 IFNET_KEEPALIVE_OFFLOAD_FRAME_ETHERTYPE_IPV4;
2936 frame->interval = inp->inp_keepalive_interval;
2937 switch (inp->inp_keepalive_type) {
2938 case UDP_KEEPALIVE_OFFLOAD_TYPE_AIRPLAY:
2939 frame->type =
2940 IFNET_KEEPALIVE_OFFLOAD_FRAME_AIRPLAY;
2941 break;
2942 default:
2943 break;
2944 }
2945 data = mtod(m, u_int8_t *);
2946 bzero(data, sizeof(struct udpiphdr));
2947 ip = (__typeof__(ip))(void *)data;
2948 udp = (__typeof__(udp))(void *) (data +
2949 sizeof(struct ip));
2950 m->m_len = sizeof(struct udpiphdr);
2951 data = data + sizeof(struct udpiphdr);
2952 if (inp->inp_keepalive_datalen > 0 &&
2953 inp->inp_keepalive_data != NULL) {
2954 bcopy(inp->inp_keepalive_data, data,
2955 inp->inp_keepalive_datalen);
2956 m->m_len += inp->inp_keepalive_datalen;
2957 }
2958 m->m_pkthdr.len = m->m_len;
2959
2960 ip->ip_v = IPVERSION;
2961 ip->ip_hl = (sizeof(struct ip) >> 2);
2962 ip->ip_p = IPPROTO_UDP;
2963 ip->ip_len = htons(sizeof(struct udpiphdr) +
2964 (u_short)inp->inp_keepalive_datalen);
2965 ip->ip_ttl = inp->inp_ip_ttl;
2966 ip->ip_tos |= (inp->inp_ip_tos & ~IPTOS_ECN_MASK);
2967 ip->ip_src = inp->inp_laddr;
2968 ip->ip_dst = inp->inp_faddr;
2969 ip->ip_sum = in_cksum_hdr_opt(ip);
2970
2971 udp->uh_sport = inp->inp_lport;
2972 udp->uh_dport = inp->inp_fport;
2973 udp->uh_ulen = htons(sizeof(struct udphdr) +
2974 (u_short)inp->inp_keepalive_datalen);
2975
2976 if (!(inp->inp_flags & INP_UDP_NOCKSUM)) {
2977 udp->uh_sum = in_pseudo(ip->ip_src.s_addr,
2978 ip->ip_dst.s_addr,
2979 htons(sizeof(struct udphdr) +
2980 (u_short)inp->inp_keepalive_datalen +
2981 IPPROTO_UDP));
2982 m->m_pkthdr.csum_flags =
2983 (CSUM_UDP | CSUM_ZERO_INVERT);
2984 m->m_pkthdr.csum_data = offsetof(struct udphdr,
2985 uh_sum);
2986 }
2987 m->m_pkthdr.pkt_proto = IPPROTO_UDP;
2988 in_delayed_cksum(m);
2989 bcopy(m->m_data, frame->data + frame_data_offset,
2990 m->m_len);
2991 } else {
2992 struct ip6_hdr *ip6;
2993 struct udphdr *udp6;
2994
2995 VERIFY(inp->inp_vflag & INP_IPV6);
2996 frame = &frames_array[frame_index];
2997 frame->length = (uint8_t)(frame_data_offset +
2998 sizeof(struct ip6_hdr) +
2999 sizeof(struct udphdr) +
3000 inp->inp_keepalive_datalen);
3001 frame->ether_type =
3002 IFNET_KEEPALIVE_OFFLOAD_FRAME_ETHERTYPE_IPV6;
3003 frame->interval = inp->inp_keepalive_interval;
3004 switch (inp->inp_keepalive_type) {
3005 case UDP_KEEPALIVE_OFFLOAD_TYPE_AIRPLAY:
3006 frame->type =
3007 IFNET_KEEPALIVE_OFFLOAD_FRAME_AIRPLAY;
3008 break;
3009 default:
3010 break;
3011 }
3012 data = mtod(m, u_int8_t *);
3013 bzero(data, sizeof(struct ip6_hdr) + sizeof(struct udphdr));
3014 ip6 = (__typeof__(ip6))(void *)data;
3015 udp6 = (__typeof__(udp6))(void *)(data +
3016 sizeof(struct ip6_hdr));
3017 m->m_len = sizeof(struct ip6_hdr) +
3018 sizeof(struct udphdr);
3019 data = data + (sizeof(struct ip6_hdr) +
3020 sizeof(struct udphdr));
3021 if (inp->inp_keepalive_datalen > 0 &&
3022 inp->inp_keepalive_data != NULL) {
3023 bcopy(inp->inp_keepalive_data, data,
3024 inp->inp_keepalive_datalen);
3025 m->m_len += inp->inp_keepalive_datalen;
3026 }
3027 m->m_pkthdr.len = m->m_len;
3028 ip6->ip6_flow = inp->inp_flow & IPV6_FLOWINFO_MASK;
3029 ip6->ip6_flow = ip6->ip6_flow & ~IPV6_FLOW_ECN_MASK;
3030 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
3031 ip6->ip6_vfc |= IPV6_VERSION;
3032 ip6->ip6_nxt = IPPROTO_UDP;
3033 ip6->ip6_hlim = (uint8_t)ip6_defhlim;
3034 ip6->ip6_plen = htons(sizeof(struct udphdr) +
3035 (u_short)inp->inp_keepalive_datalen);
3036 ip6->ip6_src = inp->in6p_laddr;
3037 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
3038 ip6->ip6_src.s6_addr16[1] = 0;
3039 }
3040
3041 ip6->ip6_dst = inp->in6p_faddr;
3042 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
3043 ip6->ip6_dst.s6_addr16[1] = 0;
3044 }
3045
3046 udp6->uh_sport = inp->in6p_lport;
3047 udp6->uh_dport = inp->in6p_fport;
3048 udp6->uh_ulen = htons(sizeof(struct udphdr) +
3049 (u_short)inp->inp_keepalive_datalen);
3050 if (!(inp->inp_flags & INP_UDP_NOCKSUM)) {
3051 udp6->uh_sum = in6_pseudo(&ip6->ip6_src,
3052 &ip6->ip6_dst,
3053 htonl(sizeof(struct udphdr) +
3054 (u_short)inp->inp_keepalive_datalen +
3055 IPPROTO_UDP));
3056 m->m_pkthdr.csum_flags =
3057 (CSUM_UDPIPV6 | CSUM_ZERO_INVERT);
3058 m->m_pkthdr.csum_data = offsetof(struct udphdr,
3059 uh_sum);
3060 }
3061 m->m_pkthdr.pkt_proto = IPPROTO_UDP;
3062 in6_delayed_cksum(m);
3063 bcopy(m->m_data, frame->data + frame_data_offset,
3064 m->m_len);
3065 }
3066 if (m != NULL) {
3067 m_freem(m);
3068 m = NULL;
3069 }
3070 frame_index++;
3071 udp_unlock(so, 1, 0);
3072 }
3073 lck_rw_done(&udbinfo.ipi_lock);
3074 *used_frames_count = frame_index;
3075 }
3076