xref: /xnu-8792.41.9/bsd/netinet/udp_usrreq.c (revision 5c2921b07a2480ab43ec66f5b9e41cb872bc554f)
1 /*
2  * Copyright (c) 2000-2021 Apple Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 /*
29  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
30  *	The Regents of the University of California.  All rights reserved.
31  *
32  * Redistribution and use in source and binary forms, with or without
33  * modification, are permitted provided that the following conditions
34  * are met:
35  * 1. Redistributions of source code must retain the above copyright
36  *    notice, this list of conditions and the following disclaimer.
37  * 2. Redistributions in binary form must reproduce the above copyright
38  *    notice, this list of conditions and the following disclaimer in the
39  *    documentation and/or other materials provided with the distribution.
40  * 3. All advertising materials mentioning features or use of this software
41  *    must display the following acknowledgement:
42  *	This product includes software developed by the University of
43  *	California, Berkeley and its contributors.
44  * 4. Neither the name of the University nor the names of its contributors
45  *    may be used to endorse or promote products derived from this software
46  *    without specific prior written permission.
47  *
48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58  * SUCH DAMAGE.
59  *
60  *	@(#)udp_usrreq.c	8.6 (Berkeley) 5/23/95
61  */
62 
63 #include <sys/param.h>
64 #include <sys/systm.h>
65 #include <sys/kernel.h>
66 #include <sys/malloc.h>
67 #include <sys/mbuf.h>
68 #include <sys/domain.h>
69 #include <sys/protosw.h>
70 #include <sys/socket.h>
71 #include <sys/socketvar.h>
72 #include <sys/sysctl.h>
73 #include <sys/syslog.h>
74 #include <sys/mcache.h>
75 #include <net/ntstat.h>
76 
77 #include <kern/zalloc.h>
78 #include <mach/boolean.h>
79 
80 #include <net/if.h>
81 #include <net/if_types.h>
82 #include <net/route.h>
83 #include <net/dlil.h>
84 #include <net/net_api_stats.h>
85 
86 #include <netinet/in.h>
87 #include <netinet/in_systm.h>
88 #include <netinet/in_tclass.h>
89 #include <netinet/ip.h>
90 #include <netinet/ip6.h>
91 #include <netinet/in_pcb.h>
92 #include <netinet/in_var.h>
93 #include <netinet/ip_var.h>
94 #include <netinet6/in6_pcb.h>
95 #include <netinet6/ip6_var.h>
96 #include <netinet6/udp6_var.h>
97 #include <netinet/ip_icmp.h>
98 #include <netinet/icmp_var.h>
99 #include <netinet/udp.h>
100 #include <netinet/udp_var.h>
101 #include <sys/kdebug.h>
102 
103 #if IPSEC
104 #include <netinet6/ipsec.h>
105 #include <netinet6/esp.h>
106 #include <netkey/key.h>
107 extern int ipsec_bypass;
108 extern int esp_udp_encap_port;
109 #endif /* IPSEC */
110 
111 #if NECP
112 #include <net/necp.h>
113 #endif /* NECP */
114 
115 #if FLOW_DIVERT
116 #include <netinet/flow_divert.h>
117 #endif /* FLOW_DIVERT */
118 
119 #if CONTENT_FILTER
120 #include <net/content_filter.h>
121 #endif /* CONTENT_FILTER */
122 
123 #if SKYWALK
124 #include <skywalk/core/skywalk_var.h>
125 #endif /* SKYWALK */
126 
127 #define DBG_LAYER_IN_BEG        NETDBG_CODE(DBG_NETUDP, 0)
128 #define DBG_LAYER_IN_END        NETDBG_CODE(DBG_NETUDP, 2)
129 #define DBG_LAYER_OUT_BEG       NETDBG_CODE(DBG_NETUDP, 1)
130 #define DBG_LAYER_OUT_END       NETDBG_CODE(DBG_NETUDP, 3)
131 #define DBG_FNC_UDP_INPUT       NETDBG_CODE(DBG_NETUDP, (5 << 8))
132 #define DBG_FNC_UDP_OUTPUT      NETDBG_CODE(DBG_NETUDP, (6 << 8) | 1)
133 
134 /*
135  * UDP protocol implementation.
136  * Per RFC 768, August, 1980.
137  */
138 #ifndef COMPAT_42
139 static int udpcksum = 1;
140 #else
141 static int udpcksum = 0;                /* XXX */
142 #endif
143 SYSCTL_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum,
144     CTLFLAG_RW | CTLFLAG_LOCKED, &udpcksum, 0, "");
145 
146 int udp_log_in_vain = 0;
147 SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_RW | CTLFLAG_LOCKED,
148     &udp_log_in_vain, 0, "Log all incoming UDP packets");
149 
150 static int blackhole = 0;
151 SYSCTL_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_RW | CTLFLAG_LOCKED,
152     &blackhole, 0, "Do not send port unreachables for refused connects");
153 
154 struct inpcbhead udb;           /* from udp_var.h */
155 #define udb6    udb  /* for KAME src sync over BSD*'s */
156 struct inpcbinfo udbinfo;
157 
158 #ifndef UDBHASHSIZE
159 #define UDBHASHSIZE 16
160 #endif
161 
162 /* Garbage collection performed during most recent udp_gc() run */
163 static boolean_t udp_gc_done = FALSE;
164 
165 #define log_in_vain_log(a) { log a; }
166 
167 static int udp_getstat SYSCTL_HANDLER_ARGS;
168 struct  udpstat udpstat;        /* from udp_var.h */
169 SYSCTL_PROC(_net_inet_udp, UDPCTL_STATS, stats,
170     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
171     0, 0, udp_getstat, "S,udpstat",
172     "UDP statistics (struct udpstat, netinet/udp_var.h)");
173 
174 SYSCTL_INT(_net_inet_udp, OID_AUTO, pcbcount,
175     CTLFLAG_RD | CTLFLAG_LOCKED, &udbinfo.ipi_count, 0,
176     "Number of active PCBs");
177 
178 __private_extern__ int udp_use_randomport = 1;
179 SYSCTL_INT(_net_inet_udp, OID_AUTO, randomize_ports,
180     CTLFLAG_RW | CTLFLAG_LOCKED, &udp_use_randomport, 0,
181     "Randomize UDP port numbers");
182 
183 struct udp_in6 {
184 	struct sockaddr_in6     uin6_sin;
185 	u_char                  uin6_init_done : 1;
186 };
187 struct udp_ip6 {
188 	struct ip6_hdr          uip6_ip6;
189 	u_char                  uip6_init_done : 1;
190 };
191 
192 int udp_abort(struct socket *);
193 int udp_attach(struct socket *, int, struct proc *);
194 int udp_bind(struct socket *, struct sockaddr *, struct proc *);
195 int udp_connect(struct socket *, struct sockaddr *, struct proc *);
196 int udp_connectx(struct socket *, struct sockaddr *,
197     struct sockaddr *, struct proc *, uint32_t, sae_associd_t,
198     sae_connid_t *, uint32_t, void *, uint32_t, struct uio *, user_ssize_t *);
199 int udp_detach(struct socket *);
200 int udp_disconnect(struct socket *);
201 int udp_disconnectx(struct socket *, sae_associd_t, sae_connid_t);
202 int udp_send(struct socket *, int, struct mbuf *, struct sockaddr *,
203     struct mbuf *, struct proc *);
204 static void udp_append(struct inpcb *, struct ip *, struct mbuf *, int,
205     struct sockaddr_in *, struct udp_in6 *, struct udp_ip6 *, struct ifnet *);
206 static int udp_input_checksum(struct mbuf *, struct udphdr *, int, int);
207 int udp_output(struct inpcb *, struct mbuf *, struct sockaddr *,
208     struct mbuf *, struct proc *);
209 static void ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip);
210 static void udp_gc(struct inpcbinfo *);
211 
212 struct pr_usrreqs udp_usrreqs = {
213 	.pru_abort =            udp_abort,
214 	.pru_attach =           udp_attach,
215 	.pru_bind =             udp_bind,
216 	.pru_connect =          udp_connect,
217 	.pru_connectx =         udp_connectx,
218 	.pru_control =          in_control,
219 	.pru_detach =           udp_detach,
220 	.pru_disconnect =       udp_disconnect,
221 	.pru_disconnectx =      udp_disconnectx,
222 	.pru_peeraddr =         in_getpeeraddr,
223 	.pru_send =             udp_send,
224 	.pru_shutdown =         udp_shutdown,
225 	.pru_sockaddr =         in_getsockaddr,
226 	.pru_sosend =           sosend,
227 	.pru_soreceive =        soreceive,
228 	.pru_soreceive_list =   soreceive_list,
229 };
230 
231 void
udp_init(struct protosw * pp,struct domain * dp)232 udp_init(struct protosw *pp, struct domain *dp)
233 {
234 #pragma unused(dp)
235 	static int udp_initialized = 0;
236 	struct inpcbinfo        *pcbinfo;
237 
238 	VERIFY((pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
239 
240 	if (udp_initialized) {
241 		return;
242 	}
243 	udp_initialized = 1;
244 	uint32_t pool_size = (nmbclusters << MCLSHIFT) >> MBSHIFT;
245 	if (pool_size >= 96) {
246 		/* Improves 10GbE UDP performance. */
247 		udp_recvspace = 786896;
248 	}
249 	LIST_INIT(&udb);
250 	udbinfo.ipi_listhead = &udb;
251 	udbinfo.ipi_hashbase = hashinit(UDBHASHSIZE, M_PCB,
252 	    &udbinfo.ipi_hashmask);
253 	udbinfo.ipi_porthashbase = hashinit(UDBHASHSIZE, M_PCB,
254 	    &udbinfo.ipi_porthashmask);
255 	udbinfo.ipi_zone = zone_create("udpcb", sizeof(struct inpcb), ZC_NONE);
256 
257 	pcbinfo = &udbinfo;
258 	/*
259 	 * allocate lock group and attribute for udp pcb mutexes
260 	 */
261 	pcbinfo->ipi_lock_grp = lck_grp_alloc_init("udppcb",
262 	    LCK_GRP_ATTR_NULL);
263 	lck_attr_setdefault(&pcbinfo->ipi_lock_attr);
264 	lck_rw_init(&pcbinfo->ipi_lock, pcbinfo->ipi_lock_grp,
265 	    &pcbinfo->ipi_lock_attr);
266 
267 	udbinfo.ipi_gc = udp_gc;
268 	in_pcbinfo_attach(&udbinfo);
269 }
270 
271 void
udp_input(struct mbuf * m,int iphlen)272 udp_input(struct mbuf *m, int iphlen)
273 {
274 	struct ip *ip;
275 	struct udphdr *uh;
276 	struct inpcb *inp;
277 	struct mbuf *opts = NULL;
278 	int len, isbroadcast;
279 	struct ip save_ip;
280 	struct sockaddr *append_sa;
281 	struct inpcbinfo *pcbinfo = &udbinfo;
282 	struct sockaddr_in udp_in;
283 	struct ip_moptions *imo = NULL;
284 	int foundmembership = 0, ret = 0;
285 	struct udp_in6 udp_in6;
286 	struct udp_ip6 udp_ip6;
287 	struct ifnet *ifp = m->m_pkthdr.rcvif;
288 	boolean_t cell = IFNET_IS_CELLULAR(ifp);
289 	boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
290 	boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
291 	u_int16_t pf_tag = 0;
292 	boolean_t is_wake_pkt = false;
293 
294 	bzero(&udp_in, sizeof(udp_in));
295 	udp_in.sin_len = sizeof(struct sockaddr_in);
296 	udp_in.sin_family = AF_INET;
297 	bzero(&udp_in6, sizeof(udp_in6));
298 	udp_in6.uin6_sin.sin6_len = sizeof(struct sockaddr_in6);
299 	udp_in6.uin6_sin.sin6_family = AF_INET6;
300 
301 	if (m->m_flags & M_PKTHDR) {
302 		pf_tag = m_pftag(m)->pftag_tag;
303 		if (m->m_pkthdr.pkt_flags & PKTF_WAKE_PKT) {
304 			is_wake_pkt = true;
305 		}
306 	}
307 
308 	udpstat.udps_ipackets++;
309 
310 	KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
311 
312 	/* Expect 32-bit aligned data pointer on strict-align platforms */
313 	MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
314 
315 	m_add_crumb(m, PKT_CRUMB_UDP_INPUT);
316 
317 	/*
318 	 * Strip IP options, if any; should skip this,
319 	 * make available to user, and use on returned packets,
320 	 * but we don't yet have a way to check the checksum
321 	 * with options still present.
322 	 */
323 	if (iphlen > sizeof(struct ip)) {
324 		ip_stripoptions(m);
325 		iphlen = sizeof(struct ip);
326 	}
327 
328 	/*
329 	 * Get IP and UDP header together in first mbuf.
330 	 */
331 	ip = mtod(m, struct ip *);
332 	if (m->m_len < iphlen + sizeof(struct udphdr)) {
333 		m = m_pullup(m, iphlen + sizeof(struct udphdr));
334 		if (m == NULL) {
335 			udpstat.udps_hdrops++;
336 			KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
337 			    0, 0, 0, 0, 0);
338 			return;
339 		}
340 		ip = mtod(m, struct ip *);
341 	}
342 	uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
343 
344 	/* destination port of 0 is illegal, based on RFC768. */
345 	if (uh->uh_dport == 0) {
346 		IF_UDP_STATINC(ifp, port0);
347 		goto bad;
348 	}
349 
350 	KERNEL_DEBUG(DBG_LAYER_IN_BEG, uh->uh_dport, uh->uh_sport,
351 	    ip->ip_src.s_addr, ip->ip_dst.s_addr, uh->uh_ulen);
352 
353 	/*
354 	 * Make mbuf data length reflect UDP length.
355 	 * If not enough data to reflect UDP length, drop.
356 	 */
357 	len = ntohs((u_short)uh->uh_ulen);
358 	if (ip->ip_len != len) {
359 		if (len > ip->ip_len || len < sizeof(struct udphdr)) {
360 			udpstat.udps_badlen++;
361 			IF_UDP_STATINC(ifp, badlength);
362 			goto bad;
363 		}
364 		m_adj(m, len - ip->ip_len);
365 		/* ip->ip_len = len; */
366 	}
367 	/*
368 	 * Save a copy of the IP header in case we want restore it
369 	 * for sending an ICMP error message in response.
370 	 */
371 	save_ip = *ip;
372 
373 	/*
374 	 * Checksum extended UDP header and data.
375 	 */
376 	if (udp_input_checksum(m, uh, iphlen, len)) {
377 		goto bad;
378 	}
379 
380 	isbroadcast = in_broadcast(ip->ip_dst, ifp);
381 
382 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || isbroadcast) {
383 		int reuse_sock = 0, mcast_delivered = 0;
384 
385 		lck_rw_lock_shared(&pcbinfo->ipi_lock);
386 		/*
387 		 * Deliver a multicast or broadcast datagram to *all* sockets
388 		 * for which the local and remote addresses and ports match
389 		 * those of the incoming datagram.  This allows more than
390 		 * one process to receive multi/broadcasts on the same port.
391 		 * (This really ought to be done for unicast datagrams as
392 		 * well, but that would cause problems with existing
393 		 * applications that open both address-specific sockets and
394 		 * a wildcard socket listening to the same port -- they would
395 		 * end up receiving duplicates of every unicast datagram.
396 		 * Those applications open the multiple sockets to overcome an
397 		 * inadequacy of the UDP socket interface, but for backwards
398 		 * compatibility we avoid the problem here rather than
399 		 * fixing the interface.  Maybe 4.5BSD will remedy this?)
400 		 */
401 
402 		/*
403 		 * Construct sockaddr format source address.
404 		 */
405 		udp_in.sin_port = uh->uh_sport;
406 		udp_in.sin_addr = ip->ip_src;
407 		/*
408 		 * Locate pcb(s) for datagram.
409 		 * (Algorithm copied from raw_intr().)
410 		 */
411 		udp_in6.uin6_init_done = udp_ip6.uip6_init_done = 0;
412 		LIST_FOREACH(inp, &udb, inp_list) {
413 #if IPSEC
414 			int skipit;
415 #endif /* IPSEC */
416 
417 			if (inp->inp_socket == NULL) {
418 				continue;
419 			}
420 			if (inp != sotoinpcb(inp->inp_socket)) {
421 				panic("%s: bad so back ptr inp=%p",
422 				    __func__, inp);
423 				/* NOTREACHED */
424 			}
425 			if ((inp->inp_vflag & INP_IPV4) == 0) {
426 				continue;
427 			}
428 			if (inp_restricted_recv(inp, ifp)) {
429 				continue;
430 			}
431 
432 			if ((inp->inp_moptions == NULL) &&
433 			    (ntohl(ip->ip_dst.s_addr) !=
434 			    INADDR_ALLHOSTS_GROUP) && (isbroadcast == 0)) {
435 				continue;
436 			}
437 			/*
438 			 * Skip unbound sockets before taking the lock on the socket as
439 			 * the test with the destination port in the header will fail
440 			 */
441 			if (inp->inp_lport == 0) {
442 				continue;
443 			}
444 
445 			if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) ==
446 			    WNT_STOPUSING) {
447 				continue;
448 			}
449 
450 			udp_lock(inp->inp_socket, 1, 0);
451 
452 			if (in_pcb_checkstate(inp, WNT_RELEASE, 1) ==
453 			    WNT_STOPUSING) {
454 				udp_unlock(inp->inp_socket, 1, 0);
455 				continue;
456 			}
457 
458 			if (inp->inp_lport != uh->uh_dport) {
459 				udp_unlock(inp->inp_socket, 1, 0);
460 				continue;
461 			}
462 			if (inp->inp_laddr.s_addr != INADDR_ANY) {
463 				if (inp->inp_laddr.s_addr !=
464 				    ip->ip_dst.s_addr) {
465 					udp_unlock(inp->inp_socket, 1, 0);
466 					continue;
467 				}
468 			}
469 			if (inp->inp_faddr.s_addr != INADDR_ANY) {
470 				if (inp->inp_faddr.s_addr !=
471 				    ip->ip_src.s_addr ||
472 				    inp->inp_fport != uh->uh_sport) {
473 					udp_unlock(inp->inp_socket, 1, 0);
474 					continue;
475 				}
476 			}
477 
478 			if (isbroadcast == 0 && (ntohl(ip->ip_dst.s_addr) !=
479 			    INADDR_ALLHOSTS_GROUP)) {
480 				struct sockaddr_in group;
481 				int blocked;
482 
483 				if ((imo = inp->inp_moptions) == NULL) {
484 					udp_unlock(inp->inp_socket, 1, 0);
485 					continue;
486 				}
487 				IMO_LOCK(imo);
488 
489 				bzero(&group, sizeof(struct sockaddr_in));
490 				group.sin_len = sizeof(struct sockaddr_in);
491 				group.sin_family = AF_INET;
492 				group.sin_addr = ip->ip_dst;
493 
494 				blocked = imo_multi_filter(imo, ifp,
495 				    &group, &udp_in);
496 				if (blocked == MCAST_PASS) {
497 					foundmembership = 1;
498 				}
499 
500 				IMO_UNLOCK(imo);
501 				if (!foundmembership) {
502 					udp_unlock(inp->inp_socket, 1, 0);
503 					if (blocked == MCAST_NOTSMEMBER ||
504 					    blocked == MCAST_MUTED) {
505 						udpstat.udps_filtermcast++;
506 					}
507 					continue;
508 				}
509 				foundmembership = 0;
510 			}
511 
512 			reuse_sock = (inp->inp_socket->so_options &
513 			    (SO_REUSEPORT | SO_REUSEADDR));
514 
515 #if NECP
516 			skipit = 0;
517 			if (!necp_socket_is_allowed_to_send_recv_v4(inp,
518 			    uh->uh_dport, uh->uh_sport, &ip->ip_dst,
519 			    &ip->ip_src, ifp, pf_tag, NULL, NULL, NULL, NULL)) {
520 				/* do not inject data to pcb */
521 				skipit = 1;
522 			}
523 			if (skipit == 0)
524 #endif /* NECP */
525 			{
526 				struct mbuf *n = NULL;
527 
528 				if (reuse_sock) {
529 					n = m_copy(m, 0, M_COPYALL);
530 				}
531 				udp_append(inp, ip, m,
532 				    iphlen + sizeof(struct udphdr),
533 				    &udp_in, &udp_in6, &udp_ip6, ifp);
534 				mcast_delivered++;
535 
536 				m = n;
537 			}
538 			if (is_wake_pkt) {
539 				soevent(inp->inp_socket, SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
540 			}
541 
542 			udp_unlock(inp->inp_socket, 1, 0);
543 
544 
545 			/*
546 			 * Don't look for additional matches if this one does
547 			 * not have either the SO_REUSEPORT or SO_REUSEADDR
548 			 * socket options set.  This heuristic avoids searching
549 			 * through all pcbs in the common case of a non-shared
550 			 * port.  It assumes that an application will never
551 			 * clear these options after setting them.
552 			 */
553 			if (reuse_sock == 0 || m == NULL) {
554 				break;
555 			}
556 
557 			/*
558 			 * Expect 32-bit aligned data pointer on strict-align
559 			 * platforms.
560 			 */
561 			MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
562 			/*
563 			 * Recompute IP and UDP header pointers for new mbuf
564 			 */
565 			ip = mtod(m, struct ip *);
566 			uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
567 		}
568 		lck_rw_done(&pcbinfo->ipi_lock);
569 
570 		if (mcast_delivered == 0) {
571 			/*
572 			 * No matching pcb found; discard datagram.
573 			 * (No need to send an ICMP Port Unreachable
574 			 * for a broadcast or multicast datgram.)
575 			 */
576 			udpstat.udps_noportbcast++;
577 			IF_UDP_STATINC(ifp, port_unreach);
578 			goto bad;
579 		}
580 
581 		/* free the extra copy of mbuf or skipped by IPsec */
582 		if (m != NULL) {
583 			m_freem(m);
584 		}
585 		KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
586 		return;
587 	}
588 
589 #if IPSEC
590 	/*
591 	 * UDP to port 4500 with a payload where the first four bytes are
592 	 * not zero is a UDP encapsulated IPsec packet. Packets where
593 	 * the payload is one byte and that byte is 0xFF are NAT keepalive
594 	 * packets. Decapsulate the ESP packet and carry on with IPsec input
595 	 * or discard the NAT keep-alive.
596 	 */
597 	if (ipsec_bypass == 0 && (esp_udp_encap_port & 0xFFFF) != 0 &&
598 	    (uh->uh_dport == ntohs((u_short)esp_udp_encap_port) ||
599 	    uh->uh_sport == ntohs((u_short)esp_udp_encap_port))) {
600 		/*
601 		 * Check if ESP or keepalive:
602 		 *      1. If the destination port of the incoming packet is 4500.
603 		 *      2. If the source port of the incoming packet is 4500,
604 		 *         then check the SADB to match IP address and port.
605 		 */
606 		bool check_esp = true;
607 		if (uh->uh_dport != ntohs((u_short)esp_udp_encap_port)) {
608 			check_esp = key_checksa_present(AF_INET, (caddr_t)&ip->ip_dst,
609 			    (caddr_t)&ip->ip_src, uh->uh_dport,
610 			    uh->uh_sport, IFSCOPE_NONE, IFSCOPE_NONE);
611 		}
612 
613 		if (check_esp) {
614 			int payload_len = len - sizeof(struct udphdr) > 4 ? 4 :
615 			    len - sizeof(struct udphdr);
616 
617 			if (m->m_len < iphlen + sizeof(struct udphdr) + payload_len) {
618 				if ((m = m_pullup(m, iphlen + sizeof(struct udphdr) +
619 				    payload_len)) == NULL) {
620 					udpstat.udps_hdrops++;
621 					KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
622 					    0, 0, 0, 0, 0);
623 					return;
624 				}
625 				/*
626 				 * Expect 32-bit aligned data pointer on strict-align
627 				 * platforms.
628 				 */
629 				MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
630 
631 				ip = mtod(m, struct ip *);
632 				uh = (struct udphdr *)(void *)((caddr_t)ip + iphlen);
633 			}
634 			/* Check for NAT keepalive packet */
635 			if (payload_len == 1 && *(u_int8_t *)
636 			    ((caddr_t)uh + sizeof(struct udphdr)) == 0xFF) {
637 				m_freem(m);
638 				KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
639 				    0, 0, 0, 0, 0);
640 				return;
641 			} else if (payload_len == 4 && *(u_int32_t *)(void *)
642 			    ((caddr_t)uh + sizeof(struct udphdr)) != 0) {
643 				/* UDP encapsulated IPsec packet to pass through NAT */
644 				KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END,
645 				    0, 0, 0, 0, 0);
646 				/* preserve the udp header */
647 				esp4_input(m, iphlen + sizeof(struct udphdr));
648 				return;
649 			}
650 		}
651 	}
652 #endif /* IPSEC */
653 
654 	/*
655 	 * Locate pcb for datagram.
656 	 */
657 	inp = in_pcblookup_hash(&udbinfo, ip->ip_src, uh->uh_sport,
658 	    ip->ip_dst, uh->uh_dport, 1, ifp);
659 	if (inp == NULL) {
660 		IF_UDP_STATINC(ifp, port_unreach);
661 
662 		if (udp_log_in_vain) {
663 			char buf[MAX_IPv4_STR_LEN];
664 			char buf2[MAX_IPv4_STR_LEN];
665 
666 			/* check src and dst address */
667 			if (udp_log_in_vain < 3) {
668 				log(LOG_INFO, "Connection attempt to "
669 				    "UDP %s:%d from %s:%d\n", inet_ntop(AF_INET,
670 				    &ip->ip_dst, buf, sizeof(buf)),
671 				    ntohs(uh->uh_dport), inet_ntop(AF_INET,
672 				    &ip->ip_src, buf2, sizeof(buf2)),
673 				    ntohs(uh->uh_sport));
674 			} else if (!(m->m_flags & (M_BCAST | M_MCAST)) &&
675 			    ip->ip_dst.s_addr != ip->ip_src.s_addr) {
676 				log_in_vain_log((LOG_INFO,
677 				    "Stealth Mode connection attempt to "
678 				    "UDP %s:%d from %s:%d\n", inet_ntop(AF_INET,
679 				    &ip->ip_dst, buf, sizeof(buf)),
680 				    ntohs(uh->uh_dport), inet_ntop(AF_INET,
681 				    &ip->ip_src, buf2, sizeof(buf2)),
682 				    ntohs(uh->uh_sport)))
683 			}
684 		}
685 		udpstat.udps_noport++;
686 		if (m->m_flags & (M_BCAST | M_MCAST)) {
687 			udpstat.udps_noportbcast++;
688 			goto bad;
689 		}
690 		if (blackhole) {
691 			if (ifp && ifp->if_type != IFT_LOOP) {
692 				goto bad;
693 			}
694 		}
695 		*ip = save_ip;
696 		ip->ip_len += iphlen;
697 		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
698 		KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
699 		return;
700 	}
701 	udp_lock(inp->inp_socket, 1, 0);
702 
703 	if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
704 		udp_unlock(inp->inp_socket, 1, 0);
705 		IF_UDP_STATINC(ifp, cleanup);
706 		goto bad;
707 	}
708 #if NECP
709 	if (!necp_socket_is_allowed_to_send_recv_v4(inp, uh->uh_dport,
710 	    uh->uh_sport, &ip->ip_dst, &ip->ip_src, ifp, pf_tag, NULL, NULL, NULL, NULL)) {
711 		udp_unlock(inp->inp_socket, 1, 0);
712 		IF_UDP_STATINC(ifp, badipsec);
713 		goto bad;
714 	}
715 #endif /* NECP */
716 
717 	/*
718 	 * Construct sockaddr format source address.
719 	 * Stuff source address and datagram in user buffer.
720 	 */
721 	udp_in.sin_port = uh->uh_sport;
722 	udp_in.sin_addr = ip->ip_src;
723 	if ((inp->inp_flags & INP_CONTROLOPTS) != 0 ||
724 	    SOFLOW_ENABLED(inp->inp_socket) ||
725 	    SO_RECV_CONTROL_OPTS(inp->inp_socket)) {
726 		if (inp->inp_vflag & INP_IPV6 || inp->inp_vflag & INP_V4MAPPEDV6) {
727 			int savedflags;
728 
729 			ip_2_ip6_hdr(&udp_ip6.uip6_ip6, ip);
730 			savedflags = inp->inp_flags;
731 			inp->inp_flags &= ~INP_UNMAPPABLEOPTS;
732 			ret = ip6_savecontrol(inp, m, &opts);
733 			inp->inp_flags = savedflags;
734 		} else {
735 			ret = ip_savecontrol(inp, &opts, ip, m);
736 		}
737 		if (ret != 0) {
738 			udp_unlock(inp->inp_socket, 1, 0);
739 			goto bad;
740 		}
741 	}
742 	m_adj(m, iphlen + sizeof(struct udphdr));
743 
744 	KERNEL_DEBUG(DBG_LAYER_IN_END, uh->uh_dport, uh->uh_sport,
745 	    save_ip.ip_src.s_addr, save_ip.ip_dst.s_addr, uh->uh_ulen);
746 
747 	if (inp->inp_vflag & INP_IPV6) {
748 		in6_sin_2_v4mapsin6(&udp_in, &udp_in6.uin6_sin);
749 		append_sa = (struct sockaddr *)&udp_in6.uin6_sin;
750 	} else {
751 		append_sa = (struct sockaddr *)&udp_in;
752 	}
753 	if (nstat_collect) {
754 		INP_ADD_STAT(inp, cell, wifi, wired, rxpackets, 1);
755 		INP_ADD_STAT(inp, cell, wifi, wired, rxbytes, m->m_pkthdr.len);
756 		inp_set_activity_bitmap(inp);
757 	}
758 	so_recv_data_stat(inp->inp_socket, m, 0);
759 	if (sbappendaddr(&inp->inp_socket->so_rcv, append_sa,
760 	    m, opts, NULL) == 0) {
761 		udpstat.udps_fullsock++;
762 	} else {
763 		sorwakeup(inp->inp_socket);
764 	}
765 	if (is_wake_pkt) {
766 		soevent(inp->inp_socket, SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
767 	}
768 	udp_unlock(inp->inp_socket, 1, 0);
769 	KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
770 	return;
771 bad:
772 	m_freem(m);
773 	if (opts) {
774 		m_freem(opts);
775 	}
776 	KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0, 0, 0, 0, 0);
777 }
778 
779 static void
ip_2_ip6_hdr(struct ip6_hdr * ip6,struct ip * ip)780 ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip)
781 {
782 	bzero(ip6, sizeof(*ip6));
783 
784 	ip6->ip6_vfc = IPV6_VERSION;
785 	ip6->ip6_plen = ip->ip_len;
786 	ip6->ip6_nxt = ip->ip_p;
787 	ip6->ip6_hlim = ip->ip_ttl;
788 	if (ip->ip_src.s_addr) {
789 		ip6->ip6_src.s6_addr32[2] = IPV6_ADDR_INT32_SMP;
790 		ip6->ip6_src.s6_addr32[3] = ip->ip_src.s_addr;
791 	}
792 	if (ip->ip_dst.s_addr) {
793 		ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_SMP;
794 		ip6->ip6_dst.s6_addr32[3] = ip->ip_dst.s_addr;
795 	}
796 }
797 
798 /*
799  * subroutine of udp_input(), mainly for source code readability.
800  */
801 static void
udp_append(struct inpcb * last,struct ip * ip,struct mbuf * n,int off,struct sockaddr_in * pudp_in,struct udp_in6 * pudp_in6,struct udp_ip6 * pudp_ip6,struct ifnet * ifp)802 udp_append(struct inpcb *last, struct ip *ip, struct mbuf *n, int off,
803     struct sockaddr_in *pudp_in, struct udp_in6 *pudp_in6,
804     struct udp_ip6 *pudp_ip6, struct ifnet *ifp)
805 {
806 	struct sockaddr *append_sa;
807 	struct mbuf *opts = 0;
808 	boolean_t cell = IFNET_IS_CELLULAR(ifp);
809 	boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
810 	boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
811 	int ret = 0;
812 
813 	if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
814 	    SOFLOW_ENABLED(last->inp_socket) ||
815 	    SO_RECV_CONTROL_OPTS(last->inp_socket)) {
816 		if (last->inp_vflag & INP_IPV6 || last->inp_vflag & INP_V4MAPPEDV6) {
817 			int savedflags;
818 
819 			if (pudp_ip6->uip6_init_done == 0) {
820 				ip_2_ip6_hdr(&pudp_ip6->uip6_ip6, ip);
821 				pudp_ip6->uip6_init_done = 1;
822 			}
823 			savedflags = last->inp_flags;
824 			last->inp_flags &= ~INP_UNMAPPABLEOPTS;
825 			ret = ip6_savecontrol(last, n, &opts);
826 			if (ret != 0) {
827 				last->inp_flags = savedflags;
828 				goto error;
829 			}
830 			last->inp_flags = savedflags;
831 		} else {
832 			ret = ip_savecontrol(last, &opts, ip, n);
833 			if (ret != 0) {
834 				goto error;
835 			}
836 		}
837 	}
838 	if (last->inp_vflag & INP_IPV6) {
839 		if (pudp_in6->uin6_init_done == 0) {
840 			in6_sin_2_v4mapsin6(pudp_in, &pudp_in6->uin6_sin);
841 			pudp_in6->uin6_init_done = 1;
842 		}
843 		append_sa = (struct sockaddr *)&pudp_in6->uin6_sin;
844 	} else {
845 		append_sa = (struct sockaddr *)pudp_in;
846 	}
847 	if (nstat_collect) {
848 		INP_ADD_STAT(last, cell, wifi, wired, rxpackets, 1);
849 		INP_ADD_STAT(last, cell, wifi, wired, rxbytes,
850 		    n->m_pkthdr.len);
851 		inp_set_activity_bitmap(last);
852 	}
853 	so_recv_data_stat(last->inp_socket, n, 0);
854 	m_adj(n, off);
855 	if (sbappendaddr(&last->inp_socket->so_rcv, append_sa,
856 	    n, opts, NULL) == 0) {
857 		udpstat.udps_fullsock++;
858 	} else {
859 		sorwakeup(last->inp_socket);
860 	}
861 	return;
862 error:
863 	m_freem(n);
864 	m_freem(opts);
865 }
866 
867 /*
868  * Notify a udp user of an asynchronous error;
869  * just wake up so that he can collect error status.
870  */
871 void
udp_notify(struct inpcb * inp,int errno)872 udp_notify(struct inpcb *inp, int errno)
873 {
874 	inp->inp_socket->so_error = (u_short)errno;
875 	sorwakeup(inp->inp_socket);
876 	sowwakeup(inp->inp_socket);
877 }
878 
879 void
udp_ctlinput(int cmd,struct sockaddr * sa,void * vip,__unused struct ifnet * ifp)880 udp_ctlinput(int cmd, struct sockaddr *sa, void *vip, __unused struct ifnet * ifp)
881 {
882 	struct ipctlparam *ctl_param = vip;
883 	struct ip *ip = NULL;
884 	struct mbuf *m = NULL;
885 	void (*notify)(struct inpcb *, int) = udp_notify;
886 	struct in_addr faddr;
887 	struct inpcb *inp = NULL;
888 	struct icmp *icp = NULL;
889 	size_t off;
890 
891 	if (ctl_param != NULL) {
892 		ip = ctl_param->ipc_icmp_ip;
893 		icp = ctl_param->ipc_icmp;
894 		m = ctl_param->ipc_m;
895 		off = ctl_param->ipc_off;
896 	} else {
897 		ip = NULL;
898 		icp = NULL;
899 		m = NULL;
900 		off = 0;
901 	}
902 
903 	faddr = ((struct sockaddr_in *)(void *)sa)->sin_addr;
904 	if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY) {
905 		return;
906 	}
907 
908 	if (PRC_IS_REDIRECT(cmd)) {
909 		ip = 0;
910 		notify = in_rtchange;
911 	} else if (cmd == PRC_HOSTDEAD) {
912 		ip = 0;
913 	} else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0) {
914 		return;
915 	}
916 	if (ip) {
917 		struct udphdr uh;
918 
919 		/* Check if we can safely get the ports from the UDP header */
920 		if (m == NULL ||
921 		    (m->m_len < off + sizeof(uh))) {
922 			/* Insufficient length */
923 			return;
924 		}
925 
926 		bcopy(m->m_data + off, &uh, sizeof(uh));
927 		inp = in_pcblookup_hash(&udbinfo, faddr, uh.uh_dport,
928 		    ip->ip_src, uh.uh_sport, 0, NULL);
929 
930 		if (inp != NULL && inp->inp_socket != NULL) {
931 			udp_lock(inp->inp_socket, 1, 0);
932 			if (in_pcb_checkstate(inp, WNT_RELEASE, 1) ==
933 			    WNT_STOPUSING) {
934 				udp_unlock(inp->inp_socket, 1, 0);
935 				return;
936 			}
937 			if (cmd == PRC_MSGSIZE && !uuid_is_null(inp->necp_client_uuid)) {
938 				uuid_t null_uuid;
939 				uuid_clear(null_uuid);
940 				necp_update_flow_protoctl_event(null_uuid, inp->necp_client_uuid,
941 				    PRC_MSGSIZE, ntohs(icp->icmp_nextmtu), 0);
942 				/*
943 				 * Avoid calling udp_notify() to set so_error
944 				 * when using Network.framework since the notification
945 				 * of PRC_MSGSIZE has been delivered through NECP.
946 				 */
947 			} else {
948 				(*notify)(inp, inetctlerrmap[cmd]);
949 			}
950 			udp_unlock(inp->inp_socket, 1, 0);
951 		}
952 #if SKYWALK
953 		else {
954 			union sockaddr_in_4_6 sock_laddr;
955 			struct protoctl_ev_val prctl_ev_val;
956 			bzero(&prctl_ev_val, sizeof(prctl_ev_val));
957 			bzero(&sock_laddr, sizeof(sock_laddr));
958 
959 			if (cmd == PRC_MSGSIZE) {
960 				prctl_ev_val.val = ntohs(icp->icmp_nextmtu);
961 			}
962 
963 			sock_laddr.sin.sin_family = AF_INET;
964 			sock_laddr.sin.sin_len = sizeof(sock_laddr.sin);
965 			sock_laddr.sin.sin_addr = ip->ip_src;
966 
967 			protoctl_event_enqueue_nwk_wq_entry(ifp,
968 			    (struct sockaddr *)&sock_laddr, sa,
969 			    uh.uh_sport, uh.uh_dport, IPPROTO_UDP,
970 			    cmd, &prctl_ev_val);
971 		}
972 #endif /* SKYWALK */
973 	} else {
974 		in_pcbnotifyall(&udbinfo, faddr, inetctlerrmap[cmd], notify);
975 	}
976 }
977 
978 int
udp_ctloutput(struct socket * so,struct sockopt * sopt)979 udp_ctloutput(struct socket *so, struct sockopt *sopt)
980 {
981 	int     error = 0, optval = 0;
982 	struct  inpcb *inp;
983 
984 	/* Allow <SOL_SOCKET,SO_FLUSH> at this level */
985 	if (sopt->sopt_level != IPPROTO_UDP &&
986 	    !(sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_FLUSH)) {
987 		if (SOCK_CHECK_DOM(so, PF_INET6)) {
988 			error = ip6_ctloutput(so, sopt);
989 		} else {
990 			error = ip_ctloutput(so, sopt);
991 		}
992 		return error;
993 	}
994 
995 	inp = sotoinpcb(so);
996 
997 	switch (sopt->sopt_dir) {
998 	case SOPT_SET:
999 		switch (sopt->sopt_name) {
1000 		case UDP_NOCKSUM:
1001 			/* This option is settable only for UDP over IPv4 */
1002 			if (!(inp->inp_vflag & INP_IPV4)) {
1003 				error = EINVAL;
1004 				break;
1005 			}
1006 
1007 			if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
1008 			    sizeof(optval))) != 0) {
1009 				break;
1010 			}
1011 
1012 			if (optval != 0) {
1013 				inp->inp_flags |= INP_UDP_NOCKSUM;
1014 			} else {
1015 				inp->inp_flags &= ~INP_UDP_NOCKSUM;
1016 			}
1017 			break;
1018 		case UDP_KEEPALIVE_OFFLOAD:
1019 		{
1020 			struct udp_keepalive_offload ka;
1021 			/*
1022 			 * If the socket is not connected, the stack will
1023 			 * not know the destination address to put in the
1024 			 * keepalive datagram. Return an error now instead
1025 			 * of failing later.
1026 			 */
1027 			if (!(so->so_state & SS_ISCONNECTED)) {
1028 				error = EINVAL;
1029 				break;
1030 			}
1031 			if (sopt->sopt_valsize != sizeof(ka)) {
1032 				error = EINVAL;
1033 				break;
1034 			}
1035 			if ((error = sooptcopyin(sopt, &ka, sizeof(ka),
1036 			    sizeof(ka))) != 0) {
1037 				break;
1038 			}
1039 
1040 			/* application should specify the type */
1041 			if (ka.ka_type == 0) {
1042 				return EINVAL;
1043 			}
1044 
1045 			if (ka.ka_interval == 0) {
1046 				/*
1047 				 * if interval is 0, disable the offload
1048 				 * mechanism
1049 				 */
1050 				if (inp->inp_keepalive_data != NULL) {
1051 					kfree_data(inp->inp_keepalive_data,
1052 					    inp->inp_keepalive_datalen);
1053 				}
1054 				inp->inp_keepalive_data = NULL;
1055 				inp->inp_keepalive_datalen = 0;
1056 				inp->inp_keepalive_interval = 0;
1057 				inp->inp_keepalive_type = 0;
1058 				inp->inp_flags2 &= ~INP2_KEEPALIVE_OFFLOAD;
1059 			} else {
1060 				if (inp->inp_keepalive_data != NULL) {
1061 					kfree_data(inp->inp_keepalive_data,
1062 					    inp->inp_keepalive_datalen);
1063 					inp->inp_keepalive_data = NULL;
1064 				}
1065 
1066 				inp->inp_keepalive_datalen = (uint8_t)min(
1067 					ka.ka_data_len,
1068 					UDP_KEEPALIVE_OFFLOAD_DATA_SIZE);
1069 				if (inp->inp_keepalive_datalen > 0) {
1070 					inp->inp_keepalive_data = (u_int8_t *)kalloc_data(
1071 						inp->inp_keepalive_datalen, Z_WAITOK);
1072 					if (inp->inp_keepalive_data == NULL) {
1073 						inp->inp_keepalive_datalen = 0;
1074 						error = ENOMEM;
1075 						break;
1076 					}
1077 					bcopy(ka.ka_data,
1078 					    inp->inp_keepalive_data,
1079 					    inp->inp_keepalive_datalen);
1080 				} else {
1081 					inp->inp_keepalive_datalen = 0;
1082 				}
1083 				inp->inp_keepalive_interval = (uint8_t)
1084 				    min(UDP_KEEPALIVE_INTERVAL_MAX_SECONDS,
1085 				    ka.ka_interval);
1086 				inp->inp_keepalive_type = ka.ka_type;
1087 				inp->inp_flags2 |= INP2_KEEPALIVE_OFFLOAD;
1088 			}
1089 			break;
1090 		}
1091 		case SO_FLUSH:
1092 			if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
1093 			    sizeof(optval))) != 0) {
1094 				break;
1095 			}
1096 
1097 			error = inp_flush(inp, optval);
1098 			break;
1099 
1100 		default:
1101 			error = ENOPROTOOPT;
1102 			break;
1103 		}
1104 		break;
1105 
1106 	case SOPT_GET:
1107 		switch (sopt->sopt_name) {
1108 		case UDP_NOCKSUM:
1109 			optval = inp->inp_flags & INP_UDP_NOCKSUM;
1110 			break;
1111 
1112 		default:
1113 			error = ENOPROTOOPT;
1114 			break;
1115 		}
1116 		if (error == 0) {
1117 			error = sooptcopyout(sopt, &optval, sizeof(optval));
1118 		}
1119 		break;
1120 	}
1121 	return error;
1122 }
1123 
1124 static int
1125 udp_pcblist SYSCTL_HANDLER_ARGS
1126 {
1127 #pragma unused(oidp, arg1, arg2)
1128 	int error, i, n, sz;
1129 	struct inpcb *inp, **inp_list;
1130 	inp_gen_t gencnt;
1131 	struct xinpgen xig;
1132 
1133 	/*
1134 	 * The process of preparing the TCB list is too time-consuming and
1135 	 * resource-intensive to repeat twice on every request.
1136 	 */
1137 	lck_rw_lock_exclusive(&udbinfo.ipi_lock);
1138 	if (req->oldptr == USER_ADDR_NULL) {
1139 		n = udbinfo.ipi_count;
1140 		req->oldidx = 2 * (sizeof(xig))
1141 		    + (n + n / 8) * sizeof(struct xinpcb);
1142 		lck_rw_done(&udbinfo.ipi_lock);
1143 		return 0;
1144 	}
1145 
1146 	if (req->newptr != USER_ADDR_NULL) {
1147 		lck_rw_done(&udbinfo.ipi_lock);
1148 		return EPERM;
1149 	}
1150 
1151 	/*
1152 	 * OK, now we're committed to doing something.
1153 	 */
1154 	gencnt = udbinfo.ipi_gencnt;
1155 	sz = n = udbinfo.ipi_count;
1156 
1157 	bzero(&xig, sizeof(xig));
1158 	xig.xig_len = sizeof(xig);
1159 	xig.xig_count = n;
1160 	xig.xig_gen = gencnt;
1161 	xig.xig_sogen = so_gencnt;
1162 	error = SYSCTL_OUT(req, &xig, sizeof(xig));
1163 	if (error) {
1164 		lck_rw_done(&udbinfo.ipi_lock);
1165 		return error;
1166 	}
1167 	/*
1168 	 * We are done if there is no pcb
1169 	 */
1170 	if (n == 0) {
1171 		lck_rw_done(&udbinfo.ipi_lock);
1172 		return 0;
1173 	}
1174 
1175 	inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1176 	if (inp_list == NULL) {
1177 		lck_rw_done(&udbinfo.ipi_lock);
1178 		return ENOMEM;
1179 	}
1180 
1181 	for (inp = LIST_FIRST(udbinfo.ipi_listhead), i = 0; inp && i < n;
1182 	    inp = LIST_NEXT(inp, inp_list)) {
1183 		if (inp->inp_gencnt <= gencnt &&
1184 		    inp->inp_state != INPCB_STATE_DEAD) {
1185 			inp_list[i++] = inp;
1186 		}
1187 	}
1188 	n = i;
1189 
1190 	error = 0;
1191 	for (i = 0; i < n; i++) {
1192 		struct xinpcb xi;
1193 
1194 		inp = inp_list[i];
1195 
1196 		if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING) {
1197 			continue;
1198 		}
1199 		udp_lock(inp->inp_socket, 1, 0);
1200 		if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
1201 			udp_unlock(inp->inp_socket, 1, 0);
1202 			continue;
1203 		}
1204 		if (inp->inp_gencnt > gencnt) {
1205 			udp_unlock(inp->inp_socket, 1, 0);
1206 			continue;
1207 		}
1208 
1209 		bzero(&xi, sizeof(xi));
1210 		xi.xi_len = sizeof(xi);
1211 		/* XXX should avoid extra copy */
1212 		inpcb_to_compat(inp, &xi.xi_inp);
1213 		if (inp->inp_socket) {
1214 			sotoxsocket(inp->inp_socket, &xi.xi_socket);
1215 		}
1216 
1217 		udp_unlock(inp->inp_socket, 1, 0);
1218 
1219 		error = SYSCTL_OUT(req, &xi, sizeof(xi));
1220 	}
1221 	if (!error) {
1222 		/*
1223 		 * Give the user an updated idea of our state.
1224 		 * If the generation differs from what we told
1225 		 * her before, she knows that something happened
1226 		 * while we were processing this request, and it
1227 		 * might be necessary to retry.
1228 		 */
1229 		bzero(&xig, sizeof(xig));
1230 		xig.xig_len = sizeof(xig);
1231 		xig.xig_gen = udbinfo.ipi_gencnt;
1232 		xig.xig_sogen = so_gencnt;
1233 		xig.xig_count = udbinfo.ipi_count;
1234 		error = SYSCTL_OUT(req, &xig, sizeof(xig));
1235 	}
1236 
1237 	lck_rw_done(&udbinfo.ipi_lock);
1238 	kfree_type(struct inpcb *, sz, inp_list);
1239 	return error;
1240 }
1241 
1242 SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist,
1243     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist,
1244     "S,xinpcb", "List of active UDP sockets");
1245 
1246 #if XNU_TARGET_OS_OSX
1247 
1248 static int
1249 udp_pcblist64 SYSCTL_HANDLER_ARGS
1250 {
1251 #pragma unused(oidp, arg1, arg2)
1252 	int error, i, n, sz;
1253 	struct inpcb *inp, **inp_list;
1254 	inp_gen_t gencnt;
1255 	struct xinpgen xig;
1256 
1257 	/*
1258 	 * The process of preparing the TCB list is too time-consuming and
1259 	 * resource-intensive to repeat twice on every request.
1260 	 */
1261 	lck_rw_lock_shared(&udbinfo.ipi_lock);
1262 	if (req->oldptr == USER_ADDR_NULL) {
1263 		n = udbinfo.ipi_count;
1264 		req->oldidx =
1265 		    2 * (sizeof(xig)) + (n + n / 8) * sizeof(struct xinpcb64);
1266 		lck_rw_done(&udbinfo.ipi_lock);
1267 		return 0;
1268 	}
1269 
1270 	if (req->newptr != USER_ADDR_NULL) {
1271 		lck_rw_done(&udbinfo.ipi_lock);
1272 		return EPERM;
1273 	}
1274 
1275 	/*
1276 	 * OK, now we're committed to doing something.
1277 	 */
1278 	gencnt = udbinfo.ipi_gencnt;
1279 	sz = n = udbinfo.ipi_count;
1280 
1281 	bzero(&xig, sizeof(xig));
1282 	xig.xig_len = sizeof(xig);
1283 	xig.xig_count = n;
1284 	xig.xig_gen = gencnt;
1285 	xig.xig_sogen = so_gencnt;
1286 	error = SYSCTL_OUT(req, &xig, sizeof(xig));
1287 	if (error) {
1288 		lck_rw_done(&udbinfo.ipi_lock);
1289 		return error;
1290 	}
1291 	/*
1292 	 * We are done if there is no pcb
1293 	 */
1294 	if (n == 0) {
1295 		lck_rw_done(&udbinfo.ipi_lock);
1296 		return 0;
1297 	}
1298 
1299 	inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1300 	if (inp_list == NULL) {
1301 		lck_rw_done(&udbinfo.ipi_lock);
1302 		return ENOMEM;
1303 	}
1304 
1305 	for (inp = LIST_FIRST(udbinfo.ipi_listhead), i = 0; inp && i < n;
1306 	    inp = LIST_NEXT(inp, inp_list)) {
1307 		if (inp->inp_gencnt <= gencnt &&
1308 		    inp->inp_state != INPCB_STATE_DEAD) {
1309 			inp_list[i++] = inp;
1310 		}
1311 	}
1312 	n = i;
1313 
1314 	error = 0;
1315 	for (i = 0; i < n; i++) {
1316 		struct xinpcb64 xi;
1317 
1318 		inp = inp_list[i];
1319 
1320 		if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING) {
1321 			continue;
1322 		}
1323 		udp_lock(inp->inp_socket, 1, 0);
1324 		if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
1325 			udp_unlock(inp->inp_socket, 1, 0);
1326 			continue;
1327 		}
1328 		if (inp->inp_gencnt > gencnt) {
1329 			udp_unlock(inp->inp_socket, 1, 0);
1330 			continue;
1331 		}
1332 
1333 		bzero(&xi, sizeof(xi));
1334 		xi.xi_len = sizeof(xi);
1335 		inpcb_to_xinpcb64(inp, &xi);
1336 		if (inp->inp_socket) {
1337 			sotoxsocket64(inp->inp_socket, &xi.xi_socket);
1338 		}
1339 
1340 		udp_unlock(inp->inp_socket, 1, 0);
1341 
1342 		error = SYSCTL_OUT(req, &xi, sizeof(xi));
1343 	}
1344 	if (!error) {
1345 		/*
1346 		 * Give the user an updated idea of our state.
1347 		 * If the generation differs from what we told
1348 		 * her before, she knows that something happened
1349 		 * while we were processing this request, and it
1350 		 * might be necessary to retry.
1351 		 */
1352 		bzero(&xig, sizeof(xig));
1353 		xig.xig_len = sizeof(xig);
1354 		xig.xig_gen = udbinfo.ipi_gencnt;
1355 		xig.xig_sogen = so_gencnt;
1356 		xig.xig_count = udbinfo.ipi_count;
1357 		error = SYSCTL_OUT(req, &xig, sizeof(xig));
1358 	}
1359 
1360 	lck_rw_done(&udbinfo.ipi_lock);
1361 	kfree_type(struct inpcb *, sz, inp_list);
1362 	return error;
1363 }
1364 
1365 SYSCTL_PROC(_net_inet_udp, OID_AUTO, pcblist64,
1366     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist64,
1367     "S,xinpcb64", "List of active UDP sockets");
1368 
1369 #endif /* XNU_TARGET_OS_OSX */
1370 
1371 static int
1372 udp_pcblist_n SYSCTL_HANDLER_ARGS
1373 {
1374 #pragma unused(oidp, arg1, arg2)
1375 	return get_pcblist_n(IPPROTO_UDP, req, &udbinfo);
1376 }
1377 
1378 SYSCTL_PROC(_net_inet_udp, OID_AUTO, pcblist_n,
1379     CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, udp_pcblist_n,
1380     "S,xinpcb_n", "List of active UDP sockets");
1381 
1382 __private_extern__ void
udp_get_ports_used(ifnet_t ifp,int protocol,uint32_t flags,bitstr_t * bitfield)1383 udp_get_ports_used(ifnet_t ifp, int protocol, uint32_t flags,
1384     bitstr_t *bitfield)
1385 {
1386 	inpcb_get_ports_used(ifp, protocol, flags, bitfield,
1387 	    &udbinfo);
1388 }
1389 
1390 __private_extern__ uint32_t
udp_count_opportunistic(unsigned int ifindex,u_int32_t flags)1391 udp_count_opportunistic(unsigned int ifindex, u_int32_t flags)
1392 {
1393 	return inpcb_count_opportunistic(ifindex, &udbinfo, flags);
1394 }
1395 
1396 __private_extern__ uint32_t
udp_find_anypcb_byaddr(struct ifaddr * ifa)1397 udp_find_anypcb_byaddr(struct ifaddr *ifa)
1398 {
1399 #if SKYWALK
1400 	if (netns_is_enabled()) {
1401 		return netns_find_anyres_byaddr(ifa, IPPROTO_UDP);
1402 	} else
1403 #endif /* SKYWALK */
1404 	return inpcb_find_anypcb_byaddr(ifa, &udbinfo);
1405 }
1406 
1407 static int
udp_check_pktinfo(struct mbuf * control,struct ifnet ** outif,struct in_addr * laddr)1408 udp_check_pktinfo(struct mbuf *control, struct ifnet **outif,
1409     struct in_addr *laddr)
1410 {
1411 	struct cmsghdr *cm = 0;
1412 	struct in_pktinfo *pktinfo;
1413 	struct ifnet *ifp;
1414 
1415 	if (outif != NULL) {
1416 		*outif = NULL;
1417 	}
1418 
1419 	/*
1420 	 * XXX: Currently, we assume all the optional information is stored
1421 	 * in a single mbuf.
1422 	 */
1423 	if (control->m_next) {
1424 		return EINVAL;
1425 	}
1426 
1427 	if (control->m_len < CMSG_LEN(0)) {
1428 		return EINVAL;
1429 	}
1430 
1431 	for (cm = M_FIRST_CMSGHDR(control);
1432 	    is_cmsg_valid(control, cm);
1433 	    cm = M_NXT_CMSGHDR(control, cm)) {
1434 		if (cm->cmsg_level != IPPROTO_IP ||
1435 		    cm->cmsg_type != IP_PKTINFO) {
1436 			continue;
1437 		}
1438 
1439 		if (cm->cmsg_len != CMSG_LEN(sizeof(struct in_pktinfo))) {
1440 			return EINVAL;
1441 		}
1442 
1443 		pktinfo =  (struct in_pktinfo *)(void *)CMSG_DATA(cm);
1444 
1445 		/* Check for a valid ifindex in pktinfo */
1446 		ifnet_head_lock_shared();
1447 
1448 		if (pktinfo->ipi_ifindex > if_index) {
1449 			ifnet_head_done();
1450 			return ENXIO;
1451 		}
1452 
1453 		/*
1454 		 * If ipi_ifindex is specified it takes precedence
1455 		 * over ipi_spec_dst.
1456 		 */
1457 		if (pktinfo->ipi_ifindex) {
1458 			ifp = ifindex2ifnet[pktinfo->ipi_ifindex];
1459 			if (ifp == NULL) {
1460 				ifnet_head_done();
1461 				return ENXIO;
1462 			}
1463 			if (outif != NULL) {
1464 				ifnet_reference(ifp);
1465 				*outif = ifp;
1466 			}
1467 			ifnet_head_done();
1468 			laddr->s_addr = INADDR_ANY;
1469 			break;
1470 		}
1471 
1472 		ifnet_head_done();
1473 
1474 		/*
1475 		 * Use the provided ipi_spec_dst address for temp
1476 		 * source address.
1477 		 */
1478 		*laddr = pktinfo->ipi_spec_dst;
1479 		break;
1480 	}
1481 	return 0;
1482 }
1483 
1484 int
udp_output(struct inpcb * inp,struct mbuf * m,struct sockaddr * addr,struct mbuf * control,struct proc * p)1485 udp_output(struct inpcb *inp, struct mbuf *m, struct sockaddr *addr,
1486     struct mbuf *control, struct proc *p)
1487 {
1488 	struct udpiphdr *ui;
1489 	int len = m->m_pkthdr.len;
1490 	struct sockaddr_in *sin;
1491 	struct in_addr origladdr, laddr, faddr, pi_laddr;
1492 	u_short lport, fport;
1493 	int error = 0, udp_dodisconnect = 0, pktinfo = 0;
1494 	struct socket *so = inp->inp_socket;
1495 	int soopts = 0;
1496 	struct mbuf *inpopts;
1497 	struct ip_moptions *mopts;
1498 	struct route ro;
1499 	struct ip_out_args ipoa;
1500 	bool sndinprog_cnt_used = false;
1501 #if CONTENT_FILTER
1502 	struct m_tag *cfil_tag = NULL;
1503 	bool cfil_faddr_use = false;
1504 	uint32_t cfil_so_state_change_cnt = 0;
1505 	uint32_t cfil_so_options = 0;
1506 	struct sockaddr *cfil_faddr = NULL;
1507 #endif
1508 	bool check_qos_marking_again = (so->so_flags1 & SOF1_QOSMARKING_POLICY_OVERRIDE) ? FALSE : TRUE;
1509 
1510 	bzero(&ipoa, sizeof(ipoa));
1511 	ipoa.ipoa_boundif = IFSCOPE_NONE;
1512 	ipoa.ipoa_flags = IPOAF_SELECT_SRCIF;
1513 
1514 	struct ifnet *outif = NULL;
1515 	struct flowadv *adv = &ipoa.ipoa_flowadv;
1516 	int sotc = SO_TC_UNSPEC;
1517 	int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
1518 	struct ifnet *origoutifp = NULL;
1519 	int flowadv = 0;
1520 	int tos = IPTOS_UNSPEC;
1521 
1522 	/* Enable flow advisory only when connected */
1523 	flowadv = (so->so_state & SS_ISCONNECTED) ? 1 : 0;
1524 	pi_laddr.s_addr = INADDR_ANY;
1525 
1526 	KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
1527 
1528 	socket_lock_assert_owned(so);
1529 
1530 #if CONTENT_FILTER
1531 	/*
1532 	 * If socket is subject to UDP Content Filter and no addr is passed in,
1533 	 * retrieve CFIL saved state from mbuf and use it if necessary.
1534 	 */
1535 	if (CFIL_DGRAM_FILTERED(so) && !addr) {
1536 		cfil_tag = cfil_dgram_get_socket_state(m, &cfil_so_state_change_cnt, &cfil_so_options, &cfil_faddr, NULL);
1537 		if (cfil_tag) {
1538 			sin = (struct sockaddr_in *)(void *)cfil_faddr;
1539 			if (inp && inp->inp_faddr.s_addr == INADDR_ANY) {
1540 				/*
1541 				 * Socket is unconnected, simply use the saved faddr as 'addr' to go through
1542 				 * the connect/disconnect logic.
1543 				 */
1544 				addr = (struct sockaddr *)cfil_faddr;
1545 			} else if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
1546 			    (inp->inp_fport != sin->sin_port ||
1547 			    inp->inp_faddr.s_addr != sin->sin_addr.s_addr)) {
1548 				/*
1549 				 * Socket is connected but socket state and dest addr/port changed.
1550 				 * We need to use the saved faddr info.
1551 				 */
1552 				cfil_faddr_use = true;
1553 			}
1554 		}
1555 	}
1556 #endif
1557 
1558 	if (control != NULL) {
1559 		tos = so_tos_from_control(control);
1560 		sotc = so_tc_from_control(control, &netsvctype);
1561 		VERIFY(outif == NULL);
1562 		error = udp_check_pktinfo(control, &outif, &pi_laddr);
1563 		m_freem(control);
1564 		control = NULL;
1565 		if (error) {
1566 			goto release;
1567 		}
1568 		pktinfo++;
1569 		if (outif != NULL) {
1570 			ipoa.ipoa_boundif = outif->if_index;
1571 		}
1572 	}
1573 	if (sotc == SO_TC_UNSPEC) {
1574 		sotc = so->so_traffic_class;
1575 		netsvctype = so->so_netsvctype;
1576 	}
1577 
1578 	KERNEL_DEBUG(DBG_LAYER_OUT_BEG, inp->inp_fport, inp->inp_lport,
1579 	    inp->inp_laddr.s_addr, inp->inp_faddr.s_addr,
1580 	    (htons((u_short)len + sizeof(struct udphdr))));
1581 
1582 	if (len + sizeof(struct udpiphdr) > IP_MAXPACKET) {
1583 		error = EMSGSIZE;
1584 		goto release;
1585 	}
1586 
1587 	if (flowadv && INP_WAIT_FOR_IF_FEEDBACK(inp)) {
1588 		/*
1589 		 * The socket is flow-controlled, drop the packets
1590 		 * until the inp is not flow controlled
1591 		 */
1592 		error = ENOBUFS;
1593 		goto release;
1594 	}
1595 	/*
1596 	 * If socket was bound to an ifindex, tell ip_output about it.
1597 	 * If the ancillary IP_PKTINFO option contains an interface index,
1598 	 * it takes precedence over the one specified by IP_BOUND_IF.
1599 	 */
1600 	if (ipoa.ipoa_boundif == IFSCOPE_NONE &&
1601 	    (inp->inp_flags & INP_BOUND_IF)) {
1602 		VERIFY(inp->inp_boundifp != NULL);
1603 		ifnet_reference(inp->inp_boundifp);     /* for this routine */
1604 		if (outif != NULL) {
1605 			ifnet_release(outif);
1606 		}
1607 		outif = inp->inp_boundifp;
1608 		ipoa.ipoa_boundif = outif->if_index;
1609 	}
1610 	if (INP_NO_CELLULAR(inp)) {
1611 		ipoa.ipoa_flags |=  IPOAF_NO_CELLULAR;
1612 	}
1613 	if (INP_NO_EXPENSIVE(inp)) {
1614 		ipoa.ipoa_flags |=  IPOAF_NO_EXPENSIVE;
1615 	}
1616 	if (INP_NO_CONSTRAINED(inp)) {
1617 		ipoa.ipoa_flags |=  IPOAF_NO_CONSTRAINED;
1618 	}
1619 	if (INP_AWDL_UNRESTRICTED(inp)) {
1620 		ipoa.ipoa_flags |=  IPOAF_AWDL_UNRESTRICTED;
1621 	}
1622 	ipoa.ipoa_sotc = sotc;
1623 	ipoa.ipoa_netsvctype = netsvctype;
1624 	soopts |= IP_OUTARGS;
1625 
1626 	/*
1627 	 * If there was a routing change, discard cached route and check
1628 	 * that we have a valid source address.  Reacquire a new source
1629 	 * address if INADDR_ANY was specified.
1630 	 *
1631 	 * If we are using cfil saved state, go through this cache cleanup
1632 	 * so that we can get a new route.
1633 	 */
1634 	if (ROUTE_UNUSABLE(&inp->inp_route)
1635 #if CONTENT_FILTER
1636 	    || cfil_faddr_use
1637 #endif
1638 	    ) {
1639 		struct in_ifaddr *ia = NULL;
1640 
1641 		ROUTE_RELEASE(&inp->inp_route);
1642 
1643 		/* src address is gone? */
1644 		if (inp->inp_laddr.s_addr != INADDR_ANY &&
1645 		    (ia = ifa_foraddr(inp->inp_laddr.s_addr)) == NULL) {
1646 			if (!(inp->inp_flags & INP_INADDR_ANY) ||
1647 			    (so->so_state & SS_ISCONNECTED)) {
1648 				/*
1649 				 * Rdar://5448998
1650 				 * If the source address is gone, return an
1651 				 * error if:
1652 				 * - the source was specified
1653 				 * - the socket was already connected
1654 				 */
1655 				soevent(so, (SO_FILT_HINT_LOCKED |
1656 				    SO_FILT_HINT_NOSRCADDR));
1657 				error = EADDRNOTAVAIL;
1658 				goto release;
1659 			} else {
1660 				/* new src will be set later */
1661 				inp->inp_laddr.s_addr = INADDR_ANY;
1662 				inp->inp_last_outifp = NULL;
1663 #if SKYWALK
1664 				if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
1665 					netns_set_ifnet(&inp->inp_netns_token, NULL);
1666 				}
1667 #endif /* SKYWALK */
1668 			}
1669 		}
1670 		if (ia != NULL) {
1671 			IFA_REMREF(&ia->ia_ifa);
1672 		}
1673 	}
1674 
1675 	/*
1676 	 * IP_PKTINFO option check.  If a temporary scope or src address
1677 	 * is provided, use it for this packet only and make sure we forget
1678 	 * it after sending this datagram.
1679 	 */
1680 	if (pi_laddr.s_addr != INADDR_ANY ||
1681 	    (ipoa.ipoa_boundif != IFSCOPE_NONE && pktinfo)) {
1682 		/* temp src address for this datagram only */
1683 		laddr = pi_laddr;
1684 		origladdr.s_addr = INADDR_ANY;
1685 		/* we don't want to keep the laddr or route */
1686 		udp_dodisconnect = 1;
1687 		/* remember we don't care about src addr */
1688 		inp->inp_flags |= INP_INADDR_ANY;
1689 	} else {
1690 		origladdr = laddr = inp->inp_laddr;
1691 	}
1692 
1693 	origoutifp = inp->inp_last_outifp;
1694 	faddr = inp->inp_faddr;
1695 	lport = inp->inp_lport;
1696 	fport = inp->inp_fport;
1697 
1698 #if CONTENT_FILTER
1699 	if (cfil_faddr_use) {
1700 		faddr = ((struct sockaddr_in *)(void *)cfil_faddr)->sin_addr;
1701 		fport = ((struct sockaddr_in *)(void *)cfil_faddr)->sin_port;
1702 	}
1703 #endif
1704 	inp->inp_sndinprog_cnt++;
1705 	sndinprog_cnt_used = true;
1706 
1707 	if (addr) {
1708 		sin = (struct sockaddr_in *)(void *)addr;
1709 		if (faddr.s_addr != INADDR_ANY) {
1710 			error = EISCONN;
1711 			goto release;
1712 		}
1713 		if (lport == 0) {
1714 			/*
1715 			 * In case we don't have a local port set, go through
1716 			 * the full connect.  We don't have a local port yet
1717 			 * (i.e., we can't be looked up), so it's not an issue
1718 			 * if the input runs at the same time we do this.
1719 			 */
1720 			/* if we have a source address specified, use that */
1721 			if (pi_laddr.s_addr != INADDR_ANY) {
1722 				inp->inp_laddr = pi_laddr;
1723 			}
1724 			/*
1725 			 * If a scope is specified, use it.  Scope from
1726 			 * IP_PKTINFO takes precendence over the the scope
1727 			 * set via INP_BOUND_IF.
1728 			 */
1729 			error = in_pcbconnect(inp, addr, p, ipoa.ipoa_boundif,
1730 			    &outif);
1731 			if (error) {
1732 				goto release;
1733 			}
1734 
1735 			laddr = inp->inp_laddr;
1736 			lport = inp->inp_lport;
1737 			faddr = inp->inp_faddr;
1738 			fport = inp->inp_fport;
1739 			udp_dodisconnect = 1;
1740 
1741 			/* synch up in case in_pcbladdr() overrides */
1742 			if (outif != NULL && ipoa.ipoa_boundif != IFSCOPE_NONE) {
1743 				ipoa.ipoa_boundif = outif->if_index;
1744 			}
1745 		} else {
1746 			/*
1747 			 * Fast path case
1748 			 *
1749 			 * We have a full address and a local port; use those
1750 			 * info to build the packet without changing the pcb
1751 			 * and interfering with the input path. See 3851370.
1752 			 *
1753 			 * Scope from IP_PKTINFO takes precendence over the
1754 			 * the scope set via INP_BOUND_IF.
1755 			 */
1756 			if (laddr.s_addr == INADDR_ANY) {
1757 				if ((error = in_pcbladdr(inp, addr, &laddr,
1758 				    ipoa.ipoa_boundif, &outif, 0)) != 0) {
1759 					goto release;
1760 				}
1761 				/*
1762 				 * from pcbconnect: remember we don't
1763 				 * care about src addr.
1764 				 */
1765 				inp->inp_flags |= INP_INADDR_ANY;
1766 
1767 				/* synch up in case in_pcbladdr() overrides */
1768 				if (outif != NULL &&
1769 				    ipoa.ipoa_boundif != IFSCOPE_NONE) {
1770 					ipoa.ipoa_boundif = outif->if_index;
1771 				}
1772 			}
1773 
1774 			faddr = sin->sin_addr;
1775 			fport = sin->sin_port;
1776 		}
1777 	} else {
1778 		if (faddr.s_addr == INADDR_ANY) {
1779 			error = ENOTCONN;
1780 			goto release;
1781 		}
1782 	}
1783 
1784 	if (inp->inp_flowhash == 0) {
1785 		inp_calc_flowhash(inp);
1786 		ASSERT(inp->inp_flowhash != 0);
1787 	}
1788 
1789 	if (fport == htons(53) && !(so->so_flags1 & SOF1_DNS_COUNTED)) {
1790 		so->so_flags1 |= SOF1_DNS_COUNTED;
1791 		INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_dns);
1792 	}
1793 
1794 	/*
1795 	 * Calculate data length and get a mbuf
1796 	 * for UDP and IP headers.
1797 	 */
1798 	M_PREPEND(m, sizeof(struct udpiphdr), M_DONTWAIT, 1);
1799 	if (m == 0) {
1800 		error = ENOBUFS;
1801 		goto abort;
1802 	}
1803 
1804 	/*
1805 	 * Fill in mbuf with extended UDP header
1806 	 * and addresses and length put into network format.
1807 	 */
1808 	ui = mtod(m, struct udpiphdr *);
1809 	bzero(ui->ui_x1, sizeof(ui->ui_x1));    /* XXX still needed? */
1810 	ui->ui_pr = IPPROTO_UDP;
1811 	ui->ui_src = laddr;
1812 	ui->ui_dst = faddr;
1813 	ui->ui_sport = lport;
1814 	ui->ui_dport = fport;
1815 	ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
1816 
1817 	/*
1818 	 * Set the Don't Fragment bit in the IP header.
1819 	 */
1820 	if (inp->inp_flags2 & INP2_DONTFRAG) {
1821 		struct ip *ip;
1822 
1823 		ip = (struct ip *)&ui->ui_i;
1824 		ip->ip_off |= IP_DF;
1825 	}
1826 
1827 	/*
1828 	 * Set up checksum to pseudo header checksum and output datagram.
1829 	 *
1830 	 * Treat flows to be CLAT46'd as IPv6 flow and compute checksum
1831 	 * no matter what, as IPv6 mandates checksum for UDP.
1832 	 *
1833 	 * Here we only compute the one's complement sum of the pseudo header.
1834 	 * The payload computation and final complement is delayed to much later
1835 	 * in IP processing to decide if remaining computation needs to be done
1836 	 * through offload.
1837 	 *
1838 	 * That is communicated by setting CSUM_UDP in csum_flags.
1839 	 * The offset of checksum from the start of ULP header is communicated
1840 	 * through csum_data.
1841 	 *
1842 	 * Note since this already contains the pseudo checksum header, any
1843 	 * later operation at IP layer that modify the values used here must
1844 	 * update the checksum as well (for example NAT etc).
1845 	 */
1846 	if ((inp->inp_flags2 & INP2_CLAT46_FLOW) ||
1847 	    (udpcksum && !(inp->inp_flags & INP_UDP_NOCKSUM))) {
1848 		ui->ui_sum = in_pseudo(ui->ui_src.s_addr, ui->ui_dst.s_addr,
1849 		    htons((u_short)len + sizeof(struct udphdr) + IPPROTO_UDP));
1850 		m->m_pkthdr.csum_flags = (CSUM_UDP | CSUM_ZERO_INVERT);
1851 		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
1852 	} else {
1853 		ui->ui_sum = 0;
1854 	}
1855 	((struct ip *)ui)->ip_len = (uint16_t)(sizeof(struct udpiphdr) + len);
1856 	((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl;    /* XXX */
1857 	if (tos != IPTOS_UNSPEC) {
1858 		((struct ip *)ui)->ip_tos = (uint8_t)(tos & IPTOS_MASK);
1859 	} else {
1860 		((struct ip *)ui)->ip_tos = inp->inp_ip_tos;    /* XXX */
1861 	}
1862 	udpstat.udps_opackets++;
1863 
1864 	KERNEL_DEBUG(DBG_LAYER_OUT_END, ui->ui_dport, ui->ui_sport,
1865 	    ui->ui_src.s_addr, ui->ui_dst.s_addr, ui->ui_ulen);
1866 
1867 #if NECP
1868 	{
1869 		necp_kernel_policy_id policy_id;
1870 		necp_kernel_policy_id skip_policy_id;
1871 		u_int32_t route_rule_id;
1872 		u_int32_t pass_flags;
1873 
1874 		/*
1875 		 * We need a route to perform NECP route rule checks
1876 		 */
1877 		if (net_qos_policy_restricted != 0 &&
1878 		    ROUTE_UNUSABLE(&inp->inp_route)) {
1879 			struct sockaddr_in to;
1880 			struct sockaddr_in from;
1881 
1882 			ROUTE_RELEASE(&inp->inp_route);
1883 
1884 			bzero(&from, sizeof(struct sockaddr_in));
1885 			from.sin_family = AF_INET;
1886 			from.sin_len = sizeof(struct sockaddr_in);
1887 			from.sin_addr = laddr;
1888 
1889 			bzero(&to, sizeof(struct sockaddr_in));
1890 			to.sin_family = AF_INET;
1891 			to.sin_len = sizeof(struct sockaddr_in);
1892 			to.sin_addr = faddr;
1893 
1894 			inp->inp_route.ro_dst.sa_family = AF_INET;
1895 			inp->inp_route.ro_dst.sa_len = sizeof(struct sockaddr_in);
1896 			((struct sockaddr_in *)(void *)&inp->inp_route.ro_dst)->sin_addr =
1897 			    faddr;
1898 
1899 			rtalloc_scoped(&inp->inp_route, ipoa.ipoa_boundif);
1900 
1901 			inp_update_necp_policy(inp, (struct sockaddr *)&from,
1902 			    (struct sockaddr *)&to, ipoa.ipoa_boundif);
1903 			inp->inp_policyresult.results.qos_marking_gencount = 0;
1904 		}
1905 
1906 		if (!necp_socket_is_allowed_to_send_recv_v4(inp, lport, fport,
1907 		    &laddr, &faddr, NULL, 0, &policy_id, &route_rule_id, &skip_policy_id, &pass_flags)) {
1908 			error = EHOSTUNREACH;
1909 			goto abort;
1910 		}
1911 
1912 		necp_mark_packet_from_socket(m, inp, policy_id, route_rule_id, skip_policy_id, pass_flags);
1913 
1914 		if (net_qos_policy_restricted != 0) {
1915 			necp_socket_update_qos_marking(inp, inp->inp_route.ro_rt, route_rule_id);
1916 		}
1917 	}
1918 #endif /* NECP */
1919 	if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
1920 		ipoa.ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
1921 	}
1922 	if (check_qos_marking_again) {
1923 		ipoa.ipoa_flags |= IPOAF_REDO_QOSMARKING_POLICY;
1924 	}
1925 	ipoa.qos_marking_gencount = inp->inp_policyresult.results.qos_marking_gencount;
1926 
1927 #if IPSEC
1928 	if (inp->inp_sp != NULL && ipsec_setsocket(m, inp->inp_socket) != 0) {
1929 		error = ENOBUFS;
1930 		goto abort;
1931 	}
1932 #endif /* IPSEC */
1933 
1934 	inpopts = inp->inp_options;
1935 #if CONTENT_FILTER
1936 	if (cfil_tag && (inp->inp_socket->so_options != cfil_so_options)) {
1937 		soopts |= (cfil_so_options & (SO_DONTROUTE | SO_BROADCAST));
1938 	} else
1939 #endif
1940 	soopts |= (inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST));
1941 
1942 	mopts = inp->inp_moptions;
1943 	if (mopts != NULL) {
1944 		IMO_LOCK(mopts);
1945 		IMO_ADDREF_LOCKED(mopts);
1946 		if (IN_MULTICAST(ntohl(ui->ui_dst.s_addr)) &&
1947 		    mopts->imo_multicast_ifp != NULL) {
1948 			/* no reference needed */
1949 			inp->inp_last_outifp = mopts->imo_multicast_ifp;
1950 #if SKYWALK
1951 			if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
1952 				netns_set_ifnet(&inp->inp_netns_token,
1953 				    inp->inp_last_outifp);
1954 			}
1955 #endif /* SKYWALK */
1956 		}
1957 		IMO_UNLOCK(mopts);
1958 	}
1959 
1960 	/* Copy the cached route and take an extra reference */
1961 	inp_route_copyout(inp, &ro);
1962 
1963 	set_packet_service_class(m, so, sotc, 0);
1964 	m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
1965 	m->m_pkthdr.pkt_flowid = inp->inp_flowhash;
1966 	m->m_pkthdr.pkt_proto = IPPROTO_UDP;
1967 	m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC);
1968 	if (flowadv) {
1969 		m->m_pkthdr.pkt_flags |= PKTF_FLOW_ADV;
1970 	}
1971 	m->m_pkthdr.tx_udp_pid = so->last_pid;
1972 	if (so->so_flags & SOF_DELEGATED) {
1973 		m->m_pkthdr.tx_udp_e_pid = so->e_pid;
1974 	} else {
1975 		m->m_pkthdr.tx_udp_e_pid = 0;
1976 	}
1977 #if (DEBUG || DEVELOPMENT)
1978 	if (so->so_flags & SOF_MARK_WAKE_PKT) {
1979 		so->so_flags &= ~SOF_MARK_WAKE_PKT;
1980 		m->m_pkthdr.pkt_flags |= PKTF_WAKE_PKT;
1981 	}
1982 #endif /* (DEBUG || DEVELOPMENT) */
1983 
1984 	m_add_crumb(m, PKT_CRUMB_UDP_OUTPUT);
1985 
1986 	if (ipoa.ipoa_boundif != IFSCOPE_NONE) {
1987 		ipoa.ipoa_flags |= IPOAF_BOUND_IF;
1988 	}
1989 
1990 	if (laddr.s_addr != INADDR_ANY) {
1991 		ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
1992 	}
1993 
1994 	socket_unlock(so, 0);
1995 	error = ip_output(m, inpopts, &ro, soopts, mopts, &ipoa);
1996 	m = NULL;
1997 	socket_lock(so, 0);
1998 	if (mopts != NULL) {
1999 		IMO_REMREF(mopts);
2000 	}
2001 
2002 	if (check_qos_marking_again) {
2003 		inp->inp_policyresult.results.qos_marking_gencount = ipoa.qos_marking_gencount;
2004 
2005 		if (ipoa.ipoa_flags & IPOAF_QOSMARKING_ALLOWED) {
2006 			inp->inp_socket->so_flags1 |= SOF1_QOSMARKING_ALLOWED;
2007 		} else {
2008 			inp->inp_socket->so_flags1 &= ~SOF1_QOSMARKING_ALLOWED;
2009 		}
2010 	}
2011 
2012 	if (error == 0 && nstat_collect) {
2013 		boolean_t cell, wifi, wired;
2014 
2015 		if (ro.ro_rt != NULL) {
2016 			cell = IFNET_IS_CELLULAR(ro.ro_rt->rt_ifp);
2017 			wifi = (!cell && IFNET_IS_WIFI(ro.ro_rt->rt_ifp));
2018 			wired = (!wifi && IFNET_IS_WIRED(ro.ro_rt->rt_ifp));
2019 		} else {
2020 			cell = wifi = wired = FALSE;
2021 		}
2022 		INP_ADD_STAT(inp, cell, wifi, wired, txpackets, 1);
2023 		INP_ADD_STAT(inp, cell, wifi, wired, txbytes, len);
2024 		inp_set_activity_bitmap(inp);
2025 	}
2026 
2027 	if (flowadv && (adv->code == FADV_FLOW_CONTROLLED ||
2028 	    adv->code == FADV_SUSPENDED)) {
2029 		/*
2030 		 * return a hint to the application that
2031 		 * the packet has been dropped
2032 		 */
2033 		error = ENOBUFS;
2034 		inp_set_fc_state(inp, adv->code);
2035 	}
2036 
2037 	/* Synchronize PCB cached route */
2038 	inp_route_copyin(inp, &ro);
2039 
2040 abort:
2041 	if (udp_dodisconnect) {
2042 		/* Always discard the cached route for unconnected socket */
2043 		ROUTE_RELEASE(&inp->inp_route);
2044 		in_pcbdisconnect(inp);
2045 		inp->inp_laddr = origladdr;     /* XXX rehash? */
2046 		/* no reference needed */
2047 		inp->inp_last_outifp = origoutifp;
2048 #if SKYWALK
2049 		if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2050 			netns_set_ifnet(&inp->inp_netns_token,
2051 			    inp->inp_last_outifp);
2052 		}
2053 #endif /* SKYWALK */
2054 	} else if (inp->inp_route.ro_rt != NULL) {
2055 		struct rtentry *rt = inp->inp_route.ro_rt;
2056 		struct ifnet *outifp;
2057 
2058 		if (rt->rt_flags & (RTF_MULTICAST | RTF_BROADCAST)) {
2059 			rt = NULL;      /* unusable */
2060 		}
2061 #if CONTENT_FILTER
2062 		/*
2063 		 * Discard temporary route for cfil case
2064 		 */
2065 		if (cfil_faddr_use) {
2066 			rt = NULL;      /* unusable */
2067 		}
2068 #endif
2069 
2070 		/*
2071 		 * Always discard if it is a multicast or broadcast route.
2072 		 */
2073 		if (rt == NULL) {
2074 			ROUTE_RELEASE(&inp->inp_route);
2075 		}
2076 
2077 		/*
2078 		 * If the destination route is unicast, update outifp with
2079 		 * that of the route interface used by IP.
2080 		 */
2081 		if (rt != NULL &&
2082 		    (outifp = rt->rt_ifp) != inp->inp_last_outifp) {
2083 			inp->inp_last_outifp = outifp; /* no reference needed */
2084 #if SKYWALK
2085 			if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2086 				netns_set_ifnet(&inp->inp_netns_token,
2087 				    inp->inp_last_outifp);
2088 			}
2089 #endif /* SKYWALK */
2090 
2091 			so->so_pktheadroom = (uint16_t)P2ROUNDUP(
2092 				sizeof(struct udphdr) +
2093 				sizeof(struct ip) +
2094 				ifnet_hdrlen(outifp) +
2095 				ifnet_mbuf_packetpreamblelen(outifp),
2096 				sizeof(u_int32_t));
2097 		}
2098 	} else {
2099 		ROUTE_RELEASE(&inp->inp_route);
2100 	}
2101 
2102 	/*
2103 	 * If output interface was cellular/expensive, and this socket is
2104 	 * denied access to it, generate an event.
2105 	 */
2106 	if (error != 0 && (ipoa.ipoa_flags & IPOAF_R_IFDENIED) &&
2107 	    (INP_NO_CELLULAR(inp) || INP_NO_EXPENSIVE(inp) || INP_NO_CONSTRAINED(inp))) {
2108 		soevent(so, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
2109 	}
2110 
2111 release:
2112 	KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_END, error, 0, 0, 0, 0);
2113 
2114 	if (m != NULL) {
2115 		m_freem(m);
2116 	}
2117 
2118 	if (outif != NULL) {
2119 		ifnet_release(outif);
2120 	}
2121 
2122 #if CONTENT_FILTER
2123 	if (cfil_tag) {
2124 		m_tag_free(cfil_tag);
2125 	}
2126 #endif
2127 	if (sndinprog_cnt_used) {
2128 		VERIFY(inp->inp_sndinprog_cnt > 0);
2129 		if (--inp->inp_sndinprog_cnt == 0) {
2130 			inp->inp_flags &= ~(INP_FC_FEEDBACK);
2131 			if (inp->inp_sndingprog_waiters > 0) {
2132 				wakeup(&inp->inp_sndinprog_cnt);
2133 			}
2134 		}
2135 		sndinprog_cnt_used = false;
2136 	}
2137 
2138 	return error;
2139 }
2140 
2141 u_int32_t       udp_sendspace = 9216;           /* really max datagram size */
2142 /* 187 1K datagrams (approx 192 KB) */
2143 u_int32_t       udp_recvspace = 187 * (1024 + sizeof(struct sockaddr_in6));
2144 
2145 /* Check that the values of udp send and recv space do not exceed sb_max */
2146 static int
sysctl_udp_sospace(struct sysctl_oid * oidp,void * arg1,int arg2,struct sysctl_req * req)2147 sysctl_udp_sospace(struct sysctl_oid *oidp, void *arg1, int arg2,
2148     struct sysctl_req *req)
2149 {
2150 #pragma unused(arg1, arg2)
2151 	u_int32_t new_value = 0, *space_p = NULL;
2152 	int changed = 0, error = 0;
2153 	u_quad_t sb_effective_max = (sb_max / (MSIZE + MCLBYTES)) * MCLBYTES;
2154 
2155 	switch (oidp->oid_number) {
2156 	case UDPCTL_RECVSPACE:
2157 		space_p = &udp_recvspace;
2158 		break;
2159 	case UDPCTL_MAXDGRAM:
2160 		space_p = &udp_sendspace;
2161 		break;
2162 	default:
2163 		return EINVAL;
2164 	}
2165 	error = sysctl_io_number(req, *space_p, sizeof(u_int32_t),
2166 	    &new_value, &changed);
2167 	if (changed) {
2168 		if (new_value > 0 && new_value <= sb_effective_max) {
2169 			*space_p = new_value;
2170 		} else {
2171 			error = ERANGE;
2172 		}
2173 	}
2174 	return error;
2175 }
2176 
2177 SYSCTL_PROC(_net_inet_udp, UDPCTL_RECVSPACE, recvspace,
2178     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &udp_recvspace, 0,
2179     &sysctl_udp_sospace, "IU", "Maximum incoming UDP datagram size");
2180 
2181 SYSCTL_PROC(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram,
2182     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED, &udp_sendspace, 0,
2183     &sysctl_udp_sospace, "IU", "Maximum outgoing UDP datagram size");
2184 
2185 int
udp_abort(struct socket * so)2186 udp_abort(struct socket *so)
2187 {
2188 	struct inpcb *inp;
2189 
2190 	inp = sotoinpcb(so);
2191 	if (inp == NULL) {
2192 		panic("%s: so=%p null inp", __func__, so);
2193 		/* NOTREACHED */
2194 	}
2195 	soisdisconnected(so);
2196 	in_pcbdetach(inp);
2197 	return 0;
2198 }
2199 
2200 int
udp_attach(struct socket * so,int proto,struct proc * p)2201 udp_attach(struct socket *so, int proto, struct proc *p)
2202 {
2203 #pragma unused(proto)
2204 	struct inpcb *inp;
2205 	int error;
2206 
2207 	error = soreserve(so, udp_sendspace, udp_recvspace);
2208 	if (error != 0) {
2209 		return error;
2210 	}
2211 	inp = sotoinpcb(so);
2212 	if (inp != NULL) {
2213 		panic("%s so=%p inp=%p", __func__, so, inp);
2214 		/* NOTREACHED */
2215 	}
2216 	error = in_pcballoc(so, &udbinfo, p);
2217 	if (error != 0) {
2218 		return error;
2219 	}
2220 	inp = (struct inpcb *)so->so_pcb;
2221 	inp->inp_vflag |= INP_IPV4;
2222 	inp->inp_ip_ttl = (uint8_t)ip_defttl;
2223 	if (nstat_collect) {
2224 		nstat_udp_new_pcb(inp);
2225 	}
2226 	return 0;
2227 }
2228 
2229 int
udp_bind(struct socket * so,struct sockaddr * nam,struct proc * p)2230 udp_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
2231 {
2232 	struct inpcb *inp;
2233 	int error;
2234 
2235 	if (nam->sa_family != 0 && nam->sa_family != AF_INET &&
2236 	    nam->sa_family != AF_INET6) {
2237 		return EAFNOSUPPORT;
2238 	}
2239 
2240 	inp = sotoinpcb(so);
2241 	if (inp == NULL) {
2242 		return EINVAL;
2243 	}
2244 	error = in_pcbbind(inp, nam, p);
2245 
2246 #if NECP
2247 	/* Update NECP client with bind result if not in middle of connect */
2248 	if (error == 0 &&
2249 	    (inp->inp_flags2 & INP2_CONNECT_IN_PROGRESS) &&
2250 	    !uuid_is_null(inp->necp_client_uuid)) {
2251 		socket_unlock(so, 0);
2252 		necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
2253 		socket_lock(so, 0);
2254 	}
2255 #endif /* NECP */
2256 
2257 	return error;
2258 }
2259 
2260 int
udp_connect(struct socket * so,struct sockaddr * nam,struct proc * p)2261 udp_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
2262 {
2263 	struct inpcb *inp;
2264 	int error;
2265 
2266 	inp = sotoinpcb(so);
2267 	if (inp == NULL) {
2268 		return EINVAL;
2269 	}
2270 	if (inp->inp_faddr.s_addr != INADDR_ANY) {
2271 		return EISCONN;
2272 	}
2273 
2274 	if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
2275 		so->so_flags1 |= SOF1_CONNECT_COUNTED;
2276 		INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
2277 	}
2278 
2279 #if NECP
2280 #if FLOW_DIVERT
2281 	if (necp_socket_should_use_flow_divert(inp)) {
2282 		error = flow_divert_pcb_init(so);
2283 		if (error == 0) {
2284 			error = flow_divert_connect_out(so, nam, p);
2285 		}
2286 		return error;
2287 	}
2288 #endif /* FLOW_DIVERT */
2289 #endif /* NECP */
2290 
2291 	error = in_pcbconnect(inp, nam, p, IFSCOPE_NONE, NULL);
2292 	if (error == 0) {
2293 #if NECP
2294 		/* Update NECP client with connected five-tuple */
2295 		if (!uuid_is_null(inp->necp_client_uuid)) {
2296 			socket_unlock(so, 0);
2297 			necp_client_assign_from_socket(so->last_pid, inp->necp_client_uuid, inp);
2298 			socket_lock(so, 0);
2299 		}
2300 #endif /* NECP */
2301 
2302 		soisconnected(so);
2303 		if (inp->inp_flowhash == 0) {
2304 			inp_calc_flowhash(inp);
2305 			ASSERT(inp->inp_flowhash != 0);
2306 		}
2307 	}
2308 	return error;
2309 }
2310 
2311 int
udp_connectx_common(struct socket * so,int af,struct sockaddr * src,struct sockaddr * dst,struct proc * p,uint32_t ifscope,sae_associd_t aid,sae_connid_t * pcid,uint32_t flags,void * arg,uint32_t arglen,struct uio * uio,user_ssize_t * bytes_written)2312 udp_connectx_common(struct socket *so, int af, struct sockaddr *src, struct sockaddr *dst,
2313     struct proc *p, uint32_t ifscope, sae_associd_t aid, sae_connid_t *pcid,
2314     uint32_t flags, void *arg, uint32_t arglen,
2315     struct uio *uio, user_ssize_t *bytes_written)
2316 {
2317 #pragma unused(aid, flags, arg, arglen)
2318 	struct inpcb *inp = sotoinpcb(so);
2319 	int error = 0;
2320 	user_ssize_t datalen = 0;
2321 
2322 	if (inp == NULL) {
2323 		return EINVAL;
2324 	}
2325 
2326 	VERIFY(dst != NULL);
2327 
2328 	ASSERT(!(inp->inp_flags2 & INP2_CONNECT_IN_PROGRESS));
2329 	inp->inp_flags2 |= INP2_CONNECT_IN_PROGRESS;
2330 
2331 #if NECP
2332 	inp_update_necp_policy(inp, src, dst, ifscope);
2333 #endif /* NECP */
2334 
2335 	/* bind socket to the specified interface, if requested */
2336 	if (ifscope != IFSCOPE_NONE &&
2337 	    (error = inp_bindif(inp, ifscope, NULL)) != 0) {
2338 		goto done;
2339 	}
2340 
2341 	/* if source address and/or port is specified, bind to it */
2342 	if (src != NULL) {
2343 		error = sobindlock(so, src, 0); /* already locked */
2344 		if (error != 0) {
2345 			goto done;
2346 		}
2347 	}
2348 
2349 	switch (af) {
2350 	case AF_INET:
2351 		error = udp_connect(so, dst, p);
2352 		break;
2353 	case AF_INET6:
2354 		error = udp6_connect(so, dst, p);
2355 		break;
2356 	default:
2357 		VERIFY(0);
2358 		/* NOTREACHED */
2359 	}
2360 
2361 	if (error != 0) {
2362 		goto done;
2363 	}
2364 
2365 	/*
2366 	 * If there is data, copy it. DATA_IDEMPOTENT is ignored.
2367 	 * CONNECT_RESUME_ON_READ_WRITE is ignored.
2368 	 */
2369 	if (uio != NULL) {
2370 		socket_unlock(so, 0);
2371 
2372 		VERIFY(bytes_written != NULL);
2373 
2374 		datalen = uio_resid(uio);
2375 		error = so->so_proto->pr_usrreqs->pru_sosend(so, NULL,
2376 		    (uio_t)uio, NULL, NULL, 0);
2377 		socket_lock(so, 0);
2378 
2379 		/* If error returned is EMSGSIZE, for example, disconnect */
2380 		if (error == 0 || error == EWOULDBLOCK) {
2381 			*bytes_written = datalen - uio_resid(uio);
2382 		} else {
2383 			(void) so->so_proto->pr_usrreqs->pru_disconnectx(so,
2384 			    SAE_ASSOCID_ANY, SAE_CONNID_ANY);
2385 		}
2386 		/*
2387 		 * mask the EWOULDBLOCK error so that the caller
2388 		 * knows that atleast the connect was successful.
2389 		 */
2390 		if (error == EWOULDBLOCK) {
2391 			error = 0;
2392 		}
2393 	}
2394 
2395 	if (error == 0 && pcid != NULL) {
2396 		*pcid = 1;      /* there is only 1 connection for UDP */
2397 	}
2398 done:
2399 	inp->inp_flags2 &= ~INP2_CONNECT_IN_PROGRESS;
2400 	return error;
2401 }
2402 
2403 int
udp_connectx(struct socket * so,struct sockaddr * src,struct sockaddr * dst,struct proc * p,uint32_t ifscope,sae_associd_t aid,sae_connid_t * pcid,uint32_t flags,void * arg,uint32_t arglen,struct uio * uio,user_ssize_t * bytes_written)2404 udp_connectx(struct socket *so, struct sockaddr *src,
2405     struct sockaddr *dst, struct proc *p, uint32_t ifscope,
2406     sae_associd_t aid, sae_connid_t *pcid, uint32_t flags, void *arg,
2407     uint32_t arglen, struct uio *uio, user_ssize_t *bytes_written)
2408 {
2409 	return udp_connectx_common(so, AF_INET, src, dst,
2410 	           p, ifscope, aid, pcid, flags, arg, arglen, uio, bytes_written);
2411 }
2412 
2413 int
udp_detach(struct socket * so)2414 udp_detach(struct socket *so)
2415 {
2416 	struct inpcb *inp;
2417 
2418 	inp = sotoinpcb(so);
2419 	if (inp == NULL) {
2420 		panic("%s: so=%p null inp", __func__, so);
2421 		/* NOTREACHED */
2422 	}
2423 
2424 	/*
2425 	 * If this is a socket that does not want to wakeup the device
2426 	 * for it's traffic, the application might be waiting for
2427 	 * close to complete before going to sleep. Send a notification
2428 	 * for this kind of sockets
2429 	 */
2430 	if (so->so_options & SO_NOWAKEFROMSLEEP) {
2431 		socket_post_kev_msg_closed(so);
2432 	}
2433 
2434 	in_pcbdetach(inp);
2435 	inp->inp_state = INPCB_STATE_DEAD;
2436 	return 0;
2437 }
2438 
2439 int
udp_disconnect(struct socket * so)2440 udp_disconnect(struct socket *so)
2441 {
2442 	struct inpcb *inp;
2443 
2444 	inp = sotoinpcb(so);
2445 	if (inp == NULL) {
2446 		return EINVAL;
2447 	}
2448 	if (inp->inp_faddr.s_addr == INADDR_ANY) {
2449 		return ENOTCONN;
2450 	}
2451 
2452 	in_pcbdisconnect(inp);
2453 
2454 	/* reset flow controlled state, just in case */
2455 	inp_reset_fc_state(inp);
2456 
2457 	inp->inp_laddr.s_addr = INADDR_ANY;
2458 	so->so_state &= ~SS_ISCONNECTED;                /* XXX */
2459 	inp->inp_last_outifp = NULL;
2460 #if SKYWALK
2461 	if (NETNS_TOKEN_VALID(&inp->inp_netns_token)) {
2462 		netns_set_ifnet(&inp->inp_netns_token, NULL);
2463 	}
2464 #endif /* SKYWALK */
2465 
2466 	return 0;
2467 }
2468 
2469 int
udp_disconnectx(struct socket * so,sae_associd_t aid,sae_connid_t cid)2470 udp_disconnectx(struct socket *so, sae_associd_t aid, sae_connid_t cid)
2471 {
2472 #pragma unused(cid)
2473 	if (aid != SAE_ASSOCID_ANY && aid != SAE_ASSOCID_ALL) {
2474 		return EINVAL;
2475 	}
2476 
2477 	return udp_disconnect(so);
2478 }
2479 
2480 int
udp_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * addr,struct mbuf * control,struct proc * p)2481 udp_send(struct socket *so, int flags, struct mbuf *m,
2482     struct sockaddr *addr, struct mbuf *control, struct proc *p)
2483 {
2484 #ifndef FLOW_DIVERT
2485 #pragma unused(flags)
2486 #endif /* !(FLOW_DIVERT) */
2487 	struct inpcb *inp;
2488 	int error;
2489 
2490 	inp = sotoinpcb(so);
2491 	if (inp == NULL) {
2492 		if (m != NULL) {
2493 			m_freem(m);
2494 		}
2495 		if (control != NULL) {
2496 			m_freem(control);
2497 		}
2498 		return EINVAL;
2499 	}
2500 
2501 #if NECP
2502 #if FLOW_DIVERT
2503 	if (necp_socket_should_use_flow_divert(inp)) {
2504 		/* Implicit connect */
2505 		return flow_divert_implicit_data_out(so, flags, m, addr,
2506 		           control, p);
2507 	}
2508 #endif /* FLOW_DIVERT */
2509 #endif /* NECP */
2510 
2511 #if SKYWALK
2512 	sk_protect_t protect = sk_async_transmit_protect();
2513 #endif /* SKYWALK */
2514 	error = udp_output(inp, m, addr, control, p);
2515 #if SKYWALK
2516 	sk_async_transmit_unprotect(protect);
2517 #endif /* SKYWALK */
2518 
2519 	return error;
2520 }
2521 
2522 int
udp_shutdown(struct socket * so)2523 udp_shutdown(struct socket *so)
2524 {
2525 	struct inpcb *inp;
2526 
2527 	inp = sotoinpcb(so);
2528 	if (inp == NULL) {
2529 		return EINVAL;
2530 	}
2531 	socantsendmore(so);
2532 	return 0;
2533 }
2534 
2535 int
udp_lock(struct socket * so,int refcount,void * debug)2536 udp_lock(struct socket *so, int refcount, void *debug)
2537 {
2538 	void *lr_saved;
2539 
2540 	if (debug == NULL) {
2541 		lr_saved = __builtin_return_address(0);
2542 	} else {
2543 		lr_saved = debug;
2544 	}
2545 
2546 	if (so->so_pcb != NULL) {
2547 		LCK_MTX_ASSERT(&((struct inpcb *)so->so_pcb)->inpcb_mtx,
2548 		    LCK_MTX_ASSERT_NOTOWNED);
2549 		lck_mtx_lock(&((struct inpcb *)so->so_pcb)->inpcb_mtx);
2550 	} else {
2551 		panic("%s: so=%p NO PCB! lr=%p lrh= %s", __func__,
2552 		    so, lr_saved, solockhistory_nr(so));
2553 		/* NOTREACHED */
2554 	}
2555 	if (refcount) {
2556 		so->so_usecount++;
2557 	}
2558 
2559 	so->lock_lr[so->next_lock_lr] = lr_saved;
2560 	so->next_lock_lr = (so->next_lock_lr + 1) % SO_LCKDBG_MAX;
2561 	return 0;
2562 }
2563 
2564 int
udp_unlock(struct socket * so,int refcount,void * debug)2565 udp_unlock(struct socket *so, int refcount, void *debug)
2566 {
2567 	void *lr_saved;
2568 
2569 	if (debug == NULL) {
2570 		lr_saved = __builtin_return_address(0);
2571 	} else {
2572 		lr_saved = debug;
2573 	}
2574 
2575 	if (refcount) {
2576 		VERIFY(so->so_usecount > 0);
2577 		so->so_usecount--;
2578 	}
2579 	if (so->so_pcb == NULL) {
2580 		panic("%s: so=%p NO PCB! lr=%p lrh= %s", __func__,
2581 		    so, lr_saved, solockhistory_nr(so));
2582 		/* NOTREACHED */
2583 	} else {
2584 		LCK_MTX_ASSERT(&((struct inpcb *)so->so_pcb)->inpcb_mtx,
2585 		    LCK_MTX_ASSERT_OWNED);
2586 		so->unlock_lr[so->next_unlock_lr] = lr_saved;
2587 		so->next_unlock_lr = (so->next_unlock_lr + 1) % SO_LCKDBG_MAX;
2588 		lck_mtx_unlock(&((struct inpcb *)so->so_pcb)->inpcb_mtx);
2589 	}
2590 	return 0;
2591 }
2592 
2593 lck_mtx_t *
udp_getlock(struct socket * so,int flags)2594 udp_getlock(struct socket *so, int flags)
2595 {
2596 #pragma unused(flags)
2597 	struct inpcb *inp = sotoinpcb(so);
2598 
2599 	if (so->so_pcb == NULL) {
2600 		panic("%s: so=%p NULL so_pcb lrh= %s", __func__,
2601 		    so, solockhistory_nr(so));
2602 		/* NOTREACHED */
2603 	}
2604 	return &inp->inpcb_mtx;
2605 }
2606 
2607 /*
2608  * UDP garbage collector callback (inpcb_timer_func_t).
2609  *
2610  * Returns > 0 to keep timer active.
2611  */
2612 static void
udp_gc(struct inpcbinfo * ipi)2613 udp_gc(struct inpcbinfo *ipi)
2614 {
2615 	struct inpcb *inp, *inpnxt;
2616 	struct socket *so;
2617 
2618 	if (lck_rw_try_lock_exclusive(&ipi->ipi_lock) == FALSE) {
2619 		if (udp_gc_done == TRUE) {
2620 			udp_gc_done = FALSE;
2621 			/* couldn't get the lock, must lock next time */
2622 			atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2623 			return;
2624 		}
2625 		lck_rw_lock_exclusive(&ipi->ipi_lock);
2626 	}
2627 
2628 	udp_gc_done = TRUE;
2629 
2630 	for (inp = udb.lh_first; inp != NULL; inp = inpnxt) {
2631 		inpnxt = inp->inp_list.le_next;
2632 
2633 		/*
2634 		 * Skip unless it's STOPUSING; garbage collector will
2635 		 * be triggered by in_pcb_checkstate() upon setting
2636 		 * wantcnt to that value.  If the PCB is already dead,
2637 		 * keep gc active to anticipate wantcnt changing.
2638 		 */
2639 		if (inp->inp_wantcnt != WNT_STOPUSING) {
2640 			continue;
2641 		}
2642 
2643 		/*
2644 		 * Skip if busy, no hurry for cleanup.  Keep gc active
2645 		 * and try the lock again during next round.
2646 		 */
2647 		if (!socket_try_lock(inp->inp_socket)) {
2648 			atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2649 			continue;
2650 		}
2651 
2652 		/*
2653 		 * Keep gc active unless usecount is 0.
2654 		 */
2655 		so = inp->inp_socket;
2656 		if (so->so_usecount == 0) {
2657 			if (inp->inp_state != INPCB_STATE_DEAD) {
2658 				if (SOCK_CHECK_DOM(so, PF_INET6)) {
2659 					in6_pcbdetach(inp);
2660 				} else {
2661 					in_pcbdetach(inp);
2662 				}
2663 			}
2664 			in_pcbdispose(inp);
2665 		} else {
2666 			socket_unlock(so, 0);
2667 			atomic_add_32(&ipi->ipi_gc_req.intimer_fast, 1);
2668 		}
2669 	}
2670 	lck_rw_done(&ipi->ipi_lock);
2671 }
2672 
2673 static int
2674 udp_getstat SYSCTL_HANDLER_ARGS
2675 {
2676 #pragma unused(oidp, arg1, arg2)
2677 	if (req->oldptr == USER_ADDR_NULL) {
2678 		req->oldlen = (size_t)sizeof(struct udpstat);
2679 	}
2680 
2681 	return SYSCTL_OUT(req, &udpstat, MIN(sizeof(udpstat), req->oldlen));
2682 }
2683 
2684 void
udp_in_cksum_stats(u_int32_t len)2685 udp_in_cksum_stats(u_int32_t len)
2686 {
2687 	udpstat.udps_rcv_swcsum++;
2688 	udpstat.udps_rcv_swcsum_bytes += len;
2689 }
2690 
2691 void
udp_out_cksum_stats(u_int32_t len)2692 udp_out_cksum_stats(u_int32_t len)
2693 {
2694 	udpstat.udps_snd_swcsum++;
2695 	udpstat.udps_snd_swcsum_bytes += len;
2696 }
2697 
2698 void
udp_in6_cksum_stats(u_int32_t len)2699 udp_in6_cksum_stats(u_int32_t len)
2700 {
2701 	udpstat.udps_rcv6_swcsum++;
2702 	udpstat.udps_rcv6_swcsum_bytes += len;
2703 }
2704 
2705 void
udp_out6_cksum_stats(u_int32_t len)2706 udp_out6_cksum_stats(u_int32_t len)
2707 {
2708 	udpstat.udps_snd6_swcsum++;
2709 	udpstat.udps_snd6_swcsum_bytes += len;
2710 }
2711 
2712 /*
2713  * Checksum extended UDP header and data.
2714  */
2715 static int
udp_input_checksum(struct mbuf * m,struct udphdr * uh,int off,int ulen)2716 udp_input_checksum(struct mbuf *m, struct udphdr *uh, int off, int ulen)
2717 {
2718 	struct ifnet *ifp = m->m_pkthdr.rcvif;
2719 	struct ip *ip = mtod(m, struct ip *);
2720 	struct ipovly *ipov = (struct ipovly *)ip;
2721 
2722 	if (uh->uh_sum == 0) {
2723 		udpstat.udps_nosum++;
2724 		return 0;
2725 	}
2726 
2727 	/* ip_stripoptions() must have been called before we get here */
2728 	ASSERT((ip->ip_hl << 2) == sizeof(*ip));
2729 
2730 	if ((hwcksum_rx || (ifp->if_flags & IFF_LOOPBACK) ||
2731 	    (m->m_pkthdr.pkt_flags & PKTF_LOOP)) &&
2732 	    (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)) {
2733 		if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
2734 			uh->uh_sum = m->m_pkthdr.csum_rx_val;
2735 		} else {
2736 			uint32_t sum = m->m_pkthdr.csum_rx_val;
2737 			uint32_t start = m->m_pkthdr.csum_rx_start;
2738 			int32_t trailer = (m_pktlen(m) - (off + ulen));
2739 
2740 			/*
2741 			 * Perform 1's complement adjustment of octets
2742 			 * that got included/excluded in the hardware-
2743 			 * calculated checksum value.  Ignore cases
2744 			 * where the value already includes the entire
2745 			 * IP header span, as the sum for those octets
2746 			 * would already be 0 by the time we get here;
2747 			 * IP has already performed its header checksum
2748 			 * checks.  If we do need to adjust, restore
2749 			 * the original fields in the IP header when
2750 			 * computing the adjustment value.  Also take
2751 			 * care of any trailing bytes and subtract out
2752 			 * their partial sum.
2753 			 */
2754 			ASSERT(trailer >= 0);
2755 			if ((m->m_pkthdr.csum_flags & CSUM_PARTIAL) &&
2756 			    ((start != 0 && start != off) || trailer != 0)) {
2757 				uint32_t swbytes = (uint32_t)trailer;
2758 
2759 				if (start < off) {
2760 					ip->ip_len += sizeof(*ip);
2761 #if BYTE_ORDER != BIG_ENDIAN
2762 					HTONS(ip->ip_len);
2763 					HTONS(ip->ip_off);
2764 #endif /* BYTE_ORDER != BIG_ENDIAN */
2765 				}
2766 				/* callee folds in sum */
2767 				sum = m_adj_sum16(m, start, off, ulen, sum);
2768 				if (off > start) {
2769 					swbytes += (off - start);
2770 				} else {
2771 					swbytes += (start - off);
2772 				}
2773 
2774 				if (start < off) {
2775 #if BYTE_ORDER != BIG_ENDIAN
2776 					NTOHS(ip->ip_off);
2777 					NTOHS(ip->ip_len);
2778 #endif /* BYTE_ORDER != BIG_ENDIAN */
2779 					ip->ip_len -= sizeof(*ip);
2780 				}
2781 
2782 				if (swbytes != 0) {
2783 					udp_in_cksum_stats(swbytes);
2784 				}
2785 				if (trailer != 0) {
2786 					m_adj(m, -trailer);
2787 				}
2788 			}
2789 
2790 			/* callee folds in sum */
2791 			uh->uh_sum = in_pseudo(ip->ip_src.s_addr,
2792 			    ip->ip_dst.s_addr, sum + htonl(ulen + IPPROTO_UDP));
2793 		}
2794 		uh->uh_sum ^= 0xffff;
2795 	} else {
2796 		uint16_t ip_sum;
2797 		char b[9];
2798 
2799 		bcopy(ipov->ih_x1, b, sizeof(ipov->ih_x1));
2800 		bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
2801 		ip_sum = ipov->ih_len;
2802 		ipov->ih_len = uh->uh_ulen;
2803 		uh->uh_sum = in_cksum(m, ulen + sizeof(struct ip));
2804 		bcopy(b, ipov->ih_x1, sizeof(ipov->ih_x1));
2805 		ipov->ih_len = ip_sum;
2806 
2807 		udp_in_cksum_stats(ulen);
2808 	}
2809 
2810 	if (uh->uh_sum != 0) {
2811 		udpstat.udps_badsum++;
2812 		IF_UDP_STATINC(ifp, badchksum);
2813 		return -1;
2814 	}
2815 
2816 	return 0;
2817 }
2818 
2819 void
udp_fill_keepalive_offload_frames(ifnet_t ifp,struct ifnet_keepalive_offload_frame * frames_array,u_int32_t frames_array_count,size_t frame_data_offset,u_int32_t * used_frames_count)2820 udp_fill_keepalive_offload_frames(ifnet_t ifp,
2821     struct ifnet_keepalive_offload_frame *frames_array,
2822     u_int32_t frames_array_count, size_t frame_data_offset,
2823     u_int32_t *used_frames_count)
2824 {
2825 	struct inpcb *inp;
2826 	inp_gen_t gencnt;
2827 	u_int32_t frame_index = *used_frames_count;
2828 
2829 	if (ifp == NULL || frames_array == NULL ||
2830 	    frames_array_count == 0 ||
2831 	    frame_index >= frames_array_count ||
2832 	    frame_data_offset >= IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2833 		return;
2834 	}
2835 
2836 	lck_rw_lock_shared(&udbinfo.ipi_lock);
2837 	gencnt = udbinfo.ipi_gencnt;
2838 	LIST_FOREACH(inp, udbinfo.ipi_listhead, inp_list) {
2839 		struct socket *so;
2840 		u_int8_t *data;
2841 		struct ifnet_keepalive_offload_frame *frame;
2842 		struct mbuf *m = NULL;
2843 
2844 		if (frame_index >= frames_array_count) {
2845 			break;
2846 		}
2847 
2848 		if (inp->inp_gencnt > gencnt ||
2849 		    inp->inp_state == INPCB_STATE_DEAD) {
2850 			continue;
2851 		}
2852 
2853 		if ((so = inp->inp_socket) == NULL ||
2854 		    (so->so_state & SS_DEFUNCT)) {
2855 			continue;
2856 		}
2857 		/*
2858 		 * check for keepalive offload flag without socket
2859 		 * lock to avoid a deadlock
2860 		 */
2861 		if (!(inp->inp_flags2 & INP2_KEEPALIVE_OFFLOAD)) {
2862 			continue;
2863 		}
2864 
2865 		udp_lock(so, 1, 0);
2866 		if (!(inp->inp_vflag & (INP_IPV4 | INP_IPV6))) {
2867 			udp_unlock(so, 1, 0);
2868 			continue;
2869 		}
2870 		if ((inp->inp_vflag & INP_IPV4) &&
2871 		    (inp->inp_laddr.s_addr == INADDR_ANY ||
2872 		    inp->inp_faddr.s_addr == INADDR_ANY)) {
2873 			udp_unlock(so, 1, 0);
2874 			continue;
2875 		}
2876 		if ((inp->inp_vflag & INP_IPV6) &&
2877 		    (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) ||
2878 		    IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))) {
2879 			udp_unlock(so, 1, 0);
2880 			continue;
2881 		}
2882 		if (inp->inp_lport == 0 || inp->inp_fport == 0) {
2883 			udp_unlock(so, 1, 0);
2884 			continue;
2885 		}
2886 		if (inp->inp_last_outifp == NULL ||
2887 		    inp->inp_last_outifp->if_index != ifp->if_index) {
2888 			udp_unlock(so, 1, 0);
2889 			continue;
2890 		}
2891 		if ((inp->inp_vflag & INP_IPV4)) {
2892 			if ((frame_data_offset + sizeof(struct udpiphdr) +
2893 			    inp->inp_keepalive_datalen) >
2894 			    IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2895 				udp_unlock(so, 1, 0);
2896 				continue;
2897 			}
2898 			if ((sizeof(struct udpiphdr) +
2899 			    inp->inp_keepalive_datalen) > _MHLEN) {
2900 				udp_unlock(so, 1, 0);
2901 				continue;
2902 			}
2903 		} else {
2904 			if ((frame_data_offset + sizeof(struct ip6_hdr) +
2905 			    sizeof(struct udphdr) +
2906 			    inp->inp_keepalive_datalen) >
2907 			    IFNET_KEEPALIVE_OFFLOAD_FRAME_DATA_SIZE) {
2908 				udp_unlock(so, 1, 0);
2909 				continue;
2910 			}
2911 			if ((sizeof(struct ip6_hdr) + sizeof(struct udphdr) +
2912 			    inp->inp_keepalive_datalen) > _MHLEN) {
2913 				udp_unlock(so, 1, 0);
2914 				continue;
2915 			}
2916 		}
2917 		MGETHDR(m, M_WAIT, MT_HEADER);
2918 		if (m == NULL) {
2919 			udp_unlock(so, 1, 0);
2920 			continue;
2921 		}
2922 		/*
2923 		 * This inp has all the information that is needed to
2924 		 * generate an offload frame.
2925 		 */
2926 		if (inp->inp_vflag & INP_IPV4) {
2927 			struct ip *ip;
2928 			struct udphdr *udp;
2929 
2930 			frame = &frames_array[frame_index];
2931 			frame->length = (uint8_t)(frame_data_offset +
2932 			    sizeof(struct udpiphdr) +
2933 			    inp->inp_keepalive_datalen);
2934 			frame->ether_type =
2935 			    IFNET_KEEPALIVE_OFFLOAD_FRAME_ETHERTYPE_IPV4;
2936 			frame->interval = inp->inp_keepalive_interval;
2937 			switch (inp->inp_keepalive_type) {
2938 			case UDP_KEEPALIVE_OFFLOAD_TYPE_AIRPLAY:
2939 				frame->type =
2940 				    IFNET_KEEPALIVE_OFFLOAD_FRAME_AIRPLAY;
2941 				break;
2942 			default:
2943 				break;
2944 			}
2945 			data = mtod(m, u_int8_t *);
2946 			bzero(data, sizeof(struct udpiphdr));
2947 			ip = (__typeof__(ip))(void *)data;
2948 			udp = (__typeof__(udp))(void *) (data +
2949 			    sizeof(struct ip));
2950 			m->m_len = sizeof(struct udpiphdr);
2951 			data = data + sizeof(struct udpiphdr);
2952 			if (inp->inp_keepalive_datalen > 0 &&
2953 			    inp->inp_keepalive_data != NULL) {
2954 				bcopy(inp->inp_keepalive_data, data,
2955 				    inp->inp_keepalive_datalen);
2956 				m->m_len += inp->inp_keepalive_datalen;
2957 			}
2958 			m->m_pkthdr.len = m->m_len;
2959 
2960 			ip->ip_v = IPVERSION;
2961 			ip->ip_hl = (sizeof(struct ip) >> 2);
2962 			ip->ip_p = IPPROTO_UDP;
2963 			ip->ip_len = htons(sizeof(struct udpiphdr) +
2964 			    (u_short)inp->inp_keepalive_datalen);
2965 			ip->ip_ttl = inp->inp_ip_ttl;
2966 			ip->ip_tos |= (inp->inp_ip_tos & ~IPTOS_ECN_MASK);
2967 			ip->ip_src = inp->inp_laddr;
2968 			ip->ip_dst = inp->inp_faddr;
2969 			ip->ip_sum = in_cksum_hdr_opt(ip);
2970 
2971 			udp->uh_sport = inp->inp_lport;
2972 			udp->uh_dport = inp->inp_fport;
2973 			udp->uh_ulen = htons(sizeof(struct udphdr) +
2974 			    (u_short)inp->inp_keepalive_datalen);
2975 
2976 			if (!(inp->inp_flags & INP_UDP_NOCKSUM)) {
2977 				udp->uh_sum = in_pseudo(ip->ip_src.s_addr,
2978 				    ip->ip_dst.s_addr,
2979 				    htons(sizeof(struct udphdr) +
2980 				    (u_short)inp->inp_keepalive_datalen +
2981 				    IPPROTO_UDP));
2982 				m->m_pkthdr.csum_flags =
2983 				    (CSUM_UDP | CSUM_ZERO_INVERT);
2984 				m->m_pkthdr.csum_data = offsetof(struct udphdr,
2985 				    uh_sum);
2986 			}
2987 			m->m_pkthdr.pkt_proto = IPPROTO_UDP;
2988 			in_delayed_cksum(m);
2989 			bcopy(m->m_data, frame->data + frame_data_offset,
2990 			    m->m_len);
2991 		} else {
2992 			struct ip6_hdr *ip6;
2993 			struct udphdr *udp6;
2994 
2995 			VERIFY(inp->inp_vflag & INP_IPV6);
2996 			frame = &frames_array[frame_index];
2997 			frame->length = (uint8_t)(frame_data_offset +
2998 			    sizeof(struct ip6_hdr) +
2999 			    sizeof(struct udphdr) +
3000 			    inp->inp_keepalive_datalen);
3001 			frame->ether_type =
3002 			    IFNET_KEEPALIVE_OFFLOAD_FRAME_ETHERTYPE_IPV6;
3003 			frame->interval = inp->inp_keepalive_interval;
3004 			switch (inp->inp_keepalive_type) {
3005 			case UDP_KEEPALIVE_OFFLOAD_TYPE_AIRPLAY:
3006 				frame->type =
3007 				    IFNET_KEEPALIVE_OFFLOAD_FRAME_AIRPLAY;
3008 				break;
3009 			default:
3010 				break;
3011 			}
3012 			data = mtod(m, u_int8_t *);
3013 			bzero(data, sizeof(struct ip6_hdr) + sizeof(struct udphdr));
3014 			ip6 = (__typeof__(ip6))(void *)data;
3015 			udp6 = (__typeof__(udp6))(void *)(data +
3016 			    sizeof(struct ip6_hdr));
3017 			m->m_len = sizeof(struct ip6_hdr) +
3018 			    sizeof(struct udphdr);
3019 			data = data + (sizeof(struct ip6_hdr) +
3020 			    sizeof(struct udphdr));
3021 			if (inp->inp_keepalive_datalen > 0 &&
3022 			    inp->inp_keepalive_data != NULL) {
3023 				bcopy(inp->inp_keepalive_data, data,
3024 				    inp->inp_keepalive_datalen);
3025 				m->m_len += inp->inp_keepalive_datalen;
3026 			}
3027 			m->m_pkthdr.len = m->m_len;
3028 			ip6->ip6_flow = inp->inp_flow & IPV6_FLOWINFO_MASK;
3029 			ip6->ip6_flow = ip6->ip6_flow & ~IPV6_FLOW_ECN_MASK;
3030 			ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
3031 			ip6->ip6_vfc |= IPV6_VERSION;
3032 			ip6->ip6_nxt = IPPROTO_UDP;
3033 			ip6->ip6_hlim = (uint8_t)ip6_defhlim;
3034 			ip6->ip6_plen = htons(sizeof(struct udphdr) +
3035 			    (u_short)inp->inp_keepalive_datalen);
3036 			ip6->ip6_src = inp->in6p_laddr;
3037 			if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
3038 				ip6->ip6_src.s6_addr16[1] = 0;
3039 			}
3040 
3041 			ip6->ip6_dst = inp->in6p_faddr;
3042 			if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
3043 				ip6->ip6_dst.s6_addr16[1] = 0;
3044 			}
3045 
3046 			udp6->uh_sport = inp->in6p_lport;
3047 			udp6->uh_dport = inp->in6p_fport;
3048 			udp6->uh_ulen = htons(sizeof(struct udphdr) +
3049 			    (u_short)inp->inp_keepalive_datalen);
3050 			if (!(inp->inp_flags & INP_UDP_NOCKSUM)) {
3051 				udp6->uh_sum = in6_pseudo(&ip6->ip6_src,
3052 				    &ip6->ip6_dst,
3053 				    htonl(sizeof(struct udphdr) +
3054 				    (u_short)inp->inp_keepalive_datalen +
3055 				    IPPROTO_UDP));
3056 				m->m_pkthdr.csum_flags =
3057 				    (CSUM_UDPIPV6 | CSUM_ZERO_INVERT);
3058 				m->m_pkthdr.csum_data = offsetof(struct udphdr,
3059 				    uh_sum);
3060 			}
3061 			m->m_pkthdr.pkt_proto = IPPROTO_UDP;
3062 			in6_delayed_cksum(m);
3063 			bcopy(m->m_data, frame->data + frame_data_offset,
3064 			    m->m_len);
3065 		}
3066 		if (m != NULL) {
3067 			m_freem(m);
3068 			m = NULL;
3069 		}
3070 		frame_index++;
3071 		udp_unlock(so, 1, 0);
3072 	}
3073 	lck_rw_done(&udbinfo.ipi_lock);
3074 	*used_frames_count = frame_index;
3075 }
3076