sys/netinet6/udp6_usrreq.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   5  * Copyright (c) 2010-2011 Juniper Networks, Inc.
   6  * Copyright (c) 2014 Kevin Lo
   7  * All rights reserved.
   8  *
   9  * Portions of this software were developed by Robert N. M. Watson under
  10  * contract to Juniper Networks, Inc.
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer.
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  * 3. Neither the name of the project nor the names of its contributors
  21  *    may be used to endorse or promote products derived from this software
  22  *    without specific prior written permission.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  34  * SUCH DAMAGE.
  35  *
  36  *      $KAME: udp6_usrreq.c,v 1.27 2001/05/21 05:45:10 jinmei Exp $
  37  *      $KAME: udp6_output.c,v 1.31 2001/05/21 16:39:15 jinmei Exp $
  38  */
  39
  40 /*-
  41  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
  42  *      The Regents of the University of California.
  43  * All rights reserved.
  44  *
  45  * Redistribution and use in source and binary forms, with or without
  46  * modification, are permitted provided that the following conditions
  47  * are met:
  48  * 1. Redistributions of source code must retain the above copyright
  49  *    notice, this list of conditions and the following disclaimer.
  50  * 2. Redistributions in binary form must reproduce the above copyright
  51  *    notice, this list of conditions and the following disclaimer in the
  52  *    documentation and/or other materials provided with the distribution.
  53  * 3. Neither the name of the University nor the names of its contributors
  54  *    may be used to endorse or promote products derived from this software
  55  *    without specific prior written permission.
  56  *
  57  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  58  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  59  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  60  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  61  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  62  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  63  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  64  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  65  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  66  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  67  * SUCH DAMAGE.
  68  *
  69  *      @(#)udp_usrreq.c        8.6 (Berkeley) 5/23/95
  70  */
  71
  72 #include <sys/cdefs.h>
  73 __FBSDID("$FreeBSD$");
  74
  75 #include "opt_inet.h"
  76 #include "opt_inet6.h"
  77 #include "opt_ipsec.h"
  78 #include "opt_rss.h"
  79
  80 #include <sys/param.h>
  81 #include <sys/jail.h>
  82 #include <sys/kernel.h>
  83 #include <sys/lock.h>
  84 #include <sys/mbuf.h>
  85 #include <sys/priv.h>
  86 #include <sys/proc.h>
  87 #include <sys/protosw.h>
  88 #include <sys/sdt.h>
  89 #include <sys/signalvar.h>
  90 #include <sys/socket.h>
  91 #include <sys/socketvar.h>
  92 #include <sys/sx.h>
  93 #include <sys/sysctl.h>
  94 #include <sys/syslog.h>
  95 #include <sys/systm.h>
  96
  97 #include <net/if.h>
  98 #include <net/if_var.h>
  99 #include <net/if_types.h>
 100 #include <net/route.h>
 101 #include <net/rss_config.h>
 102
 103 #include <netinet/in.h>
 104 #include <netinet/in_kdtrace.h>
 105 #include <netinet/in_pcb.h>
 106 #include <netinet/in_systm.h>
 107 #include <netinet/in_var.h>
 108 #include <netinet/ip.h>
 109 #include <netinet/ip6.h>
 110 #include <netinet/icmp6.h>
 111 #include <netinet/ip_var.h>
 112 #include <netinet/udp.h>
 113 #include <netinet/udp_var.h>
 114 #include <netinet/udplite.h>
 115
 116 #include <netinet6/ip6protosw.h>
 117 #include <netinet6/ip6_var.h>
 118 #include <netinet6/in6_pcb.h>
 119 #include <netinet6/in6_rss.h>
 120 #include <netinet6/udp6_var.h>
 121 #include <netinet6/scope6_var.h>
 122
 123 #include <netipsec/ipsec_support.h>
 124
 125 #include <security/mac/mac_framework.h>
 126
 127 VNET_DEFINE(int, zero_checksum_port) = 0;
 128 #define V_zero_checksum_port    VNET(zero_checksum_port)
 129 SYSCTL_INT(_net_inet6_udp6, OID_AUTO, rfc6935_port, CTLFLAG_VNET | CTLFLAG_RW,
 130     &VNET_NAME(zero_checksum_port), 0,
 131     "Zero UDP checksum allowed for traffic to/from this port.");
 132 /*
 133  * UDP protocol implementation.
 134  * Per RFC 768, August, 1980.
 135  */
 136
 137 extern struct protosw   inetsw[];
 138 static void             udp6_detach(struct socket *so);
 139
 140 static int
 141 udp6_append(struct inpcb *inp, struct mbuf *n, int off,
 142     struct sockaddr_in6 *fromsa)
 143 {
 144         struct socket *so;
 145         struct mbuf *opts = NULL, *tmp_opts;
 146         struct udpcb *up;
 147
 148         INP_LOCK_ASSERT(inp);
 149
 150         /*
 151          * Engage the tunneling protocol.
 152          */
 153         up = intoudpcb(inp);
 154         if (up->u_tun_func != NULL) {
 155                 in_pcbref(inp);
 156                 INP_RUNLOCK(inp);
 157                 (*up->u_tun_func)(n, off, inp, (struct sockaddr *)&fromsa[0],
 158                     up->u_tun_ctx);
 159                 INP_RLOCK(inp);
 160                 return (in_pcbrele_rlocked(inp));
 161         }
 162 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
 163         /* Check AH/ESP integrity. */
 164         if (IPSEC_ENABLED(ipv6)) {
 165                 if (IPSEC_CHECK_POLICY(ipv6, n, inp) != 0) {
 166                         m_freem(n);
 167                         return (0);
 168                 }
 169         }
 170 #endif /* IPSEC */
 171 #ifdef MAC
 172         if (mac_inpcb_check_deliver(inp, n) != 0) {
 173                 m_freem(n);
 174                 return (0);
 175         }
 176 #endif
 177         opts = NULL;
 178         if (inp->inp_flags & INP_CONTROLOPTS ||
 179             inp->inp_socket->so_options & SO_TIMESTAMP)
 180                 ip6_savecontrol(inp, n, &opts);
 181         if ((inp->inp_vflag & INP_IPV6) && (inp->inp_flags2 & INP_ORIGDSTADDR)) {
 182                 tmp_opts = sbcreatecontrol((caddr_t)&fromsa[1],
 183                         sizeof(struct sockaddr_in6), IPV6_ORIGDSTADDR, IPPROTO_IPV6);
 184                 if (tmp_opts) {
 185                         if (opts) {
 186                                 tmp_opts->m_next = opts;
 187                                 opts = tmp_opts;
 188                         } else
 189                                 opts = tmp_opts;
 190                 }
 191         }
 192         m_adj(n, off + sizeof(struct udphdr));
 193
 194         so = inp->inp_socket;
 195         SOCKBUF_LOCK(&so->so_rcv);
 196         if (sbappendaddr_locked(&so->so_rcv, (struct sockaddr *)&fromsa[0], n,
 197             opts) == 0) {
 198                 SOCKBUF_UNLOCK(&so->so_rcv);
 199                 m_freem(n);
 200                 if (opts)
 201                         m_freem(opts);
 202                 UDPSTAT_INC(udps_fullsock);
 203         } else
 204                 sorwakeup_locked(so);
 205         return (0);
 206 }
 207
 208 int
 209 udp6_input(struct mbuf **mp, int *offp, int proto)
 210 {
 211         struct mbuf *m = *mp;
 212         struct ifnet *ifp;
 213         struct ip6_hdr *ip6;
 214         struct udphdr *uh;
 215         struct inpcb *inp;
 216         struct inpcbinfo *pcbinfo;
 217         struct udpcb *up;
 218         int off = *offp;
 219         int cscov_partial;
 220         int plen, ulen;
 221         struct sockaddr_in6 fromsa[2];
 222         struct m_tag *fwd_tag;
 223         uint16_t uh_sum;
 224         uint8_t nxt;
 225
 226         NET_EPOCH_ASSERT();
 227
 228         ifp = m->m_pkthdr.rcvif;
 229
 230         if (m->m_len < off + sizeof(struct udphdr)) {
 231                 m = m_pullup(m, off + sizeof(struct udphdr));
 232                 if (m == NULL) {
 233                         IP6STAT_INC(ip6s_exthdrtoolong);
 234                         *mp = NULL;
 235                         return (IPPROTO_DONE);
 236                 }
 237         }
 238         ip6 = mtod(m, struct ip6_hdr *);
 239         uh = (struct udphdr *)((caddr_t)ip6 + off);
 240
 241         UDPSTAT_INC(udps_ipackets);
 242
 243         /*
 244          * Destination port of 0 is illegal, based on RFC768.
 245          */
 246         if (uh->uh_dport == 0)
 247                 goto badunlocked;
 248
 249         plen = ntohs(ip6->ip6_plen) - off + sizeof(*ip6);
 250         ulen = ntohs((u_short)uh->uh_ulen);
 251
 252         nxt = proto;
 253         cscov_partial = (nxt == IPPROTO_UDPLITE) ? 1 : 0;
 254         if (nxt == IPPROTO_UDPLITE) {
 255                 /* Zero means checksum over the complete packet. */
 256                 if (ulen == 0)
 257                         ulen = plen;
 258                 if (ulen == plen)
 259                         cscov_partial = 0;
 260                 if ((ulen < sizeof(struct udphdr)) || (ulen > plen)) {
 261                         /* XXX: What is the right UDPLite MIB counter? */
 262                         goto badunlocked;
 263                 }
 264                 if (uh->uh_sum == 0) {
 265                         /* XXX: What is the right UDPLite MIB counter? */
 266                         goto badunlocked;
 267                 }
 268         } else {
 269                 if ((ulen < sizeof(struct udphdr)) || (plen != ulen)) {
 270                         UDPSTAT_INC(udps_badlen);
 271                         goto badunlocked;
 272                 }
 273                 if (uh->uh_sum == 0) {
 274                         UDPSTAT_INC(udps_nosum);
 275                         /*
 276                          * dport 0 was rejected earlier so this is OK even if
 277                          * zero_checksum_port is 0 (which is its default value).
 278                          */
 279                         if (ntohs(uh->uh_dport) == V_zero_checksum_port)
 280                                 goto skip_checksum;
 281                         else
 282                                 goto badunlocked;
 283                 }
 284         }
 285
 286         if ((m->m_pkthdr.csum_flags & CSUM_DATA_VALID_IPV6) &&
 287             !cscov_partial) {
 288                 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
 289                         uh_sum = m->m_pkthdr.csum_data;
 290                 else
 291                         uh_sum = in6_cksum_pseudo(ip6, ulen, nxt,
 292                             m->m_pkthdr.csum_data);
 293                 uh_sum ^= 0xffff;
 294         } else
 295                 uh_sum = in6_cksum_partial(m, nxt, off, plen, ulen);
 296
 297         if (uh_sum != 0) {
 298                 UDPSTAT_INC(udps_badsum);
 299                 goto badunlocked;
 300         }
 301
 302 skip_checksum:
 303         /*
 304          * Construct sockaddr format source address.
 305          */
 306         init_sin6(&fromsa[0], m, 0);
 307         fromsa[0].sin6_port = uh->uh_sport;
 308         init_sin6(&fromsa[1], m, 1);
 309         fromsa[1].sin6_port = uh->uh_dport;
 310
 311         pcbinfo = udp_get_inpcbinfo(nxt);
 312         if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
 313                 struct inpcb *last;
 314                 struct inpcbhead *pcblist;
 315                 struct ip6_moptions *imo;
 316
 317                 /*
 318                  * In the event that laddr should be set to the link-local
 319                  * address (this happens in RIPng), the multicast address
 320                  * specified in the received packet will not match laddr.  To
 321                  * handle this situation, matching is relaxed if the
 322                  * receiving interface is the same as one specified in the
 323                  * socket and if the destination multicast address matches
 324                  * one of the multicast groups specified in the socket.
 325                  */
 326
 327                 /*
 328                  * KAME note: traditionally we dropped udpiphdr from mbuf
 329                  * here.  We need udphdr for IPsec processing so we do that
 330                  * later.
 331                  */
 332                 pcblist = udp_get_pcblist(nxt);
 333                 last = NULL;
 334                 CK_LIST_FOREACH(inp, pcblist, inp_list) {
 335                         if ((inp->inp_vflag & INP_IPV6) == 0)
 336                                 continue;
 337                         if (inp->inp_lport != uh->uh_dport)
 338                                 continue;
 339                         if (inp->inp_fport != 0 &&
 340                             inp->inp_fport != uh->uh_sport)
 341                                 continue;
 342                         if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
 343                                 if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
 344                                                         &ip6->ip6_dst))
 345                                         continue;
 346                         }
 347                         if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
 348                                 if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr,
 349                                                         &ip6->ip6_src) ||
 350                                     inp->inp_fport != uh->uh_sport)
 351                                         continue;
 352                         }
 353
 354                         /*
 355                          * XXXRW: Because we weren't holding either the inpcb
 356                          * or the hash lock when we checked for a match
 357                          * before, we should probably recheck now that the
 358                          * inpcb lock is (supposed to be) held.
 359                          */
 360
 361                         /*
 362                          * Handle socket delivery policy for any-source
 363                          * and source-specific multicast. [RFC3678]
 364                          */
 365                         imo = inp->in6p_moptions;
 366                         if (imo && IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
 367                                 struct sockaddr_in6      mcaddr;
 368                                 int                      blocked;
 369
 370                                 INP_RLOCK(inp);
 371                                 if (__predict_false(inp->inp_flags2 & INP_FREED)) {
 372                                         INP_RUNLOCK(inp);
 373                                         continue;
 374                                 }
 375
 376                                 bzero(&mcaddr, sizeof(struct sockaddr_in6));
 377                                 mcaddr.sin6_len = sizeof(struct sockaddr_in6);
 378                                 mcaddr.sin6_family = AF_INET6;
 379                                 mcaddr.sin6_addr = ip6->ip6_dst;
 380
 381                                 blocked = im6o_mc_filter(imo, ifp,
 382                                         (struct sockaddr *)&mcaddr,
 383                                         (struct sockaddr *)&fromsa[0]);
 384                                 if (blocked != MCAST_PASS) {
 385                                         if (blocked == MCAST_NOTGMEMBER)
 386                                                 IP6STAT_INC(ip6s_notmember);
 387                                         if (blocked == MCAST_NOTSMEMBER ||
 388                                             blocked == MCAST_MUTED)
 389                                                 UDPSTAT_INC(udps_filtermcast);
 390                                         INP_RUNLOCK(inp); /* XXX */
 391                                         continue;
 392                                 }
 393
 394                                 INP_RUNLOCK(inp);
 395                         }
 396                         if (last != NULL) {
 397                                 struct mbuf *n;
 398
 399                                 if ((n = m_copym(m, 0, M_COPYALL, M_NOWAIT)) !=
 400                                     NULL) {
 401                                         INP_RLOCK(last);
 402                                         if (__predict_true(last->inp_flags2 & INP_FREED) == 0) {
 403                                                 if (nxt == IPPROTO_UDPLITE)
 404                                                         UDPLITE_PROBE(receive, NULL, last,
 405                                                             ip6, last, uh);
 406                                                 else
 407                                                         UDP_PROBE(receive, NULL, last,
 408                                                             ip6, last, uh);
 409                                                 if (udp6_append(last, n, off, fromsa)) {
 410                                                         /* XXX-BZ do we leak m here? */
 411                                                         *mp = NULL;
 412                                                         return (IPPROTO_DONE);
 413                                                 }
 414                                         }
 415                                         INP_RUNLOCK(last);
 416                                 }
 417                         }
 418                         last = inp;
 419                         /*
 420                          * Don't look for additional matches if this one does
 421                          * not have either the SO_REUSEPORT or SO_REUSEADDR
 422                          * socket options set.  This heuristic avoids
 423                          * searching through all pcbs in the common case of a
 424                          * non-shared port.  It assumes that an application
 425                          * will never clear these options after setting them.
 426                          */
 427                         if ((last->inp_socket->so_options &
 428                              (SO_REUSEPORT|SO_REUSEPORT_LB|SO_REUSEADDR)) == 0)
 429                                 break;
 430                 }
 431
 432                 if (last == NULL) {
 433                         /*
 434                          * No matching pcb found; discard datagram.  (No need
 435                          * to send an ICMP Port Unreachable for a broadcast
 436                          * or multicast datgram.)
 437                          */
 438                         UDPSTAT_INC(udps_noport);
 439                         UDPSTAT_INC(udps_noportmcast);
 440                         goto badunlocked;
 441                 }
 442                 INP_RLOCK(last);
 443                 if (__predict_true(last->inp_flags2 & INP_FREED) == 0) {
 444                         if (nxt == IPPROTO_UDPLITE)
 445                                 UDPLITE_PROBE(receive, NULL, last, ip6, last, uh);
 446                         else
 447                                 UDP_PROBE(receive, NULL, last, ip6, last, uh);
 448                         if (udp6_append(last, m, off, fromsa) == 0)
 449                                 INP_RUNLOCK(last);
 450                 } else
 451                         INP_RUNLOCK(last);
 452                 *mp = NULL;
 453                 return (IPPROTO_DONE);
 454         }
 455         /*
 456          * Locate pcb for datagram.
 457          */
 458
 459         /*
 460          * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
 461          */
 462         if ((m->m_flags & M_IP6_NEXTHOP) &&
 463             (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
 464                 struct sockaddr_in6 *next_hop6;
 465
 466                 next_hop6 = (struct sockaddr_in6 *)(fwd_tag + 1);
 467
 468                 /*
 469                  * Transparently forwarded. Pretend to be the destination.
 470                  * Already got one like this?
 471                  */
 472                 inp = in6_pcblookup_mbuf(pcbinfo, &ip6->ip6_src,
 473                     uh->uh_sport, &ip6->ip6_dst, uh->uh_dport,
 474                     INPLOOKUP_RLOCKPCB, m->m_pkthdr.rcvif, m);
 475                 if (!inp) {
 476                         /*
 477                          * It's new.  Try to find the ambushing socket.
 478                          * Because we've rewritten the destination address,
 479                          * any hardware-generated hash is ignored.
 480                          */
 481                         inp = in6_pcblookup(pcbinfo, &ip6->ip6_src,
 482                             uh->uh_sport, &next_hop6->sin6_addr,
 483                             next_hop6->sin6_port ? htons(next_hop6->sin6_port) :
 484                             uh->uh_dport, INPLOOKUP_WILDCARD |
 485                             INPLOOKUP_RLOCKPCB, m->m_pkthdr.rcvif);
 486                 }
 487                 /* Remove the tag from the packet. We don't need it anymore. */
 488                 m_tag_delete(m, fwd_tag);
 489                 m->m_flags &= ~M_IP6_NEXTHOP;
 490         } else
 491                 inp = in6_pcblookup_mbuf(pcbinfo, &ip6->ip6_src,
 492                     uh->uh_sport, &ip6->ip6_dst, uh->uh_dport,
 493                     INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB,
 494                     m->m_pkthdr.rcvif, m);
 495         if (inp == NULL) {
 496                 if (V_udp_log_in_vain) {
 497                         char ip6bufs[INET6_ADDRSTRLEN];
 498                         char ip6bufd[INET6_ADDRSTRLEN];
 499
 500                         log(LOG_INFO,
 501                             "Connection attempt to UDP [%s]:%d from [%s]:%d\n",
 502                             ip6_sprintf(ip6bufd, &ip6->ip6_dst),
 503                             ntohs(uh->uh_dport),
 504                             ip6_sprintf(ip6bufs, &ip6->ip6_src),
 505                             ntohs(uh->uh_sport));
 506                 }
 507                 if (nxt == IPPROTO_UDPLITE)
 508                         UDPLITE_PROBE(receive, NULL, NULL, ip6, NULL, uh);
 509                 else
 510                         UDP_PROBE(receive, NULL, NULL, ip6, NULL, uh);
 511                 UDPSTAT_INC(udps_noport);
 512                 if (m->m_flags & M_MCAST) {
 513                         printf("UDP6: M_MCAST is set in a unicast packet.\n");
 514                         UDPSTAT_INC(udps_noportmcast);
 515                         goto badunlocked;
 516                 }
 517                 if (V_udp_blackhole)
 518                         goto badunlocked;
 519                 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT, 0);
 520                 *mp = NULL;
 521                 return (IPPROTO_DONE);
 522         }
 523         INP_RLOCK_ASSERT(inp);
 524         up = intoudpcb(inp);
 525         if (cscov_partial) {
 526                 if (up->u_rxcslen == 0 || up->u_rxcslen > ulen) {
 527                         INP_RUNLOCK(inp);
 528                         m_freem(m);
 529                         *mp = NULL;
 530                         return (IPPROTO_DONE);
 531                 }
 532         }
 533         if (nxt == IPPROTO_UDPLITE)
 534                 UDPLITE_PROBE(receive, NULL, inp, ip6, inp, uh);
 535         else
 536                 UDP_PROBE(receive, NULL, inp, ip6, inp, uh);
 537         if (udp6_append(inp, m, off, fromsa) == 0)
 538                 INP_RUNLOCK(inp);
 539         *mp = NULL;
 540         return (IPPROTO_DONE);
 541
 542 badunlocked:
 543         m_freem(m);
 544         *mp = NULL;
 545         return (IPPROTO_DONE);
 546 }
 547
 548 static void
 549 udp6_common_ctlinput(int cmd, struct sockaddr *sa, void *d,
 550     struct inpcbinfo *pcbinfo)
 551 {
 552         struct udphdr uh;
 553         struct ip6_hdr *ip6;
 554         struct mbuf *m;
 555         int off = 0;
 556         struct ip6ctlparam *ip6cp = NULL;
 557         const struct sockaddr_in6 *sa6_src = NULL;
 558         void *cmdarg;
 559         struct inpcb *(*notify)(struct inpcb *, int) = udp_notify;
 560         struct udp_portonly {
 561                 u_int16_t uh_sport;
 562                 u_int16_t uh_dport;
 563         } *uhp;
 564
 565         if (sa->sa_family != AF_INET6 ||
 566             sa->sa_len != sizeof(struct sockaddr_in6))
 567                 return;
 568
 569         if ((unsigned)cmd >= PRC_NCMDS)
 570                 return;
 571         if (PRC_IS_REDIRECT(cmd))
 572                 notify = in6_rtchange, d = NULL;
 573         else if (cmd == PRC_HOSTDEAD)
 574                 d = NULL;
 575         else if (inet6ctlerrmap[cmd] == 0)
 576                 return;
 577
 578         /* if the parameter is from icmp6, decode it. */
 579         if (d != NULL) {
 580                 ip6cp = (struct ip6ctlparam *)d;
 581                 m = ip6cp->ip6c_m;
 582                 ip6 = ip6cp->ip6c_ip6;
 583                 off = ip6cp->ip6c_off;
 584                 cmdarg = ip6cp->ip6c_cmdarg;
 585                 sa6_src = ip6cp->ip6c_src;
 586         } else {
 587                 m = NULL;
 588                 ip6 = NULL;
 589                 cmdarg = NULL;
 590                 sa6_src = &sa6_any;
 591         }
 592
 593         if (ip6) {
 594                 /*
 595                  * XXX: We assume that when IPV6 is non NULL,
 596                  * M and OFF are valid.
 597                  */
 598
 599                 /* Check if we can safely examine src and dst ports. */
 600                 if (m->m_pkthdr.len < off + sizeof(*uhp))
 601                         return;
 602
 603                 bzero(&uh, sizeof(uh));
 604                 m_copydata(m, off, sizeof(*uhp), (caddr_t)&uh);
 605
 606                 if (!PRC_IS_REDIRECT(cmd)) {
 607                         /* Check to see if its tunneled */
 608                         struct inpcb *inp;
 609                         inp = in6_pcblookup_mbuf(pcbinfo, &ip6->ip6_dst,
 610                             uh.uh_dport, &ip6->ip6_src, uh.uh_sport,
 611                             INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB,
 612                             m->m_pkthdr.rcvif, m);
 613                         if (inp != NULL) {
 614                                 struct udpcb *up;
 615
 616                                 up = intoudpcb(inp);
 617                                 if (up->u_icmp_func) {
 618                                         /* Yes it is. */
 619                                         INP_RUNLOCK(inp);
 620                                         (*up->u_icmp_func)(cmd, (struct sockaddr *)ip6cp->ip6c_src,
 621                                               d, up->u_tun_ctx);
 622                                         return;
 623                                 } else {
 624                                         /* Can't find it. */
 625                                         INP_RUNLOCK(inp);
 626                                 }
 627                         }
 628                 }
 629                 (void)in6_pcbnotify(pcbinfo, sa, uh.uh_dport,
 630                     (struct sockaddr *)ip6cp->ip6c_src, uh.uh_sport, cmd,
 631                     cmdarg, notify);
 632         } else
 633                 (void)in6_pcbnotify(pcbinfo, sa, 0,
 634                     (const struct sockaddr *)sa6_src, 0, cmd, cmdarg, notify);
 635 }
 636
 637 void
 638 udp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
 639 {
 640
 641         return (udp6_common_ctlinput(cmd, sa, d, &V_udbinfo));
 642 }
 643
 644 void
 645 udplite6_ctlinput(int cmd, struct sockaddr *sa, void *d)
 646 {
 647
 648         return (udp6_common_ctlinput(cmd, sa, d, &V_ulitecbinfo));
 649 }
 650
 651 static int
 652 udp6_getcred(SYSCTL_HANDLER_ARGS)
 653 {
 654         struct xucred xuc;
 655         struct sockaddr_in6 addrs[2];
 656         struct epoch_tracker et;
 657         struct inpcb *inp;
 658         int error;
 659
 660         error = priv_check(req->td, PRIV_NETINET_GETCRED);
 661         if (error)
 662                 return (error);
 663
 664         if (req->newlen != sizeof(addrs))
 665                 return (EINVAL);
 666         if (req->oldlen != sizeof(struct xucred))
 667                 return (EINVAL);
 668         error = SYSCTL_IN(req, addrs, sizeof(addrs));
 669         if (error)
 670                 return (error);
 671         if ((error = sa6_embedscope(&addrs[0], V_ip6_use_defzone)) != 0 ||
 672             (error = sa6_embedscope(&addrs[1], V_ip6_use_defzone)) != 0) {
 673                 return (error);
 674         }
 675         NET_EPOCH_ENTER(et);
 676         inp = in6_pcblookup(&V_udbinfo, &addrs[1].sin6_addr,
 677             addrs[1].sin6_port, &addrs[0].sin6_addr, addrs[0].sin6_port,
 678             INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB, NULL);
 679         NET_EPOCH_EXIT(et);
 680         if (inp != NULL) {
 681                 INP_RLOCK_ASSERT(inp);
 682                 if (inp->inp_socket == NULL)
 683                         error = ENOENT;
 684                 if (error == 0)
 685                         error = cr_canseesocket(req->td->td_ucred,
 686                             inp->inp_socket);
 687                 if (error == 0)
 688                         cru2x(inp->inp_cred, &xuc);
 689                 INP_RUNLOCK(inp);
 690         } else
 691                 error = ENOENT;
 692         if (error == 0)
 693                 error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
 694         return (error);
 695 }
 696
 697 SYSCTL_PROC(_net_inet6_udp6, OID_AUTO, getcred,
 698     CTLTYPE_OPAQUE | CTLFLAG_RW | CTLFLAG_MPSAFE,
 699     0, 0, udp6_getcred, "S,xucred",
 700     "Get the xucred of a UDP6 connection");
 701
 702 static int
 703 udp6_output(struct socket *so, int flags_arg, struct mbuf *m,
 704     struct sockaddr *addr6, struct mbuf *control, struct thread *td)
 705 {
 706         struct inpcb *inp;
 707         struct ip6_hdr *ip6;
 708         struct udphdr *udp6;
 709         struct in6_addr *laddr, *faddr, in6a;
 710         struct ip6_pktopts *optp, opt;
 711         struct sockaddr_in6 *sin6, tmp;
 712         struct epoch_tracker et;
 713         int cscov_partial, error, flags, hlen, scope_ambiguous;
 714         u_int32_t ulen, plen;
 715         uint16_t cscov;
 716         u_short fport;
 717         uint8_t nxt;
 718
 719         /* addr6 has been validated in udp6_send(). */
 720         sin6 = (struct sockaddr_in6 *)addr6;
 721
 722         /*
 723          * In contrast to to IPv4 we do not validate the max. packet length
 724          * here due to IPv6 Jumbograms (RFC2675).
 725          */
 726
 727         scope_ambiguous = 0;
 728         if (sin6) {
 729                 /* Protect *addr6 from overwrites. */
 730                 tmp = *sin6;
 731                 sin6 = &tmp;
 732
 733                 /*
 734                  * Application should provide a proper zone ID or the use of
 735                  * default zone IDs should be enabled.  Unfortunately, some
 736                  * applications do not behave as it should, so we need a
 737                  * workaround.  Even if an appropriate ID is not determined,
 738                  * we'll see if we can determine the outgoing interface.  If we
 739                  * can, determine the zone ID based on the interface below.
 740                  */
 741                 if (sin6->sin6_scope_id == 0 && !V_ip6_use_defzone)
 742                         scope_ambiguous = 1;
 743                 if ((error = sa6_embedscope(sin6, V_ip6_use_defzone)) != 0) {
 744                         if (control)
 745                                 m_freem(control);
 746                         m_freem(m);
 747                         return (error);
 748                 }
 749         }
 750
 751         inp = sotoinpcb(so);
 752         KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
 753         /*
 754          * In the following cases we want a write lock on the inp for either
 755          * local operations or for possible route cache updates in the IPv6
 756          * output path:
 757          * - on connected sockets (sin6 is NULL) for route cache updates,
 758          * - when we are not bound to an address and source port (it is
 759          *   in6_pcbsetport() which will require the write lock).
 760          *
 761          * We check the inp fields before actually locking the inp, so
 762          * here exists a race, and we may WLOCK the inp and end with already
 763          * bound one by other thread. This is fine.
 764          */
 765         if (sin6 == NULL || (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) &&
 766             inp->inp_lport == 0))
 767                 INP_WLOCK(inp);
 768         else
 769                 INP_RLOCK(inp);
 770
 771         nxt = (inp->inp_socket->so_proto->pr_protocol == IPPROTO_UDP) ?
 772             IPPROTO_UDP : IPPROTO_UDPLITE;
 773
 774 #ifdef INET
 775         if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
 776                 int hasv4addr;
 777
 778                 if (sin6 == NULL)
 779                         hasv4addr = (inp->inp_vflag & INP_IPV4);
 780                 else
 781                         hasv4addr = IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)
 782                             ? 1 : 0;
 783                 if (hasv4addr) {
 784                         struct pr_usrreqs *pru;
 785
 786                         /*
 787                          * XXXRW: We release UDP-layer locks before calling
 788                          * udp_send() in order to avoid recursion.  However,
 789                          * this does mean there is a short window where inp's
 790                          * fields are unstable.  Could this lead to a
 791                          * potential race in which the factors causing us to
 792                          * select the UDPv4 output routine are invalidated?
 793                          */
 794                         INP_UNLOCK(inp);
 795                         if (sin6)
 796                                 in6_sin6_2_sin_in_sock((struct sockaddr *)sin6);
 797                         pru = inetsw[ip_protox[nxt]].pr_usrreqs;
 798                         /* addr will just be freed in sendit(). */
 799                         return ((*pru->pru_send)(so, flags_arg | PRUS_IPV6, m,
 800                             (struct sockaddr *)sin6, control, td));
 801                 }
 802         } else
 803 #endif
 804         if (sin6 && IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
 805                 /*
 806                  * Given this is either an IPv6-only socket or no INET is
 807                  * supported we will fail the send if the given destination
 808                  * address is a v4mapped address.
 809                  *
 810                  * XXXGL: do we leak m and control?
 811                  */
 812                 INP_UNLOCK(inp);
 813                 return (EINVAL);
 814         }
 815
 816         if (control) {
 817                 if ((error = ip6_setpktopts(control, &opt,
 818                     inp->in6p_outputopts, td->td_ucred, nxt)) != 0) {
 819                         INP_UNLOCK(inp);
 820                         ip6_clearpktopts(&opt, -1);
 821                         if (control)
 822                                 m_freem(control);
 823                         m_freem(m);
 824                         return (error);
 825                 }
 826                 optp = &opt;
 827         } else
 828                 optp = inp->in6p_outputopts;
 829
 830         NET_EPOCH_ENTER(et);
 831         if (sin6) {
 832                 /*
 833                  * Since we saw no essential reason for calling in_pcbconnect,
 834                  * we get rid of such kind of logic, and call in6_selectsrc
 835                  * and in6_pcbsetport in order to fill in the local address
 836                  * and the local port.
 837                  */
 838                 if (sin6->sin6_port == 0) {
 839                         error = EADDRNOTAVAIL;
 840                         goto release;
 841                 }
 842
 843                 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
 844                         /* how about ::ffff:0.0.0.0 case? */
 845                         error = EISCONN;
 846                         goto release;
 847                 }
 848
 849                 /*
 850                  * Given we handle the v4mapped case in the INET block above
 851                  * assert here that it must not happen anymore.
 852                  */
 853                 KASSERT(!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr),
 854                     ("%s: sin6(%p)->sin6_addr is v4mapped which we "
 855                     "should have handled.", __func__, sin6));
 856
 857                 /* This only requires read-locking. */
 858                 error = in6_selectsrc_socket(sin6, optp, inp,
 859                     td->td_ucred, scope_ambiguous, &in6a, NULL);
 860                 if (error)
 861                         goto release;
 862                 laddr = &in6a;
 863
 864                 if (inp->inp_lport == 0) {
 865                         struct inpcbinfo *pcbinfo;
 866
 867                         INP_WLOCK_ASSERT(inp);
 868
 869                         pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
 870                         INP_HASH_WLOCK(pcbinfo);
 871                         error = in6_pcbsetport(laddr, inp, td->td_ucred);
 872                         INP_HASH_WUNLOCK(pcbinfo);
 873                         if (error != 0) {
 874                                 /* Undo an address bind that may have occurred. */
 875                                 inp->in6p_laddr = in6addr_any;
 876                                 goto release;
 877                         }
 878                 }
 879                 faddr = &sin6->sin6_addr;
 880                 fport = sin6->sin6_port; /* allow 0 port */
 881
 882         } else {
 883                 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
 884                         error = ENOTCONN;
 885                         goto release;
 886                 }
 887                 laddr = &inp->in6p_laddr;
 888                 faddr = &inp->in6p_faddr;
 889                 fport = inp->inp_fport;
 890         }
 891
 892         ulen = m->m_pkthdr.len;
 893         plen = sizeof(struct udphdr) + ulen;
 894         hlen = sizeof(struct ip6_hdr);
 895
 896         /*
 897          * Calculate data length and get a mbuf
 898          * for UDP and IP6 headers.
 899          */
 900         M_PREPEND(m, hlen + sizeof(struct udphdr), M_NOWAIT);
 901         if (m == NULL) {
 902                 error = ENOBUFS;
 903                 goto release;
 904         }
 905
 906         /*
 907          * Stuff checksum and output datagram.
 908          */
 909         cscov = cscov_partial = 0;
 910         udp6 = (struct udphdr *)(mtod(m, caddr_t) + hlen);
 911         udp6->uh_sport = inp->inp_lport; /* lport is always set in the PCB */
 912         udp6->uh_dport = fport;
 913         if (nxt == IPPROTO_UDPLITE) {
 914                 struct udpcb *up;
 915
 916                 up = intoudpcb(inp);
 917                 cscov = up->u_txcslen;
 918                 if (cscov >= plen)
 919                         cscov = 0;
 920                 udp6->uh_ulen = htons(cscov);
 921                 /*
 922                  * For UDP-Lite, checksum coverage length of zero means
 923                  * the entire UDPLite packet is covered by the checksum.
 924                  */
 925                 cscov_partial = (cscov == 0) ? 0 : 1;
 926         } else if (plen <= 0xffff)
 927                 udp6->uh_ulen = htons((u_short)plen);
 928         else
 929                 udp6->uh_ulen = 0;
 930         udp6->uh_sum = 0;
 931
 932         ip6 = mtod(m, struct ip6_hdr *);
 933         ip6->ip6_flow   = inp->inp_flow & IPV6_FLOWINFO_MASK;
 934         ip6->ip6_vfc    &= ~IPV6_VERSION_MASK;
 935         ip6->ip6_vfc    |= IPV6_VERSION;
 936         ip6->ip6_plen   = htons((u_short)plen);
 937         ip6->ip6_nxt    = nxt;
 938         ip6->ip6_hlim   = in6_selecthlim(inp, NULL);
 939         ip6->ip6_src    = *laddr;
 940         ip6->ip6_dst    = *faddr;
 941
 942 #ifdef MAC
 943         mac_inpcb_create_mbuf(inp, m);
 944 #endif
 945
 946         if (cscov_partial) {
 947                 if ((udp6->uh_sum = in6_cksum_partial(m, nxt,
 948                     sizeof(struct ip6_hdr), plen, cscov)) == 0)
 949                         udp6->uh_sum = 0xffff;
 950         } else {
 951                 udp6->uh_sum = in6_cksum_pseudo(ip6, plen, nxt, 0);
 952                 m->m_pkthdr.csum_flags = CSUM_UDP_IPV6;
 953                 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
 954         }
 955
 956         flags = 0;
 957 #ifdef  RSS
 958         {
 959                 uint32_t hash_val, hash_type;
 960                 uint8_t pr;
 961
 962                 pr = inp->inp_socket->so_proto->pr_protocol;
 963                 /*
 964                  * Calculate an appropriate RSS hash for UDP and
 965                  * UDP Lite.
 966                  *
 967                  * The called function will take care of figuring out
 968                  * whether a 2-tuple or 4-tuple hash is required based
 969                  * on the currently configured scheme.
 970                  *
 971                  * Later later on connected socket values should be
 972                  * cached in the inpcb and reused, rather than constantly
 973                  * re-calculating it.
 974                  *
 975                  * UDP Lite is a different protocol number and will
 976                  * likely end up being hashed as a 2-tuple until
 977                  * RSS / NICs grow UDP Lite protocol awareness.
 978                  */
 979                 if (rss_proto_software_hash_v6(faddr, laddr, fport,
 980                     inp->inp_lport, pr, &hash_val, &hash_type) == 0) {
 981                         m->m_pkthdr.flowid = hash_val;
 982                         M_HASHTYPE_SET(m, hash_type);
 983                 }
 984
 985                 /*
 986                  * Don't override with the inp cached flowid.
 987                  *
 988                  * Until the whole UDP path is vetted, it may actually
 989                  * be incorrect.
 990                  */
 991                 flags |= IP_NODEFAULTFLOWID;
 992         }
 993 #endif
 994
 995         UDPSTAT_INC(udps_opackets);
 996         if (nxt == IPPROTO_UDPLITE)
 997                 UDPLITE_PROBE(send, NULL, inp, ip6, inp, udp6);
 998         else
 999                 UDP_PROBE(send, NULL, inp, ip6, inp, udp6);
1000         error = ip6_output(m, optp,
1001             INP_WLOCKED(inp) ? &inp->inp_route6 : NULL, flags,
1002             inp->in6p_moptions, NULL, inp);
1003         INP_UNLOCK(inp);
1004         NET_EPOCH_EXIT(et);
1005
1006         if (control) {
1007                 ip6_clearpktopts(&opt, -1);
1008                 m_freem(control);
1009         }
1010         return (error);
1011
1012 release:
1013         INP_UNLOCK(inp);
1014         NET_EPOCH_EXIT(et);
1015         if (control) {
1016                 ip6_clearpktopts(&opt, -1);
1017                 m_freem(control);
1018         }
1019         m_freem(m);
1020
1021         return (error);
1022 }
1023
1024 static void
1025 udp6_abort(struct socket *so)
1026 {
1027         struct inpcb *inp;
1028         struct inpcbinfo *pcbinfo;
1029
1030         pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1031         inp = sotoinpcb(so);
1032         KASSERT(inp != NULL, ("udp6_abort: inp == NULL"));
1033
1034         INP_WLOCK(inp);
1035 #ifdef INET
1036         if (inp->inp_vflag & INP_IPV4) {
1037                 struct pr_usrreqs *pru;
1038                 uint8_t nxt;
1039
1040                 nxt = (inp->inp_socket->so_proto->pr_protocol == IPPROTO_UDP) ?
1041                     IPPROTO_UDP : IPPROTO_UDPLITE;
1042                 INP_WUNLOCK(inp);
1043                 pru = inetsw[ip_protox[nxt]].pr_usrreqs;
1044                 (*pru->pru_abort)(so);
1045                 return;
1046         }
1047 #endif
1048
1049         if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1050                 INP_HASH_WLOCK(pcbinfo);
1051                 in6_pcbdisconnect(inp);
1052                 inp->in6p_laddr = in6addr_any;
1053                 INP_HASH_WUNLOCK(pcbinfo);
1054                 soisdisconnected(so);
1055         }
1056         INP_WUNLOCK(inp);
1057 }
1058
1059 static int
1060 udp6_attach(struct socket *so, int proto, struct thread *td)
1061 {
1062         struct inpcb *inp;
1063         struct inpcbinfo *pcbinfo;
1064         int error;
1065
1066         pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1067         inp = sotoinpcb(so);
1068         KASSERT(inp == NULL, ("udp6_attach: inp != NULL"));
1069
1070         if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
1071                 error = soreserve(so, udp_sendspace, udp_recvspace);
1072                 if (error)
1073                         return (error);
1074         }
1075         INP_INFO_WLOCK(pcbinfo);
1076         error = in_pcballoc(so, pcbinfo);
1077         if (error) {
1078                 INP_INFO_WUNLOCK(pcbinfo);
1079                 return (error);
1080         }
1081         inp = (struct inpcb *)so->so_pcb;
1082         inp->inp_vflag |= INP_IPV6;
1083         if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0)
1084                 inp->inp_vflag |= INP_IPV4;
1085         inp->in6p_hops = -1;    /* use kernel default */
1086         inp->in6p_cksum = -1;   /* just to be sure */
1087         /*
1088          * XXX: ugly!!
1089          * IPv4 TTL initialization is necessary for an IPv6 socket as well,
1090          * because the socket may be bound to an IPv6 wildcard address,
1091          * which may match an IPv4-mapped IPv6 address.
1092          */
1093         inp->inp_ip_ttl = V_ip_defttl;
1094
1095         error = udp_newudpcb(inp);
1096         if (error) {
1097                 in_pcbdetach(inp);
1098                 in_pcbfree(inp);
1099                 INP_INFO_WUNLOCK(pcbinfo);
1100                 return (error);
1101         }
1102         INP_WUNLOCK(inp);
1103         INP_INFO_WUNLOCK(pcbinfo);
1104         return (0);
1105 }
1106
1107 static int
1108 udp6_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
1109 {
1110         struct inpcb *inp;
1111         struct inpcbinfo *pcbinfo;
1112         int error;
1113         u_char vflagsav;
1114
1115         pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1116         inp = sotoinpcb(so);
1117         KASSERT(inp != NULL, ("udp6_bind: inp == NULL"));
1118
1119         INP_WLOCK(inp);
1120         INP_HASH_WLOCK(pcbinfo);
1121         vflagsav = inp->inp_vflag;
1122         inp->inp_vflag &= ~INP_IPV4;
1123         inp->inp_vflag |= INP_IPV6;
1124         if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
1125                 struct sockaddr_in6 *sin6_p;
1126
1127                 sin6_p = (struct sockaddr_in6 *)nam;
1128
1129                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6_p->sin6_addr))
1130                         inp->inp_vflag |= INP_IPV4;
1131 #ifdef INET
1132                 else if (IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr)) {
1133                         struct sockaddr_in sin;
1134
1135                         in6_sin6_2_sin(&sin, sin6_p);
1136                         inp->inp_vflag |= INP_IPV4;
1137                         inp->inp_vflag &= ~INP_IPV6;
1138                         error = in_pcbbind(inp, (struct sockaddr *)&sin,
1139                             td->td_ucred);
1140                         goto out;
1141                 }
1142 #endif
1143         }
1144
1145         error = in6_pcbbind(inp, nam, td->td_ucred);
1146 #ifdef INET
1147 out:
1148 #endif
1149         if (error != 0)
1150                 inp->inp_vflag = vflagsav;
1151         INP_HASH_WUNLOCK(pcbinfo);
1152         INP_WUNLOCK(inp);
1153         return (error);
1154 }
1155
1156 static void
1157 udp6_close(struct socket *so)
1158 {
1159         struct inpcb *inp;
1160         struct inpcbinfo *pcbinfo;
1161
1162         pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1163         inp = sotoinpcb(so);
1164         KASSERT(inp != NULL, ("udp6_close: inp == NULL"));
1165
1166         INP_WLOCK(inp);
1167 #ifdef INET
1168         if (inp->inp_vflag & INP_IPV4) {
1169                 struct pr_usrreqs *pru;
1170                 uint8_t nxt;
1171
1172                 nxt = (inp->inp_socket->so_proto->pr_protocol == IPPROTO_UDP) ?
1173                     IPPROTO_UDP : IPPROTO_UDPLITE;
1174                 INP_WUNLOCK(inp);
1175                 pru = inetsw[ip_protox[nxt]].pr_usrreqs;
1176                 (*pru->pru_disconnect)(so);
1177                 return;
1178         }
1179 #endif
1180         if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1181                 INP_HASH_WLOCK(pcbinfo);
1182                 in6_pcbdisconnect(inp);
1183                 inp->in6p_laddr = in6addr_any;
1184                 INP_HASH_WUNLOCK(pcbinfo);
1185                 soisdisconnected(so);
1186         }
1187         INP_WUNLOCK(inp);
1188 }
1189
1190 static int
1191 udp6_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1192 {
1193 #ifdef INET
1194         struct epoch_tracker et;
1195 #endif
1196         struct inpcb *inp;
1197         struct inpcbinfo *pcbinfo;
1198         struct sockaddr_in6 *sin6;
1199         int error;
1200         u_char vflagsav;
1201
1202         pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1203         inp = sotoinpcb(so);
1204         sin6 = (struct sockaddr_in6 *)nam;
1205         KASSERT(inp != NULL, ("udp6_connect: inp == NULL"));
1206
1207         /*
1208          * XXXRW: Need to clarify locking of v4/v6 flags.
1209          */
1210         INP_WLOCK(inp);
1211 #ifdef INET
1212         if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
1213                 struct sockaddr_in sin;
1214
1215                 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
1216                         error = EINVAL;
1217                         goto out;
1218                 }
1219                 if ((inp->inp_vflag & INP_IPV4) == 0) {
1220                         error = EAFNOSUPPORT;
1221                         goto out;
1222                 }
1223                 if (inp->inp_faddr.s_addr != INADDR_ANY) {
1224                         error = EISCONN;
1225                         goto out;
1226                 }
1227                 in6_sin6_2_sin(&sin, sin6);
1228                 error = prison_remote_ip4(td->td_ucred, &sin.sin_addr);
1229                 if (error != 0)
1230                         goto out;
1231                 vflagsav = inp->inp_vflag;
1232                 inp->inp_vflag |= INP_IPV4;
1233                 inp->inp_vflag &= ~INP_IPV6;
1234                 NET_EPOCH_ENTER(et);
1235                 INP_HASH_WLOCK(pcbinfo);
1236                 error = in_pcbconnect(inp, (struct sockaddr *)&sin,
1237                     td->td_ucred);
1238                 INP_HASH_WUNLOCK(pcbinfo);
1239                 NET_EPOCH_EXIT(et);
1240                 /*
1241                  * If connect succeeds, mark socket as connected. If
1242                  * connect fails and socket is unbound, reset inp_vflag
1243                  * field.
1244                  */
1245                 if (error == 0)
1246                         soisconnected(so);
1247                 else if (inp->inp_laddr.s_addr == INADDR_ANY &&
1248                     inp->inp_lport == 0)
1249                         inp->inp_vflag = vflagsav;
1250                 goto out;
1251         } else {
1252                 if ((inp->inp_vflag & INP_IPV6) == 0) {
1253                         error = EAFNOSUPPORT;
1254                         goto out;
1255                 }
1256         }
1257 #endif
1258         if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1259                 error = EISCONN;
1260                 goto out;
1261         }
1262         error = prison_remote_ip6(td->td_ucred, &sin6->sin6_addr);
1263         if (error != 0)
1264                 goto out;
1265         vflagsav = inp->inp_vflag;
1266         inp->inp_vflag &= ~INP_IPV4;
1267         inp->inp_vflag |= INP_IPV6;
1268         INP_HASH_WLOCK(pcbinfo);
1269         error = in6_pcbconnect(inp, nam, td->td_ucred);
1270         INP_HASH_WUNLOCK(pcbinfo);
1271         /*
1272          * If connect succeeds, mark socket as connected. If
1273          * connect fails and socket is unbound, reset inp_vflag
1274          * field.
1275          */
1276         if (error == 0)
1277                 soisconnected(so);
1278         else if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) &&
1279             inp->inp_lport == 0)
1280                 inp->inp_vflag = vflagsav;
1281 out:
1282         INP_WUNLOCK(inp);
1283         return (error);
1284 }
1285
1286 static void
1287 udp6_detach(struct socket *so)
1288 {
1289         struct inpcb *inp;
1290         struct inpcbinfo *pcbinfo;
1291         struct udpcb *up;
1292
1293         pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1294         inp = sotoinpcb(so);
1295         KASSERT(inp != NULL, ("udp6_detach: inp == NULL"));
1296
1297         INP_INFO_WLOCK(pcbinfo);
1298         INP_WLOCK(inp);
1299         up = intoudpcb(inp);
1300         KASSERT(up != NULL, ("%s: up == NULL", __func__));
1301         in_pcbdetach(inp);
1302         in_pcbfree(inp);
1303         INP_INFO_WUNLOCK(pcbinfo);
1304         udp_discardcb(up);
1305 }
1306
1307 static int
1308 udp6_disconnect(struct socket *so)
1309 {
1310         struct inpcb *inp;
1311         struct inpcbinfo *pcbinfo;
1312
1313         pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1314         inp = sotoinpcb(so);
1315         KASSERT(inp != NULL, ("udp6_disconnect: inp == NULL"));
1316
1317         INP_WLOCK(inp);
1318 #ifdef INET
1319         if (inp->inp_vflag & INP_IPV4) {
1320                 struct pr_usrreqs *pru;
1321                 uint8_t nxt;
1322
1323                 nxt = (inp->inp_socket->so_proto->pr_protocol == IPPROTO_UDP) ?
1324                     IPPROTO_UDP : IPPROTO_UDPLITE;
1325                 INP_WUNLOCK(inp);
1326                 pru = inetsw[ip_protox[nxt]].pr_usrreqs;
1327                 (void)(*pru->pru_disconnect)(so);
1328                 return (0);
1329         }
1330 #endif
1331
1332         if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1333                 INP_WUNLOCK(inp);
1334                 return (ENOTCONN);
1335         }
1336
1337         INP_HASH_WLOCK(pcbinfo);
1338         in6_pcbdisconnect(inp);
1339         inp->in6p_laddr = in6addr_any;
1340         INP_HASH_WUNLOCK(pcbinfo);
1341         SOCK_LOCK(so);
1342         so->so_state &= ~SS_ISCONNECTED;                /* XXX */
1343         SOCK_UNLOCK(so);
1344         INP_WUNLOCK(inp);
1345         return (0);
1346 }
1347
1348 static int
1349 udp6_send(struct socket *so, int flags, struct mbuf *m,
1350     struct sockaddr *addr, struct mbuf *control, struct thread *td)
1351 {
1352         int error;
1353
1354         if (addr) {
1355                 if (addr->sa_len != sizeof(struct sockaddr_in6)) {
1356                         error = EINVAL;
1357                         goto bad;
1358                 }
1359                 if (addr->sa_family != AF_INET6) {
1360                         error = EAFNOSUPPORT;
1361                         goto bad;
1362                 }
1363         }
1364
1365         return (udp6_output(so, flags, m, addr, control, td));
1366
1367 bad:
1368         if (control)
1369                 m_freem(control);
1370         m_freem(m);
1371         return (error);
1372 }
1373
1374 struct pr_usrreqs udp6_usrreqs = {
1375         .pru_abort =            udp6_abort,
1376         .pru_attach =           udp6_attach,
1377         .pru_bind =             udp6_bind,
1378         .pru_connect =          udp6_connect,
1379         .pru_control =          in6_control,
1380         .pru_detach =           udp6_detach,
1381         .pru_disconnect =       udp6_disconnect,
1382         .pru_peeraddr =         in6_mapped_peeraddr,
1383         .pru_send =             udp6_send,
1384         .pru_shutdown =         udp_shutdown,
1385         .pru_sockaddr =         in6_mapped_sockaddr,
1386         .pru_soreceive =        soreceive_dgram,
1387         .pru_sosend =           sosend_dgram,
1388         .pru_sosetlabel =       in_pcbsosetlabel,
1389         .pru_close =            udp6_close
1390 };