1 /* $NetBSD: in6_pcb.c,v 1.109 2009/05/12 22:22:46 elad Exp $ */ 2 /* $KAME: in6_pcb.c,v 1.84 2001/02/08 18:02:08 itojun Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 /* 34 * Copyright (c) 1982, 1986, 1991, 1993 35 * The Regents of the University of California. All rights reserved. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 3. Neither the name of the University nor the names of its contributors 46 * may be used to endorse or promote products derived from this software 47 * without specific prior written permission. 48 * 49 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 52 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 59 * SUCH DAMAGE. 60 * 61 * @(#)in_pcb.c 8.2 (Berkeley) 1/4/94 62 */ 63 64 #include <sys/cdefs.h> 65 __KERNEL_RCSID(0, "$NetBSD: in6_pcb.c,v 1.109 2009/05/12 22:22:46 elad Exp $"); 66 67 #include "opt_inet.h" 68 #include "opt_ipsec.h" 69 70 #include <sys/param.h> 71 #include <sys/systm.h> 72 #include <sys/malloc.h> 73 #include <sys/mbuf.h> 74 #include <sys/protosw.h> 75 #include <sys/socket.h> 76 #include <sys/socketvar.h> 77 #include <sys/ioctl.h> 78 #include <sys/errno.h> 79 #include <sys/time.h> 80 #include <sys/proc.h> 81 #include <sys/kauth.h> 82 #include <sys/domain.h> 83 84 #include <net/if.h> 85 #include <net/route.h> 86 87 #include <netinet/in.h> 88 #include <netinet/in_var.h> 89 #include <netinet/in_systm.h> 90 #include <netinet/ip.h> 91 #include <netinet/in_pcb.h> 92 #include <netinet/ip6.h> 93 #include <netinet6/ip6_var.h> 94 #include <netinet6/in6_pcb.h> 95 #include <netinet6/scope6_var.h> 96 #include <netinet6/nd6.h> 97 98 #include "faith.h" 99 100 #ifdef IPSEC 101 #include <netinet6/ipsec.h> 102 #include <netkey/key.h> 103 #endif /* IPSEC */ 104 105 #ifdef FAST_IPSEC 106 #include <netipsec/ipsec.h> 107 #include <netipsec/ipsec6.h> 108 #include <netipsec/key.h> 109 #endif /* FAST_IPSEC */ 110 111 const struct in6_addr zeroin6_addr; 112 113 #define IN6PCBHASH_PORT(table, lport) \ 114 &(table)->inpt_porthashtbl[ntohs(lport) & (table)->inpt_porthash] 115 #define IN6PCBHASH_BIND(table, laddr, lport) \ 116 &(table)->inpt_bindhashtbl[ \ 117 (((laddr)->s6_addr32[0] ^ (laddr)->s6_addr32[1] ^ \ 118 (laddr)->s6_addr32[2] ^ (laddr)->s6_addr32[3]) + ntohs(lport)) & \ 119 (table)->inpt_bindhash] 120 #define IN6PCBHASH_CONNECT(table, faddr, fport, laddr, lport) \ 121 &(table)->inpt_bindhashtbl[ \ 122 ((((faddr)->s6_addr32[0] ^ (faddr)->s6_addr32[1] ^ \ 123 (faddr)->s6_addr32[2] ^ (faddr)->s6_addr32[3]) + ntohs(fport)) + \ 124 (((laddr)->s6_addr32[0] ^ (laddr)->s6_addr32[1] ^ \ 125 (laddr)->s6_addr32[2] ^ (laddr)->s6_addr32[3]) + \ 126 ntohs(lport))) & (table)->inpt_bindhash] 127 128 int ip6_anonportmin = IPV6PORT_ANONMIN; 129 int ip6_anonportmax = IPV6PORT_ANONMAX; 130 int ip6_lowportmin = IPV6PORT_RESERVEDMIN; 131 int ip6_lowportmax = IPV6PORT_RESERVEDMAX; 132 133 POOL_INIT(in6pcb_pool, sizeof(struct in6pcb), 0, 0, 0, "in6pcbpl", NULL, 134 IPL_SOFTNET); 135 136 void 137 in6_pcbinit(struct inpcbtable *table, int bindhashsize, int connecthashsize) 138 { 139 140 in_pcbinit(table, bindhashsize, connecthashsize); 141 table->inpt_lastport = (u_int16_t)ip6_anonportmax; 142 } 143 144 int 145 in6_pcballoc(struct socket *so, void *v) 146 { 147 struct inpcbtable *table = v; 148 struct in6pcb *in6p; 149 int s; 150 #if defined(IPSEC) || defined(FAST_IPSEC) 151 int error; 152 #endif 153 154 s = splnet(); 155 in6p = pool_get(&in6pcb_pool, PR_NOWAIT); 156 splx(s); 157 if (in6p == NULL) 158 return (ENOBUFS); 159 memset((void *)in6p, 0, sizeof(*in6p)); 160 in6p->in6p_af = AF_INET6; 161 in6p->in6p_table = table; 162 in6p->in6p_socket = so; 163 in6p->in6p_hops = -1; /* use kernel default */ 164 in6p->in6p_icmp6filt = NULL; 165 #if defined(IPSEC) || defined(FAST_IPSEC) 166 error = ipsec_init_pcbpolicy(so, &in6p->in6p_sp); 167 if (error != 0) { 168 s = splnet(); 169 pool_put(&in6pcb_pool, in6p); 170 splx(s); 171 return error; 172 } 173 #endif /* IPSEC */ 174 s = splnet(); 175 CIRCLEQ_INSERT_HEAD(&table->inpt_queue, (struct inpcb_hdr*)in6p, 176 inph_queue); 177 LIST_INSERT_HEAD(IN6PCBHASH_PORT(table, in6p->in6p_lport), 178 &in6p->in6p_head, inph_lhash); 179 in6_pcbstate(in6p, IN6P_ATTACHED); 180 splx(s); 181 if (ip6_v6only) 182 in6p->in6p_flags |= IN6P_IPV6_V6ONLY; 183 so->so_pcb = (void *)in6p; 184 return (0); 185 } 186 187 /* 188 * Bind address from sin6 to in6p. 189 */ 190 static int 191 in6_pcbbind_addr(struct in6pcb *in6p, struct sockaddr_in6 *sin6, struct lwp *l) 192 { 193 int error; 194 195 /* 196 * We should check the family, but old programs 197 * incorrectly fail to intialize it. 198 */ 199 if (sin6->sin6_family != AF_INET6) 200 return (EAFNOSUPPORT); 201 202 #ifndef INET 203 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) 204 return (EADDRNOTAVAIL); 205 #endif 206 207 if ((error = sa6_embedscope(sin6, ip6_use_defzone)) != 0) 208 return (error); 209 210 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 211 if ((in6p->in6p_flags & IN6P_IPV6_V6ONLY) != 0) 212 return (EINVAL); 213 if (sin6->sin6_addr.s6_addr32[3]) { 214 struct sockaddr_in sin; 215 216 memset(&sin, 0, sizeof(sin)); 217 sin.sin_len = sizeof(sin); 218 sin.sin_family = AF_INET; 219 bcopy(&sin6->sin6_addr.s6_addr32[3], 220 &sin.sin_addr, sizeof(sin.sin_addr)); 221 if (ifa_ifwithaddr((struct sockaddr *)&sin) == 0) 222 return EADDRNOTAVAIL; 223 } 224 } else if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) { 225 struct ifaddr *ia = NULL; 226 227 if ((in6p->in6p_flags & IN6P_FAITH) == 0 && 228 (ia = ifa_ifwithaddr((struct sockaddr *)sin6)) == 0) 229 return (EADDRNOTAVAIL); 230 231 /* 232 * bind to an anycast address might accidentally 233 * cause sending a packet with an anycast source 234 * address, so we forbid it. 235 * 236 * We should allow to bind to a deprecated address, 237 * since the application dare to use it. 238 * But, can we assume that they are careful enough 239 * to check if the address is deprecated or not? 240 * Maybe, as a safeguard, we should have a setsockopt 241 * flag to control the bind(2) behavior against 242 * deprecated addresses (default: forbid bind(2)). 243 */ 244 if (ia && 245 ((struct in6_ifaddr *)ia)->ia6_flags & 246 (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY|IN6_IFF_DETACHED)) 247 return (EADDRNOTAVAIL); 248 } 249 250 251 in6p->in6p_laddr = sin6->sin6_addr; 252 253 254 return (0); 255 } 256 257 /* 258 * Bind port from sin6 to in6p. 259 */ 260 static int 261 in6_pcbbind_port(struct in6pcb *in6p, struct sockaddr_in6 *sin6, struct lwp *l) 262 { 263 struct inpcbtable *table = in6p->in6p_table; 264 struct socket *so = in6p->in6p_socket; 265 int wild = 0, reuseport = (so->so_options & SO_REUSEPORT); 266 int error; 267 268 if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0 && 269 ((so->so_proto->pr_flags & PR_CONNREQUIRED) == 0 || 270 (so->so_options & SO_ACCEPTCONN) == 0)) 271 wild = 1; 272 273 if (sin6->sin6_port != 0) { 274 enum kauth_network_req req; 275 276 #ifndef IPNOPRIVPORTS 277 if (ntohs(sin6->sin6_port) < IPV6PORT_RESERVED) 278 req = KAUTH_REQ_NETWORK_BIND_PRIVPORT; 279 else 280 #endif /* IPNOPRIVPORTS */ 281 req = KAUTH_REQ_NETWORK_BIND_PORT; 282 283 error = kauth_authorize_network(l->l_cred, KAUTH_NETWORK_BIND, 284 req, so, sin6, NULL); 285 if (error) 286 return (EACCES); 287 } 288 289 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) { 290 /* 291 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast; 292 * allow compepte duplication of binding if 293 * SO_REUSEPORT is set, or if SO_REUSEADDR is set 294 * and a multicast address is bound on both 295 * new and duplicated sockets. 296 */ 297 if (so->so_options & SO_REUSEADDR) 298 reuseport = SO_REUSEADDR|SO_REUSEPORT; 299 } 300 301 if (sin6->sin6_port != 0) { 302 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 303 #ifdef INET 304 struct inpcb *t; 305 306 t = in_pcblookup_port(table, 307 *(struct in_addr *)&sin6->sin6_addr.s6_addr32[3], 308 sin6->sin6_port, wild); 309 if (t && (reuseport & t->inp_socket->so_options) == 0) 310 return (EADDRINUSE); 311 #else 312 return (EADDRNOTAVAIL); 313 #endif 314 } 315 316 { 317 struct in6pcb *t; 318 319 t = in6_pcblookup_port(table, &sin6->sin6_addr, 320 sin6->sin6_port, wild); 321 if (t && (reuseport & t->in6p_socket->so_options) == 0) 322 return (EADDRINUSE); 323 } 324 } 325 326 if (sin6->sin6_port == 0) { 327 int e; 328 e = in6_pcbsetport(sin6, in6p, l); 329 if (e != 0) 330 return (e); 331 } else { 332 in6p->in6p_lport = sin6->sin6_port; 333 in6_pcbstate(in6p, IN6P_BOUND); 334 } 335 336 LIST_REMOVE(&in6p->in6p_head, inph_lhash); 337 LIST_INSERT_HEAD(IN6PCBHASH_PORT(table, in6p->in6p_lport), 338 &in6p->in6p_head, inph_lhash); 339 340 return (0); 341 } 342 343 int 344 in6_pcbbind(void *v, struct mbuf *nam, struct lwp *l) 345 { 346 struct in6pcb *in6p = v; 347 struct sockaddr_in6 lsin6; 348 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)NULL; 349 int error; 350 351 if (in6p->in6p_af != AF_INET6) 352 return (EINVAL); 353 354 /* 355 * If we already have a local port or a local address it means we're 356 * bounded. 357 */ 358 if (in6p->in6p_lport || !IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr)) 359 return (EINVAL); 360 361 if (nam != NULL) { 362 /* We were provided a sockaddr_in6 to use. */ 363 sin6 = mtod(nam, struct sockaddr_in6 *); 364 if (nam->m_len != sizeof(*sin6)) 365 return (EINVAL); 366 } else { 367 /* We always bind to *something*, even if it's "anything". */ 368 lsin6 = *((const struct sockaddr_in6 *) 369 in6p->in6p_socket->so_proto->pr_domain->dom_sa_any); 370 sin6 = &lsin6; 371 } 372 373 /* Bind address. */ 374 error = in6_pcbbind_addr(in6p, sin6, l); 375 if (error) 376 return (error); 377 378 /* Bind port. */ 379 error = in6_pcbbind_port(in6p, sin6, l); 380 if (error) { 381 /* 382 * Reset the address here to "any" so we don't "leak" the 383 * in6pcb. 384 */ 385 in6p->in6p_laddr = in6addr_any; 386 387 return (error); 388 } 389 390 391 #if 0 392 in6p->in6p_flowinfo = 0; /* XXX */ 393 #endif 394 return (0); 395 } 396 397 /* 398 * Connect from a socket to a specified address. 399 * Both address and port must be specified in argument sin6. 400 * If don't have a local address for this socket yet, 401 * then pick one. 402 */ 403 int 404 in6_pcbconnect(void *v, struct mbuf *nam, struct lwp *l) 405 { 406 struct rtentry *rt; 407 struct in6pcb *in6p = v; 408 struct in6_addr *in6a = NULL; 409 struct sockaddr_in6 *sin6 = mtod(nam, struct sockaddr_in6 *); 410 struct ifnet *ifp = NULL; /* outgoing interface */ 411 int error = 0; 412 int scope_ambiguous = 0; 413 #ifdef INET 414 struct in6_addr mapped; 415 #endif 416 struct sockaddr_in6 tmp; 417 418 (void)&in6a; /* XXX fool gcc */ 419 420 if (in6p->in6p_af != AF_INET6) 421 return (EINVAL); 422 423 if (nam->m_len != sizeof(*sin6)) 424 return (EINVAL); 425 if (sin6->sin6_family != AF_INET6) 426 return (EAFNOSUPPORT); 427 if (sin6->sin6_port == 0) 428 return (EADDRNOTAVAIL); 429 430 if (sin6->sin6_scope_id == 0 && !ip6_use_defzone) 431 scope_ambiguous = 1; 432 if ((error = sa6_embedscope(sin6, ip6_use_defzone)) != 0) 433 return(error); 434 435 /* sanity check for mapped address case */ 436 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 437 if ((in6p->in6p_flags & IN6P_IPV6_V6ONLY) != 0) 438 return EINVAL; 439 if (IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr)) 440 in6p->in6p_laddr.s6_addr16[5] = htons(0xffff); 441 if (!IN6_IS_ADDR_V4MAPPED(&in6p->in6p_laddr)) 442 return EINVAL; 443 } else 444 { 445 if (IN6_IS_ADDR_V4MAPPED(&in6p->in6p_laddr)) 446 return EINVAL; 447 } 448 449 /* protect *sin6 from overwrites */ 450 tmp = *sin6; 451 sin6 = &tmp; 452 453 /* Source address selection. */ 454 if (IN6_IS_ADDR_V4MAPPED(&in6p->in6p_laddr) && 455 in6p->in6p_laddr.s6_addr32[3] == 0) { 456 #ifdef INET 457 struct sockaddr_in sin, *sinp; 458 459 memset(&sin, 0, sizeof(sin)); 460 sin.sin_len = sizeof(sin); 461 sin.sin_family = AF_INET; 462 memcpy(&sin.sin_addr, &sin6->sin6_addr.s6_addr32[3], 463 sizeof(sin.sin_addr)); 464 sinp = in_selectsrc(&sin, &in6p->in6p_route, 465 in6p->in6p_socket->so_options, NULL, &error); 466 if (sinp == 0) { 467 if (error == 0) 468 error = EADDRNOTAVAIL; 469 return (error); 470 } 471 memset(&mapped, 0, sizeof(mapped)); 472 mapped.s6_addr16[5] = htons(0xffff); 473 memcpy(&mapped.s6_addr32[3], &sinp->sin_addr, sizeof(sinp->sin_addr)); 474 in6a = &mapped; 475 #else 476 return EADDRNOTAVAIL; 477 #endif 478 } else { 479 /* 480 * XXX: in6_selectsrc might replace the bound local address 481 * with the address specified by setsockopt(IPV6_PKTINFO). 482 * Is it the intended behavior? 483 */ 484 in6a = in6_selectsrc(sin6, in6p->in6p_outputopts, 485 in6p->in6p_moptions, 486 &in6p->in6p_route, 487 &in6p->in6p_laddr, &ifp, &error); 488 if (ifp && scope_ambiguous && 489 (error = in6_setscope(&sin6->sin6_addr, ifp, NULL)) != 0) { 490 return(error); 491 } 492 493 if (in6a == 0) { 494 if (error == 0) 495 error = EADDRNOTAVAIL; 496 return (error); 497 } 498 } 499 if (ifp == NULL && (rt = rtcache_validate(&in6p->in6p_route)) != NULL) 500 ifp = rt->rt_ifp; 501 502 in6p->in6p_ip6.ip6_hlim = (u_int8_t)in6_selecthlim(in6p, ifp); 503 504 if (in6_pcblookup_connect(in6p->in6p_table, &sin6->sin6_addr, 505 sin6->sin6_port, 506 IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) ? in6a : &in6p->in6p_laddr, 507 in6p->in6p_lport, 0)) 508 return (EADDRINUSE); 509 if (IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) || 510 (IN6_IS_ADDR_V4MAPPED(&in6p->in6p_laddr) && 511 in6p->in6p_laddr.s6_addr32[3] == 0)) 512 { 513 if (in6p->in6p_lport == 0) { 514 error = in6_pcbbind(in6p, (struct mbuf *)0, l); 515 if (error != 0) 516 return error; 517 } 518 in6p->in6p_laddr = *in6a; 519 } 520 in6p->in6p_faddr = sin6->sin6_addr; 521 in6p->in6p_fport = sin6->sin6_port; 522 in6_pcbstate(in6p, IN6P_CONNECTED); 523 in6p->in6p_flowinfo &= ~IPV6_FLOWLABEL_MASK; 524 if (ip6_auto_flowlabel) 525 in6p->in6p_flowinfo |= 526 (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK); 527 #if defined(IPSEC) || defined(FAST_IPSEC) 528 if (in6p->in6p_socket->so_type == SOCK_STREAM) 529 ipsec_pcbconn(in6p->in6p_sp); 530 #endif 531 return (0); 532 } 533 534 void 535 in6_pcbdisconnect(struct in6pcb *in6p) 536 { 537 memset((void *)&in6p->in6p_faddr, 0, sizeof(in6p->in6p_faddr)); 538 in6p->in6p_fport = 0; 539 in6_pcbstate(in6p, IN6P_BOUND); 540 in6p->in6p_flowinfo &= ~IPV6_FLOWLABEL_MASK; 541 #if defined(IPSEC) || defined(FAST_IPSEC) 542 ipsec_pcbdisconn(in6p->in6p_sp); 543 #endif 544 if (in6p->in6p_socket->so_state & SS_NOFDREF) 545 in6_pcbdetach(in6p); 546 } 547 548 void 549 in6_pcbdetach(struct in6pcb *in6p) 550 { 551 struct socket *so = in6p->in6p_socket; 552 int s; 553 554 if (in6p->in6p_af != AF_INET6) 555 return; 556 557 #if defined(IPSEC) || defined(FAST_IPSEC) 558 ipsec6_delete_pcbpolicy(in6p); 559 #endif /* IPSEC */ 560 so->so_pcb = 0; 561 if (in6p->in6p_options) 562 m_freem(in6p->in6p_options); 563 if (in6p->in6p_outputopts != NULL) { 564 ip6_clearpktopts(in6p->in6p_outputopts, -1); 565 free(in6p->in6p_outputopts, M_IP6OPT); 566 } 567 rtcache_free(&in6p->in6p_route); 568 ip6_freemoptions(in6p->in6p_moptions); 569 s = splnet(); 570 in6_pcbstate(in6p, IN6P_ATTACHED); 571 LIST_REMOVE(&in6p->in6p_head, inph_lhash); 572 CIRCLEQ_REMOVE(&in6p->in6p_table->inpt_queue, &in6p->in6p_head, 573 inph_queue); 574 pool_put(&in6pcb_pool, in6p); 575 splx(s); 576 sofree(so); /* drops the socket's lock */ 577 mutex_enter(softnet_lock); /* reacquire it */ 578 } 579 580 void 581 in6_setsockaddr(struct in6pcb *in6p, struct mbuf *nam) 582 { 583 struct sockaddr_in6 *sin6; 584 585 if (in6p->in6p_af != AF_INET6) 586 return; 587 588 nam->m_len = sizeof(*sin6); 589 sin6 = mtod(nam, struct sockaddr_in6 *); 590 sockaddr_in6_init(sin6, &in6p->in6p_laddr, in6p->in6p_lport, 0, 0); 591 (void)sa6_recoverscope(sin6); /* XXX: should catch errors */ 592 } 593 594 void 595 in6_setpeeraddr(struct in6pcb *in6p, struct mbuf *nam) 596 { 597 struct sockaddr_in6 *sin6; 598 599 if (in6p->in6p_af != AF_INET6) 600 return; 601 602 nam->m_len = sizeof(*sin6); 603 sin6 = mtod(nam, struct sockaddr_in6 *); 604 sockaddr_in6_init(sin6, &in6p->in6p_faddr, in6p->in6p_fport, 0, 0); 605 (void)sa6_recoverscope(sin6); /* XXX: should catch errors */ 606 } 607 608 /* 609 * Pass some notification to all connections of a protocol 610 * associated with address dst. The local address and/or port numbers 611 * may be specified to limit the search. The "usual action" will be 612 * taken, depending on the ctlinput cmd. The caller must filter any 613 * cmds that are uninteresting (e.g., no error in the map). 614 * Call the protocol specific routine (if any) to report 615 * any errors for each matching socket. 616 * 617 * Must be called at splsoftnet. 618 * 619 * Note: src (4th arg) carries the flowlabel value on the original IPv6 620 * header, in sin6_flowinfo member. 621 */ 622 int 623 in6_pcbnotify(struct inpcbtable *table, const struct sockaddr *dst, 624 u_int fport_arg, const struct sockaddr *src, u_int lport_arg, int cmd, 625 void *cmdarg, void (*notify)(struct in6pcb *, int)) 626 { 627 struct rtentry *rt; 628 struct in6pcb *in6p, *nin6p; 629 struct sockaddr_in6 sa6_src; 630 const struct sockaddr_in6 *sa6_dst; 631 u_int16_t fport = fport_arg, lport = lport_arg; 632 int errno; 633 int nmatch = 0; 634 u_int32_t flowinfo; 635 636 if ((unsigned)cmd >= PRC_NCMDS || dst->sa_family != AF_INET6) 637 return 0; 638 639 sa6_dst = (const struct sockaddr_in6 *)dst; 640 if (IN6_IS_ADDR_UNSPECIFIED(&sa6_dst->sin6_addr)) 641 return 0; 642 643 /* 644 * note that src can be NULL when we get notify by local fragmentation. 645 */ 646 sa6_src = (src == NULL) ? sa6_any : *(const struct sockaddr_in6 *)src; 647 flowinfo = sa6_src.sin6_flowinfo; 648 649 /* 650 * Redirects go to all references to the destination, 651 * and use in6_rtchange to invalidate the route cache. 652 * Dead host indications: also use in6_rtchange to invalidate 653 * the cache, and deliver the error to all the sockets. 654 * Otherwise, if we have knowledge of the local port and address, 655 * deliver only to that socket. 656 */ 657 if (PRC_IS_REDIRECT(cmd) || cmd == PRC_HOSTDEAD) { 658 fport = 0; 659 lport = 0; 660 memset((void *)&sa6_src.sin6_addr, 0, sizeof(sa6_src.sin6_addr)); 661 662 if (cmd != PRC_HOSTDEAD) 663 notify = in6_rtchange; 664 } 665 666 errno = inet6ctlerrmap[cmd]; 667 for (in6p = (struct in6pcb *)CIRCLEQ_FIRST(&table->inpt_queue); 668 in6p != (void *)&table->inpt_queue; 669 in6p = nin6p) { 670 nin6p = (struct in6pcb *)CIRCLEQ_NEXT(in6p, in6p_queue); 671 672 if (in6p->in6p_af != AF_INET6) 673 continue; 674 675 /* 676 * Under the following condition, notify of redirects 677 * to the pcb, without making address matches against inpcb. 678 * - redirect notification is arrived. 679 * - the inpcb is unconnected. 680 * - the inpcb is caching !RTF_HOST routing entry. 681 * - the ICMPv6 notification is from the gateway cached in the 682 * inpcb. i.e. ICMPv6 notification is from nexthop gateway 683 * the inpcb used very recently. 684 * 685 * This is to improve interaction between netbsd/openbsd 686 * redirect handling code, and inpcb route cache code. 687 * without the clause, !RTF_HOST routing entry (which carries 688 * gateway used by inpcb right before the ICMPv6 redirect) 689 * will be cached forever in unconnected inpcb. 690 * 691 * There still is a question regarding to what is TRT: 692 * - On bsdi/freebsd, RTF_HOST (cloned) routing entry will be 693 * generated on packet output. inpcb will always cache 694 * RTF_HOST routing entry so there's no need for the clause 695 * (ICMPv6 redirect will update RTF_HOST routing entry, 696 * and inpcb is caching it already). 697 * However, bsdi/freebsd are vulnerable to local DoS attacks 698 * due to the cloned routing entries. 699 * - Specwise, "destination cache" is mentioned in RFC2461. 700 * Jinmei says that it implies bsdi/freebsd behavior, itojun 701 * is not really convinced. 702 * - Having hiwat/lowat on # of cloned host route (redirect/ 703 * pmtud) may be a good idea. netbsd/openbsd has it. see 704 * icmp6_mtudisc_update(). 705 */ 706 if ((PRC_IS_REDIRECT(cmd) || cmd == PRC_HOSTDEAD) && 707 IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) && 708 (rt = rtcache_validate(&in6p->in6p_route)) != NULL && 709 !(rt->rt_flags & RTF_HOST)) { 710 const struct sockaddr_in6 *dst6; 711 712 dst6 = (const struct sockaddr_in6 *) 713 rtcache_getdst(&in6p->in6p_route); 714 if (dst6 == NULL) 715 ; 716 else if (IN6_ARE_ADDR_EQUAL(&dst6->sin6_addr, 717 &sa6_dst->sin6_addr)) 718 goto do_notify; 719 } 720 721 /* 722 * If the error designates a new path MTU for a destination 723 * and the application (associated with this socket) wanted to 724 * know the value, notify. Note that we notify for all 725 * disconnected sockets if the corresponding application 726 * wanted. This is because some UDP applications keep sending 727 * sockets disconnected. 728 * XXX: should we avoid to notify the value to TCP sockets? 729 */ 730 if (cmd == PRC_MSGSIZE && (in6p->in6p_flags & IN6P_MTU) != 0 && 731 (IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) || 732 IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &sa6_dst->sin6_addr))) { 733 ip6_notify_pmtu(in6p, (const struct sockaddr_in6 *)dst, 734 (u_int32_t *)cmdarg); 735 } 736 737 /* 738 * Detect if we should notify the error. If no source and 739 * destination ports are specified, but non-zero flowinfo and 740 * local address match, notify the error. This is the case 741 * when the error is delivered with an encrypted buffer 742 * by ESP. Otherwise, just compare addresses and ports 743 * as usual. 744 */ 745 if (lport == 0 && fport == 0 && flowinfo && 746 in6p->in6p_socket != NULL && 747 flowinfo == (in6p->in6p_flowinfo & IPV6_FLOWLABEL_MASK) && 748 IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &sa6_src.sin6_addr)) 749 goto do_notify; 750 else if (!IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, 751 &sa6_dst->sin6_addr) || 752 in6p->in6p_socket == 0 || 753 (lport && in6p->in6p_lport != lport) || 754 (!IN6_IS_ADDR_UNSPECIFIED(&sa6_src.sin6_addr) && 755 !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, 756 &sa6_src.sin6_addr)) || 757 (fport && in6p->in6p_fport != fport)) 758 continue; 759 760 do_notify: 761 if (notify) 762 (*notify)(in6p, errno); 763 nmatch++; 764 } 765 return nmatch; 766 } 767 768 void 769 in6_pcbpurgeif0(struct inpcbtable *table, struct ifnet *ifp) 770 { 771 struct in6pcb *in6p, *nin6p; 772 struct ip6_moptions *im6o; 773 struct in6_multi_mship *imm, *nimm; 774 775 for (in6p = (struct in6pcb *)CIRCLEQ_FIRST(&table->inpt_queue); 776 in6p != (void *)&table->inpt_queue; 777 in6p = nin6p) { 778 nin6p = (struct in6pcb *)CIRCLEQ_NEXT(in6p, in6p_queue); 779 if (in6p->in6p_af != AF_INET6) 780 continue; 781 782 im6o = in6p->in6p_moptions; 783 if (im6o) { 784 /* 785 * Unselect the outgoing interface if it is being 786 * detached. 787 */ 788 if (im6o->im6o_multicast_ifp == ifp) 789 im6o->im6o_multicast_ifp = NULL; 790 791 /* 792 * Drop multicast group membership if we joined 793 * through the interface being detached. 794 * XXX controversial - is it really legal for kernel 795 * to force this? 796 */ 797 for (imm = im6o->im6o_memberships.lh_first; 798 imm != NULL; imm = nimm) { 799 nimm = imm->i6mm_chain.le_next; 800 if (imm->i6mm_maddr->in6m_ifp == ifp) { 801 LIST_REMOVE(imm, i6mm_chain); 802 in6_leavegroup(imm); 803 } 804 } 805 } 806 } 807 } 808 809 void 810 in6_pcbpurgeif(struct inpcbtable *table, struct ifnet *ifp) 811 { 812 struct rtentry *rt; 813 struct in6pcb *in6p, *nin6p; 814 815 for (in6p = (struct in6pcb *)CIRCLEQ_FIRST(&table->inpt_queue); 816 in6p != (void *)&table->inpt_queue; 817 in6p = nin6p) { 818 nin6p = (struct in6pcb *)CIRCLEQ_NEXT(in6p, in6p_queue); 819 if (in6p->in6p_af != AF_INET6) 820 continue; 821 if ((rt = rtcache_validate(&in6p->in6p_route)) != NULL && 822 rt->rt_ifp == ifp) 823 in6_rtchange(in6p, 0); 824 } 825 } 826 827 /* 828 * Check for alternatives when higher level complains 829 * about service problems. For now, invalidate cached 830 * routing information. If the route was created dynamically 831 * (by a redirect), time to try a default gateway again. 832 */ 833 void 834 in6_losing(struct in6pcb *in6p) 835 { 836 struct rtentry *rt; 837 struct rt_addrinfo info; 838 839 if (in6p->in6p_af != AF_INET6) 840 return; 841 842 if ((rt = rtcache_validate(&in6p->in6p_route)) == NULL) 843 return; 844 845 memset(&info, 0, sizeof(info)); 846 info.rti_info[RTAX_DST] = rtcache_getdst(&in6p->in6p_route); 847 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway; 848 info.rti_info[RTAX_NETMASK] = rt_mask(rt); 849 rt_missmsg(RTM_LOSING, &info, rt->rt_flags, 0); 850 if (rt->rt_flags & RTF_DYNAMIC) { 851 (void)rtrequest(RTM_DELETE, rt_getkey(rt), 852 rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL); 853 } 854 /* 855 * A new route can be allocated 856 * the next time output is attempted. 857 */ 858 rtcache_free(&in6p->in6p_route); 859 } 860 861 /* 862 * After a routing change, flush old routing. A new route can be 863 * allocated the next time output is attempted. 864 */ 865 void 866 in6_rtchange(struct in6pcb *in6p, int errno) 867 { 868 if (in6p->in6p_af != AF_INET6) 869 return; 870 871 rtcache_free(&in6p->in6p_route); 872 /* 873 * A new route can be allocated the next time 874 * output is attempted. 875 */ 876 } 877 878 struct in6pcb * 879 in6_pcblookup_port(struct inpcbtable *table, struct in6_addr *laddr6, 880 u_int lport_arg, int lookup_wildcard) 881 { 882 struct inpcbhead *head; 883 struct inpcb_hdr *inph; 884 struct in6pcb *in6p, *match = 0; 885 int matchwild = 3, wildcard; 886 u_int16_t lport = lport_arg; 887 888 head = IN6PCBHASH_PORT(table, lport); 889 LIST_FOREACH(inph, head, inph_lhash) { 890 in6p = (struct in6pcb *)inph; 891 if (in6p->in6p_af != AF_INET6) 892 continue; 893 894 if (in6p->in6p_lport != lport) 895 continue; 896 wildcard = 0; 897 if (IN6_IS_ADDR_V4MAPPED(&in6p->in6p_faddr)) { 898 if ((in6p->in6p_flags & IN6P_IPV6_V6ONLY) != 0) 899 continue; 900 } 901 if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr)) 902 wildcard++; 903 if (IN6_IS_ADDR_V4MAPPED(&in6p->in6p_laddr)) { 904 if ((in6p->in6p_flags & IN6P_IPV6_V6ONLY) != 0) 905 continue; 906 if (!IN6_IS_ADDR_V4MAPPED(laddr6)) 907 continue; 908 909 /* duplicate of IPv4 logic */ 910 wildcard = 0; 911 if (IN6_IS_ADDR_V4MAPPED(&in6p->in6p_faddr) && 912 in6p->in6p_faddr.s6_addr32[3]) 913 wildcard++; 914 if (!in6p->in6p_laddr.s6_addr32[3]) { 915 if (laddr6->s6_addr32[3]) 916 wildcard++; 917 } else { 918 if (!laddr6->s6_addr32[3]) 919 wildcard++; 920 else { 921 if (in6p->in6p_laddr.s6_addr32[3] != 922 laddr6->s6_addr32[3]) 923 continue; 924 } 925 } 926 } else if (IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr)) { 927 if (IN6_IS_ADDR_V4MAPPED(laddr6)) { 928 if ((in6p->in6p_flags & IN6P_IPV6_V6ONLY) != 0) 929 continue; 930 } 931 if (!IN6_IS_ADDR_UNSPECIFIED(laddr6)) 932 wildcard++; 933 } else { 934 if (IN6_IS_ADDR_V4MAPPED(laddr6)) { 935 if ((in6p->in6p_flags & IN6P_IPV6_V6ONLY) != 0) 936 continue; 937 } 938 if (IN6_IS_ADDR_UNSPECIFIED(laddr6)) 939 wildcard++; 940 else { 941 if (!IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, 942 laddr6)) 943 continue; 944 } 945 } 946 if (wildcard && !lookup_wildcard) 947 continue; 948 if (wildcard < matchwild) { 949 match = in6p; 950 matchwild = wildcard; 951 if (matchwild == 0) 952 break; 953 } 954 } 955 return (match); 956 } 957 #undef continue 958 959 /* 960 * WARNING: return value (rtentry) could be IPv4 one if in6pcb is connected to 961 * IPv4 mapped address. 962 */ 963 struct rtentry * 964 in6_pcbrtentry(struct in6pcb *in6p) 965 { 966 struct rtentry *rt; 967 struct route *ro; 968 union { 969 const struct sockaddr *sa; 970 const struct sockaddr_in6 *sa6; 971 #ifdef INET 972 const struct sockaddr_in *sa4; 973 #endif 974 } cdst; 975 976 ro = &in6p->in6p_route; 977 978 if (in6p->in6p_af != AF_INET6) 979 return (NULL); 980 981 cdst.sa = rtcache_getdst(ro); 982 if (cdst.sa == NULL) 983 ; 984 #ifdef INET 985 else if (cdst.sa->sa_family == AF_INET) { 986 KASSERT(IN6_IS_ADDR_V4MAPPED(&in6p->in6p_faddr)); 987 if (cdst.sa4->sin_addr.s_addr != in6p->in6p_faddr.s6_addr32[3]) 988 rtcache_free(ro); 989 } 990 #endif 991 else { 992 if (!IN6_ARE_ADDR_EQUAL(&cdst.sa6->sin6_addr, 993 &in6p->in6p_faddr)) 994 rtcache_free(ro); 995 } 996 if ((rt = rtcache_validate(ro)) == NULL) 997 rt = rtcache_update(ro, 1); 998 #ifdef INET 999 if (rt == NULL && IN6_IS_ADDR_V4MAPPED(&in6p->in6p_faddr)) { 1000 union { 1001 struct sockaddr dst; 1002 struct sockaddr_in dst4; 1003 } u; 1004 struct in_addr addr; 1005 1006 addr.s_addr = in6p->in6p_faddr.s6_addr32[3]; 1007 1008 sockaddr_in_init(&u.dst4, &addr, 0); 1009 rtcache_setdst(ro, &u.dst); 1010 1011 rt = rtcache_init(ro); 1012 } else 1013 #endif 1014 if (rt == NULL && !IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr)) { 1015 union { 1016 struct sockaddr dst; 1017 struct sockaddr_in6 dst6; 1018 } u; 1019 1020 sockaddr_in6_init(&u.dst6, &in6p->in6p_faddr, 0, 0, 0); 1021 rtcache_setdst(ro, &u.dst); 1022 1023 rt = rtcache_init(ro); 1024 } 1025 return rt; 1026 } 1027 1028 struct in6pcb * 1029 in6_pcblookup_connect(struct inpcbtable *table, const struct in6_addr *faddr6, 1030 u_int fport_arg, const struct in6_addr *laddr6, u_int lport_arg, 1031 int faith) 1032 { 1033 struct inpcbhead *head; 1034 struct inpcb_hdr *inph; 1035 struct in6pcb *in6p; 1036 u_int16_t fport = fport_arg, lport = lport_arg; 1037 1038 head = IN6PCBHASH_CONNECT(table, faddr6, fport, laddr6, lport); 1039 LIST_FOREACH(inph, head, inph_hash) { 1040 in6p = (struct in6pcb *)inph; 1041 if (in6p->in6p_af != AF_INET6) 1042 continue; 1043 1044 /* find exact match on both source and dest */ 1045 if (in6p->in6p_fport != fport) 1046 continue; 1047 if (in6p->in6p_lport != lport) 1048 continue; 1049 if (IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr)) 1050 continue; 1051 if (!IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, faddr6)) 1052 continue; 1053 if (IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr)) 1054 continue; 1055 if (!IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, laddr6)) 1056 continue; 1057 if ((IN6_IS_ADDR_V4MAPPED(laddr6) || 1058 IN6_IS_ADDR_V4MAPPED(faddr6)) && 1059 (in6p->in6p_flags & IN6P_IPV6_V6ONLY)) 1060 continue; 1061 return in6p; 1062 } 1063 return NULL; 1064 } 1065 1066 struct in6pcb * 1067 in6_pcblookup_bind(struct inpcbtable *table, const struct in6_addr *laddr6, 1068 u_int lport_arg, int faith) 1069 { 1070 struct inpcbhead *head; 1071 struct inpcb_hdr *inph; 1072 struct in6pcb *in6p; 1073 u_int16_t lport = lport_arg; 1074 #ifdef INET 1075 struct in6_addr zero_mapped; 1076 #endif 1077 1078 head = IN6PCBHASH_BIND(table, laddr6, lport); 1079 LIST_FOREACH(inph, head, inph_hash) { 1080 in6p = (struct in6pcb *)inph; 1081 if (in6p->in6p_af != AF_INET6) 1082 continue; 1083 1084 if (faith && (in6p->in6p_flags & IN6P_FAITH) == 0) 1085 continue; 1086 if (in6p->in6p_fport != 0) 1087 continue; 1088 if (in6p->in6p_lport != lport) 1089 continue; 1090 if (IN6_IS_ADDR_V4MAPPED(laddr6) && 1091 (in6p->in6p_flags & IN6P_IPV6_V6ONLY) != 0) 1092 continue; 1093 if (IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, laddr6)) 1094 goto out; 1095 } 1096 #ifdef INET 1097 if (IN6_IS_ADDR_V4MAPPED(laddr6)) { 1098 memset(&zero_mapped, 0, sizeof(zero_mapped)); 1099 zero_mapped.s6_addr16[5] = 0xffff; 1100 head = IN6PCBHASH_BIND(table, &zero_mapped, lport); 1101 LIST_FOREACH(inph, head, inph_hash) { 1102 in6p = (struct in6pcb *)inph; 1103 if (in6p->in6p_af != AF_INET6) 1104 continue; 1105 1106 if (faith && (in6p->in6p_flags & IN6P_FAITH) == 0) 1107 continue; 1108 if (in6p->in6p_fport != 0) 1109 continue; 1110 if (in6p->in6p_lport != lport) 1111 continue; 1112 if ((in6p->in6p_flags & IN6P_IPV6_V6ONLY) != 0) 1113 continue; 1114 if (IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &zero_mapped)) 1115 goto out; 1116 } 1117 } 1118 #endif 1119 head = IN6PCBHASH_BIND(table, &zeroin6_addr, lport); 1120 LIST_FOREACH(inph, head, inph_hash) { 1121 in6p = (struct in6pcb *)inph; 1122 if (in6p->in6p_af != AF_INET6) 1123 continue; 1124 1125 if (faith && (in6p->in6p_flags & IN6P_FAITH) == 0) 1126 continue; 1127 if (in6p->in6p_fport != 0) 1128 continue; 1129 if (in6p->in6p_lport != lport) 1130 continue; 1131 if (IN6_IS_ADDR_V4MAPPED(laddr6) && 1132 (in6p->in6p_flags & IN6P_IPV6_V6ONLY) != 0) 1133 continue; 1134 if (IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &zeroin6_addr)) 1135 goto out; 1136 } 1137 return (NULL); 1138 1139 out: 1140 inph = &in6p->in6p_head; 1141 if (inph != LIST_FIRST(head)) { 1142 LIST_REMOVE(inph, inph_hash); 1143 LIST_INSERT_HEAD(head, inph, inph_hash); 1144 } 1145 return in6p; 1146 } 1147 1148 void 1149 in6_pcbstate(struct in6pcb *in6p, int state) 1150 { 1151 1152 if (in6p->in6p_af != AF_INET6) 1153 return; 1154 1155 if (in6p->in6p_state > IN6P_ATTACHED) 1156 LIST_REMOVE(&in6p->in6p_head, inph_hash); 1157 1158 switch (state) { 1159 case IN6P_BOUND: 1160 LIST_INSERT_HEAD(IN6PCBHASH_BIND(in6p->in6p_table, 1161 &in6p->in6p_laddr, in6p->in6p_lport), &in6p->in6p_head, 1162 inph_hash); 1163 break; 1164 case IN6P_CONNECTED: 1165 LIST_INSERT_HEAD(IN6PCBHASH_CONNECT(in6p->in6p_table, 1166 &in6p->in6p_faddr, in6p->in6p_fport, 1167 &in6p->in6p_laddr, in6p->in6p_lport), &in6p->in6p_head, 1168 inph_hash); 1169 break; 1170 } 1171 1172 in6p->in6p_state = state; 1173 } 1174