xref: /dragonfly/sys/netinet/udp_usrreq.c (revision 556932ec)
1 /*
2  * Copyright (c) 2004 Jeffrey M. Hsu.  All rights reserved.
3  * Copyright (c) 2004 The DragonFly Project.  All rights reserved.
4  *
5  * This code is derived from software contributed to The DragonFly Project
6  * by Jeffrey M. Hsu.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of The DragonFly Project nor the names of its
17  *    contributors may be used to endorse or promote products derived
18  *    from this software without specific, prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
24  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
30  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 /*
35  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
36  *	The Regents of the University of California.  All rights reserved.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. Neither the name of the University nor the names of its contributors
47  *    may be used to endorse or promote products derived from this software
48  *    without specific prior written permission.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60  * SUCH DAMAGE.
61  *
62  *	@(#)udp_usrreq.c	8.6 (Berkeley) 5/23/95
63  * $FreeBSD: src/sys/netinet/udp_usrreq.c,v 1.64.2.18 2003/01/24 05:11:34 sam Exp $
64  */
65 
66 #include "opt_inet6.h"
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/kernel.h>
71 #include <sys/malloc.h>
72 #include <sys/mbuf.h>
73 #include <sys/domain.h>
74 #include <sys/proc.h>
75 #include <sys/priv.h>
76 #include <sys/protosw.h>
77 #include <sys/socket.h>
78 #include <sys/socketvar.h>
79 #include <sys/sysctl.h>
80 #include <sys/syslog.h>
81 #include <sys/in_cksum.h>
82 #include <sys/ktr.h>
83 #include <sys/jail.h>
84 
85 #include <sys/socketvar2.h>
86 #include <sys/serialize.h>
87 
88 #include <machine/stdarg.h>
89 
90 #include <net/if.h>
91 #include <net/route.h>
92 #include <net/netmsg2.h>
93 #include <net/netisr2.h>
94 
95 #include <netinet/in.h>
96 #include <netinet/in_systm.h>
97 #include <netinet/ip.h>
98 #ifdef INET6
99 #include <netinet/ip6.h>
100 #endif
101 #include <netinet/in_pcb.h>
102 #include <netinet/in_var.h>
103 #include <netinet/ip_var.h>
104 #ifdef INET6
105 #include <netinet6/ip6_var.h>
106 #endif
107 #include <netinet/ip_icmp.h>
108 #include <netinet/icmp_var.h>
109 #include <netinet/udp.h>
110 #include <netinet/udp_var.h>
111 
112 #define MSGF_UDP_SEND		MSGF_PROTO1
113 
114 #define INP_DIRECT_DETACH	INP_FLAG_PROTO2
115 
116 #define UDP_KTR_STRING		"inp=%p"
117 #define UDP_KTR_ARGS		struct inpcb *inp
118 
119 #ifndef KTR_UDP
120 #define KTR_UDP			KTR_ALL
121 #endif
122 
123 KTR_INFO_MASTER(udp);
124 KTR_INFO(KTR_UDP, udp, send_beg, 0, UDP_KTR_STRING, UDP_KTR_ARGS);
125 KTR_INFO(KTR_UDP, udp, send_end, 1, UDP_KTR_STRING, UDP_KTR_ARGS);
126 KTR_INFO(KTR_UDP, udp, send_ipout, 2, UDP_KTR_STRING, UDP_KTR_ARGS);
127 KTR_INFO(KTR_UDP, udp, redisp_ipout_beg, 3, UDP_KTR_STRING, UDP_KTR_ARGS);
128 KTR_INFO(KTR_UDP, udp, redisp_ipout_end, 4, UDP_KTR_STRING, UDP_KTR_ARGS);
129 KTR_INFO(KTR_UDP, udp, send_redisp, 5, UDP_KTR_STRING, UDP_KTR_ARGS);
130 KTR_INFO(KTR_UDP, udp, send_inswildcard, 6, UDP_KTR_STRING, UDP_KTR_ARGS);
131 
132 #define logudp(name, inp)	KTR_LOG(udp_##name, inp)
133 
134 /*
135  * UDP protocol implementation.
136  * Per RFC 768, August, 1980.
137  */
138 #ifndef	COMPAT_42
139 static int	udpcksum = 1;
140 #else
141 static int	udpcksum = 0;		/* XXX */
142 #endif
143 SYSCTL_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum, CTLFLAG_RW,
144     &udpcksum, 0, "Enable checksumming of UDP packets");
145 
146 int	log_in_vain = 0;
147 SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_RW,
148     &log_in_vain, 0, "Log all incoming UDP packets");
149 
150 static int	blackhole = 0;
151 SYSCTL_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_RW,
152 	&blackhole, 0, "Do not send port unreachables for refused connects");
153 
154 static int	strict_mcast_mship = 1;
155 SYSCTL_INT(_net_inet_udp, OID_AUTO, strict_mcast_mship, CTLFLAG_RW,
156 	&strict_mcast_mship, 0, "Only send multicast to member sockets");
157 
158 int	udp_sosend_async = 1;
159 SYSCTL_INT(_net_inet_udp, OID_AUTO, sosend_async, CTLFLAG_RW,
160 	&udp_sosend_async, 0, "UDP asynchronized pru_send");
161 
162 int	udp_sosend_prepend = 1;
163 SYSCTL_INT(_net_inet_udp, OID_AUTO, sosend_prepend, CTLFLAG_RW,
164 	&udp_sosend_prepend, 0,
165 	"Prepend enough space for proto and link header in pru_send");
166 
167 static int udp_reuseport_ext = 1;
168 SYSCTL_INT(_net_inet_udp, OID_AUTO, reuseport_ext, CTLFLAG_RW,
169 	&udp_reuseport_ext, 0, "SO_REUSEPORT extension");
170 
171 struct	inpcbinfo udbinfo[MAXCPU];
172 
173 #ifndef UDBHASHSIZE
174 #define UDBHASHSIZE 16
175 #endif
176 CTASSERT(powerof2(UDBHASHSIZE));
177 
178 struct	udpstat udpstat_percpu[MAXCPU] __cachealign;
179 
180 static void udp_append(struct inpcb *last, struct ip *ip,
181     struct mbuf *n, int off, struct sockaddr_in *udp_in);
182 
183 static int udp_connect_oncpu(struct inpcb *inp, struct sockaddr_in *sin,
184     struct sockaddr_in *if_sin, uint16_t hash);
185 
186 static boolean_t udp_inswildcardhash(struct inpcb *inp,
187     struct netmsg_base *msg, int error);
188 static void udp_remwildcardhash(struct inpcb *inp);
189 
190 static __inline int
191 udp_lportcpu(short lport)
192 {
193 	return (ntohs(lport) % netisr_ncpus);
194 }
195 
196 void
197 udp_init(void)
198 {
199 	struct inpcbportinfo *portinfo;
200 	int cpu;
201 
202 	portinfo = kmalloc(sizeof(*portinfo) * netisr_ncpus, M_PCB,
203 			   M_WAITOK | M_CACHEALIGN);
204 
205 	for (cpu = 0; cpu < netisr_ncpus; cpu++) {
206 		struct inpcbinfo *uicb = &udbinfo[cpu];
207 
208 		/*
209 		 * NOTE:
210 		 * UDP pcb list, wildcard hash table and localgroup hash
211 		 * table are shared.
212 		 */
213 		in_pcbinfo_init(uicb, cpu, TRUE);
214 		uicb->hashbase = hashinit(UDBHASHSIZE, M_PCB, &uicb->hashmask);
215 
216 		in_pcbportinfo_init(&portinfo[cpu], UDBHASHSIZE, cpu);
217 		in_pcbportinfo_set(uicb, portinfo, netisr_ncpus);
218 
219 		uicb->wildcardhashbase = hashinit(UDBHASHSIZE, M_PCB,
220 		    &uicb->wildcardhashmask);
221 		uicb->localgrphashbase = hashinit(UDBHASHSIZE, M_PCB,
222 		    &uicb->localgrphashmask);
223 
224 		uicb->ipi_size = sizeof(struct inpcb);
225 	}
226 
227 	/*
228 	 * Initialize UDP statistics counters for each CPU.
229 	 */
230 	for (cpu = 0; cpu < netisr_ncpus; ++cpu)
231 		bzero(&udpstat_percpu[cpu], sizeof(struct udpstat));
232 }
233 
234 static int
235 sysctl_udpstat(SYSCTL_HANDLER_ARGS)
236 {
237 	int cpu, error = 0;
238 
239 	for (cpu = 0; cpu < netisr_ncpus; ++cpu) {
240 		if ((error = SYSCTL_OUT(req, &udpstat_percpu[cpu],
241 					sizeof(struct udpstat))))
242 			break;
243 		if ((error = SYSCTL_IN(req, &udpstat_percpu[cpu],
244 				       sizeof(struct udpstat))))
245 			break;
246 	}
247 
248 	return (error);
249 }
250 SYSCTL_PROC(_net_inet_udp, UDPCTL_STATS, stats, (CTLTYPE_OPAQUE | CTLFLAG_RW),
251     0, 0, sysctl_udpstat, "S,udpstat", "UDP statistics");
252 
253 void
254 udp_ctloutput(netmsg_t msg)
255 {
256 	struct socket *so = msg->base.nm_so;
257 	struct sockopt *sopt = msg->ctloutput.nm_sopt;
258 	struct inpcb *inp = so->so_pcb;
259 
260 	if (inp == NULL) {
261 		lwkt_replymsg(&msg->lmsg, EINVAL);
262 		return;
263 	}
264 
265 	if (sopt->sopt_level == IPPROTO_IP && sopt->sopt_dir == SOPT_SET) {
266 		switch (sopt->sopt_name) {
267 		case IP_MULTICAST_IF:
268 		case IP_MULTICAST_VIF:
269 		case IP_MULTICAST_TTL:
270 		case IP_MULTICAST_LOOP:
271 		case IP_ADD_MEMBERSHIP:
272 		case IP_DROP_MEMBERSHIP:
273 			/*
274 			 * This pr_ctloutput msg will be forwarded
275 			 * to netisr0 to run; we can't do direct
276 			 * detaching anymore.
277 			 *
278 			 * NOTE:
279 			 * Don't optimize for the sockets whose
280 			 * current so_port is netisr0's msgport.
281 			 * These sockets could be connect(2)'ed
282 			 * later and the so_port will be changed.
283 			 */
284 			inp->inp_flags &= ~INP_DIRECT_DETACH;
285 			break;
286 		}
287 	}
288 	return ip_ctloutput(msg);
289 }
290 
291 /*
292  * Check multicast packets to make sure they are only sent to sockets with
293  * multicast memberships for the packet's destination address and arrival
294  * interface.  Multicast packets to multicast-unaware sockets are also
295  * disallowed.
296  *
297  * Returns 0 if the packet is acceptable, -1 if it is not.
298  */
299 static __inline int
300 check_multicast_membership(const struct ip *ip, const struct inpcb *inp,
301     const struct mbuf *m)
302 {
303 	const struct ip_moptions *mopt;
304 	int mshipno;
305 
306 	if (strict_mcast_mship == 0 ||
307 	    !IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
308 		return (0);
309 	}
310 
311 	ASSERT_NETISR0;
312 
313 	mopt = inp->inp_moptions;
314 	if (mopt == NULL)
315 		return (-1);
316 	for (mshipno = 0; mshipno < mopt->imo_num_memberships; ++mshipno) {
317 		const struct in_multi *maddr = mopt->imo_membership[mshipno];
318 
319 		if (ip->ip_dst.s_addr == maddr->inm_addr.s_addr &&
320 		    m->m_pkthdr.rcvif == maddr->inm_ifp) {
321 			return (0);
322 		}
323 	}
324 	return (-1);
325 }
326 
327 struct udp_mcast_arg {
328 	struct inpcb	*inp;
329 	struct inpcb	*last;
330 	struct ip	*ip;
331 	struct mbuf	*m;
332 	int		iphlen;
333 	struct sockaddr_in *udp_in;
334 };
335 
336 static int
337 udp_mcast_input(struct udp_mcast_arg *arg)
338 {
339 	struct inpcb *inp = arg->inp;
340 	struct inpcb *last = arg->last;
341 	struct ip *ip = arg->ip;
342 	struct mbuf *m = arg->m;
343 
344 	if (check_multicast_membership(ip, inp, m) < 0)
345 		return ERESTART; /* caller continue */
346 
347 	if (last != NULL) {
348 		struct mbuf *n;
349 
350 		if ((n = m_copypacket(m, M_NOWAIT)) != NULL)
351 			udp_append(last, ip, n,
352 			    arg->iphlen + sizeof(struct udphdr),
353 			    arg->udp_in);
354 	}
355 	arg->last = last = inp;
356 
357 	/*
358 	 * Don't look for additional matches if this one does
359 	 * not have either the SO_REUSEPORT or SO_REUSEADDR
360 	 * socket options set.  This heuristic avoids searching
361 	 * through all pcbs in the common case of a non-shared
362 	 * port.  It * assumes that an application will never
363 	 * clear these options after setting them.
364 	 */
365 	if (!(last->inp_socket->so_options &
366 	    (SO_REUSEPORT | SO_REUSEADDR)))
367 		return EJUSTRETURN; /* caller stop */
368 	return 0;
369 }
370 
371 int
372 udp_input(struct mbuf **mp, int *offp, int proto)
373 {
374 	struct sockaddr_in udp_in = { sizeof udp_in, AF_INET };
375 	int iphlen;
376 	struct ip *ip;
377 	struct udphdr *uh;
378 	struct inpcb *inp;
379 	struct mbuf *m;
380 	struct mbuf *opts = NULL;
381 	int ip_len, len, off;
382 	struct ip save_ip;
383 	struct inpcbinfo *pcbinfo = &udbinfo[mycpuid];
384 
385 	off = *offp;
386 	m = *mp;
387 	*mp = NULL;
388 
389 	iphlen = off;
390 	udp_stat.udps_ipackets++;
391 
392 	/*
393 	 * Strip IP options, if any; should skip this,
394 	 * make available to user, and use on returned packets,
395 	 * but we don't yet have a way to check the checksum
396 	 * with options still present.
397 	 */
398 	if (iphlen > sizeof(struct ip)) {
399 		ip_stripoptions(m);
400 		iphlen = sizeof(struct ip);
401 	}
402 
403 	/*
404 	 * IP and UDP headers are together in first mbuf.
405 	 * Already checked and pulled up in ip_demux().
406 	 */
407 	KASSERT(m->m_len >= iphlen + sizeof(struct udphdr),
408 	    ("UDP header not in one mbuf"));
409 
410 	ip = mtod(m, struct ip *);
411 	uh = (struct udphdr *)((caddr_t)ip + iphlen);
412 
413 	/* destination port of 0 is illegal, based on RFC768. */
414 	if (uh->uh_dport == 0)
415 		goto bad;
416 
417 	/*
418 	 * Make mbuf data length reflect UDP length.
419 	 * If not enough data to reflect UDP length, drop.
420 	 */
421 	len = ntohs((u_short)uh->uh_ulen);
422 	ip_len = ntohs(ip->ip_len) - iphlen;
423 	if (ip_len != len) {
424 		if (len > ip_len || len < sizeof(struct udphdr)) {
425 			udp_stat.udps_badlen++;
426 			goto bad;
427 		}
428 		m_adj(m, len - ip_len);
429 		/* ip->ip_len = htons(len); */
430 	}
431 	/*
432 	 * Save a copy of the IP header in case we want restore it
433 	 * for sending an ICMP error message in response.
434 	 */
435 	save_ip = *ip;
436 
437 	/*
438 	 * Checksum extended UDP header and data.
439 	 */
440 	if (uh->uh_sum) {
441 		if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
442 			if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
443 				uh->uh_sum = m->m_pkthdr.csum_data;
444 			else
445 				uh->uh_sum = in_pseudo(ip->ip_src.s_addr,
446 				    ip->ip_dst.s_addr, htonl((u_short)len +
447 				    m->m_pkthdr.csum_data + IPPROTO_UDP));
448 			uh->uh_sum ^= 0xffff;
449 		} else {
450 			char b[9];
451 
452 			bcopy(((struct ipovly *)ip)->ih_x1, b, 9);
453 			bzero(((struct ipovly *)ip)->ih_x1, 9);
454 			((struct ipovly *)ip)->ih_len = uh->uh_ulen;
455 			uh->uh_sum = in_cksum(m, len + sizeof(struct ip));
456 			bcopy(b, ((struct ipovly *)ip)->ih_x1, 9);
457 		}
458 		if (uh->uh_sum) {
459 			udp_stat.udps_badsum++;
460 			m_freem(m);
461 			return(IPPROTO_DONE);
462 		}
463 	} else {
464 		udp_stat.udps_nosum++;
465 	}
466 
467 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
468 	    in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) {
469 	    	struct inpcbhead *connhead;
470 		struct inpcontainer *ic, *ic_marker;
471 		struct inpcontainerhead *ichead;
472 		struct udp_mcast_arg arg;
473 		struct inpcb *last;
474 		int error;
475 
476 		/*
477 		 * Deliver a multicast or broadcast datagram to *all* sockets
478 		 * for which the local and remote addresses and ports match
479 		 * those of the incoming datagram.  This allows more than
480 		 * one process to receive multi/broadcasts on the same port.
481 		 * (This really ought to be done for unicast datagrams as
482 		 * well, but that would cause problems with existing
483 		 * applications that open both address-specific sockets and
484 		 * a wildcard socket listening to the same port -- they would
485 		 * end up receiving duplicates of every unicast datagram.
486 		 * Those applications open the multiple sockets to overcome an
487 		 * inadequacy of the UDP socket interface, but for backwards
488 		 * compatibility we avoid the problem here rather than
489 		 * fixing the interface.  Maybe 4.5BSD will remedy this?)
490 		 */
491 
492 		/*
493 		 * Construct sockaddr format source address.
494 		 */
495 		udp_in.sin_port = uh->uh_sport;
496 		udp_in.sin_addr = ip->ip_src;
497 		arg.udp_in = &udp_in;
498 		/*
499 		 * Locate pcb(s) for datagram.
500 		 * (Algorithm copied from raw_intr().)
501 		 */
502 		last = NULL;
503 		arg.iphlen = iphlen;
504 
505 		connhead = &pcbinfo->hashbase[
506 		    INP_PCBCONNHASH(ip->ip_src.s_addr, uh->uh_sport,
507 		    ip->ip_dst.s_addr, uh->uh_dport, pcbinfo->hashmask)];
508 		LIST_FOREACH(inp, connhead, inp_hash) {
509 #ifdef INET6
510 			if (!INP_ISIPV4(inp))
511 				continue;
512 #endif
513 			if (!in_hosteq(inp->inp_faddr, ip->ip_src) ||
514 			    !in_hosteq(inp->inp_laddr, ip->ip_dst) ||
515 			    inp->inp_fport != uh->uh_sport ||
516 			    inp->inp_lport != uh->uh_dport)
517 				continue;
518 
519 			arg.inp = inp;
520 			arg.last = last;
521 			arg.ip = ip;
522 			arg.m = m;
523 
524 			error = udp_mcast_input(&arg);
525 			if (error == ERESTART)
526 				continue;
527 			last = arg.last;
528 
529 			if (error == EJUSTRETURN)
530 				goto done;
531 		}
532 
533 		ichead = &pcbinfo->wildcardhashbase[
534 		    INP_PCBWILDCARDHASH(uh->uh_dport,
535 		    pcbinfo->wildcardhashmask)];
536 		ic_marker = in_pcbcontainer_marker();
537 
538 		GET_PCBINFO_TOKEN(pcbinfo);
539 		LIST_INSERT_HEAD(ichead, ic_marker, ic_list);
540 		while ((ic = LIST_NEXT(ic_marker, ic_list)) != NULL) {
541 			LIST_REMOVE(ic_marker, ic_list);
542 			LIST_INSERT_AFTER(ic, ic_marker, ic_list);
543 
544 			inp = ic->ic_inp;
545 			if (inp->inp_flags & INP_PLACEMARKER)
546 				continue;
547 #ifdef INET6
548 			if (!INP_ISIPV4(inp))
549 				continue;
550 #endif
551 			if (inp->inp_lport != uh->uh_dport)
552 				continue;
553 			if (inp->inp_laddr.s_addr != INADDR_ANY &&
554 			    inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
555 				continue;
556 
557 			arg.inp = inp;
558 			arg.last = last;
559 			arg.ip = ip;
560 			arg.m = m;
561 
562 			error = udp_mcast_input(&arg);
563 			if (error == ERESTART)
564 				continue;
565 			last = arg.last;
566 
567 			if (error == EJUSTRETURN)
568 				break;
569 		}
570 		LIST_REMOVE(ic_marker, ic_list);
571 		REL_PCBINFO_TOKEN(pcbinfo);
572 done:
573 		if (last == NULL) {
574 			/*
575 			 * No matching pcb found; discard datagram.
576 			 * (No need to send an ICMP Port Unreachable
577 			 * for a broadcast or multicast datgram.)
578 			 */
579 			udp_stat.udps_noportbcast++;
580 			goto bad;
581 		}
582 		udp_append(last, ip, m,
583 			   iphlen + sizeof(struct udphdr), &udp_in);
584 		return(IPPROTO_DONE);
585 	}
586 	/*
587 	 * Locate pcb for datagram.
588 	 */
589 	inp = in_pcblookup_pkthash(pcbinfo, ip->ip_src, uh->uh_sport,
590 	    ip->ip_dst, uh->uh_dport, TRUE, m->m_pkthdr.rcvif,
591 	    udp_reuseport_ext ? m : NULL);
592 	if (inp == NULL) {
593 		if (log_in_vain) {
594 			char src[INET_ADDRSTRLEN], dst[INET_ADDRSTRLEN];
595 
596 			log(LOG_INFO,
597 			    "Connection attempt to UDP %s:%d from %s:%d\n",
598 			    kinet_ntoa(ip->ip_dst, dst), ntohs(uh->uh_dport),
599 			    kinet_ntoa(ip->ip_src, src), ntohs(uh->uh_sport));
600 		}
601 		udp_stat.udps_noport++;
602 		if (m->m_flags & (M_BCAST | M_MCAST)) {
603 			udp_stat.udps_noportbcast++;
604 			goto bad;
605 		}
606 		if (blackhole)
607 			goto bad;
608 #ifdef ICMP_BANDLIM
609 		if (badport_bandlim(BANDLIM_ICMP_UNREACH) < 0)
610 			goto bad;
611 #endif
612 		*ip = save_ip;
613 		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
614 		return(IPPROTO_DONE);
615 	}
616 	KASSERT(INP_ISIPV4(inp), ("not inet inpcb"));
617 	/*
618 	 * Check the minimum TTL for socket.
619 	 */
620 	if (ip->ip_ttl < inp->inp_ip_minttl)
621 		goto bad;
622 
623 	/*
624 	 * Construct sockaddr format source address.
625 	 * Stuff source address and datagram in user buffer.
626 	 */
627 	udp_in.sin_port = uh->uh_sport;
628 	udp_in.sin_addr = ip->ip_src;
629 	if ((inp->inp_flags & INP_CONTROLOPTS) ||
630 	    (inp->inp_socket->so_options & SO_TIMESTAMP))
631 		ip_savecontrol(inp, &opts, ip, m);
632 	m_adj(m, iphlen + sizeof(struct udphdr));
633 
634 	lwkt_gettoken(&inp->inp_socket->so_rcv.ssb_token);
635 	if (ssb_appendaddr(&inp->inp_socket->so_rcv,
636 	    (struct sockaddr *)&udp_in, m, opts) == 0) {
637 		lwkt_reltoken(&inp->inp_socket->so_rcv.ssb_token);
638 		udp_stat.udps_fullsock++;
639 		soroverflow(inp->inp_socket);
640 		goto bad;
641 	}
642 	lwkt_reltoken(&inp->inp_socket->so_rcv.ssb_token);
643 	sorwakeup(inp->inp_socket);
644 	return(IPPROTO_DONE);
645 bad:
646 	m_freem(m);
647 	if (opts)
648 		m_freem(opts);
649 	return(IPPROTO_DONE);
650 }
651 
652 /*
653  * subroutine of udp_input(), mainly for source code readability.
654  * caller must properly init udp_ip6 and udp_in6 beforehand.
655  */
656 static void
657 udp_append(struct inpcb *last, struct ip *ip, struct mbuf *n, int off,
658     struct sockaddr_in *udp_in)
659 {
660 	struct mbuf *opts = NULL;
661 	int ret;
662 
663 	KASSERT(INP_ISIPV4(last), ("not inet inpcb"));
664 
665 	if (last->inp_flags & INP_CONTROLOPTS ||
666 	    last->inp_socket->so_options & SO_TIMESTAMP)
667 		ip_savecontrol(last, &opts, ip, n);
668 	m_adj(n, off);
669 
670 	lwkt_gettoken(&last->inp_socket->so_rcv.ssb_token);
671 	ret = ssb_appendaddr(&last->inp_socket->so_rcv,
672 	    (struct sockaddr *)udp_in, n, opts);
673 	lwkt_reltoken(&last->inp_socket->so_rcv.ssb_token);
674 	if (ret == 0) {
675 		m_freem(n);
676 		if (opts)
677 			m_freem(opts);
678 		udp_stat.udps_fullsock++;
679 	} else {
680 		sorwakeup(last->inp_socket);
681 	}
682 }
683 
684 /*
685  * Notify a udp user of an asynchronous error;
686  * just wake up so that he can collect error status.
687  */
688 void
689 udp_notify(struct inpcb *inp, int error)
690 {
691 	inp->inp_socket->so_error = error;
692 	sorwakeup(inp->inp_socket);
693 	sowwakeup(inp->inp_socket);
694 }
695 
696 struct netmsg_udp_notify {
697 	struct netmsg_base base;
698 	inp_notify_t	nm_notify;
699 	struct in_addr	nm_faddr;
700 	int		nm_arg;
701 };
702 
703 static void
704 udp_notifyall_oncpu(netmsg_t msg)
705 {
706 	struct netmsg_udp_notify *nm = (struct netmsg_udp_notify *)msg;
707 	int nextcpu, cpu = mycpuid;
708 
709 	ASSERT_NETISR_NCPUS(cpu);
710 
711 	in_pcbnotifyall(&udbinfo[cpu], nm->nm_faddr, nm->nm_arg, nm->nm_notify);
712 
713 	nextcpu = cpu + 1;
714 	if (nextcpu < netisr_ncpus)
715 		lwkt_forwardmsg(netisr_cpuport(nextcpu), &nm->base.lmsg);
716 	else
717 		lwkt_replymsg(&nm->base.lmsg, 0);
718 }
719 
720 inp_notify_t
721 udp_get_inpnotify(int cmd, const struct sockaddr *sa,
722     struct ip **ip0, int *cpuid)
723 {
724 	struct in_addr faddr;
725 	struct ip *ip = *ip0;
726 	inp_notify_t notify = udp_notify;
727 
728 	faddr = ((const struct sockaddr_in *)sa)->sin_addr;
729 	if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
730 		return NULL;
731 
732 	if (PRC_IS_REDIRECT(cmd)) {
733 		ip = NULL;
734 		notify = in_rtchange;
735 	} else if (cmd == PRC_HOSTDEAD) {
736 		ip = NULL;
737 	} else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0) {
738 		return NULL;
739 	}
740 
741 	if (cpuid != NULL) {
742 		if (ip == NULL) {
743 			/* Go through all effective netisr CPUs. */
744 			*cpuid = netisr_ncpus;
745 		} else {
746 			const struct udphdr *uh;
747 
748 			uh = (const struct udphdr *)
749 			    ((caddr_t)ip + (ip->ip_hl << 2));
750 			*cpuid = udp_addrcpu(faddr.s_addr, uh->uh_dport,
751 			    ip->ip_src.s_addr, uh->uh_sport);
752 		}
753 	}
754 
755 	*ip0 = ip;
756 	return notify;
757 }
758 
759 void
760 udp_ctlinput(netmsg_t msg)
761 {
762 	struct sockaddr *sa = msg->ctlinput.nm_arg;
763 	struct ip *ip = msg->ctlinput.nm_extra;
764 	int cmd = msg->ctlinput.nm_cmd, cpuid;
765 	inp_notify_t notify;
766 	struct in_addr faddr;
767 
768 	ASSERT_NETISR_NCPUS(mycpuid);
769 
770 	notify = udp_get_inpnotify(cmd, sa, &ip, &cpuid);
771 	if (notify == NULL)
772 		goto done;
773 
774 	faddr = ((struct sockaddr_in *)sa)->sin_addr;
775 	if (ip) {
776 		const struct udphdr *uh;
777 		struct inpcb *inp;
778 
779 		if (cpuid != mycpuid)
780 			goto done;
781 
782 		uh = (const struct udphdr *)((caddr_t)ip + (ip->ip_hl << 2));
783 		inp = in_pcblookup_hash(&udbinfo[mycpuid], faddr, uh->uh_dport,
784 					ip->ip_src, uh->uh_sport, 0, NULL);
785 		if (inp != NULL && inp->inp_socket != NULL)
786 			notify(inp, inetctlerrmap[cmd]);
787 	} else if (msg->ctlinput.nm_direct) {
788 		if (cpuid != netisr_ncpus && cpuid != mycpuid)
789 			goto done;
790 
791 		in_pcbnotifyall(&udbinfo[mycpuid], faddr, inetctlerrmap[cmd],
792 		    notify);
793 	} else {
794 		struct netmsg_udp_notify *nm;
795 
796 		ASSERT_NETISR0;
797 		nm = kmalloc(sizeof(*nm), M_LWKTMSG, M_INTWAIT);
798 		netmsg_init(&nm->base, NULL, &netisr_afree_rport,
799 			    0, udp_notifyall_oncpu);
800 		nm->nm_faddr = faddr;
801 		nm->nm_arg = inetctlerrmap[cmd];
802 		nm->nm_notify = notify;
803 		lwkt_sendmsg(netisr_cpuport(0), &nm->base.lmsg);
804 	}
805 done:
806 	lwkt_replymsg(&msg->lmsg, 0);
807 }
808 
809 SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist, CTLFLAG_RD, udbinfo, 0,
810 	    in_pcblist_ncpus, "S,xinpcb", "List of active UDP sockets");
811 
812 static int
813 udp_getcred(SYSCTL_HANDLER_ARGS)
814 {
815 	struct sockaddr_in addrs[2];
816 	struct ucred cred0, *cred = NULL;
817 	struct inpcb *inp;
818 	int error, cpu, origcpu;
819 
820 	error = priv_check(req->td, PRIV_ROOT);
821 	if (error)
822 		return (error);
823 	error = SYSCTL_IN(req, addrs, sizeof addrs);
824 	if (error)
825 		return (error);
826 
827 	origcpu = mycpuid;
828 	cpu = udp_addrcpu(addrs[1].sin_addr.s_addr, addrs[1].sin_port,
829 	    addrs[0].sin_addr.s_addr, addrs[0].sin_port);
830 
831 	lwkt_migratecpu(cpu);
832 
833 	inp = in_pcblookup_hash(&udbinfo[cpu],
834 	    addrs[1].sin_addr, addrs[1].sin_port,
835 	    addrs[0].sin_addr, addrs[0].sin_port, TRUE, NULL);
836 	if (inp == NULL || inp->inp_socket == NULL) {
837 		error = ENOENT;
838 	} else if (inp->inp_socket->so_cred != NULL) {
839 		cred0 = *(inp->inp_socket->so_cred);
840 		cred = &cred0;
841 	}
842 
843 	lwkt_migratecpu(origcpu);
844 
845 	if (error)
846 		return error;
847 
848 	return SYSCTL_OUT(req, cred, sizeof(struct ucred));
849 }
850 SYSCTL_PROC(_net_inet_udp, OID_AUTO, getcred, CTLTYPE_OPAQUE|CTLFLAG_RW,
851     0, 0, udp_getcred, "S,ucred", "Get the ucred of a UDP connection");
852 
853 static void
854 udp_send_redispatch(netmsg_t msg)
855 {
856 	struct mbuf *m = msg->send.nm_m;
857 	int pru_flags = msg->send.nm_flags;
858 	struct inpcb *inp = msg->send.base.nm_so->so_pcb;
859 	struct mbuf *m_opt = msg->send.nm_control; /* XXX save ipopt */
860 	int flags = msg->send.nm_priv; /* ip_output flags */
861 	int error;
862 
863 	logudp(redisp_ipout_beg, inp);
864 
865 	/*
866 	 * - Don't use inp route cache.  It should only be used in the
867 	 *   inp owner netisr.
868 	 * - Access to inp_moptions should be safe, since multicast UDP
869 	 *   datagrams are redispatched to netisr0 and inp_moptions is
870 	 *   changed only in netisr0.
871 	 */
872 	error = ip_output(m, m_opt, NULL, flags, inp->inp_moptions, inp);
873 	if ((pru_flags & PRUS_NOREPLY) == 0)
874 		lwkt_replymsg(&msg->send.base.lmsg, error);
875 
876 	if (m_opt != NULL) {
877 		/* Free saved ip options, if any */
878 		m_freem(m_opt);
879 	}
880 
881 	logudp(redisp_ipout_end, inp);
882 }
883 
884 static void
885 udp_send(netmsg_t msg)
886 {
887 	struct socket *so = msg->send.base.nm_so;
888 	struct mbuf *m = msg->send.nm_m;
889 	struct sockaddr *dstaddr = msg->send.nm_addr;
890 	int pru_flags = msg->send.nm_flags;
891 	struct inpcb *inp = so->so_pcb;
892 	struct thread *td = msg->send.nm_td;
893 	struct mbuf *control = msg->send.nm_control;
894 	uint16_t hash;
895 	int flags;
896 
897 	struct udpiphdr *ui;
898 	int len = m->m_pkthdr.len;
899 	struct sockaddr_in *sin;	/* really is initialized before use */
900 	int error = 0, cpu;
901 	struct sockaddr_in src;
902 	struct in_addr laddr;
903 	u_char tos;
904 
905 	logudp(send_beg, inp);
906 
907 	if (inp == NULL) {
908 		error = EINVAL;
909 		goto release;
910 	}
911 
912 	if (len + sizeof(struct udpiphdr) > IP_MAXPACKET) {
913 		error = EMSGSIZE;
914 		goto release;
915 	}
916 
917 	if (inp->inp_lport == 0) {	/* unbound socket */
918 		boolean_t forwarded;
919 
920 		error = in_pcbbind(inp, NULL, td);
921 		if (error)
922 			goto release;
923 
924 		/*
925 		 * Need to call udp_send again, after this inpcb is
926 		 * inserted into wildcard hash table.
927 		 */
928 		msg->send.base.lmsg.ms_flags |= MSGF_UDP_SEND;
929 		forwarded = udp_inswildcardhash(inp, &msg->send.base, 0);
930 		if (forwarded) {
931 			/*
932 			 * The message is further forwarded, so we are
933 			 * done here.
934 			 */
935 			logudp(send_inswildcard, inp);
936 			return;
937 		}
938 	}
939 
940 	tos = inp->inp_ip_tos;
941 	src.sin_family = 0;
942 	if (control != NULL) {
943 		struct cmsghdr *cm;
944 
945 		/*
946 		 * XXX: Currently, we assume all the optional information is
947 		 * stored in a single mbuf.
948 		 */
949 		if (control->m_next) {
950 			error = EINVAL;
951 			goto release;
952 		}
953 		for (; control->m_len > 0;
954 		    control->m_data += CMSG_ALIGN(cm->cmsg_len),
955 		    control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
956 			cm = mtod(control, struct cmsghdr *);
957 			if (control->m_len < sizeof(*cm) ||
958 			    cm->cmsg_len == 0 ||
959 			    cm->cmsg_len > control->m_len) {
960 				error = EINVAL;
961 				goto release;
962 			}
963 			if (cm->cmsg_level != IPPROTO_IP)
964 				continue;
965 
966 			switch (cm->cmsg_type) {
967 			case IP_SENDSRCADDR:
968 				if (cm->cmsg_len !=
969 				    CMSG_LEN(sizeof(struct in_addr))) {
970 					error = EINVAL;
971 					goto release;
972 				}
973 				src.sin_family = AF_INET;
974 				src.sin_len = sizeof(src);
975 				src.sin_addr = *(struct in_addr *)CMSG_DATA(cm);
976 				break;
977 
978 			case IP_TOS:
979 				if (cm->cmsg_len != CMSG_LEN(sizeof(u_char))) {
980 					error = EINVAL;
981 					goto release;
982 				}
983 				tos = *(u_char *)CMSG_DATA(cm);
984 				break;
985 
986 			default:
987 				error = ENOPROTOOPT;
988 				goto release;
989 			}
990 		}
991 		KKASSERT(error == 0);
992 
993 		m_freem(control);
994 		control = NULL;
995 	}
996 
997 	/*
998 	 * If the IP_SENDSRCADDR control message was specified, override the
999 	 * source address for this datagram.  Its use is invalidated if the
1000 	 * address thus specified is incomplete or clobbers other inpcbs.
1001 	 */
1002 	laddr = inp->inp_laddr;
1003 	if (src.sin_family == AF_INET) {
1004 		error = in_pcbsrcaddr_check(inp, &src, &laddr, td);
1005 		if (error)
1006 			goto release;
1007 	}
1008 
1009 	if (dstaddr != NULL) {		/* destination address specified */
1010 		if (inp->inp_faddr.s_addr != INADDR_ANY) {
1011 			/* already connected */
1012 			error = EISCONN;
1013 			goto release;
1014 		}
1015 		sin = (struct sockaddr_in *)dstaddr;
1016 	} else {
1017 		if (inp->inp_faddr.s_addr == INADDR_ANY) {
1018 			/* no destination specified and not already connected */
1019 			error = ENOTCONN;
1020 			goto release;
1021 		}
1022 		sin = NULL;
1023 	}
1024 
1025 	/*
1026 	 * Calculate data length and get a mbuf
1027 	 * for UDP and IP headers.
1028 	 */
1029 	M_PREPEND(m, sizeof(struct udpiphdr), M_NOWAIT);
1030 	if (m == NULL) {
1031 		error = ENOBUFS;
1032 		goto release;
1033 	}
1034 
1035 	/*
1036 	 * Fill in mbuf with extended UDP header
1037 	 * and addresses and length put into network format.
1038 	 */
1039 	ui = mtod(m, struct udpiphdr *);
1040 	bzero(ui->ui_x1, sizeof ui->ui_x1);	/* XXX still needed? */
1041 	ui->ui_pr = IPPROTO_UDP;
1042 
1043 	/*
1044 	 * Set destination address.
1045 	 */
1046 	if (dstaddr != NULL) {			/* use specified destination */
1047 		ui->ui_dst = sin->sin_addr;
1048 		ui->ui_dport = sin->sin_port;
1049 	} else {				/* use connected destination */
1050 		ui->ui_dst = inp->inp_faddr;
1051 		ui->ui_dport = inp->inp_fport;
1052 	}
1053 
1054 	/*
1055 	 * Set source address.
1056 	 */
1057 	if (laddr.s_addr == INADDR_ANY || IN_MULTICAST(ntohl(laddr.s_addr))) {
1058 		struct sockaddr_in *if_sin;
1059 
1060 		if (dstaddr == NULL) {
1061 			/*
1062 			 * connect() had (or should have) failed because
1063 			 * the interface had no IP address, but the
1064 			 * application proceeded to call send() anyways.
1065 			 */
1066 			error = ENOTCONN;
1067 			goto release;
1068 		}
1069 
1070 		/* Look up outgoing interface. */
1071 		error = in_pcbladdr_find(inp, dstaddr, &if_sin, td, 1);
1072 		if (error)
1073 			goto release;
1074 		ui->ui_src = if_sin->sin_addr;	/* use address of interface */
1075 	} else {
1076 		ui->ui_src = laddr;		/* use non-null bound address */
1077 	}
1078 	ui->ui_sport = inp->inp_lport;
1079 	KASSERT(inp->inp_lport != 0, ("inp lport should have been bound"));
1080 
1081 	/*
1082 	 * Release the original thread, since it is no longer used
1083 	 */
1084 	if (pru_flags & PRUS_HELDTD) {
1085 		lwkt_rele(td);
1086 		pru_flags &= ~PRUS_HELDTD;
1087 	}
1088 	/*
1089 	 * Free the dest address, since it is no longer needed
1090 	 */
1091 	if (pru_flags & PRUS_FREEADDR) {
1092 		kfree(dstaddr, M_SONAME);
1093 		pru_flags &= ~PRUS_FREEADDR;
1094 	}
1095 
1096 	ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
1097 
1098 	/*
1099 	 * Set up checksum and output datagram.
1100 	 */
1101 	if (udpcksum) {
1102 		ui->ui_sum = in_pseudo(ui->ui_src.s_addr, ui->ui_dst.s_addr,
1103 		    htons((u_short)len + sizeof(struct udphdr) + IPPROTO_UDP));
1104 		m->m_pkthdr.csum_flags = CSUM_UDP;
1105 		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
1106 		m->m_pkthdr.csum_thlen = sizeof(struct udphdr);
1107 	} else {
1108 		ui->ui_sum = 0;
1109 	}
1110 	((struct ip *)ui)->ip_len = htons(sizeof(struct udpiphdr) + len);
1111 	((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl;	/* XXX */
1112 	((struct ip *)ui)->ip_tos = tos;
1113 	udp_stat.udps_opackets++;
1114 
1115 	flags = IP_DEBUGROUTE |
1116 	    (inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST));
1117 	if (pru_flags & PRUS_DONTROUTE)
1118 		flags |= SO_DONTROUTE;
1119 
1120 	/*
1121 	 * NOTE:
1122 	 * For multicast bound and connected socket, source address of
1123 	 * the datagram is selected at the time of the sending, so the
1124 	 * datagram will have to be hashed.
1125 	 */
1126 	if ((inp->inp_flags & INP_CONNECTED) &&
1127 	    ui->ui_src.s_addr == inp->inp_laddr.s_addr) {
1128 		/*
1129 		 * For connected socket, this datagram has already
1130 		 * been in the correct netisr; no need to rehash.
1131 		 */
1132 		KASSERT(inp->inp_flags & INP_HASH, ("inpcb has no hash"));
1133 		m_sethash(m, inp->inp_hashval);
1134 		goto sendit;
1135 	}
1136 
1137 	hash = udp_addrhash(ui->ui_dst.s_addr, ui->ui_dport,
1138 	    ui->ui_src.s_addr, ui->ui_sport);
1139 	m_sethash(m, hash);
1140 
1141 	cpu = netisr_hashcpu(hash);
1142 	if (cpu != mycpuid) {
1143 		struct mbuf *m_opt = NULL;
1144 		struct netmsg_pru_send *smsg;
1145 		struct lwkt_port *port = netisr_cpuport(cpu);
1146 
1147 		if (inp->inp_flags & INP_DIRECT_DETACH) {
1148 			/*
1149 			 * No longer direct detachable, i.e. datagram has
1150 			 * to be forwarded to other CPUs for multicast
1151 			 * bound and connected socket.
1152 			 */
1153 			inp->inp_flags &= ~INP_DIRECT_DETACH;
1154 		}
1155 
1156 		/*
1157 		 * Not on the CPU that matches this UDP datagram hash;
1158 		 * redispatch to the correct CPU to do the ip_output().
1159 		 */
1160 		if (inp->inp_options != NULL) {
1161 			/*
1162 			 * If there are ip options, then save a copy,
1163 			 * since accessing inp_options on other CPUs'
1164 			 * is not safe.
1165 			 *
1166 			 * XXX optimize this?
1167 			 */
1168 			m_opt = m_copym(inp->inp_options, 0, M_COPYALL,
1169 			    M_WAITOK);
1170 		}
1171 		if ((pru_flags & PRUS_NOREPLY) == 0) {
1172 			/*
1173 			 * Change some parts of the original netmsg and
1174 			 * forward it to the target netisr.
1175 			 *
1176 			 * NOTE: so_port MUST NOT be checked in the target
1177 			 * netisr.
1178 			 */
1179 			smsg = &msg->send;
1180 			smsg->nm_priv = flags; /* ip_output flags */
1181 			smsg->nm_m = m;
1182 			smsg->nm_control = m_opt; /* XXX save ipopt */
1183 			smsg->base.lmsg.ms_flags |= MSGF_IGNSOPORT;
1184 			smsg->base.nm_dispatch = udp_send_redispatch;
1185 			lwkt_forwardmsg(port, &smsg->base.lmsg);
1186 		} else {
1187 			/*
1188 			 * Recreate the netmsg, since the original mbuf
1189 			 * could have been changed.  And send it to the
1190 			 * target netisr.
1191 			 *
1192 			 * NOTE: so_port MUST NOT be checked in the target
1193 			 * netisr.
1194 			 */
1195 			smsg = &m->m_hdr.mh_sndmsg;
1196 			netmsg_init(&smsg->base, so, &netisr_apanic_rport,
1197 			    MSGF_IGNSOPORT, udp_send_redispatch);
1198 			smsg->nm_priv = flags; /* ip_output flags */
1199 			smsg->nm_flags = pru_flags;
1200 			smsg->nm_m = m;
1201 			smsg->nm_control = m_opt; /* XXX save ipopt */
1202 			lwkt_sendmsg(port, &smsg->base.lmsg);
1203 		}
1204 
1205 		/* This UDP datagram is redispatched; done */
1206 		logudp(send_redisp, inp);
1207 		return;
1208 	}
1209 
1210 sendit:
1211 	logudp(send_ipout, inp);
1212 	error = ip_output(m, inp->inp_options, &inp->inp_route, flags,
1213 	    inp->inp_moptions, inp);
1214 	m = NULL;
1215 
1216 release:
1217 	if (m != NULL)
1218 		m_freem(m);
1219 	if (control != NULL)
1220 		m_freem(control);
1221 
1222 	if (pru_flags & PRUS_HELDTD)
1223 		lwkt_rele(td);
1224 	if (pru_flags & PRUS_FREEADDR)
1225 		kfree(dstaddr, M_SONAME);
1226 	if ((pru_flags & PRUS_NOREPLY) == 0)
1227 		lwkt_replymsg(&msg->send.base.lmsg, error);
1228 
1229 	logudp(send_end, inp);
1230 }
1231 
1232 u_long	udp_sendspace = 9216;		/* really max datagram size */
1233 					/* 40 1K datagrams */
1234 SYSCTL_INT(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram, CTLFLAG_RW,
1235     &udp_sendspace, 0, "Maximum outgoing UDP datagram size");
1236 
1237 u_long	udp_recvspace = 40 * (1024 +
1238 #ifdef INET6
1239 				      sizeof(struct sockaddr_in6)
1240 #else
1241 				      sizeof(struct sockaddr_in)
1242 #endif
1243 				      );
1244 SYSCTL_INT(_net_inet_udp, UDPCTL_RECVSPACE, recvspace, CTLFLAG_RW,
1245     &udp_recvspace, 0, "Maximum incoming UDP datagram size");
1246 
1247 /*
1248  * This should never happen, since UDP socket does not support
1249  * connection acception (SO_ACCEPTCONN, i.e. listen(2)).
1250  */
1251 static void
1252 udp_abort(netmsg_t msg __unused)
1253 {
1254 	panic("udp_abort is called");
1255 }
1256 
1257 static int
1258 udp_preattach(struct socket *so, int proto __unused, struct pru_attach_info *ai)
1259 {
1260 	return soreserve(so, udp_sendspace, udp_recvspace, ai->sb_rlimit);
1261 }
1262 
1263 static void
1264 udp_attach(netmsg_t msg)
1265 {
1266 	struct socket *so = msg->attach.base.nm_so;
1267 	struct pru_attach_info *ai = msg->attach.nm_ai;
1268 	struct inpcb *inp;
1269 	int error;
1270 
1271 	KASSERT(so->so_pcb == NULL, ("udp socket attached"));
1272 
1273 	if (ai != NULL) {
1274 		error = udp_preattach(so, 0 /* don't care */, ai);
1275 		if (error)
1276 			goto out;
1277 	} else {
1278 		/* Post attach; do nothing */
1279 	}
1280 
1281 	error = in_pcballoc(so, &udbinfo[mycpuid]);
1282 	if (error)
1283 		goto out;
1284 
1285 	inp = so->so_pcb;
1286 	inp->inp_flags |= INP_DIRECT_DETACH;
1287 	inp->inp_ip_ttl = ip_defttl;
1288 	error = 0;
1289 out:
1290 	lwkt_replymsg(&msg->attach.base.lmsg, error);
1291 }
1292 
1293 static void
1294 udp_inswildcard_replymsg(netmsg_t msg)
1295 {
1296 	lwkt_msg_t lmsg = &msg->lmsg;
1297 
1298 	if (lmsg->ms_flags & MSGF_UDP_SEND) {
1299 		udp_send(msg);
1300 		/* msg is replied by udp_send() */
1301 	} else {
1302 		lwkt_replymsg(lmsg, lmsg->ms_error);
1303 	}
1304 }
1305 
1306 static void
1307 udp_soreuseport_dispatch(netmsg_t msg)
1308 {
1309 	/* This inpcb has already been in the wildcard hash. */
1310 	in_pcblink_flags(msg->base.nm_so->so_pcb, &udbinfo[mycpuid], 0);
1311 	udp_inswildcard_replymsg(msg);
1312 }
1313 
1314 static void
1315 udp_sosetport(struct lwkt_msg *msg, lwkt_port_t port)
1316 {
1317 	sosetport(((struct netmsg_base *)msg)->nm_so, port);
1318 }
1319 
1320 static boolean_t
1321 udp_inswildcardhash_oncpu(struct inpcb *inp, struct netmsg_base *msg)
1322 {
1323 	int cpu;
1324 
1325 	KASSERT(inp->inp_pcbinfo == &udbinfo[mycpuid],
1326 	    ("not on owner cpu"));
1327 
1328 	in_pcbinswildcardhash(inp);
1329 	for (cpu = 0; cpu < netisr_ncpus; ++cpu) {
1330 		if (cpu == mycpuid) {
1331 			/*
1332 			 * This inpcb has been inserted by the above
1333 			 * in_pcbinswildcardhash().
1334 			 */
1335 			continue;
1336 		}
1337 		in_pcbinswildcardhash_oncpu(inp, &udbinfo[cpu]);
1338 	}
1339 
1340 	/* NOTE: inp_lgrpindex is _not_ assigned in jail. */
1341 	if ((inp->inp_socket->so_options & SO_REUSEPORT) &&
1342 	    inp->inp_lgrpindex >= 0) {
1343 		/*
1344 		 * For SO_REUSEPORT socket, redistribute it based on its
1345 		 * local group index.
1346 		 */
1347 		cpu = inp->inp_lgrpindex % netisr_ncpus;
1348 		if (cpu != mycpuid) {
1349 			struct lwkt_port *port = netisr_cpuport(cpu);
1350 			lwkt_msg_t lmsg = &msg->lmsg;
1351 
1352 			/*
1353 			 * We are moving the protocol processing port the
1354 			 * socket is on, we have to unlink here and re-link
1355 			 * on the target cpu (this inpcb is still left in
1356 			 * the wildcard hash).
1357 			 */
1358 			in_pcbunlink_flags(inp, &udbinfo[mycpuid], 0);
1359 			msg->nm_dispatch = udp_soreuseport_dispatch;
1360 
1361 			/*
1362 			 * See the related comment in tcp_usrreq.c
1363 			 * tcp_connect()
1364 			 */
1365 			lwkt_setmsg_receipt(lmsg, udp_sosetport);
1366 			lwkt_forwardmsg(port, lmsg);
1367 			return TRUE; /* forwarded */
1368 		}
1369 	}
1370 	return FALSE;
1371 }
1372 
1373 static void
1374 udp_inswildcardhash_dispatch(netmsg_t msg)
1375 {
1376 	struct inpcb *inp = msg->base.nm_so->so_pcb;
1377 	boolean_t forwarded;
1378 
1379 	KASSERT(inp->inp_lport != 0, ("local port not set yet"));
1380 	KASSERT(udp_lportcpu(inp->inp_lport) == mycpuid, ("not target cpu"));
1381 
1382 	in_pcblink(inp, &udbinfo[mycpuid]);
1383 
1384 	forwarded = udp_inswildcardhash_oncpu(inp, &msg->base);
1385 	if (forwarded) {
1386 		/* The message is further forwarded, so we are done here. */
1387 		return;
1388 	}
1389 	udp_inswildcard_replymsg(msg);
1390 }
1391 
1392 static boolean_t
1393 udp_inswildcardhash(struct inpcb *inp, struct netmsg_base *msg, int error)
1394 {
1395 	lwkt_msg_t lmsg = &msg->lmsg;
1396 	int cpu;
1397 
1398 	ASSERT_INP_NOTINHASH(inp);
1399 
1400 	/* This inpcb could no longer be directly detached */
1401 	inp->inp_flags &= ~INP_DIRECT_DETACH;
1402 
1403 	/*
1404 	 * Always clear the route cache, so we don't need to
1405 	 * worry about any owner CPU changes later.
1406 	 */
1407 	in_pcbresetroute(inp);
1408 
1409 	KASSERT(inp->inp_lport != 0, ("local port not set yet"));
1410 	cpu = udp_lportcpu(inp->inp_lport);
1411 
1412 	lmsg->ms_error = error;
1413 	if (cpu != mycpuid) {
1414 		struct lwkt_port *port = netisr_cpuport(cpu);
1415 
1416 		/*
1417 		 * We are moving the protocol processing port the socket
1418 		 * is on, we have to unlink here and re-link on the
1419 		 * target cpu.
1420 		 */
1421 		in_pcbunlink(inp, &udbinfo[mycpuid]);
1422 		msg->nm_dispatch = udp_inswildcardhash_dispatch;
1423 
1424 		/* See the related comment in tcp_usrreq.c tcp_connect() */
1425 		lwkt_setmsg_receipt(lmsg, udp_sosetport);
1426 		lwkt_forwardmsg(port, lmsg);
1427 		return TRUE; /* forwarded */
1428 	}
1429 
1430 	return udp_inswildcardhash_oncpu(inp, msg);
1431 }
1432 
1433 static void
1434 udp_bind(netmsg_t msg)
1435 {
1436 	struct socket *so = msg->bind.base.nm_so;
1437 	struct inpcb *inp;
1438 	int error;
1439 
1440 	inp = so->so_pcb;
1441 	if (inp) {
1442 		struct sockaddr *nam = msg->bind.nm_nam;
1443 		struct thread *td = msg->bind.nm_td;
1444 		struct sockaddr_in *sin;
1445 		lwkt_port_t port;
1446 		int cpu;
1447 
1448 		/*
1449 		 * Check "already bound" here (in_pcbbind() does the same
1450 		 * check though), so we don't forward a connected/bound
1451 		 * socket randomly which would panic in the following
1452 		 * in_pcbunlink().
1453 		 */
1454 		if (inp->inp_lport != 0 ||
1455 		    inp->inp_laddr.s_addr != INADDR_ANY) {
1456 			error = EINVAL;	/* already bound */
1457 			goto done;
1458 		}
1459 
1460 		if (nam->sa_len != sizeof(*sin)) {
1461 			error = EINVAL;
1462 			goto done;
1463 		}
1464 		sin = (struct sockaddr_in *)nam;
1465 
1466 		cpu = udp_lportcpu(sin->sin_port);
1467 		port = netisr_cpuport(cpu);
1468 
1469 		/*
1470 		 * See the related comment in tcp_usrreq.c tcp_usr_bind().
1471 		 * The exception is that we use local port based netisr
1472 		 * to serialize in_pcbbind().
1473 		 */
1474 		if (&curthread->td_msgport != port) {
1475 			lwkt_msg_t lmsg = &msg->bind.base.lmsg;
1476 
1477 			KASSERT((msg->bind.nm_flags & PRUB_RELINK) == 0,
1478 			    ("already asked to relink"));
1479 
1480 			in_pcbunlink(so->so_pcb, &udbinfo[mycpuid]);
1481 			msg->bind.nm_flags |= PRUB_RELINK;
1482 
1483 			/*
1484 			 * See the related comment in tcp_usrreq.c
1485 			 * tcp_connect().
1486 			 */
1487 			lwkt_setmsg_receipt(lmsg, udp_sosetport);
1488 			lwkt_forwardmsg(port, lmsg);
1489 			/* msg invalid now */
1490 			return;
1491 		}
1492 		KASSERT(so->so_port == port, ("so_port is not netisr%d", cpu));
1493 
1494 		if (msg->bind.nm_flags & PRUB_RELINK) {
1495 			msg->bind.nm_flags &= ~PRUB_RELINK;
1496 			in_pcblink(so->so_pcb, &udbinfo[mycpuid]);
1497 		}
1498 		KASSERT(inp->inp_pcbinfo == &udbinfo[cpu],
1499 		    ("pcbinfo is not udbinfo%d", cpu));
1500 
1501 		error = in_pcbbind(inp, nam, td);
1502 		if (error == 0) {
1503 			boolean_t forwarded;
1504 
1505 			if (sin->sin_addr.s_addr != INADDR_ANY)
1506 				inp->inp_flags |= INP_WASBOUND_NOTANY;
1507 
1508 			forwarded = udp_inswildcardhash(inp,
1509 			    &msg->bind.base, 0);
1510 			if (forwarded) {
1511 				/*
1512 				 * The message is further forwarded, so
1513 				 * we are done here.
1514 				 */
1515 				return;
1516 			}
1517 		}
1518 	} else {
1519 		error = EINVAL;
1520 	}
1521 done:
1522 	lwkt_replymsg(&msg->bind.base.lmsg, error);
1523 }
1524 
1525 static int
1526 udp_preconnect(struct socket *so, const struct sockaddr *nam __unused,
1527     struct thread *td __unused)
1528 {
1529 	sosetstate(so, SS_ISCONNECTED);		/* XXX */
1530 	return 0;
1531 }
1532 
1533 static void
1534 udp_connect(netmsg_t msg)
1535 {
1536 	struct socket *so = msg->connect.base.nm_so;
1537 	struct sockaddr *nam = msg->connect.nm_nam;
1538 	struct thread *td = msg->connect.nm_td;
1539 	struct inpcb *inp;
1540 	struct sockaddr_in *sin = (struct sockaddr_in *)nam;
1541 	struct sockaddr_in *if_sin;
1542 	struct lwkt_port *port;
1543 	uint16_t hash;
1544 	int error;
1545 
1546 	KKASSERT(msg->connect.nm_m == NULL);
1547 
1548 	inp = so->so_pcb;
1549 	if (inp == NULL) {
1550 		error = EINVAL;
1551 		goto out;
1552 	}
1553 
1554 	if (msg->connect.nm_flags & PRUC_RECONNECT) {
1555 		msg->connect.nm_flags &= ~PRUC_RECONNECT;
1556 		in_pcblink(inp, &udbinfo[mycpuid]);
1557 	}
1558 
1559 	if (inp->inp_faddr.s_addr != INADDR_ANY) {
1560 		error = EISCONN;
1561 		goto out;
1562 	}
1563 	error = 0;
1564 
1565 	/*
1566 	 * Bind if we have to
1567 	 */
1568 	if (inp->inp_lport == 0) {
1569 		error = in_pcbbind(inp, NULL, td);
1570 		if (error)
1571 			goto out;
1572 	}
1573 
1574 	/*
1575 	 * Calculate the correct protocol processing thread.  The connect
1576 	 * operation must run there.
1577 	 */
1578 	error = in_pcbladdr(inp, nam, &if_sin, td);
1579 	if (error)
1580 		goto out;
1581 
1582 	hash = udp_addrhash(sin->sin_addr.s_addr, sin->sin_port,
1583 	    inp->inp_laddr.s_addr != INADDR_ANY ?
1584 	    inp->inp_laddr.s_addr : if_sin->sin_addr.s_addr, inp->inp_lport);
1585 	port = netisr_hashport(hash);
1586 	if (port != &curthread->td_msgport) {
1587 		lwkt_msg_t lmsg = &msg->connect.base.lmsg;
1588 		int nm_flags = PRUC_RECONNECT;
1589 
1590 		/*
1591 		 * in_pcbladdr() may have allocated a route entry for us
1592 		 * on the current CPU, but we need a route entry on the
1593 		 * inpcb's owner CPU, so free it here.
1594 		 */
1595 		in_pcbresetroute(inp);
1596 
1597 		if (inp->inp_flags & INP_WILDCARD) {
1598 			/*
1599 			 * Remove this inpcb from the wildcard hash before
1600 			 * the socket's msgport changes.
1601 			 */
1602 			udp_remwildcardhash(inp);
1603 		}
1604 
1605 		if (so->so_orig_port == NULL) {
1606 			/*
1607 			 * First time change protocol processing port.
1608 			 * Save the current port for synchronization upon
1609 			 * udp_detach.
1610 			 */
1611 			so->so_orig_port = &curthread->td_msgport;
1612 		} else {
1613 			/*
1614 			 * We have changed protocol processing port more
1615 			 * than once.  We could not do direct detach
1616 			 * anymore, because we lose the track of the
1617 			 * original protocol processing ports to perform
1618 			 * synchronization upon udp_detach.  This should
1619 			 * be rare though.
1620 			 */
1621 			inp->inp_flags &= ~INP_DIRECT_DETACH;
1622 		}
1623 
1624 		/*
1625 		 * We are moving the protocol processing port the socket
1626 		 * is on, we have to unlink here and re-link on the
1627 		 * target cpu.
1628 		 */
1629 		in_pcbunlink(inp, &udbinfo[mycpuid]);
1630 		msg->connect.nm_flags |= nm_flags;
1631 
1632 		/* See the related comment in tcp_usrreq.c tcp_connect() */
1633 		lwkt_setmsg_receipt(lmsg, udp_sosetport);
1634 		lwkt_forwardmsg(port, lmsg);
1635 		/* msg invalid now */
1636 		return;
1637 	}
1638 	error = udp_connect_oncpu(inp, sin, if_sin, hash);
1639 out:
1640 	if (msg->connect.nm_flags & PRUC_HELDTD)
1641 		lwkt_rele(td);
1642 	if (error && (msg->connect.nm_flags & PRUC_ASYNC)) {
1643 		if (inp->inp_lport == 0) {
1644 			/*
1645 			 * As long as we have the local port, it is fine
1646 			 * for connect to fail, e.g. disconnect.
1647 			 */
1648 			so->so_error = error;
1649 		}
1650 		soclrstate(so, SS_ISCONNECTED);
1651 		/*
1652 		 * Wake up callers blocked on this socket to make sure
1653 		 * that they can see this error.
1654 		 *
1655 		 * NOTE:
1656 		 * sodisconnected() can't be used here, which bricks
1657 		 * sending and receiving.
1658 		 */
1659 		wakeup(&so->so_timeo);
1660 		sowwakeup(so);
1661 		sorwakeup(so);
1662 	}
1663 	if (error && inp != NULL && inp->inp_lport != 0 &&
1664 	    (inp->inp_flags & INP_WILDCARD) == 0) {
1665 		boolean_t forwarded;
1666 
1667 		/* Connect failed; put it to wildcard hash. */
1668 		forwarded = udp_inswildcardhash(inp, &msg->connect.base,
1669 		    error);
1670 		if (forwarded) {
1671 			/*
1672 			 * The message is further forwarded, so we are done
1673 			 * here.
1674 			 */
1675 			return;
1676 		}
1677 	}
1678 	lwkt_replymsg(&msg->connect.base.lmsg, error);
1679 }
1680 
1681 static void
1682 udp_remwildcardhash(struct inpcb *inp)
1683 {
1684 	int cpu;
1685 
1686 	KASSERT(inp->inp_pcbinfo == &udbinfo[mycpuid],
1687 	    ("not on owner cpu"));
1688 
1689 	for (cpu = 0; cpu < netisr_ncpus; ++cpu) {
1690 		if (cpu == mycpuid) {
1691 			/*
1692 			 * This inpcb will be removed by the later
1693 			 * in_pcbremwildcardhash().
1694 			 */
1695 			continue;
1696 		}
1697 		in_pcbremwildcardhash_oncpu(inp, &udbinfo[cpu]);
1698 	}
1699 	in_pcbremwildcardhash(inp);
1700 }
1701 
1702 static int
1703 udp_connect_oncpu(struct inpcb *inp, struct sockaddr_in *sin,
1704     struct sockaddr_in *if_sin, uint16_t hash)
1705 {
1706 	struct socket *so = inp->inp_socket;
1707 	struct inpcb *oinp;
1708 
1709 	oinp = in_pcblookup_hash(inp->inp_pcbinfo,
1710 	    sin->sin_addr, sin->sin_port,
1711 	    inp->inp_laddr.s_addr != INADDR_ANY ?
1712 	    inp->inp_laddr : if_sin->sin_addr, inp->inp_lport, FALSE, NULL);
1713 	if (oinp != NULL)
1714 		return EADDRINUSE;
1715 
1716 	/*
1717 	 * No more errors can occur, finish adjusting the socket
1718 	 * and change the processing port to reflect the connected
1719 	 * socket.  Once set we can no longer safely mess with the
1720 	 * socket.
1721 	 */
1722 
1723 	if (inp->inp_flags & INP_WILDCARD)
1724 		udp_remwildcardhash(inp);
1725 
1726 	if (inp->inp_laddr.s_addr == INADDR_ANY)
1727 		inp->inp_laddr = if_sin->sin_addr;
1728 	inp->inp_faddr = sin->sin_addr;
1729 	inp->inp_fport = sin->sin_port;
1730 	in_pcbinsconnhash(inp);
1731 
1732 	inp->inp_flags |= INP_HASH;
1733 	inp->inp_hashval = hash;
1734 
1735 	soisconnected(so);
1736 
1737 	return 0;
1738 }
1739 
1740 static void
1741 udp_detach2(struct socket *so)
1742 {
1743 	in_pcbdetach(so->so_pcb);
1744 	sodiscard(so);
1745 	sofree(so);
1746 }
1747 
1748 static void
1749 udp_detach_final_dispatch(netmsg_t msg)
1750 {
1751 	udp_detach2(msg->base.nm_so);
1752 }
1753 
1754 static void
1755 udp_detach_oncpu_dispatch(netmsg_t msg)
1756 {
1757 	struct netmsg_base *clomsg = &msg->base;
1758 	struct socket *so = clomsg->nm_so;
1759 	struct inpcb *inp = so->so_pcb;
1760 	struct thread *td = curthread;
1761 	int nextcpu, cpuid = mycpuid;
1762 
1763 	KASSERT(td->td_type == TD_TYPE_NETISR, ("not in netisr"));
1764 
1765 	if (inp->inp_flags & INP_WILDCARD) {
1766 		/*
1767 		 * This inp will be removed on the inp's
1768 		 * owner CPU later, so don't do it now.
1769 		 */
1770 		if (&td->td_msgport != so->so_port)
1771 			in_pcbremwildcardhash_oncpu(inp, &udbinfo[cpuid]);
1772 	}
1773 
1774 	if (cpuid == 0) {
1775 		/*
1776 		 * Free and clear multicast socket option,
1777 		 * which is only accessed in netisr0.
1778 		 */
1779 		ip_freemoptions(inp->inp_moptions);
1780 		inp->inp_moptions = NULL;
1781 	}
1782 
1783 	nextcpu = cpuid + 1;
1784 	if (nextcpu < netisr_ncpus) {
1785 		lwkt_forwardmsg(netisr_cpuport(nextcpu), &clomsg->lmsg);
1786 	} else {
1787 		/*
1788 		 * No one could see this inpcb now; destroy this
1789 		 * inpcb in its owner netisr.
1790 		 */
1791 		netmsg_init(clomsg, so, &netisr_apanic_rport, 0,
1792 		    udp_detach_final_dispatch);
1793 		lwkt_sendmsg(so->so_port, &clomsg->lmsg);
1794 	}
1795 }
1796 
1797 static void
1798 udp_detach_syncorig_dispatch(netmsg_t msg)
1799 {
1800 	struct netmsg_base *clomsg = &msg->base;
1801 	struct socket *so = clomsg->nm_so;
1802 
1803 	/*
1804 	 * Original protocol processing port is synchronized;
1805 	 * destroy this inpcb in its owner netisr.
1806 	 */
1807 	netmsg_init(clomsg, so, &netisr_apanic_rport, 0,
1808 	    udp_detach_final_dispatch);
1809 	lwkt_sendmsg(so->so_port, &clomsg->lmsg);
1810 }
1811 
1812 static void
1813 udp_detach(netmsg_t msg)
1814 {
1815 	struct socket *so = msg->detach.base.nm_so;
1816 	struct netmsg_base *clomsg;
1817 	struct inpcb *inp;
1818 
1819 	inp = so->so_pcb;
1820 	if (inp == NULL) {
1821 		lwkt_replymsg(&msg->detach.base.lmsg, EINVAL);
1822 		return;
1823 	}
1824 
1825 	/*
1826 	 * Reply EJUSTRETURN ASAP, we will call sodiscard() and
1827 	 * sofree() later.
1828 	 */
1829 	lwkt_replymsg(&msg->detach.base.lmsg, EJUSTRETURN);
1830 
1831 	if (netisr_ncpus == 1) {
1832 		/* Only one CPU, detach the inpcb directly. */
1833 		udp_detach2(so);
1834 		return;
1835 	}
1836 
1837 	/*
1838 	 * Remove this inpcb from the inpcb list first, so that
1839 	 * no one could find this inpcb from the inpcb list.
1840 	 */
1841 	in_pcbofflist(inp);
1842 
1843 	/*
1844 	 * Remove this inpcb from the local port hash directly
1845 	 * here, so that its bound local port could be recycled
1846 	 * timely.
1847 	 */
1848 	in_pcbremporthash(inp);
1849 
1850 	if (inp->inp_flags & INP_DIRECT_DETACH) {
1851 		/*
1852 		 * Direct detaching is allowed
1853 		 */
1854 		KASSERT((inp->inp_flags & INP_WILDCARD) == 0,
1855 		    ("in the wildcardhash"));
1856 		KASSERT(inp->inp_moptions == NULL, ("has mcast options"));
1857 		if (so->so_orig_port == NULL) {
1858 			udp_detach2(so);
1859 		} else {
1860 			/*
1861 			 * Protocol processing port changed once, so
1862 			 * we need to make sure that there are nothing
1863 			 * left on the original protocol processing
1864 			 * port before we destroy this socket and inpcb.
1865 			 * This is more lightweight than going through
1866 			 * all UDP processing netisrs.
1867 			 */
1868 			clomsg = &so->so_clomsg;
1869 			netmsg_init(clomsg, so, &netisr_apanic_rport,
1870 			    MSGF_IGNSOPORT, udp_detach_syncorig_dispatch);
1871 			lwkt_sendmsg(so->so_orig_port, &clomsg->lmsg);
1872 		}
1873 		return;
1874 	}
1875 
1876 	/*
1877 	 * Go through netisrs which process UDP to make sure
1878 	 * no one could find this inpcb anymore.
1879 	 */
1880 	clomsg = &so->so_clomsg;
1881 	netmsg_init(clomsg, so, &netisr_apanic_rport, MSGF_IGNSOPORT,
1882 	    udp_detach_oncpu_dispatch);
1883 	lwkt_sendmsg(netisr_cpuport(0), &clomsg->lmsg);
1884 }
1885 
1886 static void
1887 udp_disconnect(netmsg_t msg)
1888 {
1889 	struct socket *so = msg->disconnect.base.nm_so;
1890 	struct inpcb *inp;
1891 	boolean_t forwarded;
1892 	int error = 0;
1893 
1894 	inp = so->so_pcb;
1895 	if (inp == NULL) {
1896 		error = EINVAL;
1897 		goto out;
1898 	}
1899 	if (inp->inp_faddr.s_addr == INADDR_ANY) {
1900 		error = ENOTCONN;
1901 		goto out;
1902 	}
1903 
1904 	soclrstate(so, SS_ISCONNECTED);		/* XXX */
1905 
1906 	in_pcbdisconnect(inp);
1907 	inp->inp_flags &= ~INP_HASH;
1908 
1909 	/*
1910 	 * Follow traditional BSD behavior and retain the local port
1911 	 * binding.  But, fix the old misbehavior of overwriting any
1912 	 * previously bound local address.
1913 	 */
1914 	if (!(inp->inp_flags & INP_WASBOUND_NOTANY))
1915 		inp->inp_laddr.s_addr = INADDR_ANY;
1916 
1917 	if (so->so_state & SS_ISCLOSING) {
1918 		/*
1919 		 * If this socket is being closed, there is no need
1920 		 * to put this socket back into wildcard hash table.
1921 		 */
1922 		error = 0;
1923 		goto out;
1924 	}
1925 
1926 	forwarded = udp_inswildcardhash(inp, &msg->disconnect.base, 0);
1927 	if (forwarded) {
1928 		/*
1929 		 * The message is further forwarded, so we are done
1930 		 * here.
1931 		 */
1932 		return;
1933 	}
1934 out:
1935 	lwkt_replymsg(&msg->disconnect.base.lmsg, error);
1936 }
1937 
1938 void
1939 udp_shutdown(netmsg_t msg)
1940 {
1941 	struct socket *so = msg->shutdown.base.nm_so;
1942 	struct inpcb *inp;
1943 	int error;
1944 
1945 	inp = so->so_pcb;
1946 	if (inp) {
1947 		socantsendmore(so);
1948 		error = 0;
1949 	} else {
1950 		error = EINVAL;
1951 	}
1952 	lwkt_replymsg(&msg->shutdown.base.lmsg, error);
1953 }
1954 
1955 struct pr_usrreqs udp_usrreqs = {
1956 	.pru_abort = udp_abort,
1957 	.pru_accept = pr_generic_notsupp,
1958 	.pru_attach = udp_attach,
1959 	.pru_bind = udp_bind,
1960 	.pru_connect = udp_connect,
1961 	.pru_connect2 = pr_generic_notsupp,
1962 	.pru_control = in_control_dispatch,
1963 	.pru_detach = udp_detach,
1964 	.pru_disconnect = udp_disconnect,
1965 	.pru_listen = pr_generic_notsupp,
1966 	.pru_peeraddr = in_setpeeraddr_dispatch,
1967 	.pru_rcvd = pr_generic_notsupp,
1968 	.pru_rcvoob = pr_generic_notsupp,
1969 	.pru_send = udp_send,
1970 	.pru_sense = pru_sense_null,
1971 	.pru_shutdown = udp_shutdown,
1972 	.pru_sockaddr = in_setsockaddr_dispatch,
1973 	.pru_sosend = sosendudp,
1974 	.pru_soreceive = soreceive,
1975 	.pru_preconnect = udp_preconnect,
1976 	.pru_preattach = udp_preattach
1977 };
1978