1994-05-24 10:09:53 +00:00
|
|
|
/*
|
1995-09-22 19:56:26 +00:00
|
|
|
* Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
|
1994-05-24 10:09:53 +00:00
|
|
|
* The Regents of the University of California. All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
* 3. All advertising materials mentioning features or use of this software
|
|
|
|
* must display the following acknowledgement:
|
|
|
|
* This product includes software developed by the University of
|
|
|
|
* California, Berkeley and its contributors.
|
|
|
|
* 4. Neither the name of the University nor the names of its contributors
|
|
|
|
* may be used to endorse or promote products derived from this software
|
|
|
|
* without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*
|
1995-09-22 19:56:26 +00:00
|
|
|
* @(#)udp_usrreq.c 8.6 (Berkeley) 5/23/95
|
1999-08-28 01:08:13 +00:00
|
|
|
* $FreeBSD$
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
|
|
|
|
1999-12-22 19:13:38 +00:00
|
|
|
#include "opt_ipsec.h"
|
1999-12-07 17:39:16 +00:00
|
|
|
#include "opt_inet6.h"
|
2002-08-01 21:37:34 +00:00
|
|
|
#include "opt_mac.h"
|
1999-12-07 17:39:16 +00:00
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
#include <sys/param.h>
|
1994-05-25 09:21:21 +00:00
|
|
|
#include <sys/systm.h>
|
2002-04-30 01:54:54 +00:00
|
|
|
#include <sys/domain.h>
|
|
|
|
#include <sys/jail.h>
|
1997-02-24 20:31:25 +00:00
|
|
|
#include <sys/kernel.h>
|
2002-04-30 01:54:54 +00:00
|
|
|
#include <sys/lock.h>
|
2002-08-01 21:37:34 +00:00
|
|
|
#include <sys/mac.h>
|
1994-05-24 10:09:53 +00:00
|
|
|
#include <sys/malloc.h>
|
|
|
|
#include <sys/mbuf.h>
|
1999-07-11 18:32:46 +00:00
|
|
|
#include <sys/proc.h>
|
1994-05-24 10:09:53 +00:00
|
|
|
#include <sys/protosw.h>
|
2002-04-30 01:54:54 +00:00
|
|
|
#include <sys/signalvar.h>
|
1994-05-24 10:09:53 +00:00
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <sys/socketvar.h>
|
2002-04-30 01:54:54 +00:00
|
|
|
#include <sys/sx.h>
|
1995-03-16 18:17:34 +00:00
|
|
|
#include <sys/sysctl.h>
|
1996-04-04 10:46:44 +00:00
|
|
|
#include <sys/syslog.h>
|
1998-03-28 10:18:26 +00:00
|
|
|
|
2002-03-20 05:48:55 +00:00
|
|
|
#include <vm/uma.h>
|
1994-05-24 10:09:53 +00:00
|
|
|
|
|
|
|
#include <net/if.h>
|
|
|
|
#include <net/route.h>
|
|
|
|
|
|
|
|
#include <netinet/in.h>
|
|
|
|
#include <netinet/in_systm.h>
|
2002-04-30 01:54:54 +00:00
|
|
|
#include <netinet/in_pcb.h>
|
|
|
|
#include <netinet/in_var.h>
|
1994-05-24 10:09:53 +00:00
|
|
|
#include <netinet/ip.h>
|
1999-12-07 17:39:16 +00:00
|
|
|
#ifdef INET6
|
|
|
|
#include <netinet/ip6.h>
|
|
|
|
#endif
|
2002-04-30 01:54:54 +00:00
|
|
|
#include <netinet/ip_icmp.h>
|
|
|
|
#include <netinet/icmp_var.h>
|
1994-05-24 10:09:53 +00:00
|
|
|
#include <netinet/ip_var.h>
|
1999-12-07 17:39:16 +00:00
|
|
|
#ifdef INET6
|
|
|
|
#include <netinet6/ip6_var.h>
|
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
#include <netinet/udp.h>
|
|
|
|
#include <netinet/udp_var.h>
|
|
|
|
|
2002-10-16 02:25:05 +00:00
|
|
|
#ifdef FAST_IPSEC
|
|
|
|
#include <netipsec/ipsec.h>
|
|
|
|
#endif /*FAST_IPSEC*/
|
|
|
|
|
1999-12-07 17:39:16 +00:00
|
|
|
#ifdef IPSEC
|
|
|
|
#include <netinet6/ipsec.h>
|
|
|
|
#endif /*IPSEC*/
|
|
|
|
|
2000-03-27 19:14:27 +00:00
|
|
|
#include <machine/in_cksum.h>
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* UDP protocol implementation.
|
|
|
|
* Per RFC 768, August, 1980.
|
|
|
|
*/
|
|
|
|
#ifndef COMPAT_42
|
1995-11-14 20:34:56 +00:00
|
|
|
static int udpcksum = 1;
|
1994-05-24 10:09:53 +00:00
|
|
|
#else
|
1995-11-14 20:34:56 +00:00
|
|
|
static int udpcksum = 0; /* XXX */
|
1994-05-24 10:09:53 +00:00
|
|
|
#endif
|
1995-11-14 20:34:56 +00:00
|
|
|
SYSCTL_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum, CTLFLAG_RW,
|
2002-11-20 19:00:54 +00:00
|
|
|
&udpcksum, 0, "");
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2002-11-20 19:00:54 +00:00
|
|
|
int log_in_vain = 0;
|
1996-04-04 10:46:44 +00:00
|
|
|
SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_RW,
|
1999-05-03 23:57:32 +00:00
|
|
|
&log_in_vain, 0, "Log all incoming UDP packets");
|
1996-04-04 10:46:44 +00:00
|
|
|
|
2002-11-20 19:00:54 +00:00
|
|
|
static int blackhole = 0;
|
1999-08-17 12:17:53 +00:00
|
|
|
SYSCTL_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_RW,
|
2002-11-20 19:00:54 +00:00
|
|
|
&blackhole, 0, "Do not send port unreachables for refused connects");
|
1999-08-17 12:17:53 +00:00
|
|
|
|
2003-11-12 20:17:11 +00:00
|
|
|
static int strict_mcast_mship = 0;
|
|
|
|
SYSCTL_INT(_net_inet_udp, OID_AUTO, strict_mcast_mship, CTLFLAG_RW,
|
|
|
|
&strict_mcast_mship, 0, "Only send multicast to member sockets");
|
|
|
|
|
1999-11-05 14:41:39 +00:00
|
|
|
struct inpcbhead udb; /* from udp_var.h */
|
1999-12-07 17:39:16 +00:00
|
|
|
#define udb6 udb /* for KAME src sync over BSD*'s */
|
1999-11-05 14:41:39 +00:00
|
|
|
struct inpcbinfo udbinfo;
|
1995-04-09 01:29:31 +00:00
|
|
|
|
|
|
|
#ifndef UDBHASHSIZE
|
Improved connection establishment performance by doing local port lookups via
a hashed port list. In the new scheme, in_pcblookup() goes away and is
replaced by a new routine, in_pcblookup_local() for doing the local port
check. Note that this implementation is space inefficient in that the PCB
struct is now too large to fit into 128 bytes. I might deal with this in the
future by using the new zone allocator, but I wanted these changes to be
extensively tested in their current form first.
Also:
1) Fixed off-by-one errors in the port lookup loops in in_pcbbind().
2) Got rid of some unneeded rehashing. Adding a new routine, in_pcbinshash()
to do the initialial hash insertion.
3) Renamed in_pcblookuphash() to in_pcblookup_hash() for easier readability.
4) Added a new routine, in_pcbremlists() to remove the PCB from the various
hash lists.
5) Added/deleted comments where appropriate.
6) Removed unnecessary splnet() locking. In general, the PCB functions should
be called at splnet()...there are unfortunately a few exceptions, however.
7) Reorganized a few structs for better cache line behavior.
8) Killed my TCP_ACK_HACK kludge. It may come back in a different form in
the future, however.
These changes have been tested on wcarchive for more than a month. In tests
done here, connection establishment overhead is reduced by more than 50
times, thus getting rid of one of the major networking scalability problems.
Still to do: make tcp_fastimo/tcp_slowtimo scale well for systems with a
large number of connections. tcp_fastimo is easy; tcp_slowtimo is difficult.
WARNING: Anything that knows about inpcb and tcpcb structs will have to be
recompiled; at the very least, this includes netstat(1).
1998-01-27 09:15:13 +00:00
|
|
|
#define UDBHASHSIZE 16
|
1995-04-09 01:29:31 +00:00
|
|
|
#endif
|
|
|
|
|
1999-11-05 14:41:39 +00:00
|
|
|
struct udpstat udpstat; /* from udp_var.h */
|
2001-06-23 17:17:59 +00:00
|
|
|
SYSCTL_STRUCT(_net_inet_udp, UDPCTL_STATS, stats, CTLFLAG_RW,
|
1999-05-03 23:57:32 +00:00
|
|
|
&udpstat, udpstat, "UDP statistics (struct udpstat, netinet/udp_var.h)");
|
1995-02-16 00:27:47 +00:00
|
|
|
|
1995-11-14 20:34:56 +00:00
|
|
|
static struct sockaddr_in udp_in = { sizeof(udp_in), AF_INET };
|
1999-12-07 17:39:16 +00:00
|
|
|
#ifdef INET6
|
|
|
|
struct udp_in6 {
|
|
|
|
struct sockaddr_in6 uin6_sin;
|
|
|
|
u_char uin6_init_done : 1;
|
|
|
|
} udp_in6 = {
|
|
|
|
{ sizeof(udp_in6.uin6_sin), AF_INET6 },
|
|
|
|
0
|
|
|
|
};
|
|
|
|
struct udp_ip6 {
|
|
|
|
struct ip6_hdr uip6_ip6;
|
|
|
|
u_char uip6_init_done : 1;
|
|
|
|
} udp_ip6;
|
|
|
|
#endif /* INET6 */
|
|
|
|
|
2002-03-24 10:19:10 +00:00
|
|
|
static void udp_append(struct inpcb *last, struct ip *ip, struct mbuf *n,
|
|
|
|
int off);
|
1999-12-07 17:39:16 +00:00
|
|
|
#ifdef INET6
|
2002-03-19 21:25:46 +00:00
|
|
|
static void ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip);
|
1999-12-07 17:39:16 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2002-03-19 21:25:46 +00:00
|
|
|
static int udp_detach(struct socket *so);
|
|
|
|
static int udp_output(struct inpcb *, struct mbuf *, struct sockaddr *,
|
2002-03-24 10:19:10 +00:00
|
|
|
struct mbuf *, struct thread *);
|
1994-05-24 10:09:53 +00:00
|
|
|
|
|
|
|
void
|
2002-11-20 19:00:54 +00:00
|
|
|
udp_init()
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_LOCK_INIT(&udbinfo, "udp");
|
1995-04-09 01:29:31 +00:00
|
|
|
LIST_INIT(&udb);
|
|
|
|
udbinfo.listhead = &udb;
|
1997-03-03 09:23:37 +00:00
|
|
|
udbinfo.hashbase = hashinit(UDBHASHSIZE, M_PCB, &udbinfo.hashmask);
|
1998-03-28 10:18:26 +00:00
|
|
|
udbinfo.porthashbase = hashinit(UDBHASHSIZE, M_PCB,
|
|
|
|
&udbinfo.porthashmask);
|
2002-03-20 05:48:55 +00:00
|
|
|
udbinfo.ipi_zone = uma_zcreate("udpcb", sizeof(struct inpcb), NULL,
|
|
|
|
NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
|
|
|
|
uma_zone_set_max(udbinfo.ipi_zone, maxsockets);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2002-11-20 19:00:54 +00:00
|
|
|
udp_input(m, off)
|
|
|
|
register struct mbuf *m;
|
|
|
|
int off;
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
1999-12-07 17:39:16 +00:00
|
|
|
int iphlen = off;
|
2002-11-20 19:00:54 +00:00
|
|
|
register struct ip *ip;
|
|
|
|
register struct udphdr *uh;
|
|
|
|
register struct inpcb *inp;
|
1994-05-24 10:09:53 +00:00
|
|
|
struct mbuf *opts = 0;
|
|
|
|
int len;
|
|
|
|
struct ip save_ip;
|
|
|
|
|
|
|
|
udpstat.udps_ipackets++;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Strip IP options, if any; should skip this,
|
|
|
|
* make available to user, and use on returned packets,
|
|
|
|
* but we don't yet have a way to check the checksum
|
|
|
|
* with options still present.
|
|
|
|
*/
|
|
|
|
if (iphlen > sizeof (struct ip)) {
|
|
|
|
ip_stripoptions(m, (struct mbuf *)0);
|
|
|
|
iphlen = sizeof(struct ip);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Get IP and UDP header together in first mbuf.
|
|
|
|
*/
|
|
|
|
ip = mtod(m, struct ip *);
|
|
|
|
if (m->m_len < iphlen + sizeof(struct udphdr)) {
|
|
|
|
if ((m = m_pullup(m, iphlen + sizeof(struct udphdr))) == 0) {
|
|
|
|
udpstat.udps_hdrops++;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
ip = mtod(m, struct ip *);
|
|
|
|
}
|
|
|
|
uh = (struct udphdr *)((caddr_t)ip + iphlen);
|
|
|
|
|
2000-07-04 16:35:15 +00:00
|
|
|
/* destination port of 0 is illegal, based on RFC768. */
|
|
|
|
if (uh->uh_dport == 0)
|
2002-06-10 20:05:46 +00:00
|
|
|
goto badunlocked;
|
2000-07-04 16:35:15 +00:00
|
|
|
|
2002-10-16 02:25:05 +00:00
|
|
|
/*
|
|
|
|
* Construct sockaddr format source address.
|
|
|
|
* Stuff source address and datagram in user buffer.
|
|
|
|
*/
|
|
|
|
udp_in.sin_port = uh->uh_sport;
|
|
|
|
udp_in.sin_addr = ip->ip_src;
|
|
|
|
#ifdef INET6
|
|
|
|
udp_in6.uin6_init_done = udp_ip6.uip6_init_done = 0;
|
|
|
|
#endif
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* Make mbuf data length reflect UDP length.
|
|
|
|
* If not enough data to reflect UDP length, drop.
|
|
|
|
*/
|
|
|
|
len = ntohs((u_short)uh->uh_ulen);
|
|
|
|
if (ip->ip_len != len) {
|
1995-08-17 22:09:14 +00:00
|
|
|
if (len > ip->ip_len || len < sizeof(struct udphdr)) {
|
1994-05-24 10:09:53 +00:00
|
|
|
udpstat.udps_badlen++;
|
2002-06-10 20:05:46 +00:00
|
|
|
goto badunlocked;
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
m_adj(m, len - ip->ip_len);
|
|
|
|
/* ip->ip_len = len; */
|
|
|
|
}
|
|
|
|
/*
|
|
|
|
* Save a copy of the IP header in case we want restore it
|
|
|
|
* for sending an ICMP error message in response.
|
|
|
|
*/
|
2000-10-31 09:13:02 +00:00
|
|
|
if (!blackhole)
|
|
|
|
save_ip = *ip;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Checksum extended UDP header and data.
|
|
|
|
*/
|
1995-09-22 19:56:26 +00:00
|
|
|
if (uh->uh_sum) {
|
2000-03-27 19:14:27 +00:00
|
|
|
if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
|
|
|
|
if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
|
|
|
|
uh->uh_sum = m->m_pkthdr.csum_data;
|
|
|
|
else
|
|
|
|
uh->uh_sum = in_pseudo(ip->ip_src.s_addr,
|
2000-11-01 16:56:33 +00:00
|
|
|
ip->ip_dst.s_addr, htonl((u_short)len +
|
2000-03-27 19:14:27 +00:00
|
|
|
m->m_pkthdr.csum_data + IPPROTO_UDP));
|
|
|
|
uh->uh_sum ^= 0xffff;
|
|
|
|
} else {
|
2001-10-22 12:43:30 +00:00
|
|
|
char b[9];
|
|
|
|
bcopy(((struct ipovly *)ip)->ih_x1, b, 9);
|
2000-03-27 19:14:27 +00:00
|
|
|
bzero(((struct ipovly *)ip)->ih_x1, 9);
|
|
|
|
((struct ipovly *)ip)->ih_len = uh->uh_ulen;
|
|
|
|
uh->uh_sum = in_cksum(m, len + sizeof (struct ip));
|
2001-10-22 12:43:30 +00:00
|
|
|
bcopy(b, ((struct ipovly *)ip)->ih_x1, 9);
|
2000-03-27 19:14:27 +00:00
|
|
|
}
|
1994-10-02 17:48:58 +00:00
|
|
|
if (uh->uh_sum) {
|
1994-05-24 10:09:53 +00:00
|
|
|
udpstat.udps_badsum++;
|
|
|
|
m_freem(m);
|
|
|
|
return;
|
|
|
|
}
|
2001-03-13 13:26:06 +00:00
|
|
|
} else
|
|
|
|
udpstat.udps_nosum++;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_RLOCK(&udbinfo);
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
|
|
|
|
in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) {
|
1996-11-11 04:56:32 +00:00
|
|
|
struct inpcb *last;
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* Deliver a multicast or broadcast datagram to *all* sockets
|
|
|
|
* for which the local and remote addresses and ports match
|
|
|
|
* those of the incoming datagram. This allows more than
|
|
|
|
* one process to receive multi/broadcasts on the same port.
|
|
|
|
* (This really ought to be done for unicast datagrams as
|
|
|
|
* well, but that would cause problems with existing
|
|
|
|
* applications that open both address-specific sockets and
|
|
|
|
* a wildcard socket listening to the same port -- they would
|
|
|
|
* end up receiving duplicates of every unicast datagram.
|
|
|
|
* Those applications open the multiple sockets to overcome an
|
|
|
|
* inadequacy of the UDP socket interface, but for backwards
|
|
|
|
* compatibility we avoid the problem here rather than
|
|
|
|
* fixing the interface. Maybe 4.5BSD will remedy this?)
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Locate pcb(s) for datagram.
|
|
|
|
* (Algorithm copied from raw_intr().)
|
|
|
|
*/
|
|
|
|
last = NULL;
|
1999-12-07 17:39:16 +00:00
|
|
|
LIST_FOREACH(inp, &udb, inp_list) {
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_LOCK(inp);
|
|
|
|
if (inp->inp_lport != uh->uh_dport) {
|
|
|
|
docontinue:
|
|
|
|
INP_UNLOCK(inp);
|
|
|
|
continue;
|
|
|
|
}
|
1999-12-07 17:39:16 +00:00
|
|
|
#ifdef INET6
|
1999-12-21 11:14:12 +00:00
|
|
|
if ((inp->inp_vflag & INP_IPV4) == 0)
|
2002-06-10 20:05:46 +00:00
|
|
|
goto docontinue;
|
1999-12-07 17:39:16 +00:00
|
|
|
#endif
|
1994-05-24 10:09:53 +00:00
|
|
|
if (inp->inp_laddr.s_addr != INADDR_ANY) {
|
2002-06-10 20:05:46 +00:00
|
|
|
if (inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
|
|
|
|
goto docontinue;
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
if (inp->inp_faddr.s_addr != INADDR_ANY) {
|
|
|
|
if (inp->inp_faddr.s_addr !=
|
|
|
|
ip->ip_src.s_addr ||
|
|
|
|
inp->inp_fport != uh->uh_sport)
|
2002-06-10 20:05:46 +00:00
|
|
|
goto docontinue;
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
2003-11-12 20:17:11 +00:00
|
|
|
/*
|
|
|
|
* Check multicast packets to make sure they are only
|
|
|
|
* sent to sockets with multicast memberships for the
|
|
|
|
* packet's destination address and arrival interface
|
|
|
|
*/
|
|
|
|
#define MSHIP(_inp, n) ((_inp)->inp_moptions->imo_membership[(n)])
|
|
|
|
#define NMSHIPS(_inp) ((_inp)->inp_moptions->imo_num_memberships)
|
|
|
|
if (strict_mcast_mship && inp->inp_moptions != NULL) {
|
|
|
|
int mship, foundmship = 0;
|
|
|
|
|
|
|
|
for (mship = 0; mship < NMSHIPS(inp); mship++) {
|
|
|
|
if (MSHIP(inp, mship)->inm_addr.s_addr
|
|
|
|
== ip->ip_dst.s_addr &&
|
|
|
|
MSHIP(inp, mship)->inm_ifp
|
|
|
|
== m->m_pkthdr.rcvif) {
|
|
|
|
foundmship = 1;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (foundmship == 0)
|
|
|
|
goto docontinue;
|
|
|
|
}
|
|
|
|
#undef NMSHIPS
|
|
|
|
#undef MSHIP
|
1994-05-24 10:09:53 +00:00
|
|
|
if (last != NULL) {
|
|
|
|
struct mbuf *n;
|
|
|
|
|
2002-11-20 19:00:54 +00:00
|
|
|
n = m_copy(m, 0, M_COPYALL);
|
2002-10-16 02:25:05 +00:00
|
|
|
if (n != NULL)
|
|
|
|
udp_append(last, ip, n,
|
1999-12-07 17:39:16 +00:00
|
|
|
iphlen +
|
|
|
|
sizeof(struct udphdr));
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_UNLOCK(last);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
1996-11-11 04:56:32 +00:00
|
|
|
last = inp;
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
|
|
|
* Don't look for additional matches if this one does
|
|
|
|
* not have either the SO_REUSEPORT or SO_REUSEADDR
|
|
|
|
* socket options set. This heuristic avoids searching
|
|
|
|
* through all pcbs in the common case of a non-shared
|
|
|
|
* port. It * assumes that an application will never
|
|
|
|
* clear these options after setting them.
|
|
|
|
*/
|
2002-05-31 11:52:35 +00:00
|
|
|
if ((last->inp_socket->so_options&(SO_REUSEPORT|SO_REUSEADDR)) == 0)
|
1994-05-24 10:09:53 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (last == NULL) {
|
|
|
|
/*
|
|
|
|
* No matching pcb found; discard datagram.
|
|
|
|
* (No need to send an ICMP Port Unreachable
|
|
|
|
* for a broadcast or multicast datgram.)
|
|
|
|
*/
|
|
|
|
udpstat.udps_noportbcast++;
|
2002-06-12 15:21:41 +00:00
|
|
|
goto badheadlocked;
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_RUNLOCK(&udbinfo);
|
1999-12-07 17:39:16 +00:00
|
|
|
udp_append(last, ip, m, iphlen + sizeof(struct udphdr));
|
2002-10-16 02:33:28 +00:00
|
|
|
INP_UNLOCK(last);
|
1994-05-24 10:09:53 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
/*
|
1996-10-07 19:06:12 +00:00
|
|
|
* Locate pcb for datagram.
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
Improved connection establishment performance by doing local port lookups via
a hashed port list. In the new scheme, in_pcblookup() goes away and is
replaced by a new routine, in_pcblookup_local() for doing the local port
check. Note that this implementation is space inefficient in that the PCB
struct is now too large to fit into 128 bytes. I might deal with this in the
future by using the new zone allocator, but I wanted these changes to be
extensively tested in their current form first.
Also:
1) Fixed off-by-one errors in the port lookup loops in in_pcbbind().
2) Got rid of some unneeded rehashing. Adding a new routine, in_pcbinshash()
to do the initialial hash insertion.
3) Renamed in_pcblookuphash() to in_pcblookup_hash() for easier readability.
4) Added a new routine, in_pcbremlists() to remove the PCB from the various
hash lists.
5) Added/deleted comments where appropriate.
6) Removed unnecessary splnet() locking. In general, the PCB functions should
be called at splnet()...there are unfortunately a few exceptions, however.
7) Reorganized a few structs for better cache line behavior.
8) Killed my TCP_ACK_HACK kludge. It may come back in a different form in
the future, however.
These changes have been tested on wcarchive for more than a month. In tests
done here, connection establishment overhead is reduced by more than 50
times, thus getting rid of one of the major networking scalability problems.
Still to do: make tcp_fastimo/tcp_slowtimo scale well for systems with a
large number of connections. tcp_fastimo is easy; tcp_slowtimo is difficult.
WARNING: Anything that knows about inpcb and tcpcb structs will have to be
recompiled; at the very least, this includes netstat(1).
1998-01-27 09:15:13 +00:00
|
|
|
inp = in_pcblookup_hash(&udbinfo, ip->ip_src, uh->uh_sport,
|
1999-12-07 17:39:16 +00:00
|
|
|
ip->ip_dst, uh->uh_dport, 1, m->m_pkthdr.rcvif);
|
1995-04-09 01:29:31 +00:00
|
|
|
if (inp == NULL) {
|
1996-04-27 18:19:12 +00:00
|
|
|
if (log_in_vain) {
|
1996-05-02 05:54:14 +00:00
|
|
|
char buf[4*sizeof "123"];
|
1996-04-27 18:19:12 +00:00
|
|
|
|
|
|
|
strcpy(buf, inet_ntoa(ip->ip_dst));
|
1997-12-19 23:46:21 +00:00
|
|
|
log(LOG_INFO,
|
|
|
|
"Connection attempt to UDP %s:%d from %s:%d\n",
|
|
|
|
buf, ntohs(uh->uh_dport), inet_ntoa(ip->ip_src),
|
|
|
|
ntohs(uh->uh_sport));
|
1996-04-27 18:19:12 +00:00
|
|
|
}
|
1994-05-24 10:09:53 +00:00
|
|
|
udpstat.udps_noport++;
|
|
|
|
if (m->m_flags & (M_BCAST | M_MCAST)) {
|
|
|
|
udpstat.udps_noportbcast++;
|
2002-06-12 15:21:41 +00:00
|
|
|
goto badheadlocked;
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
2000-05-24 12:57:52 +00:00
|
|
|
if (blackhole)
|
2002-06-12 15:21:41 +00:00
|
|
|
goto badheadlocked;
|
2002-08-04 20:50:13 +00:00
|
|
|
if (badport_bandlim(BANDLIM_ICMP_UNREACH) < 0)
|
|
|
|
goto badheadlocked;
|
Fixed broken ICMP error generation, unified conversion of IP header
fields between host and network byte order. The details:
o icmp_error() now does not add IP header length. This fixes the problem
when icmp_error() is called from ip_forward(). In this case the ip_len
of the original IP datagram returned with ICMP error was wrong.
o icmp_error() expects all three fields, ip_len, ip_id and ip_off in host
byte order, so DTRT and convert these fields back to network byte order
before sending a message. This fixes the problem described in PR 16240
and PR 20877 (ip_id field was returned in host byte order).
o ip_ttl decrement operation in ip_forward() was moved down to make sure
that it does not corrupt the copy of original IP datagram passed later
to icmp_error().
o A copy of original IP datagram in ip_forward() was made a read-write,
independent copy. This fixes the problem I first reported to Garrett
Wollman and Bill Fenner and later put in audit trail of PR 16240:
ip_output() (not always) converts fields of original datagram to network
byte order, but because copy (mcopy) and its original (m) most likely
share the same mbuf cluster, ip_output()'s manipulations on original
also corrupted the copy.
o ip_output() now expects all three fields, ip_len, ip_off and (what is
significant) ip_id in host byte order. It was a headache for years that
ip_id was handled differently. The only compatibility issue here is the
raw IP socket interface with IP_HDRINCL socket option set and a non-zero
ip_id field, but ip.4 manual page was unclear on whether in this case
ip_id field should be in host or network byte order.
2000-09-01 12:33:03 +00:00
|
|
|
*ip = save_ip;
|
|
|
|
ip->ip_len += iphlen;
|
2000-05-24 12:57:52 +00:00
|
|
|
icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_RUNLOCK(&udbinfo);
|
1994-05-24 10:09:53 +00:00
|
|
|
return;
|
|
|
|
}
|
2002-06-12 15:21:41 +00:00
|
|
|
INP_LOCK(inp);
|
|
|
|
INP_INFO_RUNLOCK(&udbinfo);
|
2002-10-16 02:25:05 +00:00
|
|
|
udp_append(inp, ip, m, iphlen + sizeof(struct udphdr));
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_UNLOCK(inp);
|
1994-05-24 10:09:53 +00:00
|
|
|
return;
|
2002-06-12 15:21:41 +00:00
|
|
|
|
|
|
|
badheadlocked:
|
|
|
|
INP_INFO_RUNLOCK(&udbinfo);
|
2002-06-10 20:05:46 +00:00
|
|
|
if (inp)
|
|
|
|
INP_UNLOCK(inp);
|
|
|
|
badunlocked:
|
1994-05-24 10:09:53 +00:00
|
|
|
m_freem(m);
|
|
|
|
if (opts)
|
|
|
|
m_freem(opts);
|
1999-12-07 17:39:16 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2000-07-04 16:35:15 +00:00
|
|
|
#ifdef INET6
|
1999-12-07 17:39:16 +00:00
|
|
|
static void
|
2002-11-20 19:00:54 +00:00
|
|
|
ip_2_ip6_hdr(ip6, ip)
|
|
|
|
struct ip6_hdr *ip6;
|
|
|
|
struct ip *ip;
|
1999-12-07 17:39:16 +00:00
|
|
|
{
|
|
|
|
bzero(ip6, sizeof(*ip6));
|
|
|
|
|
|
|
|
ip6->ip6_vfc = IPV6_VERSION;
|
|
|
|
ip6->ip6_plen = ip->ip_len;
|
|
|
|
ip6->ip6_nxt = ip->ip_p;
|
|
|
|
ip6->ip6_hlim = ip->ip_ttl;
|
|
|
|
ip6->ip6_src.s6_addr32[2] = ip6->ip6_dst.s6_addr32[2] =
|
|
|
|
IPV6_ADDR_INT32_SMP;
|
|
|
|
ip6->ip6_src.s6_addr32[3] = ip->ip_src.s_addr;
|
|
|
|
ip6->ip6_dst.s6_addr32[3] = ip->ip_dst.s_addr;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
|
|
|
* subroutine of udp_input(), mainly for source code readability.
|
|
|
|
* caller must properly init udp_ip6 and udp_in6 beforehand.
|
|
|
|
*/
|
|
|
|
static void
|
2002-11-20 19:00:54 +00:00
|
|
|
udp_append(last, ip, n, off)
|
|
|
|
struct inpcb *last;
|
|
|
|
struct ip *ip;
|
|
|
|
struct mbuf *n;
|
|
|
|
int off;
|
1999-12-07 17:39:16 +00:00
|
|
|
{
|
|
|
|
struct sockaddr *append_sa;
|
|
|
|
struct mbuf *opts = 0;
|
|
|
|
|
2004-02-17 14:02:37 +00:00
|
|
|
#if defined(IPSEC) || defined(FAST_IPSEC)
|
2002-10-16 02:25:05 +00:00
|
|
|
/* check AH/ESP integrity. */
|
2004-02-03 18:20:55 +00:00
|
|
|
if (ipsec4_in_reject(n, last)) {
|
2004-02-17 14:02:37 +00:00
|
|
|
#ifdef IPSEC
|
2002-10-16 02:25:05 +00:00
|
|
|
ipsecstat.in_polvio++;
|
|
|
|
#endif /*IPSEC*/
|
|
|
|
m_freem(n);
|
|
|
|
return;
|
|
|
|
}
|
2004-02-17 14:02:37 +00:00
|
|
|
#endif /*IPSEC || FAST_IPSEC*/
|
2002-10-16 02:25:05 +00:00
|
|
|
#ifdef MAC
|
Introduce a MAC label reference in 'struct inpcb', which caches
the MAC label referenced from 'struct socket' in the IPv4 and
IPv6-based protocols. This permits MAC labels to be checked during
network delivery operations without dereferencing inp->inp_socket
to get to so->so_label, which will eventually avoid our having to
grab the socket lock during delivery at the network layer.
This change introduces 'struct inpcb' as a labeled object to the
MAC Framework, along with the normal circus of entry points:
initialization, creation from socket, destruction, as well as a
delivery access control check.
For most policies, the inpcb label will simply be a cache of the
socket label, so a new protocol switch method is introduced,
pr_sosetlabel() to notify protocols that the socket layer label
has been updated so that the cache can be updated while holding
appropriate locks. Most protocols implement this using
pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use
the the worker function in_pcbsosetlabel(), which calls into the
MAC Framework to perform a cache update.
Biba, LOMAC, and MLS implement these entry points, as do the stub
policy, and test policy.
Reviewed by: sam, bms
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
2003-11-18 00:39:07 +00:00
|
|
|
if (mac_check_inpcb_deliver(last, n) != 0) {
|
2002-10-16 02:25:05 +00:00
|
|
|
m_freem(n);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
#endif
|
1999-12-07 17:39:16 +00:00
|
|
|
if (last->inp_flags & INP_CONTROLOPTS ||
|
2004-01-31 10:40:25 +00:00
|
|
|
last->inp_socket->so_options & (SO_TIMESTAMP | SO_BINTIME)) {
|
1999-12-07 17:39:16 +00:00
|
|
|
#ifdef INET6
|
|
|
|
if (last->inp_vflag & INP_IPV6) {
|
|
|
|
int savedflags;
|
|
|
|
|
|
|
|
if (udp_ip6.uip6_init_done == 0) {
|
|
|
|
ip_2_ip6_hdr(&udp_ip6.uip6_ip6, ip);
|
|
|
|
udp_ip6.uip6_init_done = 1;
|
|
|
|
}
|
|
|
|
savedflags = last->inp_flags;
|
|
|
|
last->inp_flags &= ~INP_UNMAPPABLEOPTS;
|
2003-10-29 12:52:28 +00:00
|
|
|
ip6_savecontrol(last, n, &opts);
|
1999-12-07 17:39:16 +00:00
|
|
|
last->inp_flags = savedflags;
|
|
|
|
} else
|
|
|
|
#endif
|
|
|
|
ip_savecontrol(last, &opts, ip, n);
|
2002-05-31 11:52:35 +00:00
|
|
|
}
|
1999-12-07 17:39:16 +00:00
|
|
|
#ifdef INET6
|
|
|
|
if (last->inp_vflag & INP_IPV6) {
|
|
|
|
if (udp_in6.uin6_init_done == 0) {
|
|
|
|
in6_sin_2_v4mapsin6(&udp_in, &udp_in6.uin6_sin);
|
|
|
|
udp_in6.uin6_init_done = 1;
|
|
|
|
}
|
|
|
|
append_sa = (struct sockaddr *)&udp_in6.uin6_sin;
|
|
|
|
} else
|
|
|
|
#endif
|
|
|
|
append_sa = (struct sockaddr *)&udp_in;
|
|
|
|
m_adj(n, off);
|
|
|
|
if (sbappendaddr(&last->inp_socket->so_rcv, append_sa, n, opts) == 0) {
|
|
|
|
m_freem(n);
|
|
|
|
if (opts)
|
|
|
|
m_freem(opts);
|
|
|
|
udpstat.udps_fullsock++;
|
2002-05-31 11:52:35 +00:00
|
|
|
} else
|
1999-12-07 17:39:16 +00:00
|
|
|
sorwakeup(last->inp_socket);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Notify a udp user of an asynchronous error;
|
|
|
|
* just wake up so that he can collect error status.
|
|
|
|
*/
|
2002-06-14 08:35:21 +00:00
|
|
|
struct inpcb *
|
2002-11-20 19:00:54 +00:00
|
|
|
udp_notify(inp, errno)
|
|
|
|
register struct inpcb *inp;
|
|
|
|
int errno;
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
|
|
|
inp->inp_socket->so_error = errno;
|
|
|
|
sorwakeup(inp->inp_socket);
|
|
|
|
sowwakeup(inp->inp_socket);
|
2002-06-14 08:35:21 +00:00
|
|
|
return inp;
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2002-11-20 19:00:54 +00:00
|
|
|
udp_ctlinput(cmd, sa, vip)
|
|
|
|
int cmd;
|
|
|
|
struct sockaddr *sa;
|
|
|
|
void *vip;
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2001-02-26 21:19:47 +00:00
|
|
|
struct ip *ip = vip;
|
|
|
|
struct udphdr *uh;
|
2002-06-14 08:35:21 +00:00
|
|
|
struct inpcb *(*notify)(struct inpcb *, int) = udp_notify;
|
2001-02-26 21:19:47 +00:00
|
|
|
struct in_addr faddr;
|
|
|
|
struct inpcb *inp;
|
|
|
|
int s;
|
|
|
|
|
|
|
|
faddr = ((struct sockaddr_in *)sa)->sin_addr;
|
|
|
|
if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
|
|
|
|
return;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2003-11-20 20:07:39 +00:00
|
|
|
/*
|
|
|
|
* Redirects don't need to be handled up here.
|
|
|
|
*/
|
|
|
|
if (PRC_IS_REDIRECT(cmd))
|
|
|
|
return;
|
|
|
|
/*
|
|
|
|
* Hostdead is ugly because it goes linearly through all PCBs.
|
|
|
|
* XXX: We never get this from ICMP, otherwise it makes an
|
|
|
|
* excellent DoS attack on machines with many connections.
|
|
|
|
*/
|
|
|
|
if (cmd == PRC_HOSTDEAD)
|
2001-02-22 21:23:45 +00:00
|
|
|
ip = 0;
|
|
|
|
else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0)
|
1994-05-24 10:09:53 +00:00
|
|
|
return;
|
|
|
|
if (ip) {
|
2001-02-26 21:19:47 +00:00
|
|
|
s = splnet();
|
1994-05-24 10:09:53 +00:00
|
|
|
uh = (struct udphdr *)((caddr_t)ip + (ip->ip_hl << 2));
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_RLOCK(&udbinfo);
|
2001-02-26 21:19:47 +00:00
|
|
|
inp = in_pcblookup_hash(&udbinfo, faddr, uh->uh_dport,
|
|
|
|
ip->ip_src, uh->uh_sport, 0, NULL);
|
2002-06-10 20:05:46 +00:00
|
|
|
if (inp != NULL) {
|
|
|
|
INP_LOCK(inp);
|
2003-02-15 02:37:57 +00:00
|
|
|
if (inp->inp_socket != NULL) {
|
2002-06-10 20:05:46 +00:00
|
|
|
(*notify)(inp, inetctlerrmap[cmd]);
|
|
|
|
}
|
|
|
|
INP_UNLOCK(inp);
|
|
|
|
}
|
|
|
|
INP_INFO_RUNLOCK(&udbinfo);
|
2001-02-26 21:19:47 +00:00
|
|
|
splx(s);
|
1994-05-24 10:09:53 +00:00
|
|
|
} else
|
2002-06-10 20:05:46 +00:00
|
|
|
in_pcbnotifyall(&udbinfo, faddr, inetctlerrmap[cmd], notify);
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
1998-05-15 20:11:40 +00:00
|
|
|
static int
|
2000-07-04 11:25:35 +00:00
|
|
|
udp_pcblist(SYSCTL_HANDLER_ARGS)
|
1998-05-15 20:11:40 +00:00
|
|
|
{
|
|
|
|
int error, i, n, s;
|
|
|
|
struct inpcb *inp, **inp_list;
|
|
|
|
inp_gen_t gencnt;
|
|
|
|
struct xinpgen xig;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The process of preparing the TCB list is too time-consuming and
|
|
|
|
* resource-intensive to repeat twice on every request.
|
|
|
|
*/
|
|
|
|
if (req->oldptr == 0) {
|
|
|
|
n = udbinfo.ipi_count;
|
|
|
|
req->oldidx = 2 * (sizeof xig)
|
|
|
|
+ (n + n/8) * sizeof(struct xinpcb);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (req->newptr != 0)
|
|
|
|
return EPERM;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* OK, now we're committed to doing something.
|
|
|
|
*/
|
|
|
|
s = splnet();
|
2003-02-15 02:37:57 +00:00
|
|
|
INP_INFO_RLOCK(&udbinfo);
|
1998-05-15 20:11:40 +00:00
|
|
|
gencnt = udbinfo.ipi_gencnt;
|
|
|
|
n = udbinfo.ipi_count;
|
2003-02-15 02:37:57 +00:00
|
|
|
INP_INFO_RUNLOCK(&udbinfo);
|
1998-05-15 20:11:40 +00:00
|
|
|
splx(s);
|
|
|
|
|
2004-02-26 00:27:04 +00:00
|
|
|
error = sysctl_wire_old_buffer(req, 2 * (sizeof xig)
|
2002-07-28 19:59:31 +00:00
|
|
|
+ n * sizeof(struct xinpcb));
|
2004-02-26 00:27:04 +00:00
|
|
|
if (error != 0)
|
|
|
|
return (error);
|
2002-07-28 19:59:31 +00:00
|
|
|
|
1998-05-15 20:11:40 +00:00
|
|
|
xig.xig_len = sizeof xig;
|
|
|
|
xig.xig_count = n;
|
|
|
|
xig.xig_gen = gencnt;
|
|
|
|
xig.xig_sogen = so_gencnt;
|
|
|
|
error = SYSCTL_OUT(req, &xig, sizeof xig);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
|
2003-02-19 05:47:46 +00:00
|
|
|
inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
|
1998-05-15 20:11:40 +00:00
|
|
|
if (inp_list == 0)
|
|
|
|
return ENOMEM;
|
|
|
|
|
|
|
|
s = splnet();
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_RLOCK(&udbinfo);
|
2001-02-04 13:13:25 +00:00
|
|
|
for (inp = LIST_FIRST(udbinfo.listhead), i = 0; inp && i < n;
|
|
|
|
inp = LIST_NEXT(inp, inp_list)) {
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_LOCK(inp);
|
2002-06-21 22:54:16 +00:00
|
|
|
if (inp->inp_gencnt <= gencnt &&
|
|
|
|
cr_canseesocket(req->td->td_ucred, inp->inp_socket) == 0)
|
1998-05-15 20:11:40 +00:00
|
|
|
inp_list[i++] = inp;
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_UNLOCK(inp);
|
1998-05-15 20:11:40 +00:00
|
|
|
}
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_RUNLOCK(&udbinfo);
|
1998-05-15 20:11:40 +00:00
|
|
|
splx(s);
|
|
|
|
n = i;
|
|
|
|
|
|
|
|
error = 0;
|
|
|
|
for (i = 0; i < n; i++) {
|
|
|
|
inp = inp_list[i];
|
|
|
|
if (inp->inp_gencnt <= gencnt) {
|
|
|
|
struct xinpcb xi;
|
|
|
|
xi.xi_len = sizeof xi;
|
|
|
|
/* XXX should avoid extra copy */
|
|
|
|
bcopy(inp, &xi.xi_inp, sizeof *inp);
|
|
|
|
if (inp->inp_socket)
|
|
|
|
sotoxsocket(inp->inp_socket, &xi.xi_socket);
|
2003-02-15 02:37:57 +00:00
|
|
|
xi.xi_inp.inp_gencnt = inp->inp_gencnt;
|
1998-05-15 20:11:40 +00:00
|
|
|
error = SYSCTL_OUT(req, &xi, sizeof xi);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!error) {
|
|
|
|
/*
|
|
|
|
* Give the user an updated idea of our state.
|
|
|
|
* If the generation differs from what we told
|
|
|
|
* her before, she knows that something happened
|
|
|
|
* while we were processing this request, and it
|
|
|
|
* might be necessary to retry.
|
|
|
|
*/
|
|
|
|
s = splnet();
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_RLOCK(&udbinfo);
|
1998-05-15 20:11:40 +00:00
|
|
|
xig.xig_gen = udbinfo.ipi_gencnt;
|
|
|
|
xig.xig_sogen = so_gencnt;
|
|
|
|
xig.xig_count = udbinfo.ipi_count;
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_RUNLOCK(&udbinfo);
|
1998-05-15 20:11:40 +00:00
|
|
|
splx(s);
|
|
|
|
error = SYSCTL_OUT(req, &xig, sizeof xig);
|
|
|
|
}
|
|
|
|
free(inp_list, M_TEMP);
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist, CTLFLAG_RD, 0, 0,
|
2002-11-20 19:00:54 +00:00
|
|
|
udp_pcblist, "S,xinpcb", "List of active UDP sockets");
|
1998-05-15 20:11:40 +00:00
|
|
|
|
1999-07-11 18:32:46 +00:00
|
|
|
static int
|
2000-07-04 11:25:35 +00:00
|
|
|
udp_getcred(SYSCTL_HANDLER_ARGS)
|
1999-07-11 18:32:46 +00:00
|
|
|
{
|
2001-02-18 13:30:20 +00:00
|
|
|
struct xucred xuc;
|
1999-07-11 18:32:46 +00:00
|
|
|
struct sockaddr_in addrs[2];
|
|
|
|
struct inpcb *inp;
|
|
|
|
int error, s;
|
|
|
|
|
2002-04-01 21:31:13 +00:00
|
|
|
error = suser_cred(req->td->td_ucred, PRISON_ROOT);
|
1999-07-11 18:32:46 +00:00
|
|
|
if (error)
|
|
|
|
return (error);
|
|
|
|
error = SYSCTL_IN(req, addrs, sizeof(addrs));
|
|
|
|
if (error)
|
|
|
|
return (error);
|
|
|
|
s = splnet();
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_RLOCK(&udbinfo);
|
1999-07-11 18:32:46 +00:00
|
|
|
inp = in_pcblookup_hash(&udbinfo, addrs[1].sin_addr, addrs[1].sin_port,
|
1999-12-07 17:39:16 +00:00
|
|
|
addrs[0].sin_addr, addrs[0].sin_port, 1, NULL);
|
2002-07-12 09:55:48 +00:00
|
|
|
if (inp == NULL || inp->inp_socket == NULL) {
|
1999-07-11 18:32:46 +00:00
|
|
|
error = ENOENT;
|
|
|
|
goto out;
|
|
|
|
}
|
2002-03-22 19:57:41 +00:00
|
|
|
error = cr_canseesocket(req->td->td_ucred, inp->inp_socket);
|
2001-06-24 12:18:27 +00:00
|
|
|
if (error)
|
|
|
|
goto out;
|
2002-02-27 04:45:37 +00:00
|
|
|
cru2x(inp->inp_socket->so_cred, &xuc);
|
1999-07-11 18:32:46 +00:00
|
|
|
out:
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_RUNLOCK(&udbinfo);
|
1999-07-11 18:32:46 +00:00
|
|
|
splx(s);
|
2002-07-11 23:18:43 +00:00
|
|
|
if (error == 0)
|
|
|
|
error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
|
1999-07-11 18:32:46 +00:00
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
2001-06-24 12:18:27 +00:00
|
|
|
SYSCTL_PROC(_net_inet_udp, OID_AUTO, getcred,
|
|
|
|
CTLTYPE_OPAQUE|CTLFLAG_RW|CTLFLAG_PRISON, 0, 0,
|
|
|
|
udp_getcred, "S,xucred", "Get the xucred of a UDP connection");
|
1999-07-11 18:32:46 +00:00
|
|
|
|
1995-11-14 20:34:56 +00:00
|
|
|
static int
|
2002-11-20 19:00:54 +00:00
|
|
|
udp_output(inp, m, addr, control, td)
|
|
|
|
register struct inpcb *inp;
|
|
|
|
struct mbuf *m;
|
|
|
|
struct sockaddr *addr;
|
|
|
|
struct mbuf *control;
|
|
|
|
struct thread *td;
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
2002-11-20 19:00:54 +00:00
|
|
|
register struct udpiphdr *ui;
|
|
|
|
register int len = m->m_pkthdr.len;
|
2002-10-21 20:10:05 +00:00
|
|
|
struct in_addr faddr, laddr;
|
2002-10-21 20:40:02 +00:00
|
|
|
struct cmsghdr *cm;
|
|
|
|
struct sockaddr_in *sin, src;
|
2002-10-21 20:10:05 +00:00
|
|
|
int error = 0;
|
2003-08-20 14:46:40 +00:00
|
|
|
int ipflags;
|
2002-10-21 20:10:05 +00:00
|
|
|
u_short fport, lport;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2003-11-08 23:00:48 +00:00
|
|
|
INP_LOCK_ASSERT(inp);
|
2002-08-01 21:37:34 +00:00
|
|
|
#ifdef MAC
|
|
|
|
mac_create_mbuf_from_socket(inp->inp_socket, m);
|
|
|
|
#endif
|
|
|
|
|
1996-10-25 17:57:53 +00:00
|
|
|
if (len + sizeof(struct udpiphdr) > IP_MAXPACKET) {
|
|
|
|
error = EMSGSIZE;
|
2002-10-21 20:40:02 +00:00
|
|
|
if (control)
|
|
|
|
m_freem(control);
|
1996-10-25 17:57:53 +00:00
|
|
|
goto release;
|
|
|
|
}
|
|
|
|
|
2002-10-21 20:40:02 +00:00
|
|
|
src.sin_addr.s_addr = INADDR_ANY;
|
|
|
|
if (control != NULL) {
|
|
|
|
/*
|
|
|
|
* XXX: Currently, we assume all the optional information
|
|
|
|
* is stored in a single mbuf.
|
|
|
|
*/
|
|
|
|
if (control->m_next) {
|
|
|
|
error = EINVAL;
|
|
|
|
m_freem(control);
|
|
|
|
goto release;
|
|
|
|
}
|
|
|
|
for (; control->m_len > 0;
|
|
|
|
control->m_data += CMSG_ALIGN(cm->cmsg_len),
|
|
|
|
control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
|
|
|
|
cm = mtod(control, struct cmsghdr *);
|
|
|
|
if (control->m_len < sizeof(*cm) || cm->cmsg_len == 0 ||
|
|
|
|
cm->cmsg_len > control->m_len) {
|
|
|
|
error = EINVAL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (cm->cmsg_level != IPPROTO_IP)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
switch (cm->cmsg_type) {
|
|
|
|
case IP_SENDSRCADDR:
|
|
|
|
if (cm->cmsg_len !=
|
|
|
|
CMSG_LEN(sizeof(struct in_addr))) {
|
|
|
|
error = EINVAL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
bzero(&src, sizeof(src));
|
|
|
|
src.sin_family = AF_INET;
|
|
|
|
src.sin_len = sizeof(src);
|
|
|
|
src.sin_port = inp->inp_lport;
|
|
|
|
src.sin_addr = *(struct in_addr *)CMSG_DATA(cm);
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
error = ENOPROTOOPT;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (error)
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
m_freem(control);
|
|
|
|
}
|
|
|
|
if (error)
|
|
|
|
goto release;
|
2002-10-21 20:10:05 +00:00
|
|
|
laddr = inp->inp_laddr;
|
|
|
|
lport = inp->inp_lport;
|
2002-10-21 20:40:02 +00:00
|
|
|
if (src.sin_addr.s_addr != INADDR_ANY) {
|
|
|
|
if (lport == 0) {
|
|
|
|
error = EINVAL;
|
|
|
|
goto release;
|
|
|
|
}
|
|
|
|
error = in_pcbbind_setup(inp, (struct sockaddr *)&src,
|
|
|
|
&laddr.s_addr, &lport, td);
|
|
|
|
if (error)
|
|
|
|
goto release;
|
|
|
|
}
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
if (addr) {
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
sin = (struct sockaddr_in *)addr;
|
2002-02-27 18:32:23 +00:00
|
|
|
if (td && jailed(td->td_ucred))
|
|
|
|
prison_remote_ip(td->td_ucred, 0, &sin->sin_addr.s_addr);
|
1994-05-24 10:09:53 +00:00
|
|
|
if (inp->inp_faddr.s_addr != INADDR_ANY) {
|
|
|
|
error = EISCONN;
|
|
|
|
goto release;
|
|
|
|
}
|
2002-10-21 20:10:05 +00:00
|
|
|
error = in_pcbconnect_setup(inp, addr, &laddr.s_addr, &lport,
|
|
|
|
&faddr.s_addr, &fport, NULL, td);
|
|
|
|
if (error)
|
1994-05-24 10:09:53 +00:00
|
|
|
goto release;
|
2002-10-21 20:10:05 +00:00
|
|
|
|
|
|
|
/* Commit the local port if newly assigned. */
|
|
|
|
if (inp->inp_laddr.s_addr == INADDR_ANY &&
|
|
|
|
inp->inp_lport == 0) {
|
|
|
|
inp->inp_lport = lport;
|
|
|
|
if (in_pcbinshash(inp) != 0) {
|
|
|
|
inp->inp_lport = 0;
|
|
|
|
error = EAGAIN;
|
|
|
|
goto release;
|
|
|
|
}
|
|
|
|
inp->inp_flags |= INP_ANONPORT;
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
} else {
|
2002-10-21 20:10:05 +00:00
|
|
|
faddr = inp->inp_faddr;
|
|
|
|
fport = inp->inp_fport;
|
|
|
|
if (faddr.s_addr == INADDR_ANY) {
|
1994-05-24 10:09:53 +00:00
|
|
|
error = ENOTCONN;
|
|
|
|
goto release;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/*
|
|
|
|
* Calculate data length and get a mbuf
|
|
|
|
* for UDP and IP headers.
|
|
|
|
*/
|
2003-02-19 05:47:46 +00:00
|
|
|
M_PREPEND(m, sizeof(struct udpiphdr), M_DONTWAIT);
|
1994-05-24 10:09:53 +00:00
|
|
|
if (m == 0) {
|
|
|
|
error = ENOBUFS;
|
|
|
|
goto release;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Fill in mbuf with extended UDP header
|
|
|
|
* and addresses and length put into network format.
|
|
|
|
*/
|
|
|
|
ui = mtod(m, struct udpiphdr *);
|
2000-03-27 19:14:27 +00:00
|
|
|
bzero(ui->ui_x1, sizeof(ui->ui_x1)); /* XXX still needed? */
|
1994-05-24 10:09:53 +00:00
|
|
|
ui->ui_pr = IPPROTO_UDP;
|
2002-10-21 20:10:05 +00:00
|
|
|
ui->ui_src = laddr;
|
|
|
|
ui->ui_dst = faddr;
|
|
|
|
ui->ui_sport = lport;
|
|
|
|
ui->ui_dport = fport;
|
2000-03-27 19:14:27 +00:00
|
|
|
ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2003-08-20 14:46:40 +00:00
|
|
|
ipflags = inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST);
|
|
|
|
if (inp->inp_flags & INP_ONESBCAST)
|
|
|
|
ipflags |= IP_SENDONES;
|
|
|
|
|
1994-05-24 10:09:53 +00:00
|
|
|
/*
|
2000-03-27 19:14:27 +00:00
|
|
|
* Set up checksum and output datagram.
|
1994-05-24 10:09:53 +00:00
|
|
|
*/
|
|
|
|
if (udpcksum) {
|
2003-09-03 02:19:29 +00:00
|
|
|
if (inp->inp_flags & INP_ONESBCAST)
|
|
|
|
faddr.s_addr = INADDR_BROADCAST;
|
|
|
|
ui->ui_sum = in_pseudo(ui->ui_src.s_addr, faddr.s_addr,
|
2000-03-27 19:14:27 +00:00
|
|
|
htons((u_short)len + sizeof(struct udphdr) + IPPROTO_UDP));
|
|
|
|
m->m_pkthdr.csum_flags = CSUM_UDP;
|
|
|
|
m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
|
|
|
|
} else {
|
|
|
|
ui->ui_sum = 0;
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
((struct ip *)ui)->ip_len = sizeof (struct udpiphdr) + len;
|
1997-04-03 05:14:45 +00:00
|
|
|
((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl; /* XXX */
|
|
|
|
((struct ip *)ui)->ip_tos = inp->inp_ip_tos; /* XXX */
|
1994-05-24 10:09:53 +00:00
|
|
|
udpstat.udps_opackets++;
|
1999-12-07 17:39:16 +00:00
|
|
|
|
2003-11-20 20:07:39 +00:00
|
|
|
error = ip_output(m, inp->inp_options, NULL, ipflags,
|
2002-10-16 01:54:46 +00:00
|
|
|
inp->inp_moptions, inp);
|
1994-05-24 10:09:53 +00:00
|
|
|
return (error);
|
|
|
|
|
|
|
|
release:
|
|
|
|
m_freem(m);
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
1999-11-05 14:41:39 +00:00
|
|
|
u_long udp_sendspace = 9216; /* really max datagram size */
|
2002-11-20 19:00:54 +00:00
|
|
|
/* 40 1K datagrams */
|
1995-11-14 20:34:56 +00:00
|
|
|
SYSCTL_INT(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram, CTLFLAG_RW,
|
1999-05-03 23:57:32 +00:00
|
|
|
&udp_sendspace, 0, "Maximum outgoing UDP datagram size");
|
1995-11-14 20:34:56 +00:00
|
|
|
|
1999-12-07 17:39:16 +00:00
|
|
|
u_long udp_recvspace = 40 * (1024 +
|
|
|
|
#ifdef INET6
|
|
|
|
sizeof(struct sockaddr_in6)
|
|
|
|
#else
|
|
|
|
sizeof(struct sockaddr_in)
|
|
|
|
#endif
|
|
|
|
);
|
1995-11-14 20:34:56 +00:00
|
|
|
SYSCTL_INT(_net_inet_udp, UDPCTL_RECVSPACE, recvspace, CTLFLAG_RW,
|
2004-01-27 22:17:39 +00:00
|
|
|
&udp_recvspace, 0, "Maximum space for incoming UDP datagrams");
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1997-02-14 18:15:53 +00:00
|
|
|
static int
|
|
|
|
udp_abort(struct socket *so)
|
1994-05-24 10:09:53 +00:00
|
|
|
{
|
1997-02-14 18:15:53 +00:00
|
|
|
struct inpcb *inp;
|
1994-05-24 10:09:53 +00:00
|
|
|
int s;
|
|
|
|
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_WLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
inp = sotoinpcb(so);
|
2002-06-10 20:05:46 +00:00
|
|
|
if (inp == 0) {
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
return EINVAL; /* ??? possible? panic instead? */
|
2002-06-10 20:05:46 +00:00
|
|
|
}
|
|
|
|
INP_LOCK(inp);
|
1997-02-14 18:15:53 +00:00
|
|
|
soisdisconnected(so);
|
|
|
|
s = splnet();
|
|
|
|
in_pcbdetach(inp);
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
splx(s);
|
|
|
|
return 0;
|
|
|
|
}
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1997-02-14 18:15:53 +00:00
|
|
|
static int
|
2001-09-12 08:38:13 +00:00
|
|
|
udp_attach(struct socket *so, int proto, struct thread *td)
|
1997-02-14 18:15:53 +00:00
|
|
|
{
|
|
|
|
struct inpcb *inp;
|
|
|
|
int s, error;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_WLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
inp = sotoinpcb(so);
|
2002-06-10 20:05:46 +00:00
|
|
|
if (inp != 0) {
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
return EINVAL;
|
2002-06-10 20:05:46 +00:00
|
|
|
}
|
1999-12-07 17:39:16 +00:00
|
|
|
error = soreserve(so, udp_sendspace, udp_recvspace);
|
2002-06-10 20:05:46 +00:00
|
|
|
if (error) {
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1999-12-07 17:39:16 +00:00
|
|
|
return error;
|
2002-06-10 20:05:46 +00:00
|
|
|
}
|
1997-02-14 18:15:53 +00:00
|
|
|
s = splnet();
|
2004-03-27 20:41:32 +00:00
|
|
|
error = in_pcballoc(so, &udbinfo, "udpinp");
|
1997-02-14 18:15:53 +00:00
|
|
|
splx(s);
|
2003-08-19 17:11:46 +00:00
|
|
|
if (error) {
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
return error;
|
2003-08-19 17:11:46 +00:00
|
|
|
}
|
1999-12-07 17:39:16 +00:00
|
|
|
|
|
|
|
inp = (struct inpcb *)so->so_pcb;
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_LOCK(inp);
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1999-12-07 17:39:16 +00:00
|
|
|
inp->inp_vflag |= INP_IPV4;
|
|
|
|
inp->inp_ip_ttl = ip_defttl;
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_UNLOCK(inp);
|
1997-02-14 18:15:53 +00:00
|
|
|
return 0;
|
|
|
|
}
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1997-02-14 18:15:53 +00:00
|
|
|
static int
|
2001-09-12 08:38:13 +00:00
|
|
|
udp_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
|
1997-02-14 18:15:53 +00:00
|
|
|
{
|
|
|
|
struct inpcb *inp;
|
|
|
|
int s, error;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_WLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
inp = sotoinpcb(so);
|
2002-06-10 20:05:46 +00:00
|
|
|
if (inp == 0) {
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
return EINVAL;
|
2002-06-10 20:05:46 +00:00
|
|
|
}
|
|
|
|
INP_LOCK(inp);
|
1997-02-14 18:15:53 +00:00
|
|
|
s = splnet();
|
2001-09-12 08:38:13 +00:00
|
|
|
error = in_pcbbind(inp, nam, td);
|
1997-02-14 18:15:53 +00:00
|
|
|
splx(s);
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_UNLOCK(inp);
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
return error;
|
|
|
|
}
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1997-02-14 18:15:53 +00:00
|
|
|
static int
|
2001-09-12 08:38:13 +00:00
|
|
|
udp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
|
1997-02-14 18:15:53 +00:00
|
|
|
{
|
|
|
|
struct inpcb *inp;
|
|
|
|
int s, error;
|
This Implements the mumbled about "Jail" feature.
This is a seriously beefed up chroot kind of thing. The process
is jailed along the same lines as a chroot does it, but with
additional tough restrictions imposed on what the superuser can do.
For all I know, it is safe to hand over the root bit inside a
prison to the customer living in that prison, this is what
it was developed for in fact: "real virtual servers".
Each prison has an ip number associated with it, which all IP
communications will be coerced to use and each prison has its own
hostname.
Needless to say, you need more RAM this way, but the advantage is
that each customer can run their own particular version of apache
and not stomp on the toes of their neighbors.
It generally does what one would expect, but setting up a jail
still takes a little knowledge.
A few notes:
I have no scripts for setting up a jail, don't ask me for them.
The IP number should be an alias on one of the interfaces.
mount a /proc in each jail, it will make ps more useable.
/proc/<pid>/status tells the hostname of the prison for
jailed processes.
Quotas are only sensible if you have a mountpoint per prison.
There are no privisions for stopping resource-hogging.
Some "#ifdef INET" and similar may be missing (send patches!)
If somebody wants to take it from here and develop it into
more of a "virtual machine" they should be most welcome!
Tools, comments, patches & documentation most welcome.
Have fun...
Sponsored by: http://www.rndassociates.com/
Run for almost a year by: http://www.servetheweb.com/
1999-04-28 11:38:52 +00:00
|
|
|
struct sockaddr_in *sin;
|
1997-02-14 18:15:53 +00:00
|
|
|
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_WLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
inp = sotoinpcb(so);
|
2002-06-10 20:05:46 +00:00
|
|
|
if (inp == 0) {
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
return EINVAL;
|
2002-06-10 20:05:46 +00:00
|
|
|
}
|
|
|
|
INP_LOCK(inp);
|
|
|
|
if (inp->inp_faddr.s_addr != INADDR_ANY) {
|
|
|
|
INP_UNLOCK(inp);
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
return EISCONN;
|
2002-06-10 20:05:46 +00:00
|
|
|
}
|
1997-02-14 18:15:53 +00:00
|
|
|
s = splnet();
|
2000-09-17 13:34:18 +00:00
|
|
|
sin = (struct sockaddr_in *)nam;
|
2002-02-27 18:32:23 +00:00
|
|
|
if (td && jailed(td->td_ucred))
|
|
|
|
prison_remote_ip(td->td_ucred, 0, &sin->sin_addr.s_addr);
|
2001-09-12 08:38:13 +00:00
|
|
|
error = in_pcbconnect(inp, nam, td);
|
1997-02-14 18:15:53 +00:00
|
|
|
splx(s);
|
2002-05-31 11:52:35 +00:00
|
|
|
if (error == 0)
|
1997-02-14 18:15:53 +00:00
|
|
|
soisconnected(so);
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_UNLOCK(inp);
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
return error;
|
|
|
|
}
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1997-02-14 18:15:53 +00:00
|
|
|
static int
|
|
|
|
udp_detach(struct socket *so)
|
|
|
|
{
|
|
|
|
struct inpcb *inp;
|
|
|
|
int s;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_WLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
inp = sotoinpcb(so);
|
2002-06-10 20:05:46 +00:00
|
|
|
if (inp == 0) {
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
return EINVAL;
|
2002-06-10 20:05:46 +00:00
|
|
|
}
|
|
|
|
INP_LOCK(inp);
|
1997-02-14 18:15:53 +00:00
|
|
|
s = splnet();
|
|
|
|
in_pcbdetach(inp);
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
splx(s);
|
|
|
|
return 0;
|
|
|
|
}
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1997-02-14 18:15:53 +00:00
|
|
|
static int
|
|
|
|
udp_disconnect(struct socket *so)
|
|
|
|
{
|
|
|
|
struct inpcb *inp;
|
|
|
|
int s;
|
1994-05-24 10:09:53 +00:00
|
|
|
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_WLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
inp = sotoinpcb(so);
|
2002-06-10 20:05:46 +00:00
|
|
|
if (inp == 0) {
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
return EINVAL;
|
2002-06-10 20:05:46 +00:00
|
|
|
}
|
|
|
|
INP_LOCK(inp);
|
|
|
|
if (inp->inp_faddr.s_addr == INADDR_ANY) {
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
|
|
|
INP_UNLOCK(inp);
|
1997-02-14 18:15:53 +00:00
|
|
|
return ENOTCONN;
|
2002-06-10 20:05:46 +00:00
|
|
|
}
|
1994-05-24 10:09:53 +00:00
|
|
|
|
1997-02-14 18:15:53 +00:00
|
|
|
s = splnet();
|
|
|
|
in_pcbdisconnect(inp);
|
|
|
|
inp->inp_laddr.s_addr = INADDR_ANY;
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_UNLOCK(inp);
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
splx(s);
|
|
|
|
so->so_state &= ~SS_ISCONNECTED; /* XXX */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
1997-08-16 19:16:27 +00:00
|
|
|
udp_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
|
2001-09-12 08:38:13 +00:00
|
|
|
struct mbuf *control, struct thread *td)
|
1997-02-14 18:15:53 +00:00
|
|
|
{
|
|
|
|
struct inpcb *inp;
|
2002-06-10 20:05:46 +00:00
|
|
|
int ret;
|
1997-02-14 18:15:53 +00:00
|
|
|
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_WLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
inp = sotoinpcb(so);
|
|
|
|
if (inp == 0) {
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
1994-05-24 10:09:53 +00:00
|
|
|
m_freem(m);
|
1997-02-14 18:15:53 +00:00
|
|
|
return EINVAL;
|
|
|
|
}
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_LOCK(inp);
|
|
|
|
ret = udp_output(inp, m, addr, control, td);
|
|
|
|
INP_UNLOCK(inp);
|
|
|
|
INP_INFO_WUNLOCK(&udbinfo);
|
|
|
|
return ret;
|
1994-05-24 10:09:53 +00:00
|
|
|
}
|
|
|
|
|
1999-11-05 14:41:39 +00:00
|
|
|
int
|
1997-02-14 18:15:53 +00:00
|
|
|
udp_shutdown(struct socket *so)
|
|
|
|
{
|
1994-05-24 10:09:53 +00:00
|
|
|
struct inpcb *inp;
|
1997-02-14 18:15:53 +00:00
|
|
|
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_INFO_RLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
inp = sotoinpcb(so);
|
2002-06-10 20:05:46 +00:00
|
|
|
if (inp == 0) {
|
|
|
|
INP_INFO_RUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
return EINVAL;
|
2002-06-10 20:05:46 +00:00
|
|
|
}
|
|
|
|
INP_LOCK(inp);
|
|
|
|
INP_INFO_RUNLOCK(&udbinfo);
|
1997-02-14 18:15:53 +00:00
|
|
|
socantsendmore(so);
|
2002-06-10 20:05:46 +00:00
|
|
|
INP_UNLOCK(inp);
|
1997-02-14 18:15:53 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2002-06-10 20:05:46 +00:00
|
|
|
/*
|
|
|
|
* This is the wrapper function for in_setsockaddr. We just pass down
|
|
|
|
* the pcbinfo for in_setsockaddr to lock. We don't want to do the locking
|
|
|
|
* here because in_setsockaddr will call malloc and might block.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
udp_sockaddr(struct socket *so, struct sockaddr **nam)
|
|
|
|
{
|
|
|
|
return (in_setsockaddr(so, nam, &udbinfo));
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This is the wrapper function for in_setpeeraddr. We just pass down
|
|
|
|
* the pcbinfo for in_setpeeraddr to lock.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
udp_peeraddr(struct socket *so, struct sockaddr **nam)
|
|
|
|
{
|
|
|
|
return (in_setpeeraddr(so, nam, &udbinfo));
|
|
|
|
}
|
|
|
|
|
1997-02-14 18:15:53 +00:00
|
|
|
struct pr_usrreqs udp_usrreqs = {
|
1997-02-18 20:46:36 +00:00
|
|
|
udp_abort, pru_accept_notsupp, udp_attach, udp_bind, udp_connect,
|
|
|
|
pru_connect2_notsupp, in_control, udp_detach, udp_disconnect,
|
2002-06-10 20:05:46 +00:00
|
|
|
pru_listen_notsupp, udp_peeraddr, pru_rcvd_notsupp,
|
1997-02-18 20:46:36 +00:00
|
|
|
pru_rcvoob_notsupp, udp_send, pru_sense_null, udp_shutdown,
|
Introduce a MAC label reference in 'struct inpcb', which caches
the MAC label referenced from 'struct socket' in the IPv4 and
IPv6-based protocols. This permits MAC labels to be checked during
network delivery operations without dereferencing inp->inp_socket
to get to so->so_label, which will eventually avoid our having to
grab the socket lock during delivery at the network layer.
This change introduces 'struct inpcb' as a labeled object to the
MAC Framework, along with the normal circus of entry points:
initialization, creation from socket, destruction, as well as a
delivery access control check.
For most policies, the inpcb label will simply be a cache of the
socket label, so a new protocol switch method is introduced,
pr_sosetlabel() to notify protocols that the socket layer label
has been updated so that the cache can be updated while holding
appropriate locks. Most protocols implement this using
pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use
the the worker function in_pcbsosetlabel(), which calls into the
MAC Framework to perform a cache update.
Biba, LOMAC, and MLS implement these entry points, as do the stub
policy, and test policy.
Reviewed by: sam, bms
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
2003-11-18 00:39:07 +00:00
|
|
|
udp_sockaddr, sosend, soreceive, sopoll, in_pcbsosetlabel
|
1997-02-14 18:15:53 +00:00
|
|
|
};
|