Home | History | Annotate | Line # | Download | only in netinet6
udp6_usrreq.c revision 1.91.4.3
      1 /*	$NetBSD: udp6_usrreq.c,v 1.91.4.3 2014/05/18 17:46:13 rmind Exp $	*/
      2 /*	$KAME: udp6_usrreq.c,v 1.86 2001/05/27 17:33:00 itojun Exp $	*/
      3 
      4 /*
      5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
      6  * All rights reserved.
      7  *
      8  * Redistribution and use in source and binary forms, with or without
      9  * modification, are permitted provided that the following conditions
     10  * are met:
     11  * 1. Redistributions of source code must retain the above copyright
     12  *    notice, this list of conditions and the following disclaimer.
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in the
     15  *    documentation and/or other materials provided with the distribution.
     16  * 3. Neither the name of the project nor the names of its contributors
     17  *    may be used to endorse or promote products derived from this software
     18  *    without specific prior written permission.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     30  * SUCH DAMAGE.
     31  */
     32 
     33 /*
     34  * Copyright (c) 1982, 1986, 1989, 1993
     35  *	The Regents of the University of California.  All rights reserved.
     36  *
     37  * Redistribution and use in source and binary forms, with or without
     38  * modification, are permitted provided that the following conditions
     39  * are met:
     40  * 1. Redistributions of source code must retain the above copyright
     41  *    notice, this list of conditions and the following disclaimer.
     42  * 2. Redistributions in binary form must reproduce the above copyright
     43  *    notice, this list of conditions and the following disclaimer in the
     44  *    documentation and/or other materials provided with the distribution.
     45  * 3. Neither the name of the University nor the names of its contributors
     46  *    may be used to endorse or promote products derived from this software
     47  *    without specific prior written permission.
     48  *
     49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     59  * SUCH DAMAGE.
     60  *
     61  *	@(#)udp_var.h	8.1 (Berkeley) 6/10/93
     62  */
     63 
     64 #include <sys/cdefs.h>
     65 __KERNEL_RCSID(0, "$NetBSD: udp6_usrreq.c,v 1.91.4.3 2014/05/18 17:46:13 rmind Exp $");
     66 
     67 #include "opt_inet.h"
     68 #include "opt_inet_csum.h"
     69 
     70 #include <sys/param.h>
     71 #include <sys/mbuf.h>
     72 #include <sys/protosw.h>
     73 #include <sys/socket.h>
     74 #include <sys/socketvar.h>
     75 #include <sys/systm.h>
     76 #include <sys/proc.h>
     77 #include <sys/syslog.h>
     78 #include <sys/domain.h>
     79 #include <sys/sysctl.h>
     80 
     81 #include <net/if.h>
     82 #include <net/route.h>
     83 #include <net/if_types.h>
     84 
     85 #include <netinet/in.h>
     86 #include <netinet/in_var.h>
     87 #include <netinet/in_systm.h>
     88 #include <netinet/in_offload.h>
     89 #include <netinet/ip.h>
     90 #include <netinet/ip_var.h>
     91 #define __INPCB_PRIVATE
     92 #include <netinet/in_pcb.h>
     93 #include <netinet/udp.h>
     94 #include <netinet/udp_var.h>
     95 #include <netinet/udp_private.h>
     96 
     97 #include <netinet/ip6.h>
     98 #include <netinet/icmp6.h>
     99 #include <netinet6/ip6_var.h>
    100 #include <netinet6/ip6_private.h>
    101 #include <netinet6/in6_pcb.h>
    102 #include <netinet6/udp6_var.h>
    103 #include <netinet6/udp6_private.h>
    104 #include <netinet6/ip6protosw.h>
    105 #include <netinet6/scope6_var.h>
    106 
    107 #include "faith.h"
    108 #if defined(NFAITH) && NFAITH > 0
    109 #include <net/if_faith.h>
    110 #endif
    111 
    112 /*
    113  * UDP protocol implementation.
    114  * Per RFC 768, August, 1980.
    115  */
    116 
    117 extern inpcbtable_t *	udbtable;
    118 
    119 percpu_t *		udp6stat_percpu;
    120 
    121 static	void udp6_notify(struct in6pcb *, int);
    122 static	void sysctl_net_inet6_udp6_setup(struct sysctllog **);
    123 
    124 #ifdef UDP_CSUM_COUNTERS
    125 #include <sys/device.h>
    126 
    127 struct evcnt udp6_hwcsum_bad = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    128     NULL, "udp6", "hwcsum bad");
    129 struct evcnt udp6_hwcsum_ok = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    130     NULL, "udp6", "hwcsum ok");
    131 struct evcnt udp6_hwcsum_data = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    132     NULL, "udp6", "hwcsum data");
    133 struct evcnt udp6_swcsum = EVCNT_INITIALIZER(EVCNT_TYPE_MISC,
    134     NULL, "udp6", "swcsum");
    135 
    136 EVCNT_ATTACH_STATIC(udp6_hwcsum_bad);
    137 EVCNT_ATTACH_STATIC(udp6_hwcsum_ok);
    138 EVCNT_ATTACH_STATIC(udp6_hwcsum_data);
    139 EVCNT_ATTACH_STATIC(udp6_swcsum);
    140 
    141 #define	UDP_CSUM_COUNTER_INCR(ev)	(ev)->ev_count++
    142 #else
    143 #define	UDP_CSUM_COUNTER_INCR(ev)	/* nothing */
    144 #endif /* UDP_CSUM_COUNTERS */
    145 
    146 void
    147 udp6_init(void)
    148 {
    149 	sysctl_net_inet6_udp6_setup(NULL);
    150 	udp6stat_percpu = percpu_alloc(sizeof(uint64_t) * UDP6_NSTATS);
    151 
    152 	udp_init_common();
    153 }
    154 
    155 /*
    156  * Notify a udp user of an asynchronous error;
    157  * just wake up so that he can collect error status.
    158  */
    159 static	void
    160 udp6_notify(struct in6pcb *in6p, int errno)
    161 {
    162 	in6p->in6p_socket->so_error = errno;
    163 	sorwakeup(in6p->in6p_socket);
    164 	sowwakeup(in6p->in6p_socket);
    165 }
    166 
    167 void *
    168 udp6_ctlinput(int cmd, const struct sockaddr *sa, void *d)
    169 {
    170 	struct udphdr uh;
    171 	struct ip6_hdr *ip6;
    172 	const struct sockaddr_in6 *sa6 = (const struct sockaddr_in6 *)sa;
    173 	struct mbuf *m;
    174 	int off;
    175 	void *cmdarg;
    176 	struct ip6ctlparam *ip6cp = NULL;
    177 	const struct sockaddr_in6 *sa6_src = NULL;
    178 	void (*notify)(struct in6pcb *, int) = udp6_notify;
    179 	struct udp_portonly {
    180 		u_int16_t uh_sport;
    181 		u_int16_t uh_dport;
    182 	} *uhp;
    183 
    184 	if (sa->sa_family != AF_INET6 ||
    185 	    sa->sa_len != sizeof(struct sockaddr_in6))
    186 		return NULL;
    187 
    188 	if ((unsigned)cmd >= PRC_NCMDS)
    189 		return NULL;
    190 	if (PRC_IS_REDIRECT(cmd))
    191 		notify = in6_rtchange, d = NULL;
    192 	else if (cmd == PRC_HOSTDEAD)
    193 		d = NULL;
    194 	else if (cmd == PRC_MSGSIZE) {
    195 		/* special code is present, see below */
    196 		notify = in6_rtchange;
    197 	}
    198 	else if (inet6ctlerrmap[cmd] == 0)
    199 		return NULL;
    200 
    201 	/* if the parameter is from icmp6, decode it. */
    202 	if (d != NULL) {
    203 		ip6cp = (struct ip6ctlparam *)d;
    204 		m = ip6cp->ip6c_m;
    205 		ip6 = ip6cp->ip6c_ip6;
    206 		off = ip6cp->ip6c_off;
    207 		cmdarg = ip6cp->ip6c_cmdarg;
    208 		sa6_src = ip6cp->ip6c_src;
    209 	} else {
    210 		m = NULL;
    211 		ip6 = NULL;
    212 		cmdarg = NULL;
    213 		sa6_src = &sa6_any;
    214 		off = 0;
    215 	}
    216 
    217 	if (ip6) {
    218 		/*
    219 		 * XXX: We assume that when IPV6 is non NULL,
    220 		 * M and OFF are valid.
    221 		 */
    222 
    223 		/* check if we can safely examine src and dst ports */
    224 		if (m->m_pkthdr.len < off + sizeof(*uhp)) {
    225 			if (cmd == PRC_MSGSIZE)
    226 				icmp6_mtudisc_update((struct ip6ctlparam *)d, 0);
    227 			return NULL;
    228 		}
    229 
    230 		memset(&uh, 0, sizeof(uh));
    231 		m_copydata(m, off, sizeof(*uhp), (void *)&uh);
    232 
    233 		if (cmd == PRC_MSGSIZE) {
    234 			int valid = 0;
    235 
    236 			/*
    237 			 * Check to see if we have a valid UDP socket
    238 			 * corresponding to the address in the ICMPv6 message
    239 			 * payload.
    240 			 */
    241 			if (in6_pcblookup_connect(udbtable, &sa6->sin6_addr,
    242 			    uh.uh_dport, (const struct in6_addr *)&sa6_src->sin6_addr,
    243 						  uh.uh_sport, 0, 0))
    244 				valid++;
    245 #if 0
    246 			/*
    247 			 * As the use of sendto(2) is fairly popular,
    248 			 * we may want to allow non-connected pcb too.
    249 			 * But it could be too weak against attacks...
    250 			 * We should at least check if the local address (= s)
    251 			 * is really ours.
    252 			 */
    253 			else if (in6_pcblookup_bind(udbtable, &sa6->sin6_addr,
    254 			    uh.uh_dport, 0))
    255 				valid++;
    256 #endif
    257 
    258 			/*
    259 			 * Depending on the value of "valid" and routing table
    260 			 * size (mtudisc_{hi,lo}wat), we will:
    261 			 * - recalculate the new MTU and create the
    262 			 *   corresponding routing entry, or
    263 			 * - ignore the MTU change notification.
    264 			 */
    265 			icmp6_mtudisc_update((struct ip6ctlparam *)d, valid);
    266 
    267 			/*
    268 			 * regardless of if we called
    269 			 * icmp6_mtudisc_update(), we need to call
    270 			 * in6_pcbnotify(), to notify path MTU change
    271 			 * to the userland (RFC3542), because some
    272 			 * unconnected sockets may share the same
    273 			 * destination and want to know the path MTU.
    274 			 */
    275 		}
    276 
    277 		(void) in6_pcbnotify(udbtable, sa, uh.uh_dport,
    278 		    (const struct sockaddr *)sa6_src, uh.uh_sport, cmd, cmdarg,
    279 		    notify);
    280 	} else {
    281 		(void) in6_pcbnotify(udbtable, sa, 0,
    282 		    (const struct sockaddr *)sa6_src, 0, cmd, cmdarg, notify);
    283 	}
    284 	return NULL;
    285 }
    286 
    287 int
    288 udp6_ctloutput(int op, struct socket *so, struct sockopt *sopt)
    289 {
    290 	int s;
    291 	int error = 0;
    292 	int family;
    293 
    294 	family = so->so_proto->pr_domain->dom_family;
    295 
    296 	s = splsoftnet();
    297 	switch (family) {
    298 #ifdef INET
    299 	case PF_INET:
    300 		if (sopt->sopt_level != IPPROTO_UDP) {
    301 			error = ip_ctloutput(op, so, sopt);
    302 			goto end;
    303 		}
    304 		break;
    305 #endif
    306 #ifdef INET6
    307 	case PF_INET6:
    308 		if (sopt->sopt_level != IPPROTO_UDP) {
    309 			error = ip6_ctloutput(op, so, sopt);
    310 			goto end;
    311 		}
    312 		break;
    313 #endif
    314 	default:
    315 		error = EAFNOSUPPORT;
    316 		goto end;
    317 	}
    318 	error = EINVAL;
    319 
    320 end:
    321 	splx(s);
    322 	return error;
    323 }
    324 
    325 static void
    326 udp6_sendup(struct mbuf *m, int off /* offset of data portion */,
    327 	struct sockaddr *src, struct socket *so)
    328 {
    329 	struct mbuf *opts = NULL;
    330 	struct mbuf *n;
    331 	struct in6pcb *in6p = NULL;
    332 
    333 	if (!so)
    334 		return;
    335 	if (so->so_proto->pr_domain->dom_family != AF_INET6)
    336 		return;
    337 	in6p = sotoin6pcb(so);
    338 
    339 #if defined(IPSEC)
    340 	/* check AH/ESP integrity. */
    341 	if (so != NULL && ipsec6_in_reject_so(m, so)) {
    342 		IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
    343 		if ((n = m_copypacket(m, M_DONTWAIT)) != NULL)
    344 			icmp6_error(n, ICMP6_DST_UNREACH,
    345 			    ICMP6_DST_UNREACH_ADMIN, 0);
    346 		return;
    347 	}
    348 #endif /*IPSEC*/
    349 
    350 	if ((n = m_copypacket(m, M_DONTWAIT)) != NULL) {
    351 		if (in6p && (in6p->in6p_flags & IN6P_CONTROLOPTS
    352 #ifdef SO_OTIMESTAMP
    353 		    || in6p->in6p_socket->so_options & SO_OTIMESTAMP
    354 #endif
    355 		    || in6p->in6p_socket->so_options & SO_TIMESTAMP)) {
    356 			struct ip6_hdr *ip6 = mtod(n, struct ip6_hdr *);
    357 			ip6_savecontrol(in6p, &opts, ip6, n);
    358 		}
    359 
    360 		m_adj(n, off);
    361 		if (sbappendaddr(&so->so_rcv, src, n, opts) == 0) {
    362 			m_freem(n);
    363 			if (opts)
    364 				m_freem(opts);
    365 			so->so_rcv.sb_overflowed++;
    366 			UDP6_STATINC(UDP6_STAT_FULLSOCK);
    367 		} else
    368 			sorwakeup(so);
    369 	}
    370 }
    371 
    372 int
    373 udp6_realinput(int af, struct sockaddr_in6 *src, struct sockaddr_in6 *dst,
    374 	struct mbuf *m, int off)
    375 {
    376 	u_int16_t sport, dport;
    377 	int rcvcnt;
    378 	struct in6_addr src6, *dst6;
    379 	const struct in_addr *dst4;
    380 	struct inpcb_hdr *inph;
    381 	struct in6pcb *in6p;
    382 
    383 	rcvcnt = 0;
    384 	off += sizeof(struct udphdr);	/* now, offset of payload */
    385 
    386 	if (af != AF_INET && af != AF_INET6)
    387 		goto bad;
    388 	if (src->sin6_family != AF_INET6 || dst->sin6_family != AF_INET6)
    389 		goto bad;
    390 
    391 	src6 = src->sin6_addr;
    392 	if (sa6_recoverscope(src) != 0) {
    393 		/* XXX: should be impossible. */
    394 		goto bad;
    395 	}
    396 	sport = src->sin6_port;
    397 
    398 	dport = dst->sin6_port;
    399 	dst4 = (struct in_addr *)&dst->sin6_addr.s6_addr[12];
    400 	dst6 = &dst->sin6_addr;
    401 
    402 	if (IN6_IS_ADDR_MULTICAST(dst6) ||
    403 	    (af == AF_INET && IN_MULTICAST(dst4->s_addr))) {
    404 		/*
    405 		 * Deliver a multicast or broadcast datagram to *all* sockets
    406 		 * for which the local and remote addresses and ports match
    407 		 * those of the incoming datagram.  This allows more than
    408 		 * one process to receive multi/broadcasts on the same port.
    409 		 * (This really ought to be done for unicast datagrams as
    410 		 * well, but that would cause problems with existing
    411 		 * applications that open both address-specific sockets and
    412 		 * a wildcard socket listening to the same port -- they would
    413 		 * end up receiving duplicates of every unicast datagram.
    414 		 * Those applications open the multiple sockets to overcome an
    415 		 * inadequacy of the UDP socket interface, but for backwards
    416 		 * compatibility we avoid the problem here rather than
    417 		 * fixing the interface.  Maybe 4.5BSD will remedy this?)
    418 		 */
    419 
    420 		/*
    421 		 * KAME note: traditionally we dropped udpiphdr from mbuf here.
    422 		 * we need udpiphdr for IPsec processing so we do that later.
    423 		 */
    424 		/*
    425 		 * Locate pcb(s) for datagram.
    426 		 */
    427 		CIRCLEQ_FOREACH(inph, &udbtable->inpt_queue, inph_queue) {
    428 			in6p = (struct in6pcb *)inph;
    429 			if (in6p->in6p_af != AF_INET6)
    430 				continue;
    431 
    432 			if (in6p->in6p_lport != dport)
    433 				continue;
    434 			if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr)) {
    435 				if (!IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr,
    436 				    dst6))
    437 					continue;
    438 			} else {
    439 				if (IN6_IS_ADDR_V4MAPPED(dst6) &&
    440 				    (in6p->in6p_flags & IN6P_IPV6_V6ONLY))
    441 					continue;
    442 			}
    443 			if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr)) {
    444 				if (!IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr,
    445 				    &src6) || in6p->in6p_fport != sport)
    446 					continue;
    447 			} else {
    448 				if (IN6_IS_ADDR_V4MAPPED(&src6) &&
    449 				    (in6p->in6p_flags & IN6P_IPV6_V6ONLY))
    450 					continue;
    451 			}
    452 
    453 			udp6_sendup(m, off, (struct sockaddr *)src,
    454 				in6p->in6p_socket);
    455 			rcvcnt++;
    456 
    457 			/*
    458 			 * Don't look for additional matches if this one does
    459 			 * not have either the SO_REUSEPORT or SO_REUSEADDR
    460 			 * socket options set.  This heuristic avoids searching
    461 			 * through all pcbs in the common case of a non-shared
    462 			 * port.  It assumes that an application will never
    463 			 * clear these options after setting them.
    464 			 */
    465 			if ((in6p->in6p_socket->so_options &
    466 			    (SO_REUSEPORT|SO_REUSEADDR)) == 0)
    467 				break;
    468 		}
    469 	} else {
    470 		/*
    471 		 * Locate pcb for datagram.
    472 		 */
    473 		in6p = in6_pcblookup_connect(udbtable, &src6, sport, dst6,
    474 					     dport, 0, 0);
    475 		if (in6p == 0) {
    476 			UDP_STATINC(UDP_STAT_PCBHASHMISS);
    477 			in6p = in6_pcblookup_bind(udbtable, dst6, dport, 0);
    478 			if (in6p == 0)
    479 				return rcvcnt;
    480 		}
    481 
    482 		udp6_sendup(m, off, (struct sockaddr *)src, in6p->in6p_socket);
    483 		rcvcnt++;
    484 	}
    485 
    486 bad:
    487 	return rcvcnt;
    488 }
    489 
    490 int
    491 udp6_input_checksum(struct mbuf *m, const struct udphdr *uh, int off, int len)
    492 {
    493 	/*
    494 	 * XXX it's better to record and check if this mbuf is
    495 	 * already checked.
    496 	 */
    497 
    498 	if (__predict_false((m->m_flags & M_LOOP) && !udp_do_loopback_cksum)) {
    499 		goto good;
    500 	}
    501 	if (uh->uh_sum == 0) {
    502 		UDP6_STATINC(UDP6_STAT_NOSUM);
    503 		goto bad;
    504 	}
    505 
    506 	switch (m->m_pkthdr.csum_flags &
    507 	    ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_UDPv6) |
    508 	    M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
    509 	case M_CSUM_UDPv6|M_CSUM_TCP_UDP_BAD:
    510 		UDP_CSUM_COUNTER_INCR(&udp6_hwcsum_bad);
    511 		UDP6_STATINC(UDP6_STAT_BADSUM);
    512 		goto bad;
    513 
    514 #if 0 /* notyet */
    515 	case M_CSUM_UDPv6|M_CSUM_DATA:
    516 #endif
    517 
    518 	case M_CSUM_UDPv6:
    519 		/* Checksum was okay. */
    520 		UDP_CSUM_COUNTER_INCR(&udp6_hwcsum_ok);
    521 		break;
    522 
    523 	default:
    524 		/*
    525 		 * Need to compute it ourselves.  Maybe skip checksum
    526 		 * on loopback interfaces.
    527 		 */
    528 		UDP_CSUM_COUNTER_INCR(&udp6_swcsum);
    529 		if (in6_cksum(m, IPPROTO_UDP, off, len) != 0) {
    530 			UDP6_STATINC(UDP6_STAT_BADSUM);
    531 			goto bad;
    532 		}
    533 	}
    534 
    535 good:
    536 	return 0;
    537 bad:
    538 	return -1;
    539 }
    540 
    541 int
    542 udp6_input(struct mbuf **mp, int *offp, int proto)
    543 {
    544 	struct mbuf *m = *mp;
    545 	int off = *offp;
    546 	struct sockaddr_in6 src, dst;
    547 	struct ip6_hdr *ip6;
    548 	struct udphdr *uh;
    549 	u_int32_t plen, ulen;
    550 
    551 	ip6 = mtod(m, struct ip6_hdr *);
    552 
    553 #if defined(NFAITH) && 0 < NFAITH
    554 	if (faithprefix(&ip6->ip6_dst)) {
    555 		/* send icmp6 host unreach? */
    556 		m_freem(m);
    557 		return IPPROTO_DONE;
    558 	}
    559 #endif
    560 
    561 	UDP6_STATINC(UDP6_STAT_IPACKETS);
    562 
    563 	/* check for jumbogram is done in ip6_input.  we can trust pkthdr.len */
    564 	plen = m->m_pkthdr.len - off;
    565 	IP6_EXTHDR_GET(uh, struct udphdr *, m, off, sizeof(struct udphdr));
    566 	if (uh == NULL) {
    567 		IP6_STATINC(IP6_STAT_TOOSHORT);
    568 		return IPPROTO_DONE;
    569 	}
    570 	KASSERT(UDP_HDR_ALIGNED_P(uh));
    571 	ulen = ntohs((u_short)uh->uh_ulen);
    572 	/*
    573 	 * RFC2675 section 4: jumbograms will have 0 in the UDP header field,
    574 	 * iff payload length > 0xffff.
    575 	 */
    576 	if (ulen == 0 && plen > 0xffff)
    577 		ulen = plen;
    578 
    579 	if (plen != ulen) {
    580 		UDP6_STATINC(UDP6_STAT_BADLEN);
    581 		goto bad;
    582 	}
    583 
    584 	/* destination port of 0 is illegal, based on RFC768. */
    585 	if (uh->uh_dport == 0)
    586 		goto bad;
    587 
    588 	/* Be proactive about malicious use of IPv4 mapped address */
    589 	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
    590 	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
    591 		/* XXX stat */
    592 		goto bad;
    593 	}
    594 
    595 	/*
    596 	 * Checksum extended UDP header and data.  Maybe skip checksum
    597 	 * on loopback interfaces.
    598 	 */
    599 	if (udp6_input_checksum(m, uh, off, ulen))
    600 		goto bad;
    601 
    602 	/*
    603 	 * Construct source and dst sockaddrs.
    604 	 */
    605 	memset(&src, 0, sizeof(src));
    606 	src.sin6_family = AF_INET6;
    607 	src.sin6_len = sizeof(struct sockaddr_in6);
    608 	src.sin6_addr = ip6->ip6_src;
    609 	src.sin6_port = uh->uh_sport;
    610 	memset(&dst, 0, sizeof(dst));
    611 	dst.sin6_family = AF_INET6;
    612 	dst.sin6_len = sizeof(struct sockaddr_in6);
    613 	dst.sin6_addr = ip6->ip6_dst;
    614 	dst.sin6_port = uh->uh_dport;
    615 
    616 	if (udp6_realinput(AF_INET6, &src, &dst, m, off) == 0) {
    617 		if (m->m_flags & M_MCAST) {
    618 			UDP6_STATINC(UDP6_STAT_NOPORTMCAST);
    619 			goto bad;
    620 		}
    621 		UDP6_STATINC(UDP6_STAT_NOPORT);
    622 		icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT, 0);
    623 		m = NULL;
    624 	}
    625 
    626 bad:
    627 	if (m)
    628 		m_freem(m);
    629 	return IPPROTO_DONE;
    630 }
    631 
    632 extern	int udp6_sendspace;
    633 extern	int udp6_recvspace;
    634 
    635 static int
    636 udp6_attach(struct socket *so, int proto)
    637 {
    638 	struct in6pcb *in6p;
    639 	int s, error = 0;
    640 
    641 	KASSERT(sotoin6pcb(so) == NULL);
    642 	sosetlock(so);
    643 	solock(so);
    644 
    645 	/*
    646 	 * MAPPED_ADDR implementation spec:
    647 	 *  Always attach for IPv6, and only when necessary for IPv4.
    648 	 */
    649 	s = splsoftnet();
    650 	error = in6_pcballoc(so, udbtable);
    651 	splx(s);
    652 	if (error) {
    653 		sounlock(so);
    654 		return error;
    655 	}
    656 	error = soreserve(so, udp6_sendspace, udp6_recvspace);
    657 	if (error) {
    658 		sounlock(so);
    659 		return error;
    660 	}
    661 	in6p = sotoin6pcb(so);
    662 	in6p->in6p_cksum = -1;	/* just to be sure */
    663 	sounlock(so);
    664 	return 0;
    665 }
    666 
    667 static void
    668 udp6_detach(struct socket *so)
    669 {
    670 	struct in6pcb *in6p = sotoin6pcb(so);
    671 	int s;
    672 
    673 	KASSERT(solocked(so));
    674 
    675 	s = splsoftnet();
    676 	KASSERT(in6p != NULL);
    677 	in6_pcbdetach(in6p);
    678 	splx(s);
    679 }
    680 
    681 int
    682 udp6_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *addr6,
    683     struct mbuf *control, struct lwp *l)
    684 {
    685 	struct	in6pcb *in6p = sotoin6pcb(so);
    686 	int	error = 0;
    687 	int	s;
    688 
    689 	KASSERT(req != PRU_ATTACH);
    690 	KASSERT(req != PRU_DETACH);
    691 
    692 	/*
    693 	 * MAPPED_ADDR implementation info:
    694 	 *  Mapped addr support for PRU_CONTROL is not necessary.
    695 	 *  Because typical user of PRU_CONTROL is such as ifconfig,
    696 	 *  and they don't associate any addr to their socket.  Then
    697 	 *  socket family is only hint about the PRU_CONTROL'ed address
    698 	 *  family, especially when getting addrs from kernel.
    699 	 *  So AF_INET socket need to be used to control AF_INET addrs,
    700 	 *  and AF_INET6 socket for AF_INET6 addrs.
    701 	 */
    702 	if (req == PRU_CONTROL)
    703 		return in6_control(so, (u_long)m, (void *)addr6,
    704 				   (struct ifnet *)control, l);
    705 
    706 	if (req == PRU_PURGEIF) {
    707 		mutex_enter(softnet_lock);
    708 		in6_pcbpurgeif0(udbtable, (struct ifnet *)control);
    709 		in6_purgeif((struct ifnet *)control);
    710 		in6_pcbpurgeif(udbtable, (struct ifnet *)control);
    711 		mutex_exit(softnet_lock);
    712 		return 0;
    713 	}
    714 
    715 	if (in6p == NULL) {
    716 		error = EINVAL;
    717 		goto release;
    718 	}
    719 
    720 	switch (req) {
    721 	case PRU_BIND:
    722 		s = splsoftnet();
    723 		error = in6_pcbbind(in6p, addr6, l);
    724 		splx(s);
    725 		break;
    726 
    727 	case PRU_CONNECT:
    728 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr)) {
    729 			error = EISCONN;
    730 			break;
    731 		}
    732 		s = splsoftnet();
    733 		error = in6_pcbconnect(in6p, addr6, l);
    734 		splx(s);
    735 		if (error == 0)
    736 			soisconnected(so);
    737 		break;
    738 
    739 	case PRU_DISCONNECT:
    740 		if (IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr)) {
    741 			error = ENOTCONN;
    742 			break;
    743 		}
    744 		s = splsoftnet();
    745 		in6_pcbdisconnect(in6p);
    746 		memset((void *)&in6p->in6p_laddr, 0, sizeof(in6p->in6p_laddr));
    747 		splx(s);
    748 		so->so_state &= ~SS_ISCONNECTED;		/* XXX */
    749 		in6_pcbstate(in6p, IN6P_BOUND);		/* XXX */
    750 		break;
    751 
    752 	case PRU_SHUTDOWN:
    753 		socantsendmore(so);
    754 		break;
    755 
    756 	case PRU_SEND:
    757 		s = splsoftnet();
    758 		error = udp6_output(in6p, m, addr6, control, l);
    759 		splx(s);
    760 		return error;
    761 
    762 	case PRU_ABORT:
    763 		soisdisconnected(so);
    764 		in6_pcbdetach(in6p);
    765 		break;
    766 
    767 	case PRU_SOCKADDR:
    768 		in6_setsockaddr(in6p, addr6);
    769 		break;
    770 
    771 	case PRU_PEERADDR:
    772 		in6_setpeeraddr(in6p, addr6);
    773 		break;
    774 
    775 	case PRU_SENSE:
    776 		/*
    777 		 * stat: don't bother with a blocksize
    778 		 */
    779 		return 0;
    780 
    781 	case PRU_LISTEN:
    782 	case PRU_CONNECT2:
    783 	case PRU_ACCEPT:
    784 	case PRU_SENDOOB:
    785 	case PRU_FASTTIMO:
    786 	case PRU_SLOWTIMO:
    787 	case PRU_PROTORCV:
    788 	case PRU_PROTOSEND:
    789 		error = EOPNOTSUPP;
    790 		break;
    791 
    792 	case PRU_RCVD:
    793 	case PRU_RCVOOB:
    794 		return EOPNOTSUPP;	/* do not free mbuf's */
    795 
    796 	default:
    797 		panic("udp6_usrreq");
    798 	}
    799 
    800 release:
    801 	if (control != NULL)
    802 		m_freem(control);
    803 	if (m != NULL)
    804 		m_freem(m);
    805 	return error;
    806 }
    807 
    808 PR_WRAP_USRREQ(udp6_usrreq)
    809 
    810 #define	udp6_usrreq	udp6_usrreq_wrapper
    811 
    812 const struct pr_usrreqs udp6_usrreqs = {
    813 	.pr_attach	= udp6_attach,
    814 	.pr_detach	= udp6_detach,
    815 	.pr_generic	= udp6_usrreq,
    816 };
    817 
    818 static int
    819 sysctl_net_inet6_udp6_stats(SYSCTLFN_ARGS)
    820 {
    821 
    822 	return (NETSTAT_SYSCTL(udp6stat_percpu, UDP6_NSTATS));
    823 }
    824 
    825 static void
    826 sysctl_net_inet6_udp6_setup(struct sysctllog **clog)
    827 {
    828 
    829 	sysctl_createv(clog, 0, NULL, NULL,
    830 		       CTLFLAG_PERMANENT,
    831 		       CTLTYPE_NODE, "inet6", NULL,
    832 		       NULL, 0, NULL, 0,
    833 		       CTL_NET, PF_INET6, CTL_EOL);
    834 	sysctl_createv(clog, 0, NULL, NULL,
    835 		       CTLFLAG_PERMANENT,
    836 		       CTLTYPE_NODE, "udp6",
    837 		       SYSCTL_DESCR("UDPv6 related settings"),
    838 		       NULL, 0, NULL, 0,
    839 		       CTL_NET, PF_INET6, IPPROTO_UDP, CTL_EOL);
    840 
    841 	sysctl_createv(clog, 0, NULL, NULL,
    842 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
    843 		       CTLTYPE_INT, "sendspace",
    844 		       SYSCTL_DESCR("Default UDP send buffer size"),
    845 		       NULL, 0, &udp6_sendspace, 0,
    846 		       CTL_NET, PF_INET6, IPPROTO_UDP, UDP6CTL_SENDSPACE,
    847 		       CTL_EOL);
    848 	sysctl_createv(clog, 0, NULL, NULL,
    849 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
    850 		       CTLTYPE_INT, "recvspace",
    851 		       SYSCTL_DESCR("Default UDP receive buffer size"),
    852 		       NULL, 0, &udp6_recvspace, 0,
    853 		       CTL_NET, PF_INET6, IPPROTO_UDP, UDP6CTL_RECVSPACE,
    854 		       CTL_EOL);
    855 	sysctl_createv(clog, 0, NULL, NULL,
    856 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
    857 		       CTLTYPE_INT, "do_loopback_cksum",
    858 		       SYSCTL_DESCR("Perform UDP checksum on loopback"),
    859 		       NULL, 0, &udp_do_loopback_cksum, 0,
    860 		       CTL_NET, PF_INET6, IPPROTO_UDP, UDP6CTL_LOOPBACKCKSUM,
    861 		       CTL_EOL);
    862 	sysctl_createv(clog, 0, NULL, NULL,
    863 		       CTLFLAG_PERMANENT,
    864 		       CTLTYPE_STRUCT, "pcblist",
    865 		       SYSCTL_DESCR("UDP protocol control block list"),
    866 		       sysctl_inpcblist, 0, udbtable, 0,
    867 		       CTL_NET, PF_INET6, IPPROTO_UDP, CTL_CREATE,
    868 		       CTL_EOL);
    869 	sysctl_createv(clog, 0, NULL, NULL,
    870 		       CTLFLAG_PERMANENT,
    871 		       CTLTYPE_STRUCT, "stats",
    872 		       SYSCTL_DESCR("UDPv6 statistics"),
    873 		       sysctl_net_inet6_udp6_stats, 0, NULL, 0,
    874 		       CTL_NET, PF_INET6, IPPROTO_UDP, UDP6CTL_STATS,
    875 		       CTL_EOL);
    876 }
    877 
    878 void
    879 udp6_statinc(u_int stat)
    880 {
    881 
    882 	KASSERT(stat < UDP6_NSTATS);
    883 	UDP6_STATINC(stat);
    884 }
    885 
    886 PR_WRAP_USRREQ(udp6_usrreq)
    887 
    888 #define	udp6_usrreq	udp6_usrreq_wrapper
    889 
    890 const struct pr_usrreqs udp6_usrreqs = {
    891 	.pr_generic	= udp6_usrreq,
    892 };
    893