1 /*- 2 * Copyright (c) 1982, 1986, 1991, 1993, 1995 3 * The Regents of the University of California. 4 * Copyright (c) 2007-2008 Robert N. M. Watson 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 4. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 * 31 * @(#)in_pcb.c 8.4 (Berkeley) 5/24/95 32 */ 33 34 #include <sys/cdefs.h> 35 __FBSDID("$FreeBSD$"); 36 37 #include "opt_ddb.h" 38 #include "opt_inet.h" 39 #include "opt_ipsec.h" 40 #include "opt_inet6.h" 41 #include "opt_mac.h" 42 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/malloc.h> 46 #include <sys/mbuf.h> 47 #include <sys/domain.h> 48 #include <sys/protosw.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/priv.h> 52 #include <sys/proc.h> 53 #include <sys/jail.h> 54 #include <sys/kernel.h> 55 #include <sys/sysctl.h> 56 #include <sys/vimage.h> 57 58 #ifdef DDB 59 #include <ddb/ddb.h> 60 #endif 61 62 #include <vm/uma.h> 63 64 #include <net/if.h> 65 #include <net/if_types.h> 66 #include <net/route.h> 67 68 #include <netinet/in.h> 69 #include <netinet/in_pcb.h> 70 #include <netinet/in_var.h> 71 #include <netinet/ip_var.h> 72 #include <netinet/tcp_var.h> 73 #include <netinet/udp.h> 74 #include <netinet/udp_var.h> 75 #include <netinet/vinet.h> 76 #ifdef INET6 77 #include <netinet/ip6.h> 78 #include <netinet6/ip6_var.h> 79 #include <netinet6/vinet6.h> 80 #endif /* INET6 */ 81 82 83 #ifdef IPSEC 84 #include <netipsec/ipsec.h> 85 #include <netipsec/key.h> 86 #endif /* IPSEC */ 87 88 #include <security/mac/mac_framework.h> 89 90 #ifdef VIMAGE_GLOBALS 91 /* 92 * These configure the range of local port addresses assigned to 93 * "unspecified" outgoing connections/packets/whatever. 94 */ 95 int ipport_lowfirstauto; 96 int ipport_lowlastauto; 97 int ipport_firstauto; 98 int ipport_lastauto; 99 int ipport_hifirstauto; 100 int ipport_hilastauto; 101 102 /* 103 * Reserved ports accessible only to root. There are significant 104 * security considerations that must be accounted for when changing these, 105 * but the security benefits can be great. Please be careful. 106 */ 107 int ipport_reservedhigh; 108 int ipport_reservedlow; 109 110 /* Variables dealing with random ephemeral port allocation. */ 111 int ipport_randomized; 112 int ipport_randomcps; 113 int ipport_randomtime; 114 int ipport_stoprandom; 115 int ipport_tcpallocs; 116 int ipport_tcplastcount; 117 #endif 118 119 #define RANGECHK(var, min, max) \ 120 if ((var) < (min)) { (var) = (min); } \ 121 else if ((var) > (max)) { (var) = (max); } 122 123 static int 124 sysctl_net_ipport_check(SYSCTL_HANDLER_ARGS) 125 { 126 INIT_VNET_INET(curvnet); 127 int error; 128 129 error = sysctl_handle_int(oidp, oidp->oid_arg1, oidp->oid_arg2, req); 130 if (error == 0) { 131 RANGECHK(V_ipport_lowfirstauto, 1, IPPORT_RESERVED - 1); 132 RANGECHK(V_ipport_lowlastauto, 1, IPPORT_RESERVED - 1); 133 RANGECHK(V_ipport_firstauto, IPPORT_RESERVED, IPPORT_MAX); 134 RANGECHK(V_ipport_lastauto, IPPORT_RESERVED, IPPORT_MAX); 135 RANGECHK(V_ipport_hifirstauto, IPPORT_RESERVED, IPPORT_MAX); 136 RANGECHK(V_ipport_hilastauto, IPPORT_RESERVED, IPPORT_MAX); 137 } 138 return (error); 139 } 140 141 #undef RANGECHK 142 143 SYSCTL_NODE(_net_inet_ip, IPPROTO_IP, portrange, CTLFLAG_RW, 0, "IP Ports"); 144 145 SYSCTL_V_PROC(V_NET, vnet_inet, _net_inet_ip_portrange, OID_AUTO, 146 lowfirst, CTLTYPE_INT|CTLFLAG_RW, ipport_lowfirstauto, 0, 147 &sysctl_net_ipport_check, "I", ""); 148 SYSCTL_V_PROC(V_NET, vnet_inet, _net_inet_ip_portrange, OID_AUTO, 149 lowlast, CTLTYPE_INT|CTLFLAG_RW, ipport_lowlastauto, 0, 150 &sysctl_net_ipport_check, "I", ""); 151 SYSCTL_V_PROC(V_NET, vnet_inet, _net_inet_ip_portrange, OID_AUTO, 152 first, CTLTYPE_INT|CTLFLAG_RW, ipport_firstauto, 0, 153 &sysctl_net_ipport_check, "I", ""); 154 SYSCTL_V_PROC(V_NET, vnet_inet, _net_inet_ip_portrange, OID_AUTO, 155 last, CTLTYPE_INT|CTLFLAG_RW, ipport_lastauto, 0, 156 &sysctl_net_ipport_check, "I", ""); 157 SYSCTL_V_PROC(V_NET, vnet_inet, _net_inet_ip_portrange, OID_AUTO, 158 hifirst, CTLTYPE_INT|CTLFLAG_RW, ipport_hifirstauto, 0, 159 &sysctl_net_ipport_check, "I", ""); 160 SYSCTL_V_PROC(V_NET, vnet_inet, _net_inet_ip_portrange, OID_AUTO, 161 hilast, CTLTYPE_INT|CTLFLAG_RW, ipport_hilastauto, 0, 162 &sysctl_net_ipport_check, "I", ""); 163 SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_ip_portrange, OID_AUTO, 164 reservedhigh, CTLFLAG_RW|CTLFLAG_SECURE, ipport_reservedhigh, 0, ""); 165 SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_ip_portrange, OID_AUTO, reservedlow, 166 CTLFLAG_RW|CTLFLAG_SECURE, ipport_reservedlow, 0, ""); 167 SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_ip_portrange, OID_AUTO, randomized, 168 CTLFLAG_RW, ipport_randomized, 0, "Enable random port allocation"); 169 SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_ip_portrange, OID_AUTO, randomcps, 170 CTLFLAG_RW, ipport_randomcps, 0, "Maximum number of random port " 171 "allocations before switching to a sequental one"); 172 SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_ip_portrange, OID_AUTO, randomtime, 173 CTLFLAG_RW, ipport_randomtime, 0, 174 "Minimum time to keep sequental port " 175 "allocation before switching to a random one"); 176 177 /* 178 * in_pcb.c: manage the Protocol Control Blocks. 179 * 180 * NOTE: It is assumed that most of these functions will be called with 181 * the pcbinfo lock held, and often, the inpcb lock held, as these utility 182 * functions often modify hash chains or addresses in pcbs. 183 */ 184 185 /* 186 * Allocate a PCB and associate it with the socket. 187 * On success return with the PCB locked. 188 */ 189 int 190 in_pcballoc(struct socket *so, struct inpcbinfo *pcbinfo) 191 { 192 #ifdef INET6 193 INIT_VNET_INET6(curvnet); 194 #endif 195 struct inpcb *inp; 196 int error; 197 198 INP_INFO_WLOCK_ASSERT(pcbinfo); 199 error = 0; 200 inp = uma_zalloc(pcbinfo->ipi_zone, M_NOWAIT); 201 if (inp == NULL) 202 return (ENOBUFS); 203 bzero(inp, inp_zero_size); 204 inp->inp_pcbinfo = pcbinfo; 205 inp->inp_socket = so; 206 inp->inp_cred = crhold(so->so_cred); 207 inp->inp_inc.inc_fibnum = so->so_fibnum; 208 #ifdef MAC 209 error = mac_inpcb_init(inp, M_NOWAIT); 210 if (error != 0) 211 goto out; 212 SOCK_LOCK(so); 213 mac_inpcb_create(so, inp); 214 SOCK_UNLOCK(so); 215 #endif 216 #ifdef IPSEC 217 error = ipsec_init_policy(so, &inp->inp_sp); 218 if (error != 0) { 219 #ifdef MAC 220 mac_inpcb_destroy(inp); 221 #endif 222 goto out; 223 } 224 #endif /*IPSEC*/ 225 #ifdef INET6 226 if (INP_SOCKAF(so) == AF_INET6) { 227 inp->inp_vflag |= INP_IPV6PROTO; 228 if (V_ip6_v6only) 229 inp->inp_flags |= IN6P_IPV6_V6ONLY; 230 } 231 #endif 232 LIST_INSERT_HEAD(pcbinfo->ipi_listhead, inp, inp_list); 233 pcbinfo->ipi_count++; 234 so->so_pcb = (caddr_t)inp; 235 #ifdef INET6 236 if (V_ip6_auto_flowlabel) 237 inp->inp_flags |= IN6P_AUTOFLOWLABEL; 238 #endif 239 INP_WLOCK(inp); 240 inp->inp_gencnt = ++pcbinfo->ipi_gencnt; 241 inp->inp_refcount = 1; /* Reference from the inpcbinfo */ 242 #if defined(IPSEC) || defined(MAC) 243 out: 244 if (error != 0) { 245 crfree(inp->inp_cred); 246 uma_zfree(pcbinfo->ipi_zone, inp); 247 } 248 #endif 249 return (error); 250 } 251 252 int 253 in_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct ucred *cred) 254 { 255 int anonport, error; 256 257 INP_INFO_WLOCK_ASSERT(inp->inp_pcbinfo); 258 INP_WLOCK_ASSERT(inp); 259 260 if (inp->inp_lport != 0 || inp->inp_laddr.s_addr != INADDR_ANY) 261 return (EINVAL); 262 anonport = inp->inp_lport == 0 && (nam == NULL || 263 ((struct sockaddr_in *)nam)->sin_port == 0); 264 error = in_pcbbind_setup(inp, nam, &inp->inp_laddr.s_addr, 265 &inp->inp_lport, cred); 266 if (error) 267 return (error); 268 if (in_pcbinshash(inp) != 0) { 269 inp->inp_laddr.s_addr = INADDR_ANY; 270 inp->inp_lport = 0; 271 return (EAGAIN); 272 } 273 if (anonport) 274 inp->inp_flags |= INP_ANONPORT; 275 return (0); 276 } 277 278 /* 279 * Set up a bind operation on a PCB, performing port allocation 280 * as required, but do not actually modify the PCB. Callers can 281 * either complete the bind by setting inp_laddr/inp_lport and 282 * calling in_pcbinshash(), or they can just use the resulting 283 * port and address to authorise the sending of a once-off packet. 284 * 285 * On error, the values of *laddrp and *lportp are not changed. 286 */ 287 int 288 in_pcbbind_setup(struct inpcb *inp, struct sockaddr *nam, in_addr_t *laddrp, 289 u_short *lportp, struct ucred *cred) 290 { 291 INIT_VNET_INET(inp->inp_vnet); 292 struct socket *so = inp->inp_socket; 293 unsigned short *lastport; 294 struct sockaddr_in *sin; 295 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; 296 struct in_addr laddr; 297 u_short lport = 0; 298 int wild = 0, reuseport = (so->so_options & SO_REUSEPORT); 299 int error; 300 int dorandom; 301 302 /* 303 * Because no actual state changes occur here, a global write lock on 304 * the pcbinfo isn't required. 305 */ 306 INP_INFO_LOCK_ASSERT(pcbinfo); 307 INP_LOCK_ASSERT(inp); 308 309 if (TAILQ_EMPTY(&V_in_ifaddrhead)) /* XXX broken! */ 310 return (EADDRNOTAVAIL); 311 laddr.s_addr = *laddrp; 312 if (nam != NULL && laddr.s_addr != INADDR_ANY) 313 return (EINVAL); 314 if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0) 315 wild = INPLOOKUP_WILDCARD; 316 if (nam) { 317 sin = (struct sockaddr_in *)nam; 318 if (nam->sa_len != sizeof (*sin)) 319 return (EINVAL); 320 #ifdef notdef 321 /* 322 * We should check the family, but old programs 323 * incorrectly fail to initialize it. 324 */ 325 if (sin->sin_family != AF_INET) 326 return (EAFNOSUPPORT); 327 #endif 328 if (prison_local_ip4(cred, &sin->sin_addr)) 329 return (EINVAL); 330 if (sin->sin_port != *lportp) { 331 /* Don't allow the port to change. */ 332 if (*lportp != 0) 333 return (EINVAL); 334 lport = sin->sin_port; 335 } 336 /* NB: lport is left as 0 if the port isn't being changed. */ 337 if (IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) { 338 /* 339 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast; 340 * allow complete duplication of binding if 341 * SO_REUSEPORT is set, or if SO_REUSEADDR is set 342 * and a multicast address is bound on both 343 * new and duplicated sockets. 344 */ 345 if (so->so_options & SO_REUSEADDR) 346 reuseport = SO_REUSEADDR|SO_REUSEPORT; 347 } else if (sin->sin_addr.s_addr != INADDR_ANY) { 348 sin->sin_port = 0; /* yech... */ 349 bzero(&sin->sin_zero, sizeof(sin->sin_zero)); 350 /* 351 * Is the address a local IP address? 352 * If INP_NONLOCALOK is set, then the socket may be bound 353 * to any endpoint address, local or not. 354 */ 355 if ( 356 #if defined(IP_NONLOCALBIND) 357 ((inp->inp_flags & INP_NONLOCALOK) == 0) && 358 #endif 359 (ifa_ifwithaddr((struct sockaddr *)sin) == 0)) 360 return (EADDRNOTAVAIL); 361 } 362 laddr = sin->sin_addr; 363 if (lport) { 364 struct inpcb *t; 365 struct tcptw *tw; 366 367 /* GROSS */ 368 if (ntohs(lport) <= V_ipport_reservedhigh && 369 ntohs(lport) >= V_ipport_reservedlow && 370 priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 371 0)) 372 return (EACCES); 373 if (!IN_MULTICAST(ntohl(sin->sin_addr.s_addr)) && 374 priv_check_cred(inp->inp_cred, 375 PRIV_NETINET_REUSEPORT, 0) != 0) { 376 t = in_pcblookup_local(pcbinfo, sin->sin_addr, 377 lport, INPLOOKUP_WILDCARD, cred); 378 /* 379 * XXX 380 * This entire block sorely needs a rewrite. 381 */ 382 if (t && 383 ((t->inp_vflag & INP_TIMEWAIT) == 0) && 384 (so->so_type != SOCK_STREAM || 385 ntohl(t->inp_faddr.s_addr) == INADDR_ANY) && 386 (ntohl(sin->sin_addr.s_addr) != INADDR_ANY || 387 ntohl(t->inp_laddr.s_addr) != INADDR_ANY || 388 (t->inp_socket->so_options & 389 SO_REUSEPORT) == 0) && 390 (inp->inp_cred->cr_uid != 391 t->inp_cred->cr_uid)) 392 return (EADDRINUSE); 393 } 394 if (prison_local_ip4(cred, &sin->sin_addr)) 395 return (EADDRNOTAVAIL); 396 t = in_pcblookup_local(pcbinfo, sin->sin_addr, 397 lport, wild, cred); 398 if (t && (t->inp_vflag & INP_TIMEWAIT)) { 399 /* 400 * XXXRW: If an incpb has had its timewait 401 * state recycled, we treat the address as 402 * being in use (for now). This is better 403 * than a panic, but not desirable. 404 */ 405 tw = intotw(inp); 406 if (tw == NULL || 407 (reuseport & tw->tw_so_options) == 0) 408 return (EADDRINUSE); 409 } else if (t && 410 (reuseport & t->inp_socket->so_options) == 0) { 411 #ifdef INET6 412 if (ntohl(sin->sin_addr.s_addr) != 413 INADDR_ANY || 414 ntohl(t->inp_laddr.s_addr) != 415 INADDR_ANY || 416 INP_SOCKAF(so) == 417 INP_SOCKAF(t->inp_socket)) 418 #endif 419 return (EADDRINUSE); 420 } 421 } 422 } 423 if (*lportp != 0) 424 lport = *lportp; 425 if (lport == 0) { 426 u_short first, last, aux; 427 int count; 428 429 if (prison_local_ip4(cred, &laddr)) 430 return (EINVAL); 431 432 if (inp->inp_flags & INP_HIGHPORT) { 433 first = V_ipport_hifirstauto; /* sysctl */ 434 last = V_ipport_hilastauto; 435 lastport = &pcbinfo->ipi_lasthi; 436 } else if (inp->inp_flags & INP_LOWPORT) { 437 error = priv_check_cred(cred, 438 PRIV_NETINET_RESERVEDPORT, 0); 439 if (error) 440 return error; 441 first = V_ipport_lowfirstauto; /* 1023 */ 442 last = V_ipport_lowlastauto; /* 600 */ 443 lastport = &pcbinfo->ipi_lastlow; 444 } else { 445 first = V_ipport_firstauto; /* sysctl */ 446 last = V_ipport_lastauto; 447 lastport = &pcbinfo->ipi_lastport; 448 } 449 /* 450 * For UDP, use random port allocation as long as the user 451 * allows it. For TCP (and as of yet unknown) connections, 452 * use random port allocation only if the user allows it AND 453 * ipport_tick() allows it. 454 */ 455 if (V_ipport_randomized && 456 (!V_ipport_stoprandom || pcbinfo == &V_udbinfo)) 457 dorandom = 1; 458 else 459 dorandom = 0; 460 /* 461 * It makes no sense to do random port allocation if 462 * we have the only port available. 463 */ 464 if (first == last) 465 dorandom = 0; 466 /* Make sure to not include UDP packets in the count. */ 467 if (pcbinfo != &V_udbinfo) 468 V_ipport_tcpallocs++; 469 /* 470 * Instead of having two loops further down counting up or down 471 * make sure that first is always <= last and go with only one 472 * code path implementing all logic. 473 */ 474 if (first > last) { 475 aux = first; 476 first = last; 477 last = aux; 478 } 479 480 if (dorandom) 481 *lastport = first + 482 (arc4random() % (last - first)); 483 484 count = last - first; 485 486 do { 487 if (count-- < 0) /* completely used? */ 488 return (EADDRNOTAVAIL); 489 ++*lastport; 490 if (*lastport < first || *lastport > last) 491 *lastport = first; 492 lport = htons(*lastport); 493 } while (in_pcblookup_local(pcbinfo, laddr, 494 lport, wild, cred)); 495 } 496 if (prison_local_ip4(cred, &laddr)) 497 return (EINVAL); 498 *laddrp = laddr.s_addr; 499 *lportp = lport; 500 return (0); 501 } 502 503 /* 504 * Connect from a socket to a specified address. 505 * Both address and port must be specified in argument sin. 506 * If don't have a local address for this socket yet, 507 * then pick one. 508 */ 509 int 510 in_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct ucred *cred) 511 { 512 u_short lport, fport; 513 in_addr_t laddr, faddr; 514 int anonport, error; 515 516 INP_INFO_WLOCK_ASSERT(inp->inp_pcbinfo); 517 INP_WLOCK_ASSERT(inp); 518 519 lport = inp->inp_lport; 520 laddr = inp->inp_laddr.s_addr; 521 anonport = (lport == 0); 522 error = in_pcbconnect_setup(inp, nam, &laddr, &lport, &faddr, &fport, 523 NULL, cred); 524 if (error) 525 return (error); 526 527 /* Do the initial binding of the local address if required. */ 528 if (inp->inp_laddr.s_addr == INADDR_ANY && inp->inp_lport == 0) { 529 inp->inp_lport = lport; 530 inp->inp_laddr.s_addr = laddr; 531 if (in_pcbinshash(inp) != 0) { 532 inp->inp_laddr.s_addr = INADDR_ANY; 533 inp->inp_lport = 0; 534 return (EAGAIN); 535 } 536 } 537 538 /* Commit the remaining changes. */ 539 inp->inp_lport = lport; 540 inp->inp_laddr.s_addr = laddr; 541 inp->inp_faddr.s_addr = faddr; 542 inp->inp_fport = fport; 543 in_pcbrehash(inp); 544 545 if (anonport) 546 inp->inp_flags |= INP_ANONPORT; 547 return (0); 548 } 549 550 /* 551 * Do proper source address selection on an unbound socket in case 552 * of connect. Take jails into account as well. 553 */ 554 static int 555 in_pcbladdr(struct inpcb *inp, struct in_addr *faddr, struct in_addr *laddr, 556 struct ucred *cred) 557 { 558 struct in_ifaddr *ia; 559 struct ifaddr *ifa; 560 struct sockaddr *sa; 561 struct sockaddr_in *sin; 562 struct route sro; 563 int error; 564 565 KASSERT(laddr != NULL, ("%s: laddr NULL", __func__)); 566 567 error = 0; 568 ia = NULL; 569 bzero(&sro, sizeof(sro)); 570 571 sin = (struct sockaddr_in *)&sro.ro_dst; 572 sin->sin_family = AF_INET; 573 sin->sin_len = sizeof(struct sockaddr_in); 574 sin->sin_addr.s_addr = faddr->s_addr; 575 576 /* 577 * If route is known our src addr is taken from the i/f, 578 * else punt. 579 * 580 * Find out route to destination. 581 */ 582 if ((inp->inp_socket->so_options & SO_DONTROUTE) == 0) 583 in_rtalloc_ign(&sro, 0, inp->inp_inc.inc_fibnum); 584 585 /* 586 * If we found a route, use the address corresponding to 587 * the outgoing interface. 588 * 589 * Otherwise assume faddr is reachable on a directly connected 590 * network and try to find a corresponding interface to take 591 * the source address from. 592 */ 593 if (sro.ro_rt == NULL || sro.ro_rt->rt_ifp == NULL) { 594 struct ifnet *ifp; 595 596 ia = ifatoia(ifa_ifwithdstaddr((struct sockaddr *)sin)); 597 if (ia == NULL) 598 ia = ifatoia(ifa_ifwithnet((struct sockaddr *)sin)); 599 if (ia == NULL) { 600 error = ENETUNREACH; 601 goto done; 602 } 603 604 if (cred == NULL || !jailed(cred)) { 605 laddr->s_addr = ia->ia_addr.sin_addr.s_addr; 606 goto done; 607 } 608 609 ifp = ia->ia_ifp; 610 ia = NULL; 611 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 612 613 sa = ifa->ifa_addr; 614 if (sa->sa_family != AF_INET) 615 continue; 616 sin = (struct sockaddr_in *)sa; 617 if (prison_check_ip4(cred, &sin->sin_addr)) { 618 ia = (struct in_ifaddr *)ifa; 619 break; 620 } 621 } 622 if (ia != NULL) { 623 laddr->s_addr = ia->ia_addr.sin_addr.s_addr; 624 goto done; 625 } 626 627 /* 3. As a last resort return the 'default' jail address. */ 628 if (prison_getip4(cred, laddr) != 0) 629 error = EADDRNOTAVAIL; 630 goto done; 631 } 632 633 /* 634 * If the outgoing interface on the route found is not 635 * a loopback interface, use the address from that interface. 636 * In case of jails do those three steps: 637 * 1. check if the interface address belongs to the jail. If so use it. 638 * 2. check if we have any address on the outgoing interface 639 * belonging to this jail. If so use it. 640 * 3. as a last resort return the 'default' jail address. 641 */ 642 if ((sro.ro_rt->rt_ifp->if_flags & IFF_LOOPBACK) == 0) { 643 644 /* If not jailed, use the default returned. */ 645 if (cred == NULL || !jailed(cred)) { 646 ia = (struct in_ifaddr *)sro.ro_rt->rt_ifa; 647 laddr->s_addr = ia->ia_addr.sin_addr.s_addr; 648 goto done; 649 } 650 651 /* Jailed. */ 652 /* 1. Check if the iface address belongs to the jail. */ 653 sin = (struct sockaddr_in *)sro.ro_rt->rt_ifa->ifa_addr; 654 if (prison_check_ip4(cred, &sin->sin_addr)) { 655 ia = (struct in_ifaddr *)sro.ro_rt->rt_ifa; 656 laddr->s_addr = ia->ia_addr.sin_addr.s_addr; 657 goto done; 658 } 659 660 /* 661 * 2. Check if we have any address on the outgoing interface 662 * belonging to this jail. 663 */ 664 TAILQ_FOREACH(ifa, &sro.ro_rt->rt_ifp->if_addrhead, ifa_link) { 665 666 sa = ifa->ifa_addr; 667 if (sa->sa_family != AF_INET) 668 continue; 669 sin = (struct sockaddr_in *)sa; 670 if (prison_check_ip4(cred, &sin->sin_addr)) { 671 ia = (struct in_ifaddr *)ifa; 672 break; 673 } 674 } 675 if (ia != NULL) { 676 laddr->s_addr = ia->ia_addr.sin_addr.s_addr; 677 goto done; 678 } 679 680 /* 3. As a last resort return the 'default' jail address. */ 681 if (prison_getip4(cred, laddr) != 0) 682 error = EADDRNOTAVAIL; 683 goto done; 684 } 685 686 /* 687 * The outgoing interface is marked with 'loopback net', so a route 688 * to ourselves is here. 689 * Try to find the interface of the destination address and then 690 * take the address from there. That interface is not necessarily 691 * a loopback interface. 692 * In case of jails, check that it is an address of the jail 693 * and if we cannot find, fall back to the 'default' jail address. 694 */ 695 if ((sro.ro_rt->rt_ifp->if_flags & IFF_LOOPBACK) != 0) { 696 struct sockaddr_in sain; 697 698 bzero(&sain, sizeof(struct sockaddr_in)); 699 sain.sin_family = AF_INET; 700 sain.sin_len = sizeof(struct sockaddr_in); 701 sain.sin_addr.s_addr = faddr->s_addr; 702 703 ia = ifatoia(ifa_ifwithdstaddr(sintosa(&sain))); 704 if (ia == NULL) 705 ia = ifatoia(ifa_ifwithnet(sintosa(&sain))); 706 707 if (cred == NULL || !jailed(cred)) { 708 #if __FreeBSD_version < 800000 709 if (ia == NULL) 710 ia = (struct in_ifaddr *)sro.ro_rt->rt_ifa; 711 #endif 712 if (ia == NULL) { 713 error = ENETUNREACH; 714 goto done; 715 } 716 laddr->s_addr = ia->ia_addr.sin_addr.s_addr; 717 goto done; 718 } 719 720 /* Jailed. */ 721 if (ia != NULL) { 722 struct ifnet *ifp; 723 724 ifp = ia->ia_ifp; 725 ia = NULL; 726 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 727 728 sa = ifa->ifa_addr; 729 if (sa->sa_family != AF_INET) 730 continue; 731 sin = (struct sockaddr_in *)sa; 732 if (prison_check_ip4(cred, &sin->sin_addr)) { 733 ia = (struct in_ifaddr *)ifa; 734 break; 735 } 736 } 737 if (ia != NULL) { 738 laddr->s_addr = ia->ia_addr.sin_addr.s_addr; 739 goto done; 740 } 741 } 742 743 /* 3. As a last resort return the 'default' jail address. */ 744 if (prison_getip4(cred, laddr) != 0) 745 error = EADDRNOTAVAIL; 746 goto done; 747 } 748 749 done: 750 if (sro.ro_rt != NULL) 751 RTFREE(sro.ro_rt); 752 return (error); 753 } 754 755 /* 756 * Set up for a connect from a socket to the specified address. 757 * On entry, *laddrp and *lportp should contain the current local 758 * address and port for the PCB; these are updated to the values 759 * that should be placed in inp_laddr and inp_lport to complete 760 * the connect. 761 * 762 * On success, *faddrp and *fportp will be set to the remote address 763 * and port. These are not updated in the error case. 764 * 765 * If the operation fails because the connection already exists, 766 * *oinpp will be set to the PCB of that connection so that the 767 * caller can decide to override it. In all other cases, *oinpp 768 * is set to NULL. 769 */ 770 int 771 in_pcbconnect_setup(struct inpcb *inp, struct sockaddr *nam, 772 in_addr_t *laddrp, u_short *lportp, in_addr_t *faddrp, u_short *fportp, 773 struct inpcb **oinpp, struct ucred *cred) 774 { 775 INIT_VNET_INET(inp->inp_vnet); 776 struct sockaddr_in *sin = (struct sockaddr_in *)nam; 777 struct in_ifaddr *ia; 778 struct inpcb *oinp; 779 struct in_addr laddr, faddr, jailia; 780 u_short lport, fport; 781 int error; 782 783 /* 784 * Because a global state change doesn't actually occur here, a read 785 * lock is sufficient. 786 */ 787 INP_INFO_LOCK_ASSERT(inp->inp_pcbinfo); 788 INP_LOCK_ASSERT(inp); 789 790 if (oinpp != NULL) 791 *oinpp = NULL; 792 if (nam->sa_len != sizeof (*sin)) 793 return (EINVAL); 794 if (sin->sin_family != AF_INET) 795 return (EAFNOSUPPORT); 796 if (sin->sin_port == 0) 797 return (EADDRNOTAVAIL); 798 laddr.s_addr = *laddrp; 799 lport = *lportp; 800 faddr = sin->sin_addr; 801 fport = sin->sin_port; 802 803 if (!TAILQ_EMPTY(&V_in_ifaddrhead)) { 804 /* 805 * If the destination address is INADDR_ANY, 806 * use the primary local address. 807 * If the supplied address is INADDR_BROADCAST, 808 * and the primary interface supports broadcast, 809 * choose the broadcast address for that interface. 810 */ 811 if (faddr.s_addr == INADDR_ANY) { 812 if (cred != NULL && jailed(cred)) { 813 if (prison_getip4(cred, &jailia) != 0) 814 return (EADDRNOTAVAIL); 815 faddr.s_addr = jailia.s_addr; 816 } else { 817 faddr = 818 IA_SIN(TAILQ_FIRST(&V_in_ifaddrhead))-> 819 sin_addr; 820 } 821 } else if (faddr.s_addr == (u_long)INADDR_BROADCAST && 822 (TAILQ_FIRST(&V_in_ifaddrhead)->ia_ifp->if_flags & 823 IFF_BROADCAST)) 824 faddr = satosin(&TAILQ_FIRST( 825 &V_in_ifaddrhead)->ia_broadaddr)->sin_addr; 826 } 827 if (laddr.s_addr == INADDR_ANY) { 828 error = in_pcbladdr(inp, &faddr, &laddr, cred); 829 if (error) 830 return (error); 831 832 /* 833 * If the destination address is multicast and an outgoing 834 * interface has been set as a multicast option, use the 835 * address of that interface as our source address. 836 */ 837 if (IN_MULTICAST(ntohl(faddr.s_addr)) && 838 inp->inp_moptions != NULL) { 839 struct ip_moptions *imo; 840 struct ifnet *ifp; 841 842 imo = inp->inp_moptions; 843 if (imo->imo_multicast_ifp != NULL) { 844 ifp = imo->imo_multicast_ifp; 845 TAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) 846 if (ia->ia_ifp == ifp) 847 break; 848 if (ia == NULL) 849 return (EADDRNOTAVAIL); 850 laddr = ia->ia_addr.sin_addr; 851 } 852 } 853 } 854 855 oinp = in_pcblookup_hash(inp->inp_pcbinfo, faddr, fport, laddr, lport, 856 0, NULL); 857 if (oinp != NULL) { 858 if (oinpp != NULL) 859 *oinpp = oinp; 860 return (EADDRINUSE); 861 } 862 if (lport == 0) { 863 error = in_pcbbind_setup(inp, NULL, &laddr.s_addr, &lport, 864 cred); 865 if (error) 866 return (error); 867 } 868 *laddrp = laddr.s_addr; 869 *lportp = lport; 870 *faddrp = faddr.s_addr; 871 *fportp = fport; 872 return (0); 873 } 874 875 void 876 in_pcbdisconnect(struct inpcb *inp) 877 { 878 879 INP_INFO_WLOCK_ASSERT(inp->inp_pcbinfo); 880 INP_WLOCK_ASSERT(inp); 881 882 inp->inp_faddr.s_addr = INADDR_ANY; 883 inp->inp_fport = 0; 884 in_pcbrehash(inp); 885 } 886 887 /* 888 * in_pcbdetach() is responsibe for disassociating a socket from an inpcb. 889 * For most protocols, this will be invoked immediately prior to calling 890 * in_pcbfree(). However, with TCP the inpcb may significantly outlive the 891 * socket, in which case in_pcbfree() is deferred. 892 */ 893 void 894 in_pcbdetach(struct inpcb *inp) 895 { 896 897 KASSERT(inp->inp_socket != NULL, ("%s: inp_socket == NULL", __func__)); 898 899 inp->inp_socket->so_pcb = NULL; 900 inp->inp_socket = NULL; 901 } 902 903 /* 904 * in_pcbfree_internal() frees an inpcb that has been detached from its 905 * socket, and whose reference count has reached 0. It will also remove the 906 * inpcb from any global lists it might remain on. 907 */ 908 static void 909 in_pcbfree_internal(struct inpcb *inp) 910 { 911 struct inpcbinfo *ipi = inp->inp_pcbinfo; 912 913 KASSERT(inp->inp_socket == NULL, ("%s: inp_socket != NULL", __func__)); 914 KASSERT(inp->inp_refcount == 0, ("%s: refcount !0", __func__)); 915 916 INP_INFO_WLOCK_ASSERT(ipi); 917 INP_WLOCK_ASSERT(inp); 918 919 #ifdef IPSEC 920 if (inp->inp_sp != NULL) 921 ipsec_delete_pcbpolicy(inp); 922 #endif /* IPSEC */ 923 inp->inp_gencnt = ++ipi->ipi_gencnt; 924 in_pcbremlists(inp); 925 #ifdef INET6 926 if (inp->inp_vflag & INP_IPV6PROTO) { 927 ip6_freepcbopts(inp->in6p_outputopts); 928 ip6_freemoptions(inp->in6p_moptions); 929 } 930 #endif 931 if (inp->inp_options) 932 (void)m_free(inp->inp_options); 933 if (inp->inp_moptions != NULL) 934 inp_freemoptions(inp->inp_moptions); 935 inp->inp_vflag = 0; 936 crfree(inp->inp_cred); 937 938 #ifdef MAC 939 mac_inpcb_destroy(inp); 940 #endif 941 INP_WUNLOCK(inp); 942 uma_zfree(ipi->ipi_zone, inp); 943 } 944 945 /* 946 * in_pcbref() bumps the reference count on an inpcb in order to maintain 947 * stability of an inpcb pointer despite the inpcb lock being released. This 948 * is used in TCP when the inpcbinfo lock needs to be acquired or upgraded, 949 * but where the inpcb lock is already held. 950 * 951 * While the inpcb will not be freed, releasing the inpcb lock means that the 952 * connection's state may change, so the caller should be careful to 953 * revalidate any cached state on reacquiring the lock. Drop the reference 954 * using in_pcbrele(). 955 */ 956 void 957 in_pcbref(struct inpcb *inp) 958 { 959 960 INP_WLOCK_ASSERT(inp); 961 962 KASSERT(inp->inp_refcount > 0, ("%s: refcount 0", __func__)); 963 964 inp->inp_refcount++; 965 } 966 967 /* 968 * Drop a refcount on an inpcb elevated using in_pcbref(); because a call to 969 * in_pcbfree() may have been made between in_pcbref() and in_pcbrele(), we 970 * return a flag indicating whether or not the inpcb remains valid. If it is 971 * valid, we return with the inpcb lock held. 972 */ 973 int 974 in_pcbrele(struct inpcb *inp) 975 { 976 #ifdef INVARIANTS 977 struct inpcbinfo *ipi = inp->inp_pcbinfo; 978 #endif 979 980 KASSERT(inp->inp_refcount > 0, ("%s: refcount 0", __func__)); 981 982 INP_INFO_WLOCK_ASSERT(ipi); 983 INP_WLOCK_ASSERT(inp); 984 985 inp->inp_refcount--; 986 if (inp->inp_refcount > 0) 987 return (0); 988 in_pcbfree_internal(inp); 989 return (1); 990 } 991 992 /* 993 * Unconditionally schedule an inpcb to be freed by decrementing its 994 * reference count, which should occur only after the inpcb has been detached 995 * from its socket. If another thread holds a temporary reference (acquired 996 * using in_pcbref()) then the free is deferred until that reference is 997 * released using in_pcbrele(), but the inpcb is still unlocked. 998 */ 999 void 1000 in_pcbfree(struct inpcb *inp) 1001 { 1002 #ifdef INVARIANTS 1003 struct inpcbinfo *ipi = inp->inp_pcbinfo; 1004 #endif 1005 1006 KASSERT(inp->inp_socket == NULL, ("%s: inp_socket != NULL", 1007 __func__)); 1008 1009 INP_INFO_WLOCK_ASSERT(ipi); 1010 INP_WLOCK_ASSERT(inp); 1011 1012 if (!in_pcbrele(inp)) 1013 INP_WUNLOCK(inp); 1014 } 1015 1016 /* 1017 * in_pcbdrop() removes an inpcb from hashed lists, releasing its address and 1018 * port reservation, and preventing it from being returned by inpcb lookups. 1019 * 1020 * It is used by TCP to mark an inpcb as unused and avoid future packet 1021 * delivery or event notification when a socket remains open but TCP has 1022 * closed. This might occur as a result of a shutdown()-initiated TCP close 1023 * or a RST on the wire, and allows the port binding to be reused while still 1024 * maintaining the invariant that so_pcb always points to a valid inpcb until 1025 * in_pcbdetach(). 1026 * 1027 * XXXRW: An inp_lport of 0 is used to indicate that the inpcb is not on hash 1028 * lists, but can lead to confusing netstat output, as open sockets with 1029 * closed TCP connections will no longer appear to have their bound port 1030 * number. An explicit flag would be better, as it would allow us to leave 1031 * the port number intact after the connection is dropped. 1032 * 1033 * XXXRW: Possibly in_pcbdrop() should also prevent future notifications by 1034 * in_pcbnotifyall() and in_pcbpurgeif0()? 1035 */ 1036 void 1037 in_pcbdrop(struct inpcb *inp) 1038 { 1039 1040 INP_INFO_WLOCK_ASSERT(inp->inp_pcbinfo); 1041 INP_WLOCK_ASSERT(inp); 1042 1043 inp->inp_vflag |= INP_DROPPED; 1044 if (inp->inp_lport) { 1045 struct inpcbport *phd = inp->inp_phd; 1046 1047 LIST_REMOVE(inp, inp_hash); 1048 LIST_REMOVE(inp, inp_portlist); 1049 if (LIST_FIRST(&phd->phd_pcblist) == NULL) { 1050 LIST_REMOVE(phd, phd_hash); 1051 free(phd, M_PCB); 1052 } 1053 inp->inp_lport = 0; 1054 } 1055 } 1056 1057 /* 1058 * Common routines to return the socket addresses associated with inpcbs. 1059 */ 1060 struct sockaddr * 1061 in_sockaddr(in_port_t port, struct in_addr *addr_p) 1062 { 1063 struct sockaddr_in *sin; 1064 1065 sin = malloc(sizeof *sin, M_SONAME, 1066 M_WAITOK | M_ZERO); 1067 sin->sin_family = AF_INET; 1068 sin->sin_len = sizeof(*sin); 1069 sin->sin_addr = *addr_p; 1070 sin->sin_port = port; 1071 1072 return (struct sockaddr *)sin; 1073 } 1074 1075 int 1076 in_getsockaddr(struct socket *so, struct sockaddr **nam) 1077 { 1078 struct inpcb *inp; 1079 struct in_addr addr; 1080 in_port_t port; 1081 1082 inp = sotoinpcb(so); 1083 KASSERT(inp != NULL, ("in_getsockaddr: inp == NULL")); 1084 1085 INP_RLOCK(inp); 1086 port = inp->inp_lport; 1087 addr = inp->inp_laddr; 1088 INP_RUNLOCK(inp); 1089 1090 *nam = in_sockaddr(port, &addr); 1091 return 0; 1092 } 1093 1094 int 1095 in_getpeeraddr(struct socket *so, struct sockaddr **nam) 1096 { 1097 struct inpcb *inp; 1098 struct in_addr addr; 1099 in_port_t port; 1100 1101 inp = sotoinpcb(so); 1102 KASSERT(inp != NULL, ("in_getpeeraddr: inp == NULL")); 1103 1104 INP_RLOCK(inp); 1105 port = inp->inp_fport; 1106 addr = inp->inp_faddr; 1107 INP_RUNLOCK(inp); 1108 1109 *nam = in_sockaddr(port, &addr); 1110 return 0; 1111 } 1112 1113 void 1114 in_pcbnotifyall(struct inpcbinfo *pcbinfo, struct in_addr faddr, int errno, 1115 struct inpcb *(*notify)(struct inpcb *, int)) 1116 { 1117 struct inpcb *inp, *inp_temp; 1118 1119 INP_INFO_WLOCK(pcbinfo); 1120 LIST_FOREACH_SAFE(inp, pcbinfo->ipi_listhead, inp_list, inp_temp) { 1121 INP_WLOCK(inp); 1122 #ifdef INET6 1123 if ((inp->inp_vflag & INP_IPV4) == 0) { 1124 INP_WUNLOCK(inp); 1125 continue; 1126 } 1127 #endif 1128 if (inp->inp_faddr.s_addr != faddr.s_addr || 1129 inp->inp_socket == NULL) { 1130 INP_WUNLOCK(inp); 1131 continue; 1132 } 1133 if ((*notify)(inp, errno)) 1134 INP_WUNLOCK(inp); 1135 } 1136 INP_INFO_WUNLOCK(pcbinfo); 1137 } 1138 1139 void 1140 in_pcbpurgeif0(struct inpcbinfo *pcbinfo, struct ifnet *ifp) 1141 { 1142 struct inpcb *inp; 1143 struct ip_moptions *imo; 1144 int i, gap; 1145 1146 INP_INFO_RLOCK(pcbinfo); 1147 LIST_FOREACH(inp, pcbinfo->ipi_listhead, inp_list) { 1148 INP_WLOCK(inp); 1149 imo = inp->inp_moptions; 1150 if ((inp->inp_vflag & INP_IPV4) && 1151 imo != NULL) { 1152 /* 1153 * Unselect the outgoing interface if it is being 1154 * detached. 1155 */ 1156 if (imo->imo_multicast_ifp == ifp) 1157 imo->imo_multicast_ifp = NULL; 1158 1159 /* 1160 * Drop multicast group membership if we joined 1161 * through the interface being detached. 1162 */ 1163 for (i = 0, gap = 0; i < imo->imo_num_memberships; 1164 i++) { 1165 if (imo->imo_membership[i]->inm_ifp == ifp) { 1166 in_delmulti(imo->imo_membership[i]); 1167 gap++; 1168 } else if (gap != 0) 1169 imo->imo_membership[i - gap] = 1170 imo->imo_membership[i]; 1171 } 1172 imo->imo_num_memberships -= gap; 1173 } 1174 INP_WUNLOCK(inp); 1175 } 1176 INP_INFO_RUNLOCK(pcbinfo); 1177 } 1178 1179 /* 1180 * Lookup a PCB based on the local address and port. 1181 */ 1182 #define INP_LOOKUP_MAPPED_PCB_COST 3 1183 struct inpcb * 1184 in_pcblookup_local(struct inpcbinfo *pcbinfo, struct in_addr laddr, 1185 u_short lport, int wild_okay, struct ucred *cred) 1186 { 1187 struct inpcb *inp; 1188 #ifdef INET6 1189 int matchwild = 3 + INP_LOOKUP_MAPPED_PCB_COST; 1190 #else 1191 int matchwild = 3; 1192 #endif 1193 int wildcard; 1194 1195 INP_INFO_LOCK_ASSERT(pcbinfo); 1196 1197 if (!wild_okay) { 1198 struct inpcbhead *head; 1199 /* 1200 * Look for an unconnected (wildcard foreign addr) PCB that 1201 * matches the local address and port we're looking for. 1202 */ 1203 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 1204 0, pcbinfo->ipi_hashmask)]; 1205 LIST_FOREACH(inp, head, inp_hash) { 1206 #ifdef INET6 1207 /* XXX inp locking */ 1208 if ((inp->inp_vflag & INP_IPV4) == 0) 1209 continue; 1210 #endif 1211 if (inp->inp_faddr.s_addr == INADDR_ANY && 1212 inp->inp_laddr.s_addr == laddr.s_addr && 1213 inp->inp_lport == lport) { 1214 /* 1215 * Found? 1216 */ 1217 if (cred == NULL || 1218 inp->inp_cred->cr_prison == cred->cr_prison) 1219 return (inp); 1220 } 1221 } 1222 /* 1223 * Not found. 1224 */ 1225 return (NULL); 1226 } else { 1227 struct inpcbporthead *porthash; 1228 struct inpcbport *phd; 1229 struct inpcb *match = NULL; 1230 /* 1231 * Best fit PCB lookup. 1232 * 1233 * First see if this local port is in use by looking on the 1234 * port hash list. 1235 */ 1236 porthash = &pcbinfo->ipi_porthashbase[INP_PCBPORTHASH(lport, 1237 pcbinfo->ipi_porthashmask)]; 1238 LIST_FOREACH(phd, porthash, phd_hash) { 1239 if (phd->phd_port == lport) 1240 break; 1241 } 1242 if (phd != NULL) { 1243 /* 1244 * Port is in use by one or more PCBs. Look for best 1245 * fit. 1246 */ 1247 LIST_FOREACH(inp, &phd->phd_pcblist, inp_portlist) { 1248 wildcard = 0; 1249 if (cred != NULL && 1250 inp->inp_cred->cr_prison != cred->cr_prison) 1251 continue; 1252 #ifdef INET6 1253 /* XXX inp locking */ 1254 if ((inp->inp_vflag & INP_IPV4) == 0) 1255 continue; 1256 /* 1257 * We never select the PCB that has 1258 * INP_IPV6 flag and is bound to :: if 1259 * we have another PCB which is bound 1260 * to 0.0.0.0. If a PCB has the 1261 * INP_IPV6 flag, then we set its cost 1262 * higher than IPv4 only PCBs. 1263 * 1264 * Note that the case only happens 1265 * when a socket is bound to ::, under 1266 * the condition that the use of the 1267 * mapped address is allowed. 1268 */ 1269 if ((inp->inp_vflag & INP_IPV6) != 0) 1270 wildcard += INP_LOOKUP_MAPPED_PCB_COST; 1271 #endif 1272 if (inp->inp_faddr.s_addr != INADDR_ANY) 1273 wildcard++; 1274 if (inp->inp_laddr.s_addr != INADDR_ANY) { 1275 if (laddr.s_addr == INADDR_ANY) 1276 wildcard++; 1277 else if (inp->inp_laddr.s_addr != laddr.s_addr) 1278 continue; 1279 } else { 1280 if (laddr.s_addr != INADDR_ANY) 1281 wildcard++; 1282 } 1283 if (wildcard < matchwild) { 1284 match = inp; 1285 matchwild = wildcard; 1286 if (matchwild == 0) 1287 break; 1288 } 1289 } 1290 } 1291 return (match); 1292 } 1293 } 1294 #undef INP_LOOKUP_MAPPED_PCB_COST 1295 1296 /* 1297 * Lookup PCB in hash list. 1298 */ 1299 struct inpcb * 1300 in_pcblookup_hash(struct inpcbinfo *pcbinfo, struct in_addr faddr, 1301 u_int fport_arg, struct in_addr laddr, u_int lport_arg, int wildcard, 1302 struct ifnet *ifp) 1303 { 1304 struct inpcbhead *head; 1305 struct inpcb *inp, *tmpinp; 1306 u_short fport = fport_arg, lport = lport_arg; 1307 1308 INP_INFO_LOCK_ASSERT(pcbinfo); 1309 1310 /* 1311 * First look for an exact match. 1312 */ 1313 tmpinp = NULL; 1314 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr.s_addr, lport, fport, 1315 pcbinfo->ipi_hashmask)]; 1316 LIST_FOREACH(inp, head, inp_hash) { 1317 #ifdef INET6 1318 /* XXX inp locking */ 1319 if ((inp->inp_vflag & INP_IPV4) == 0) 1320 continue; 1321 #endif 1322 if (inp->inp_faddr.s_addr == faddr.s_addr && 1323 inp->inp_laddr.s_addr == laddr.s_addr && 1324 inp->inp_fport == fport && 1325 inp->inp_lport == lport) { 1326 /* 1327 * XXX We should be able to directly return 1328 * the inp here, without any checks. 1329 * Well unless both bound with SO_REUSEPORT? 1330 */ 1331 if (jailed(inp->inp_cred)) 1332 return (inp); 1333 if (tmpinp == NULL) 1334 tmpinp = inp; 1335 } 1336 } 1337 if (tmpinp != NULL) 1338 return (tmpinp); 1339 1340 /* 1341 * Then look for a wildcard match, if requested. 1342 */ 1343 if (wildcard == INPLOOKUP_WILDCARD) { 1344 struct inpcb *local_wild = NULL, *local_exact = NULL; 1345 #ifdef INET6 1346 struct inpcb *local_wild_mapped = NULL; 1347 #endif 1348 struct inpcb *jail_wild = NULL; 1349 int injail; 1350 1351 /* 1352 * Order of socket selection - we always prefer jails. 1353 * 1. jailed, non-wild. 1354 * 2. jailed, wild. 1355 * 3. non-jailed, non-wild. 1356 * 4. non-jailed, wild. 1357 */ 1358 1359 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 1360 0, pcbinfo->ipi_hashmask)]; 1361 LIST_FOREACH(inp, head, inp_hash) { 1362 #ifdef INET6 1363 /* XXX inp locking */ 1364 if ((inp->inp_vflag & INP_IPV4) == 0) 1365 continue; 1366 #endif 1367 if (inp->inp_faddr.s_addr != INADDR_ANY || 1368 inp->inp_lport != lport) 1369 continue; 1370 1371 /* XXX inp locking */ 1372 if (ifp && ifp->if_type == IFT_FAITH && 1373 (inp->inp_flags & INP_FAITH) == 0) 1374 continue; 1375 1376 injail = jailed(inp->inp_cred); 1377 if (injail) { 1378 if (!prison_check_ip4(inp->inp_cred, &laddr)) 1379 continue; 1380 } else { 1381 if (local_exact != NULL) 1382 continue; 1383 } 1384 1385 if (inp->inp_laddr.s_addr == laddr.s_addr) { 1386 if (injail) 1387 return (inp); 1388 else 1389 local_exact = inp; 1390 } else if (inp->inp_laddr.s_addr == INADDR_ANY) { 1391 #ifdef INET6 1392 /* XXX inp locking, NULL check */ 1393 if (inp->inp_vflag & INP_IPV6PROTO) 1394 local_wild_mapped = inp; 1395 else 1396 #endif /* INET6 */ 1397 if (injail) 1398 jail_wild = inp; 1399 else 1400 local_wild = inp; 1401 } 1402 } /* LIST_FOREACH */ 1403 if (jail_wild != NULL) 1404 return (jail_wild); 1405 if (local_exact != NULL) 1406 return (local_exact); 1407 if (local_wild != NULL) 1408 return (local_wild); 1409 #ifdef INET6 1410 if (local_wild_mapped != NULL) 1411 return (local_wild_mapped); 1412 #endif /* defined(INET6) */ 1413 } /* if (wildcard == INPLOOKUP_WILDCARD) */ 1414 1415 return (NULL); 1416 } 1417 1418 /* 1419 * Insert PCB onto various hash lists. 1420 */ 1421 int 1422 in_pcbinshash(struct inpcb *inp) 1423 { 1424 struct inpcbhead *pcbhash; 1425 struct inpcbporthead *pcbporthash; 1426 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; 1427 struct inpcbport *phd; 1428 u_int32_t hashkey_faddr; 1429 1430 INP_INFO_WLOCK_ASSERT(pcbinfo); 1431 INP_WLOCK_ASSERT(inp); 1432 1433 #ifdef INET6 1434 if (inp->inp_vflag & INP_IPV6) 1435 hashkey_faddr = inp->in6p_faddr.s6_addr32[3] /* XXX */; 1436 else 1437 #endif /* INET6 */ 1438 hashkey_faddr = inp->inp_faddr.s_addr; 1439 1440 pcbhash = &pcbinfo->ipi_hashbase[INP_PCBHASH(hashkey_faddr, 1441 inp->inp_lport, inp->inp_fport, pcbinfo->ipi_hashmask)]; 1442 1443 pcbporthash = &pcbinfo->ipi_porthashbase[ 1444 INP_PCBPORTHASH(inp->inp_lport, pcbinfo->ipi_porthashmask)]; 1445 1446 /* 1447 * Go through port list and look for a head for this lport. 1448 */ 1449 LIST_FOREACH(phd, pcbporthash, phd_hash) { 1450 if (phd->phd_port == inp->inp_lport) 1451 break; 1452 } 1453 /* 1454 * If none exists, malloc one and tack it on. 1455 */ 1456 if (phd == NULL) { 1457 phd = malloc(sizeof(struct inpcbport), M_PCB, M_NOWAIT); 1458 if (phd == NULL) { 1459 return (ENOBUFS); /* XXX */ 1460 } 1461 phd->phd_port = inp->inp_lport; 1462 LIST_INIT(&phd->phd_pcblist); 1463 LIST_INSERT_HEAD(pcbporthash, phd, phd_hash); 1464 } 1465 inp->inp_phd = phd; 1466 LIST_INSERT_HEAD(&phd->phd_pcblist, inp, inp_portlist); 1467 LIST_INSERT_HEAD(pcbhash, inp, inp_hash); 1468 return (0); 1469 } 1470 1471 /* 1472 * Move PCB to the proper hash bucket when { faddr, fport } have been 1473 * changed. NOTE: This does not handle the case of the lport changing (the 1474 * hashed port list would have to be updated as well), so the lport must 1475 * not change after in_pcbinshash() has been called. 1476 */ 1477 void 1478 in_pcbrehash(struct inpcb *inp) 1479 { 1480 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; 1481 struct inpcbhead *head; 1482 u_int32_t hashkey_faddr; 1483 1484 INP_INFO_WLOCK_ASSERT(pcbinfo); 1485 INP_WLOCK_ASSERT(inp); 1486 1487 #ifdef INET6 1488 if (inp->inp_vflag & INP_IPV6) 1489 hashkey_faddr = inp->in6p_faddr.s6_addr32[3] /* XXX */; 1490 else 1491 #endif /* INET6 */ 1492 hashkey_faddr = inp->inp_faddr.s_addr; 1493 1494 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(hashkey_faddr, 1495 inp->inp_lport, inp->inp_fport, pcbinfo->ipi_hashmask)]; 1496 1497 LIST_REMOVE(inp, inp_hash); 1498 LIST_INSERT_HEAD(head, inp, inp_hash); 1499 } 1500 1501 /* 1502 * Remove PCB from various lists. 1503 */ 1504 void 1505 in_pcbremlists(struct inpcb *inp) 1506 { 1507 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; 1508 1509 INP_INFO_WLOCK_ASSERT(pcbinfo); 1510 INP_WLOCK_ASSERT(inp); 1511 1512 inp->inp_gencnt = ++pcbinfo->ipi_gencnt; 1513 if (inp->inp_lport) { 1514 struct inpcbport *phd = inp->inp_phd; 1515 1516 LIST_REMOVE(inp, inp_hash); 1517 LIST_REMOVE(inp, inp_portlist); 1518 if (LIST_FIRST(&phd->phd_pcblist) == NULL) { 1519 LIST_REMOVE(phd, phd_hash); 1520 free(phd, M_PCB); 1521 } 1522 } 1523 LIST_REMOVE(inp, inp_list); 1524 pcbinfo->ipi_count--; 1525 } 1526 1527 /* 1528 * A set label operation has occurred at the socket layer, propagate the 1529 * label change into the in_pcb for the socket. 1530 */ 1531 void 1532 in_pcbsosetlabel(struct socket *so) 1533 { 1534 #ifdef MAC 1535 struct inpcb *inp; 1536 1537 inp = sotoinpcb(so); 1538 KASSERT(inp != NULL, ("in_pcbsosetlabel: so->so_pcb == NULL")); 1539 1540 INP_WLOCK(inp); 1541 SOCK_LOCK(so); 1542 mac_inpcb_sosetlabel(so, inp); 1543 SOCK_UNLOCK(so); 1544 INP_WUNLOCK(inp); 1545 #endif 1546 } 1547 1548 /* 1549 * ipport_tick runs once per second, determining if random port allocation 1550 * should be continued. If more than ipport_randomcps ports have been 1551 * allocated in the last second, then we return to sequential port 1552 * allocation. We return to random allocation only once we drop below 1553 * ipport_randomcps for at least ipport_randomtime seconds. 1554 */ 1555 void 1556 ipport_tick(void *xtp) 1557 { 1558 VNET_ITERATOR_DECL(vnet_iter); 1559 1560 VNET_LIST_RLOCK(); 1561 VNET_FOREACH(vnet_iter) { 1562 CURVNET_SET(vnet_iter); /* XXX appease INVARIANTS here */ 1563 INIT_VNET_INET(vnet_iter); 1564 if (V_ipport_tcpallocs <= 1565 V_ipport_tcplastcount + V_ipport_randomcps) { 1566 if (V_ipport_stoprandom > 0) 1567 V_ipport_stoprandom--; 1568 } else 1569 V_ipport_stoprandom = V_ipport_randomtime; 1570 V_ipport_tcplastcount = V_ipport_tcpallocs; 1571 CURVNET_RESTORE(); 1572 } 1573 VNET_LIST_RUNLOCK(); 1574 callout_reset(&ipport_tick_callout, hz, ipport_tick, NULL); 1575 } 1576 1577 void 1578 inp_wlock(struct inpcb *inp) 1579 { 1580 1581 INP_WLOCK(inp); 1582 } 1583 1584 void 1585 inp_wunlock(struct inpcb *inp) 1586 { 1587 1588 INP_WUNLOCK(inp); 1589 } 1590 1591 void 1592 inp_rlock(struct inpcb *inp) 1593 { 1594 1595 INP_RLOCK(inp); 1596 } 1597 1598 void 1599 inp_runlock(struct inpcb *inp) 1600 { 1601 1602 INP_RUNLOCK(inp); 1603 } 1604 1605 #ifdef INVARIANTS 1606 void 1607 inp_lock_assert(struct inpcb *inp) 1608 { 1609 1610 INP_WLOCK_ASSERT(inp); 1611 } 1612 1613 void 1614 inp_unlock_assert(struct inpcb *inp) 1615 { 1616 1617 INP_UNLOCK_ASSERT(inp); 1618 } 1619 #endif 1620 1621 void 1622 inp_apply_all(void (*func)(struct inpcb *, void *), void *arg) 1623 { 1624 INIT_VNET_INET(curvnet); 1625 struct inpcb *inp; 1626 1627 INP_INFO_RLOCK(&V_tcbinfo); 1628 LIST_FOREACH(inp, V_tcbinfo.ipi_listhead, inp_list) { 1629 INP_WLOCK(inp); 1630 func(inp, arg); 1631 INP_WUNLOCK(inp); 1632 } 1633 INP_INFO_RUNLOCK(&V_tcbinfo); 1634 } 1635 1636 struct socket * 1637 inp_inpcbtosocket(struct inpcb *inp) 1638 { 1639 1640 INP_WLOCK_ASSERT(inp); 1641 return (inp->inp_socket); 1642 } 1643 1644 struct tcpcb * 1645 inp_inpcbtotcpcb(struct inpcb *inp) 1646 { 1647 1648 INP_WLOCK_ASSERT(inp); 1649 return ((struct tcpcb *)inp->inp_ppcb); 1650 } 1651 1652 int 1653 inp_ip_tos_get(const struct inpcb *inp) 1654 { 1655 1656 return (inp->inp_ip_tos); 1657 } 1658 1659 void 1660 inp_ip_tos_set(struct inpcb *inp, int val) 1661 { 1662 1663 inp->inp_ip_tos = val; 1664 } 1665 1666 void 1667 inp_4tuple_get(struct inpcb *inp, uint32_t *laddr, uint16_t *lp, 1668 uint32_t *faddr, uint16_t *fp) 1669 { 1670 1671 INP_LOCK_ASSERT(inp); 1672 *laddr = inp->inp_laddr.s_addr; 1673 *faddr = inp->inp_faddr.s_addr; 1674 *lp = inp->inp_lport; 1675 *fp = inp->inp_fport; 1676 } 1677 1678 struct inpcb * 1679 so_sotoinpcb(struct socket *so) 1680 { 1681 1682 return (sotoinpcb(so)); 1683 } 1684 1685 struct tcpcb * 1686 so_sototcpcb(struct socket *so) 1687 { 1688 1689 return (sototcpcb(so)); 1690 } 1691 1692 #ifdef DDB 1693 static void 1694 db_print_indent(int indent) 1695 { 1696 int i; 1697 1698 for (i = 0; i < indent; i++) 1699 db_printf(" "); 1700 } 1701 1702 static void 1703 db_print_inconninfo(struct in_conninfo *inc, const char *name, int indent) 1704 { 1705 char faddr_str[48], laddr_str[48]; 1706 1707 db_print_indent(indent); 1708 db_printf("%s at %p\n", name, inc); 1709 1710 indent += 2; 1711 1712 #ifdef INET6 1713 if (inc->inc_flags & INC_ISIPV6) { 1714 /* IPv6. */ 1715 ip6_sprintf(laddr_str, &inc->inc6_laddr); 1716 ip6_sprintf(faddr_str, &inc->inc6_faddr); 1717 } else { 1718 #endif 1719 /* IPv4. */ 1720 inet_ntoa_r(inc->inc_laddr, laddr_str); 1721 inet_ntoa_r(inc->inc_faddr, faddr_str); 1722 #ifdef INET6 1723 } 1724 #endif 1725 db_print_indent(indent); 1726 db_printf("inc_laddr %s inc_lport %u\n", laddr_str, 1727 ntohs(inc->inc_lport)); 1728 db_print_indent(indent); 1729 db_printf("inc_faddr %s inc_fport %u\n", faddr_str, 1730 ntohs(inc->inc_fport)); 1731 } 1732 1733 static void 1734 db_print_inpflags(int inp_flags) 1735 { 1736 int comma; 1737 1738 comma = 0; 1739 if (inp_flags & INP_RECVOPTS) { 1740 db_printf("%sINP_RECVOPTS", comma ? ", " : ""); 1741 comma = 1; 1742 } 1743 if (inp_flags & INP_RECVRETOPTS) { 1744 db_printf("%sINP_RECVRETOPTS", comma ? ", " : ""); 1745 comma = 1; 1746 } 1747 if (inp_flags & INP_RECVDSTADDR) { 1748 db_printf("%sINP_RECVDSTADDR", comma ? ", " : ""); 1749 comma = 1; 1750 } 1751 if (inp_flags & INP_HDRINCL) { 1752 db_printf("%sINP_HDRINCL", comma ? ", " : ""); 1753 comma = 1; 1754 } 1755 if (inp_flags & INP_HIGHPORT) { 1756 db_printf("%sINP_HIGHPORT", comma ? ", " : ""); 1757 comma = 1; 1758 } 1759 if (inp_flags & INP_LOWPORT) { 1760 db_printf("%sINP_LOWPORT", comma ? ", " : ""); 1761 comma = 1; 1762 } 1763 if (inp_flags & INP_ANONPORT) { 1764 db_printf("%sINP_ANONPORT", comma ? ", " : ""); 1765 comma = 1; 1766 } 1767 if (inp_flags & INP_RECVIF) { 1768 db_printf("%sINP_RECVIF", comma ? ", " : ""); 1769 comma = 1; 1770 } 1771 if (inp_flags & INP_MTUDISC) { 1772 db_printf("%sINP_MTUDISC", comma ? ", " : ""); 1773 comma = 1; 1774 } 1775 if (inp_flags & INP_FAITH) { 1776 db_printf("%sINP_FAITH", comma ? ", " : ""); 1777 comma = 1; 1778 } 1779 if (inp_flags & INP_RECVTTL) { 1780 db_printf("%sINP_RECVTTL", comma ? ", " : ""); 1781 comma = 1; 1782 } 1783 if (inp_flags & INP_DONTFRAG) { 1784 db_printf("%sINP_DONTFRAG", comma ? ", " : ""); 1785 comma = 1; 1786 } 1787 if (inp_flags & IN6P_IPV6_V6ONLY) { 1788 db_printf("%sIN6P_IPV6_V6ONLY", comma ? ", " : ""); 1789 comma = 1; 1790 } 1791 if (inp_flags & IN6P_PKTINFO) { 1792 db_printf("%sIN6P_PKTINFO", comma ? ", " : ""); 1793 comma = 1; 1794 } 1795 if (inp_flags & IN6P_HOPLIMIT) { 1796 db_printf("%sIN6P_HOPLIMIT", comma ? ", " : ""); 1797 comma = 1; 1798 } 1799 if (inp_flags & IN6P_HOPOPTS) { 1800 db_printf("%sIN6P_HOPOPTS", comma ? ", " : ""); 1801 comma = 1; 1802 } 1803 if (inp_flags & IN6P_DSTOPTS) { 1804 db_printf("%sIN6P_DSTOPTS", comma ? ", " : ""); 1805 comma = 1; 1806 } 1807 if (inp_flags & IN6P_RTHDR) { 1808 db_printf("%sIN6P_RTHDR", comma ? ", " : ""); 1809 comma = 1; 1810 } 1811 if (inp_flags & IN6P_RTHDRDSTOPTS) { 1812 db_printf("%sIN6P_RTHDRDSTOPTS", comma ? ", " : ""); 1813 comma = 1; 1814 } 1815 if (inp_flags & IN6P_TCLASS) { 1816 db_printf("%sIN6P_TCLASS", comma ? ", " : ""); 1817 comma = 1; 1818 } 1819 if (inp_flags & IN6P_AUTOFLOWLABEL) { 1820 db_printf("%sIN6P_AUTOFLOWLABEL", comma ? ", " : ""); 1821 comma = 1; 1822 } 1823 if (inp_flags & IN6P_RFC2292) { 1824 db_printf("%sIN6P_RFC2292", comma ? ", " : ""); 1825 comma = 1; 1826 } 1827 if (inp_flags & IN6P_MTU) { 1828 db_printf("IN6P_MTU%s", comma ? ", " : ""); 1829 comma = 1; 1830 } 1831 } 1832 1833 static void 1834 db_print_inpvflag(u_char inp_vflag) 1835 { 1836 int comma; 1837 1838 comma = 0; 1839 if (inp_vflag & INP_IPV4) { 1840 db_printf("%sINP_IPV4", comma ? ", " : ""); 1841 comma = 1; 1842 } 1843 if (inp_vflag & INP_IPV6) { 1844 db_printf("%sINP_IPV6", comma ? ", " : ""); 1845 comma = 1; 1846 } 1847 if (inp_vflag & INP_IPV6PROTO) { 1848 db_printf("%sINP_IPV6PROTO", comma ? ", " : ""); 1849 comma = 1; 1850 } 1851 if (inp_vflag & INP_TIMEWAIT) { 1852 db_printf("%sINP_TIMEWAIT", comma ? ", " : ""); 1853 comma = 1; 1854 } 1855 if (inp_vflag & INP_ONESBCAST) { 1856 db_printf("%sINP_ONESBCAST", comma ? ", " : ""); 1857 comma = 1; 1858 } 1859 if (inp_vflag & INP_DROPPED) { 1860 db_printf("%sINP_DROPPED", comma ? ", " : ""); 1861 comma = 1; 1862 } 1863 if (inp_vflag & INP_SOCKREF) { 1864 db_printf("%sINP_SOCKREF", comma ? ", " : ""); 1865 comma = 1; 1866 } 1867 } 1868 1869 void 1870 db_print_inpcb(struct inpcb *inp, const char *name, int indent) 1871 { 1872 1873 db_print_indent(indent); 1874 db_printf("%s at %p\n", name, inp); 1875 1876 indent += 2; 1877 1878 db_print_indent(indent); 1879 db_printf("inp_flow: 0x%x\n", inp->inp_flow); 1880 1881 db_print_inconninfo(&inp->inp_inc, "inp_conninfo", indent); 1882 1883 db_print_indent(indent); 1884 db_printf("inp_ppcb: %p inp_pcbinfo: %p inp_socket: %p\n", 1885 inp->inp_ppcb, inp->inp_pcbinfo, inp->inp_socket); 1886 1887 db_print_indent(indent); 1888 db_printf("inp_label: %p inp_flags: 0x%x (", 1889 inp->inp_label, inp->inp_flags); 1890 db_print_inpflags(inp->inp_flags); 1891 db_printf(")\n"); 1892 1893 db_print_indent(indent); 1894 db_printf("inp_sp: %p inp_vflag: 0x%x (", inp->inp_sp, 1895 inp->inp_vflag); 1896 db_print_inpvflag(inp->inp_vflag); 1897 db_printf(")\n"); 1898 1899 db_print_indent(indent); 1900 db_printf("inp_ip_ttl: %d inp_ip_p: %d inp_ip_minttl: %d\n", 1901 inp->inp_ip_ttl, inp->inp_ip_p, inp->inp_ip_minttl); 1902 1903 db_print_indent(indent); 1904 #ifdef INET6 1905 if (inp->inp_vflag & INP_IPV6) { 1906 db_printf("in6p_options: %p in6p_outputopts: %p " 1907 "in6p_moptions: %p\n", inp->in6p_options, 1908 inp->in6p_outputopts, inp->in6p_moptions); 1909 db_printf("in6p_icmp6filt: %p in6p_cksum %d " 1910 "in6p_hops %u\n", inp->in6p_icmp6filt, inp->in6p_cksum, 1911 inp->in6p_hops); 1912 } else 1913 #endif 1914 { 1915 db_printf("inp_ip_tos: %d inp_ip_options: %p " 1916 "inp_ip_moptions: %p\n", inp->inp_ip_tos, 1917 inp->inp_options, inp->inp_moptions); 1918 } 1919 1920 db_print_indent(indent); 1921 db_printf("inp_phd: %p inp_gencnt: %ju\n", inp->inp_phd, 1922 (uintmax_t)inp->inp_gencnt); 1923 } 1924 1925 DB_SHOW_COMMAND(inpcb, db_show_inpcb) 1926 { 1927 struct inpcb *inp; 1928 1929 if (!have_addr) { 1930 db_printf("usage: show inpcb <addr>\n"); 1931 return; 1932 } 1933 inp = (struct inpcb *)addr; 1934 1935 db_print_inpcb(inp, "inpcb", 0); 1936 } 1937 #endif 1938