xref: /freebsd/sys/netinet/udp_usrreq.c (revision c6db8143eda5c775467145ac73e8ebec47afdd8f)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3  *	The Regents of the University of California.
4  * Copyright (c) 2008 Robert N. M. Watson
5  * Copyright (c) 2010-2011 Juniper Networks, Inc.
6  * Copyright (c) 2014 Kevin Lo
7  * All rights reserved.
8  *
9  * Portions of this software were developed by Robert N. M. Watson under
10  * contract to Juniper Networks, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 4. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)udp_usrreq.c	8.6 (Berkeley) 5/23/95
37  */
38 
39 #include <sys/cdefs.h>
40 __FBSDID("$FreeBSD$");
41 
42 #include "opt_ipfw.h"
43 #include "opt_inet.h"
44 #include "opt_inet6.h"
45 #include "opt_ipsec.h"
46 #include "opt_rss.h"
47 
48 #include <sys/param.h>
49 #include <sys/domain.h>
50 #include <sys/eventhandler.h>
51 #include <sys/jail.h>
52 #include <sys/kernel.h>
53 #include <sys/lock.h>
54 #include <sys/malloc.h>
55 #include <sys/mbuf.h>
56 #include <sys/priv.h>
57 #include <sys/proc.h>
58 #include <sys/protosw.h>
59 #include <sys/sdt.h>
60 #include <sys/signalvar.h>
61 #include <sys/socket.h>
62 #include <sys/socketvar.h>
63 #include <sys/sx.h>
64 #include <sys/sysctl.h>
65 #include <sys/syslog.h>
66 #include <sys/systm.h>
67 
68 #include <vm/uma.h>
69 
70 #include <net/if.h>
71 #include <net/if_var.h>
72 #include <net/route.h>
73 
74 #include <netinet/in.h>
75 #include <netinet/in_kdtrace.h>
76 #include <netinet/in_pcb.h>
77 #include <netinet/in_systm.h>
78 #include <netinet/in_var.h>
79 #include <netinet/ip.h>
80 #ifdef INET6
81 #include <netinet/ip6.h>
82 #endif
83 #include <netinet/ip_icmp.h>
84 #include <netinet/icmp_var.h>
85 #include <netinet/ip_var.h>
86 #include <netinet/ip_options.h>
87 #ifdef INET6
88 #include <netinet6/ip6_var.h>
89 #endif
90 #include <netinet/udp.h>
91 #include <netinet/udp_var.h>
92 #include <netinet/udplite.h>
93 #include <netinet/in_rss.h>
94 
95 #ifdef IPSEC
96 #include <netipsec/ipsec.h>
97 #include <netipsec/esp.h>
98 #endif
99 
100 #include <machine/in_cksum.h>
101 
102 #include <security/mac/mac_framework.h>
103 
104 /*
105  * UDP and UDP-Lite protocols implementation.
106  * Per RFC 768, August, 1980.
107  * Per RFC 3828, July, 2004.
108  */
109 
110 /*
111  * BSD 4.2 defaulted the udp checksum to be off.  Turning off udp checksums
112  * removes the only data integrity mechanism for packets and malformed
113  * packets that would otherwise be discarded due to bad checksums, and may
114  * cause problems (especially for NFS data blocks).
115  */
116 VNET_DEFINE(int, udp_cksum) = 1;
117 SYSCTL_INT(_net_inet_udp, UDPCTL_CHECKSUM, checksum, CTLFLAG_VNET | CTLFLAG_RW,
118     &VNET_NAME(udp_cksum), 0, "compute udp checksum");
119 
120 int	udp_log_in_vain = 0;
121 SYSCTL_INT(_net_inet_udp, OID_AUTO, log_in_vain, CTLFLAG_RW,
122     &udp_log_in_vain, 0, "Log all incoming UDP packets");
123 
124 VNET_DEFINE(int, udp_blackhole) = 0;
125 SYSCTL_INT(_net_inet_udp, OID_AUTO, blackhole, CTLFLAG_VNET | CTLFLAG_RW,
126     &VNET_NAME(udp_blackhole), 0,
127     "Do not send port unreachables for refused connects");
128 
129 u_long	udp_sendspace = 9216;		/* really max datagram size */
130 					/* 40 1K datagrams */
131 SYSCTL_ULONG(_net_inet_udp, UDPCTL_MAXDGRAM, maxdgram, CTLFLAG_RW,
132     &udp_sendspace, 0, "Maximum outgoing UDP datagram size");
133 
134 u_long	udp_recvspace = 40 * (1024 +
135 #ifdef INET6
136 				      sizeof(struct sockaddr_in6)
137 #else
138 				      sizeof(struct sockaddr_in)
139 #endif
140 				      );
141 
142 SYSCTL_ULONG(_net_inet_udp, UDPCTL_RECVSPACE, recvspace, CTLFLAG_RW,
143     &udp_recvspace, 0, "Maximum space for incoming UDP datagrams");
144 
145 VNET_DEFINE(struct inpcbhead, udb);		/* from udp_var.h */
146 VNET_DEFINE(struct inpcbinfo, udbinfo);
147 VNET_DEFINE(struct inpcbhead, ulitecb);
148 VNET_DEFINE(struct inpcbinfo, ulitecbinfo);
149 static VNET_DEFINE(uma_zone_t, udpcb_zone);
150 #define	V_udpcb_zone			VNET(udpcb_zone)
151 
152 #ifndef UDBHASHSIZE
153 #define	UDBHASHSIZE	128
154 #endif
155 
156 VNET_PCPUSTAT_DEFINE(struct udpstat, udpstat);		/* from udp_var.h */
157 VNET_PCPUSTAT_SYSINIT(udpstat);
158 SYSCTL_VNET_PCPUSTAT(_net_inet_udp, UDPCTL_STATS, stats, struct udpstat,
159     udpstat, "UDP statistics (struct udpstat, netinet/udp_var.h)");
160 
161 #ifdef VIMAGE
162 VNET_PCPUSTAT_SYSUNINIT(udpstat);
163 #endif /* VIMAGE */
164 #ifdef INET
165 static void	udp_detach(struct socket *so);
166 static int	udp_output(struct inpcb *, struct mbuf *, struct sockaddr *,
167 		    struct mbuf *, struct thread *);
168 #endif
169 
170 #ifdef IPSEC
171 #ifdef IPSEC_NAT_T
172 #define	UF_ESPINUDP_ALL	(UF_ESPINUDP_NON_IKE|UF_ESPINUDP)
173 #ifdef INET
174 static struct mbuf *udp4_espdecap(struct inpcb *, struct mbuf *, int);
175 #endif
176 #endif /* IPSEC_NAT_T */
177 #endif /* IPSEC */
178 
179 static void
180 udp_zone_change(void *tag)
181 {
182 
183 	uma_zone_set_max(V_udbinfo.ipi_zone, maxsockets);
184 	uma_zone_set_max(V_udpcb_zone, maxsockets);
185 }
186 
187 static int
188 udp_inpcb_init(void *mem, int size, int flags)
189 {
190 	struct inpcb *inp;
191 
192 	inp = mem;
193 	INP_LOCK_INIT(inp, "inp", "udpinp");
194 	return (0);
195 }
196 
197 static int
198 udplite_inpcb_init(void *mem, int size, int flags)
199 {
200 	struct inpcb *inp;
201 
202 	inp = mem;
203 	INP_LOCK_INIT(inp, "inp", "udpliteinp");
204 	return (0);
205 }
206 
207 void
208 udp_init(void)
209 {
210 
211 	/*
212 	 * For now default to 2-tuple UDP hashing - until the fragment
213 	 * reassembly code can also update the flowid.
214 	 *
215 	 * Once we can calculate the flowid that way and re-establish
216 	 * a 4-tuple, flip this to 4-tuple.
217 	 */
218 	in_pcbinfo_init(&V_udbinfo, "udp", &V_udb, UDBHASHSIZE, UDBHASHSIZE,
219 	    "udp_inpcb", udp_inpcb_init, NULL, UMA_ZONE_NOFREE,
220 	    IPI_HASHFIELDS_2TUPLE);
221 	V_udpcb_zone = uma_zcreate("udpcb", sizeof(struct udpcb),
222 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
223 	uma_zone_set_max(V_udpcb_zone, maxsockets);
224 	uma_zone_set_warning(V_udpcb_zone, "kern.ipc.maxsockets limit reached");
225 	EVENTHANDLER_REGISTER(maxsockets_change, udp_zone_change, NULL,
226 	    EVENTHANDLER_PRI_ANY);
227 }
228 
229 void
230 udplite_init(void)
231 {
232 
233 	in_pcbinfo_init(&V_ulitecbinfo, "udplite", &V_ulitecb, UDBHASHSIZE,
234 	    UDBHASHSIZE, "udplite_inpcb", udplite_inpcb_init, NULL,
235 	    UMA_ZONE_NOFREE, IPI_HASHFIELDS_2TUPLE);
236 }
237 
238 /*
239  * Kernel module interface for updating udpstat.  The argument is an index
240  * into udpstat treated as an array of u_long.  While this encodes the
241  * general layout of udpstat into the caller, it doesn't encode its location,
242  * so that future changes to add, for example, per-CPU stats support won't
243  * cause binary compatibility problems for kernel modules.
244  */
245 void
246 kmod_udpstat_inc(int statnum)
247 {
248 
249 	counter_u64_add(VNET(udpstat)[statnum], 1);
250 }
251 
252 int
253 udp_newudpcb(struct inpcb *inp)
254 {
255 	struct udpcb *up;
256 
257 	up = uma_zalloc(V_udpcb_zone, M_NOWAIT | M_ZERO);
258 	if (up == NULL)
259 		return (ENOBUFS);
260 	inp->inp_ppcb = up;
261 	return (0);
262 }
263 
264 void
265 udp_discardcb(struct udpcb *up)
266 {
267 
268 	uma_zfree(V_udpcb_zone, up);
269 }
270 
271 #ifdef VIMAGE
272 void
273 udp_destroy(void)
274 {
275 
276 	in_pcbinfo_destroy(&V_udbinfo);
277 	uma_zdestroy(V_udpcb_zone);
278 }
279 
280 void
281 udplite_destroy(void)
282 {
283 
284 	in_pcbinfo_destroy(&V_ulitecbinfo);
285 }
286 #endif
287 
288 #ifdef INET
289 /*
290  * Subroutine of udp_input(), which appends the provided mbuf chain to the
291  * passed pcb/socket.  The caller must provide a sockaddr_in via udp_in that
292  * contains the source address.  If the socket ends up being an IPv6 socket,
293  * udp_append() will convert to a sockaddr_in6 before passing the address
294  * into the socket code.
295  */
296 static void
297 udp_append(struct inpcb *inp, struct ip *ip, struct mbuf *n, int off,
298     struct sockaddr_in *udp_in)
299 {
300 	struct sockaddr *append_sa;
301 	struct socket *so;
302 	struct mbuf *opts = 0;
303 #ifdef INET6
304 	struct sockaddr_in6 udp_in6;
305 #endif
306 	struct udpcb *up;
307 
308 	INP_LOCK_ASSERT(inp);
309 
310 	/*
311 	 * Engage the tunneling protocol.
312 	 */
313 	up = intoudpcb(inp);
314 	if (up->u_tun_func != NULL) {
315 		(*up->u_tun_func)(n, off, inp, (struct sockaddr *)udp_in,
316 		    up->u_tun_ctx);
317 		return;
318 	}
319 
320 	off += sizeof(struct udphdr);
321 
322 #ifdef IPSEC
323 	/* Check AH/ESP integrity. */
324 	if (ipsec4_in_reject(n, inp)) {
325 		m_freem(n);
326 		IPSECSTAT_INC(ips_in_polvio);
327 		return;
328 	}
329 #ifdef IPSEC_NAT_T
330 	up = intoudpcb(inp);
331 	KASSERT(up != NULL, ("%s: udpcb NULL", __func__));
332 	if (up->u_flags & UF_ESPINUDP_ALL) {	/* IPSec UDP encaps. */
333 		n = udp4_espdecap(inp, n, off);
334 		if (n == NULL)				/* Consumed. */
335 			return;
336 	}
337 #endif /* IPSEC_NAT_T */
338 #endif /* IPSEC */
339 #ifdef MAC
340 	if (mac_inpcb_check_deliver(inp, n) != 0) {
341 		m_freem(n);
342 		return;
343 	}
344 #endif /* MAC */
345 	if (inp->inp_flags & INP_CONTROLOPTS ||
346 	    inp->inp_socket->so_options & (SO_TIMESTAMP | SO_BINTIME)) {
347 #ifdef INET6
348 		if (inp->inp_vflag & INP_IPV6)
349 			(void)ip6_savecontrol_v4(inp, n, &opts, NULL);
350 		else
351 #endif /* INET6 */
352 			ip_savecontrol(inp, &opts, ip, n);
353 	}
354 #ifdef INET6
355 	if (inp->inp_vflag & INP_IPV6) {
356 		bzero(&udp_in6, sizeof(udp_in6));
357 		udp_in6.sin6_len = sizeof(udp_in6);
358 		udp_in6.sin6_family = AF_INET6;
359 		in6_sin_2_v4mapsin6(udp_in, &udp_in6);
360 		append_sa = (struct sockaddr *)&udp_in6;
361 	} else
362 #endif /* INET6 */
363 		append_sa = (struct sockaddr *)udp_in;
364 	m_adj(n, off);
365 
366 	so = inp->inp_socket;
367 	SOCKBUF_LOCK(&so->so_rcv);
368 	if (sbappendaddr_locked(&so->so_rcv, append_sa, n, opts) == 0) {
369 		SOCKBUF_UNLOCK(&so->so_rcv);
370 		m_freem(n);
371 		if (opts)
372 			m_freem(opts);
373 		UDPSTAT_INC(udps_fullsock);
374 	} else
375 		sorwakeup_locked(so);
376 }
377 
378 int
379 udp_input(struct mbuf **mp, int *offp, int proto)
380 {
381 	struct ip *ip;
382 	struct udphdr *uh;
383 	struct ifnet *ifp;
384 	struct inpcb *inp;
385 	uint16_t len, ip_len;
386 	struct inpcbinfo *pcbinfo;
387 	struct ip save_ip;
388 	struct sockaddr_in udp_in;
389 	struct mbuf *m;
390 	struct m_tag *fwd_tag;
391 	int cscov_partial, iphlen;
392 
393 	m = *mp;
394 	iphlen = *offp;
395 	ifp = m->m_pkthdr.rcvif;
396 	*mp = NULL;
397 	UDPSTAT_INC(udps_ipackets);
398 
399 	/*
400 	 * Strip IP options, if any; should skip this, make available to
401 	 * user, and use on returned packets, but we don't yet have a way to
402 	 * check the checksum with options still present.
403 	 */
404 	if (iphlen > sizeof (struct ip)) {
405 		ip_stripoptions(m);
406 		iphlen = sizeof(struct ip);
407 	}
408 
409 	/*
410 	 * Get IP and UDP header together in first mbuf.
411 	 */
412 	ip = mtod(m, struct ip *);
413 	if (m->m_len < iphlen + sizeof(struct udphdr)) {
414 		if ((m = m_pullup(m, iphlen + sizeof(struct udphdr))) == NULL) {
415 			UDPSTAT_INC(udps_hdrops);
416 			return (IPPROTO_DONE);
417 		}
418 		ip = mtod(m, struct ip *);
419 	}
420 	uh = (struct udphdr *)((caddr_t)ip + iphlen);
421 	cscov_partial = (proto == IPPROTO_UDPLITE) ? 1 : 0;
422 
423 	/*
424 	 * Destination port of 0 is illegal, based on RFC768.
425 	 */
426 	if (uh->uh_dport == 0)
427 		goto badunlocked;
428 
429 	/*
430 	 * Construct sockaddr format source address.  Stuff source address
431 	 * and datagram in user buffer.
432 	 */
433 	bzero(&udp_in, sizeof(udp_in));
434 	udp_in.sin_len = sizeof(udp_in);
435 	udp_in.sin_family = AF_INET;
436 	udp_in.sin_port = uh->uh_sport;
437 	udp_in.sin_addr = ip->ip_src;
438 
439 	/*
440 	 * Make mbuf data length reflect UDP length.  If not enough data to
441 	 * reflect UDP length, drop.
442 	 */
443 	len = ntohs((u_short)uh->uh_ulen);
444 	ip_len = ntohs(ip->ip_len) - iphlen;
445 	if (proto == IPPROTO_UDPLITE && (len == 0 || len == ip_len)) {
446 		/* Zero means checksum over the complete packet. */
447 		if (len == 0)
448 			len = ip_len;
449 		cscov_partial = 0;
450 	}
451 	if (ip_len != len) {
452 		if (len > ip_len || len < sizeof(struct udphdr)) {
453 			UDPSTAT_INC(udps_badlen);
454 			goto badunlocked;
455 		}
456 		if (proto == IPPROTO_UDP)
457 			m_adj(m, len - ip_len);
458 	}
459 
460 	/*
461 	 * Save a copy of the IP header in case we want restore it for
462 	 * sending an ICMP error message in response.
463 	 */
464 	if (!V_udp_blackhole)
465 		save_ip = *ip;
466 	else
467 		memset(&save_ip, 0, sizeof(save_ip));
468 
469 	/*
470 	 * Checksum extended UDP header and data.
471 	 */
472 	if (uh->uh_sum) {
473 		u_short uh_sum;
474 
475 		if ((m->m_pkthdr.csum_flags & CSUM_DATA_VALID) &&
476 		    !cscov_partial) {
477 			if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
478 				uh_sum = m->m_pkthdr.csum_data;
479 			else
480 				uh_sum = in_pseudo(ip->ip_src.s_addr,
481 				    ip->ip_dst.s_addr, htonl((u_short)len +
482 				    m->m_pkthdr.csum_data + proto));
483 			uh_sum ^= 0xffff;
484 		} else {
485 			char b[9];
486 
487 			bcopy(((struct ipovly *)ip)->ih_x1, b, 9);
488 			bzero(((struct ipovly *)ip)->ih_x1, 9);
489 			((struct ipovly *)ip)->ih_len = (proto == IPPROTO_UDP) ?
490 			    uh->uh_ulen : htons(ip_len);
491 			uh_sum = in_cksum(m, len + sizeof (struct ip));
492 			bcopy(b, ((struct ipovly *)ip)->ih_x1, 9);
493 		}
494 		if (uh_sum) {
495 			UDPSTAT_INC(udps_badsum);
496 			m_freem(m);
497 			return (IPPROTO_DONE);
498 		}
499 	} else {
500 		if (proto == IPPROTO_UDP) {
501 			UDPSTAT_INC(udps_nosum);
502 		} else {
503 			/* UDPLite requires a checksum */
504 			/* XXX: What is the right UDPLite MIB counter here? */
505 			m_freem(m);
506 			return (IPPROTO_DONE);
507 		}
508 	}
509 
510 	pcbinfo = get_inpcbinfo(proto);
511 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
512 	    in_broadcast(ip->ip_dst, ifp)) {
513 		struct inpcb *last;
514 		struct inpcbhead *pcblist;
515 		struct ip_moptions *imo;
516 
517 		INP_INFO_RLOCK(pcbinfo);
518 		pcblist = get_pcblist(proto);
519 		last = NULL;
520 		LIST_FOREACH(inp, pcblist, inp_list) {
521 			if (inp->inp_lport != uh->uh_dport)
522 				continue;
523 #ifdef INET6
524 			if ((inp->inp_vflag & INP_IPV4) == 0)
525 				continue;
526 #endif
527 			if (inp->inp_laddr.s_addr != INADDR_ANY &&
528 			    inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
529 				continue;
530 			if (inp->inp_faddr.s_addr != INADDR_ANY &&
531 			    inp->inp_faddr.s_addr != ip->ip_src.s_addr)
532 				continue;
533 			if (inp->inp_fport != 0 &&
534 			    inp->inp_fport != uh->uh_sport)
535 				continue;
536 
537 			INP_RLOCK(inp);
538 
539 			/*
540 			 * XXXRW: Because we weren't holding either the inpcb
541 			 * or the hash lock when we checked for a match
542 			 * before, we should probably recheck now that the
543 			 * inpcb lock is held.
544 			 */
545 
546 			/*
547 			 * Handle socket delivery policy for any-source
548 			 * and source-specific multicast. [RFC3678]
549 			 */
550 			imo = inp->inp_moptions;
551 			if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
552 				struct sockaddr_in	 group;
553 				int			 blocked;
554 				if (imo == NULL) {
555 					INP_RUNLOCK(inp);
556 					continue;
557 				}
558 				bzero(&group, sizeof(struct sockaddr_in));
559 				group.sin_len = sizeof(struct sockaddr_in);
560 				group.sin_family = AF_INET;
561 				group.sin_addr = ip->ip_dst;
562 
563 				blocked = imo_multi_filter(imo, ifp,
564 					(struct sockaddr *)&group,
565 					(struct sockaddr *)&udp_in);
566 				if (blocked != MCAST_PASS) {
567 					if (blocked == MCAST_NOTGMEMBER)
568 						IPSTAT_INC(ips_notmember);
569 					if (blocked == MCAST_NOTSMEMBER ||
570 					    blocked == MCAST_MUTED)
571 						UDPSTAT_INC(udps_filtermcast);
572 					INP_RUNLOCK(inp);
573 					continue;
574 				}
575 			}
576 			if (last != NULL) {
577 				struct mbuf *n;
578 
579 				if ((n = m_copy(m, 0, M_COPYALL)) != NULL) {
580 					UDP_PROBE(receive, NULL, last, ip,
581 					    last, uh);
582 					udp_append(last, ip, n, iphlen,
583 					    &udp_in);
584 				}
585 				INP_RUNLOCK(last);
586 			}
587 			last = inp;
588 			/*
589 			 * Don't look for additional matches if this one does
590 			 * not have either the SO_REUSEPORT or SO_REUSEADDR
591 			 * socket options set.  This heuristic avoids
592 			 * searching through all pcbs in the common case of a
593 			 * non-shared port.  It assumes that an application
594 			 * will never clear these options after setting them.
595 			 */
596 			if ((last->inp_socket->so_options &
597 			    (SO_REUSEPORT|SO_REUSEADDR)) == 0)
598 				break;
599 		}
600 
601 		if (last == NULL) {
602 			/*
603 			 * No matching pcb found; discard datagram.  (No need
604 			 * to send an ICMP Port Unreachable for a broadcast
605 			 * or multicast datgram.)
606 			 */
607 			UDPSTAT_INC(udps_noportbcast);
608 			if (inp)
609 				INP_RUNLOCK(inp);
610 			INP_INFO_RUNLOCK(pcbinfo);
611 			goto badunlocked;
612 		}
613 		UDP_PROBE(receive, NULL, last, ip, last, uh);
614 		udp_append(last, ip, m, iphlen, &udp_in);
615 		INP_RUNLOCK(last);
616 		INP_INFO_RUNLOCK(pcbinfo);
617 		return (IPPROTO_DONE);
618 	}
619 
620 	/*
621 	 * Locate pcb for datagram.
622 	 */
623 
624 	/*
625 	 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
626 	 */
627 	if ((m->m_flags & M_IP_NEXTHOP) &&
628 	    (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
629 		struct sockaddr_in *next_hop;
630 
631 		next_hop = (struct sockaddr_in *)(fwd_tag + 1);
632 
633 		/*
634 		 * Transparently forwarded. Pretend to be the destination.
635 		 * Already got one like this?
636 		 */
637 		inp = in_pcblookup_mbuf(pcbinfo, ip->ip_src, uh->uh_sport,
638 		    ip->ip_dst, uh->uh_dport, INPLOOKUP_RLOCKPCB, ifp, m);
639 		if (!inp) {
640 			/*
641 			 * It's new.  Try to find the ambushing socket.
642 			 * Because we've rewritten the destination address,
643 			 * any hardware-generated hash is ignored.
644 			 */
645 			inp = in_pcblookup(pcbinfo, ip->ip_src,
646 			    uh->uh_sport, next_hop->sin_addr,
647 			    next_hop->sin_port ? htons(next_hop->sin_port) :
648 			    uh->uh_dport, INPLOOKUP_WILDCARD |
649 			    INPLOOKUP_RLOCKPCB, ifp);
650 		}
651 		/* Remove the tag from the packet. We don't need it anymore. */
652 		m_tag_delete(m, fwd_tag);
653 		m->m_flags &= ~M_IP_NEXTHOP;
654 	} else
655 		inp = in_pcblookup_mbuf(pcbinfo, ip->ip_src, uh->uh_sport,
656 		    ip->ip_dst, uh->uh_dport, INPLOOKUP_WILDCARD |
657 		    INPLOOKUP_RLOCKPCB, ifp, m);
658 	if (inp == NULL) {
659 		if (udp_log_in_vain) {
660 			char buf[4*sizeof "123"];
661 
662 			strcpy(buf, inet_ntoa(ip->ip_dst));
663 			log(LOG_INFO,
664 			    "Connection attempt to UDP %s:%d from %s:%d\n",
665 			    buf, ntohs(uh->uh_dport), inet_ntoa(ip->ip_src),
666 			    ntohs(uh->uh_sport));
667 		}
668 		UDPSTAT_INC(udps_noport);
669 		if (m->m_flags & (M_BCAST | M_MCAST)) {
670 			UDPSTAT_INC(udps_noportbcast);
671 			goto badunlocked;
672 		}
673 		if (V_udp_blackhole)
674 			goto badunlocked;
675 		if (badport_bandlim(BANDLIM_ICMP_UNREACH) < 0)
676 			goto badunlocked;
677 		*ip = save_ip;
678 		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
679 		return (IPPROTO_DONE);
680 	}
681 
682 	/*
683 	 * Check the minimum TTL for socket.
684 	 */
685 	INP_RLOCK_ASSERT(inp);
686 	if (inp->inp_ip_minttl && inp->inp_ip_minttl > ip->ip_ttl) {
687 		INP_RUNLOCK(inp);
688 		m_freem(m);
689 		return (IPPROTO_DONE);
690 	}
691 	if (cscov_partial) {
692 		struct udpcb *up;
693 
694 		up = intoudpcb(inp);
695 		if (up->u_rxcslen == 0 || up->u_rxcslen > len) {
696 			INP_RUNLOCK(inp);
697 			m_freem(m);
698 			return (IPPROTO_DONE);
699 		}
700 	}
701 
702 	UDP_PROBE(receive, NULL, inp, ip, inp, uh);
703 	udp_append(inp, ip, m, iphlen, &udp_in);
704 	INP_RUNLOCK(inp);
705 	return (IPPROTO_DONE);
706 
707 badunlocked:
708 	m_freem(m);
709 	return (IPPROTO_DONE);
710 }
711 #endif /* INET */
712 
713 /*
714  * Notify a udp user of an asynchronous error; just wake up so that they can
715  * collect error status.
716  */
717 struct inpcb *
718 udp_notify(struct inpcb *inp, int errno)
719 {
720 
721 	/*
722 	 * While udp_ctlinput() always calls udp_notify() with a read lock
723 	 * when invoking it directly, in_pcbnotifyall() currently uses write
724 	 * locks due to sharing code with TCP.  For now, accept either a read
725 	 * or a write lock, but a read lock is sufficient.
726 	 */
727 	INP_LOCK_ASSERT(inp);
728 
729 	inp->inp_socket->so_error = errno;
730 	sorwakeup(inp->inp_socket);
731 	sowwakeup(inp->inp_socket);
732 	return (inp);
733 }
734 
735 #ifdef INET
736 static void
737 udp_common_ctlinput(int cmd, struct sockaddr *sa, void *vip,
738     struct inpcbinfo *pcbinfo)
739 {
740 	struct ip *ip = vip;
741 	struct udphdr *uh;
742 	struct in_addr faddr;
743 	struct inpcb *inp;
744 
745 	faddr = ((struct sockaddr_in *)sa)->sin_addr;
746 	if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
747 		return;
748 
749 	/*
750 	 * Redirects don't need to be handled up here.
751 	 */
752 	if (PRC_IS_REDIRECT(cmd))
753 		return;
754 
755 	/*
756 	 * Hostdead is ugly because it goes linearly through all PCBs.
757 	 *
758 	 * XXX: We never get this from ICMP, otherwise it makes an excellent
759 	 * DoS attack on machines with many connections.
760 	 */
761 	if (cmd == PRC_HOSTDEAD)
762 		ip = NULL;
763 	else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0)
764 		return;
765 	if (ip != NULL) {
766 		uh = (struct udphdr *)((caddr_t)ip + (ip->ip_hl << 2));
767 		inp = in_pcblookup(pcbinfo, faddr, uh->uh_dport,
768 		    ip->ip_src, uh->uh_sport, INPLOOKUP_RLOCKPCB, NULL);
769 		if (inp != NULL) {
770 			INP_RLOCK_ASSERT(inp);
771 			if (inp->inp_socket != NULL) {
772 				udp_notify(inp, inetctlerrmap[cmd]);
773 			}
774 			INP_RUNLOCK(inp);
775 		}
776 	} else
777 		in_pcbnotifyall(pcbinfo, faddr, inetctlerrmap[cmd],
778 		    udp_notify);
779 }
780 void
781 udp_ctlinput(int cmd, struct sockaddr *sa, void *vip)
782 {
783 
784 	return (udp_common_ctlinput(cmd, sa, vip, &V_udbinfo));
785 }
786 
787 void
788 udplite_ctlinput(int cmd, struct sockaddr *sa, void *vip)
789 {
790 
791 	return (udp_common_ctlinput(cmd, sa, vip, &V_ulitecbinfo));
792 }
793 #endif /* INET */
794 
795 static int
796 udp_pcblist(SYSCTL_HANDLER_ARGS)
797 {
798 	int error, i, n;
799 	struct inpcb *inp, **inp_list;
800 	inp_gen_t gencnt;
801 	struct xinpgen xig;
802 
803 	/*
804 	 * The process of preparing the PCB list is too time-consuming and
805 	 * resource-intensive to repeat twice on every request.
806 	 */
807 	if (req->oldptr == 0) {
808 		n = V_udbinfo.ipi_count;
809 		n += imax(n / 8, 10);
810 		req->oldidx = 2 * (sizeof xig) + n * sizeof(struct xinpcb);
811 		return (0);
812 	}
813 
814 	if (req->newptr != 0)
815 		return (EPERM);
816 
817 	/*
818 	 * OK, now we're committed to doing something.
819 	 */
820 	INP_INFO_RLOCK(&V_udbinfo);
821 	gencnt = V_udbinfo.ipi_gencnt;
822 	n = V_udbinfo.ipi_count;
823 	INP_INFO_RUNLOCK(&V_udbinfo);
824 
825 	error = sysctl_wire_old_buffer(req, 2 * (sizeof xig)
826 		+ n * sizeof(struct xinpcb));
827 	if (error != 0)
828 		return (error);
829 
830 	xig.xig_len = sizeof xig;
831 	xig.xig_count = n;
832 	xig.xig_gen = gencnt;
833 	xig.xig_sogen = so_gencnt;
834 	error = SYSCTL_OUT(req, &xig, sizeof xig);
835 	if (error)
836 		return (error);
837 
838 	inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
839 	if (inp_list == 0)
840 		return (ENOMEM);
841 
842 	INP_INFO_RLOCK(&V_udbinfo);
843 	for (inp = LIST_FIRST(V_udbinfo.ipi_listhead), i = 0; inp && i < n;
844 	     inp = LIST_NEXT(inp, inp_list)) {
845 		INP_WLOCK(inp);
846 		if (inp->inp_gencnt <= gencnt &&
847 		    cr_canseeinpcb(req->td->td_ucred, inp) == 0) {
848 			in_pcbref(inp);
849 			inp_list[i++] = inp;
850 		}
851 		INP_WUNLOCK(inp);
852 	}
853 	INP_INFO_RUNLOCK(&V_udbinfo);
854 	n = i;
855 
856 	error = 0;
857 	for (i = 0; i < n; i++) {
858 		inp = inp_list[i];
859 		INP_RLOCK(inp);
860 		if (inp->inp_gencnt <= gencnt) {
861 			struct xinpcb xi;
862 
863 			bzero(&xi, sizeof(xi));
864 			xi.xi_len = sizeof xi;
865 			/* XXX should avoid extra copy */
866 			bcopy(inp, &xi.xi_inp, sizeof *inp);
867 			if (inp->inp_socket)
868 				sotoxsocket(inp->inp_socket, &xi.xi_socket);
869 			xi.xi_inp.inp_gencnt = inp->inp_gencnt;
870 			INP_RUNLOCK(inp);
871 			error = SYSCTL_OUT(req, &xi, sizeof xi);
872 		} else
873 			INP_RUNLOCK(inp);
874 	}
875 	INP_INFO_WLOCK(&V_udbinfo);
876 	for (i = 0; i < n; i++) {
877 		inp = inp_list[i];
878 		INP_RLOCK(inp);
879 		if (!in_pcbrele_rlocked(inp))
880 			INP_RUNLOCK(inp);
881 	}
882 	INP_INFO_WUNLOCK(&V_udbinfo);
883 
884 	if (!error) {
885 		/*
886 		 * Give the user an updated idea of our state.  If the
887 		 * generation differs from what we told her before, she knows
888 		 * that something happened while we were processing this
889 		 * request, and it might be necessary to retry.
890 		 */
891 		INP_INFO_RLOCK(&V_udbinfo);
892 		xig.xig_gen = V_udbinfo.ipi_gencnt;
893 		xig.xig_sogen = so_gencnt;
894 		xig.xig_count = V_udbinfo.ipi_count;
895 		INP_INFO_RUNLOCK(&V_udbinfo);
896 		error = SYSCTL_OUT(req, &xig, sizeof xig);
897 	}
898 	free(inp_list, M_TEMP);
899 	return (error);
900 }
901 
902 SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist,
903     CTLTYPE_OPAQUE | CTLFLAG_RD, NULL, 0,
904     udp_pcblist, "S,xinpcb", "List of active UDP sockets");
905 
906 #ifdef INET
907 static int
908 udp_getcred(SYSCTL_HANDLER_ARGS)
909 {
910 	struct xucred xuc;
911 	struct sockaddr_in addrs[2];
912 	struct inpcb *inp;
913 	int error;
914 
915 	error = priv_check(req->td, PRIV_NETINET_GETCRED);
916 	if (error)
917 		return (error);
918 	error = SYSCTL_IN(req, addrs, sizeof(addrs));
919 	if (error)
920 		return (error);
921 	inp = in_pcblookup(&V_udbinfo, addrs[1].sin_addr, addrs[1].sin_port,
922 	    addrs[0].sin_addr, addrs[0].sin_port,
923 	    INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB, NULL);
924 	if (inp != NULL) {
925 		INP_RLOCK_ASSERT(inp);
926 		if (inp->inp_socket == NULL)
927 			error = ENOENT;
928 		if (error == 0)
929 			error = cr_canseeinpcb(req->td->td_ucred, inp);
930 		if (error == 0)
931 			cru2x(inp->inp_cred, &xuc);
932 		INP_RUNLOCK(inp);
933 	} else
934 		error = ENOENT;
935 	if (error == 0)
936 		error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
937 	return (error);
938 }
939 
940 SYSCTL_PROC(_net_inet_udp, OID_AUTO, getcred,
941     CTLTYPE_OPAQUE|CTLFLAG_RW|CTLFLAG_PRISON, 0, 0,
942     udp_getcred, "S,xucred", "Get the xucred of a UDP connection");
943 #endif /* INET */
944 
945 int
946 udp_ctloutput(struct socket *so, struct sockopt *sopt)
947 {
948 	struct inpcb *inp;
949 	struct udpcb *up;
950 	int isudplite, error, optval;
951 
952 	error = 0;
953 	isudplite = (so->so_proto->pr_protocol == IPPROTO_UDPLITE) ? 1 : 0;
954 	inp = sotoinpcb(so);
955 	KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
956 	INP_WLOCK(inp);
957 	if (sopt->sopt_level != so->so_proto->pr_protocol) {
958 #ifdef INET6
959 		if (INP_CHECK_SOCKAF(so, AF_INET6)) {
960 			INP_WUNLOCK(inp);
961 			error = ip6_ctloutput(so, sopt);
962 		}
963 #endif
964 #if defined(INET) && defined(INET6)
965 		else
966 #endif
967 #ifdef INET
968 		{
969 			INP_WUNLOCK(inp);
970 			error = ip_ctloutput(so, sopt);
971 		}
972 #endif
973 		return (error);
974 	}
975 
976 	switch (sopt->sopt_dir) {
977 	case SOPT_SET:
978 		switch (sopt->sopt_name) {
979 		case UDP_ENCAP:
980 			INP_WUNLOCK(inp);
981 			error = sooptcopyin(sopt, &optval, sizeof optval,
982 					    sizeof optval);
983 			if (error)
984 				break;
985 			inp = sotoinpcb(so);
986 			KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
987 			INP_WLOCK(inp);
988 #ifdef IPSEC_NAT_T
989 			up = intoudpcb(inp);
990 			KASSERT(up != NULL, ("%s: up == NULL", __func__));
991 #endif
992 			switch (optval) {
993 			case 0:
994 				/* Clear all UDP encap. */
995 #ifdef IPSEC_NAT_T
996 				up->u_flags &= ~UF_ESPINUDP_ALL;
997 #endif
998 				break;
999 #ifdef IPSEC_NAT_T
1000 			case UDP_ENCAP_ESPINUDP:
1001 			case UDP_ENCAP_ESPINUDP_NON_IKE:
1002 				up->u_flags &= ~UF_ESPINUDP_ALL;
1003 				if (optval == UDP_ENCAP_ESPINUDP)
1004 					up->u_flags |= UF_ESPINUDP;
1005 				else if (optval == UDP_ENCAP_ESPINUDP_NON_IKE)
1006 					up->u_flags |= UF_ESPINUDP_NON_IKE;
1007 				break;
1008 #endif
1009 			default:
1010 				error = EINVAL;
1011 				break;
1012 			}
1013 			INP_WUNLOCK(inp);
1014 			break;
1015 		case UDPLITE_SEND_CSCOV:
1016 		case UDPLITE_RECV_CSCOV:
1017 			if (!isudplite) {
1018 				INP_WUNLOCK(inp);
1019 				error = ENOPROTOOPT;
1020 				break;
1021 			}
1022 			INP_WUNLOCK(inp);
1023 			error = sooptcopyin(sopt, &optval, sizeof(optval),
1024 			    sizeof(optval));
1025 			if (error != 0)
1026 				break;
1027 			inp = sotoinpcb(so);
1028 			KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
1029 			INP_WLOCK(inp);
1030 			up = intoudpcb(inp);
1031 			KASSERT(up != NULL, ("%s: up == NULL", __func__));
1032 			if ((optval != 0 && optval < 8) || (optval > 65535)) {
1033 				INP_WUNLOCK(inp);
1034 				error = EINVAL;
1035 				break;
1036 			}
1037 			if (sopt->sopt_name == UDPLITE_SEND_CSCOV)
1038 				up->u_txcslen = optval;
1039 			else
1040 				up->u_rxcslen = optval;
1041 			INP_WUNLOCK(inp);
1042 			break;
1043 		default:
1044 			INP_WUNLOCK(inp);
1045 			error = ENOPROTOOPT;
1046 			break;
1047 		}
1048 		break;
1049 	case SOPT_GET:
1050 		switch (sopt->sopt_name) {
1051 #ifdef IPSEC_NAT_T
1052 		case UDP_ENCAP:
1053 			up = intoudpcb(inp);
1054 			KASSERT(up != NULL, ("%s: up == NULL", __func__));
1055 			optval = up->u_flags & UF_ESPINUDP_ALL;
1056 			INP_WUNLOCK(inp);
1057 			error = sooptcopyout(sopt, &optval, sizeof optval);
1058 			break;
1059 #endif
1060 		case UDPLITE_SEND_CSCOV:
1061 		case UDPLITE_RECV_CSCOV:
1062 			if (!isudplite) {
1063 				INP_WUNLOCK(inp);
1064 				error = ENOPROTOOPT;
1065 				break;
1066 			}
1067 			up = intoudpcb(inp);
1068 			KASSERT(up != NULL, ("%s: up == NULL", __func__));
1069 			if (sopt->sopt_name == UDPLITE_SEND_CSCOV)
1070 				optval = up->u_txcslen;
1071 			else
1072 				optval = up->u_rxcslen;
1073 			INP_WUNLOCK(inp);
1074 			error = sooptcopyout(sopt, &optval, sizeof(optval));
1075 			break;
1076 		default:
1077 			INP_WUNLOCK(inp);
1078 			error = ENOPROTOOPT;
1079 			break;
1080 		}
1081 		break;
1082 	}
1083 	return (error);
1084 }
1085 
1086 #ifdef INET
1087 #define	UH_WLOCKED	2
1088 #define	UH_RLOCKED	1
1089 #define	UH_UNLOCKED	0
1090 static int
1091 udp_output(struct inpcb *inp, struct mbuf *m, struct sockaddr *addr,
1092     struct mbuf *control, struct thread *td)
1093 {
1094 	struct udpiphdr *ui;
1095 	int len = m->m_pkthdr.len;
1096 	struct in_addr faddr, laddr;
1097 	struct cmsghdr *cm;
1098 	struct inpcbinfo *pcbinfo;
1099 	struct sockaddr_in *sin, src;
1100 	int cscov_partial = 0;
1101 	int error = 0;
1102 	int ipflags;
1103 	u_short fport, lport;
1104 	int unlock_udbinfo;
1105 	u_char tos;
1106 	uint8_t pr;
1107 	uint16_t cscov = 0;
1108 	uint32_t flowid = 0;
1109 	int flowid_type = 0;
1110 	int use_flowid = 0;
1111 
1112 	/*
1113 	 * udp_output() may need to temporarily bind or connect the current
1114 	 * inpcb.  As such, we don't know up front whether we will need the
1115 	 * pcbinfo lock or not.  Do any work to decide what is needed up
1116 	 * front before acquiring any locks.
1117 	 */
1118 	if (len + sizeof(struct udpiphdr) > IP_MAXPACKET) {
1119 		if (control)
1120 			m_freem(control);
1121 		m_freem(m);
1122 		return (EMSGSIZE);
1123 	}
1124 
1125 	src.sin_family = 0;
1126 	INP_RLOCK(inp);
1127 	tos = inp->inp_ip_tos;
1128 	if (control != NULL) {
1129 		/*
1130 		 * XXX: Currently, we assume all the optional information is
1131 		 * stored in a single mbuf.
1132 		 */
1133 		if (control->m_next) {
1134 			INP_RUNLOCK(inp);
1135 			m_freem(control);
1136 			m_freem(m);
1137 			return (EINVAL);
1138 		}
1139 		for (; control->m_len > 0;
1140 		    control->m_data += CMSG_ALIGN(cm->cmsg_len),
1141 		    control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
1142 			cm = mtod(control, struct cmsghdr *);
1143 			if (control->m_len < sizeof(*cm) || cm->cmsg_len == 0
1144 			    || cm->cmsg_len > control->m_len) {
1145 				error = EINVAL;
1146 				break;
1147 			}
1148 			if (cm->cmsg_level != IPPROTO_IP)
1149 				continue;
1150 
1151 			switch (cm->cmsg_type) {
1152 			case IP_SENDSRCADDR:
1153 				if (cm->cmsg_len !=
1154 				    CMSG_LEN(sizeof(struct in_addr))) {
1155 					error = EINVAL;
1156 					break;
1157 				}
1158 				bzero(&src, sizeof(src));
1159 				src.sin_family = AF_INET;
1160 				src.sin_len = sizeof(src);
1161 				src.sin_port = inp->inp_lport;
1162 				src.sin_addr =
1163 				    *(struct in_addr *)CMSG_DATA(cm);
1164 				break;
1165 
1166 			case IP_TOS:
1167 				if (cm->cmsg_len != CMSG_LEN(sizeof(u_char))) {
1168 					error = EINVAL;
1169 					break;
1170 				}
1171 				tos = *(u_char *)CMSG_DATA(cm);
1172 				break;
1173 
1174 			case IP_FLOWID:
1175 				if (cm->cmsg_len != CMSG_LEN(sizeof(uint32_t))) {
1176 					error = EINVAL;
1177 					break;
1178 				}
1179 				flowid = *(uint32_t *) CMSG_DATA(cm);
1180 				break;
1181 
1182 			case IP_FLOWTYPE:
1183 				if (cm->cmsg_len != CMSG_LEN(sizeof(uint32_t))) {
1184 					error = EINVAL;
1185 					break;
1186 				}
1187 				flowid_type = *(uint32_t *) CMSG_DATA(cm);
1188 				use_flowid = 1;
1189 				break;
1190 
1191 #ifdef	RSS
1192 			case IP_RSSBUCKETID:
1193 				if (cm->cmsg_len != CMSG_LEN(sizeof(uint32_t))) {
1194 					error = EINVAL;
1195 					break;
1196 				}
1197 				/* This is just a placeholder for now */
1198 				break;
1199 #endif	/* RSS */
1200 			default:
1201 				error = ENOPROTOOPT;
1202 				break;
1203 			}
1204 			if (error)
1205 				break;
1206 		}
1207 		m_freem(control);
1208 	}
1209 	if (error) {
1210 		INP_RUNLOCK(inp);
1211 		m_freem(m);
1212 		return (error);
1213 	}
1214 
1215 	/*
1216 	 * Depending on whether or not the application has bound or connected
1217 	 * the socket, we may have to do varying levels of work.  The optimal
1218 	 * case is for a connected UDP socket, as a global lock isn't
1219 	 * required at all.
1220 	 *
1221 	 * In order to decide which we need, we require stability of the
1222 	 * inpcb binding, which we ensure by acquiring a read lock on the
1223 	 * inpcb.  This doesn't strictly follow the lock order, so we play
1224 	 * the trylock and retry game; note that we may end up with more
1225 	 * conservative locks than required the second time around, so later
1226 	 * assertions have to accept that.  Further analysis of the number of
1227 	 * misses under contention is required.
1228 	 *
1229 	 * XXXRW: Check that hash locking update here is correct.
1230 	 */
1231 	pr = inp->inp_socket->so_proto->pr_protocol;
1232 	pcbinfo = get_inpcbinfo(pr);
1233 	sin = (struct sockaddr_in *)addr;
1234 	if (sin != NULL &&
1235 	    (inp->inp_laddr.s_addr == INADDR_ANY && inp->inp_lport == 0)) {
1236 		INP_RUNLOCK(inp);
1237 		INP_WLOCK(inp);
1238 		INP_HASH_WLOCK(pcbinfo);
1239 		unlock_udbinfo = UH_WLOCKED;
1240 	} else if ((sin != NULL && (
1241 	    (sin->sin_addr.s_addr == INADDR_ANY) ||
1242 	    (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
1243 	    (inp->inp_laddr.s_addr == INADDR_ANY) ||
1244 	    (inp->inp_lport == 0))) ||
1245 	    (src.sin_family == AF_INET)) {
1246 		INP_HASH_RLOCK(pcbinfo);
1247 		unlock_udbinfo = UH_RLOCKED;
1248 	} else
1249 		unlock_udbinfo = UH_UNLOCKED;
1250 
1251 	/*
1252 	 * If the IP_SENDSRCADDR control message was specified, override the
1253 	 * source address for this datagram.  Its use is invalidated if the
1254 	 * address thus specified is incomplete or clobbers other inpcbs.
1255 	 */
1256 	laddr = inp->inp_laddr;
1257 	lport = inp->inp_lport;
1258 	if (src.sin_family == AF_INET) {
1259 		INP_HASH_LOCK_ASSERT(pcbinfo);
1260 		if ((lport == 0) ||
1261 		    (laddr.s_addr == INADDR_ANY &&
1262 		     src.sin_addr.s_addr == INADDR_ANY)) {
1263 			error = EINVAL;
1264 			goto release;
1265 		}
1266 		error = in_pcbbind_setup(inp, (struct sockaddr *)&src,
1267 		    &laddr.s_addr, &lport, td->td_ucred);
1268 		if (error)
1269 			goto release;
1270 	}
1271 
1272 	/*
1273 	 * If a UDP socket has been connected, then a local address/port will
1274 	 * have been selected and bound.
1275 	 *
1276 	 * If a UDP socket has not been connected to, then an explicit
1277 	 * destination address must be used, in which case a local
1278 	 * address/port may not have been selected and bound.
1279 	 */
1280 	if (sin != NULL) {
1281 		INP_LOCK_ASSERT(inp);
1282 		if (inp->inp_faddr.s_addr != INADDR_ANY) {
1283 			error = EISCONN;
1284 			goto release;
1285 		}
1286 
1287 		/*
1288 		 * Jail may rewrite the destination address, so let it do
1289 		 * that before we use it.
1290 		 */
1291 		error = prison_remote_ip4(td->td_ucred, &sin->sin_addr);
1292 		if (error)
1293 			goto release;
1294 
1295 		/*
1296 		 * If a local address or port hasn't yet been selected, or if
1297 		 * the destination address needs to be rewritten due to using
1298 		 * a special INADDR_ constant, invoke in_pcbconnect_setup()
1299 		 * to do the heavy lifting.  Once a port is selected, we
1300 		 * commit the binding back to the socket; we also commit the
1301 		 * binding of the address if in jail.
1302 		 *
1303 		 * If we already have a valid binding and we're not
1304 		 * requesting a destination address rewrite, use a fast path.
1305 		 */
1306 		if (inp->inp_laddr.s_addr == INADDR_ANY ||
1307 		    inp->inp_lport == 0 ||
1308 		    sin->sin_addr.s_addr == INADDR_ANY ||
1309 		    sin->sin_addr.s_addr == INADDR_BROADCAST) {
1310 			INP_HASH_LOCK_ASSERT(pcbinfo);
1311 			error = in_pcbconnect_setup(inp, addr, &laddr.s_addr,
1312 			    &lport, &faddr.s_addr, &fport, NULL,
1313 			    td->td_ucred);
1314 			if (error)
1315 				goto release;
1316 
1317 			/*
1318 			 * XXXRW: Why not commit the port if the address is
1319 			 * !INADDR_ANY?
1320 			 */
1321 			/* Commit the local port if newly assigned. */
1322 			if (inp->inp_laddr.s_addr == INADDR_ANY &&
1323 			    inp->inp_lport == 0) {
1324 				INP_WLOCK_ASSERT(inp);
1325 				INP_HASH_WLOCK_ASSERT(pcbinfo);
1326 				/*
1327 				 * Remember addr if jailed, to prevent
1328 				 * rebinding.
1329 				 */
1330 				if (prison_flag(td->td_ucred, PR_IP4))
1331 					inp->inp_laddr = laddr;
1332 				inp->inp_lport = lport;
1333 				if (in_pcbinshash(inp) != 0) {
1334 					inp->inp_lport = 0;
1335 					error = EAGAIN;
1336 					goto release;
1337 				}
1338 				inp->inp_flags |= INP_ANONPORT;
1339 			}
1340 		} else {
1341 			faddr = sin->sin_addr;
1342 			fport = sin->sin_port;
1343 		}
1344 	} else {
1345 		INP_LOCK_ASSERT(inp);
1346 		faddr = inp->inp_faddr;
1347 		fport = inp->inp_fport;
1348 		if (faddr.s_addr == INADDR_ANY) {
1349 			error = ENOTCONN;
1350 			goto release;
1351 		}
1352 	}
1353 
1354 	/*
1355 	 * Calculate data length and get a mbuf for UDP, IP, and possible
1356 	 * link-layer headers.  Immediate slide the data pointer back forward
1357 	 * since we won't use that space at this layer.
1358 	 */
1359 	M_PREPEND(m, sizeof(struct udpiphdr) + max_linkhdr, M_NOWAIT);
1360 	if (m == NULL) {
1361 		error = ENOBUFS;
1362 		goto release;
1363 	}
1364 	m->m_data += max_linkhdr;
1365 	m->m_len -= max_linkhdr;
1366 	m->m_pkthdr.len -= max_linkhdr;
1367 
1368 	/*
1369 	 * Fill in mbuf with extended UDP header and addresses and length put
1370 	 * into network format.
1371 	 */
1372 	ui = mtod(m, struct udpiphdr *);
1373 	bzero(ui->ui_x1, sizeof(ui->ui_x1));	/* XXX still needed? */
1374 	ui->ui_pr = pr;
1375 	ui->ui_src = laddr;
1376 	ui->ui_dst = faddr;
1377 	ui->ui_sport = lport;
1378 	ui->ui_dport = fport;
1379 	ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
1380 	if (pr == IPPROTO_UDPLITE) {
1381 		struct udpcb *up;
1382 		uint16_t plen;
1383 
1384 		up = intoudpcb(inp);
1385 		cscov = up->u_txcslen;
1386 		plen = (u_short)len + sizeof(struct udphdr);
1387 		if (cscov >= plen)
1388 			cscov = 0;
1389 		ui->ui_len = htons(plen);
1390 		ui->ui_ulen = htons(cscov);
1391 		/*
1392 		 * For UDP-Lite, checksum coverage length of zero means
1393 		 * the entire UDPLite packet is covered by the checksum.
1394 		 */
1395 		cscov_partial = (cscov == 0) ? 0 : 1;
1396 	} else
1397 		ui->ui_v = IPVERSION << 4;
1398 
1399 	/*
1400 	 * Set the Don't Fragment bit in the IP header.
1401 	 */
1402 	if (inp->inp_flags & INP_DONTFRAG) {
1403 		struct ip *ip;
1404 
1405 		ip = (struct ip *)&ui->ui_i;
1406 		ip->ip_off |= htons(IP_DF);
1407 	}
1408 
1409 	ipflags = 0;
1410 	if (inp->inp_socket->so_options & SO_DONTROUTE)
1411 		ipflags |= IP_ROUTETOIF;
1412 	if (inp->inp_socket->so_options & SO_BROADCAST)
1413 		ipflags |= IP_ALLOWBROADCAST;
1414 	if (inp->inp_flags & INP_ONESBCAST)
1415 		ipflags |= IP_SENDONES;
1416 
1417 #ifdef MAC
1418 	mac_inpcb_create_mbuf(inp, m);
1419 #endif
1420 
1421 	/*
1422 	 * Set up checksum and output datagram.
1423 	 */
1424 	ui->ui_sum = 0;
1425 	if (pr == IPPROTO_UDPLITE) {
1426 		if (inp->inp_flags & INP_ONESBCAST)
1427 			faddr.s_addr = INADDR_BROADCAST;
1428 		if (cscov_partial) {
1429 			if ((ui->ui_sum = in_cksum(m, sizeof(struct ip) + cscov)) == 0)
1430 				ui->ui_sum = 0xffff;
1431 		} else {
1432 			if ((ui->ui_sum = in_cksum(m, sizeof(struct udpiphdr) + len)) == 0)
1433 				ui->ui_sum = 0xffff;
1434 		}
1435 	} else if (V_udp_cksum) {
1436 		if (inp->inp_flags & INP_ONESBCAST)
1437 			faddr.s_addr = INADDR_BROADCAST;
1438 		ui->ui_sum = in_pseudo(ui->ui_src.s_addr, faddr.s_addr,
1439 		    htons((u_short)len + sizeof(struct udphdr) + pr));
1440 		m->m_pkthdr.csum_flags = CSUM_UDP;
1441 		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
1442 	}
1443 	((struct ip *)ui)->ip_len = htons(sizeof(struct udpiphdr) + len);
1444 	((struct ip *)ui)->ip_ttl = inp->inp_ip_ttl;	/* XXX */
1445 	((struct ip *)ui)->ip_tos = tos;		/* XXX */
1446 	UDPSTAT_INC(udps_opackets);
1447 
1448 	/*
1449 	 * Setup flowid / RSS information for outbound socket.
1450 	 *
1451 	 * Once the UDP code decides to set a flowid some other way,
1452 	 * this allows the flowid to be overridden by userland.
1453 	 */
1454 	if (use_flowid) {
1455 		m->m_flags |= M_FLOWID;
1456 		m->m_pkthdr.flowid = flowid;
1457 		M_HASHTYPE_SET(m, flowid_type);
1458 #ifdef	RSS
1459 	} else {
1460 		uint32_t hash_val, hash_type;
1461 		/*
1462 		 * Calculate an appropriate RSS hash for UDP and
1463 		 * UDP Lite.
1464 		 *
1465 		 * The called function will take care of figuring out
1466 		 * whether a 2-tuple or 4-tuple hash is required based
1467 		 * on the currently configured scheme.
1468 		 *
1469 		 * Later later on connected socket values should be
1470 		 * cached in the inpcb and reused, rather than constantly
1471 		 * re-calculating it.
1472 		 *
1473 		 * UDP Lite is a different protocol number and will
1474 		 * likely end up being hashed as a 2-tuple until
1475 		 * RSS / NICs grow UDP Lite protocol awareness.
1476 		 */
1477 		if (rss_proto_software_hash_v4(faddr, laddr, fport, lport,
1478 		    pr, &hash_val, &hash_type) == 0) {
1479 			m->m_pkthdr.flowid = hash_val;
1480 			m->m_flags |= M_FLOWID;
1481 			M_HASHTYPE_SET(m, hash_type);
1482 		}
1483 #endif
1484 	}
1485 
1486 #ifdef	RSS
1487 	/*
1488 	 * Don't override with the inp cached flowid value.
1489 	 *
1490 	 * Depending upon the kind of send being done, the inp
1491 	 * flowid/flowtype values may actually not be appropriate
1492 	 * for this particular socket send.
1493 	 *
1494 	 * We should either leave the flowid at zero (which is what is
1495 	 * currently done) or set it to some software generated
1496 	 * hash value based on the packet contents.
1497 	 */
1498 	ipflags |= IP_NODEFAULTFLOWID;
1499 #endif	/* RSS */
1500 
1501 	if (unlock_udbinfo == UH_WLOCKED)
1502 		INP_HASH_WUNLOCK(pcbinfo);
1503 	else if (unlock_udbinfo == UH_RLOCKED)
1504 		INP_HASH_RUNLOCK(pcbinfo);
1505 	UDP_PROBE(send, NULL, inp, &ui->ui_i, inp, &ui->ui_u);
1506 	error = ip_output(m, inp->inp_options, NULL, ipflags,
1507 	    inp->inp_moptions, inp);
1508 	if (unlock_udbinfo == UH_WLOCKED)
1509 		INP_WUNLOCK(inp);
1510 	else
1511 		INP_RUNLOCK(inp);
1512 	return (error);
1513 
1514 release:
1515 	if (unlock_udbinfo == UH_WLOCKED) {
1516 		INP_HASH_WUNLOCK(pcbinfo);
1517 		INP_WUNLOCK(inp);
1518 	} else if (unlock_udbinfo == UH_RLOCKED) {
1519 		INP_HASH_RUNLOCK(pcbinfo);
1520 		INP_RUNLOCK(inp);
1521 	} else
1522 		INP_RUNLOCK(inp);
1523 	m_freem(m);
1524 	return (error);
1525 }
1526 
1527 
1528 #if defined(IPSEC) && defined(IPSEC_NAT_T)
1529 /*
1530  * Potentially decap ESP in UDP frame.  Check for an ESP header
1531  * and optional marker; if present, strip the UDP header and
1532  * push the result through IPSec.
1533  *
1534  * Returns mbuf to be processed (potentially re-allocated) or
1535  * NULL if consumed and/or processed.
1536  */
1537 static struct mbuf *
1538 udp4_espdecap(struct inpcb *inp, struct mbuf *m, int off)
1539 {
1540 	size_t minlen, payload, skip, iphlen;
1541 	caddr_t data;
1542 	struct udpcb *up;
1543 	struct m_tag *tag;
1544 	struct udphdr *udphdr;
1545 	struct ip *ip;
1546 
1547 	INP_RLOCK_ASSERT(inp);
1548 
1549 	/*
1550 	 * Pull up data so the longest case is contiguous:
1551 	 *    IP/UDP hdr + non ESP marker + ESP hdr.
1552 	 */
1553 	minlen = off + sizeof(uint64_t) + sizeof(struct esp);
1554 	if (minlen > m->m_pkthdr.len)
1555 		minlen = m->m_pkthdr.len;
1556 	if ((m = m_pullup(m, minlen)) == NULL) {
1557 		IPSECSTAT_INC(ips_in_inval);
1558 		return (NULL);		/* Bypass caller processing. */
1559 	}
1560 	data = mtod(m, caddr_t);	/* Points to ip header. */
1561 	payload = m->m_len - off;	/* Size of payload. */
1562 
1563 	if (payload == 1 && data[off] == '\xff')
1564 		return (m);		/* NB: keepalive packet, no decap. */
1565 
1566 	up = intoudpcb(inp);
1567 	KASSERT(up != NULL, ("%s: udpcb NULL", __func__));
1568 	KASSERT((up->u_flags & UF_ESPINUDP_ALL) != 0,
1569 	    ("u_flags 0x%x", up->u_flags));
1570 
1571 	/*
1572 	 * Check that the payload is large enough to hold an
1573 	 * ESP header and compute the amount of data to remove.
1574 	 *
1575 	 * NB: the caller has already done a pullup for us.
1576 	 * XXX can we assume alignment and eliminate bcopys?
1577 	 */
1578 	if (up->u_flags & UF_ESPINUDP_NON_IKE) {
1579 		/*
1580 		 * draft-ietf-ipsec-nat-t-ike-0[01].txt and
1581 		 * draft-ietf-ipsec-udp-encaps-(00/)01.txt, ignoring
1582 		 * possible AH mode non-IKE marker+non-ESP marker
1583 		 * from draft-ietf-ipsec-udp-encaps-00.txt.
1584 		 */
1585 		uint64_t marker;
1586 
1587 		if (payload <= sizeof(uint64_t) + sizeof(struct esp))
1588 			return (m);	/* NB: no decap. */
1589 		bcopy(data + off, &marker, sizeof(uint64_t));
1590 		if (marker != 0)	/* Non-IKE marker. */
1591 			return (m);	/* NB: no decap. */
1592 		skip = sizeof(uint64_t) + sizeof(struct udphdr);
1593 	} else {
1594 		uint32_t spi;
1595 
1596 		if (payload <= sizeof(struct esp)) {
1597 			IPSECSTAT_INC(ips_in_inval);
1598 			m_freem(m);
1599 			return (NULL);	/* Discard. */
1600 		}
1601 		bcopy(data + off, &spi, sizeof(uint32_t));
1602 		if (spi == 0)		/* Non-ESP marker. */
1603 			return (m);	/* NB: no decap. */
1604 		skip = sizeof(struct udphdr);
1605 	}
1606 
1607 	/*
1608 	 * Setup a PACKET_TAG_IPSEC_NAT_T_PORT tag to remember
1609 	 * the UDP ports. This is required if we want to select
1610 	 * the right SPD for multiple hosts behind same NAT.
1611 	 *
1612 	 * NB: ports are maintained in network byte order everywhere
1613 	 *     in the NAT-T code.
1614 	 */
1615 	tag = m_tag_get(PACKET_TAG_IPSEC_NAT_T_PORTS,
1616 		2 * sizeof(uint16_t), M_NOWAIT);
1617 	if (tag == NULL) {
1618 		IPSECSTAT_INC(ips_in_nomem);
1619 		m_freem(m);
1620 		return (NULL);		/* Discard. */
1621 	}
1622 	iphlen = off - sizeof(struct udphdr);
1623 	udphdr = (struct udphdr *)(data + iphlen);
1624 	((uint16_t *)(tag + 1))[0] = udphdr->uh_sport;
1625 	((uint16_t *)(tag + 1))[1] = udphdr->uh_dport;
1626 	m_tag_prepend(m, tag);
1627 
1628 	/*
1629 	 * Remove the UDP header (and possibly the non ESP marker)
1630 	 * IP header length is iphlen
1631 	 * Before:
1632 	 *   <--- off --->
1633 	 *   +----+------+-----+
1634 	 *   | IP |  UDP | ESP |
1635 	 *   +----+------+-----+
1636 	 *        <-skip->
1637 	 * After:
1638 	 *          +----+-----+
1639 	 *          | IP | ESP |
1640 	 *          +----+-----+
1641 	 *   <-skip->
1642 	 */
1643 	ovbcopy(data, data + skip, iphlen);
1644 	m_adj(m, skip);
1645 
1646 	ip = mtod(m, struct ip *);
1647 	ip->ip_len = htons(ntohs(ip->ip_len) - skip);
1648 	ip->ip_p = IPPROTO_ESP;
1649 
1650 	/*
1651 	 * We cannot yet update the cksums so clear any
1652 	 * h/w cksum flags as they are no longer valid.
1653 	 */
1654 	if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)
1655 		m->m_pkthdr.csum_flags &= ~(CSUM_DATA_VALID|CSUM_PSEUDO_HDR);
1656 
1657 	(void) ipsec4_common_input(m, iphlen, ip->ip_p);
1658 	return (NULL);			/* NB: consumed, bypass processing. */
1659 }
1660 #endif /* defined(IPSEC) && defined(IPSEC_NAT_T) */
1661 
1662 static void
1663 udp_abort(struct socket *so)
1664 {
1665 	struct inpcb *inp;
1666 	struct inpcbinfo *pcbinfo;
1667 
1668 	pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1669 	inp = sotoinpcb(so);
1670 	KASSERT(inp != NULL, ("udp_abort: inp == NULL"));
1671 	INP_WLOCK(inp);
1672 	if (inp->inp_faddr.s_addr != INADDR_ANY) {
1673 		INP_HASH_WLOCK(pcbinfo);
1674 		in_pcbdisconnect(inp);
1675 		inp->inp_laddr.s_addr = INADDR_ANY;
1676 		INP_HASH_WUNLOCK(pcbinfo);
1677 		soisdisconnected(so);
1678 	}
1679 	INP_WUNLOCK(inp);
1680 }
1681 
1682 static int
1683 udp_attach(struct socket *so, int proto, struct thread *td)
1684 {
1685 	struct inpcb *inp;
1686 	struct inpcbinfo *pcbinfo;
1687 	int error;
1688 
1689 	pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1690 	inp = sotoinpcb(so);
1691 	KASSERT(inp == NULL, ("udp_attach: inp != NULL"));
1692 	error = soreserve(so, udp_sendspace, udp_recvspace);
1693 	if (error)
1694 		return (error);
1695 	INP_INFO_WLOCK(pcbinfo);
1696 	error = in_pcballoc(so, pcbinfo);
1697 	if (error) {
1698 		INP_INFO_WUNLOCK(pcbinfo);
1699 		return (error);
1700 	}
1701 
1702 	inp = sotoinpcb(so);
1703 	inp->inp_vflag |= INP_IPV4;
1704 	inp->inp_ip_ttl = V_ip_defttl;
1705 
1706 	error = udp_newudpcb(inp);
1707 	if (error) {
1708 		in_pcbdetach(inp);
1709 		in_pcbfree(inp);
1710 		INP_INFO_WUNLOCK(pcbinfo);
1711 		return (error);
1712 	}
1713 
1714 	INP_WUNLOCK(inp);
1715 	INP_INFO_WUNLOCK(pcbinfo);
1716 	return (0);
1717 }
1718 #endif /* INET */
1719 
1720 int
1721 udp_set_kernel_tunneling(struct socket *so, udp_tun_func_t f, void *ctx)
1722 {
1723 	struct inpcb *inp;
1724 	struct udpcb *up;
1725 
1726 	KASSERT(so->so_type == SOCK_DGRAM,
1727 	    ("udp_set_kernel_tunneling: !dgram"));
1728 	inp = sotoinpcb(so);
1729 	KASSERT(inp != NULL, ("udp_set_kernel_tunneling: inp == NULL"));
1730 	INP_WLOCK(inp);
1731 	up = intoudpcb(inp);
1732 	if (up->u_tun_func != NULL) {
1733 		INP_WUNLOCK(inp);
1734 		return (EBUSY);
1735 	}
1736 	up->u_tun_func = f;
1737 	up->u_tun_ctx = ctx;
1738 	INP_WUNLOCK(inp);
1739 	return (0);
1740 }
1741 
1742 #ifdef INET
1743 static int
1744 udp_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
1745 {
1746 	struct inpcb *inp;
1747 	struct inpcbinfo *pcbinfo;
1748 	int error;
1749 
1750 	pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1751 	inp = sotoinpcb(so);
1752 	KASSERT(inp != NULL, ("udp_bind: inp == NULL"));
1753 	INP_WLOCK(inp);
1754 	INP_HASH_WLOCK(pcbinfo);
1755 	error = in_pcbbind(inp, nam, td->td_ucred);
1756 	INP_HASH_WUNLOCK(pcbinfo);
1757 	INP_WUNLOCK(inp);
1758 	return (error);
1759 }
1760 
1761 static void
1762 udp_close(struct socket *so)
1763 {
1764 	struct inpcb *inp;
1765 	struct inpcbinfo *pcbinfo;
1766 
1767 	pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1768 	inp = sotoinpcb(so);
1769 	KASSERT(inp != NULL, ("udp_close: inp == NULL"));
1770 	INP_WLOCK(inp);
1771 	if (inp->inp_faddr.s_addr != INADDR_ANY) {
1772 		INP_HASH_WLOCK(pcbinfo);
1773 		in_pcbdisconnect(inp);
1774 		inp->inp_laddr.s_addr = INADDR_ANY;
1775 		INP_HASH_WUNLOCK(pcbinfo);
1776 		soisdisconnected(so);
1777 	}
1778 	INP_WUNLOCK(inp);
1779 }
1780 
1781 static int
1782 udp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1783 {
1784 	struct inpcb *inp;
1785 	struct inpcbinfo *pcbinfo;
1786 	struct sockaddr_in *sin;
1787 	int error;
1788 
1789 	pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1790 	inp = sotoinpcb(so);
1791 	KASSERT(inp != NULL, ("udp_connect: inp == NULL"));
1792 	INP_WLOCK(inp);
1793 	if (inp->inp_faddr.s_addr != INADDR_ANY) {
1794 		INP_WUNLOCK(inp);
1795 		return (EISCONN);
1796 	}
1797 	sin = (struct sockaddr_in *)nam;
1798 	error = prison_remote_ip4(td->td_ucred, &sin->sin_addr);
1799 	if (error != 0) {
1800 		INP_WUNLOCK(inp);
1801 		return (error);
1802 	}
1803 	INP_HASH_WLOCK(pcbinfo);
1804 	error = in_pcbconnect(inp, nam, td->td_ucred);
1805 	INP_HASH_WUNLOCK(pcbinfo);
1806 	if (error == 0)
1807 		soisconnected(so);
1808 	INP_WUNLOCK(inp);
1809 	return (error);
1810 }
1811 
1812 static void
1813 udp_detach(struct socket *so)
1814 {
1815 	struct inpcb *inp;
1816 	struct inpcbinfo *pcbinfo;
1817 	struct udpcb *up;
1818 
1819 	pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1820 	inp = sotoinpcb(so);
1821 	KASSERT(inp != NULL, ("udp_detach: inp == NULL"));
1822 	KASSERT(inp->inp_faddr.s_addr == INADDR_ANY,
1823 	    ("udp_detach: not disconnected"));
1824 	INP_INFO_WLOCK(pcbinfo);
1825 	INP_WLOCK(inp);
1826 	up = intoudpcb(inp);
1827 	KASSERT(up != NULL, ("%s: up == NULL", __func__));
1828 	inp->inp_ppcb = NULL;
1829 	in_pcbdetach(inp);
1830 	in_pcbfree(inp);
1831 	INP_INFO_WUNLOCK(pcbinfo);
1832 	udp_discardcb(up);
1833 }
1834 
1835 static int
1836 udp_disconnect(struct socket *so)
1837 {
1838 	struct inpcb *inp;
1839 	struct inpcbinfo *pcbinfo;
1840 
1841 	pcbinfo = get_inpcbinfo(so->so_proto->pr_protocol);
1842 	inp = sotoinpcb(so);
1843 	KASSERT(inp != NULL, ("udp_disconnect: inp == NULL"));
1844 	INP_WLOCK(inp);
1845 	if (inp->inp_faddr.s_addr == INADDR_ANY) {
1846 		INP_WUNLOCK(inp);
1847 		return (ENOTCONN);
1848 	}
1849 	INP_HASH_WLOCK(pcbinfo);
1850 	in_pcbdisconnect(inp);
1851 	inp->inp_laddr.s_addr = INADDR_ANY;
1852 	INP_HASH_WUNLOCK(pcbinfo);
1853 	SOCK_LOCK(so);
1854 	so->so_state &= ~SS_ISCONNECTED;		/* XXX */
1855 	SOCK_UNLOCK(so);
1856 	INP_WUNLOCK(inp);
1857 	return (0);
1858 }
1859 
1860 static int
1861 udp_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
1862     struct mbuf *control, struct thread *td)
1863 {
1864 	struct inpcb *inp;
1865 
1866 	inp = sotoinpcb(so);
1867 	KASSERT(inp != NULL, ("udp_send: inp == NULL"));
1868 	return (udp_output(inp, m, addr, control, td));
1869 }
1870 #endif /* INET */
1871 
1872 int
1873 udp_shutdown(struct socket *so)
1874 {
1875 	struct inpcb *inp;
1876 
1877 	inp = sotoinpcb(so);
1878 	KASSERT(inp != NULL, ("udp_shutdown: inp == NULL"));
1879 	INP_WLOCK(inp);
1880 	socantsendmore(so);
1881 	INP_WUNLOCK(inp);
1882 	return (0);
1883 }
1884 
1885 #ifdef INET
1886 struct pr_usrreqs udp_usrreqs = {
1887 	.pru_abort =		udp_abort,
1888 	.pru_attach =		udp_attach,
1889 	.pru_bind =		udp_bind,
1890 	.pru_connect =		udp_connect,
1891 	.pru_control =		in_control,
1892 	.pru_detach =		udp_detach,
1893 	.pru_disconnect =	udp_disconnect,
1894 	.pru_peeraddr =		in_getpeeraddr,
1895 	.pru_send =		udp_send,
1896 	.pru_soreceive =	soreceive_dgram,
1897 	.pru_sosend =		sosend_dgram,
1898 	.pru_shutdown =		udp_shutdown,
1899 	.pru_sockaddr =		in_getsockaddr,
1900 	.pru_sosetlabel =	in_pcbsosetlabel,
1901 	.pru_close =		udp_close,
1902 };
1903 #endif /* INET */
1904