1 /*
2 * INET An implementation of the TCP/IP protocol suite for the LINUX
3 * operating system. INET is implemented using the BSD Socket
4 * interface as the means of communication with the user level.
5 *
6 * The User Datagram Protocol (UDP).
7 *
8 * Authors: Ross Biro
9 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10 * Arnt Gulbrandsen, <agulbra@nvg.unit.no>
11 * Alan Cox, <alan@lxorguk.ukuu.org.uk>
12 * Hirokazu Takahashi, <taka@valinux.co.jp>
13 *
14 * Fixes:
15 * Alan Cox : verify_area() calls
16 * Alan Cox : stopped close while in use off icmp
17 * messages. Not a fix but a botch that
18 * for udp at least is 'valid'.
19 * Alan Cox : Fixed icmp handling properly
20 * Alan Cox : Correct error for oversized datagrams
21 * Alan Cox : Tidied select() semantics.
22 * Alan Cox : udp_err() fixed properly, also now
23 * select and read wake correctly on errors
24 * Alan Cox : udp_send verify_area moved to avoid mem leak
25 * Alan Cox : UDP can count its memory
26 * Alan Cox : send to an unknown connection causes
27 * an ECONNREFUSED off the icmp, but
28 * does NOT close.
29 * Alan Cox : Switched to new sk_buff handlers. No more backlog!
30 * Alan Cox : Using generic datagram code. Even smaller and the PEEK
31 * bug no longer crashes it.
32 * Fred Van Kempen : Net2e support for sk->broadcast.
33 * Alan Cox : Uses skb_free_datagram
34 * Alan Cox : Added get/set sockopt support.
35 * Alan Cox : Broadcasting without option set returns EACCES.
36 * Alan Cox : No wakeup calls. Instead we now use the callbacks.
37 * Alan Cox : Use ip_tos and ip_ttl
38 * Alan Cox : SNMP Mibs
39 * Alan Cox : MSG_DONTROUTE, and 0.0.0.0 support.
40 * Matt Dillon : UDP length checks.
41 * Alan Cox : Smarter af_inet used properly.
42 * Alan Cox : Use new kernel side addressing.
43 * Alan Cox : Incorrect return on truncated datagram receive.
44 * Arnt Gulbrandsen : New udp_send and stuff
45 * Alan Cox : Cache last socket
46 * Alan Cox : Route cache
47 * Jon Peatfield : Minor efficiency fix to sendto().
48 * Mike Shaver : RFC1122 checks.
49 * Alan Cox : Nonblocking error fix.
50 * Willy Konynenberg : Transparent proxying support.
51 * Mike McLagan : Routing by source
52 * David S. Miller : New socket lookup architecture.
53 * Last socket cache retained as it
54 * does have a high hit rate.
55 * Olaf Kirch : Don't linearise iovec on sendmsg.
56 * Andi Kleen : Some cleanups, cache destination entry
57 * for connect.
58 * Vitaly E. Lavrov : Transparent proxy revived after year coma.
59 * Melvin Smith : Check msg_name not msg_namelen in sendto(),
60 * return ENOTCONN for unconnected sockets (POSIX)
61 * Janos Farkas : don't deliver multi/broadcasts to a different
62 * bound-to-device socket
63 * Hirokazu Takahashi : HW checksumming for outgoing UDP
64 * datagrams.
65 * Hirokazu Takahashi : sendfile() on UDP works now.
66 * Arnaldo C. Melo : convert /proc/net/udp to seq_file
67 * YOSHIFUJI Hideaki @USAGI and: Support IPV6_V6ONLY socket option, which
68 * Alexey Kuznetsov: allow both IPv4 and IPv6 sockets to bind
69 * a single port at the same time.
70 * Derek Atkins <derek@ihtfp.com>: Add Encapulation Support
71 * James Chapman : Add L2TP encapsulation type.
72 *
73 *
74 * This program is free software; you can redistribute it and/or
75 * modify it under the terms of the GNU General Public License
76 * as published by the Free Software Foundation; either version
77 * 2 of the License, or (at your option) any later version.
78 */
79
80 #include <asm/system.h>
81 #include <asm/uaccess.h>
82 #include <asm/ioctls.h>
83 #include <linux/bootmem.h>
84 #include <linux/highmem.h>
85 #include <linux/swap.h>
86 #include <linux/types.h>
87 #include <linux/fcntl.h>
88 #include <linux/module.h>
89 #include <linux/socket.h>
90 #include <linux/sockios.h>
91 #include <linux/igmp.h>
92 #include <linux/in.h>
93 #include <linux/errno.h>
94 #include <linux/timer.h>
95 #include <linux/mm.h>
96 #include <linux/inet.h>
97 #include <linux/netdevice.h>
98 #include <net/tcp_states.h>
99 #include <linux/skbuff.h>
100 #include <linux/proc_fs.h>
101 #include <linux/seq_file.h>
102 #include <net/net_namespace.h>
103 #include <net/icmp.h>
104 #include <net/route.h>
105 #include <net/checksum.h>
106 #include <net/xfrm.h>
107 #include "udp_impl.h"
108 #include <linux/ccsecurity.h>
109
110 struct udp_table udp_table;
111 EXPORT_SYMBOL(udp_table);
112
113 int sysctl_udp_mem[3] __read_mostly;
114 EXPORT_SYMBOL(sysctl_udp_mem);
115
116 int sysctl_udp_rmem_min __read_mostly;
117 EXPORT_SYMBOL(sysctl_udp_rmem_min);
118
119 int sysctl_udp_wmem_min __read_mostly;
120 EXPORT_SYMBOL(sysctl_udp_wmem_min);
121
122 atomic_t udp_memory_allocated;
123 EXPORT_SYMBOL(udp_memory_allocated);
124
125 #define PORTS_PER_CHAIN (65536 / UDP_HTABLE_SIZE)
126
127 static int udp_lib_lport_inuse(struct net *net, __u16 num,
128 const struct udp_hslot *hslot,
129 unsigned long *bitmap,
130 struct sock *sk,
131 int (*saddr_comp)(const struct sock *sk1,
132 const struct sock *sk2))
133 {
134 struct sock *sk2;
135 struct hlist_nulls_node *node;
136
137 sk_nulls_for_each(sk2, node, &hslot->head)
138 if (net_eq(sock_net(sk2), net) &&
139 sk2 != sk &&
140 (bitmap || sk2->sk_hash == num) &&
141 (!sk2->sk_reuse || !sk->sk_reuse) &&
142 (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if
143 || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
144 (*saddr_comp)(sk, sk2)) {
145 if (bitmap)
146 __set_bit(sk2->sk_hash / UDP_HTABLE_SIZE,
147 bitmap);
148 else
149 return 1;
150 }
151 return 0;
152 }
153
154 /**
155 * udp_lib_get_port - UDP/-Lite port lookup for IPv4 and IPv6
156 *
157 * @sk: socket struct in question
158 * @snum: port number to look up
159 * @saddr_comp: AF-dependent comparison of bound local IP addresses
160 */
161 int udp_lib_get_port(struct sock *sk, unsigned short snum,
162 int (*saddr_comp)(const struct sock *sk1,
163 const struct sock *sk2))
164 {
165 struct udp_hslot *hslot;
166 struct udp_table *udptable = sk->sk_prot->h.udp_table;
167 int error = 1;
168 struct net *net = sock_net(sk);
169
170 if (!snum) {
171 int low, high, remaining;
172 unsigned rand;
173 unsigned short first, last;
174 DECLARE_BITMAP(bitmap, PORTS_PER_CHAIN);
175
176 inet_get_local_port_range(&low, &high);
177 remaining = (high - low) + 1;
178
179 rand = net_random();
180 first = (((u64)rand * remaining) >> 32) + low;
181 /*
182 * force rand to be an odd multiple of UDP_HTABLE_SIZE
183 */
184 rand = (rand | 1) * UDP_HTABLE_SIZE;
185 for (last = first + UDP_HTABLE_SIZE; first != last; first++) {
186 hslot = &udptable->hash[udp_hashfn(net, first)];
187 bitmap_zero(bitmap, PORTS_PER_CHAIN);
188 spin_lock_bh(&hslot->lock);
189 udp_lib_lport_inuse(net, snum, hslot, bitmap, sk,
190 saddr_comp);
191
192 snum = first;
193 /*
194 * Iterate on all possible values of snum for this hash.
195 * Using steps of an odd multiple of UDP_HTABLE_SIZE
196 * give us randomization and full range coverage.
197 */
198 do {
199 if (low <= snum && snum <= high &&
200 !test_bit(snum / UDP_HTABLE_SIZE, bitmap)
201 && !ccs_lport_reserved(snum))
202 goto found;
203 snum += rand;
204 } while (snum != first);
205 spin_unlock_bh(&hslot->lock);
206 }
207 goto fail;
208 } else {
209 hslot = &udptable->hash[udp_hashfn(net, snum)];
210 spin_lock_bh(&hslot->lock);
211 if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk, saddr_comp))
212 goto fail_unlock;
213 }
214 found:
215 inet_sk(sk)->num = snum;
216 sk->sk_hash = snum;
217 if (sk_unhashed(sk)) {
218 sk_nulls_add_node_rcu(sk, &hslot->head);
219 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
220 }
221 error = 0;
222 fail_unlock:
223 spin_unlock_bh(&hslot->lock);
224 fail:
225 return error;
226 }
227 EXPORT_SYMBOL(udp_lib_get_port);
228
229 static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
230 {
231 struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
232
233 return (!ipv6_only_sock(sk2) &&
234 (!inet1->rcv_saddr || !inet2->rcv_saddr ||
235 inet1->rcv_saddr == inet2->rcv_saddr));
236 }
237
238 int udp_v4_get_port(struct sock *sk, unsigned short snum)
239 {
240 return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal);
241 }
242
243 static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
244 unsigned short hnum,
245 __be16 sport, __be32 daddr, __be16 dport, int dif)
246 {
247 int score = -1;
248
249 if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
250 !ipv6_only_sock(sk)) {
251 struct inet_sock *inet = inet_sk(sk);
252
253 score = (sk->sk_family == PF_INET ? 1 : 0);
254 if (inet->rcv_saddr) {
255 if (inet->rcv_saddr != daddr)
256 return -1;
257 score += 2;
258 }
259 if (inet->daddr) {
260 if (inet->daddr != saddr)
261 return -1;
262 score += 2;
263 }
264 if (inet->dport) {
265 if (inet->dport != sport)
266 return -1;
267 score += 2;
268 }
269 if (sk->sk_bound_dev_if) {
270 if (sk->sk_bound_dev_if != dif)
271 return -1;
272 score += 2;
273 }
274 }
275 return score;
276 }
277
278 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
279 * harder than this. -DaveM
280 */
281 static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
282 __be16 sport, __be32 daddr, __be16 dport,
283 int dif, struct udp_table *udptable)
284 {
285 struct sock *sk, *result;
286 struct hlist_nulls_node *node;
287 unsigned short hnum = ntohs(dport);
288 unsigned int hash = udp_hashfn(net, hnum);
289 struct udp_hslot *hslot = &udptable->hash[hash];
290 int score, badness;
291
292 rcu_read_lock();
293 begin:
294 result = NULL;
295 badness = -1;
296 sk_nulls_for_each_rcu(sk, node, &hslot->head) {
297 score = compute_score(sk, net, saddr, hnum, sport,
298 daddr, dport, dif);
299 if (score > badness) {
300 result = sk;
301 badness = score;
302 }
303 }
304 /*
305 * if the nulls value we got at the end of this lookup is
306 * not the expected one, we must restart lookup.
307 * We probably met an item that was moved to another chain.
308 */
309 if (get_nulls_value(node) != hash)
310 goto begin;
311
312 if (result) {
313 if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
314 result = NULL;
315 else if (unlikely(compute_score(result, net, saddr, hnum, sport,
316 daddr, dport, dif) < badness)) {
317 sock_put(result);
318 goto begin;
319 }
320 }
321 rcu_read_unlock();
322 return result;
323 }
324
325 static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,
326 __be16 sport, __be16 dport,
327 struct udp_table *udptable)
328 {
329 struct sock *sk;
330 const struct iphdr *iph = ip_hdr(skb);
331
332 if (unlikely(sk = skb_steal_sock(skb)))
333 return sk;
334 else
335 return __udp4_lib_lookup(dev_net(skb_dst(skb)->dev), iph->saddr, sport,
336 iph->daddr, dport, inet_iif(skb),
337 udptable);
338 }
339
340 struct sock *udp4_lib_lookup(struct net *net, __be32 saddr, __be16 sport,
341 __be32 daddr, __be16 dport, int dif)
342 {
343 return __udp4_lib_lookup(net, saddr, sport, daddr, dport, dif, &udp_table);
344 }
345 EXPORT_SYMBOL_GPL(udp4_lib_lookup);
346
347 static inline struct sock *udp_v4_mcast_next(struct net *net, struct sock *sk,
348 __be16 loc_port, __be32 loc_addr,
349 __be16 rmt_port, __be32 rmt_addr,
350 int dif)
351 {
352 struct hlist_nulls_node *node;
353 struct sock *s = sk;
354 unsigned short hnum = ntohs(loc_port);
355
356 sk_nulls_for_each_from(s, node) {
357 struct inet_sock *inet = inet_sk(s);
358
359 if (!net_eq(sock_net(s), net) ||
360 s->sk_hash != hnum ||
361 (inet->daddr && inet->daddr != rmt_addr) ||
362 (inet->dport != rmt_port && inet->dport) ||
363 (inet->rcv_saddr && inet->rcv_saddr != loc_addr) ||
364 ipv6_only_sock(s) ||
365 (s->sk_bound_dev_if && s->sk_bound_dev_if != dif))
366 continue;
367 if (!ip_mc_sf_allow(s, loc_addr, rmt_addr, dif))
368 continue;
369 goto found;
370 }
371 s = NULL;
372 found:
373 return s;
374 }
375
376 /*
377 * This routine is called by the ICMP module when it gets some
378 * sort of error condition. If err < 0 then the socket should
379 * be closed and the error returned to the user. If err > 0
380 * it's just the icmp type << 8 | icmp code.
381 * Header points to the ip header of the error packet. We move
382 * on past this. Then (as it used to claim before adjustment)
383 * header points to the first 8 bytes of the udp header. We need
384 * to find the appropriate port.
385 */
386
387 void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
388 {
389 struct inet_sock *inet;
390 struct iphdr *iph = (struct iphdr *)skb->data;
391 struct udphdr *uh = (struct udphdr *)(skb->data+(iph->ihl<<2));
392 const int type = icmp_hdr(skb)->type;
393 const int code = icmp_hdr(skb)->code;
394 struct sock *sk;
395 int harderr;
396 int err;
397 struct net *net = dev_net(skb->dev);
398
399 sk = __udp4_lib_lookup(net, iph->daddr, uh->dest,
400 iph->saddr, uh->source, skb->dev->ifindex, udptable);
401 if (sk == NULL) {
402 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
403 return; /* No socket for error */
404 }
405
406 err = 0;
407 harderr = 0;
408 inet = inet_sk(sk);
409
410 switch (type) {
411 default:
412 case ICMP_TIME_EXCEEDED:
413 err = EHOSTUNREACH;
414 break;
415 case ICMP_SOURCE_QUENCH:
416 goto out;
417 case ICMP_PARAMETERPROB:
418 err = EPROTO;
419 harderr = 1;
420 break;
421 case ICMP_DEST_UNREACH:
422 if (code == ICMP_FRAG_NEEDED) { /* Path MTU discovery */
423 if (inet->pmtudisc != IP_PMTUDISC_DONT) {
424 err = EMSGSIZE;
425 harderr = 1;
426 break;
427 }
428 goto out;
429 }
430 err = EHOSTUNREACH;
431 if (code <= NR_ICMP_UNREACH) {
432 harderr = icmp_err_convert[code].fatal;
433 err = icmp_err_convert[code].errno;
434 }
435 break;
436 }
437
438 /*
439 * RFC1122: OK. Passes ICMP errors back to application, as per
440 * 4.1.3.3.
441 */
442 if (!inet->recverr) {
443 if (!harderr || sk->sk_state != TCP_ESTABLISHED)
444 goto out;
445 } else
446 ip_icmp_error(sk, skb, err, uh->dest, info, (u8 *)(uh+1));
447
448 sk->sk_err = err;
449 sk->sk_error_report(sk);
450 out:
451 sock_put(sk);
452 }
453
454 void udp_err(struct sk_buff *skb, u32 info)
455 {
456 __udp4_lib_err(skb, info, &udp_table);
457 }
458
459 /*
460 * Throw away all pending data and cancel the corking. Socket is locked.
461 */
462 void udp_flush_pending_frames(struct sock *sk)
463 {
464 struct udp_sock *up = udp_sk(sk);
465
466 if (up->pending) {
467 up->len = 0;
468 up->pending = 0;
469 ip_flush_pending_frames(sk);
470 }
471 }
472 EXPORT_SYMBOL(udp_flush_pending_frames);
473
474 /**
475 * udp4_hwcsum_outgoing - handle outgoing HW checksumming
476 * @sk: socket we are sending on
477 * @skb: sk_buff containing the filled-in UDP header
478 * (checksum field must be zeroed out)
479 */
480 static void udp4_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb,
481 __be32 src, __be32 dst, int len)
482 {
483 unsigned int offset;
484 struct udphdr *uh = udp_hdr(skb);
485 __wsum csum = 0;
486
487 if (skb_queue_len(&sk->sk_write_queue) == 1) {
488 /*
489 * Only one fragment on the socket.
490 */
491 skb->csum_start = skb_transport_header(skb) - skb->head;
492 skb->csum_offset = offsetof(struct udphdr, check);
493 uh->check = ~csum_tcpudp_magic(src, dst, len, IPPROTO_UDP, 0);
494 } else {
495 /*
496 * HW-checksum won't work as there are two or more
497 * fragments on the socket so that all csums of sk_buffs
498 * should be together
499 */
500 offset = skb_transport_offset(skb);
501 skb->csum = skb_checksum(skb, offset, skb->len - offset, 0);
502
503 skb->ip_summed = CHECKSUM_NONE;
504
505 skb_queue_walk(&sk->sk_write_queue, skb) {
506 csum = csum_add(csum, skb->csum);
507 }
508
509 uh->check = csum_tcpudp_magic(src, dst, len, IPPROTO_UDP, csum);
510 if (uh->check == 0)
511 uh->check = CSUM_MANGLED_0;
512 }
513 }
514
515 /*
516 * Push out all pending data as one UDP datagram. Socket is locked.
517 */
518 int udp_push_pending_frames(struct sock *sk)
519 {
520 struct udp_sock *up = udp_sk(sk);
521 struct inet_sock *inet = inet_sk(sk);
522 struct flowi *fl = &inet->cork.fl;
523 struct sk_buff *skb;
524 struct udphdr *uh;
525 int err = 0;
526 int is_udplite = IS_UDPLITE(sk);
527 __wsum csum = 0;
528
529 /* Grab the skbuff where UDP header space exists. */
530 if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
531 goto out;
532
533 /*
534 * Create a UDP header
535 */
536 uh = udp_hdr(skb);
537 uh->source = fl->fl_ip_sport;
538 uh->dest = fl->fl_ip_dport;
539 uh->len = htons(up->len);
540 uh->check = 0;
541
542 if (is_udplite) /* UDP-Lite */
543 csum = udplite_csum_outgoing(sk, skb);
544
545 else if (sk->sk_no_check == UDP_CSUM_NOXMIT) { /* UDP csum disabled */
546
547 skb->ip_summed = CHECKSUM_NONE;
548 goto send;
549
550 } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
551
552 udp4_hwcsum_outgoing(sk, skb, fl->fl4_src, fl->fl4_dst, up->len);
553 goto send;
554
555 } else /* `normal' UDP */
556 csum = udp_csum_outgoing(sk, skb);
557
558 /* add protocol-dependent pseudo-header */
559 uh->check = csum_tcpudp_magic(fl->fl4_src, fl->fl4_dst, up->len,
560 sk->sk_protocol, csum);
561 if (uh->check == 0)
562 uh->check = CSUM_MANGLED_0;
563
564 send:
565 err = ip_push_pending_frames(sk);
566 if (err) {
567 if (err == -ENOBUFS && !inet->recverr) {
568 UDP_INC_STATS_USER(sock_net(sk),
569 UDP_MIB_SNDBUFERRORS, is_udplite);
570 err = 0;
571 }
572 } else
573 UDP_INC_STATS_USER(sock_net(sk),
574 UDP_MIB_OUTDATAGRAMS, is_udplite);
575 out:
576 up->len = 0;
577 up->pending = 0;
578 return err;
579 }
580 EXPORT_SYMBOL(udp_push_pending_frames);
581
582 int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
583 size_t len)
584 {
585 struct inet_sock *inet = inet_sk(sk);
586 struct udp_sock *up = udp_sk(sk);
587 int ulen = len;
588 struct ipcm_cookie ipc;
589 struct rtable *rt = NULL;
590 int free = 0;
591 int connected = 0;
592 __be32 daddr, faddr, saddr;
593 __be16 dport;
594 u8 tos;
595 int err, is_udplite = IS_UDPLITE(sk);
596 int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
597 int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
598 struct ip_options_data opt_copy;
599
600 if (len > 0xFFFF)
601 return -EMSGSIZE;
602
603 /*
604 * Check the flags.
605 */
606
607 if (msg->msg_flags & MSG_OOB) /* Mirror BSD error message compatibility */
608 return -EOPNOTSUPP;
609
610 ipc.opt = NULL;
611 ipc.shtx.flags = 0;
612
613 if (up->pending) {
614 /*
615 * There are pending frames.
616 * The socket lock must be held while it's corked.
617 */
618 lock_sock(sk);
619 if (likely(up->pending)) {
620 if (unlikely(up->pending != AF_INET)) {
621 release_sock(sk);
622 return -EINVAL;
623 }
624 goto do_append_data;
625 }
626 release_sock(sk);
627 }
628 ulen += sizeof(struct udphdr);
629
630 /*
631 * Get and verify the address.
632 */
633 if (msg->msg_name) {
634 struct sockaddr_in * usin = (struct sockaddr_in *)msg->msg_name;
635 if (msg->msg_namelen < sizeof(*usin))
636 return -EINVAL;
637 if (usin->sin_family != AF_INET) {
638 if (usin->sin_family != AF_UNSPEC)
639 return -EAFNOSUPPORT;
640 }
641
642 daddr = usin->sin_addr.s_addr;
643 dport = usin->sin_port;
644 if (dport == 0)
645 return -EINVAL;
646 } else {
647 if (sk->sk_state != TCP_ESTABLISHED)
648 return -EDESTADDRREQ;
649 daddr = inet->daddr;
650 dport = inet->dport;
651 /* Open fast path for connected socket.
652 Route will not be used, if at least one option is set.
653 */
654 connected = 1;
655 }
656 ipc.addr = inet->saddr;
657
658 ipc.oif = sk->sk_bound_dev_if;
659 err = sock_tx_timestamp(msg, sk, &ipc.shtx);
660 if (err)
661 return err;
662 if (msg->msg_controllen) {
663 err = ip_cmsg_send(sock_net(sk), msg, &ipc);
664 if (err)
665 return err;
666 if (ipc.opt)
667 free = 1;
668 connected = 0;
669 }
670 if (!ipc.opt) {
671 struct ip_options_rcu *inet_opt;
672
673 rcu_read_lock();
674 inet_opt = rcu_dereference(inet->inet_opt);
675 if (inet_opt) {
676 memcpy(&opt_copy, inet_opt,
677 sizeof(*inet_opt) + inet_opt->opt.optlen);
678 ipc.opt = &opt_copy.opt;
679 }
680 rcu_read_unlock();
681 }
682
683 saddr = ipc.addr;
684 ipc.addr = faddr = daddr;
685
686 if (ipc.opt && ipc.opt->opt.srr) {
687 if (!daddr)
688 return -EINVAL;
689 faddr = ipc.opt->opt.faddr;
690 connected = 0;
691 }
692 tos = RT_TOS(inet->tos);
693 if (sock_flag(sk, SOCK_LOCALROUTE) ||
694 (msg->msg_flags & MSG_DONTROUTE) ||
695 (ipc.opt && ipc.opt->opt.is_strictroute)) {
696 tos |= RTO_ONLINK;
697 connected = 0;
698 }
699
700 if (ipv4_is_multicast(daddr)) {
701 if (!ipc.oif)
702 ipc.oif = inet->mc_index;
703 if (!saddr)
704 saddr = inet->mc_addr;
705 connected = 0;
706 }
707
708 if (connected)
709 rt = (struct rtable *)sk_dst_check(sk, 0);
710
711 if (rt == NULL) {
712 struct flowi fl = { .oif = ipc.oif,
713 .mark = sk->sk_mark,
714 .nl_u = { .ip4_u =
715 { .daddr = faddr,
716 .saddr = saddr,
717 .tos = tos } },
718 .proto = sk->sk_protocol,
719 .flags = inet_sk_flowi_flags(sk),
720 .uli_u = { .ports =
721 { .sport = inet->sport,
722 .dport = dport } } };
723 struct net *net = sock_net(sk);
724
725 security_sk_classify_flow(sk, &fl);
726 err = ip_route_output_flow(net, &rt, &fl, sk, 1);
727 if (err) {
728 if (err == -ENETUNREACH)
729 IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
730 goto out;
731 }
732
733 err = -EACCES;
734 if ((rt->rt_flags & RTCF_BROADCAST) &&
735 !sock_flag(sk, SOCK_BROADCAST))
736 goto out;
737 if (connected)
738 sk_dst_set(sk, dst_clone(&rt->u.dst));
739 }
740
741 if (msg->msg_flags&MSG_CONFIRM)
742 goto do_confirm;
743 back_from_confirm:
744
745 saddr = rt->rt_src;
746 if (!ipc.addr)
747 daddr = ipc.addr = rt->rt_dst;
748
749 lock_sock(sk);
750 if (unlikely(up->pending)) {
751 /* The socket is already corked while preparing it. */
752 /* ... which is an evident application bug. --ANK */
753 release_sock(sk);
754
755 LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 2\n");
756 err = -EINVAL;
757 goto out;
758 }
759 /*
760 * Now cork the socket to pend data.
761 */
762 inet->cork.fl.fl4_dst = daddr;
763 inet->cork.fl.fl_ip_dport = dport;
764 inet->cork.fl.fl4_src = saddr;
765 inet->cork.fl.fl_ip_sport = inet->sport;
766 up->pending = AF_INET;
767
768 do_append_data:
769 up->len += ulen;
770 getfrag = is_udplite ? udplite_getfrag : ip_generic_getfrag;
771 err = ip_append_data(sk, getfrag, msg->msg_iov, ulen,
772 sizeof(struct udphdr), &ipc, &rt,
773 corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
774 if (err)
775 udp_flush_pending_frames(sk);
776 else if (!corkreq)
777 err = udp_push_pending_frames(sk);
778 else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
779 up->pending = 0;
780 release_sock(sk);
781
782 out:
783 ip_rt_put(rt);
784 if (free)
785 kfree(ipc.opt);
786 if (!err)
787 return len;
788 /*
789 * ENOBUFS = no kernel mem, SOCK_NOSPACE = no sndbuf space. Reporting
790 * ENOBUFS might not be good (it's not tunable per se), but otherwise
791 * we don't have a good statistic (IpOutDiscards but it can be too many
792 * things). We could add another new stat but at least for now that
793 * seems like overkill.
794 */
795 if (err == -ENOBUFS || test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
796 UDP_INC_STATS_USER(sock_net(sk),
797 UDP_MIB_SNDBUFERRORS, is_udplite);
798 }
799 return err;
800
801 do_confirm:
802 dst_confirm(&rt->u.dst);
803 if (!(msg->msg_flags&MSG_PROBE) || len)
804 goto back_from_confirm;
805 err = 0;
806 goto out;
807 }
808 EXPORT_SYMBOL(udp_sendmsg);
809
810 int udp_sendpage(struct sock *sk, struct page *page, int offset,
811 size_t size, int flags)
812 {
813 struct udp_sock *up = udp_sk(sk);
814 int ret;
815
816 if (!up->pending) {
817 struct msghdr msg = { .msg_flags = flags|MSG_MORE };
818
819 /* Call udp_sendmsg to specify destination address which
820 * sendpage interface can't pass.
821 * This will succeed only when the socket is connected.
822 */
823 ret = udp_sendmsg(NULL, sk, &msg, 0);
824 if (ret < 0)
825 return ret;
826 }
827
828 lock_sock(sk);
829
830 if (unlikely(!up->pending)) {
831 release_sock(sk);
832
833 LIMIT_NETDEBUG(KERN_DEBUG "udp cork app bug 3\n");
834 return -EINVAL;
835 }
836
837 ret = ip_append_page(sk, page, offset, size, flags);
838 if (ret == -EOPNOTSUPP) {
839 release_sock(sk);
840 return sock_no_sendpage(sk->sk_socket, page, offset,
841 size, flags);
842 }
843 if (ret < 0) {
844 udp_flush_pending_frames(sk);
845 goto out;
846 }
847
848 up->len += size;
849 if (!(up->corkflag || (flags&MSG_MORE)))
850 ret = udp_push_pending_frames(sk);
851 if (!ret)
852 ret = size;
853 out:
854 release_sock(sk);
855 return ret;
856 }
857
858
859 /**
860 * first_packet_length - return length of first packet in receive queue
861 * @sk: socket
862 *
863 * Drops all bad checksum frames, until a valid one is found.
864 * Returns the length of found skb, or 0 if none is found.
865 */
866 static unsigned int first_packet_length(struct sock *sk)
867 {
868 struct sk_buff_head list_kill, *rcvq = &sk->sk_receive_queue;
869 struct sk_buff *skb;
870 unsigned int res;
871
872 __skb_queue_head_init(&list_kill);
873
874 spin_lock_bh(&rcvq->lock);
875 while ((skb = skb_peek(rcvq)) != NULL &&
876 udp_lib_checksum_complete(skb)) {
877 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
878 IS_UDPLITE(sk));
879 __skb_unlink(skb, rcvq);
880 __skb_queue_tail(&list_kill, skb);
881 }
882 res = skb ? skb->len : 0;
883 spin_unlock_bh(&rcvq->lock);
884
885 if (!skb_queue_empty(&list_kill)) {
886 lock_sock(sk);
887 __skb_queue_purge(&list_kill);
888 sk_mem_reclaim_partial(sk);
889 release_sock(sk);
890 }
891 return res;
892 }
893
894 /*
895 * IOCTL requests applicable to the UDP protocol
896 */
897
898 int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
899 {
900 switch (cmd) {
901 case SIOCOUTQ:
902 {
903 int amount = sk_wmem_alloc_get(sk);
904
905 return put_user(amount, (int __user *)arg);
906 }
907
908 case SIOCINQ:
909 {
910 unsigned int amount = first_packet_length(sk);
911
912 if (amount)
913 /*
914 * We will only return the amount
915 * of this packet since that is all
916 * that will be read.
917 */
918 amount -= sizeof(struct udphdr);
919
920 return put_user(amount, (int __user *)arg);
921 }
922
923 default:
924 return -ENOIOCTLCMD;
925 }
926
927 return 0;
928 }
929 EXPORT_SYMBOL(udp_ioctl);
930
931 /*
932 * This should be easy, if there is something there we
933 * return it, otherwise we block.
934 */
935
936 int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
937 size_t len, int noblock, int flags, int *addr_len)
938 {
939 struct inet_sock *inet = inet_sk(sk);
940 struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
941 struct sk_buff *skb;
942 unsigned int ulen, copied;
943 int peeked;
944 int err;
945 int is_udplite = IS_UDPLITE(sk);
946 bool checksum_valid = false;
947
948 if (flags & MSG_ERRQUEUE)
949 return ip_recv_error(sk, msg, len, addr_len);
950
951 try_again:
952 skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
953 &peeked, &err);
954 if (!skb)
955 goto out;
956 if (ccs_socket_post_recvmsg_permission(sk, skb, flags)) {
957 err = -EAGAIN; /* Hope less harmful than -EPERM. */
958 goto out;
959 }
960
961 ulen = skb->len - sizeof(struct udphdr);
962 copied = len;
963 if (copied > ulen)
964 copied = ulen;
965 else if (copied < ulen)
966 msg->msg_flags |= MSG_TRUNC;
967
968 /*
969 * If checksum is needed at all, try to do it while copying the
970 * data. If the data is truncated, or if we only want a partial
971 * coverage checksum (UDP-Lite), do it before the copy.
972 */
973
974 if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
975 checksum_valid = !udp_lib_checksum_complete(skb);
976 if (!checksum_valid)
977 goto csum_copy_err;
978 }
979
980 if (checksum_valid || skb_csum_unnecessary(skb))
981 err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
982 msg->msg_iov, copied);
983 else {
984 err = skb_copy_and_csum_datagram_iovec(skb,
985 sizeof(struct udphdr),
986 msg->msg_iov);
987
988 if (err == -EINVAL)
989 goto csum_copy_err;
990 }
991
992 if (err)
993 goto out_free;
994
995 if (!peeked)
996 UDP_INC_STATS_USER(sock_net(sk),
997 UDP_MIB_INDATAGRAMS, is_udplite);
998
999 sock_recv_timestamp(msg, sk, skb);
1000
1001 /* Copy the address. */
1002 if (sin) {
1003 sin->sin_family = AF_INET;
1004 sin->sin_port = udp_hdr(skb)->source;
1005 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
1006 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
1007 *addr_len = sizeof(*sin);
1008 }
1009 if (inet->cmsg_flags)
1010 ip_cmsg_recv(msg, skb);
1011
1012 err = copied;
1013 if (flags & MSG_TRUNC)
1014 err = ulen;
1015
1016 out_free:
1017 skb_free_datagram_locked(sk, skb);
1018 out:
1019 return err;
1020
1021 csum_copy_err:
1022 lock_sock(sk);
1023 if (!skb_kill_datagram(sk, skb, flags))
1024 UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
1025 release_sock(sk);
1026
1027 /* starting over for a new packet, but check if we need to yield */
1028 cond_resched();
1029 msg->msg_flags &= ~MSG_TRUNC;
1030 goto try_again;
1031 }
1032
1033
1034 int udp_disconnect(struct sock *sk, int flags)
1035 {
1036 struct inet_sock *inet = inet_sk(sk);
1037 /*
1038 * 1003.1g - break association.
1039 */
1040
1041 sk->sk_state = TCP_CLOSE;
1042 inet->daddr = 0;
1043 inet->dport = 0;
1044 sk->sk_bound_dev_if = 0;
1045 if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
1046 inet_reset_saddr(sk);
1047
1048 if (!(sk->sk_userlocks & SOCK_BINDPORT_LOCK)) {
1049 sk->sk_prot->unhash(sk);
1050 inet->sport = 0;
1051 }
1052 sk_dst_reset(sk);
1053 return 0;
1054 }
1055 EXPORT_SYMBOL(udp_disconnect);
1056
1057 void udp_lib_unhash(struct sock *sk)
1058 {
1059 if (sk_hashed(sk)) {
1060 struct udp_table *udptable = sk->sk_prot->h.udp_table;
1061 unsigned int hash = udp_hashfn(sock_net(sk), sk->sk_hash);
1062 struct udp_hslot *hslot = &udptable->hash[hash];
1063
1064 spin_lock_bh(&hslot->lock);
1065 if (sk_nulls_del_node_init_rcu(sk)) {
1066 inet_sk(sk)->num = 0;
1067 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
1068 }
1069 spin_unlock_bh(&hslot->lock);
1070 }
1071 }
1072 EXPORT_SYMBOL(udp_lib_unhash);
1073
1074 static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
1075 {
1076 int is_udplite = IS_UDPLITE(sk);
1077 int rc;
1078
1079 if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
1080 /* Note that an ENOMEM error is charged twice */
1081 if (rc == -ENOMEM) {
1082 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
1083 is_udplite);
1084 atomic_inc(&sk->sk_drops);
1085 }
1086 goto drop;
1087 }
1088
1089 return 0;
1090
1091 drop:
1092 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
1093 kfree_skb(skb);
1094 return -1;
1095 }
1096
1097 /* returns:
1098 * -1: error
1099 * 0: success
1100 * >0: "udp encap" protocol resubmission
1101 *
1102 * Note that in the success and error cases, the skb is assumed to
1103 * have either been requeued or freed.
1104 */
1105 int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
1106 {
1107 struct udp_sock *up = udp_sk(sk);
1108 int rc;
1109 int is_udplite = IS_UDPLITE(sk);
1110
1111 /*
1112 * Charge it to the socket, dropping if the queue is full.
1113 */
1114 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
1115 goto drop;
1116 nf_reset(skb);
1117
1118 if (up->encap_type) {
1119 /*
1120 * This is an encapsulation socket so pass the skb to
1121 * the socket's udp_encap_rcv() hook. Otherwise, just
1122 * fall through and pass this up the UDP socket.
1123 * up->encap_rcv() returns the following value:
1124 * =0 if skb was successfully passed to the encap
1125 * handler or was discarded by it.
1126 * >0 if skb should be passed on to UDP.
1127 * <0 if skb should be resubmitted as proto -N
1128 */
1129
1130 /* if we're overly short, let UDP handle it */
1131 if (skb->len > sizeof(struct udphdr) &&
1132 up->encap_rcv != NULL) {
1133 int ret;
1134
1135 ret = (*up->encap_rcv)(sk, skb);
1136 if (ret <= 0) {
1137 UDP_INC_STATS_BH(sock_net(sk),
1138 UDP_MIB_INDATAGRAMS,
1139 is_udplite);
1140 return -ret;
1141 }
1142 }
1143
1144 /* FALLTHROUGH -- it's a UDP Packet */
1145 }
1146
1147 /*
1148 * UDP-Lite specific tests, ignored on UDP sockets
1149 */
1150 if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) {
1151
1152 /*
1153 * MIB statistics other than incrementing the error count are
1154 * disabled for the following two types of errors: these depend
1155 * on the application settings, not on the functioning of the
1156 * protocol stack as such.
1157 *
1158 * RFC 3828 here recommends (sec 3.3): "There should also be a
1159 * way ... to ... at least let the receiving application block
1160 * delivery of packets with coverage values less than a value
1161 * provided by the application."
1162 */
1163 if (up->pcrlen == 0) { /* full coverage was set */
1164 LIMIT_NETDEBUG(KERN_WARNING "UDPLITE: partial coverage "
1165 "%d while full coverage %d requested\n",
1166 UDP_SKB_CB(skb)->cscov, skb->len);
1167 goto drop;
1168 }
1169 /* The next case involves violating the min. coverage requested
1170 * by the receiver. This is subtle: if receiver wants x and x is
1171 * greater than the buffersize/MTU then receiver will complain
1172 * that it wants x while sender emits packets of smaller size y.
1173 * Therefore the above ...()->partial_cov statement is essential.
1174 */
1175 if (UDP_SKB_CB(skb)->cscov < up->pcrlen) {
1176 LIMIT_NETDEBUG(KERN_WARNING
1177 "UDPLITE: coverage %d too small, need min %d\n",
1178 UDP_SKB_CB(skb)->cscov, up->pcrlen);
1179 goto drop;
1180 }
1181 }
1182
1183 if (sk->sk_filter) {
1184 if (udp_lib_checksum_complete(skb))
1185 goto drop;
1186 }
1187
1188 rc = 0;
1189
1190 bh_lock_sock(sk);
1191 if (!sock_owned_by_user(sk))
1192 rc = __udp_queue_rcv_skb(sk, skb);
1193 else
1194 sk_add_backlog(sk, skb);
1195 bh_unlock_sock(sk);
1196
1197 return rc;
1198
1199 drop:
1200 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
1201 kfree_skb(skb);
1202 return -1;
1203 }
1204
1205 /*
1206 * Multicasts and broadcasts go to each listener.
1207 *
1208 * Note: called only from the BH handler context,
1209 * so we don't need to lock the hashes.
1210 */
1211 static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
1212 struct udphdr *uh,
1213 __be32 saddr, __be32 daddr,
1214 struct udp_table *udptable)
1215 {
1216 struct sock *sk;
1217 struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
1218 int dif;
1219
1220 spin_lock(&hslot->lock);
1221 sk = sk_nulls_head(&hslot->head);
1222 dif = skb->dev->ifindex;
1223 sk = udp_v4_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
1224 if (sk) {
1225 struct sock *sknext = NULL;
1226
1227 do {
1228 struct sk_buff *skb1 = skb;
1229
1230 sknext = udp_v4_mcast_next(net, sk_nulls_next(sk), uh->dest,
1231 daddr, uh->source, saddr,
1232 dif);
1233 if (sknext)
1234 skb1 = skb_clone(skb, GFP_ATOMIC);
1235
1236 if (skb1) {
1237 int ret = udp_queue_rcv_skb(sk, skb1);
1238 if (ret > 0)
1239 /* we should probably re-process instead
1240 * of dropping packets here. */
1241 kfree_skb(skb1);
1242 }
1243 sk = sknext;
1244 } while (sknext);
1245 } else
1246 consume_skb(skb);
1247 spin_unlock(&hslot->lock);
1248 return 0;
1249 }
1250
1251 /* Initialize UDP checksum. If exited with zero value (success),
1252 * CHECKSUM_UNNECESSARY means, that no more checks are required.
1253 * Otherwise, csum completion requires chacksumming packet body,
1254 * including udp header and folding it to skb->csum.
1255 */
1256 static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
1257 int proto)
1258 {
1259 const struct iphdr *iph;
1260 int err;
1261
1262 UDP_SKB_CB(skb)->partial_cov = 0;
1263 UDP_SKB_CB(skb)->cscov = skb->len;
1264
1265 if (proto == IPPROTO_UDPLITE) {
1266 err = udplite_checksum_init(skb, uh);
1267 if (err)
1268 return err;
1269 }
1270
1271 iph = ip_hdr(skb);
1272 if (uh->check == 0) {
1273 skb->ip_summed = CHECKSUM_UNNECESSARY;
1274 } else if (skb->ip_summed == CHECKSUM_COMPLETE) {
1275 if (!csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
1276 proto, skb->csum))
1277 skb->ip_summed = CHECKSUM_UNNECESSARY;
1278 }
1279 if (!skb_csum_unnecessary(skb))
1280 skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
1281 skb->len, proto, 0);
1282 /* Probably, we should checksum udp header (it should be in cache
1283 * in any case) and data in tiny packets (< rx copybreak).
1284 */
1285
1286 return 0;
1287 }
1288
1289 /*
1290 * All we need to do is get the socket, and then do a checksum.
1291 */
1292
1293 int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
1294 int proto)
1295 {
1296 struct sock *sk;
1297 struct udphdr *uh;
1298 unsigned short ulen;
1299 struct rtable *rt = skb_rtable(skb);
1300 __be32 saddr, daddr;
1301 struct net *net = dev_net(skb->dev);
1302
1303 /*
1304 * Validate the packet.
1305 */
1306 if (!pskb_may_pull(skb, sizeof(struct udphdr)))
1307 goto drop; /* No space for header. */
1308
1309 uh = udp_hdr(skb);
1310 ulen = ntohs(uh->len);
1311 saddr = ip_hdr(skb)->saddr;
1312 daddr = ip_hdr(skb)->daddr;
1313
1314 if (ulen > skb->len)
1315 goto short_packet;
1316
1317 if (proto == IPPROTO_UDP) {
1318 /* UDP validates ulen. */
1319 if (ulen < sizeof(*uh) || pskb_trim_rcsum(skb, ulen))
1320 goto short_packet;
1321 uh = udp_hdr(skb);
1322 }
1323
1324 if (udp4_csum_init(skb, uh, proto))
1325 goto csum_error;
1326
1327 if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
1328 return __udp4_lib_mcast_deliver(net, skb, uh,
1329 saddr, daddr, udptable);
1330
1331 sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
1332
1333 if (sk != NULL) {
1334 int ret = udp_queue_rcv_skb(sk, skb);
1335 sock_put(sk);
1336
1337 /* a return value > 0 means to resubmit the input, but
1338 * it wants the return to be -protocol, or 0
1339 */
1340 if (ret > 0)
1341 return -ret;
1342 return 0;
1343 }
1344
1345 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
1346 goto drop;
1347 nf_reset(skb);
1348
1349 /* No socket. Drop packet silently, if checksum is wrong */
1350 if (udp_lib_checksum_complete(skb))
1351 goto csum_error;
1352
1353 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
1354 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
1355
1356 /*
1357 * Hmm. We got an UDP packet to a port to which we
1358 * don't wanna listen. Ignore it.
1359 */
1360 kfree_skb(skb);
1361 return 0;
1362
1363 short_packet:
1364 LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: short packet: From %pI4:%u %d/%d to %pI4:%u\n",
1365 proto == IPPROTO_UDPLITE ? "-Lite" : "",
1366 &saddr,
1367 ntohs(uh->source),
1368 ulen,
1369 skb->len,
1370 &daddr,
1371 ntohs(uh->dest));
1372 goto drop;
1373
1374 csum_error:
1375 /*
1376 * RFC1122: OK. Discards the bad packet silently (as far as
1377 * the network is concerned, anyway) as per 4.1.3.4 (MUST).
1378 */
1379 LIMIT_NETDEBUG(KERN_DEBUG "UDP%s: bad checksum. From %pI4:%u to %pI4:%u ulen %d\n",
1380 proto == IPPROTO_UDPLITE ? "-Lite" : "",
1381 &saddr,
1382 ntohs(uh->source),
1383 &daddr,
1384 ntohs(uh->dest),
1385 ulen);
1386 drop:
1387 UDP_INC_STATS_BH(net, UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
1388 kfree_skb(skb);
1389 return 0;
1390 }
1391
1392 int udp_rcv(struct sk_buff *skb)
1393 {
1394 return __udp4_lib_rcv(skb, &udp_table, IPPROTO_UDP);
1395 }
1396
1397 void udp_destroy_sock(struct sock *sk)
1398 {
1399 lock_sock(sk);
1400 udp_flush_pending_frames(sk);
1401 release_sock(sk);
1402 }
1403
1404 /*
1405 * Socket option code for UDP
1406 */
1407 int udp_lib_setsockopt(struct sock *sk, int level, int optname,
1408 char __user *optval, unsigned int optlen,
1409 int (*push_pending_frames)(struct sock *))
1410 {
1411 struct udp_sock *up = udp_sk(sk);
1412 int val;
1413 int err = 0;
1414 int is_udplite = IS_UDPLITE(sk);
1415
1416 if (optlen < sizeof(int))
1417 return -EINVAL;
1418
1419 if (get_user(val, (int __user *)optval))
1420 return -EFAULT;
1421
1422 switch (optname) {
1423 case UDP_CORK:
1424 if (val != 0) {
1425 up->corkflag = 1;
1426 } else {
1427 up->corkflag = 0;
1428 lock_sock(sk);
1429 (*push_pending_frames)(sk);
1430 release_sock(sk);
1431 }
1432 break;
1433
1434 case UDP_ENCAP:
1435 switch (val) {
1436 case 0:
1437 case UDP_ENCAP_ESPINUDP:
1438 case UDP_ENCAP_ESPINUDP_NON_IKE:
1439 up->encap_rcv = xfrm4_udp_encap_rcv;
1440 /* FALLTHROUGH */
1441 case UDP_ENCAP_L2TPINUDP:
1442 up->encap_type = val;
1443 break;
1444 default:
1445 err = -ENOPROTOOPT;
1446 break;
1447 }
1448 break;
1449
1450 /*
1451 * UDP-Lite's partial checksum coverage (RFC 3828).
1452 */
1453 /* The sender sets actual checksum coverage length via this option.
1454 * The case coverage > packet length is handled by send module. */
1455 case UDPLITE_SEND_CSCOV:
1456 if (!is_udplite) /* Disable the option on UDP sockets */
1457 return -ENOPROTOOPT;
1458 if (val != 0 && val < 8) /* Illegal coverage: use default (8) */
1459 val = 8;
1460 else if (val > USHORT_MAX)
1461 val = USHORT_MAX;
1462 up->pcslen = val;
1463 up->pcflag |= UDPLITE_SEND_CC;
1464 break;
1465
1466 /* The receiver specifies a minimum checksum coverage value. To make
1467 * sense, this should be set to at least 8 (as done below). If zero is
1468 * used, this again means full checksum coverage. */
1469 case UDPLITE_RECV_CSCOV:
1470 if (!is_udplite) /* Disable the option on UDP sockets */
1471 return -ENOPROTOOPT;
1472 if (val != 0 && val < 8) /* Avoid silly minimal values. */
1473 val = 8;
1474 else if (val > USHORT_MAX)
1475 val = USHORT_MAX;
1476 up->pcrlen = val;
1477 up->pcflag |= UDPLITE_RECV_CC;
1478 break;
1479
1480 default:
1481 err = -ENOPROTOOPT;
1482 break;
1483 }
1484
1485 return err;
1486 }
1487 EXPORT_SYMBOL(udp_lib_setsockopt);
1488
1489 int udp_setsockopt(struct sock *sk, int level, int optname,
1490 char __user *optval, unsigned int optlen)
1491 {
1492 if (level == SOL_UDP || level == SOL_UDPLITE)
1493 return udp_lib_setsockopt(sk, level, optname, optval, optlen,
1494 udp_push_pending_frames);
1495 return ip_setsockopt(sk, level, optname, optval, optlen);
1496 }
1497
1498 #ifdef CONFIG_COMPAT
1499 int compat_udp_setsockopt(struct sock *sk, int level, int optname,
1500 char __user *optval, unsigned int optlen)
1501 {
1502 if (level == SOL_UDP || level == SOL_UDPLITE)
1503 return udp_lib_setsockopt(sk, level, optname, optval, optlen,
1504 udp_push_pending_frames);
1505 return compat_ip_setsockopt(sk, level, optname, optval, optlen);
1506 }
1507 #endif
1508
1509 int udp_lib_getsockopt(struct sock *sk, int level, int optname,
1510 char __user *optval, int __user *optlen)
1511 {
1512 struct udp_sock *up = udp_sk(sk);
1513 int val, len;
1514
1515 if (get_user(len, optlen))
1516 return -EFAULT;
1517
1518 len = min_t(unsigned int, len, sizeof(int));
1519
1520 if (len < 0)
1521 return -EINVAL;
1522
1523 switch (optname) {
1524 case UDP_CORK:
1525 val = up->corkflag;
1526 break;
1527
1528 case UDP_ENCAP:
1529 val = up->encap_type;
1530 break;
1531
1532 /* The following two cannot be changed on UDP sockets, the return is
1533 * always 0 (which corresponds to the full checksum coverage of UDP). */
1534 case UDPLITE_SEND_CSCOV:
1535 val = up->pcslen;
1536 break;
1537
1538 case UDPLITE_RECV_CSCOV:
1539 val = up->pcrlen;
1540 break;
1541
1542 default:
1543 return -ENOPROTOOPT;
1544 }
1545
1546 if (put_user(len, optlen))
1547 return -EFAULT;
1548 if (copy_to_user(optval, &val, len))
1549 return -EFAULT;
1550 return 0;
1551 }
1552 EXPORT_SYMBOL(udp_lib_getsockopt);
1553
1554 int udp_getsockopt(struct sock *sk, int level, int optname,
1555 char __user *optval, int __user *optlen)
1556 {
1557 if (level == SOL_UDP || level == SOL_UDPLITE)
1558 return udp_lib_getsockopt(sk, level, optname, optval, optlen);
1559 return ip_getsockopt(sk, level, optname, optval, optlen);
1560 }
1561
1562 #ifdef CONFIG_COMPAT
1563 int compat_udp_getsockopt(struct sock *sk, int level, int optname,
1564 char __user *optval, int __user *optlen)
1565 {
1566 if (level == SOL_UDP || level == SOL_UDPLITE)
1567 return udp_lib_getsockopt(sk, level, optname, optval, optlen);
1568 return compat_ip_getsockopt(sk, level, optname, optval, optlen);
1569 }
1570 #endif
1571 /**
1572 * udp_poll - wait for a UDP event.
1573 * @file - file struct
1574 * @sock - socket
1575 * @wait - poll table
1576 *
1577 * This is same as datagram poll, except for the special case of
1578 * blocking sockets. If application is using a blocking fd
1579 * and a packet with checksum error is in the queue;
1580 * then it could get return from select indicating data available
1581 * but then block when reading it. Add special case code
1582 * to work around these arguably broken applications.
1583 */
1584 unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
1585 {
1586 unsigned int mask = datagram_poll(file, sock, wait);
1587 struct sock *sk = sock->sk;
1588
1589 /* Check for false positives due to checksum errors */
1590 if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
1591 !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk))
1592 mask &= ~(POLLIN | POLLRDNORM);
1593
1594 return mask;
1595
1596 }
1597 EXPORT_SYMBOL(udp_poll);
1598
1599 struct proto udp_prot = {
1600 .name = "UDP",
1601 .owner = THIS_MODULE,
1602 .close = udp_lib_close,
1603 .connect = ip4_datagram_connect,
1604 .disconnect = udp_disconnect,
1605 .ioctl = udp_ioctl,
1606 .destroy = udp_destroy_sock,
1607 .setsockopt = udp_setsockopt,
1608 .getsockopt = udp_getsockopt,
1609 .sendmsg = udp_sendmsg,
1610 .recvmsg = udp_recvmsg,
1611 .sendpage = udp_sendpage,
1612 .backlog_rcv = __udp_queue_rcv_skb,
1613 .hash = udp_lib_hash,
1614 .unhash = udp_lib_unhash,
1615 .get_port = udp_v4_get_port,
1616 .memory_allocated = &udp_memory_allocated,
1617 .sysctl_mem = sysctl_udp_mem,
1618 .sysctl_wmem = &sysctl_udp_wmem_min,
1619 .sysctl_rmem = &sysctl_udp_rmem_min,
1620 .obj_size = sizeof(struct udp_sock),
1621 .slab_flags = SLAB_DESTROY_BY_RCU,
1622 .h.udp_table = &udp_table,
1623 #ifdef CONFIG_COMPAT
1624 .compat_setsockopt = compat_udp_setsockopt,
1625 .compat_getsockopt = compat_udp_getsockopt,
1626 #endif
1627 };
1628 EXPORT_SYMBOL(udp_prot);
1629
1630 /* ------------------------------------------------------------------------ */
1631 #ifdef CONFIG_PROC_FS
1632
1633 static struct sock *udp_get_first(struct seq_file *seq, int start)
1634 {
1635 struct sock *sk;
1636 struct udp_iter_state *state = seq->private;
1637 struct net *net = seq_file_net(seq);
1638
1639 for (state->bucket = start; state->bucket < UDP_HTABLE_SIZE; ++state->bucket) {
1640 struct hlist_nulls_node *node;
1641 struct udp_hslot *hslot = &state->udp_table->hash[state->bucket];
1642 spin_lock_bh(&hslot->lock);
1643 sk_nulls_for_each(sk, node, &hslot->head) {
1644 if (!net_eq(sock_net(sk), net))
1645 continue;
1646 if (sk->sk_family == state->family)
1647 goto found;
1648 }
1649 spin_unlock_bh(&hslot->lock);
1650 }
1651 sk = NULL;
1652 found:
1653 return sk;
1654 }
1655
1656 static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
1657 {
1658 struct udp_iter_state *state = seq->private;
1659 struct net *net = seq_file_net(seq);
1660
1661 do {
1662 sk = sk_nulls_next(sk);
1663 } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
1664
1665 if (!sk) {
1666 if (state->bucket < UDP_HTABLE_SIZE)
1667 spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
1668 return udp_get_first(seq, state->bucket + 1);
1669 }
1670 return sk;
1671 }
1672
1673 static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
1674 {
1675 struct sock *sk = udp_get_first(seq, 0);
1676
1677 if (sk)
1678 while (pos && (sk = udp_get_next(seq, sk)) != NULL)
1679 --pos;
1680 return pos ? NULL : sk;
1681 }
1682
1683 static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
1684 {
1685 struct udp_iter_state *state = seq->private;
1686 state->bucket = UDP_HTABLE_SIZE;
1687
1688 return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
1689 }
1690
1691 static void *udp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1692 {
1693 struct sock *sk;
1694
1695 if (v == SEQ_START_TOKEN)
1696 sk = udp_get_idx(seq, 0);
1697 else
1698 sk = udp_get_next(seq, v);
1699
1700 ++*pos;
1701 return sk;
1702 }
1703
1704 static void udp_seq_stop(struct seq_file *seq, void *v)
1705 {
1706 struct udp_iter_state *state = seq->private;
1707
1708 if (state->bucket < UDP_HTABLE_SIZE)
1709 spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
1710 }
1711
1712 static int udp_seq_open(struct inode *inode, struct file *file)
1713 {
1714 struct udp_seq_afinfo *afinfo = PDE(inode)->data;
1715 struct udp_iter_state *s;
1716 int err;
1717
1718 err = seq_open_net(inode, file, &afinfo->seq_ops,
1719 sizeof(struct udp_iter_state));
1720 if (err < 0)
1721 return err;
1722
1723 s = ((struct seq_file *)file->private_data)->private;
1724 s->family = afinfo->family;
1725 s->udp_table = afinfo->udp_table;
1726 return err;
1727 }
1728
1729 /* ------------------------------------------------------------------------ */
1730 int udp_proc_register(struct net *net, struct udp_seq_afinfo *afinfo)
1731 {
1732 struct proc_dir_entry *p;
1733 int rc = 0;
1734
1735 afinfo->seq_fops.open = udp_seq_open;
1736 afinfo->seq_fops.read = seq_read;
1737 afinfo->seq_fops.llseek = seq_lseek;
1738 afinfo->seq_fops.release = seq_release_net;
1739
1740 afinfo->seq_ops.start = udp_seq_start;
1741 afinfo->seq_ops.next = udp_seq_next;
1742 afinfo->seq_ops.stop = udp_seq_stop;
1743
1744 p = proc_create_data(afinfo->name, S_IRUGO, net->proc_net,
1745 &afinfo->seq_fops, afinfo);
1746 if (!p)
1747 rc = -ENOMEM;
1748 return rc;
1749 }
1750 EXPORT_SYMBOL(udp_proc_register);
1751
1752 void udp_proc_unregister(struct net *net, struct udp_seq_afinfo *afinfo)
1753 {
1754 proc_net_remove(net, afinfo->name);
1755 }
1756 EXPORT_SYMBOL(udp_proc_unregister);
1757
1758 /* ------------------------------------------------------------------------ */
1759 static void udp4_format_sock(struct sock *sp, struct seq_file *f,
1760 int bucket, int *len)
1761 {
1762 struct inet_sock *inet = inet_sk(sp);
1763 __be32 dest = inet->daddr;
1764 __be32 src = inet->rcv_saddr;
1765 __u16 destp = ntohs(inet->dport);
1766 __u16 srcp = ntohs(inet->sport);
1767
1768 seq_printf(f, "%4d: %08X:%04X %08X:%04X"
1769 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d%n",
1770 bucket, src, srcp, dest, destp, sp->sk_state,
1771 sk_wmem_alloc_get(sp),
1772 sk_rmem_alloc_get(sp),
1773 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
1774 atomic_read(&sp->sk_refcnt), sp,
1775 atomic_read(&sp->sk_drops), len);
1776 }
1777
1778 int udp4_seq_show(struct seq_file *seq, void *v)
1779 {
1780 if (v == SEQ_START_TOKEN)
1781 seq_printf(seq, "%-127s\n",
1782 " sl local_address rem_address st tx_queue "
1783 "rx_queue tr tm->when retrnsmt uid timeout "
1784 "inode ref pointer drops");
1785 else {
1786 struct udp_iter_state *state = seq->private;
1787 int len;
1788
1789 udp4_format_sock(v, seq, state->bucket, &len);
1790 seq_printf(seq, "%*s\n", 127 - len, "");
1791 }
1792 return 0;
1793 }
1794
1795 /* ------------------------------------------------------------------------ */
1796 static struct udp_seq_afinfo udp4_seq_afinfo = {
1797 .name = "udp",
1798 .family = AF_INET,
1799 .udp_table = &udp_table,
1800 .seq_fops = {
1801 .owner = THIS_MODULE,
1802 },
1803 .seq_ops = {
1804 .show = udp4_seq_show,
1805 },
1806 };
1807
1808 static int udp4_proc_init_net(struct net *net)
1809 {
1810 return udp_proc_register(net, &udp4_seq_afinfo);
1811 }
1812
1813 static void udp4_proc_exit_net(struct net *net)
1814 {
1815 udp_proc_unregister(net, &udp4_seq_afinfo);
1816 }
1817
1818 static struct pernet_operations udp4_net_ops = {
1819 .init = udp4_proc_init_net,
1820 .exit = udp4_proc_exit_net,
1821 };
1822
1823 int __init udp4_proc_init(void)
1824 {
1825 return register_pernet_subsys(&udp4_net_ops);
1826 }
1827
1828 void udp4_proc_exit(void)
1829 {
1830 unregister_pernet_subsys(&udp4_net_ops);
1831 }
1832 #endif /* CONFIG_PROC_FS */
1833
1834 void __init udp_table_init(struct udp_table *table)
1835 {
1836 int i;
1837
1838 for (i = 0; i < UDP_HTABLE_SIZE; i++) {
1839 INIT_HLIST_NULLS_HEAD(&table->hash[i].head, i);
1840 spin_lock_init(&table->hash[i].lock);
1841 }
1842 }
1843
1844 void __init udp_init(void)
1845 {
1846 unsigned long nr_pages, limit;
1847
1848 udp_table_init(&udp_table);
1849 /* Set the pressure threshold up by the same strategy of TCP. It is a
1850 * fraction of global memory that is up to 1/2 at 256 MB, decreasing
1851 * toward zero with the amount of memory, with a floor of 128 pages,
1852 * and a ceiling that prevents an integer overflow.
1853 */
1854 nr_pages = totalram_pages - totalhigh_pages;
1855 limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
1856 limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
1857 limit = max(limit, 128UL);
1858 limit = min(limit, INT_MAX * 4UL / 3 / 2);
1859 sysctl_udp_mem[0] = limit / 4 * 3;
1860 sysctl_udp_mem[1] = limit;
1861 sysctl_udp_mem[2] = sysctl_udp_mem[0] * 2;
1862
1863 sysctl_udp_rmem_min = SK_MEM_QUANTUM;
1864 sysctl_udp_wmem_min = SK_MEM_QUANTUM;
1865 }
1866
1867 int udp4_ufo_send_check(struct sk_buff *skb)
1868 {
1869 const struct iphdr *iph;
1870 struct udphdr *uh;
1871
1872 if (!pskb_may_pull(skb, sizeof(*uh)))
1873 return -EINVAL;
1874
1875 iph = ip_hdr(skb);
1876 uh = udp_hdr(skb);
1877
1878 uh->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
1879 IPPROTO_UDP, 0);
1880 skb->csum_start = skb_transport_header(skb) - skb->head;
1881 skb->csum_offset = offsetof(struct udphdr, check);
1882 skb->ip_summed = CHECKSUM_PARTIAL;
1883 return 0;
1884 }
1885
1886 struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb, int features)
1887 {
1888 struct sk_buff *segs = ERR_PTR(-EINVAL);
1889 unsigned int mss;
1890 int offset;
1891 __wsum csum;
1892
1893 mss = skb_shinfo(skb)->gso_size;
1894 if (unlikely(skb->len <= mss))
1895 goto out;
1896
1897 if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
1898 /* Packet is from an untrusted source, reset gso_segs. */
1899 int type = skb_shinfo(skb)->gso_type;
1900
1901 if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY) ||
1902 !(type & (SKB_GSO_UDP))))
1903 goto out;
1904
1905 skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
1906
1907 segs = NULL;
1908 goto out;
1909 }
1910
1911 /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
1912 * do checksum of UDP packets sent as multiple IP fragments.
1913 */
1914 offset = skb->csum_start - skb_headroom(skb);
1915 csum = skb_checksum(skb, offset, skb->len - offset, 0);
1916 offset += skb->csum_offset;
1917 *(__sum16 *)(skb->data + offset) = csum_fold(csum);
1918 skb->ip_summed = CHECKSUM_NONE;
1919
1920 /* Fragment the skb. IP headers of the fragments are updated in
1921 * inet_gso_segment()
1922 */
1923 segs = skb_segment(skb, features);
1924 out:
1925 return segs;
1926 }
1927
1928
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.