Author: karels
Date: Sat Jun 20 20:10:42 2020
New Revision: 362446
URL: https://svnweb.freebsd.org/changeset/base/362446
Log:
Allow TCP to reuse local port with different destinations
MFC r361228, r361231:
Previously, tcp_connect() would bind a local port before connecting,
forcing the local port to be unique across all outgoing TCP connections
for the address family. Instead, choose a local port after selecting
the destination and the local address, requiring only that the tuple
is unique and does not match a wildcard binding.
Note that in_pcb_lport and in_pcb_lport_dest can be called with a NULL
local address for IPv6 sockets; handle it.
Sponsored by: Forcepoint LLC
Modified:
stable/12/sys/netinet/in_pcb.c
stable/12/sys/netinet/in_pcb.h
stable/12/sys/netinet/tcp_usrreq.c
stable/12/sys/netinet6/in6_pcb.c
stable/12/sys/netinet6/in6_pcb.h
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/sys/netinet/in_pcb.c
==============================================================================
--- stable/12/sys/netinet/in_pcb.c Sat Jun 20 20:06:52 2020
(r362445)
+++ stable/12/sys/netinet/in_pcb.c Sat Jun 20 20:10:42 2020
(r362446)
@@ -591,13 +591,16 @@ in_pcbbind(struct inpcb *inp, struct sockaddr *nam, st
}
#endif
+#if defined(INET) || defined(INET6)
/*
- * Select a local port (number) to use.
+ * Assign a local port like in_pcb_lport(), but also used with connect()
+ * and a foreign address and port. If fsa is non-NULL, choose a local port
+ * that is unused with those, otherwise one that is completely unused.
+ * lsa can be NULL for IPv6.
*/
-#if defined(INET) || defined(INET6)
int
-in_pcb_lport(struct inpcb *inp, struct in_addr *laddrp, u_short *lportp,
- struct ucred *cred, int lookupflags)
+in_pcb_lport_dest(struct inpcb *inp, struct sockaddr *lsa, u_short *lportp,
+ struct sockaddr *fsa, u_short fport, struct ucred *cred, int lookupflags)
{
struct inpcbinfo *pcbinfo;
struct inpcb *tmpinp;
@@ -605,8 +608,11 @@ in_pcb_lport(struct inpcb *inp, struct in_addr *laddrp
int count, dorandom, error;
u_short aux, first, last, lport;
#ifdef INET
- struct in_addr laddr;
+ struct in_addr laddr, faddr;
#endif
+#ifdef INET6
+ struct in6_addr *laddr6, *faddr6;
+#endif
pcbinfo = inp->inp_pcbinfo;
@@ -666,15 +672,25 @@ in_pcb_lport(struct inpcb *inp, struct in_addr *laddrp
}
#ifdef INET
- /* Make the compiler happy. */
- laddr.s_addr = 0;
+ laddr.s_addr = INADDR_ANY;
if ((inp->inp_vflag & (INP_IPV4|INP_IPV6)) == INP_IPV4) {
- KASSERT(laddrp != NULL, ("%s: laddrp NULL for v4 inp %p",
- __func__, inp));
- laddr = *laddrp;
+ if (lsa != NULL)
+ laddr = ((struct sockaddr_in *)lsa)->sin_addr;
+ if (fsa != NULL)
+ faddr = ((struct sockaddr_in *)fsa)->sin_addr;
}
#endif
- tmpinp = NULL; /* Make compiler happy. */
+#ifdef INET6
+ laddr6 = NULL;
+ if ((inp->inp_vflag & INP_IPV6) != 0) {
+ if (lsa != NULL)
+ laddr6 = &((struct sockaddr_in6 *)lsa)->sin6_addr;
+ if (fsa != NULL)
+ faddr6 = &((struct sockaddr_in6 *)fsa)->sin6_addr;
+ }
+#endif
+
+ tmpinp = NULL;
lport = *lportp;
if (dorandom)
@@ -690,30 +706,62 @@ in_pcb_lport(struct inpcb *inp, struct in_addr *laddrp
*lastport = first;
lport = htons(*lastport);
+ if (fsa != NULL) {
+
+#ifdef INET
+ if (lsa->sa_family == AF_INET) {
+ tmpinp = in_pcblookup_hash_locked(pcbinfo,
+ faddr, fport, laddr, lport, lookupflags,
+ NULL);
+ }
+#endif
#ifdef INET6
- if ((inp->inp_vflag & INP_IPV6) != 0)
- tmpinp = in6_pcblookup_local(pcbinfo,
- &inp->in6p_laddr, lport, lookupflags, cred);
+ if (lsa->sa_family == AF_INET6) {
+ tmpinp = in6_pcblookup_hash_locked(pcbinfo,
+ faddr6, fport, laddr6, lport, lookupflags,
+ NULL);
+ }
#endif
+ } else {
+#ifdef INET6
+ if ((inp->inp_vflag & INP_IPV6) != 0)
+ tmpinp = in6_pcblookup_local(pcbinfo,
+ &inp->in6p_laddr, lport, lookupflags, cred);
+#endif
#if defined(INET) && defined(INET6)
- else
+ else
#endif
#ifdef INET
- tmpinp = in_pcblookup_local(pcbinfo, laddr,
- lport, lookupflags, cred);
+ tmpinp = in_pcblookup_local(pcbinfo, laddr,
+ lport, lookupflags, cred);
#endif
+ }
} while (tmpinp != NULL);
-#ifdef INET
- if ((inp->inp_vflag & (INP_IPV4|INP_IPV6)) == INP_IPV4)
- laddrp->s_addr = laddr.s_addr;
-#endif
*lportp = lport;
return (0);
}
/*
+ * Select a local port (number) to use.
+ */
+int
+in_pcb_lport(struct inpcb *inp, struct in_addr *laddrp, u_short *lportp,
+ struct ucred *cred, int lookupflags)
+{
+ struct sockaddr_in laddr;
+
+ if (laddrp) {
+ bzero(&laddr, sizeof(laddr));
+ laddr.sin_family = AF_INET;
+ laddr.sin_addr = *laddrp;
+ }
+ return (in_pcb_lport_dest(inp, laddrp ? (struct sockaddr *) &laddr :
+ NULL, lportp, NULL, 0, cred, lookupflags));
+}
+
+/*
* Return cached socket options.
*/
int
@@ -1327,16 +1375,26 @@ in_pcbconnect_setup(struct inpcb *inp, struct sockaddr
if (error)
return (error);
}
- oinp = in_pcblookup_hash_locked(inp->inp_pcbinfo, faddr, fport,
- laddr, lport, 0, NULL);
- if (oinp != NULL) {
- if (oinpp != NULL)
- *oinpp = oinp;
- return (EADDRINUSE);
- }
- if (lport == 0) {
- error = in_pcbbind_setup(inp, NULL, &laddr.s_addr, &lport,
- cred);
+ if (lport != 0) {
+ oinp = in_pcblookup_hash_locked(inp->inp_pcbinfo, faddr,
+ fport, laddr, lport, 0, NULL);
+ if (oinp != NULL) {
+ if (oinpp != NULL)
+ *oinpp = oinp;
+ return (EADDRINUSE);
+ }
+ } else {
+ struct sockaddr_in lsin, fsin;
+
+ bzero(&lsin, sizeof(lsin));
+ bzero(&fsin, sizeof(fsin));
+ lsin.sin_family = AF_INET;
+ lsin.sin_addr = laddr;
+ fsin.sin_family = AF_INET;
+ fsin.sin_addr = faddr;
+ error = in_pcb_lport_dest(inp, (struct sockaddr *) &lsin,
+ &lport, (struct sockaddr *)& fsin, fport, cred,
+ INPLOOKUP_WILDCARD);
if (error)
return (error);
}
Modified: stable/12/sys/netinet/in_pcb.h
==============================================================================
--- stable/12/sys/netinet/in_pcb.h Sat Jun 20 20:06:52 2020
(r362445)
+++ stable/12/sys/netinet/in_pcb.h Sat Jun 20 20:10:42 2020
(r362446)
@@ -837,6 +837,9 @@ void in_pcbgroup_update_mbuf(struct inpcb *, struct
mb
void in_pcbpurgeif0(struct inpcbinfo *, struct ifnet *);
int in_pcballoc(struct socket *, struct inpcbinfo *);
int in_pcbbind(struct inpcb *, struct sockaddr *, struct ucred *);
+int in_pcb_lport_dest(struct inpcb *inp, struct sockaddr *lsa,
+ u_short *lportp, struct sockaddr *fsa, u_short fport,
+ struct ucred *cred, int lookupflags);
int in_pcb_lport(struct inpcb *, struct in_addr *, u_short *,
struct ucred *, int);
int in_pcbbind_setup(struct inpcb *, struct sockaddr *, in_addr_t *,
Modified: stable/12/sys/netinet/tcp_usrreq.c
==============================================================================
--- stable/12/sys/netinet/tcp_usrreq.c Sat Jun 20 20:06:52 2020
(r362445)
+++ stable/12/sys/netinet/tcp_usrreq.c Sat Jun 20 20:10:42 2020
(r362446)
@@ -134,6 +134,16 @@ static void tcp_fill_info(struct tcpcb *, struct
tcp_i
#endif
/*
+ * tcp_require_unique port requires a globally-unique source port for each
+ * outgoing connection. The default is to require the 4-tuple to be unique.
+ */
+VNET_DEFINE(int, tcp_require_unique_port) = 0;
+SYSCTL_INT(_net_inet_tcp, OID_AUTO, require_unique_port,
+ CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(tcp_require_unique_port), 0,
+ "Require globally-unique ephemeral port for outgoing connections");
+#define V_tcp_require_unique_port VNET(tcp_require_unique_port)
+
+/*
* TCP attaches to socket via pru_attach(), reserving space,
* and an internet control block.
*/
@@ -1456,7 +1466,7 @@ tcp_connect(struct tcpcb *tp, struct sockaddr *nam, st
INP_WLOCK_ASSERT(inp);
INP_HASH_WLOCK(&V_tcbinfo);
- if (inp->inp_lport == 0) {
+ if (V_tcp_require_unique_port && inp->inp_lport == 0) {
error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
if (error)
goto out;
@@ -1477,6 +1487,15 @@ tcp_connect(struct tcpcb *tp, struct sockaddr *nam, st
error = EADDRINUSE;
goto out;
}
+ /* Handle initial bind if it hadn't been done in advance. */
+ if (inp->inp_lport == 0) {
+ inp->inp_lport = lport;
+ if (in_pcbinshash(inp) != 0) {
+ inp->inp_lport = 0;
+ error = EAGAIN;
+ goto out;
+ }
+ }
inp->inp_laddr = laddr;
in_pcbrehash(inp);
INP_HASH_WUNLOCK(&V_tcbinfo);
@@ -1516,7 +1535,7 @@ tcp6_connect(struct tcpcb *tp, struct sockaddr *nam, s
INP_WLOCK_ASSERT(inp);
INP_HASH_WLOCK(&V_tcbinfo);
- if (inp->inp_lport == 0) {
+ if (V_tcp_require_unique_port && inp->inp_lport == 0) {
error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
if (error)
goto out;
Modified: stable/12/sys/netinet6/in6_pcb.c
==============================================================================
--- stable/12/sys/netinet6/in6_pcb.c Sat Jun 20 20:06:52 2020
(r362445)
+++ stable/12/sys/netinet6/in6_pcb.c Sat Jun 20 20:10:42 2020
(r362446)
@@ -111,9 +111,6 @@ __FBSDID("$FreeBSD$");
#include <netinet6/in6_pcb.h>
#include <netinet6/scope6_var.h>
-static struct inpcb *in6_pcblookup_hash_locked(struct inpcbinfo *,
- struct in6_addr *, u_int, struct in6_addr *, u_int, int, struct ifnet *);
-
int
in6_pcbbind(struct inpcb *inp, struct sockaddr *nam,
struct ucred *cred)
@@ -416,9 +413,13 @@ in6_pcbconnect_mbuf(struct inpcb *inp, struct sockaddr
{
struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
- struct in6_addr addr6;
+ struct sockaddr_in6 laddr6;
int error;
+ bool rehash = true;
+ bzero(&laddr6, sizeof(laddr6));
+ laddr6.sin6_family = AF_INET6;
+
INP_WLOCK_ASSERT(inp);
INP_HASH_WLOCK_ASSERT(pcbinfo);
@@ -426,23 +427,26 @@ in6_pcbconnect_mbuf(struct inpcb *inp, struct sockaddr
* Call inner routine, to assign local interface address.
* in6_pcbladdr() may automatically fill in sin6_scope_id.
*/
- if ((error = in6_pcbladdr(inp, nam, &addr6)) != 0)
+ if ((error = in6_pcbladdr(inp, nam, &laddr6.sin6_addr)) != 0)
return (error);
if (in6_pcblookup_hash_locked(pcbinfo, &sin6->sin6_addr,
sin6->sin6_port,
IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)
- ? &addr6 : &inp->in6p_laddr,
+ ? &laddr6.sin6_addr : &inp->in6p_laddr,
inp->inp_lport, 0, NULL) != NULL) {
return (EADDRINUSE);
}
if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
if (inp->inp_lport == 0) {
- error = in6_pcbbind(inp, (struct sockaddr *)0, cred);
+ rehash = false;
+ error = in_pcb_lport_dest(inp,
+ (struct sockaddr *) &laddr6, &inp->inp_lport,
+ (struct sockaddr *) sin6, sin6->sin6_port, cred, 0);
if (error)
return (error);
}
- inp->in6p_laddr = addr6;
+ inp->in6p_laddr = laddr6.sin6_addr;
}
inp->in6p_faddr = sin6->sin6_addr;
inp->inp_fport = sin6->sin6_port;
@@ -452,7 +456,11 @@ in6_pcbconnect_mbuf(struct inpcb *inp, struct sockaddr
inp->inp_flow |=
(htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
- in_pcbrehash_mbuf(inp, m);
+ if (rehash) {
+ in_pcbrehash_mbuf(inp, m);
+ } else {
+ in_pcbinshash(inp);
+ }
return (0);
}
@@ -1115,9 +1123,9 @@ found:
#endif /* PCBGROUP */
/*
- * Lookup PCB in hash list.
+ * Lookup PCB in hash list. Used in in_pcb.c as well as here.
*/
-static struct inpcb *
+struct inpcb *
in6_pcblookup_hash_locked(struct inpcbinfo *pcbinfo, struct in6_addr *faddr,
u_int fport_arg, struct in6_addr *laddr, u_int lport_arg,
int lookupflags, struct ifnet *ifp)
Modified: stable/12/sys/netinet6/in6_pcb.h
==============================================================================
--- stable/12/sys/netinet6/in6_pcb.h Sat Jun 20 20:06:52 2020
(r362445)
+++ stable/12/sys/netinet6/in6_pcb.h Sat Jun 20 20:10:42 2020
(r362446)
@@ -92,6 +92,10 @@ struct inpcb *
in6_pcblookup_local(struct inpcbinfo *,
struct in6_addr *, u_short, int,
struct ucred *);
+struct inpcb *
+ in6_pcblookup_hash_locked(struct inpcbinfo *pcbinfo,
+ struct in6_addr *faddr, u_int fport_arg, struct in6_addr *laddr,
+ u_int lport_arg, int lookupflags, struct ifnet *ifp);
struct inpcb *
in6_pcblookup(struct inpcbinfo *, struct in6_addr *,
u_int, struct in6_addr *, u_int, int,
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
