xref: /freebsd/sys/netinet/in.c (revision f61e92ca5a23450bc28169bbdd71d7674df98c19)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * Copyright (C) 2001 WIDE Project.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	@(#)in.c	8.4 (Berkeley) 1/9/95
33  */
34 
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD$");
37 
38 #include <sys/param.h>
39 #include <sys/eventhandler.h>
40 #include <sys/systm.h>
41 #include <sys/sockio.h>
42 #include <sys/malloc.h>
43 #include <sys/priv.h>
44 #include <sys/socket.h>
45 #include <sys/jail.h>
46 #include <sys/kernel.h>
47 #include <sys/lock.h>
48 #include <sys/proc.h>
49 #include <sys/rmlock.h>
50 #include <sys/sysctl.h>
51 #include <sys/syslog.h>
52 #include <sys/sx.h>
53 
54 #include <net/if.h>
55 #include <net/if_var.h>
56 #include <net/if_arp.h>
57 #include <net/if_dl.h>
58 #include <net/if_llatbl.h>
59 #include <net/if_types.h>
60 #include <net/route.h>
61 #include <net/route/nhop.h>
62 #include <net/route/route_ctl.h>
63 #include <net/vnet.h>
64 
65 #include <netinet/if_ether.h>
66 #include <netinet/in.h>
67 #include <netinet/in_var.h>
68 #include <netinet/in_pcb.h>
69 #include <netinet/ip_var.h>
70 #include <netinet/ip_carp.h>
71 #include <netinet/igmp_var.h>
72 #include <netinet/udp.h>
73 #include <netinet/udp_var.h>
74 
75 static int in_aifaddr_ioctl(u_long, caddr_t, struct ifnet *, struct thread *);
76 static int in_difaddr_ioctl(u_long, caddr_t, struct ifnet *, struct thread *);
77 static int in_gifaddr_ioctl(u_long, caddr_t, struct ifnet *, struct thread *);
78 
79 static void	in_socktrim(struct sockaddr_in *);
80 static void	in_purgemaddrs(struct ifnet *);
81 
82 static bool	ia_need_loopback_route(const struct in_ifaddr *);
83 
84 VNET_DEFINE_STATIC(int, nosameprefix);
85 #define	V_nosameprefix			VNET(nosameprefix)
86 SYSCTL_INT(_net_inet_ip, OID_AUTO, no_same_prefix, CTLFLAG_VNET | CTLFLAG_RW,
87 	&VNET_NAME(nosameprefix), 0,
88 	"Refuse to create same prefixes on different interfaces");
89 
90 VNET_DECLARE(struct inpcbinfo, ripcbinfo);
91 #define	V_ripcbinfo			VNET(ripcbinfo)
92 
93 static struct sx in_control_sx;
94 SX_SYSINIT(in_control_sx, &in_control_sx, "in_control");
95 
96 /*
97  * Return 1 if an internet address is for a ``local'' host
98  * (one to which we have a connection).
99  */
100 int
101 in_localaddr(struct in_addr in)
102 {
103 	struct rm_priotracker in_ifa_tracker;
104 	u_long i = ntohl(in.s_addr);
105 	struct in_ifaddr *ia;
106 
107 	IN_IFADDR_RLOCK(&in_ifa_tracker);
108 	CK_STAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) {
109 		if ((i & ia->ia_subnetmask) == ia->ia_subnet) {
110 			IN_IFADDR_RUNLOCK(&in_ifa_tracker);
111 			return (1);
112 		}
113 	}
114 	IN_IFADDR_RUNLOCK(&in_ifa_tracker);
115 	return (0);
116 }
117 
118 /*
119  * Return 1 if an internet address is for the local host and configured
120  * on one of its interfaces.
121  */
122 int
123 in_localip(struct in_addr in)
124 {
125 	struct rm_priotracker in_ifa_tracker;
126 	struct in_ifaddr *ia;
127 
128 	IN_IFADDR_RLOCK(&in_ifa_tracker);
129 	LIST_FOREACH(ia, INADDR_HASH(in.s_addr), ia_hash) {
130 		if (IA_SIN(ia)->sin_addr.s_addr == in.s_addr) {
131 			IN_IFADDR_RUNLOCK(&in_ifa_tracker);
132 			return (1);
133 		}
134 	}
135 	IN_IFADDR_RUNLOCK(&in_ifa_tracker);
136 	return (0);
137 }
138 
139 /*
140  * Return 1 if an internet address is configured on an interface.
141  */
142 int
143 in_ifhasaddr(struct ifnet *ifp, struct in_addr in)
144 {
145 	struct ifaddr *ifa;
146 	struct in_ifaddr *ia;
147 
148 	NET_EPOCH_ASSERT();
149 
150 	CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
151 		if (ifa->ifa_addr->sa_family != AF_INET)
152 			continue;
153 		ia = (struct in_ifaddr *)ifa;
154 		if (ia->ia_addr.sin_addr.s_addr == in.s_addr)
155 			return (1);
156 	}
157 
158 	return (0);
159 }
160 
161 /*
162  * Return a reference to the interface address which is different to
163  * the supplied one but with same IP address value.
164  */
165 static struct in_ifaddr *
166 in_localip_more(struct in_ifaddr *original_ia)
167 {
168 	struct rm_priotracker in_ifa_tracker;
169 	in_addr_t original_addr = IA_SIN(original_ia)->sin_addr.s_addr;
170 	uint32_t original_fib = original_ia->ia_ifa.ifa_ifp->if_fib;
171 	struct in_ifaddr *ia;
172 
173 	IN_IFADDR_RLOCK(&in_ifa_tracker);
174 	LIST_FOREACH(ia, INADDR_HASH(original_addr), ia_hash) {
175 		in_addr_t addr = IA_SIN(ia)->sin_addr.s_addr;
176 		uint32_t fib = ia->ia_ifa.ifa_ifp->if_fib;
177 		if (!V_rt_add_addr_allfibs && (original_fib != fib))
178 			continue;
179 		if ((original_ia != ia) && (original_addr == addr)) {
180 			ifa_ref(&ia->ia_ifa);
181 			IN_IFADDR_RUNLOCK(&in_ifa_tracker);
182 			return (ia);
183 		}
184 	}
185 	IN_IFADDR_RUNLOCK(&in_ifa_tracker);
186 
187 	return (NULL);
188 }
189 
190 /*
191  * Determine whether an IP address is in a reserved set of addresses
192  * that may not be forwarded, or whether datagrams to that destination
193  * may be forwarded.
194  */
195 int
196 in_canforward(struct in_addr in)
197 {
198 	u_long i = ntohl(in.s_addr);
199 
200 	if (IN_EXPERIMENTAL(i) || IN_MULTICAST(i) || IN_LINKLOCAL(i) ||
201 	    IN_ZERONET(i) || IN_LOOPBACK(i))
202 		return (0);
203 	return (1);
204 }
205 
206 /*
207  * Trim a mask in a sockaddr
208  */
209 static void
210 in_socktrim(struct sockaddr_in *ap)
211 {
212     char *cplim = (char *) &ap->sin_addr;
213     char *cp = (char *) (&ap->sin_addr + 1);
214 
215     ap->sin_len = 0;
216     while (--cp >= cplim)
217 	if (*cp) {
218 	    (ap)->sin_len = cp - (char *) (ap) + 1;
219 	    break;
220 	}
221 }
222 
223 /*
224  * Generic internet control operations (ioctl's).
225  */
226 int
227 in_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp,
228     struct thread *td)
229 {
230 	struct ifreq *ifr = (struct ifreq *)data;
231 	struct sockaddr_in *addr = (struct sockaddr_in *)&ifr->ifr_addr;
232 	struct epoch_tracker et;
233 	struct ifaddr *ifa;
234 	struct in_ifaddr *ia;
235 	int error;
236 
237 	if (ifp == NULL)
238 		return (EADDRNOTAVAIL);
239 
240 	/*
241 	 * Filter out 4 ioctls we implement directly.  Forward the rest
242 	 * to specific functions and ifp->if_ioctl().
243 	 */
244 	switch (cmd) {
245 	case SIOCGIFADDR:
246 	case SIOCGIFBRDADDR:
247 	case SIOCGIFDSTADDR:
248 	case SIOCGIFNETMASK:
249 		break;
250 	case SIOCGIFALIAS:
251 		sx_xlock(&in_control_sx);
252 		error = in_gifaddr_ioctl(cmd, data, ifp, td);
253 		sx_xunlock(&in_control_sx);
254 		return (error);
255 	case SIOCDIFADDR:
256 		sx_xlock(&in_control_sx);
257 		error = in_difaddr_ioctl(cmd, data, ifp, td);
258 		sx_xunlock(&in_control_sx);
259 		return (error);
260 	case OSIOCAIFADDR:	/* 9.x compat */
261 	case SIOCAIFADDR:
262 		sx_xlock(&in_control_sx);
263 		error = in_aifaddr_ioctl(cmd, data, ifp, td);
264 		sx_xunlock(&in_control_sx);
265 		return (error);
266 	case SIOCSIFADDR:
267 	case SIOCSIFBRDADDR:
268 	case SIOCSIFDSTADDR:
269 	case SIOCSIFNETMASK:
270 		/* We no longer support that old commands. */
271 		return (EINVAL);
272 	default:
273 		if (ifp->if_ioctl == NULL)
274 			return (EOPNOTSUPP);
275 		return ((*ifp->if_ioctl)(ifp, cmd, data));
276 	}
277 
278 	if (addr->sin_addr.s_addr != INADDR_ANY &&
279 	    prison_check_ip4(td->td_ucred, &addr->sin_addr) != 0)
280 		return (EADDRNOTAVAIL);
281 
282 	/*
283 	 * Find address for this interface, if it exists.  If an
284 	 * address was specified, find that one instead of the
285 	 * first one on the interface, if possible.
286 	 */
287 	NET_EPOCH_ENTER(et);
288 	CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
289 		if (ifa->ifa_addr->sa_family != AF_INET)
290 			continue;
291 		ia = (struct in_ifaddr *)ifa;
292 		if (ia->ia_addr.sin_addr.s_addr == addr->sin_addr.s_addr)
293 			break;
294 	}
295 	if (ifa == NULL)
296 		CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
297 			if (ifa->ifa_addr->sa_family == AF_INET) {
298 				ia = (struct in_ifaddr *)ifa;
299 				if (prison_check_ip4(td->td_ucred,
300 				    &ia->ia_addr.sin_addr) == 0)
301 					break;
302 			}
303 
304 	if (ifa == NULL) {
305 		NET_EPOCH_EXIT(et);
306 		return (EADDRNOTAVAIL);
307 	}
308 
309 	error = 0;
310 	switch (cmd) {
311 	case SIOCGIFADDR:
312 		*addr = ia->ia_addr;
313 		break;
314 
315 	case SIOCGIFBRDADDR:
316 		if ((ifp->if_flags & IFF_BROADCAST) == 0) {
317 			error = EINVAL;
318 			break;
319 		}
320 		*addr = ia->ia_broadaddr;
321 		break;
322 
323 	case SIOCGIFDSTADDR:
324 		if ((ifp->if_flags & IFF_POINTOPOINT) == 0) {
325 			error = EINVAL;
326 			break;
327 		}
328 		*addr = ia->ia_dstaddr;
329 		break;
330 
331 	case SIOCGIFNETMASK:
332 		*addr = ia->ia_sockmask;
333 		break;
334 	}
335 
336 	NET_EPOCH_EXIT(et);
337 
338 	return (error);
339 }
340 
341 static int
342 in_aifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td)
343 {
344 	const struct in_aliasreq *ifra = (struct in_aliasreq *)data;
345 	const struct sockaddr_in *addr = &ifra->ifra_addr;
346 	const struct sockaddr_in *broadaddr = &ifra->ifra_broadaddr;
347 	const struct sockaddr_in *mask = &ifra->ifra_mask;
348 	const struct sockaddr_in *dstaddr = &ifra->ifra_dstaddr;
349 	const int vhid = (cmd == SIOCAIFADDR) ? ifra->ifra_vhid : 0;
350 	struct epoch_tracker et;
351 	struct ifaddr *ifa;
352 	struct in_ifaddr *ia;
353 	bool iaIsFirst;
354 	int error = 0;
355 
356 	error = priv_check(td, PRIV_NET_ADDIFADDR);
357 	if (error)
358 		return (error);
359 
360 	/*
361 	 * ifra_addr must be present and be of INET family.
362 	 * ifra_broadaddr/ifra_dstaddr and ifra_mask are optional.
363 	 */
364 	if (addr->sin_len != sizeof(struct sockaddr_in) ||
365 	    addr->sin_family != AF_INET)
366 		return (EINVAL);
367 	if (broadaddr->sin_len != 0 &&
368 	    (broadaddr->sin_len != sizeof(struct sockaddr_in) ||
369 	    broadaddr->sin_family != AF_INET))
370 		return (EINVAL);
371 	if (mask->sin_len != 0 &&
372 	    (mask->sin_len != sizeof(struct sockaddr_in) ||
373 	    mask->sin_family != AF_INET))
374 		return (EINVAL);
375 	if ((ifp->if_flags & IFF_POINTOPOINT) &&
376 	    (dstaddr->sin_len != sizeof(struct sockaddr_in) ||
377 	     dstaddr->sin_addr.s_addr == INADDR_ANY))
378 		return (EDESTADDRREQ);
379 	if (vhid > 0 && carp_attach_p == NULL)
380 		return (EPROTONOSUPPORT);
381 
382 	/*
383 	 * See whether address already exist.
384 	 */
385 	iaIsFirst = true;
386 	ia = NULL;
387 	NET_EPOCH_ENTER(et);
388 	CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
389 		struct in_ifaddr *it;
390 
391 		if (ifa->ifa_addr->sa_family != AF_INET)
392 			continue;
393 
394 		it = (struct in_ifaddr *)ifa;
395 		if (it->ia_addr.sin_addr.s_addr == addr->sin_addr.s_addr &&
396 		    prison_check_ip4(td->td_ucred, &addr->sin_addr) == 0)
397 			ia = it;
398 		else
399 			iaIsFirst = false;
400 	}
401 	NET_EPOCH_EXIT(et);
402 
403 	if (ia != NULL)
404 		(void )in_difaddr_ioctl(cmd, data, ifp, td);
405 
406 	ifa = ifa_alloc(sizeof(struct in_ifaddr), M_WAITOK);
407 	ia = (struct in_ifaddr *)ifa;
408 	ifa->ifa_addr = (struct sockaddr *)&ia->ia_addr;
409 	ifa->ifa_dstaddr = (struct sockaddr *)&ia->ia_dstaddr;
410 	ifa->ifa_netmask = (struct sockaddr *)&ia->ia_sockmask;
411 	callout_init_rw(&ia->ia_garp_timer, &ifp->if_addr_lock,
412 	    CALLOUT_RETURNUNLOCKED);
413 
414 	ia->ia_ifp = ifp;
415 	ia->ia_addr = *addr;
416 	if (mask->sin_len != 0) {
417 		ia->ia_sockmask = *mask;
418 		ia->ia_subnetmask = ntohl(ia->ia_sockmask.sin_addr.s_addr);
419 	} else {
420 		in_addr_t i = ntohl(addr->sin_addr.s_addr);
421 
422 		/*
423 	 	 * Be compatible with network classes, if netmask isn't
424 		 * supplied, guess it based on classes.
425 	 	 */
426 		if (IN_CLASSA(i))
427 			ia->ia_subnetmask = IN_CLASSA_NET;
428 		else if (IN_CLASSB(i))
429 			ia->ia_subnetmask = IN_CLASSB_NET;
430 		else
431 			ia->ia_subnetmask = IN_CLASSC_NET;
432 		ia->ia_sockmask.sin_addr.s_addr = htonl(ia->ia_subnetmask);
433 	}
434 	ia->ia_subnet = ntohl(addr->sin_addr.s_addr) & ia->ia_subnetmask;
435 	in_socktrim(&ia->ia_sockmask);
436 
437 	if (ifp->if_flags & IFF_BROADCAST) {
438 		if (broadaddr->sin_len != 0) {
439 			ia->ia_broadaddr = *broadaddr;
440 		} else if (ia->ia_subnetmask == IN_RFC3021_MASK) {
441 			ia->ia_broadaddr.sin_addr.s_addr = INADDR_BROADCAST;
442 			ia->ia_broadaddr.sin_len = sizeof(struct sockaddr_in);
443 			ia->ia_broadaddr.sin_family = AF_INET;
444 		} else {
445 			ia->ia_broadaddr.sin_addr.s_addr =
446 			    htonl(ia->ia_subnet | ~ia->ia_subnetmask);
447 			ia->ia_broadaddr.sin_len = sizeof(struct sockaddr_in);
448 			ia->ia_broadaddr.sin_family = AF_INET;
449 		}
450 	}
451 
452 	if (ifp->if_flags & IFF_POINTOPOINT)
453 		ia->ia_dstaddr = *dstaddr;
454 
455 	if (vhid != 0) {
456 		error = (*carp_attach_p)(&ia->ia_ifa, vhid);
457 		if (error)
458 			return (error);
459 	}
460 
461 	/* if_addrhead is already referenced by ifa_alloc() */
462 	IF_ADDR_WLOCK(ifp);
463 	CK_STAILQ_INSERT_TAIL(&ifp->if_addrhead, ifa, ifa_link);
464 	IF_ADDR_WUNLOCK(ifp);
465 
466 	ifa_ref(ifa);			/* in_ifaddrhead */
467 	IN_IFADDR_WLOCK();
468 	CK_STAILQ_INSERT_TAIL(&V_in_ifaddrhead, ia, ia_link);
469 	LIST_INSERT_HEAD(INADDR_HASH(ia->ia_addr.sin_addr.s_addr), ia, ia_hash);
470 	IN_IFADDR_WUNLOCK();
471 
472 	/*
473 	 * Give the interface a chance to initialize
474 	 * if this is its first address,
475 	 * and to validate the address if necessary.
476 	 */
477 	if (ifp->if_ioctl != NULL) {
478 		error = (*ifp->if_ioctl)(ifp, SIOCSIFADDR, (caddr_t)ia);
479 		if (error)
480 			goto fail1;
481 	}
482 
483 	/*
484 	 * Add route for the network.
485 	 */
486 	if (vhid == 0) {
487 		error = in_addprefix(ia);
488 		if (error)
489 			goto fail1;
490 	}
491 
492 	/*
493 	 * Add a loopback route to self.
494 	 */
495 	if (vhid == 0 && ia_need_loopback_route(ia)) {
496 		struct in_ifaddr *eia;
497 
498 		eia = in_localip_more(ia);
499 
500 		if (eia == NULL) {
501 			error = ifa_add_loopback_route((struct ifaddr *)ia,
502 			    (struct sockaddr *)&ia->ia_addr);
503 			if (error)
504 				goto fail2;
505 		} else
506 			ifa_free(&eia->ia_ifa);
507 	}
508 
509 	if (iaIsFirst && (ifp->if_flags & IFF_MULTICAST)) {
510 		struct in_addr allhosts_addr;
511 		struct in_ifinfo *ii;
512 
513 		ii = ((struct in_ifinfo *)ifp->if_afdata[AF_INET]);
514 		allhosts_addr.s_addr = htonl(INADDR_ALLHOSTS_GROUP);
515 
516 		error = in_joingroup(ifp, &allhosts_addr, NULL,
517 			&ii->ii_allhosts);
518 	}
519 
520 	/*
521 	 * Note: we don't need extra reference for ifa, since we called
522 	 * with sx lock held, and ifaddr can not be deleted in concurrent
523 	 * thread.
524 	 */
525 	EVENTHANDLER_INVOKE(ifaddr_event_ext, ifp, ifa, IFADDR_EVENT_ADD);
526 
527 	return (error);
528 
529 fail2:
530 	if (vhid == 0)
531 		(void )in_scrubprefix(ia, LLE_STATIC);
532 
533 fail1:
534 	if (ia->ia_ifa.ifa_carp)
535 		(*carp_detach_p)(&ia->ia_ifa, false);
536 
537 	IF_ADDR_WLOCK(ifp);
538 	CK_STAILQ_REMOVE(&ifp->if_addrhead, &ia->ia_ifa, ifaddr, ifa_link);
539 	IF_ADDR_WUNLOCK(ifp);
540 	ifa_free(&ia->ia_ifa);		/* if_addrhead */
541 
542 	IN_IFADDR_WLOCK();
543 	CK_STAILQ_REMOVE(&V_in_ifaddrhead, ia, in_ifaddr, ia_link);
544 	LIST_REMOVE(ia, ia_hash);
545 	IN_IFADDR_WUNLOCK();
546 	ifa_free(&ia->ia_ifa);		/* in_ifaddrhead */
547 
548 	return (error);
549 }
550 
551 static int
552 in_difaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td)
553 {
554 	const struct ifreq *ifr = (struct ifreq *)data;
555 	const struct sockaddr_in *addr = (const struct sockaddr_in *)
556 	    &ifr->ifr_addr;
557 	struct ifaddr *ifa;
558 	struct in_ifaddr *ia;
559 	bool deleteAny, iaIsLast;
560 	int error;
561 
562 	if (td != NULL) {
563 		error = priv_check(td, PRIV_NET_DELIFADDR);
564 		if (error)
565 			return (error);
566 	}
567 
568 	if (addr->sin_len != sizeof(struct sockaddr_in) ||
569 	    addr->sin_family != AF_INET)
570 		deleteAny = true;
571 	else
572 		deleteAny = false;
573 
574 	iaIsLast = true;
575 	ia = NULL;
576 	IF_ADDR_WLOCK(ifp);
577 	CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
578 		struct in_ifaddr *it;
579 
580 		if (ifa->ifa_addr->sa_family != AF_INET)
581 			continue;
582 
583 		it = (struct in_ifaddr *)ifa;
584 		if (deleteAny && ia == NULL && (td == NULL ||
585 		    prison_check_ip4(td->td_ucred, &it->ia_addr.sin_addr) == 0))
586 			ia = it;
587 
588 		if (it->ia_addr.sin_addr.s_addr == addr->sin_addr.s_addr &&
589 		    (td == NULL || prison_check_ip4(td->td_ucred,
590 		    &addr->sin_addr) == 0))
591 			ia = it;
592 
593 		if (it != ia)
594 			iaIsLast = false;
595 	}
596 
597 	if (ia == NULL) {
598 		IF_ADDR_WUNLOCK(ifp);
599 		return (EADDRNOTAVAIL);
600 	}
601 
602 	CK_STAILQ_REMOVE(&ifp->if_addrhead, &ia->ia_ifa, ifaddr, ifa_link);
603 	IF_ADDR_WUNLOCK(ifp);
604 	ifa_free(&ia->ia_ifa);		/* if_addrhead */
605 
606 	IN_IFADDR_WLOCK();
607 	CK_STAILQ_REMOVE(&V_in_ifaddrhead, ia, in_ifaddr, ia_link);
608 	LIST_REMOVE(ia, ia_hash);
609 	IN_IFADDR_WUNLOCK();
610 
611 	/*
612 	 * in_scrubprefix() kills the interface route.
613 	 */
614 	in_scrubprefix(ia, LLE_STATIC);
615 
616 	/*
617 	 * in_ifadown gets rid of all the rest of
618 	 * the routes.  This is not quite the right
619 	 * thing to do, but at least if we are running
620 	 * a routing process they will come back.
621 	 */
622 	in_ifadown(&ia->ia_ifa, 1);
623 
624 	if (ia->ia_ifa.ifa_carp)
625 		(*carp_detach_p)(&ia->ia_ifa, cmd == SIOCAIFADDR);
626 
627 	/*
628 	 * If this is the last IPv4 address configured on this
629 	 * interface, leave the all-hosts group.
630 	 * No state-change report need be transmitted.
631 	 */
632 	if (iaIsLast && (ifp->if_flags & IFF_MULTICAST)) {
633 		struct in_ifinfo *ii;
634 
635 		ii = ((struct in_ifinfo *)ifp->if_afdata[AF_INET]);
636 		if (ii->ii_allhosts) {
637 			(void)in_leavegroup(ii->ii_allhosts, NULL);
638 			ii->ii_allhosts = NULL;
639 		}
640 	}
641 
642 	IF_ADDR_WLOCK(ifp);
643 	if (callout_stop(&ia->ia_garp_timer) == 1) {
644 		ifa_free(&ia->ia_ifa);
645 	}
646 	IF_ADDR_WUNLOCK(ifp);
647 
648 	EVENTHANDLER_INVOKE(ifaddr_event_ext, ifp, &ia->ia_ifa,
649 	    IFADDR_EVENT_DEL);
650 	ifa_free(&ia->ia_ifa);		/* in_ifaddrhead */
651 
652 	return (0);
653 }
654 
655 static int
656 in_gifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td)
657 {
658 	struct in_aliasreq *ifra = (struct in_aliasreq *)data;
659 	const struct sockaddr_in *addr = &ifra->ifra_addr;
660 	struct epoch_tracker et;
661 	struct ifaddr *ifa;
662 	struct in_ifaddr *ia;
663 
664 	/*
665 	 * ifra_addr must be present and be of INET family.
666 	 */
667 	if (addr->sin_len != sizeof(struct sockaddr_in) ||
668 	    addr->sin_family != AF_INET)
669 		return (EINVAL);
670 
671 	/*
672 	 * See whether address exist.
673 	 */
674 	ia = NULL;
675 	NET_EPOCH_ENTER(et);
676 	CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
677 		struct in_ifaddr *it;
678 
679 		if (ifa->ifa_addr->sa_family != AF_INET)
680 			continue;
681 
682 		it = (struct in_ifaddr *)ifa;
683 		if (it->ia_addr.sin_addr.s_addr == addr->sin_addr.s_addr &&
684 		    prison_check_ip4(td->td_ucred, &addr->sin_addr) == 0) {
685 			ia = it;
686 			break;
687 		}
688 	}
689 	if (ia == NULL) {
690 		NET_EPOCH_EXIT(et);
691 		return (EADDRNOTAVAIL);
692 	}
693 
694 	ifra->ifra_mask = ia->ia_sockmask;
695 	if ((ifp->if_flags & IFF_POINTOPOINT) &&
696 	    ia->ia_dstaddr.sin_family == AF_INET)
697 		ifra->ifra_dstaddr = ia->ia_dstaddr;
698 	else if ((ifp->if_flags & IFF_BROADCAST) &&
699 	    ia->ia_broadaddr.sin_family == AF_INET)
700 		ifra->ifra_broadaddr = ia->ia_broadaddr;
701 	else
702 		memset(&ifra->ifra_broadaddr, 0,
703 		    sizeof(ifra->ifra_broadaddr));
704 
705 	NET_EPOCH_EXIT(et);
706 	return (0);
707 }
708 
709 static int
710 in_match_ifaddr(const struct rtentry *rt, const struct nhop_object *nh, void *arg)
711 {
712 
713 	if (nh->nh_ifa == (struct ifaddr *)arg)
714 		return (1);
715 
716 	return (0);
717 }
718 
719 static int
720 in_handle_prefix_route(uint32_t fibnum, int cmd,
721     struct sockaddr_in *dst, struct sockaddr_in *netmask, struct ifaddr *ifa,
722     struct ifnet *ifp)
723 {
724 
725 	NET_EPOCH_ASSERT();
726 
727 	/* Prepare gateway */
728 	struct sockaddr_dl_short sdl = {
729 		.sdl_family = AF_LINK,
730 		.sdl_len = sizeof(struct sockaddr_dl_short),
731 		.sdl_type = ifa->ifa_ifp->if_type,
732 		.sdl_index = ifa->ifa_ifp->if_index,
733 	};
734 
735 	struct rt_addrinfo info = {
736 		.rti_ifa = ifa,
737 		.rti_ifp = ifp,
738 		.rti_flags = RTF_PINNED | ((netmask != NULL) ? 0 : RTF_HOST),
739 		.rti_info = {
740 			[RTAX_DST] = (struct sockaddr *)dst,
741 			[RTAX_NETMASK] = (struct sockaddr *)netmask,
742 			[RTAX_GATEWAY] = (struct sockaddr *)&sdl,
743 		},
744 		/* Ensure we delete the prefix IFF prefix ifa matches */
745 		.rti_filter = in_match_ifaddr,
746 		.rti_filterdata = ifa,
747 	};
748 
749 	return (rib_handle_ifaddr_info(fibnum, cmd, &info));
750 }
751 
752 /*
753  * Routing table interaction with interface addresses.
754  *
755  * In general, two types of routes needs to be installed:
756  * a) "interface" or "prefix" route, telling user that the addresses
757  *   behind the ifa prefix are reached directly.
758  * b) "loopback" route installed for the ifa address, telling user that
759  *   the address belongs to local system.
760  *
761  * Handling for (a) and (b) differs in multi-fib aspects, hence they
762  *  are implemented in different functions below.
763  *
764  * The cases above may intersect - /32 interface aliases results in
765  *  the same prefix produced by (a) and (b). This blurs the definition
766  *  of the "loopback" route and complicate interactions. The interaction
767  *  table is defined below. The case numbers are used in the multiple
768  *  functions below to refer to the particular test case.
769  *
770  * There can be multiple options:
771  * 1) Adding address with prefix on non-p2p/non-loopback interface.
772  *  Example: 192.0.2.1/24. Action:
773  *  * add "prefix" route towards 192.0.2.0/24 via @ia interface,
774  *    using @ia as an address source.
775  *  * add "loopback" route towards 192.0.2.1 via V_loif, saving
776  *   @ia ifp in the gateway and using @ia as an address source.
777  *
778  * 2) Adding address with /32 mask to non-p2p/non-loopback interface.
779  *  Example: 192.0.2.2/32. Action:
780  *  * add "prefix" host route via V_loif, using @ia as an address source.
781  *
782  * 3) Adding address with or without prefix to p2p interface.
783  *  Example: 10.0.0.1/24->10.0.0.2. Action:
784  *  * add "prefix" host route towards 10.0.0.2 via this interface, using @ia
785  *    as an address source. Note: no sense in installing full /24 as the interface
786  *    is point-to-point.
787  *  * add "loopback" route towards 10.0.9.1 via V_loif, saving
788  *   @ia ifp in the gateway and using @ia as an address source.
789  *
790  * 4) Adding address with or without prefix to loopback interface.
791  *  Example: 192.0.2.1/24. Action:
792  *  * add "prefix" host route via @ia interface, using @ia as an address source.
793  *    Note: Skip installing /24 prefix as it would introduce TTL loop
794  *    for the traffic destined to these addresses.
795  */
796 
797 /*
798  * Checks if @ia needs to install loopback route to @ia address via
799  *  ifa_maintain_loopback_route().
800  *
801  * Return true on success.
802  */
803 static bool
804 ia_need_loopback_route(const struct in_ifaddr *ia)
805 {
806 	struct ifnet *ifp = ia->ia_ifp;
807 
808 	/* Case 4: Skip loopback interfaces */
809 	if ((ifp->if_flags & IFF_LOOPBACK) ||
810 	    (ia->ia_addr.sin_addr.s_addr == INADDR_ANY))
811 		return (false);
812 
813 	/* Clash avoidance: Skip p2p interfaces with both addresses are equal */
814 	if ((ifp->if_flags & IFF_POINTOPOINT) &&
815 	    ia->ia_dstaddr.sin_addr.s_addr == ia->ia_addr.sin_addr.s_addr)
816 		return (false);
817 
818 	/* Case 2: skip /32 prefixes */
819 	if (!(ifp->if_flags & IFF_POINTOPOINT) &&
820 	    (ia->ia_sockmask.sin_addr.s_addr == INADDR_BROADCAST))
821 		return (false);
822 
823 	return (true);
824 }
825 
826 /*
827  * Calculate "prefix" route corresponding to @ia.
828  */
829 static void
830 ia_getrtprefix(const struct in_ifaddr *ia, struct in_addr *prefix, struct in_addr *mask)
831 {
832 
833 	if (ia->ia_ifp->if_flags & IFF_POINTOPOINT) {
834 		/* Case 3: return host route for dstaddr */
835 		*prefix = ia->ia_dstaddr.sin_addr;
836 		mask->s_addr = INADDR_BROADCAST;
837 	} else if (ia->ia_ifp->if_flags & IFF_LOOPBACK) {
838 		/* Case 4: return host route for ifaddr */
839 		*prefix = ia->ia_addr.sin_addr;
840 		mask->s_addr = INADDR_BROADCAST;
841 	} else {
842 		/* Cases 1,2: return actual ia prefix */
843 		*prefix = ia->ia_addr.sin_addr;
844 		*mask = ia->ia_sockmask.sin_addr;
845 		prefix->s_addr &= mask->s_addr;
846 	}
847 }
848 
849 /*
850  * Adds or delete interface "prefix" route corresponding to @ifa.
851  *  Returns 0 on success or errno.
852  */
853 int
854 in_handle_ifaddr_route(int cmd, struct in_ifaddr *ia)
855 {
856 	struct ifaddr *ifa = &ia->ia_ifa;
857 	struct in_addr daddr, maddr;
858 	struct sockaddr_in *pmask;
859 	struct epoch_tracker et;
860 	int error;
861 
862 	ia_getrtprefix(ia, &daddr, &maddr);
863 
864 	struct sockaddr_in mask = {
865 		.sin_family = AF_INET,
866 		.sin_len = sizeof(struct sockaddr_in),
867 		.sin_addr = maddr,
868 	};
869 
870 	pmask = (maddr.s_addr != INADDR_BROADCAST) ? &mask : NULL;
871 
872 	struct sockaddr_in dst = {
873 		.sin_family = AF_INET,
874 		.sin_len = sizeof(struct sockaddr_in),
875 		.sin_addr.s_addr = daddr.s_addr & maddr.s_addr,
876 	};
877 
878 	struct ifnet *ifp = ia->ia_ifp;
879 
880 	if ((maddr.s_addr == INADDR_BROADCAST) &&
881 	    (!(ia->ia_ifp->if_flags & (IFF_POINTOPOINT|IFF_LOOPBACK)))) {
882 		/* Case 2: host route on broadcast interface */
883 		ifp = V_loif;
884 	}
885 
886 	uint32_t fibnum = ifa->ifa_ifp->if_fib;
887 	NET_EPOCH_ENTER(et);
888 	error = in_handle_prefix_route(fibnum, cmd, &dst, pmask, ifa, ifp);
889 	NET_EPOCH_EXIT(et);
890 
891 	return (error);
892 }
893 
894 /*
895  * Check if we have a route for the given prefix already.
896  */
897 static bool
898 in_hasrtprefix(struct in_ifaddr *target)
899 {
900 	struct rm_priotracker in_ifa_tracker;
901 	struct in_ifaddr *ia;
902 	struct in_addr prefix, mask, p, m;
903 	bool result = false;
904 
905 	ia_getrtprefix(target, &prefix, &mask);
906 
907 	IN_IFADDR_RLOCK(&in_ifa_tracker);
908 	/* Look for an existing address with the same prefix, mask, and fib */
909 	CK_STAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) {
910 		ia_getrtprefix(ia, &p, &m);
911 
912 		if (prefix.s_addr != p.s_addr ||
913 		    mask.s_addr != m.s_addr)
914 			continue;
915 
916 		if (target->ia_ifp->if_fib != ia->ia_ifp->if_fib)
917 			continue;
918 
919 		/*
920 		 * If we got a matching prefix route inserted by other
921 		 * interface address, we are done here.
922 		 */
923 		if (ia->ia_flags & IFA_ROUTE) {
924 			result = true;
925 			break;
926 		}
927 	}
928 	IN_IFADDR_RUNLOCK(&in_ifa_tracker);
929 
930 	return (result);
931 }
932 
933 int
934 in_addprefix(struct in_ifaddr *target)
935 {
936 	int error;
937 
938 	if (in_hasrtprefix(target)) {
939 		if (V_nosameprefix)
940 			return (EEXIST);
941 		else {
942 			rt_addrmsg(RTM_ADD, &target->ia_ifa,
943 			    target->ia_ifp->if_fib);
944 			return (0);
945 		}
946 	}
947 
948 	/*
949 	 * No-one seem to have this prefix route, so we try to insert it.
950 	 */
951 	rt_addrmsg(RTM_ADD, &target->ia_ifa, target->ia_ifp->if_fib);
952 	error = in_handle_ifaddr_route(RTM_ADD, target);
953 	if (!error)
954 		target->ia_flags |= IFA_ROUTE;
955 	return (error);
956 }
957 
958 /*
959  * Removes either all lle entries for given @ia, or lle
960  * corresponding to @ia address.
961  */
962 static void
963 in_scrubprefixlle(struct in_ifaddr *ia, int all, u_int flags)
964 {
965 	struct sockaddr_in addr, mask;
966 	struct sockaddr *saddr, *smask;
967 	struct ifnet *ifp;
968 
969 	saddr = (struct sockaddr *)&addr;
970 	bzero(&addr, sizeof(addr));
971 	addr.sin_len = sizeof(addr);
972 	addr.sin_family = AF_INET;
973 	smask = (struct sockaddr *)&mask;
974 	bzero(&mask, sizeof(mask));
975 	mask.sin_len = sizeof(mask);
976 	mask.sin_family = AF_INET;
977 	mask.sin_addr.s_addr = ia->ia_subnetmask;
978 	ifp = ia->ia_ifp;
979 
980 	if (all) {
981 		/*
982 		 * Remove all L2 entries matching given prefix.
983 		 * Convert address to host representation to avoid
984 		 * doing this on every callback. ia_subnetmask is already
985 		 * stored in host representation.
986 		 */
987 		addr.sin_addr.s_addr = ntohl(ia->ia_addr.sin_addr.s_addr);
988 		lltable_prefix_free(AF_INET, saddr, smask, flags);
989 	} else {
990 		/* Remove interface address only */
991 		addr.sin_addr.s_addr = ia->ia_addr.sin_addr.s_addr;
992 		lltable_delete_addr(LLTABLE(ifp), LLE_IFADDR, saddr);
993 	}
994 }
995 
996 /*
997  * If there is no other address in the system that can serve a route to the
998  * same prefix, remove the route.  Hand over the route to the new address
999  * otherwise.
1000  */
1001 int
1002 in_scrubprefix(struct in_ifaddr *target, u_int flags)
1003 {
1004 	struct rm_priotracker in_ifa_tracker;
1005 	struct in_ifaddr *ia;
1006 	struct in_addr prefix, mask, p, m;
1007 	int error = 0;
1008 
1009 	/*
1010 	 * Remove the loopback route to the interface address.
1011 	 */
1012 	if (ia_need_loopback_route(target) && (flags & LLE_STATIC)) {
1013 		struct in_ifaddr *eia;
1014 
1015 		eia = in_localip_more(target);
1016 
1017 		if (eia != NULL) {
1018 			error = ifa_switch_loopback_route((struct ifaddr *)eia,
1019 			    (struct sockaddr *)&target->ia_addr);
1020 			ifa_free(&eia->ia_ifa);
1021 		} else {
1022 			error = ifa_del_loopback_route((struct ifaddr *)target,
1023 			    (struct sockaddr *)&target->ia_addr);
1024 		}
1025 	}
1026 
1027 	ia_getrtprefix(target, &prefix, &mask);
1028 
1029 	if ((target->ia_flags & IFA_ROUTE) == 0) {
1030 		rt_addrmsg(RTM_DELETE, &target->ia_ifa, target->ia_ifp->if_fib);
1031 
1032 		/*
1033 		 * Removing address from !IFF_UP interface or
1034 		 * prefix which exists on other interface (along with route).
1035 		 * No entries should exist here except target addr.
1036 		 * Given that, delete this entry only.
1037 		 */
1038 		in_scrubprefixlle(target, 0, flags);
1039 		return (0);
1040 	}
1041 
1042 	IN_IFADDR_RLOCK(&in_ifa_tracker);
1043 	CK_STAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) {
1044 		ia_getrtprefix(ia, &p, &m);
1045 
1046 		if (prefix.s_addr != p.s_addr ||
1047 		    mask.s_addr != m.s_addr)
1048 			continue;
1049 
1050 		if ((ia->ia_ifp->if_flags & IFF_UP) == 0)
1051 			continue;
1052 
1053 		/*
1054 		 * If we got a matching prefix address, move IFA_ROUTE and
1055 		 * the route itself to it.  Make sure that routing daemons
1056 		 * get a heads-up.
1057 		 */
1058 		if ((ia->ia_flags & IFA_ROUTE) == 0) {
1059 			ifa_ref(&ia->ia_ifa);
1060 			IN_IFADDR_RUNLOCK(&in_ifa_tracker);
1061 			error = in_handle_ifaddr_route(RTM_DELETE, target);
1062 			if (error == 0)
1063 				target->ia_flags &= ~IFA_ROUTE;
1064 			else
1065 				log(LOG_INFO, "in_scrubprefix: err=%d, old prefix delete failed\n",
1066 					error);
1067 			/* Scrub all entries IFF interface is different */
1068 			in_scrubprefixlle(target, target->ia_ifp != ia->ia_ifp,
1069 			    flags);
1070 			error = in_handle_ifaddr_route(RTM_ADD, ia);
1071 			if (error == 0)
1072 				ia->ia_flags |= IFA_ROUTE;
1073 			else
1074 				log(LOG_INFO, "in_scrubprefix: err=%d, new prefix add failed\n",
1075 					error);
1076 			ifa_free(&ia->ia_ifa);
1077 			return (error);
1078 		}
1079 	}
1080 	IN_IFADDR_RUNLOCK(&in_ifa_tracker);
1081 
1082 	/*
1083 	 * remove all L2 entries on the given prefix
1084 	 */
1085 	in_scrubprefixlle(target, 1, flags);
1086 
1087 	/*
1088 	 * As no-one seem to have this prefix, we can remove the route.
1089 	 */
1090 	rt_addrmsg(RTM_DELETE, &target->ia_ifa, target->ia_ifp->if_fib);
1091 	error = in_handle_ifaddr_route(RTM_DELETE, target);
1092 	if (error == 0)
1093 		target->ia_flags &= ~IFA_ROUTE;
1094 	else
1095 		log(LOG_INFO, "in_scrubprefix: err=%d, prefix delete failed\n", error);
1096 	return (error);
1097 }
1098 
1099 void
1100 in_ifscrub_all(void)
1101 {
1102 	struct ifnet *ifp;
1103 	struct ifaddr *ifa, *nifa;
1104 	struct ifaliasreq ifr;
1105 
1106 	IFNET_RLOCK();
1107 	CK_STAILQ_FOREACH(ifp, &V_ifnet, if_link) {
1108 		/* Cannot lock here - lock recursion. */
1109 		/* NET_EPOCH_ENTER(et); */
1110 		CK_STAILQ_FOREACH_SAFE(ifa, &ifp->if_addrhead, ifa_link, nifa) {
1111 			if (ifa->ifa_addr->sa_family != AF_INET)
1112 				continue;
1113 
1114 			/*
1115 			 * This is ugly but the only way for legacy IP to
1116 			 * cleanly remove addresses and everything attached.
1117 			 */
1118 			bzero(&ifr, sizeof(ifr));
1119 			ifr.ifra_addr = *ifa->ifa_addr;
1120 			if (ifa->ifa_dstaddr)
1121 			ifr.ifra_broadaddr = *ifa->ifa_dstaddr;
1122 			(void)in_control(NULL, SIOCDIFADDR, (caddr_t)&ifr,
1123 			    ifp, NULL);
1124 		}
1125 		/* NET_EPOCH_EXIT(et); */
1126 		in_purgemaddrs(ifp);
1127 		igmp_domifdetach(ifp);
1128 	}
1129 	IFNET_RUNLOCK();
1130 }
1131 
1132 int
1133 in_ifaddr_broadcast(struct in_addr in, struct in_ifaddr *ia)
1134 {
1135 
1136 	return ((in.s_addr == ia->ia_broadaddr.sin_addr.s_addr ||
1137 	     /*
1138 	      * Check for old-style (host 0) broadcast, but
1139 	      * taking into account that RFC 3021 obsoletes it.
1140 	      */
1141 	    (ia->ia_subnetmask != IN_RFC3021_MASK &&
1142 	    ntohl(in.s_addr) == ia->ia_subnet)) &&
1143 	     /*
1144 	      * Check for an all one subnetmask. These
1145 	      * only exist when an interface gets a secondary
1146 	      * address.
1147 	      */
1148 	    ia->ia_subnetmask != (u_long)0xffffffff);
1149 }
1150 
1151 /*
1152  * Return 1 if the address might be a local broadcast address.
1153  */
1154 int
1155 in_broadcast(struct in_addr in, struct ifnet *ifp)
1156 {
1157 	struct ifaddr *ifa;
1158 	int found;
1159 
1160 	NET_EPOCH_ASSERT();
1161 
1162 	if (in.s_addr == INADDR_BROADCAST ||
1163 	    in.s_addr == INADDR_ANY)
1164 		return (1);
1165 	if ((ifp->if_flags & IFF_BROADCAST) == 0)
1166 		return (0);
1167 	found = 0;
1168 	/*
1169 	 * Look through the list of addresses for a match
1170 	 * with a broadcast address.
1171 	 */
1172 	CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
1173 		if (ifa->ifa_addr->sa_family == AF_INET &&
1174 		    in_ifaddr_broadcast(in, (struct in_ifaddr *)ifa)) {
1175 			found = 1;
1176 			break;
1177 		}
1178 	return (found);
1179 }
1180 
1181 /*
1182  * On interface removal, clean up IPv4 data structures hung off of the ifnet.
1183  */
1184 void
1185 in_ifdetach(struct ifnet *ifp)
1186 {
1187 	IN_MULTI_LOCK();
1188 	in_pcbpurgeif0(&V_ripcbinfo, ifp);
1189 	in_pcbpurgeif0(&V_udbinfo, ifp);
1190 	in_pcbpurgeif0(&V_ulitecbinfo, ifp);
1191 	in_purgemaddrs(ifp);
1192 	IN_MULTI_UNLOCK();
1193 
1194 	/*
1195 	 * Make sure all multicast deletions invoking if_ioctl() are
1196 	 * completed before returning. Else we risk accessing a freed
1197 	 * ifnet structure pointer.
1198 	 */
1199 	inm_release_wait(NULL);
1200 }
1201 
1202 /*
1203  * Delete all IPv4 multicast address records, and associated link-layer
1204  * multicast address records, associated with ifp.
1205  * XXX It looks like domifdetach runs AFTER the link layer cleanup.
1206  * XXX This should not race with ifma_protospec being set during
1207  * a new allocation, if it does, we have bigger problems.
1208  */
1209 static void
1210 in_purgemaddrs(struct ifnet *ifp)
1211 {
1212 	struct in_multi_head purgeinms;
1213 	struct in_multi		*inm;
1214 	struct ifmultiaddr	*ifma, *next;
1215 
1216 	SLIST_INIT(&purgeinms);
1217 	IN_MULTI_LIST_LOCK();
1218 
1219 	/*
1220 	 * Extract list of in_multi associated with the detaching ifp
1221 	 * which the PF_INET layer is about to release.
1222 	 * We need to do this as IF_ADDR_LOCK() may be re-acquired
1223 	 * by code further down.
1224 	 */
1225 	IF_ADDR_WLOCK(ifp);
1226  restart:
1227 	CK_STAILQ_FOREACH_SAFE(ifma, &ifp->if_multiaddrs, ifma_link, next) {
1228 		if (ifma->ifma_addr->sa_family != AF_INET ||
1229 		    ifma->ifma_protospec == NULL)
1230 			continue;
1231 		inm = (struct in_multi *)ifma->ifma_protospec;
1232 		inm_rele_locked(&purgeinms, inm);
1233 		if (__predict_false(ifma_restart)) {
1234 			ifma_restart = true;
1235 			goto restart;
1236 		}
1237 	}
1238 	IF_ADDR_WUNLOCK(ifp);
1239 
1240 	inm_release_list_deferred(&purgeinms);
1241 	igmp_ifdetach(ifp);
1242 	IN_MULTI_LIST_UNLOCK();
1243 }
1244 
1245 struct in_llentry {
1246 	struct llentry		base;
1247 };
1248 
1249 #define	IN_LLTBL_DEFAULT_HSIZE	32
1250 #define	IN_LLTBL_HASH(k, h) \
1251 	(((((((k >> 8) ^ k) >> 8) ^ k) >> 8) ^ k) & ((h) - 1))
1252 
1253 /*
1254  * Do actual deallocation of @lle.
1255  */
1256 static void
1257 in_lltable_destroy_lle_unlocked(epoch_context_t ctx)
1258 {
1259 	struct llentry *lle;
1260 
1261 	lle = __containerof(ctx, struct llentry, lle_epoch_ctx);
1262 	LLE_LOCK_DESTROY(lle);
1263 	LLE_REQ_DESTROY(lle);
1264 	free(lle, M_LLTABLE);
1265 }
1266 
1267 /*
1268  * Called by the datapath to indicate that
1269  * the entry was used.
1270  */
1271 static void
1272 in_lltable_mark_used(struct llentry *lle)
1273 {
1274 
1275 	LLE_REQ_LOCK(lle);
1276 	lle->r_skip_req = 0;
1277 	LLE_REQ_UNLOCK(lle);
1278 }
1279 
1280 /*
1281  * Called by LLE_FREE_LOCKED when number of references
1282  * drops to zero.
1283  */
1284 static void
1285 in_lltable_destroy_lle(struct llentry *lle)
1286 {
1287 
1288 	LLE_WUNLOCK(lle);
1289 	NET_EPOCH_CALL(in_lltable_destroy_lle_unlocked, &lle->lle_epoch_ctx);
1290 }
1291 
1292 static struct llentry *
1293 in_lltable_new(struct in_addr addr4, u_int flags)
1294 {
1295 	struct in_llentry *lle;
1296 
1297 	lle = malloc(sizeof(struct in_llentry), M_LLTABLE, M_NOWAIT | M_ZERO);
1298 	if (lle == NULL)		/* NB: caller generates msg */
1299 		return NULL;
1300 
1301 	/*
1302 	 * For IPv4 this will trigger "arpresolve" to generate
1303 	 * an ARP request.
1304 	 */
1305 	lle->base.la_expire = time_uptime; /* mark expired */
1306 	lle->base.r_l3addr.addr4 = addr4;
1307 	lle->base.lle_refcnt = 1;
1308 	lle->base.lle_free = in_lltable_destroy_lle;
1309 	LLE_LOCK_INIT(&lle->base);
1310 	LLE_REQ_INIT(&lle->base);
1311 	callout_init(&lle->base.lle_timer, 1);
1312 
1313 	return (&lle->base);
1314 }
1315 
1316 #define IN_ARE_MASKED_ADDR_EQUAL(d, a, m)	(		\
1317 	((((d).s_addr ^ (a).s_addr) & (m).s_addr)) == 0 )
1318 
1319 static int
1320 in_lltable_match_prefix(const struct sockaddr *saddr,
1321     const struct sockaddr *smask, u_int flags, struct llentry *lle)
1322 {
1323 	struct in_addr addr, mask, lle_addr;
1324 
1325 	addr = ((const struct sockaddr_in *)saddr)->sin_addr;
1326 	mask = ((const struct sockaddr_in *)smask)->sin_addr;
1327 	lle_addr.s_addr = ntohl(lle->r_l3addr.addr4.s_addr);
1328 
1329 	if (IN_ARE_MASKED_ADDR_EQUAL(lle_addr, addr, mask) == 0)
1330 		return (0);
1331 
1332 	if (lle->la_flags & LLE_IFADDR) {
1333 		/*
1334 		 * Delete LLE_IFADDR records IFF address & flag matches.
1335 		 * Note that addr is the interface address within prefix
1336 		 * being matched.
1337 		 * Note also we should handle 'ifdown' cases without removing
1338 		 * ifaddr macs.
1339 		 */
1340 		if (addr.s_addr == lle_addr.s_addr && (flags & LLE_STATIC) != 0)
1341 			return (1);
1342 		return (0);
1343 	}
1344 
1345 	/* flags & LLE_STATIC means deleting both dynamic and static entries */
1346 	if ((flags & LLE_STATIC) || !(lle->la_flags & LLE_STATIC))
1347 		return (1);
1348 
1349 	return (0);
1350 }
1351 
1352 static void
1353 in_lltable_free_entry(struct lltable *llt, struct llentry *lle)
1354 {
1355 	size_t pkts_dropped;
1356 
1357 	LLE_WLOCK_ASSERT(lle);
1358 	KASSERT(llt != NULL, ("lltable is NULL"));
1359 
1360 	/* Unlink entry from table if not already */
1361 	if ((lle->la_flags & LLE_LINKED) != 0) {
1362 		IF_AFDATA_WLOCK_ASSERT(llt->llt_ifp);
1363 		lltable_unlink_entry(llt, lle);
1364 	}
1365 
1366 	/* Drop hold queue */
1367 	pkts_dropped = llentry_free(lle);
1368 	ARPSTAT_ADD(dropped, pkts_dropped);
1369 }
1370 
1371 static int
1372 in_lltable_rtcheck(struct ifnet *ifp, u_int flags, const struct sockaddr *l3addr)
1373 {
1374 	struct rt_addrinfo info;
1375 	struct sockaddr_in rt_key, rt_mask;
1376 	struct sockaddr rt_gateway;
1377 	int rt_flags;
1378 
1379 	KASSERT(l3addr->sa_family == AF_INET,
1380 	    ("sin_family %d", l3addr->sa_family));
1381 
1382 	bzero(&rt_key, sizeof(rt_key));
1383 	rt_key.sin_len = sizeof(rt_key);
1384 	bzero(&rt_mask, sizeof(rt_mask));
1385 	rt_mask.sin_len = sizeof(rt_mask);
1386 	bzero(&rt_gateway, sizeof(rt_gateway));
1387 	rt_gateway.sa_len = sizeof(rt_gateway);
1388 
1389 	bzero(&info, sizeof(info));
1390 	info.rti_info[RTAX_DST] = (struct sockaddr *)&rt_key;
1391 	info.rti_info[RTAX_NETMASK] = (struct sockaddr *)&rt_mask;
1392 	info.rti_info[RTAX_GATEWAY] = (struct sockaddr *)&rt_gateway;
1393 
1394 	if (rib_lookup_info(ifp->if_fib, l3addr, NHR_REF, 0, &info) != 0)
1395 		return (EINVAL);
1396 
1397 	rt_flags = info.rti_flags;
1398 
1399 	/*
1400 	 * If the gateway for an existing host route matches the target L3
1401 	 * address, which is a special route inserted by some implementation
1402 	 * such as MANET, and the interface is of the correct type, then
1403 	 * allow for ARP to proceed.
1404 	 */
1405 	if (rt_flags & RTF_GATEWAY) {
1406 		if (!(rt_flags & RTF_HOST) || !info.rti_ifp ||
1407 		    info.rti_ifp->if_type != IFT_ETHER ||
1408 		    (info.rti_ifp->if_flags & (IFF_NOARP | IFF_STATICARP)) != 0 ||
1409 		    memcmp(rt_gateway.sa_data, l3addr->sa_data,
1410 		    sizeof(in_addr_t)) != 0) {
1411 			rib_free_info(&info);
1412 			return (EINVAL);
1413 		}
1414 	}
1415 	rib_free_info(&info);
1416 
1417 	/*
1418 	 * Make sure that at least the destination address is covered
1419 	 * by the route. This is for handling the case where 2 or more
1420 	 * interfaces have the same prefix. An incoming packet arrives
1421 	 * on one interface and the corresponding outgoing packet leaves
1422 	 * another interface.
1423 	 */
1424 	if (!(rt_flags & RTF_HOST) && info.rti_ifp != ifp) {
1425 		const char *sa, *mask, *addr, *lim;
1426 		const struct sockaddr_in *l3sin;
1427 
1428 		mask = (const char *)&rt_mask;
1429 		/*
1430 		 * Just being extra cautious to avoid some custom
1431 		 * code getting into trouble.
1432 		 */
1433 		if ((info.rti_addrs & RTA_NETMASK) == 0)
1434 			return (EINVAL);
1435 
1436 		sa = (const char *)&rt_key;
1437 		addr = (const char *)l3addr;
1438 		l3sin = (const struct sockaddr_in *)l3addr;
1439 		lim = addr + l3sin->sin_len;
1440 
1441 		for ( ; addr < lim; sa++, mask++, addr++) {
1442 			if ((*sa ^ *addr) & *mask) {
1443 #ifdef DIAGNOSTIC
1444 				char addrbuf[INET_ADDRSTRLEN];
1445 
1446 				log(LOG_INFO, "IPv4 address: \"%s\" "
1447 				    "is not on the network\n",
1448 				    inet_ntoa_r(l3sin->sin_addr, addrbuf));
1449 #endif
1450 				return (EINVAL);
1451 			}
1452 		}
1453 	}
1454 
1455 	return (0);
1456 }
1457 
1458 static inline uint32_t
1459 in_lltable_hash_dst(const struct in_addr dst, uint32_t hsize)
1460 {
1461 
1462 	return (IN_LLTBL_HASH(dst.s_addr, hsize));
1463 }
1464 
1465 static uint32_t
1466 in_lltable_hash(const struct llentry *lle, uint32_t hsize)
1467 {
1468 
1469 	return (in_lltable_hash_dst(lle->r_l3addr.addr4, hsize));
1470 }
1471 
1472 static void
1473 in_lltable_fill_sa_entry(const struct llentry *lle, struct sockaddr *sa)
1474 {
1475 	struct sockaddr_in *sin;
1476 
1477 	sin = (struct sockaddr_in *)sa;
1478 	bzero(sin, sizeof(*sin));
1479 	sin->sin_family = AF_INET;
1480 	sin->sin_len = sizeof(*sin);
1481 	sin->sin_addr = lle->r_l3addr.addr4;
1482 }
1483 
1484 static inline struct llentry *
1485 in_lltable_find_dst(struct lltable *llt, struct in_addr dst)
1486 {
1487 	struct llentry *lle;
1488 	struct llentries *lleh;
1489 	u_int hashidx;
1490 
1491 	hashidx = in_lltable_hash_dst(dst, llt->llt_hsize);
1492 	lleh = &llt->lle_head[hashidx];
1493 	CK_LIST_FOREACH(lle, lleh, lle_next) {
1494 		if (lle->la_flags & LLE_DELETED)
1495 			continue;
1496 		if (lle->r_l3addr.addr4.s_addr == dst.s_addr)
1497 			break;
1498 	}
1499 
1500 	return (lle);
1501 }
1502 
1503 static void
1504 in_lltable_delete_entry(struct lltable *llt, struct llentry *lle)
1505 {
1506 
1507 	lle->la_flags |= LLE_DELETED;
1508 	EVENTHANDLER_INVOKE(lle_event, lle, LLENTRY_DELETED);
1509 #ifdef DIAGNOSTIC
1510 	log(LOG_INFO, "ifaddr cache = %p is deleted\n", lle);
1511 #endif
1512 	llentry_free(lle);
1513 }
1514 
1515 static struct llentry *
1516 in_lltable_alloc(struct lltable *llt, u_int flags, const struct sockaddr *l3addr)
1517 {
1518 	const struct sockaddr_in *sin = (const struct sockaddr_in *)l3addr;
1519 	struct ifnet *ifp = llt->llt_ifp;
1520 	struct llentry *lle;
1521 	char linkhdr[LLE_MAX_LINKHDR];
1522 	size_t linkhdrsize;
1523 	int lladdr_off;
1524 
1525 	KASSERT(l3addr->sa_family == AF_INET,
1526 	    ("sin_family %d", l3addr->sa_family));
1527 
1528 	/*
1529 	 * A route that covers the given address must have
1530 	 * been installed 1st because we are doing a resolution,
1531 	 * verify this.
1532 	 */
1533 	if (!(flags & LLE_IFADDR) &&
1534 	    in_lltable_rtcheck(ifp, flags, l3addr) != 0)
1535 		return (NULL);
1536 
1537 	lle = in_lltable_new(sin->sin_addr, flags);
1538 	if (lle == NULL) {
1539 		log(LOG_INFO, "lla_lookup: new lle malloc failed\n");
1540 		return (NULL);
1541 	}
1542 	lle->la_flags = flags;
1543 	if (flags & LLE_STATIC)
1544 		lle->r_flags |= RLLE_VALID;
1545 	if ((flags & LLE_IFADDR) == LLE_IFADDR) {
1546 		linkhdrsize = LLE_MAX_LINKHDR;
1547 		if (lltable_calc_llheader(ifp, AF_INET, IF_LLADDR(ifp),
1548 		    linkhdr, &linkhdrsize, &lladdr_off) != 0) {
1549 			NET_EPOCH_CALL(in_lltable_destroy_lle_unlocked, &lle->lle_epoch_ctx);
1550 			return (NULL);
1551 		}
1552 		lltable_set_entry_addr(ifp, lle, linkhdr, linkhdrsize,
1553 		    lladdr_off);
1554 		lle->la_flags |= LLE_STATIC;
1555 		lle->r_flags |= (RLLE_VALID | RLLE_IFADDR);
1556 	}
1557 
1558 	return (lle);
1559 }
1560 
1561 /*
1562  * Return NULL if not found or marked for deletion.
1563  * If found return lle read locked.
1564  */
1565 static struct llentry *
1566 in_lltable_lookup(struct lltable *llt, u_int flags, const struct sockaddr *l3addr)
1567 {
1568 	const struct sockaddr_in *sin = (const struct sockaddr_in *)l3addr;
1569 	struct llentry *lle;
1570 
1571 	IF_AFDATA_LOCK_ASSERT(llt->llt_ifp);
1572 	KASSERT(l3addr->sa_family == AF_INET,
1573 	    ("sin_family %d", l3addr->sa_family));
1574 	KASSERT((flags & (LLE_UNLOCKED | LLE_EXCLUSIVE)) !=
1575 	    (LLE_UNLOCKED | LLE_EXCLUSIVE),
1576 	    ("wrong lle request flags: %#x", flags));
1577 
1578 	lle = in_lltable_find_dst(llt, sin->sin_addr);
1579 	if (lle == NULL)
1580 		return (NULL);
1581 	if (flags & LLE_UNLOCKED)
1582 		return (lle);
1583 
1584 	if (flags & LLE_EXCLUSIVE)
1585 		LLE_WLOCK(lle);
1586 	else
1587 		LLE_RLOCK(lle);
1588 
1589 	/*
1590 	 * If the afdata lock is not held, the LLE may have been unlinked while
1591 	 * we were blocked on the LLE lock.  Check for this case.
1592 	 */
1593 	if (__predict_false((lle->la_flags & LLE_LINKED) == 0)) {
1594 		if (flags & LLE_EXCLUSIVE)
1595 			LLE_WUNLOCK(lle);
1596 		else
1597 			LLE_RUNLOCK(lle);
1598 		return (NULL);
1599 	}
1600 	return (lle);
1601 }
1602 
1603 static int
1604 in_lltable_dump_entry(struct lltable *llt, struct llentry *lle,
1605     struct sysctl_req *wr)
1606 {
1607 	struct ifnet *ifp = llt->llt_ifp;
1608 	/* XXX stack use */
1609 	struct {
1610 		struct rt_msghdr	rtm;
1611 		struct sockaddr_in	sin;
1612 		struct sockaddr_dl	sdl;
1613 	} arpc;
1614 	struct sockaddr_dl *sdl;
1615 	int error;
1616 
1617 	bzero(&arpc, sizeof(arpc));
1618 	/* skip deleted entries */
1619 	if ((lle->la_flags & LLE_DELETED) == LLE_DELETED)
1620 		return (0);
1621 	/* Skip if jailed and not a valid IP of the prison. */
1622 	lltable_fill_sa_entry(lle,(struct sockaddr *)&arpc.sin);
1623 	if (prison_if(wr->td->td_ucred, (struct sockaddr *)&arpc.sin) != 0)
1624 		return (0);
1625 	/*
1626 	 * produce a msg made of:
1627 	 *  struct rt_msghdr;
1628 	 *  struct sockaddr_in; (IPv4)
1629 	 *  struct sockaddr_dl;
1630 	 */
1631 	arpc.rtm.rtm_msglen = sizeof(arpc);
1632 	arpc.rtm.rtm_version = RTM_VERSION;
1633 	arpc.rtm.rtm_type = RTM_GET;
1634 	arpc.rtm.rtm_flags = RTF_UP;
1635 	arpc.rtm.rtm_addrs = RTA_DST | RTA_GATEWAY;
1636 
1637 	/* publish */
1638 	if (lle->la_flags & LLE_PUB)
1639 		arpc.rtm.rtm_flags |= RTF_ANNOUNCE;
1640 
1641 	sdl = &arpc.sdl;
1642 	sdl->sdl_family = AF_LINK;
1643 	sdl->sdl_len = sizeof(*sdl);
1644 	sdl->sdl_index = ifp->if_index;
1645 	sdl->sdl_type = ifp->if_type;
1646 	if ((lle->la_flags & LLE_VALID) == LLE_VALID) {
1647 		sdl->sdl_alen = ifp->if_addrlen;
1648 		bcopy(lle->ll_addr, LLADDR(sdl), ifp->if_addrlen);
1649 	} else {
1650 		sdl->sdl_alen = 0;
1651 		bzero(LLADDR(sdl), ifp->if_addrlen);
1652 	}
1653 
1654 	arpc.rtm.rtm_rmx.rmx_expire =
1655 	    lle->la_flags & LLE_STATIC ? 0 : lle->la_expire;
1656 	arpc.rtm.rtm_flags |= (RTF_HOST | RTF_LLDATA);
1657 	if (lle->la_flags & LLE_STATIC)
1658 		arpc.rtm.rtm_flags |= RTF_STATIC;
1659 	if (lle->la_flags & LLE_IFADDR)
1660 		arpc.rtm.rtm_flags |= RTF_PINNED;
1661 	arpc.rtm.rtm_index = ifp->if_index;
1662 	error = SYSCTL_OUT(wr, &arpc, sizeof(arpc));
1663 
1664 	return (error);
1665 }
1666 
1667 static struct lltable *
1668 in_lltattach(struct ifnet *ifp)
1669 {
1670 	struct lltable *llt;
1671 
1672 	llt = lltable_allocate_htbl(IN_LLTBL_DEFAULT_HSIZE);
1673  	llt->llt_af = AF_INET;
1674  	llt->llt_ifp = ifp;
1675 
1676 	llt->llt_lookup = in_lltable_lookup;
1677 	llt->llt_alloc_entry = in_lltable_alloc;
1678 	llt->llt_delete_entry = in_lltable_delete_entry;
1679 	llt->llt_dump_entry = in_lltable_dump_entry;
1680 	llt->llt_hash = in_lltable_hash;
1681 	llt->llt_fill_sa_entry = in_lltable_fill_sa_entry;
1682 	llt->llt_free_entry = in_lltable_free_entry;
1683 	llt->llt_match_prefix = in_lltable_match_prefix;
1684 	llt->llt_mark_used = in_lltable_mark_used;
1685  	lltable_link(llt);
1686 
1687 	return (llt);
1688 }
1689 
1690 void *
1691 in_domifattach(struct ifnet *ifp)
1692 {
1693 	struct in_ifinfo *ii;
1694 
1695 	ii = malloc(sizeof(struct in_ifinfo), M_IFADDR, M_WAITOK|M_ZERO);
1696 
1697 	ii->ii_llt = in_lltattach(ifp);
1698 	ii->ii_igmp = igmp_domifattach(ifp);
1699 
1700 	return (ii);
1701 }
1702 
1703 void
1704 in_domifdetach(struct ifnet *ifp, void *aux)
1705 {
1706 	struct in_ifinfo *ii = (struct in_ifinfo *)aux;
1707 
1708 	igmp_domifdetach(ifp);
1709 	lltable_free(ii->ii_llt);
1710 	free(ii, M_IFADDR);
1711 }
1712