xref: /freebsd/sys/netinet/ip_mroute.c (revision 4a27bf128b108d90412190c06a54ebac36a8ca2e)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1989 Stephen Deering
5  * Copyright (c) 1992, 1993
6  *      The Regents of the University of California.  All rights reserved.
7  *
8  * This code is derived from software contributed to Berkeley by
9  * Stephen Deering of Stanford University.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. Neither the name of the University nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  *
35  *      @(#)ip_mroute.c 8.2 (Berkeley) 11/15/93
36  */
37 
38 /*
39  * IP multicast forwarding procedures
40  *
41  * Written by David Waitzman, BBN Labs, August 1988.
42  * Modified by Steve Deering, Stanford, February 1989.
43  * Modified by Mark J. Steiglitz, Stanford, May, 1991
44  * Modified by Van Jacobson, LBL, January 1993
45  * Modified by Ajit Thyagarajan, PARC, August 1993
46  * Modified by Bill Fenner, PARC, April 1995
47  * Modified by Ahmed Helmy, SGI, June 1996
48  * Modified by George Edmond Eddy (Rusty), ISI, February 1998
49  * Modified by Pavlin Radoslavov, USC/ISI, May 1998, August 1999, October 2000
50  * Modified by Hitoshi Asaeda, WIDE, August 2000
51  * Modified by Pavlin Radoslavov, ICSI, October 2002
52  * Modified by Wojciech Macek, Semihalf, May 2021
53  *
54  * MROUTING Revision: 3.5
55  * and PIM-SMv2 and PIM-DM support, advanced API support,
56  * bandwidth metering and signaling
57  */
58 
59 /*
60  * TODO: Prefix functions with ipmf_.
61  * TODO: Maintain a refcount on if_allmulti() in ifnet or in the protocol
62  * domain attachment (if_afdata) so we can track consumers of that service.
63  * TODO: Deprecate routing socket path for SIOCGETSGCNT and SIOCGETVIFCNT,
64  * move it to socket options.
65  * TODO: Cleanup LSRR removal further.
66  * TODO: Push RSVP stubs into raw_ip.c.
67  * TODO: Use bitstring.h for vif set.
68  * TODO: Fix mrt6_ioctl dangling ref when dynamically loaded.
69  * TODO: Sync ip6_mroute.c with this file.
70  */
71 
72 #include <sys/cdefs.h>
73 __FBSDID("$FreeBSD$");
74 
75 #include "opt_inet.h"
76 #include "opt_mrouting.h"
77 
78 #define _PIM_VT 1
79 
80 #include <sys/param.h>
81 #include <sys/kernel.h>
82 #include <sys/stddef.h>
83 #include <sys/eventhandler.h>
84 #include <sys/lock.h>
85 #include <sys/ktr.h>
86 #include <sys/malloc.h>
87 #include <sys/mbuf.h>
88 #include <sys/module.h>
89 #include <sys/priv.h>
90 #include <sys/protosw.h>
91 #include <sys/signalvar.h>
92 #include <sys/socket.h>
93 #include <sys/socketvar.h>
94 #include <sys/sockio.h>
95 #include <sys/sx.h>
96 #include <sys/sysctl.h>
97 #include <sys/syslog.h>
98 #include <sys/systm.h>
99 #include <sys/time.h>
100 #include <sys/counter.h>
101 
102 #include <net/if.h>
103 #include <net/if_var.h>
104 #include <net/netisr.h>
105 #include <net/route.h>
106 #include <net/vnet.h>
107 
108 #include <netinet/in.h>
109 #include <netinet/igmp.h>
110 #include <netinet/in_systm.h>
111 #include <netinet/in_var.h>
112 #include <netinet/ip.h>
113 #include <netinet/ip_encap.h>
114 #include <netinet/ip_mroute.h>
115 #include <netinet/ip_var.h>
116 #include <netinet/ip_options.h>
117 #include <netinet/pim.h>
118 #include <netinet/pim_var.h>
119 #include <netinet/udp.h>
120 
121 #include <machine/in_cksum.h>
122 
123 #ifndef KTR_IPMF
124 #define KTR_IPMF KTR_INET
125 #endif
126 
127 #define		VIFI_INVALID	((vifi_t) -1)
128 
129 static MALLOC_DEFINE(M_MRTABLE, "mroutetbl", "multicast forwarding cache");
130 
131 /*
132  * Locking.  We use two locks: one for the virtual interface table and
133  * one for the forwarding table.  These locks may be nested in which case
134  * the VIF lock must always be taken first.  Note that each lock is used
135  * to cover not only the specific data structure but also related data
136  * structures.
137  */
138 
139 static struct mtx mrouter_mtx;
140 #define	MROUTER_LOCK()		mtx_lock(&mrouter_mtx)
141 #define	MROUTER_UNLOCK()	mtx_unlock(&mrouter_mtx)
142 #define	MROUTER_LOCK_ASSERT()	mtx_assert(&mrouter_mtx, MA_OWNED)
143 #define	MROUTER_LOCK_INIT()						\
144 	mtx_init(&mrouter_mtx, "IPv4 multicast forwarding", NULL, MTX_DEF)
145 #define	MROUTER_LOCK_DESTROY()	mtx_destroy(&mrouter_mtx)
146 
147 static int ip_mrouter_cnt;	/* # of vnets with active mrouters */
148 static int ip_mrouter_unloading; /* Allow no more V_ip_mrouter sockets */
149 
150 VNET_PCPUSTAT_DEFINE_STATIC(struct mrtstat, mrtstat);
151 VNET_PCPUSTAT_SYSINIT(mrtstat);
152 VNET_PCPUSTAT_SYSUNINIT(mrtstat);
153 SYSCTL_VNET_PCPUSTAT(_net_inet_ip, OID_AUTO, mrtstat, struct mrtstat,
154     mrtstat, "IPv4 Multicast Forwarding Statistics (struct mrtstat, "
155     "netinet/ip_mroute.h)");
156 
157 VNET_DEFINE_STATIC(u_long, mfchash);
158 #define	V_mfchash		VNET(mfchash)
159 #define	MFCHASH(a, g)							\
160 	((((a).s_addr >> 20) ^ ((a).s_addr >> 10) ^ (a).s_addr ^ \
161 	  ((g).s_addr >> 20) ^ ((g).s_addr >> 10) ^ (g).s_addr) & V_mfchash)
162 #define	MFCHASHSIZE	256
163 
164 static u_long mfchashsize;			/* Hash size */
165 VNET_DEFINE_STATIC(u_char *, nexpire);		/* 0..mfchashsize-1 */
166 #define	V_nexpire		VNET(nexpire)
167 VNET_DEFINE_STATIC(LIST_HEAD(mfchashhdr, mfc)*, mfchashtbl);
168 #define	V_mfchashtbl		VNET(mfchashtbl)
169 
170 static struct mtx mfc_mtx;
171 #define	MFC_LOCK()		mtx_lock(&mfc_mtx)
172 #define	MFC_UNLOCK()		mtx_unlock(&mfc_mtx)
173 #define	MFC_LOCK_ASSERT()	mtx_assert(&mfc_mtx, MA_OWNED)
174 #define	MFC_LOCK_INIT()							\
175 	mtx_init(&mfc_mtx, "IPv4 multicast forwarding cache", NULL, MTX_DEF)
176 #define	MFC_LOCK_DESTROY()	mtx_destroy(&mfc_mtx)
177 
178 VNET_DEFINE_STATIC(vifi_t, numvifs);
179 #define	V_numvifs		VNET(numvifs)
180 VNET_DEFINE_STATIC(struct vif *, viftable);
181 #define	V_viftable		VNET(viftable)
182 
183 static struct mtx vif_mtx;
184 #define	VIF_LOCK()		mtx_lock(&vif_mtx)
185 #define	VIF_UNLOCK()		mtx_unlock(&vif_mtx)
186 #define	VIF_LOCK_ASSERT()	mtx_assert(&vif_mtx, MA_OWNED)
187 #define	VIF_LOCK_INIT()							\
188 	mtx_init(&vif_mtx, "IPv4 multicast interfaces", NULL, MTX_DEF)
189 #define	VIF_LOCK_DESTROY()	mtx_destroy(&vif_mtx)
190 
191 static eventhandler_tag if_detach_event_tag = NULL;
192 
193 VNET_DEFINE_STATIC(struct callout, expire_upcalls_ch);
194 #define	V_expire_upcalls_ch	VNET(expire_upcalls_ch)
195 
196 #define		EXPIRE_TIMEOUT	(hz / 4)	/* 4x / second		*/
197 #define		UPCALL_EXPIRE	6		/* number of timeouts	*/
198 
199 /*
200  * Bandwidth meter variables and constants
201  */
202 static MALLOC_DEFINE(M_BWMETER, "bwmeter", "multicast upcall bw meters");
203 
204 /*
205  * Pending upcalls are stored in a vector which is flushed when
206  * full, or periodically
207  */
208 VNET_DEFINE_STATIC(struct bw_upcall *, bw_upcalls);
209 #define	V_bw_upcalls		VNET(bw_upcalls)
210 VNET_DEFINE_STATIC(u_int, bw_upcalls_n); /* # of pending upcalls */
211 #define	V_bw_upcalls_n    	VNET(bw_upcalls_n)
212 VNET_DEFINE_STATIC(struct callout, bw_upcalls_ch);
213 #define	V_bw_upcalls_ch		VNET(bw_upcalls_ch)
214 
215 #define BW_UPCALLS_PERIOD (hz)		/* periodical flush of bw upcalls */
216 
217 VNET_PCPUSTAT_DEFINE_STATIC(struct pimstat, pimstat);
218 VNET_PCPUSTAT_SYSINIT(pimstat);
219 VNET_PCPUSTAT_SYSUNINIT(pimstat);
220 
221 SYSCTL_NODE(_net_inet, IPPROTO_PIM, pim, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
222     "PIM");
223 SYSCTL_VNET_PCPUSTAT(_net_inet_pim, PIMCTL_STATS, stats, struct pimstat,
224     pimstat, "PIM Statistics (struct pimstat, netinet/pim_var.h)");
225 
226 static u_long	pim_squelch_wholepkt = 0;
227 SYSCTL_ULONG(_net_inet_pim, OID_AUTO, squelch_wholepkt, CTLFLAG_RW,
228     &pim_squelch_wholepkt, 0,
229     "Disable IGMP_WHOLEPKT notifications if rendezvous point is unspecified");
230 
231 static const struct encaptab *pim_encap_cookie;
232 static int pim_encapcheck(const struct mbuf *, int, int, void *);
233 static int pim_input(struct mbuf *, int, int, void *);
234 
235 extern int in_mcast_loop;
236 
237 static const struct encap_config ipv4_encap_cfg = {
238 	.proto = IPPROTO_PIM,
239 	.min_length = sizeof(struct ip) + PIM_MINLEN,
240 	.exact_match = 8,
241 	.check = pim_encapcheck,
242 	.input = pim_input
243 };
244 
245 /*
246  * Note: the PIM Register encapsulation adds the following in front of a
247  * data packet:
248  *
249  * struct pim_encap_hdr {
250  *    struct ip ip;
251  *    struct pim_encap_pimhdr  pim;
252  * }
253  *
254  */
255 
256 struct pim_encap_pimhdr {
257 	struct pim pim;
258 	uint32_t   flags;
259 };
260 #define		PIM_ENCAP_TTL	64
261 
262 static struct ip pim_encap_iphdr = {
263 #if BYTE_ORDER == LITTLE_ENDIAN
264 	sizeof(struct ip) >> 2,
265 	IPVERSION,
266 #else
267 	IPVERSION,
268 	sizeof(struct ip) >> 2,
269 #endif
270 	0,			/* tos */
271 	sizeof(struct ip),	/* total length */
272 	0,			/* id */
273 	0,			/* frag offset */
274 	PIM_ENCAP_TTL,
275 	IPPROTO_PIM,
276 	0,			/* checksum */
277 };
278 
279 static struct pim_encap_pimhdr pim_encap_pimhdr = {
280     {
281 	PIM_MAKE_VT(PIM_VERSION, PIM_REGISTER), /* PIM vers and message type */
282 	0,			/* reserved */
283 	0,			/* checksum */
284     },
285     0				/* flags */
286 };
287 
288 VNET_DEFINE_STATIC(vifi_t, reg_vif_num) = VIFI_INVALID;
289 #define	V_reg_vif_num		VNET(reg_vif_num)
290 VNET_DEFINE_STATIC(struct ifnet, multicast_register_if);
291 #define	V_multicast_register_if	VNET(multicast_register_if)
292 
293 /*
294  * Private variables.
295  */
296 
297 static u_long	X_ip_mcast_src(int);
298 static int	X_ip_mforward(struct ip *, struct ifnet *, struct mbuf *,
299 		    struct ip_moptions *);
300 static int	X_ip_mrouter_done(void);
301 static int	X_ip_mrouter_get(struct socket *, struct sockopt *);
302 static int	X_ip_mrouter_set(struct socket *, struct sockopt *);
303 static int	X_legal_vif_num(int);
304 static int	X_mrt_ioctl(u_long, caddr_t, int);
305 
306 static int	add_bw_upcall(struct bw_upcall *);
307 static int	add_mfc(struct mfcctl2 *);
308 static int	add_vif(struct vifctl *);
309 static void	bw_meter_prepare_upcall(struct bw_meter *, struct timeval *);
310 static void	bw_meter_geq_receive_packet(struct bw_meter *, int,
311 		    struct timeval *);
312 static void	bw_upcalls_send(void);
313 static int	del_bw_upcall(struct bw_upcall *);
314 static int	del_mfc(struct mfcctl2 *);
315 static int	del_vif(vifi_t);
316 static int	del_vif_locked(vifi_t);
317 static void	expire_bw_upcalls_send(void *);
318 static void	expire_mfc(struct mfc *);
319 static void	expire_upcalls(void *);
320 static void	free_bw_list(struct bw_meter *);
321 static int	get_sg_cnt(struct sioc_sg_req *);
322 static int	get_vif_cnt(struct sioc_vif_req *);
323 static void	if_detached_event(void *, struct ifnet *);
324 static int	ip_mdq(struct mbuf *, struct ifnet *, struct mfc *, vifi_t);
325 static int	ip_mrouter_init(struct socket *, int);
326 static __inline struct mfc *
327 		mfc_find(struct in_addr *, struct in_addr *);
328 static void	phyint_send(struct ip *, struct vif *, struct mbuf *);
329 static struct mbuf *
330 		pim_register_prepare(struct ip *, struct mbuf *);
331 static int	pim_register_send(struct ip *, struct vif *,
332 		    struct mbuf *, struct mfc *);
333 static int	pim_register_send_rp(struct ip *, struct vif *,
334 		    struct mbuf *, struct mfc *);
335 static int	pim_register_send_upcall(struct ip *, struct vif *,
336 		    struct mbuf *, struct mfc *);
337 static void	send_packet(struct vif *, struct mbuf *);
338 static int	set_api_config(uint32_t *);
339 static int	set_assert(int);
340 static int	socket_send(struct socket *, struct mbuf *,
341 		    struct sockaddr_in *);
342 
343 /*
344  * Kernel multicast forwarding API capabilities and setup.
345  * If more API capabilities are added to the kernel, they should be
346  * recorded in `mrt_api_support'.
347  */
348 #define MRT_API_VERSION		0x0305
349 
350 static const int mrt_api_version = MRT_API_VERSION;
351 static const uint32_t mrt_api_support = (MRT_MFC_FLAGS_DISABLE_WRONGVIF |
352 					 MRT_MFC_FLAGS_BORDER_VIF |
353 					 MRT_MFC_RP |
354 					 MRT_MFC_BW_UPCALL);
355 VNET_DEFINE_STATIC(uint32_t, mrt_api_config);
356 #define	V_mrt_api_config	VNET(mrt_api_config)
357 VNET_DEFINE_STATIC(int, pim_assert_enabled);
358 #define	V_pim_assert_enabled	VNET(pim_assert_enabled)
359 static struct timeval pim_assert_interval = { 3, 0 };	/* Rate limit */
360 
361 /*
362  * Find a route for a given origin IP address and multicast group address.
363  * Statistics must be updated by the caller.
364  */
365 static __inline struct mfc *
366 mfc_find(struct in_addr *o, struct in_addr *g)
367 {
368 	struct mfc *rt;
369 
370 	MFC_LOCK_ASSERT();
371 
372 	LIST_FOREACH(rt, &V_mfchashtbl[MFCHASH(*o, *g)], mfc_hash) {
373 		if (in_hosteq(rt->mfc_origin, *o) &&
374 		    in_hosteq(rt->mfc_mcastgrp, *g) &&
375 		    TAILQ_EMPTY(&rt->mfc_stall))
376 			break;
377 	}
378 
379 	return (rt);
380 }
381 
382 /*
383  * Handle MRT setsockopt commands to modify the multicast forwarding tables.
384  */
385 static int
386 X_ip_mrouter_set(struct socket *so, struct sockopt *sopt)
387 {
388     int	error, optval;
389     vifi_t	vifi;
390     struct	vifctl vifc;
391     struct	mfcctl2 mfc;
392     struct	bw_upcall bw_upcall;
393     uint32_t	i;
394 
395     if (so != V_ip_mrouter && sopt->sopt_name != MRT_INIT)
396 	return EPERM;
397 
398     error = 0;
399     switch (sopt->sopt_name) {
400     case MRT_INIT:
401 	error = sooptcopyin(sopt, &optval, sizeof optval, sizeof optval);
402 	if (error)
403 	    break;
404 	error = ip_mrouter_init(so, optval);
405 	break;
406 
407     case MRT_DONE:
408 	error = ip_mrouter_done();
409 	break;
410 
411     case MRT_ADD_VIF:
412 	error = sooptcopyin(sopt, &vifc, sizeof vifc, sizeof vifc);
413 	if (error)
414 	    break;
415 	error = add_vif(&vifc);
416 	break;
417 
418     case MRT_DEL_VIF:
419 	error = sooptcopyin(sopt, &vifi, sizeof vifi, sizeof vifi);
420 	if (error)
421 	    break;
422 	error = del_vif(vifi);
423 	break;
424 
425     case MRT_ADD_MFC:
426     case MRT_DEL_MFC:
427 	/*
428 	 * select data size depending on API version.
429 	 */
430 	if (sopt->sopt_name == MRT_ADD_MFC &&
431 		V_mrt_api_config & MRT_API_FLAGS_ALL) {
432 	    error = sooptcopyin(sopt, &mfc, sizeof(struct mfcctl2),
433 				sizeof(struct mfcctl2));
434 	} else {
435 	    error = sooptcopyin(sopt, &mfc, sizeof(struct mfcctl),
436 				sizeof(struct mfcctl));
437 	    bzero((caddr_t)&mfc + sizeof(struct mfcctl),
438 			sizeof(mfc) - sizeof(struct mfcctl));
439 	}
440 	if (error)
441 	    break;
442 	if (sopt->sopt_name == MRT_ADD_MFC)
443 	    error = add_mfc(&mfc);
444 	else
445 	    error = del_mfc(&mfc);
446 	break;
447 
448     case MRT_ASSERT:
449 	error = sooptcopyin(sopt, &optval, sizeof optval, sizeof optval);
450 	if (error)
451 	    break;
452 	set_assert(optval);
453 	break;
454 
455     case MRT_API_CONFIG:
456 	error = sooptcopyin(sopt, &i, sizeof i, sizeof i);
457 	if (!error)
458 	    error = set_api_config(&i);
459 	if (!error)
460 	    error = sooptcopyout(sopt, &i, sizeof i);
461 	break;
462 
463     case MRT_ADD_BW_UPCALL:
464     case MRT_DEL_BW_UPCALL:
465 	error = sooptcopyin(sopt, &bw_upcall, sizeof bw_upcall,
466 				sizeof bw_upcall);
467 	if (error)
468 	    break;
469 	if (sopt->sopt_name == MRT_ADD_BW_UPCALL)
470 	    error = add_bw_upcall(&bw_upcall);
471 	else
472 	    error = del_bw_upcall(&bw_upcall);
473 	break;
474 
475     default:
476 	error = EOPNOTSUPP;
477 	break;
478     }
479     return error;
480 }
481 
482 /*
483  * Handle MRT getsockopt commands
484  */
485 static int
486 X_ip_mrouter_get(struct socket *so, struct sockopt *sopt)
487 {
488     int error;
489 
490     switch (sopt->sopt_name) {
491     case MRT_VERSION:
492 	error = sooptcopyout(sopt, &mrt_api_version, sizeof mrt_api_version);
493 	break;
494 
495     case MRT_ASSERT:
496 	error = sooptcopyout(sopt, &V_pim_assert_enabled,
497 	    sizeof V_pim_assert_enabled);
498 	break;
499 
500     case MRT_API_SUPPORT:
501 	error = sooptcopyout(sopt, &mrt_api_support, sizeof mrt_api_support);
502 	break;
503 
504     case MRT_API_CONFIG:
505 	error = sooptcopyout(sopt, &V_mrt_api_config, sizeof V_mrt_api_config);
506 	break;
507 
508     default:
509 	error = EOPNOTSUPP;
510 	break;
511     }
512     return error;
513 }
514 
515 /*
516  * Handle ioctl commands to obtain information from the cache
517  */
518 static int
519 X_mrt_ioctl(u_long cmd, caddr_t data, int fibnum __unused)
520 {
521     int error = 0;
522 
523     /*
524      * Currently the only function calling this ioctl routine is rtioctl_fib().
525      * Typically, only root can create the raw socket in order to execute
526      * this ioctl method, however the request might be coming from a prison
527      */
528     error = priv_check(curthread, PRIV_NETINET_MROUTE);
529     if (error)
530 	return (error);
531     switch (cmd) {
532     case (SIOCGETVIFCNT):
533 	error = get_vif_cnt((struct sioc_vif_req *)data);
534 	break;
535 
536     case (SIOCGETSGCNT):
537 	error = get_sg_cnt((struct sioc_sg_req *)data);
538 	break;
539 
540     default:
541 	error = EINVAL;
542 	break;
543     }
544     return error;
545 }
546 
547 /*
548  * returns the packet, byte, rpf-failure count for the source group provided
549  */
550 static int
551 get_sg_cnt(struct sioc_sg_req *req)
552 {
553     struct mfc *rt;
554 
555     MFC_LOCK();
556     rt = mfc_find(&req->src, &req->grp);
557     if (rt == NULL) {
558 	MFC_UNLOCK();
559 	req->pktcnt = req->bytecnt = req->wrong_if = 0xffffffff;
560 	return EADDRNOTAVAIL;
561     }
562     req->pktcnt = rt->mfc_pkt_cnt;
563     req->bytecnt = rt->mfc_byte_cnt;
564     req->wrong_if = rt->mfc_wrong_if;
565     MFC_UNLOCK();
566     return 0;
567 }
568 
569 /*
570  * returns the input and output packet and byte counts on the vif provided
571  */
572 static int
573 get_vif_cnt(struct sioc_vif_req *req)
574 {
575     vifi_t vifi = req->vifi;
576 
577     VIF_LOCK();
578     if (vifi >= V_numvifs) {
579 	VIF_UNLOCK();
580 	return EINVAL;
581     }
582 
583     req->icount = V_viftable[vifi].v_pkt_in;
584     req->ocount = V_viftable[vifi].v_pkt_out;
585     req->ibytes = V_viftable[vifi].v_bytes_in;
586     req->obytes = V_viftable[vifi].v_bytes_out;
587     VIF_UNLOCK();
588 
589     return 0;
590 }
591 
592 static void
593 if_detached_event(void *arg __unused, struct ifnet *ifp)
594 {
595     vifi_t vifi;
596     u_long i;
597 
598     MROUTER_LOCK();
599 
600     if (V_ip_mrouter == NULL) {
601 	MROUTER_UNLOCK();
602 	return;
603     }
604 
605     VIF_LOCK();
606     MFC_LOCK();
607 
608     /*
609      * Tear down multicast forwarder state associated with this ifnet.
610      * 1. Walk the vif list, matching vifs against this ifnet.
611      * 2. Walk the multicast forwarding cache (mfc) looking for
612      *    inner matches with this vif's index.
613      * 3. Expire any matching multicast forwarding cache entries.
614      * 4. Free vif state. This should disable ALLMULTI on the interface.
615      */
616     for (vifi = 0; vifi < V_numvifs; vifi++) {
617 	if (V_viftable[vifi].v_ifp != ifp)
618 		continue;
619 	for (i = 0; i < mfchashsize; i++) {
620 		struct mfc *rt, *nrt;
621 
622 		LIST_FOREACH_SAFE(rt, &V_mfchashtbl[i], mfc_hash, nrt) {
623 			if (rt->mfc_parent == vifi) {
624 				expire_mfc(rt);
625 			}
626 		}
627 	}
628 	del_vif_locked(vifi);
629     }
630 
631     MFC_UNLOCK();
632     VIF_UNLOCK();
633 
634     MROUTER_UNLOCK();
635 }
636 
637 /*
638  * Enable multicast forwarding.
639  */
640 static int
641 ip_mrouter_init(struct socket *so, int version)
642 {
643 
644     CTR3(KTR_IPMF, "%s: so_type %d, pr_protocol %d", __func__,
645         so->so_type, so->so_proto->pr_protocol);
646 
647     if (so->so_type != SOCK_RAW || so->so_proto->pr_protocol != IPPROTO_IGMP)
648 	return EOPNOTSUPP;
649 
650     if (version != 1)
651 	return ENOPROTOOPT;
652 
653     MROUTER_LOCK();
654 
655     if (ip_mrouter_unloading) {
656 	MROUTER_UNLOCK();
657 	return ENOPROTOOPT;
658     }
659 
660     if (V_ip_mrouter != NULL) {
661 	MROUTER_UNLOCK();
662 	return EADDRINUSE;
663     }
664 
665     V_mfchashtbl = hashinit_flags(mfchashsize, M_MRTABLE, &V_mfchash,
666 	HASH_NOWAIT);
667 
668     callout_reset(&V_expire_upcalls_ch, EXPIRE_TIMEOUT, expire_upcalls,
669 	curvnet);
670     callout_reset(&V_bw_upcalls_ch, BW_UPCALLS_PERIOD, expire_bw_upcalls_send,
671 	curvnet);
672 
673     V_ip_mrouter = so;
674     ip_mrouter_cnt++;
675 
676     MROUTER_UNLOCK();
677 
678     CTR1(KTR_IPMF, "%s: done", __func__);
679 
680     return 0;
681 }
682 
683 /*
684  * Disable multicast forwarding.
685  */
686 static int
687 X_ip_mrouter_done(void)
688 {
689     struct ifnet *ifp;
690     u_long i;
691     vifi_t vifi;
692 
693     MROUTER_LOCK();
694 
695     if (V_ip_mrouter == NULL) {
696 	MROUTER_UNLOCK();
697 	return EINVAL;
698     }
699 
700     /*
701      * Detach/disable hooks to the reset of the system.
702      */
703     V_ip_mrouter = NULL;
704     ip_mrouter_cnt--;
705     V_mrt_api_config = 0;
706 
707     MROUTER_WAIT();
708 
709     VIF_LOCK();
710 
711     /*
712      * For each phyint in use, disable promiscuous reception of all IP
713      * multicasts.
714      */
715     for (vifi = 0; vifi < V_numvifs; vifi++) {
716 	if (!in_nullhost(V_viftable[vifi].v_lcl_addr) &&
717 		!(V_viftable[vifi].v_flags & (VIFF_TUNNEL | VIFF_REGISTER))) {
718 	    ifp = V_viftable[vifi].v_ifp;
719 	    if_allmulti(ifp, 0);
720 	}
721     }
722     bzero((caddr_t)V_viftable, sizeof(*V_viftable) * MAXVIFS);
723     V_numvifs = 0;
724     V_pim_assert_enabled = 0;
725 
726     VIF_UNLOCK();
727 
728     callout_stop(&V_expire_upcalls_ch);
729     callout_stop(&V_bw_upcalls_ch);
730 
731     MFC_LOCK();
732 
733     /*
734      * Free all multicast forwarding cache entries.
735      * Do not use hashdestroy(), as we must perform other cleanup.
736      */
737     for (i = 0; i < mfchashsize; i++) {
738 	struct mfc *rt, *nrt;
739 
740 	LIST_FOREACH_SAFE(rt, &V_mfchashtbl[i], mfc_hash, nrt) {
741 		expire_mfc(rt);
742 	}
743     }
744     free(V_mfchashtbl, M_MRTABLE);
745     V_mfchashtbl = NULL;
746 
747     bzero(V_nexpire, sizeof(V_nexpire[0]) * mfchashsize);
748 
749     V_bw_upcalls_n = 0;
750 
751     MFC_UNLOCK();
752 
753     V_reg_vif_num = VIFI_INVALID;
754 
755     MROUTER_UNLOCK();
756 
757     CTR1(KTR_IPMF, "%s: done", __func__);
758 
759     return 0;
760 }
761 
762 /*
763  * Set PIM assert processing global
764  */
765 static int
766 set_assert(int i)
767 {
768     if ((i != 1) && (i != 0))
769 	return EINVAL;
770 
771     V_pim_assert_enabled = i;
772 
773     return 0;
774 }
775 
776 /*
777  * Configure API capabilities
778  */
779 int
780 set_api_config(uint32_t *apival)
781 {
782     u_long i;
783 
784     /*
785      * We can set the API capabilities only if it is the first operation
786      * after MRT_INIT. I.e.:
787      *  - there are no vifs installed
788      *  - pim_assert is not enabled
789      *  - the MFC table is empty
790      */
791     if (V_numvifs > 0) {
792 	*apival = 0;
793 	return EPERM;
794     }
795     if (V_pim_assert_enabled) {
796 	*apival = 0;
797 	return EPERM;
798     }
799 
800     MFC_LOCK();
801 
802     for (i = 0; i < mfchashsize; i++) {
803 	if (LIST_FIRST(&V_mfchashtbl[i]) != NULL) {
804 	    MFC_UNLOCK();
805 	    *apival = 0;
806 	    return EPERM;
807 	}
808     }
809 
810     MFC_UNLOCK();
811 
812     V_mrt_api_config = *apival & mrt_api_support;
813     *apival = V_mrt_api_config;
814 
815     return 0;
816 }
817 
818 /*
819  * Add a vif to the vif table
820  */
821 static int
822 add_vif(struct vifctl *vifcp)
823 {
824     struct vif *vifp = V_viftable + vifcp->vifc_vifi;
825     struct sockaddr_in sin = {sizeof sin, AF_INET};
826     struct ifaddr *ifa;
827     struct ifnet *ifp;
828     int error;
829 
830     VIF_LOCK();
831     if (vifcp->vifc_vifi >= MAXVIFS) {
832 	VIF_UNLOCK();
833 	return EINVAL;
834     }
835     /* rate limiting is no longer supported by this code */
836     if (vifcp->vifc_rate_limit != 0) {
837 	log(LOG_ERR, "rate limiting is no longer supported\n");
838 	VIF_UNLOCK();
839 	return EINVAL;
840     }
841     if (!in_nullhost(vifp->v_lcl_addr)) {
842 	VIF_UNLOCK();
843 	return EADDRINUSE;
844     }
845     if (in_nullhost(vifcp->vifc_lcl_addr)) {
846 	VIF_UNLOCK();
847 	return EADDRNOTAVAIL;
848     }
849 
850     /* Find the interface with an address in AF_INET family */
851     if (vifcp->vifc_flags & VIFF_REGISTER) {
852 	/*
853 	 * XXX: Because VIFF_REGISTER does not really need a valid
854 	 * local interface (e.g. it could be 127.0.0.2), we don't
855 	 * check its address.
856 	 */
857 	ifp = NULL;
858     } else {
859 	struct epoch_tracker et;
860 
861 	sin.sin_addr = vifcp->vifc_lcl_addr;
862 	NET_EPOCH_ENTER(et);
863 	ifa = ifa_ifwithaddr((struct sockaddr *)&sin);
864 	if (ifa == NULL) {
865 	    NET_EPOCH_EXIT(et);
866 	    VIF_UNLOCK();
867 	    return EADDRNOTAVAIL;
868 	}
869 	ifp = ifa->ifa_ifp;
870 	/* XXX FIXME we need to take a ref on ifp and cleanup properly! */
871 	NET_EPOCH_EXIT(et);
872     }
873 
874     if ((vifcp->vifc_flags & VIFF_TUNNEL) != 0) {
875 	CTR1(KTR_IPMF, "%s: tunnels are no longer supported", __func__);
876 	VIF_UNLOCK();
877 	return EOPNOTSUPP;
878     } else if (vifcp->vifc_flags & VIFF_REGISTER) {
879 	ifp = &V_multicast_register_if;
880 	CTR2(KTR_IPMF, "%s: add register vif for ifp %p", __func__, ifp);
881 	if (V_reg_vif_num == VIFI_INVALID) {
882 	    if_initname(&V_multicast_register_if, "register_vif", 0);
883 	    V_multicast_register_if.if_flags = IFF_LOOPBACK;
884 	    V_reg_vif_num = vifcp->vifc_vifi;
885 	}
886     } else {		/* Make sure the interface supports multicast */
887 	if ((ifp->if_flags & IFF_MULTICAST) == 0) {
888 	    VIF_UNLOCK();
889 	    return EOPNOTSUPP;
890 	}
891 
892 	/* Enable promiscuous reception of all IP multicasts from the if */
893 	error = if_allmulti(ifp, 1);
894 	if (error) {
895 	    VIF_UNLOCK();
896 	    return error;
897 	}
898     }
899 
900     vifp->v_flags     = vifcp->vifc_flags;
901     vifp->v_threshold = vifcp->vifc_threshold;
902     vifp->v_lcl_addr  = vifcp->vifc_lcl_addr;
903     vifp->v_rmt_addr  = vifcp->vifc_rmt_addr;
904     vifp->v_ifp       = ifp;
905     /* initialize per vif pkt counters */
906     vifp->v_pkt_in    = 0;
907     vifp->v_pkt_out   = 0;
908     vifp->v_bytes_in  = 0;
909     vifp->v_bytes_out = 0;
910 
911     /* Adjust numvifs up if the vifi is higher than numvifs */
912     if (V_numvifs <= vifcp->vifc_vifi)
913 	V_numvifs = vifcp->vifc_vifi + 1;
914 
915     VIF_UNLOCK();
916 
917     CTR4(KTR_IPMF, "%s: add vif %d laddr 0x%08x thresh %x", __func__,
918 	(int)vifcp->vifc_vifi, ntohl(vifcp->vifc_lcl_addr.s_addr),
919 	(int)vifcp->vifc_threshold);
920 
921     return 0;
922 }
923 
924 /*
925  * Delete a vif from the vif table
926  */
927 static int
928 del_vif_locked(vifi_t vifi)
929 {
930     struct vif *vifp;
931 
932     VIF_LOCK_ASSERT();
933 
934     if (vifi >= V_numvifs) {
935 	return EINVAL;
936     }
937     vifp = &V_viftable[vifi];
938     if (in_nullhost(vifp->v_lcl_addr)) {
939 	return EADDRNOTAVAIL;
940     }
941 
942     if (!(vifp->v_flags & (VIFF_TUNNEL | VIFF_REGISTER)))
943 	if_allmulti(vifp->v_ifp, 0);
944 
945     if (vifp->v_flags & VIFF_REGISTER)
946 	V_reg_vif_num = VIFI_INVALID;
947 
948     bzero((caddr_t)vifp, sizeof (*vifp));
949 
950     CTR2(KTR_IPMF, "%s: delete vif %d", __func__, (int)vifi);
951 
952     /* Adjust numvifs down */
953     for (vifi = V_numvifs; vifi > 0; vifi--)
954 	if (!in_nullhost(V_viftable[vifi-1].v_lcl_addr))
955 	    break;
956     V_numvifs = vifi;
957 
958     return 0;
959 }
960 
961 static int
962 del_vif(vifi_t vifi)
963 {
964     int cc;
965 
966     VIF_LOCK();
967     cc = del_vif_locked(vifi);
968     VIF_UNLOCK();
969 
970     return cc;
971 }
972 
973 /*
974  * update an mfc entry without resetting counters and S,G addresses.
975  */
976 static void
977 update_mfc_params(struct mfc *rt, struct mfcctl2 *mfccp)
978 {
979     int i;
980 
981     rt->mfc_parent = mfccp->mfcc_parent;
982     for (i = 0; i < V_numvifs; i++) {
983 	rt->mfc_ttls[i] = mfccp->mfcc_ttls[i];
984 	rt->mfc_flags[i] = mfccp->mfcc_flags[i] & V_mrt_api_config &
985 	    MRT_MFC_FLAGS_ALL;
986     }
987     /* set the RP address */
988     if (V_mrt_api_config & MRT_MFC_RP)
989 	rt->mfc_rp = mfccp->mfcc_rp;
990     else
991 	rt->mfc_rp.s_addr = INADDR_ANY;
992 }
993 
994 /*
995  * fully initialize an mfc entry from the parameter.
996  */
997 static void
998 init_mfc_params(struct mfc *rt, struct mfcctl2 *mfccp)
999 {
1000     rt->mfc_origin     = mfccp->mfcc_origin;
1001     rt->mfc_mcastgrp   = mfccp->mfcc_mcastgrp;
1002 
1003     update_mfc_params(rt, mfccp);
1004 
1005     /* initialize pkt counters per src-grp */
1006     rt->mfc_pkt_cnt    = 0;
1007     rt->mfc_byte_cnt   = 0;
1008     rt->mfc_wrong_if   = 0;
1009     timevalclear(&rt->mfc_last_assert);
1010 }
1011 
1012 static void
1013 expire_mfc(struct mfc *rt)
1014 {
1015 	struct rtdetq *rte, *nrte;
1016 
1017 	MFC_LOCK_ASSERT();
1018 
1019 	free_bw_list(rt->mfc_bw_meter_leq);
1020 	free_bw_list(rt->mfc_bw_meter_geq);
1021 
1022 	TAILQ_FOREACH_SAFE(rte, &rt->mfc_stall, rte_link, nrte) {
1023 		m_freem(rte->m);
1024 		TAILQ_REMOVE(&rt->mfc_stall, rte, rte_link);
1025 		free(rte, M_MRTABLE);
1026 	}
1027 
1028 	LIST_REMOVE(rt, mfc_hash);
1029 	free(rt, M_MRTABLE);
1030 }
1031 
1032 /*
1033  * Add an mfc entry
1034  */
1035 static int
1036 add_mfc(struct mfcctl2 *mfccp)
1037 {
1038     struct mfc *rt;
1039     struct rtdetq *rte, *nrte;
1040     u_long hash = 0;
1041     u_short nstl;
1042 
1043     VIF_LOCK();
1044     MFC_LOCK();
1045 
1046     rt = mfc_find(&mfccp->mfcc_origin, &mfccp->mfcc_mcastgrp);
1047 
1048     /* If an entry already exists, just update the fields */
1049     if (rt) {
1050 	CTR4(KTR_IPMF, "%s: update mfc orig 0x%08x group %lx parent %x",
1051 	    __func__, ntohl(mfccp->mfcc_origin.s_addr),
1052 	    (u_long)ntohl(mfccp->mfcc_mcastgrp.s_addr),
1053 	    mfccp->mfcc_parent);
1054 	update_mfc_params(rt, mfccp);
1055 	MFC_UNLOCK();
1056 	VIF_UNLOCK();
1057 	return (0);
1058     }
1059 
1060     /*
1061      * Find the entry for which the upcall was made and update
1062      */
1063     nstl = 0;
1064     hash = MFCHASH(mfccp->mfcc_origin, mfccp->mfcc_mcastgrp);
1065     LIST_FOREACH(rt, &V_mfchashtbl[hash], mfc_hash) {
1066 	if (in_hosteq(rt->mfc_origin, mfccp->mfcc_origin) &&
1067 	    in_hosteq(rt->mfc_mcastgrp, mfccp->mfcc_mcastgrp) &&
1068 	    !TAILQ_EMPTY(&rt->mfc_stall)) {
1069 		CTR5(KTR_IPMF,
1070 		    "%s: add mfc orig 0x%08x group %lx parent %x qh %p",
1071 		    __func__, ntohl(mfccp->mfcc_origin.s_addr),
1072 		    (u_long)ntohl(mfccp->mfcc_mcastgrp.s_addr),
1073 		    mfccp->mfcc_parent,
1074 		    TAILQ_FIRST(&rt->mfc_stall));
1075 		if (nstl++)
1076 			CTR1(KTR_IPMF, "%s: multiple matches", __func__);
1077 
1078 		init_mfc_params(rt, mfccp);
1079 		rt->mfc_expire = 0;	/* Don't clean this guy up */
1080 		V_nexpire[hash]--;
1081 
1082 		/* Free queued packets, but attempt to forward them first. */
1083 		TAILQ_FOREACH_SAFE(rte, &rt->mfc_stall, rte_link, nrte) {
1084 			if (rte->ifp != NULL)
1085 				ip_mdq(rte->m, rte->ifp, rt, -1);
1086 			m_freem(rte->m);
1087 			TAILQ_REMOVE(&rt->mfc_stall, rte, rte_link);
1088 			rt->mfc_nstall--;
1089 			free(rte, M_MRTABLE);
1090 		}
1091 	}
1092     }
1093 
1094     /*
1095      * It is possible that an entry is being inserted without an upcall
1096      */
1097     if (nstl == 0) {
1098 	CTR1(KTR_IPMF, "%s: adding mfc w/o upcall", __func__);
1099 	LIST_FOREACH(rt, &V_mfchashtbl[hash], mfc_hash) {
1100 		if (in_hosteq(rt->mfc_origin, mfccp->mfcc_origin) &&
1101 		    in_hosteq(rt->mfc_mcastgrp, mfccp->mfcc_mcastgrp)) {
1102 			init_mfc_params(rt, mfccp);
1103 			if (rt->mfc_expire)
1104 			    V_nexpire[hash]--;
1105 			rt->mfc_expire = 0;
1106 			break; /* XXX */
1107 		}
1108 	}
1109 
1110 	if (rt == NULL) {		/* no upcall, so make a new entry */
1111 	    rt = (struct mfc *)malloc(sizeof(*rt), M_MRTABLE, M_NOWAIT);
1112 	    if (rt == NULL) {
1113 		MFC_UNLOCK();
1114 		VIF_UNLOCK();
1115 		return (ENOBUFS);
1116 	    }
1117 
1118 	    init_mfc_params(rt, mfccp);
1119 	    TAILQ_INIT(&rt->mfc_stall);
1120 	    rt->mfc_nstall = 0;
1121 
1122 	    rt->mfc_expire     = 0;
1123 	    rt->mfc_bw_meter_leq = NULL;
1124 	    rt->mfc_bw_meter_geq = NULL;
1125 
1126 	    /* insert new entry at head of hash chain */
1127 	    LIST_INSERT_HEAD(&V_mfchashtbl[hash], rt, mfc_hash);
1128 	}
1129     }
1130 
1131     MFC_UNLOCK();
1132     VIF_UNLOCK();
1133 
1134     return (0);
1135 }
1136 
1137 /*
1138  * Delete an mfc entry
1139  */
1140 static int
1141 del_mfc(struct mfcctl2 *mfccp)
1142 {
1143     struct in_addr	origin;
1144     struct in_addr	mcastgrp;
1145     struct mfc		*rt;
1146 
1147     origin = mfccp->mfcc_origin;
1148     mcastgrp = mfccp->mfcc_mcastgrp;
1149 
1150     CTR3(KTR_IPMF, "%s: delete mfc orig 0x%08x group %lx", __func__,
1151 	ntohl(origin.s_addr), (u_long)ntohl(mcastgrp.s_addr));
1152 
1153     MFC_LOCK();
1154 
1155     rt = mfc_find(&origin, &mcastgrp);
1156     if (rt == NULL) {
1157 	MFC_UNLOCK();
1158 	return EADDRNOTAVAIL;
1159     }
1160 
1161     /*
1162      * free the bw_meter entries
1163      */
1164     free_bw_list(rt->mfc_bw_meter_leq);
1165     rt->mfc_bw_meter_leq = NULL;
1166     free_bw_list(rt->mfc_bw_meter_geq);
1167     rt->mfc_bw_meter_geq = NULL;
1168 
1169     LIST_REMOVE(rt, mfc_hash);
1170     free(rt, M_MRTABLE);
1171 
1172     MFC_UNLOCK();
1173 
1174     return (0);
1175 }
1176 
1177 /*
1178  * Send a message to the routing daemon on the multicast routing socket.
1179  */
1180 static int
1181 socket_send(struct socket *s, struct mbuf *mm, struct sockaddr_in *src)
1182 {
1183     if (s) {
1184 	SOCKBUF_LOCK(&s->so_rcv);
1185 	if (sbappendaddr_locked(&s->so_rcv, (struct sockaddr *)src, mm,
1186 	    NULL) != 0) {
1187 	    sorwakeup_locked(s);
1188 	    return 0;
1189 	}
1190 	SOCKBUF_UNLOCK(&s->so_rcv);
1191     }
1192     m_freem(mm);
1193     return -1;
1194 }
1195 
1196 /*
1197  * IP multicast forwarding function. This function assumes that the packet
1198  * pointed to by "ip" has arrived on (or is about to be sent to) the interface
1199  * pointed to by "ifp", and the packet is to be relayed to other networks
1200  * that have members of the packet's destination IP multicast group.
1201  *
1202  * The packet is returned unscathed to the caller, unless it is
1203  * erroneous, in which case a non-zero return value tells the caller to
1204  * discard it.
1205  */
1206 
1207 #define TUNNEL_LEN  12  /* # bytes of IP option for tunnel encapsulation  */
1208 
1209 static int
1210 X_ip_mforward(struct ip *ip, struct ifnet *ifp, struct mbuf *m,
1211     struct ip_moptions *imo)
1212 {
1213     struct mfc *rt;
1214     int error;
1215     vifi_t vifi;
1216 
1217     CTR3(KTR_IPMF, "ip_mforward: delete mfc orig 0x%08x group %lx ifp %p",
1218 	ntohl(ip->ip_src.s_addr), (u_long)ntohl(ip->ip_dst.s_addr), ifp);
1219 
1220     if (ip->ip_hl < (sizeof(struct ip) + TUNNEL_LEN) >> 2 ||
1221 		((u_char *)(ip + 1))[1] != IPOPT_LSRR ) {
1222 	/*
1223 	 * Packet arrived via a physical interface or
1224 	 * an encapsulated tunnel or a register_vif.
1225 	 */
1226     } else {
1227 	/*
1228 	 * Packet arrived through a source-route tunnel.
1229 	 * Source-route tunnels are no longer supported.
1230 	 */
1231 	return (1);
1232     }
1233 
1234     VIF_LOCK();
1235     MFC_LOCK();
1236     if (imo && ((vifi = imo->imo_multicast_vif) < V_numvifs)) {
1237 	if (ip->ip_ttl < MAXTTL)
1238 	    ip->ip_ttl++;	/* compensate for -1 in *_send routines */
1239 	error = ip_mdq(m, ifp, NULL, vifi);
1240 	MFC_UNLOCK();
1241 	VIF_UNLOCK();
1242 	return error;
1243     }
1244 
1245     /*
1246      * Don't forward a packet with time-to-live of zero or one,
1247      * or a packet destined to a local-only group.
1248      */
1249     if (ip->ip_ttl <= 1 || IN_LOCAL_GROUP(ntohl(ip->ip_dst.s_addr))) {
1250 	MFC_UNLOCK();
1251 	VIF_UNLOCK();
1252 	return 0;
1253     }
1254 
1255     /*
1256      * Determine forwarding vifs from the forwarding cache table
1257      */
1258     MRTSTAT_INC(mrts_mfc_lookups);
1259     rt = mfc_find(&ip->ip_src, &ip->ip_dst);
1260 
1261     /* Entry exists, so forward if necessary */
1262     if (rt != NULL) {
1263 	error = ip_mdq(m, ifp, rt, -1);
1264 	MFC_UNLOCK();
1265 	VIF_UNLOCK();
1266 	return error;
1267     } else {
1268 	/*
1269 	 * If we don't have a route for packet's origin,
1270 	 * Make a copy of the packet & send message to routing daemon
1271 	 */
1272 
1273 	struct mbuf *mb0;
1274 	struct rtdetq *rte;
1275 	u_long hash;
1276 	int hlen = ip->ip_hl << 2;
1277 
1278 	MRTSTAT_INC(mrts_mfc_misses);
1279 	MRTSTAT_INC(mrts_no_route);
1280 	CTR2(KTR_IPMF, "ip_mforward: no mfc for (0x%08x,%lx)",
1281 	    ntohl(ip->ip_src.s_addr), (u_long)ntohl(ip->ip_dst.s_addr));
1282 
1283 	/*
1284 	 * Allocate mbufs early so that we don't do extra work if we are
1285 	 * just going to fail anyway.  Make sure to pullup the header so
1286 	 * that other people can't step on it.
1287 	 */
1288 	rte = (struct rtdetq *)malloc((sizeof *rte), M_MRTABLE,
1289 	    M_NOWAIT|M_ZERO);
1290 	if (rte == NULL) {
1291 	    MFC_UNLOCK();
1292 	    VIF_UNLOCK();
1293 	    return ENOBUFS;
1294 	}
1295 
1296 	mb0 = m_copypacket(m, M_NOWAIT);
1297 	if (mb0 && (!M_WRITABLE(mb0) || mb0->m_len < hlen))
1298 	    mb0 = m_pullup(mb0, hlen);
1299 	if (mb0 == NULL) {
1300 	    free(rte, M_MRTABLE);
1301 	    MFC_UNLOCK();
1302 	    VIF_UNLOCK();
1303 	    return ENOBUFS;
1304 	}
1305 
1306 	/* is there an upcall waiting for this flow ? */
1307 	hash = MFCHASH(ip->ip_src, ip->ip_dst);
1308 	LIST_FOREACH(rt, &V_mfchashtbl[hash], mfc_hash) {
1309 		if (in_hosteq(ip->ip_src, rt->mfc_origin) &&
1310 		    in_hosteq(ip->ip_dst, rt->mfc_mcastgrp) &&
1311 		    !TAILQ_EMPTY(&rt->mfc_stall))
1312 			break;
1313 	}
1314 
1315 	if (rt == NULL) {
1316 	    int i;
1317 	    struct igmpmsg *im;
1318 	    struct sockaddr_in k_igmpsrc = { sizeof k_igmpsrc, AF_INET };
1319 	    struct mbuf *mm;
1320 
1321 	    /*
1322 	     * Locate the vifi for the incoming interface for this packet.
1323 	     * If none found, drop packet.
1324 	     */
1325 	    for (vifi = 0; vifi < V_numvifs &&
1326 		    V_viftable[vifi].v_ifp != ifp; vifi++)
1327 		;
1328 	    if (vifi >= V_numvifs)	/* vif not found, drop packet */
1329 		goto non_fatal;
1330 
1331 	    /* no upcall, so make a new entry */
1332 	    rt = (struct mfc *)malloc(sizeof(*rt), M_MRTABLE, M_NOWAIT);
1333 	    if (rt == NULL)
1334 		goto fail;
1335 
1336 	    /* Make a copy of the header to send to the user level process */
1337 	    mm = m_copym(mb0, 0, hlen, M_NOWAIT);
1338 	    if (mm == NULL)
1339 		goto fail1;
1340 
1341 	    /*
1342 	     * Send message to routing daemon to install
1343 	     * a route into the kernel table
1344 	     */
1345 
1346 	    im = mtod(mm, struct igmpmsg *);
1347 	    im->im_msgtype = IGMPMSG_NOCACHE;
1348 	    im->im_mbz = 0;
1349 	    im->im_vif = vifi;
1350 
1351 	    MRTSTAT_INC(mrts_upcalls);
1352 
1353 	    k_igmpsrc.sin_addr = ip->ip_src;
1354 	    if (socket_send(V_ip_mrouter, mm, &k_igmpsrc) < 0) {
1355 		CTR0(KTR_IPMF, "ip_mforward: socket queue full");
1356 		MRTSTAT_INC(mrts_upq_sockfull);
1357 fail1:
1358 		free(rt, M_MRTABLE);
1359 fail:
1360 		free(rte, M_MRTABLE);
1361 		m_freem(mb0);
1362 		MFC_UNLOCK();
1363 		VIF_UNLOCK();
1364 		return ENOBUFS;
1365 	    }
1366 
1367 	    /* insert new entry at head of hash chain */
1368 	    rt->mfc_origin.s_addr     = ip->ip_src.s_addr;
1369 	    rt->mfc_mcastgrp.s_addr   = ip->ip_dst.s_addr;
1370 	    rt->mfc_expire	      = UPCALL_EXPIRE;
1371 	    V_nexpire[hash]++;
1372 	    for (i = 0; i < V_numvifs; i++) {
1373 		rt->mfc_ttls[i] = 0;
1374 		rt->mfc_flags[i] = 0;
1375 	    }
1376 	    rt->mfc_parent = -1;
1377 
1378 	    /* clear the RP address */
1379 	    rt->mfc_rp.s_addr = INADDR_ANY;
1380 	    rt->mfc_bw_meter_leq = NULL;
1381 	    rt->mfc_bw_meter_geq = NULL;
1382 
1383 	    /* initialize pkt counters per src-grp */
1384 	    rt->mfc_pkt_cnt = 0;
1385 	    rt->mfc_byte_cnt = 0;
1386 	    rt->mfc_wrong_if = 0;
1387 	    timevalclear(&rt->mfc_last_assert);
1388 
1389 	    TAILQ_INIT(&rt->mfc_stall);
1390 	    rt->mfc_nstall = 0;
1391 
1392 	    /* link into table */
1393 	    LIST_INSERT_HEAD(&V_mfchashtbl[hash], rt, mfc_hash);
1394 	    TAILQ_INSERT_HEAD(&rt->mfc_stall, rte, rte_link);
1395 	    rt->mfc_nstall++;
1396 
1397 	} else {
1398 	    /* determine if queue has overflowed */
1399 	    if (rt->mfc_nstall > MAX_UPQ) {
1400 		MRTSTAT_INC(mrts_upq_ovflw);
1401 non_fatal:
1402 		free(rte, M_MRTABLE);
1403 		m_freem(mb0);
1404 		MFC_UNLOCK();
1405 		VIF_UNLOCK();
1406 		return (0);
1407 	    }
1408 	    TAILQ_INSERT_TAIL(&rt->mfc_stall, rte, rte_link);
1409 	    rt->mfc_nstall++;
1410 	}
1411 
1412 	rte->m			= mb0;
1413 	rte->ifp		= ifp;
1414 
1415 	MFC_UNLOCK();
1416 	VIF_UNLOCK();
1417 
1418 	return 0;
1419     }
1420 }
1421 
1422 /*
1423  * Clean up the cache entry if upcall is not serviced
1424  */
1425 static void
1426 expire_upcalls(void *arg)
1427 {
1428     u_long i;
1429 
1430     CURVNET_SET((struct vnet *) arg);
1431 
1432     MFC_LOCK();
1433 
1434     for (i = 0; i < mfchashsize; i++) {
1435 	struct mfc *rt, *nrt;
1436 
1437 	if (V_nexpire[i] == 0)
1438 	    continue;
1439 
1440 	LIST_FOREACH_SAFE(rt, &V_mfchashtbl[i], mfc_hash, nrt) {
1441 		if (TAILQ_EMPTY(&rt->mfc_stall))
1442 			continue;
1443 
1444 		if (rt->mfc_expire == 0 || --rt->mfc_expire > 0)
1445 			continue;
1446 
1447 		MRTSTAT_INC(mrts_cache_cleanups);
1448 		CTR3(KTR_IPMF, "%s: expire (%lx, %lx)", __func__,
1449 		    (u_long)ntohl(rt->mfc_origin.s_addr),
1450 		    (u_long)ntohl(rt->mfc_mcastgrp.s_addr));
1451 
1452 		expire_mfc(rt);
1453 	    }
1454     }
1455 
1456     MFC_UNLOCK();
1457 
1458     callout_reset(&V_expire_upcalls_ch, EXPIRE_TIMEOUT, expire_upcalls,
1459 	curvnet);
1460 
1461     CURVNET_RESTORE();
1462 }
1463 
1464 /*
1465  * Packet forwarding routine once entry in the cache is made
1466  */
1467 static int
1468 ip_mdq(struct mbuf *m, struct ifnet *ifp, struct mfc *rt, vifi_t xmt_vif)
1469 {
1470     struct ip  *ip = mtod(m, struct ip *);
1471     vifi_t vifi;
1472     int plen = ntohs(ip->ip_len);
1473 
1474     VIF_LOCK_ASSERT();
1475 
1476     /*
1477      * If xmt_vif is not -1, send on only the requested vif.
1478      *
1479      * (since vifi_t is u_short, -1 becomes MAXUSHORT, which > numvifs.)
1480      */
1481     if (xmt_vif < V_numvifs) {
1482 	if (V_viftable[xmt_vif].v_flags & VIFF_REGISTER)
1483 		pim_register_send(ip, V_viftable + xmt_vif, m, rt);
1484 	else
1485 		phyint_send(ip, V_viftable + xmt_vif, m);
1486 	return 1;
1487     }
1488 
1489     /*
1490      * Don't forward if it didn't arrive from the parent vif for its origin.
1491      */
1492     vifi = rt->mfc_parent;
1493     if ((vifi >= V_numvifs) || (V_viftable[vifi].v_ifp != ifp)) {
1494 	CTR4(KTR_IPMF, "%s: rx on wrong ifp %p (vifi %d, v_ifp %p)",
1495 	    __func__, ifp, (int)vifi, V_viftable[vifi].v_ifp);
1496 	MRTSTAT_INC(mrts_wrong_if);
1497 	++rt->mfc_wrong_if;
1498 	/*
1499 	 * If we are doing PIM assert processing, send a message
1500 	 * to the routing daemon.
1501 	 *
1502 	 * XXX: A PIM-SM router needs the WRONGVIF detection so it
1503 	 * can complete the SPT switch, regardless of the type
1504 	 * of the iif (broadcast media, GRE tunnel, etc).
1505 	 */
1506 	if (V_pim_assert_enabled && (vifi < V_numvifs) &&
1507 	    V_viftable[vifi].v_ifp) {
1508 	    if (ifp == &V_multicast_register_if)
1509 		PIMSTAT_INC(pims_rcv_registers_wrongiif);
1510 
1511 	    /* Get vifi for the incoming packet */
1512 	    for (vifi = 0; vifi < V_numvifs && V_viftable[vifi].v_ifp != ifp;
1513 		vifi++)
1514 		;
1515 	    if (vifi >= V_numvifs)
1516 		return 0;	/* The iif is not found: ignore the packet. */
1517 
1518 	    if (rt->mfc_flags[vifi] & MRT_MFC_FLAGS_DISABLE_WRONGVIF)
1519 		return 0;	/* WRONGVIF disabled: ignore the packet */
1520 
1521 	    if (ratecheck(&rt->mfc_last_assert, &pim_assert_interval)) {
1522 		struct sockaddr_in k_igmpsrc = { sizeof k_igmpsrc, AF_INET };
1523 		struct igmpmsg *im;
1524 		int hlen = ip->ip_hl << 2;
1525 		struct mbuf *mm = m_copym(m, 0, hlen, M_NOWAIT);
1526 
1527 		if (mm && (!M_WRITABLE(mm) || mm->m_len < hlen))
1528 		    mm = m_pullup(mm, hlen);
1529 		if (mm == NULL)
1530 		    return ENOBUFS;
1531 
1532 		im = mtod(mm, struct igmpmsg *);
1533 		im->im_msgtype	= IGMPMSG_WRONGVIF;
1534 		im->im_mbz		= 0;
1535 		im->im_vif		= vifi;
1536 
1537 		MRTSTAT_INC(mrts_upcalls);
1538 
1539 		k_igmpsrc.sin_addr = im->im_src;
1540 		if (socket_send(V_ip_mrouter, mm, &k_igmpsrc) < 0) {
1541 		    CTR1(KTR_IPMF, "%s: socket queue full", __func__);
1542 		    MRTSTAT_INC(mrts_upq_sockfull);
1543 		    return ENOBUFS;
1544 		}
1545 	    }
1546 	}
1547 	return 0;
1548     }
1549 
1550     /* If I sourced this packet, it counts as output, else it was input. */
1551     if (in_hosteq(ip->ip_src, V_viftable[vifi].v_lcl_addr)) {
1552 	V_viftable[vifi].v_pkt_out++;
1553 	V_viftable[vifi].v_bytes_out += plen;
1554     } else {
1555 	V_viftable[vifi].v_pkt_in++;
1556 	V_viftable[vifi].v_bytes_in += plen;
1557     }
1558     rt->mfc_pkt_cnt++;
1559     rt->mfc_byte_cnt += plen;
1560 
1561     /*
1562      * For each vif, decide if a copy of the packet should be forwarded.
1563      * Forward if:
1564      *		- the ttl exceeds the vif's threshold
1565      *		- there are group members downstream on interface
1566      */
1567     for (vifi = 0; vifi < V_numvifs; vifi++)
1568 	if ((rt->mfc_ttls[vifi] > 0) && (ip->ip_ttl > rt->mfc_ttls[vifi])) {
1569 	    V_viftable[vifi].v_pkt_out++;
1570 	    V_viftable[vifi].v_bytes_out += plen;
1571 	    if (V_viftable[vifi].v_flags & VIFF_REGISTER)
1572 		pim_register_send(ip, V_viftable + vifi, m, rt);
1573 	    else
1574 		phyint_send(ip, V_viftable + vifi, m);
1575 	}
1576 
1577     /*
1578      * Perform upcall-related bw measuring.
1579      */
1580     if ((rt->mfc_bw_meter_geq != NULL) || (rt->mfc_bw_meter_leq != NULL)) {
1581 	struct bw_meter *x;
1582 	struct timeval now;
1583 
1584 	microtime(&now);
1585 	MFC_LOCK_ASSERT();
1586 	/* Process meters for Greater-or-EQual case */
1587 	for (x = rt->mfc_bw_meter_geq; x != NULL; x = x->bm_mfc_next)
1588 		bw_meter_geq_receive_packet(x, plen, &now);
1589 
1590 	/* Process meters for Lower-or-EQual case */
1591 	for (x = rt->mfc_bw_meter_leq; x != NULL; x = x->bm_mfc_next) {
1592 		/* Record that a packet is received */
1593 		x->bm_measured.b_packets++;
1594 		x->bm_measured.b_bytes += plen;
1595 	}
1596     }
1597 
1598     return 0;
1599 }
1600 
1601 /*
1602  * Check if a vif number is legal/ok. This is used by in_mcast.c.
1603  */
1604 static int
1605 X_legal_vif_num(int vif)
1606 {
1607 	int ret;
1608 
1609 	ret = 0;
1610 	if (vif < 0)
1611 		return (ret);
1612 
1613 	VIF_LOCK();
1614 	if (vif < V_numvifs)
1615 		ret = 1;
1616 	VIF_UNLOCK();
1617 
1618 	return (ret);
1619 }
1620 
1621 /*
1622  * Return the local address used by this vif
1623  */
1624 static u_long
1625 X_ip_mcast_src(int vifi)
1626 {
1627 	in_addr_t addr;
1628 
1629 	addr = INADDR_ANY;
1630 	if (vifi < 0)
1631 		return (addr);
1632 
1633 	VIF_LOCK();
1634 	if (vifi < V_numvifs)
1635 		addr = V_viftable[vifi].v_lcl_addr.s_addr;
1636 	VIF_UNLOCK();
1637 
1638 	return (addr);
1639 }
1640 
1641 static void
1642 phyint_send(struct ip *ip, struct vif *vifp, struct mbuf *m)
1643 {
1644     struct mbuf *mb_copy;
1645     int hlen = ip->ip_hl << 2;
1646 
1647     VIF_LOCK_ASSERT();
1648 
1649     /*
1650      * Make a new reference to the packet; make sure that
1651      * the IP header is actually copied, not just referenced,
1652      * so that ip_output() only scribbles on the copy.
1653      */
1654     mb_copy = m_copypacket(m, M_NOWAIT);
1655     if (mb_copy && (!M_WRITABLE(mb_copy) || mb_copy->m_len < hlen))
1656 	mb_copy = m_pullup(mb_copy, hlen);
1657     if (mb_copy == NULL)
1658 	return;
1659 
1660     send_packet(vifp, mb_copy);
1661 }
1662 
1663 static void
1664 send_packet(struct vif *vifp, struct mbuf *m)
1665 {
1666 	struct ip_moptions imo;
1667 	int error __unused;
1668 
1669 	VIF_LOCK_ASSERT();
1670 
1671 	imo.imo_multicast_ifp  = vifp->v_ifp;
1672 	imo.imo_multicast_ttl  = mtod(m, struct ip *)->ip_ttl - 1;
1673 	imo.imo_multicast_loop = !!in_mcast_loop;
1674 	imo.imo_multicast_vif  = -1;
1675 	STAILQ_INIT(&imo.imo_head);
1676 
1677 	/*
1678 	 * Re-entrancy should not be a problem here, because
1679 	 * the packets that we send out and are looped back at us
1680 	 * should get rejected because they appear to come from
1681 	 * the loopback interface, thus preventing looping.
1682 	 */
1683 	error = ip_output(m, NULL, NULL, IP_FORWARDING, &imo, NULL);
1684 	CTR3(KTR_IPMF, "%s: vif %td err %d", __func__,
1685 	    (ptrdiff_t)(vifp - V_viftable), error);
1686 }
1687 
1688 /*
1689  * Stubs for old RSVP socket shim implementation.
1690  */
1691 
1692 static int
1693 X_ip_rsvp_vif(struct socket *so __unused, struct sockopt *sopt __unused)
1694 {
1695 
1696 	return (EOPNOTSUPP);
1697 }
1698 
1699 static void
1700 X_ip_rsvp_force_done(struct socket *so __unused)
1701 {
1702 
1703 }
1704 
1705 static int
1706 X_rsvp_input(struct mbuf **mp, int *offp, int proto)
1707 {
1708 	struct mbuf *m;
1709 
1710 	m = *mp;
1711 	*mp = NULL;
1712 	if (!V_rsvp_on)
1713 		m_freem(m);
1714 	return (IPPROTO_DONE);
1715 }
1716 
1717 /*
1718  * Code for bandwidth monitors
1719  */
1720 
1721 /*
1722  * Define common interface for timeval-related methods
1723  */
1724 #define	BW_TIMEVALCMP(tvp, uvp, cmp) timevalcmp((tvp), (uvp), cmp)
1725 #define	BW_TIMEVALDECR(vvp, uvp) timevalsub((vvp), (uvp))
1726 #define	BW_TIMEVALADD(vvp, uvp) timevaladd((vvp), (uvp))
1727 
1728 static uint32_t
1729 compute_bw_meter_flags(struct bw_upcall *req)
1730 {
1731     uint32_t flags = 0;
1732 
1733     if (req->bu_flags & BW_UPCALL_UNIT_PACKETS)
1734 	flags |= BW_METER_UNIT_PACKETS;
1735     if (req->bu_flags & BW_UPCALL_UNIT_BYTES)
1736 	flags |= BW_METER_UNIT_BYTES;
1737     if (req->bu_flags & BW_UPCALL_GEQ)
1738 	flags |= BW_METER_GEQ;
1739     if (req->bu_flags & BW_UPCALL_LEQ)
1740 	flags |= BW_METER_LEQ;
1741 
1742     return flags;
1743 }
1744 
1745 static void
1746 expire_bw_meter_leq(void *arg)
1747 {
1748 	struct bw_meter *x = arg;
1749 	struct timeval now;
1750 	/*
1751 	 * INFO:
1752 	 * callout is always executed with MFC_LOCK taken
1753 	 */
1754 
1755 	CURVNET_SET((struct vnet *)x->arg);
1756 
1757 	microtime(&now);
1758 
1759 	/*
1760 	 * Test if we should deliver an upcall
1761 	 */
1762 	if (((x->bm_flags & BW_METER_UNIT_PACKETS) &&
1763 	    (x->bm_measured.b_packets <= x->bm_threshold.b_packets)) ||
1764 	    ((x->bm_flags & BW_METER_UNIT_BYTES) &&
1765 	    (x->bm_measured.b_bytes <= x->bm_threshold.b_bytes))) {
1766 		/* Prepare an upcall for delivery */
1767 		bw_meter_prepare_upcall(x, &now);
1768 	}
1769 
1770 	/* Send all upcalls that are pending delivery */
1771 	bw_upcalls_send();
1772 
1773 	/* Reset counters */
1774 	x->bm_start_time = now;
1775 	x->bm_measured.b_bytes = 0;
1776 	x->bm_measured.b_packets = 0;
1777 
1778 	callout_schedule(&x->bm_meter_callout, tvtohz(&x->bm_threshold.b_time));
1779 
1780 	CURVNET_RESTORE();
1781 }
1782 
1783 /*
1784  * Add a bw_meter entry
1785  */
1786 static int
1787 add_bw_upcall(struct bw_upcall *req)
1788 {
1789 	struct mfc *mfc;
1790 	struct timeval delta = { BW_UPCALL_THRESHOLD_INTERVAL_MIN_SEC,
1791 	BW_UPCALL_THRESHOLD_INTERVAL_MIN_USEC };
1792 	struct timeval now;
1793 	struct bw_meter *x, **bwm_ptr;
1794 	uint32_t flags;
1795 
1796 	if (!(V_mrt_api_config & MRT_MFC_BW_UPCALL))
1797 		return EOPNOTSUPP;
1798 
1799 	/* Test if the flags are valid */
1800 	if (!(req->bu_flags & (BW_UPCALL_UNIT_PACKETS | BW_UPCALL_UNIT_BYTES)))
1801 		return EINVAL;
1802 	if (!(req->bu_flags & (BW_UPCALL_GEQ | BW_UPCALL_LEQ)))
1803 		return EINVAL;
1804 	if ((req->bu_flags & (BW_UPCALL_GEQ | BW_UPCALL_LEQ))
1805 			== (BW_UPCALL_GEQ | BW_UPCALL_LEQ))
1806 		return EINVAL;
1807 
1808 	/* Test if the threshold time interval is valid */
1809 	if (BW_TIMEVALCMP(&req->bu_threshold.b_time, &delta, <))
1810 		return EINVAL;
1811 
1812 	flags = compute_bw_meter_flags(req);
1813 
1814 	/*
1815 	 * Find if we have already same bw_meter entry
1816 	 */
1817 	MFC_LOCK();
1818 	mfc = mfc_find(&req->bu_src, &req->bu_dst);
1819 	if (mfc == NULL) {
1820 		MFC_UNLOCK();
1821 		return EADDRNOTAVAIL;
1822 	}
1823 
1824 	/* Choose an appropriate bw_meter list */
1825 	if (req->bu_flags & BW_UPCALL_GEQ)
1826 		bwm_ptr = &mfc->mfc_bw_meter_geq;
1827 	else
1828 		bwm_ptr = &mfc->mfc_bw_meter_leq;
1829 
1830 	for (x = *bwm_ptr; x != NULL; x = x->bm_mfc_next) {
1831 		if ((BW_TIMEVALCMP(&x->bm_threshold.b_time,
1832 		    &req->bu_threshold.b_time, ==))
1833 		    && (x->bm_threshold.b_packets
1834 		    == req->bu_threshold.b_packets)
1835 		    && (x->bm_threshold.b_bytes
1836 		    == req->bu_threshold.b_bytes)
1837 		    && (x->bm_flags & BW_METER_USER_FLAGS)
1838 		    == flags) {
1839 			MFC_UNLOCK();
1840 			return 0; /* XXX Already installed */
1841 		}
1842 	}
1843 
1844 	/* Allocate the new bw_meter entry */
1845 	x = (struct bw_meter*) malloc(sizeof(*x), M_BWMETER, M_NOWAIT);
1846 	if (x == NULL) {
1847 		MFC_UNLOCK();
1848 		return ENOBUFS;
1849 	}
1850 
1851 	/* Set the new bw_meter entry */
1852 	x->bm_threshold.b_time = req->bu_threshold.b_time;
1853 	microtime(&now);
1854 	x->bm_start_time = now;
1855 	x->bm_threshold.b_packets = req->bu_threshold.b_packets;
1856 	x->bm_threshold.b_bytes = req->bu_threshold.b_bytes;
1857 	x->bm_measured.b_packets = 0;
1858 	x->bm_measured.b_bytes = 0;
1859 	x->bm_flags = flags;
1860 	x->bm_time_next = NULL;
1861 	x->bm_mfc = mfc;
1862 	x->arg = curvnet;
1863 
1864 	/* For LEQ case create periodic callout */
1865 	if (req->bu_flags & BW_UPCALL_LEQ) {
1866 		callout_init_mtx(&x->bm_meter_callout, &mfc_mtx,0);
1867 		callout_reset(&x->bm_meter_callout, tvtohz(&x->bm_threshold.b_time),
1868 		    expire_bw_meter_leq, x);
1869 	}
1870 
1871 	/* Add the new bw_meter entry to the front of entries for this MFC */
1872 	x->bm_mfc_next = *bwm_ptr;
1873 	*bwm_ptr = x;
1874 
1875 	MFC_UNLOCK();
1876 
1877 	return 0;
1878 }
1879 
1880 static void
1881 free_bw_list(struct bw_meter *list)
1882 {
1883     while (list != NULL) {
1884 	struct bw_meter *x = list;
1885 
1886 	/* MFC_LOCK must be held here */
1887 	if (x->bm_flags & BW_METER_LEQ)
1888 		callout_drain(&x->bm_meter_callout);
1889 
1890 	list = list->bm_mfc_next;
1891 	free(x, M_BWMETER);
1892     }
1893 }
1894 
1895 /*
1896  * Delete one or multiple bw_meter entries
1897  */
1898 static int
1899 del_bw_upcall(struct bw_upcall *req)
1900 {
1901     struct mfc *mfc;
1902     struct bw_meter *x, **bwm_ptr;
1903 
1904     if (!(V_mrt_api_config & MRT_MFC_BW_UPCALL))
1905 	return EOPNOTSUPP;
1906 
1907     MFC_LOCK();
1908 
1909     /* Find the corresponding MFC entry */
1910     mfc = mfc_find(&req->bu_src, &req->bu_dst);
1911     if (mfc == NULL) {
1912 	MFC_UNLOCK();
1913 	return EADDRNOTAVAIL;
1914     } else if (req->bu_flags & BW_UPCALL_DELETE_ALL) {
1915 	/*
1916 	 * Delete all bw_meter entries for this mfc
1917 	 */
1918 	struct bw_meter *list;
1919 
1920 	/* Free LEQ list */
1921 	list = mfc->mfc_bw_meter_leq;
1922 	mfc->mfc_bw_meter_leq = NULL;
1923 	free_bw_list(list);
1924 
1925 	/* Free GEQ list */
1926 	list = mfc->mfc_bw_meter_geq;
1927 	mfc->mfc_bw_meter_geq = NULL;
1928 	free_bw_list(list);
1929 	MFC_UNLOCK();
1930 	return 0;
1931     } else {			/* Delete a single bw_meter entry */
1932 	struct bw_meter *prev;
1933 	uint32_t flags = 0;
1934 
1935 	flags = compute_bw_meter_flags(req);
1936 
1937 	/* Choose an appropriate bw_meter list */
1938 	if (req->bu_flags & BW_UPCALL_GEQ)
1939 		bwm_ptr = &mfc->mfc_bw_meter_geq;
1940 	else
1941 		bwm_ptr = &mfc->mfc_bw_meter_leq;
1942 
1943 	/* Find the bw_meter entry to delete */
1944 	for (prev = NULL, x = *bwm_ptr; x != NULL;
1945 	     prev = x, x = x->bm_mfc_next) {
1946 	    if ((BW_TIMEVALCMP(&x->bm_threshold.b_time,
1947 			       &req->bu_threshold.b_time, ==)) &&
1948 		(x->bm_threshold.b_packets == req->bu_threshold.b_packets) &&
1949 		(x->bm_threshold.b_bytes == req->bu_threshold.b_bytes) &&
1950 		(x->bm_flags & BW_METER_USER_FLAGS) == flags)
1951 		break;
1952 	}
1953 	if (x != NULL) { /* Delete entry from the list for this MFC */
1954 	    if (prev != NULL)
1955 		prev->bm_mfc_next = x->bm_mfc_next;	/* remove from middle*/
1956 	    else
1957 		*bwm_ptr = x->bm_mfc_next;/* new head of list */
1958 
1959 	    if (req->bu_flags & BW_UPCALL_LEQ)
1960 		    callout_stop(&x->bm_meter_callout);
1961 
1962 	    MFC_UNLOCK();
1963 	    /* Free the bw_meter entry */
1964 	    free(x, M_BWMETER);
1965 	    return 0;
1966 	} else {
1967 	    MFC_UNLOCK();
1968 	    return EINVAL;
1969 	}
1970     }
1971     /* NOTREACHED */
1972 }
1973 
1974 /*
1975  * Perform bandwidth measurement processing that may result in an upcall
1976  */
1977 static void
1978 bw_meter_geq_receive_packet(struct bw_meter *x, int plen, struct timeval *nowp)
1979 {
1980 	struct timeval delta;
1981 
1982 	MFC_LOCK_ASSERT();
1983 
1984 	delta = *nowp;
1985 	BW_TIMEVALDECR(&delta, &x->bm_start_time);
1986 
1987 	/*
1988 	 * Processing for ">=" type of bw_meter entry
1989 	 */
1990 	if (BW_TIMEVALCMP(&delta, &x->bm_threshold.b_time, >)) {
1991 	    /* Reset the bw_meter entry */
1992 	    x->bm_start_time = *nowp;
1993 	    x->bm_measured.b_packets = 0;
1994 	    x->bm_measured.b_bytes = 0;
1995 	    x->bm_flags &= ~BW_METER_UPCALL_DELIVERED;
1996 	}
1997 
1998 	/* Record that a packet is received */
1999 	x->bm_measured.b_packets++;
2000 	x->bm_measured.b_bytes += plen;
2001 
2002 	/*
2003 	 * Test if we should deliver an upcall
2004 	 */
2005 	if (!(x->bm_flags & BW_METER_UPCALL_DELIVERED)) {
2006 		if (((x->bm_flags & BW_METER_UNIT_PACKETS) &&
2007 		    (x->bm_measured.b_packets >= x->bm_threshold.b_packets)) ||
2008 		    ((x->bm_flags & BW_METER_UNIT_BYTES) &&
2009 		    (x->bm_measured.b_bytes >= x->bm_threshold.b_bytes))) {
2010 			/* Prepare an upcall for delivery */
2011 			bw_meter_prepare_upcall(x, nowp);
2012 			x->bm_flags |= BW_METER_UPCALL_DELIVERED;
2013 		}
2014 	}
2015 }
2016 
2017 /*
2018  * Prepare a bandwidth-related upcall
2019  */
2020 static void
2021 bw_meter_prepare_upcall(struct bw_meter *x, struct timeval *nowp)
2022 {
2023 	struct timeval delta;
2024 	struct bw_upcall *u;
2025 
2026 	MFC_LOCK_ASSERT();
2027 
2028 	/*
2029 	 * Compute the measured time interval
2030 	 */
2031 	delta = *nowp;
2032 	BW_TIMEVALDECR(&delta, &x->bm_start_time);
2033 
2034 	/*
2035 	 * If there are too many pending upcalls, deliver them now
2036 	 */
2037 	if (V_bw_upcalls_n >= BW_UPCALLS_MAX)
2038 		bw_upcalls_send();
2039 
2040 	/*
2041 	 * Set the bw_upcall entry
2042 	 */
2043 	u = &V_bw_upcalls[V_bw_upcalls_n++];
2044 	u->bu_src = x->bm_mfc->mfc_origin;
2045 	u->bu_dst = x->bm_mfc->mfc_mcastgrp;
2046 	u->bu_threshold.b_time = x->bm_threshold.b_time;
2047 	u->bu_threshold.b_packets = x->bm_threshold.b_packets;
2048 	u->bu_threshold.b_bytes = x->bm_threshold.b_bytes;
2049 	u->bu_measured.b_time = delta;
2050 	u->bu_measured.b_packets = x->bm_measured.b_packets;
2051 	u->bu_measured.b_bytes = x->bm_measured.b_bytes;
2052 	u->bu_flags = 0;
2053 	if (x->bm_flags & BW_METER_UNIT_PACKETS)
2054 		u->bu_flags |= BW_UPCALL_UNIT_PACKETS;
2055 	if (x->bm_flags & BW_METER_UNIT_BYTES)
2056 		u->bu_flags |= BW_UPCALL_UNIT_BYTES;
2057 	if (x->bm_flags & BW_METER_GEQ)
2058 		u->bu_flags |= BW_UPCALL_GEQ;
2059 	if (x->bm_flags & BW_METER_LEQ)
2060 		u->bu_flags |= BW_UPCALL_LEQ;
2061 }
2062 
2063 /*
2064  * Send the pending bandwidth-related upcalls
2065  */
2066 static void
2067 bw_upcalls_send(void)
2068 {
2069     struct mbuf *m;
2070     int len = V_bw_upcalls_n * sizeof(V_bw_upcalls[0]);
2071     struct sockaddr_in k_igmpsrc = { sizeof k_igmpsrc, AF_INET };
2072     static struct igmpmsg igmpmsg = { 0,		/* unused1 */
2073 				      0,		/* unused2 */
2074 				      IGMPMSG_BW_UPCALL,/* im_msgtype */
2075 				      0,		/* im_mbz  */
2076 				      0,		/* im_vif  */
2077 				      0,		/* unused3 */
2078 				      { 0 },		/* im_src  */
2079 				      { 0 } };		/* im_dst  */
2080 
2081     MFC_LOCK_ASSERT();
2082 
2083     if (V_bw_upcalls_n == 0)
2084 	return;			/* No pending upcalls */
2085 
2086     V_bw_upcalls_n = 0;
2087 
2088     /*
2089      * Allocate a new mbuf, initialize it with the header and
2090      * the payload for the pending calls.
2091      */
2092     m = m_gethdr(M_NOWAIT, MT_DATA);
2093     if (m == NULL) {
2094 	log(LOG_WARNING, "bw_upcalls_send: cannot allocate mbuf\n");
2095 	return;
2096     }
2097 
2098     m_copyback(m, 0, sizeof(struct igmpmsg), (caddr_t)&igmpmsg);
2099     m_copyback(m, sizeof(struct igmpmsg), len, (caddr_t)&V_bw_upcalls[0]);
2100 
2101     /*
2102      * Send the upcalls
2103      * XXX do we need to set the address in k_igmpsrc ?
2104      */
2105     MRTSTAT_INC(mrts_upcalls);
2106     if (socket_send(V_ip_mrouter, m, &k_igmpsrc) < 0) {
2107 	log(LOG_WARNING, "bw_upcalls_send: ip_mrouter socket queue full\n");
2108 	MRTSTAT_INC(mrts_upq_sockfull);
2109     }
2110 }
2111 
2112 /*
2113  * A periodic function for sending all upcalls that are pending delivery
2114  */
2115 static void
2116 expire_bw_upcalls_send(void *arg)
2117 {
2118     CURVNET_SET((struct vnet *) arg);
2119 
2120     MFC_LOCK();
2121     bw_upcalls_send();
2122     MFC_UNLOCK();
2123 
2124     callout_reset(&V_bw_upcalls_ch, BW_UPCALLS_PERIOD, expire_bw_upcalls_send,
2125 	curvnet);
2126     CURVNET_RESTORE();
2127 }
2128 
2129 /*
2130  * End of bandwidth monitoring code
2131  */
2132 
2133 /*
2134  * Send the packet up to the user daemon, or eventually do kernel encapsulation
2135  *
2136  */
2137 static int
2138 pim_register_send(struct ip *ip, struct vif *vifp, struct mbuf *m,
2139     struct mfc *rt)
2140 {
2141     struct mbuf *mb_copy, *mm;
2142 
2143     /*
2144      * Do not send IGMP_WHOLEPKT notifications to userland, if the
2145      * rendezvous point was unspecified, and we were told not to.
2146      */
2147     if (pim_squelch_wholepkt != 0 && (V_mrt_api_config & MRT_MFC_RP) &&
2148 	in_nullhost(rt->mfc_rp))
2149 	return 0;
2150 
2151     mb_copy = pim_register_prepare(ip, m);
2152     if (mb_copy == NULL)
2153 	return ENOBUFS;
2154 
2155     /*
2156      * Send all the fragments. Note that the mbuf for each fragment
2157      * is freed by the sending machinery.
2158      */
2159     for (mm = mb_copy; mm; mm = mb_copy) {
2160 	mb_copy = mm->m_nextpkt;
2161 	mm->m_nextpkt = 0;
2162 	mm = m_pullup(mm, sizeof(struct ip));
2163 	if (mm != NULL) {
2164 	    ip = mtod(mm, struct ip *);
2165 	    if ((V_mrt_api_config & MRT_MFC_RP) && !in_nullhost(rt->mfc_rp)) {
2166 		pim_register_send_rp(ip, vifp, mm, rt);
2167 	    } else {
2168 		pim_register_send_upcall(ip, vifp, mm, rt);
2169 	    }
2170 	}
2171     }
2172 
2173     return 0;
2174 }
2175 
2176 /*
2177  * Return a copy of the data packet that is ready for PIM Register
2178  * encapsulation.
2179  * XXX: Note that in the returned copy the IP header is a valid one.
2180  */
2181 static struct mbuf *
2182 pim_register_prepare(struct ip *ip, struct mbuf *m)
2183 {
2184     struct mbuf *mb_copy = NULL;
2185     int mtu;
2186 
2187     /* Take care of delayed checksums */
2188     if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
2189 	in_delayed_cksum(m);
2190 	m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
2191     }
2192 
2193     /*
2194      * Copy the old packet & pullup its IP header into the
2195      * new mbuf so we can modify it.
2196      */
2197     mb_copy = m_copypacket(m, M_NOWAIT);
2198     if (mb_copy == NULL)
2199 	return NULL;
2200     mb_copy = m_pullup(mb_copy, ip->ip_hl << 2);
2201     if (mb_copy == NULL)
2202 	return NULL;
2203 
2204     /* take care of the TTL */
2205     ip = mtod(mb_copy, struct ip *);
2206     --ip->ip_ttl;
2207 
2208     /* Compute the MTU after the PIM Register encapsulation */
2209     mtu = 0xffff - sizeof(pim_encap_iphdr) - sizeof(pim_encap_pimhdr);
2210 
2211     if (ntohs(ip->ip_len) <= mtu) {
2212 	/* Turn the IP header into a valid one */
2213 	ip->ip_sum = 0;
2214 	ip->ip_sum = in_cksum(mb_copy, ip->ip_hl << 2);
2215     } else {
2216 	/* Fragment the packet */
2217 	mb_copy->m_pkthdr.csum_flags |= CSUM_IP;
2218 	if (ip_fragment(ip, &mb_copy, mtu, 0) != 0) {
2219 	    m_freem(mb_copy);
2220 	    return NULL;
2221 	}
2222     }
2223     return mb_copy;
2224 }
2225 
2226 /*
2227  * Send an upcall with the data packet to the user-level process.
2228  */
2229 static int
2230 pim_register_send_upcall(struct ip *ip, struct vif *vifp,
2231     struct mbuf *mb_copy, struct mfc *rt)
2232 {
2233     struct mbuf *mb_first;
2234     int len = ntohs(ip->ip_len);
2235     struct igmpmsg *im;
2236     struct sockaddr_in k_igmpsrc = { sizeof k_igmpsrc, AF_INET };
2237 
2238     VIF_LOCK_ASSERT();
2239 
2240     /*
2241      * Add a new mbuf with an upcall header
2242      */
2243     mb_first = m_gethdr(M_NOWAIT, MT_DATA);
2244     if (mb_first == NULL) {
2245 	m_freem(mb_copy);
2246 	return ENOBUFS;
2247     }
2248     mb_first->m_data += max_linkhdr;
2249     mb_first->m_pkthdr.len = len + sizeof(struct igmpmsg);
2250     mb_first->m_len = sizeof(struct igmpmsg);
2251     mb_first->m_next = mb_copy;
2252 
2253     /* Send message to routing daemon */
2254     im = mtod(mb_first, struct igmpmsg *);
2255     im->im_msgtype	= IGMPMSG_WHOLEPKT;
2256     im->im_mbz		= 0;
2257     im->im_vif		= vifp - V_viftable;
2258     im->im_src		= ip->ip_src;
2259     im->im_dst		= ip->ip_dst;
2260 
2261     k_igmpsrc.sin_addr	= ip->ip_src;
2262 
2263     MRTSTAT_INC(mrts_upcalls);
2264 
2265     if (socket_send(V_ip_mrouter, mb_first, &k_igmpsrc) < 0) {
2266 	CTR1(KTR_IPMF, "%s: socket queue full", __func__);
2267 	MRTSTAT_INC(mrts_upq_sockfull);
2268 	return ENOBUFS;
2269     }
2270 
2271     /* Keep statistics */
2272     PIMSTAT_INC(pims_snd_registers_msgs);
2273     PIMSTAT_ADD(pims_snd_registers_bytes, len);
2274 
2275     return 0;
2276 }
2277 
2278 /*
2279  * Encapsulate the data packet in PIM Register message and send it to the RP.
2280  */
2281 static int
2282 pim_register_send_rp(struct ip *ip, struct vif *vifp, struct mbuf *mb_copy,
2283     struct mfc *rt)
2284 {
2285     struct mbuf *mb_first;
2286     struct ip *ip_outer;
2287     struct pim_encap_pimhdr *pimhdr;
2288     int len = ntohs(ip->ip_len);
2289     vifi_t vifi = rt->mfc_parent;
2290 
2291     VIF_LOCK_ASSERT();
2292 
2293     if ((vifi >= V_numvifs) || in_nullhost(V_viftable[vifi].v_lcl_addr)) {
2294 	m_freem(mb_copy);
2295 	return EADDRNOTAVAIL;		/* The iif vif is invalid */
2296     }
2297 
2298     /*
2299      * Add a new mbuf with the encapsulating header
2300      */
2301     mb_first = m_gethdr(M_NOWAIT, MT_DATA);
2302     if (mb_first == NULL) {
2303 	m_freem(mb_copy);
2304 	return ENOBUFS;
2305     }
2306     mb_first->m_data += max_linkhdr;
2307     mb_first->m_len = sizeof(pim_encap_iphdr) + sizeof(pim_encap_pimhdr);
2308     mb_first->m_next = mb_copy;
2309 
2310     mb_first->m_pkthdr.len = len + mb_first->m_len;
2311 
2312     /*
2313      * Fill in the encapsulating IP and PIM header
2314      */
2315     ip_outer = mtod(mb_first, struct ip *);
2316     *ip_outer = pim_encap_iphdr;
2317     ip_outer->ip_len = htons(len + sizeof(pim_encap_iphdr) +
2318 	sizeof(pim_encap_pimhdr));
2319     ip_outer->ip_src = V_viftable[vifi].v_lcl_addr;
2320     ip_outer->ip_dst = rt->mfc_rp;
2321     /*
2322      * Copy the inner header TOS to the outer header, and take care of the
2323      * IP_DF bit.
2324      */
2325     ip_outer->ip_tos = ip->ip_tos;
2326     if (ip->ip_off & htons(IP_DF))
2327 	ip_outer->ip_off |= htons(IP_DF);
2328     ip_fillid(ip_outer);
2329     pimhdr = (struct pim_encap_pimhdr *)((caddr_t)ip_outer
2330 					 + sizeof(pim_encap_iphdr));
2331     *pimhdr = pim_encap_pimhdr;
2332     /* If the iif crosses a border, set the Border-bit */
2333     if (rt->mfc_flags[vifi] & MRT_MFC_FLAGS_BORDER_VIF & V_mrt_api_config)
2334 	pimhdr->flags |= htonl(PIM_BORDER_REGISTER);
2335 
2336     mb_first->m_data += sizeof(pim_encap_iphdr);
2337     pimhdr->pim.pim_cksum = in_cksum(mb_first, sizeof(pim_encap_pimhdr));
2338     mb_first->m_data -= sizeof(pim_encap_iphdr);
2339 
2340     send_packet(vifp, mb_first);
2341 
2342     /* Keep statistics */
2343     PIMSTAT_INC(pims_snd_registers_msgs);
2344     PIMSTAT_ADD(pims_snd_registers_bytes, len);
2345 
2346     return 0;
2347 }
2348 
2349 /*
2350  * pim_encapcheck() is called by the encap4_input() path at runtime to
2351  * determine if a packet is for PIM; allowing PIM to be dynamically loaded
2352  * into the kernel.
2353  */
2354 static int
2355 pim_encapcheck(const struct mbuf *m __unused, int off __unused,
2356     int proto __unused, void *arg __unused)
2357 {
2358 
2359     KASSERT(proto == IPPROTO_PIM, ("not for IPPROTO_PIM"));
2360     return (8);		/* claim the datagram. */
2361 }
2362 
2363 /*
2364  * PIM-SMv2 and PIM-DM messages processing.
2365  * Receives and verifies the PIM control messages, and passes them
2366  * up to the listening socket, using rip_input().
2367  * The only message with special processing is the PIM_REGISTER message
2368  * (used by PIM-SM): the PIM header is stripped off, and the inner packet
2369  * is passed to if_simloop().
2370  */
2371 static int
2372 pim_input(struct mbuf *m, int off, int proto, void *arg __unused)
2373 {
2374     struct ip *ip = mtod(m, struct ip *);
2375     struct pim *pim;
2376     int iphlen = off;
2377     int minlen;
2378     int datalen = ntohs(ip->ip_len) - iphlen;
2379     int ip_tos;
2380 
2381     /* Keep statistics */
2382     PIMSTAT_INC(pims_rcv_total_msgs);
2383     PIMSTAT_ADD(pims_rcv_total_bytes, datalen);
2384 
2385     /*
2386      * Validate lengths
2387      */
2388     if (datalen < PIM_MINLEN) {
2389 	PIMSTAT_INC(pims_rcv_tooshort);
2390 	CTR3(KTR_IPMF, "%s: short packet (%d) from 0x%08x",
2391 	    __func__, datalen, ntohl(ip->ip_src.s_addr));
2392 	m_freem(m);
2393 	return (IPPROTO_DONE);
2394     }
2395 
2396     /*
2397      * If the packet is at least as big as a REGISTER, go agead
2398      * and grab the PIM REGISTER header size, to avoid another
2399      * possible m_pullup() later.
2400      *
2401      * PIM_MINLEN       == pimhdr + u_int32_t == 4 + 4 = 8
2402      * PIM_REG_MINLEN   == pimhdr + reghdr + encap_iphdr == 4 + 4 + 20 = 28
2403      */
2404     minlen = iphlen + (datalen >= PIM_REG_MINLEN ? PIM_REG_MINLEN : PIM_MINLEN);
2405     /*
2406      * Get the IP and PIM headers in contiguous memory, and
2407      * possibly the PIM REGISTER header.
2408      */
2409     if (m->m_len < minlen && (m = m_pullup(m, minlen)) == NULL) {
2410 	CTR1(KTR_IPMF, "%s: m_pullup() failed", __func__);
2411 	return (IPPROTO_DONE);
2412     }
2413 
2414     /* m_pullup() may have given us a new mbuf so reset ip. */
2415     ip = mtod(m, struct ip *);
2416     ip_tos = ip->ip_tos;
2417 
2418     /* adjust mbuf to point to the PIM header */
2419     m->m_data += iphlen;
2420     m->m_len  -= iphlen;
2421     pim = mtod(m, struct pim *);
2422 
2423     /*
2424      * Validate checksum. If PIM REGISTER, exclude the data packet.
2425      *
2426      * XXX: some older PIMv2 implementations don't make this distinction,
2427      * so for compatibility reason perform the checksum over part of the
2428      * message, and if error, then over the whole message.
2429      */
2430     if (PIM_VT_T(pim->pim_vt) == PIM_REGISTER && in_cksum(m, PIM_MINLEN) == 0) {
2431 	/* do nothing, checksum okay */
2432     } else if (in_cksum(m, datalen)) {
2433 	PIMSTAT_INC(pims_rcv_badsum);
2434 	CTR1(KTR_IPMF, "%s: invalid checksum", __func__);
2435 	m_freem(m);
2436 	return (IPPROTO_DONE);
2437     }
2438 
2439     /* PIM version check */
2440     if (PIM_VT_V(pim->pim_vt) < PIM_VERSION) {
2441 	PIMSTAT_INC(pims_rcv_badversion);
2442 	CTR3(KTR_IPMF, "%s: bad version %d expect %d", __func__,
2443 	    (int)PIM_VT_V(pim->pim_vt), PIM_VERSION);
2444 	m_freem(m);
2445 	return (IPPROTO_DONE);
2446     }
2447 
2448     /* restore mbuf back to the outer IP */
2449     m->m_data -= iphlen;
2450     m->m_len  += iphlen;
2451 
2452     if (PIM_VT_T(pim->pim_vt) == PIM_REGISTER) {
2453 	/*
2454 	 * Since this is a REGISTER, we'll make a copy of the register
2455 	 * headers ip + pim + u_int32 + encap_ip, to be passed up to the
2456 	 * routing daemon.
2457 	 */
2458 	struct sockaddr_in dst = { sizeof(dst), AF_INET };
2459 	struct mbuf *mcp;
2460 	struct ip *encap_ip;
2461 	u_int32_t *reghdr;
2462 	struct ifnet *vifp;
2463 
2464 	VIF_LOCK();
2465 	if ((V_reg_vif_num >= V_numvifs) || (V_reg_vif_num == VIFI_INVALID)) {
2466 	    VIF_UNLOCK();
2467 	    CTR2(KTR_IPMF, "%s: register vif not set: %d", __func__,
2468 		(int)V_reg_vif_num);
2469 	    m_freem(m);
2470 	    return (IPPROTO_DONE);
2471 	}
2472 	/* XXX need refcnt? */
2473 	vifp = V_viftable[V_reg_vif_num].v_ifp;
2474 	VIF_UNLOCK();
2475 
2476 	/*
2477 	 * Validate length
2478 	 */
2479 	if (datalen < PIM_REG_MINLEN) {
2480 	    PIMSTAT_INC(pims_rcv_tooshort);
2481 	    PIMSTAT_INC(pims_rcv_badregisters);
2482 	    CTR1(KTR_IPMF, "%s: register packet size too small", __func__);
2483 	    m_freem(m);
2484 	    return (IPPROTO_DONE);
2485 	}
2486 
2487 	reghdr = (u_int32_t *)(pim + 1);
2488 	encap_ip = (struct ip *)(reghdr + 1);
2489 
2490 	CTR3(KTR_IPMF, "%s: register: encap ip src 0x%08x len %d",
2491 	    __func__, ntohl(encap_ip->ip_src.s_addr),
2492 	    ntohs(encap_ip->ip_len));
2493 
2494 	/* verify the version number of the inner packet */
2495 	if (encap_ip->ip_v != IPVERSION) {
2496 	    PIMSTAT_INC(pims_rcv_badregisters);
2497 	    CTR1(KTR_IPMF, "%s: bad encap ip version", __func__);
2498 	    m_freem(m);
2499 	    return (IPPROTO_DONE);
2500 	}
2501 
2502 	/* verify the inner packet is destined to a mcast group */
2503 	if (!IN_MULTICAST(ntohl(encap_ip->ip_dst.s_addr))) {
2504 	    PIMSTAT_INC(pims_rcv_badregisters);
2505 	    CTR2(KTR_IPMF, "%s: bad encap ip dest 0x%08x", __func__,
2506 		ntohl(encap_ip->ip_dst.s_addr));
2507 	    m_freem(m);
2508 	    return (IPPROTO_DONE);
2509 	}
2510 
2511 	/* If a NULL_REGISTER, pass it to the daemon */
2512 	if ((ntohl(*reghdr) & PIM_NULL_REGISTER))
2513 	    goto pim_input_to_daemon;
2514 
2515 	/*
2516 	 * Copy the TOS from the outer IP header to the inner IP header.
2517 	 */
2518 	if (encap_ip->ip_tos != ip_tos) {
2519 	    /* Outer TOS -> inner TOS */
2520 	    encap_ip->ip_tos = ip_tos;
2521 	    /* Recompute the inner header checksum. Sigh... */
2522 
2523 	    /* adjust mbuf to point to the inner IP header */
2524 	    m->m_data += (iphlen + PIM_MINLEN);
2525 	    m->m_len  -= (iphlen + PIM_MINLEN);
2526 
2527 	    encap_ip->ip_sum = 0;
2528 	    encap_ip->ip_sum = in_cksum(m, encap_ip->ip_hl << 2);
2529 
2530 	    /* restore mbuf to point back to the outer IP header */
2531 	    m->m_data -= (iphlen + PIM_MINLEN);
2532 	    m->m_len  += (iphlen + PIM_MINLEN);
2533 	}
2534 
2535 	/*
2536 	 * Decapsulate the inner IP packet and loopback to forward it
2537 	 * as a normal multicast packet. Also, make a copy of the
2538 	 *     outer_iphdr + pimhdr + reghdr + encap_iphdr
2539 	 * to pass to the daemon later, so it can take the appropriate
2540 	 * actions (e.g., send back PIM_REGISTER_STOP).
2541 	 * XXX: here m->m_data points to the outer IP header.
2542 	 */
2543 	mcp = m_copym(m, 0, iphlen + PIM_REG_MINLEN, M_NOWAIT);
2544 	if (mcp == NULL) {
2545 	    CTR1(KTR_IPMF, "%s: m_copym() failed", __func__);
2546 	    m_freem(m);
2547 	    return (IPPROTO_DONE);
2548 	}
2549 
2550 	/* Keep statistics */
2551 	/* XXX: registers_bytes include only the encap. mcast pkt */
2552 	PIMSTAT_INC(pims_rcv_registers_msgs);
2553 	PIMSTAT_ADD(pims_rcv_registers_bytes, ntohs(encap_ip->ip_len));
2554 
2555 	/*
2556 	 * forward the inner ip packet; point m_data at the inner ip.
2557 	 */
2558 	m_adj(m, iphlen + PIM_MINLEN);
2559 
2560 	CTR4(KTR_IPMF,
2561 	    "%s: forward decap'd REGISTER: src %lx dst %lx vif %d",
2562 	    __func__,
2563 	    (u_long)ntohl(encap_ip->ip_src.s_addr),
2564 	    (u_long)ntohl(encap_ip->ip_dst.s_addr),
2565 	    (int)V_reg_vif_num);
2566 
2567 	/* NB: vifp was collected above; can it change on us? */
2568 	if_simloop(vifp, m, dst.sin_family, 0);
2569 
2570 	/* prepare the register head to send to the mrouting daemon */
2571 	m = mcp;
2572     }
2573 
2574 pim_input_to_daemon:
2575     /*
2576      * Pass the PIM message up to the daemon; if it is a Register message,
2577      * pass the 'head' only up to the daemon. This includes the
2578      * outer IP header, PIM header, PIM-Register header and the
2579      * inner IP header.
2580      * XXX: the outer IP header pkt size of a Register is not adjust to
2581      * reflect the fact that the inner multicast data is truncated.
2582      */
2583     return (rip_input(&m, &off, proto));
2584 }
2585 
2586 static int
2587 sysctl_mfctable(SYSCTL_HANDLER_ARGS)
2588 {
2589 	struct mfc	*rt;
2590 	int		 error, i;
2591 
2592 	if (req->newptr)
2593 		return (EPERM);
2594 	if (V_mfchashtbl == NULL)	/* XXX unlocked */
2595 		return (0);
2596 	error = sysctl_wire_old_buffer(req, 0);
2597 	if (error)
2598 		return (error);
2599 
2600 	MFC_LOCK();
2601 	for (i = 0; i < mfchashsize; i++) {
2602 		LIST_FOREACH(rt, &V_mfchashtbl[i], mfc_hash) {
2603 			error = SYSCTL_OUT(req, rt, sizeof(struct mfc));
2604 			if (error)
2605 				goto out_locked;
2606 		}
2607 	}
2608 out_locked:
2609 	MFC_UNLOCK();
2610 	return (error);
2611 }
2612 
2613 static SYSCTL_NODE(_net_inet_ip, OID_AUTO, mfctable,
2614     CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_mfctable,
2615     "IPv4 Multicast Forwarding Table "
2616     "(struct *mfc[mfchashsize], netinet/ip_mroute.h)");
2617 
2618 static int
2619 sysctl_viflist(SYSCTL_HANDLER_ARGS)
2620 {
2621 	int error;
2622 
2623 	if (req->newptr)
2624 		return (EPERM);
2625 	if (V_viftable == NULL)		/* XXX unlocked */
2626 		return (0);
2627 	error = sysctl_wire_old_buffer(req, sizeof(*V_viftable) * MAXVIFS);
2628 	if (error)
2629 		return (error);
2630 
2631 	VIF_LOCK();
2632 	error = SYSCTL_OUT(req, V_viftable, sizeof(*V_viftable) * MAXVIFS);
2633 	VIF_UNLOCK();
2634 	return (error);
2635 }
2636 
2637 SYSCTL_PROC(_net_inet_ip, OID_AUTO, viftable,
2638     CTLTYPE_OPAQUE | CTLFLAG_VNET | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
2639     sysctl_viflist, "S,vif[MAXVIFS]",
2640     "IPv4 Multicast Interfaces (struct vif[MAXVIFS], netinet/ip_mroute.h)");
2641 
2642 static void
2643 vnet_mroute_init(const void *unused __unused)
2644 {
2645 
2646 	V_nexpire = malloc(mfchashsize, M_MRTABLE, M_WAITOK|M_ZERO);
2647 
2648 	V_viftable = mallocarray(MAXVIFS, sizeof(*V_viftable),
2649 	    M_MRTABLE, M_WAITOK|M_ZERO);
2650 	V_bw_upcalls = mallocarray(BW_UPCALLS_MAX, sizeof(*V_bw_upcalls),
2651 	    M_MRTABLE, M_WAITOK|M_ZERO);
2652 
2653 	callout_init(&V_expire_upcalls_ch, 1);
2654 	callout_init(&V_bw_upcalls_ch, 1);
2655 }
2656 
2657 VNET_SYSINIT(vnet_mroute_init, SI_SUB_PROTO_MC, SI_ORDER_ANY, vnet_mroute_init,
2658 	NULL);
2659 
2660 static void
2661 vnet_mroute_uninit(const void *unused __unused)
2662 {
2663 
2664 	free(V_bw_upcalls, M_MRTABLE);
2665 	free(V_viftable, M_MRTABLE);
2666 	free(V_nexpire, M_MRTABLE);
2667 	V_nexpire = NULL;
2668 }
2669 
2670 VNET_SYSUNINIT(vnet_mroute_uninit, SI_SUB_PROTO_MC, SI_ORDER_MIDDLE,
2671 	vnet_mroute_uninit, NULL);
2672 
2673 static int
2674 ip_mroute_modevent(module_t mod, int type, void *unused)
2675 {
2676 
2677     switch (type) {
2678     case MOD_LOAD:
2679 	MROUTER_LOCK_INIT();
2680 
2681 	if_detach_event_tag = EVENTHANDLER_REGISTER(ifnet_departure_event,
2682 	    if_detached_event, NULL, EVENTHANDLER_PRI_ANY);
2683 	if (if_detach_event_tag == NULL) {
2684 		printf("ip_mroute: unable to register "
2685 		    "ifnet_departure_event handler\n");
2686 		MROUTER_LOCK_DESTROY();
2687 		return (EINVAL);
2688 	}
2689 
2690 	MFC_LOCK_INIT();
2691 	VIF_LOCK_INIT();
2692 
2693 	mfchashsize = MFCHASHSIZE;
2694 	if (TUNABLE_ULONG_FETCH("net.inet.ip.mfchashsize", &mfchashsize) &&
2695 	    !powerof2(mfchashsize)) {
2696 		printf("WARNING: %s not a power of 2; using default\n",
2697 		    "net.inet.ip.mfchashsize");
2698 		mfchashsize = MFCHASHSIZE;
2699 	}
2700 
2701 	pim_squelch_wholepkt = 0;
2702 	TUNABLE_ULONG_FETCH("net.inet.pim.squelch_wholepkt",
2703 	    &pim_squelch_wholepkt);
2704 
2705 	pim_encap_cookie = ip_encap_attach(&ipv4_encap_cfg, NULL, M_WAITOK);
2706 	if (pim_encap_cookie == NULL) {
2707 		printf("ip_mroute: unable to attach pim encap\n");
2708 		VIF_LOCK_DESTROY();
2709 		MFC_LOCK_DESTROY();
2710 		MROUTER_LOCK_DESTROY();
2711 		return (EINVAL);
2712 	}
2713 
2714 	ip_mcast_src = X_ip_mcast_src;
2715 	ip_mforward = X_ip_mforward;
2716 	ip_mrouter_done = X_ip_mrouter_done;
2717 	ip_mrouter_get = X_ip_mrouter_get;
2718 	ip_mrouter_set = X_ip_mrouter_set;
2719 
2720 	ip_rsvp_force_done = X_ip_rsvp_force_done;
2721 	ip_rsvp_vif = X_ip_rsvp_vif;
2722 
2723 	legal_vif_num = X_legal_vif_num;
2724 	mrt_ioctl = X_mrt_ioctl;
2725 	rsvp_input_p = X_rsvp_input;
2726 	break;
2727 
2728     case MOD_UNLOAD:
2729 	/*
2730 	 * Typically module unload happens after the user-level
2731 	 * process has shutdown the kernel services (the check
2732 	 * below insures someone can't just yank the module out
2733 	 * from under a running process).  But if the module is
2734 	 * just loaded and then unloaded w/o starting up a user
2735 	 * process we still need to cleanup.
2736 	 */
2737 	MROUTER_LOCK();
2738 	if (ip_mrouter_cnt != 0) {
2739 	    MROUTER_UNLOCK();
2740 	    return (EINVAL);
2741 	}
2742 	ip_mrouter_unloading = 1;
2743 	MROUTER_UNLOCK();
2744 
2745 	EVENTHANDLER_DEREGISTER(ifnet_departure_event, if_detach_event_tag);
2746 
2747 	if (pim_encap_cookie) {
2748 	    ip_encap_detach(pim_encap_cookie);
2749 	    pim_encap_cookie = NULL;
2750 	}
2751 
2752 	ip_mcast_src = NULL;
2753 	ip_mforward = NULL;
2754 	ip_mrouter_done = NULL;
2755 	ip_mrouter_get = NULL;
2756 	ip_mrouter_set = NULL;
2757 
2758 	ip_rsvp_force_done = NULL;
2759 	ip_rsvp_vif = NULL;
2760 
2761 	legal_vif_num = NULL;
2762 	mrt_ioctl = NULL;
2763 	rsvp_input_p = NULL;
2764 
2765 	VIF_LOCK_DESTROY();
2766 	MFC_LOCK_DESTROY();
2767 	MROUTER_LOCK_DESTROY();
2768 	break;
2769 
2770     default:
2771 	return EOPNOTSUPP;
2772     }
2773     return 0;
2774 }
2775 
2776 static moduledata_t ip_mroutemod = {
2777     "ip_mroute",
2778     ip_mroute_modevent,
2779     0
2780 };
2781 
2782 DECLARE_MODULE(ip_mroute, ip_mroutemod, SI_SUB_PROTO_MC, SI_ORDER_MIDDLE);
2783