xref: /freebsd/sys/netinet/raw_ip.c (revision 13014ca04aad1931d41958b56f71a2c65b9a7a2c)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1993
3  *	The Regents of the University of California.
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 4. Neither the name of the University nor the names of its contributors
15  *    may be used to endorse or promote products derived from this software
16  *    without specific prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  *	@(#)raw_ip.c	8.7 (Berkeley) 5/15/95
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include "opt_inet6.h"
37 #include "opt_ipsec.h"
38 #include "opt_mac.h"
39 
40 #include <sys/param.h>
41 #include <sys/jail.h>
42 #include <sys/kernel.h>
43 #include <sys/lock.h>
44 #include <sys/malloc.h>
45 #include <sys/mbuf.h>
46 #include <sys/priv.h>
47 #include <sys/proc.h>
48 #include <sys/protosw.h>
49 #include <sys/signalvar.h>
50 #include <sys/socket.h>
51 #include <sys/socketvar.h>
52 #include <sys/sx.h>
53 #include <sys/sysctl.h>
54 #include <sys/systm.h>
55 #include <sys/vimage.h>
56 
57 #include <vm/uma.h>
58 
59 #include <net/if.h>
60 #include <net/route.h>
61 
62 #include <netinet/in.h>
63 #include <netinet/in_systm.h>
64 #include <netinet/in_pcb.h>
65 #include <netinet/in_var.h>
66 #include <netinet/ip.h>
67 #include <netinet/ip_var.h>
68 #include <netinet/ip_mroute.h>
69 
70 #include <netinet/ip_fw.h>
71 #include <netinet/ip_dummynet.h>
72 
73 #ifdef IPSEC
74 #include <netipsec/ipsec.h>
75 #endif /*IPSEC*/
76 
77 #include <security/mac/mac_framework.h>
78 
79 struct	inpcbhead ripcb;
80 struct	inpcbinfo ripcbinfo;
81 
82 /* control hooks for ipfw and dummynet */
83 ip_fw_ctl_t *ip_fw_ctl_ptr = NULL;
84 ip_dn_ctl_t *ip_dn_ctl_ptr = NULL;
85 
86 /*
87  * Hooks for multicast routing. They all default to NULL, so leave them not
88  * initialized and rely on BSS being set to 0.
89  */
90 
91 /*
92  * The socket used to communicate with the multicast routing daemon.
93  */
94 struct socket  *ip_mrouter;
95 
96 /*
97  * The various mrouter and rsvp functions.
98  */
99 int (*ip_mrouter_set)(struct socket *, struct sockopt *);
100 int (*ip_mrouter_get)(struct socket *, struct sockopt *);
101 int (*ip_mrouter_done)(void);
102 int (*ip_mforward)(struct ip *, struct ifnet *, struct mbuf *,
103 		   struct ip_moptions *);
104 int (*mrt_ioctl)(int, caddr_t, int);
105 int (*legal_vif_num)(int);
106 u_long (*ip_mcast_src)(int);
107 
108 void (*rsvp_input_p)(struct mbuf *m, int off);
109 int (*ip_rsvp_vif)(struct socket *, struct sockopt *);
110 void (*ip_rsvp_force_done)(struct socket *);
111 
112 /*
113  * Hash functions
114  */
115 
116 #define INP_PCBHASH_RAW_SIZE	256
117 #define INP_PCBHASH_RAW(proto, laddr, faddr, mask) \
118         (((proto) + (laddr) + (faddr)) % (mask) + 1)
119 
120 static void
121 rip_inshash(struct inpcb *inp)
122 {
123 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
124 	struct inpcbhead *pcbhash;
125 	int hash;
126 
127 	INP_INFO_WLOCK_ASSERT(pcbinfo);
128 	INP_WLOCK_ASSERT(inp);
129 
130 	if (inp->inp_ip_p != 0 &&
131 	    inp->inp_laddr.s_addr != INADDR_ANY &&
132 	    inp->inp_faddr.s_addr != INADDR_ANY) {
133 		hash = INP_PCBHASH_RAW(inp->inp_ip_p, inp->inp_laddr.s_addr,
134 		    inp->inp_faddr.s_addr, pcbinfo->ipi_hashmask);
135 	} else
136 		hash = 0;
137 	pcbhash = &pcbinfo->ipi_hashbase[hash];
138 	LIST_INSERT_HEAD(pcbhash, inp, inp_hash);
139 }
140 
141 static void
142 rip_delhash(struct inpcb *inp)
143 {
144 
145 	INP_INFO_WLOCK_ASSERT(inp->inp_pcbinfo);
146 	INP_WLOCK_ASSERT(inp);
147 
148 	LIST_REMOVE(inp, inp_hash);
149 }
150 
151 /*
152  * Raw interface to IP protocol.
153  */
154 
155 /*
156  * Initialize raw connection block q.
157  */
158 static void
159 rip_zone_change(void *tag)
160 {
161 	INIT_VNET_INET(curvnet);
162 
163 	uma_zone_set_max(V_ripcbinfo.ipi_zone, maxsockets);
164 }
165 
166 static int
167 rip_inpcb_init(void *mem, int size, int flags)
168 {
169 	struct inpcb *inp = mem;
170 
171 	INP_LOCK_INIT(inp, "inp", "rawinp");
172 	return (0);
173 }
174 
175 void
176 rip_init(void)
177 {
178 	INIT_VNET_INET(curvnet);
179 
180 	INP_INFO_LOCK_INIT(&V_ripcbinfo, "rip");
181 	LIST_INIT(&V_ripcb);
182 	V_ripcbinfo.ipi_listhead = &V_ripcb;
183 	V_ripcbinfo.ipi_hashbase =
184 	    hashinit(INP_PCBHASH_RAW_SIZE, M_PCB, &V_ripcbinfo.ipi_hashmask);
185 	V_ripcbinfo.ipi_porthashbase =
186 	    hashinit(1, M_PCB, &V_ripcbinfo.ipi_porthashmask);
187 	V_ripcbinfo.ipi_zone = uma_zcreate("ripcb", sizeof(struct inpcb),
188 	    NULL, NULL, rip_inpcb_init, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
189 	uma_zone_set_max(V_ripcbinfo.ipi_zone, maxsockets);
190 	EVENTHANDLER_REGISTER(maxsockets_change, rip_zone_change, NULL,
191 	    EVENTHANDLER_PRI_ANY);
192 }
193 
194 static int
195 rip_append(struct inpcb *last, struct ip *ip, struct mbuf *n,
196     struct sockaddr_in *ripsrc)
197 {
198 	int policyfail = 0;
199 
200 	INP_RLOCK_ASSERT(last);
201 
202 #ifdef IPSEC
203 	/* check AH/ESP integrity. */
204 	if (ipsec4_in_reject(n, last)) {
205 		policyfail = 1;
206 	}
207 #endif /* IPSEC */
208 #ifdef MAC
209 	if (!policyfail && mac_inpcb_check_deliver(last, n) != 0)
210 		policyfail = 1;
211 #endif
212 	/* Check the minimum TTL for socket. */
213 	if (last->inp_ip_minttl && last->inp_ip_minttl > ip->ip_ttl)
214 		policyfail = 1;
215 	if (!policyfail) {
216 		struct mbuf *opts = NULL;
217 		struct socket *so;
218 
219 		so = last->inp_socket;
220 		if ((last->inp_flags & INP_CONTROLOPTS) ||
221 		    (so->so_options & (SO_TIMESTAMP | SO_BINTIME)))
222 			ip_savecontrol(last, &opts, ip, n);
223 		SOCKBUF_LOCK(&so->so_rcv);
224 		if (sbappendaddr_locked(&so->so_rcv,
225 		    (struct sockaddr *)ripsrc, n, opts) == 0) {
226 			/* should notify about lost packet */
227 			m_freem(n);
228 			if (opts)
229 				m_freem(opts);
230 			SOCKBUF_UNLOCK(&so->so_rcv);
231 		} else
232 			sorwakeup_locked(so);
233 	} else
234 		m_freem(n);
235 	return (policyfail);
236 }
237 
238 /*
239  * Setup generic address and protocol structures for raw_input routine, then
240  * pass them along with mbuf chain.
241  */
242 void
243 rip_input(struct mbuf *m, int off)
244 {
245 	INIT_VNET_INET(curvnet);
246 	struct ip *ip = mtod(m, struct ip *);
247 	int proto = ip->ip_p;
248 	struct inpcb *inp, *last;
249 	struct sockaddr_in ripsrc;
250 	int hash;
251 
252 	bzero(&ripsrc, sizeof(ripsrc));
253 	ripsrc.sin_len = sizeof(ripsrc);
254 	ripsrc.sin_family = AF_INET;
255 	ripsrc.sin_addr = ip->ip_src;
256 	last = NULL;
257 	hash = INP_PCBHASH_RAW(proto, ip->ip_src.s_addr,
258 	    ip->ip_dst.s_addr, V_ripcbinfo.ipi_hashmask);
259 	INP_INFO_RLOCK(&V_ripcbinfo);
260 	LIST_FOREACH(inp, &V_ripcbinfo.ipi_hashbase[hash], inp_hash) {
261 		if (inp->inp_ip_p != proto)
262 			continue;
263 #ifdef INET6
264 		/* XXX inp locking */
265 		if ((inp->inp_vflag & INP_IPV4) == 0)
266 			continue;
267 #endif
268 		if (inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
269 			continue;
270 		if (inp->inp_faddr.s_addr != ip->ip_src.s_addr)
271 			continue;
272 		if (jailed(inp->inp_cred) &&
273 		    (htonl(prison_getip(inp->inp_cred)) !=
274 		    ip->ip_dst.s_addr)) {
275 			continue;
276 		}
277 		if (last) {
278 			struct mbuf *n;
279 
280 			n = m_copy(m, 0, (int)M_COPYALL);
281 			if (n != NULL)
282 		    	    (void) rip_append(last, ip, n, &ripsrc);
283 			/* XXX count dropped packet */
284 			INP_RUNLOCK(last);
285 		}
286 		INP_RLOCK(inp);
287 		last = inp;
288 	}
289 	LIST_FOREACH(inp, &V_ripcbinfo.ipi_hashbase[0], inp_hash) {
290 		if (inp->inp_ip_p && inp->inp_ip_p != proto)
291 			continue;
292 #ifdef INET6
293 		/* XXX inp locking */
294 		if ((inp->inp_vflag & INP_IPV4) == 0)
295 			continue;
296 #endif
297 		if (inp->inp_laddr.s_addr &&
298 		    inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
299 			continue;
300 		if (inp->inp_faddr.s_addr &&
301 		    inp->inp_faddr.s_addr != ip->ip_src.s_addr)
302 			continue;
303 		if (jailed(inp->inp_cred) &&
304 		    (htonl(prison_getip(inp->inp_cred)) !=
305 		    ip->ip_dst.s_addr)) {
306 			continue;
307 		}
308 		if (last) {
309 			struct mbuf *n;
310 
311 			n = m_copy(m, 0, (int)M_COPYALL);
312 			if (n != NULL)
313 				(void) rip_append(last, ip, n, &ripsrc);
314 			/* XXX count dropped packet */
315 			INP_RUNLOCK(last);
316 		}
317 		INP_RLOCK(inp);
318 		last = inp;
319 	}
320 	INP_INFO_RUNLOCK(&V_ripcbinfo);
321 	if (last != NULL) {
322 		if (rip_append(last, ip, m, &ripsrc) != 0)
323 			V_ipstat.ips_delivered--;
324 		INP_RUNLOCK(last);
325 	} else {
326 		m_freem(m);
327 		V_ipstat.ips_noproto++;
328 		V_ipstat.ips_delivered--;
329 	}
330 }
331 
332 /*
333  * Generate IP header and pass packet to ip_output.  Tack on options user may
334  * have setup with control call.
335  */
336 int
337 rip_output(struct mbuf *m, struct socket *so, u_long dst)
338 {
339 	INIT_VNET_INET(so->so_vnet);
340 	struct ip *ip;
341 	int error;
342 	struct inpcb *inp = sotoinpcb(so);
343 	int flags = ((so->so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0) |
344 	    IP_ALLOWBROADCAST;
345 
346 	/*
347 	 * If the user handed us a complete IP packet, use it.  Otherwise,
348 	 * allocate an mbuf for a header and fill it in.
349 	 */
350 	if ((inp->inp_flags & INP_HDRINCL) == 0) {
351 		if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
352 			m_freem(m);
353 			return(EMSGSIZE);
354 		}
355 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
356 		if (m == NULL)
357 			return(ENOBUFS);
358 
359 		INP_RLOCK(inp);
360 		ip = mtod(m, struct ip *);
361 		ip->ip_tos = inp->inp_ip_tos;
362 		if (inp->inp_flags & INP_DONTFRAG)
363 			ip->ip_off = IP_DF;
364 		else
365 			ip->ip_off = 0;
366 		ip->ip_p = inp->inp_ip_p;
367 		ip->ip_len = m->m_pkthdr.len;
368 		if (jailed(inp->inp_cred))
369 			ip->ip_src.s_addr =
370 			    htonl(prison_getip(inp->inp_cred));
371 		else
372 			ip->ip_src = inp->inp_laddr;
373 		ip->ip_dst.s_addr = dst;
374 		ip->ip_ttl = inp->inp_ip_ttl;
375 	} else {
376 		if (m->m_pkthdr.len > IP_MAXPACKET) {
377 			m_freem(m);
378 			return(EMSGSIZE);
379 		}
380 		INP_RLOCK(inp);
381 		ip = mtod(m, struct ip *);
382 		if (jailed(inp->inp_cred)) {
383 			if (ip->ip_src.s_addr !=
384 			    htonl(prison_getip(inp->inp_cred))) {
385 				INP_RUNLOCK(inp);
386 				m_freem(m);
387 				return (EPERM);
388 			}
389 		}
390 
391 		/*
392 		 * Don't allow both user specified and setsockopt options,
393 		 * and don't allow packet length sizes that will crash.
394 		 */
395 		if (((ip->ip_hl != (sizeof (*ip) >> 2)) && inp->inp_options)
396 		    || (ip->ip_len > m->m_pkthdr.len)
397 		    || (ip->ip_len < (ip->ip_hl << 2))) {
398 			INP_RUNLOCK(inp);
399 			m_freem(m);
400 			return (EINVAL);
401 		}
402 		if (ip->ip_id == 0)
403 			ip->ip_id = ip_newid();
404 
405 		/*
406 		 * XXX prevent ip_output from overwriting header fields.
407 		 */
408 		flags |= IP_RAWOUTPUT;
409 		V_ipstat.ips_rawout++;
410 	}
411 
412 	if (inp->inp_flags & INP_ONESBCAST)
413 		flags |= IP_SENDONES;
414 
415 #ifdef MAC
416 	mac_inpcb_create_mbuf(inp, m);
417 #endif
418 
419 	error = ip_output(m, inp->inp_options, NULL, flags,
420 	    inp->inp_moptions, inp);
421 	INP_RUNLOCK(inp);
422 	return (error);
423 }
424 
425 /*
426  * Raw IP socket option processing.
427  *
428  * IMPORTANT NOTE regarding access control: Traditionally, raw sockets could
429  * only be created by a privileged process, and as such, socket option
430  * operations to manage system properties on any raw socket were allowed to
431  * take place without explicit additional access control checks.  However,
432  * raw sockets can now also be created in jail(), and therefore explicit
433  * checks are now required.  Likewise, raw sockets can be used by a process
434  * after it gives up privilege, so some caution is required.  For options
435  * passed down to the IP layer via ip_ctloutput(), checks are assumed to be
436  * performed in ip_ctloutput() and therefore no check occurs here.
437  * Unilaterally checking priv_check() here breaks normal IP socket option
438  * operations on raw sockets.
439  *
440  * When adding new socket options here, make sure to add access control
441  * checks here as necessary.
442  */
443 int
444 rip_ctloutput(struct socket *so, struct sockopt *sopt)
445 {
446 	struct	inpcb *inp = sotoinpcb(so);
447 	int	error, optval;
448 
449 	if (sopt->sopt_level != IPPROTO_IP)
450 		return (EINVAL);
451 
452 	error = 0;
453 	switch (sopt->sopt_dir) {
454 	case SOPT_GET:
455 		switch (sopt->sopt_name) {
456 		case IP_HDRINCL:
457 			optval = inp->inp_flags & INP_HDRINCL;
458 			error = sooptcopyout(sopt, &optval, sizeof optval);
459 			break;
460 
461 		case IP_FW_ADD:	/* ADD actually returns the body... */
462 		case IP_FW_GET:
463 		case IP_FW_TABLE_GETSIZE:
464 		case IP_FW_TABLE_LIST:
465 		case IP_FW_NAT_GET_CONFIG:
466 		case IP_FW_NAT_GET_LOG:
467 			if (ip_fw_ctl_ptr != NULL)
468 				error = ip_fw_ctl_ptr(sopt);
469 			else
470 				error = ENOPROTOOPT;
471 			break;
472 
473 		case IP_DUMMYNET_GET:
474 			if (ip_dn_ctl_ptr != NULL)
475 				error = ip_dn_ctl_ptr(sopt);
476 			else
477 				error = ENOPROTOOPT;
478 			break ;
479 
480 		case MRT_INIT:
481 		case MRT_DONE:
482 		case MRT_ADD_VIF:
483 		case MRT_DEL_VIF:
484 		case MRT_ADD_MFC:
485 		case MRT_DEL_MFC:
486 		case MRT_VERSION:
487 		case MRT_ASSERT:
488 		case MRT_API_SUPPORT:
489 		case MRT_API_CONFIG:
490 		case MRT_ADD_BW_UPCALL:
491 		case MRT_DEL_BW_UPCALL:
492 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
493 			if (error != 0)
494 				return (error);
495 			error = ip_mrouter_get ? ip_mrouter_get(so, sopt) :
496 				EOPNOTSUPP;
497 			break;
498 
499 		default:
500 			error = ip_ctloutput(so, sopt);
501 			break;
502 		}
503 		break;
504 
505 	case SOPT_SET:
506 		switch (sopt->sopt_name) {
507 		case IP_HDRINCL:
508 			error = sooptcopyin(sopt, &optval, sizeof optval,
509 					    sizeof optval);
510 			if (error)
511 				break;
512 			if (optval)
513 				inp->inp_flags |= INP_HDRINCL;
514 			else
515 				inp->inp_flags &= ~INP_HDRINCL;
516 			break;
517 
518 		case IP_FW_ADD:
519 		case IP_FW_DEL:
520 		case IP_FW_FLUSH:
521 		case IP_FW_ZERO:
522 		case IP_FW_RESETLOG:
523 		case IP_FW_TABLE_ADD:
524 		case IP_FW_TABLE_DEL:
525 		case IP_FW_TABLE_FLUSH:
526 		case IP_FW_NAT_CFG:
527 		case IP_FW_NAT_DEL:
528 			if (ip_fw_ctl_ptr != NULL)
529 				error = ip_fw_ctl_ptr(sopt);
530 			else
531 				error = ENOPROTOOPT;
532 			break;
533 
534 		case IP_DUMMYNET_CONFIGURE:
535 		case IP_DUMMYNET_DEL:
536 		case IP_DUMMYNET_FLUSH:
537 			if (ip_dn_ctl_ptr != NULL)
538 				error = ip_dn_ctl_ptr(sopt);
539 			else
540 				error = ENOPROTOOPT ;
541 			break ;
542 
543 		case IP_RSVP_ON:
544 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
545 			if (error != 0)
546 				return (error);
547 			error = ip_rsvp_init(so);
548 			break;
549 
550 		case IP_RSVP_OFF:
551 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
552 			if (error != 0)
553 				return (error);
554 			error = ip_rsvp_done();
555 			break;
556 
557 		case IP_RSVP_VIF_ON:
558 		case IP_RSVP_VIF_OFF:
559 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
560 			if (error != 0)
561 				return (error);
562 			error = ip_rsvp_vif ?
563 				ip_rsvp_vif(so, sopt) : EINVAL;
564 			break;
565 
566 		case MRT_INIT:
567 		case MRT_DONE:
568 		case MRT_ADD_VIF:
569 		case MRT_DEL_VIF:
570 		case MRT_ADD_MFC:
571 		case MRT_DEL_MFC:
572 		case MRT_VERSION:
573 		case MRT_ASSERT:
574 		case MRT_API_SUPPORT:
575 		case MRT_API_CONFIG:
576 		case MRT_ADD_BW_UPCALL:
577 		case MRT_DEL_BW_UPCALL:
578 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
579 			if (error != 0)
580 				return (error);
581 			error = ip_mrouter_set ? ip_mrouter_set(so, sopt) :
582 					EOPNOTSUPP;
583 			break;
584 
585 		default:
586 			error = ip_ctloutput(so, sopt);
587 			break;
588 		}
589 		break;
590 	}
591 
592 	return (error);
593 }
594 
595 /*
596  * This function exists solely to receive the PRC_IFDOWN messages which are
597  * sent by if_down().  It looks for an ifaddr whose ifa_addr is sa, and calls
598  * in_ifadown() to remove all routes corresponding to that address.  It also
599  * receives the PRC_IFUP messages from if_up() and reinstalls the interface
600  * routes.
601  */
602 void
603 rip_ctlinput(int cmd, struct sockaddr *sa, void *vip)
604 {
605 	INIT_VNET_INET(curvnet);
606 	struct in_ifaddr *ia;
607 	struct ifnet *ifp;
608 	int err;
609 	int flags;
610 
611 	switch (cmd) {
612 	case PRC_IFDOWN:
613 		TAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) {
614 			if (ia->ia_ifa.ifa_addr == sa
615 			    && (ia->ia_flags & IFA_ROUTE)) {
616 				/*
617 				 * in_ifscrub kills the interface route.
618 				 */
619 				in_ifscrub(ia->ia_ifp, ia);
620 				/*
621 				 * in_ifadown gets rid of all the rest of the
622 				 * routes.  This is not quite the right thing
623 				 * to do, but at least if we are running a
624 				 * routing process they will come back.
625 				 */
626 				in_ifadown(&ia->ia_ifa, 0);
627 				break;
628 			}
629 		}
630 		break;
631 
632 	case PRC_IFUP:
633 		TAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) {
634 			if (ia->ia_ifa.ifa_addr == sa)
635 				break;
636 		}
637 		if (ia == 0 || (ia->ia_flags & IFA_ROUTE))
638 			return;
639 		flags = RTF_UP;
640 		ifp = ia->ia_ifa.ifa_ifp;
641 
642 		if ((ifp->if_flags & IFF_LOOPBACK)
643 		    || (ifp->if_flags & IFF_POINTOPOINT))
644 			flags |= RTF_HOST;
645 
646 		err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
647 		if (err == 0)
648 			ia->ia_flags |= IFA_ROUTE;
649 		break;
650 	}
651 }
652 
653 u_long	rip_sendspace = 9216;
654 u_long	rip_recvspace = 9216;
655 
656 SYSCTL_ULONG(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW,
657     &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
658 SYSCTL_ULONG(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW,
659     &rip_recvspace, 0, "Maximum space for incoming raw IP datagrams");
660 
661 static int
662 rip_attach(struct socket *so, int proto, struct thread *td)
663 {
664 	INIT_VNET_INET(so->so_vnet);
665 	struct inpcb *inp;
666 	int error;
667 
668 	inp = sotoinpcb(so);
669 	KASSERT(inp == NULL, ("rip_attach: inp != NULL"));
670 
671 	error = priv_check(td, PRIV_NETINET_RAW);
672 	if (error)
673 		return (error);
674 	if (proto >= IPPROTO_MAX || proto < 0)
675 		return EPROTONOSUPPORT;
676 	error = soreserve(so, rip_sendspace, rip_recvspace);
677 	if (error)
678 		return (error);
679 	INP_INFO_WLOCK(&V_ripcbinfo);
680 	error = in_pcballoc(so, &V_ripcbinfo);
681 	if (error) {
682 		INP_INFO_WUNLOCK(&V_ripcbinfo);
683 		return (error);
684 	}
685 	inp = (struct inpcb *)so->so_pcb;
686 	inp->inp_vflag |= INP_IPV4;
687 	inp->inp_ip_p = proto;
688 	inp->inp_ip_ttl = V_ip_defttl;
689 	rip_inshash(inp);
690 	INP_INFO_WUNLOCK(&V_ripcbinfo);
691 	INP_WUNLOCK(inp);
692 	return (0);
693 }
694 
695 static void
696 rip_detach(struct socket *so)
697 {
698 	INIT_VNET_INET(so->so_vnet);
699 	struct inpcb *inp;
700 
701 	inp = sotoinpcb(so);
702 	KASSERT(inp != NULL, ("rip_detach: inp == NULL"));
703 	KASSERT(inp->inp_faddr.s_addr == INADDR_ANY,
704 	    ("rip_detach: not closed"));
705 
706 	INP_INFO_WLOCK(&V_ripcbinfo);
707 	INP_WLOCK(inp);
708 	rip_delhash(inp);
709 	if (so == V_ip_mrouter && ip_mrouter_done)
710 		ip_mrouter_done();
711 	if (ip_rsvp_force_done)
712 		ip_rsvp_force_done(so);
713 	if (so == V_ip_rsvpd)
714 		ip_rsvp_done();
715 	in_pcbdetach(inp);
716 	in_pcbfree(inp);
717 	INP_INFO_WUNLOCK(&V_ripcbinfo);
718 }
719 
720 static void
721 rip_dodisconnect(struct socket *so, struct inpcb *inp)
722 {
723 
724 	INP_INFO_WLOCK_ASSERT(inp->inp_pcbinfo);
725 	INP_WLOCK_ASSERT(inp);
726 
727 	rip_delhash(inp);
728 	inp->inp_faddr.s_addr = INADDR_ANY;
729 	rip_inshash(inp);
730 	SOCK_LOCK(so);
731 	so->so_state &= ~SS_ISCONNECTED;
732 	SOCK_UNLOCK(so);
733 }
734 
735 static void
736 rip_abort(struct socket *so)
737 {
738 	INIT_VNET_INET(so->so_vnet);
739 	struct inpcb *inp;
740 
741 	inp = sotoinpcb(so);
742 	KASSERT(inp != NULL, ("rip_abort: inp == NULL"));
743 
744 	INP_INFO_WLOCK(&V_ripcbinfo);
745 	INP_WLOCK(inp);
746 	rip_dodisconnect(so, inp);
747 	INP_WUNLOCK(inp);
748 	INP_INFO_WUNLOCK(&V_ripcbinfo);
749 }
750 
751 static void
752 rip_close(struct socket *so)
753 {
754 	INIT_VNET_INET(so->so_vnet);
755 	struct inpcb *inp;
756 
757 	inp = sotoinpcb(so);
758 	KASSERT(inp != NULL, ("rip_close: inp == NULL"));
759 
760 	INP_INFO_WLOCK(&V_ripcbinfo);
761 	INP_WLOCK(inp);
762 	rip_dodisconnect(so, inp);
763 	INP_WUNLOCK(inp);
764 	INP_INFO_WUNLOCK(&V_ripcbinfo);
765 }
766 
767 static int
768 rip_disconnect(struct socket *so)
769 {
770 	INIT_VNET_INET(so->so_vnet);
771 	struct inpcb *inp;
772 
773 	if ((so->so_state & SS_ISCONNECTED) == 0)
774 		return (ENOTCONN);
775 
776 	inp = sotoinpcb(so);
777 	KASSERT(inp != NULL, ("rip_disconnect: inp == NULL"));
778 
779 	INP_INFO_WLOCK(&V_ripcbinfo);
780 	INP_WLOCK(inp);
781 	rip_dodisconnect(so, inp);
782 	INP_WUNLOCK(inp);
783 	INP_INFO_WUNLOCK(&V_ripcbinfo);
784 	return (0);
785 }
786 
787 static int
788 rip_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
789 {
790 	INIT_VNET_NET(so->so_vnet);
791 	INIT_VNET_INET(so->so_vnet);
792 	struct sockaddr_in *addr = (struct sockaddr_in *)nam;
793 	struct inpcb *inp;
794 
795 	if (nam->sa_len != sizeof(*addr))
796 		return (EINVAL);
797 
798 	if (jailed(td->td_ucred)) {
799 		if (addr->sin_addr.s_addr == INADDR_ANY)
800 			addr->sin_addr.s_addr =
801 			    htonl(prison_getip(td->td_ucred));
802 		if (htonl(prison_getip(td->td_ucred)) != addr->sin_addr.s_addr)
803 			return (EADDRNOTAVAIL);
804 	}
805 
806 	if (TAILQ_EMPTY(&V_ifnet) ||
807 	    (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) ||
808 	    (addr->sin_addr.s_addr &&
809 	     ifa_ifwithaddr((struct sockaddr *)addr) == 0))
810 		return (EADDRNOTAVAIL);
811 
812 	inp = sotoinpcb(so);
813 	KASSERT(inp != NULL, ("rip_bind: inp == NULL"));
814 
815 	INP_INFO_WLOCK(&V_ripcbinfo);
816 	INP_WLOCK(inp);
817 	rip_delhash(inp);
818 	inp->inp_laddr = addr->sin_addr;
819 	rip_inshash(inp);
820 	INP_WUNLOCK(inp);
821 	INP_INFO_WUNLOCK(&V_ripcbinfo);
822 	return (0);
823 }
824 
825 static int
826 rip_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
827 {
828 	INIT_VNET_NET(so->so_vnet);
829 	INIT_VNET_INET(so->so_vnet);
830 	struct sockaddr_in *addr = (struct sockaddr_in *)nam;
831 	struct inpcb *inp;
832 
833 	if (nam->sa_len != sizeof(*addr))
834 		return (EINVAL);
835 	if (TAILQ_EMPTY(&V_ifnet))
836 		return (EADDRNOTAVAIL);
837 	if (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK)
838 		return (EAFNOSUPPORT);
839 
840 	inp = sotoinpcb(so);
841 	KASSERT(inp != NULL, ("rip_connect: inp == NULL"));
842 
843 	INP_INFO_WLOCK(&V_ripcbinfo);
844 	INP_WLOCK(inp);
845 	rip_delhash(inp);
846 	inp->inp_faddr = addr->sin_addr;
847 	rip_inshash(inp);
848 	soisconnected(so);
849 	INP_WUNLOCK(inp);
850 	INP_INFO_WUNLOCK(&V_ripcbinfo);
851 	return (0);
852 }
853 
854 static int
855 rip_shutdown(struct socket *so)
856 {
857 	struct inpcb *inp;
858 
859 	inp = sotoinpcb(so);
860 	KASSERT(inp != NULL, ("rip_shutdown: inp == NULL"));
861 
862 	INP_WLOCK(inp);
863 	socantsendmore(so);
864 	INP_WUNLOCK(inp);
865 	return (0);
866 }
867 
868 static int
869 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
870     struct mbuf *control, struct thread *td)
871 {
872 	struct inpcb *inp;
873 	u_long dst;
874 
875 	inp = sotoinpcb(so);
876 	KASSERT(inp != NULL, ("rip_send: inp == NULL"));
877 
878 	/*
879 	 * Note: 'dst' reads below are unlocked.
880 	 */
881 	if (so->so_state & SS_ISCONNECTED) {
882 		if (nam) {
883 			m_freem(m);
884 			return (EISCONN);
885 		}
886 		dst = inp->inp_faddr.s_addr;	/* Unlocked read. */
887 	} else {
888 		if (nam == NULL) {
889 			m_freem(m);
890 			return (ENOTCONN);
891 		}
892 		dst = ((struct sockaddr_in *)nam)->sin_addr.s_addr;
893 	}
894 	return (rip_output(m, so, dst));
895 }
896 
897 static int
898 rip_pcblist(SYSCTL_HANDLER_ARGS)
899 {
900 	INIT_VNET_INET(curvnet);
901 	int error, i, n;
902 	struct inpcb *inp, **inp_list;
903 	inp_gen_t gencnt;
904 	struct xinpgen xig;
905 
906 	/*
907 	 * The process of preparing the TCB list is too time-consuming and
908 	 * resource-intensive to repeat twice on every request.
909 	 */
910 	if (req->oldptr == 0) {
911 		n = V_ripcbinfo.ipi_count;
912 		req->oldidx = 2 * (sizeof xig)
913 		    + (n + n/8) * sizeof(struct xinpcb);
914 		return (0);
915 	}
916 
917 	if (req->newptr != 0)
918 		return (EPERM);
919 
920 	/*
921 	 * OK, now we're committed to doing something.
922 	 */
923 	INP_INFO_RLOCK(&V_ripcbinfo);
924 	gencnt = V_ripcbinfo.ipi_gencnt;
925 	n = V_ripcbinfo.ipi_count;
926 	INP_INFO_RUNLOCK(&V_ripcbinfo);
927 
928 	xig.xig_len = sizeof xig;
929 	xig.xig_count = n;
930 	xig.xig_gen = gencnt;
931 	xig.xig_sogen = so_gencnt;
932 	error = SYSCTL_OUT(req, &xig, sizeof xig);
933 	if (error)
934 		return (error);
935 
936 	inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
937 	if (inp_list == 0)
938 		return (ENOMEM);
939 
940 	INP_INFO_RLOCK(&V_ripcbinfo);
941 	for (inp = LIST_FIRST(V_ripcbinfo.ipi_listhead), i = 0; inp && i < n;
942 	     inp = LIST_NEXT(inp, inp_list)) {
943 		INP_RLOCK(inp);
944 		if (inp->inp_gencnt <= gencnt &&
945 		    cr_canseesocket(req->td->td_ucred, inp->inp_socket) == 0) {
946 			/* XXX held references? */
947 			inp_list[i++] = inp;
948 		}
949 		INP_RUNLOCK(inp);
950 	}
951 	INP_INFO_RUNLOCK(&V_ripcbinfo);
952 	n = i;
953 
954 	error = 0;
955 	for (i = 0; i < n; i++) {
956 		inp = inp_list[i];
957 		INP_RLOCK(inp);
958 		if (inp->inp_gencnt <= gencnt) {
959 			struct xinpcb xi;
960 			bzero(&xi, sizeof(xi));
961 			xi.xi_len = sizeof xi;
962 			/* XXX should avoid extra copy */
963 			bcopy(inp, &xi.xi_inp, sizeof *inp);
964 			if (inp->inp_socket)
965 				sotoxsocket(inp->inp_socket, &xi.xi_socket);
966 			INP_RUNLOCK(inp);
967 			error = SYSCTL_OUT(req, &xi, sizeof xi);
968 		} else
969 			INP_RUNLOCK(inp);
970 	}
971 	if (!error) {
972 		/*
973 		 * Give the user an updated idea of our state.  If the
974 		 * generation differs from what we told her before, she knows
975 		 * that something happened while we were processing this
976 		 * request, and it might be necessary to retry.
977 		 */
978 		INP_INFO_RLOCK(&V_ripcbinfo);
979 		xig.xig_gen = V_ripcbinfo.ipi_gencnt;
980 		xig.xig_sogen = so_gencnt;
981 		xig.xig_count = V_ripcbinfo.ipi_count;
982 		INP_INFO_RUNLOCK(&V_ripcbinfo);
983 		error = SYSCTL_OUT(req, &xig, sizeof xig);
984 	}
985 	free(inp_list, M_TEMP);
986 	return (error);
987 }
988 
989 SYSCTL_PROC(_net_inet_raw, OID_AUTO/*XXX*/, pcblist, CTLFLAG_RD, 0, 0,
990     rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
991 
992 struct pr_usrreqs rip_usrreqs = {
993 	.pru_abort =		rip_abort,
994 	.pru_attach =		rip_attach,
995 	.pru_bind =		rip_bind,
996 	.pru_connect =		rip_connect,
997 	.pru_control =		in_control,
998 	.pru_detach =		rip_detach,
999 	.pru_disconnect =	rip_disconnect,
1000 	.pru_peeraddr =		in_getpeeraddr,
1001 	.pru_send =		rip_send,
1002 	.pru_shutdown =		rip_shutdown,
1003 	.pru_sockaddr =		in_getsockaddr,
1004 	.pru_sosetlabel =	in_pcbsosetlabel,
1005 	.pru_close =		rip_close,
1006 };
1007