xref: /freebsd/sys/netinet/raw_ip.c (revision 1db64f89363c97858961c4df0b7d02f3223723cf)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1988, 1993
5  *	The Regents of the University of California.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 #include "opt_inet.h"
35 #include "opt_inet6.h"
36 #include "opt_ipsec.h"
37 #include "opt_route.h"
38 
39 #include <sys/param.h>
40 #include <sys/jail.h>
41 #include <sys/kernel.h>
42 #include <sys/eventhandler.h>
43 #include <sys/lock.h>
44 #include <sys/malloc.h>
45 #include <sys/mbuf.h>
46 #include <sys/priv.h>
47 #include <sys/proc.h>
48 #include <sys/protosw.h>
49 #include <sys/rwlock.h>
50 #include <sys/signalvar.h>
51 #include <sys/socket.h>
52 #include <sys/socketvar.h>
53 #include <sys/sx.h>
54 #include <sys/sysctl.h>
55 #include <sys/systm.h>
56 
57 #include <vm/uma.h>
58 
59 #include <net/if.h>
60 #include <net/if_var.h>
61 #include <net/route.h>
62 #include <net/route/route_ctl.h>
63 #include <net/vnet.h>
64 
65 #include <netinet/in.h>
66 #include <netinet/in_systm.h>
67 #include <netinet/in_fib.h>
68 #include <netinet/in_pcb.h>
69 #include <netinet/in_var.h>
70 #include <netinet/if_ether.h>
71 #include <netinet/ip.h>
72 #include <netinet/ip_var.h>
73 #include <netinet/ip_mroute.h>
74 #include <netinet/ip_icmp.h>
75 
76 #include <netipsec/ipsec_support.h>
77 
78 #include <machine/stdarg.h>
79 #include <security/mac/mac_framework.h>
80 
81 extern ipproto_input_t *ip_protox[];
82 
83 VNET_DEFINE(int, ip_defttl) = IPDEFTTL;
84 SYSCTL_INT(_net_inet_ip, IPCTL_DEFTTL, ttl, CTLFLAG_VNET | CTLFLAG_RW,
85     &VNET_NAME(ip_defttl), 0,
86     "Maximum TTL on IP packets");
87 
88 VNET_DEFINE(struct inpcbinfo, ripcbinfo);
89 #define	V_ripcbinfo		VNET(ripcbinfo)
90 
91 /*
92  * Control and data hooks for ipfw, dummynet, divert and so on.
93  * The data hooks are not used here but it is convenient
94  * to keep them all in one place.
95  */
96 VNET_DEFINE(ip_fw_ctl_ptr_t, ip_fw_ctl_ptr) = NULL;
97 
98 int	(*ip_dn_ctl_ptr)(struct sockopt *);
99 int	(*ip_dn_io_ptr)(struct mbuf **, struct ip_fw_args *);
100 void	(*ip_divert_ptr)(struct mbuf *, bool);
101 int	(*ng_ipfw_input_p)(struct mbuf **, struct ip_fw_args *, bool);
102 
103 #ifdef INET
104 /*
105  * Hooks for multicast routing. They all default to NULL, so leave them not
106  * initialized and rely on BSS being set to 0.
107  */
108 
109 /*
110  * The socket used to communicate with the multicast routing daemon.
111  */
112 VNET_DEFINE(struct socket *, ip_mrouter);
113 
114 /*
115  * The various mrouter and rsvp functions.
116  */
117 int (*ip_mrouter_set)(struct socket *, struct sockopt *);
118 int (*ip_mrouter_get)(struct socket *, struct sockopt *);
119 int (*ip_mrouter_done)(void);
120 int (*ip_mforward)(struct ip *, struct ifnet *, struct mbuf *,
121 		   struct ip_moptions *);
122 int (*mrt_ioctl)(u_long, caddr_t, int);
123 int (*legal_vif_num)(int);
124 u_long (*ip_mcast_src)(int);
125 
126 int (*rsvp_input_p)(struct mbuf **, int *, int);
127 int (*ip_rsvp_vif)(struct socket *, struct sockopt *);
128 void (*ip_rsvp_force_done)(struct socket *);
129 #endif /* INET */
130 
131 u_long	rip_sendspace = 9216;
132 SYSCTL_ULONG(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW,
133     &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
134 
135 u_long	rip_recvspace = 9216;
136 SYSCTL_ULONG(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW,
137     &rip_recvspace, 0, "Maximum space for incoming raw IP datagrams");
138 
139 /*
140  * Hash functions
141  */
142 
143 #define INP_PCBHASH_RAW_SIZE	256
144 #define INP_PCBHASH_RAW(proto, laddr, faddr, mask) \
145         (((proto) + (laddr) + (faddr)) % (mask) + 1)
146 
147 #ifdef INET
148 static void
149 rip_inshash(struct inpcb *inp)
150 {
151 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
152 	struct inpcbhead *pcbhash;
153 	int hash;
154 
155 	INP_HASH_WLOCK_ASSERT(pcbinfo);
156 	INP_WLOCK_ASSERT(inp);
157 
158 	if (inp->inp_ip_p != 0 &&
159 	    inp->inp_laddr.s_addr != INADDR_ANY &&
160 	    inp->inp_faddr.s_addr != INADDR_ANY) {
161 		hash = INP_PCBHASH_RAW(inp->inp_ip_p, inp->inp_laddr.s_addr,
162 		    inp->inp_faddr.s_addr, pcbinfo->ipi_hashmask);
163 	} else
164 		hash = 0;
165 	pcbhash = &pcbinfo->ipi_hash_exact[hash];
166 	CK_LIST_INSERT_HEAD(pcbhash, inp, inp_hash_exact);
167 }
168 
169 static void
170 rip_delhash(struct inpcb *inp)
171 {
172 
173 	INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);
174 	INP_WLOCK_ASSERT(inp);
175 
176 	CK_LIST_REMOVE(inp, inp_hash_exact);
177 }
178 #endif /* INET */
179 
180 INPCBSTORAGE_DEFINE(ripcbstor, inpcb, "rawinp", "ripcb", "rip", "riphash");
181 
182 static void
183 rip_init(void *arg __unused)
184 {
185 
186 	in_pcbinfo_init(&V_ripcbinfo, &ripcbstor, INP_PCBHASH_RAW_SIZE, 1);
187 }
188 VNET_SYSINIT(rip_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD, rip_init, NULL);
189 
190 #ifdef VIMAGE
191 static void
192 rip_destroy(void *unused __unused)
193 {
194 
195 	in_pcbinfo_destroy(&V_ripcbinfo);
196 }
197 VNET_SYSUNINIT(raw_ip, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH, rip_destroy, NULL);
198 #endif
199 
200 #ifdef INET
201 static int
202 rip_append(struct inpcb *inp, struct ip *ip, struct mbuf *m,
203     struct sockaddr_in *ripsrc)
204 {
205 	struct socket *so = inp->inp_socket;
206 	struct mbuf *n, *opts = NULL;
207 
208 	INP_LOCK_ASSERT(inp);
209 
210 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
211 	/* check AH/ESP integrity. */
212 	if (IPSEC_ENABLED(ipv4) && IPSEC_CHECK_POLICY(ipv4, m, inp) != 0)
213 		return (0);
214 #endif /* IPSEC */
215 #ifdef MAC
216 	if (mac_inpcb_check_deliver(inp, m) != 0)
217 		return (0);
218 #endif
219 	/* Check the minimum TTL for socket. */
220 	if (inp->inp_ip_minttl && inp->inp_ip_minttl > ip->ip_ttl)
221 		return (0);
222 
223 	if ((n = m_copym(m, 0, M_COPYALL, M_NOWAIT)) == NULL)
224 		return (0);
225 
226 	if ((inp->inp_flags & INP_CONTROLOPTS) ||
227 	    (so->so_options & (SO_TIMESTAMP | SO_BINTIME)))
228 		ip_savecontrol(inp, &opts, ip, n);
229 	SOCKBUF_LOCK(&so->so_rcv);
230 	if (sbappendaddr_locked(&so->so_rcv,
231 	    (struct sockaddr *)ripsrc, n, opts) == 0) {
232 		soroverflow_locked(so);
233 		m_freem(n);
234 		if (opts)
235 			m_freem(opts);
236 		return (0);
237 	}
238 	sorwakeup_locked(so);
239 
240 	return (1);
241 }
242 
243 struct rip_inp_match_ctx {
244 	struct ip *ip;
245 	int proto;
246 };
247 
248 static bool
249 rip_inp_match1(const struct inpcb *inp, void *v)
250 {
251 	struct rip_inp_match_ctx *ctx = v;
252 
253 	if (inp->inp_ip_p != ctx->proto)
254 		return (false);
255 #ifdef INET6
256 	/* XXX inp locking */
257 	if ((inp->inp_vflag & INP_IPV4) == 0)
258 		return (false);
259 #endif
260 	if (inp->inp_laddr.s_addr != ctx->ip->ip_dst.s_addr)
261 		return (false);
262 	if (inp->inp_faddr.s_addr != ctx->ip->ip_src.s_addr)
263 		return (false);
264 	return (true);
265 }
266 
267 static bool
268 rip_inp_match2(const struct inpcb *inp, void *v)
269 {
270 	struct rip_inp_match_ctx *ctx = v;
271 
272 	if (inp->inp_ip_p && inp->inp_ip_p != ctx->proto)
273 		return (false);
274 #ifdef INET6
275 	/* XXX inp locking */
276 	if ((inp->inp_vflag & INP_IPV4) == 0)
277 		return (false);
278 #endif
279 	if (!in_nullhost(inp->inp_laddr) &&
280 	    !in_hosteq(inp->inp_laddr, ctx->ip->ip_dst))
281 		return (false);
282 	if (!in_nullhost(inp->inp_faddr) &&
283 	    !in_hosteq(inp->inp_faddr, ctx->ip->ip_src))
284 		return (false);
285 	return (true);
286 }
287 
288 /*
289  * Setup generic address and protocol structures for raw_input routine, then
290  * pass them along with mbuf chain.
291  */
292 int
293 rip_input(struct mbuf **mp, int *offp, int proto)
294 {
295 	struct rip_inp_match_ctx ctx = {
296 		.ip = mtod(*mp, struct ip *),
297 		.proto = proto,
298 	};
299 	struct inpcb_iterator inpi = INP_ITERATOR(&V_ripcbinfo,
300 	    INPLOOKUP_RLOCKPCB, rip_inp_match1, &ctx);
301 	struct ifnet *ifp;
302 	struct mbuf *m = *mp;
303 	struct inpcb *inp;
304 	struct sockaddr_in ripsrc;
305 	int appended;
306 
307 	*mp = NULL;
308 	appended = 0;
309 
310 	bzero(&ripsrc, sizeof(ripsrc));
311 	ripsrc.sin_len = sizeof(ripsrc);
312 	ripsrc.sin_family = AF_INET;
313 	ripsrc.sin_addr = ctx.ip->ip_src;
314 
315 	ifp = m->m_pkthdr.rcvif;
316 
317 	inpi.hash = INP_PCBHASH_RAW(proto, ctx.ip->ip_src.s_addr,
318 	    ctx.ip->ip_dst.s_addr, V_ripcbinfo.ipi_hashmask);
319 	while ((inp = inp_next(&inpi)) != NULL) {
320 		INP_RLOCK_ASSERT(inp);
321 		if (jailed_without_vnet(inp->inp_cred) &&
322 		    prison_check_ip4(inp->inp_cred, &ctx.ip->ip_dst) != 0) {
323 			/*
324 			 * XXX: If faddr was bound to multicast group,
325 			 * jailed raw socket will drop datagram.
326 			 */
327 			continue;
328 		}
329 		appended += rip_append(inp, ctx.ip, m, &ripsrc);
330 	}
331 
332 	inpi.hash = 0;
333 	inpi.match = rip_inp_match2;
334 	MPASS(inpi.inp == NULL);
335 	while ((inp = inp_next(&inpi)) != NULL) {
336 		INP_RLOCK_ASSERT(inp);
337 		if (jailed_without_vnet(inp->inp_cred) &&
338 		    !IN_MULTICAST(ntohl(ctx.ip->ip_dst.s_addr)) &&
339 		    prison_check_ip4(inp->inp_cred, &ctx.ip->ip_dst) != 0)
340 			/*
341 			 * Allow raw socket in jail to receive multicast;
342 			 * assume process had PRIV_NETINET_RAW at attach,
343 			 * and fall through into normal filter path if so.
344 			 */
345 			continue;
346 		/*
347 		 * If this raw socket has multicast state, and we
348 		 * have received a multicast, check if this socket
349 		 * should receive it, as multicast filtering is now
350 		 * the responsibility of the transport layer.
351 		 */
352 		if (inp->inp_moptions != NULL &&
353 		    IN_MULTICAST(ntohl(ctx.ip->ip_dst.s_addr))) {
354 			/*
355 			 * If the incoming datagram is for IGMP, allow it
356 			 * through unconditionally to the raw socket.
357 			 *
358 			 * In the case of IGMPv2, we may not have explicitly
359 			 * joined the group, and may have set IFF_ALLMULTI
360 			 * on the interface. imo_multi_filter() may discard
361 			 * control traffic we actually need to see.
362 			 *
363 			 * Userland multicast routing daemons should continue
364 			 * filter the control traffic appropriately.
365 			 */
366 			int blocked;
367 
368 			blocked = MCAST_PASS;
369 			if (proto != IPPROTO_IGMP) {
370 				struct sockaddr_in group;
371 
372 				bzero(&group, sizeof(struct sockaddr_in));
373 				group.sin_len = sizeof(struct sockaddr_in);
374 				group.sin_family = AF_INET;
375 				group.sin_addr = ctx.ip->ip_dst;
376 
377 				blocked = imo_multi_filter(inp->inp_moptions,
378 				    ifp,
379 				    (struct sockaddr *)&group,
380 				    (struct sockaddr *)&ripsrc);
381 			}
382 
383 			if (blocked != MCAST_PASS) {
384 				IPSTAT_INC(ips_notmember);
385 				continue;
386 			}
387 		}
388 		appended += rip_append(inp, ctx.ip, m, &ripsrc);
389 	}
390 	if (appended == 0 && ip_protox[ctx.ip->ip_p] == rip_input) {
391 		IPSTAT_INC(ips_noproto);
392 		IPSTAT_DEC(ips_delivered);
393 		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PROTOCOL, 0, 0);
394 	} else
395 		m_freem(m);
396 	return (IPPROTO_DONE);
397 }
398 
399 /*
400  * Generate IP header and pass packet to ip_output.  Tack on options user may
401  * have setup with control call.
402  */
403 static int
404 rip_send(struct socket *so, int pruflags, struct mbuf *m, struct sockaddr *nam,
405     struct mbuf *control, struct thread *td)
406 {
407 	struct epoch_tracker et;
408 	struct ip *ip;
409 	struct inpcb *inp;
410 	in_addr_t *dst;
411 	int error, flags, cnt, hlen;
412 	u_char opttype, optlen, *cp;
413 
414 	inp = sotoinpcb(so);
415 	KASSERT(inp != NULL, ("rip_send: inp == NULL"));
416 
417 	if (control != NULL) {
418 		m_freem(control);
419 		control = NULL;
420 	}
421 
422 	if (so->so_state & SS_ISCONNECTED) {
423 		if (nam) {
424 			error = EISCONN;
425 			m_freem(m);
426 			return (error);
427 		}
428 		dst = &inp->inp_faddr.s_addr;
429 	} else {
430 		if (nam == NULL)
431 			error = ENOTCONN;
432 		else if (nam->sa_family != AF_INET)
433 			error = EAFNOSUPPORT;
434 		else if (nam->sa_len != sizeof(struct sockaddr_in))
435 			error = EINVAL;
436 		else
437 			error = 0;
438 		if (error != 0) {
439 			m_freem(m);
440 			return (error);
441 		}
442 		dst = &((struct sockaddr_in *)nam)->sin_addr.s_addr;
443 	}
444 
445 	flags = ((so->so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0) |
446 	    IP_ALLOWBROADCAST;
447 
448 	/*
449 	 * If the user handed us a complete IP packet, use it.  Otherwise,
450 	 * allocate an mbuf for a header and fill it in.
451 	 */
452 	if ((inp->inp_flags & INP_HDRINCL) == 0) {
453 		if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
454 			m_freem(m);
455 			return(EMSGSIZE);
456 		}
457 		M_PREPEND(m, sizeof(struct ip), M_NOWAIT);
458 		if (m == NULL)
459 			return(ENOBUFS);
460 
461 		INP_RLOCK(inp);
462 		ip = mtod(m, struct ip *);
463 		ip->ip_tos = inp->inp_ip_tos;
464 		if (inp->inp_flags & INP_DONTFRAG)
465 			ip->ip_off = htons(IP_DF);
466 		else
467 			ip->ip_off = htons(0);
468 		ip->ip_p = inp->inp_ip_p;
469 		ip->ip_len = htons(m->m_pkthdr.len);
470 		ip->ip_src = inp->inp_laddr;
471 		ip->ip_dst.s_addr = *dst;
472 #ifdef ROUTE_MPATH
473 		if (CALC_FLOWID_OUTBOUND) {
474 			uint32_t hash_type, hash_val;
475 
476 			hash_val = fib4_calc_software_hash(ip->ip_src,
477 			    ip->ip_dst, 0, 0, ip->ip_p, &hash_type);
478 			m->m_pkthdr.flowid = hash_val;
479 			M_HASHTYPE_SET(m, hash_type);
480 			flags |= IP_NODEFAULTFLOWID;
481 		}
482 #endif
483 		if (jailed(inp->inp_cred)) {
484 			/*
485 			 * prison_local_ip4() would be good enough but would
486 			 * let a source of INADDR_ANY pass, which we do not
487 			 * want to see from jails.
488 			 */
489 			if (ip->ip_src.s_addr == INADDR_ANY) {
490 				NET_EPOCH_ENTER(et);
491 				error = in_pcbladdr(inp, &ip->ip_dst,
492 				    &ip->ip_src, inp->inp_cred);
493 				NET_EPOCH_EXIT(et);
494 			} else {
495 				error = prison_local_ip4(inp->inp_cred,
496 				    &ip->ip_src);
497 			}
498 			if (error != 0) {
499 				INP_RUNLOCK(inp);
500 				m_freem(m);
501 				return (error);
502 			}
503 		}
504 		ip->ip_ttl = inp->inp_ip_ttl;
505 	} else {
506 		if (m->m_pkthdr.len > IP_MAXPACKET) {
507 			m_freem(m);
508 			return (EMSGSIZE);
509 		}
510 		if (m->m_pkthdr.len < sizeof(*ip)) {
511 			m_freem(m);
512 			return (EINVAL);
513 		}
514 		m = m_pullup(m, sizeof(*ip));
515 		if (m == NULL)
516 			return (ENOMEM);
517 		ip = mtod(m, struct ip *);
518 		hlen = ip->ip_hl << 2;
519 		if (m->m_len < hlen) {
520 			m = m_pullup(m, hlen);
521 			if (m == NULL)
522 				return (EINVAL);
523 			ip = mtod(m, struct ip *);
524 		}
525 #ifdef ROUTE_MPATH
526 		if (CALC_FLOWID_OUTBOUND) {
527 			uint32_t hash_type, hash_val;
528 
529 			hash_val = fib4_calc_software_hash(ip->ip_dst,
530 			    ip->ip_src, 0, 0, ip->ip_p, &hash_type);
531 			m->m_pkthdr.flowid = hash_val;
532 			M_HASHTYPE_SET(m, hash_type);
533 			flags |= IP_NODEFAULTFLOWID;
534 		}
535 #endif
536 		INP_RLOCK(inp);
537 		/*
538 		 * Don't allow both user specified and setsockopt options,
539 		 * and don't allow packet length sizes that will crash.
540 		 */
541 		if ((hlen < sizeof (*ip))
542 		    || ((hlen > sizeof (*ip)) && inp->inp_options)
543 		    || (ntohs(ip->ip_len) != m->m_pkthdr.len)) {
544 			INP_RUNLOCK(inp);
545 			m_freem(m);
546 			return (EINVAL);
547 		}
548 		error = prison_check_ip4(inp->inp_cred, &ip->ip_src);
549 		if (error != 0) {
550 			INP_RUNLOCK(inp);
551 			m_freem(m);
552 			return (error);
553 		}
554 		/*
555 		 * Don't allow IP options which do not have the required
556 		 * structure as specified in section 3.1 of RFC 791 on
557 		 * pages 15-23.
558 		 */
559 		cp = (u_char *)(ip + 1);
560 		cnt = hlen - sizeof (struct ip);
561 		for (; cnt > 0; cnt -= optlen, cp += optlen) {
562 			opttype = cp[IPOPT_OPTVAL];
563 			if (opttype == IPOPT_EOL)
564 				break;
565 			if (opttype == IPOPT_NOP) {
566 				optlen = 1;
567 				continue;
568 			}
569 			if (cnt < IPOPT_OLEN + sizeof(u_char)) {
570 				INP_RUNLOCK(inp);
571 				m_freem(m);
572 				return (EINVAL);
573 			}
574 			optlen = cp[IPOPT_OLEN];
575 			if (optlen < IPOPT_OLEN + sizeof(u_char) ||
576 			    optlen > cnt) {
577 				INP_RUNLOCK(inp);
578 				m_freem(m);
579 				return (EINVAL);
580 			}
581 		}
582 		/*
583 		 * This doesn't allow application to specify ID of zero,
584 		 * but we got this limitation from the beginning of history.
585 		 */
586 		if (ip->ip_id == 0)
587 			ip_fillid(ip);
588 
589 		/*
590 		 * XXX prevent ip_output from overwriting header fields.
591 		 */
592 		flags |= IP_RAWOUTPUT;
593 		IPSTAT_INC(ips_rawout);
594 	}
595 
596 	if (inp->inp_flags & INP_ONESBCAST)
597 		flags |= IP_SENDONES;
598 
599 #ifdef MAC
600 	mac_inpcb_create_mbuf(inp, m);
601 #endif
602 
603 	NET_EPOCH_ENTER(et);
604 	error = ip_output(m, inp->inp_options, NULL, flags,
605 	    inp->inp_moptions, inp);
606 	NET_EPOCH_EXIT(et);
607 	INP_RUNLOCK(inp);
608 	return (error);
609 }
610 
611 /*
612  * Raw IP socket option processing.
613  *
614  * IMPORTANT NOTE regarding access control: Traditionally, raw sockets could
615  * only be created by a privileged process, and as such, socket option
616  * operations to manage system properties on any raw socket were allowed to
617  * take place without explicit additional access control checks.  However,
618  * raw sockets can now also be created in jail(), and therefore explicit
619  * checks are now required.  Likewise, raw sockets can be used by a process
620  * after it gives up privilege, so some caution is required.  For options
621  * passed down to the IP layer via ip_ctloutput(), checks are assumed to be
622  * performed in ip_ctloutput() and therefore no check occurs here.
623  * Unilaterally checking priv_check() here breaks normal IP socket option
624  * operations on raw sockets.
625  *
626  * When adding new socket options here, make sure to add access control
627  * checks here as necessary.
628  *
629  * XXX-BZ inp locking?
630  */
631 int
632 rip_ctloutput(struct socket *so, struct sockopt *sopt)
633 {
634 	struct	inpcb *inp = sotoinpcb(so);
635 	int	error, optval;
636 
637 	if (sopt->sopt_level != IPPROTO_IP) {
638 		if ((sopt->sopt_level == SOL_SOCKET) &&
639 		    (sopt->sopt_name == SO_SETFIB)) {
640 			inp->inp_inc.inc_fibnum = so->so_fibnum;
641 			return (0);
642 		}
643 		return (EINVAL);
644 	}
645 
646 	error = 0;
647 	switch (sopt->sopt_dir) {
648 	case SOPT_GET:
649 		switch (sopt->sopt_name) {
650 		case IP_HDRINCL:
651 			optval = inp->inp_flags & INP_HDRINCL;
652 			error = sooptcopyout(sopt, &optval, sizeof optval);
653 			break;
654 
655 		case IP_FW3:	/* generic ipfw v.3 functions */
656 		case IP_FW_ADD:	/* ADD actually returns the body... */
657 		case IP_FW_GET:
658 		case IP_FW_TABLE_GETSIZE:
659 		case IP_FW_TABLE_LIST:
660 		case IP_FW_NAT_GET_CONFIG:
661 		case IP_FW_NAT_GET_LOG:
662 			if (V_ip_fw_ctl_ptr != NULL)
663 				error = V_ip_fw_ctl_ptr(sopt);
664 			else
665 				error = ENOPROTOOPT;
666 			break;
667 
668 		case IP_DUMMYNET3:	/* generic dummynet v.3 functions */
669 		case IP_DUMMYNET_GET:
670 			if (ip_dn_ctl_ptr != NULL)
671 				error = ip_dn_ctl_ptr(sopt);
672 			else
673 				error = ENOPROTOOPT;
674 			break ;
675 
676 		case MRT_INIT:
677 		case MRT_DONE:
678 		case MRT_ADD_VIF:
679 		case MRT_DEL_VIF:
680 		case MRT_ADD_MFC:
681 		case MRT_DEL_MFC:
682 		case MRT_VERSION:
683 		case MRT_ASSERT:
684 		case MRT_API_SUPPORT:
685 		case MRT_API_CONFIG:
686 		case MRT_ADD_BW_UPCALL:
687 		case MRT_DEL_BW_UPCALL:
688 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
689 			if (error != 0)
690 				return (error);
691 			if (inp->inp_ip_p != IPPROTO_IGMP)
692 				return (EOPNOTSUPP);
693 			error = ip_mrouter_get ? ip_mrouter_get(so, sopt) :
694 				EOPNOTSUPP;
695 			break;
696 
697 		default:
698 			error = ip_ctloutput(so, sopt);
699 			break;
700 		}
701 		break;
702 
703 	case SOPT_SET:
704 		switch (sopt->sopt_name) {
705 		case IP_HDRINCL:
706 			error = sooptcopyin(sopt, &optval, sizeof optval,
707 					    sizeof optval);
708 			if (error)
709 				break;
710 			if (optval)
711 				inp->inp_flags |= INP_HDRINCL;
712 			else
713 				inp->inp_flags &= ~INP_HDRINCL;
714 			break;
715 
716 		case IP_FW3:	/* generic ipfw v.3 functions */
717 		case IP_FW_ADD:
718 		case IP_FW_DEL:
719 		case IP_FW_FLUSH:
720 		case IP_FW_ZERO:
721 		case IP_FW_RESETLOG:
722 		case IP_FW_TABLE_ADD:
723 		case IP_FW_TABLE_DEL:
724 		case IP_FW_TABLE_FLUSH:
725 		case IP_FW_NAT_CFG:
726 		case IP_FW_NAT_DEL:
727 			if (V_ip_fw_ctl_ptr != NULL)
728 				error = V_ip_fw_ctl_ptr(sopt);
729 			else
730 				error = ENOPROTOOPT;
731 			break;
732 
733 		case IP_DUMMYNET3:	/* generic dummynet v.3 functions */
734 		case IP_DUMMYNET_CONFIGURE:
735 		case IP_DUMMYNET_DEL:
736 		case IP_DUMMYNET_FLUSH:
737 			if (ip_dn_ctl_ptr != NULL)
738 				error = ip_dn_ctl_ptr(sopt);
739 			else
740 				error = ENOPROTOOPT ;
741 			break ;
742 
743 		case IP_RSVP_ON:
744 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
745 			if (error != 0)
746 				return (error);
747 			if (inp->inp_ip_p != IPPROTO_RSVP)
748 				return (EOPNOTSUPP);
749 			error = ip_rsvp_init(so);
750 			break;
751 
752 		case IP_RSVP_OFF:
753 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
754 			if (error != 0)
755 				return (error);
756 			error = ip_rsvp_done();
757 			break;
758 
759 		case IP_RSVP_VIF_ON:
760 		case IP_RSVP_VIF_OFF:
761 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
762 			if (error != 0)
763 				return (error);
764 			if (inp->inp_ip_p != IPPROTO_RSVP)
765 				return (EOPNOTSUPP);
766 			error = ip_rsvp_vif ?
767 				ip_rsvp_vif(so, sopt) : EINVAL;
768 			break;
769 
770 		case MRT_INIT:
771 		case MRT_DONE:
772 		case MRT_ADD_VIF:
773 		case MRT_DEL_VIF:
774 		case MRT_ADD_MFC:
775 		case MRT_DEL_MFC:
776 		case MRT_VERSION:
777 		case MRT_ASSERT:
778 		case MRT_API_SUPPORT:
779 		case MRT_API_CONFIG:
780 		case MRT_ADD_BW_UPCALL:
781 		case MRT_DEL_BW_UPCALL:
782 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
783 			if (error != 0)
784 				return (error);
785 			if (inp->inp_ip_p != IPPROTO_IGMP)
786 				return (EOPNOTSUPP);
787 			error = ip_mrouter_set ? ip_mrouter_set(so, sopt) :
788 					EOPNOTSUPP;
789 			break;
790 
791 		default:
792 			error = ip_ctloutput(so, sopt);
793 			break;
794 		}
795 		break;
796 	}
797 
798 	return (error);
799 }
800 
801 void
802 rip_ctlinput(struct icmp *icmp)
803 {
804 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
805 	if (IPSEC_ENABLED(ipv4))
806 		IPSEC_CTLINPUT(ipv4, icmp);
807 #endif
808 }
809 
810 static int
811 rip_attach(struct socket *so, int proto, struct thread *td)
812 {
813 	struct inpcb *inp;
814 	int error;
815 
816 	inp = sotoinpcb(so);
817 	KASSERT(inp == NULL, ("rip_attach: inp != NULL"));
818 
819 	error = priv_check(td, PRIV_NETINET_RAW);
820 	if (error)
821 		return (error);
822 	if (proto >= IPPROTO_MAX || proto < 0)
823 		return EPROTONOSUPPORT;
824 	error = soreserve(so, rip_sendspace, rip_recvspace);
825 	if (error)
826 		return (error);
827 	error = in_pcballoc(so, &V_ripcbinfo);
828 	if (error)
829 		return (error);
830 	inp = (struct inpcb *)so->so_pcb;
831 	inp->inp_ip_p = proto;
832 	inp->inp_ip_ttl = V_ip_defttl;
833 	INP_HASH_WLOCK(&V_ripcbinfo);
834 	rip_inshash(inp);
835 	INP_HASH_WUNLOCK(&V_ripcbinfo);
836 	INP_WUNLOCK(inp);
837 	return (0);
838 }
839 
840 static void
841 rip_detach(struct socket *so)
842 {
843 	struct inpcb *inp;
844 
845 	inp = sotoinpcb(so);
846 	KASSERT(inp != NULL, ("rip_detach: inp == NULL"));
847 	KASSERT(inp->inp_faddr.s_addr == INADDR_ANY,
848 	    ("rip_detach: not closed"));
849 
850 	/* Disable mrouter first */
851 	if (so == V_ip_mrouter && ip_mrouter_done)
852 		ip_mrouter_done();
853 
854 	INP_WLOCK(inp);
855 	INP_HASH_WLOCK(&V_ripcbinfo);
856 	rip_delhash(inp);
857 	INP_HASH_WUNLOCK(&V_ripcbinfo);
858 
859 	if (ip_rsvp_force_done)
860 		ip_rsvp_force_done(so);
861 	if (so == V_ip_rsvpd)
862 		ip_rsvp_done();
863 	in_pcbdetach(inp);
864 	in_pcbfree(inp);
865 }
866 
867 static void
868 rip_dodisconnect(struct socket *so, struct inpcb *inp)
869 {
870 	struct inpcbinfo *pcbinfo;
871 
872 	pcbinfo = inp->inp_pcbinfo;
873 	INP_WLOCK(inp);
874 	INP_HASH_WLOCK(pcbinfo);
875 	rip_delhash(inp);
876 	inp->inp_faddr.s_addr = INADDR_ANY;
877 	rip_inshash(inp);
878 	INP_HASH_WUNLOCK(pcbinfo);
879 	SOCK_LOCK(so);
880 	so->so_state &= ~SS_ISCONNECTED;
881 	SOCK_UNLOCK(so);
882 	INP_WUNLOCK(inp);
883 }
884 
885 static void
886 rip_abort(struct socket *so)
887 {
888 	struct inpcb *inp;
889 
890 	inp = sotoinpcb(so);
891 	KASSERT(inp != NULL, ("rip_abort: inp == NULL"));
892 
893 	rip_dodisconnect(so, inp);
894 }
895 
896 static void
897 rip_close(struct socket *so)
898 {
899 	struct inpcb *inp;
900 
901 	inp = sotoinpcb(so);
902 	KASSERT(inp != NULL, ("rip_close: inp == NULL"));
903 
904 	rip_dodisconnect(so, inp);
905 }
906 
907 static int
908 rip_disconnect(struct socket *so)
909 {
910 	struct inpcb *inp;
911 
912 	if ((so->so_state & SS_ISCONNECTED) == 0)
913 		return (ENOTCONN);
914 
915 	inp = sotoinpcb(so);
916 	KASSERT(inp != NULL, ("rip_disconnect: inp == NULL"));
917 
918 	rip_dodisconnect(so, inp);
919 	return (0);
920 }
921 
922 static int
923 rip_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
924 {
925 	struct sockaddr_in *addr = (struct sockaddr_in *)nam;
926 	struct inpcb *inp;
927 	int error;
928 
929 	if (nam->sa_family != AF_INET)
930 		return (EAFNOSUPPORT);
931 	if (nam->sa_len != sizeof(*addr))
932 		return (EINVAL);
933 
934 	error = prison_check_ip4(td->td_ucred, &addr->sin_addr);
935 	if (error != 0)
936 		return (error);
937 
938 	inp = sotoinpcb(so);
939 	KASSERT(inp != NULL, ("rip_bind: inp == NULL"));
940 
941 	if (CK_STAILQ_EMPTY(&V_ifnet) ||
942 	    (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) ||
943 	    (addr->sin_addr.s_addr &&
944 	     (inp->inp_flags & INP_BINDANY) == 0 &&
945 	     ifa_ifwithaddr_check((struct sockaddr *)addr) == 0))
946 		return (EADDRNOTAVAIL);
947 
948 	INP_WLOCK(inp);
949 	INP_HASH_WLOCK(&V_ripcbinfo);
950 	rip_delhash(inp);
951 	inp->inp_laddr = addr->sin_addr;
952 	rip_inshash(inp);
953 	INP_HASH_WUNLOCK(&V_ripcbinfo);
954 	INP_WUNLOCK(inp);
955 	return (0);
956 }
957 
958 static int
959 rip_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
960 {
961 	struct sockaddr_in *addr = (struct sockaddr_in *)nam;
962 	struct inpcb *inp;
963 
964 	if (nam->sa_len != sizeof(*addr))
965 		return (EINVAL);
966 	if (CK_STAILQ_EMPTY(&V_ifnet))
967 		return (EADDRNOTAVAIL);
968 	if (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK)
969 		return (EAFNOSUPPORT);
970 
971 	inp = sotoinpcb(so);
972 	KASSERT(inp != NULL, ("rip_connect: inp == NULL"));
973 
974 	INP_WLOCK(inp);
975 	INP_HASH_WLOCK(&V_ripcbinfo);
976 	rip_delhash(inp);
977 	inp->inp_faddr = addr->sin_addr;
978 	rip_inshash(inp);
979 	INP_HASH_WUNLOCK(&V_ripcbinfo);
980 	soisconnected(so);
981 	INP_WUNLOCK(inp);
982 	return (0);
983 }
984 
985 static int
986 rip_shutdown(struct socket *so)
987 {
988 	struct inpcb *inp;
989 
990 	inp = sotoinpcb(so);
991 	KASSERT(inp != NULL, ("rip_shutdown: inp == NULL"));
992 
993 	INP_WLOCK(inp);
994 	socantsendmore(so);
995 	INP_WUNLOCK(inp);
996 	return (0);
997 }
998 #endif /* INET */
999 
1000 static int
1001 rip_pcblist(SYSCTL_HANDLER_ARGS)
1002 {
1003 	struct inpcb_iterator inpi = INP_ALL_ITERATOR(&V_ripcbinfo,
1004 	    INPLOOKUP_RLOCKPCB);
1005 	struct xinpgen xig;
1006 	struct inpcb *inp;
1007 	int error;
1008 
1009 	if (req->newptr != 0)
1010 		return (EPERM);
1011 
1012 	if (req->oldptr == 0) {
1013 		int n;
1014 
1015 		n = V_ripcbinfo.ipi_count;
1016 		n += imax(n / 8, 10);
1017 		req->oldidx = 2 * (sizeof xig) + n * sizeof(struct xinpcb);
1018 		return (0);
1019 	}
1020 
1021 	if ((error = sysctl_wire_old_buffer(req, 0)) != 0)
1022 		return (error);
1023 
1024 	bzero(&xig, sizeof(xig));
1025 	xig.xig_len = sizeof xig;
1026 	xig.xig_count = V_ripcbinfo.ipi_count;
1027 	xig.xig_gen = V_ripcbinfo.ipi_gencnt;
1028 	xig.xig_sogen = so_gencnt;
1029 	error = SYSCTL_OUT(req, &xig, sizeof xig);
1030 	if (error)
1031 		return (error);
1032 
1033 	while ((inp = inp_next(&inpi)) != NULL) {
1034 		if (inp->inp_gencnt <= xig.xig_gen &&
1035 		    cr_canseeinpcb(req->td->td_ucred, inp) == 0) {
1036 			struct xinpcb xi;
1037 
1038 			in_pcbtoxinpcb(inp, &xi);
1039 			error = SYSCTL_OUT(req, &xi, sizeof xi);
1040 			if (error) {
1041 				INP_RUNLOCK(inp);
1042 				break;
1043 			}
1044 		}
1045 	}
1046 
1047 	if (!error) {
1048 		/*
1049 		 * Give the user an updated idea of our state.  If the
1050 		 * generation differs from what we told her before, she knows
1051 		 * that something happened while we were processing this
1052 		 * request, and it might be necessary to retry.
1053 		 */
1054 		xig.xig_gen = V_ripcbinfo.ipi_gencnt;
1055 		xig.xig_sogen = so_gencnt;
1056 		xig.xig_count = V_ripcbinfo.ipi_count;
1057 		error = SYSCTL_OUT(req, &xig, sizeof xig);
1058 	}
1059 
1060 	return (error);
1061 }
1062 
1063 SYSCTL_PROC(_net_inet_raw, OID_AUTO/*XXX*/, pcblist,
1064     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0,
1065     rip_pcblist, "S,xinpcb",
1066     "List of active raw IP sockets");
1067 
1068 #ifdef INET
1069 struct protosw rip_protosw = {
1070 	.pr_type =		SOCK_RAW,
1071 	.pr_flags =		PR_ATOMIC|PR_ADDR,
1072 	.pr_ctloutput =		rip_ctloutput,
1073 	.pr_abort =		rip_abort,
1074 	.pr_attach =		rip_attach,
1075 	.pr_bind =		rip_bind,
1076 	.pr_connect =		rip_connect,
1077 	.pr_control =		in_control,
1078 	.pr_detach =		rip_detach,
1079 	.pr_disconnect =	rip_disconnect,
1080 	.pr_peeraddr =		in_getpeeraddr,
1081 	.pr_send =		rip_send,
1082 	.pr_shutdown =		rip_shutdown,
1083 	.pr_sockaddr =		in_getsockaddr,
1084 	.pr_sosetlabel =	in_pcbsosetlabel,
1085 	.pr_close =		rip_close
1086 };
1087 #endif /* INET */
1088