xref: /freebsd/sys/netinet/raw_ip.c (revision 2546665afcaf0d53dc2c7058fee96354b3680f5a)
1 /*
2  * Copyright (c) 1982, 1986, 1988, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)raw_ip.c	8.7 (Berkeley) 5/15/95
30  * $FreeBSD$
31  */
32 
33 #include "opt_inet6.h"
34 #include "opt_ipsec.h"
35 #include "opt_mac.h"
36 #include "opt_random_ip_id.h"
37 
38 #include <sys/param.h>
39 #include <sys/jail.h>
40 #include <sys/kernel.h>
41 #include <sys/lock.h>
42 #include <sys/mac.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/proc.h>
46 #include <sys/protosw.h>
47 #include <sys/signalvar.h>
48 #include <sys/socket.h>
49 #include <sys/socketvar.h>
50 #include <sys/sx.h>
51 #include <sys/sysctl.h>
52 #include <sys/systm.h>
53 
54 #include <vm/uma.h>
55 
56 #include <net/if.h>
57 #include <net/route.h>
58 
59 #include <netinet/in.h>
60 #include <netinet/in_systm.h>
61 #include <netinet/in_pcb.h>
62 #include <netinet/in_var.h>
63 #include <netinet/ip.h>
64 #include <netinet/ip_var.h>
65 #include <netinet/ip_mroute.h>
66 
67 #include <netinet/ip_fw.h>
68 #include <netinet/ip_dummynet.h>
69 
70 #ifdef FAST_IPSEC
71 #include <netipsec/ipsec.h>
72 #endif /*FAST_IPSEC*/
73 
74 #ifdef IPSEC
75 #include <netinet6/ipsec.h>
76 #endif /*IPSEC*/
77 
78 struct	inpcbhead ripcb;
79 struct	inpcbinfo ripcbinfo;
80 
81 /* control hooks for ipfw and dummynet */
82 ip_fw_ctl_t *ip_fw_ctl_ptr;
83 ip_dn_ctl_t *ip_dn_ctl_ptr;
84 
85 /*
86  * hooks for multicast routing. They all default to NULL,
87  * so leave them not initialized and rely on BSS being set to 0.
88  */
89 
90 /* The socket used to communicate with the multicast routing daemon.  */
91 struct socket  *ip_mrouter;
92 
93 /* The various mrouter and rsvp functions */
94 int (*ip_mrouter_set)(struct socket *, struct sockopt *);
95 int (*ip_mrouter_get)(struct socket *, struct sockopt *);
96 int (*ip_mrouter_done)(void);
97 int (*ip_mforward)(struct ip *, struct ifnet *, struct mbuf *,
98                    struct ip_moptions *);
99 int (*mrt_ioctl)(int, caddr_t);
100 int (*legal_vif_num)(int);
101 u_long (*ip_mcast_src)(int);
102 
103 void (*rsvp_input_p)(struct mbuf *m, int off);
104 int (*ip_rsvp_vif)(struct socket *, struct sockopt *);
105 void (*ip_rsvp_force_done)(struct socket *);
106 
107 /*
108  * Nominal space allocated to a raw ip socket.
109  */
110 #define	RIPSNDQ		8192
111 #define	RIPRCVQ		8192
112 
113 /*
114  * Raw interface to IP protocol.
115  */
116 
117 /*
118  * Initialize raw connection block q.
119  */
120 void
121 rip_init()
122 {
123 	INP_INFO_LOCK_INIT(&ripcbinfo, "rip");
124 	LIST_INIT(&ripcb);
125 	ripcbinfo.listhead = &ripcb;
126 	/*
127 	 * XXX We don't use the hash list for raw IP, but it's easier
128 	 * to allocate a one entry hash list than it is to check all
129 	 * over the place for hashbase == NULL.
130 	 */
131 	ripcbinfo.hashbase = hashinit(1, M_PCB, &ripcbinfo.hashmask);
132 	ripcbinfo.porthashbase = hashinit(1, M_PCB, &ripcbinfo.porthashmask);
133 	ripcbinfo.ipi_zone = uma_zcreate("ripcb", sizeof(struct inpcb),
134 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
135 	uma_zone_set_max(ripcbinfo.ipi_zone, maxsockets);
136 }
137 
138 static struct	sockaddr_in ripsrc = { sizeof(ripsrc), AF_INET };
139 
140 static int
141 raw_append(struct inpcb *last, struct ip *ip, struct mbuf *n)
142 {
143 	int policyfail = 0;
144 
145 	INP_LOCK_ASSERT(last);
146 
147 #if defined(IPSEC) || defined(FAST_IPSEC)
148 	/* check AH/ESP integrity. */
149 	if (ipsec4_in_reject(n, last)) {
150 		policyfail = 1;
151 #ifdef IPSEC
152 		ipsecstat.in_polvio++;
153 #endif /*IPSEC*/
154 		/* do not inject data to pcb */
155 	}
156 #endif /*IPSEC || FAST_IPSEC*/
157 #ifdef MAC
158 	if (!policyfail && mac_check_inpcb_deliver(last, n) != 0)
159 		policyfail = 1;
160 #endif
161 	if (!policyfail) {
162 		struct mbuf *opts = NULL;
163 		struct socket *so;
164 
165 		so = last->inp_socket;
166 		if ((last->inp_flags & INP_CONTROLOPTS) ||
167 		    (so->so_options & SO_TIMESTAMP))
168 			ip_savecontrol(last, &opts, ip, n);
169 		SOCKBUF_LOCK(&so->so_rcv);
170 		if (sbappendaddr_locked(&so->so_rcv,
171 		    (struct sockaddr *)&ripsrc, n, opts) == 0) {
172 			/* should notify about lost packet */
173 			m_freem(n);
174 			if (opts)
175 				m_freem(opts);
176 			SOCKBUF_UNLOCK(&so->so_rcv);
177 		} else
178 			sorwakeup_locked(so);
179 	} else
180 		m_freem(n);
181 	return policyfail;
182 }
183 
184 /*
185  * Setup generic address and protocol structures
186  * for raw_input routine, then pass them along with
187  * mbuf chain.
188  */
189 void
190 rip_input(struct mbuf *m, int off)
191 {
192 	struct ip *ip = mtod(m, struct ip *);
193 	int proto = ip->ip_p;
194 	struct inpcb *inp, *last;
195 
196 	INP_INFO_RLOCK(&ripcbinfo);
197 	ripsrc.sin_addr = ip->ip_src;
198 	last = NULL;
199 	LIST_FOREACH(inp, &ripcb, inp_list) {
200 		INP_LOCK(inp);
201 		if (inp->inp_ip_p && inp->inp_ip_p != proto) {
202 	docontinue:
203 			INP_UNLOCK(inp);
204 			continue;
205 		}
206 #ifdef INET6
207 		if ((inp->inp_vflag & INP_IPV4) == 0)
208 			goto docontinue;
209 #endif
210 		if (inp->inp_laddr.s_addr &&
211                     inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
212 			goto docontinue;
213 		if (inp->inp_faddr.s_addr &&
214                     inp->inp_faddr.s_addr != ip->ip_src.s_addr)
215 			goto docontinue;
216 		if (jailed(inp->inp_socket->so_cred))
217 			if (htonl(prison_getip(inp->inp_socket->so_cred)) !=
218 			    ip->ip_dst.s_addr)
219 				goto docontinue;
220 		if (last) {
221 			struct mbuf *n;
222 
223 			n = m_copy(m, 0, (int)M_COPYALL);
224 			if (n != NULL)
225 				(void) raw_append(last, ip, n);
226 			/* XXX count dropped packet */
227 			INP_UNLOCK(last);
228 		}
229 		last = inp;
230 	}
231 	if (last != NULL) {
232 		if (raw_append(last, ip, m) != 0)
233 			ipstat.ips_delivered--;
234 		INP_UNLOCK(last);
235 	} else {
236 		m_freem(m);
237 		ipstat.ips_noproto++;
238 		ipstat.ips_delivered--;
239 	}
240 	INP_INFO_RUNLOCK(&ripcbinfo);
241 }
242 
243 /*
244  * Generate IP header and pass packet to ip_output.
245  * Tack on options user may have setup with control call.
246  */
247 int
248 rip_output(struct mbuf *m, struct socket *so, u_long dst)
249 {
250 	struct ip *ip;
251 	int error;
252 	struct inpcb *inp = sotoinpcb(so);
253 	int flags = (so->so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
254 
255 	/*
256 	 * If the user handed us a complete IP packet, use it.
257 	 * Otherwise, allocate an mbuf for a header and fill it in.
258 	 */
259 	if ((inp->inp_flags & INP_HDRINCL) == 0) {
260 		if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
261 			m_freem(m);
262 			return(EMSGSIZE);
263 		}
264 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
265 		if (m == NULL)
266 			return(ENOBUFS);
267 
268 		INP_LOCK(inp);
269 		ip = mtod(m, struct ip *);
270 		ip->ip_tos = inp->inp_ip_tos;
271 		ip->ip_off = 0;
272 		ip->ip_p = inp->inp_ip_p;
273 		ip->ip_len = m->m_pkthdr.len;
274 		if (jailed(inp->inp_socket->so_cred))
275 			ip->ip_src.s_addr =
276 			    htonl(prison_getip(inp->inp_socket->so_cred));
277 		else
278 			ip->ip_src = inp->inp_laddr;
279 		ip->ip_dst.s_addr = dst;
280 		ip->ip_ttl = inp->inp_ip_ttl;
281 	} else {
282 		if (m->m_pkthdr.len > IP_MAXPACKET) {
283 			m_freem(m);
284 			return(EMSGSIZE);
285 		}
286 		INP_LOCK(inp);
287 		ip = mtod(m, struct ip *);
288 		if (jailed(inp->inp_socket->so_cred)) {
289 			if (ip->ip_src.s_addr !=
290 			    htonl(prison_getip(inp->inp_socket->so_cred))) {
291 				INP_UNLOCK(inp);
292 				m_freem(m);
293 				return (EPERM);
294 			}
295 		}
296 		/* don't allow both user specified and setsockopt options,
297 		   and don't allow packet length sizes that will crash */
298 		if (((ip->ip_hl != (sizeof (*ip) >> 2))
299 		     && inp->inp_options)
300 		    || (ip->ip_len > m->m_pkthdr.len)
301 		    || (ip->ip_len < (ip->ip_hl << 2))) {
302 			INP_UNLOCK(inp);
303 			m_freem(m);
304 			return EINVAL;
305 		}
306 		if (ip->ip_id == 0)
307 #ifdef RANDOM_IP_ID
308 			ip->ip_id = ip_randomid();
309 #else
310 			ip->ip_id = htons(ip_id++);
311 #endif
312 		/* XXX prevent ip_output from overwriting header fields */
313 		flags |= IP_RAWOUTPUT;
314 		ipstat.ips_rawout++;
315 	}
316 
317 	if (inp->inp_flags & INP_ONESBCAST)
318 		flags |= IP_SENDONES;
319 
320 #ifdef MAC
321 	mac_create_mbuf_from_inpcb(inp, m);
322 #endif
323 
324 	error = ip_output(m, inp->inp_options, NULL, flags,
325 	    inp->inp_moptions, inp);
326 	INP_UNLOCK(inp);
327 	return error;
328 }
329 
330 /*
331  * Raw IP socket option processing.
332  *
333  * Note that access to all of the IP administrative functions here is
334  * implicitly protected by suser() as gaining access to a raw socket
335  * requires either that the thread pass a suser() check, or that it be
336  * passed a raw socket by another thread that has passed a suser() check.
337  * If FreeBSD moves to a more fine-grained access control mechanism,
338  * additional checks will need to be placed here if the raw IP attachment
339  * check is not equivilent the the check required for these
340  * administrative operations; in some cases, these checks are already
341  * present.
342  */
343 int
344 rip_ctloutput(struct socket *so, struct sockopt *sopt)
345 {
346 	struct	inpcb *inp = sotoinpcb(so);
347 	int	error, optval;
348 
349 	if (sopt->sopt_level != IPPROTO_IP)
350 		return (EINVAL);
351 
352 	error = 0;
353 
354 	switch (sopt->sopt_dir) {
355 	case SOPT_GET:
356 		switch (sopt->sopt_name) {
357 		case IP_HDRINCL:
358 			optval = inp->inp_flags & INP_HDRINCL;
359 			error = sooptcopyout(sopt, &optval, sizeof optval);
360 			break;
361 
362 		case IP_FW_ADD:	/* ADD actually returns the body... */
363 		case IP_FW_GET:
364 		case IP_FW_TABLE_GETSIZE:
365 		case IP_FW_TABLE_LIST:
366 			if (IPFW_LOADED)
367 				error = ip_fw_ctl_ptr(sopt);
368 			else
369 				error = ENOPROTOOPT;
370 			break;
371 
372 		case IP_DUMMYNET_GET:
373 			if (DUMMYNET_LOADED)
374 				error = ip_dn_ctl_ptr(sopt);
375 			else
376 				error = ENOPROTOOPT;
377 			break ;
378 
379 		case MRT_INIT:
380 		case MRT_DONE:
381 		case MRT_ADD_VIF:
382 		case MRT_DEL_VIF:
383 		case MRT_ADD_MFC:
384 		case MRT_DEL_MFC:
385 		case MRT_VERSION:
386 		case MRT_ASSERT:
387 		case MRT_API_SUPPORT:
388 		case MRT_API_CONFIG:
389 		case MRT_ADD_BW_UPCALL:
390 		case MRT_DEL_BW_UPCALL:
391 			error = ip_mrouter_get ? ip_mrouter_get(so, sopt) :
392 				EOPNOTSUPP;
393 			break;
394 
395 		default:
396 			error = ip_ctloutput(so, sopt);
397 			break;
398 		}
399 		break;
400 
401 	case SOPT_SET:
402 		switch (sopt->sopt_name) {
403 		case IP_HDRINCL:
404 			error = sooptcopyin(sopt, &optval, sizeof optval,
405 					    sizeof optval);
406 			if (error)
407 				break;
408 			if (optval)
409 				inp->inp_flags |= INP_HDRINCL;
410 			else
411 				inp->inp_flags &= ~INP_HDRINCL;
412 			break;
413 
414 		case IP_FW_ADD:
415 		case IP_FW_DEL:
416 		case IP_FW_FLUSH:
417 		case IP_FW_ZERO:
418 		case IP_FW_RESETLOG:
419 		case IP_FW_TABLE_ADD:
420 		case IP_FW_TABLE_DEL:
421 		case IP_FW_TABLE_FLUSH:
422 			if (IPFW_LOADED)
423 				error = ip_fw_ctl_ptr(sopt);
424 			else
425 				error = ENOPROTOOPT;
426 			break;
427 
428 		case IP_DUMMYNET_CONFIGURE:
429 		case IP_DUMMYNET_DEL:
430 		case IP_DUMMYNET_FLUSH:
431 			if (DUMMYNET_LOADED)
432 				error = ip_dn_ctl_ptr(sopt);
433 			else
434 				error = ENOPROTOOPT ;
435 			break ;
436 
437 		case IP_RSVP_ON:
438 			error = ip_rsvp_init(so);
439 			break;
440 
441 		case IP_RSVP_OFF:
442 			error = ip_rsvp_done();
443 			break;
444 
445 		case IP_RSVP_VIF_ON:
446 		case IP_RSVP_VIF_OFF:
447 			error = ip_rsvp_vif ?
448 				ip_rsvp_vif(so, sopt) : EINVAL;
449 			break;
450 
451 		case MRT_INIT:
452 		case MRT_DONE:
453 		case MRT_ADD_VIF:
454 		case MRT_DEL_VIF:
455 		case MRT_ADD_MFC:
456 		case MRT_DEL_MFC:
457 		case MRT_VERSION:
458 		case MRT_ASSERT:
459 		case MRT_API_SUPPORT:
460 		case MRT_API_CONFIG:
461 		case MRT_ADD_BW_UPCALL:
462 		case MRT_DEL_BW_UPCALL:
463 			error = ip_mrouter_set ? ip_mrouter_set(so, sopt) :
464 					EOPNOTSUPP;
465 			break;
466 
467 		default:
468 			error = ip_ctloutput(so, sopt);
469 			break;
470 		}
471 		break;
472 	}
473 
474 	return (error);
475 }
476 
477 /*
478  * This function exists solely to receive the PRC_IFDOWN messages which
479  * are sent by if_down().  It looks for an ifaddr whose ifa_addr is sa,
480  * and calls in_ifadown() to remove all routes corresponding to that address.
481  * It also receives the PRC_IFUP messages from if_up() and reinstalls the
482  * interface routes.
483  */
484 void
485 rip_ctlinput(int cmd, struct sockaddr *sa, void *vip)
486 {
487 	struct in_ifaddr *ia;
488 	struct ifnet *ifp;
489 	int err;
490 	int flags;
491 
492 	switch (cmd) {
493 	case PRC_IFDOWN:
494 		TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
495 			if (ia->ia_ifa.ifa_addr == sa
496 			    && (ia->ia_flags & IFA_ROUTE)) {
497 				/*
498 				 * in_ifscrub kills the interface route.
499 				 */
500 				in_ifscrub(ia->ia_ifp, ia);
501 				/*
502 				 * in_ifadown gets rid of all the rest of
503 				 * the routes.  This is not quite the right
504 				 * thing to do, but at least if we are running
505 				 * a routing process they will come back.
506 				 */
507 				in_ifadown(&ia->ia_ifa, 0);
508 				break;
509 			}
510 		}
511 		break;
512 
513 	case PRC_IFUP:
514 		TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
515 			if (ia->ia_ifa.ifa_addr == sa)
516 				break;
517 		}
518 		if (ia == 0 || (ia->ia_flags & IFA_ROUTE))
519 			return;
520 		flags = RTF_UP;
521 		ifp = ia->ia_ifa.ifa_ifp;
522 
523 		if ((ifp->if_flags & IFF_LOOPBACK)
524 		    || (ifp->if_flags & IFF_POINTOPOINT))
525 			flags |= RTF_HOST;
526 
527 		err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
528 		if (err == 0)
529 			ia->ia_flags |= IFA_ROUTE;
530 		break;
531 	}
532 }
533 
534 u_long	rip_sendspace = RIPSNDQ;
535 u_long	rip_recvspace = RIPRCVQ;
536 
537 SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW,
538     &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
539 SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW,
540     &rip_recvspace, 0, "Maximum space for incoming raw IP datagrams");
541 
542 static int
543 rip_attach(struct socket *so, int proto, struct thread *td)
544 {
545 	struct inpcb *inp;
546 	int error;
547 
548 	/* XXX why not lower? */
549 	INP_INFO_WLOCK(&ripcbinfo);
550 	inp = sotoinpcb(so);
551 	if (inp) {
552 		/* XXX counter, printf */
553 		INP_INFO_WUNLOCK(&ripcbinfo);
554 		return EINVAL;
555 	}
556 	if (td && jailed(td->td_ucred) && !jail_allow_raw_sockets) {
557 		INP_INFO_WUNLOCK(&ripcbinfo);
558 		return (EPERM);
559 	}
560 	if (td && (error = suser_cred(td->td_ucred, SUSER_ALLOWJAIL)) != 0) {
561 		INP_INFO_WUNLOCK(&ripcbinfo);
562 		return error;
563 	}
564 	if (proto >= IPPROTO_MAX || proto < 0) {
565 		INP_INFO_WUNLOCK(&ripcbinfo);
566 		return EPROTONOSUPPORT;
567 	}
568 
569 	error = soreserve(so, rip_sendspace, rip_recvspace);
570 	if (error) {
571 		INP_INFO_WUNLOCK(&ripcbinfo);
572 		return error;
573 	}
574 	error = in_pcballoc(so, &ripcbinfo, "rawinp");
575 	if (error) {
576 		INP_INFO_WUNLOCK(&ripcbinfo);
577 		return error;
578 	}
579 	inp = (struct inpcb *)so->so_pcb;
580 	INP_LOCK(inp);
581 	INP_INFO_WUNLOCK(&ripcbinfo);
582 	inp->inp_vflag |= INP_IPV4;
583 	inp->inp_ip_p = proto;
584 	inp->inp_ip_ttl = ip_defttl;
585 	INP_UNLOCK(inp);
586 	return 0;
587 }
588 
589 static void
590 rip_pcbdetach(struct socket *so, struct inpcb *inp)
591 {
592 	INP_INFO_WLOCK_ASSERT(&ripcbinfo);
593 	INP_LOCK_ASSERT(inp);
594 
595 	if (so == ip_mrouter && ip_mrouter_done)
596 		ip_mrouter_done();
597 	if (ip_rsvp_force_done)
598 		ip_rsvp_force_done(so);
599 	if (so == ip_rsvpd)
600 		ip_rsvp_done();
601 	in_pcbdetach(inp);
602 }
603 
604 static int
605 rip_detach(struct socket *so)
606 {
607 	struct inpcb *inp;
608 
609 	INP_INFO_WLOCK(&ripcbinfo);
610 	inp = sotoinpcb(so);
611 	if (inp == 0) {
612 		/* XXX counter, printf */
613 		INP_INFO_WUNLOCK(&ripcbinfo);
614 		return EINVAL;
615 	}
616 	INP_LOCK(inp);
617 	rip_pcbdetach(so, inp);
618 	INP_INFO_WUNLOCK(&ripcbinfo);
619 	return 0;
620 }
621 
622 static int
623 rip_abort(struct socket *so)
624 {
625 	struct inpcb *inp;
626 
627 	INP_INFO_WLOCK(&ripcbinfo);
628 	inp = sotoinpcb(so);
629 	if (inp == 0) {
630 		INP_INFO_WUNLOCK(&ripcbinfo);
631 		return EINVAL;	/* ??? possible? panic instead? */
632 	}
633 	INP_LOCK(inp);
634 	soisdisconnected(so);
635 	if (so->so_state & SS_NOFDREF)
636 		rip_pcbdetach(so, inp);
637 	else
638 		INP_UNLOCK(inp);
639 	INP_INFO_WUNLOCK(&ripcbinfo);
640 	return 0;
641 }
642 
643 static int
644 rip_disconnect(struct socket *so)
645 {
646 	if ((so->so_state & SS_ISCONNECTED) == 0)
647 		return ENOTCONN;
648 	return rip_abort(so);
649 }
650 
651 static int
652 rip_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
653 {
654 	struct sockaddr_in *addr = (struct sockaddr_in *)nam;
655 	struct inpcb *inp;
656 
657 	if (nam->sa_len != sizeof(*addr))
658 		return EINVAL;
659 
660 	if (jailed(td->td_ucred)) {
661 		if (addr->sin_addr.s_addr == INADDR_ANY)
662 			addr->sin_addr.s_addr =
663 			    htonl(prison_getip(td->td_ucred));
664 		if (htonl(prison_getip(td->td_ucred)) != addr->sin_addr.s_addr)
665 			return (EADDRNOTAVAIL);
666 	}
667 
668 	if (TAILQ_EMPTY(&ifnet) ||
669 	    (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) ||
670 	    (addr->sin_addr.s_addr &&
671 	     ifa_ifwithaddr((struct sockaddr *)addr) == 0))
672 		return EADDRNOTAVAIL;
673 
674 	INP_INFO_WLOCK(&ripcbinfo);
675 	inp = sotoinpcb(so);
676 	if (inp == 0) {
677 		INP_INFO_WUNLOCK(&ripcbinfo);
678 		return EINVAL;
679 	}
680 	INP_LOCK(inp);
681 	inp->inp_laddr = addr->sin_addr;
682 	INP_UNLOCK(inp);
683 	INP_INFO_WUNLOCK(&ripcbinfo);
684 	return 0;
685 }
686 
687 static int
688 rip_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
689 {
690 	struct sockaddr_in *addr = (struct sockaddr_in *)nam;
691 	struct inpcb *inp;
692 
693 	if (nam->sa_len != sizeof(*addr))
694 		return EINVAL;
695 	if (TAILQ_EMPTY(&ifnet))
696 		return EADDRNOTAVAIL;
697 	if (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK)
698 		return EAFNOSUPPORT;
699 
700 	INP_INFO_WLOCK(&ripcbinfo);
701 	inp = sotoinpcb(so);
702 	if (inp == 0) {
703 		INP_INFO_WUNLOCK(&ripcbinfo);
704 		return EINVAL;
705 	}
706 	INP_LOCK(inp);
707 	inp->inp_faddr = addr->sin_addr;
708 	soisconnected(so);
709 	INP_UNLOCK(inp);
710 	INP_INFO_WUNLOCK(&ripcbinfo);
711 	return 0;
712 }
713 
714 static int
715 rip_shutdown(struct socket *so)
716 {
717 	struct inpcb *inp;
718 
719 	INP_INFO_RLOCK(&ripcbinfo);
720 	inp = sotoinpcb(so);
721 	if (inp == 0) {
722 		INP_INFO_RUNLOCK(&ripcbinfo);
723 		return EINVAL;
724 	}
725 	INP_LOCK(inp);
726 	INP_INFO_RUNLOCK(&ripcbinfo);
727 	socantsendmore(so);
728 	INP_UNLOCK(inp);
729 	return 0;
730 }
731 
732 static int
733 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
734 	 struct mbuf *control, struct thread *td)
735 {
736 	struct inpcb *inp;
737 	u_long dst;
738 	int ret;
739 
740 	INP_INFO_WLOCK(&ripcbinfo);
741 	inp = sotoinpcb(so);
742 	if (so->so_state & SS_ISCONNECTED) {
743 		if (nam) {
744 			INP_INFO_WUNLOCK(&ripcbinfo);
745 			m_freem(m);
746 			return EISCONN;
747 		}
748 		dst = inp->inp_faddr.s_addr;
749 	} else {
750 		if (nam == NULL) {
751 			INP_INFO_WUNLOCK(&ripcbinfo);
752 			m_freem(m);
753 			return ENOTCONN;
754 		}
755 		dst = ((struct sockaddr_in *)nam)->sin_addr.s_addr;
756 	}
757 	ret = rip_output(m, so, dst);
758 	INP_INFO_WUNLOCK(&ripcbinfo);
759 	return ret;
760 }
761 
762 static int
763 rip_pcblist(SYSCTL_HANDLER_ARGS)
764 {
765 	int error, i, n;
766 	struct inpcb *inp, **inp_list;
767 	inp_gen_t gencnt;
768 	struct xinpgen xig;
769 
770 	/*
771 	 * The process of preparing the TCB list is too time-consuming and
772 	 * resource-intensive to repeat twice on every request.
773 	 */
774 	if (req->oldptr == 0) {
775 		n = ripcbinfo.ipi_count;
776 		req->oldidx = 2 * (sizeof xig)
777 			+ (n + n/8) * sizeof(struct xinpcb);
778 		return 0;
779 	}
780 
781 	if (req->newptr != 0)
782 		return EPERM;
783 
784 	/*
785 	 * OK, now we're committed to doing something.
786 	 */
787 	INP_INFO_RLOCK(&ripcbinfo);
788 	gencnt = ripcbinfo.ipi_gencnt;
789 	n = ripcbinfo.ipi_count;
790 	INP_INFO_RUNLOCK(&ripcbinfo);
791 
792 	xig.xig_len = sizeof xig;
793 	xig.xig_count = n;
794 	xig.xig_gen = gencnt;
795 	xig.xig_sogen = so_gencnt;
796 	error = SYSCTL_OUT(req, &xig, sizeof xig);
797 	if (error)
798 		return error;
799 
800 	inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
801 	if (inp_list == 0)
802 		return ENOMEM;
803 
804 	INP_INFO_RLOCK(&ripcbinfo);
805 	for (inp = LIST_FIRST(ripcbinfo.listhead), i = 0; inp && i < n;
806 	     inp = LIST_NEXT(inp, inp_list)) {
807 		INP_LOCK(inp);
808 		if (inp->inp_gencnt <= gencnt &&
809 		    cr_canseesocket(req->td->td_ucred, inp->inp_socket) == 0) {
810 			/* XXX held references? */
811 			inp_list[i++] = inp;
812 		}
813 		INP_UNLOCK(inp);
814 	}
815 	INP_INFO_RUNLOCK(&ripcbinfo);
816 	n = i;
817 
818 	error = 0;
819 	for (i = 0; i < n; i++) {
820 		inp = inp_list[i];
821 		if (inp->inp_gencnt <= gencnt) {
822 			struct xinpcb xi;
823 			xi.xi_len = sizeof xi;
824 			/* XXX should avoid extra copy */
825 			bcopy(inp, &xi.xi_inp, sizeof *inp);
826 			if (inp->inp_socket)
827 				sotoxsocket(inp->inp_socket, &xi.xi_socket);
828 			error = SYSCTL_OUT(req, &xi, sizeof xi);
829 		}
830 	}
831 	if (!error) {
832 		/*
833 		 * Give the user an updated idea of our state.
834 		 * If the generation differs from what we told
835 		 * her before, she knows that something happened
836 		 * while we were processing this request, and it
837 		 * might be necessary to retry.
838 		 */
839 		INP_INFO_RLOCK(&ripcbinfo);
840 		xig.xig_gen = ripcbinfo.ipi_gencnt;
841 		xig.xig_sogen = so_gencnt;
842 		xig.xig_count = ripcbinfo.ipi_count;
843 		INP_INFO_RUNLOCK(&ripcbinfo);
844 		error = SYSCTL_OUT(req, &xig, sizeof xig);
845 	}
846 	free(inp_list, M_TEMP);
847 	return error;
848 }
849 
850 /*
851  * This is the wrapper function for in_setsockaddr.  We just pass down
852  * the pcbinfo for in_setpeeraddr to lock.
853  */
854 static int
855 rip_sockaddr(struct socket *so, struct sockaddr **nam)
856 {
857 	return (in_setsockaddr(so, nam, &ripcbinfo));
858 }
859 
860 /*
861  * This is the wrapper function for in_setpeeraddr.  We just pass down
862  * the pcbinfo for in_setpeeraddr to lock.
863  */
864 static int
865 rip_peeraddr(struct socket *so, struct sockaddr **nam)
866 {
867 	return (in_setpeeraddr(so, nam, &ripcbinfo));
868 }
869 
870 
871 SYSCTL_PROC(_net_inet_raw, OID_AUTO/*XXX*/, pcblist, CTLFLAG_RD, 0, 0,
872 	    rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
873 
874 struct pr_usrreqs rip_usrreqs = {
875 	rip_abort, pru_accept_notsupp, rip_attach, rip_bind, rip_connect,
876 	pru_connect2_notsupp, in_control, rip_detach, rip_disconnect,
877 	pru_listen_notsupp, rip_peeraddr, pru_rcvd_notsupp,
878 	pru_rcvoob_notsupp, rip_send, pru_sense_null, rip_shutdown,
879 	rip_sockaddr, sosend, soreceive, sopoll, in_pcbsosetlabel
880 };
881