xref: /freebsd/sys/netinet/raw_ip.c (revision 91c878a6935c5c2e99866eb267e5bc3028bf6d2f)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)raw_ip.c	8.7 (Berkeley) 5/15/95
30  * $FreeBSD$
31  */
32 
33 #include "opt_inet6.h"
34 #include "opt_ipsec.h"
35 #include "opt_mac.h"
36 
37 #include <sys/param.h>
38 #include <sys/jail.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/malloc.h>
42 #include <sys/mbuf.h>
43 #include <sys/proc.h>
44 #include <sys/protosw.h>
45 #include <sys/signalvar.h>
46 #include <sys/socket.h>
47 #include <sys/socketvar.h>
48 #include <sys/sx.h>
49 #include <sys/sysctl.h>
50 #include <sys/systm.h>
51 
52 #include <vm/uma.h>
53 
54 #include <net/if.h>
55 #include <net/route.h>
56 
57 #include <netinet/in.h>
58 #include <netinet/in_systm.h>
59 #include <netinet/in_pcb.h>
60 #include <netinet/in_var.h>
61 #include <netinet/ip.h>
62 #include <netinet/ip_var.h>
63 #include <netinet/ip_mroute.h>
64 
65 #include <netinet/ip_fw.h>
66 #include <netinet/ip_dummynet.h>
67 
68 #ifdef FAST_IPSEC
69 #include <netipsec/ipsec.h>
70 #endif /*FAST_IPSEC*/
71 
72 #ifdef IPSEC
73 #include <netinet6/ipsec.h>
74 #endif /*IPSEC*/
75 
76 #include <security/mac/mac_framework.h>
77 
78 struct	inpcbhead ripcb;
79 struct	inpcbinfo ripcbinfo;
80 
81 /* control hooks for ipfw and dummynet */
82 ip_fw_ctl_t *ip_fw_ctl_ptr = NULL;
83 ip_dn_ctl_t *ip_dn_ctl_ptr = NULL;
84 
85 /*
86  * hooks for multicast routing. They all default to NULL,
87  * so leave them not initialized and rely on BSS being set to 0.
88  */
89 
90 /* The socket used to communicate with the multicast routing daemon.  */
91 struct socket  *ip_mrouter;
92 
93 /* The various mrouter and rsvp functions */
94 int (*ip_mrouter_set)(struct socket *, struct sockopt *);
95 int (*ip_mrouter_get)(struct socket *, struct sockopt *);
96 int (*ip_mrouter_done)(void);
97 int (*ip_mforward)(struct ip *, struct ifnet *, struct mbuf *,
98 		   struct ip_moptions *);
99 int (*mrt_ioctl)(int, caddr_t);
100 int (*legal_vif_num)(int);
101 u_long (*ip_mcast_src)(int);
102 
103 void (*rsvp_input_p)(struct mbuf *m, int off);
104 int (*ip_rsvp_vif)(struct socket *, struct sockopt *);
105 void (*ip_rsvp_force_done)(struct socket *);
106 
107 /*
108  * Nominal space allocated to a raw ip socket.
109  */
110 #define	RIPSNDQ		8192
111 #define	RIPRCVQ		8192
112 
113 /*
114  * Raw interface to IP protocol.
115  */
116 
117 /*
118  * Initialize raw connection block q.
119  */
120 static void
121 rip_zone_change(void *tag)
122 {
123 
124 	uma_zone_set_max(ripcbinfo.ipi_zone, maxsockets);
125 }
126 
127 static int
128 rip_inpcb_init(void *mem, int size, int flags)
129 {
130 	struct inpcb *inp = (struct inpcb *) mem;
131 	INP_LOCK_INIT(inp, "inp", "rawinp");
132 	return (0);
133 }
134 
135 void
136 rip_init()
137 {
138 	INP_INFO_LOCK_INIT(&ripcbinfo, "rip");
139 	LIST_INIT(&ripcb);
140 	ripcbinfo.listhead = &ripcb;
141 	/*
142 	 * XXX We don't use the hash list for raw IP, but it's easier
143 	 * to allocate a one entry hash list than it is to check all
144 	 * over the place for hashbase == NULL.
145 	 */
146 	ripcbinfo.hashbase = hashinit(1, M_PCB, &ripcbinfo.hashmask);
147 	ripcbinfo.porthashbase = hashinit(1, M_PCB, &ripcbinfo.porthashmask);
148 	ripcbinfo.ipi_zone = uma_zcreate("ripcb", sizeof(struct inpcb),
149 	    NULL, NULL, rip_inpcb_init, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
150 	uma_zone_set_max(ripcbinfo.ipi_zone, maxsockets);
151 	EVENTHANDLER_REGISTER(maxsockets_change, rip_zone_change,
152 		NULL, EVENTHANDLER_PRI_ANY);
153 }
154 
155 static struct	sockaddr_in ripsrc = { sizeof(ripsrc), AF_INET };
156 
157 static int
158 raw_append(struct inpcb *last, struct ip *ip, struct mbuf *n)
159 {
160 	int policyfail = 0;
161 
162 	INP_LOCK_ASSERT(last);
163 
164 #if defined(IPSEC) || defined(FAST_IPSEC)
165 	/* check AH/ESP integrity. */
166 	if (ipsec4_in_reject(n, last)) {
167 		policyfail = 1;
168 #ifdef IPSEC
169 		ipsecstat.in_polvio++;
170 #endif /*IPSEC*/
171 		/* do not inject data to pcb */
172 	}
173 #endif /*IPSEC || FAST_IPSEC*/
174 #ifdef MAC
175 	if (!policyfail && mac_check_inpcb_deliver(last, n) != 0)
176 		policyfail = 1;
177 #endif
178 	/* Check the minimum TTL for socket. */
179 	if (last->inp_ip_minttl && last->inp_ip_minttl > ip->ip_ttl)
180 		policyfail = 1;
181 	if (!policyfail) {
182 		struct mbuf *opts = NULL;
183 		struct socket *so;
184 
185 		so = last->inp_socket;
186 		if ((last->inp_flags & INP_CONTROLOPTS) ||
187 		    (so->so_options & (SO_TIMESTAMP | SO_BINTIME)))
188 			ip_savecontrol(last, &opts, ip, n);
189 		SOCKBUF_LOCK(&so->so_rcv);
190 		if (sbappendaddr_locked(&so->so_rcv,
191 		    (struct sockaddr *)&ripsrc, n, opts) == 0) {
192 			/* should notify about lost packet */
193 			m_freem(n);
194 			if (opts)
195 				m_freem(opts);
196 			SOCKBUF_UNLOCK(&so->so_rcv);
197 		} else
198 			sorwakeup_locked(so);
199 	} else
200 		m_freem(n);
201 	return policyfail;
202 }
203 
204 /*
205  * Setup generic address and protocol structures
206  * for raw_input routine, then pass them along with
207  * mbuf chain.
208  */
209 void
210 rip_input(struct mbuf *m, int off)
211 {
212 	struct ip *ip = mtod(m, struct ip *);
213 	int proto = ip->ip_p;
214 	struct inpcb *inp, *last;
215 
216 	INP_INFO_RLOCK(&ripcbinfo);
217 	ripsrc.sin_addr = ip->ip_src;
218 	last = NULL;
219 	LIST_FOREACH(inp, &ripcb, inp_list) {
220 		INP_LOCK(inp);
221 		if (inp->inp_ip_p && inp->inp_ip_p != proto) {
222 	docontinue:
223 			INP_UNLOCK(inp);
224 			continue;
225 		}
226 #ifdef INET6
227 		if ((inp->inp_vflag & INP_IPV4) == 0)
228 			goto docontinue;
229 #endif
230 		if (inp->inp_laddr.s_addr &&
231 		    inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
232 			goto docontinue;
233 		if (inp->inp_faddr.s_addr &&
234 		    inp->inp_faddr.s_addr != ip->ip_src.s_addr)
235 			goto docontinue;
236 		if (jailed(inp->inp_socket->so_cred))
237 			if (htonl(prison_getip(inp->inp_socket->so_cred)) !=
238 			    ip->ip_dst.s_addr)
239 				goto docontinue;
240 		if (last) {
241 			struct mbuf *n;
242 
243 			n = m_copy(m, 0, (int)M_COPYALL);
244 			if (n != NULL)
245 				(void) raw_append(last, ip, n);
246 			/* XXX count dropped packet */
247 			INP_UNLOCK(last);
248 		}
249 		last = inp;
250 	}
251 	if (last != NULL) {
252 		if (raw_append(last, ip, m) != 0)
253 			ipstat.ips_delivered--;
254 		INP_UNLOCK(last);
255 	} else {
256 		m_freem(m);
257 		ipstat.ips_noproto++;
258 		ipstat.ips_delivered--;
259 	}
260 	INP_INFO_RUNLOCK(&ripcbinfo);
261 }
262 
263 /*
264  * Generate IP header and pass packet to ip_output.
265  * Tack on options user may have setup with control call.
266  */
267 int
268 rip_output(struct mbuf *m, struct socket *so, u_long dst)
269 {
270 	struct ip *ip;
271 	int error;
272 	struct inpcb *inp = sotoinpcb(so);
273 	int flags = ((so->so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0) |
274 	    IP_ALLOWBROADCAST;
275 
276 	/*
277 	 * If the user handed us a complete IP packet, use it.
278 	 * Otherwise, allocate an mbuf for a header and fill it in.
279 	 */
280 	if ((inp->inp_flags & INP_HDRINCL) == 0) {
281 		if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
282 			m_freem(m);
283 			return(EMSGSIZE);
284 		}
285 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
286 		if (m == NULL)
287 			return(ENOBUFS);
288 
289 		INP_LOCK(inp);
290 		ip = mtod(m, struct ip *);
291 		ip->ip_tos = inp->inp_ip_tos;
292 		if (inp->inp_flags & INP_DONTFRAG)
293 			ip->ip_off = IP_DF;
294 		else
295 			ip->ip_off = 0;
296 		ip->ip_p = inp->inp_ip_p;
297 		ip->ip_len = m->m_pkthdr.len;
298 		if (jailed(inp->inp_socket->so_cred))
299 			ip->ip_src.s_addr =
300 			    htonl(prison_getip(inp->inp_socket->so_cred));
301 		else
302 			ip->ip_src = inp->inp_laddr;
303 		ip->ip_dst.s_addr = dst;
304 		ip->ip_ttl = inp->inp_ip_ttl;
305 	} else {
306 		if (m->m_pkthdr.len > IP_MAXPACKET) {
307 			m_freem(m);
308 			return(EMSGSIZE);
309 		}
310 		INP_LOCK(inp);
311 		ip = mtod(m, struct ip *);
312 		if (jailed(inp->inp_socket->so_cred)) {
313 			if (ip->ip_src.s_addr !=
314 			    htonl(prison_getip(inp->inp_socket->so_cred))) {
315 				INP_UNLOCK(inp);
316 				m_freem(m);
317 				return (EPERM);
318 			}
319 		}
320 		/* don't allow both user specified and setsockopt options,
321 		   and don't allow packet length sizes that will crash */
322 		if (((ip->ip_hl != (sizeof (*ip) >> 2))
323 		     && inp->inp_options)
324 		    || (ip->ip_len > m->m_pkthdr.len)
325 		    || (ip->ip_len < (ip->ip_hl << 2))) {
326 			INP_UNLOCK(inp);
327 			m_freem(m);
328 			return EINVAL;
329 		}
330 		if (ip->ip_id == 0)
331 			ip->ip_id = ip_newid();
332 		/* XXX prevent ip_output from overwriting header fields */
333 		flags |= IP_RAWOUTPUT;
334 		ipstat.ips_rawout++;
335 	}
336 
337 	if (inp->inp_flags & INP_ONESBCAST)
338 		flags |= IP_SENDONES;
339 
340 #ifdef MAC
341 	mac_create_mbuf_from_inpcb(inp, m);
342 #endif
343 
344 	error = ip_output(m, inp->inp_options, NULL, flags,
345 	    inp->inp_moptions, inp);
346 	INP_UNLOCK(inp);
347 	return error;
348 }
349 
350 /*
351  * Raw IP socket option processing.
352  *
353  * IMPORTANT NOTE regarding access control: Traditionally, raw sockets could
354  * only be created by a privileged process, and as such, socket option
355  * operations to manage system properties on any raw socket were allowed to
356  * take place without explicit additional access control checks.  However,
357  * raw sockets can now also be created in jail(), and therefore explicit
358  * checks are now required.  Likewise, raw sockets can be used by a process
359  * after it gives up privilege, so some caution is required.  For options
360  * passed down to the IP layer via ip_ctloutput(), checks are assumed to be
361  * performed in ip_ctloutput() and therefore no check occurs here.
362  * Unilaterally checking suser() here breaks normal IP socket option
363  * operations on raw sockets.
364  *
365  * When adding new socket options here, make sure to add access control
366  * checks here as necessary.
367  */
368 int
369 rip_ctloutput(struct socket *so, struct sockopt *sopt)
370 {
371 	struct	inpcb *inp = sotoinpcb(so);
372 	int	error, optval;
373 
374 	if (sopt->sopt_level != IPPROTO_IP)
375 		return (EINVAL);
376 
377 	error = 0;
378 	switch (sopt->sopt_dir) {
379 	case SOPT_GET:
380 		switch (sopt->sopt_name) {
381 		case IP_HDRINCL:
382 			optval = inp->inp_flags & INP_HDRINCL;
383 			error = sooptcopyout(sopt, &optval, sizeof optval);
384 			break;
385 
386 		case IP_FW_ADD:	/* ADD actually returns the body... */
387 		case IP_FW_GET:
388 		case IP_FW_TABLE_GETSIZE:
389 		case IP_FW_TABLE_LIST:
390 			error = suser(curthread);
391 			if (error != 0)
392 				return (error);
393 			if (ip_fw_ctl_ptr != NULL)
394 				error = ip_fw_ctl_ptr(sopt);
395 			else
396 				error = ENOPROTOOPT;
397 			break;
398 
399 		case IP_DUMMYNET_GET:
400 			error = suser(curthread);
401 			if (error != 0)
402 				return (error);
403 			if (ip_dn_ctl_ptr != NULL)
404 				error = ip_dn_ctl_ptr(sopt);
405 			else
406 				error = ENOPROTOOPT;
407 			break ;
408 
409 		case MRT_INIT:
410 		case MRT_DONE:
411 		case MRT_ADD_VIF:
412 		case MRT_DEL_VIF:
413 		case MRT_ADD_MFC:
414 		case MRT_DEL_MFC:
415 		case MRT_VERSION:
416 		case MRT_ASSERT:
417 		case MRT_API_SUPPORT:
418 		case MRT_API_CONFIG:
419 		case MRT_ADD_BW_UPCALL:
420 		case MRT_DEL_BW_UPCALL:
421 			error = suser(curthread);
422 			if (error != 0)
423 				return (error);
424 			error = ip_mrouter_get ? ip_mrouter_get(so, sopt) :
425 				EOPNOTSUPP;
426 			break;
427 
428 		default:
429 			error = ip_ctloutput(so, sopt);
430 			break;
431 		}
432 		break;
433 
434 	case SOPT_SET:
435 		switch (sopt->sopt_name) {
436 		case IP_HDRINCL:
437 			error = sooptcopyin(sopt, &optval, sizeof optval,
438 					    sizeof optval);
439 			if (error)
440 				break;
441 			if (optval)
442 				inp->inp_flags |= INP_HDRINCL;
443 			else
444 				inp->inp_flags &= ~INP_HDRINCL;
445 			break;
446 
447 		case IP_FW_ADD:
448 		case IP_FW_DEL:
449 		case IP_FW_FLUSH:
450 		case IP_FW_ZERO:
451 		case IP_FW_RESETLOG:
452 		case IP_FW_TABLE_ADD:
453 		case IP_FW_TABLE_DEL:
454 		case IP_FW_TABLE_FLUSH:
455 			error = suser(curthread);
456 			if (error != 0)
457 				return (error);
458 			if (ip_fw_ctl_ptr != NULL)
459 				error = ip_fw_ctl_ptr(sopt);
460 			else
461 				error = ENOPROTOOPT;
462 			break;
463 
464 		case IP_DUMMYNET_CONFIGURE:
465 		case IP_DUMMYNET_DEL:
466 		case IP_DUMMYNET_FLUSH:
467 			error = suser(curthread);
468 			if (error != 0)
469 				return (error);
470 			if (ip_dn_ctl_ptr != NULL)
471 				error = ip_dn_ctl_ptr(sopt);
472 			else
473 				error = ENOPROTOOPT ;
474 			break ;
475 
476 		case IP_RSVP_ON:
477 			error = suser(curthread);
478 			if (error != 0)
479 				return (error);
480 			error = ip_rsvp_init(so);
481 			break;
482 
483 		case IP_RSVP_OFF:
484 			error = suser(curthread);
485 			if (error != 0)
486 				return (error);
487 			error = ip_rsvp_done();
488 			break;
489 
490 		case IP_RSVP_VIF_ON:
491 		case IP_RSVP_VIF_OFF:
492 			error = suser(curthread);
493 			if (error != 0)
494 				return (error);
495 			error = ip_rsvp_vif ?
496 				ip_rsvp_vif(so, sopt) : EINVAL;
497 			break;
498 
499 		case MRT_INIT:
500 		case MRT_DONE:
501 		case MRT_ADD_VIF:
502 		case MRT_DEL_VIF:
503 		case MRT_ADD_MFC:
504 		case MRT_DEL_MFC:
505 		case MRT_VERSION:
506 		case MRT_ASSERT:
507 		case MRT_API_SUPPORT:
508 		case MRT_API_CONFIG:
509 		case MRT_ADD_BW_UPCALL:
510 		case MRT_DEL_BW_UPCALL:
511 			error = suser(curthread);
512 			if (error != 0)
513 				return (error);
514 			error = ip_mrouter_set ? ip_mrouter_set(so, sopt) :
515 					EOPNOTSUPP;
516 			break;
517 
518 		default:
519 			error = ip_ctloutput(so, sopt);
520 			break;
521 		}
522 		break;
523 	}
524 
525 	return (error);
526 }
527 
528 /*
529  * This function exists solely to receive the PRC_IFDOWN messages which
530  * are sent by if_down().  It looks for an ifaddr whose ifa_addr is sa,
531  * and calls in_ifadown() to remove all routes corresponding to that address.
532  * It also receives the PRC_IFUP messages from if_up() and reinstalls the
533  * interface routes.
534  */
535 void
536 rip_ctlinput(int cmd, struct sockaddr *sa, void *vip)
537 {
538 	struct in_ifaddr *ia;
539 	struct ifnet *ifp;
540 	int err;
541 	int flags;
542 
543 	switch (cmd) {
544 	case PRC_IFDOWN:
545 		TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
546 			if (ia->ia_ifa.ifa_addr == sa
547 			    && (ia->ia_flags & IFA_ROUTE)) {
548 				/*
549 				 * in_ifscrub kills the interface route.
550 				 */
551 				in_ifscrub(ia->ia_ifp, ia);
552 				/*
553 				 * in_ifadown gets rid of all the rest of
554 				 * the routes.  This is not quite the right
555 				 * thing to do, but at least if we are running
556 				 * a routing process they will come back.
557 				 */
558 				in_ifadown(&ia->ia_ifa, 0);
559 				break;
560 			}
561 		}
562 		break;
563 
564 	case PRC_IFUP:
565 		TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
566 			if (ia->ia_ifa.ifa_addr == sa)
567 				break;
568 		}
569 		if (ia == 0 || (ia->ia_flags & IFA_ROUTE))
570 			return;
571 		flags = RTF_UP;
572 		ifp = ia->ia_ifa.ifa_ifp;
573 
574 		if ((ifp->if_flags & IFF_LOOPBACK)
575 		    || (ifp->if_flags & IFF_POINTOPOINT))
576 			flags |= RTF_HOST;
577 
578 		err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
579 		if (err == 0)
580 			ia->ia_flags |= IFA_ROUTE;
581 		break;
582 	}
583 }
584 
585 u_long	rip_sendspace = RIPSNDQ;
586 u_long	rip_recvspace = RIPRCVQ;
587 
588 SYSCTL_ULONG(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW,
589     &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
590 SYSCTL_ULONG(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW,
591     &rip_recvspace, 0, "Maximum space for incoming raw IP datagrams");
592 
593 static int
594 rip_attach(struct socket *so, int proto, struct thread *td)
595 {
596 	struct inpcb *inp;
597 	int error;
598 
599 	inp = sotoinpcb(so);
600 	KASSERT(inp == NULL, ("rip_attach: inp != NULL"));
601 	if (jailed(td->td_ucred) && !jail_allow_raw_sockets)
602 		return (EPERM);
603 	if ((error = suser_cred(td->td_ucred, SUSER_ALLOWJAIL)) != 0)
604 		return error;
605 	if (proto >= IPPROTO_MAX || proto < 0)
606 		return EPROTONOSUPPORT;
607 	error = soreserve(so, rip_sendspace, rip_recvspace);
608 	if (error)
609 		return error;
610 	INP_INFO_WLOCK(&ripcbinfo);
611 	error = in_pcballoc(so, &ripcbinfo);
612 	if (error) {
613 		INP_INFO_WUNLOCK(&ripcbinfo);
614 		return error;
615 	}
616 	inp = (struct inpcb *)so->so_pcb;
617 	INP_INFO_WUNLOCK(&ripcbinfo);
618 	inp->inp_vflag |= INP_IPV4;
619 	inp->inp_ip_p = proto;
620 	inp->inp_ip_ttl = ip_defttl;
621 	INP_UNLOCK(inp);
622 	return 0;
623 }
624 
625 static void
626 rip_detach(struct socket *so)
627 {
628 	struct inpcb *inp;
629 
630 	inp = sotoinpcb(so);
631 	KASSERT(inp != NULL, ("rip_detach: inp == NULL"));
632 	KASSERT(inp->inp_faddr.s_addr == INADDR_ANY,
633 	    ("rip_detach: not closed"));
634 
635 	INP_INFO_WLOCK(&ripcbinfo);
636 	INP_LOCK(inp);
637 	if (so == ip_mrouter && ip_mrouter_done)
638 		ip_mrouter_done();
639 	if (ip_rsvp_force_done)
640 		ip_rsvp_force_done(so);
641 	if (so == ip_rsvpd)
642 		ip_rsvp_done();
643 	in_pcbdetach(inp);
644 	in_pcbfree(inp);
645 	INP_INFO_WUNLOCK(&ripcbinfo);
646 }
647 
648 static void
649 rip_dodisconnect(struct socket *so, struct inpcb *inp)
650 {
651 
652 	INP_LOCK_ASSERT(inp);
653 
654 	inp->inp_faddr.s_addr = INADDR_ANY;
655 	SOCK_LOCK(so);
656 	so->so_state &= ~SS_ISCONNECTED;
657 	SOCK_UNLOCK(so);
658 }
659 
660 static void
661 rip_abort(struct socket *so)
662 {
663 	struct inpcb *inp;
664 
665 	inp = sotoinpcb(so);
666 	KASSERT(inp != NULL, ("rip_abort: inp == NULL"));
667 
668 	INP_INFO_WLOCK(&ripcbinfo);
669 	INP_LOCK(inp);
670 	rip_dodisconnect(so, inp);
671 	INP_UNLOCK(inp);
672 	INP_INFO_WUNLOCK(&ripcbinfo);
673 }
674 
675 static void
676 rip_close(struct socket *so)
677 {
678 	struct inpcb *inp;
679 
680 	inp = sotoinpcb(so);
681 	KASSERT(inp != NULL, ("rip_close: inp == NULL"));
682 
683 	INP_INFO_WLOCK(&ripcbinfo);
684 	INP_LOCK(inp);
685 	rip_dodisconnect(so, inp);
686 	INP_UNLOCK(inp);
687 	INP_INFO_WUNLOCK(&ripcbinfo);
688 }
689 
690 static int
691 rip_disconnect(struct socket *so)
692 {
693 	struct inpcb *inp;
694 
695 	if ((so->so_state & SS_ISCONNECTED) == 0)
696 		return ENOTCONN;
697 
698 	inp = sotoinpcb(so);
699 	KASSERT(inp != NULL, ("rip_disconnect: inp == NULL"));
700 	INP_INFO_WLOCK(&ripcbinfo);
701 	INP_LOCK(inp);
702 	rip_dodisconnect(so, inp);
703 	INP_UNLOCK(inp);
704 	INP_INFO_WUNLOCK(&ripcbinfo);
705 	return (0);
706 }
707 
708 static int
709 rip_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
710 {
711 	struct sockaddr_in *addr = (struct sockaddr_in *)nam;
712 	struct inpcb *inp;
713 
714 	if (nam->sa_len != sizeof(*addr))
715 		return EINVAL;
716 
717 	if (jailed(td->td_ucred)) {
718 		if (addr->sin_addr.s_addr == INADDR_ANY)
719 			addr->sin_addr.s_addr =
720 			    htonl(prison_getip(td->td_ucred));
721 		if (htonl(prison_getip(td->td_ucred)) != addr->sin_addr.s_addr)
722 			return (EADDRNOTAVAIL);
723 	}
724 
725 	if (TAILQ_EMPTY(&ifnet) ||
726 	    (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) ||
727 	    (addr->sin_addr.s_addr &&
728 	     ifa_ifwithaddr((struct sockaddr *)addr) == 0))
729 		return EADDRNOTAVAIL;
730 
731 	inp = sotoinpcb(so);
732 	KASSERT(inp != NULL, ("rip_bind: inp == NULL"));
733 	INP_INFO_WLOCK(&ripcbinfo);
734 	INP_LOCK(inp);
735 	inp->inp_laddr = addr->sin_addr;
736 	INP_UNLOCK(inp);
737 	INP_INFO_WUNLOCK(&ripcbinfo);
738 	return 0;
739 }
740 
741 static int
742 rip_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
743 {
744 	struct sockaddr_in *addr = (struct sockaddr_in *)nam;
745 	struct inpcb *inp;
746 
747 	if (nam->sa_len != sizeof(*addr))
748 		return EINVAL;
749 	if (TAILQ_EMPTY(&ifnet))
750 		return EADDRNOTAVAIL;
751 	if (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK)
752 		return EAFNOSUPPORT;
753 
754 	inp = sotoinpcb(so);
755 	KASSERT(inp != NULL, ("rip_connect: inp == NULL"));
756 	INP_INFO_WLOCK(&ripcbinfo);
757 	INP_LOCK(inp);
758 	inp->inp_faddr = addr->sin_addr;
759 	soisconnected(so);
760 	INP_UNLOCK(inp);
761 	INP_INFO_WUNLOCK(&ripcbinfo);
762 	return 0;
763 }
764 
765 static int
766 rip_shutdown(struct socket *so)
767 {
768 	struct inpcb *inp;
769 
770 	inp = sotoinpcb(so);
771 	KASSERT(inp != NULL, ("rip_shutdown: inp == NULL"));
772 	INP_LOCK(inp);
773 	socantsendmore(so);
774 	INP_UNLOCK(inp);
775 	return 0;
776 }
777 
778 static int
779 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
780 	 struct mbuf *control, struct thread *td)
781 {
782 	struct inpcb *inp;
783 	u_long dst;
784 
785 	inp = sotoinpcb(so);
786 	KASSERT(inp != NULL, ("rip_send: inp == NULL"));
787 	/*
788 	 * Note: 'dst' reads below are unlocked.
789 	 */
790 	if (so->so_state & SS_ISCONNECTED) {
791 		if (nam) {
792 			m_freem(m);
793 			return EISCONN;
794 		}
795 		dst = inp->inp_faddr.s_addr;	/* Unlocked read. */
796 	} else {
797 		if (nam == NULL) {
798 			m_freem(m);
799 			return ENOTCONN;
800 		}
801 		dst = ((struct sockaddr_in *)nam)->sin_addr.s_addr;
802 	}
803 	return rip_output(m, so, dst);
804 }
805 
806 static int
807 rip_pcblist(SYSCTL_HANDLER_ARGS)
808 {
809 	int error, i, n;
810 	struct inpcb *inp, **inp_list;
811 	inp_gen_t gencnt;
812 	struct xinpgen xig;
813 
814 	/*
815 	 * The process of preparing the TCB list is too time-consuming and
816 	 * resource-intensive to repeat twice on every request.
817 	 */
818 	if (req->oldptr == 0) {
819 		n = ripcbinfo.ipi_count;
820 		req->oldidx = 2 * (sizeof xig)
821 			+ (n + n/8) * sizeof(struct xinpcb);
822 		return 0;
823 	}
824 
825 	if (req->newptr != 0)
826 		return EPERM;
827 
828 	/*
829 	 * OK, now we're committed to doing something.
830 	 */
831 	INP_INFO_RLOCK(&ripcbinfo);
832 	gencnt = ripcbinfo.ipi_gencnt;
833 	n = ripcbinfo.ipi_count;
834 	INP_INFO_RUNLOCK(&ripcbinfo);
835 
836 	xig.xig_len = sizeof xig;
837 	xig.xig_count = n;
838 	xig.xig_gen = gencnt;
839 	xig.xig_sogen = so_gencnt;
840 	error = SYSCTL_OUT(req, &xig, sizeof xig);
841 	if (error)
842 		return error;
843 
844 	inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
845 	if (inp_list == 0)
846 		return ENOMEM;
847 
848 	INP_INFO_RLOCK(&ripcbinfo);
849 	for (inp = LIST_FIRST(ripcbinfo.listhead), i = 0; inp && i < n;
850 	     inp = LIST_NEXT(inp, inp_list)) {
851 		INP_LOCK(inp);
852 		if (inp->inp_gencnt <= gencnt &&
853 		    cr_canseesocket(req->td->td_ucred, inp->inp_socket) == 0) {
854 			/* XXX held references? */
855 			inp_list[i++] = inp;
856 		}
857 		INP_UNLOCK(inp);
858 	}
859 	INP_INFO_RUNLOCK(&ripcbinfo);
860 	n = i;
861 
862 	error = 0;
863 	for (i = 0; i < n; i++) {
864 		inp = inp_list[i];
865 		INP_LOCK(inp);
866 		if (inp->inp_gencnt <= gencnt) {
867 			struct xinpcb xi;
868 			bzero(&xi, sizeof(xi));
869 			xi.xi_len = sizeof xi;
870 			/* XXX should avoid extra copy */
871 			bcopy(inp, &xi.xi_inp, sizeof *inp);
872 			if (inp->inp_socket)
873 				sotoxsocket(inp->inp_socket, &xi.xi_socket);
874 			INP_UNLOCK(inp);
875 			error = SYSCTL_OUT(req, &xi, sizeof xi);
876 		} else
877 			INP_UNLOCK(inp);
878 	}
879 	if (!error) {
880 		/*
881 		 * Give the user an updated idea of our state.
882 		 * If the generation differs from what we told
883 		 * her before, she knows that something happened
884 		 * while we were processing this request, and it
885 		 * might be necessary to retry.
886 		 */
887 		INP_INFO_RLOCK(&ripcbinfo);
888 		xig.xig_gen = ripcbinfo.ipi_gencnt;
889 		xig.xig_sogen = so_gencnt;
890 		xig.xig_count = ripcbinfo.ipi_count;
891 		INP_INFO_RUNLOCK(&ripcbinfo);
892 		error = SYSCTL_OUT(req, &xig, sizeof xig);
893 	}
894 	free(inp_list, M_TEMP);
895 	return error;
896 }
897 
898 /*
899  * This is the wrapper function for in_setsockaddr.  We just pass down
900  * the pcbinfo for in_setpeeraddr to lock.
901  */
902 static int
903 rip_sockaddr(struct socket *so, struct sockaddr **nam)
904 {
905 	return (in_setsockaddr(so, nam, &ripcbinfo));
906 }
907 
908 /*
909  * This is the wrapper function for in_setpeeraddr.  We just pass down
910  * the pcbinfo for in_setpeeraddr to lock.
911  */
912 static int
913 rip_peeraddr(struct socket *so, struct sockaddr **nam)
914 {
915 	return (in_setpeeraddr(so, nam, &ripcbinfo));
916 }
917 
918 
919 SYSCTL_PROC(_net_inet_raw, OID_AUTO/*XXX*/, pcblist, CTLFLAG_RD, 0, 0,
920 	    rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
921 
922 struct pr_usrreqs rip_usrreqs = {
923 	.pru_abort =		rip_abort,
924 	.pru_attach =		rip_attach,
925 	.pru_bind =		rip_bind,
926 	.pru_connect =		rip_connect,
927 	.pru_control =		in_control,
928 	.pru_detach =		rip_detach,
929 	.pru_disconnect =	rip_disconnect,
930 	.pru_peeraddr =		rip_peeraddr,
931 	.pru_send =		rip_send,
932 	.pru_shutdown =		rip_shutdown,
933 	.pru_sockaddr =		rip_sockaddr,
934 	.pru_sosetlabel =	in_pcbsosetlabel,
935 	.pru_close =		rip_close,
936 };
937