xref: /freebsd/sys/netinet/raw_ip.c (revision a0e793cbf1951d07fc47a0d9ea389d7dacba5213)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1993
3  *	The Regents of the University of California.
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 4. Neither the name of the University nor the names of its contributors
15  *    may be used to endorse or promote products derived from this software
16  *    without specific prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  *	@(#)raw_ip.c	8.7 (Berkeley) 5/15/95
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include "opt_inet.h"
37 #include "opt_inet6.h"
38 #include "opt_ipsec.h"
39 
40 #include <sys/param.h>
41 #include <sys/jail.h>
42 #include <sys/kernel.h>
43 #include <sys/lock.h>
44 #include <sys/malloc.h>
45 #include <sys/mbuf.h>
46 #include <sys/priv.h>
47 #include <sys/proc.h>
48 #include <sys/protosw.h>
49 #include <sys/rwlock.h>
50 #include <sys/signalvar.h>
51 #include <sys/socket.h>
52 #include <sys/socketvar.h>
53 #include <sys/sx.h>
54 #include <sys/sysctl.h>
55 #include <sys/systm.h>
56 
57 #include <vm/uma.h>
58 
59 #include <net/if.h>
60 #include <net/if_var.h>
61 #include <net/route.h>
62 #include <net/vnet.h>
63 
64 #include <netinet/in.h>
65 #include <netinet/in_systm.h>
66 #include <netinet/in_pcb.h>
67 #include <netinet/in_var.h>
68 #include <netinet/if_ether.h>
69 #include <netinet/ip.h>
70 #include <netinet/ip_var.h>
71 #include <netinet/ip_mroute.h>
72 
73 #ifdef IPSEC
74 #include <netipsec/ipsec.h>
75 #endif /*IPSEC*/
76 
77 #include <security/mac/mac_framework.h>
78 
79 VNET_DEFINE(int, ip_defttl) = IPDEFTTL;
80 SYSCTL_VNET_INT(_net_inet_ip, IPCTL_DEFTTL, ttl, CTLFLAG_RW,
81     &VNET_NAME(ip_defttl), 0,
82     "Maximum TTL on IP packets");
83 
84 VNET_DEFINE(struct inpcbhead, ripcb);
85 VNET_DEFINE(struct inpcbinfo, ripcbinfo);
86 
87 #define	V_ripcb			VNET(ripcb)
88 #define	V_ripcbinfo		VNET(ripcbinfo)
89 
90 /*
91  * Control and data hooks for ipfw, dummynet, divert and so on.
92  * The data hooks are not used here but it is convenient
93  * to keep them all in one place.
94  */
95 VNET_DEFINE(ip_fw_chk_ptr_t, ip_fw_chk_ptr) = NULL;
96 VNET_DEFINE(ip_fw_ctl_ptr_t, ip_fw_ctl_ptr) = NULL;
97 
98 int	(*ip_dn_ctl_ptr)(struct sockopt *);
99 int	(*ip_dn_io_ptr)(struct mbuf **, int, struct ip_fw_args *);
100 void	(*ip_divert_ptr)(struct mbuf *, int);
101 int	(*ng_ipfw_input_p)(struct mbuf **, int,
102 			struct ip_fw_args *, int);
103 
104 #ifdef INET
105 /*
106  * Hooks for multicast routing. They all default to NULL, so leave them not
107  * initialized and rely on BSS being set to 0.
108  */
109 
110 /*
111  * The socket used to communicate with the multicast routing daemon.
112  */
113 VNET_DEFINE(struct socket *, ip_mrouter);
114 
115 /*
116  * The various mrouter and rsvp functions.
117  */
118 int (*ip_mrouter_set)(struct socket *, struct sockopt *);
119 int (*ip_mrouter_get)(struct socket *, struct sockopt *);
120 int (*ip_mrouter_done)(void);
121 int (*ip_mforward)(struct ip *, struct ifnet *, struct mbuf *,
122 		   struct ip_moptions *);
123 int (*mrt_ioctl)(u_long, caddr_t, int);
124 int (*legal_vif_num)(int);
125 u_long (*ip_mcast_src)(int);
126 
127 int (*rsvp_input_p)(struct mbuf **, int *, int);
128 int (*ip_rsvp_vif)(struct socket *, struct sockopt *);
129 void (*ip_rsvp_force_done)(struct socket *);
130 #endif /* INET */
131 
132 u_long	rip_sendspace = 9216;
133 SYSCTL_ULONG(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW,
134     &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
135 
136 u_long	rip_recvspace = 9216;
137 SYSCTL_ULONG(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW,
138     &rip_recvspace, 0, "Maximum space for incoming raw IP datagrams");
139 
140 /*
141  * Hash functions
142  */
143 
144 #define INP_PCBHASH_RAW_SIZE	256
145 #define INP_PCBHASH_RAW(proto, laddr, faddr, mask) \
146         (((proto) + (laddr) + (faddr)) % (mask) + 1)
147 
148 #ifdef INET
149 static void
150 rip_inshash(struct inpcb *inp)
151 {
152 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
153 	struct inpcbhead *pcbhash;
154 	int hash;
155 
156 	INP_INFO_WLOCK_ASSERT(pcbinfo);
157 	INP_WLOCK_ASSERT(inp);
158 
159 	if (inp->inp_ip_p != 0 &&
160 	    inp->inp_laddr.s_addr != INADDR_ANY &&
161 	    inp->inp_faddr.s_addr != INADDR_ANY) {
162 		hash = INP_PCBHASH_RAW(inp->inp_ip_p, inp->inp_laddr.s_addr,
163 		    inp->inp_faddr.s_addr, pcbinfo->ipi_hashmask);
164 	} else
165 		hash = 0;
166 	pcbhash = &pcbinfo->ipi_hashbase[hash];
167 	LIST_INSERT_HEAD(pcbhash, inp, inp_hash);
168 }
169 
170 static void
171 rip_delhash(struct inpcb *inp)
172 {
173 
174 	INP_INFO_WLOCK_ASSERT(inp->inp_pcbinfo);
175 	INP_WLOCK_ASSERT(inp);
176 
177 	LIST_REMOVE(inp, inp_hash);
178 }
179 #endif /* INET */
180 
181 /*
182  * Raw interface to IP protocol.
183  */
184 
185 /*
186  * Initialize raw connection block q.
187  */
188 static void
189 rip_zone_change(void *tag)
190 {
191 
192 	uma_zone_set_max(V_ripcbinfo.ipi_zone, maxsockets);
193 }
194 
195 static int
196 rip_inpcb_init(void *mem, int size, int flags)
197 {
198 	struct inpcb *inp = mem;
199 
200 	INP_LOCK_INIT(inp, "inp", "rawinp");
201 	return (0);
202 }
203 
204 void
205 rip_init(void)
206 {
207 
208 	in_pcbinfo_init(&V_ripcbinfo, "rip", &V_ripcb, INP_PCBHASH_RAW_SIZE,
209 	    1, "ripcb", rip_inpcb_init, NULL, UMA_ZONE_NOFREE,
210 	    IPI_HASHFIELDS_NONE);
211 	EVENTHANDLER_REGISTER(maxsockets_change, rip_zone_change, NULL,
212 	    EVENTHANDLER_PRI_ANY);
213 }
214 
215 #ifdef VIMAGE
216 void
217 rip_destroy(void)
218 {
219 
220 	in_pcbinfo_destroy(&V_ripcbinfo);
221 }
222 #endif
223 
224 #ifdef INET
225 static int
226 rip_append(struct inpcb *last, struct ip *ip, struct mbuf *n,
227     struct sockaddr_in *ripsrc)
228 {
229 	int policyfail = 0;
230 
231 	INP_LOCK_ASSERT(last);
232 
233 #ifdef IPSEC
234 	/* check AH/ESP integrity. */
235 	if (ipsec4_in_reject(n, last)) {
236 		policyfail = 1;
237 	}
238 #endif /* IPSEC */
239 #ifdef MAC
240 	if (!policyfail && mac_inpcb_check_deliver(last, n) != 0)
241 		policyfail = 1;
242 #endif
243 	/* Check the minimum TTL for socket. */
244 	if (last->inp_ip_minttl && last->inp_ip_minttl > ip->ip_ttl)
245 		policyfail = 1;
246 	if (!policyfail) {
247 		struct mbuf *opts = NULL;
248 		struct socket *so;
249 
250 		so = last->inp_socket;
251 		if ((last->inp_flags & INP_CONTROLOPTS) ||
252 		    (so->so_options & (SO_TIMESTAMP | SO_BINTIME)))
253 			ip_savecontrol(last, &opts, ip, n);
254 		SOCKBUF_LOCK(&so->so_rcv);
255 		if (sbappendaddr_locked(&so->so_rcv,
256 		    (struct sockaddr *)ripsrc, n, opts) == 0) {
257 			/* should notify about lost packet */
258 			m_freem(n);
259 			if (opts)
260 				m_freem(opts);
261 			SOCKBUF_UNLOCK(&so->so_rcv);
262 		} else
263 			sorwakeup_locked(so);
264 	} else
265 		m_freem(n);
266 	return (policyfail);
267 }
268 
269 /*
270  * Setup generic address and protocol structures for raw_input routine, then
271  * pass them along with mbuf chain.
272  */
273 int
274 rip_input(struct mbuf **mp, int *offp, int proto)
275 {
276 	struct ifnet *ifp;
277 	struct mbuf *m = *mp;
278 	struct ip *ip = mtod(m, struct ip *);
279 	struct inpcb *inp, *last;
280 	struct sockaddr_in ripsrc;
281 	int hash;
282 
283 	*mp = NULL;
284 
285 	bzero(&ripsrc, sizeof(ripsrc));
286 	ripsrc.sin_len = sizeof(ripsrc);
287 	ripsrc.sin_family = AF_INET;
288 	ripsrc.sin_addr = ip->ip_src;
289 	last = NULL;
290 
291 	ifp = m->m_pkthdr.rcvif;
292 	/*
293 	 * Applications on raw sockets expect host byte order.
294 	 */
295 	ip->ip_len = ntohs(ip->ip_len);
296 	ip->ip_off = ntohs(ip->ip_off);
297 
298 	hash = INP_PCBHASH_RAW(proto, ip->ip_src.s_addr,
299 	    ip->ip_dst.s_addr, V_ripcbinfo.ipi_hashmask);
300 	INP_INFO_RLOCK(&V_ripcbinfo);
301 	LIST_FOREACH(inp, &V_ripcbinfo.ipi_hashbase[hash], inp_hash) {
302 		if (inp->inp_ip_p != proto)
303 			continue;
304 #ifdef INET6
305 		/* XXX inp locking */
306 		if ((inp->inp_vflag & INP_IPV4) == 0)
307 			continue;
308 #endif
309 		if (inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
310 			continue;
311 		if (inp->inp_faddr.s_addr != ip->ip_src.s_addr)
312 			continue;
313 		if (jailed_without_vnet(inp->inp_cred)) {
314 			/*
315 			 * XXX: If faddr was bound to multicast group,
316 			 * jailed raw socket will drop datagram.
317 			 */
318 			if (prison_check_ip4(inp->inp_cred, &ip->ip_dst) != 0)
319 				continue;
320 		}
321 		if (last != NULL) {
322 			struct mbuf *n;
323 
324 			n = m_copy(m, 0, (int)M_COPYALL);
325 			if (n != NULL)
326 		    	    (void) rip_append(last, ip, n, &ripsrc);
327 			/* XXX count dropped packet */
328 			INP_RUNLOCK(last);
329 		}
330 		INP_RLOCK(inp);
331 		last = inp;
332 	}
333 	LIST_FOREACH(inp, &V_ripcbinfo.ipi_hashbase[0], inp_hash) {
334 		if (inp->inp_ip_p && inp->inp_ip_p != proto)
335 			continue;
336 #ifdef INET6
337 		/* XXX inp locking */
338 		if ((inp->inp_vflag & INP_IPV4) == 0)
339 			continue;
340 #endif
341 		if (!in_nullhost(inp->inp_laddr) &&
342 		    !in_hosteq(inp->inp_laddr, ip->ip_dst))
343 			continue;
344 		if (!in_nullhost(inp->inp_faddr) &&
345 		    !in_hosteq(inp->inp_faddr, ip->ip_src))
346 			continue;
347 		if (jailed_without_vnet(inp->inp_cred)) {
348 			/*
349 			 * Allow raw socket in jail to receive multicast;
350 			 * assume process had PRIV_NETINET_RAW at attach,
351 			 * and fall through into normal filter path if so.
352 			 */
353 			if (!IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) &&
354 			    prison_check_ip4(inp->inp_cred, &ip->ip_dst) != 0)
355 				continue;
356 		}
357 		/*
358 		 * If this raw socket has multicast state, and we
359 		 * have received a multicast, check if this socket
360 		 * should receive it, as multicast filtering is now
361 		 * the responsibility of the transport layer.
362 		 */
363 		if (inp->inp_moptions != NULL &&
364 		    IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
365 			/*
366 			 * If the incoming datagram is for IGMP, allow it
367 			 * through unconditionally to the raw socket.
368 			 *
369 			 * In the case of IGMPv2, we may not have explicitly
370 			 * joined the group, and may have set IFF_ALLMULTI
371 			 * on the interface. imo_multi_filter() may discard
372 			 * control traffic we actually need to see.
373 			 *
374 			 * Userland multicast routing daemons should continue
375 			 * filter the control traffic appropriately.
376 			 */
377 			int blocked;
378 
379 			blocked = MCAST_PASS;
380 			if (proto != IPPROTO_IGMP) {
381 				struct sockaddr_in group;
382 
383 				bzero(&group, sizeof(struct sockaddr_in));
384 				group.sin_len = sizeof(struct sockaddr_in);
385 				group.sin_family = AF_INET;
386 				group.sin_addr = ip->ip_dst;
387 
388 				blocked = imo_multi_filter(inp->inp_moptions,
389 				    ifp,
390 				    (struct sockaddr *)&group,
391 				    (struct sockaddr *)&ripsrc);
392 			}
393 
394 			if (blocked != MCAST_PASS) {
395 				IPSTAT_INC(ips_notmember);
396 				continue;
397 			}
398 		}
399 		if (last != NULL) {
400 			struct mbuf *n;
401 
402 			n = m_copy(m, 0, (int)M_COPYALL);
403 			if (n != NULL)
404 				(void) rip_append(last, ip, n, &ripsrc);
405 			/* XXX count dropped packet */
406 			INP_RUNLOCK(last);
407 		}
408 		INP_RLOCK(inp);
409 		last = inp;
410 	}
411 	INP_INFO_RUNLOCK(&V_ripcbinfo);
412 	if (last != NULL) {
413 		if (rip_append(last, ip, m, &ripsrc) != 0)
414 			IPSTAT_INC(ips_delivered);
415 		INP_RUNLOCK(last);
416 	} else {
417 		m_freem(m);
418 		IPSTAT_INC(ips_noproto);
419 		IPSTAT_DEC(ips_delivered);
420 	}
421 	return (IPPROTO_DONE);
422 }
423 
424 /*
425  * Generate IP header and pass packet to ip_output.  Tack on options user may
426  * have setup with control call.
427  */
428 int
429 rip_output(struct mbuf *m, struct socket *so, u_long dst)
430 {
431 	struct ip *ip;
432 	int error;
433 	struct inpcb *inp = sotoinpcb(so);
434 	int flags = ((so->so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0) |
435 	    IP_ALLOWBROADCAST;
436 
437 	/*
438 	 * If the user handed us a complete IP packet, use it.  Otherwise,
439 	 * allocate an mbuf for a header and fill it in.
440 	 */
441 	if ((inp->inp_flags & INP_HDRINCL) == 0) {
442 		if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
443 			m_freem(m);
444 			return(EMSGSIZE);
445 		}
446 		M_PREPEND(m, sizeof(struct ip), M_NOWAIT);
447 		if (m == NULL)
448 			return(ENOBUFS);
449 
450 		INP_RLOCK(inp);
451 		ip = mtod(m, struct ip *);
452 		ip->ip_tos = inp->inp_ip_tos;
453 		if (inp->inp_flags & INP_DONTFRAG)
454 			ip->ip_off = htons(IP_DF);
455 		else
456 			ip->ip_off = htons(0);
457 		ip->ip_p = inp->inp_ip_p;
458 		ip->ip_len = htons(m->m_pkthdr.len);
459 		ip->ip_src = inp->inp_laddr;
460 		ip->ip_dst.s_addr = dst;
461 		if (jailed(inp->inp_cred)) {
462 			/*
463 			 * prison_local_ip4() would be good enough but would
464 			 * let a source of INADDR_ANY pass, which we do not
465 			 * want to see from jails.
466 			 */
467 			if (ip->ip_src.s_addr == INADDR_ANY) {
468 				error = in_pcbladdr(inp, &ip->ip_dst, &ip->ip_src,
469 				    inp->inp_cred);
470 			} else {
471 				error = prison_local_ip4(inp->inp_cred,
472 				    &ip->ip_src);
473 			}
474 			if (error != 0) {
475 				INP_RUNLOCK(inp);
476 				m_freem(m);
477 				return (error);
478 			}
479 		}
480 		ip->ip_ttl = inp->inp_ip_ttl;
481 	} else {
482 		if (m->m_pkthdr.len > IP_MAXPACKET) {
483 			m_freem(m);
484 			return(EMSGSIZE);
485 		}
486 		INP_RLOCK(inp);
487 		ip = mtod(m, struct ip *);
488 		error = prison_check_ip4(inp->inp_cred, &ip->ip_src);
489 		if (error != 0) {
490 			INP_RUNLOCK(inp);
491 			m_freem(m);
492 			return (error);
493 		}
494 
495 		/*
496 		 * Don't allow both user specified and setsockopt options,
497 		 * and don't allow packet length sizes that will crash.
498 		 */
499 		if (((ip->ip_hl != (sizeof (*ip) >> 2)) && inp->inp_options)
500 		    || (ip->ip_len > m->m_pkthdr.len)
501 		    || (ip->ip_len < (ip->ip_hl << 2))) {
502 			INP_RUNLOCK(inp);
503 			m_freem(m);
504 			return (EINVAL);
505 		}
506 		if (ip->ip_id == 0)
507 			ip->ip_id = ip_newid();
508 
509 		/*
510 		 * Applications on raw sockets pass us packets
511 		 * in host byte order.
512 		 */
513 		ip->ip_len = htons(ip->ip_len);
514 		ip->ip_off = htons(ip->ip_off);
515 
516 		/*
517 		 * XXX prevent ip_output from overwriting header fields.
518 		 */
519 		flags |= IP_RAWOUTPUT;
520 		IPSTAT_INC(ips_rawout);
521 	}
522 
523 	if (inp->inp_flags & INP_ONESBCAST)
524 		flags |= IP_SENDONES;
525 
526 #ifdef MAC
527 	mac_inpcb_create_mbuf(inp, m);
528 #endif
529 
530 	error = ip_output(m, inp->inp_options, NULL, flags,
531 	    inp->inp_moptions, inp);
532 	INP_RUNLOCK(inp);
533 	return (error);
534 }
535 
536 /*
537  * Raw IP socket option processing.
538  *
539  * IMPORTANT NOTE regarding access control: Traditionally, raw sockets could
540  * only be created by a privileged process, and as such, socket option
541  * operations to manage system properties on any raw socket were allowed to
542  * take place without explicit additional access control checks.  However,
543  * raw sockets can now also be created in jail(), and therefore explicit
544  * checks are now required.  Likewise, raw sockets can be used by a process
545  * after it gives up privilege, so some caution is required.  For options
546  * passed down to the IP layer via ip_ctloutput(), checks are assumed to be
547  * performed in ip_ctloutput() and therefore no check occurs here.
548  * Unilaterally checking priv_check() here breaks normal IP socket option
549  * operations on raw sockets.
550  *
551  * When adding new socket options here, make sure to add access control
552  * checks here as necessary.
553  *
554  * XXX-BZ inp locking?
555  */
556 int
557 rip_ctloutput(struct socket *so, struct sockopt *sopt)
558 {
559 	struct	inpcb *inp = sotoinpcb(so);
560 	int	error, optval;
561 
562 	if (sopt->sopt_level != IPPROTO_IP) {
563 		if ((sopt->sopt_level == SOL_SOCKET) &&
564 		    (sopt->sopt_name == SO_SETFIB)) {
565 			inp->inp_inc.inc_fibnum = so->so_fibnum;
566 			return (0);
567 		}
568 		return (EINVAL);
569 	}
570 
571 	error = 0;
572 	switch (sopt->sopt_dir) {
573 	case SOPT_GET:
574 		switch (sopt->sopt_name) {
575 		case IP_HDRINCL:
576 			optval = inp->inp_flags & INP_HDRINCL;
577 			error = sooptcopyout(sopt, &optval, sizeof optval);
578 			break;
579 
580 		case IP_FW3:	/* generic ipfw v.3 functions */
581 		case IP_FW_ADD:	/* ADD actually returns the body... */
582 		case IP_FW_GET:
583 		case IP_FW_TABLE_GETSIZE:
584 		case IP_FW_TABLE_LIST:
585 		case IP_FW_NAT_GET_CONFIG:
586 		case IP_FW_NAT_GET_LOG:
587 			if (V_ip_fw_ctl_ptr != NULL)
588 				error = V_ip_fw_ctl_ptr(sopt);
589 			else
590 				error = ENOPROTOOPT;
591 			break;
592 
593 		case IP_DUMMYNET3:	/* generic dummynet v.3 functions */
594 		case IP_DUMMYNET_GET:
595 			if (ip_dn_ctl_ptr != NULL)
596 				error = ip_dn_ctl_ptr(sopt);
597 			else
598 				error = ENOPROTOOPT;
599 			break ;
600 
601 		case MRT_INIT:
602 		case MRT_DONE:
603 		case MRT_ADD_VIF:
604 		case MRT_DEL_VIF:
605 		case MRT_ADD_MFC:
606 		case MRT_DEL_MFC:
607 		case MRT_VERSION:
608 		case MRT_ASSERT:
609 		case MRT_API_SUPPORT:
610 		case MRT_API_CONFIG:
611 		case MRT_ADD_BW_UPCALL:
612 		case MRT_DEL_BW_UPCALL:
613 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
614 			if (error != 0)
615 				return (error);
616 			error = ip_mrouter_get ? ip_mrouter_get(so, sopt) :
617 				EOPNOTSUPP;
618 			break;
619 
620 		default:
621 			error = ip_ctloutput(so, sopt);
622 			break;
623 		}
624 		break;
625 
626 	case SOPT_SET:
627 		switch (sopt->sopt_name) {
628 		case IP_HDRINCL:
629 			error = sooptcopyin(sopt, &optval, sizeof optval,
630 					    sizeof optval);
631 			if (error)
632 				break;
633 			if (optval)
634 				inp->inp_flags |= INP_HDRINCL;
635 			else
636 				inp->inp_flags &= ~INP_HDRINCL;
637 			break;
638 
639 		case IP_FW3:	/* generic ipfw v.3 functions */
640 		case IP_FW_ADD:
641 		case IP_FW_DEL:
642 		case IP_FW_FLUSH:
643 		case IP_FW_ZERO:
644 		case IP_FW_RESETLOG:
645 		case IP_FW_TABLE_ADD:
646 		case IP_FW_TABLE_DEL:
647 		case IP_FW_TABLE_FLUSH:
648 		case IP_FW_NAT_CFG:
649 		case IP_FW_NAT_DEL:
650 			if (V_ip_fw_ctl_ptr != NULL)
651 				error = V_ip_fw_ctl_ptr(sopt);
652 			else
653 				error = ENOPROTOOPT;
654 			break;
655 
656 		case IP_DUMMYNET3:	/* generic dummynet v.3 functions */
657 		case IP_DUMMYNET_CONFIGURE:
658 		case IP_DUMMYNET_DEL:
659 		case IP_DUMMYNET_FLUSH:
660 			if (ip_dn_ctl_ptr != NULL)
661 				error = ip_dn_ctl_ptr(sopt);
662 			else
663 				error = ENOPROTOOPT ;
664 			break ;
665 
666 		case IP_RSVP_ON:
667 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
668 			if (error != 0)
669 				return (error);
670 			error = ip_rsvp_init(so);
671 			break;
672 
673 		case IP_RSVP_OFF:
674 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
675 			if (error != 0)
676 				return (error);
677 			error = ip_rsvp_done();
678 			break;
679 
680 		case IP_RSVP_VIF_ON:
681 		case IP_RSVP_VIF_OFF:
682 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
683 			if (error != 0)
684 				return (error);
685 			error = ip_rsvp_vif ?
686 				ip_rsvp_vif(so, sopt) : EINVAL;
687 			break;
688 
689 		case MRT_INIT:
690 		case MRT_DONE:
691 		case MRT_ADD_VIF:
692 		case MRT_DEL_VIF:
693 		case MRT_ADD_MFC:
694 		case MRT_DEL_MFC:
695 		case MRT_VERSION:
696 		case MRT_ASSERT:
697 		case MRT_API_SUPPORT:
698 		case MRT_API_CONFIG:
699 		case MRT_ADD_BW_UPCALL:
700 		case MRT_DEL_BW_UPCALL:
701 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
702 			if (error != 0)
703 				return (error);
704 			error = ip_mrouter_set ? ip_mrouter_set(so, sopt) :
705 					EOPNOTSUPP;
706 			break;
707 
708 		default:
709 			error = ip_ctloutput(so, sopt);
710 			break;
711 		}
712 		break;
713 	}
714 
715 	return (error);
716 }
717 
718 /*
719  * This function exists solely to receive the PRC_IFDOWN messages which are
720  * sent by if_down().  It looks for an ifaddr whose ifa_addr is sa, and calls
721  * in_ifadown() to remove all routes corresponding to that address.  It also
722  * receives the PRC_IFUP messages from if_up() and reinstalls the interface
723  * routes.
724  */
725 void
726 rip_ctlinput(int cmd, struct sockaddr *sa, void *vip)
727 {
728 	struct in_ifaddr *ia;
729 	struct ifnet *ifp;
730 	int err;
731 	int flags;
732 
733 	switch (cmd) {
734 	case PRC_IFDOWN:
735 		IN_IFADDR_RLOCK();
736 		TAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) {
737 			if (ia->ia_ifa.ifa_addr == sa
738 			    && (ia->ia_flags & IFA_ROUTE)) {
739 				ifa_ref(&ia->ia_ifa);
740 				IN_IFADDR_RUNLOCK();
741 				/*
742 				 * in_scrubprefix() kills the interface route.
743 				 */
744 				in_scrubprefix(ia, 0);
745 				/*
746 				 * in_ifadown gets rid of all the rest of the
747 				 * routes.  This is not quite the right thing
748 				 * to do, but at least if we are running a
749 				 * routing process they will come back.
750 				 */
751 				in_ifadown(&ia->ia_ifa, 0);
752 				ifa_free(&ia->ia_ifa);
753 				break;
754 			}
755 		}
756 		if (ia == NULL)		/* If ia matched, already unlocked. */
757 			IN_IFADDR_RUNLOCK();
758 		break;
759 
760 	case PRC_IFUP:
761 		IN_IFADDR_RLOCK();
762 		TAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) {
763 			if (ia->ia_ifa.ifa_addr == sa)
764 				break;
765 		}
766 		if (ia == NULL || (ia->ia_flags & IFA_ROUTE)) {
767 			IN_IFADDR_RUNLOCK();
768 			return;
769 		}
770 		ifa_ref(&ia->ia_ifa);
771 		IN_IFADDR_RUNLOCK();
772 		flags = RTF_UP;
773 		ifp = ia->ia_ifa.ifa_ifp;
774 
775 		if ((ifp->if_flags & IFF_LOOPBACK)
776 		    || (ifp->if_flags & IFF_POINTOPOINT))
777 			flags |= RTF_HOST;
778 
779 		err = ifa_del_loopback_route((struct ifaddr *)ia, sa);
780 
781 		err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
782 		if (err == 0)
783 			ia->ia_flags |= IFA_ROUTE;
784 
785 		err = ifa_add_loopback_route((struct ifaddr *)ia, sa);
786 
787 		ifa_free(&ia->ia_ifa);
788 		break;
789 	}
790 }
791 
792 static int
793 rip_attach(struct socket *so, int proto, struct thread *td)
794 {
795 	struct inpcb *inp;
796 	int error;
797 
798 	inp = sotoinpcb(so);
799 	KASSERT(inp == NULL, ("rip_attach: inp != NULL"));
800 
801 	error = priv_check(td, PRIV_NETINET_RAW);
802 	if (error)
803 		return (error);
804 	if (proto >= IPPROTO_MAX || proto < 0)
805 		return EPROTONOSUPPORT;
806 	error = soreserve(so, rip_sendspace, rip_recvspace);
807 	if (error)
808 		return (error);
809 	INP_INFO_WLOCK(&V_ripcbinfo);
810 	error = in_pcballoc(so, &V_ripcbinfo);
811 	if (error) {
812 		INP_INFO_WUNLOCK(&V_ripcbinfo);
813 		return (error);
814 	}
815 	inp = (struct inpcb *)so->so_pcb;
816 	inp->inp_vflag |= INP_IPV4;
817 	inp->inp_ip_p = proto;
818 	inp->inp_ip_ttl = V_ip_defttl;
819 	rip_inshash(inp);
820 	INP_INFO_WUNLOCK(&V_ripcbinfo);
821 	INP_WUNLOCK(inp);
822 	return (0);
823 }
824 
825 static void
826 rip_detach(struct socket *so)
827 {
828 	struct inpcb *inp;
829 
830 	inp = sotoinpcb(so);
831 	KASSERT(inp != NULL, ("rip_detach: inp == NULL"));
832 	KASSERT(inp->inp_faddr.s_addr == INADDR_ANY,
833 	    ("rip_detach: not closed"));
834 
835 	INP_INFO_WLOCK(&V_ripcbinfo);
836 	INP_WLOCK(inp);
837 	rip_delhash(inp);
838 	if (so == V_ip_mrouter && ip_mrouter_done)
839 		ip_mrouter_done();
840 	if (ip_rsvp_force_done)
841 		ip_rsvp_force_done(so);
842 	if (so == V_ip_rsvpd)
843 		ip_rsvp_done();
844 	in_pcbdetach(inp);
845 	in_pcbfree(inp);
846 	INP_INFO_WUNLOCK(&V_ripcbinfo);
847 }
848 
849 static void
850 rip_dodisconnect(struct socket *so, struct inpcb *inp)
851 {
852 	struct inpcbinfo *pcbinfo;
853 
854 	pcbinfo = inp->inp_pcbinfo;
855 	INP_INFO_WLOCK(pcbinfo);
856 	INP_WLOCK(inp);
857 	rip_delhash(inp);
858 	inp->inp_faddr.s_addr = INADDR_ANY;
859 	rip_inshash(inp);
860 	SOCK_LOCK(so);
861 	so->so_state &= ~SS_ISCONNECTED;
862 	SOCK_UNLOCK(so);
863 	INP_WUNLOCK(inp);
864 	INP_INFO_WUNLOCK(pcbinfo);
865 }
866 
867 static void
868 rip_abort(struct socket *so)
869 {
870 	struct inpcb *inp;
871 
872 	inp = sotoinpcb(so);
873 	KASSERT(inp != NULL, ("rip_abort: inp == NULL"));
874 
875 	rip_dodisconnect(so, inp);
876 }
877 
878 static void
879 rip_close(struct socket *so)
880 {
881 	struct inpcb *inp;
882 
883 	inp = sotoinpcb(so);
884 	KASSERT(inp != NULL, ("rip_close: inp == NULL"));
885 
886 	rip_dodisconnect(so, inp);
887 }
888 
889 static int
890 rip_disconnect(struct socket *so)
891 {
892 	struct inpcb *inp;
893 
894 	if ((so->so_state & SS_ISCONNECTED) == 0)
895 		return (ENOTCONN);
896 
897 	inp = sotoinpcb(so);
898 	KASSERT(inp != NULL, ("rip_disconnect: inp == NULL"));
899 
900 	rip_dodisconnect(so, inp);
901 	return (0);
902 }
903 
904 static int
905 rip_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
906 {
907 	struct sockaddr_in *addr = (struct sockaddr_in *)nam;
908 	struct inpcb *inp;
909 	int error;
910 
911 	if (nam->sa_len != sizeof(*addr))
912 		return (EINVAL);
913 
914 	error = prison_check_ip4(td->td_ucred, &addr->sin_addr);
915 	if (error != 0)
916 		return (error);
917 
918 	inp = sotoinpcb(so);
919 	KASSERT(inp != NULL, ("rip_bind: inp == NULL"));
920 
921 	if (TAILQ_EMPTY(&V_ifnet) ||
922 	    (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) ||
923 	    (addr->sin_addr.s_addr &&
924 	     (inp->inp_flags & INP_BINDANY) == 0 &&
925 	     ifa_ifwithaddr_check((struct sockaddr *)addr) == 0))
926 		return (EADDRNOTAVAIL);
927 
928 	INP_INFO_WLOCK(&V_ripcbinfo);
929 	INP_WLOCK(inp);
930 	rip_delhash(inp);
931 	inp->inp_laddr = addr->sin_addr;
932 	rip_inshash(inp);
933 	INP_WUNLOCK(inp);
934 	INP_INFO_WUNLOCK(&V_ripcbinfo);
935 	return (0);
936 }
937 
938 static int
939 rip_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
940 {
941 	struct sockaddr_in *addr = (struct sockaddr_in *)nam;
942 	struct inpcb *inp;
943 
944 	if (nam->sa_len != sizeof(*addr))
945 		return (EINVAL);
946 	if (TAILQ_EMPTY(&V_ifnet))
947 		return (EADDRNOTAVAIL);
948 	if (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK)
949 		return (EAFNOSUPPORT);
950 
951 	inp = sotoinpcb(so);
952 	KASSERT(inp != NULL, ("rip_connect: inp == NULL"));
953 
954 	INP_INFO_WLOCK(&V_ripcbinfo);
955 	INP_WLOCK(inp);
956 	rip_delhash(inp);
957 	inp->inp_faddr = addr->sin_addr;
958 	rip_inshash(inp);
959 	soisconnected(so);
960 	INP_WUNLOCK(inp);
961 	INP_INFO_WUNLOCK(&V_ripcbinfo);
962 	return (0);
963 }
964 
965 static int
966 rip_shutdown(struct socket *so)
967 {
968 	struct inpcb *inp;
969 
970 	inp = sotoinpcb(so);
971 	KASSERT(inp != NULL, ("rip_shutdown: inp == NULL"));
972 
973 	INP_WLOCK(inp);
974 	socantsendmore(so);
975 	INP_WUNLOCK(inp);
976 	return (0);
977 }
978 
979 static int
980 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
981     struct mbuf *control, struct thread *td)
982 {
983 	struct inpcb *inp;
984 	u_long dst;
985 
986 	inp = sotoinpcb(so);
987 	KASSERT(inp != NULL, ("rip_send: inp == NULL"));
988 
989 	/*
990 	 * Note: 'dst' reads below are unlocked.
991 	 */
992 	if (so->so_state & SS_ISCONNECTED) {
993 		if (nam) {
994 			m_freem(m);
995 			return (EISCONN);
996 		}
997 		dst = inp->inp_faddr.s_addr;	/* Unlocked read. */
998 	} else {
999 		if (nam == NULL) {
1000 			m_freem(m);
1001 			return (ENOTCONN);
1002 		}
1003 		dst = ((struct sockaddr_in *)nam)->sin_addr.s_addr;
1004 	}
1005 	return (rip_output(m, so, dst));
1006 }
1007 #endif /* INET */
1008 
1009 static int
1010 rip_pcblist(SYSCTL_HANDLER_ARGS)
1011 {
1012 	int error, i, n;
1013 	struct inpcb *inp, **inp_list;
1014 	inp_gen_t gencnt;
1015 	struct xinpgen xig;
1016 
1017 	/*
1018 	 * The process of preparing the TCB list is too time-consuming and
1019 	 * resource-intensive to repeat twice on every request.
1020 	 */
1021 	if (req->oldptr == 0) {
1022 		n = V_ripcbinfo.ipi_count;
1023 		n += imax(n / 8, 10);
1024 		req->oldidx = 2 * (sizeof xig) + n * sizeof(struct xinpcb);
1025 		return (0);
1026 	}
1027 
1028 	if (req->newptr != 0)
1029 		return (EPERM);
1030 
1031 	/*
1032 	 * OK, now we're committed to doing something.
1033 	 */
1034 	INP_INFO_RLOCK(&V_ripcbinfo);
1035 	gencnt = V_ripcbinfo.ipi_gencnt;
1036 	n = V_ripcbinfo.ipi_count;
1037 	INP_INFO_RUNLOCK(&V_ripcbinfo);
1038 
1039 	xig.xig_len = sizeof xig;
1040 	xig.xig_count = n;
1041 	xig.xig_gen = gencnt;
1042 	xig.xig_sogen = so_gencnt;
1043 	error = SYSCTL_OUT(req, &xig, sizeof xig);
1044 	if (error)
1045 		return (error);
1046 
1047 	inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
1048 	if (inp_list == 0)
1049 		return (ENOMEM);
1050 
1051 	INP_INFO_RLOCK(&V_ripcbinfo);
1052 	for (inp = LIST_FIRST(V_ripcbinfo.ipi_listhead), i = 0; inp && i < n;
1053 	     inp = LIST_NEXT(inp, inp_list)) {
1054 		INP_WLOCK(inp);
1055 		if (inp->inp_gencnt <= gencnt &&
1056 		    cr_canseeinpcb(req->td->td_ucred, inp) == 0) {
1057 			in_pcbref(inp);
1058 			inp_list[i++] = inp;
1059 		}
1060 		INP_WUNLOCK(inp);
1061 	}
1062 	INP_INFO_RUNLOCK(&V_ripcbinfo);
1063 	n = i;
1064 
1065 	error = 0;
1066 	for (i = 0; i < n; i++) {
1067 		inp = inp_list[i];
1068 		INP_RLOCK(inp);
1069 		if (inp->inp_gencnt <= gencnt) {
1070 			struct xinpcb xi;
1071 
1072 			bzero(&xi, sizeof(xi));
1073 			xi.xi_len = sizeof xi;
1074 			/* XXX should avoid extra copy */
1075 			bcopy(inp, &xi.xi_inp, sizeof *inp);
1076 			if (inp->inp_socket)
1077 				sotoxsocket(inp->inp_socket, &xi.xi_socket);
1078 			INP_RUNLOCK(inp);
1079 			error = SYSCTL_OUT(req, &xi, sizeof xi);
1080 		} else
1081 			INP_RUNLOCK(inp);
1082 	}
1083 	INP_INFO_WLOCK(&V_ripcbinfo);
1084 	for (i = 0; i < n; i++) {
1085 		inp = inp_list[i];
1086 		INP_RLOCK(inp);
1087 		if (!in_pcbrele_rlocked(inp))
1088 			INP_RUNLOCK(inp);
1089 	}
1090 	INP_INFO_WUNLOCK(&V_ripcbinfo);
1091 
1092 	if (!error) {
1093 		/*
1094 		 * Give the user an updated idea of our state.  If the
1095 		 * generation differs from what we told her before, she knows
1096 		 * that something happened while we were processing this
1097 		 * request, and it might be necessary to retry.
1098 		 */
1099 		INP_INFO_RLOCK(&V_ripcbinfo);
1100 		xig.xig_gen = V_ripcbinfo.ipi_gencnt;
1101 		xig.xig_sogen = so_gencnt;
1102 		xig.xig_count = V_ripcbinfo.ipi_count;
1103 		INP_INFO_RUNLOCK(&V_ripcbinfo);
1104 		error = SYSCTL_OUT(req, &xig, sizeof xig);
1105 	}
1106 	free(inp_list, M_TEMP);
1107 	return (error);
1108 }
1109 
1110 SYSCTL_PROC(_net_inet_raw, OID_AUTO/*XXX*/, pcblist,
1111     CTLTYPE_OPAQUE | CTLFLAG_RD, NULL, 0,
1112     rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
1113 
1114 #ifdef INET
1115 struct pr_usrreqs rip_usrreqs = {
1116 	.pru_abort =		rip_abort,
1117 	.pru_attach =		rip_attach,
1118 	.pru_bind =		rip_bind,
1119 	.pru_connect =		rip_connect,
1120 	.pru_control =		in_control,
1121 	.pru_detach =		rip_detach,
1122 	.pru_disconnect =	rip_disconnect,
1123 	.pru_peeraddr =		in_getpeeraddr,
1124 	.pru_send =		rip_send,
1125 	.pru_shutdown =		rip_shutdown,
1126 	.pru_sockaddr =		in_getsockaddr,
1127 	.pru_sosetlabel =	in_pcbsosetlabel,
1128 	.pru_close =		rip_close,
1129 };
1130 #endif /* INET */
1131