31 */
32
33#include "opt_inet6.h"
34#include "opt_ipsec.h"
35#include "opt_mac.h"
36#include "opt_random_ip_id.h"
37
38#include <sys/param.h>
39#include <sys/jail.h>
40#include <sys/kernel.h>
41#include <sys/lock.h>
42#include <sys/mac.h>
43#include <sys/malloc.h>
44#include <sys/mbuf.h>
45#include <sys/proc.h>
46#include <sys/protosw.h>
47#include <sys/signalvar.h>
48#include <sys/socket.h>
49#include <sys/socketvar.h>
50#include <sys/sx.h>
51#include <sys/sysctl.h>
52#include <sys/systm.h>
53
54#include <vm/uma.h>
55
56#include <net/if.h>
57#include <net/route.h>
58
59#include <netinet/in.h>
60#include <netinet/in_systm.h>
61#include <netinet/in_pcb.h>
62#include <netinet/in_var.h>
63#include <netinet/ip.h>
64#include <netinet/ip_var.h>
65#include <netinet/ip_mroute.h>
66
67#include <netinet/ip_fw.h>
68#include <netinet/ip_dummynet.h>
69
70#ifdef FAST_IPSEC
71#include <netipsec/ipsec.h>
72#endif /*FAST_IPSEC*/
73
74#ifdef IPSEC
75#include <netinet6/ipsec.h>
76#endif /*IPSEC*/
77
78struct inpcbhead ripcb;
79struct inpcbinfo ripcbinfo;
80
81/* control hooks for ipfw and dummynet */
82ip_fw_ctl_t *ip_fw_ctl_ptr;
83ip_dn_ctl_t *ip_dn_ctl_ptr;
84
85/*
86 * hooks for multicast routing. They all default to NULL,
87 * so leave them not initialized and rely on BSS being set to 0.
88 */
89
90/* The socket used to communicate with the multicast routing daemon. */
91struct socket *ip_mrouter;
92
93/* The various mrouter and rsvp functions */
94int (*ip_mrouter_set)(struct socket *, struct sockopt *);
95int (*ip_mrouter_get)(struct socket *, struct sockopt *);
96int (*ip_mrouter_done)(void);
97int (*ip_mforward)(struct ip *, struct ifnet *, struct mbuf *,
98 struct ip_moptions *);
99int (*mrt_ioctl)(int, caddr_t);
100int (*legal_vif_num)(int);
101u_long (*ip_mcast_src)(int);
102
103void (*rsvp_input_p)(struct mbuf *m, int off);
104int (*ip_rsvp_vif)(struct socket *, struct sockopt *);
105void (*ip_rsvp_force_done)(struct socket *);
106
107/*
108 * Nominal space allocated to a raw ip socket.
109 */
110#define RIPSNDQ 8192
111#define RIPRCVQ 8192
112
113/*
114 * Raw interface to IP protocol.
115 */
116
117/*
118 * Initialize raw connection block q.
119 */
120void
121rip_init()
122{
123 INP_INFO_LOCK_INIT(&ripcbinfo, "rip");
124 LIST_INIT(&ripcb);
125 ripcbinfo.listhead = &ripcb;
126 /*
127 * XXX We don't use the hash list for raw IP, but it's easier
128 * to allocate a one entry hash list than it is to check all
129 * over the place for hashbase == NULL.
130 */
131 ripcbinfo.hashbase = hashinit(1, M_PCB, &ripcbinfo.hashmask);
132 ripcbinfo.porthashbase = hashinit(1, M_PCB, &ripcbinfo.porthashmask);
133 ripcbinfo.ipi_zone = uma_zcreate("ripcb", sizeof(struct inpcb),
134 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
135 uma_zone_set_max(ripcbinfo.ipi_zone, maxsockets);
136}
137
138static struct sockaddr_in ripsrc = { sizeof(ripsrc), AF_INET };
139
140static int
141raw_append(struct inpcb *last, struct ip *ip, struct mbuf *n)
142{
143 int policyfail = 0;
144
145 INP_LOCK_ASSERT(last);
146
147#if defined(IPSEC) || defined(FAST_IPSEC)
148 /* check AH/ESP integrity. */
149 if (ipsec4_in_reject(n, last)) {
150 policyfail = 1;
151#ifdef IPSEC
152 ipsecstat.in_polvio++;
153#endif /*IPSEC*/
154 /* do not inject data to pcb */
155 }
156#endif /*IPSEC || FAST_IPSEC*/
157#ifdef MAC
158 if (!policyfail && mac_check_inpcb_deliver(last, n) != 0)
159 policyfail = 1;
160#endif
161 if (!policyfail) {
162 struct mbuf *opts = NULL;
| 31 */
32
33#include "opt_inet6.h"
34#include "opt_ipsec.h"
35#include "opt_mac.h"
36#include "opt_random_ip_id.h"
37
38#include <sys/param.h>
39#include <sys/jail.h>
40#include <sys/kernel.h>
41#include <sys/lock.h>
42#include <sys/mac.h>
43#include <sys/malloc.h>
44#include <sys/mbuf.h>
45#include <sys/proc.h>
46#include <sys/protosw.h>
47#include <sys/signalvar.h>
48#include <sys/socket.h>
49#include <sys/socketvar.h>
50#include <sys/sx.h>
51#include <sys/sysctl.h>
52#include <sys/systm.h>
53
54#include <vm/uma.h>
55
56#include <net/if.h>
57#include <net/route.h>
58
59#include <netinet/in.h>
60#include <netinet/in_systm.h>
61#include <netinet/in_pcb.h>
62#include <netinet/in_var.h>
63#include <netinet/ip.h>
64#include <netinet/ip_var.h>
65#include <netinet/ip_mroute.h>
66
67#include <netinet/ip_fw.h>
68#include <netinet/ip_dummynet.h>
69
70#ifdef FAST_IPSEC
71#include <netipsec/ipsec.h>
72#endif /*FAST_IPSEC*/
73
74#ifdef IPSEC
75#include <netinet6/ipsec.h>
76#endif /*IPSEC*/
77
78struct inpcbhead ripcb;
79struct inpcbinfo ripcbinfo;
80
81/* control hooks for ipfw and dummynet */
82ip_fw_ctl_t *ip_fw_ctl_ptr;
83ip_dn_ctl_t *ip_dn_ctl_ptr;
84
85/*
86 * hooks for multicast routing. They all default to NULL,
87 * so leave them not initialized and rely on BSS being set to 0.
88 */
89
90/* The socket used to communicate with the multicast routing daemon. */
91struct socket *ip_mrouter;
92
93/* The various mrouter and rsvp functions */
94int (*ip_mrouter_set)(struct socket *, struct sockopt *);
95int (*ip_mrouter_get)(struct socket *, struct sockopt *);
96int (*ip_mrouter_done)(void);
97int (*ip_mforward)(struct ip *, struct ifnet *, struct mbuf *,
98 struct ip_moptions *);
99int (*mrt_ioctl)(int, caddr_t);
100int (*legal_vif_num)(int);
101u_long (*ip_mcast_src)(int);
102
103void (*rsvp_input_p)(struct mbuf *m, int off);
104int (*ip_rsvp_vif)(struct socket *, struct sockopt *);
105void (*ip_rsvp_force_done)(struct socket *);
106
107/*
108 * Nominal space allocated to a raw ip socket.
109 */
110#define RIPSNDQ 8192
111#define RIPRCVQ 8192
112
113/*
114 * Raw interface to IP protocol.
115 */
116
117/*
118 * Initialize raw connection block q.
119 */
120void
121rip_init()
122{
123 INP_INFO_LOCK_INIT(&ripcbinfo, "rip");
124 LIST_INIT(&ripcb);
125 ripcbinfo.listhead = &ripcb;
126 /*
127 * XXX We don't use the hash list for raw IP, but it's easier
128 * to allocate a one entry hash list than it is to check all
129 * over the place for hashbase == NULL.
130 */
131 ripcbinfo.hashbase = hashinit(1, M_PCB, &ripcbinfo.hashmask);
132 ripcbinfo.porthashbase = hashinit(1, M_PCB, &ripcbinfo.porthashmask);
133 ripcbinfo.ipi_zone = uma_zcreate("ripcb", sizeof(struct inpcb),
134 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
135 uma_zone_set_max(ripcbinfo.ipi_zone, maxsockets);
136}
137
138static struct sockaddr_in ripsrc = { sizeof(ripsrc), AF_INET };
139
140static int
141raw_append(struct inpcb *last, struct ip *ip, struct mbuf *n)
142{
143 int policyfail = 0;
144
145 INP_LOCK_ASSERT(last);
146
147#if defined(IPSEC) || defined(FAST_IPSEC)
148 /* check AH/ESP integrity. */
149 if (ipsec4_in_reject(n, last)) {
150 policyfail = 1;
151#ifdef IPSEC
152 ipsecstat.in_polvio++;
153#endif /*IPSEC*/
154 /* do not inject data to pcb */
155 }
156#endif /*IPSEC || FAST_IPSEC*/
157#ifdef MAC
158 if (!policyfail && mac_check_inpcb_deliver(last, n) != 0)
159 policyfail = 1;
160#endif
161 if (!policyfail) {
162 struct mbuf *opts = NULL;
|
175 } else
176 m_freem(n);
177 return policyfail;
178}
179
180/*
181 * Setup generic address and protocol structures
182 * for raw_input routine, then pass them along with
183 * mbuf chain.
184 */
185void
186rip_input(struct mbuf *m, int off)
187{
188 struct ip *ip = mtod(m, struct ip *);
189 int proto = ip->ip_p;
190 struct inpcb *inp, *last;
191
192 INP_INFO_RLOCK(&ripcbinfo);
193 ripsrc.sin_addr = ip->ip_src;
194 last = NULL;
195 LIST_FOREACH(inp, &ripcb, inp_list) {
196 INP_LOCK(inp);
197 if (inp->inp_ip_p && inp->inp_ip_p != proto) {
198 docontinue:
199 INP_UNLOCK(inp);
200 continue;
201 }
202#ifdef INET6
203 if ((inp->inp_vflag & INP_IPV4) == 0)
204 goto docontinue;
205#endif
206 if (inp->inp_laddr.s_addr &&
207 inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
208 goto docontinue;
209 if (inp->inp_faddr.s_addr &&
210 inp->inp_faddr.s_addr != ip->ip_src.s_addr)
211 goto docontinue;
212 if (jailed(inp->inp_socket->so_cred))
213 if (htonl(prison_getip(inp->inp_socket->so_cred)) !=
214 ip->ip_dst.s_addr)
215 goto docontinue;
216 if (last) {
217 struct mbuf *n;
218
219 n = m_copy(m, 0, (int)M_COPYALL);
220 if (n != NULL)
221 (void) raw_append(last, ip, n);
222 /* XXX count dropped packet */
223 INP_UNLOCK(last);
224 }
225 last = inp;
226 }
227 if (last != NULL) {
228 if (raw_append(last, ip, m) != 0)
229 ipstat.ips_delivered--;
230 INP_UNLOCK(last);
231 } else {
232 m_freem(m);
233 ipstat.ips_noproto++;
234 ipstat.ips_delivered--;
235 }
236 INP_INFO_RUNLOCK(&ripcbinfo);
237}
238
239/*
240 * Generate IP header and pass packet to ip_output.
241 * Tack on options user may have setup with control call.
242 */
243int
244rip_output(struct mbuf *m, struct socket *so, u_long dst)
245{
246 struct ip *ip;
247 int error;
248 struct inpcb *inp = sotoinpcb(so);
249 int flags = (so->so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
250
251 /*
252 * If the user handed us a complete IP packet, use it.
253 * Otherwise, allocate an mbuf for a header and fill it in.
254 */
255 if ((inp->inp_flags & INP_HDRINCL) == 0) {
256 if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
257 m_freem(m);
258 return(EMSGSIZE);
259 }
260 M_PREPEND(m, sizeof(struct ip), M_TRYWAIT);
261 if (m == NULL)
262 return(ENOBUFS);
263
264 INP_LOCK(inp);
265 ip = mtod(m, struct ip *);
266 ip->ip_tos = inp->inp_ip_tos;
267 ip->ip_off = 0;
268 ip->ip_p = inp->inp_ip_p;
269 ip->ip_len = m->m_pkthdr.len;
270 if (jailed(inp->inp_socket->so_cred))
271 ip->ip_src.s_addr =
272 htonl(prison_getip(inp->inp_socket->so_cred));
273 else
274 ip->ip_src = inp->inp_laddr;
275 ip->ip_dst.s_addr = dst;
276 ip->ip_ttl = inp->inp_ip_ttl;
277 } else {
278 if (m->m_pkthdr.len > IP_MAXPACKET) {
279 m_freem(m);
280 return(EMSGSIZE);
281 }
282 INP_LOCK(inp);
283 ip = mtod(m, struct ip *);
284 if (jailed(inp->inp_socket->so_cred)) {
285 if (ip->ip_src.s_addr !=
286 htonl(prison_getip(inp->inp_socket->so_cred))) {
287 INP_UNLOCK(inp);
288 m_freem(m);
289 return (EPERM);
290 }
291 }
292 /* don't allow both user specified and setsockopt options,
293 and don't allow packet length sizes that will crash */
294 if (((ip->ip_hl != (sizeof (*ip) >> 2))
295 && inp->inp_options)
296 || (ip->ip_len > m->m_pkthdr.len)
297 || (ip->ip_len < (ip->ip_hl << 2))) {
298 INP_UNLOCK(inp);
299 m_freem(m);
300 return EINVAL;
301 }
302 if (ip->ip_id == 0)
303#ifdef RANDOM_IP_ID
304 ip->ip_id = ip_randomid();
305#else
306 ip->ip_id = htons(ip_id++);
307#endif
308 /* XXX prevent ip_output from overwriting header fields */
309 flags |= IP_RAWOUTPUT;
310 ipstat.ips_rawout++;
311 }
312
313 if (inp->inp_flags & INP_ONESBCAST)
314 flags |= IP_SENDONES;
315
316#ifdef MAC
317 mac_create_mbuf_from_inpcb(inp, m);
318#endif
319
320 error = ip_output(m, inp->inp_options, NULL, flags,
321 inp->inp_moptions, inp);
322 INP_UNLOCK(inp);
323 return error;
324}
325
326/*
327 * Raw IP socket option processing.
328 *
329 * Note that access to all of the IP administrative functions here is
330 * implicitly protected by suser() as gaining access to a raw socket
331 * requires either that the thread pass a suser() check, or that it be
332 * passed a raw socket by another thread that has passed a suser() check.
333 * If FreeBSD moves to a more fine-grained access control mechanism,
334 * additional checks will need to be placed here if the raw IP attachment
335 * check is not equivilent the the check required for these
336 * administrative operations; in some cases, these checks are already
337 * present.
338 */
339int
340rip_ctloutput(struct socket *so, struct sockopt *sopt)
341{
342 struct inpcb *inp = sotoinpcb(so);
343 int error, optval;
344
345 if (sopt->sopt_level != IPPROTO_IP)
346 return (EINVAL);
347
348 error = 0;
349
350 switch (sopt->sopt_dir) {
351 case SOPT_GET:
352 switch (sopt->sopt_name) {
353 case IP_HDRINCL:
354 optval = inp->inp_flags & INP_HDRINCL;
355 error = sooptcopyout(sopt, &optval, sizeof optval);
356 break;
357
358 case IP_FW_ADD: /* ADD actually returns the body... */
359 case IP_FW_GET:
360 case IP_FW_TABLE_GETSIZE:
361 case IP_FW_TABLE_LIST:
362 if (IPFW_LOADED)
363 error = ip_fw_ctl_ptr(sopt);
364 else
365 error = ENOPROTOOPT;
366 break;
367
368 case IP_DUMMYNET_GET:
369 if (DUMMYNET_LOADED)
370 error = ip_dn_ctl_ptr(sopt);
371 else
372 error = ENOPROTOOPT;
373 break ;
374
375 case MRT_INIT:
376 case MRT_DONE:
377 case MRT_ADD_VIF:
378 case MRT_DEL_VIF:
379 case MRT_ADD_MFC:
380 case MRT_DEL_MFC:
381 case MRT_VERSION:
382 case MRT_ASSERT:
383 case MRT_API_SUPPORT:
384 case MRT_API_CONFIG:
385 case MRT_ADD_BW_UPCALL:
386 case MRT_DEL_BW_UPCALL:
387 error = ip_mrouter_get ? ip_mrouter_get(so, sopt) :
388 EOPNOTSUPP;
389 break;
390
391 default:
392 error = ip_ctloutput(so, sopt);
393 break;
394 }
395 break;
396
397 case SOPT_SET:
398 switch (sopt->sopt_name) {
399 case IP_HDRINCL:
400 error = sooptcopyin(sopt, &optval, sizeof optval,
401 sizeof optval);
402 if (error)
403 break;
404 if (optval)
405 inp->inp_flags |= INP_HDRINCL;
406 else
407 inp->inp_flags &= ~INP_HDRINCL;
408 break;
409
410 case IP_FW_ADD:
411 case IP_FW_DEL:
412 case IP_FW_FLUSH:
413 case IP_FW_ZERO:
414 case IP_FW_RESETLOG:
415 case IP_FW_TABLE_ADD:
416 case IP_FW_TABLE_DEL:
417 case IP_FW_TABLE_FLUSH:
418 if (IPFW_LOADED)
419 error = ip_fw_ctl_ptr(sopt);
420 else
421 error = ENOPROTOOPT;
422 break;
423
424 case IP_DUMMYNET_CONFIGURE:
425 case IP_DUMMYNET_DEL:
426 case IP_DUMMYNET_FLUSH:
427 if (DUMMYNET_LOADED)
428 error = ip_dn_ctl_ptr(sopt);
429 else
430 error = ENOPROTOOPT ;
431 break ;
432
433 case IP_RSVP_ON:
434 error = ip_rsvp_init(so);
435 break;
436
437 case IP_RSVP_OFF:
438 error = ip_rsvp_done();
439 break;
440
441 case IP_RSVP_VIF_ON:
442 case IP_RSVP_VIF_OFF:
443 error = ip_rsvp_vif ?
444 ip_rsvp_vif(so, sopt) : EINVAL;
445 break;
446
447 case MRT_INIT:
448 case MRT_DONE:
449 case MRT_ADD_VIF:
450 case MRT_DEL_VIF:
451 case MRT_ADD_MFC:
452 case MRT_DEL_MFC:
453 case MRT_VERSION:
454 case MRT_ASSERT:
455 case MRT_API_SUPPORT:
456 case MRT_API_CONFIG:
457 case MRT_ADD_BW_UPCALL:
458 case MRT_DEL_BW_UPCALL:
459 error = ip_mrouter_set ? ip_mrouter_set(so, sopt) :
460 EOPNOTSUPP;
461 break;
462
463 default:
464 error = ip_ctloutput(so, sopt);
465 break;
466 }
467 break;
468 }
469
470 return (error);
471}
472
473/*
474 * This function exists solely to receive the PRC_IFDOWN messages which
475 * are sent by if_down(). It looks for an ifaddr whose ifa_addr is sa,
476 * and calls in_ifadown() to remove all routes corresponding to that address.
477 * It also receives the PRC_IFUP messages from if_up() and reinstalls the
478 * interface routes.
479 */
480void
481rip_ctlinput(int cmd, struct sockaddr *sa, void *vip)
482{
483 struct in_ifaddr *ia;
484 struct ifnet *ifp;
485 int err;
486 int flags;
487
488 switch (cmd) {
489 case PRC_IFDOWN:
490 TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
491 if (ia->ia_ifa.ifa_addr == sa
492 && (ia->ia_flags & IFA_ROUTE)) {
493 /*
494 * in_ifscrub kills the interface route.
495 */
496 in_ifscrub(ia->ia_ifp, ia);
497 /*
498 * in_ifadown gets rid of all the rest of
499 * the routes. This is not quite the right
500 * thing to do, but at least if we are running
501 * a routing process they will come back.
502 */
503 in_ifadown(&ia->ia_ifa, 0);
504 break;
505 }
506 }
507 break;
508
509 case PRC_IFUP:
510 TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
511 if (ia->ia_ifa.ifa_addr == sa)
512 break;
513 }
514 if (ia == 0 || (ia->ia_flags & IFA_ROUTE))
515 return;
516 flags = RTF_UP;
517 ifp = ia->ia_ifa.ifa_ifp;
518
519 if ((ifp->if_flags & IFF_LOOPBACK)
520 || (ifp->if_flags & IFF_POINTOPOINT))
521 flags |= RTF_HOST;
522
523 err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
524 if (err == 0)
525 ia->ia_flags |= IFA_ROUTE;
526 break;
527 }
528}
529
530u_long rip_sendspace = RIPSNDQ;
531u_long rip_recvspace = RIPRCVQ;
532
533SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW,
534 &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
535SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW,
536 &rip_recvspace, 0, "Maximum space for incoming raw IP datagrams");
537
538static int
539rip_attach(struct socket *so, int proto, struct thread *td)
540{
541 struct inpcb *inp;
542 int error;
543
544 /* XXX why not lower? */
545 INP_INFO_WLOCK(&ripcbinfo);
546 inp = sotoinpcb(so);
547 if (inp) {
548 /* XXX counter, printf */
549 INP_INFO_WUNLOCK(&ripcbinfo);
550 return EINVAL;
551 }
552 if (td && jailed(td->td_ucred) && !jail_allow_raw_sockets) {
553 INP_INFO_WUNLOCK(&ripcbinfo);
554 return (EPERM);
555 }
556 if (td && (error = suser_cred(td->td_ucred, PRISON_ROOT)) != 0) {
557 INP_INFO_WUNLOCK(&ripcbinfo);
558 return error;
559 }
560 if (proto >= IPPROTO_MAX || proto < 0) {
561 INP_INFO_WUNLOCK(&ripcbinfo);
562 return EPROTONOSUPPORT;
563 }
564
565 error = soreserve(so, rip_sendspace, rip_recvspace);
566 if (error) {
567 INP_INFO_WUNLOCK(&ripcbinfo);
568 return error;
569 }
570 error = in_pcballoc(so, &ripcbinfo, "rawinp");
571 if (error) {
572 INP_INFO_WUNLOCK(&ripcbinfo);
573 return error;
574 }
575 inp = (struct inpcb *)so->so_pcb;
576 INP_LOCK(inp);
577 INP_INFO_WUNLOCK(&ripcbinfo);
578 inp->inp_vflag |= INP_IPV4;
579 inp->inp_ip_p = proto;
580 inp->inp_ip_ttl = ip_defttl;
581 INP_UNLOCK(inp);
582 return 0;
583}
584
585static void
586rip_pcbdetach(struct socket *so, struct inpcb *inp)
587{
588 INP_INFO_WLOCK_ASSERT(&ripcbinfo);
589 INP_LOCK_ASSERT(inp);
590
591 if (so == ip_mrouter && ip_mrouter_done)
592 ip_mrouter_done();
593 if (ip_rsvp_force_done)
594 ip_rsvp_force_done(so);
595 if (so == ip_rsvpd)
596 ip_rsvp_done();
597 in_pcbdetach(inp);
598}
599
600static int
601rip_detach(struct socket *so)
602{
603 struct inpcb *inp;
604
605 INP_INFO_WLOCK(&ripcbinfo);
606 inp = sotoinpcb(so);
607 if (inp == 0) {
608 /* XXX counter, printf */
609 INP_INFO_WUNLOCK(&ripcbinfo);
610 return EINVAL;
611 }
612 INP_LOCK(inp);
613 rip_pcbdetach(so, inp);
614 INP_INFO_WUNLOCK(&ripcbinfo);
615 return 0;
616}
617
618static int
619rip_abort(struct socket *so)
620{
621 struct inpcb *inp;
622
623 INP_INFO_WLOCK(&ripcbinfo);
624 inp = sotoinpcb(so);
625 if (inp == 0) {
626 INP_INFO_WUNLOCK(&ripcbinfo);
627 return EINVAL; /* ??? possible? panic instead? */
628 }
629 INP_LOCK(inp);
630 soisdisconnected(so);
631 if (so->so_state & SS_NOFDREF)
632 rip_pcbdetach(so, inp);
633 else
634 INP_UNLOCK(inp);
635 INP_INFO_WUNLOCK(&ripcbinfo);
636 return 0;
637}
638
639static int
640rip_disconnect(struct socket *so)
641{
642 if ((so->so_state & SS_ISCONNECTED) == 0)
643 return ENOTCONN;
644 return rip_abort(so);
645}
646
647static int
648rip_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
649{
650 struct sockaddr_in *addr = (struct sockaddr_in *)nam;
651 struct inpcb *inp;
652
653 if (nam->sa_len != sizeof(*addr))
654 return EINVAL;
655
656 if (jailed(td->td_ucred)) {
657 if (addr->sin_addr.s_addr == INADDR_ANY)
658 addr->sin_addr.s_addr =
659 htonl(prison_getip(td->td_ucred));
660 if (htonl(prison_getip(td->td_ucred)) != addr->sin_addr.s_addr)
661 return (EADDRNOTAVAIL);
662 }
663
664 if (TAILQ_EMPTY(&ifnet) ||
665 (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) ||
666 (addr->sin_addr.s_addr &&
667 ifa_ifwithaddr((struct sockaddr *)addr) == 0))
668 return EADDRNOTAVAIL;
669
670 INP_INFO_WLOCK(&ripcbinfo);
671 inp = sotoinpcb(so);
672 if (inp == 0) {
673 INP_INFO_WUNLOCK(&ripcbinfo);
674 return EINVAL;
675 }
676 INP_LOCK(inp);
677 inp->inp_laddr = addr->sin_addr;
678 INP_UNLOCK(inp);
679 INP_INFO_WUNLOCK(&ripcbinfo);
680 return 0;
681}
682
683static int
684rip_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
685{
686 struct sockaddr_in *addr = (struct sockaddr_in *)nam;
687 struct inpcb *inp;
688
689 if (nam->sa_len != sizeof(*addr))
690 return EINVAL;
691 if (TAILQ_EMPTY(&ifnet))
692 return EADDRNOTAVAIL;
693 if (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK)
694 return EAFNOSUPPORT;
695
696 INP_INFO_WLOCK(&ripcbinfo);
697 inp = sotoinpcb(so);
698 if (inp == 0) {
699 INP_INFO_WUNLOCK(&ripcbinfo);
700 return EINVAL;
701 }
702 INP_LOCK(inp);
703 inp->inp_faddr = addr->sin_addr;
704 soisconnected(so);
705 INP_UNLOCK(inp);
706 INP_INFO_WUNLOCK(&ripcbinfo);
707 return 0;
708}
709
710static int
711rip_shutdown(struct socket *so)
712{
713 struct inpcb *inp;
714
715 INP_INFO_RLOCK(&ripcbinfo);
716 inp = sotoinpcb(so);
717 if (inp == 0) {
718 INP_INFO_RUNLOCK(&ripcbinfo);
719 return EINVAL;
720 }
721 INP_LOCK(inp);
722 INP_INFO_RUNLOCK(&ripcbinfo);
723 socantsendmore(so);
724 INP_UNLOCK(inp);
725 return 0;
726}
727
728static int
729rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
730 struct mbuf *control, struct thread *td)
731{
732 struct inpcb *inp;
733 u_long dst;
734 int ret;
735
736 INP_INFO_WLOCK(&ripcbinfo);
737 inp = sotoinpcb(so);
738 if (so->so_state & SS_ISCONNECTED) {
739 if (nam) {
740 INP_INFO_WUNLOCK(&ripcbinfo);
741 m_freem(m);
742 return EISCONN;
743 }
744 dst = inp->inp_faddr.s_addr;
745 } else {
746 if (nam == NULL) {
747 INP_INFO_WUNLOCK(&ripcbinfo);
748 m_freem(m);
749 return ENOTCONN;
750 }
751 dst = ((struct sockaddr_in *)nam)->sin_addr.s_addr;
752 }
753 ret = rip_output(m, so, dst);
754 INP_INFO_WUNLOCK(&ripcbinfo);
755 return ret;
756}
757
758static int
759rip_pcblist(SYSCTL_HANDLER_ARGS)
760{
761 int error, i, n;
762 struct inpcb *inp, **inp_list;
763 inp_gen_t gencnt;
764 struct xinpgen xig;
765
766 /*
767 * The process of preparing the TCB list is too time-consuming and
768 * resource-intensive to repeat twice on every request.
769 */
770 if (req->oldptr == 0) {
771 n = ripcbinfo.ipi_count;
772 req->oldidx = 2 * (sizeof xig)
773 + (n + n/8) * sizeof(struct xinpcb);
774 return 0;
775 }
776
777 if (req->newptr != 0)
778 return EPERM;
779
780 /*
781 * OK, now we're committed to doing something.
782 */
783 INP_INFO_RLOCK(&ripcbinfo);
784 gencnt = ripcbinfo.ipi_gencnt;
785 n = ripcbinfo.ipi_count;
786 INP_INFO_RUNLOCK(&ripcbinfo);
787
788 xig.xig_len = sizeof xig;
789 xig.xig_count = n;
790 xig.xig_gen = gencnt;
791 xig.xig_sogen = so_gencnt;
792 error = SYSCTL_OUT(req, &xig, sizeof xig);
793 if (error)
794 return error;
795
796 inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
797 if (inp_list == 0)
798 return ENOMEM;
799
800 INP_INFO_RLOCK(&ripcbinfo);
801 for (inp = LIST_FIRST(ripcbinfo.listhead), i = 0; inp && i < n;
802 inp = LIST_NEXT(inp, inp_list)) {
803 INP_LOCK(inp);
804 if (inp->inp_gencnt <= gencnt &&
805 cr_canseesocket(req->td->td_ucred, inp->inp_socket) == 0) {
806 /* XXX held references? */
807 inp_list[i++] = inp;
808 }
809 INP_UNLOCK(inp);
810 }
811 INP_INFO_RUNLOCK(&ripcbinfo);
812 n = i;
813
814 error = 0;
815 for (i = 0; i < n; i++) {
816 inp = inp_list[i];
817 if (inp->inp_gencnt <= gencnt) {
818 struct xinpcb xi;
819 xi.xi_len = sizeof xi;
820 /* XXX should avoid extra copy */
821 bcopy(inp, &xi.xi_inp, sizeof *inp);
822 if (inp->inp_socket)
823 sotoxsocket(inp->inp_socket, &xi.xi_socket);
824 error = SYSCTL_OUT(req, &xi, sizeof xi);
825 }
826 }
827 if (!error) {
828 /*
829 * Give the user an updated idea of our state.
830 * If the generation differs from what we told
831 * her before, she knows that something happened
832 * while we were processing this request, and it
833 * might be necessary to retry.
834 */
835 INP_INFO_RLOCK(&ripcbinfo);
836 xig.xig_gen = ripcbinfo.ipi_gencnt;
837 xig.xig_sogen = so_gencnt;
838 xig.xig_count = ripcbinfo.ipi_count;
839 INP_INFO_RUNLOCK(&ripcbinfo);
840 error = SYSCTL_OUT(req, &xig, sizeof xig);
841 }
842 free(inp_list, M_TEMP);
843 return error;
844}
845
846/*
847 * This is the wrapper function for in_setsockaddr. We just pass down
848 * the pcbinfo for in_setpeeraddr to lock.
849 */
850static int
851rip_sockaddr(struct socket *so, struct sockaddr **nam)
852{
853 return (in_setsockaddr(so, nam, &ripcbinfo));
854}
855
856/*
857 * This is the wrapper function for in_setpeeraddr. We just pass down
858 * the pcbinfo for in_setpeeraddr to lock.
859 */
860static int
861rip_peeraddr(struct socket *so, struct sockaddr **nam)
862{
863 return (in_setpeeraddr(so, nam, &ripcbinfo));
864}
865
866
867SYSCTL_PROC(_net_inet_raw, OID_AUTO/*XXX*/, pcblist, CTLFLAG_RD, 0, 0,
868 rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
869
870struct pr_usrreqs rip_usrreqs = {
871 rip_abort, pru_accept_notsupp, rip_attach, rip_bind, rip_connect,
872 pru_connect2_notsupp, in_control, rip_detach, rip_disconnect,
873 pru_listen_notsupp, rip_peeraddr, pru_rcvd_notsupp,
874 pru_rcvoob_notsupp, rip_send, pru_sense_null, rip_shutdown,
875 rip_sockaddr, sosend, soreceive, sopoll, in_pcbsosetlabel
876};
| 179 } else
180 m_freem(n);
181 return policyfail;
182}
183
184/*
185 * Setup generic address and protocol structures
186 * for raw_input routine, then pass them along with
187 * mbuf chain.
188 */
189void
190rip_input(struct mbuf *m, int off)
191{
192 struct ip *ip = mtod(m, struct ip *);
193 int proto = ip->ip_p;
194 struct inpcb *inp, *last;
195
196 INP_INFO_RLOCK(&ripcbinfo);
197 ripsrc.sin_addr = ip->ip_src;
198 last = NULL;
199 LIST_FOREACH(inp, &ripcb, inp_list) {
200 INP_LOCK(inp);
201 if (inp->inp_ip_p && inp->inp_ip_p != proto) {
202 docontinue:
203 INP_UNLOCK(inp);
204 continue;
205 }
206#ifdef INET6
207 if ((inp->inp_vflag & INP_IPV4) == 0)
208 goto docontinue;
209#endif
210 if (inp->inp_laddr.s_addr &&
211 inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
212 goto docontinue;
213 if (inp->inp_faddr.s_addr &&
214 inp->inp_faddr.s_addr != ip->ip_src.s_addr)
215 goto docontinue;
216 if (jailed(inp->inp_socket->so_cred))
217 if (htonl(prison_getip(inp->inp_socket->so_cred)) !=
218 ip->ip_dst.s_addr)
219 goto docontinue;
220 if (last) {
221 struct mbuf *n;
222
223 n = m_copy(m, 0, (int)M_COPYALL);
224 if (n != NULL)
225 (void) raw_append(last, ip, n);
226 /* XXX count dropped packet */
227 INP_UNLOCK(last);
228 }
229 last = inp;
230 }
231 if (last != NULL) {
232 if (raw_append(last, ip, m) != 0)
233 ipstat.ips_delivered--;
234 INP_UNLOCK(last);
235 } else {
236 m_freem(m);
237 ipstat.ips_noproto++;
238 ipstat.ips_delivered--;
239 }
240 INP_INFO_RUNLOCK(&ripcbinfo);
241}
242
243/*
244 * Generate IP header and pass packet to ip_output.
245 * Tack on options user may have setup with control call.
246 */
247int
248rip_output(struct mbuf *m, struct socket *so, u_long dst)
249{
250 struct ip *ip;
251 int error;
252 struct inpcb *inp = sotoinpcb(so);
253 int flags = (so->so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
254
255 /*
256 * If the user handed us a complete IP packet, use it.
257 * Otherwise, allocate an mbuf for a header and fill it in.
258 */
259 if ((inp->inp_flags & INP_HDRINCL) == 0) {
260 if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
261 m_freem(m);
262 return(EMSGSIZE);
263 }
264 M_PREPEND(m, sizeof(struct ip), M_TRYWAIT);
265 if (m == NULL)
266 return(ENOBUFS);
267
268 INP_LOCK(inp);
269 ip = mtod(m, struct ip *);
270 ip->ip_tos = inp->inp_ip_tos;
271 ip->ip_off = 0;
272 ip->ip_p = inp->inp_ip_p;
273 ip->ip_len = m->m_pkthdr.len;
274 if (jailed(inp->inp_socket->so_cred))
275 ip->ip_src.s_addr =
276 htonl(prison_getip(inp->inp_socket->so_cred));
277 else
278 ip->ip_src = inp->inp_laddr;
279 ip->ip_dst.s_addr = dst;
280 ip->ip_ttl = inp->inp_ip_ttl;
281 } else {
282 if (m->m_pkthdr.len > IP_MAXPACKET) {
283 m_freem(m);
284 return(EMSGSIZE);
285 }
286 INP_LOCK(inp);
287 ip = mtod(m, struct ip *);
288 if (jailed(inp->inp_socket->so_cred)) {
289 if (ip->ip_src.s_addr !=
290 htonl(prison_getip(inp->inp_socket->so_cred))) {
291 INP_UNLOCK(inp);
292 m_freem(m);
293 return (EPERM);
294 }
295 }
296 /* don't allow both user specified and setsockopt options,
297 and don't allow packet length sizes that will crash */
298 if (((ip->ip_hl != (sizeof (*ip) >> 2))
299 && inp->inp_options)
300 || (ip->ip_len > m->m_pkthdr.len)
301 || (ip->ip_len < (ip->ip_hl << 2))) {
302 INP_UNLOCK(inp);
303 m_freem(m);
304 return EINVAL;
305 }
306 if (ip->ip_id == 0)
307#ifdef RANDOM_IP_ID
308 ip->ip_id = ip_randomid();
309#else
310 ip->ip_id = htons(ip_id++);
311#endif
312 /* XXX prevent ip_output from overwriting header fields */
313 flags |= IP_RAWOUTPUT;
314 ipstat.ips_rawout++;
315 }
316
317 if (inp->inp_flags & INP_ONESBCAST)
318 flags |= IP_SENDONES;
319
320#ifdef MAC
321 mac_create_mbuf_from_inpcb(inp, m);
322#endif
323
324 error = ip_output(m, inp->inp_options, NULL, flags,
325 inp->inp_moptions, inp);
326 INP_UNLOCK(inp);
327 return error;
328}
329
330/*
331 * Raw IP socket option processing.
332 *
333 * Note that access to all of the IP administrative functions here is
334 * implicitly protected by suser() as gaining access to a raw socket
335 * requires either that the thread pass a suser() check, or that it be
336 * passed a raw socket by another thread that has passed a suser() check.
337 * If FreeBSD moves to a more fine-grained access control mechanism,
338 * additional checks will need to be placed here if the raw IP attachment
339 * check is not equivilent the the check required for these
340 * administrative operations; in some cases, these checks are already
341 * present.
342 */
343int
344rip_ctloutput(struct socket *so, struct sockopt *sopt)
345{
346 struct inpcb *inp = sotoinpcb(so);
347 int error, optval;
348
349 if (sopt->sopt_level != IPPROTO_IP)
350 return (EINVAL);
351
352 error = 0;
353
354 switch (sopt->sopt_dir) {
355 case SOPT_GET:
356 switch (sopt->sopt_name) {
357 case IP_HDRINCL:
358 optval = inp->inp_flags & INP_HDRINCL;
359 error = sooptcopyout(sopt, &optval, sizeof optval);
360 break;
361
362 case IP_FW_ADD: /* ADD actually returns the body... */
363 case IP_FW_GET:
364 case IP_FW_TABLE_GETSIZE:
365 case IP_FW_TABLE_LIST:
366 if (IPFW_LOADED)
367 error = ip_fw_ctl_ptr(sopt);
368 else
369 error = ENOPROTOOPT;
370 break;
371
372 case IP_DUMMYNET_GET:
373 if (DUMMYNET_LOADED)
374 error = ip_dn_ctl_ptr(sopt);
375 else
376 error = ENOPROTOOPT;
377 break ;
378
379 case MRT_INIT:
380 case MRT_DONE:
381 case MRT_ADD_VIF:
382 case MRT_DEL_VIF:
383 case MRT_ADD_MFC:
384 case MRT_DEL_MFC:
385 case MRT_VERSION:
386 case MRT_ASSERT:
387 case MRT_API_SUPPORT:
388 case MRT_API_CONFIG:
389 case MRT_ADD_BW_UPCALL:
390 case MRT_DEL_BW_UPCALL:
391 error = ip_mrouter_get ? ip_mrouter_get(so, sopt) :
392 EOPNOTSUPP;
393 break;
394
395 default:
396 error = ip_ctloutput(so, sopt);
397 break;
398 }
399 break;
400
401 case SOPT_SET:
402 switch (sopt->sopt_name) {
403 case IP_HDRINCL:
404 error = sooptcopyin(sopt, &optval, sizeof optval,
405 sizeof optval);
406 if (error)
407 break;
408 if (optval)
409 inp->inp_flags |= INP_HDRINCL;
410 else
411 inp->inp_flags &= ~INP_HDRINCL;
412 break;
413
414 case IP_FW_ADD:
415 case IP_FW_DEL:
416 case IP_FW_FLUSH:
417 case IP_FW_ZERO:
418 case IP_FW_RESETLOG:
419 case IP_FW_TABLE_ADD:
420 case IP_FW_TABLE_DEL:
421 case IP_FW_TABLE_FLUSH:
422 if (IPFW_LOADED)
423 error = ip_fw_ctl_ptr(sopt);
424 else
425 error = ENOPROTOOPT;
426 break;
427
428 case IP_DUMMYNET_CONFIGURE:
429 case IP_DUMMYNET_DEL:
430 case IP_DUMMYNET_FLUSH:
431 if (DUMMYNET_LOADED)
432 error = ip_dn_ctl_ptr(sopt);
433 else
434 error = ENOPROTOOPT ;
435 break ;
436
437 case IP_RSVP_ON:
438 error = ip_rsvp_init(so);
439 break;
440
441 case IP_RSVP_OFF:
442 error = ip_rsvp_done();
443 break;
444
445 case IP_RSVP_VIF_ON:
446 case IP_RSVP_VIF_OFF:
447 error = ip_rsvp_vif ?
448 ip_rsvp_vif(so, sopt) : EINVAL;
449 break;
450
451 case MRT_INIT:
452 case MRT_DONE:
453 case MRT_ADD_VIF:
454 case MRT_DEL_VIF:
455 case MRT_ADD_MFC:
456 case MRT_DEL_MFC:
457 case MRT_VERSION:
458 case MRT_ASSERT:
459 case MRT_API_SUPPORT:
460 case MRT_API_CONFIG:
461 case MRT_ADD_BW_UPCALL:
462 case MRT_DEL_BW_UPCALL:
463 error = ip_mrouter_set ? ip_mrouter_set(so, sopt) :
464 EOPNOTSUPP;
465 break;
466
467 default:
468 error = ip_ctloutput(so, sopt);
469 break;
470 }
471 break;
472 }
473
474 return (error);
475}
476
477/*
478 * This function exists solely to receive the PRC_IFDOWN messages which
479 * are sent by if_down(). It looks for an ifaddr whose ifa_addr is sa,
480 * and calls in_ifadown() to remove all routes corresponding to that address.
481 * It also receives the PRC_IFUP messages from if_up() and reinstalls the
482 * interface routes.
483 */
484void
485rip_ctlinput(int cmd, struct sockaddr *sa, void *vip)
486{
487 struct in_ifaddr *ia;
488 struct ifnet *ifp;
489 int err;
490 int flags;
491
492 switch (cmd) {
493 case PRC_IFDOWN:
494 TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
495 if (ia->ia_ifa.ifa_addr == sa
496 && (ia->ia_flags & IFA_ROUTE)) {
497 /*
498 * in_ifscrub kills the interface route.
499 */
500 in_ifscrub(ia->ia_ifp, ia);
501 /*
502 * in_ifadown gets rid of all the rest of
503 * the routes. This is not quite the right
504 * thing to do, but at least if we are running
505 * a routing process they will come back.
506 */
507 in_ifadown(&ia->ia_ifa, 0);
508 break;
509 }
510 }
511 break;
512
513 case PRC_IFUP:
514 TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
515 if (ia->ia_ifa.ifa_addr == sa)
516 break;
517 }
518 if (ia == 0 || (ia->ia_flags & IFA_ROUTE))
519 return;
520 flags = RTF_UP;
521 ifp = ia->ia_ifa.ifa_ifp;
522
523 if ((ifp->if_flags & IFF_LOOPBACK)
524 || (ifp->if_flags & IFF_POINTOPOINT))
525 flags |= RTF_HOST;
526
527 err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
528 if (err == 0)
529 ia->ia_flags |= IFA_ROUTE;
530 break;
531 }
532}
533
534u_long rip_sendspace = RIPSNDQ;
535u_long rip_recvspace = RIPRCVQ;
536
537SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW,
538 &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
539SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW,
540 &rip_recvspace, 0, "Maximum space for incoming raw IP datagrams");
541
542static int
543rip_attach(struct socket *so, int proto, struct thread *td)
544{
545 struct inpcb *inp;
546 int error;
547
548 /* XXX why not lower? */
549 INP_INFO_WLOCK(&ripcbinfo);
550 inp = sotoinpcb(so);
551 if (inp) {
552 /* XXX counter, printf */
553 INP_INFO_WUNLOCK(&ripcbinfo);
554 return EINVAL;
555 }
556 if (td && jailed(td->td_ucred) && !jail_allow_raw_sockets) {
557 INP_INFO_WUNLOCK(&ripcbinfo);
558 return (EPERM);
559 }
560 if (td && (error = suser_cred(td->td_ucred, PRISON_ROOT)) != 0) {
561 INP_INFO_WUNLOCK(&ripcbinfo);
562 return error;
563 }
564 if (proto >= IPPROTO_MAX || proto < 0) {
565 INP_INFO_WUNLOCK(&ripcbinfo);
566 return EPROTONOSUPPORT;
567 }
568
569 error = soreserve(so, rip_sendspace, rip_recvspace);
570 if (error) {
571 INP_INFO_WUNLOCK(&ripcbinfo);
572 return error;
573 }
574 error = in_pcballoc(so, &ripcbinfo, "rawinp");
575 if (error) {
576 INP_INFO_WUNLOCK(&ripcbinfo);
577 return error;
578 }
579 inp = (struct inpcb *)so->so_pcb;
580 INP_LOCK(inp);
581 INP_INFO_WUNLOCK(&ripcbinfo);
582 inp->inp_vflag |= INP_IPV4;
583 inp->inp_ip_p = proto;
584 inp->inp_ip_ttl = ip_defttl;
585 INP_UNLOCK(inp);
586 return 0;
587}
588
589static void
590rip_pcbdetach(struct socket *so, struct inpcb *inp)
591{
592 INP_INFO_WLOCK_ASSERT(&ripcbinfo);
593 INP_LOCK_ASSERT(inp);
594
595 if (so == ip_mrouter && ip_mrouter_done)
596 ip_mrouter_done();
597 if (ip_rsvp_force_done)
598 ip_rsvp_force_done(so);
599 if (so == ip_rsvpd)
600 ip_rsvp_done();
601 in_pcbdetach(inp);
602}
603
604static int
605rip_detach(struct socket *so)
606{
607 struct inpcb *inp;
608
609 INP_INFO_WLOCK(&ripcbinfo);
610 inp = sotoinpcb(so);
611 if (inp == 0) {
612 /* XXX counter, printf */
613 INP_INFO_WUNLOCK(&ripcbinfo);
614 return EINVAL;
615 }
616 INP_LOCK(inp);
617 rip_pcbdetach(so, inp);
618 INP_INFO_WUNLOCK(&ripcbinfo);
619 return 0;
620}
621
622static int
623rip_abort(struct socket *so)
624{
625 struct inpcb *inp;
626
627 INP_INFO_WLOCK(&ripcbinfo);
628 inp = sotoinpcb(so);
629 if (inp == 0) {
630 INP_INFO_WUNLOCK(&ripcbinfo);
631 return EINVAL; /* ??? possible? panic instead? */
632 }
633 INP_LOCK(inp);
634 soisdisconnected(so);
635 if (so->so_state & SS_NOFDREF)
636 rip_pcbdetach(so, inp);
637 else
638 INP_UNLOCK(inp);
639 INP_INFO_WUNLOCK(&ripcbinfo);
640 return 0;
641}
642
643static int
644rip_disconnect(struct socket *so)
645{
646 if ((so->so_state & SS_ISCONNECTED) == 0)
647 return ENOTCONN;
648 return rip_abort(so);
649}
650
651static int
652rip_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
653{
654 struct sockaddr_in *addr = (struct sockaddr_in *)nam;
655 struct inpcb *inp;
656
657 if (nam->sa_len != sizeof(*addr))
658 return EINVAL;
659
660 if (jailed(td->td_ucred)) {
661 if (addr->sin_addr.s_addr == INADDR_ANY)
662 addr->sin_addr.s_addr =
663 htonl(prison_getip(td->td_ucred));
664 if (htonl(prison_getip(td->td_ucred)) != addr->sin_addr.s_addr)
665 return (EADDRNOTAVAIL);
666 }
667
668 if (TAILQ_EMPTY(&ifnet) ||
669 (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) ||
670 (addr->sin_addr.s_addr &&
671 ifa_ifwithaddr((struct sockaddr *)addr) == 0))
672 return EADDRNOTAVAIL;
673
674 INP_INFO_WLOCK(&ripcbinfo);
675 inp = sotoinpcb(so);
676 if (inp == 0) {
677 INP_INFO_WUNLOCK(&ripcbinfo);
678 return EINVAL;
679 }
680 INP_LOCK(inp);
681 inp->inp_laddr = addr->sin_addr;
682 INP_UNLOCK(inp);
683 INP_INFO_WUNLOCK(&ripcbinfo);
684 return 0;
685}
686
687static int
688rip_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
689{
690 struct sockaddr_in *addr = (struct sockaddr_in *)nam;
691 struct inpcb *inp;
692
693 if (nam->sa_len != sizeof(*addr))
694 return EINVAL;
695 if (TAILQ_EMPTY(&ifnet))
696 return EADDRNOTAVAIL;
697 if (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK)
698 return EAFNOSUPPORT;
699
700 INP_INFO_WLOCK(&ripcbinfo);
701 inp = sotoinpcb(so);
702 if (inp == 0) {
703 INP_INFO_WUNLOCK(&ripcbinfo);
704 return EINVAL;
705 }
706 INP_LOCK(inp);
707 inp->inp_faddr = addr->sin_addr;
708 soisconnected(so);
709 INP_UNLOCK(inp);
710 INP_INFO_WUNLOCK(&ripcbinfo);
711 return 0;
712}
713
714static int
715rip_shutdown(struct socket *so)
716{
717 struct inpcb *inp;
718
719 INP_INFO_RLOCK(&ripcbinfo);
720 inp = sotoinpcb(so);
721 if (inp == 0) {
722 INP_INFO_RUNLOCK(&ripcbinfo);
723 return EINVAL;
724 }
725 INP_LOCK(inp);
726 INP_INFO_RUNLOCK(&ripcbinfo);
727 socantsendmore(so);
728 INP_UNLOCK(inp);
729 return 0;
730}
731
732static int
733rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
734 struct mbuf *control, struct thread *td)
735{
736 struct inpcb *inp;
737 u_long dst;
738 int ret;
739
740 INP_INFO_WLOCK(&ripcbinfo);
741 inp = sotoinpcb(so);
742 if (so->so_state & SS_ISCONNECTED) {
743 if (nam) {
744 INP_INFO_WUNLOCK(&ripcbinfo);
745 m_freem(m);
746 return EISCONN;
747 }
748 dst = inp->inp_faddr.s_addr;
749 } else {
750 if (nam == NULL) {
751 INP_INFO_WUNLOCK(&ripcbinfo);
752 m_freem(m);
753 return ENOTCONN;
754 }
755 dst = ((struct sockaddr_in *)nam)->sin_addr.s_addr;
756 }
757 ret = rip_output(m, so, dst);
758 INP_INFO_WUNLOCK(&ripcbinfo);
759 return ret;
760}
761
762static int
763rip_pcblist(SYSCTL_HANDLER_ARGS)
764{
765 int error, i, n;
766 struct inpcb *inp, **inp_list;
767 inp_gen_t gencnt;
768 struct xinpgen xig;
769
770 /*
771 * The process of preparing the TCB list is too time-consuming and
772 * resource-intensive to repeat twice on every request.
773 */
774 if (req->oldptr == 0) {
775 n = ripcbinfo.ipi_count;
776 req->oldidx = 2 * (sizeof xig)
777 + (n + n/8) * sizeof(struct xinpcb);
778 return 0;
779 }
780
781 if (req->newptr != 0)
782 return EPERM;
783
784 /*
785 * OK, now we're committed to doing something.
786 */
787 INP_INFO_RLOCK(&ripcbinfo);
788 gencnt = ripcbinfo.ipi_gencnt;
789 n = ripcbinfo.ipi_count;
790 INP_INFO_RUNLOCK(&ripcbinfo);
791
792 xig.xig_len = sizeof xig;
793 xig.xig_count = n;
794 xig.xig_gen = gencnt;
795 xig.xig_sogen = so_gencnt;
796 error = SYSCTL_OUT(req, &xig, sizeof xig);
797 if (error)
798 return error;
799
800 inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
801 if (inp_list == 0)
802 return ENOMEM;
803
804 INP_INFO_RLOCK(&ripcbinfo);
805 for (inp = LIST_FIRST(ripcbinfo.listhead), i = 0; inp && i < n;
806 inp = LIST_NEXT(inp, inp_list)) {
807 INP_LOCK(inp);
808 if (inp->inp_gencnt <= gencnt &&
809 cr_canseesocket(req->td->td_ucred, inp->inp_socket) == 0) {
810 /* XXX held references? */
811 inp_list[i++] = inp;
812 }
813 INP_UNLOCK(inp);
814 }
815 INP_INFO_RUNLOCK(&ripcbinfo);
816 n = i;
817
818 error = 0;
819 for (i = 0; i < n; i++) {
820 inp = inp_list[i];
821 if (inp->inp_gencnt <= gencnt) {
822 struct xinpcb xi;
823 xi.xi_len = sizeof xi;
824 /* XXX should avoid extra copy */
825 bcopy(inp, &xi.xi_inp, sizeof *inp);
826 if (inp->inp_socket)
827 sotoxsocket(inp->inp_socket, &xi.xi_socket);
828 error = SYSCTL_OUT(req, &xi, sizeof xi);
829 }
830 }
831 if (!error) {
832 /*
833 * Give the user an updated idea of our state.
834 * If the generation differs from what we told
835 * her before, she knows that something happened
836 * while we were processing this request, and it
837 * might be necessary to retry.
838 */
839 INP_INFO_RLOCK(&ripcbinfo);
840 xig.xig_gen = ripcbinfo.ipi_gencnt;
841 xig.xig_sogen = so_gencnt;
842 xig.xig_count = ripcbinfo.ipi_count;
843 INP_INFO_RUNLOCK(&ripcbinfo);
844 error = SYSCTL_OUT(req, &xig, sizeof xig);
845 }
846 free(inp_list, M_TEMP);
847 return error;
848}
849
850/*
851 * This is the wrapper function for in_setsockaddr. We just pass down
852 * the pcbinfo for in_setpeeraddr to lock.
853 */
854static int
855rip_sockaddr(struct socket *so, struct sockaddr **nam)
856{
857 return (in_setsockaddr(so, nam, &ripcbinfo));
858}
859
860/*
861 * This is the wrapper function for in_setpeeraddr. We just pass down
862 * the pcbinfo for in_setpeeraddr to lock.
863 */
864static int
865rip_peeraddr(struct socket *so, struct sockaddr **nam)
866{
867 return (in_setpeeraddr(so, nam, &ripcbinfo));
868}
869
870
871SYSCTL_PROC(_net_inet_raw, OID_AUTO/*XXX*/, pcblist, CTLFLAG_RD, 0, 0,
872 rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
873
874struct pr_usrreqs rip_usrreqs = {
875 rip_abort, pru_accept_notsupp, rip_attach, rip_bind, rip_connect,
876 pru_connect2_notsupp, in_control, rip_detach, rip_disconnect,
877 pru_listen_notsupp, rip_peeraddr, pru_rcvd_notsupp,
878 pru_rcvoob_notsupp, rip_send, pru_sense_null, rip_shutdown,
879 rip_sockaddr, sosend, soreceive, sopoll, in_pcbsosetlabel
880};
|