raw_ip.c revision 180833
1/*- 2 * Copyright (c) 1982, 1986, 1988, 1993 3 * The Regents of the University of California. 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 4. Neither the name of the University nor the names of its contributors 15 * may be used to endorse or promote products derived from this software 16 * without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28 * SUCH DAMAGE. 29 * 30 * @(#)raw_ip.c 8.7 (Berkeley) 5/15/95 31 */ 32 33#include <sys/cdefs.h> 34__FBSDID("$FreeBSD: head/sys/netinet/raw_ip.c 180833 2008-07-26 21:12:00Z mav $"); 35 36#include "opt_inet6.h" 37#include "opt_ipsec.h" 38#include "opt_mac.h" 39 40#include <sys/param.h> 41#include <sys/jail.h> 42#include <sys/kernel.h> 43#include <sys/lock.h> 44#include <sys/malloc.h> 45#include <sys/mbuf.h> 46#include <sys/priv.h> 47#include <sys/proc.h> 48#include <sys/protosw.h> 49#include <sys/signalvar.h> 50#include <sys/socket.h> 51#include <sys/socketvar.h> 52#include <sys/sx.h> 53#include <sys/sysctl.h> 54#include <sys/systm.h> 55 56#include <vm/uma.h> 57 58#include <net/if.h> 59#include <net/route.h> 60 61#include <netinet/in.h> 62#include <netinet/in_systm.h> 63#include <netinet/in_pcb.h> 64#include <netinet/in_var.h> 65#include <netinet/ip.h> 66#include <netinet/ip_var.h> 67#include <netinet/ip_mroute.h> 68 69#include <netinet/ip_fw.h> 70#include <netinet/ip_dummynet.h> 71 72#ifdef IPSEC 73#include <netipsec/ipsec.h> 74#endif /*IPSEC*/ 75 76#include <security/mac/mac_framework.h> 77 78struct inpcbhead ripcb; 79struct inpcbinfo ripcbinfo; 80 81/* control hooks for ipfw and dummynet */ 82ip_fw_ctl_t *ip_fw_ctl_ptr = NULL; 83ip_dn_ctl_t *ip_dn_ctl_ptr = NULL; 84 85/* 86 * Hooks for multicast routing. They all default to NULL, so leave them not 87 * initialized and rely on BSS being set to 0. 88 */ 89 90/* 91 * The socket used to communicate with the multicast routing daemon. 92 */ 93struct socket *ip_mrouter; 94 95/* 96 * The various mrouter and rsvp functions. 97 */ 98int (*ip_mrouter_set)(struct socket *, struct sockopt *); 99int (*ip_mrouter_get)(struct socket *, struct sockopt *); 100int (*ip_mrouter_done)(void); 101int (*ip_mforward)(struct ip *, struct ifnet *, struct mbuf *, 102 struct ip_moptions *); 103int (*mrt_ioctl)(int, caddr_t, int); 104int (*legal_vif_num)(int); 105u_long (*ip_mcast_src)(int); 106 107void (*rsvp_input_p)(struct mbuf *m, int off); 108int (*ip_rsvp_vif)(struct socket *, struct sockopt *); 109void (*ip_rsvp_force_done)(struct socket *); 110 111/* 112 * Hash functions 113 */ 114 115#define INP_PCBHASH_RAW_SIZE 256 116#define INP_PCBHASH_RAW(proto, laddr, faddr, mask) \ 117 (((proto) + (laddr) + (faddr)) % (mask) + 1) 118 119static void 120rip_inshash(struct inpcb *inp) 121{ 122 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo; 123 struct inpcbhead *pcbhash; 124 int hash; 125 126 INP_INFO_WLOCK_ASSERT(pcbinfo); 127 INP_WLOCK_ASSERT(inp); 128 129 if (inp->inp_ip_p && inp->inp_laddr.s_addr && inp->inp_faddr.s_addr) { 130 hash = INP_PCBHASH_RAW(inp->inp_ip_p, inp->inp_laddr.s_addr, 131 inp->inp_faddr.s_addr, pcbinfo->ipi_hashmask); 132 } else { 133 hash = 0; 134 } 135 pcbhash = &pcbinfo->ipi_hashbase[hash]; 136 LIST_INSERT_HEAD(pcbhash, inp, inp_hash); 137} 138 139static void 140rip_delhash(struct inpcb *inp) 141{ 142 INP_WLOCK_ASSERT(inp); 143 LIST_REMOVE(inp, inp_hash); 144} 145 146/* 147 * Raw interface to IP protocol. 148 */ 149 150/* 151 * Initialize raw connection block q. 152 */ 153static void 154rip_zone_change(void *tag) 155{ 156 157 uma_zone_set_max(ripcbinfo.ipi_zone, maxsockets); 158} 159 160static int 161rip_inpcb_init(void *mem, int size, int flags) 162{ 163 struct inpcb *inp = mem; 164 165 INP_LOCK_INIT(inp, "inp", "rawinp"); 166 return (0); 167} 168 169void 170rip_init(void) 171{ 172 173 INP_INFO_LOCK_INIT(&ripcbinfo, "rip"); 174 LIST_INIT(&ripcb); 175 ripcbinfo.ipi_listhead = &ripcb; 176 ripcbinfo.ipi_hashbase = hashinit(INP_PCBHASH_RAW_SIZE, M_PCB, 177 &ripcbinfo.ipi_hashmask); 178 ripcbinfo.ipi_porthashbase = hashinit(1, M_PCB, 179 &ripcbinfo.ipi_porthashmask); 180 ripcbinfo.ipi_zone = uma_zcreate("ripcb", sizeof(struct inpcb), 181 NULL, NULL, rip_inpcb_init, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE); 182 uma_zone_set_max(ripcbinfo.ipi_zone, maxsockets); 183 EVENTHANDLER_REGISTER(maxsockets_change, rip_zone_change, NULL, 184 EVENTHANDLER_PRI_ANY); 185} 186 187static int 188rip_append(struct inpcb *last, struct ip *ip, struct mbuf *n, 189 struct sockaddr_in *ripsrc) 190{ 191 int policyfail = 0; 192 193 INP_RLOCK_ASSERT(last); 194 195#ifdef IPSEC 196 /* check AH/ESP integrity. */ 197 if (ipsec4_in_reject(n, last)) { 198 policyfail = 1; 199 } 200#endif /* IPSEC */ 201#ifdef MAC 202 if (!policyfail && mac_inpcb_check_deliver(last, n) != 0) 203 policyfail = 1; 204#endif 205 /* Check the minimum TTL for socket. */ 206 if (last->inp_ip_minttl && last->inp_ip_minttl > ip->ip_ttl) 207 policyfail = 1; 208 if (!policyfail) { 209 struct mbuf *opts = NULL; 210 struct socket *so; 211 212 so = last->inp_socket; 213 if ((last->inp_flags & INP_CONTROLOPTS) || 214 (so->so_options & (SO_TIMESTAMP | SO_BINTIME))) 215 ip_savecontrol(last, &opts, ip, n); 216 SOCKBUF_LOCK(&so->so_rcv); 217 if (sbappendaddr_locked(&so->so_rcv, 218 (struct sockaddr *)ripsrc, n, opts) == 0) { 219 /* should notify about lost packet */ 220 m_freem(n); 221 if (opts) 222 m_freem(opts); 223 SOCKBUF_UNLOCK(&so->so_rcv); 224 } else 225 sorwakeup_locked(so); 226 } else 227 m_freem(n); 228 return (policyfail); 229} 230 231/* 232 * Setup generic address and protocol structures for raw_input routine, then 233 * pass them along with mbuf chain. 234 */ 235void 236rip_input(struct mbuf *m, int off) 237{ 238 struct ip *ip = mtod(m, struct ip *); 239 int proto = ip->ip_p; 240 struct inpcb *inp, *last; 241 struct sockaddr_in ripsrc; 242 int hash; 243 244 bzero(&ripsrc, sizeof(ripsrc)); 245 ripsrc.sin_len = sizeof(ripsrc); 246 ripsrc.sin_family = AF_INET; 247 ripsrc.sin_addr = ip->ip_src; 248 last = NULL; 249 hash = INP_PCBHASH_RAW(proto, ip->ip_src.s_addr, 250 ip->ip_dst.s_addr, ripcbinfo.ipi_hashmask); 251 INP_INFO_RLOCK(&ripcbinfo); 252 LIST_FOREACH(inp, &ripcbinfo.ipi_hashbase[hash], inp_hash) { 253 if (inp->inp_ip_p != proto) 254 continue; 255#ifdef INET6 256 if ((inp->inp_vflag & INP_IPV4) == 0) 257 continue; 258#endif 259 if (inp->inp_laddr.s_addr != ip->ip_dst.s_addr) 260 continue; 261 if (inp->inp_faddr.s_addr != ip->ip_src.s_addr) 262 continue; 263 INP_RLOCK(inp); 264 if (jailed(inp->inp_socket->so_cred) && 265 (htonl(prison_getip(inp->inp_socket->so_cred)) != 266 ip->ip_dst.s_addr)) { 267 INP_RUNLOCK(inp); 268 continue; 269 } 270 if (last) { 271 struct mbuf *n; 272 273 n = m_copy(m, 0, (int)M_COPYALL); 274 if (n != NULL) 275 (void) rip_append(last, ip, n, &ripsrc); 276 /* XXX count dropped packet */ 277 INP_RUNLOCK(last); 278 } 279 last = inp; 280 } 281 LIST_FOREACH(inp, &ripcbinfo.ipi_hashbase[0], inp_hash) { 282 if (inp->inp_ip_p && inp->inp_ip_p != proto) 283 continue; 284#ifdef INET6 285 if ((inp->inp_vflag & INP_IPV4) == 0) 286 continue; 287#endif 288 if (inp->inp_laddr.s_addr && 289 inp->inp_laddr.s_addr != ip->ip_dst.s_addr) 290 continue; 291 if (inp->inp_faddr.s_addr && 292 inp->inp_faddr.s_addr != ip->ip_src.s_addr) 293 continue; 294 INP_RLOCK(inp); 295 if (jailed(inp->inp_socket->so_cred) && 296 (htonl(prison_getip(inp->inp_socket->so_cred)) != 297 ip->ip_dst.s_addr)) { 298 INP_RUNLOCK(inp); 299 continue; 300 } 301 if (last) { 302 struct mbuf *n; 303 304 n = m_copy(m, 0, (int)M_COPYALL); 305 if (n != NULL) 306 (void) rip_append(last, ip, n, &ripsrc); 307 /* XXX count dropped packet */ 308 INP_RUNLOCK(last); 309 } 310 last = inp; 311 } 312 INP_INFO_RUNLOCK(&ripcbinfo); 313 if (last != NULL) { 314 if (rip_append(last, ip, m, &ripsrc) != 0) 315 ipstat.ips_delivered--; 316 INP_RUNLOCK(last); 317 } else { 318 m_freem(m); 319 ipstat.ips_noproto++; 320 ipstat.ips_delivered--; 321 } 322} 323 324/* 325 * Generate IP header and pass packet to ip_output. Tack on options user may 326 * have setup with control call. 327 */ 328int 329rip_output(struct mbuf *m, struct socket *so, u_long dst) 330{ 331 struct ip *ip; 332 int error; 333 struct inpcb *inp = sotoinpcb(so); 334 int flags = ((so->so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0) | 335 IP_ALLOWBROADCAST; 336 337 /* 338 * If the user handed us a complete IP packet, use it. Otherwise, 339 * allocate an mbuf for a header and fill it in. 340 */ 341 if ((inp->inp_flags & INP_HDRINCL) == 0) { 342 if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) { 343 m_freem(m); 344 return(EMSGSIZE); 345 } 346 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 347 if (m == NULL) 348 return(ENOBUFS); 349 350 INP_RLOCK(inp); 351 ip = mtod(m, struct ip *); 352 ip->ip_tos = inp->inp_ip_tos; 353 if (inp->inp_flags & INP_DONTFRAG) 354 ip->ip_off = IP_DF; 355 else 356 ip->ip_off = 0; 357 ip->ip_p = inp->inp_ip_p; 358 ip->ip_len = m->m_pkthdr.len; 359 if (jailed(inp->inp_socket->so_cred)) 360 ip->ip_src.s_addr = 361 htonl(prison_getip(inp->inp_socket->so_cred)); 362 else 363 ip->ip_src = inp->inp_laddr; 364 ip->ip_dst.s_addr = dst; 365 ip->ip_ttl = inp->inp_ip_ttl; 366 } else { 367 if (m->m_pkthdr.len > IP_MAXPACKET) { 368 m_freem(m); 369 return(EMSGSIZE); 370 } 371 INP_RLOCK(inp); 372 ip = mtod(m, struct ip *); 373 if (jailed(inp->inp_socket->so_cred)) { 374 if (ip->ip_src.s_addr != 375 htonl(prison_getip(inp->inp_socket->so_cred))) { 376 INP_RUNLOCK(inp); 377 m_freem(m); 378 return (EPERM); 379 } 380 } 381 382 /* 383 * Don't allow both user specified and setsockopt options, 384 * and don't allow packet length sizes that will crash. 385 */ 386 if (((ip->ip_hl != (sizeof (*ip) >> 2)) && inp->inp_options) 387 || (ip->ip_len > m->m_pkthdr.len) 388 || (ip->ip_len < (ip->ip_hl << 2))) { 389 INP_RUNLOCK(inp); 390 m_freem(m); 391 return (EINVAL); 392 } 393 if (ip->ip_id == 0) 394 ip->ip_id = ip_newid(); 395 396 /* 397 * XXX prevent ip_output from overwriting header fields. 398 */ 399 flags |= IP_RAWOUTPUT; 400 ipstat.ips_rawout++; 401 } 402 403 if (inp->inp_flags & INP_ONESBCAST) 404 flags |= IP_SENDONES; 405 406#ifdef MAC 407 mac_inpcb_create_mbuf(inp, m); 408#endif 409 410 error = ip_output(m, inp->inp_options, NULL, flags, 411 inp->inp_moptions, inp); 412 INP_RUNLOCK(inp); 413 return (error); 414} 415 416/* 417 * Raw IP socket option processing. 418 * 419 * IMPORTANT NOTE regarding access control: Traditionally, raw sockets could 420 * only be created by a privileged process, and as such, socket option 421 * operations to manage system properties on any raw socket were allowed to 422 * take place without explicit additional access control checks. However, 423 * raw sockets can now also be created in jail(), and therefore explicit 424 * checks are now required. Likewise, raw sockets can be used by a process 425 * after it gives up privilege, so some caution is required. For options 426 * passed down to the IP layer via ip_ctloutput(), checks are assumed to be 427 * performed in ip_ctloutput() and therefore no check occurs here. 428 * Unilaterally checking priv_check() here breaks normal IP socket option 429 * operations on raw sockets. 430 * 431 * When adding new socket options here, make sure to add access control 432 * checks here as necessary. 433 */ 434int 435rip_ctloutput(struct socket *so, struct sockopt *sopt) 436{ 437 struct inpcb *inp = sotoinpcb(so); 438 int error, optval; 439 440 if (sopt->sopt_level != IPPROTO_IP) 441 return (EINVAL); 442 443 error = 0; 444 switch (sopt->sopt_dir) { 445 case SOPT_GET: 446 switch (sopt->sopt_name) { 447 case IP_HDRINCL: 448 optval = inp->inp_flags & INP_HDRINCL; 449 error = sooptcopyout(sopt, &optval, sizeof optval); 450 break; 451 452 case IP_FW_ADD: /* ADD actually returns the body... */ 453 case IP_FW_GET: 454 case IP_FW_TABLE_GETSIZE: 455 case IP_FW_TABLE_LIST: 456 case IP_FW_NAT_GET_CONFIG: 457 case IP_FW_NAT_GET_LOG: 458 if (ip_fw_ctl_ptr != NULL) 459 error = ip_fw_ctl_ptr(sopt); 460 else 461 error = ENOPROTOOPT; 462 break; 463 464 case IP_DUMMYNET_GET: 465 if (ip_dn_ctl_ptr != NULL) 466 error = ip_dn_ctl_ptr(sopt); 467 else 468 error = ENOPROTOOPT; 469 break ; 470 471 case MRT_INIT: 472 case MRT_DONE: 473 case MRT_ADD_VIF: 474 case MRT_DEL_VIF: 475 case MRT_ADD_MFC: 476 case MRT_DEL_MFC: 477 case MRT_VERSION: 478 case MRT_ASSERT: 479 case MRT_API_SUPPORT: 480 case MRT_API_CONFIG: 481 case MRT_ADD_BW_UPCALL: 482 case MRT_DEL_BW_UPCALL: 483 error = priv_check(curthread, PRIV_NETINET_MROUTE); 484 if (error != 0) 485 return (error); 486 error = ip_mrouter_get ? ip_mrouter_get(so, sopt) : 487 EOPNOTSUPP; 488 break; 489 490 default: 491 error = ip_ctloutput(so, sopt); 492 break; 493 } 494 break; 495 496 case SOPT_SET: 497 switch (sopt->sopt_name) { 498 case IP_HDRINCL: 499 error = sooptcopyin(sopt, &optval, sizeof optval, 500 sizeof optval); 501 if (error) 502 break; 503 if (optval) 504 inp->inp_flags |= INP_HDRINCL; 505 else 506 inp->inp_flags &= ~INP_HDRINCL; 507 break; 508 509 case IP_FW_ADD: 510 case IP_FW_DEL: 511 case IP_FW_FLUSH: 512 case IP_FW_ZERO: 513 case IP_FW_RESETLOG: 514 case IP_FW_TABLE_ADD: 515 case IP_FW_TABLE_DEL: 516 case IP_FW_TABLE_FLUSH: 517 case IP_FW_NAT_CFG: 518 case IP_FW_NAT_DEL: 519 if (ip_fw_ctl_ptr != NULL) 520 error = ip_fw_ctl_ptr(sopt); 521 else 522 error = ENOPROTOOPT; 523 break; 524 525 case IP_DUMMYNET_CONFIGURE: 526 case IP_DUMMYNET_DEL: 527 case IP_DUMMYNET_FLUSH: 528 if (ip_dn_ctl_ptr != NULL) 529 error = ip_dn_ctl_ptr(sopt); 530 else 531 error = ENOPROTOOPT ; 532 break ; 533 534 case IP_RSVP_ON: 535 error = priv_check(curthread, PRIV_NETINET_MROUTE); 536 if (error != 0) 537 return (error); 538 error = ip_rsvp_init(so); 539 break; 540 541 case IP_RSVP_OFF: 542 error = priv_check(curthread, PRIV_NETINET_MROUTE); 543 if (error != 0) 544 return (error); 545 error = ip_rsvp_done(); 546 break; 547 548 case IP_RSVP_VIF_ON: 549 case IP_RSVP_VIF_OFF: 550 error = priv_check(curthread, PRIV_NETINET_MROUTE); 551 if (error != 0) 552 return (error); 553 error = ip_rsvp_vif ? 554 ip_rsvp_vif(so, sopt) : EINVAL; 555 break; 556 557 case MRT_INIT: 558 case MRT_DONE: 559 case MRT_ADD_VIF: 560 case MRT_DEL_VIF: 561 case MRT_ADD_MFC: 562 case MRT_DEL_MFC: 563 case MRT_VERSION: 564 case MRT_ASSERT: 565 case MRT_API_SUPPORT: 566 case MRT_API_CONFIG: 567 case MRT_ADD_BW_UPCALL: 568 case MRT_DEL_BW_UPCALL: 569 error = priv_check(curthread, PRIV_NETINET_MROUTE); 570 if (error != 0) 571 return (error); 572 error = ip_mrouter_set ? ip_mrouter_set(so, sopt) : 573 EOPNOTSUPP; 574 break; 575 576 default: 577 error = ip_ctloutput(so, sopt); 578 break; 579 } 580 break; 581 } 582 583 return (error); 584} 585 586/* 587 * This function exists solely to receive the PRC_IFDOWN messages which are 588 * sent by if_down(). It looks for an ifaddr whose ifa_addr is sa, and calls 589 * in_ifadown() to remove all routes corresponding to that address. It also 590 * receives the PRC_IFUP messages from if_up() and reinstalls the interface 591 * routes. 592 */ 593void 594rip_ctlinput(int cmd, struct sockaddr *sa, void *vip) 595{ 596 struct in_ifaddr *ia; 597 struct ifnet *ifp; 598 int err; 599 int flags; 600 601 switch (cmd) { 602 case PRC_IFDOWN: 603 TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) { 604 if (ia->ia_ifa.ifa_addr == sa 605 && (ia->ia_flags & IFA_ROUTE)) { 606 /* 607 * in_ifscrub kills the interface route. 608 */ 609 in_ifscrub(ia->ia_ifp, ia); 610 /* 611 * in_ifadown gets rid of all the rest of the 612 * routes. This is not quite the right thing 613 * to do, but at least if we are running a 614 * routing process they will come back. 615 */ 616 in_ifadown(&ia->ia_ifa, 0); 617 break; 618 } 619 } 620 break; 621 622 case PRC_IFUP: 623 TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) { 624 if (ia->ia_ifa.ifa_addr == sa) 625 break; 626 } 627 if (ia == 0 || (ia->ia_flags & IFA_ROUTE)) 628 return; 629 flags = RTF_UP; 630 ifp = ia->ia_ifa.ifa_ifp; 631 632 if ((ifp->if_flags & IFF_LOOPBACK) 633 || (ifp->if_flags & IFF_POINTOPOINT)) 634 flags |= RTF_HOST; 635 636 err = rtinit(&ia->ia_ifa, RTM_ADD, flags); 637 if (err == 0) 638 ia->ia_flags |= IFA_ROUTE; 639 break; 640 } 641} 642 643u_long rip_sendspace = 9216; 644u_long rip_recvspace = 9216; 645 646SYSCTL_ULONG(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW, 647 &rip_sendspace, 0, "Maximum outgoing raw IP datagram size"); 648SYSCTL_ULONG(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW, 649 &rip_recvspace, 0, "Maximum space for incoming raw IP datagrams"); 650 651static int 652rip_attach(struct socket *so, int proto, struct thread *td) 653{ 654 struct inpcb *inp; 655 int error; 656 657 inp = sotoinpcb(so); 658 KASSERT(inp == NULL, ("rip_attach: inp != NULL")); 659 660 error = priv_check(td, PRIV_NETINET_RAW); 661 if (error) 662 return (error); 663 if (proto >= IPPROTO_MAX || proto < 0) 664 return EPROTONOSUPPORT; 665 error = soreserve(so, rip_sendspace, rip_recvspace); 666 if (error) 667 return (error); 668 INP_INFO_WLOCK(&ripcbinfo); 669 error = in_pcballoc(so, &ripcbinfo); 670 if (error) { 671 INP_INFO_WUNLOCK(&ripcbinfo); 672 return (error); 673 } 674 inp = (struct inpcb *)so->so_pcb; 675 inp->inp_vflag |= INP_IPV4; 676 inp->inp_ip_p = proto; 677 inp->inp_ip_ttl = ip_defttl; 678 rip_inshash(inp); 679 INP_INFO_WUNLOCK(&ripcbinfo); 680 INP_WUNLOCK(inp); 681 return (0); 682} 683 684static void 685rip_detach(struct socket *so) 686{ 687 struct inpcb *inp; 688 689 inp = sotoinpcb(so); 690 KASSERT(inp != NULL, ("rip_detach: inp == NULL")); 691 KASSERT(inp->inp_faddr.s_addr == INADDR_ANY, 692 ("rip_detach: not closed")); 693 694 INP_INFO_WLOCK(&ripcbinfo); 695 INP_WLOCK(inp); 696 rip_delhash(inp); 697 if (so == ip_mrouter && ip_mrouter_done) 698 ip_mrouter_done(); 699 if (ip_rsvp_force_done) 700 ip_rsvp_force_done(so); 701 if (so == ip_rsvpd) 702 ip_rsvp_done(); 703 in_pcbdetach(inp); 704 in_pcbfree(inp); 705 INP_INFO_WUNLOCK(&ripcbinfo); 706} 707 708static void 709rip_dodisconnect(struct socket *so, struct inpcb *inp) 710{ 711 INP_WLOCK_ASSERT(inp); 712 713 rip_delhash(inp); 714 inp->inp_faddr.s_addr = INADDR_ANY; 715 rip_inshash(inp); 716 SOCK_LOCK(so); 717 so->so_state &= ~SS_ISCONNECTED; 718 SOCK_UNLOCK(so); 719} 720 721static void 722rip_abort(struct socket *so) 723{ 724 struct inpcb *inp; 725 726 inp = sotoinpcb(so); 727 KASSERT(inp != NULL, ("rip_abort: inp == NULL")); 728 729 INP_INFO_WLOCK(&ripcbinfo); 730 INP_WLOCK(inp); 731 rip_dodisconnect(so, inp); 732 INP_WUNLOCK(inp); 733 INP_INFO_WUNLOCK(&ripcbinfo); 734} 735 736static void 737rip_close(struct socket *so) 738{ 739 struct inpcb *inp; 740 741 inp = sotoinpcb(so); 742 KASSERT(inp != NULL, ("rip_close: inp == NULL")); 743 744 INP_INFO_WLOCK(&ripcbinfo); 745 INP_WLOCK(inp); 746 rip_dodisconnect(so, inp); 747 INP_WUNLOCK(inp); 748 INP_INFO_WUNLOCK(&ripcbinfo); 749} 750 751static int 752rip_disconnect(struct socket *so) 753{ 754 struct inpcb *inp; 755 756 if ((so->so_state & SS_ISCONNECTED) == 0) 757 return (ENOTCONN); 758 759 inp = sotoinpcb(so); 760 KASSERT(inp != NULL, ("rip_disconnect: inp == NULL")); 761 762 INP_INFO_WLOCK(&ripcbinfo); 763 INP_WLOCK(inp); 764 rip_dodisconnect(so, inp); 765 INP_WUNLOCK(inp); 766 INP_INFO_WUNLOCK(&ripcbinfo); 767 return (0); 768} 769 770static int 771rip_bind(struct socket *so, struct sockaddr *nam, struct thread *td) 772{ 773 struct sockaddr_in *addr = (struct sockaddr_in *)nam; 774 struct inpcb *inp; 775 776 if (nam->sa_len != sizeof(*addr)) 777 return (EINVAL); 778 779 if (jailed(td->td_ucred)) { 780 if (addr->sin_addr.s_addr == INADDR_ANY) 781 addr->sin_addr.s_addr = 782 htonl(prison_getip(td->td_ucred)); 783 if (htonl(prison_getip(td->td_ucred)) != addr->sin_addr.s_addr) 784 return (EADDRNOTAVAIL); 785 } 786 787 if (TAILQ_EMPTY(&ifnet) || 788 (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) || 789 (addr->sin_addr.s_addr && 790 ifa_ifwithaddr((struct sockaddr *)addr) == 0)) 791 return (EADDRNOTAVAIL); 792 793 inp = sotoinpcb(so); 794 KASSERT(inp != NULL, ("rip_bind: inp == NULL")); 795 796 INP_INFO_WLOCK(&ripcbinfo); 797 INP_WLOCK(inp); 798 rip_delhash(inp); 799 inp->inp_laddr = addr->sin_addr; 800 rip_inshash(inp); 801 INP_WUNLOCK(inp); 802 INP_INFO_WUNLOCK(&ripcbinfo); 803 return (0); 804} 805 806static int 807rip_connect(struct socket *so, struct sockaddr *nam, struct thread *td) 808{ 809 struct sockaddr_in *addr = (struct sockaddr_in *)nam; 810 struct inpcb *inp; 811 812 if (nam->sa_len != sizeof(*addr)) 813 return (EINVAL); 814 if (TAILQ_EMPTY(&ifnet)) 815 return (EADDRNOTAVAIL); 816 if (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) 817 return (EAFNOSUPPORT); 818 819 inp = sotoinpcb(so); 820 KASSERT(inp != NULL, ("rip_connect: inp == NULL")); 821 822 INP_INFO_WLOCK(&ripcbinfo); 823 INP_WLOCK(inp); 824 rip_delhash(inp); 825 inp->inp_faddr = addr->sin_addr; 826 rip_inshash(inp); 827 soisconnected(so); 828 INP_WUNLOCK(inp); 829 INP_INFO_WUNLOCK(&ripcbinfo); 830 return (0); 831} 832 833static int 834rip_shutdown(struct socket *so) 835{ 836 struct inpcb *inp; 837 838 inp = sotoinpcb(so); 839 KASSERT(inp != NULL, ("rip_shutdown: inp == NULL")); 840 841 INP_WLOCK(inp); 842 socantsendmore(so); 843 INP_WUNLOCK(inp); 844 return (0); 845} 846 847static int 848rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, 849 struct mbuf *control, struct thread *td) 850{ 851 struct inpcb *inp; 852 u_long dst; 853 854 inp = sotoinpcb(so); 855 KASSERT(inp != NULL, ("rip_send: inp == NULL")); 856 857 /* 858 * Note: 'dst' reads below are unlocked. 859 */ 860 if (so->so_state & SS_ISCONNECTED) { 861 if (nam) { 862 m_freem(m); 863 return (EISCONN); 864 } 865 dst = inp->inp_faddr.s_addr; /* Unlocked read. */ 866 } else { 867 if (nam == NULL) { 868 m_freem(m); 869 return (ENOTCONN); 870 } 871 dst = ((struct sockaddr_in *)nam)->sin_addr.s_addr; 872 } 873 return (rip_output(m, so, dst)); 874} 875 876static int 877rip_pcblist(SYSCTL_HANDLER_ARGS) 878{ 879 int error, i, n; 880 struct inpcb *inp, **inp_list; 881 inp_gen_t gencnt; 882 struct xinpgen xig; 883 884 /* 885 * The process of preparing the TCB list is too time-consuming and 886 * resource-intensive to repeat twice on every request. 887 */ 888 if (req->oldptr == 0) { 889 n = ripcbinfo.ipi_count; 890 req->oldidx = 2 * (sizeof xig) 891 + (n + n/8) * sizeof(struct xinpcb); 892 return (0); 893 } 894 895 if (req->newptr != 0) 896 return (EPERM); 897 898 /* 899 * OK, now we're committed to doing something. 900 */ 901 INP_INFO_RLOCK(&ripcbinfo); 902 gencnt = ripcbinfo.ipi_gencnt; 903 n = ripcbinfo.ipi_count; 904 INP_INFO_RUNLOCK(&ripcbinfo); 905 906 xig.xig_len = sizeof xig; 907 xig.xig_count = n; 908 xig.xig_gen = gencnt; 909 xig.xig_sogen = so_gencnt; 910 error = SYSCTL_OUT(req, &xig, sizeof xig); 911 if (error) 912 return (error); 913 914 inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK); 915 if (inp_list == 0) 916 return (ENOMEM); 917 918 INP_INFO_RLOCK(&ripcbinfo); 919 for (inp = LIST_FIRST(ripcbinfo.ipi_listhead), i = 0; inp && i < n; 920 inp = LIST_NEXT(inp, inp_list)) { 921 INP_RLOCK(inp); 922 if (inp->inp_gencnt <= gencnt && 923 cr_canseesocket(req->td->td_ucred, inp->inp_socket) == 0) { 924 /* XXX held references? */ 925 inp_list[i++] = inp; 926 } 927 INP_RUNLOCK(inp); 928 } 929 INP_INFO_RUNLOCK(&ripcbinfo); 930 n = i; 931 932 error = 0; 933 for (i = 0; i < n; i++) { 934 inp = inp_list[i]; 935 INP_RLOCK(inp); 936 if (inp->inp_gencnt <= gencnt) { 937 struct xinpcb xi; 938 bzero(&xi, sizeof(xi)); 939 xi.xi_len = sizeof xi; 940 /* XXX should avoid extra copy */ 941 bcopy(inp, &xi.xi_inp, sizeof *inp); 942 if (inp->inp_socket) 943 sotoxsocket(inp->inp_socket, &xi.xi_socket); 944 INP_RUNLOCK(inp); 945 error = SYSCTL_OUT(req, &xi, sizeof xi); 946 } else 947 INP_RUNLOCK(inp); 948 } 949 if (!error) { 950 /* 951 * Give the user an updated idea of our state. If the 952 * generation differs from what we told her before, she knows 953 * that something happened while we were processing this 954 * request, and it might be necessary to retry. 955 */ 956 INP_INFO_RLOCK(&ripcbinfo); 957 xig.xig_gen = ripcbinfo.ipi_gencnt; 958 xig.xig_sogen = so_gencnt; 959 xig.xig_count = ripcbinfo.ipi_count; 960 INP_INFO_RUNLOCK(&ripcbinfo); 961 error = SYSCTL_OUT(req, &xig, sizeof xig); 962 } 963 free(inp_list, M_TEMP); 964 return (error); 965} 966 967SYSCTL_PROC(_net_inet_raw, OID_AUTO/*XXX*/, pcblist, CTLFLAG_RD, 0, 0, 968 rip_pcblist, "S,xinpcb", "List of active raw IP sockets"); 969 970struct pr_usrreqs rip_usrreqs = { 971 .pru_abort = rip_abort, 972 .pru_attach = rip_attach, 973 .pru_bind = rip_bind, 974 .pru_connect = rip_connect, 975 .pru_control = in_control, 976 .pru_detach = rip_detach, 977 .pru_disconnect = rip_disconnect, 978 .pru_peeraddr = in_getpeeraddr, 979 .pru_send = rip_send, 980 .pru_shutdown = rip_shutdown, 981 .pru_sockaddr = in_getsockaddr, 982 .pru_sosetlabel = in_pcbsosetlabel, 983 .pru_close = rip_close, 984}; 985