sys/net/rtsock.c

   1 /*-
   2  * Copyright (c) 1988, 1991, 1993
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 4. Neither the name of the University nor the names of its contributors
  14  *    may be used to endorse or promote products derived from this software
  15  *    without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  *
  29  *      @(#)rtsock.c    8.7 (Berkeley) 10/12/95
  30  * $FreeBSD$
  31  */
  32 #include "opt_sctp.h"
  33 #include "opt_mpath.h"
  34 #include "opt_inet.h"
  35 #include "opt_inet6.h"
  36
  37 #include <sys/param.h>
  38 #include <sys/jail.h>
  39 #include <sys/kernel.h>
  40 #include <sys/domain.h>
  41 #include <sys/lock.h>
  42 #include <sys/malloc.h>
  43 #include <sys/mbuf.h>
  44 #include <sys/priv.h>
  45 #include <sys/proc.h>
  46 #include <sys/protosw.h>
  47 #include <sys/rwlock.h>
  48 #include <sys/signalvar.h>
  49 #include <sys/socket.h>
  50 #include <sys/socketvar.h>
  51 #include <sys/sysctl.h>
  52 #include <sys/systm.h>
  53
  54 #include <net/if.h>
  55 #include <net/if_dl.h>
  56 #include <net/if_llatbl.h>
  57 #include <net/netisr.h>
  58 #include <net/raw_cb.h>
  59 #include <net/route.h>
  60 #include <net/vnet.h>
  61
  62 #include <netinet/in.h>
  63 #include <netinet/if_ether.h>
  64 #ifdef INET6
  65 #include <netinet6/scope6_var.h>
  66 #endif
  67
  68 #if defined(INET) || defined(INET6)
  69 #ifdef SCTP
  70 extern void sctp_addr_change(struct ifaddr *ifa, int cmd);
  71 #endif /* SCTP */
  72 #endif
  73
  74 MALLOC_DEFINE(M_RTABLE, "routetbl", "routing tables");
  75
  76 /* NB: these are not modified */
  77 static struct   sockaddr route_src = { 2, PF_ROUTE, };
  78 static struct   sockaddr sa_zero   = { sizeof(sa_zero), AF_INET, };
  79
  80 static struct {
  81         int     ip_count;       /* attached w/ AF_INET */
  82         int     ip6_count;      /* attached w/ AF_INET6 */
  83         int     ipx_count;      /* attached w/ AF_IPX */
  84         int     any_count;      /* total attached */
  85 } route_cb;
  86
  87 struct mtx rtsock_mtx;
  88 MTX_SYSINIT(rtsock, &rtsock_mtx, "rtsock route_cb lock", MTX_DEF);
  89
  90 #define RTSOCK_LOCK()   mtx_lock(&rtsock_mtx)
  91 #define RTSOCK_UNLOCK() mtx_unlock(&rtsock_mtx)
  92 #define RTSOCK_LOCK_ASSERT()    mtx_assert(&rtsock_mtx, MA_OWNED)
  93
  94 SYSCTL_NODE(_net, OID_AUTO, route, CTLFLAG_RD, 0, "");
  95
  96 struct walkarg {
  97         int     w_tmemsize;
  98         int     w_op, w_arg;
  99         caddr_t w_tmem;
 100         struct sysctl_req *w_req;
 101 };
 102
 103 static void     rts_input(struct mbuf *m);
 104 static struct mbuf *rt_msg1(int type, struct rt_addrinfo *rtinfo);
 105 static int      rt_msg2(int type, struct rt_addrinfo *rtinfo,
 106                         caddr_t cp, struct walkarg *w);
 107 static int      rt_xaddrs(caddr_t cp, caddr_t cplim,
 108                         struct rt_addrinfo *rtinfo);
 109 static int      sysctl_dumpentry(struct radix_node *rn, void *vw);
 110 static int      sysctl_iflist(int af, struct walkarg *w);
 111 static int      sysctl_ifmalist(int af, struct walkarg *w);
 112 static int      route_output(struct mbuf *m, struct socket *so);
 113 static void     rt_setmetrics(u_long which, const struct rt_metrics *in,
 114                         struct rt_metrics_lite *out);
 115 static void     rt_getmetrics(const struct rt_metrics_lite *in,
 116                         struct rt_metrics *out);
 117 static void     rt_dispatch(struct mbuf *, const struct sockaddr *);
 118
 119 static struct netisr_handler rtsock_nh = {
 120         .nh_name = "rtsock",
 121         .nh_handler = rts_input,
 122         .nh_proto = NETISR_ROUTE,
 123         .nh_policy = NETISR_POLICY_SOURCE,
 124 };
 125
 126 static int
 127 sysctl_route_netisr_maxqlen(SYSCTL_HANDLER_ARGS)
 128 {
 129         int error, qlimit;
 130
 131         netisr_getqlimit(&rtsock_nh, &qlimit);
 132         error = sysctl_handle_int(oidp, &qlimit, 0, req);
 133         if (error || !req->newptr)
 134                 return (error);
 135         if (qlimit < 1)
 136                 return (EINVAL);
 137         return (netisr_setqlimit(&rtsock_nh, qlimit));
 138 }
 139 SYSCTL_PROC(_net_route, OID_AUTO, netisr_maxqlen, CTLTYPE_INT|CTLFLAG_RW,
 140     0, 0, sysctl_route_netisr_maxqlen, "I",
 141     "maximum routing socket dispatch queue length");
 142
 143 static void
 144 rts_init(void)
 145 {
 146         int tmp;
 147
 148         if (TUNABLE_INT_FETCH("net.route.netisr_maxqlen", &tmp))
 149                 rtsock_nh.nh_qlimit = tmp;
 150         netisr_register(&rtsock_nh);
 151 }
 152 SYSINIT(rtsock, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD, rts_init, 0);
 153
 154 static void
 155 rts_input(struct mbuf *m)
 156 {
 157         struct sockproto route_proto;
 158         unsigned short *family;
 159         struct m_tag *tag;
 160
 161         route_proto.sp_family = PF_ROUTE;
 162         tag = m_tag_find(m, PACKET_TAG_RTSOCKFAM, NULL);
 163         if (tag != NULL) {
 164                 family = (unsigned short *)(tag + 1);
 165                 route_proto.sp_protocol = *family;
 166                 m_tag_delete(m, tag);
 167         } else
 168                 route_proto.sp_protocol = 0;
 169
 170         raw_input(m, &route_proto, &route_src);
 171 }
 172
 173 /*
 174  * It really doesn't make any sense at all for this code to share much
 175  * with raw_usrreq.c, since its functionality is so restricted.  XXX
 176  */
 177 static void
 178 rts_abort(struct socket *so)
 179 {
 180
 181         raw_usrreqs.pru_abort(so);
 182 }
 183
 184 static void
 185 rts_close(struct socket *so)
 186 {
 187
 188         raw_usrreqs.pru_close(so);
 189 }
 190
 191 /* pru_accept is EOPNOTSUPP */
 192
 193 static int
 194 rts_attach(struct socket *so, int proto, struct thread *td)
 195 {
 196         struct rawcb *rp;
 197         int s, error;
 198
 199         KASSERT(so->so_pcb == NULL, ("rts_attach: so_pcb != NULL"));
 200
 201         /* XXX */
 202         rp = malloc(sizeof *rp, M_PCB, M_WAITOK | M_ZERO);
 203         if (rp == NULL)
 204                 return ENOBUFS;
 205
 206         /*
 207          * The splnet() is necessary to block protocols from sending
 208          * error notifications (like RTM_REDIRECT or RTM_LOSING) while
 209          * this PCB is extant but incompletely initialized.
 210          * Probably we should try to do more of this work beforehand and
 211          * eliminate the spl.
 212          */
 213         s = splnet();
 214         so->so_pcb = (caddr_t)rp;
 215         so->so_fibnum = td->td_proc->p_fibnum;
 216         error = raw_attach(so, proto);
 217         rp = sotorawcb(so);
 218         if (error) {
 219                 splx(s);
 220                 so->so_pcb = NULL;
 221                 free(rp, M_PCB);
 222                 return error;
 223         }
 224         RTSOCK_LOCK();
 225         switch(rp->rcb_proto.sp_protocol) {
 226         case AF_INET:
 227                 route_cb.ip_count++;
 228                 break;
 229         case AF_INET6:
 230                 route_cb.ip6_count++;
 231                 break;
 232         case AF_IPX:
 233                 route_cb.ipx_count++;
 234                 break;
 235         }
 236         route_cb.any_count++;
 237         RTSOCK_UNLOCK();
 238         soisconnected(so);
 239         so->so_options |= SO_USELOOPBACK;
 240         splx(s);
 241         return 0;
 242 }
 243
 244 static int
 245 rts_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 246 {
 247
 248         return (raw_usrreqs.pru_bind(so, nam, td)); /* xxx just EINVAL */
 249 }
 250
 251 static int
 252 rts_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 253 {
 254
 255         return (raw_usrreqs.pru_connect(so, nam, td)); /* XXX just EINVAL */
 256 }
 257
 258 /* pru_connect2 is EOPNOTSUPP */
 259 /* pru_control is EOPNOTSUPP */
 260
 261 static void
 262 rts_detach(struct socket *so)
 263 {
 264         struct rawcb *rp = sotorawcb(so);
 265
 266         KASSERT(rp != NULL, ("rts_detach: rp == NULL"));
 267
 268         RTSOCK_LOCK();
 269         switch(rp->rcb_proto.sp_protocol) {
 270         case AF_INET:
 271                 route_cb.ip_count--;
 272                 break;
 273         case AF_INET6:
 274                 route_cb.ip6_count--;
 275                 break;
 276         case AF_IPX:
 277                 route_cb.ipx_count--;
 278                 break;
 279         }
 280         route_cb.any_count--;
 281         RTSOCK_UNLOCK();
 282         raw_usrreqs.pru_detach(so);
 283 }
 284
 285 static int
 286 rts_disconnect(struct socket *so)
 287 {
 288
 289         return (raw_usrreqs.pru_disconnect(so));
 290 }
 291
 292 /* pru_listen is EOPNOTSUPP */
 293
 294 static int
 295 rts_peeraddr(struct socket *so, struct sockaddr **nam)
 296 {
 297
 298         return (raw_usrreqs.pru_peeraddr(so, nam));
 299 }
 300
 301 /* pru_rcvd is EOPNOTSUPP */
 302 /* pru_rcvoob is EOPNOTSUPP */
 303
 304 static int
 305 rts_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
 306          struct mbuf *control, struct thread *td)
 307 {
 308
 309         return (raw_usrreqs.pru_send(so, flags, m, nam, control, td));
 310 }
 311
 312 /* pru_sense is null */
 313
 314 static int
 315 rts_shutdown(struct socket *so)
 316 {
 317
 318         return (raw_usrreqs.pru_shutdown(so));
 319 }
 320
 321 static int
 322 rts_sockaddr(struct socket *so, struct sockaddr **nam)
 323 {
 324
 325         return (raw_usrreqs.pru_sockaddr(so, nam));
 326 }
 327
 328 static struct pr_usrreqs route_usrreqs = {
 329         .pru_abort =            rts_abort,
 330         .pru_attach =           rts_attach,
 331         .pru_bind =             rts_bind,
 332         .pru_connect =          rts_connect,
 333         .pru_detach =           rts_detach,
 334         .pru_disconnect =       rts_disconnect,
 335         .pru_peeraddr =         rts_peeraddr,
 336         .pru_send =             rts_send,
 337         .pru_shutdown =         rts_shutdown,
 338         .pru_sockaddr =         rts_sockaddr,
 339         .pru_close =            rts_close,
 340 };
 341
 342 #ifndef _SOCKADDR_UNION_DEFINED
 343 #define _SOCKADDR_UNION_DEFINED
 344 /*
 345  * The union of all possible address formats we handle.
 346  */
 347 union sockaddr_union {
 348         struct sockaddr         sa;
 349         struct sockaddr_in      sin;
 350         struct sockaddr_in6     sin6;
 351 };
 352 #endif /* _SOCKADDR_UNION_DEFINED */
 353
 354 static int
 355 rtm_get_jailed(struct rt_addrinfo *info, struct ifnet *ifp,
 356     struct rtentry *rt, union sockaddr_union *saun, struct ucred *cred)
 357 {
 358
 359         /* First, see if the returned address is part of the jail. */
 360         if (prison_if(cred, rt->rt_ifa->ifa_addr) == 0) {
 361                 info->rti_info[RTAX_IFA] = rt->rt_ifa->ifa_addr;
 362                 return (0);
 363         }
 364
 365         switch (info->rti_info[RTAX_DST]->sa_family) {
 366 #ifdef INET
 367         case AF_INET:
 368         {
 369                 struct in_addr ia;
 370                 struct ifaddr *ifa;
 371                 int found;
 372
 373                 found = 0;
 374                 /*
 375                  * Try to find an address on the given outgoing interface
 376                  * that belongs to the jail.
 377                  */
 378                 IF_ADDR_LOCK(ifp);
 379                 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
 380                         struct sockaddr *sa;
 381                         sa = ifa->ifa_addr;
 382                         if (sa->sa_family != AF_INET)
 383                                 continue;
 384                         ia = ((struct sockaddr_in *)sa)->sin_addr;
 385                         if (prison_check_ip4(cred, &ia) == 0) {
 386                                 found = 1;
 387                                 break;
 388                         }
 389                 }
 390                 IF_ADDR_UNLOCK(ifp);
 391                 if (!found) {
 392                         /*
 393                          * As a last resort return the 'default' jail address.
 394                          */
 395                         ia = ((struct sockaddr_in *)rt->rt_ifa->ifa_addr)->
 396                             sin_addr;
 397                         if (prison_get_ip4(cred, &ia) != 0)
 398                                 return (ESRCH);
 399                 }
 400                 bzero(&saun->sin, sizeof(struct sockaddr_in));
 401                 saun->sin.sin_len = sizeof(struct sockaddr_in);
 402                 saun->sin.sin_family = AF_INET;
 403                 saun->sin.sin_addr.s_addr = ia.s_addr;
 404                 info->rti_info[RTAX_IFA] = (struct sockaddr *)&saun->sin;
 405                 break;
 406         }
 407 #endif
 408 #ifdef INET6
 409         case AF_INET6:
 410         {
 411                 struct in6_addr ia6;
 412                 struct ifaddr *ifa;
 413                 int found;
 414
 415                 found = 0;
 416                 /*
 417                  * Try to find an address on the given outgoing interface
 418                  * that belongs to the jail.
 419                  */
 420                 IF_ADDR_LOCK(ifp);
 421                 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
 422                         struct sockaddr *sa;
 423                         sa = ifa->ifa_addr;
 424                         if (sa->sa_family != AF_INET6)
 425                                 continue;
 426                         bcopy(&((struct sockaddr_in6 *)sa)->sin6_addr,
 427                             &ia6, sizeof(struct in6_addr));
 428                         if (prison_check_ip6(cred, &ia6) == 0) {
 429                                 found = 1;
 430                                 break;
 431                         }
 432                 }
 433                 IF_ADDR_UNLOCK(ifp);
 434                 if (!found) {
 435                         /*
 436                          * As a last resort return the 'default' jail address.
 437                          */
 438                         ia6 = ((struct sockaddr_in6 *)rt->rt_ifa->ifa_addr)->
 439                             sin6_addr;
 440                         if (prison_get_ip6(cred, &ia6) != 0)
 441                                 return (ESRCH);
 442                 }
 443                 bzero(&saun->sin6, sizeof(struct sockaddr_in6));
 444                 saun->sin6.sin6_len = sizeof(struct sockaddr_in6);
 445                 saun->sin6.sin6_family = AF_INET6;
 446                 bcopy(&ia6, &saun->sin6.sin6_addr, sizeof(struct in6_addr));
 447                 if (sa6_recoverscope(&saun->sin6) != 0)
 448                         return (ESRCH);
 449                 info->rti_info[RTAX_IFA] = (struct sockaddr *)&saun->sin6;
 450                 break;
 451         }
 452 #endif
 453         default:
 454                 return (ESRCH);
 455         }
 456         return (0);
 457 }
 458
 459 /*ARGSUSED*/
 460 static int
 461 route_output(struct mbuf *m, struct socket *so)
 462 {
 463 #define sa_equal(a1, a2) (bcmp((a1), (a2), (a1)->sa_len) == 0)
 464         struct rt_msghdr *rtm = NULL;
 465         struct rtentry *rt = NULL;
 466         struct radix_node_head *rnh;
 467         struct rt_addrinfo info;
 468         int len, error = 0;
 469         struct ifnet *ifp = NULL;
 470         union sockaddr_union saun;
 471
 472 #define senderr(e) { error = e; goto flush;}
 473         if (m == NULL || ((m->m_len < sizeof(long)) &&
 474                        (m = m_pullup(m, sizeof(long))) == NULL))
 475                 return (ENOBUFS);
 476         if ((m->m_flags & M_PKTHDR) == 0)
 477                 panic("route_output");
 478         len = m->m_pkthdr.len;
 479         if (len < sizeof(*rtm) ||
 480             len != mtod(m, struct rt_msghdr *)->rtm_msglen) {
 481                 info.rti_info[RTAX_DST] = NULL;
 482                 senderr(EINVAL);
 483         }
 484         R_Malloc(rtm, struct rt_msghdr *, len);
 485         if (rtm == NULL) {
 486                 info.rti_info[RTAX_DST] = NULL;
 487                 senderr(ENOBUFS);
 488         }
 489         m_copydata(m, 0, len, (caddr_t)rtm);
 490         if (rtm->rtm_version != RTM_VERSION) {
 491                 info.rti_info[RTAX_DST] = NULL;
 492                 senderr(EPROTONOSUPPORT);
 493         }
 494         rtm->rtm_pid = curproc->p_pid;
 495         bzero(&info, sizeof(info));
 496         info.rti_addrs = rtm->rtm_addrs;
 497         if (rt_xaddrs((caddr_t)(rtm + 1), len + (caddr_t)rtm, &info)) {
 498                 info.rti_info[RTAX_DST] = NULL;
 499                 senderr(EINVAL);
 500         }
 501         info.rti_flags = rtm->rtm_flags;
 502         if (info.rti_info[RTAX_DST] == NULL ||
 503             info.rti_info[RTAX_DST]->sa_family >= AF_MAX ||
 504             (info.rti_info[RTAX_GATEWAY] != NULL &&
 505              info.rti_info[RTAX_GATEWAY]->sa_family >= AF_MAX))
 506                 senderr(EINVAL);
 507         /*
 508          * Verify that the caller has the appropriate privilege; RTM_GET
 509          * is the only operation the non-superuser is allowed.
 510          */
 511         if (rtm->rtm_type != RTM_GET) {
 512                 error = priv_check(curthread, PRIV_NET_ROUTE);
 513                 if (error)
 514                         senderr(error);
 515         }
 516
 517         /*
 518          * The given gateway address may be an interface address.
 519          * For example, issuing a "route change" command on a route
 520          * entry that was created from a tunnel, and the gateway
 521          * address given is the local end point. In this case the
 522          * RTF_GATEWAY flag must be cleared or the destination will
 523          * not be reachable even though there is no error message.
 524          */
 525         if (info.rti_info[RTAX_GATEWAY] != NULL &&
 526             info.rti_info[RTAX_GATEWAY]->sa_family != AF_LINK) {
 527                 struct route gw_ro;
 528
 529                 bzero(&gw_ro, sizeof(gw_ro));
 530                 gw_ro.ro_dst = *info.rti_info[RTAX_GATEWAY];
 531                 rtalloc_ign_fib(&gw_ro, 0, so->so_fibnum);
 532                 /*
 533                  * A host route through the loopback interface is
 534                  * installed for each interface adddress. In pre 8.0
 535                  * releases the interface address of a PPP link type
 536                  * is not reachable locally. This behavior is fixed as
 537                  * part of the new L2/L3 redesign and rewrite work. The
 538                  * signature of this interface address route is the
 539                  * AF_LINK sa_family type of the rt_gateway, and the
 540                  * rt_ifp has the IFF_LOOPBACK flag set.
 541                  */
 542                 if (gw_ro.ro_rt != NULL &&
 543                     gw_ro.ro_rt->rt_gateway->sa_family == AF_LINK &&
 544                     gw_ro.ro_rt->rt_ifp->if_flags & IFF_LOOPBACK)
 545                         info.rti_flags &= ~RTF_GATEWAY;
 546                 if (gw_ro.ro_rt != NULL)
 547                         RTFREE(gw_ro.ro_rt);
 548         }
 549
 550         switch (rtm->rtm_type) {
 551                 struct rtentry *saved_nrt;
 552
 553         case RTM_ADD:
 554                 if (info.rti_info[RTAX_GATEWAY] == NULL)
 555                         senderr(EINVAL);
 556                 saved_nrt = NULL;
 557
 558                 /* support for new ARP code */
 559                 if (info.rti_info[RTAX_GATEWAY]->sa_family == AF_LINK &&
 560                     (rtm->rtm_flags & RTF_LLDATA) != 0) {
 561                         error = lla_rt_output(rtm, &info);
 562                         break;
 563                 }
 564                 error = rtrequest1_fib(RTM_ADD, &info, &saved_nrt,
 565                     so->so_fibnum);
 566                 if (error == 0 && saved_nrt) {
 567                         RT_LOCK(saved_nrt);
 568                         rt_setmetrics(rtm->rtm_inits,
 569                                 &rtm->rtm_rmx, &saved_nrt->rt_rmx);
 570                         rtm->rtm_index = saved_nrt->rt_ifp->if_index;
 571                         RT_REMREF(saved_nrt);
 572                         RT_UNLOCK(saved_nrt);
 573                 }
 574                 break;
 575
 576         case RTM_DELETE:
 577                 saved_nrt = NULL;
 578                 /* support for new ARP code */
 579                 if (info.rti_info[RTAX_GATEWAY] &&
 580                     (info.rti_info[RTAX_GATEWAY]->sa_family == AF_LINK) &&
 581                     (rtm->rtm_flags & RTF_LLDATA) != 0) {
 582                         error = lla_rt_output(rtm, &info);
 583                         break;
 584                 }
 585                 error = rtrequest1_fib(RTM_DELETE, &info, &saved_nrt,
 586                     so->so_fibnum);
 587                 if (error == 0) {
 588                         RT_LOCK(saved_nrt);
 589                         rt = saved_nrt;
 590                         goto report;
 591                 }
 592                 break;
 593
 594         case RTM_GET:
 595         case RTM_CHANGE:
 596         case RTM_LOCK:
 597                 rnh = rt_tables_get_rnh(so->so_fibnum,
 598                     info.rti_info[RTAX_DST]->sa_family);
 599                 if (rnh == NULL)
 600                         senderr(EAFNOSUPPORT);
 601                 RADIX_NODE_HEAD_RLOCK(rnh);
 602                 rt = (struct rtentry *) rnh->rnh_lookup(info.rti_info[RTAX_DST],
 603                         info.rti_info[RTAX_NETMASK], rnh);
 604                 if (rt == NULL) {       /* XXX looks bogus */
 605                         RADIX_NODE_HEAD_RUNLOCK(rnh);
 606                         senderr(ESRCH);
 607                 }
 608 #ifdef RADIX_MPATH
 609                 /*
 610                  * for RTM_CHANGE/LOCK, if we got multipath routes,
 611                  * we require users to specify a matching RTAX_GATEWAY.
 612                  *
 613                  * for RTM_GET, gate is optional even with multipath.
 614                  * if gate == NULL the first match is returned.
 615                  * (no need to call rt_mpath_matchgate if gate == NULL)
 616                  */
 617                 if (rn_mpath_capable(rnh) &&
 618                     (rtm->rtm_type != RTM_GET || info.rti_info[RTAX_GATEWAY])) {
 619                         rt = rt_mpath_matchgate(rt, info.rti_info[RTAX_GATEWAY]);
 620                         if (!rt) {
 621                                 RADIX_NODE_HEAD_RUNLOCK(rnh);
 622                                 senderr(ESRCH);
 623                         }
 624                 }
 625 #endif
 626                 /*
 627                  * If performing proxied L2 entry insertion, and
 628                  * the actual PPP host entry is found, perform
 629                  * another search to retrieve the prefix route of
 630                  * the local end point of the PPP link.
 631                  */
 632                 if ((rtm->rtm_flags & RTF_ANNOUNCE) &&
 633                     (rt->rt_ifp->if_flags & IFF_POINTOPOINT)) {
 634                         struct sockaddr laddr;
 635                         rt_maskedcopy(rt->rt_ifa->ifa_addr,
 636                                       &laddr,
 637                                       rt->rt_ifa->ifa_netmask);
 638                         /*
 639                          * refactor rt and no lock operation necessary
 640                          */
 641                         rt = (struct rtentry *)rnh->rnh_matchaddr(&laddr, rnh);
 642                         if (rt == NULL) {
 643                                 RADIX_NODE_HEAD_RUNLOCK(rnh);
 644                                 senderr(ESRCH);
 645                         }
 646                 }
 647                 RT_LOCK(rt);
 648                 RT_ADDREF(rt);
 649                 RADIX_NODE_HEAD_RUNLOCK(rnh);
 650
 651                 /*
 652                  * Fix for PR: 82974
 653                  *
 654                  * RTM_CHANGE/LOCK need a perfect match, rn_lookup()
 655                  * returns a perfect match in case a netmask is
 656                  * specified.  For host routes only a longest prefix
 657                  * match is returned so it is necessary to compare the
 658                  * existence of the netmask.  If both have a netmask
 659                  * rnh_lookup() did a perfect match and if none of them
 660                  * have a netmask both are host routes which is also a
 661                  * perfect match.
 662                  */
 663
 664                 if (rtm->rtm_type != RTM_GET &&
 665                     (!rt_mask(rt) != !info.rti_info[RTAX_NETMASK])) {
 666                         RT_UNLOCK(rt);
 667                         senderr(ESRCH);
 668                 }
 669
 670                 switch(rtm->rtm_type) {
 671
 672                 case RTM_GET:
 673                 report:
 674                         RT_LOCK_ASSERT(rt);
 675                         if ((rt->rt_flags & RTF_HOST) == 0
 676                             ? jailed_without_vnet(curthread->td_ucred)
 677                             : prison_if(curthread->td_ucred,
 678                             rt_key(rt)) != 0) {
 679                                 RT_UNLOCK(rt);
 680                                 senderr(ESRCH);
 681                         }
 682                         info.rti_info[RTAX_DST] = rt_key(rt);
 683                         info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
 684                         info.rti_info[RTAX_NETMASK] = rt_mask(rt);
 685                         info.rti_info[RTAX_GENMASK] = 0;
 686                         if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
 687                                 ifp = rt->rt_ifp;
 688                                 if (ifp) {
 689                                         info.rti_info[RTAX_IFP] =
 690                                             ifp->if_addr->ifa_addr;
 691                                         error = rtm_get_jailed(&info, ifp, rt,
 692                                             &saun, curthread->td_ucred);
 693                                         if (error != 0) {
 694                                                 RT_UNLOCK(rt);
 695                                                 senderr(error);
 696                                         }
 697                                         if (ifp->if_flags & IFF_POINTOPOINT)
 698                                                 info.rti_info[RTAX_BRD] =
 699                                                     rt->rt_ifa->ifa_dstaddr;
 700                                         rtm->rtm_index = ifp->if_index;
 701                                 } else {
 702                                         info.rti_info[RTAX_IFP] = NULL;
 703                                         info.rti_info[RTAX_IFA] = NULL;
 704                                 }
 705                         } else if ((ifp = rt->rt_ifp) != NULL) {
 706                                 rtm->rtm_index = ifp->if_index;
 707                         }
 708                         len = rt_msg2(rtm->rtm_type, &info, NULL, NULL);
 709                         if (len > rtm->rtm_msglen) {
 710                                 struct rt_msghdr *new_rtm;
 711                                 R_Malloc(new_rtm, struct rt_msghdr *, len);
 712                                 if (new_rtm == NULL) {
 713                                         RT_UNLOCK(rt);
 714                                         senderr(ENOBUFS);
 715                                 }
 716                                 bcopy(rtm, new_rtm, rtm->rtm_msglen);
 717                                 Free(rtm); rtm = new_rtm;
 718                         }
 719                         (void)rt_msg2(rtm->rtm_type, &info, (caddr_t)rtm, NULL);
 720                         rtm->rtm_flags = rt->rt_flags;
 721                         rt_getmetrics(&rt->rt_rmx, &rtm->rtm_rmx);
 722                         rtm->rtm_addrs = info.rti_addrs;
 723                         break;
 724
 725                 case RTM_CHANGE:
 726                         /*
 727                          * New gateway could require new ifaddr, ifp;
 728                          * flags may also be different; ifp may be specified
 729                          * by ll sockaddr when protocol address is ambiguous
 730                          */
 731                         if (((rt->rt_flags & RTF_GATEWAY) &&
 732                              info.rti_info[RTAX_GATEWAY] != NULL) ||
 733                             info.rti_info[RTAX_IFP] != NULL ||
 734                             (info.rti_info[RTAX_IFA] != NULL &&
 735                              !sa_equal(info.rti_info[RTAX_IFA],
 736                                        rt->rt_ifa->ifa_addr))) {
 737                                 RT_UNLOCK(rt);
 738                                 RADIX_NODE_HEAD_LOCK(rnh);
 739                                 error = rt_getifa_fib(&info, rt->rt_fibnum);
 740                                 /*
 741                                  * XXXRW: Really we should release this
 742                                  * reference later, but this maintains
 743                                  * historical behavior.
 744                                  */
 745                                 if (info.rti_ifa != NULL)
 746                                         ifa_free(info.rti_ifa);
 747                                 RADIX_NODE_HEAD_UNLOCK(rnh);
 748                                 if (error != 0)
 749                                         senderr(error);
 750                                 RT_LOCK(rt);
 751                         }
 752                         if (info.rti_ifa != NULL &&
 753                             info.rti_ifa != rt->rt_ifa &&
 754                             rt->rt_ifa != NULL &&
 755                             rt->rt_ifa->ifa_rtrequest != NULL) {
 756                                 rt->rt_ifa->ifa_rtrequest(RTM_DELETE, rt,
 757                                     &info);
 758                                 ifa_free(rt->rt_ifa);
 759                         }
 760                         if (info.rti_info[RTAX_GATEWAY] != NULL) {
 761                                 RT_UNLOCK(rt);
 762                                 RADIX_NODE_HEAD_LOCK(rnh);
 763                                 RT_LOCK(rt);
 764
 765                                 error = rt_setgate(rt, rt_key(rt),
 766                                     info.rti_info[RTAX_GATEWAY]);
 767                                 RADIX_NODE_HEAD_UNLOCK(rnh);
 768                                 if (error != 0) {
 769                                         RT_UNLOCK(rt);
 770                                         senderr(error);
 771                                 }
 772                                 rt->rt_flags |= (RTF_GATEWAY & info.rti_flags);
 773                         }
 774                         if (info.rti_ifa != NULL &&
 775                             info.rti_ifa != rt->rt_ifa) {
 776                                 ifa_ref(info.rti_ifa);
 777                                 rt->rt_ifa = info.rti_ifa;
 778                                 rt->rt_ifp = info.rti_ifp;
 779                         }
 780                         /* Allow some flags to be toggled on change. */
 781                         rt->rt_flags = (rt->rt_flags & ~RTF_FMASK) |
 782                                     (rtm->rtm_flags & RTF_FMASK);
 783                         rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx,
 784                                         &rt->rt_rmx);
 785                         rtm->rtm_index = rt->rt_ifp->if_index;
 786                         if (rt->rt_ifa && rt->rt_ifa->ifa_rtrequest)
 787                                rt->rt_ifa->ifa_rtrequest(RTM_ADD, rt, &info);
 788                         /* FALLTHROUGH */
 789                 case RTM_LOCK:
 790                         /* We don't support locks anymore */
 791                         break;
 792                 }
 793                 RT_UNLOCK(rt);
 794                 break;
 795
 796         default:
 797                 senderr(EOPNOTSUPP);
 798         }
 799
 800 flush:
 801         if (rtm) {
 802                 if (error)
 803                         rtm->rtm_errno = error;
 804                 else
 805                         rtm->rtm_flags |= RTF_DONE;
 806         }
 807         if (rt)         /* XXX can this be true? */
 808                 RTFREE(rt);
 809     {
 810         struct rawcb *rp = NULL;
 811         /*
 812          * Check to see if we don't want our own messages.
 813          */
 814         if ((so->so_options & SO_USELOOPBACK) == 0) {
 815                 if (route_cb.any_count <= 1) {
 816                         if (rtm)
 817                                 Free(rtm);
 818                         m_freem(m);
 819                         return (error);
 820                 }
 821                 /* There is another listener, so construct message */
 822                 rp = sotorawcb(so);
 823         }
 824         if (rtm) {
 825                 m_copyback(m, 0, rtm->rtm_msglen, (caddr_t)rtm);
 826                 if (m->m_pkthdr.len < rtm->rtm_msglen) {
 827                         m_freem(m);
 828                         m = NULL;
 829                 } else if (m->m_pkthdr.len > rtm->rtm_msglen)
 830                         m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
 831                 Free(rtm);
 832         }
 833         if (m) {
 834                 if (rp) {
 835                         /*
 836                          * XXX insure we don't get a copy by
 837                          * invalidating our protocol
 838                          */
 839                         unsigned short family = rp->rcb_proto.sp_family;
 840                         rp->rcb_proto.sp_family = 0;
 841                         rt_dispatch(m, info.rti_info[RTAX_DST]);
 842                         rp->rcb_proto.sp_family = family;
 843                 } else
 844                         rt_dispatch(m, info.rti_info[RTAX_DST]);
 845         }
 846     }
 847         return (error);
 848 #undef  sa_equal
 849 }
 850
 851 static void
 852 rt_setmetrics(u_long which, const struct rt_metrics *in,
 853         struct rt_metrics_lite *out)
 854 {
 855 #define metric(f, e) if (which & (f)) out->e = in->e;
 856         /*
 857          * Only these are stored in the routing entry since introduction
 858          * of tcp hostcache. The rest is ignored.
 859          */
 860         metric(RTV_MTU, rmx_mtu);
 861         metric(RTV_WEIGHT, rmx_weight);
 862         /* Userland -> kernel timebase conversion. */
 863         if (which & RTV_EXPIRE)
 864                 out->rmx_expire = in->rmx_expire ?
 865                     in->rmx_expire - time_second + time_uptime : 0;
 866 #undef metric
 867 }
 868
 869 static void
 870 rt_getmetrics(const struct rt_metrics_lite *in, struct rt_metrics *out)
 871 {
 872 #define metric(e) out->e = in->e;
 873         bzero(out, sizeof(*out));
 874         metric(rmx_mtu);
 875         metric(rmx_weight);
 876         /* Kernel -> userland timebase conversion. */
 877         out->rmx_expire = in->rmx_expire ?
 878             in->rmx_expire - time_uptime + time_second : 0;
 879 #undef metric
 880 }
 881
 882 /*
 883  * Extract the addresses of the passed sockaddrs.
 884  * Do a little sanity checking so as to avoid bad memory references.
 885  * This data is derived straight from userland.
 886  */
 887 static int
 888 rt_xaddrs(caddr_t cp, caddr_t cplim, struct rt_addrinfo *rtinfo)
 889 {
 890         struct sockaddr *sa;
 891         int i;
 892
 893         for (i = 0; i < RTAX_MAX && cp < cplim; i++) {
 894                 if ((rtinfo->rti_addrs & (1 << i)) == 0)
 895                         continue;
 896                 sa = (struct sockaddr *)cp;
 897                 /*
 898                  * It won't fit.
 899                  */
 900                 if (cp + sa->sa_len > cplim)
 901                         return (EINVAL);
 902                 /*
 903                  * there are no more.. quit now
 904                  * If there are more bits, they are in error.
 905                  * I've seen this. route(1) can evidently generate these.
 906                  * This causes kernel to core dump.
 907                  * for compatibility, If we see this, point to a safe address.
 908                  */
 909                 if (sa->sa_len == 0) {
 910                         rtinfo->rti_info[i] = &sa_zero;
 911                         return (0); /* should be EINVAL but for compat */
 912                 }
 913                 /* accept it */
 914                 rtinfo->rti_info[i] = sa;
 915                 cp += SA_SIZE(sa);
 916         }
 917         return (0);
 918 }
 919
 920 static struct mbuf *
 921 rt_msg1(int type, struct rt_addrinfo *rtinfo)
 922 {
 923         struct rt_msghdr *rtm;
 924         struct mbuf *m;
 925         int i;
 926         struct sockaddr *sa;
 927         int len, dlen;
 928
 929         switch (type) {
 930
 931         case RTM_DELADDR:
 932         case RTM_NEWADDR:
 933                 len = sizeof(struct ifa_msghdr);
 934                 break;
 935
 936         case RTM_DELMADDR:
 937         case RTM_NEWMADDR:
 938                 len = sizeof(struct ifma_msghdr);
 939                 break;
 940
 941         case RTM_IFINFO:
 942                 len = sizeof(struct if_msghdr);
 943                 break;
 944
 945         case RTM_IFANNOUNCE:
 946         case RTM_IEEE80211:
 947                 len = sizeof(struct if_announcemsghdr);
 948                 break;
 949
 950         default:
 951                 len = sizeof(struct rt_msghdr);
 952         }
 953         if (len > MCLBYTES)
 954                 panic("rt_msg1");
 955         m = m_gethdr(M_DONTWAIT, MT_DATA);
 956         if (m && len > MHLEN) {
 957                 MCLGET(m, M_DONTWAIT);
 958                 if ((m->m_flags & M_EXT) == 0) {
 959                         m_free(m);
 960                         m = NULL;
 961                 }
 962         }
 963         if (m == NULL)
 964                 return (m);
 965         m->m_pkthdr.len = m->m_len = len;
 966         m->m_pkthdr.rcvif = NULL;
 967         rtm = mtod(m, struct rt_msghdr *);
 968         bzero((caddr_t)rtm, len);
 969         for (i = 0; i < RTAX_MAX; i++) {
 970                 if ((sa = rtinfo->rti_info[i]) == NULL)
 971                         continue;
 972                 rtinfo->rti_addrs |= (1 << i);
 973                 dlen = SA_SIZE(sa);
 974                 m_copyback(m, len, dlen, (caddr_t)sa);
 975                 len += dlen;
 976         }
 977         if (m->m_pkthdr.len != len) {
 978                 m_freem(m);
 979                 return (NULL);
 980         }
 981         rtm->rtm_msglen = len;
 982         rtm->rtm_version = RTM_VERSION;
 983         rtm->rtm_type = type;
 984         return (m);
 985 }
 986
 987 static int
 988 rt_msg2(int type, struct rt_addrinfo *rtinfo, caddr_t cp, struct walkarg *w)
 989 {
 990         int i;
 991         int len, dlen, second_time = 0;
 992         caddr_t cp0;
 993
 994         rtinfo->rti_addrs = 0;
 995 again:
 996         switch (type) {
 997
 998         case RTM_DELADDR:
 999         case RTM_NEWADDR:
1000                 len = sizeof(struct ifa_msghdr);
1001                 break;
1002
1003         case RTM_IFINFO:
1004                 len = sizeof(struct if_msghdr);
1005                 break;
1006
1007         case RTM_NEWMADDR:
1008                 len = sizeof(struct ifma_msghdr);
1009                 break;
1010
1011         default:
1012                 len = sizeof(struct rt_msghdr);
1013         }
1014         cp0 = cp;
1015         if (cp0)
1016                 cp += len;
1017         for (i = 0; i < RTAX_MAX; i++) {
1018                 struct sockaddr *sa;
1019
1020                 if ((sa = rtinfo->rti_info[i]) == NULL)
1021                         continue;
1022                 rtinfo->rti_addrs |= (1 << i);
1023                 dlen = SA_SIZE(sa);
1024                 if (cp) {
1025                         bcopy((caddr_t)sa, cp, (unsigned)dlen);
1026                         cp += dlen;
1027                 }
1028                 len += dlen;
1029         }
1030         len = ALIGN(len);
1031         if (cp == NULL && w != NULL && !second_time) {
1032                 struct walkarg *rw = w;
1033
1034                 if (rw->w_req) {
1035                         if (rw->w_tmemsize < len) {
1036                                 if (rw->w_tmem)
1037                                         free(rw->w_tmem, M_RTABLE);
1038                                 rw->w_tmem = (caddr_t)
1039                                         malloc(len, M_RTABLE, M_NOWAIT);
1040                                 if (rw->w_tmem)
1041                                         rw->w_tmemsize = len;
1042                         }
1043                         if (rw->w_tmem) {
1044                                 cp = rw->w_tmem;
1045                                 second_time = 1;
1046                                 goto again;
1047                         }
1048                 }
1049         }
1050         if (cp) {
1051                 struct rt_msghdr *rtm = (struct rt_msghdr *)cp0;
1052
1053                 rtm->rtm_version = RTM_VERSION;
1054                 rtm->rtm_type = type;
1055                 rtm->rtm_msglen = len;
1056         }
1057         return (len);
1058 }
1059
1060 /*
1061  * This routine is called to generate a message from the routing
1062  * socket indicating that a redirect has occured, a routing lookup
1063  * has failed, or that a protocol has detected timeouts to a particular
1064  * destination.
1065  */
1066 void
1067 rt_missmsg(int type, struct rt_addrinfo *rtinfo, int flags, int error)
1068 {
1069         struct rt_msghdr *rtm;
1070         struct mbuf *m;
1071         struct sockaddr *sa = rtinfo->rti_info[RTAX_DST];
1072
1073         if (route_cb.any_count == 0)
1074                 return;
1075         m = rt_msg1(type, rtinfo);
1076         if (m == NULL)
1077                 return;
1078         rtm = mtod(m, struct rt_msghdr *);
1079         rtm->rtm_flags = RTF_DONE | flags;
1080         rtm->rtm_errno = error;
1081         rtm->rtm_addrs = rtinfo->rti_addrs;
1082         rt_dispatch(m, sa);
1083 }
1084
1085 /*
1086  * This routine is called to generate a message from the routing
1087  * socket indicating that the status of a network interface has changed.
1088  */
1089 void
1090 rt_ifmsg(struct ifnet *ifp)
1091 {
1092         struct if_msghdr *ifm;
1093         struct mbuf *m;
1094         struct rt_addrinfo info;
1095
1096         if (route_cb.any_count == 0)
1097                 return;
1098         bzero((caddr_t)&info, sizeof(info));
1099         m = rt_msg1(RTM_IFINFO, &info);
1100         if (m == NULL)
1101                 return;
1102         ifm = mtod(m, struct if_msghdr *);
1103         ifm->ifm_index = ifp->if_index;
1104         ifm->ifm_flags = ifp->if_flags | ifp->if_drv_flags;
1105         ifm->ifm_data = ifp->if_data;
1106         ifm->ifm_addrs = 0;
1107         rt_dispatch(m, NULL);
1108 }
1109
1110 /*
1111  * This is called to generate messages from the routing socket
1112  * indicating a network interface has had addresses associated with it.
1113  * if we ever reverse the logic and replace messages TO the routing
1114  * socket indicate a request to configure interfaces, then it will
1115  * be unnecessary as the routing socket will automatically generate
1116  * copies of it.
1117  */
1118 void
1119 rt_newaddrmsg(int cmd, struct ifaddr *ifa, int error, struct rtentry *rt)
1120 {
1121         struct rt_addrinfo info;
1122         struct sockaddr *sa = NULL;
1123         int pass;
1124         struct mbuf *m = NULL;
1125         struct ifnet *ifp = ifa->ifa_ifp;
1126
1127         KASSERT(cmd == RTM_ADD || cmd == RTM_DELETE,
1128                 ("unexpected cmd %u", cmd));
1129 #if defined(INET) || defined(INET6)
1130 #ifdef SCTP
1131         /*
1132          * notify the SCTP stack
1133          * this will only get called when an address is added/deleted
1134          * XXX pass the ifaddr struct instead if ifa->ifa_addr...
1135          */
1136         sctp_addr_change(ifa, cmd);
1137 #endif /* SCTP */
1138 #endif
1139         if (route_cb.any_count == 0)
1140                 return;
1141         for (pass = 1; pass < 3; pass++) {
1142                 bzero((caddr_t)&info, sizeof(info));
1143                 if ((cmd == RTM_ADD && pass == 1) ||
1144                     (cmd == RTM_DELETE && pass == 2)) {
1145                         struct ifa_msghdr *ifam;
1146                         int ncmd = cmd == RTM_ADD ? RTM_NEWADDR : RTM_DELADDR;
1147
1148                         info.rti_info[RTAX_IFA] = sa = ifa->ifa_addr;
1149                         info.rti_info[RTAX_IFP] = ifp->if_addr->ifa_addr;
1150                         info.rti_info[RTAX_NETMASK] = ifa->ifa_netmask;
1151                         info.rti_info[RTAX_BRD] = ifa->ifa_dstaddr;
1152                         if ((m = rt_msg1(ncmd, &info)) == NULL)
1153                                 continue;
1154                         ifam = mtod(m, struct ifa_msghdr *);
1155                         ifam->ifam_index = ifp->if_index;
1156                         ifam->ifam_metric = ifa->ifa_metric;
1157                         ifam->ifam_flags = ifa->ifa_flags;
1158                         ifam->ifam_addrs = info.rti_addrs;
1159                 }
1160                 if ((cmd == RTM_ADD && pass == 2) ||
1161                     (cmd == RTM_DELETE && pass == 1)) {
1162                         struct rt_msghdr *rtm;
1163
1164                         if (rt == NULL)
1165                                 continue;
1166                         info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1167                         info.rti_info[RTAX_DST] = sa = rt_key(rt);
1168                         info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1169                         if ((m = rt_msg1(cmd, &info)) == NULL)
1170                                 continue;
1171                         rtm = mtod(m, struct rt_msghdr *);
1172                         rtm->rtm_index = ifp->if_index;
1173                         rtm->rtm_flags |= rt->rt_flags;
1174                         rtm->rtm_errno = error;
1175                         rtm->rtm_addrs = info.rti_addrs;
1176                 }
1177                 rt_dispatch(m, sa);
1178         }
1179 }
1180
1181 /*
1182  * This is the analogue to the rt_newaddrmsg which performs the same
1183  * function but for multicast group memberhips.  This is easier since
1184  * there is no route state to worry about.
1185  */
1186 void
1187 rt_newmaddrmsg(int cmd, struct ifmultiaddr *ifma)
1188 {
1189         struct rt_addrinfo info;
1190         struct mbuf *m = NULL;
1191         struct ifnet *ifp = ifma->ifma_ifp;
1192         struct ifma_msghdr *ifmam;
1193
1194         if (route_cb.any_count == 0)
1195                 return;
1196
1197         bzero((caddr_t)&info, sizeof(info));
1198         info.rti_info[RTAX_IFA] = ifma->ifma_addr;
1199         info.rti_info[RTAX_IFP] = ifp ? ifp->if_addr->ifa_addr : NULL;
1200         /*
1201          * If a link-layer address is present, present it as a ``gateway''
1202          * (similarly to how ARP entries, e.g., are presented).
1203          */
1204         info.rti_info[RTAX_GATEWAY] = ifma->ifma_lladdr;
1205         m = rt_msg1(cmd, &info);
1206         if (m == NULL)
1207                 return;
1208         ifmam = mtod(m, struct ifma_msghdr *);
1209         KASSERT(ifp != NULL, ("%s: link-layer multicast address w/o ifp\n",
1210             __func__));
1211         ifmam->ifmam_index = ifp->if_index;
1212         ifmam->ifmam_addrs = info.rti_addrs;
1213         rt_dispatch(m, ifma->ifma_addr);
1214 }
1215
1216 static struct mbuf *
1217 rt_makeifannouncemsg(struct ifnet *ifp, int type, int what,
1218         struct rt_addrinfo *info)
1219 {
1220         struct if_announcemsghdr *ifan;
1221         struct mbuf *m;
1222
1223         if (route_cb.any_count == 0)
1224                 return NULL;
1225         bzero((caddr_t)info, sizeof(*info));
1226         m = rt_msg1(type, info);
1227         if (m != NULL) {
1228                 ifan = mtod(m, struct if_announcemsghdr *);
1229                 ifan->ifan_index = ifp->if_index;
1230                 strlcpy(ifan->ifan_name, ifp->if_xname,
1231                         sizeof(ifan->ifan_name));
1232                 ifan->ifan_what = what;
1233         }
1234         return m;
1235 }
1236
1237 /*
1238  * This is called to generate routing socket messages indicating
1239  * IEEE80211 wireless events.
1240  * XXX we piggyback on the RTM_IFANNOUNCE msg format in a clumsy way.
1241  */
1242 void
1243 rt_ieee80211msg(struct ifnet *ifp, int what, void *data, size_t data_len)
1244 {
1245         struct mbuf *m;
1246         struct rt_addrinfo info;
1247
1248         m = rt_makeifannouncemsg(ifp, RTM_IEEE80211, what, &info);
1249         if (m != NULL) {
1250                 /*
1251                  * Append the ieee80211 data.  Try to stick it in the
1252                  * mbuf containing the ifannounce msg; otherwise allocate
1253                  * a new mbuf and append.
1254                  *
1255                  * NB: we assume m is a single mbuf.
1256                  */
1257                 if (data_len > M_TRAILINGSPACE(m)) {
1258                         struct mbuf *n = m_get(M_NOWAIT, MT_DATA);
1259                         if (n == NULL) {
1260                                 m_freem(m);
1261                                 return;
1262                         }
1263                         bcopy(data, mtod(n, void *), data_len);
1264                         n->m_len = data_len;
1265                         m->m_next = n;
1266                 } else if (data_len > 0) {
1267                         bcopy(data, mtod(m, u_int8_t *) + m->m_len, data_len);
1268                         m->m_len += data_len;
1269                 }
1270                 if (m->m_flags & M_PKTHDR)
1271                         m->m_pkthdr.len += data_len;
1272                 mtod(m, struct if_announcemsghdr *)->ifan_msglen += data_len;
1273                 rt_dispatch(m, NULL);
1274         }
1275 }
1276
1277 /*
1278  * This is called to generate routing socket messages indicating
1279  * network interface arrival and departure.
1280  */
1281 void
1282 rt_ifannouncemsg(struct ifnet *ifp, int what)
1283 {
1284         struct mbuf *m;
1285         struct rt_addrinfo info;
1286
1287         m = rt_makeifannouncemsg(ifp, RTM_IFANNOUNCE, what, &info);
1288         if (m != NULL)
1289                 rt_dispatch(m, NULL);
1290 }
1291
1292 static void
1293 rt_dispatch(struct mbuf *m, const struct sockaddr *sa)
1294 {
1295         struct m_tag *tag;
1296
1297         /*
1298          * Preserve the family from the sockaddr, if any, in an m_tag for
1299          * use when injecting the mbuf into the routing socket buffer from
1300          * the netisr.
1301          */
1302         if (sa != NULL) {
1303                 tag = m_tag_get(PACKET_TAG_RTSOCKFAM, sizeof(unsigned short),
1304                     M_NOWAIT);
1305                 if (tag == NULL) {
1306                         m_freem(m);
1307                         return;
1308                 }
1309                 *(unsigned short *)(tag + 1) = sa->sa_family;
1310                 m_tag_prepend(m, tag);
1311         }
1312 #ifdef VIMAGE
1313         if (V_loif)
1314                 m->m_pkthdr.rcvif = V_loif;
1315         else {
1316                 m_freem(m);
1317                 return;
1318         }
1319 #endif
1320         netisr_queue(NETISR_ROUTE, m);  /* mbuf is free'd on failure. */
1321 }
1322
1323 /*
1324  * This is used in dumping the kernel table via sysctl().
1325  */
1326 static int
1327 sysctl_dumpentry(struct radix_node *rn, void *vw)
1328 {
1329         struct walkarg *w = vw;
1330         struct rtentry *rt = (struct rtentry *)rn;
1331         int error = 0, size;
1332         struct rt_addrinfo info;
1333
1334         if (w->w_op == NET_RT_FLAGS && !(rt->rt_flags & w->w_arg))
1335                 return 0;
1336         if ((rt->rt_flags & RTF_HOST) == 0
1337             ? jailed_without_vnet(w->w_req->td->td_ucred)
1338             : prison_if(w->w_req->td->td_ucred, rt_key(rt)) != 0)
1339                 return (0);
1340         bzero((caddr_t)&info, sizeof(info));
1341         info.rti_info[RTAX_DST] = rt_key(rt);
1342         info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1343         info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1344         info.rti_info[RTAX_GENMASK] = 0;
1345         if (rt->rt_ifp) {
1346                 info.rti_info[RTAX_IFP] = rt->rt_ifp->if_addr->ifa_addr;
1347                 info.rti_info[RTAX_IFA] = rt->rt_ifa->ifa_addr;
1348                 if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
1349                         info.rti_info[RTAX_BRD] = rt->rt_ifa->ifa_dstaddr;
1350         }
1351         size = rt_msg2(RTM_GET, &info, NULL, w);
1352         if (w->w_req && w->w_tmem) {
1353                 struct rt_msghdr *rtm = (struct rt_msghdr *)w->w_tmem;
1354
1355                 rtm->rtm_flags = rt->rt_flags;
1356                 /*
1357                  * let's be honest about this being a retarded hack
1358                  */
1359                 rtm->rtm_fmask = rt->rt_rmx.rmx_pksent;
1360                 rt_getmetrics(&rt->rt_rmx, &rtm->rtm_rmx);
1361                 rtm->rtm_index = rt->rt_ifp->if_index;
1362                 rtm->rtm_errno = rtm->rtm_pid = rtm->rtm_seq = 0;
1363                 rtm->rtm_addrs = info.rti_addrs;
1364                 error = SYSCTL_OUT(w->w_req, (caddr_t)rtm, size);
1365                 return (error);
1366         }
1367         return (error);
1368 }
1369
1370 static int
1371 sysctl_iflist(int af, struct walkarg *w)
1372 {
1373         struct ifnet *ifp;
1374         struct ifaddr *ifa;
1375         struct rt_addrinfo info;
1376         int len, error = 0;
1377
1378         bzero((caddr_t)&info, sizeof(info));
1379         IFNET_RLOCK();
1380         TAILQ_FOREACH(ifp, &V_ifnet, if_link) {
1381                 if (w->w_arg && w->w_arg != ifp->if_index)
1382                         continue;
1383                 ifa = ifp->if_addr;
1384                 info.rti_info[RTAX_IFP] = ifa->ifa_addr;
1385                 len = rt_msg2(RTM_IFINFO, &info, NULL, w);
1386                 info.rti_info[RTAX_IFP] = NULL;
1387                 if (w->w_req && w->w_tmem) {
1388                         struct if_msghdr *ifm;
1389
1390                         ifm = (struct if_msghdr *)w->w_tmem;
1391                         ifm->ifm_index = ifp->if_index;
1392                         ifm->ifm_flags = ifp->if_flags | ifp->if_drv_flags;
1393                         ifm->ifm_data = ifp->if_data;
1394                         ifm->ifm_addrs = info.rti_addrs;
1395                         error = SYSCTL_OUT(w->w_req,(caddr_t)ifm, len);
1396                         if (error)
1397                                 goto done;
1398                 }
1399                 while ((ifa = TAILQ_NEXT(ifa, ifa_link)) != NULL) {
1400                         if (af && af != ifa->ifa_addr->sa_family)
1401                                 continue;
1402                         if (prison_if(w->w_req->td->td_ucred,
1403                             ifa->ifa_addr) != 0)
1404                                 continue;
1405                         info.rti_info[RTAX_IFA] = ifa->ifa_addr;
1406                         info.rti_info[RTAX_NETMASK] = ifa->ifa_netmask;
1407                         info.rti_info[RTAX_BRD] = ifa->ifa_dstaddr;
1408                         len = rt_msg2(RTM_NEWADDR, &info, NULL, w);
1409                         if (w->w_req && w->w_tmem) {
1410                                 struct ifa_msghdr *ifam;
1411
1412                                 ifam = (struct ifa_msghdr *)w->w_tmem;
1413                                 ifam->ifam_index = ifa->ifa_ifp->if_index;
1414                                 ifam->ifam_flags = ifa->ifa_flags;
1415                                 ifam->ifam_metric = ifa->ifa_metric;
1416                                 ifam->ifam_addrs = info.rti_addrs;
1417                                 error = SYSCTL_OUT(w->w_req, w->w_tmem, len);
1418                                 if (error)
1419                                         goto done;
1420                         }
1421                 }
1422                 info.rti_info[RTAX_IFA] = info.rti_info[RTAX_NETMASK] =
1423                         info.rti_info[RTAX_BRD] = NULL;
1424         }
1425 done:
1426         IFNET_RUNLOCK();
1427         return (error);
1428 }
1429
1430 static int
1431 sysctl_ifmalist(int af, struct walkarg *w)
1432 {
1433         struct ifnet *ifp;
1434         struct ifmultiaddr *ifma;
1435         struct  rt_addrinfo info;
1436         int     len, error = 0;
1437         struct ifaddr *ifa;
1438
1439         bzero((caddr_t)&info, sizeof(info));
1440         IFNET_RLOCK();
1441         TAILQ_FOREACH(ifp, &V_ifnet, if_link) {
1442                 if (w->w_arg && w->w_arg != ifp->if_index)
1443                         continue;
1444                 ifa = ifp->if_addr;
1445                 info.rti_info[RTAX_IFP] = ifa ? ifa->ifa_addr : NULL;
1446                 IF_ADDR_LOCK(ifp);
1447                 TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1448                         if (af && af != ifma->ifma_addr->sa_family)
1449                                 continue;
1450                         if (prison_if(w->w_req->td->td_ucred,
1451                             ifma->ifma_addr) != 0)
1452                                 continue;
1453                         info.rti_info[RTAX_IFA] = ifma->ifma_addr;
1454                         info.rti_info[RTAX_GATEWAY] =
1455                             (ifma->ifma_addr->sa_family != AF_LINK) ?
1456                             ifma->ifma_lladdr : NULL;
1457                         len = rt_msg2(RTM_NEWMADDR, &info, NULL, w);
1458                         if (w->w_req && w->w_tmem) {
1459                                 struct ifma_msghdr *ifmam;
1460
1461                                 ifmam = (struct ifma_msghdr *)w->w_tmem;
1462                                 ifmam->ifmam_index = ifma->ifma_ifp->if_index;
1463                                 ifmam->ifmam_flags = 0;
1464                                 ifmam->ifmam_addrs = info.rti_addrs;
1465                                 error = SYSCTL_OUT(w->w_req, w->w_tmem, len);
1466                                 if (error) {
1467                                         IF_ADDR_UNLOCK(ifp);
1468                                         goto done;
1469                                 }
1470                         }
1471                 }
1472                 IF_ADDR_UNLOCK(ifp);
1473         }
1474 done:
1475         IFNET_RUNLOCK();
1476         return (error);
1477 }
1478
1479 static int
1480 sysctl_rtsock(SYSCTL_HANDLER_ARGS)
1481 {
1482         int     *name = (int *)arg1;
1483         u_int   namelen = arg2;
1484         struct radix_node_head *rnh = NULL; /* silence compiler. */
1485         int     i, lim, error = EINVAL;
1486         u_char  af;
1487         struct  walkarg w;
1488
1489         name ++;
1490         namelen--;
1491         if (req->newptr)
1492                 return (EPERM);
1493         if (namelen != 3)
1494                 return ((namelen < 3) ? EISDIR : ENOTDIR);
1495         af = name[0];
1496         if (af > AF_MAX)
1497                 return (EINVAL);
1498         bzero(&w, sizeof(w));
1499         w.w_op = name[1];
1500         w.w_arg = name[2];
1501         w.w_req = req;
1502
1503         error = sysctl_wire_old_buffer(req, 0);
1504         if (error)
1505                 return (error);
1506         switch (w.w_op) {
1507
1508         case NET_RT_DUMP:
1509         case NET_RT_FLAGS:
1510                 if (af == 0) {                  /* dump all tables */
1511                         i = 1;
1512                         lim = AF_MAX;
1513                 } else                          /* dump only one table */
1514                         i = lim = af;
1515
1516                 /*
1517                  * take care of llinfo entries, the caller must
1518                  * specify an AF
1519                  */
1520                 if (w.w_op == NET_RT_FLAGS &&
1521                     (w.w_arg == 0 || w.w_arg & RTF_LLINFO)) {
1522                         if (af != 0)
1523                                 error = lltable_sysctl_dumparp(af, w.w_req);
1524                         else
1525                                 error = EINVAL;
1526                         break;
1527                 }
1528                 /*
1529                  * take care of routing entries
1530                  */
1531                 for (error = 0; error == 0 && i <= lim; i++) {
1532                         rnh = rt_tables_get_rnh(req->td->td_proc->p_fibnum, i);
1533                         if (rnh != NULL) {
1534                                 RADIX_NODE_HEAD_LOCK(rnh);
1535                                 error = rnh->rnh_walktree(rnh,
1536                                     sysctl_dumpentry, &w);
1537                                 RADIX_NODE_HEAD_UNLOCK(rnh);
1538                         } else if (af != 0)
1539                                 error = EAFNOSUPPORT;
1540                 }
1541                 break;
1542
1543         case NET_RT_IFLIST:
1544                 error = sysctl_iflist(af, &w);
1545                 break;
1546
1547         case NET_RT_IFMALIST:
1548                 error = sysctl_ifmalist(af, &w);
1549                 break;
1550         }
1551         if (w.w_tmem)
1552                 free(w.w_tmem, M_RTABLE);
1553         return (error);
1554 }
1555
1556 SYSCTL_NODE(_net, PF_ROUTE, routetable, CTLFLAG_RD, sysctl_rtsock, "");
1557
1558 /*
1559  * Definitions of protocols supported in the ROUTE domain.
1560  */
1561
1562 static struct domain routedomain;               /* or at least forward */
1563
1564 static struct protosw routesw[] = {
1565 {
1566         .pr_type =              SOCK_RAW,
1567         .pr_domain =            &routedomain,
1568         .pr_flags =             PR_ATOMIC|PR_ADDR,
1569         .pr_output =            route_output,
1570         .pr_ctlinput =          raw_ctlinput,
1571         .pr_init =              raw_init,
1572         .pr_usrreqs =           &route_usrreqs
1573 }
1574 };
1575
1576 static struct domain routedomain = {
1577         .dom_family =           PF_ROUTE,
1578         .dom_name =              "route",
1579         .dom_protosw =          routesw,
1580         .dom_protoswNPROTOSW =  &routesw[sizeof(routesw)/sizeof(routesw[0])]
1581 };
1582
1583 VNET_DOMAIN_SET(route);