xref: /dragonfly/sys/net/rtsock.c (revision 8e11cefe)
1 /*
2  * Copyright (c) 2004, 2005 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Jeffrey M. Hsu.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of The DragonFly Project nor the names of its
16  *    contributors may be used to endorse or promote products derived
17  *    from this software without specific, prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
27  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
29  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1988, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)rtsock.c	8.7 (Berkeley) 10/12/95
62  * $FreeBSD: src/sys/net/rtsock.c,v 1.44.2.11 2002/12/04 14:05:41 ru Exp $
63  */
64 
65 #include <sys/param.h>
66 #include <sys/systm.h>
67 #include <sys/kernel.h>
68 #include <sys/sysctl.h>
69 #include <sys/proc.h>
70 #include <sys/priv.h>
71 #include <sys/malloc.h>
72 #include <sys/mbuf.h>
73 #include <sys/protosw.h>
74 #include <sys/socket.h>
75 #include <sys/socketvar.h>
76 #include <sys/domain.h>
77 #include <sys/jail.h>
78 
79 #include <sys/thread2.h>
80 #include <sys/socketvar2.h>
81 
82 #include <net/if.h>
83 #include <net/if_var.h>
84 #include <net/route.h>
85 #include <net/raw_cb.h>
86 #include <net/netmsg2.h>
87 #include <net/netisr2.h>
88 
89 MALLOC_DEFINE(M_RTABLE, "routetbl", "routing tables");
90 
91 static struct route_cb {
92 	int	ip_count;
93 	int	ip6_count;
94 	int	ns_count;
95 	int	any_count;
96 } route_cb;
97 
98 static const struct sockaddr route_src = { 2, PF_ROUTE, };
99 
100 struct walkarg {
101 	int	w_tmemsize;
102 	int	w_op, w_arg;
103 	void	*w_tmem;
104 	struct sysctl_req *w_req;
105 };
106 
107 #ifndef RTTABLE_DUMP_MSGCNT_MAX
108 /* Should be large enough for dupkeys */
109 #define RTTABLE_DUMP_MSGCNT_MAX		64
110 #endif
111 
112 struct rttable_walkarg {
113 	int	w_op;
114 	int	w_arg;
115 	int	w_bufsz;
116 	void	*w_buf;
117 
118 	int	w_buflen;
119 
120 	const char *w_key;
121 	const char *w_mask;
122 
123 	struct sockaddr_storage w_key0;
124 	struct sockaddr_storage w_mask0;
125 };
126 
127 struct netmsg_rttable_walk {
128 	struct netmsg_base	base;
129 	int			af;
130 	struct rttable_walkarg	*w;
131 };
132 
133 struct routecb {
134 	struct rawcb	rocb_rcb;
135 	unsigned int	rocb_msgfilter;
136 };
137 #define	sotoroutecb(so)	((struct routecb *)(so)->so_pcb)
138 
139 static struct mbuf *
140 		rt_msg_mbuf (int, struct rt_addrinfo *);
141 static void	rt_msg_buffer (int, struct rt_addrinfo *, void *buf, int len);
142 static int	rt_msgsize(int type, const struct rt_addrinfo *rtinfo);
143 static int	rt_xaddrs (char *, char *, struct rt_addrinfo *);
144 static int	sysctl_rttable(int af, struct sysctl_req *req, int op, int arg);
145 static int	if_addrflags(const struct ifaddr *ifa);
146 static int	sysctl_iflist (int af, struct walkarg *w);
147 static int	route_output(struct mbuf *, struct socket *, ...);
148 static void	rt_setmetrics (u_long, struct rt_metrics *,
149 			       struct rt_metrics *);
150 
151 /*
152  * It really doesn't make any sense at all for this code to share much
153  * with raw_usrreq.c, since its functionality is so restricted.  XXX
154  */
155 static void
156 rts_abort(netmsg_t msg)
157 {
158 	crit_enter();
159 	raw_usrreqs.pru_abort(msg);
160 	/* msg invalid now */
161 	crit_exit();
162 }
163 
164 static int
165 rts_filter(struct mbuf *m, const struct sockproto *proto,
166 	const struct rawcb *rp)
167 {
168 	const struct routecb *rop = (const struct routecb *)rp;
169 	const struct rt_msghdr *rtm;
170 
171 	KKASSERT(m != NULL);
172 	KKASSERT(proto != NULL);
173 	KKASSERT(rp != NULL);
174 
175 	/* Wrong family for this socket. */
176 	if (proto->sp_family != PF_ROUTE)
177 		return ENOPROTOOPT;
178 
179 	/* If no filter set, just return. */
180 	if (rop->rocb_msgfilter == 0)
181 		return 0;
182 
183 	/* Ensure we can access rtm_type */
184 	if (m->m_len <
185 	    offsetof(struct rt_msghdr, rtm_type) + sizeof(rtm->rtm_type))
186 		return EINVAL;
187 
188 	rtm = mtod(m, const struct rt_msghdr *);
189 	/* If the rtm type is filtered out, return a positive. */
190 	if (!(rop->rocb_msgfilter & ROUTE_FILTER(rtm->rtm_type)))
191 		return EEXIST;
192 
193 	/* Passed the filter. */
194 	return 0;
195 }
196 
197 
198 /* pru_accept is EOPNOTSUPP */
199 
200 static void
201 rts_attach(netmsg_t msg)
202 {
203 	struct socket *so = msg->base.nm_so;
204 	struct pru_attach_info *ai = msg->attach.nm_ai;
205 	struct rawcb *rp;
206 	struct routecb *rop;
207 	int proto = msg->attach.nm_proto;
208 	int error;
209 
210 	crit_enter();
211 	if (sotorawcb(so) != NULL) {
212 		error = EISCONN;
213 		goto done;
214 	}
215 
216 	rop = kmalloc(sizeof *rop, M_PCB, M_WAITOK | M_ZERO);
217 	rp = &rop->rocb_rcb;
218 
219 	/*
220 	 * The critical section is necessary to block protocols from sending
221 	 * error notifications (like RTM_REDIRECT or RTM_LOSING) while
222 	 * this PCB is extant but incompletely initialized.
223 	 * Probably we should try to do more of this work beforehand and
224 	 * eliminate the critical section.
225 	 */
226 	so->so_pcb = rp;
227 	soreference(so);	/* so_pcb assignment */
228 	error = raw_attach(so, proto, ai->sb_rlimit);
229 	rp = sotorawcb(so);
230 	if (error) {
231 		kfree(rop, M_PCB);
232 		goto done;
233 	}
234 	switch(rp->rcb_proto.sp_protocol) {
235 	case AF_INET:
236 		route_cb.ip_count++;
237 		break;
238 	case AF_INET6:
239 		route_cb.ip6_count++;
240 		break;
241 	}
242 	rp->rcb_faddr = &route_src;
243 	rp->rcb_filter = rts_filter;
244 	route_cb.any_count++;
245 	soisconnected(so);
246 	so->so_options |= SO_USELOOPBACK;
247 	error = 0;
248 done:
249 	crit_exit();
250 	lwkt_replymsg(&msg->lmsg, error);
251 }
252 
253 static void
254 rts_bind(netmsg_t msg)
255 {
256 	crit_enter();
257 	raw_usrreqs.pru_bind(msg); /* xxx just EINVAL */
258 	/* msg invalid now */
259 	crit_exit();
260 }
261 
262 static void
263 rts_connect(netmsg_t msg)
264 {
265 	crit_enter();
266 	raw_usrreqs.pru_connect(msg); /* XXX just EINVAL */
267 	/* msg invalid now */
268 	crit_exit();
269 }
270 
271 /* pru_connect2 is EOPNOTSUPP */
272 /* pru_control is EOPNOTSUPP */
273 
274 static void
275 rts_detach(netmsg_t msg)
276 {
277 	struct socket *so = msg->base.nm_so;
278 	struct rawcb *rp = sotorawcb(so);
279 
280 	crit_enter();
281 	if (rp != NULL) {
282 		switch(rp->rcb_proto.sp_protocol) {
283 		case AF_INET:
284 			route_cb.ip_count--;
285 			break;
286 		case AF_INET6:
287 			route_cb.ip6_count--;
288 			break;
289 		}
290 		route_cb.any_count--;
291 	}
292 	raw_usrreqs.pru_detach(msg);
293 	/* msg invalid now */
294 	crit_exit();
295 }
296 
297 static void
298 rts_disconnect(netmsg_t msg)
299 {
300 	crit_enter();
301 	raw_usrreqs.pru_disconnect(msg);
302 	/* msg invalid now */
303 	crit_exit();
304 }
305 
306 /* pru_listen is EOPNOTSUPP */
307 
308 static void
309 rts_peeraddr(netmsg_t msg)
310 {
311 	crit_enter();
312 	raw_usrreqs.pru_peeraddr(msg);
313 	/* msg invalid now */
314 	crit_exit();
315 }
316 
317 /* pru_rcvd is EOPNOTSUPP */
318 /* pru_rcvoob is EOPNOTSUPP */
319 
320 static void
321 rts_send(netmsg_t msg)
322 {
323 	crit_enter();
324 	raw_usrreqs.pru_send(msg);
325 	/* msg invalid now */
326 	crit_exit();
327 }
328 
329 /* pru_sense is null */
330 
331 static void
332 rts_shutdown(netmsg_t msg)
333 {
334 	crit_enter();
335 	raw_usrreqs.pru_shutdown(msg);
336 	/* msg invalid now */
337 	crit_exit();
338 }
339 
340 static void
341 rts_sockaddr(netmsg_t msg)
342 {
343 	crit_enter();
344 	raw_usrreqs.pru_sockaddr(msg);
345 	/* msg invalid now */
346 	crit_exit();
347 }
348 
349 static struct pr_usrreqs route_usrreqs = {
350 	.pru_abort = rts_abort,
351 	.pru_accept = pr_generic_notsupp,
352 	.pru_attach = rts_attach,
353 	.pru_bind = rts_bind,
354 	.pru_connect = rts_connect,
355 	.pru_connect2 = pr_generic_notsupp,
356 	.pru_control = pr_generic_notsupp,
357 	.pru_detach = rts_detach,
358 	.pru_disconnect = rts_disconnect,
359 	.pru_listen = pr_generic_notsupp,
360 	.pru_peeraddr = rts_peeraddr,
361 	.pru_rcvd = pr_generic_notsupp,
362 	.pru_rcvoob = pr_generic_notsupp,
363 	.pru_send = rts_send,
364 	.pru_sense = pru_sense_null,
365 	.pru_shutdown = rts_shutdown,
366 	.pru_sockaddr = rts_sockaddr,
367 	.pru_sosend = sosend,
368 	.pru_soreceive = soreceive
369 };
370 
371 static __inline sa_family_t
372 familyof(struct sockaddr *sa)
373 {
374 	return (sa != NULL ? sa->sa_family : 0);
375 }
376 
377 /*
378  * Routing socket input function.  The packet must be serialized onto cpu 0.
379  * We use the cpu0_soport() netisr processing loop to handle it.
380  *
381  * This looks messy but it means that anyone, including interrupt code,
382  * can send a message to the routing socket.
383  */
384 static void
385 rts_input_handler(netmsg_t msg)
386 {
387 	static const struct sockaddr route_dst = { 2, PF_ROUTE, };
388 	struct sockproto route_proto;
389 	struct netmsg_packet *pmsg = &msg->packet;
390 	struct mbuf *m;
391 	sa_family_t family;
392 	struct rawcb *skip;
393 
394 	family = pmsg->base.lmsg.u.ms_result;
395 	route_proto.sp_family = PF_ROUTE;
396 	route_proto.sp_protocol = family;
397 
398 	m = pmsg->nm_packet;
399 	M_ASSERTPKTHDR(m);
400 
401 	skip = m->m_pkthdr.header;
402 	m->m_pkthdr.header = NULL;
403 
404 	raw_input(m, &route_proto, &route_src, &route_dst, skip);
405 }
406 
407 static void
408 rts_input_skip(struct mbuf *m, sa_family_t family, struct rawcb *skip)
409 {
410 	struct netmsg_packet *pmsg;
411 	lwkt_port_t port;
412 
413 	M_ASSERTPKTHDR(m);
414 
415 	port = netisr_cpuport(0);	/* XXX same as for routing socket */
416 	pmsg = &m->m_hdr.mh_netmsg;
417 	netmsg_init(&pmsg->base, NULL, &netisr_apanic_rport,
418 		    0, rts_input_handler);
419 	pmsg->nm_packet = m;
420 	pmsg->base.lmsg.u.ms_result = family;
421 	m->m_pkthdr.header = skip; /* XXX steal field in pkthdr */
422 	lwkt_sendmsg(port, &pmsg->base.lmsg);
423 }
424 
425 static __inline void
426 rts_input(struct mbuf *m, sa_family_t family)
427 {
428 	rts_input_skip(m, family, NULL);
429 }
430 
431 static void
432 route_ctloutput(netmsg_t msg)
433 {
434 	struct socket *so = msg->ctloutput.base.nm_so;
435 	struct sockopt *sopt = msg->ctloutput.nm_sopt;
436 	struct routecb *rop = sotoroutecb(so);
437 	int error;
438 	unsigned int msgfilter;
439 
440 	if (sopt->sopt_level != AF_ROUTE) {
441 		error = EINVAL;
442 		goto out;
443 	}
444 
445 	error = 0;
446 
447 	switch (sopt->sopt_dir) {
448 	case SOPT_SET:
449 		switch (sopt->sopt_name) {
450 		case ROUTE_MSGFILTER:
451 			error = soopt_to_kbuf(sopt, &msgfilter,
452 			    sizeof(msgfilter), sizeof(msgfilter));
453 			if (error == 0)
454 				rop->rocb_msgfilter = msgfilter;
455 			break;
456 		default:
457 			error = ENOPROTOOPT;
458 			break;
459 		}
460 		break;
461 	case SOPT_GET:
462 		switch (sopt->sopt_name) {
463 		case ROUTE_MSGFILTER:
464 			msgfilter = rop->rocb_msgfilter;
465 			soopt_from_kbuf(sopt, &msgfilter, sizeof(msgfilter));
466 			break;
467 		default:
468 			error = ENOPROTOOPT;
469 			break;
470 		}
471 	}
472 out:
473 	lwkt_replymsg(&msg->ctloutput.base.lmsg, error);
474 }
475 
476 
477 
478 static void *
479 reallocbuf_nofree(void *ptr, size_t len, size_t olen)
480 {
481 	void *newptr;
482 
483 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
484 	if (newptr == NULL)
485 		return NULL;
486 	bcopy(ptr, newptr, olen);
487 	if (olen < len)
488 		bzero((char *)newptr + olen, len - olen);
489 
490 	return (newptr);
491 }
492 
493 /*
494  * Internal helper routine for route_output().
495  */
496 static int
497 _fillrtmsg(struct rt_msghdr **prtm, struct rtentry *rt,
498 	   struct rt_addrinfo *rtinfo)
499 {
500 	int msglen;
501 	struct rt_msghdr *rtm = *prtm;
502 
503 	/* Fill in rt_addrinfo for call to rt_msg_buffer(). */
504 	rtinfo->rti_dst = rt_key(rt);
505 	rtinfo->rti_gateway = rt->rt_gateway;
506 	rtinfo->rti_netmask = rt_mask(rt);		/* might be NULL */
507 	rtinfo->rti_genmask = rt->rt_genmask;		/* might be NULL */
508 	if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
509 		if (rt->rt_ifp != NULL) {
510 			rtinfo->rti_ifpaddr =
511 			    TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])
512 			    ->ifa->ifa_addr;
513 			rtinfo->rti_ifaaddr = rt->rt_ifa->ifa_addr;
514 			if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
515 				rtinfo->rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
516 			rtm->rtm_index = rt->rt_ifp->if_index;
517 		} else {
518 			rtinfo->rti_ifpaddr = NULL;
519 			rtinfo->rti_ifaaddr = NULL;
520 		}
521 	} else if (rt->rt_ifp != NULL) {
522 		rtm->rtm_index = rt->rt_ifp->if_index;
523 	}
524 
525 	msglen = rt_msgsize(rtm->rtm_type, rtinfo);
526 	if (rtm->rtm_msglen < msglen) {
527 		/* NOTE: Caller will free the old rtm accordingly */
528 		rtm = reallocbuf_nofree(rtm, msglen, rtm->rtm_msglen);
529 		if (rtm == NULL)
530 			return (ENOBUFS);
531 		*prtm = rtm;
532 	}
533 	rt_msg_buffer(rtm->rtm_type, rtinfo, rtm, msglen);
534 
535 	rtm->rtm_flags = rt->rt_flags;
536 	rtm->rtm_rmx = rt->rt_rmx;
537 	rtm->rtm_addrs = rtinfo->rti_addrs;
538 
539 	return (0);
540 }
541 
542 struct rtm_arg {
543 	struct rt_msghdr	*bak_rtm;
544 	struct rt_msghdr	*new_rtm;
545 };
546 
547 static int
548 fillrtmsg(struct rtm_arg *arg, struct rtentry *rt,
549 	  struct rt_addrinfo *rtinfo)
550 {
551 	struct rt_msghdr *rtm = arg->new_rtm;
552 	int error;
553 
554 	error = _fillrtmsg(&rtm, rt, rtinfo);
555 	if (!error) {
556 		if (arg->new_rtm != rtm) {
557 			/*
558 			 * _fillrtmsg() just allocated a new rtm;
559 			 * if the previously allocated rtm is not
560 			 * the backing rtm, it should be freed.
561 			 */
562 			if (arg->new_rtm != arg->bak_rtm)
563 				kfree(arg->new_rtm, M_RTABLE);
564 			arg->new_rtm = rtm;
565 		}
566 	}
567 	return error;
568 }
569 
570 static void route_output_add_callback(int, int, struct rt_addrinfo *,
571 					struct rtentry *, void *);
572 static void route_output_delete_callback(int, int, struct rt_addrinfo *,
573 					struct rtentry *, void *);
574 static int route_output_get_callback(int, struct rt_addrinfo *,
575 				     struct rtentry *, void *, int);
576 static int route_output_change_callback(int, struct rt_addrinfo *,
577 					struct rtentry *, void *, int);
578 static int route_output_lock_callback(int, struct rt_addrinfo *,
579 				      struct rtentry *, void *, int);
580 
581 /*ARGSUSED*/
582 static int
583 route_output(struct mbuf *m, struct socket *so, ...)
584 {
585 	struct rtm_arg arg;
586 	struct rt_msghdr *rtm = NULL;
587 	struct rawcb *rp = NULL;
588 	struct pr_output_info *oi;
589 	struct rt_addrinfo rtinfo;
590 	sa_family_t family;
591 	int len, error = 0;
592 	__va_list ap;
593 
594 	M_ASSERTPKTHDR(m);
595 
596 	__va_start(ap, so);
597 	oi = __va_arg(ap, struct pr_output_info *);
598 	__va_end(ap);
599 
600 	family = familyof(NULL);
601 
602 #define gotoerr(e) { error = e; goto flush;}
603 
604 	if (m == NULL ||
605 	    (m->m_len < sizeof(long) &&
606 	     (m = m_pullup(m, sizeof(long))) == NULL))
607 		return (ENOBUFS);
608 	len = m->m_pkthdr.len;
609 	if (len < sizeof(struct rt_msghdr) ||
610 	    len != mtod(m, struct rt_msghdr *)->rtm_msglen)
611 		gotoerr(EINVAL);
612 
613 	rtm = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
614 	if (rtm == NULL)
615 		gotoerr(ENOBUFS);
616 
617 	m_copydata(m, 0, len, (caddr_t)rtm);
618 	if (rtm->rtm_version != RTM_VERSION)
619 		gotoerr(EPROTONOSUPPORT);
620 
621 	rtm->rtm_pid = oi->p_pid;
622 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
623 	rtinfo.rti_addrs = rtm->rtm_addrs;
624 	if (rt_xaddrs((char *)(rtm + 1), (char *)rtm + len, &rtinfo) != 0)
625 		gotoerr(EINVAL);
626 
627 	rtinfo.rti_flags = rtm->rtm_flags;
628 	if (rtinfo.rti_dst == NULL || rtinfo.rti_dst->sa_family >= AF_MAX ||
629 	    (rtinfo.rti_gateway && rtinfo.rti_gateway->sa_family >= AF_MAX))
630 		gotoerr(EINVAL);
631 
632 	family = familyof(rtinfo.rti_dst);
633 
634 	/*
635 	 * Verify that the caller has the appropriate privilege; RTM_GET
636 	 * is the only operation the non-superuser is allowed.
637 	 */
638 	if (rtm->rtm_type != RTM_GET &&
639 	    priv_check_cred(so->so_cred, PRIV_ROOT, 0) != 0)
640 		gotoerr(EPERM);
641 
642 	if (rtinfo.rti_genmask != NULL) {
643 		error = rtmask_add_global(rtinfo.rti_genmask,
644 		    rtm->rtm_type != RTM_GET ?
645 		    RTREQ_PRIO_HIGH : RTREQ_PRIO_NORM);
646 		if (error)
647 			goto flush;
648 	}
649 
650 	switch (rtm->rtm_type) {
651 	case RTM_ADD:
652 		if (rtinfo.rti_gateway == NULL) {
653 			error = EINVAL;
654 		} else {
655 			error = rtrequest1_global(RTM_ADD, &rtinfo,
656 			    route_output_add_callback, rtm, RTREQ_PRIO_HIGH);
657 		}
658 		break;
659 	case RTM_DELETE:
660 		/*
661 		 * Backing rtm (bak_rtm) could _not_ be freed during
662 		 * rtrequest1_global or rtsearch_global, even if the
663 		 * callback reallocates the rtm due to its size changes,
664 		 * since rtinfo points to the backing rtm's memory area.
665 		 * After rtrequest1_global or rtsearch_global returns,
666 		 * it is safe to free the backing rtm, since rtinfo will
667 		 * not be used anymore.
668 		 *
669 		 * new_rtm will be used to save the new rtm allocated
670 		 * by rtrequest1_global or rtsearch_global.
671 		 */
672 		arg.bak_rtm = rtm;
673 		arg.new_rtm = rtm;
674 		error = rtrequest1_global(RTM_DELETE, &rtinfo,
675 		    route_output_delete_callback, &arg, RTREQ_PRIO_HIGH);
676 		rtm = arg.new_rtm;
677 		if (rtm != arg.bak_rtm)
678 			kfree(arg.bak_rtm, M_RTABLE);
679 		break;
680 	case RTM_GET:
681 		/* See the comment in RTM_DELETE */
682 		arg.bak_rtm = rtm;
683 		arg.new_rtm = rtm;
684 		error = rtsearch_global(RTM_GET, &rtinfo,
685 		    route_output_get_callback, &arg, RTS_NOEXACTMATCH,
686 		    RTREQ_PRIO_NORM);
687 		rtm = arg.new_rtm;
688 		if (rtm != arg.bak_rtm)
689 			kfree(arg.bak_rtm, M_RTABLE);
690 		break;
691 	case RTM_CHANGE:
692 		error = rtsearch_global(RTM_CHANGE, &rtinfo,
693 		    route_output_change_callback, rtm, RTS_EXACTMATCH,
694 		    RTREQ_PRIO_HIGH);
695 		break;
696 	case RTM_LOCK:
697 		error = rtsearch_global(RTM_LOCK, &rtinfo,
698 		    route_output_lock_callback, rtm, RTS_EXACTMATCH,
699 		    RTREQ_PRIO_HIGH);
700 		break;
701 	default:
702 		error = EOPNOTSUPP;
703 		break;
704 	}
705 flush:
706 	if (rtm != NULL) {
707 		if (error != 0)
708 			rtm->rtm_errno = error;
709 		else
710 			rtm->rtm_flags |= RTF_DONE;
711 	}
712 
713 	/*
714 	 * Check to see if we don't want our own messages.
715 	 */
716 	if (!(so->so_options & SO_USELOOPBACK)) {
717 		if (route_cb.any_count <= 1) {
718 			if (rtm != NULL)
719 				kfree(rtm, M_RTABLE);
720 			m_freem(m);
721 			return (error);
722 		}
723 		/* There is another listener, so construct message */
724 		rp = sotorawcb(so);
725 	}
726 	if (rtm != NULL) {
727 		m_copyback(m, 0, rtm->rtm_msglen, (caddr_t)rtm);
728 		if (m->m_pkthdr.len < rtm->rtm_msglen) {
729 			m_freem(m);
730 			m = NULL;
731 		} else if (m->m_pkthdr.len > rtm->rtm_msglen)
732 			m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
733 		kfree(rtm, M_RTABLE);
734 	}
735 	if (m != NULL)
736 		rts_input_skip(m, family, rp);
737 	return (error);
738 }
739 
740 static void
741 route_output_add_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
742 			  struct rtentry *rt, void *arg)
743 {
744 	struct rt_msghdr *rtm = arg;
745 
746 	if (error == 0 && rt != NULL) {
747 		rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx,
748 		    &rt->rt_rmx);
749 		rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
750 		rt->rt_rmx.rmx_locks |=
751 		    (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
752 		if (rtinfo->rti_genmask != NULL) {
753 			rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
754 			if (rt->rt_genmask == NULL) {
755 				/*
756 				 * This should not happen, since we
757 				 * have already installed genmask
758 				 * on each CPU before we reach here.
759 				 */
760 				panic("genmask is gone!?");
761 			}
762 		} else {
763 			rt->rt_genmask = NULL;
764 		}
765 		rtm->rtm_index = rt->rt_ifp->if_index;
766 	}
767 }
768 
769 static void
770 route_output_delete_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
771 			  struct rtentry *rt, void *arg)
772 {
773 	if (error == 0 && rt) {
774 		++rt->rt_refcnt;
775 		if (fillrtmsg(arg, rt, rtinfo) != 0) {
776 			error = ENOBUFS;
777 			/* XXX no way to return the error */
778 		}
779 		--rt->rt_refcnt;
780 	}
781 	if (rt && rt->rt_refcnt == 0) {
782 		++rt->rt_refcnt;
783 		rtfree(rt);
784 	}
785 }
786 
787 static int
788 route_output_get_callback(int cmd, struct rt_addrinfo *rtinfo,
789 			  struct rtentry *rt, void *arg, int found_cnt)
790 {
791 	int error, found = 0;
792 
793 	if (((rtinfo->rti_flags ^ rt->rt_flags) & RTF_HOST) == 0)
794 		found = 1;
795 
796 	error = fillrtmsg(arg, rt, rtinfo);
797 	if (!error && found) {
798 		/* Got the exact match, we could return now! */
799 		error = EJUSTRETURN;
800 	}
801 	return error;
802 }
803 
804 static int
805 route_output_change_callback(int cmd, struct rt_addrinfo *rtinfo,
806 			     struct rtentry *rt, void *arg, int found_cnt)
807 {
808 	struct rt_msghdr *rtm = arg;
809 	struct ifaddr *ifa;
810 	int error = 0;
811 
812 	/*
813 	 * new gateway could require new ifaddr, ifp;
814 	 * flags may also be different; ifp may be specified
815 	 * by ll sockaddr when protocol address is ambiguous
816 	 */
817 	if (((rt->rt_flags & RTF_GATEWAY) && rtinfo->rti_gateway != NULL) ||
818 	    rtinfo->rti_ifpaddr != NULL ||
819 	    (rtinfo->rti_ifaaddr != NULL &&
820 	     !sa_equal(rtinfo->rti_ifaaddr, rt->rt_ifa->ifa_addr))) {
821 		error = rt_getifa(rtinfo);
822 		if (error != 0)
823 			goto done;
824 	}
825 	if (rtinfo->rti_gateway != NULL) {
826 		/*
827 		 * We only need to generate rtmsg upon the
828 		 * first route to be changed.
829 		 */
830 		error = rt_setgate(rt, rt_key(rt), rtinfo->rti_gateway);
831 		if (error != 0)
832 			goto done;
833 	}
834 	if ((ifa = rtinfo->rti_ifa) != NULL) {
835 		struct ifaddr *oifa = rt->rt_ifa;
836 
837 		if (oifa != ifa) {
838 			if (oifa && oifa->ifa_rtrequest)
839 				oifa->ifa_rtrequest(RTM_DELETE, rt);
840 			IFAFREE(rt->rt_ifa);
841 			IFAREF(ifa);
842 			rt->rt_ifa = ifa;
843 			rt->rt_ifp = rtinfo->rti_ifp;
844 		}
845 	}
846 	rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx, &rt->rt_rmx);
847 	if (rt->rt_ifa && rt->rt_ifa->ifa_rtrequest)
848 		rt->rt_ifa->ifa_rtrequest(RTM_ADD, rt);
849 	if (rtinfo->rti_genmask != NULL) {
850 		rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
851 		if (rt->rt_genmask == NULL) {
852 			/*
853 			 * This should not happen, since we
854 			 * have already installed genmask
855 			 * on each CPU before we reach here.
856 			 */
857 			panic("genmask is gone!?");
858 		}
859 	}
860 	rtm->rtm_index = rt->rt_ifp->if_index;
861 	if (found_cnt == 1)
862 		rt_rtmsg(RTM_CHANGE, rt, rt->rt_ifp, 0);
863 done:
864 	return error;
865 }
866 
867 static int
868 route_output_lock_callback(int cmd, struct rt_addrinfo *rtinfo,
869 			   struct rtentry *rt, void *arg,
870 			   int found_cnt __unused)
871 {
872 	struct rt_msghdr *rtm = arg;
873 
874 	rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
875 	rt->rt_rmx.rmx_locks |=
876 		(rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
877 	return 0;
878 }
879 
880 static void
881 rt_setmetrics(u_long which, struct rt_metrics *in, struct rt_metrics *out)
882 {
883 #define setmetric(flag, elt) if (which & (flag)) out->elt = in->elt;
884 	setmetric(RTV_RPIPE, rmx_recvpipe);
885 	setmetric(RTV_SPIPE, rmx_sendpipe);
886 	setmetric(RTV_SSTHRESH, rmx_ssthresh);
887 	setmetric(RTV_RTT, rmx_rtt);
888 	setmetric(RTV_RTTVAR, rmx_rttvar);
889 	setmetric(RTV_HOPCOUNT, rmx_hopcount);
890 	setmetric(RTV_MTU, rmx_mtu);
891 	setmetric(RTV_EXPIRE, rmx_expire);
892 	setmetric(RTV_MSL, rmx_msl);
893 	setmetric(RTV_IWMAXSEGS, rmx_iwmaxsegs);
894 	setmetric(RTV_IWCAPSEGS, rmx_iwcapsegs);
895 #undef setmetric
896 }
897 
898 /*
899  * Extract the addresses of the passed sockaddrs.
900  * Do a little sanity checking so as to avoid bad memory references.
901  * This data is derived straight from userland.
902  */
903 static int
904 rt_xaddrs(char *cp, char *cplim, struct rt_addrinfo *rtinfo)
905 {
906 	struct sockaddr *sa;
907 	int i;
908 
909 	for (i = 0; (i < RTAX_MAX) && (cp < cplim); i++) {
910 		if ((rtinfo->rti_addrs & (1 << i)) == 0)
911 			continue;
912 		sa = (struct sockaddr *)cp;
913 		/*
914 		 * It won't fit.
915 		 */
916 		if ((cp + sa->sa_len) > cplim) {
917 			return (EINVAL);
918 		}
919 
920 		/*
921 		 * There are no more...  Quit now.
922 		 * If there are more bits, they are in error.
923 		 * I've seen this.  route(1) can evidently generate these.
924 		 * This causes kernel to core dump.
925 		 * For compatibility, if we see this, point to a safe address.
926 		 */
927 		if (sa->sa_len == 0) {
928 			static struct sockaddr sa_zero = {
929 				sizeof sa_zero, AF_INET,
930 			};
931 
932 			rtinfo->rti_info[i] = &sa_zero;
933 			kprintf("rtsock: received more addr bits than sockaddrs.\n");
934 			return (0); /* should be EINVAL but for compat */
935 		}
936 
937 		/* Accept the sockaddr. */
938 		rtinfo->rti_info[i] = sa;
939 		cp += RT_ROUNDUP(sa->sa_len);
940 	}
941 	return (0);
942 }
943 
944 static int
945 rt_msghdrsize(int type)
946 {
947 	switch (type) {
948 	case RTM_DELADDR:
949 	case RTM_NEWADDR:
950 		return sizeof(struct ifa_msghdr);
951 	case RTM_DELMADDR:
952 	case RTM_NEWMADDR:
953 		return sizeof(struct ifma_msghdr);
954 	case RTM_IFINFO:
955 		return sizeof(struct if_msghdr);
956 	case RTM_IFANNOUNCE:
957 	case RTM_IEEE80211:
958 		return sizeof(struct if_announcemsghdr);
959 	default:
960 		return sizeof(struct rt_msghdr);
961 	}
962 }
963 
964 static int
965 rt_msgsize(int type, const struct rt_addrinfo *rtinfo)
966 {
967 	int len, i;
968 
969 	len = rt_msghdrsize(type);
970 	for (i = 0; i < RTAX_MAX; i++) {
971 		if (rtinfo->rti_info[i] != NULL)
972 			len += RT_ROUNDUP(rtinfo->rti_info[i]->sa_len);
973 	}
974 	len = ALIGN(len);
975 	return len;
976 }
977 
978 /*
979  * Build a routing message in a buffer.
980  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
981  * to the end of the buffer after the message header.
982  *
983  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
984  * This side-effect can be avoided if we reorder the addrs bitmask field in all
985  * the route messages to line up so we can set it here instead of back in the
986  * calling routine.
987  *
988  * NOTE! The buffer may already contain a partially filled-out rtm via
989  *	 _fillrtmsg().
990  */
991 static void
992 rt_msg_buffer(int type, struct rt_addrinfo *rtinfo, void *buf, int msglen)
993 {
994 	struct rt_msghdr *rtm;
995 	char *cp;
996 	int dlen, i;
997 
998 	rtm = (struct rt_msghdr *) buf;
999 	rtm->rtm_version = RTM_VERSION;
1000 	rtm->rtm_type = type;
1001 	rtm->rtm_msglen = msglen;
1002 
1003 	cp = (char *)buf + rt_msghdrsize(type);
1004 	rtinfo->rti_addrs = 0;
1005 	for (i = 0; i < RTAX_MAX; i++) {
1006 		struct sockaddr *sa;
1007 
1008 		if ((sa = rtinfo->rti_info[i]) == NULL)
1009 			continue;
1010 		rtinfo->rti_addrs |= (1 << i);
1011 		dlen = RT_ROUNDUP(sa->sa_len);
1012 		bcopy(sa, cp, dlen);
1013 		cp += dlen;
1014 	}
1015 }
1016 
1017 /*
1018  * Build a routing message in a mbuf chain.
1019  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
1020  * to the end of the mbuf after the message header.
1021  *
1022  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
1023  * This side-effect can be avoided if we reorder the addrs bitmask field in all
1024  * the route messages to line up so we can set it here instead of back in the
1025  * calling routine.
1026  */
1027 static struct mbuf *
1028 rt_msg_mbuf(int type, struct rt_addrinfo *rtinfo)
1029 {
1030 	struct mbuf *m;
1031 	struct rt_msghdr *rtm;
1032 	int hlen, len;
1033 	int i;
1034 
1035 	hlen = rt_msghdrsize(type);
1036 	KASSERT(hlen <= MCLBYTES, ("rt_msg_mbuf: hlen %d doesn't fit", hlen));
1037 
1038 	m = m_getl(hlen, M_NOWAIT, MT_DATA, M_PKTHDR, NULL);
1039 	if (m == NULL)
1040 		return (NULL);
1041 	mbuftrackid(m, 32);
1042 	m->m_pkthdr.len = m->m_len = hlen;
1043 	m->m_pkthdr.rcvif = NULL;
1044 	rtinfo->rti_addrs = 0;
1045 	len = hlen;
1046 	for (i = 0; i < RTAX_MAX; i++) {
1047 		struct sockaddr *sa;
1048 		int dlen;
1049 
1050 		if ((sa = rtinfo->rti_info[i]) == NULL)
1051 			continue;
1052 		rtinfo->rti_addrs |= (1 << i);
1053 		dlen = RT_ROUNDUP(sa->sa_len);
1054 		m_copyback(m, len, dlen, (caddr_t)sa); /* can grow mbuf chain */
1055 		len += dlen;
1056 	}
1057 	if (m->m_pkthdr.len != len) { /* one of the m_copyback() calls failed */
1058 		m_freem(m);
1059 		return (NULL);
1060 	}
1061 	rtm = mtod(m, struct rt_msghdr *);
1062 	bzero(rtm, hlen);
1063 	rtm->rtm_msglen = len;
1064 	rtm->rtm_version = RTM_VERSION;
1065 	rtm->rtm_type = type;
1066 	return (m);
1067 }
1068 
1069 /*
1070  * This routine is called to generate a message from the routing
1071  * socket indicating that a redirect has occurred, a routing lookup
1072  * has failed, or that a protocol has detected timeouts to a particular
1073  * destination.
1074  */
1075 void
1076 rt_missmsg(int type, struct rt_addrinfo *rtinfo, int flags, int error)
1077 {
1078 	struct sockaddr *dst = rtinfo->rti_info[RTAX_DST];
1079 	struct rt_msghdr *rtm;
1080 	struct mbuf *m;
1081 
1082 	if (route_cb.any_count == 0)
1083 		return;
1084 	m = rt_msg_mbuf(type, rtinfo);
1085 	if (m == NULL)
1086 		return;
1087 	rtm = mtod(m, struct rt_msghdr *);
1088 	rtm->rtm_flags = RTF_DONE | flags;
1089 	rtm->rtm_errno = error;
1090 	rtm->rtm_addrs = rtinfo->rti_addrs;
1091 	rts_input(m, familyof(dst));
1092 }
1093 
1094 void
1095 rt_dstmsg(int type, struct sockaddr *dst, int error)
1096 {
1097 	struct rt_msghdr *rtm;
1098 	struct rt_addrinfo addrs;
1099 	struct mbuf *m;
1100 
1101 	if (route_cb.any_count == 0)
1102 		return;
1103 	bzero(&addrs, sizeof(struct rt_addrinfo));
1104 	addrs.rti_info[RTAX_DST] = dst;
1105 	m = rt_msg_mbuf(type, &addrs);
1106 	if (m == NULL)
1107 		return;
1108 	rtm = mtod(m, struct rt_msghdr *);
1109 	rtm->rtm_flags = RTF_DONE;
1110 	rtm->rtm_errno = error;
1111 	rtm->rtm_addrs = addrs.rti_addrs;
1112 	rts_input(m, familyof(dst));
1113 }
1114 
1115 /*
1116  * This routine is called to generate a message from the routing
1117  * socket indicating that the status of a network interface has changed.
1118  */
1119 void
1120 rt_ifmsg(struct ifnet *ifp)
1121 {
1122 	struct if_msghdr *ifm;
1123 	struct mbuf *m;
1124 	struct rt_addrinfo rtinfo;
1125 
1126 	if (route_cb.any_count == 0)
1127 		return;
1128 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1129 	m = rt_msg_mbuf(RTM_IFINFO, &rtinfo);
1130 	if (m == NULL)
1131 		return;
1132 	ifm = mtod(m, struct if_msghdr *);
1133 	ifm->ifm_index = ifp->if_index;
1134 	ifm->ifm_flags = ifp->if_flags;
1135 	ifm->ifm_data = ifp->if_data;
1136 	ifm->ifm_addrs = 0;
1137 	rts_input(m, 0);
1138 }
1139 
1140 static void
1141 rt_ifamsg(int cmd, struct ifaddr *ifa)
1142 {
1143 	struct ifa_msghdr *ifam;
1144 	struct rt_addrinfo rtinfo;
1145 	struct mbuf *m;
1146 	struct ifnet *ifp = ifa->ifa_ifp;
1147 
1148 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1149 	rtinfo.rti_ifaaddr = ifa->ifa_addr;
1150 	rtinfo.rti_ifpaddr =
1151 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1152 	rtinfo.rti_netmask = ifa->ifa_netmask;
1153 	rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1154 
1155 	m = rt_msg_mbuf(cmd, &rtinfo);
1156 	if (m == NULL)
1157 		return;
1158 
1159 	ifam = mtod(m, struct ifa_msghdr *);
1160 	ifam->ifam_index = ifp->if_index;
1161 	ifam->ifam_flags = ifa->ifa_flags;
1162 	ifam->ifam_addrs = rtinfo.rti_addrs;
1163 	ifam->ifam_addrflags = if_addrflags(ifa);
1164 	ifam->ifam_metric = ifa->ifa_metric;
1165 
1166 	rts_input(m, familyof(ifa->ifa_addr));
1167 }
1168 
1169 void
1170 rt_rtmsg(int cmd, struct rtentry *rt, struct ifnet *ifp, int error)
1171 {
1172 	struct rt_msghdr *rtm;
1173 	struct rt_addrinfo rtinfo;
1174 	struct mbuf *m;
1175 	struct sockaddr *dst;
1176 
1177 	if (rt == NULL)
1178 		return;
1179 
1180 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1181 	rtinfo.rti_dst = dst = rt_key(rt);
1182 	rtinfo.rti_gateway = rt->rt_gateway;
1183 	rtinfo.rti_netmask = rt_mask(rt);
1184 	if (ifp != NULL) {
1185 		rtinfo.rti_ifpaddr =
1186 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1187 	}
1188 	if (rt->rt_ifa != NULL)
1189 		rtinfo.rti_ifaaddr = rt->rt_ifa->ifa_addr;
1190 
1191 	m = rt_msg_mbuf(cmd, &rtinfo);
1192 	if (m == NULL)
1193 		return;
1194 
1195 	rtm = mtod(m, struct rt_msghdr *);
1196 	if (ifp != NULL)
1197 		rtm->rtm_index = ifp->if_index;
1198 	rtm->rtm_flags |= rt->rt_flags;
1199 	rtm->rtm_errno = error;
1200 	rtm->rtm_addrs = rtinfo.rti_addrs;
1201 
1202 	rts_input(m, familyof(dst));
1203 }
1204 
1205 /*
1206  * This is called to generate messages from the routing socket
1207  * indicating a network interface has had addresses associated with it.
1208  * if we ever reverse the logic and replace messages TO the routing
1209  * socket indicate a request to configure interfaces, then it will
1210  * be unnecessary as the routing socket will automatically generate
1211  * copies of it.
1212  */
1213 void
1214 rt_newaddrmsg(int cmd, struct ifaddr *ifa, int error, struct rtentry *rt)
1215 {
1216 	if (route_cb.any_count == 0)
1217 		return;
1218 
1219 	if (cmd == RTM_ADD) {
1220 		rt_ifamsg(RTM_NEWADDR, ifa);
1221 		rt_rtmsg(RTM_ADD, rt, ifa->ifa_ifp, error);
1222 	} else {
1223 		KASSERT((cmd == RTM_DELETE), ("unknown cmd %d", cmd));
1224 		rt_rtmsg(RTM_DELETE, rt, ifa->ifa_ifp, error);
1225 		rt_ifamsg(RTM_DELADDR, ifa);
1226 	}
1227 }
1228 
1229 /*
1230  * This is the analogue to the rt_newaddrmsg which performs the same
1231  * function but for multicast group memberhips.  This is easier since
1232  * there is no route state to worry about.
1233  */
1234 void
1235 rt_newmaddrmsg(int cmd, struct ifmultiaddr *ifma)
1236 {
1237 	struct rt_addrinfo rtinfo;
1238 	struct mbuf *m = NULL;
1239 	struct ifnet *ifp = ifma->ifma_ifp;
1240 	struct ifma_msghdr *ifmam;
1241 
1242 	if (route_cb.any_count == 0)
1243 		return;
1244 
1245 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1246 	rtinfo.rti_ifaaddr = ifma->ifma_addr;
1247 	if (ifp != NULL && !TAILQ_EMPTY(&ifp->if_addrheads[mycpuid])) {
1248 		rtinfo.rti_ifpaddr =
1249 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1250 	}
1251 	/*
1252 	 * If a link-layer address is present, present it as a ``gateway''
1253 	 * (similarly to how ARP entries, e.g., are presented).
1254 	 */
1255 	rtinfo.rti_gateway = ifma->ifma_lladdr;
1256 
1257 	m = rt_msg_mbuf(cmd, &rtinfo);
1258 	if (m == NULL)
1259 		return;
1260 
1261 	ifmam = mtod(m, struct ifma_msghdr *);
1262 	ifmam->ifmam_index = ifp->if_index;
1263 	ifmam->ifmam_addrs = rtinfo.rti_addrs;
1264 
1265 	rts_input(m, familyof(ifma->ifma_addr));
1266 }
1267 
1268 static struct mbuf *
1269 rt_makeifannouncemsg(struct ifnet *ifp, int type, int what,
1270 		     struct rt_addrinfo *info)
1271 {
1272 	struct if_announcemsghdr *ifan;
1273 	struct mbuf *m;
1274 
1275 	if (route_cb.any_count == 0)
1276 		return NULL;
1277 
1278 	bzero(info, sizeof(*info));
1279 	m = rt_msg_mbuf(type, info);
1280 	if (m == NULL)
1281 		return NULL;
1282 
1283 	ifan = mtod(m, struct if_announcemsghdr *);
1284 	ifan->ifan_index = ifp->if_index;
1285 	strlcpy(ifan->ifan_name, ifp->if_xname, sizeof ifan->ifan_name);
1286 	ifan->ifan_what = what;
1287 	return m;
1288 }
1289 
1290 /*
1291  * This is called to generate routing socket messages indicating
1292  * IEEE80211 wireless events.
1293  * XXX we piggyback on the RTM_IFANNOUNCE msg format in a clumsy way.
1294  */
1295 void
1296 rt_ieee80211msg(struct ifnet *ifp, int what, void *data, size_t data_len)
1297 {
1298 	struct rt_addrinfo info;
1299 	struct mbuf *m;
1300 
1301 	m = rt_makeifannouncemsg(ifp, RTM_IEEE80211, what, &info);
1302 	if (m == NULL)
1303 		return;
1304 
1305 	/*
1306 	 * Append the ieee80211 data.  Try to stick it in the
1307 	 * mbuf containing the ifannounce msg; otherwise allocate
1308 	 * a new mbuf and append.
1309 	 *
1310 	 * NB: we assume m is a single mbuf.
1311 	 */
1312 	if (data_len > M_TRAILINGSPACE(m)) {
1313 		/* XXX use m_getb(data_len, M_NOWAIT, MT_DATA, 0); */
1314 		struct mbuf *n = m_get(M_NOWAIT, MT_DATA);
1315 		if (n == NULL) {
1316 			m_freem(m);
1317 			return;
1318 		}
1319 		KKASSERT(data_len <= M_TRAILINGSPACE(n));
1320 		bcopy(data, mtod(n, void *), data_len);
1321 		n->m_len = data_len;
1322 		m->m_next = n;
1323 	} else if (data_len > 0) {
1324 		bcopy(data, mtod(m, u_int8_t *) + m->m_len, data_len);
1325 		m->m_len += data_len;
1326 	}
1327 	mbuftrackid(m, 33);
1328 	if (m->m_flags & M_PKTHDR)
1329 		m->m_pkthdr.len += data_len;
1330 	mtod(m, struct if_announcemsghdr *)->ifan_msglen += data_len;
1331 	rts_input(m, 0);
1332 }
1333 
1334 /*
1335  * This is called to generate routing socket messages indicating
1336  * network interface arrival and departure.
1337  */
1338 void
1339 rt_ifannouncemsg(struct ifnet *ifp, int what)
1340 {
1341 	struct rt_addrinfo addrinfo;
1342 	struct mbuf *m;
1343 
1344 	m = rt_makeifannouncemsg(ifp, RTM_IFANNOUNCE, what, &addrinfo);
1345 	if (m != NULL)
1346 		rts_input(m, 0);
1347 }
1348 
1349 static int
1350 resizewalkarg(struct walkarg *w, int len)
1351 {
1352 	void *newptr;
1353 
1354 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
1355 	if (newptr == NULL)
1356 		return (ENOMEM);
1357 	if (w->w_tmem != NULL)
1358 		kfree(w->w_tmem, M_RTABLE);
1359 	w->w_tmem = newptr;
1360 	w->w_tmemsize = len;
1361 	bzero(newptr, len);
1362 
1363 	return (0);
1364 }
1365 
1366 static void
1367 ifnet_compute_stats(struct ifnet *ifp)
1368 {
1369 	IFNET_STAT_GET(ifp, ipackets, ifp->if_ipackets);
1370 	IFNET_STAT_GET(ifp, ierrors, ifp->if_ierrors);
1371 	IFNET_STAT_GET(ifp, opackets, ifp->if_opackets);
1372 	IFNET_STAT_GET(ifp, collisions, ifp->if_collisions);
1373 	IFNET_STAT_GET(ifp, ibytes, ifp->if_ibytes);
1374 	IFNET_STAT_GET(ifp, obytes, ifp->if_obytes);
1375 	IFNET_STAT_GET(ifp, imcasts, ifp->if_imcasts);
1376 	IFNET_STAT_GET(ifp, omcasts, ifp->if_omcasts);
1377 	IFNET_STAT_GET(ifp, iqdrops, ifp->if_iqdrops);
1378 	IFNET_STAT_GET(ifp, noproto, ifp->if_noproto);
1379 	IFNET_STAT_GET(ifp, oqdrops, ifp->if_oqdrops);
1380 }
1381 
1382 static int
1383 if_addrflags(const struct ifaddr *ifa)
1384 {
1385 	switch (ifa->ifa_addr->sa_family) {
1386 #ifdef INET6
1387 	case AF_INET6:
1388 		return ((const struct in6_ifaddr *)ifa)->ia6_flags;
1389 #endif
1390 	default:
1391 		return 0;
1392 	}
1393 }
1394 
1395 static int
1396 sysctl_iflist(int af, struct walkarg *w)
1397 {
1398 	struct ifnet *ifp;
1399 	struct rt_addrinfo rtinfo;
1400 	int msglen, error;
1401 
1402 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1403 
1404 	ifnet_lock();
1405 	TAILQ_FOREACH(ifp, &ifnetlist, if_link) {
1406 		struct ifaddr_container *ifac, *ifac_mark;
1407 		struct ifaddr_marker mark;
1408 		struct ifaddrhead *head;
1409 		struct ifaddr *ifa;
1410 
1411 		if (w->w_arg && w->w_arg != ifp->if_index)
1412 			continue;
1413 		head = &ifp->if_addrheads[mycpuid];
1414 		/*
1415 		 * There is no need to reference the first ifaddr
1416 		 * even if the following resizewalkarg() blocks,
1417 		 * since the first ifaddr will not be destroyed
1418 		 * when the ifnet lock is held.
1419 		 */
1420 		ifac = TAILQ_FIRST(head);
1421 		ifa = ifac->ifa;
1422 		rtinfo.rti_ifpaddr = ifa->ifa_addr;
1423 		msglen = rt_msgsize(RTM_IFINFO, &rtinfo);
1424 		if (w->w_tmemsize < msglen && resizewalkarg(w, msglen) != 0) {
1425 			ifnet_unlock();
1426 			return (ENOMEM);
1427 		}
1428 		rt_msg_buffer(RTM_IFINFO, &rtinfo, w->w_tmem, msglen);
1429 		rtinfo.rti_ifpaddr = NULL;
1430 		if (w->w_req != NULL && w->w_tmem != NULL) {
1431 			struct if_msghdr *ifm = w->w_tmem;
1432 
1433 			ifm->ifm_index = ifp->if_index;
1434 			ifm->ifm_flags = ifp->if_flags;
1435 			ifnet_compute_stats(ifp);
1436 			ifm->ifm_data = ifp->if_data;
1437 			ifm->ifm_addrs = rtinfo.rti_addrs;
1438 			error = SYSCTL_OUT(w->w_req, ifm, msglen);
1439 			if (error) {
1440 				ifnet_unlock();
1441 				return (error);
1442 			}
1443 		}
1444 		/*
1445 		 * Add a marker, since SYSCTL_OUT() could block and during
1446 		 * that period the list could be changed.
1447 		 */
1448 		ifa_marker_init(&mark, ifp);
1449 		ifac_mark = &mark.ifac;
1450 		TAILQ_INSERT_AFTER(head, ifac, ifac_mark, ifa_link);
1451 		while ((ifac = TAILQ_NEXT(ifac_mark, ifa_link)) != NULL) {
1452 			TAILQ_REMOVE(head, ifac_mark, ifa_link);
1453 			TAILQ_INSERT_AFTER(head, ifac, ifac_mark, ifa_link);
1454 
1455 			ifa = ifac->ifa;
1456 
1457 			/* Ignore marker */
1458 			if (ifa->ifa_addr->sa_family == AF_UNSPEC)
1459 				continue;
1460 
1461 			if (af && af != ifa->ifa_addr->sa_family)
1462 				continue;
1463 			if (curproc->p_ucred->cr_prison &&
1464 			    prison_if(curproc->p_ucred, ifa->ifa_addr))
1465 				continue;
1466 			rtinfo.rti_ifaaddr = ifa->ifa_addr;
1467 			rtinfo.rti_netmask = ifa->ifa_netmask;
1468 			rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1469 			msglen = rt_msgsize(RTM_NEWADDR, &rtinfo);
1470 			/*
1471 			 * Keep a reference on this ifaddr, so that it will
1472 			 * not be destroyed if the following resizewalkarg()
1473 			 * blocks.
1474 			 */
1475 			IFAREF(ifa);
1476 			if (w->w_tmemsize < msglen &&
1477 			    resizewalkarg(w, msglen) != 0) {
1478 				IFAFREE(ifa);
1479 				TAILQ_REMOVE(head, ifac_mark, ifa_link);
1480 				ifnet_unlock();
1481 				return (ENOMEM);
1482 			}
1483 			rt_msg_buffer(RTM_NEWADDR, &rtinfo, w->w_tmem, msglen);
1484 			if (w->w_req != NULL) {
1485 				struct ifa_msghdr *ifam = w->w_tmem;
1486 
1487 				ifam->ifam_index = ifa->ifa_ifp->if_index;
1488 				ifam->ifam_flags = ifa->ifa_flags;
1489 				ifam->ifam_addrs = rtinfo.rti_addrs;
1490 				ifam->ifam_addrflags = if_addrflags(ifa);
1491 				ifam->ifam_metric = ifa->ifa_metric;
1492 				error = SYSCTL_OUT(w->w_req, w->w_tmem, msglen);
1493 				if (error) {
1494 					IFAFREE(ifa);
1495 					TAILQ_REMOVE(head, ifac_mark, ifa_link);
1496 					ifnet_unlock();
1497 					return (error);
1498 				}
1499 			}
1500 			IFAFREE(ifa);
1501 		}
1502 		TAILQ_REMOVE(head, ifac_mark, ifa_link);
1503 		rtinfo.rti_netmask = NULL;
1504 		rtinfo.rti_ifaaddr = NULL;
1505 		rtinfo.rti_bcastaddr = NULL;
1506 	}
1507 	ifnet_unlock();
1508 	return (0);
1509 }
1510 
1511 static int
1512 rttable_walkarg_create(struct rttable_walkarg *w, int op, int arg)
1513 {
1514 	struct rt_addrinfo rtinfo;
1515 	struct sockaddr_storage ss;
1516 	int i, msglen;
1517 
1518 	memset(w, 0, sizeof(*w));
1519 	w->w_op = op;
1520 	w->w_arg = arg;
1521 
1522 	memset(&ss, 0, sizeof(ss));
1523 	ss.ss_len = sizeof(ss);
1524 
1525 	memset(&rtinfo, 0, sizeof(rtinfo));
1526 	for (i = 0; i < RTAX_MAX; ++i)
1527 		rtinfo.rti_info[i] = (struct sockaddr *)&ss;
1528 	msglen = rt_msgsize(RTM_GET, &rtinfo);
1529 
1530 	w->w_bufsz = msglen * RTTABLE_DUMP_MSGCNT_MAX;
1531 	w->w_buf = kmalloc(w->w_bufsz, M_TEMP, M_WAITOK | M_NULLOK);
1532 	if (w->w_buf == NULL)
1533 		return ENOMEM;
1534 	return 0;
1535 }
1536 
1537 static void
1538 rttable_walkarg_destroy(struct rttable_walkarg *w)
1539 {
1540 	kfree(w->w_buf, M_TEMP);
1541 }
1542 
1543 static void
1544 rttable_entry_rtinfo(struct rt_addrinfo *rtinfo, struct radix_node *rn)
1545 {
1546 	struct rtentry *rt = (struct rtentry *)rn;
1547 
1548 	bzero(rtinfo, sizeof(*rtinfo));
1549 	rtinfo->rti_dst = rt_key(rt);
1550 	rtinfo->rti_gateway = rt->rt_gateway;
1551 	rtinfo->rti_netmask = rt_mask(rt);
1552 	rtinfo->rti_genmask = rt->rt_genmask;
1553 	if (rt->rt_ifp != NULL) {
1554 		rtinfo->rti_ifpaddr =
1555 		TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1556 		rtinfo->rti_ifaaddr = rt->rt_ifa->ifa_addr;
1557 		if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
1558 			rtinfo->rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
1559 	}
1560 }
1561 
1562 static int
1563 rttable_walk_entry(struct radix_node *rn, void *xw)
1564 {
1565 	struct rttable_walkarg *w = xw;
1566 	struct rtentry *rt = (struct rtentry *)rn;
1567 	struct rt_addrinfo rtinfo;
1568 	struct rt_msghdr *rtm;
1569 	boolean_t save = FALSE;
1570 	int msglen, w_bufleft;
1571 	void *ptr;
1572 
1573 	rttable_entry_rtinfo(&rtinfo, rn);
1574 	msglen = rt_msgsize(RTM_GET, &rtinfo);
1575 
1576 	w_bufleft = w->w_bufsz - w->w_buflen;
1577 
1578 	if (rn->rn_dupedkey != NULL) {
1579 		struct radix_node *rn1 = rn;
1580 		int total_msglen = msglen;
1581 
1582 		/*
1583 		 * Make sure that we have enough space left for all
1584 		 * dupedkeys, since rn_walktree_at always starts
1585 		 * from the first dupedkey.
1586 		 */
1587 		while ((rn1 = rn1->rn_dupedkey) != NULL) {
1588 			struct rt_addrinfo rtinfo1;
1589 			int msglen1;
1590 
1591 			if (rn1->rn_flags & RNF_ROOT)
1592 				continue;
1593 
1594 			rttable_entry_rtinfo(&rtinfo1, rn1);
1595 			msglen1 = rt_msgsize(RTM_GET, &rtinfo1);
1596 			total_msglen += msglen1;
1597 		}
1598 
1599 		if (total_msglen > w_bufleft) {
1600 			if (total_msglen > w->w_bufsz) {
1601 				static int logged = 0;
1602 
1603 				if (!logged) {
1604 					kprintf("buffer is too small for "
1605 					    "all dupedkeys, increase "
1606 					    "RTTABLE_DUMP_MSGCNT_MAX\n");
1607 					logged = 1;
1608 				}
1609 				return ENOMEM;
1610 			}
1611 			save = TRUE;
1612 		}
1613 	} else if (msglen > w_bufleft) {
1614 		save = TRUE;
1615 	}
1616 
1617 	if (save) {
1618 		/*
1619 		 * Not enough buffer left; remember the position
1620 		 * to start from upon next round.
1621 		 */
1622 		KASSERT(msglen <= w->w_bufsz, ("msg too long %d", msglen));
1623 
1624 		KASSERT(rtinfo.rti_dst->sa_len <= sizeof(w->w_key0),
1625 		    ("key too long %d", rtinfo.rti_dst->sa_len));
1626 		memset(&w->w_key0, 0, sizeof(w->w_key0));
1627 		memcpy(&w->w_key0, rtinfo.rti_dst, rtinfo.rti_dst->sa_len);
1628 		w->w_key = (const char *)&w->w_key0;
1629 
1630 		if (rtinfo.rti_netmask != NULL) {
1631 			KASSERT(
1632 			    rtinfo.rti_netmask->sa_len <= sizeof(w->w_mask0),
1633 			    ("mask too long %d", rtinfo.rti_netmask->sa_len));
1634 			memset(&w->w_mask0, 0, sizeof(w->w_mask0));
1635 			memcpy(&w->w_mask0, rtinfo.rti_netmask,
1636 			    rtinfo.rti_netmask->sa_len);
1637 			w->w_mask = (const char *)&w->w_mask0;
1638 		} else {
1639 			w->w_mask = NULL;
1640 		}
1641 		return EJUSTRETURN;
1642 	}
1643 
1644 	if (w->w_op == NET_RT_FLAGS && !(rt->rt_flags & w->w_arg))
1645 		return 0;
1646 
1647 	ptr = ((uint8_t *)w->w_buf) + w->w_buflen;
1648 	rt_msg_buffer(RTM_GET, &rtinfo, ptr, msglen);
1649 
1650 	rtm = (struct rt_msghdr *)ptr;
1651 	rtm->rtm_flags = rt->rt_flags;
1652 	rtm->rtm_use = rt->rt_use;
1653 	rtm->rtm_rmx = rt->rt_rmx;
1654 	rtm->rtm_index = rt->rt_ifp->if_index;
1655 	rtm->rtm_errno = rtm->rtm_pid = rtm->rtm_seq = 0;
1656 	rtm->rtm_addrs = rtinfo.rti_addrs;
1657 
1658 	w->w_buflen += msglen;
1659 
1660 	return 0;
1661 }
1662 
1663 static void
1664 rttable_walk_dispatch(netmsg_t msg)
1665 {
1666 	struct netmsg_rttable_walk *nmsg = (struct netmsg_rttable_walk *)msg;
1667 	struct radix_node_head *rnh = rt_tables[mycpuid][nmsg->af];
1668 	struct rttable_walkarg *w = nmsg->w;
1669 	int error;
1670 
1671 	error = rnh->rnh_walktree_at(rnh, w->w_key, w->w_mask,
1672 	    rttable_walk_entry, w);
1673 	lwkt_replymsg(&nmsg->base.lmsg, error);
1674 }
1675 
1676 static int
1677 sysctl_rttable(int af, struct sysctl_req *req, int op, int arg)
1678 {
1679 	struct rttable_walkarg w;
1680 	int error, i;
1681 
1682 	error = rttable_walkarg_create(&w, op, arg);
1683 	if (error)
1684 		return error;
1685 
1686 	error = EINVAL;
1687 	for (i = 1; i <= AF_MAX; i++) {
1688 		if (rt_tables[mycpuid][i] != NULL && (af == 0 || af == i)) {
1689 			w.w_key = NULL;
1690 			w.w_mask = NULL;
1691 			for (;;) {
1692 				struct netmsg_rttable_walk nmsg;
1693 
1694 				netmsg_init(&nmsg.base, NULL,
1695 				    &curthread->td_msgport, 0,
1696 				    rttable_walk_dispatch);
1697 				nmsg.af = i;
1698 				nmsg.w = &w;
1699 
1700 				w.w_buflen = 0;
1701 
1702 				error = lwkt_domsg(netisr_cpuport(mycpuid),
1703 				    &nmsg.base.lmsg, 0);
1704 				if (error && error != EJUSTRETURN)
1705 					goto done;
1706 
1707 				if (req != NULL && w.w_buflen > 0) {
1708 					int error1;
1709 
1710 					error1 = SYSCTL_OUT(req, w.w_buf,
1711 					    w.w_buflen);
1712 					if (error1) {
1713 						error = error1;
1714 						goto done;
1715 					}
1716 				}
1717 				if (error == 0) /* done */
1718 					break;
1719 			}
1720 		}
1721 	}
1722 done:
1723 	rttable_walkarg_destroy(&w);
1724 	return error;
1725 }
1726 
1727 static int
1728 sysctl_rtsock(SYSCTL_HANDLER_ARGS)
1729 {
1730 	int	*name = (int *)arg1;
1731 	u_int	namelen = arg2;
1732 	int	error = EINVAL;
1733 	int	origcpu, cpu;
1734 	u_char  af;
1735 	struct	walkarg w;
1736 
1737 	name ++;
1738 	namelen--;
1739 	if (req->newptr)
1740 		return (EPERM);
1741 	if (namelen != 3 && namelen != 4)
1742 		return (EINVAL);
1743 	af = name[0];
1744 	bzero(&w, sizeof w);
1745 	w.w_op = name[1];
1746 	w.w_arg = name[2];
1747 	w.w_req = req;
1748 
1749 	/*
1750 	 * Optional third argument specifies cpu, used primarily for
1751 	 * debugging the route table.
1752 	 */
1753 	if (namelen == 4) {
1754 		if (name[3] < 0 || name[3] >= netisr_ncpus)
1755 			return (EINVAL);
1756 		cpu = name[3];
1757 	} else {
1758 		/*
1759 		 * Target cpu is not specified, use cpu0 then, so that
1760 		 * the result set will be relatively stable.
1761 		 */
1762 		cpu = 0;
1763 	}
1764 	origcpu = mycpuid;
1765 	lwkt_migratecpu(cpu);
1766 
1767 	switch (w.w_op) {
1768 	case NET_RT_DUMP:
1769 	case NET_RT_FLAGS:
1770 		error = sysctl_rttable(af, w.w_req, w.w_op, w.w_arg);
1771 		break;
1772 
1773 	case NET_RT_IFLIST:
1774 		error = sysctl_iflist(af, &w);
1775 		break;
1776 	}
1777 	if (w.w_tmem != NULL)
1778 		kfree(w.w_tmem, M_RTABLE);
1779 
1780 	lwkt_migratecpu(origcpu);
1781 	return (error);
1782 }
1783 
1784 SYSCTL_NODE(_net, PF_ROUTE, routetable, CTLFLAG_RD, sysctl_rtsock, "");
1785 
1786 /*
1787  * Definitions of protocols supported in the ROUTE domain.
1788  */
1789 
1790 static struct domain routedomain;		/* or at least forward */
1791 
1792 static struct protosw routesw[] = {
1793     {
1794 	.pr_type = SOCK_RAW,
1795 	.pr_domain = &routedomain,
1796 	.pr_protocol = 0,
1797 	.pr_flags = PR_ATOMIC|PR_ADDR,
1798 	.pr_input = NULL,
1799 	.pr_output = route_output,
1800 	.pr_ctlinput = raw_ctlinput,
1801 	.pr_ctloutput = route_ctloutput,
1802 	.pr_ctlport = cpu0_ctlport,
1803 
1804 	.pr_init = raw_init,
1805 	.pr_usrreqs = &route_usrreqs
1806     }
1807 };
1808 
1809 static struct domain routedomain = {
1810 	.dom_family		= AF_ROUTE,
1811 	.dom_name		= "route",
1812 	.dom_init		= NULL,
1813 	.dom_externalize	= NULL,
1814 	.dom_dispose		= NULL,
1815 	.dom_protosw		= routesw,
1816 	.dom_protoswNPROTOSW	= &routesw[(sizeof routesw)/(sizeof routesw[0])],
1817 	.dom_next		= SLIST_ENTRY_INITIALIZER,
1818 	.dom_rtattach		= NULL,
1819 	.dom_rtoffset		= 0,
1820 	.dom_maxrtkey		= 0,
1821 	.dom_ifattach		= NULL,
1822 	.dom_ifdetach		= NULL
1823 };
1824 
1825 DOMAIN_SET(route);
1826 
1827