xref: /dragonfly/sys/net/rtsock.c (revision cae2835b)
1 /*
2  * Copyright (c) 2004, 2005 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Jeffrey M. Hsu.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of The DragonFly Project nor the names of its
16  *    contributors may be used to endorse or promote products derived
17  *    from this software without specific, prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
27  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
29  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1988, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)rtsock.c	8.7 (Berkeley) 10/12/95
62  * $FreeBSD: src/sys/net/rtsock.c,v 1.44.2.11 2002/12/04 14:05:41 ru Exp $
63  */
64 
65 #include <sys/param.h>
66 #include <sys/systm.h>
67 #include <sys/kernel.h>
68 #include <sys/sysctl.h>
69 #include <sys/proc.h>
70 #include <sys/priv.h>
71 #include <sys/malloc.h>
72 #include <sys/mbuf.h>
73 #include <sys/protosw.h>
74 #include <sys/socket.h>
75 #include <sys/socketvar.h>
76 #include <sys/domain.h>
77 
78 #include <sys/thread2.h>
79 #include <sys/socketvar2.h>
80 
81 #include <net/if.h>
82 #include <net/route.h>
83 #include <net/raw_cb.h>
84 #include <net/netmsg2.h>
85 #include <net/netisr2.h>
86 
87 MALLOC_DEFINE(M_RTABLE, "routetbl", "routing tables");
88 
89 static struct route_cb {
90 	int	ip_count;
91 	int	ip6_count;
92 	int	ns_count;
93 	int	any_count;
94 } route_cb;
95 
96 static const struct sockaddr route_src = { 2, PF_ROUTE, };
97 
98 struct walkarg {
99 	int	w_tmemsize;
100 	int	w_op, w_arg;
101 	void	*w_tmem;
102 	struct sysctl_req *w_req;
103 };
104 
105 #ifndef RTTABLE_DUMP_MSGCNT_MAX
106 /* Should be large enough for dupkeys */
107 #define RTTABLE_DUMP_MSGCNT_MAX		64
108 #endif
109 
110 struct rttable_walkarg {
111 	int	w_op;
112 	int	w_arg;
113 	int	w_bufsz;
114 	void	*w_buf;
115 
116 	int	w_buflen;
117 
118 	const char *w_key;
119 	const char *w_mask;
120 
121 	struct sockaddr_storage w_key0;
122 	struct sockaddr_storage w_mask0;
123 };
124 
125 struct netmsg_rttable_walk {
126 	struct netmsg_base	base;
127 	int			af;
128 	struct rttable_walkarg	*w;
129 };
130 
131 static struct mbuf *
132 		rt_msg_mbuf (int, struct rt_addrinfo *);
133 static void	rt_msg_buffer (int, struct rt_addrinfo *, void *buf, int len);
134 static int	rt_msgsize(int type, const struct rt_addrinfo *rtinfo);
135 static int	rt_xaddrs (char *, char *, struct rt_addrinfo *);
136 static int	sysctl_rttable(int af, struct sysctl_req *req, int op, int arg);
137 static int	sysctl_iflist (int af, struct walkarg *w);
138 static int	route_output(struct mbuf *, struct socket *, ...);
139 static void	rt_setmetrics (u_long, struct rt_metrics *,
140 			       struct rt_metrics *);
141 
142 /*
143  * It really doesn't make any sense at all for this code to share much
144  * with raw_usrreq.c, since its functionality is so restricted.  XXX
145  */
146 static void
147 rts_abort(netmsg_t msg)
148 {
149 	crit_enter();
150 	raw_usrreqs.pru_abort(msg);
151 	/* msg invalid now */
152 	crit_exit();
153 }
154 
155 /* pru_accept is EOPNOTSUPP */
156 
157 static void
158 rts_attach(netmsg_t msg)
159 {
160 	struct socket *so = msg->base.nm_so;
161 	struct pru_attach_info *ai = msg->attach.nm_ai;
162 	struct rawcb *rp;
163 	int proto = msg->attach.nm_proto;
164 	int error;
165 
166 	crit_enter();
167 	if (sotorawcb(so) != NULL) {
168 		error = EISCONN;
169 		goto done;
170 	}
171 
172 	rp = kmalloc(sizeof *rp, M_PCB, M_WAITOK | M_ZERO);
173 
174 	/*
175 	 * The critical section is necessary to block protocols from sending
176 	 * error notifications (like RTM_REDIRECT or RTM_LOSING) while
177 	 * this PCB is extant but incompletely initialized.
178 	 * Probably we should try to do more of this work beforehand and
179 	 * eliminate the critical section.
180 	 */
181 	so->so_pcb = rp;
182 	soreference(so);	/* so_pcb assignment */
183 	error = raw_attach(so, proto, ai->sb_rlimit);
184 	rp = sotorawcb(so);
185 	if (error) {
186 		kfree(rp, M_PCB);
187 		goto done;
188 	}
189 	switch(rp->rcb_proto.sp_protocol) {
190 	case AF_INET:
191 		route_cb.ip_count++;
192 		break;
193 	case AF_INET6:
194 		route_cb.ip6_count++;
195 		break;
196 	}
197 	rp->rcb_faddr = &route_src;
198 	route_cb.any_count++;
199 	soisconnected(so);
200 	so->so_options |= SO_USELOOPBACK;
201 	error = 0;
202 done:
203 	crit_exit();
204 	lwkt_replymsg(&msg->lmsg, error);
205 }
206 
207 static void
208 rts_bind(netmsg_t msg)
209 {
210 	crit_enter();
211 	raw_usrreqs.pru_bind(msg); /* xxx just EINVAL */
212 	/* msg invalid now */
213 	crit_exit();
214 }
215 
216 static void
217 rts_connect(netmsg_t msg)
218 {
219 	crit_enter();
220 	raw_usrreqs.pru_connect(msg); /* XXX just EINVAL */
221 	/* msg invalid now */
222 	crit_exit();
223 }
224 
225 /* pru_connect2 is EOPNOTSUPP */
226 /* pru_control is EOPNOTSUPP */
227 
228 static void
229 rts_detach(netmsg_t msg)
230 {
231 	struct socket *so = msg->base.nm_so;
232 	struct rawcb *rp = sotorawcb(so);
233 
234 	crit_enter();
235 	if (rp != NULL) {
236 		switch(rp->rcb_proto.sp_protocol) {
237 		case AF_INET:
238 			route_cb.ip_count--;
239 			break;
240 		case AF_INET6:
241 			route_cb.ip6_count--;
242 			break;
243 		}
244 		route_cb.any_count--;
245 	}
246 	raw_usrreqs.pru_detach(msg);
247 	/* msg invalid now */
248 	crit_exit();
249 }
250 
251 static void
252 rts_disconnect(netmsg_t msg)
253 {
254 	crit_enter();
255 	raw_usrreqs.pru_disconnect(msg);
256 	/* msg invalid now */
257 	crit_exit();
258 }
259 
260 /* pru_listen is EOPNOTSUPP */
261 
262 static void
263 rts_peeraddr(netmsg_t msg)
264 {
265 	crit_enter();
266 	raw_usrreqs.pru_peeraddr(msg);
267 	/* msg invalid now */
268 	crit_exit();
269 }
270 
271 /* pru_rcvd is EOPNOTSUPP */
272 /* pru_rcvoob is EOPNOTSUPP */
273 
274 static void
275 rts_send(netmsg_t msg)
276 {
277 	crit_enter();
278 	raw_usrreqs.pru_send(msg);
279 	/* msg invalid now */
280 	crit_exit();
281 }
282 
283 /* pru_sense is null */
284 
285 static void
286 rts_shutdown(netmsg_t msg)
287 {
288 	crit_enter();
289 	raw_usrreqs.pru_shutdown(msg);
290 	/* msg invalid now */
291 	crit_exit();
292 }
293 
294 static void
295 rts_sockaddr(netmsg_t msg)
296 {
297 	crit_enter();
298 	raw_usrreqs.pru_sockaddr(msg);
299 	/* msg invalid now */
300 	crit_exit();
301 }
302 
303 static struct pr_usrreqs route_usrreqs = {
304 	.pru_abort = rts_abort,
305 	.pru_accept = pr_generic_notsupp,
306 	.pru_attach = rts_attach,
307 	.pru_bind = rts_bind,
308 	.pru_connect = rts_connect,
309 	.pru_connect2 = pr_generic_notsupp,
310 	.pru_control = pr_generic_notsupp,
311 	.pru_detach = rts_detach,
312 	.pru_disconnect = rts_disconnect,
313 	.pru_listen = pr_generic_notsupp,
314 	.pru_peeraddr = rts_peeraddr,
315 	.pru_rcvd = pr_generic_notsupp,
316 	.pru_rcvoob = pr_generic_notsupp,
317 	.pru_send = rts_send,
318 	.pru_sense = pru_sense_null,
319 	.pru_shutdown = rts_shutdown,
320 	.pru_sockaddr = rts_sockaddr,
321 	.pru_sosend = sosend,
322 	.pru_soreceive = soreceive
323 };
324 
325 static __inline sa_family_t
326 familyof(struct sockaddr *sa)
327 {
328 	return (sa != NULL ? sa->sa_family : 0);
329 }
330 
331 /*
332  * Routing socket input function.  The packet must be serialized onto cpu 0.
333  * We use the cpu0_soport() netisr processing loop to handle it.
334  *
335  * This looks messy but it means that anyone, including interrupt code,
336  * can send a message to the routing socket.
337  */
338 static void
339 rts_input_handler(netmsg_t msg)
340 {
341 	static const struct sockaddr route_dst = { 2, PF_ROUTE, };
342 	struct sockproto route_proto;
343 	struct netmsg_packet *pmsg = &msg->packet;
344 	struct mbuf *m;
345 	sa_family_t family;
346 	struct rawcb *skip;
347 
348 	family = pmsg->base.lmsg.u.ms_result;
349 	route_proto.sp_family = PF_ROUTE;
350 	route_proto.sp_protocol = family;
351 
352 	m = pmsg->nm_packet;
353 	M_ASSERTPKTHDR(m);
354 
355 	skip = m->m_pkthdr.header;
356 	m->m_pkthdr.header = NULL;
357 
358 	raw_input(m, &route_proto, &route_src, &route_dst, skip);
359 }
360 
361 static void
362 rts_input_skip(struct mbuf *m, sa_family_t family, struct rawcb *skip)
363 {
364 	struct netmsg_packet *pmsg;
365 	lwkt_port_t port;
366 
367 	M_ASSERTPKTHDR(m);
368 
369 	port = netisr_cpuport(0);	/* XXX same as for routing socket */
370 	pmsg = &m->m_hdr.mh_netmsg;
371 	netmsg_init(&pmsg->base, NULL, &netisr_apanic_rport,
372 		    0, rts_input_handler);
373 	pmsg->nm_packet = m;
374 	pmsg->base.lmsg.u.ms_result = family;
375 	m->m_pkthdr.header = skip; /* XXX steal field in pkthdr */
376 	lwkt_sendmsg(port, &pmsg->base.lmsg);
377 }
378 
379 static __inline void
380 rts_input(struct mbuf *m, sa_family_t family)
381 {
382 	rts_input_skip(m, family, NULL);
383 }
384 
385 static void *
386 reallocbuf_nofree(void *ptr, size_t len, size_t olen)
387 {
388 	void *newptr;
389 
390 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
391 	if (newptr == NULL)
392 		return NULL;
393 	bcopy(ptr, newptr, olen);
394 	return (newptr);
395 }
396 
397 /*
398  * Internal helper routine for route_output().
399  */
400 static int
401 _fillrtmsg(struct rt_msghdr **prtm, struct rtentry *rt,
402 	   struct rt_addrinfo *rtinfo)
403 {
404 	int msglen;
405 	struct rt_msghdr *rtm = *prtm;
406 
407 	/* Fill in rt_addrinfo for call to rt_msg_buffer(). */
408 	rtinfo->rti_dst = rt_key(rt);
409 	rtinfo->rti_gateway = rt->rt_gateway;
410 	rtinfo->rti_netmask = rt_mask(rt);		/* might be NULL */
411 	rtinfo->rti_genmask = rt->rt_genmask;		/* might be NULL */
412 	if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
413 		if (rt->rt_ifp != NULL) {
414 			rtinfo->rti_ifpaddr =
415 			    TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])
416 			    ->ifa->ifa_addr;
417 			rtinfo->rti_ifaaddr = rt->rt_ifa->ifa_addr;
418 			if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
419 				rtinfo->rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
420 			rtm->rtm_index = rt->rt_ifp->if_index;
421 		} else {
422 			rtinfo->rti_ifpaddr = NULL;
423 			rtinfo->rti_ifaaddr = NULL;
424 		}
425 	} else if (rt->rt_ifp != NULL) {
426 		rtm->rtm_index = rt->rt_ifp->if_index;
427 	}
428 
429 	msglen = rt_msgsize(rtm->rtm_type, rtinfo);
430 	if (rtm->rtm_msglen < msglen) {
431 		/* NOTE: Caller will free the old rtm accordingly */
432 		rtm = reallocbuf_nofree(rtm, msglen, rtm->rtm_msglen);
433 		if (rtm == NULL)
434 			return (ENOBUFS);
435 		*prtm = rtm;
436 	}
437 	rt_msg_buffer(rtm->rtm_type, rtinfo, rtm, msglen);
438 
439 	rtm->rtm_flags = rt->rt_flags;
440 	rtm->rtm_rmx = rt->rt_rmx;
441 	rtm->rtm_addrs = rtinfo->rti_addrs;
442 
443 	return (0);
444 }
445 
446 struct rtm_arg {
447 	struct rt_msghdr	*bak_rtm;
448 	struct rt_msghdr	*new_rtm;
449 };
450 
451 static int
452 fillrtmsg(struct rtm_arg *arg, struct rtentry *rt,
453 	  struct rt_addrinfo *rtinfo)
454 {
455 	struct rt_msghdr *rtm = arg->new_rtm;
456 	int error;
457 
458 	error = _fillrtmsg(&rtm, rt, rtinfo);
459 	if (!error) {
460 		if (arg->new_rtm != rtm) {
461 			/*
462 			 * _fillrtmsg() just allocated a new rtm;
463 			 * if the previously allocated rtm is not
464 			 * the backing rtm, it should be freed.
465 			 */
466 			if (arg->new_rtm != arg->bak_rtm)
467 				kfree(arg->new_rtm, M_RTABLE);
468 			arg->new_rtm = rtm;
469 		}
470 	}
471 	return error;
472 }
473 
474 static void route_output_add_callback(int, int, struct rt_addrinfo *,
475 					struct rtentry *, void *);
476 static void route_output_delete_callback(int, int, struct rt_addrinfo *,
477 					struct rtentry *, void *);
478 static int route_output_get_callback(int, struct rt_addrinfo *,
479 				     struct rtentry *, void *, int);
480 static int route_output_change_callback(int, struct rt_addrinfo *,
481 					struct rtentry *, void *, int);
482 static int route_output_lock_callback(int, struct rt_addrinfo *,
483 				      struct rtentry *, void *, int);
484 
485 /*ARGSUSED*/
486 static int
487 route_output(struct mbuf *m, struct socket *so, ...)
488 {
489 	struct rtm_arg arg;
490 	struct rt_msghdr *rtm = NULL;
491 	struct rawcb *rp = NULL;
492 	struct pr_output_info *oi;
493 	struct rt_addrinfo rtinfo;
494 	sa_family_t family;
495 	int len, error = 0;
496 	__va_list ap;
497 
498 	M_ASSERTPKTHDR(m);
499 
500 	__va_start(ap, so);
501 	oi = __va_arg(ap, struct pr_output_info *);
502 	__va_end(ap);
503 
504 	family = familyof(NULL);
505 
506 #define gotoerr(e) { error = e; goto flush;}
507 
508 	if (m == NULL ||
509 	    (m->m_len < sizeof(long) &&
510 	     (m = m_pullup(m, sizeof(long))) == NULL))
511 		return (ENOBUFS);
512 	len = m->m_pkthdr.len;
513 	if (len < sizeof(struct rt_msghdr) ||
514 	    len != mtod(m, struct rt_msghdr *)->rtm_msglen)
515 		gotoerr(EINVAL);
516 
517 	rtm = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
518 	if (rtm == NULL)
519 		gotoerr(ENOBUFS);
520 
521 	m_copydata(m, 0, len, (caddr_t)rtm);
522 	if (rtm->rtm_version != RTM_VERSION)
523 		gotoerr(EPROTONOSUPPORT);
524 
525 	rtm->rtm_pid = oi->p_pid;
526 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
527 	rtinfo.rti_addrs = rtm->rtm_addrs;
528 	if (rt_xaddrs((char *)(rtm + 1), (char *)rtm + len, &rtinfo) != 0)
529 		gotoerr(EINVAL);
530 
531 	rtinfo.rti_flags = rtm->rtm_flags;
532 	if (rtinfo.rti_dst == NULL || rtinfo.rti_dst->sa_family >= AF_MAX ||
533 	    (rtinfo.rti_gateway && rtinfo.rti_gateway->sa_family >= AF_MAX))
534 		gotoerr(EINVAL);
535 
536 	family = familyof(rtinfo.rti_dst);
537 
538 	/*
539 	 * Verify that the caller has the appropriate privilege; RTM_GET
540 	 * is the only operation the non-superuser is allowed.
541 	 */
542 	if (rtm->rtm_type != RTM_GET &&
543 	    priv_check_cred(so->so_cred, PRIV_ROOT, 0) != 0)
544 		gotoerr(EPERM);
545 
546 	if (rtinfo.rti_genmask != NULL) {
547 		error = rtmask_add_global(rtinfo.rti_genmask,
548 		    rtm->rtm_type != RTM_GET ?
549 		    RTREQ_PRIO_HIGH : RTREQ_PRIO_NORM);
550 		if (error)
551 			goto flush;
552 	}
553 
554 	switch (rtm->rtm_type) {
555 	case RTM_ADD:
556 		if (rtinfo.rti_gateway == NULL) {
557 			error = EINVAL;
558 		} else {
559 			error = rtrequest1_global(RTM_ADD, &rtinfo,
560 			    route_output_add_callback, rtm, RTREQ_PRIO_HIGH);
561 		}
562 		break;
563 	case RTM_DELETE:
564 		/*
565 		 * Backing rtm (bak_rtm) could _not_ be freed during
566 		 * rtrequest1_global or rtsearch_global, even if the
567 		 * callback reallocates the rtm due to its size changes,
568 		 * since rtinfo points to the backing rtm's memory area.
569 		 * After rtrequest1_global or rtsearch_global returns,
570 		 * it is safe to free the backing rtm, since rtinfo will
571 		 * not be used anymore.
572 		 *
573 		 * new_rtm will be used to save the new rtm allocated
574 		 * by rtrequest1_global or rtsearch_global.
575 		 */
576 		arg.bak_rtm = rtm;
577 		arg.new_rtm = rtm;
578 		error = rtrequest1_global(RTM_DELETE, &rtinfo,
579 		    route_output_delete_callback, &arg, RTREQ_PRIO_HIGH);
580 		rtm = arg.new_rtm;
581 		if (rtm != arg.bak_rtm)
582 			kfree(arg.bak_rtm, M_RTABLE);
583 		break;
584 	case RTM_GET:
585 		/* See the comment in RTM_DELETE */
586 		arg.bak_rtm = rtm;
587 		arg.new_rtm = rtm;
588 		error = rtsearch_global(RTM_GET, &rtinfo,
589 		    route_output_get_callback, &arg, RTS_NOEXACTMATCH,
590 		    RTREQ_PRIO_NORM);
591 		rtm = arg.new_rtm;
592 		if (rtm != arg.bak_rtm)
593 			kfree(arg.bak_rtm, M_RTABLE);
594 		break;
595 	case RTM_CHANGE:
596 		error = rtsearch_global(RTM_CHANGE, &rtinfo,
597 		    route_output_change_callback, rtm, RTS_EXACTMATCH,
598 		    RTREQ_PRIO_HIGH);
599 		break;
600 	case RTM_LOCK:
601 		error = rtsearch_global(RTM_LOCK, &rtinfo,
602 		    route_output_lock_callback, rtm, RTS_EXACTMATCH,
603 		    RTREQ_PRIO_HIGH);
604 		break;
605 	default:
606 		error = EOPNOTSUPP;
607 		break;
608 	}
609 flush:
610 	if (rtm != NULL) {
611 		if (error != 0)
612 			rtm->rtm_errno = error;
613 		else
614 			rtm->rtm_flags |= RTF_DONE;
615 	}
616 
617 	/*
618 	 * Check to see if we don't want our own messages.
619 	 */
620 	if (!(so->so_options & SO_USELOOPBACK)) {
621 		if (route_cb.any_count <= 1) {
622 			if (rtm != NULL)
623 				kfree(rtm, M_RTABLE);
624 			m_freem(m);
625 			return (error);
626 		}
627 		/* There is another listener, so construct message */
628 		rp = sotorawcb(so);
629 	}
630 	if (rtm != NULL) {
631 		m_copyback(m, 0, rtm->rtm_msglen, (caddr_t)rtm);
632 		if (m->m_pkthdr.len < rtm->rtm_msglen) {
633 			m_freem(m);
634 			m = NULL;
635 		} else if (m->m_pkthdr.len > rtm->rtm_msglen)
636 			m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
637 		kfree(rtm, M_RTABLE);
638 	}
639 	if (m != NULL)
640 		rts_input_skip(m, family, rp);
641 	return (error);
642 }
643 
644 static void
645 route_output_add_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
646 			  struct rtentry *rt, void *arg)
647 {
648 	struct rt_msghdr *rtm = arg;
649 
650 	if (error == 0 && rt != NULL) {
651 		rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx,
652 		    &rt->rt_rmx);
653 		rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
654 		rt->rt_rmx.rmx_locks |=
655 		    (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
656 		if (rtinfo->rti_genmask != NULL) {
657 			rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
658 			if (rt->rt_genmask == NULL) {
659 				/*
660 				 * This should not happen, since we
661 				 * have already installed genmask
662 				 * on each CPU before we reach here.
663 				 */
664 				panic("genmask is gone!?");
665 			}
666 		} else {
667 			rt->rt_genmask = NULL;
668 		}
669 		rtm->rtm_index = rt->rt_ifp->if_index;
670 	}
671 }
672 
673 static void
674 route_output_delete_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
675 			  struct rtentry *rt, void *arg)
676 {
677 	if (error == 0 && rt) {
678 		++rt->rt_refcnt;
679 		if (fillrtmsg(arg, rt, rtinfo) != 0) {
680 			error = ENOBUFS;
681 			/* XXX no way to return the error */
682 		}
683 		--rt->rt_refcnt;
684 	}
685 	if (rt && rt->rt_refcnt == 0) {
686 		++rt->rt_refcnt;
687 		rtfree(rt);
688 	}
689 }
690 
691 static int
692 route_output_get_callback(int cmd, struct rt_addrinfo *rtinfo,
693 			  struct rtentry *rt, void *arg, int found_cnt)
694 {
695 	int error, found = 0;
696 
697 	if (((rtinfo->rti_flags ^ rt->rt_flags) & RTF_HOST) == 0)
698 		found = 1;
699 
700 	error = fillrtmsg(arg, rt, rtinfo);
701 	if (!error && found) {
702 		/* Got the exact match, we could return now! */
703 		error = EJUSTRETURN;
704 	}
705 	return error;
706 }
707 
708 static int
709 route_output_change_callback(int cmd, struct rt_addrinfo *rtinfo,
710 			     struct rtentry *rt, void *arg, int found_cnt)
711 {
712 	struct rt_msghdr *rtm = arg;
713 	struct ifaddr *ifa;
714 	int error = 0;
715 
716 	/*
717 	 * new gateway could require new ifaddr, ifp;
718 	 * flags may also be different; ifp may be specified
719 	 * by ll sockaddr when protocol address is ambiguous
720 	 */
721 	if (((rt->rt_flags & RTF_GATEWAY) && rtinfo->rti_gateway != NULL) ||
722 	    rtinfo->rti_ifpaddr != NULL ||
723 	    (rtinfo->rti_ifaaddr != NULL &&
724 	     !sa_equal(rtinfo->rti_ifaaddr, rt->rt_ifa->ifa_addr))) {
725 		error = rt_getifa(rtinfo);
726 		if (error != 0)
727 			goto done;
728 	}
729 	if (rtinfo->rti_gateway != NULL) {
730 		/*
731 		 * We only need to generate rtmsg upon the
732 		 * first route to be changed.
733 		 */
734 		error = rt_setgate(rt, rt_key(rt), rtinfo->rti_gateway,
735 			found_cnt == 1 ? RTL_REPORTMSG : RTL_DONTREPORT);
736 		if (error != 0)
737 			goto done;
738 	}
739 	if ((ifa = rtinfo->rti_ifa) != NULL) {
740 		struct ifaddr *oifa = rt->rt_ifa;
741 
742 		if (oifa != ifa) {
743 			if (oifa && oifa->ifa_rtrequest)
744 				oifa->ifa_rtrequest(RTM_DELETE, rt);
745 			IFAFREE(rt->rt_ifa);
746 			IFAREF(ifa);
747 			rt->rt_ifa = ifa;
748 			rt->rt_ifp = rtinfo->rti_ifp;
749 		}
750 	}
751 	rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx, &rt->rt_rmx);
752 	if (rt->rt_ifa && rt->rt_ifa->ifa_rtrequest)
753 		rt->rt_ifa->ifa_rtrequest(RTM_ADD, rt);
754 	if (rtinfo->rti_genmask != NULL) {
755 		rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
756 		if (rt->rt_genmask == NULL) {
757 			/*
758 			 * This should not happen, since we
759 			 * have already installed genmask
760 			 * on each CPU before we reach here.
761 			 */
762 			panic("genmask is gone!?");
763 		}
764 	}
765 	rtm->rtm_index = rt->rt_ifp->if_index;
766 done:
767 	return error;
768 }
769 
770 static int
771 route_output_lock_callback(int cmd, struct rt_addrinfo *rtinfo,
772 			   struct rtentry *rt, void *arg,
773 			   int found_cnt __unused)
774 {
775 	struct rt_msghdr *rtm = arg;
776 
777 	rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
778 	rt->rt_rmx.rmx_locks |=
779 		(rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
780 	return 0;
781 }
782 
783 static void
784 rt_setmetrics(u_long which, struct rt_metrics *in, struct rt_metrics *out)
785 {
786 #define setmetric(flag, elt) if (which & (flag)) out->elt = in->elt;
787 	setmetric(RTV_RPIPE, rmx_recvpipe);
788 	setmetric(RTV_SPIPE, rmx_sendpipe);
789 	setmetric(RTV_SSTHRESH, rmx_ssthresh);
790 	setmetric(RTV_RTT, rmx_rtt);
791 	setmetric(RTV_RTTVAR, rmx_rttvar);
792 	setmetric(RTV_HOPCOUNT, rmx_hopcount);
793 	setmetric(RTV_MTU, rmx_mtu);
794 	setmetric(RTV_EXPIRE, rmx_expire);
795 	setmetric(RTV_MSL, rmx_msl);
796 	setmetric(RTV_IWMAXSEGS, rmx_iwmaxsegs);
797 	setmetric(RTV_IWCAPSEGS, rmx_iwcapsegs);
798 #undef setmetric
799 }
800 
801 /*
802  * Extract the addresses of the passed sockaddrs.
803  * Do a little sanity checking so as to avoid bad memory references.
804  * This data is derived straight from userland.
805  */
806 static int
807 rt_xaddrs(char *cp, char *cplim, struct rt_addrinfo *rtinfo)
808 {
809 	struct sockaddr *sa;
810 	int i;
811 
812 	for (i = 0; (i < RTAX_MAX) && (cp < cplim); i++) {
813 		if ((rtinfo->rti_addrs & (1 << i)) == 0)
814 			continue;
815 		sa = (struct sockaddr *)cp;
816 		/*
817 		 * It won't fit.
818 		 */
819 		if ((cp + sa->sa_len) > cplim) {
820 			return (EINVAL);
821 		}
822 
823 		/*
824 		 * There are no more...  Quit now.
825 		 * If there are more bits, they are in error.
826 		 * I've seen this.  route(1) can evidently generate these.
827 		 * This causes kernel to core dump.
828 		 * For compatibility, if we see this, point to a safe address.
829 		 */
830 		if (sa->sa_len == 0) {
831 			static struct sockaddr sa_zero = {
832 				sizeof sa_zero, AF_INET,
833 			};
834 
835 			rtinfo->rti_info[i] = &sa_zero;
836 			kprintf("rtsock: received more addr bits than sockaddrs.\n");
837 			return (0); /* should be EINVAL but for compat */
838 		}
839 
840 		/* Accept the sockaddr. */
841 		rtinfo->rti_info[i] = sa;
842 		cp += RT_ROUNDUP(sa->sa_len);
843 	}
844 	return (0);
845 }
846 
847 static int
848 rt_msghdrsize(int type)
849 {
850 	switch (type) {
851 	case RTM_DELADDR:
852 	case RTM_NEWADDR:
853 		return sizeof(struct ifa_msghdr);
854 	case RTM_DELMADDR:
855 	case RTM_NEWMADDR:
856 		return sizeof(struct ifma_msghdr);
857 	case RTM_IFINFO:
858 		return sizeof(struct if_msghdr);
859 	case RTM_IFANNOUNCE:
860 	case RTM_IEEE80211:
861 		return sizeof(struct if_announcemsghdr);
862 	default:
863 		return sizeof(struct rt_msghdr);
864 	}
865 }
866 
867 static int
868 rt_msgsize(int type, const struct rt_addrinfo *rtinfo)
869 {
870 	int len, i;
871 
872 	len = rt_msghdrsize(type);
873 	for (i = 0; i < RTAX_MAX; i++) {
874 		if (rtinfo->rti_info[i] != NULL)
875 			len += RT_ROUNDUP(rtinfo->rti_info[i]->sa_len);
876 	}
877 	len = ALIGN(len);
878 	return len;
879 }
880 
881 /*
882  * Build a routing message in a buffer.
883  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
884  * to the end of the buffer after the message header.
885  *
886  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
887  * This side-effect can be avoided if we reorder the addrs bitmask field in all
888  * the route messages to line up so we can set it here instead of back in the
889  * calling routine.
890  */
891 static void
892 rt_msg_buffer(int type, struct rt_addrinfo *rtinfo, void *buf, int msglen)
893 {
894 	struct rt_msghdr *rtm;
895 	char *cp;
896 	int dlen, i;
897 
898 	rtm = (struct rt_msghdr *) buf;
899 	rtm->rtm_version = RTM_VERSION;
900 	rtm->rtm_type = type;
901 	rtm->rtm_msglen = msglen;
902 
903 	cp = (char *)buf + rt_msghdrsize(type);
904 	rtinfo->rti_addrs = 0;
905 	for (i = 0; i < RTAX_MAX; i++) {
906 		struct sockaddr *sa;
907 
908 		if ((sa = rtinfo->rti_info[i]) == NULL)
909 			continue;
910 		rtinfo->rti_addrs |= (1 << i);
911 		dlen = RT_ROUNDUP(sa->sa_len);
912 		bcopy(sa, cp, dlen);
913 		cp += dlen;
914 	}
915 }
916 
917 /*
918  * Build a routing message in a mbuf chain.
919  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
920  * to the end of the mbuf after the message header.
921  *
922  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
923  * This side-effect can be avoided if we reorder the addrs bitmask field in all
924  * the route messages to line up so we can set it here instead of back in the
925  * calling routine.
926  */
927 static struct mbuf *
928 rt_msg_mbuf(int type, struct rt_addrinfo *rtinfo)
929 {
930 	struct mbuf *m;
931 	struct rt_msghdr *rtm;
932 	int hlen, len;
933 	int i;
934 
935 	hlen = rt_msghdrsize(type);
936 	KASSERT(hlen <= MCLBYTES, ("rt_msg_mbuf: hlen %d doesn't fit", hlen));
937 
938 	m = m_getl(hlen, M_NOWAIT, MT_DATA, M_PKTHDR, NULL);
939 	if (m == NULL)
940 		return (NULL);
941 	mbuftrackid(m, 32);
942 	m->m_pkthdr.len = m->m_len = hlen;
943 	m->m_pkthdr.rcvif = NULL;
944 	rtinfo->rti_addrs = 0;
945 	len = hlen;
946 	for (i = 0; i < RTAX_MAX; i++) {
947 		struct sockaddr *sa;
948 		int dlen;
949 
950 		if ((sa = rtinfo->rti_info[i]) == NULL)
951 			continue;
952 		rtinfo->rti_addrs |= (1 << i);
953 		dlen = RT_ROUNDUP(sa->sa_len);
954 		m_copyback(m, len, dlen, (caddr_t)sa); /* can grow mbuf chain */
955 		len += dlen;
956 	}
957 	if (m->m_pkthdr.len != len) { /* one of the m_copyback() calls failed */
958 		m_freem(m);
959 		return (NULL);
960 	}
961 	rtm = mtod(m, struct rt_msghdr *);
962 	bzero(rtm, hlen);
963 	rtm->rtm_msglen = len;
964 	rtm->rtm_version = RTM_VERSION;
965 	rtm->rtm_type = type;
966 	return (m);
967 }
968 
969 /*
970  * This routine is called to generate a message from the routing
971  * socket indicating that a redirect has occurred, a routing lookup
972  * has failed, or that a protocol has detected timeouts to a particular
973  * destination.
974  */
975 void
976 rt_missmsg(int type, struct rt_addrinfo *rtinfo, int flags, int error)
977 {
978 	struct sockaddr *dst = rtinfo->rti_info[RTAX_DST];
979 	struct rt_msghdr *rtm;
980 	struct mbuf *m;
981 
982 	if (route_cb.any_count == 0)
983 		return;
984 	m = rt_msg_mbuf(type, rtinfo);
985 	if (m == NULL)
986 		return;
987 	rtm = mtod(m, struct rt_msghdr *);
988 	rtm->rtm_flags = RTF_DONE | flags;
989 	rtm->rtm_errno = error;
990 	rtm->rtm_addrs = rtinfo->rti_addrs;
991 	rts_input(m, familyof(dst));
992 }
993 
994 void
995 rt_dstmsg(int type, struct sockaddr *dst, int error)
996 {
997 	struct rt_msghdr *rtm;
998 	struct rt_addrinfo addrs;
999 	struct mbuf *m;
1000 
1001 	if (route_cb.any_count == 0)
1002 		return;
1003 	bzero(&addrs, sizeof(struct rt_addrinfo));
1004 	addrs.rti_info[RTAX_DST] = dst;
1005 	m = rt_msg_mbuf(type, &addrs);
1006 	if (m == NULL)
1007 		return;
1008 	rtm = mtod(m, struct rt_msghdr *);
1009 	rtm->rtm_flags = RTF_DONE;
1010 	rtm->rtm_errno = error;
1011 	rtm->rtm_addrs = addrs.rti_addrs;
1012 	rts_input(m, familyof(dst));
1013 }
1014 
1015 /*
1016  * This routine is called to generate a message from the routing
1017  * socket indicating that the status of a network interface has changed.
1018  */
1019 void
1020 rt_ifmsg(struct ifnet *ifp)
1021 {
1022 	struct if_msghdr *ifm;
1023 	struct mbuf *m;
1024 	struct rt_addrinfo rtinfo;
1025 
1026 	if (route_cb.any_count == 0)
1027 		return;
1028 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1029 	m = rt_msg_mbuf(RTM_IFINFO, &rtinfo);
1030 	if (m == NULL)
1031 		return;
1032 	ifm = mtod(m, struct if_msghdr *);
1033 	ifm->ifm_index = ifp->if_index;
1034 	ifm->ifm_flags = ifp->if_flags;
1035 	ifm->ifm_data = ifp->if_data;
1036 	ifm->ifm_addrs = 0;
1037 	rts_input(m, 0);
1038 }
1039 
1040 static void
1041 rt_ifamsg(int cmd, struct ifaddr *ifa)
1042 {
1043 	struct ifa_msghdr *ifam;
1044 	struct rt_addrinfo rtinfo;
1045 	struct mbuf *m;
1046 	struct ifnet *ifp = ifa->ifa_ifp;
1047 
1048 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1049 	rtinfo.rti_ifaaddr = ifa->ifa_addr;
1050 	rtinfo.rti_ifpaddr =
1051 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1052 	rtinfo.rti_netmask = ifa->ifa_netmask;
1053 	rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1054 
1055 	m = rt_msg_mbuf(cmd, &rtinfo);
1056 	if (m == NULL)
1057 		return;
1058 
1059 	ifam = mtod(m, struct ifa_msghdr *);
1060 	ifam->ifam_index = ifp->if_index;
1061 	ifam->ifam_metric = ifa->ifa_metric;
1062 	ifam->ifam_flags = ifa->ifa_flags;
1063 	ifam->ifam_addrs = rtinfo.rti_addrs;
1064 
1065 	rts_input(m, familyof(ifa->ifa_addr));
1066 }
1067 
1068 void
1069 rt_rtmsg(int cmd, struct rtentry *rt, struct ifnet *ifp, int error)
1070 {
1071 	struct rt_msghdr *rtm;
1072 	struct rt_addrinfo rtinfo;
1073 	struct mbuf *m;
1074 	struct sockaddr *dst;
1075 
1076 	if (rt == NULL)
1077 		return;
1078 
1079 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1080 	rtinfo.rti_dst = dst = rt_key(rt);
1081 	rtinfo.rti_gateway = rt->rt_gateway;
1082 	rtinfo.rti_netmask = rt_mask(rt);
1083 	if (ifp != NULL) {
1084 		rtinfo.rti_ifpaddr =
1085 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1086 	}
1087 	rtinfo.rti_ifaaddr = rt->rt_ifa->ifa_addr;
1088 
1089 	m = rt_msg_mbuf(cmd, &rtinfo);
1090 	if (m == NULL)
1091 		return;
1092 
1093 	rtm = mtod(m, struct rt_msghdr *);
1094 	if (ifp != NULL)
1095 		rtm->rtm_index = ifp->if_index;
1096 	rtm->rtm_flags |= rt->rt_flags;
1097 	rtm->rtm_errno = error;
1098 	rtm->rtm_addrs = rtinfo.rti_addrs;
1099 
1100 	rts_input(m, familyof(dst));
1101 }
1102 
1103 /*
1104  * This is called to generate messages from the routing socket
1105  * indicating a network interface has had addresses associated with it.
1106  * if we ever reverse the logic and replace messages TO the routing
1107  * socket indicate a request to configure interfaces, then it will
1108  * be unnecessary as the routing socket will automatically generate
1109  * copies of it.
1110  */
1111 void
1112 rt_newaddrmsg(int cmd, struct ifaddr *ifa, int error, struct rtentry *rt)
1113 {
1114 	if (route_cb.any_count == 0)
1115 		return;
1116 
1117 	if (cmd == RTM_ADD) {
1118 		rt_ifamsg(RTM_NEWADDR, ifa);
1119 		rt_rtmsg(RTM_ADD, rt, ifa->ifa_ifp, error);
1120 	} else {
1121 		KASSERT((cmd == RTM_DELETE), ("unknown cmd %d", cmd));
1122 		rt_rtmsg(RTM_DELETE, rt, ifa->ifa_ifp, error);
1123 		rt_ifamsg(RTM_DELADDR, ifa);
1124 	}
1125 }
1126 
1127 /*
1128  * This is the analogue to the rt_newaddrmsg which performs the same
1129  * function but for multicast group memberhips.  This is easier since
1130  * there is no route state to worry about.
1131  */
1132 void
1133 rt_newmaddrmsg(int cmd, struct ifmultiaddr *ifma)
1134 {
1135 	struct rt_addrinfo rtinfo;
1136 	struct mbuf *m = NULL;
1137 	struct ifnet *ifp = ifma->ifma_ifp;
1138 	struct ifma_msghdr *ifmam;
1139 
1140 	if (route_cb.any_count == 0)
1141 		return;
1142 
1143 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1144 	rtinfo.rti_ifaaddr = ifma->ifma_addr;
1145 	if (ifp != NULL && !TAILQ_EMPTY(&ifp->if_addrheads[mycpuid])) {
1146 		rtinfo.rti_ifpaddr =
1147 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1148 	}
1149 	/*
1150 	 * If a link-layer address is present, present it as a ``gateway''
1151 	 * (similarly to how ARP entries, e.g., are presented).
1152 	 */
1153 	rtinfo.rti_gateway = ifma->ifma_lladdr;
1154 
1155 	m = rt_msg_mbuf(cmd, &rtinfo);
1156 	if (m == NULL)
1157 		return;
1158 
1159 	ifmam = mtod(m, struct ifma_msghdr *);
1160 	ifmam->ifmam_index = ifp->if_index;
1161 	ifmam->ifmam_addrs = rtinfo.rti_addrs;
1162 
1163 	rts_input(m, familyof(ifma->ifma_addr));
1164 }
1165 
1166 static struct mbuf *
1167 rt_makeifannouncemsg(struct ifnet *ifp, int type, int what,
1168 		     struct rt_addrinfo *info)
1169 {
1170 	struct if_announcemsghdr *ifan;
1171 	struct mbuf *m;
1172 
1173 	if (route_cb.any_count == 0)
1174 		return NULL;
1175 
1176 	bzero(info, sizeof(*info));
1177 	m = rt_msg_mbuf(type, info);
1178 	if (m == NULL)
1179 		return NULL;
1180 
1181 	ifan = mtod(m, struct if_announcemsghdr *);
1182 	ifan->ifan_index = ifp->if_index;
1183 	strlcpy(ifan->ifan_name, ifp->if_xname, sizeof ifan->ifan_name);
1184 	ifan->ifan_what = what;
1185 	return m;
1186 }
1187 
1188 /*
1189  * This is called to generate routing socket messages indicating
1190  * IEEE80211 wireless events.
1191  * XXX we piggyback on the RTM_IFANNOUNCE msg format in a clumsy way.
1192  */
1193 void
1194 rt_ieee80211msg(struct ifnet *ifp, int what, void *data, size_t data_len)
1195 {
1196 	struct rt_addrinfo info;
1197 	struct mbuf *m;
1198 
1199 	m = rt_makeifannouncemsg(ifp, RTM_IEEE80211, what, &info);
1200 	if (m == NULL)
1201 		return;
1202 
1203 	/*
1204 	 * Append the ieee80211 data.  Try to stick it in the
1205 	 * mbuf containing the ifannounce msg; otherwise allocate
1206 	 * a new mbuf and append.
1207 	 *
1208 	 * NB: we assume m is a single mbuf.
1209 	 */
1210 	if (data_len > M_TRAILINGSPACE(m)) {
1211 		/* XXX use m_getb(data_len, M_NOWAIT, MT_DATA, 0); */
1212 		struct mbuf *n = m_get(M_NOWAIT, MT_DATA);
1213 		if (n == NULL) {
1214 			m_freem(m);
1215 			return;
1216 		}
1217 		KKASSERT(data_len <= M_TRAILINGSPACE(n));
1218 		bcopy(data, mtod(n, void *), data_len);
1219 		n->m_len = data_len;
1220 		m->m_next = n;
1221 	} else if (data_len > 0) {
1222 		bcopy(data, mtod(m, u_int8_t *) + m->m_len, data_len);
1223 		m->m_len += data_len;
1224 	}
1225 	mbuftrackid(m, 33);
1226 	if (m->m_flags & M_PKTHDR)
1227 		m->m_pkthdr.len += data_len;
1228 	mtod(m, struct if_announcemsghdr *)->ifan_msglen += data_len;
1229 	rts_input(m, 0);
1230 }
1231 
1232 /*
1233  * This is called to generate routing socket messages indicating
1234  * network interface arrival and departure.
1235  */
1236 void
1237 rt_ifannouncemsg(struct ifnet *ifp, int what)
1238 {
1239 	struct rt_addrinfo addrinfo;
1240 	struct mbuf *m;
1241 
1242 	m = rt_makeifannouncemsg(ifp, RTM_IFANNOUNCE, what, &addrinfo);
1243 	if (m != NULL)
1244 		rts_input(m, 0);
1245 }
1246 
1247 static int
1248 resizewalkarg(struct walkarg *w, int len)
1249 {
1250 	void *newptr;
1251 
1252 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
1253 	if (newptr == NULL)
1254 		return (ENOMEM);
1255 	if (w->w_tmem != NULL)
1256 		kfree(w->w_tmem, M_RTABLE);
1257 	w->w_tmem = newptr;
1258 	w->w_tmemsize = len;
1259 	return (0);
1260 }
1261 
1262 static void
1263 ifnet_compute_stats(struct ifnet *ifp)
1264 {
1265 	IFNET_STAT_GET(ifp, ipackets, ifp->if_ipackets);
1266 	IFNET_STAT_GET(ifp, ierrors, ifp->if_ierrors);
1267 	IFNET_STAT_GET(ifp, opackets, ifp->if_opackets);
1268 	IFNET_STAT_GET(ifp, collisions, ifp->if_collisions);
1269 	IFNET_STAT_GET(ifp, ibytes, ifp->if_ibytes);
1270 	IFNET_STAT_GET(ifp, obytes, ifp->if_obytes);
1271 	IFNET_STAT_GET(ifp, imcasts, ifp->if_imcasts);
1272 	IFNET_STAT_GET(ifp, omcasts, ifp->if_omcasts);
1273 	IFNET_STAT_GET(ifp, iqdrops, ifp->if_iqdrops);
1274 	IFNET_STAT_GET(ifp, noproto, ifp->if_noproto);
1275 	IFNET_STAT_GET(ifp, oqdrops, ifp->if_oqdrops);
1276 }
1277 
1278 static int
1279 sysctl_iflist(int af, struct walkarg *w)
1280 {
1281 	struct ifnet *ifp;
1282 	struct rt_addrinfo rtinfo;
1283 	int msglen, error;
1284 
1285 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1286 
1287 	ifnet_lock();
1288 	TAILQ_FOREACH(ifp, &ifnetlist, if_link) {
1289 		struct ifaddr_container *ifac, *ifac_mark;
1290 		struct ifaddr_marker mark;
1291 		struct ifaddrhead *head;
1292 		struct ifaddr *ifa;
1293 
1294 		if (w->w_arg && w->w_arg != ifp->if_index)
1295 			continue;
1296 		head = &ifp->if_addrheads[mycpuid];
1297 		/*
1298 		 * There is no need to reference the first ifaddr
1299 		 * even if the following resizewalkarg() blocks,
1300 		 * since the first ifaddr will not be destroyed
1301 		 * when the ifnet lock is held.
1302 		 */
1303 		ifac = TAILQ_FIRST(head);
1304 		ifa = ifac->ifa;
1305 		rtinfo.rti_ifpaddr = ifa->ifa_addr;
1306 		msglen = rt_msgsize(RTM_IFINFO, &rtinfo);
1307 		if (w->w_tmemsize < msglen && resizewalkarg(w, msglen) != 0) {
1308 			ifnet_unlock();
1309 			return (ENOMEM);
1310 		}
1311 		rt_msg_buffer(RTM_IFINFO, &rtinfo, w->w_tmem, msglen);
1312 		rtinfo.rti_ifpaddr = NULL;
1313 		if (w->w_req != NULL && w->w_tmem != NULL) {
1314 			struct if_msghdr *ifm = w->w_tmem;
1315 
1316 			ifm->ifm_index = ifp->if_index;
1317 			ifm->ifm_flags = ifp->if_flags;
1318 			ifnet_compute_stats(ifp);
1319 			ifm->ifm_data = ifp->if_data;
1320 			ifm->ifm_addrs = rtinfo.rti_addrs;
1321 			error = SYSCTL_OUT(w->w_req, ifm, msglen);
1322 			if (error) {
1323 				ifnet_unlock();
1324 				return (error);
1325 			}
1326 		}
1327 		/*
1328 		 * Add a marker, since SYSCTL_OUT() could block and during
1329 		 * that period the list could be changed.
1330 		 */
1331 		ifa_marker_init(&mark, ifp);
1332 		ifac_mark = &mark.ifac;
1333 		TAILQ_INSERT_AFTER(head, ifac, ifac_mark, ifa_link);
1334 		while ((ifac = TAILQ_NEXT(ifac_mark, ifa_link)) != NULL) {
1335 			TAILQ_REMOVE(head, ifac_mark, ifa_link);
1336 			TAILQ_INSERT_AFTER(head, ifac, ifac_mark, ifa_link);
1337 
1338 			ifa = ifac->ifa;
1339 
1340 			/* Ignore marker */
1341 			if (ifa->ifa_addr->sa_family == AF_UNSPEC)
1342 				continue;
1343 
1344 			if (af && af != ifa->ifa_addr->sa_family)
1345 				continue;
1346 			if (curproc->p_ucred->cr_prison &&
1347 			    prison_if(curproc->p_ucred, ifa->ifa_addr))
1348 				continue;
1349 			rtinfo.rti_ifaaddr = ifa->ifa_addr;
1350 			rtinfo.rti_netmask = ifa->ifa_netmask;
1351 			rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1352 			msglen = rt_msgsize(RTM_NEWADDR, &rtinfo);
1353 			/*
1354 			 * Keep a reference on this ifaddr, so that it will
1355 			 * not be destroyed if the following resizewalkarg()
1356 			 * blocks.
1357 			 */
1358 			IFAREF(ifa);
1359 			if (w->w_tmemsize < msglen &&
1360 			    resizewalkarg(w, msglen) != 0) {
1361 				IFAFREE(ifa);
1362 				TAILQ_REMOVE(head, ifac_mark, ifa_link);
1363 				ifnet_unlock();
1364 				return (ENOMEM);
1365 			}
1366 			rt_msg_buffer(RTM_NEWADDR, &rtinfo, w->w_tmem, msglen);
1367 			if (w->w_req != NULL) {
1368 				struct ifa_msghdr *ifam = w->w_tmem;
1369 
1370 				ifam->ifam_index = ifa->ifa_ifp->if_index;
1371 				ifam->ifam_flags = ifa->ifa_flags;
1372 				ifam->ifam_metric = ifa->ifa_metric;
1373 				ifam->ifam_addrs = rtinfo.rti_addrs;
1374 				error = SYSCTL_OUT(w->w_req, w->w_tmem, msglen);
1375 				if (error) {
1376 					IFAFREE(ifa);
1377 					TAILQ_REMOVE(head, ifac_mark, ifa_link);
1378 					ifnet_unlock();
1379 					return (error);
1380 				}
1381 			}
1382 			IFAFREE(ifa);
1383 		}
1384 		TAILQ_REMOVE(head, ifac_mark, ifa_link);
1385 		rtinfo.rti_netmask = NULL;
1386 		rtinfo.rti_ifaaddr = NULL;
1387 		rtinfo.rti_bcastaddr = NULL;
1388 	}
1389 	ifnet_unlock();
1390 	return (0);
1391 }
1392 
1393 static int
1394 rttable_walkarg_create(struct rttable_walkarg *w, int op, int arg)
1395 {
1396 	struct rt_addrinfo rtinfo;
1397 	struct sockaddr_storage ss;
1398 	int i, msglen;
1399 
1400 	memset(w, 0, sizeof(*w));
1401 	w->w_op = op;
1402 	w->w_arg = arg;
1403 
1404 	memset(&ss, 0, sizeof(ss));
1405 	ss.ss_len = sizeof(ss);
1406 
1407 	memset(&rtinfo, 0, sizeof(rtinfo));
1408 	for (i = 0; i < RTAX_MAX; ++i)
1409 		rtinfo.rti_info[i] = (struct sockaddr *)&ss;
1410 	msglen = rt_msgsize(RTM_GET, &rtinfo);
1411 
1412 	w->w_bufsz = msglen * RTTABLE_DUMP_MSGCNT_MAX;
1413 	w->w_buf = kmalloc(w->w_bufsz, M_TEMP, M_WAITOK | M_NULLOK);
1414 	if (w->w_buf == NULL)
1415 		return ENOMEM;
1416 	return 0;
1417 }
1418 
1419 static void
1420 rttable_walkarg_destroy(struct rttable_walkarg *w)
1421 {
1422 	kfree(w->w_buf, M_TEMP);
1423 }
1424 
1425 static void
1426 rttable_entry_rtinfo(struct rt_addrinfo *rtinfo, struct radix_node *rn)
1427 {
1428 	struct rtentry *rt = (struct rtentry *)rn;
1429 
1430 	bzero(rtinfo, sizeof(*rtinfo));
1431 	rtinfo->rti_dst = rt_key(rt);
1432 	rtinfo->rti_gateway = rt->rt_gateway;
1433 	rtinfo->rti_netmask = rt_mask(rt);
1434 	rtinfo->rti_genmask = rt->rt_genmask;
1435 	if (rt->rt_ifp != NULL) {
1436 		rtinfo->rti_ifpaddr =
1437 		TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1438 		rtinfo->rti_ifaaddr = rt->rt_ifa->ifa_addr;
1439 		if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
1440 			rtinfo->rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
1441 	}
1442 }
1443 
1444 static int
1445 rttable_walk_entry(struct radix_node *rn, void *xw)
1446 {
1447 	struct rttable_walkarg *w = xw;
1448 	struct rtentry *rt = (struct rtentry *)rn;
1449 	struct rt_addrinfo rtinfo;
1450 	struct rt_msghdr *rtm;
1451 	boolean_t save = FALSE;
1452 	int msglen, w_bufleft;
1453 	void *ptr;
1454 
1455 	rttable_entry_rtinfo(&rtinfo, rn);
1456 	msglen = rt_msgsize(RTM_GET, &rtinfo);
1457 
1458 	w_bufleft = w->w_bufsz - w->w_buflen;
1459 
1460 	if (rn->rn_dupedkey != NULL) {
1461 		struct radix_node *rn1 = rn;
1462 		int total_msglen = msglen;
1463 
1464 		/*
1465 		 * Make sure that we have enough space left for all
1466 		 * dupedkeys, since rn_walktree_at always starts
1467 		 * from the first dupedkey.
1468 		 */
1469 		while ((rn1 = rn1->rn_dupedkey) != NULL) {
1470 			struct rt_addrinfo rtinfo1;
1471 			int msglen1;
1472 
1473 			if (rn1->rn_flags & RNF_ROOT)
1474 				continue;
1475 
1476 			rttable_entry_rtinfo(&rtinfo1, rn1);
1477 			msglen1 = rt_msgsize(RTM_GET, &rtinfo1);
1478 			total_msglen += msglen1;
1479 		}
1480 
1481 		if (total_msglen > w_bufleft) {
1482 			if (total_msglen > w->w_bufsz) {
1483 				static int logged = 0;
1484 
1485 				if (!logged) {
1486 					kprintf("buffer is too small for "
1487 					    "all dupedkeys, increase "
1488 					    "RTTABLE_DUMP_MSGCNT_MAX\n");
1489 					logged = 1;
1490 				}
1491 				return ENOMEM;
1492 			}
1493 			save = TRUE;
1494 		}
1495 	} else if (msglen > w_bufleft) {
1496 		save = TRUE;
1497 	}
1498 
1499 	if (save) {
1500 		/*
1501 		 * Not enough buffer left; remember the position
1502 		 * to start from upon next round.
1503 		 */
1504 		KASSERT(msglen <= w->w_bufsz, ("msg too long %d", msglen));
1505 
1506 		KASSERT(rtinfo.rti_dst->sa_len <= sizeof(w->w_key0),
1507 		    ("key too long %d", rtinfo.rti_dst->sa_len));
1508 		memset(&w->w_key0, 0, sizeof(w->w_key0));
1509 		memcpy(&w->w_key0, rtinfo.rti_dst, rtinfo.rti_dst->sa_len);
1510 		w->w_key = (const char *)&w->w_key0;
1511 
1512 		if (rtinfo.rti_netmask != NULL) {
1513 			KASSERT(
1514 			    rtinfo.rti_netmask->sa_len <= sizeof(w->w_mask0),
1515 			    ("mask too long %d", rtinfo.rti_netmask->sa_len));
1516 			memset(&w->w_mask0, 0, sizeof(w->w_mask0));
1517 			memcpy(&w->w_mask0, rtinfo.rti_netmask,
1518 			    rtinfo.rti_netmask->sa_len);
1519 			w->w_mask = (const char *)&w->w_mask0;
1520 		} else {
1521 			w->w_mask = NULL;
1522 		}
1523 		return EJUSTRETURN;
1524 	}
1525 
1526 	if (w->w_op == NET_RT_FLAGS && !(rt->rt_flags & w->w_arg))
1527 		return 0;
1528 
1529 	ptr = ((uint8_t *)w->w_buf) + w->w_buflen;
1530 	rt_msg_buffer(RTM_GET, &rtinfo, ptr, msglen);
1531 
1532 	rtm = (struct rt_msghdr *)ptr;
1533 	rtm->rtm_flags = rt->rt_flags;
1534 	rtm->rtm_use = rt->rt_use;
1535 	rtm->rtm_rmx = rt->rt_rmx;
1536 	rtm->rtm_index = rt->rt_ifp->if_index;
1537 	rtm->rtm_errno = rtm->rtm_pid = rtm->rtm_seq = 0;
1538 	rtm->rtm_addrs = rtinfo.rti_addrs;
1539 
1540 	w->w_buflen += msglen;
1541 
1542 	return 0;
1543 }
1544 
1545 static void
1546 rttable_walk_dispatch(netmsg_t msg)
1547 {
1548 	struct netmsg_rttable_walk *nmsg = (struct netmsg_rttable_walk *)msg;
1549 	struct radix_node_head *rnh = rt_tables[mycpuid][nmsg->af];
1550 	struct rttable_walkarg *w = nmsg->w;
1551 	int error;
1552 
1553 	error = rnh->rnh_walktree_at(rnh, w->w_key, w->w_mask,
1554 	    rttable_walk_entry, w);
1555 	lwkt_replymsg(&nmsg->base.lmsg, error);
1556 }
1557 
1558 static int
1559 sysctl_rttable(int af, struct sysctl_req *req, int op, int arg)
1560 {
1561 	struct rttable_walkarg w;
1562 	int error, i;
1563 
1564 	error = rttable_walkarg_create(&w, op, arg);
1565 	if (error)
1566 		return error;
1567 
1568 	error = EINVAL;
1569 	for (i = 1; i <= AF_MAX; i++) {
1570 		if (rt_tables[mycpuid][i] != NULL && (af == 0 || af == i)) {
1571 			w.w_key = NULL;
1572 			w.w_mask = NULL;
1573 			for (;;) {
1574 				struct netmsg_rttable_walk nmsg;
1575 
1576 				netmsg_init(&nmsg.base, NULL,
1577 				    &curthread->td_msgport, 0,
1578 				    rttable_walk_dispatch);
1579 				nmsg.af = i;
1580 				nmsg.w = &w;
1581 
1582 				w.w_buflen = 0;
1583 
1584 				error = lwkt_domsg(netisr_cpuport(mycpuid),
1585 				    &nmsg.base.lmsg, 0);
1586 				if (error && error != EJUSTRETURN)
1587 					goto done;
1588 
1589 				if (req != NULL && w.w_buflen > 0) {
1590 					int error1;
1591 
1592 					error1 = SYSCTL_OUT(req, w.w_buf,
1593 					    w.w_buflen);
1594 					if (error1) {
1595 						error = error1;
1596 						goto done;
1597 					}
1598 				}
1599 				if (error == 0) /* done */
1600 					break;
1601 			}
1602 		}
1603 	}
1604 done:
1605 	rttable_walkarg_destroy(&w);
1606 	return error;
1607 }
1608 
1609 static int
1610 sysctl_rtsock(SYSCTL_HANDLER_ARGS)
1611 {
1612 	int	*name = (int *)arg1;
1613 	u_int	namelen = arg2;
1614 	int	error = EINVAL;
1615 	int	origcpu, cpu;
1616 	u_char  af;
1617 	struct	walkarg w;
1618 
1619 	name ++;
1620 	namelen--;
1621 	if (req->newptr)
1622 		return (EPERM);
1623 	if (namelen != 3 && namelen != 4)
1624 		return (EINVAL);
1625 	af = name[0];
1626 	bzero(&w, sizeof w);
1627 	w.w_op = name[1];
1628 	w.w_arg = name[2];
1629 	w.w_req = req;
1630 
1631 	/*
1632 	 * Optional third argument specifies cpu, used primarily for
1633 	 * debugging the route table.
1634 	 */
1635 	if (namelen == 4) {
1636 		if (name[3] < 0 || name[3] >= ncpus)
1637 			return (EINVAL);
1638 		cpu = name[3];
1639 	} else {
1640 		/*
1641 		 * Target cpu is not specified, use cpu0 then, so that
1642 		 * the result set will be relatively stable.
1643 		 */
1644 		cpu = 0;
1645 	}
1646 	origcpu = mycpuid;
1647 	lwkt_migratecpu(cpu);
1648 
1649 	switch (w.w_op) {
1650 	case NET_RT_DUMP:
1651 	case NET_RT_FLAGS:
1652 		error = sysctl_rttable(af, w.w_req, w.w_op, w.w_arg);
1653 		break;
1654 
1655 	case NET_RT_IFLIST:
1656 		error = sysctl_iflist(af, &w);
1657 		break;
1658 	}
1659 	if (w.w_tmem != NULL)
1660 		kfree(w.w_tmem, M_RTABLE);
1661 
1662 	lwkt_migratecpu(origcpu);
1663 	return (error);
1664 }
1665 
1666 SYSCTL_NODE(_net, PF_ROUTE, routetable, CTLFLAG_RD, sysctl_rtsock, "");
1667 
1668 /*
1669  * Definitions of protocols supported in the ROUTE domain.
1670  */
1671 
1672 static struct domain routedomain;		/* or at least forward */
1673 
1674 static struct protosw routesw[] = {
1675     {
1676 	.pr_type = SOCK_RAW,
1677 	.pr_domain = &routedomain,
1678 	.pr_protocol = 0,
1679 	.pr_flags = PR_ATOMIC|PR_ADDR,
1680 	.pr_input = NULL,
1681 	.pr_output = route_output,
1682 	.pr_ctlinput = raw_ctlinput,
1683 	.pr_ctloutput = NULL,
1684 	.pr_ctlport = cpu0_ctlport,
1685 
1686 	.pr_init = raw_init,
1687 	.pr_usrreqs = &route_usrreqs
1688     }
1689 };
1690 
1691 static struct domain routedomain = {
1692 	PF_ROUTE, "route", NULL, NULL, NULL,
1693 	routesw, &routesw[(sizeof routesw)/(sizeof routesw[0])],
1694 };
1695 
1696 DOMAIN_SET(route);
1697 
1698