xref: /dragonfly/sys/net/rtsock.c (revision 03517d4e)
1 /*
2  * Copyright (c) 2004, 2005 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Jeffrey M. Hsu.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of The DragonFly Project nor the names of its
16  *    contributors may be used to endorse or promote products derived
17  *    from this software without specific, prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
27  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
29  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1988, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)rtsock.c	8.7 (Berkeley) 10/12/95
62  * $FreeBSD: src/sys/net/rtsock.c,v 1.44.2.11 2002/12/04 14:05:41 ru Exp $
63  */
64 
65 #include "opt_inet6.h"
66 
67 #include <sys/param.h>
68 #include <sys/systm.h>
69 #include <sys/kernel.h>
70 #include <sys/sysctl.h>
71 #include <sys/proc.h>
72 #include <sys/caps.h>
73 #include <sys/malloc.h>
74 #include <sys/mbuf.h>
75 #include <sys/protosw.h>
76 #include <sys/socket.h>
77 #include <sys/socketvar.h>
78 #include <sys/domain.h>
79 #include <sys/jail.h>
80 
81 #include <sys/thread2.h>
82 #include <sys/socketvar2.h>
83 
84 #include <net/if.h>
85 #include <net/if_var.h>
86 #include <net/route.h>
87 #include <net/raw_cb.h>
88 #include <net/netmsg2.h>
89 #include <net/netisr2.h>
90 
91 #ifdef INET6
92 #include <netinet/in_var.h>
93 #endif
94 
95 /* sa_family is after sa_len, rest is data */
96 #define	_SA_MINSIZE	(offsetof(struct sockaddr, sa_family) + \
97 			 sizeof(((struct sockaddr *)0)->sa_family))
98 
99 MALLOC_DEFINE(M_RTABLE, "routetbl", "routing tables");
100 
101 static struct route_cb {
102 	int	ip_count;
103 	int	ip6_count;
104 	int	any_count;
105 } route_cb;
106 
107 static const struct sockaddr route_src = { 2, PF_ROUTE, };
108 
109 struct walkarg {
110 	int	w_tmemsize;
111 	int	w_op, w_arg;
112 	void	*w_tmem;
113 	struct sysctl_req *w_req;
114 };
115 
116 #ifndef RTTABLE_DUMP_MSGCNT_MAX
117 /* Should be large enough for dupkeys */
118 #define RTTABLE_DUMP_MSGCNT_MAX		64
119 #endif
120 
121 struct rttable_walkarg {
122 	int	w_op;
123 	int	w_arg;
124 	int	w_bufsz;
125 	void	*w_buf;
126 
127 	int	w_buflen;
128 
129 	const char *w_key;
130 	const char *w_mask;
131 
132 	struct sockaddr_storage w_key0;
133 	struct sockaddr_storage w_mask0;
134 };
135 
136 struct netmsg_rttable_walk {
137 	struct netmsg_base	base;
138 	int			af;
139 	struct rttable_walkarg	*w;
140 };
141 
142 struct routecb {
143 	struct rawcb	rocb_rcb;
144 	unsigned int	rocb_msgfilter;
145 	char		*rocb_missfilter;
146 	size_t		rocb_missfilterlen;
147 };
148 #define	sotoroutecb(so)	((struct routecb *)(so)->so_pcb)
149 
150 static struct mbuf *
151 		rt_msg_mbuf (int, struct rt_addrinfo *);
152 static void	rt_msg_buffer (int, struct rt_addrinfo *, void *buf, int len);
153 static int	rt_msgsize(int type, const struct rt_addrinfo *rtinfo);
154 static int	rt_xaddrs (char *, char *, struct rt_addrinfo *);
155 static int	sysctl_rttable(int af, struct sysctl_req *req, int op, int arg);
156 static int	if_addrflags(const struct ifaddr *ifa);
157 static int	sysctl_iflist (int af, struct walkarg *w);
158 static int	route_output(struct mbuf *, struct socket *, ...);
159 static void	rt_setmetrics (u_long, struct rt_metrics *,
160 			       struct rt_metrics *);
161 
162 /*
163  * It really doesn't make any sense at all for this code to share much
164  * with raw_usrreq.c, since its functionality is so restricted.  XXX
165  */
166 static void
167 rts_abort(netmsg_t msg)
168 {
169 	crit_enter();
170 	raw_usrreqs.pru_abort(msg);
171 	/* msg invalid now */
172 	crit_exit();
173 }
174 
175 static int
176 rts_filter(struct mbuf *m, const struct sockproto *proto,
177 	const struct rawcb *rp)
178 {
179 	const struct routecb *rop = (const struct routecb *)rp;
180 	const struct rt_msghdr *rtm;
181 
182 	KKASSERT(m != NULL);
183 	KKASSERT(proto != NULL);
184 	KKASSERT(rp != NULL);
185 
186 	/* Wrong family for this socket. */
187 	if (proto->sp_family != PF_ROUTE)
188 		return ENOPROTOOPT;
189 
190 	/* If no filter set, just return. */
191 	if (rop->rocb_msgfilter == 0 && rop->rocb_missfilterlen == 0)
192 		return 0;
193 
194 	/* Ensure we can access rtm_type */
195 	if (m->m_len <
196 	    offsetof(struct rt_msghdr, rtm_type) + sizeof(rtm->rtm_type))
197 		return EINVAL;
198 
199 	rtm = mtod(m, const struct rt_msghdr *);
200 	/* If the rtm type is filtered out, return a positive. */
201 	if (rop->rocb_msgfilter != 0 &&
202 	    !(rop->rocb_msgfilter & ROUTE_FILTER(rtm->rtm_type)))
203 		return EEXIST;
204 
205 	if (rop->rocb_missfilterlen != 0 && rtm->rtm_type == RTM_MISS) {
206 		CTASSERT(RTAX_DST == 0);
207 		struct sockaddr *sa;
208 		struct sockaddr_storage ss;
209 		struct sockaddr *dst = (struct sockaddr *)&ss;
210 		char *cp = rop->rocb_missfilter;
211 		char *ep = cp + rop->rocb_missfilterlen;
212 
213 		/* Ensure we can access sa_len */
214 		if (m->m_pkthdr.len < sizeof(*rtm) + _SA_MINSIZE)
215 			return EINVAL;
216 		m_copydata(m, sizeof(*rtm) + offsetof(struct sockaddr, sa_len),
217 		    sizeof(ss.ss_len), &ss);
218 		if (ss.ss_len < _SA_MINSIZE ||
219 		    ss.ss_len > sizeof(ss) ||
220 		    m->m_pkthdr.len < sizeof(*rtm) + ss.ss_len)
221 			return EINVAL;
222 		/* Copy out the destination sockaddr */
223 		m_copydata(m, sizeof(*rtm), ss.ss_len, &ss);
224 
225 		/* Find a matching sockaddr in the filter */
226 		while (cp < ep) {
227 			sa = (struct sockaddr *)cp;
228 			if (sa->sa_len == dst->sa_len &&
229 			    memcmp(sa, dst, sa->sa_len) == 0)
230 				break;
231 			cp += RT_ROUNDUP(sa->sa_len);
232 		}
233 		if (cp == ep)
234 			return EEXIST;
235 	}
236 
237 	/* Passed the filter. */
238 	return 0;
239 }
240 
241 
242 /* pru_accept is EOPNOTSUPP */
243 
244 static void
245 rts_attach(netmsg_t msg)
246 {
247 	struct socket *so = msg->base.nm_so;
248 	struct pru_attach_info *ai = msg->attach.nm_ai;
249 	struct rawcb *rp;
250 	struct routecb *rop;
251 	int proto = msg->attach.nm_proto;
252 	int error;
253 
254 	crit_enter();
255 	if (sotorawcb(so) != NULL) {
256 		error = EISCONN;
257 		goto done;
258 	}
259 
260 	rop = kmalloc(sizeof *rop, M_PCB, M_WAITOK | M_ZERO);
261 	rp = &rop->rocb_rcb;
262 
263 	/*
264 	 * The critical section is necessary to block protocols from sending
265 	 * error notifications (like RTM_REDIRECT or RTM_LOSING) while
266 	 * this PCB is extant but incompletely initialized.
267 	 * Probably we should try to do more of this work beforehand and
268 	 * eliminate the critical section.
269 	 */
270 	so->so_pcb = rp;
271 	soreference(so);	/* so_pcb assignment */
272 	error = raw_attach(so, proto, ai->sb_rlimit);
273 	rp = sotorawcb(so);
274 	if (error) {
275 		kfree(rop, M_PCB);
276 		goto done;
277 	}
278 	switch(rp->rcb_proto.sp_protocol) {
279 	case AF_INET:
280 		route_cb.ip_count++;
281 		break;
282 	case AF_INET6:
283 		route_cb.ip6_count++;
284 		break;
285 	}
286 	rp->rcb_faddr = &route_src;
287 	rp->rcb_filter = rts_filter;
288 	route_cb.any_count++;
289 	soisconnected(so);
290 	so->so_options |= SO_USELOOPBACK;
291 	error = 0;
292 done:
293 	crit_exit();
294 	lwkt_replymsg(&msg->lmsg, error);
295 }
296 
297 static void
298 rts_bind(netmsg_t msg)
299 {
300 	crit_enter();
301 	raw_usrreqs.pru_bind(msg); /* xxx just EINVAL */
302 	/* msg invalid now */
303 	crit_exit();
304 }
305 
306 static void
307 rts_connect(netmsg_t msg)
308 {
309 	crit_enter();
310 	raw_usrreqs.pru_connect(msg); /* XXX just EINVAL */
311 	/* msg invalid now */
312 	crit_exit();
313 }
314 
315 /* pru_connect2 is EOPNOTSUPP */
316 /* pru_control is EOPNOTSUPP */
317 
318 static void
319 rts_detach(netmsg_t msg)
320 {
321 	struct socket *so = msg->base.nm_so;
322 	struct rawcb *rp = sotorawcb(so);
323 	struct routecb *rop = (struct routecb *)rp;
324 
325 	crit_enter();
326 	if (rop->rocb_missfilterlen != 0)
327 		kfree(rop->rocb_missfilter, M_PCB);
328 	if (rp != NULL) {
329 		switch(rp->rcb_proto.sp_protocol) {
330 		case AF_INET:
331 			route_cb.ip_count--;
332 			break;
333 		case AF_INET6:
334 			route_cb.ip6_count--;
335 			break;
336 		}
337 		route_cb.any_count--;
338 	}
339 	raw_usrreqs.pru_detach(msg);
340 	/* msg invalid now */
341 	crit_exit();
342 }
343 
344 static void
345 rts_disconnect(netmsg_t msg)
346 {
347 	crit_enter();
348 	raw_usrreqs.pru_disconnect(msg);
349 	/* msg invalid now */
350 	crit_exit();
351 }
352 
353 /* pru_listen is EOPNOTSUPP */
354 
355 static void
356 rts_peeraddr(netmsg_t msg)
357 {
358 	crit_enter();
359 	raw_usrreqs.pru_peeraddr(msg);
360 	/* msg invalid now */
361 	crit_exit();
362 }
363 
364 /* pru_rcvd is EOPNOTSUPP */
365 /* pru_rcvoob is EOPNOTSUPP */
366 
367 static void
368 rts_send(netmsg_t msg)
369 {
370 	crit_enter();
371 	raw_usrreqs.pru_send(msg);
372 	/* msg invalid now */
373 	crit_exit();
374 }
375 
376 /* pru_sense is null */
377 
378 static void
379 rts_shutdown(netmsg_t msg)
380 {
381 	crit_enter();
382 	raw_usrreqs.pru_shutdown(msg);
383 	/* msg invalid now */
384 	crit_exit();
385 }
386 
387 static void
388 rts_sockaddr(netmsg_t msg)
389 {
390 	crit_enter();
391 	raw_usrreqs.pru_sockaddr(msg);
392 	/* msg invalid now */
393 	crit_exit();
394 }
395 
396 static struct pr_usrreqs route_usrreqs = {
397 	.pru_abort = rts_abort,
398 	.pru_accept = pr_generic_notsupp,
399 	.pru_attach = rts_attach,
400 	.pru_bind = rts_bind,
401 	.pru_connect = rts_connect,
402 	.pru_connect2 = pr_generic_notsupp,
403 	.pru_control = pr_generic_notsupp,
404 	.pru_detach = rts_detach,
405 	.pru_disconnect = rts_disconnect,
406 	.pru_listen = pr_generic_notsupp,
407 	.pru_peeraddr = rts_peeraddr,
408 	.pru_rcvd = pr_generic_notsupp,
409 	.pru_rcvoob = pr_generic_notsupp,
410 	.pru_send = rts_send,
411 	.pru_sense = pru_sense_null,
412 	.pru_shutdown = rts_shutdown,
413 	.pru_sockaddr = rts_sockaddr,
414 	.pru_sosend = sosend,
415 	.pru_soreceive = soreceive
416 };
417 
418 static __inline sa_family_t
419 familyof(struct sockaddr *sa)
420 {
421 	return (sa != NULL ? sa->sa_family : 0);
422 }
423 
424 /*
425  * Routing socket input function.  The packet must be serialized onto cpu 0.
426  * We use the cpu0_soport() netisr processing loop to handle it.
427  *
428  * This looks messy but it means that anyone, including interrupt code,
429  * can send a message to the routing socket.
430  */
431 static void
432 rts_input_handler(netmsg_t msg)
433 {
434 	static const struct sockaddr route_dst = { 2, PF_ROUTE, };
435 	struct sockproto route_proto;
436 	struct netmsg_packet *pmsg = &msg->packet;
437 	struct mbuf *m;
438 	sa_family_t family;
439 	struct rawcb *skip;
440 
441 	family = pmsg->base.lmsg.u.ms_result;
442 	route_proto.sp_family = PF_ROUTE;
443 	route_proto.sp_protocol = family;
444 
445 	m = pmsg->nm_packet;
446 	M_ASSERTPKTHDR(m);
447 
448 	skip = m->m_pkthdr.header;
449 	m->m_pkthdr.header = NULL;
450 
451 	raw_input(m, &route_proto, &route_src, &route_dst, skip);
452 }
453 
454 static void
455 rts_input_skip(struct mbuf *m, sa_family_t family, struct rawcb *skip)
456 {
457 	struct netmsg_packet *pmsg;
458 	lwkt_port_t port;
459 
460 	M_ASSERTPKTHDR(m);
461 
462 	port = netisr_cpuport(0);	/* XXX same as for routing socket */
463 	pmsg = &m->m_hdr.mh_netmsg;
464 	netmsg_init(&pmsg->base, NULL, &netisr_apanic_rport,
465 		    0, rts_input_handler);
466 	pmsg->nm_packet = m;
467 	pmsg->base.lmsg.u.ms_result = family;
468 	m->m_pkthdr.header = skip; /* XXX steal field in pkthdr */
469 	lwkt_sendmsg(port, &pmsg->base.lmsg);
470 }
471 
472 static __inline void
473 rts_input(struct mbuf *m, sa_family_t family)
474 {
475 	rts_input_skip(m, family, NULL);
476 }
477 
478 static void
479 route_ctloutput(netmsg_t msg)
480 {
481 	struct socket *so = msg->ctloutput.base.nm_so;
482 	struct sockopt *sopt = msg->ctloutput.nm_sopt;
483 	struct routecb *rop = sotoroutecb(so);
484 	int error;
485 	unsigned int msgfilter;
486 	unsigned char *cp, *ep;
487 	size_t len;
488 	struct sockaddr *sa;
489 
490 	if (sopt->sopt_level != AF_ROUTE) {
491 		error = EINVAL;
492 		goto out;
493 	}
494 
495 	error = 0;
496 
497 	switch (sopt->sopt_dir) {
498 	case SOPT_SET:
499 		switch (sopt->sopt_name) {
500 		case ROUTE_MSGFILTER:
501 			error = soopt_to_kbuf(sopt, &msgfilter,
502 			    sizeof(msgfilter), sizeof(msgfilter));
503 			if (error == 0)
504 				rop->rocb_msgfilter = msgfilter;
505 			break;
506 		case RO_MISSFILTER:
507 			/* Validate the data */
508 			len = 0;
509 			cp = sopt->sopt_val;
510 			ep = cp + sopt->sopt_valsize;
511 			while (cp < ep) {
512 				if (ep - cp <
513 				    offsetof(struct sockaddr, sa_len) +
514 				    sizeof(sa->sa_len))
515 					break;
516 				if (++len > RO_FILTSA_MAX) {
517 					error = ENOBUFS;
518 					break;
519 				}
520 				sa = (struct sockaddr *)cp;
521 				if (sa->sa_len < _SA_MINSIZE ||
522 				    sa->sa_len > sizeof(struct sockaddr_storage))
523 					break;
524 				cp += RT_ROUNDUP(sa->sa_len);
525 			}
526 			if (cp != ep) {
527 				if (error == 0)
528 					error = EINVAL;
529 				break;
530 			}
531 			if (rop->rocb_missfilterlen != 0)
532 				kfree(rop->rocb_missfilter, M_PCB);
533 			if (sopt->sopt_valsize != 0) {
534 				rop->rocb_missfilter =
535 				    kmalloc(sopt->sopt_valsize,
536 				            M_PCB, M_WAITOK | M_NULLOK);
537 				if (rop->rocb_missfilter == NULL) {
538 					rop->rocb_missfilterlen = 0;
539 					error = ENOBUFS;
540 					break;
541 				}
542 			} else
543 				rop->rocb_missfilter = NULL;
544 			rop->rocb_missfilterlen = sopt->sopt_valsize;
545 			if (rop->rocb_missfilterlen != 0)
546 				memcpy(rop->rocb_missfilter, sopt->sopt_val,
547 				    rop->rocb_missfilterlen);
548 			break;
549 		default:
550 			error = ENOPROTOOPT;
551 			break;
552 		}
553 		break;
554 	case SOPT_GET:
555 		switch (sopt->sopt_name) {
556 		case ROUTE_MSGFILTER:
557 			msgfilter = rop->rocb_msgfilter;
558 			soopt_from_kbuf(sopt, &msgfilter, sizeof(msgfilter));
559 			break;
560 		case RO_MISSFILTER:
561 			soopt_from_kbuf(sopt, rop->rocb_missfilter,
562 			    rop->rocb_missfilterlen);
563 			break;
564 		default:
565 			error = ENOPROTOOPT;
566 			break;
567 		}
568 	}
569 out:
570 	lwkt_replymsg(&msg->ctloutput.base.lmsg, error);
571 }
572 
573 
574 
575 static void *
576 reallocbuf_nofree(void *ptr, size_t len, size_t olen)
577 {
578 	void *newptr;
579 
580 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
581 	if (newptr == NULL)
582 		return NULL;
583 	bcopy(ptr, newptr, olen);
584 	if (olen < len)
585 		bzero((char *)newptr + olen, len - olen);
586 
587 	return (newptr);
588 }
589 
590 /*
591  * Internal helper routine for route_output().
592  */
593 static int
594 _fillrtmsg(struct rt_msghdr **prtm, struct rtentry *rt,
595 	   struct rt_addrinfo *rtinfo)
596 {
597 	int msglen;
598 	struct rt_msghdr *rtm = *prtm;
599 
600 	/* Fill in rt_addrinfo for call to rt_msg_buffer(). */
601 	rtinfo->rti_dst = rt_key(rt);
602 	rtinfo->rti_gateway = rt->rt_gateway;
603 	rtinfo->rti_netmask = rt_mask(rt);		/* might be NULL */
604 	rtinfo->rti_genmask = rt->rt_genmask;		/* might be NULL */
605 	if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
606 		if (rt->rt_ifp != NULL) {
607 			rtinfo->rti_ifpaddr =
608 			    TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])
609 			    ->ifa->ifa_addr;
610 			rtinfo->rti_ifaaddr = rt->rt_ifa->ifa_addr;
611 			if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
612 				rtinfo->rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
613 			rtm->rtm_index = rt->rt_ifp->if_index;
614 		} else {
615 			rtinfo->rti_ifpaddr = NULL;
616 			rtinfo->rti_ifaaddr = NULL;
617 		}
618 	} else if (rt->rt_ifp != NULL) {
619 		rtm->rtm_index = rt->rt_ifp->if_index;
620 	}
621 
622 	msglen = rt_msgsize(rtm->rtm_type, rtinfo);
623 	if (rtm->rtm_msglen < msglen) {
624 		/* NOTE: Caller will free the old rtm accordingly */
625 		rtm = reallocbuf_nofree(rtm, msglen, rtm->rtm_msglen);
626 		if (rtm == NULL)
627 			return (ENOBUFS);
628 		*prtm = rtm;
629 	}
630 	rt_msg_buffer(rtm->rtm_type, rtinfo, rtm, msglen);
631 
632 	rtm->rtm_flags = rt->rt_flags;
633 	rtm->rtm_rmx = rt->rt_rmx;
634 	rtm->rtm_addrs = rtinfo->rti_addrs;
635 
636 	return (0);
637 }
638 
639 struct rtm_arg {
640 	struct rt_msghdr	*bak_rtm;
641 	struct rt_msghdr	*new_rtm;
642 };
643 
644 static int
645 fillrtmsg(struct rtm_arg *arg, struct rtentry *rt,
646 	  struct rt_addrinfo *rtinfo)
647 {
648 	struct rt_msghdr *rtm = arg->new_rtm;
649 	int error;
650 
651 	error = _fillrtmsg(&rtm, rt, rtinfo);
652 	if (!error) {
653 		if (arg->new_rtm != rtm) {
654 			/*
655 			 * _fillrtmsg() just allocated a new rtm;
656 			 * if the previously allocated rtm is not
657 			 * the backing rtm, it should be freed.
658 			 */
659 			if (arg->new_rtm != arg->bak_rtm)
660 				kfree(arg->new_rtm, M_RTABLE);
661 			arg->new_rtm = rtm;
662 		}
663 	}
664 	return error;
665 }
666 
667 static void route_output_add_callback(int, int, struct rt_addrinfo *,
668 					struct rtentry *, void *);
669 static void route_output_delete_callback(int, int, struct rt_addrinfo *,
670 					struct rtentry *, void *);
671 static int route_output_get_callback(int, struct rt_addrinfo *,
672 				     struct rtentry *, void *, int);
673 static int route_output_change_callback(int, struct rt_addrinfo *,
674 					struct rtentry *, void *, int);
675 static int route_output_lock_callback(int, struct rt_addrinfo *,
676 				      struct rtentry *, void *, int);
677 
678 /*ARGSUSED*/
679 static int
680 route_output(struct mbuf *m, struct socket *so, ...)
681 {
682 	struct rtm_arg arg;
683 	struct rt_msghdr *rtm = NULL;
684 	struct rawcb *rp = NULL;
685 	struct pr_output_info *oi;
686 	struct rt_addrinfo rtinfo;
687 	sa_family_t family;
688 	int len, error = 0;
689 	__va_list ap;
690 
691 	M_ASSERTPKTHDR(m);
692 
693 	__va_start(ap, so);
694 	oi = __va_arg(ap, struct pr_output_info *);
695 	__va_end(ap);
696 
697 	family = familyof(NULL);
698 
699 #define gotoerr(e) { error = e; goto flush;}
700 
701 	if (m == NULL ||
702 	    (m->m_len < sizeof(long) &&
703 	     (m = m_pullup(m, sizeof(long))) == NULL))
704 		return (ENOBUFS);
705 	len = m->m_pkthdr.len;
706 	if (len < sizeof(struct rt_msghdr) ||
707 	    len != mtod(m, struct rt_msghdr *)->rtm_msglen)
708 		gotoerr(EINVAL);
709 
710 	rtm = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
711 	if (rtm == NULL)
712 		gotoerr(ENOBUFS);
713 
714 	m_copydata(m, 0, len, rtm);
715 	if (rtm->rtm_version != RTM_VERSION)
716 		gotoerr(EPROTONOSUPPORT);
717 
718 	rtm->rtm_pid = oi->p_pid;
719 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
720 	rtinfo.rti_addrs = rtm->rtm_addrs;
721 	if (rt_xaddrs((char *)(rtm + 1), (char *)rtm + len, &rtinfo) != 0)
722 		gotoerr(EINVAL);
723 
724 	rtinfo.rti_flags = rtm->rtm_flags;
725 	if (rtinfo.rti_dst == NULL || rtinfo.rti_dst->sa_family >= AF_MAX ||
726 	    (rtinfo.rti_gateway && rtinfo.rti_gateway->sa_family >= AF_MAX))
727 		gotoerr(EINVAL);
728 
729 	family = familyof(rtinfo.rti_dst);
730 
731 	/*
732 	 * Verify that the caller has the appropriate privilege; RTM_GET
733 	 * is the only operation the non-superuser is allowed.
734 	 */
735 	if (rtm->rtm_type != RTM_GET &&
736 	    caps_priv_check(so->so_cred, SYSCAP_RESTRICTEDROOT) != 0)
737 	{
738 		gotoerr(EPERM);
739 	}
740 
741 	if (rtinfo.rti_genmask != NULL) {
742 		error = rtmask_add_global(rtinfo.rti_genmask,
743 		    rtm->rtm_type != RTM_GET ?
744 		    RTREQ_PRIO_HIGH : RTREQ_PRIO_NORM);
745 		if (error)
746 			goto flush;
747 	}
748 
749 	switch (rtm->rtm_type) {
750 	case RTM_ADD:
751 		if (rtinfo.rti_gateway == NULL) {
752 			error = EINVAL;
753 		} else {
754 			error = rtrequest1_global(RTM_ADD, &rtinfo,
755 			    route_output_add_callback, rtm, RTREQ_PRIO_HIGH);
756 		}
757 		break;
758 	case RTM_DELETE:
759 		/*
760 		 * Backing rtm (bak_rtm) could _not_ be freed during
761 		 * rtrequest1_global or rtsearch_global, even if the
762 		 * callback reallocates the rtm due to its size changes,
763 		 * since rtinfo points to the backing rtm's memory area.
764 		 * After rtrequest1_global or rtsearch_global returns,
765 		 * it is safe to free the backing rtm, since rtinfo will
766 		 * not be used anymore.
767 		 *
768 		 * new_rtm will be used to save the new rtm allocated
769 		 * by rtrequest1_global or rtsearch_global.
770 		 */
771 		arg.bak_rtm = rtm;
772 		arg.new_rtm = rtm;
773 		error = rtrequest1_global(RTM_DELETE, &rtinfo,
774 		    route_output_delete_callback, &arg, RTREQ_PRIO_HIGH);
775 		rtm = arg.new_rtm;
776 		if (rtm != arg.bak_rtm)
777 			kfree(arg.bak_rtm, M_RTABLE);
778 		break;
779 	case RTM_GET:
780 		/* See the comment in RTM_DELETE */
781 		arg.bak_rtm = rtm;
782 		arg.new_rtm = rtm;
783 		error = rtsearch_global(RTM_GET, &rtinfo,
784 		    route_output_get_callback, &arg, RTS_NOEXACTMATCH,
785 		    RTREQ_PRIO_NORM);
786 		rtm = arg.new_rtm;
787 		if (rtm != arg.bak_rtm)
788 			kfree(arg.bak_rtm, M_RTABLE);
789 		break;
790 	case RTM_CHANGE:
791 		error = rtsearch_global(RTM_CHANGE, &rtinfo,
792 		    route_output_change_callback, rtm, RTS_EXACTMATCH,
793 		    RTREQ_PRIO_HIGH);
794 		break;
795 	case RTM_LOCK:
796 		error = rtsearch_global(RTM_LOCK, &rtinfo,
797 		    route_output_lock_callback, rtm, RTS_EXACTMATCH,
798 		    RTREQ_PRIO_HIGH);
799 		break;
800 	default:
801 		error = EOPNOTSUPP;
802 		break;
803 	}
804 flush:
805 	if (rtm != NULL) {
806 		if (error != 0)
807 			rtm->rtm_errno = error;
808 		else
809 			rtm->rtm_flags |= RTF_DONE;
810 	}
811 
812 	/*
813 	 * Check to see if we don't want our own messages.
814 	 */
815 	if (!(so->so_options & SO_USELOOPBACK)) {
816 		if (route_cb.any_count <= 1) {
817 			if (rtm != NULL)
818 				kfree(rtm, M_RTABLE);
819 			m_freem(m);
820 			return (error);
821 		}
822 		/* There is another listener, so construct message */
823 		rp = sotorawcb(so);
824 	}
825 	if (rtm != NULL) {
826 		if (m_copyback2(m, 0, rtm->rtm_msglen, rtm, M_NOWAIT) != 0) {
827 			m_freem(m);
828 			m = NULL;
829 		} else if (m->m_pkthdr.len > rtm->rtm_msglen) {
830 			m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
831 		}
832 		kfree(rtm, M_RTABLE);
833 	}
834 	if (m != NULL)
835 		rts_input_skip(m, family, rp);
836 	return (error);
837 }
838 
839 static void
840 route_output_add_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
841 			  struct rtentry *rt, void *arg)
842 {
843 	struct rt_msghdr *rtm = arg;
844 
845 	if (error == 0 && rt != NULL) {
846 		rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx,
847 		    &rt->rt_rmx);
848 		rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
849 		rt->rt_rmx.rmx_locks |=
850 		    (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
851 		if (rtinfo->rti_genmask != NULL) {
852 			rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
853 			if (rt->rt_genmask == NULL) {
854 				/*
855 				 * This should not happen, since we
856 				 * have already installed genmask
857 				 * on each CPU before we reach here.
858 				 */
859 				panic("genmask is gone!?");
860 			}
861 		} else {
862 			rt->rt_genmask = NULL;
863 		}
864 		rtm->rtm_index = rt->rt_ifp->if_index;
865 	}
866 }
867 
868 static void
869 route_output_delete_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
870 			  struct rtentry *rt, void *arg)
871 {
872 	if (error == 0 && rt) {
873 		++rt->rt_refcnt;
874 		if (fillrtmsg(arg, rt, rtinfo) != 0) {
875 			error = ENOBUFS;
876 			/* XXX no way to return the error */
877 		}
878 		--rt->rt_refcnt;
879 	}
880 	if (rt && rt->rt_refcnt == 0) {
881 		++rt->rt_refcnt;
882 		rtfree(rt);
883 	}
884 }
885 
886 static int
887 route_output_get_callback(int cmd, struct rt_addrinfo *rtinfo,
888 			  struct rtentry *rt, void *arg, int found_cnt)
889 {
890 	int error, found = 0;
891 
892 	if (((rtinfo->rti_flags ^ rt->rt_flags) & RTF_HOST) == 0)
893 		found = 1;
894 
895 	error = fillrtmsg(arg, rt, rtinfo);
896 	if (!error && found) {
897 		/* Got the exact match, we could return now! */
898 		error = EJUSTRETURN;
899 	}
900 	return error;
901 }
902 
903 static int
904 route_output_change_callback(int cmd, struct rt_addrinfo *rtinfo,
905 			     struct rtentry *rt, void *arg, int found_cnt)
906 {
907 	struct rt_msghdr *rtm = arg;
908 	struct ifaddr *ifa;
909 	int error = 0;
910 
911 	/*
912 	 * new gateway could require new ifaddr, ifp;
913 	 * flags may also be different; ifp may be specified
914 	 * by ll sockaddr when protocol address is ambiguous
915 	 */
916 	if (((rt->rt_flags & RTF_GATEWAY) && rtinfo->rti_gateway != NULL) ||
917 	    rtinfo->rti_ifpaddr != NULL ||
918 	    (rtinfo->rti_ifaaddr != NULL &&
919 	     !sa_equal(rtinfo->rti_ifaaddr, rt->rt_ifa->ifa_addr))) {
920 		error = rt_getifa(rtinfo);
921 		if (error != 0)
922 			goto done;
923 	}
924 	if (rtinfo->rti_gateway != NULL) {
925 		/*
926 		 * We only need to generate rtmsg upon the
927 		 * first route to be changed.
928 		 */
929 		error = rt_setgate(rt, rt_key(rt), rtinfo->rti_gateway);
930 		if (error != 0)
931 			goto done;
932 	}
933 	if ((ifa = rtinfo->rti_ifa) != NULL) {
934 		struct ifaddr *oifa = rt->rt_ifa;
935 
936 		if (oifa != ifa) {
937 			if (oifa && oifa->ifa_rtrequest)
938 				oifa->ifa_rtrequest(RTM_DELETE, rt);
939 			IFAFREE(rt->rt_ifa);
940 			IFAREF(ifa);
941 			rt->rt_ifa = ifa;
942 			rt->rt_ifp = rtinfo->rti_ifp;
943 		}
944 	}
945 	rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx, &rt->rt_rmx);
946 	if (rt->rt_ifa && rt->rt_ifa->ifa_rtrequest)
947 		rt->rt_ifa->ifa_rtrequest(RTM_ADD, rt);
948 	if (rtinfo->rti_genmask != NULL) {
949 		rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
950 		if (rt->rt_genmask == NULL) {
951 			/*
952 			 * This should not happen, since we
953 			 * have already installed genmask
954 			 * on each CPU before we reach here.
955 			 */
956 			panic("genmask is gone!?");
957 		}
958 	}
959 	rtm->rtm_index = rt->rt_ifp->if_index;
960 	if (found_cnt == 1)
961 		rt_rtmsg(RTM_CHANGE, rt, rt->rt_ifp, 0);
962 done:
963 	return error;
964 }
965 
966 static int
967 route_output_lock_callback(int cmd, struct rt_addrinfo *rtinfo,
968 			   struct rtentry *rt, void *arg,
969 			   int found_cnt __unused)
970 {
971 	struct rt_msghdr *rtm = arg;
972 
973 	rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
974 	rt->rt_rmx.rmx_locks |=
975 		(rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
976 	return 0;
977 }
978 
979 static void
980 rt_setmetrics(u_long which, struct rt_metrics *in, struct rt_metrics *out)
981 {
982 #define setmetric(flag, elt) if (which & (flag)) out->elt = in->elt;
983 	setmetric(RTV_RPIPE, rmx_recvpipe);
984 	setmetric(RTV_SPIPE, rmx_sendpipe);
985 	setmetric(RTV_SSTHRESH, rmx_ssthresh);
986 	setmetric(RTV_RTT, rmx_rtt);
987 	setmetric(RTV_RTTVAR, rmx_rttvar);
988 	setmetric(RTV_HOPCOUNT, rmx_hopcount);
989 	setmetric(RTV_MTU, rmx_mtu);
990 	setmetric(RTV_EXPIRE, rmx_expire);
991 	setmetric(RTV_MSL, rmx_msl);
992 	setmetric(RTV_IWMAXSEGS, rmx_iwmaxsegs);
993 	setmetric(RTV_IWCAPSEGS, rmx_iwcapsegs);
994 #undef setmetric
995 }
996 
997 /*
998  * Extract the addresses of the passed sockaddrs.
999  * Do a little sanity checking so as to avoid bad memory references.
1000  * This data is derived straight from userland.
1001  */
1002 static int
1003 rt_xaddrs(char *cp, char *cplim, struct rt_addrinfo *rtinfo)
1004 {
1005 	struct sockaddr *sa;
1006 	int i;
1007 
1008 	for (i = 0; (i < RTAX_MAX) && (cp < cplim); i++) {
1009 		if ((rtinfo->rti_addrs & (1 << i)) == 0)
1010 			continue;
1011 		sa = (struct sockaddr *)cp;
1012 		/*
1013 		 * It won't fit.
1014 		 */
1015 		if ((cp + sa->sa_len) > cplim) {
1016 			return (EINVAL);
1017 		}
1018 
1019 		/*
1020 		 * There are no more...  Quit now.
1021 		 * If there are more bits, they are in error.
1022 		 * I've seen this.  route(1) can evidently generate these.
1023 		 * This causes kernel to core dump.
1024 		 * For compatibility, if we see this, point to a safe address.
1025 		 */
1026 		if (sa->sa_len == 0) {
1027 			static struct sockaddr sa_zero = {
1028 				sizeof sa_zero, AF_INET,
1029 			};
1030 
1031 			rtinfo->rti_info[i] = &sa_zero;
1032 			kprintf("rtsock: received more addr bits than sockaddrs.\n");
1033 			return (0); /* should be EINVAL but for compat */
1034 		}
1035 
1036 		/* Accept the sockaddr. */
1037 		rtinfo->rti_info[i] = sa;
1038 		cp += RT_ROUNDUP(sa->sa_len);
1039 	}
1040 	return (0);
1041 }
1042 
1043 static int
1044 rt_msghdrsize(int type)
1045 {
1046 	switch (type) {
1047 	case RTM_DELADDR:
1048 	case RTM_NEWADDR:
1049 		return sizeof(struct ifa_msghdr);
1050 	case RTM_DELMADDR:
1051 	case RTM_NEWMADDR:
1052 		return sizeof(struct ifma_msghdr);
1053 	case RTM_IFINFO:
1054 		return sizeof(struct if_msghdr);
1055 	case RTM_IFANNOUNCE:
1056 	case RTM_IEEE80211:
1057 		return sizeof(struct if_announcemsghdr);
1058 	default:
1059 		return sizeof(struct rt_msghdr);
1060 	}
1061 }
1062 
1063 static int
1064 rt_msgsize(int type, const struct rt_addrinfo *rtinfo)
1065 {
1066 	int len, i;
1067 
1068 	len = rt_msghdrsize(type);
1069 	for (i = 0; i < RTAX_MAX; i++) {
1070 		if (rtinfo->rti_info[i] != NULL)
1071 			len += RT_ROUNDUP(rtinfo->rti_info[i]->sa_len);
1072 	}
1073 	len = ALIGN(len);
1074 	return len;
1075 }
1076 
1077 /*
1078  * Build a routing message in a buffer.
1079  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
1080  * to the end of the buffer after the message header.
1081  *
1082  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
1083  * This side-effect can be avoided if we reorder the addrs bitmask field in all
1084  * the route messages to line up so we can set it here instead of back in the
1085  * calling routine.
1086  *
1087  * NOTE! The buffer may already contain a partially filled-out rtm via
1088  *	 _fillrtmsg().
1089  */
1090 static void
1091 rt_msg_buffer(int type, struct rt_addrinfo *rtinfo, void *buf, int msglen)
1092 {
1093 	struct rt_msghdr *rtm;
1094 	char *cp;
1095 	int dlen, i;
1096 
1097 	rtm = (struct rt_msghdr *) buf;
1098 	rtm->rtm_version = RTM_VERSION;
1099 	rtm->rtm_type = type;
1100 	rtm->rtm_msglen = msglen;
1101 
1102 	cp = (char *)buf + rt_msghdrsize(type);
1103 	rtinfo->rti_addrs = 0;
1104 	for (i = 0; i < RTAX_MAX; i++) {
1105 		struct sockaddr *sa;
1106 
1107 		if ((sa = rtinfo->rti_info[i]) == NULL)
1108 			continue;
1109 		rtinfo->rti_addrs |= (1 << i);
1110 		dlen = RT_ROUNDUP(sa->sa_len);
1111 		bcopy(sa, cp, dlen);
1112 		cp += dlen;
1113 	}
1114 }
1115 
1116 /*
1117  * Build a routing message in a mbuf chain.
1118  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
1119  * to the end of the mbuf after the message header.
1120  *
1121  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
1122  * This side-effect can be avoided if we reorder the addrs bitmask field in all
1123  * the route messages to line up so we can set it here instead of back in the
1124  * calling routine.
1125  */
1126 static struct mbuf *
1127 rt_msg_mbuf(int type, struct rt_addrinfo *rtinfo)
1128 {
1129 	struct mbuf *m, *n;
1130 	struct rt_msghdr *rtm;
1131 	struct sockaddr *sa;
1132 	int hlen, dlen, len, i;
1133 
1134 	hlen = rt_msghdrsize(type);
1135 	KASSERT(hlen <= MCLBYTES, ("rt_msg_mbuf: hlen %d doesn't fit", hlen));
1136 
1137 	/* Determine the required mbuf (chain) length. */
1138 	len = hlen;
1139 	for (i = 0; i < RTAX_MAX; i++) {
1140 		if ((sa = rtinfo->rti_info[i]) == NULL)
1141 			continue;
1142 		len += RT_ROUNDUP(sa->sa_len);
1143 	}
1144 
1145 	/* Allocate the mbuf header and possible chain. */
1146 	m = m_getl(len, M_NOWAIT, MT_DATA, M_PKTHDR, &dlen);
1147 	if (m == NULL)
1148 		return (NULL);
1149 	if (len > dlen) {
1150 		n = m_getc(len - dlen, M_NOWAIT, MT_DATA);
1151 		if (n == NULL) {
1152 			m_freem(m);
1153 			return (NULL);
1154 		}
1155 		m_cat(m, n);
1156 	}
1157 	mbuftrackid(m, 32);
1158 
1159 	m->m_pkthdr.len = m->m_len = hlen; /* rtinfo->rti_info[] can be empty */
1160 	m->m_pkthdr.rcvif = NULL;
1161 	rtinfo->rti_addrs = 0;
1162 	len = hlen;
1163 	for (i = 0; i < RTAX_MAX; i++) {
1164 		if ((sa = rtinfo->rti_info[i]) == NULL)
1165 			continue;
1166 		rtinfo->rti_addrs |= (1 << i);
1167 		dlen = RT_ROUNDUP(sa->sa_len);
1168 		m_copyback(m, len, dlen, sa);
1169 		len += dlen;
1170 	}
1171 	rtm = mtod(m, struct rt_msghdr *);
1172 	bzero(rtm, hlen);
1173 	rtm->rtm_msglen = len;
1174 	rtm->rtm_version = RTM_VERSION;
1175 	rtm->rtm_type = type;
1176 	return (m);
1177 }
1178 
1179 /*
1180  * This routine is called to generate a message from the routing
1181  * socket indicating that a redirect has occurred, a routing lookup
1182  * has failed, or that a protocol has detected timeouts to a particular
1183  * destination.
1184  */
1185 void
1186 rt_missmsg(int type, struct rt_addrinfo *rtinfo, int flags, int error)
1187 {
1188 	struct sockaddr *dst = rtinfo->rti_info[RTAX_DST];
1189 	struct rt_msghdr *rtm;
1190 	struct mbuf *m;
1191 
1192 	if (route_cb.any_count == 0)
1193 		return;
1194 	m = rt_msg_mbuf(type, rtinfo);
1195 	if (m == NULL)
1196 		return;
1197 	rtm = mtod(m, struct rt_msghdr *);
1198 	rtm->rtm_flags = RTF_DONE | flags;
1199 	rtm->rtm_errno = error;
1200 	rtm->rtm_addrs = rtinfo->rti_addrs;
1201 	rts_input(m, familyof(dst));
1202 }
1203 
1204 void
1205 rt_dstmsg(int type, struct sockaddr *dst, int error)
1206 {
1207 	struct rt_msghdr *rtm;
1208 	struct rt_addrinfo addrs;
1209 	struct mbuf *m;
1210 
1211 	if (route_cb.any_count == 0)
1212 		return;
1213 	bzero(&addrs, sizeof(struct rt_addrinfo));
1214 	addrs.rti_info[RTAX_DST] = dst;
1215 	m = rt_msg_mbuf(type, &addrs);
1216 	if (m == NULL)
1217 		return;
1218 	rtm = mtod(m, struct rt_msghdr *);
1219 	rtm->rtm_flags = RTF_DONE;
1220 	rtm->rtm_errno = error;
1221 	rtm->rtm_addrs = addrs.rti_addrs;
1222 	rts_input(m, familyof(dst));
1223 }
1224 
1225 /*
1226  * This routine is called to generate a message from the routing
1227  * socket indicating that the status of a network interface has changed.
1228  */
1229 void
1230 rt_ifmsg(struct ifnet *ifp)
1231 {
1232 	struct if_msghdr *ifm;
1233 	struct mbuf *m;
1234 	struct rt_addrinfo rtinfo;
1235 
1236 	if (route_cb.any_count == 0)
1237 		return;
1238 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1239 	m = rt_msg_mbuf(RTM_IFINFO, &rtinfo);
1240 	if (m == NULL)
1241 		return;
1242 	ifm = mtod(m, struct if_msghdr *);
1243 	ifm->ifm_index = ifp->if_index;
1244 	ifm->ifm_flags = ifp->if_flags;
1245 	ifm->ifm_data = ifp->if_data;
1246 	ifm->ifm_addrs = 0;
1247 	rts_input(m, 0);
1248 }
1249 
1250 static void
1251 rt_ifamsg(int cmd, struct ifaddr *ifa)
1252 {
1253 	struct ifa_msghdr *ifam;
1254 	struct rt_addrinfo rtinfo;
1255 	struct mbuf *m;
1256 	struct ifnet *ifp = ifa->ifa_ifp;
1257 
1258 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1259 	rtinfo.rti_ifaaddr = ifa->ifa_addr;
1260 	rtinfo.rti_ifpaddr =
1261 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1262 	rtinfo.rti_netmask = ifa->ifa_netmask;
1263 	rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1264 
1265 	m = rt_msg_mbuf(cmd, &rtinfo);
1266 	if (m == NULL)
1267 		return;
1268 
1269 	ifam = mtod(m, struct ifa_msghdr *);
1270 	ifam->ifam_index = ifp->if_index;
1271 	ifam->ifam_flags = ifa->ifa_flags;
1272 	ifam->ifam_addrs = rtinfo.rti_addrs;
1273 	ifam->ifam_addrflags = if_addrflags(ifa);
1274 	ifam->ifam_metric = ifa->ifa_metric;
1275 
1276 	rts_input(m, familyof(ifa->ifa_addr));
1277 }
1278 
1279 void
1280 rt_rtmsg(int cmd, struct rtentry *rt, struct ifnet *ifp, int error)
1281 {
1282 	struct rt_msghdr *rtm;
1283 	struct rt_addrinfo rtinfo;
1284 	struct mbuf *m;
1285 	struct sockaddr *dst;
1286 
1287 	if (rt == NULL)
1288 		return;
1289 
1290 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1291 	rtinfo.rti_dst = dst = rt_key(rt);
1292 	rtinfo.rti_gateway = rt->rt_gateway;
1293 	rtinfo.rti_netmask = rt_mask(rt);
1294 	if (ifp != NULL) {
1295 		rtinfo.rti_ifpaddr =
1296 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1297 	}
1298 	if (rt->rt_ifa != NULL)
1299 		rtinfo.rti_ifaaddr = rt->rt_ifa->ifa_addr;
1300 
1301 	m = rt_msg_mbuf(cmd, &rtinfo);
1302 	if (m == NULL)
1303 		return;
1304 
1305 	rtm = mtod(m, struct rt_msghdr *);
1306 	if (ifp != NULL)
1307 		rtm->rtm_index = ifp->if_index;
1308 	rtm->rtm_flags |= rt->rt_flags;
1309 	rtm->rtm_errno = error;
1310 	rtm->rtm_addrs = rtinfo.rti_addrs;
1311 
1312 	rts_input(m, familyof(dst));
1313 }
1314 
1315 /*
1316  * This is called to generate messages from the routing socket
1317  * indicating a network interface has had addresses associated with it.
1318  * if we ever reverse the logic and replace messages TO the routing
1319  * socket indicate a request to configure interfaces, then it will
1320  * be unnecessary as the routing socket will automatically generate
1321  * copies of it.
1322  */
1323 void
1324 rt_newaddrmsg(int cmd, struct ifaddr *ifa, int error, struct rtentry *rt)
1325 {
1326 	if (route_cb.any_count == 0)
1327 		return;
1328 
1329 	if (cmd == RTM_ADD) {
1330 		rt_ifamsg(RTM_NEWADDR, ifa);
1331 		rt_rtmsg(RTM_ADD, rt, ifa->ifa_ifp, error);
1332 	} else {
1333 		KASSERT((cmd == RTM_DELETE), ("unknown cmd %d", cmd));
1334 		rt_rtmsg(RTM_DELETE, rt, ifa->ifa_ifp, error);
1335 		rt_ifamsg(RTM_DELADDR, ifa);
1336 	}
1337 }
1338 
1339 /*
1340  * This is the analogue to the rt_newaddrmsg which performs the same
1341  * function but for multicast group memberhips.  This is easier since
1342  * there is no route state to worry about.
1343  */
1344 void
1345 rt_newmaddrmsg(int cmd, struct ifmultiaddr *ifma)
1346 {
1347 	struct rt_addrinfo rtinfo;
1348 	struct mbuf *m = NULL;
1349 	struct ifnet *ifp = ifma->ifma_ifp;
1350 	struct ifma_msghdr *ifmam;
1351 
1352 	if (route_cb.any_count == 0)
1353 		return;
1354 
1355 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1356 	rtinfo.rti_ifaaddr = ifma->ifma_addr;
1357 	if (ifp != NULL && !TAILQ_EMPTY(&ifp->if_addrheads[mycpuid])) {
1358 		rtinfo.rti_ifpaddr =
1359 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1360 	}
1361 	/*
1362 	 * If a link-layer address is present, present it as a ``gateway''
1363 	 * (similarly to how ARP entries, e.g., are presented).
1364 	 */
1365 	rtinfo.rti_gateway = ifma->ifma_lladdr;
1366 
1367 	m = rt_msg_mbuf(cmd, &rtinfo);
1368 	if (m == NULL)
1369 		return;
1370 
1371 	ifmam = mtod(m, struct ifma_msghdr *);
1372 	ifmam->ifmam_index = ifp->if_index;
1373 	ifmam->ifmam_addrs = rtinfo.rti_addrs;
1374 
1375 	rts_input(m, familyof(ifma->ifma_addr));
1376 }
1377 
1378 static struct mbuf *
1379 rt_makeifannouncemsg(struct ifnet *ifp, int type, int what,
1380 		     struct rt_addrinfo *info)
1381 {
1382 	struct if_announcemsghdr *ifan;
1383 	struct mbuf *m;
1384 
1385 	if (route_cb.any_count == 0)
1386 		return NULL;
1387 
1388 	bzero(info, sizeof(*info));
1389 	m = rt_msg_mbuf(type, info);
1390 	if (m == NULL)
1391 		return NULL;
1392 
1393 	ifan = mtod(m, struct if_announcemsghdr *);
1394 	ifan->ifan_index = ifp->if_index;
1395 	strlcpy(ifan->ifan_name, ifp->if_xname, sizeof ifan->ifan_name);
1396 	ifan->ifan_what = what;
1397 	return m;
1398 }
1399 
1400 /*
1401  * This is called to generate routing socket messages indicating
1402  * IEEE80211 wireless events.
1403  * XXX we piggyback on the RTM_IFANNOUNCE msg format in a clumsy way.
1404  */
1405 void
1406 rt_ieee80211msg(struct ifnet *ifp, int what, void *data, size_t data_len)
1407 {
1408 	struct rt_addrinfo info;
1409 	struct mbuf *m;
1410 
1411 	m = rt_makeifannouncemsg(ifp, RTM_IEEE80211, what, &info);
1412 	if (m == NULL)
1413 		return;
1414 
1415 	/*
1416 	 * Append the ieee80211 data.  Try to stick it in the
1417 	 * mbuf containing the ifannounce msg; otherwise allocate
1418 	 * a new mbuf and append.
1419 	 *
1420 	 * NB: we assume m is a single mbuf.
1421 	 */
1422 	if (data_len > M_TRAILINGSPACE(m)) {
1423 		/* XXX use m_getb(data_len, M_NOWAIT, MT_DATA, 0); */
1424 		struct mbuf *n = m_get(M_NOWAIT, MT_DATA);
1425 		if (n == NULL) {
1426 			m_freem(m);
1427 			return;
1428 		}
1429 		KKASSERT(data_len <= M_TRAILINGSPACE(n));
1430 		bcopy(data, mtod(n, void *), data_len);
1431 		n->m_len = data_len;
1432 		m->m_next = n;
1433 	} else if (data_len > 0) {
1434 		bcopy(data, mtod(m, u_int8_t *) + m->m_len, data_len);
1435 		m->m_len += data_len;
1436 	}
1437 	mbuftrackid(m, 33);
1438 	if (m->m_flags & M_PKTHDR)
1439 		m->m_pkthdr.len += data_len;
1440 	mtod(m, struct if_announcemsghdr *)->ifan_msglen += data_len;
1441 	rts_input(m, 0);
1442 }
1443 
1444 /*
1445  * This is called to generate routing socket messages indicating
1446  * network interface arrival and departure.
1447  */
1448 void
1449 rt_ifannouncemsg(struct ifnet *ifp, int what)
1450 {
1451 	struct rt_addrinfo addrinfo;
1452 	struct mbuf *m;
1453 
1454 	m = rt_makeifannouncemsg(ifp, RTM_IFANNOUNCE, what, &addrinfo);
1455 	if (m != NULL)
1456 		rts_input(m, 0);
1457 }
1458 
1459 static int
1460 resizewalkarg(struct walkarg *w, int len)
1461 {
1462 	void *newptr;
1463 
1464 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
1465 	if (newptr == NULL)
1466 		return (ENOMEM);
1467 	if (w->w_tmem != NULL)
1468 		kfree(w->w_tmem, M_RTABLE);
1469 	w->w_tmem = newptr;
1470 	w->w_tmemsize = len;
1471 	bzero(newptr, len);
1472 
1473 	return (0);
1474 }
1475 
1476 static void
1477 ifnet_compute_stats(struct ifnet *ifp)
1478 {
1479 	IFNET_STAT_GET(ifp, ipackets, ifp->if_ipackets);
1480 	IFNET_STAT_GET(ifp, ierrors, ifp->if_ierrors);
1481 	IFNET_STAT_GET(ifp, opackets, ifp->if_opackets);
1482 	IFNET_STAT_GET(ifp, collisions, ifp->if_collisions);
1483 	IFNET_STAT_GET(ifp, ibytes, ifp->if_ibytes);
1484 	IFNET_STAT_GET(ifp, obytes, ifp->if_obytes);
1485 	IFNET_STAT_GET(ifp, imcasts, ifp->if_imcasts);
1486 	IFNET_STAT_GET(ifp, omcasts, ifp->if_omcasts);
1487 	IFNET_STAT_GET(ifp, iqdrops, ifp->if_iqdrops);
1488 	IFNET_STAT_GET(ifp, noproto, ifp->if_noproto);
1489 	IFNET_STAT_GET(ifp, oqdrops, ifp->if_oqdrops);
1490 }
1491 
1492 static int
1493 if_addrflags(const struct ifaddr *ifa)
1494 {
1495 	switch (ifa->ifa_addr->sa_family) {
1496 #ifdef INET6
1497 	case AF_INET6:
1498 		return ((const struct in6_ifaddr *)ifa)->ia6_flags;
1499 #endif
1500 	default:
1501 		return 0;
1502 	}
1503 }
1504 
1505 static int
1506 sysctl_iflist(int af, struct walkarg *w)
1507 {
1508 	struct ifnet *ifp;
1509 	struct rt_addrinfo rtinfo;
1510 	int msglen, error;
1511 
1512 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1513 
1514 	ifnet_lock();
1515 	TAILQ_FOREACH(ifp, &ifnetlist, if_link) {
1516 		struct ifaddr_container *ifac, *ifac_mark;
1517 		struct ifaddr_marker mark;
1518 		struct ifaddrhead *head;
1519 		struct ifaddr *ifa;
1520 
1521 		if (w->w_arg && w->w_arg != ifp->if_index)
1522 			continue;
1523 		head = &ifp->if_addrheads[mycpuid];
1524 		/*
1525 		 * There is no need to reference the first ifaddr
1526 		 * even if the following resizewalkarg() blocks,
1527 		 * since the first ifaddr will not be destroyed
1528 		 * when the ifnet lock is held.
1529 		 */
1530 		ifac = TAILQ_FIRST(head);
1531 		ifa = ifac->ifa;
1532 		rtinfo.rti_ifpaddr = ifa->ifa_addr;
1533 		msglen = rt_msgsize(RTM_IFINFO, &rtinfo);
1534 		if (w->w_tmemsize < msglen && resizewalkarg(w, msglen) != 0) {
1535 			ifnet_unlock();
1536 			return (ENOMEM);
1537 		}
1538 		rt_msg_buffer(RTM_IFINFO, &rtinfo, w->w_tmem, msglen);
1539 		rtinfo.rti_ifpaddr = NULL;
1540 		if (w->w_req != NULL && w->w_tmem != NULL) {
1541 			struct if_msghdr *ifm = w->w_tmem;
1542 
1543 			ifm->ifm_index = ifp->if_index;
1544 			ifm->ifm_flags = ifp->if_flags;
1545 			ifnet_compute_stats(ifp);
1546 			ifm->ifm_data = ifp->if_data;
1547 			ifm->ifm_addrs = rtinfo.rti_addrs;
1548 			error = SYSCTL_OUT(w->w_req, ifm, msglen);
1549 			if (error) {
1550 				ifnet_unlock();
1551 				return (error);
1552 			}
1553 		}
1554 		/*
1555 		 * Add a marker, since SYSCTL_OUT() could block and during
1556 		 * that period the list could be changed.
1557 		 */
1558 		ifa_marker_init(&mark, ifp);
1559 		ifac_mark = &mark.ifac;
1560 		TAILQ_INSERT_AFTER(head, ifac, ifac_mark, ifa_link);
1561 		while ((ifac = TAILQ_NEXT(ifac_mark, ifa_link)) != NULL) {
1562 			TAILQ_REMOVE(head, ifac_mark, ifa_link);
1563 			TAILQ_INSERT_AFTER(head, ifac, ifac_mark, ifa_link);
1564 
1565 			ifa = ifac->ifa;
1566 
1567 			/* Ignore marker */
1568 			if (ifa->ifa_addr->sa_family == AF_UNSPEC)
1569 				continue;
1570 
1571 			if (af && af != ifa->ifa_addr->sa_family)
1572 				continue;
1573 			if (curproc->p_ucred->cr_prison &&
1574 			    prison_if(curproc->p_ucred, ifa->ifa_addr))
1575 				continue;
1576 			rtinfo.rti_ifaaddr = ifa->ifa_addr;
1577 			rtinfo.rti_netmask = ifa->ifa_netmask;
1578 			rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1579 			msglen = rt_msgsize(RTM_NEWADDR, &rtinfo);
1580 			/*
1581 			 * Keep a reference on this ifaddr, so that it will
1582 			 * not be destroyed if the following resizewalkarg()
1583 			 * blocks.
1584 			 */
1585 			IFAREF(ifa);
1586 			if (w->w_tmemsize < msglen &&
1587 			    resizewalkarg(w, msglen) != 0) {
1588 				IFAFREE(ifa);
1589 				TAILQ_REMOVE(head, ifac_mark, ifa_link);
1590 				ifnet_unlock();
1591 				return (ENOMEM);
1592 			}
1593 			rt_msg_buffer(RTM_NEWADDR, &rtinfo, w->w_tmem, msglen);
1594 			if (w->w_req != NULL) {
1595 				struct ifa_msghdr *ifam = w->w_tmem;
1596 
1597 				ifam->ifam_index = ifa->ifa_ifp->if_index;
1598 				ifam->ifam_flags = ifa->ifa_flags;
1599 				ifam->ifam_addrs = rtinfo.rti_addrs;
1600 				ifam->ifam_addrflags = if_addrflags(ifa);
1601 				ifam->ifam_metric = ifa->ifa_metric;
1602 				error = SYSCTL_OUT(w->w_req, w->w_tmem, msglen);
1603 				if (error) {
1604 					IFAFREE(ifa);
1605 					TAILQ_REMOVE(head, ifac_mark, ifa_link);
1606 					ifnet_unlock();
1607 					return (error);
1608 				}
1609 			}
1610 			IFAFREE(ifa);
1611 		}
1612 		TAILQ_REMOVE(head, ifac_mark, ifa_link);
1613 		rtinfo.rti_netmask = NULL;
1614 		rtinfo.rti_ifaaddr = NULL;
1615 		rtinfo.rti_bcastaddr = NULL;
1616 	}
1617 	ifnet_unlock();
1618 	return (0);
1619 }
1620 
1621 static int
1622 rttable_walkarg_create(struct rttable_walkarg *w, int op, int arg)
1623 {
1624 	struct rt_addrinfo rtinfo;
1625 	struct sockaddr_storage ss;
1626 	int i, msglen;
1627 
1628 	memset(w, 0, sizeof(*w));
1629 	w->w_op = op;
1630 	w->w_arg = arg;
1631 
1632 	memset(&ss, 0, sizeof(ss));
1633 	ss.ss_len = sizeof(ss);
1634 
1635 	memset(&rtinfo, 0, sizeof(rtinfo));
1636 	for (i = 0; i < RTAX_MAX; ++i)
1637 		rtinfo.rti_info[i] = (struct sockaddr *)&ss;
1638 	msglen = rt_msgsize(RTM_GET, &rtinfo);
1639 
1640 	w->w_bufsz = msglen * RTTABLE_DUMP_MSGCNT_MAX;
1641 	w->w_buf = kmalloc(w->w_bufsz, M_TEMP, M_WAITOK | M_NULLOK);
1642 	if (w->w_buf == NULL)
1643 		return ENOMEM;
1644 	return 0;
1645 }
1646 
1647 static void
1648 rttable_walkarg_destroy(struct rttable_walkarg *w)
1649 {
1650 	kfree(w->w_buf, M_TEMP);
1651 }
1652 
1653 static void
1654 rttable_entry_rtinfo(struct rt_addrinfo *rtinfo, struct radix_node *rn)
1655 {
1656 	struct rtentry *rt = (struct rtentry *)rn;
1657 
1658 	bzero(rtinfo, sizeof(*rtinfo));
1659 	rtinfo->rti_dst = rt_key(rt);
1660 	rtinfo->rti_gateway = rt->rt_gateway;
1661 	rtinfo->rti_netmask = rt_mask(rt);
1662 	rtinfo->rti_genmask = rt->rt_genmask;
1663 	if (rt->rt_ifp != NULL) {
1664 		rtinfo->rti_ifpaddr =
1665 		TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1666 		rtinfo->rti_ifaaddr = rt->rt_ifa->ifa_addr;
1667 		if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
1668 			rtinfo->rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
1669 	}
1670 }
1671 
1672 static int
1673 rttable_walk_entry(struct radix_node *rn, void *xw)
1674 {
1675 	struct rttable_walkarg *w = xw;
1676 	struct rtentry *rt = (struct rtentry *)rn;
1677 	struct rt_addrinfo rtinfo;
1678 	struct rt_msghdr *rtm;
1679 	boolean_t save = FALSE;
1680 	int msglen, w_bufleft;
1681 	void *ptr;
1682 
1683 	rttable_entry_rtinfo(&rtinfo, rn);
1684 	msglen = rt_msgsize(RTM_GET, &rtinfo);
1685 
1686 	w_bufleft = w->w_bufsz - w->w_buflen;
1687 
1688 	if (rn->rn_dupedkey != NULL) {
1689 		struct radix_node *rn1 = rn;
1690 		int total_msglen = msglen;
1691 
1692 		/*
1693 		 * Make sure that we have enough space left for all
1694 		 * dupedkeys, since rn_walktree_at always starts
1695 		 * from the first dupedkey.
1696 		 */
1697 		while ((rn1 = rn1->rn_dupedkey) != NULL) {
1698 			struct rt_addrinfo rtinfo1;
1699 			int msglen1;
1700 
1701 			if (rn1->rn_flags & RNF_ROOT)
1702 				continue;
1703 
1704 			rttable_entry_rtinfo(&rtinfo1, rn1);
1705 			msglen1 = rt_msgsize(RTM_GET, &rtinfo1);
1706 			total_msglen += msglen1;
1707 		}
1708 
1709 		if (total_msglen > w_bufleft) {
1710 			if (total_msglen > w->w_bufsz) {
1711 				static int logged = 0;
1712 
1713 				if (!logged) {
1714 					kprintf("buffer is too small for "
1715 					    "all dupedkeys, increase "
1716 					    "RTTABLE_DUMP_MSGCNT_MAX\n");
1717 					logged = 1;
1718 				}
1719 				return ENOMEM;
1720 			}
1721 			save = TRUE;
1722 		}
1723 	} else if (msglen > w_bufleft) {
1724 		save = TRUE;
1725 	}
1726 
1727 	if (save) {
1728 		/*
1729 		 * Not enough buffer left; remember the position
1730 		 * to start from upon next round.
1731 		 */
1732 		KASSERT(msglen <= w->w_bufsz, ("msg too long %d", msglen));
1733 
1734 		KASSERT(rtinfo.rti_dst->sa_len <= sizeof(w->w_key0),
1735 		    ("key too long %d", rtinfo.rti_dst->sa_len));
1736 		memset(&w->w_key0, 0, sizeof(w->w_key0));
1737 		memcpy(&w->w_key0, rtinfo.rti_dst, rtinfo.rti_dst->sa_len);
1738 		w->w_key = (const char *)&w->w_key0;
1739 
1740 		if (rtinfo.rti_netmask != NULL) {
1741 			KASSERT(
1742 			    rtinfo.rti_netmask->sa_len <= sizeof(w->w_mask0),
1743 			    ("mask too long %d", rtinfo.rti_netmask->sa_len));
1744 			memset(&w->w_mask0, 0, sizeof(w->w_mask0));
1745 			memcpy(&w->w_mask0, rtinfo.rti_netmask,
1746 			    rtinfo.rti_netmask->sa_len);
1747 			w->w_mask = (const char *)&w->w_mask0;
1748 		} else {
1749 			w->w_mask = NULL;
1750 		}
1751 		return EJUSTRETURN;
1752 	}
1753 
1754 	if (w->w_op == NET_RT_FLAGS && !(rt->rt_flags & w->w_arg))
1755 		return 0;
1756 
1757 	ptr = ((uint8_t *)w->w_buf) + w->w_buflen;
1758 	rt_msg_buffer(RTM_GET, &rtinfo, ptr, msglen);
1759 
1760 	rtm = (struct rt_msghdr *)ptr;
1761 	rtm->rtm_flags = rt->rt_flags;
1762 	rtm->rtm_use = rt->rt_use;
1763 	rtm->rtm_rmx = rt->rt_rmx;
1764 	rtm->rtm_index = rt->rt_ifp->if_index;
1765 	rtm->rtm_errno = rtm->rtm_pid = rtm->rtm_seq = 0;
1766 	rtm->rtm_addrs = rtinfo.rti_addrs;
1767 
1768 	w->w_buflen += msglen;
1769 
1770 	return 0;
1771 }
1772 
1773 static void
1774 rttable_walk_dispatch(netmsg_t msg)
1775 {
1776 	struct netmsg_rttable_walk *nmsg = (struct netmsg_rttable_walk *)msg;
1777 	struct radix_node_head *rnh = rt_tables[mycpuid][nmsg->af];
1778 	struct rttable_walkarg *w = nmsg->w;
1779 	int error;
1780 
1781 	error = rnh->rnh_walktree_at(rnh, w->w_key, w->w_mask,
1782 	    rttable_walk_entry, w);
1783 	lwkt_replymsg(&nmsg->base.lmsg, error);
1784 }
1785 
1786 static int
1787 sysctl_rttable(int af, struct sysctl_req *req, int op, int arg)
1788 {
1789 	struct rttable_walkarg w;
1790 	int error, i;
1791 
1792 	error = rttable_walkarg_create(&w, op, arg);
1793 	if (error)
1794 		return error;
1795 
1796 	error = EINVAL;
1797 	for (i = 1; i <= AF_MAX; i++) {
1798 		if (rt_tables[mycpuid][i] != NULL && (af == 0 || af == i)) {
1799 			w.w_key = NULL;
1800 			w.w_mask = NULL;
1801 			for (;;) {
1802 				struct netmsg_rttable_walk nmsg;
1803 
1804 				netmsg_init(&nmsg.base, NULL,
1805 				    &curthread->td_msgport, 0,
1806 				    rttable_walk_dispatch);
1807 				nmsg.af = i;
1808 				nmsg.w = &w;
1809 
1810 				w.w_buflen = 0;
1811 
1812 				error = lwkt_domsg(netisr_cpuport(mycpuid),
1813 				    &nmsg.base.lmsg, 0);
1814 				if (error && error != EJUSTRETURN)
1815 					goto done;
1816 
1817 				if (req != NULL && w.w_buflen > 0) {
1818 					int error1;
1819 
1820 					error1 = SYSCTL_OUT(req, w.w_buf,
1821 					    w.w_buflen);
1822 					if (error1) {
1823 						error = error1;
1824 						goto done;
1825 					}
1826 				}
1827 				if (error == 0) /* done */
1828 					break;
1829 			}
1830 		}
1831 	}
1832 done:
1833 	rttable_walkarg_destroy(&w);
1834 	return error;
1835 }
1836 
1837 static int
1838 sysctl_rtsock(SYSCTL_HANDLER_ARGS)
1839 {
1840 	int	*name = (int *)arg1;
1841 	u_int	namelen = arg2;
1842 	int	error = EINVAL;
1843 	int	origcpu, cpu;
1844 	u_char  af;
1845 	struct	walkarg w;
1846 
1847 	name ++;
1848 	namelen--;
1849 	if (req->newptr)
1850 		return (EPERM);
1851 	if (namelen != 3 && namelen != 4)
1852 		return (EINVAL);
1853 	af = name[0];
1854 	bzero(&w, sizeof w);
1855 	w.w_op = name[1];
1856 	w.w_arg = name[2];
1857 	w.w_req = req;
1858 
1859 	/*
1860 	 * Optional third argument specifies cpu, used primarily for
1861 	 * debugging the route table.
1862 	 */
1863 	if (namelen == 4) {
1864 		if (name[3] < 0 || name[3] >= netisr_ncpus)
1865 			return (EINVAL);
1866 		cpu = name[3];
1867 	} else {
1868 		/*
1869 		 * Target cpu is not specified, use cpu0 then, so that
1870 		 * the result set will be relatively stable.
1871 		 */
1872 		cpu = 0;
1873 	}
1874 	origcpu = mycpuid;
1875 	lwkt_migratecpu(cpu);
1876 
1877 	switch (w.w_op) {
1878 	case NET_RT_DUMP:
1879 	case NET_RT_FLAGS:
1880 		error = sysctl_rttable(af, w.w_req, w.w_op, w.w_arg);
1881 		break;
1882 
1883 	case NET_RT_IFLIST:
1884 		error = sysctl_iflist(af, &w);
1885 		break;
1886 	}
1887 	if (w.w_tmem != NULL)
1888 		kfree(w.w_tmem, M_RTABLE);
1889 
1890 	lwkt_migratecpu(origcpu);
1891 	return (error);
1892 }
1893 
1894 SYSCTL_NODE(_net, PF_ROUTE, routetable, CTLFLAG_RD, sysctl_rtsock, "");
1895 
1896 /*
1897  * Definitions of protocols supported in the ROUTE domain.
1898  */
1899 
1900 static struct domain routedomain;		/* or at least forward */
1901 
1902 static struct protosw routesw[] = {
1903     {
1904 	.pr_type = SOCK_RAW,
1905 	.pr_domain = &routedomain,
1906 	.pr_protocol = 0,
1907 	.pr_flags = PR_ATOMIC|PR_ADDR,
1908 	.pr_input = NULL,
1909 	.pr_output = route_output,
1910 	.pr_ctlinput = raw_ctlinput,
1911 	.pr_ctloutput = route_ctloutput,
1912 	.pr_ctlport = cpu0_ctlport,
1913 
1914 	.pr_init = raw_init,
1915 	.pr_usrreqs = &route_usrreqs
1916     }
1917 };
1918 
1919 static struct domain routedomain = {
1920 	.dom_family		= AF_ROUTE,
1921 	.dom_name		= "route",
1922 	.dom_init		= NULL,
1923 	.dom_externalize	= NULL,
1924 	.dom_dispose		= NULL,
1925 	.dom_protosw		= routesw,
1926 	.dom_protoswNPROTOSW	= &routesw[NELEM(routesw)],
1927 	.dom_next		= SLIST_ENTRY_INITIALIZER,
1928 	.dom_rtattach		= NULL,
1929 	.dom_rtoffset		= 0,
1930 	.dom_maxrtkey		= 0,
1931 	.dom_ifattach		= NULL,
1932 	.dom_ifdetach		= NULL
1933 };
1934 
1935 DOMAIN_SET(route);
1936 
1937