xref: /dragonfly/sys/net/rtsock.c (revision 10cbe914)
1 /*
2  * Copyright (c) 2004, 2005 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Jeffrey M. Hsu.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of The DragonFly Project nor the names of its
16  *    contributors may be used to endorse or promote products derived
17  *    from this software without specific, prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
27  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
29  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1988, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. All advertising materials mentioning features or use of this software
46  *    must display the following acknowledgement:
47  *	This product includes software developed by the University of
48  *	California, Berkeley and its contributors.
49  * 4. Neither the name of the University nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63  * SUCH DAMAGE.
64  *
65  *	@(#)rtsock.c	8.7 (Berkeley) 10/12/95
66  * $FreeBSD: src/sys/net/rtsock.c,v 1.44.2.11 2002/12/04 14:05:41 ru Exp $
67  * $DragonFly: src/sys/net/rtsock.c,v 1.45 2008/10/27 02:56:30 sephe Exp $
68  */
69 
70 #include "opt_sctp.h"
71 
72 #include <sys/param.h>
73 #include <sys/systm.h>
74 #include <sys/kernel.h>
75 #include <sys/sysctl.h>
76 #include <sys/proc.h>
77 #include <sys/priv.h>
78 #include <sys/malloc.h>
79 #include <sys/mbuf.h>
80 #include <sys/protosw.h>
81 #include <sys/socket.h>
82 #include <sys/socketvar.h>
83 #include <sys/domain.h>
84 
85 #include <sys/thread2.h>
86 #include <sys/socketvar2.h>
87 
88 #include <net/if.h>
89 #include <net/route.h>
90 #include <net/raw_cb.h>
91 #include <net/netmsg2.h>
92 
93 #ifdef SCTP
94 extern void sctp_add_ip_address(struct ifaddr *ifa);
95 extern void sctp_delete_ip_address(struct ifaddr *ifa);
96 #endif /* SCTP */
97 
98 MALLOC_DEFINE(M_RTABLE, "routetbl", "routing tables");
99 
100 static struct route_cb {
101 	int	ip_count;
102 	int	ip6_count;
103 	int	ipx_count;
104 	int	ns_count;
105 	int	any_count;
106 } route_cb;
107 
108 static const struct sockaddr route_src = { 2, PF_ROUTE, };
109 
110 struct walkarg {
111 	int	w_tmemsize;
112 	int	w_op, w_arg;
113 	void	*w_tmem;
114 	struct sysctl_req *w_req;
115 };
116 
117 static struct mbuf *
118 		rt_msg_mbuf (int, struct rt_addrinfo *);
119 static void	rt_msg_buffer (int, struct rt_addrinfo *, void *buf, int len);
120 static int	rt_msgsize (int type, struct rt_addrinfo *rtinfo);
121 static int	rt_xaddrs (char *, char *, struct rt_addrinfo *);
122 static int	sysctl_dumpentry (struct radix_node *rn, void *vw);
123 static int	sysctl_iflist (int af, struct walkarg *w);
124 static int	route_output(struct mbuf *, struct socket *, ...);
125 static void	rt_setmetrics (u_long, struct rt_metrics *,
126 			       struct rt_metrics *);
127 
128 /*
129  * It really doesn't make any sense at all for this code to share much
130  * with raw_usrreq.c, since its functionality is so restricted.  XXX
131  */
132 static void
133 rts_abort(netmsg_t msg)
134 {
135 	crit_enter();
136 	raw_usrreqs.pru_abort(msg);
137 	/* msg invalid now */
138 	crit_exit();
139 }
140 
141 /* pru_accept is EOPNOTSUPP */
142 
143 static void
144 rts_attach(netmsg_t msg)
145 {
146 	struct socket *so = msg->base.nm_so;
147 	struct pru_attach_info *ai = msg->attach.nm_ai;
148 	struct rawcb *rp;
149 	int proto = msg->attach.nm_proto;
150 	int error;
151 
152 	crit_enter();
153 	if (sotorawcb(so) != NULL) {
154 		error = EISCONN;
155 		goto done;
156 	}
157 
158 	rp = kmalloc(sizeof *rp, M_PCB, M_WAITOK | M_ZERO);
159 
160 	/*
161 	 * The critical section is necessary to block protocols from sending
162 	 * error notifications (like RTM_REDIRECT or RTM_LOSING) while
163 	 * this PCB is extant but incompletely initialized.
164 	 * Probably we should try to do more of this work beforehand and
165 	 * eliminate the critical section.
166 	 */
167 	so->so_pcb = rp;
168 	soreference(so);	/* so_pcb assignment */
169 	error = raw_attach(so, proto, ai->sb_rlimit);
170 	rp = sotorawcb(so);
171 	if (error) {
172 		kfree(rp, M_PCB);
173 		goto done;
174 	}
175 	switch(rp->rcb_proto.sp_protocol) {
176 	case AF_INET:
177 		route_cb.ip_count++;
178 		break;
179 	case AF_INET6:
180 		route_cb.ip6_count++;
181 		break;
182 	case AF_IPX:
183 		route_cb.ipx_count++;
184 		break;
185 	case AF_NS:
186 		route_cb.ns_count++;
187 		break;
188 	}
189 	rp->rcb_faddr = &route_src;
190 	route_cb.any_count++;
191 	soisconnected(so);
192 	so->so_options |= SO_USELOOPBACK;
193 	error = 0;
194 done:
195 	crit_exit();
196 	lwkt_replymsg(&msg->lmsg, error);
197 }
198 
199 static void
200 rts_bind(netmsg_t msg)
201 {
202 	crit_enter();
203 	raw_usrreqs.pru_bind(msg); /* xxx just EINVAL */
204 	/* msg invalid now */
205 	crit_exit();
206 }
207 
208 static void
209 rts_connect(netmsg_t msg)
210 {
211 	crit_enter();
212 	raw_usrreqs.pru_connect(msg); /* XXX just EINVAL */
213 	/* msg invalid now */
214 	crit_exit();
215 }
216 
217 /* pru_connect2 is EOPNOTSUPP */
218 /* pru_control is EOPNOTSUPP */
219 
220 static void
221 rts_detach(netmsg_t msg)
222 {
223 	struct socket *so = msg->base.nm_so;
224 	struct rawcb *rp = sotorawcb(so);
225 
226 	crit_enter();
227 	if (rp != NULL) {
228 		switch(rp->rcb_proto.sp_protocol) {
229 		case AF_INET:
230 			route_cb.ip_count--;
231 			break;
232 		case AF_INET6:
233 			route_cb.ip6_count--;
234 			break;
235 		case AF_IPX:
236 			route_cb.ipx_count--;
237 			break;
238 		case AF_NS:
239 			route_cb.ns_count--;
240 			break;
241 		}
242 		route_cb.any_count--;
243 	}
244 	raw_usrreqs.pru_detach(msg);
245 	/* msg invalid now */
246 	crit_exit();
247 }
248 
249 static void
250 rts_disconnect(netmsg_t msg)
251 {
252 	crit_enter();
253 	raw_usrreqs.pru_disconnect(msg);
254 	/* msg invalid now */
255 	crit_exit();
256 }
257 
258 /* pru_listen is EOPNOTSUPP */
259 
260 static void
261 rts_peeraddr(netmsg_t msg)
262 {
263 	crit_enter();
264 	raw_usrreqs.pru_peeraddr(msg);
265 	/* msg invalid now */
266 	crit_exit();
267 }
268 
269 /* pru_rcvd is EOPNOTSUPP */
270 /* pru_rcvoob is EOPNOTSUPP */
271 
272 static void
273 rts_send(netmsg_t msg)
274 {
275 	crit_enter();
276 	raw_usrreqs.pru_send(msg);
277 	/* msg invalid now */
278 	crit_exit();
279 }
280 
281 /* pru_sense is null */
282 
283 static void
284 rts_shutdown(netmsg_t msg)
285 {
286 	crit_enter();
287 	raw_usrreqs.pru_shutdown(msg);
288 	/* msg invalid now */
289 	crit_exit();
290 }
291 
292 static void
293 rts_sockaddr(netmsg_t msg)
294 {
295 	crit_enter();
296 	raw_usrreqs.pru_sockaddr(msg);
297 	/* msg invalid now */
298 	crit_exit();
299 }
300 
301 static struct pr_usrreqs route_usrreqs = {
302 	.pru_abort = rts_abort,
303 	.pru_accept = pr_generic_notsupp,
304 	.pru_attach = rts_attach,
305 	.pru_bind = rts_bind,
306 	.pru_connect = rts_connect,
307 	.pru_connect2 = pr_generic_notsupp,
308 	.pru_control = pr_generic_notsupp,
309 	.pru_detach = rts_detach,
310 	.pru_disconnect = rts_disconnect,
311 	.pru_listen = pr_generic_notsupp,
312 	.pru_peeraddr = rts_peeraddr,
313 	.pru_rcvd = pr_generic_notsupp,
314 	.pru_rcvoob = pr_generic_notsupp,
315 	.pru_send = rts_send,
316 	.pru_sense = pru_sense_null,
317 	.pru_shutdown = rts_shutdown,
318 	.pru_sockaddr = rts_sockaddr,
319 	.pru_sosend = sosend,
320 	.pru_soreceive = soreceive
321 };
322 
323 static __inline sa_family_t
324 familyof(struct sockaddr *sa)
325 {
326 	return (sa != NULL ? sa->sa_family : 0);
327 }
328 
329 /*
330  * Routing socket input function.  The packet must be serialized onto cpu 0.
331  * We use the cpu0_soport() netisr processing loop to handle it.
332  *
333  * This looks messy but it means that anyone, including interrupt code,
334  * can send a message to the routing socket.
335  */
336 static void
337 rts_input_handler(netmsg_t msg)
338 {
339 	static const struct sockaddr route_dst = { 2, PF_ROUTE, };
340 	struct sockproto route_proto;
341 	struct netmsg_packet *pmsg = &msg->packet;
342 	struct mbuf *m;
343 	sa_family_t family;
344 	struct rawcb *skip;
345 
346 	family = pmsg->base.lmsg.u.ms_result;
347 	route_proto.sp_family = PF_ROUTE;
348 	route_proto.sp_protocol = family;
349 
350 	m = pmsg->nm_packet;
351 	M_ASSERTPKTHDR(m);
352 
353 	skip = m->m_pkthdr.header;
354 	m->m_pkthdr.header = NULL;
355 
356 	raw_input(m, &route_proto, &route_src, &route_dst, skip);
357 }
358 
359 static void
360 rts_input_skip(struct mbuf *m, sa_family_t family, struct rawcb *skip)
361 {
362 	struct netmsg_packet *pmsg;
363 	lwkt_port_t port;
364 
365 	M_ASSERTPKTHDR(m);
366 
367 	port = cpu_portfn(0);	/* XXX same as for routing socket */
368 	pmsg = &m->m_hdr.mh_netmsg;
369 	netmsg_init(&pmsg->base, NULL, &netisr_apanic_rport,
370 		    0, rts_input_handler);
371 	pmsg->nm_packet = m;
372 	pmsg->base.lmsg.u.ms_result = family;
373 	m->m_pkthdr.header = skip; /* XXX steal field in pkthdr */
374 	lwkt_sendmsg(port, &pmsg->base.lmsg);
375 }
376 
377 static __inline void
378 rts_input(struct mbuf *m, sa_family_t family)
379 {
380 	rts_input_skip(m, family, NULL);
381 }
382 
383 static void *
384 reallocbuf_nofree(void *ptr, size_t len, size_t olen)
385 {
386 	void *newptr;
387 
388 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
389 	if (newptr == NULL)
390 		return NULL;
391 	bcopy(ptr, newptr, olen);
392 	return (newptr);
393 }
394 
395 /*
396  * Internal helper routine for route_output().
397  */
398 static int
399 _fillrtmsg(struct rt_msghdr **prtm, struct rtentry *rt,
400 	   struct rt_addrinfo *rtinfo)
401 {
402 	int msglen;
403 	struct rt_msghdr *rtm = *prtm;
404 
405 	/* Fill in rt_addrinfo for call to rt_msg_buffer(). */
406 	rtinfo->rti_dst = rt_key(rt);
407 	rtinfo->rti_gateway = rt->rt_gateway;
408 	rtinfo->rti_netmask = rt_mask(rt);		/* might be NULL */
409 	rtinfo->rti_genmask = rt->rt_genmask;		/* might be NULL */
410 	if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
411 		if (rt->rt_ifp != NULL) {
412 			rtinfo->rti_ifpaddr =
413 			    TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])
414 			    ->ifa->ifa_addr;
415 			rtinfo->rti_ifaaddr = rt->rt_ifa->ifa_addr;
416 			if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
417 				rtinfo->rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
418 			rtm->rtm_index = rt->rt_ifp->if_index;
419 		} else {
420 			rtinfo->rti_ifpaddr = NULL;
421 			rtinfo->rti_ifaaddr = NULL;
422 		}
423 	} else if (rt->rt_ifp != NULL) {
424 		rtm->rtm_index = rt->rt_ifp->if_index;
425 	}
426 
427 	msglen = rt_msgsize(rtm->rtm_type, rtinfo);
428 	if (rtm->rtm_msglen < msglen) {
429 		/* NOTE: Caller will free the old rtm accordingly */
430 		rtm = reallocbuf_nofree(rtm, msglen, rtm->rtm_msglen);
431 		if (rtm == NULL)
432 			return (ENOBUFS);
433 		*prtm = rtm;
434 	}
435 	rt_msg_buffer(rtm->rtm_type, rtinfo, rtm, msglen);
436 
437 	rtm->rtm_flags = rt->rt_flags;
438 	rtm->rtm_rmx = rt->rt_rmx;
439 	rtm->rtm_addrs = rtinfo->rti_addrs;
440 
441 	return (0);
442 }
443 
444 struct rtm_arg {
445 	struct rt_msghdr	*bak_rtm;
446 	struct rt_msghdr	*new_rtm;
447 };
448 
449 static int
450 fillrtmsg(struct rtm_arg *arg, struct rtentry *rt,
451 	  struct rt_addrinfo *rtinfo)
452 {
453 	struct rt_msghdr *rtm = arg->new_rtm;
454 	int error;
455 
456 	error = _fillrtmsg(&rtm, rt, rtinfo);
457 	if (!error) {
458 		if (arg->new_rtm != rtm) {
459 			/*
460 			 * _fillrtmsg() just allocated a new rtm;
461 			 * if the previously allocated rtm is not
462 			 * the backing rtm, it should be freed.
463 			 */
464 			if (arg->new_rtm != arg->bak_rtm)
465 				kfree(arg->new_rtm, M_RTABLE);
466 			arg->new_rtm = rtm;
467 		}
468 	}
469 	return error;
470 }
471 
472 static void route_output_add_callback(int, int, struct rt_addrinfo *,
473 					struct rtentry *, void *);
474 static void route_output_delete_callback(int, int, struct rt_addrinfo *,
475 					struct rtentry *, void *);
476 static int route_output_get_callback(int, struct rt_addrinfo *,
477 				     struct rtentry *, void *, int);
478 static int route_output_change_callback(int, struct rt_addrinfo *,
479 					struct rtentry *, void *, int);
480 static int route_output_lock_callback(int, struct rt_addrinfo *,
481 				      struct rtentry *, void *, int);
482 
483 /*ARGSUSED*/
484 static int
485 route_output(struct mbuf *m, struct socket *so, ...)
486 {
487 	struct rtm_arg arg;
488 	struct rt_msghdr *rtm = NULL;
489 	struct rawcb *rp = NULL;
490 	struct pr_output_info *oi;
491 	struct rt_addrinfo rtinfo;
492 	sa_family_t family;
493 	int len, error = 0;
494 	__va_list ap;
495 
496 	M_ASSERTPKTHDR(m);
497 
498 	__va_start(ap, so);
499 	oi = __va_arg(ap, struct pr_output_info *);
500 	__va_end(ap);
501 
502 	family = familyof(NULL);
503 
504 #define gotoerr(e) { error = e; goto flush;}
505 
506 	if (m == NULL ||
507 	    (m->m_len < sizeof(long) &&
508 	     (m = m_pullup(m, sizeof(long))) == NULL))
509 		return (ENOBUFS);
510 	len = m->m_pkthdr.len;
511 	if (len < sizeof(struct rt_msghdr) ||
512 	    len != mtod(m, struct rt_msghdr *)->rtm_msglen)
513 		gotoerr(EINVAL);
514 
515 	rtm = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
516 	if (rtm == NULL)
517 		gotoerr(ENOBUFS);
518 
519 	m_copydata(m, 0, len, (caddr_t)rtm);
520 	if (rtm->rtm_version != RTM_VERSION)
521 		gotoerr(EPROTONOSUPPORT);
522 
523 	rtm->rtm_pid = oi->p_pid;
524 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
525 	rtinfo.rti_addrs = rtm->rtm_addrs;
526 	if (rt_xaddrs((char *)(rtm + 1), (char *)rtm + len, &rtinfo) != 0)
527 		gotoerr(EINVAL);
528 
529 	rtinfo.rti_flags = rtm->rtm_flags;
530 	if (rtinfo.rti_dst == NULL || rtinfo.rti_dst->sa_family >= AF_MAX ||
531 	    (rtinfo.rti_gateway && rtinfo.rti_gateway->sa_family >= AF_MAX))
532 		gotoerr(EINVAL);
533 
534 	family = familyof(rtinfo.rti_dst);
535 
536 	if (rtinfo.rti_genmask != NULL) {
537 		error = rtmask_add_global(rtinfo.rti_genmask);
538 		if (error)
539 			goto flush;
540 	}
541 
542 	/*
543 	 * Verify that the caller has the appropriate privilege; RTM_GET
544 	 * is the only operation the non-superuser is allowed.
545 	 */
546 	if (rtm->rtm_type != RTM_GET &&
547 	    priv_check_cred(so->so_cred, PRIV_ROOT, 0) != 0)
548 		gotoerr(EPERM);
549 
550 	switch (rtm->rtm_type) {
551 	case RTM_ADD:
552 		if (rtinfo.rti_gateway == NULL) {
553 			error = EINVAL;
554 		} else {
555 			error = rtrequest1_global(RTM_ADD, &rtinfo,
556 					  route_output_add_callback, rtm);
557 		}
558 		break;
559 	case RTM_DELETE:
560 		/*
561 		 * Backing rtm (bak_rtm) could _not_ be freed during
562 		 * rtrequest1_global or rtsearch_global, even if the
563 		 * callback reallocates the rtm due to its size changes,
564 		 * since rtinfo points to the backing rtm's memory area.
565 		 * After rtrequest1_global or rtsearch_global returns,
566 		 * it is safe to free the backing rtm, since rtinfo will
567 		 * not be used anymore.
568 		 *
569 		 * new_rtm will be used to save the new rtm allocated
570 		 * by rtrequest1_global or rtsearch_global.
571 		 */
572 		arg.bak_rtm = rtm;
573 		arg.new_rtm = rtm;
574 		error = rtrequest1_global(RTM_DELETE, &rtinfo,
575 					  route_output_delete_callback, &arg);
576 		rtm = arg.new_rtm;
577 		if (rtm != arg.bak_rtm)
578 			kfree(arg.bak_rtm, M_RTABLE);
579 		break;
580 	case RTM_GET:
581 		/* See the comment in RTM_DELETE */
582 		arg.bak_rtm = rtm;
583 		arg.new_rtm = rtm;
584 		error = rtsearch_global(RTM_GET, &rtinfo,
585 					route_output_get_callback, &arg,
586 					RTS_NOEXACTMATCH);
587 		rtm = arg.new_rtm;
588 		if (rtm != arg.bak_rtm)
589 			kfree(arg.bak_rtm, M_RTABLE);
590 		break;
591 	case RTM_CHANGE:
592 		error = rtsearch_global(RTM_CHANGE, &rtinfo,
593 					route_output_change_callback, rtm,
594 					RTS_EXACTMATCH);
595 		break;
596 	case RTM_LOCK:
597 		error = rtsearch_global(RTM_LOCK, &rtinfo,
598 					route_output_lock_callback, rtm,
599 					RTS_EXACTMATCH);
600 		break;
601 	default:
602 		error = EOPNOTSUPP;
603 		break;
604 	}
605 flush:
606 	if (rtm != NULL) {
607 		if (error != 0)
608 			rtm->rtm_errno = error;
609 		else
610 			rtm->rtm_flags |= RTF_DONE;
611 	}
612 
613 	/*
614 	 * Check to see if we don't want our own messages.
615 	 */
616 	if (!(so->so_options & SO_USELOOPBACK)) {
617 		if (route_cb.any_count <= 1) {
618 			if (rtm != NULL)
619 				kfree(rtm, M_RTABLE);
620 			m_freem(m);
621 			return (error);
622 		}
623 		/* There is another listener, so construct message */
624 		rp = sotorawcb(so);
625 	}
626 	if (rtm != NULL) {
627 		m_copyback(m, 0, rtm->rtm_msglen, (caddr_t)rtm);
628 		if (m->m_pkthdr.len < rtm->rtm_msglen) {
629 			m_freem(m);
630 			m = NULL;
631 		} else if (m->m_pkthdr.len > rtm->rtm_msglen)
632 			m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
633 		kfree(rtm, M_RTABLE);
634 	}
635 	if (m != NULL)
636 		rts_input_skip(m, family, rp);
637 	return (error);
638 }
639 
640 static void
641 route_output_add_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
642 			  struct rtentry *rt, void *arg)
643 {
644 	struct rt_msghdr *rtm = arg;
645 
646 	if (error == 0 && rt != NULL) {
647 		rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx,
648 		    &rt->rt_rmx);
649 		rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
650 		rt->rt_rmx.rmx_locks |=
651 		    (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
652 		if (rtinfo->rti_genmask != NULL) {
653 			rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
654 			if (rt->rt_genmask == NULL) {
655 				/*
656 				 * This should not happen, since we
657 				 * have already installed genmask
658 				 * on each CPU before we reach here.
659 				 */
660 				panic("genmask is gone!?");
661 			}
662 		} else {
663 			rt->rt_genmask = NULL;
664 		}
665 		rtm->rtm_index = rt->rt_ifp->if_index;
666 	}
667 }
668 
669 static void
670 route_output_delete_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
671 			  struct rtentry *rt, void *arg)
672 {
673 	if (error == 0 && rt) {
674 		++rt->rt_refcnt;
675 		if (fillrtmsg(arg, rt, rtinfo) != 0) {
676 			error = ENOBUFS;
677 			/* XXX no way to return the error */
678 		}
679 		--rt->rt_refcnt;
680 	}
681 	if (rt && rt->rt_refcnt == 0) {
682 		++rt->rt_refcnt;
683 		rtfree(rt);
684 	}
685 }
686 
687 static int
688 route_output_get_callback(int cmd, struct rt_addrinfo *rtinfo,
689 			  struct rtentry *rt, void *arg, int found_cnt)
690 {
691 	int error, found = 0;
692 
693 	if (((rtinfo->rti_flags ^ rt->rt_flags) & RTF_HOST) == 0)
694 		found = 1;
695 
696 	error = fillrtmsg(arg, rt, rtinfo);
697 	if (!error && found) {
698 		/* Got the exact match, we could return now! */
699 		error = EJUSTRETURN;
700 	}
701 	return error;
702 }
703 
704 static int
705 route_output_change_callback(int cmd, struct rt_addrinfo *rtinfo,
706 			     struct rtentry *rt, void *arg, int found_cnt)
707 {
708 	struct rt_msghdr *rtm = arg;
709 	struct ifaddr *ifa;
710 	int error = 0;
711 
712 	/*
713 	 * new gateway could require new ifaddr, ifp;
714 	 * flags may also be different; ifp may be specified
715 	 * by ll sockaddr when protocol address is ambiguous
716 	 */
717 	if (((rt->rt_flags & RTF_GATEWAY) && rtinfo->rti_gateway != NULL) ||
718 	    rtinfo->rti_ifpaddr != NULL ||
719 	    (rtinfo->rti_ifaaddr != NULL &&
720 	     !sa_equal(rtinfo->rti_ifaaddr, rt->rt_ifa->ifa_addr))) {
721 		error = rt_getifa(rtinfo);
722 		if (error != 0)
723 			goto done;
724 	}
725 	if (rtinfo->rti_gateway != NULL) {
726 		/*
727 		 * We only need to generate rtmsg upon the
728 		 * first route to be changed.
729 		 */
730 		error = rt_setgate(rt, rt_key(rt), rtinfo->rti_gateway,
731 			found_cnt == 1 ? RTL_REPORTMSG : RTL_DONTREPORT);
732 		if (error != 0)
733 			goto done;
734 	}
735 	if ((ifa = rtinfo->rti_ifa) != NULL) {
736 		struct ifaddr *oifa = rt->rt_ifa;
737 
738 		if (oifa != ifa) {
739 			if (oifa && oifa->ifa_rtrequest)
740 				oifa->ifa_rtrequest(RTM_DELETE, rt, rtinfo);
741 			IFAFREE(rt->rt_ifa);
742 			IFAREF(ifa);
743 			rt->rt_ifa = ifa;
744 			rt->rt_ifp = rtinfo->rti_ifp;
745 		}
746 	}
747 	rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx, &rt->rt_rmx);
748 	if (rt->rt_ifa && rt->rt_ifa->ifa_rtrequest)
749 		rt->rt_ifa->ifa_rtrequest(RTM_ADD, rt, rtinfo);
750 	if (rtinfo->rti_genmask != NULL) {
751 		rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
752 		if (rt->rt_genmask == NULL) {
753 			/*
754 			 * This should not happen, since we
755 			 * have already installed genmask
756 			 * on each CPU before we reach here.
757 			 */
758 			panic("genmask is gone!?\n");
759 		}
760 	}
761 	rtm->rtm_index = rt->rt_ifp->if_index;
762 done:
763 	return error;
764 }
765 
766 static int
767 route_output_lock_callback(int cmd, struct rt_addrinfo *rtinfo,
768 			   struct rtentry *rt, void *arg,
769 			   int found_cnt __unused)
770 {
771 	struct rt_msghdr *rtm = arg;
772 
773 	rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
774 	rt->rt_rmx.rmx_locks |=
775 		(rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
776 	return 0;
777 }
778 
779 static void
780 rt_setmetrics(u_long which, struct rt_metrics *in, struct rt_metrics *out)
781 {
782 #define setmetric(flag, elt) if (which & (flag)) out->elt = in->elt;
783 	setmetric(RTV_RPIPE, rmx_recvpipe);
784 	setmetric(RTV_SPIPE, rmx_sendpipe);
785 	setmetric(RTV_SSTHRESH, rmx_ssthresh);
786 	setmetric(RTV_RTT, rmx_rtt);
787 	setmetric(RTV_RTTVAR, rmx_rttvar);
788 	setmetric(RTV_HOPCOUNT, rmx_hopcount);
789 	setmetric(RTV_MTU, rmx_mtu);
790 	setmetric(RTV_EXPIRE, rmx_expire);
791 #undef setmetric
792 }
793 
794 #define ROUNDUP(a) \
795 	((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long))
796 
797 /*
798  * Extract the addresses of the passed sockaddrs.
799  * Do a little sanity checking so as to avoid bad memory references.
800  * This data is derived straight from userland.
801  */
802 static int
803 rt_xaddrs(char *cp, char *cplim, struct rt_addrinfo *rtinfo)
804 {
805 	struct sockaddr *sa;
806 	int i;
807 
808 	for (i = 0; (i < RTAX_MAX) && (cp < cplim); i++) {
809 		if ((rtinfo->rti_addrs & (1 << i)) == 0)
810 			continue;
811 		sa = (struct sockaddr *)cp;
812 		/*
813 		 * It won't fit.
814 		 */
815 		if ((cp + sa->sa_len) > cplim) {
816 			return (EINVAL);
817 		}
818 
819 		/*
820 		 * There are no more...  Quit now.
821 		 * If there are more bits, they are in error.
822 		 * I've seen this.  route(1) can evidently generate these.
823 		 * This causes kernel to core dump.
824 		 * For compatibility, if we see this, point to a safe address.
825 		 */
826 		if (sa->sa_len == 0) {
827 			static struct sockaddr sa_zero = {
828 				sizeof sa_zero, AF_INET,
829 			};
830 
831 			rtinfo->rti_info[i] = &sa_zero;
832 			kprintf("rtsock: received more addr bits than sockaddrs.\n");
833 			return (0); /* should be EINVAL but for compat */
834 		}
835 
836 		/* Accept the sockaddr. */
837 		rtinfo->rti_info[i] = sa;
838 		cp += ROUNDUP(sa->sa_len);
839 	}
840 	return (0);
841 }
842 
843 static int
844 rt_msghdrsize(int type)
845 {
846 	switch (type) {
847 	case RTM_DELADDR:
848 	case RTM_NEWADDR:
849 		return sizeof(struct ifa_msghdr);
850 	case RTM_DELMADDR:
851 	case RTM_NEWMADDR:
852 		return sizeof(struct ifma_msghdr);
853 	case RTM_IFINFO:
854 		return sizeof(struct if_msghdr);
855 	case RTM_IFANNOUNCE:
856 	case RTM_IEEE80211:
857 		return sizeof(struct if_announcemsghdr);
858 	default:
859 		return sizeof(struct rt_msghdr);
860 	}
861 }
862 
863 static int
864 rt_msgsize(int type, struct rt_addrinfo *rtinfo)
865 {
866 	int len, i;
867 
868 	len = rt_msghdrsize(type);
869 	for (i = 0; i < RTAX_MAX; i++) {
870 		if (rtinfo->rti_info[i] != NULL)
871 			len += ROUNDUP(rtinfo->rti_info[i]->sa_len);
872 	}
873 	len = ALIGN(len);
874 	return len;
875 }
876 
877 /*
878  * Build a routing message in a buffer.
879  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
880  * to the end of the buffer after the message header.
881  *
882  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
883  * This side-effect can be avoided if we reorder the addrs bitmask field in all
884  * the route messages to line up so we can set it here instead of back in the
885  * calling routine.
886  */
887 static void
888 rt_msg_buffer(int type, struct rt_addrinfo *rtinfo, void *buf, int msglen)
889 {
890 	struct rt_msghdr *rtm;
891 	char *cp;
892 	int dlen, i;
893 
894 	rtm = (struct rt_msghdr *) buf;
895 	rtm->rtm_version = RTM_VERSION;
896 	rtm->rtm_type = type;
897 	rtm->rtm_msglen = msglen;
898 
899 	cp = (char *)buf + rt_msghdrsize(type);
900 	rtinfo->rti_addrs = 0;
901 	for (i = 0; i < RTAX_MAX; i++) {
902 		struct sockaddr *sa;
903 
904 		if ((sa = rtinfo->rti_info[i]) == NULL)
905 			continue;
906 		rtinfo->rti_addrs |= (1 << i);
907 		dlen = ROUNDUP(sa->sa_len);
908 		bcopy(sa, cp, dlen);
909 		cp += dlen;
910 	}
911 }
912 
913 /*
914  * Build a routing message in a mbuf chain.
915  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
916  * to the end of the mbuf after the message header.
917  *
918  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
919  * This side-effect can be avoided if we reorder the addrs bitmask field in all
920  * the route messages to line up so we can set it here instead of back in the
921  * calling routine.
922  */
923 static struct mbuf *
924 rt_msg_mbuf(int type, struct rt_addrinfo *rtinfo)
925 {
926 	struct mbuf *m;
927 	struct rt_msghdr *rtm;
928 	int hlen, len;
929 	int i;
930 
931 	hlen = rt_msghdrsize(type);
932 	KASSERT(hlen <= MCLBYTES, ("rt_msg_mbuf: hlen %d doesn't fit", hlen));
933 
934 	m = m_getl(hlen, MB_DONTWAIT, MT_DATA, M_PKTHDR, NULL);
935 	if (m == NULL)
936 		return (NULL);
937 	mbuftrackid(m, 32);
938 	m->m_pkthdr.len = m->m_len = hlen;
939 	m->m_pkthdr.rcvif = NULL;
940 	rtinfo->rti_addrs = 0;
941 	len = hlen;
942 	for (i = 0; i < RTAX_MAX; i++) {
943 		struct sockaddr *sa;
944 		int dlen;
945 
946 		if ((sa = rtinfo->rti_info[i]) == NULL)
947 			continue;
948 		rtinfo->rti_addrs |= (1 << i);
949 		dlen = ROUNDUP(sa->sa_len);
950 		m_copyback(m, len, dlen, (caddr_t)sa); /* can grow mbuf chain */
951 		len += dlen;
952 	}
953 	if (m->m_pkthdr.len != len) { /* one of the m_copyback() calls failed */
954 		m_freem(m);
955 		return (NULL);
956 	}
957 	rtm = mtod(m, struct rt_msghdr *);
958 	bzero(rtm, hlen);
959 	rtm->rtm_msglen = len;
960 	rtm->rtm_version = RTM_VERSION;
961 	rtm->rtm_type = type;
962 	return (m);
963 }
964 
965 /*
966  * This routine is called to generate a message from the routing
967  * socket indicating that a redirect has occurred, a routing lookup
968  * has failed, or that a protocol has detected timeouts to a particular
969  * destination.
970  */
971 void
972 rt_missmsg(int type, struct rt_addrinfo *rtinfo, int flags, int error)
973 {
974 	struct sockaddr *dst = rtinfo->rti_info[RTAX_DST];
975 	struct rt_msghdr *rtm;
976 	struct mbuf *m;
977 
978 	if (route_cb.any_count == 0)
979 		return;
980 	m = rt_msg_mbuf(type, rtinfo);
981 	if (m == NULL)
982 		return;
983 	rtm = mtod(m, struct rt_msghdr *);
984 	rtm->rtm_flags = RTF_DONE | flags;
985 	rtm->rtm_errno = error;
986 	rtm->rtm_addrs = rtinfo->rti_addrs;
987 	rts_input(m, familyof(dst));
988 }
989 
990 void
991 rt_dstmsg(int type, struct sockaddr *dst, int error)
992 {
993 	struct rt_msghdr *rtm;
994 	struct rt_addrinfo addrs;
995 	struct mbuf *m;
996 
997 	if (route_cb.any_count == 0)
998 		return;
999 	bzero(&addrs, sizeof(struct rt_addrinfo));
1000 	addrs.rti_info[RTAX_DST] = dst;
1001 	m = rt_msg_mbuf(type, &addrs);
1002 	if (m == NULL)
1003 		return;
1004 	rtm = mtod(m, struct rt_msghdr *);
1005 	rtm->rtm_flags = RTF_DONE;
1006 	rtm->rtm_errno = error;
1007 	rtm->rtm_addrs = addrs.rti_addrs;
1008 	rts_input(m, familyof(dst));
1009 }
1010 
1011 /*
1012  * This routine is called to generate a message from the routing
1013  * socket indicating that the status of a network interface has changed.
1014  */
1015 void
1016 rt_ifmsg(struct ifnet *ifp)
1017 {
1018 	struct if_msghdr *ifm;
1019 	struct mbuf *m;
1020 	struct rt_addrinfo rtinfo;
1021 
1022 	if (route_cb.any_count == 0)
1023 		return;
1024 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1025 	m = rt_msg_mbuf(RTM_IFINFO, &rtinfo);
1026 	if (m == NULL)
1027 		return;
1028 	ifm = mtod(m, struct if_msghdr *);
1029 	ifm->ifm_index = ifp->if_index;
1030 	ifm->ifm_flags = ifp->if_flags;
1031 	ifm->ifm_data = ifp->if_data;
1032 	ifm->ifm_addrs = 0;
1033 	rts_input(m, 0);
1034 }
1035 
1036 static void
1037 rt_ifamsg(int cmd, struct ifaddr *ifa)
1038 {
1039 	struct ifa_msghdr *ifam;
1040 	struct rt_addrinfo rtinfo;
1041 	struct mbuf *m;
1042 	struct ifnet *ifp = ifa->ifa_ifp;
1043 
1044 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1045 	rtinfo.rti_ifaaddr = ifa->ifa_addr;
1046 	rtinfo.rti_ifpaddr =
1047 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1048 	rtinfo.rti_netmask = ifa->ifa_netmask;
1049 	rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1050 
1051 	m = rt_msg_mbuf(cmd, &rtinfo);
1052 	if (m == NULL)
1053 		return;
1054 
1055 	ifam = mtod(m, struct ifa_msghdr *);
1056 	ifam->ifam_index = ifp->if_index;
1057 	ifam->ifam_metric = ifa->ifa_metric;
1058 	ifam->ifam_flags = ifa->ifa_flags;
1059 	ifam->ifam_addrs = rtinfo.rti_addrs;
1060 
1061 	rts_input(m, familyof(ifa->ifa_addr));
1062 }
1063 
1064 void
1065 rt_rtmsg(int cmd, struct rtentry *rt, struct ifnet *ifp, int error)
1066 {
1067 	struct rt_msghdr *rtm;
1068 	struct rt_addrinfo rtinfo;
1069 	struct mbuf *m;
1070 	struct sockaddr *dst;
1071 
1072 	if (rt == NULL)
1073 		return;
1074 
1075 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1076 	rtinfo.rti_dst = dst = rt_key(rt);
1077 	rtinfo.rti_gateway = rt->rt_gateway;
1078 	rtinfo.rti_netmask = rt_mask(rt);
1079 	if (ifp != NULL) {
1080 		rtinfo.rti_ifpaddr =
1081 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1082 	}
1083 	rtinfo.rti_ifaaddr = rt->rt_ifa->ifa_addr;
1084 
1085 	m = rt_msg_mbuf(cmd, &rtinfo);
1086 	if (m == NULL)
1087 		return;
1088 
1089 	rtm = mtod(m, struct rt_msghdr *);
1090 	if (ifp != NULL)
1091 		rtm->rtm_index = ifp->if_index;
1092 	rtm->rtm_flags |= rt->rt_flags;
1093 	rtm->rtm_errno = error;
1094 	rtm->rtm_addrs = rtinfo.rti_addrs;
1095 
1096 	rts_input(m, familyof(dst));
1097 }
1098 
1099 /*
1100  * This is called to generate messages from the routing socket
1101  * indicating a network interface has had addresses associated with it.
1102  * if we ever reverse the logic and replace messages TO the routing
1103  * socket indicate a request to configure interfaces, then it will
1104  * be unnecessary as the routing socket will automatically generate
1105  * copies of it.
1106  */
1107 void
1108 rt_newaddrmsg(int cmd, struct ifaddr *ifa, int error, struct rtentry *rt)
1109 {
1110 #ifdef SCTP
1111 	/*
1112 	 * notify the SCTP stack
1113 	 * this will only get called when an address is added/deleted
1114 	 * XXX pass the ifaddr struct instead if ifa->ifa_addr...
1115 	 */
1116 	if (cmd == RTM_ADD)
1117 		sctp_add_ip_address(ifa);
1118 	else if (cmd == RTM_DELETE)
1119 		sctp_delete_ip_address(ifa);
1120 #endif /* SCTP */
1121 
1122 	if (route_cb.any_count == 0)
1123 		return;
1124 
1125 	if (cmd == RTM_ADD) {
1126 		rt_ifamsg(RTM_NEWADDR, ifa);
1127 		rt_rtmsg(RTM_ADD, rt, ifa->ifa_ifp, error);
1128 	} else {
1129 		KASSERT((cmd == RTM_DELETE), ("unknown cmd %d", cmd));
1130 		rt_rtmsg(RTM_DELETE, rt, ifa->ifa_ifp, error);
1131 		rt_ifamsg(RTM_DELADDR, ifa);
1132 	}
1133 }
1134 
1135 /*
1136  * This is the analogue to the rt_newaddrmsg which performs the same
1137  * function but for multicast group memberhips.  This is easier since
1138  * there is no route state to worry about.
1139  */
1140 void
1141 rt_newmaddrmsg(int cmd, struct ifmultiaddr *ifma)
1142 {
1143 	struct rt_addrinfo rtinfo;
1144 	struct mbuf *m = NULL;
1145 	struct ifnet *ifp = ifma->ifma_ifp;
1146 	struct ifma_msghdr *ifmam;
1147 
1148 	if (route_cb.any_count == 0)
1149 		return;
1150 
1151 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1152 	rtinfo.rti_ifaaddr = ifma->ifma_addr;
1153 	if (ifp != NULL && !TAILQ_EMPTY(&ifp->if_addrheads[mycpuid])) {
1154 		rtinfo.rti_ifpaddr =
1155 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1156 	}
1157 	/*
1158 	 * If a link-layer address is present, present it as a ``gateway''
1159 	 * (similarly to how ARP entries, e.g., are presented).
1160 	 */
1161 	rtinfo.rti_gateway = ifma->ifma_lladdr;
1162 
1163 	m = rt_msg_mbuf(cmd, &rtinfo);
1164 	if (m == NULL)
1165 		return;
1166 
1167 	ifmam = mtod(m, struct ifma_msghdr *);
1168 	ifmam->ifmam_index = ifp->if_index;
1169 	ifmam->ifmam_addrs = rtinfo.rti_addrs;
1170 
1171 	rts_input(m, familyof(ifma->ifma_addr));
1172 }
1173 
1174 static struct mbuf *
1175 rt_makeifannouncemsg(struct ifnet *ifp, int type, int what,
1176 		     struct rt_addrinfo *info)
1177 {
1178 	struct if_announcemsghdr *ifan;
1179 	struct mbuf *m;
1180 
1181 	if (route_cb.any_count == 0)
1182 		return NULL;
1183 
1184 	bzero(info, sizeof(*info));
1185 	m = rt_msg_mbuf(type, info);
1186 	if (m == NULL)
1187 		return NULL;
1188 
1189 	ifan = mtod(m, struct if_announcemsghdr *);
1190 	ifan->ifan_index = ifp->if_index;
1191 	strlcpy(ifan->ifan_name, ifp->if_xname, sizeof ifan->ifan_name);
1192 	ifan->ifan_what = what;
1193 	return m;
1194 }
1195 
1196 /*
1197  * This is called to generate routing socket messages indicating
1198  * IEEE80211 wireless events.
1199  * XXX we piggyback on the RTM_IFANNOUNCE msg format in a clumsy way.
1200  */
1201 void
1202 rt_ieee80211msg(struct ifnet *ifp, int what, void *data, size_t data_len)
1203 {
1204 	struct rt_addrinfo info;
1205 	struct mbuf *m;
1206 
1207 	m = rt_makeifannouncemsg(ifp, RTM_IEEE80211, what, &info);
1208 	if (m == NULL)
1209 		return;
1210 
1211 	/*
1212 	 * Append the ieee80211 data.  Try to stick it in the
1213 	 * mbuf containing the ifannounce msg; otherwise allocate
1214 	 * a new mbuf and append.
1215 	 *
1216 	 * NB: we assume m is a single mbuf.
1217 	 */
1218 	if (data_len > M_TRAILINGSPACE(m)) {
1219 		/* XXX use m_getb(data_len, MB_DONTWAIT, MT_DATA, 0); */
1220 		struct mbuf *n = m_get(MB_DONTWAIT, MT_DATA);
1221 		if (n == NULL) {
1222 			m_freem(m);
1223 			return;
1224 		}
1225 		KKASSERT(data_len <= M_TRAILINGSPACE(n));
1226 		bcopy(data, mtod(n, void *), data_len);
1227 		n->m_len = data_len;
1228 		m->m_next = n;
1229 	} else if (data_len > 0) {
1230 		bcopy(data, mtod(m, u_int8_t *) + m->m_len, data_len);
1231 		m->m_len += data_len;
1232 	}
1233 	mbuftrackid(m, 33);
1234 	if (m->m_flags & M_PKTHDR)
1235 		m->m_pkthdr.len += data_len;
1236 	mtod(m, struct if_announcemsghdr *)->ifan_msglen += data_len;
1237 	rts_input(m, 0);
1238 }
1239 
1240 /*
1241  * This is called to generate routing socket messages indicating
1242  * network interface arrival and departure.
1243  */
1244 void
1245 rt_ifannouncemsg(struct ifnet *ifp, int what)
1246 {
1247 	struct rt_addrinfo addrinfo;
1248 	struct mbuf *m;
1249 
1250 	m = rt_makeifannouncemsg(ifp, RTM_IFANNOUNCE, what, &addrinfo);
1251 	if (m != NULL)
1252 		rts_input(m, 0);
1253 }
1254 
1255 static int
1256 resizewalkarg(struct walkarg *w, int len)
1257 {
1258 	void *newptr;
1259 
1260 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
1261 	if (newptr == NULL)
1262 		return (ENOMEM);
1263 	if (w->w_tmem != NULL)
1264 		kfree(w->w_tmem, M_RTABLE);
1265 	w->w_tmem = newptr;
1266 	w->w_tmemsize = len;
1267 	return (0);
1268 }
1269 
1270 /*
1271  * This is used in dumping the kernel table via sysctl().
1272  */
1273 int
1274 sysctl_dumpentry(struct radix_node *rn, void *vw)
1275 {
1276 	struct walkarg *w = vw;
1277 	struct rtentry *rt = (struct rtentry *)rn;
1278 	struct rt_addrinfo rtinfo;
1279 	int error, msglen;
1280 
1281 	if (w->w_op == NET_RT_FLAGS && !(rt->rt_flags & w->w_arg))
1282 		return 0;
1283 
1284 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1285 	rtinfo.rti_dst = rt_key(rt);
1286 	rtinfo.rti_gateway = rt->rt_gateway;
1287 	rtinfo.rti_netmask = rt_mask(rt);
1288 	rtinfo.rti_genmask = rt->rt_genmask;
1289 	if (rt->rt_ifp != NULL) {
1290 		rtinfo.rti_ifpaddr =
1291 		TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1292 		rtinfo.rti_ifaaddr = rt->rt_ifa->ifa_addr;
1293 		if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
1294 			rtinfo.rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
1295 	}
1296 	msglen = rt_msgsize(RTM_GET, &rtinfo);
1297 	if (w->w_tmemsize < msglen && resizewalkarg(w, msglen) != 0)
1298 		return (ENOMEM);
1299 	rt_msg_buffer(RTM_GET, &rtinfo, w->w_tmem, msglen);
1300 	if (w->w_req != NULL) {
1301 		struct rt_msghdr *rtm = w->w_tmem;
1302 
1303 		rtm->rtm_flags = rt->rt_flags;
1304 		rtm->rtm_use = rt->rt_use;
1305 		rtm->rtm_rmx = rt->rt_rmx;
1306 		rtm->rtm_index = rt->rt_ifp->if_index;
1307 		rtm->rtm_errno = rtm->rtm_pid = rtm->rtm_seq = 0;
1308 		rtm->rtm_addrs = rtinfo.rti_addrs;
1309 		error = SYSCTL_OUT(w->w_req, rtm, msglen);
1310 		return (error);
1311 	}
1312 	return (0);
1313 }
1314 
1315 static int
1316 sysctl_iflist(int af, struct walkarg *w)
1317 {
1318 	struct ifnet *ifp;
1319 	struct rt_addrinfo rtinfo;
1320 	int msglen, error;
1321 
1322 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1323 	TAILQ_FOREACH(ifp, &ifnet, if_link) {
1324 		struct ifaddr_container *ifac;
1325 		struct ifaddr *ifa;
1326 
1327 		if (w->w_arg && w->w_arg != ifp->if_index)
1328 			continue;
1329 		ifac = TAILQ_FIRST(&ifp->if_addrheads[mycpuid]);
1330 		ifa = ifac->ifa;
1331 		rtinfo.rti_ifpaddr = ifa->ifa_addr;
1332 		msglen = rt_msgsize(RTM_IFINFO, &rtinfo);
1333 		if (w->w_tmemsize < msglen && resizewalkarg(w, msglen) != 0)
1334 			return (ENOMEM);
1335 		rt_msg_buffer(RTM_IFINFO, &rtinfo, w->w_tmem, msglen);
1336 		rtinfo.rti_ifpaddr = NULL;
1337 		if (w->w_req != NULL && w->w_tmem != NULL) {
1338 			struct if_msghdr *ifm = w->w_tmem;
1339 
1340 			ifm->ifm_index = ifp->if_index;
1341 			ifm->ifm_flags = ifp->if_flags;
1342 			ifm->ifm_data = ifp->if_data;
1343 			ifm->ifm_addrs = rtinfo.rti_addrs;
1344 			error = SYSCTL_OUT(w->w_req, ifm, msglen);
1345 			if (error)
1346 				return (error);
1347 		}
1348 		while ((ifac = TAILQ_NEXT(ifac, ifa_link)) != NULL) {
1349 			ifa = ifac->ifa;
1350 
1351 			if (af && af != ifa->ifa_addr->sa_family)
1352 				continue;
1353 			if (curproc->p_ucred->cr_prison &&
1354 			    prison_if(curproc->p_ucred, ifa->ifa_addr))
1355 				continue;
1356 			rtinfo.rti_ifaaddr = ifa->ifa_addr;
1357 			rtinfo.rti_netmask = ifa->ifa_netmask;
1358 			rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1359 			msglen = rt_msgsize(RTM_NEWADDR, &rtinfo);
1360 			if (w->w_tmemsize < msglen &&
1361 			    resizewalkarg(w, msglen) != 0)
1362 				return (ENOMEM);
1363 			rt_msg_buffer(RTM_NEWADDR, &rtinfo, w->w_tmem, msglen);
1364 			if (w->w_req != NULL) {
1365 				struct ifa_msghdr *ifam = w->w_tmem;
1366 
1367 				ifam->ifam_index = ifa->ifa_ifp->if_index;
1368 				ifam->ifam_flags = ifa->ifa_flags;
1369 				ifam->ifam_metric = ifa->ifa_metric;
1370 				ifam->ifam_addrs = rtinfo.rti_addrs;
1371 				error = SYSCTL_OUT(w->w_req, w->w_tmem, msglen);
1372 				if (error)
1373 					return (error);
1374 			}
1375 		}
1376 		rtinfo.rti_netmask = NULL;
1377 		rtinfo.rti_ifaaddr = NULL;
1378 		rtinfo.rti_bcastaddr = NULL;
1379 	}
1380 	return (0);
1381 }
1382 
1383 static int
1384 sysctl_rtsock(SYSCTL_HANDLER_ARGS)
1385 {
1386 	int	*name = (int *)arg1;
1387 	u_int	namelen = arg2;
1388 	struct radix_node_head *rnh;
1389 	int	i, error = EINVAL;
1390 	int	origcpu;
1391 	u_char  af;
1392 	struct	walkarg w;
1393 
1394 	name ++;
1395 	namelen--;
1396 	if (req->newptr)
1397 		return (EPERM);
1398 	if (namelen != 3 && namelen != 4)
1399 		return (EINVAL);
1400 	af = name[0];
1401 	bzero(&w, sizeof w);
1402 	w.w_op = name[1];
1403 	w.w_arg = name[2];
1404 	w.w_req = req;
1405 
1406 	/*
1407 	 * Optional third argument specifies cpu, used primarily for
1408 	 * debugging the route table.
1409 	 */
1410 	if (namelen == 4) {
1411 		if (name[3] < 0 || name[3] >= ncpus)
1412 			return (EINVAL);
1413 		origcpu = mycpuid;
1414 		lwkt_migratecpu(name[3]);
1415 	} else {
1416 		origcpu = -1;
1417 	}
1418 	crit_enter();
1419 	switch (w.w_op) {
1420 	case NET_RT_DUMP:
1421 	case NET_RT_FLAGS:
1422 		for (i = 1; i <= AF_MAX; i++)
1423 			if ((rnh = rt_tables[mycpuid][i]) &&
1424 			    (af == 0 || af == i) &&
1425 			    (error = rnh->rnh_walktree(rnh,
1426 						       sysctl_dumpentry, &w)))
1427 				break;
1428 		break;
1429 
1430 	case NET_RT_IFLIST:
1431 		error = sysctl_iflist(af, &w);
1432 	}
1433 	crit_exit();
1434 	if (w.w_tmem != NULL)
1435 		kfree(w.w_tmem, M_RTABLE);
1436 	if (origcpu >= 0)
1437 		lwkt_migratecpu(origcpu);
1438 	return (error);
1439 }
1440 
1441 SYSCTL_NODE(_net, PF_ROUTE, routetable, CTLFLAG_RD, sysctl_rtsock, "");
1442 
1443 /*
1444  * Definitions of protocols supported in the ROUTE domain.
1445  */
1446 
1447 static struct domain routedomain;		/* or at least forward */
1448 
1449 static struct protosw routesw[] = {
1450     {
1451 	.pr_type = SOCK_RAW,
1452 	.pr_domain = &routedomain,
1453 	.pr_protocol = 0,
1454 	.pr_flags = PR_ATOMIC|PR_ADDR,
1455 	.pr_input = NULL,
1456 	.pr_output = route_output,
1457 	.pr_ctlinput = raw_ctlinput,
1458 	.pr_ctloutput = NULL,
1459 	.pr_ctlport = cpu0_ctlport,
1460 
1461 	.pr_init = raw_init,
1462 	.pr_usrreqs = &route_usrreqs
1463     }
1464 };
1465 
1466 static struct domain routedomain = {
1467 	PF_ROUTE, "route", NULL, NULL, NULL,
1468 	routesw, &routesw[(sizeof routesw)/(sizeof routesw[0])],
1469 };
1470 
1471 DOMAIN_SET(route);
1472 
1473