xref: /dragonfly/sys/net/rtsock.c (revision 7c4f4eee)
1 /*
2  * Copyright (c) 2004, 2005 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Jeffrey M. Hsu.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of The DragonFly Project nor the names of its
16  *    contributors may be used to endorse or promote products derived
17  *    from this software without specific, prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
27  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
29  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1988, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)rtsock.c	8.7 (Berkeley) 10/12/95
62  * $FreeBSD: src/sys/net/rtsock.c,v 1.44.2.11 2002/12/04 14:05:41 ru Exp $
63  */
64 
65 #include <sys/param.h>
66 #include <sys/systm.h>
67 #include <sys/kernel.h>
68 #include <sys/sysctl.h>
69 #include <sys/proc.h>
70 #include <sys/priv.h>
71 #include <sys/malloc.h>
72 #include <sys/mbuf.h>
73 #include <sys/protosw.h>
74 #include <sys/socket.h>
75 #include <sys/socketvar.h>
76 #include <sys/domain.h>
77 #include <sys/jail.h>
78 
79 #include <sys/thread2.h>
80 #include <sys/socketvar2.h>
81 
82 #include <net/if.h>
83 #include <net/if_var.h>
84 #include <net/route.h>
85 #include <net/raw_cb.h>
86 #include <net/netmsg2.h>
87 #include <net/netisr2.h>
88 
89 MALLOC_DEFINE(M_RTABLE, "routetbl", "routing tables");
90 
91 static struct route_cb {
92 	int	ip_count;
93 	int	ip6_count;
94 	int	ns_count;
95 	int	any_count;
96 } route_cb;
97 
98 static const struct sockaddr route_src = { 2, PF_ROUTE, };
99 
100 struct walkarg {
101 	int	w_tmemsize;
102 	int	w_op, w_arg;
103 	void	*w_tmem;
104 	struct sysctl_req *w_req;
105 };
106 
107 #ifndef RTTABLE_DUMP_MSGCNT_MAX
108 /* Should be large enough for dupkeys */
109 #define RTTABLE_DUMP_MSGCNT_MAX		64
110 #endif
111 
112 struct rttable_walkarg {
113 	int	w_op;
114 	int	w_arg;
115 	int	w_bufsz;
116 	void	*w_buf;
117 
118 	int	w_buflen;
119 
120 	const char *w_key;
121 	const char *w_mask;
122 
123 	struct sockaddr_storage w_key0;
124 	struct sockaddr_storage w_mask0;
125 };
126 
127 struct netmsg_rttable_walk {
128 	struct netmsg_base	base;
129 	int			af;
130 	struct rttable_walkarg	*w;
131 };
132 
133 struct routecb {
134 	struct rawcb	rocb_rcb;
135 	unsigned int	rocb_msgfilter;
136 };
137 #define	sotoroutecb(so)	((struct routecb *)(so)->so_pcb)
138 
139 static struct mbuf *
140 		rt_msg_mbuf (int, struct rt_addrinfo *);
141 static void	rt_msg_buffer (int, struct rt_addrinfo *, void *buf, int len);
142 static int	rt_msgsize(int type, const struct rt_addrinfo *rtinfo);
143 static int	rt_xaddrs (char *, char *, struct rt_addrinfo *);
144 static int	sysctl_rttable(int af, struct sysctl_req *req, int op, int arg);
145 static int	sysctl_iflist (int af, struct walkarg *w);
146 static int	route_output(struct mbuf *, struct socket *, ...);
147 static void	rt_setmetrics (u_long, struct rt_metrics *,
148 			       struct rt_metrics *);
149 
150 /*
151  * It really doesn't make any sense at all for this code to share much
152  * with raw_usrreq.c, since its functionality is so restricted.  XXX
153  */
154 static void
155 rts_abort(netmsg_t msg)
156 {
157 	crit_enter();
158 	raw_usrreqs.pru_abort(msg);
159 	/* msg invalid now */
160 	crit_exit();
161 }
162 
163 static int
164 rts_filter(struct mbuf *m, const struct sockproto *proto,
165 	const struct rawcb *rp)
166 {
167 	const struct routecb *rop = (const struct routecb *)rp;
168 	const struct rt_msghdr *rtm;
169 
170 	KKASSERT(m != NULL);
171 	KKASSERT(proto != NULL);
172 	KKASSERT(rp != NULL);
173 
174 	/* Wrong family for this socket. */
175 	if (proto->sp_family != PF_ROUTE)
176 		return ENOPROTOOPT;
177 
178 	/* If no filter set, just return. */
179 	if (rop->rocb_msgfilter == 0)
180 		return 0;
181 
182 	/* Ensure we can access rtm_type */
183 	if (m->m_len <
184 	    offsetof(struct rt_msghdr, rtm_type) + sizeof(rtm->rtm_type))
185 		return EINVAL;
186 
187 	rtm = mtod(m, const struct rt_msghdr *);
188 	/* If the rtm type is filtered out, return a positive. */
189 	if (!(rop->rocb_msgfilter & ROUTE_FILTER(rtm->rtm_type)))
190 		return EEXIST;
191 
192 	/* Passed the filter. */
193 	return 0;
194 }
195 
196 
197 /* pru_accept is EOPNOTSUPP */
198 
199 static void
200 rts_attach(netmsg_t msg)
201 {
202 	struct socket *so = msg->base.nm_so;
203 	struct pru_attach_info *ai = msg->attach.nm_ai;
204 	struct rawcb *rp;
205 	struct routecb *rop;
206 	int proto = msg->attach.nm_proto;
207 	int error;
208 
209 	crit_enter();
210 	if (sotorawcb(so) != NULL) {
211 		error = EISCONN;
212 		goto done;
213 	}
214 
215 	rop = kmalloc(sizeof *rop, M_PCB, M_WAITOK | M_ZERO);
216 	rp = &rop->rocb_rcb;
217 
218 	/*
219 	 * The critical section is necessary to block protocols from sending
220 	 * error notifications (like RTM_REDIRECT or RTM_LOSING) while
221 	 * this PCB is extant but incompletely initialized.
222 	 * Probably we should try to do more of this work beforehand and
223 	 * eliminate the critical section.
224 	 */
225 	so->so_pcb = rp;
226 	soreference(so);	/* so_pcb assignment */
227 	error = raw_attach(so, proto, ai->sb_rlimit);
228 	rp = sotorawcb(so);
229 	if (error) {
230 		kfree(rop, M_PCB);
231 		goto done;
232 	}
233 	switch(rp->rcb_proto.sp_protocol) {
234 	case AF_INET:
235 		route_cb.ip_count++;
236 		break;
237 	case AF_INET6:
238 		route_cb.ip6_count++;
239 		break;
240 	}
241 	rp->rcb_faddr = &route_src;
242 	rp->rcb_filter = rts_filter;
243 	route_cb.any_count++;
244 	soisconnected(so);
245 	so->so_options |= SO_USELOOPBACK;
246 	error = 0;
247 done:
248 	crit_exit();
249 	lwkt_replymsg(&msg->lmsg, error);
250 }
251 
252 static void
253 rts_bind(netmsg_t msg)
254 {
255 	crit_enter();
256 	raw_usrreqs.pru_bind(msg); /* xxx just EINVAL */
257 	/* msg invalid now */
258 	crit_exit();
259 }
260 
261 static void
262 rts_connect(netmsg_t msg)
263 {
264 	crit_enter();
265 	raw_usrreqs.pru_connect(msg); /* XXX just EINVAL */
266 	/* msg invalid now */
267 	crit_exit();
268 }
269 
270 /* pru_connect2 is EOPNOTSUPP */
271 /* pru_control is EOPNOTSUPP */
272 
273 static void
274 rts_detach(netmsg_t msg)
275 {
276 	struct socket *so = msg->base.nm_so;
277 	struct rawcb *rp = sotorawcb(so);
278 
279 	crit_enter();
280 	if (rp != NULL) {
281 		switch(rp->rcb_proto.sp_protocol) {
282 		case AF_INET:
283 			route_cb.ip_count--;
284 			break;
285 		case AF_INET6:
286 			route_cb.ip6_count--;
287 			break;
288 		}
289 		route_cb.any_count--;
290 	}
291 	raw_usrreqs.pru_detach(msg);
292 	/* msg invalid now */
293 	crit_exit();
294 }
295 
296 static void
297 rts_disconnect(netmsg_t msg)
298 {
299 	crit_enter();
300 	raw_usrreqs.pru_disconnect(msg);
301 	/* msg invalid now */
302 	crit_exit();
303 }
304 
305 /* pru_listen is EOPNOTSUPP */
306 
307 static void
308 rts_peeraddr(netmsg_t msg)
309 {
310 	crit_enter();
311 	raw_usrreqs.pru_peeraddr(msg);
312 	/* msg invalid now */
313 	crit_exit();
314 }
315 
316 /* pru_rcvd is EOPNOTSUPP */
317 /* pru_rcvoob is EOPNOTSUPP */
318 
319 static void
320 rts_send(netmsg_t msg)
321 {
322 	crit_enter();
323 	raw_usrreqs.pru_send(msg);
324 	/* msg invalid now */
325 	crit_exit();
326 }
327 
328 /* pru_sense is null */
329 
330 static void
331 rts_shutdown(netmsg_t msg)
332 {
333 	crit_enter();
334 	raw_usrreqs.pru_shutdown(msg);
335 	/* msg invalid now */
336 	crit_exit();
337 }
338 
339 static void
340 rts_sockaddr(netmsg_t msg)
341 {
342 	crit_enter();
343 	raw_usrreqs.pru_sockaddr(msg);
344 	/* msg invalid now */
345 	crit_exit();
346 }
347 
348 static struct pr_usrreqs route_usrreqs = {
349 	.pru_abort = rts_abort,
350 	.pru_accept = pr_generic_notsupp,
351 	.pru_attach = rts_attach,
352 	.pru_bind = rts_bind,
353 	.pru_connect = rts_connect,
354 	.pru_connect2 = pr_generic_notsupp,
355 	.pru_control = pr_generic_notsupp,
356 	.pru_detach = rts_detach,
357 	.pru_disconnect = rts_disconnect,
358 	.pru_listen = pr_generic_notsupp,
359 	.pru_peeraddr = rts_peeraddr,
360 	.pru_rcvd = pr_generic_notsupp,
361 	.pru_rcvoob = pr_generic_notsupp,
362 	.pru_send = rts_send,
363 	.pru_sense = pru_sense_null,
364 	.pru_shutdown = rts_shutdown,
365 	.pru_sockaddr = rts_sockaddr,
366 	.pru_sosend = sosend,
367 	.pru_soreceive = soreceive
368 };
369 
370 static __inline sa_family_t
371 familyof(struct sockaddr *sa)
372 {
373 	return (sa != NULL ? sa->sa_family : 0);
374 }
375 
376 /*
377  * Routing socket input function.  The packet must be serialized onto cpu 0.
378  * We use the cpu0_soport() netisr processing loop to handle it.
379  *
380  * This looks messy but it means that anyone, including interrupt code,
381  * can send a message to the routing socket.
382  */
383 static void
384 rts_input_handler(netmsg_t msg)
385 {
386 	static const struct sockaddr route_dst = { 2, PF_ROUTE, };
387 	struct sockproto route_proto;
388 	struct netmsg_packet *pmsg = &msg->packet;
389 	struct mbuf *m;
390 	sa_family_t family;
391 	struct rawcb *skip;
392 
393 	family = pmsg->base.lmsg.u.ms_result;
394 	route_proto.sp_family = PF_ROUTE;
395 	route_proto.sp_protocol = family;
396 
397 	m = pmsg->nm_packet;
398 	M_ASSERTPKTHDR(m);
399 
400 	skip = m->m_pkthdr.header;
401 	m->m_pkthdr.header = NULL;
402 
403 	raw_input(m, &route_proto, &route_src, &route_dst, skip);
404 }
405 
406 static void
407 rts_input_skip(struct mbuf *m, sa_family_t family, struct rawcb *skip)
408 {
409 	struct netmsg_packet *pmsg;
410 	lwkt_port_t port;
411 
412 	M_ASSERTPKTHDR(m);
413 
414 	port = netisr_cpuport(0);	/* XXX same as for routing socket */
415 	pmsg = &m->m_hdr.mh_netmsg;
416 	netmsg_init(&pmsg->base, NULL, &netisr_apanic_rport,
417 		    0, rts_input_handler);
418 	pmsg->nm_packet = m;
419 	pmsg->base.lmsg.u.ms_result = family;
420 	m->m_pkthdr.header = skip; /* XXX steal field in pkthdr */
421 	lwkt_sendmsg(port, &pmsg->base.lmsg);
422 }
423 
424 static __inline void
425 rts_input(struct mbuf *m, sa_family_t family)
426 {
427 	rts_input_skip(m, family, NULL);
428 }
429 
430 static void
431 route_ctloutput(netmsg_t msg)
432 {
433 	struct socket *so = msg->ctloutput.base.nm_so;
434 	struct sockopt *sopt = msg->ctloutput.nm_sopt;
435 	struct routecb *rop = sotoroutecb(so);
436 	int error;
437 	unsigned int msgfilter;
438 
439 	if (sopt->sopt_level != AF_ROUTE) {
440 		error = EINVAL;
441 		goto out;
442 	}
443 
444 	error = 0;
445 
446 	switch (sopt->sopt_dir) {
447 	case SOPT_SET:
448 		switch (sopt->sopt_name) {
449 		case ROUTE_MSGFILTER:
450 			error = soopt_to_kbuf(sopt, &msgfilter,
451 			    sizeof(msgfilter), sizeof(msgfilter));
452 			if (error == 0)
453 				rop->rocb_msgfilter = msgfilter;
454 			break;
455 		default:
456 			error = ENOPROTOOPT;
457 			break;
458 		}
459 		break;
460 	case SOPT_GET:
461 		switch (sopt->sopt_name) {
462 		case ROUTE_MSGFILTER:
463 			msgfilter = rop->rocb_msgfilter;
464 			soopt_from_kbuf(sopt, &msgfilter, sizeof(msgfilter));
465 			break;
466 		default:
467 			error = ENOPROTOOPT;
468 			break;
469 		}
470 	}
471 out:
472 	lwkt_replymsg(&msg->ctloutput.base.lmsg, error);
473 }
474 
475 
476 
477 static void *
478 reallocbuf_nofree(void *ptr, size_t len, size_t olen)
479 {
480 	void *newptr;
481 
482 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
483 	if (newptr == NULL)
484 		return NULL;
485 	bcopy(ptr, newptr, olen);
486 	return (newptr);
487 }
488 
489 /*
490  * Internal helper routine for route_output().
491  */
492 static int
493 _fillrtmsg(struct rt_msghdr **prtm, struct rtentry *rt,
494 	   struct rt_addrinfo *rtinfo)
495 {
496 	int msglen;
497 	struct rt_msghdr *rtm = *prtm;
498 
499 	/* Fill in rt_addrinfo for call to rt_msg_buffer(). */
500 	rtinfo->rti_dst = rt_key(rt);
501 	rtinfo->rti_gateway = rt->rt_gateway;
502 	rtinfo->rti_netmask = rt_mask(rt);		/* might be NULL */
503 	rtinfo->rti_genmask = rt->rt_genmask;		/* might be NULL */
504 	if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
505 		if (rt->rt_ifp != NULL) {
506 			rtinfo->rti_ifpaddr =
507 			    TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])
508 			    ->ifa->ifa_addr;
509 			rtinfo->rti_ifaaddr = rt->rt_ifa->ifa_addr;
510 			if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
511 				rtinfo->rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
512 			rtm->rtm_index = rt->rt_ifp->if_index;
513 		} else {
514 			rtinfo->rti_ifpaddr = NULL;
515 			rtinfo->rti_ifaaddr = NULL;
516 		}
517 	} else if (rt->rt_ifp != NULL) {
518 		rtm->rtm_index = rt->rt_ifp->if_index;
519 	}
520 
521 	msglen = rt_msgsize(rtm->rtm_type, rtinfo);
522 	if (rtm->rtm_msglen < msglen) {
523 		/* NOTE: Caller will free the old rtm accordingly */
524 		rtm = reallocbuf_nofree(rtm, msglen, rtm->rtm_msglen);
525 		if (rtm == NULL)
526 			return (ENOBUFS);
527 		*prtm = rtm;
528 	}
529 	rt_msg_buffer(rtm->rtm_type, rtinfo, rtm, msglen);
530 
531 	rtm->rtm_flags = rt->rt_flags;
532 	rtm->rtm_rmx = rt->rt_rmx;
533 	rtm->rtm_addrs = rtinfo->rti_addrs;
534 
535 	return (0);
536 }
537 
538 struct rtm_arg {
539 	struct rt_msghdr	*bak_rtm;
540 	struct rt_msghdr	*new_rtm;
541 };
542 
543 static int
544 fillrtmsg(struct rtm_arg *arg, struct rtentry *rt,
545 	  struct rt_addrinfo *rtinfo)
546 {
547 	struct rt_msghdr *rtm = arg->new_rtm;
548 	int error;
549 
550 	error = _fillrtmsg(&rtm, rt, rtinfo);
551 	if (!error) {
552 		if (arg->new_rtm != rtm) {
553 			/*
554 			 * _fillrtmsg() just allocated a new rtm;
555 			 * if the previously allocated rtm is not
556 			 * the backing rtm, it should be freed.
557 			 */
558 			if (arg->new_rtm != arg->bak_rtm)
559 				kfree(arg->new_rtm, M_RTABLE);
560 			arg->new_rtm = rtm;
561 		}
562 	}
563 	return error;
564 }
565 
566 static void route_output_add_callback(int, int, struct rt_addrinfo *,
567 					struct rtentry *, void *);
568 static void route_output_delete_callback(int, int, struct rt_addrinfo *,
569 					struct rtentry *, void *);
570 static int route_output_get_callback(int, struct rt_addrinfo *,
571 				     struct rtentry *, void *, int);
572 static int route_output_change_callback(int, struct rt_addrinfo *,
573 					struct rtentry *, void *, int);
574 static int route_output_lock_callback(int, struct rt_addrinfo *,
575 				      struct rtentry *, void *, int);
576 
577 /*ARGSUSED*/
578 static int
579 route_output(struct mbuf *m, struct socket *so, ...)
580 {
581 	struct rtm_arg arg;
582 	struct rt_msghdr *rtm = NULL;
583 	struct rawcb *rp = NULL;
584 	struct pr_output_info *oi;
585 	struct rt_addrinfo rtinfo;
586 	sa_family_t family;
587 	int len, error = 0;
588 	__va_list ap;
589 
590 	M_ASSERTPKTHDR(m);
591 
592 	__va_start(ap, so);
593 	oi = __va_arg(ap, struct pr_output_info *);
594 	__va_end(ap);
595 
596 	family = familyof(NULL);
597 
598 #define gotoerr(e) { error = e; goto flush;}
599 
600 	if (m == NULL ||
601 	    (m->m_len < sizeof(long) &&
602 	     (m = m_pullup(m, sizeof(long))) == NULL))
603 		return (ENOBUFS);
604 	len = m->m_pkthdr.len;
605 	if (len < sizeof(struct rt_msghdr) ||
606 	    len != mtod(m, struct rt_msghdr *)->rtm_msglen)
607 		gotoerr(EINVAL);
608 
609 	rtm = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
610 	if (rtm == NULL)
611 		gotoerr(ENOBUFS);
612 
613 	m_copydata(m, 0, len, (caddr_t)rtm);
614 	if (rtm->rtm_version != RTM_VERSION)
615 		gotoerr(EPROTONOSUPPORT);
616 
617 	rtm->rtm_pid = oi->p_pid;
618 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
619 	rtinfo.rti_addrs = rtm->rtm_addrs;
620 	if (rt_xaddrs((char *)(rtm + 1), (char *)rtm + len, &rtinfo) != 0)
621 		gotoerr(EINVAL);
622 
623 	rtinfo.rti_flags = rtm->rtm_flags;
624 	if (rtinfo.rti_dst == NULL || rtinfo.rti_dst->sa_family >= AF_MAX ||
625 	    (rtinfo.rti_gateway && rtinfo.rti_gateway->sa_family >= AF_MAX))
626 		gotoerr(EINVAL);
627 
628 	family = familyof(rtinfo.rti_dst);
629 
630 	/*
631 	 * Verify that the caller has the appropriate privilege; RTM_GET
632 	 * is the only operation the non-superuser is allowed.
633 	 */
634 	if (rtm->rtm_type != RTM_GET &&
635 	    priv_check_cred(so->so_cred, PRIV_ROOT, 0) != 0)
636 		gotoerr(EPERM);
637 
638 	if (rtinfo.rti_genmask != NULL) {
639 		error = rtmask_add_global(rtinfo.rti_genmask,
640 		    rtm->rtm_type != RTM_GET ?
641 		    RTREQ_PRIO_HIGH : RTREQ_PRIO_NORM);
642 		if (error)
643 			goto flush;
644 	}
645 
646 	switch (rtm->rtm_type) {
647 	case RTM_ADD:
648 		if (rtinfo.rti_gateway == NULL) {
649 			error = EINVAL;
650 		} else {
651 			error = rtrequest1_global(RTM_ADD, &rtinfo,
652 			    route_output_add_callback, rtm, RTREQ_PRIO_HIGH);
653 		}
654 		break;
655 	case RTM_DELETE:
656 		/*
657 		 * Backing rtm (bak_rtm) could _not_ be freed during
658 		 * rtrequest1_global or rtsearch_global, even if the
659 		 * callback reallocates the rtm due to its size changes,
660 		 * since rtinfo points to the backing rtm's memory area.
661 		 * After rtrequest1_global or rtsearch_global returns,
662 		 * it is safe to free the backing rtm, since rtinfo will
663 		 * not be used anymore.
664 		 *
665 		 * new_rtm will be used to save the new rtm allocated
666 		 * by rtrequest1_global or rtsearch_global.
667 		 */
668 		arg.bak_rtm = rtm;
669 		arg.new_rtm = rtm;
670 		error = rtrequest1_global(RTM_DELETE, &rtinfo,
671 		    route_output_delete_callback, &arg, RTREQ_PRIO_HIGH);
672 		rtm = arg.new_rtm;
673 		if (rtm != arg.bak_rtm)
674 			kfree(arg.bak_rtm, M_RTABLE);
675 		break;
676 	case RTM_GET:
677 		/* See the comment in RTM_DELETE */
678 		arg.bak_rtm = rtm;
679 		arg.new_rtm = rtm;
680 		error = rtsearch_global(RTM_GET, &rtinfo,
681 		    route_output_get_callback, &arg, RTS_NOEXACTMATCH,
682 		    RTREQ_PRIO_NORM);
683 		rtm = arg.new_rtm;
684 		if (rtm != arg.bak_rtm)
685 			kfree(arg.bak_rtm, M_RTABLE);
686 		break;
687 	case RTM_CHANGE:
688 		error = rtsearch_global(RTM_CHANGE, &rtinfo,
689 		    route_output_change_callback, rtm, RTS_EXACTMATCH,
690 		    RTREQ_PRIO_HIGH);
691 		break;
692 	case RTM_LOCK:
693 		error = rtsearch_global(RTM_LOCK, &rtinfo,
694 		    route_output_lock_callback, rtm, RTS_EXACTMATCH,
695 		    RTREQ_PRIO_HIGH);
696 		break;
697 	default:
698 		error = EOPNOTSUPP;
699 		break;
700 	}
701 flush:
702 	if (rtm != NULL) {
703 		if (error != 0)
704 			rtm->rtm_errno = error;
705 		else
706 			rtm->rtm_flags |= RTF_DONE;
707 	}
708 
709 	/*
710 	 * Check to see if we don't want our own messages.
711 	 */
712 	if (!(so->so_options & SO_USELOOPBACK)) {
713 		if (route_cb.any_count <= 1) {
714 			if (rtm != NULL)
715 				kfree(rtm, M_RTABLE);
716 			m_freem(m);
717 			return (error);
718 		}
719 		/* There is another listener, so construct message */
720 		rp = sotorawcb(so);
721 	}
722 	if (rtm != NULL) {
723 		m_copyback(m, 0, rtm->rtm_msglen, (caddr_t)rtm);
724 		if (m->m_pkthdr.len < rtm->rtm_msglen) {
725 			m_freem(m);
726 			m = NULL;
727 		} else if (m->m_pkthdr.len > rtm->rtm_msglen)
728 			m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
729 		kfree(rtm, M_RTABLE);
730 	}
731 	if (m != NULL)
732 		rts_input_skip(m, family, rp);
733 	return (error);
734 }
735 
736 static void
737 route_output_add_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
738 			  struct rtentry *rt, void *arg)
739 {
740 	struct rt_msghdr *rtm = arg;
741 
742 	if (error == 0 && rt != NULL) {
743 		rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx,
744 		    &rt->rt_rmx);
745 		rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
746 		rt->rt_rmx.rmx_locks |=
747 		    (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
748 		if (rtinfo->rti_genmask != NULL) {
749 			rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
750 			if (rt->rt_genmask == NULL) {
751 				/*
752 				 * This should not happen, since we
753 				 * have already installed genmask
754 				 * on each CPU before we reach here.
755 				 */
756 				panic("genmask is gone!?");
757 			}
758 		} else {
759 			rt->rt_genmask = NULL;
760 		}
761 		rtm->rtm_index = rt->rt_ifp->if_index;
762 	}
763 }
764 
765 static void
766 route_output_delete_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
767 			  struct rtentry *rt, void *arg)
768 {
769 	if (error == 0 && rt) {
770 		++rt->rt_refcnt;
771 		if (fillrtmsg(arg, rt, rtinfo) != 0) {
772 			error = ENOBUFS;
773 			/* XXX no way to return the error */
774 		}
775 		--rt->rt_refcnt;
776 	}
777 	if (rt && rt->rt_refcnt == 0) {
778 		++rt->rt_refcnt;
779 		rtfree(rt);
780 	}
781 }
782 
783 static int
784 route_output_get_callback(int cmd, struct rt_addrinfo *rtinfo,
785 			  struct rtentry *rt, void *arg, int found_cnt)
786 {
787 	int error, found = 0;
788 
789 	if (((rtinfo->rti_flags ^ rt->rt_flags) & RTF_HOST) == 0)
790 		found = 1;
791 
792 	error = fillrtmsg(arg, rt, rtinfo);
793 	if (!error && found) {
794 		/* Got the exact match, we could return now! */
795 		error = EJUSTRETURN;
796 	}
797 	return error;
798 }
799 
800 static int
801 route_output_change_callback(int cmd, struct rt_addrinfo *rtinfo,
802 			     struct rtentry *rt, void *arg, int found_cnt)
803 {
804 	struct rt_msghdr *rtm = arg;
805 	struct ifaddr *ifa;
806 	int error = 0;
807 
808 	/*
809 	 * new gateway could require new ifaddr, ifp;
810 	 * flags may also be different; ifp may be specified
811 	 * by ll sockaddr when protocol address is ambiguous
812 	 */
813 	if (((rt->rt_flags & RTF_GATEWAY) && rtinfo->rti_gateway != NULL) ||
814 	    rtinfo->rti_ifpaddr != NULL ||
815 	    (rtinfo->rti_ifaaddr != NULL &&
816 	     !sa_equal(rtinfo->rti_ifaaddr, rt->rt_ifa->ifa_addr))) {
817 		error = rt_getifa(rtinfo);
818 		if (error != 0)
819 			goto done;
820 	}
821 	if (rtinfo->rti_gateway != NULL) {
822 		/*
823 		 * We only need to generate rtmsg upon the
824 		 * first route to be changed.
825 		 */
826 		error = rt_setgate(rt, rt_key(rt), rtinfo->rti_gateway);
827 		if (error != 0)
828 			goto done;
829 	}
830 	if ((ifa = rtinfo->rti_ifa) != NULL) {
831 		struct ifaddr *oifa = rt->rt_ifa;
832 
833 		if (oifa != ifa) {
834 			if (oifa && oifa->ifa_rtrequest)
835 				oifa->ifa_rtrequest(RTM_DELETE, rt);
836 			IFAFREE(rt->rt_ifa);
837 			IFAREF(ifa);
838 			rt->rt_ifa = ifa;
839 			rt->rt_ifp = rtinfo->rti_ifp;
840 		}
841 	}
842 	rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx, &rt->rt_rmx);
843 	if (rt->rt_ifa && rt->rt_ifa->ifa_rtrequest)
844 		rt->rt_ifa->ifa_rtrequest(RTM_ADD, rt);
845 	if (rtinfo->rti_genmask != NULL) {
846 		rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
847 		if (rt->rt_genmask == NULL) {
848 			/*
849 			 * This should not happen, since we
850 			 * have already installed genmask
851 			 * on each CPU before we reach here.
852 			 */
853 			panic("genmask is gone!?");
854 		}
855 	}
856 	rtm->rtm_index = rt->rt_ifp->if_index;
857 	if (found_cnt == 1)
858 		rt_rtmsg(RTM_CHANGE, rt, rt->rt_ifp, 0);
859 done:
860 	return error;
861 }
862 
863 static int
864 route_output_lock_callback(int cmd, struct rt_addrinfo *rtinfo,
865 			   struct rtentry *rt, void *arg,
866 			   int found_cnt __unused)
867 {
868 	struct rt_msghdr *rtm = arg;
869 
870 	rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
871 	rt->rt_rmx.rmx_locks |=
872 		(rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
873 	return 0;
874 }
875 
876 static void
877 rt_setmetrics(u_long which, struct rt_metrics *in, struct rt_metrics *out)
878 {
879 #define setmetric(flag, elt) if (which & (flag)) out->elt = in->elt;
880 	setmetric(RTV_RPIPE, rmx_recvpipe);
881 	setmetric(RTV_SPIPE, rmx_sendpipe);
882 	setmetric(RTV_SSTHRESH, rmx_ssthresh);
883 	setmetric(RTV_RTT, rmx_rtt);
884 	setmetric(RTV_RTTVAR, rmx_rttvar);
885 	setmetric(RTV_HOPCOUNT, rmx_hopcount);
886 	setmetric(RTV_MTU, rmx_mtu);
887 	setmetric(RTV_EXPIRE, rmx_expire);
888 	setmetric(RTV_MSL, rmx_msl);
889 	setmetric(RTV_IWMAXSEGS, rmx_iwmaxsegs);
890 	setmetric(RTV_IWCAPSEGS, rmx_iwcapsegs);
891 #undef setmetric
892 }
893 
894 /*
895  * Extract the addresses of the passed sockaddrs.
896  * Do a little sanity checking so as to avoid bad memory references.
897  * This data is derived straight from userland.
898  */
899 static int
900 rt_xaddrs(char *cp, char *cplim, struct rt_addrinfo *rtinfo)
901 {
902 	struct sockaddr *sa;
903 	int i;
904 
905 	for (i = 0; (i < RTAX_MAX) && (cp < cplim); i++) {
906 		if ((rtinfo->rti_addrs & (1 << i)) == 0)
907 			continue;
908 		sa = (struct sockaddr *)cp;
909 		/*
910 		 * It won't fit.
911 		 */
912 		if ((cp + sa->sa_len) > cplim) {
913 			return (EINVAL);
914 		}
915 
916 		/*
917 		 * There are no more...  Quit now.
918 		 * If there are more bits, they are in error.
919 		 * I've seen this.  route(1) can evidently generate these.
920 		 * This causes kernel to core dump.
921 		 * For compatibility, if we see this, point to a safe address.
922 		 */
923 		if (sa->sa_len == 0) {
924 			static struct sockaddr sa_zero = {
925 				sizeof sa_zero, AF_INET,
926 			};
927 
928 			rtinfo->rti_info[i] = &sa_zero;
929 			kprintf("rtsock: received more addr bits than sockaddrs.\n");
930 			return (0); /* should be EINVAL but for compat */
931 		}
932 
933 		/* Accept the sockaddr. */
934 		rtinfo->rti_info[i] = sa;
935 		cp += RT_ROUNDUP(sa->sa_len);
936 	}
937 	return (0);
938 }
939 
940 static int
941 rt_msghdrsize(int type)
942 {
943 	switch (type) {
944 	case RTM_DELADDR:
945 	case RTM_NEWADDR:
946 		return sizeof(struct ifa_msghdr);
947 	case RTM_DELMADDR:
948 	case RTM_NEWMADDR:
949 		return sizeof(struct ifma_msghdr);
950 	case RTM_IFINFO:
951 		return sizeof(struct if_msghdr);
952 	case RTM_IFANNOUNCE:
953 	case RTM_IEEE80211:
954 		return sizeof(struct if_announcemsghdr);
955 	default:
956 		return sizeof(struct rt_msghdr);
957 	}
958 }
959 
960 static int
961 rt_msgsize(int type, const struct rt_addrinfo *rtinfo)
962 {
963 	int len, i;
964 
965 	len = rt_msghdrsize(type);
966 	for (i = 0; i < RTAX_MAX; i++) {
967 		if (rtinfo->rti_info[i] != NULL)
968 			len += RT_ROUNDUP(rtinfo->rti_info[i]->sa_len);
969 	}
970 	len = ALIGN(len);
971 	return len;
972 }
973 
974 /*
975  * Build a routing message in a buffer.
976  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
977  * to the end of the buffer after the message header.
978  *
979  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
980  * This side-effect can be avoided if we reorder the addrs bitmask field in all
981  * the route messages to line up so we can set it here instead of back in the
982  * calling routine.
983  */
984 static void
985 rt_msg_buffer(int type, struct rt_addrinfo *rtinfo, void *buf, int msglen)
986 {
987 	struct rt_msghdr *rtm;
988 	char *cp;
989 	int dlen, i;
990 
991 	rtm = (struct rt_msghdr *) buf;
992 	rtm->rtm_version = RTM_VERSION;
993 	rtm->rtm_type = type;
994 	rtm->rtm_msglen = msglen;
995 
996 	cp = (char *)buf + rt_msghdrsize(type);
997 	rtinfo->rti_addrs = 0;
998 	for (i = 0; i < RTAX_MAX; i++) {
999 		struct sockaddr *sa;
1000 
1001 		if ((sa = rtinfo->rti_info[i]) == NULL)
1002 			continue;
1003 		rtinfo->rti_addrs |= (1 << i);
1004 		dlen = RT_ROUNDUP(sa->sa_len);
1005 		bcopy(sa, cp, dlen);
1006 		cp += dlen;
1007 	}
1008 }
1009 
1010 /*
1011  * Build a routing message in a mbuf chain.
1012  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
1013  * to the end of the mbuf after the message header.
1014  *
1015  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
1016  * This side-effect can be avoided if we reorder the addrs bitmask field in all
1017  * the route messages to line up so we can set it here instead of back in the
1018  * calling routine.
1019  */
1020 static struct mbuf *
1021 rt_msg_mbuf(int type, struct rt_addrinfo *rtinfo)
1022 {
1023 	struct mbuf *m;
1024 	struct rt_msghdr *rtm;
1025 	int hlen, len;
1026 	int i;
1027 
1028 	hlen = rt_msghdrsize(type);
1029 	KASSERT(hlen <= MCLBYTES, ("rt_msg_mbuf: hlen %d doesn't fit", hlen));
1030 
1031 	m = m_getl(hlen, M_NOWAIT, MT_DATA, M_PKTHDR, NULL);
1032 	if (m == NULL)
1033 		return (NULL);
1034 	mbuftrackid(m, 32);
1035 	m->m_pkthdr.len = m->m_len = hlen;
1036 	m->m_pkthdr.rcvif = NULL;
1037 	rtinfo->rti_addrs = 0;
1038 	len = hlen;
1039 	for (i = 0; i < RTAX_MAX; i++) {
1040 		struct sockaddr *sa;
1041 		int dlen;
1042 
1043 		if ((sa = rtinfo->rti_info[i]) == NULL)
1044 			continue;
1045 		rtinfo->rti_addrs |= (1 << i);
1046 		dlen = RT_ROUNDUP(sa->sa_len);
1047 		m_copyback(m, len, dlen, (caddr_t)sa); /* can grow mbuf chain */
1048 		len += dlen;
1049 	}
1050 	if (m->m_pkthdr.len != len) { /* one of the m_copyback() calls failed */
1051 		m_freem(m);
1052 		return (NULL);
1053 	}
1054 	rtm = mtod(m, struct rt_msghdr *);
1055 	bzero(rtm, hlen);
1056 	rtm->rtm_msglen = len;
1057 	rtm->rtm_version = RTM_VERSION;
1058 	rtm->rtm_type = type;
1059 	return (m);
1060 }
1061 
1062 /*
1063  * This routine is called to generate a message from the routing
1064  * socket indicating that a redirect has occurred, a routing lookup
1065  * has failed, or that a protocol has detected timeouts to a particular
1066  * destination.
1067  */
1068 void
1069 rt_missmsg(int type, struct rt_addrinfo *rtinfo, int flags, int error)
1070 {
1071 	struct sockaddr *dst = rtinfo->rti_info[RTAX_DST];
1072 	struct rt_msghdr *rtm;
1073 	struct mbuf *m;
1074 
1075 	if (route_cb.any_count == 0)
1076 		return;
1077 	m = rt_msg_mbuf(type, rtinfo);
1078 	if (m == NULL)
1079 		return;
1080 	rtm = mtod(m, struct rt_msghdr *);
1081 	rtm->rtm_flags = RTF_DONE | flags;
1082 	rtm->rtm_errno = error;
1083 	rtm->rtm_addrs = rtinfo->rti_addrs;
1084 	rts_input(m, familyof(dst));
1085 }
1086 
1087 void
1088 rt_dstmsg(int type, struct sockaddr *dst, int error)
1089 {
1090 	struct rt_msghdr *rtm;
1091 	struct rt_addrinfo addrs;
1092 	struct mbuf *m;
1093 
1094 	if (route_cb.any_count == 0)
1095 		return;
1096 	bzero(&addrs, sizeof(struct rt_addrinfo));
1097 	addrs.rti_info[RTAX_DST] = dst;
1098 	m = rt_msg_mbuf(type, &addrs);
1099 	if (m == NULL)
1100 		return;
1101 	rtm = mtod(m, struct rt_msghdr *);
1102 	rtm->rtm_flags = RTF_DONE;
1103 	rtm->rtm_errno = error;
1104 	rtm->rtm_addrs = addrs.rti_addrs;
1105 	rts_input(m, familyof(dst));
1106 }
1107 
1108 /*
1109  * This routine is called to generate a message from the routing
1110  * socket indicating that the status of a network interface has changed.
1111  */
1112 void
1113 rt_ifmsg(struct ifnet *ifp)
1114 {
1115 	struct if_msghdr *ifm;
1116 	struct mbuf *m;
1117 	struct rt_addrinfo rtinfo;
1118 
1119 	if (route_cb.any_count == 0)
1120 		return;
1121 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1122 	m = rt_msg_mbuf(RTM_IFINFO, &rtinfo);
1123 	if (m == NULL)
1124 		return;
1125 	ifm = mtod(m, struct if_msghdr *);
1126 	ifm->ifm_index = ifp->if_index;
1127 	ifm->ifm_flags = ifp->if_flags;
1128 	ifm->ifm_data = ifp->if_data;
1129 	ifm->ifm_addrs = 0;
1130 	rts_input(m, 0);
1131 }
1132 
1133 static void
1134 rt_ifamsg(int cmd, struct ifaddr *ifa)
1135 {
1136 	struct ifa_msghdr *ifam;
1137 	struct rt_addrinfo rtinfo;
1138 	struct mbuf *m;
1139 	struct ifnet *ifp = ifa->ifa_ifp;
1140 
1141 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1142 	rtinfo.rti_ifaaddr = ifa->ifa_addr;
1143 	rtinfo.rti_ifpaddr =
1144 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1145 	rtinfo.rti_netmask = ifa->ifa_netmask;
1146 	rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1147 
1148 	m = rt_msg_mbuf(cmd, &rtinfo);
1149 	if (m == NULL)
1150 		return;
1151 
1152 	ifam = mtod(m, struct ifa_msghdr *);
1153 	ifam->ifam_index = ifp->if_index;
1154 	ifam->ifam_metric = ifa->ifa_metric;
1155 	ifam->ifam_flags = ifa->ifa_flags;
1156 	ifam->ifam_addrs = rtinfo.rti_addrs;
1157 
1158 	rts_input(m, familyof(ifa->ifa_addr));
1159 }
1160 
1161 void
1162 rt_rtmsg(int cmd, struct rtentry *rt, struct ifnet *ifp, int error)
1163 {
1164 	struct rt_msghdr *rtm;
1165 	struct rt_addrinfo rtinfo;
1166 	struct mbuf *m;
1167 	struct sockaddr *dst;
1168 
1169 	if (rt == NULL)
1170 		return;
1171 
1172 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1173 	rtinfo.rti_dst = dst = rt_key(rt);
1174 	rtinfo.rti_gateway = rt->rt_gateway;
1175 	rtinfo.rti_netmask = rt_mask(rt);
1176 	if (ifp != NULL) {
1177 		rtinfo.rti_ifpaddr =
1178 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1179 	}
1180 	if (rt->rt_ifa != NULL)
1181 		rtinfo.rti_ifaaddr = rt->rt_ifa->ifa_addr;
1182 
1183 	m = rt_msg_mbuf(cmd, &rtinfo);
1184 	if (m == NULL)
1185 		return;
1186 
1187 	rtm = mtod(m, struct rt_msghdr *);
1188 	if (ifp != NULL)
1189 		rtm->rtm_index = ifp->if_index;
1190 	rtm->rtm_flags |= rt->rt_flags;
1191 	rtm->rtm_errno = error;
1192 	rtm->rtm_addrs = rtinfo.rti_addrs;
1193 
1194 	rts_input(m, familyof(dst));
1195 }
1196 
1197 /*
1198  * This is called to generate messages from the routing socket
1199  * indicating a network interface has had addresses associated with it.
1200  * if we ever reverse the logic and replace messages TO the routing
1201  * socket indicate a request to configure interfaces, then it will
1202  * be unnecessary as the routing socket will automatically generate
1203  * copies of it.
1204  */
1205 void
1206 rt_newaddrmsg(int cmd, struct ifaddr *ifa, int error, struct rtentry *rt)
1207 {
1208 	if (route_cb.any_count == 0)
1209 		return;
1210 
1211 	if (cmd == RTM_ADD) {
1212 		rt_ifamsg(RTM_NEWADDR, ifa);
1213 		rt_rtmsg(RTM_ADD, rt, ifa->ifa_ifp, error);
1214 	} else {
1215 		KASSERT((cmd == RTM_DELETE), ("unknown cmd %d", cmd));
1216 		rt_rtmsg(RTM_DELETE, rt, ifa->ifa_ifp, error);
1217 		rt_ifamsg(RTM_DELADDR, ifa);
1218 	}
1219 }
1220 
1221 /*
1222  * This is the analogue to the rt_newaddrmsg which performs the same
1223  * function but for multicast group memberhips.  This is easier since
1224  * there is no route state to worry about.
1225  */
1226 void
1227 rt_newmaddrmsg(int cmd, struct ifmultiaddr *ifma)
1228 {
1229 	struct rt_addrinfo rtinfo;
1230 	struct mbuf *m = NULL;
1231 	struct ifnet *ifp = ifma->ifma_ifp;
1232 	struct ifma_msghdr *ifmam;
1233 
1234 	if (route_cb.any_count == 0)
1235 		return;
1236 
1237 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1238 	rtinfo.rti_ifaaddr = ifma->ifma_addr;
1239 	if (ifp != NULL && !TAILQ_EMPTY(&ifp->if_addrheads[mycpuid])) {
1240 		rtinfo.rti_ifpaddr =
1241 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1242 	}
1243 	/*
1244 	 * If a link-layer address is present, present it as a ``gateway''
1245 	 * (similarly to how ARP entries, e.g., are presented).
1246 	 */
1247 	rtinfo.rti_gateway = ifma->ifma_lladdr;
1248 
1249 	m = rt_msg_mbuf(cmd, &rtinfo);
1250 	if (m == NULL)
1251 		return;
1252 
1253 	ifmam = mtod(m, struct ifma_msghdr *);
1254 	ifmam->ifmam_index = ifp->if_index;
1255 	ifmam->ifmam_addrs = rtinfo.rti_addrs;
1256 
1257 	rts_input(m, familyof(ifma->ifma_addr));
1258 }
1259 
1260 static struct mbuf *
1261 rt_makeifannouncemsg(struct ifnet *ifp, int type, int what,
1262 		     struct rt_addrinfo *info)
1263 {
1264 	struct if_announcemsghdr *ifan;
1265 	struct mbuf *m;
1266 
1267 	if (route_cb.any_count == 0)
1268 		return NULL;
1269 
1270 	bzero(info, sizeof(*info));
1271 	m = rt_msg_mbuf(type, info);
1272 	if (m == NULL)
1273 		return NULL;
1274 
1275 	ifan = mtod(m, struct if_announcemsghdr *);
1276 	ifan->ifan_index = ifp->if_index;
1277 	strlcpy(ifan->ifan_name, ifp->if_xname, sizeof ifan->ifan_name);
1278 	ifan->ifan_what = what;
1279 	return m;
1280 }
1281 
1282 /*
1283  * This is called to generate routing socket messages indicating
1284  * IEEE80211 wireless events.
1285  * XXX we piggyback on the RTM_IFANNOUNCE msg format in a clumsy way.
1286  */
1287 void
1288 rt_ieee80211msg(struct ifnet *ifp, int what, void *data, size_t data_len)
1289 {
1290 	struct rt_addrinfo info;
1291 	struct mbuf *m;
1292 
1293 	m = rt_makeifannouncemsg(ifp, RTM_IEEE80211, what, &info);
1294 	if (m == NULL)
1295 		return;
1296 
1297 	/*
1298 	 * Append the ieee80211 data.  Try to stick it in the
1299 	 * mbuf containing the ifannounce msg; otherwise allocate
1300 	 * a new mbuf and append.
1301 	 *
1302 	 * NB: we assume m is a single mbuf.
1303 	 */
1304 	if (data_len > M_TRAILINGSPACE(m)) {
1305 		/* XXX use m_getb(data_len, M_NOWAIT, MT_DATA, 0); */
1306 		struct mbuf *n = m_get(M_NOWAIT, MT_DATA);
1307 		if (n == NULL) {
1308 			m_freem(m);
1309 			return;
1310 		}
1311 		KKASSERT(data_len <= M_TRAILINGSPACE(n));
1312 		bcopy(data, mtod(n, void *), data_len);
1313 		n->m_len = data_len;
1314 		m->m_next = n;
1315 	} else if (data_len > 0) {
1316 		bcopy(data, mtod(m, u_int8_t *) + m->m_len, data_len);
1317 		m->m_len += data_len;
1318 	}
1319 	mbuftrackid(m, 33);
1320 	if (m->m_flags & M_PKTHDR)
1321 		m->m_pkthdr.len += data_len;
1322 	mtod(m, struct if_announcemsghdr *)->ifan_msglen += data_len;
1323 	rts_input(m, 0);
1324 }
1325 
1326 /*
1327  * This is called to generate routing socket messages indicating
1328  * network interface arrival and departure.
1329  */
1330 void
1331 rt_ifannouncemsg(struct ifnet *ifp, int what)
1332 {
1333 	struct rt_addrinfo addrinfo;
1334 	struct mbuf *m;
1335 
1336 	m = rt_makeifannouncemsg(ifp, RTM_IFANNOUNCE, what, &addrinfo);
1337 	if (m != NULL)
1338 		rts_input(m, 0);
1339 }
1340 
1341 static int
1342 resizewalkarg(struct walkarg *w, int len)
1343 {
1344 	void *newptr;
1345 
1346 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
1347 	if (newptr == NULL)
1348 		return (ENOMEM);
1349 	if (w->w_tmem != NULL)
1350 		kfree(w->w_tmem, M_RTABLE);
1351 	w->w_tmem = newptr;
1352 	w->w_tmemsize = len;
1353 	return (0);
1354 }
1355 
1356 static void
1357 ifnet_compute_stats(struct ifnet *ifp)
1358 {
1359 	IFNET_STAT_GET(ifp, ipackets, ifp->if_ipackets);
1360 	IFNET_STAT_GET(ifp, ierrors, ifp->if_ierrors);
1361 	IFNET_STAT_GET(ifp, opackets, ifp->if_opackets);
1362 	IFNET_STAT_GET(ifp, collisions, ifp->if_collisions);
1363 	IFNET_STAT_GET(ifp, ibytes, ifp->if_ibytes);
1364 	IFNET_STAT_GET(ifp, obytes, ifp->if_obytes);
1365 	IFNET_STAT_GET(ifp, imcasts, ifp->if_imcasts);
1366 	IFNET_STAT_GET(ifp, omcasts, ifp->if_omcasts);
1367 	IFNET_STAT_GET(ifp, iqdrops, ifp->if_iqdrops);
1368 	IFNET_STAT_GET(ifp, noproto, ifp->if_noproto);
1369 	IFNET_STAT_GET(ifp, oqdrops, ifp->if_oqdrops);
1370 }
1371 
1372 static int
1373 sysctl_iflist(int af, struct walkarg *w)
1374 {
1375 	struct ifnet *ifp;
1376 	struct rt_addrinfo rtinfo;
1377 	int msglen, error;
1378 
1379 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1380 
1381 	ifnet_lock();
1382 	TAILQ_FOREACH(ifp, &ifnetlist, if_link) {
1383 		struct ifaddr_container *ifac, *ifac_mark;
1384 		struct ifaddr_marker mark;
1385 		struct ifaddrhead *head;
1386 		struct ifaddr *ifa;
1387 
1388 		if (w->w_arg && w->w_arg != ifp->if_index)
1389 			continue;
1390 		head = &ifp->if_addrheads[mycpuid];
1391 		/*
1392 		 * There is no need to reference the first ifaddr
1393 		 * even if the following resizewalkarg() blocks,
1394 		 * since the first ifaddr will not be destroyed
1395 		 * when the ifnet lock is held.
1396 		 */
1397 		ifac = TAILQ_FIRST(head);
1398 		ifa = ifac->ifa;
1399 		rtinfo.rti_ifpaddr = ifa->ifa_addr;
1400 		msglen = rt_msgsize(RTM_IFINFO, &rtinfo);
1401 		if (w->w_tmemsize < msglen && resizewalkarg(w, msglen) != 0) {
1402 			ifnet_unlock();
1403 			return (ENOMEM);
1404 		}
1405 		rt_msg_buffer(RTM_IFINFO, &rtinfo, w->w_tmem, msglen);
1406 		rtinfo.rti_ifpaddr = NULL;
1407 		if (w->w_req != NULL && w->w_tmem != NULL) {
1408 			struct if_msghdr *ifm = w->w_tmem;
1409 
1410 			ifm->ifm_index = ifp->if_index;
1411 			ifm->ifm_flags = ifp->if_flags;
1412 			ifnet_compute_stats(ifp);
1413 			ifm->ifm_data = ifp->if_data;
1414 			ifm->ifm_addrs = rtinfo.rti_addrs;
1415 			error = SYSCTL_OUT(w->w_req, ifm, msglen);
1416 			if (error) {
1417 				ifnet_unlock();
1418 				return (error);
1419 			}
1420 		}
1421 		/*
1422 		 * Add a marker, since SYSCTL_OUT() could block and during
1423 		 * that period the list could be changed.
1424 		 */
1425 		ifa_marker_init(&mark, ifp);
1426 		ifac_mark = &mark.ifac;
1427 		TAILQ_INSERT_AFTER(head, ifac, ifac_mark, ifa_link);
1428 		while ((ifac = TAILQ_NEXT(ifac_mark, ifa_link)) != NULL) {
1429 			TAILQ_REMOVE(head, ifac_mark, ifa_link);
1430 			TAILQ_INSERT_AFTER(head, ifac, ifac_mark, ifa_link);
1431 
1432 			ifa = ifac->ifa;
1433 
1434 			/* Ignore marker */
1435 			if (ifa->ifa_addr->sa_family == AF_UNSPEC)
1436 				continue;
1437 
1438 			if (af && af != ifa->ifa_addr->sa_family)
1439 				continue;
1440 			if (curproc->p_ucred->cr_prison &&
1441 			    prison_if(curproc->p_ucred, ifa->ifa_addr))
1442 				continue;
1443 			rtinfo.rti_ifaaddr = ifa->ifa_addr;
1444 			rtinfo.rti_netmask = ifa->ifa_netmask;
1445 			rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1446 			msglen = rt_msgsize(RTM_NEWADDR, &rtinfo);
1447 			/*
1448 			 * Keep a reference on this ifaddr, so that it will
1449 			 * not be destroyed if the following resizewalkarg()
1450 			 * blocks.
1451 			 */
1452 			IFAREF(ifa);
1453 			if (w->w_tmemsize < msglen &&
1454 			    resizewalkarg(w, msglen) != 0) {
1455 				IFAFREE(ifa);
1456 				TAILQ_REMOVE(head, ifac_mark, ifa_link);
1457 				ifnet_unlock();
1458 				return (ENOMEM);
1459 			}
1460 			rt_msg_buffer(RTM_NEWADDR, &rtinfo, w->w_tmem, msglen);
1461 			if (w->w_req != NULL) {
1462 				struct ifa_msghdr *ifam = w->w_tmem;
1463 
1464 				ifam->ifam_index = ifa->ifa_ifp->if_index;
1465 				ifam->ifam_flags = ifa->ifa_flags;
1466 				ifam->ifam_metric = ifa->ifa_metric;
1467 				ifam->ifam_addrs = rtinfo.rti_addrs;
1468 				error = SYSCTL_OUT(w->w_req, w->w_tmem, msglen);
1469 				if (error) {
1470 					IFAFREE(ifa);
1471 					TAILQ_REMOVE(head, ifac_mark, ifa_link);
1472 					ifnet_unlock();
1473 					return (error);
1474 				}
1475 			}
1476 			IFAFREE(ifa);
1477 		}
1478 		TAILQ_REMOVE(head, ifac_mark, ifa_link);
1479 		rtinfo.rti_netmask = NULL;
1480 		rtinfo.rti_ifaaddr = NULL;
1481 		rtinfo.rti_bcastaddr = NULL;
1482 	}
1483 	ifnet_unlock();
1484 	return (0);
1485 }
1486 
1487 static int
1488 rttable_walkarg_create(struct rttable_walkarg *w, int op, int arg)
1489 {
1490 	struct rt_addrinfo rtinfo;
1491 	struct sockaddr_storage ss;
1492 	int i, msglen;
1493 
1494 	memset(w, 0, sizeof(*w));
1495 	w->w_op = op;
1496 	w->w_arg = arg;
1497 
1498 	memset(&ss, 0, sizeof(ss));
1499 	ss.ss_len = sizeof(ss);
1500 
1501 	memset(&rtinfo, 0, sizeof(rtinfo));
1502 	for (i = 0; i < RTAX_MAX; ++i)
1503 		rtinfo.rti_info[i] = (struct sockaddr *)&ss;
1504 	msglen = rt_msgsize(RTM_GET, &rtinfo);
1505 
1506 	w->w_bufsz = msglen * RTTABLE_DUMP_MSGCNT_MAX;
1507 	w->w_buf = kmalloc(w->w_bufsz, M_TEMP, M_WAITOK | M_NULLOK);
1508 	if (w->w_buf == NULL)
1509 		return ENOMEM;
1510 	return 0;
1511 }
1512 
1513 static void
1514 rttable_walkarg_destroy(struct rttable_walkarg *w)
1515 {
1516 	kfree(w->w_buf, M_TEMP);
1517 }
1518 
1519 static void
1520 rttable_entry_rtinfo(struct rt_addrinfo *rtinfo, struct radix_node *rn)
1521 {
1522 	struct rtentry *rt = (struct rtentry *)rn;
1523 
1524 	bzero(rtinfo, sizeof(*rtinfo));
1525 	rtinfo->rti_dst = rt_key(rt);
1526 	rtinfo->rti_gateway = rt->rt_gateway;
1527 	rtinfo->rti_netmask = rt_mask(rt);
1528 	rtinfo->rti_genmask = rt->rt_genmask;
1529 	if (rt->rt_ifp != NULL) {
1530 		rtinfo->rti_ifpaddr =
1531 		TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1532 		rtinfo->rti_ifaaddr = rt->rt_ifa->ifa_addr;
1533 		if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
1534 			rtinfo->rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
1535 	}
1536 }
1537 
1538 static int
1539 rttable_walk_entry(struct radix_node *rn, void *xw)
1540 {
1541 	struct rttable_walkarg *w = xw;
1542 	struct rtentry *rt = (struct rtentry *)rn;
1543 	struct rt_addrinfo rtinfo;
1544 	struct rt_msghdr *rtm;
1545 	boolean_t save = FALSE;
1546 	int msglen, w_bufleft;
1547 	void *ptr;
1548 
1549 	rttable_entry_rtinfo(&rtinfo, rn);
1550 	msglen = rt_msgsize(RTM_GET, &rtinfo);
1551 
1552 	w_bufleft = w->w_bufsz - w->w_buflen;
1553 
1554 	if (rn->rn_dupedkey != NULL) {
1555 		struct radix_node *rn1 = rn;
1556 		int total_msglen = msglen;
1557 
1558 		/*
1559 		 * Make sure that we have enough space left for all
1560 		 * dupedkeys, since rn_walktree_at always starts
1561 		 * from the first dupedkey.
1562 		 */
1563 		while ((rn1 = rn1->rn_dupedkey) != NULL) {
1564 			struct rt_addrinfo rtinfo1;
1565 			int msglen1;
1566 
1567 			if (rn1->rn_flags & RNF_ROOT)
1568 				continue;
1569 
1570 			rttable_entry_rtinfo(&rtinfo1, rn1);
1571 			msglen1 = rt_msgsize(RTM_GET, &rtinfo1);
1572 			total_msglen += msglen1;
1573 		}
1574 
1575 		if (total_msglen > w_bufleft) {
1576 			if (total_msglen > w->w_bufsz) {
1577 				static int logged = 0;
1578 
1579 				if (!logged) {
1580 					kprintf("buffer is too small for "
1581 					    "all dupedkeys, increase "
1582 					    "RTTABLE_DUMP_MSGCNT_MAX\n");
1583 					logged = 1;
1584 				}
1585 				return ENOMEM;
1586 			}
1587 			save = TRUE;
1588 		}
1589 	} else if (msglen > w_bufleft) {
1590 		save = TRUE;
1591 	}
1592 
1593 	if (save) {
1594 		/*
1595 		 * Not enough buffer left; remember the position
1596 		 * to start from upon next round.
1597 		 */
1598 		KASSERT(msglen <= w->w_bufsz, ("msg too long %d", msglen));
1599 
1600 		KASSERT(rtinfo.rti_dst->sa_len <= sizeof(w->w_key0),
1601 		    ("key too long %d", rtinfo.rti_dst->sa_len));
1602 		memset(&w->w_key0, 0, sizeof(w->w_key0));
1603 		memcpy(&w->w_key0, rtinfo.rti_dst, rtinfo.rti_dst->sa_len);
1604 		w->w_key = (const char *)&w->w_key0;
1605 
1606 		if (rtinfo.rti_netmask != NULL) {
1607 			KASSERT(
1608 			    rtinfo.rti_netmask->sa_len <= sizeof(w->w_mask0),
1609 			    ("mask too long %d", rtinfo.rti_netmask->sa_len));
1610 			memset(&w->w_mask0, 0, sizeof(w->w_mask0));
1611 			memcpy(&w->w_mask0, rtinfo.rti_netmask,
1612 			    rtinfo.rti_netmask->sa_len);
1613 			w->w_mask = (const char *)&w->w_mask0;
1614 		} else {
1615 			w->w_mask = NULL;
1616 		}
1617 		return EJUSTRETURN;
1618 	}
1619 
1620 	if (w->w_op == NET_RT_FLAGS && !(rt->rt_flags & w->w_arg))
1621 		return 0;
1622 
1623 	ptr = ((uint8_t *)w->w_buf) + w->w_buflen;
1624 	rt_msg_buffer(RTM_GET, &rtinfo, ptr, msglen);
1625 
1626 	rtm = (struct rt_msghdr *)ptr;
1627 	rtm->rtm_flags = rt->rt_flags;
1628 	rtm->rtm_use = rt->rt_use;
1629 	rtm->rtm_rmx = rt->rt_rmx;
1630 	rtm->rtm_index = rt->rt_ifp->if_index;
1631 	rtm->rtm_errno = rtm->rtm_pid = rtm->rtm_seq = 0;
1632 	rtm->rtm_addrs = rtinfo.rti_addrs;
1633 
1634 	w->w_buflen += msglen;
1635 
1636 	return 0;
1637 }
1638 
1639 static void
1640 rttable_walk_dispatch(netmsg_t msg)
1641 {
1642 	struct netmsg_rttable_walk *nmsg = (struct netmsg_rttable_walk *)msg;
1643 	struct radix_node_head *rnh = rt_tables[mycpuid][nmsg->af];
1644 	struct rttable_walkarg *w = nmsg->w;
1645 	int error;
1646 
1647 	error = rnh->rnh_walktree_at(rnh, w->w_key, w->w_mask,
1648 	    rttable_walk_entry, w);
1649 	lwkt_replymsg(&nmsg->base.lmsg, error);
1650 }
1651 
1652 static int
1653 sysctl_rttable(int af, struct sysctl_req *req, int op, int arg)
1654 {
1655 	struct rttable_walkarg w;
1656 	int error, i;
1657 
1658 	error = rttable_walkarg_create(&w, op, arg);
1659 	if (error)
1660 		return error;
1661 
1662 	error = EINVAL;
1663 	for (i = 1; i <= AF_MAX; i++) {
1664 		if (rt_tables[mycpuid][i] != NULL && (af == 0 || af == i)) {
1665 			w.w_key = NULL;
1666 			w.w_mask = NULL;
1667 			for (;;) {
1668 				struct netmsg_rttable_walk nmsg;
1669 
1670 				netmsg_init(&nmsg.base, NULL,
1671 				    &curthread->td_msgport, 0,
1672 				    rttable_walk_dispatch);
1673 				nmsg.af = i;
1674 				nmsg.w = &w;
1675 
1676 				w.w_buflen = 0;
1677 
1678 				error = lwkt_domsg(netisr_cpuport(mycpuid),
1679 				    &nmsg.base.lmsg, 0);
1680 				if (error && error != EJUSTRETURN)
1681 					goto done;
1682 
1683 				if (req != NULL && w.w_buflen > 0) {
1684 					int error1;
1685 
1686 					error1 = SYSCTL_OUT(req, w.w_buf,
1687 					    w.w_buflen);
1688 					if (error1) {
1689 						error = error1;
1690 						goto done;
1691 					}
1692 				}
1693 				if (error == 0) /* done */
1694 					break;
1695 			}
1696 		}
1697 	}
1698 done:
1699 	rttable_walkarg_destroy(&w);
1700 	return error;
1701 }
1702 
1703 static int
1704 sysctl_rtsock(SYSCTL_HANDLER_ARGS)
1705 {
1706 	int	*name = (int *)arg1;
1707 	u_int	namelen = arg2;
1708 	int	error = EINVAL;
1709 	int	origcpu, cpu;
1710 	u_char  af;
1711 	struct	walkarg w;
1712 
1713 	name ++;
1714 	namelen--;
1715 	if (req->newptr)
1716 		return (EPERM);
1717 	if (namelen != 3 && namelen != 4)
1718 		return (EINVAL);
1719 	af = name[0];
1720 	bzero(&w, sizeof w);
1721 	w.w_op = name[1];
1722 	w.w_arg = name[2];
1723 	w.w_req = req;
1724 
1725 	/*
1726 	 * Optional third argument specifies cpu, used primarily for
1727 	 * debugging the route table.
1728 	 */
1729 	if (namelen == 4) {
1730 		if (name[3] < 0 || name[3] >= netisr_ncpus)
1731 			return (EINVAL);
1732 		cpu = name[3];
1733 	} else {
1734 		/*
1735 		 * Target cpu is not specified, use cpu0 then, so that
1736 		 * the result set will be relatively stable.
1737 		 */
1738 		cpu = 0;
1739 	}
1740 	origcpu = mycpuid;
1741 	lwkt_migratecpu(cpu);
1742 
1743 	switch (w.w_op) {
1744 	case NET_RT_DUMP:
1745 	case NET_RT_FLAGS:
1746 		error = sysctl_rttable(af, w.w_req, w.w_op, w.w_arg);
1747 		break;
1748 
1749 	case NET_RT_IFLIST:
1750 		error = sysctl_iflist(af, &w);
1751 		break;
1752 	}
1753 	if (w.w_tmem != NULL)
1754 		kfree(w.w_tmem, M_RTABLE);
1755 
1756 	lwkt_migratecpu(origcpu);
1757 	return (error);
1758 }
1759 
1760 SYSCTL_NODE(_net, PF_ROUTE, routetable, CTLFLAG_RD, sysctl_rtsock, "");
1761 
1762 /*
1763  * Definitions of protocols supported in the ROUTE domain.
1764  */
1765 
1766 static struct domain routedomain;		/* or at least forward */
1767 
1768 static struct protosw routesw[] = {
1769     {
1770 	.pr_type = SOCK_RAW,
1771 	.pr_domain = &routedomain,
1772 	.pr_protocol = 0,
1773 	.pr_flags = PR_ATOMIC|PR_ADDR,
1774 	.pr_input = NULL,
1775 	.pr_output = route_output,
1776 	.pr_ctlinput = raw_ctlinput,
1777 	.pr_ctloutput = route_ctloutput,
1778 	.pr_ctlport = cpu0_ctlport,
1779 
1780 	.pr_init = raw_init,
1781 	.pr_usrreqs = &route_usrreqs
1782     }
1783 };
1784 
1785 static struct domain routedomain = {
1786 	.dom_family		= AF_ROUTE,
1787 	.dom_name		= "route",
1788 	.dom_init		= NULL,
1789 	.dom_externalize	= NULL,
1790 	.dom_dispose		= NULL,
1791 	.dom_protosw		= routesw,
1792 	.dom_protoswNPROTOSW	= &routesw[(sizeof routesw)/(sizeof routesw[0])],
1793 	.dom_next		= SLIST_ENTRY_INITIALIZER,
1794 	.dom_rtattach		= NULL,
1795 	.dom_rtoffset		= 0,
1796 	.dom_maxrtkey		= 0,
1797 	.dom_ifattach		= NULL,
1798 	.dom_ifdetach		= NULL
1799 };
1800 
1801 DOMAIN_SET(route);
1802 
1803