xref: /dragonfly/sys/net/rtsock.c (revision ce7a3582)
1 /*
2  * Copyright (c) 2004, 2005 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Jeffrey M. Hsu.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of The DragonFly Project nor the names of its
16  *    contributors may be used to endorse or promote products derived
17  *    from this software without specific, prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
27  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
29  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1988, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. All advertising materials mentioning features or use of this software
46  *    must display the following acknowledgement:
47  *	This product includes software developed by the University of
48  *	California, Berkeley and its contributors.
49  * 4. Neither the name of the University nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63  * SUCH DAMAGE.
64  *
65  *	@(#)rtsock.c	8.7 (Berkeley) 10/12/95
66  * $FreeBSD: src/sys/net/rtsock.c,v 1.44.2.11 2002/12/04 14:05:41 ru Exp $
67  * $DragonFly: src/sys/net/rtsock.c,v 1.45 2008/10/27 02:56:30 sephe Exp $
68  */
69 
70 #include "opt_sctp.h"
71 
72 #include <sys/param.h>
73 #include <sys/systm.h>
74 #include <sys/kernel.h>
75 #include <sys/sysctl.h>
76 #include <sys/proc.h>
77 #include <sys/priv.h>
78 #include <sys/malloc.h>
79 #include <sys/mbuf.h>
80 #include <sys/protosw.h>
81 #include <sys/socket.h>
82 #include <sys/socketvar.h>
83 #include <sys/domain.h>
84 
85 #include <sys/thread2.h>
86 #include <sys/socketvar2.h>
87 
88 #include <net/if.h>
89 #include <net/route.h>
90 #include <net/raw_cb.h>
91 #include <net/netmsg2.h>
92 
93 #ifdef SCTP
94 extern void sctp_add_ip_address(struct ifaddr *ifa);
95 extern void sctp_delete_ip_address(struct ifaddr *ifa);
96 #endif /* SCTP */
97 
98 MALLOC_DEFINE(M_RTABLE, "routetbl", "routing tables");
99 
100 static struct route_cb {
101 	int	ip_count;
102 	int	ip6_count;
103 	int	ipx_count;
104 	int	ns_count;
105 	int	any_count;
106 } route_cb;
107 
108 static const struct sockaddr route_src = { 2, PF_ROUTE, };
109 
110 struct walkarg {
111 	int	w_tmemsize;
112 	int	w_op, w_arg;
113 	void	*w_tmem;
114 	struct sysctl_req *w_req;
115 };
116 
117 static struct mbuf *
118 		rt_msg_mbuf (int, struct rt_addrinfo *);
119 static void	rt_msg_buffer (int, struct rt_addrinfo *, void *buf, int len);
120 static int	rt_msgsize (int type, struct rt_addrinfo *rtinfo);
121 static int	rt_xaddrs (char *, char *, struct rt_addrinfo *);
122 static int	sysctl_dumpentry (struct radix_node *rn, void *vw);
123 static int	sysctl_iflist (int af, struct walkarg *w);
124 static int	route_output(struct mbuf *, struct socket *, ...);
125 static void	rt_setmetrics (u_long, struct rt_metrics *,
126 			       struct rt_metrics *);
127 
128 /*
129  * It really doesn't make any sense at all for this code to share much
130  * with raw_usrreq.c, since its functionality is so restricted.  XXX
131  */
132 static void
133 rts_abort(netmsg_t msg)
134 {
135 	crit_enter();
136 	raw_usrreqs.pru_abort(msg);
137 	/* msg invalid now */
138 	crit_exit();
139 }
140 
141 /* pru_accept is EOPNOTSUPP */
142 
143 static void
144 rts_attach(netmsg_t msg)
145 {
146 	struct socket *so = msg->base.nm_so;
147 	struct pru_attach_info *ai = msg->attach.nm_ai;
148 	struct rawcb *rp;
149 	int proto = msg->attach.nm_proto;
150 	int error;
151 
152 	crit_enter();
153 	if (sotorawcb(so) != NULL) {
154 		error = EISCONN;
155 		goto done;
156 	}
157 
158 	rp = kmalloc(sizeof *rp, M_PCB, M_WAITOK | M_ZERO);
159 
160 	/*
161 	 * The critical section is necessary to block protocols from sending
162 	 * error notifications (like RTM_REDIRECT or RTM_LOSING) while
163 	 * this PCB is extant but incompletely initialized.
164 	 * Probably we should try to do more of this work beforehand and
165 	 * eliminate the critical section.
166 	 */
167 	so->so_pcb = rp;
168 	soreference(so);	/* so_pcb assignment */
169 	error = raw_attach(so, proto, ai->sb_rlimit);
170 	rp = sotorawcb(so);
171 	if (error) {
172 		kfree(rp, M_PCB);
173 		goto done;
174 	}
175 	switch(rp->rcb_proto.sp_protocol) {
176 	case AF_INET:
177 		route_cb.ip_count++;
178 		break;
179 	case AF_INET6:
180 		route_cb.ip6_count++;
181 		break;
182 	case AF_IPX:
183 		route_cb.ipx_count++;
184 		break;
185 	case AF_NS:
186 		route_cb.ns_count++;
187 		break;
188 	}
189 	rp->rcb_faddr = &route_src;
190 	route_cb.any_count++;
191 	soisconnected(so);
192 	so->so_options |= SO_USELOOPBACK;
193 	error = 0;
194 done:
195 	crit_exit();
196 	lwkt_replymsg(&msg->lmsg, error);
197 }
198 
199 static void
200 rts_bind(netmsg_t msg)
201 {
202 	crit_enter();
203 	raw_usrreqs.pru_bind(msg); /* xxx just EINVAL */
204 	/* msg invalid now */
205 	crit_exit();
206 }
207 
208 static void
209 rts_connect(netmsg_t msg)
210 {
211 	crit_enter();
212 	raw_usrreqs.pru_connect(msg); /* XXX just EINVAL */
213 	/* msg invalid now */
214 	crit_exit();
215 }
216 
217 /* pru_connect2 is EOPNOTSUPP */
218 /* pru_control is EOPNOTSUPP */
219 
220 static void
221 rts_detach(netmsg_t msg)
222 {
223 	struct socket *so = msg->base.nm_so;
224 	struct rawcb *rp = sotorawcb(so);
225 
226 	crit_enter();
227 	if (rp != NULL) {
228 		switch(rp->rcb_proto.sp_protocol) {
229 		case AF_INET:
230 			route_cb.ip_count--;
231 			break;
232 		case AF_INET6:
233 			route_cb.ip6_count--;
234 			break;
235 		case AF_IPX:
236 			route_cb.ipx_count--;
237 			break;
238 		case AF_NS:
239 			route_cb.ns_count--;
240 			break;
241 		}
242 		route_cb.any_count--;
243 	}
244 	raw_usrreqs.pru_detach(msg);
245 	/* msg invalid now */
246 	crit_exit();
247 }
248 
249 static void
250 rts_disconnect(netmsg_t msg)
251 {
252 	crit_enter();
253 	raw_usrreqs.pru_disconnect(msg);
254 	/* msg invalid now */
255 	crit_exit();
256 }
257 
258 /* pru_listen is EOPNOTSUPP */
259 
260 static void
261 rts_peeraddr(netmsg_t msg)
262 {
263 	crit_enter();
264 	raw_usrreqs.pru_peeraddr(msg);
265 	/* msg invalid now */
266 	crit_exit();
267 }
268 
269 /* pru_rcvd is EOPNOTSUPP */
270 /* pru_rcvoob is EOPNOTSUPP */
271 
272 static void
273 rts_send(netmsg_t msg)
274 {
275 	crit_enter();
276 	raw_usrreqs.pru_send(msg);
277 	/* msg invalid now */
278 	crit_exit();
279 }
280 
281 /* pru_sense is null */
282 
283 static void
284 rts_shutdown(netmsg_t msg)
285 {
286 	crit_enter();
287 	raw_usrreqs.pru_shutdown(msg);
288 	/* msg invalid now */
289 	crit_exit();
290 }
291 
292 static void
293 rts_sockaddr(netmsg_t msg)
294 {
295 	crit_enter();
296 	raw_usrreqs.pru_sockaddr(msg);
297 	/* msg invalid now */
298 	crit_exit();
299 }
300 
301 static struct pr_usrreqs route_usrreqs = {
302 	.pru_abort = rts_abort,
303 	.pru_accept = pr_generic_notsupp,
304 	.pru_attach = rts_attach,
305 	.pru_bind = rts_bind,
306 	.pru_connect = rts_connect,
307 	.pru_connect2 = pr_generic_notsupp,
308 	.pru_control = pr_generic_notsupp,
309 	.pru_detach = rts_detach,
310 	.pru_disconnect = rts_disconnect,
311 	.pru_listen = pr_generic_notsupp,
312 	.pru_peeraddr = rts_peeraddr,
313 	.pru_rcvd = pr_generic_notsupp,
314 	.pru_rcvoob = pr_generic_notsupp,
315 	.pru_send = rts_send,
316 	.pru_sense = pru_sense_null,
317 	.pru_shutdown = rts_shutdown,
318 	.pru_sockaddr = rts_sockaddr,
319 	.pru_sosend = sosend,
320 	.pru_soreceive = soreceive
321 };
322 
323 static __inline sa_family_t
324 familyof(struct sockaddr *sa)
325 {
326 	return (sa != NULL ? sa->sa_family : 0);
327 }
328 
329 /*
330  * Routing socket input function.  The packet must be serialized onto cpu 0.
331  * We use the cpu0_soport() netisr processing loop to handle it.
332  *
333  * This looks messy but it means that anyone, including interrupt code,
334  * can send a message to the routing socket.
335  */
336 static void
337 rts_input_handler(netmsg_t msg)
338 {
339 	static const struct sockaddr route_dst = { 2, PF_ROUTE, };
340 	struct sockproto route_proto;
341 	struct netmsg_packet *pmsg = &msg->packet;
342 	struct mbuf *m;
343 	sa_family_t family;
344 	struct rawcb *skip;
345 
346 	family = pmsg->base.lmsg.u.ms_result;
347 	route_proto.sp_family = PF_ROUTE;
348 	route_proto.sp_protocol = family;
349 
350 	m = pmsg->nm_packet;
351 	M_ASSERTPKTHDR(m);
352 
353 	skip = m->m_pkthdr.header;
354 	m->m_pkthdr.header = NULL;
355 
356 	raw_input(m, &route_proto, &route_src, &route_dst, skip);
357 }
358 
359 static void
360 rts_input_skip(struct mbuf *m, sa_family_t family, struct rawcb *skip)
361 {
362 	struct netmsg_packet *pmsg;
363 	lwkt_port_t port;
364 
365 	M_ASSERTPKTHDR(m);
366 
367 	port = cpu_portfn(0);	/* XXX same as for routing socket */
368 	pmsg = &m->m_hdr.mh_netmsg;
369 	netmsg_init(&pmsg->base, NULL, &netisr_apanic_rport,
370 		    0, rts_input_handler);
371 	pmsg->nm_packet = m;
372 	pmsg->base.lmsg.u.ms_result = family;
373 	m->m_pkthdr.header = skip; /* XXX steal field in pkthdr */
374 	lwkt_sendmsg(port, &pmsg->base.lmsg);
375 }
376 
377 static __inline void
378 rts_input(struct mbuf *m, sa_family_t family)
379 {
380 	rts_input_skip(m, family, NULL);
381 }
382 
383 static void *
384 reallocbuf_nofree(void *ptr, size_t len, size_t olen)
385 {
386 	void *newptr;
387 
388 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
389 	if (newptr == NULL)
390 		return NULL;
391 	bcopy(ptr, newptr, olen);
392 	return (newptr);
393 }
394 
395 /*
396  * Internal helper routine for route_output().
397  */
398 static int
399 _fillrtmsg(struct rt_msghdr **prtm, struct rtentry *rt,
400 	   struct rt_addrinfo *rtinfo)
401 {
402 	int msglen;
403 	struct rt_msghdr *rtm = *prtm;
404 
405 	/* Fill in rt_addrinfo for call to rt_msg_buffer(). */
406 	rtinfo->rti_dst = rt_key(rt);
407 	rtinfo->rti_gateway = rt->rt_gateway;
408 	rtinfo->rti_netmask = rt_mask(rt);		/* might be NULL */
409 	rtinfo->rti_genmask = rt->rt_genmask;		/* might be NULL */
410 	if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
411 		if (rt->rt_ifp != NULL) {
412 			rtinfo->rti_ifpaddr =
413 			    TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])
414 			    ->ifa->ifa_addr;
415 			rtinfo->rti_ifaaddr = rt->rt_ifa->ifa_addr;
416 			if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
417 				rtinfo->rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
418 			rtm->rtm_index = rt->rt_ifp->if_index;
419 		} else {
420 			rtinfo->rti_ifpaddr = NULL;
421 			rtinfo->rti_ifaaddr = NULL;
422 		}
423 	} else if (rt->rt_ifp != NULL) {
424 		rtm->rtm_index = rt->rt_ifp->if_index;
425 	}
426 
427 	msglen = rt_msgsize(rtm->rtm_type, rtinfo);
428 	if (rtm->rtm_msglen < msglen) {
429 		/* NOTE: Caller will free the old rtm accordingly */
430 		rtm = reallocbuf_nofree(rtm, msglen, rtm->rtm_msglen);
431 		if (rtm == NULL)
432 			return (ENOBUFS);
433 		*prtm = rtm;
434 	}
435 	rt_msg_buffer(rtm->rtm_type, rtinfo, rtm, msglen);
436 
437 	rtm->rtm_flags = rt->rt_flags;
438 	rtm->rtm_rmx = rt->rt_rmx;
439 	rtm->rtm_addrs = rtinfo->rti_addrs;
440 
441 	return (0);
442 }
443 
444 struct rtm_arg {
445 	struct rt_msghdr	*bak_rtm;
446 	struct rt_msghdr	*new_rtm;
447 };
448 
449 static int
450 fillrtmsg(struct rtm_arg *arg, struct rtentry *rt,
451 	  struct rt_addrinfo *rtinfo)
452 {
453 	struct rt_msghdr *rtm = arg->new_rtm;
454 	int error;
455 
456 	error = _fillrtmsg(&rtm, rt, rtinfo);
457 	if (!error) {
458 		if (arg->new_rtm != rtm) {
459 			/*
460 			 * _fillrtmsg() just allocated a new rtm;
461 			 * if the previously allocated rtm is not
462 			 * the backing rtm, it should be freed.
463 			 */
464 			if (arg->new_rtm != arg->bak_rtm)
465 				kfree(arg->new_rtm, M_RTABLE);
466 			arg->new_rtm = rtm;
467 		}
468 	}
469 	return error;
470 }
471 
472 static void route_output_add_callback(int, int, struct rt_addrinfo *,
473 					struct rtentry *, void *);
474 static void route_output_delete_callback(int, int, struct rt_addrinfo *,
475 					struct rtentry *, void *);
476 static int route_output_get_callback(int, struct rt_addrinfo *,
477 				     struct rtentry *, void *, int);
478 static int route_output_change_callback(int, struct rt_addrinfo *,
479 					struct rtentry *, void *, int);
480 static int route_output_lock_callback(int, struct rt_addrinfo *,
481 				      struct rtentry *, void *, int);
482 
483 /*ARGSUSED*/
484 static int
485 route_output(struct mbuf *m, struct socket *so, ...)
486 {
487 	struct rtm_arg arg;
488 	struct rt_msghdr *rtm = NULL;
489 	struct rawcb *rp = NULL;
490 	struct pr_output_info *oi;
491 	struct rt_addrinfo rtinfo;
492 	sa_family_t family;
493 	int len, error = 0;
494 	__va_list ap;
495 
496 	M_ASSERTPKTHDR(m);
497 
498 	__va_start(ap, so);
499 	oi = __va_arg(ap, struct pr_output_info *);
500 	__va_end(ap);
501 
502 	family = familyof(NULL);
503 
504 #define gotoerr(e) { error = e; goto flush;}
505 
506 	if (m == NULL ||
507 	    (m->m_len < sizeof(long) &&
508 	     (m = m_pullup(m, sizeof(long))) == NULL))
509 		return (ENOBUFS);
510 	len = m->m_pkthdr.len;
511 	if (len < sizeof(struct rt_msghdr) ||
512 	    len != mtod(m, struct rt_msghdr *)->rtm_msglen)
513 		gotoerr(EINVAL);
514 
515 	rtm = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
516 	if (rtm == NULL)
517 		gotoerr(ENOBUFS);
518 
519 	m_copydata(m, 0, len, (caddr_t)rtm);
520 	if (rtm->rtm_version != RTM_VERSION)
521 		gotoerr(EPROTONOSUPPORT);
522 
523 	rtm->rtm_pid = oi->p_pid;
524 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
525 	rtinfo.rti_addrs = rtm->rtm_addrs;
526 	if (rt_xaddrs((char *)(rtm + 1), (char *)rtm + len, &rtinfo) != 0)
527 		gotoerr(EINVAL);
528 
529 	rtinfo.rti_flags = rtm->rtm_flags;
530 	if (rtinfo.rti_dst == NULL || rtinfo.rti_dst->sa_family >= AF_MAX ||
531 	    (rtinfo.rti_gateway && rtinfo.rti_gateway->sa_family >= AF_MAX))
532 		gotoerr(EINVAL);
533 
534 	family = familyof(rtinfo.rti_dst);
535 
536 	if (rtinfo.rti_genmask != NULL) {
537 		error = rtmask_add_global(rtinfo.rti_genmask);
538 		if (error)
539 			goto flush;
540 	}
541 
542 	/*
543 	 * Verify that the caller has the appropriate privilege; RTM_GET
544 	 * is the only operation the non-superuser is allowed.
545 	 */
546 	if (rtm->rtm_type != RTM_GET &&
547 	    priv_check_cred(so->so_cred, PRIV_ROOT, 0) != 0)
548 		gotoerr(EPERM);
549 
550 	switch (rtm->rtm_type) {
551 	case RTM_ADD:
552 		if (rtinfo.rti_gateway == NULL) {
553 			error = EINVAL;
554 		} else {
555 			error = rtrequest1_global(RTM_ADD, &rtinfo,
556 					  route_output_add_callback, rtm);
557 		}
558 		break;
559 	case RTM_DELETE:
560 		/*
561 		 * Backing rtm (bak_rtm) could _not_ be freed during
562 		 * rtrequest1_global or rtsearch_global, even if the
563 		 * callback reallocates the rtm due to its size changes,
564 		 * since rtinfo points to the backing rtm's memory area.
565 		 * After rtrequest1_global or rtsearch_global returns,
566 		 * it is safe to free the backing rtm, since rtinfo will
567 		 * not be used anymore.
568 		 *
569 		 * new_rtm will be used to save the new rtm allocated
570 		 * by rtrequest1_global or rtsearch_global.
571 		 */
572 		arg.bak_rtm = rtm;
573 		arg.new_rtm = rtm;
574 		error = rtrequest1_global(RTM_DELETE, &rtinfo,
575 					  route_output_delete_callback, &arg);
576 		rtm = arg.new_rtm;
577 		if (rtm != arg.bak_rtm)
578 			kfree(arg.bak_rtm, M_RTABLE);
579 		break;
580 	case RTM_GET:
581 		/* See the comment in RTM_DELETE */
582 		arg.bak_rtm = rtm;
583 		arg.new_rtm = rtm;
584 		error = rtsearch_global(RTM_GET, &rtinfo,
585 					route_output_get_callback, &arg,
586 					RTS_NOEXACTMATCH);
587 		rtm = arg.new_rtm;
588 		if (rtm != arg.bak_rtm)
589 			kfree(arg.bak_rtm, M_RTABLE);
590 		break;
591 	case RTM_CHANGE:
592 		error = rtsearch_global(RTM_CHANGE, &rtinfo,
593 					route_output_change_callback, rtm,
594 					RTS_EXACTMATCH);
595 		break;
596 	case RTM_LOCK:
597 		error = rtsearch_global(RTM_LOCK, &rtinfo,
598 					route_output_lock_callback, rtm,
599 					RTS_EXACTMATCH);
600 		break;
601 	default:
602 		error = EOPNOTSUPP;
603 		break;
604 	}
605 flush:
606 	if (rtm != NULL) {
607 		if (error != 0)
608 			rtm->rtm_errno = error;
609 		else
610 			rtm->rtm_flags |= RTF_DONE;
611 	}
612 
613 	/*
614 	 * Check to see if we don't want our own messages.
615 	 */
616 	if (!(so->so_options & SO_USELOOPBACK)) {
617 		if (route_cb.any_count <= 1) {
618 			if (rtm != NULL)
619 				kfree(rtm, M_RTABLE);
620 			m_freem(m);
621 			return (error);
622 		}
623 		/* There is another listener, so construct message */
624 		rp = sotorawcb(so);
625 	}
626 	if (rtm != NULL) {
627 		m_copyback(m, 0, rtm->rtm_msglen, (caddr_t)rtm);
628 		if (m->m_pkthdr.len < rtm->rtm_msglen) {
629 			m_freem(m);
630 			m = NULL;
631 		} else if (m->m_pkthdr.len > rtm->rtm_msglen)
632 			m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
633 		kfree(rtm, M_RTABLE);
634 	}
635 	if (m != NULL)
636 		rts_input_skip(m, family, rp);
637 	return (error);
638 }
639 
640 static void
641 route_output_add_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
642 			  struct rtentry *rt, void *arg)
643 {
644 	struct rt_msghdr *rtm = arg;
645 
646 	if (error == 0 && rt != NULL) {
647 		rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx,
648 		    &rt->rt_rmx);
649 		rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
650 		rt->rt_rmx.rmx_locks |=
651 		    (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
652 		if (rtinfo->rti_genmask != NULL) {
653 			rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
654 			if (rt->rt_genmask == NULL) {
655 				/*
656 				 * This should not happen, since we
657 				 * have already installed genmask
658 				 * on each CPU before we reach here.
659 				 */
660 				panic("genmask is gone!?");
661 			}
662 		} else {
663 			rt->rt_genmask = NULL;
664 		}
665 		rtm->rtm_index = rt->rt_ifp->if_index;
666 	}
667 }
668 
669 static void
670 route_output_delete_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
671 			  struct rtentry *rt, void *arg)
672 {
673 	if (error == 0 && rt) {
674 		++rt->rt_refcnt;
675 		if (fillrtmsg(arg, rt, rtinfo) != 0) {
676 			error = ENOBUFS;
677 			/* XXX no way to return the error */
678 		}
679 		--rt->rt_refcnt;
680 	}
681 	if (rt && rt->rt_refcnt == 0) {
682 		++rt->rt_refcnt;
683 		rtfree(rt);
684 	}
685 }
686 
687 static int
688 route_output_get_callback(int cmd, struct rt_addrinfo *rtinfo,
689 			  struct rtentry *rt, void *arg, int found_cnt)
690 {
691 	int error, found = 0;
692 
693 	if (((rtinfo->rti_flags ^ rt->rt_flags) & RTF_HOST) == 0)
694 		found = 1;
695 
696 	error = fillrtmsg(arg, rt, rtinfo);
697 	if (!error && found) {
698 		/* Got the exact match, we could return now! */
699 		error = EJUSTRETURN;
700 	}
701 	return error;
702 }
703 
704 static int
705 route_output_change_callback(int cmd, struct rt_addrinfo *rtinfo,
706 			     struct rtentry *rt, void *arg, int found_cnt)
707 {
708 	struct rt_msghdr *rtm = arg;
709 	struct ifaddr *ifa;
710 	int error = 0;
711 
712 	/*
713 	 * new gateway could require new ifaddr, ifp;
714 	 * flags may also be different; ifp may be specified
715 	 * by ll sockaddr when protocol address is ambiguous
716 	 */
717 	if (((rt->rt_flags & RTF_GATEWAY) && rtinfo->rti_gateway != NULL) ||
718 	    rtinfo->rti_ifpaddr != NULL ||
719 	    (rtinfo->rti_ifaaddr != NULL &&
720 	     !sa_equal(rtinfo->rti_ifaaddr, rt->rt_ifa->ifa_addr))) {
721 		error = rt_getifa(rtinfo);
722 		if (error != 0)
723 			goto done;
724 	}
725 	if (rtinfo->rti_gateway != NULL) {
726 		/*
727 		 * We only need to generate rtmsg upon the
728 		 * first route to be changed.
729 		 */
730 		error = rt_setgate(rt, rt_key(rt), rtinfo->rti_gateway,
731 			found_cnt == 1 ? RTL_REPORTMSG : RTL_DONTREPORT);
732 		if (error != 0)
733 			goto done;
734 	}
735 	if ((ifa = rtinfo->rti_ifa) != NULL) {
736 		struct ifaddr *oifa = rt->rt_ifa;
737 
738 		if (oifa != ifa) {
739 			if (oifa && oifa->ifa_rtrequest)
740 				oifa->ifa_rtrequest(RTM_DELETE, rt, rtinfo);
741 			IFAFREE(rt->rt_ifa);
742 			IFAREF(ifa);
743 			rt->rt_ifa = ifa;
744 			rt->rt_ifp = rtinfo->rti_ifp;
745 		}
746 	}
747 	rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx, &rt->rt_rmx);
748 	if (rt->rt_ifa && rt->rt_ifa->ifa_rtrequest)
749 		rt->rt_ifa->ifa_rtrequest(RTM_ADD, rt, rtinfo);
750 	if (rtinfo->rti_genmask != NULL) {
751 		rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
752 		if (rt->rt_genmask == NULL) {
753 			/*
754 			 * This should not happen, since we
755 			 * have already installed genmask
756 			 * on each CPU before we reach here.
757 			 */
758 			panic("genmask is gone!?\n");
759 		}
760 	}
761 	rtm->rtm_index = rt->rt_ifp->if_index;
762 done:
763 	return error;
764 }
765 
766 static int
767 route_output_lock_callback(int cmd, struct rt_addrinfo *rtinfo,
768 			   struct rtentry *rt, void *arg,
769 			   int found_cnt __unused)
770 {
771 	struct rt_msghdr *rtm = arg;
772 
773 	rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
774 	rt->rt_rmx.rmx_locks |=
775 		(rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
776 	return 0;
777 }
778 
779 static void
780 rt_setmetrics(u_long which, struct rt_metrics *in, struct rt_metrics *out)
781 {
782 #define setmetric(flag, elt) if (which & (flag)) out->elt = in->elt;
783 	setmetric(RTV_RPIPE, rmx_recvpipe);
784 	setmetric(RTV_SPIPE, rmx_sendpipe);
785 	setmetric(RTV_SSTHRESH, rmx_ssthresh);
786 	setmetric(RTV_RTT, rmx_rtt);
787 	setmetric(RTV_RTTVAR, rmx_rttvar);
788 	setmetric(RTV_HOPCOUNT, rmx_hopcount);
789 	setmetric(RTV_MTU, rmx_mtu);
790 	setmetric(RTV_EXPIRE, rmx_expire);
791 	setmetric(RTV_MSL, rmx_msl);
792 #undef setmetric
793 }
794 
795 #define ROUNDUP(a) \
796 	((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long))
797 
798 /*
799  * Extract the addresses of the passed sockaddrs.
800  * Do a little sanity checking so as to avoid bad memory references.
801  * This data is derived straight from userland.
802  */
803 static int
804 rt_xaddrs(char *cp, char *cplim, struct rt_addrinfo *rtinfo)
805 {
806 	struct sockaddr *sa;
807 	int i;
808 
809 	for (i = 0; (i < RTAX_MAX) && (cp < cplim); i++) {
810 		if ((rtinfo->rti_addrs & (1 << i)) == 0)
811 			continue;
812 		sa = (struct sockaddr *)cp;
813 		/*
814 		 * It won't fit.
815 		 */
816 		if ((cp + sa->sa_len) > cplim) {
817 			return (EINVAL);
818 		}
819 
820 		/*
821 		 * There are no more...  Quit now.
822 		 * If there are more bits, they are in error.
823 		 * I've seen this.  route(1) can evidently generate these.
824 		 * This causes kernel to core dump.
825 		 * For compatibility, if we see this, point to a safe address.
826 		 */
827 		if (sa->sa_len == 0) {
828 			static struct sockaddr sa_zero = {
829 				sizeof sa_zero, AF_INET,
830 			};
831 
832 			rtinfo->rti_info[i] = &sa_zero;
833 			kprintf("rtsock: received more addr bits than sockaddrs.\n");
834 			return (0); /* should be EINVAL but for compat */
835 		}
836 
837 		/* Accept the sockaddr. */
838 		rtinfo->rti_info[i] = sa;
839 		cp += ROUNDUP(sa->sa_len);
840 	}
841 	return (0);
842 }
843 
844 static int
845 rt_msghdrsize(int type)
846 {
847 	switch (type) {
848 	case RTM_DELADDR:
849 	case RTM_NEWADDR:
850 		return sizeof(struct ifa_msghdr);
851 	case RTM_DELMADDR:
852 	case RTM_NEWMADDR:
853 		return sizeof(struct ifma_msghdr);
854 	case RTM_IFINFO:
855 		return sizeof(struct if_msghdr);
856 	case RTM_IFANNOUNCE:
857 	case RTM_IEEE80211:
858 		return sizeof(struct if_announcemsghdr);
859 	default:
860 		return sizeof(struct rt_msghdr);
861 	}
862 }
863 
864 static int
865 rt_msgsize(int type, struct rt_addrinfo *rtinfo)
866 {
867 	int len, i;
868 
869 	len = rt_msghdrsize(type);
870 	for (i = 0; i < RTAX_MAX; i++) {
871 		if (rtinfo->rti_info[i] != NULL)
872 			len += ROUNDUP(rtinfo->rti_info[i]->sa_len);
873 	}
874 	len = ALIGN(len);
875 	return len;
876 }
877 
878 /*
879  * Build a routing message in a buffer.
880  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
881  * to the end of the buffer after the message header.
882  *
883  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
884  * This side-effect can be avoided if we reorder the addrs bitmask field in all
885  * the route messages to line up so we can set it here instead of back in the
886  * calling routine.
887  */
888 static void
889 rt_msg_buffer(int type, struct rt_addrinfo *rtinfo, void *buf, int msglen)
890 {
891 	struct rt_msghdr *rtm;
892 	char *cp;
893 	int dlen, i;
894 
895 	rtm = (struct rt_msghdr *) buf;
896 	rtm->rtm_version = RTM_VERSION;
897 	rtm->rtm_type = type;
898 	rtm->rtm_msglen = msglen;
899 
900 	cp = (char *)buf + rt_msghdrsize(type);
901 	rtinfo->rti_addrs = 0;
902 	for (i = 0; i < RTAX_MAX; i++) {
903 		struct sockaddr *sa;
904 
905 		if ((sa = rtinfo->rti_info[i]) == NULL)
906 			continue;
907 		rtinfo->rti_addrs |= (1 << i);
908 		dlen = ROUNDUP(sa->sa_len);
909 		bcopy(sa, cp, dlen);
910 		cp += dlen;
911 	}
912 }
913 
914 /*
915  * Build a routing message in a mbuf chain.
916  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
917  * to the end of the mbuf after the message header.
918  *
919  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
920  * This side-effect can be avoided if we reorder the addrs bitmask field in all
921  * the route messages to line up so we can set it here instead of back in the
922  * calling routine.
923  */
924 static struct mbuf *
925 rt_msg_mbuf(int type, struct rt_addrinfo *rtinfo)
926 {
927 	struct mbuf *m;
928 	struct rt_msghdr *rtm;
929 	int hlen, len;
930 	int i;
931 
932 	hlen = rt_msghdrsize(type);
933 	KASSERT(hlen <= MCLBYTES, ("rt_msg_mbuf: hlen %d doesn't fit", hlen));
934 
935 	m = m_getl(hlen, MB_DONTWAIT, MT_DATA, M_PKTHDR, NULL);
936 	if (m == NULL)
937 		return (NULL);
938 	mbuftrackid(m, 32);
939 	m->m_pkthdr.len = m->m_len = hlen;
940 	m->m_pkthdr.rcvif = NULL;
941 	rtinfo->rti_addrs = 0;
942 	len = hlen;
943 	for (i = 0; i < RTAX_MAX; i++) {
944 		struct sockaddr *sa;
945 		int dlen;
946 
947 		if ((sa = rtinfo->rti_info[i]) == NULL)
948 			continue;
949 		rtinfo->rti_addrs |= (1 << i);
950 		dlen = ROUNDUP(sa->sa_len);
951 		m_copyback(m, len, dlen, (caddr_t)sa); /* can grow mbuf chain */
952 		len += dlen;
953 	}
954 	if (m->m_pkthdr.len != len) { /* one of the m_copyback() calls failed */
955 		m_freem(m);
956 		return (NULL);
957 	}
958 	rtm = mtod(m, struct rt_msghdr *);
959 	bzero(rtm, hlen);
960 	rtm->rtm_msglen = len;
961 	rtm->rtm_version = RTM_VERSION;
962 	rtm->rtm_type = type;
963 	return (m);
964 }
965 
966 /*
967  * This routine is called to generate a message from the routing
968  * socket indicating that a redirect has occurred, a routing lookup
969  * has failed, or that a protocol has detected timeouts to a particular
970  * destination.
971  */
972 void
973 rt_missmsg(int type, struct rt_addrinfo *rtinfo, int flags, int error)
974 {
975 	struct sockaddr *dst = rtinfo->rti_info[RTAX_DST];
976 	struct rt_msghdr *rtm;
977 	struct mbuf *m;
978 
979 	if (route_cb.any_count == 0)
980 		return;
981 	m = rt_msg_mbuf(type, rtinfo);
982 	if (m == NULL)
983 		return;
984 	rtm = mtod(m, struct rt_msghdr *);
985 	rtm->rtm_flags = RTF_DONE | flags;
986 	rtm->rtm_errno = error;
987 	rtm->rtm_addrs = rtinfo->rti_addrs;
988 	rts_input(m, familyof(dst));
989 }
990 
991 void
992 rt_dstmsg(int type, struct sockaddr *dst, int error)
993 {
994 	struct rt_msghdr *rtm;
995 	struct rt_addrinfo addrs;
996 	struct mbuf *m;
997 
998 	if (route_cb.any_count == 0)
999 		return;
1000 	bzero(&addrs, sizeof(struct rt_addrinfo));
1001 	addrs.rti_info[RTAX_DST] = dst;
1002 	m = rt_msg_mbuf(type, &addrs);
1003 	if (m == NULL)
1004 		return;
1005 	rtm = mtod(m, struct rt_msghdr *);
1006 	rtm->rtm_flags = RTF_DONE;
1007 	rtm->rtm_errno = error;
1008 	rtm->rtm_addrs = addrs.rti_addrs;
1009 	rts_input(m, familyof(dst));
1010 }
1011 
1012 /*
1013  * This routine is called to generate a message from the routing
1014  * socket indicating that the status of a network interface has changed.
1015  */
1016 void
1017 rt_ifmsg(struct ifnet *ifp)
1018 {
1019 	struct if_msghdr *ifm;
1020 	struct mbuf *m;
1021 	struct rt_addrinfo rtinfo;
1022 
1023 	if (route_cb.any_count == 0)
1024 		return;
1025 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1026 	m = rt_msg_mbuf(RTM_IFINFO, &rtinfo);
1027 	if (m == NULL)
1028 		return;
1029 	ifm = mtod(m, struct if_msghdr *);
1030 	ifm->ifm_index = ifp->if_index;
1031 	ifm->ifm_flags = ifp->if_flags;
1032 	ifm->ifm_data = ifp->if_data;
1033 	ifm->ifm_addrs = 0;
1034 	rts_input(m, 0);
1035 }
1036 
1037 static void
1038 rt_ifamsg(int cmd, struct ifaddr *ifa)
1039 {
1040 	struct ifa_msghdr *ifam;
1041 	struct rt_addrinfo rtinfo;
1042 	struct mbuf *m;
1043 	struct ifnet *ifp = ifa->ifa_ifp;
1044 
1045 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1046 	rtinfo.rti_ifaaddr = ifa->ifa_addr;
1047 	rtinfo.rti_ifpaddr =
1048 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1049 	rtinfo.rti_netmask = ifa->ifa_netmask;
1050 	rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1051 
1052 	m = rt_msg_mbuf(cmd, &rtinfo);
1053 	if (m == NULL)
1054 		return;
1055 
1056 	ifam = mtod(m, struct ifa_msghdr *);
1057 	ifam->ifam_index = ifp->if_index;
1058 	ifam->ifam_metric = ifa->ifa_metric;
1059 	ifam->ifam_flags = ifa->ifa_flags;
1060 	ifam->ifam_addrs = rtinfo.rti_addrs;
1061 
1062 	rts_input(m, familyof(ifa->ifa_addr));
1063 }
1064 
1065 void
1066 rt_rtmsg(int cmd, struct rtentry *rt, struct ifnet *ifp, int error)
1067 {
1068 	struct rt_msghdr *rtm;
1069 	struct rt_addrinfo rtinfo;
1070 	struct mbuf *m;
1071 	struct sockaddr *dst;
1072 
1073 	if (rt == NULL)
1074 		return;
1075 
1076 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1077 	rtinfo.rti_dst = dst = rt_key(rt);
1078 	rtinfo.rti_gateway = rt->rt_gateway;
1079 	rtinfo.rti_netmask = rt_mask(rt);
1080 	if (ifp != NULL) {
1081 		rtinfo.rti_ifpaddr =
1082 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1083 	}
1084 	rtinfo.rti_ifaaddr = rt->rt_ifa->ifa_addr;
1085 
1086 	m = rt_msg_mbuf(cmd, &rtinfo);
1087 	if (m == NULL)
1088 		return;
1089 
1090 	rtm = mtod(m, struct rt_msghdr *);
1091 	if (ifp != NULL)
1092 		rtm->rtm_index = ifp->if_index;
1093 	rtm->rtm_flags |= rt->rt_flags;
1094 	rtm->rtm_errno = error;
1095 	rtm->rtm_addrs = rtinfo.rti_addrs;
1096 
1097 	rts_input(m, familyof(dst));
1098 }
1099 
1100 /*
1101  * This is called to generate messages from the routing socket
1102  * indicating a network interface has had addresses associated with it.
1103  * if we ever reverse the logic and replace messages TO the routing
1104  * socket indicate a request to configure interfaces, then it will
1105  * be unnecessary as the routing socket will automatically generate
1106  * copies of it.
1107  */
1108 void
1109 rt_newaddrmsg(int cmd, struct ifaddr *ifa, int error, struct rtentry *rt)
1110 {
1111 #ifdef SCTP
1112 	/*
1113 	 * notify the SCTP stack
1114 	 * this will only get called when an address is added/deleted
1115 	 * XXX pass the ifaddr struct instead if ifa->ifa_addr...
1116 	 */
1117 	if (cmd == RTM_ADD)
1118 		sctp_add_ip_address(ifa);
1119 	else if (cmd == RTM_DELETE)
1120 		sctp_delete_ip_address(ifa);
1121 #endif /* SCTP */
1122 
1123 	if (route_cb.any_count == 0)
1124 		return;
1125 
1126 	if (cmd == RTM_ADD) {
1127 		rt_ifamsg(RTM_NEWADDR, ifa);
1128 		rt_rtmsg(RTM_ADD, rt, ifa->ifa_ifp, error);
1129 	} else {
1130 		KASSERT((cmd == RTM_DELETE), ("unknown cmd %d", cmd));
1131 		rt_rtmsg(RTM_DELETE, rt, ifa->ifa_ifp, error);
1132 		rt_ifamsg(RTM_DELADDR, ifa);
1133 	}
1134 }
1135 
1136 /*
1137  * This is the analogue to the rt_newaddrmsg which performs the same
1138  * function but for multicast group memberhips.  This is easier since
1139  * there is no route state to worry about.
1140  */
1141 void
1142 rt_newmaddrmsg(int cmd, struct ifmultiaddr *ifma)
1143 {
1144 	struct rt_addrinfo rtinfo;
1145 	struct mbuf *m = NULL;
1146 	struct ifnet *ifp = ifma->ifma_ifp;
1147 	struct ifma_msghdr *ifmam;
1148 
1149 	if (route_cb.any_count == 0)
1150 		return;
1151 
1152 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1153 	rtinfo.rti_ifaaddr = ifma->ifma_addr;
1154 	if (ifp != NULL && !TAILQ_EMPTY(&ifp->if_addrheads[mycpuid])) {
1155 		rtinfo.rti_ifpaddr =
1156 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1157 	}
1158 	/*
1159 	 * If a link-layer address is present, present it as a ``gateway''
1160 	 * (similarly to how ARP entries, e.g., are presented).
1161 	 */
1162 	rtinfo.rti_gateway = ifma->ifma_lladdr;
1163 
1164 	m = rt_msg_mbuf(cmd, &rtinfo);
1165 	if (m == NULL)
1166 		return;
1167 
1168 	ifmam = mtod(m, struct ifma_msghdr *);
1169 	ifmam->ifmam_index = ifp->if_index;
1170 	ifmam->ifmam_addrs = rtinfo.rti_addrs;
1171 
1172 	rts_input(m, familyof(ifma->ifma_addr));
1173 }
1174 
1175 static struct mbuf *
1176 rt_makeifannouncemsg(struct ifnet *ifp, int type, int what,
1177 		     struct rt_addrinfo *info)
1178 {
1179 	struct if_announcemsghdr *ifan;
1180 	struct mbuf *m;
1181 
1182 	if (route_cb.any_count == 0)
1183 		return NULL;
1184 
1185 	bzero(info, sizeof(*info));
1186 	m = rt_msg_mbuf(type, info);
1187 	if (m == NULL)
1188 		return NULL;
1189 
1190 	ifan = mtod(m, struct if_announcemsghdr *);
1191 	ifan->ifan_index = ifp->if_index;
1192 	strlcpy(ifan->ifan_name, ifp->if_xname, sizeof ifan->ifan_name);
1193 	ifan->ifan_what = what;
1194 	return m;
1195 }
1196 
1197 /*
1198  * This is called to generate routing socket messages indicating
1199  * IEEE80211 wireless events.
1200  * XXX we piggyback on the RTM_IFANNOUNCE msg format in a clumsy way.
1201  */
1202 void
1203 rt_ieee80211msg(struct ifnet *ifp, int what, void *data, size_t data_len)
1204 {
1205 	struct rt_addrinfo info;
1206 	struct mbuf *m;
1207 
1208 	m = rt_makeifannouncemsg(ifp, RTM_IEEE80211, what, &info);
1209 	if (m == NULL)
1210 		return;
1211 
1212 	/*
1213 	 * Append the ieee80211 data.  Try to stick it in the
1214 	 * mbuf containing the ifannounce msg; otherwise allocate
1215 	 * a new mbuf and append.
1216 	 *
1217 	 * NB: we assume m is a single mbuf.
1218 	 */
1219 	if (data_len > M_TRAILINGSPACE(m)) {
1220 		/* XXX use m_getb(data_len, MB_DONTWAIT, MT_DATA, 0); */
1221 		struct mbuf *n = m_get(MB_DONTWAIT, MT_DATA);
1222 		if (n == NULL) {
1223 			m_freem(m);
1224 			return;
1225 		}
1226 		KKASSERT(data_len <= M_TRAILINGSPACE(n));
1227 		bcopy(data, mtod(n, void *), data_len);
1228 		n->m_len = data_len;
1229 		m->m_next = n;
1230 	} else if (data_len > 0) {
1231 		bcopy(data, mtod(m, u_int8_t *) + m->m_len, data_len);
1232 		m->m_len += data_len;
1233 	}
1234 	mbuftrackid(m, 33);
1235 	if (m->m_flags & M_PKTHDR)
1236 		m->m_pkthdr.len += data_len;
1237 	mtod(m, struct if_announcemsghdr *)->ifan_msglen += data_len;
1238 	rts_input(m, 0);
1239 }
1240 
1241 /*
1242  * This is called to generate routing socket messages indicating
1243  * network interface arrival and departure.
1244  */
1245 void
1246 rt_ifannouncemsg(struct ifnet *ifp, int what)
1247 {
1248 	struct rt_addrinfo addrinfo;
1249 	struct mbuf *m;
1250 
1251 	m = rt_makeifannouncemsg(ifp, RTM_IFANNOUNCE, what, &addrinfo);
1252 	if (m != NULL)
1253 		rts_input(m, 0);
1254 }
1255 
1256 static int
1257 resizewalkarg(struct walkarg *w, int len)
1258 {
1259 	void *newptr;
1260 
1261 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
1262 	if (newptr == NULL)
1263 		return (ENOMEM);
1264 	if (w->w_tmem != NULL)
1265 		kfree(w->w_tmem, M_RTABLE);
1266 	w->w_tmem = newptr;
1267 	w->w_tmemsize = len;
1268 	return (0);
1269 }
1270 
1271 /*
1272  * This is used in dumping the kernel table via sysctl().
1273  */
1274 int
1275 sysctl_dumpentry(struct radix_node *rn, void *vw)
1276 {
1277 	struct walkarg *w = vw;
1278 	struct rtentry *rt = (struct rtentry *)rn;
1279 	struct rt_addrinfo rtinfo;
1280 	int error, msglen;
1281 
1282 	if (w->w_op == NET_RT_FLAGS && !(rt->rt_flags & w->w_arg))
1283 		return 0;
1284 
1285 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1286 	rtinfo.rti_dst = rt_key(rt);
1287 	rtinfo.rti_gateway = rt->rt_gateway;
1288 	rtinfo.rti_netmask = rt_mask(rt);
1289 	rtinfo.rti_genmask = rt->rt_genmask;
1290 	if (rt->rt_ifp != NULL) {
1291 		rtinfo.rti_ifpaddr =
1292 		TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1293 		rtinfo.rti_ifaaddr = rt->rt_ifa->ifa_addr;
1294 		if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
1295 			rtinfo.rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
1296 	}
1297 	msglen = rt_msgsize(RTM_GET, &rtinfo);
1298 	if (w->w_tmemsize < msglen && resizewalkarg(w, msglen) != 0)
1299 		return (ENOMEM);
1300 	rt_msg_buffer(RTM_GET, &rtinfo, w->w_tmem, msglen);
1301 	if (w->w_req != NULL) {
1302 		struct rt_msghdr *rtm = w->w_tmem;
1303 
1304 		rtm->rtm_flags = rt->rt_flags;
1305 		rtm->rtm_use = rt->rt_use;
1306 		rtm->rtm_rmx = rt->rt_rmx;
1307 		rtm->rtm_index = rt->rt_ifp->if_index;
1308 		rtm->rtm_errno = rtm->rtm_pid = rtm->rtm_seq = 0;
1309 		rtm->rtm_addrs = rtinfo.rti_addrs;
1310 		error = SYSCTL_OUT(w->w_req, rtm, msglen);
1311 		return (error);
1312 	}
1313 	return (0);
1314 }
1315 
1316 static int
1317 sysctl_iflist(int af, struct walkarg *w)
1318 {
1319 	struct ifnet *ifp;
1320 	struct rt_addrinfo rtinfo;
1321 	int msglen, error;
1322 
1323 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1324 	TAILQ_FOREACH(ifp, &ifnet, if_link) {
1325 		struct ifaddr_container *ifac;
1326 		struct ifaddr *ifa;
1327 
1328 		if (w->w_arg && w->w_arg != ifp->if_index)
1329 			continue;
1330 		ifac = TAILQ_FIRST(&ifp->if_addrheads[mycpuid]);
1331 		ifa = ifac->ifa;
1332 		rtinfo.rti_ifpaddr = ifa->ifa_addr;
1333 		msglen = rt_msgsize(RTM_IFINFO, &rtinfo);
1334 		if (w->w_tmemsize < msglen && resizewalkarg(w, msglen) != 0)
1335 			return (ENOMEM);
1336 		rt_msg_buffer(RTM_IFINFO, &rtinfo, w->w_tmem, msglen);
1337 		rtinfo.rti_ifpaddr = NULL;
1338 		if (w->w_req != NULL && w->w_tmem != NULL) {
1339 			struct if_msghdr *ifm = w->w_tmem;
1340 
1341 			ifm->ifm_index = ifp->if_index;
1342 			ifm->ifm_flags = ifp->if_flags;
1343 			ifm->ifm_data = ifp->if_data;
1344 			ifm->ifm_addrs = rtinfo.rti_addrs;
1345 			error = SYSCTL_OUT(w->w_req, ifm, msglen);
1346 			if (error)
1347 				return (error);
1348 		}
1349 		while ((ifac = TAILQ_NEXT(ifac, ifa_link)) != NULL) {
1350 			ifa = ifac->ifa;
1351 
1352 			if (af && af != ifa->ifa_addr->sa_family)
1353 				continue;
1354 			if (curproc->p_ucred->cr_prison &&
1355 			    prison_if(curproc->p_ucred, ifa->ifa_addr))
1356 				continue;
1357 			rtinfo.rti_ifaaddr = ifa->ifa_addr;
1358 			rtinfo.rti_netmask = ifa->ifa_netmask;
1359 			rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1360 			msglen = rt_msgsize(RTM_NEWADDR, &rtinfo);
1361 			if (w->w_tmemsize < msglen &&
1362 			    resizewalkarg(w, msglen) != 0)
1363 				return (ENOMEM);
1364 			rt_msg_buffer(RTM_NEWADDR, &rtinfo, w->w_tmem, msglen);
1365 			if (w->w_req != NULL) {
1366 				struct ifa_msghdr *ifam = w->w_tmem;
1367 
1368 				ifam->ifam_index = ifa->ifa_ifp->if_index;
1369 				ifam->ifam_flags = ifa->ifa_flags;
1370 				ifam->ifam_metric = ifa->ifa_metric;
1371 				ifam->ifam_addrs = rtinfo.rti_addrs;
1372 				error = SYSCTL_OUT(w->w_req, w->w_tmem, msglen);
1373 				if (error)
1374 					return (error);
1375 			}
1376 		}
1377 		rtinfo.rti_netmask = NULL;
1378 		rtinfo.rti_ifaaddr = NULL;
1379 		rtinfo.rti_bcastaddr = NULL;
1380 	}
1381 	return (0);
1382 }
1383 
1384 static int
1385 sysctl_rtsock(SYSCTL_HANDLER_ARGS)
1386 {
1387 	int	*name = (int *)arg1;
1388 	u_int	namelen = arg2;
1389 	struct radix_node_head *rnh;
1390 	int	i, error = EINVAL;
1391 	int	origcpu;
1392 	u_char  af;
1393 	struct	walkarg w;
1394 
1395 	name ++;
1396 	namelen--;
1397 	if (req->newptr)
1398 		return (EPERM);
1399 	if (namelen != 3 && namelen != 4)
1400 		return (EINVAL);
1401 	af = name[0];
1402 	bzero(&w, sizeof w);
1403 	w.w_op = name[1];
1404 	w.w_arg = name[2];
1405 	w.w_req = req;
1406 
1407 	/*
1408 	 * Optional third argument specifies cpu, used primarily for
1409 	 * debugging the route table.
1410 	 */
1411 	if (namelen == 4) {
1412 		if (name[3] < 0 || name[3] >= ncpus)
1413 			return (EINVAL);
1414 		origcpu = mycpuid;
1415 		lwkt_migratecpu(name[3]);
1416 	} else {
1417 		origcpu = -1;
1418 	}
1419 	crit_enter();
1420 	switch (w.w_op) {
1421 	case NET_RT_DUMP:
1422 	case NET_RT_FLAGS:
1423 		for (i = 1; i <= AF_MAX; i++)
1424 			if ((rnh = rt_tables[mycpuid][i]) &&
1425 			    (af == 0 || af == i) &&
1426 			    (error = rnh->rnh_walktree(rnh,
1427 						       sysctl_dumpentry, &w)))
1428 				break;
1429 		break;
1430 
1431 	case NET_RT_IFLIST:
1432 		error = sysctl_iflist(af, &w);
1433 	}
1434 	crit_exit();
1435 	if (w.w_tmem != NULL)
1436 		kfree(w.w_tmem, M_RTABLE);
1437 	if (origcpu >= 0)
1438 		lwkt_migratecpu(origcpu);
1439 	return (error);
1440 }
1441 
1442 SYSCTL_NODE(_net, PF_ROUTE, routetable, CTLFLAG_RD, sysctl_rtsock, "");
1443 
1444 /*
1445  * Definitions of protocols supported in the ROUTE domain.
1446  */
1447 
1448 static struct domain routedomain;		/* or at least forward */
1449 
1450 static struct protosw routesw[] = {
1451     {
1452 	.pr_type = SOCK_RAW,
1453 	.pr_domain = &routedomain,
1454 	.pr_protocol = 0,
1455 	.pr_flags = PR_ATOMIC|PR_ADDR,
1456 	.pr_input = NULL,
1457 	.pr_output = route_output,
1458 	.pr_ctlinput = raw_ctlinput,
1459 	.pr_ctloutput = NULL,
1460 	.pr_ctlport = cpu0_ctlport,
1461 
1462 	.pr_init = raw_init,
1463 	.pr_usrreqs = &route_usrreqs
1464     }
1465 };
1466 
1467 static struct domain routedomain = {
1468 	PF_ROUTE, "route", NULL, NULL, NULL,
1469 	routesw, &routesw[(sizeof routesw)/(sizeof routesw[0])],
1470 };
1471 
1472 DOMAIN_SET(route);
1473 
1474