1/*
2 * Copyright (c) 2000-2018 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1988, 1991, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)rtsock.c 8.5 (Berkeley) 11/2/94
61 */
62
63#include <sys/param.h>
64#include <sys/systm.h>
65#include <sys/kauth.h>
66#include <sys/kernel.h>
67#include <sys/sysctl.h>
68#include <sys/proc.h>
69#include <sys/malloc.h>
70#include <sys/mbuf.h>
71#include <sys/socket.h>
72#include <sys/socketvar.h>
73#include <sys/domain.h>
74#include <sys/protosw.h>
75#include <sys/syslog.h>
76#include <sys/mcache.h>
77#include <kern/locks.h>
78#include <sys/codesign.h>
79
80#include <net/if.h>
81#include <net/route.h>
82#include <net/dlil.h>
83#include <net/raw_cb.h>
84#include <netinet/in.h>
85#include <netinet/in_var.h>
86#include <netinet/in_arp.h>
87#include <netinet/ip.h>
88#include <netinet/ip6.h>
89#include <netinet6/nd6.h>
90
91extern struct rtstat rtstat;
92extern struct domain routedomain_s;
93static struct domain *routedomain = NULL;
94
95MALLOC_DEFINE(M_RTABLE, "routetbl", "routing tables");
96
97static struct sockaddr route_dst = { 2, PF_ROUTE, { 0, } };
98static struct sockaddr route_src = { 2, PF_ROUTE, { 0, } };
99static struct sockaddr sa_zero = { sizeof (sa_zero), AF_INET, { 0, } };
100
101struct route_cb {
102 u_int32_t ip_count; /* attached w/ AF_INET */
103 u_int32_t ip6_count; /* attached w/ AF_INET6 */
104 u_int32_t any_count; /* total attached */
105};
106
107static struct route_cb route_cb;
108
109struct walkarg {
110 int w_tmemsize;
111 int w_op, w_arg;
112 caddr_t w_tmem;
113 struct sysctl_req *w_req;
114};
115
116static void route_dinit(struct domain *);
117static int rts_abort(struct socket *);
118static int rts_attach(struct socket *, int, struct proc *);
119static int rts_bind(struct socket *, struct sockaddr *, struct proc *);
120static int rts_connect(struct socket *, struct sockaddr *, struct proc *);
121static int rts_detach(struct socket *);
122static int rts_disconnect(struct socket *);
123static int rts_peeraddr(struct socket *, struct sockaddr **);
124static int rts_send(struct socket *, int, struct mbuf *, struct sockaddr *,
125 struct mbuf *, struct proc *);
126static int rts_shutdown(struct socket *);
127static int rts_sockaddr(struct socket *, struct sockaddr **);
128
129static int route_output(struct mbuf *, struct socket *);
130static int rt_setmetrics(u_int32_t, struct rt_metrics *, struct rtentry *);
131static void rt_getmetrics(struct rtentry *, struct rt_metrics *);
132static void rt_setif(struct rtentry *, struct sockaddr *, struct sockaddr *,
133 struct sockaddr *, unsigned int);
134static int rt_xaddrs(caddr_t, caddr_t, struct rt_addrinfo *);
135static struct mbuf *rt_msg1(int, struct rt_addrinfo *);
136static int rt_msg2(int, struct rt_addrinfo *, caddr_t, struct walkarg *,
137 kauth_cred_t *);
138static int sysctl_dumpentry(struct radix_node *rn, void *vw);
139static int sysctl_dumpentry_ext(struct radix_node *rn, void *vw);
140static int sysctl_iflist(int af, struct walkarg *w);
141static int sysctl_iflist2(int af, struct walkarg *w);
142static int sysctl_rtstat(struct sysctl_req *);
143static int sysctl_rttrash(struct sysctl_req *);
144static int sysctl_rtsock SYSCTL_HANDLER_ARGS;
145
146SYSCTL_NODE(_net, PF_ROUTE, routetable, CTLFLAG_RD | CTLFLAG_LOCKED,
147 sysctl_rtsock, "");
148
149SYSCTL_NODE(_net, OID_AUTO, route, CTLFLAG_RW|CTLFLAG_LOCKED, 0, "routing");
150
151/* Align x to 1024 (only power of 2) assuming x is positive */
152#define ALIGN_BYTES(x) do { \
153 x = P2ALIGN(x, 1024); \
154} while(0)
155
156#define ROUNDUP32(a) \
157 ((a) > 0 ? (1 + (((a) - 1) | (sizeof (uint32_t) - 1))) : \
158 sizeof (uint32_t))
159
160#define ADVANCE32(x, n) \
161 (x += ROUNDUP32((n)->sa_len))
162
163/*
164 * It really doesn't make any sense at all for this code to share much
165 * with raw_usrreq.c, since its functionality is so restricted. XXX
166 */
167static int
168rts_abort(struct socket *so)
169{
170 return (raw_usrreqs.pru_abort(so));
171}
172
173/* pru_accept is EOPNOTSUPP */
174
175static int
176rts_attach(struct socket *so, int proto, struct proc *p)
177{
178#pragma unused(p)
179 struct rawcb *rp;
180 int error;
181
182 VERIFY(so->so_pcb == NULL);
183
184 MALLOC(rp, struct rawcb *, sizeof (*rp), M_PCB, M_WAITOK | M_ZERO);
185 if (rp == NULL)
186 return (ENOBUFS);
187
188 so->so_pcb = (caddr_t)rp;
189 /* don't use raw_usrreqs.pru_attach, it checks for SS_PRIV */
190 error = raw_attach(so, proto);
191 rp = sotorawcb(so);
192 if (error) {
193 FREE(rp, M_PCB);
194 so->so_pcb = NULL;
195 so->so_flags |= SOF_PCBCLEARING;
196 return (error);
197 }
198
199 switch (rp->rcb_proto.sp_protocol) {
200 case AF_INET:
201 atomic_add_32(&route_cb.ip_count, 1);
202 break;
203 case AF_INET6:
204 atomic_add_32(&route_cb.ip6_count, 1);
205 break;
206 }
207 rp->rcb_faddr = &route_src;
208 atomic_add_32(&route_cb.any_count, 1);
209 /* the socket is already locked when we enter rts_attach */
210 soisconnected(so);
211 so->so_options |= SO_USELOOPBACK;
212 return (0);
213}
214
215static int
216rts_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
217{
218 return (raw_usrreqs.pru_bind(so, nam, p)); /* xxx just EINVAL */
219}
220
221static int
222rts_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
223{
224 return (raw_usrreqs.pru_connect(so, nam, p)); /* XXX just EINVAL */
225}
226
227/* pru_connect2 is EOPNOTSUPP */
228/* pru_control is EOPNOTSUPP */
229
230static int
231rts_detach(struct socket *so)
232{
233 struct rawcb *rp = sotorawcb(so);
234
235 VERIFY(rp != NULL);
236
237 switch (rp->rcb_proto.sp_protocol) {
238 case AF_INET:
239 atomic_add_32(&route_cb.ip_count, -1);
240 break;
241 case AF_INET6:
242 atomic_add_32(&route_cb.ip6_count, -1);
243 break;
244 }
245 atomic_add_32(&route_cb.any_count, -1);
246 return (raw_usrreqs.pru_detach(so));
247}
248
249static int
250rts_disconnect(struct socket *so)
251{
252 return (raw_usrreqs.pru_disconnect(so));
253}
254
255/* pru_listen is EOPNOTSUPP */
256
257static int
258rts_peeraddr(struct socket *so, struct sockaddr **nam)
259{
260 return (raw_usrreqs.pru_peeraddr(so, nam));
261}
262
263/* pru_rcvd is EOPNOTSUPP */
264/* pru_rcvoob is EOPNOTSUPP */
265
266static int
267rts_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
268 struct mbuf *control, struct proc *p)
269{
270 return (raw_usrreqs.pru_send(so, flags, m, nam, control, p));
271}
272
273/* pru_sense is null */
274
275static int
276rts_shutdown(struct socket *so)
277{
278 return (raw_usrreqs.pru_shutdown(so));
279}
280
281static int
282rts_sockaddr(struct socket *so, struct sockaddr **nam)
283{
284 return (raw_usrreqs.pru_sockaddr(so, nam));
285}
286
287static struct pr_usrreqs route_usrreqs = {
288 .pru_abort = rts_abort,
289 .pru_attach = rts_attach,
290 .pru_bind = rts_bind,
291 .pru_connect = rts_connect,
292 .pru_detach = rts_detach,
293 .pru_disconnect = rts_disconnect,
294 .pru_peeraddr = rts_peeraddr,
295 .pru_send = rts_send,
296 .pru_shutdown = rts_shutdown,
297 .pru_sockaddr = rts_sockaddr,
298 .pru_sosend = sosend,
299 .pru_soreceive = soreceive,
300};
301
302/*ARGSUSED*/
303static int
304route_output(struct mbuf *m, struct socket *so)
305{
306 struct rt_msghdr *rtm = NULL;
307 struct rtentry *rt = NULL;
308 struct rtentry *saved_nrt = NULL;
309 struct radix_node_head *rnh;
310 struct rt_addrinfo info;
311 int len, error = 0;
312 sa_family_t dst_sa_family = 0;
313 struct ifnet *ifp = NULL;
314 struct sockaddr_in dst_in, gate_in;
315 int sendonlytoself = 0;
316 unsigned int ifscope = IFSCOPE_NONE;
317 struct rawcb *rp = NULL;
318 boolean_t is_router = FALSE;
319#define senderr(e) { error = (e); goto flush; }
320 if (m == NULL || ((m->m_len < sizeof (intptr_t)) &&
321 (m = m_pullup(m, sizeof (intptr_t))) == NULL))
322 return (ENOBUFS);
323 VERIFY(m->m_flags & M_PKTHDR);
324
325 /*
326 * Unlock the socket (but keep a reference) it won't be
327 * accessed until raw_input appends to it.
328 */
329 socket_unlock(so, 0);
330 lck_mtx_lock(rnh_lock);
331
332 len = m->m_pkthdr.len;
333 if (len < sizeof (*rtm) ||
334 len != mtod(m, struct rt_msghdr *)->rtm_msglen) {
335 info.rti_info[RTAX_DST] = NULL;
336 senderr(EINVAL);
337 }
338 R_Malloc(rtm, struct rt_msghdr *, len);
339 if (rtm == NULL) {
340 info.rti_info[RTAX_DST] = NULL;
341 senderr(ENOBUFS);
342 }
343 m_copydata(m, 0, len, (caddr_t)rtm);
344 if (rtm->rtm_version != RTM_VERSION) {
345 info.rti_info[RTAX_DST] = NULL;
346 senderr(EPROTONOSUPPORT);
347 }
348
349 /*
350 * Silent version of RTM_GET for Reachabiltiy APIs. We may change
351 * all RTM_GETs to be silent in the future, so this is private for now.
352 */
353 if (rtm->rtm_type == RTM_GET_SILENT) {
354 if (!(so->so_options & SO_USELOOPBACK))
355 senderr(EINVAL);
356 sendonlytoself = 1;
357 rtm->rtm_type = RTM_GET;
358 }
359
360 /*
361 * Perform permission checking, only privileged sockets
362 * may perform operations other than RTM_GET
363 */
364 if (rtm->rtm_type != RTM_GET && !(so->so_state & SS_PRIV)) {
365 info.rti_info[RTAX_DST] = NULL;
366 senderr(EPERM);
367 }
368
369 rtm->rtm_pid = proc_selfpid();
370 info.rti_addrs = rtm->rtm_addrs;
371 if (rt_xaddrs((caddr_t)(rtm + 1), len + (caddr_t)rtm, &info)) {
372 info.rti_info[RTAX_DST] = NULL;
373 senderr(EINVAL);
374 }
375 if (info.rti_info[RTAX_DST] == NULL ||
376 info.rti_info[RTAX_DST]->sa_family >= AF_MAX ||
377 (info.rti_info[RTAX_GATEWAY] != NULL &&
378 info.rti_info[RTAX_GATEWAY]->sa_family >= AF_MAX))
379 senderr(EINVAL);
380
381 if (info.rti_info[RTAX_DST]->sa_family == AF_INET &&
382 info.rti_info[RTAX_DST]->sa_len != sizeof (dst_in)) {
383 /* At minimum, we need up to sin_addr */
384 if (info.rti_info[RTAX_DST]->sa_len <
385 offsetof(struct sockaddr_in, sin_zero))
386 senderr(EINVAL);
387 bzero(&dst_in, sizeof (dst_in));
388 dst_in.sin_len = sizeof (dst_in);
389 dst_in.sin_family = AF_INET;
390 dst_in.sin_port = SIN(info.rti_info[RTAX_DST])->sin_port;
391 dst_in.sin_addr = SIN(info.rti_info[RTAX_DST])->sin_addr;
392 info.rti_info[RTAX_DST] = (struct sockaddr *)&dst_in;
393 dst_sa_family = info.rti_info[RTAX_DST]->sa_family;
394 }
395
396 if (info.rti_info[RTAX_GATEWAY] != NULL &&
397 info.rti_info[RTAX_GATEWAY]->sa_family == AF_INET &&
398 info.rti_info[RTAX_GATEWAY]->sa_len != sizeof (gate_in)) {
399 /* At minimum, we need up to sin_addr */
400 if (info.rti_info[RTAX_GATEWAY]->sa_len <
401 offsetof(struct sockaddr_in, sin_zero))
402 senderr(EINVAL);
403 bzero(&gate_in, sizeof (gate_in));
404 gate_in.sin_len = sizeof (gate_in);
405 gate_in.sin_family = AF_INET;
406 gate_in.sin_port = SIN(info.rti_info[RTAX_GATEWAY])->sin_port;
407 gate_in.sin_addr = SIN(info.rti_info[RTAX_GATEWAY])->sin_addr;
408 info.rti_info[RTAX_GATEWAY] = (struct sockaddr *)&gate_in;
409 }
410
411 if (info.rti_info[RTAX_GENMASK]) {
412 struct radix_node *t;
413 t = rn_addmask((caddr_t)info.rti_info[RTAX_GENMASK], 0, 1);
414 if (t != NULL && Bcmp(info.rti_info[RTAX_GENMASK],
415 t->rn_key, *(u_char *)info.rti_info[RTAX_GENMASK]) == 0)
416 info.rti_info[RTAX_GENMASK] =
417 (struct sockaddr *)(t->rn_key);
418 else
419 senderr(ENOBUFS);
420 }
421
422 /*
423 * If RTF_IFSCOPE flag is set, then rtm_index specifies the scope.
424 */
425 if (rtm->rtm_flags & RTF_IFSCOPE) {
426 if (info.rti_info[RTAX_DST]->sa_family != AF_INET &&
427 info.rti_info[RTAX_DST]->sa_family != AF_INET6)
428 senderr(EINVAL);
429 ifscope = rtm->rtm_index;
430 }
431 /*
432 * Block changes on INTCOPROC interfaces.
433 */
434 if (ifscope) {
435 unsigned int intcoproc_scope = 0;
436 ifnet_head_lock_shared();
437 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
438 if (IFNET_IS_INTCOPROC(ifp)) {
439 intcoproc_scope = ifp->if_index;
440 break;
441 }
442 }
443 ifnet_head_done();
444 if (intcoproc_scope == ifscope && current_proc()->p_pid != 0)
445 senderr(EINVAL);
446 }
447
448 /*
449 * RTF_PROXY can only be set internally from within the kernel.
450 */
451 if (rtm->rtm_flags & RTF_PROXY)
452 senderr(EINVAL);
453
454 /*
455 * For AF_INET, always zero out the embedded scope ID. If this is
456 * a scoped request, it must be done explicitly by setting RTF_IFSCOPE
457 * flag and the corresponding rtm_index value. This is to prevent
458 * false interpretation of the scope ID because it's using the sin_zero
459 * field, which might not be properly cleared by the requestor.
460 */
461 if (info.rti_info[RTAX_DST]->sa_family == AF_INET)
462 sin_set_ifscope(info.rti_info[RTAX_DST], IFSCOPE_NONE);
463 if (info.rti_info[RTAX_GATEWAY] != NULL &&
464 info.rti_info[RTAX_GATEWAY]->sa_family == AF_INET)
465 sin_set_ifscope(info.rti_info[RTAX_GATEWAY], IFSCOPE_NONE);
466 switch (rtm->rtm_type) {
467 case RTM_ADD:
468 if (info.rti_info[RTAX_GATEWAY] == NULL)
469 senderr(EINVAL);
470
471 error = rtrequest_scoped_locked(RTM_ADD,
472 info.rti_info[RTAX_DST], info.rti_info[RTAX_GATEWAY],
473 info.rti_info[RTAX_NETMASK], rtm->rtm_flags, &saved_nrt,
474 ifscope);
475 if (error == 0 && saved_nrt != NULL) {
476 RT_LOCK(saved_nrt);
477 /*
478 * If the route request specified an interface with
479 * IFA and/or IFP, we set the requested interface on
480 * the route with rt_setif. It would be much better
481 * to do this inside rtrequest, but that would
482 * require passing the desired interface, in some
483 * form, to rtrequest. Since rtrequest is called in
484 * so many places (roughly 40 in our source), adding
485 * a parameter is to much for us to swallow; this is
486 * something for the FreeBSD developers to tackle.
487 * Instead, we let rtrequest compute whatever
488 * interface it wants, then come in behind it and
489 * stick in the interface that we really want. This
490 * works reasonably well except when rtrequest can't
491 * figure out what interface to use (with
492 * ifa_withroute) and returns ENETUNREACH. Ideally
493 * it shouldn't matter if rtrequest can't figure out
494 * the interface if we're going to explicitly set it
495 * ourselves anyway. But practically we can't
496 * recover here because rtrequest will not do any of
497 * the work necessary to add the route if it can't
498 * find an interface. As long as there is a default
499 * route that leads to some interface, rtrequest will
500 * find an interface, so this problem should be
501 * rarely encountered.
502 * dwiggins@bbn.com
503 */
504 rt_setif(saved_nrt,
505 info.rti_info[RTAX_IFP], info.rti_info[RTAX_IFA],
506 info.rti_info[RTAX_GATEWAY], ifscope);
507 (void)rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx, saved_nrt);
508 saved_nrt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
509 saved_nrt->rt_rmx.rmx_locks |=
510 (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
511 saved_nrt->rt_genmask = info.rti_info[RTAX_GENMASK];
512 RT_REMREF_LOCKED(saved_nrt);
513 RT_UNLOCK(saved_nrt);
514 }
515 break;
516
517 case RTM_DELETE:
518 error = rtrequest_scoped_locked(RTM_DELETE,
519 info.rti_info[RTAX_DST], info.rti_info[RTAX_GATEWAY],
520 info.rti_info[RTAX_NETMASK], rtm->rtm_flags, &saved_nrt,
521 ifscope);
522 if (error == 0) {
523 rt = saved_nrt;
524 RT_LOCK(rt);
525 goto report;
526 }
527 break;
528
529 case RTM_GET:
530 case RTM_CHANGE:
531 case RTM_LOCK:
532 rnh = rt_tables[info.rti_info[RTAX_DST]->sa_family];
533 if (rnh == NULL)
534 senderr(EAFNOSUPPORT);
535 /*
536 * Lookup the best match based on the key-mask pair;
537 * callee adds a reference and checks for root node.
538 */
539 rt = rt_lookup(TRUE, info.rti_info[RTAX_DST],
540 info.rti_info[RTAX_NETMASK], rnh, ifscope);
541 if (rt == NULL)
542 senderr(ESRCH);
543 RT_LOCK(rt);
544
545 /*
546 * Holding rnh_lock here prevents the possibility of
547 * ifa from changing (e.g. in_ifinit), so it is safe
548 * to access its ifa_addr (down below) without locking.
549 */
550 switch (rtm->rtm_type) {
551 case RTM_GET: {
552 kauth_cred_t cred;
553 kauth_cred_t* credp;
554 struct ifaddr *ifa2;
555report:
556 cred = kauth_cred_proc_ref(current_proc());
557 credp = &cred;
558
559 ifa2 = NULL;
560 RT_LOCK_ASSERT_HELD(rt);
561 info.rti_info[RTAX_DST] = rt_key(rt);
562 dst_sa_family = info.rti_info[RTAX_DST]->sa_family;
563 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
564 info.rti_info[RTAX_NETMASK] = rt_mask(rt);
565 info.rti_info[RTAX_GENMASK] = rt->rt_genmask;
566 if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
567 ifp = rt->rt_ifp;
568 if (ifp != NULL) {
569 ifnet_lock_shared(ifp);
570 ifa2 = ifp->if_lladdr;
571 info.rti_info[RTAX_IFP] =
572 ifa2->ifa_addr;
573 IFA_ADDREF(ifa2);
574 ifnet_lock_done(ifp);
575 info.rti_info[RTAX_IFA] =
576 rt->rt_ifa->ifa_addr;
577 rtm->rtm_index = ifp->if_index;
578 } else {
579 info.rti_info[RTAX_IFP] = NULL;
580 info.rti_info[RTAX_IFA] = NULL;
581 }
582 } else if ((ifp = rt->rt_ifp) != NULL) {
583 rtm->rtm_index = ifp->if_index;
584 }
585 if (ifa2 != NULL)
586 IFA_LOCK(ifa2);
587 len = rt_msg2(rtm->rtm_type, &info, NULL, NULL, credp);
588 if (ifa2 != NULL)
589 IFA_UNLOCK(ifa2);
590 struct rt_msghdr *out_rtm;
591 R_Malloc(out_rtm, struct rt_msghdr *, len);
592 if (out_rtm == NULL) {
593 RT_UNLOCK(rt);
594 if (ifa2 != NULL)
595 IFA_REMREF(ifa2);
596 senderr(ENOBUFS);
597 }
598 Bcopy(rtm, out_rtm, sizeof(struct rt_msghdr));
599 if (ifa2 != NULL)
600 IFA_LOCK(ifa2);
601 (void) rt_msg2(out_rtm->rtm_type, &info, (caddr_t)out_rtm,
602 NULL, &cred);
603 if (ifa2 != NULL)
604 IFA_UNLOCK(ifa2);
605 R_Free(rtm);
606 rtm = out_rtm;
607 rtm->rtm_flags = rt->rt_flags;
608 rt_getmetrics(rt, &rtm->rtm_rmx);
609 rtm->rtm_addrs = info.rti_addrs;
610 if (ifa2 != NULL)
611 IFA_REMREF(ifa2);
612
613 kauth_cred_unref(&cred);
614 break;
615 }
616
617 case RTM_CHANGE:
618 is_router = (rt->rt_flags & RTF_ROUTER) ? TRUE : FALSE;
619
620 if (info.rti_info[RTAX_GATEWAY] != NULL &&
621 (error = rt_setgate(rt, rt_key(rt),
622 info.rti_info[RTAX_GATEWAY]))) {
623 int tmp = error;
624 RT_UNLOCK(rt);
625 senderr(tmp);
626 }
627 /*
628 * If they tried to change things but didn't specify
629 * the required gateway, then just use the old one.
630 * This can happen if the user tries to change the
631 * flags on the default route without changing the
632 * default gateway. Changing flags still doesn't work.
633 */
634 if ((rt->rt_flags & RTF_GATEWAY) &&
635 info.rti_info[RTAX_GATEWAY] == NULL)
636 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
637
638 /*
639 * On Darwin, we call rt_setif which contains the
640 * equivalent to the code found at this very spot
641 * in BSD.
642 */
643 rt_setif(rt,
644 info.rti_info[RTAX_IFP], info.rti_info[RTAX_IFA],
645 info.rti_info[RTAX_GATEWAY], ifscope);
646
647 if ((error = rt_setmetrics(rtm->rtm_inits,
648 &rtm->rtm_rmx, rt))) {
649 int tmp = error;
650 RT_UNLOCK(rt);
651 senderr(tmp);
652 }
653 if (info.rti_info[RTAX_GENMASK])
654 rt->rt_genmask = info.rti_info[RTAX_GENMASK];
655
656 /*
657 * Enqueue work item to invoke callback for this route entry
658 * This may not be needed always, but for now issue it anytime
659 * RTM_CHANGE gets called.
660 */
661 route_event_enqueue_nwk_wq_entry(rt, NULL, ROUTE_ENTRY_REFRESH, NULL, TRUE);
662 /*
663 * If the route is for a router, walk the tree to send refresh
664 * event to protocol cloned entries
665 */
666 if (is_router) {
667 struct route_event rt_ev;
668 route_event_init(&rt_ev, rt, NULL, ROUTE_ENTRY_REFRESH);
669 RT_UNLOCK(rt);
670 (void) rnh->rnh_walktree(rnh, route_event_walktree, (void *)&rt_ev);
671 RT_LOCK(rt);
672 }
673 /* FALLTHRU */
674 case RTM_LOCK:
675 rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
676 rt->rt_rmx.rmx_locks |=
677 (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
678 break;
679 }
680 RT_UNLOCK(rt);
681 break;
682 default:
683 senderr(EOPNOTSUPP);
684 }
685flush:
686 if (rtm != NULL) {
687 if (error)
688 rtm->rtm_errno = error;
689 else
690 rtm->rtm_flags |= RTF_DONE;
691 }
692 if (rt != NULL) {
693 RT_LOCK_ASSERT_NOTHELD(rt);
694 rtfree_locked(rt);
695 }
696 lck_mtx_unlock(rnh_lock);
697
698 /* relock the socket now */
699 socket_lock(so, 0);
700 /*
701 * Check to see if we don't want our own messages.
702 */
703 if (!(so->so_options & SO_USELOOPBACK)) {
704 if (route_cb.any_count <= 1) {
705 if (rtm != NULL)
706 R_Free(rtm);
707 m_freem(m);
708 return (error);
709 }
710 /* There is another listener, so construct message */
711 rp = sotorawcb(so);
712 }
713 if (rtm != NULL) {
714 m_copyback(m, 0, rtm->rtm_msglen, (caddr_t)rtm);
715 if (m->m_pkthdr.len < rtm->rtm_msglen) {
716 m_freem(m);
717 m = NULL;
718 } else if (m->m_pkthdr.len > rtm->rtm_msglen) {
719 m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
720 }
721 R_Free(rtm);
722 }
723 if (sendonlytoself && m != NULL) {
724 error = 0;
725 if (sbappendaddr(&so->so_rcv, &route_src, m,
726 NULL, &error) != 0) {
727 sorwakeup(so);
728 }
729 if (error)
730 return (error);
731 } else {
732 struct sockproto route_proto = { PF_ROUTE, 0 };
733 if (rp != NULL)
734 rp->rcb_proto.sp_family = 0; /* Avoid us */
735 if (dst_sa_family != 0)
736 route_proto.sp_protocol = dst_sa_family;
737 if (m != NULL) {
738 socket_unlock(so, 0);
739 raw_input(m, &route_proto, &route_src, &route_dst);
740 socket_lock(so, 0);
741 }
742 if (rp != NULL)
743 rp->rcb_proto.sp_family = PF_ROUTE;
744 }
745 return (error);
746}
747
748void
749rt_setexpire(struct rtentry *rt, uint64_t expiry)
750{
751 /* set both rt_expire and rmx_expire */
752 rt->rt_expire = expiry;
753 if (expiry) {
754 rt->rt_rmx.rmx_expire = expiry + rt->base_calendartime -
755 rt->base_uptime;
756 } else {
757 rt->rt_rmx.rmx_expire = 0;
758 }
759}
760
761static int
762rt_setmetrics(u_int32_t which, struct rt_metrics *in, struct rtentry *out)
763{
764 if (!(which & RTV_REFRESH_HOST)) {
765 struct timeval caltime;
766 getmicrotime(&caltime);
767#define metric(f, e) if (which & (f)) out->rt_rmx.e = in->e;
768 metric(RTV_RPIPE, rmx_recvpipe);
769 metric(RTV_SPIPE, rmx_sendpipe);
770 metric(RTV_SSTHRESH, rmx_ssthresh);
771 metric(RTV_RTT, rmx_rtt);
772 metric(RTV_RTTVAR, rmx_rttvar);
773 metric(RTV_HOPCOUNT, rmx_hopcount);
774 metric(RTV_MTU, rmx_mtu);
775 metric(RTV_EXPIRE, rmx_expire);
776#undef metric
777 if (out->rt_rmx.rmx_expire > 0) {
778 /* account for system time change */
779 getmicrotime(&caltime);
780 out->base_calendartime +=
781 NET_CALCULATE_CLOCKSKEW(caltime,
782 out->base_calendartime,
783 net_uptime(), out->base_uptime);
784 rt_setexpire(out,
785 out->rt_rmx.rmx_expire -
786 out->base_calendartime +
787 out->base_uptime);
788 } else {
789 rt_setexpire(out, 0);
790 }
791
792 VERIFY(out->rt_expire == 0 || out->rt_rmx.rmx_expire != 0);
793 VERIFY(out->rt_expire != 0 || out->rt_rmx.rmx_expire == 0);
794 } else {
795 /* Only RTV_REFRESH_HOST must be set */
796 if ((which & ~RTV_REFRESH_HOST) ||
797 (out->rt_flags & RTF_STATIC) ||
798 !(out->rt_flags & RTF_LLINFO)) {
799 return (EINVAL);
800 }
801
802 if (out->rt_llinfo_refresh == NULL) {
803 return (ENOTSUP);
804 }
805
806 out->rt_llinfo_refresh(out);
807 }
808 return (0);
809}
810
811static void
812rt_getmetrics(struct rtentry *in, struct rt_metrics *out)
813{
814 struct timeval caltime;
815
816 VERIFY(in->rt_expire == 0 || in->rt_rmx.rmx_expire != 0);
817 VERIFY(in->rt_expire != 0 || in->rt_rmx.rmx_expire == 0);
818
819 *out = in->rt_rmx;
820
821 if (in->rt_expire != 0) {
822 /* account for system time change */
823 getmicrotime(&caltime);
824
825 in->base_calendartime +=
826 NET_CALCULATE_CLOCKSKEW(caltime,
827 in->base_calendartime, net_uptime(), in->base_uptime);
828
829 out->rmx_expire = in->base_calendartime +
830 in->rt_expire - in->base_uptime;
831 } else {
832 out->rmx_expire = 0;
833 }
834}
835
836/*
837 * Set route's interface given info.rti_info[RTAX_IFP],
838 * info.rti_info[RTAX_IFA], and gateway.
839 */
840static void
841rt_setif(struct rtentry *rt, struct sockaddr *Ifpaddr, struct sockaddr *Ifaaddr,
842 struct sockaddr *Gate, unsigned int ifscope)
843{
844 struct ifaddr *ifa = NULL;
845 struct ifnet *ifp = NULL;
846 void (*ifa_rtrequest)(int, struct rtentry *, struct sockaddr *);
847
848 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
849
850 RT_LOCK_ASSERT_HELD(rt);
851
852 /* Don't update a defunct route */
853 if (rt->rt_flags & RTF_CONDEMNED)
854 return;
855
856 /* Add an extra ref for ourselves */
857 RT_ADDREF_LOCKED(rt);
858
859 /* Become a regular mutex, just in case */
860 RT_CONVERT_LOCK(rt);
861
862 /*
863 * New gateway could require new ifaddr, ifp; flags may also
864 * be different; ifp may be specified by ll sockaddr when
865 * protocol address is ambiguous.
866 */
867 if (Ifpaddr && (ifa = ifa_ifwithnet_scoped(Ifpaddr, ifscope)) &&
868 (ifp = ifa->ifa_ifp) && (Ifaaddr || Gate)) {
869 IFA_REMREF(ifa);
870 ifa = ifaof_ifpforaddr(Ifaaddr ? Ifaaddr : Gate, ifp);
871 } else {
872 if (ifa != NULL) {
873 IFA_REMREF(ifa);
874 ifa = NULL;
875 }
876 if (Ifpaddr && (ifp = if_withname(Ifpaddr))) {
877 if (Gate) {
878 ifa = ifaof_ifpforaddr(Gate, ifp);
879 } else {
880 ifnet_lock_shared(ifp);
881 ifa = TAILQ_FIRST(&ifp->if_addrhead);
882 if (ifa != NULL)
883 IFA_ADDREF(ifa);
884 ifnet_lock_done(ifp);
885 }
886 } else if (Ifaaddr &&
887 (ifa = ifa_ifwithaddr_scoped(Ifaaddr, ifscope))) {
888 ifp = ifa->ifa_ifp;
889 } else if (Gate != NULL) {
890 /*
891 * Safe to drop rt_lock and use rt_key, since holding
892 * rnh_lock here prevents another thread from calling
893 * rt_setgate() on this route. We cannot hold the
894 * lock across ifa_ifwithroute since the lookup done
895 * by that routine may point to the same route.
896 */
897 RT_UNLOCK(rt);
898 if ((ifa = ifa_ifwithroute_scoped_locked(rt->rt_flags,
899 rt_key(rt), Gate, ifscope)) != NULL)
900 ifp = ifa->ifa_ifp;
901 RT_LOCK(rt);
902 /* Don't update a defunct route */
903 if (rt->rt_flags & RTF_CONDEMNED) {
904 if (ifa != NULL)
905 IFA_REMREF(ifa);
906 /* Release extra ref */
907 RT_REMREF_LOCKED(rt);
908 return;
909 }
910 }
911 }
912
913 /* trigger route cache reevaluation */
914 if (rt_key(rt)->sa_family == AF_INET)
915 routegenid_inet_update();
916#if INET6
917 else if (rt_key(rt)->sa_family == AF_INET6)
918 routegenid_inet6_update();
919#endif /* INET6 */
920
921 if (ifa != NULL) {
922 struct ifaddr *oifa = rt->rt_ifa;
923 if (oifa != ifa) {
924 if (oifa != NULL) {
925 IFA_LOCK_SPIN(oifa);
926 ifa_rtrequest = oifa->ifa_rtrequest;
927 IFA_UNLOCK(oifa);
928 if (ifa_rtrequest != NULL)
929 ifa_rtrequest(RTM_DELETE, rt, Gate);
930 }
931 rtsetifa(rt, ifa);
932
933 if (rt->rt_ifp != ifp) {
934 /*
935 * Purge any link-layer info caching.
936 */
937 if (rt->rt_llinfo_purge != NULL)
938 rt->rt_llinfo_purge(rt);
939
940 /*
941 * Adjust route ref count for the interfaces.
942 */
943 if (rt->rt_if_ref_fn != NULL) {
944 rt->rt_if_ref_fn(ifp, 1);
945 rt->rt_if_ref_fn(rt->rt_ifp, -1);
946 }
947 }
948 rt->rt_ifp = ifp;
949 /*
950 * If this is the (non-scoped) default route, record
951 * the interface index used for the primary ifscope.
952 */
953 if (rt_primary_default(rt, rt_key(rt))) {
954 set_primary_ifscope(rt_key(rt)->sa_family,
955 rt->rt_ifp->if_index);
956 }
957 /*
958 * If rmx_mtu is not locked, update it
959 * to the MTU used by the new interface.
960 */
961 if (!(rt->rt_rmx.rmx_locks & RTV_MTU)) {
962 rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu;
963 if (rt_key(rt)->sa_family == AF_INET &&
964 INTF_ADJUST_MTU_FOR_CLAT46(ifp)) {
965 rt->rt_rmx.rmx_mtu = IN6_LINKMTU(rt->rt_ifp);
966 /* Further adjust the size for CLAT46 expansion */
967 rt->rt_rmx.rmx_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
968 }
969 }
970
971 if (rt->rt_ifa != NULL) {
972 IFA_LOCK_SPIN(rt->rt_ifa);
973 ifa_rtrequest = rt->rt_ifa->ifa_rtrequest;
974 IFA_UNLOCK(rt->rt_ifa);
975 if (ifa_rtrequest != NULL)
976 ifa_rtrequest(RTM_ADD, rt, Gate);
977 }
978 IFA_REMREF(ifa);
979 /* Release extra ref */
980 RT_REMREF_LOCKED(rt);
981 return;
982 }
983 IFA_REMREF(ifa);
984 ifa = NULL;
985 }
986
987 /* XXX: to reset gateway to correct value, at RTM_CHANGE */
988 if (rt->rt_ifa != NULL) {
989 IFA_LOCK_SPIN(rt->rt_ifa);
990 ifa_rtrequest = rt->rt_ifa->ifa_rtrequest;
991 IFA_UNLOCK(rt->rt_ifa);
992 if (ifa_rtrequest != NULL)
993 ifa_rtrequest(RTM_ADD, rt, Gate);
994 }
995
996 /*
997 * Workaround for local address routes pointing to the loopback
998 * interface added by configd, until <rdar://problem/12970142>.
999 */
1000 if ((rt->rt_ifp->if_flags & IFF_LOOPBACK) &&
1001 (rt->rt_flags & RTF_HOST) && rt->rt_ifa->ifa_ifp == rt->rt_ifp) {
1002 ifa = ifa_ifwithaddr(rt_key(rt));
1003 if (ifa != NULL) {
1004 if (ifa != rt->rt_ifa)
1005 rtsetifa(rt, ifa);
1006 IFA_REMREF(ifa);
1007 }
1008 }
1009
1010 /* Release extra ref */
1011 RT_REMREF_LOCKED(rt);
1012}
1013
1014/*
1015 * Extract the addresses of the passed sockaddrs.
1016 * Do a little sanity checking so as to avoid bad memory references.
1017 * This data is derived straight from userland.
1018 */
1019static int
1020rt_xaddrs(caddr_t cp, caddr_t cplim, struct rt_addrinfo *rtinfo)
1021{
1022 struct sockaddr *sa;
1023 int i;
1024
1025 bzero(rtinfo->rti_info, sizeof (rtinfo->rti_info));
1026 for (i = 0; (i < RTAX_MAX) && (cp < cplim); i++) {
1027 if ((rtinfo->rti_addrs & (1 << i)) == 0)
1028 continue;
1029 sa = (struct sockaddr *)cp;
1030 /*
1031 * It won't fit.
1032 */
1033 if ((cp + sa->sa_len) > cplim)
1034 return (EINVAL);
1035 /*
1036 * there are no more.. quit now
1037 * If there are more bits, they are in error.
1038 * I've seen this. route(1) can evidently generate these.
1039 * This causes kernel to core dump.
1040 * for compatibility, If we see this, point to a safe address.
1041 */
1042 if (sa->sa_len == 0) {
1043 rtinfo->rti_info[i] = &sa_zero;
1044 return (0); /* should be EINVAL but for compat */
1045 }
1046 /* accept it */
1047 rtinfo->rti_info[i] = sa;
1048 ADVANCE32(cp, sa);
1049 }
1050 return (0);
1051}
1052
1053static struct mbuf *
1054rt_msg1(int type, struct rt_addrinfo *rtinfo)
1055{
1056 struct rt_msghdr *rtm;
1057 struct mbuf *m;
1058 int i;
1059 int len, dlen, off;
1060
1061 switch (type) {
1062
1063 case RTM_DELADDR:
1064 case RTM_NEWADDR:
1065 len = sizeof (struct ifa_msghdr);
1066 break;
1067
1068 case RTM_DELMADDR:
1069 case RTM_NEWMADDR:
1070 len = sizeof (struct ifma_msghdr);
1071 break;
1072
1073 case RTM_IFINFO:
1074 len = sizeof (struct if_msghdr);
1075 break;
1076
1077 default:
1078 len = sizeof (struct rt_msghdr);
1079 }
1080 m = m_gethdr(M_DONTWAIT, MT_DATA);
1081 if (m && len > MHLEN) {
1082 MCLGET(m, M_DONTWAIT);
1083 if (!(m->m_flags & M_EXT)) {
1084 m_free(m);
1085 m = NULL;
1086 }
1087 }
1088 if (m == NULL)
1089 return (NULL);
1090 m->m_pkthdr.len = m->m_len = len;
1091 m->m_pkthdr.rcvif = NULL;
1092 rtm = mtod(m, struct rt_msghdr *);
1093 bzero((caddr_t)rtm, len);
1094 off = len;
1095 for (i = 0; i < RTAX_MAX; i++) {
1096 struct sockaddr *sa, *hint;
1097 uint8_t ssbuf[SOCK_MAXADDRLEN + 1];
1098
1099 /*
1100 * Make sure to accomodate the largest possible size of sa_len.
1101 */
1102 _CASSERT(sizeof (ssbuf) == (SOCK_MAXADDRLEN + 1));
1103
1104 if ((sa = rtinfo->rti_info[i]) == NULL)
1105 continue;
1106
1107 switch (i) {
1108 case RTAX_DST:
1109 case RTAX_NETMASK:
1110 if ((hint = rtinfo->rti_info[RTAX_DST]) == NULL)
1111 hint = rtinfo->rti_info[RTAX_IFA];
1112
1113 /* Scrub away any trace of embedded interface scope */
1114 sa = rtm_scrub(type, i, hint, sa, &ssbuf,
1115 sizeof (ssbuf), NULL);
1116 break;
1117
1118 default:
1119 break;
1120 }
1121
1122 rtinfo->rti_addrs |= (1 << i);
1123 dlen = sa->sa_len;
1124 m_copyback(m, off, dlen, (caddr_t)sa);
1125 len = off + dlen;
1126 off += ROUNDUP32(dlen);
1127 }
1128 if (m->m_pkthdr.len != len) {
1129 m_freem(m);
1130 return (NULL);
1131 }
1132 rtm->rtm_msglen = len;
1133 rtm->rtm_version = RTM_VERSION;
1134 rtm->rtm_type = type;
1135 return (m);
1136}
1137
1138static int
1139rt_msg2(int type, struct rt_addrinfo *rtinfo, caddr_t cp, struct walkarg *w,
1140 kauth_cred_t* credp)
1141{
1142 int i;
1143 int len, dlen, rlen, second_time = 0;
1144 caddr_t cp0;
1145
1146 rtinfo->rti_addrs = 0;
1147again:
1148 switch (type) {
1149
1150 case RTM_DELADDR:
1151 case RTM_NEWADDR:
1152 len = sizeof (struct ifa_msghdr);
1153 break;
1154
1155 case RTM_DELMADDR:
1156 case RTM_NEWMADDR:
1157 len = sizeof (struct ifma_msghdr);
1158 break;
1159
1160 case RTM_IFINFO:
1161 len = sizeof (struct if_msghdr);
1162 break;
1163
1164 case RTM_IFINFO2:
1165 len = sizeof (struct if_msghdr2);
1166 break;
1167
1168 case RTM_NEWMADDR2:
1169 len = sizeof (struct ifma_msghdr2);
1170 break;
1171
1172 case RTM_GET_EXT:
1173 len = sizeof (struct rt_msghdr_ext);
1174 break;
1175
1176 case RTM_GET2:
1177 len = sizeof (struct rt_msghdr2);
1178 break;
1179
1180 default:
1181 len = sizeof (struct rt_msghdr);
1182 }
1183 cp0 = cp;
1184 if (cp0)
1185 cp += len;
1186 for (i = 0; i < RTAX_MAX; i++) {
1187 struct sockaddr *sa, *hint;
1188 uint8_t ssbuf[SOCK_MAXADDRLEN + 1];
1189
1190 /*
1191 * Make sure to accomodate the largest possible size of sa_len.
1192 */
1193 _CASSERT(sizeof (ssbuf) == (SOCK_MAXADDRLEN + 1));
1194
1195 if ((sa = rtinfo->rti_info[i]) == NULL)
1196 continue;
1197
1198 switch (i) {
1199 case RTAX_DST:
1200 case RTAX_NETMASK:
1201 if ((hint = rtinfo->rti_info[RTAX_DST]) == NULL)
1202 hint = rtinfo->rti_info[RTAX_IFA];
1203
1204 /* Scrub away any trace of embedded interface scope */
1205 sa = rtm_scrub(type, i, hint, sa, &ssbuf,
1206 sizeof (ssbuf), NULL);
1207 break;
1208 case RTAX_GATEWAY:
1209 case RTAX_IFP:
1210 sa = rtm_scrub(type, i, NULL, sa, &ssbuf,
1211 sizeof (ssbuf), credp);
1212 break;
1213
1214 default:
1215 break;
1216 }
1217
1218 rtinfo->rti_addrs |= (1 << i);
1219 dlen = sa->sa_len;
1220 rlen = ROUNDUP32(dlen);
1221 if (cp) {
1222 bcopy((caddr_t)sa, cp, (size_t)dlen);
1223 if (dlen != rlen)
1224 bzero(cp + dlen, rlen - dlen);
1225 cp += rlen;
1226 }
1227 len += rlen;
1228 }
1229 if (cp == NULL && w != NULL && !second_time) {
1230 struct walkarg *rw = w;
1231
1232 if (rw->w_req != NULL) {
1233 if (rw->w_tmemsize < len) {
1234 if (rw->w_tmem != NULL)
1235 FREE(rw->w_tmem, M_RTABLE);
1236 rw->w_tmem = _MALLOC(len, M_RTABLE, M_WAITOK);
1237 if (rw->w_tmem != NULL)
1238 rw->w_tmemsize = len;
1239 }
1240 if (rw->w_tmem != NULL) {
1241 cp = rw->w_tmem;
1242 second_time = 1;
1243 goto again;
1244 }
1245 }
1246 }
1247 if (cp) {
1248 struct rt_msghdr *rtm = (struct rt_msghdr *)(void *)cp0;
1249
1250 rtm->rtm_version = RTM_VERSION;
1251 rtm->rtm_type = type;
1252 rtm->rtm_msglen = len;
1253 }
1254 return (len);
1255}
1256
1257/*
1258 * This routine is called to generate a message from the routing
1259 * socket indicating that a redirect has occurred, a routing lookup
1260 * has failed, or that a protocol has detected timeouts to a particular
1261 * destination.
1262 */
1263void
1264rt_missmsg(int type, struct rt_addrinfo *rtinfo, int flags, int error)
1265{
1266 struct rt_msghdr *rtm;
1267 struct mbuf *m;
1268 struct sockaddr *sa = rtinfo->rti_info[RTAX_DST];
1269 struct sockproto route_proto = { PF_ROUTE, 0 };
1270
1271 if (route_cb.any_count == 0)
1272 return;
1273 m = rt_msg1(type, rtinfo);
1274 if (m == NULL)
1275 return;
1276 rtm = mtod(m, struct rt_msghdr *);
1277 rtm->rtm_flags = RTF_DONE | flags;
1278 rtm->rtm_errno = error;
1279 rtm->rtm_addrs = rtinfo->rti_addrs;
1280 route_proto.sp_family = sa ? sa->sa_family : 0;
1281 raw_input(m, &route_proto, &route_src, &route_dst);
1282}
1283
1284/*
1285 * This routine is called to generate a message from the routing
1286 * socket indicating that the status of a network interface has changed.
1287 */
1288void
1289rt_ifmsg(struct ifnet *ifp)
1290{
1291 struct if_msghdr *ifm;
1292 struct mbuf *m;
1293 struct rt_addrinfo info;
1294 struct sockproto route_proto = { PF_ROUTE, 0 };
1295
1296 if (route_cb.any_count == 0)
1297 return;
1298 bzero((caddr_t)&info, sizeof (info));
1299 m = rt_msg1(RTM_IFINFO, &info);
1300 if (m == NULL)
1301 return;
1302 ifm = mtod(m, struct if_msghdr *);
1303 ifm->ifm_index = ifp->if_index;
1304 ifm->ifm_flags = (u_short)ifp->if_flags;
1305 if_data_internal_to_if_data(ifp, &ifp->if_data, &ifm->ifm_data);
1306 ifm->ifm_addrs = 0;
1307 raw_input(m, &route_proto, &route_src, &route_dst);
1308}
1309
1310/*
1311 * This is called to generate messages from the routing socket
1312 * indicating a network interface has had addresses associated with it.
1313 * if we ever reverse the logic and replace messages TO the routing
1314 * socket indicate a request to configure interfaces, then it will
1315 * be unnecessary as the routing socket will automatically generate
1316 * copies of it.
1317 *
1318 * Since this is coming from the interface, it is expected that the
1319 * interface will be locked. Caller must hold rnh_lock and rt_lock.
1320 */
1321void
1322rt_newaddrmsg(int cmd, struct ifaddr *ifa, int error, struct rtentry *rt)
1323{
1324 struct rt_addrinfo info;
1325 struct sockaddr *sa = 0;
1326 int pass;
1327 struct mbuf *m = 0;
1328 struct ifnet *ifp = ifa->ifa_ifp;
1329 struct sockproto route_proto = { PF_ROUTE, 0 };
1330
1331 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1332 RT_LOCK_ASSERT_HELD(rt);
1333
1334 if (route_cb.any_count == 0)
1335 return;
1336
1337 /* Become a regular mutex, just in case */
1338 RT_CONVERT_LOCK(rt);
1339 for (pass = 1; pass < 3; pass++) {
1340 bzero((caddr_t)&info, sizeof (info));
1341 if ((cmd == RTM_ADD && pass == 1) ||
1342 (cmd == RTM_DELETE && pass == 2)) {
1343 struct ifa_msghdr *ifam;
1344 int ncmd = cmd == RTM_ADD ? RTM_NEWADDR : RTM_DELADDR;
1345
1346 /* Lock ifp for if_lladdr */
1347 ifnet_lock_shared(ifp);
1348 IFA_LOCK(ifa);
1349 info.rti_info[RTAX_IFA] = sa = ifa->ifa_addr;
1350 /*
1351 * Holding ifnet lock here prevents the link address
1352 * from changing contents, so no need to hold its
1353 * lock. The link address is always present; it's
1354 * never freed.
1355 */
1356 info.rti_info[RTAX_IFP] = ifp->if_lladdr->ifa_addr;
1357 info.rti_info[RTAX_NETMASK] = ifa->ifa_netmask;
1358 info.rti_info[RTAX_BRD] = ifa->ifa_dstaddr;
1359 if ((m = rt_msg1(ncmd, &info)) == NULL) {
1360 IFA_UNLOCK(ifa);
1361 ifnet_lock_done(ifp);
1362 continue;
1363 }
1364 IFA_UNLOCK(ifa);
1365 ifnet_lock_done(ifp);
1366 ifam = mtod(m, struct ifa_msghdr *);
1367 ifam->ifam_index = ifp->if_index;
1368 IFA_LOCK_SPIN(ifa);
1369 ifam->ifam_metric = ifa->ifa_metric;
1370 ifam->ifam_flags = ifa->ifa_flags;
1371 IFA_UNLOCK(ifa);
1372 ifam->ifam_addrs = info.rti_addrs;
1373 }
1374 if ((cmd == RTM_ADD && pass == 2) ||
1375 (cmd == RTM_DELETE && pass == 1)) {
1376 struct rt_msghdr *rtm;
1377
1378 if (rt == NULL)
1379 continue;
1380 info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1381 info.rti_info[RTAX_DST] = sa = rt_key(rt);
1382 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1383 if ((m = rt_msg1(cmd, &info)) == NULL)
1384 continue;
1385 rtm = mtod(m, struct rt_msghdr *);
1386 rtm->rtm_index = ifp->if_index;
1387 rtm->rtm_flags |= rt->rt_flags;
1388 rtm->rtm_errno = error;
1389 rtm->rtm_addrs = info.rti_addrs;
1390 }
1391 route_proto.sp_protocol = sa ? sa->sa_family : 0;
1392 raw_input(m, &route_proto, &route_src, &route_dst);
1393 }
1394}
1395
1396/*
1397 * This is the analogue to the rt_newaddrmsg which performs the same
1398 * function but for multicast group memberhips. This is easier since
1399 * there is no route state to worry about.
1400 */
1401void
1402rt_newmaddrmsg(int cmd, struct ifmultiaddr *ifma)
1403{
1404 struct rt_addrinfo info;
1405 struct mbuf *m = 0;
1406 struct ifnet *ifp = ifma->ifma_ifp;
1407 struct ifma_msghdr *ifmam;
1408 struct sockproto route_proto = { PF_ROUTE, 0 };
1409
1410 if (route_cb.any_count == 0)
1411 return;
1412
1413 /* Lock ifp for if_lladdr */
1414 ifnet_lock_shared(ifp);
1415 bzero((caddr_t)&info, sizeof (info));
1416 IFMA_LOCK(ifma);
1417 info.rti_info[RTAX_IFA] = ifma->ifma_addr;
1418 /* lladdr doesn't need lock */
1419 info.rti_info[RTAX_IFP] = ifp->if_lladdr->ifa_addr;
1420
1421 /*
1422 * If a link-layer address is present, present it as a ``gateway''
1423 * (similarly to how ARP entries, e.g., are presented).
1424 */
1425 info.rti_info[RTAX_GATEWAY] = (ifma->ifma_ll != NULL) ?
1426 ifma->ifma_ll->ifma_addr : NULL;
1427 if ((m = rt_msg1(cmd, &info)) == NULL) {
1428 IFMA_UNLOCK(ifma);
1429 ifnet_lock_done(ifp);
1430 return;
1431 }
1432 ifmam = mtod(m, struct ifma_msghdr *);
1433 ifmam->ifmam_index = ifp->if_index;
1434 ifmam->ifmam_addrs = info.rti_addrs;
1435 route_proto.sp_protocol = ifma->ifma_addr->sa_family;
1436 IFMA_UNLOCK(ifma);
1437 ifnet_lock_done(ifp);
1438 raw_input(m, &route_proto, &route_src, &route_dst);
1439}
1440
1441const char *
1442rtm2str(int cmd)
1443{
1444 const char *c = "RTM_?";
1445
1446 switch (cmd) {
1447 case RTM_ADD:
1448 c = "RTM_ADD";
1449 break;
1450 case RTM_DELETE:
1451 c = "RTM_DELETE";
1452 break;
1453 case RTM_CHANGE:
1454 c = "RTM_CHANGE";
1455 break;
1456 case RTM_GET:
1457 c = "RTM_GET";
1458 break;
1459 case RTM_LOSING:
1460 c = "RTM_LOSING";
1461 break;
1462 case RTM_REDIRECT:
1463 c = "RTM_REDIRECT";
1464 break;
1465 case RTM_MISS:
1466 c = "RTM_MISS";
1467 break;
1468 case RTM_LOCK:
1469 c = "RTM_LOCK";
1470 break;
1471 case RTM_OLDADD:
1472 c = "RTM_OLDADD";
1473 break;
1474 case RTM_OLDDEL:
1475 c = "RTM_OLDDEL";
1476 break;
1477 case RTM_RESOLVE:
1478 c = "RTM_RESOLVE";
1479 break;
1480 case RTM_NEWADDR:
1481 c = "RTM_NEWADDR";
1482 break;
1483 case RTM_DELADDR:
1484 c = "RTM_DELADDR";
1485 break;
1486 case RTM_IFINFO:
1487 c = "RTM_IFINFO";
1488 break;
1489 case RTM_NEWMADDR:
1490 c = "RTM_NEWMADDR";
1491 break;
1492 case RTM_DELMADDR:
1493 c = "RTM_DELMADDR";
1494 break;
1495 case RTM_GET_SILENT:
1496 c = "RTM_GET_SILENT";
1497 break;
1498 case RTM_IFINFO2:
1499 c = "RTM_IFINFO2";
1500 break;
1501 case RTM_NEWMADDR2:
1502 c = "RTM_NEWMADDR2";
1503 break;
1504 case RTM_GET2:
1505 c = "RTM_GET2";
1506 break;
1507 case RTM_GET_EXT:
1508 c = "RTM_GET_EXT";
1509 break;
1510 }
1511
1512 return (c);
1513}
1514
1515/*
1516 * This is used in dumping the kernel table via sysctl().
1517 */
1518static int
1519sysctl_dumpentry(struct radix_node *rn, void *vw)
1520{
1521 struct walkarg *w = vw;
1522 struct rtentry *rt = (struct rtentry *)rn;
1523 int error = 0, size;
1524 struct rt_addrinfo info;
1525 kauth_cred_t cred;
1526 kauth_cred_t *credp;
1527
1528 cred = kauth_cred_proc_ref(current_proc());
1529 credp = &cred;
1530
1531 RT_LOCK(rt);
1532 if ((w->w_op == NET_RT_FLAGS || w->w_op == NET_RT_FLAGS_PRIV) &&
1533 !(rt->rt_flags & w->w_arg))
1534 goto done;
1535
1536 /*
1537 * If the matching route has RTF_LLINFO set, then we can skip scrubbing the MAC
1538 * only if the outgoing interface is not loopback and the process has entitlement
1539 * for neighbor cache read.
1540 */
1541 if (w->w_op == NET_RT_FLAGS_PRIV && (rt->rt_flags & RTF_LLINFO)) {
1542 if (rt->rt_ifp != lo_ifp &&
1543 (route_op_entitlement_check(NULL, cred, ROUTE_OP_READ, TRUE) == 0)) {
1544 credp = NULL;
1545 }
1546 }
1547
1548 bzero((caddr_t)&info, sizeof (info));
1549 info.rti_info[RTAX_DST] = rt_key(rt);
1550 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1551 info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1552 info.rti_info[RTAX_GENMASK] = rt->rt_genmask;
1553
1554 if (w->w_op != NET_RT_DUMP2) {
1555 size = rt_msg2(RTM_GET, &info, NULL, w, credp);
1556 if (w->w_req != NULL && w->w_tmem != NULL) {
1557 struct rt_msghdr *rtm =
1558 (struct rt_msghdr *)(void *)w->w_tmem;
1559
1560 rtm->rtm_flags = rt->rt_flags;
1561 rtm->rtm_use = rt->rt_use;
1562 rt_getmetrics(rt, &rtm->rtm_rmx);
1563 rtm->rtm_index = rt->rt_ifp->if_index;
1564 rtm->rtm_pid = 0;
1565 rtm->rtm_seq = 0;
1566 rtm->rtm_errno = 0;
1567 rtm->rtm_addrs = info.rti_addrs;
1568 error = SYSCTL_OUT(w->w_req, (caddr_t)rtm, size);
1569 }
1570 } else {
1571 size = rt_msg2(RTM_GET2, &info, NULL, w, credp);
1572 if (w->w_req != NULL && w->w_tmem != NULL) {
1573 struct rt_msghdr2 *rtm =
1574 (struct rt_msghdr2 *)(void *)w->w_tmem;
1575
1576 rtm->rtm_flags = rt->rt_flags;
1577 rtm->rtm_use = rt->rt_use;
1578 rt_getmetrics(rt, &rtm->rtm_rmx);
1579 rtm->rtm_index = rt->rt_ifp->if_index;
1580 rtm->rtm_refcnt = rt->rt_refcnt;
1581 if (rt->rt_parent)
1582 rtm->rtm_parentflags = rt->rt_parent->rt_flags;
1583 else
1584 rtm->rtm_parentflags = 0;
1585 rtm->rtm_reserved = 0;
1586 rtm->rtm_addrs = info.rti_addrs;
1587 error = SYSCTL_OUT(w->w_req, (caddr_t)rtm, size);
1588 }
1589 }
1590
1591done:
1592 RT_UNLOCK(rt);
1593 kauth_cred_unref(&cred);
1594 return (error);
1595}
1596
1597/*
1598 * This is used for dumping extended information from route entries.
1599 */
1600static int
1601sysctl_dumpentry_ext(struct radix_node *rn, void *vw)
1602{
1603 struct walkarg *w = vw;
1604 struct rtentry *rt = (struct rtentry *)rn;
1605 int error = 0, size;
1606 struct rt_addrinfo info;
1607 kauth_cred_t cred;
1608
1609 cred = kauth_cred_proc_ref(current_proc());
1610
1611 RT_LOCK(rt);
1612 if (w->w_op == NET_RT_DUMPX_FLAGS && !(rt->rt_flags & w->w_arg))
1613 goto done;
1614 bzero(&info, sizeof (info));
1615 info.rti_info[RTAX_DST] = rt_key(rt);
1616 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1617 info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1618 info.rti_info[RTAX_GENMASK] = rt->rt_genmask;
1619
1620 size = rt_msg2(RTM_GET_EXT, &info, NULL, w, &cred);
1621 if (w->w_req != NULL && w->w_tmem != NULL) {
1622 struct rt_msghdr_ext *ertm =
1623 (struct rt_msghdr_ext *)(void *)w->w_tmem;
1624
1625 ertm->rtm_flags = rt->rt_flags;
1626 ertm->rtm_use = rt->rt_use;
1627 rt_getmetrics(rt, &ertm->rtm_rmx);
1628 ertm->rtm_index = rt->rt_ifp->if_index;
1629 ertm->rtm_pid = 0;
1630 ertm->rtm_seq = 0;
1631 ertm->rtm_errno = 0;
1632 ertm->rtm_addrs = info.rti_addrs;
1633 if (rt->rt_llinfo_get_ri == NULL) {
1634 bzero(&ertm->rtm_ri, sizeof (ertm->rtm_ri));
1635 ertm->rtm_ri.ri_rssi = IFNET_RSSI_UNKNOWN;
1636 ertm->rtm_ri.ri_lqm = IFNET_LQM_THRESH_OFF;
1637 ertm->rtm_ri.ri_npm = IFNET_NPM_THRESH_UNKNOWN;
1638 } else {
1639 rt->rt_llinfo_get_ri(rt, &ertm->rtm_ri);
1640 }
1641 error = SYSCTL_OUT(w->w_req, (caddr_t)ertm, size);
1642 }
1643
1644done:
1645 RT_UNLOCK(rt);
1646 kauth_cred_unref(&cred);
1647 return (error);
1648}
1649
1650/*
1651 * rdar://9307819
1652 * To avoid to call copyout() while holding locks and to cause problems
1653 * in the paging path, sysctl_iflist() and sysctl_iflist2() contstruct
1654 * the list in two passes. In the first pass we compute the total
1655 * length of the data we are going to copyout, then we release
1656 * all locks to allocate a temporary buffer that gets filled
1657 * in the second pass.
1658 *
1659 * Note that we are verifying the assumption that _MALLOC returns a buffer
1660 * that is at least 32 bits aligned and that the messages and addresses are
1661 * 32 bits aligned.
1662 */
1663static int
1664sysctl_iflist(int af, struct walkarg *w)
1665{
1666 struct ifnet *ifp;
1667 struct ifaddr *ifa;
1668 struct rt_addrinfo info;
1669 int len = 0, error = 0;
1670 int pass = 0;
1671 int total_len = 0, current_len = 0;
1672 char *total_buffer = NULL, *cp = NULL;
1673 kauth_cred_t cred;
1674
1675 cred = kauth_cred_proc_ref(current_proc());
1676
1677 bzero((caddr_t)&info, sizeof (info));
1678
1679 for (pass = 0; pass < 2; pass++) {
1680 ifnet_head_lock_shared();
1681
1682 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
1683 if (error)
1684 break;
1685 if (w->w_arg && w->w_arg != ifp->if_index)
1686 continue;
1687 ifnet_lock_shared(ifp);
1688 /*
1689 * Holding ifnet lock here prevents the link address
1690 * from changing contents, so no need to hold the ifa
1691 * lock. The link address is always present; it's
1692 * never freed.
1693 */
1694 ifa = ifp->if_lladdr;
1695 info.rti_info[RTAX_IFP] = ifa->ifa_addr;
1696 len = rt_msg2(RTM_IFINFO, &info, NULL, NULL, &cred);
1697 if (pass == 0) {
1698 total_len += len;
1699 } else {
1700 struct if_msghdr *ifm;
1701
1702 if (current_len + len > total_len) {
1703 ifnet_lock_done(ifp);
1704 error = ENOBUFS;
1705 break;
1706 }
1707 info.rti_info[RTAX_IFP] = ifa->ifa_addr;
1708 len = rt_msg2(RTM_IFINFO, &info,
1709 (caddr_t)cp, NULL, &cred);
1710 info.rti_info[RTAX_IFP] = NULL;
1711
1712 ifm = (struct if_msghdr *)(void *)cp;
1713 ifm->ifm_index = ifp->if_index;
1714 ifm->ifm_flags = (u_short)ifp->if_flags;
1715 if_data_internal_to_if_data(ifp, &ifp->if_data,
1716 &ifm->ifm_data);
1717 ifm->ifm_addrs = info.rti_addrs;
1718 /*
1719 * <rdar://problem/32940901>
1720 * Round bytes only for non-platform
1721 */
1722 if (!csproc_get_platform_binary(w->w_req->p)) {
1723 ALIGN_BYTES(ifm->ifm_data.ifi_ibytes);
1724 ALIGN_BYTES(ifm->ifm_data.ifi_obytes);
1725 }
1726
1727 cp += len;
1728 VERIFY(IS_P2ALIGNED(cp, sizeof (u_int32_t)));
1729 current_len += len;
1730 }
1731 while ((ifa = ifa->ifa_link.tqe_next) != NULL) {
1732 IFA_LOCK(ifa);
1733 if (af && af != ifa->ifa_addr->sa_family) {
1734 IFA_UNLOCK(ifa);
1735 continue;
1736 }
1737 if (ifa->ifa_addr->sa_family == AF_INET6 &&
1738 (((struct in6_ifaddr *)ifa)->ia6_flags &
1739 IN6_IFF_CLAT46) != 0) {
1740 IFA_UNLOCK(ifa);
1741 continue;
1742 }
1743 info.rti_info[RTAX_IFA] = ifa->ifa_addr;
1744 info.rti_info[RTAX_NETMASK] = ifa->ifa_netmask;
1745 info.rti_info[RTAX_BRD] = ifa->ifa_dstaddr;
1746 len = rt_msg2(RTM_NEWADDR, &info, NULL, NULL,
1747 &cred);
1748 if (pass == 0) {
1749 total_len += len;
1750 } else {
1751 struct ifa_msghdr *ifam;
1752
1753 if (current_len + len > total_len) {
1754 IFA_UNLOCK(ifa);
1755 error = ENOBUFS;
1756 break;
1757 }
1758 len = rt_msg2(RTM_NEWADDR, &info,
1759 (caddr_t)cp, NULL, &cred);
1760
1761 ifam = (struct ifa_msghdr *)(void *)cp;
1762 ifam->ifam_index =
1763 ifa->ifa_ifp->if_index;
1764 ifam->ifam_flags = ifa->ifa_flags;
1765 ifam->ifam_metric = ifa->ifa_metric;
1766 ifam->ifam_addrs = info.rti_addrs;
1767
1768 cp += len;
1769 VERIFY(IS_P2ALIGNED(cp,
1770 sizeof (u_int32_t)));
1771 current_len += len;
1772 }
1773 IFA_UNLOCK(ifa);
1774 }
1775 ifnet_lock_done(ifp);
1776 info.rti_info[RTAX_IFA] = info.rti_info[RTAX_NETMASK] =
1777 info.rti_info[RTAX_BRD] = NULL;
1778 }
1779
1780 ifnet_head_done();
1781
1782 if (error != 0) {
1783 if (error == ENOBUFS)
1784 printf("%s: current_len (%d) + len (%d) > "
1785 "total_len (%d)\n", __func__, current_len,
1786 len, total_len);
1787 break;
1788 }
1789
1790 if (pass == 0) {
1791 /* Better to return zero length buffer than ENOBUFS */
1792 if (total_len == 0)
1793 total_len = 1;
1794 total_len += total_len >> 3;
1795 total_buffer = _MALLOC(total_len, M_RTABLE,
1796 M_ZERO | M_WAITOK);
1797 if (total_buffer == NULL) {
1798 printf("%s: _MALLOC(%d) failed\n", __func__,
1799 total_len);
1800 error = ENOBUFS;
1801 break;
1802 }
1803 cp = total_buffer;
1804 VERIFY(IS_P2ALIGNED(cp, sizeof (u_int32_t)));
1805 } else {
1806 error = SYSCTL_OUT(w->w_req, total_buffer, current_len);
1807 if (error)
1808 break;
1809 }
1810 }
1811
1812 if (total_buffer != NULL)
1813 _FREE(total_buffer, M_RTABLE);
1814
1815 kauth_cred_unref(&cred);
1816 return (error);
1817}
1818
1819static int
1820sysctl_iflist2(int af, struct walkarg *w)
1821{
1822 struct ifnet *ifp;
1823 struct ifaddr *ifa;
1824 struct rt_addrinfo info;
1825 int len = 0, error = 0;
1826 int pass = 0;
1827 int total_len = 0, current_len = 0;
1828 char *total_buffer = NULL, *cp = NULL;
1829 kauth_cred_t cred;
1830
1831 cred = kauth_cred_proc_ref(current_proc());
1832
1833 bzero((caddr_t)&info, sizeof (info));
1834
1835 for (pass = 0; pass < 2; pass++) {
1836 struct ifmultiaddr *ifma;
1837
1838 ifnet_head_lock_shared();
1839
1840 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
1841 if (error)
1842 break;
1843 if (w->w_arg && w->w_arg != ifp->if_index)
1844 continue;
1845 ifnet_lock_shared(ifp);
1846 /*
1847 * Holding ifnet lock here prevents the link address
1848 * from changing contents, so no need to hold the ifa
1849 * lock. The link address is always present; it's
1850 * never freed.
1851 */
1852 ifa = ifp->if_lladdr;
1853 info.rti_info[RTAX_IFP] = ifa->ifa_addr;
1854 len = rt_msg2(RTM_IFINFO2, &info, NULL, NULL, &cred);
1855 if (pass == 0) {
1856 total_len += len;
1857 } else {
1858 struct if_msghdr2 *ifm;
1859
1860 if (current_len + len > total_len) {
1861 ifnet_lock_done(ifp);
1862 error = ENOBUFS;
1863 break;
1864 }
1865 info.rti_info[RTAX_IFP] = ifa->ifa_addr;
1866 len = rt_msg2(RTM_IFINFO2, &info,
1867 (caddr_t)cp, NULL, &cred);
1868 info.rti_info[RTAX_IFP] = NULL;
1869
1870 ifm = (struct if_msghdr2 *)(void *)cp;
1871 ifm->ifm_addrs = info.rti_addrs;
1872 ifm->ifm_flags = (u_short)ifp->if_flags;
1873 ifm->ifm_index = ifp->if_index;
1874 ifm->ifm_snd_len = IFCQ_LEN(&ifp->if_snd);
1875 ifm->ifm_snd_maxlen = IFCQ_MAXLEN(&ifp->if_snd);
1876 ifm->ifm_snd_drops =
1877 ifp->if_snd.ifcq_dropcnt.packets;
1878 ifm->ifm_timer = ifp->if_timer;
1879 if_data_internal_to_if_data64(ifp,
1880 &ifp->if_data, &ifm->ifm_data);
1881 /*
1882 * <rdar://problem/32940901>
1883 * Round bytes only for non-platform
1884 */
1885 if (!csproc_get_platform_binary(w->w_req->p)) {
1886 ALIGN_BYTES(ifm->ifm_data.ifi_ibytes);
1887 ALIGN_BYTES(ifm->ifm_data.ifi_obytes);
1888 }
1889
1890 cp += len;
1891 VERIFY(IS_P2ALIGNED(cp, sizeof (u_int32_t)));
1892 current_len += len;
1893 }
1894 while ((ifa = ifa->ifa_link.tqe_next) != NULL) {
1895 IFA_LOCK(ifa);
1896 if (af && af != ifa->ifa_addr->sa_family) {
1897 IFA_UNLOCK(ifa);
1898 continue;
1899 }
1900 if (ifa->ifa_addr->sa_family == AF_INET6 &&
1901 (((struct in6_ifaddr *)ifa)->ia6_flags &
1902 IN6_IFF_CLAT46) != 0) {
1903 IFA_UNLOCK(ifa);
1904 continue;
1905 }
1906
1907 info.rti_info[RTAX_IFA] = ifa->ifa_addr;
1908 info.rti_info[RTAX_NETMASK] = ifa->ifa_netmask;
1909 info.rti_info[RTAX_BRD] = ifa->ifa_dstaddr;
1910 len = rt_msg2(RTM_NEWADDR, &info, NULL, NULL,
1911 &cred);
1912 if (pass == 0) {
1913 total_len += len;
1914 } else {
1915 struct ifa_msghdr *ifam;
1916
1917 if (current_len + len > total_len) {
1918 IFA_UNLOCK(ifa);
1919 error = ENOBUFS;
1920 break;
1921 }
1922 len = rt_msg2(RTM_NEWADDR, &info,
1923 (caddr_t)cp, NULL, &cred);
1924
1925 ifam = (struct ifa_msghdr *)(void *)cp;
1926 ifam->ifam_index =
1927 ifa->ifa_ifp->if_index;
1928 ifam->ifam_flags = ifa->ifa_flags;
1929 ifam->ifam_metric = ifa->ifa_metric;
1930 ifam->ifam_addrs = info.rti_addrs;
1931
1932 cp += len;
1933 VERIFY(IS_P2ALIGNED(cp,
1934 sizeof (u_int32_t)));
1935 current_len += len;
1936 }
1937 IFA_UNLOCK(ifa);
1938 }
1939 if (error) {
1940 ifnet_lock_done(ifp);
1941 break;
1942 }
1943
1944 for (ifma = LIST_FIRST(&ifp->if_multiaddrs);
1945 ifma != NULL; ifma = LIST_NEXT(ifma, ifma_link)) {
1946 struct ifaddr *ifa0;
1947
1948 IFMA_LOCK(ifma);
1949 if (af && af != ifma->ifma_addr->sa_family) {
1950 IFMA_UNLOCK(ifma);
1951 continue;
1952 }
1953 bzero((caddr_t)&info, sizeof (info));
1954 info.rti_info[RTAX_IFA] = ifma->ifma_addr;
1955 /*
1956 * Holding ifnet lock here prevents the link
1957 * address from changing contents, so no need
1958 * to hold the ifa0 lock. The link address is
1959 * always present; it's never freed.
1960 */
1961 ifa0 = ifp->if_lladdr;
1962 info.rti_info[RTAX_IFP] = ifa0->ifa_addr;
1963 if (ifma->ifma_ll != NULL)
1964 info.rti_info[RTAX_GATEWAY] =
1965 ifma->ifma_ll->ifma_addr;
1966 len = rt_msg2(RTM_NEWMADDR2, &info, NULL, NULL,
1967 &cred);
1968 if (pass == 0) {
1969 total_len += len;
1970 } else {
1971 struct ifma_msghdr2 *ifmam;
1972
1973 if (current_len + len > total_len) {
1974 IFMA_UNLOCK(ifma);
1975 error = ENOBUFS;
1976 break;
1977 }
1978 len = rt_msg2(RTM_NEWMADDR2, &info,
1979 (caddr_t)cp, NULL, &cred);
1980
1981 ifmam =
1982 (struct ifma_msghdr2 *)(void *)cp;
1983 ifmam->ifmam_addrs = info.rti_addrs;
1984 ifmam->ifmam_flags = 0;
1985 ifmam->ifmam_index =
1986 ifma->ifma_ifp->if_index;
1987 ifmam->ifmam_refcount =
1988 ifma->ifma_reqcnt;
1989
1990 cp += len;
1991 VERIFY(IS_P2ALIGNED(cp,
1992 sizeof (u_int32_t)));
1993 current_len += len;
1994 }
1995 IFMA_UNLOCK(ifma);
1996 }
1997 ifnet_lock_done(ifp);
1998 info.rti_info[RTAX_IFA] = info.rti_info[RTAX_NETMASK] =
1999 info.rti_info[RTAX_BRD] = NULL;
2000 }
2001 ifnet_head_done();
2002
2003 if (error) {
2004 if (error == ENOBUFS)
2005 printf("%s: current_len (%d) + len (%d) > "
2006 "total_len (%d)\n", __func__, current_len,
2007 len, total_len);
2008 break;
2009 }
2010
2011 if (pass == 0) {
2012 /* Better to return zero length buffer than ENOBUFS */
2013 if (total_len == 0)
2014 total_len = 1;
2015 total_len += total_len >> 3;
2016 total_buffer = _MALLOC(total_len, M_RTABLE,
2017 M_ZERO | M_WAITOK);
2018 if (total_buffer == NULL) {
2019 printf("%s: _MALLOC(%d) failed\n", __func__,
2020 total_len);
2021 error = ENOBUFS;
2022 break;
2023 }
2024 cp = total_buffer;
2025 VERIFY(IS_P2ALIGNED(cp, sizeof (u_int32_t)));
2026 } else {
2027 error = SYSCTL_OUT(w->w_req, total_buffer, current_len);
2028 if (error)
2029 break;
2030 }
2031 }
2032
2033 if (total_buffer != NULL)
2034 _FREE(total_buffer, M_RTABLE);
2035
2036 kauth_cred_unref(&cred);
2037 return (error);
2038}
2039
2040
2041static int
2042sysctl_rtstat(struct sysctl_req *req)
2043{
2044 return (SYSCTL_OUT(req, &rtstat, sizeof (struct rtstat)));
2045}
2046
2047static int
2048sysctl_rttrash(struct sysctl_req *req)
2049{
2050 return (SYSCTL_OUT(req, &rttrash, sizeof (rttrash)));
2051}
2052
2053static int
2054sysctl_rtsock SYSCTL_HANDLER_ARGS
2055{
2056#pragma unused(oidp)
2057 int *name = (int *)arg1;
2058 u_int namelen = arg2;
2059 struct radix_node_head *rnh;
2060 int i, error = EINVAL;
2061 u_char af;
2062 struct walkarg w;
2063
2064 name ++;
2065 namelen--;
2066 if (req->newptr)
2067 return (EPERM);
2068 if (namelen != 3)
2069 return (EINVAL);
2070 af = name[0];
2071 Bzero(&w, sizeof (w));
2072 w.w_op = name[1];
2073 w.w_arg = name[2];
2074 w.w_req = req;
2075
2076 switch (w.w_op) {
2077
2078 case NET_RT_DUMP:
2079 case NET_RT_DUMP2:
2080 case NET_RT_FLAGS:
2081 case NET_RT_FLAGS_PRIV:
2082 lck_mtx_lock(rnh_lock);
2083 for (i = 1; i <= AF_MAX; i++)
2084 if ((rnh = rt_tables[i]) && (af == 0 || af == i) &&
2085 (error = rnh->rnh_walktree(rnh,
2086 sysctl_dumpentry, &w)))
2087 break;
2088 lck_mtx_unlock(rnh_lock);
2089 break;
2090 case NET_RT_DUMPX:
2091 case NET_RT_DUMPX_FLAGS:
2092 lck_mtx_lock(rnh_lock);
2093 for (i = 1; i <= AF_MAX; i++)
2094 if ((rnh = rt_tables[i]) && (af == 0 || af == i) &&
2095 (error = rnh->rnh_walktree(rnh,
2096 sysctl_dumpentry_ext, &w)))
2097 break;
2098 lck_mtx_unlock(rnh_lock);
2099 break;
2100 case NET_RT_IFLIST:
2101 error = sysctl_iflist(af, &w);
2102 break;
2103 case NET_RT_IFLIST2:
2104 error = sysctl_iflist2(af, &w);
2105 break;
2106 case NET_RT_STAT:
2107 error = sysctl_rtstat(req);
2108 break;
2109 case NET_RT_TRASH:
2110 error = sysctl_rttrash(req);
2111 break;
2112 }
2113 if (w.w_tmem != NULL)
2114 FREE(w.w_tmem, M_RTABLE);
2115 return (error);
2116}
2117
2118/*
2119 * Definitions of protocols supported in the ROUTE domain.
2120 */
2121static struct protosw routesw[] = {
2122{
2123 .pr_type = SOCK_RAW,
2124 .pr_protocol = 0,
2125 .pr_flags = PR_ATOMIC|PR_ADDR,
2126 .pr_output = route_output,
2127 .pr_ctlinput = raw_ctlinput,
2128 .pr_init = raw_init,
2129 .pr_usrreqs = &route_usrreqs,
2130}
2131};
2132
2133static int route_proto_count = (sizeof (routesw) / sizeof (struct protosw));
2134
2135struct domain routedomain_s = {
2136 .dom_family = PF_ROUTE,
2137 .dom_name = "route",
2138 .dom_init = route_dinit,
2139};
2140
2141static void
2142route_dinit(struct domain *dp)
2143{
2144 struct protosw *pr;
2145 int i;
2146
2147 VERIFY(!(dp->dom_flags & DOM_INITIALIZED));
2148 VERIFY(routedomain == NULL);
2149
2150 routedomain = dp;
2151
2152 for (i = 0, pr = &routesw[0]; i < route_proto_count; i++, pr++)
2153 net_add_proto(pr, dp, 1);
2154
2155 route_init();
2156}
2157