1 /*
2 * Copyright (c) 2000-2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1988, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)raw_ip.c 8.7 (Berkeley) 5/15/95
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/malloc.h>
73 #include <sys/mbuf.h>
74 #include <sys/mcache.h>
75 #include <sys/proc.h>
76 #include <sys/domain.h>
77 #include <sys/protosw.h>
78 #include <sys/socket.h>
79 #include <sys/socketvar.h>
80 #include <sys/sysctl.h>
81 #include <libkern/OSAtomic.h>
82 #include <kern/zalloc.h>
83
84 #include <pexpert/pexpert.h>
85
86 #include <net/if.h>
87 #include <net/net_api_stats.h>
88 #include <net/route.h>
89 #include <net/content_filter.h>
90
91 #define _IP_VHL
92 #include <netinet/in.h>
93 #include <netinet/in_systm.h>
94 #include <netinet/in_tclass.h>
95 #include <netinet/ip.h>
96 #include <netinet/in_pcb.h>
97 #include <netinet/in_var.h>
98 #include <netinet/ip_var.h>
99
100 #include <netinet6/in6_pcb.h>
101
102
103 #if IPSEC
104 #include <netinet6/ipsec.h>
105 #endif /*IPSEC*/
106
107 #if DUMMYNET
108 #include <netinet/ip_dummynet.h>
109 #endif /* DUMMYNET */
110
111 int rip_detach(struct socket *);
112 int rip_abort(struct socket *);
113 int rip_disconnect(struct socket *);
114 int rip_bind(struct socket *, struct sockaddr *, struct proc *);
115 int rip_connect(struct socket *, struct sockaddr *, struct proc *);
116 int rip_shutdown(struct socket *);
117
118 struct inpcbhead ripcb;
119 struct inpcbinfo ripcbinfo;
120
121 /* control hooks for dummynet */
122 #if DUMMYNET
123 ip_dn_ctl_t *ip_dn_ctl_ptr;
124 #endif /* DUMMYNET */
125
126 /*
127 * Nominal space allocated to a raw ip socket.
128 */
129 #define RIPSNDQ 8192
130 #define RIPRCVQ 8192
131
132 /*
133 * Raw interface to IP protocol.
134 */
135
136 /*
137 * Initialize raw connection block q.
138 */
139 void
rip_init(struct protosw * pp,struct domain * dp)140 rip_init(struct protosw *pp, struct domain *dp)
141 {
142 #pragma unused(dp)
143 static int rip_initialized = 0;
144 struct inpcbinfo *pcbinfo;
145
146 VERIFY((pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
147
148 if (rip_initialized) {
149 return;
150 }
151 rip_initialized = 1;
152
153 LIST_INIT(&ripcb);
154 ripcbinfo.ipi_listhead = &ripcb;
155 /*
156 * XXX We don't use the hash list for raw IP, but it's easier
157 * to allocate a one entry hash list than it is to check all
158 * over the place for ipi_hashbase == NULL.
159 */
160 ripcbinfo.ipi_hashbase = hashinit(1, M_PCB, &ripcbinfo.ipi_hashmask);
161 ripcbinfo.ipi_porthashbase = hashinit(1, M_PCB, &ripcbinfo.ipi_porthashmask);
162
163 ripcbinfo.ipi_zone = zone_create("ripzone", sizeof(struct inpcb),
164 ZC_NONE);
165
166 pcbinfo = &ripcbinfo;
167 /*
168 * allocate lock group attribute and group for udp pcb mutexes
169 */
170 pcbinfo->ipi_lock_grp = lck_grp_alloc_init("ripcb", LCK_GRP_ATTR_NULL);
171
172 /*
173 * allocate the lock attribute for udp pcb mutexes
174 */
175 lck_attr_setdefault(&pcbinfo->ipi_lock_attr);
176 lck_rw_init(&pcbinfo->ipi_lock, pcbinfo->ipi_lock_grp,
177 &pcbinfo->ipi_lock_attr);
178
179 in_pcbinfo_attach(&ripcbinfo);
180 }
181
182 static struct sockaddr_in ripsrc = {
183 .sin_len = sizeof(ripsrc),
184 .sin_family = AF_INET,
185 .sin_port = 0,
186 .sin_addr = { .s_addr = 0 },
187 .sin_zero = {0, 0, 0, 0, 0, 0, 0, 0, }
188 };
189
190 /*
191 * Setup generic address and protocol structures
192 * for raw_input routine, then pass them along with
193 * mbuf chain.
194 */
195 void
rip_input(struct mbuf * m,int iphlen)196 rip_input(struct mbuf *m, int iphlen)
197 {
198 struct ip *ip = mtod(m, struct ip *);
199 struct inpcb *inp;
200 struct inpcb *last = 0;
201 struct mbuf *opts = 0;
202 int skipit = 0, ret = 0;
203 struct ifnet *ifp = m->m_pkthdr.rcvif;
204
205 /* Expect 32-bit aligned data pointer on strict-align platforms */
206 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
207
208 ripsrc.sin_addr = ip->ip_src;
209 lck_rw_lock_shared(&ripcbinfo.ipi_lock);
210 LIST_FOREACH(inp, &ripcb, inp_list) {
211 if ((inp->inp_vflag & INP_IPV4) == 0) {
212 continue;
213 }
214 if (inp->inp_ip_p && (inp->inp_ip_p != ip->ip_p)) {
215 continue;
216 }
217 if (inp->inp_laddr.s_addr &&
218 inp->inp_laddr.s_addr != ip->ip_dst.s_addr) {
219 continue;
220 }
221 if (inp->inp_faddr.s_addr &&
222 inp->inp_faddr.s_addr != ip->ip_src.s_addr) {
223 continue;
224 }
225 if (inp_restricted_recv(inp, ifp)) {
226 continue;
227 }
228 if (last) {
229 struct mbuf *n = m_copy(m, 0, (int)M_COPYALL);
230
231 skipit = 0;
232
233 #if NECP
234 if (n && !necp_socket_is_allowed_to_send_recv_v4(last, 0, 0,
235 &ip->ip_dst, &ip->ip_src, ifp, 0, NULL, NULL, NULL, NULL)) {
236 m_freem(n);
237 /* do not inject data to pcb */
238 skipit = 1;
239 }
240 #endif /* NECP */
241 if (n && skipit == 0) {
242 int error = 0;
243 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
244 SOFLOW_ENABLED(last->inp_socket) ||
245 (last->inp_socket->so_options & SO_TIMESTAMP) != 0 ||
246 (last->inp_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
247 (last->inp_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
248 ret = ip_savecontrol(last, &opts, ip, n);
249 if (ret != 0) {
250 m_freem(n);
251 m_freem(opts);
252 last = inp;
253 continue;
254 }
255 }
256 if (last->inp_flags & INP_STRIPHDR
257 #if CONTENT_FILTER
258 /*
259 * If socket is subject to Content Filter, delay stripping until reinject
260 */
261 && (!CFIL_DGRAM_FILTERED(last->inp_socket))
262 #endif
263 ) {
264 n->m_len -= iphlen;
265 n->m_pkthdr.len -= iphlen;
266 n->m_data += iphlen;
267 }
268 so_recv_data_stat(last->inp_socket, m, 0);
269 if (sbappendaddr(&last->inp_socket->so_rcv,
270 (struct sockaddr *)&ripsrc, n,
271 opts, &error) != 0) {
272 sorwakeup(last->inp_socket);
273 } else {
274 if (error) {
275 /* should notify about lost packet */
276 ipstat.ips_raw_sappend_fail++;
277 }
278 }
279 opts = 0;
280 }
281 }
282 last = inp;
283 }
284
285 skipit = 0;
286 #if NECP
287 if (last && !necp_socket_is_allowed_to_send_recv_v4(last, 0, 0,
288 &ip->ip_dst, &ip->ip_src, ifp, 0, NULL, NULL, NULL, NULL)) {
289 m_freem(m);
290 OSAddAtomic(1, &ipstat.ips_delivered);
291 /* do not inject data to pcb */
292 skipit = 1;
293 }
294 #endif /* NECP */
295 if (skipit == 0) {
296 if (last) {
297 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
298 SOFLOW_ENABLED(last->inp_socket) ||
299 (last->inp_socket->so_options & SO_TIMESTAMP) != 0 ||
300 (last->inp_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
301 (last->inp_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
302 ret = ip_savecontrol(last, &opts, ip, m);
303 if (ret != 0) {
304 m_freem(m);
305 m_freem(opts);
306 goto unlock;
307 }
308 }
309 if (last->inp_flags & INP_STRIPHDR
310 #if CONTENT_FILTER
311 /*
312 * If socket is subject to Content Filter, delay stripping until reinject
313 */
314 && (!CFIL_DGRAM_FILTERED(last->inp_socket))
315 #endif
316 ) {
317 m->m_len -= iphlen;
318 m->m_pkthdr.len -= iphlen;
319 m->m_data += iphlen;
320 }
321 so_recv_data_stat(last->inp_socket, m, 0);
322 if (sbappendaddr(&last->inp_socket->so_rcv,
323 (struct sockaddr *)&ripsrc, m, opts, NULL) != 0) {
324 sorwakeup(last->inp_socket);
325 } else {
326 ipstat.ips_raw_sappend_fail++;
327 }
328 } else {
329 m_freem(m);
330 OSAddAtomic(1, &ipstat.ips_noproto);
331 OSAddAtomic(-1, &ipstat.ips_delivered);
332 }
333 }
334 unlock:
335 /*
336 * Keep the list locked because socket filter may force the socket lock
337 * to be released when calling sbappendaddr() -- see rdar://7627704
338 */
339 lck_rw_done(&ripcbinfo.ipi_lock);
340 }
341
342 /*
343 * Generate IP header and pass packet to ip_output.
344 * Tack on options user may have setup with control call.
345 */
346 int
rip_output(struct mbuf * m,struct socket * so,u_int32_t dst,struct mbuf * control)347 rip_output(
348 struct mbuf *m,
349 struct socket *so,
350 u_int32_t dst,
351 struct mbuf *control)
352 {
353 struct ip *ip;
354 struct inpcb *inp = sotoinpcb(so);
355 int flags = (so->so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
356 int inp_flags = inp ? inp->inp_flags : 0;
357 struct ip_out_args ipoa;
358 struct ip_moptions *imo;
359 int tos = IPTOS_UNSPEC;
360 int error = 0;
361 #if CONTENT_FILTER
362 struct m_tag *cfil_tag = NULL;
363 bool cfil_faddr_use = false;
364 uint32_t cfil_so_state_change_cnt = 0;
365 uint32_t cfil_so_options = 0;
366 int cfil_inp_flags = 0;
367 struct sockaddr *cfil_faddr = NULL;
368 struct sockaddr_in *cfil_sin;
369 #endif
370
371 #if CONTENT_FILTER
372 /*
373 * If socket is subject to Content Filter and no addr is passed in,
374 * retrieve CFIL saved state from mbuf and use it if necessary.
375 */
376 if (CFIL_DGRAM_FILTERED(so) && dst == INADDR_ANY) {
377 cfil_tag = cfil_dgram_get_socket_state(m, &cfil_so_state_change_cnt, &cfil_so_options, &cfil_faddr, &cfil_inp_flags);
378 if (cfil_tag) {
379 cfil_sin = SIN(cfil_faddr);
380 flags = (cfil_so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
381 inp_flags = cfil_inp_flags;
382 if (inp && inp->inp_faddr.s_addr == INADDR_ANY) {
383 /*
384 * Socket is unconnected, simply use the saved faddr as 'addr' to go through
385 * the connect/disconnect logic.
386 */
387 dst = cfil_sin->sin_addr.s_addr;
388 } else if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
389 (inp->inp_fport != cfil_sin->sin_port ||
390 inp->inp_faddr.s_addr != cfil_sin->sin_addr.s_addr)) {
391 /*
392 * Socket is connected but socket state and dest addr/port changed.
393 * We need to use the saved faddr and socket options.
394 */
395 cfil_faddr_use = true;
396 }
397 m_tag_free(cfil_tag);
398 }
399 }
400 #endif
401
402 if (so->so_state & SS_ISCONNECTED) {
403 if (dst != INADDR_ANY) {
404 if (m != NULL) {
405 m_freem(m);
406 }
407 if (control != NULL) {
408 m_freem(control);
409 }
410 return EISCONN;
411 }
412 dst = cfil_faddr_use ? cfil_sin->sin_addr.s_addr : inp->inp_faddr.s_addr;
413 } else {
414 if (dst == INADDR_ANY) {
415 if (m != NULL) {
416 m_freem(m);
417 }
418 if (control != NULL) {
419 m_freem(control);
420 }
421 return ENOTCONN;
422 }
423 }
424
425 bzero(&ipoa, sizeof(ipoa));
426 ipoa.ipoa_boundif = IFSCOPE_NONE;
427 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF;
428
429 int sotc = SO_TC_UNSPEC;
430 int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
431
432
433 if (control != NULL) {
434 tos = so_tos_from_control(control);
435 sotc = so_tc_from_control(control, &netsvctype);
436
437 m_freem(control);
438 control = NULL;
439 }
440 if (sotc == SO_TC_UNSPEC) {
441 sotc = so->so_traffic_class;
442 netsvctype = so->so_netsvctype;
443 }
444
445 if (inp == NULL
446 #if NECP
447 || (necp_socket_should_use_flow_divert(inp))
448 #endif /* NECP */
449 ) {
450 if (m != NULL) {
451 m_freem(m);
452 }
453 VERIFY(control == NULL);
454 return inp == NULL ? EINVAL : EPROTOTYPE;
455 }
456
457 flags |= IP_OUTARGS;
458 /* If socket was bound to an ifindex, tell ip_output about it */
459 if (inp->inp_flags & INP_BOUND_IF) {
460 ipoa.ipoa_boundif = inp->inp_boundifp->if_index;
461 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
462 }
463 if (INP_NO_CELLULAR(inp)) {
464 ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
465 }
466 if (INP_NO_EXPENSIVE(inp)) {
467 ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
468 }
469 if (INP_NO_CONSTRAINED(inp)) {
470 ipoa.ipoa_flags |= IPOAF_NO_CONSTRAINED;
471 }
472 if (INP_AWDL_UNRESTRICTED(inp)) {
473 ipoa.ipoa_flags |= IPOAF_AWDL_UNRESTRICTED;
474 }
475 ipoa.ipoa_sotc = sotc;
476 ipoa.ipoa_netsvctype = netsvctype;
477
478 if (inp->inp_flowhash == 0) {
479 inp->inp_flowhash = inp_calc_flowhash(inp);
480 }
481
482 /*
483 * If the user handed us a complete IP packet, use it.
484 * Otherwise, allocate an mbuf for a header and fill it in.
485 */
486 if ((inp_flags & INP_HDRINCL) == 0) {
487 if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
488 m_freem(m);
489 return EMSGSIZE;
490 }
491 M_PREPEND(m, sizeof(struct ip), M_WAIT, 1);
492 if (m == NULL) {
493 return ENOBUFS;
494 }
495 ip = mtod(m, struct ip *);
496 if (tos != IPTOS_UNSPEC) {
497 ip->ip_tos = (uint8_t)(tos & IPTOS_MASK);
498 } else {
499 ip->ip_tos = inp->inp_ip_tos;
500 }
501 if (inp->inp_flags2 & INP2_DONTFRAG) {
502 ip->ip_off = IP_DF;
503 } else {
504 ip->ip_off = 0;
505 }
506 ip->ip_p = inp->inp_ip_p;
507 ip->ip_len = (uint16_t)m->m_pkthdr.len;
508 ip->ip_src = inp->inp_laddr;
509 ip->ip_dst.s_addr = dst;
510 ip->ip_ttl = inp->inp_ip_ttl;
511 } else {
512 if (m->m_pkthdr.len > IP_MAXPACKET) {
513 m_freem(m);
514 return EMSGSIZE;
515 }
516 ip = mtod(m, struct ip *);
517 /* don't allow both user specified and setsockopt options,
518 * and don't allow packet length sizes that will crash */
519 if (((IP_VHL_HL(ip->ip_vhl) != (sizeof(*ip) >> 2))
520 && inp->inp_options)
521 || (ip->ip_len > m->m_pkthdr.len)
522 || (ip->ip_len < (IP_VHL_HL(ip->ip_vhl) << 2))) {
523 m_freem(m);
524 return EINVAL;
525 }
526 if (ip->ip_id == 0 && !(rfc6864 && IP_OFF_IS_ATOMIC(ntohs(ip->ip_off)))) {
527 ip->ip_id = ip_randomid((uint64_t)m);
528 }
529 /* XXX prevent ip_output from overwriting header fields */
530 flags |= IP_RAWOUTPUT;
531 OSAddAtomic(1, &ipstat.ips_rawout);
532 }
533
534 if (inp->inp_laddr.s_addr != INADDR_ANY) {
535 ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
536 }
537
538 #if NECP
539 {
540 necp_kernel_policy_id policy_id;
541 necp_kernel_policy_id skip_policy_id;
542 u_int32_t route_rule_id;
543 u_int32_t pass_flags;
544
545 /*
546 * We need a route to perform NECP route rule checks
547 */
548 if ((net_qos_policy_restricted != 0 &&
549 ROUTE_UNUSABLE(&inp->inp_route))
550 #if CONTENT_FILTER
551 || cfil_faddr_use
552 #endif
553 ) {
554 struct sockaddr_in to;
555 struct sockaddr_in from;
556 struct in_addr laddr = ip->ip_src;
557
558 ROUTE_RELEASE(&inp->inp_route);
559
560 bzero(&from, sizeof(struct sockaddr_in));
561 from.sin_family = AF_INET;
562 from.sin_len = sizeof(struct sockaddr_in);
563 from.sin_addr = laddr;
564
565 bzero(&to, sizeof(struct sockaddr_in));
566 to.sin_family = AF_INET;
567 to.sin_len = sizeof(struct sockaddr_in);
568 to.sin_addr.s_addr = ip->ip_dst.s_addr;
569
570 if ((error = in_pcbladdr(inp, (struct sockaddr *)&to,
571 &laddr, ipoa.ipoa_boundif, NULL, 1)) != 0) {
572 printf("%s in_pcbladdr(%p) error %d\n",
573 __func__, inp, error);
574 m_freem(m);
575 return error;
576 }
577
578 inp_update_necp_policy(inp, (struct sockaddr *)&from,
579 (struct sockaddr *)&to, ipoa.ipoa_boundif);
580 inp->inp_policyresult.results.qos_marking_gencount = 0;
581 }
582
583 if (!necp_socket_is_allowed_to_send_recv_v4(inp, 0, 0,
584 &ip->ip_src, &ip->ip_dst, NULL, 0, &policy_id, &route_rule_id, &skip_policy_id, &pass_flags)) {
585 m_freem(m);
586 return EHOSTUNREACH;
587 }
588
589 necp_mark_packet_from_socket(m, inp, policy_id, route_rule_id, skip_policy_id, pass_flags);
590
591 if (net_qos_policy_restricted != 0) {
592 struct ifnet *rt_ifp = NULL;
593
594 if (inp->inp_route.ro_rt != NULL) {
595 rt_ifp = inp->inp_route.ro_rt->rt_ifp;
596 }
597
598 necp_socket_update_qos_marking(inp, inp->inp_route.ro_rt, route_rule_id);
599 }
600 }
601 #endif /* NECP */
602 if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
603 ipoa.ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
604 }
605 #if IPSEC
606 if (inp->inp_sp != NULL && ipsec_setsocket(m, so) != 0) {
607 m_freem(m);
608 return ENOBUFS;
609 }
610 #endif /*IPSEC*/
611
612 if (ROUTE_UNUSABLE(&inp->inp_route)) {
613 ROUTE_RELEASE(&inp->inp_route);
614 }
615
616 set_packet_service_class(m, so, sotc, 0);
617 m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
618 m->m_pkthdr.pkt_flowid = inp->inp_flowhash;
619 m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC |
620 PKTF_FLOW_RAWSOCK);
621 m->m_pkthdr.pkt_proto = inp->inp_ip_p;
622 m->m_pkthdr.tx_rawip_pid = so->last_pid;
623 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
624 if (so->so_flags & SOF_DELEGATED) {
625 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
626 } else {
627 m->m_pkthdr.tx_rawip_e_pid = 0;
628 }
629 #if (DEBUG || DEVELOPMENT)
630 if (so->so_flags & SOF_MARK_WAKE_PKT) {
631 so->so_flags &= ~SOF_MARK_WAKE_PKT;
632 m->m_pkthdr.pkt_flags |= PKTF_WAKE_PKT;
633 }
634 #endif /* (DEBUG || DEVELOPMENT) */
635
636 imo = inp->inp_moptions;
637 if (imo != NULL) {
638 IMO_ADDREF(imo);
639 }
640 /*
641 * The domain lock is held across ip_output, so it is okay
642 * to pass the PCB cached route pointer directly to IP and
643 * the modules beneath it.
644 */
645 // TODO: PASS DOWN ROUTE RULE ID
646 error = ip_output(m, inp->inp_options, &inp->inp_route, flags,
647 imo, &ipoa);
648
649 if (imo != NULL) {
650 IMO_REMREF(imo);
651 }
652
653 if (inp->inp_route.ro_rt != NULL) {
654 struct rtentry *rt = inp->inp_route.ro_rt;
655 struct ifnet *outif;
656
657 if ((rt->rt_flags & (RTF_MULTICAST | RTF_BROADCAST)) ||
658 inp->inp_socket == NULL ||
659 #if CONTENT_FILTER
660 /* Discard temporary route for cfil case */
661 cfil_faddr_use ||
662 #endif
663 !(inp->inp_socket->so_state & SS_ISCONNECTED)) {
664 rt = NULL; /* unusable */
665 }
666 /*
667 * Always discard the cached route for unconnected
668 * socket or if it is a multicast route.
669 */
670 if (rt == NULL) {
671 ROUTE_RELEASE(&inp->inp_route);
672 }
673
674 /*
675 * If this is a connected socket and the destination
676 * route is unicast, update outif with that of the
677 * route interface used by IP.
678 */
679 if (rt != NULL &&
680 (outif = rt->rt_ifp) != inp->inp_last_outifp) {
681 inp->inp_last_outifp = outif;
682 }
683 } else {
684 ROUTE_RELEASE(&inp->inp_route);
685 }
686
687 /*
688 * If output interface was cellular/expensive/constrained, and this socket is
689 * denied access to it, generate an event.
690 */
691 if (error != 0 && (ipoa.ipoa_flags & IPOAF_R_IFDENIED) &&
692 (INP_NO_CELLULAR(inp) || INP_NO_EXPENSIVE(inp) || INP_NO_CONSTRAINED(inp))) {
693 soevent(so, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
694 }
695
696 return error;
697 }
698
699
700 /*
701 * Raw IP socket option processing.
702 */
703 int
rip_ctloutput(struct socket * so,struct sockopt * sopt)704 rip_ctloutput(struct socket *so, struct sockopt *sopt)
705 {
706 struct inpcb *inp = sotoinpcb(so);
707 int error, optval;
708
709 /* Allow <SOL_SOCKET,SO_FLUSH> at this level */
710 if (sopt->sopt_level != IPPROTO_IP &&
711 !(sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_FLUSH)) {
712 return EINVAL;
713 }
714
715 error = 0;
716
717 switch (sopt->sopt_dir) {
718 case SOPT_GET:
719 switch (sopt->sopt_name) {
720 case IP_HDRINCL:
721 optval = inp->inp_flags & INP_HDRINCL;
722 error = sooptcopyout(sopt, &optval, sizeof optval);
723 break;
724
725 case IP_STRIPHDR:
726 optval = inp->inp_flags & INP_STRIPHDR;
727 error = sooptcopyout(sopt, &optval, sizeof optval);
728 break;
729
730
731 #if DUMMYNET
732 case IP_DUMMYNET_GET:
733 if (!DUMMYNET_LOADED) {
734 ip_dn_init();
735 }
736 if (DUMMYNET_LOADED) {
737 error = ip_dn_ctl_ptr(sopt);
738 } else {
739 error = ENOPROTOOPT;
740 }
741 break;
742 #endif /* DUMMYNET */
743
744 default:
745 error = ip_ctloutput(so, sopt);
746 break;
747 }
748 break;
749
750 case SOPT_SET:
751 switch (sopt->sopt_name) {
752 case IP_HDRINCL:
753 error = sooptcopyin(sopt, &optval, sizeof optval,
754 sizeof optval);
755 if (error) {
756 break;
757 }
758 if (optval) {
759 inp->inp_flags |= INP_HDRINCL;
760 } else {
761 inp->inp_flags &= ~INP_HDRINCL;
762 }
763 break;
764
765 case IP_STRIPHDR:
766 error = sooptcopyin(sopt, &optval, sizeof optval,
767 sizeof optval);
768 if (error) {
769 break;
770 }
771 if (optval) {
772 inp->inp_flags |= INP_STRIPHDR;
773 } else {
774 inp->inp_flags &= ~INP_STRIPHDR;
775 }
776 break;
777
778
779 #if DUMMYNET
780 case IP_DUMMYNET_CONFIGURE:
781 case IP_DUMMYNET_DEL:
782 case IP_DUMMYNET_FLUSH:
783 if (!DUMMYNET_LOADED) {
784 ip_dn_init();
785 }
786 if (DUMMYNET_LOADED) {
787 error = ip_dn_ctl_ptr(sopt);
788 } else {
789 error = ENOPROTOOPT;
790 }
791 break;
792 #endif /* DUMMYNET */
793
794 case SO_FLUSH:
795 if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
796 sizeof(optval))) != 0) {
797 break;
798 }
799
800 error = inp_flush(inp, optval);
801 break;
802
803 default:
804 error = ip_ctloutput(so, sopt);
805 break;
806 }
807 break;
808 }
809
810 return error;
811 }
812
813 /*
814 * This function exists solely to receive the PRC_IFDOWN messages which
815 * are sent by if_down(). It looks for an ifaddr whose ifa_addr is sa,
816 * and calls in_ifadown() to remove all routes corresponding to that address.
817 * It also receives the PRC_IFUP messages from if_up() and reinstalls the
818 * interface routes.
819 */
820 void
rip_ctlinput(int cmd,struct sockaddr * sa,__unused void * vip,__unused struct ifnet * ifp)821 rip_ctlinput(
822 int cmd,
823 struct sockaddr *sa,
824 __unused void *vip,
825 __unused struct ifnet *ifp)
826 {
827 struct in_ifaddr *ia = NULL;
828 struct ifnet *iaifp = NULL;
829 int err = 0;
830 int flags, done = 0;
831
832 switch (cmd) {
833 case PRC_IFDOWN:
834 lck_rw_lock_shared(&in_ifaddr_rwlock);
835 for (ia = in_ifaddrhead.tqh_first; ia;
836 ia = ia->ia_link.tqe_next) {
837 IFA_LOCK(&ia->ia_ifa);
838 if (ia->ia_ifa.ifa_addr == sa &&
839 (ia->ia_flags & IFA_ROUTE)) {
840 done = 1;
841 IFA_ADDREF_LOCKED(&ia->ia_ifa);
842 IFA_UNLOCK(&ia->ia_ifa);
843 lck_rw_done(&in_ifaddr_rwlock);
844 lck_mtx_lock(rnh_lock);
845 /*
846 * in_ifscrub kills the interface route.
847 */
848 in_ifscrub(ia->ia_ifp, ia, 1);
849 /*
850 * in_ifadown gets rid of all the rest of
851 * the routes. This is not quite the right
852 * thing to do, but at least if we are running
853 * a routing process they will come back.
854 */
855 in_ifadown(&ia->ia_ifa, 1);
856 lck_mtx_unlock(rnh_lock);
857 IFA_REMREF(&ia->ia_ifa);
858 break;
859 }
860 IFA_UNLOCK(&ia->ia_ifa);
861 }
862 if (!done) {
863 lck_rw_done(&in_ifaddr_rwlock);
864 }
865 break;
866
867 case PRC_IFUP:
868 lck_rw_lock_shared(&in_ifaddr_rwlock);
869 for (ia = in_ifaddrhead.tqh_first; ia;
870 ia = ia->ia_link.tqe_next) {
871 IFA_LOCK(&ia->ia_ifa);
872 if (ia->ia_ifa.ifa_addr == sa) {
873 /* keep it locked */
874 break;
875 }
876 IFA_UNLOCK(&ia->ia_ifa);
877 }
878 if (ia == NULL || (ia->ia_flags & IFA_ROUTE) ||
879 (ia->ia_ifa.ifa_debug & IFD_NOTREADY)) {
880 if (ia != NULL) {
881 IFA_UNLOCK(&ia->ia_ifa);
882 }
883 lck_rw_done(&in_ifaddr_rwlock);
884 return;
885 }
886 IFA_ADDREF_LOCKED(&ia->ia_ifa);
887 IFA_UNLOCK(&ia->ia_ifa);
888 lck_rw_done(&in_ifaddr_rwlock);
889
890 flags = RTF_UP;
891 iaifp = ia->ia_ifa.ifa_ifp;
892
893 if ((iaifp->if_flags & IFF_LOOPBACK)
894 || (iaifp->if_flags & IFF_POINTOPOINT)) {
895 flags |= RTF_HOST;
896 }
897
898 err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
899 if (err == 0) {
900 IFA_LOCK_SPIN(&ia->ia_ifa);
901 ia->ia_flags |= IFA_ROUTE;
902 IFA_UNLOCK(&ia->ia_ifa);
903 }
904 IFA_REMREF(&ia->ia_ifa);
905 break;
906 }
907 }
908
909 u_int32_t rip_sendspace = RIPSNDQ;
910 u_int32_t rip_recvspace = RIPRCVQ;
911
912 SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW | CTLFLAG_LOCKED,
913 &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
914 SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW | CTLFLAG_LOCKED,
915 &rip_recvspace, 0, "Maximum incoming raw IP datagram size");
916 SYSCTL_UINT(_net_inet_raw, OID_AUTO, pcbcount, CTLFLAG_RD | CTLFLAG_LOCKED,
917 &ripcbinfo.ipi_count, 0, "Number of active PCBs");
918
919 static int
rip_attach(struct socket * so,int proto,struct proc * p)920 rip_attach(struct socket *so, int proto, struct proc *p)
921 {
922 struct inpcb *inp;
923 int error;
924
925 inp = sotoinpcb(so);
926 if (inp) {
927 panic("rip_attach");
928 }
929 if ((so->so_state & SS_PRIV) == 0) {
930 return EPERM;
931 }
932 if (proto > UINT8_MAX) {
933 return EINVAL;
934 }
935
936 error = soreserve(so, rip_sendspace, rip_recvspace);
937 if (error) {
938 return error;
939 }
940 error = in_pcballoc(so, &ripcbinfo, p);
941 if (error) {
942 return error;
943 }
944 inp = (struct inpcb *)so->so_pcb;
945 inp->inp_vflag |= INP_IPV4;
946 VERIFY(proto <= UINT8_MAX);
947 inp->inp_ip_p = (u_char)proto;
948 inp->inp_ip_ttl = (u_char)ip_defttl;
949 return 0;
950 }
951
952 __private_extern__ int
rip_detach(struct socket * so)953 rip_detach(struct socket *so)
954 {
955 struct inpcb *inp;
956
957 inp = sotoinpcb(so);
958 if (inp == 0) {
959 panic("rip_detach");
960 }
961 in_pcbdetach(inp);
962 return 0;
963 }
964
965 __private_extern__ int
rip_abort(struct socket * so)966 rip_abort(struct socket *so)
967 {
968 soisdisconnected(so);
969 return rip_detach(so);
970 }
971
972 __private_extern__ int
rip_disconnect(struct socket * so)973 rip_disconnect(struct socket *so)
974 {
975 if ((so->so_state & SS_ISCONNECTED) == 0) {
976 return ENOTCONN;
977 }
978 return rip_abort(so);
979 }
980
981 __private_extern__ int
rip_bind(struct socket * so,struct sockaddr * nam,struct proc * p)982 rip_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
983 {
984 #pragma unused(p)
985 struct inpcb *inp = sotoinpcb(so);
986 struct sockaddr_in sin;
987 struct ifaddr *ifa = NULL;
988 struct ifnet *outif = NULL;
989
990 if (inp == NULL
991 #if NECP
992 || (necp_socket_should_use_flow_divert(inp))
993 #endif /* NECP */
994 ) {
995 return inp == NULL ? EINVAL : EPROTOTYPE;
996 }
997
998 if (nam->sa_len != sizeof(struct sockaddr_in)) {
999 return EINVAL;
1000 }
1001
1002 /* Sanitized local copy for interface address searches */
1003 bzero(&sin, sizeof(sin));
1004 sin.sin_family = AF_INET;
1005 sin.sin_len = sizeof(struct sockaddr_in);
1006 sin.sin_addr.s_addr = SIN(nam)->sin_addr.s_addr;
1007
1008 if (TAILQ_EMPTY(&ifnet_head) ||
1009 (sin.sin_family != AF_INET && sin.sin_family != AF_IMPLINK) ||
1010 (sin.sin_addr.s_addr && (ifa = ifa_ifwithaddr(SA(&sin))) == 0)) {
1011 return EADDRNOTAVAIL;
1012 } else if (ifa) {
1013 /*
1014 * Opportunistically determine the outbound
1015 * interface that may be used; this may not
1016 * hold true if we end up using a route
1017 * going over a different interface, e.g.
1018 * when sending to a local address. This
1019 * will get updated again after sending.
1020 */
1021 IFA_LOCK(ifa);
1022 outif = ifa->ifa_ifp;
1023 IFA_UNLOCK(ifa);
1024 IFA_REMREF(ifa);
1025 }
1026 inp->inp_laddr = sin.sin_addr;
1027 inp->inp_last_outifp = outif;
1028
1029 return 0;
1030 }
1031
1032 __private_extern__ int
rip_connect(struct socket * so,struct sockaddr * nam,__unused struct proc * p)1033 rip_connect(struct socket *so, struct sockaddr *nam, __unused struct proc *p)
1034 {
1035 struct inpcb *inp = sotoinpcb(so);
1036 struct sockaddr_in *addr = (struct sockaddr_in *)(void *)nam;
1037
1038 if (inp == NULL
1039 #if NECP
1040 || (necp_socket_should_use_flow_divert(inp))
1041 #endif /* NECP */
1042 ) {
1043 return inp == NULL ? EINVAL : EPROTOTYPE;
1044 }
1045 if (nam->sa_len != sizeof(*addr)) {
1046 return EINVAL;
1047 }
1048 if (TAILQ_EMPTY(&ifnet_head)) {
1049 return EADDRNOTAVAIL;
1050 }
1051 if ((addr->sin_family != AF_INET) &&
1052 (addr->sin_family != AF_IMPLINK)) {
1053 return EAFNOSUPPORT;
1054 }
1055
1056 if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
1057 so->so_flags1 |= SOF1_CONNECT_COUNTED;
1058 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
1059 }
1060
1061 inp->inp_faddr = addr->sin_addr;
1062 soisconnected(so);
1063
1064 return 0;
1065 }
1066
1067 __private_extern__ int
rip_shutdown(struct socket * so)1068 rip_shutdown(struct socket *so)
1069 {
1070 socantsendmore(so);
1071 return 0;
1072 }
1073
1074 __private_extern__ int
rip_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct proc * p)1075 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
1076 struct mbuf *control, struct proc *p)
1077 {
1078 #pragma unused(flags, p)
1079 struct inpcb *inp = sotoinpcb(so);
1080 u_int32_t dst = INADDR_ANY;
1081 int error = 0;
1082
1083 if (inp == NULL
1084 #if NECP
1085 || (necp_socket_should_use_flow_divert(inp) && (error = EPROTOTYPE))
1086 #endif /* NECP */
1087 ) {
1088 if (inp == NULL) {
1089 error = EINVAL;
1090 } else {
1091 error = EPROTOTYPE;
1092 }
1093 goto bad;
1094 }
1095
1096 if (nam != NULL) {
1097 dst = ((struct sockaddr_in *)(void *)nam)->sin_addr.s_addr;
1098 }
1099 return rip_output(m, so, dst, control);
1100
1101 bad:
1102 VERIFY(error != 0);
1103
1104 if (m != NULL) {
1105 m_freem(m);
1106 }
1107 if (control != NULL) {
1108 m_freem(control);
1109 }
1110
1111 return error;
1112 }
1113
1114 /* note: rip_unlock is called from different protos instead of the generic socket_unlock,
1115 * it will handle the socket dealloc on last reference
1116 * */
1117 int
rip_unlock(struct socket * so,int refcount,void * debug)1118 rip_unlock(struct socket *so, int refcount, void *debug)
1119 {
1120 void *lr_saved;
1121 struct inpcb *inp = sotoinpcb(so);
1122
1123 if (debug == NULL) {
1124 lr_saved = __builtin_return_address(0);
1125 } else {
1126 lr_saved = debug;
1127 }
1128
1129 if (refcount) {
1130 if (so->so_usecount <= 0) {
1131 panic("rip_unlock: bad refoucnt so=%p val=%x lrh= %s",
1132 so, so->so_usecount, solockhistory_nr(so));
1133 /* NOTREACHED */
1134 }
1135 so->so_usecount--;
1136 if (so->so_usecount == 0 && (inp->inp_wantcnt == WNT_STOPUSING)) {
1137 /* cleanup after last reference */
1138 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1139 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1140 if (inp->inp_state != INPCB_STATE_DEAD) {
1141 if (SOCK_CHECK_DOM(so, PF_INET6)) {
1142 in6_pcbdetach(inp);
1143 } else {
1144 in_pcbdetach(inp);
1145 }
1146 }
1147 in_pcbdispose(inp);
1148 lck_rw_done(&ripcbinfo.ipi_lock);
1149 return 0;
1150 }
1151 }
1152 so->unlock_lr[so->next_unlock_lr] = lr_saved;
1153 so->next_unlock_lr = (so->next_unlock_lr + 1) % SO_LCKDBG_MAX;
1154 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1155 return 0;
1156 }
1157
1158 static int
1159 rip_pcblist SYSCTL_HANDLER_ARGS
1160 {
1161 #pragma unused(oidp, arg1, arg2)
1162 int error, i, n;
1163 struct inpcb *inp, **inp_list;
1164 inp_gen_t gencnt;
1165 struct xinpgen xig;
1166
1167 /*
1168 * The process of preparing the TCB list is too time-consuming and
1169 * resource-intensive to repeat twice on every request.
1170 */
1171 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1172 if (req->oldptr == USER_ADDR_NULL) {
1173 n = ripcbinfo.ipi_count;
1174 req->oldidx = 2 * (sizeof xig)
1175 + (n + n / 8) * sizeof(struct xinpcb);
1176 lck_rw_done(&ripcbinfo.ipi_lock);
1177 return 0;
1178 }
1179
1180 if (req->newptr != USER_ADDR_NULL) {
1181 lck_rw_done(&ripcbinfo.ipi_lock);
1182 return EPERM;
1183 }
1184
1185 /*
1186 * OK, now we're committed to doing something.
1187 */
1188 gencnt = ripcbinfo.ipi_gencnt;
1189 n = ripcbinfo.ipi_count;
1190
1191 bzero(&xig, sizeof(xig));
1192 xig.xig_len = sizeof xig;
1193 xig.xig_count = n;
1194 xig.xig_gen = gencnt;
1195 xig.xig_sogen = so_gencnt;
1196 error = SYSCTL_OUT(req, &xig, sizeof xig);
1197 if (error) {
1198 lck_rw_done(&ripcbinfo.ipi_lock);
1199 return error;
1200 }
1201 /*
1202 * We are done if there is no pcb
1203 */
1204 if (n == 0) {
1205 lck_rw_done(&ripcbinfo.ipi_lock);
1206 return 0;
1207 }
1208
1209 inp_list = _MALLOC(n * sizeof *inp_list, M_TEMP, M_WAITOK);
1210 if (inp_list == 0) {
1211 lck_rw_done(&ripcbinfo.ipi_lock);
1212 return ENOMEM;
1213 }
1214
1215 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1216 inp = inp->inp_list.le_next) {
1217 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1218 inp_list[i++] = inp;
1219 }
1220 }
1221 n = i;
1222
1223 error = 0;
1224 for (i = 0; i < n; i++) {
1225 inp = inp_list[i];
1226 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1227 struct xinpcb xi;
1228
1229 bzero(&xi, sizeof(xi));
1230 xi.xi_len = sizeof xi;
1231 /* XXX should avoid extra copy */
1232 inpcb_to_compat(inp, &xi.xi_inp);
1233 if (inp->inp_socket) {
1234 sotoxsocket(inp->inp_socket, &xi.xi_socket);
1235 }
1236 error = SYSCTL_OUT(req, &xi, sizeof xi);
1237 }
1238 }
1239 if (!error) {
1240 /*
1241 * Give the user an updated idea of our state.
1242 * If the generation differs from what we told
1243 * her before, she knows that something happened
1244 * while we were processing this request, and it
1245 * might be necessary to retry.
1246 */
1247 bzero(&xig, sizeof(xig));
1248 xig.xig_len = sizeof xig;
1249 xig.xig_gen = ripcbinfo.ipi_gencnt;
1250 xig.xig_sogen = so_gencnt;
1251 xig.xig_count = ripcbinfo.ipi_count;
1252 error = SYSCTL_OUT(req, &xig, sizeof xig);
1253 }
1254 FREE(inp_list, M_TEMP);
1255 lck_rw_done(&ripcbinfo.ipi_lock);
1256 return error;
1257 }
1258
1259 SYSCTL_PROC(_net_inet_raw, OID_AUTO /*XXX*/, pcblist,
1260 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1261 rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
1262
1263 #if XNU_TARGET_OS_OSX
1264
1265 static int
1266 rip_pcblist64 SYSCTL_HANDLER_ARGS
1267 {
1268 #pragma unused(oidp, arg1, arg2)
1269 int error, i, n;
1270 struct inpcb *inp, **inp_list;
1271 inp_gen_t gencnt;
1272 struct xinpgen xig;
1273
1274 /*
1275 * The process of preparing the TCB list is too time-consuming and
1276 * resource-intensive to repeat twice on every request.
1277 */
1278 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1279 if (req->oldptr == USER_ADDR_NULL) {
1280 n = ripcbinfo.ipi_count;
1281 req->oldidx = 2 * (sizeof xig)
1282 + (n + n / 8) * sizeof(struct xinpcb64);
1283 lck_rw_done(&ripcbinfo.ipi_lock);
1284 return 0;
1285 }
1286
1287 if (req->newptr != USER_ADDR_NULL) {
1288 lck_rw_done(&ripcbinfo.ipi_lock);
1289 return EPERM;
1290 }
1291
1292 /*
1293 * OK, now we're committed to doing something.
1294 */
1295 gencnt = ripcbinfo.ipi_gencnt;
1296 n = ripcbinfo.ipi_count;
1297
1298 bzero(&xig, sizeof(xig));
1299 xig.xig_len = sizeof xig;
1300 xig.xig_count = n;
1301 xig.xig_gen = gencnt;
1302 xig.xig_sogen = so_gencnt;
1303 error = SYSCTL_OUT(req, &xig, sizeof xig);
1304 if (error) {
1305 lck_rw_done(&ripcbinfo.ipi_lock);
1306 return error;
1307 }
1308 /*
1309 * We are done if there is no pcb
1310 */
1311 if (n == 0) {
1312 lck_rw_done(&ripcbinfo.ipi_lock);
1313 return 0;
1314 }
1315
1316 inp_list = _MALLOC(n * sizeof *inp_list, M_TEMP, M_WAITOK);
1317 if (inp_list == 0) {
1318 lck_rw_done(&ripcbinfo.ipi_lock);
1319 return ENOMEM;
1320 }
1321
1322 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1323 inp = inp->inp_list.le_next) {
1324 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1325 inp_list[i++] = inp;
1326 }
1327 }
1328 n = i;
1329
1330 error = 0;
1331 for (i = 0; i < n; i++) {
1332 inp = inp_list[i];
1333 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1334 struct xinpcb64 xi;
1335
1336 bzero(&xi, sizeof(xi));
1337 xi.xi_len = sizeof xi;
1338 inpcb_to_xinpcb64(inp, &xi);
1339 if (inp->inp_socket) {
1340 sotoxsocket64(inp->inp_socket, &xi.xi_socket);
1341 }
1342 error = SYSCTL_OUT(req, &xi, sizeof xi);
1343 }
1344 }
1345 if (!error) {
1346 /*
1347 * Give the user an updated idea of our state.
1348 * If the generation differs from what we told
1349 * her before, she knows that something happened
1350 * while we were processing this request, and it
1351 * might be necessary to retry.
1352 */
1353 bzero(&xig, sizeof(xig));
1354 xig.xig_len = sizeof xig;
1355 xig.xig_gen = ripcbinfo.ipi_gencnt;
1356 xig.xig_sogen = so_gencnt;
1357 xig.xig_count = ripcbinfo.ipi_count;
1358 error = SYSCTL_OUT(req, &xig, sizeof xig);
1359 }
1360 FREE(inp_list, M_TEMP);
1361 lck_rw_done(&ripcbinfo.ipi_lock);
1362 return error;
1363 }
1364
1365 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist64,
1366 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1367 rip_pcblist64, "S,xinpcb64", "List of active raw IP sockets");
1368
1369 #endif /* XNU_TARGET_OS_OSX */
1370
1371
1372 static int
1373 rip_pcblist_n SYSCTL_HANDLER_ARGS
1374 {
1375 #pragma unused(oidp, arg1, arg2)
1376 int error = 0;
1377
1378 error = get_pcblist_n(IPPROTO_IP, req, &ripcbinfo);
1379
1380 return error;
1381 }
1382
1383 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist_n,
1384 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1385 rip_pcblist_n, "S,xinpcb_n", "List of active raw IP sockets");
1386
1387 struct pr_usrreqs rip_usrreqs = {
1388 .pru_abort = rip_abort,
1389 .pru_attach = rip_attach,
1390 .pru_bind = rip_bind,
1391 .pru_connect = rip_connect,
1392 .pru_control = in_control,
1393 .pru_detach = rip_detach,
1394 .pru_disconnect = rip_disconnect,
1395 .pru_peeraddr = in_getpeeraddr,
1396 .pru_send = rip_send,
1397 .pru_shutdown = rip_shutdown,
1398 .pru_sockaddr = in_getsockaddr,
1399 .pru_sosend = sosend,
1400 .pru_soreceive = soreceive,
1401 };
1402 /* DSEP Review Done pl-20051213-v02 @3253 */
1403