1 /*
2 * Copyright (c) 2000-2022 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1988, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)raw_ip.c 8.7 (Berkeley) 5/15/95
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/malloc.h>
73 #include <sys/mbuf.h>
74 #include <sys/mcache.h>
75 #include <sys/proc.h>
76 #include <sys/domain.h>
77 #include <sys/protosw.h>
78 #include <sys/socket.h>
79 #include <sys/socketvar.h>
80 #include <sys/sysctl.h>
81 #include <libkern/OSAtomic.h>
82 #include <kern/zalloc.h>
83
84 #include <pexpert/pexpert.h>
85
86 #include <net/if.h>
87 #include <net/net_api_stats.h>
88 #include <net/route.h>
89 #include <net/content_filter.h>
90
91 #define _IP_VHL
92 #include <netinet/in.h>
93 #include <netinet/in_systm.h>
94 #include <netinet/in_tclass.h>
95 #include <netinet/ip.h>
96 #include <netinet/in_pcb.h>
97 #include <netinet/in_var.h>
98 #include <netinet/ip_var.h>
99
100 #include <netinet6/in6_pcb.h>
101
102
103 #if IPSEC
104 #include <netinet6/ipsec.h>
105 #endif /*IPSEC*/
106
107 #if DUMMYNET
108 #include <netinet/ip_dummynet.h>
109 #endif /* DUMMYNET */
110
111 int rip_detach(struct socket *);
112 int rip_abort(struct socket *);
113 int rip_disconnect(struct socket *);
114 int rip_bind(struct socket *, struct sockaddr *, struct proc *);
115 int rip_connect(struct socket *, struct sockaddr *, struct proc *);
116 int rip_shutdown(struct socket *);
117
118 struct inpcbhead ripcb;
119 struct inpcbinfo ripcbinfo;
120
121 /* control hooks for dummynet */
122 #if DUMMYNET
123 ip_dn_ctl_t *ip_dn_ctl_ptr;
124 #endif /* DUMMYNET */
125
126 /*
127 * Nominal space allocated to a raw ip socket.
128 */
129 #define RIPSNDQ 8192
130 #define RIPRCVQ 8192
131
132 static KALLOC_TYPE_DEFINE(ripzone, struct inpcb, NET_KT_DEFAULT);
133
134 /*
135 * Raw interface to IP protocol.
136 */
137
138 /*
139 * Initialize raw connection block q.
140 */
141 void
rip_init(struct protosw * pp,struct domain * dp)142 rip_init(struct protosw *pp, struct domain *dp)
143 {
144 #pragma unused(dp)
145 static int rip_initialized = 0;
146 struct inpcbinfo *pcbinfo;
147
148 VERIFY((pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
149
150 if (rip_initialized) {
151 return;
152 }
153 rip_initialized = 1;
154
155 LIST_INIT(&ripcb);
156 ripcbinfo.ipi_listhead = &ripcb;
157 /*
158 * XXX We don't use the hash list for raw IP, but it's easier
159 * to allocate a one entry hash list than it is to check all
160 * over the place for ipi_hashbase == NULL.
161 */
162 ripcbinfo.ipi_hashbase = hashinit(1, M_PCB, &ripcbinfo.ipi_hashmask);
163 ripcbinfo.ipi_porthashbase = hashinit(1, M_PCB, &ripcbinfo.ipi_porthashmask);
164
165 ripcbinfo.ipi_zone = ripzone;
166
167 pcbinfo = &ripcbinfo;
168 /*
169 * allocate lock group attribute and group for udp pcb mutexes
170 */
171 pcbinfo->ipi_lock_grp = lck_grp_alloc_init("ripcb", LCK_GRP_ATTR_NULL);
172
173 /*
174 * allocate the lock attribute for udp pcb mutexes
175 */
176 lck_attr_setdefault(&pcbinfo->ipi_lock_attr);
177 lck_rw_init(&pcbinfo->ipi_lock, pcbinfo->ipi_lock_grp,
178 &pcbinfo->ipi_lock_attr);
179
180 in_pcbinfo_attach(&ripcbinfo);
181 }
182
183 static struct sockaddr_in ripsrc = {
184 .sin_len = sizeof(ripsrc),
185 .sin_family = AF_INET,
186 .sin_port = 0,
187 .sin_addr = { .s_addr = 0 },
188 .sin_zero = {0, 0, 0, 0, 0, 0, 0, 0, }
189 };
190
191 /*
192 * Setup generic address and protocol structures
193 * for raw_input routine, then pass them along with
194 * mbuf chain.
195 */
196 void
rip_input(struct mbuf * m,int iphlen)197 rip_input(struct mbuf *m, int iphlen)
198 {
199 struct ip *ip = mtod(m, struct ip *);
200 struct inpcb *inp;
201 struct inpcb *last = 0;
202 struct mbuf *opts = 0;
203 int skipit = 0, ret = 0;
204 struct ifnet *ifp = m->m_pkthdr.rcvif;
205 boolean_t is_wake_pkt = false;
206
207 /* Expect 32-bit aligned data pointer on strict-align platforms */
208 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
209
210 if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.pkt_flags & PKTF_WAKE_PKT)) {
211 is_wake_pkt = true;
212 }
213
214 ripsrc.sin_addr = ip->ip_src;
215 lck_rw_lock_shared(&ripcbinfo.ipi_lock);
216 LIST_FOREACH(inp, &ripcb, inp_list) {
217 if ((inp->inp_vflag & INP_IPV4) == 0) {
218 continue;
219 }
220 if (inp->inp_ip_p && (inp->inp_ip_p != ip->ip_p)) {
221 continue;
222 }
223 if (inp->inp_laddr.s_addr &&
224 inp->inp_laddr.s_addr != ip->ip_dst.s_addr) {
225 continue;
226 }
227 if (inp->inp_faddr.s_addr &&
228 inp->inp_faddr.s_addr != ip->ip_src.s_addr) {
229 continue;
230 }
231 if (inp_restricted_recv(inp, ifp)) {
232 continue;
233 }
234 if (last) {
235 struct mbuf *n = m_copy(m, 0, (int)M_COPYALL);
236
237 skipit = 0;
238
239 #if NECP
240 if (n && !necp_socket_is_allowed_to_send_recv_v4(last, 0, 0,
241 &ip->ip_dst, &ip->ip_src, ifp, 0, NULL, NULL, NULL, NULL)) {
242 m_freem(n);
243 /* do not inject data to pcb */
244 skipit = 1;
245 }
246 #endif /* NECP */
247 if (n && skipit == 0) {
248 int error = 0;
249 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
250 SOFLOW_ENABLED(last->inp_socket) ||
251 SO_RECV_CONTROL_OPTS(last->inp_socket)) {
252 ret = ip_savecontrol(last, &opts, ip, n);
253 if (ret != 0) {
254 m_freem(n);
255 m_freem(opts);
256 last = inp;
257 continue;
258 }
259 }
260 if (last->inp_flags & INP_STRIPHDR
261 #if CONTENT_FILTER
262 /*
263 * If socket is subject to Content Filter, delay stripping until reinject
264 */
265 && (!CFIL_DGRAM_FILTERED(last->inp_socket))
266 #endif
267 ) {
268 n->m_len -= iphlen;
269 n->m_pkthdr.len -= iphlen;
270 n->m_data += iphlen;
271 }
272 so_recv_data_stat(last->inp_socket, m, 0);
273 if (sbappendaddr(&last->inp_socket->so_rcv,
274 (struct sockaddr *)&ripsrc, n,
275 opts, &error) != 0) {
276 sorwakeup(last->inp_socket);
277 } else {
278 if (error) {
279 /* should notify about lost packet */
280 ipstat.ips_raw_sappend_fail++;
281 }
282 }
283 if (is_wake_pkt) {
284 soevent(last->in6p_socket,
285 SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
286 }
287 opts = 0;
288 }
289 }
290 last = inp;
291 }
292
293 skipit = 0;
294 #if NECP
295 if (last && !necp_socket_is_allowed_to_send_recv_v4(last, 0, 0,
296 &ip->ip_dst, &ip->ip_src, ifp, 0, NULL, NULL, NULL, NULL)) {
297 m_freem(m);
298 OSAddAtomic(1, &ipstat.ips_delivered);
299 /* do not inject data to pcb */
300 skipit = 1;
301 }
302 #endif /* NECP */
303 if (skipit == 0) {
304 if (last) {
305 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
306 SOFLOW_ENABLED(last->inp_socket) ||
307 SO_RECV_CONTROL_OPTS(last->inp_socket)) {
308 ret = ip_savecontrol(last, &opts, ip, m);
309 if (ret != 0) {
310 m_freem(m);
311 m_freem(opts);
312 goto unlock;
313 }
314 }
315 if (last->inp_flags & INP_STRIPHDR
316 #if CONTENT_FILTER
317 /*
318 * If socket is subject to Content Filter, delay stripping until reinject
319 */
320 && (!CFIL_DGRAM_FILTERED(last->inp_socket))
321 #endif
322 ) {
323 m->m_len -= iphlen;
324 m->m_pkthdr.len -= iphlen;
325 m->m_data += iphlen;
326 }
327 so_recv_data_stat(last->inp_socket, m, 0);
328 if (sbappendaddr(&last->inp_socket->so_rcv,
329 (struct sockaddr *)&ripsrc, m, opts, NULL) != 0) {
330 sorwakeup(last->inp_socket);
331 } else {
332 ipstat.ips_raw_sappend_fail++;
333 }
334 if (is_wake_pkt) {
335 soevent(last->in6p_socket,
336 SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
337 }
338 } else {
339 m_freem(m);
340 OSAddAtomic(1, &ipstat.ips_noproto);
341 OSAddAtomic(-1, &ipstat.ips_delivered);
342 }
343 }
344 unlock:
345 /*
346 * Keep the list locked because socket filter may force the socket lock
347 * to be released when calling sbappendaddr() -- see rdar://7627704
348 */
349 lck_rw_done(&ripcbinfo.ipi_lock);
350 }
351
352 /*
353 * Generate IP header and pass packet to ip_output.
354 * Tack on options user may have setup with control call.
355 */
356 int
rip_output(struct mbuf * m,struct socket * so,u_int32_t dst,struct mbuf * control)357 rip_output(
358 struct mbuf *m,
359 struct socket *so,
360 u_int32_t dst,
361 struct mbuf *control)
362 {
363 struct ip *ip;
364 struct inpcb *inp = sotoinpcb(so);
365 int flags = (so->so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
366 int inp_flags = inp ? inp->inp_flags : 0;
367 struct ip_out_args ipoa;
368 struct ip_moptions *imo;
369 int tos = IPTOS_UNSPEC;
370 int error = 0;
371 #if CONTENT_FILTER
372 struct m_tag *cfil_tag = NULL;
373 bool cfil_faddr_use = false;
374 uint32_t cfil_so_state_change_cnt = 0;
375 uint32_t cfil_so_options = 0;
376 int cfil_inp_flags = 0;
377 struct sockaddr *cfil_faddr = NULL;
378 struct sockaddr_in *cfil_sin;
379 u_int32_t cfil_dst = 0;
380 #endif
381
382 #if CONTENT_FILTER
383 /*
384 * If socket is subject to Content Filter and no addr is passed in,
385 * retrieve CFIL saved state from mbuf and use it if necessary.
386 */
387 if (CFIL_DGRAM_FILTERED(so) && dst == INADDR_ANY) {
388 cfil_tag = cfil_dgram_get_socket_state(m, &cfil_so_state_change_cnt, &cfil_so_options, &cfil_faddr, &cfil_inp_flags);
389 if (cfil_tag) {
390 cfil_sin = SIN(cfil_faddr);
391 flags = (cfil_so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
392 inp_flags = cfil_inp_flags;
393 if (inp && inp->inp_faddr.s_addr == INADDR_ANY) {
394 /*
395 * Socket is unconnected, simply use the saved faddr as 'addr' to go through
396 * the connect/disconnect logic.
397 */
398 dst = cfil_sin->sin_addr.s_addr;
399 } else if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
400 (inp->inp_fport != cfil_sin->sin_port ||
401 inp->inp_faddr.s_addr != cfil_sin->sin_addr.s_addr)) {
402 /*
403 * Socket is connected but socket state and dest addr/port changed.
404 * We need to use the saved faddr and socket options.
405 */
406 cfil_faddr_use = true;
407 cfil_dst = cfil_sin->sin_addr.s_addr;
408 }
409 m_tag_free(cfil_tag);
410 }
411 }
412 #endif
413
414 if (so->so_state & SS_ISCONNECTED) {
415 if (dst != INADDR_ANY) {
416 if (m != NULL) {
417 m_freem(m);
418 }
419 if (control != NULL) {
420 m_freem(control);
421 }
422 return EISCONN;
423 }
424 dst = cfil_faddr_use ? cfil_dst : inp->inp_faddr.s_addr;
425 } else {
426 if (dst == INADDR_ANY) {
427 if (m != NULL) {
428 m_freem(m);
429 }
430 if (control != NULL) {
431 m_freem(control);
432 }
433 return ENOTCONN;
434 }
435 }
436
437 bzero(&ipoa, sizeof(ipoa));
438 ipoa.ipoa_boundif = IFSCOPE_NONE;
439 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF;
440
441 int sotc = SO_TC_UNSPEC;
442 int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
443
444
445 if (control != NULL) {
446 tos = so_tos_from_control(control);
447 sotc = so_tc_from_control(control, &netsvctype);
448
449 m_freem(control);
450 control = NULL;
451 }
452 if (sotc == SO_TC_UNSPEC) {
453 sotc = so->so_traffic_class;
454 netsvctype = so->so_netsvctype;
455 }
456
457 if (inp == NULL
458 #if NECP
459 || (necp_socket_should_use_flow_divert(inp))
460 #endif /* NECP */
461 ) {
462 if (m != NULL) {
463 m_freem(m);
464 }
465 VERIFY(control == NULL);
466 return inp == NULL ? EINVAL : EPROTOTYPE;
467 }
468
469 flags |= IP_OUTARGS;
470 /* If socket was bound to an ifindex, tell ip_output about it */
471 if (inp->inp_flags & INP_BOUND_IF) {
472 ipoa.ipoa_boundif = inp->inp_boundifp->if_index;
473 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
474 }
475 if (INP_NO_CELLULAR(inp)) {
476 ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
477 }
478 if (INP_NO_EXPENSIVE(inp)) {
479 ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
480 }
481 if (INP_NO_CONSTRAINED(inp)) {
482 ipoa.ipoa_flags |= IPOAF_NO_CONSTRAINED;
483 }
484 if (INP_AWDL_UNRESTRICTED(inp)) {
485 ipoa.ipoa_flags |= IPOAF_AWDL_UNRESTRICTED;
486 }
487 if (INP_MANAGEMENT_ALLOWED(inp)) {
488 ipoa.ipoa_flags |= IPOAF_MANAGEMENT_ALLOWED;
489 }
490 ipoa.ipoa_sotc = sotc;
491 ipoa.ipoa_netsvctype = netsvctype;
492
493 if (inp->inp_flowhash == 0) {
494 inp_calc_flowhash(inp);
495 ASSERT(inp->inp_flowhash != 0);
496 }
497
498 /*
499 * If the user handed us a complete IP packet, use it.
500 * Otherwise, allocate an mbuf for a header and fill it in.
501 */
502 if ((inp_flags & INP_HDRINCL) == 0) {
503 if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
504 m_freem(m);
505 return EMSGSIZE;
506 }
507 M_PREPEND(m, sizeof(struct ip), M_WAIT, 1);
508 if (m == NULL) {
509 return ENOBUFS;
510 }
511 ip = mtod(m, struct ip *);
512 if (tos != IPTOS_UNSPEC) {
513 ip->ip_tos = (uint8_t)(tos & IPTOS_MASK);
514 } else {
515 ip->ip_tos = inp->inp_ip_tos;
516 }
517 if (inp->inp_flags2 & INP2_DONTFRAG) {
518 ip->ip_off = IP_DF;
519 } else {
520 ip->ip_off = 0;
521 }
522 ip->ip_p = inp->inp_ip_p;
523 ip->ip_len = (uint16_t)m->m_pkthdr.len;
524 ip->ip_src = inp->inp_laddr;
525 ip->ip_dst.s_addr = dst;
526 ip->ip_ttl = inp->inp_ip_ttl;
527 } else {
528 if (m->m_pkthdr.len > IP_MAXPACKET) {
529 m_freem(m);
530 return EMSGSIZE;
531 }
532 ip = mtod(m, struct ip *);
533 /*
534 * don't allow both user specified and setsockopt options,
535 * and don't allow packet length sizes that will crash
536 */
537 if (m->m_pkthdr.len < sizeof(struct ip) ||
538 ((IP_VHL_HL(ip->ip_vhl) != (sizeof(*ip) >> 2)) && inp->inp_options) ||
539 (ip->ip_len > m->m_pkthdr.len) ||
540 (ip->ip_len < (IP_VHL_HL(ip->ip_vhl) << 2))) {
541 m_freem(m);
542 return EINVAL;
543 }
544 if (ip->ip_id == 0 && !(rfc6864 && IP_OFF_IS_ATOMIC(ntohs(ip->ip_off)))) {
545 ip->ip_id = ip_randomid((uint64_t)m);
546 }
547 /* XXX prevent ip_output from overwriting header fields */
548 flags |= IP_RAWOUTPUT;
549 OSAddAtomic(1, &ipstat.ips_rawout);
550 }
551
552 if (inp->inp_laddr.s_addr != INADDR_ANY) {
553 ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
554 }
555
556 #if NECP
557 {
558 necp_kernel_policy_id policy_id;
559 necp_kernel_policy_id skip_policy_id;
560 u_int32_t route_rule_id;
561 u_int32_t pass_flags;
562
563 /*
564 * We need a route to perform NECP route rule checks
565 */
566 if ((net_qos_policy_restricted != 0 &&
567 ROUTE_UNUSABLE(&inp->inp_route))
568 #if CONTENT_FILTER
569 || cfil_faddr_use
570 #endif
571 ) {
572 struct sockaddr_in to;
573 struct sockaddr_in from;
574 struct in_addr laddr = ip->ip_src;
575
576 ROUTE_RELEASE(&inp->inp_route);
577
578 bzero(&from, sizeof(struct sockaddr_in));
579 from.sin_family = AF_INET;
580 from.sin_len = sizeof(struct sockaddr_in);
581 from.sin_addr = laddr;
582
583 bzero(&to, sizeof(struct sockaddr_in));
584 to.sin_family = AF_INET;
585 to.sin_len = sizeof(struct sockaddr_in);
586 to.sin_addr.s_addr = ip->ip_dst.s_addr;
587
588 if ((error = in_pcbladdr(inp, (struct sockaddr *)&to,
589 &laddr, ipoa.ipoa_boundif, NULL, 1)) != 0) {
590 printf("%s in_pcbladdr(%p) error %d\n",
591 __func__, inp, error);
592 m_freem(m);
593 return error;
594 }
595
596 inp_update_necp_policy(inp, (struct sockaddr *)&from,
597 (struct sockaddr *)&to, ipoa.ipoa_boundif);
598 inp->inp_policyresult.results.qos_marking_gencount = 0;
599 }
600
601 if (!necp_socket_is_allowed_to_send_recv_v4(inp, 0, 0,
602 &ip->ip_src, &ip->ip_dst, NULL, 0, &policy_id, &route_rule_id, &skip_policy_id, &pass_flags)) {
603 m_freem(m);
604 return EHOSTUNREACH;
605 }
606
607 necp_mark_packet_from_socket(m, inp, policy_id, route_rule_id, skip_policy_id, pass_flags);
608
609 if (net_qos_policy_restricted != 0) {
610 struct ifnet *rt_ifp = NULL;
611
612 if (inp->inp_route.ro_rt != NULL) {
613 rt_ifp = inp->inp_route.ro_rt->rt_ifp;
614 }
615
616 necp_socket_update_qos_marking(inp, inp->inp_route.ro_rt, route_rule_id);
617 }
618 }
619 #endif /* NECP */
620 if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
621 ipoa.ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
622 }
623 #if IPSEC
624 if (inp->inp_sp != NULL && ipsec_setsocket(m, so) != 0) {
625 m_freem(m);
626 return ENOBUFS;
627 }
628 #endif /*IPSEC*/
629
630 if (ROUTE_UNUSABLE(&inp->inp_route)) {
631 ROUTE_RELEASE(&inp->inp_route);
632 }
633
634 set_packet_service_class(m, so, sotc, 0);
635 m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
636 m->m_pkthdr.pkt_flowid = inp->inp_flowhash;
637 m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC |
638 PKTF_FLOW_RAWSOCK);
639 m->m_pkthdr.pkt_proto = inp->inp_ip_p;
640 m->m_pkthdr.tx_rawip_pid = so->last_pid;
641 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
642 if (so->so_flags & SOF_DELEGATED) {
643 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
644 } else {
645 m->m_pkthdr.tx_rawip_e_pid = 0;
646 }
647 #if (DEBUG || DEVELOPMENT)
648 if (so->so_flags & SOF_MARK_WAKE_PKT) {
649 so->so_flags &= ~SOF_MARK_WAKE_PKT;
650 m->m_pkthdr.pkt_flags |= PKTF_WAKE_PKT;
651 }
652 #endif /* (DEBUG || DEVELOPMENT) */
653
654 imo = inp->inp_moptions;
655 if (imo != NULL) {
656 IMO_ADDREF(imo);
657 }
658 /*
659 * The domain lock is held across ip_output, so it is okay
660 * to pass the PCB cached route pointer directly to IP and
661 * the modules beneath it.
662 */
663 // TODO: PASS DOWN ROUTE RULE ID
664 error = ip_output(m, inp->inp_options, &inp->inp_route, flags,
665 imo, &ipoa);
666
667 if (imo != NULL) {
668 IMO_REMREF(imo);
669 }
670
671 if (inp->inp_route.ro_rt != NULL) {
672 struct rtentry *rt = inp->inp_route.ro_rt;
673 struct ifnet *outif;
674
675 if ((rt->rt_flags & (RTF_MULTICAST | RTF_BROADCAST)) ||
676 inp->inp_socket == NULL ||
677 #if CONTENT_FILTER
678 /* Discard temporary route for cfil case */
679 cfil_faddr_use ||
680 #endif
681 !(inp->inp_socket->so_state & SS_ISCONNECTED)) {
682 rt = NULL; /* unusable */
683 }
684 /*
685 * Always discard the cached route for unconnected
686 * socket or if it is a multicast route.
687 */
688 if (rt == NULL) {
689 ROUTE_RELEASE(&inp->inp_route);
690 }
691
692 /*
693 * If this is a connected socket and the destination
694 * route is unicast, update outif with that of the
695 * route interface used by IP.
696 */
697 if (rt != NULL &&
698 (outif = rt->rt_ifp) != inp->inp_last_outifp) {
699 inp->inp_last_outifp = outif;
700 }
701 } else {
702 ROUTE_RELEASE(&inp->inp_route);
703 }
704
705 /*
706 * If output interface was cellular/expensive/constrained, and this socket is
707 * denied access to it, generate an event.
708 */
709 if (error != 0 && (ipoa.ipoa_flags & IPOAF_R_IFDENIED) &&
710 (INP_NO_CELLULAR(inp) || INP_NO_EXPENSIVE(inp) || INP_NO_CONSTRAINED(inp))) {
711 soevent(so, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
712 }
713
714 return error;
715 }
716
717
718 /*
719 * Raw IP socket option processing.
720 */
721 int
rip_ctloutput(struct socket * so,struct sockopt * sopt)722 rip_ctloutput(struct socket *so, struct sockopt *sopt)
723 {
724 struct inpcb *inp = sotoinpcb(so);
725 int error, optval;
726
727 /* Allow <SOL_SOCKET,SO_FLUSH> at this level */
728 if (sopt->sopt_level != IPPROTO_IP &&
729 !(sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_FLUSH)) {
730 return EINVAL;
731 }
732
733 error = 0;
734
735 switch (sopt->sopt_dir) {
736 case SOPT_GET:
737 switch (sopt->sopt_name) {
738 case IP_HDRINCL:
739 optval = inp->inp_flags & INP_HDRINCL;
740 error = sooptcopyout(sopt, &optval, sizeof optval);
741 break;
742
743 case IP_STRIPHDR:
744 optval = inp->inp_flags & INP_STRIPHDR;
745 error = sooptcopyout(sopt, &optval, sizeof optval);
746 break;
747
748
749 #if DUMMYNET
750 case IP_DUMMYNET_GET:
751 if (!DUMMYNET_LOADED) {
752 ip_dn_init();
753 }
754 if (DUMMYNET_LOADED) {
755 error = ip_dn_ctl_ptr(sopt);
756 } else {
757 error = ENOPROTOOPT;
758 }
759 break;
760 #endif /* DUMMYNET */
761
762 default:
763 error = ip_ctloutput(so, sopt);
764 break;
765 }
766 break;
767
768 case SOPT_SET:
769 switch (sopt->sopt_name) {
770 case IP_HDRINCL:
771 error = sooptcopyin(sopt, &optval, sizeof optval,
772 sizeof optval);
773 if (error) {
774 break;
775 }
776 if (optval) {
777 inp->inp_flags |= INP_HDRINCL;
778 } else {
779 inp->inp_flags &= ~INP_HDRINCL;
780 }
781 break;
782
783 case IP_STRIPHDR:
784 error = sooptcopyin(sopt, &optval, sizeof optval,
785 sizeof optval);
786 if (error) {
787 break;
788 }
789 if (optval) {
790 inp->inp_flags |= INP_STRIPHDR;
791 } else {
792 inp->inp_flags &= ~INP_STRIPHDR;
793 }
794 break;
795
796
797 #if DUMMYNET
798 case IP_DUMMYNET_CONFIGURE:
799 case IP_DUMMYNET_DEL:
800 case IP_DUMMYNET_FLUSH:
801 if (!DUMMYNET_LOADED) {
802 ip_dn_init();
803 }
804 if (DUMMYNET_LOADED) {
805 error = ip_dn_ctl_ptr(sopt);
806 } else {
807 error = ENOPROTOOPT;
808 }
809 break;
810 #endif /* DUMMYNET */
811
812 case SO_FLUSH:
813 if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
814 sizeof(optval))) != 0) {
815 break;
816 }
817
818 error = inp_flush(inp, optval);
819 break;
820
821 default:
822 error = ip_ctloutput(so, sopt);
823 break;
824 }
825 break;
826 }
827
828 return error;
829 }
830
831 /*
832 * This function exists solely to receive the PRC_IFDOWN messages which
833 * are sent by if_down(). It looks for an ifaddr whose ifa_addr is sa,
834 * and calls in_ifadown() to remove all routes corresponding to that address.
835 * It also receives the PRC_IFUP messages from if_up() and reinstalls the
836 * interface routes.
837 */
838 void
rip_ctlinput(int cmd,struct sockaddr * sa,__unused void * vip,__unused struct ifnet * ifp)839 rip_ctlinput(
840 int cmd,
841 struct sockaddr *sa,
842 __unused void *vip,
843 __unused struct ifnet *ifp)
844 {
845 struct in_ifaddr *ia = NULL;
846 struct ifnet *iaifp = NULL;
847 int err = 0;
848 int flags, done = 0;
849
850 switch (cmd) {
851 case PRC_IFDOWN:
852 lck_rw_lock_shared(&in_ifaddr_rwlock);
853 for (ia = in_ifaddrhead.tqh_first; ia;
854 ia = ia->ia_link.tqe_next) {
855 IFA_LOCK(&ia->ia_ifa);
856 if (ia->ia_ifa.ifa_addr == sa &&
857 (ia->ia_flags & IFA_ROUTE)) {
858 done = 1;
859 IFA_ADDREF_LOCKED(&ia->ia_ifa);
860 IFA_UNLOCK(&ia->ia_ifa);
861 lck_rw_done(&in_ifaddr_rwlock);
862 lck_mtx_lock(rnh_lock);
863 /*
864 * in_ifscrub kills the interface route.
865 */
866 in_ifscrub(ia->ia_ifp, ia, 1);
867 /*
868 * in_ifadown gets rid of all the rest of
869 * the routes. This is not quite the right
870 * thing to do, but at least if we are running
871 * a routing process they will come back.
872 */
873 in_ifadown(&ia->ia_ifa, 1);
874 lck_mtx_unlock(rnh_lock);
875 IFA_REMREF(&ia->ia_ifa);
876 break;
877 }
878 IFA_UNLOCK(&ia->ia_ifa);
879 }
880 if (!done) {
881 lck_rw_done(&in_ifaddr_rwlock);
882 }
883 break;
884
885 case PRC_IFUP:
886 lck_rw_lock_shared(&in_ifaddr_rwlock);
887 for (ia = in_ifaddrhead.tqh_first; ia;
888 ia = ia->ia_link.tqe_next) {
889 IFA_LOCK(&ia->ia_ifa);
890 if (ia->ia_ifa.ifa_addr == sa) {
891 /* keep it locked */
892 break;
893 }
894 IFA_UNLOCK(&ia->ia_ifa);
895 }
896 if (ia == NULL || (ia->ia_flags & IFA_ROUTE) ||
897 (ia->ia_ifa.ifa_debug & IFD_NOTREADY)) {
898 if (ia != NULL) {
899 IFA_UNLOCK(&ia->ia_ifa);
900 }
901 lck_rw_done(&in_ifaddr_rwlock);
902 return;
903 }
904 IFA_ADDREF_LOCKED(&ia->ia_ifa);
905 IFA_UNLOCK(&ia->ia_ifa);
906 lck_rw_done(&in_ifaddr_rwlock);
907
908 flags = RTF_UP;
909 iaifp = ia->ia_ifa.ifa_ifp;
910
911 if ((iaifp->if_flags & IFF_LOOPBACK)
912 || (iaifp->if_flags & IFF_POINTOPOINT)) {
913 flags |= RTF_HOST;
914 }
915
916 err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
917 if (err == 0) {
918 IFA_LOCK_SPIN(&ia->ia_ifa);
919 ia->ia_flags |= IFA_ROUTE;
920 IFA_UNLOCK(&ia->ia_ifa);
921 }
922 IFA_REMREF(&ia->ia_ifa);
923 break;
924 }
925 }
926
927 u_int32_t rip_sendspace = RIPSNDQ;
928 u_int32_t rip_recvspace = RIPRCVQ;
929
930 SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW | CTLFLAG_LOCKED,
931 &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
932 SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW | CTLFLAG_LOCKED,
933 &rip_recvspace, 0, "Maximum incoming raw IP datagram size");
934 SYSCTL_UINT(_net_inet_raw, OID_AUTO, pcbcount, CTLFLAG_RD | CTLFLAG_LOCKED,
935 &ripcbinfo.ipi_count, 0, "Number of active PCBs");
936
937 static int
rip_attach(struct socket * so,int proto,struct proc * p)938 rip_attach(struct socket *so, int proto, struct proc *p)
939 {
940 struct inpcb *inp;
941 int error;
942
943 inp = sotoinpcb(so);
944 if (inp) {
945 panic("rip_attach");
946 }
947 if ((so->so_state & SS_PRIV) == 0) {
948 return EPERM;
949 }
950 if (proto > UINT8_MAX) {
951 return EINVAL;
952 }
953
954 error = soreserve(so, rip_sendspace, rip_recvspace);
955 if (error) {
956 return error;
957 }
958 error = in_pcballoc(so, &ripcbinfo, p);
959 if (error) {
960 return error;
961 }
962 inp = (struct inpcb *)so->so_pcb;
963 inp->inp_vflag |= INP_IPV4;
964 VERIFY(proto <= UINT8_MAX);
965 inp->inp_ip_p = (u_char)proto;
966 inp->inp_ip_ttl = (u_char)ip_defttl;
967 return 0;
968 }
969
970 __private_extern__ int
rip_detach(struct socket * so)971 rip_detach(struct socket *so)
972 {
973 struct inpcb *inp;
974
975 inp = sotoinpcb(so);
976 if (inp == 0) {
977 panic("rip_detach");
978 }
979 in_pcbdetach(inp);
980 return 0;
981 }
982
983 __private_extern__ int
rip_abort(struct socket * so)984 rip_abort(struct socket *so)
985 {
986 soisdisconnected(so);
987 return rip_detach(so);
988 }
989
990 __private_extern__ int
rip_disconnect(struct socket * so)991 rip_disconnect(struct socket *so)
992 {
993 if ((so->so_state & SS_ISCONNECTED) == 0) {
994 return ENOTCONN;
995 }
996 return rip_abort(so);
997 }
998
999 __private_extern__ int
rip_bind(struct socket * so,struct sockaddr * nam,struct proc * p)1000 rip_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
1001 {
1002 #pragma unused(p)
1003 struct inpcb *inp = sotoinpcb(so);
1004 struct sockaddr_in sin;
1005 struct ifaddr *ifa = NULL;
1006 struct ifnet *outif = NULL;
1007
1008 if (inp == NULL
1009 #if NECP
1010 || (necp_socket_should_use_flow_divert(inp))
1011 #endif /* NECP */
1012 ) {
1013 return inp == NULL ? EINVAL : EPROTOTYPE;
1014 }
1015
1016 if (nam->sa_len != sizeof(struct sockaddr_in)) {
1017 return EINVAL;
1018 }
1019
1020 /* Sanitized local copy for interface address searches */
1021 bzero(&sin, sizeof(sin));
1022 sin.sin_family = AF_INET;
1023 sin.sin_len = sizeof(struct sockaddr_in);
1024 sin.sin_addr.s_addr = SIN(nam)->sin_addr.s_addr;
1025
1026 if (TAILQ_EMPTY(&ifnet_head) ||
1027 (sin.sin_family != AF_INET && sin.sin_family != AF_IMPLINK) ||
1028 (sin.sin_addr.s_addr && (ifa = ifa_ifwithaddr(SA(&sin))) == 0)) {
1029 return EADDRNOTAVAIL;
1030 } else if (ifa) {
1031 /*
1032 * Opportunistically determine the outbound
1033 * interface that may be used; this may not
1034 * hold true if we end up using a route
1035 * going over a different interface, e.g.
1036 * when sending to a local address. This
1037 * will get updated again after sending.
1038 */
1039 IFA_LOCK(ifa);
1040 outif = ifa->ifa_ifp;
1041 IFA_UNLOCK(ifa);
1042 IFA_REMREF(ifa);
1043 }
1044 inp->inp_laddr = sin.sin_addr;
1045 inp->inp_last_outifp = outif;
1046
1047 return 0;
1048 }
1049
1050 __private_extern__ int
rip_connect(struct socket * so,struct sockaddr * nam,__unused struct proc * p)1051 rip_connect(struct socket *so, struct sockaddr *nam, __unused struct proc *p)
1052 {
1053 struct inpcb *inp = sotoinpcb(so);
1054 struct sockaddr_in *addr = (struct sockaddr_in *)(void *)nam;
1055
1056 if (inp == NULL
1057 #if NECP
1058 || (necp_socket_should_use_flow_divert(inp))
1059 #endif /* NECP */
1060 ) {
1061 return inp == NULL ? EINVAL : EPROTOTYPE;
1062 }
1063 if (nam->sa_len != sizeof(*addr)) {
1064 return EINVAL;
1065 }
1066 if (TAILQ_EMPTY(&ifnet_head)) {
1067 return EADDRNOTAVAIL;
1068 }
1069 if ((addr->sin_family != AF_INET) &&
1070 (addr->sin_family != AF_IMPLINK)) {
1071 return EAFNOSUPPORT;
1072 }
1073
1074 if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
1075 so->so_flags1 |= SOF1_CONNECT_COUNTED;
1076 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
1077 }
1078
1079 inp->inp_faddr = addr->sin_addr;
1080 soisconnected(so);
1081
1082 return 0;
1083 }
1084
1085 __private_extern__ int
rip_shutdown(struct socket * so)1086 rip_shutdown(struct socket *so)
1087 {
1088 socantsendmore(so);
1089 return 0;
1090 }
1091
1092 __private_extern__ int
rip_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct proc * p)1093 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
1094 struct mbuf *control, struct proc *p)
1095 {
1096 #pragma unused(flags, p)
1097 struct inpcb *inp = sotoinpcb(so);
1098 u_int32_t dst = INADDR_ANY;
1099 int error = 0;
1100
1101 if (inp == NULL
1102 #if NECP
1103 || (necp_socket_should_use_flow_divert(inp) && (error = EPROTOTYPE))
1104 #endif /* NECP */
1105 ) {
1106 if (inp == NULL) {
1107 error = EINVAL;
1108 } else {
1109 error = EPROTOTYPE;
1110 }
1111 goto bad;
1112 }
1113
1114 if (nam != NULL) {
1115 dst = ((struct sockaddr_in *)(void *)nam)->sin_addr.s_addr;
1116 }
1117 return rip_output(m, so, dst, control);
1118
1119 bad:
1120 VERIFY(error != 0);
1121
1122 if (m != NULL) {
1123 m_freem(m);
1124 }
1125 if (control != NULL) {
1126 m_freem(control);
1127 }
1128
1129 return error;
1130 }
1131
1132 /* note: rip_unlock is called from different protos instead of the generic socket_unlock,
1133 * it will handle the socket dealloc on last reference
1134 * */
1135 int
rip_unlock(struct socket * so,int refcount,void * debug)1136 rip_unlock(struct socket *so, int refcount, void *debug)
1137 {
1138 void *lr_saved;
1139 struct inpcb *inp = sotoinpcb(so);
1140
1141 if (debug == NULL) {
1142 lr_saved = __builtin_return_address(0);
1143 } else {
1144 lr_saved = debug;
1145 }
1146
1147 if (refcount) {
1148 if (so->so_usecount <= 0) {
1149 panic("rip_unlock: bad refoucnt so=%p val=%x lrh= %s",
1150 so, so->so_usecount, solockhistory_nr(so));
1151 /* NOTREACHED */
1152 }
1153 so->so_usecount--;
1154 if (so->so_usecount == 0 && (inp->inp_wantcnt == WNT_STOPUSING)) {
1155 /* cleanup after last reference */
1156 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1157 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1158 if (inp->inp_state != INPCB_STATE_DEAD) {
1159 if (SOCK_CHECK_DOM(so, PF_INET6)) {
1160 in6_pcbdetach(inp);
1161 } else {
1162 in_pcbdetach(inp);
1163 }
1164 }
1165 in_pcbdispose(inp);
1166 lck_rw_done(&ripcbinfo.ipi_lock);
1167 return 0;
1168 }
1169 }
1170 so->unlock_lr[so->next_unlock_lr] = lr_saved;
1171 so->next_unlock_lr = (so->next_unlock_lr + 1) % SO_LCKDBG_MAX;
1172 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1173 return 0;
1174 }
1175
1176 static int
1177 rip_pcblist SYSCTL_HANDLER_ARGS
1178 {
1179 #pragma unused(oidp, arg1, arg2)
1180 int error, i, n, sz;
1181 struct inpcb *inp, **inp_list;
1182 inp_gen_t gencnt;
1183 struct xinpgen xig;
1184
1185 /*
1186 * The process of preparing the TCB list is too time-consuming and
1187 * resource-intensive to repeat twice on every request.
1188 */
1189 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1190 if (req->oldptr == USER_ADDR_NULL) {
1191 n = ripcbinfo.ipi_count;
1192 req->oldidx = 2 * (sizeof xig)
1193 + (n + n / 8) * sizeof(struct xinpcb);
1194 lck_rw_done(&ripcbinfo.ipi_lock);
1195 return 0;
1196 }
1197
1198 if (req->newptr != USER_ADDR_NULL) {
1199 lck_rw_done(&ripcbinfo.ipi_lock);
1200 return EPERM;
1201 }
1202
1203 /*
1204 * OK, now we're committed to doing something.
1205 */
1206 gencnt = ripcbinfo.ipi_gencnt;
1207 sz = n = ripcbinfo.ipi_count;
1208
1209 bzero(&xig, sizeof(xig));
1210 xig.xig_len = sizeof xig;
1211 xig.xig_count = n;
1212 xig.xig_gen = gencnt;
1213 xig.xig_sogen = so_gencnt;
1214 error = SYSCTL_OUT(req, &xig, sizeof xig);
1215 if (error) {
1216 lck_rw_done(&ripcbinfo.ipi_lock);
1217 return error;
1218 }
1219 /*
1220 * We are done if there is no pcb
1221 */
1222 if (n == 0) {
1223 lck_rw_done(&ripcbinfo.ipi_lock);
1224 return 0;
1225 }
1226
1227 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1228 if (inp_list == NULL) {
1229 lck_rw_done(&ripcbinfo.ipi_lock);
1230 return ENOMEM;
1231 }
1232
1233 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1234 inp = inp->inp_list.le_next) {
1235 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1236 inp_list[i++] = inp;
1237 }
1238 }
1239 n = i;
1240
1241 error = 0;
1242 for (i = 0; i < n; i++) {
1243 inp = inp_list[i];
1244 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1245 struct xinpcb xi;
1246
1247 bzero(&xi, sizeof(xi));
1248 xi.xi_len = sizeof xi;
1249 /* XXX should avoid extra copy */
1250 inpcb_to_compat(inp, &xi.xi_inp);
1251 if (inp->inp_socket) {
1252 sotoxsocket(inp->inp_socket, &xi.xi_socket);
1253 }
1254 error = SYSCTL_OUT(req, &xi, sizeof xi);
1255 }
1256 }
1257 if (!error) {
1258 /*
1259 * Give the user an updated idea of our state.
1260 * If the generation differs from what we told
1261 * her before, she knows that something happened
1262 * while we were processing this request, and it
1263 * might be necessary to retry.
1264 */
1265 bzero(&xig, sizeof(xig));
1266 xig.xig_len = sizeof xig;
1267 xig.xig_gen = ripcbinfo.ipi_gencnt;
1268 xig.xig_sogen = so_gencnt;
1269 xig.xig_count = ripcbinfo.ipi_count;
1270 error = SYSCTL_OUT(req, &xig, sizeof xig);
1271 }
1272
1273 lck_rw_done(&ripcbinfo.ipi_lock);
1274 kfree_type(struct inpcb *, sz, inp_list);
1275 return error;
1276 }
1277
1278 SYSCTL_PROC(_net_inet_raw, OID_AUTO /*XXX*/, pcblist,
1279 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1280 rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
1281
1282 #if XNU_TARGET_OS_OSX
1283
1284 static int
1285 rip_pcblist64 SYSCTL_HANDLER_ARGS
1286 {
1287 #pragma unused(oidp, arg1, arg2)
1288 int error, i, n, sz;
1289 struct inpcb *inp, **inp_list;
1290 inp_gen_t gencnt;
1291 struct xinpgen xig;
1292
1293 /*
1294 * The process of preparing the TCB list is too time-consuming and
1295 * resource-intensive to repeat twice on every request.
1296 */
1297 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1298 if (req->oldptr == USER_ADDR_NULL) {
1299 n = ripcbinfo.ipi_count;
1300 req->oldidx = 2 * (sizeof xig)
1301 + (n + n / 8) * sizeof(struct xinpcb64);
1302 lck_rw_done(&ripcbinfo.ipi_lock);
1303 return 0;
1304 }
1305
1306 if (req->newptr != USER_ADDR_NULL) {
1307 lck_rw_done(&ripcbinfo.ipi_lock);
1308 return EPERM;
1309 }
1310
1311 /*
1312 * OK, now we're committed to doing something.
1313 */
1314 gencnt = ripcbinfo.ipi_gencnt;
1315 sz = n = ripcbinfo.ipi_count;
1316
1317 bzero(&xig, sizeof(xig));
1318 xig.xig_len = sizeof xig;
1319 xig.xig_count = n;
1320 xig.xig_gen = gencnt;
1321 xig.xig_sogen = so_gencnt;
1322 error = SYSCTL_OUT(req, &xig, sizeof xig);
1323 if (error) {
1324 lck_rw_done(&ripcbinfo.ipi_lock);
1325 return error;
1326 }
1327 /*
1328 * We are done if there is no pcb
1329 */
1330 if (n == 0) {
1331 lck_rw_done(&ripcbinfo.ipi_lock);
1332 return 0;
1333 }
1334
1335 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1336 if (inp_list == NULL) {
1337 lck_rw_done(&ripcbinfo.ipi_lock);
1338 return ENOMEM;
1339 }
1340
1341 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1342 inp = inp->inp_list.le_next) {
1343 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1344 inp_list[i++] = inp;
1345 }
1346 }
1347 n = i;
1348
1349 error = 0;
1350 for (i = 0; i < n; i++) {
1351 inp = inp_list[i];
1352 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1353 struct xinpcb64 xi;
1354
1355 bzero(&xi, sizeof(xi));
1356 xi.xi_len = sizeof xi;
1357 inpcb_to_xinpcb64(inp, &xi);
1358 if (inp->inp_socket) {
1359 sotoxsocket64(inp->inp_socket, &xi.xi_socket);
1360 }
1361 error = SYSCTL_OUT(req, &xi, sizeof xi);
1362 }
1363 }
1364 if (!error) {
1365 /*
1366 * Give the user an updated idea of our state.
1367 * If the generation differs from what we told
1368 * her before, she knows that something happened
1369 * while we were processing this request, and it
1370 * might be necessary to retry.
1371 */
1372 bzero(&xig, sizeof(xig));
1373 xig.xig_len = sizeof xig;
1374 xig.xig_gen = ripcbinfo.ipi_gencnt;
1375 xig.xig_sogen = so_gencnt;
1376 xig.xig_count = ripcbinfo.ipi_count;
1377 error = SYSCTL_OUT(req, &xig, sizeof xig);
1378 }
1379
1380 lck_rw_done(&ripcbinfo.ipi_lock);
1381 kfree_type(struct inpcb *, sz, inp_list);
1382 return error;
1383 }
1384
1385 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist64,
1386 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1387 rip_pcblist64, "S,xinpcb64", "List of active raw IP sockets");
1388
1389 #endif /* XNU_TARGET_OS_OSX */
1390
1391
1392 static int
1393 rip_pcblist_n SYSCTL_HANDLER_ARGS
1394 {
1395 #pragma unused(oidp, arg1, arg2)
1396 int error = 0;
1397
1398 error = get_pcblist_n(IPPROTO_IP, req, &ripcbinfo);
1399
1400 return error;
1401 }
1402
1403 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist_n,
1404 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1405 rip_pcblist_n, "S,xinpcb_n", "List of active raw IP sockets");
1406
1407 struct pr_usrreqs rip_usrreqs = {
1408 .pru_abort = rip_abort,
1409 .pru_attach = rip_attach,
1410 .pru_bind = rip_bind,
1411 .pru_connect = rip_connect,
1412 .pru_control = in_control,
1413 .pru_detach = rip_detach,
1414 .pru_disconnect = rip_disconnect,
1415 .pru_peeraddr = in_getpeeraddr,
1416 .pru_send = rip_send,
1417 .pru_shutdown = rip_shutdown,
1418 .pru_sockaddr = in_getsockaddr,
1419 .pru_sosend = sosend,
1420 .pru_soreceive = soreceive,
1421 };
1422 /* DSEP Review Done pl-20051213-v02 @3253 */
1423