1 /*
2 * Copyright (c) 2000-2022 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1988, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)raw_ip.c 8.7 (Berkeley) 5/15/95
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/malloc.h>
73 #include <sys/mbuf.h>
74 #include <sys/mcache.h>
75 #include <sys/proc.h>
76 #include <sys/domain.h>
77 #include <sys/protosw.h>
78 #include <sys/socket.h>
79 #include <sys/socketvar.h>
80 #include <sys/sysctl.h>
81 #include <libkern/OSAtomic.h>
82 #include <kern/zalloc.h>
83
84 #include <pexpert/pexpert.h>
85
86 #include <net/if.h>
87 #include <net/net_api_stats.h>
88 #include <net/route.h>
89 #include <net/content_filter.h>
90
91 #define _IP_VHL
92 #include <netinet/in.h>
93 #include <netinet/in_systm.h>
94 #include <netinet/in_tclass.h>
95 #include <netinet/ip.h>
96 #include <netinet/in_pcb.h>
97 #include <netinet/in_var.h>
98 #include <netinet/ip_var.h>
99
100 #include <netinet6/in6_pcb.h>
101
102
103 #if IPSEC
104 #include <netinet6/ipsec.h>
105 #endif /*IPSEC*/
106
107 #if DUMMYNET
108 #include <netinet/ip_dummynet.h>
109 #endif /* DUMMYNET */
110
111 int rip_detach(struct socket *);
112 int rip_abort(struct socket *);
113 int rip_disconnect(struct socket *);
114 int rip_bind(struct socket *, struct sockaddr *, struct proc *);
115 int rip_connect(struct socket *, struct sockaddr *, struct proc *);
116 int rip_shutdown(struct socket *);
117
118 struct inpcbhead ripcb;
119 struct inpcbinfo ripcbinfo;
120
121 /* control hooks for dummynet */
122 #if DUMMYNET
123 ip_dn_ctl_t *ip_dn_ctl_ptr;
124 #endif /* DUMMYNET */
125
126 /*
127 * Nominal space allocated to a raw ip socket.
128 */
129 #define RIPSNDQ 8192
130 #define RIPRCVQ 8192
131
132 /*
133 * Raw interface to IP protocol.
134 */
135
136 /*
137 * Initialize raw connection block q.
138 */
139 void
rip_init(struct protosw * pp,struct domain * dp)140 rip_init(struct protosw *pp, struct domain *dp)
141 {
142 #pragma unused(dp)
143 static int rip_initialized = 0;
144 struct inpcbinfo *pcbinfo;
145
146 VERIFY((pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
147
148 if (rip_initialized) {
149 return;
150 }
151 rip_initialized = 1;
152
153 LIST_INIT(&ripcb);
154 ripcbinfo.ipi_listhead = &ripcb;
155 /*
156 * XXX We don't use the hash list for raw IP, but it's easier
157 * to allocate a one entry hash list than it is to check all
158 * over the place for ipi_hashbase == NULL.
159 */
160 ripcbinfo.ipi_hashbase = hashinit(1, M_PCB, &ripcbinfo.ipi_hashmask);
161 ripcbinfo.ipi_porthashbase = hashinit(1, M_PCB, &ripcbinfo.ipi_porthashmask);
162
163 ripcbinfo.ipi_zone = zone_create("ripzone", sizeof(struct inpcb),
164 ZC_NONE);
165
166 pcbinfo = &ripcbinfo;
167 /*
168 * allocate lock group attribute and group for udp pcb mutexes
169 */
170 pcbinfo->ipi_lock_grp = lck_grp_alloc_init("ripcb", LCK_GRP_ATTR_NULL);
171
172 /*
173 * allocate the lock attribute for udp pcb mutexes
174 */
175 lck_attr_setdefault(&pcbinfo->ipi_lock_attr);
176 lck_rw_init(&pcbinfo->ipi_lock, pcbinfo->ipi_lock_grp,
177 &pcbinfo->ipi_lock_attr);
178
179 in_pcbinfo_attach(&ripcbinfo);
180 }
181
182 static struct sockaddr_in ripsrc = {
183 .sin_len = sizeof(ripsrc),
184 .sin_family = AF_INET,
185 .sin_port = 0,
186 .sin_addr = { .s_addr = 0 },
187 .sin_zero = {0, 0, 0, 0, 0, 0, 0, 0, }
188 };
189
190 /*
191 * Setup generic address and protocol structures
192 * for raw_input routine, then pass them along with
193 * mbuf chain.
194 */
195 void
rip_input(struct mbuf * m,int iphlen)196 rip_input(struct mbuf *m, int iphlen)
197 {
198 struct ip *ip = mtod(m, struct ip *);
199 struct inpcb *inp;
200 struct inpcb *last = 0;
201 struct mbuf *opts = 0;
202 int skipit = 0, ret = 0;
203 struct ifnet *ifp = m->m_pkthdr.rcvif;
204
205 /* Expect 32-bit aligned data pointer on strict-align platforms */
206 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
207
208 ripsrc.sin_addr = ip->ip_src;
209 lck_rw_lock_shared(&ripcbinfo.ipi_lock);
210 LIST_FOREACH(inp, &ripcb, inp_list) {
211 if ((inp->inp_vflag & INP_IPV4) == 0) {
212 continue;
213 }
214 if (inp->inp_ip_p && (inp->inp_ip_p != ip->ip_p)) {
215 continue;
216 }
217 if (inp->inp_laddr.s_addr &&
218 inp->inp_laddr.s_addr != ip->ip_dst.s_addr) {
219 continue;
220 }
221 if (inp->inp_faddr.s_addr &&
222 inp->inp_faddr.s_addr != ip->ip_src.s_addr) {
223 continue;
224 }
225 if (inp_restricted_recv(inp, ifp)) {
226 continue;
227 }
228 if (last) {
229 struct mbuf *n = m_copy(m, 0, (int)M_COPYALL);
230
231 skipit = 0;
232
233 #if NECP
234 if (n && !necp_socket_is_allowed_to_send_recv_v4(last, 0, 0,
235 &ip->ip_dst, &ip->ip_src, ifp, 0, NULL, NULL, NULL, NULL)) {
236 m_freem(n);
237 /* do not inject data to pcb */
238 skipit = 1;
239 }
240 #endif /* NECP */
241 if (n && skipit == 0) {
242 int error = 0;
243 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
244 SOFLOW_ENABLED(last->inp_socket) ||
245 (last->inp_socket->so_options & SO_TIMESTAMP) != 0 ||
246 (last->inp_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
247 (last->inp_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
248 ret = ip_savecontrol(last, &opts, ip, n);
249 if (ret != 0) {
250 m_freem(n);
251 m_freem(opts);
252 last = inp;
253 continue;
254 }
255 }
256 if (last->inp_flags & INP_STRIPHDR
257 #if CONTENT_FILTER
258 /*
259 * If socket is subject to Content Filter, delay stripping until reinject
260 */
261 && (!CFIL_DGRAM_FILTERED(last->inp_socket))
262 #endif
263 ) {
264 n->m_len -= iphlen;
265 n->m_pkthdr.len -= iphlen;
266 n->m_data += iphlen;
267 }
268 so_recv_data_stat(last->inp_socket, m, 0);
269 if (sbappendaddr(&last->inp_socket->so_rcv,
270 (struct sockaddr *)&ripsrc, n,
271 opts, &error) != 0) {
272 sorwakeup(last->inp_socket);
273 } else {
274 if (error) {
275 /* should notify about lost packet */
276 ipstat.ips_raw_sappend_fail++;
277 }
278 }
279 opts = 0;
280 }
281 }
282 last = inp;
283 }
284
285 skipit = 0;
286 #if NECP
287 if (last && !necp_socket_is_allowed_to_send_recv_v4(last, 0, 0,
288 &ip->ip_dst, &ip->ip_src, ifp, 0, NULL, NULL, NULL, NULL)) {
289 m_freem(m);
290 OSAddAtomic(1, &ipstat.ips_delivered);
291 /* do not inject data to pcb */
292 skipit = 1;
293 }
294 #endif /* NECP */
295 if (skipit == 0) {
296 if (last) {
297 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
298 SOFLOW_ENABLED(last->inp_socket) ||
299 (last->inp_socket->so_options & SO_TIMESTAMP) != 0 ||
300 (last->inp_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
301 (last->inp_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
302 ret = ip_savecontrol(last, &opts, ip, m);
303 if (ret != 0) {
304 m_freem(m);
305 m_freem(opts);
306 goto unlock;
307 }
308 }
309 if (last->inp_flags & INP_STRIPHDR
310 #if CONTENT_FILTER
311 /*
312 * If socket is subject to Content Filter, delay stripping until reinject
313 */
314 && (!CFIL_DGRAM_FILTERED(last->inp_socket))
315 #endif
316 ) {
317 m->m_len -= iphlen;
318 m->m_pkthdr.len -= iphlen;
319 m->m_data += iphlen;
320 }
321 so_recv_data_stat(last->inp_socket, m, 0);
322 if (sbappendaddr(&last->inp_socket->so_rcv,
323 (struct sockaddr *)&ripsrc, m, opts, NULL) != 0) {
324 sorwakeup(last->inp_socket);
325 } else {
326 ipstat.ips_raw_sappend_fail++;
327 }
328 } else {
329 m_freem(m);
330 OSAddAtomic(1, &ipstat.ips_noproto);
331 OSAddAtomic(-1, &ipstat.ips_delivered);
332 }
333 }
334 unlock:
335 /*
336 * Keep the list locked because socket filter may force the socket lock
337 * to be released when calling sbappendaddr() -- see rdar://7627704
338 */
339 lck_rw_done(&ripcbinfo.ipi_lock);
340 }
341
342 /*
343 * Generate IP header and pass packet to ip_output.
344 * Tack on options user may have setup with control call.
345 */
346 int
rip_output(struct mbuf * m,struct socket * so,u_int32_t dst,struct mbuf * control)347 rip_output(
348 struct mbuf *m,
349 struct socket *so,
350 u_int32_t dst,
351 struct mbuf *control)
352 {
353 struct ip *ip;
354 struct inpcb *inp = sotoinpcb(so);
355 int flags = (so->so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
356 int inp_flags = inp ? inp->inp_flags : 0;
357 struct ip_out_args ipoa;
358 struct ip_moptions *imo;
359 int tos = IPTOS_UNSPEC;
360 int error = 0;
361 #if CONTENT_FILTER
362 struct m_tag *cfil_tag = NULL;
363 bool cfil_faddr_use = false;
364 uint32_t cfil_so_state_change_cnt = 0;
365 uint32_t cfil_so_options = 0;
366 int cfil_inp_flags = 0;
367 struct sockaddr *cfil_faddr = NULL;
368 struct sockaddr_in *cfil_sin;
369 #endif
370
371 #if CONTENT_FILTER
372 /*
373 * If socket is subject to Content Filter and no addr is passed in,
374 * retrieve CFIL saved state from mbuf and use it if necessary.
375 */
376 if (CFIL_DGRAM_FILTERED(so) && dst == INADDR_ANY) {
377 cfil_tag = cfil_dgram_get_socket_state(m, &cfil_so_state_change_cnt, &cfil_so_options, &cfil_faddr, &cfil_inp_flags);
378 if (cfil_tag) {
379 cfil_sin = SIN(cfil_faddr);
380 flags = (cfil_so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
381 inp_flags = cfil_inp_flags;
382 if (inp && inp->inp_faddr.s_addr == INADDR_ANY) {
383 /*
384 * Socket is unconnected, simply use the saved faddr as 'addr' to go through
385 * the connect/disconnect logic.
386 */
387 dst = cfil_sin->sin_addr.s_addr;
388 } else if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
389 (inp->inp_fport != cfil_sin->sin_port ||
390 inp->inp_faddr.s_addr != cfil_sin->sin_addr.s_addr)) {
391 /*
392 * Socket is connected but socket state and dest addr/port changed.
393 * We need to use the saved faddr and socket options.
394 */
395 cfil_faddr_use = true;
396 }
397 m_tag_free(cfil_tag);
398 }
399 }
400 #endif
401
402 if (so->so_state & SS_ISCONNECTED) {
403 if (dst != INADDR_ANY) {
404 if (m != NULL) {
405 m_freem(m);
406 }
407 if (control != NULL) {
408 m_freem(control);
409 }
410 return EISCONN;
411 }
412 dst = cfil_faddr_use ? cfil_sin->sin_addr.s_addr : inp->inp_faddr.s_addr;
413 } else {
414 if (dst == INADDR_ANY) {
415 if (m != NULL) {
416 m_freem(m);
417 }
418 if (control != NULL) {
419 m_freem(control);
420 }
421 return ENOTCONN;
422 }
423 }
424
425 bzero(&ipoa, sizeof(ipoa));
426 ipoa.ipoa_boundif = IFSCOPE_NONE;
427 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF;
428
429 int sotc = SO_TC_UNSPEC;
430 int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
431
432
433 if (control != NULL) {
434 tos = so_tos_from_control(control);
435 sotc = so_tc_from_control(control, &netsvctype);
436
437 m_freem(control);
438 control = NULL;
439 }
440 if (sotc == SO_TC_UNSPEC) {
441 sotc = so->so_traffic_class;
442 netsvctype = so->so_netsvctype;
443 }
444
445 if (inp == NULL
446 #if NECP
447 || (necp_socket_should_use_flow_divert(inp))
448 #endif /* NECP */
449 ) {
450 if (m != NULL) {
451 m_freem(m);
452 }
453 VERIFY(control == NULL);
454 return inp == NULL ? EINVAL : EPROTOTYPE;
455 }
456
457 flags |= IP_OUTARGS;
458 /* If socket was bound to an ifindex, tell ip_output about it */
459 if (inp->inp_flags & INP_BOUND_IF) {
460 ipoa.ipoa_boundif = inp->inp_boundifp->if_index;
461 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
462 }
463 if (INP_NO_CELLULAR(inp)) {
464 ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
465 }
466 if (INP_NO_EXPENSIVE(inp)) {
467 ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
468 }
469 if (INP_NO_CONSTRAINED(inp)) {
470 ipoa.ipoa_flags |= IPOAF_NO_CONSTRAINED;
471 }
472 if (INP_AWDL_UNRESTRICTED(inp)) {
473 ipoa.ipoa_flags |= IPOAF_AWDL_UNRESTRICTED;
474 }
475 ipoa.ipoa_sotc = sotc;
476 ipoa.ipoa_netsvctype = netsvctype;
477
478 if (inp->inp_flowhash == 0) {
479 inp->inp_flowhash = inp_calc_flowhash(inp);
480 }
481
482 /*
483 * If the user handed us a complete IP packet, use it.
484 * Otherwise, allocate an mbuf for a header and fill it in.
485 */
486 if ((inp_flags & INP_HDRINCL) == 0) {
487 if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
488 m_freem(m);
489 return EMSGSIZE;
490 }
491 M_PREPEND(m, sizeof(struct ip), M_WAIT, 1);
492 if (m == NULL) {
493 return ENOBUFS;
494 }
495 ip = mtod(m, struct ip *);
496 if (tos != IPTOS_UNSPEC) {
497 ip->ip_tos = (uint8_t)(tos & IPTOS_MASK);
498 } else {
499 ip->ip_tos = inp->inp_ip_tos;
500 }
501 if (inp->inp_flags2 & INP2_DONTFRAG) {
502 ip->ip_off = IP_DF;
503 } else {
504 ip->ip_off = 0;
505 }
506 ip->ip_p = inp->inp_ip_p;
507 ip->ip_len = (uint16_t)m->m_pkthdr.len;
508 ip->ip_src = inp->inp_laddr;
509 ip->ip_dst.s_addr = dst;
510 ip->ip_ttl = inp->inp_ip_ttl;
511 } else {
512 if (m->m_pkthdr.len > IP_MAXPACKET) {
513 m_freem(m);
514 return EMSGSIZE;
515 }
516 ip = mtod(m, struct ip *);
517 /*
518 * don't allow both user specified and setsockopt options,
519 * and don't allow packet length sizes that will crash
520 */
521 if (m->m_pkthdr.len < sizeof(struct ip) ||
522 ((IP_VHL_HL(ip->ip_vhl) != (sizeof(*ip) >> 2)) && inp->inp_options) ||
523 (ip->ip_len > m->m_pkthdr.len) ||
524 (ip->ip_len < (IP_VHL_HL(ip->ip_vhl) << 2))) {
525 m_freem(m);
526 return EINVAL;
527 }
528 if (ip->ip_id == 0 && !(rfc6864 && IP_OFF_IS_ATOMIC(ntohs(ip->ip_off)))) {
529 ip->ip_id = ip_randomid((uint64_t)m);
530 }
531 /* XXX prevent ip_output from overwriting header fields */
532 flags |= IP_RAWOUTPUT;
533 OSAddAtomic(1, &ipstat.ips_rawout);
534 }
535
536 if (inp->inp_laddr.s_addr != INADDR_ANY) {
537 ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
538 }
539
540 #if NECP
541 {
542 necp_kernel_policy_id policy_id;
543 necp_kernel_policy_id skip_policy_id;
544 u_int32_t route_rule_id;
545 u_int32_t pass_flags;
546
547 /*
548 * We need a route to perform NECP route rule checks
549 */
550 if ((net_qos_policy_restricted != 0 &&
551 ROUTE_UNUSABLE(&inp->inp_route))
552 #if CONTENT_FILTER
553 || cfil_faddr_use
554 #endif
555 ) {
556 struct sockaddr_in to;
557 struct sockaddr_in from;
558 struct in_addr laddr = ip->ip_src;
559
560 ROUTE_RELEASE(&inp->inp_route);
561
562 bzero(&from, sizeof(struct sockaddr_in));
563 from.sin_family = AF_INET;
564 from.sin_len = sizeof(struct sockaddr_in);
565 from.sin_addr = laddr;
566
567 bzero(&to, sizeof(struct sockaddr_in));
568 to.sin_family = AF_INET;
569 to.sin_len = sizeof(struct sockaddr_in);
570 to.sin_addr.s_addr = ip->ip_dst.s_addr;
571
572 if ((error = in_pcbladdr(inp, (struct sockaddr *)&to,
573 &laddr, ipoa.ipoa_boundif, NULL, 1)) != 0) {
574 printf("%s in_pcbladdr(%p) error %d\n",
575 __func__, inp, error);
576 m_freem(m);
577 return error;
578 }
579
580 inp_update_necp_policy(inp, (struct sockaddr *)&from,
581 (struct sockaddr *)&to, ipoa.ipoa_boundif);
582 inp->inp_policyresult.results.qos_marking_gencount = 0;
583 }
584
585 if (!necp_socket_is_allowed_to_send_recv_v4(inp, 0, 0,
586 &ip->ip_src, &ip->ip_dst, NULL, 0, &policy_id, &route_rule_id, &skip_policy_id, &pass_flags)) {
587 m_freem(m);
588 return EHOSTUNREACH;
589 }
590
591 necp_mark_packet_from_socket(m, inp, policy_id, route_rule_id, skip_policy_id, pass_flags);
592
593 if (net_qos_policy_restricted != 0) {
594 struct ifnet *rt_ifp = NULL;
595
596 if (inp->inp_route.ro_rt != NULL) {
597 rt_ifp = inp->inp_route.ro_rt->rt_ifp;
598 }
599
600 necp_socket_update_qos_marking(inp, inp->inp_route.ro_rt, route_rule_id);
601 }
602 }
603 #endif /* NECP */
604 if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
605 ipoa.ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
606 }
607 #if IPSEC
608 if (inp->inp_sp != NULL && ipsec_setsocket(m, so) != 0) {
609 m_freem(m);
610 return ENOBUFS;
611 }
612 #endif /*IPSEC*/
613
614 if (ROUTE_UNUSABLE(&inp->inp_route)) {
615 ROUTE_RELEASE(&inp->inp_route);
616 }
617
618 set_packet_service_class(m, so, sotc, 0);
619 m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
620 m->m_pkthdr.pkt_flowid = inp->inp_flowhash;
621 m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC |
622 PKTF_FLOW_RAWSOCK);
623 m->m_pkthdr.pkt_proto = inp->inp_ip_p;
624 m->m_pkthdr.tx_rawip_pid = so->last_pid;
625 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
626 if (so->so_flags & SOF_DELEGATED) {
627 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
628 } else {
629 m->m_pkthdr.tx_rawip_e_pid = 0;
630 }
631 #if (DEBUG || DEVELOPMENT)
632 if (so->so_flags & SOF_MARK_WAKE_PKT) {
633 so->so_flags &= ~SOF_MARK_WAKE_PKT;
634 m->m_pkthdr.pkt_flags |= PKTF_WAKE_PKT;
635 }
636 #endif /* (DEBUG || DEVELOPMENT) */
637
638 imo = inp->inp_moptions;
639 if (imo != NULL) {
640 IMO_ADDREF(imo);
641 }
642 /*
643 * The domain lock is held across ip_output, so it is okay
644 * to pass the PCB cached route pointer directly to IP and
645 * the modules beneath it.
646 */
647 // TODO: PASS DOWN ROUTE RULE ID
648 error = ip_output(m, inp->inp_options, &inp->inp_route, flags,
649 imo, &ipoa);
650
651 if (imo != NULL) {
652 IMO_REMREF(imo);
653 }
654
655 if (inp->inp_route.ro_rt != NULL) {
656 struct rtentry *rt = inp->inp_route.ro_rt;
657 struct ifnet *outif;
658
659 if ((rt->rt_flags & (RTF_MULTICAST | RTF_BROADCAST)) ||
660 inp->inp_socket == NULL ||
661 #if CONTENT_FILTER
662 /* Discard temporary route for cfil case */
663 cfil_faddr_use ||
664 #endif
665 !(inp->inp_socket->so_state & SS_ISCONNECTED)) {
666 rt = NULL; /* unusable */
667 }
668 /*
669 * Always discard the cached route for unconnected
670 * socket or if it is a multicast route.
671 */
672 if (rt == NULL) {
673 ROUTE_RELEASE(&inp->inp_route);
674 }
675
676 /*
677 * If this is a connected socket and the destination
678 * route is unicast, update outif with that of the
679 * route interface used by IP.
680 */
681 if (rt != NULL &&
682 (outif = rt->rt_ifp) != inp->inp_last_outifp) {
683 inp->inp_last_outifp = outif;
684 }
685 } else {
686 ROUTE_RELEASE(&inp->inp_route);
687 }
688
689 /*
690 * If output interface was cellular/expensive/constrained, and this socket is
691 * denied access to it, generate an event.
692 */
693 if (error != 0 && (ipoa.ipoa_flags & IPOAF_R_IFDENIED) &&
694 (INP_NO_CELLULAR(inp) || INP_NO_EXPENSIVE(inp) || INP_NO_CONSTRAINED(inp))) {
695 soevent(so, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
696 }
697
698 return error;
699 }
700
701
702 /*
703 * Raw IP socket option processing.
704 */
705 int
rip_ctloutput(struct socket * so,struct sockopt * sopt)706 rip_ctloutput(struct socket *so, struct sockopt *sopt)
707 {
708 struct inpcb *inp = sotoinpcb(so);
709 int error, optval;
710
711 /* Allow <SOL_SOCKET,SO_FLUSH> at this level */
712 if (sopt->sopt_level != IPPROTO_IP &&
713 !(sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_FLUSH)) {
714 return EINVAL;
715 }
716
717 error = 0;
718
719 switch (sopt->sopt_dir) {
720 case SOPT_GET:
721 switch (sopt->sopt_name) {
722 case IP_HDRINCL:
723 optval = inp->inp_flags & INP_HDRINCL;
724 error = sooptcopyout(sopt, &optval, sizeof optval);
725 break;
726
727 case IP_STRIPHDR:
728 optval = inp->inp_flags & INP_STRIPHDR;
729 error = sooptcopyout(sopt, &optval, sizeof optval);
730 break;
731
732
733 #if DUMMYNET
734 case IP_DUMMYNET_GET:
735 if (!DUMMYNET_LOADED) {
736 ip_dn_init();
737 }
738 if (DUMMYNET_LOADED) {
739 error = ip_dn_ctl_ptr(sopt);
740 } else {
741 error = ENOPROTOOPT;
742 }
743 break;
744 #endif /* DUMMYNET */
745
746 default:
747 error = ip_ctloutput(so, sopt);
748 break;
749 }
750 break;
751
752 case SOPT_SET:
753 switch (sopt->sopt_name) {
754 case IP_HDRINCL:
755 error = sooptcopyin(sopt, &optval, sizeof optval,
756 sizeof optval);
757 if (error) {
758 break;
759 }
760 if (optval) {
761 inp->inp_flags |= INP_HDRINCL;
762 } else {
763 inp->inp_flags &= ~INP_HDRINCL;
764 }
765 break;
766
767 case IP_STRIPHDR:
768 error = sooptcopyin(sopt, &optval, sizeof optval,
769 sizeof optval);
770 if (error) {
771 break;
772 }
773 if (optval) {
774 inp->inp_flags |= INP_STRIPHDR;
775 } else {
776 inp->inp_flags &= ~INP_STRIPHDR;
777 }
778 break;
779
780
781 #if DUMMYNET
782 case IP_DUMMYNET_CONFIGURE:
783 case IP_DUMMYNET_DEL:
784 case IP_DUMMYNET_FLUSH:
785 if (!DUMMYNET_LOADED) {
786 ip_dn_init();
787 }
788 if (DUMMYNET_LOADED) {
789 error = ip_dn_ctl_ptr(sopt);
790 } else {
791 error = ENOPROTOOPT;
792 }
793 break;
794 #endif /* DUMMYNET */
795
796 case SO_FLUSH:
797 if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
798 sizeof(optval))) != 0) {
799 break;
800 }
801
802 error = inp_flush(inp, optval);
803 break;
804
805 default:
806 error = ip_ctloutput(so, sopt);
807 break;
808 }
809 break;
810 }
811
812 return error;
813 }
814
815 /*
816 * This function exists solely to receive the PRC_IFDOWN messages which
817 * are sent by if_down(). It looks for an ifaddr whose ifa_addr is sa,
818 * and calls in_ifadown() to remove all routes corresponding to that address.
819 * It also receives the PRC_IFUP messages from if_up() and reinstalls the
820 * interface routes.
821 */
822 void
rip_ctlinput(int cmd,struct sockaddr * sa,__unused void * vip,__unused struct ifnet * ifp)823 rip_ctlinput(
824 int cmd,
825 struct sockaddr *sa,
826 __unused void *vip,
827 __unused struct ifnet *ifp)
828 {
829 struct in_ifaddr *ia = NULL;
830 struct ifnet *iaifp = NULL;
831 int err = 0;
832 int flags, done = 0;
833
834 switch (cmd) {
835 case PRC_IFDOWN:
836 lck_rw_lock_shared(&in_ifaddr_rwlock);
837 for (ia = in_ifaddrhead.tqh_first; ia;
838 ia = ia->ia_link.tqe_next) {
839 IFA_LOCK(&ia->ia_ifa);
840 if (ia->ia_ifa.ifa_addr == sa &&
841 (ia->ia_flags & IFA_ROUTE)) {
842 done = 1;
843 IFA_ADDREF_LOCKED(&ia->ia_ifa);
844 IFA_UNLOCK(&ia->ia_ifa);
845 lck_rw_done(&in_ifaddr_rwlock);
846 lck_mtx_lock(rnh_lock);
847 /*
848 * in_ifscrub kills the interface route.
849 */
850 in_ifscrub(ia->ia_ifp, ia, 1);
851 /*
852 * in_ifadown gets rid of all the rest of
853 * the routes. This is not quite the right
854 * thing to do, but at least if we are running
855 * a routing process they will come back.
856 */
857 in_ifadown(&ia->ia_ifa, 1);
858 lck_mtx_unlock(rnh_lock);
859 IFA_REMREF(&ia->ia_ifa);
860 break;
861 }
862 IFA_UNLOCK(&ia->ia_ifa);
863 }
864 if (!done) {
865 lck_rw_done(&in_ifaddr_rwlock);
866 }
867 break;
868
869 case PRC_IFUP:
870 lck_rw_lock_shared(&in_ifaddr_rwlock);
871 for (ia = in_ifaddrhead.tqh_first; ia;
872 ia = ia->ia_link.tqe_next) {
873 IFA_LOCK(&ia->ia_ifa);
874 if (ia->ia_ifa.ifa_addr == sa) {
875 /* keep it locked */
876 break;
877 }
878 IFA_UNLOCK(&ia->ia_ifa);
879 }
880 if (ia == NULL || (ia->ia_flags & IFA_ROUTE) ||
881 (ia->ia_ifa.ifa_debug & IFD_NOTREADY)) {
882 if (ia != NULL) {
883 IFA_UNLOCK(&ia->ia_ifa);
884 }
885 lck_rw_done(&in_ifaddr_rwlock);
886 return;
887 }
888 IFA_ADDREF_LOCKED(&ia->ia_ifa);
889 IFA_UNLOCK(&ia->ia_ifa);
890 lck_rw_done(&in_ifaddr_rwlock);
891
892 flags = RTF_UP;
893 iaifp = ia->ia_ifa.ifa_ifp;
894
895 if ((iaifp->if_flags & IFF_LOOPBACK)
896 || (iaifp->if_flags & IFF_POINTOPOINT)) {
897 flags |= RTF_HOST;
898 }
899
900 err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
901 if (err == 0) {
902 IFA_LOCK_SPIN(&ia->ia_ifa);
903 ia->ia_flags |= IFA_ROUTE;
904 IFA_UNLOCK(&ia->ia_ifa);
905 }
906 IFA_REMREF(&ia->ia_ifa);
907 break;
908 }
909 }
910
911 u_int32_t rip_sendspace = RIPSNDQ;
912 u_int32_t rip_recvspace = RIPRCVQ;
913
914 SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW | CTLFLAG_LOCKED,
915 &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
916 SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW | CTLFLAG_LOCKED,
917 &rip_recvspace, 0, "Maximum incoming raw IP datagram size");
918 SYSCTL_UINT(_net_inet_raw, OID_AUTO, pcbcount, CTLFLAG_RD | CTLFLAG_LOCKED,
919 &ripcbinfo.ipi_count, 0, "Number of active PCBs");
920
921 static int
rip_attach(struct socket * so,int proto,struct proc * p)922 rip_attach(struct socket *so, int proto, struct proc *p)
923 {
924 struct inpcb *inp;
925 int error;
926
927 inp = sotoinpcb(so);
928 if (inp) {
929 panic("rip_attach");
930 }
931 if ((so->so_state & SS_PRIV) == 0) {
932 return EPERM;
933 }
934 if (proto > UINT8_MAX) {
935 return EINVAL;
936 }
937
938 error = soreserve(so, rip_sendspace, rip_recvspace);
939 if (error) {
940 return error;
941 }
942 error = in_pcballoc(so, &ripcbinfo, p);
943 if (error) {
944 return error;
945 }
946 inp = (struct inpcb *)so->so_pcb;
947 inp->inp_vflag |= INP_IPV4;
948 VERIFY(proto <= UINT8_MAX);
949 inp->inp_ip_p = (u_char)proto;
950 inp->inp_ip_ttl = (u_char)ip_defttl;
951 return 0;
952 }
953
954 __private_extern__ int
rip_detach(struct socket * so)955 rip_detach(struct socket *so)
956 {
957 struct inpcb *inp;
958
959 inp = sotoinpcb(so);
960 if (inp == 0) {
961 panic("rip_detach");
962 }
963 in_pcbdetach(inp);
964 return 0;
965 }
966
967 __private_extern__ int
rip_abort(struct socket * so)968 rip_abort(struct socket *so)
969 {
970 soisdisconnected(so);
971 return rip_detach(so);
972 }
973
974 __private_extern__ int
rip_disconnect(struct socket * so)975 rip_disconnect(struct socket *so)
976 {
977 if ((so->so_state & SS_ISCONNECTED) == 0) {
978 return ENOTCONN;
979 }
980 return rip_abort(so);
981 }
982
983 __private_extern__ int
rip_bind(struct socket * so,struct sockaddr * nam,struct proc * p)984 rip_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
985 {
986 #pragma unused(p)
987 struct inpcb *inp = sotoinpcb(so);
988 struct sockaddr_in sin;
989 struct ifaddr *ifa = NULL;
990 struct ifnet *outif = NULL;
991
992 if (inp == NULL
993 #if NECP
994 || (necp_socket_should_use_flow_divert(inp))
995 #endif /* NECP */
996 ) {
997 return inp == NULL ? EINVAL : EPROTOTYPE;
998 }
999
1000 if (nam->sa_len != sizeof(struct sockaddr_in)) {
1001 return EINVAL;
1002 }
1003
1004 /* Sanitized local copy for interface address searches */
1005 bzero(&sin, sizeof(sin));
1006 sin.sin_family = AF_INET;
1007 sin.sin_len = sizeof(struct sockaddr_in);
1008 sin.sin_addr.s_addr = SIN(nam)->sin_addr.s_addr;
1009
1010 if (TAILQ_EMPTY(&ifnet_head) ||
1011 (sin.sin_family != AF_INET && sin.sin_family != AF_IMPLINK) ||
1012 (sin.sin_addr.s_addr && (ifa = ifa_ifwithaddr(SA(&sin))) == 0)) {
1013 return EADDRNOTAVAIL;
1014 } else if (ifa) {
1015 /*
1016 * Opportunistically determine the outbound
1017 * interface that may be used; this may not
1018 * hold true if we end up using a route
1019 * going over a different interface, e.g.
1020 * when sending to a local address. This
1021 * will get updated again after sending.
1022 */
1023 IFA_LOCK(ifa);
1024 outif = ifa->ifa_ifp;
1025 IFA_UNLOCK(ifa);
1026 IFA_REMREF(ifa);
1027 }
1028 inp->inp_laddr = sin.sin_addr;
1029 inp->inp_last_outifp = outif;
1030
1031 return 0;
1032 }
1033
1034 __private_extern__ int
rip_connect(struct socket * so,struct sockaddr * nam,__unused struct proc * p)1035 rip_connect(struct socket *so, struct sockaddr *nam, __unused struct proc *p)
1036 {
1037 struct inpcb *inp = sotoinpcb(so);
1038 struct sockaddr_in *addr = (struct sockaddr_in *)(void *)nam;
1039
1040 if (inp == NULL
1041 #if NECP
1042 || (necp_socket_should_use_flow_divert(inp))
1043 #endif /* NECP */
1044 ) {
1045 return inp == NULL ? EINVAL : EPROTOTYPE;
1046 }
1047 if (nam->sa_len != sizeof(*addr)) {
1048 return EINVAL;
1049 }
1050 if (TAILQ_EMPTY(&ifnet_head)) {
1051 return EADDRNOTAVAIL;
1052 }
1053 if ((addr->sin_family != AF_INET) &&
1054 (addr->sin_family != AF_IMPLINK)) {
1055 return EAFNOSUPPORT;
1056 }
1057
1058 if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
1059 so->so_flags1 |= SOF1_CONNECT_COUNTED;
1060 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
1061 }
1062
1063 inp->inp_faddr = addr->sin_addr;
1064 soisconnected(so);
1065
1066 return 0;
1067 }
1068
1069 __private_extern__ int
rip_shutdown(struct socket * so)1070 rip_shutdown(struct socket *so)
1071 {
1072 socantsendmore(so);
1073 return 0;
1074 }
1075
1076 __private_extern__ int
rip_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct proc * p)1077 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
1078 struct mbuf *control, struct proc *p)
1079 {
1080 #pragma unused(flags, p)
1081 struct inpcb *inp = sotoinpcb(so);
1082 u_int32_t dst = INADDR_ANY;
1083 int error = 0;
1084
1085 if (inp == NULL
1086 #if NECP
1087 || (necp_socket_should_use_flow_divert(inp) && (error = EPROTOTYPE))
1088 #endif /* NECP */
1089 ) {
1090 if (inp == NULL) {
1091 error = EINVAL;
1092 } else {
1093 error = EPROTOTYPE;
1094 }
1095 goto bad;
1096 }
1097
1098 if (nam != NULL) {
1099 dst = ((struct sockaddr_in *)(void *)nam)->sin_addr.s_addr;
1100 }
1101 return rip_output(m, so, dst, control);
1102
1103 bad:
1104 VERIFY(error != 0);
1105
1106 if (m != NULL) {
1107 m_freem(m);
1108 }
1109 if (control != NULL) {
1110 m_freem(control);
1111 }
1112
1113 return error;
1114 }
1115
1116 /* note: rip_unlock is called from different protos instead of the generic socket_unlock,
1117 * it will handle the socket dealloc on last reference
1118 * */
1119 int
rip_unlock(struct socket * so,int refcount,void * debug)1120 rip_unlock(struct socket *so, int refcount, void *debug)
1121 {
1122 void *lr_saved;
1123 struct inpcb *inp = sotoinpcb(so);
1124
1125 if (debug == NULL) {
1126 lr_saved = __builtin_return_address(0);
1127 } else {
1128 lr_saved = debug;
1129 }
1130
1131 if (refcount) {
1132 if (so->so_usecount <= 0) {
1133 panic("rip_unlock: bad refoucnt so=%p val=%x lrh= %s",
1134 so, so->so_usecount, solockhistory_nr(so));
1135 /* NOTREACHED */
1136 }
1137 so->so_usecount--;
1138 if (so->so_usecount == 0 && (inp->inp_wantcnt == WNT_STOPUSING)) {
1139 /* cleanup after last reference */
1140 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1141 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1142 if (inp->inp_state != INPCB_STATE_DEAD) {
1143 if (SOCK_CHECK_DOM(so, PF_INET6)) {
1144 in6_pcbdetach(inp);
1145 } else {
1146 in_pcbdetach(inp);
1147 }
1148 }
1149 in_pcbdispose(inp);
1150 lck_rw_done(&ripcbinfo.ipi_lock);
1151 return 0;
1152 }
1153 }
1154 so->unlock_lr[so->next_unlock_lr] = lr_saved;
1155 so->next_unlock_lr = (so->next_unlock_lr + 1) % SO_LCKDBG_MAX;
1156 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1157 return 0;
1158 }
1159
1160 static int
1161 rip_pcblist SYSCTL_HANDLER_ARGS
1162 {
1163 #pragma unused(oidp, arg1, arg2)
1164 int error, i, n, sz;
1165 struct inpcb *inp, **inp_list;
1166 inp_gen_t gencnt;
1167 struct xinpgen xig;
1168
1169 /*
1170 * The process of preparing the TCB list is too time-consuming and
1171 * resource-intensive to repeat twice on every request.
1172 */
1173 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1174 if (req->oldptr == USER_ADDR_NULL) {
1175 n = ripcbinfo.ipi_count;
1176 req->oldidx = 2 * (sizeof xig)
1177 + (n + n / 8) * sizeof(struct xinpcb);
1178 lck_rw_done(&ripcbinfo.ipi_lock);
1179 return 0;
1180 }
1181
1182 if (req->newptr != USER_ADDR_NULL) {
1183 lck_rw_done(&ripcbinfo.ipi_lock);
1184 return EPERM;
1185 }
1186
1187 /*
1188 * OK, now we're committed to doing something.
1189 */
1190 gencnt = ripcbinfo.ipi_gencnt;
1191 sz = n = ripcbinfo.ipi_count;
1192
1193 bzero(&xig, sizeof(xig));
1194 xig.xig_len = sizeof xig;
1195 xig.xig_count = n;
1196 xig.xig_gen = gencnt;
1197 xig.xig_sogen = so_gencnt;
1198 error = SYSCTL_OUT(req, &xig, sizeof xig);
1199 if (error) {
1200 lck_rw_done(&ripcbinfo.ipi_lock);
1201 return error;
1202 }
1203 /*
1204 * We are done if there is no pcb
1205 */
1206 if (n == 0) {
1207 lck_rw_done(&ripcbinfo.ipi_lock);
1208 return 0;
1209 }
1210
1211 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1212 if (inp_list == NULL) {
1213 lck_rw_done(&ripcbinfo.ipi_lock);
1214 return ENOMEM;
1215 }
1216
1217 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1218 inp = inp->inp_list.le_next) {
1219 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1220 inp_list[i++] = inp;
1221 }
1222 }
1223 n = i;
1224
1225 error = 0;
1226 for (i = 0; i < n; i++) {
1227 inp = inp_list[i];
1228 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1229 struct xinpcb xi;
1230
1231 bzero(&xi, sizeof(xi));
1232 xi.xi_len = sizeof xi;
1233 /* XXX should avoid extra copy */
1234 inpcb_to_compat(inp, &xi.xi_inp);
1235 if (inp->inp_socket) {
1236 sotoxsocket(inp->inp_socket, &xi.xi_socket);
1237 }
1238 error = SYSCTL_OUT(req, &xi, sizeof xi);
1239 }
1240 }
1241 if (!error) {
1242 /*
1243 * Give the user an updated idea of our state.
1244 * If the generation differs from what we told
1245 * her before, she knows that something happened
1246 * while we were processing this request, and it
1247 * might be necessary to retry.
1248 */
1249 bzero(&xig, sizeof(xig));
1250 xig.xig_len = sizeof xig;
1251 xig.xig_gen = ripcbinfo.ipi_gencnt;
1252 xig.xig_sogen = so_gencnt;
1253 xig.xig_count = ripcbinfo.ipi_count;
1254 error = SYSCTL_OUT(req, &xig, sizeof xig);
1255 }
1256
1257 lck_rw_done(&ripcbinfo.ipi_lock);
1258 kfree_type(struct inpcb *, sz, inp_list);
1259 return error;
1260 }
1261
1262 SYSCTL_PROC(_net_inet_raw, OID_AUTO /*XXX*/, pcblist,
1263 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1264 rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
1265
1266 #if XNU_TARGET_OS_OSX
1267
1268 static int
1269 rip_pcblist64 SYSCTL_HANDLER_ARGS
1270 {
1271 #pragma unused(oidp, arg1, arg2)
1272 int error, i, n, sz;
1273 struct inpcb *inp, **inp_list;
1274 inp_gen_t gencnt;
1275 struct xinpgen xig;
1276
1277 /*
1278 * The process of preparing the TCB list is too time-consuming and
1279 * resource-intensive to repeat twice on every request.
1280 */
1281 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1282 if (req->oldptr == USER_ADDR_NULL) {
1283 n = ripcbinfo.ipi_count;
1284 req->oldidx = 2 * (sizeof xig)
1285 + (n + n / 8) * sizeof(struct xinpcb64);
1286 lck_rw_done(&ripcbinfo.ipi_lock);
1287 return 0;
1288 }
1289
1290 if (req->newptr != USER_ADDR_NULL) {
1291 lck_rw_done(&ripcbinfo.ipi_lock);
1292 return EPERM;
1293 }
1294
1295 /*
1296 * OK, now we're committed to doing something.
1297 */
1298 gencnt = ripcbinfo.ipi_gencnt;
1299 sz = n = ripcbinfo.ipi_count;
1300
1301 bzero(&xig, sizeof(xig));
1302 xig.xig_len = sizeof xig;
1303 xig.xig_count = n;
1304 xig.xig_gen = gencnt;
1305 xig.xig_sogen = so_gencnt;
1306 error = SYSCTL_OUT(req, &xig, sizeof xig);
1307 if (error) {
1308 lck_rw_done(&ripcbinfo.ipi_lock);
1309 return error;
1310 }
1311 /*
1312 * We are done if there is no pcb
1313 */
1314 if (n == 0) {
1315 lck_rw_done(&ripcbinfo.ipi_lock);
1316 return 0;
1317 }
1318
1319 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1320 if (inp_list == NULL) {
1321 lck_rw_done(&ripcbinfo.ipi_lock);
1322 return ENOMEM;
1323 }
1324
1325 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1326 inp = inp->inp_list.le_next) {
1327 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1328 inp_list[i++] = inp;
1329 }
1330 }
1331 n = i;
1332
1333 error = 0;
1334 for (i = 0; i < n; i++) {
1335 inp = inp_list[i];
1336 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1337 struct xinpcb64 xi;
1338
1339 bzero(&xi, sizeof(xi));
1340 xi.xi_len = sizeof xi;
1341 inpcb_to_xinpcb64(inp, &xi);
1342 if (inp->inp_socket) {
1343 sotoxsocket64(inp->inp_socket, &xi.xi_socket);
1344 }
1345 error = SYSCTL_OUT(req, &xi, sizeof xi);
1346 }
1347 }
1348 if (!error) {
1349 /*
1350 * Give the user an updated idea of our state.
1351 * If the generation differs from what we told
1352 * her before, she knows that something happened
1353 * while we were processing this request, and it
1354 * might be necessary to retry.
1355 */
1356 bzero(&xig, sizeof(xig));
1357 xig.xig_len = sizeof xig;
1358 xig.xig_gen = ripcbinfo.ipi_gencnt;
1359 xig.xig_sogen = so_gencnt;
1360 xig.xig_count = ripcbinfo.ipi_count;
1361 error = SYSCTL_OUT(req, &xig, sizeof xig);
1362 }
1363
1364 lck_rw_done(&ripcbinfo.ipi_lock);
1365 kfree_type(struct inpcb *, sz, inp_list);
1366 return error;
1367 }
1368
1369 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist64,
1370 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1371 rip_pcblist64, "S,xinpcb64", "List of active raw IP sockets");
1372
1373 #endif /* XNU_TARGET_OS_OSX */
1374
1375
1376 static int
1377 rip_pcblist_n SYSCTL_HANDLER_ARGS
1378 {
1379 #pragma unused(oidp, arg1, arg2)
1380 int error = 0;
1381
1382 error = get_pcblist_n(IPPROTO_IP, req, &ripcbinfo);
1383
1384 return error;
1385 }
1386
1387 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist_n,
1388 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1389 rip_pcblist_n, "S,xinpcb_n", "List of active raw IP sockets");
1390
1391 struct pr_usrreqs rip_usrreqs = {
1392 .pru_abort = rip_abort,
1393 .pru_attach = rip_attach,
1394 .pru_bind = rip_bind,
1395 .pru_connect = rip_connect,
1396 .pru_control = in_control,
1397 .pru_detach = rip_detach,
1398 .pru_disconnect = rip_disconnect,
1399 .pru_peeraddr = in_getpeeraddr,
1400 .pru_send = rip_send,
1401 .pru_shutdown = rip_shutdown,
1402 .pru_sockaddr = in_getsockaddr,
1403 .pru_sosend = sosend,
1404 .pru_soreceive = soreceive,
1405 };
1406 /* DSEP Review Done pl-20051213-v02 @3253 */
1407