1 /*
2 * Copyright (c) 2000-2022 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1988, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)raw_ip.c 8.7 (Berkeley) 5/15/95
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/malloc.h>
73 #include <sys/mbuf.h>
74 #include <sys/mcache.h>
75 #include <sys/proc.h>
76 #include <sys/domain.h>
77 #include <sys/protosw.h>
78 #include <sys/socket.h>
79 #include <sys/socketvar.h>
80 #include <sys/sysctl.h>
81 #include <libkern/OSAtomic.h>
82 #include <kern/zalloc.h>
83
84 #include <pexpert/pexpert.h>
85
86 #include <net/if.h>
87 #include <net/net_api_stats.h>
88 #include <net/route.h>
89 #include <net/content_filter.h>
90
91 #define _IP_VHL
92 #include <netinet/in.h>
93 #include <netinet/in_systm.h>
94 #include <netinet/in_tclass.h>
95 #include <netinet/ip.h>
96 #include <netinet/in_pcb.h>
97 #include <netinet/in_var.h>
98 #include <netinet/ip_var.h>
99
100 #include <netinet6/in6_pcb.h>
101
102
103 #if IPSEC
104 #include <netinet6/ipsec.h>
105 #endif /*IPSEC*/
106
107 #if DUMMYNET
108 #include <netinet/ip_dummynet.h>
109 #endif /* DUMMYNET */
110
111 int rip_detach(struct socket *);
112 int rip_abort(struct socket *);
113 int rip_disconnect(struct socket *);
114 int rip_bind(struct socket *, struct sockaddr *, struct proc *);
115 int rip_connect(struct socket *, struct sockaddr *, struct proc *);
116 int rip_shutdown(struct socket *);
117
118 struct inpcbhead ripcb;
119 struct inpcbinfo ripcbinfo;
120
121 /* control hooks for dummynet */
122 #if DUMMYNET
123 ip_dn_ctl_t *ip_dn_ctl_ptr;
124 #endif /* DUMMYNET */
125
126 /*
127 * Nominal space allocated to a raw ip socket.
128 */
129 #define RIPSNDQ 8192
130 #define RIPRCVQ 8192
131
132 /*
133 * Raw interface to IP protocol.
134 */
135
136 /*
137 * Initialize raw connection block q.
138 */
139 void
rip_init(struct protosw * pp,struct domain * dp)140 rip_init(struct protosw *pp, struct domain *dp)
141 {
142 #pragma unused(dp)
143 static int rip_initialized = 0;
144 struct inpcbinfo *pcbinfo;
145
146 VERIFY((pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
147
148 if (rip_initialized) {
149 return;
150 }
151 rip_initialized = 1;
152
153 LIST_INIT(&ripcb);
154 ripcbinfo.ipi_listhead = &ripcb;
155 /*
156 * XXX We don't use the hash list for raw IP, but it's easier
157 * to allocate a one entry hash list than it is to check all
158 * over the place for ipi_hashbase == NULL.
159 */
160 ripcbinfo.ipi_hashbase = hashinit(1, M_PCB, &ripcbinfo.ipi_hashmask);
161 ripcbinfo.ipi_porthashbase = hashinit(1, M_PCB, &ripcbinfo.ipi_porthashmask);
162
163 ripcbinfo.ipi_zone = zone_create("ripzone", sizeof(struct inpcb),
164 ZC_NONE);
165
166 pcbinfo = &ripcbinfo;
167 /*
168 * allocate lock group attribute and group for udp pcb mutexes
169 */
170 pcbinfo->ipi_lock_grp = lck_grp_alloc_init("ripcb", LCK_GRP_ATTR_NULL);
171
172 /*
173 * allocate the lock attribute for udp pcb mutexes
174 */
175 lck_attr_setdefault(&pcbinfo->ipi_lock_attr);
176 lck_rw_init(&pcbinfo->ipi_lock, pcbinfo->ipi_lock_grp,
177 &pcbinfo->ipi_lock_attr);
178
179 in_pcbinfo_attach(&ripcbinfo);
180 }
181
182 static struct sockaddr_in ripsrc = {
183 .sin_len = sizeof(ripsrc),
184 .sin_family = AF_INET,
185 .sin_port = 0,
186 .sin_addr = { .s_addr = 0 },
187 .sin_zero = {0, 0, 0, 0, 0, 0, 0, 0, }
188 };
189
190 /*
191 * Setup generic address and protocol structures
192 * for raw_input routine, then pass them along with
193 * mbuf chain.
194 */
195 void
rip_input(struct mbuf * m,int iphlen)196 rip_input(struct mbuf *m, int iphlen)
197 {
198 struct ip *ip = mtod(m, struct ip *);
199 struct inpcb *inp;
200 struct inpcb *last = 0;
201 struct mbuf *opts = 0;
202 int skipit = 0, ret = 0;
203 struct ifnet *ifp = m->m_pkthdr.rcvif;
204
205 /* Expect 32-bit aligned data pointer on strict-align platforms */
206 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
207
208 ripsrc.sin_addr = ip->ip_src;
209 lck_rw_lock_shared(&ripcbinfo.ipi_lock);
210 LIST_FOREACH(inp, &ripcb, inp_list) {
211 if ((inp->inp_vflag & INP_IPV4) == 0) {
212 continue;
213 }
214 if (inp->inp_ip_p && (inp->inp_ip_p != ip->ip_p)) {
215 continue;
216 }
217 if (inp->inp_laddr.s_addr &&
218 inp->inp_laddr.s_addr != ip->ip_dst.s_addr) {
219 continue;
220 }
221 if (inp->inp_faddr.s_addr &&
222 inp->inp_faddr.s_addr != ip->ip_src.s_addr) {
223 continue;
224 }
225 if (inp_restricted_recv(inp, ifp)) {
226 continue;
227 }
228 if (last) {
229 struct mbuf *n = m_copy(m, 0, (int)M_COPYALL);
230
231 skipit = 0;
232
233 #if NECP
234 if (n && !necp_socket_is_allowed_to_send_recv_v4(last, 0, 0,
235 &ip->ip_dst, &ip->ip_src, ifp, 0, NULL, NULL, NULL, NULL)) {
236 m_freem(n);
237 /* do not inject data to pcb */
238 skipit = 1;
239 }
240 #endif /* NECP */
241 if (n && skipit == 0) {
242 int error = 0;
243 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
244 SOFLOW_ENABLED(last->inp_socket) ||
245 (last->inp_socket->so_options & SO_TIMESTAMP) != 0 ||
246 (last->inp_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
247 (last->inp_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
248 ret = ip_savecontrol(last, &opts, ip, n);
249 if (ret != 0) {
250 m_freem(n);
251 m_freem(opts);
252 last = inp;
253 continue;
254 }
255 }
256 if (last->inp_flags & INP_STRIPHDR
257 #if CONTENT_FILTER
258 /*
259 * If socket is subject to Content Filter, delay stripping until reinject
260 */
261 && (!CFIL_DGRAM_FILTERED(last->inp_socket))
262 #endif
263 ) {
264 n->m_len -= iphlen;
265 n->m_pkthdr.len -= iphlen;
266 n->m_data += iphlen;
267 }
268 so_recv_data_stat(last->inp_socket, m, 0);
269 if (sbappendaddr(&last->inp_socket->so_rcv,
270 (struct sockaddr *)&ripsrc, n,
271 opts, &error) != 0) {
272 sorwakeup(last->inp_socket);
273 } else {
274 if (error) {
275 /* should notify about lost packet */
276 ipstat.ips_raw_sappend_fail++;
277 }
278 }
279 opts = 0;
280 }
281 }
282 last = inp;
283 }
284
285 skipit = 0;
286 #if NECP
287 if (last && !necp_socket_is_allowed_to_send_recv_v4(last, 0, 0,
288 &ip->ip_dst, &ip->ip_src, ifp, 0, NULL, NULL, NULL, NULL)) {
289 m_freem(m);
290 OSAddAtomic(1, &ipstat.ips_delivered);
291 /* do not inject data to pcb */
292 skipit = 1;
293 }
294 #endif /* NECP */
295 if (skipit == 0) {
296 if (last) {
297 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
298 SOFLOW_ENABLED(last->inp_socket) ||
299 (last->inp_socket->so_options & SO_TIMESTAMP) != 0 ||
300 (last->inp_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
301 (last->inp_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
302 ret = ip_savecontrol(last, &opts, ip, m);
303 if (ret != 0) {
304 m_freem(m);
305 m_freem(opts);
306 goto unlock;
307 }
308 }
309 if (last->inp_flags & INP_STRIPHDR
310 #if CONTENT_FILTER
311 /*
312 * If socket is subject to Content Filter, delay stripping until reinject
313 */
314 && (!CFIL_DGRAM_FILTERED(last->inp_socket))
315 #endif
316 ) {
317 m->m_len -= iphlen;
318 m->m_pkthdr.len -= iphlen;
319 m->m_data += iphlen;
320 }
321 so_recv_data_stat(last->inp_socket, m, 0);
322 if (sbappendaddr(&last->inp_socket->so_rcv,
323 (struct sockaddr *)&ripsrc, m, opts, NULL) != 0) {
324 sorwakeup(last->inp_socket);
325 } else {
326 ipstat.ips_raw_sappend_fail++;
327 }
328 } else {
329 m_freem(m);
330 OSAddAtomic(1, &ipstat.ips_noproto);
331 OSAddAtomic(-1, &ipstat.ips_delivered);
332 }
333 }
334 unlock:
335 /*
336 * Keep the list locked because socket filter may force the socket lock
337 * to be released when calling sbappendaddr() -- see rdar://7627704
338 */
339 lck_rw_done(&ripcbinfo.ipi_lock);
340 }
341
342 /*
343 * Generate IP header and pass packet to ip_output.
344 * Tack on options user may have setup with control call.
345 */
346 int
rip_output(struct mbuf * m,struct socket * so,u_int32_t dst,struct mbuf * control)347 rip_output(
348 struct mbuf *m,
349 struct socket *so,
350 u_int32_t dst,
351 struct mbuf *control)
352 {
353 struct ip *ip;
354 struct inpcb *inp = sotoinpcb(so);
355 int flags = (so->so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
356 int inp_flags = inp ? inp->inp_flags : 0;
357 struct ip_out_args ipoa;
358 struct ip_moptions *imo;
359 int tos = IPTOS_UNSPEC;
360 int error = 0;
361 #if CONTENT_FILTER
362 struct m_tag *cfil_tag = NULL;
363 bool cfil_faddr_use = false;
364 uint32_t cfil_so_state_change_cnt = 0;
365 uint32_t cfil_so_options = 0;
366 int cfil_inp_flags = 0;
367 struct sockaddr *cfil_faddr = NULL;
368 struct sockaddr_in *cfil_sin;
369 u_int32_t cfil_dst = 0;
370 #endif
371
372 #if CONTENT_FILTER
373 /*
374 * If socket is subject to Content Filter and no addr is passed in,
375 * retrieve CFIL saved state from mbuf and use it if necessary.
376 */
377 if (CFIL_DGRAM_FILTERED(so) && dst == INADDR_ANY) {
378 cfil_tag = cfil_dgram_get_socket_state(m, &cfil_so_state_change_cnt, &cfil_so_options, &cfil_faddr, &cfil_inp_flags);
379 if (cfil_tag) {
380 cfil_sin = SIN(cfil_faddr);
381 flags = (cfil_so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
382 inp_flags = cfil_inp_flags;
383 if (inp && inp->inp_faddr.s_addr == INADDR_ANY) {
384 /*
385 * Socket is unconnected, simply use the saved faddr as 'addr' to go through
386 * the connect/disconnect logic.
387 */
388 dst = cfil_sin->sin_addr.s_addr;
389 } else if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
390 (inp->inp_fport != cfil_sin->sin_port ||
391 inp->inp_faddr.s_addr != cfil_sin->sin_addr.s_addr)) {
392 /*
393 * Socket is connected but socket state and dest addr/port changed.
394 * We need to use the saved faddr and socket options.
395 */
396 cfil_faddr_use = true;
397 cfil_dst = cfil_sin->sin_addr.s_addr;
398 }
399 m_tag_free(cfil_tag);
400 }
401 }
402 #endif
403
404 if (so->so_state & SS_ISCONNECTED) {
405 if (dst != INADDR_ANY) {
406 if (m != NULL) {
407 m_freem(m);
408 }
409 if (control != NULL) {
410 m_freem(control);
411 }
412 return EISCONN;
413 }
414 dst = cfil_faddr_use ? cfil_dst : inp->inp_faddr.s_addr;
415 } else {
416 if (dst == INADDR_ANY) {
417 if (m != NULL) {
418 m_freem(m);
419 }
420 if (control != NULL) {
421 m_freem(control);
422 }
423 return ENOTCONN;
424 }
425 }
426
427 bzero(&ipoa, sizeof(ipoa));
428 ipoa.ipoa_boundif = IFSCOPE_NONE;
429 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF;
430
431 int sotc = SO_TC_UNSPEC;
432 int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
433
434
435 if (control != NULL) {
436 tos = so_tos_from_control(control);
437 sotc = so_tc_from_control(control, &netsvctype);
438
439 m_freem(control);
440 control = NULL;
441 }
442 if (sotc == SO_TC_UNSPEC) {
443 sotc = so->so_traffic_class;
444 netsvctype = so->so_netsvctype;
445 }
446
447 if (inp == NULL
448 #if NECP
449 || (necp_socket_should_use_flow_divert(inp))
450 #endif /* NECP */
451 ) {
452 if (m != NULL) {
453 m_freem(m);
454 }
455 VERIFY(control == NULL);
456 return inp == NULL ? EINVAL : EPROTOTYPE;
457 }
458
459 flags |= IP_OUTARGS;
460 /* If socket was bound to an ifindex, tell ip_output about it */
461 if (inp->inp_flags & INP_BOUND_IF) {
462 ipoa.ipoa_boundif = inp->inp_boundifp->if_index;
463 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
464 }
465 if (INP_NO_CELLULAR(inp)) {
466 ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
467 }
468 if (INP_NO_EXPENSIVE(inp)) {
469 ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
470 }
471 if (INP_NO_CONSTRAINED(inp)) {
472 ipoa.ipoa_flags |= IPOAF_NO_CONSTRAINED;
473 }
474 if (INP_AWDL_UNRESTRICTED(inp)) {
475 ipoa.ipoa_flags |= IPOAF_AWDL_UNRESTRICTED;
476 }
477 ipoa.ipoa_sotc = sotc;
478 ipoa.ipoa_netsvctype = netsvctype;
479
480 if (inp->inp_flowhash == 0) {
481 inp->inp_flowhash = inp_calc_flowhash(inp);
482 }
483
484 /*
485 * If the user handed us a complete IP packet, use it.
486 * Otherwise, allocate an mbuf for a header and fill it in.
487 */
488 if ((inp_flags & INP_HDRINCL) == 0) {
489 if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
490 m_freem(m);
491 return EMSGSIZE;
492 }
493 M_PREPEND(m, sizeof(struct ip), M_WAIT, 1);
494 if (m == NULL) {
495 return ENOBUFS;
496 }
497 ip = mtod(m, struct ip *);
498 if (tos != IPTOS_UNSPEC) {
499 ip->ip_tos = (uint8_t)(tos & IPTOS_MASK);
500 } else {
501 ip->ip_tos = inp->inp_ip_tos;
502 }
503 if (inp->inp_flags2 & INP2_DONTFRAG) {
504 ip->ip_off = IP_DF;
505 } else {
506 ip->ip_off = 0;
507 }
508 ip->ip_p = inp->inp_ip_p;
509 ip->ip_len = (uint16_t)m->m_pkthdr.len;
510 ip->ip_src = inp->inp_laddr;
511 ip->ip_dst.s_addr = dst;
512 ip->ip_ttl = inp->inp_ip_ttl;
513 } else {
514 if (m->m_pkthdr.len > IP_MAXPACKET) {
515 m_freem(m);
516 return EMSGSIZE;
517 }
518 ip = mtod(m, struct ip *);
519 /*
520 * don't allow both user specified and setsockopt options,
521 * and don't allow packet length sizes that will crash
522 */
523 if (m->m_pkthdr.len < sizeof(struct ip) ||
524 ((IP_VHL_HL(ip->ip_vhl) != (sizeof(*ip) >> 2)) && inp->inp_options) ||
525 (ip->ip_len > m->m_pkthdr.len) ||
526 (ip->ip_len < (IP_VHL_HL(ip->ip_vhl) << 2))) {
527 m_freem(m);
528 return EINVAL;
529 }
530 if (ip->ip_id == 0 && !(rfc6864 && IP_OFF_IS_ATOMIC(ntohs(ip->ip_off)))) {
531 ip->ip_id = ip_randomid((uint64_t)m);
532 }
533 /* XXX prevent ip_output from overwriting header fields */
534 flags |= IP_RAWOUTPUT;
535 OSAddAtomic(1, &ipstat.ips_rawout);
536 }
537
538 if (inp->inp_laddr.s_addr != INADDR_ANY) {
539 ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
540 }
541
542 #if NECP
543 {
544 necp_kernel_policy_id policy_id;
545 necp_kernel_policy_id skip_policy_id;
546 u_int32_t route_rule_id;
547 u_int32_t pass_flags;
548
549 /*
550 * We need a route to perform NECP route rule checks
551 */
552 if ((net_qos_policy_restricted != 0 &&
553 ROUTE_UNUSABLE(&inp->inp_route))
554 #if CONTENT_FILTER
555 || cfil_faddr_use
556 #endif
557 ) {
558 struct sockaddr_in to;
559 struct sockaddr_in from;
560 struct in_addr laddr = ip->ip_src;
561
562 ROUTE_RELEASE(&inp->inp_route);
563
564 bzero(&from, sizeof(struct sockaddr_in));
565 from.sin_family = AF_INET;
566 from.sin_len = sizeof(struct sockaddr_in);
567 from.sin_addr = laddr;
568
569 bzero(&to, sizeof(struct sockaddr_in));
570 to.sin_family = AF_INET;
571 to.sin_len = sizeof(struct sockaddr_in);
572 to.sin_addr.s_addr = ip->ip_dst.s_addr;
573
574 if ((error = in_pcbladdr(inp, (struct sockaddr *)&to,
575 &laddr, ipoa.ipoa_boundif, NULL, 1)) != 0) {
576 printf("%s in_pcbladdr(%p) error %d\n",
577 __func__, inp, error);
578 m_freem(m);
579 return error;
580 }
581
582 inp_update_necp_policy(inp, (struct sockaddr *)&from,
583 (struct sockaddr *)&to, ipoa.ipoa_boundif);
584 inp->inp_policyresult.results.qos_marking_gencount = 0;
585 }
586
587 if (!necp_socket_is_allowed_to_send_recv_v4(inp, 0, 0,
588 &ip->ip_src, &ip->ip_dst, NULL, 0, &policy_id, &route_rule_id, &skip_policy_id, &pass_flags)) {
589 m_freem(m);
590 return EHOSTUNREACH;
591 }
592
593 necp_mark_packet_from_socket(m, inp, policy_id, route_rule_id, skip_policy_id, pass_flags);
594
595 if (net_qos_policy_restricted != 0) {
596 struct ifnet *rt_ifp = NULL;
597
598 if (inp->inp_route.ro_rt != NULL) {
599 rt_ifp = inp->inp_route.ro_rt->rt_ifp;
600 }
601
602 necp_socket_update_qos_marking(inp, inp->inp_route.ro_rt, route_rule_id);
603 }
604 }
605 #endif /* NECP */
606 if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
607 ipoa.ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
608 }
609 #if IPSEC
610 if (inp->inp_sp != NULL && ipsec_setsocket(m, so) != 0) {
611 m_freem(m);
612 return ENOBUFS;
613 }
614 #endif /*IPSEC*/
615
616 if (ROUTE_UNUSABLE(&inp->inp_route)) {
617 ROUTE_RELEASE(&inp->inp_route);
618 }
619
620 set_packet_service_class(m, so, sotc, 0);
621 m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
622 m->m_pkthdr.pkt_flowid = inp->inp_flowhash;
623 m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC |
624 PKTF_FLOW_RAWSOCK);
625 m->m_pkthdr.pkt_proto = inp->inp_ip_p;
626 m->m_pkthdr.tx_rawip_pid = so->last_pid;
627 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
628 if (so->so_flags & SOF_DELEGATED) {
629 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
630 } else {
631 m->m_pkthdr.tx_rawip_e_pid = 0;
632 }
633 #if (DEBUG || DEVELOPMENT)
634 if (so->so_flags & SOF_MARK_WAKE_PKT) {
635 so->so_flags &= ~SOF_MARK_WAKE_PKT;
636 m->m_pkthdr.pkt_flags |= PKTF_WAKE_PKT;
637 }
638 #endif /* (DEBUG || DEVELOPMENT) */
639
640 imo = inp->inp_moptions;
641 if (imo != NULL) {
642 IMO_ADDREF(imo);
643 }
644 /*
645 * The domain lock is held across ip_output, so it is okay
646 * to pass the PCB cached route pointer directly to IP and
647 * the modules beneath it.
648 */
649 // TODO: PASS DOWN ROUTE RULE ID
650 error = ip_output(m, inp->inp_options, &inp->inp_route, flags,
651 imo, &ipoa);
652
653 if (imo != NULL) {
654 IMO_REMREF(imo);
655 }
656
657 if (inp->inp_route.ro_rt != NULL) {
658 struct rtentry *rt = inp->inp_route.ro_rt;
659 struct ifnet *outif;
660
661 if ((rt->rt_flags & (RTF_MULTICAST | RTF_BROADCAST)) ||
662 inp->inp_socket == NULL ||
663 #if CONTENT_FILTER
664 /* Discard temporary route for cfil case */
665 cfil_faddr_use ||
666 #endif
667 !(inp->inp_socket->so_state & SS_ISCONNECTED)) {
668 rt = NULL; /* unusable */
669 }
670 /*
671 * Always discard the cached route for unconnected
672 * socket or if it is a multicast route.
673 */
674 if (rt == NULL) {
675 ROUTE_RELEASE(&inp->inp_route);
676 }
677
678 /*
679 * If this is a connected socket and the destination
680 * route is unicast, update outif with that of the
681 * route interface used by IP.
682 */
683 if (rt != NULL &&
684 (outif = rt->rt_ifp) != inp->inp_last_outifp) {
685 inp->inp_last_outifp = outif;
686 }
687 } else {
688 ROUTE_RELEASE(&inp->inp_route);
689 }
690
691 /*
692 * If output interface was cellular/expensive/constrained, and this socket is
693 * denied access to it, generate an event.
694 */
695 if (error != 0 && (ipoa.ipoa_flags & IPOAF_R_IFDENIED) &&
696 (INP_NO_CELLULAR(inp) || INP_NO_EXPENSIVE(inp) || INP_NO_CONSTRAINED(inp))) {
697 soevent(so, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
698 }
699
700 return error;
701 }
702
703
704 /*
705 * Raw IP socket option processing.
706 */
707 int
rip_ctloutput(struct socket * so,struct sockopt * sopt)708 rip_ctloutput(struct socket *so, struct sockopt *sopt)
709 {
710 struct inpcb *inp = sotoinpcb(so);
711 int error, optval;
712
713 /* Allow <SOL_SOCKET,SO_FLUSH> at this level */
714 if (sopt->sopt_level != IPPROTO_IP &&
715 !(sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_FLUSH)) {
716 return EINVAL;
717 }
718
719 error = 0;
720
721 switch (sopt->sopt_dir) {
722 case SOPT_GET:
723 switch (sopt->sopt_name) {
724 case IP_HDRINCL:
725 optval = inp->inp_flags & INP_HDRINCL;
726 error = sooptcopyout(sopt, &optval, sizeof optval);
727 break;
728
729 case IP_STRIPHDR:
730 optval = inp->inp_flags & INP_STRIPHDR;
731 error = sooptcopyout(sopt, &optval, sizeof optval);
732 break;
733
734
735 #if DUMMYNET
736 case IP_DUMMYNET_GET:
737 if (!DUMMYNET_LOADED) {
738 ip_dn_init();
739 }
740 if (DUMMYNET_LOADED) {
741 error = ip_dn_ctl_ptr(sopt);
742 } else {
743 error = ENOPROTOOPT;
744 }
745 break;
746 #endif /* DUMMYNET */
747
748 default:
749 error = ip_ctloutput(so, sopt);
750 break;
751 }
752 break;
753
754 case SOPT_SET:
755 switch (sopt->sopt_name) {
756 case IP_HDRINCL:
757 error = sooptcopyin(sopt, &optval, sizeof optval,
758 sizeof optval);
759 if (error) {
760 break;
761 }
762 if (optval) {
763 inp->inp_flags |= INP_HDRINCL;
764 } else {
765 inp->inp_flags &= ~INP_HDRINCL;
766 }
767 break;
768
769 case IP_STRIPHDR:
770 error = sooptcopyin(sopt, &optval, sizeof optval,
771 sizeof optval);
772 if (error) {
773 break;
774 }
775 if (optval) {
776 inp->inp_flags |= INP_STRIPHDR;
777 } else {
778 inp->inp_flags &= ~INP_STRIPHDR;
779 }
780 break;
781
782
783 #if DUMMYNET
784 case IP_DUMMYNET_CONFIGURE:
785 case IP_DUMMYNET_DEL:
786 case IP_DUMMYNET_FLUSH:
787 if (!DUMMYNET_LOADED) {
788 ip_dn_init();
789 }
790 if (DUMMYNET_LOADED) {
791 error = ip_dn_ctl_ptr(sopt);
792 } else {
793 error = ENOPROTOOPT;
794 }
795 break;
796 #endif /* DUMMYNET */
797
798 case SO_FLUSH:
799 if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
800 sizeof(optval))) != 0) {
801 break;
802 }
803
804 error = inp_flush(inp, optval);
805 break;
806
807 default:
808 error = ip_ctloutput(so, sopt);
809 break;
810 }
811 break;
812 }
813
814 return error;
815 }
816
817 /*
818 * This function exists solely to receive the PRC_IFDOWN messages which
819 * are sent by if_down(). It looks for an ifaddr whose ifa_addr is sa,
820 * and calls in_ifadown() to remove all routes corresponding to that address.
821 * It also receives the PRC_IFUP messages from if_up() and reinstalls the
822 * interface routes.
823 */
824 void
rip_ctlinput(int cmd,struct sockaddr * sa,__unused void * vip,__unused struct ifnet * ifp)825 rip_ctlinput(
826 int cmd,
827 struct sockaddr *sa,
828 __unused void *vip,
829 __unused struct ifnet *ifp)
830 {
831 struct in_ifaddr *ia = NULL;
832 struct ifnet *iaifp = NULL;
833 int err = 0;
834 int flags, done = 0;
835
836 switch (cmd) {
837 case PRC_IFDOWN:
838 lck_rw_lock_shared(&in_ifaddr_rwlock);
839 for (ia = in_ifaddrhead.tqh_first; ia;
840 ia = ia->ia_link.tqe_next) {
841 IFA_LOCK(&ia->ia_ifa);
842 if (ia->ia_ifa.ifa_addr == sa &&
843 (ia->ia_flags & IFA_ROUTE)) {
844 done = 1;
845 IFA_ADDREF_LOCKED(&ia->ia_ifa);
846 IFA_UNLOCK(&ia->ia_ifa);
847 lck_rw_done(&in_ifaddr_rwlock);
848 lck_mtx_lock(rnh_lock);
849 /*
850 * in_ifscrub kills the interface route.
851 */
852 in_ifscrub(ia->ia_ifp, ia, 1);
853 /*
854 * in_ifadown gets rid of all the rest of
855 * the routes. This is not quite the right
856 * thing to do, but at least if we are running
857 * a routing process they will come back.
858 */
859 in_ifadown(&ia->ia_ifa, 1);
860 lck_mtx_unlock(rnh_lock);
861 IFA_REMREF(&ia->ia_ifa);
862 break;
863 }
864 IFA_UNLOCK(&ia->ia_ifa);
865 }
866 if (!done) {
867 lck_rw_done(&in_ifaddr_rwlock);
868 }
869 break;
870
871 case PRC_IFUP:
872 lck_rw_lock_shared(&in_ifaddr_rwlock);
873 for (ia = in_ifaddrhead.tqh_first; ia;
874 ia = ia->ia_link.tqe_next) {
875 IFA_LOCK(&ia->ia_ifa);
876 if (ia->ia_ifa.ifa_addr == sa) {
877 /* keep it locked */
878 break;
879 }
880 IFA_UNLOCK(&ia->ia_ifa);
881 }
882 if (ia == NULL || (ia->ia_flags & IFA_ROUTE) ||
883 (ia->ia_ifa.ifa_debug & IFD_NOTREADY)) {
884 if (ia != NULL) {
885 IFA_UNLOCK(&ia->ia_ifa);
886 }
887 lck_rw_done(&in_ifaddr_rwlock);
888 return;
889 }
890 IFA_ADDREF_LOCKED(&ia->ia_ifa);
891 IFA_UNLOCK(&ia->ia_ifa);
892 lck_rw_done(&in_ifaddr_rwlock);
893
894 flags = RTF_UP;
895 iaifp = ia->ia_ifa.ifa_ifp;
896
897 if ((iaifp->if_flags & IFF_LOOPBACK)
898 || (iaifp->if_flags & IFF_POINTOPOINT)) {
899 flags |= RTF_HOST;
900 }
901
902 err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
903 if (err == 0) {
904 IFA_LOCK_SPIN(&ia->ia_ifa);
905 ia->ia_flags |= IFA_ROUTE;
906 IFA_UNLOCK(&ia->ia_ifa);
907 }
908 IFA_REMREF(&ia->ia_ifa);
909 break;
910 }
911 }
912
913 u_int32_t rip_sendspace = RIPSNDQ;
914 u_int32_t rip_recvspace = RIPRCVQ;
915
916 SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW | CTLFLAG_LOCKED,
917 &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
918 SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW | CTLFLAG_LOCKED,
919 &rip_recvspace, 0, "Maximum incoming raw IP datagram size");
920 SYSCTL_UINT(_net_inet_raw, OID_AUTO, pcbcount, CTLFLAG_RD | CTLFLAG_LOCKED,
921 &ripcbinfo.ipi_count, 0, "Number of active PCBs");
922
923 static int
rip_attach(struct socket * so,int proto,struct proc * p)924 rip_attach(struct socket *so, int proto, struct proc *p)
925 {
926 struct inpcb *inp;
927 int error;
928
929 inp = sotoinpcb(so);
930 if (inp) {
931 panic("rip_attach");
932 }
933 if ((so->so_state & SS_PRIV) == 0) {
934 return EPERM;
935 }
936 if (proto > UINT8_MAX) {
937 return EINVAL;
938 }
939
940 error = soreserve(so, rip_sendspace, rip_recvspace);
941 if (error) {
942 return error;
943 }
944 error = in_pcballoc(so, &ripcbinfo, p);
945 if (error) {
946 return error;
947 }
948 inp = (struct inpcb *)so->so_pcb;
949 inp->inp_vflag |= INP_IPV4;
950 VERIFY(proto <= UINT8_MAX);
951 inp->inp_ip_p = (u_char)proto;
952 inp->inp_ip_ttl = (u_char)ip_defttl;
953 return 0;
954 }
955
956 __private_extern__ int
rip_detach(struct socket * so)957 rip_detach(struct socket *so)
958 {
959 struct inpcb *inp;
960
961 inp = sotoinpcb(so);
962 if (inp == 0) {
963 panic("rip_detach");
964 }
965 in_pcbdetach(inp);
966 return 0;
967 }
968
969 __private_extern__ int
rip_abort(struct socket * so)970 rip_abort(struct socket *so)
971 {
972 soisdisconnected(so);
973 return rip_detach(so);
974 }
975
976 __private_extern__ int
rip_disconnect(struct socket * so)977 rip_disconnect(struct socket *so)
978 {
979 if ((so->so_state & SS_ISCONNECTED) == 0) {
980 return ENOTCONN;
981 }
982 return rip_abort(so);
983 }
984
985 __private_extern__ int
rip_bind(struct socket * so,struct sockaddr * nam,struct proc * p)986 rip_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
987 {
988 #pragma unused(p)
989 struct inpcb *inp = sotoinpcb(so);
990 struct sockaddr_in sin;
991 struct ifaddr *ifa = NULL;
992 struct ifnet *outif = NULL;
993
994 if (inp == NULL
995 #if NECP
996 || (necp_socket_should_use_flow_divert(inp))
997 #endif /* NECP */
998 ) {
999 return inp == NULL ? EINVAL : EPROTOTYPE;
1000 }
1001
1002 if (nam->sa_len != sizeof(struct sockaddr_in)) {
1003 return EINVAL;
1004 }
1005
1006 /* Sanitized local copy for interface address searches */
1007 bzero(&sin, sizeof(sin));
1008 sin.sin_family = AF_INET;
1009 sin.sin_len = sizeof(struct sockaddr_in);
1010 sin.sin_addr.s_addr = SIN(nam)->sin_addr.s_addr;
1011
1012 if (TAILQ_EMPTY(&ifnet_head) ||
1013 (sin.sin_family != AF_INET && sin.sin_family != AF_IMPLINK) ||
1014 (sin.sin_addr.s_addr && (ifa = ifa_ifwithaddr(SA(&sin))) == 0)) {
1015 return EADDRNOTAVAIL;
1016 } else if (ifa) {
1017 /*
1018 * Opportunistically determine the outbound
1019 * interface that may be used; this may not
1020 * hold true if we end up using a route
1021 * going over a different interface, e.g.
1022 * when sending to a local address. This
1023 * will get updated again after sending.
1024 */
1025 IFA_LOCK(ifa);
1026 outif = ifa->ifa_ifp;
1027 IFA_UNLOCK(ifa);
1028 IFA_REMREF(ifa);
1029 }
1030 inp->inp_laddr = sin.sin_addr;
1031 inp->inp_last_outifp = outif;
1032
1033 return 0;
1034 }
1035
1036 __private_extern__ int
rip_connect(struct socket * so,struct sockaddr * nam,__unused struct proc * p)1037 rip_connect(struct socket *so, struct sockaddr *nam, __unused struct proc *p)
1038 {
1039 struct inpcb *inp = sotoinpcb(so);
1040 struct sockaddr_in *addr = (struct sockaddr_in *)(void *)nam;
1041
1042 if (inp == NULL
1043 #if NECP
1044 || (necp_socket_should_use_flow_divert(inp))
1045 #endif /* NECP */
1046 ) {
1047 return inp == NULL ? EINVAL : EPROTOTYPE;
1048 }
1049 if (nam->sa_len != sizeof(*addr)) {
1050 return EINVAL;
1051 }
1052 if (TAILQ_EMPTY(&ifnet_head)) {
1053 return EADDRNOTAVAIL;
1054 }
1055 if ((addr->sin_family != AF_INET) &&
1056 (addr->sin_family != AF_IMPLINK)) {
1057 return EAFNOSUPPORT;
1058 }
1059
1060 if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
1061 so->so_flags1 |= SOF1_CONNECT_COUNTED;
1062 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
1063 }
1064
1065 inp->inp_faddr = addr->sin_addr;
1066 soisconnected(so);
1067
1068 return 0;
1069 }
1070
1071 __private_extern__ int
rip_shutdown(struct socket * so)1072 rip_shutdown(struct socket *so)
1073 {
1074 socantsendmore(so);
1075 return 0;
1076 }
1077
1078 __private_extern__ int
rip_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct proc * p)1079 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
1080 struct mbuf *control, struct proc *p)
1081 {
1082 #pragma unused(flags, p)
1083 struct inpcb *inp = sotoinpcb(so);
1084 u_int32_t dst = INADDR_ANY;
1085 int error = 0;
1086
1087 if (inp == NULL
1088 #if NECP
1089 || (necp_socket_should_use_flow_divert(inp) && (error = EPROTOTYPE))
1090 #endif /* NECP */
1091 ) {
1092 if (inp == NULL) {
1093 error = EINVAL;
1094 } else {
1095 error = EPROTOTYPE;
1096 }
1097 goto bad;
1098 }
1099
1100 if (nam != NULL) {
1101 dst = ((struct sockaddr_in *)(void *)nam)->sin_addr.s_addr;
1102 }
1103 return rip_output(m, so, dst, control);
1104
1105 bad:
1106 VERIFY(error != 0);
1107
1108 if (m != NULL) {
1109 m_freem(m);
1110 }
1111 if (control != NULL) {
1112 m_freem(control);
1113 }
1114
1115 return error;
1116 }
1117
1118 /* note: rip_unlock is called from different protos instead of the generic socket_unlock,
1119 * it will handle the socket dealloc on last reference
1120 * */
1121 int
rip_unlock(struct socket * so,int refcount,void * debug)1122 rip_unlock(struct socket *so, int refcount, void *debug)
1123 {
1124 void *lr_saved;
1125 struct inpcb *inp = sotoinpcb(so);
1126
1127 if (debug == NULL) {
1128 lr_saved = __builtin_return_address(0);
1129 } else {
1130 lr_saved = debug;
1131 }
1132
1133 if (refcount) {
1134 if (so->so_usecount <= 0) {
1135 panic("rip_unlock: bad refoucnt so=%p val=%x lrh= %s",
1136 so, so->so_usecount, solockhistory_nr(so));
1137 /* NOTREACHED */
1138 }
1139 so->so_usecount--;
1140 if (so->so_usecount == 0 && (inp->inp_wantcnt == WNT_STOPUSING)) {
1141 /* cleanup after last reference */
1142 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1143 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1144 if (inp->inp_state != INPCB_STATE_DEAD) {
1145 if (SOCK_CHECK_DOM(so, PF_INET6)) {
1146 in6_pcbdetach(inp);
1147 } else {
1148 in_pcbdetach(inp);
1149 }
1150 }
1151 in_pcbdispose(inp);
1152 lck_rw_done(&ripcbinfo.ipi_lock);
1153 return 0;
1154 }
1155 }
1156 so->unlock_lr[so->next_unlock_lr] = lr_saved;
1157 so->next_unlock_lr = (so->next_unlock_lr + 1) % SO_LCKDBG_MAX;
1158 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1159 return 0;
1160 }
1161
1162 static int
1163 rip_pcblist SYSCTL_HANDLER_ARGS
1164 {
1165 #pragma unused(oidp, arg1, arg2)
1166 int error, i, n, sz;
1167 struct inpcb *inp, **inp_list;
1168 inp_gen_t gencnt;
1169 struct xinpgen xig;
1170
1171 /*
1172 * The process of preparing the TCB list is too time-consuming and
1173 * resource-intensive to repeat twice on every request.
1174 */
1175 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1176 if (req->oldptr == USER_ADDR_NULL) {
1177 n = ripcbinfo.ipi_count;
1178 req->oldidx = 2 * (sizeof xig)
1179 + (n + n / 8) * sizeof(struct xinpcb);
1180 lck_rw_done(&ripcbinfo.ipi_lock);
1181 return 0;
1182 }
1183
1184 if (req->newptr != USER_ADDR_NULL) {
1185 lck_rw_done(&ripcbinfo.ipi_lock);
1186 return EPERM;
1187 }
1188
1189 /*
1190 * OK, now we're committed to doing something.
1191 */
1192 gencnt = ripcbinfo.ipi_gencnt;
1193 sz = n = ripcbinfo.ipi_count;
1194
1195 bzero(&xig, sizeof(xig));
1196 xig.xig_len = sizeof xig;
1197 xig.xig_count = n;
1198 xig.xig_gen = gencnt;
1199 xig.xig_sogen = so_gencnt;
1200 error = SYSCTL_OUT(req, &xig, sizeof xig);
1201 if (error) {
1202 lck_rw_done(&ripcbinfo.ipi_lock);
1203 return error;
1204 }
1205 /*
1206 * We are done if there is no pcb
1207 */
1208 if (n == 0) {
1209 lck_rw_done(&ripcbinfo.ipi_lock);
1210 return 0;
1211 }
1212
1213 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1214 if (inp_list == NULL) {
1215 lck_rw_done(&ripcbinfo.ipi_lock);
1216 return ENOMEM;
1217 }
1218
1219 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1220 inp = inp->inp_list.le_next) {
1221 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1222 inp_list[i++] = inp;
1223 }
1224 }
1225 n = i;
1226
1227 error = 0;
1228 for (i = 0; i < n; i++) {
1229 inp = inp_list[i];
1230 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1231 struct xinpcb xi;
1232
1233 bzero(&xi, sizeof(xi));
1234 xi.xi_len = sizeof xi;
1235 /* XXX should avoid extra copy */
1236 inpcb_to_compat(inp, &xi.xi_inp);
1237 if (inp->inp_socket) {
1238 sotoxsocket(inp->inp_socket, &xi.xi_socket);
1239 }
1240 error = SYSCTL_OUT(req, &xi, sizeof xi);
1241 }
1242 }
1243 if (!error) {
1244 /*
1245 * Give the user an updated idea of our state.
1246 * If the generation differs from what we told
1247 * her before, she knows that something happened
1248 * while we were processing this request, and it
1249 * might be necessary to retry.
1250 */
1251 bzero(&xig, sizeof(xig));
1252 xig.xig_len = sizeof xig;
1253 xig.xig_gen = ripcbinfo.ipi_gencnt;
1254 xig.xig_sogen = so_gencnt;
1255 xig.xig_count = ripcbinfo.ipi_count;
1256 error = SYSCTL_OUT(req, &xig, sizeof xig);
1257 }
1258
1259 lck_rw_done(&ripcbinfo.ipi_lock);
1260 kfree_type(struct inpcb *, sz, inp_list);
1261 return error;
1262 }
1263
1264 SYSCTL_PROC(_net_inet_raw, OID_AUTO /*XXX*/, pcblist,
1265 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1266 rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
1267
1268 #if XNU_TARGET_OS_OSX
1269
1270 static int
1271 rip_pcblist64 SYSCTL_HANDLER_ARGS
1272 {
1273 #pragma unused(oidp, arg1, arg2)
1274 int error, i, n, sz;
1275 struct inpcb *inp, **inp_list;
1276 inp_gen_t gencnt;
1277 struct xinpgen xig;
1278
1279 /*
1280 * The process of preparing the TCB list is too time-consuming and
1281 * resource-intensive to repeat twice on every request.
1282 */
1283 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1284 if (req->oldptr == USER_ADDR_NULL) {
1285 n = ripcbinfo.ipi_count;
1286 req->oldidx = 2 * (sizeof xig)
1287 + (n + n / 8) * sizeof(struct xinpcb64);
1288 lck_rw_done(&ripcbinfo.ipi_lock);
1289 return 0;
1290 }
1291
1292 if (req->newptr != USER_ADDR_NULL) {
1293 lck_rw_done(&ripcbinfo.ipi_lock);
1294 return EPERM;
1295 }
1296
1297 /*
1298 * OK, now we're committed to doing something.
1299 */
1300 gencnt = ripcbinfo.ipi_gencnt;
1301 sz = n = ripcbinfo.ipi_count;
1302
1303 bzero(&xig, sizeof(xig));
1304 xig.xig_len = sizeof xig;
1305 xig.xig_count = n;
1306 xig.xig_gen = gencnt;
1307 xig.xig_sogen = so_gencnt;
1308 error = SYSCTL_OUT(req, &xig, sizeof xig);
1309 if (error) {
1310 lck_rw_done(&ripcbinfo.ipi_lock);
1311 return error;
1312 }
1313 /*
1314 * We are done if there is no pcb
1315 */
1316 if (n == 0) {
1317 lck_rw_done(&ripcbinfo.ipi_lock);
1318 return 0;
1319 }
1320
1321 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1322 if (inp_list == NULL) {
1323 lck_rw_done(&ripcbinfo.ipi_lock);
1324 return ENOMEM;
1325 }
1326
1327 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1328 inp = inp->inp_list.le_next) {
1329 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1330 inp_list[i++] = inp;
1331 }
1332 }
1333 n = i;
1334
1335 error = 0;
1336 for (i = 0; i < n; i++) {
1337 inp = inp_list[i];
1338 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1339 struct xinpcb64 xi;
1340
1341 bzero(&xi, sizeof(xi));
1342 xi.xi_len = sizeof xi;
1343 inpcb_to_xinpcb64(inp, &xi);
1344 if (inp->inp_socket) {
1345 sotoxsocket64(inp->inp_socket, &xi.xi_socket);
1346 }
1347 error = SYSCTL_OUT(req, &xi, sizeof xi);
1348 }
1349 }
1350 if (!error) {
1351 /*
1352 * Give the user an updated idea of our state.
1353 * If the generation differs from what we told
1354 * her before, she knows that something happened
1355 * while we were processing this request, and it
1356 * might be necessary to retry.
1357 */
1358 bzero(&xig, sizeof(xig));
1359 xig.xig_len = sizeof xig;
1360 xig.xig_gen = ripcbinfo.ipi_gencnt;
1361 xig.xig_sogen = so_gencnt;
1362 xig.xig_count = ripcbinfo.ipi_count;
1363 error = SYSCTL_OUT(req, &xig, sizeof xig);
1364 }
1365
1366 lck_rw_done(&ripcbinfo.ipi_lock);
1367 kfree_type(struct inpcb *, sz, inp_list);
1368 return error;
1369 }
1370
1371 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist64,
1372 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1373 rip_pcblist64, "S,xinpcb64", "List of active raw IP sockets");
1374
1375 #endif /* XNU_TARGET_OS_OSX */
1376
1377
1378 static int
1379 rip_pcblist_n SYSCTL_HANDLER_ARGS
1380 {
1381 #pragma unused(oidp, arg1, arg2)
1382 int error = 0;
1383
1384 error = get_pcblist_n(IPPROTO_IP, req, &ripcbinfo);
1385
1386 return error;
1387 }
1388
1389 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist_n,
1390 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1391 rip_pcblist_n, "S,xinpcb_n", "List of active raw IP sockets");
1392
1393 struct pr_usrreqs rip_usrreqs = {
1394 .pru_abort = rip_abort,
1395 .pru_attach = rip_attach,
1396 .pru_bind = rip_bind,
1397 .pru_connect = rip_connect,
1398 .pru_control = in_control,
1399 .pru_detach = rip_detach,
1400 .pru_disconnect = rip_disconnect,
1401 .pru_peeraddr = in_getpeeraddr,
1402 .pru_send = rip_send,
1403 .pru_shutdown = rip_shutdown,
1404 .pru_sockaddr = in_getsockaddr,
1405 .pru_sosend = sosend,
1406 .pru_soreceive = soreceive,
1407 };
1408 /* DSEP Review Done pl-20051213-v02 @3253 */
1409