1 /*
2 * Copyright (c) 2000-2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1988, 1991, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)rtsock.c 8.5 (Berkeley) 11/2/94
61 */
62
63 #include <sys/param.h>
64 #include <sys/systm.h>
65 #include <sys/kauth.h>
66 #include <sys/kernel.h>
67 #include <sys/sysctl.h>
68 #include <sys/proc.h>
69 #include <sys/malloc.h>
70 #include <sys/mbuf.h>
71 #include <sys/socket.h>
72 #include <sys/socketvar.h>
73 #include <sys/domain.h>
74 #include <sys/protosw.h>
75 #include <sys/syslog.h>
76 #include <sys/mcache.h>
77 #include <kern/locks.h>
78 #include <sys/codesign.h>
79
80 #include <net/if.h>
81 #include <net/route.h>
82 #include <net/dlil.h>
83 #include <net/raw_cb.h>
84 #include <netinet/in.h>
85 #include <netinet/in_var.h>
86 #include <netinet/in_arp.h>
87 #include <netinet/ip.h>
88 #include <netinet/ip6.h>
89 #include <netinet6/nd6.h>
90
91 #include <net/sockaddr_utils.h>
92
93 #include <IOKit/IOBSD.h>
94
95 extern struct rtstat rtstat;
96 extern struct domain routedomain_s;
97 static struct domain *routedomain = NULL;
98
99 static struct sockaddr route_dst = { .sa_len = 2, .sa_family = PF_ROUTE, .sa_data = { 0, } };
100 static struct sockaddr route_src = { .sa_len = 2, .sa_family = PF_ROUTE, .sa_data = { 0, } };
101 static struct sockaddr sa_zero = { .sa_len = sizeof(sa_zero), .sa_family = AF_INET, .sa_data = { 0, } };
102
103 struct route_cb {
104 u_int32_t ip_count; /* attached w/ AF_INET */
105 u_int32_t ip6_count; /* attached w/ AF_INET6 */
106 u_int32_t any_count; /* total attached */
107 };
108
109 static struct route_cb route_cb;
110
111 struct walkarg {
112 int w_tmemsize;
113 int w_op, w_arg;
114 caddr_t w_tmem;
115 struct sysctl_req *w_req;
116 };
117
118 static void route_dinit(struct domain *);
119 static int rts_abort(struct socket *);
120 static int rts_attach(struct socket *, int, struct proc *);
121 static int rts_bind(struct socket *, struct sockaddr *, struct proc *);
122 static int rts_connect(struct socket *, struct sockaddr *, struct proc *);
123 static int rts_detach(struct socket *);
124 static int rts_disconnect(struct socket *);
125 static int rts_peeraddr(struct socket *, struct sockaddr **);
126 static int rts_send(struct socket *, int, struct mbuf *, struct sockaddr *,
127 struct mbuf *, struct proc *);
128 static int rts_shutdown(struct socket *);
129 static int rts_sockaddr(struct socket *, struct sockaddr **);
130
131 static int route_output(struct mbuf *, struct socket *);
132 static int rt_setmetrics(u_int32_t, struct rt_metrics *, struct rtentry *);
133 static void rt_getmetrics(struct rtentry *, struct rt_metrics *);
134 static void rt_setif(struct rtentry *, struct sockaddr *, struct sockaddr *,
135 struct sockaddr *, unsigned int);
136 static int rt_xaddrs(caddr_t cp __ended_by(cplim), caddr_t cplim, struct rt_addrinfo *);
137 static struct mbuf *rt_msg1(u_char, struct rt_addrinfo *);
138 static int rt_msg2(u_char, struct rt_addrinfo *, caddr_t, struct walkarg *,
139 kauth_cred_t *);
140 static int sysctl_dumpentry(struct radix_node *rn, void *vw);
141 static int sysctl_dumpentry_ext(struct radix_node *rn, void *vw);
142 static int sysctl_iflist(int af, struct walkarg *w);
143 static int sysctl_iflist2(int af, struct walkarg *w);
144 static int sysctl_rtstat(struct sysctl_req *);
145 static int sysctl_rttrash(struct sysctl_req *);
146 static int sysctl_rtsock SYSCTL_HANDLER_ARGS;
147
148 SYSCTL_NODE(_net, PF_ROUTE, routetable, CTLFLAG_RD | CTLFLAG_LOCKED,
149 sysctl_rtsock, "");
150
151 SYSCTL_NODE(_net, OID_AUTO, route, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "routing");
152
153 /* Align x to 1024 (only power of 2) assuming x is positive */
154 #define ALIGN_BYTES(x) do { \
155 x = (uint32_t)P2ALIGN(x, 1024); \
156 } while(0)
157
158 #define ROUNDUP32(a) \
159 ((a) > 0 ? (1 + (((a) - 1) | (sizeof (uint32_t) - 1))) : \
160 sizeof (uint32_t))
161
162 #define ADVANCE32(x, n, lim) do { \
163 (x += ROUNDUP32((n)->sa_len)); \
164 _Pragma("clang diagnostic push"); \
165 _Pragma("clang diagnostic ignored \"-Wself-assign\""); \
166 (lim) = (lim); \
167 _Pragma("clang diagnostic pop"); \
168 } while(0)
169
170
171 #define RT_HAS_IFADDR(rt) \
172 ((rt)->rt_ifa != NULL && (rt)->rt_ifa->ifa_addr != NULL)
173
174 /*
175 * It really doesn't make any sense at all for this code to share much
176 * with raw_usrreq.c, since its functionality is so restricted. XXX
177 */
178 static int
rts_abort(struct socket * so)179 rts_abort(struct socket *so)
180 {
181 return raw_usrreqs.pru_abort(so);
182 }
183
184 /* pru_accept is EOPNOTSUPP */
185
186 static int
rts_attach(struct socket * so,int proto,struct proc * p)187 rts_attach(struct socket *so, int proto, struct proc *p)
188 {
189 #pragma unused(p)
190 struct rawcb *rp;
191 int error;
192
193 VERIFY(so->so_pcb == NULL);
194
195 rp = kalloc_type(struct rawcb, Z_WAITOK_ZERO_NOFAIL);
196 so->so_pcb = (caddr_t)rp;
197 /* don't use raw_usrreqs.pru_attach, it checks for SS_PRIV */
198 error = raw_attach(so, proto);
199 rp = sotorawcb(so);
200 if (error) {
201 kfree_type(struct rawcb, rp);
202 so->so_pcb = NULL;
203 so->so_flags |= SOF_PCBCLEARING;
204 return error;
205 }
206
207 switch (rp->rcb_proto.sp_protocol) {
208 case AF_INET:
209 os_atomic_inc(&route_cb.ip_count, relaxed);
210 break;
211 case AF_INET6:
212 os_atomic_inc(&route_cb.ip6_count, relaxed);
213 break;
214 }
215 rp->rcb_faddr = &route_src;
216 os_atomic_inc(&route_cb.any_count, relaxed);
217 /* the socket is already locked when we enter rts_attach */
218 soisconnected(so);
219 so->so_options |= SO_USELOOPBACK;
220 return 0;
221 }
222
223 static int
rts_bind(struct socket * so,struct sockaddr * nam,struct proc * p)224 rts_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
225 {
226 return raw_usrreqs.pru_bind(so, nam, p); /* xxx just EINVAL */
227 }
228
229 static int
rts_connect(struct socket * so,struct sockaddr * nam,struct proc * p)230 rts_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
231 {
232 return raw_usrreqs.pru_connect(so, nam, p); /* XXX just EINVAL */
233 }
234
235 /* pru_connect2 is EOPNOTSUPP */
236 /* pru_control is EOPNOTSUPP */
237
238 static int
rts_detach(struct socket * so)239 rts_detach(struct socket *so)
240 {
241 struct rawcb *rp = sotorawcb(so);
242
243 VERIFY(rp != NULL);
244
245 switch (rp->rcb_proto.sp_protocol) {
246 case AF_INET:
247 os_atomic_dec(&route_cb.ip_count, relaxed);
248 break;
249 case AF_INET6:
250 os_atomic_dec(&route_cb.ip6_count, relaxed);
251 break;
252 }
253 os_atomic_dec(&route_cb.any_count, relaxed);
254 return raw_usrreqs.pru_detach(so);
255 }
256
257 static int
rts_disconnect(struct socket * so)258 rts_disconnect(struct socket *so)
259 {
260 return raw_usrreqs.pru_disconnect(so);
261 }
262
263 /* pru_listen is EOPNOTSUPP */
264
265 static int
rts_peeraddr(struct socket * so,struct sockaddr ** nam)266 rts_peeraddr(struct socket *so, struct sockaddr **nam)
267 {
268 return raw_usrreqs.pru_peeraddr(so, nam);
269 }
270
271 /* pru_rcvd is EOPNOTSUPP */
272 /* pru_rcvoob is EOPNOTSUPP */
273
274 static int
rts_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct proc * p)275 rts_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
276 struct mbuf *control, struct proc *p)
277 {
278 return raw_usrreqs.pru_send(so, flags, m, nam, control, p);
279 }
280
281 /* pru_sense is null */
282
283 static int
rts_shutdown(struct socket * so)284 rts_shutdown(struct socket *so)
285 {
286 return raw_usrreqs.pru_shutdown(so);
287 }
288
289 static int
rts_sockaddr(struct socket * so,struct sockaddr ** nam)290 rts_sockaddr(struct socket *so, struct sockaddr **nam)
291 {
292 return raw_usrreqs.pru_sockaddr(so, nam);
293 }
294
295 static struct pr_usrreqs route_usrreqs = {
296 .pru_abort = rts_abort,
297 .pru_attach = rts_attach,
298 .pru_bind = rts_bind,
299 .pru_connect = rts_connect,
300 .pru_detach = rts_detach,
301 .pru_disconnect = rts_disconnect,
302 .pru_peeraddr = rts_peeraddr,
303 .pru_send = rts_send,
304 .pru_shutdown = rts_shutdown,
305 .pru_sockaddr = rts_sockaddr,
306 .pru_sosend = sosend,
307 .pru_soreceive = soreceive,
308 };
309
310 /*ARGSUSED*/
311 static int
route_output(struct mbuf * m,struct socket * so)312 route_output(struct mbuf *m, struct socket *so)
313 {
314 struct rt_msghdr *rtm = NULL;
315 size_t rtm_len = 0;
316 rtentry_ref_t rt = NULL;
317 rtentry_ref_t saved_nrt = NULL;
318 struct radix_node_head *rnh;
319 struct rt_addrinfo info;
320 int len, error = 0;
321 sa_family_t dst_sa_family = 0;
322 struct ifnet *ifp = NULL;
323 struct sockaddr_in dst_in, gate_in;
324 int sendonlytoself = 0;
325 unsigned int ifscope = IFSCOPE_NONE;
326 struct rawcb *rp = NULL;
327 boolean_t is_router = FALSE;
328 #define senderr(e) { error = (e); goto flush; }
329 if (m == NULL || ((m->m_len < sizeof(intptr_t)) &&
330 (m = m_pullup(m, sizeof(intptr_t))) == NULL)) {
331 return ENOBUFS;
332 }
333 VERIFY(m->m_flags & M_PKTHDR);
334
335 /*
336 * Unlock the socket (but keep a reference) it won't be
337 * accessed until raw_input appends to it.
338 */
339 socket_unlock(so, 0);
340 lck_mtx_lock(rnh_lock);
341
342 len = m->m_pkthdr.len;
343 if (len < sizeof(*rtm) ||
344 len != mtod(m, struct rt_msghdr *)->rtm_msglen) {
345 info.rti_info[RTAX_DST] = NULL;
346 senderr(EINVAL);
347 }
348 rtm = kalloc_data(len, Z_WAITOK);
349 if (rtm == NULL) {
350 info.rti_info[RTAX_DST] = NULL;
351 senderr(ENOBUFS);
352 }
353 rtm_len = (size_t)len;
354 m_copydata(m, 0, len, (caddr_t)rtm);
355 if (rtm->rtm_version != RTM_VERSION) {
356 info.rti_info[RTAX_DST] = NULL;
357 senderr(EPROTONOSUPPORT);
358 }
359
360 /*
361 * Silent version of RTM_GET for Reachabiltiy APIs. We may change
362 * all RTM_GETs to be silent in the future, so this is private for now.
363 */
364 if (rtm->rtm_type == RTM_GET_SILENT) {
365 if (!(so->so_options & SO_USELOOPBACK)) {
366 senderr(EINVAL);
367 }
368 sendonlytoself = 1;
369 rtm->rtm_type = RTM_GET;
370 }
371
372 /*
373 * Perform permission checking, only privileged sockets
374 * may perform operations other than RTM_GET
375 */
376 if (rtm->rtm_type != RTM_GET && !(so->so_state & SS_PRIV)) {
377 info.rti_info[RTAX_DST] = NULL;
378 senderr(EPERM);
379 }
380
381 rtm->rtm_pid = proc_selfpid();
382 info.rti_addrs = rtm->rtm_addrs;
383 if (rt_xaddrs((caddr_t)(rtm + 1), len + (caddr_t)rtm, &info)) {
384 info.rti_info[RTAX_DST] = NULL;
385 senderr(EINVAL);
386 }
387 if (info.rti_info[RTAX_DST] == NULL ||
388 info.rti_info[RTAX_DST]->sa_family >= AF_MAX ||
389 (info.rti_info[RTAX_GATEWAY] != NULL &&
390 info.rti_info[RTAX_GATEWAY]->sa_family >= AF_MAX)) {
391 senderr(EINVAL);
392 }
393
394 if (info.rti_info[RTAX_DST]->sa_family == AF_INET &&
395 info.rti_info[RTAX_DST]->sa_len != sizeof(struct sockaddr_in)) {
396 /* At minimum, we need up to sin_addr */
397 if (info.rti_info[RTAX_DST]->sa_len <
398 offsetof(struct sockaddr_in, sin_zero)) {
399 senderr(EINVAL);
400 }
401 SOCKADDR_ZERO(&dst_in, sizeof(dst_in));
402 dst_in.sin_len = sizeof(dst_in);
403 dst_in.sin_family = AF_INET;
404 dst_in.sin_port = SIN(info.rti_info[RTAX_DST])->sin_port;
405 dst_in.sin_addr = SIN(info.rti_info[RTAX_DST])->sin_addr;
406 info.rti_info[RTAX_DST] = SA(&dst_in);
407 dst_sa_family = info.rti_info[RTAX_DST]->sa_family;
408 } else if (info.rti_info[RTAX_DST]->sa_family == AF_INET6 &&
409 info.rti_info[RTAX_DST]->sa_len < sizeof(struct sockaddr_in6)) {
410 senderr(EINVAL);
411 }
412
413 if (info.rti_info[RTAX_GATEWAY] != NULL) {
414 if (info.rti_info[RTAX_GATEWAY]->sa_family == AF_INET &&
415 info.rti_info[RTAX_GATEWAY]->sa_len != sizeof(struct sockaddr_in)) {
416 /* At minimum, we need up to sin_addr */
417 if (info.rti_info[RTAX_GATEWAY]->sa_len <
418 offsetof(struct sockaddr_in, sin_zero)) {
419 senderr(EINVAL);
420 }
421 SOCKADDR_ZERO(&gate_in, sizeof(gate_in));
422 gate_in.sin_len = sizeof(gate_in);
423 gate_in.sin_family = AF_INET;
424 gate_in.sin_port = SIN(info.rti_info[RTAX_GATEWAY])->sin_port;
425 gate_in.sin_addr = SIN(info.rti_info[RTAX_GATEWAY])->sin_addr;
426 info.rti_info[RTAX_GATEWAY] = SA(&gate_in);
427 } else if (info.rti_info[RTAX_GATEWAY]->sa_family == AF_INET6 &&
428 info.rti_info[RTAX_GATEWAY]->sa_len < sizeof(struct sockaddr_in6)) {
429 senderr(EINVAL);
430 }
431 }
432
433 if (info.rti_info[RTAX_GENMASK]) {
434 struct radix_node *t;
435 t = rn_addmask((caddr_t)info.rti_info[RTAX_GENMASK], 0, 1);
436 if (t != NULL && Bcmp(info.rti_info[RTAX_GENMASK],
437 rn_get_key(t), *(u_char *)info.rti_info[RTAX_GENMASK]) == 0) {
438 info.rti_info[RTAX_GENMASK] = SA(rn_get_key(t));
439 } else {
440 senderr(ENOBUFS);
441 }
442 }
443
444 /*
445 * If RTF_IFSCOPE flag is set, then rtm_index specifies the scope.
446 */
447 if (rtm->rtm_flags & RTF_IFSCOPE) {
448 if (info.rti_info[RTAX_DST]->sa_family != AF_INET &&
449 info.rti_info[RTAX_DST]->sa_family != AF_INET6) {
450 senderr(EINVAL);
451 }
452 ifscope = rtm->rtm_index;
453 }
454 /*
455 * Block changes on INTCOPROC interfaces.
456 */
457 if (ifscope != IFSCOPE_NONE) {
458 unsigned int intcoproc_scope = 0;
459 ifnet_head_lock_shared();
460 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
461 if (IFNET_IS_INTCOPROC(ifp)) {
462 intcoproc_scope = ifp->if_index;
463 break;
464 }
465 }
466 ifnet_head_done();
467 if (intcoproc_scope == ifscope && proc_getpid(current_proc()) != 0) {
468 senderr(EINVAL);
469 }
470 }
471 /*
472 * Require entitlement to change management interfaces
473 */
474 if (management_control_unrestricted == false && if_management_interface_check_needed == true &&
475 ifscope != IFSCOPE_NONE && proc_getpid(current_proc()) != 0) {
476 bool is_management = false;
477
478 ifnet_head_lock_shared();
479 if (IF_INDEX_IN_RANGE(ifscope)) {
480 ifp = ifindex2ifnet[ifscope];
481 if (ifp != NULL && IFNET_IS_MANAGEMENT(ifp)) {
482 is_management = true;
483 }
484 }
485 ifnet_head_done();
486
487 if (is_management && !IOCurrentTaskHasEntitlement(MANAGEMENT_CONTROL_ENTITLEMENT)) {
488 senderr(EINVAL);
489 }
490 }
491
492 /*
493 * RTF_PROXY can only be set internally from within the kernel.
494 */
495 if (rtm->rtm_flags & RTF_PROXY) {
496 senderr(EINVAL);
497 }
498
499 /*
500 * For AF_INET, always zero out the embedded scope ID. If this is
501 * a scoped request, it must be done explicitly by setting RTF_IFSCOPE
502 * flag and the corresponding rtm_index value. This is to prevent
503 * false interpretation of the scope ID because it's using the sin_zero
504 * field, which might not be properly cleared by the requestor.
505 */
506 if (info.rti_info[RTAX_DST]->sa_family == AF_INET) {
507 sin_set_ifscope(info.rti_info[RTAX_DST], IFSCOPE_NONE);
508 }
509 if (info.rti_info[RTAX_GATEWAY] != NULL &&
510 info.rti_info[RTAX_GATEWAY]->sa_family == AF_INET) {
511 sin_set_ifscope(info.rti_info[RTAX_GATEWAY], IFSCOPE_NONE);
512 }
513 if (info.rti_info[RTAX_DST]->sa_family == AF_INET6 &&
514 IN6_IS_SCOPE_EMBED(&SIN6(info.rti_info[RTAX_DST])->sin6_addr) &&
515 !IN6_IS_ADDR_UNICAST_BASED_MULTICAST(&SIN6(info.rti_info[RTAX_DST])->sin6_addr) &&
516 SIN6(info.rti_info[RTAX_DST])->sin6_scope_id == 0) {
517 SIN6(info.rti_info[RTAX_DST])->sin6_scope_id = ntohs(SIN6(info.rti_info[RTAX_DST])->sin6_addr.s6_addr16[1]);
518 SIN6(info.rti_info[RTAX_DST])->sin6_addr.s6_addr16[1] = 0;
519 }
520
521 switch (rtm->rtm_type) {
522 case RTM_ADD:
523 if (info.rti_info[RTAX_GATEWAY] == NULL) {
524 senderr(EINVAL);
525 }
526
527 error = rtrequest_scoped_locked(RTM_ADD,
528 info.rti_info[RTAX_DST], info.rti_info[RTAX_GATEWAY],
529 info.rti_info[RTAX_NETMASK], rtm->rtm_flags, &saved_nrt,
530 ifscope);
531 if (error == 0 && saved_nrt != NULL) {
532 RT_LOCK(saved_nrt);
533 /*
534 * If the route request specified an interface with
535 * IFA and/or IFP, we set the requested interface on
536 * the route with rt_setif. It would be much better
537 * to do this inside rtrequest, but that would
538 * require passing the desired interface, in some
539 * form, to rtrequest. Since rtrequest is called in
540 * so many places (roughly 40 in our source), adding
541 * a parameter is to much for us to swallow; this is
542 * something for the FreeBSD developers to tackle.
543 * Instead, we let rtrequest compute whatever
544 * interface it wants, then come in behind it and
545 * stick in the interface that we really want. This
546 * works reasonably well except when rtrequest can't
547 * figure out what interface to use (with
548 * ifa_withroute) and returns ENETUNREACH. Ideally
549 * it shouldn't matter if rtrequest can't figure out
550 * the interface if we're going to explicitly set it
551 * ourselves anyway. But practically we can't
552 * recover here because rtrequest will not do any of
553 * the work necessary to add the route if it can't
554 * find an interface. As long as there is a default
555 * route that leads to some interface, rtrequest will
556 * find an interface, so this problem should be
557 * rarely encountered.
558 * [email protected]
559 */
560 rt_setif(saved_nrt,
561 info.rti_info[RTAX_IFP], info.rti_info[RTAX_IFA],
562 info.rti_info[RTAX_GATEWAY], ifscope);
563 (void)rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx, saved_nrt);
564 saved_nrt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
565 saved_nrt->rt_rmx.rmx_locks |=
566 (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
567 saved_nrt->rt_genmask = info.rti_info[RTAX_GENMASK];
568 RT_REMREF_LOCKED(saved_nrt);
569 RT_UNLOCK(saved_nrt);
570 }
571 break;
572
573 case RTM_DELETE:
574 error = rtrequest_scoped_locked(RTM_DELETE,
575 info.rti_info[RTAX_DST], info.rti_info[RTAX_GATEWAY],
576 info.rti_info[RTAX_NETMASK], rtm->rtm_flags, &saved_nrt,
577 ifscope);
578 if (error == 0) {
579 rt = saved_nrt;
580 RT_LOCK(rt);
581 goto report;
582 }
583 break;
584
585 case RTM_GET:
586 case RTM_CHANGE:
587 case RTM_LOCK:
588 rnh = rt_tables[info.rti_info[RTAX_DST]->sa_family];
589 if (rnh == NULL) {
590 senderr(EAFNOSUPPORT);
591 }
592 /*
593 * Lookup the best match based on the key-mask pair;
594 * callee adds a reference and checks for root node.
595 */
596 rt = rt_lookup(TRUE, info.rti_info[RTAX_DST],
597 info.rti_info[RTAX_NETMASK], rnh, ifscope);
598 if (rt == NULL) {
599 senderr(ESRCH);
600 }
601 RT_LOCK(rt);
602
603 /*
604 * Holding rnh_lock here prevents the possibility of
605 * ifa from changing (e.g. in_ifinit), so it is safe
606 * to access its ifa_addr (down below) without locking.
607 */
608 switch (rtm->rtm_type) {
609 case RTM_GET: {
610 kauth_cred_t cred __single;
611 kauth_cred_t* credp;
612 struct ifaddr *ifa2;
613 report:
614 cred = current_cached_proc_cred(PROC_NULL);
615 credp = &cred;
616
617 ifa2 = NULL;
618 RT_LOCK_ASSERT_HELD(rt);
619 info.rti_info[RTAX_DST] = rt_key(rt);
620 dst_sa_family = info.rti_info[RTAX_DST]->sa_family;
621 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
622 info.rti_info[RTAX_NETMASK] = rt_mask(rt);
623 info.rti_info[RTAX_GENMASK] = rt->rt_genmask;
624 if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
625 ifp = rt->rt_ifp;
626 if (ifp != NULL) {
627 ifnet_lock_shared(ifp);
628 ifa2 = ifp->if_lladdr;
629 info.rti_info[RTAX_IFP] =
630 ifa2->ifa_addr;
631 ifa_addref(ifa2);
632 ifnet_lock_done(ifp);
633 info.rti_info[RTAX_IFA] =
634 rt->rt_ifa->ifa_addr;
635 rtm->rtm_index = ifp->if_index;
636 } else {
637 info.rti_info[RTAX_IFP] = NULL;
638 info.rti_info[RTAX_IFA] = NULL;
639 }
640 } else if ((ifp = rt->rt_ifp) != NULL) {
641 rtm->rtm_index = ifp->if_index;
642 }
643 if (ifa2 != NULL) {
644 IFA_LOCK(ifa2);
645 }
646 len = rt_msg2(rtm->rtm_type, &info, NULL, NULL, credp);
647 if (ifa2 != NULL) {
648 IFA_UNLOCK(ifa2);
649 }
650 struct rt_msghdr *out_rtm;
651 out_rtm = kalloc_data(len, Z_WAITOK);
652 if (out_rtm == NULL) {
653 RT_UNLOCK(rt);
654 if (ifa2 != NULL) {
655 ifa_remref(ifa2);
656 }
657 senderr(ENOBUFS);
658 }
659 Bcopy(rtm, out_rtm, sizeof(struct rt_msghdr));
660 if (ifa2 != NULL) {
661 IFA_LOCK(ifa2);
662 }
663 (void) rt_msg2(out_rtm->rtm_type, &info, (caddr_t)out_rtm,
664 NULL, &cred);
665 if (ifa2 != NULL) {
666 IFA_UNLOCK(ifa2);
667 }
668 kfree_data(rtm, rtm_len);
669 rtm = out_rtm;
670 rtm_len = len;
671 rtm->rtm_flags = rt->rt_flags;
672 rt_getmetrics(rt, &rtm->rtm_rmx);
673 rtm->rtm_addrs = info.rti_addrs;
674 if (ifa2 != NULL) {
675 ifa_remref(ifa2);
676 }
677
678 break;
679 }
680
681 case RTM_CHANGE:
682 is_router = (rt->rt_flags & RTF_ROUTER) ? TRUE : FALSE;
683
684 if (info.rti_info[RTAX_GATEWAY] != NULL &&
685 (error = rt_setgate(rt, rt_key(rt),
686 info.rti_info[RTAX_GATEWAY]))) {
687 int tmp = error;
688 RT_UNLOCK(rt);
689 senderr(tmp);
690 }
691 /*
692 * If they tried to change things but didn't specify
693 * the required gateway, then just use the old one.
694 * This can happen if the user tries to change the
695 * flags on the default route without changing the
696 * default gateway. Changing flags still doesn't work.
697 */
698 if ((rt->rt_flags & RTF_GATEWAY) &&
699 info.rti_info[RTAX_GATEWAY] == NULL) {
700 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
701 }
702
703 /*
704 * On Darwin, we call rt_setif which contains the
705 * equivalent to the code found at this very spot
706 * in BSD.
707 */
708 rt_setif(rt,
709 info.rti_info[RTAX_IFP], info.rti_info[RTAX_IFA],
710 info.rti_info[RTAX_GATEWAY], ifscope);
711
712 if ((error = rt_setmetrics(rtm->rtm_inits,
713 &rtm->rtm_rmx, rt))) {
714 int tmp = error;
715 RT_UNLOCK(rt);
716 senderr(tmp);
717 }
718 if (info.rti_info[RTAX_GENMASK]) {
719 rt->rt_genmask = info.rti_info[RTAX_GENMASK];
720 }
721
722 /*
723 * Enqueue work item to invoke callback for this route entry
724 * This may not be needed always, but for now issue it anytime
725 * RTM_CHANGE gets called.
726 */
727 route_event_enqueue_nwk_wq_entry(rt, NULL, ROUTE_ENTRY_REFRESH, NULL, TRUE);
728 /*
729 * If the route is for a router, walk the tree to send refresh
730 * event to protocol cloned entries
731 */
732 if (is_router) {
733 struct route_event rt_ev;
734 route_event_init(&rt_ev, rt, NULL, ROUTE_ENTRY_REFRESH);
735 RT_UNLOCK(rt);
736 (void) rnh->rnh_walktree(rnh, route_event_walktree, (void *)&rt_ev);
737 RT_LOCK(rt);
738 }
739 OS_FALLTHROUGH;
740 case RTM_LOCK:
741 rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
742 rt->rt_rmx.rmx_locks |=
743 (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
744 break;
745 }
746 RT_UNLOCK(rt);
747 break;
748 default:
749 senderr(EOPNOTSUPP);
750 }
751 flush:
752 if (rtm != NULL) {
753 if (error) {
754 rtm->rtm_errno = error;
755 } else {
756 rtm->rtm_flags |= RTF_DONE;
757 }
758 }
759 if (rt != NULL) {
760 RT_LOCK_ASSERT_NOTHELD(rt);
761 rtfree_locked(rt);
762 }
763 lck_mtx_unlock(rnh_lock);
764
765 /* relock the socket now */
766 socket_lock(so, 0);
767 /*
768 * Check to see if we don't want our own messages.
769 */
770 if (!(so->so_options & SO_USELOOPBACK)) {
771 if (route_cb.any_count <= 1) {
772 kfree_data(rtm, rtm_len);
773 m_freem(m);
774 return error;
775 }
776 /* There is another listener, so construct message */
777 rp = sotorawcb(so);
778 }
779 if (rtm != NULL) {
780 m_copyback(m, 0, rtm->rtm_msglen, (caddr_t)rtm);
781 if (m->m_pkthdr.len < rtm->rtm_msglen) {
782 m_freem(m);
783 m = NULL;
784 } else if (m->m_pkthdr.len > rtm->rtm_msglen) {
785 m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
786 }
787 kfree_data(rtm, rtm_len);
788 }
789 if (sendonlytoself && m != NULL) {
790 error = 0;
791 if (sbappendaddr(&so->so_rcv, &route_src, m,
792 NULL, &error) != 0) {
793 sorwakeup(so);
794 }
795 if (error) {
796 return error;
797 }
798 } else {
799 struct sockproto route_proto = { .sp_family = PF_ROUTE, .sp_protocol = 0 };
800 if (rp != NULL) {
801 rp->rcb_proto.sp_family = 0; /* Avoid us */
802 }
803 if (dst_sa_family != 0) {
804 route_proto.sp_protocol = dst_sa_family;
805 }
806 if (m != NULL) {
807 socket_unlock(so, 0);
808 raw_input(m, &route_proto, &route_src, &route_dst);
809 socket_lock(so, 0);
810 }
811 if (rp != NULL) {
812 rp->rcb_proto.sp_family = PF_ROUTE;
813 }
814 }
815 return error;
816 }
817
818 void
rt_setexpire(struct rtentry * rt,uint64_t expiry)819 rt_setexpire(struct rtentry *rt, uint64_t expiry)
820 {
821 /* set both rt_expire and rmx_expire */
822 rt->rt_expire = expiry;
823 if (expiry) {
824 rt->rt_rmx.rmx_expire =
825 (int32_t)(expiry + rt->base_calendartime -
826 rt->base_uptime);
827 } else {
828 rt->rt_rmx.rmx_expire = 0;
829 }
830 }
831
832 static int
rt_setmetrics(u_int32_t which,struct rt_metrics * in,struct rtentry * out)833 rt_setmetrics(u_int32_t which, struct rt_metrics *in, struct rtentry *out)
834 {
835 if (!(which & RTV_REFRESH_HOST)) {
836 struct timeval caltime;
837 getmicrotime(&caltime);
838 #define metric(f, e) if (which & (f)) out->rt_rmx.e = in->e;
839 metric(RTV_RPIPE, rmx_recvpipe);
840 metric(RTV_SPIPE, rmx_sendpipe);
841 metric(RTV_SSTHRESH, rmx_ssthresh);
842 metric(RTV_RTT, rmx_rtt);
843 metric(RTV_RTTVAR, rmx_rttvar);
844 metric(RTV_HOPCOUNT, rmx_hopcount);
845 metric(RTV_MTU, rmx_mtu);
846 metric(RTV_EXPIRE, rmx_expire);
847 #undef metric
848 if (out->rt_rmx.rmx_expire > 0) {
849 /* account for system time change */
850 getmicrotime(&caltime);
851 out->base_calendartime +=
852 NET_CALCULATE_CLOCKSKEW(caltime,
853 out->base_calendartime,
854 net_uptime(), out->base_uptime);
855 rt_setexpire(out,
856 out->rt_rmx.rmx_expire -
857 out->base_calendartime +
858 out->base_uptime);
859 } else {
860 rt_setexpire(out, 0);
861 }
862
863 VERIFY(out->rt_expire == 0 || out->rt_rmx.rmx_expire != 0);
864 VERIFY(out->rt_expire != 0 || out->rt_rmx.rmx_expire == 0);
865 } else {
866 /* Only RTV_REFRESH_HOST must be set */
867 if ((which & ~RTV_REFRESH_HOST) ||
868 (out->rt_flags & RTF_STATIC) ||
869 !(out->rt_flags & RTF_LLINFO)) {
870 return EINVAL;
871 }
872
873 if (out->rt_llinfo_refresh == NULL) {
874 return ENOTSUP;
875 }
876
877 out->rt_llinfo_refresh(out);
878 }
879 return 0;
880 }
881
882 static void
rt_getmetrics(struct rtentry * in,struct rt_metrics * out)883 rt_getmetrics(struct rtentry *in, struct rt_metrics *out)
884 {
885 struct timeval caltime;
886
887 VERIFY(in->rt_expire == 0 || in->rt_rmx.rmx_expire != 0);
888 VERIFY(in->rt_expire != 0 || in->rt_rmx.rmx_expire == 0);
889
890 *out = in->rt_rmx;
891
892 if (in->rt_expire != 0) {
893 /* account for system time change */
894 getmicrotime(&caltime);
895
896 in->base_calendartime +=
897 NET_CALCULATE_CLOCKSKEW(caltime,
898 in->base_calendartime, net_uptime(), in->base_uptime);
899
900 out->rmx_expire = (int32_t)(in->base_calendartime +
901 in->rt_expire - in->base_uptime);
902 } else {
903 out->rmx_expire = 0;
904 }
905 }
906
907 /*
908 * Set route's interface given info.rti_info[RTAX_IFP],
909 * info.rti_info[RTAX_IFA], and gateway.
910 */
911 static void
rt_setif(struct rtentry * rt,struct sockaddr * Ifpaddr,struct sockaddr * Ifaaddr,struct sockaddr * Gate,unsigned int ifscope)912 rt_setif(struct rtentry *rt, struct sockaddr *Ifpaddr, struct sockaddr *Ifaaddr,
913 struct sockaddr *Gate, unsigned int ifscope)
914 {
915 struct ifaddr *ifa = NULL;
916 struct ifnet *ifp = NULL;
917 void (*ifa_rtrequest)(int, struct rtentry *, struct sockaddr *);
918
919 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
920
921 RT_LOCK_ASSERT_HELD(rt);
922
923 /* Don't update a defunct route */
924 if (rt->rt_flags & RTF_CONDEMNED) {
925 return;
926 }
927
928 /* Add an extra ref for ourselves */
929 RT_ADDREF_LOCKED(rt);
930
931 /* Become a regular mutex, just in case */
932 RT_CONVERT_LOCK(rt);
933
934 /*
935 * New gateway could require new ifaddr, ifp; flags may also
936 * be different; ifp may be specified by ll sockaddr when
937 * protocol address is ambiguous.
938 */
939 if (Ifpaddr && (ifa = ifa_ifwithnet_scoped(Ifpaddr, ifscope)) &&
940 (ifp = ifa->ifa_ifp) && (Ifaaddr || Gate)) {
941 ifa_remref(ifa);
942 ifa = ifaof_ifpforaddr(Ifaaddr ? Ifaaddr : Gate, ifp);
943 } else {
944 if (ifa != NULL) {
945 ifa_remref(ifa);
946 ifa = NULL;
947 }
948 if (Ifpaddr && (ifp = if_withname(Ifpaddr))) {
949 if (Gate) {
950 ifa = ifaof_ifpforaddr(Gate, ifp);
951 } else {
952 ifnet_lock_shared(ifp);
953 ifa = TAILQ_FIRST(&ifp->if_addrhead);
954 if (ifa != NULL) {
955 ifa_addref(ifa);
956 }
957 ifnet_lock_done(ifp);
958 }
959 } else if (Ifaaddr &&
960 (ifa = ifa_ifwithaddr_scoped(Ifaaddr, ifscope))) {
961 ifp = ifa->ifa_ifp;
962 } else if (Gate != NULL) {
963 /*
964 * Safe to drop rt_lock and use rt_key, since holding
965 * rnh_lock here prevents another thread from calling
966 * rt_setgate() on this route. We cannot hold the
967 * lock across ifa_ifwithroute since the lookup done
968 * by that routine may point to the same route.
969 */
970 RT_UNLOCK(rt);
971 if ((ifa = ifa_ifwithroute_scoped_locked(rt->rt_flags,
972 rt_key(rt), Gate, ifscope)) != NULL) {
973 ifp = ifa->ifa_ifp;
974 }
975 RT_LOCK(rt);
976 /* Don't update a defunct route */
977 if (rt->rt_flags & RTF_CONDEMNED) {
978 if (ifa != NULL) {
979 ifa_remref(ifa);
980 }
981 /* Release extra ref */
982 RT_REMREF_LOCKED(rt);
983 return;
984 }
985 }
986 }
987
988 /* trigger route cache reevaluation */
989 if (rt_key(rt)->sa_family == AF_INET) {
990 routegenid_inet_update();
991 } else if (rt_key(rt)->sa_family == AF_INET6) {
992 routegenid_inet6_update();
993 }
994
995 if (ifa != NULL) {
996 struct ifaddr *oifa = rt->rt_ifa;
997 if (oifa != ifa) {
998 if (oifa != NULL) {
999 IFA_LOCK_SPIN(oifa);
1000 ifa_rtrequest = oifa->ifa_rtrequest;
1001 IFA_UNLOCK(oifa);
1002 if (ifa_rtrequest != NULL) {
1003 ifa_rtrequest(RTM_DELETE, rt, Gate);
1004 }
1005 }
1006 rtsetifa(rt, ifa);
1007
1008 if (rt->rt_ifp != ifp) {
1009 /*
1010 * Purge any link-layer info caching.
1011 */
1012 if (rt->rt_llinfo_purge != NULL) {
1013 rt->rt_llinfo_purge(rt);
1014 }
1015
1016 /*
1017 * Adjust route ref count for the interfaces.
1018 */
1019 if (rt->rt_if_ref_fn != NULL) {
1020 rt->rt_if_ref_fn(ifp, 1);
1021 rt->rt_if_ref_fn(rt->rt_ifp, -1);
1022 }
1023 }
1024 rt->rt_ifp = ifp;
1025 /*
1026 * If this is the (non-scoped) default route, record
1027 * the interface index used for the primary ifscope.
1028 */
1029 if (rt_primary_default(rt, rt_key(rt))) {
1030 set_primary_ifscope(rt_key(rt)->sa_family,
1031 rt->rt_ifp->if_index);
1032 }
1033 /*
1034 * If rmx_mtu is not locked, update it
1035 * to the MTU used by the new interface.
1036 */
1037 if (!(rt->rt_rmx.rmx_locks & RTV_MTU)) {
1038 rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu;
1039 if (rt_key(rt)->sa_family == AF_INET &&
1040 INTF_ADJUST_MTU_FOR_CLAT46(ifp)) {
1041 rt->rt_rmx.rmx_mtu = IN6_LINKMTU(rt->rt_ifp);
1042 /* Further adjust the size for CLAT46 expansion */
1043 rt->rt_rmx.rmx_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
1044 }
1045 }
1046
1047 if (rt->rt_ifa != NULL) {
1048 IFA_LOCK_SPIN(rt->rt_ifa);
1049 ifa_rtrequest = rt->rt_ifa->ifa_rtrequest;
1050 IFA_UNLOCK(rt->rt_ifa);
1051 if (ifa_rtrequest != NULL) {
1052 ifa_rtrequest(RTM_ADD, rt, Gate);
1053 }
1054 }
1055 ifa_remref(ifa);
1056 /* Release extra ref */
1057 RT_REMREF_LOCKED(rt);
1058 return;
1059 }
1060 ifa_remref(ifa);
1061 ifa = NULL;
1062 }
1063
1064 /* XXX: to reset gateway to correct value, at RTM_CHANGE */
1065 if (rt->rt_ifa != NULL) {
1066 IFA_LOCK_SPIN(rt->rt_ifa);
1067 ifa_rtrequest = rt->rt_ifa->ifa_rtrequest;
1068 IFA_UNLOCK(rt->rt_ifa);
1069 if (ifa_rtrequest != NULL) {
1070 ifa_rtrequest(RTM_ADD, rt, Gate);
1071 }
1072 }
1073
1074 /*
1075 * Workaround for local address routes pointing to the loopback
1076 * interface added by configd, until <rdar://problem/12970142>.
1077 */
1078 if ((rt->rt_ifp->if_flags & IFF_LOOPBACK) &&
1079 (rt->rt_flags & RTF_HOST) && rt->rt_ifa->ifa_ifp == rt->rt_ifp) {
1080 ifa = ifa_ifwithaddr(rt_key(rt));
1081 if (ifa != NULL) {
1082 if (ifa != rt->rt_ifa) {
1083 rtsetifa(rt, ifa);
1084 }
1085 ifa_remref(ifa);
1086 }
1087 }
1088
1089 /* Release extra ref */
1090 RT_REMREF_LOCKED(rt);
1091 }
1092
1093 /*
1094 * Extract the addresses of the passed sockaddrs.
1095 * Do a little sanity checking so as to avoid bad memory references.
1096 * This data is derived straight from userland.
1097 */
1098 static int
rt_xaddrs(caddr_t cp __ended_by (cplim),caddr_t cplim,struct rt_addrinfo * rtinfo)1099 rt_xaddrs(caddr_t cp __ended_by(cplim), caddr_t cplim, struct rt_addrinfo *rtinfo)
1100 {
1101 struct sockaddr *sa;
1102 int i;
1103
1104 bzero(rtinfo->rti_info, sizeof(rtinfo->rti_info));
1105 for (i = 0; (i < RTAX_MAX) && (cp < cplim); i++) {
1106 if ((rtinfo->rti_addrs & (1 << i)) == 0) {
1107 continue;
1108 }
1109 sa = SA(cp);
1110 /*
1111 * It won't fit.
1112 */
1113 if ((cp + sa->sa_len) > cplim) {
1114 return EINVAL;
1115 }
1116 if (sa->sa_len > sizeof(struct sockaddr_storage)) {
1117 return EINVAL;
1118 }
1119 /*
1120 * there are no more.. quit now
1121 * If there are more bits, they are in error.
1122 * I've seen this. route(1) can evidently generate these.
1123 * This causes kernel to core dump.
1124 * for compatibility, If we see this, point to a safe address.
1125 */
1126 if (sa->sa_len == 0) {
1127 rtinfo->rti_info[i] = &sa_zero;
1128 return 0; /* should be EINVAL but for compat */
1129 }
1130 if (sa->sa_len < offsetof(struct sockaddr, sa_data)) {
1131 return EINVAL;
1132 }
1133 /* accept it */
1134 rtinfo->rti_info[i] = sa;
1135 ADVANCE32(cp, sa, cplim);
1136 }
1137 return 0;
1138 }
1139
1140 static struct mbuf *
rt_msg1(u_char type,struct rt_addrinfo * rtinfo)1141 rt_msg1(u_char type, struct rt_addrinfo *rtinfo)
1142 {
1143 struct rt_msghdr *rtm;
1144 struct mbuf *m;
1145 int i;
1146 int len, dlen, off;
1147
1148 switch (type) {
1149 case RTM_DELADDR:
1150 case RTM_NEWADDR:
1151 len = sizeof(struct ifa_msghdr);
1152 break;
1153
1154 case RTM_DELMADDR:
1155 case RTM_NEWMADDR:
1156 len = sizeof(struct ifma_msghdr);
1157 break;
1158
1159 case RTM_IFINFO:
1160 len = sizeof(struct if_msghdr);
1161 break;
1162
1163 default:
1164 len = sizeof(struct rt_msghdr);
1165 }
1166 m = m_gethdr(M_DONTWAIT, MT_DATA);
1167 if (m && len > MHLEN) {
1168 MCLGET(m, M_DONTWAIT);
1169 if (!(m->m_flags & M_EXT)) {
1170 m_free(m);
1171 m = NULL;
1172 }
1173 }
1174 if (m == NULL) {
1175 return NULL;
1176 }
1177 m->m_pkthdr.len = m->m_len = len;
1178 m->m_pkthdr.rcvif = NULL;
1179 rtm = mtod(m, struct rt_msghdr *);
1180 bzero((caddr_t)rtm, len);
1181 off = len;
1182 for (i = 0; i < RTAX_MAX; i++) {
1183 struct sockaddr *sa, *hint;
1184 uint8_t ssbuf[SOCK_MAXADDRLEN + 1];
1185
1186 /*
1187 * Make sure to accomodate the largest possible size of sa_len.
1188 */
1189 _CASSERT(sizeof(ssbuf) == (SOCK_MAXADDRLEN + 1));
1190
1191 if ((sa = rtinfo->rti_info[i]) == NULL) {
1192 continue;
1193 }
1194
1195 switch (i) {
1196 case RTAX_DST:
1197 case RTAX_NETMASK:
1198 if ((hint = rtinfo->rti_info[RTAX_DST]) == NULL) {
1199 hint = rtinfo->rti_info[RTAX_IFA];
1200 }
1201
1202 /* Scrub away any trace of embedded interface scope */
1203 sa = rtm_scrub(type, i, hint, sa, &ssbuf,
1204 sizeof(ssbuf), NULL);
1205 break;
1206
1207 default:
1208 break;
1209 }
1210
1211 rtinfo->rti_addrs |= (1 << i);
1212 dlen = sa->sa_len;
1213 m_copyback(m, off, dlen, (caddr_t)sa);
1214 len = off + dlen;
1215 off += ROUNDUP32(dlen);
1216 }
1217 if (m->m_pkthdr.len != len) {
1218 m_freem(m);
1219 return NULL;
1220 }
1221 rtm->rtm_msglen = (u_short)len;
1222 rtm->rtm_version = RTM_VERSION;
1223 rtm->rtm_type = type;
1224 return m;
1225 }
1226
1227 static int
rt_msg2(u_char type,struct rt_addrinfo * rtinfo,caddr_t cp,struct walkarg * w,kauth_cred_t * credp)1228 rt_msg2(u_char type, struct rt_addrinfo *rtinfo, caddr_t cp, struct walkarg *w,
1229 kauth_cred_t* credp)
1230 {
1231 int i;
1232 int len, dlen, rlen, second_time = 0;
1233 caddr_t cp0;
1234
1235 rtinfo->rti_addrs = 0;
1236 again:
1237 switch (type) {
1238 case RTM_DELADDR:
1239 case RTM_NEWADDR:
1240 len = sizeof(struct ifa_msghdr);
1241 break;
1242
1243 case RTM_DELMADDR:
1244 case RTM_NEWMADDR:
1245 len = sizeof(struct ifma_msghdr);
1246 break;
1247
1248 case RTM_IFINFO:
1249 len = sizeof(struct if_msghdr);
1250 break;
1251
1252 case RTM_IFINFO2:
1253 len = sizeof(struct if_msghdr2);
1254 break;
1255
1256 case RTM_NEWMADDR2:
1257 len = sizeof(struct ifma_msghdr2);
1258 break;
1259
1260 case RTM_GET_EXT:
1261 len = sizeof(struct rt_msghdr_ext);
1262 break;
1263
1264 case RTM_GET2:
1265 len = sizeof(struct rt_msghdr2);
1266 break;
1267
1268 default:
1269 len = sizeof(struct rt_msghdr);
1270 }
1271 cp0 = cp;
1272 if (cp0) {
1273 cp += len;
1274 }
1275 for (i = 0; i < RTAX_MAX; i++) {
1276 struct sockaddr *sa, *hint;
1277 uint8_t ssbuf[SOCK_MAXADDRLEN + 1];
1278
1279 /*
1280 * Make sure to accomodate the largest possible size of sa_len.
1281 */
1282 _CASSERT(sizeof(ssbuf) == (SOCK_MAXADDRLEN + 1));
1283
1284 if ((sa = rtinfo->rti_info[i]) == NULL) {
1285 continue;
1286 }
1287
1288 switch (i) {
1289 case RTAX_DST:
1290 case RTAX_NETMASK:
1291 if ((hint = rtinfo->rti_info[RTAX_DST]) == NULL) {
1292 hint = rtinfo->rti_info[RTAX_IFA];
1293 }
1294
1295 /* Scrub away any trace of embedded interface scope */
1296 sa = rtm_scrub(type, i, hint, sa, &ssbuf,
1297 sizeof(ssbuf), NULL);
1298 break;
1299 case RTAX_GATEWAY:
1300 case RTAX_IFP:
1301 sa = rtm_scrub(type, i, NULL, sa, &ssbuf,
1302 sizeof(ssbuf), credp);
1303 break;
1304
1305 default:
1306 break;
1307 }
1308
1309 rtinfo->rti_addrs |= (1 << i);
1310 dlen = sa->sa_len;
1311 rlen = ROUNDUP32(dlen);
1312 if (cp) {
1313 bcopy((caddr_t)sa, cp, (size_t)dlen);
1314 if (dlen != rlen) {
1315 bzero(cp + dlen, rlen - dlen);
1316 }
1317 cp += rlen;
1318 }
1319 len += rlen;
1320 }
1321 if (cp == NULL && w != NULL && !second_time) {
1322 struct walkarg *rw = w;
1323
1324 if (rw->w_req != NULL) {
1325 if (rw->w_tmemsize < len) {
1326 if (rw->w_tmem != NULL) {
1327 kfree_data(rw->w_tmem, rw->w_tmemsize);
1328 }
1329 rw->w_tmem = (caddr_t) kalloc_data(len, Z_ZERO | Z_WAITOK);
1330 if (rw->w_tmem != NULL) {
1331 rw->w_tmemsize = len;
1332 }
1333 }
1334 if (rw->w_tmem != NULL) {
1335 cp = rw->w_tmem;
1336 second_time = 1;
1337 goto again;
1338 }
1339 }
1340 }
1341 if (cp) {
1342 struct rt_msghdr *rtm = (struct rt_msghdr *)(void *)cp0;
1343
1344 rtm->rtm_version = RTM_VERSION;
1345 rtm->rtm_type = type;
1346 rtm->rtm_msglen = (u_short)len;
1347 }
1348 return len;
1349 }
1350
1351 /*
1352 * This routine is called to generate a message from the routing
1353 * socket indicating that a redirect has occurred, a routing lookup
1354 * has failed, or that a protocol has detected timeouts to a particular
1355 * destination.
1356 */
1357 void
rt_missmsg(u_char type,struct rt_addrinfo * rtinfo,int flags,int error)1358 rt_missmsg(u_char type, struct rt_addrinfo *rtinfo, int flags, int error)
1359 {
1360 struct rt_msghdr *rtm;
1361 struct mbuf *m;
1362 struct sockaddr *sa = rtinfo->rti_info[RTAX_DST];
1363 struct sockproto route_proto = { .sp_family = PF_ROUTE, .sp_protocol = 0 };
1364
1365 if (route_cb.any_count == 0) {
1366 return;
1367 }
1368 m = rt_msg1(type, rtinfo);
1369 if (m == NULL) {
1370 return;
1371 }
1372 rtm = mtod(m, struct rt_msghdr *);
1373 rtm->rtm_flags = RTF_DONE | flags;
1374 rtm->rtm_errno = error;
1375 rtm->rtm_addrs = rtinfo->rti_addrs;
1376 route_proto.sp_family = sa ? sa->sa_family : 0;
1377 raw_input(m, &route_proto, &route_src, &route_dst);
1378 }
1379
1380 /*
1381 * This routine is called to generate a message from the routing
1382 * socket indicating that the status of a network interface has changed.
1383 */
1384 void
rt_ifmsg(struct ifnet * ifp)1385 rt_ifmsg(struct ifnet *ifp)
1386 {
1387 struct if_msghdr *ifm;
1388 struct mbuf *m;
1389 struct rt_addrinfo info;
1390 struct sockproto route_proto = { .sp_family = PF_ROUTE, .sp_protocol = 0 };
1391
1392 if (route_cb.any_count == 0) {
1393 return;
1394 }
1395 bzero((caddr_t)&info, sizeof(info));
1396 m = rt_msg1(RTM_IFINFO, &info);
1397 if (m == NULL) {
1398 return;
1399 }
1400 ifm = mtod(m, struct if_msghdr *);
1401 ifm->ifm_index = ifp->if_index;
1402 ifm->ifm_flags = (u_short)ifp->if_flags;
1403 if_data_internal_to_if_data(ifp, &ifp->if_data, &ifm->ifm_data);
1404 ifm->ifm_addrs = 0;
1405 raw_input(m, &route_proto, &route_src, &route_dst);
1406 }
1407
1408 /*
1409 * This is called to generate messages from the routing socket
1410 * indicating a network interface has had addresses associated with it.
1411 * if we ever reverse the logic and replace messages TO the routing
1412 * socket indicate a request to configure interfaces, then it will
1413 * be unnecessary as the routing socket will automatically generate
1414 * copies of it.
1415 *
1416 * Since this is coming from the interface, it is expected that the
1417 * interface will be locked. Caller must hold rnh_lock and rt_lock.
1418 */
1419 void
rt_newaddrmsg(u_char cmd,struct ifaddr * ifa,int error,struct rtentry * rt)1420 rt_newaddrmsg(u_char cmd, struct ifaddr *ifa, int error, struct rtentry *rt)
1421 {
1422 struct rt_addrinfo info;
1423 struct sockaddr *sa = 0;
1424 int pass;
1425 struct mbuf *m = 0;
1426 struct ifnet *ifp = ifa->ifa_ifp;
1427 struct sockproto route_proto = { .sp_family = PF_ROUTE, .sp_protocol = 0 };
1428
1429 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1430 RT_LOCK_ASSERT_HELD(rt);
1431
1432 if (route_cb.any_count == 0) {
1433 return;
1434 }
1435
1436 /* Become a regular mutex, just in case */
1437 RT_CONVERT_LOCK(rt);
1438 for (pass = 1; pass < 3; pass++) {
1439 bzero((caddr_t)&info, sizeof(info));
1440 if ((cmd == RTM_ADD && pass == 1) ||
1441 (cmd == RTM_DELETE && pass == 2)) {
1442 struct ifa_msghdr *ifam;
1443 u_char ncmd = cmd == RTM_ADD ? RTM_NEWADDR : RTM_DELADDR;
1444
1445 /* Lock ifp for if_lladdr */
1446 ifnet_lock_shared(ifp);
1447 IFA_LOCK(ifa);
1448 info.rti_info[RTAX_IFA] = sa = ifa->ifa_addr;
1449 /*
1450 * Holding ifnet lock here prevents the link address
1451 * from changing contents, so no need to hold its
1452 * lock. The link address is always present; it's
1453 * never freed.
1454 */
1455 info.rti_info[RTAX_IFP] = ifp->if_lladdr->ifa_addr;
1456 info.rti_info[RTAX_NETMASK] = ifa->ifa_netmask;
1457 info.rti_info[RTAX_BRD] = ifa->ifa_dstaddr;
1458 if ((m = rt_msg1(ncmd, &info)) == NULL) {
1459 IFA_UNLOCK(ifa);
1460 ifnet_lock_done(ifp);
1461 continue;
1462 }
1463 IFA_UNLOCK(ifa);
1464 ifnet_lock_done(ifp);
1465 ifam = mtod(m, struct ifa_msghdr *);
1466 ifam->ifam_index = ifp->if_index;
1467 IFA_LOCK_SPIN(ifa);
1468 ifam->ifam_metric = ifa->ifa_metric;
1469 ifam->ifam_flags = ifa->ifa_flags;
1470 IFA_UNLOCK(ifa);
1471 ifam->ifam_addrs = info.rti_addrs;
1472 }
1473 if ((cmd == RTM_ADD && pass == 2) ||
1474 (cmd == RTM_DELETE && pass == 1)) {
1475 struct rt_msghdr *rtm;
1476
1477 if (rt == NULL) {
1478 continue;
1479 }
1480 info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1481 info.rti_info[RTAX_DST] = sa = rt_key(rt);
1482 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1483 if ((m = rt_msg1(cmd, &info)) == NULL) {
1484 continue;
1485 }
1486 rtm = mtod(m, struct rt_msghdr *);
1487 rtm->rtm_index = ifp->if_index;
1488 rtm->rtm_flags |= rt->rt_flags;
1489 rtm->rtm_errno = error;
1490 rtm->rtm_addrs = info.rti_addrs;
1491 }
1492 route_proto.sp_protocol = sa ? sa->sa_family : 0;
1493 raw_input(m, &route_proto, &route_src, &route_dst);
1494 }
1495 }
1496
1497 /*
1498 * This is the analogue to the rt_newaddrmsg which performs the same
1499 * function but for multicast group memberhips. This is easier since
1500 * there is no route state to worry about.
1501 */
1502 void
rt_newmaddrmsg(u_char cmd,struct ifmultiaddr * ifma)1503 rt_newmaddrmsg(u_char cmd, struct ifmultiaddr *ifma)
1504 {
1505 struct rt_addrinfo info;
1506 struct mbuf *m = 0;
1507 struct ifnet *ifp = ifma->ifma_ifp;
1508 struct ifma_msghdr *ifmam;
1509 struct sockproto route_proto = { .sp_family = PF_ROUTE, .sp_protocol = 0 };
1510
1511 if (route_cb.any_count == 0) {
1512 return;
1513 }
1514
1515 /* Lock ifp for if_lladdr */
1516 ifnet_lock_shared(ifp);
1517 bzero((caddr_t)&info, sizeof(info));
1518 IFMA_LOCK(ifma);
1519 info.rti_info[RTAX_IFA] = ifma->ifma_addr;
1520 /* lladdr doesn't need lock */
1521 info.rti_info[RTAX_IFP] = ifp->if_lladdr->ifa_addr;
1522
1523 /*
1524 * If a link-layer address is present, present it as a ``gateway''
1525 * (similarly to how ARP entries, e.g., are presented).
1526 */
1527 info.rti_info[RTAX_GATEWAY] = (ifma->ifma_ll != NULL) ?
1528 ifma->ifma_ll->ifma_addr : NULL;
1529 if ((m = rt_msg1(cmd, &info)) == NULL) {
1530 IFMA_UNLOCK(ifma);
1531 ifnet_lock_done(ifp);
1532 return;
1533 }
1534 ifmam = mtod(m, struct ifma_msghdr *);
1535 ifmam->ifmam_index = ifp->if_index;
1536 ifmam->ifmam_addrs = info.rti_addrs;
1537 route_proto.sp_protocol = ifma->ifma_addr->sa_family;
1538 IFMA_UNLOCK(ifma);
1539 ifnet_lock_done(ifp);
1540 raw_input(m, &route_proto, &route_src, &route_dst);
1541 }
1542
1543 const char *
rtm2str(int cmd)1544 rtm2str(int cmd)
1545 {
1546 const char *c = "RTM_?";
1547
1548 switch (cmd) {
1549 case RTM_ADD:
1550 c = "RTM_ADD";
1551 break;
1552 case RTM_DELETE:
1553 c = "RTM_DELETE";
1554 break;
1555 case RTM_CHANGE:
1556 c = "RTM_CHANGE";
1557 break;
1558 case RTM_GET:
1559 c = "RTM_GET";
1560 break;
1561 case RTM_LOSING:
1562 c = "RTM_LOSING";
1563 break;
1564 case RTM_REDIRECT:
1565 c = "RTM_REDIRECT";
1566 break;
1567 case RTM_MISS:
1568 c = "RTM_MISS";
1569 break;
1570 case RTM_LOCK:
1571 c = "RTM_LOCK";
1572 break;
1573 case RTM_OLDADD:
1574 c = "RTM_OLDADD";
1575 break;
1576 case RTM_OLDDEL:
1577 c = "RTM_OLDDEL";
1578 break;
1579 case RTM_RESOLVE:
1580 c = "RTM_RESOLVE";
1581 break;
1582 case RTM_NEWADDR:
1583 c = "RTM_NEWADDR";
1584 break;
1585 case RTM_DELADDR:
1586 c = "RTM_DELADDR";
1587 break;
1588 case RTM_IFINFO:
1589 c = "RTM_IFINFO";
1590 break;
1591 case RTM_NEWMADDR:
1592 c = "RTM_NEWMADDR";
1593 break;
1594 case RTM_DELMADDR:
1595 c = "RTM_DELMADDR";
1596 break;
1597 case RTM_GET_SILENT:
1598 c = "RTM_GET_SILENT";
1599 break;
1600 case RTM_IFINFO2:
1601 c = "RTM_IFINFO2";
1602 break;
1603 case RTM_NEWMADDR2:
1604 c = "RTM_NEWMADDR2";
1605 break;
1606 case RTM_GET2:
1607 c = "RTM_GET2";
1608 break;
1609 case RTM_GET_EXT:
1610 c = "RTM_GET_EXT";
1611 break;
1612 }
1613
1614 return c;
1615 }
1616
1617 /*
1618 * This is used in dumping the kernel table via sysctl().
1619 */
1620 static int
sysctl_dumpentry(struct radix_node * rn,void * vw)1621 sysctl_dumpentry(struct radix_node *rn, void *vw)
1622 {
1623 struct walkarg *w = vw;
1624 rtentry_ref_t rt = (rtentry_ref_t)rn;
1625 int error = 0, size;
1626 struct rt_addrinfo info;
1627 kauth_cred_t cred __single;
1628 kauth_cred_t *credp;
1629
1630 cred = current_cached_proc_cred(PROC_NULL);
1631 credp = &cred;
1632
1633 RT_LOCK(rt);
1634 if ((w->w_op == NET_RT_FLAGS || w->w_op == NET_RT_FLAGS_PRIV) &&
1635 !(rt->rt_flags & w->w_arg)) {
1636 goto done;
1637 }
1638
1639 /*
1640 * If the matching route has RTF_LLINFO set, then we can skip scrubbing the MAC
1641 * only if the outgoing interface is not loopback and the process has entitlement
1642 * for neighbor cache read.
1643 */
1644 if (w->w_op == NET_RT_FLAGS_PRIV && (rt->rt_flags & RTF_LLINFO)) {
1645 if (rt->rt_ifp != lo_ifp &&
1646 (route_op_entitlement_check(NULL, cred, ROUTE_OP_READ, TRUE) == 0)) {
1647 credp = NULL;
1648 }
1649 }
1650
1651 bzero((caddr_t)&info, sizeof(info));
1652 info.rti_info[RTAX_DST] = rt_key(rt);
1653 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1654 info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1655 info.rti_info[RTAX_GENMASK] = rt->rt_genmask;
1656 if (RT_HAS_IFADDR(rt)) {
1657 info.rti_info[RTAX_IFA] = rt->rt_ifa->ifa_addr;
1658 }
1659
1660 if (w->w_op != NET_RT_DUMP2) {
1661 size = rt_msg2(RTM_GET, &info, NULL, w, credp);
1662 if (w->w_req != NULL && w->w_tmem != NULL) {
1663 struct rt_msghdr *rtm =
1664 (struct rt_msghdr *)(void *)w->w_tmem;
1665
1666 rtm->rtm_flags = rt->rt_flags;
1667 rtm->rtm_use = rt->rt_use;
1668 rt_getmetrics(rt, &rtm->rtm_rmx);
1669 rtm->rtm_index = rt->rt_ifp->if_index;
1670 rtm->rtm_pid = 0;
1671 rtm->rtm_seq = 0;
1672 rtm->rtm_errno = 0;
1673 rtm->rtm_addrs = info.rti_addrs;
1674 error = SYSCTL_OUT(w->w_req, (caddr_t)rtm, size);
1675 }
1676 } else {
1677 size = rt_msg2(RTM_GET2, &info, NULL, w, credp);
1678 if (w->w_req != NULL && w->w_tmem != NULL) {
1679 struct rt_msghdr2 *rtm =
1680 (struct rt_msghdr2 *)(void *)w->w_tmem;
1681
1682 rtm->rtm_flags = rt->rt_flags;
1683 rtm->rtm_use = rt->rt_use;
1684 rt_getmetrics(rt, &rtm->rtm_rmx);
1685 rtm->rtm_index = rt->rt_ifp->if_index;
1686 rtm->rtm_refcnt = rt->rt_refcnt;
1687 if (rt->rt_parent) {
1688 rtm->rtm_parentflags = rt->rt_parent->rt_flags;
1689 } else {
1690 rtm->rtm_parentflags = 0;
1691 }
1692 rtm->rtm_reserved = 0;
1693 rtm->rtm_addrs = info.rti_addrs;
1694 error = SYSCTL_OUT(w->w_req, (caddr_t)rtm, size);
1695 }
1696 }
1697
1698 done:
1699 RT_UNLOCK(rt);
1700 return error;
1701 }
1702
1703 /*
1704 * This is used for dumping extended information from route entries.
1705 */
1706 static int
sysctl_dumpentry_ext(struct radix_node * rn,void * vw)1707 sysctl_dumpentry_ext(struct radix_node *rn, void *vw)
1708 {
1709 struct walkarg *w = vw;
1710 rtentry_ref_t rt = (rtentry_ref_t)rn;
1711 int error = 0, size;
1712 struct rt_addrinfo info;
1713 kauth_cred_t cred __single;
1714
1715 cred = current_cached_proc_cred(PROC_NULL);
1716
1717 RT_LOCK(rt);
1718 if (w->w_op == NET_RT_DUMPX_FLAGS && !(rt->rt_flags & w->w_arg)) {
1719 goto done;
1720 }
1721 bzero(&info, sizeof(info));
1722 info.rti_info[RTAX_DST] = rt_key(rt);
1723 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1724 info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1725 info.rti_info[RTAX_GENMASK] = rt->rt_genmask;
1726
1727 size = rt_msg2(RTM_GET_EXT, &info, NULL, w, &cred);
1728 if (w->w_req != NULL && w->w_tmem != NULL) {
1729 struct rt_msghdr_ext *ertm =
1730 (struct rt_msghdr_ext *)(void *)w->w_tmem;
1731
1732 ertm->rtm_flags = rt->rt_flags;
1733 ertm->rtm_use = rt->rt_use;
1734 rt_getmetrics(rt, &ertm->rtm_rmx);
1735 ertm->rtm_index = rt->rt_ifp->if_index;
1736 ertm->rtm_pid = 0;
1737 ertm->rtm_seq = 0;
1738 ertm->rtm_errno = 0;
1739 ertm->rtm_addrs = info.rti_addrs;
1740 if (rt->rt_llinfo_get_ri == NULL) {
1741 bzero(&ertm->rtm_ri, sizeof(ertm->rtm_ri));
1742 ertm->rtm_ri.ri_rssi = IFNET_RSSI_UNKNOWN;
1743 ertm->rtm_ri.ri_lqm = IFNET_LQM_THRESH_OFF;
1744 ertm->rtm_ri.ri_npm = IFNET_NPM_THRESH_UNKNOWN;
1745 } else {
1746 rt->rt_llinfo_get_ri(rt, &ertm->rtm_ri);
1747 }
1748 error = SYSCTL_OUT(w->w_req, (caddr_t)ertm, size);
1749 }
1750
1751 done:
1752 RT_UNLOCK(rt);
1753 return error;
1754 }
1755
1756 /*
1757 * rdar://9307819
1758 * To avoid to call copyout() while holding locks and to cause problems
1759 * in the paging path, sysctl_iflist() and sysctl_iflist2() contstruct
1760 * the list in two passes. In the first pass we compute the total
1761 * length of the data we are going to copyout, then we release
1762 * all locks to allocate a temporary buffer that gets filled
1763 * in the second pass.
1764 *
1765 * Note that we are verifying the assumption that kalloc() returns a buffer
1766 * that is at least 32 bits aligned and that the messages and addresses are
1767 * 32 bits aligned.
1768 */
1769 static int
sysctl_iflist(int af,struct walkarg * w)1770 sysctl_iflist(int af, struct walkarg *w)
1771 {
1772 struct ifnet *ifp;
1773 struct ifaddr *ifa;
1774 struct rt_addrinfo info;
1775 int error = 0;
1776 int pass = 0;
1777 size_t len = 0, total_len = 0, total_buffer_len = 0, current_len = 0;
1778 char *total_buffer = NULL, *cp = NULL;
1779 kauth_cred_t cred __single;
1780
1781 cred = current_cached_proc_cred(PROC_NULL);
1782
1783 bzero((caddr_t)&info, sizeof(info));
1784
1785 for (pass = 0; pass < 2; pass++) {
1786 ifnet_head_lock_shared();
1787
1788 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
1789 if (error) {
1790 break;
1791 }
1792 if (w->w_arg && w->w_arg != ifp->if_index) {
1793 continue;
1794 }
1795 ifnet_lock_shared(ifp);
1796 /*
1797 * Holding ifnet lock here prevents the link address
1798 * from changing contents, so no need to hold the ifa
1799 * lock. The link address is always present; it's
1800 * never freed.
1801 */
1802 ifa = ifp->if_lladdr;
1803 info.rti_info[RTAX_IFP] = ifa->ifa_addr;
1804 len = rt_msg2(RTM_IFINFO, &info, NULL, NULL, &cred);
1805 if (pass == 0) {
1806 if (os_add_overflow(total_len, len, &total_len)) {
1807 ifnet_lock_done(ifp);
1808 error = ENOBUFS;
1809 break;
1810 }
1811 } else {
1812 struct if_msghdr *ifm;
1813
1814 if (current_len + len > total_len) {
1815 ifnet_lock_done(ifp);
1816 error = ENOBUFS;
1817 break;
1818 }
1819 info.rti_info[RTAX_IFP] = ifa->ifa_addr;
1820 len = rt_msg2(RTM_IFINFO, &info,
1821 (caddr_t)cp, NULL, &cred);
1822 info.rti_info[RTAX_IFP] = NULL;
1823
1824 ifm = (struct if_msghdr *)(void *)cp;
1825 ifm->ifm_index = ifp->if_index;
1826 ifm->ifm_flags = (u_short)ifp->if_flags;
1827 if_data_internal_to_if_data(ifp, &ifp->if_data,
1828 &ifm->ifm_data);
1829 ifm->ifm_addrs = info.rti_addrs;
1830 /*
1831 * <rdar://problem/32940901>
1832 * Round bytes only for non-platform
1833 */
1834 if (!csproc_get_platform_binary(w->w_req->p)) {
1835 ALIGN_BYTES(ifm->ifm_data.ifi_ibytes);
1836 ALIGN_BYTES(ifm->ifm_data.ifi_obytes);
1837 }
1838
1839 cp += len;
1840 VERIFY(IS_P2ALIGNED(cp, sizeof(u_int32_t)));
1841 current_len += len;
1842 VERIFY(current_len <= total_len);
1843 }
1844 while ((ifa = ifa->ifa_link.tqe_next) != NULL) {
1845 IFA_LOCK(ifa);
1846 if (af && af != ifa->ifa_addr->sa_family) {
1847 IFA_UNLOCK(ifa);
1848 continue;
1849 }
1850 if (ifa->ifa_addr->sa_family == AF_INET6 &&
1851 (((struct in6_ifaddr *)ifa)->ia6_flags &
1852 IN6_IFF_CLAT46) != 0) {
1853 IFA_UNLOCK(ifa);
1854 continue;
1855 }
1856 info.rti_info[RTAX_IFA] = ifa->ifa_addr;
1857 info.rti_info[RTAX_NETMASK] = ifa->ifa_netmask;
1858 info.rti_info[RTAX_BRD] = ifa->ifa_dstaddr;
1859 len = rt_msg2(RTM_NEWADDR, &info, NULL, NULL,
1860 &cred);
1861 if (pass == 0) {
1862 if (os_add_overflow(total_len, len, &total_len)) {
1863 IFA_UNLOCK(ifa);
1864 error = ENOBUFS;
1865 break;
1866 }
1867 } else {
1868 struct ifa_msghdr *ifam;
1869
1870 if (current_len + len > total_len) {
1871 IFA_UNLOCK(ifa);
1872 error = ENOBUFS;
1873 break;
1874 }
1875 len = rt_msg2(RTM_NEWADDR, &info,
1876 (caddr_t)cp, NULL, &cred);
1877
1878 ifam = (struct ifa_msghdr *)(void *)cp;
1879 ifam->ifam_index =
1880 ifa->ifa_ifp->if_index;
1881 ifam->ifam_flags = ifa->ifa_flags;
1882 ifam->ifam_metric = ifa->ifa_metric;
1883 ifam->ifam_addrs = info.rti_addrs;
1884
1885 cp += len;
1886 VERIFY(IS_P2ALIGNED(cp,
1887 sizeof(u_int32_t)));
1888 current_len += len;
1889 VERIFY(current_len <= total_len);
1890 }
1891 IFA_UNLOCK(ifa);
1892 }
1893 ifnet_lock_done(ifp);
1894 info.rti_info[RTAX_IFA] = info.rti_info[RTAX_NETMASK] =
1895 info.rti_info[RTAX_BRD] = NULL;
1896 }
1897
1898 ifnet_head_done();
1899
1900 if (error != 0) {
1901 if (error == ENOBUFS) {
1902 printf("%s: current_len (%lu) + len (%lu) > "
1903 "total_len (%lu)\n", __func__, current_len,
1904 len, total_len);
1905 }
1906 break;
1907 }
1908
1909 if (pass == 0) {
1910 /* Better to return zero length buffer than ENOBUFS */
1911 if (total_len == 0) {
1912 total_len = 1;
1913 }
1914 total_len += total_len >> 3;
1915 total_buffer_len = total_len;
1916 total_buffer = (char *) kalloc_data(total_len, Z_ZERO | Z_WAITOK);
1917 if (total_buffer == NULL) {
1918 printf("%s: kalloc_data(%lu) failed\n", __func__,
1919 total_len);
1920 error = ENOBUFS;
1921 break;
1922 }
1923 cp = total_buffer;
1924 VERIFY(IS_P2ALIGNED(cp, sizeof(u_int32_t)));
1925 } else {
1926 error = SYSCTL_OUT(w->w_req, total_buffer, current_len);
1927 if (error) {
1928 break;
1929 }
1930 }
1931 }
1932
1933 if (total_buffer != NULL) {
1934 kfree_data(total_buffer, total_buffer_len);
1935 }
1936
1937 return error;
1938 }
1939
1940 static int
sysctl_iflist2(int af,struct walkarg * w)1941 sysctl_iflist2(int af, struct walkarg *w)
1942 {
1943 struct ifnet *ifp;
1944 struct ifaddr *ifa;
1945 struct rt_addrinfo info;
1946 int error = 0;
1947 int pass = 0;
1948 size_t len = 0, total_len = 0, total_buffer_len = 0, current_len = 0;
1949 char *total_buffer = NULL, *cp = NULL;
1950 kauth_cred_t cred __single;
1951
1952 cred = current_cached_proc_cred(PROC_NULL);
1953
1954 bzero((caddr_t)&info, sizeof(info));
1955
1956 for (pass = 0; pass < 2; pass++) {
1957 struct ifmultiaddr *ifma;
1958
1959 ifnet_head_lock_shared();
1960
1961 TAILQ_FOREACH(ifp, &ifnet_head, if_link) {
1962 if (error) {
1963 break;
1964 }
1965 if (w->w_arg && w->w_arg != ifp->if_index) {
1966 continue;
1967 }
1968 ifnet_lock_shared(ifp);
1969 /*
1970 * Holding ifnet lock here prevents the link address
1971 * from changing contents, so no need to hold the ifa
1972 * lock. The link address is always present; it's
1973 * never freed.
1974 */
1975 ifa = ifp->if_lladdr;
1976 info.rti_info[RTAX_IFP] = ifa->ifa_addr;
1977 len = rt_msg2(RTM_IFINFO2, &info, NULL, NULL, &cred);
1978 if (pass == 0) {
1979 if (os_add_overflow(total_len, len, &total_len)) {
1980 ifnet_lock_done(ifp);
1981 error = ENOBUFS;
1982 break;
1983 }
1984 } else {
1985 struct if_msghdr2 *ifm;
1986
1987 if (current_len + len > total_len) {
1988 ifnet_lock_done(ifp);
1989 error = ENOBUFS;
1990 break;
1991 }
1992 info.rti_info[RTAX_IFP] = ifa->ifa_addr;
1993 len = rt_msg2(RTM_IFINFO2, &info,
1994 (caddr_t)cp, NULL, &cred);
1995 info.rti_info[RTAX_IFP] = NULL;
1996
1997 ifm = (struct if_msghdr2 *)(void *)cp;
1998 ifm->ifm_addrs = info.rti_addrs;
1999 ifm->ifm_flags = (u_short)ifp->if_flags;
2000 ifm->ifm_index = ifp->if_index;
2001 ifm->ifm_snd_len = IFCQ_LEN(ifp->if_snd);
2002 ifm->ifm_snd_maxlen = IFCQ_MAXLEN(ifp->if_snd);
2003 ifm->ifm_snd_drops =
2004 (int)ifp->if_snd->ifcq_dropcnt.packets;
2005 ifm->ifm_timer = ifp->if_timer;
2006 if_data_internal_to_if_data64(ifp,
2007 &ifp->if_data, &ifm->ifm_data);
2008 /*
2009 * <rdar://problem/32940901>
2010 * Round bytes only for non-platform
2011 */
2012 if (!csproc_get_platform_binary(w->w_req->p)) {
2013 ALIGN_BYTES(ifm->ifm_data.ifi_ibytes);
2014 ALIGN_BYTES(ifm->ifm_data.ifi_obytes);
2015 }
2016
2017 cp += len;
2018 VERIFY(IS_P2ALIGNED(cp, sizeof(u_int32_t)));
2019 current_len += len;
2020 VERIFY(current_len <= total_len);
2021 }
2022 while ((ifa = ifa->ifa_link.tqe_next) != NULL) {
2023 IFA_LOCK(ifa);
2024 if (af && af != ifa->ifa_addr->sa_family) {
2025 IFA_UNLOCK(ifa);
2026 continue;
2027 }
2028 if (ifa->ifa_addr->sa_family == AF_INET6 &&
2029 (((struct in6_ifaddr *)ifa)->ia6_flags &
2030 IN6_IFF_CLAT46) != 0) {
2031 IFA_UNLOCK(ifa);
2032 continue;
2033 }
2034
2035 info.rti_info[RTAX_IFA] = ifa->ifa_addr;
2036 info.rti_info[RTAX_NETMASK] = ifa->ifa_netmask;
2037 info.rti_info[RTAX_BRD] = ifa->ifa_dstaddr;
2038 len = rt_msg2(RTM_NEWADDR, &info, NULL, NULL,
2039 &cred);
2040 if (pass == 0) {
2041 if (os_add_overflow(total_len, len, &total_len)) {
2042 IFA_UNLOCK(ifa);
2043 error = ENOBUFS;
2044 break;
2045 }
2046 } else {
2047 struct ifa_msghdr *ifam;
2048
2049 if (current_len + len > total_len) {
2050 IFA_UNLOCK(ifa);
2051 error = ENOBUFS;
2052 break;
2053 }
2054 len = rt_msg2(RTM_NEWADDR, &info,
2055 (caddr_t)cp, NULL, &cred);
2056
2057 ifam = (struct ifa_msghdr *)(void *)cp;
2058 ifam->ifam_index =
2059 ifa->ifa_ifp->if_index;
2060 ifam->ifam_flags = ifa->ifa_flags;
2061 ifam->ifam_metric = ifa->ifa_metric;
2062 ifam->ifam_addrs = info.rti_addrs;
2063
2064 cp += len;
2065 VERIFY(IS_P2ALIGNED(cp,
2066 sizeof(u_int32_t)));
2067 current_len += len;
2068 VERIFY(current_len <= total_len);
2069 }
2070 IFA_UNLOCK(ifa);
2071 }
2072 if (error) {
2073 ifnet_lock_done(ifp);
2074 break;
2075 }
2076
2077 for (ifma = LIST_FIRST(&ifp->if_multiaddrs);
2078 ifma != NULL; ifma = LIST_NEXT(ifma, ifma_link)) {
2079 struct ifaddr *ifa0;
2080
2081 IFMA_LOCK(ifma);
2082 if (af && af != ifma->ifma_addr->sa_family) {
2083 IFMA_UNLOCK(ifma);
2084 continue;
2085 }
2086 bzero((caddr_t)&info, sizeof(info));
2087 info.rti_info[RTAX_IFA] = ifma->ifma_addr;
2088 /*
2089 * Holding ifnet lock here prevents the link
2090 * address from changing contents, so no need
2091 * to hold the ifa0 lock. The link address is
2092 * always present; it's never freed.
2093 */
2094 ifa0 = ifp->if_lladdr;
2095 info.rti_info[RTAX_IFP] = ifa0->ifa_addr;
2096 if (ifma->ifma_ll != NULL) {
2097 info.rti_info[RTAX_GATEWAY] =
2098 ifma->ifma_ll->ifma_addr;
2099 }
2100 len = rt_msg2(RTM_NEWMADDR2, &info, NULL, NULL,
2101 &cred);
2102 if (pass == 0) {
2103 total_len += len;
2104 } else {
2105 struct ifma_msghdr2 *ifmam;
2106
2107 if (current_len + len > total_len) {
2108 IFMA_UNLOCK(ifma);
2109 error = ENOBUFS;
2110 break;
2111 }
2112 len = rt_msg2(RTM_NEWMADDR2, &info,
2113 (caddr_t)cp, NULL, &cred);
2114
2115 ifmam =
2116 (struct ifma_msghdr2 *)(void *)cp;
2117 ifmam->ifmam_addrs = info.rti_addrs;
2118 ifmam->ifmam_flags = 0;
2119 ifmam->ifmam_index =
2120 ifma->ifma_ifp->if_index;
2121 ifmam->ifmam_refcount =
2122 ifma->ifma_reqcnt;
2123
2124 cp += len;
2125 VERIFY(IS_P2ALIGNED(cp,
2126 sizeof(u_int32_t)));
2127 current_len += len;
2128 }
2129 IFMA_UNLOCK(ifma);
2130 }
2131 ifnet_lock_done(ifp);
2132 info.rti_info[RTAX_IFA] = info.rti_info[RTAX_NETMASK] =
2133 info.rti_info[RTAX_BRD] = NULL;
2134 }
2135 ifnet_head_done();
2136
2137 if (error) {
2138 if (error == ENOBUFS) {
2139 printf("%s: current_len (%lu) + len (%lu) > "
2140 "total_len (%lu)\n", __func__, current_len,
2141 len, total_len);
2142 }
2143 break;
2144 }
2145
2146 if (pass == 0) {
2147 /* Better to return zero length buffer than ENOBUFS */
2148 if (total_len == 0) {
2149 total_len = 1;
2150 }
2151 total_len += total_len >> 3;
2152 total_buffer_len = total_len;
2153 total_buffer = (char *) kalloc_data(total_len, Z_ZERO | Z_WAITOK);
2154 if (total_buffer == NULL) {
2155 printf("%s: kalloc_data(%lu) failed\n", __func__,
2156 total_len);
2157 error = ENOBUFS;
2158 break;
2159 }
2160 cp = total_buffer;
2161 VERIFY(IS_P2ALIGNED(cp, sizeof(u_int32_t)));
2162 } else {
2163 error = SYSCTL_OUT(w->w_req, total_buffer, current_len);
2164 if (error) {
2165 break;
2166 }
2167 }
2168 }
2169
2170 if (total_buffer != NULL) {
2171 kfree_data(total_buffer, total_buffer_len);
2172 }
2173
2174 return error;
2175 }
2176
2177
2178 static int
sysctl_rtstat(struct sysctl_req * req)2179 sysctl_rtstat(struct sysctl_req *req)
2180 {
2181 return SYSCTL_OUT(req, &rtstat, sizeof(struct rtstat));
2182 }
2183
2184 static int
sysctl_rttrash(struct sysctl_req * req)2185 sysctl_rttrash(struct sysctl_req *req)
2186 {
2187 return SYSCTL_OUT(req, &rttrash, sizeof(rttrash));
2188 }
2189
2190 static int
2191 sysctl_rtsock SYSCTL_HANDLER_ARGS
2192 {
2193 #pragma unused(oidp)
2194 int *name = (int *)arg1;
2195 u_int namelen = arg2;
2196 struct radix_node_head *rnh;
2197 int i, error = EINVAL;
2198 u_char af;
2199 struct walkarg w;
2200
2201 name++;
2202 namelen--;
2203 if (req->newptr) {
2204 return EPERM;
2205 }
2206 if (namelen != 3) {
2207 return EINVAL;
2208 }
2209 af = (u_char)name[0];
2210 Bzero(&w, sizeof(w));
2211 w.w_op = name[1];
2212 w.w_arg = name[2];
2213 w.w_req = req;
2214
2215 switch (w.w_op) {
2216 case NET_RT_DUMP:
2217 case NET_RT_DUMP2:
2218 case NET_RT_FLAGS:
2219 case NET_RT_FLAGS_PRIV:
2220 lck_mtx_lock(rnh_lock);
2221 for (i = 1; i <= AF_MAX; i++) {
2222 if ((rnh = rt_tables[i]) && (af == 0 || af == i) &&
2223 (error = rnh->rnh_walktree(rnh,
2224 sysctl_dumpentry, &w))) {
2225 break;
2226 }
2227 }
2228 lck_mtx_unlock(rnh_lock);
2229 break;
2230 case NET_RT_DUMPX:
2231 case NET_RT_DUMPX_FLAGS:
2232 lck_mtx_lock(rnh_lock);
2233 for (i = 1; i <= AF_MAX; i++) {
2234 if ((rnh = rt_tables[i]) && (af == 0 || af == i) &&
2235 (error = rnh->rnh_walktree(rnh,
2236 sysctl_dumpentry_ext, &w))) {
2237 break;
2238 }
2239 }
2240 lck_mtx_unlock(rnh_lock);
2241 break;
2242 case NET_RT_IFLIST:
2243 error = sysctl_iflist(af, &w);
2244 break;
2245 case NET_RT_IFLIST2:
2246 error = sysctl_iflist2(af, &w);
2247 break;
2248 case NET_RT_STAT:
2249 error = sysctl_rtstat(req);
2250 break;
2251 case NET_RT_TRASH:
2252 error = sysctl_rttrash(req);
2253 break;
2254 }
2255 if (w.w_tmem != NULL) {
2256 kfree_data(w.w_tmem, w.w_tmemsize);
2257 }
2258 return error;
2259 }
2260
2261 /*
2262 * Definitions of protocols supported in the ROUTE domain.
2263 */
2264 static struct protosw routesw[] = {
2265 {
2266 .pr_type = SOCK_RAW,
2267 .pr_protocol = 0,
2268 .pr_flags = PR_ATOMIC | PR_ADDR,
2269 .pr_output = route_output,
2270 .pr_ctlinput = raw_ctlinput,
2271 .pr_usrreqs = &route_usrreqs,
2272 }
2273 };
2274
2275 static int route_proto_count = (sizeof(routesw) / sizeof(struct protosw));
2276
2277 struct domain routedomain_s = {
2278 .dom_family = PF_ROUTE,
2279 .dom_name = "route",
2280 .dom_init = route_dinit,
2281 };
2282
2283 static void
route_dinit(struct domain * dp)2284 route_dinit(struct domain *dp)
2285 {
2286 struct protosw *pr;
2287 int i;
2288
2289 VERIFY(!(dp->dom_flags & DOM_INITIALIZED));
2290 VERIFY(routedomain == NULL);
2291
2292 routedomain = dp;
2293
2294 for (i = 0, pr = &routesw[0]; i < route_proto_count; i++, pr++) {
2295 net_add_proto(pr, dp, 1);
2296 }
2297
2298 route_init();
2299 }
2300