1 /*
2 * Copyright (c) 2000-2024 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1988, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)raw_ip.c 8.7 (Berkeley) 5/15/95
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/malloc.h>
73 #include <sys/mbuf.h>
74 #include <sys/mcache.h>
75 #include <sys/proc.h>
76 #include <sys/domain.h>
77 #include <sys/protosw.h>
78 #include <sys/socket.h>
79 #include <sys/socketvar.h>
80 #include <sys/sysctl.h>
81 #include <libkern/OSAtomic.h>
82 #include <kern/zalloc.h>
83
84 #include <pexpert/pexpert.h>
85
86 #include <net/if.h>
87 #include <net/net_api_stats.h>
88 #include <net/route.h>
89 #include <net/content_filter.h>
90 #include <net/sockaddr_utils.h>
91
92 #define _IP_VHL
93 #include <netinet/in.h>
94 #include <netinet/in_systm.h>
95 #include <netinet/in_tclass.h>
96 #include <netinet/ip.h>
97 #include <netinet/in_pcb.h>
98 #include <netinet/in_var.h>
99 #include <netinet/ip_var.h>
100
101 #include <netinet6/in6_pcb.h>
102
103
104 #if IPSEC
105 #include <netinet6/ipsec.h>
106 #endif /*IPSEC*/
107
108 #if DUMMYNET
109 #include <netinet/ip_dummynet.h>
110 #endif /* DUMMYNET */
111
112 int rip_detach(struct socket *);
113 int rip_abort(struct socket *);
114 int rip_disconnect(struct socket *);
115 int rip_bind(struct socket *, struct sockaddr *, struct proc *);
116 int rip_connect(struct socket *, struct sockaddr *, struct proc *);
117 int rip_shutdown(struct socket *);
118
119 struct inpcbhead ripcb;
120 struct inpcbinfo ripcbinfo;
121
122 /* control hooks for dummynet */
123 #if DUMMYNET
124 ip_dn_ctl_t *ip_dn_ctl_ptr;
125 #endif /* DUMMYNET */
126
127 /*
128 * Nominal space allocated to a raw ip socket.
129 */
130 #define RIPSNDQ 8192
131 #define RIPRCVQ 8192
132
133 static KALLOC_TYPE_DEFINE(ripzone, struct inpcb, NET_KT_DEFAULT);
134
135 /*
136 * Raw interface to IP protocol.
137 */
138
139 /*
140 * Initialize raw connection block q.
141 */
142 void
rip_init(struct protosw * pp,struct domain * dp)143 rip_init(struct protosw *pp, struct domain *dp)
144 {
145 #pragma unused(dp)
146 static int rip_initialized = 0;
147 struct inpcbinfo *pcbinfo;
148
149 VERIFY((pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
150
151 if (rip_initialized) {
152 return;
153 }
154 rip_initialized = 1;
155
156 LIST_INIT(&ripcb);
157 ripcbinfo.ipi_listhead = &ripcb;
158 /*
159 * XXX We don't use the hash list for raw IP, but it's easier
160 * to allocate a one entry hash list than it is to check all
161 * over the place for ipi_hashbase == NULL.
162 */
163 hashinit_counted_by(1, ripcbinfo.ipi_hashbase,
164 ripcbinfo.ipi_hashbase_count);
165 ripcbinfo.ipi_hashmask = ripcbinfo.ipi_hashbase_count - 1;
166 hashinit_counted_by(1, ripcbinfo.ipi_porthashbase,
167 ripcbinfo.ipi_porthashbase_count);
168 ripcbinfo.ipi_porthashmask = ripcbinfo.ipi_porthashbase_count - 1;
169 ripcbinfo.ipi_zone = ripzone;
170
171 pcbinfo = &ripcbinfo;
172 /*
173 * allocate lock group attribute and group for udp pcb mutexes
174 */
175 pcbinfo->ipi_lock_grp = lck_grp_alloc_init("ripcb", LCK_GRP_ATTR_NULL);
176
177 /*
178 * allocate the lock attribute for udp pcb mutexes
179 */
180 lck_attr_setdefault(&pcbinfo->ipi_lock_attr);
181 lck_rw_init(&pcbinfo->ipi_lock, pcbinfo->ipi_lock_grp,
182 &pcbinfo->ipi_lock_attr);
183
184 in_pcbinfo_attach(&ripcbinfo);
185 }
186
187 static uint32_t
rip_inp_input(struct inpcb * inp,struct mbuf * m,int iphlen)188 rip_inp_input(struct inpcb *inp, struct mbuf *m, int iphlen)
189 {
190 struct ip *ip = mtod(m, struct ip *);
191 struct ifnet *ifp = m->m_pkthdr.rcvif;
192 struct sockaddr_in ripsrc = {
193 .sin_len = sizeof(ripsrc),
194 .sin_family = AF_INET,
195 .sin_port = 0,
196 .sin_addr = { .s_addr = 0 },
197 .sin_zero = {0, 0, 0, 0, 0, 0, 0, 0, }
198 };
199 mbuf_ref_t opts = NULL;
200 boolean_t is_wake_pkt = false;
201 uint32_t num_delivered = 0;
202
203 #if NECP
204 if (!necp_socket_is_allowed_to_send_recv_v4(inp, 0, 0,
205 &ip->ip_dst, &ip->ip_src, ifp, 0, NULL, NULL, NULL, NULL)) {
206 /* do not inject data to pcb */
207 m_freem(m);
208 goto done;
209 }
210 #endif /* NECP */
211
212 ripsrc.sin_addr = ip->ip_src;
213
214 if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.pkt_flags & PKTF_WAKE_PKT)) {
215 is_wake_pkt = true;
216 }
217
218 if ((inp->inp_flags & INP_CONTROLOPTS) != 0 ||
219 SOFLOW_ENABLED(inp->inp_socket) ||
220 SO_RECV_CONTROL_OPTS(inp->inp_socket)) {
221 if (ip_savecontrol(inp, &opts, ip, m) != 0) {
222 m_freem(m);
223 m_freem(opts);
224 goto done;
225 }
226 }
227 if (inp->inp_flags & INP_STRIPHDR
228 #if CONTENT_FILTER
229 /*
230 * If socket is subject to Content Filter, delay stripping until reinject
231 */
232 && (!CFIL_DGRAM_FILTERED(inp->inp_socket))
233 #endif
234 ) {
235 m->m_len -= iphlen;
236 m->m_pkthdr.len -= iphlen;
237 m->m_data += iphlen;
238 }
239 so_recv_data_stat(inp->inp_socket, m, 0);
240 if (sbappendaddr(&inp->inp_socket->so_rcv,
241 (struct sockaddr *)&ripsrc, m, opts, NULL) != 0) {
242 num_delivered = 1;
243 sorwakeup(inp->inp_socket);
244 if (is_wake_pkt) {
245 soevent(inp->in6p_socket,
246 SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
247 }
248 } else {
249 ipstat.ips_raw_sappend_fail++;
250 }
251 done:
252 return num_delivered;
253 }
254
255 /*
256 * The first pass is for IPv4 socket and the second pass for IPv6
257 */
258 static bool
rip_input_inner(struct mbuf * m,int iphlen,bool is_ipv4_pass,uint32_t * total_delivered)259 rip_input_inner(struct mbuf *m, int iphlen, bool is_ipv4_pass, uint32_t *total_delivered)
260 {
261 struct inpcb *inp;
262 struct inpcb *last = NULL;
263 struct ip *ip = mtod(m, struct ip *);
264 struct ifnet *ifp = m->m_pkthdr.rcvif;
265 bool need_ipv6_pass = false;
266 uint32_t num_delivered = 0;
267
268 lck_rw_lock_shared(&ripcbinfo.ipi_lock);
269 LIST_FOREACH(inp, &ripcb, inp_list) {
270 if (is_ipv4_pass) {
271 if ((inp->inp_vflag & (INP_IPV4 | INP_IPV6)) != INP_IPV4) {
272 /* Tell if we need to an IPv6 pass */
273 need_ipv6_pass = true;
274 continue;
275 }
276 } else {
277 if ((inp->inp_vflag & (INP_IPV4 | INP_IPV6)) != (INP_IPV4 | INP_IPV6)) {
278 continue;
279 }
280 }
281 if (inp->inp_ip_p && (inp->inp_ip_p != ip->ip_p)) {
282 continue;
283 }
284 if (inp->inp_laddr.s_addr &&
285 inp->inp_laddr.s_addr != ip->ip_dst.s_addr) {
286 continue;
287 }
288 if (inp->inp_faddr.s_addr &&
289 inp->inp_faddr.s_addr != ip->ip_src.s_addr) {
290 continue;
291 }
292 if (inp_restricted_recv(inp, ifp)) {
293 continue;
294 }
295 if (last != NULL) {
296 struct mbuf *n = m_copym_mode(m, 0, (int)M_COPYALL, M_DONTWAIT, NULL, NULL, M_COPYM_MUST_COPY_HDR);
297
298 if (n == NULL) {
299 continue;
300 }
301 num_delivered += rip_inp_input(last, n, iphlen);
302 }
303 last = inp;
304 }
305
306 /*
307 * Consume the orignal mbuf 'm' if:
308 * - it is the first pass and there is no IPv6 raw socket
309 * - it is the second pass for IPv6
310 */
311 if (need_ipv6_pass == false || is_ipv4_pass == false) {
312 if (last != NULL) {
313 num_delivered += rip_inp_input(last, m, iphlen);
314 } else {
315 m_freem(m);
316 }
317 } else {
318 if (last != NULL) {
319 struct mbuf *n = m_copym_mode(m, 0, (int)M_COPYALL, M_DONTWAIT, NULL, NULL, M_COPYM_MUST_COPY_HDR);
320
321 if (n != NULL) {
322 num_delivered += rip_inp_input(last, n, iphlen);
323 }
324 }
325 }
326 /*
327 * Keep the list locked because socket filter may force the socket lock
328 * to be released when calling sbappendaddr() -- see rdar://7627704
329 */
330 lck_rw_done(&ripcbinfo.ipi_lock);
331
332 *total_delivered += num_delivered;
333
334 return need_ipv6_pass;
335 }
336
337
338 /*
339 * Setup generic address and protocol structures
340 * for raw_input routine, then pass them along with
341 * mbuf chain.
342 */
343 void
rip_input(struct mbuf * m,int iphlen)344 rip_input(struct mbuf *m, int iphlen)
345 {
346 uint32_t num_delivered = 0;
347 bool need_v6_pass = false;
348
349 /* Expect 32-bit aligned data pointer on strict-align platforms */
350 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
351
352 /*
353 * First pass for raw IPv4 sockets that are protected by the inet_domain_mutex lock
354 */
355 need_v6_pass = rip_input_inner(m, iphlen, true, &num_delivered);
356
357 /*
358 * For the IPv6 pass we need to switch to the inet6_domain_mutex lock
359 * to protect the raw IPv6 sockets
360 */
361 if (need_v6_pass) {
362 lck_mtx_unlock(inet_domain_mutex);
363
364 lck_mtx_lock(inet6_domain_mutex);
365 rip_input_inner(m, iphlen, false, &num_delivered);
366 lck_mtx_unlock(inet6_domain_mutex);
367
368 lck_mtx_lock(inet_domain_mutex);
369 }
370
371 if (num_delivered > 0) {
372 OSAddAtomic(1, &ipstat.ips_delivered);
373 } else {
374 OSAddAtomic(1, &ipstat.ips_noproto);
375 }
376 }
377
378 /*
379 * Generate IP header and pass packet to ip_output.
380 * Tack on options user may have setup with control call.
381 */
382 int
rip_output(struct mbuf * m,struct socket * so,u_int32_t dst,struct mbuf * control)383 rip_output(
384 struct mbuf *m,
385 struct socket *so,
386 u_int32_t dst,
387 struct mbuf *control)
388 {
389 struct ip *ip;
390 struct inpcb *inp = sotoinpcb(so);
391 int flags = (so->so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
392 int inp_flags = inp ? inp->inp_flags : 0;
393 struct ip_out_args ipoa;
394 struct ip_moptions *imo;
395 int tos = IPTOS_UNSPEC;
396 int error = 0;
397 #if CONTENT_FILTER
398 struct m_tag *cfil_tag = NULL;
399 bool cfil_faddr_use = false;
400 uint32_t cfil_so_state_change_cnt = 0;
401 uint32_t cfil_so_options = 0;
402 int cfil_inp_flags = 0;
403 struct sockaddr *__single cfil_faddr = NULL;
404 struct sockaddr_in *__single cfil_sin;
405 u_int32_t cfil_dst = 0;
406 #endif
407
408 #if CONTENT_FILTER
409 /*
410 * If socket is subject to Content Filter and no addr is passed in,
411 * retrieve CFIL saved state from mbuf and use it if necessary.
412 */
413 if (CFIL_DGRAM_FILTERED(so) && dst == INADDR_ANY) {
414 cfil_tag = cfil_dgram_get_socket_state(m, &cfil_so_state_change_cnt, &cfil_so_options, &cfil_faddr, &cfil_inp_flags);
415 if (cfil_tag) {
416 cfil_sin = SIN(cfil_faddr);
417 flags = (cfil_so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
418 inp_flags = cfil_inp_flags;
419 if (inp && inp->inp_faddr.s_addr == INADDR_ANY) {
420 /*
421 * Socket is unconnected, simply use the saved faddr as 'addr' to go through
422 * the connect/disconnect logic.
423 */
424 dst = cfil_sin->sin_addr.s_addr;
425 } else if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
426 (inp->inp_fport != cfil_sin->sin_port ||
427 inp->inp_faddr.s_addr != cfil_sin->sin_addr.s_addr)) {
428 /*
429 * Socket is connected but socket state and dest addr/port changed.
430 * We need to use the saved faddr and socket options.
431 */
432 cfil_faddr_use = true;
433 cfil_dst = cfil_sin->sin_addr.s_addr;
434 }
435 m_tag_free(cfil_tag);
436 }
437 }
438 #endif
439
440 if (so->so_state & SS_ISCONNECTED) {
441 if (dst != INADDR_ANY) {
442 if (m != NULL) {
443 m_freem(m);
444 }
445 if (control != NULL) {
446 m_freem(control);
447 }
448 return EISCONN;
449 }
450 dst = cfil_faddr_use ? cfil_dst : inp->inp_faddr.s_addr;
451 } else {
452 if (dst == INADDR_ANY) {
453 if (m != NULL) {
454 m_freem(m);
455 }
456 if (control != NULL) {
457 m_freem(control);
458 }
459 return ENOTCONN;
460 }
461 }
462
463 bzero(&ipoa, sizeof(ipoa));
464 ipoa.ipoa_boundif = IFSCOPE_NONE;
465 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF;
466
467 int sotc = SO_TC_UNSPEC;
468 int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
469
470
471 if (control != NULL) {
472 tos = so_tos_from_control(control);
473 sotc = so_tc_from_control(control, &netsvctype);
474
475 m_freem(control);
476 control = NULL;
477 }
478 if (sotc == SO_TC_UNSPEC) {
479 sotc = so->so_traffic_class;
480 netsvctype = so->so_netsvctype;
481 }
482
483 if (inp == NULL
484 #if NECP
485 || (necp_socket_should_use_flow_divert(inp))
486 #endif /* NECP */
487 ) {
488 if (m != NULL) {
489 m_freem(m);
490 }
491 VERIFY(control == NULL);
492 return inp == NULL ? EINVAL : EPROTOTYPE;
493 }
494
495 flags |= IP_OUTARGS;
496 /* If socket was bound to an ifindex, tell ip_output about it */
497 if (inp->inp_flags & INP_BOUND_IF) {
498 ipoa.ipoa_boundif = inp->inp_boundifp->if_index;
499 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
500 }
501 if (INP_NO_CELLULAR(inp)) {
502 ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
503 }
504 if (INP_NO_EXPENSIVE(inp)) {
505 ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
506 }
507 if (INP_NO_CONSTRAINED(inp)) {
508 ipoa.ipoa_flags |= IPOAF_NO_CONSTRAINED;
509 }
510 if (INP_AWDL_UNRESTRICTED(inp)) {
511 ipoa.ipoa_flags |= IPOAF_AWDL_UNRESTRICTED;
512 }
513 if (INP_MANAGEMENT_ALLOWED(inp)) {
514 ipoa.ipoa_flags |= IPOAF_MANAGEMENT_ALLOWED;
515 }
516 if (INP_ULTRA_CONSTRAINED_ALLOWED(inp)) {
517 ipoa.ipoa_flags |= IPOAF_ULTRA_CONSTRAINED_ALLOWED;
518 }
519 ipoa.ipoa_sotc = sotc;
520 ipoa.ipoa_netsvctype = netsvctype;
521
522 if (inp->inp_flowhash == 0) {
523 inp_calc_flowhash(inp);
524 ASSERT(inp->inp_flowhash != 0);
525 }
526
527 /*
528 * If the user handed us a complete IP packet, use it.
529 * Otherwise, allocate an mbuf for a header and fill it in.
530 */
531 if ((inp_flags & INP_HDRINCL) == 0) {
532 if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
533 m_freem(m);
534 return EMSGSIZE;
535 }
536 M_PREPEND(m, sizeof(struct ip), M_WAIT, 1);
537 if (m == NULL) {
538 return ENOBUFS;
539 }
540 ip = mtod(m, struct ip *);
541 if (tos != IPTOS_UNSPEC) {
542 ip->ip_tos = (uint8_t)(tos & IPTOS_MASK);
543 } else {
544 ip->ip_tos = inp->inp_ip_tos;
545 }
546 if (inp->inp_flags2 & INP2_DONTFRAG) {
547 ip->ip_off = IP_DF;
548 } else {
549 ip->ip_off = 0;
550 }
551 ip->ip_p = inp->inp_ip_p;
552 ip->ip_len = (uint16_t)m->m_pkthdr.len;
553 ip->ip_src = inp->inp_laddr;
554 ip->ip_dst.s_addr = dst;
555 ip->ip_ttl = inp->inp_ip_ttl;
556 } else {
557 if (m->m_pkthdr.len > IP_MAXPACKET) {
558 m_freem(m);
559 return EMSGSIZE;
560 }
561 ip = mtod(m, struct ip *);
562 /*
563 * don't allow both user specified and setsockopt options,
564 * and don't allow packet length sizes that will crash
565 */
566 if (m->m_pkthdr.len < sizeof(struct ip) ||
567 ((IP_VHL_HL(ip->ip_vhl) != (sizeof(*ip) >> 2)) && inp->inp_options) ||
568 (ip->ip_len > m->m_pkthdr.len) ||
569 (ip->ip_len < (IP_VHL_HL(ip->ip_vhl) << 2))) {
570 m_freem(m);
571 return EINVAL;
572 }
573 if (ip->ip_id == 0 && !(rfc6864 && IP_OFF_IS_ATOMIC(ntohs(ip->ip_off)))) {
574 ip->ip_id = ip_randomid((uint64_t)m);
575 }
576 /* XXX prevent ip_output from overwriting header fields */
577 flags |= IP_RAWOUTPUT;
578 OSAddAtomic(1, &ipstat.ips_rawout);
579 }
580
581 if (inp->inp_laddr.s_addr != INADDR_ANY) {
582 ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
583 }
584
585 #if NECP
586 {
587 necp_kernel_policy_id policy_id;
588 necp_kernel_policy_id skip_policy_id;
589 u_int32_t route_rule_id;
590 u_int32_t pass_flags;
591
592 /*
593 * We need a route to perform NECP route rule checks
594 */
595 if ((net_qos_policy_restricted != 0 &&
596 ROUTE_UNUSABLE(&inp->inp_route))
597 #if CONTENT_FILTER
598 || cfil_faddr_use
599 #endif
600 ) {
601 struct sockaddr_in to;
602 struct sockaddr_in from;
603 struct in_addr laddr = ip->ip_src;
604
605 ROUTE_RELEASE(&inp->inp_route);
606
607 bzero(&from, sizeof(struct sockaddr_in));
608 from.sin_family = AF_INET;
609 from.sin_len = sizeof(struct sockaddr_in);
610 from.sin_addr = laddr;
611
612 bzero(&to, sizeof(struct sockaddr_in));
613 to.sin_family = AF_INET;
614 to.sin_len = sizeof(struct sockaddr_in);
615 to.sin_addr.s_addr = ip->ip_dst.s_addr;
616
617 if ((error = in_pcbladdr(inp, (struct sockaddr *)&to,
618 &laddr, ipoa.ipoa_boundif, NULL, 1)) != 0) {
619 printf("%s in_pcbladdr(%p) error %d\n",
620 __func__, inp, error);
621 m_freem(m);
622 return error;
623 }
624
625 inp_update_necp_policy(inp, (struct sockaddr *)&from,
626 (struct sockaddr *)&to, ipoa.ipoa_boundif);
627 inp->inp_policyresult.results.qos_marking_gencount = 0;
628 }
629
630 if (!necp_socket_is_allowed_to_send_recv_v4(inp, 0, 0,
631 &ip->ip_src, &ip->ip_dst, NULL, 0, &policy_id, &route_rule_id, &skip_policy_id, &pass_flags)) {
632 m_freem(m);
633 return EHOSTUNREACH;
634 }
635
636 necp_mark_packet_from_socket(m, inp, policy_id, route_rule_id, skip_policy_id, pass_flags);
637
638 if (net_qos_policy_restricted != 0) {
639 struct ifnet *rt_ifp = NULL;
640
641 if (inp->inp_route.ro_rt != NULL) {
642 rt_ifp = inp->inp_route.ro_rt->rt_ifp;
643 }
644
645 necp_socket_update_qos_marking(inp, inp->inp_route.ro_rt, route_rule_id);
646 }
647 }
648 #endif /* NECP */
649 if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
650 ipoa.ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
651 }
652 #if IPSEC
653 if (inp->inp_sp != NULL && ipsec_setsocket(m, so) != 0) {
654 m_freem(m);
655 return ENOBUFS;
656 }
657 #endif /*IPSEC*/
658
659 if (ROUTE_UNUSABLE(&inp->inp_route)) {
660 ROUTE_RELEASE(&inp->inp_route);
661 }
662
663 set_packet_service_class(m, so, sotc, 0);
664 m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
665 m->m_pkthdr.pkt_flowid = inp->inp_flowhash;
666 m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC |
667 PKTF_FLOW_RAWSOCK);
668 m->m_pkthdr.pkt_proto = inp->inp_ip_p;
669 m->m_pkthdr.tx_rawip_pid = so->last_pid;
670 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
671 if (so->so_flags & SOF_DELEGATED) {
672 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
673 } else {
674 m->m_pkthdr.tx_rawip_e_pid = 0;
675 }
676 #if (DEBUG || DEVELOPMENT)
677 if (so->so_flags & SOF_MARK_WAKE_PKT) {
678 so->so_flags &= ~SOF_MARK_WAKE_PKT;
679 m->m_pkthdr.pkt_flags |= PKTF_WAKE_PKT;
680 }
681 #endif /* (DEBUG || DEVELOPMENT) */
682
683 imo = inp->inp_moptions;
684 if (imo != NULL) {
685 IMO_ADDREF(imo);
686 }
687 /*
688 * The domain lock is held across ip_output, so it is okay
689 * to pass the PCB cached route pointer directly to IP and
690 * the modules beneath it.
691 */
692 // TODO: PASS DOWN ROUTE RULE ID
693 error = ip_output(m, inp->inp_options, &inp->inp_route, flags,
694 imo, &ipoa);
695
696 if (imo != NULL) {
697 IMO_REMREF(imo);
698 }
699
700 if (inp->inp_route.ro_rt != NULL) {
701 struct rtentry *rt = inp->inp_route.ro_rt;
702 struct ifnet *outif;
703
704 if ((rt->rt_flags & (RTF_MULTICAST | RTF_BROADCAST)) ||
705 inp->inp_socket == NULL ||
706 #if CONTENT_FILTER
707 /* Discard temporary route for cfil case */
708 cfil_faddr_use ||
709 #endif
710 !(inp->inp_socket->so_state & SS_ISCONNECTED)) {
711 rt = NULL; /* unusable */
712 }
713 /*
714 * Always discard the cached route for unconnected
715 * socket or if it is a multicast route.
716 */
717 if (rt == NULL) {
718 ROUTE_RELEASE(&inp->inp_route);
719 }
720
721 /*
722 * If this is a connected socket and the destination
723 * route is unicast, update outif with that of the
724 * route interface used by IP.
725 */
726 if (rt != NULL &&
727 (outif = rt->rt_ifp) != inp->inp_last_outifp) {
728 inp->inp_last_outifp = outif;
729 }
730 } else {
731 ROUTE_RELEASE(&inp->inp_route);
732 }
733
734 /*
735 * If output interface was cellular/expensive/constrained, and this socket is
736 * denied access to it, generate an event.
737 */
738 if (error != 0 && (ipoa.ipoa_flags & IPOAF_R_IFDENIED) &&
739 (INP_NO_CELLULAR(inp) || INP_NO_EXPENSIVE(inp) || INP_NO_CONSTRAINED(inp))) {
740 soevent(so, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
741 }
742
743 return error;
744 }
745
746
747 /*
748 * Raw IP socket option processing.
749 */
750 int
rip_ctloutput(struct socket * so,struct sockopt * sopt)751 rip_ctloutput(struct socket *so, struct sockopt *sopt)
752 {
753 struct inpcb *inp = sotoinpcb(so);
754 int error, optval;
755
756 /* Allow <SOL_SOCKET,SO_BINDTODEVICE> at this level */
757 if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_BINDTODEVICE) {
758 return ip_ctloutput(so, sopt);
759 }
760
761 if (sopt->sopt_level != IPPROTO_IP) {
762 return EINVAL;
763 }
764
765 error = 0;
766
767 switch (sopt->sopt_dir) {
768 case SOPT_GET:
769 switch (sopt->sopt_name) {
770 case IP_HDRINCL:
771 optval = inp->inp_flags & INP_HDRINCL;
772 error = sooptcopyout(sopt, &optval, sizeof optval);
773 break;
774
775 case IP_STRIPHDR:
776 optval = inp->inp_flags & INP_STRIPHDR;
777 error = sooptcopyout(sopt, &optval, sizeof optval);
778 break;
779
780
781 #if DUMMYNET
782 case IP_DUMMYNET_GET:
783 if (!DUMMYNET_LOADED) {
784 ip_dn_init();
785 }
786 if (DUMMYNET_LOADED) {
787 error = ip_dn_ctl_ptr(sopt);
788 } else {
789 error = ENOPROTOOPT;
790 }
791 break;
792 #endif /* DUMMYNET */
793
794 default:
795 error = ip_ctloutput(so, sopt);
796 break;
797 }
798 break;
799
800 case SOPT_SET:
801 switch (sopt->sopt_name) {
802 case IP_HDRINCL:
803 error = sooptcopyin(sopt, &optval, sizeof optval,
804 sizeof optval);
805 if (error) {
806 break;
807 }
808 if (optval) {
809 inp->inp_flags |= INP_HDRINCL;
810 } else {
811 inp->inp_flags &= ~INP_HDRINCL;
812 }
813 break;
814
815 case IP_STRIPHDR:
816 error = sooptcopyin(sopt, &optval, sizeof optval,
817 sizeof optval);
818 if (error) {
819 break;
820 }
821 if (optval) {
822 inp->inp_flags |= INP_STRIPHDR;
823 } else {
824 inp->inp_flags &= ~INP_STRIPHDR;
825 }
826 break;
827
828
829 #if DUMMYNET
830 case IP_DUMMYNET_CONFIGURE:
831 case IP_DUMMYNET_DEL:
832 case IP_DUMMYNET_FLUSH:
833 if (!DUMMYNET_LOADED) {
834 ip_dn_init();
835 }
836 if (DUMMYNET_LOADED) {
837 error = ip_dn_ctl_ptr(sopt);
838 } else {
839 error = ENOPROTOOPT;
840 }
841 break;
842 #endif /* DUMMYNET */
843
844 case SO_FLUSH:
845 if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
846 sizeof(optval))) != 0) {
847 break;
848 }
849
850 error = inp_flush(inp, optval);
851 break;
852
853 default:
854 error = ip_ctloutput(so, sopt);
855 break;
856 }
857 break;
858 }
859
860 return error;
861 }
862
863 /*
864 * This function exists solely to receive the PRC_IFDOWN messages which
865 * are sent by if_down(). It looks for an ifaddr whose ifa_addr is sa,
866 * and calls in_ifadown() to remove all routes corresponding to that address.
867 * It also receives the PRC_IFUP messages from if_up() and reinstalls the
868 * interface routes.
869 */
870 void
rip_ctlinput(int cmd,struct sockaddr * sa,__unused void * vip,__unused struct ifnet * ifp)871 rip_ctlinput(
872 int cmd,
873 struct sockaddr *sa,
874 __unused void *vip,
875 __unused struct ifnet *ifp)
876 {
877 struct in_ifaddr *ia = NULL;
878 struct ifnet *iaifp = NULL;
879 int err = 0;
880 int flags, done = 0;
881
882 switch (cmd) {
883 case PRC_IFDOWN:
884 lck_rw_lock_shared(&in_ifaddr_rwlock);
885 for (ia = in_ifaddrhead.tqh_first; ia;
886 ia = ia->ia_link.tqe_next) {
887 IFA_LOCK(&ia->ia_ifa);
888 if (ia->ia_ifa.ifa_addr == sa &&
889 (ia->ia_flags & IFA_ROUTE)) {
890 done = 1;
891 ifa_addref(&ia->ia_ifa);
892 IFA_UNLOCK(&ia->ia_ifa);
893 lck_rw_done(&in_ifaddr_rwlock);
894 lck_mtx_lock(rnh_lock);
895 /*
896 * in_ifscrub kills the interface route.
897 */
898 in_ifscrub(ia->ia_ifp, ia, 1);
899 /*
900 * in_ifadown gets rid of all the rest of
901 * the routes. This is not quite the right
902 * thing to do, but at least if we are running
903 * a routing process they will come back.
904 */
905 in_ifadown(&ia->ia_ifa, 1);
906 lck_mtx_unlock(rnh_lock);
907 ifa_remref(&ia->ia_ifa);
908 break;
909 }
910 IFA_UNLOCK(&ia->ia_ifa);
911 }
912 if (!done) {
913 lck_rw_done(&in_ifaddr_rwlock);
914 }
915 break;
916
917 case PRC_IFUP:
918 lck_rw_lock_shared(&in_ifaddr_rwlock);
919 for (ia = in_ifaddrhead.tqh_first; ia;
920 ia = ia->ia_link.tqe_next) {
921 IFA_LOCK(&ia->ia_ifa);
922 if (ia->ia_ifa.ifa_addr == sa) {
923 /* keep it locked */
924 break;
925 }
926 IFA_UNLOCK(&ia->ia_ifa);
927 }
928 if (ia == NULL || (ia->ia_flags & IFA_ROUTE) ||
929 (ia->ia_ifa.ifa_debug & IFD_NOTREADY)) {
930 if (ia != NULL) {
931 IFA_UNLOCK(&ia->ia_ifa);
932 }
933 lck_rw_done(&in_ifaddr_rwlock);
934 return;
935 }
936 ifa_addref(&ia->ia_ifa);
937 IFA_UNLOCK(&ia->ia_ifa);
938 lck_rw_done(&in_ifaddr_rwlock);
939
940 flags = RTF_UP;
941 iaifp = ia->ia_ifa.ifa_ifp;
942
943 if ((iaifp->if_flags & IFF_LOOPBACK)
944 || (iaifp->if_flags & IFF_POINTOPOINT)) {
945 flags |= RTF_HOST;
946 }
947
948 err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
949 if (err == 0) {
950 IFA_LOCK_SPIN(&ia->ia_ifa);
951 ia->ia_flags |= IFA_ROUTE;
952 IFA_UNLOCK(&ia->ia_ifa);
953 }
954 ifa_remref(&ia->ia_ifa);
955 break;
956 }
957 }
958
959 u_int32_t rip_sendspace = RIPSNDQ;
960 u_int32_t rip_recvspace = RIPRCVQ;
961
962 SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW | CTLFLAG_LOCKED,
963 &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
964 SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW | CTLFLAG_LOCKED,
965 &rip_recvspace, 0, "Maximum incoming raw IP datagram size");
966 SYSCTL_UINT(_net_inet_raw, OID_AUTO, pcbcount, CTLFLAG_RD | CTLFLAG_LOCKED,
967 &ripcbinfo.ipi_count, 0, "Number of active PCBs");
968
969 static int
rip_attach(struct socket * so,int proto,struct proc * p)970 rip_attach(struct socket *so, int proto, struct proc *p)
971 {
972 struct inpcb *inp;
973 int error;
974
975 inp = sotoinpcb(so);
976 if (inp) {
977 panic("rip_attach");
978 }
979 if ((so->so_state & SS_PRIV) == 0) {
980 return EPERM;
981 }
982 if (proto > UINT8_MAX) {
983 return EINVAL;
984 }
985
986 error = soreserve(so, rip_sendspace, rip_recvspace);
987 if (error) {
988 return error;
989 }
990 error = in_pcballoc(so, &ripcbinfo, p);
991 if (error) {
992 return error;
993 }
994 inp = (struct inpcb *)so->so_pcb;
995 inp->inp_vflag |= INP_IPV4;
996 VERIFY(proto <= UINT8_MAX);
997 inp->inp_ip_p = (u_char)proto;
998 inp->inp_ip_ttl = (u_char)ip_defttl;
999 return 0;
1000 }
1001
1002 __private_extern__ int
rip_detach(struct socket * so)1003 rip_detach(struct socket *so)
1004 {
1005 struct inpcb *inp;
1006
1007 inp = sotoinpcb(so);
1008 if (inp == 0) {
1009 panic("rip_detach");
1010 }
1011 in_pcbdetach(inp);
1012 return 0;
1013 }
1014
1015 __private_extern__ int
rip_abort(struct socket * so)1016 rip_abort(struct socket *so)
1017 {
1018 soisdisconnected(so);
1019 return rip_detach(so);
1020 }
1021
1022 __private_extern__ int
rip_disconnect(struct socket * so)1023 rip_disconnect(struct socket *so)
1024 {
1025 if ((so->so_state & SS_ISCONNECTED) == 0) {
1026 return ENOTCONN;
1027 }
1028 return rip_abort(so);
1029 }
1030
1031 __private_extern__ int
rip_bind(struct socket * so,struct sockaddr * nam,struct proc * p)1032 rip_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
1033 {
1034 #pragma unused(p)
1035 struct inpcb *inp = sotoinpcb(so);
1036 struct sockaddr_in sin;
1037 struct ifaddr *ifa = NULL;
1038 struct ifnet *outif = NULL;
1039
1040 if (inp == NULL
1041 #if NECP
1042 || (necp_socket_should_use_flow_divert(inp))
1043 #endif /* NECP */
1044 ) {
1045 return inp == NULL ? EINVAL : EPROTOTYPE;
1046 }
1047
1048 if (nam->sa_len != sizeof(struct sockaddr_in)) {
1049 return EINVAL;
1050 }
1051
1052 /* Sanitized local copy for interface address searches */
1053 bzero(&sin, sizeof(sin));
1054 sin.sin_family = AF_INET;
1055 sin.sin_len = sizeof(struct sockaddr_in);
1056 sin.sin_addr.s_addr = SIN(nam)->sin_addr.s_addr;
1057
1058 if (TAILQ_EMPTY(&ifnet_head) ||
1059 (sin.sin_family != AF_INET && sin.sin_family != AF_IMPLINK) ||
1060 (sin.sin_addr.s_addr && (ifa = ifa_ifwithaddr(SA(&sin))) == 0)) {
1061 return EADDRNOTAVAIL;
1062 } else if (ifa) {
1063 /*
1064 * Opportunistically determine the outbound
1065 * interface that may be used; this may not
1066 * hold true if we end up using a route
1067 * going over a different interface, e.g.
1068 * when sending to a local address. This
1069 * will get updated again after sending.
1070 */
1071 IFA_LOCK(ifa);
1072 outif = ifa->ifa_ifp;
1073 IFA_UNLOCK(ifa);
1074 ifa_remref(ifa);
1075 }
1076 inp->inp_laddr = sin.sin_addr;
1077 inp->inp_last_outifp = outif;
1078
1079 return 0;
1080 }
1081
1082 __private_extern__ int
rip_connect(struct socket * so,struct sockaddr * nam,__unused struct proc * p)1083 rip_connect(struct socket *so, struct sockaddr *nam, __unused struct proc *p)
1084 {
1085 struct inpcb *inp = sotoinpcb(so);
1086 struct sockaddr_in *addr = (struct sockaddr_in *)(void *)nam;
1087
1088 if (inp == NULL
1089 #if NECP
1090 || (necp_socket_should_use_flow_divert(inp))
1091 #endif /* NECP */
1092 ) {
1093 return inp == NULL ? EINVAL : EPROTOTYPE;
1094 }
1095 if (nam->sa_len != sizeof(*addr)) {
1096 return EINVAL;
1097 }
1098 if (TAILQ_EMPTY(&ifnet_head)) {
1099 return EADDRNOTAVAIL;
1100 }
1101 if ((addr->sin_family != AF_INET) &&
1102 (addr->sin_family != AF_IMPLINK)) {
1103 return EAFNOSUPPORT;
1104 }
1105
1106 if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
1107 so->so_flags1 |= SOF1_CONNECT_COUNTED;
1108 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
1109 }
1110
1111 inp->inp_faddr = addr->sin_addr;
1112 soisconnected(so);
1113
1114 return 0;
1115 }
1116
1117 __private_extern__ int
rip_shutdown(struct socket * so)1118 rip_shutdown(struct socket *so)
1119 {
1120 socantsendmore(so);
1121 return 0;
1122 }
1123
1124 __private_extern__ int
rip_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct proc * p)1125 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
1126 struct mbuf *control, struct proc *p)
1127 {
1128 #pragma unused(flags, p)
1129 struct inpcb *inp = sotoinpcb(so);
1130 u_int32_t dst = INADDR_ANY;
1131 int error = 0;
1132
1133 if (inp == NULL
1134 #if NECP
1135 || (necp_socket_should_use_flow_divert(inp) && (error = EPROTOTYPE))
1136 #endif /* NECP */
1137 ) {
1138 if (inp == NULL) {
1139 error = EINVAL;
1140 } else {
1141 error = EPROTOTYPE;
1142 }
1143 goto bad;
1144 }
1145
1146 in_pcb_check_management_entitled(inp);
1147 in_pcb_check_ultra_constrained_entitled(inp);
1148
1149 so_update_tx_data_stats(so, 1, m->m_pkthdr.len);
1150
1151 if (nam != NULL) {
1152 dst = ((struct sockaddr_in *)(void *)nam)->sin_addr.s_addr;
1153 }
1154 return rip_output(m, so, dst, control);
1155
1156 bad:
1157 VERIFY(error != 0);
1158
1159 if (m != NULL) {
1160 m_freem(m);
1161 }
1162 if (control != NULL) {
1163 m_freem(control);
1164 }
1165
1166 return error;
1167 }
1168
1169 /* note: rip_unlock is called from different protos instead of the generic socket_unlock,
1170 * it will handle the socket dealloc on last reference
1171 * */
1172 int
rip_unlock(struct socket * so,int refcount,void * debug)1173 rip_unlock(struct socket *so, int refcount, void *debug)
1174 {
1175 void *__single lr_saved;
1176 struct inpcb *inp = sotoinpcb(so);
1177
1178 if (debug == NULL) {
1179 lr_saved = __unsafe_forge_single(void *, __builtin_return_address(0));
1180 } else {
1181 lr_saved = debug;
1182 }
1183
1184 if (refcount) {
1185 if (so->so_usecount <= 0) {
1186 panic("rip_unlock: bad refoucnt so=%p val=%x lrh= %s",
1187 so, so->so_usecount, solockhistory_nr(so));
1188 /* NOTREACHED */
1189 }
1190 so->so_usecount--;
1191 if (so->so_usecount == 0 && (inp->inp_wantcnt == WNT_STOPUSING)) {
1192 /* cleanup after last reference */
1193 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1194 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1195 if (inp->inp_state != INPCB_STATE_DEAD) {
1196 if (SOCK_CHECK_DOM(so, PF_INET6)) {
1197 in6_pcbdetach(inp);
1198 } else {
1199 in_pcbdetach(inp);
1200 }
1201 }
1202 in_pcbdispose(inp);
1203 lck_rw_done(&ripcbinfo.ipi_lock);
1204 return 0;
1205 }
1206 }
1207 so->unlock_lr[so->next_unlock_lr] = lr_saved;
1208 so->next_unlock_lr = (so->next_unlock_lr + 1) % SO_LCKDBG_MAX;
1209 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1210 return 0;
1211 }
1212
1213 static int
1214 rip_pcblist SYSCTL_HANDLER_ARGS
1215 {
1216 #pragma unused(oidp, arg1, arg2)
1217 int error, i, n, sz;
1218 struct inpcb *inp, **inp_list;
1219 inp_gen_t gencnt;
1220 struct xinpgen xig;
1221
1222 /*
1223 * The process of preparing the TCB list is too time-consuming and
1224 * resource-intensive to repeat twice on every request.
1225 */
1226 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1227 if (req->oldptr == USER_ADDR_NULL) {
1228 n = ripcbinfo.ipi_count;
1229 req->oldidx = 2 * (sizeof xig)
1230 + (n + n / 8) * sizeof(struct xinpcb);
1231 lck_rw_done(&ripcbinfo.ipi_lock);
1232 return 0;
1233 }
1234
1235 if (req->newptr != USER_ADDR_NULL) {
1236 lck_rw_done(&ripcbinfo.ipi_lock);
1237 return EPERM;
1238 }
1239
1240 /*
1241 * OK, now we're committed to doing something.
1242 */
1243 gencnt = ripcbinfo.ipi_gencnt;
1244 sz = n = ripcbinfo.ipi_count;
1245
1246 bzero(&xig, sizeof(xig));
1247 xig.xig_len = sizeof xig;
1248 xig.xig_count = n;
1249 xig.xig_gen = gencnt;
1250 xig.xig_sogen = so_gencnt;
1251 error = SYSCTL_OUT(req, &xig, sizeof xig);
1252 if (error) {
1253 lck_rw_done(&ripcbinfo.ipi_lock);
1254 return error;
1255 }
1256 /*
1257 * We are done if there is no pcb
1258 */
1259 if (n == 0) {
1260 lck_rw_done(&ripcbinfo.ipi_lock);
1261 return 0;
1262 }
1263
1264 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1265 if (inp_list == NULL) {
1266 lck_rw_done(&ripcbinfo.ipi_lock);
1267 return ENOMEM;
1268 }
1269
1270 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1271 inp = inp->inp_list.le_next) {
1272 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1273 inp_list[i++] = inp;
1274 }
1275 }
1276 n = i;
1277
1278 error = 0;
1279 for (i = 0; i < n; i++) {
1280 inp = inp_list[i];
1281 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1282 struct xinpcb xi;
1283
1284 bzero(&xi, sizeof(xi));
1285 xi.xi_len = sizeof xi;
1286 /* XXX should avoid extra copy */
1287 inpcb_to_compat(inp, &xi.xi_inp);
1288 if (inp->inp_socket) {
1289 sotoxsocket(inp->inp_socket, &xi.xi_socket);
1290 }
1291 error = SYSCTL_OUT(req, &xi, sizeof xi);
1292 }
1293 }
1294 if (!error) {
1295 /*
1296 * Give the user an updated idea of our state.
1297 * If the generation differs from what we told
1298 * her before, she knows that something happened
1299 * while we were processing this request, and it
1300 * might be necessary to retry.
1301 */
1302 bzero(&xig, sizeof(xig));
1303 xig.xig_len = sizeof xig;
1304 xig.xig_gen = ripcbinfo.ipi_gencnt;
1305 xig.xig_sogen = so_gencnt;
1306 xig.xig_count = ripcbinfo.ipi_count;
1307 error = SYSCTL_OUT(req, &xig, sizeof xig);
1308 }
1309
1310 lck_rw_done(&ripcbinfo.ipi_lock);
1311 kfree_type(struct inpcb *, sz, inp_list);
1312 return error;
1313 }
1314
1315 SYSCTL_PROC(_net_inet_raw, OID_AUTO /*XXX*/, pcblist,
1316 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1317 rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
1318
1319 #if XNU_TARGET_OS_OSX
1320
1321 static int
1322 rip_pcblist64 SYSCTL_HANDLER_ARGS
1323 {
1324 #pragma unused(oidp, arg1, arg2)
1325 int error, i, n, sz;
1326 struct inpcb *inp, **inp_list;
1327 inp_gen_t gencnt;
1328 struct xinpgen xig;
1329
1330 /*
1331 * The process of preparing the TCB list is too time-consuming and
1332 * resource-intensive to repeat twice on every request.
1333 */
1334 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1335 if (req->oldptr == USER_ADDR_NULL) {
1336 n = ripcbinfo.ipi_count;
1337 req->oldidx = 2 * (sizeof xig)
1338 + (n + n / 8) * sizeof(struct xinpcb64);
1339 lck_rw_done(&ripcbinfo.ipi_lock);
1340 return 0;
1341 }
1342
1343 if (req->newptr != USER_ADDR_NULL) {
1344 lck_rw_done(&ripcbinfo.ipi_lock);
1345 return EPERM;
1346 }
1347
1348 /*
1349 * OK, now we're committed to doing something.
1350 */
1351 gencnt = ripcbinfo.ipi_gencnt;
1352 sz = n = ripcbinfo.ipi_count;
1353
1354 bzero(&xig, sizeof(xig));
1355 xig.xig_len = sizeof xig;
1356 xig.xig_count = n;
1357 xig.xig_gen = gencnt;
1358 xig.xig_sogen = so_gencnt;
1359 error = SYSCTL_OUT(req, &xig, sizeof xig);
1360 if (error) {
1361 lck_rw_done(&ripcbinfo.ipi_lock);
1362 return error;
1363 }
1364 /*
1365 * We are done if there is no pcb
1366 */
1367 if (n == 0) {
1368 lck_rw_done(&ripcbinfo.ipi_lock);
1369 return 0;
1370 }
1371
1372 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1373 if (inp_list == NULL) {
1374 lck_rw_done(&ripcbinfo.ipi_lock);
1375 return ENOMEM;
1376 }
1377
1378 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1379 inp = inp->inp_list.le_next) {
1380 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1381 inp_list[i++] = inp;
1382 }
1383 }
1384 n = i;
1385
1386 error = 0;
1387 for (i = 0; i < n; i++) {
1388 inp = inp_list[i];
1389 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1390 struct xinpcb64 xi;
1391
1392 bzero(&xi, sizeof(xi));
1393 xi.xi_len = sizeof xi;
1394 inpcb_to_xinpcb64(inp, &xi);
1395 if (inp->inp_socket) {
1396 sotoxsocket64(inp->inp_socket, &xi.xi_socket);
1397 }
1398 error = SYSCTL_OUT(req, &xi, sizeof xi);
1399 }
1400 }
1401 if (!error) {
1402 /*
1403 * Give the user an updated idea of our state.
1404 * If the generation differs from what we told
1405 * her before, she knows that something happened
1406 * while we were processing this request, and it
1407 * might be necessary to retry.
1408 */
1409 bzero(&xig, sizeof(xig));
1410 xig.xig_len = sizeof xig;
1411 xig.xig_gen = ripcbinfo.ipi_gencnt;
1412 xig.xig_sogen = so_gencnt;
1413 xig.xig_count = ripcbinfo.ipi_count;
1414 error = SYSCTL_OUT(req, &xig, sizeof xig);
1415 }
1416
1417 lck_rw_done(&ripcbinfo.ipi_lock);
1418 kfree_type(struct inpcb *, sz, inp_list);
1419 return error;
1420 }
1421
1422 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist64,
1423 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1424 rip_pcblist64, "S,xinpcb64", "List of active raw IP sockets");
1425
1426 #endif /* XNU_TARGET_OS_OSX */
1427
1428
1429 static int
1430 rip_pcblist_n SYSCTL_HANDLER_ARGS
1431 {
1432 #pragma unused(oidp, arg1, arg2)
1433 int error = 0;
1434
1435 error = get_pcblist_n(IPPROTO_IP, req, &ripcbinfo);
1436
1437 return error;
1438 }
1439
1440 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist_n,
1441 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1442 rip_pcblist_n, "S,xinpcb_n", "List of active raw IP sockets");
1443
1444 struct pr_usrreqs rip_usrreqs = {
1445 .pru_abort = rip_abort,
1446 .pru_attach = rip_attach,
1447 .pru_bind = rip_bind,
1448 .pru_connect = rip_connect,
1449 .pru_control = in_control,
1450 .pru_detach = rip_detach,
1451 .pru_disconnect = rip_disconnect,
1452 .pru_peeraddr = in_getpeeraddr,
1453 .pru_send = rip_send,
1454 .pru_shutdown = rip_shutdown,
1455 .pru_sockaddr = in_getsockaddr,
1456 .pru_sosend = sosend,
1457 .pru_soreceive = soreceive,
1458 };
1459 /* DSEP Review Done pl-20051213-v02 @3253 */
1460