1 /*
2 * Copyright (c) 2000-2022 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1988, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)raw_ip.c 8.7 (Berkeley) 5/15/95
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/malloc.h>
73 #include <sys/mbuf.h>
74 #include <sys/mcache.h>
75 #include <sys/proc.h>
76 #include <sys/domain.h>
77 #include <sys/protosw.h>
78 #include <sys/socket.h>
79 #include <sys/socketvar.h>
80 #include <sys/sysctl.h>
81 #include <libkern/OSAtomic.h>
82 #include <kern/zalloc.h>
83
84 #include <pexpert/pexpert.h>
85
86 #include <net/if.h>
87 #include <net/net_api_stats.h>
88 #include <net/route.h>
89 #include <net/content_filter.h>
90
91 #define _IP_VHL
92 #include <netinet/in.h>
93 #include <netinet/in_systm.h>
94 #include <netinet/in_tclass.h>
95 #include <netinet/ip.h>
96 #include <netinet/in_pcb.h>
97 #include <netinet/in_var.h>
98 #include <netinet/ip_var.h>
99
100 #include <netinet6/in6_pcb.h>
101
102
103 #if IPSEC
104 #include <netinet6/ipsec.h>
105 #endif /*IPSEC*/
106
107 #if DUMMYNET
108 #include <netinet/ip_dummynet.h>
109 #endif /* DUMMYNET */
110
111 int rip_detach(struct socket *);
112 int rip_abort(struct socket *);
113 int rip_disconnect(struct socket *);
114 int rip_bind(struct socket *, struct sockaddr *, struct proc *);
115 int rip_connect(struct socket *, struct sockaddr *, struct proc *);
116 int rip_shutdown(struct socket *);
117
118 struct inpcbhead ripcb;
119 struct inpcbinfo ripcbinfo;
120
121 /* control hooks for dummynet */
122 #if DUMMYNET
123 ip_dn_ctl_t *ip_dn_ctl_ptr;
124 #endif /* DUMMYNET */
125
126 /*
127 * Nominal space allocated to a raw ip socket.
128 */
129 #define RIPSNDQ 8192
130 #define RIPRCVQ 8192
131
132 /*
133 * Raw interface to IP protocol.
134 */
135
136 /*
137 * Initialize raw connection block q.
138 */
139 void
rip_init(struct protosw * pp,struct domain * dp)140 rip_init(struct protosw *pp, struct domain *dp)
141 {
142 #pragma unused(dp)
143 static int rip_initialized = 0;
144 struct inpcbinfo *pcbinfo;
145
146 VERIFY((pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
147
148 if (rip_initialized) {
149 return;
150 }
151 rip_initialized = 1;
152
153 LIST_INIT(&ripcb);
154 ripcbinfo.ipi_listhead = &ripcb;
155 /*
156 * XXX We don't use the hash list for raw IP, but it's easier
157 * to allocate a one entry hash list than it is to check all
158 * over the place for ipi_hashbase == NULL.
159 */
160 ripcbinfo.ipi_hashbase = hashinit(1, M_PCB, &ripcbinfo.ipi_hashmask);
161 ripcbinfo.ipi_porthashbase = hashinit(1, M_PCB, &ripcbinfo.ipi_porthashmask);
162
163 ripcbinfo.ipi_zone = zone_create("ripzone", sizeof(struct inpcb),
164 ZC_NONE);
165
166 pcbinfo = &ripcbinfo;
167 /*
168 * allocate lock group attribute and group for udp pcb mutexes
169 */
170 pcbinfo->ipi_lock_grp = lck_grp_alloc_init("ripcb", LCK_GRP_ATTR_NULL);
171
172 /*
173 * allocate the lock attribute for udp pcb mutexes
174 */
175 lck_attr_setdefault(&pcbinfo->ipi_lock_attr);
176 lck_rw_init(&pcbinfo->ipi_lock, pcbinfo->ipi_lock_grp,
177 &pcbinfo->ipi_lock_attr);
178
179 in_pcbinfo_attach(&ripcbinfo);
180 }
181
182 static struct sockaddr_in ripsrc = {
183 .sin_len = sizeof(ripsrc),
184 .sin_family = AF_INET,
185 .sin_port = 0,
186 .sin_addr = { .s_addr = 0 },
187 .sin_zero = {0, 0, 0, 0, 0, 0, 0, 0, }
188 };
189
190 /*
191 * Setup generic address and protocol structures
192 * for raw_input routine, then pass them along with
193 * mbuf chain.
194 */
195 void
rip_input(struct mbuf * m,int iphlen)196 rip_input(struct mbuf *m, int iphlen)
197 {
198 struct ip *ip = mtod(m, struct ip *);
199 struct inpcb *inp;
200 struct inpcb *last = 0;
201 struct mbuf *opts = 0;
202 int skipit = 0, ret = 0;
203 struct ifnet *ifp = m->m_pkthdr.rcvif;
204 boolean_t is_wake_pkt = false;
205
206 /* Expect 32-bit aligned data pointer on strict-align platforms */
207 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
208
209 if ((m->m_flags & M_PKTHDR) && (m->m_pkthdr.pkt_flags & PKTF_WAKE_PKT)) {
210 is_wake_pkt = true;
211 }
212
213 ripsrc.sin_addr = ip->ip_src;
214 lck_rw_lock_shared(&ripcbinfo.ipi_lock);
215 LIST_FOREACH(inp, &ripcb, inp_list) {
216 if ((inp->inp_vflag & INP_IPV4) == 0) {
217 continue;
218 }
219 if (inp->inp_ip_p && (inp->inp_ip_p != ip->ip_p)) {
220 continue;
221 }
222 if (inp->inp_laddr.s_addr &&
223 inp->inp_laddr.s_addr != ip->ip_dst.s_addr) {
224 continue;
225 }
226 if (inp->inp_faddr.s_addr &&
227 inp->inp_faddr.s_addr != ip->ip_src.s_addr) {
228 continue;
229 }
230 if (inp_restricted_recv(inp, ifp)) {
231 continue;
232 }
233 if (last) {
234 struct mbuf *n = m_copy(m, 0, (int)M_COPYALL);
235
236 skipit = 0;
237
238 #if NECP
239 if (n && !necp_socket_is_allowed_to_send_recv_v4(last, 0, 0,
240 &ip->ip_dst, &ip->ip_src, ifp, 0, NULL, NULL, NULL, NULL)) {
241 m_freem(n);
242 /* do not inject data to pcb */
243 skipit = 1;
244 }
245 #endif /* NECP */
246 if (n && skipit == 0) {
247 int error = 0;
248 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
249 SOFLOW_ENABLED(last->inp_socket) ||
250 SO_RECV_CONTROL_OPTS(last->inp_socket)) {
251 ret = ip_savecontrol(last, &opts, ip, n);
252 if (ret != 0) {
253 m_freem(n);
254 m_freem(opts);
255 last = inp;
256 continue;
257 }
258 }
259 if (last->inp_flags & INP_STRIPHDR
260 #if CONTENT_FILTER
261 /*
262 * If socket is subject to Content Filter, delay stripping until reinject
263 */
264 && (!CFIL_DGRAM_FILTERED(last->inp_socket))
265 #endif
266 ) {
267 n->m_len -= iphlen;
268 n->m_pkthdr.len -= iphlen;
269 n->m_data += iphlen;
270 }
271 so_recv_data_stat(last->inp_socket, m, 0);
272 if (sbappendaddr(&last->inp_socket->so_rcv,
273 (struct sockaddr *)&ripsrc, n,
274 opts, &error) != 0) {
275 sorwakeup(last->inp_socket);
276 } else {
277 if (error) {
278 /* should notify about lost packet */
279 ipstat.ips_raw_sappend_fail++;
280 }
281 }
282 if (is_wake_pkt) {
283 soevent(last->in6p_socket,
284 SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
285 }
286 opts = 0;
287 }
288 }
289 last = inp;
290 }
291
292 skipit = 0;
293 #if NECP
294 if (last && !necp_socket_is_allowed_to_send_recv_v4(last, 0, 0,
295 &ip->ip_dst, &ip->ip_src, ifp, 0, NULL, NULL, NULL, NULL)) {
296 m_freem(m);
297 OSAddAtomic(1, &ipstat.ips_delivered);
298 /* do not inject data to pcb */
299 skipit = 1;
300 }
301 #endif /* NECP */
302 if (skipit == 0) {
303 if (last) {
304 if ((last->inp_flags & INP_CONTROLOPTS) != 0 ||
305 SOFLOW_ENABLED(last->inp_socket) ||
306 SO_RECV_CONTROL_OPTS(last->inp_socket)) {
307 ret = ip_savecontrol(last, &opts, ip, m);
308 if (ret != 0) {
309 m_freem(m);
310 m_freem(opts);
311 goto unlock;
312 }
313 }
314 if (last->inp_flags & INP_STRIPHDR
315 #if CONTENT_FILTER
316 /*
317 * If socket is subject to Content Filter, delay stripping until reinject
318 */
319 && (!CFIL_DGRAM_FILTERED(last->inp_socket))
320 #endif
321 ) {
322 m->m_len -= iphlen;
323 m->m_pkthdr.len -= iphlen;
324 m->m_data += iphlen;
325 }
326 so_recv_data_stat(last->inp_socket, m, 0);
327 if (sbappendaddr(&last->inp_socket->so_rcv,
328 (struct sockaddr *)&ripsrc, m, opts, NULL) != 0) {
329 sorwakeup(last->inp_socket);
330 } else {
331 ipstat.ips_raw_sappend_fail++;
332 }
333 if (is_wake_pkt) {
334 soevent(last->in6p_socket,
335 SO_FILT_HINT_LOCKED | SO_FILT_HINT_WAKE_PKT);
336 }
337 } else {
338 m_freem(m);
339 OSAddAtomic(1, &ipstat.ips_noproto);
340 OSAddAtomic(-1, &ipstat.ips_delivered);
341 }
342 }
343 unlock:
344 /*
345 * Keep the list locked because socket filter may force the socket lock
346 * to be released when calling sbappendaddr() -- see rdar://7627704
347 */
348 lck_rw_done(&ripcbinfo.ipi_lock);
349 }
350
351 /*
352 * Generate IP header and pass packet to ip_output.
353 * Tack on options user may have setup with control call.
354 */
355 int
rip_output(struct mbuf * m,struct socket * so,u_int32_t dst,struct mbuf * control)356 rip_output(
357 struct mbuf *m,
358 struct socket *so,
359 u_int32_t dst,
360 struct mbuf *control)
361 {
362 struct ip *ip;
363 struct inpcb *inp = sotoinpcb(so);
364 int flags = (so->so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
365 int inp_flags = inp ? inp->inp_flags : 0;
366 struct ip_out_args ipoa;
367 struct ip_moptions *imo;
368 int tos = IPTOS_UNSPEC;
369 int error = 0;
370 #if CONTENT_FILTER
371 struct m_tag *cfil_tag = NULL;
372 bool cfil_faddr_use = false;
373 uint32_t cfil_so_state_change_cnt = 0;
374 uint32_t cfil_so_options = 0;
375 int cfil_inp_flags = 0;
376 struct sockaddr *cfil_faddr = NULL;
377 struct sockaddr_in *cfil_sin;
378 u_int32_t cfil_dst = 0;
379 #endif
380
381 #if CONTENT_FILTER
382 /*
383 * If socket is subject to Content Filter and no addr is passed in,
384 * retrieve CFIL saved state from mbuf and use it if necessary.
385 */
386 if (CFIL_DGRAM_FILTERED(so) && dst == INADDR_ANY) {
387 cfil_tag = cfil_dgram_get_socket_state(m, &cfil_so_state_change_cnt, &cfil_so_options, &cfil_faddr, &cfil_inp_flags);
388 if (cfil_tag) {
389 cfil_sin = SIN(cfil_faddr);
390 flags = (cfil_so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
391 inp_flags = cfil_inp_flags;
392 if (inp && inp->inp_faddr.s_addr == INADDR_ANY) {
393 /*
394 * Socket is unconnected, simply use the saved faddr as 'addr' to go through
395 * the connect/disconnect logic.
396 */
397 dst = cfil_sin->sin_addr.s_addr;
398 } else if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
399 (inp->inp_fport != cfil_sin->sin_port ||
400 inp->inp_faddr.s_addr != cfil_sin->sin_addr.s_addr)) {
401 /*
402 * Socket is connected but socket state and dest addr/port changed.
403 * We need to use the saved faddr and socket options.
404 */
405 cfil_faddr_use = true;
406 cfil_dst = cfil_sin->sin_addr.s_addr;
407 }
408 m_tag_free(cfil_tag);
409 }
410 }
411 #endif
412
413 if (so->so_state & SS_ISCONNECTED) {
414 if (dst != INADDR_ANY) {
415 if (m != NULL) {
416 m_freem(m);
417 }
418 if (control != NULL) {
419 m_freem(control);
420 }
421 return EISCONN;
422 }
423 dst = cfil_faddr_use ? cfil_dst : inp->inp_faddr.s_addr;
424 } else {
425 if (dst == INADDR_ANY) {
426 if (m != NULL) {
427 m_freem(m);
428 }
429 if (control != NULL) {
430 m_freem(control);
431 }
432 return ENOTCONN;
433 }
434 }
435
436 bzero(&ipoa, sizeof(ipoa));
437 ipoa.ipoa_boundif = IFSCOPE_NONE;
438 ipoa.ipoa_flags = IPOAF_SELECT_SRCIF;
439
440 int sotc = SO_TC_UNSPEC;
441 int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
442
443
444 if (control != NULL) {
445 tos = so_tos_from_control(control);
446 sotc = so_tc_from_control(control, &netsvctype);
447
448 m_freem(control);
449 control = NULL;
450 }
451 if (sotc == SO_TC_UNSPEC) {
452 sotc = so->so_traffic_class;
453 netsvctype = so->so_netsvctype;
454 }
455
456 if (inp == NULL
457 #if NECP
458 || (necp_socket_should_use_flow_divert(inp))
459 #endif /* NECP */
460 ) {
461 if (m != NULL) {
462 m_freem(m);
463 }
464 VERIFY(control == NULL);
465 return inp == NULL ? EINVAL : EPROTOTYPE;
466 }
467
468 flags |= IP_OUTARGS;
469 /* If socket was bound to an ifindex, tell ip_output about it */
470 if (inp->inp_flags & INP_BOUND_IF) {
471 ipoa.ipoa_boundif = inp->inp_boundifp->if_index;
472 ipoa.ipoa_flags |= IPOAF_BOUND_IF;
473 }
474 if (INP_NO_CELLULAR(inp)) {
475 ipoa.ipoa_flags |= IPOAF_NO_CELLULAR;
476 }
477 if (INP_NO_EXPENSIVE(inp)) {
478 ipoa.ipoa_flags |= IPOAF_NO_EXPENSIVE;
479 }
480 if (INP_NO_CONSTRAINED(inp)) {
481 ipoa.ipoa_flags |= IPOAF_NO_CONSTRAINED;
482 }
483 if (INP_AWDL_UNRESTRICTED(inp)) {
484 ipoa.ipoa_flags |= IPOAF_AWDL_UNRESTRICTED;
485 }
486 ipoa.ipoa_sotc = sotc;
487 ipoa.ipoa_netsvctype = netsvctype;
488
489 if (inp->inp_flowhash == 0) {
490 inp_calc_flowhash(inp);
491 ASSERT(inp->inp_flowhash != 0);
492 }
493
494 /*
495 * If the user handed us a complete IP packet, use it.
496 * Otherwise, allocate an mbuf for a header and fill it in.
497 */
498 if ((inp_flags & INP_HDRINCL) == 0) {
499 if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
500 m_freem(m);
501 return EMSGSIZE;
502 }
503 M_PREPEND(m, sizeof(struct ip), M_WAIT, 1);
504 if (m == NULL) {
505 return ENOBUFS;
506 }
507 ip = mtod(m, struct ip *);
508 if (tos != IPTOS_UNSPEC) {
509 ip->ip_tos = (uint8_t)(tos & IPTOS_MASK);
510 } else {
511 ip->ip_tos = inp->inp_ip_tos;
512 }
513 if (inp->inp_flags2 & INP2_DONTFRAG) {
514 ip->ip_off = IP_DF;
515 } else {
516 ip->ip_off = 0;
517 }
518 ip->ip_p = inp->inp_ip_p;
519 ip->ip_len = (uint16_t)m->m_pkthdr.len;
520 ip->ip_src = inp->inp_laddr;
521 ip->ip_dst.s_addr = dst;
522 ip->ip_ttl = inp->inp_ip_ttl;
523 } else {
524 if (m->m_pkthdr.len > IP_MAXPACKET) {
525 m_freem(m);
526 return EMSGSIZE;
527 }
528 ip = mtod(m, struct ip *);
529 /*
530 * don't allow both user specified and setsockopt options,
531 * and don't allow packet length sizes that will crash
532 */
533 if (m->m_pkthdr.len < sizeof(struct ip) ||
534 ((IP_VHL_HL(ip->ip_vhl) != (sizeof(*ip) >> 2)) && inp->inp_options) ||
535 (ip->ip_len > m->m_pkthdr.len) ||
536 (ip->ip_len < (IP_VHL_HL(ip->ip_vhl) << 2))) {
537 m_freem(m);
538 return EINVAL;
539 }
540 if (ip->ip_id == 0 && !(rfc6864 && IP_OFF_IS_ATOMIC(ntohs(ip->ip_off)))) {
541 ip->ip_id = ip_randomid((uint64_t)m);
542 }
543 /* XXX prevent ip_output from overwriting header fields */
544 flags |= IP_RAWOUTPUT;
545 OSAddAtomic(1, &ipstat.ips_rawout);
546 }
547
548 if (inp->inp_laddr.s_addr != INADDR_ANY) {
549 ipoa.ipoa_flags |= IPOAF_BOUND_SRCADDR;
550 }
551
552 #if NECP
553 {
554 necp_kernel_policy_id policy_id;
555 necp_kernel_policy_id skip_policy_id;
556 u_int32_t route_rule_id;
557 u_int32_t pass_flags;
558
559 /*
560 * We need a route to perform NECP route rule checks
561 */
562 if ((net_qos_policy_restricted != 0 &&
563 ROUTE_UNUSABLE(&inp->inp_route))
564 #if CONTENT_FILTER
565 || cfil_faddr_use
566 #endif
567 ) {
568 struct sockaddr_in to;
569 struct sockaddr_in from;
570 struct in_addr laddr = ip->ip_src;
571
572 ROUTE_RELEASE(&inp->inp_route);
573
574 bzero(&from, sizeof(struct sockaddr_in));
575 from.sin_family = AF_INET;
576 from.sin_len = sizeof(struct sockaddr_in);
577 from.sin_addr = laddr;
578
579 bzero(&to, sizeof(struct sockaddr_in));
580 to.sin_family = AF_INET;
581 to.sin_len = sizeof(struct sockaddr_in);
582 to.sin_addr.s_addr = ip->ip_dst.s_addr;
583
584 if ((error = in_pcbladdr(inp, (struct sockaddr *)&to,
585 &laddr, ipoa.ipoa_boundif, NULL, 1)) != 0) {
586 printf("%s in_pcbladdr(%p) error %d\n",
587 __func__, inp, error);
588 m_freem(m);
589 return error;
590 }
591
592 inp_update_necp_policy(inp, (struct sockaddr *)&from,
593 (struct sockaddr *)&to, ipoa.ipoa_boundif);
594 inp->inp_policyresult.results.qos_marking_gencount = 0;
595 }
596
597 if (!necp_socket_is_allowed_to_send_recv_v4(inp, 0, 0,
598 &ip->ip_src, &ip->ip_dst, NULL, 0, &policy_id, &route_rule_id, &skip_policy_id, &pass_flags)) {
599 m_freem(m);
600 return EHOSTUNREACH;
601 }
602
603 necp_mark_packet_from_socket(m, inp, policy_id, route_rule_id, skip_policy_id, pass_flags);
604
605 if (net_qos_policy_restricted != 0) {
606 struct ifnet *rt_ifp = NULL;
607
608 if (inp->inp_route.ro_rt != NULL) {
609 rt_ifp = inp->inp_route.ro_rt->rt_ifp;
610 }
611
612 necp_socket_update_qos_marking(inp, inp->inp_route.ro_rt, route_rule_id);
613 }
614 }
615 #endif /* NECP */
616 if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
617 ipoa.ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
618 }
619 #if IPSEC
620 if (inp->inp_sp != NULL && ipsec_setsocket(m, so) != 0) {
621 m_freem(m);
622 return ENOBUFS;
623 }
624 #endif /*IPSEC*/
625
626 if (ROUTE_UNUSABLE(&inp->inp_route)) {
627 ROUTE_RELEASE(&inp->inp_route);
628 }
629
630 set_packet_service_class(m, so, sotc, 0);
631 m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
632 m->m_pkthdr.pkt_flowid = inp->inp_flowhash;
633 m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC |
634 PKTF_FLOW_RAWSOCK);
635 m->m_pkthdr.pkt_proto = inp->inp_ip_p;
636 m->m_pkthdr.tx_rawip_pid = so->last_pid;
637 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
638 if (so->so_flags & SOF_DELEGATED) {
639 m->m_pkthdr.tx_rawip_e_pid = so->e_pid;
640 } else {
641 m->m_pkthdr.tx_rawip_e_pid = 0;
642 }
643 #if (DEBUG || DEVELOPMENT)
644 if (so->so_flags & SOF_MARK_WAKE_PKT) {
645 so->so_flags &= ~SOF_MARK_WAKE_PKT;
646 m->m_pkthdr.pkt_flags |= PKTF_WAKE_PKT;
647 }
648 #endif /* (DEBUG || DEVELOPMENT) */
649
650 imo = inp->inp_moptions;
651 if (imo != NULL) {
652 IMO_ADDREF(imo);
653 }
654 /*
655 * The domain lock is held across ip_output, so it is okay
656 * to pass the PCB cached route pointer directly to IP and
657 * the modules beneath it.
658 */
659 // TODO: PASS DOWN ROUTE RULE ID
660 error = ip_output(m, inp->inp_options, &inp->inp_route, flags,
661 imo, &ipoa);
662
663 if (imo != NULL) {
664 IMO_REMREF(imo);
665 }
666
667 if (inp->inp_route.ro_rt != NULL) {
668 struct rtentry *rt = inp->inp_route.ro_rt;
669 struct ifnet *outif;
670
671 if ((rt->rt_flags & (RTF_MULTICAST | RTF_BROADCAST)) ||
672 inp->inp_socket == NULL ||
673 #if CONTENT_FILTER
674 /* Discard temporary route for cfil case */
675 cfil_faddr_use ||
676 #endif
677 !(inp->inp_socket->so_state & SS_ISCONNECTED)) {
678 rt = NULL; /* unusable */
679 }
680 /*
681 * Always discard the cached route for unconnected
682 * socket or if it is a multicast route.
683 */
684 if (rt == NULL) {
685 ROUTE_RELEASE(&inp->inp_route);
686 }
687
688 /*
689 * If this is a connected socket and the destination
690 * route is unicast, update outif with that of the
691 * route interface used by IP.
692 */
693 if (rt != NULL &&
694 (outif = rt->rt_ifp) != inp->inp_last_outifp) {
695 inp->inp_last_outifp = outif;
696 }
697 } else {
698 ROUTE_RELEASE(&inp->inp_route);
699 }
700
701 /*
702 * If output interface was cellular/expensive/constrained, and this socket is
703 * denied access to it, generate an event.
704 */
705 if (error != 0 && (ipoa.ipoa_flags & IPOAF_R_IFDENIED) &&
706 (INP_NO_CELLULAR(inp) || INP_NO_EXPENSIVE(inp) || INP_NO_CONSTRAINED(inp))) {
707 soevent(so, (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
708 }
709
710 return error;
711 }
712
713
714 /*
715 * Raw IP socket option processing.
716 */
717 int
rip_ctloutput(struct socket * so,struct sockopt * sopt)718 rip_ctloutput(struct socket *so, struct sockopt *sopt)
719 {
720 struct inpcb *inp = sotoinpcb(so);
721 int error, optval;
722
723 /* Allow <SOL_SOCKET,SO_FLUSH> at this level */
724 if (sopt->sopt_level != IPPROTO_IP &&
725 !(sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_FLUSH)) {
726 return EINVAL;
727 }
728
729 error = 0;
730
731 switch (sopt->sopt_dir) {
732 case SOPT_GET:
733 switch (sopt->sopt_name) {
734 case IP_HDRINCL:
735 optval = inp->inp_flags & INP_HDRINCL;
736 error = sooptcopyout(sopt, &optval, sizeof optval);
737 break;
738
739 case IP_STRIPHDR:
740 optval = inp->inp_flags & INP_STRIPHDR;
741 error = sooptcopyout(sopt, &optval, sizeof optval);
742 break;
743
744
745 #if DUMMYNET
746 case IP_DUMMYNET_GET:
747 if (!DUMMYNET_LOADED) {
748 ip_dn_init();
749 }
750 if (DUMMYNET_LOADED) {
751 error = ip_dn_ctl_ptr(sopt);
752 } else {
753 error = ENOPROTOOPT;
754 }
755 break;
756 #endif /* DUMMYNET */
757
758 default:
759 error = ip_ctloutput(so, sopt);
760 break;
761 }
762 break;
763
764 case SOPT_SET:
765 switch (sopt->sopt_name) {
766 case IP_HDRINCL:
767 error = sooptcopyin(sopt, &optval, sizeof optval,
768 sizeof optval);
769 if (error) {
770 break;
771 }
772 if (optval) {
773 inp->inp_flags |= INP_HDRINCL;
774 } else {
775 inp->inp_flags &= ~INP_HDRINCL;
776 }
777 break;
778
779 case IP_STRIPHDR:
780 error = sooptcopyin(sopt, &optval, sizeof optval,
781 sizeof optval);
782 if (error) {
783 break;
784 }
785 if (optval) {
786 inp->inp_flags |= INP_STRIPHDR;
787 } else {
788 inp->inp_flags &= ~INP_STRIPHDR;
789 }
790 break;
791
792
793 #if DUMMYNET
794 case IP_DUMMYNET_CONFIGURE:
795 case IP_DUMMYNET_DEL:
796 case IP_DUMMYNET_FLUSH:
797 if (!DUMMYNET_LOADED) {
798 ip_dn_init();
799 }
800 if (DUMMYNET_LOADED) {
801 error = ip_dn_ctl_ptr(sopt);
802 } else {
803 error = ENOPROTOOPT;
804 }
805 break;
806 #endif /* DUMMYNET */
807
808 case SO_FLUSH:
809 if ((error = sooptcopyin(sopt, &optval, sizeof(optval),
810 sizeof(optval))) != 0) {
811 break;
812 }
813
814 error = inp_flush(inp, optval);
815 break;
816
817 default:
818 error = ip_ctloutput(so, sopt);
819 break;
820 }
821 break;
822 }
823
824 return error;
825 }
826
827 /*
828 * This function exists solely to receive the PRC_IFDOWN messages which
829 * are sent by if_down(). It looks for an ifaddr whose ifa_addr is sa,
830 * and calls in_ifadown() to remove all routes corresponding to that address.
831 * It also receives the PRC_IFUP messages from if_up() and reinstalls the
832 * interface routes.
833 */
834 void
rip_ctlinput(int cmd,struct sockaddr * sa,__unused void * vip,__unused struct ifnet * ifp)835 rip_ctlinput(
836 int cmd,
837 struct sockaddr *sa,
838 __unused void *vip,
839 __unused struct ifnet *ifp)
840 {
841 struct in_ifaddr *ia = NULL;
842 struct ifnet *iaifp = NULL;
843 int err = 0;
844 int flags, done = 0;
845
846 switch (cmd) {
847 case PRC_IFDOWN:
848 lck_rw_lock_shared(&in_ifaddr_rwlock);
849 for (ia = in_ifaddrhead.tqh_first; ia;
850 ia = ia->ia_link.tqe_next) {
851 IFA_LOCK(&ia->ia_ifa);
852 if (ia->ia_ifa.ifa_addr == sa &&
853 (ia->ia_flags & IFA_ROUTE)) {
854 done = 1;
855 IFA_ADDREF_LOCKED(&ia->ia_ifa);
856 IFA_UNLOCK(&ia->ia_ifa);
857 lck_rw_done(&in_ifaddr_rwlock);
858 lck_mtx_lock(rnh_lock);
859 /*
860 * in_ifscrub kills the interface route.
861 */
862 in_ifscrub(ia->ia_ifp, ia, 1);
863 /*
864 * in_ifadown gets rid of all the rest of
865 * the routes. This is not quite the right
866 * thing to do, but at least if we are running
867 * a routing process they will come back.
868 */
869 in_ifadown(&ia->ia_ifa, 1);
870 lck_mtx_unlock(rnh_lock);
871 IFA_REMREF(&ia->ia_ifa);
872 break;
873 }
874 IFA_UNLOCK(&ia->ia_ifa);
875 }
876 if (!done) {
877 lck_rw_done(&in_ifaddr_rwlock);
878 }
879 break;
880
881 case PRC_IFUP:
882 lck_rw_lock_shared(&in_ifaddr_rwlock);
883 for (ia = in_ifaddrhead.tqh_first; ia;
884 ia = ia->ia_link.tqe_next) {
885 IFA_LOCK(&ia->ia_ifa);
886 if (ia->ia_ifa.ifa_addr == sa) {
887 /* keep it locked */
888 break;
889 }
890 IFA_UNLOCK(&ia->ia_ifa);
891 }
892 if (ia == NULL || (ia->ia_flags & IFA_ROUTE) ||
893 (ia->ia_ifa.ifa_debug & IFD_NOTREADY)) {
894 if (ia != NULL) {
895 IFA_UNLOCK(&ia->ia_ifa);
896 }
897 lck_rw_done(&in_ifaddr_rwlock);
898 return;
899 }
900 IFA_ADDREF_LOCKED(&ia->ia_ifa);
901 IFA_UNLOCK(&ia->ia_ifa);
902 lck_rw_done(&in_ifaddr_rwlock);
903
904 flags = RTF_UP;
905 iaifp = ia->ia_ifa.ifa_ifp;
906
907 if ((iaifp->if_flags & IFF_LOOPBACK)
908 || (iaifp->if_flags & IFF_POINTOPOINT)) {
909 flags |= RTF_HOST;
910 }
911
912 err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
913 if (err == 0) {
914 IFA_LOCK_SPIN(&ia->ia_ifa);
915 ia->ia_flags |= IFA_ROUTE;
916 IFA_UNLOCK(&ia->ia_ifa);
917 }
918 IFA_REMREF(&ia->ia_ifa);
919 break;
920 }
921 }
922
923 u_int32_t rip_sendspace = RIPSNDQ;
924 u_int32_t rip_recvspace = RIPRCVQ;
925
926 SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW | CTLFLAG_LOCKED,
927 &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
928 SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW | CTLFLAG_LOCKED,
929 &rip_recvspace, 0, "Maximum incoming raw IP datagram size");
930 SYSCTL_UINT(_net_inet_raw, OID_AUTO, pcbcount, CTLFLAG_RD | CTLFLAG_LOCKED,
931 &ripcbinfo.ipi_count, 0, "Number of active PCBs");
932
933 static int
rip_attach(struct socket * so,int proto,struct proc * p)934 rip_attach(struct socket *so, int proto, struct proc *p)
935 {
936 struct inpcb *inp;
937 int error;
938
939 inp = sotoinpcb(so);
940 if (inp) {
941 panic("rip_attach");
942 }
943 if ((so->so_state & SS_PRIV) == 0) {
944 return EPERM;
945 }
946 if (proto > UINT8_MAX) {
947 return EINVAL;
948 }
949
950 error = soreserve(so, rip_sendspace, rip_recvspace);
951 if (error) {
952 return error;
953 }
954 error = in_pcballoc(so, &ripcbinfo, p);
955 if (error) {
956 return error;
957 }
958 inp = (struct inpcb *)so->so_pcb;
959 inp->inp_vflag |= INP_IPV4;
960 VERIFY(proto <= UINT8_MAX);
961 inp->inp_ip_p = (u_char)proto;
962 inp->inp_ip_ttl = (u_char)ip_defttl;
963 return 0;
964 }
965
966 __private_extern__ int
rip_detach(struct socket * so)967 rip_detach(struct socket *so)
968 {
969 struct inpcb *inp;
970
971 inp = sotoinpcb(so);
972 if (inp == 0) {
973 panic("rip_detach");
974 }
975 in_pcbdetach(inp);
976 return 0;
977 }
978
979 __private_extern__ int
rip_abort(struct socket * so)980 rip_abort(struct socket *so)
981 {
982 soisdisconnected(so);
983 return rip_detach(so);
984 }
985
986 __private_extern__ int
rip_disconnect(struct socket * so)987 rip_disconnect(struct socket *so)
988 {
989 if ((so->so_state & SS_ISCONNECTED) == 0) {
990 return ENOTCONN;
991 }
992 return rip_abort(so);
993 }
994
995 __private_extern__ int
rip_bind(struct socket * so,struct sockaddr * nam,struct proc * p)996 rip_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
997 {
998 #pragma unused(p)
999 struct inpcb *inp = sotoinpcb(so);
1000 struct sockaddr_in sin;
1001 struct ifaddr *ifa = NULL;
1002 struct ifnet *outif = NULL;
1003
1004 if (inp == NULL
1005 #if NECP
1006 || (necp_socket_should_use_flow_divert(inp))
1007 #endif /* NECP */
1008 ) {
1009 return inp == NULL ? EINVAL : EPROTOTYPE;
1010 }
1011
1012 if (nam->sa_len != sizeof(struct sockaddr_in)) {
1013 return EINVAL;
1014 }
1015
1016 /* Sanitized local copy for interface address searches */
1017 bzero(&sin, sizeof(sin));
1018 sin.sin_family = AF_INET;
1019 sin.sin_len = sizeof(struct sockaddr_in);
1020 sin.sin_addr.s_addr = SIN(nam)->sin_addr.s_addr;
1021
1022 if (TAILQ_EMPTY(&ifnet_head) ||
1023 (sin.sin_family != AF_INET && sin.sin_family != AF_IMPLINK) ||
1024 (sin.sin_addr.s_addr && (ifa = ifa_ifwithaddr(SA(&sin))) == 0)) {
1025 return EADDRNOTAVAIL;
1026 } else if (ifa) {
1027 /*
1028 * Opportunistically determine the outbound
1029 * interface that may be used; this may not
1030 * hold true if we end up using a route
1031 * going over a different interface, e.g.
1032 * when sending to a local address. This
1033 * will get updated again after sending.
1034 */
1035 IFA_LOCK(ifa);
1036 outif = ifa->ifa_ifp;
1037 IFA_UNLOCK(ifa);
1038 IFA_REMREF(ifa);
1039 }
1040 inp->inp_laddr = sin.sin_addr;
1041 inp->inp_last_outifp = outif;
1042
1043 return 0;
1044 }
1045
1046 __private_extern__ int
rip_connect(struct socket * so,struct sockaddr * nam,__unused struct proc * p)1047 rip_connect(struct socket *so, struct sockaddr *nam, __unused struct proc *p)
1048 {
1049 struct inpcb *inp = sotoinpcb(so);
1050 struct sockaddr_in *addr = (struct sockaddr_in *)(void *)nam;
1051
1052 if (inp == NULL
1053 #if NECP
1054 || (necp_socket_should_use_flow_divert(inp))
1055 #endif /* NECP */
1056 ) {
1057 return inp == NULL ? EINVAL : EPROTOTYPE;
1058 }
1059 if (nam->sa_len != sizeof(*addr)) {
1060 return EINVAL;
1061 }
1062 if (TAILQ_EMPTY(&ifnet_head)) {
1063 return EADDRNOTAVAIL;
1064 }
1065 if ((addr->sin_family != AF_INET) &&
1066 (addr->sin_family != AF_IMPLINK)) {
1067 return EAFNOSUPPORT;
1068 }
1069
1070 if (!(so->so_flags1 & SOF1_CONNECT_COUNTED)) {
1071 so->so_flags1 |= SOF1_CONNECT_COUNTED;
1072 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_connected);
1073 }
1074
1075 inp->inp_faddr = addr->sin_addr;
1076 soisconnected(so);
1077
1078 return 0;
1079 }
1080
1081 __private_extern__ int
rip_shutdown(struct socket * so)1082 rip_shutdown(struct socket *so)
1083 {
1084 socantsendmore(so);
1085 return 0;
1086 }
1087
1088 __private_extern__ int
rip_send(struct socket * so,int flags,struct mbuf * m,struct sockaddr * nam,struct mbuf * control,struct proc * p)1089 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
1090 struct mbuf *control, struct proc *p)
1091 {
1092 #pragma unused(flags, p)
1093 struct inpcb *inp = sotoinpcb(so);
1094 u_int32_t dst = INADDR_ANY;
1095 int error = 0;
1096
1097 if (inp == NULL
1098 #if NECP
1099 || (necp_socket_should_use_flow_divert(inp) && (error = EPROTOTYPE))
1100 #endif /* NECP */
1101 ) {
1102 if (inp == NULL) {
1103 error = EINVAL;
1104 } else {
1105 error = EPROTOTYPE;
1106 }
1107 goto bad;
1108 }
1109
1110 if (nam != NULL) {
1111 dst = ((struct sockaddr_in *)(void *)nam)->sin_addr.s_addr;
1112 }
1113 return rip_output(m, so, dst, control);
1114
1115 bad:
1116 VERIFY(error != 0);
1117
1118 if (m != NULL) {
1119 m_freem(m);
1120 }
1121 if (control != NULL) {
1122 m_freem(control);
1123 }
1124
1125 return error;
1126 }
1127
1128 /* note: rip_unlock is called from different protos instead of the generic socket_unlock,
1129 * it will handle the socket dealloc on last reference
1130 * */
1131 int
rip_unlock(struct socket * so,int refcount,void * debug)1132 rip_unlock(struct socket *so, int refcount, void *debug)
1133 {
1134 void *lr_saved;
1135 struct inpcb *inp = sotoinpcb(so);
1136
1137 if (debug == NULL) {
1138 lr_saved = __builtin_return_address(0);
1139 } else {
1140 lr_saved = debug;
1141 }
1142
1143 if (refcount) {
1144 if (so->so_usecount <= 0) {
1145 panic("rip_unlock: bad refoucnt so=%p val=%x lrh= %s",
1146 so, so->so_usecount, solockhistory_nr(so));
1147 /* NOTREACHED */
1148 }
1149 so->so_usecount--;
1150 if (so->so_usecount == 0 && (inp->inp_wantcnt == WNT_STOPUSING)) {
1151 /* cleanup after last reference */
1152 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1153 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1154 if (inp->inp_state != INPCB_STATE_DEAD) {
1155 if (SOCK_CHECK_DOM(so, PF_INET6)) {
1156 in6_pcbdetach(inp);
1157 } else {
1158 in_pcbdetach(inp);
1159 }
1160 }
1161 in_pcbdispose(inp);
1162 lck_rw_done(&ripcbinfo.ipi_lock);
1163 return 0;
1164 }
1165 }
1166 so->unlock_lr[so->next_unlock_lr] = lr_saved;
1167 so->next_unlock_lr = (so->next_unlock_lr + 1) % SO_LCKDBG_MAX;
1168 lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
1169 return 0;
1170 }
1171
1172 static int
1173 rip_pcblist SYSCTL_HANDLER_ARGS
1174 {
1175 #pragma unused(oidp, arg1, arg2)
1176 int error, i, n, sz;
1177 struct inpcb *inp, **inp_list;
1178 inp_gen_t gencnt;
1179 struct xinpgen xig;
1180
1181 /*
1182 * The process of preparing the TCB list is too time-consuming and
1183 * resource-intensive to repeat twice on every request.
1184 */
1185 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1186 if (req->oldptr == USER_ADDR_NULL) {
1187 n = ripcbinfo.ipi_count;
1188 req->oldidx = 2 * (sizeof xig)
1189 + (n + n / 8) * sizeof(struct xinpcb);
1190 lck_rw_done(&ripcbinfo.ipi_lock);
1191 return 0;
1192 }
1193
1194 if (req->newptr != USER_ADDR_NULL) {
1195 lck_rw_done(&ripcbinfo.ipi_lock);
1196 return EPERM;
1197 }
1198
1199 /*
1200 * OK, now we're committed to doing something.
1201 */
1202 gencnt = ripcbinfo.ipi_gencnt;
1203 sz = n = ripcbinfo.ipi_count;
1204
1205 bzero(&xig, sizeof(xig));
1206 xig.xig_len = sizeof xig;
1207 xig.xig_count = n;
1208 xig.xig_gen = gencnt;
1209 xig.xig_sogen = so_gencnt;
1210 error = SYSCTL_OUT(req, &xig, sizeof xig);
1211 if (error) {
1212 lck_rw_done(&ripcbinfo.ipi_lock);
1213 return error;
1214 }
1215 /*
1216 * We are done if there is no pcb
1217 */
1218 if (n == 0) {
1219 lck_rw_done(&ripcbinfo.ipi_lock);
1220 return 0;
1221 }
1222
1223 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1224 if (inp_list == NULL) {
1225 lck_rw_done(&ripcbinfo.ipi_lock);
1226 return ENOMEM;
1227 }
1228
1229 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1230 inp = inp->inp_list.le_next) {
1231 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1232 inp_list[i++] = inp;
1233 }
1234 }
1235 n = i;
1236
1237 error = 0;
1238 for (i = 0; i < n; i++) {
1239 inp = inp_list[i];
1240 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1241 struct xinpcb xi;
1242
1243 bzero(&xi, sizeof(xi));
1244 xi.xi_len = sizeof xi;
1245 /* XXX should avoid extra copy */
1246 inpcb_to_compat(inp, &xi.xi_inp);
1247 if (inp->inp_socket) {
1248 sotoxsocket(inp->inp_socket, &xi.xi_socket);
1249 }
1250 error = SYSCTL_OUT(req, &xi, sizeof xi);
1251 }
1252 }
1253 if (!error) {
1254 /*
1255 * Give the user an updated idea of our state.
1256 * If the generation differs from what we told
1257 * her before, she knows that something happened
1258 * while we were processing this request, and it
1259 * might be necessary to retry.
1260 */
1261 bzero(&xig, sizeof(xig));
1262 xig.xig_len = sizeof xig;
1263 xig.xig_gen = ripcbinfo.ipi_gencnt;
1264 xig.xig_sogen = so_gencnt;
1265 xig.xig_count = ripcbinfo.ipi_count;
1266 error = SYSCTL_OUT(req, &xig, sizeof xig);
1267 }
1268
1269 lck_rw_done(&ripcbinfo.ipi_lock);
1270 kfree_type(struct inpcb *, sz, inp_list);
1271 return error;
1272 }
1273
1274 SYSCTL_PROC(_net_inet_raw, OID_AUTO /*XXX*/, pcblist,
1275 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1276 rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
1277
1278 #if XNU_TARGET_OS_OSX
1279
1280 static int
1281 rip_pcblist64 SYSCTL_HANDLER_ARGS
1282 {
1283 #pragma unused(oidp, arg1, arg2)
1284 int error, i, n, sz;
1285 struct inpcb *inp, **inp_list;
1286 inp_gen_t gencnt;
1287 struct xinpgen xig;
1288
1289 /*
1290 * The process of preparing the TCB list is too time-consuming and
1291 * resource-intensive to repeat twice on every request.
1292 */
1293 lck_rw_lock_exclusive(&ripcbinfo.ipi_lock);
1294 if (req->oldptr == USER_ADDR_NULL) {
1295 n = ripcbinfo.ipi_count;
1296 req->oldidx = 2 * (sizeof xig)
1297 + (n + n / 8) * sizeof(struct xinpcb64);
1298 lck_rw_done(&ripcbinfo.ipi_lock);
1299 return 0;
1300 }
1301
1302 if (req->newptr != USER_ADDR_NULL) {
1303 lck_rw_done(&ripcbinfo.ipi_lock);
1304 return EPERM;
1305 }
1306
1307 /*
1308 * OK, now we're committed to doing something.
1309 */
1310 gencnt = ripcbinfo.ipi_gencnt;
1311 sz = n = ripcbinfo.ipi_count;
1312
1313 bzero(&xig, sizeof(xig));
1314 xig.xig_len = sizeof xig;
1315 xig.xig_count = n;
1316 xig.xig_gen = gencnt;
1317 xig.xig_sogen = so_gencnt;
1318 error = SYSCTL_OUT(req, &xig, sizeof xig);
1319 if (error) {
1320 lck_rw_done(&ripcbinfo.ipi_lock);
1321 return error;
1322 }
1323 /*
1324 * We are done if there is no pcb
1325 */
1326 if (n == 0) {
1327 lck_rw_done(&ripcbinfo.ipi_lock);
1328 return 0;
1329 }
1330
1331 inp_list = kalloc_type(struct inpcb *, n, Z_WAITOK);
1332 if (inp_list == NULL) {
1333 lck_rw_done(&ripcbinfo.ipi_lock);
1334 return ENOMEM;
1335 }
1336
1337 for (inp = ripcbinfo.ipi_listhead->lh_first, i = 0; inp && i < n;
1338 inp = inp->inp_list.le_next) {
1339 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1340 inp_list[i++] = inp;
1341 }
1342 }
1343 n = i;
1344
1345 error = 0;
1346 for (i = 0; i < n; i++) {
1347 inp = inp_list[i];
1348 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
1349 struct xinpcb64 xi;
1350
1351 bzero(&xi, sizeof(xi));
1352 xi.xi_len = sizeof xi;
1353 inpcb_to_xinpcb64(inp, &xi);
1354 if (inp->inp_socket) {
1355 sotoxsocket64(inp->inp_socket, &xi.xi_socket);
1356 }
1357 error = SYSCTL_OUT(req, &xi, sizeof xi);
1358 }
1359 }
1360 if (!error) {
1361 /*
1362 * Give the user an updated idea of our state.
1363 * If the generation differs from what we told
1364 * her before, she knows that something happened
1365 * while we were processing this request, and it
1366 * might be necessary to retry.
1367 */
1368 bzero(&xig, sizeof(xig));
1369 xig.xig_len = sizeof xig;
1370 xig.xig_gen = ripcbinfo.ipi_gencnt;
1371 xig.xig_sogen = so_gencnt;
1372 xig.xig_count = ripcbinfo.ipi_count;
1373 error = SYSCTL_OUT(req, &xig, sizeof xig);
1374 }
1375
1376 lck_rw_done(&ripcbinfo.ipi_lock);
1377 kfree_type(struct inpcb *, sz, inp_list);
1378 return error;
1379 }
1380
1381 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist64,
1382 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1383 rip_pcblist64, "S,xinpcb64", "List of active raw IP sockets");
1384
1385 #endif /* XNU_TARGET_OS_OSX */
1386
1387
1388 static int
1389 rip_pcblist_n SYSCTL_HANDLER_ARGS
1390 {
1391 #pragma unused(oidp, arg1, arg2)
1392 int error = 0;
1393
1394 error = get_pcblist_n(IPPROTO_IP, req, &ripcbinfo);
1395
1396 return error;
1397 }
1398
1399 SYSCTL_PROC(_net_inet_raw, OID_AUTO, pcblist_n,
1400 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
1401 rip_pcblist_n, "S,xinpcb_n", "List of active raw IP sockets");
1402
1403 struct pr_usrreqs rip_usrreqs = {
1404 .pru_abort = rip_abort,
1405 .pru_attach = rip_attach,
1406 .pru_bind = rip_bind,
1407 .pru_connect = rip_connect,
1408 .pru_control = in_control,
1409 .pru_detach = rip_detach,
1410 .pru_disconnect = rip_disconnect,
1411 .pru_peeraddr = in_getpeeraddr,
1412 .pru_send = rip_send,
1413 .pru_shutdown = rip_shutdown,
1414 .pru_sockaddr = in_getsockaddr,
1415 .pru_sosend = sosend,
1416 .pru_soreceive = soreceive,
1417 };
1418 /* DSEP Review Done pl-20051213-v02 @3253 */
1419