xref: /dflybsd-src/sys/net/rtsock.c (revision d217426c317e15b34c1a61f020c85bd2b08f5c0d)
1 /*
2  * Copyright (c) 2004, 2005 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Jeffrey M. Hsu.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of The DragonFly Project nor the names of its
16  *    contributors may be used to endorse or promote products derived
17  *    from this software without specific, prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
27  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
29  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1988, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)rtsock.c	8.7 (Berkeley) 10/12/95
62  * $FreeBSD: src/sys/net/rtsock.c,v 1.44.2.11 2002/12/04 14:05:41 ru Exp $
63  */
64 
65 #include "opt_sctp.h"
66 
67 #include <sys/param.h>
68 #include <sys/systm.h>
69 #include <sys/kernel.h>
70 #include <sys/sysctl.h>
71 #include <sys/proc.h>
72 #include <sys/priv.h>
73 #include <sys/malloc.h>
74 #include <sys/mbuf.h>
75 #include <sys/protosw.h>
76 #include <sys/socket.h>
77 #include <sys/socketvar.h>
78 #include <sys/domain.h>
79 
80 #include <sys/thread2.h>
81 #include <sys/socketvar2.h>
82 
83 #include <net/if.h>
84 #include <net/route.h>
85 #include <net/raw_cb.h>
86 #include <net/netmsg2.h>
87 #include <net/netisr2.h>
88 
89 #ifdef SCTP
90 extern void sctp_add_ip_address(struct ifaddr *ifa);
91 extern void sctp_delete_ip_address(struct ifaddr *ifa);
92 #endif /* SCTP */
93 
94 MALLOC_DEFINE(M_RTABLE, "routetbl", "routing tables");
95 
96 static struct route_cb {
97 	int	ip_count;
98 	int	ip6_count;
99 	int	ns_count;
100 	int	any_count;
101 } route_cb;
102 
103 static const struct sockaddr route_src = { 2, PF_ROUTE, };
104 
105 struct walkarg {
106 	int	w_tmemsize;
107 	int	w_op, w_arg;
108 	void	*w_tmem;
109 	struct sysctl_req *w_req;
110 };
111 
112 static struct mbuf *
113 		rt_msg_mbuf (int, struct rt_addrinfo *);
114 static void	rt_msg_buffer (int, struct rt_addrinfo *, void *buf, int len);
115 static int	rt_msgsize(int type, const struct rt_addrinfo *rtinfo);
116 static int	rt_xaddrs (char *, char *, struct rt_addrinfo *);
117 static int	sysctl_dumpentry (struct radix_node *rn, void *vw);
118 static int	sysctl_rttable(int af, struct sysctl_req *req, int op, int arg);
119 static int	sysctl_iflist (int af, struct walkarg *w);
120 static int	route_output(struct mbuf *, struct socket *, ...);
121 static void	rt_setmetrics (u_long, struct rt_metrics *,
122 			       struct rt_metrics *);
123 
124 /*
125  * It really doesn't make any sense at all for this code to share much
126  * with raw_usrreq.c, since its functionality is so restricted.  XXX
127  */
128 static void
129 rts_abort(netmsg_t msg)
130 {
131 	crit_enter();
132 	raw_usrreqs.pru_abort(msg);
133 	/* msg invalid now */
134 	crit_exit();
135 }
136 
137 /* pru_accept is EOPNOTSUPP */
138 
139 static void
140 rts_attach(netmsg_t msg)
141 {
142 	struct socket *so = msg->base.nm_so;
143 	struct pru_attach_info *ai = msg->attach.nm_ai;
144 	struct rawcb *rp;
145 	int proto = msg->attach.nm_proto;
146 	int error;
147 
148 	crit_enter();
149 	if (sotorawcb(so) != NULL) {
150 		error = EISCONN;
151 		goto done;
152 	}
153 
154 	rp = kmalloc(sizeof *rp, M_PCB, M_WAITOK | M_ZERO);
155 
156 	/*
157 	 * The critical section is necessary to block protocols from sending
158 	 * error notifications (like RTM_REDIRECT or RTM_LOSING) while
159 	 * this PCB is extant but incompletely initialized.
160 	 * Probably we should try to do more of this work beforehand and
161 	 * eliminate the critical section.
162 	 */
163 	so->so_pcb = rp;
164 	soreference(so);	/* so_pcb assignment */
165 	error = raw_attach(so, proto, ai->sb_rlimit);
166 	rp = sotorawcb(so);
167 	if (error) {
168 		kfree(rp, M_PCB);
169 		goto done;
170 	}
171 	switch(rp->rcb_proto.sp_protocol) {
172 	case AF_INET:
173 		route_cb.ip_count++;
174 		break;
175 	case AF_INET6:
176 		route_cb.ip6_count++;
177 		break;
178 	}
179 	rp->rcb_faddr = &route_src;
180 	route_cb.any_count++;
181 	soisconnected(so);
182 	so->so_options |= SO_USELOOPBACK;
183 	error = 0;
184 done:
185 	crit_exit();
186 	lwkt_replymsg(&msg->lmsg, error);
187 }
188 
189 static void
190 rts_bind(netmsg_t msg)
191 {
192 	crit_enter();
193 	raw_usrreqs.pru_bind(msg); /* xxx just EINVAL */
194 	/* msg invalid now */
195 	crit_exit();
196 }
197 
198 static void
199 rts_connect(netmsg_t msg)
200 {
201 	crit_enter();
202 	raw_usrreqs.pru_connect(msg); /* XXX just EINVAL */
203 	/* msg invalid now */
204 	crit_exit();
205 }
206 
207 /* pru_connect2 is EOPNOTSUPP */
208 /* pru_control is EOPNOTSUPP */
209 
210 static void
211 rts_detach(netmsg_t msg)
212 {
213 	struct socket *so = msg->base.nm_so;
214 	struct rawcb *rp = sotorawcb(so);
215 
216 	crit_enter();
217 	if (rp != NULL) {
218 		switch(rp->rcb_proto.sp_protocol) {
219 		case AF_INET:
220 			route_cb.ip_count--;
221 			break;
222 		case AF_INET6:
223 			route_cb.ip6_count--;
224 			break;
225 		}
226 		route_cb.any_count--;
227 	}
228 	raw_usrreqs.pru_detach(msg);
229 	/* msg invalid now */
230 	crit_exit();
231 }
232 
233 static void
234 rts_disconnect(netmsg_t msg)
235 {
236 	crit_enter();
237 	raw_usrreqs.pru_disconnect(msg);
238 	/* msg invalid now */
239 	crit_exit();
240 }
241 
242 /* pru_listen is EOPNOTSUPP */
243 
244 static void
245 rts_peeraddr(netmsg_t msg)
246 {
247 	crit_enter();
248 	raw_usrreqs.pru_peeraddr(msg);
249 	/* msg invalid now */
250 	crit_exit();
251 }
252 
253 /* pru_rcvd is EOPNOTSUPP */
254 /* pru_rcvoob is EOPNOTSUPP */
255 
256 static void
257 rts_send(netmsg_t msg)
258 {
259 	crit_enter();
260 	raw_usrreqs.pru_send(msg);
261 	/* msg invalid now */
262 	crit_exit();
263 }
264 
265 /* pru_sense is null */
266 
267 static void
268 rts_shutdown(netmsg_t msg)
269 {
270 	crit_enter();
271 	raw_usrreqs.pru_shutdown(msg);
272 	/* msg invalid now */
273 	crit_exit();
274 }
275 
276 static void
277 rts_sockaddr(netmsg_t msg)
278 {
279 	crit_enter();
280 	raw_usrreqs.pru_sockaddr(msg);
281 	/* msg invalid now */
282 	crit_exit();
283 }
284 
285 static struct pr_usrreqs route_usrreqs = {
286 	.pru_abort = rts_abort,
287 	.pru_accept = pr_generic_notsupp,
288 	.pru_attach = rts_attach,
289 	.pru_bind = rts_bind,
290 	.pru_connect = rts_connect,
291 	.pru_connect2 = pr_generic_notsupp,
292 	.pru_control = pr_generic_notsupp,
293 	.pru_detach = rts_detach,
294 	.pru_disconnect = rts_disconnect,
295 	.pru_listen = pr_generic_notsupp,
296 	.pru_peeraddr = rts_peeraddr,
297 	.pru_rcvd = pr_generic_notsupp,
298 	.pru_rcvoob = pr_generic_notsupp,
299 	.pru_send = rts_send,
300 	.pru_sense = pru_sense_null,
301 	.pru_shutdown = rts_shutdown,
302 	.pru_sockaddr = rts_sockaddr,
303 	.pru_sosend = sosend,
304 	.pru_soreceive = soreceive
305 };
306 
307 static __inline sa_family_t
308 familyof(struct sockaddr *sa)
309 {
310 	return (sa != NULL ? sa->sa_family : 0);
311 }
312 
313 /*
314  * Routing socket input function.  The packet must be serialized onto cpu 0.
315  * We use the cpu0_soport() netisr processing loop to handle it.
316  *
317  * This looks messy but it means that anyone, including interrupt code,
318  * can send a message to the routing socket.
319  */
320 static void
321 rts_input_handler(netmsg_t msg)
322 {
323 	static const struct sockaddr route_dst = { 2, PF_ROUTE, };
324 	struct sockproto route_proto;
325 	struct netmsg_packet *pmsg = &msg->packet;
326 	struct mbuf *m;
327 	sa_family_t family;
328 	struct rawcb *skip;
329 
330 	family = pmsg->base.lmsg.u.ms_result;
331 	route_proto.sp_family = PF_ROUTE;
332 	route_proto.sp_protocol = family;
333 
334 	m = pmsg->nm_packet;
335 	M_ASSERTPKTHDR(m);
336 
337 	skip = m->m_pkthdr.header;
338 	m->m_pkthdr.header = NULL;
339 
340 	raw_input(m, &route_proto, &route_src, &route_dst, skip);
341 }
342 
343 static void
344 rts_input_skip(struct mbuf *m, sa_family_t family, struct rawcb *skip)
345 {
346 	struct netmsg_packet *pmsg;
347 	lwkt_port_t port;
348 
349 	M_ASSERTPKTHDR(m);
350 
351 	port = netisr_cpuport(0);	/* XXX same as for routing socket */
352 	pmsg = &m->m_hdr.mh_netmsg;
353 	netmsg_init(&pmsg->base, NULL, &netisr_apanic_rport,
354 		    0, rts_input_handler);
355 	pmsg->nm_packet = m;
356 	pmsg->base.lmsg.u.ms_result = family;
357 	m->m_pkthdr.header = skip; /* XXX steal field in pkthdr */
358 	lwkt_sendmsg(port, &pmsg->base.lmsg);
359 }
360 
361 static __inline void
362 rts_input(struct mbuf *m, sa_family_t family)
363 {
364 	rts_input_skip(m, family, NULL);
365 }
366 
367 static void *
368 reallocbuf_nofree(void *ptr, size_t len, size_t olen)
369 {
370 	void *newptr;
371 
372 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
373 	if (newptr == NULL)
374 		return NULL;
375 	bcopy(ptr, newptr, olen);
376 	return (newptr);
377 }
378 
379 /*
380  * Internal helper routine for route_output().
381  */
382 static int
383 _fillrtmsg(struct rt_msghdr **prtm, struct rtentry *rt,
384 	   struct rt_addrinfo *rtinfo)
385 {
386 	int msglen;
387 	struct rt_msghdr *rtm = *prtm;
388 
389 	/* Fill in rt_addrinfo for call to rt_msg_buffer(). */
390 	rtinfo->rti_dst = rt_key(rt);
391 	rtinfo->rti_gateway = rt->rt_gateway;
392 	rtinfo->rti_netmask = rt_mask(rt);		/* might be NULL */
393 	rtinfo->rti_genmask = rt->rt_genmask;		/* might be NULL */
394 	if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
395 		if (rt->rt_ifp != NULL) {
396 			rtinfo->rti_ifpaddr =
397 			    TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])
398 			    ->ifa->ifa_addr;
399 			rtinfo->rti_ifaaddr = rt->rt_ifa->ifa_addr;
400 			if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
401 				rtinfo->rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
402 			rtm->rtm_index = rt->rt_ifp->if_index;
403 		} else {
404 			rtinfo->rti_ifpaddr = NULL;
405 			rtinfo->rti_ifaaddr = NULL;
406 		}
407 	} else if (rt->rt_ifp != NULL) {
408 		rtm->rtm_index = rt->rt_ifp->if_index;
409 	}
410 
411 	msglen = rt_msgsize(rtm->rtm_type, rtinfo);
412 	if (rtm->rtm_msglen < msglen) {
413 		/* NOTE: Caller will free the old rtm accordingly */
414 		rtm = reallocbuf_nofree(rtm, msglen, rtm->rtm_msglen);
415 		if (rtm == NULL)
416 			return (ENOBUFS);
417 		*prtm = rtm;
418 	}
419 	rt_msg_buffer(rtm->rtm_type, rtinfo, rtm, msglen);
420 
421 	rtm->rtm_flags = rt->rt_flags;
422 	rtm->rtm_rmx = rt->rt_rmx;
423 	rtm->rtm_addrs = rtinfo->rti_addrs;
424 
425 	return (0);
426 }
427 
428 struct rtm_arg {
429 	struct rt_msghdr	*bak_rtm;
430 	struct rt_msghdr	*new_rtm;
431 };
432 
433 static int
434 fillrtmsg(struct rtm_arg *arg, struct rtentry *rt,
435 	  struct rt_addrinfo *rtinfo)
436 {
437 	struct rt_msghdr *rtm = arg->new_rtm;
438 	int error;
439 
440 	error = _fillrtmsg(&rtm, rt, rtinfo);
441 	if (!error) {
442 		if (arg->new_rtm != rtm) {
443 			/*
444 			 * _fillrtmsg() just allocated a new rtm;
445 			 * if the previously allocated rtm is not
446 			 * the backing rtm, it should be freed.
447 			 */
448 			if (arg->new_rtm != arg->bak_rtm)
449 				kfree(arg->new_rtm, M_RTABLE);
450 			arg->new_rtm = rtm;
451 		}
452 	}
453 	return error;
454 }
455 
456 static void route_output_add_callback(int, int, struct rt_addrinfo *,
457 					struct rtentry *, void *);
458 static void route_output_delete_callback(int, int, struct rt_addrinfo *,
459 					struct rtentry *, void *);
460 static int route_output_get_callback(int, struct rt_addrinfo *,
461 				     struct rtentry *, void *, int);
462 static int route_output_change_callback(int, struct rt_addrinfo *,
463 					struct rtentry *, void *, int);
464 static int route_output_lock_callback(int, struct rt_addrinfo *,
465 				      struct rtentry *, void *, int);
466 
467 /*ARGSUSED*/
468 static int
469 route_output(struct mbuf *m, struct socket *so, ...)
470 {
471 	struct rtm_arg arg;
472 	struct rt_msghdr *rtm = NULL;
473 	struct rawcb *rp = NULL;
474 	struct pr_output_info *oi;
475 	struct rt_addrinfo rtinfo;
476 	sa_family_t family;
477 	int len, error = 0;
478 	__va_list ap;
479 
480 	M_ASSERTPKTHDR(m);
481 
482 	__va_start(ap, so);
483 	oi = __va_arg(ap, struct pr_output_info *);
484 	__va_end(ap);
485 
486 	family = familyof(NULL);
487 
488 #define gotoerr(e) { error = e; goto flush;}
489 
490 	if (m == NULL ||
491 	    (m->m_len < sizeof(long) &&
492 	     (m = m_pullup(m, sizeof(long))) == NULL))
493 		return (ENOBUFS);
494 	len = m->m_pkthdr.len;
495 	if (len < sizeof(struct rt_msghdr) ||
496 	    len != mtod(m, struct rt_msghdr *)->rtm_msglen)
497 		gotoerr(EINVAL);
498 
499 	rtm = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
500 	if (rtm == NULL)
501 		gotoerr(ENOBUFS);
502 
503 	m_copydata(m, 0, len, (caddr_t)rtm);
504 	if (rtm->rtm_version != RTM_VERSION)
505 		gotoerr(EPROTONOSUPPORT);
506 
507 	rtm->rtm_pid = oi->p_pid;
508 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
509 	rtinfo.rti_addrs = rtm->rtm_addrs;
510 	if (rt_xaddrs((char *)(rtm + 1), (char *)rtm + len, &rtinfo) != 0)
511 		gotoerr(EINVAL);
512 
513 	rtinfo.rti_flags = rtm->rtm_flags;
514 	if (rtinfo.rti_dst == NULL || rtinfo.rti_dst->sa_family >= AF_MAX ||
515 	    (rtinfo.rti_gateway && rtinfo.rti_gateway->sa_family >= AF_MAX))
516 		gotoerr(EINVAL);
517 
518 	family = familyof(rtinfo.rti_dst);
519 
520 	/*
521 	 * Verify that the caller has the appropriate privilege; RTM_GET
522 	 * is the only operation the non-superuser is allowed.
523 	 */
524 	if (rtm->rtm_type != RTM_GET &&
525 	    priv_check_cred(so->so_cred, PRIV_ROOT, 0) != 0)
526 		gotoerr(EPERM);
527 
528 	if (rtinfo.rti_genmask != NULL) {
529 		error = rtmask_add_global(rtinfo.rti_genmask,
530 		    rtm->rtm_type != RTM_GET ?
531 		    RTREQ_PRIO_HIGH : RTREQ_PRIO_NORM);
532 		if (error)
533 			goto flush;
534 	}
535 
536 	switch (rtm->rtm_type) {
537 	case RTM_ADD:
538 		if (rtinfo.rti_gateway == NULL) {
539 			error = EINVAL;
540 		} else {
541 			error = rtrequest1_global(RTM_ADD, &rtinfo,
542 			    route_output_add_callback, rtm, RTREQ_PRIO_HIGH);
543 		}
544 		break;
545 	case RTM_DELETE:
546 		/*
547 		 * Backing rtm (bak_rtm) could _not_ be freed during
548 		 * rtrequest1_global or rtsearch_global, even if the
549 		 * callback reallocates the rtm due to its size changes,
550 		 * since rtinfo points to the backing rtm's memory area.
551 		 * After rtrequest1_global or rtsearch_global returns,
552 		 * it is safe to free the backing rtm, since rtinfo will
553 		 * not be used anymore.
554 		 *
555 		 * new_rtm will be used to save the new rtm allocated
556 		 * by rtrequest1_global or rtsearch_global.
557 		 */
558 		arg.bak_rtm = rtm;
559 		arg.new_rtm = rtm;
560 		error = rtrequest1_global(RTM_DELETE, &rtinfo,
561 		    route_output_delete_callback, &arg, RTREQ_PRIO_HIGH);
562 		rtm = arg.new_rtm;
563 		if (rtm != arg.bak_rtm)
564 			kfree(arg.bak_rtm, M_RTABLE);
565 		break;
566 	case RTM_GET:
567 		/* See the comment in RTM_DELETE */
568 		arg.bak_rtm = rtm;
569 		arg.new_rtm = rtm;
570 		error = rtsearch_global(RTM_GET, &rtinfo,
571 		    route_output_get_callback, &arg, RTS_NOEXACTMATCH,
572 		    RTREQ_PRIO_NORM);
573 		rtm = arg.new_rtm;
574 		if (rtm != arg.bak_rtm)
575 			kfree(arg.bak_rtm, M_RTABLE);
576 		break;
577 	case RTM_CHANGE:
578 		error = rtsearch_global(RTM_CHANGE, &rtinfo,
579 		    route_output_change_callback, rtm, RTS_EXACTMATCH,
580 		    RTREQ_PRIO_HIGH);
581 		break;
582 	case RTM_LOCK:
583 		error = rtsearch_global(RTM_LOCK, &rtinfo,
584 		    route_output_lock_callback, rtm, RTS_EXACTMATCH,
585 		    RTREQ_PRIO_HIGH);
586 		break;
587 	default:
588 		error = EOPNOTSUPP;
589 		break;
590 	}
591 flush:
592 	if (rtm != NULL) {
593 		if (error != 0)
594 			rtm->rtm_errno = error;
595 		else
596 			rtm->rtm_flags |= RTF_DONE;
597 	}
598 
599 	/*
600 	 * Check to see if we don't want our own messages.
601 	 */
602 	if (!(so->so_options & SO_USELOOPBACK)) {
603 		if (route_cb.any_count <= 1) {
604 			if (rtm != NULL)
605 				kfree(rtm, M_RTABLE);
606 			m_freem(m);
607 			return (error);
608 		}
609 		/* There is another listener, so construct message */
610 		rp = sotorawcb(so);
611 	}
612 	if (rtm != NULL) {
613 		m_copyback(m, 0, rtm->rtm_msglen, (caddr_t)rtm);
614 		if (m->m_pkthdr.len < rtm->rtm_msglen) {
615 			m_freem(m);
616 			m = NULL;
617 		} else if (m->m_pkthdr.len > rtm->rtm_msglen)
618 			m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
619 		kfree(rtm, M_RTABLE);
620 	}
621 	if (m != NULL)
622 		rts_input_skip(m, family, rp);
623 	return (error);
624 }
625 
626 static void
627 route_output_add_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
628 			  struct rtentry *rt, void *arg)
629 {
630 	struct rt_msghdr *rtm = arg;
631 
632 	if (error == 0 && rt != NULL) {
633 		rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx,
634 		    &rt->rt_rmx);
635 		rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
636 		rt->rt_rmx.rmx_locks |=
637 		    (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
638 		if (rtinfo->rti_genmask != NULL) {
639 			rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
640 			if (rt->rt_genmask == NULL) {
641 				/*
642 				 * This should not happen, since we
643 				 * have already installed genmask
644 				 * on each CPU before we reach here.
645 				 */
646 				panic("genmask is gone!?");
647 			}
648 		} else {
649 			rt->rt_genmask = NULL;
650 		}
651 		rtm->rtm_index = rt->rt_ifp->if_index;
652 	}
653 }
654 
655 static void
656 route_output_delete_callback(int cmd, int error, struct rt_addrinfo *rtinfo,
657 			  struct rtentry *rt, void *arg)
658 {
659 	if (error == 0 && rt) {
660 		++rt->rt_refcnt;
661 		if (fillrtmsg(arg, rt, rtinfo) != 0) {
662 			error = ENOBUFS;
663 			/* XXX no way to return the error */
664 		}
665 		--rt->rt_refcnt;
666 	}
667 	if (rt && rt->rt_refcnt == 0) {
668 		++rt->rt_refcnt;
669 		rtfree(rt);
670 	}
671 }
672 
673 static int
674 route_output_get_callback(int cmd, struct rt_addrinfo *rtinfo,
675 			  struct rtentry *rt, void *arg, int found_cnt)
676 {
677 	int error, found = 0;
678 
679 	if (((rtinfo->rti_flags ^ rt->rt_flags) & RTF_HOST) == 0)
680 		found = 1;
681 
682 	error = fillrtmsg(arg, rt, rtinfo);
683 	if (!error && found) {
684 		/* Got the exact match, we could return now! */
685 		error = EJUSTRETURN;
686 	}
687 	return error;
688 }
689 
690 static int
691 route_output_change_callback(int cmd, struct rt_addrinfo *rtinfo,
692 			     struct rtentry *rt, void *arg, int found_cnt)
693 {
694 	struct rt_msghdr *rtm = arg;
695 	struct ifaddr *ifa;
696 	int error = 0;
697 
698 	/*
699 	 * new gateway could require new ifaddr, ifp;
700 	 * flags may also be different; ifp may be specified
701 	 * by ll sockaddr when protocol address is ambiguous
702 	 */
703 	if (((rt->rt_flags & RTF_GATEWAY) && rtinfo->rti_gateway != NULL) ||
704 	    rtinfo->rti_ifpaddr != NULL ||
705 	    (rtinfo->rti_ifaaddr != NULL &&
706 	     !sa_equal(rtinfo->rti_ifaaddr, rt->rt_ifa->ifa_addr))) {
707 		error = rt_getifa(rtinfo);
708 		if (error != 0)
709 			goto done;
710 	}
711 	if (rtinfo->rti_gateway != NULL) {
712 		/*
713 		 * We only need to generate rtmsg upon the
714 		 * first route to be changed.
715 		 */
716 		error = rt_setgate(rt, rt_key(rt), rtinfo->rti_gateway,
717 			found_cnt == 1 ? RTL_REPORTMSG : RTL_DONTREPORT);
718 		if (error != 0)
719 			goto done;
720 	}
721 	if ((ifa = rtinfo->rti_ifa) != NULL) {
722 		struct ifaddr *oifa = rt->rt_ifa;
723 
724 		if (oifa != ifa) {
725 			if (oifa && oifa->ifa_rtrequest)
726 				oifa->ifa_rtrequest(RTM_DELETE, rt);
727 			IFAFREE(rt->rt_ifa);
728 			IFAREF(ifa);
729 			rt->rt_ifa = ifa;
730 			rt->rt_ifp = rtinfo->rti_ifp;
731 		}
732 	}
733 	rt_setmetrics(rtm->rtm_inits, &rtm->rtm_rmx, &rt->rt_rmx);
734 	if (rt->rt_ifa && rt->rt_ifa->ifa_rtrequest)
735 		rt->rt_ifa->ifa_rtrequest(RTM_ADD, rt);
736 	if (rtinfo->rti_genmask != NULL) {
737 		rt->rt_genmask = rtmask_purelookup(rtinfo->rti_genmask);
738 		if (rt->rt_genmask == NULL) {
739 			/*
740 			 * This should not happen, since we
741 			 * have already installed genmask
742 			 * on each CPU before we reach here.
743 			 */
744 			panic("genmask is gone!?");
745 		}
746 	}
747 	rtm->rtm_index = rt->rt_ifp->if_index;
748 done:
749 	return error;
750 }
751 
752 static int
753 route_output_lock_callback(int cmd, struct rt_addrinfo *rtinfo,
754 			   struct rtentry *rt, void *arg,
755 			   int found_cnt __unused)
756 {
757 	struct rt_msghdr *rtm = arg;
758 
759 	rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
760 	rt->rt_rmx.rmx_locks |=
761 		(rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
762 	return 0;
763 }
764 
765 static void
766 rt_setmetrics(u_long which, struct rt_metrics *in, struct rt_metrics *out)
767 {
768 #define setmetric(flag, elt) if (which & (flag)) out->elt = in->elt;
769 	setmetric(RTV_RPIPE, rmx_recvpipe);
770 	setmetric(RTV_SPIPE, rmx_sendpipe);
771 	setmetric(RTV_SSTHRESH, rmx_ssthresh);
772 	setmetric(RTV_RTT, rmx_rtt);
773 	setmetric(RTV_RTTVAR, rmx_rttvar);
774 	setmetric(RTV_HOPCOUNT, rmx_hopcount);
775 	setmetric(RTV_MTU, rmx_mtu);
776 	setmetric(RTV_EXPIRE, rmx_expire);
777 	setmetric(RTV_MSL, rmx_msl);
778 	setmetric(RTV_IWMAXSEGS, rmx_iwmaxsegs);
779 	setmetric(RTV_IWCAPSEGS, rmx_iwcapsegs);
780 #undef setmetric
781 }
782 
783 /*
784  * Extract the addresses of the passed sockaddrs.
785  * Do a little sanity checking so as to avoid bad memory references.
786  * This data is derived straight from userland.
787  */
788 static int
789 rt_xaddrs(char *cp, char *cplim, struct rt_addrinfo *rtinfo)
790 {
791 	struct sockaddr *sa;
792 	int i;
793 
794 	for (i = 0; (i < RTAX_MAX) && (cp < cplim); i++) {
795 		if ((rtinfo->rti_addrs & (1 << i)) == 0)
796 			continue;
797 		sa = (struct sockaddr *)cp;
798 		/*
799 		 * It won't fit.
800 		 */
801 		if ((cp + sa->sa_len) > cplim) {
802 			return (EINVAL);
803 		}
804 
805 		/*
806 		 * There are no more...  Quit now.
807 		 * If there are more bits, they are in error.
808 		 * I've seen this.  route(1) can evidently generate these.
809 		 * This causes kernel to core dump.
810 		 * For compatibility, if we see this, point to a safe address.
811 		 */
812 		if (sa->sa_len == 0) {
813 			static struct sockaddr sa_zero = {
814 				sizeof sa_zero, AF_INET,
815 			};
816 
817 			rtinfo->rti_info[i] = &sa_zero;
818 			kprintf("rtsock: received more addr bits than sockaddrs.\n");
819 			return (0); /* should be EINVAL but for compat */
820 		}
821 
822 		/* Accept the sockaddr. */
823 		rtinfo->rti_info[i] = sa;
824 		cp += RT_ROUNDUP(sa->sa_len);
825 	}
826 	return (0);
827 }
828 
829 static int
830 rt_msghdrsize(int type)
831 {
832 	switch (type) {
833 	case RTM_DELADDR:
834 	case RTM_NEWADDR:
835 		return sizeof(struct ifa_msghdr);
836 	case RTM_DELMADDR:
837 	case RTM_NEWMADDR:
838 		return sizeof(struct ifma_msghdr);
839 	case RTM_IFINFO:
840 		return sizeof(struct if_msghdr);
841 	case RTM_IFANNOUNCE:
842 	case RTM_IEEE80211:
843 		return sizeof(struct if_announcemsghdr);
844 	default:
845 		return sizeof(struct rt_msghdr);
846 	}
847 }
848 
849 static int
850 rt_msgsize(int type, const struct rt_addrinfo *rtinfo)
851 {
852 	int len, i;
853 
854 	len = rt_msghdrsize(type);
855 	for (i = 0; i < RTAX_MAX; i++) {
856 		if (rtinfo->rti_info[i] != NULL)
857 			len += RT_ROUNDUP(rtinfo->rti_info[i]->sa_len);
858 	}
859 	len = ALIGN(len);
860 	return len;
861 }
862 
863 /*
864  * Build a routing message in a buffer.
865  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
866  * to the end of the buffer after the message header.
867  *
868  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
869  * This side-effect can be avoided if we reorder the addrs bitmask field in all
870  * the route messages to line up so we can set it here instead of back in the
871  * calling routine.
872  */
873 static void
874 rt_msg_buffer(int type, struct rt_addrinfo *rtinfo, void *buf, int msglen)
875 {
876 	struct rt_msghdr *rtm;
877 	char *cp;
878 	int dlen, i;
879 
880 	rtm = (struct rt_msghdr *) buf;
881 	rtm->rtm_version = RTM_VERSION;
882 	rtm->rtm_type = type;
883 	rtm->rtm_msglen = msglen;
884 
885 	cp = (char *)buf + rt_msghdrsize(type);
886 	rtinfo->rti_addrs = 0;
887 	for (i = 0; i < RTAX_MAX; i++) {
888 		struct sockaddr *sa;
889 
890 		if ((sa = rtinfo->rti_info[i]) == NULL)
891 			continue;
892 		rtinfo->rti_addrs |= (1 << i);
893 		dlen = RT_ROUNDUP(sa->sa_len);
894 		bcopy(sa, cp, dlen);
895 		cp += dlen;
896 	}
897 }
898 
899 /*
900  * Build a routing message in a mbuf chain.
901  * Copy the addresses in the rtinfo->rti_info[] sockaddr array
902  * to the end of the mbuf after the message header.
903  *
904  * Set the rtinfo->rti_addrs bitmask of addresses present in rtinfo->rti_info[].
905  * This side-effect can be avoided if we reorder the addrs bitmask field in all
906  * the route messages to line up so we can set it here instead of back in the
907  * calling routine.
908  */
909 static struct mbuf *
910 rt_msg_mbuf(int type, struct rt_addrinfo *rtinfo)
911 {
912 	struct mbuf *m;
913 	struct rt_msghdr *rtm;
914 	int hlen, len;
915 	int i;
916 
917 	hlen = rt_msghdrsize(type);
918 	KASSERT(hlen <= MCLBYTES, ("rt_msg_mbuf: hlen %d doesn't fit", hlen));
919 
920 	m = m_getl(hlen, MB_DONTWAIT, MT_DATA, M_PKTHDR, NULL);
921 	if (m == NULL)
922 		return (NULL);
923 	mbuftrackid(m, 32);
924 	m->m_pkthdr.len = m->m_len = hlen;
925 	m->m_pkthdr.rcvif = NULL;
926 	rtinfo->rti_addrs = 0;
927 	len = hlen;
928 	for (i = 0; i < RTAX_MAX; i++) {
929 		struct sockaddr *sa;
930 		int dlen;
931 
932 		if ((sa = rtinfo->rti_info[i]) == NULL)
933 			continue;
934 		rtinfo->rti_addrs |= (1 << i);
935 		dlen = RT_ROUNDUP(sa->sa_len);
936 		m_copyback(m, len, dlen, (caddr_t)sa); /* can grow mbuf chain */
937 		len += dlen;
938 	}
939 	if (m->m_pkthdr.len != len) { /* one of the m_copyback() calls failed */
940 		m_freem(m);
941 		return (NULL);
942 	}
943 	rtm = mtod(m, struct rt_msghdr *);
944 	bzero(rtm, hlen);
945 	rtm->rtm_msglen = len;
946 	rtm->rtm_version = RTM_VERSION;
947 	rtm->rtm_type = type;
948 	return (m);
949 }
950 
951 /*
952  * This routine is called to generate a message from the routing
953  * socket indicating that a redirect has occurred, a routing lookup
954  * has failed, or that a protocol has detected timeouts to a particular
955  * destination.
956  */
957 void
958 rt_missmsg(int type, struct rt_addrinfo *rtinfo, int flags, int error)
959 {
960 	struct sockaddr *dst = rtinfo->rti_info[RTAX_DST];
961 	struct rt_msghdr *rtm;
962 	struct mbuf *m;
963 
964 	if (route_cb.any_count == 0)
965 		return;
966 	m = rt_msg_mbuf(type, rtinfo);
967 	if (m == NULL)
968 		return;
969 	rtm = mtod(m, struct rt_msghdr *);
970 	rtm->rtm_flags = RTF_DONE | flags;
971 	rtm->rtm_errno = error;
972 	rtm->rtm_addrs = rtinfo->rti_addrs;
973 	rts_input(m, familyof(dst));
974 }
975 
976 void
977 rt_dstmsg(int type, struct sockaddr *dst, int error)
978 {
979 	struct rt_msghdr *rtm;
980 	struct rt_addrinfo addrs;
981 	struct mbuf *m;
982 
983 	if (route_cb.any_count == 0)
984 		return;
985 	bzero(&addrs, sizeof(struct rt_addrinfo));
986 	addrs.rti_info[RTAX_DST] = dst;
987 	m = rt_msg_mbuf(type, &addrs);
988 	if (m == NULL)
989 		return;
990 	rtm = mtod(m, struct rt_msghdr *);
991 	rtm->rtm_flags = RTF_DONE;
992 	rtm->rtm_errno = error;
993 	rtm->rtm_addrs = addrs.rti_addrs;
994 	rts_input(m, familyof(dst));
995 }
996 
997 /*
998  * This routine is called to generate a message from the routing
999  * socket indicating that the status of a network interface has changed.
1000  */
1001 void
1002 rt_ifmsg(struct ifnet *ifp)
1003 {
1004 	struct if_msghdr *ifm;
1005 	struct mbuf *m;
1006 	struct rt_addrinfo rtinfo;
1007 
1008 	if (route_cb.any_count == 0)
1009 		return;
1010 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1011 	m = rt_msg_mbuf(RTM_IFINFO, &rtinfo);
1012 	if (m == NULL)
1013 		return;
1014 	ifm = mtod(m, struct if_msghdr *);
1015 	ifm->ifm_index = ifp->if_index;
1016 	ifm->ifm_flags = ifp->if_flags;
1017 	ifm->ifm_data = ifp->if_data;
1018 	ifm->ifm_addrs = 0;
1019 	rts_input(m, 0);
1020 }
1021 
1022 static void
1023 rt_ifamsg(int cmd, struct ifaddr *ifa)
1024 {
1025 	struct ifa_msghdr *ifam;
1026 	struct rt_addrinfo rtinfo;
1027 	struct mbuf *m;
1028 	struct ifnet *ifp = ifa->ifa_ifp;
1029 
1030 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1031 	rtinfo.rti_ifaaddr = ifa->ifa_addr;
1032 	rtinfo.rti_ifpaddr =
1033 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1034 	rtinfo.rti_netmask = ifa->ifa_netmask;
1035 	rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1036 
1037 	m = rt_msg_mbuf(cmd, &rtinfo);
1038 	if (m == NULL)
1039 		return;
1040 
1041 	ifam = mtod(m, struct ifa_msghdr *);
1042 	ifam->ifam_index = ifp->if_index;
1043 	ifam->ifam_metric = ifa->ifa_metric;
1044 	ifam->ifam_flags = ifa->ifa_flags;
1045 	ifam->ifam_addrs = rtinfo.rti_addrs;
1046 
1047 	rts_input(m, familyof(ifa->ifa_addr));
1048 }
1049 
1050 void
1051 rt_rtmsg(int cmd, struct rtentry *rt, struct ifnet *ifp, int error)
1052 {
1053 	struct rt_msghdr *rtm;
1054 	struct rt_addrinfo rtinfo;
1055 	struct mbuf *m;
1056 	struct sockaddr *dst;
1057 
1058 	if (rt == NULL)
1059 		return;
1060 
1061 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1062 	rtinfo.rti_dst = dst = rt_key(rt);
1063 	rtinfo.rti_gateway = rt->rt_gateway;
1064 	rtinfo.rti_netmask = rt_mask(rt);
1065 	if (ifp != NULL) {
1066 		rtinfo.rti_ifpaddr =
1067 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1068 	}
1069 	rtinfo.rti_ifaaddr = rt->rt_ifa->ifa_addr;
1070 
1071 	m = rt_msg_mbuf(cmd, &rtinfo);
1072 	if (m == NULL)
1073 		return;
1074 
1075 	rtm = mtod(m, struct rt_msghdr *);
1076 	if (ifp != NULL)
1077 		rtm->rtm_index = ifp->if_index;
1078 	rtm->rtm_flags |= rt->rt_flags;
1079 	rtm->rtm_errno = error;
1080 	rtm->rtm_addrs = rtinfo.rti_addrs;
1081 
1082 	rts_input(m, familyof(dst));
1083 }
1084 
1085 /*
1086  * This is called to generate messages from the routing socket
1087  * indicating a network interface has had addresses associated with it.
1088  * if we ever reverse the logic and replace messages TO the routing
1089  * socket indicate a request to configure interfaces, then it will
1090  * be unnecessary as the routing socket will automatically generate
1091  * copies of it.
1092  */
1093 void
1094 rt_newaddrmsg(int cmd, struct ifaddr *ifa, int error, struct rtentry *rt)
1095 {
1096 #ifdef SCTP
1097 	/*
1098 	 * notify the SCTP stack
1099 	 * this will only get called when an address is added/deleted
1100 	 * XXX pass the ifaddr struct instead if ifa->ifa_addr...
1101 	 */
1102 	if (cmd == RTM_ADD)
1103 		sctp_add_ip_address(ifa);
1104 	else if (cmd == RTM_DELETE)
1105 		sctp_delete_ip_address(ifa);
1106 #endif /* SCTP */
1107 
1108 	if (route_cb.any_count == 0)
1109 		return;
1110 
1111 	if (cmd == RTM_ADD) {
1112 		rt_ifamsg(RTM_NEWADDR, ifa);
1113 		rt_rtmsg(RTM_ADD, rt, ifa->ifa_ifp, error);
1114 	} else {
1115 		KASSERT((cmd == RTM_DELETE), ("unknown cmd %d", cmd));
1116 		rt_rtmsg(RTM_DELETE, rt, ifa->ifa_ifp, error);
1117 		rt_ifamsg(RTM_DELADDR, ifa);
1118 	}
1119 }
1120 
1121 /*
1122  * This is the analogue to the rt_newaddrmsg which performs the same
1123  * function but for multicast group memberhips.  This is easier since
1124  * there is no route state to worry about.
1125  */
1126 void
1127 rt_newmaddrmsg(int cmd, struct ifmultiaddr *ifma)
1128 {
1129 	struct rt_addrinfo rtinfo;
1130 	struct mbuf *m = NULL;
1131 	struct ifnet *ifp = ifma->ifma_ifp;
1132 	struct ifma_msghdr *ifmam;
1133 
1134 	if (route_cb.any_count == 0)
1135 		return;
1136 
1137 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1138 	rtinfo.rti_ifaaddr = ifma->ifma_addr;
1139 	if (ifp != NULL && !TAILQ_EMPTY(&ifp->if_addrheads[mycpuid])) {
1140 		rtinfo.rti_ifpaddr =
1141 		TAILQ_FIRST(&ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1142 	}
1143 	/*
1144 	 * If a link-layer address is present, present it as a ``gateway''
1145 	 * (similarly to how ARP entries, e.g., are presented).
1146 	 */
1147 	rtinfo.rti_gateway = ifma->ifma_lladdr;
1148 
1149 	m = rt_msg_mbuf(cmd, &rtinfo);
1150 	if (m == NULL)
1151 		return;
1152 
1153 	ifmam = mtod(m, struct ifma_msghdr *);
1154 	ifmam->ifmam_index = ifp->if_index;
1155 	ifmam->ifmam_addrs = rtinfo.rti_addrs;
1156 
1157 	rts_input(m, familyof(ifma->ifma_addr));
1158 }
1159 
1160 static struct mbuf *
1161 rt_makeifannouncemsg(struct ifnet *ifp, int type, int what,
1162 		     struct rt_addrinfo *info)
1163 {
1164 	struct if_announcemsghdr *ifan;
1165 	struct mbuf *m;
1166 
1167 	if (route_cb.any_count == 0)
1168 		return NULL;
1169 
1170 	bzero(info, sizeof(*info));
1171 	m = rt_msg_mbuf(type, info);
1172 	if (m == NULL)
1173 		return NULL;
1174 
1175 	ifan = mtod(m, struct if_announcemsghdr *);
1176 	ifan->ifan_index = ifp->if_index;
1177 	strlcpy(ifan->ifan_name, ifp->if_xname, sizeof ifan->ifan_name);
1178 	ifan->ifan_what = what;
1179 	return m;
1180 }
1181 
1182 /*
1183  * This is called to generate routing socket messages indicating
1184  * IEEE80211 wireless events.
1185  * XXX we piggyback on the RTM_IFANNOUNCE msg format in a clumsy way.
1186  */
1187 void
1188 rt_ieee80211msg(struct ifnet *ifp, int what, void *data, size_t data_len)
1189 {
1190 	struct rt_addrinfo info;
1191 	struct mbuf *m;
1192 
1193 	m = rt_makeifannouncemsg(ifp, RTM_IEEE80211, what, &info);
1194 	if (m == NULL)
1195 		return;
1196 
1197 	/*
1198 	 * Append the ieee80211 data.  Try to stick it in the
1199 	 * mbuf containing the ifannounce msg; otherwise allocate
1200 	 * a new mbuf and append.
1201 	 *
1202 	 * NB: we assume m is a single mbuf.
1203 	 */
1204 	if (data_len > M_TRAILINGSPACE(m)) {
1205 		/* XXX use m_getb(data_len, MB_DONTWAIT, MT_DATA, 0); */
1206 		struct mbuf *n = m_get(MB_DONTWAIT, MT_DATA);
1207 		if (n == NULL) {
1208 			m_freem(m);
1209 			return;
1210 		}
1211 		KKASSERT(data_len <= M_TRAILINGSPACE(n));
1212 		bcopy(data, mtod(n, void *), data_len);
1213 		n->m_len = data_len;
1214 		m->m_next = n;
1215 	} else if (data_len > 0) {
1216 		bcopy(data, mtod(m, u_int8_t *) + m->m_len, data_len);
1217 		m->m_len += data_len;
1218 	}
1219 	mbuftrackid(m, 33);
1220 	if (m->m_flags & M_PKTHDR)
1221 		m->m_pkthdr.len += data_len;
1222 	mtod(m, struct if_announcemsghdr *)->ifan_msglen += data_len;
1223 	rts_input(m, 0);
1224 }
1225 
1226 /*
1227  * This is called to generate routing socket messages indicating
1228  * network interface arrival and departure.
1229  */
1230 void
1231 rt_ifannouncemsg(struct ifnet *ifp, int what)
1232 {
1233 	struct rt_addrinfo addrinfo;
1234 	struct mbuf *m;
1235 
1236 	m = rt_makeifannouncemsg(ifp, RTM_IFANNOUNCE, what, &addrinfo);
1237 	if (m != NULL)
1238 		rts_input(m, 0);
1239 }
1240 
1241 static int
1242 resizewalkarg(struct walkarg *w, int len)
1243 {
1244 	void *newptr;
1245 
1246 	newptr = kmalloc(len, M_RTABLE, M_INTWAIT | M_NULLOK);
1247 	if (newptr == NULL)
1248 		return (ENOMEM);
1249 	if (w->w_tmem != NULL)
1250 		kfree(w->w_tmem, M_RTABLE);
1251 	w->w_tmem = newptr;
1252 	w->w_tmemsize = len;
1253 	return (0);
1254 }
1255 
1256 /*
1257  * This is used in dumping the kernel table via sysctl().
1258  */
1259 int
1260 sysctl_dumpentry(struct radix_node *rn, void *vw)
1261 {
1262 	struct walkarg *w = vw;
1263 	struct rtentry *rt = (struct rtentry *)rn;
1264 	struct rt_addrinfo rtinfo;
1265 	int error, msglen;
1266 
1267 	if (w->w_op == NET_RT_FLAGS && !(rt->rt_flags & w->w_arg))
1268 		return 0;
1269 
1270 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1271 	rtinfo.rti_dst = rt_key(rt);
1272 	rtinfo.rti_gateway = rt->rt_gateway;
1273 	rtinfo.rti_netmask = rt_mask(rt);
1274 	rtinfo.rti_genmask = rt->rt_genmask;
1275 	if (rt->rt_ifp != NULL) {
1276 		rtinfo.rti_ifpaddr =
1277 		TAILQ_FIRST(&rt->rt_ifp->if_addrheads[mycpuid])->ifa->ifa_addr;
1278 		rtinfo.rti_ifaaddr = rt->rt_ifa->ifa_addr;
1279 		if (rt->rt_ifp->if_flags & IFF_POINTOPOINT)
1280 			rtinfo.rti_bcastaddr = rt->rt_ifa->ifa_dstaddr;
1281 	}
1282 	msglen = rt_msgsize(RTM_GET, &rtinfo);
1283 	if (w->w_tmemsize < msglen && resizewalkarg(w, msglen) != 0)
1284 		return (ENOMEM);
1285 	rt_msg_buffer(RTM_GET, &rtinfo, w->w_tmem, msglen);
1286 	if (w->w_req != NULL) {
1287 		struct rt_msghdr *rtm = w->w_tmem;
1288 
1289 		rtm->rtm_flags = rt->rt_flags;
1290 		rtm->rtm_use = rt->rt_use;
1291 		rtm->rtm_rmx = rt->rt_rmx;
1292 		rtm->rtm_index = rt->rt_ifp->if_index;
1293 		rtm->rtm_errno = rtm->rtm_pid = rtm->rtm_seq = 0;
1294 		rtm->rtm_addrs = rtinfo.rti_addrs;
1295 		error = SYSCTL_OUT(w->w_req, rtm, msglen);
1296 		return (error);
1297 	}
1298 	return (0);
1299 }
1300 
1301 static void
1302 ifnet_compute_stats(struct ifnet *ifp)
1303 {
1304 	IFNET_STAT_GET(ifp, ipackets, ifp->if_ipackets);
1305 	IFNET_STAT_GET(ifp, ierrors, ifp->if_ierrors);
1306 	IFNET_STAT_GET(ifp, opackets, ifp->if_opackets);
1307 	IFNET_STAT_GET(ifp, collisions, ifp->if_collisions);
1308 	IFNET_STAT_GET(ifp, ibytes, ifp->if_ibytes);
1309 	IFNET_STAT_GET(ifp, obytes, ifp->if_obytes);
1310 	IFNET_STAT_GET(ifp, imcasts, ifp->if_imcasts);
1311 	IFNET_STAT_GET(ifp, omcasts, ifp->if_omcasts);
1312 	IFNET_STAT_GET(ifp, iqdrops, ifp->if_iqdrops);
1313 	IFNET_STAT_GET(ifp, noproto, ifp->if_noproto);
1314 }
1315 
1316 static int
1317 sysctl_iflist(int af, struct walkarg *w)
1318 {
1319 	struct ifnet *ifp;
1320 	struct rt_addrinfo rtinfo;
1321 	int msglen, error;
1322 
1323 	bzero(&rtinfo, sizeof(struct rt_addrinfo));
1324 	TAILQ_FOREACH(ifp, &ifnet, if_link) {
1325 		struct ifaddr_container *ifac;
1326 		struct ifaddr *ifa;
1327 
1328 		if (w->w_arg && w->w_arg != ifp->if_index)
1329 			continue;
1330 		ifac = TAILQ_FIRST(&ifp->if_addrheads[mycpuid]);
1331 		ifa = ifac->ifa;
1332 		rtinfo.rti_ifpaddr = ifa->ifa_addr;
1333 		msglen = rt_msgsize(RTM_IFINFO, &rtinfo);
1334 		if (w->w_tmemsize < msglen && resizewalkarg(w, msglen) != 0)
1335 			return (ENOMEM);
1336 		rt_msg_buffer(RTM_IFINFO, &rtinfo, w->w_tmem, msglen);
1337 		rtinfo.rti_ifpaddr = NULL;
1338 		if (w->w_req != NULL && w->w_tmem != NULL) {
1339 			struct if_msghdr *ifm = w->w_tmem;
1340 
1341 			ifm->ifm_index = ifp->if_index;
1342 			ifm->ifm_flags = ifp->if_flags;
1343 			ifnet_compute_stats(ifp);
1344 			ifm->ifm_data = ifp->if_data;
1345 			ifm->ifm_addrs = rtinfo.rti_addrs;
1346 			error = SYSCTL_OUT(w->w_req, ifm, msglen);
1347 			if (error)
1348 				return (error);
1349 		}
1350 		while ((ifac = TAILQ_NEXT(ifac, ifa_link)) != NULL) {
1351 			ifa = ifac->ifa;
1352 
1353 			if (af && af != ifa->ifa_addr->sa_family)
1354 				continue;
1355 			if (curproc->p_ucred->cr_prison &&
1356 			    prison_if(curproc->p_ucred, ifa->ifa_addr))
1357 				continue;
1358 			rtinfo.rti_ifaaddr = ifa->ifa_addr;
1359 			rtinfo.rti_netmask = ifa->ifa_netmask;
1360 			rtinfo.rti_bcastaddr = ifa->ifa_dstaddr;
1361 			msglen = rt_msgsize(RTM_NEWADDR, &rtinfo);
1362 			if (w->w_tmemsize < msglen &&
1363 			    resizewalkarg(w, msglen) != 0)
1364 				return (ENOMEM);
1365 			rt_msg_buffer(RTM_NEWADDR, &rtinfo, w->w_tmem, msglen);
1366 			if (w->w_req != NULL) {
1367 				struct ifa_msghdr *ifam = w->w_tmem;
1368 
1369 				ifam->ifam_index = ifa->ifa_ifp->if_index;
1370 				ifam->ifam_flags = ifa->ifa_flags;
1371 				ifam->ifam_metric = ifa->ifa_metric;
1372 				ifam->ifam_addrs = rtinfo.rti_addrs;
1373 				error = SYSCTL_OUT(w->w_req, w->w_tmem, msglen);
1374 				if (error)
1375 					return (error);
1376 			}
1377 		}
1378 		rtinfo.rti_netmask = NULL;
1379 		rtinfo.rti_ifaaddr = NULL;
1380 		rtinfo.rti_bcastaddr = NULL;
1381 	}
1382 	return (0);
1383 }
1384 
1385 static int
1386 sysctl_rttable(int af, struct sysctl_req *req, int op, int arg)
1387 {
1388 	struct walkarg w;
1389 	int i, error = EINVAL;
1390 
1391 	bzero(&w, sizeof(w));
1392 	w.w_op = op;
1393 	w.w_arg = arg;
1394 	w.w_req = req;
1395 
1396 	for (i = 1; i <= AF_MAX; i++) {
1397 		struct radix_node_head *rnh;
1398 
1399 		if ((rnh = rt_tables[mycpuid][i]) && (af == 0 || af == i) &&
1400 		    (error = rnh->rnh_walktree(rnh, sysctl_dumpentry, &w)))
1401 			break;
1402 	}
1403 
1404 	if (w.w_tmem != NULL)
1405 		kfree(w.w_tmem, M_RTABLE);
1406 
1407 	return error;
1408 }
1409 
1410 static int
1411 sysctl_rtsock(SYSCTL_HANDLER_ARGS)
1412 {
1413 	int	*name = (int *)arg1;
1414 	u_int	namelen = arg2;
1415 	int	error = EINVAL;
1416 	int	origcpu;
1417 	u_char  af;
1418 	struct	walkarg w;
1419 
1420 	name ++;
1421 	namelen--;
1422 	if (req->newptr)
1423 		return (EPERM);
1424 	if (namelen != 3 && namelen != 4)
1425 		return (EINVAL);
1426 	af = name[0];
1427 	bzero(&w, sizeof w);
1428 	w.w_op = name[1];
1429 	w.w_arg = name[2];
1430 	w.w_req = req;
1431 
1432 	/*
1433 	 * Optional third argument specifies cpu, used primarily for
1434 	 * debugging the route table.
1435 	 */
1436 	if (namelen == 4) {
1437 		if (name[3] < 0 || name[3] >= ncpus)
1438 			return (EINVAL);
1439 		origcpu = mycpuid;
1440 		lwkt_migratecpu(name[3]);
1441 	} else {
1442 		origcpu = -1;
1443 	}
1444 
1445 	switch (w.w_op) {
1446 	case NET_RT_DUMP:
1447 	case NET_RT_FLAGS:
1448 		error = sysctl_rttable(af, w.w_req, w.w_op, w.w_arg);
1449 		break;
1450 
1451 	case NET_RT_IFLIST:
1452 		error = sysctl_iflist(af, &w);
1453 		break;
1454 	}
1455 	if (w.w_tmem != NULL)
1456 		kfree(w.w_tmem, M_RTABLE);
1457 
1458 	if (origcpu >= 0)
1459 		lwkt_migratecpu(origcpu);
1460 	return (error);
1461 }
1462 
1463 SYSCTL_NODE(_net, PF_ROUTE, routetable, CTLFLAG_RD, sysctl_rtsock, "");
1464 
1465 /*
1466  * Definitions of protocols supported in the ROUTE domain.
1467  */
1468 
1469 static struct domain routedomain;		/* or at least forward */
1470 
1471 static struct protosw routesw[] = {
1472     {
1473 	.pr_type = SOCK_RAW,
1474 	.pr_domain = &routedomain,
1475 	.pr_protocol = 0,
1476 	.pr_flags = PR_ATOMIC|PR_ADDR,
1477 	.pr_input = NULL,
1478 	.pr_output = route_output,
1479 	.pr_ctlinput = raw_ctlinput,
1480 	.pr_ctloutput = NULL,
1481 	.pr_ctlport = cpu0_ctlport,
1482 
1483 	.pr_init = raw_init,
1484 	.pr_usrreqs = &route_usrreqs
1485     }
1486 };
1487 
1488 static struct domain routedomain = {
1489 	PF_ROUTE, "route", NULL, NULL, NULL,
1490 	routesw, &routesw[(sizeof routesw)/(sizeof routesw[0])],
1491 };
1492 
1493 DOMAIN_SET(route);
1494 
1495