xref: /netbsd-src/sys/net/rtsock_shared.c (revision 7330f729ccf0bd976a06f95fad452fe774fc7fd1)
1 /*	$NetBSD: rtsock_shared.c,v 1.11 2019/10/14 16:43:04 maxv Exp $	*/
2 
3 /*
4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the project nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 /*
33  * Copyright (c) 1988, 1991, 1993
34  *	The Regents of the University of California.  All rights reserved.
35  *
36  * Redistribution and use in source and binary forms, with or without
37  * modification, are permitted provided that the following conditions
38  * are met:
39  * 1. Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  * 2. Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in the
43  *    documentation and/or other materials provided with the distribution.
44  * 3. Neither the name of the University nor the names of its contributors
45  *    may be used to endorse or promote products derived from this software
46  *    without specific prior written permission.
47  *
48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58  * SUCH DAMAGE.
59  *
60  *	@(#)rtsock.c	8.7 (Berkeley) 10/12/95
61  */
62 
63 #include <sys/cdefs.h>
64 __KERNEL_RCSID(0, "$NetBSD: rtsock_shared.c,v 1.11 2019/10/14 16:43:04 maxv Exp $");
65 
66 #ifdef _KERNEL_OPT
67 #include "opt_inet.h"
68 #include "opt_net_mpsafe.h"
69 #endif
70 
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/proc.h>
74 #include <sys/socket.h>
75 #include <sys/socketvar.h>
76 #include <sys/domain.h>
77 #include <sys/protosw.h>
78 #include <sys/sysctl.h>
79 #include <sys/kauth.h>
80 #include <sys/kmem.h>
81 #include <sys/intr.h>
82 #include <sys/condvar.h>
83 #include <sys/compat_stub.h>
84 
85 #include <net/if.h>
86 #include <net/if_llatbl.h>
87 #include <net/if_types.h>
88 #include <net/route.h>
89 #include <net/raw_cb.h>
90 
91 #include <netinet/in_var.h>
92 #include <netinet/if_inarp.h>
93 
94 #include <netmpls/mpls.h>
95 
96 #include <compat/net/if.h>
97 #include <compat/net/route.h>
98 
99 #ifdef COMPAT_RTSOCK
100 /*
101  * These are used when #include-d from compat/common/rtsock_50.c
102  */
103 #define	RTM_XVERSION	RTM_OVERSION
104 #define	RTM_XNEWADDR	RTM_ONEWADDR
105 #define	RTM_XDELADDR	RTM_ODELADDR
106 #define	RTM_XCHGADDR	RTM_OCHGADDR
107 #define	RT_XADVANCE(a,b) RT_OADVANCE(a,b)
108 #define	RT_XROUNDUP(n)	RT_OROUNDUP(n)
109 #define	PF_XROUTE	PF_OROUTE
110 #define	rt_xmsghdr	rt_msghdr50
111 #define	if_xmsghdr	if_msghdr	/* if_msghdr50 is for RTM_OIFINFO */
112 #define	ifa_xmsghdr	ifa_msghdr50
113 #define	if_xannouncemsghdr	if_announcemsghdr50
114 #define	COMPATNAME(x)	compat_50_ ## x
115 #define	DOMAINNAME	"oroute"
116 #define	COMPATCALL(name, args)		\
117 	MODULE_HOOK_CALL_VOID(rtsock_ ## name ## _50_hook, args, __nothing);
118 #define	RTS_CTASSERT(x)	__nothing
119 CTASSERT(sizeof(struct ifa_xmsghdr) == 20);
120 DOMAIN_DEFINE(compat_50_routedomain); /* forward declare and add to link set */
121 #else /* COMPAT_RTSOCK */
122 /*
123  * These are used when #include-d from compat/common/rtsock_50.c
124  */
125 #define	RTM_XVERSION	RTM_VERSION
126 #define	RTM_XNEWADDR	RTM_NEWADDR
127 #define	RTM_XDELADDR	RTM_DELADDR
128 #define	RTM_XCHGADDR	RTM_CHGADDR
129 #define	RT_XADVANCE(a,b) RT_ADVANCE(a,b)
130 #define	RT_XROUNDUP(n)	RT_ROUNDUP(n)
131 #define	PF_XROUTE	PF_ROUTE
132 #define	rt_xmsghdr	rt_msghdr
133 #define	if_xmsghdr	if_msghdr
134 #define	ifa_xmsghdr	ifa_msghdr
135 #define	if_xannouncemsghdr	if_announcemsghdr
136 #define	COMPATNAME(x)	x
137 #define	DOMAINNAME	"route"
138 #define	COMPATCALL(name, args)	__nothing;
139 #define	RTS_CTASSERT(x)	CTASSERT(x)
140 CTASSERT(sizeof(struct ifa_xmsghdr) == 32);
141 DOMAIN_DEFINE(routedomain); /* forward declare and add to link set */
142 #endif /* COMPAT_RTSOCK */
143 
144 #ifdef RTSOCK_DEBUG
145 #define RT_IN_PRINT(info, b, a) (in_print((b), sizeof(b), \
146     &((const struct sockaddr_in *)(info)->rti_info[(a)])->sin_addr), (b))
147 #endif /* RTSOCK_DEBUG */
148 
149 struct route_info COMPATNAME(route_info) = {
150 	.ri_dst = { .sa_len = 2, .sa_family = PF_XROUTE, },
151 	.ri_src = { .sa_len = 2, .sa_family = PF_XROUTE, },
152 	.ri_maxqlen = IFQ_MAXLEN,
153 };
154 
155 static void COMPATNAME(route_init)(void);
156 static int COMPATNAME(route_output)(struct mbuf *, struct socket *);
157 
158 static int rt_xaddrs(u_char, const char *, const char *, struct rt_addrinfo *);
159 static struct mbuf *rt_makeifannouncemsg(struct ifnet *, int, int,
160     struct rt_addrinfo *);
161 static int rt_msg2(int, struct rt_addrinfo *, void *, struct rt_walkarg *, int *);
162 static void _rt_setmetrics(int, const struct rt_xmsghdr *, struct rtentry *);
163 static void rtm_setmetrics(const struct rtentry *, struct rt_xmsghdr *);
164 static void rt_adjustcount(int, int);
165 
166 static const struct protosw COMPATNAME(route_protosw)[];
167 
168 struct routecb {
169 	struct rawcb	rocb_rcb;
170 	unsigned int	rocb_msgfilter;
171 #define	RTMSGFILTER(m)	(1U << (m))
172 };
173 #define sotoroutecb(so)	((struct routecb *)(so)->so_pcb)
174 
175 static struct rawcbhead rt_rawcb;
176 #ifdef NET_MPSAFE
177 static kmutex_t *rt_so_mtx;
178 
179 static bool rt_updating = false;
180 static kcondvar_t rt_update_cv;
181 #endif
182 
183 static void
184 rt_adjustcount(int af, int cnt)
185 {
186 	struct route_cb * const cb = &COMPATNAME(route_info).ri_cb;
187 
188 	cb->any_count += cnt;
189 
190 	switch (af) {
191 	case AF_INET:
192 		cb->ip_count += cnt;
193 		return;
194 #ifdef INET6
195 	case AF_INET6:
196 		cb->ip6_count += cnt;
197 		return;
198 #endif
199 	case AF_MPLS:
200 		cb->mpls_count += cnt;
201 		return;
202 	}
203 }
204 
205 static int
206 COMPATNAME(route_filter)(struct mbuf *m, struct sockproto *proto,
207     struct rawcb *rp)
208 {
209 	struct routecb *rop = (struct routecb *)rp;
210 	struct rt_xmsghdr *rtm;
211 
212 	KASSERT(m != NULL);
213 	KASSERT(proto != NULL);
214 	KASSERT(rp != NULL);
215 
216 	/* Wrong family for this socket. */
217 	if (proto->sp_family != PF_ROUTE)
218 		return ENOPROTOOPT;
219 
220 	/* If no filter set, just return. */
221 	if (rop->rocb_msgfilter == 0)
222 		return 0;
223 
224 	/* Ensure we can access rtm_type */
225 	if (m->m_len <
226 	    offsetof(struct rt_xmsghdr, rtm_type) + sizeof(rtm->rtm_type))
227 		return EINVAL;
228 
229 	rtm = mtod(m, struct rt_xmsghdr *);
230 	if (rtm->rtm_type >= sizeof(rop->rocb_msgfilter) * CHAR_BIT)
231 		return EINVAL;
232 	/* If the rtm type is filtered out, return a positive. */
233 	if (!(rop->rocb_msgfilter & RTMSGFILTER(rtm->rtm_type)))
234 		return EEXIST;
235 
236 	/* Passed the filter. */
237 	return 0;
238 }
239 
240 static void
241 rt_pr_init(void)
242 {
243 
244 	LIST_INIT(&rt_rawcb);
245 }
246 
247 static int
248 COMPATNAME(route_attach)(struct socket *so, int proto)
249 {
250 	struct rawcb *rp;
251 	struct routecb *rop;
252 	int s, error;
253 
254 	KASSERT(sotorawcb(so) == NULL);
255 	rop = kmem_zalloc(sizeof(*rop), KM_SLEEP);
256 	rp = &rop->rocb_rcb;
257 	rp->rcb_len = sizeof(*rop);
258 	so->so_pcb = rp;
259 
260 	s = splsoftnet();
261 
262 #ifdef NET_MPSAFE
263 	KASSERT(so->so_lock == NULL);
264 	mutex_obj_hold(rt_so_mtx);
265 	so->so_lock = rt_so_mtx;
266 	solock(so);
267 #endif
268 
269 	if ((error = raw_attach(so, proto, &rt_rawcb)) == 0) {
270 		rt_adjustcount(rp->rcb_proto.sp_protocol, 1);
271 		rp->rcb_laddr = &COMPATNAME(route_info).ri_src;
272 		rp->rcb_faddr = &COMPATNAME(route_info).ri_dst;
273 		rp->rcb_filter = COMPATNAME(route_filter);
274 	}
275 	splx(s);
276 
277 	if (error) {
278 		kmem_free(rop, sizeof(*rop));
279 		so->so_pcb = NULL;
280 		return error;
281 	}
282 
283 	soisconnected(so);
284 	so->so_options |= SO_USELOOPBACK;
285 	KASSERT(solocked(so));
286 
287 	return error;
288 }
289 
290 static void
291 COMPATNAME(route_detach)(struct socket *so)
292 {
293 	struct rawcb *rp = sotorawcb(so);
294 	int s;
295 
296 	KASSERT(rp != NULL);
297 	KASSERT(solocked(so));
298 
299 	s = splsoftnet();
300 	rt_adjustcount(rp->rcb_proto.sp_protocol, -1);
301 	raw_detach(so);
302 	splx(s);
303 }
304 
305 static int
306 COMPATNAME(route_accept)(struct socket *so, struct sockaddr *nam)
307 {
308 	KASSERT(solocked(so));
309 
310 	panic("route_accept");
311 
312 	return EOPNOTSUPP;
313 }
314 
315 static int
316 COMPATNAME(route_bind)(struct socket *so, struct sockaddr *nam, struct lwp *l)
317 {
318 	KASSERT(solocked(so));
319 
320 	return EOPNOTSUPP;
321 }
322 
323 static int
324 COMPATNAME(route_listen)(struct socket *so, struct lwp *l)
325 {
326 	KASSERT(solocked(so));
327 
328 	return EOPNOTSUPP;
329 }
330 
331 static int
332 COMPATNAME(route_connect)(struct socket *so, struct sockaddr *nam, struct lwp *l)
333 {
334 	KASSERT(solocked(so));
335 
336 	return EOPNOTSUPP;
337 }
338 
339 static int
340 COMPATNAME(route_connect2)(struct socket *so, struct socket *so2)
341 {
342 	KASSERT(solocked(so));
343 
344 	return EOPNOTSUPP;
345 }
346 
347 static int
348 COMPATNAME(route_disconnect)(struct socket *so)
349 {
350 	struct rawcb *rp = sotorawcb(so);
351 	int s;
352 
353 	KASSERT(solocked(so));
354 	KASSERT(rp != NULL);
355 
356 	s = splsoftnet();
357 	soisdisconnected(so);
358 	raw_disconnect(rp);
359 	splx(s);
360 
361 	return 0;
362 }
363 
364 static int
365 COMPATNAME(route_shutdown)(struct socket *so)
366 {
367 	int s;
368 
369 	KASSERT(solocked(so));
370 
371 	/*
372 	 * Mark the connection as being incapable of further input.
373 	 */
374 	s = splsoftnet();
375 	socantsendmore(so);
376 	splx(s);
377 	return 0;
378 }
379 
380 static int
381 COMPATNAME(route_abort)(struct socket *so)
382 {
383 	KASSERT(solocked(so));
384 
385 	panic("route_abort");
386 
387 	return EOPNOTSUPP;
388 }
389 
390 static int
391 COMPATNAME(route_ioctl)(struct socket *so, u_long cmd, void *nam,
392     struct ifnet * ifp)
393 {
394 	return EOPNOTSUPP;
395 }
396 
397 static int
398 COMPATNAME(route_stat)(struct socket *so, struct stat *ub)
399 {
400 	KASSERT(solocked(so));
401 
402 	return 0;
403 }
404 
405 static int
406 COMPATNAME(route_peeraddr)(struct socket *so, struct sockaddr *nam)
407 {
408 	struct rawcb *rp = sotorawcb(so);
409 
410 	KASSERT(solocked(so));
411 	KASSERT(rp != NULL);
412 	KASSERT(nam != NULL);
413 
414 	if (rp->rcb_faddr == NULL)
415 		return ENOTCONN;
416 
417 	raw_setpeeraddr(rp, nam);
418 	return 0;
419 }
420 
421 static int
422 COMPATNAME(route_sockaddr)(struct socket *so, struct sockaddr *nam)
423 {
424 	struct rawcb *rp = sotorawcb(so);
425 
426 	KASSERT(solocked(so));
427 	KASSERT(rp != NULL);
428 	KASSERT(nam != NULL);
429 
430 	if (rp->rcb_faddr == NULL)
431 		return ENOTCONN;
432 
433 	raw_setsockaddr(rp, nam);
434 	return 0;
435 }
436 
437 static int
438 COMPATNAME(route_rcvd)(struct socket *so, int flags, struct lwp *l)
439 {
440 	KASSERT(solocked(so));
441 
442 	return EOPNOTSUPP;
443 }
444 
445 static int
446 COMPATNAME(route_recvoob)(struct socket *so, struct mbuf *m, int flags)
447 {
448 	KASSERT(solocked(so));
449 
450 	return EOPNOTSUPP;
451 }
452 
453 static int
454 COMPATNAME(route_send)(struct socket *so, struct mbuf *m,
455     struct sockaddr *nam, struct mbuf *control, struct lwp *l)
456 {
457 	int error = 0;
458 	int s;
459 
460 	KASSERT(solocked(so));
461 	KASSERT(so->so_proto == &COMPATNAME(route_protosw)[0]);
462 
463 	s = splsoftnet();
464 	error = raw_send(so, m, nam, control, l, &COMPATNAME(route_output));
465 	splx(s);
466 
467 	return error;
468 }
469 
470 static int
471 COMPATNAME(route_sendoob)(struct socket *so, struct mbuf *m,
472     struct mbuf *control)
473 {
474 	KASSERT(solocked(so));
475 
476 	m_freem(m);
477 	m_freem(control);
478 
479 	return EOPNOTSUPP;
480 }
481 static int
482 COMPATNAME(route_purgeif)(struct socket *so, struct ifnet *ifp)
483 {
484 
485 	panic("route_purgeif");
486 
487 	return EOPNOTSUPP;
488 }
489 
490 #if defined(INET) || defined(INET6)
491 static int
492 route_get_sdl_index(struct rt_addrinfo *info, int *sdl_index)
493 {
494 	struct rtentry *nrt;
495 	int error;
496 
497 	error = rtrequest1(RTM_GET, info, &nrt);
498 	if (error != 0)
499 		return error;
500 	/*
501 	 * nrt->rt_ifp->if_index may not be correct
502 	 * due to changing to ifplo0.
503 	 */
504 	*sdl_index = satosdl(nrt->rt_gateway)->sdl_index;
505 	rt_unref(nrt);
506 
507 	return 0;
508 }
509 #endif
510 
511 static void
512 route_get_sdl(const struct ifnet *ifp, const struct sockaddr *dst,
513     struct sockaddr_dl *sdl, int *flags)
514 {
515 	struct llentry *la;
516 
517 	KASSERT(ifp != NULL);
518 
519 	IF_AFDATA_RLOCK(ifp);
520 	switch (dst->sa_family) {
521 	case AF_INET:
522 		la = lla_lookup(LLTABLE(ifp), 0, dst);
523 		break;
524 	case AF_INET6:
525 		la = lla_lookup(LLTABLE6(ifp), 0, dst);
526 		break;
527 	default:
528 		la = NULL;
529 		KASSERTMSG(0, "Invalid AF=%d\n", dst->sa_family);
530 		break;
531 	}
532 	IF_AFDATA_RUNLOCK(ifp);
533 
534 	void *a = (LLE_IS_VALID(la) && (la->la_flags & LLE_VALID) == LLE_VALID)
535 	    ? &la->ll_addr : NULL;
536 
537 	a = sockaddr_dl_init(sdl, sizeof(*sdl), ifp->if_index, ifp->if_type,
538 	    NULL, 0, a, ifp->if_addrlen);
539 	KASSERT(a != NULL);
540 
541 	if (la != NULL) {
542 		*flags = la->la_flags;
543 		LLE_RUNLOCK(la);
544 	}
545 }
546 
547 static int
548 route_output_report(struct rtentry *rt, struct rt_addrinfo *info,
549     struct rt_xmsghdr *rtm, struct rt_xmsghdr **new_rtm)
550 {
551 	int len, error;
552 
553 	if (rtm->rtm_addrs & (RTA_IFP | RTA_IFA)) {
554 		const struct ifaddr *rtifa;
555 		const struct ifnet *ifp = rt->rt_ifp;
556 
557 		info->rti_info[RTAX_IFP] = ifp->if_dl->ifa_addr;
558 		/* rtifa used to be simply rt->rt_ifa.
559 		 * If rt->rt_ifa != NULL, then
560 		 * rt_get_ifa() != NULL.  So this
561 		 * ought to still be safe. --dyoung
562 		 */
563 		rtifa = rt_get_ifa(rt);
564 		info->rti_info[RTAX_IFA] = rtifa->ifa_addr;
565 #ifdef RTSOCK_DEBUG
566 		if (info->rti_info[RTAX_IFA]->sa_family == AF_INET) {
567 			char ibuf[INET_ADDRSTRLEN];
568 			char abuf[INET_ADDRSTRLEN];
569 			printf("%s: copying out RTAX_IFA %s "
570 			    "for info->rti_info[RTAX_DST] %s "
571 			    "ifa_getifa %p ifa_seqno %p\n",
572 			    __func__,
573 			    RT_IN_PRINT(info, ibuf, RTAX_IFA),
574 			    RT_IN_PRINT(info, abuf, RTAX_DST),
575 			    (void *)rtifa->ifa_getifa,
576 			    rtifa->ifa_seqno);
577 		}
578 #endif /* RTSOCK_DEBUG */
579 		if (ifp->if_flags & IFF_POINTOPOINT)
580 			info->rti_info[RTAX_BRD] = rtifa->ifa_dstaddr;
581 		else
582 			info->rti_info[RTAX_BRD] = NULL;
583 		rtm->rtm_index = ifp->if_index;
584 	}
585 	error = rt_msg2(rtm->rtm_type, info, NULL, NULL, &len);
586 	if (error)
587 		return error;
588 	if (len > rtm->rtm_msglen) {
589 		struct rt_xmsghdr *old_rtm = rtm;
590 		R_Malloc(*new_rtm, struct rt_xmsghdr *, len);
591 		if (*new_rtm == NULL)
592 			return ENOBUFS;
593 		(void)memcpy(*new_rtm, old_rtm, old_rtm->rtm_msglen);
594 		rtm = *new_rtm;
595 	}
596 	(void)rt_msg2(rtm->rtm_type, info, rtm, NULL, 0);
597 	rtm->rtm_flags = rt->rt_flags;
598 	rtm_setmetrics(rt, rtm);
599 	rtm->rtm_addrs = info->rti_addrs;
600 
601 	return 0;
602 }
603 
604 /*ARGSUSED*/
605 int
606 COMPATNAME(route_output)(struct mbuf *m, struct socket *so)
607 {
608 	struct sockproto proto = { .sp_family = PF_XROUTE, };
609 	struct rt_xmsghdr *rtm = NULL;
610 	struct rt_xmsghdr *old_rtm = NULL, *new_rtm = NULL;
611 	struct rtentry *rt = NULL;
612 	struct rtentry *saved_nrt = NULL;
613 	struct rt_addrinfo info;
614 	int len, error = 0;
615 	sa_family_t family;
616 	struct sockaddr_dl sdl;
617 	int bound = curlwp_bind();
618 	bool do_rt_free = false;
619 	struct sockaddr_storage netmask;
620 
621 #define senderr(e) do { error = e; goto flush;} while (/*CONSTCOND*/ 0)
622 	if (m == NULL || ((m->m_len < sizeof(int32_t)) &&
623 	   (m = m_pullup(m, sizeof(int32_t))) == NULL)) {
624 		error = ENOBUFS;
625 		goto out;
626 	}
627 	if ((m->m_flags & M_PKTHDR) == 0)
628 		panic("%s", __func__);
629 	len = m->m_pkthdr.len;
630 	if (len < sizeof(*rtm) ||
631 	    len != mtod(m, struct rt_xmsghdr *)->rtm_msglen) {
632 		info.rti_info[RTAX_DST] = NULL;
633 		senderr(EINVAL);
634 	}
635 	R_Malloc(rtm, struct rt_xmsghdr *, len);
636 	if (rtm == NULL) {
637 		info.rti_info[RTAX_DST] = NULL;
638 		senderr(ENOBUFS);
639 	}
640 	m_copydata(m, 0, len, rtm);
641 	if (rtm->rtm_version != RTM_XVERSION) {
642 		info.rti_info[RTAX_DST] = NULL;
643 		senderr(EPROTONOSUPPORT);
644 	}
645 	rtm->rtm_pid = curproc->p_pid;
646 	memset(&info, 0, sizeof(info));
647 	info.rti_addrs = rtm->rtm_addrs;
648 	if (rt_xaddrs(rtm->rtm_type, (const char *)(rtm + 1), len + (char *)rtm,
649 	    &info)) {
650 		senderr(EINVAL);
651 	}
652 	info.rti_flags = rtm->rtm_flags;
653 #ifdef RTSOCK_DEBUG
654 	if (info.rti_info[RTAX_DST]->sa_family == AF_INET) {
655 		char abuf[INET_ADDRSTRLEN];
656 		printf("%s: extracted info.rti_info[RTAX_DST] %s\n", __func__,
657 		    RT_IN_PRINT(&info, abuf, RTAX_DST));
658 	}
659 #endif /* RTSOCK_DEBUG */
660 	if (info.rti_info[RTAX_DST] == NULL ||
661 	    (info.rti_info[RTAX_DST]->sa_family >= AF_MAX)) {
662 		senderr(EINVAL);
663 	}
664 	if (info.rti_info[RTAX_GATEWAY] != NULL &&
665 	    (info.rti_info[RTAX_GATEWAY]->sa_family >= AF_MAX)) {
666 		senderr(EINVAL);
667 	}
668 
669 	/*
670 	 * Verify that the caller has the appropriate privilege; RTM_GET
671 	 * is the only operation the non-superuser is allowed.
672 	 */
673 	if (kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_ROUTE,
674 	    0, rtm, NULL, NULL) != 0)
675 		senderr(EACCES);
676 
677 	/*
678 	 * route(8) passes a sockaddr truncated with prefixlen.
679 	 * The kernel doesn't expect such sockaddr and need to
680 	 * use a buffer that is big enough for the sockaddr expected
681 	 * (padded with 0's). We keep the original length of the sockaddr.
682 	 */
683 	if (info.rti_info[RTAX_NETMASK]) {
684 		/*
685 		 * Use the family of RTAX_DST, because RTAX_NETMASK
686 		 * can have a zero family if it comes from the radix
687 		 * tree via rt_mask().
688 		 */
689 		socklen_t sa_len = sockaddr_getsize_by_family(
690 		    info.rti_info[RTAX_DST]->sa_family);
691 		socklen_t masklen = sockaddr_getlen(
692 		    info.rti_info[RTAX_NETMASK]);
693 		if (sa_len != 0 && sa_len > masklen) {
694 			KASSERT(sa_len <= sizeof(netmask));
695 			memcpy(&netmask, info.rti_info[RTAX_NETMASK], masklen);
696 			memset((char *)&netmask + masklen, 0, sa_len - masklen);
697 			info.rti_info[RTAX_NETMASK] = sstocsa(&netmask);
698 		}
699 	}
700 
701 	switch (rtm->rtm_type) {
702 
703 	case RTM_ADD:
704 		if (info.rti_info[RTAX_GATEWAY] == NULL) {
705 			senderr(EINVAL);
706 		}
707 #if defined(INET) || defined(INET6)
708 		/* support for new ARP/NDP code with keeping backcompat */
709 		if (info.rti_info[RTAX_GATEWAY]->sa_family == AF_LINK) {
710 			const struct sockaddr_dl *sdlp =
711 			    satocsdl(info.rti_info[RTAX_GATEWAY]);
712 
713 			/* Allow routing requests by interface index */
714 			if (sdlp->sdl_nlen == 0 && sdlp->sdl_alen == 0
715 			    && sdlp->sdl_slen == 0)
716 				goto fallback;
717 			/*
718 			 * Old arp binaries don't set the sdl_index
719 			 * so we have to complement it.
720 			 */
721 			int sdl_index = sdlp->sdl_index;
722 			if (sdl_index == 0) {
723 				error = route_get_sdl_index(&info, &sdl_index);
724 				if (error != 0)
725 					goto fallback;
726 			} else if (
727 			    info.rti_info[RTAX_DST]->sa_family == AF_INET) {
728 				/*
729 				 * XXX workaround for SIN_PROXY case; proxy arp
730 				 * entry should be in an interface that has
731 				 * a network route including the destination,
732 				 * not a local (link) route that may not be a
733 				 * desired place, for example a tap.
734 				 */
735 				const struct sockaddr_inarp *sina =
736 				    (const struct sockaddr_inarp *)
737 				    info.rti_info[RTAX_DST];
738 				if (sina->sin_other & SIN_PROXY) {
739 					error = route_get_sdl_index(&info,
740 					    &sdl_index);
741 					if (error != 0)
742 						goto fallback;
743 				}
744 			}
745 			error = lla_rt_output(rtm->rtm_type, rtm->rtm_flags,
746 			    rtm->rtm_rmx.rmx_expire, &info, sdl_index);
747 			break;
748 		}
749 	fallback:
750 #endif /* defined(INET) || defined(INET6) */
751 		error = rtrequest1(rtm->rtm_type, &info, &saved_nrt);
752 		if (error == 0) {
753 			_rt_setmetrics(rtm->rtm_inits, rtm, saved_nrt);
754 			rt_unref(saved_nrt);
755 		}
756 		break;
757 
758 	case RTM_DELETE:
759 #if defined(INET) || defined(INET6)
760 		/* support for new ARP/NDP code */
761 		if (info.rti_info[RTAX_GATEWAY] &&
762 		    (info.rti_info[RTAX_GATEWAY]->sa_family == AF_LINK) &&
763 		    (rtm->rtm_flags & RTF_LLDATA) != 0) {
764 			const struct sockaddr_dl *sdlp =
765 			    satocsdl(info.rti_info[RTAX_GATEWAY]);
766 			error = lla_rt_output(rtm->rtm_type, rtm->rtm_flags,
767 			    rtm->rtm_rmx.rmx_expire, &info, sdlp->sdl_index);
768 			rtm->rtm_flags &= ~RTF_UP;
769 			break;
770 		}
771 #endif
772 		error = rtrequest1(rtm->rtm_type, &info, &saved_nrt);
773 		if (error != 0)
774 			break;
775 
776 		rt = saved_nrt;
777 		do_rt_free = true;
778 		info.rti_info[RTAX_DST] = rt_getkey(rt);
779 		info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
780 		info.rti_info[RTAX_NETMASK] = rt_mask(rt);
781 		info.rti_info[RTAX_TAG] = rt_gettag(rt);
782 		error = route_output_report(rt, &info, rtm, &new_rtm);
783 		if (error)
784 			senderr(error);
785 		if (new_rtm != NULL) {
786 			old_rtm = rtm;
787 			rtm = new_rtm;
788 		}
789 		break;
790 
791 	case RTM_GET:
792 	case RTM_CHANGE:
793 	case RTM_LOCK:
794                 /* XXX This will mask info.rti_info[RTAX_DST] with
795 		 * info.rti_info[RTAX_NETMASK] before
796                  * searching.  It did not used to do that.  --dyoung
797 		 */
798 		rt = NULL;
799 		error = rtrequest1(RTM_GET, &info, &rt);
800 		if (error != 0)
801 			senderr(error);
802 		if (rtm->rtm_type != RTM_GET) {/* XXX: too grotty */
803 			if (memcmp(info.rti_info[RTAX_DST], rt_getkey(rt),
804 			    info.rti_info[RTAX_DST]->sa_len) != 0)
805 				senderr(ESRCH);
806 			if (info.rti_info[RTAX_NETMASK] == NULL &&
807 			    rt_mask(rt) != NULL)
808 				senderr(ETOOMANYREFS);
809 		}
810 
811 		/*
812 		 * XXX if arp/ndp requests an L2 entry, we have to obtain
813 		 * it from lltable while for the route command we have to
814 		 * return a route as it is. How to distinguish them?
815 		 * For newer arp/ndp, RTF_LLDATA flag set by arp/ndp
816 		 * indicates an L2 entry is requested. For old arp/ndp
817 		 * binaries, we check RTF_UP flag is NOT set; it works
818 		 * by the fact that arp/ndp don't set it while the route
819 		 * command sets it.
820 		 */
821 		if (((rtm->rtm_flags & RTF_LLDATA) != 0 ||
822 		     (rtm->rtm_flags & RTF_UP) == 0) &&
823 		    rtm->rtm_type == RTM_GET &&
824 		    sockaddr_cmp(rt_getkey(rt), info.rti_info[RTAX_DST]) != 0) {
825 			int ll_flags = 0;
826 			route_get_sdl(rt->rt_ifp, info.rti_info[RTAX_DST], &sdl,
827 			    &ll_flags);
828 			info.rti_info[RTAX_GATEWAY] = sstocsa(&sdl);
829 			error = route_output_report(rt, &info, rtm, &new_rtm);
830 			if (error)
831 				senderr(error);
832 			if (new_rtm != NULL) {
833 				old_rtm = rtm;
834 				rtm = new_rtm;
835 			}
836 			rtm->rtm_flags |= RTF_LLDATA;
837 			rtm->rtm_flags &= ~RTF_CONNECTED;
838 			rtm->rtm_flags |= (ll_flags & LLE_STATIC) ? RTF_STATIC : 0;
839 			break;
840 		}
841 
842 		switch (rtm->rtm_type) {
843 		case RTM_GET:
844 			info.rti_info[RTAX_DST] = rt_getkey(rt);
845 			info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
846 			info.rti_info[RTAX_NETMASK] = rt_mask(rt);
847 			info.rti_info[RTAX_TAG] = rt_gettag(rt);
848 			error = route_output_report(rt, &info, rtm, &new_rtm);
849 			if (error)
850 				senderr(error);
851 			if (new_rtm != NULL) {
852 				old_rtm = rtm;
853 				rtm = new_rtm;
854 			}
855 			break;
856 
857 		case RTM_CHANGE:
858 #ifdef NET_MPSAFE
859 			/*
860 			 * Release rt_so_mtx to avoid a deadlock with route_intr
861 			 * and also serialize updating routes to avoid another.
862 			 */
863 			if (rt_updating) {
864 				/* Release to allow the updater to proceed */
865 				rt_unref(rt);
866 				rt = NULL;
867 			}
868 			while (rt_updating) {
869 				error = cv_wait_sig(&rt_update_cv, rt_so_mtx);
870 				if (error != 0)
871 					goto flush;
872 			}
873 			if (rt == NULL) {
874 				error = rtrequest1(RTM_GET, &info, &rt);
875 				if (error != 0)
876 					goto flush;
877 			}
878 			rt_updating = true;
879 			mutex_exit(rt_so_mtx);
880 
881 			error = rt_update_prepare(rt);
882 			if (error == 0) {
883 				error = rt_update(rt, &info, rtm);
884 				rt_update_finish(rt);
885 			}
886 
887 			mutex_enter(rt_so_mtx);
888 			rt_updating = false;
889 			cv_broadcast(&rt_update_cv);
890 #else
891 			error = rt_update(rt, &info, rtm);
892 #endif
893 			if (error != 0)
894 				goto flush;
895 			/*FALLTHROUGH*/
896 		case RTM_LOCK:
897 			rt->rt_rmx.rmx_locks &= ~(rtm->rtm_inits);
898 			rt->rt_rmx.rmx_locks |=
899 			    (rtm->rtm_inits & rtm->rtm_rmx.rmx_locks);
900 			break;
901 		}
902 		break;
903 
904 	default:
905 		senderr(EOPNOTSUPP);
906 	}
907 
908 flush:
909 	if (rtm) {
910 		if (error)
911 			rtm->rtm_errno = error;
912 		else
913 			rtm->rtm_flags |= RTF_DONE;
914 	}
915 	family = info.rti_info[RTAX_DST] ? info.rti_info[RTAX_DST]->sa_family :
916 	    0;
917 	/* We cannot free old_rtm until we have stopped using the
918 	 * pointers in info, some of which may point to sockaddrs
919 	 * in old_rtm.
920 	 */
921 	if (old_rtm != NULL)
922 		Free(old_rtm);
923 	if (rt) {
924 		if (do_rt_free) {
925 #ifdef NET_MPSAFE
926 			/*
927 			 * Release rt_so_mtx to avoid a deadlock with
928 			 * route_intr.
929 			 */
930 			mutex_exit(rt_so_mtx);
931 			rt_free(rt);
932 			mutex_enter(rt_so_mtx);
933 #else
934 			rt_free(rt);
935 #endif
936 		} else
937 			rt_unref(rt);
938 	}
939     {
940 	struct rawcb *rp = NULL;
941 	/*
942 	 * Check to see if we don't want our own messages.
943 	 */
944 	if ((so->so_options & SO_USELOOPBACK) == 0) {
945 		if (COMPATNAME(route_info).ri_cb.any_count <= 1) {
946 			if (rtm)
947 				Free(rtm);
948 			m_freem(m);
949 			goto out;
950 		}
951 		/* There is another listener, so construct message */
952 		rp = sotorawcb(so);
953 	}
954 	if (rtm) {
955 		m_copyback(m, 0, rtm->rtm_msglen, rtm);
956 		if (m->m_pkthdr.len < rtm->rtm_msglen) {
957 			m_freem(m);
958 			m = NULL;
959 		} else if (m->m_pkthdr.len > rtm->rtm_msglen)
960 			m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len);
961 		Free(rtm);
962 	}
963 	if (rp)
964 		rp->rcb_proto.sp_family = 0; /* Avoid us */
965 	if (family)
966 		proto.sp_protocol = family;
967 	if (m)
968 		raw_input(m, &proto, &COMPATNAME(route_info).ri_src,
969 		    &COMPATNAME(route_info).ri_dst, &rt_rawcb);
970 	if (rp)
971 		rp->rcb_proto.sp_family = PF_XROUTE;
972     }
973 out:
974 	curlwp_bindx(bound);
975 	return error;
976 }
977 
978 static int
979 route_ctloutput(int op, struct socket *so, struct sockopt *sopt)
980 {
981 	struct routecb *rop = sotoroutecb(so);
982 	int error = 0;
983 	unsigned char *rtm_type;
984 	size_t len;
985 	unsigned int msgfilter;
986 
987 	KASSERT(solocked(so));
988 
989 	if (sopt->sopt_level != AF_ROUTE) {
990 		error = ENOPROTOOPT;
991 	} else switch (op) {
992 	case PRCO_SETOPT:
993 		switch (sopt->sopt_name) {
994 		case RO_MSGFILTER:
995 			msgfilter = 0;
996 			for (rtm_type = sopt->sopt_data, len = sopt->sopt_size;
997 			     len != 0;
998 			     rtm_type++, len -= sizeof(*rtm_type))
999 			{
1000 				/* Guard against overflowing our storage. */
1001 				if (*rtm_type >= sizeof(msgfilter) * CHAR_BIT) {
1002 					error = EOVERFLOW;
1003 					break;
1004 				}
1005 				msgfilter |= RTMSGFILTER(*rtm_type);
1006 			}
1007 			if (error == 0)
1008 				rop->rocb_msgfilter = msgfilter;
1009 			break;
1010 		default:
1011 			error = ENOPROTOOPT;
1012 			break;
1013 		}
1014 		break;
1015 	case PRCO_GETOPT:
1016 		switch (sopt->sopt_name) {
1017 		case RO_MSGFILTER:
1018 			error = ENOTSUP;
1019 			break;
1020 		default:
1021 			error = ENOPROTOOPT;
1022 			break;
1023 		}
1024 	}
1025 	return error;
1026 }
1027 
1028 static void
1029 _rt_setmetrics(int which, const struct rt_xmsghdr *in, struct rtentry *out)
1030 {
1031 #define metric(f, e) if (which & (f)) out->rt_rmx.e = in->rtm_rmx.e;
1032 	metric(RTV_RPIPE, rmx_recvpipe);
1033 	metric(RTV_SPIPE, rmx_sendpipe);
1034 	metric(RTV_SSTHRESH, rmx_ssthresh);
1035 	metric(RTV_RTT, rmx_rtt);
1036 	metric(RTV_RTTVAR, rmx_rttvar);
1037 	metric(RTV_HOPCOUNT, rmx_hopcount);
1038 	metric(RTV_MTU, rmx_mtu);
1039 #undef metric
1040 	if (which & RTV_EXPIRE) {
1041 		out->rt_rmx.rmx_expire = in->rtm_rmx.rmx_expire ?
1042 		    time_wall_to_mono(in->rtm_rmx.rmx_expire) : 0;
1043 	}
1044 }
1045 
1046 static void
1047 rtm_setmetrics(const struct rtentry *in, struct rt_xmsghdr *out)
1048 {
1049 #define metric(e) out->rtm_rmx.e = in->rt_rmx.e;
1050 	metric(rmx_recvpipe);
1051 	metric(rmx_sendpipe);
1052 	metric(rmx_ssthresh);
1053 	metric(rmx_rtt);
1054 	metric(rmx_rttvar);
1055 	metric(rmx_hopcount);
1056 	metric(rmx_mtu);
1057 	metric(rmx_locks);
1058 #undef metric
1059 	out->rtm_rmx.rmx_expire = in->rt_rmx.rmx_expire ?
1060 	    time_mono_to_wall(in->rt_rmx.rmx_expire) : 0;
1061 }
1062 
1063 static int
1064 rt_xaddrs(u_char rtmtype, const char *cp, const char *cplim,
1065     struct rt_addrinfo *rtinfo)
1066 {
1067 	const struct sockaddr *sa = NULL;	/* Quell compiler warning */
1068 	int i;
1069 
1070 	for (i = 0; i < RTAX_MAX && cp < cplim; i++) {
1071 		if ((rtinfo->rti_addrs & (1 << i)) == 0)
1072 			continue;
1073 		rtinfo->rti_info[i] = sa = (const struct sockaddr *)cp;
1074 		RT_XADVANCE(cp, sa);
1075 	}
1076 
1077 	/*
1078 	 * Check for extra addresses specified, except RTM_GET asking
1079 	 * for interface info.
1080 	 */
1081 	if (rtmtype == RTM_GET) {
1082 		if (((rtinfo->rti_addrs &
1083 		    (~((1 << RTAX_IFP) | (1 << RTAX_IFA)))) & (~0U << i)) != 0)
1084 			return 1;
1085 	} else if ((rtinfo->rti_addrs & (~0U << i)) != 0)
1086 		return 1;
1087 	/* Check for bad data length.  */
1088 	if (cp != cplim) {
1089 		if (i == RTAX_NETMASK + 1 && sa != NULL &&
1090 		    cp - RT_XROUNDUP(sa->sa_len) + sa->sa_len == cplim)
1091 			/*
1092 			 * The last sockaddr was info.rti_info[RTAX_NETMASK].
1093 			 * We accept this for now for the sake of old
1094 			 * binaries or third party softwares.
1095 			 */
1096 			;
1097 		else
1098 			return 1;
1099 	}
1100 	return 0;
1101 }
1102 
1103 static int
1104 rt_getlen(int type)
1105 {
1106 	RTS_CTASSERT(__alignof(struct ifa_msghdr) >= sizeof(uint64_t));
1107 	RTS_CTASSERT(__alignof(struct if_msghdr) >= sizeof(uint64_t));
1108 	RTS_CTASSERT(__alignof(struct if_announcemsghdr) >= sizeof(uint64_t));
1109 	RTS_CTASSERT(__alignof(struct rt_msghdr) >= sizeof(uint64_t));
1110 
1111 	switch (type) {
1112 	case RTM_ODELADDR:
1113 	case RTM_ONEWADDR:
1114 	case RTM_OCHGADDR:
1115 		if (rtsock_iflist_70_hook.hooked)
1116 			return sizeof(struct ifa_msghdr70);
1117 		else {
1118 #ifdef RTSOCK_DEBUG
1119 			printf("%s: unsupported RTM type %d\n", __func__, type);
1120 #endif
1121 			return -1;
1122 		}
1123 
1124 	case RTM_DELADDR:
1125 	case RTM_NEWADDR:
1126 	case RTM_CHGADDR:
1127 		return sizeof(struct ifa_xmsghdr);
1128 
1129 	case RTM_OOIFINFO:
1130 		if (rtsock_iflist_14_hook.hooked)
1131 			return sizeof(struct if_msghdr14);
1132 		else {
1133 #ifdef RTSOCK_DEBUG
1134 			printf("%s: unsupported RTM type RTM_OOIFINFO\n",
1135 			    __func__);
1136 #endif
1137 			return -1;
1138 		}
1139 
1140 	case RTM_OIFINFO:
1141 		if (rtsock_iflist_50_hook.hooked)
1142 			return sizeof(struct if_msghdr50);
1143 		else {
1144 #ifdef RTSOCK_DEBUG
1145 			printf("%s: unsupported RTM type RTM_OIFINFO\n",
1146 			    __func__);
1147 #endif
1148 			return -1;
1149 		}
1150 
1151 	case RTM_IFINFO:
1152 		return sizeof(struct if_xmsghdr);
1153 
1154 	case RTM_IFANNOUNCE:
1155 	case RTM_IEEE80211:
1156 		return sizeof(struct if_xannouncemsghdr);
1157 
1158 	default:
1159 		return sizeof(struct rt_xmsghdr);
1160 	}
1161 }
1162 
1163 
1164 struct mbuf *
1165 COMPATNAME(rt_msg1)(int type, struct rt_addrinfo *rtinfo, void *data, int datalen)
1166 {
1167 	struct rt_xmsghdr *rtm;
1168 	struct mbuf *m;
1169 	int i;
1170 	const struct sockaddr *sa;
1171 	int len, dlen;
1172 
1173 	m = m_gethdr(M_DONTWAIT, MT_DATA);
1174 	if (m == NULL)
1175 		return m;
1176 	MCLAIM(m, &COMPATNAME(routedomain).dom_mowner);
1177 
1178 	if ((len = rt_getlen(type)) == -1)
1179 		goto out;
1180 	if (len > MHLEN + MLEN)
1181 		panic("%s: message too long", __func__);
1182 	else if (len > MHLEN) {
1183 		m->m_next = m_get(M_DONTWAIT, MT_DATA);
1184 		if (m->m_next == NULL)
1185 			goto out;
1186 		MCLAIM(m->m_next, m->m_owner);
1187 		m->m_pkthdr.len = len;
1188 		m->m_len = MHLEN;
1189 		m->m_next->m_len = len - MHLEN;
1190 	} else {
1191 		m->m_pkthdr.len = m->m_len = len;
1192 	}
1193 	m_reset_rcvif(m);
1194 	m_copyback(m, 0, datalen, data);
1195 	if (len > datalen)
1196 		(void)memset(mtod(m, char *) + datalen, 0, len - datalen);
1197 	rtm = mtod(m, struct rt_xmsghdr *);
1198 	for (i = 0; i < RTAX_MAX; i++) {
1199 		if ((sa = rtinfo->rti_info[i]) == NULL)
1200 			continue;
1201 		rtinfo->rti_addrs |= (1 << i);
1202 		dlen = RT_XROUNDUP(sa->sa_len);
1203 		m_copyback(m, len, sa->sa_len, sa);
1204 		if (dlen != sa->sa_len) {
1205 			/*
1206 			 * Up to 7 + 1 nul's since roundup is to
1207 			 * sizeof(uint64_t) (8 bytes)
1208 			 */
1209 			m_copyback(m, len + sa->sa_len,
1210 			    dlen - sa->sa_len, "\0\0\0\0\0\0\0");
1211 		}
1212 		len += dlen;
1213 	}
1214 	if (m->m_pkthdr.len != len)
1215 		goto out;
1216 	rtm->rtm_msglen = len;
1217 	rtm->rtm_version = RTM_XVERSION;
1218 	rtm->rtm_type = type;
1219 	return m;
1220 out:
1221 	m_freem(m);
1222 	return NULL;
1223 }
1224 
1225 /*
1226  * rt_msg2
1227  *
1228  *	 fills 'cp' or 'w'.w_tmem with the routing socket message and
1229  *		returns the length of the message in 'lenp'.
1230  *
1231  * if walkarg is 0, cp is expected to be 0 or a buffer large enough to hold
1232  *	the message
1233  * otherwise walkarg's w_needed is updated and if the user buffer is
1234  *	specified and w_needed indicates space exists the information is copied
1235  *	into the temp space (w_tmem). w_tmem is [re]allocated if necessary,
1236  *	if the allocation fails ENOBUFS is returned.
1237  */
1238 static int
1239 rt_msg2(int type, struct rt_addrinfo *rtinfo, void *cpv, struct rt_walkarg *w,
1240 	int *lenp)
1241 {
1242 	int i;
1243 	int len, dlen, second_time = 0;
1244 	char *cp0, *cp = cpv;
1245 
1246 	rtinfo->rti_addrs = 0;
1247 again:
1248 	if ((len = rt_getlen(type)) == -1)
1249 		return EINVAL;
1250 
1251 	if ((cp0 = cp) != NULL)
1252 		cp += len;
1253 	for (i = 0; i < RTAX_MAX; i++) {
1254 		const struct sockaddr *sa;
1255 
1256 		if ((sa = rtinfo->rti_info[i]) == NULL)
1257 			continue;
1258 		rtinfo->rti_addrs |= (1 << i);
1259 		dlen = RT_XROUNDUP(sa->sa_len);
1260 		if (cp) {
1261 			int diff = dlen - sa->sa_len;
1262 			(void)memcpy(cp, sa, (size_t)sa->sa_len);
1263 			cp += sa->sa_len;
1264 			if (diff > 0) {
1265 				(void)memset(cp, 0, (size_t)diff);
1266 				cp += diff;
1267 			}
1268 		}
1269 		len += dlen;
1270 	}
1271 	if (cp == NULL && w != NULL && !second_time) {
1272 		struct rt_walkarg *rw = w;
1273 
1274 		rw->w_needed += len;
1275 		if (rw->w_needed <= 0 && rw->w_where) {
1276 			if (rw->w_tmemsize < len) {
1277 				if (rw->w_tmem)
1278 					kmem_free(rw->w_tmem, rw->w_tmemsize);
1279 				rw->w_tmem = kmem_zalloc(len, KM_SLEEP);
1280 				rw->w_tmemsize = len;
1281 			}
1282 			if (rw->w_tmem) {
1283 				cp = rw->w_tmem;
1284 				second_time = 1;
1285 				goto again;
1286 			} else {
1287 				rw->w_tmemneeded = len;
1288 				return ENOBUFS;
1289 			}
1290 		}
1291 	}
1292 	if (cp) {
1293 		struct rt_xmsghdr *rtm = (struct rt_xmsghdr *)cp0;
1294 
1295 		rtm->rtm_version = RTM_XVERSION;
1296 		rtm->rtm_type = type;
1297 		rtm->rtm_msglen = len;
1298 	}
1299 	if (lenp)
1300 		*lenp = len;
1301 	return 0;
1302 }
1303 
1304 /*
1305  * This routine is called to generate a message from the routing
1306  * socket indicating that a redirect has occurred, a routing lookup
1307  * has failed, or that a protocol has detected timeouts to a particular
1308  * destination.
1309  */
1310 void
1311 COMPATNAME(rt_missmsg)(int type, const struct rt_addrinfo *rtinfo, int flags,
1312     int error)
1313 {
1314 	struct rt_xmsghdr rtm;
1315 	struct mbuf *m;
1316 	const struct sockaddr *sa = rtinfo->rti_info[RTAX_DST];
1317 	struct rt_addrinfo info = *rtinfo;
1318 
1319 	COMPATCALL(rt_missmsg, (type, rtinfo, flags, error));
1320 	if (COMPATNAME(route_info).ri_cb.any_count == 0)
1321 		return;
1322 	memset(&rtm, 0, sizeof(rtm));
1323 	rtm.rtm_pid = curproc->p_pid;
1324 	rtm.rtm_flags = RTF_DONE | flags;
1325 	rtm.rtm_errno = error;
1326 	m = COMPATNAME(rt_msg1)(type, &info, &rtm, sizeof(rtm));
1327 	if (m == NULL)
1328 		return;
1329 	mtod(m, struct rt_xmsghdr *)->rtm_addrs = info.rti_addrs;
1330 	COMPATNAME(route_enqueue)(m, sa ? sa->sa_family : 0);
1331 }
1332 
1333 /*
1334  * This routine is called to generate a message from the routing
1335  * socket indicating that the status of a network interface has changed.
1336  */
1337 void
1338 COMPATNAME(rt_ifmsg)(struct ifnet *ifp)
1339 {
1340 	struct if_xmsghdr ifm;
1341 	struct mbuf *m;
1342 	struct rt_addrinfo info;
1343 
1344 	COMPATCALL(rt_ifmsg, (ifp));
1345 	if (COMPATNAME(route_info).ri_cb.any_count == 0)
1346 		return;
1347 	(void)memset(&info, 0, sizeof(info));
1348 	(void)memset(&ifm, 0, sizeof(ifm));
1349 	ifm.ifm_index = ifp->if_index;
1350 	ifm.ifm_flags = ifp->if_flags;
1351 	ifm.ifm_data = ifp->if_data;
1352 	ifm.ifm_addrs = 0;
1353 	m = COMPATNAME(rt_msg1)(RTM_IFINFO, &info, &ifm, sizeof(ifm));
1354 	if (m == NULL)
1355 		return;
1356 	COMPATNAME(route_enqueue)(m, 0);
1357 	MODULE_HOOK_CALL_VOID(rtsock_oifmsg_14_hook, (ifp), __nothing);
1358 	MODULE_HOOK_CALL_VOID(rtsock_oifmsg_50_hook, (ifp), __nothing);
1359 }
1360 
1361 /*
1362  * This is called to generate messages from the routing socket
1363  * indicating a network interface has had addresses associated with it.
1364  * if we ever reverse the logic and replace messages TO the routing
1365  * socket indicate a request to configure interfaces, then it will
1366  * be unnecessary as the routing socket will automatically generate
1367  * copies of it.
1368  */
1369 static void
1370 COMPATNAME(rt_addrmsg0)(int cmd, struct ifaddr *ifa, int error,
1371     struct rtentry *rt, const struct sockaddr *src)
1372 {
1373 #define	cmdpass(__cmd, __pass)	(((__cmd) << 2) | (__pass))
1374 	struct rt_addrinfo info;
1375 	const struct sockaddr *sa;
1376 	int pass;
1377 	struct mbuf *m;
1378 	struct ifnet *ifp;
1379 	struct rt_xmsghdr rtm;
1380 	struct ifa_xmsghdr ifam;
1381 	int ncmd;
1382 
1383 	KASSERT(ifa != NULL);
1384 	KASSERT(ifa->ifa_addr != NULL);
1385 	ifp = ifa->ifa_ifp;
1386 	if (cmd == RTM_ADD && vec_sctp_add_ip_address != NULL) {
1387 		(*vec_sctp_add_ip_address)(ifa);
1388 	} else if (cmd == RTM_DELETE && vec_sctp_delete_ip_address != NULL) {
1389 		(*vec_sctp_delete_ip_address)(ifa);
1390 	}
1391 
1392 	COMPATCALL(rt_addrmsg_rt, (cmd, ifa, error, rt));
1393 	if (COMPATNAME(route_info).ri_cb.any_count == 0)
1394 		return;
1395 	for (pass = 1; pass < 3; pass++) {
1396 		memset(&info, 0, sizeof(info));
1397 		switch (cmdpass(cmd, pass)) {
1398 		case cmdpass(RTM_ADD, 1):
1399 		case cmdpass(RTM_CHANGE, 1):
1400 		case cmdpass(RTM_DELETE, 2):
1401 		case cmdpass(RTM_NEWADDR, 1):
1402 		case cmdpass(RTM_DELADDR, 1):
1403 		case cmdpass(RTM_CHGADDR, 1):
1404 			switch (cmd) {
1405 			case RTM_ADD:
1406 				ncmd = RTM_XNEWADDR;
1407 				break;
1408 			case RTM_DELETE:
1409 				ncmd = RTM_XDELADDR;
1410 				break;
1411 			case RTM_CHANGE:
1412 				ncmd = RTM_XCHGADDR;
1413 				break;
1414 			case RTM_NEWADDR:
1415 				ncmd = RTM_XNEWADDR;
1416 				break;
1417 			case RTM_DELADDR:
1418 				ncmd = RTM_XDELADDR;
1419 				break;
1420 			case RTM_CHGADDR:
1421 				ncmd = RTM_XCHGADDR;
1422 				break;
1423 			default:
1424 				panic("%s: unknown command %d", __func__, cmd);
1425 			}
1426 			MODULE_HOOK_CALL_VOID(rtsock_newaddr_70_hook,
1427 			    (ncmd, ifa), __nothing);
1428 			info.rti_info[RTAX_IFA] = sa = ifa->ifa_addr;
1429 			KASSERT(ifp->if_dl != NULL);
1430 			info.rti_info[RTAX_IFP] = ifp->if_dl->ifa_addr;
1431 			info.rti_info[RTAX_NETMASK] = ifa->ifa_netmask;
1432 			info.rti_info[RTAX_BRD] = ifa->ifa_dstaddr;
1433 			info.rti_info[RTAX_AUTHOR] = src;
1434 			memset(&ifam, 0, sizeof(ifam));
1435 			ifam.ifam_index = ifp->if_index;
1436 			ifam.ifam_metric = ifa->ifa_metric;
1437 			ifam.ifam_flags = ifa->ifa_flags;
1438 #ifndef COMPAT_RTSOCK
1439 			ifam.ifam_pid = curproc->p_pid;
1440 			ifam.ifam_addrflags = if_addrflags(ifa);
1441 #endif
1442 			m = COMPATNAME(rt_msg1)(ncmd, &info, &ifam, sizeof(ifam));
1443 			if (m == NULL)
1444 				continue;
1445 			mtod(m, struct ifa_xmsghdr *)->ifam_addrs =
1446 			    info.rti_addrs;
1447 			break;
1448 		case cmdpass(RTM_ADD, 2):
1449 		case cmdpass(RTM_CHANGE, 2):
1450 		case cmdpass(RTM_DELETE, 1):
1451 			if (rt == NULL)
1452 				continue;
1453 			info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1454 			info.rti_info[RTAX_DST] = sa = rt_getkey(rt);
1455 			info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1456 			memset(&rtm, 0, sizeof(rtm));
1457 			rtm.rtm_pid = curproc->p_pid;
1458 			rtm.rtm_index = ifp->if_index;
1459 			rtm.rtm_flags |= rt->rt_flags;
1460 			rtm.rtm_errno = error;
1461 			m = COMPATNAME(rt_msg1)(cmd, &info, &rtm, sizeof(rtm));
1462 			if (m == NULL)
1463 				continue;
1464 			mtod(m, struct rt_xmsghdr *)->rtm_addrs = info.rti_addrs;
1465 			break;
1466 		default:
1467 			continue;
1468 		}
1469 		KASSERTMSG(m != NULL, "called with wrong command");
1470 		COMPATNAME(route_enqueue)(m, sa ? sa->sa_family : 0);
1471 	}
1472 #undef cmdpass
1473 }
1474 
1475 void
1476 COMPATNAME(rt_addrmsg)(int cmd, struct ifaddr *ifa)
1477 {
1478 
1479 	COMPATNAME(rt_addrmsg0)(cmd, ifa, 0, NULL, NULL);
1480 }
1481 
1482 void
1483 COMPATNAME(rt_addrmsg_rt)(int cmd, struct ifaddr *ifa, int error,
1484     struct rtentry *rt)
1485 {
1486 
1487 	COMPATNAME(rt_addrmsg0)(cmd, ifa, error, rt, NULL);
1488 }
1489 
1490 void
1491 COMPATNAME(rt_addrmsg_src)(int cmd, struct ifaddr *ifa,
1492     const struct sockaddr *src)
1493 {
1494 
1495 	COMPATNAME(rt_addrmsg0)(cmd, ifa, 0, NULL, src);
1496 }
1497 
1498 static struct mbuf *
1499 rt_makeifannouncemsg(struct ifnet *ifp, int type, int what,
1500     struct rt_addrinfo *info)
1501 {
1502 	struct if_xannouncemsghdr ifan;
1503 
1504 	memset(info, 0, sizeof(*info));
1505 	memset(&ifan, 0, sizeof(ifan));
1506 	ifan.ifan_index = ifp->if_index;
1507 	strlcpy(ifan.ifan_name, ifp->if_xname, sizeof(ifan.ifan_name));
1508 	ifan.ifan_what = what;
1509 	return COMPATNAME(rt_msg1)(type, info, &ifan, sizeof(ifan));
1510 }
1511 
1512 /*
1513  * This is called to generate routing socket messages indicating
1514  * network interface arrival and departure.
1515  */
1516 void
1517 COMPATNAME(rt_ifannouncemsg)(struct ifnet *ifp, int what)
1518 {
1519 	struct mbuf *m;
1520 	struct rt_addrinfo info;
1521 
1522 	COMPATCALL(rt_ifannouncemsg, (ifp, what));
1523 	if (COMPATNAME(route_info).ri_cb.any_count == 0)
1524 		return;
1525 	m = rt_makeifannouncemsg(ifp, RTM_IFANNOUNCE, what, &info);
1526 	if (m == NULL)
1527 		return;
1528 	COMPATNAME(route_enqueue)(m, 0);
1529 }
1530 
1531 /*
1532  * This is called to generate routing socket messages indicating
1533  * IEEE80211 wireless events.
1534  * XXX we piggyback on the RTM_IFANNOUNCE msg format in a clumsy way.
1535  */
1536 void
1537 COMPATNAME(rt_ieee80211msg)(struct ifnet *ifp, int what, void *data,
1538 	size_t data_len)
1539 {
1540 	struct mbuf *m;
1541 	struct rt_addrinfo info;
1542 
1543 	COMPATCALL(rt_ieee80211msg, (ifp, what, data, data_len));
1544 	if (COMPATNAME(route_info).ri_cb.any_count == 0)
1545 		return;
1546 	m = rt_makeifannouncemsg(ifp, RTM_IEEE80211, what, &info);
1547 	if (m == NULL)
1548 		return;
1549 	/*
1550 	 * Append the ieee80211 data.  Try to stick it in the
1551 	 * mbuf containing the ifannounce msg; otherwise allocate
1552 	 * a new mbuf and append.
1553 	 *
1554 	 * NB: we assume m is a single mbuf.
1555 	 */
1556 	if (data_len > M_TRAILINGSPACE(m)) {
1557 		struct mbuf *n = m_get(M_NOWAIT, MT_DATA);
1558 		if (n == NULL) {
1559 			m_freem(m);
1560 			return;
1561 		}
1562 		(void)memcpy(mtod(n, void *), data, data_len);
1563 		n->m_len = data_len;
1564 		m->m_next = n;
1565 	} else if (data_len > 0) {
1566 		(void)memcpy(mtod(m, uint8_t *) + m->m_len, data, data_len);
1567 		m->m_len += data_len;
1568 	}
1569 	if (m->m_flags & M_PKTHDR)
1570 		m->m_pkthdr.len += data_len;
1571 	mtod(m, struct if_xannouncemsghdr *)->ifan_msglen += data_len;
1572 	COMPATNAME(route_enqueue)(m, 0);
1573 }
1574 
1575 /*
1576  * Routing message software interrupt routine
1577  */
1578 static void
1579 COMPATNAME(route_intr)(void *cookie)
1580 {
1581 	struct sockproto proto = { .sp_family = PF_XROUTE, };
1582 	struct route_info * const ri = &COMPATNAME(route_info);
1583 	struct mbuf *m;
1584 
1585 	SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
1586 	for (;;) {
1587 		IFQ_LOCK(&ri->ri_intrq);
1588 		IF_DEQUEUE(&ri->ri_intrq, m);
1589 		IFQ_UNLOCK(&ri->ri_intrq);
1590 		if (m == NULL)
1591 			break;
1592 		proto.sp_protocol = M_GETCTX(m, uintptr_t);
1593 #ifdef NET_MPSAFE
1594 		mutex_enter(rt_so_mtx);
1595 #endif
1596 		raw_input(m, &proto, &ri->ri_src, &ri->ri_dst, &rt_rawcb);
1597 #ifdef NET_MPSAFE
1598 		mutex_exit(rt_so_mtx);
1599 #endif
1600 	}
1601 	SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
1602 }
1603 
1604 /*
1605  * Enqueue a message to the software interrupt routine.
1606  */
1607 void
1608 COMPATNAME(route_enqueue)(struct mbuf *m, int family)
1609 {
1610 	struct route_info * const ri = &COMPATNAME(route_info);
1611 	int wasempty;
1612 
1613 	IFQ_LOCK(&ri->ri_intrq);
1614 	if (IF_QFULL(&ri->ri_intrq)) {
1615 		printf("%s: queue full, dropped message\n", __func__);
1616 		IF_DROP(&ri->ri_intrq);
1617 		IFQ_UNLOCK(&ri->ri_intrq);
1618 		m_freem(m);
1619 	} else {
1620 		wasempty = IF_IS_EMPTY(&ri->ri_intrq);
1621 		M_SETCTX(m, (uintptr_t)family);
1622 		IF_ENQUEUE(&ri->ri_intrq, m);
1623 		IFQ_UNLOCK(&ri->ri_intrq);
1624 		if (wasempty) {
1625 			kpreempt_disable();
1626 			softint_schedule(ri->ri_sih);
1627 			kpreempt_enable();
1628 		}
1629 	}
1630 }
1631 
1632 static void
1633 COMPATNAME(route_init)(void)
1634 {
1635 	struct route_info * const ri = &COMPATNAME(route_info);
1636 
1637 #ifndef COMPAT_RTSOCK
1638 	rt_init();
1639 #ifdef NET_MPSAFE
1640 	rt_so_mtx = mutex_obj_alloc(MUTEX_DEFAULT, IPL_NONE);
1641 
1642 	cv_init(&rt_update_cv, "rtsock_cv");
1643 #endif
1644 
1645 	sysctl_net_route_setup(NULL, PF_ROUTE, "rtable");
1646 #endif
1647 	ri->ri_intrq.ifq_maxlen = ri->ri_maxqlen;
1648 	ri->ri_sih = softint_establish(SOFTINT_NET | SOFTINT_MPSAFE,
1649 	    COMPATNAME(route_intr), NULL);
1650 	IFQ_LOCK_INIT(&ri->ri_intrq);
1651 
1652 #ifdef MBUFTRACE
1653 	MOWNER_ATTACH(&COMPATNAME(routedomain).dom_mowner);
1654 #endif
1655 }
1656 
1657 /*
1658  * Definitions of protocols supported in the ROUTE domain.
1659  */
1660 #ifndef COMPAT_RTSOCK
1661 PR_WRAP_USRREQS(route);
1662 #else
1663 PR_WRAP_USRREQS(compat_50_route);
1664 #endif
1665 
1666 static const struct pr_usrreqs route_usrreqs = {
1667 	.pr_attach	= COMPATNAME(route_attach_wrapper),
1668 	.pr_detach	= COMPATNAME(route_detach_wrapper),
1669 	.pr_accept	= COMPATNAME(route_accept_wrapper),
1670 	.pr_bind	= COMPATNAME(route_bind_wrapper),
1671 	.pr_listen	= COMPATNAME(route_listen_wrapper),
1672 	.pr_connect	= COMPATNAME(route_connect_wrapper),
1673 	.pr_connect2	= COMPATNAME(route_connect2_wrapper),
1674 	.pr_disconnect	= COMPATNAME(route_disconnect_wrapper),
1675 	.pr_shutdown	= COMPATNAME(route_shutdown_wrapper),
1676 	.pr_abort	= COMPATNAME(route_abort_wrapper),
1677 	.pr_ioctl	= COMPATNAME(route_ioctl_wrapper),
1678 	.pr_stat	= COMPATNAME(route_stat_wrapper),
1679 	.pr_peeraddr	= COMPATNAME(route_peeraddr_wrapper),
1680 	.pr_sockaddr	= COMPATNAME(route_sockaddr_wrapper),
1681 	.pr_rcvd	= COMPATNAME(route_rcvd_wrapper),
1682 	.pr_recvoob	= COMPATNAME(route_recvoob_wrapper),
1683 	.pr_send	= COMPATNAME(route_send_wrapper),
1684 	.pr_sendoob	= COMPATNAME(route_sendoob_wrapper),
1685 	.pr_purgeif	= COMPATNAME(route_purgeif_wrapper),
1686 };
1687 
1688 static const struct protosw COMPATNAME(route_protosw)[] = {
1689 	{
1690 		.pr_type = SOCK_RAW,
1691 		.pr_domain = &COMPATNAME(routedomain),
1692 		.pr_flags = PR_ATOMIC|PR_ADDR,
1693 		.pr_ctlinput = raw_ctlinput,
1694 		.pr_ctloutput = route_ctloutput,
1695 		.pr_usrreqs = &route_usrreqs,
1696 		.pr_init = rt_pr_init,
1697 	},
1698 };
1699 
1700 struct domain COMPATNAME(routedomain) = {
1701 	.dom_family = PF_XROUTE,
1702 	.dom_name = DOMAINNAME,
1703 	.dom_init = COMPATNAME(route_init),
1704 	.dom_protosw = COMPATNAME(route_protosw),
1705 	.dom_protoswNPROTOSW =
1706 	    &COMPATNAME(route_protosw)[__arraycount(COMPATNAME(route_protosw))],
1707 #ifdef MBUFTRACE
1708 	.dom_mowner = MOWNER_INIT("route", "rtm"),
1709 #endif
1710 };
1711