xref: /netbsd-src/sys/netinet/in.c (revision f21b7d7f2cbdd5c14b3882c4e8a3d43580d460a6)
1 /*	$NetBSD: in.c,v 1.186 2016/10/01 17:17:20 roy Exp $	*/
2 
3 /*
4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the project nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 /*-
33  * Copyright (c) 1998 The NetBSD Foundation, Inc.
34  * All rights reserved.
35  *
36  * This code is derived from software contributed to The NetBSD Foundation
37  * by Public Access Networks Corporation ("Panix").  It was developed under
38  * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon.
39  *
40  * Redistribution and use in source and binary forms, with or without
41  * modification, are permitted provided that the following conditions
42  * are met:
43  * 1. Redistributions of source code must retain the above copyright
44  *    notice, this list of conditions and the following disclaimer.
45  * 2. Redistributions in binary form must reproduce the above copyright
46  *    notice, this list of conditions and the following disclaimer in the
47  *    documentation and/or other materials provided with the distribution.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
50  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
51  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
52  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
53  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
54  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
55  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
56  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
57  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
58  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
59  * POSSIBILITY OF SUCH DAMAGE.
60  */
61 
62 /*
63  * Copyright (c) 1982, 1986, 1991, 1993
64  *	The Regents of the University of California.  All rights reserved.
65  *
66  * Redistribution and use in source and binary forms, with or without
67  * modification, are permitted provided that the following conditions
68  * are met:
69  * 1. Redistributions of source code must retain the above copyright
70  *    notice, this list of conditions and the following disclaimer.
71  * 2. Redistributions in binary form must reproduce the above copyright
72  *    notice, this list of conditions and the following disclaimer in the
73  *    documentation and/or other materials provided with the distribution.
74  * 3. Neither the name of the University nor the names of its contributors
75  *    may be used to endorse or promote products derived from this software
76  *    without specific prior written permission.
77  *
78  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
79  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
80  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
81  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
82  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
83  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
84  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
85  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
86  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
87  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
88  * SUCH DAMAGE.
89  *
90  *	@(#)in.c	8.4 (Berkeley) 1/9/95
91  */
92 
93 #include <sys/cdefs.h>
94 __KERNEL_RCSID(0, "$NetBSD: in.c,v 1.186 2016/10/01 17:17:20 roy Exp $");
95 
96 #include "arp.h"
97 
98 #ifdef _KERNEL_OPT
99 #include "opt_inet.h"
100 #include "opt_inet_conf.h"
101 #include "opt_mrouting.h"
102 #endif
103 
104 #include <sys/param.h>
105 #include <sys/ioctl.h>
106 #include <sys/errno.h>
107 #include <sys/kernel.h>
108 #include <sys/malloc.h>
109 #include <sys/socket.h>
110 #include <sys/socketvar.h>
111 #include <sys/sysctl.h>
112 #include <sys/systm.h>
113 #include <sys/proc.h>
114 #include <sys/syslog.h>
115 #include <sys/kauth.h>
116 #include <sys/kmem.h>
117 
118 #include <sys/cprng.h>
119 
120 #include <net/if.h>
121 #include <net/route.h>
122 #include <net/pfil.h>
123 
124 #include <net/if_arp.h>
125 #include <net/if_ether.h>
126 #include <net/if_types.h>
127 #include <net/if_llatbl.h>
128 #include <net/if_dl.h>
129 
130 #include <netinet/in_systm.h>
131 #include <netinet/in.h>
132 #include <netinet/in_var.h>
133 #include <netinet/ip.h>
134 #include <netinet/ip_var.h>
135 #include <netinet/in_ifattach.h>
136 #include <netinet/in_pcb.h>
137 #include <netinet/in_selsrc.h>
138 #include <netinet/if_inarp.h>
139 #include <netinet/ip_mroute.h>
140 #include <netinet/igmp_var.h>
141 
142 #ifdef IPSELSRC
143 #include <netinet/in_selsrc.h>
144 #endif
145 
146 static u_int	in_mask2len(struct in_addr *);
147 static void	in_len2mask(struct in_addr *, u_int);
148 static int	in_lifaddr_ioctl(struct socket *, u_long, void *,
149 	struct ifnet *);
150 
151 static int	in_addprefix(struct in_ifaddr *, int);
152 static void	in_scrubaddr(struct in_ifaddr *);
153 static int	in_scrubprefix(struct in_ifaddr *);
154 static void	in_sysctl_init(struct sysctllog **);
155 
156 #ifndef SUBNETSARELOCAL
157 #define	SUBNETSARELOCAL	1
158 #endif
159 
160 #ifndef HOSTZEROBROADCAST
161 #define HOSTZEROBROADCAST 0
162 #endif
163 
164 /* Note: 61, 127, 251, 509, 1021, 2039 are good. */
165 #ifndef IN_MULTI_HASH_SIZE
166 #define IN_MULTI_HASH_SIZE	509
167 #endif
168 
169 static int			subnetsarelocal = SUBNETSARELOCAL;
170 static int			hostzeroisbroadcast = HOSTZEROBROADCAST;
171 
172 /*
173  * This list is used to keep track of in_multi chains which belong to
174  * deleted interface addresses.  We use in_ifaddr so that a chain head
175  * won't be deallocated until all multicast address record are deleted.
176  */
177 
178 LIST_HEAD(in_multihashhead, in_multi);		/* Type of the hash head */
179 
180 static struct pool		inmulti_pool;
181 static u_int			in_multientries;
182 static struct in_multihashhead *in_multihashtbl;
183 static u_long			in_multihash;
184 static krwlock_t		in_multilock;
185 
186 #define IN_MULTI_HASH(x, ifp) \
187     (in_multihashtbl[(u_long)((x) ^ (ifp->if_index)) % IN_MULTI_HASH_SIZE])
188 
189 /* XXX DEPRECATED. Keep them to avoid breaking kvm(3) users. */
190 struct in_ifaddrhashhead *	in_ifaddrhashtbl;
191 u_long				in_ifaddrhash;
192 struct in_ifaddrhead		in_ifaddrhead;
193 static kmutex_t			in_ifaddr_lock;
194 
195 struct pslist_head *		in_ifaddrhashtbl_pslist;
196 u_long				in_ifaddrhash_pslist;
197 struct pslist_head		in_ifaddrhead_pslist;
198 
199 void
200 in_init(void)
201 {
202 	pool_init(&inmulti_pool, sizeof(struct in_multi), 0, 0, 0, "inmltpl",
203 	    NULL, IPL_SOFTNET);
204 	TAILQ_INIT(&in_ifaddrhead);
205 	PSLIST_INIT(&in_ifaddrhead_pslist);
206 
207 	in_ifaddrhashtbl = hashinit(IN_IFADDR_HASH_SIZE, HASH_LIST, true,
208 	    &in_ifaddrhash);
209 
210 	in_ifaddrhashtbl_pslist = hashinit(IN_IFADDR_HASH_SIZE, HASH_PSLIST,
211 	    true, &in_ifaddrhash_pslist);
212 	mutex_init(&in_ifaddr_lock, MUTEX_DEFAULT, IPL_NONE);
213 
214 	in_multihashtbl = hashinit(IN_IFADDR_HASH_SIZE, HASH_LIST, true,
215 	    &in_multihash);
216 	rw_init(&in_multilock);
217 
218 	in_sysctl_init(NULL);
219 }
220 
221 /*
222  * Return 1 if an internet address is for a ``local'' host
223  * (one to which we have a connection).  If subnetsarelocal
224  * is true, this includes other subnets of the local net.
225  * Otherwise, it includes only the directly-connected (sub)nets.
226  */
227 int
228 in_localaddr(struct in_addr in)
229 {
230 	struct in_ifaddr *ia;
231 	int localaddr = 0;
232 	int s = pserialize_read_enter();
233 
234 	if (subnetsarelocal) {
235 		IN_ADDRLIST_READER_FOREACH(ia) {
236 			if ((in.s_addr & ia->ia_netmask) == ia->ia_net) {
237 				localaddr = 1;
238 				break;
239 			}
240 		}
241 	} else {
242 		IN_ADDRLIST_READER_FOREACH(ia) {
243 			if ((in.s_addr & ia->ia_subnetmask) == ia->ia_subnet) {
244 				localaddr = 1;
245 				break;
246 			}
247 		}
248 	}
249 	pserialize_read_exit(s);
250 
251 	return localaddr;
252 }
253 
254 /*
255  * Determine whether an IP address is in a reserved set of addresses
256  * that may not be forwarded, or whether datagrams to that destination
257  * may be forwarded.
258  */
259 int
260 in_canforward(struct in_addr in)
261 {
262 	u_int32_t net;
263 
264 	if (IN_EXPERIMENTAL(in.s_addr) || IN_MULTICAST(in.s_addr))
265 		return (0);
266 	if (IN_CLASSA(in.s_addr)) {
267 		net = in.s_addr & IN_CLASSA_NET;
268 		if (net == 0 || net == htonl(IN_LOOPBACKNET << IN_CLASSA_NSHIFT))
269 			return (0);
270 	}
271 	return (1);
272 }
273 
274 /*
275  * Trim a mask in a sockaddr
276  */
277 void
278 in_socktrim(struct sockaddr_in *ap)
279 {
280 	char *cplim = (char *) &ap->sin_addr;
281 	char *cp = (char *) (&ap->sin_addr + 1);
282 
283 	ap->sin_len = 0;
284 	while (--cp >= cplim)
285 		if (*cp) {
286 			(ap)->sin_len = cp - (char *) (ap) + 1;
287 			break;
288 		}
289 }
290 
291 /*
292  *  Routine to take an Internet address and convert into a
293  *  "dotted quad" representation for printing.
294  */
295 const char *
296 in_fmtaddr(struct in_addr addr)
297 {
298 	static char buf[sizeof("123.456.789.123")];
299 
300 	addr.s_addr = ntohl(addr.s_addr);
301 
302 	snprintf(buf, sizeof(buf), "%d.%d.%d.%d",
303 		(addr.s_addr >> 24) & 0xFF,
304 		(addr.s_addr >> 16) & 0xFF,
305 		(addr.s_addr >>  8) & 0xFF,
306 		(addr.s_addr >>  0) & 0xFF);
307 	return buf;
308 }
309 
310 /*
311  * Maintain the "in_maxmtu" variable, which is the largest
312  * mtu for non-local interfaces with AF_INET addresses assigned
313  * to them that are up.
314  */
315 unsigned long in_maxmtu;
316 
317 void
318 in_setmaxmtu(void)
319 {
320 	struct in_ifaddr *ia;
321 	struct ifnet *ifp;
322 	unsigned long maxmtu = 0;
323 	int s = pserialize_read_enter();
324 
325 	IN_ADDRLIST_READER_FOREACH(ia) {
326 		if ((ifp = ia->ia_ifp) == 0)
327 			continue;
328 		if ((ifp->if_flags & (IFF_UP|IFF_LOOPBACK)) != IFF_UP)
329 			continue;
330 		if (ifp->if_mtu > maxmtu)
331 			maxmtu = ifp->if_mtu;
332 	}
333 	if (maxmtu)
334 		in_maxmtu = maxmtu;
335 	pserialize_read_exit(s);
336 }
337 
338 static u_int
339 in_mask2len(struct in_addr *mask)
340 {
341 	u_int x, y;
342 	u_char *p;
343 
344 	p = (u_char *)mask;
345 	for (x = 0; x < sizeof(*mask); x++) {
346 		if (p[x] != 0xff)
347 			break;
348 	}
349 	y = 0;
350 	if (x < sizeof(*mask)) {
351 		for (y = 0; y < NBBY; y++) {
352 			if ((p[x] & (0x80 >> y)) == 0)
353 				break;
354 		}
355 	}
356 	return x * NBBY + y;
357 }
358 
359 static void
360 in_len2mask(struct in_addr *mask, u_int len)
361 {
362 	u_int i;
363 	u_char *p;
364 
365 	p = (u_char *)mask;
366 	memset(mask, 0, sizeof(*mask));
367 	for (i = 0; i < len / NBBY; i++)
368 		p[i] = 0xff;
369 	if (len % NBBY)
370 		p[i] = (0xff00 >> (len % NBBY)) & 0xff;
371 }
372 
373 /*
374  * Generic internet control operations (ioctl's).
375  * Ifp is 0 if not an interface-specific ioctl.
376  */
377 /* ARGSUSED */
378 static int
379 in_control0(struct socket *so, u_long cmd, void *data, struct ifnet *ifp)
380 {
381 	struct ifreq *ifr = (struct ifreq *)data;
382 	struct in_ifaddr *ia = NULL;
383 	struct in_aliasreq *ifra = (struct in_aliasreq *)data;
384 	struct sockaddr_in oldaddr, *new_dstaddr;
385 	int error, hostIsNew, maskIsNew;
386 	int newifaddr = 0;
387 	bool run_hook = false;
388 	bool need_reinsert = false;
389 	struct psref psref;
390 	int bound;
391 
392 	switch (cmd) {
393 	case SIOCALIFADDR:
394 	case SIOCDLIFADDR:
395 	case SIOCGLIFADDR:
396 		if (ifp == NULL)
397 			return EINVAL;
398 		return in_lifaddr_ioctl(so, cmd, data, ifp);
399 	case SIOCGIFADDRPREF:
400 	case SIOCSIFADDRPREF:
401 		if (ifp == NULL)
402 			return EINVAL;
403 		return ifaddrpref_ioctl(so, cmd, data, ifp);
404 	}
405 
406 	bound = curlwp_bind();
407 	/*
408 	 * Find address for this interface, if it exists.
409 	 */
410 	if (ifp != NULL)
411 		ia = in_get_ia_from_ifp_psref(ifp, &psref);
412 
413 	hostIsNew = 1;		/* moved here to appease gcc */
414 	switch (cmd) {
415 	case SIOCAIFADDR:
416 	case SIOCDIFADDR:
417 	case SIOCGIFALIAS:
418 	case SIOCGIFAFLAG_IN:
419 		if (ifra->ifra_addr.sin_family == AF_INET) {
420 			int s;
421 
422 			if (ia != NULL)
423 				ia4_release(ia, &psref);
424 			s = pserialize_read_enter();
425 			IN_ADDRHASH_READER_FOREACH(ia,
426 			    ifra->ifra_addr.sin_addr.s_addr) {
427 				if (ia->ia_ifp == ifp &&
428 				    in_hosteq(ia->ia_addr.sin_addr,
429 				    ifra->ifra_addr.sin_addr))
430 					break;
431 			}
432 			if (ia != NULL)
433 				ia4_acquire(ia, &psref);
434 			pserialize_read_exit(s);
435 		}
436 		if ((cmd == SIOCDIFADDR ||
437 		    cmd == SIOCGIFALIAS ||
438 		    cmd == SIOCGIFAFLAG_IN) &&
439 		    ia == NULL) {
440 			error = EADDRNOTAVAIL;
441 			goto out;
442 		}
443 
444 		if (cmd == SIOCDIFADDR &&
445 		    ifra->ifra_addr.sin_family == AF_UNSPEC) {
446 			ifra->ifra_addr.sin_family = AF_INET;
447 		}
448 		/* FALLTHROUGH */
449 	case SIOCSIFADDR:
450 		if (ia == NULL || ia->ia_addr.sin_family != AF_INET)
451 			;
452 		else if (ifra->ifra_addr.sin_len == 0) {
453 			ifra->ifra_addr = ia->ia_addr;
454 			hostIsNew = 0;
455 		} else if (in_hosteq(ia->ia_addr.sin_addr,
456 		           ifra->ifra_addr.sin_addr))
457 			hostIsNew = 0;
458 		/* FALLTHROUGH */
459 	case SIOCSIFDSTADDR:
460 		if (ifra->ifra_addr.sin_family != AF_INET) {
461 			error = EAFNOSUPPORT;
462 			goto out;
463 		}
464 		/* FALLTHROUGH */
465 	case SIOCSIFNETMASK:
466 		if (ifp == NULL)
467 			panic("in_control");
468 
469 		if (cmd == SIOCGIFALIAS || cmd == SIOCGIFAFLAG_IN)
470 			break;
471 
472 		if (ia == NULL &&
473 		    (cmd == SIOCSIFNETMASK || cmd == SIOCSIFDSTADDR)) {
474 			error = EADDRNOTAVAIL;
475 			goto out;
476 		}
477 
478 		if (kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_INTERFACE,
479 		    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd,
480 		    NULL) != 0) {
481 			error = EPERM;
482 			goto out;
483 		}
484 
485 		if (ia == NULL) {
486 			ia = malloc(sizeof(*ia), M_IFADDR, M_WAITOK|M_ZERO);
487 			if (ia == NULL) {
488 				error = ENOBUFS;
489 				goto out;
490 			}
491 			ia->ia_ifa.ifa_addr = sintosa(&ia->ia_addr);
492 			ia->ia_ifa.ifa_dstaddr = sintosa(&ia->ia_dstaddr);
493 			ia->ia_ifa.ifa_netmask = sintosa(&ia->ia_sockmask);
494 #ifdef IPSELSRC
495 			ia->ia_ifa.ifa_getifa = in_getifa;
496 #else /* IPSELSRC */
497 			ia->ia_ifa.ifa_getifa = NULL;
498 #endif /* IPSELSRC */
499 			ia->ia_sockmask.sin_len = 8;
500 			ia->ia_sockmask.sin_family = AF_INET;
501 			if (ifp->if_flags & IFF_BROADCAST) {
502 				ia->ia_broadaddr.sin_len = sizeof(ia->ia_addr);
503 				ia->ia_broadaddr.sin_family = AF_INET;
504 			}
505 			ia->ia_ifp = ifp;
506 			ia->ia_idsalt = cprng_fast32() % 65535;
507 			LIST_INIT(&ia->ia_multiaddrs);
508 			IN_ADDRHASH_ENTRY_INIT(ia);
509 			IN_ADDRLIST_ENTRY_INIT(ia);
510 			ifa_psref_init(&ia->ia_ifa);
511 
512 			newifaddr = 1;
513 		}
514 		break;
515 
516 	case SIOCSIFBRDADDR:
517 		if (kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_INTERFACE,
518 		    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd,
519 		    NULL) != 0) {
520 			error = EPERM;
521 			goto out;
522 		}
523 		/* FALLTHROUGH */
524 
525 	case SIOCGIFADDR:
526 	case SIOCGIFNETMASK:
527 	case SIOCGIFDSTADDR:
528 	case SIOCGIFBRDADDR:
529 		if (ia == NULL) {
530 			error = EADDRNOTAVAIL;
531 			goto out;
532 		}
533 		break;
534 	}
535 	error = 0;
536 	switch (cmd) {
537 
538 	case SIOCGIFADDR:
539 		ifreq_setaddr(cmd, ifr, sintocsa(&ia->ia_addr));
540 		break;
541 
542 	case SIOCGIFBRDADDR:
543 		if ((ifp->if_flags & IFF_BROADCAST) == 0) {
544 			error = EINVAL;
545 			goto out;
546 		}
547 		ifreq_setdstaddr(cmd, ifr, sintocsa(&ia->ia_broadaddr));
548 		break;
549 
550 	case SIOCGIFDSTADDR:
551 		if ((ifp->if_flags & IFF_POINTOPOINT) == 0) {
552 			error = EINVAL;
553 			goto out;
554 		}
555 		ifreq_setdstaddr(cmd, ifr, sintocsa(&ia->ia_dstaddr));
556 		break;
557 
558 	case SIOCGIFNETMASK:
559 		/*
560 		 * We keep the number of trailing zero bytes the sin_len field
561 		 * of ia_sockmask, so we fix this before we pass it back to
562 		 * userland.
563 		 */
564 		oldaddr = ia->ia_sockmask;
565 		oldaddr.sin_len = sizeof(struct sockaddr_in);
566 		ifreq_setaddr(cmd, ifr, (const void *)&oldaddr);
567 		break;
568 
569 	case SIOCSIFDSTADDR:
570 		if ((ifp->if_flags & IFF_POINTOPOINT) == 0) {
571 			error = EINVAL;
572 			goto out;
573 		}
574 		oldaddr = ia->ia_dstaddr;
575 		ia->ia_dstaddr = *satocsin(ifreq_getdstaddr(cmd, ifr));
576 		if ((error = if_addr_init(ifp, &ia->ia_ifa, false)) != 0) {
577 			ia->ia_dstaddr = oldaddr;
578 			goto out;
579 		}
580 		if (ia->ia_flags & IFA_ROUTE) {
581 			ia->ia_ifa.ifa_dstaddr = sintosa(&oldaddr);
582 			rtinit(&ia->ia_ifa, RTM_DELETE, RTF_HOST);
583 			ia->ia_ifa.ifa_dstaddr = sintosa(&ia->ia_dstaddr);
584 			rtinit(&ia->ia_ifa, RTM_ADD, RTF_HOST|RTF_UP);
585 		}
586 		break;
587 
588 	case SIOCSIFBRDADDR:
589 		if ((ifp->if_flags & IFF_BROADCAST) == 0) {
590 			error = EINVAL;
591 			goto out;
592 		}
593 		ia->ia_broadaddr = *satocsin(ifreq_getbroadaddr(cmd, ifr));
594 		break;
595 
596 	case SIOCSIFADDR:
597 		if (!newifaddr) {
598 			mutex_enter(&in_ifaddr_lock);
599 			LIST_REMOVE(ia, ia_hash);
600 			IN_ADDRHASH_WRITER_REMOVE(ia);
601 			mutex_exit(&in_ifaddr_lock);
602 			need_reinsert = true;
603 		}
604 		error = in_ifinit(ifp, ia, satocsin(ifreq_getaddr(cmd, ifr)),
605 		    NULL, 1);
606 
607 		run_hook = true;
608 		break;
609 
610 	case SIOCSIFNETMASK:
611 		in_scrubprefix(ia);
612 		ia->ia_sockmask = *satocsin(ifreq_getaddr(cmd, ifr));
613 		ia->ia_subnetmask = ia->ia_sockmask.sin_addr.s_addr;
614 		if (!newifaddr) {
615 			mutex_enter(&in_ifaddr_lock);
616 			LIST_REMOVE(ia, ia_hash);
617 			IN_ADDRHASH_WRITER_REMOVE(ia);
618 			mutex_exit(&in_ifaddr_lock);
619 			need_reinsert = true;
620 		}
621 		error = in_ifinit(ifp, ia, NULL, NULL, 0);
622 		break;
623 
624 	case SIOCAIFADDR:
625 		maskIsNew = 0;
626 		if (ifra->ifra_mask.sin_len) {
627 			in_scrubprefix(ia);
628 			ia->ia_sockmask = ifra->ifra_mask;
629 			ia->ia_subnetmask = ia->ia_sockmask.sin_addr.s_addr;
630 			maskIsNew = 1;
631 		}
632 		if ((ifp->if_flags & IFF_POINTOPOINT) &&
633 		    (ifra->ifra_dstaddr.sin_family == AF_INET)) {
634 			new_dstaddr = &ifra->ifra_dstaddr;
635 			maskIsNew  = 1; /* We lie; but the effect's the same */
636 		} else
637 			new_dstaddr = NULL;
638 		if (ifra->ifra_addr.sin_family == AF_INET &&
639 		    (hostIsNew || maskIsNew)) {
640 			if (!newifaddr) {
641 				mutex_enter(&in_ifaddr_lock);
642 				LIST_REMOVE(ia, ia_hash);
643 				IN_ADDRHASH_WRITER_REMOVE(ia);
644 				mutex_exit(&in_ifaddr_lock);
645 				need_reinsert = true;
646 			}
647 			error = in_ifinit(ifp, ia, &ifra->ifra_addr,
648 			    new_dstaddr, 0);
649 		}
650 		if ((ifp->if_flags & IFF_BROADCAST) &&
651 		    (ifra->ifra_broadaddr.sin_family == AF_INET))
652 			ia->ia_broadaddr = ifra->ifra_broadaddr;
653 		run_hook = true;
654 		break;
655 
656 	case SIOCGIFALIAS:
657 		ifra->ifra_mask = ia->ia_sockmask;
658 		if ((ifp->if_flags & IFF_POINTOPOINT) &&
659 		    (ia->ia_dstaddr.sin_family == AF_INET))
660 			ifra->ifra_dstaddr = ia->ia_dstaddr;
661 		else if ((ifp->if_flags & IFF_BROADCAST) &&
662 		    (ia->ia_broadaddr.sin_family == AF_INET))
663 			ifra->ifra_broadaddr = ia->ia_broadaddr;
664 		else
665 			memset(&ifra->ifra_broadaddr, 0,
666 			      sizeof(ifra->ifra_broadaddr));
667 		break;
668 
669 	case SIOCGIFAFLAG_IN:
670 		ifr->ifr_addrflags = ia->ia4_flags;
671 		break;
672 
673 	case SIOCDIFADDR:
674 		ia4_release(ia, &psref);
675 		in_purgeaddr(&ia->ia_ifa);
676 		ia = NULL;
677 		run_hook = true;
678 		break;
679 
680 #ifdef MROUTING
681 	case SIOCGETVIFCNT:
682 	case SIOCGETSGCNT:
683 		error = mrt_ioctl(so, cmd, data);
684 		break;
685 #endif /* MROUTING */
686 
687 	default:
688 		error = ENOTTY;
689 		goto out;
690 	}
691 
692 	/*
693 	 * XXX insert regardless of error to make in_purgeaddr below work.
694 	 * Need to improve.
695 	 */
696 	if (newifaddr) {
697 		ifaref(&ia->ia_ifa);
698 		ifa_insert(ifp, &ia->ia_ifa);
699 
700 		mutex_enter(&in_ifaddr_lock);
701 		TAILQ_INSERT_TAIL(&in_ifaddrhead, ia, ia_list);
702 		IN_ADDRLIST_WRITER_INSERT_TAIL(ia);
703 		LIST_INSERT_HEAD(&IN_IFADDR_HASH(ia->ia_addr.sin_addr.s_addr),
704 		    ia, ia_hash);
705 		IN_ADDRHASH_WRITER_INSERT_HEAD(ia);
706 		mutex_exit(&in_ifaddr_lock);
707 	} else if (need_reinsert) {
708 		mutex_enter(&in_ifaddr_lock);
709 		LIST_INSERT_HEAD(&IN_IFADDR_HASH(ia->ia_addr.sin_addr.s_addr),
710 		    ia, ia_hash);
711 		IN_ADDRHASH_WRITER_INSERT_HEAD(ia);
712 		mutex_exit(&in_ifaddr_lock);
713 	}
714 
715 	if (error == 0) {
716 		if (run_hook)
717 			(void)pfil_run_hooks(if_pfil,
718 			    (struct mbuf **)cmd, ifp, PFIL_IFADDR);
719 	} else if (newifaddr) {
720 		KASSERT(ia != NULL);
721 		in_purgeaddr(&ia->ia_ifa);
722 		ia = NULL;
723 	}
724 
725 out:
726 	if (!newifaddr && ia != NULL)
727 		ia4_release(ia, &psref);
728 	curlwp_bindx(bound);
729 	return error;
730 }
731 
732 int
733 in_control(struct socket *so, u_long cmd, void *data, struct ifnet *ifp)
734 {
735 	int error;
736 
737 	mutex_enter(softnet_lock);
738 	error = in_control0(so, cmd, data, ifp);
739 	mutex_exit(softnet_lock);
740 
741 	return error;
742 }
743 
744 /* Add ownaddr as loopback rtentry. */
745 static void
746 in_ifaddlocal(struct ifaddr *ifa)
747 {
748 	struct in_ifaddr *ia;
749 
750 	ia = (struct in_ifaddr *)ifa;
751 	if (ia->ia_addr.sin_addr.s_addr == INADDR_ANY ||
752 	    (ia->ia_ifp->if_flags & IFF_POINTOPOINT &&
753 	    in_hosteq(ia->ia_dstaddr.sin_addr, ia->ia_addr.sin_addr)))
754 	{
755 		rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
756 		return;
757 	}
758 
759 	rt_ifa_addlocal(ifa);
760 }
761 
762 /* Remove loopback entry of ownaddr */
763 static void
764 in_ifremlocal(struct ifaddr *ifa)
765 {
766 	struct in_ifaddr *ia, *p;
767 	struct ifaddr *alt_ifa = NULL;
768 	int ia_count = 0;
769 	int s;
770 	struct psref psref;
771 	int bound = curlwp_bind();
772 
773 	ia = (struct in_ifaddr *)ifa;
774 	/* Delete the entry if exactly one ifaddr matches the
775 	 * address, ifa->ifa_addr. */
776 	s = pserialize_read_enter();
777 	IN_ADDRLIST_READER_FOREACH(p) {
778 		if (!in_hosteq(p->ia_addr.sin_addr, ia->ia_addr.sin_addr))
779 			continue;
780 		if (p->ia_ifp != ia->ia_ifp)
781 			alt_ifa = &p->ia_ifa;
782 		if (++ia_count > 1 && alt_ifa != NULL)
783 			break;
784 	}
785 	if (alt_ifa != NULL && ia_count > 1)
786 		ifa_acquire(alt_ifa, &psref);
787 	pserialize_read_exit(s);
788 
789 	if (ia_count == 0)
790 		goto out;
791 
792 	rt_ifa_remlocal(ifa, ia_count == 1 ? NULL : alt_ifa);
793 	if (alt_ifa != NULL && ia_count > 1)
794 		ifa_release(alt_ifa, &psref);
795 out:
796 	curlwp_bindx(bound);
797 }
798 
799 static void
800 in_scrubaddr(struct in_ifaddr *ia)
801 {
802 
803 	/* stop DAD processing */
804 	if (ia->ia_dad_stop != NULL)
805 		ia->ia_dad_stop(&ia->ia_ifa);
806 
807 	in_scrubprefix(ia);
808 	in_ifremlocal(&ia->ia_ifa);
809 
810 	if (ia->ia_allhosts != NULL) {
811 		in_delmulti(ia->ia_allhosts);
812 		ia->ia_allhosts = NULL;
813 	}
814 }
815 
816 /*
817  * Depends on it isn't called in concurrent. It should be guaranteed
818  * by ifa->ifa_ifp's ioctl lock. The possible callers are in_control
819  * and if_purgeaddrs; the former is called iva ifa->ifa_ifp's ioctl
820  * and the latter is called via ifa->ifa_ifp's if_detach. The functions
821  * never be executed in concurrent.
822  */
823 void
824 in_purgeaddr(struct ifaddr *ifa)
825 {
826 	struct in_ifaddr *ia = (void *) ifa;
827 	struct ifnet *ifp = ifa->ifa_ifp;
828 
829 	KASSERT(!ifa_held(ifa));
830 
831 	in_scrubaddr(ia);
832 
833 	mutex_enter(&in_ifaddr_lock);
834 	LIST_REMOVE(ia, ia_hash);
835 	IN_ADDRHASH_WRITER_REMOVE(ia);
836 	TAILQ_REMOVE(&in_ifaddrhead, ia, ia_list);
837 	IN_ADDRLIST_WRITER_REMOVE(ia);
838 	ifa_remove(ifp, &ia->ia_ifa);
839 	mutex_exit(&in_ifaddr_lock);
840 
841 	IN_ADDRHASH_ENTRY_DESTROY(ia);
842 	IN_ADDRLIST_ENTRY_DESTROY(ia);
843 	ifafree(&ia->ia_ifa);
844 	in_setmaxmtu();
845 }
846 
847 void
848 in_purgeif(struct ifnet *ifp)		/* MUST be called at splsoftnet() */
849 {
850 	if_purgeaddrs(ifp, AF_INET, in_purgeaddr);
851 	igmp_purgeif(ifp);		/* manipulates pools */
852 #ifdef MROUTING
853 	ip_mrouter_detach(ifp);
854 #endif
855 }
856 
857 /*
858  * SIOC[GAD]LIFADDR.
859  *	SIOCGLIFADDR: get first address. (???)
860  *	SIOCGLIFADDR with IFLR_PREFIX:
861  *		get first address that matches the specified prefix.
862  *	SIOCALIFADDR: add the specified address.
863  *	SIOCALIFADDR with IFLR_PREFIX:
864  *		EINVAL since we can't deduce hostid part of the address.
865  *	SIOCDLIFADDR: delete the specified address.
866  *	SIOCDLIFADDR with IFLR_PREFIX:
867  *		delete the first address that matches the specified prefix.
868  * return values:
869  *	EINVAL on invalid parameters
870  *	EADDRNOTAVAIL on prefix match failed/specified address not found
871  *	other values may be returned from in_ioctl()
872  */
873 static int
874 in_lifaddr_ioctl(struct socket *so, u_long cmd, void *data,
875     struct ifnet *ifp)
876 {
877 	struct if_laddrreq *iflr = (struct if_laddrreq *)data;
878 	struct ifaddr *ifa;
879 	struct sockaddr *sa;
880 
881 	/* sanity checks */
882 	if (data == NULL || ifp == NULL) {
883 		panic("invalid argument to in_lifaddr_ioctl");
884 		/*NOTRECHED*/
885 	}
886 
887 	switch (cmd) {
888 	case SIOCGLIFADDR:
889 		/* address must be specified on GET with IFLR_PREFIX */
890 		if ((iflr->flags & IFLR_PREFIX) == 0)
891 			break;
892 		/*FALLTHROUGH*/
893 	case SIOCALIFADDR:
894 	case SIOCDLIFADDR:
895 		/* address must be specified on ADD and DELETE */
896 		sa = (struct sockaddr *)&iflr->addr;
897 		if (sa->sa_family != AF_INET)
898 			return EINVAL;
899 		if (sa->sa_len != sizeof(struct sockaddr_in))
900 			return EINVAL;
901 		/* XXX need improvement */
902 		sa = (struct sockaddr *)&iflr->dstaddr;
903 		if (sa->sa_family != AF_UNSPEC && sa->sa_family != AF_INET)
904 			return EINVAL;
905 		if (sa->sa_len != 0 && sa->sa_len != sizeof(struct sockaddr_in))
906 			return EINVAL;
907 		break;
908 	default: /*shouldn't happen*/
909 #if 0
910 		panic("invalid cmd to in_lifaddr_ioctl");
911 		/*NOTREACHED*/
912 #else
913 		return EOPNOTSUPP;
914 #endif
915 	}
916 	if (sizeof(struct in_addr) * NBBY < iflr->prefixlen)
917 		return EINVAL;
918 
919 	switch (cmd) {
920 	case SIOCALIFADDR:
921 	    {
922 		struct in_aliasreq ifra;
923 
924 		if (iflr->flags & IFLR_PREFIX)
925 			return EINVAL;
926 
927 		/* copy args to in_aliasreq, perform ioctl(SIOCAIFADDR). */
928 		memset(&ifra, 0, sizeof(ifra));
929 		memcpy(ifra.ifra_name, iflr->iflr_name,
930 			sizeof(ifra.ifra_name));
931 
932 		memcpy(&ifra.ifra_addr, &iflr->addr,
933 			((struct sockaddr *)&iflr->addr)->sa_len);
934 
935 		if (((struct sockaddr *)&iflr->dstaddr)->sa_family) {	/*XXX*/
936 			memcpy(&ifra.ifra_dstaddr, &iflr->dstaddr,
937 				((struct sockaddr *)&iflr->dstaddr)->sa_len);
938 		}
939 
940 		ifra.ifra_mask.sin_family = AF_INET;
941 		ifra.ifra_mask.sin_len = sizeof(struct sockaddr_in);
942 		in_len2mask(&ifra.ifra_mask.sin_addr, iflr->prefixlen);
943 
944 		return in_control(so, SIOCAIFADDR, &ifra, ifp);
945 	    }
946 	case SIOCGLIFADDR:
947 	case SIOCDLIFADDR:
948 	    {
949 		struct in_ifaddr *ia;
950 		struct in_addr mask, candidate, match;
951 		struct sockaddr_in *sin;
952 		int cmp, s;
953 
954 		memset(&mask, 0, sizeof(mask));
955 		memset(&match, 0, sizeof(match));	/* XXX gcc */
956 		if (iflr->flags & IFLR_PREFIX) {
957 			/* lookup a prefix rather than address. */
958 			in_len2mask(&mask, iflr->prefixlen);
959 
960 			sin = (struct sockaddr_in *)&iflr->addr;
961 			match.s_addr = sin->sin_addr.s_addr;
962 			match.s_addr &= mask.s_addr;
963 
964 			/* if you set extra bits, that's wrong */
965 			if (match.s_addr != sin->sin_addr.s_addr)
966 				return EINVAL;
967 
968 			cmp = 1;
969 		} else {
970 			if (cmd == SIOCGLIFADDR) {
971 				/* on getting an address, take the 1st match */
972 				cmp = 0;	/*XXX*/
973 			} else {
974 				/* on deleting an address, do exact match */
975 				in_len2mask(&mask, 32);
976 				sin = (struct sockaddr_in *)&iflr->addr;
977 				match.s_addr = sin->sin_addr.s_addr;
978 
979 				cmp = 1;
980 			}
981 		}
982 
983 		s = pserialize_read_enter();
984 		IFADDR_READER_FOREACH(ifa, ifp) {
985 			if (ifa->ifa_addr->sa_family != AF_INET)
986 				continue;
987 			if (cmp == 0)
988 				break;
989 			candidate.s_addr = ((struct sockaddr_in *)ifa->ifa_addr)->sin_addr.s_addr;
990 			candidate.s_addr &= mask.s_addr;
991 			if (candidate.s_addr == match.s_addr)
992 				break;
993 		}
994 		if (ifa == NULL) {
995 			pserialize_read_exit(s);
996 			return EADDRNOTAVAIL;
997 		}
998 		ia = (struct in_ifaddr *)ifa;
999 
1000 		if (cmd == SIOCGLIFADDR) {
1001 			/* fill in the if_laddrreq structure */
1002 			memcpy(&iflr->addr, &ia->ia_addr, ia->ia_addr.sin_len);
1003 
1004 			if ((ifp->if_flags & IFF_POINTOPOINT) != 0) {
1005 				memcpy(&iflr->dstaddr, &ia->ia_dstaddr,
1006 					ia->ia_dstaddr.sin_len);
1007 			} else
1008 				memset(&iflr->dstaddr, 0, sizeof(iflr->dstaddr));
1009 
1010 			iflr->prefixlen =
1011 				in_mask2len(&ia->ia_sockmask.sin_addr);
1012 
1013 			iflr->flags = 0;	/*XXX*/
1014 			pserialize_read_exit(s);
1015 
1016 			return 0;
1017 		} else {
1018 			struct in_aliasreq ifra;
1019 
1020 			/* fill in_aliasreq and do ioctl(SIOCDIFADDR) */
1021 			memset(&ifra, 0, sizeof(ifra));
1022 			memcpy(ifra.ifra_name, iflr->iflr_name,
1023 				sizeof(ifra.ifra_name));
1024 
1025 			memcpy(&ifra.ifra_addr, &ia->ia_addr,
1026 				ia->ia_addr.sin_len);
1027 			if ((ifp->if_flags & IFF_POINTOPOINT) != 0) {
1028 				memcpy(&ifra.ifra_dstaddr, &ia->ia_dstaddr,
1029 					ia->ia_dstaddr.sin_len);
1030 			}
1031 			memcpy(&ifra.ifra_dstaddr, &ia->ia_sockmask,
1032 				ia->ia_sockmask.sin_len);
1033 			pserialize_read_exit(s);
1034 
1035 			return in_control(so, SIOCDIFADDR, &ifra, ifp);
1036 		}
1037 	    }
1038 	}
1039 
1040 	return EOPNOTSUPP;	/*just for safety*/
1041 }
1042 
1043 /*
1044  * Initialize an interface's internet address
1045  * and routing table entry.
1046  */
1047 int
1048 in_ifinit(struct ifnet *ifp, struct in_ifaddr *ia,
1049     const struct sockaddr_in *sin, const struct sockaddr_in *dst, int scrub)
1050 {
1051 	u_int32_t i;
1052 	struct sockaddr_in oldaddr, olddst;
1053 	int s, oldflags, flags = RTF_UP, error, hostIsNew;
1054 
1055 	if (sin == NULL)
1056 		sin = &ia->ia_addr;
1057 	if (dst == NULL)
1058 		dst = &ia->ia_dstaddr;
1059 
1060 	/*
1061 	 * Set up new addresses.
1062 	 */
1063 	oldaddr = ia->ia_addr;
1064 	olddst = ia->ia_dstaddr;
1065 	oldflags = ia->ia4_flags;
1066 	ia->ia_addr = *sin;
1067 	ia->ia_dstaddr = *dst;
1068 	hostIsNew = oldaddr.sin_family != AF_INET ||
1069 	    !in_hosteq(ia->ia_addr.sin_addr, oldaddr.sin_addr);
1070 	if (!scrub)
1071 		scrub = oldaddr.sin_family != ia->ia_dstaddr.sin_family ||
1072 		    !in_hosteq(ia->ia_dstaddr.sin_addr, olddst.sin_addr);
1073 
1074 	/*
1075 	 * Configure address flags.
1076 	 * We need to do this early because they maybe adjusted
1077 	 * by if_addr_init depending on the address.
1078 	 */
1079 	if (ia->ia4_flags & IN_IFF_DUPLICATED) {
1080 		ia->ia4_flags &= ~IN_IFF_DUPLICATED;
1081 		hostIsNew = 1;
1082 	}
1083 	if (ifp->if_link_state == LINK_STATE_DOWN) {
1084 		ia->ia4_flags |= IN_IFF_DETACHED;
1085 		ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1086 	} else if (hostIsNew && if_do_dad(ifp))
1087 		ia->ia4_flags |= IN_IFF_TRYTENTATIVE;
1088 
1089 	/*
1090 	 * Give the interface a chance to initialize
1091 	 * if this is its first address,
1092 	 * and to validate the address if necessary.
1093 	 */
1094 	s = splnet();
1095 	error = if_addr_init(ifp, &ia->ia_ifa, true);
1096 	splx(s);
1097 	/* Now clear the try tentative flag, it's job is done. */
1098 	ia->ia4_flags &= ~IN_IFF_TRYTENTATIVE;
1099 	if (error != 0) {
1100 		ia->ia_addr = oldaddr;
1101 		ia->ia_dstaddr = olddst;
1102 		ia->ia4_flags = oldflags;
1103 		return error;
1104 	}
1105 
1106 	if (scrub || hostIsNew) {
1107 		int newflags = ia->ia4_flags;
1108 
1109 		ia->ia_ifa.ifa_addr = sintosa(&oldaddr);
1110 		ia->ia_ifa.ifa_dstaddr = sintosa(&olddst);
1111 		ia->ia4_flags = oldflags;
1112 		if (hostIsNew)
1113 			in_scrubaddr(ia);
1114 		else if (scrub)
1115 			in_scrubprefix(ia);
1116 		ia->ia_ifa.ifa_addr = sintosa(&ia->ia_addr);
1117 		ia->ia_ifa.ifa_dstaddr = sintosa(&ia->ia_dstaddr);
1118 		ia->ia4_flags = newflags;
1119 	}
1120 
1121 	/* Add the local route to the address */
1122 	in_ifaddlocal(&ia->ia_ifa);
1123 
1124 	i = ia->ia_addr.sin_addr.s_addr;
1125 	if (ifp->if_flags & IFF_POINTOPOINT)
1126 		ia->ia_netmask = INADDR_BROADCAST;	/* default to /32 */
1127 	else if (IN_CLASSA(i))
1128 		ia->ia_netmask = IN_CLASSA_NET;
1129 	else if (IN_CLASSB(i))
1130 		ia->ia_netmask = IN_CLASSB_NET;
1131 	else
1132 		ia->ia_netmask = IN_CLASSC_NET;
1133 	/*
1134 	 * The subnet mask usually includes at least the standard network part,
1135 	 * but may may be smaller in the case of supernetting.
1136 	 * If it is set, we believe it.
1137 	 */
1138 	if (ia->ia_subnetmask == 0) {
1139 		ia->ia_subnetmask = ia->ia_netmask;
1140 		ia->ia_sockmask.sin_addr.s_addr = ia->ia_subnetmask;
1141 	} else
1142 		ia->ia_netmask &= ia->ia_subnetmask;
1143 
1144 	ia->ia_net = i & ia->ia_netmask;
1145 	ia->ia_subnet = i & ia->ia_subnetmask;
1146 	in_socktrim(&ia->ia_sockmask);
1147 	/* re-calculate the "in_maxmtu" value */
1148 	in_setmaxmtu();
1149 	/*
1150 	 * Add route for the network.
1151 	 */
1152 	ia->ia_ifa.ifa_metric = ifp->if_metric;
1153 	if (ifp->if_flags & IFF_BROADCAST) {
1154 		ia->ia_broadaddr.sin_addr.s_addr =
1155 			ia->ia_subnet | ~ia->ia_subnetmask;
1156 		ia->ia_netbroadcast.s_addr =
1157 			ia->ia_net | ~ia->ia_netmask;
1158 	} else if (ifp->if_flags & IFF_LOOPBACK) {
1159 		ia->ia_dstaddr = ia->ia_addr;
1160 		flags |= RTF_HOST;
1161 	} else if (ifp->if_flags & IFF_POINTOPOINT) {
1162 		if (ia->ia_dstaddr.sin_family != AF_INET)
1163 			return (0);
1164 		flags |= RTF_HOST;
1165 	}
1166 	error = in_addprefix(ia, flags);
1167 	/*
1168 	 * If the interface supports multicast, join the "all hosts"
1169 	 * multicast group on that interface.
1170 	 */
1171 	if ((ifp->if_flags & IFF_MULTICAST) != 0 && ia->ia_allhosts == NULL) {
1172 		struct in_addr addr;
1173 
1174 		addr.s_addr = INADDR_ALLHOSTS_GROUP;
1175 		ia->ia_allhosts = in_addmulti(&addr, ifp);
1176 	}
1177 
1178 	if (hostIsNew &&
1179 	    ia->ia4_flags & IN_IFF_TENTATIVE &&
1180 	    if_do_dad(ifp))
1181 		ia->ia_dad_start((struct ifaddr *)ia);
1182 
1183 	return error;
1184 }
1185 
1186 #define rtinitflags(x) \
1187 	((((x)->ia_ifp->if_flags & (IFF_LOOPBACK | IFF_POINTOPOINT)) != 0) \
1188 	    ? RTF_HOST : 0)
1189 
1190 /*
1191  * add a route to prefix ("connected route" in cisco terminology).
1192  * does nothing if there's some interface address with the same prefix already.
1193  */
1194 static int
1195 in_addprefix(struct in_ifaddr *target, int flags)
1196 {
1197 	struct in_ifaddr *ia;
1198 	struct in_addr prefix, mask, p;
1199 	int error;
1200 	int s;
1201 
1202 	if ((flags & RTF_HOST) != 0)
1203 		prefix = target->ia_dstaddr.sin_addr;
1204 	else {
1205 		prefix = target->ia_addr.sin_addr;
1206 		mask = target->ia_sockmask.sin_addr;
1207 		prefix.s_addr &= mask.s_addr;
1208 	}
1209 
1210 	s = pserialize_read_enter();
1211 	IN_ADDRLIST_READER_FOREACH(ia) {
1212 		if (rtinitflags(ia))
1213 			p = ia->ia_dstaddr.sin_addr;
1214 		else {
1215 			p = ia->ia_addr.sin_addr;
1216 			p.s_addr &= ia->ia_sockmask.sin_addr.s_addr;
1217 		}
1218 
1219 		if (prefix.s_addr != p.s_addr)
1220 			continue;
1221 
1222 		/*
1223 		 * if we got a matching prefix route inserted by other
1224 		 * interface address, we don't need to bother
1225 		 *
1226 		 * XXX RADIX_MPATH implications here? -dyoung
1227 		 */
1228 		if (ia->ia_flags & IFA_ROUTE) {
1229 			pserialize_read_exit(s);
1230 			return 0;
1231 		}
1232 	}
1233 	pserialize_read_exit(s);
1234 
1235 	/*
1236 	 * noone seem to have prefix route.  insert it.
1237 	 */
1238 	error = rtinit(&target->ia_ifa, RTM_ADD, flags);
1239 	if (error == 0)
1240 		target->ia_flags |= IFA_ROUTE;
1241 	else if (error == EEXIST) {
1242 		/*
1243 		 * the fact the route already exists is not an error.
1244 		 */
1245 		error = 0;
1246 	}
1247 	return error;
1248 }
1249 
1250 /*
1251  * remove a route to prefix ("connected route" in cisco terminology).
1252  * re-installs the route by using another interface address, if there's one
1253  * with the same prefix (otherwise we lose the route mistakenly).
1254  */
1255 static int
1256 in_scrubprefix(struct in_ifaddr *target)
1257 {
1258 	struct in_ifaddr *ia;
1259 	struct in_addr prefix, mask, p;
1260 	int error;
1261 	int s;
1262 
1263 	/* If we don't have IFA_ROUTE we have nothing to do */
1264 	if ((target->ia_flags & IFA_ROUTE) == 0)
1265 		return 0;
1266 
1267 	if (rtinitflags(target))
1268 		prefix = target->ia_dstaddr.sin_addr;
1269 	else {
1270 		prefix = target->ia_addr.sin_addr;
1271 		mask = target->ia_sockmask.sin_addr;
1272 		prefix.s_addr &= mask.s_addr;
1273 	}
1274 
1275 	s = pserialize_read_enter();
1276 	IN_ADDRLIST_READER_FOREACH(ia) {
1277 		if (rtinitflags(ia))
1278 			p = ia->ia_dstaddr.sin_addr;
1279 		else {
1280 			p = ia->ia_addr.sin_addr;
1281 			p.s_addr &= ia->ia_sockmask.sin_addr.s_addr;
1282 		}
1283 
1284 		if (prefix.s_addr != p.s_addr)
1285 			continue;
1286 
1287 		/*
1288 		 * if we got a matching prefix route, move IFA_ROUTE to him
1289 		 */
1290 		if ((ia->ia_flags & IFA_ROUTE) == 0) {
1291 			struct psref psref;
1292 			int bound = curlwp_bind();
1293 
1294 			ia4_acquire(ia, &psref);
1295 			pserialize_read_exit(s);
1296 
1297 			rtinit(&target->ia_ifa, RTM_DELETE,
1298 			    rtinitflags(target));
1299 			target->ia_flags &= ~IFA_ROUTE;
1300 
1301 			error = rtinit(&ia->ia_ifa, RTM_ADD,
1302 			    rtinitflags(ia) | RTF_UP);
1303 			if (error == 0)
1304 				ia->ia_flags |= IFA_ROUTE;
1305 
1306 			ia4_release(ia, &psref);
1307 			curlwp_bindx(bound);
1308 
1309 			return error;
1310 		}
1311 	}
1312 	pserialize_read_exit(s);
1313 
1314 	/*
1315 	 * noone seem to have prefix route.  remove it.
1316 	 */
1317 	rtinit(&target->ia_ifa, RTM_DELETE, rtinitflags(target));
1318 	target->ia_flags &= ~IFA_ROUTE;
1319 	return 0;
1320 }
1321 
1322 #undef rtinitflags
1323 
1324 /*
1325  * Return 1 if the address might be a local broadcast address.
1326  */
1327 int
1328 in_broadcast(struct in_addr in, struct ifnet *ifp)
1329 {
1330 	struct ifaddr *ifa;
1331 	int s;
1332 
1333 	KASSERT(ifp != NULL);
1334 
1335 	if (in.s_addr == INADDR_BROADCAST ||
1336 	    in_nullhost(in))
1337 		return 1;
1338 	if ((ifp->if_flags & IFF_BROADCAST) == 0)
1339 		return 0;
1340 	/*
1341 	 * Look through the list of addresses for a match
1342 	 * with a broadcast address.
1343 	 */
1344 #define ia (ifatoia(ifa))
1345 	s = pserialize_read_enter();
1346 	IFADDR_READER_FOREACH(ifa, ifp) {
1347 		if (ifa->ifa_addr->sa_family == AF_INET &&
1348 		    !in_hosteq(in, ia->ia_addr.sin_addr) &&
1349 		    (in_hosteq(in, ia->ia_broadaddr.sin_addr) ||
1350 		     in_hosteq(in, ia->ia_netbroadcast) ||
1351 		     (hostzeroisbroadcast &&
1352 		      /*
1353 		       * Check for old-style (host 0) broadcast.
1354 		       */
1355 		      (in.s_addr == ia->ia_subnet ||
1356 		       in.s_addr == ia->ia_net)))) {
1357 			pserialize_read_exit(s);
1358 			return 1;
1359 		}
1360 	}
1361 	pserialize_read_exit(s);
1362 	return (0);
1363 #undef ia
1364 }
1365 
1366 /*
1367  * perform DAD when interface becomes IFF_UP.
1368  */
1369 void
1370 in_if_link_up(struct ifnet *ifp)
1371 {
1372 	struct ifaddr *ifa;
1373 	struct in_ifaddr *ia;
1374 	int s, bound;
1375 
1376 	/* Ensure it's sane to run DAD */
1377 	if (ifp->if_link_state == LINK_STATE_DOWN)
1378 		return;
1379 	if ((ifp->if_flags & (IFF_UP|IFF_RUNNING)) != (IFF_UP|IFF_RUNNING))
1380 		return;
1381 
1382 	bound = curlwp_bind();
1383 	s = pserialize_read_enter();
1384 	IFADDR_READER_FOREACH(ifa, ifp) {
1385 		struct psref psref;
1386 
1387 		if (ifa->ifa_addr->sa_family != AF_INET)
1388 			continue;
1389 		ifa_acquire(ifa, &psref);
1390 		pserialize_read_exit(s);
1391 
1392 		ia = (struct in_ifaddr *)ifa;
1393 
1394 		/* If detached then mark as tentative */
1395 		if (ia->ia4_flags & IN_IFF_DETACHED) {
1396 			ia->ia4_flags &= ~IN_IFF_DETACHED;
1397 			if (if_do_dad(ifp) && ia->ia_dad_start != NULL)
1398 				ia->ia4_flags |= IN_IFF_TENTATIVE;
1399 			else if ((ia->ia4_flags & IN_IFF_TENTATIVE) == 0)
1400 				rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1401 		}
1402 
1403 		if (ia->ia4_flags & IN_IFF_TENTATIVE) {
1404 			/* Clear the duplicated flag as we're starting DAD. */
1405 			ia->ia4_flags &= ~IN_IFF_DUPLICATED;
1406 			ia->ia_dad_start(ifa);
1407 		}
1408 
1409 		s = pserialize_read_enter();
1410 		ifa_release(ifa, &psref);
1411 	}
1412 	pserialize_read_exit(s);
1413 	curlwp_bindx(bound);
1414 }
1415 
1416 void
1417 in_if_up(struct ifnet *ifp)
1418 {
1419 
1420 	/* interface may not support link state, so bring it up also */
1421 	in_if_link_up(ifp);
1422 }
1423 
1424 /*
1425  * Mark all addresses as detached.
1426  */
1427 void
1428 in_if_link_down(struct ifnet *ifp)
1429 {
1430 	struct ifaddr *ifa;
1431 	struct in_ifaddr *ia;
1432 	int s, bound;
1433 
1434 	bound = curlwp_bind();
1435 	s = pserialize_read_enter();
1436 	IFADDR_READER_FOREACH(ifa, ifp) {
1437 		struct psref psref;
1438 
1439 		if (ifa->ifa_addr->sa_family != AF_INET)
1440 			continue;
1441 		ifa_acquire(ifa, &psref);
1442 		pserialize_read_exit(s);
1443 
1444 		ia = (struct in_ifaddr *)ifa;
1445 
1446 		/* Stop DAD processing */
1447 		if (ia->ia_dad_stop != NULL)
1448 			ia->ia_dad_stop(ifa);
1449 
1450 		/*
1451 		 * Mark the address as detached.
1452 		 */
1453 		if (!(ia->ia4_flags & IN_IFF_DETACHED)) {
1454 			ia->ia4_flags |= IN_IFF_DETACHED;
1455 			ia->ia4_flags &=
1456 			    ~(IN_IFF_TENTATIVE | IN_IFF_DUPLICATED);
1457 			rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1458 		}
1459 
1460 		s = pserialize_read_enter();
1461 		ifa_release(ifa, &psref);
1462 	}
1463 	pserialize_read_exit(s);
1464 	curlwp_bindx(bound);
1465 }
1466 
1467 void
1468 in_if_down(struct ifnet *ifp)
1469 {
1470 
1471 	in_if_link_down(ifp);
1472 }
1473 
1474 void
1475 in_if_link_state_change(struct ifnet *ifp, int link_state)
1476 {
1477 
1478 	switch (link_state) {
1479 	case LINK_STATE_DOWN:
1480 		in_if_link_down(ifp);
1481 		break;
1482 	case LINK_STATE_UP:
1483 		in_if_link_up(ifp);
1484 		break;
1485 	}
1486 }
1487 
1488 /*
1489  * in_lookup_multi: look up the in_multi record for a given IP
1490  * multicast address on a given interface.  If no matching record is
1491  * found, return NULL.
1492  */
1493 struct in_multi *
1494 in_lookup_multi(struct in_addr addr, ifnet_t *ifp)
1495 {
1496 	struct in_multi *inm;
1497 
1498 	KASSERT(rw_lock_held(&in_multilock));
1499 
1500 	LIST_FOREACH(inm, &IN_MULTI_HASH(addr.s_addr, ifp), inm_list) {
1501 		if (in_hosteq(inm->inm_addr, addr) && inm->inm_ifp == ifp)
1502 			break;
1503 	}
1504 	return inm;
1505 }
1506 
1507 /*
1508  * in_multi_group: check whether the address belongs to an IP multicast
1509  * group we are joined on this interface.  Returns true or false.
1510  */
1511 bool
1512 in_multi_group(struct in_addr addr, ifnet_t *ifp, int flags)
1513 {
1514 	bool ingroup;
1515 
1516 	if (__predict_true(flags & IP_IGMP_MCAST) == 0) {
1517 		rw_enter(&in_multilock, RW_READER);
1518 		ingroup = in_lookup_multi(addr, ifp) != NULL;
1519 		rw_exit(&in_multilock);
1520 	} else {
1521 		/* XXX Recursive call from ip_output(). */
1522 		KASSERT(rw_lock_held(&in_multilock));
1523 		ingroup = in_lookup_multi(addr, ifp) != NULL;
1524 	}
1525 	return ingroup;
1526 }
1527 
1528 /*
1529  * Add an address to the list of IP multicast addresses for a given interface.
1530  */
1531 struct in_multi *
1532 in_addmulti(struct in_addr *ap, ifnet_t *ifp)
1533 {
1534 	struct sockaddr_in sin;
1535 	struct in_multi *inm;
1536 
1537 	/*
1538 	 * See if address already in list.
1539 	 */
1540 	rw_enter(&in_multilock, RW_WRITER);
1541 	inm = in_lookup_multi(*ap, ifp);
1542 	if (inm != NULL) {
1543 		/*
1544 		 * Found it; just increment the reference count.
1545 		 */
1546 		inm->inm_refcount++;
1547 		rw_exit(&in_multilock);
1548 		return inm;
1549 	}
1550 
1551 	/*
1552 	 * New address; allocate a new multicast record.
1553 	 */
1554 	inm = pool_get(&inmulti_pool, PR_NOWAIT);
1555 	if (inm == NULL) {
1556 		rw_exit(&in_multilock);
1557 		return NULL;
1558 	}
1559 	inm->inm_addr = *ap;
1560 	inm->inm_ifp = ifp;
1561 	inm->inm_refcount = 1;
1562 
1563 	/*
1564 	 * Ask the network driver to update its multicast reception
1565 	 * filter appropriately for the new address.
1566 	 */
1567 	sockaddr_in_init(&sin, ap, 0);
1568 	if (if_mcast_op(ifp, SIOCADDMULTI, sintosa(&sin)) != 0) {
1569 		rw_exit(&in_multilock);
1570 		pool_put(&inmulti_pool, inm);
1571 		return NULL;
1572 	}
1573 
1574 	/*
1575 	 * Let IGMP know that we have joined a new IP multicast group.
1576 	 */
1577 	if (igmp_joingroup(inm) != 0) {
1578 		rw_exit(&in_multilock);
1579 		pool_put(&inmulti_pool, inm);
1580 		return NULL;
1581 	}
1582 	LIST_INSERT_HEAD(
1583 	    &IN_MULTI_HASH(inm->inm_addr.s_addr, ifp),
1584 	    inm, inm_list);
1585 	in_multientries++;
1586 	rw_exit(&in_multilock);
1587 
1588 	return inm;
1589 }
1590 
1591 /*
1592  * Delete a multicast address record.
1593  */
1594 void
1595 in_delmulti(struct in_multi *inm)
1596 {
1597 	struct sockaddr_in sin;
1598 
1599 	rw_enter(&in_multilock, RW_WRITER);
1600 	if (--inm->inm_refcount > 0) {
1601 		rw_exit(&in_multilock);
1602 		return;
1603 	}
1604 
1605 	/*
1606 	 * No remaining claims to this record; let IGMP know that
1607 	 * we are leaving the multicast group.
1608 	 */
1609 	igmp_leavegroup(inm);
1610 
1611 	/*
1612 	 * Notify the network driver to update its multicast reception
1613 	 * filter.
1614 	 */
1615 	sockaddr_in_init(&sin, &inm->inm_addr, 0);
1616 	if_mcast_op(inm->inm_ifp, SIOCDELMULTI, sintosa(&sin));
1617 
1618 	/*
1619 	 * Unlink from list.
1620 	 */
1621 	LIST_REMOVE(inm, inm_list);
1622 	in_multientries--;
1623 	rw_exit(&in_multilock);
1624 
1625 	pool_put(&inmulti_pool, inm);
1626 }
1627 
1628 /*
1629  * in_next_multi: step through all of the in_multi records, one at a time.
1630  * The current position is remembered in "step", which the caller must
1631  * provide.  in_first_multi(), below, must be called to initialize "step"
1632  * and get the first record.  Both macros return a NULL "inm" when there
1633  * are no remaining records.
1634  */
1635 struct in_multi *
1636 in_next_multi(struct in_multistep *step)
1637 {
1638 	struct in_multi *inm;
1639 
1640 	KASSERT(rw_lock_held(&in_multilock));
1641 
1642 	while (step->i_inm == NULL && step->i_n < IN_MULTI_HASH_SIZE) {
1643 		step->i_inm = LIST_FIRST(&in_multihashtbl[++step->i_n]);
1644 	}
1645 	if ((inm = step->i_inm) != NULL) {
1646 		step->i_inm = LIST_NEXT(inm, inm_list);
1647 	}
1648 	return inm;
1649 }
1650 
1651 struct in_multi *
1652 in_first_multi(struct in_multistep *step)
1653 {
1654 	KASSERT(rw_lock_held(&in_multilock));
1655 
1656 	step->i_n = 0;
1657 	step->i_inm = LIST_FIRST(&in_multihashtbl[0]);
1658 	return in_next_multi(step);
1659 }
1660 
1661 void
1662 in_multi_lock(int op)
1663 {
1664 	rw_enter(&in_multilock, op);
1665 }
1666 
1667 void
1668 in_multi_unlock(void)
1669 {
1670 	rw_exit(&in_multilock);
1671 }
1672 
1673 int
1674 in_multi_lock_held(void)
1675 {
1676 	return rw_lock_held(&in_multilock);
1677 }
1678 
1679 struct in_ifaddr *
1680 in_selectsrc(struct sockaddr_in *sin, struct route *ro,
1681     int soopts, struct ip_moptions *mopts, int *errorp, struct psref *psref)
1682 {
1683 	struct rtentry *rt = NULL;
1684 	struct in_ifaddr *ia = NULL;
1685 
1686 	KASSERT(ISSET(curlwp->l_pflag, LP_BOUND));
1687 	/*
1688          * If route is known or can be allocated now, take the
1689          * source address from the interface.  Otherwise, punt.
1690 	 */
1691 	if ((soopts & SO_DONTROUTE) != 0)
1692 		rtcache_free(ro);
1693 	else {
1694 		union {
1695 			struct sockaddr		dst;
1696 			struct sockaddr_in	dst4;
1697 		} u;
1698 
1699 		sockaddr_in_init(&u.dst4, &sin->sin_addr, 0);
1700 		rt = rtcache_lookup(ro, &u.dst);
1701 	}
1702 	/*
1703 	 * If we found a route, use the address
1704 	 * corresponding to the outgoing interface
1705 	 * unless it is the loopback (in case a route
1706 	 * to our address on another net goes to loopback).
1707 	 *
1708 	 * XXX Is this still true?  Do we care?
1709 	 */
1710 	if (rt != NULL && (rt->rt_ifp->if_flags & IFF_LOOPBACK) == 0) {
1711 		int s;
1712 		struct ifaddr *ifa;
1713 		/*
1714 		 * Just in case. May not need to do this workaround.
1715 		 * Revisit when working on rtentry MP-ification.
1716 		 */
1717 		s = pserialize_read_enter();
1718 		IFADDR_READER_FOREACH(ifa, rt->rt_ifp) {
1719 			if (ifa == rt->rt_ifa)
1720 				break;
1721 		}
1722 		if (ifa != NULL)
1723 			ifa_acquire(ifa, psref);
1724 		pserialize_read_exit(s);
1725 
1726 		ia = ifatoia(ifa);
1727 	}
1728 	if (ia == NULL) {
1729 		u_int16_t fport = sin->sin_port;
1730 		struct ifaddr *ifa;
1731 		int s;
1732 
1733 		sin->sin_port = 0;
1734 		ifa = ifa_ifwithladdr_psref(sintosa(sin), psref);
1735 		sin->sin_port = fport;
1736 		if (ifa == NULL) {
1737 			/* Find 1st non-loopback AF_INET address */
1738 			s = pserialize_read_enter();
1739 			IN_ADDRLIST_READER_FOREACH(ia) {
1740 				if (!(ia->ia_ifp->if_flags & IFF_LOOPBACK))
1741 					break;
1742 			}
1743 			if (ia != NULL)
1744 				ia4_acquire(ia, psref);
1745 			pserialize_read_exit(s);
1746 		} else {
1747 			/* ia is already referenced by psref */
1748 			ia = ifatoia(ifa);
1749 		}
1750 		if (ia == NULL) {
1751 			*errorp = EADDRNOTAVAIL;
1752 			return NULL;
1753 		}
1754 	}
1755 	/*
1756 	 * If the destination address is multicast and an outgoing
1757 	 * interface has been set as a multicast option, use the
1758 	 * address of that interface as our source address.
1759 	 */
1760 	if (IN_MULTICAST(sin->sin_addr.s_addr) && mopts != NULL) {
1761 		struct ip_moptions *imo;
1762 
1763 		imo = mopts;
1764 		if (imo->imo_multicast_if_index != 0) {
1765 			struct ifnet *ifp;
1766 			int s;
1767 
1768 			if (ia != NULL)
1769 				ia4_release(ia, psref);
1770 			s = pserialize_read_enter();
1771 			ifp = if_byindex(imo->imo_multicast_if_index);
1772 			if (ifp != NULL) {
1773 				/* XXX */
1774 				ia = in_get_ia_from_ifp_psref(ifp, psref);
1775 			} else
1776 				ia = NULL;
1777 			if (ia == NULL || ia->ia4_flags & IN_IFF_NOTREADY) {
1778 				pserialize_read_exit(s);
1779 				if (ia != NULL)
1780 					ia4_release(ia, psref);
1781 				*errorp = EADDRNOTAVAIL;
1782 				return NULL;
1783 			}
1784 			pserialize_read_exit(s);
1785 		}
1786 	}
1787 	if (ia->ia_ifa.ifa_getifa != NULL) {
1788 		ia = ifatoia((*ia->ia_ifa.ifa_getifa)(&ia->ia_ifa,
1789 		                                      sintosa(sin)));
1790 		if (ia == NULL) {
1791 			*errorp = EADDRNOTAVAIL;
1792 			return NULL;
1793 		}
1794 		/* FIXME NOMPSAFE */
1795 		ia4_acquire(ia, psref);
1796 	}
1797 #ifdef GETIFA_DEBUG
1798 	else
1799 		printf("%s: missing ifa_getifa\n", __func__);
1800 #endif
1801 	return ia;
1802 }
1803 
1804 #if NARP > 0
1805 
1806 struct in_llentry {
1807 	struct llentry		base;
1808 };
1809 
1810 #define	IN_LLTBL_DEFAULT_HSIZE	32
1811 #define	IN_LLTBL_HASH(k, h) \
1812 	(((((((k >> 8) ^ k) >> 8) ^ k) >> 8) ^ k) & ((h) - 1))
1813 
1814 /*
1815  * Do actual deallocation of @lle.
1816  * Called by LLE_FREE_LOCKED when number of references
1817  * drops to zero.
1818  */
1819 static void
1820 in_lltable_destroy_lle(struct llentry *lle)
1821 {
1822 
1823 	LLE_WUNLOCK(lle);
1824 	LLE_LOCK_DESTROY(lle);
1825 	kmem_intr_free(lle, sizeof(*lle));
1826 }
1827 
1828 static struct llentry *
1829 in_lltable_new(struct in_addr addr4, u_int flags)
1830 {
1831 	struct in_llentry *lle;
1832 
1833 	lle = kmem_intr_zalloc(sizeof(*lle), KM_NOSLEEP);
1834 	if (lle == NULL)		/* NB: caller generates msg */
1835 		return NULL;
1836 
1837 	/*
1838 	 * For IPv4 this will trigger "arpresolve" to generate
1839 	 * an ARP request.
1840 	 */
1841 	lle->base.la_expire = time_uptime; /* mark expired */
1842 	lle->base.r_l3addr.addr4 = addr4;
1843 	lle->base.lle_refcnt = 1;
1844 	lle->base.lle_free = in_lltable_destroy_lle;
1845 	LLE_LOCK_INIT(&lle->base);
1846 	callout_init(&lle->base.la_timer, CALLOUT_MPSAFE);
1847 
1848 	return (&lle->base);
1849 }
1850 
1851 #define IN_ARE_MASKED_ADDR_EQUAL(d, a, m)	(			\
1852 	    (((ntohl((d).s_addr) ^ (a)->sin_addr.s_addr) & (m)->sin_addr.s_addr)) == 0 )
1853 
1854 static int
1855 in_lltable_match_prefix(const struct sockaddr *prefix,
1856     const struct sockaddr *mask, u_int flags, struct llentry *lle)
1857 {
1858 	const struct sockaddr_in *pfx = (const struct sockaddr_in *)prefix;
1859 	const struct sockaddr_in *msk = (const struct sockaddr_in *)mask;
1860 
1861 	/*
1862 	 * (flags & LLE_STATIC) means deleting all entries
1863 	 * including static ARP entries.
1864 	 */
1865 	if (IN_ARE_MASKED_ADDR_EQUAL(lle->r_l3addr.addr4, pfx, msk) &&
1866 	    ((flags & LLE_STATIC) || !(lle->la_flags & LLE_STATIC)))
1867 		return (1);
1868 
1869 	return (0);
1870 }
1871 
1872 static void
1873 in_lltable_free_entry(struct lltable *llt, struct llentry *lle)
1874 {
1875 	struct ifnet *ifp __diagused;
1876 	size_t pkts_dropped;
1877 
1878 	LLE_WLOCK_ASSERT(lle);
1879 	KASSERT(llt != NULL);
1880 
1881 	/* Unlink entry from table if not already */
1882 	if ((lle->la_flags & LLE_LINKED) != 0) {
1883 		ifp = llt->llt_ifp;
1884 		IF_AFDATA_WLOCK_ASSERT(ifp);
1885 		lltable_unlink_entry(llt, lle);
1886 	}
1887 
1888 	/* cancel timer */
1889 	if (callout_halt(&lle->lle_timer, &lle->lle_lock))
1890 		LLE_REMREF(lle);
1891 
1892 	/* Drop hold queue */
1893 	pkts_dropped = llentry_free(lle);
1894 	arp_stat_add(ARP_STAT_DFRDROPPED, (uint64_t)pkts_dropped);
1895 }
1896 
1897 static int
1898 in_lltable_rtcheck(struct ifnet *ifp, u_int flags, const struct sockaddr *l3addr)
1899 {
1900 	struct rtentry *rt;
1901 	int error = EINVAL;
1902 
1903 	KASSERTMSG(l3addr->sa_family == AF_INET,
1904 	    "sin_family %d", l3addr->sa_family);
1905 
1906 	rt = rtalloc1(l3addr, 0);
1907 	if (rt == NULL)
1908 		return error;
1909 
1910 	/*
1911 	 * If the gateway for an existing host route matches the target L3
1912 	 * address, which is a special route inserted by some implementation
1913 	 * such as MANET, and the interface is of the correct type, then
1914 	 * allow for ARP to proceed.
1915 	 */
1916 	if (rt->rt_flags & RTF_GATEWAY) {
1917 		if (!(rt->rt_flags & RTF_HOST) || !rt->rt_ifp ||
1918 		    rt->rt_ifp->if_type != IFT_ETHER ||
1919 #ifdef __FreeBSD__
1920 		    (rt->rt_ifp->if_flags & (IFF_NOARP | IFF_STATICARP)) != 0 ||
1921 #else
1922 		    (rt->rt_ifp->if_flags & IFF_NOARP) != 0 ||
1923 #endif
1924 		    memcmp(rt->rt_gateway->sa_data, l3addr->sa_data,
1925 		    sizeof(in_addr_t)) != 0) {
1926 			goto error;
1927 		}
1928 	}
1929 
1930 	/*
1931 	 * Make sure that at least the destination address is covered
1932 	 * by the route. This is for handling the case where 2 or more
1933 	 * interfaces have the same prefix. An incoming packet arrives
1934 	 * on one interface and the corresponding outgoing packet leaves
1935 	 * another interface.
1936 	 */
1937 	if (!(rt->rt_flags & RTF_HOST) && rt->rt_ifp != ifp) {
1938 		const char *sa, *mask, *addr, *lim;
1939 		int len;
1940 
1941 		mask = (const char *)rt_mask(rt);
1942 		/*
1943 		 * Just being extra cautious to avoid some custom
1944 		 * code getting into trouble.
1945 		 */
1946 		if (mask == NULL)
1947 			goto error;
1948 
1949 		sa = (const char *)rt_getkey(rt);
1950 		addr = (const char *)l3addr;
1951 		len = ((const struct sockaddr_in *)l3addr)->sin_len;
1952 		lim = addr + len;
1953 
1954 		for ( ; addr < lim; sa++, mask++, addr++) {
1955 			if ((*sa ^ *addr) & *mask) {
1956 #ifdef DIAGNOSTIC
1957 				log(LOG_INFO, "IPv4 address: \"%s\" is not on the network\n",
1958 				    inet_ntoa(((const struct sockaddr_in *)l3addr)->sin_addr));
1959 #endif
1960 				goto error;
1961 			}
1962 		}
1963 	}
1964 
1965 	error = 0;
1966 error:
1967 	rtfree(rt);
1968 	return error;
1969 }
1970 
1971 static inline uint32_t
1972 in_lltable_hash_dst(const struct in_addr dst, uint32_t hsize)
1973 {
1974 
1975 	return (IN_LLTBL_HASH(dst.s_addr, hsize));
1976 }
1977 
1978 static uint32_t
1979 in_lltable_hash(const struct llentry *lle, uint32_t hsize)
1980 {
1981 
1982 	return (in_lltable_hash_dst(lle->r_l3addr.addr4, hsize));
1983 }
1984 
1985 static void
1986 in_lltable_fill_sa_entry(const struct llentry *lle, struct sockaddr *sa)
1987 {
1988 	struct sockaddr_in *sin;
1989 
1990 	sin = (struct sockaddr_in *)sa;
1991 	memset(sin, 0, sizeof(*sin));
1992 	sin->sin_family = AF_INET;
1993 	sin->sin_len = sizeof(*sin);
1994 	sin->sin_addr = lle->r_l3addr.addr4;
1995 }
1996 
1997 static inline struct llentry *
1998 in_lltable_find_dst(struct lltable *llt, struct in_addr dst)
1999 {
2000 	struct llentry *lle;
2001 	struct llentries *lleh;
2002 	u_int hashidx;
2003 
2004 	hashidx = in_lltable_hash_dst(dst, llt->llt_hsize);
2005 	lleh = &llt->lle_head[hashidx];
2006 	LIST_FOREACH(lle, lleh, lle_next) {
2007 		if (lle->la_flags & LLE_DELETED)
2008 			continue;
2009 		if (lle->r_l3addr.addr4.s_addr == dst.s_addr)
2010 			break;
2011 	}
2012 
2013 	return (lle);
2014 }
2015 
2016 static int
2017 in_lltable_delete(struct lltable *llt, u_int flags,
2018     const struct sockaddr *l3addr)
2019 {
2020 	const struct sockaddr_in *sin = (const struct sockaddr_in *)l3addr;
2021 	struct ifnet *ifp __diagused = llt->llt_ifp;
2022 	struct llentry *lle;
2023 
2024 	IF_AFDATA_WLOCK_ASSERT(ifp);
2025 	KASSERTMSG(l3addr->sa_family == AF_INET,
2026 	    "sin_family %d", l3addr->sa_family);
2027 
2028 	lle = in_lltable_find_dst(llt, sin->sin_addr);
2029 	if (lle == NULL) {
2030 #ifdef DIAGNOSTIC
2031 		log(LOG_INFO, "interface address is missing from cache = %p  in delete\n", lle);
2032 #endif
2033 		return (ENOENT);
2034 	}
2035 
2036 	LLE_WLOCK(lle);
2037 	lle->la_flags |= LLE_DELETED;
2038 #ifdef DIAGNOSTIC
2039 	log(LOG_INFO, "ifaddr cache = %p is deleted\n", lle);
2040 #endif
2041 	if ((lle->la_flags & (LLE_STATIC | LLE_IFADDR)) == LLE_STATIC)
2042 		llentry_free(lle);
2043 	else
2044 		LLE_WUNLOCK(lle);
2045 
2046 	return (0);
2047 }
2048 
2049 static struct llentry *
2050 in_lltable_create(struct lltable *llt, u_int flags, const struct sockaddr *l3addr)
2051 {
2052 	const struct sockaddr_in *sin = (const struct sockaddr_in *)l3addr;
2053 	struct ifnet *ifp = llt->llt_ifp;
2054 	struct llentry *lle;
2055 
2056 	IF_AFDATA_WLOCK_ASSERT(ifp);
2057 	KASSERTMSG(l3addr->sa_family == AF_INET,
2058 	    "sin_family %d", l3addr->sa_family);
2059 
2060 	lle = in_lltable_find_dst(llt, sin->sin_addr);
2061 
2062 	if (lle != NULL) {
2063 		LLE_WLOCK(lle);
2064 		return (lle);
2065 	}
2066 
2067 	/* no existing record, we need to create new one */
2068 
2069 	/*
2070 	 * A route that covers the given address must have
2071 	 * been installed 1st because we are doing a resolution,
2072 	 * verify this.
2073 	 */
2074 	if (!(flags & LLE_IFADDR) &&
2075 	    in_lltable_rtcheck(ifp, flags, l3addr) != 0)
2076 		return (NULL);
2077 
2078 	lle = in_lltable_new(sin->sin_addr, flags);
2079 	if (lle == NULL) {
2080 		log(LOG_INFO, "lla_lookup: new lle malloc failed\n");
2081 		return (NULL);
2082 	}
2083 	lle->la_flags = flags;
2084 	if ((flags & LLE_IFADDR) == LLE_IFADDR) {
2085 		memcpy(&lle->ll_addr, CLLADDR(ifp->if_sadl), ifp->if_addrlen);
2086 		lle->la_flags |= (LLE_VALID | LLE_STATIC);
2087 	}
2088 
2089 	lltable_link_entry(llt, lle);
2090 	LLE_WLOCK(lle);
2091 
2092 	return (lle);
2093 }
2094 
2095 /*
2096  * Return NULL if not found or marked for deletion.
2097  * If found return lle read locked.
2098  */
2099 static struct llentry *
2100 in_lltable_lookup(struct lltable *llt, u_int flags, const struct sockaddr *l3addr)
2101 {
2102 	const struct sockaddr_in *sin = (const struct sockaddr_in *)l3addr;
2103 	struct llentry *lle;
2104 
2105 	IF_AFDATA_LOCK_ASSERT(llt->llt_ifp);
2106 	KASSERTMSG(l3addr->sa_family == AF_INET,
2107 	    "sin_family %d", l3addr->sa_family);
2108 
2109 	lle = in_lltable_find_dst(llt, sin->sin_addr);
2110 
2111 	if (lle == NULL)
2112 		return NULL;
2113 
2114 	if (flags & LLE_EXCLUSIVE)
2115 		LLE_WLOCK(lle);
2116 	else
2117 		LLE_RLOCK(lle);
2118 
2119 	return lle;
2120 }
2121 
2122 static int
2123 in_lltable_dump_entry(struct lltable *llt, struct llentry *lle,
2124     struct rt_walkarg *w)
2125 {
2126 	struct sockaddr_in sin;
2127 
2128 	LLTABLE_LOCK_ASSERT();
2129 
2130 	/* skip deleted entries */
2131 	if (lle->la_flags & LLE_DELETED)
2132 		return 0;
2133 
2134 	sockaddr_in_init(&sin, &lle->r_l3addr.addr4, 0);
2135 
2136 	return lltable_dump_entry(llt, lle, w, sintosa(&sin));
2137 }
2138 
2139 #endif /* NARP > 0 */
2140 
2141 static int
2142 in_multicast_sysctl(SYSCTLFN_ARGS)
2143 {
2144 	struct ifnet *ifp;
2145 	struct ifaddr *ifa;
2146 	struct in_ifaddr *ifa4;
2147 	struct in_multi *inm;
2148 	uint32_t tmp;
2149 	int error;
2150 	size_t written;
2151 	struct psref psref;
2152 	int bound;
2153 
2154 	if (namelen != 1)
2155 		return EINVAL;
2156 
2157 	bound = curlwp_bind();
2158 	ifp = if_get_byindex(name[0], &psref);
2159 	if (ifp == NULL) {
2160 		curlwp_bindx(bound);
2161 		return ENODEV;
2162 	}
2163 
2164 	if (oldp == NULL) {
2165 		*oldlenp = 0;
2166 		IFADDR_FOREACH(ifa, ifp) {
2167 			if (ifa->ifa_addr->sa_family != AF_INET)
2168 				continue;
2169 			ifa4 = (void *)ifa;
2170 			LIST_FOREACH(inm, &ifa4->ia_multiaddrs, inm_list) {
2171 				*oldlenp += 2 * sizeof(struct in_addr) +
2172 				    sizeof(uint32_t);
2173 			}
2174 		}
2175 		if_put(ifp, &psref);
2176 		curlwp_bindx(bound);
2177 		return 0;
2178 	}
2179 
2180 	error = 0;
2181 	written = 0;
2182 	IFADDR_FOREACH(ifa, ifp) {
2183 		if (ifa->ifa_addr->sa_family != AF_INET)
2184 			continue;
2185 		ifa4 = (void *)ifa;
2186 		LIST_FOREACH(inm, &ifa4->ia_multiaddrs, inm_list) {
2187 			if (written + 2 * sizeof(struct in_addr) +
2188 			    sizeof(uint32_t) > *oldlenp)
2189 				goto done;
2190 			error = sysctl_copyout(l, &ifa4->ia_addr.sin_addr,
2191 			    oldp, sizeof(struct in_addr));
2192 			if (error)
2193 				goto done;
2194 			oldp = (char *)oldp + sizeof(struct in_addr);
2195 			written += sizeof(struct in_addr);
2196 			error = sysctl_copyout(l, &inm->inm_addr,
2197 			    oldp, sizeof(struct in_addr));
2198 			if (error)
2199 				goto done;
2200 			oldp = (char *)oldp + sizeof(struct in_addr);
2201 			written += sizeof(struct in_addr);
2202 			tmp = inm->inm_refcount;
2203 			error = sysctl_copyout(l, &tmp, oldp, sizeof(tmp));
2204 			if (error)
2205 				goto done;
2206 			oldp = (char *)oldp + sizeof(tmp);
2207 			written += sizeof(tmp);
2208 		}
2209 	}
2210 done:
2211 	if_put(ifp, &psref);
2212 	curlwp_bindx(bound);
2213 	*oldlenp = written;
2214 	return error;
2215 }
2216 
2217 static void
2218 in_sysctl_init(struct sysctllog **clog)
2219 {
2220 	sysctl_createv(clog, 0, NULL, NULL,
2221 		       CTLFLAG_PERMANENT,
2222 		       CTLTYPE_NODE, "inet",
2223 		       SYSCTL_DESCR("PF_INET related settings"),
2224 		       NULL, 0, NULL, 0,
2225 		       CTL_NET, PF_INET, CTL_EOL);
2226 	sysctl_createv(clog, 0, NULL, NULL,
2227 		       CTLFLAG_PERMANENT,
2228 		       CTLTYPE_NODE, "multicast",
2229 		       SYSCTL_DESCR("Multicast information"),
2230 		       in_multicast_sysctl, 0, NULL, 0,
2231 		       CTL_NET, PF_INET, CTL_CREATE, CTL_EOL);
2232 	sysctl_createv(clog, 0, NULL, NULL,
2233 		       CTLFLAG_PERMANENT,
2234 		       CTLTYPE_NODE, "ip",
2235 		       SYSCTL_DESCR("IPv4 related settings"),
2236 		       NULL, 0, NULL, 0,
2237 		       CTL_NET, PF_INET, IPPROTO_IP, CTL_EOL);
2238 
2239 	sysctl_createv(clog, 0, NULL, NULL,
2240 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2241 		       CTLTYPE_INT, "subnetsarelocal",
2242 		       SYSCTL_DESCR("Whether logical subnets are considered "
2243 				    "local"),
2244 		       NULL, 0, &subnetsarelocal, 0,
2245 		       CTL_NET, PF_INET, IPPROTO_IP,
2246 		       IPCTL_SUBNETSARELOCAL, CTL_EOL);
2247 	sysctl_createv(clog, 0, NULL, NULL,
2248 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2249 		       CTLTYPE_INT, "hostzerobroadcast",
2250 		       SYSCTL_DESCR("All zeroes address is broadcast address"),
2251 		       NULL, 0, &hostzeroisbroadcast, 0,
2252 		       CTL_NET, PF_INET, IPPROTO_IP,
2253 		       IPCTL_HOSTZEROBROADCAST, CTL_EOL);
2254 }
2255 
2256 #if NARP > 0
2257 
2258 static struct lltable *
2259 in_lltattach(struct ifnet *ifp)
2260 {
2261 	struct lltable *llt;
2262 
2263 	llt = lltable_allocate_htbl(IN_LLTBL_DEFAULT_HSIZE);
2264 	llt->llt_af = AF_INET;
2265 	llt->llt_ifp = ifp;
2266 
2267 	llt->llt_lookup = in_lltable_lookup;
2268 	llt->llt_create = in_lltable_create;
2269 	llt->llt_delete = in_lltable_delete;
2270 	llt->llt_dump_entry = in_lltable_dump_entry;
2271 	llt->llt_hash = in_lltable_hash;
2272 	llt->llt_fill_sa_entry = in_lltable_fill_sa_entry;
2273 	llt->llt_free_entry = in_lltable_free_entry;
2274 	llt->llt_match_prefix = in_lltable_match_prefix;
2275 	lltable_link(llt);
2276 
2277 	return (llt);
2278 }
2279 
2280 #endif /* NARP > 0 */
2281 
2282 void *
2283 in_domifattach(struct ifnet *ifp)
2284 {
2285 	struct in_ifinfo *ii;
2286 
2287 	ii = kmem_zalloc(sizeof(struct in_ifinfo), KM_SLEEP);
2288 	KASSERT(ii != NULL);
2289 
2290 #if NARP > 0
2291 	ii->ii_llt = in_lltattach(ifp);
2292 #endif
2293 
2294 #ifdef IPSELSRC
2295 	ii->ii_selsrc = in_selsrc_domifattach(ifp);
2296 	KASSERT(ii->ii_selsrc != NULL);
2297 #endif
2298 
2299 	return ii;
2300 }
2301 
2302 void
2303 in_domifdetach(struct ifnet *ifp, void *aux)
2304 {
2305 	struct in_ifinfo *ii = aux;
2306 
2307 #ifdef IPSELSRC
2308 	in_selsrc_domifdetach(ifp, ii->ii_selsrc);
2309 #endif
2310 #if NARP > 0
2311 	lltable_free(ii->ii_llt);
2312 #endif
2313 	kmem_free(ii, sizeof(struct in_ifinfo));
2314 }
2315