bsd/netinet/ip_divert.c

   1 /*
   2  * Copyright (c) 2000-2010 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * Copyright (c) 1982, 1986, 1988, 1993
  30  *      The Regents of the University of California.  All rights reserved.
  31  *
  32  * Redistribution and use in source and binary forms, with or without
  33  * modification, are permitted provided that the following conditions
  34  * are met:
  35  * 1. Redistributions of source code must retain the above copyright
  36  *    notice, this list of conditions and the following disclaimer.
  37  * 2. Redistributions in binary form must reproduce the above copyright
  38  *    notice, this list of conditions and the following disclaimer in the
  39  *    documentation and/or other materials provided with the distribution.
  40  * 3. All advertising materials mentioning features or use of this software
  41  *    must display the following acknowledgement:
  42  *      This product includes software developed by the University of
  43  *      California, Berkeley and its contributors.
  44  * 4. Neither the name of the University nor the names of its contributors
  45  *    may be used to endorse or promote products derived from this software
  46  *    without specific prior written permission.
  47  *
  48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  58  * SUCH DAMAGE.
  59  *
  60  * $FreeBSD: src/sys/netinet/ip_divert.c,v 1.98 2004/08/17 22:05:54 andre Exp $
  61  */
  62
  63 #if !INET
  64 #error "IPDIVERT requires INET."
  65 #endif
  66
  67 #include <sys/param.h>
  68 #include <sys/kernel.h>
  69 #include <sys/malloc.h>
  70 #include <sys/mbuf.h>
  71 #include <sys/socket.h>
  72 #include <sys/domain.h>
  73 #include <sys/protosw.h>
  74 #include <sys/socketvar.h>
  75 #include <sys/sysctl.h>
  76 #include <sys/systm.h>
  77 #include <sys/proc.h>
  78
  79 #include <machine/endian.h>
  80
  81 #include <net/if.h>
  82 #include <net/route.h>
  83 #include <net/kpi_protocol.h>
  84
  85 #include <netinet/in.h>
  86 #include <netinet/in_systm.h>
  87 #include <netinet/ip.h>
  88 #include <netinet/in_pcb.h>
  89 #include <netinet/in_var.h>
  90 #include <netinet/ip_var.h>
  91 #include <netinet/ip_fw.h>
  92 #include <netinet/ip_divert.h>
  93
  94 #include <kern/zalloc.h>
  95 #include <libkern/OSAtomic.h>
  96
  97 /*
  98  * Divert sockets
  99  */
 100
 101 /*
 102  * Allocate enough space to hold a full IP packet
 103  */
 104 #define DIVSNDQ         (65536 + 100)
 105 #define DIVRCVQ         (65536 + 100)
 106
 107 /*
 108  * Divert sockets work in conjunction with ipfw, see the divert(4)
 109  * manpage for features.
 110  * Internally, packets selected by ipfw in ip_input() or ip_output(),
 111  * and never diverted before, are passed to the input queue of the
 112  * divert socket with a given 'divert_port' number (as specified in
 113  * the matching ipfw rule), and they are tagged with a 16 bit cookie
 114  * (representing the rule number of the matching ipfw rule), which
 115  * is passed to process reading from the socket.
 116  *
 117  * Packets written to the divert socket are again tagged with a cookie
 118  * (usually the same as above) and a destination address.
 119  * If the destination address is INADDR_ANY then the packet is
 120  * treated as outgoing and sent to ip_output(), otherwise it is
 121  * treated as incoming and sent to ip_input().
 122  * In both cases, the packet is tagged with the cookie.
 123  *
 124  * On reinjection, processing in ip_input() and ip_output()
 125  * will be exactly the same as for the original packet, except that
 126  * ipfw processing will start at the rule number after the one
 127  * written in the cookie (so, tagging a packet with a cookie of 0
 128  * will cause it to be effectively considered as a standard packet).
 129  */
 130
 131 /* Internal variables */
 132 static struct inpcbhead divcb;
 133 static struct inpcbinfo divcbinfo;
 134
 135 static u_int32_t        div_sendspace = DIVSNDQ;        /* XXX sysctl ? */
 136 static u_int32_t        div_recvspace = DIVRCVQ;        /* XXX sysctl ? */
 137
 138 /* Optimization: have this preinitialized */
 139 static struct sockaddr_in divsrc = { sizeof(divsrc), AF_INET, 0, { 0 }, { 0,0,0,0,0,0,0,0 } };
 140
 141 /* Internal functions */
 142 static int div_output(struct socket *so,
 143                 struct mbuf *m, struct sockaddr *addr, struct mbuf *control);
 144
 145 extern int load_ipfw(void);
 146 /*
 147  * Initialize divert connection block queue.
 148  */
 149 void
 150 div_init(void)
 151 {
 152         struct inpcbinfo *pcbinfo;
 153         LIST_INIT(&divcb);
 154         divcbinfo.listhead = &divcb;
 155         /*
 156          * XXX We don't use the hash list for divert IP, but it's easier
 157          * to allocate a one entry hash list than it is to check all
 158          * over the place for hashbase == NULL.
 159          */
 160         divcbinfo.hashbase = hashinit(1, M_PCB, &divcbinfo.hashmask);
 161         divcbinfo.porthashbase = hashinit(1, M_PCB, &divcbinfo.porthashmask);
 162         divcbinfo.ipi_zone = (void *) zinit(sizeof(struct inpcb),(maxsockets * sizeof(struct inpcb)),
 163                                    4096, "divzone");
 164         pcbinfo = &divcbinfo;
 165         /*
 166          * allocate lock group attribute and group for udp pcb mutexes
 167          */
 168         pcbinfo->mtx_grp_attr = lck_grp_attr_alloc_init();
 169
 170         pcbinfo->mtx_grp = lck_grp_alloc_init("divcb", pcbinfo->mtx_grp_attr);
 171
 172         /*
 173          * allocate the lock attribute for divert pcb mutexes
 174          */
 175         pcbinfo->mtx_attr = lck_attr_alloc_init();
 176
 177         if ((pcbinfo->mtx = lck_rw_alloc_init(pcbinfo->mtx_grp, pcbinfo->mtx_attr)) == NULL)
 178                 return; /* pretty much dead if this fails... */
 179
 180 #if IPFIREWALL
 181         if (!IPFW_LOADED) {
 182                 load_ipfw();
 183         }
 184 #endif
 185 }
 186
 187 /*
 188  * IPPROTO_DIVERT is not a real IP protocol; don't allow any packets
 189  * with that protocol number to enter the system from the outside.
 190  */
 191 void
 192 div_input(struct mbuf *m, __unused int off)
 193 {
 194         OSAddAtomic(1, &ipstat.ips_noproto);
 195         m_freem(m);
 196 }
 197
 198 /*
 199  * Divert a packet by passing it up to the divert socket at port 'port'.
 200  *
 201  * Setup generic address and protocol structures for div_input routine,
 202  * then pass them along with mbuf chain.
 203  * ###LOCK  called in ip_mutex from ip_output/ip_input
 204  */
 205 void
 206 divert_packet(struct mbuf *m, int incoming, int port, int rule)
 207 {
 208         struct ip *ip;
 209         struct inpcb *inp;
 210         struct socket *sa;
 211         u_int16_t nport;
 212
 213         /* Sanity check */
 214         KASSERT(port != 0, ("%s: port=0", __FUNCTION__));
 215
 216         divsrc.sin_port = rule;         /* record matching rule */
 217
 218         /* Assure header */
 219         if (m->m_len < sizeof(struct ip) &&
 220             (m = m_pullup(m, sizeof(struct ip))) == 0) {
 221                 return;
 222         }
 223         ip = mtod(m, struct ip *);
 224
 225         /*
 226          * Record receive interface address, if any.
 227          * But only for incoming packets.
 228          */
 229         divsrc.sin_addr.s_addr = 0;
 230         if (incoming) {
 231                 struct ifaddr *ifa;
 232
 233                 /* Sanity check */
 234                 KASSERT((m->m_flags & M_PKTHDR), ("%s: !PKTHDR", __FUNCTION__));
 235
 236                 /* Find IP address for receive interface */
 237                 ifnet_lock_shared(m->m_pkthdr.rcvif);
 238                 TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrhead, ifa_link) {
 239                         if (ifa->ifa_addr == NULL)
 240                                 continue;
 241                         if (ifa->ifa_addr->sa_family != AF_INET)
 242                                 continue;
 243                         divsrc.sin_addr =
 244                             ((struct sockaddr_in *) ifa->ifa_addr)->sin_addr;
 245                         break;
 246                 }
 247                 ifnet_lock_done(m->m_pkthdr.rcvif);
 248         }
 249         /*
 250          * Record the incoming interface name whenever we have one.
 251          */
 252         bzero(&divsrc.sin_zero, sizeof(divsrc.sin_zero));
 253         if (m->m_pkthdr.rcvif) {
 254                 /*
 255                  * Hide the actual interface name in there in the
 256                  * sin_zero array. XXX This needs to be moved to a
 257                  * different sockaddr type for divert, e.g.
 258                  * sockaddr_div with multiple fields like
 259                  * sockaddr_dl. Presently we have only 7 bytes
 260                  * but that will do for now as most interfaces
 261                  * are 4 or less + 2 or less bytes for unit.
 262                  * There is probably a faster way of doing this,
 263                  * possibly taking it from the sockaddr_dl on the iface.
 264                  * This solves the problem of a P2P link and a LAN interface
 265                  * having the same address, which can result in the wrong
 266                  * interface being assigned to the packet when fed back
 267                  * into the divert socket. Theoretically if the daemon saves
 268                  * and re-uses the sockaddr_in as suggested in the man pages,
 269                  * this iface name will come along for the ride.
 270                  * (see div_output for the other half of this.)
 271                  */
 272                 snprintf(divsrc.sin_zero, sizeof(divsrc.sin_zero),
 273                         "%s%d", m->m_pkthdr.rcvif->if_name,
 274                         m->m_pkthdr.rcvif->if_unit);
 275         }
 276
 277         /* Put packet on socket queue, if any */
 278         sa = NULL;
 279         nport = htons((u_int16_t)port);
 280         lck_rw_lock_shared(divcbinfo.mtx);
 281         LIST_FOREACH(inp, &divcb, inp_list) {
 282                 if (inp->inp_lport == nport)
 283                         sa = inp->inp_socket;
 284         }
 285         if (sa) {
 286                 int error = 0;
 287
 288                 socket_lock(sa, 1);
 289                 if (sbappendaddr(&sa->so_rcv, (struct sockaddr *)&divsrc,
 290                                 m, (struct mbuf *)0, &error) != 0)
 291                         sorwakeup(sa);
 292                 socket_unlock(sa, 1);
 293         } else {
 294                 m_freem(m);
 295                 OSAddAtomic(1, &ipstat.ips_noproto);
 296                 OSAddAtomic(-1, &ipstat.ips_delivered);
 297         }
 298         lck_rw_done(divcbinfo.mtx);
 299 }
 300
 301 /*
 302  * Deliver packet back into the IP processing machinery.
 303  *
 304  * If no address specified, or address is 0.0.0.0, send to ip_output();
 305  * otherwise, send to ip_input() and mark as having been received on
 306  * the interface with that address.
 307  * ###LOCK  called in inet_proto mutex when from div_send.
 308  */
 309 static int
 310 div_output(struct socket *so, struct mbuf *m, struct sockaddr *addr,
 311            struct mbuf *control)
 312 {
 313         struct inpcb *const inp = sotoinpcb(so);
 314         struct ip *const ip = mtod(m, struct ip *);
 315         struct sockaddr_in *sin = (struct sockaddr_in *)addr;
 316         int error = 0;
 317 #if PKT_PRIORITY
 318         mbuf_traffic_class_t mtc = MBUF_TC_NONE;
 319 #endif /* PKT_PRIORITY */
 320
 321         if (control != NULL) {
 322 #if PKT_PRIORITY
 323                 mtc = mbuf_traffic_class_from_control(control);
 324 #endif /* PKT_PRIORITY */
 325
 326                 m_freem(control);               /* XXX */
 327         }
 328         /* Loopback avoidance and state recovery */
 329         if (sin) {
 330                 struct m_tag *mtag;
 331                 struct divert_tag *dt;
 332                 int     len = 0;
 333                 char    *c = sin->sin_zero;
 334
 335                 mtag = m_tag_alloc(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_DIVERT,
 336                                 sizeof(struct divert_tag), M_NOWAIT);
 337                 if (mtag == NULL) {
 338                         error = ENOBUFS;
 339                         goto cantsend;
 340                 }
 341                 dt = (struct divert_tag *)(mtag+1);
 342                 dt->info = 0;
 343                 dt->cookie = sin->sin_port;
 344                 m_tag_prepend(m, mtag);
 345
 346                 /*
 347                  * Find receive interface with the given name or IP address.
 348                  * The name is user supplied data so don't trust it's size or
 349                  * that it is zero terminated. The name has priority.
 350                  * We are presently assuming that the sockaddr_in
 351                  * has not been replaced by a sockaddr_div, so we limit it
 352                  * to 16 bytes in total. the name is stuffed (if it exists)
 353                  * in the sin_zero[] field.
 354                  */
 355                 while (*c++ && (len++ < sizeof(sin->sin_zero)));
 356                 if ((len > 0) && (len < sizeof(sin->sin_zero)))
 357                         m->m_pkthdr.rcvif = ifunit(sin->sin_zero);
 358         }
 359
 360         /* Reinject packet into the system as incoming or outgoing */
 361         if (!sin || sin->sin_addr.s_addr == 0) {
 362                 struct ip_out_args ipoa = { IFSCOPE_NONE };
 363                 struct route ro;
 364
 365                 /*
 366                  * Don't allow both user specified and setsockopt options,
 367                  * and don't allow packet length sizes that will crash
 368                  */
 369                 if (((ip->ip_hl != (sizeof (*ip) >> 2)) && inp->inp_options) ||
 370                      ((u_short)ntohs(ip->ip_len) > m->m_pkthdr.len)) {
 371                         error = EINVAL;
 372                         goto cantsend;
 373                 }
 374
 375                 /* Convert fields to host order for ip_output() */
 376 #if BYTE_ORDER != BIG_ENDIAN
 377                 NTOHS(ip->ip_len);
 378                 NTOHS(ip->ip_off);
 379 #endif
 380
 381                 OSAddAtomic(1, &ipstat.ips_rawout);
 382                 /* Copy the cached route and take an extra reference */
 383                 inp_route_copyout(inp, &ro);
 384
 385 #if PKT_PRIORITY
 386                 set_traffic_class(m, so, mtc);
 387 #endif /* PKT_PRIORITY */
 388
 389                 socket_unlock(so, 0);
 390 #if CONFIG_MACF_NET
 391                 mac_mbuf_label_associate_inpcb(inp, m);
 392 #endif
 393                 /* Send packet to output processing */
 394                 error = ip_output(m, inp->inp_options, &ro,
 395                         (so->so_options & SO_DONTROUTE) |
 396                         IP_ALLOWBROADCAST | IP_RAWOUTPUT | IP_OUTARGS,
 397                         inp->inp_moptions, &ipoa);
 398
 399                 socket_lock(so, 0);
 400                 /* Synchronize cached PCB route */
 401                 inp_route_copyin(inp, &ro);
 402         } else {
 403                 struct  ifaddr *ifa;
 404
 405                 /* If no luck with the name above. check by IP address.  */
 406                 if (m->m_pkthdr.rcvif == NULL) {
 407                         /*
 408                          * Make sure there are no distractions
 409                          * for ifa_ifwithaddr. Clear the port and the ifname.
 410                          * Maybe zap all 8 bytes at once using a 64bit write?
 411                          */
 412                         bzero(sin->sin_zero, sizeof(sin->sin_zero));
 413                         /* *((u_int64_t *)sin->sin_zero) = 0; */ /* XXX ?? */
 414                         sin->sin_port = 0;
 415                         if (!(ifa = ifa_ifwithaddr((struct sockaddr *) sin))) {
 416                                 error = EADDRNOTAVAIL;
 417                                 goto cantsend;
 418                         }
 419                         m->m_pkthdr.rcvif = ifa->ifa_ifp;
 420                         ifafree(ifa);
 421                 }
 422 #if CONFIG_MACF_NET
 423                 mac_mbuf_label_associate_socket(so, m);
 424 #endif
 425                 /* Send packet to input processing */
 426                 proto_inject(PF_INET, m);
 427         }
 428
 429         return error;
 430
 431 cantsend:
 432         m_freem(m);
 433         return error;
 434 }
 435
 436 static int
 437 div_attach(struct socket *so, int proto, struct proc *p)
 438 {
 439         struct inpcb *inp;
 440         int error;
 441
 442
 443         inp  = sotoinpcb(so);
 444         if (inp)
 445                 panic("div_attach");
 446         if ((error = proc_suser(p)) != 0)
 447                 return error;
 448
 449         error = soreserve(so, div_sendspace, div_recvspace);
 450         if (error)
 451                 return error;
 452         error = in_pcballoc(so, &divcbinfo, p);
 453         if (error)
 454                 return error;
 455         inp = (struct inpcb *)so->so_pcb;
 456         inp->inp_ip_p = proto;
 457         inp->inp_vflag |= INP_IPV4;
 458         inp->inp_flags |= INP_HDRINCL;
 459         /* The socket is always "connected" because
 460            we always know "where" to send the packet */
 461         so->so_state |= SS_ISCONNECTED;
 462
 463 #ifdef MORE_DICVLOCK_DEBUG
 464         printf("div_attach: so=%p sopcb=%p lock=%x ref=%x\n",
 465                         so, so->so_pcb, ((struct inpcb *)so->so_pcb)->inpcb_mtx, so->so_usecount);
 466 #endif
 467         return 0;
 468 }
 469
 470 static int
 471 div_detach(struct socket *so)
 472 {
 473         struct inpcb *inp;
 474
 475 #ifdef MORE_DICVLOCK_DEBUG
 476         printf("div_detach: so=%p sopcb=%p lock=%x ref=%x\n",
 477                         so, so->so_pcb, ((struct inpcb *)so->so_pcb)->inpcb_mtx, so->so_usecount);
 478 #endif
 479         inp = sotoinpcb(so);
 480         if (inp == 0)
 481                 panic("div_detach: so=%p null inp\n", so);
 482         in_pcbdetach(inp);
 483         inp->inp_state = INPCB_STATE_DEAD;
 484         return 0;
 485 }
 486
 487 static int
 488 div_abort(struct socket *so)
 489 {
 490         soisdisconnected(so);
 491         return div_detach(so);
 492 }
 493
 494 static int
 495 div_disconnect(struct socket *so)
 496 {
 497         if ((so->so_state & SS_ISCONNECTED) == 0)
 498                 return ENOTCONN;
 499         return div_abort(so);
 500 }
 501
 502 static int
 503 div_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
 504 {
 505         struct inpcb *inp;
 506         int error;
 507
 508         inp = sotoinpcb(so);
 509         /* in_pcbbind assumes that the socket is a sockaddr_in
 510         * and in_pcbbind requires a valid address. Since divert
 511         * sockets don't we need to make sure the address is
 512         * filled in properly.
 513         * XXX -- divert should not be abusing in_pcbind
 514         * and should probably have its own family.
 515         */
 516         if (nam->sa_family != AF_INET) {
 517                 error = EAFNOSUPPORT;
 518         } else {
 519                ((struct sockaddr_in *)nam)->sin_addr.s_addr = INADDR_ANY;
 520                 error = in_pcbbind(inp, nam, p);
 521         }
 522         return error;
 523 }
 524
 525 static int
 526 div_shutdown(struct socket *so)
 527 {
 528         socantsendmore(so);
 529         return 0;
 530 }
 531
 532 static int
 533 div_send(struct socket *so, __unused int flags, struct mbuf *m, struct sockaddr *nam,
 534          struct mbuf *control, __unused struct proc *p)
 535 {
 536         /* Packet must have a header (but that's about it) */
 537         if (m->m_len < sizeof (struct ip) &&
 538             (m = m_pullup(m, sizeof (struct ip))) == 0) {
 539                 OSAddAtomic(1, &ipstat.ips_toosmall);
 540                 m_freem(m);
 541                 return EINVAL;
 542         }
 543
 544         /* Send packet */
 545         return div_output(so, m, nam, control);
 546 }
 547
 548 #if 0
 549 static int
 550 div_pcblist SYSCTL_HANDLER_ARGS
 551 {
 552 #pragma unused(oidp, arg1, arg2)
 553         int error, i, n;
 554         struct inpcb *inp, **inp_list;
 555         inp_gen_t gencnt;
 556         struct xinpgen xig;
 557
 558         /*
 559          * The process of preparing the TCB list is too time-consuming and
 560          * resource-intensive to repeat twice on every request.
 561          */
 562         lck_rw_lock_exclusive(divcbinfo.mtx);
 563         if (req->oldptr == USER_ADDR_NULL) {
 564                 n = divcbinfo.ipi_count;
 565                 req->oldidx = 2 * (sizeof xig)
 566                         + (n + n/8) * sizeof(struct xinpcb);
 567                 lck_rw_done(divcbinfo.mtx);
 568                 return 0;
 569         }
 570
 571         if (req->newptr != USER_ADDR_NULL) {
 572                 lck_rw_done(divcbinfo.mtx);
 573                 return EPERM;
 574         }
 575
 576         /*
 577          * OK, now we're committed to doing something.
 578          */
 579         gencnt = divcbinfo.ipi_gencnt;
 580         n = divcbinfo.ipi_count;
 581
 582         bzero(&xig, sizeof(xig));
 583         xig.xig_len = sizeof xig;
 584         xig.xig_count = n;
 585         xig.xig_gen = gencnt;
 586         xig.xig_sogen = so_gencnt;
 587         error = SYSCTL_OUT(req, &xig, sizeof xig);
 588         if (error) {
 589                 lck_rw_done(divcbinfo.mtx);
 590                 return error;
 591         }
 592
 593         inp_list = _MALLOC(n * sizeof *inp_list, M_TEMP, M_WAITOK);
 594         if (inp_list == 0) {
 595                 lck_rw_done(divcbinfo.mtx);
 596                 return ENOMEM;
 597         }
 598
 599         for (inp = LIST_FIRST(divcbinfo.listhead), i = 0; inp && i < n;
 600              inp = LIST_NEXT(inp, inp_list)) {
 601 #ifdef __APPLE__
 602                 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD)
 603 #else
 604                 if (inp->inp_gencnt <= gencnt && !prison_xinpcb(req->p, inp))
 605 #endif
 606                         inp_list[i++] = inp;
 607         }
 608         n = i;
 609
 610         error = 0;
 611         for (i = 0; i < n; i++) {
 612                 inp = inp_list[i];
 613                 if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
 614                         struct xinpcb xi;
 615
 616                         bzero(&xi, sizeof(xi));
 617                         xi.xi_len = sizeof xi;
 618                         /* XXX should avoid extra copy */
 619                         inpcb_to_compat(inp, &xi.xi_inp);
 620                         if (inp->inp_socket)
 621                                 sotoxsocket(inp->inp_socket, &xi.xi_socket);
 622                         error = SYSCTL_OUT(req, &xi, sizeof xi);
 623                 }
 624         }
 625         if (!error) {
 626                 /*
 627                  * Give the user an updated idea of our state.
 628                  * If the generation differs from what we told
 629                  * her before, she knows that something happened
 630                  * while we were processing this request, and it
 631                  * might be necessary to retry.
 632                  */
 633                 bzero(&xig, sizeof(xig));
 634                 xig.xig_len = sizeof xig;
 635                 xig.xig_gen = divcbinfo.ipi_gencnt;
 636                 xig.xig_sogen = so_gencnt;
 637                 xig.xig_count = divcbinfo.ipi_count;
 638                 error = SYSCTL_OUT(req, &xig, sizeof xig);
 639         }
 640         FREE(inp_list, M_TEMP);
 641         lck_rw_done(divcbinfo.mtx);
 642         return error;
 643 }
 644 #endif
 645
 646 __private_extern__ int
 647 div_lock(struct socket *so, int refcount, void *lr)
 648 {
 649         void *lr_saved;
 650
 651         if (lr == NULL)
 652                 lr_saved = __builtin_return_address(0);
 653         else
 654                 lr_saved = lr;
 655
 656 #ifdef MORE_DICVLOCK_DEBUG
 657         printf("div_lock: so=%p sopcb=%p lock=%p ref=%x lr=%p\n",
 658             so, so->so_pcb, so->so_pcb ?
 659             ((struct inpcb *)so->so_pcb)->inpcb_mtx : NULL,
 660             so->so_usecount, lr_saved);
 661 #endif
 662         if (so->so_pcb) {
 663                 lck_mtx_lock(((struct inpcb *)so->so_pcb)->inpcb_mtx);
 664         } else  {
 665                 panic("div_lock: so=%p NO PCB! lr=%p lrh= lrh= %s\n",
 666                     so, lr_saved, solockhistory_nr(so));
 667                 /* NOTREACHED */
 668         }
 669
 670         if (so->so_usecount < 0) {
 671                 panic("div_lock: so=%p so_pcb=%p lr=%p ref=%x lrh= %s\n",
 672                     so, so->so_pcb, lr_saved, so->so_usecount,
 673                     solockhistory_nr(so));
 674                 /* NOTREACHED */
 675         }
 676
 677         if (refcount)
 678                 so->so_usecount++;
 679         so->lock_lr[so->next_lock_lr] = lr_saved;
 680         so->next_lock_lr = (so->next_lock_lr+1) % SO_LCKDBG_MAX;
 681
 682         return (0);
 683 }
 684
 685 __private_extern__ int
 686 div_unlock(struct socket *so, int refcount, void *lr)
 687 {
 688         void *lr_saved;
 689         lck_mtx_t * mutex_held;
 690         struct inpcb *inp = sotoinpcb(so);
 691
 692         if (lr == NULL)
 693                 lr_saved = __builtin_return_address(0);
 694         else
 695                 lr_saved = lr;
 696
 697 #ifdef MORE_DICVLOCK_DEBUG
 698         printf("div_unlock: so=%p sopcb=%p lock=%p ref=%x lr=%p\n",
 699             so, so->so_pcb, so->so_pcb ?
 700             ((struct inpcb *)so->so_pcb)->inpcb_mtx : NULL,
 701             so->so_usecount, lr_saved);
 702 #endif
 703         if (refcount)
 704                 so->so_usecount--;
 705
 706         if (so->so_usecount < 0) {
 707                 panic("div_unlock: so=%p usecount=%x lrh= %s\n",
 708                     so, so->so_usecount, solockhistory_nr(so));
 709                 /* NOTREACHED */
 710         }
 711         if (so->so_pcb == NULL) {
 712                 panic("div_unlock: so=%p NO PCB usecount=%x lr=%p lrh= %s\n",
 713                     so, so->so_usecount, lr_saved, solockhistory_nr(so));
 714                 /* NOTREACHED */
 715         }
 716         mutex_held = ((struct inpcb *)so->so_pcb)->inpcb_mtx;
 717
 718         if (so->so_usecount == 0 && (inp->inp_wantcnt == WNT_STOPUSING)) {
 719                 lck_rw_lock_exclusive(divcbinfo.mtx);
 720                 if (inp->inp_state != INPCB_STATE_DEAD)
 721                         in_pcbdetach(inp);
 722                 in_pcbdispose(inp);
 723                 lck_rw_done(divcbinfo.mtx);
 724                 return (0);
 725         }
 726         lck_mtx_assert(mutex_held, LCK_MTX_ASSERT_OWNED);
 727         so->unlock_lr[so->next_unlock_lr] = lr_saved;
 728         so->next_unlock_lr = (so->next_unlock_lr+1) % SO_LCKDBG_MAX;
 729         lck_mtx_unlock(mutex_held);
 730         return (0);
 731 }
 732
 733 __private_extern__ lck_mtx_t *
 734 div_getlock(struct socket *so, __unused int locktype)
 735 {
 736         struct inpcb *inpcb = (struct inpcb *)so->so_pcb;
 737
 738         if (so->so_pcb)  {
 739                 if (so->so_usecount < 0)
 740                         panic("div_getlock: so=%p usecount=%x lrh= %s\n",
 741                             so, so->so_usecount, solockhistory_nr(so));
 742                 return(inpcb->inpcb_mtx);
 743         } else {
 744                 panic("div_getlock: so=%p NULL NO PCB lrh= %s\n",
 745                     so, solockhistory_nr(so));
 746                 return (so->so_proto->pr_domain->dom_mtx);
 747         }
 748 }
 749
 750
 751 struct pr_usrreqs div_usrreqs = {
 752         div_abort, pru_accept_notsupp, div_attach, div_bind,
 753         pru_connect_notsupp, pru_connect2_notsupp, in_control, div_detach,
 754         div_disconnect, pru_listen_notsupp, in_setpeeraddr, pru_rcvd_notsupp,
 755         pru_rcvoob_notsupp, div_send, pru_sense_null, div_shutdown,
 756         in_setsockaddr, sosend, soreceive, pru_sopoll_notsupp
 757 };
 758