2 * Copyright (c) 1982, 1986, 1988, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * @(#)raw_ip.c 8.7 (Berkeley) 5/15/95
30 * $FreeBSD: src/sys/netinet/raw_ip.c,v 1.64.2.16 2003/08/24 08:24:38 hsu Exp $
33 #include "opt_inet6.h"
34 #include "opt_ipsec.h"
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/kernel.h>
41 #include <sys/malloc.h>
45 #include <sys/protosw.h>
46 #include <sys/socket.h>
47 #include <sys/socketvar.h>
48 #include <sys/sysctl.h>
50 #include <sys/thread2.h>
51 #include <sys/socketvar2.h>
52 #include <sys/msgport2.h>
54 #include <machine/stdarg.h>
58 #include <net/if_types.h>
60 #include <net/route.h>
63 #include <netinet/in.h>
64 #include <netinet/in_systm.h>
65 #include <netinet/ip.h>
66 #include <netinet/in_pcb.h>
67 #include <netinet/in_var.h>
68 #include <netinet/ip_var.h>
70 #include <net/ip_mroute/ip_mroute.h>
71 #include <net/ipfw/ip_fw.h>
72 #include <net/ipfw3/ip_fw.h>
73 #include <net/dummynet/ip_dummynet.h>
74 #include <net/dummynet3/ip_dummynet3.h>
77 #include <netproto/ipsec/ipsec.h>
81 #include <netinet6/ipsec.h>
84 struct inpcbinfo ripcbinfo
;
85 struct inpcbportinfo ripcbportinfo
;
88 * hooks for multicast routing. They all default to NULL,
89 * so leave them not initialized and rely on BSS being set to 0.
92 /* The socket used to communicate with the multicast routing daemon. */
93 struct socket
*ip_mrouter
;
95 /* The various mrouter and rsvp functions */
96 int (*ip_mrouter_set
)(struct socket
*, struct sockopt
*);
97 int (*ip_mrouter_get
)(struct socket
*, struct sockopt
*);
98 int (*ip_mrouter_done
)(void);
99 int (*ip_mforward
)(struct ip
*, struct ifnet
*, struct mbuf
*,
100 struct ip_moptions
*);
101 int (*mrt_ioctl
)(u_long
, caddr_t
);
102 int (*legal_vif_num
)(int);
103 u_long (*ip_mcast_src
)(int);
105 int (*rsvp_input_p
)(struct mbuf
**, int *, int);
106 int (*ip_rsvp_vif
)(struct socket
*, struct sockopt
*);
107 void (*ip_rsvp_force_done
)(struct socket
*);
110 * Nominal space allocated to a raw ip socket.
116 * Raw interface to IP protocol.
120 * Initialize raw connection block queue.
125 in_pcbinfo_init(&ripcbinfo
, 0, FALSE
);
126 in_pcbportinfo_init(&ripcbportinfo
, 1, 0);
128 * XXX We don't use the hash list for raw IP, but it's easier
129 * to allocate a one entry hash list than it is to check all
130 * over the place for hashbase == NULL.
132 ripcbinfo
.hashbase
= hashinit(1, M_PCB
, &ripcbinfo
.hashmask
);
133 in_pcbportinfo_set(&ripcbinfo
, &ripcbportinfo
, 1);
134 ripcbinfo
.wildcardhashbase
= hashinit(1, M_PCB
,
135 &ripcbinfo
.wildcardhashmask
);
136 ripcbinfo
.ipi_size
= sizeof(struct inpcb
);
140 * Setup generic address and protocol structures
141 * for raw_input routine, then pass them along with
145 rip_input(struct mbuf
**mp
, int *offp
, int proto
)
147 struct sockaddr_in ripsrc
= { sizeof ripsrc
, AF_INET
};
148 struct mbuf
*m
= *mp
;
149 struct ip
*ip
= mtod(m
, struct ip
*);
151 struct inpcb
*last
= NULL
;
152 struct mbuf
*opts
= NULL
;
158 ripsrc
.sin_addr
= ip
->ip_src
;
159 LIST_FOREACH(inp
, &ripcbinfo
.pcblisthead
, inp_list
) {
160 if (inp
->inp_flags
& INP_PLACEMARKER
)
163 if (!INP_ISIPV4(inp
))
166 if (inp
->inp_ip_p
&& inp
->inp_ip_p
!= proto
)
168 if (inp
->inp_laddr
.s_addr
!= INADDR_ANY
&&
169 inp
->inp_laddr
.s_addr
!= ip
->ip_dst
.s_addr
)
171 if (inp
->inp_faddr
.s_addr
!= INADDR_ANY
&&
172 inp
->inp_faddr
.s_addr
!= ip
->ip_src
.s_addr
)
175 struct mbuf
*n
= m_copypacket(m
, M_NOWAIT
);
178 /* check AH/ESP integrity. */
179 if (n
&& ipsec4_in_reject_so(n
, last
->inp_socket
)) {
181 ipsecstat
.in_polvio
++;
182 /* do not inject data to pcb */
186 /* check AH/ESP integrity. */
187 if (ipsec4_in_reject(n
, last
)) {
189 /* do not inject data to pcb */
191 #endif /*FAST_IPSEC*/
193 lwkt_gettoken(&last
->inp_socket
->so_rcv
.ssb_token
);
194 if (last
->inp_flags
& INP_CONTROLOPTS
||
195 last
->inp_socket
->so_options
& SO_TIMESTAMP
)
196 ip_savecontrol(last
, &opts
, ip
, n
);
197 if (ssb_appendaddr(&last
->inp_socket
->so_rcv
,
198 (struct sockaddr
*)&ripsrc
, n
,
200 /* should notify about lost packet */
205 sorwakeup(last
->inp_socket
);
207 lwkt_reltoken(&last
->inp_socket
->so_rcv
.ssb_token
);
214 /* check AH/ESP integrity. */
215 if (last
&& ipsec4_in_reject_so(m
, last
->inp_socket
)) {
217 ipsecstat
.in_polvio
++;
218 ipstat
.ips_delivered
--;
219 /* do not inject data to pcb */
223 /* check AH/ESP integrity. */
224 if (last
&& ipsec4_in_reject(m
, last
)) {
226 ipstat
.ips_delivered
--;
227 /* do not inject data to pcb */
229 #endif /*FAST_IPSEC*/
230 /* Check the minimum TTL for socket. */
231 if (last
&& ip
->ip_ttl
< last
->inp_ip_minttl
) {
233 ipstat
.ips_delivered
--;
235 if (last
->inp_flags
& INP_CONTROLOPTS
||
236 last
->inp_socket
->so_options
& SO_TIMESTAMP
)
237 ip_savecontrol(last
, &opts
, ip
, m
);
238 lwkt_gettoken(&last
->inp_socket
->so_rcv
.ssb_token
);
239 if (ssb_appendaddr(&last
->inp_socket
->so_rcv
,
240 (struct sockaddr
*)&ripsrc
, m
, opts
) == 0) {
245 sorwakeup(last
->inp_socket
);
247 lwkt_reltoken(&last
->inp_socket
->so_rcv
.ssb_token
);
250 ipstat
.ips_noproto
++;
251 ipstat
.ips_delivered
--;
253 return(IPPROTO_DONE
);
257 * Generate IP header and pass packet to ip_output.
258 * Tack on options user may have setup with control call.
261 rip_output(struct mbuf
*m
, struct socket
*so
, ...)
264 struct inpcb
*inp
= so
->so_pcb
;
266 int flags
= (so
->so_options
& SO_DONTROUTE
) | IP_ALLOWBROADCAST
;
272 dst
= __va_arg(ap
, u_long
);
276 * If the user handed us a complete IP packet, use it.
277 * Otherwise, allocate an mbuf for a header and fill it in.
279 if ((inp
->inp_flags
& INP_HDRINCL
) == 0) {
280 if (m
->m_pkthdr
.len
+ sizeof(struct ip
) > IP_MAXPACKET
) {
284 M_PREPEND(m
, sizeof(struct ip
), M_WAITOK
);
287 ip
= mtod(m
, struct ip
*);
288 ip
->ip_tos
= inp
->inp_ip_tos
;
290 ip
->ip_p
= inp
->inp_ip_p
;
291 ip
->ip_len
= m
->m_pkthdr
.len
;
292 ip
->ip_src
= inp
->inp_laddr
;
293 ip
->ip_dst
.s_addr
= dst
;
294 ip
->ip_ttl
= inp
->inp_ip_ttl
;
298 if (m
->m_pkthdr
.len
> IP_MAXPACKET
) {
302 if (m
->m_len
< sizeof(struct ip
)) {
303 m
= m_pullup(m
, sizeof(struct ip
));
307 ip
= mtod(m
, struct ip
*);
308 hlen
= IP_VHL_HL(ip
->ip_vhl
) << 2;
310 /* Don't allow header length less than the minimum. */
311 if (hlen
< sizeof(struct ip
)) {
317 * Don't allow both user specified and setsockopt options.
318 * Don't allow packet length sizes that will crash.
320 if ((hlen
!= sizeof(struct ip
) && inp
->inp_options
) ||
321 ip
->ip_len
> m
->m_pkthdr
.len
|| ip
->ip_len
< hlen
) {
326 ip
->ip_id
= ip_newid();
328 /* Prevent ip_output from overwriting header fields */
329 flags
|= IP_RAWOUTPUT
;
333 return ip_output(m
, inp
->inp_options
, &inp
->inp_route
, flags
,
334 inp
->inp_moptions
, inp
);
338 * Raw IP socket option processing.
341 rip_ctloutput(netmsg_t msg
)
343 struct socket
*so
= msg
->base
.nm_so
;
344 struct sockopt
*sopt
= msg
->ctloutput
.nm_sopt
;
345 struct inpcb
*inp
= so
->so_pcb
;
352 /* Get socket's owner cpuid hint */
353 if (sopt
->sopt_level
== SOL_SOCKET
&&
354 sopt
->sopt_dir
== SOPT_GET
&&
355 sopt
->sopt_name
== SO_CPUHINT
) {
357 soopt_from_kbuf(sopt
, &optval
, sizeof(optval
));
361 if (sopt
->sopt_level
!= IPPROTO_IP
) {
366 switch (sopt
->sopt_dir
) {
368 switch (sopt
->sopt_name
) {
370 optval
= inp
->inp_flags
& INP_HDRINCL
;
371 soopt_from_kbuf(sopt
, &optval
, sizeof optval
);
375 error
= ip_fw3_sockopt(sopt
);
378 case IP_FW_ADD
: /* ADD actually returns the body... */
381 case IP_FW_TBL_EXPIRE
: /* returns # of expired addresses */
382 error
= ip_fw_sockopt(sopt
);
385 case IP_DUMMYNET_GET
:
386 error
= ip_dn_sockopt(sopt
);
397 case MRT_API_SUPPORT
:
399 case MRT_ADD_BW_UPCALL
:
400 case MRT_DEL_BW_UPCALL
:
401 error
= ip_mrouter_get
? ip_mrouter_get(so
, sopt
) :
407 /* msg invalid now */
413 switch (sopt
->sopt_name
) {
415 error
= soopt_to_kbuf(sopt
, &optval
, sizeof optval
,
420 inp
->inp_flags
|= INP_HDRINCL
;
422 inp
->inp_flags
&= ~INP_HDRINCL
;
426 error
= ip_fw3_sockopt(sopt
);
434 case IP_FW_TBL_CREATE
:
435 case IP_FW_TBL_DESTROY
:
438 case IP_FW_TBL_FLUSH
:
440 case IP_FW_TBL_EXPIRE
:
441 error
= ip_fw_sockopt(sopt
);
444 case IP_DUMMYNET_CONFIGURE
:
445 case IP_DUMMYNET_DEL
:
446 case IP_DUMMYNET_FLUSH
:
447 error
= ip_dn_sockopt(sopt
);
451 error
= ip_rsvp_init(so
);
455 error
= ip_rsvp_done();
459 case IP_RSVP_VIF_OFF
:
460 error
= ip_rsvp_vif
?
461 ip_rsvp_vif(so
, sopt
) : EINVAL
;
472 case MRT_API_SUPPORT
:
474 case MRT_ADD_BW_UPCALL
:
475 case MRT_DEL_BW_UPCALL
:
476 error
= ip_mrouter_set
? ip_mrouter_set(so
, sopt
) :
482 /* msg invalid now */
488 lwkt_replymsg(&msg
->lmsg
, error
);
492 * This function exists solely to receive the PRC_IFDOWN messages which
493 * are sent by if_down(). It looks for an ifaddr whose ifa_addr is sa,
494 * and calls in_ifadown() to remove all routes corresponding to that address.
495 * It also receives the PRC_IFUP messages from if_up() and reinstalls the
499 rip_ctlinput(netmsg_t msg
)
501 int cmd
= msg
->ctlinput
.nm_cmd
;
502 struct sockaddr
*sa
= msg
->ctlinput
.nm_arg
;
503 struct in_ifaddr
*ia
;
504 struct in_ifaddr_container
*iac
;
513 TAILQ_FOREACH(iac
, &in_ifaddrheads
[mycpuid
], ia_link
) {
516 if (ia
->ia_ifa
.ifa_addr
== sa
&&
517 (ia
->ia_flags
& IFA_ROUTE
)) {
519 * in_ifscrub kills the interface route.
521 in_ifscrub(ia
->ia_ifp
, ia
);
523 * in_ifadown gets rid of all the rest of
524 * the routes. This is not quite the right
525 * thing to do, but at least if we are running
526 * a routing process they will come back.
528 in_ifadown(&ia
->ia_ifa
, 0);
536 TAILQ_FOREACH(iac
, &in_ifaddrheads
[mycpuid
], ia_link
) {
537 if (iac
->ia
->ia_ifa
.ifa_addr
== sa
) {
542 if (ia
== NULL
|| (ia
->ia_flags
& IFA_ROUTE
))
545 ifp
= ia
->ia_ifa
.ifa_ifp
;
549 * Don't add prefix routes for CARP interfaces.
550 * Prefix routes creation is handled by CARP
551 * interfaces themselves.
553 if (ifp
->if_type
== IFT_CARP
)
557 if ((ifp
->if_flags
& IFF_LOOPBACK
) ||
558 (ifp
->if_flags
& IFF_POINTOPOINT
))
561 err
= rtinit(&ia
->ia_ifa
, RTM_ADD
, flags
);
563 ia
->ia_flags
|= IFA_ROUTE
;
567 lwkt_replymsg(&msg
->lmsg
, 0);
570 u_long rip_sendspace
= RIPSNDQ
;
571 u_long rip_recvspace
= RIPRCVQ
;
573 SYSCTL_INT(_net_inet_raw
, OID_AUTO
, maxdgram
, CTLFLAG_RW
,
574 &rip_sendspace
, 0, "Maximum outgoing raw IP datagram size");
575 SYSCTL_INT(_net_inet_raw
, OID_AUTO
, recvspace
, CTLFLAG_RW
,
576 &rip_recvspace
, 0, "Maximum incoming raw IP datagram size");
579 rip_attach(netmsg_t msg
)
581 struct socket
*so
= msg
->base
.nm_so
;
582 int proto
= msg
->attach
.nm_proto
;
583 struct pru_attach_info
*ai
= msg
->attach
.nm_ai
;
592 error
= priv_check_cred(ai
->p_ucred
, PRIV_NETINET_RAW
, NULL_CRED_OKAY
);
596 error
= soreserve(so
, rip_sendspace
, rip_recvspace
, ai
->sb_rlimit
);
600 error
= in_pcballoc(so
, &ripcbinfo
);
602 inp
= (struct inpcb
*)so
->so_pcb
;
603 inp
->inp_ip_p
= proto
;
604 inp
->inp_ip_ttl
= ip_defttl
;
607 lwkt_replymsg(&msg
->lmsg
, error
);
611 rip_detach(netmsg_t msg
)
613 struct socket
*so
= msg
->base
.nm_so
;
621 if (so
== ip_mrouter
&& ip_mrouter_done
)
623 if (ip_rsvp_force_done
)
624 ip_rsvp_force_done(so
);
628 lwkt_replymsg(&msg
->lmsg
, 0);
632 rip_abort(netmsg_t msg
)
635 * Raw socket does not support listen(2),
636 * so this should never be called.
638 panic("rip_abort is called");
642 rip_disconnect(netmsg_t msg
)
644 struct socket
*so
= msg
->base
.nm_so
;
649 if (so
->so_state
& SS_ISCONNECTED
) {
650 soisdisconnected(so
);
655 lwkt_replymsg(&msg
->lmsg
, error
);
659 rip_bind(netmsg_t msg
)
661 struct socket
*so
= msg
->base
.nm_so
;
662 struct sockaddr
*nam
= msg
->bind
.nm_nam
;
663 struct inpcb
*inp
= so
->so_pcb
;
664 struct sockaddr_in
*addr
= (struct sockaddr_in
*)nam
;
669 if (nam
->sa_len
== sizeof(*addr
)) {
670 if (ifnet_array_isempty() ||
671 ((addr
->sin_family
!= AF_INET
) &&
672 (addr
->sin_family
!= AF_IMPLINK
)) ||
673 (addr
->sin_addr
.s_addr
!= INADDR_ANY
&&
674 ifa_ifwithaddr((struct sockaddr
*)addr
) == 0)) {
675 error
= EADDRNOTAVAIL
;
677 inp
->inp_laddr
= addr
->sin_addr
;
683 lwkt_replymsg(&msg
->lmsg
, error
);
687 rip_connect(netmsg_t msg
)
689 struct socket
*so
= msg
->base
.nm_so
;
690 struct sockaddr
*nam
= msg
->connect
.nm_nam
;
691 struct inpcb
*inp
= so
->so_pcb
;
692 struct sockaddr_in
*addr
= (struct sockaddr_in
*)nam
;
697 if (nam
->sa_len
!= sizeof(*addr
)) {
699 } else if (ifnet_array_isempty()) {
700 error
= EADDRNOTAVAIL
;
702 if ((addr
->sin_family
!= AF_INET
) &&
703 (addr
->sin_family
!= AF_IMPLINK
)) {
704 error
= EAFNOSUPPORT
;
706 inp
->inp_faddr
= addr
->sin_addr
;
711 lwkt_replymsg(&msg
->lmsg
, error
);
715 rip_shutdown(netmsg_t msg
)
719 socantsendmore(msg
->base
.nm_so
);
720 lwkt_replymsg(&msg
->lmsg
, 0);
724 rip_send(netmsg_t msg
)
726 struct socket
*so
= msg
->base
.nm_so
;
727 struct mbuf
*m
= msg
->send
.nm_m
;
728 /*struct mbuf *control = msg->send.nm_control;*/
729 struct sockaddr
*nam
= msg
->send
.nm_addr
;
730 /*int flags = msg->send.nm_flags;*/
731 struct inpcb
*inp
= so
->so_pcb
;
737 if (so
->so_state
& SS_ISCONNECTED
) {
742 dst
= inp
->inp_faddr
.s_addr
;
743 error
= rip_output(m
, so
, dst
);
750 dst
= ((struct sockaddr_in
*)nam
)->sin_addr
.s_addr
;
751 error
= rip_output(m
, so
, dst
);
754 lwkt_replymsg(&msg
->lmsg
, error
);
757 SYSCTL_PROC(_net_inet_raw
, OID_AUTO
/*XXX*/, pcblist
, CTLFLAG_RD
, &ripcbinfo
, 1,
758 in_pcblist_range
, "S,xinpcb", "List of active raw IP sockets");
760 struct pr_usrreqs rip_usrreqs
= {
761 .pru_abort
= rip_abort
,
762 .pru_accept
= pr_generic_notsupp
,
763 .pru_attach
= rip_attach
,
764 .pru_bind
= rip_bind
,
765 .pru_connect
= rip_connect
,
766 .pru_connect2
= pr_generic_notsupp
,
767 .pru_control
= in_control_dispatch
,
768 .pru_detach
= rip_detach
,
769 .pru_disconnect
= rip_disconnect
,
770 .pru_listen
= pr_generic_notsupp
,
771 .pru_peeraddr
= in_setpeeraddr_dispatch
,
772 .pru_rcvd
= pr_generic_notsupp
,
773 .pru_rcvoob
= pr_generic_notsupp
,
774 .pru_send
= rip_send
,
775 .pru_sense
= pru_sense_null
,
776 .pru_shutdown
= rip_shutdown
,
777 .pru_sockaddr
= in_setsockaddr_dispatch
,
778 .pru_sosend
= sosend
,
779 .pru_soreceive
= soreceive