2 * Copyright (c) 1982, 1986, 1988, 1990, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
30 * $FreeBSD: src/sys/netinet/ip_output.c,v 1.99.2.37 2003/04/15 06:44:45 silby Exp $
31 * $DragonFly: src/sys/netinet/ip_output.c,v 1.46 2008/07/07 22:02:10 nant Exp $
38 #include "opt_ipdivert.h"
39 #include "opt_ipfilter.h"
40 #include "opt_ipsec.h"
41 #include "opt_mbuf_stress_test.h"
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/kernel.h>
47 #include <sys/malloc.h>
49 #include <sys/protosw.h>
50 #include <sys/socket.h>
51 #include <sys/socketvar.h>
53 #include <sys/sysctl.h>
54 #include <sys/thread2.h>
55 #include <sys/in_cksum.h>
58 #include <net/netisr.h>
60 #include <net/route.h>
62 #include <netinet/in.h>
63 #include <netinet/in_systm.h>
64 #include <netinet/ip.h>
65 #include <netinet/in_pcb.h>
66 #include <netinet/in_var.h>
67 #include <netinet/ip_var.h>
69 #include <netproto/mpls/mpls_var.h>
71 static MALLOC_DEFINE(M_IPMOPTS
, "ip_moptions", "internet multicast options");
74 #include <netinet6/ipsec.h>
75 #include <netproto/key/key.h>
77 #include <netproto/key/key_debug.h>
79 #define KEYDEBUG(lev,arg)
84 #include <netproto/ipsec/ipsec.h>
85 #include <netproto/ipsec/xform.h>
86 #include <netproto/ipsec/key.h>
89 #include <net/ipfw/ip_fw.h>
90 #include <net/dummynet/ip_dummynet.h>
92 #define print_ip(x, a, y) kprintf("%s %d.%d.%d.%d%s",\
93 x, (ntohl(a.s_addr)>>24)&0xFF,\
94 (ntohl(a.s_addr)>>16)&0xFF,\
95 (ntohl(a.s_addr)>>8)&0xFF,\
96 (ntohl(a.s_addr))&0xFF, y);
100 #ifdef MBUF_STRESS_TEST
101 int mbuf_frag_size
= 0;
102 SYSCTL_INT(_net_inet_ip
, OID_AUTO
, mbuf_frag_size
, CTLFLAG_RW
,
103 &mbuf_frag_size
, 0, "Fragment outgoing mbufs to this size");
106 static struct mbuf
*ip_insertoptions(struct mbuf
*, struct mbuf
*, int *);
107 static struct ifnet
*ip_multicast_if(struct in_addr
*, int *);
108 static void ip_mloopback
109 (struct ifnet
*, struct mbuf
*, struct sockaddr_in
*, int);
110 static int ip_getmoptions
111 (struct sockopt
*, struct ip_moptions
*);
112 static int ip_pcbopts(int, struct mbuf
**, struct mbuf
*);
113 static int ip_setmoptions
114 (struct sockopt
*, struct ip_moptions
**);
116 int ip_optcopy(struct ip
*, struct ip
*);
119 extern struct protosw inetsw
[];
122 * IP output. The packet in mbuf chain m contains a skeletal IP
123 * header (with len, off, ttl, proto, tos, src, dst).
124 * The mbuf chain containing the packet will be freed.
125 * The mbuf opt, if present, will not be freed.
128 ip_output(struct mbuf
*m0
, struct mbuf
*opt
, struct route
*ro
,
129 int flags
, struct ip_moptions
*imo
, struct inpcb
*inp
)
132 struct ifnet
*ifp
= NULL
; /* keep compiler happy */
134 int hlen
= sizeof(struct ip
);
135 int len
, off
, error
= 0;
136 struct sockaddr_in
*dst
= NULL
; /* keep compiler happy */
137 struct in_ifaddr
*ia
= NULL
;
138 int isbroadcast
, sw_csum
;
139 struct in_addr pkt_dst
;
140 struct route iproute
;
141 struct m_tag
*dn_mtag
= NULL
;
143 struct secpolicy
*sp
= NULL
;
144 struct socket
*so
= inp
? inp
->inp_socket
: NULL
;
148 struct secpolicy
*sp
= NULL
;
149 struct tdb_ident
*tdbi
;
150 #endif /* FAST_IPSEC */
151 struct ip_fw_args args
;
152 int src_was_INADDR_ANY
= 0; /* as the name says... */
156 args
.next_hop
= NULL
;
158 /* Grab info from MT_TAG mbufs prepended to the chain. */
159 while (m0
!= NULL
&& m0
->m_type
== MT_TAG
) {
160 switch(m0
->_m_tag_id
) {
161 case PACKET_TAG_IPFORWARD
:
162 args
.next_hop
= (struct sockaddr_in
*)m0
->m_data
;
165 kprintf("ip_output: unrecognised MT_TAG tag %d\n",
174 /* Extract info from dummynet tag */
175 dn_mtag
= m_tag_find(m
, PACKET_TAG_DUMMYNET
, NULL
);
176 if (dn_mtag
!= NULL
) {
177 struct dn_pkt
*dn_pkt
= m_tag_data(dn_mtag
);
180 * The packet was already tagged, so part of the
181 * processing was already done, and we need to go down.
182 * Get parameters from the tag.
184 args
.rule
= dn_pkt
->dn_priv
;
188 dst
= dn_pkt
->dn_dst
;
190 flags
= dn_pkt
->flags
;
193 * Don't delete the dummynet tag here, just unlink it,
194 * since some local variables (like 'ro' and 'dst') are
195 * still referencing certain parts of it.
196 * The dummynet tag will be freed at the end of the
199 m_tag_unlink(m
, dn_mtag
);
204 bzero(ro
, sizeof *ro
);
207 if (args
.rule
!= NULL
) { /* dummynet already saw us */
208 ip
= mtod(m
, struct ip
*);
209 hlen
= IP_VHL_HL(ip
->ip_vhl
) << 2 ;
211 ia
= ifatoia(ro
->ro_rt
->rt_ifa
);
217 m
= ip_insertoptions(m
, opt
, &len
);
221 ip
= mtod(m
, struct ip
*);
222 pkt_dst
= args
.next_hop
? args
.next_hop
->sin_addr
: ip
->ip_dst
;
227 if (!(flags
& (IP_FORWARDING
|IP_RAWOUTPUT
))) {
228 ip
->ip_vhl
= IP_MAKE_VHL(IPVERSION
, hlen
>> 2);
230 ip
->ip_id
= ip_newid();
231 ipstat
.ips_localout
++;
233 hlen
= IP_VHL_HL(ip
->ip_vhl
) << 2;
236 dst
= (struct sockaddr_in
*)&ro
->ro_dst
;
238 * If there is a cached route,
239 * check that it is to the same destination
240 * and is still up. If not, free it and try again.
241 * The address family should also be checked in case of sharing the
245 (!(ro
->ro_rt
->rt_flags
& RTF_UP
) ||
246 dst
->sin_family
!= AF_INET
||
247 dst
->sin_addr
.s_addr
!= pkt_dst
.s_addr
)) {
249 ro
->ro_rt
= (struct rtentry
*)NULL
;
251 if (ro
->ro_rt
== NULL
) {
252 bzero(dst
, sizeof *dst
);
253 dst
->sin_family
= AF_INET
;
254 dst
->sin_len
= sizeof *dst
;
255 dst
->sin_addr
= pkt_dst
;
258 * If routing to interface only,
259 * short circuit routing lookup.
261 if (flags
& IP_ROUTETOIF
) {
262 if ((ia
= ifatoia(ifa_ifwithdstaddr(sintosa(dst
)))) == NULL
&&
263 (ia
= ifatoia(ifa_ifwithnet(sintosa(dst
)))) == NULL
) {
264 ipstat
.ips_noroute
++;
270 isbroadcast
= in_broadcast(dst
->sin_addr
, ifp
);
271 } else if (IN_MULTICAST(ntohl(ip
->ip_dst
.s_addr
)) &&
272 imo
!= NULL
&& imo
->imo_multicast_ifp
!= NULL
) {
274 * Bypass the normal routing lookup for multicast
275 * packets if the interface is specified.
277 ifp
= imo
->imo_multicast_ifp
;
279 isbroadcast
= 0; /* fool gcc */
282 * If this is the case, we probably don't want to allocate
283 * a protocol-cloned route since we didn't get one from the
284 * ULP. This lets TCP do its thing, while not burdening
285 * forwarding or ICMP with the overhead of cloning a route.
286 * Of course, we still want to do any cloning requested by
287 * the link layer, as this is probably required in all cases
288 * for correct operation (as it is for ARP).
290 if (ro
->ro_rt
== NULL
)
291 rtalloc_ign(ro
, RTF_PRCLONING
);
292 if (ro
->ro_rt
== NULL
) {
293 ipstat
.ips_noroute
++;
294 error
= EHOSTUNREACH
;
297 ia
= ifatoia(ro
->ro_rt
->rt_ifa
);
298 ifp
= ro
->ro_rt
->rt_ifp
;
300 if (ro
->ro_rt
->rt_flags
& RTF_GATEWAY
)
301 dst
= (struct sockaddr_in
*)ro
->ro_rt
->rt_gateway
;
302 if (ro
->ro_rt
->rt_flags
& RTF_HOST
)
303 isbroadcast
= (ro
->ro_rt
->rt_flags
& RTF_BROADCAST
);
305 isbroadcast
= in_broadcast(dst
->sin_addr
, ifp
);
307 if (IN_MULTICAST(ntohl(pkt_dst
.s_addr
))) {
308 struct in_multi
*inm
;
310 m
->m_flags
|= M_MCAST
;
312 * IP destination address is multicast. Make sure "dst"
313 * still points to the address in "ro". (It may have been
314 * changed to point to a gateway address, above.)
316 dst
= (struct sockaddr_in
*)&ro
->ro_dst
;
318 * See if the caller provided any multicast options
321 ip
->ip_ttl
= imo
->imo_multicast_ttl
;
322 if (imo
->imo_multicast_vif
!= -1)
325 ip_mcast_src(imo
->imo_multicast_vif
) :
328 ip
->ip_ttl
= IP_DEFAULT_MULTICAST_TTL
;
330 * Confirm that the outgoing interface supports multicast.
332 if ((imo
== NULL
) || (imo
->imo_multicast_vif
== -1)) {
333 if (!(ifp
->if_flags
& IFF_MULTICAST
)) {
334 ipstat
.ips_noroute
++;
340 * If source address not specified yet, use address
341 * of outgoing interface.
343 if (ip
->ip_src
.s_addr
== INADDR_ANY
) {
344 /* Interface may have no addresses. */
346 ip
->ip_src
= IA_SIN(ia
)->sin_addr
;
349 IN_LOOKUP_MULTI(pkt_dst
, ifp
, inm
);
351 (imo
== NULL
|| imo
->imo_multicast_loop
)) {
353 * If we belong to the destination multicast group
354 * on the outgoing interface, and the caller did not
355 * forbid loopback, loop back a copy.
357 ip_mloopback(ifp
, m
, dst
, hlen
);
361 * If we are acting as a multicast router, perform
362 * multicast forwarding as if the packet had just
363 * arrived on the interface to which we are about
364 * to send. The multicast forwarding function
365 * recursively calls this function, using the
366 * IP_FORWARDING flag to prevent infinite recursion.
368 * Multicasts that are looped back by ip_mloopback(),
369 * above, will be forwarded by the ip_input() routine,
372 if (ip_mrouter
&& !(flags
& IP_FORWARDING
)) {
374 * If rsvp daemon is not running, do not
375 * set ip_moptions. This ensures that the packet
376 * is multicast and not just sent down one link
377 * as prescribed by rsvpd.
382 ip_mforward(ip
, ifp
, m
, imo
) != 0) {
390 * Multicasts with a time-to-live of zero may be looped-
391 * back, above, but must not be transmitted on a network.
392 * Also, multicasts addressed to the loopback interface
393 * are not sent -- the above call to ip_mloopback() will
394 * loop back a copy if this host actually belongs to the
395 * destination group on the loopback interface.
397 if (ip
->ip_ttl
== 0 || ifp
->if_flags
& IFF_LOOPBACK
) {
406 * If the source address is not specified yet, use the address
407 * of the outoing interface. In case, keep note we did that, so
408 * if the the firewall changes the next-hop causing the output
409 * interface to change, we can fix that.
411 if (ip
->ip_src
.s_addr
== INADDR_ANY
) {
412 /* Interface may have no addresses. */
414 ip
->ip_src
= IA_SIN(ia
)->sin_addr
;
415 src_was_INADDR_ANY
= 1;
421 * Disable packet drop hack.
422 * Packetdrop should be done by queueing.
426 * Verify that we have any chance at all of being able to queue
427 * the packet or packet fragments
429 if ((ifp
->if_snd
.ifq_len
+ ip
->ip_len
/ ifp
->if_mtu
+ 1) >=
430 ifp
->if_snd
.ifq_maxlen
) {
432 ipstat
.ips_odropped
++;
438 * Look for broadcast address and
439 * verify user is allowed to send
443 if (!(ifp
->if_flags
& IFF_BROADCAST
)) {
444 error
= EADDRNOTAVAIL
;
447 if (!(flags
& IP_ALLOWBROADCAST
)) {
451 /* don't allow broadcast messages to be fragmented */
452 if (ip
->ip_len
> ifp
->if_mtu
) {
456 m
->m_flags
|= M_BCAST
;
458 m
->m_flags
&= ~M_BCAST
;
463 /* get SP for this packet */
465 sp
= ipsec4_getpolicybyaddr(m
, IPSEC_DIR_OUTBOUND
, flags
, &error
);
467 sp
= ipsec4_getpolicybysock(m
, IPSEC_DIR_OUTBOUND
, so
, &error
);
470 ipsecstat
.out_inval
++;
477 switch (sp
->policy
) {
478 case IPSEC_POLICY_DISCARD
:
480 * This packet is just discarded.
482 ipsecstat
.out_polvio
++;
485 case IPSEC_POLICY_BYPASS
:
486 case IPSEC_POLICY_NONE
:
487 /* no need to do IPsec. */
490 case IPSEC_POLICY_IPSEC
:
491 if (sp
->req
== NULL
) {
492 /* acquire a policy */
493 error
= key_spdacquire(sp
);
498 case IPSEC_POLICY_ENTRUST
:
500 kprintf("ip_output: Invalid policy found. %d\n", sp
->policy
);
503 struct ipsec_output_state state
;
504 bzero(&state
, sizeof state
);
506 if (flags
& IP_ROUTETOIF
) {
508 bzero(&iproute
, sizeof iproute
);
511 state
.dst
= (struct sockaddr
*)dst
;
517 * delayed checksums are not currently compatible with IPsec
519 if (m
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) {
521 m
->m_pkthdr
.csum_flags
&= ~CSUM_DELAY_DATA
;
524 ip
->ip_len
= htons(ip
->ip_len
);
525 ip
->ip_off
= htons(ip
->ip_off
);
527 error
= ipsec4_output(&state
, sp
, flags
);
530 if (flags
& IP_ROUTETOIF
) {
532 * if we have tunnel mode SA, we may need to ignore
535 if (state
.ro
!= &iproute
|| state
.ro
->ro_rt
!= NULL
) {
536 flags
&= ~IP_ROUTETOIF
;
541 dst
= (struct sockaddr_in
*)state
.dst
;
543 /* mbuf is already reclaimed in ipsec4_output. */
553 kprintf("ip4_output (ipsec): error code %d\n", error
);
556 /* don't show these error codes to the user */
564 /* be sure to update variables that are affected by ipsec4_output() */
565 ip
= mtod(m
, struct ip
*);
567 hlen
= IP_VHL_HL(ip
->ip_vhl
) << 2;
569 hlen
= ip
->ip_hl
<< 2;
571 if (ro
->ro_rt
== NULL
) {
572 if (!(flags
& IP_ROUTETOIF
)) {
573 kprintf("ip_output: "
574 "can't update route after IPsec processing\n");
575 error
= EHOSTUNREACH
; /*XXX*/
579 ia
= ifatoia(ro
->ro_rt
->rt_ifa
);
580 ifp
= ro
->ro_rt
->rt_ifp
;
583 /* make it flipped, again. */
584 ip
->ip_len
= ntohs(ip
->ip_len
);
585 ip
->ip_off
= ntohs(ip
->ip_off
);
590 * Check the security policy (SP) for the packet and, if
591 * required, do IPsec-related processing. There are two
592 * cases here; the first time a packet is sent through
593 * it will be untagged and handled by ipsec4_checkpolicy.
594 * If the packet is resubmitted to ip_output (e.g. after
595 * AH, ESP, etc. processing), there will be a tag to bypass
596 * the lookup and related policy checking.
598 mtag
= m_tag_find(m
, PACKET_TAG_IPSEC_PENDING_TDB
, NULL
);
601 tdbi
= (struct tdb_ident
*)m_tag_data(mtag
);
602 sp
= ipsec_getpolicy(tdbi
, IPSEC_DIR_OUTBOUND
);
604 error
= -EINVAL
; /* force silent drop */
605 m_tag_delete(m
, mtag
);
607 sp
= ipsec4_checkpolicy(m
, IPSEC_DIR_OUTBOUND
, flags
,
611 * There are four return cases:
612 * sp != NULL apply IPsec policy
613 * sp == NULL, error == 0 no IPsec handling needed
614 * sp == NULL, error == -EINVAL discard packet w/o error
615 * sp == NULL, error != 0 discard packet, report error
618 /* Loop detection, check if ipsec processing already done */
619 KASSERT(sp
->req
!= NULL
, ("ip_output: no ipsec request"));
620 for (mtag
= m_tag_first(m
); mtag
!= NULL
;
621 mtag
= m_tag_next(m
, mtag
)) {
622 if (mtag
->m_tag_cookie
!= MTAG_ABI_COMPAT
)
624 if (mtag
->m_tag_id
!= PACKET_TAG_IPSEC_OUT_DONE
&&
625 mtag
->m_tag_id
!= PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED
)
628 * Check if policy has an SA associated with it.
629 * This can happen when an SP has yet to acquire
630 * an SA; e.g. on first reference. If it occurs,
631 * then we let ipsec4_process_packet do its thing.
633 if (sp
->req
->sav
== NULL
)
635 tdbi
= (struct tdb_ident
*)m_tag_data(mtag
);
636 if (tdbi
->spi
== sp
->req
->sav
->spi
&&
637 tdbi
->proto
== sp
->req
->sav
->sah
->saidx
.proto
&&
638 bcmp(&tdbi
->dst
, &sp
->req
->sav
->sah
->saidx
.dst
,
639 sizeof(union sockaddr_union
)) == 0) {
641 * No IPsec processing is needed, free
644 * NB: null pointer to avoid free at
647 KEY_FREESP(&sp
), sp
= NULL
;
654 * Do delayed checksums now because we send before
655 * this is done in the normal processing path.
657 if (m
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) {
659 m
->m_pkthdr
.csum_flags
&= ~CSUM_DELAY_DATA
;
662 ip
->ip_len
= htons(ip
->ip_len
);
663 ip
->ip_off
= htons(ip
->ip_off
);
665 /* NB: callee frees mbuf */
666 error
= ipsec4_process_packet(m
, sp
->req
, flags
, 0);
668 * Preserve KAME behaviour: ENOENT can be returned
669 * when an SA acquire is in progress. Don't propagate
670 * this to user-level; it confuses applications.
672 * XXX this will go away when the SADB is redone.
683 * Hack: -EINVAL is used to signal that a packet
684 * should be silently discarded. This is typically
685 * because we asked key management for an SA and
686 * it was delayed (e.g. kicked up to IKE).
688 if (error
== -EINVAL
)
692 /* No IPsec processing for this packet. */
696 * If deferred crypto processing is needed, check that
697 * the interface supports it.
699 mtag
= m_tag_find(m
, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED
, NULL
);
700 if (mtag
!= NULL
&& !(ifp
->if_capenable
& IFCAP_IPSEC
)) {
701 /* notify IPsec to do its own crypto */
702 ipsp_skipcrypto_unmark((struct tdb_ident
*)m_tag_data(mtag
));
703 error
= EHOSTUNREACH
;
709 #endif /* FAST_IPSEC */
712 * - Xlate: translate packet's addr/port (NAT).
713 * - Firewall: deny/allow/etc.
714 * - Wrap: fake packet's addr/port <unimpl.>
715 * - Encapsulate: put it in another IP and send out. <unimp.>
719 * Run through list of hooks for output packets.
721 if (pfil_has_hooks(&inet_pfil_hook
)) {
722 error
= pfil_run_hooks(&inet_pfil_hook
, &m
, ifp
, PFIL_OUT
);
723 if (error
!= 0 || m
== NULL
)
725 ip
= mtod(m
, struct ip
*);
729 * Check with the firewall...
730 * but not if we are already being fwd'd from a firewall.
732 if (fw_enable
&& IPFW_LOADED
&& !args
.next_hop
) {
733 struct sockaddr_in
*old
= dst
;
738 off
= ip_fw_chk_ptr(&args
);
743 * On return we must do the following:
744 * m == NULL -> drop the pkt (old interface, deprecated)
745 * (off & IP_FW_PORT_DENY_FLAG) -> drop the pkt (new interface)
746 * 1<=off<= 0xffff -> DIVERT
747 * (off & IP_FW_PORT_DYNT_FLAG) -> send to a DUMMYNET pipe
748 * (off & IP_FW_PORT_TEE_FLAG) -> TEE the packet
749 * dst != old -> IPFIREWALL_FORWARD
750 * off==0, dst==old -> accept
751 * If some of the above modules are not compiled in, then
752 * we should't have to check the corresponding condition
753 * (because the ipfw control socket should not accept
754 * unsupported rules), but better play safe and drop
755 * packets in case of doubt.
757 if ( (off
& IP_FW_PORT_DENY_FLAG
) || m
== NULL
) {
763 ip
= mtod(m
, struct ip
*);
764 if (off
== 0 && dst
== old
) /* common case */
766 if (off
& IP_FW_PORT_DYNT_FLAG
) {
768 * pass the pkt to dummynet. Need to include
769 * pipe number, m, ifp, ro, dst because these are
770 * not recomputed in the next pass.
771 * All other parameters have been already used and
772 * so they are not needed anymore.
773 * XXX note: if the ifp or ro entry are deleted
774 * while a pkt is in dummynet, we are in trouble!
781 ip_fw_dn_io_ptr(m
, off
& 0xffff, DN_TO_IP_OUT
, &args
);
785 if (off
!= 0 && !(off
& IP_FW_PORT_DYNT_FLAG
)) {
786 struct mbuf
*clone
= NULL
;
788 /* Clone packet if we're doing a 'tee' */
789 if ((off
& IP_FW_PORT_TEE_FLAG
))
790 clone
= m_dup(m
, MB_DONTWAIT
);
794 * delayed checksums are not currently compatible
795 * with divert sockets.
797 if (m
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) {
799 m
->m_pkthdr
.csum_flags
&= ~CSUM_DELAY_DATA
;
802 /* Restore packet header fields to original values */
803 ip
->ip_len
= htons(ip
->ip_len
);
804 ip
->ip_off
= htons(ip
->ip_off
);
806 /* Deliver packet to divert input routine */
807 divert_packet(m
, 0, off
& 0xffff);
809 /* If 'tee', continue with original packet */
812 ip
= mtod(m
, struct ip
*);
819 /* IPFIREWALL_FORWARD */
821 * Check dst to make sure it is directly reachable on the
822 * interface we previously thought it was.
823 * If it isn't (which may be likely in some situations) we have
824 * to re-route it (ie, find a route for the next-hop and the
825 * associated interface) and set them here. This is nested
826 * forwarding which in most cases is undesirable, except where
827 * such control is nigh impossible. So we do it here.
830 if (off
== 0 && old
!= dst
) { /* FORWARD, dst has changed */
833 * XXX To improve readability, this block should be
834 * changed into a function call as below:
836 error
= ip_ipforward(&m
, &dst
, &ifp
);
839 if (m
== NULL
) /* ip_input consumed the mbuf */
842 struct in_ifaddr
*ia
;
843 struct in_ifaddr_container
*iac
;
846 * XXX sro_fwd below is static, and a pointer
847 * to it gets passed to routines downstream.
848 * This could have surprisingly bad results in
849 * practice, because its content is overwritten
850 * by subsequent packets.
852 /* There must be a better way to do this next line... */
853 static struct route sro_fwd
;
854 struct route
*ro_fwd
= &sro_fwd
;
857 print_ip("IPFIREWALL_FORWARD: New dst ip: ",
858 dst
->sin_addr
, "\n");
862 * We need to figure out if we have been forwarded
863 * to a local socket. If so, then we should somehow
864 * "loop back" to ip_input, and get directed to the
865 * PCB as if we had received this packet. This is
866 * because it may be dificult to identify the packets
867 * you want to forward until they are being output
868 * and have selected an interface. (e.g. locally
869 * initiated packets) If we used the loopback inteface,
870 * we would not be able to control what happens
871 * as the packet runs through ip_input() as
872 * it is done through a ISR.
875 LIST_FOREACH(iac
, INADDR_HASH(dst
->sin_addr
.s_addr
),
878 * If the addr to forward to is one
879 * of ours, we pretend to
880 * be the destination for this packet.
882 if (IA_SIN(iac
->ia
)->sin_addr
.s_addr
==
883 dst
->sin_addr
.s_addr
) {
888 if (ia
!= NULL
) { /* tell ip_input "dont filter" */
891 tag
.mh_type
= MT_TAG
;
892 tag
.mh_flags
= PACKET_TAG_IPFORWARD
;
893 tag
.mh_data
= (caddr_t
)args
.next_hop
;
896 if (m
->m_pkthdr
.rcvif
== NULL
)
897 m
->m_pkthdr
.rcvif
= ifunit("lo0");
898 if (m
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) {
899 m
->m_pkthdr
.csum_flags
|=
900 CSUM_DATA_VALID
| CSUM_PSEUDO_HDR
;
901 m
->m_pkthdr
.csum_data
= 0xffff;
903 m
->m_pkthdr
.csum_flags
|=
904 CSUM_IP_CHECKED
| CSUM_IP_VALID
;
905 ip
->ip_len
= htons(ip
->ip_len
);
906 ip
->ip_off
= htons(ip
->ip_off
);
907 ip_input((struct mbuf
*)&tag
);
910 /* Some of the logic for this was nicked from above.
912 * This rewrites the cached route in a local PCB.
913 * Is this what we want to do?
915 bcopy(dst
, &ro_fwd
->ro_dst
, sizeof *dst
);
916 ro_fwd
->ro_rt
= NULL
;
918 rtalloc_ign(ro_fwd
, RTF_PRCLONING
);
919 if (ro_fwd
->ro_rt
== NULL
) {
920 ipstat
.ips_noroute
++;
921 error
= EHOSTUNREACH
;
925 ia
= ifatoia(ro_fwd
->ro_rt
->rt_ifa
);
926 ifp
= ro_fwd
->ro_rt
->rt_ifp
;
927 ro_fwd
->ro_rt
->rt_use
++;
928 if (ro_fwd
->ro_rt
->rt_flags
& RTF_GATEWAY
)
929 dst
= (struct sockaddr_in
*)
930 ro_fwd
->ro_rt
->rt_gateway
;
931 if (ro_fwd
->ro_rt
->rt_flags
& RTF_HOST
)
933 (ro_fwd
->ro_rt
->rt_flags
& RTF_BROADCAST
);
935 isbroadcast
= in_broadcast(dst
->sin_addr
, ifp
);
936 if (ro
->ro_rt
!= NULL
)
938 ro
->ro_rt
= ro_fwd
->ro_rt
;
939 dst
= (struct sockaddr_in
*)&ro_fwd
->ro_dst
;
941 #endif /* ... block to be put into a function */
943 * If we added a default src ip earlier,
944 * which would have been gotten from the-then
945 * interface, do it again, from the new one.
947 if (src_was_INADDR_ANY
)
948 ip
->ip_src
= IA_SIN(ia
)->sin_addr
;
953 * if we get here, none of the above matches, and
954 * we have to drop the pkt
957 error
= EACCES
; /* not sure this is the right error msg */
962 /* 127/8 must not appear on wire - RFC1122. */
963 if ((ntohl(ip
->ip_dst
.s_addr
) >> IN_CLASSA_NSHIFT
) == IN_LOOPBACKNET
||
964 (ntohl(ip
->ip_src
.s_addr
) >> IN_CLASSA_NSHIFT
) == IN_LOOPBACKNET
) {
965 if (!(ifp
->if_flags
& IFF_LOOPBACK
)) {
966 ipstat
.ips_badaddr
++;
967 error
= EADDRNOTAVAIL
;
972 m
->m_pkthdr
.csum_flags
|= CSUM_IP
;
973 sw_csum
= m
->m_pkthdr
.csum_flags
& ~ifp
->if_hwassist
;
974 if (sw_csum
& CSUM_DELAY_DATA
) {
976 sw_csum
&= ~CSUM_DELAY_DATA
;
978 m
->m_pkthdr
.csum_flags
&= ifp
->if_hwassist
;
981 * If small enough for interface, or the interface will take
982 * care of the fragmentation for us, can just send directly.
984 if (ip
->ip_len
<= ifp
->if_mtu
|| ((ifp
->if_hwassist
& CSUM_FRAGMENT
) &&
985 !(ip
->ip_off
& IP_DF
))) {
986 ip
->ip_len
= htons(ip
->ip_len
);
987 ip
->ip_off
= htons(ip
->ip_off
);
989 if (sw_csum
& CSUM_DELAY_IP
) {
990 if (ip
->ip_vhl
== IP_VHL_BORING
) {
991 ip
->ip_sum
= in_cksum_hdr(ip
);
993 ip
->ip_sum
= in_cksum(m
, hlen
);
997 /* Record statistics for this interface address. */
998 if (!(flags
& IP_FORWARDING
) && ia
) {
999 ia
->ia_ifa
.if_opackets
++;
1000 ia
->ia_ifa
.if_obytes
+= m
->m_pkthdr
.len
;
1004 /* clean ipsec history once it goes out of the node */
1008 #ifdef MBUF_STRESS_TEST
1009 if (mbuf_frag_size
&& m
->m_pkthdr
.len
> mbuf_frag_size
) {
1010 struct mbuf
*m1
, *m2
;
1013 tmp
= length
= m
->m_pkthdr
.len
;
1015 while ((length
-= mbuf_frag_size
) >= 1) {
1016 m1
= m_split(m
, length
, MB_DONTWAIT
);
1020 while (m2
->m_next
!= NULL
)
1024 m
->m_pkthdr
.len
= tmp
;
1029 struct rtentry
*send_route
= ro
->ro_rt
; /* copy-in/copy-out parameter */
1031 if (!mpls_output_process(ifp
, m
, &dst
, send_route
))
1034 error
= ifp
->if_output(ifp
, m
, (struct sockaddr
*)dst
,
1039 if (ip
->ip_off
& IP_DF
) {
1042 * This case can happen if the user changed the MTU
1043 * of an interface after enabling IP on it. Because
1044 * most netifs don't keep track of routes pointing to
1045 * them, there is no way for one to update all its
1046 * routes when the MTU is changed.
1048 if ((ro
->ro_rt
->rt_flags
& (RTF_UP
| RTF_HOST
)) &&
1049 !(ro
->ro_rt
->rt_rmx
.rmx_locks
& RTV_MTU
) &&
1050 (ro
->ro_rt
->rt_rmx
.rmx_mtu
> ifp
->if_mtu
)) {
1051 ro
->ro_rt
->rt_rmx
.rmx_mtu
= ifp
->if_mtu
;
1053 ipstat
.ips_cantfrag
++;
1058 * Too large for interface; fragment if possible. If successful,
1059 * on return, m will point to a list of packets to be sent.
1061 error
= ip_fragment(ip
, &m
, ifp
->if_mtu
, ifp
->if_hwassist
, sw_csum
);
1066 m
->m_nextpkt
= NULL
;
1068 /* clean ipsec history once it goes out of the node */
1072 /* Record statistics for this interface address. */
1074 ia
->ia_ifa
.if_opackets
++;
1075 ia
->ia_ifa
.if_obytes
+= m
->m_pkthdr
.len
;
1078 struct rtentry
*send_route
= ro
->ro_rt
; /* copy-in/copy-out parameter */
1080 if (!mpls_output_process(ifp
, m
, &dst
, send_route
))
1083 error
= ifp
->if_output(ifp
, m
, (struct sockaddr
*)dst
,
1091 ipstat
.ips_fragmented
++;
1094 if (ro
== &iproute
&& ro
->ro_rt
!= NULL
) {
1100 KEYDEBUG(KEYDEBUG_IPSEC_STAMP
,
1101 kprintf("DP ip_output call free SP:%p\n", sp
));
1109 if (dn_mtag
!= NULL
)
1110 m_tag_free(dn_mtag
);
1119 * Create a chain of fragments which fit the given mtu. m_frag points to the
1120 * mbuf to be fragmented; on return it points to the chain with the fragments.
1121 * Return 0 if no error. If error, m_frag may contain a partially built
1122 * chain of fragments that should be freed by the caller.
1124 * if_hwassist_flags is the hw offload capabilities (see if_data.ifi_hwassist)
1125 * sw_csum contains the delayed checksums flags (e.g., CSUM_DELAY_IP).
1128 ip_fragment(struct ip
*ip
, struct mbuf
**m_frag
, int mtu
,
1129 u_long if_hwassist_flags
, int sw_csum
)
1132 int hlen
= IP_VHL_HL(ip
->ip_vhl
) << 2;
1133 int len
= (mtu
- hlen
) & ~7; /* size of payload in each fragment */
1135 struct mbuf
*m0
= *m_frag
; /* the original packet */
1137 struct mbuf
**mnext
;
1140 if (ip
->ip_off
& IP_DF
) { /* Fragmentation not allowed */
1141 ipstat
.ips_cantfrag
++;
1146 * Must be able to put at least 8 bytes per fragment.
1152 * If the interface will not calculate checksums on
1153 * fragmented packets, then do it here.
1155 if ((m0
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) &&
1156 !(if_hwassist_flags
& CSUM_IP_FRAGS
)) {
1157 in_delayed_cksum(m0
);
1158 m0
->m_pkthdr
.csum_flags
&= ~CSUM_DELAY_DATA
;
1161 if (len
> PAGE_SIZE
) {
1163 * Fragment large datagrams such that each segment
1164 * contains a multiple of PAGE_SIZE amount of data,
1165 * plus headers. This enables a receiver to perform
1166 * page-flipping zero-copy optimizations.
1168 * XXX When does this help given that sender and receiver
1169 * could have different page sizes, and also mtu could
1170 * be less than the receiver's page size ?
1175 for (m
= m0
, off
= 0; m
&& (off
+m
->m_len
) <= mtu
; m
= m
->m_next
)
1179 * firstlen (off - hlen) must be aligned on an
1183 goto smart_frag_failure
;
1184 off
= ((off
- hlen
) & ~7) + hlen
;
1185 newlen
= (~PAGE_MASK
) & mtu
;
1186 if ((newlen
+ sizeof(struct ip
)) > mtu
) {
1187 /* we failed, go back the default */
1198 firstlen
= off
- hlen
;
1199 mnext
= &m0
->m_nextpkt
; /* pointer to next packet */
1202 * Loop through length of segment after first fragment,
1203 * make new header and copy data of each part and link onto chain.
1204 * Here, m0 is the original packet, m is the fragment being created.
1205 * The fragments are linked off the m_nextpkt of the original
1206 * packet, which after processing serves as the first fragment.
1208 for (nfrags
= 1; off
< ip
->ip_len
; off
+= len
, nfrags
++) {
1209 struct ip
*mhip
; /* ip header on the fragment */
1211 int mhlen
= sizeof(struct ip
);
1213 MGETHDR(m
, MB_DONTWAIT
, MT_HEADER
);
1216 ipstat
.ips_odropped
++;
1219 m
->m_flags
|= (m0
->m_flags
& M_MCAST
) | M_FRAG
;
1221 * In the first mbuf, leave room for the link header, then
1222 * copy the original IP header including options. The payload
1223 * goes into an additional mbuf chain returned by m_copy().
1225 m
->m_data
+= max_linkhdr
;
1226 mhip
= mtod(m
, struct ip
*);
1228 if (hlen
> sizeof(struct ip
)) {
1229 mhlen
= ip_optcopy(ip
, mhip
) + sizeof(struct ip
);
1230 mhip
->ip_vhl
= IP_MAKE_VHL(IPVERSION
, mhlen
>> 2);
1233 /* XXX do we need to add ip->ip_off below ? */
1234 mhip
->ip_off
= ((off
- hlen
) >> 3) + ip
->ip_off
;
1235 if (off
+ len
>= ip
->ip_len
) { /* last fragment */
1236 len
= ip
->ip_len
- off
;
1237 m
->m_flags
|= M_LASTFRAG
;
1239 mhip
->ip_off
|= IP_MF
;
1240 mhip
->ip_len
= htons((u_short
)(len
+ mhlen
));
1241 m
->m_next
= m_copy(m0
, off
, len
);
1242 if (m
->m_next
== NULL
) { /* copy failed */
1244 error
= ENOBUFS
; /* ??? */
1245 ipstat
.ips_odropped
++;
1248 m
->m_pkthdr
.len
= mhlen
+ len
;
1249 m
->m_pkthdr
.rcvif
= (struct ifnet
*)NULL
;
1250 m
->m_pkthdr
.csum_flags
= m0
->m_pkthdr
.csum_flags
;
1251 mhip
->ip_off
= htons(mhip
->ip_off
);
1253 if (sw_csum
& CSUM_DELAY_IP
)
1254 mhip
->ip_sum
= in_cksum(m
, mhlen
);
1256 mnext
= &m
->m_nextpkt
;
1258 ipstat
.ips_ofragments
+= nfrags
;
1260 /* set first marker for fragment chain */
1261 m0
->m_flags
|= M_FIRSTFRAG
| M_FRAG
;
1262 m0
->m_pkthdr
.csum_data
= nfrags
;
1265 * Update first fragment by trimming what's been copied out
1266 * and updating header.
1268 m_adj(m0
, hlen
+ firstlen
- ip
->ip_len
);
1269 m0
->m_pkthdr
.len
= hlen
+ firstlen
;
1270 ip
->ip_len
= htons((u_short
)m0
->m_pkthdr
.len
);
1271 ip
->ip_off
|= IP_MF
;
1272 ip
->ip_off
= htons(ip
->ip_off
);
1274 if (sw_csum
& CSUM_DELAY_IP
)
1275 ip
->ip_sum
= in_cksum(m0
, hlen
);
1283 in_delayed_cksum(struct mbuf
*m
)
1286 u_short csum
, offset
;
1288 ip
= mtod(m
, struct ip
*);
1289 offset
= IP_VHL_HL(ip
->ip_vhl
) << 2 ;
1290 csum
= in_cksum_skip(m
, ip
->ip_len
, offset
);
1291 if (m
->m_pkthdr
.csum_flags
& CSUM_UDP
&& csum
== 0)
1293 offset
+= m
->m_pkthdr
.csum_data
; /* checksum offset */
1295 if (offset
+ sizeof(u_short
) > m
->m_len
) {
1296 kprintf("delayed m_pullup, m->len: %d off: %d p: %d\n",
1297 m
->m_len
, offset
, ip
->ip_p
);
1300 * this shouldn't happen, but if it does, the
1301 * correct behavior may be to insert the checksum
1302 * in the existing chain instead of rearranging it.
1304 m
= m_pullup(m
, offset
+ sizeof(u_short
));
1306 *(u_short
*)(m
->m_data
+ offset
) = csum
;
1310 * Insert IP options into preformed packet.
1311 * Adjust IP destination as required for IP source routing,
1312 * as indicated by a non-zero in_addr at the start of the options.
1314 * XXX This routine assumes that the packet has no options in place.
1316 static struct mbuf
*
1317 ip_insertoptions(struct mbuf
*m
, struct mbuf
*opt
, int *phlen
)
1319 struct ipoption
*p
= mtod(opt
, struct ipoption
*);
1321 struct ip
*ip
= mtod(m
, struct ip
*);
1324 optlen
= opt
->m_len
- sizeof p
->ipopt_dst
;
1325 if (optlen
+ (u_short
)ip
->ip_len
> IP_MAXPACKET
) {
1327 return (m
); /* XXX should fail */
1329 if (p
->ipopt_dst
.s_addr
)
1330 ip
->ip_dst
= p
->ipopt_dst
;
1331 if (m
->m_flags
& M_EXT
|| m
->m_data
- optlen
< m
->m_pktdat
) {
1332 MGETHDR(n
, MB_DONTWAIT
, MT_HEADER
);
1337 n
->m_pkthdr
.rcvif
= (struct ifnet
*)NULL
;
1338 n
->m_pkthdr
.len
= m
->m_pkthdr
.len
+ optlen
;
1339 m
->m_len
-= sizeof(struct ip
);
1340 m
->m_data
+= sizeof(struct ip
);
1343 m
->m_len
= optlen
+ sizeof(struct ip
);
1344 m
->m_data
+= max_linkhdr
;
1345 memcpy(mtod(m
, void *), ip
, sizeof(struct ip
));
1347 m
->m_data
-= optlen
;
1349 m
->m_pkthdr
.len
+= optlen
;
1350 ovbcopy(ip
, mtod(m
, caddr_t
), sizeof(struct ip
));
1352 ip
= mtod(m
, struct ip
*);
1353 bcopy(p
->ipopt_list
, ip
+ 1, optlen
);
1354 *phlen
= sizeof(struct ip
) + optlen
;
1355 ip
->ip_vhl
= IP_MAKE_VHL(IPVERSION
, *phlen
>> 2);
1356 ip
->ip_len
+= optlen
;
1361 * Copy options from ip to jp,
1362 * omitting those not copied during fragmentation.
1365 ip_optcopy(struct ip
*ip
, struct ip
*jp
)
1368 int opt
, optlen
, cnt
;
1370 cp
= (u_char
*)(ip
+ 1);
1371 dp
= (u_char
*)(jp
+ 1);
1372 cnt
= (IP_VHL_HL(ip
->ip_vhl
) << 2) - sizeof(struct ip
);
1373 for (; cnt
> 0; cnt
-= optlen
, cp
+= optlen
) {
1375 if (opt
== IPOPT_EOL
)
1377 if (opt
== IPOPT_NOP
) {
1378 /* Preserve for IP mcast tunnel's LSRR alignment. */
1384 KASSERT(cnt
>= IPOPT_OLEN
+ sizeof *cp
,
1385 ("ip_optcopy: malformed ipv4 option"));
1386 optlen
= cp
[IPOPT_OLEN
];
1387 KASSERT(optlen
>= IPOPT_OLEN
+ sizeof *cp
&& optlen
<= cnt
,
1388 ("ip_optcopy: malformed ipv4 option"));
1390 /* bogus lengths should have been caught by ip_dooptions */
1393 if (IPOPT_COPIED(opt
)) {
1394 bcopy(cp
, dp
, optlen
);
1398 for (optlen
= dp
- (u_char
*)(jp
+1); optlen
& 0x3; optlen
++)
1404 * IP socket option processing.
1407 ip_ctloutput(struct socket
*so
, struct sockopt
*sopt
)
1409 struct inpcb
*inp
= so
->so_pcb
;
1413 if (sopt
->sopt_level
!= IPPROTO_IP
) {
1417 switch (sopt
->sopt_dir
) {
1419 switch (sopt
->sopt_name
) {
1426 if (sopt
->sopt_valsize
> MLEN
) {
1430 MGET(m
, sopt
->sopt_td
? MB_WAIT
: MB_DONTWAIT
, MT_HEADER
);
1435 m
->m_len
= sopt
->sopt_valsize
;
1436 error
= soopt_to_kbuf(sopt
, mtod(m
, void *), m
->m_len
,
1438 return (ip_pcbopts(sopt
->sopt_name
, &inp
->inp_options
,
1446 case IP_RECVRETOPTS
:
1447 case IP_RECVDSTADDR
:
1451 error
= soopt_to_kbuf(sopt
, &optval
, sizeof optval
,
1455 switch (sopt
->sopt_name
) {
1457 inp
->inp_ip_tos
= optval
;
1461 inp
->inp_ip_ttl
= optval
;
1464 if (optval
> 0 && optval
<= MAXTTL
)
1465 inp
->inp_ip_minttl
= optval
;
1469 #define OPTSET(bit) \
1471 inp->inp_flags |= bit; \
1473 inp->inp_flags &= ~bit;
1476 OPTSET(INP_RECVOPTS
);
1479 case IP_RECVRETOPTS
:
1480 OPTSET(INP_RECVRETOPTS
);
1483 case IP_RECVDSTADDR
:
1484 OPTSET(INP_RECVDSTADDR
);
1492 OPTSET(INP_RECVTTL
);
1502 case IP_MULTICAST_IF
:
1503 case IP_MULTICAST_VIF
:
1504 case IP_MULTICAST_TTL
:
1505 case IP_MULTICAST_LOOP
:
1506 case IP_ADD_MEMBERSHIP
:
1507 case IP_DROP_MEMBERSHIP
:
1508 error
= ip_setmoptions(sopt
, &inp
->inp_moptions
);
1512 error
= soopt_to_kbuf(sopt
, &optval
, sizeof optval
,
1518 case IP_PORTRANGE_DEFAULT
:
1519 inp
->inp_flags
&= ~(INP_LOWPORT
);
1520 inp
->inp_flags
&= ~(INP_HIGHPORT
);
1523 case IP_PORTRANGE_HIGH
:
1524 inp
->inp_flags
&= ~(INP_LOWPORT
);
1525 inp
->inp_flags
|= INP_HIGHPORT
;
1528 case IP_PORTRANGE_LOW
:
1529 inp
->inp_flags
&= ~(INP_HIGHPORT
);
1530 inp
->inp_flags
|= INP_LOWPORT
;
1539 #if defined(IPSEC) || defined(FAST_IPSEC)
1540 case IP_IPSEC_POLICY
:
1548 if ((error
= soopt_getm(sopt
, &m
)) != 0) /* XXX */
1550 soopt_to_mbuf(sopt
, m
);
1551 priv
= (sopt
->sopt_td
!= NULL
&&
1552 suser(sopt
->sopt_td
) != 0) ? 0 : 1;
1553 req
= mtod(m
, caddr_t
);
1555 optname
= sopt
->sopt_name
;
1556 error
= ipsec4_set_policy(inp
, optname
, req
, len
, priv
);
1563 error
= ENOPROTOOPT
;
1569 switch (sopt
->sopt_name
) {
1572 if (inp
->inp_options
)
1573 soopt_from_kbuf(sopt
, mtod(inp
->inp_options
,
1575 inp
->inp_options
->m_len
);
1577 sopt
->sopt_valsize
= 0;
1584 case IP_RECVRETOPTS
:
1585 case IP_RECVDSTADDR
:
1590 switch (sopt
->sopt_name
) {
1593 optval
= inp
->inp_ip_tos
;
1597 optval
= inp
->inp_ip_ttl
;
1600 optval
= inp
->inp_ip_minttl
;
1603 #define OPTBIT(bit) (inp->inp_flags & bit ? 1 : 0)
1606 optval
= OPTBIT(INP_RECVOPTS
);
1609 case IP_RECVRETOPTS
:
1610 optval
= OPTBIT(INP_RECVRETOPTS
);
1613 case IP_RECVDSTADDR
:
1614 optval
= OPTBIT(INP_RECVDSTADDR
);
1618 optval
= OPTBIT(INP_RECVTTL
);
1622 optval
= OPTBIT(INP_RECVIF
);
1626 if (inp
->inp_flags
& INP_HIGHPORT
)
1627 optval
= IP_PORTRANGE_HIGH
;
1628 else if (inp
->inp_flags
& INP_LOWPORT
)
1629 optval
= IP_PORTRANGE_LOW
;
1635 optval
= OPTBIT(INP_FAITH
);
1638 soopt_from_kbuf(sopt
, &optval
, sizeof optval
);
1641 case IP_MULTICAST_IF
:
1642 case IP_MULTICAST_VIF
:
1643 case IP_MULTICAST_TTL
:
1644 case IP_MULTICAST_LOOP
:
1645 case IP_ADD_MEMBERSHIP
:
1646 case IP_DROP_MEMBERSHIP
:
1647 error
= ip_getmoptions(sopt
, inp
->inp_moptions
);
1650 #if defined(IPSEC) || defined(FAST_IPSEC)
1651 case IP_IPSEC_POLICY
:
1653 struct mbuf
*m
= NULL
;
1658 req
= mtod(m
, caddr_t
);
1661 error
= ipsec4_get_policy(so
->so_pcb
, req
, len
, &m
);
1663 error
= soopt_from_mbuf(sopt
, m
); /* XXX */
1671 error
= ENOPROTOOPT
;
1680 * Set up IP options in pcb for insertion in output packets.
1681 * Store in mbuf with pointer in pcbopt, adding pseudo-option
1682 * with destination address if source routed.
1685 ip_pcbopts(int optname
, struct mbuf
**pcbopt
, struct mbuf
*m
)
1691 /* turn off any old options */
1695 if (m
== NULL
|| m
->m_len
== 0) {
1697 * Only turning off any previous options.
1704 if (m
->m_len
% sizeof(int32_t))
1707 * IP first-hop destination address will be stored before
1708 * actual options; move other options back
1709 * and clear it when none present.
1711 if (m
->m_data
+ m
->m_len
+ sizeof(struct in_addr
) >= &m
->m_dat
[MLEN
])
1714 m
->m_len
+= sizeof(struct in_addr
);
1715 cp
= mtod(m
, u_char
*) + sizeof(struct in_addr
);
1716 ovbcopy(mtod(m
, caddr_t
), cp
, cnt
);
1717 bzero(mtod(m
, caddr_t
), sizeof(struct in_addr
));
1719 for (; cnt
> 0; cnt
-= optlen
, cp
+= optlen
) {
1720 opt
= cp
[IPOPT_OPTVAL
];
1721 if (opt
== IPOPT_EOL
)
1723 if (opt
== IPOPT_NOP
)
1726 if (cnt
< IPOPT_OLEN
+ sizeof *cp
)
1728 optlen
= cp
[IPOPT_OLEN
];
1729 if (optlen
< IPOPT_OLEN
+ sizeof *cp
|| optlen
> cnt
)
1740 * user process specifies route as:
1742 * D must be our final destination (but we can't
1743 * check that since we may not have connected yet).
1744 * A is first hop destination, which doesn't appear in
1745 * actual IP option, but is stored before the options.
1747 if (optlen
< IPOPT_MINOFF
- 1 + sizeof(struct in_addr
))
1749 m
->m_len
-= sizeof(struct in_addr
);
1750 cnt
-= sizeof(struct in_addr
);
1751 optlen
-= sizeof(struct in_addr
);
1752 cp
[IPOPT_OLEN
] = optlen
;
1754 * Move first hop before start of options.
1756 bcopy(&cp
[IPOPT_OFFSET
+1], mtod(m
, caddr_t
),
1757 sizeof(struct in_addr
));
1759 * Then copy rest of options back
1760 * to close up the deleted entry.
1762 ovbcopy(&cp
[IPOPT_OFFSET
+1] + sizeof(struct in_addr
),
1763 &cp
[IPOPT_OFFSET
+1],
1764 cnt
- (IPOPT_MINOFF
- 1));
1768 if (m
->m_len
> MAX_IPOPTLEN
+ sizeof(struct in_addr
))
1780 * The whole multicast option thing needs to be re-thought.
1781 * Several of these options are equally applicable to non-multicast
1782 * transmission, and one (IP_MULTICAST_TTL) totally duplicates a
1783 * standard option (IP_TTL).
1787 * following RFC1724 section 3.3, 0.0.0.0/8 is interpreted as interface index.
1789 static struct ifnet
*
1790 ip_multicast_if(struct in_addr
*a
, int *ifindexp
)
1797 if (ntohl(a
->s_addr
) >> 24 == 0) {
1798 ifindex
= ntohl(a
->s_addr
) & 0xffffff;
1799 if (ifindex
< 0 || if_index
< ifindex
)
1801 ifp
= ifindex2ifnet
[ifindex
];
1803 *ifindexp
= ifindex
;
1805 ifp
= INADDR_TO_IFP(a
);
1811 * Set the IP multicast options in response to user setsockopt().
1814 ip_setmoptions(struct sockopt
*sopt
, struct ip_moptions
**imop
)
1818 struct in_addr addr
;
1819 struct ip_mreq mreq
;
1821 struct ip_moptions
*imo
= *imop
;
1826 * No multicast option buffer attached to the pcb;
1827 * allocate one and initialize to default values.
1829 imo
= kmalloc(sizeof *imo
, M_IPMOPTS
, M_WAITOK
);
1832 imo
->imo_multicast_ifp
= NULL
;
1833 imo
->imo_multicast_addr
.s_addr
= INADDR_ANY
;
1834 imo
->imo_multicast_vif
= -1;
1835 imo
->imo_multicast_ttl
= IP_DEFAULT_MULTICAST_TTL
;
1836 imo
->imo_multicast_loop
= IP_DEFAULT_MULTICAST_LOOP
;
1837 imo
->imo_num_memberships
= 0;
1839 switch (sopt
->sopt_name
) {
1840 /* store an index number for the vif you wanna use in the send */
1841 case IP_MULTICAST_VIF
:
1842 if (legal_vif_num
== 0) {
1846 error
= soopt_to_kbuf(sopt
, &i
, sizeof i
, sizeof i
);
1849 if (!legal_vif_num(i
) && (i
!= -1)) {
1853 imo
->imo_multicast_vif
= i
;
1856 case IP_MULTICAST_IF
:
1858 * Select the interface for outgoing multicast packets.
1860 error
= soopt_to_kbuf(sopt
, &addr
, sizeof addr
, sizeof addr
);
1865 * INADDR_ANY is used to remove a previous selection.
1866 * When no interface is selected, a default one is
1867 * chosen every time a multicast packet is sent.
1869 if (addr
.s_addr
== INADDR_ANY
) {
1870 imo
->imo_multicast_ifp
= NULL
;
1874 * The selected interface is identified by its local
1875 * IP address. Find the interface and confirm that
1876 * it supports multicasting.
1879 ifp
= ip_multicast_if(&addr
, &ifindex
);
1880 if (ifp
== NULL
|| !(ifp
->if_flags
& IFF_MULTICAST
)) {
1882 error
= EADDRNOTAVAIL
;
1885 imo
->imo_multicast_ifp
= ifp
;
1887 imo
->imo_multicast_addr
= addr
;
1889 imo
->imo_multicast_addr
.s_addr
= INADDR_ANY
;
1893 case IP_MULTICAST_TTL
:
1895 * Set the IP time-to-live for outgoing multicast packets.
1896 * The original multicast API required a char argument,
1897 * which is inconsistent with the rest of the socket API.
1898 * We allow either a char or an int.
1900 if (sopt
->sopt_valsize
== 1) {
1902 error
= soopt_to_kbuf(sopt
, &ttl
, 1, 1);
1905 imo
->imo_multicast_ttl
= ttl
;
1908 error
= soopt_to_kbuf(sopt
, &ttl
, sizeof ttl
, sizeof ttl
);
1914 imo
->imo_multicast_ttl
= ttl
;
1918 case IP_MULTICAST_LOOP
:
1920 * Set the loopback flag for outgoing multicast packets.
1921 * Must be zero or one. The original multicast API required a
1922 * char argument, which is inconsistent with the rest
1923 * of the socket API. We allow either a char or an int.
1925 if (sopt
->sopt_valsize
== 1) {
1928 error
= soopt_to_kbuf(sopt
, &loop
, 1, 1);
1931 imo
->imo_multicast_loop
= !!loop
;
1935 error
= soopt_to_kbuf(sopt
, &loop
, sizeof loop
,
1939 imo
->imo_multicast_loop
= !!loop
;
1943 case IP_ADD_MEMBERSHIP
:
1945 * Add a multicast group membership.
1946 * Group must be a valid IP multicast address.
1948 error
= soopt_to_kbuf(sopt
, &mreq
, sizeof mreq
, sizeof mreq
);
1952 if (!IN_MULTICAST(ntohl(mreq
.imr_multiaddr
.s_addr
))) {
1958 * If no interface address was provided, use the interface of
1959 * the route to the given multicast address.
1961 if (mreq
.imr_interface
.s_addr
== INADDR_ANY
) {
1962 struct sockaddr_in dst
;
1965 bzero(&dst
, sizeof(struct sockaddr_in
));
1966 dst
.sin_len
= sizeof(struct sockaddr_in
);
1967 dst
.sin_family
= AF_INET
;
1968 dst
.sin_addr
= mreq
.imr_multiaddr
;
1969 rt
= rtlookup((struct sockaddr
*)&dst
);
1971 error
= EADDRNOTAVAIL
;
1978 ifp
= ip_multicast_if(&mreq
.imr_interface
, NULL
);
1982 * See if we found an interface, and confirm that it
1983 * supports multicast.
1985 if (ifp
== NULL
|| !(ifp
->if_flags
& IFF_MULTICAST
)) {
1986 error
= EADDRNOTAVAIL
;
1991 * See if the membership already exists or if all the
1992 * membership slots are full.
1994 for (i
= 0; i
< imo
->imo_num_memberships
; ++i
) {
1995 if (imo
->imo_membership
[i
]->inm_ifp
== ifp
&&
1996 imo
->imo_membership
[i
]->inm_addr
.s_addr
1997 == mreq
.imr_multiaddr
.s_addr
)
2000 if (i
< imo
->imo_num_memberships
) {
2005 if (i
== IP_MAX_MEMBERSHIPS
) {
2006 error
= ETOOMANYREFS
;
2011 * Everything looks good; add a new record to the multicast
2012 * address list for the given interface.
2014 if ((imo
->imo_membership
[i
] =
2015 in_addmulti(&mreq
.imr_multiaddr
, ifp
)) == NULL
) {
2020 ++imo
->imo_num_memberships
;
2024 case IP_DROP_MEMBERSHIP
:
2026 * Drop a multicast group membership.
2027 * Group must be a valid IP multicast address.
2029 error
= soopt_to_kbuf(sopt
, &mreq
, sizeof mreq
, sizeof mreq
);
2033 if (!IN_MULTICAST(ntohl(mreq
.imr_multiaddr
.s_addr
))) {
2040 * If an interface address was specified, get a pointer
2041 * to its ifnet structure.
2043 if (mreq
.imr_interface
.s_addr
== INADDR_ANY
)
2046 ifp
= ip_multicast_if(&mreq
.imr_interface
, NULL
);
2048 error
= EADDRNOTAVAIL
;
2054 * Find the membership in the membership array.
2056 for (i
= 0; i
< imo
->imo_num_memberships
; ++i
) {
2058 imo
->imo_membership
[i
]->inm_ifp
== ifp
) &&
2059 imo
->imo_membership
[i
]->inm_addr
.s_addr
==
2060 mreq
.imr_multiaddr
.s_addr
)
2063 if (i
== imo
->imo_num_memberships
) {
2064 error
= EADDRNOTAVAIL
;
2069 * Give up the multicast address record to which the
2070 * membership points.
2072 in_delmulti(imo
->imo_membership
[i
]);
2074 * Remove the gap in the membership array.
2076 for (++i
; i
< imo
->imo_num_memberships
; ++i
)
2077 imo
->imo_membership
[i
-1] = imo
->imo_membership
[i
];
2078 --imo
->imo_num_memberships
;
2088 * If all options have default values, no need to keep the mbuf.
2090 if (imo
->imo_multicast_ifp
== NULL
&&
2091 imo
->imo_multicast_vif
== -1 &&
2092 imo
->imo_multicast_ttl
== IP_DEFAULT_MULTICAST_TTL
&&
2093 imo
->imo_multicast_loop
== IP_DEFAULT_MULTICAST_LOOP
&&
2094 imo
->imo_num_memberships
== 0) {
2095 kfree(*imop
, M_IPMOPTS
);
2103 * Return the IP multicast options in response to user getsockopt().
2106 ip_getmoptions(struct sockopt
*sopt
, struct ip_moptions
*imo
)
2108 struct in_addr addr
;
2109 struct in_ifaddr
*ia
;
2114 switch (sopt
->sopt_name
) {
2115 case IP_MULTICAST_VIF
:
2117 optval
= imo
->imo_multicast_vif
;
2120 soopt_from_kbuf(sopt
, &optval
, sizeof optval
);
2123 case IP_MULTICAST_IF
:
2124 if (imo
== NULL
|| imo
->imo_multicast_ifp
== NULL
)
2125 addr
.s_addr
= INADDR_ANY
;
2126 else if (imo
->imo_multicast_addr
.s_addr
) {
2127 /* return the value user has set */
2128 addr
= imo
->imo_multicast_addr
;
2130 ia
= IFP_TO_IA(imo
->imo_multicast_ifp
);
2131 addr
.s_addr
= (ia
== NULL
) ? INADDR_ANY
2132 : IA_SIN(ia
)->sin_addr
.s_addr
;
2134 soopt_from_kbuf(sopt
, &addr
, sizeof addr
);
2137 case IP_MULTICAST_TTL
:
2139 optval
= coptval
= IP_DEFAULT_MULTICAST_TTL
;
2141 optval
= coptval
= imo
->imo_multicast_ttl
;
2142 if (sopt
->sopt_valsize
== 1)
2143 soopt_from_kbuf(sopt
, &coptval
, 1);
2145 soopt_from_kbuf(sopt
, &optval
, sizeof optval
);
2148 case IP_MULTICAST_LOOP
:
2150 optval
= coptval
= IP_DEFAULT_MULTICAST_LOOP
;
2152 optval
= coptval
= imo
->imo_multicast_loop
;
2153 if (sopt
->sopt_valsize
== 1)
2154 soopt_from_kbuf(sopt
, &coptval
, 1);
2156 soopt_from_kbuf(sopt
, &optval
, sizeof optval
);
2160 error
= ENOPROTOOPT
;
2167 * Discard the IP multicast options.
2170 ip_freemoptions(struct ip_moptions
*imo
)
2175 for (i
= 0; i
< imo
->imo_num_memberships
; ++i
)
2176 in_delmulti(imo
->imo_membership
[i
]);
2177 kfree(imo
, M_IPMOPTS
);
2182 * Routine called from ip_output() to loop back a copy of an IP multicast
2183 * packet to the input queue of a specified interface. Note that this
2184 * calls the output routine of the loopback "driver", but with an interface
2185 * pointer that might NOT be a loopback interface -- evil, but easier than
2186 * replicating that code here.
2189 ip_mloopback(struct ifnet
*ifp
, struct mbuf
*m
, struct sockaddr_in
*dst
,
2195 copym
= m_copypacket(m
, MB_DONTWAIT
);
2196 if (copym
!= NULL
&& (copym
->m_flags
& M_EXT
|| copym
->m_len
< hlen
))
2197 copym
= m_pullup(copym
, hlen
);
2198 if (copym
!= NULL
) {
2200 * if the checksum hasn't been computed, mark it as valid
2202 if (copym
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) {
2203 in_delayed_cksum(copym
);
2204 copym
->m_pkthdr
.csum_flags
&= ~CSUM_DELAY_DATA
;
2205 copym
->m_pkthdr
.csum_flags
|=
2206 CSUM_DATA_VALID
| CSUM_PSEUDO_HDR
;
2207 copym
->m_pkthdr
.csum_data
= 0xffff;
2210 * We don't bother to fragment if the IP length is greater
2211 * than the interface's MTU. Can this possibly matter?
2213 ip
= mtod(copym
, struct ip
*);
2214 ip
->ip_len
= htons(ip
->ip_len
);
2215 ip
->ip_off
= htons(ip
->ip_off
);
2217 if (ip
->ip_vhl
== IP_VHL_BORING
) {
2218 ip
->ip_sum
= in_cksum_hdr(ip
);
2220 ip
->ip_sum
= in_cksum(copym
, hlen
);
2224 * It's not clear whether there are any lingering
2225 * reentrancy problems in other areas which might
2226 * be exposed by using ip_input directly (in
2227 * particular, everything which modifies the packet
2228 * in-place). Yet another option is using the
2229 * protosw directly to deliver the looped back
2230 * packet. For the moment, we'll err on the side
2231 * of safety by using if_simloop().
2234 if (dst
->sin_family
!= AF_INET
) {
2235 kprintf("ip_mloopback: bad address family %d\n",
2237 dst
->sin_family
= AF_INET
;
2242 copym
->m_pkthdr
.rcvif
= ifp
;
2245 if_simloop(ifp
, copym
, dst
->sin_family
, 0);