2 * Copyright (c) 1982, 1986, 1988, 1990, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
30 * $FreeBSD: src/sys/netinet/ip_output.c,v 1.99.2.37 2003/04/15 06:44:45 silby Exp $
36 #include "opt_ipdivert.h"
37 #include "opt_ipsec.h"
38 #include "opt_mbuf_stress_test.h"
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/kernel.h>
44 #include <sys/malloc.h>
46 #include <sys/protosw.h>
47 #include <sys/socket.h>
48 #include <sys/socketvar.h>
51 #include <sys/sysctl.h>
52 #include <sys/in_cksum.h>
55 #include <sys/thread2.h>
56 #include <sys/mplock2.h>
57 #include <sys/msgport2.h>
60 #include <net/netisr.h>
62 #include <net/route.h>
64 #include <netinet/in.h>
65 #include <netinet/in_systm.h>
66 #include <netinet/ip.h>
67 #include <netinet/in_pcb.h>
68 #include <netinet/in_var.h>
69 #include <netinet/ip_var.h>
71 #include <netproto/mpls/mpls_var.h>
73 static MALLOC_DEFINE(M_IPMOPTS
, "ip_moptions", "internet multicast options");
76 #include <netinet6/ipsec.h>
77 #include <netproto/key/key.h>
79 #include <netproto/key/key_debug.h>
81 #define KEYDEBUG(lev,arg)
86 #include <netproto/ipsec/ipsec.h>
87 #include <netproto/ipsec/xform.h>
88 #include <netproto/ipsec/key.h>
91 #include <net/ipfw/ip_fw.h>
92 #include <net/dummynet/ip_dummynet.h>
94 #define print_ip(x, a, y) kprintf("%s %d.%d.%d.%d%s",\
95 x, (ntohl(a.s_addr)>>24)&0xFF,\
96 (ntohl(a.s_addr)>>16)&0xFF,\
97 (ntohl(a.s_addr)>>8)&0xFF,\
98 (ntohl(a.s_addr))&0xFF, y);
102 #ifdef MBUF_STRESS_TEST
103 int mbuf_frag_size
= 0;
104 SYSCTL_INT(_net_inet_ip
, OID_AUTO
, mbuf_frag_size
, CTLFLAG_RW
,
105 &mbuf_frag_size
, 0, "Fragment outgoing mbufs to this size");
108 static int ip_do_rfc6864
= 1;
109 SYSCTL_INT(_net_inet_ip
, OID_AUTO
, rfc6864
, CTLFLAG_RW
, &ip_do_rfc6864
, 0,
110 "Don't generate IP ID for DF IP datagrams");
112 static struct mbuf
*ip_insertoptions(struct mbuf
*, struct mbuf
*, int *);
113 static struct ifnet
*ip_multicast_if(struct in_addr
*, int *);
114 static void ip_mloopback
115 (struct ifnet
*, struct mbuf
*, struct sockaddr_in
*, int);
116 static int ip_getmoptions
117 (struct sockopt
*, struct ip_moptions
*);
118 static int ip_pcbopts(int, struct mbuf
**, struct mbuf
*);
119 static int ip_setmoptions
120 (struct sockopt
*, struct ip_moptions
**);
122 int ip_optcopy(struct ip
*, struct ip
*);
124 extern struct protosw inetsw
[];
127 ip_localforward(struct mbuf
*m
, const struct sockaddr_in
*dst
, int hlen
)
129 struct in_ifaddr_container
*iac
;
132 * We need to figure out if we have been forwarded to a local
133 * socket. If so, then we should somehow "loop back" to
134 * ip_input(), and get directed to the PCB as if we had received
135 * this packet. This is because it may be difficult to identify
136 * the packets you want to forward until they are being output
137 * and have selected an interface (e.g. locally initiated
138 * packets). If we used the loopback inteface, we would not be
139 * able to control what happens as the packet runs through
140 * ip_input() as it is done through a ISR.
142 LIST_FOREACH(iac
, INADDR_HASH(dst
->sin_addr
.s_addr
), ia_hash
) {
144 * If the addr to forward to is one of ours, we pretend
145 * to be the destination for this packet.
147 if (IA_SIN(iac
->ia
)->sin_addr
.s_addr
== dst
->sin_addr
.s_addr
)
153 if (m
->m_pkthdr
.rcvif
== NULL
)
154 m
->m_pkthdr
.rcvif
= loif
;
155 if (m
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) {
156 m
->m_pkthdr
.csum_flags
|= CSUM_DATA_VALID
|
158 m
->m_pkthdr
.csum_data
= 0xffff;
160 m
->m_pkthdr
.csum_flags
|= CSUM_IP_CHECKED
| CSUM_IP_VALID
;
163 * Make sure that the IP header is in one mbuf,
164 * required by ip_input
166 if (m
->m_len
< hlen
) {
167 m
= m_pullup(m
, hlen
);
169 /* The packet was freed; we are done */
173 ip
= mtod(m
, struct ip
*);
175 ip
->ip_len
= htons(ip
->ip_len
);
176 ip
->ip_off
= htons(ip
->ip_off
);
179 return 1; /* The packet gets forwarded locally */
185 * IP output. The packet in mbuf chain m contains a skeletal IP
186 * header (with len, off, ttl, proto, tos, src, dst).
187 * The mbuf chain containing the packet will be freed.
188 * The mbuf opt, if present, will not be freed.
191 ip_output(struct mbuf
*m0
, struct mbuf
*opt
, struct route
*ro
,
192 int flags
, struct ip_moptions
*imo
, struct inpcb
*inp
)
195 struct ifnet
*ifp
= NULL
; /* keep compiler happy */
197 int hlen
= sizeof(struct ip
);
199 struct sockaddr_in
*dst
= NULL
; /* keep compiler happy */
200 struct in_ifaddr
*ia
= NULL
;
201 int isbroadcast
, sw_csum
;
202 struct in_addr pkt_dst
;
203 struct route iproute
;
206 struct secpolicy
*sp
= NULL
;
207 struct socket
*so
= inp
? inp
->inp_socket
: NULL
;
210 struct secpolicy
*sp
= NULL
;
211 struct tdb_ident
*tdbi
;
212 #endif /* FAST_IPSEC */
213 struct sockaddr_in
*next_hop
= NULL
;
214 int src_was_INADDR_ANY
= 0; /* as the name says... */
216 ASSERT_NETISR_NCPUS(mycpuid
);
223 bzero(ro
, sizeof *ro
);
224 } else if (ro
->ro_rt
!= NULL
&& ro
->ro_rt
->rt_cpuid
!= mycpuid
) {
225 if (flags
& IP_DEBUGROUTE
) {
226 panic("ip_output: rt rt_cpuid %d accessed on cpu %d\n",
227 ro
->ro_rt
->rt_cpuid
, mycpuid
);
232 * If the cached rtentry's owner CPU is not the current CPU,
233 * then don't touch the cached rtentry (remote free is too
234 * expensive in this context); just relocate the route.
237 bzero(ro
, sizeof *ro
);
240 if (m
->m_pkthdr
.fw_flags
& IPFORWARD_MBUF_TAGGED
) {
242 mtag
= m_tag_find(m
, PACKET_TAG_IPFORWARD
, NULL
);
243 KKASSERT(mtag
!= NULL
);
244 next_hop
= m_tag_data(mtag
);
247 if (m
->m_pkthdr
.fw_flags
& DUMMYNET_MBUF_TAGGED
) {
248 struct dn_pkt
*dn_pkt
;
250 /* Extract info from dummynet tag */
251 mtag
= m_tag_find(m
, PACKET_TAG_DUMMYNET
, NULL
);
252 KKASSERT(mtag
!= NULL
);
253 dn_pkt
= m_tag_data(mtag
);
256 * The packet was already tagged, so part of the
257 * processing was already done, and we need to go down.
258 * Get the calculated parameters from the tag.
262 KKASSERT(ro
== &iproute
);
263 *ro
= dn_pkt
->ro
; /* structure copy */
264 KKASSERT(ro
->ro_rt
== NULL
|| ro
->ro_rt
->rt_cpuid
== mycpuid
);
266 dst
= dn_pkt
->dn_dst
;
267 if (dst
== (struct sockaddr_in
*)&(dn_pkt
->ro
.ro_dst
)) {
268 /* If 'dst' points into dummynet tag, adjust it */
269 dst
= (struct sockaddr_in
*)&(ro
->ro_dst
);
272 ip
= mtod(m
, struct ip
*);
273 hlen
= IP_VHL_HL(ip
->ip_vhl
) << 2 ;
275 ia
= ifatoia(ro
->ro_rt
->rt_ifa
);
281 m
= ip_insertoptions(m
, opt
, &len
);
285 ip
= mtod(m
, struct ip
*);
290 if (!(flags
& (IP_FORWARDING
|IP_RAWOUTPUT
))) {
291 ip
->ip_vhl
= IP_MAKE_VHL(IPVERSION
, hlen
>> 2);
293 if (ip_do_rfc6864
&& (ip
->ip_off
& IP_DF
))
296 ip
->ip_id
= ip_newid();
297 ipstat
.ips_localout
++;
299 hlen
= IP_VHL_HL(ip
->ip_vhl
) << 2;
303 pkt_dst
= next_hop
? next_hop
->sin_addr
: ip
->ip_dst
;
305 dst
= (struct sockaddr_in
*)&ro
->ro_dst
;
307 * If there is a cached route,
308 * check that it is to the same destination
309 * and is still up. If not, free it and try again.
310 * The address family should also be checked in case of sharing the
314 (!(ro
->ro_rt
->rt_flags
& RTF_UP
) ||
315 dst
->sin_family
!= AF_INET
||
316 dst
->sin_addr
.s_addr
!= pkt_dst
.s_addr
)) {
320 if (ro
->ro_rt
== NULL
) {
321 bzero(dst
, sizeof *dst
);
322 dst
->sin_family
= AF_INET
;
323 dst
->sin_len
= sizeof *dst
;
324 dst
->sin_addr
= pkt_dst
;
327 * If routing to interface only,
328 * short circuit routing lookup.
330 if (flags
& IP_ROUTETOIF
) {
331 if ((ia
= ifatoia(ifa_ifwithdstaddr(sintosa(dst
)))) == NULL
&&
332 (ia
= ifatoia(ifa_ifwithnet(sintosa(dst
)))) == NULL
) {
333 ipstat
.ips_noroute
++;
339 isbroadcast
= in_broadcast(dst
->sin_addr
, ifp
);
340 } else if (IN_MULTICAST(ntohl(pkt_dst
.s_addr
)) &&
341 imo
!= NULL
&& imo
->imo_multicast_ifp
!= NULL
) {
343 * Bypass the normal routing lookup for multicast
344 * packets if the interface is specified.
346 ifp
= imo
->imo_multicast_ifp
;
348 isbroadcast
= 0; /* fool gcc */
351 * If this is the case, we probably don't want to allocate
352 * a protocol-cloned route since we didn't get one from the
353 * ULP. This lets TCP do its thing, while not burdening
354 * forwarding or ICMP with the overhead of cloning a route.
355 * Of course, we still want to do any cloning requested by
356 * the link layer, as this is probably required in all cases
357 * for correct operation (as it is for ARP).
359 if (ro
->ro_rt
== NULL
)
360 rtalloc_ign(ro
, RTF_PRCLONING
);
361 if (ro
->ro_rt
== NULL
) {
362 ipstat
.ips_noroute
++;
363 error
= EHOSTUNREACH
;
366 ia
= ifatoia(ro
->ro_rt
->rt_ifa
);
367 ifp
= ro
->ro_rt
->rt_ifp
;
369 if (ro
->ro_rt
->rt_flags
& RTF_GATEWAY
)
370 dst
= (struct sockaddr_in
*)ro
->ro_rt
->rt_gateway
;
371 if (ro
->ro_rt
->rt_flags
& RTF_HOST
)
372 isbroadcast
= (ro
->ro_rt
->rt_flags
& RTF_BROADCAST
);
374 isbroadcast
= in_broadcast(dst
->sin_addr
, ifp
);
376 if (IN_MULTICAST(ntohl(pkt_dst
.s_addr
))) {
377 m
->m_flags
|= M_MCAST
;
379 * IP destination address is multicast. Make sure "dst"
380 * still points to the address in "ro". (It may have been
381 * changed to point to a gateway address, above.)
383 dst
= (struct sockaddr_in
*)&ro
->ro_dst
;
385 * See if the caller provided any multicast options
388 ip
->ip_ttl
= imo
->imo_multicast_ttl
;
389 if (imo
->imo_multicast_vif
!= -1) {
392 ip_mcast_src(imo
->imo_multicast_vif
) :
396 ip
->ip_ttl
= IP_DEFAULT_MULTICAST_TTL
;
399 * Confirm that the outgoing interface supports multicast.
401 if ((imo
== NULL
) || (imo
->imo_multicast_vif
== -1)) {
402 if (!(ifp
->if_flags
& IFF_MULTICAST
)) {
403 ipstat
.ips_noroute
++;
409 * If source address not specified yet, use address of the
410 * outgoing interface. In case, keep note we did that, so
411 * if the the firewall changes the next-hop causing the
412 * output interface to change, we can fix that.
414 if (ip
->ip_src
.s_addr
== INADDR_ANY
|| src_was_INADDR_ANY
) {
415 /* Interface may have no addresses. */
417 ip
->ip_src
= IA_SIN(ia
)->sin_addr
;
418 src_was_INADDR_ANY
= 1;
422 if (ip
->ip_src
.s_addr
!= INADDR_ANY
) {
423 struct in_multi
*inm
;
425 inm
= IN_LOOKUP_MULTI(&pkt_dst
, ifp
);
427 (imo
== NULL
|| imo
->imo_multicast_loop
)) {
429 * If we belong to the destination multicast
430 * group on the outgoing interface, and the
431 * caller did not forbid loopback, loop back
434 ip_mloopback(ifp
, m
, dst
, hlen
);
437 * If we are acting as a multicast router,
438 * perform multicast forwarding as if the
439 * packet had just arrived on the interface
440 * to which we are about to send. The
441 * multicast forwarding function recursively
442 * calls this function, using the IP_FORWARDING
443 * flag to prevent infinite recursion.
445 * Multicasts that are looped back by
446 * ip_mloopback(), above, will be forwarded by
447 * the ip_input() routine, if necessary.
449 if (ip_mrouter
&& !(flags
& IP_FORWARDING
)) {
451 * If rsvp daemon is not running, do
452 * not set ip_moptions. This ensures
453 * that the packet is multicast and
454 * not just sent down one link as
455 * prescribed by rsvpd.
461 if (ip_mforward(ip
, ifp
,
474 * Multicasts with a time-to-live of zero may be looped-
475 * back, above, but must not be transmitted on a network.
476 * Also, multicasts addressed to the loopback interface
477 * are not sent -- the above call to ip_mloopback() will
478 * loop back a copy if this host actually belongs to the
479 * destination group on the loopback interface.
481 if (ip
->ip_ttl
== 0 || ifp
->if_flags
& IFF_LOOPBACK
) {
488 m
->m_flags
&= ~M_MCAST
;
492 * If the source address is not specified yet, use the address
493 * of the outgoing interface. In case, keep note we did that,
494 * so if the the firewall changes the next-hop causing the output
495 * interface to change, we can fix that.
497 if (ip
->ip_src
.s_addr
== INADDR_ANY
|| src_was_INADDR_ANY
) {
498 /* Interface may have no addresses. */
500 ip
->ip_src
= IA_SIN(ia
)->sin_addr
;
501 src_was_INADDR_ANY
= 1;
506 * Look for broadcast address and
507 * verify user is allowed to send
511 if (!(ifp
->if_flags
& IFF_BROADCAST
)) {
512 error
= EADDRNOTAVAIL
;
515 if (!(flags
& IP_ALLOWBROADCAST
)) {
519 /* don't allow broadcast messages to be fragmented */
520 if (ip
->ip_len
> ifp
->if_mtu
) {
524 m
->m_flags
|= M_BCAST
;
526 m
->m_flags
&= ~M_BCAST
;
531 /* get SP for this packet */
533 sp
= ipsec4_getpolicybyaddr(m
, IPSEC_DIR_OUTBOUND
, flags
, &error
);
535 sp
= ipsec4_getpolicybysock(m
, IPSEC_DIR_OUTBOUND
, so
, &error
);
538 ipsecstat
.out_inval
++;
545 switch (sp
->policy
) {
546 case IPSEC_POLICY_DISCARD
:
548 * This packet is just discarded.
550 ipsecstat
.out_polvio
++;
553 case IPSEC_POLICY_BYPASS
:
554 case IPSEC_POLICY_NONE
:
555 case IPSEC_POLICY_TCP
:
556 /* no need to do IPsec. */
559 case IPSEC_POLICY_IPSEC
:
560 if (sp
->req
== NULL
) {
561 /* acquire a policy */
562 error
= key_spdacquire(sp
);
567 case IPSEC_POLICY_ENTRUST
:
569 kprintf("ip_output: Invalid policy found. %d\n", sp
->policy
);
572 struct ipsec_output_state state
;
573 bzero(&state
, sizeof state
);
575 if (flags
& IP_ROUTETOIF
) {
577 bzero(&iproute
, sizeof iproute
);
580 state
.dst
= (struct sockaddr
*)dst
;
586 * delayed checksums are not currently compatible with IPsec
588 if (m
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) {
590 m
->m_pkthdr
.csum_flags
&= ~CSUM_DELAY_DATA
;
593 ip
->ip_len
= htons(ip
->ip_len
);
594 ip
->ip_off
= htons(ip
->ip_off
);
596 error
= ipsec4_output(&state
, sp
, flags
);
599 if (flags
& IP_ROUTETOIF
) {
601 * if we have tunnel mode SA, we may need to ignore
604 if (state
.ro
!= &iproute
|| state
.ro
->ro_rt
!= NULL
) {
605 flags
&= ~IP_ROUTETOIF
;
610 dst
= (struct sockaddr_in
*)state
.dst
;
612 /* mbuf is already reclaimed in ipsec4_output. */
622 kprintf("ip4_output (ipsec): error code %d\n", error
);
625 /* don't show these error codes to the user */
633 /* be sure to update variables that are affected by ipsec4_output() */
634 ip
= mtod(m
, struct ip
*);
636 hlen
= IP_VHL_HL(ip
->ip_vhl
) << 2;
638 hlen
= ip
->ip_hl
<< 2;
640 if (ro
->ro_rt
== NULL
) {
641 if (!(flags
& IP_ROUTETOIF
)) {
642 kprintf("ip_output: "
643 "can't update route after IPsec processing\n");
644 error
= EHOSTUNREACH
; /*XXX*/
648 ia
= ifatoia(ro
->ro_rt
->rt_ifa
);
649 ifp
= ro
->ro_rt
->rt_ifp
;
652 /* make it flipped, again. */
653 ip
->ip_len
= ntohs(ip
->ip_len
);
654 ip
->ip_off
= ntohs(ip
->ip_off
);
659 * Check the security policy (SP) for the packet and, if
660 * required, do IPsec-related processing. There are two
661 * cases here; the first time a packet is sent through
662 * it will be untagged and handled by ipsec4_checkpolicy.
663 * If the packet is resubmitted to ip_output (e.g. after
664 * AH, ESP, etc. processing), there will be a tag to bypass
665 * the lookup and related policy checking.
667 mtag
= m_tag_find(m
, PACKET_TAG_IPSEC_PENDING_TDB
, NULL
);
670 tdbi
= (struct tdb_ident
*)m_tag_data(mtag
);
671 sp
= ipsec_getpolicy(tdbi
, IPSEC_DIR_OUTBOUND
);
673 error
= -EINVAL
; /* force silent drop */
674 m_tag_delete(m
, mtag
);
676 sp
= ipsec4_checkpolicy(m
, IPSEC_DIR_OUTBOUND
, flags
,
680 * There are four return cases:
681 * sp != NULL apply IPsec policy
682 * sp == NULL, error == 0 no IPsec handling needed
683 * sp == NULL, error == -EINVAL discard packet w/o error
684 * sp == NULL, error != 0 discard packet, report error
687 /* Loop detection, check if ipsec processing already done */
688 KASSERT(sp
->req
!= NULL
, ("ip_output: no ipsec request"));
689 for (mtag
= m_tag_first(m
); mtag
!= NULL
;
690 mtag
= m_tag_next(m
, mtag
)) {
691 if (mtag
->m_tag_cookie
!= MTAG_ABI_COMPAT
)
693 if (mtag
->m_tag_id
!= PACKET_TAG_IPSEC_OUT_DONE
&&
694 mtag
->m_tag_id
!= PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED
)
697 * Check if policy has an SA associated with it.
698 * This can happen when an SP has yet to acquire
699 * an SA; e.g. on first reference. If it occurs,
700 * then we let ipsec4_process_packet do its thing.
702 if (sp
->req
->sav
== NULL
)
704 tdbi
= (struct tdb_ident
*)m_tag_data(mtag
);
705 if (tdbi
->spi
== sp
->req
->sav
->spi
&&
706 tdbi
->proto
== sp
->req
->sav
->sah
->saidx
.proto
&&
707 bcmp(&tdbi
->dst
, &sp
->req
->sav
->sah
->saidx
.dst
,
708 sizeof(union sockaddr_union
)) == 0) {
710 * No IPsec processing is needed, free
713 * NB: null pointer to avoid free at
716 KEY_FREESP(&sp
), sp
= NULL
;
723 * Do delayed checksums now because we send before
724 * this is done in the normal processing path.
726 if (m
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) {
728 m
->m_pkthdr
.csum_flags
&= ~CSUM_DELAY_DATA
;
731 ip
->ip_len
= htons(ip
->ip_len
);
732 ip
->ip_off
= htons(ip
->ip_off
);
734 /* NB: callee frees mbuf */
735 error
= ipsec4_process_packet(m
, sp
->req
, flags
, 0);
737 * Preserve KAME behaviour: ENOENT can be returned
738 * when an SA acquire is in progress. Don't propagate
739 * this to user-level; it confuses applications.
741 * XXX this will go away when the SADB is redone.
752 * Hack: -EINVAL is used to signal that a packet
753 * should be silently discarded. This is typically
754 * because we asked key management for an SA and
755 * it was delayed (e.g. kicked up to IKE).
757 if (error
== -EINVAL
)
761 /* No IPsec processing for this packet. */
765 * If deferred crypto processing is needed, check that
766 * the interface supports it.
768 mtag
= m_tag_find(m
, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED
, NULL
);
769 if (mtag
!= NULL
&& !(ifp
->if_capenable
& IFCAP_IPSEC
)) {
770 /* notify IPsec to do its own crypto */
771 ipsp_skipcrypto_unmark((struct tdb_ident
*)m_tag_data(mtag
));
772 error
= EHOSTUNREACH
;
778 #endif /* FAST_IPSEC */
780 /* We are already being fwd'd from a firewall. */
781 if (next_hop
!= NULL
)
785 if (!pfil_has_hooks(&inet_pfil_hook
)) {
786 if (m
->m_pkthdr
.fw_flags
& DUMMYNET_MBUF_TAGGED
) {
788 * Strip dummynet tags from stranded packets
790 mtag
= m_tag_find(m
, PACKET_TAG_DUMMYNET
, NULL
);
791 KKASSERT(mtag
!= NULL
);
792 m_tag_delete(m
, mtag
);
793 m
->m_pkthdr
.fw_flags
&= ~DUMMYNET_MBUF_TAGGED
;
800 * - Xlate: translate packet's addr/port (NAT).
801 * - Firewall: deny/allow/etc.
802 * - Wrap: fake packet's addr/port <unimpl.>
803 * - Encapsulate: put it in another IP and send out. <unimp.>
807 * Run through list of hooks for output packets.
809 error
= pfil_run_hooks(&inet_pfil_hook
, &m
, ifp
, PFIL_OUT
);
810 if (error
!= 0 || m
== NULL
)
812 ip
= mtod(m
, struct ip
*);
814 if (m
->m_pkthdr
.fw_flags
& IPFORWARD_MBUF_TAGGED
) {
816 * Check dst to make sure it is directly reachable on the
817 * interface we previously thought it was.
818 * If it isn't (which may be likely in some situations) we have
819 * to re-route it (ie, find a route for the next-hop and the
820 * associated interface) and set them here. This is nested
821 * forwarding which in most cases is undesirable, except where
822 * such control is nigh impossible. So we do it here.
825 mtag
= m_tag_find(m
, PACKET_TAG_IPFORWARD
, NULL
);
826 KKASSERT(mtag
!= NULL
);
827 next_hop
= m_tag_data(mtag
);
830 * Try local forwarding first
832 if (ip_localforward(m
, next_hop
, hlen
))
836 * Relocate the route based on next_hop.
837 * If the current route is inp's cache, keep it untouched.
839 if (ro
== &iproute
&& ro
->ro_rt
!= NULL
) {
844 bzero(ro
, sizeof *ro
);
847 * Forwarding to broadcast address is not allowed.
848 * XXX Should we follow IP_ROUTETOIF?
850 flags
&= ~(IP_ALLOWBROADCAST
| IP_ROUTETOIF
);
852 /* We are doing forwarding now */
853 flags
|= IP_FORWARDING
;
858 if (m
->m_pkthdr
.fw_flags
& DUMMYNET_MBUF_TAGGED
) {
859 struct dn_pkt
*dn_pkt
;
861 mtag
= m_tag_find(m
, PACKET_TAG_DUMMYNET
, NULL
);
862 KKASSERT(mtag
!= NULL
);
863 dn_pkt
= m_tag_data(mtag
);
866 * Under certain cases it is not possible to recalculate
867 * 'ro' and 'dst', let alone 'flags', so just save them in
868 * dummynet tag and avoid the possible wrong reculcalation
869 * when we come back to ip_output() again.
871 * All other parameters have been already used and so they
872 * are not needed anymore.
873 * XXX if the ifp is deleted while a pkt is in dummynet,
874 * we are in trouble! (TODO use ifnet_detach_event)
876 * We need to copy *ro because for ICMP pkts (and maybe
877 * others) the caller passed a pointer into the stack;
878 * dst might also be a pointer into *ro so it needs to
883 ro
->ro_rt
->rt_refcnt
++;
884 if (dst
== (struct sockaddr_in
*)&ro
->ro_dst
) {
885 /* 'dst' points into 'ro' */
886 dst
= (struct sockaddr_in
*)&(dn_pkt
->ro
.ro_dst
);
888 dn_pkt
->dn_dst
= dst
;
889 dn_pkt
->flags
= flags
;
895 if (m
->m_pkthdr
.fw_flags
& IPFW_MBUF_CONTINUE
) {
896 /* ipfw was disabled/unloaded. */
901 /* 127/8 must not appear on wire - RFC1122. */
902 if ((ntohl(ip
->ip_dst
.s_addr
) >> IN_CLASSA_NSHIFT
) == IN_LOOPBACKNET
||
903 (ntohl(ip
->ip_src
.s_addr
) >> IN_CLASSA_NSHIFT
) == IN_LOOPBACKNET
) {
904 if (!(ifp
->if_flags
& IFF_LOOPBACK
)) {
905 ipstat
.ips_badaddr
++;
906 error
= EADDRNOTAVAIL
;
910 if (ip
->ip_src
.s_addr
== INADDR_ANY
||
911 IN_MULTICAST(ntohl(ip
->ip_src
.s_addr
))) {
912 ipstat
.ips_badaddr
++;
913 error
= EADDRNOTAVAIL
;
917 if ((m
->m_pkthdr
.csum_flags
& CSUM_TSO
) == 0) {
918 m
->m_pkthdr
.csum_flags
|= CSUM_IP
;
919 sw_csum
= m
->m_pkthdr
.csum_flags
& ~ifp
->if_hwassist
;
920 if (sw_csum
& CSUM_DELAY_DATA
) {
922 sw_csum
&= ~CSUM_DELAY_DATA
;
924 m
->m_pkthdr
.csum_flags
&= ifp
->if_hwassist
;
928 m
->m_pkthdr
.csum_iphlen
= hlen
;
931 * If small enough for interface, or the interface will take
932 * care of the fragmentation or segmentation for us, can just
935 if (ip
->ip_len
<= ifp
->if_mtu
||
936 ((ifp
->if_hwassist
& CSUM_FRAGMENT
) && !(ip
->ip_off
& IP_DF
)) ||
937 (m
->m_pkthdr
.csum_flags
& CSUM_TSO
)) {
938 ip
->ip_len
= htons(ip
->ip_len
);
939 ip
->ip_off
= htons(ip
->ip_off
);
941 if (sw_csum
& CSUM_DELAY_IP
) {
942 if (ip
->ip_vhl
== IP_VHL_BORING
)
943 ip
->ip_sum
= in_cksum_hdr(ip
);
945 ip
->ip_sum
= in_cksum(m
, hlen
);
948 /* Record statistics for this interface address. */
949 if (!(flags
& IP_FORWARDING
) && ia
) {
950 IFA_STAT_INC(&ia
->ia_ifa
, opackets
, 1);
951 IFA_STAT_INC(&ia
->ia_ifa
, obytes
, m
->m_pkthdr
.len
);
955 /* clean ipsec history once it goes out of the node */
959 #ifdef MBUF_STRESS_TEST
960 if (mbuf_frag_size
&& m
->m_pkthdr
.len
> mbuf_frag_size
) {
961 struct mbuf
*m1
, *m2
;
964 tmp
= length
= m
->m_pkthdr
.len
;
966 while ((length
-= mbuf_frag_size
) >= 1) {
967 m1
= m_split(m
, length
, M_NOWAIT
);
971 while (m2
->m_next
!= NULL
)
975 m
->m_pkthdr
.len
= tmp
;
980 if (!mpls_output_process(m
, ro
->ro_rt
))
983 error
= ifp
->if_output(ifp
, m
, (struct sockaddr
*)dst
,
988 if (ip
->ip_off
& IP_DF
) {
991 * This case can happen if the user changed the MTU
992 * of an interface after enabling IP on it. Because
993 * most netifs don't keep track of routes pointing to
994 * them, there is no way for one to update all its
995 * routes when the MTU is changed.
997 if ((ro
->ro_rt
->rt_flags
& (RTF_UP
| RTF_HOST
)) &&
998 !(ro
->ro_rt
->rt_rmx
.rmx_locks
& RTV_MTU
) &&
999 (ro
->ro_rt
->rt_rmx
.rmx_mtu
> ifp
->if_mtu
)) {
1000 ro
->ro_rt
->rt_rmx
.rmx_mtu
= ifp
->if_mtu
;
1002 ipstat
.ips_cantfrag
++;
1007 * Too large for interface; fragment if possible. If successful,
1008 * on return, m will point to a list of packets to be sent.
1010 error
= ip_fragment(ip
, &m
, ifp
->if_mtu
, ifp
->if_hwassist
, sw_csum
);
1015 m
->m_nextpkt
= NULL
;
1017 /* clean ipsec history once it goes out of the node */
1021 /* Record statistics for this interface address. */
1023 IFA_STAT_INC(&ia
->ia_ifa
, opackets
, 1);
1024 IFA_STAT_INC(&ia
->ia_ifa
, obytes
,
1028 if (!mpls_output_process(m
, ro
->ro_rt
))
1031 error
= ifp
->if_output(ifp
, m
, (struct sockaddr
*)dst
,
1039 ipstat
.ips_fragmented
++;
1042 if (ro
== &iproute
&& ro
->ro_rt
!= NULL
) {
1048 KEYDEBUG(KEYDEBUG_IPSEC_STAMP
,
1049 kprintf("DP ip_output call free SP:%p\n", sp
));
1064 * Create a chain of fragments which fit the given mtu. m_frag points to the
1065 * mbuf to be fragmented; on return it points to the chain with the fragments.
1066 * Return 0 if no error. If error, m_frag may contain a partially built
1067 * chain of fragments that should be freed by the caller.
1069 * if_hwassist_flags is the hw offload capabilities (see if_data.ifi_hwassist)
1070 * sw_csum contains the delayed checksums flags (e.g., CSUM_DELAY_IP).
1073 ip_fragment(struct ip
*ip
, struct mbuf
**m_frag
, int mtu
,
1074 u_long if_hwassist_flags
, int sw_csum
)
1077 int hlen
= IP_VHL_HL(ip
->ip_vhl
) << 2;
1078 int len
= (mtu
- hlen
) & ~7; /* size of payload in each fragment */
1080 struct mbuf
*m0
= *m_frag
; /* the original packet */
1082 struct mbuf
**mnext
;
1085 if (ip
->ip_off
& IP_DF
) { /* Fragmentation not allowed */
1086 ipstat
.ips_cantfrag
++;
1091 * Must be able to put at least 8 bytes per fragment.
1097 * If the interface will not calculate checksums on
1098 * fragmented packets, then do it here.
1100 if ((m0
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) &&
1101 !(if_hwassist_flags
& CSUM_IP_FRAGS
)) {
1102 in_delayed_cksum(m0
);
1103 m0
->m_pkthdr
.csum_flags
&= ~CSUM_DELAY_DATA
;
1106 if (len
> PAGE_SIZE
) {
1108 * Fragment large datagrams such that each segment
1109 * contains a multiple of PAGE_SIZE amount of data,
1110 * plus headers. This enables a receiver to perform
1111 * page-flipping zero-copy optimizations.
1113 * XXX When does this help given that sender and receiver
1114 * could have different page sizes, and also mtu could
1115 * be less than the receiver's page size ?
1120 for (m
= m0
, off
= 0; m
&& (off
+m
->m_len
) <= mtu
; m
= m
->m_next
)
1124 * firstlen (off - hlen) must be aligned on an
1128 goto smart_frag_failure
;
1129 off
= ((off
- hlen
) & ~7) + hlen
;
1130 newlen
= (~PAGE_MASK
) & mtu
;
1131 if ((newlen
+ sizeof(struct ip
)) > mtu
) {
1132 /* we failed, go back the default */
1143 firstlen
= off
- hlen
;
1144 mnext
= &m0
->m_nextpkt
; /* pointer to next packet */
1147 * Loop through length of segment after first fragment,
1148 * make new header and copy data of each part and link onto chain.
1149 * Here, m0 is the original packet, m is the fragment being created.
1150 * The fragments are linked off the m_nextpkt of the original
1151 * packet, which after processing serves as the first fragment.
1153 for (nfrags
= 1; off
< ip
->ip_len
; off
+= len
, nfrags
++) {
1154 struct ip
*mhip
; /* ip header on the fragment */
1156 int mhlen
= sizeof(struct ip
);
1158 MGETHDR(m
, M_NOWAIT
, MT_HEADER
);
1161 ipstat
.ips_odropped
++;
1164 m
->m_flags
|= (m0
->m_flags
& M_MCAST
) | M_FRAG
;
1166 * In the first mbuf, leave room for the link header, then
1167 * copy the original IP header including options. The payload
1168 * goes into an additional mbuf chain returned by m_copy().
1170 m
->m_data
+= max_linkhdr
;
1171 mhip
= mtod(m
, struct ip
*);
1173 if (hlen
> sizeof(struct ip
)) {
1174 mhlen
= ip_optcopy(ip
, mhip
) + sizeof(struct ip
);
1175 mhip
->ip_vhl
= IP_MAKE_VHL(IPVERSION
, mhlen
>> 2);
1178 /* XXX do we need to add ip->ip_off below ? */
1179 mhip
->ip_off
= ((off
- hlen
) >> 3) + ip
->ip_off
;
1180 if (off
+ len
>= ip
->ip_len
) { /* last fragment */
1181 len
= ip
->ip_len
- off
;
1182 m
->m_flags
|= M_LASTFRAG
;
1184 mhip
->ip_off
|= IP_MF
;
1185 mhip
->ip_len
= htons((u_short
)(len
+ mhlen
));
1186 m
->m_next
= m_copy(m0
, off
, len
);
1187 if (m
->m_next
== NULL
) { /* copy failed */
1189 error
= ENOBUFS
; /* ??? */
1190 ipstat
.ips_odropped
++;
1193 m
->m_pkthdr
.len
= mhlen
+ len
;
1194 m
->m_pkthdr
.rcvif
= NULL
;
1195 m
->m_pkthdr
.csum_flags
= m0
->m_pkthdr
.csum_flags
;
1196 m
->m_pkthdr
.csum_iphlen
= mhlen
;
1197 mhip
->ip_off
= htons(mhip
->ip_off
);
1199 if (sw_csum
& CSUM_DELAY_IP
)
1200 mhip
->ip_sum
= in_cksum(m
, mhlen
);
1202 mnext
= &m
->m_nextpkt
;
1204 ipstat
.ips_ofragments
+= nfrags
;
1206 /* set first marker for fragment chain */
1207 m0
->m_flags
|= M_FIRSTFRAG
| M_FRAG
;
1208 m0
->m_pkthdr
.csum_data
= nfrags
;
1211 * Update first fragment by trimming what's been copied out
1212 * and updating header.
1214 m_adj(m0
, hlen
+ firstlen
- ip
->ip_len
);
1215 m0
->m_pkthdr
.len
= hlen
+ firstlen
;
1216 ip
->ip_len
= htons((u_short
)m0
->m_pkthdr
.len
);
1217 ip
->ip_off
|= IP_MF
;
1218 ip
->ip_off
= htons(ip
->ip_off
);
1220 if (sw_csum
& CSUM_DELAY_IP
)
1221 ip
->ip_sum
= in_cksum(m0
, hlen
);
1229 in_delayed_cksum(struct mbuf
*m
)
1232 u_short csum
, offset
;
1234 ip
= mtod(m
, struct ip
*);
1235 offset
= IP_VHL_HL(ip
->ip_vhl
) << 2 ;
1236 csum
= in_cksum_skip(m
, ip
->ip_len
, offset
);
1237 if (m
->m_pkthdr
.csum_flags
& CSUM_UDP
&& csum
== 0)
1239 offset
+= m
->m_pkthdr
.csum_data
; /* checksum offset */
1241 if (offset
+ sizeof(u_short
) > m
->m_len
) {
1242 kprintf("delayed m_pullup, m->len: %d off: %d p: %d\n",
1243 m
->m_len
, offset
, ip
->ip_p
);
1246 * this shouldn't happen, but if it does, the
1247 * correct behavior may be to insert the checksum
1248 * in the existing chain instead of rearranging it.
1250 m
= m_pullup(m
, offset
+ sizeof(u_short
));
1252 *(u_short
*)(m
->m_data
+ offset
) = csum
;
1256 * Insert IP options into preformed packet.
1257 * Adjust IP destination as required for IP source routing,
1258 * as indicated by a non-zero in_addr at the start of the options.
1260 * XXX This routine assumes that the packet has no options in place.
1262 static struct mbuf
*
1263 ip_insertoptions(struct mbuf
*m
, struct mbuf
*opt
, int *phlen
)
1265 struct ipoption
*p
= mtod(opt
, struct ipoption
*);
1267 struct ip
*ip
= mtod(m
, struct ip
*);
1270 optlen
= opt
->m_len
- sizeof p
->ipopt_dst
;
1271 if (optlen
+ (u_short
)ip
->ip_len
> IP_MAXPACKET
) {
1273 return (m
); /* XXX should fail */
1275 if (p
->ipopt_dst
.s_addr
)
1276 ip
->ip_dst
= p
->ipopt_dst
;
1277 if (m
->m_flags
& M_EXT
|| m
->m_data
- optlen
< m
->m_pktdat
) {
1278 MGETHDR(n
, M_NOWAIT
, MT_HEADER
);
1283 n
->m_pkthdr
.rcvif
= NULL
;
1284 n
->m_pkthdr
.len
= m
->m_pkthdr
.len
+ optlen
;
1285 m
->m_len
-= sizeof(struct ip
);
1286 m
->m_data
+= sizeof(struct ip
);
1289 m
->m_len
= optlen
+ sizeof(struct ip
);
1290 m
->m_data
+= max_linkhdr
;
1291 memcpy(mtod(m
, void *), ip
, sizeof(struct ip
));
1293 m
->m_data
-= optlen
;
1295 m
->m_pkthdr
.len
+= optlen
;
1296 bcopy(ip
, mtod(m
, caddr_t
), sizeof(struct ip
));
1298 ip
= mtod(m
, struct ip
*);
1299 bcopy(p
->ipopt_list
, ip
+ 1, optlen
);
1300 *phlen
= sizeof(struct ip
) + optlen
;
1301 ip
->ip_vhl
= IP_MAKE_VHL(IPVERSION
, *phlen
>> 2);
1302 ip
->ip_len
+= optlen
;
1307 * Copy options from ip to jp,
1308 * omitting those not copied during fragmentation.
1311 ip_optcopy(struct ip
*ip
, struct ip
*jp
)
1314 int opt
, optlen
, cnt
;
1316 cp
= (u_char
*)(ip
+ 1);
1317 dp
= (u_char
*)(jp
+ 1);
1318 cnt
= (IP_VHL_HL(ip
->ip_vhl
) << 2) - sizeof(struct ip
);
1319 for (; cnt
> 0; cnt
-= optlen
, cp
+= optlen
) {
1321 if (opt
== IPOPT_EOL
)
1323 if (opt
== IPOPT_NOP
) {
1324 /* Preserve for IP mcast tunnel's LSRR alignment. */
1330 KASSERT(cnt
>= IPOPT_OLEN
+ sizeof *cp
,
1331 ("ip_optcopy: malformed ipv4 option"));
1332 optlen
= cp
[IPOPT_OLEN
];
1333 KASSERT(optlen
>= IPOPT_OLEN
+ sizeof *cp
&& optlen
<= cnt
,
1334 ("ip_optcopy: malformed ipv4 option"));
1336 /* bogus lengths should have been caught by ip_dooptions */
1339 if (IPOPT_COPIED(opt
)) {
1340 bcopy(cp
, dp
, optlen
);
1344 for (optlen
= dp
- (u_char
*)(jp
+1); optlen
& 0x3; optlen
++)
1350 * IP socket option processing.
1353 ip_ctloutput(netmsg_t msg
)
1355 struct socket
*so
= msg
->base
.nm_so
;
1356 struct sockopt
*sopt
= msg
->ctloutput
.nm_sopt
;
1357 struct inpcb
*inp
= so
->so_pcb
;
1362 /* Get socket's owner cpuid hint */
1363 if (sopt
->sopt_level
== SOL_SOCKET
&&
1364 sopt
->sopt_dir
== SOPT_GET
&&
1365 sopt
->sopt_name
== SO_CPUHINT
) {
1367 soopt_from_kbuf(sopt
, &optval
, sizeof(optval
));
1371 if (sopt
->sopt_level
!= IPPROTO_IP
) {
1376 switch (sopt
->sopt_name
) {
1377 case IP_MULTICAST_IF
:
1378 case IP_MULTICAST_VIF
:
1379 case IP_MULTICAST_TTL
:
1380 case IP_MULTICAST_LOOP
:
1381 case IP_ADD_MEMBERSHIP
:
1382 case IP_DROP_MEMBERSHIP
:
1384 * Handle multicast options in netisr0
1386 if (&curthread
->td_msgport
!= netisr_cpuport(0)) {
1387 /* NOTE: so_port MUST NOT be checked in netisr0 */
1388 msg
->lmsg
.ms_flags
|= MSGF_IGNSOPORT
;
1389 lwkt_forwardmsg(netisr_cpuport(0), &msg
->lmsg
);
1395 switch (sopt
->sopt_dir
) {
1397 switch (sopt
->sopt_name
) {
1404 if (sopt
->sopt_valsize
> MLEN
) {
1408 MGET(m
, sopt
->sopt_td
? M_WAITOK
: M_NOWAIT
, MT_HEADER
);
1413 m
->m_len
= sopt
->sopt_valsize
;
1414 error
= soopt_to_kbuf(sopt
, mtod(m
, void *), m
->m_len
,
1416 error
= ip_pcbopts(sopt
->sopt_name
,
1417 &inp
->inp_options
, m
);
1425 case IP_RECVRETOPTS
:
1426 case IP_RECVDSTADDR
:
1429 error
= soopt_to_kbuf(sopt
, &optval
, sizeof optval
,
1433 switch (sopt
->sopt_name
) {
1435 inp
->inp_ip_tos
= optval
;
1439 inp
->inp_ip_ttl
= optval
;
1442 if (optval
>= 0 && optval
<= MAXTTL
)
1443 inp
->inp_ip_minttl
= optval
;
1447 #define OPTSET(bit) \
1449 inp->inp_flags |= bit; \
1451 inp->inp_flags &= ~bit;
1454 OPTSET(INP_RECVOPTS
);
1457 case IP_RECVRETOPTS
:
1458 OPTSET(INP_RECVRETOPTS
);
1461 case IP_RECVDSTADDR
:
1462 OPTSET(INP_RECVDSTADDR
);
1470 OPTSET(INP_RECVTTL
);
1476 case IP_MULTICAST_IF
:
1477 case IP_MULTICAST_VIF
:
1478 case IP_MULTICAST_TTL
:
1479 case IP_MULTICAST_LOOP
:
1480 case IP_ADD_MEMBERSHIP
:
1481 case IP_DROP_MEMBERSHIP
:
1482 error
= ip_setmoptions(sopt
, &inp
->inp_moptions
);
1486 error
= soopt_to_kbuf(sopt
, &optval
, sizeof optval
,
1492 case IP_PORTRANGE_DEFAULT
:
1493 inp
->inp_flags
&= ~(INP_LOWPORT
);
1494 inp
->inp_flags
&= ~(INP_HIGHPORT
);
1497 case IP_PORTRANGE_HIGH
:
1498 inp
->inp_flags
&= ~(INP_LOWPORT
);
1499 inp
->inp_flags
|= INP_HIGHPORT
;
1502 case IP_PORTRANGE_LOW
:
1503 inp
->inp_flags
&= ~(INP_HIGHPORT
);
1504 inp
->inp_flags
|= INP_LOWPORT
;
1513 #if defined(IPSEC) || defined(FAST_IPSEC)
1514 case IP_IPSEC_POLICY
:
1522 if ((error
= soopt_getm(sopt
, &m
)) != 0) /* XXX */
1524 soopt_to_mbuf(sopt
, m
);
1525 priv
= (sopt
->sopt_td
!= NULL
&&
1526 priv_check(sopt
->sopt_td
, PRIV_ROOT
) != 0) ? 0 : 1;
1527 req
= mtod(m
, caddr_t
);
1529 optname
= sopt
->sopt_name
;
1530 error
= ipsec4_set_policy(inp
, optname
, req
, len
, priv
);
1537 error
= ENOPROTOOPT
;
1543 switch (sopt
->sopt_name
) {
1546 if (inp
->inp_options
)
1547 soopt_from_kbuf(sopt
, mtod(inp
->inp_options
,
1549 inp
->inp_options
->m_len
);
1551 sopt
->sopt_valsize
= 0;
1558 case IP_RECVRETOPTS
:
1559 case IP_RECVDSTADDR
:
1563 switch (sopt
->sopt_name
) {
1566 optval
= inp
->inp_ip_tos
;
1570 optval
= inp
->inp_ip_ttl
;
1573 optval
= inp
->inp_ip_minttl
;
1576 #define OPTBIT(bit) (inp->inp_flags & bit ? 1 : 0)
1579 optval
= OPTBIT(INP_RECVOPTS
);
1582 case IP_RECVRETOPTS
:
1583 optval
= OPTBIT(INP_RECVRETOPTS
);
1586 case IP_RECVDSTADDR
:
1587 optval
= OPTBIT(INP_RECVDSTADDR
);
1591 optval
= OPTBIT(INP_RECVTTL
);
1595 optval
= OPTBIT(INP_RECVIF
);
1599 if (inp
->inp_flags
& INP_HIGHPORT
)
1600 optval
= IP_PORTRANGE_HIGH
;
1601 else if (inp
->inp_flags
& INP_LOWPORT
)
1602 optval
= IP_PORTRANGE_LOW
;
1607 soopt_from_kbuf(sopt
, &optval
, sizeof optval
);
1610 case IP_MULTICAST_IF
:
1611 case IP_MULTICAST_VIF
:
1612 case IP_MULTICAST_TTL
:
1613 case IP_MULTICAST_LOOP
:
1614 case IP_ADD_MEMBERSHIP
:
1615 case IP_DROP_MEMBERSHIP
:
1616 error
= ip_getmoptions(sopt
, inp
->inp_moptions
);
1619 #if defined(IPSEC) || defined(FAST_IPSEC)
1620 case IP_IPSEC_POLICY
:
1622 struct mbuf
*m
= NULL
;
1627 req
= mtod(m
, caddr_t
);
1630 error
= ipsec4_get_policy(so
->so_pcb
, req
, len
, &m
);
1632 error
= soopt_from_mbuf(sopt
, m
); /* XXX */
1640 error
= ENOPROTOOPT
;
1646 lwkt_replymsg(&msg
->lmsg
, error
);
1650 * Set up IP options in pcb for insertion in output packets.
1651 * Store in mbuf with pointer in pcbopt, adding pseudo-option
1652 * with destination address if source routed.
1655 ip_pcbopts(int optname
, struct mbuf
**pcbopt
, struct mbuf
*m
)
1661 /* turn off any old options */
1665 if (m
== NULL
|| m
->m_len
== 0) {
1667 * Only turning off any previous options.
1674 if (m
->m_len
% sizeof(int32_t))
1677 * IP first-hop destination address will be stored before
1678 * actual options; move other options back
1679 * and clear it when none present.
1681 if (m
->m_data
+ m
->m_len
+ sizeof(struct in_addr
) >= &m
->m_dat
[MLEN
])
1684 m
->m_len
+= sizeof(struct in_addr
);
1685 cp
= mtod(m
, u_char
*) + sizeof(struct in_addr
);
1686 bcopy(mtod(m
, caddr_t
), cp
, cnt
);
1687 bzero(mtod(m
, caddr_t
), sizeof(struct in_addr
));
1689 for (; cnt
> 0; cnt
-= optlen
, cp
+= optlen
) {
1690 opt
= cp
[IPOPT_OPTVAL
];
1691 if (opt
== IPOPT_EOL
)
1693 if (opt
== IPOPT_NOP
)
1696 if (cnt
< IPOPT_OLEN
+ sizeof *cp
)
1698 optlen
= cp
[IPOPT_OLEN
];
1699 if (optlen
< IPOPT_OLEN
+ sizeof *cp
|| optlen
> cnt
)
1710 * user process specifies route as:
1712 * D must be our final destination (but we can't
1713 * check that since we may not have connected yet).
1714 * A is first hop destination, which doesn't appear in
1715 * actual IP option, but is stored before the options.
1717 if (optlen
< IPOPT_MINOFF
- 1 + sizeof(struct in_addr
))
1719 m
->m_len
-= sizeof(struct in_addr
);
1720 cnt
-= sizeof(struct in_addr
);
1721 optlen
-= sizeof(struct in_addr
);
1722 cp
[IPOPT_OLEN
] = optlen
;
1724 * Move first hop before start of options.
1726 bcopy(&cp
[IPOPT_OFFSET
+1], mtod(m
, caddr_t
),
1727 sizeof(struct in_addr
));
1729 * Then copy rest of options back
1730 * to close up the deleted entry.
1732 bcopy(&cp
[IPOPT_OFFSET
+1] + sizeof(struct in_addr
),
1733 &cp
[IPOPT_OFFSET
+1],
1734 cnt
- (IPOPT_MINOFF
- 1));
1738 if (m
->m_len
> MAX_IPOPTLEN
+ sizeof(struct in_addr
))
1750 * The whole multicast option thing needs to be re-thought.
1751 * Several of these options are equally applicable to non-multicast
1752 * transmission, and one (IP_MULTICAST_TTL) totally duplicates a
1753 * standard option (IP_TTL).
1757 * following RFC1724 section 3.3, 0.0.0.0/8 is interpreted as interface index.
1759 static struct ifnet
*
1760 ip_multicast_if(struct in_addr
*a
, int *ifindexp
)
1767 if (ntohl(a
->s_addr
) >> 24 == 0) {
1768 ifindex
= ntohl(a
->s_addr
) & 0xffffff;
1769 if (ifindex
< 0 || if_index
< ifindex
)
1771 ifp
= ifindex2ifnet
[ifindex
];
1773 *ifindexp
= ifindex
;
1775 ifp
= INADDR_TO_IFP(a
);
1781 * Set the IP multicast options in response to user setsockopt().
1784 ip_setmoptions(struct sockopt
*sopt
, struct ip_moptions
**imop
)
1788 struct in_addr addr
;
1789 struct ip_mreq mreq
;
1791 struct ip_moptions
*imo
= *imop
;
1796 * No multicast option buffer attached to the pcb;
1797 * allocate one and initialize to default values.
1799 imo
= kmalloc(sizeof *imo
, M_IPMOPTS
, M_WAITOK
);
1801 imo
->imo_multicast_ifp
= NULL
;
1802 imo
->imo_multicast_addr
.s_addr
= INADDR_ANY
;
1803 imo
->imo_multicast_vif
= -1;
1804 imo
->imo_multicast_ttl
= IP_DEFAULT_MULTICAST_TTL
;
1805 imo
->imo_multicast_loop
= IP_DEFAULT_MULTICAST_LOOP
;
1806 imo
->imo_num_memberships
= 0;
1807 /* Assign imo to imop after all fields are setup */
1811 switch (sopt
->sopt_name
) {
1812 /* store an index number for the vif you wanna use in the send */
1813 case IP_MULTICAST_VIF
:
1814 if (legal_vif_num
== 0) {
1818 error
= soopt_to_kbuf(sopt
, &i
, sizeof i
, sizeof i
);
1821 if (!legal_vif_num(i
) && (i
!= -1)) {
1825 imo
->imo_multicast_vif
= i
;
1828 case IP_MULTICAST_IF
:
1830 * Select the interface for outgoing multicast packets.
1832 error
= soopt_to_kbuf(sopt
, &addr
, sizeof addr
, sizeof addr
);
1837 * INADDR_ANY is used to remove a previous selection.
1838 * When no interface is selected, a default one is
1839 * chosen every time a multicast packet is sent.
1841 if (addr
.s_addr
== INADDR_ANY
) {
1842 imo
->imo_multicast_ifp
= NULL
;
1846 * The selected interface is identified by its local
1847 * IP address. Find the interface and confirm that
1848 * it supports multicasting.
1851 ifp
= ip_multicast_if(&addr
, &ifindex
);
1852 if (ifp
== NULL
|| !(ifp
->if_flags
& IFF_MULTICAST
)) {
1854 error
= EADDRNOTAVAIL
;
1857 imo
->imo_multicast_ifp
= ifp
;
1859 imo
->imo_multicast_addr
= addr
;
1861 imo
->imo_multicast_addr
.s_addr
= INADDR_ANY
;
1865 case IP_MULTICAST_TTL
:
1867 * Set the IP time-to-live for outgoing multicast packets.
1868 * The original multicast API required a char argument,
1869 * which is inconsistent with the rest of the socket API.
1870 * We allow either a char or an int.
1872 if (sopt
->sopt_valsize
== 1) {
1874 error
= soopt_to_kbuf(sopt
, &ttl
, 1, 1);
1877 imo
->imo_multicast_ttl
= ttl
;
1880 error
= soopt_to_kbuf(sopt
, &ttl
, sizeof ttl
, sizeof ttl
);
1886 imo
->imo_multicast_ttl
= ttl
;
1890 case IP_MULTICAST_LOOP
:
1892 * Set the loopback flag for outgoing multicast packets.
1893 * Must be zero or one. The original multicast API required a
1894 * char argument, which is inconsistent with the rest
1895 * of the socket API. We allow either a char or an int.
1897 if (sopt
->sopt_valsize
== 1) {
1900 error
= soopt_to_kbuf(sopt
, &loop
, 1, 1);
1903 imo
->imo_multicast_loop
= !!loop
;
1907 error
= soopt_to_kbuf(sopt
, &loop
, sizeof loop
,
1911 imo
->imo_multicast_loop
= !!loop
;
1915 case IP_ADD_MEMBERSHIP
:
1917 * Add a multicast group membership.
1918 * Group must be a valid IP multicast address.
1920 error
= soopt_to_kbuf(sopt
, &mreq
, sizeof mreq
, sizeof mreq
);
1924 if (!IN_MULTICAST(ntohl(mreq
.imr_multiaddr
.s_addr
))) {
1930 * If no interface address was provided, use the interface of
1931 * the route to the given multicast address.
1933 if (mreq
.imr_interface
.s_addr
== INADDR_ANY
) {
1934 struct sockaddr_in dst
;
1937 bzero(&dst
, sizeof(struct sockaddr_in
));
1938 dst
.sin_len
= sizeof(struct sockaddr_in
);
1939 dst
.sin_family
= AF_INET
;
1940 dst
.sin_addr
= mreq
.imr_multiaddr
;
1941 rt
= rtlookup((struct sockaddr
*)&dst
);
1943 error
= EADDRNOTAVAIL
;
1950 ifp
= ip_multicast_if(&mreq
.imr_interface
, NULL
);
1954 * See if we found an interface, and confirm that it
1955 * supports multicast.
1957 if (ifp
== NULL
|| !(ifp
->if_flags
& IFF_MULTICAST
)) {
1958 error
= EADDRNOTAVAIL
;
1963 * See if the membership already exists or if all the
1964 * membership slots are full.
1966 for (i
= 0; i
< imo
->imo_num_memberships
; ++i
) {
1967 if (imo
->imo_membership
[i
]->inm_ifp
== ifp
&&
1968 imo
->imo_membership
[i
]->inm_addr
.s_addr
1969 == mreq
.imr_multiaddr
.s_addr
)
1972 if (i
< imo
->imo_num_memberships
) {
1977 if (i
== IP_MAX_MEMBERSHIPS
) {
1978 error
= ETOOMANYREFS
;
1983 * Everything looks good; add a new record to the multicast
1984 * address list for the given interface.
1986 if ((imo
->imo_membership
[i
] =
1987 in_addmulti(&mreq
.imr_multiaddr
, ifp
)) == NULL
) {
1992 ++imo
->imo_num_memberships
;
1996 case IP_DROP_MEMBERSHIP
:
1998 * Drop a multicast group membership.
1999 * Group must be a valid IP multicast address.
2001 error
= soopt_to_kbuf(sopt
, &mreq
, sizeof mreq
, sizeof mreq
);
2005 if (!IN_MULTICAST(ntohl(mreq
.imr_multiaddr
.s_addr
))) {
2012 * If an interface address was specified, get a pointer
2013 * to its ifnet structure.
2015 if (mreq
.imr_interface
.s_addr
== INADDR_ANY
)
2018 ifp
= ip_multicast_if(&mreq
.imr_interface
, NULL
);
2020 error
= EADDRNOTAVAIL
;
2026 * Find the membership in the membership array.
2028 for (i
= 0; i
< imo
->imo_num_memberships
; ++i
) {
2030 imo
->imo_membership
[i
]->inm_ifp
== ifp
) &&
2031 imo
->imo_membership
[i
]->inm_addr
.s_addr
==
2032 mreq
.imr_multiaddr
.s_addr
)
2035 if (i
== imo
->imo_num_memberships
) {
2036 error
= EADDRNOTAVAIL
;
2041 * Give up the multicast address record to which the
2042 * membership points.
2044 in_delmulti(imo
->imo_membership
[i
]);
2046 * Remove the gap in the membership array.
2048 for (++i
; i
< imo
->imo_num_memberships
; ++i
)
2049 imo
->imo_membership
[i
-1] = imo
->imo_membership
[i
];
2050 --imo
->imo_num_memberships
;
2063 * Return the IP multicast options in response to user getsockopt().
2066 ip_getmoptions(struct sockopt
*sopt
, struct ip_moptions
*imo
)
2068 struct in_addr addr
;
2069 struct in_ifaddr
*ia
;
2074 switch (sopt
->sopt_name
) {
2075 case IP_MULTICAST_VIF
:
2077 optval
= imo
->imo_multicast_vif
;
2080 soopt_from_kbuf(sopt
, &optval
, sizeof optval
);
2083 case IP_MULTICAST_IF
:
2084 if (imo
== NULL
|| imo
->imo_multicast_ifp
== NULL
)
2085 addr
.s_addr
= INADDR_ANY
;
2086 else if (imo
->imo_multicast_addr
.s_addr
) {
2087 /* return the value user has set */
2088 addr
= imo
->imo_multicast_addr
;
2090 ia
= IFP_TO_IA(imo
->imo_multicast_ifp
);
2091 addr
.s_addr
= (ia
== NULL
) ? INADDR_ANY
2092 : IA_SIN(ia
)->sin_addr
.s_addr
;
2094 soopt_from_kbuf(sopt
, &addr
, sizeof addr
);
2097 case IP_MULTICAST_TTL
:
2099 optval
= coptval
= IP_DEFAULT_MULTICAST_TTL
;
2101 optval
= coptval
= imo
->imo_multicast_ttl
;
2102 if (sopt
->sopt_valsize
== 1)
2103 soopt_from_kbuf(sopt
, &coptval
, 1);
2105 soopt_from_kbuf(sopt
, &optval
, sizeof optval
);
2108 case IP_MULTICAST_LOOP
:
2110 optval
= coptval
= IP_DEFAULT_MULTICAST_LOOP
;
2112 optval
= coptval
= imo
->imo_multicast_loop
;
2113 if (sopt
->sopt_valsize
== 1)
2114 soopt_from_kbuf(sopt
, &coptval
, 1);
2116 soopt_from_kbuf(sopt
, &optval
, sizeof optval
);
2120 error
= ENOPROTOOPT
;
2127 * Discard the IP multicast options.
2130 ip_freemoptions(struct ip_moptions
*imo
)
2135 for (i
= 0; i
< imo
->imo_num_memberships
; ++i
)
2136 in_delmulti(imo
->imo_membership
[i
]);
2137 kfree(imo
, M_IPMOPTS
);
2142 * Routine called from ip_output() to loop back a copy of an IP multicast
2143 * packet to the input queue of a specified interface. Note that this
2144 * calls the output routine of the loopback "driver", but with an interface
2145 * pointer that might NOT be a loopback interface -- evil, but easier than
2146 * replicating that code here.
2149 ip_mloopback(struct ifnet
*ifp
, struct mbuf
*m
, struct sockaddr_in
*dst
,
2155 copym
= m_copypacket(m
, M_NOWAIT
);
2156 if (copym
!= NULL
&& (copym
->m_flags
& M_EXT
|| copym
->m_len
< hlen
))
2157 copym
= m_pullup(copym
, hlen
);
2158 if (copym
!= NULL
) {
2160 * if the checksum hasn't been computed, mark it as valid
2162 if (copym
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) {
2163 in_delayed_cksum(copym
);
2164 copym
->m_pkthdr
.csum_flags
&= ~CSUM_DELAY_DATA
;
2165 copym
->m_pkthdr
.csum_flags
|=
2166 CSUM_DATA_VALID
| CSUM_PSEUDO_HDR
;
2167 copym
->m_pkthdr
.csum_data
= 0xffff;
2170 * We don't bother to fragment if the IP length is greater
2171 * than the interface's MTU. Can this possibly matter?
2173 ip
= mtod(copym
, struct ip
*);
2174 ip
->ip_len
= htons(ip
->ip_len
);
2175 ip
->ip_off
= htons(ip
->ip_off
);
2177 if (ip
->ip_vhl
== IP_VHL_BORING
) {
2178 ip
->ip_sum
= in_cksum_hdr(ip
);
2180 ip
->ip_sum
= in_cksum(copym
, hlen
);
2184 * It's not clear whether there are any lingering
2185 * reentrancy problems in other areas which might
2186 * be exposed by using ip_input directly (in
2187 * particular, everything which modifies the packet
2188 * in-place). Yet another option is using the
2189 * protosw directly to deliver the looped back
2190 * packet. For the moment, we'll err on the side
2191 * of safety by using if_simloop().
2194 if (dst
->sin_family
!= AF_INET
) {
2195 kprintf("ip_mloopback: bad address family %d\n",
2197 dst
->sin_family
= AF_INET
;
2200 if_simloop(ifp
, copym
, dst
->sin_family
, 0);