ip_output.c revision 1.217.2.1
1 /* $NetBSD: ip_output.c,v 1.217.2.1 2013/02/25 00:30:04 tls Exp $ */ 2 3 /* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /*- 33 * Copyright (c) 1998 The NetBSD Foundation, Inc. 34 * All rights reserved. 35 * 36 * This code is derived from software contributed to The NetBSD Foundation 37 * by Public Access Networks Corporation ("Panix"). It was developed under 38 * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon. 39 * 40 * Redistribution and use in source and binary forms, with or without 41 * modification, are permitted provided that the following conditions 42 * are met: 43 * 1. Redistributions of source code must retain the above copyright 44 * notice, this list of conditions and the following disclaimer. 45 * 2. Redistributions in binary form must reproduce the above copyright 46 * notice, this list of conditions and the following disclaimer in the 47 * documentation and/or other materials provided with the distribution. 48 * 49 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 50 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 51 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 52 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 53 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 54 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 55 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 56 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 57 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 58 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 59 * POSSIBILITY OF SUCH DAMAGE. 60 */ 61 62 /* 63 * Copyright (c) 1982, 1986, 1988, 1990, 1993 64 * The Regents of the University of California. All rights reserved. 65 * 66 * Redistribution and use in source and binary forms, with or without 67 * modification, are permitted provided that the following conditions 68 * are met: 69 * 1. Redistributions of source code must retain the above copyright 70 * notice, this list of conditions and the following disclaimer. 71 * 2. Redistributions in binary form must reproduce the above copyright 72 * notice, this list of conditions and the following disclaimer in the 73 * documentation and/or other materials provided with the distribution. 74 * 3. Neither the name of the University nor the names of its contributors 75 * may be used to endorse or promote products derived from this software 76 * without specific prior written permission. 77 * 78 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 79 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 80 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 81 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 82 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 83 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 84 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 85 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 86 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 87 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 88 * SUCH DAMAGE. 89 * 90 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94 91 */ 92 93 #include <sys/cdefs.h> 94 __KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.217.2.1 2013/02/25 00:30:04 tls Exp $"); 95 96 #include "opt_pfil_hooks.h" 97 #include "opt_inet.h" 98 #include "opt_ipsec.h" 99 #include "opt_mrouting.h" 100 101 #include <sys/param.h> 102 #include <sys/malloc.h> 103 #include <sys/kmem.h> 104 #include <sys/mbuf.h> 105 #include <sys/errno.h> 106 #include <sys/protosw.h> 107 #include <sys/socket.h> 108 #include <sys/socketvar.h> 109 #include <sys/kauth.h> 110 #ifdef FAST_IPSEC 111 #include <sys/domain.h> 112 #endif 113 #include <sys/systm.h> 114 #include <sys/proc.h> 115 116 #include <net/if.h> 117 #include <net/route.h> 118 #include <net/pfil.h> 119 120 #include <netinet/in.h> 121 #include <netinet/in_systm.h> 122 #include <netinet/ip.h> 123 #include <netinet/in_pcb.h> 124 #include <netinet/in_var.h> 125 #include <netinet/ip_var.h> 126 #include <netinet/ip_private.h> 127 #include <netinet/in_offload.h> 128 #include <netinet/portalgo.h> 129 130 #ifdef MROUTING 131 #include <netinet/ip_mroute.h> 132 #endif 133 134 #ifdef FAST_IPSEC 135 #include <netipsec/ipsec.h> 136 #include <netipsec/key.h> 137 #include <netipsec/xform.h> 138 #endif /* FAST_IPSEC*/ 139 140 #ifdef IPSEC_NAT_T 141 #include <netinet/udp.h> 142 #endif 143 144 static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *); 145 static struct ifnet *ip_multicast_if(struct in_addr *, int *); 146 static void ip_mloopback(struct ifnet *, struct mbuf *, 147 const struct sockaddr_in *); 148 149 #ifdef PFIL_HOOKS 150 extern struct pfil_head inet_pfil_hook; /* XXX */ 151 #endif 152 153 int ip_do_loopback_cksum = 0; 154 155 /* 156 * IP output. The packet in mbuf chain m contains a skeletal IP 157 * header (with len, off, ttl, proto, tos, src, dst). 158 * The mbuf chain containing the packet will be freed. 159 * The mbuf opt, if present, will not be freed. 160 */ 161 int 162 ip_output(struct mbuf *m0, ...) 163 { 164 struct rtentry *rt; 165 struct ip *ip; 166 struct ifnet *ifp; 167 struct mbuf *m = m0; 168 int hlen = sizeof (struct ip); 169 int len, error = 0; 170 struct route iproute; 171 const struct sockaddr_in *dst; 172 struct in_ifaddr *ia; 173 struct ifaddr *xifa; 174 struct mbuf *opt; 175 struct route *ro; 176 int flags, sw_csum; 177 int *mtu_p; 178 u_long mtu; 179 struct ip_moptions *imo; 180 struct socket *so; 181 va_list ap; 182 #ifdef IPSEC_NAT_T 183 int natt_frag = 0; 184 #endif 185 #ifdef FAST_IPSEC 186 struct inpcb *inp; 187 struct secpolicy *sp = NULL; 188 int s; 189 #endif 190 union { 191 struct sockaddr dst; 192 struct sockaddr_in dst4; 193 } u; 194 struct sockaddr *rdst = &u.dst; /* real IP destination, as opposed 195 * to the nexthop 196 */ 197 198 len = 0; 199 va_start(ap, m0); 200 opt = va_arg(ap, struct mbuf *); 201 ro = va_arg(ap, struct route *); 202 flags = va_arg(ap, int); 203 imo = va_arg(ap, struct ip_moptions *); 204 so = va_arg(ap, struct socket *); 205 if (flags & IP_RETURNMTU) 206 mtu_p = va_arg(ap, int *); 207 else 208 mtu_p = NULL; 209 va_end(ap); 210 211 MCLAIM(m, &ip_tx_mowner); 212 #ifdef FAST_IPSEC 213 if (so != NULL && so->so_proto->pr_domain->dom_family == AF_INET) 214 inp = (struct inpcb *)so->so_pcb; 215 else 216 inp = NULL; 217 #endif /* FAST_IPSEC */ 218 219 #ifdef DIAGNOSTIC 220 if ((m->m_flags & M_PKTHDR) == 0) 221 panic("ip_output: no HDR"); 222 223 if ((m->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) != 0) { 224 panic("ip_output: IPv6 checksum offload flags: %d", 225 m->m_pkthdr.csum_flags); 226 } 227 228 if ((m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) == 229 (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 230 panic("ip_output: conflicting checksum offload flags: %d", 231 m->m_pkthdr.csum_flags); 232 } 233 #endif 234 if (opt) { 235 m = ip_insertoptions(m, opt, &len); 236 if (len >= sizeof(struct ip)) 237 hlen = len; 238 } 239 ip = mtod(m, struct ip *); 240 /* 241 * Fill in IP header. 242 */ 243 if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) { 244 ip->ip_v = IPVERSION; 245 ip->ip_off = htons(0); 246 /* ip->ip_id filled in after we find out source ia */ 247 ip->ip_hl = hlen >> 2; 248 IP_STATINC(IP_STAT_LOCALOUT); 249 } else { 250 hlen = ip->ip_hl << 2; 251 } 252 /* 253 * Route packet. 254 */ 255 memset(&iproute, 0, sizeof(iproute)); 256 if (ro == NULL) 257 ro = &iproute; 258 sockaddr_in_init(&u.dst4, &ip->ip_dst, 0); 259 dst = satocsin(rtcache_getdst(ro)); 260 /* 261 * If there is a cached route, 262 * check that it is to the same destination 263 * and is still up. If not, free it and try again. 264 * The address family should also be checked in case of sharing the 265 * cache with IPv6. 266 */ 267 if (dst == NULL) 268 ; 269 else if (dst->sin_family != AF_INET || 270 !in_hosteq(dst->sin_addr, ip->ip_dst)) 271 rtcache_free(ro); 272 273 if ((rt = rtcache_validate(ro)) == NULL && 274 (rt = rtcache_update(ro, 1)) == NULL) { 275 dst = &u.dst4; 276 rtcache_setdst(ro, &u.dst); 277 } 278 /* 279 * If routing to interface only, 280 * short circuit routing lookup. 281 */ 282 if (flags & IP_ROUTETOIF) { 283 if ((ia = ifatoia(ifa_ifwithladdr(sintocsa(dst)))) == NULL) { 284 IP_STATINC(IP_STAT_NOROUTE); 285 error = ENETUNREACH; 286 goto bad; 287 } 288 ifp = ia->ia_ifp; 289 mtu = ifp->if_mtu; 290 ip->ip_ttl = 1; 291 } else if ((IN_MULTICAST(ip->ip_dst.s_addr) || 292 ip->ip_dst.s_addr == INADDR_BROADCAST) && 293 imo != NULL && imo->imo_multicast_ifp != NULL) { 294 ifp = imo->imo_multicast_ifp; 295 mtu = ifp->if_mtu; 296 IFP_TO_IA(ifp, ia); 297 } else { 298 if (rt == NULL) 299 rt = rtcache_init(ro); 300 if (rt == NULL) { 301 IP_STATINC(IP_STAT_NOROUTE); 302 error = EHOSTUNREACH; 303 goto bad; 304 } 305 ia = ifatoia(rt->rt_ifa); 306 ifp = rt->rt_ifp; 307 if ((mtu = rt->rt_rmx.rmx_mtu) == 0) 308 mtu = ifp->if_mtu; 309 rt->rt_use++; 310 if (rt->rt_flags & RTF_GATEWAY) 311 dst = satosin(rt->rt_gateway); 312 } 313 if (IN_MULTICAST(ip->ip_dst.s_addr) || 314 (ip->ip_dst.s_addr == INADDR_BROADCAST)) { 315 struct in_multi *inm; 316 317 m->m_flags |= (ip->ip_dst.s_addr == INADDR_BROADCAST) ? 318 M_BCAST : M_MCAST; 319 /* 320 * See if the caller provided any multicast options 321 */ 322 if (imo != NULL) 323 ip->ip_ttl = imo->imo_multicast_ttl; 324 else 325 ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL; 326 327 /* 328 * if we don't know the outgoing ifp yet, we can't generate 329 * output 330 */ 331 if (!ifp) { 332 IP_STATINC(IP_STAT_NOROUTE); 333 error = ENETUNREACH; 334 goto bad; 335 } 336 337 /* 338 * If the packet is multicast or broadcast, confirm that 339 * the outgoing interface can transmit it. 340 */ 341 if (((m->m_flags & M_MCAST) && 342 (ifp->if_flags & IFF_MULTICAST) == 0) || 343 ((m->m_flags & M_BCAST) && 344 (ifp->if_flags & (IFF_BROADCAST|IFF_POINTOPOINT)) == 0)) { 345 IP_STATINC(IP_STAT_NOROUTE); 346 error = ENETUNREACH; 347 goto bad; 348 } 349 /* 350 * If source address not specified yet, use an address 351 * of outgoing interface. 352 */ 353 if (in_nullhost(ip->ip_src)) { 354 struct in_ifaddr *xia; 355 356 IFP_TO_IA(ifp, xia); 357 if (!xia) { 358 error = EADDRNOTAVAIL; 359 goto bad; 360 } 361 xifa = &xia->ia_ifa; 362 if (xifa->ifa_getifa != NULL) { 363 xia = ifatoia((*xifa->ifa_getifa)(xifa, rdst)); 364 } 365 ip->ip_src = xia->ia_addr.sin_addr; 366 } 367 368 IN_LOOKUP_MULTI(ip->ip_dst, ifp, inm); 369 if (inm != NULL && 370 (imo == NULL || imo->imo_multicast_loop)) { 371 /* 372 * If we belong to the destination multicast group 373 * on the outgoing interface, and the caller did not 374 * forbid loopback, loop back a copy. 375 */ 376 ip_mloopback(ifp, m, &u.dst4); 377 } 378 #ifdef MROUTING 379 else { 380 /* 381 * If we are acting as a multicast router, perform 382 * multicast forwarding as if the packet had just 383 * arrived on the interface to which we are about 384 * to send. The multicast forwarding function 385 * recursively calls this function, using the 386 * IP_FORWARDING flag to prevent infinite recursion. 387 * 388 * Multicasts that are looped back by ip_mloopback(), 389 * above, will be forwarded by the ip_input() routine, 390 * if necessary. 391 */ 392 extern struct socket *ip_mrouter; 393 394 if (ip_mrouter && (flags & IP_FORWARDING) == 0) { 395 if (ip_mforward(m, ifp) != 0) { 396 m_freem(m); 397 goto done; 398 } 399 } 400 } 401 #endif 402 /* 403 * Multicasts with a time-to-live of zero may be looped- 404 * back, above, but must not be transmitted on a network. 405 * Also, multicasts addressed to the loopback interface 406 * are not sent -- the above call to ip_mloopback() will 407 * loop back a copy if this host actually belongs to the 408 * destination group on the loopback interface. 409 */ 410 if (ip->ip_ttl == 0 || (ifp->if_flags & IFF_LOOPBACK) != 0) { 411 m_freem(m); 412 goto done; 413 } 414 415 goto sendit; 416 } 417 /* 418 * If source address not specified yet, use address 419 * of outgoing interface. 420 */ 421 if (in_nullhost(ip->ip_src)) { 422 xifa = &ia->ia_ifa; 423 if (xifa->ifa_getifa != NULL) 424 ia = ifatoia((*xifa->ifa_getifa)(xifa, rdst)); 425 ip->ip_src = ia->ia_addr.sin_addr; 426 } 427 428 /* 429 * packets with Class-D address as source are not valid per 430 * RFC 1112 431 */ 432 if (IN_MULTICAST(ip->ip_src.s_addr)) { 433 IP_STATINC(IP_STAT_ODROPPED); 434 error = EADDRNOTAVAIL; 435 goto bad; 436 } 437 438 /* 439 * Look for broadcast address and 440 * and verify user is allowed to send 441 * such a packet. 442 */ 443 if (in_broadcast(dst->sin_addr, ifp)) { 444 if ((ifp->if_flags & IFF_BROADCAST) == 0) { 445 error = EADDRNOTAVAIL; 446 goto bad; 447 } 448 if ((flags & IP_ALLOWBROADCAST) == 0) { 449 error = EACCES; 450 goto bad; 451 } 452 /* don't allow broadcast messages to be fragmented */ 453 if (ntohs(ip->ip_len) > ifp->if_mtu) { 454 error = EMSGSIZE; 455 goto bad; 456 } 457 m->m_flags |= M_BCAST; 458 } else 459 m->m_flags &= ~M_BCAST; 460 461 sendit: 462 if ((flags & (IP_FORWARDING|IP_NOIPNEWID)) == 0) { 463 if (m->m_pkthdr.len < IP_MINFRAGSIZE) { 464 ip->ip_id = 0; 465 } else if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0) { 466 ip->ip_id = ip_newid(ia); 467 } else { 468 469 /* 470 * TSO capable interfaces (typically?) increment 471 * ip_id for each segment. 472 * "allocate" enough ids here to increase the chance 473 * for them to be unique. 474 * 475 * note that the following calculation is not 476 * needed to be precise. wasting some ip_id is fine. 477 */ 478 479 unsigned int segsz = m->m_pkthdr.segsz; 480 unsigned int datasz = ntohs(ip->ip_len) - hlen; 481 unsigned int num = howmany(datasz, segsz); 482 483 ip->ip_id = ip_newid_range(ia, num); 484 } 485 } 486 /* 487 * If we're doing Path MTU Discovery, we need to set DF unless 488 * the route's MTU is locked. 489 */ 490 if ((flags & IP_MTUDISC) != 0 && rt != NULL && 491 (rt->rt_rmx.rmx_locks & RTV_MTU) == 0) 492 ip->ip_off |= htons(IP_DF); 493 494 #ifdef FAST_IPSEC 495 /* 496 * Check the security policy (SP) for the packet and, if 497 * required, do IPsec-related processing. There are two 498 * cases here; the first time a packet is sent through 499 * it will be untagged and handled by ipsec4_checkpolicy. 500 * If the packet is resubmitted to ip_output (e.g. after 501 * AH, ESP, etc. processing), there will be a tag to bypass 502 * the lookup and related policy checking. 503 */ 504 if (!ipsec_outdone(m)) { 505 s = splsoftnet(); 506 if (inp != NULL && 507 IPSEC_PCB_SKIP_IPSEC(inp->inp_sp, IPSEC_DIR_OUTBOUND)) { 508 splx(s); 509 goto spd_done; 510 } 511 sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags, 512 &error, inp); 513 /* 514 * There are four return cases: 515 * sp != NULL apply IPsec policy 516 * sp == NULL, error == 0 no IPsec handling needed 517 * sp == NULL, error == -EINVAL discard packet w/o error 518 * sp == NULL, error != 0 discard packet, report error 519 */ 520 if (sp != NULL) { 521 #ifdef IPSEC_NAT_T 522 /* 523 * NAT-T ESP fragmentation: don't do IPSec processing now, 524 * we'll do it on each fragmented packet. 525 */ 526 if (sp->req->sav && 527 ((sp->req->sav->natt_type & UDP_ENCAP_ESPINUDP) || 528 (sp->req->sav->natt_type & UDP_ENCAP_ESPINUDP_NON_IKE))) { 529 if (ntohs(ip->ip_len) > sp->req->sav->esp_frag) { 530 natt_frag = 1; 531 mtu = sp->req->sav->esp_frag; 532 splx(s); 533 goto spd_done; 534 } 535 } 536 #endif /* IPSEC_NAT_T */ 537 538 /* 539 * Do delayed checksums now because we send before 540 * this is done in the normal processing path. 541 */ 542 if (m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 543 in_delayed_cksum(m); 544 m->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 545 } 546 547 #ifdef __FreeBSD__ 548 ip->ip_len = htons(ip->ip_len); 549 ip->ip_off = htons(ip->ip_off); 550 #endif 551 552 /* NB: callee frees mbuf */ 553 error = ipsec4_process_packet(m, sp->req, flags, 0); 554 /* 555 * Preserve KAME behaviour: ENOENT can be returned 556 * when an SA acquire is in progress. Don't propagate 557 * this to user-level; it confuses applications. 558 * 559 * XXX this will go away when the SADB is redone. 560 */ 561 if (error == ENOENT) 562 error = 0; 563 splx(s); 564 goto done; 565 } else { 566 splx(s); 567 568 if (error != 0) { 569 /* 570 * Hack: -EINVAL is used to signal that a packet 571 * should be silently discarded. This is typically 572 * because we asked key management for an SA and 573 * it was delayed (e.g. kicked up to IKE). 574 */ 575 if (error == -EINVAL) 576 error = 0; 577 goto bad; 578 } else { 579 /* No IPsec processing for this packet. */ 580 } 581 } 582 } 583 spd_done: 584 #endif /* FAST_IPSEC */ 585 586 #ifdef PFIL_HOOKS 587 /* 588 * Run through list of hooks for output packets. 589 */ 590 if ((error = pfil_run_hooks(&inet_pfil_hook, &m, ifp, PFIL_OUT)) != 0) 591 goto done; 592 if (m == NULL) 593 goto done; 594 595 ip = mtod(m, struct ip *); 596 hlen = ip->ip_hl << 2; 597 #endif /* PFIL_HOOKS */ 598 599 m->m_pkthdr.csum_data |= hlen << 16; 600 601 #if IFA_STATS 602 /* 603 * search for the source address structure to 604 * maintain output statistics. 605 */ 606 INADDR_TO_IA(ip->ip_src, ia); 607 #endif 608 609 /* Maybe skip checksums on loopback interfaces. */ 610 if (IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) { 611 m->m_pkthdr.csum_flags |= M_CSUM_IPv4; 612 } 613 sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_csum_flags_tx; 614 /* 615 * If small enough for mtu of path, or if using TCP segmentation 616 * offload, can just send directly. 617 */ 618 if (ntohs(ip->ip_len) <= mtu || 619 (m->m_pkthdr.csum_flags & M_CSUM_TSOv4) != 0) { 620 #if IFA_STATS 621 if (ia) 622 ia->ia_ifa.ifa_data.ifad_outbytes += ntohs(ip->ip_len); 623 #endif 624 /* 625 * Always initialize the sum to 0! Some HW assisted 626 * checksumming requires this. 627 */ 628 ip->ip_sum = 0; 629 630 if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0) { 631 /* 632 * Perform any checksums that the hardware can't do 633 * for us. 634 * 635 * XXX Does any hardware require the {th,uh}_sum 636 * XXX fields to be 0? 637 */ 638 if (sw_csum & M_CSUM_IPv4) { 639 KASSERT(IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)); 640 ip->ip_sum = in_cksum(m, hlen); 641 m->m_pkthdr.csum_flags &= ~M_CSUM_IPv4; 642 } 643 if (sw_csum & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 644 if (IN_NEED_CHECKSUM(ifp, 645 sw_csum & (M_CSUM_TCPv4|M_CSUM_UDPv4))) { 646 in_delayed_cksum(m); 647 } 648 m->m_pkthdr.csum_flags &= 649 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 650 } 651 } 652 653 if (__predict_true( 654 (m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0 || 655 (ifp->if_capenable & IFCAP_TSOv4) != 0)) { 656 KERNEL_LOCK(1, NULL); 657 error = 658 (*ifp->if_output)(ifp, m, 659 (m->m_flags & M_MCAST) ? 660 sintocsa(rdst) : sintocsa(dst), 661 rt); 662 KERNEL_UNLOCK_ONE(NULL); 663 } else { 664 error = 665 ip_tso_output(ifp, m, 666 (m->m_flags & M_MCAST) ? 667 sintocsa(rdst) : sintocsa(dst), 668 rt); 669 } 670 goto done; 671 } 672 673 /* 674 * We can't use HW checksumming if we're about to 675 * to fragment the packet. 676 * 677 * XXX Some hardware can do this. 678 */ 679 if (m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 680 if (IN_NEED_CHECKSUM(ifp, 681 m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4))) { 682 in_delayed_cksum(m); 683 } 684 m->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 685 } 686 687 /* 688 * Too large for interface; fragment if possible. 689 * Must be able to put at least 8 bytes per fragment. 690 */ 691 if (ntohs(ip->ip_off) & IP_DF) { 692 if (flags & IP_RETURNMTU) 693 *mtu_p = mtu; 694 error = EMSGSIZE; 695 IP_STATINC(IP_STAT_CANTFRAG); 696 goto bad; 697 } 698 699 error = ip_fragment(m, ifp, mtu); 700 if (error) { 701 m = NULL; 702 goto bad; 703 } 704 705 for (; m; m = m0) { 706 m0 = m->m_nextpkt; 707 m->m_nextpkt = 0; 708 if (error == 0) { 709 #if IFA_STATS 710 if (ia) 711 ia->ia_ifa.ifa_data.ifad_outbytes += 712 ntohs(ip->ip_len); 713 #endif 714 #ifdef IPSEC_NAT_T 715 /* 716 * If we get there, the packet has not been handeld by 717 * IPSec whereas it should have. Now that it has been 718 * fragmented, re-inject it in ip_output so that IPsec 719 * processing can occur. 720 */ 721 if (natt_frag) { 722 error = ip_output(m, opt, 723 ro, flags | IP_RAWOUTPUT | IP_NOIPNEWID, imo, so, mtu_p); 724 } else 725 #endif /* IPSEC_NAT_T */ 726 { 727 KASSERT((m->m_pkthdr.csum_flags & 728 (M_CSUM_UDPv4 | M_CSUM_TCPv4)) == 0); 729 KERNEL_LOCK(1, NULL); 730 error = (*ifp->if_output)(ifp, m, 731 (m->m_flags & M_MCAST) ? 732 sintocsa(rdst) : sintocsa(dst), 733 rt); 734 KERNEL_UNLOCK_ONE(NULL); 735 } 736 } else 737 m_freem(m); 738 } 739 740 if (error == 0) 741 IP_STATINC(IP_STAT_FRAGMENTED); 742 done: 743 rtcache_free(&iproute); 744 745 #ifdef FAST_IPSEC 746 if (sp != NULL) 747 KEY_FREESP(&sp); 748 #endif /* FAST_IPSEC */ 749 750 return (error); 751 bad: 752 m_freem(m); 753 goto done; 754 } 755 756 int 757 ip_fragment(struct mbuf *m, struct ifnet *ifp, u_long mtu) 758 { 759 struct ip *ip, *mhip; 760 struct mbuf *m0; 761 int len, hlen, off; 762 int mhlen, firstlen; 763 struct mbuf **mnext; 764 int sw_csum = m->m_pkthdr.csum_flags; 765 int fragments = 0; 766 int s; 767 int error = 0; 768 769 ip = mtod(m, struct ip *); 770 hlen = ip->ip_hl << 2; 771 if (ifp != NULL) 772 sw_csum &= ~ifp->if_csum_flags_tx; 773 774 len = (mtu - hlen) &~ 7; 775 if (len < 8) { 776 m_freem(m); 777 return (EMSGSIZE); 778 } 779 780 firstlen = len; 781 mnext = &m->m_nextpkt; 782 783 /* 784 * Loop through length of segment after first fragment, 785 * make new header and copy data of each part and link onto chain. 786 */ 787 m0 = m; 788 mhlen = sizeof (struct ip); 789 for (off = hlen + len; off < ntohs(ip->ip_len); off += len) { 790 MGETHDR(m, M_DONTWAIT, MT_HEADER); 791 if (m == 0) { 792 error = ENOBUFS; 793 IP_STATINC(IP_STAT_ODROPPED); 794 goto sendorfree; 795 } 796 MCLAIM(m, m0->m_owner); 797 *mnext = m; 798 mnext = &m->m_nextpkt; 799 m->m_data += max_linkhdr; 800 mhip = mtod(m, struct ip *); 801 *mhip = *ip; 802 /* we must inherit MCAST and BCAST flags */ 803 m->m_flags |= m0->m_flags & (M_MCAST|M_BCAST); 804 if (hlen > sizeof (struct ip)) { 805 mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip); 806 mhip->ip_hl = mhlen >> 2; 807 } 808 m->m_len = mhlen; 809 mhip->ip_off = ((off - hlen) >> 3) + 810 (ntohs(ip->ip_off) & ~IP_MF); 811 if (ip->ip_off & htons(IP_MF)) 812 mhip->ip_off |= IP_MF; 813 if (off + len >= ntohs(ip->ip_len)) 814 len = ntohs(ip->ip_len) - off; 815 else 816 mhip->ip_off |= IP_MF; 817 HTONS(mhip->ip_off); 818 mhip->ip_len = htons((u_int16_t)(len + mhlen)); 819 m->m_next = m_copym(m0, off, len, M_DONTWAIT); 820 if (m->m_next == 0) { 821 error = ENOBUFS; /* ??? */ 822 IP_STATINC(IP_STAT_ODROPPED); 823 goto sendorfree; 824 } 825 m->m_pkthdr.len = mhlen + len; 826 m->m_pkthdr.rcvif = NULL; 827 mhip->ip_sum = 0; 828 KASSERT((m->m_pkthdr.csum_flags & M_CSUM_IPv4) == 0); 829 if (sw_csum & M_CSUM_IPv4) { 830 mhip->ip_sum = in_cksum(m, mhlen); 831 } else { 832 /* 833 * checksum is hw-offloaded or not necessary. 834 */ 835 m->m_pkthdr.csum_flags |= 836 m0->m_pkthdr.csum_flags & M_CSUM_IPv4; 837 m->m_pkthdr.csum_data |= mhlen << 16; 838 KASSERT(!(ifp != NULL && 839 IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) 840 || (m->m_pkthdr.csum_flags & M_CSUM_IPv4) != 0); 841 } 842 IP_STATINC(IP_STAT_OFRAGMENTS); 843 fragments++; 844 } 845 /* 846 * Update first fragment by trimming what's been copied out 847 * and updating header, then send each fragment (in order). 848 */ 849 m = m0; 850 m_adj(m, hlen + firstlen - ntohs(ip->ip_len)); 851 m->m_pkthdr.len = hlen + firstlen; 852 ip->ip_len = htons((u_int16_t)m->m_pkthdr.len); 853 ip->ip_off |= htons(IP_MF); 854 ip->ip_sum = 0; 855 if (sw_csum & M_CSUM_IPv4) { 856 ip->ip_sum = in_cksum(m, hlen); 857 m->m_pkthdr.csum_flags &= ~M_CSUM_IPv4; 858 } else { 859 /* 860 * checksum is hw-offloaded or not necessary. 861 */ 862 KASSERT(!(ifp != NULL && IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) 863 || (m->m_pkthdr.csum_flags & M_CSUM_IPv4) != 0); 864 KASSERT(M_CSUM_DATA_IPv4_IPHL(m->m_pkthdr.csum_data) >= 865 sizeof(struct ip)); 866 } 867 sendorfree: 868 /* 869 * If there is no room for all the fragments, don't queue 870 * any of them. 871 */ 872 if (ifp != NULL) { 873 s = splnet(); 874 if (ifp->if_snd.ifq_maxlen - ifp->if_snd.ifq_len < fragments && 875 error == 0) { 876 error = ENOBUFS; 877 IP_STATINC(IP_STAT_ODROPPED); 878 IFQ_INC_DROPS(&ifp->if_snd); 879 } 880 splx(s); 881 } 882 if (error) { 883 for (m = m0; m; m = m0) { 884 m0 = m->m_nextpkt; 885 m->m_nextpkt = NULL; 886 m_freem(m); 887 } 888 } 889 return (error); 890 } 891 892 /* 893 * Process a delayed payload checksum calculation. 894 */ 895 void 896 in_delayed_cksum(struct mbuf *m) 897 { 898 struct ip *ip; 899 u_int16_t csum, offset; 900 901 ip = mtod(m, struct ip *); 902 offset = ip->ip_hl << 2; 903 csum = in4_cksum(m, 0, offset, ntohs(ip->ip_len) - offset); 904 if (csum == 0 && (m->m_pkthdr.csum_flags & M_CSUM_UDPv4) != 0) 905 csum = 0xffff; 906 907 offset += M_CSUM_DATA_IPv4_OFFSET(m->m_pkthdr.csum_data); 908 909 if ((offset + sizeof(u_int16_t)) > m->m_len) { 910 /* This happen when ip options were inserted 911 printf("in_delayed_cksum: pullup len %d off %d proto %d\n", 912 m->m_len, offset, ip->ip_p); 913 */ 914 m_copyback(m, offset, sizeof(csum), (void *) &csum); 915 } else 916 *(u_int16_t *)(mtod(m, char *) + offset) = csum; 917 } 918 919 /* 920 * Determine the maximum length of the options to be inserted; 921 * we would far rather allocate too much space rather than too little. 922 */ 923 924 u_int 925 ip_optlen(struct inpcb *inp) 926 { 927 struct mbuf *m = inp->inp_options; 928 929 if (m && m->m_len > offsetof(struct ipoption, ipopt_dst)) 930 return (m->m_len - offsetof(struct ipoption, ipopt_dst)); 931 else 932 return 0; 933 } 934 935 936 /* 937 * Insert IP options into preformed packet. 938 * Adjust IP destination as required for IP source routing, 939 * as indicated by a non-zero in_addr at the start of the options. 940 */ 941 static struct mbuf * 942 ip_insertoptions(struct mbuf *m, struct mbuf *opt, int *phlen) 943 { 944 struct ipoption *p = mtod(opt, struct ipoption *); 945 struct mbuf *n; 946 struct ip *ip = mtod(m, struct ip *); 947 unsigned optlen; 948 949 optlen = opt->m_len - sizeof(p->ipopt_dst); 950 if (optlen + ntohs(ip->ip_len) > IP_MAXPACKET) 951 return (m); /* XXX should fail */ 952 if (!in_nullhost(p->ipopt_dst)) 953 ip->ip_dst = p->ipopt_dst; 954 if (M_READONLY(m) || M_LEADINGSPACE(m) < optlen) { 955 MGETHDR(n, M_DONTWAIT, MT_HEADER); 956 if (n == 0) 957 return (m); 958 MCLAIM(n, m->m_owner); 959 M_MOVE_PKTHDR(n, m); 960 m->m_len -= sizeof(struct ip); 961 m->m_data += sizeof(struct ip); 962 n->m_next = m; 963 m = n; 964 m->m_len = optlen + sizeof(struct ip); 965 m->m_data += max_linkhdr; 966 bcopy((void *)ip, mtod(m, void *), sizeof(struct ip)); 967 } else { 968 m->m_data -= optlen; 969 m->m_len += optlen; 970 memmove(mtod(m, void *), ip, sizeof(struct ip)); 971 } 972 m->m_pkthdr.len += optlen; 973 ip = mtod(m, struct ip *); 974 bcopy((void *)p->ipopt_list, (void *)(ip + 1), (unsigned)optlen); 975 *phlen = sizeof(struct ip) + optlen; 976 ip->ip_len = htons(ntohs(ip->ip_len) + optlen); 977 return (m); 978 } 979 980 /* 981 * Copy options from ip to jp, 982 * omitting those not copied during fragmentation. 983 */ 984 int 985 ip_optcopy(struct ip *ip, struct ip *jp) 986 { 987 u_char *cp, *dp; 988 int opt, optlen, cnt; 989 990 cp = (u_char *)(ip + 1); 991 dp = (u_char *)(jp + 1); 992 cnt = (ip->ip_hl << 2) - sizeof (struct ip); 993 for (; cnt > 0; cnt -= optlen, cp += optlen) { 994 opt = cp[0]; 995 if (opt == IPOPT_EOL) 996 break; 997 if (opt == IPOPT_NOP) { 998 /* Preserve for IP mcast tunnel's LSRR alignment. */ 999 *dp++ = IPOPT_NOP; 1000 optlen = 1; 1001 continue; 1002 } 1003 #ifdef DIAGNOSTIC 1004 if (cnt < IPOPT_OLEN + sizeof(*cp)) 1005 panic("malformed IPv4 option passed to ip_optcopy"); 1006 #endif 1007 optlen = cp[IPOPT_OLEN]; 1008 #ifdef DIAGNOSTIC 1009 if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) 1010 panic("malformed IPv4 option passed to ip_optcopy"); 1011 #endif 1012 /* bogus lengths should have been caught by ip_dooptions */ 1013 if (optlen > cnt) 1014 optlen = cnt; 1015 if (IPOPT_COPIED(opt)) { 1016 bcopy((void *)cp, (void *)dp, (unsigned)optlen); 1017 dp += optlen; 1018 } 1019 } 1020 for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++) 1021 *dp++ = IPOPT_EOL; 1022 return (optlen); 1023 } 1024 1025 /* 1026 * IP socket option processing. 1027 */ 1028 int 1029 ip_ctloutput(int op, struct socket *so, struct sockopt *sopt) 1030 { 1031 struct inpcb *inp = sotoinpcb(so); 1032 int optval = 0; 1033 int error = 0; 1034 #if defined(FAST_IPSEC) 1035 struct lwp *l = curlwp; /*XXX*/ 1036 #endif 1037 1038 if (sopt->sopt_level != IPPROTO_IP) { 1039 if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_NOHEADER) 1040 return 0; 1041 return ENOPROTOOPT; 1042 } 1043 1044 switch (op) { 1045 case PRCO_SETOPT: 1046 switch (sopt->sopt_name) { 1047 case IP_OPTIONS: 1048 #ifdef notyet 1049 case IP_RETOPTS: 1050 #endif 1051 error = ip_pcbopts(&inp->inp_options, sopt); 1052 break; 1053 1054 case IP_TOS: 1055 case IP_TTL: 1056 case IP_MINTTL: 1057 case IP_RECVOPTS: 1058 case IP_RECVRETOPTS: 1059 case IP_RECVDSTADDR: 1060 case IP_RECVIF: 1061 case IP_RECVTTL: 1062 error = sockopt_getint(sopt, &optval); 1063 if (error) 1064 break; 1065 1066 switch (sopt->sopt_name) { 1067 case IP_TOS: 1068 inp->inp_ip.ip_tos = optval; 1069 break; 1070 1071 case IP_TTL: 1072 inp->inp_ip.ip_ttl = optval; 1073 break; 1074 1075 case IP_MINTTL: 1076 if (optval > 0 && optval <= MAXTTL) 1077 inp->inp_ip_minttl = optval; 1078 else 1079 error = EINVAL; 1080 break; 1081 #define OPTSET(bit) \ 1082 if (optval) \ 1083 inp->inp_flags |= bit; \ 1084 else \ 1085 inp->inp_flags &= ~bit; 1086 1087 case IP_RECVOPTS: 1088 OPTSET(INP_RECVOPTS); 1089 break; 1090 1091 case IP_RECVRETOPTS: 1092 OPTSET(INP_RECVRETOPTS); 1093 break; 1094 1095 case IP_RECVDSTADDR: 1096 OPTSET(INP_RECVDSTADDR); 1097 break; 1098 1099 case IP_RECVIF: 1100 OPTSET(INP_RECVIF); 1101 break; 1102 1103 case IP_RECVTTL: 1104 OPTSET(INP_RECVTTL); 1105 break; 1106 } 1107 break; 1108 #undef OPTSET 1109 1110 case IP_MULTICAST_IF: 1111 case IP_MULTICAST_TTL: 1112 case IP_MULTICAST_LOOP: 1113 case IP_ADD_MEMBERSHIP: 1114 case IP_DROP_MEMBERSHIP: 1115 error = ip_setmoptions(&inp->inp_moptions, sopt); 1116 break; 1117 1118 case IP_PORTRANGE: 1119 error = sockopt_getint(sopt, &optval); 1120 if (error) 1121 break; 1122 1123 /* INP_LOCK(inp); */ 1124 switch (optval) { 1125 case IP_PORTRANGE_DEFAULT: 1126 case IP_PORTRANGE_HIGH: 1127 inp->inp_flags &= ~(INP_LOWPORT); 1128 break; 1129 1130 case IP_PORTRANGE_LOW: 1131 inp->inp_flags |= INP_LOWPORT; 1132 break; 1133 1134 default: 1135 error = EINVAL; 1136 break; 1137 } 1138 /* INP_UNLOCK(inp); */ 1139 break; 1140 1141 case IP_PORTALGO: 1142 error = sockopt_getint(sopt, &optval); 1143 if (error) 1144 break; 1145 1146 error = portalgo_algo_index_select( 1147 (struct inpcb_hdr *)inp, optval); 1148 break; 1149 1150 #if defined(FAST_IPSEC) 1151 case IP_IPSEC_POLICY: 1152 error = ipsec4_set_policy(inp, sopt->sopt_name, 1153 sopt->sopt_data, sopt->sopt_size, l->l_cred); 1154 break; 1155 #endif /*IPSEC*/ 1156 1157 default: 1158 error = ENOPROTOOPT; 1159 break; 1160 } 1161 break; 1162 1163 case PRCO_GETOPT: 1164 switch (sopt->sopt_name) { 1165 case IP_OPTIONS: 1166 case IP_RETOPTS: 1167 if (inp->inp_options) { 1168 struct mbuf *m; 1169 1170 m = m_copym(inp->inp_options, 0, M_COPYALL, 1171 M_DONTWAIT); 1172 if (m == NULL) { 1173 error = ENOBUFS; 1174 break; 1175 } 1176 1177 error = sockopt_setmbuf(sopt, m); 1178 } 1179 break; 1180 1181 case IP_TOS: 1182 case IP_TTL: 1183 case IP_MINTTL: 1184 case IP_RECVOPTS: 1185 case IP_RECVRETOPTS: 1186 case IP_RECVDSTADDR: 1187 case IP_RECVIF: 1188 case IP_RECVTTL: 1189 case IP_ERRORMTU: 1190 switch (sopt->sopt_name) { 1191 case IP_TOS: 1192 optval = inp->inp_ip.ip_tos; 1193 break; 1194 1195 case IP_TTL: 1196 optval = inp->inp_ip.ip_ttl; 1197 break; 1198 1199 case IP_MINTTL: 1200 optval = inp->inp_ip_minttl; 1201 break; 1202 1203 case IP_ERRORMTU: 1204 optval = inp->inp_errormtu; 1205 break; 1206 1207 #define OPTBIT(bit) (inp->inp_flags & bit ? 1 : 0) 1208 1209 case IP_RECVOPTS: 1210 optval = OPTBIT(INP_RECVOPTS); 1211 break; 1212 1213 case IP_RECVRETOPTS: 1214 optval = OPTBIT(INP_RECVRETOPTS); 1215 break; 1216 1217 case IP_RECVDSTADDR: 1218 optval = OPTBIT(INP_RECVDSTADDR); 1219 break; 1220 1221 case IP_RECVIF: 1222 optval = OPTBIT(INP_RECVIF); 1223 break; 1224 1225 case IP_RECVTTL: 1226 optval = OPTBIT(INP_RECVTTL); 1227 break; 1228 } 1229 error = sockopt_setint(sopt, optval); 1230 break; 1231 1232 #if 0 /* defined(FAST_IPSEC) */ 1233 case IP_IPSEC_POLICY: 1234 { 1235 struct mbuf *m = NULL; 1236 1237 /* XXX this will return EINVAL as sopt is empty */ 1238 error = ipsec4_get_policy(inp, sopt->sopt_data, 1239 sopt->sopt_size, &m); 1240 if (error == 0) 1241 error = sockopt_setmbuf(sopt, m); 1242 break; 1243 } 1244 #endif /*IPSEC*/ 1245 1246 case IP_MULTICAST_IF: 1247 case IP_MULTICAST_TTL: 1248 case IP_MULTICAST_LOOP: 1249 case IP_ADD_MEMBERSHIP: 1250 case IP_DROP_MEMBERSHIP: 1251 error = ip_getmoptions(inp->inp_moptions, sopt); 1252 break; 1253 1254 case IP_PORTRANGE: 1255 if (inp->inp_flags & INP_LOWPORT) 1256 optval = IP_PORTRANGE_LOW; 1257 else 1258 optval = IP_PORTRANGE_DEFAULT; 1259 1260 error = sockopt_setint(sopt, optval); 1261 1262 break; 1263 1264 case IP_PORTALGO: 1265 optval = ((struct inpcb_hdr *)inp)->inph_portalgo; 1266 error = sockopt_setint(sopt, optval); 1267 break; 1268 1269 default: 1270 error = ENOPROTOOPT; 1271 break; 1272 } 1273 break; 1274 } 1275 return (error); 1276 } 1277 1278 /* 1279 * Set up IP options in pcb for insertion in output packets. 1280 * Store in mbuf with pointer in pcbopt, adding pseudo-option 1281 * with destination address if source routed. 1282 */ 1283 int 1284 ip_pcbopts(struct mbuf **pcbopt, const struct sockopt *sopt) 1285 { 1286 struct mbuf *m; 1287 const u_char *cp; 1288 u_char *dp; 1289 int cnt; 1290 uint8_t optval, olen, offset; 1291 1292 /* turn off any old options */ 1293 if (*pcbopt) 1294 (void)m_free(*pcbopt); 1295 *pcbopt = NULL; 1296 1297 cp = sopt->sopt_data; 1298 cnt = sopt->sopt_size; 1299 1300 if (cnt == 0) 1301 return (0); /* Only turning off any previous options */ 1302 1303 #ifndef __vax__ 1304 if (cnt % sizeof(int32_t)) 1305 return (EINVAL); 1306 #endif 1307 1308 m = m_get(M_DONTWAIT, MT_SOOPTS); 1309 if (m == NULL) 1310 return (ENOBUFS); 1311 1312 dp = mtod(m, u_char *); 1313 memset(dp, 0, sizeof(struct in_addr)); 1314 dp += sizeof(struct in_addr); 1315 m->m_len = sizeof(struct in_addr); 1316 1317 /* 1318 * IP option list according to RFC791. Each option is of the form 1319 * 1320 * [optval] [olen] [(olen - 2) data bytes] 1321 * 1322 * we validate the list and copy options to an mbuf for prepending 1323 * to data packets. The IP first-hop destination address will be 1324 * stored before actual options and is zero if unset. 1325 */ 1326 while (cnt > 0) { 1327 optval = cp[IPOPT_OPTVAL]; 1328 1329 if (optval == IPOPT_EOL || optval == IPOPT_NOP) { 1330 olen = 1; 1331 } else { 1332 if (cnt < IPOPT_OLEN + 1) 1333 goto bad; 1334 1335 olen = cp[IPOPT_OLEN]; 1336 if (olen < IPOPT_OLEN + 1 || olen > cnt) 1337 goto bad; 1338 } 1339 1340 if (optval == IPOPT_LSRR || optval == IPOPT_SSRR) { 1341 /* 1342 * user process specifies route as: 1343 * ->A->B->C->D 1344 * D must be our final destination (but we can't 1345 * check that since we may not have connected yet). 1346 * A is first hop destination, which doesn't appear in 1347 * actual IP option, but is stored before the options. 1348 */ 1349 if (olen < IPOPT_OFFSET + 1 + sizeof(struct in_addr)) 1350 goto bad; 1351 1352 offset = cp[IPOPT_OFFSET]; 1353 memcpy(mtod(m, u_char *), cp + IPOPT_OFFSET + 1, 1354 sizeof(struct in_addr)); 1355 1356 cp += sizeof(struct in_addr); 1357 cnt -= sizeof(struct in_addr); 1358 olen -= sizeof(struct in_addr); 1359 1360 if (m->m_len + olen > MAX_IPOPTLEN + sizeof(struct in_addr)) 1361 goto bad; 1362 1363 memcpy(dp, cp, olen); 1364 dp[IPOPT_OPTVAL] = optval; 1365 dp[IPOPT_OLEN] = olen; 1366 dp[IPOPT_OFFSET] = offset; 1367 break; 1368 } else { 1369 if (m->m_len + olen > MAX_IPOPTLEN + sizeof(struct in_addr)) 1370 goto bad; 1371 1372 memcpy(dp, cp, olen); 1373 break; 1374 } 1375 1376 dp += olen; 1377 m->m_len += olen; 1378 1379 if (optval == IPOPT_EOL) 1380 break; 1381 1382 cp += olen; 1383 cnt -= olen; 1384 } 1385 1386 *pcbopt = m; 1387 return (0); 1388 1389 bad: 1390 (void)m_free(m); 1391 return (EINVAL); 1392 } 1393 1394 /* 1395 * following RFC1724 section 3.3, 0.0.0.0/8 is interpreted as interface index. 1396 */ 1397 static struct ifnet * 1398 ip_multicast_if(struct in_addr *a, int *ifindexp) 1399 { 1400 int ifindex; 1401 struct ifnet *ifp = NULL; 1402 struct in_ifaddr *ia; 1403 1404 if (ifindexp) 1405 *ifindexp = 0; 1406 if (ntohl(a->s_addr) >> 24 == 0) { 1407 ifindex = ntohl(a->s_addr) & 0xffffff; 1408 if (ifindex < 0 || if_indexlim <= ifindex) 1409 return NULL; 1410 ifp = ifindex2ifnet[ifindex]; 1411 if (!ifp) 1412 return NULL; 1413 if (ifindexp) 1414 *ifindexp = ifindex; 1415 } else { 1416 LIST_FOREACH(ia, &IN_IFADDR_HASH(a->s_addr), ia_hash) { 1417 if (in_hosteq(ia->ia_addr.sin_addr, *a) && 1418 (ia->ia_ifp->if_flags & IFF_MULTICAST) != 0) { 1419 ifp = ia->ia_ifp; 1420 break; 1421 } 1422 } 1423 } 1424 return ifp; 1425 } 1426 1427 static int 1428 ip_getoptval(const struct sockopt *sopt, u_int8_t *val, u_int maxval) 1429 { 1430 u_int tval; 1431 u_char cval; 1432 int error; 1433 1434 if (sopt == NULL) 1435 return EINVAL; 1436 1437 switch (sopt->sopt_size) { 1438 case sizeof(u_char): 1439 error = sockopt_get(sopt, &cval, sizeof(u_char)); 1440 tval = cval; 1441 break; 1442 1443 case sizeof(u_int): 1444 error = sockopt_get(sopt, &tval, sizeof(u_int)); 1445 break; 1446 1447 default: 1448 error = EINVAL; 1449 } 1450 1451 if (error) 1452 return error; 1453 1454 if (tval > maxval) 1455 return EINVAL; 1456 1457 *val = tval; 1458 return 0; 1459 } 1460 1461 /* 1462 * Set the IP multicast options in response to user setsockopt(). 1463 */ 1464 int 1465 ip_setmoptions(struct ip_moptions **imop, const struct sockopt *sopt) 1466 { 1467 struct in_addr addr; 1468 struct ip_mreq lmreq, *mreq; 1469 struct ifnet *ifp; 1470 struct ip_moptions *imo = *imop; 1471 int i, ifindex, error = 0; 1472 1473 if (imo == NULL) { 1474 /* 1475 * No multicast option buffer attached to the pcb; 1476 * allocate one and initialize to default values. 1477 */ 1478 imo = kmem_intr_alloc(sizeof(*imo), KM_NOSLEEP); 1479 if (imo == NULL) 1480 return ENOBUFS; 1481 1482 imo->imo_multicast_ifp = NULL; 1483 imo->imo_multicast_addr.s_addr = INADDR_ANY; 1484 imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; 1485 imo->imo_multicast_loop = IP_DEFAULT_MULTICAST_LOOP; 1486 imo->imo_num_memberships = 0; 1487 *imop = imo; 1488 } 1489 1490 switch (sopt->sopt_name) { 1491 case IP_MULTICAST_IF: 1492 /* 1493 * Select the interface for outgoing multicast packets. 1494 */ 1495 error = sockopt_get(sopt, &addr, sizeof(addr)); 1496 if (error) 1497 break; 1498 1499 /* 1500 * INADDR_ANY is used to remove a previous selection. 1501 * When no interface is selected, a default one is 1502 * chosen every time a multicast packet is sent. 1503 */ 1504 if (in_nullhost(addr)) { 1505 imo->imo_multicast_ifp = NULL; 1506 break; 1507 } 1508 /* 1509 * The selected interface is identified by its local 1510 * IP address. Find the interface and confirm that 1511 * it supports multicasting. 1512 */ 1513 ifp = ip_multicast_if(&addr, &ifindex); 1514 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) { 1515 error = EADDRNOTAVAIL; 1516 break; 1517 } 1518 imo->imo_multicast_ifp = ifp; 1519 if (ifindex) 1520 imo->imo_multicast_addr = addr; 1521 else 1522 imo->imo_multicast_addr.s_addr = INADDR_ANY; 1523 break; 1524 1525 case IP_MULTICAST_TTL: 1526 /* 1527 * Set the IP time-to-live for outgoing multicast packets. 1528 */ 1529 error = ip_getoptval(sopt, &imo->imo_multicast_ttl, MAXTTL); 1530 break; 1531 1532 case IP_MULTICAST_LOOP: 1533 /* 1534 * Set the loopback flag for outgoing multicast packets. 1535 * Must be zero or one. 1536 */ 1537 error = ip_getoptval(sopt, &imo->imo_multicast_loop, 1); 1538 break; 1539 1540 case IP_ADD_MEMBERSHIP: 1541 /* 1542 * Add a multicast group membership. 1543 * Group must be a valid IP multicast address. 1544 */ 1545 error = sockopt_get(sopt, &lmreq, sizeof(lmreq)); 1546 if (error) 1547 break; 1548 1549 mreq = &lmreq; 1550 1551 if (!IN_MULTICAST(mreq->imr_multiaddr.s_addr)) { 1552 error = EINVAL; 1553 break; 1554 } 1555 /* 1556 * If no interface address was provided, use the interface of 1557 * the route to the given multicast address. 1558 */ 1559 if (in_nullhost(mreq->imr_interface)) { 1560 struct rtentry *rt; 1561 union { 1562 struct sockaddr dst; 1563 struct sockaddr_in dst4; 1564 } u; 1565 struct route ro; 1566 1567 memset(&ro, 0, sizeof(ro)); 1568 1569 sockaddr_in_init(&u.dst4, &mreq->imr_multiaddr, 0); 1570 rtcache_setdst(&ro, &u.dst); 1571 ifp = (rt = rtcache_init(&ro)) != NULL ? rt->rt_ifp 1572 : NULL; 1573 rtcache_free(&ro); 1574 } else { 1575 ifp = ip_multicast_if(&mreq->imr_interface, NULL); 1576 } 1577 /* 1578 * See if we found an interface, and confirm that it 1579 * supports multicast. 1580 */ 1581 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) { 1582 error = EADDRNOTAVAIL; 1583 break; 1584 } 1585 /* 1586 * See if the membership already exists or if all the 1587 * membership slots are full. 1588 */ 1589 for (i = 0; i < imo->imo_num_memberships; ++i) { 1590 if (imo->imo_membership[i]->inm_ifp == ifp && 1591 in_hosteq(imo->imo_membership[i]->inm_addr, 1592 mreq->imr_multiaddr)) 1593 break; 1594 } 1595 if (i < imo->imo_num_memberships) { 1596 error = EADDRINUSE; 1597 break; 1598 } 1599 if (i == IP_MAX_MEMBERSHIPS) { 1600 error = ETOOMANYREFS; 1601 break; 1602 } 1603 /* 1604 * Everything looks good; add a new record to the multicast 1605 * address list for the given interface. 1606 */ 1607 if ((imo->imo_membership[i] = 1608 in_addmulti(&mreq->imr_multiaddr, ifp)) == NULL) { 1609 error = ENOBUFS; 1610 break; 1611 } 1612 ++imo->imo_num_memberships; 1613 break; 1614 1615 case IP_DROP_MEMBERSHIP: 1616 /* 1617 * Drop a multicast group membership. 1618 * Group must be a valid IP multicast address. 1619 */ 1620 error = sockopt_get(sopt, &lmreq, sizeof(lmreq)); 1621 if (error) 1622 break; 1623 1624 mreq = &lmreq; 1625 1626 if (!IN_MULTICAST(mreq->imr_multiaddr.s_addr)) { 1627 error = EINVAL; 1628 break; 1629 } 1630 /* 1631 * If an interface address was specified, get a pointer 1632 * to its ifnet structure. 1633 */ 1634 if (in_nullhost(mreq->imr_interface)) 1635 ifp = NULL; 1636 else { 1637 ifp = ip_multicast_if(&mreq->imr_interface, NULL); 1638 if (ifp == NULL) { 1639 error = EADDRNOTAVAIL; 1640 break; 1641 } 1642 } 1643 /* 1644 * Find the membership in the membership array. 1645 */ 1646 for (i = 0; i < imo->imo_num_memberships; ++i) { 1647 if ((ifp == NULL || 1648 imo->imo_membership[i]->inm_ifp == ifp) && 1649 in_hosteq(imo->imo_membership[i]->inm_addr, 1650 mreq->imr_multiaddr)) 1651 break; 1652 } 1653 if (i == imo->imo_num_memberships) { 1654 error = EADDRNOTAVAIL; 1655 break; 1656 } 1657 /* 1658 * Give up the multicast address record to which the 1659 * membership points. 1660 */ 1661 in_delmulti(imo->imo_membership[i]); 1662 /* 1663 * Remove the gap in the membership array. 1664 */ 1665 for (++i; i < imo->imo_num_memberships; ++i) 1666 imo->imo_membership[i-1] = imo->imo_membership[i]; 1667 --imo->imo_num_memberships; 1668 break; 1669 1670 default: 1671 error = EOPNOTSUPP; 1672 break; 1673 } 1674 1675 /* 1676 * If all options have default values, no need to keep the mbuf. 1677 */ 1678 if (imo->imo_multicast_ifp == NULL && 1679 imo->imo_multicast_ttl == IP_DEFAULT_MULTICAST_TTL && 1680 imo->imo_multicast_loop == IP_DEFAULT_MULTICAST_LOOP && 1681 imo->imo_num_memberships == 0) { 1682 kmem_free(imo, sizeof(*imo)); 1683 *imop = NULL; 1684 } 1685 1686 return error; 1687 } 1688 1689 /* 1690 * Return the IP multicast options in response to user getsockopt(). 1691 */ 1692 int 1693 ip_getmoptions(struct ip_moptions *imo, struct sockopt *sopt) 1694 { 1695 struct in_addr addr; 1696 struct in_ifaddr *ia; 1697 int error; 1698 uint8_t optval; 1699 1700 error = 0; 1701 1702 switch (sopt->sopt_name) { 1703 case IP_MULTICAST_IF: 1704 if (imo == NULL || imo->imo_multicast_ifp == NULL) 1705 addr = zeroin_addr; 1706 else if (imo->imo_multicast_addr.s_addr) { 1707 /* return the value user has set */ 1708 addr = imo->imo_multicast_addr; 1709 } else { 1710 IFP_TO_IA(imo->imo_multicast_ifp, ia); 1711 addr = ia ? ia->ia_addr.sin_addr : zeroin_addr; 1712 } 1713 error = sockopt_set(sopt, &addr, sizeof(addr)); 1714 break; 1715 1716 case IP_MULTICAST_TTL: 1717 optval = imo ? imo->imo_multicast_ttl 1718 : IP_DEFAULT_MULTICAST_TTL; 1719 1720 error = sockopt_set(sopt, &optval, sizeof(optval)); 1721 break; 1722 1723 case IP_MULTICAST_LOOP: 1724 optval = imo ? imo->imo_multicast_loop 1725 : IP_DEFAULT_MULTICAST_LOOP; 1726 1727 error = sockopt_set(sopt, &optval, sizeof(optval)); 1728 break; 1729 1730 default: 1731 error = EOPNOTSUPP; 1732 } 1733 1734 return (error); 1735 } 1736 1737 /* 1738 * Discard the IP multicast options. 1739 */ 1740 void 1741 ip_freemoptions(struct ip_moptions *imo) 1742 { 1743 int i; 1744 1745 if (imo != NULL) { 1746 for (i = 0; i < imo->imo_num_memberships; ++i) 1747 in_delmulti(imo->imo_membership[i]); 1748 kmem_free(imo, sizeof(*imo)); 1749 } 1750 } 1751 1752 /* 1753 * Routine called from ip_output() to loop back a copy of an IP multicast 1754 * packet to the input queue of a specified interface. Note that this 1755 * calls the output routine of the loopback "driver", but with an interface 1756 * pointer that might NOT be lo0ifp -- easier than replicating that code here. 1757 */ 1758 static void 1759 ip_mloopback(struct ifnet *ifp, struct mbuf *m, const struct sockaddr_in *dst) 1760 { 1761 struct ip *ip; 1762 struct mbuf *copym; 1763 1764 copym = m_copypacket(m, M_DONTWAIT); 1765 if (copym != NULL 1766 && (copym->m_flags & M_EXT || copym->m_len < sizeof(struct ip))) 1767 copym = m_pullup(copym, sizeof(struct ip)); 1768 if (copym == NULL) 1769 return; 1770 /* 1771 * We don't bother to fragment if the IP length is greater 1772 * than the interface's MTU. Can this possibly matter? 1773 */ 1774 ip = mtod(copym, struct ip *); 1775 1776 if (copym->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 1777 in_delayed_cksum(copym); 1778 copym->m_pkthdr.csum_flags &= 1779 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 1780 } 1781 1782 ip->ip_sum = 0; 1783 ip->ip_sum = in_cksum(copym, ip->ip_hl << 2); 1784 (void)looutput(ifp, copym, sintocsa(dst), NULL); 1785 } 1786
Indexes created Wed Oct 01 19:09:53 GMT 2025