ip_output.c revision 1.233.2.2
1 /* $NetBSD: ip_output.c,v 1.233.2.2 2015/06/06 14:40:25 skrll Exp $ */ 2 3 /* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /*- 33 * Copyright (c) 1998 The NetBSD Foundation, Inc. 34 * All rights reserved. 35 * 36 * This code is derived from software contributed to The NetBSD Foundation 37 * by Public Access Networks Corporation ("Panix"). It was developed under 38 * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon. 39 * 40 * Redistribution and use in source and binary forms, with or without 41 * modification, are permitted provided that the following conditions 42 * are met: 43 * 1. Redistributions of source code must retain the above copyright 44 * notice, this list of conditions and the following disclaimer. 45 * 2. Redistributions in binary form must reproduce the above copyright 46 * notice, this list of conditions and the following disclaimer in the 47 * documentation and/or other materials provided with the distribution. 48 * 49 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 50 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 51 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 52 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 53 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 54 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 55 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 56 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 57 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 58 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 59 * POSSIBILITY OF SUCH DAMAGE. 60 */ 61 62 /* 63 * Copyright (c) 1982, 1986, 1988, 1990, 1993 64 * The Regents of the University of California. All rights reserved. 65 * 66 * Redistribution and use in source and binary forms, with or without 67 * modification, are permitted provided that the following conditions 68 * are met: 69 * 1. Redistributions of source code must retain the above copyright 70 * notice, this list of conditions and the following disclaimer. 71 * 2. Redistributions in binary form must reproduce the above copyright 72 * notice, this list of conditions and the following disclaimer in the 73 * documentation and/or other materials provided with the distribution. 74 * 3. Neither the name of the University nor the names of its contributors 75 * may be used to endorse or promote products derived from this software 76 * without specific prior written permission. 77 * 78 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 79 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 80 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 81 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 82 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 83 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 84 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 85 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 86 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 87 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 88 * SUCH DAMAGE. 89 * 90 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94 91 */ 92 93 #include <sys/cdefs.h> 94 __KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.233.2.2 2015/06/06 14:40:25 skrll Exp $"); 95 96 #include "opt_inet.h" 97 #include "opt_ipsec.h" 98 #include "opt_mrouting.h" 99 #include "opt_net_mpsafe.h" 100 #include "opt_mpls.h" 101 102 #include <sys/param.h> 103 #include <sys/kmem.h> 104 #include <sys/mbuf.h> 105 #include <sys/protosw.h> 106 #include <sys/socket.h> 107 #include <sys/socketvar.h> 108 #include <sys/kauth.h> 109 #ifdef IPSEC 110 #include <sys/domain.h> 111 #endif 112 #include <sys/systm.h> 113 114 #include <net/if.h> 115 #include <net/if_types.h> 116 #include <net/route.h> 117 #include <net/pfil.h> 118 119 #include <netinet/in.h> 120 #include <netinet/in_systm.h> 121 #include <netinet/ip.h> 122 #include <netinet/in_pcb.h> 123 #include <netinet/in_var.h> 124 #include <netinet/ip_var.h> 125 #include <netinet/ip_private.h> 126 #include <netinet/in_offload.h> 127 #include <netinet/portalgo.h> 128 #include <netinet/udp.h> 129 130 #ifdef INET6 131 #include <netinet6/ip6_var.h> 132 #endif 133 134 #ifdef MROUTING 135 #include <netinet/ip_mroute.h> 136 #endif 137 138 #ifdef IPSEC 139 #include <netipsec/ipsec.h> 140 #include <netipsec/key.h> 141 #endif 142 143 #ifdef MPLS 144 #include <netmpls/mpls.h> 145 #include <netmpls/mpls_var.h> 146 #endif 147 148 static int ip_pcbopts(struct inpcb *, const struct sockopt *); 149 static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *); 150 static struct ifnet *ip_multicast_if(struct in_addr *, int *); 151 static void ip_mloopback(struct ifnet *, struct mbuf *, 152 const struct sockaddr_in *); 153 154 extern pfil_head_t *inet_pfil_hook; /* XXX */ 155 156 int ip_do_loopback_cksum = 0; 157 158 static bool 159 ip_hresolv_needed(const struct ifnet * const ifp) 160 { 161 switch (ifp->if_type) { 162 case IFT_ARCNET: 163 case IFT_ATM: 164 case IFT_ECONET: 165 case IFT_ETHER: 166 case IFT_FDDI: 167 case IFT_HIPPI: 168 case IFT_IEEE1394: 169 return true; 170 default: 171 return false; 172 } 173 } 174 175 static int 176 klock_if_output(struct ifnet * const ifp, struct mbuf * const m, 177 const struct sockaddr * const dst, struct rtentry *rt) 178 { 179 int error; 180 181 #ifndef NET_MPSAFE 182 KERNEL_LOCK(1, NULL); 183 #endif 184 185 error = (*ifp->if_output)(ifp, m, dst, rt); 186 187 #ifndef NET_MPSAFE 188 KERNEL_UNLOCK_ONE(NULL); 189 #endif 190 191 return error; 192 } 193 194 /* 195 * Send an IP packet to a host. 196 * 197 * If necessary, resolve the arbitrary IP route, rt0, to an IP host route before 198 * calling ifp's output routine. 199 */ 200 int 201 ip_hresolv_output(struct ifnet * const ifp0, struct mbuf * const m, 202 const struct sockaddr * const dst, struct rtentry *rt0) 203 { 204 int error = 0; 205 struct ifnet *ifp = ifp0; 206 struct rtentry *rt; 207 208 retry: 209 if (!ip_hresolv_needed(ifp)) { 210 rt = rt0; 211 goto out; 212 } 213 214 if (rt0 == NULL) { 215 rt = NULL; 216 goto out; 217 } 218 219 rt = rt0; 220 221 /* 222 * The following block is highly questionable. How did we get here 223 * with a !RTF_UP route? Does rtalloc1() always return an RTF_UP 224 * route? 225 */ 226 if ((rt->rt_flags & RTF_UP) == 0) { 227 rt = rtalloc1(dst, 1); 228 if (rt == NULL) { 229 error = EHOSTUNREACH; 230 goto bad; 231 } 232 rt0 = rt; 233 rt->rt_refcnt--; 234 if (rt->rt_ifp != ifp) { 235 ifp = rt->rt_ifp; 236 rt0 = rt; 237 goto retry; 238 } 239 } 240 241 if ((rt->rt_flags & RTF_GATEWAY) == 0) 242 goto out; 243 244 rt = rt->rt_gwroute; 245 if (rt == NULL || (rt->rt_flags & RTF_UP) == 0) { 246 if (rt != NULL) { 247 rtfree(rt); 248 rt = rt0; 249 } 250 if (rt == NULL) { 251 error = EHOSTUNREACH; 252 goto bad; 253 } 254 rt = rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1); 255 if (rt == NULL) { 256 error = EHOSTUNREACH; 257 goto bad; 258 } 259 /* the "G" test below also prevents rt == rt0 */ 260 if ((rt->rt_flags & RTF_GATEWAY) != 0 || rt->rt_ifp != ifp) { 261 rt->rt_refcnt--; 262 rt0->rt_gwroute = NULL; 263 error = EHOSTUNREACH; 264 goto bad; 265 } 266 } 267 if ((rt->rt_flags & RTF_REJECT) != 0) { 268 if (rt->rt_rmx.rmx_expire == 0 || 269 time_second < rt->rt_rmx.rmx_expire) { 270 error = (rt == rt0) ? EHOSTDOWN : EHOSTUNREACH; 271 goto bad; 272 } 273 } 274 275 out: 276 #ifdef MPLS 277 if (rt0 != NULL && rt_gettag(rt0) != NULL && 278 rt_gettag(rt0)->sa_family == AF_MPLS && 279 (m->m_flags & (M_MCAST | M_BCAST)) == 0 && 280 ifp->if_type == IFT_ETHER) { 281 union mpls_shim msh; 282 msh.s_addr = MPLS_GETSADDR(rt0); 283 if (msh.shim.label != MPLS_LABEL_IMPLNULL) { 284 struct m_tag *mtag; 285 /* 286 * XXX tentative solution to tell ether_output 287 * it's MPLS. Need some more efficient solution. 288 */ 289 mtag = m_tag_get(PACKET_TAG_MPLS, 290 sizeof(int) /* dummy */, 291 M_NOWAIT); 292 if (mtag == NULL) { 293 error = ENOMEM; 294 goto bad; 295 } 296 m_tag_prepend(m, mtag); 297 } 298 } 299 #endif 300 301 return klock_if_output(ifp, m, dst, rt); 302 bad: 303 if (m != NULL) 304 m_freem(m); 305 306 return error; 307 } 308 309 /* 310 * IP output. The packet in mbuf chain m contains a skeletal IP 311 * header (with len, off, ttl, proto, tos, src, dst). 312 * The mbuf chain containing the packet will be freed. 313 * The mbuf opt, if present, will not be freed. 314 */ 315 int 316 ip_output(struct mbuf *m0, ...) 317 { 318 struct rtentry *rt; 319 struct ip *ip; 320 struct ifnet *ifp; 321 struct mbuf *m = m0; 322 int hlen = sizeof (struct ip); 323 int len, error = 0; 324 struct route iproute; 325 const struct sockaddr_in *dst; 326 struct in_ifaddr *ia; 327 int isbroadcast; 328 struct mbuf *opt; 329 struct route *ro; 330 int flags, sw_csum; 331 u_long mtu; 332 struct ip_moptions *imo; 333 struct socket *so; 334 va_list ap; 335 #ifdef IPSEC 336 struct secpolicy *sp = NULL; 337 #endif 338 bool natt_frag = false; 339 bool rtmtu_nolock; 340 union { 341 struct sockaddr dst; 342 struct sockaddr_in dst4; 343 } u; 344 struct sockaddr *rdst = &u.dst; /* real IP destination, as opposed 345 * to the nexthop 346 */ 347 348 len = 0; 349 va_start(ap, m0); 350 opt = va_arg(ap, struct mbuf *); 351 ro = va_arg(ap, struct route *); 352 flags = va_arg(ap, int); 353 imo = va_arg(ap, struct ip_moptions *); 354 so = va_arg(ap, struct socket *); 355 va_end(ap); 356 357 MCLAIM(m, &ip_tx_mowner); 358 359 KASSERT((m->m_flags & M_PKTHDR) != 0); 360 KASSERT((m->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) == 0); 361 KASSERT((m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) != 362 (M_CSUM_TCPv4|M_CSUM_UDPv4)); 363 364 if (opt) { 365 m = ip_insertoptions(m, opt, &len); 366 if (len >= sizeof(struct ip)) 367 hlen = len; 368 } 369 ip = mtod(m, struct ip *); 370 371 /* 372 * Fill in IP header. 373 */ 374 if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) { 375 ip->ip_v = IPVERSION; 376 ip->ip_off = htons(0); 377 /* ip->ip_id filled in after we find out source ia */ 378 ip->ip_hl = hlen >> 2; 379 IP_STATINC(IP_STAT_LOCALOUT); 380 } else { 381 hlen = ip->ip_hl << 2; 382 } 383 384 /* 385 * Route packet. 386 */ 387 if (ro == NULL) { 388 memset(&iproute, 0, sizeof(iproute)); 389 ro = &iproute; 390 } 391 sockaddr_in_init(&u.dst4, &ip->ip_dst, 0); 392 dst = satocsin(rtcache_getdst(ro)); 393 394 /* 395 * If there is a cached route, check that it is to the same 396 * destination and is still up. If not, free it and try again. 397 * The address family should also be checked in case of sharing 398 * the cache with IPv6. 399 */ 400 if (dst && (dst->sin_family != AF_INET || 401 !in_hosteq(dst->sin_addr, ip->ip_dst))) 402 rtcache_free(ro); 403 404 if ((rt = rtcache_validate(ro)) == NULL && 405 (rt = rtcache_update(ro, 1)) == NULL) { 406 dst = &u.dst4; 407 error = rtcache_setdst(ro, &u.dst); 408 if (error != 0) 409 goto bad; 410 } 411 412 /* 413 * If routing to interface only, short circuit routing lookup. 414 */ 415 if (flags & IP_ROUTETOIF) { 416 if ((ia = ifatoia(ifa_ifwithladdr(sintocsa(dst)))) == NULL) { 417 IP_STATINC(IP_STAT_NOROUTE); 418 error = ENETUNREACH; 419 goto bad; 420 } 421 ifp = ia->ia_ifp; 422 mtu = ifp->if_mtu; 423 ip->ip_ttl = 1; 424 isbroadcast = in_broadcast(dst->sin_addr, ifp); 425 } else if ((IN_MULTICAST(ip->ip_dst.s_addr) || 426 ip->ip_dst.s_addr == INADDR_BROADCAST) && 427 imo != NULL && imo->imo_multicast_ifp != NULL) { 428 ifp = imo->imo_multicast_ifp; 429 mtu = ifp->if_mtu; 430 IFP_TO_IA(ifp, ia); 431 isbroadcast = 0; 432 } else { 433 if (rt == NULL) 434 rt = rtcache_init(ro); 435 if (rt == NULL) { 436 IP_STATINC(IP_STAT_NOROUTE); 437 error = EHOSTUNREACH; 438 goto bad; 439 } 440 ia = ifatoia(rt->rt_ifa); 441 ifp = rt->rt_ifp; 442 if ((mtu = rt->rt_rmx.rmx_mtu) == 0) 443 mtu = ifp->if_mtu; 444 rt->rt_use++; 445 if (rt->rt_flags & RTF_GATEWAY) 446 dst = satosin(rt->rt_gateway); 447 if (rt->rt_flags & RTF_HOST) 448 isbroadcast = rt->rt_flags & RTF_BROADCAST; 449 else 450 isbroadcast = in_broadcast(dst->sin_addr, ifp); 451 } 452 rtmtu_nolock = rt && (rt->rt_rmx.rmx_locks & RTV_MTU) == 0; 453 454 if (IN_MULTICAST(ip->ip_dst.s_addr) || 455 (ip->ip_dst.s_addr == INADDR_BROADCAST)) { 456 bool inmgroup; 457 458 m->m_flags |= (ip->ip_dst.s_addr == INADDR_BROADCAST) ? 459 M_BCAST : M_MCAST; 460 /* 461 * See if the caller provided any multicast options 462 */ 463 if (imo != NULL) 464 ip->ip_ttl = imo->imo_multicast_ttl; 465 else 466 ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL; 467 468 /* 469 * if we don't know the outgoing ifp yet, we can't generate 470 * output 471 */ 472 if (!ifp) { 473 IP_STATINC(IP_STAT_NOROUTE); 474 error = ENETUNREACH; 475 goto bad; 476 } 477 478 /* 479 * If the packet is multicast or broadcast, confirm that 480 * the outgoing interface can transmit it. 481 */ 482 if (((m->m_flags & M_MCAST) && 483 (ifp->if_flags & IFF_MULTICAST) == 0) || 484 ((m->m_flags & M_BCAST) && 485 (ifp->if_flags & (IFF_BROADCAST|IFF_POINTOPOINT)) == 0)) { 486 IP_STATINC(IP_STAT_NOROUTE); 487 error = ENETUNREACH; 488 goto bad; 489 } 490 /* 491 * If source address not specified yet, use an address 492 * of outgoing interface. 493 */ 494 if (in_nullhost(ip->ip_src)) { 495 struct in_ifaddr *xia; 496 struct ifaddr *xifa; 497 498 IFP_TO_IA(ifp, xia); 499 if (!xia) { 500 error = EADDRNOTAVAIL; 501 goto bad; 502 } 503 xifa = &xia->ia_ifa; 504 if (xifa->ifa_getifa != NULL) { 505 xia = ifatoia((*xifa->ifa_getifa)(xifa, rdst)); 506 } 507 ip->ip_src = xia->ia_addr.sin_addr; 508 } 509 510 inmgroup = in_multi_group(ip->ip_dst, ifp, flags); 511 if (inmgroup && (imo == NULL || imo->imo_multicast_loop)) { 512 /* 513 * If we belong to the destination multicast group 514 * on the outgoing interface, and the caller did not 515 * forbid loopback, loop back a copy. 516 */ 517 ip_mloopback(ifp, m, &u.dst4); 518 } 519 #ifdef MROUTING 520 else { 521 /* 522 * If we are acting as a multicast router, perform 523 * multicast forwarding as if the packet had just 524 * arrived on the interface to which we are about 525 * to send. The multicast forwarding function 526 * recursively calls this function, using the 527 * IP_FORWARDING flag to prevent infinite recursion. 528 * 529 * Multicasts that are looped back by ip_mloopback(), 530 * above, will be forwarded by the ip_input() routine, 531 * if necessary. 532 */ 533 extern struct socket *ip_mrouter; 534 535 if (ip_mrouter && (flags & IP_FORWARDING) == 0) { 536 if (ip_mforward(m, ifp) != 0) { 537 m_freem(m); 538 goto done; 539 } 540 } 541 } 542 #endif 543 /* 544 * Multicasts with a time-to-live of zero may be looped- 545 * back, above, but must not be transmitted on a network. 546 * Also, multicasts addressed to the loopback interface 547 * are not sent -- the above call to ip_mloopback() will 548 * loop back a copy if this host actually belongs to the 549 * destination group on the loopback interface. 550 */ 551 if (ip->ip_ttl == 0 || (ifp->if_flags & IFF_LOOPBACK) != 0) { 552 m_freem(m); 553 goto done; 554 } 555 goto sendit; 556 } 557 558 /* 559 * If source address not specified yet, use address 560 * of outgoing interface. 561 */ 562 if (in_nullhost(ip->ip_src)) { 563 struct ifaddr *xifa; 564 565 xifa = &ia->ia_ifa; 566 if (xifa->ifa_getifa != NULL) 567 ia = ifatoia((*xifa->ifa_getifa)(xifa, rdst)); 568 ip->ip_src = ia->ia_addr.sin_addr; 569 } 570 571 /* 572 * packets with Class-D address as source are not valid per 573 * RFC 1112 574 */ 575 if (IN_MULTICAST(ip->ip_src.s_addr)) { 576 IP_STATINC(IP_STAT_ODROPPED); 577 error = EADDRNOTAVAIL; 578 goto bad; 579 } 580 581 /* 582 * Look for broadcast address and and verify user is allowed to 583 * send such a packet. 584 */ 585 if (isbroadcast) { 586 if ((ifp->if_flags & IFF_BROADCAST) == 0) { 587 error = EADDRNOTAVAIL; 588 goto bad; 589 } 590 if ((flags & IP_ALLOWBROADCAST) == 0) { 591 error = EACCES; 592 goto bad; 593 } 594 /* don't allow broadcast messages to be fragmented */ 595 if (ntohs(ip->ip_len) > ifp->if_mtu) { 596 error = EMSGSIZE; 597 goto bad; 598 } 599 m->m_flags |= M_BCAST; 600 } else 601 m->m_flags &= ~M_BCAST; 602 603 sendit: 604 if ((flags & (IP_FORWARDING|IP_NOIPNEWID)) == 0) { 605 if (m->m_pkthdr.len < IP_MINFRAGSIZE) { 606 ip->ip_id = 0; 607 } else if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0) { 608 ip->ip_id = ip_newid(ia); 609 } else { 610 611 /* 612 * TSO capable interfaces (typically?) increment 613 * ip_id for each segment. 614 * "allocate" enough ids here to increase the chance 615 * for them to be unique. 616 * 617 * note that the following calculation is not 618 * needed to be precise. wasting some ip_id is fine. 619 */ 620 621 unsigned int segsz = m->m_pkthdr.segsz; 622 unsigned int datasz = ntohs(ip->ip_len) - hlen; 623 unsigned int num = howmany(datasz, segsz); 624 625 ip->ip_id = ip_newid_range(ia, num); 626 } 627 } 628 629 /* 630 * If we're doing Path MTU Discovery, we need to set DF unless 631 * the route's MTU is locked. 632 */ 633 if ((flags & IP_MTUDISC) != 0 && rtmtu_nolock) { 634 ip->ip_off |= htons(IP_DF); 635 } 636 637 #ifdef IPSEC 638 if (ipsec_used) { 639 bool ipsec_done = false; 640 641 /* Perform IPsec processing, if any. */ 642 error = ipsec4_output(m, so, flags, &sp, &mtu, &natt_frag, 643 &ipsec_done); 644 if (error || ipsec_done) 645 goto done; 646 } 647 #endif 648 649 /* 650 * Run through list of hooks for output packets. 651 */ 652 error = pfil_run_hooks(inet_pfil_hook, &m, ifp, PFIL_OUT); 653 if (error) 654 goto done; 655 if (m == NULL) 656 goto done; 657 658 ip = mtod(m, struct ip *); 659 hlen = ip->ip_hl << 2; 660 661 m->m_pkthdr.csum_data |= hlen << 16; 662 663 #if IFA_STATS 664 /* 665 * search for the source address structure to 666 * maintain output statistics. 667 */ 668 INADDR_TO_IA(ip->ip_src, ia); 669 #endif 670 671 /* Maybe skip checksums on loopback interfaces. */ 672 if (IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) { 673 m->m_pkthdr.csum_flags |= M_CSUM_IPv4; 674 } 675 sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_csum_flags_tx; 676 /* 677 * If small enough for mtu of path, or if using TCP segmentation 678 * offload, can just send directly. 679 */ 680 if (ntohs(ip->ip_len) <= mtu || 681 (m->m_pkthdr.csum_flags & M_CSUM_TSOv4) != 0) { 682 const struct sockaddr *sa; 683 684 #if IFA_STATS 685 if (ia) 686 ia->ia_ifa.ifa_data.ifad_outbytes += ntohs(ip->ip_len); 687 #endif 688 /* 689 * Always initialize the sum to 0! Some HW assisted 690 * checksumming requires this. 691 */ 692 ip->ip_sum = 0; 693 694 if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0) { 695 /* 696 * Perform any checksums that the hardware can't do 697 * for us. 698 * 699 * XXX Does any hardware require the {th,uh}_sum 700 * XXX fields to be 0? 701 */ 702 if (sw_csum & M_CSUM_IPv4) { 703 KASSERT(IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)); 704 ip->ip_sum = in_cksum(m, hlen); 705 m->m_pkthdr.csum_flags &= ~M_CSUM_IPv4; 706 } 707 if (sw_csum & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 708 if (IN_NEED_CHECKSUM(ifp, 709 sw_csum & (M_CSUM_TCPv4|M_CSUM_UDPv4))) { 710 in_delayed_cksum(m); 711 } 712 m->m_pkthdr.csum_flags &= 713 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 714 } 715 } 716 717 sa = (m->m_flags & M_MCAST) ? sintocsa(rdst) : sintocsa(dst); 718 if (__predict_true( 719 (m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0 || 720 (ifp->if_capenable & IFCAP_TSOv4) != 0)) { 721 error = ip_hresolv_output(ifp, m, sa, rt); 722 } else { 723 error = ip_tso_output(ifp, m, sa, rt); 724 } 725 goto done; 726 } 727 728 /* 729 * We can't use HW checksumming if we're about to 730 * to fragment the packet. 731 * 732 * XXX Some hardware can do this. 733 */ 734 if (m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 735 if (IN_NEED_CHECKSUM(ifp, 736 m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4))) { 737 in_delayed_cksum(m); 738 } 739 m->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 740 } 741 742 /* 743 * Too large for interface; fragment if possible. 744 * Must be able to put at least 8 bytes per fragment. 745 */ 746 if (ntohs(ip->ip_off) & IP_DF) { 747 if (flags & IP_RETURNMTU) { 748 struct inpcb *inp; 749 750 KASSERT(so && solocked(so)); 751 inp = sotoinpcb(so); 752 inp->inp_errormtu = mtu; 753 } 754 error = EMSGSIZE; 755 IP_STATINC(IP_STAT_CANTFRAG); 756 goto bad; 757 } 758 759 error = ip_fragment(m, ifp, mtu); 760 if (error) { 761 m = NULL; 762 goto bad; 763 } 764 765 for (; m; m = m0) { 766 m0 = m->m_nextpkt; 767 m->m_nextpkt = 0; 768 if (error) { 769 m_freem(m); 770 continue; 771 } 772 #if IFA_STATS 773 if (ia) 774 ia->ia_ifa.ifa_data.ifad_outbytes += ntohs(ip->ip_len); 775 #endif 776 /* 777 * If we get there, the packet has not been handled by 778 * IPsec whereas it should have. Now that it has been 779 * fragmented, re-inject it in ip_output so that IPsec 780 * processing can occur. 781 */ 782 if (natt_frag) { 783 error = ip_output(m, opt, ro, 784 flags | IP_RAWOUTPUT | IP_NOIPNEWID, 785 imo, so); 786 } else { 787 KASSERT((m->m_pkthdr.csum_flags & 788 (M_CSUM_UDPv4 | M_CSUM_TCPv4)) == 0); 789 error = ip_hresolv_output(ifp, m, 790 (m->m_flags & M_MCAST) ? 791 sintocsa(rdst) : sintocsa(dst), rt); 792 } 793 } 794 if (error == 0) { 795 IP_STATINC(IP_STAT_FRAGMENTED); 796 } 797 done: 798 if (ro == &iproute) { 799 rtcache_free(&iproute); 800 } 801 #ifdef IPSEC 802 if (sp) { 803 KEY_FREESP(&sp); 804 } 805 #endif 806 return error; 807 bad: 808 m_freem(m); 809 goto done; 810 } 811 812 int 813 ip_fragment(struct mbuf *m, struct ifnet *ifp, u_long mtu) 814 { 815 struct ip *ip, *mhip; 816 struct mbuf *m0; 817 int len, hlen, off; 818 int mhlen, firstlen; 819 struct mbuf **mnext; 820 int sw_csum = m->m_pkthdr.csum_flags; 821 int fragments = 0; 822 int s; 823 int error = 0; 824 825 ip = mtod(m, struct ip *); 826 hlen = ip->ip_hl << 2; 827 if (ifp != NULL) 828 sw_csum &= ~ifp->if_csum_flags_tx; 829 830 len = (mtu - hlen) &~ 7; 831 if (len < 8) { 832 m_freem(m); 833 return (EMSGSIZE); 834 } 835 836 firstlen = len; 837 mnext = &m->m_nextpkt; 838 839 /* 840 * Loop through length of segment after first fragment, 841 * make new header and copy data of each part and link onto chain. 842 */ 843 m0 = m; 844 mhlen = sizeof (struct ip); 845 for (off = hlen + len; off < ntohs(ip->ip_len); off += len) { 846 MGETHDR(m, M_DONTWAIT, MT_HEADER); 847 if (m == 0) { 848 error = ENOBUFS; 849 IP_STATINC(IP_STAT_ODROPPED); 850 goto sendorfree; 851 } 852 MCLAIM(m, m0->m_owner); 853 *mnext = m; 854 mnext = &m->m_nextpkt; 855 m->m_data += max_linkhdr; 856 mhip = mtod(m, struct ip *); 857 *mhip = *ip; 858 /* we must inherit MCAST and BCAST flags */ 859 m->m_flags |= m0->m_flags & (M_MCAST|M_BCAST); 860 if (hlen > sizeof (struct ip)) { 861 mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip); 862 mhip->ip_hl = mhlen >> 2; 863 } 864 m->m_len = mhlen; 865 mhip->ip_off = ((off - hlen) >> 3) + 866 (ntohs(ip->ip_off) & ~IP_MF); 867 if (ip->ip_off & htons(IP_MF)) 868 mhip->ip_off |= IP_MF; 869 if (off + len >= ntohs(ip->ip_len)) 870 len = ntohs(ip->ip_len) - off; 871 else 872 mhip->ip_off |= IP_MF; 873 HTONS(mhip->ip_off); 874 mhip->ip_len = htons((u_int16_t)(len + mhlen)); 875 m->m_next = m_copym(m0, off, len, M_DONTWAIT); 876 if (m->m_next == 0) { 877 error = ENOBUFS; /* ??? */ 878 IP_STATINC(IP_STAT_ODROPPED); 879 goto sendorfree; 880 } 881 m->m_pkthdr.len = mhlen + len; 882 m->m_pkthdr.rcvif = NULL; 883 mhip->ip_sum = 0; 884 KASSERT((m->m_pkthdr.csum_flags & M_CSUM_IPv4) == 0); 885 if (sw_csum & M_CSUM_IPv4) { 886 mhip->ip_sum = in_cksum(m, mhlen); 887 } else { 888 /* 889 * checksum is hw-offloaded or not necessary. 890 */ 891 m->m_pkthdr.csum_flags |= 892 m0->m_pkthdr.csum_flags & M_CSUM_IPv4; 893 m->m_pkthdr.csum_data |= mhlen << 16; 894 KASSERT(!(ifp != NULL && 895 IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) || 896 (m->m_pkthdr.csum_flags & M_CSUM_IPv4) != 0); 897 } 898 IP_STATINC(IP_STAT_OFRAGMENTS); 899 fragments++; 900 } 901 /* 902 * Update first fragment by trimming what's been copied out 903 * and updating header, then send each fragment (in order). 904 */ 905 m = m0; 906 m_adj(m, hlen + firstlen - ntohs(ip->ip_len)); 907 m->m_pkthdr.len = hlen + firstlen; 908 ip->ip_len = htons((u_int16_t)m->m_pkthdr.len); 909 ip->ip_off |= htons(IP_MF); 910 ip->ip_sum = 0; 911 if (sw_csum & M_CSUM_IPv4) { 912 ip->ip_sum = in_cksum(m, hlen); 913 m->m_pkthdr.csum_flags &= ~M_CSUM_IPv4; 914 } else { 915 /* 916 * checksum is hw-offloaded or not necessary. 917 */ 918 KASSERT(!(ifp != NULL && IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) || 919 (m->m_pkthdr.csum_flags & M_CSUM_IPv4) != 0); 920 KASSERT(M_CSUM_DATA_IPv4_IPHL(m->m_pkthdr.csum_data) >= 921 sizeof(struct ip)); 922 } 923 sendorfree: 924 /* 925 * If there is no room for all the fragments, don't queue 926 * any of them. 927 */ 928 if (ifp != NULL) { 929 s = splnet(); 930 if (ifp->if_snd.ifq_maxlen - ifp->if_snd.ifq_len < fragments && 931 error == 0) { 932 error = ENOBUFS; 933 IP_STATINC(IP_STAT_ODROPPED); 934 IFQ_INC_DROPS(&ifp->if_snd); 935 } 936 splx(s); 937 } 938 if (error) { 939 for (m = m0; m; m = m0) { 940 m0 = m->m_nextpkt; 941 m->m_nextpkt = NULL; 942 m_freem(m); 943 } 944 } 945 return (error); 946 } 947 948 /* 949 * Process a delayed payload checksum calculation. 950 */ 951 void 952 in_delayed_cksum(struct mbuf *m) 953 { 954 struct ip *ip; 955 u_int16_t csum, offset; 956 957 ip = mtod(m, struct ip *); 958 offset = ip->ip_hl << 2; 959 csum = in4_cksum(m, 0, offset, ntohs(ip->ip_len) - offset); 960 if (csum == 0 && (m->m_pkthdr.csum_flags & M_CSUM_UDPv4) != 0) 961 csum = 0xffff; 962 963 offset += M_CSUM_DATA_IPv4_OFFSET(m->m_pkthdr.csum_data); 964 965 if ((offset + sizeof(u_int16_t)) > m->m_len) { 966 /* This happen when ip options were inserted 967 printf("in_delayed_cksum: pullup len %d off %d proto %d\n", 968 m->m_len, offset, ip->ip_p); 969 */ 970 m_copyback(m, offset, sizeof(csum), (void *) &csum); 971 } else 972 *(u_int16_t *)(mtod(m, char *) + offset) = csum; 973 } 974 975 /* 976 * Determine the maximum length of the options to be inserted; 977 * we would far rather allocate too much space rather than too little. 978 */ 979 980 u_int 981 ip_optlen(struct inpcb *inp) 982 { 983 struct mbuf *m = inp->inp_options; 984 985 if (m && m->m_len > offsetof(struct ipoption, ipopt_dst)) { 986 return (m->m_len - offsetof(struct ipoption, ipopt_dst)); 987 } 988 return 0; 989 } 990 991 /* 992 * Insert IP options into preformed packet. 993 * Adjust IP destination as required for IP source routing, 994 * as indicated by a non-zero in_addr at the start of the options. 995 */ 996 static struct mbuf * 997 ip_insertoptions(struct mbuf *m, struct mbuf *opt, int *phlen) 998 { 999 struct ipoption *p = mtod(opt, struct ipoption *); 1000 struct mbuf *n; 1001 struct ip *ip = mtod(m, struct ip *); 1002 unsigned optlen; 1003 1004 optlen = opt->m_len - sizeof(p->ipopt_dst); 1005 if (optlen + ntohs(ip->ip_len) > IP_MAXPACKET) 1006 return (m); /* XXX should fail */ 1007 if (!in_nullhost(p->ipopt_dst)) 1008 ip->ip_dst = p->ipopt_dst; 1009 if (M_READONLY(m) || M_LEADINGSPACE(m) < optlen) { 1010 MGETHDR(n, M_DONTWAIT, MT_HEADER); 1011 if (n == 0) 1012 return (m); 1013 MCLAIM(n, m->m_owner); 1014 M_MOVE_PKTHDR(n, m); 1015 m->m_len -= sizeof(struct ip); 1016 m->m_data += sizeof(struct ip); 1017 n->m_next = m; 1018 m = n; 1019 m->m_len = optlen + sizeof(struct ip); 1020 m->m_data += max_linkhdr; 1021 bcopy((void *)ip, mtod(m, void *), sizeof(struct ip)); 1022 } else { 1023 m->m_data -= optlen; 1024 m->m_len += optlen; 1025 memmove(mtod(m, void *), ip, sizeof(struct ip)); 1026 } 1027 m->m_pkthdr.len += optlen; 1028 ip = mtod(m, struct ip *); 1029 bcopy((void *)p->ipopt_list, (void *)(ip + 1), (unsigned)optlen); 1030 *phlen = sizeof(struct ip) + optlen; 1031 ip->ip_len = htons(ntohs(ip->ip_len) + optlen); 1032 return (m); 1033 } 1034 1035 /* 1036 * Copy options from ip to jp, 1037 * omitting those not copied during fragmentation. 1038 */ 1039 int 1040 ip_optcopy(struct ip *ip, struct ip *jp) 1041 { 1042 u_char *cp, *dp; 1043 int opt, optlen, cnt; 1044 1045 cp = (u_char *)(ip + 1); 1046 dp = (u_char *)(jp + 1); 1047 cnt = (ip->ip_hl << 2) - sizeof (struct ip); 1048 for (; cnt > 0; cnt -= optlen, cp += optlen) { 1049 opt = cp[0]; 1050 if (opt == IPOPT_EOL) 1051 break; 1052 if (opt == IPOPT_NOP) { 1053 /* Preserve for IP mcast tunnel's LSRR alignment. */ 1054 *dp++ = IPOPT_NOP; 1055 optlen = 1; 1056 continue; 1057 } 1058 1059 KASSERT(cnt >= IPOPT_OLEN + sizeof(*cp)); 1060 optlen = cp[IPOPT_OLEN]; 1061 KASSERT(optlen >= IPOPT_OLEN + sizeof(*cp) && optlen < cnt); 1062 1063 /* Invalid lengths should have been caught by ip_dooptions. */ 1064 if (optlen > cnt) 1065 optlen = cnt; 1066 if (IPOPT_COPIED(opt)) { 1067 bcopy((void *)cp, (void *)dp, (unsigned)optlen); 1068 dp += optlen; 1069 } 1070 } 1071 for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++) 1072 *dp++ = IPOPT_EOL; 1073 return (optlen); 1074 } 1075 1076 /* 1077 * IP socket option processing. 1078 */ 1079 int 1080 ip_ctloutput(int op, struct socket *so, struct sockopt *sopt) 1081 { 1082 struct inpcb *inp = sotoinpcb(so); 1083 struct ip *ip = &inp->inp_ip; 1084 int inpflags = inp->inp_flags; 1085 int optval = 0, error = 0; 1086 1087 if (sopt->sopt_level != IPPROTO_IP) { 1088 if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_NOHEADER) 1089 return 0; 1090 return ENOPROTOOPT; 1091 } 1092 1093 switch (op) { 1094 case PRCO_SETOPT: 1095 switch (sopt->sopt_name) { 1096 case IP_OPTIONS: 1097 #ifdef notyet 1098 case IP_RETOPTS: 1099 #endif 1100 error = ip_pcbopts(inp, sopt); 1101 break; 1102 1103 case IP_TOS: 1104 case IP_TTL: 1105 case IP_MINTTL: 1106 case IP_PKTINFO: 1107 case IP_RECVOPTS: 1108 case IP_RECVRETOPTS: 1109 case IP_RECVDSTADDR: 1110 case IP_RECVIF: 1111 case IP_RECVPKTINFO: 1112 case IP_RECVTTL: 1113 error = sockopt_getint(sopt, &optval); 1114 if (error) 1115 break; 1116 1117 switch (sopt->sopt_name) { 1118 case IP_TOS: 1119 ip->ip_tos = optval; 1120 break; 1121 1122 case IP_TTL: 1123 ip->ip_ttl = optval; 1124 break; 1125 1126 case IP_MINTTL: 1127 if (optval > 0 && optval <= MAXTTL) 1128 inp->inp_ip_minttl = optval; 1129 else 1130 error = EINVAL; 1131 break; 1132 #define OPTSET(bit) \ 1133 if (optval) \ 1134 inpflags |= bit; \ 1135 else \ 1136 inpflags &= ~bit; 1137 1138 case IP_PKTINFO: 1139 OPTSET(INP_PKTINFO); 1140 break; 1141 1142 case IP_RECVOPTS: 1143 OPTSET(INP_RECVOPTS); 1144 break; 1145 1146 case IP_RECVPKTINFO: 1147 OPTSET(INP_RECVPKTINFO); 1148 break; 1149 1150 case IP_RECVRETOPTS: 1151 OPTSET(INP_RECVRETOPTS); 1152 break; 1153 1154 case IP_RECVDSTADDR: 1155 OPTSET(INP_RECVDSTADDR); 1156 break; 1157 1158 case IP_RECVIF: 1159 OPTSET(INP_RECVIF); 1160 break; 1161 1162 case IP_RECVTTL: 1163 OPTSET(INP_RECVTTL); 1164 break; 1165 } 1166 break; 1167 #undef OPTSET 1168 1169 case IP_MULTICAST_IF: 1170 case IP_MULTICAST_TTL: 1171 case IP_MULTICAST_LOOP: 1172 case IP_ADD_MEMBERSHIP: 1173 case IP_DROP_MEMBERSHIP: 1174 error = ip_setmoptions(&inp->inp_moptions, sopt); 1175 break; 1176 1177 case IP_PORTRANGE: 1178 error = sockopt_getint(sopt, &optval); 1179 if (error) 1180 break; 1181 1182 switch (optval) { 1183 case IP_PORTRANGE_DEFAULT: 1184 case IP_PORTRANGE_HIGH: 1185 inpflags &= ~(INP_LOWPORT); 1186 break; 1187 1188 case IP_PORTRANGE_LOW: 1189 inpflags |= INP_LOWPORT; 1190 break; 1191 1192 default: 1193 error = EINVAL; 1194 break; 1195 } 1196 break; 1197 1198 case IP_PORTALGO: 1199 error = sockopt_getint(sopt, &optval); 1200 if (error) 1201 break; 1202 1203 error = portalgo_algo_index_select( 1204 (struct inpcb_hdr *)inp, optval); 1205 break; 1206 1207 #if defined(IPSEC) 1208 case IP_IPSEC_POLICY: 1209 if (ipsec_enabled) { 1210 error = ipsec4_set_policy(inp, sopt->sopt_name, 1211 sopt->sopt_data, sopt->sopt_size, 1212 curlwp->l_cred); 1213 break; 1214 } 1215 /*FALLTHROUGH*/ 1216 #endif /* IPSEC */ 1217 1218 default: 1219 error = ENOPROTOOPT; 1220 break; 1221 } 1222 break; 1223 1224 case PRCO_GETOPT: 1225 switch (sopt->sopt_name) { 1226 case IP_OPTIONS: 1227 case IP_RETOPTS: { 1228 struct mbuf *mopts = inp->inp_options; 1229 1230 if (mopts) { 1231 struct mbuf *m; 1232 1233 m = m_copym(mopts, 0, M_COPYALL, M_DONTWAIT); 1234 if (m == NULL) { 1235 error = ENOBUFS; 1236 break; 1237 } 1238 error = sockopt_setmbuf(sopt, m); 1239 } 1240 break; 1241 } 1242 case IP_PKTINFO: 1243 case IP_TOS: 1244 case IP_TTL: 1245 case IP_MINTTL: 1246 case IP_RECVOPTS: 1247 case IP_RECVRETOPTS: 1248 case IP_RECVDSTADDR: 1249 case IP_RECVIF: 1250 case IP_RECVPKTINFO: 1251 case IP_RECVTTL: 1252 case IP_ERRORMTU: 1253 switch (sopt->sopt_name) { 1254 case IP_TOS: 1255 optval = ip->ip_tos; 1256 break; 1257 1258 case IP_TTL: 1259 optval = ip->ip_ttl; 1260 break; 1261 1262 case IP_MINTTL: 1263 optval = inp->inp_ip_minttl; 1264 break; 1265 1266 case IP_ERRORMTU: 1267 optval = inp->inp_errormtu; 1268 break; 1269 1270 #define OPTBIT(bit) (inpflags & bit ? 1 : 0) 1271 1272 case IP_PKTINFO: 1273 optval = OPTBIT(INP_PKTINFO); 1274 break; 1275 1276 case IP_RECVOPTS: 1277 optval = OPTBIT(INP_RECVOPTS); 1278 break; 1279 1280 case IP_RECVPKTINFO: 1281 optval = OPTBIT(INP_RECVPKTINFO); 1282 break; 1283 1284 case IP_RECVRETOPTS: 1285 optval = OPTBIT(INP_RECVRETOPTS); 1286 break; 1287 1288 case IP_RECVDSTADDR: 1289 optval = OPTBIT(INP_RECVDSTADDR); 1290 break; 1291 1292 case IP_RECVIF: 1293 optval = OPTBIT(INP_RECVIF); 1294 break; 1295 1296 case IP_RECVTTL: 1297 optval = OPTBIT(INP_RECVTTL); 1298 break; 1299 } 1300 error = sockopt_setint(sopt, optval); 1301 break; 1302 1303 #if 0 /* defined(IPSEC) */ 1304 case IP_IPSEC_POLICY: 1305 { 1306 struct mbuf *m = NULL; 1307 1308 /* XXX this will return EINVAL as sopt is empty */ 1309 error = ipsec4_get_policy(inp, sopt->sopt_data, 1310 sopt->sopt_size, &m); 1311 if (error == 0) 1312 error = sockopt_setmbuf(sopt, m); 1313 break; 1314 } 1315 #endif /*IPSEC*/ 1316 1317 case IP_MULTICAST_IF: 1318 case IP_MULTICAST_TTL: 1319 case IP_MULTICAST_LOOP: 1320 case IP_ADD_MEMBERSHIP: 1321 case IP_DROP_MEMBERSHIP: 1322 error = ip_getmoptions(inp->inp_moptions, sopt); 1323 break; 1324 1325 case IP_PORTRANGE: 1326 if (inpflags & INP_LOWPORT) 1327 optval = IP_PORTRANGE_LOW; 1328 else 1329 optval = IP_PORTRANGE_DEFAULT; 1330 error = sockopt_setint(sopt, optval); 1331 break; 1332 1333 case IP_PORTALGO: 1334 optval = inp->inp_portalgo; 1335 error = sockopt_setint(sopt, optval); 1336 break; 1337 1338 default: 1339 error = ENOPROTOOPT; 1340 break; 1341 } 1342 break; 1343 } 1344 1345 if (!error) { 1346 inp->inp_flags = inpflags; 1347 } 1348 return error; 1349 } 1350 1351 /* 1352 * Set up IP options in pcb for insertion in output packets. 1353 * Store in mbuf with pointer in pcbopt, adding pseudo-option 1354 * with destination address if source routed. 1355 */ 1356 static int 1357 ip_pcbopts(struct inpcb *inp, const struct sockopt *sopt) 1358 { 1359 struct mbuf *m; 1360 const u_char *cp; 1361 u_char *dp; 1362 int cnt; 1363 1364 /* Turn off any old options. */ 1365 if (inp->inp_options) { 1366 m_free(inp->inp_options); 1367 } 1368 inp->inp_options = NULL; 1369 if ((cnt = sopt->sopt_size) == 0) { 1370 /* Only turning off any previous options. */ 1371 return 0; 1372 } 1373 cp = sopt->sopt_data; 1374 1375 #ifndef __vax__ 1376 if (cnt % sizeof(int32_t)) 1377 return (EINVAL); 1378 #endif 1379 1380 m = m_get(M_DONTWAIT, MT_SOOPTS); 1381 if (m == NULL) 1382 return (ENOBUFS); 1383 1384 dp = mtod(m, u_char *); 1385 memset(dp, 0, sizeof(struct in_addr)); 1386 dp += sizeof(struct in_addr); 1387 m->m_len = sizeof(struct in_addr); 1388 1389 /* 1390 * IP option list according to RFC791. Each option is of the form 1391 * 1392 * [optval] [olen] [(olen - 2) data bytes] 1393 * 1394 * We validate the list and copy options to an mbuf for prepending 1395 * to data packets. The IP first-hop destination address will be 1396 * stored before actual options and is zero if unset. 1397 */ 1398 while (cnt > 0) { 1399 uint8_t optval, olen, offset; 1400 1401 optval = cp[IPOPT_OPTVAL]; 1402 1403 if (optval == IPOPT_EOL || optval == IPOPT_NOP) { 1404 olen = 1; 1405 } else { 1406 if (cnt < IPOPT_OLEN + 1) 1407 goto bad; 1408 1409 olen = cp[IPOPT_OLEN]; 1410 if (olen < IPOPT_OLEN + 1 || olen > cnt) 1411 goto bad; 1412 } 1413 1414 if (optval == IPOPT_LSRR || optval == IPOPT_SSRR) { 1415 /* 1416 * user process specifies route as: 1417 * ->A->B->C->D 1418 * D must be our final destination (but we can't 1419 * check that since we may not have connected yet). 1420 * A is first hop destination, which doesn't appear in 1421 * actual IP option, but is stored before the options. 1422 */ 1423 if (olen < IPOPT_OFFSET + 1 + sizeof(struct in_addr)) 1424 goto bad; 1425 1426 offset = cp[IPOPT_OFFSET]; 1427 memcpy(mtod(m, u_char *), cp + IPOPT_OFFSET + 1, 1428 sizeof(struct in_addr)); 1429 1430 cp += sizeof(struct in_addr); 1431 cnt -= sizeof(struct in_addr); 1432 olen -= sizeof(struct in_addr); 1433 1434 if (m->m_len + olen > MAX_IPOPTLEN + sizeof(struct in_addr)) 1435 goto bad; 1436 1437 memcpy(dp, cp, olen); 1438 dp[IPOPT_OPTVAL] = optval; 1439 dp[IPOPT_OLEN] = olen; 1440 dp[IPOPT_OFFSET] = offset; 1441 break; 1442 } else { 1443 if (m->m_len + olen > MAX_IPOPTLEN + sizeof(struct in_addr)) 1444 goto bad; 1445 1446 memcpy(dp, cp, olen); 1447 break; 1448 } 1449 1450 dp += olen; 1451 m->m_len += olen; 1452 1453 if (optval == IPOPT_EOL) 1454 break; 1455 1456 cp += olen; 1457 cnt -= olen; 1458 } 1459 1460 inp->inp_options = m; 1461 return 0; 1462 bad: 1463 (void)m_free(m); 1464 return EINVAL; 1465 } 1466 1467 /* 1468 * following RFC1724 section 3.3, 0.0.0.0/8 is interpreted as interface index. 1469 */ 1470 static struct ifnet * 1471 ip_multicast_if(struct in_addr *a, int *ifindexp) 1472 { 1473 int ifindex; 1474 struct ifnet *ifp = NULL; 1475 struct in_ifaddr *ia; 1476 1477 if (ifindexp) 1478 *ifindexp = 0; 1479 if (ntohl(a->s_addr) >> 24 == 0) { 1480 ifindex = ntohl(a->s_addr) & 0xffffff; 1481 ifp = if_byindex(ifindex); 1482 if (!ifp) 1483 return NULL; 1484 if (ifindexp) 1485 *ifindexp = ifindex; 1486 } else { 1487 LIST_FOREACH(ia, &IN_IFADDR_HASH(a->s_addr), ia_hash) { 1488 if (in_hosteq(ia->ia_addr.sin_addr, *a) && 1489 (ia->ia_ifp->if_flags & IFF_MULTICAST) != 0) { 1490 ifp = ia->ia_ifp; 1491 break; 1492 } 1493 } 1494 } 1495 return ifp; 1496 } 1497 1498 static int 1499 ip_getoptval(const struct sockopt *sopt, u_int8_t *val, u_int maxval) 1500 { 1501 u_int tval; 1502 u_char cval; 1503 int error; 1504 1505 if (sopt == NULL) 1506 return EINVAL; 1507 1508 switch (sopt->sopt_size) { 1509 case sizeof(u_char): 1510 error = sockopt_get(sopt, &cval, sizeof(u_char)); 1511 tval = cval; 1512 break; 1513 1514 case sizeof(u_int): 1515 error = sockopt_get(sopt, &tval, sizeof(u_int)); 1516 break; 1517 1518 default: 1519 error = EINVAL; 1520 } 1521 1522 if (error) 1523 return error; 1524 1525 if (tval > maxval) 1526 return EINVAL; 1527 1528 *val = tval; 1529 return 0; 1530 } 1531 1532 static int 1533 ip_get_membership(const struct sockopt *sopt, struct ifnet **ifp, 1534 struct in_addr *ia, bool add) 1535 { 1536 int error; 1537 struct ip_mreq mreq; 1538 1539 error = sockopt_get(sopt, &mreq, sizeof(mreq)); 1540 if (error) 1541 return error; 1542 1543 if (!IN_MULTICAST(mreq.imr_multiaddr.s_addr)) 1544 return EINVAL; 1545 1546 memcpy(ia, &mreq.imr_multiaddr, sizeof(*ia)); 1547 1548 if (in_nullhost(mreq.imr_interface)) { 1549 union { 1550 struct sockaddr dst; 1551 struct sockaddr_in dst4; 1552 } u; 1553 struct route ro; 1554 1555 if (!add) { 1556 *ifp = NULL; 1557 return 0; 1558 } 1559 /* 1560 * If no interface address was provided, use the interface of 1561 * the route to the given multicast address. 1562 */ 1563 struct rtentry *rt; 1564 memset(&ro, 0, sizeof(ro)); 1565 1566 sockaddr_in_init(&u.dst4, ia, 0); 1567 error = rtcache_setdst(&ro, &u.dst); 1568 if (error != 0) 1569 return error; 1570 *ifp = (rt = rtcache_init(&ro)) != NULL ? rt->rt_ifp : NULL; 1571 rtcache_free(&ro); 1572 } else { 1573 *ifp = ip_multicast_if(&mreq.imr_interface, NULL); 1574 if (!add && *ifp == NULL) 1575 return EADDRNOTAVAIL; 1576 } 1577 return 0; 1578 } 1579 1580 /* 1581 * Add a multicast group membership. 1582 * Group must be a valid IP multicast address. 1583 */ 1584 static int 1585 ip_add_membership(struct ip_moptions *imo, const struct sockopt *sopt) 1586 { 1587 struct ifnet *ifp; 1588 struct in_addr ia; 1589 int i, error; 1590 1591 if (sopt->sopt_size == sizeof(struct ip_mreq)) 1592 error = ip_get_membership(sopt, &ifp, &ia, true); 1593 else 1594 #ifdef INET6 1595 error = ip6_get_membership(sopt, &ifp, &ia, sizeof(ia)); 1596 #else 1597 return EINVAL; 1598 #endif 1599 1600 if (error) 1601 return error; 1602 1603 /* 1604 * See if we found an interface, and confirm that it 1605 * supports multicast. 1606 */ 1607 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) 1608 return EADDRNOTAVAIL; 1609 1610 /* 1611 * See if the membership already exists or if all the 1612 * membership slots are full. 1613 */ 1614 for (i = 0; i < imo->imo_num_memberships; ++i) { 1615 if (imo->imo_membership[i]->inm_ifp == ifp && 1616 in_hosteq(imo->imo_membership[i]->inm_addr, ia)) 1617 break; 1618 } 1619 if (i < imo->imo_num_memberships) 1620 return EADDRINUSE; 1621 1622 if (i == IP_MAX_MEMBERSHIPS) 1623 return ETOOMANYREFS; 1624 1625 /* 1626 * Everything looks good; add a new record to the multicast 1627 * address list for the given interface. 1628 */ 1629 if ((imo->imo_membership[i] = in_addmulti(&ia, ifp)) == NULL) 1630 return ENOBUFS; 1631 1632 ++imo->imo_num_memberships; 1633 return 0; 1634 } 1635 1636 /* 1637 * Drop a multicast group membership. 1638 * Group must be a valid IP multicast address. 1639 */ 1640 static int 1641 ip_drop_membership(struct ip_moptions *imo, const struct sockopt *sopt) 1642 { 1643 struct in_addr ia; 1644 struct ifnet *ifp; 1645 int i, error; 1646 1647 if (sopt->sopt_size == sizeof(struct ip_mreq)) 1648 error = ip_get_membership(sopt, &ifp, &ia, false); 1649 else 1650 #ifdef INET6 1651 error = ip6_get_membership(sopt, &ifp, &ia, sizeof(ia)); 1652 #else 1653 return EINVAL; 1654 #endif 1655 1656 if (error) 1657 return error; 1658 1659 /* 1660 * Find the membership in the membership array. 1661 */ 1662 for (i = 0; i < imo->imo_num_memberships; ++i) { 1663 if ((ifp == NULL || 1664 imo->imo_membership[i]->inm_ifp == ifp) && 1665 in_hosteq(imo->imo_membership[i]->inm_addr, ia)) 1666 break; 1667 } 1668 if (i == imo->imo_num_memberships) 1669 return EADDRNOTAVAIL; 1670 1671 /* 1672 * Give up the multicast address record to which the 1673 * membership points. 1674 */ 1675 in_delmulti(imo->imo_membership[i]); 1676 1677 /* 1678 * Remove the gap in the membership array. 1679 */ 1680 for (++i; i < imo->imo_num_memberships; ++i) 1681 imo->imo_membership[i-1] = imo->imo_membership[i]; 1682 --imo->imo_num_memberships; 1683 return 0; 1684 } 1685 1686 /* 1687 * Set the IP multicast options in response to user setsockopt(). 1688 */ 1689 int 1690 ip_setmoptions(struct ip_moptions **pimo, const struct sockopt *sopt) 1691 { 1692 struct ip_moptions *imo = *pimo; 1693 struct in_addr addr; 1694 struct ifnet *ifp; 1695 int ifindex, error = 0; 1696 1697 if (!imo) { 1698 /* 1699 * No multicast option buffer attached to the pcb; 1700 * allocate one and initialize to default values. 1701 */ 1702 imo = kmem_intr_alloc(sizeof(*imo), KM_NOSLEEP); 1703 if (imo == NULL) 1704 return ENOBUFS; 1705 1706 imo->imo_multicast_ifp = NULL; 1707 imo->imo_multicast_addr.s_addr = INADDR_ANY; 1708 imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; 1709 imo->imo_multicast_loop = IP_DEFAULT_MULTICAST_LOOP; 1710 imo->imo_num_memberships = 0; 1711 *pimo = imo; 1712 } 1713 1714 switch (sopt->sopt_name) { 1715 case IP_MULTICAST_IF: 1716 /* 1717 * Select the interface for outgoing multicast packets. 1718 */ 1719 error = sockopt_get(sopt, &addr, sizeof(addr)); 1720 if (error) 1721 break; 1722 1723 /* 1724 * INADDR_ANY is used to remove a previous selection. 1725 * When no interface is selected, a default one is 1726 * chosen every time a multicast packet is sent. 1727 */ 1728 if (in_nullhost(addr)) { 1729 imo->imo_multicast_ifp = NULL; 1730 break; 1731 } 1732 /* 1733 * The selected interface is identified by its local 1734 * IP address. Find the interface and confirm that 1735 * it supports multicasting. 1736 */ 1737 ifp = ip_multicast_if(&addr, &ifindex); 1738 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) { 1739 error = EADDRNOTAVAIL; 1740 break; 1741 } 1742 imo->imo_multicast_ifp = ifp; 1743 if (ifindex) 1744 imo->imo_multicast_addr = addr; 1745 else 1746 imo->imo_multicast_addr.s_addr = INADDR_ANY; 1747 break; 1748 1749 case IP_MULTICAST_TTL: 1750 /* 1751 * Set the IP time-to-live for outgoing multicast packets. 1752 */ 1753 error = ip_getoptval(sopt, &imo->imo_multicast_ttl, MAXTTL); 1754 break; 1755 1756 case IP_MULTICAST_LOOP: 1757 /* 1758 * Set the loopback flag for outgoing multicast packets. 1759 * Must be zero or one. 1760 */ 1761 error = ip_getoptval(sopt, &imo->imo_multicast_loop, 1); 1762 break; 1763 1764 case IP_ADD_MEMBERSHIP: /* IPV6_JOIN_GROUP */ 1765 error = ip_add_membership(imo, sopt); 1766 break; 1767 1768 case IP_DROP_MEMBERSHIP: /* IPV6_LEAVE_GROUP */ 1769 error = ip_drop_membership(imo, sopt); 1770 break; 1771 1772 default: 1773 error = EOPNOTSUPP; 1774 break; 1775 } 1776 1777 /* 1778 * If all options have default values, no need to keep the mbuf. 1779 */ 1780 if (imo->imo_multicast_ifp == NULL && 1781 imo->imo_multicast_ttl == IP_DEFAULT_MULTICAST_TTL && 1782 imo->imo_multicast_loop == IP_DEFAULT_MULTICAST_LOOP && 1783 imo->imo_num_memberships == 0) { 1784 kmem_free(imo, sizeof(*imo)); 1785 *pimo = NULL; 1786 } 1787 1788 return error; 1789 } 1790 1791 /* 1792 * Return the IP multicast options in response to user getsockopt(). 1793 */ 1794 int 1795 ip_getmoptions(struct ip_moptions *imo, struct sockopt *sopt) 1796 { 1797 struct in_addr addr; 1798 struct in_ifaddr *ia; 1799 uint8_t optval; 1800 int error = 0; 1801 1802 switch (sopt->sopt_name) { 1803 case IP_MULTICAST_IF: 1804 if (imo == NULL || imo->imo_multicast_ifp == NULL) 1805 addr = zeroin_addr; 1806 else if (imo->imo_multicast_addr.s_addr) { 1807 /* return the value user has set */ 1808 addr = imo->imo_multicast_addr; 1809 } else { 1810 IFP_TO_IA(imo->imo_multicast_ifp, ia); 1811 addr = ia ? ia->ia_addr.sin_addr : zeroin_addr; 1812 } 1813 error = sockopt_set(sopt, &addr, sizeof(addr)); 1814 break; 1815 1816 case IP_MULTICAST_TTL: 1817 optval = imo ? imo->imo_multicast_ttl 1818 : IP_DEFAULT_MULTICAST_TTL; 1819 1820 error = sockopt_set(sopt, &optval, sizeof(optval)); 1821 break; 1822 1823 case IP_MULTICAST_LOOP: 1824 optval = imo ? imo->imo_multicast_loop 1825 : IP_DEFAULT_MULTICAST_LOOP; 1826 1827 error = sockopt_set(sopt, &optval, sizeof(optval)); 1828 break; 1829 1830 default: 1831 error = EOPNOTSUPP; 1832 } 1833 1834 return error; 1835 } 1836 1837 /* 1838 * Discard the IP multicast options. 1839 */ 1840 void 1841 ip_freemoptions(struct ip_moptions *imo) 1842 { 1843 int i; 1844 1845 if (imo != NULL) { 1846 for (i = 0; i < imo->imo_num_memberships; ++i) 1847 in_delmulti(imo->imo_membership[i]); 1848 kmem_free(imo, sizeof(*imo)); 1849 } 1850 } 1851 1852 /* 1853 * Routine called from ip_output() to loop back a copy of an IP multicast 1854 * packet to the input queue of a specified interface. Note that this 1855 * calls the output routine of the loopback "driver", but with an interface 1856 * pointer that might NOT be lo0ifp -- easier than replicating that code here. 1857 */ 1858 static void 1859 ip_mloopback(struct ifnet *ifp, struct mbuf *m, const struct sockaddr_in *dst) 1860 { 1861 struct ip *ip; 1862 struct mbuf *copym; 1863 1864 copym = m_copypacket(m, M_DONTWAIT); 1865 if (copym != NULL && 1866 (copym->m_flags & M_EXT || copym->m_len < sizeof(struct ip))) 1867 copym = m_pullup(copym, sizeof(struct ip)); 1868 if (copym == NULL) 1869 return; 1870 /* 1871 * We don't bother to fragment if the IP length is greater 1872 * than the interface's MTU. Can this possibly matter? 1873 */ 1874 ip = mtod(copym, struct ip *); 1875 1876 if (copym->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 1877 in_delayed_cksum(copym); 1878 copym->m_pkthdr.csum_flags &= 1879 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 1880 } 1881 1882 ip->ip_sum = 0; 1883 ip->ip_sum = in_cksum(copym, ip->ip_hl << 2); 1884 #ifndef NET_MPSAFE 1885 KERNEL_LOCK(1, NULL); 1886 #endif 1887 (void)looutput(ifp, copym, sintocsa(dst), NULL); 1888 #ifndef NET_MPSAFE 1889 KERNEL_UNLOCK_ONE(NULL); 1890 #endif 1891 } 1892
Indexes created Wed Oct 01 12:09:54 GMT 2025