ip_output.c revision 1.246 1 /* $NetBSD: ip_output.c,v 1.246 2015/08/24 22:21:26 pooka Exp $ */
2
3 /*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 /*-
33 * Copyright (c) 1998 The NetBSD Foundation, Inc.
34 * All rights reserved.
35 *
36 * This code is derived from software contributed to The NetBSD Foundation
37 * by Public Access Networks Corporation ("Panix"). It was developed under
38 * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon.
39 *
40 * Redistribution and use in source and binary forms, with or without
41 * modification, are permitted provided that the following conditions
42 * are met:
43 * 1. Redistributions of source code must retain the above copyright
44 * notice, this list of conditions and the following disclaimer.
45 * 2. Redistributions in binary form must reproduce the above copyright
46 * notice, this list of conditions and the following disclaimer in the
47 * documentation and/or other materials provided with the distribution.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
50 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
51 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
52 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
53 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
54 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
55 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
56 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
57 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
58 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
59 * POSSIBILITY OF SUCH DAMAGE.
60 */
61
62 /*
63 * Copyright (c) 1982, 1986, 1988, 1990, 1993
64 * The Regents of the University of California. All rights reserved.
65 *
66 * Redistribution and use in source and binary forms, with or without
67 * modification, are permitted provided that the following conditions
68 * are met:
69 * 1. Redistributions of source code must retain the above copyright
70 * notice, this list of conditions and the following disclaimer.
71 * 2. Redistributions in binary form must reproduce the above copyright
72 * notice, this list of conditions and the following disclaimer in the
73 * documentation and/or other materials provided with the distribution.
74 * 3. Neither the name of the University nor the names of its contributors
75 * may be used to endorse or promote products derived from this software
76 * without specific prior written permission.
77 *
78 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
79 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
80 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
81 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
82 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
83 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
84 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
85 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
86 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
87 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
88 * SUCH DAMAGE.
89 *
90 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
91 */
92
93 #include <sys/cdefs.h>
94 __KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.246 2015/08/24 22:21:26 pooka Exp $");
95
96 #ifdef _KERNEL_OPT
97 #include "opt_inet.h"
98 #include "opt_ipsec.h"
99 #include "opt_mrouting.h"
100 #include "opt_net_mpsafe.h"
101 #include "opt_mpls.h"
102 #endif
103
104 #include <sys/param.h>
105 #include <sys/kmem.h>
106 #include <sys/mbuf.h>
107 #include <sys/protosw.h>
108 #include <sys/socket.h>
109 #include <sys/socketvar.h>
110 #include <sys/kauth.h>
111 #ifdef IPSEC
112 #include <sys/domain.h>
113 #endif
114 #include <sys/systm.h>
115
116 #include <net/if.h>
117 #include <net/if_types.h>
118 #include <net/route.h>
119 #include <net/pfil.h>
120
121 #include <netinet/in.h>
122 #include <netinet/in_systm.h>
123 #include <netinet/ip.h>
124 #include <netinet/in_pcb.h>
125 #include <netinet/in_var.h>
126 #include <netinet/ip_var.h>
127 #include <netinet/ip_private.h>
128 #include <netinet/in_offload.h>
129 #include <netinet/portalgo.h>
130 #include <netinet/udp.h>
131
132 #ifdef INET6
133 #include <netinet6/ip6_var.h>
134 #endif
135
136 #ifdef MROUTING
137 #include <netinet/ip_mroute.h>
138 #endif
139
140 #ifdef IPSEC
141 #include <netipsec/ipsec.h>
142 #include <netipsec/key.h>
143 #endif
144
145 #ifdef MPLS
146 #include <netmpls/mpls.h>
147 #include <netmpls/mpls_var.h>
148 #endif
149
150 static int ip_pcbopts(struct inpcb *, const struct sockopt *);
151 static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *);
152 static struct ifnet *ip_multicast_if(struct in_addr *, int *);
153 static void ip_mloopback(struct ifnet *, struct mbuf *,
154 const struct sockaddr_in *);
155
156 extern pfil_head_t *inet_pfil_hook; /* XXX */
157
158 int ip_do_loopback_cksum = 0;
159
160 static bool
161 ip_hresolv_needed(const struct ifnet * const ifp)
162 {
163 switch (ifp->if_type) {
164 case IFT_ARCNET:
165 case IFT_ATM:
166 case IFT_ECONET:
167 case IFT_ETHER:
168 case IFT_FDDI:
169 case IFT_HIPPI:
170 case IFT_IEEE1394:
171 case IFT_ISO88025:
172 case IFT_SLIP:
173 return true;
174 default:
175 return false;
176 }
177 }
178
179 static int
180 klock_if_output(struct ifnet * const ifp, struct mbuf * const m,
181 const struct sockaddr * const dst, struct rtentry *rt)
182 {
183 int error;
184
185 #ifndef NET_MPSAFE
186 KERNEL_LOCK(1, NULL);
187 #endif
188
189 error = (*ifp->if_output)(ifp, m, dst, rt);
190
191 #ifndef NET_MPSAFE
192 KERNEL_UNLOCK_ONE(NULL);
193 #endif
194
195 return error;
196 }
197
198 /*
199 * Send an IP packet to a host.
200 *
201 * If necessary, resolve the arbitrary IP route, rt0, to an IP host route before
202 * calling ifp's output routine.
203 */
204 int
205 ip_hresolv_output(struct ifnet * const ifp0, struct mbuf * const m,
206 const struct sockaddr * const dst, struct rtentry *rt00)
207 {
208 int error = 0;
209 struct ifnet *ifp = ifp0;
210 struct rtentry *rt, *rt0, *gwrt;
211
212 #define RTFREE_IF_NEEDED(_rt) \
213 if ((_rt) != NULL && (_rt) != rt00) \
214 rtfree((_rt));
215
216 rt0 = rt00;
217 retry:
218 if (!ip_hresolv_needed(ifp)) {
219 rt = rt0;
220 goto out;
221 }
222
223 if (rt0 == NULL) {
224 rt = NULL;
225 goto out;
226 }
227
228 rt = rt0;
229
230 /*
231 * The following block is highly questionable. How did we get here
232 * with a !RTF_UP route? Does rtalloc1() always return an RTF_UP
233 * route?
234 */
235 if ((rt->rt_flags & RTF_UP) == 0) {
236 rt = rtalloc1(dst, 1);
237 if (rt == NULL) {
238 error = EHOSTUNREACH;
239 goto bad;
240 }
241 rt0 = rt;
242 if (rt->rt_ifp != ifp) {
243 ifp = rt->rt_ifp;
244 goto retry;
245 }
246 }
247
248 if ((rt->rt_flags & RTF_GATEWAY) == 0)
249 goto out;
250
251 gwrt = rt_get_gwroute(rt);
252 RTFREE_IF_NEEDED(rt);
253 rt = gwrt;
254 if (rt == NULL || (rt->rt_flags & RTF_UP) == 0) {
255 if (rt != NULL) {
256 RTFREE_IF_NEEDED(rt);
257 rt = rt0;
258 }
259 if (rt == NULL) {
260 error = EHOSTUNREACH;
261 goto bad;
262 }
263 gwrt = rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1);
264 RTFREE_IF_NEEDED(rt);
265 rt = gwrt;
266 if (rt == NULL) {
267 error = EHOSTUNREACH;
268 goto bad;
269 }
270 /* the "G" test below also prevents rt == rt0 */
271 if ((rt->rt_flags & RTF_GATEWAY) != 0 || rt->rt_ifp != ifp) {
272 rt0->rt_gwroute = NULL;
273 error = EHOSTUNREACH;
274 goto bad;
275 }
276 }
277 if ((rt->rt_flags & RTF_REJECT) != 0) {
278 if (rt->rt_rmx.rmx_expire == 0 ||
279 time_uptime < rt->rt_rmx.rmx_expire) {
280 error = (rt == rt0) ? EHOSTDOWN : EHOSTUNREACH;
281 goto bad;
282 }
283 }
284
285 out:
286 #ifdef MPLS
287 if (rt0 != NULL && rt_gettag(rt0) != NULL &&
288 rt_gettag(rt0)->sa_family == AF_MPLS &&
289 (m->m_flags & (M_MCAST | M_BCAST)) == 0 &&
290 ifp->if_type == IFT_ETHER) {
291 union mpls_shim msh;
292 msh.s_addr = MPLS_GETSADDR(rt0);
293 if (msh.shim.label != MPLS_LABEL_IMPLNULL) {
294 struct m_tag *mtag;
295 /*
296 * XXX tentative solution to tell ether_output
297 * it's MPLS. Need some more efficient solution.
298 */
299 mtag = m_tag_get(PACKET_TAG_MPLS,
300 sizeof(int) /* dummy */,
301 M_NOWAIT);
302 if (mtag == NULL) {
303 error = ENOMEM;
304 goto bad;
305 }
306 m_tag_prepend(m, mtag);
307 }
308 }
309 #endif
310
311 error = klock_if_output(ifp, m, dst, rt);
312 goto exit;
313
314 bad:
315 if (m != NULL)
316 m_freem(m);
317 exit:
318 RTFREE_IF_NEEDED(rt);
319
320 return error;
321
322 #undef RTFREE_IF_NEEDED
323 }
324
325 /*
326 * IP output. The packet in mbuf chain m contains a skeletal IP
327 * header (with len, off, ttl, proto, tos, src, dst).
328 * The mbuf chain containing the packet will be freed.
329 * The mbuf opt, if present, will not be freed.
330 */
331 int
332 ip_output(struct mbuf *m0, ...)
333 {
334 struct rtentry *rt;
335 struct ip *ip;
336 struct ifnet *ifp;
337 struct mbuf *m = m0;
338 int hlen = sizeof (struct ip);
339 int len, error = 0;
340 struct route iproute;
341 const struct sockaddr_in *dst;
342 struct in_ifaddr *ia;
343 int isbroadcast;
344 struct mbuf *opt;
345 struct route *ro;
346 int flags, sw_csum;
347 u_long mtu;
348 struct ip_moptions *imo;
349 struct socket *so;
350 va_list ap;
351 #ifdef IPSEC
352 struct secpolicy *sp = NULL;
353 #endif
354 bool natt_frag = false;
355 bool rtmtu_nolock;
356 union {
357 struct sockaddr dst;
358 struct sockaddr_in dst4;
359 } u;
360 struct sockaddr *rdst = &u.dst; /* real IP destination, as opposed
361 * to the nexthop
362 */
363
364 len = 0;
365 va_start(ap, m0);
366 opt = va_arg(ap, struct mbuf *);
367 ro = va_arg(ap, struct route *);
368 flags = va_arg(ap, int);
369 imo = va_arg(ap, struct ip_moptions *);
370 so = va_arg(ap, struct socket *);
371 va_end(ap);
372
373 MCLAIM(m, &ip_tx_mowner);
374
375 KASSERT((m->m_flags & M_PKTHDR) != 0);
376 KASSERT((m->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) == 0);
377 KASSERT((m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) !=
378 (M_CSUM_TCPv4|M_CSUM_UDPv4));
379
380 if (opt) {
381 m = ip_insertoptions(m, opt, &len);
382 if (len >= sizeof(struct ip))
383 hlen = len;
384 }
385 ip = mtod(m, struct ip *);
386
387 /*
388 * Fill in IP header.
389 */
390 if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) {
391 ip->ip_v = IPVERSION;
392 ip->ip_off = htons(0);
393 /* ip->ip_id filled in after we find out source ia */
394 ip->ip_hl = hlen >> 2;
395 IP_STATINC(IP_STAT_LOCALOUT);
396 } else {
397 hlen = ip->ip_hl << 2;
398 }
399
400 /*
401 * Route packet.
402 */
403 if (ro == NULL) {
404 memset(&iproute, 0, sizeof(iproute));
405 ro = &iproute;
406 }
407 sockaddr_in_init(&u.dst4, &ip->ip_dst, 0);
408 dst = satocsin(rtcache_getdst(ro));
409
410 /*
411 * If there is a cached route, check that it is to the same
412 * destination and is still up. If not, free it and try again.
413 * The address family should also be checked in case of sharing
414 * the cache with IPv6.
415 */
416 if (dst && (dst->sin_family != AF_INET ||
417 !in_hosteq(dst->sin_addr, ip->ip_dst)))
418 rtcache_free(ro);
419
420 if ((rt = rtcache_validate(ro)) == NULL &&
421 (rt = rtcache_update(ro, 1)) == NULL) {
422 dst = &u.dst4;
423 error = rtcache_setdst(ro, &u.dst);
424 if (error != 0)
425 goto bad;
426 }
427
428 /*
429 * If routing to interface only, short circuit routing lookup.
430 */
431 if (flags & IP_ROUTETOIF) {
432 if ((ia = ifatoia(ifa_ifwithladdr(sintocsa(dst)))) == NULL) {
433 IP_STATINC(IP_STAT_NOROUTE);
434 error = ENETUNREACH;
435 goto bad;
436 }
437 ifp = ia->ia_ifp;
438 mtu = ifp->if_mtu;
439 ip->ip_ttl = 1;
440 isbroadcast = in_broadcast(dst->sin_addr, ifp);
441 } else if ((IN_MULTICAST(ip->ip_dst.s_addr) ||
442 ip->ip_dst.s_addr == INADDR_BROADCAST) &&
443 imo != NULL && imo->imo_multicast_ifp != NULL) {
444 ifp = imo->imo_multicast_ifp;
445 mtu = ifp->if_mtu;
446 IFP_TO_IA(ifp, ia);
447 isbroadcast = 0;
448 } else {
449 if (rt == NULL)
450 rt = rtcache_init(ro);
451 if (rt == NULL) {
452 IP_STATINC(IP_STAT_NOROUTE);
453 error = EHOSTUNREACH;
454 goto bad;
455 }
456 ia = ifatoia(rt->rt_ifa);
457 ifp = rt->rt_ifp;
458 if ((mtu = rt->rt_rmx.rmx_mtu) == 0)
459 mtu = ifp->if_mtu;
460 rt->rt_use++;
461 if (rt->rt_flags & RTF_GATEWAY)
462 dst = satosin(rt->rt_gateway);
463 if (rt->rt_flags & RTF_HOST)
464 isbroadcast = rt->rt_flags & RTF_BROADCAST;
465 else
466 isbroadcast = in_broadcast(dst->sin_addr, ifp);
467 }
468 rtmtu_nolock = rt && (rt->rt_rmx.rmx_locks & RTV_MTU) == 0;
469
470 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
471 (ip->ip_dst.s_addr == INADDR_BROADCAST)) {
472 bool inmgroup;
473
474 m->m_flags |= (ip->ip_dst.s_addr == INADDR_BROADCAST) ?
475 M_BCAST : M_MCAST;
476 /*
477 * See if the caller provided any multicast options
478 */
479 if (imo != NULL)
480 ip->ip_ttl = imo->imo_multicast_ttl;
481 else
482 ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL;
483
484 /*
485 * if we don't know the outgoing ifp yet, we can't generate
486 * output
487 */
488 if (!ifp) {
489 IP_STATINC(IP_STAT_NOROUTE);
490 error = ENETUNREACH;
491 goto bad;
492 }
493
494 /*
495 * If the packet is multicast or broadcast, confirm that
496 * the outgoing interface can transmit it.
497 */
498 if (((m->m_flags & M_MCAST) &&
499 (ifp->if_flags & IFF_MULTICAST) == 0) ||
500 ((m->m_flags & M_BCAST) &&
501 (ifp->if_flags & (IFF_BROADCAST|IFF_POINTOPOINT)) == 0)) {
502 IP_STATINC(IP_STAT_NOROUTE);
503 error = ENETUNREACH;
504 goto bad;
505 }
506 /*
507 * If source address not specified yet, use an address
508 * of outgoing interface.
509 */
510 if (in_nullhost(ip->ip_src)) {
511 struct in_ifaddr *xia;
512 struct ifaddr *xifa;
513
514 IFP_TO_IA(ifp, xia);
515 if (!xia) {
516 error = EADDRNOTAVAIL;
517 goto bad;
518 }
519 xifa = &xia->ia_ifa;
520 if (xifa->ifa_getifa != NULL) {
521 xia = ifatoia((*xifa->ifa_getifa)(xifa, rdst));
522 if (xia == NULL) {
523 error = EADDRNOTAVAIL;
524 goto bad;
525 }
526 }
527 ip->ip_src = xia->ia_addr.sin_addr;
528 }
529
530 inmgroup = in_multi_group(ip->ip_dst, ifp, flags);
531 if (inmgroup && (imo == NULL || imo->imo_multicast_loop)) {
532 /*
533 * If we belong to the destination multicast group
534 * on the outgoing interface, and the caller did not
535 * forbid loopback, loop back a copy.
536 */
537 ip_mloopback(ifp, m, &u.dst4);
538 }
539 #ifdef MROUTING
540 else {
541 /*
542 * If we are acting as a multicast router, perform
543 * multicast forwarding as if the packet had just
544 * arrived on the interface to which we are about
545 * to send. The multicast forwarding function
546 * recursively calls this function, using the
547 * IP_FORWARDING flag to prevent infinite recursion.
548 *
549 * Multicasts that are looped back by ip_mloopback(),
550 * above, will be forwarded by the ip_input() routine,
551 * if necessary.
552 */
553 extern struct socket *ip_mrouter;
554
555 if (ip_mrouter && (flags & IP_FORWARDING) == 0) {
556 if (ip_mforward(m, ifp) != 0) {
557 m_freem(m);
558 goto done;
559 }
560 }
561 }
562 #endif
563 /*
564 * Multicasts with a time-to-live of zero may be looped-
565 * back, above, but must not be transmitted on a network.
566 * Also, multicasts addressed to the loopback interface
567 * are not sent -- the above call to ip_mloopback() will
568 * loop back a copy if this host actually belongs to the
569 * destination group on the loopback interface.
570 */
571 if (ip->ip_ttl == 0 || (ifp->if_flags & IFF_LOOPBACK) != 0) {
572 m_freem(m);
573 goto done;
574 }
575 goto sendit;
576 }
577
578 /*
579 * If source address not specified yet, use address
580 * of outgoing interface.
581 */
582 if (in_nullhost(ip->ip_src)) {
583 struct ifaddr *xifa;
584
585 xifa = &ia->ia_ifa;
586 if (xifa->ifa_getifa != NULL) {
587 ia = ifatoia((*xifa->ifa_getifa)(xifa, rdst));
588 if (ia == NULL) {
589 error = EADDRNOTAVAIL;
590 goto bad;
591 }
592 }
593 ip->ip_src = ia->ia_addr.sin_addr;
594 }
595
596 /*
597 * packets with Class-D address as source are not valid per
598 * RFC 1112
599 */
600 if (IN_MULTICAST(ip->ip_src.s_addr)) {
601 IP_STATINC(IP_STAT_ODROPPED);
602 error = EADDRNOTAVAIL;
603 goto bad;
604 }
605
606 /*
607 * Look for broadcast address and and verify user is allowed to
608 * send such a packet.
609 */
610 if (isbroadcast) {
611 if ((ifp->if_flags & IFF_BROADCAST) == 0) {
612 error = EADDRNOTAVAIL;
613 goto bad;
614 }
615 if ((flags & IP_ALLOWBROADCAST) == 0) {
616 error = EACCES;
617 goto bad;
618 }
619 /* don't allow broadcast messages to be fragmented */
620 if (ntohs(ip->ip_len) > ifp->if_mtu) {
621 error = EMSGSIZE;
622 goto bad;
623 }
624 m->m_flags |= M_BCAST;
625 } else
626 m->m_flags &= ~M_BCAST;
627
628 sendit:
629 if ((flags & (IP_FORWARDING|IP_NOIPNEWID)) == 0) {
630 if (m->m_pkthdr.len < IP_MINFRAGSIZE) {
631 ip->ip_id = 0;
632 } else if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0) {
633 ip->ip_id = ip_newid(ia);
634 } else {
635
636 /*
637 * TSO capable interfaces (typically?) increment
638 * ip_id for each segment.
639 * "allocate" enough ids here to increase the chance
640 * for them to be unique.
641 *
642 * note that the following calculation is not
643 * needed to be precise. wasting some ip_id is fine.
644 */
645
646 unsigned int segsz = m->m_pkthdr.segsz;
647 unsigned int datasz = ntohs(ip->ip_len) - hlen;
648 unsigned int num = howmany(datasz, segsz);
649
650 ip->ip_id = ip_newid_range(ia, num);
651 }
652 }
653
654 /*
655 * If we're doing Path MTU Discovery, we need to set DF unless
656 * the route's MTU is locked.
657 */
658 if ((flags & IP_MTUDISC) != 0 && rtmtu_nolock) {
659 ip->ip_off |= htons(IP_DF);
660 }
661
662 #ifdef IPSEC
663 if (ipsec_used) {
664 bool ipsec_done = false;
665
666 /* Perform IPsec processing, if any. */
667 error = ipsec4_output(m, so, flags, &sp, &mtu, &natt_frag,
668 &ipsec_done);
669 if (error || ipsec_done)
670 goto done;
671 }
672 #endif
673
674 /*
675 * Run through list of hooks for output packets.
676 */
677 error = pfil_run_hooks(inet_pfil_hook, &m, ifp, PFIL_OUT);
678 if (error)
679 goto done;
680 if (m == NULL)
681 goto done;
682
683 ip = mtod(m, struct ip *);
684 hlen = ip->ip_hl << 2;
685
686 m->m_pkthdr.csum_data |= hlen << 16;
687
688 #if IFA_STATS
689 /*
690 * search for the source address structure to
691 * maintain output statistics.
692 */
693 INADDR_TO_IA(ip->ip_src, ia);
694 #endif
695
696 /* Maybe skip checksums on loopback interfaces. */
697 if (IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) {
698 m->m_pkthdr.csum_flags |= M_CSUM_IPv4;
699 }
700 sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_csum_flags_tx;
701 /*
702 * If small enough for mtu of path, or if using TCP segmentation
703 * offload, can just send directly.
704 */
705 if (ntohs(ip->ip_len) <= mtu ||
706 (m->m_pkthdr.csum_flags & M_CSUM_TSOv4) != 0) {
707 const struct sockaddr *sa;
708
709 #if IFA_STATS
710 if (ia)
711 ia->ia_ifa.ifa_data.ifad_outbytes += ntohs(ip->ip_len);
712 #endif
713 /*
714 * Always initialize the sum to 0! Some HW assisted
715 * checksumming requires this.
716 */
717 ip->ip_sum = 0;
718
719 if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0) {
720 /*
721 * Perform any checksums that the hardware can't do
722 * for us.
723 *
724 * XXX Does any hardware require the {th,uh}_sum
725 * XXX fields to be 0?
726 */
727 if (sw_csum & M_CSUM_IPv4) {
728 KASSERT(IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4));
729 ip->ip_sum = in_cksum(m, hlen);
730 m->m_pkthdr.csum_flags &= ~M_CSUM_IPv4;
731 }
732 if (sw_csum & (M_CSUM_TCPv4|M_CSUM_UDPv4)) {
733 if (IN_NEED_CHECKSUM(ifp,
734 sw_csum & (M_CSUM_TCPv4|M_CSUM_UDPv4))) {
735 in_delayed_cksum(m);
736 }
737 m->m_pkthdr.csum_flags &=
738 ~(M_CSUM_TCPv4|M_CSUM_UDPv4);
739 }
740 }
741
742 sa = (m->m_flags & M_MCAST) ? sintocsa(rdst) : sintocsa(dst);
743 if (__predict_true(
744 (m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0 ||
745 (ifp->if_capenable & IFCAP_TSOv4) != 0)) {
746 error = ip_hresolv_output(ifp, m, sa, rt);
747 } else {
748 error = ip_tso_output(ifp, m, sa, rt);
749 }
750 goto done;
751 }
752
753 /*
754 * We can't use HW checksumming if we're about to
755 * to fragment the packet.
756 *
757 * XXX Some hardware can do this.
758 */
759 if (m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) {
760 if (IN_NEED_CHECKSUM(ifp,
761 m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4))) {
762 in_delayed_cksum(m);
763 }
764 m->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv4|M_CSUM_UDPv4);
765 }
766
767 /*
768 * Too large for interface; fragment if possible.
769 * Must be able to put at least 8 bytes per fragment.
770 */
771 if (ntohs(ip->ip_off) & IP_DF) {
772 if (flags & IP_RETURNMTU) {
773 struct inpcb *inp;
774
775 KASSERT(so && solocked(so));
776 inp = sotoinpcb(so);
777 inp->inp_errormtu = mtu;
778 }
779 error = EMSGSIZE;
780 IP_STATINC(IP_STAT_CANTFRAG);
781 goto bad;
782 }
783
784 error = ip_fragment(m, ifp, mtu);
785 if (error) {
786 m = NULL;
787 goto bad;
788 }
789
790 for (; m; m = m0) {
791 m0 = m->m_nextpkt;
792 m->m_nextpkt = 0;
793 if (error) {
794 m_freem(m);
795 continue;
796 }
797 #if IFA_STATS
798 if (ia)
799 ia->ia_ifa.ifa_data.ifad_outbytes += ntohs(ip->ip_len);
800 #endif
801 /*
802 * If we get there, the packet has not been handled by
803 * IPsec whereas it should have. Now that it has been
804 * fragmented, re-inject it in ip_output so that IPsec
805 * processing can occur.
806 */
807 if (natt_frag) {
808 error = ip_output(m, opt, ro,
809 flags | IP_RAWOUTPUT | IP_NOIPNEWID,
810 imo, so);
811 } else {
812 KASSERT((m->m_pkthdr.csum_flags &
813 (M_CSUM_UDPv4 | M_CSUM_TCPv4)) == 0);
814 error = ip_hresolv_output(ifp, m,
815 (m->m_flags & M_MCAST) ?
816 sintocsa(rdst) : sintocsa(dst), rt);
817 }
818 }
819 if (error == 0) {
820 IP_STATINC(IP_STAT_FRAGMENTED);
821 }
822 done:
823 if (ro == &iproute) {
824 rtcache_free(&iproute);
825 }
826 #ifdef IPSEC
827 if (sp) {
828 KEY_FREESP(&sp);
829 }
830 #endif
831 return error;
832 bad:
833 m_freem(m);
834 goto done;
835 }
836
837 int
838 ip_fragment(struct mbuf *m, struct ifnet *ifp, u_long mtu)
839 {
840 struct ip *ip, *mhip;
841 struct mbuf *m0;
842 int len, hlen, off;
843 int mhlen, firstlen;
844 struct mbuf **mnext;
845 int sw_csum = m->m_pkthdr.csum_flags;
846 int fragments = 0;
847 int s;
848 int error = 0;
849
850 ip = mtod(m, struct ip *);
851 hlen = ip->ip_hl << 2;
852 if (ifp != NULL)
853 sw_csum &= ~ifp->if_csum_flags_tx;
854
855 len = (mtu - hlen) &~ 7;
856 if (len < 8) {
857 m_freem(m);
858 return (EMSGSIZE);
859 }
860
861 firstlen = len;
862 mnext = &m->m_nextpkt;
863
864 /*
865 * Loop through length of segment after first fragment,
866 * make new header and copy data of each part and link onto chain.
867 */
868 m0 = m;
869 mhlen = sizeof (struct ip);
870 for (off = hlen + len; off < ntohs(ip->ip_len); off += len) {
871 MGETHDR(m, M_DONTWAIT, MT_HEADER);
872 if (m == 0) {
873 error = ENOBUFS;
874 IP_STATINC(IP_STAT_ODROPPED);
875 goto sendorfree;
876 }
877 MCLAIM(m, m0->m_owner);
878 *mnext = m;
879 mnext = &m->m_nextpkt;
880 m->m_data += max_linkhdr;
881 mhip = mtod(m, struct ip *);
882 *mhip = *ip;
883 /* we must inherit MCAST and BCAST flags */
884 m->m_flags |= m0->m_flags & (M_MCAST|M_BCAST);
885 if (hlen > sizeof (struct ip)) {
886 mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);
887 mhip->ip_hl = mhlen >> 2;
888 }
889 m->m_len = mhlen;
890 mhip->ip_off = ((off - hlen) >> 3) +
891 (ntohs(ip->ip_off) & ~IP_MF);
892 if (ip->ip_off & htons(IP_MF))
893 mhip->ip_off |= IP_MF;
894 if (off + len >= ntohs(ip->ip_len))
895 len = ntohs(ip->ip_len) - off;
896 else
897 mhip->ip_off |= IP_MF;
898 HTONS(mhip->ip_off);
899 mhip->ip_len = htons((u_int16_t)(len + mhlen));
900 m->m_next = m_copym(m0, off, len, M_DONTWAIT);
901 if (m->m_next == 0) {
902 error = ENOBUFS; /* ??? */
903 IP_STATINC(IP_STAT_ODROPPED);
904 goto sendorfree;
905 }
906 m->m_pkthdr.len = mhlen + len;
907 m->m_pkthdr.rcvif = NULL;
908 mhip->ip_sum = 0;
909 KASSERT((m->m_pkthdr.csum_flags & M_CSUM_IPv4) == 0);
910 if (sw_csum & M_CSUM_IPv4) {
911 mhip->ip_sum = in_cksum(m, mhlen);
912 } else {
913 /*
914 * checksum is hw-offloaded or not necessary.
915 */
916 m->m_pkthdr.csum_flags |=
917 m0->m_pkthdr.csum_flags & M_CSUM_IPv4;
918 m->m_pkthdr.csum_data |= mhlen << 16;
919 KASSERT(!(ifp != NULL &&
920 IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) ||
921 (m->m_pkthdr.csum_flags & M_CSUM_IPv4) != 0);
922 }
923 IP_STATINC(IP_STAT_OFRAGMENTS);
924 fragments++;
925 }
926 /*
927 * Update first fragment by trimming what's been copied out
928 * and updating header, then send each fragment (in order).
929 */
930 m = m0;
931 m_adj(m, hlen + firstlen - ntohs(ip->ip_len));
932 m->m_pkthdr.len = hlen + firstlen;
933 ip->ip_len = htons((u_int16_t)m->m_pkthdr.len);
934 ip->ip_off |= htons(IP_MF);
935 ip->ip_sum = 0;
936 if (sw_csum & M_CSUM_IPv4) {
937 ip->ip_sum = in_cksum(m, hlen);
938 m->m_pkthdr.csum_flags &= ~M_CSUM_IPv4;
939 } else {
940 /*
941 * checksum is hw-offloaded or not necessary.
942 */
943 KASSERT(!(ifp != NULL && IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) ||
944 (m->m_pkthdr.csum_flags & M_CSUM_IPv4) != 0);
945 KASSERT(M_CSUM_DATA_IPv4_IPHL(m->m_pkthdr.csum_data) >=
946 sizeof(struct ip));
947 }
948 sendorfree:
949 /*
950 * If there is no room for all the fragments, don't queue
951 * any of them.
952 */
953 if (ifp != NULL) {
954 s = splnet();
955 if (ifp->if_snd.ifq_maxlen - ifp->if_snd.ifq_len < fragments &&
956 error == 0) {
957 error = ENOBUFS;
958 IP_STATINC(IP_STAT_ODROPPED);
959 IFQ_INC_DROPS(&ifp->if_snd);
960 }
961 splx(s);
962 }
963 if (error) {
964 for (m = m0; m; m = m0) {
965 m0 = m->m_nextpkt;
966 m->m_nextpkt = NULL;
967 m_freem(m);
968 }
969 }
970 return (error);
971 }
972
973 /*
974 * Process a delayed payload checksum calculation.
975 */
976 void
977 in_delayed_cksum(struct mbuf *m)
978 {
979 struct ip *ip;
980 u_int16_t csum, offset;
981
982 ip = mtod(m, struct ip *);
983 offset = ip->ip_hl << 2;
984 csum = in4_cksum(m, 0, offset, ntohs(ip->ip_len) - offset);
985 if (csum == 0 && (m->m_pkthdr.csum_flags & M_CSUM_UDPv4) != 0)
986 csum = 0xffff;
987
988 offset += M_CSUM_DATA_IPv4_OFFSET(m->m_pkthdr.csum_data);
989
990 if ((offset + sizeof(u_int16_t)) > m->m_len) {
991 /* This happen when ip options were inserted
992 printf("in_delayed_cksum: pullup len %d off %d proto %d\n",
993 m->m_len, offset, ip->ip_p);
994 */
995 m_copyback(m, offset, sizeof(csum), (void *) &csum);
996 } else
997 *(u_int16_t *)(mtod(m, char *) + offset) = csum;
998 }
999
1000 /*
1001 * Determine the maximum length of the options to be inserted;
1002 * we would far rather allocate too much space rather than too little.
1003 */
1004
1005 u_int
1006 ip_optlen(struct inpcb *inp)
1007 {
1008 struct mbuf *m = inp->inp_options;
1009
1010 if (m && m->m_len > offsetof(struct ipoption, ipopt_dst)) {
1011 return (m->m_len - offsetof(struct ipoption, ipopt_dst));
1012 }
1013 return 0;
1014 }
1015
1016 /*
1017 * Insert IP options into preformed packet.
1018 * Adjust IP destination as required for IP source routing,
1019 * as indicated by a non-zero in_addr at the start of the options.
1020 */
1021 static struct mbuf *
1022 ip_insertoptions(struct mbuf *m, struct mbuf *opt, int *phlen)
1023 {
1024 struct ipoption *p = mtod(opt, struct ipoption *);
1025 struct mbuf *n;
1026 struct ip *ip = mtod(m, struct ip *);
1027 unsigned optlen;
1028
1029 optlen = opt->m_len - sizeof(p->ipopt_dst);
1030 if (optlen + ntohs(ip->ip_len) > IP_MAXPACKET)
1031 return (m); /* XXX should fail */
1032 if (!in_nullhost(p->ipopt_dst))
1033 ip->ip_dst = p->ipopt_dst;
1034 if (M_READONLY(m) || M_LEADINGSPACE(m) < optlen) {
1035 MGETHDR(n, M_DONTWAIT, MT_HEADER);
1036 if (n == 0)
1037 return (m);
1038 MCLAIM(n, m->m_owner);
1039 M_MOVE_PKTHDR(n, m);
1040 m->m_len -= sizeof(struct ip);
1041 m->m_data += sizeof(struct ip);
1042 n->m_next = m;
1043 m = n;
1044 m->m_len = optlen + sizeof(struct ip);
1045 m->m_data += max_linkhdr;
1046 bcopy((void *)ip, mtod(m, void *), sizeof(struct ip));
1047 } else {
1048 m->m_data -= optlen;
1049 m->m_len += optlen;
1050 memmove(mtod(m, void *), ip, sizeof(struct ip));
1051 }
1052 m->m_pkthdr.len += optlen;
1053 ip = mtod(m, struct ip *);
1054 bcopy((void *)p->ipopt_list, (void *)(ip + 1), (unsigned)optlen);
1055 *phlen = sizeof(struct ip) + optlen;
1056 ip->ip_len = htons(ntohs(ip->ip_len) + optlen);
1057 return (m);
1058 }
1059
1060 /*
1061 * Copy options from ip to jp,
1062 * omitting those not copied during fragmentation.
1063 */
1064 int
1065 ip_optcopy(struct ip *ip, struct ip *jp)
1066 {
1067 u_char *cp, *dp;
1068 int opt, optlen, cnt;
1069
1070 cp = (u_char *)(ip + 1);
1071 dp = (u_char *)(jp + 1);
1072 cnt = (ip->ip_hl << 2) - sizeof (struct ip);
1073 for (; cnt > 0; cnt -= optlen, cp += optlen) {
1074 opt = cp[0];
1075 if (opt == IPOPT_EOL)
1076 break;
1077 if (opt == IPOPT_NOP) {
1078 /* Preserve for IP mcast tunnel's LSRR alignment. */
1079 *dp++ = IPOPT_NOP;
1080 optlen = 1;
1081 continue;
1082 }
1083
1084 KASSERT(cnt >= IPOPT_OLEN + sizeof(*cp));
1085 optlen = cp[IPOPT_OLEN];
1086 KASSERT(optlen >= IPOPT_OLEN + sizeof(*cp) && optlen < cnt);
1087
1088 /* Invalid lengths should have been caught by ip_dooptions. */
1089 if (optlen > cnt)
1090 optlen = cnt;
1091 if (IPOPT_COPIED(opt)) {
1092 bcopy((void *)cp, (void *)dp, (unsigned)optlen);
1093 dp += optlen;
1094 }
1095 }
1096 for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++)
1097 *dp++ = IPOPT_EOL;
1098 return (optlen);
1099 }
1100
1101 /*
1102 * IP socket option processing.
1103 */
1104 int
1105 ip_ctloutput(int op, struct socket *so, struct sockopt *sopt)
1106 {
1107 struct inpcb *inp = sotoinpcb(so);
1108 struct ip *ip = &inp->inp_ip;
1109 int inpflags = inp->inp_flags;
1110 int optval = 0, error = 0;
1111
1112 if (sopt->sopt_level != IPPROTO_IP) {
1113 if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_NOHEADER)
1114 return 0;
1115 return ENOPROTOOPT;
1116 }
1117
1118 switch (op) {
1119 case PRCO_SETOPT:
1120 switch (sopt->sopt_name) {
1121 case IP_OPTIONS:
1122 #ifdef notyet
1123 case IP_RETOPTS:
1124 #endif
1125 error = ip_pcbopts(inp, sopt);
1126 break;
1127
1128 case IP_TOS:
1129 case IP_TTL:
1130 case IP_MINTTL:
1131 case IP_PKTINFO:
1132 case IP_RECVOPTS:
1133 case IP_RECVRETOPTS:
1134 case IP_RECVDSTADDR:
1135 case IP_RECVIF:
1136 case IP_RECVPKTINFO:
1137 case IP_RECVTTL:
1138 error = sockopt_getint(sopt, &optval);
1139 if (error)
1140 break;
1141
1142 switch (sopt->sopt_name) {
1143 case IP_TOS:
1144 ip->ip_tos = optval;
1145 break;
1146
1147 case IP_TTL:
1148 ip->ip_ttl = optval;
1149 break;
1150
1151 case IP_MINTTL:
1152 if (optval > 0 && optval <= MAXTTL)
1153 inp->inp_ip_minttl = optval;
1154 else
1155 error = EINVAL;
1156 break;
1157 #define OPTSET(bit) \
1158 if (optval) \
1159 inpflags |= bit; \
1160 else \
1161 inpflags &= ~bit;
1162
1163 case IP_PKTINFO:
1164 OPTSET(INP_PKTINFO);
1165 break;
1166
1167 case IP_RECVOPTS:
1168 OPTSET(INP_RECVOPTS);
1169 break;
1170
1171 case IP_RECVPKTINFO:
1172 OPTSET(INP_RECVPKTINFO);
1173 break;
1174
1175 case IP_RECVRETOPTS:
1176 OPTSET(INP_RECVRETOPTS);
1177 break;
1178
1179 case IP_RECVDSTADDR:
1180 OPTSET(INP_RECVDSTADDR);
1181 break;
1182
1183 case IP_RECVIF:
1184 OPTSET(INP_RECVIF);
1185 break;
1186
1187 case IP_RECVTTL:
1188 OPTSET(INP_RECVTTL);
1189 break;
1190 }
1191 break;
1192 #undef OPTSET
1193
1194 case IP_MULTICAST_IF:
1195 case IP_MULTICAST_TTL:
1196 case IP_MULTICAST_LOOP:
1197 case IP_ADD_MEMBERSHIP:
1198 case IP_DROP_MEMBERSHIP:
1199 error = ip_setmoptions(&inp->inp_moptions, sopt);
1200 break;
1201
1202 case IP_PORTRANGE:
1203 error = sockopt_getint(sopt, &optval);
1204 if (error)
1205 break;
1206
1207 switch (optval) {
1208 case IP_PORTRANGE_DEFAULT:
1209 case IP_PORTRANGE_HIGH:
1210 inpflags &= ~(INP_LOWPORT);
1211 break;
1212
1213 case IP_PORTRANGE_LOW:
1214 inpflags |= INP_LOWPORT;
1215 break;
1216
1217 default:
1218 error = EINVAL;
1219 break;
1220 }
1221 break;
1222
1223 case IP_PORTALGO:
1224 error = sockopt_getint(sopt, &optval);
1225 if (error)
1226 break;
1227
1228 error = portalgo_algo_index_select(
1229 (struct inpcb_hdr *)inp, optval);
1230 break;
1231
1232 #if defined(IPSEC)
1233 case IP_IPSEC_POLICY:
1234 if (ipsec_enabled) {
1235 error = ipsec4_set_policy(inp, sopt->sopt_name,
1236 sopt->sopt_data, sopt->sopt_size,
1237 curlwp->l_cred);
1238 break;
1239 }
1240 /*FALLTHROUGH*/
1241 #endif /* IPSEC */
1242
1243 default:
1244 error = ENOPROTOOPT;
1245 break;
1246 }
1247 break;
1248
1249 case PRCO_GETOPT:
1250 switch (sopt->sopt_name) {
1251 case IP_OPTIONS:
1252 case IP_RETOPTS: {
1253 struct mbuf *mopts = inp->inp_options;
1254
1255 if (mopts) {
1256 struct mbuf *m;
1257
1258 m = m_copym(mopts, 0, M_COPYALL, M_DONTWAIT);
1259 if (m == NULL) {
1260 error = ENOBUFS;
1261 break;
1262 }
1263 error = sockopt_setmbuf(sopt, m);
1264 }
1265 break;
1266 }
1267 case IP_PKTINFO:
1268 case IP_TOS:
1269 case IP_TTL:
1270 case IP_MINTTL:
1271 case IP_RECVOPTS:
1272 case IP_RECVRETOPTS:
1273 case IP_RECVDSTADDR:
1274 case IP_RECVIF:
1275 case IP_RECVPKTINFO:
1276 case IP_RECVTTL:
1277 case IP_ERRORMTU:
1278 switch (sopt->sopt_name) {
1279 case IP_TOS:
1280 optval = ip->ip_tos;
1281 break;
1282
1283 case IP_TTL:
1284 optval = ip->ip_ttl;
1285 break;
1286
1287 case IP_MINTTL:
1288 optval = inp->inp_ip_minttl;
1289 break;
1290
1291 case IP_ERRORMTU:
1292 optval = inp->inp_errormtu;
1293 break;
1294
1295 #define OPTBIT(bit) (inpflags & bit ? 1 : 0)
1296
1297 case IP_PKTINFO:
1298 optval = OPTBIT(INP_PKTINFO);
1299 break;
1300
1301 case IP_RECVOPTS:
1302 optval = OPTBIT(INP_RECVOPTS);
1303 break;
1304
1305 case IP_RECVPKTINFO:
1306 optval = OPTBIT(INP_RECVPKTINFO);
1307 break;
1308
1309 case IP_RECVRETOPTS:
1310 optval = OPTBIT(INP_RECVRETOPTS);
1311 break;
1312
1313 case IP_RECVDSTADDR:
1314 optval = OPTBIT(INP_RECVDSTADDR);
1315 break;
1316
1317 case IP_RECVIF:
1318 optval = OPTBIT(INP_RECVIF);
1319 break;
1320
1321 case IP_RECVTTL:
1322 optval = OPTBIT(INP_RECVTTL);
1323 break;
1324 }
1325 error = sockopt_setint(sopt, optval);
1326 break;
1327
1328 #if 0 /* defined(IPSEC) */
1329 case IP_IPSEC_POLICY:
1330 {
1331 struct mbuf *m = NULL;
1332
1333 /* XXX this will return EINVAL as sopt is empty */
1334 error = ipsec4_get_policy(inp, sopt->sopt_data,
1335 sopt->sopt_size, &m);
1336 if (error == 0)
1337 error = sockopt_setmbuf(sopt, m);
1338 break;
1339 }
1340 #endif /*IPSEC*/
1341
1342 case IP_MULTICAST_IF:
1343 case IP_MULTICAST_TTL:
1344 case IP_MULTICAST_LOOP:
1345 case IP_ADD_MEMBERSHIP:
1346 case IP_DROP_MEMBERSHIP:
1347 error = ip_getmoptions(inp->inp_moptions, sopt);
1348 break;
1349
1350 case IP_PORTRANGE:
1351 if (inpflags & INP_LOWPORT)
1352 optval = IP_PORTRANGE_LOW;
1353 else
1354 optval = IP_PORTRANGE_DEFAULT;
1355 error = sockopt_setint(sopt, optval);
1356 break;
1357
1358 case IP_PORTALGO:
1359 optval = inp->inp_portalgo;
1360 error = sockopt_setint(sopt, optval);
1361 break;
1362
1363 default:
1364 error = ENOPROTOOPT;
1365 break;
1366 }
1367 break;
1368 }
1369
1370 if (!error) {
1371 inp->inp_flags = inpflags;
1372 }
1373 return error;
1374 }
1375
1376 /*
1377 * Set up IP options in pcb for insertion in output packets.
1378 * Store in mbuf with pointer in pcbopt, adding pseudo-option
1379 * with destination address if source routed.
1380 */
1381 static int
1382 ip_pcbopts(struct inpcb *inp, const struct sockopt *sopt)
1383 {
1384 struct mbuf *m;
1385 const u_char *cp;
1386 u_char *dp;
1387 int cnt;
1388
1389 /* Turn off any old options. */
1390 if (inp->inp_options) {
1391 m_free(inp->inp_options);
1392 }
1393 inp->inp_options = NULL;
1394 if ((cnt = sopt->sopt_size) == 0) {
1395 /* Only turning off any previous options. */
1396 return 0;
1397 }
1398 cp = sopt->sopt_data;
1399
1400 #ifndef __vax__
1401 if (cnt % sizeof(int32_t))
1402 return (EINVAL);
1403 #endif
1404
1405 m = m_get(M_DONTWAIT, MT_SOOPTS);
1406 if (m == NULL)
1407 return (ENOBUFS);
1408
1409 dp = mtod(m, u_char *);
1410 memset(dp, 0, sizeof(struct in_addr));
1411 dp += sizeof(struct in_addr);
1412 m->m_len = sizeof(struct in_addr);
1413
1414 /*
1415 * IP option list according to RFC791. Each option is of the form
1416 *
1417 * [optval] [olen] [(olen - 2) data bytes]
1418 *
1419 * We validate the list and copy options to an mbuf for prepending
1420 * to data packets. The IP first-hop destination address will be
1421 * stored before actual options and is zero if unset.
1422 */
1423 while (cnt > 0) {
1424 uint8_t optval, olen, offset;
1425
1426 optval = cp[IPOPT_OPTVAL];
1427
1428 if (optval == IPOPT_EOL || optval == IPOPT_NOP) {
1429 olen = 1;
1430 } else {
1431 if (cnt < IPOPT_OLEN + 1)
1432 goto bad;
1433
1434 olen = cp[IPOPT_OLEN];
1435 if (olen < IPOPT_OLEN + 1 || olen > cnt)
1436 goto bad;
1437 }
1438
1439 if (optval == IPOPT_LSRR || optval == IPOPT_SSRR) {
1440 /*
1441 * user process specifies route as:
1442 * ->A->B->C->D
1443 * D must be our final destination (but we can't
1444 * check that since we may not have connected yet).
1445 * A is first hop destination, which doesn't appear in
1446 * actual IP option, but is stored before the options.
1447 */
1448 if (olen < IPOPT_OFFSET + 1 + sizeof(struct in_addr))
1449 goto bad;
1450
1451 offset = cp[IPOPT_OFFSET];
1452 memcpy(mtod(m, u_char *), cp + IPOPT_OFFSET + 1,
1453 sizeof(struct in_addr));
1454
1455 cp += sizeof(struct in_addr);
1456 cnt -= sizeof(struct in_addr);
1457 olen -= sizeof(struct in_addr);
1458
1459 if (m->m_len + olen > MAX_IPOPTLEN + sizeof(struct in_addr))
1460 goto bad;
1461
1462 memcpy(dp, cp, olen);
1463 dp[IPOPT_OPTVAL] = optval;
1464 dp[IPOPT_OLEN] = olen;
1465 dp[IPOPT_OFFSET] = offset;
1466 break;
1467 } else {
1468 if (m->m_len + olen > MAX_IPOPTLEN + sizeof(struct in_addr))
1469 goto bad;
1470
1471 memcpy(dp, cp, olen);
1472 break;
1473 }
1474
1475 dp += olen;
1476 m->m_len += olen;
1477
1478 if (optval == IPOPT_EOL)
1479 break;
1480
1481 cp += olen;
1482 cnt -= olen;
1483 }
1484
1485 inp->inp_options = m;
1486 return 0;
1487 bad:
1488 (void)m_free(m);
1489 return EINVAL;
1490 }
1491
1492 /*
1493 * following RFC1724 section 3.3, 0.0.0.0/8 is interpreted as interface index.
1494 */
1495 static struct ifnet *
1496 ip_multicast_if(struct in_addr *a, int *ifindexp)
1497 {
1498 int ifindex;
1499 struct ifnet *ifp = NULL;
1500 struct in_ifaddr *ia;
1501
1502 if (ifindexp)
1503 *ifindexp = 0;
1504 if (ntohl(a->s_addr) >> 24 == 0) {
1505 ifindex = ntohl(a->s_addr) & 0xffffff;
1506 ifp = if_byindex(ifindex);
1507 if (!ifp)
1508 return NULL;
1509 if (ifindexp)
1510 *ifindexp = ifindex;
1511 } else {
1512 LIST_FOREACH(ia, &IN_IFADDR_HASH(a->s_addr), ia_hash) {
1513 if (in_hosteq(ia->ia_addr.sin_addr, *a) &&
1514 (ia->ia_ifp->if_flags & IFF_MULTICAST) != 0) {
1515 ifp = ia->ia_ifp;
1516 break;
1517 }
1518 }
1519 }
1520 return ifp;
1521 }
1522
1523 static int
1524 ip_getoptval(const struct sockopt *sopt, u_int8_t *val, u_int maxval)
1525 {
1526 u_int tval;
1527 u_char cval;
1528 int error;
1529
1530 if (sopt == NULL)
1531 return EINVAL;
1532
1533 switch (sopt->sopt_size) {
1534 case sizeof(u_char):
1535 error = sockopt_get(sopt, &cval, sizeof(u_char));
1536 tval = cval;
1537 break;
1538
1539 case sizeof(u_int):
1540 error = sockopt_get(sopt, &tval, sizeof(u_int));
1541 break;
1542
1543 default:
1544 error = EINVAL;
1545 }
1546
1547 if (error)
1548 return error;
1549
1550 if (tval > maxval)
1551 return EINVAL;
1552
1553 *val = tval;
1554 return 0;
1555 }
1556
1557 static int
1558 ip_get_membership(const struct sockopt *sopt, struct ifnet **ifp,
1559 struct in_addr *ia, bool add)
1560 {
1561 int error;
1562 struct ip_mreq mreq;
1563
1564 error = sockopt_get(sopt, &mreq, sizeof(mreq));
1565 if (error)
1566 return error;
1567
1568 if (!IN_MULTICAST(mreq.imr_multiaddr.s_addr))
1569 return EINVAL;
1570
1571 memcpy(ia, &mreq.imr_multiaddr, sizeof(*ia));
1572
1573 if (in_nullhost(mreq.imr_interface)) {
1574 union {
1575 struct sockaddr dst;
1576 struct sockaddr_in dst4;
1577 } u;
1578 struct route ro;
1579
1580 if (!add) {
1581 *ifp = NULL;
1582 return 0;
1583 }
1584 /*
1585 * If no interface address was provided, use the interface of
1586 * the route to the given multicast address.
1587 */
1588 struct rtentry *rt;
1589 memset(&ro, 0, sizeof(ro));
1590
1591 sockaddr_in_init(&u.dst4, ia, 0);
1592 error = rtcache_setdst(&ro, &u.dst);
1593 if (error != 0)
1594 return error;
1595 *ifp = (rt = rtcache_init(&ro)) != NULL ? rt->rt_ifp : NULL;
1596 rtcache_free(&ro);
1597 } else {
1598 *ifp = ip_multicast_if(&mreq.imr_interface, NULL);
1599 if (!add && *ifp == NULL)
1600 return EADDRNOTAVAIL;
1601 }
1602 return 0;
1603 }
1604
1605 /*
1606 * Add a multicast group membership.
1607 * Group must be a valid IP multicast address.
1608 */
1609 static int
1610 ip_add_membership(struct ip_moptions *imo, const struct sockopt *sopt)
1611 {
1612 struct ifnet *ifp;
1613 struct in_addr ia;
1614 int i, error;
1615
1616 if (sopt->sopt_size == sizeof(struct ip_mreq))
1617 error = ip_get_membership(sopt, &ifp, &ia, true);
1618 else
1619 #ifdef INET6
1620 error = ip6_get_membership(sopt, &ifp, &ia, sizeof(ia));
1621 #else
1622 return EINVAL;
1623 #endif
1624
1625 if (error)
1626 return error;
1627
1628 /*
1629 * See if we found an interface, and confirm that it
1630 * supports multicast.
1631 */
1632 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0)
1633 return EADDRNOTAVAIL;
1634
1635 /*
1636 * See if the membership already exists or if all the
1637 * membership slots are full.
1638 */
1639 for (i = 0; i < imo->imo_num_memberships; ++i) {
1640 if (imo->imo_membership[i]->inm_ifp == ifp &&
1641 in_hosteq(imo->imo_membership[i]->inm_addr, ia))
1642 break;
1643 }
1644 if (i < imo->imo_num_memberships)
1645 return EADDRINUSE;
1646
1647 if (i == IP_MAX_MEMBERSHIPS)
1648 return ETOOMANYREFS;
1649
1650 /*
1651 * Everything looks good; add a new record to the multicast
1652 * address list for the given interface.
1653 */
1654 if ((imo->imo_membership[i] = in_addmulti(&ia, ifp)) == NULL)
1655 return ENOBUFS;
1656
1657 ++imo->imo_num_memberships;
1658 return 0;
1659 }
1660
1661 /*
1662 * Drop a multicast group membership.
1663 * Group must be a valid IP multicast address.
1664 */
1665 static int
1666 ip_drop_membership(struct ip_moptions *imo, const struct sockopt *sopt)
1667 {
1668 struct in_addr ia;
1669 struct ifnet *ifp;
1670 int i, error;
1671
1672 if (sopt->sopt_size == sizeof(struct ip_mreq))
1673 error = ip_get_membership(sopt, &ifp, &ia, false);
1674 else
1675 #ifdef INET6
1676 error = ip6_get_membership(sopt, &ifp, &ia, sizeof(ia));
1677 #else
1678 return EINVAL;
1679 #endif
1680
1681 if (error)
1682 return error;
1683
1684 /*
1685 * Find the membership in the membership array.
1686 */
1687 for (i = 0; i < imo->imo_num_memberships; ++i) {
1688 if ((ifp == NULL ||
1689 imo->imo_membership[i]->inm_ifp == ifp) &&
1690 in_hosteq(imo->imo_membership[i]->inm_addr, ia))
1691 break;
1692 }
1693 if (i == imo->imo_num_memberships)
1694 return EADDRNOTAVAIL;
1695
1696 /*
1697 * Give up the multicast address record to which the
1698 * membership points.
1699 */
1700 in_delmulti(imo->imo_membership[i]);
1701
1702 /*
1703 * Remove the gap in the membership array.
1704 */
1705 for (++i; i < imo->imo_num_memberships; ++i)
1706 imo->imo_membership[i-1] = imo->imo_membership[i];
1707 --imo->imo_num_memberships;
1708 return 0;
1709 }
1710
1711 /*
1712 * Set the IP multicast options in response to user setsockopt().
1713 */
1714 int
1715 ip_setmoptions(struct ip_moptions **pimo, const struct sockopt *sopt)
1716 {
1717 struct ip_moptions *imo = *pimo;
1718 struct in_addr addr;
1719 struct ifnet *ifp;
1720 int ifindex, error = 0;
1721
1722 if (!imo) {
1723 /*
1724 * No multicast option buffer attached to the pcb;
1725 * allocate one and initialize to default values.
1726 */
1727 imo = kmem_intr_alloc(sizeof(*imo), KM_NOSLEEP);
1728 if (imo == NULL)
1729 return ENOBUFS;
1730
1731 imo->imo_multicast_ifp = NULL;
1732 imo->imo_multicast_addr.s_addr = INADDR_ANY;
1733 imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1734 imo->imo_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
1735 imo->imo_num_memberships = 0;
1736 *pimo = imo;
1737 }
1738
1739 switch (sopt->sopt_name) {
1740 case IP_MULTICAST_IF:
1741 /*
1742 * Select the interface for outgoing multicast packets.
1743 */
1744 error = sockopt_get(sopt, &addr, sizeof(addr));
1745 if (error)
1746 break;
1747
1748 /*
1749 * INADDR_ANY is used to remove a previous selection.
1750 * When no interface is selected, a default one is
1751 * chosen every time a multicast packet is sent.
1752 */
1753 if (in_nullhost(addr)) {
1754 imo->imo_multicast_ifp = NULL;
1755 break;
1756 }
1757 /*
1758 * The selected interface is identified by its local
1759 * IP address. Find the interface and confirm that
1760 * it supports multicasting.
1761 */
1762 ifp = ip_multicast_if(&addr, &ifindex);
1763 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1764 error = EADDRNOTAVAIL;
1765 break;
1766 }
1767 imo->imo_multicast_ifp = ifp;
1768 if (ifindex)
1769 imo->imo_multicast_addr = addr;
1770 else
1771 imo->imo_multicast_addr.s_addr = INADDR_ANY;
1772 break;
1773
1774 case IP_MULTICAST_TTL:
1775 /*
1776 * Set the IP time-to-live for outgoing multicast packets.
1777 */
1778 error = ip_getoptval(sopt, &imo->imo_multicast_ttl, MAXTTL);
1779 break;
1780
1781 case IP_MULTICAST_LOOP:
1782 /*
1783 * Set the loopback flag for outgoing multicast packets.
1784 * Must be zero or one.
1785 */
1786 error = ip_getoptval(sopt, &imo->imo_multicast_loop, 1);
1787 break;
1788
1789 case IP_ADD_MEMBERSHIP: /* IPV6_JOIN_GROUP */
1790 error = ip_add_membership(imo, sopt);
1791 break;
1792
1793 case IP_DROP_MEMBERSHIP: /* IPV6_LEAVE_GROUP */
1794 error = ip_drop_membership(imo, sopt);
1795 break;
1796
1797 default:
1798 error = EOPNOTSUPP;
1799 break;
1800 }
1801
1802 /*
1803 * If all options have default values, no need to keep the mbuf.
1804 */
1805 if (imo->imo_multicast_ifp == NULL &&
1806 imo->imo_multicast_ttl == IP_DEFAULT_MULTICAST_TTL &&
1807 imo->imo_multicast_loop == IP_DEFAULT_MULTICAST_LOOP &&
1808 imo->imo_num_memberships == 0) {
1809 kmem_free(imo, sizeof(*imo));
1810 *pimo = NULL;
1811 }
1812
1813 return error;
1814 }
1815
1816 /*
1817 * Return the IP multicast options in response to user getsockopt().
1818 */
1819 int
1820 ip_getmoptions(struct ip_moptions *imo, struct sockopt *sopt)
1821 {
1822 struct in_addr addr;
1823 struct in_ifaddr *ia;
1824 uint8_t optval;
1825 int error = 0;
1826
1827 switch (sopt->sopt_name) {
1828 case IP_MULTICAST_IF:
1829 if (imo == NULL || imo->imo_multicast_ifp == NULL)
1830 addr = zeroin_addr;
1831 else if (imo->imo_multicast_addr.s_addr) {
1832 /* return the value user has set */
1833 addr = imo->imo_multicast_addr;
1834 } else {
1835 IFP_TO_IA(imo->imo_multicast_ifp, ia);
1836 addr = ia ? ia->ia_addr.sin_addr : zeroin_addr;
1837 }
1838 error = sockopt_set(sopt, &addr, sizeof(addr));
1839 break;
1840
1841 case IP_MULTICAST_TTL:
1842 optval = imo ? imo->imo_multicast_ttl
1843 : IP_DEFAULT_MULTICAST_TTL;
1844
1845 error = sockopt_set(sopt, &optval, sizeof(optval));
1846 break;
1847
1848 case IP_MULTICAST_LOOP:
1849 optval = imo ? imo->imo_multicast_loop
1850 : IP_DEFAULT_MULTICAST_LOOP;
1851
1852 error = sockopt_set(sopt, &optval, sizeof(optval));
1853 break;
1854
1855 default:
1856 error = EOPNOTSUPP;
1857 }
1858
1859 return error;
1860 }
1861
1862 /*
1863 * Discard the IP multicast options.
1864 */
1865 void
1866 ip_freemoptions(struct ip_moptions *imo)
1867 {
1868 int i;
1869
1870 if (imo != NULL) {
1871 for (i = 0; i < imo->imo_num_memberships; ++i)
1872 in_delmulti(imo->imo_membership[i]);
1873 kmem_free(imo, sizeof(*imo));
1874 }
1875 }
1876
1877 /*
1878 * Routine called from ip_output() to loop back a copy of an IP multicast
1879 * packet to the input queue of a specified interface. Note that this
1880 * calls the output routine of the loopback "driver", but with an interface
1881 * pointer that might NOT be lo0ifp -- easier than replicating that code here.
1882 */
1883 static void
1884 ip_mloopback(struct ifnet *ifp, struct mbuf *m, const struct sockaddr_in *dst)
1885 {
1886 struct ip *ip;
1887 struct mbuf *copym;
1888
1889 copym = m_copypacket(m, M_DONTWAIT);
1890 if (copym != NULL &&
1891 (copym->m_flags & M_EXT || copym->m_len < sizeof(struct ip)))
1892 copym = m_pullup(copym, sizeof(struct ip));
1893 if (copym == NULL)
1894 return;
1895 /*
1896 * We don't bother to fragment if the IP length is greater
1897 * than the interface's MTU. Can this possibly matter?
1898 */
1899 ip = mtod(copym, struct ip *);
1900
1901 if (copym->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) {
1902 in_delayed_cksum(copym);
1903 copym->m_pkthdr.csum_flags &=
1904 ~(M_CSUM_TCPv4|M_CSUM_UDPv4);
1905 }
1906
1907 ip->ip_sum = 0;
1908 ip->ip_sum = in_cksum(copym, ip->ip_hl << 2);
1909 #ifndef NET_MPSAFE
1910 KERNEL_LOCK(1, NULL);
1911 #endif
1912 (void)looutput(ifp, copym, sintocsa(dst), NULL);
1913 #ifndef NET_MPSAFE
1914 KERNEL_UNLOCK_ONE(NULL);
1915 #endif
1916 }
1917