ip_output.c revision 1.282
1 /* $NetBSD: ip_output.c,v 1.282 2017/07/04 10:25:45 roy Exp $ */ 2 3 /* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /*- 33 * Copyright (c) 1998 The NetBSD Foundation, Inc. 34 * All rights reserved. 35 * 36 * This code is derived from software contributed to The NetBSD Foundation 37 * by Public Access Networks Corporation ("Panix"). It was developed under 38 * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon. 39 * 40 * Redistribution and use in source and binary forms, with or without 41 * modification, are permitted provided that the following conditions 42 * are met: 43 * 1. Redistributions of source code must retain the above copyright 44 * notice, this list of conditions and the following disclaimer. 45 * 2. Redistributions in binary form must reproduce the above copyright 46 * notice, this list of conditions and the following disclaimer in the 47 * documentation and/or other materials provided with the distribution. 48 * 49 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 50 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 51 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 52 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 53 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 54 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 55 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 56 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 57 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 58 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 59 * POSSIBILITY OF SUCH DAMAGE. 60 */ 61 62 /* 63 * Copyright (c) 1982, 1986, 1988, 1990, 1993 64 * The Regents of the University of California. All rights reserved. 65 * 66 * Redistribution and use in source and binary forms, with or without 67 * modification, are permitted provided that the following conditions 68 * are met: 69 * 1. Redistributions of source code must retain the above copyright 70 * notice, this list of conditions and the following disclaimer. 71 * 2. Redistributions in binary form must reproduce the above copyright 72 * notice, this list of conditions and the following disclaimer in the 73 * documentation and/or other materials provided with the distribution. 74 * 3. Neither the name of the University nor the names of its contributors 75 * may be used to endorse or promote products derived from this software 76 * without specific prior written permission. 77 * 78 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 79 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 80 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 81 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 82 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 83 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 84 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 85 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 86 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 87 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 88 * SUCH DAMAGE. 89 * 90 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94 91 */ 92 93 #include <sys/cdefs.h> 94 __KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.282 2017/07/04 10:25:45 roy Exp $"); 95 96 #ifdef _KERNEL_OPT 97 #include "opt_inet.h" 98 #include "opt_ipsec.h" 99 #include "opt_mrouting.h" 100 #include "opt_net_mpsafe.h" 101 #include "opt_mpls.h" 102 #endif 103 104 #include "arp.h" 105 106 #include <sys/param.h> 107 #include <sys/kmem.h> 108 #include <sys/mbuf.h> 109 #include <sys/socket.h> 110 #include <sys/socketvar.h> 111 #include <sys/kauth.h> 112 #include <sys/systm.h> 113 #include <sys/syslog.h> 114 115 #include <net/if.h> 116 #include <net/if_types.h> 117 #include <net/route.h> 118 #include <net/pfil.h> 119 120 #include <netinet/in.h> 121 #include <netinet/in_systm.h> 122 #include <netinet/ip.h> 123 #include <netinet/in_pcb.h> 124 #include <netinet/in_var.h> 125 #include <netinet/ip_var.h> 126 #include <netinet/ip_private.h> 127 #include <netinet/in_offload.h> 128 #include <netinet/portalgo.h> 129 #include <netinet/udp.h> 130 131 #ifdef INET6 132 #include <netinet6/ip6_var.h> 133 #endif 134 135 #ifdef MROUTING 136 #include <netinet/ip_mroute.h> 137 #endif 138 139 #ifdef IPSEC 140 #include <netipsec/ipsec.h> 141 #include <netipsec/key.h> 142 #endif 143 144 #ifdef MPLS 145 #include <netmpls/mpls.h> 146 #include <netmpls/mpls_var.h> 147 #endif 148 149 static int ip_pcbopts(struct inpcb *, const struct sockopt *); 150 static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *); 151 static struct ifnet *ip_multicast_if(struct in_addr *, int *); 152 static void ip_mloopback(struct ifnet *, struct mbuf *, 153 const struct sockaddr_in *); 154 static int ip_ifaddrvalid(const struct in_ifaddr *); 155 156 extern pfil_head_t *inet_pfil_hook; /* XXX */ 157 158 int ip_do_loopback_cksum = 0; 159 160 static int 161 ip_mark_mpls(struct ifnet * const ifp, struct mbuf * const m, 162 const struct rtentry *rt) 163 { 164 int error = 0; 165 #ifdef MPLS 166 union mpls_shim msh; 167 168 if (rt == NULL || rt_gettag(rt) == NULL || 169 rt_gettag(rt)->sa_family != AF_MPLS || 170 (m->m_flags & (M_MCAST | M_BCAST)) != 0 || 171 ifp->if_type != IFT_ETHER) 172 return 0; 173 174 msh.s_addr = MPLS_GETSADDR(rt); 175 if (msh.shim.label != MPLS_LABEL_IMPLNULL) { 176 struct m_tag *mtag; 177 /* 178 * XXX tentative solution to tell ether_output 179 * it's MPLS. Need some more efficient solution. 180 */ 181 mtag = m_tag_get(PACKET_TAG_MPLS, 182 sizeof(int) /* dummy */, 183 M_NOWAIT); 184 if (mtag == NULL) 185 return ENOMEM; 186 m_tag_prepend(m, mtag); 187 } 188 #endif 189 return error; 190 } 191 192 /* 193 * Send an IP packet to a host. 194 */ 195 int 196 ip_if_output(struct ifnet * const ifp, struct mbuf * const m, 197 const struct sockaddr * const dst, const struct rtentry *rt) 198 { 199 int error = 0; 200 201 if (rt != NULL) { 202 error = rt_check_reject_route(rt, ifp); 203 if (error != 0) { 204 m_freem(m); 205 return error; 206 } 207 } 208 209 error = ip_mark_mpls(ifp, m, rt); 210 if (error != 0) { 211 m_freem(m); 212 return error; 213 } 214 215 error = if_output_lock(ifp, ifp, m, dst, rt); 216 217 return error; 218 } 219 220 /* 221 * IP output. The packet in mbuf chain m contains a skeletal IP 222 * header (with len, off, ttl, proto, tos, src, dst). 223 * The mbuf chain containing the packet will be freed. 224 * The mbuf opt, if present, will not be freed. 225 */ 226 int 227 ip_output(struct mbuf *m0, struct mbuf *opt, struct route *ro, int flags, 228 struct ip_moptions *imo, struct inpcb *inp) 229 { 230 struct rtentry *rt; 231 struct ip *ip; 232 struct ifnet *ifp, *mifp = NULL; 233 struct mbuf *m = m0; 234 int hlen = sizeof (struct ip); 235 int len, error = 0; 236 struct route iproute; 237 const struct sockaddr_in *dst; 238 struct in_ifaddr *ia = NULL; 239 struct ifaddr *ifa; 240 int isbroadcast; 241 int sw_csum; 242 u_long mtu; 243 bool natt_frag = false; 244 bool rtmtu_nolock; 245 union { 246 struct sockaddr sa; 247 struct sockaddr_in sin; 248 } udst, usrc; 249 struct sockaddr *rdst = &udst.sa; /* real IP destination, as 250 * opposed to the nexthop 251 */ 252 struct psref psref, psref_ia; 253 int bound; 254 bool bind_need_restore = false; 255 256 len = 0; 257 258 MCLAIM(m, &ip_tx_mowner); 259 260 KASSERT((m->m_flags & M_PKTHDR) != 0); 261 KASSERT((m->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) == 0); 262 KASSERT((m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) != 263 (M_CSUM_TCPv4|M_CSUM_UDPv4)); 264 265 if (opt) { 266 m = ip_insertoptions(m, opt, &len); 267 if (len >= sizeof(struct ip)) 268 hlen = len; 269 } 270 ip = mtod(m, struct ip *); 271 272 /* 273 * Fill in IP header. 274 */ 275 if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) { 276 ip->ip_v = IPVERSION; 277 ip->ip_off = htons(0); 278 /* ip->ip_id filled in after we find out source ia */ 279 ip->ip_hl = hlen >> 2; 280 IP_STATINC(IP_STAT_LOCALOUT); 281 } else { 282 hlen = ip->ip_hl << 2; 283 } 284 285 /* 286 * Route packet. 287 */ 288 if (ro == NULL) { 289 memset(&iproute, 0, sizeof(iproute)); 290 ro = &iproute; 291 } 292 sockaddr_in_init(&udst.sin, &ip->ip_dst, 0); 293 dst = satocsin(rtcache_getdst(ro)); 294 295 /* 296 * If there is a cached route, check that it is to the same 297 * destination and is still up. If not, free it and try again. 298 * The address family should also be checked in case of sharing 299 * the cache with IPv6. 300 */ 301 if (dst && (dst->sin_family != AF_INET || 302 !in_hosteq(dst->sin_addr, ip->ip_dst))) 303 rtcache_free(ro); 304 305 if ((rt = rtcache_validate(ro)) == NULL && 306 (rt = rtcache_update(ro, 1)) == NULL) { 307 dst = &udst.sin; 308 error = rtcache_setdst(ro, &udst.sa); 309 if (error != 0) 310 goto bad; 311 } 312 313 bound = curlwp_bind(); 314 bind_need_restore = true; 315 /* 316 * If routing to interface only, short circuit routing lookup. 317 */ 318 if (flags & IP_ROUTETOIF) { 319 ifa = ifa_ifwithladdr_psref(sintocsa(dst), &psref_ia); 320 if (ifa == NULL) { 321 IP_STATINC(IP_STAT_NOROUTE); 322 error = ENETUNREACH; 323 goto bad; 324 } 325 /* ia is already referenced by psref_ia */ 326 ia = ifatoia(ifa); 327 328 ifp = ia->ia_ifp; 329 mtu = ifp->if_mtu; 330 ip->ip_ttl = 1; 331 isbroadcast = in_broadcast(dst->sin_addr, ifp); 332 } else if ((IN_MULTICAST(ip->ip_dst.s_addr) || 333 ip->ip_dst.s_addr == INADDR_BROADCAST) && 334 imo != NULL && imo->imo_multicast_if_index != 0) { 335 ifp = mifp = if_get_byindex(imo->imo_multicast_if_index, &psref); 336 if (ifp == NULL) { 337 IP_STATINC(IP_STAT_NOROUTE); 338 error = ENETUNREACH; 339 goto bad; 340 } 341 mtu = ifp->if_mtu; 342 ia = in_get_ia_from_ifp_psref(ifp, &psref_ia); 343 if (ia == NULL) { 344 error = EADDRNOTAVAIL; 345 goto bad; 346 } 347 isbroadcast = 0; 348 } else { 349 if (rt == NULL) 350 rt = rtcache_init(ro); 351 if (rt == NULL) { 352 IP_STATINC(IP_STAT_NOROUTE); 353 error = EHOSTUNREACH; 354 goto bad; 355 } 356 if (ifa_is_destroying(rt->rt_ifa)) { 357 rtcache_unref(rt, ro); 358 rt = NULL; 359 IP_STATINC(IP_STAT_NOROUTE); 360 error = EHOSTUNREACH; 361 goto bad; 362 } 363 ifa_acquire(rt->rt_ifa, &psref_ia); 364 ia = ifatoia(rt->rt_ifa); 365 ifp = rt->rt_ifp; 366 if ((mtu = rt->rt_rmx.rmx_mtu) == 0) 367 mtu = ifp->if_mtu; 368 rt->rt_use++; 369 if (rt->rt_flags & RTF_GATEWAY) 370 dst = satosin(rt->rt_gateway); 371 if (rt->rt_flags & RTF_HOST) 372 isbroadcast = rt->rt_flags & RTF_BROADCAST; 373 else 374 isbroadcast = in_broadcast(dst->sin_addr, ifp); 375 } 376 rtmtu_nolock = rt && (rt->rt_rmx.rmx_locks & RTV_MTU) == 0; 377 378 if (IN_MULTICAST(ip->ip_dst.s_addr) || 379 (ip->ip_dst.s_addr == INADDR_BROADCAST)) { 380 bool inmgroup; 381 382 m->m_flags |= (ip->ip_dst.s_addr == INADDR_BROADCAST) ? 383 M_BCAST : M_MCAST; 384 /* 385 * See if the caller provided any multicast options 386 */ 387 if (imo != NULL) 388 ip->ip_ttl = imo->imo_multicast_ttl; 389 else 390 ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL; 391 392 /* 393 * if we don't know the outgoing ifp yet, we can't generate 394 * output 395 */ 396 if (!ifp) { 397 IP_STATINC(IP_STAT_NOROUTE); 398 error = ENETUNREACH; 399 goto bad; 400 } 401 402 /* 403 * If the packet is multicast or broadcast, confirm that 404 * the outgoing interface can transmit it. 405 */ 406 if (((m->m_flags & M_MCAST) && 407 (ifp->if_flags & IFF_MULTICAST) == 0) || 408 ((m->m_flags & M_BCAST) && 409 (ifp->if_flags & (IFF_BROADCAST|IFF_POINTOPOINT)) == 0)) { 410 IP_STATINC(IP_STAT_NOROUTE); 411 error = ENETUNREACH; 412 goto bad; 413 } 414 /* 415 * If source address not specified yet, use an address 416 * of outgoing interface. 417 */ 418 if (in_nullhost(ip->ip_src)) { 419 struct in_ifaddr *xia; 420 struct ifaddr *xifa; 421 struct psref _psref; 422 423 xia = in_get_ia_from_ifp_psref(ifp, &_psref); 424 if (!xia) { 425 error = EADDRNOTAVAIL; 426 goto bad; 427 } 428 xifa = &xia->ia_ifa; 429 if (xifa->ifa_getifa != NULL) { 430 ia4_release(xia, &_psref); 431 /* FIXME ifa_getifa is NOMPSAFE */ 432 xia = ifatoia((*xifa->ifa_getifa)(xifa, rdst)); 433 if (xia == NULL) { 434 error = EADDRNOTAVAIL; 435 goto bad; 436 } 437 ia4_acquire(xia, &_psref); 438 } 439 ip->ip_src = xia->ia_addr.sin_addr; 440 ia4_release(xia, &_psref); 441 } 442 443 inmgroup = in_multi_group(ip->ip_dst, ifp, flags); 444 if (inmgroup && (imo == NULL || imo->imo_multicast_loop)) { 445 /* 446 * If we belong to the destination multicast group 447 * on the outgoing interface, and the caller did not 448 * forbid loopback, loop back a copy. 449 */ 450 ip_mloopback(ifp, m, &udst.sin); 451 } 452 #ifdef MROUTING 453 else { 454 /* 455 * If we are acting as a multicast router, perform 456 * multicast forwarding as if the packet had just 457 * arrived on the interface to which we are about 458 * to send. The multicast forwarding function 459 * recursively calls this function, using the 460 * IP_FORWARDING flag to prevent infinite recursion. 461 * 462 * Multicasts that are looped back by ip_mloopback(), 463 * above, will be forwarded by the ip_input() routine, 464 * if necessary. 465 */ 466 extern struct socket *ip_mrouter; 467 468 if (ip_mrouter && (flags & IP_FORWARDING) == 0) { 469 if (ip_mforward(m, ifp) != 0) { 470 m_freem(m); 471 goto done; 472 } 473 } 474 } 475 #endif 476 /* 477 * Multicasts with a time-to-live of zero may be looped- 478 * back, above, but must not be transmitted on a network. 479 * Also, multicasts addressed to the loopback interface 480 * are not sent -- the above call to ip_mloopback() will 481 * loop back a copy if this host actually belongs to the 482 * destination group on the loopback interface. 483 */ 484 if (ip->ip_ttl == 0 || (ifp->if_flags & IFF_LOOPBACK) != 0) { 485 m_freem(m); 486 goto done; 487 } 488 goto sendit; 489 } 490 491 /* 492 * If source address not specified yet, use address 493 * of outgoing interface. 494 */ 495 if (in_nullhost(ip->ip_src)) { 496 struct ifaddr *xifa; 497 498 xifa = &ia->ia_ifa; 499 if (xifa->ifa_getifa != NULL) { 500 ia4_release(ia, &psref_ia); 501 /* FIXME ifa_getifa is NOMPSAFE */ 502 ia = ifatoia((*xifa->ifa_getifa)(xifa, rdst)); 503 if (ia == NULL) { 504 error = EADDRNOTAVAIL; 505 goto bad; 506 } 507 ia4_acquire(ia, &psref_ia); 508 } 509 ip->ip_src = ia->ia_addr.sin_addr; 510 } 511 512 /* 513 * packets with Class-D address as source are not valid per 514 * RFC 1112 515 */ 516 if (IN_MULTICAST(ip->ip_src.s_addr)) { 517 IP_STATINC(IP_STAT_ODROPPED); 518 error = EADDRNOTAVAIL; 519 goto bad; 520 } 521 522 /* 523 * Look for broadcast address and and verify user is allowed to 524 * send such a packet. 525 */ 526 if (isbroadcast) { 527 if ((ifp->if_flags & IFF_BROADCAST) == 0) { 528 error = EADDRNOTAVAIL; 529 goto bad; 530 } 531 if ((flags & IP_ALLOWBROADCAST) == 0) { 532 error = EACCES; 533 goto bad; 534 } 535 /* don't allow broadcast messages to be fragmented */ 536 if (ntohs(ip->ip_len) > ifp->if_mtu) { 537 error = EMSGSIZE; 538 goto bad; 539 } 540 m->m_flags |= M_BCAST; 541 } else 542 m->m_flags &= ~M_BCAST; 543 544 sendit: 545 if ((flags & (IP_FORWARDING|IP_NOIPNEWID)) == 0) { 546 if (m->m_pkthdr.len < IP_MINFRAGSIZE) { 547 ip->ip_id = 0; 548 } else if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0) { 549 ip->ip_id = ip_newid(ia); 550 } else { 551 552 /* 553 * TSO capable interfaces (typically?) increment 554 * ip_id for each segment. 555 * "allocate" enough ids here to increase the chance 556 * for them to be unique. 557 * 558 * note that the following calculation is not 559 * needed to be precise. wasting some ip_id is fine. 560 */ 561 562 unsigned int segsz = m->m_pkthdr.segsz; 563 unsigned int datasz = ntohs(ip->ip_len) - hlen; 564 unsigned int num = howmany(datasz, segsz); 565 566 ip->ip_id = ip_newid_range(ia, num); 567 } 568 } 569 if (ia != NULL) { 570 ia4_release(ia, &psref_ia); 571 ia = NULL; 572 } 573 574 /* 575 * If we're doing Path MTU Discovery, we need to set DF unless 576 * the route's MTU is locked. 577 */ 578 if ((flags & IP_MTUDISC) != 0 && rtmtu_nolock) { 579 ip->ip_off |= htons(IP_DF); 580 } 581 582 #ifdef IPSEC 583 if (ipsec_used) { 584 bool ipsec_done = false; 585 586 /* Perform IPsec processing, if any. */ 587 error = ipsec4_output(m, inp, flags, &mtu, &natt_frag, 588 &ipsec_done); 589 if (error || ipsec_done) 590 goto done; 591 } 592 #endif 593 594 /* 595 * Run through list of hooks for output packets. 596 */ 597 error = pfil_run_hooks(inet_pfil_hook, &m, ifp, PFIL_OUT); 598 if (error) 599 goto done; 600 if (m == NULL) 601 goto done; 602 603 ip = mtod(m, struct ip *); 604 hlen = ip->ip_hl << 2; 605 606 m->m_pkthdr.csum_data |= hlen << 16; 607 608 /* 609 * search for the source address structure to 610 * maintain output statistics, and verify address 611 * validity 612 */ 613 KASSERT(ia == NULL); 614 sockaddr_in_init(&usrc.sin, &ip->ip_src, 0); 615 ifa = ifaof_ifpforaddr_psref(&usrc.sa, ifp, &psref_ia); 616 if (ifa != NULL) 617 ia = ifatoia(ifa); 618 619 /* 620 * Ensure we only send from a valid address. 621 * A NULL address is valid because the packet could be 622 * generated from a packet filter. 623 */ 624 if (ia != NULL && (flags & IP_FORWARDING) == 0 && 625 (error = ip_ifaddrvalid(ia)) != 0) 626 { 627 ARPLOG(LOG_ERR, 628 "refusing to send from invalid address %s (pid %d)\n", 629 ARPLOGADDR(&ip->ip_src), curproc->p_pid); 630 IP_STATINC(IP_STAT_ODROPPED); 631 if (error == 1) 632 /* 633 * Address exists, but is tentative or detached. 634 * We can't send from it because it's invalid, 635 * so we drop the packet. 636 */ 637 error = 0; 638 else 639 error = EADDRNOTAVAIL; 640 goto bad; 641 } 642 643 /* Maybe skip checksums on loopback interfaces. */ 644 if (IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) { 645 m->m_pkthdr.csum_flags |= M_CSUM_IPv4; 646 } 647 sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_csum_flags_tx; 648 /* 649 * If small enough for mtu of path, or if using TCP segmentation 650 * offload, can just send directly. 651 */ 652 if (ntohs(ip->ip_len) <= mtu || 653 (m->m_pkthdr.csum_flags & M_CSUM_TSOv4) != 0) { 654 const struct sockaddr *sa; 655 656 #if IFA_STATS 657 if (ia) 658 ia->ia_ifa.ifa_data.ifad_outbytes += ntohs(ip->ip_len); 659 #endif 660 /* 661 * Always initialize the sum to 0! Some HW assisted 662 * checksumming requires this. 663 */ 664 ip->ip_sum = 0; 665 666 if ((m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0) { 667 /* 668 * Perform any checksums that the hardware can't do 669 * for us. 670 * 671 * XXX Does any hardware require the {th,uh}_sum 672 * XXX fields to be 0? 673 */ 674 if (sw_csum & M_CSUM_IPv4) { 675 KASSERT(IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)); 676 ip->ip_sum = in_cksum(m, hlen); 677 m->m_pkthdr.csum_flags &= ~M_CSUM_IPv4; 678 } 679 if (sw_csum & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 680 if (IN_NEED_CHECKSUM(ifp, 681 sw_csum & (M_CSUM_TCPv4|M_CSUM_UDPv4))) { 682 in_delayed_cksum(m); 683 } 684 m->m_pkthdr.csum_flags &= 685 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 686 } 687 } 688 689 sa = (m->m_flags & M_MCAST) ? sintocsa(rdst) : sintocsa(dst); 690 if (__predict_true( 691 (m->m_pkthdr.csum_flags & M_CSUM_TSOv4) == 0 || 692 (ifp->if_capenable & IFCAP_TSOv4) != 0)) { 693 error = ip_if_output(ifp, m, sa, rt); 694 } else { 695 error = ip_tso_output(ifp, m, sa, rt); 696 } 697 goto done; 698 } 699 700 /* 701 * We can't use HW checksumming if we're about to 702 * fragment the packet. 703 * 704 * XXX Some hardware can do this. 705 */ 706 if (m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 707 if (IN_NEED_CHECKSUM(ifp, 708 m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4))) { 709 in_delayed_cksum(m); 710 } 711 m->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 712 } 713 714 /* 715 * Too large for interface; fragment if possible. 716 * Must be able to put at least 8 bytes per fragment. 717 */ 718 if (ntohs(ip->ip_off) & IP_DF) { 719 if (flags & IP_RETURNMTU) { 720 KASSERT(inp != NULL); 721 inp->inp_errormtu = mtu; 722 } 723 error = EMSGSIZE; 724 IP_STATINC(IP_STAT_CANTFRAG); 725 goto bad; 726 } 727 728 error = ip_fragment(m, ifp, mtu); 729 if (error) { 730 m = NULL; 731 goto bad; 732 } 733 734 for (; m; m = m0) { 735 m0 = m->m_nextpkt; 736 m->m_nextpkt = 0; 737 if (error) { 738 m_freem(m); 739 continue; 740 } 741 #if IFA_STATS 742 if (ia) 743 ia->ia_ifa.ifa_data.ifad_outbytes += ntohs(ip->ip_len); 744 #endif 745 /* 746 * If we get there, the packet has not been handled by 747 * IPsec whereas it should have. Now that it has been 748 * fragmented, re-inject it in ip_output so that IPsec 749 * processing can occur. 750 */ 751 if (natt_frag) { 752 error = ip_output(m, opt, ro, 753 flags | IP_RAWOUTPUT | IP_NOIPNEWID, 754 imo, inp); 755 } else { 756 KASSERT((m->m_pkthdr.csum_flags & 757 (M_CSUM_UDPv4 | M_CSUM_TCPv4)) == 0); 758 error = ip_if_output(ifp, m, 759 (m->m_flags & M_MCAST) ? 760 sintocsa(rdst) : sintocsa(dst), rt); 761 } 762 } 763 if (error == 0) { 764 IP_STATINC(IP_STAT_FRAGMENTED); 765 } 766 done: 767 ia4_release(ia, &psref_ia); 768 rtcache_unref(rt, ro); 769 if (ro == &iproute) { 770 rtcache_free(&iproute); 771 } 772 if (mifp != NULL) { 773 if_put(mifp, &psref); 774 } 775 if (bind_need_restore) 776 curlwp_bindx(bound); 777 return error; 778 bad: 779 m_freem(m); 780 goto done; 781 } 782 783 int 784 ip_fragment(struct mbuf *m, struct ifnet *ifp, u_long mtu) 785 { 786 struct ip *ip, *mhip; 787 struct mbuf *m0; 788 int len, hlen, off; 789 int mhlen, firstlen; 790 struct mbuf **mnext; 791 int sw_csum = m->m_pkthdr.csum_flags; 792 int fragments = 0; 793 int error = 0; 794 795 ip = mtod(m, struct ip *); 796 hlen = ip->ip_hl << 2; 797 if (ifp != NULL) 798 sw_csum &= ~ifp->if_csum_flags_tx; 799 800 len = (mtu - hlen) &~ 7; 801 if (len < 8) { 802 m_freem(m); 803 return (EMSGSIZE); 804 } 805 806 firstlen = len; 807 mnext = &m->m_nextpkt; 808 809 /* 810 * Loop through length of segment after first fragment, 811 * make new header and copy data of each part and link onto chain. 812 */ 813 m0 = m; 814 mhlen = sizeof (struct ip); 815 for (off = hlen + len; off < ntohs(ip->ip_len); off += len) { 816 MGETHDR(m, M_DONTWAIT, MT_HEADER); 817 if (m == 0) { 818 error = ENOBUFS; 819 IP_STATINC(IP_STAT_ODROPPED); 820 goto sendorfree; 821 } 822 MCLAIM(m, m0->m_owner); 823 *mnext = m; 824 mnext = &m->m_nextpkt; 825 m->m_data += max_linkhdr; 826 mhip = mtod(m, struct ip *); 827 *mhip = *ip; 828 /* we must inherit MCAST and BCAST flags */ 829 m->m_flags |= m0->m_flags & (M_MCAST|M_BCAST); 830 if (hlen > sizeof (struct ip)) { 831 mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip); 832 mhip->ip_hl = mhlen >> 2; 833 } 834 m->m_len = mhlen; 835 mhip->ip_off = ((off - hlen) >> 3) + 836 (ntohs(ip->ip_off) & ~IP_MF); 837 if (ip->ip_off & htons(IP_MF)) 838 mhip->ip_off |= IP_MF; 839 if (off + len >= ntohs(ip->ip_len)) 840 len = ntohs(ip->ip_len) - off; 841 else 842 mhip->ip_off |= IP_MF; 843 HTONS(mhip->ip_off); 844 mhip->ip_len = htons((u_int16_t)(len + mhlen)); 845 m->m_next = m_copym(m0, off, len, M_DONTWAIT); 846 if (m->m_next == 0) { 847 error = ENOBUFS; /* ??? */ 848 IP_STATINC(IP_STAT_ODROPPED); 849 goto sendorfree; 850 } 851 m->m_pkthdr.len = mhlen + len; 852 m_reset_rcvif(m); 853 mhip->ip_sum = 0; 854 KASSERT((m->m_pkthdr.csum_flags & M_CSUM_IPv4) == 0); 855 if (sw_csum & M_CSUM_IPv4) { 856 mhip->ip_sum = in_cksum(m, mhlen); 857 } else { 858 /* 859 * checksum is hw-offloaded or not necessary. 860 */ 861 m->m_pkthdr.csum_flags |= 862 m0->m_pkthdr.csum_flags & M_CSUM_IPv4; 863 m->m_pkthdr.csum_data |= mhlen << 16; 864 KASSERT(!(ifp != NULL && 865 IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) || 866 (m->m_pkthdr.csum_flags & M_CSUM_IPv4) != 0); 867 } 868 IP_STATINC(IP_STAT_OFRAGMENTS); 869 fragments++; 870 } 871 /* 872 * Update first fragment by trimming what's been copied out 873 * and updating header, then send each fragment (in order). 874 */ 875 m = m0; 876 m_adj(m, hlen + firstlen - ntohs(ip->ip_len)); 877 m->m_pkthdr.len = hlen + firstlen; 878 ip->ip_len = htons((u_int16_t)m->m_pkthdr.len); 879 ip->ip_off |= htons(IP_MF); 880 ip->ip_sum = 0; 881 if (sw_csum & M_CSUM_IPv4) { 882 ip->ip_sum = in_cksum(m, hlen); 883 m->m_pkthdr.csum_flags &= ~M_CSUM_IPv4; 884 } else { 885 /* 886 * checksum is hw-offloaded or not necessary. 887 */ 888 KASSERT(!(ifp != NULL && IN_NEED_CHECKSUM(ifp, M_CSUM_IPv4)) || 889 (m->m_pkthdr.csum_flags & M_CSUM_IPv4) != 0); 890 KASSERT(M_CSUM_DATA_IPv4_IPHL(m->m_pkthdr.csum_data) >= 891 sizeof(struct ip)); 892 } 893 sendorfree: 894 /* 895 * If there is no room for all the fragments, don't queue 896 * any of them. 897 */ 898 if (ifp != NULL) { 899 IFQ_LOCK(&ifp->if_snd); 900 if (ifp->if_snd.ifq_maxlen - ifp->if_snd.ifq_len < fragments && 901 error == 0) { 902 error = ENOBUFS; 903 IP_STATINC(IP_STAT_ODROPPED); 904 IFQ_INC_DROPS(&ifp->if_snd); 905 } 906 IFQ_UNLOCK(&ifp->if_snd); 907 } 908 if (error) { 909 for (m = m0; m; m = m0) { 910 m0 = m->m_nextpkt; 911 m->m_nextpkt = NULL; 912 m_freem(m); 913 } 914 } 915 return (error); 916 } 917 918 /* 919 * Process a delayed payload checksum calculation. 920 */ 921 void 922 in_delayed_cksum(struct mbuf *m) 923 { 924 struct ip *ip; 925 u_int16_t csum, offset; 926 927 ip = mtod(m, struct ip *); 928 offset = ip->ip_hl << 2; 929 csum = in4_cksum(m, 0, offset, ntohs(ip->ip_len) - offset); 930 if (csum == 0 && (m->m_pkthdr.csum_flags & M_CSUM_UDPv4) != 0) 931 csum = 0xffff; 932 933 offset += M_CSUM_DATA_IPv4_OFFSET(m->m_pkthdr.csum_data); 934 935 if ((offset + sizeof(u_int16_t)) > m->m_len) { 936 /* This happen when ip options were inserted 937 printf("in_delayed_cksum: pullup len %d off %d proto %d\n", 938 m->m_len, offset, ip->ip_p); 939 */ 940 m_copyback(m, offset, sizeof(csum), (void *) &csum); 941 } else 942 *(u_int16_t *)(mtod(m, char *) + offset) = csum; 943 } 944 945 /* 946 * Determine the maximum length of the options to be inserted; 947 * we would far rather allocate too much space rather than too little. 948 */ 949 950 u_int 951 ip_optlen(struct inpcb *inp) 952 { 953 struct mbuf *m = inp->inp_options; 954 955 if (m && m->m_len > offsetof(struct ipoption, ipopt_dst)) { 956 return (m->m_len - offsetof(struct ipoption, ipopt_dst)); 957 } 958 return 0; 959 } 960 961 /* 962 * Insert IP options into preformed packet. 963 * Adjust IP destination as required for IP source routing, 964 * as indicated by a non-zero in_addr at the start of the options. 965 */ 966 static struct mbuf * 967 ip_insertoptions(struct mbuf *m, struct mbuf *opt, int *phlen) 968 { 969 struct ipoption *p = mtod(opt, struct ipoption *); 970 struct mbuf *n; 971 struct ip *ip = mtod(m, struct ip *); 972 unsigned optlen; 973 974 optlen = opt->m_len - sizeof(p->ipopt_dst); 975 if (optlen + ntohs(ip->ip_len) > IP_MAXPACKET) 976 return (m); /* XXX should fail */ 977 if (!in_nullhost(p->ipopt_dst)) 978 ip->ip_dst = p->ipopt_dst; 979 if (M_READONLY(m) || M_LEADINGSPACE(m) < optlen) { 980 MGETHDR(n, M_DONTWAIT, MT_HEADER); 981 if (n == 0) 982 return (m); 983 MCLAIM(n, m->m_owner); 984 M_MOVE_PKTHDR(n, m); 985 m->m_len -= sizeof(struct ip); 986 m->m_data += sizeof(struct ip); 987 n->m_next = m; 988 m = n; 989 m->m_len = optlen + sizeof(struct ip); 990 m->m_data += max_linkhdr; 991 bcopy((void *)ip, mtod(m, void *), sizeof(struct ip)); 992 } else { 993 m->m_data -= optlen; 994 m->m_len += optlen; 995 memmove(mtod(m, void *), ip, sizeof(struct ip)); 996 } 997 m->m_pkthdr.len += optlen; 998 ip = mtod(m, struct ip *); 999 bcopy((void *)p->ipopt_list, (void *)(ip + 1), (unsigned)optlen); 1000 *phlen = sizeof(struct ip) + optlen; 1001 ip->ip_len = htons(ntohs(ip->ip_len) + optlen); 1002 return (m); 1003 } 1004 1005 /* 1006 * Copy options from ip to jp, 1007 * omitting those not copied during fragmentation. 1008 */ 1009 int 1010 ip_optcopy(struct ip *ip, struct ip *jp) 1011 { 1012 u_char *cp, *dp; 1013 int opt, optlen, cnt; 1014 1015 cp = (u_char *)(ip + 1); 1016 dp = (u_char *)(jp + 1); 1017 cnt = (ip->ip_hl << 2) - sizeof (struct ip); 1018 for (; cnt > 0; cnt -= optlen, cp += optlen) { 1019 opt = cp[0]; 1020 if (opt == IPOPT_EOL) 1021 break; 1022 if (opt == IPOPT_NOP) { 1023 /* Preserve for IP mcast tunnel's LSRR alignment. */ 1024 *dp++ = IPOPT_NOP; 1025 optlen = 1; 1026 continue; 1027 } 1028 1029 KASSERT(cnt >= IPOPT_OLEN + sizeof(*cp)); 1030 optlen = cp[IPOPT_OLEN]; 1031 KASSERT(optlen >= IPOPT_OLEN + sizeof(*cp) && optlen < cnt); 1032 1033 /* Invalid lengths should have been caught by ip_dooptions. */ 1034 if (optlen > cnt) 1035 optlen = cnt; 1036 if (IPOPT_COPIED(opt)) { 1037 bcopy((void *)cp, (void *)dp, (unsigned)optlen); 1038 dp += optlen; 1039 } 1040 } 1041 for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++) 1042 *dp++ = IPOPT_EOL; 1043 return (optlen); 1044 } 1045 1046 /* 1047 * IP socket option processing. 1048 */ 1049 int 1050 ip_ctloutput(int op, struct socket *so, struct sockopt *sopt) 1051 { 1052 struct inpcb *inp = sotoinpcb(so); 1053 struct ip *ip = &inp->inp_ip; 1054 int inpflags = inp->inp_flags; 1055 int optval = 0, error = 0; 1056 1057 KASSERT(solocked(so)); 1058 1059 if (sopt->sopt_level != IPPROTO_IP) { 1060 if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_NOHEADER) 1061 return 0; 1062 return ENOPROTOOPT; 1063 } 1064 1065 switch (op) { 1066 case PRCO_SETOPT: 1067 switch (sopt->sopt_name) { 1068 case IP_OPTIONS: 1069 #ifdef notyet 1070 case IP_RETOPTS: 1071 #endif 1072 error = ip_pcbopts(inp, sopt); 1073 break; 1074 1075 case IP_TOS: 1076 case IP_TTL: 1077 case IP_MINTTL: 1078 case IP_PKTINFO: 1079 case IP_RECVOPTS: 1080 case IP_RECVRETOPTS: 1081 case IP_RECVDSTADDR: 1082 case IP_RECVIF: 1083 case IP_RECVPKTINFO: 1084 case IP_RECVTTL: 1085 error = sockopt_getint(sopt, &optval); 1086 if (error) 1087 break; 1088 1089 switch (sopt->sopt_name) { 1090 case IP_TOS: 1091 ip->ip_tos = optval; 1092 break; 1093 1094 case IP_TTL: 1095 ip->ip_ttl = optval; 1096 break; 1097 1098 case IP_MINTTL: 1099 if (optval > 0 && optval <= MAXTTL) 1100 inp->inp_ip_minttl = optval; 1101 else 1102 error = EINVAL; 1103 break; 1104 #define OPTSET(bit) \ 1105 if (optval) \ 1106 inpflags |= bit; \ 1107 else \ 1108 inpflags &= ~bit; 1109 1110 case IP_PKTINFO: 1111 OPTSET(INP_PKTINFO); 1112 break; 1113 1114 case IP_RECVOPTS: 1115 OPTSET(INP_RECVOPTS); 1116 break; 1117 1118 case IP_RECVPKTINFO: 1119 OPTSET(INP_RECVPKTINFO); 1120 break; 1121 1122 case IP_RECVRETOPTS: 1123 OPTSET(INP_RECVRETOPTS); 1124 break; 1125 1126 case IP_RECVDSTADDR: 1127 OPTSET(INP_RECVDSTADDR); 1128 break; 1129 1130 case IP_RECVIF: 1131 OPTSET(INP_RECVIF); 1132 break; 1133 1134 case IP_RECVTTL: 1135 OPTSET(INP_RECVTTL); 1136 break; 1137 } 1138 break; 1139 #undef OPTSET 1140 1141 case IP_MULTICAST_IF: 1142 case IP_MULTICAST_TTL: 1143 case IP_MULTICAST_LOOP: 1144 case IP_ADD_MEMBERSHIP: 1145 case IP_DROP_MEMBERSHIP: 1146 error = ip_setmoptions(&inp->inp_moptions, sopt); 1147 break; 1148 1149 case IP_PORTRANGE: 1150 error = sockopt_getint(sopt, &optval); 1151 if (error) 1152 break; 1153 1154 switch (optval) { 1155 case IP_PORTRANGE_DEFAULT: 1156 case IP_PORTRANGE_HIGH: 1157 inpflags &= ~(INP_LOWPORT); 1158 break; 1159 1160 case IP_PORTRANGE_LOW: 1161 inpflags |= INP_LOWPORT; 1162 break; 1163 1164 default: 1165 error = EINVAL; 1166 break; 1167 } 1168 break; 1169 1170 case IP_PORTALGO: 1171 error = sockopt_getint(sopt, &optval); 1172 if (error) 1173 break; 1174 1175 error = portalgo_algo_index_select( 1176 (struct inpcb_hdr *)inp, optval); 1177 break; 1178 1179 #if defined(IPSEC) 1180 case IP_IPSEC_POLICY: 1181 if (ipsec_enabled) { 1182 error = ipsec4_set_policy(inp, sopt->sopt_name, 1183 sopt->sopt_data, sopt->sopt_size, 1184 curlwp->l_cred); 1185 break; 1186 } 1187 /*FALLTHROUGH*/ 1188 #endif /* IPSEC */ 1189 1190 default: 1191 error = ENOPROTOOPT; 1192 break; 1193 } 1194 break; 1195 1196 case PRCO_GETOPT: 1197 switch (sopt->sopt_name) { 1198 case IP_OPTIONS: 1199 case IP_RETOPTS: { 1200 struct mbuf *mopts = inp->inp_options; 1201 1202 if (mopts) { 1203 struct mbuf *m; 1204 1205 m = m_copym(mopts, 0, M_COPYALL, M_DONTWAIT); 1206 if (m == NULL) { 1207 error = ENOBUFS; 1208 break; 1209 } 1210 error = sockopt_setmbuf(sopt, m); 1211 } 1212 break; 1213 } 1214 case IP_PKTINFO: 1215 case IP_TOS: 1216 case IP_TTL: 1217 case IP_MINTTL: 1218 case IP_RECVOPTS: 1219 case IP_RECVRETOPTS: 1220 case IP_RECVDSTADDR: 1221 case IP_RECVIF: 1222 case IP_RECVPKTINFO: 1223 case IP_RECVTTL: 1224 case IP_ERRORMTU: 1225 switch (sopt->sopt_name) { 1226 case IP_TOS: 1227 optval = ip->ip_tos; 1228 break; 1229 1230 case IP_TTL: 1231 optval = ip->ip_ttl; 1232 break; 1233 1234 case IP_MINTTL: 1235 optval = inp->inp_ip_minttl; 1236 break; 1237 1238 case IP_ERRORMTU: 1239 optval = inp->inp_errormtu; 1240 break; 1241 1242 #define OPTBIT(bit) (inpflags & bit ? 1 : 0) 1243 1244 case IP_PKTINFO: 1245 optval = OPTBIT(INP_PKTINFO); 1246 break; 1247 1248 case IP_RECVOPTS: 1249 optval = OPTBIT(INP_RECVOPTS); 1250 break; 1251 1252 case IP_RECVPKTINFO: 1253 optval = OPTBIT(INP_RECVPKTINFO); 1254 break; 1255 1256 case IP_RECVRETOPTS: 1257 optval = OPTBIT(INP_RECVRETOPTS); 1258 break; 1259 1260 case IP_RECVDSTADDR: 1261 optval = OPTBIT(INP_RECVDSTADDR); 1262 break; 1263 1264 case IP_RECVIF: 1265 optval = OPTBIT(INP_RECVIF); 1266 break; 1267 1268 case IP_RECVTTL: 1269 optval = OPTBIT(INP_RECVTTL); 1270 break; 1271 } 1272 error = sockopt_setint(sopt, optval); 1273 break; 1274 1275 #if 0 /* defined(IPSEC) */ 1276 case IP_IPSEC_POLICY: 1277 { 1278 struct mbuf *m = NULL; 1279 1280 /* XXX this will return EINVAL as sopt is empty */ 1281 error = ipsec4_get_policy(inp, sopt->sopt_data, 1282 sopt->sopt_size, &m); 1283 if (error == 0) 1284 error = sockopt_setmbuf(sopt, m); 1285 break; 1286 } 1287 #endif /*IPSEC*/ 1288 1289 case IP_MULTICAST_IF: 1290 case IP_MULTICAST_TTL: 1291 case IP_MULTICAST_LOOP: 1292 case IP_ADD_MEMBERSHIP: 1293 case IP_DROP_MEMBERSHIP: 1294 error = ip_getmoptions(inp->inp_moptions, sopt); 1295 break; 1296 1297 case IP_PORTRANGE: 1298 if (inpflags & INP_LOWPORT) 1299 optval = IP_PORTRANGE_LOW; 1300 else 1301 optval = IP_PORTRANGE_DEFAULT; 1302 error = sockopt_setint(sopt, optval); 1303 break; 1304 1305 case IP_PORTALGO: 1306 optval = inp->inp_portalgo; 1307 error = sockopt_setint(sopt, optval); 1308 break; 1309 1310 default: 1311 error = ENOPROTOOPT; 1312 break; 1313 } 1314 break; 1315 } 1316 1317 if (!error) { 1318 inp->inp_flags = inpflags; 1319 } 1320 return error; 1321 } 1322 1323 /* 1324 * Set up IP options in pcb for insertion in output packets. 1325 * Store in mbuf with pointer in pcbopt, adding pseudo-option 1326 * with destination address if source routed. 1327 */ 1328 static int 1329 ip_pcbopts(struct inpcb *inp, const struct sockopt *sopt) 1330 { 1331 struct mbuf *m; 1332 const u_char *cp; 1333 u_char *dp; 1334 int cnt; 1335 1336 KASSERT(inp_locked(inp)); 1337 1338 /* Turn off any old options. */ 1339 if (inp->inp_options) { 1340 m_free(inp->inp_options); 1341 } 1342 inp->inp_options = NULL; 1343 if ((cnt = sopt->sopt_size) == 0) { 1344 /* Only turning off any previous options. */ 1345 return 0; 1346 } 1347 cp = sopt->sopt_data; 1348 1349 #ifndef __vax__ 1350 if (cnt % sizeof(int32_t)) 1351 return (EINVAL); 1352 #endif 1353 1354 m = m_get(M_DONTWAIT, MT_SOOPTS); 1355 if (m == NULL) 1356 return (ENOBUFS); 1357 1358 dp = mtod(m, u_char *); 1359 memset(dp, 0, sizeof(struct in_addr)); 1360 dp += sizeof(struct in_addr); 1361 m->m_len = sizeof(struct in_addr); 1362 1363 /* 1364 * IP option list according to RFC791. Each option is of the form 1365 * 1366 * [optval] [olen] [(olen - 2) data bytes] 1367 * 1368 * We validate the list and copy options to an mbuf for prepending 1369 * to data packets. The IP first-hop destination address will be 1370 * stored before actual options and is zero if unset. 1371 */ 1372 while (cnt > 0) { 1373 uint8_t optval, olen, offset; 1374 1375 optval = cp[IPOPT_OPTVAL]; 1376 1377 if (optval == IPOPT_EOL || optval == IPOPT_NOP) { 1378 olen = 1; 1379 } else { 1380 if (cnt < IPOPT_OLEN + 1) 1381 goto bad; 1382 1383 olen = cp[IPOPT_OLEN]; 1384 if (olen < IPOPT_OLEN + 1 || olen > cnt) 1385 goto bad; 1386 } 1387 1388 if (optval == IPOPT_LSRR || optval == IPOPT_SSRR) { 1389 /* 1390 * user process specifies route as: 1391 * ->A->B->C->D 1392 * D must be our final destination (but we can't 1393 * check that since we may not have connected yet). 1394 * A is first hop destination, which doesn't appear in 1395 * actual IP option, but is stored before the options. 1396 */ 1397 if (olen < IPOPT_OFFSET + 1 + sizeof(struct in_addr)) 1398 goto bad; 1399 1400 offset = cp[IPOPT_OFFSET]; 1401 memcpy(mtod(m, u_char *), cp + IPOPT_OFFSET + 1, 1402 sizeof(struct in_addr)); 1403 1404 cp += sizeof(struct in_addr); 1405 cnt -= sizeof(struct in_addr); 1406 olen -= sizeof(struct in_addr); 1407 1408 if (m->m_len + olen > MAX_IPOPTLEN + sizeof(struct in_addr)) 1409 goto bad; 1410 1411 memcpy(dp, cp, olen); 1412 dp[IPOPT_OPTVAL] = optval; 1413 dp[IPOPT_OLEN] = olen; 1414 dp[IPOPT_OFFSET] = offset; 1415 break; 1416 } else { 1417 if (m->m_len + olen > MAX_IPOPTLEN + sizeof(struct in_addr)) 1418 goto bad; 1419 1420 memcpy(dp, cp, olen); 1421 break; 1422 } 1423 1424 dp += olen; 1425 m->m_len += olen; 1426 1427 if (optval == IPOPT_EOL) 1428 break; 1429 1430 cp += olen; 1431 cnt -= olen; 1432 } 1433 1434 inp->inp_options = m; 1435 return 0; 1436 bad: 1437 (void)m_free(m); 1438 return EINVAL; 1439 } 1440 1441 /* 1442 * following RFC1724 section 3.3, 0.0.0.0/8 is interpreted as interface index. 1443 * Must be called in a pserialize critical section. 1444 */ 1445 static struct ifnet * 1446 ip_multicast_if(struct in_addr *a, int *ifindexp) 1447 { 1448 int ifindex; 1449 struct ifnet *ifp = NULL; 1450 struct in_ifaddr *ia; 1451 1452 if (ifindexp) 1453 *ifindexp = 0; 1454 if (ntohl(a->s_addr) >> 24 == 0) { 1455 ifindex = ntohl(a->s_addr) & 0xffffff; 1456 ifp = if_byindex(ifindex); 1457 if (!ifp) 1458 return NULL; 1459 if (ifindexp) 1460 *ifindexp = ifindex; 1461 } else { 1462 IN_ADDRHASH_READER_FOREACH(ia, a->s_addr) { 1463 if (in_hosteq(ia->ia_addr.sin_addr, *a) && 1464 (ia->ia_ifp->if_flags & IFF_MULTICAST) != 0) { 1465 ifp = ia->ia_ifp; 1466 if (if_is_deactivated(ifp)) 1467 ifp = NULL; 1468 break; 1469 } 1470 } 1471 } 1472 return ifp; 1473 } 1474 1475 static int 1476 ip_getoptval(const struct sockopt *sopt, u_int8_t *val, u_int maxval) 1477 { 1478 u_int tval; 1479 u_char cval; 1480 int error; 1481 1482 if (sopt == NULL) 1483 return EINVAL; 1484 1485 switch (sopt->sopt_size) { 1486 case sizeof(u_char): 1487 error = sockopt_get(sopt, &cval, sizeof(u_char)); 1488 tval = cval; 1489 break; 1490 1491 case sizeof(u_int): 1492 error = sockopt_get(sopt, &tval, sizeof(u_int)); 1493 break; 1494 1495 default: 1496 error = EINVAL; 1497 } 1498 1499 if (error) 1500 return error; 1501 1502 if (tval > maxval) 1503 return EINVAL; 1504 1505 *val = tval; 1506 return 0; 1507 } 1508 1509 static int 1510 ip_get_membership(const struct sockopt *sopt, struct ifnet **ifp, 1511 struct psref *psref, struct in_addr *ia, bool add) 1512 { 1513 int error; 1514 struct ip_mreq mreq; 1515 1516 error = sockopt_get(sopt, &mreq, sizeof(mreq)); 1517 if (error) 1518 return error; 1519 1520 if (!IN_MULTICAST(mreq.imr_multiaddr.s_addr)) 1521 return EINVAL; 1522 1523 memcpy(ia, &mreq.imr_multiaddr, sizeof(*ia)); 1524 1525 if (in_nullhost(mreq.imr_interface)) { 1526 union { 1527 struct sockaddr dst; 1528 struct sockaddr_in dst4; 1529 } u; 1530 struct route ro; 1531 1532 if (!add) { 1533 *ifp = NULL; 1534 return 0; 1535 } 1536 /* 1537 * If no interface address was provided, use the interface of 1538 * the route to the given multicast address. 1539 */ 1540 struct rtentry *rt; 1541 memset(&ro, 0, sizeof(ro)); 1542 1543 sockaddr_in_init(&u.dst4, ia, 0); 1544 error = rtcache_setdst(&ro, &u.dst); 1545 if (error != 0) 1546 return error; 1547 *ifp = (rt = rtcache_init(&ro)) != NULL ? rt->rt_ifp : NULL; 1548 if (*ifp != NULL) { 1549 if (if_is_deactivated(*ifp)) 1550 *ifp = NULL; 1551 else 1552 if_acquire(*ifp, psref); 1553 } 1554 rtcache_unref(rt, &ro); 1555 rtcache_free(&ro); 1556 } else { 1557 int s = pserialize_read_enter(); 1558 *ifp = ip_multicast_if(&mreq.imr_interface, NULL); 1559 if (!add && *ifp == NULL) { 1560 pserialize_read_exit(s); 1561 return EADDRNOTAVAIL; 1562 } 1563 if (*ifp != NULL) { 1564 if (if_is_deactivated(*ifp)) 1565 *ifp = NULL; 1566 else 1567 if_acquire(*ifp, psref); 1568 } 1569 pserialize_read_exit(s); 1570 } 1571 return 0; 1572 } 1573 1574 /* 1575 * Add a multicast group membership. 1576 * Group must be a valid IP multicast address. 1577 */ 1578 static int 1579 ip_add_membership(struct ip_moptions *imo, const struct sockopt *sopt) 1580 { 1581 struct ifnet *ifp = NULL; // XXX: gcc [ppc] 1582 struct in_addr ia; 1583 int i, error, bound; 1584 struct psref psref; 1585 1586 /* imo is protected by solock or referenced only by the caller */ 1587 1588 bound = curlwp_bind(); 1589 if (sopt->sopt_size == sizeof(struct ip_mreq)) 1590 error = ip_get_membership(sopt, &ifp, &psref, &ia, true); 1591 else 1592 #ifdef INET6 1593 error = ip6_get_membership(sopt, &ifp, &psref, &ia, sizeof(ia)); 1594 #else 1595 error = EINVAL; 1596 goto out; 1597 #endif 1598 1599 if (error) 1600 goto out; 1601 1602 /* 1603 * See if we found an interface, and confirm that it 1604 * supports multicast. 1605 */ 1606 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) { 1607 error = EADDRNOTAVAIL; 1608 goto out; 1609 } 1610 1611 /* 1612 * See if the membership already exists or if all the 1613 * membership slots are full. 1614 */ 1615 for (i = 0; i < imo->imo_num_memberships; ++i) { 1616 if (imo->imo_membership[i]->inm_ifp == ifp && 1617 in_hosteq(imo->imo_membership[i]->inm_addr, ia)) 1618 break; 1619 } 1620 if (i < imo->imo_num_memberships) { 1621 error = EADDRINUSE; 1622 goto out; 1623 } 1624 1625 if (i == IP_MAX_MEMBERSHIPS) { 1626 error = ETOOMANYREFS; 1627 goto out; 1628 } 1629 1630 /* 1631 * Everything looks good; add a new record to the multicast 1632 * address list for the given interface. 1633 */ 1634 if ((imo->imo_membership[i] = in_addmulti(&ia, ifp)) == NULL) { 1635 error = ENOBUFS; 1636 goto out; 1637 } 1638 1639 ++imo->imo_num_memberships; 1640 error = 0; 1641 out: 1642 if_put(ifp, &psref); 1643 curlwp_bindx(bound); 1644 return error; 1645 } 1646 1647 /* 1648 * Drop a multicast group membership. 1649 * Group must be a valid IP multicast address. 1650 */ 1651 static int 1652 ip_drop_membership(struct ip_moptions *imo, const struct sockopt *sopt) 1653 { 1654 struct in_addr ia = { .s_addr = 0 }; // XXX: gcc [ppc] 1655 struct ifnet *ifp = NULL; // XXX: gcc [ppc] 1656 int i, error, bound; 1657 struct psref psref; 1658 1659 /* imo is protected by solock or referenced only by the caller */ 1660 1661 bound = curlwp_bind(); 1662 if (sopt->sopt_size == sizeof(struct ip_mreq)) 1663 error = ip_get_membership(sopt, &ifp, &psref, &ia, false); 1664 else 1665 #ifdef INET6 1666 error = ip6_get_membership(sopt, &ifp, &psref, &ia, sizeof(ia)); 1667 #else 1668 error = EINVAL; 1669 goto out; 1670 #endif 1671 1672 if (error) 1673 goto out; 1674 1675 /* 1676 * Find the membership in the membership array. 1677 */ 1678 for (i = 0; i < imo->imo_num_memberships; ++i) { 1679 if ((ifp == NULL || 1680 imo->imo_membership[i]->inm_ifp == ifp) && 1681 in_hosteq(imo->imo_membership[i]->inm_addr, ia)) 1682 break; 1683 } 1684 if (i == imo->imo_num_memberships) { 1685 error = EADDRNOTAVAIL; 1686 goto out; 1687 } 1688 1689 /* 1690 * Give up the multicast address record to which the 1691 * membership points. 1692 */ 1693 in_delmulti(imo->imo_membership[i]); 1694 1695 /* 1696 * Remove the gap in the membership array. 1697 */ 1698 for (++i; i < imo->imo_num_memberships; ++i) 1699 imo->imo_membership[i-1] = imo->imo_membership[i]; 1700 --imo->imo_num_memberships; 1701 error = 0; 1702 out: 1703 if_put(ifp, &psref); 1704 curlwp_bindx(bound); 1705 return error; 1706 } 1707 1708 /* 1709 * Set the IP multicast options in response to user setsockopt(). 1710 */ 1711 int 1712 ip_setmoptions(struct ip_moptions **pimo, const struct sockopt *sopt) 1713 { 1714 struct ip_moptions *imo = *pimo; 1715 struct in_addr addr; 1716 struct ifnet *ifp; 1717 int ifindex, error = 0; 1718 1719 /* The passed imo isn't NULL, it should be protected by solock */ 1720 1721 if (!imo) { 1722 /* 1723 * No multicast option buffer attached to the pcb; 1724 * allocate one and initialize to default values. 1725 */ 1726 imo = kmem_intr_alloc(sizeof(*imo), KM_NOSLEEP); 1727 if (imo == NULL) 1728 return ENOBUFS; 1729 1730 imo->imo_multicast_if_index = 0; 1731 imo->imo_multicast_addr.s_addr = INADDR_ANY; 1732 imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; 1733 imo->imo_multicast_loop = IP_DEFAULT_MULTICAST_LOOP; 1734 imo->imo_num_memberships = 0; 1735 *pimo = imo; 1736 } 1737 1738 switch (sopt->sopt_name) { 1739 case IP_MULTICAST_IF: { 1740 int s; 1741 /* 1742 * Select the interface for outgoing multicast packets. 1743 */ 1744 error = sockopt_get(sopt, &addr, sizeof(addr)); 1745 if (error) 1746 break; 1747 1748 /* 1749 * INADDR_ANY is used to remove a previous selection. 1750 * When no interface is selected, a default one is 1751 * chosen every time a multicast packet is sent. 1752 */ 1753 if (in_nullhost(addr)) { 1754 imo->imo_multicast_if_index = 0; 1755 break; 1756 } 1757 /* 1758 * The selected interface is identified by its local 1759 * IP address. Find the interface and confirm that 1760 * it supports multicasting. 1761 */ 1762 s = pserialize_read_enter(); 1763 ifp = ip_multicast_if(&addr, &ifindex); 1764 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) { 1765 pserialize_read_exit(s); 1766 error = EADDRNOTAVAIL; 1767 break; 1768 } 1769 imo->imo_multicast_if_index = ifp->if_index; 1770 pserialize_read_exit(s); 1771 if (ifindex) 1772 imo->imo_multicast_addr = addr; 1773 else 1774 imo->imo_multicast_addr.s_addr = INADDR_ANY; 1775 break; 1776 } 1777 1778 case IP_MULTICAST_TTL: 1779 /* 1780 * Set the IP time-to-live for outgoing multicast packets. 1781 */ 1782 error = ip_getoptval(sopt, &imo->imo_multicast_ttl, MAXTTL); 1783 break; 1784 1785 case IP_MULTICAST_LOOP: 1786 /* 1787 * Set the loopback flag for outgoing multicast packets. 1788 * Must be zero or one. 1789 */ 1790 error = ip_getoptval(sopt, &imo->imo_multicast_loop, 1); 1791 break; 1792 1793 case IP_ADD_MEMBERSHIP: /* IPV6_JOIN_GROUP */ 1794 error = ip_add_membership(imo, sopt); 1795 break; 1796 1797 case IP_DROP_MEMBERSHIP: /* IPV6_LEAVE_GROUP */ 1798 error = ip_drop_membership(imo, sopt); 1799 break; 1800 1801 default: 1802 error = EOPNOTSUPP; 1803 break; 1804 } 1805 1806 /* 1807 * If all options have default values, no need to keep the mbuf. 1808 */ 1809 if (imo->imo_multicast_if_index == 0 && 1810 imo->imo_multicast_ttl == IP_DEFAULT_MULTICAST_TTL && 1811 imo->imo_multicast_loop == IP_DEFAULT_MULTICAST_LOOP && 1812 imo->imo_num_memberships == 0) { 1813 kmem_free(imo, sizeof(*imo)); 1814 *pimo = NULL; 1815 } 1816 1817 return error; 1818 } 1819 1820 /* 1821 * Return the IP multicast options in response to user getsockopt(). 1822 */ 1823 int 1824 ip_getmoptions(struct ip_moptions *imo, struct sockopt *sopt) 1825 { 1826 struct in_addr addr; 1827 uint8_t optval; 1828 int error = 0; 1829 1830 /* imo is protected by solock or refereced only by the caller */ 1831 1832 switch (sopt->sopt_name) { 1833 case IP_MULTICAST_IF: 1834 if (imo == NULL || imo->imo_multicast_if_index == 0) 1835 addr = zeroin_addr; 1836 else if (imo->imo_multicast_addr.s_addr) { 1837 /* return the value user has set */ 1838 addr = imo->imo_multicast_addr; 1839 } else { 1840 struct ifnet *ifp; 1841 struct in_ifaddr *ia = NULL; 1842 int s = pserialize_read_enter(); 1843 1844 ifp = if_byindex(imo->imo_multicast_if_index); 1845 if (ifp != NULL) { 1846 ia = in_get_ia_from_ifp(ifp); 1847 } 1848 addr = ia ? ia->ia_addr.sin_addr : zeroin_addr; 1849 pserialize_read_exit(s); 1850 } 1851 error = sockopt_set(sopt, &addr, sizeof(addr)); 1852 break; 1853 1854 case IP_MULTICAST_TTL: 1855 optval = imo ? imo->imo_multicast_ttl 1856 : IP_DEFAULT_MULTICAST_TTL; 1857 1858 error = sockopt_set(sopt, &optval, sizeof(optval)); 1859 break; 1860 1861 case IP_MULTICAST_LOOP: 1862 optval = imo ? imo->imo_multicast_loop 1863 : IP_DEFAULT_MULTICAST_LOOP; 1864 1865 error = sockopt_set(sopt, &optval, sizeof(optval)); 1866 break; 1867 1868 default: 1869 error = EOPNOTSUPP; 1870 } 1871 1872 return error; 1873 } 1874 1875 /* 1876 * Discard the IP multicast options. 1877 */ 1878 void 1879 ip_freemoptions(struct ip_moptions *imo) 1880 { 1881 int i; 1882 1883 /* The owner of imo (inp) should be protected by solock */ 1884 1885 if (imo != NULL) { 1886 for (i = 0; i < imo->imo_num_memberships; ++i) 1887 in_delmulti(imo->imo_membership[i]); 1888 kmem_free(imo, sizeof(*imo)); 1889 } 1890 } 1891 1892 /* 1893 * Routine called from ip_output() to loop back a copy of an IP multicast 1894 * packet to the input queue of a specified interface. Note that this 1895 * calls the output routine of the loopback "driver", but with an interface 1896 * pointer that might NOT be lo0ifp -- easier than replicating that code here. 1897 */ 1898 static void 1899 ip_mloopback(struct ifnet *ifp, struct mbuf *m, const struct sockaddr_in *dst) 1900 { 1901 struct ip *ip; 1902 struct mbuf *copym; 1903 1904 copym = m_copypacket(m, M_DONTWAIT); 1905 if (copym != NULL && 1906 (copym->m_flags & M_EXT || copym->m_len < sizeof(struct ip))) 1907 copym = m_pullup(copym, sizeof(struct ip)); 1908 if (copym == NULL) 1909 return; 1910 /* 1911 * We don't bother to fragment if the IP length is greater 1912 * than the interface's MTU. Can this possibly matter? 1913 */ 1914 ip = mtod(copym, struct ip *); 1915 1916 if (copym->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 1917 in_delayed_cksum(copym); 1918 copym->m_pkthdr.csum_flags &= 1919 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 1920 } 1921 1922 ip->ip_sum = 0; 1923 ip->ip_sum = in_cksum(copym, ip->ip_hl << 2); 1924 #ifndef NET_MPSAFE 1925 KERNEL_LOCK(1, NULL); 1926 #endif 1927 (void)looutput(ifp, copym, sintocsa(dst), NULL); 1928 #ifndef NET_MPSAFE 1929 KERNEL_UNLOCK_ONE(NULL); 1930 #endif 1931 } 1932 1933 /* 1934 * Ensure sending address is valid. 1935 * Returns 0 on success, -1 if an error should be sent back or 1 1936 * if the packet could be dropped without error (protocol dependent). 1937 */ 1938 static int 1939 ip_ifaddrvalid(const struct in_ifaddr *ia) 1940 { 1941 1942 if (ia->ia_addr.sin_addr.s_addr == INADDR_ANY) 1943 return 0; 1944 1945 if (ia->ia4_flags & IN_IFF_DUPLICATED) 1946 return -1; 1947 else if (ia->ia4_flags & (IN_IFF_TENTATIVE | IN_IFF_DETACHED)) 1948 return 1; 1949 1950 return 0; 1951 } 1952
Indexes created Tue Sep 23 07:09:52 GMT 2025