Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netinet/ip_input.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1988, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 * 31 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 32 */ 33 34 #include <sys/cdefs.h> 35 __FBSDID("$FreeBSD$"); 36 37 #include "opt_bootp.h" 38 #include "opt_ipstealth.h" 39 #include "opt_ipsec.h" 40 #include "opt_route.h" 41 #include "opt_rss.h" 42 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/hhook.h> 46 #include <sys/mbuf.h> 47 #include <sys/malloc.h> 48 #include <sys/domain.h> 49 #include <sys/protosw.h> 50 #include <sys/socket.h> 51 #include <sys/time.h> 52 #include <sys/kernel.h> 53 #include <sys/lock.h> 54 #include <sys/rmlock.h> 55 #include <sys/rwlock.h> 56 #include <sys/sdt.h> 57 #include <sys/syslog.h> 58 #include <sys/sysctl.h> 59 60 #include <net/pfil.h> 61 #include <net/if.h> 62 #include <net/if_types.h> 63 #include <net/if_var.h> 64 #include <net/if_dl.h> 65 #include <net/route.h> 66 #include <net/netisr.h> 67 #include <net/rss_config.h> 68 #include <net/vnet.h> 69 70 #include <netinet/in.h> 71 #include <netinet/in_kdtrace.h> 72 #include <netinet/in_systm.h> 73 #include <netinet/in_var.h> 74 #include <netinet/ip.h> 75 #include <netinet/in_pcb.h> 76 #include <netinet/ip_var.h> 77 #include <netinet/ip_fw.h> 78 #include <netinet/ip_icmp.h> 79 #include <netinet/ip_options.h> 80 #include <machine/in_cksum.h> 81 #include <netinet/ip_carp.h> 82 #include <netinet/in_rss.h> 83 84 #include <netipsec/ipsec_support.h> 85 86 #include <sys/socketvar.h> 87 88 #include <security/mac/mac_framework.h> 89 90 #ifdef CTASSERT 91 CTASSERT(sizeof(struct ip) == 20); 92 #endif 93 94 /* IP reassembly functions are defined in ip_reass.c. */ 95 extern void ipreass_init(void); 96 extern void ipreass_drain(void); 97 extern void ipreass_slowtimo(void); 98 #ifdef VIMAGE 99 extern void ipreass_destroy(void); 100 #endif 101 102 struct rmlock in_ifaddr_lock; 103 RM_SYSINIT(in_ifaddr_lock, &in_ifaddr_lock, "in_ifaddr_lock"); 104 105 VNET_DEFINE(int, rsvp_on); 106 107 VNET_DEFINE(int, ipforwarding); 108 SYSCTL_INT(_net_inet_ip, IPCTL_FORWARDING, forwarding, CTLFLAG_VNET | CTLFLAG_RW, 109 &VNET_NAME(ipforwarding), 0, 110 "Enable IP forwarding between interfaces"); 111 112 /* 113 * Respond with an ICMP host redirect when we forward a packet out of 114 * the same interface on which it was received. See RFC 792. 115 */ 116 VNET_DEFINE(int, ipsendredirects) = 1; 117 SYSCTL_INT(_net_inet_ip, IPCTL_SENDREDIRECTS, redirect, CTLFLAG_VNET | CTLFLAG_RW, 118 &VNET_NAME(ipsendredirects), 0, 119 "Enable sending IP redirects"); 120 121 /* 122 * XXX - Setting ip_checkinterface mostly implements the receive side of 123 * the Strong ES model described in RFC 1122, but since the routing table 124 * and transmit implementation do not implement the Strong ES model, 125 * setting this to 1 results in an odd hybrid. 126 * 127 * XXX - ip_checkinterface currently must be disabled if you use ipnat 128 * to translate the destination address to another local interface. 129 * 130 * XXX - ip_checkinterface must be disabled if you add IP aliases 131 * to the loopback interface instead of the interface where the 132 * packets for those addresses are received. 133 */ 134 VNET_DEFINE_STATIC(int, ip_checkinterface); 135 #define V_ip_checkinterface VNET(ip_checkinterface) 136 SYSCTL_INT(_net_inet_ip, OID_AUTO, check_interface, CTLFLAG_VNET | CTLFLAG_RW, 137 &VNET_NAME(ip_checkinterface), 0, 138 "Verify packet arrives on correct interface"); 139 140 VNET_DEFINE(struct pfil_head, inet_pfil_hook); /* Packet filter hooks */ 141 142 static struct netisr_handler ip_nh = { 143 .nh_name = "ip", 144 .nh_handler = ip_input, 145 .nh_proto = NETISR_IP, 146 #ifdef RSS 147 .nh_m2cpuid = rss_soft_m2cpuid_v4, 148 .nh_policy = NETISR_POLICY_CPU, 149 .nh_dispatch = NETISR_DISPATCH_HYBRID, 150 #else 151 .nh_policy = NETISR_POLICY_FLOW, 152 #endif 153 }; 154 155 #ifdef RSS 156 /* 157 * Directly dispatched frames are currently assumed 158 * to have a flowid already calculated. 159 * 160 * It should likely have something that assert it 161 * actually has valid flow details. 162 */ 163 static struct netisr_handler ip_direct_nh = { 164 .nh_name = "ip_direct", 165 .nh_handler = ip_direct_input, 166 .nh_proto = NETISR_IP_DIRECT, 167 .nh_m2cpuid = rss_soft_m2cpuid_v4, 168 .nh_policy = NETISR_POLICY_CPU, 169 .nh_dispatch = NETISR_DISPATCH_HYBRID, 170 }; 171 #endif 172 173 extern struct domain inetdomain; 174 extern struct protosw inetsw[]; 175 u_char ip_protox[IPPROTO_MAX]; 176 VNET_DEFINE(struct in_ifaddrhead, in_ifaddrhead); /* first inet address */ 177 VNET_DEFINE(struct in_ifaddrhashhead *, in_ifaddrhashtbl); /* inet addr hash table */ 178 VNET_DEFINE(u_long, in_ifaddrhmask); /* mask for hash table */ 179 180 #ifdef IPCTL_DEFMTU 181 SYSCTL_INT(_net_inet_ip, IPCTL_DEFMTU, mtu, CTLFLAG_RW, 182 &ip_mtu, 0, "Default MTU"); 183 #endif 184 185 #ifdef IPSTEALTH 186 VNET_DEFINE(int, ipstealth); 187 SYSCTL_INT(_net_inet_ip, OID_AUTO, stealth, CTLFLAG_VNET | CTLFLAG_RW, 188 &VNET_NAME(ipstealth), 0, 189 "IP stealth mode, no TTL decrementation on forwarding"); 190 #endif 191 192 /* 193 * IP statistics are stored in the "array" of counter(9)s. 194 */ 195 VNET_PCPUSTAT_DEFINE(struct ipstat, ipstat); 196 VNET_PCPUSTAT_SYSINIT(ipstat); 197 SYSCTL_VNET_PCPUSTAT(_net_inet_ip, IPCTL_STATS, stats, struct ipstat, ipstat, 198 "IP statistics (struct ipstat, netinet/ip_var.h)"); 199 200 #ifdef VIMAGE 201 VNET_PCPUSTAT_SYSUNINIT(ipstat); 202 #endif /* VIMAGE */ 203 204 /* 205 * Kernel module interface for updating ipstat. The argument is an index 206 * into ipstat treated as an array. 207 */ 208 void 209 kmod_ipstat_inc(int statnum) 210 { 211 212 counter_u64_add(VNET(ipstat)[statnum], 1); 213 } 214 215 void 216 kmod_ipstat_dec(int statnum) 217 { 218 219 counter_u64_add(VNET(ipstat)[statnum], -1); 220 } 221 222 static int 223 sysctl_netinet_intr_queue_maxlen(SYSCTL_HANDLER_ARGS) 224 { 225 int error, qlimit; 226 227 netisr_getqlimit(&ip_nh, &qlimit); 228 error = sysctl_handle_int(oidp, &qlimit, 0, req); 229 if (error || !req->newptr) 230 return (error); 231 if (qlimit < 1) 232 return (EINVAL); 233 return (netisr_setqlimit(&ip_nh, qlimit)); 234 } 235 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQMAXLEN, intr_queue_maxlen, 236 CTLTYPE_INT|CTLFLAG_RW, 0, 0, sysctl_netinet_intr_queue_maxlen, "I", 237 "Maximum size of the IP input queue"); 238 239 static int 240 sysctl_netinet_intr_queue_drops(SYSCTL_HANDLER_ARGS) 241 { 242 u_int64_t qdrops_long; 243 int error, qdrops; 244 245 netisr_getqdrops(&ip_nh, &qdrops_long); 246 qdrops = qdrops_long; 247 error = sysctl_handle_int(oidp, &qdrops, 0, req); 248 if (error || !req->newptr) 249 return (error); 250 if (qdrops != 0) 251 return (EINVAL); 252 netisr_clearqdrops(&ip_nh); 253 return (0); 254 } 255 256 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQDROPS, intr_queue_drops, 257 CTLTYPE_INT|CTLFLAG_RD, 0, 0, sysctl_netinet_intr_queue_drops, "I", 258 "Number of packets dropped from the IP input queue"); 259 260 #ifdef RSS 261 static int 262 sysctl_netinet_intr_direct_queue_maxlen(SYSCTL_HANDLER_ARGS) 263 { 264 int error, qlimit; 265 266 netisr_getqlimit(&ip_direct_nh, &qlimit); 267 error = sysctl_handle_int(oidp, &qlimit, 0, req); 268 if (error || !req->newptr) 269 return (error); 270 if (qlimit < 1) 271 return (EINVAL); 272 return (netisr_setqlimit(&ip_direct_nh, qlimit)); 273 } 274 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRDQMAXLEN, intr_direct_queue_maxlen, 275 CTLTYPE_INT|CTLFLAG_RW, 0, 0, sysctl_netinet_intr_direct_queue_maxlen, 276 "I", "Maximum size of the IP direct input queue"); 277 278 static int 279 sysctl_netinet_intr_direct_queue_drops(SYSCTL_HANDLER_ARGS) 280 { 281 u_int64_t qdrops_long; 282 int error, qdrops; 283 284 netisr_getqdrops(&ip_direct_nh, &qdrops_long); 285 qdrops = qdrops_long; 286 error = sysctl_handle_int(oidp, &qdrops, 0, req); 287 if (error || !req->newptr) 288 return (error); 289 if (qdrops != 0) 290 return (EINVAL); 291 netisr_clearqdrops(&ip_direct_nh); 292 return (0); 293 } 294 295 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRDQDROPS, intr_direct_queue_drops, 296 CTLTYPE_INT|CTLFLAG_RD, 0, 0, sysctl_netinet_intr_direct_queue_drops, "I", 297 "Number of packets dropped from the IP direct input queue"); 298 #endif /* RSS */ 299 300 /* 301 * IP initialization: fill in IP protocol switch table. 302 * All protocols not implemented in kernel go to raw IP protocol handler. 303 */ 304 void 305 ip_init(void) 306 { 307 struct protosw *pr; 308 int i; 309 310 CK_STAILQ_INIT(&V_in_ifaddrhead); 311 V_in_ifaddrhashtbl = hashinit(INADDR_NHASH, M_IFADDR, &V_in_ifaddrhmask); 312 313 /* Initialize IP reassembly queue. */ 314 ipreass_init(); 315 316 /* Initialize packet filter hooks. */ 317 V_inet_pfil_hook.ph_type = PFIL_TYPE_AF; 318 V_inet_pfil_hook.ph_af = AF_INET; 319 if ((i = pfil_head_register(&V_inet_pfil_hook)) != 0) 320 printf("%s: WARNING: unable to register pfil hook, " 321 "error %d\n", __func__, i); 322 323 if (hhook_head_register(HHOOK_TYPE_IPSEC_IN, AF_INET, 324 &V_ipsec_hhh_in[HHOOK_IPSEC_INET], 325 HHOOK_WAITOK | HHOOK_HEADISINVNET) != 0) 326 printf("%s: WARNING: unable to register input helper hook\n", 327 __func__); 328 if (hhook_head_register(HHOOK_TYPE_IPSEC_OUT, AF_INET, 329 &V_ipsec_hhh_out[HHOOK_IPSEC_INET], 330 HHOOK_WAITOK | HHOOK_HEADISINVNET) != 0) 331 printf("%s: WARNING: unable to register output helper hook\n", 332 __func__); 333 334 /* Skip initialization of globals for non-default instances. */ 335 #ifdef VIMAGE 336 if (!IS_DEFAULT_VNET(curvnet)) { 337 netisr_register_vnet(&ip_nh); 338 #ifdef RSS 339 netisr_register_vnet(&ip_direct_nh); 340 #endif 341 return; 342 } 343 #endif 344 345 pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 346 if (pr == NULL) 347 panic("ip_init: PF_INET not found"); 348 349 /* Initialize the entire ip_protox[] array to IPPROTO_RAW. */ 350 for (i = 0; i < IPPROTO_MAX; i++) 351 ip_protox[i] = pr - inetsw; 352 /* 353 * Cycle through IP protocols and put them into the appropriate place 354 * in ip_protox[]. 355 */ 356 for (pr = inetdomain.dom_protosw; 357 pr < inetdomain.dom_protoswNPROTOSW; pr++) 358 if (pr->pr_domain->dom_family == PF_INET && 359 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) { 360 /* Be careful to only index valid IP protocols. */ 361 if (pr->pr_protocol < IPPROTO_MAX) 362 ip_protox[pr->pr_protocol] = pr - inetsw; 363 } 364 365 netisr_register(&ip_nh); 366 #ifdef RSS 367 netisr_register(&ip_direct_nh); 368 #endif 369 } 370 371 #ifdef VIMAGE 372 static void 373 ip_destroy(void *unused __unused) 374 { 375 struct ifnet *ifp; 376 int error; 377 378 #ifdef RSS 379 netisr_unregister_vnet(&ip_direct_nh); 380 #endif 381 netisr_unregister_vnet(&ip_nh); 382 383 if ((error = pfil_head_unregister(&V_inet_pfil_hook)) != 0) 384 printf("%s: WARNING: unable to unregister pfil hook, " 385 "error %d\n", __func__, error); 386 387 error = hhook_head_deregister(V_ipsec_hhh_in[HHOOK_IPSEC_INET]); 388 if (error != 0) { 389 printf("%s: WARNING: unable to deregister input helper hook " 390 "type HHOOK_TYPE_IPSEC_IN, id HHOOK_IPSEC_INET: " 391 "error %d returned\n", __func__, error); 392 } 393 error = hhook_head_deregister(V_ipsec_hhh_out[HHOOK_IPSEC_INET]); 394 if (error != 0) { 395 printf("%s: WARNING: unable to deregister output helper hook " 396 "type HHOOK_TYPE_IPSEC_OUT, id HHOOK_IPSEC_INET: " 397 "error %d returned\n", __func__, error); 398 } 399 400 /* Remove the IPv4 addresses from all interfaces. */ 401 in_ifscrub_all(); 402 403 /* Make sure the IPv4 routes are gone as well. */ 404 IFNET_RLOCK(); 405 CK_STAILQ_FOREACH(ifp, &V_ifnet, if_link) 406 rt_flushifroutes_af(ifp, AF_INET); 407 IFNET_RUNLOCK(); 408 409 /* Destroy IP reassembly queue. */ 410 ipreass_destroy(); 411 412 /* Cleanup in_ifaddr hash table; should be empty. */ 413 hashdestroy(V_in_ifaddrhashtbl, M_IFADDR, V_in_ifaddrhmask); 414 } 415 416 VNET_SYSUNINIT(ip, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD, ip_destroy, NULL); 417 #endif 418 419 #ifdef RSS 420 /* 421 * IP direct input routine. 422 * 423 * This is called when reinjecting completed fragments where 424 * all of the previous checking and book-keeping has been done. 425 */ 426 void 427 ip_direct_input(struct mbuf *m) 428 { 429 struct ip *ip; 430 int hlen; 431 432 ip = mtod(m, struct ip *); 433 hlen = ip->ip_hl << 2; 434 435 #if defined(IPSEC) || defined(IPSEC_SUPPORT) 436 if (IPSEC_ENABLED(ipv4)) { 437 if (IPSEC_INPUT(ipv4, m, hlen, ip->ip_p) != 0) 438 return; 439 } 440 #endif /* IPSEC */ 441 IPSTAT_INC(ips_delivered); 442 (*inetsw[ip_protox[ip->ip_p]].pr_input)(&m, &hlen, ip->ip_p); 443 return; 444 } 445 #endif 446 447 /* 448 * Ip input routine. Checksum and byte swap header. If fragmented 449 * try to reassemble. Process options. Pass to next level. 450 */ 451 void 452 ip_input(struct mbuf *m) 453 { 454 struct rm_priotracker in_ifa_tracker; 455 struct ip *ip = NULL; 456 struct in_ifaddr *ia = NULL; 457 struct ifaddr *ifa; 458 struct ifnet *ifp; 459 int checkif, hlen = 0; 460 uint16_t sum, ip_len; 461 int dchg = 0; /* dest changed after fw */ 462 struct in_addr odst; /* original dst address */ 463 464 M_ASSERTPKTHDR(m); 465 466 if (m->m_flags & M_FASTFWD_OURS) { 467 m->m_flags &= ~M_FASTFWD_OURS; 468 /* Set up some basics that will be used later. */ 469 ip = mtod(m, struct ip *); 470 hlen = ip->ip_hl << 2; 471 ip_len = ntohs(ip->ip_len); 472 goto ours; 473 } 474 475 IPSTAT_INC(ips_total); 476 477 if (m->m_pkthdr.len < sizeof(struct ip)) 478 goto tooshort; 479 480 if (m->m_len < sizeof (struct ip) && 481 (m = m_pullup(m, sizeof (struct ip))) == NULL) { 482 IPSTAT_INC(ips_toosmall); 483 return; 484 } 485 ip = mtod(m, struct ip *); 486 487 if (ip->ip_v != IPVERSION) { 488 IPSTAT_INC(ips_badvers); 489 goto bad; 490 } 491 492 hlen = ip->ip_hl << 2; 493 if (hlen < sizeof(struct ip)) { /* minimum header length */ 494 IPSTAT_INC(ips_badhlen); 495 goto bad; 496 } 497 if (hlen > m->m_len) { 498 if ((m = m_pullup(m, hlen)) == NULL) { 499 IPSTAT_INC(ips_badhlen); 500 return; 501 } 502 ip = mtod(m, struct ip *); 503 } 504 505 IP_PROBE(receive, NULL, NULL, ip, m->m_pkthdr.rcvif, ip, NULL); 506 507 /* IN_LOOPBACK must not appear on the wire - RFC1122 */ 508 ifp = m->m_pkthdr.rcvif; 509 if (IN_LOOPBACK(ntohl(ip->ip_dst.s_addr)) || 510 IN_LOOPBACK(ntohl(ip->ip_src.s_addr))) { 511 if ((ifp->if_flags & IFF_LOOPBACK) == 0) { 512 IPSTAT_INC(ips_badaddr); 513 goto bad; 514 } 515 } 516 517 if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) { 518 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID); 519 } else { 520 if (hlen == sizeof(struct ip)) { 521 sum = in_cksum_hdr(ip); 522 } else { 523 sum = in_cksum(m, hlen); 524 } 525 } 526 if (sum) { 527 IPSTAT_INC(ips_badsum); 528 goto bad; 529 } 530 531 #ifdef ALTQ 532 if (altq_input != NULL && (*altq_input)(m, AF_INET) == 0) 533 /* packet is dropped by traffic conditioner */ 534 return; 535 #endif 536 537 ip_len = ntohs(ip->ip_len); 538 if (ip_len < hlen) { 539 IPSTAT_INC(ips_badlen); 540 goto bad; 541 } 542 543 /* 544 * Check that the amount of data in the buffers 545 * is as at least much as the IP header would have us expect. 546 * Trim mbufs if longer than we expect. 547 * Drop packet if shorter than we expect. 548 */ 549 if (m->m_pkthdr.len < ip_len) { 550 tooshort: 551 IPSTAT_INC(ips_tooshort); 552 goto bad; 553 } 554 if (m->m_pkthdr.len > ip_len) { 555 if (m->m_len == m->m_pkthdr.len) { 556 m->m_len = ip_len; 557 m->m_pkthdr.len = ip_len; 558 } else 559 m_adj(m, ip_len - m->m_pkthdr.len); 560 } 561 562 /* 563 * Try to forward the packet, but if we fail continue. 564 * ip_tryforward() does not generate redirects, so fall 565 * through to normal processing if redirects are required. 566 * ip_tryforward() does inbound and outbound packet firewall 567 * processing. If firewall has decided that destination becomes 568 * our local address, it sets M_FASTFWD_OURS flag. In this 569 * case skip another inbound firewall processing and update 570 * ip pointer. 571 */ 572 if (V_ipforwarding != 0 573 #if defined(IPSEC) || defined(IPSEC_SUPPORT) 574 && (!IPSEC_ENABLED(ipv4) || 575 IPSEC_CAPS(ipv4, m, IPSEC_CAP_OPERABLE) == 0) 576 #endif 577 ) { 578 if ((m = ip_tryforward(m)) == NULL) 579 return; 580 if (m->m_flags & M_FASTFWD_OURS) { 581 m->m_flags &= ~M_FASTFWD_OURS; 582 ip = mtod(m, struct ip *); 583 goto ours; 584 } 585 } 586 587 #if defined(IPSEC) || defined(IPSEC_SUPPORT) 588 /* 589 * Bypass packet filtering for packets previously handled by IPsec. 590 */ 591 if (IPSEC_ENABLED(ipv4) && 592 IPSEC_CAPS(ipv4, m, IPSEC_CAP_BYPASS_FILTER) != 0) 593 goto passin; 594 #endif 595 596 /* 597 * Run through list of hooks for input packets. 598 * 599 * NB: Beware of the destination address changing (e.g. 600 * by NAT rewriting). When this happens, tell 601 * ip_forward to do the right thing. 602 */ 603 604 /* Jump over all PFIL processing if hooks are not active. */ 605 if (!PFIL_HOOKED(&V_inet_pfil_hook)) 606 goto passin; 607 608 odst = ip->ip_dst; 609 if (pfil_run_hooks(&V_inet_pfil_hook, &m, ifp, PFIL_IN, 0, NULL) != 0) 610 return; 611 if (m == NULL) /* consumed by filter */ 612 return; 613 614 ip = mtod(m, struct ip *); 615 dchg = (odst.s_addr != ip->ip_dst.s_addr); 616 ifp = m->m_pkthdr.rcvif; 617 618 if (m->m_flags & M_FASTFWD_OURS) { 619 m->m_flags &= ~M_FASTFWD_OURS; 620 goto ours; 621 } 622 if (m->m_flags & M_IP_NEXTHOP) { 623 if (m_tag_find(m, PACKET_TAG_IPFORWARD, NULL) != NULL) { 624 /* 625 * Directly ship the packet on. This allows 626 * forwarding packets originally destined to us 627 * to some other directly connected host. 628 */ 629 ip_forward(m, 1); 630 return; 631 } 632 } 633 passin: 634 635 /* 636 * Process options and, if not destined for us, 637 * ship it on. ip_dooptions returns 1 when an 638 * error was detected (causing an icmp message 639 * to be sent and the original packet to be freed). 640 */ 641 if (hlen > sizeof (struct ip) && ip_dooptions(m, 0)) 642 return; 643 644 /* greedy RSVP, snatches any PATH packet of the RSVP protocol and no 645 * matter if it is destined to another node, or whether it is 646 * a multicast one, RSVP wants it! and prevents it from being forwarded 647 * anywhere else. Also checks if the rsvp daemon is running before 648 * grabbing the packet. 649 */ 650 if (V_rsvp_on && ip->ip_p==IPPROTO_RSVP) 651 goto ours; 652 653 /* 654 * Check our list of addresses, to see if the packet is for us. 655 * If we don't have any addresses, assume any unicast packet 656 * we receive might be for us (and let the upper layers deal 657 * with it). 658 */ 659 if (CK_STAILQ_EMPTY(&V_in_ifaddrhead) && 660 (m->m_flags & (M_MCAST|M_BCAST)) == 0) 661 goto ours; 662 663 /* 664 * Enable a consistency check between the destination address 665 * and the arrival interface for a unicast packet (the RFC 1122 666 * strong ES model) if IP forwarding is disabled and the packet 667 * is not locally generated and the packet is not subject to 668 * 'ipfw fwd'. 669 * 670 * XXX - Checking also should be disabled if the destination 671 * address is ipnat'ed to a different interface. 672 * 673 * XXX - Checking is incompatible with IP aliases added 674 * to the loopback interface instead of the interface where 675 * the packets are received. 676 * 677 * XXX - This is the case for carp vhost IPs as well so we 678 * insert a workaround. If the packet got here, we already 679 * checked with carp_iamatch() and carp_forus(). 680 */ 681 checkif = V_ip_checkinterface && (V_ipforwarding == 0) && 682 ifp != NULL && ((ifp->if_flags & IFF_LOOPBACK) == 0) && 683 ifp->if_carp == NULL && (dchg == 0); 684 685 /* 686 * Check for exact addresses in the hash bucket. 687 */ 688 IN_IFADDR_RLOCK(&in_ifa_tracker); 689 LIST_FOREACH(ia, INADDR_HASH(ip->ip_dst.s_addr), ia_hash) { 690 /* 691 * If the address matches, verify that the packet 692 * arrived via the correct interface if checking is 693 * enabled. 694 */ 695 if (IA_SIN(ia)->sin_addr.s_addr == ip->ip_dst.s_addr && 696 (!checkif || ia->ia_ifp == ifp)) { 697 counter_u64_add(ia->ia_ifa.ifa_ipackets, 1); 698 counter_u64_add(ia->ia_ifa.ifa_ibytes, 699 m->m_pkthdr.len); 700 IN_IFADDR_RUNLOCK(&in_ifa_tracker); 701 goto ours; 702 } 703 } 704 IN_IFADDR_RUNLOCK(&in_ifa_tracker); 705 706 /* 707 * Check for broadcast addresses. 708 * 709 * Only accept broadcast packets that arrive via the matching 710 * interface. Reception of forwarded directed broadcasts would 711 * be handled via ip_forward() and ether_output() with the loopback 712 * into the stack for SIMPLEX interfaces handled by ether_output(). 713 */ 714 if (ifp != NULL && ifp->if_flags & IFF_BROADCAST) { 715 IF_ADDR_RLOCK(ifp); 716 CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 717 if (ifa->ifa_addr->sa_family != AF_INET) 718 continue; 719 ia = ifatoia(ifa); 720 if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr == 721 ip->ip_dst.s_addr) { 722 counter_u64_add(ia->ia_ifa.ifa_ipackets, 1); 723 counter_u64_add(ia->ia_ifa.ifa_ibytes, 724 m->m_pkthdr.len); 725 IF_ADDR_RUNLOCK(ifp); 726 goto ours; 727 } 728 #ifdef BOOTP_COMPAT 729 if (IA_SIN(ia)->sin_addr.s_addr == INADDR_ANY) { 730 counter_u64_add(ia->ia_ifa.ifa_ipackets, 1); 731 counter_u64_add(ia->ia_ifa.ifa_ibytes, 732 m->m_pkthdr.len); 733 IF_ADDR_RUNLOCK(ifp); 734 goto ours; 735 } 736 #endif 737 } 738 IF_ADDR_RUNLOCK(ifp); 739 ia = NULL; 740 } 741 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) { 742 /* 743 * RFC 3927 2.7: Do not forward multicast packets from 744 * IN_LINKLOCAL. 745 */ 746 if (V_ip_mrouter && !IN_LINKLOCAL(ntohl(ip->ip_src.s_addr))) { 747 /* 748 * If we are acting as a multicast router, all 749 * incoming multicast packets are passed to the 750 * kernel-level multicast forwarding function. 751 * The packet is returned (relatively) intact; if 752 * ip_mforward() returns a non-zero value, the packet 753 * must be discarded, else it may be accepted below. 754 */ 755 if (ip_mforward && ip_mforward(ip, ifp, m, 0) != 0) { 756 IPSTAT_INC(ips_cantforward); 757 m_freem(m); 758 return; 759 } 760 761 /* 762 * The process-level routing daemon needs to receive 763 * all multicast IGMP packets, whether or not this 764 * host belongs to their destination groups. 765 */ 766 if (ip->ip_p == IPPROTO_IGMP) 767 goto ours; 768 IPSTAT_INC(ips_forward); 769 } 770 /* 771 * Assume the packet is for us, to avoid prematurely taking 772 * a lock on the in_multi hash. Protocols must perform 773 * their own filtering and update statistics accordingly. 774 */ 775 goto ours; 776 } 777 if (ip->ip_dst.s_addr == (u_long)INADDR_BROADCAST) 778 goto ours; 779 if (ip->ip_dst.s_addr == INADDR_ANY) 780 goto ours; 781 /* RFC 3927 2.7: Do not forward packets to or from IN_LINKLOCAL. */ 782 if (IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr)) || 783 IN_LINKLOCAL(ntohl(ip->ip_src.s_addr))) { 784 IPSTAT_INC(ips_cantforward); 785 m_freem(m); 786 return; 787 } 788 789 /* 790 * Not for us; forward if possible and desirable. 791 */ 792 if (V_ipforwarding == 0) { 793 IPSTAT_INC(ips_cantforward); 794 m_freem(m); 795 } else { 796 ip_forward(m, dchg); 797 } 798 return; 799 800 ours: 801 #ifdef IPSTEALTH 802 /* 803 * IPSTEALTH: Process non-routing options only 804 * if the packet is destined for us. 805 */ 806 if (V_ipstealth && hlen > sizeof (struct ip) && ip_dooptions(m, 1)) 807 return; 808 #endif /* IPSTEALTH */ 809 810 /* 811 * Attempt reassembly; if it succeeds, proceed. 812 * ip_reass() will return a different mbuf. 813 */ 814 if (ip->ip_off & htons(IP_MF | IP_OFFMASK)) { 815 /* XXXGL: shouldn't we save & set m_flags? */ 816 m = ip_reass(m); 817 if (m == NULL) 818 return; 819 ip = mtod(m, struct ip *); 820 /* Get the header length of the reassembled packet */ 821 hlen = ip->ip_hl << 2; 822 } 823 824 #if defined(IPSEC) || defined(IPSEC_SUPPORT) 825 if (IPSEC_ENABLED(ipv4)) { 826 if (IPSEC_INPUT(ipv4, m, hlen, ip->ip_p) != 0) 827 return; 828 } 829 #endif /* IPSEC */ 830 831 /* 832 * Switch out to protocol's input routine. 833 */ 834 IPSTAT_INC(ips_delivered); 835 836 (*inetsw[ip_protox[ip->ip_p]].pr_input)(&m, &hlen, ip->ip_p); 837 return; 838 bad: 839 m_freem(m); 840 } 841 842 /* 843 * IP timer processing; 844 * if a timer expires on a reassembly 845 * queue, discard it. 846 */ 847 void 848 ip_slowtimo(void) 849 { 850 VNET_ITERATOR_DECL(vnet_iter); 851 852 VNET_LIST_RLOCK_NOSLEEP(); 853 VNET_FOREACH(vnet_iter) { 854 CURVNET_SET(vnet_iter); 855 ipreass_slowtimo(); 856 CURVNET_RESTORE(); 857 } 858 VNET_LIST_RUNLOCK_NOSLEEP(); 859 } 860 861 void 862 ip_drain(void) 863 { 864 VNET_ITERATOR_DECL(vnet_iter); 865 866 VNET_LIST_RLOCK_NOSLEEP(); 867 VNET_FOREACH(vnet_iter) { 868 CURVNET_SET(vnet_iter); 869 ipreass_drain(); 870 CURVNET_RESTORE(); 871 } 872 VNET_LIST_RUNLOCK_NOSLEEP(); 873 } 874 875 /* 876 * The protocol to be inserted into ip_protox[] must be already registered 877 * in inetsw[], either statically or through pf_proto_register(). 878 */ 879 int 880 ipproto_register(short ipproto) 881 { 882 struct protosw *pr; 883 884 /* Sanity checks. */ 885 if (ipproto <= 0 || ipproto >= IPPROTO_MAX) 886 return (EPROTONOSUPPORT); 887 888 /* 889 * The protocol slot must not be occupied by another protocol 890 * already. An index pointing to IPPROTO_RAW is unused. 891 */ 892 pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 893 if (pr == NULL) 894 return (EPFNOSUPPORT); 895 if (ip_protox[ipproto] != pr - inetsw) /* IPPROTO_RAW */ 896 return (EEXIST); 897 898 /* Find the protocol position in inetsw[] and set the index. */ 899 for (pr = inetdomain.dom_protosw; 900 pr < inetdomain.dom_protoswNPROTOSW; pr++) { 901 if (pr->pr_domain->dom_family == PF_INET && 902 pr->pr_protocol && pr->pr_protocol == ipproto) { 903 ip_protox[pr->pr_protocol] = pr - inetsw; 904 return (0); 905 } 906 } 907 return (EPROTONOSUPPORT); 908 } 909 910 int 911 ipproto_unregister(short ipproto) 912 { 913 struct protosw *pr; 914 915 /* Sanity checks. */ 916 if (ipproto <= 0 || ipproto >= IPPROTO_MAX) 917 return (EPROTONOSUPPORT); 918 919 /* Check if the protocol was indeed registered. */ 920 pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 921 if (pr == NULL) 922 return (EPFNOSUPPORT); 923 if (ip_protox[ipproto] == pr - inetsw) /* IPPROTO_RAW */ 924 return (ENOENT); 925 926 /* Reset the protocol slot to IPPROTO_RAW. */ 927 ip_protox[ipproto] = pr - inetsw; 928 return (0); 929 } 930 931 u_char inetctlerrmap[PRC_NCMDS] = { 932 0, 0, 0, 0, 933 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, 934 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, 935 EMSGSIZE, EHOSTUNREACH, 0, 0, 936 0, 0, EHOSTUNREACH, 0, 937 ENOPROTOOPT, ECONNREFUSED 938 }; 939 940 /* 941 * Forward a packet. If some error occurs return the sender 942 * an icmp packet. Note we can't always generate a meaningful 943 * icmp message because icmp doesn't have a large enough repertoire 944 * of codes and types. 945 * 946 * If not forwarding, just drop the packet. This could be confusing 947 * if ipforwarding was zero but some routing protocol was advancing 948 * us as a gateway to somewhere. However, we must let the routing 949 * protocol deal with that. 950 * 951 * The srcrt parameter indicates whether the packet is being forwarded 952 * via a source route. 953 */ 954 void 955 ip_forward(struct mbuf *m, int srcrt) 956 { 957 struct ip *ip = mtod(m, struct ip *); 958 struct in_ifaddr *ia; 959 struct mbuf *mcopy; 960 struct sockaddr_in *sin; 961 struct in_addr dest; 962 struct route ro; 963 int error, type = 0, code = 0, mtu = 0; 964 965 if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(ip->ip_dst) == 0) { 966 IPSTAT_INC(ips_cantforward); 967 m_freem(m); 968 return; 969 } 970 if ( 971 #ifdef IPSTEALTH 972 V_ipstealth == 0 && 973 #endif 974 ip->ip_ttl <= IPTTLDEC) { 975 icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 0, 0); 976 return; 977 } 978 979 bzero(&ro, sizeof(ro)); 980 sin = (struct sockaddr_in *)&ro.ro_dst; 981 sin->sin_family = AF_INET; 982 sin->sin_len = sizeof(*sin); 983 sin->sin_addr = ip->ip_dst; 984 #ifdef RADIX_MPATH 985 rtalloc_mpath_fib(&ro, 986 ntohl(ip->ip_src.s_addr ^ ip->ip_dst.s_addr), 987 M_GETFIB(m)); 988 #else 989 in_rtalloc_ign(&ro, 0, M_GETFIB(m)); 990 #endif 991 NET_EPOCH_ENTER(); 992 if (ro.ro_rt != NULL) { 993 ia = ifatoia(ro.ro_rt->rt_ifa); 994 } else 995 ia = NULL; 996 /* 997 * Save the IP header and at most 8 bytes of the payload, 998 * in case we need to generate an ICMP message to the src. 999 * 1000 * XXX this can be optimized a lot by saving the data in a local 1001 * buffer on the stack (72 bytes at most), and only allocating the 1002 * mbuf if really necessary. The vast majority of the packets 1003 * are forwarded without having to send an ICMP back (either 1004 * because unnecessary, or because rate limited), so we are 1005 * really we are wasting a lot of work here. 1006 * 1007 * We don't use m_copym() because it might return a reference 1008 * to a shared cluster. Both this function and ip_output() 1009 * assume exclusive access to the IP header in `m', so any 1010 * data in a cluster may change before we reach icmp_error(). 1011 */ 1012 mcopy = m_gethdr(M_NOWAIT, m->m_type); 1013 if (mcopy != NULL && !m_dup_pkthdr(mcopy, m, M_NOWAIT)) { 1014 /* 1015 * It's probably ok if the pkthdr dup fails (because 1016 * the deep copy of the tag chain failed), but for now 1017 * be conservative and just discard the copy since 1018 * code below may some day want the tags. 1019 */ 1020 m_free(mcopy); 1021 mcopy = NULL; 1022 } 1023 if (mcopy != NULL) { 1024 mcopy->m_len = min(ntohs(ip->ip_len), M_TRAILINGSPACE(mcopy)); 1025 mcopy->m_pkthdr.len = mcopy->m_len; 1026 m_copydata(m, 0, mcopy->m_len, mtod(mcopy, caddr_t)); 1027 } 1028 #ifdef IPSTEALTH 1029 if (V_ipstealth == 0) 1030 #endif 1031 ip->ip_ttl -= IPTTLDEC; 1032 #if defined(IPSEC) || defined(IPSEC_SUPPORT) 1033 if (IPSEC_ENABLED(ipv4)) { 1034 if ((error = IPSEC_FORWARD(ipv4, m)) != 0) { 1035 /* mbuf consumed by IPsec */ 1036 m_freem(mcopy); 1037 if (error != EINPROGRESS) 1038 IPSTAT_INC(ips_cantforward); 1039 goto out; 1040 } 1041 /* No IPsec processing required */ 1042 } 1043 #endif /* IPSEC */ 1044 /* 1045 * If forwarding packet using same interface that it came in on, 1046 * perhaps should send a redirect to sender to shortcut a hop. 1047 * Only send redirect if source is sending directly to us, 1048 * and if packet was not source routed (or has any options). 1049 * Also, don't send redirect if forwarding using a default route 1050 * or a route modified by a redirect. 1051 */ 1052 dest.s_addr = 0; 1053 if (!srcrt && V_ipsendredirects && 1054 ia != NULL && ia->ia_ifp == m->m_pkthdr.rcvif) { 1055 struct rtentry *rt; 1056 1057 rt = ro.ro_rt; 1058 1059 if (rt && (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0 && 1060 satosin(rt_key(rt))->sin_addr.s_addr != 0) { 1061 #define RTA(rt) ((struct in_ifaddr *)(rt->rt_ifa)) 1062 u_long src = ntohl(ip->ip_src.s_addr); 1063 1064 if (RTA(rt) && 1065 (src & RTA(rt)->ia_subnetmask) == RTA(rt)->ia_subnet) { 1066 if (rt->rt_flags & RTF_GATEWAY) 1067 dest.s_addr = satosin(rt->rt_gateway)->sin_addr.s_addr; 1068 else 1069 dest.s_addr = ip->ip_dst.s_addr; 1070 /* Router requirements says to only send host redirects */ 1071 type = ICMP_REDIRECT; 1072 code = ICMP_REDIRECT_HOST; 1073 } 1074 } 1075 } 1076 1077 error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL, NULL); 1078 1079 if (error == EMSGSIZE && ro.ro_rt) 1080 mtu = ro.ro_rt->rt_mtu; 1081 RO_RTFREE(&ro); 1082 1083 if (error) 1084 IPSTAT_INC(ips_cantforward); 1085 else { 1086 IPSTAT_INC(ips_forward); 1087 if (type) 1088 IPSTAT_INC(ips_redirectsent); 1089 else { 1090 if (mcopy) 1091 m_freem(mcopy); 1092 goto out; 1093 } 1094 } 1095 if (mcopy == NULL) 1096 goto out; 1097 1098 1099 switch (error) { 1100 1101 case 0: /* forwarded, but need redirect */ 1102 /* type, code set above */ 1103 break; 1104 1105 case ENETUNREACH: 1106 case EHOSTUNREACH: 1107 case ENETDOWN: 1108 case EHOSTDOWN: 1109 default: 1110 type = ICMP_UNREACH; 1111 code = ICMP_UNREACH_HOST; 1112 break; 1113 1114 case EMSGSIZE: 1115 type = ICMP_UNREACH; 1116 code = ICMP_UNREACH_NEEDFRAG; 1117 /* 1118 * If the MTU was set before make sure we are below the 1119 * interface MTU. 1120 * If the MTU wasn't set before use the interface mtu or 1121 * fall back to the next smaller mtu step compared to the 1122 * current packet size. 1123 */ 1124 if (mtu != 0) { 1125 if (ia != NULL) 1126 mtu = min(mtu, ia->ia_ifp->if_mtu); 1127 } else { 1128 if (ia != NULL) 1129 mtu = ia->ia_ifp->if_mtu; 1130 else 1131 mtu = ip_next_mtu(ntohs(ip->ip_len), 0); 1132 } 1133 IPSTAT_INC(ips_cantfrag); 1134 break; 1135 1136 case ENOBUFS: 1137 case EACCES: /* ipfw denied packet */ 1138 m_freem(mcopy); 1139 goto out; 1140 } 1141 icmp_error(mcopy, type, code, dest.s_addr, mtu); 1142 out: 1143 NET_EPOCH_EXIT(); 1144 } 1145 1146 #define CHECK_SO_CT(sp, ct) \ 1147 (((sp->so_options & SO_TIMESTAMP) && (sp->so_ts_clock == ct)) ? 1 : 0) 1148 1149 void 1150 ip_savecontrol(struct inpcb *inp, struct mbuf **mp, struct ip *ip, 1151 struct mbuf *m) 1152 { 1153 bool stamped; 1154 1155 stamped = false; 1156 if ((inp->inp_socket->so_options & SO_BINTIME) || 1157 CHECK_SO_CT(inp->inp_socket, SO_TS_BINTIME)) { 1158 struct bintime boottimebin, bt; 1159 struct timespec ts1; 1160 1161 if ((m->m_flags & (M_PKTHDR | M_TSTMP)) == (M_PKTHDR | 1162 M_TSTMP)) { 1163 mbuf_tstmp2timespec(m, &ts1); 1164 timespec2bintime(&ts1, &bt); 1165 getboottimebin(&boottimebin); 1166 bintime_add(&bt, &boottimebin); 1167 } else { 1168 bintime(&bt); 1169 } 1170 *mp = sbcreatecontrol((caddr_t)&bt, sizeof(bt), 1171 SCM_BINTIME, SOL_SOCKET); 1172 if (*mp != NULL) { 1173 mp = &(*mp)->m_next; 1174 stamped = true; 1175 } 1176 } 1177 if (CHECK_SO_CT(inp->inp_socket, SO_TS_REALTIME_MICRO)) { 1178 struct bintime boottimebin, bt1; 1179 struct timespec ts1;; 1180 struct timeval tv; 1181 1182 if ((m->m_flags & (M_PKTHDR | M_TSTMP)) == (M_PKTHDR | 1183 M_TSTMP)) { 1184 mbuf_tstmp2timespec(m, &ts1); 1185 timespec2bintime(&ts1, &bt1); 1186 getboottimebin(&boottimebin); 1187 bintime_add(&bt1, &boottimebin); 1188 bintime2timeval(&bt1, &tv); 1189 } else { 1190 microtime(&tv); 1191 } 1192 *mp = sbcreatecontrol((caddr_t)&tv, sizeof(tv), 1193 SCM_TIMESTAMP, SOL_SOCKET); 1194 if (*mp != NULL) { 1195 mp = &(*mp)->m_next; 1196 stamped = true; 1197 } 1198 } else if (CHECK_SO_CT(inp->inp_socket, SO_TS_REALTIME)) { 1199 struct bintime boottimebin; 1200 struct timespec ts, ts1; 1201 1202 if ((m->m_flags & (M_PKTHDR | M_TSTMP)) == (M_PKTHDR | 1203 M_TSTMP)) { 1204 mbuf_tstmp2timespec(m, &ts); 1205 getboottimebin(&boottimebin); 1206 bintime2timespec(&boottimebin, &ts1); 1207 timespecadd(&ts, &ts1, &ts); 1208 } else { 1209 nanotime(&ts); 1210 } 1211 *mp = sbcreatecontrol((caddr_t)&ts, sizeof(ts), 1212 SCM_REALTIME, SOL_SOCKET); 1213 if (*mp != NULL) { 1214 mp = &(*mp)->m_next; 1215 stamped = true; 1216 } 1217 } else if (CHECK_SO_CT(inp->inp_socket, SO_TS_MONOTONIC)) { 1218 struct timespec ts; 1219 1220 if ((m->m_flags & (M_PKTHDR | M_TSTMP)) == (M_PKTHDR | 1221 M_TSTMP)) 1222 mbuf_tstmp2timespec(m, &ts); 1223 else 1224 nanouptime(&ts); 1225 *mp = sbcreatecontrol((caddr_t)&ts, sizeof(ts), 1226 SCM_MONOTONIC, SOL_SOCKET); 1227 if (*mp != NULL) { 1228 mp = &(*mp)->m_next; 1229 stamped = true; 1230 } 1231 } 1232 if (stamped && (m->m_flags & (M_PKTHDR | M_TSTMP)) == (M_PKTHDR | 1233 M_TSTMP)) { 1234 struct sock_timestamp_info sti; 1235 1236 bzero(&sti, sizeof(sti)); 1237 sti.st_info_flags = ST_INFO_HW; 1238 if ((m->m_flags & M_TSTMP_HPREC) != 0) 1239 sti.st_info_flags |= ST_INFO_HW_HPREC; 1240 *mp = sbcreatecontrol((caddr_t)&sti, sizeof(sti), SCM_TIME_INFO, 1241 SOL_SOCKET); 1242 if (*mp != NULL) 1243 mp = &(*mp)->m_next; 1244 } 1245 if (inp->inp_flags & INP_RECVDSTADDR) { 1246 *mp = sbcreatecontrol((caddr_t)&ip->ip_dst, 1247 sizeof(struct in_addr), IP_RECVDSTADDR, IPPROTO_IP); 1248 if (*mp) 1249 mp = &(*mp)->m_next; 1250 } 1251 if (inp->inp_flags & INP_RECVTTL) { 1252 *mp = sbcreatecontrol((caddr_t)&ip->ip_ttl, 1253 sizeof(u_char), IP_RECVTTL, IPPROTO_IP); 1254 if (*mp) 1255 mp = &(*mp)->m_next; 1256 } 1257 #ifdef notyet 1258 /* XXX 1259 * Moving these out of udp_input() made them even more broken 1260 * than they already were. 1261 */ 1262 /* options were tossed already */ 1263 if (inp->inp_flags & INP_RECVOPTS) { 1264 *mp = sbcreatecontrol((caddr_t)opts_deleted_above, 1265 sizeof(struct in_addr), IP_RECVOPTS, IPPROTO_IP); 1266 if (*mp) 1267 mp = &(*mp)->m_next; 1268 } 1269 /* ip_srcroute doesn't do what we want here, need to fix */ 1270 if (inp->inp_flags & INP_RECVRETOPTS) { 1271 *mp = sbcreatecontrol((caddr_t)ip_srcroute(m), 1272 sizeof(struct in_addr), IP_RECVRETOPTS, IPPROTO_IP); 1273 if (*mp) 1274 mp = &(*mp)->m_next; 1275 } 1276 #endif 1277 if (inp->inp_flags & INP_RECVIF) { 1278 struct ifnet *ifp; 1279 struct sdlbuf { 1280 struct sockaddr_dl sdl; 1281 u_char pad[32]; 1282 } sdlbuf; 1283 struct sockaddr_dl *sdp; 1284 struct sockaddr_dl *sdl2 = &sdlbuf.sdl; 1285 1286 if ((ifp = m->m_pkthdr.rcvif) && 1287 ifp->if_index && ifp->if_index <= V_if_index) { 1288 sdp = (struct sockaddr_dl *)ifp->if_addr->ifa_addr; 1289 /* 1290 * Change our mind and don't try copy. 1291 */ 1292 if (sdp->sdl_family != AF_LINK || 1293 sdp->sdl_len > sizeof(sdlbuf)) { 1294 goto makedummy; 1295 } 1296 bcopy(sdp, sdl2, sdp->sdl_len); 1297 } else { 1298 makedummy: 1299 sdl2->sdl_len = 1300 offsetof(struct sockaddr_dl, sdl_data[0]); 1301 sdl2->sdl_family = AF_LINK; 1302 sdl2->sdl_index = 0; 1303 sdl2->sdl_nlen = sdl2->sdl_alen = sdl2->sdl_slen = 0; 1304 } 1305 *mp = sbcreatecontrol((caddr_t)sdl2, sdl2->sdl_len, 1306 IP_RECVIF, IPPROTO_IP); 1307 if (*mp) 1308 mp = &(*mp)->m_next; 1309 } 1310 if (inp->inp_flags & INP_RECVTOS) { 1311 *mp = sbcreatecontrol((caddr_t)&ip->ip_tos, 1312 sizeof(u_char), IP_RECVTOS, IPPROTO_IP); 1313 if (*mp) 1314 mp = &(*mp)->m_next; 1315 } 1316 1317 if (inp->inp_flags2 & INP_RECVFLOWID) { 1318 uint32_t flowid, flow_type; 1319 1320 flowid = m->m_pkthdr.flowid; 1321 flow_type = M_HASHTYPE_GET(m); 1322 1323 /* 1324 * XXX should handle the failure of one or the 1325 * other - don't populate both? 1326 */ 1327 *mp = sbcreatecontrol((caddr_t) &flowid, 1328 sizeof(uint32_t), IP_FLOWID, IPPROTO_IP); 1329 if (*mp) 1330 mp = &(*mp)->m_next; 1331 *mp = sbcreatecontrol((caddr_t) &flow_type, 1332 sizeof(uint32_t), IP_FLOWTYPE, IPPROTO_IP); 1333 if (*mp) 1334 mp = &(*mp)->m_next; 1335 } 1336 1337 #ifdef RSS 1338 if (inp->inp_flags2 & INP_RECVRSSBUCKETID) { 1339 uint32_t flowid, flow_type; 1340 uint32_t rss_bucketid; 1341 1342 flowid = m->m_pkthdr.flowid; 1343 flow_type = M_HASHTYPE_GET(m); 1344 1345 if (rss_hash2bucket(flowid, flow_type, &rss_bucketid) == 0) { 1346 *mp = sbcreatecontrol((caddr_t) &rss_bucketid, 1347 sizeof(uint32_t), IP_RSSBUCKETID, IPPROTO_IP); 1348 if (*mp) 1349 mp = &(*mp)->m_next; 1350 } 1351 } 1352 #endif 1353 } 1354 1355 /* 1356 * XXXRW: Multicast routing code in ip_mroute.c is generally MPSAFE, but the 1357 * ip_rsvp and ip_rsvp_on variables need to be interlocked with rsvp_on 1358 * locking. This code remains in ip_input.c as ip_mroute.c is optionally 1359 * compiled. 1360 */ 1361 VNET_DEFINE_STATIC(int, ip_rsvp_on); 1362 VNET_DEFINE(struct socket *, ip_rsvpd); 1363 1364 #define V_ip_rsvp_on VNET(ip_rsvp_on) 1365 1366 int 1367 ip_rsvp_init(struct socket *so) 1368 { 1369 1370 if (so->so_type != SOCK_RAW || 1371 so->so_proto->pr_protocol != IPPROTO_RSVP) 1372 return EOPNOTSUPP; 1373 1374 if (V_ip_rsvpd != NULL) 1375 return EADDRINUSE; 1376 1377 V_ip_rsvpd = so; 1378 /* 1379 * This may seem silly, but we need to be sure we don't over-increment 1380 * the RSVP counter, in case something slips up. 1381 */ 1382 if (!V_ip_rsvp_on) { 1383 V_ip_rsvp_on = 1; 1384 V_rsvp_on++; 1385 } 1386 1387 return 0; 1388 } 1389 1390 int 1391 ip_rsvp_done(void) 1392 { 1393 1394 V_ip_rsvpd = NULL; 1395 /* 1396 * This may seem silly, but we need to be sure we don't over-decrement 1397 * the RSVP counter, in case something slips up. 1398 */ 1399 if (V_ip_rsvp_on) { 1400 V_ip_rsvp_on = 0; 1401 V_rsvp_on--; 1402 } 1403 return 0; 1404 } 1405 1406 int 1407 rsvp_input(struct mbuf **mp, int *offp, int proto) 1408 { 1409 struct mbuf *m; 1410 1411 m = *mp; 1412 *mp = NULL; 1413 1414 if (rsvp_input_p) { /* call the real one if loaded */ 1415 *mp = m; 1416 rsvp_input_p(mp, offp, proto); 1417 return (IPPROTO_DONE); 1418 } 1419 1420 /* Can still get packets with rsvp_on = 0 if there is a local member 1421 * of the group to which the RSVP packet is addressed. But in this 1422 * case we want to throw the packet away. 1423 */ 1424 1425 if (!V_rsvp_on) { 1426 m_freem(m); 1427 return (IPPROTO_DONE); 1428 } 1429 1430 if (V_ip_rsvpd != NULL) { 1431 *mp = m; 1432 rip_input(mp, offp, proto); 1433 return (IPPROTO_DONE); 1434 } 1435 /* Drop the packet */ 1436 m_freem(m); 1437 return (IPPROTO_DONE); 1438 }
Cache object: 57c705d3c8ed38c4890512b700a8904b
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]