1 /*
2 * Copyright (c) 1982, 1986, 1988, 1993
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by the University of
16 * California, Berkeley and its contributors.
17 * 4. Neither the name of the University nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 *
33 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94
34 * $FreeBSD: releng/5.0/sys/netinet/ip_input.c 107114 2002-11-20 19:07:27Z luigi $
35 */
36
37 #include "opt_bootp.h"
38 #include "opt_ipfw.h"
39 #include "opt_ipdn.h"
40 #include "opt_ipdivert.h"
41 #include "opt_ipfilter.h"
42 #include "opt_ipstealth.h"
43 #include "opt_ipsec.h"
44 #include "opt_mac.h"
45 #include "opt_pfil_hooks.h"
46 #include "opt_random_ip_id.h"
47
48 #include <sys/param.h>
49 #include <sys/systm.h>
50 #include <sys/mac.h>
51 #include <sys/mbuf.h>
52 #include <sys/malloc.h>
53 #include <sys/domain.h>
54 #include <sys/protosw.h>
55 #include <sys/socket.h>
56 #include <sys/time.h>
57 #include <sys/kernel.h>
58 #include <sys/syslog.h>
59 #include <sys/sysctl.h>
60
61 #include <net/pfil.h>
62 #include <net/if.h>
63 #include <net/if_types.h>
64 #include <net/if_var.h>
65 #include <net/if_dl.h>
66 #include <net/route.h>
67 #include <net/netisr.h>
68 #include <net/intrq.h>
69
70 #include <netinet/in.h>
71 #include <netinet/in_systm.h>
72 #include <netinet/in_var.h>
73 #include <netinet/ip.h>
74 #include <netinet/in_pcb.h>
75 #include <netinet/ip_var.h>
76 #include <netinet/ip_icmp.h>
77 #include <machine/in_cksum.h>
78
79 #include <sys/socketvar.h>
80
81 #include <netinet/ip_fw.h>
82 #include <netinet/ip_dummynet.h>
83
84 #ifdef IPSEC
85 #include <netinet6/ipsec.h>
86 #include <netkey/key.h>
87 #endif
88
89 #ifdef FAST_IPSEC
90 #include <netipsec/ipsec.h>
91 #include <netipsec/key.h>
92 #endif
93
94 int rsvp_on = 0;
95
96 int ipforwarding = 0;
97 SYSCTL_INT(_net_inet_ip, IPCTL_FORWARDING, forwarding, CTLFLAG_RW,
98 &ipforwarding, 0, "Enable IP forwarding between interfaces");
99
100 static int ipsendredirects = 1; /* XXX */
101 SYSCTL_INT(_net_inet_ip, IPCTL_SENDREDIRECTS, redirect, CTLFLAG_RW,
102 &ipsendredirects, 0, "Enable sending IP redirects");
103
104 int ip_defttl = IPDEFTTL;
105 SYSCTL_INT(_net_inet_ip, IPCTL_DEFTTL, ttl, CTLFLAG_RW,
106 &ip_defttl, 0, "Maximum TTL on IP packets");
107
108 static int ip_dosourceroute = 0;
109 SYSCTL_INT(_net_inet_ip, IPCTL_SOURCEROUTE, sourceroute, CTLFLAG_RW,
110 &ip_dosourceroute, 0, "Enable forwarding source routed IP packets");
111
112 static int ip_acceptsourceroute = 0;
113 SYSCTL_INT(_net_inet_ip, IPCTL_ACCEPTSOURCEROUTE, accept_sourceroute,
114 CTLFLAG_RW, &ip_acceptsourceroute, 0,
115 "Enable accepting source routed IP packets");
116
117 static int ip_keepfaith = 0;
118 SYSCTL_INT(_net_inet_ip, IPCTL_KEEPFAITH, keepfaith, CTLFLAG_RW,
119 &ip_keepfaith, 0,
120 "Enable packet capture for FAITH IPv4->IPv6 translater daemon");
121
122 static int ip_nfragpackets = 0;
123 static int ip_maxfragpackets; /* initialized in ip_init() */
124 SYSCTL_INT(_net_inet_ip, OID_AUTO, maxfragpackets, CTLFLAG_RW,
125 &ip_maxfragpackets, 0,
126 "Maximum number of IPv4 fragment reassembly queue entries");
127
128 static int ip_sendsourcequench = 0;
129 SYSCTL_INT(_net_inet_ip, OID_AUTO, sendsourcequench, CTLFLAG_RW,
130 &ip_sendsourcequench, 0,
131 "Enable the transmission of source quench packets");
132
133 /*
134 * XXX - Setting ip_checkinterface mostly implements the receive side of
135 * the Strong ES model described in RFC 1122, but since the routing table
136 * and transmit implementation do not implement the Strong ES model,
137 * setting this to 1 results in an odd hybrid.
138 *
139 * XXX - ip_checkinterface currently must be disabled if you use ipnat
140 * to translate the destination address to another local interface.
141 *
142 * XXX - ip_checkinterface must be disabled if you add IP aliases
143 * to the loopback interface instead of the interface where the
144 * packets for those addresses are received.
145 */
146 static int ip_checkinterface = 1;
147 SYSCTL_INT(_net_inet_ip, OID_AUTO, check_interface, CTLFLAG_RW,
148 &ip_checkinterface, 0, "Verify packet arrives on correct interface");
149
150 #ifdef DIAGNOSTIC
151 static int ipprintfs = 0;
152 #endif
153
154 static int ipqmaxlen = IFQ_MAXLEN;
155
156 extern struct domain inetdomain;
157 extern struct protosw inetsw[];
158 u_char ip_protox[IPPROTO_MAX];
159 struct in_ifaddrhead in_ifaddrhead; /* first inet address */
160 struct in_ifaddrhashhead *in_ifaddrhashtbl; /* inet addr hash table */
161 u_long in_ifaddrhmask; /* mask for hash table */
162
163 SYSCTL_INT(_net_inet_ip, IPCTL_INTRQMAXLEN, intr_queue_maxlen, CTLFLAG_RW,
164 &ipintrq.ifq_maxlen, 0, "Maximum size of the IP input queue");
165 SYSCTL_INT(_net_inet_ip, IPCTL_INTRQDROPS, intr_queue_drops, CTLFLAG_RD,
166 &ipintrq.ifq_drops, 0, "Number of packets dropped from the IP input queue");
167
168 struct ipstat ipstat;
169 SYSCTL_STRUCT(_net_inet_ip, IPCTL_STATS, stats, CTLFLAG_RW,
170 &ipstat, ipstat, "IP statistics (struct ipstat, netinet/ip_var.h)");
171
172 /* Packet reassembly stuff */
173 #define IPREASS_NHASH_LOG2 6
174 #define IPREASS_NHASH (1 << IPREASS_NHASH_LOG2)
175 #define IPREASS_HMASK (IPREASS_NHASH - 1)
176 #define IPREASS_HASH(x,y) \
177 (((((x) & 0xF) | ((((x) >> 8) & 0xF) << 4)) ^ (y)) & IPREASS_HMASK)
178
179 static TAILQ_HEAD(ipqhead, ipq) ipq[IPREASS_NHASH];
180 static int nipq = 0; /* total # of reass queues */
181 static int maxnipq;
182
183 #ifdef IPCTL_DEFMTU
184 SYSCTL_INT(_net_inet_ip, IPCTL_DEFMTU, mtu, CTLFLAG_RW,
185 &ip_mtu, 0, "Default MTU");
186 #endif
187
188 #ifdef IPSTEALTH
189 static int ipstealth = 0;
190 SYSCTL_INT(_net_inet_ip, OID_AUTO, stealth, CTLFLAG_RW,
191 &ipstealth, 0, "");
192 #endif
193
194
195 /* Firewall hooks */
196 ip_fw_chk_t *ip_fw_chk_ptr;
197 int fw_enable = 1 ;
198 int fw_one_pass = 1;
199
200 /* Dummynet hooks */
201 ip_dn_io_t *ip_dn_io_ptr;
202
203
204 /*
205 * XXX this is ugly -- the following two global variables are
206 * used to store packet state while it travels through the stack.
207 * Note that the code even makes assumptions on the size and
208 * alignment of fields inside struct ip_srcrt so e.g. adding some
209 * fields will break the code. This needs to be fixed.
210 *
211 * We need to save the IP options in case a protocol wants to respond
212 * to an incoming packet over the same route if the packet got here
213 * using IP source routing. This allows connection establishment and
214 * maintenance when the remote end is on a network that is not known
215 * to us.
216 */
217 static int ip_nhops = 0;
218 static struct ip_srcrt {
219 struct in_addr dst; /* final destination */
220 char nop; /* one NOP to align */
221 char srcopt[IPOPT_OFFSET + 1]; /* OPTVAL, OLEN and OFFSET */
222 struct in_addr route[MAX_IPOPTLEN/sizeof(struct in_addr)];
223 } ip_srcrt;
224
225 static void save_rte(u_char *, struct in_addr);
226 static int ip_dooptions(struct mbuf *m, int,
227 struct sockaddr_in *next_hop);
228 static void ip_forward(struct mbuf *m, int srcrt,
229 struct sockaddr_in *next_hop);
230 static void ip_freef(struct ipqhead *, struct ipq *);
231 static struct mbuf *ip_reass(struct mbuf *, struct ipqhead *,
232 struct ipq *, u_int32_t *, u_int16_t *);
233 static void ipintr(void);
234
235 /*
236 * IP initialization: fill in IP protocol switch table.
237 * All protocols not implemented in kernel go to raw IP protocol handler.
238 */
239 void
240 ip_init()
241 {
242 register struct protosw *pr;
243 register int i;
244
245 TAILQ_INIT(&in_ifaddrhead);
246 in_ifaddrhashtbl = hashinit(INADDR_NHASH, M_IFADDR, &in_ifaddrhmask);
247 pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW);
248 if (pr == 0)
249 panic("ip_init");
250 for (i = 0; i < IPPROTO_MAX; i++)
251 ip_protox[i] = pr - inetsw;
252 for (pr = inetdomain.dom_protosw;
253 pr < inetdomain.dom_protoswNPROTOSW; pr++)
254 if (pr->pr_domain->dom_family == PF_INET &&
255 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
256 ip_protox[pr->pr_protocol] = pr - inetsw;
257
258 for (i = 0; i < IPREASS_NHASH; i++)
259 TAILQ_INIT(&ipq[i]);
260
261 maxnipq = nmbclusters / 4;
262 ip_maxfragpackets = nmbclusters / 4;
263
264 #ifndef RANDOM_IP_ID
265 ip_id = time_second & 0xffff;
266 #endif
267 ipintrq.ifq_maxlen = ipqmaxlen;
268 mtx_init(&ipintrq.ifq_mtx, "ip_inq", NULL, MTX_DEF);
269 ipintrq_present = 1;
270
271 register_netisr(NETISR_IP, ipintr);
272 }
273
274 /*
275 * XXX watch out this one. It is perhaps used as a cache for
276 * the most recently used route ? it is cleared in in_addroute()
277 * when a new route is successfully created.
278 */
279 struct route ipforward_rt;
280
281 /*
282 * Ip input routine. Checksum and byte swap header. If fragmented
283 * try to reassemble. Process options. Pass to next level.
284 */
285 void
286 ip_input(struct mbuf *m)
287 {
288 struct ip *ip;
289 struct ipq *fp;
290 struct in_ifaddr *ia = NULL;
291 struct ifaddr *ifa;
292 int i, hlen, checkif;
293 u_short sum;
294 struct in_addr pkt_dst;
295 u_int32_t divert_info = 0; /* packet divert/tee info */
296 struct ip_fw_args args;
297 #ifdef PFIL_HOOKS
298 struct packet_filter_hook *pfh;
299 struct mbuf *m0;
300 int rv;
301 #endif /* PFIL_HOOKS */
302 #ifdef FAST_IPSEC
303 struct m_tag *mtag;
304 struct tdb_ident *tdbi;
305 struct secpolicy *sp;
306 int s, error;
307 #endif /* FAST_IPSEC */
308
309 args.eh = NULL;
310 args.oif = NULL;
311 args.rule = NULL;
312 args.divert_rule = 0; /* divert cookie */
313 args.next_hop = NULL;
314
315 /* Grab info from MT_TAG mbufs prepended to the chain. */
316 for (; m && m->m_type == MT_TAG; m = m->m_next) {
317 switch(m->_m_tag_id) {
318 default:
319 printf("ip_input: unrecognised MT_TAG tag %d\n",
320 m->_m_tag_id);
321 break;
322
323 case PACKET_TAG_DUMMYNET:
324 args.rule = ((struct dn_pkt *)m)->rule;
325 break;
326
327 case PACKET_TAG_DIVERT:
328 args.divert_rule = (intptr_t)m->m_hdr.mh_data & 0xffff;
329 break;
330
331 case PACKET_TAG_IPFORWARD:
332 args.next_hop = (struct sockaddr_in *)m->m_hdr.mh_data;
333 break;
334 }
335 }
336
337 KASSERT(m != NULL && (m->m_flags & M_PKTHDR) != 0,
338 ("ip_input: no HDR"));
339
340 if (args.rule) { /* dummynet already filtered us */
341 ip = mtod(m, struct ip *);
342 hlen = ip->ip_hl << 2;
343 goto iphack ;
344 }
345
346 ipstat.ips_total++;
347
348 if (m->m_pkthdr.len < sizeof(struct ip))
349 goto tooshort;
350
351 if (m->m_len < sizeof (struct ip) &&
352 (m = m_pullup(m, sizeof (struct ip))) == 0) {
353 ipstat.ips_toosmall++;
354 return;
355 }
356 ip = mtod(m, struct ip *);
357
358 if (ip->ip_v != IPVERSION) {
359 ipstat.ips_badvers++;
360 goto bad;
361 }
362
363 hlen = ip->ip_hl << 2;
364 if (hlen < sizeof(struct ip)) { /* minimum header length */
365 ipstat.ips_badhlen++;
366 goto bad;
367 }
368 if (hlen > m->m_len) {
369 if ((m = m_pullup(m, hlen)) == 0) {
370 ipstat.ips_badhlen++;
371 return;
372 }
373 ip = mtod(m, struct ip *);
374 }
375
376 /* 127/8 must not appear on wire - RFC1122 */
377 if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
378 (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
379 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) {
380 ipstat.ips_badaddr++;
381 goto bad;
382 }
383 }
384
385 if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
386 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
387 } else {
388 if (hlen == sizeof(struct ip)) {
389 sum = in_cksum_hdr(ip);
390 } else {
391 sum = in_cksum(m, hlen);
392 }
393 }
394 if (sum) {
395 ipstat.ips_badsum++;
396 goto bad;
397 }
398
399 /*
400 * Convert fields to host representation.
401 */
402 ip->ip_len = ntohs(ip->ip_len);
403 if (ip->ip_len < hlen) {
404 ipstat.ips_badlen++;
405 goto bad;
406 }
407 ip->ip_off = ntohs(ip->ip_off);
408
409 /*
410 * Check that the amount of data in the buffers
411 * is as at least much as the IP header would have us expect.
412 * Trim mbufs if longer than we expect.
413 * Drop packet if shorter than we expect.
414 */
415 if (m->m_pkthdr.len < ip->ip_len) {
416 tooshort:
417 ipstat.ips_tooshort++;
418 goto bad;
419 }
420 if (m->m_pkthdr.len > ip->ip_len) {
421 if (m->m_len == m->m_pkthdr.len) {
422 m->m_len = ip->ip_len;
423 m->m_pkthdr.len = ip->ip_len;
424 } else
425 m_adj(m, ip->ip_len - m->m_pkthdr.len);
426 }
427
428 /*
429 * IpHack's section.
430 * Right now when no processing on packet has done
431 * and it is still fresh out of network we do our black
432 * deals with it.
433 * - Firewall: deny/allow/divert
434 * - Xlate: translate packet's addr/port (NAT).
435 * - Pipe: pass pkt through dummynet.
436 * - Wrap: fake packet's addr/port <unimpl.>
437 * - Encapsulate: put it in another IP and send out. <unimp.>
438 */
439
440 iphack:
441
442 #ifdef PFIL_HOOKS
443 /*
444 * Run through list of hooks for input packets. If there are any
445 * filters which require that additional packets in the flow are
446 * not fast-forwarded, they must clear the M_CANFASTFWD flag.
447 * Note that filters must _never_ set this flag, as another filter
448 * in the list may have previously cleared it.
449 */
450 m0 = m;
451 pfh = pfil_hook_get(PFIL_IN, &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
452 for (; pfh; pfh = TAILQ_NEXT(pfh, pfil_link))
453 if (pfh->pfil_func) {
454 rv = pfh->pfil_func(ip, hlen,
455 m->m_pkthdr.rcvif, 0, &m0);
456 if (rv)
457 return;
458 m = m0;
459 if (m == NULL)
460 return;
461 ip = mtod(m, struct ip *);
462 }
463 #endif /* PFIL_HOOKS */
464
465 if (fw_enable && IPFW_LOADED) {
466 /*
467 * If we've been forwarded from the output side, then
468 * skip the firewall a second time
469 */
470 if (args.next_hop)
471 goto ours;
472
473 args.m = m;
474 i = ip_fw_chk_ptr(&args);
475 m = args.m;
476
477 if ( (i & IP_FW_PORT_DENY_FLAG) || m == NULL) { /* drop */
478 if (m)
479 m_freem(m);
480 return;
481 }
482 ip = mtod(m, struct ip *); /* just in case m changed */
483 if (i == 0 && args.next_hop == NULL) /* common case */
484 goto pass;
485 if (DUMMYNET_LOADED && (i & IP_FW_PORT_DYNT_FLAG) != 0) {
486 /* Send packet to the appropriate pipe */
487 ip_dn_io_ptr(m, i&0xffff, DN_TO_IP_IN, &args);
488 return;
489 }
490 #ifdef IPDIVERT
491 if (i != 0 && (i & IP_FW_PORT_DYNT_FLAG) == 0) {
492 /* Divert or tee packet */
493 divert_info = i;
494 goto ours;
495 }
496 #endif
497 if (i == 0 && args.next_hop != NULL)
498 goto pass;
499 /*
500 * if we get here, the packet must be dropped
501 */
502 m_freem(m);
503 return;
504 }
505 pass:
506
507 /*
508 * Process options and, if not destined for us,
509 * ship it on. ip_dooptions returns 1 when an
510 * error was detected (causing an icmp message
511 * to be sent and the original packet to be freed).
512 */
513 ip_nhops = 0; /* for source routed packets */
514 if (hlen > sizeof (struct ip) && ip_dooptions(m, 0, args.next_hop))
515 return;
516
517 /* greedy RSVP, snatches any PATH packet of the RSVP protocol and no
518 * matter if it is destined to another node, or whether it is
519 * a multicast one, RSVP wants it! and prevents it from being forwarded
520 * anywhere else. Also checks if the rsvp daemon is running before
521 * grabbing the packet.
522 */
523 if (rsvp_on && ip->ip_p==IPPROTO_RSVP)
524 goto ours;
525
526 /*
527 * Check our list of addresses, to see if the packet is for us.
528 * If we don't have any addresses, assume any unicast packet
529 * we receive might be for us (and let the upper layers deal
530 * with it).
531 */
532 if (TAILQ_EMPTY(&in_ifaddrhead) &&
533 (m->m_flags & (M_MCAST|M_BCAST)) == 0)
534 goto ours;
535
536 /*
537 * Cache the destination address of the packet; this may be
538 * changed by use of 'ipfw fwd'.
539 */
540 pkt_dst = args.next_hop ? args.next_hop->sin_addr : ip->ip_dst;
541
542 /*
543 * Enable a consistency check between the destination address
544 * and the arrival interface for a unicast packet (the RFC 1122
545 * strong ES model) if IP forwarding is disabled and the packet
546 * is not locally generated and the packet is not subject to
547 * 'ipfw fwd'.
548 *
549 * XXX - Checking also should be disabled if the destination
550 * address is ipnat'ed to a different interface.
551 *
552 * XXX - Checking is incompatible with IP aliases added
553 * to the loopback interface instead of the interface where
554 * the packets are received.
555 */
556 checkif = ip_checkinterface && (ipforwarding == 0) &&
557 m->m_pkthdr.rcvif != NULL &&
558 ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) &&
559 (args.next_hop == NULL);
560
561 /*
562 * Check for exact addresses in the hash bucket.
563 */
564 LIST_FOREACH(ia, INADDR_HASH(pkt_dst.s_addr), ia_hash) {
565 /*
566 * If the address matches, verify that the packet
567 * arrived via the correct interface if checking is
568 * enabled.
569 */
570 if (IA_SIN(ia)->sin_addr.s_addr == pkt_dst.s_addr &&
571 (!checkif || ia->ia_ifp == m->m_pkthdr.rcvif))
572 goto ours;
573 }
574 /*
575 * Check for broadcast addresses.
576 *
577 * Only accept broadcast packets that arrive via the matching
578 * interface. Reception of forwarded directed broadcasts would
579 * be handled via ip_forward() and ether_output() with the loopback
580 * into the stack for SIMPLEX interfaces handled by ether_output().
581 */
582 if (m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) {
583 TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrhead, ifa_link) {
584 if (ifa->ifa_addr->sa_family != AF_INET)
585 continue;
586 ia = ifatoia(ifa);
587 if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr ==
588 pkt_dst.s_addr)
589 goto ours;
590 if (ia->ia_netbroadcast.s_addr == pkt_dst.s_addr)
591 goto ours;
592 #ifdef BOOTP_COMPAT
593 if (IA_SIN(ia)->sin_addr.s_addr == INADDR_ANY)
594 goto ours;
595 #endif
596 }
597 }
598 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
599 struct in_multi *inm;
600 if (ip_mrouter) {
601 /*
602 * If we are acting as a multicast router, all
603 * incoming multicast packets are passed to the
604 * kernel-level multicast forwarding function.
605 * The packet is returned (relatively) intact; if
606 * ip_mforward() returns a non-zero value, the packet
607 * must be discarded, else it may be accepted below.
608 */
609 if (ip_mforward &&
610 ip_mforward(ip, m->m_pkthdr.rcvif, m, 0) != 0) {
611 ipstat.ips_cantforward++;
612 m_freem(m);
613 return;
614 }
615
616 /*
617 * The process-level routing daemon needs to receive
618 * all multicast IGMP packets, whether or not this
619 * host belongs to their destination groups.
620 */
621 if (ip->ip_p == IPPROTO_IGMP)
622 goto ours;
623 ipstat.ips_forward++;
624 }
625 /*
626 * See if we belong to the destination multicast group on the
627 * arrival interface.
628 */
629 IN_LOOKUP_MULTI(ip->ip_dst, m->m_pkthdr.rcvif, inm);
630 if (inm == NULL) {
631 ipstat.ips_notmember++;
632 m_freem(m);
633 return;
634 }
635 goto ours;
636 }
637 if (ip->ip_dst.s_addr == (u_long)INADDR_BROADCAST)
638 goto ours;
639 if (ip->ip_dst.s_addr == INADDR_ANY)
640 goto ours;
641
642 /*
643 * FAITH(Firewall Aided Internet Translator)
644 */
645 if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
646 if (ip_keepfaith) {
647 if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_ICMP)
648 goto ours;
649 }
650 m_freem(m);
651 return;
652 }
653
654 /*
655 * Not for us; forward if possible and desirable.
656 */
657 if (ipforwarding == 0) {
658 ipstat.ips_cantforward++;
659 m_freem(m);
660 } else {
661 #ifdef IPSEC
662 /*
663 * Enforce inbound IPsec SPD.
664 */
665 if (ipsec4_in_reject(m, NULL)) {
666 ipsecstat.in_polvio++;
667 goto bad;
668 }
669 #endif /* IPSEC */
670 #ifdef FAST_IPSEC
671 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
672 s = splnet();
673 if (mtag != NULL) {
674 tdbi = (struct tdb_ident *)(mtag + 1);
675 sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND);
676 } else {
677 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND,
678 IP_FORWARDING, &error);
679 }
680 if (sp == NULL) { /* NB: can happen if error */
681 splx(s);
682 /*XXX error stat???*/
683 DPRINTF(("ip_input: no SP for forwarding\n")); /*XXX*/
684 goto bad;
685 }
686
687 /*
688 * Check security policy against packet attributes.
689 */
690 error = ipsec_in_reject(sp, m);
691 KEY_FREESP(&sp);
692 splx(s);
693 if (error) {
694 ipstat.ips_cantforward++;
695 goto bad;
696 }
697 #endif /* FAST_IPSEC */
698 ip_forward(m, 0, args.next_hop);
699 }
700 return;
701
702 ours:
703 #ifdef IPSTEALTH
704 /*
705 * IPSTEALTH: Process non-routing options only
706 * if the packet is destined for us.
707 */
708 if (ipstealth && hlen > sizeof (struct ip) &&
709 ip_dooptions(m, 1, args.next_hop))
710 return;
711 #endif /* IPSTEALTH */
712
713 /* Count the packet in the ip address stats */
714 if (ia != NULL) {
715 ia->ia_ifa.if_ipackets++;
716 ia->ia_ifa.if_ibytes += m->m_pkthdr.len;
717 }
718
719 /*
720 * If offset or IP_MF are set, must reassemble.
721 * Otherwise, nothing need be done.
722 * (We could look in the reassembly queue to see
723 * if the packet was previously fragmented,
724 * but it's not worth the time; just let them time out.)
725 */
726 if (ip->ip_off & (IP_MF | IP_OFFMASK)) {
727
728 sum = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id);
729 /*
730 * Look for queue of fragments
731 * of this datagram.
732 */
733 TAILQ_FOREACH(fp, &ipq[sum], ipq_list)
734 if (ip->ip_id == fp->ipq_id &&
735 ip->ip_src.s_addr == fp->ipq_src.s_addr &&
736 ip->ip_dst.s_addr == fp->ipq_dst.s_addr &&
737 #ifdef MAC
738 mac_fragment_match(m, fp) &&
739 #endif
740 ip->ip_p == fp->ipq_p)
741 goto found;
742
743 fp = 0;
744
745 /* check if there's a place for the new queue */
746 if (nipq > maxnipq) {
747 /*
748 * drop something from the tail of the current queue
749 * before proceeding further
750 */
751 struct ipq *q = TAILQ_LAST(&ipq[sum], ipqhead);
752 if (q == NULL) { /* gak */
753 for (i = 0; i < IPREASS_NHASH; i++) {
754 struct ipq *r = TAILQ_LAST(&ipq[i], ipqhead);
755 if (r) {
756 ip_freef(&ipq[i], r);
757 break;
758 }
759 }
760 } else
761 ip_freef(&ipq[sum], q);
762 }
763 found:
764 /*
765 * Adjust ip_len to not reflect header,
766 * convert offset of this to bytes.
767 */
768 ip->ip_len -= hlen;
769 if (ip->ip_off & IP_MF) {
770 /*
771 * Make sure that fragments have a data length
772 * that's a non-zero multiple of 8 bytes.
773 */
774 if (ip->ip_len == 0 || (ip->ip_len & 0x7) != 0) {
775 ipstat.ips_toosmall++; /* XXX */
776 goto bad;
777 }
778 m->m_flags |= M_FRAG;
779 } else
780 m->m_flags &= ~M_FRAG;
781 ip->ip_off <<= 3;
782
783 /*
784 * Attempt reassembly; if it succeeds, proceed.
785 * ip_reass() will return a different mbuf, and update
786 * the divert info in divert_info and args.divert_rule.
787 */
788 ipstat.ips_fragments++;
789 m->m_pkthdr.header = ip;
790 m = ip_reass(m,
791 &ipq[sum], fp, &divert_info, &args.divert_rule);
792 if (m == 0)
793 return;
794 ipstat.ips_reassembled++;
795 ip = mtod(m, struct ip *);
796 /* Get the header length of the reassembled packet */
797 hlen = ip->ip_hl << 2;
798 #ifdef IPDIVERT
799 /* Restore original checksum before diverting packet */
800 if (divert_info != 0) {
801 ip->ip_len += hlen;
802 ip->ip_len = htons(ip->ip_len);
803 ip->ip_off = htons(ip->ip_off);
804 ip->ip_sum = 0;
805 if (hlen == sizeof(struct ip))
806 ip->ip_sum = in_cksum_hdr(ip);
807 else
808 ip->ip_sum = in_cksum(m, hlen);
809 ip->ip_off = ntohs(ip->ip_off);
810 ip->ip_len = ntohs(ip->ip_len);
811 ip->ip_len -= hlen;
812 }
813 #endif
814 } else
815 ip->ip_len -= hlen;
816
817 #ifdef IPDIVERT
818 /*
819 * Divert or tee packet to the divert protocol if required.
820 */
821 if (divert_info != 0) {
822 struct mbuf *clone = NULL;
823
824 /* Clone packet if we're doing a 'tee' */
825 if ((divert_info & IP_FW_PORT_TEE_FLAG) != 0)
826 clone = m_dup(m, M_DONTWAIT);
827
828 /* Restore packet header fields to original values */
829 ip->ip_len += hlen;
830 ip->ip_len = htons(ip->ip_len);
831 ip->ip_off = htons(ip->ip_off);
832
833 /* Deliver packet to divert input routine */
834 divert_packet(m, 1, divert_info & 0xffff, args.divert_rule);
835 ipstat.ips_delivered++;
836
837 /* If 'tee', continue with original packet */
838 if (clone == NULL)
839 return;
840 m = clone;
841 ip = mtod(m, struct ip *);
842 ip->ip_len += hlen;
843 /*
844 * Jump backwards to complete processing of the
845 * packet. But first clear divert_info to avoid
846 * entering this block again.
847 * We do not need to clear args.divert_rule
848 * or args.next_hop as they will not be used.
849 */
850 divert_info = 0;
851 goto pass;
852 }
853 #endif
854
855 #ifdef IPSEC
856 /*
857 * enforce IPsec policy checking if we are seeing last header.
858 * note that we do not visit this with protocols with pcb layer
859 * code - like udp/tcp/raw ip.
860 */
861 if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0 &&
862 ipsec4_in_reject(m, NULL)) {
863 ipsecstat.in_polvio++;
864 goto bad;
865 }
866 #endif
867 #if FAST_IPSEC
868 /*
869 * enforce IPsec policy checking if we are seeing last header.
870 * note that we do not visit this with protocols with pcb layer
871 * code - like udp/tcp/raw ip.
872 */
873 if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0) {
874 /*
875 * Check if the packet has already had IPsec processing
876 * done. If so, then just pass it along. This tag gets
877 * set during AH, ESP, etc. input handling, before the
878 * packet is returned to the ip input queue for delivery.
879 */
880 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
881 s = splnet();
882 if (mtag != NULL) {
883 tdbi = (struct tdb_ident *)(mtag + 1);
884 sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND);
885 } else {
886 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND,
887 IP_FORWARDING, &error);
888 }
889 if (sp != NULL) {
890 /*
891 * Check security policy against packet attributes.
892 */
893 error = ipsec_in_reject(sp, m);
894 KEY_FREESP(&sp);
895 } else {
896 /* XXX error stat??? */
897 error = EINVAL;
898 DPRINTF(("ip_input: no SP, packet discarded\n"));/*XXX*/
899 goto bad;
900 }
901 splx(s);
902 if (error)
903 goto bad;
904 }
905 #endif /* FAST_IPSEC */
906
907 /*
908 * Switch out to protocol's input routine.
909 */
910 ipstat.ips_delivered++;
911 if (args.next_hop && ip->ip_p == IPPROTO_TCP) {
912 /* TCP needs IPFORWARD info if available */
913 struct m_hdr tag;
914
915 tag.mh_type = MT_TAG;
916 tag.mh_flags = PACKET_TAG_IPFORWARD;
917 tag.mh_data = (caddr_t)args.next_hop;
918 tag.mh_next = m;
919
920 (*inetsw[ip_protox[ip->ip_p]].pr_input)(
921 (struct mbuf *)&tag, hlen);
922 } else
923 (*inetsw[ip_protox[ip->ip_p]].pr_input)(m, hlen);
924 return;
925 bad:
926 m_freem(m);
927 }
928
929 /*
930 * IP software interrupt routine - to go away sometime soon
931 */
932 static void
933 ipintr(void)
934 {
935 struct mbuf *m;
936
937 while (1) {
938 IF_DEQUEUE(&ipintrq, m);
939 if (m == 0)
940 return;
941 ip_input(m);
942 }
943 }
944
945 /*
946 * Take incoming datagram fragment and try to reassemble it into
947 * whole datagram. If a chain for reassembly of this datagram already
948 * exists, then it is given as fp; otherwise have to make a chain.
949 *
950 * When IPDIVERT enabled, keep additional state with each packet that
951 * tells us if we need to divert or tee the packet we're building.
952 * In particular, *divinfo includes the port and TEE flag,
953 * *divert_rule is the number of the matching rule.
954 */
955
956 static struct mbuf *
957 ip_reass(struct mbuf *m, struct ipqhead *head, struct ipq *fp,
958 u_int32_t *divinfo, u_int16_t *divert_rule)
959 {
960 struct ip *ip = mtod(m, struct ip *);
961 register struct mbuf *p, *q, *nq;
962 struct mbuf *t;
963 int hlen = ip->ip_hl << 2;
964 int i, next;
965
966 /*
967 * Presence of header sizes in mbufs
968 * would confuse code below.
969 */
970 m->m_data += hlen;
971 m->m_len -= hlen;
972
973 /*
974 * If first fragment to arrive, create a reassembly queue.
975 */
976 if (fp == 0) {
977 /*
978 * Enforce upper bound on number of fragmented packets
979 * for which we attempt reassembly;
980 * If maxfrag is 0, never accept fragments.
981 * If maxfrag is -1, accept all fragments without limitation.
982 */
983 if ((ip_maxfragpackets >= 0) && (ip_nfragpackets >= ip_maxfragpackets))
984 goto dropfrag;
985 ip_nfragpackets++;
986 if ((t = m_get(M_DONTWAIT, MT_FTABLE)) == NULL)
987 goto dropfrag;
988 fp = mtod(t, struct ipq *);
989 #ifdef MAC
990 mac_init_ipq(fp);
991 mac_create_ipq(m, fp);
992 #endif
993 TAILQ_INSERT_HEAD(head, fp, ipq_list);
994 nipq++;
995 fp->ipq_ttl = IPFRAGTTL;
996 fp->ipq_p = ip->ip_p;
997 fp->ipq_id = ip->ip_id;
998 fp->ipq_src = ip->ip_src;
999 fp->ipq_dst = ip->ip_dst;
1000 fp->ipq_frags = m;
1001 m->m_nextpkt = NULL;
1002 #ifdef IPDIVERT
1003 fp->ipq_div_info = 0;
1004 fp->ipq_div_cookie = 0;
1005 #endif
1006 goto inserted;
1007 } else {
1008 #ifdef MAC
1009 mac_update_ipq(m, fp);
1010 #endif
1011 }
1012
1013 #define GETIP(m) ((struct ip*)((m)->m_pkthdr.header))
1014
1015 /*
1016 * Find a segment which begins after this one does.
1017 */
1018 for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt)
1019 if (GETIP(q)->ip_off > ip->ip_off)
1020 break;
1021
1022 /*
1023 * If there is a preceding segment, it may provide some of
1024 * our data already. If so, drop the data from the incoming
1025 * segment. If it provides all of our data, drop us, otherwise
1026 * stick new segment in the proper place.
1027 *
1028 * If some of the data is dropped from the the preceding
1029 * segment, then it's checksum is invalidated.
1030 */
1031 if (p) {
1032 i = GETIP(p)->ip_off + GETIP(p)->ip_len - ip->ip_off;
1033 if (i > 0) {
1034 if (i >= ip->ip_len)
1035 goto dropfrag;
1036 m_adj(m, i);
1037 m->m_pkthdr.csum_flags = 0;
1038 ip->ip_off += i;
1039 ip->ip_len -= i;
1040 }
1041 m->m_nextpkt = p->m_nextpkt;
1042 p->m_nextpkt = m;
1043 } else {
1044 m->m_nextpkt = fp->ipq_frags;
1045 fp->ipq_frags = m;
1046 }
1047
1048 /*
1049 * While we overlap succeeding segments trim them or,
1050 * if they are completely covered, dequeue them.
1051 */
1052 for (; q != NULL && ip->ip_off + ip->ip_len > GETIP(q)->ip_off;
1053 q = nq) {
1054 i = (ip->ip_off + ip->ip_len) -
1055 GETIP(q)->ip_off;
1056 if (i < GETIP(q)->ip_len) {
1057 GETIP(q)->ip_len -= i;
1058 GETIP(q)->ip_off += i;
1059 m_adj(q, i);
1060 q->m_pkthdr.csum_flags = 0;
1061 break;
1062 }
1063 nq = q->m_nextpkt;
1064 m->m_nextpkt = nq;
1065 m_freem(q);
1066 }
1067
1068 inserted:
1069
1070 #ifdef IPDIVERT
1071 /*
1072 * Transfer firewall instructions to the fragment structure.
1073 * Only trust info in the fragment at offset 0.
1074 */
1075 if (ip->ip_off == 0) {
1076 fp->ipq_div_info = *divinfo;
1077 fp->ipq_div_cookie = *divert_rule;
1078 }
1079 *divinfo = 0;
1080 *divert_rule = 0;
1081 #endif
1082
1083 /*
1084 * Check for complete reassembly.
1085 */
1086 next = 0;
1087 for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt) {
1088 if (GETIP(q)->ip_off != next)
1089 return (0);
1090 next += GETIP(q)->ip_len;
1091 }
1092 /* Make sure the last packet didn't have the IP_MF flag */
1093 if (p->m_flags & M_FRAG)
1094 return (0);
1095
1096 /*
1097 * Reassembly is complete. Make sure the packet is a sane size.
1098 */
1099 q = fp->ipq_frags;
1100 ip = GETIP(q);
1101 if (next + (ip->ip_hl << 2) > IP_MAXPACKET) {
1102 ipstat.ips_toolong++;
1103 ip_freef(head, fp);
1104 return (0);
1105 }
1106
1107 /*
1108 * Concatenate fragments.
1109 */
1110 m = q;
1111 t = m->m_next;
1112 m->m_next = 0;
1113 m_cat(m, t);
1114 nq = q->m_nextpkt;
1115 q->m_nextpkt = 0;
1116 for (q = nq; q != NULL; q = nq) {
1117 nq = q->m_nextpkt;
1118 q->m_nextpkt = NULL;
1119 m->m_pkthdr.csum_flags &= q->m_pkthdr.csum_flags;
1120 m->m_pkthdr.csum_data += q->m_pkthdr.csum_data;
1121 m_cat(m, q);
1122 }
1123 #ifdef MAC
1124 mac_create_datagram_from_ipq(fp, m);
1125 mac_destroy_ipq(fp);
1126 #endif
1127
1128 #ifdef IPDIVERT
1129 /*
1130 * Extract firewall instructions from the fragment structure.
1131 */
1132 *divinfo = fp->ipq_div_info;
1133 *divert_rule = fp->ipq_div_cookie;
1134 #endif
1135
1136 /*
1137 * Create header for new ip packet by
1138 * modifying header of first packet;
1139 * dequeue and discard fragment reassembly header.
1140 * Make header visible.
1141 */
1142 ip->ip_len = next;
1143 ip->ip_src = fp->ipq_src;
1144 ip->ip_dst = fp->ipq_dst;
1145 TAILQ_REMOVE(head, fp, ipq_list);
1146 nipq--;
1147 (void) m_free(dtom(fp));
1148 ip_nfragpackets--;
1149 m->m_len += (ip->ip_hl << 2);
1150 m->m_data -= (ip->ip_hl << 2);
1151 /* some debugging cruft by sklower, below, will go away soon */
1152 if (m->m_flags & M_PKTHDR) /* XXX this should be done elsewhere */
1153 m_fixhdr(m);
1154 return (m);
1155
1156 dropfrag:
1157 #ifdef IPDIVERT
1158 *divinfo = 0;
1159 *divert_rule = 0;
1160 #endif
1161 ipstat.ips_fragdropped++;
1162 m_freem(m);
1163 return (0);
1164
1165 #undef GETIP
1166 }
1167
1168 /*
1169 * Free a fragment reassembly header and all
1170 * associated datagrams.
1171 */
1172 static void
1173 ip_freef(fhp, fp)
1174 struct ipqhead *fhp;
1175 struct ipq *fp;
1176 {
1177 register struct mbuf *q;
1178
1179 while (fp->ipq_frags) {
1180 q = fp->ipq_frags;
1181 fp->ipq_frags = q->m_nextpkt;
1182 m_freem(q);
1183 }
1184 TAILQ_REMOVE(fhp, fp, ipq_list);
1185 (void) m_free(dtom(fp));
1186 ip_nfragpackets--;
1187 nipq--;
1188 }
1189
1190 /*
1191 * IP timer processing;
1192 * if a timer expires on a reassembly
1193 * queue, discard it.
1194 */
1195 void
1196 ip_slowtimo()
1197 {
1198 register struct ipq *fp;
1199 int s = splnet();
1200 int i;
1201
1202 for (i = 0; i < IPREASS_NHASH; i++) {
1203 for(fp = TAILQ_FIRST(&ipq[i]); fp;) {
1204 struct ipq *fpp;
1205
1206 fpp = fp;
1207 fp = TAILQ_NEXT(fp, ipq_list);
1208 if(--fpp->ipq_ttl == 0) {
1209 ipstat.ips_fragtimeout++;
1210 ip_freef(&ipq[i], fpp);
1211 }
1212 }
1213 }
1214 /*
1215 * If we are over the maximum number of fragments
1216 * (due to the limit being lowered), drain off
1217 * enough to get down to the new limit.
1218 */
1219 for (i = 0; i < IPREASS_NHASH; i++) {
1220 if (ip_maxfragpackets >= 0) {
1221 while (ip_nfragpackets > ip_maxfragpackets &&
1222 !TAILQ_EMPTY(&ipq[i])) {
1223 ipstat.ips_fragdropped++;
1224 ip_freef(&ipq[i], TAILQ_FIRST(&ipq[i]));
1225 }
1226 }
1227 }
1228 ipflow_slowtimo();
1229 splx(s);
1230 }
1231
1232 /*
1233 * Drain off all datagram fragments.
1234 */
1235 void
1236 ip_drain()
1237 {
1238 int i;
1239
1240 for (i = 0; i < IPREASS_NHASH; i++) {
1241 while(!TAILQ_EMPTY(&ipq[i])) {
1242 ipstat.ips_fragdropped++;
1243 ip_freef(&ipq[i], TAILQ_FIRST(&ipq[i]));
1244 }
1245 }
1246 in_rtqdrain();
1247 }
1248
1249 /*
1250 * Do option processing on a datagram,
1251 * possibly discarding it if bad options are encountered,
1252 * or forwarding it if source-routed.
1253 * The pass argument is used when operating in the IPSTEALTH
1254 * mode to tell what options to process:
1255 * [LS]SRR (pass 0) or the others (pass 1).
1256 * The reason for as many as two passes is that when doing IPSTEALTH,
1257 * non-routing options should be processed only if the packet is for us.
1258 * Returns 1 if packet has been forwarded/freed,
1259 * 0 if the packet should be processed further.
1260 */
1261 static int
1262 ip_dooptions(struct mbuf *m, int pass, struct sockaddr_in *next_hop)
1263 {
1264 struct ip *ip = mtod(m, struct ip *);
1265 u_char *cp;
1266 struct in_ifaddr *ia;
1267 int opt, optlen, cnt, off, code, type = ICMP_PARAMPROB, forward = 0;
1268 struct in_addr *sin, dst;
1269 n_time ntime;
1270 struct sockaddr_in ipaddr = { sizeof(ipaddr), AF_INET };
1271
1272 dst = ip->ip_dst;
1273 cp = (u_char *)(ip + 1);
1274 cnt = (ip->ip_hl << 2) - sizeof (struct ip);
1275 for (; cnt > 0; cnt -= optlen, cp += optlen) {
1276 opt = cp[IPOPT_OPTVAL];
1277 if (opt == IPOPT_EOL)
1278 break;
1279 if (opt == IPOPT_NOP)
1280 optlen = 1;
1281 else {
1282 if (cnt < IPOPT_OLEN + sizeof(*cp)) {
1283 code = &cp[IPOPT_OLEN] - (u_char *)ip;
1284 goto bad;
1285 }
1286 optlen = cp[IPOPT_OLEN];
1287 if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) {
1288 code = &cp[IPOPT_OLEN] - (u_char *)ip;
1289 goto bad;
1290 }
1291 }
1292 switch (opt) {
1293
1294 default:
1295 break;
1296
1297 /*
1298 * Source routing with record.
1299 * Find interface with current destination address.
1300 * If none on this machine then drop if strictly routed,
1301 * or do nothing if loosely routed.
1302 * Record interface address and bring up next address
1303 * component. If strictly routed make sure next
1304 * address is on directly accessible net.
1305 */
1306 case IPOPT_LSRR:
1307 case IPOPT_SSRR:
1308 #ifdef IPSTEALTH
1309 if (ipstealth && pass > 0)
1310 break;
1311 #endif
1312 if (optlen < IPOPT_OFFSET + sizeof(*cp)) {
1313 code = &cp[IPOPT_OLEN] - (u_char *)ip;
1314 goto bad;
1315 }
1316 if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {
1317 code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1318 goto bad;
1319 }
1320 ipaddr.sin_addr = ip->ip_dst;
1321 ia = (struct in_ifaddr *)
1322 ifa_ifwithaddr((struct sockaddr *)&ipaddr);
1323 if (ia == 0) {
1324 if (opt == IPOPT_SSRR) {
1325 type = ICMP_UNREACH;
1326 code = ICMP_UNREACH_SRCFAIL;
1327 goto bad;
1328 }
1329 if (!ip_dosourceroute)
1330 goto nosourcerouting;
1331 /*
1332 * Loose routing, and not at next destination
1333 * yet; nothing to do except forward.
1334 */
1335 break;
1336 }
1337 off--; /* 0 origin */
1338 if (off > optlen - (int)sizeof(struct in_addr)) {
1339 /*
1340 * End of source route. Should be for us.
1341 */
1342 if (!ip_acceptsourceroute)
1343 goto nosourcerouting;
1344 save_rte(cp, ip->ip_src);
1345 break;
1346 }
1347 #ifdef IPSTEALTH
1348 if (ipstealth)
1349 goto dropit;
1350 #endif
1351 if (!ip_dosourceroute) {
1352 if (ipforwarding) {
1353 char buf[16]; /* aaa.bbb.ccc.ddd\0 */
1354 /*
1355 * Acting as a router, so generate ICMP
1356 */
1357 nosourcerouting:
1358 strcpy(buf, inet_ntoa(ip->ip_dst));
1359 log(LOG_WARNING,
1360 "attempted source route from %s to %s\n",
1361 inet_ntoa(ip->ip_src), buf);
1362 type = ICMP_UNREACH;
1363 code = ICMP_UNREACH_SRCFAIL;
1364 goto bad;
1365 } else {
1366 /*
1367 * Not acting as a router, so silently drop.
1368 */
1369 #ifdef IPSTEALTH
1370 dropit:
1371 #endif
1372 ipstat.ips_cantforward++;
1373 m_freem(m);
1374 return (1);
1375 }
1376 }
1377
1378 /*
1379 * locate outgoing interface
1380 */
1381 (void)memcpy(&ipaddr.sin_addr, cp + off,
1382 sizeof(ipaddr.sin_addr));
1383
1384 if (opt == IPOPT_SSRR) {
1385 #define INA struct in_ifaddr *
1386 #define SA struct sockaddr *
1387 if ((ia = (INA)ifa_ifwithdstaddr((SA)&ipaddr)) == 0)
1388 ia = (INA)ifa_ifwithnet((SA)&ipaddr);
1389 } else
1390 ia = ip_rtaddr(ipaddr.sin_addr, &ipforward_rt);
1391 if (ia == 0) {
1392 type = ICMP_UNREACH;
1393 code = ICMP_UNREACH_SRCFAIL;
1394 goto bad;
1395 }
1396 ip->ip_dst = ipaddr.sin_addr;
1397 (void)memcpy(cp + off, &(IA_SIN(ia)->sin_addr),
1398 sizeof(struct in_addr));
1399 cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1400 /*
1401 * Let ip_intr's mcast routing check handle mcast pkts
1402 */
1403 forward = !IN_MULTICAST(ntohl(ip->ip_dst.s_addr));
1404 break;
1405
1406 case IPOPT_RR:
1407 #ifdef IPSTEALTH
1408 if (ipstealth && pass == 0)
1409 break;
1410 #endif
1411 if (optlen < IPOPT_OFFSET + sizeof(*cp)) {
1412 code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1413 goto bad;
1414 }
1415 if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {
1416 code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1417 goto bad;
1418 }
1419 /*
1420 * If no space remains, ignore.
1421 */
1422 off--; /* 0 origin */
1423 if (off > optlen - (int)sizeof(struct in_addr))
1424 break;
1425 (void)memcpy(&ipaddr.sin_addr, &ip->ip_dst,
1426 sizeof(ipaddr.sin_addr));
1427 /*
1428 * locate outgoing interface; if we're the destination,
1429 * use the incoming interface (should be same).
1430 */
1431 if ((ia = (INA)ifa_ifwithaddr((SA)&ipaddr)) == 0 &&
1432 (ia = ip_rtaddr(ipaddr.sin_addr,
1433 &ipforward_rt)) == 0) {
1434 type = ICMP_UNREACH;
1435 code = ICMP_UNREACH_HOST;
1436 goto bad;
1437 }
1438 (void)memcpy(cp + off, &(IA_SIN(ia)->sin_addr),
1439 sizeof(struct in_addr));
1440 cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1441 break;
1442
1443 case IPOPT_TS:
1444 #ifdef IPSTEALTH
1445 if (ipstealth && pass == 0)
1446 break;
1447 #endif
1448 code = cp - (u_char *)ip;
1449 if (optlen < 4 || optlen > 40) {
1450 code = &cp[IPOPT_OLEN] - (u_char *)ip;
1451 goto bad;
1452 }
1453 if ((off = cp[IPOPT_OFFSET]) < 5) {
1454 code = &cp[IPOPT_OLEN] - (u_char *)ip;
1455 goto bad;
1456 }
1457 if (off > optlen - (int)sizeof(int32_t)) {
1458 cp[IPOPT_OFFSET + 1] += (1 << 4);
1459 if ((cp[IPOPT_OFFSET + 1] & 0xf0) == 0) {
1460 code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1461 goto bad;
1462 }
1463 break;
1464 }
1465 off--; /* 0 origin */
1466 sin = (struct in_addr *)(cp + off);
1467 switch (cp[IPOPT_OFFSET + 1] & 0x0f) {
1468
1469 case IPOPT_TS_TSONLY:
1470 break;
1471
1472 case IPOPT_TS_TSANDADDR:
1473 if (off + sizeof(n_time) +
1474 sizeof(struct in_addr) > optlen) {
1475 code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1476 goto bad;
1477 }
1478 ipaddr.sin_addr = dst;
1479 ia = (INA)ifaof_ifpforaddr((SA)&ipaddr,
1480 m->m_pkthdr.rcvif);
1481 if (ia == 0)
1482 continue;
1483 (void)memcpy(sin, &IA_SIN(ia)->sin_addr,
1484 sizeof(struct in_addr));
1485 cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1486 off += sizeof(struct in_addr);
1487 break;
1488
1489 case IPOPT_TS_PRESPEC:
1490 if (off + sizeof(n_time) +
1491 sizeof(struct in_addr) > optlen) {
1492 code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1493 goto bad;
1494 }
1495 (void)memcpy(&ipaddr.sin_addr, sin,
1496 sizeof(struct in_addr));
1497 if (ifa_ifwithaddr((SA)&ipaddr) == 0)
1498 continue;
1499 cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1500 off += sizeof(struct in_addr);
1501 break;
1502
1503 default:
1504 code = &cp[IPOPT_OFFSET + 1] - (u_char *)ip;
1505 goto bad;
1506 }
1507 ntime = iptime();
1508 (void)memcpy(cp + off, &ntime, sizeof(n_time));
1509 cp[IPOPT_OFFSET] += sizeof(n_time);
1510 }
1511 }
1512 if (forward && ipforwarding) {
1513 ip_forward(m, 1, next_hop);
1514 return (1);
1515 }
1516 return (0);
1517 bad:
1518 icmp_error(m, type, code, 0, 0);
1519 ipstat.ips_badoptions++;
1520 return (1);
1521 }
1522
1523 /*
1524 * Given address of next destination (final or next hop),
1525 * return internet address info of interface to be used to get there.
1526 */
1527 struct in_ifaddr *
1528 ip_rtaddr(dst, rt)
1529 struct in_addr dst;
1530 struct route *rt;
1531 {
1532 register struct sockaddr_in *sin;
1533
1534 sin = (struct sockaddr_in *)&rt->ro_dst;
1535
1536 if (rt->ro_rt == 0 ||
1537 !(rt->ro_rt->rt_flags & RTF_UP) ||
1538 dst.s_addr != sin->sin_addr.s_addr) {
1539 if (rt->ro_rt) {
1540 RTFREE(rt->ro_rt);
1541 rt->ro_rt = 0;
1542 }
1543 sin->sin_family = AF_INET;
1544 sin->sin_len = sizeof(*sin);
1545 sin->sin_addr = dst;
1546
1547 rtalloc_ign(rt, RTF_PRCLONING);
1548 }
1549 if (rt->ro_rt == 0)
1550 return ((struct in_ifaddr *)0);
1551 return (ifatoia(rt->ro_rt->rt_ifa));
1552 }
1553
1554 /*
1555 * Save incoming source route for use in replies,
1556 * to be picked up later by ip_srcroute if the receiver is interested.
1557 */
1558 static void
1559 save_rte(option, dst)
1560 u_char *option;
1561 struct in_addr dst;
1562 {
1563 unsigned olen;
1564
1565 olen = option[IPOPT_OLEN];
1566 #ifdef DIAGNOSTIC
1567 if (ipprintfs)
1568 printf("save_rte: olen %d\n", olen);
1569 #endif
1570 if (olen > sizeof(ip_srcrt) - (1 + sizeof(dst)))
1571 return;
1572 bcopy(option, ip_srcrt.srcopt, olen);
1573 ip_nhops = (olen - IPOPT_OFFSET - 1) / sizeof(struct in_addr);
1574 ip_srcrt.dst = dst;
1575 }
1576
1577 /*
1578 * Retrieve incoming source route for use in replies,
1579 * in the same form used by setsockopt.
1580 * The first hop is placed before the options, will be removed later.
1581 */
1582 struct mbuf *
1583 ip_srcroute()
1584 {
1585 register struct in_addr *p, *q;
1586 register struct mbuf *m;
1587
1588 if (ip_nhops == 0)
1589 return ((struct mbuf *)0);
1590 m = m_get(M_DONTWAIT, MT_HEADER);
1591 if (m == 0)
1592 return ((struct mbuf *)0);
1593
1594 #define OPTSIZ (sizeof(ip_srcrt.nop) + sizeof(ip_srcrt.srcopt))
1595
1596 /* length is (nhops+1)*sizeof(addr) + sizeof(nop + srcrt header) */
1597 m->m_len = ip_nhops * sizeof(struct in_addr) + sizeof(struct in_addr) +
1598 OPTSIZ;
1599 #ifdef DIAGNOSTIC
1600 if (ipprintfs)
1601 printf("ip_srcroute: nhops %d mlen %d", ip_nhops, m->m_len);
1602 #endif
1603
1604 /*
1605 * First save first hop for return route
1606 */
1607 p = &ip_srcrt.route[ip_nhops - 1];
1608 *(mtod(m, struct in_addr *)) = *p--;
1609 #ifdef DIAGNOSTIC
1610 if (ipprintfs)
1611 printf(" hops %lx", (u_long)ntohl(mtod(m, struct in_addr *)->s_addr));
1612 #endif
1613
1614 /*
1615 * Copy option fields and padding (nop) to mbuf.
1616 */
1617 ip_srcrt.nop = IPOPT_NOP;
1618 ip_srcrt.srcopt[IPOPT_OFFSET] = IPOPT_MINOFF;
1619 (void)memcpy(mtod(m, caddr_t) + sizeof(struct in_addr),
1620 &ip_srcrt.nop, OPTSIZ);
1621 q = (struct in_addr *)(mtod(m, caddr_t) +
1622 sizeof(struct in_addr) + OPTSIZ);
1623 #undef OPTSIZ
1624 /*
1625 * Record return path as an IP source route,
1626 * reversing the path (pointers are now aligned).
1627 */
1628 while (p >= ip_srcrt.route) {
1629 #ifdef DIAGNOSTIC
1630 if (ipprintfs)
1631 printf(" %lx", (u_long)ntohl(q->s_addr));
1632 #endif
1633 *q++ = *p--;
1634 }
1635 /*
1636 * Last hop goes to final destination.
1637 */
1638 *q = ip_srcrt.dst;
1639 #ifdef DIAGNOSTIC
1640 if (ipprintfs)
1641 printf(" %lx\n", (u_long)ntohl(q->s_addr));
1642 #endif
1643 return (m);
1644 }
1645
1646 /*
1647 * Strip out IP options, at higher
1648 * level protocol in the kernel.
1649 * Second argument is buffer to which options
1650 * will be moved, and return value is their length.
1651 * XXX should be deleted; last arg currently ignored.
1652 */
1653 void
1654 ip_stripoptions(m, mopt)
1655 register struct mbuf *m;
1656 struct mbuf *mopt;
1657 {
1658 register int i;
1659 struct ip *ip = mtod(m, struct ip *);
1660 register caddr_t opts;
1661 int olen;
1662
1663 olen = (ip->ip_hl << 2) - sizeof (struct ip);
1664 opts = (caddr_t)(ip + 1);
1665 i = m->m_len - (sizeof (struct ip) + olen);
1666 bcopy(opts + olen, opts, (unsigned)i);
1667 m->m_len -= olen;
1668 if (m->m_flags & M_PKTHDR)
1669 m->m_pkthdr.len -= olen;
1670 ip->ip_v = IPVERSION;
1671 ip->ip_hl = sizeof(struct ip) >> 2;
1672 }
1673
1674 u_char inetctlerrmap[PRC_NCMDS] = {
1675 0, 0, 0, 0,
1676 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH,
1677 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED,
1678 EMSGSIZE, EHOSTUNREACH, 0, 0,
1679 0, 0, 0, 0,
1680 ENOPROTOOPT, ECONNREFUSED
1681 };
1682
1683 /*
1684 * Forward a packet. If some error occurs return the sender
1685 * an icmp packet. Note we can't always generate a meaningful
1686 * icmp message because icmp doesn't have a large enough repertoire
1687 * of codes and types.
1688 *
1689 * If not forwarding, just drop the packet. This could be confusing
1690 * if ipforwarding was zero but some routing protocol was advancing
1691 * us as a gateway to somewhere. However, we must let the routing
1692 * protocol deal with that.
1693 *
1694 * The srcrt parameter indicates whether the packet is being forwarded
1695 * via a source route.
1696 */
1697 static void
1698 ip_forward(struct mbuf *m, int srcrt, struct sockaddr_in *next_hop)
1699 {
1700 struct ip *ip = mtod(m, struct ip *);
1701 struct rtentry *rt;
1702 int error, type = 0, code = 0;
1703 struct mbuf *mcopy;
1704 n_long dest;
1705 struct in_addr pkt_dst;
1706 struct ifnet *destifp;
1707 #if defined(IPSEC) || defined(FAST_IPSEC)
1708 struct ifnet dummyifp;
1709 #endif
1710
1711 dest = 0;
1712 /*
1713 * Cache the destination address of the packet; this may be
1714 * changed by use of 'ipfw fwd'.
1715 */
1716 pkt_dst = next_hop ? next_hop->sin_addr : ip->ip_dst;
1717
1718 #ifdef DIAGNOSTIC
1719 if (ipprintfs)
1720 printf("forward: src %lx dst %lx ttl %x\n",
1721 (u_long)ip->ip_src.s_addr, (u_long)pkt_dst.s_addr,
1722 ip->ip_ttl);
1723 #endif
1724
1725
1726 if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(pkt_dst) == 0) {
1727 ipstat.ips_cantforward++;
1728 m_freem(m);
1729 return;
1730 }
1731 #ifdef IPSTEALTH
1732 if (!ipstealth) {
1733 #endif
1734 if (ip->ip_ttl <= IPTTLDEC) {
1735 icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS,
1736 dest, 0);
1737 return;
1738 }
1739 #ifdef IPSTEALTH
1740 }
1741 #endif
1742
1743 if (ip_rtaddr(pkt_dst, &ipforward_rt) == 0) {
1744 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, dest, 0);
1745 return;
1746 } else
1747 rt = ipforward_rt.ro_rt;
1748
1749 /*
1750 * Save the IP header and at most 8 bytes of the payload,
1751 * in case we need to generate an ICMP message to the src.
1752 *
1753 * XXX this can be optimized a lot by saving the data in a local
1754 * buffer on the stack (72 bytes at most), and only allocating the
1755 * mbuf if really necessary. The vast majority of the packets
1756 * are forwarded without having to send an ICMP back (either
1757 * because unnecessary, or because rate limited), so we are
1758 * really we are wasting a lot of work here.
1759 *
1760 * We don't use m_copy() because it might return a reference
1761 * to a shared cluster. Both this function and ip_output()
1762 * assume exclusive access to the IP header in `m', so any
1763 * data in a cluster may change before we reach icmp_error().
1764 */
1765 MGET(mcopy, M_DONTWAIT, m->m_type);
1766 if (mcopy != NULL) {
1767 M_COPY_PKTHDR(mcopy, m);
1768 mcopy->m_len = imin((ip->ip_hl << 2) + 8,
1769 (int)ip->ip_len);
1770 m_copydata(m, 0, mcopy->m_len, mtod(mcopy, caddr_t));
1771 #ifdef MAC
1772 /*
1773 * XXXMAC: This will eventually become an explicit
1774 * labeling point.
1775 */
1776 mac_create_mbuf_from_mbuf(m, mcopy);
1777 #endif
1778 }
1779
1780 #ifdef IPSTEALTH
1781 if (!ipstealth) {
1782 #endif
1783 ip->ip_ttl -= IPTTLDEC;
1784 #ifdef IPSTEALTH
1785 }
1786 #endif
1787
1788 /*
1789 * If forwarding packet using same interface that it came in on,
1790 * perhaps should send a redirect to sender to shortcut a hop.
1791 * Only send redirect if source is sending directly to us,
1792 * and if packet was not source routed (or has any options).
1793 * Also, don't send redirect if forwarding using a default route
1794 * or a route modified by a redirect.
1795 */
1796 if (rt->rt_ifp == m->m_pkthdr.rcvif &&
1797 (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0 &&
1798 satosin(rt_key(rt))->sin_addr.s_addr != 0 &&
1799 ipsendredirects && !srcrt && !next_hop) {
1800 #define RTA(rt) ((struct in_ifaddr *)(rt->rt_ifa))
1801 u_long src = ntohl(ip->ip_src.s_addr);
1802
1803 if (RTA(rt) &&
1804 (src & RTA(rt)->ia_subnetmask) == RTA(rt)->ia_subnet) {
1805 if (rt->rt_flags & RTF_GATEWAY)
1806 dest = satosin(rt->rt_gateway)->sin_addr.s_addr;
1807 else
1808 dest = pkt_dst.s_addr;
1809 /* Router requirements says to only send host redirects */
1810 type = ICMP_REDIRECT;
1811 code = ICMP_REDIRECT_HOST;
1812 #ifdef DIAGNOSTIC
1813 if (ipprintfs)
1814 printf("redirect (%d) to %lx\n", code, (u_long)dest);
1815 #endif
1816 }
1817 }
1818
1819 {
1820 struct m_hdr tag;
1821
1822 if (next_hop) {
1823 /* Pass IPFORWARD info if available */
1824
1825 tag.mh_type = MT_TAG;
1826 tag.mh_flags = PACKET_TAG_IPFORWARD;
1827 tag.mh_data = (caddr_t)next_hop;
1828 tag.mh_next = m;
1829 m = (struct mbuf *)&tag;
1830 }
1831 error = ip_output(m, (struct mbuf *)0, &ipforward_rt,
1832 IP_FORWARDING, 0, NULL);
1833 }
1834 if (error)
1835 ipstat.ips_cantforward++;
1836 else {
1837 ipstat.ips_forward++;
1838 if (type)
1839 ipstat.ips_redirectsent++;
1840 else {
1841 if (mcopy) {
1842 ipflow_create(&ipforward_rt, mcopy);
1843 m_freem(mcopy);
1844 }
1845 return;
1846 }
1847 }
1848 if (mcopy == NULL)
1849 return;
1850 destifp = NULL;
1851
1852 switch (error) {
1853
1854 case 0: /* forwarded, but need redirect */
1855 /* type, code set above */
1856 break;
1857
1858 case ENETUNREACH: /* shouldn't happen, checked above */
1859 case EHOSTUNREACH:
1860 case ENETDOWN:
1861 case EHOSTDOWN:
1862 default:
1863 type = ICMP_UNREACH;
1864 code = ICMP_UNREACH_HOST;
1865 break;
1866
1867 case EMSGSIZE:
1868 type = ICMP_UNREACH;
1869 code = ICMP_UNREACH_NEEDFRAG;
1870 #ifdef IPSEC
1871 /*
1872 * If the packet is routed over IPsec tunnel, tell the
1873 * originator the tunnel MTU.
1874 * tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz
1875 * XXX quickhack!!!
1876 */
1877 if (ipforward_rt.ro_rt) {
1878 struct secpolicy *sp = NULL;
1879 int ipsecerror;
1880 int ipsechdr;
1881 struct route *ro;
1882
1883 sp = ipsec4_getpolicybyaddr(mcopy,
1884 IPSEC_DIR_OUTBOUND,
1885 IP_FORWARDING,
1886 &ipsecerror);
1887
1888 if (sp == NULL)
1889 destifp = ipforward_rt.ro_rt->rt_ifp;
1890 else {
1891 /* count IPsec header size */
1892 ipsechdr = ipsec4_hdrsiz(mcopy,
1893 IPSEC_DIR_OUTBOUND,
1894 NULL);
1895
1896 /*
1897 * find the correct route for outer IPv4
1898 * header, compute tunnel MTU.
1899 *
1900 * XXX BUG ALERT
1901 * The "dummyifp" code relies upon the fact
1902 * that icmp_error() touches only ifp->if_mtu.
1903 */
1904 /*XXX*/
1905 destifp = NULL;
1906 if (sp->req != NULL
1907 && sp->req->sav != NULL
1908 && sp->req->sav->sah != NULL) {
1909 ro = &sp->req->sav->sah->sa_route;
1910 if (ro->ro_rt && ro->ro_rt->rt_ifp) {
1911 dummyifp.if_mtu =
1912 ro->ro_rt->rt_ifp->if_mtu;
1913 dummyifp.if_mtu -= ipsechdr;
1914 destifp = &dummyifp;
1915 }
1916 }
1917
1918 key_freesp(sp);
1919 }
1920 }
1921 #elif FAST_IPSEC
1922 /*
1923 * If the packet is routed over IPsec tunnel, tell the
1924 * originator the tunnel MTU.
1925 * tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz
1926 * XXX quickhack!!!
1927 */
1928 if (ipforward_rt.ro_rt) {
1929 struct secpolicy *sp = NULL;
1930 int ipsecerror;
1931 int ipsechdr;
1932 struct route *ro;
1933
1934 sp = ipsec_getpolicybyaddr(mcopy,
1935 IPSEC_DIR_OUTBOUND,
1936 IP_FORWARDING,
1937 &ipsecerror);
1938
1939 if (sp == NULL)
1940 destifp = ipforward_rt.ro_rt->rt_ifp;
1941 else {
1942 /* count IPsec header size */
1943 ipsechdr = ipsec4_hdrsiz(mcopy,
1944 IPSEC_DIR_OUTBOUND,
1945 NULL);
1946
1947 /*
1948 * find the correct route for outer IPv4
1949 * header, compute tunnel MTU.
1950 *
1951 * XXX BUG ALERT
1952 * The "dummyifp" code relies upon the fact
1953 * that icmp_error() touches only ifp->if_mtu.
1954 */
1955 /*XXX*/
1956 destifp = NULL;
1957 if (sp->req != NULL
1958 && sp->req->sav != NULL
1959 && sp->req->sav->sah != NULL) {
1960 ro = &sp->req->sav->sah->sa_route;
1961 if (ro->ro_rt && ro->ro_rt->rt_ifp) {
1962 dummyifp.if_mtu =
1963 ro->ro_rt->rt_ifp->if_mtu;
1964 dummyifp.if_mtu -= ipsechdr;
1965 destifp = &dummyifp;
1966 }
1967 }
1968
1969 KEY_FREESP(&sp);
1970 }
1971 }
1972 #else /* !IPSEC && !FAST_IPSEC */
1973 if (ipforward_rt.ro_rt)
1974 destifp = ipforward_rt.ro_rt->rt_ifp;
1975 #endif /*IPSEC*/
1976 ipstat.ips_cantfrag++;
1977 break;
1978
1979 case ENOBUFS:
1980 /*
1981 * A router should not generate ICMP_SOURCEQUENCH as
1982 * required in RFC1812 Requirements for IP Version 4 Routers.
1983 * Source quench could be a big problem under DoS attacks,
1984 * or if the underlying interface is rate-limited.
1985 * Those who need source quench packets may re-enable them
1986 * via the net.inet.ip.sendsourcequench sysctl.
1987 */
1988 if (ip_sendsourcequench == 0) {
1989 m_freem(mcopy);
1990 return;
1991 } else {
1992 type = ICMP_SOURCEQUENCH;
1993 code = 0;
1994 }
1995 break;
1996
1997 case EACCES: /* ipfw denied packet */
1998 m_freem(mcopy);
1999 return;
2000 }
2001 icmp_error(mcopy, type, code, dest, destifp);
2002 }
2003
2004 void
2005 ip_savecontrol(inp, mp, ip, m)
2006 register struct inpcb *inp;
2007 register struct mbuf **mp;
2008 register struct ip *ip;
2009 register struct mbuf *m;
2010 {
2011 if (inp->inp_socket->so_options & SO_TIMESTAMP) {
2012 struct timeval tv;
2013
2014 microtime(&tv);
2015 *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
2016 SCM_TIMESTAMP, SOL_SOCKET);
2017 if (*mp)
2018 mp = &(*mp)->m_next;
2019 }
2020 if (inp->inp_flags & INP_RECVDSTADDR) {
2021 *mp = sbcreatecontrol((caddr_t) &ip->ip_dst,
2022 sizeof(struct in_addr), IP_RECVDSTADDR, IPPROTO_IP);
2023 if (*mp)
2024 mp = &(*mp)->m_next;
2025 }
2026 #ifdef notyet
2027 /* XXX
2028 * Moving these out of udp_input() made them even more broken
2029 * than they already were.
2030 */
2031 /* options were tossed already */
2032 if (inp->inp_flags & INP_RECVOPTS) {
2033 *mp = sbcreatecontrol((caddr_t) opts_deleted_above,
2034 sizeof(struct in_addr), IP_RECVOPTS, IPPROTO_IP);
2035 if (*mp)
2036 mp = &(*mp)->m_next;
2037 }
2038 /* ip_srcroute doesn't do what we want here, need to fix */
2039 if (inp->inp_flags & INP_RECVRETOPTS) {
2040 *mp = sbcreatecontrol((caddr_t) ip_srcroute(),
2041 sizeof(struct in_addr), IP_RECVRETOPTS, IPPROTO_IP);
2042 if (*mp)
2043 mp = &(*mp)->m_next;
2044 }
2045 #endif
2046 if (inp->inp_flags & INP_RECVIF) {
2047 struct ifnet *ifp;
2048 struct sdlbuf {
2049 struct sockaddr_dl sdl;
2050 u_char pad[32];
2051 } sdlbuf;
2052 struct sockaddr_dl *sdp;
2053 struct sockaddr_dl *sdl2 = &sdlbuf.sdl;
2054
2055 if (((ifp = m->m_pkthdr.rcvif))
2056 && ( ifp->if_index && (ifp->if_index <= if_index))) {
2057 sdp = (struct sockaddr_dl *)
2058 (ifaddr_byindex(ifp->if_index)->ifa_addr);
2059 /*
2060 * Change our mind and don't try copy.
2061 */
2062 if ((sdp->sdl_family != AF_LINK)
2063 || (sdp->sdl_len > sizeof(sdlbuf))) {
2064 goto makedummy;
2065 }
2066 bcopy(sdp, sdl2, sdp->sdl_len);
2067 } else {
2068 makedummy:
2069 sdl2->sdl_len
2070 = offsetof(struct sockaddr_dl, sdl_data[0]);
2071 sdl2->sdl_family = AF_LINK;
2072 sdl2->sdl_index = 0;
2073 sdl2->sdl_nlen = sdl2->sdl_alen = sdl2->sdl_slen = 0;
2074 }
2075 *mp = sbcreatecontrol((caddr_t) sdl2, sdl2->sdl_len,
2076 IP_RECVIF, IPPROTO_IP);
2077 if (*mp)
2078 mp = &(*mp)->m_next;
2079 }
2080 }
2081
2082 /*
2083 * XXX these routines are called from the upper part of the kernel.
2084 * They need to be locked when we remove Giant.
2085 *
2086 * They could also be moved to ip_mroute.c, since all the RSVP
2087 * handling is done there already.
2088 */
2089 static int ip_rsvp_on;
2090 struct socket *ip_rsvpd;
2091 int
2092 ip_rsvp_init(struct socket *so)
2093 {
2094 if (so->so_type != SOCK_RAW ||
2095 so->so_proto->pr_protocol != IPPROTO_RSVP)
2096 return EOPNOTSUPP;
2097
2098 if (ip_rsvpd != NULL)
2099 return EADDRINUSE;
2100
2101 ip_rsvpd = so;
2102 /*
2103 * This may seem silly, but we need to be sure we don't over-increment
2104 * the RSVP counter, in case something slips up.
2105 */
2106 if (!ip_rsvp_on) {
2107 ip_rsvp_on = 1;
2108 rsvp_on++;
2109 }
2110
2111 return 0;
2112 }
2113
2114 int
2115 ip_rsvp_done(void)
2116 {
2117 ip_rsvpd = NULL;
2118 /*
2119 * This may seem silly, but we need to be sure we don't over-decrement
2120 * the RSVP counter, in case something slips up.
2121 */
2122 if (ip_rsvp_on) {
2123 ip_rsvp_on = 0;
2124 rsvp_on--;
2125 }
2126 return 0;
2127 }
2128
2129 void
2130 rsvp_input(struct mbuf *m, int off) /* XXX must fixup manually */
2131 {
2132 if (rsvp_input_p) { /* call the real one if loaded */
2133 rsvp_input_p(m, off);
2134 return;
2135 }
2136
2137 /* Can still get packets with rsvp_on = 0 if there is a local member
2138 * of the group to which the RSVP packet is addressed. But in this
2139 * case we want to throw the packet away.
2140 */
2141
2142 if (!rsvp_on) {
2143 m_freem(m);
2144 return;
2145 }
2146
2147 if (ip_rsvpd != NULL) {
2148 rip_input(m, off);
2149 return;
2150 }
2151 /* Drop the packet */
2152 m_freem(m);
2153 }
Cache object: c2afd612b6dfafe0b116d8da658fb852
|