xref: /freebsd/sys/netinet/ip_input.c (revision d0ebc0d2f18688c6e47eb5100c8be969fdc04f95)
1df8bae1dSRodney W. Grimes /*
2df8bae1dSRodney W. Grimes  * Copyright (c) 1982, 1986, 1988, 1993
3df8bae1dSRodney W. Grimes  *	The Regents of the University of California.  All rights reserved.
4df8bae1dSRodney W. Grimes  *
5df8bae1dSRodney W. Grimes  * Redistribution and use in source and binary forms, with or without
6df8bae1dSRodney W. Grimes  * modification, are permitted provided that the following conditions
7df8bae1dSRodney W. Grimes  * are met:
8df8bae1dSRodney W. Grimes  * 1. Redistributions of source code must retain the above copyright
9df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer.
10df8bae1dSRodney W. Grimes  * 2. Redistributions in binary form must reproduce the above copyright
11df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer in the
12df8bae1dSRodney W. Grimes  *    documentation and/or other materials provided with the distribution.
13df8bae1dSRodney W. Grimes  * 3. All advertising materials mentioning features or use of this software
14df8bae1dSRodney W. Grimes  *    must display the following acknowledgement:
15df8bae1dSRodney W. Grimes  *	This product includes software developed by the University of
16df8bae1dSRodney W. Grimes  *	California, Berkeley and its contributors.
17df8bae1dSRodney W. Grimes  * 4. Neither the name of the University nor the names of its contributors
18df8bae1dSRodney W. Grimes  *    may be used to endorse or promote products derived from this software
19df8bae1dSRodney W. Grimes  *    without specific prior written permission.
20df8bae1dSRodney W. Grimes  *
21df8bae1dSRodney W. Grimes  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22df8bae1dSRodney W. Grimes  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23df8bae1dSRodney W. Grimes  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24df8bae1dSRodney W. Grimes  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25df8bae1dSRodney W. Grimes  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26df8bae1dSRodney W. Grimes  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27df8bae1dSRodney W. Grimes  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28df8bae1dSRodney W. Grimes  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29df8bae1dSRodney W. Grimes  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30df8bae1dSRodney W. Grimes  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31df8bae1dSRodney W. Grimes  * SUCH DAMAGE.
32df8bae1dSRodney W. Grimes  *
33df8bae1dSRodney W. Grimes  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
34c3aac50fSPeter Wemm  * $FreeBSD$
35df8bae1dSRodney W. Grimes  */
36df8bae1dSRodney W. Grimes 
3758938916SGarrett Wollman #define	_IP_VHL
3858938916SGarrett Wollman 
39e4f4247aSEivind Eklund #include "opt_bootp.h"
4074a9466cSGary Palmer #include "opt_ipfw.h"
41b715f178SLuigi Rizzo #include "opt_ipdn.h"
42fbd1372aSJoerg Wunsch #include "opt_ipdivert.h"
431ee25934SPeter Wemm #include "opt_ipfilter.h"
4427108a15SDag-Erling Smørgrav #include "opt_ipstealth.h"
456a800098SYoshinobu Inoue #include "opt_ipsec.h"
46c4ac87eaSDarren Reed #include "opt_pfil_hooks.h"
4764dddc18SKris Kennaway #include "opt_random_ip_id.h"
4874a9466cSGary Palmer 
49df8bae1dSRodney W. Grimes #include <sys/param.h>
50df8bae1dSRodney W. Grimes #include <sys/systm.h>
51df8bae1dSRodney W. Grimes #include <sys/mbuf.h>
52b715f178SLuigi Rizzo #include <sys/malloc.h>
53df8bae1dSRodney W. Grimes #include <sys/domain.h>
54df8bae1dSRodney W. Grimes #include <sys/protosw.h>
55df8bae1dSRodney W. Grimes #include <sys/socket.h>
56df8bae1dSRodney W. Grimes #include <sys/time.h>
57df8bae1dSRodney W. Grimes #include <sys/kernel.h>
581025071fSGarrett Wollman #include <sys/syslog.h>
59b5e8ce9fSBruce Evans #include <sys/sysctl.h>
60df8bae1dSRodney W. Grimes 
61c85540ddSAndrey A. Chernov #include <net/pfil.h>
62df8bae1dSRodney W. Grimes #include <net/if.h>
639494d596SBrooks Davis #include <net/if_types.h>
64d314ad7bSJulian Elischer #include <net/if_var.h>
6582c23ebaSBill Fenner #include <net/if_dl.h>
66df8bae1dSRodney W. Grimes #include <net/route.h>
67748e0b0aSGarrett Wollman #include <net/netisr.h>
68367d34f8SBrian Somers #include <net/intrq.h>
69df8bae1dSRodney W. Grimes 
70df8bae1dSRodney W. Grimes #include <netinet/in.h>
71df8bae1dSRodney W. Grimes #include <netinet/in_systm.h>
72b5e8ce9fSBruce Evans #include <netinet/in_var.h>
73df8bae1dSRodney W. Grimes #include <netinet/ip.h>
74df8bae1dSRodney W. Grimes #include <netinet/in_pcb.h>
75df8bae1dSRodney W. Grimes #include <netinet/ip_var.h>
76df8bae1dSRodney W. Grimes #include <netinet/ip_icmp.h>
7758938916SGarrett Wollman #include <machine/in_cksum.h>
78df8bae1dSRodney W. Grimes 
79f0068c4aSGarrett Wollman #include <sys/socketvar.h>
806ddbf1e2SGary Palmer 
816ddbf1e2SGary Palmer #include <netinet/ip_fw.h>
82db69a05dSPaul Saab #include <netinet/ip_dummynet.h>
83db69a05dSPaul Saab 
846a800098SYoshinobu Inoue #ifdef IPSEC
856a800098SYoshinobu Inoue #include <netinet6/ipsec.h>
866a800098SYoshinobu Inoue #include <netkey/key.h>
876a800098SYoshinobu Inoue #endif
886a800098SYoshinobu Inoue 
891c5de19aSGarrett Wollman int rsvp_on = 0;
90f708ef1bSPoul-Henning Kamp static int ip_rsvp_on;
91f0068c4aSGarrett Wollman struct socket *ip_rsvpd;
92f0068c4aSGarrett Wollman 
931f91d8c5SDavid Greenman int	ipforwarding = 0;
940312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_FORWARDING, forwarding, CTLFLAG_RW,
953d177f46SBill Fumerola     &ipforwarding, 0, "Enable IP forwarding between interfaces");
960312fbe9SPoul-Henning Kamp 
97d4fb926cSGarrett Wollman static int	ipsendredirects = 1; /* XXX */
980312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_SENDREDIRECTS, redirect, CTLFLAG_RW,
993d177f46SBill Fumerola     &ipsendredirects, 0, "Enable sending IP redirects");
1000312fbe9SPoul-Henning Kamp 
101df8bae1dSRodney W. Grimes int	ip_defttl = IPDEFTTL;
1020312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_DEFTTL, ttl, CTLFLAG_RW,
1033d177f46SBill Fumerola     &ip_defttl, 0, "Maximum TTL on IP packets");
1040312fbe9SPoul-Henning Kamp 
1050312fbe9SPoul-Henning Kamp static int	ip_dosourceroute = 0;
1060312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_SOURCEROUTE, sourceroute, CTLFLAG_RW,
1073d177f46SBill Fumerola     &ip_dosourceroute, 0, "Enable forwarding source routed IP packets");
1084fce5804SGuido van Rooij 
1094fce5804SGuido van Rooij static int	ip_acceptsourceroute = 0;
1104fce5804SGuido van Rooij SYSCTL_INT(_net_inet_ip, IPCTL_ACCEPTSOURCEROUTE, accept_sourceroute,
1113d177f46SBill Fumerola     CTLFLAG_RW, &ip_acceptsourceroute, 0,
1123d177f46SBill Fumerola     "Enable accepting source routed IP packets");
1136a800098SYoshinobu Inoue 
1146a800098SYoshinobu Inoue static int	ip_keepfaith = 0;
1156a800098SYoshinobu Inoue SYSCTL_INT(_net_inet_ip, IPCTL_KEEPFAITH, keepfaith, CTLFLAG_RW,
1166a800098SYoshinobu Inoue 	&ip_keepfaith,	0,
1176a800098SYoshinobu Inoue 	"Enable packet capture for FAITH IPv4->IPv6 translater daemon");
1186a800098SYoshinobu Inoue 
119690a6055SJesper Skriver static int	ip_nfragpackets = 0;
12096c2b042SJesper Skriver static int	ip_maxfragpackets;	/* initialized in ip_init() */
121690a6055SJesper Skriver SYSCTL_INT(_net_inet_ip, OID_AUTO, maxfragpackets, CTLFLAG_RW,
122690a6055SJesper Skriver 	&ip_maxfragpackets, 0,
123690a6055SJesper Skriver 	"Maximum number of IPv4 fragment reassembly queue entries");
124690a6055SJesper Skriver 
125823db0e9SDon Lewis /*
126823db0e9SDon Lewis  * XXX - Setting ip_checkinterface mostly implements the receive side of
127823db0e9SDon Lewis  * the Strong ES model described in RFC 1122, but since the routing table
128a8f12100SDon Lewis  * and transmit implementation do not implement the Strong ES model,
129823db0e9SDon Lewis  * setting this to 1 results in an odd hybrid.
1303f67c834SDon Lewis  *
131a8f12100SDon Lewis  * XXX - ip_checkinterface currently must be disabled if you use ipnat
132a8f12100SDon Lewis  * to translate the destination address to another local interface.
1333f67c834SDon Lewis  *
1343f67c834SDon Lewis  * XXX - ip_checkinterface must be disabled if you add IP aliases
1353f67c834SDon Lewis  * to the loopback interface instead of the interface where the
1363f67c834SDon Lewis  * packets for those addresses are received.
137823db0e9SDon Lewis  */
138b3e95d4eSJonathan Lemon static int	ip_checkinterface = 1;
139b3e95d4eSJonathan Lemon SYSCTL_INT(_net_inet_ip, OID_AUTO, check_interface, CTLFLAG_RW,
140b3e95d4eSJonathan Lemon     &ip_checkinterface, 0, "Verify packet arrives on correct interface");
141b3e95d4eSJonathan Lemon 
142df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC
1430312fbe9SPoul-Henning Kamp static int	ipprintfs = 0;
144df8bae1dSRodney W. Grimes #endif
145df8bae1dSRodney W. Grimes 
146ca925d9cSJonathan Lemon static int	ipqmaxlen = IFQ_MAXLEN;
147ca925d9cSJonathan Lemon 
148df8bae1dSRodney W. Grimes extern	struct domain inetdomain;
149f0ffb944SJulian Elischer extern	struct protosw inetsw[];
150df8bae1dSRodney W. Grimes u_char	ip_protox[IPPROTO_MAX];
15159562606SGarrett Wollman struct	in_ifaddrhead in_ifaddrhead; 		/* first inet address */
152ca925d9cSJonathan Lemon struct	in_ifaddrhashhead *in_ifaddrhashtbl;	/* inet addr hash table  */
153ca925d9cSJonathan Lemon u_long 	in_ifaddrhmask;				/* mask for hash table */
154ca925d9cSJonathan Lemon 
155afed1375SDavid Greenman SYSCTL_INT(_net_inet_ip, IPCTL_INTRQMAXLEN, intr_queue_maxlen, CTLFLAG_RW,
1563d177f46SBill Fumerola     &ipintrq.ifq_maxlen, 0, "Maximum size of the IP input queue");
1570312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_INTRQDROPS, intr_queue_drops, CTLFLAG_RD,
1583d177f46SBill Fumerola     &ipintrq.ifq_drops, 0, "Number of packets dropped from the IP input queue");
159df8bae1dSRodney W. Grimes 
160f23b4c91SGarrett Wollman struct ipstat ipstat;
161c73d99b5SRuslan Ermilov SYSCTL_STRUCT(_net_inet_ip, IPCTL_STATS, stats, CTLFLAG_RW,
1623d177f46SBill Fumerola     &ipstat, ipstat, "IP statistics (struct ipstat, netinet/ip_var.h)");
163194a213eSAndrey A. Chernov 
164194a213eSAndrey A. Chernov /* Packet reassembly stuff */
165194a213eSAndrey A. Chernov #define IPREASS_NHASH_LOG2      6
166194a213eSAndrey A. Chernov #define IPREASS_NHASH           (1 << IPREASS_NHASH_LOG2)
167194a213eSAndrey A. Chernov #define IPREASS_HMASK           (IPREASS_NHASH - 1)
168194a213eSAndrey A. Chernov #define IPREASS_HASH(x,y) \
169831a80b0SMatthew Dillon 	(((((x) & 0xF) | ((((x) >> 8) & 0xF) << 4)) ^ (y)) & IPREASS_HMASK)
170194a213eSAndrey A. Chernov 
171462b86feSPoul-Henning Kamp static TAILQ_HEAD(ipqhead, ipq) ipq[IPREASS_NHASH];
172194a213eSAndrey A. Chernov static int    nipq = 0;         /* total # of reass queues */
173194a213eSAndrey A. Chernov static int    maxnipq;
174367d34f8SBrian Somers const  int    ipintrq_present = 1;
175f23b4c91SGarrett Wollman 
1760312fbe9SPoul-Henning Kamp #ifdef IPCTL_DEFMTU
1770312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_DEFMTU, mtu, CTLFLAG_RW,
1783d177f46SBill Fumerola     &ip_mtu, 0, "Default MTU");
1790312fbe9SPoul-Henning Kamp #endif
1800312fbe9SPoul-Henning Kamp 
1811b968362SDag-Erling Smørgrav #ifdef IPSTEALTH
1821b968362SDag-Erling Smørgrav static int	ipstealth = 0;
1831b968362SDag-Erling Smørgrav SYSCTL_INT(_net_inet_ip, OID_AUTO, stealth, CTLFLAG_RW,
1841b968362SDag-Erling Smørgrav     &ipstealth, 0, "");
1851b968362SDag-Erling Smørgrav #endif
1861b968362SDag-Erling Smørgrav 
187cfe8b629SGarrett Wollman 
18823bf9953SPoul-Henning Kamp /* Firewall hooks */
18923bf9953SPoul-Henning Kamp ip_fw_chk_t *ip_fw_chk_ptr;
1909fcc0795SLuigi Rizzo int fw_enable = 1 ;
191e7319babSPoul-Henning Kamp 
192db69a05dSPaul Saab /* Dummynet hooks */
193db69a05dSPaul Saab ip_dn_io_t *ip_dn_io_ptr;
194b715f178SLuigi Rizzo 
195afed1b49SDarren Reed 
196e7319babSPoul-Henning Kamp /*
197df8bae1dSRodney W. Grimes  * We need to save the IP options in case a protocol wants to respond
198df8bae1dSRodney W. Grimes  * to an incoming packet over the same route if the packet got here
199df8bae1dSRodney W. Grimes  * using IP source routing.  This allows connection establishment and
200df8bae1dSRodney W. Grimes  * maintenance when the remote end is on a network that is not known
201df8bae1dSRodney W. Grimes  * to us.
202df8bae1dSRodney W. Grimes  */
2030312fbe9SPoul-Henning Kamp static int	ip_nhops = 0;
204df8bae1dSRodney W. Grimes static	struct ip_srcrt {
205df8bae1dSRodney W. Grimes 	struct	in_addr dst;			/* final destination */
206df8bae1dSRodney W. Grimes 	char	nop;				/* one NOP to align */
207df8bae1dSRodney W. Grimes 	char	srcopt[IPOPT_OFFSET + 1];	/* OPTVAL, OLEN and OFFSET */
208df8bae1dSRodney W. Grimes 	struct	in_addr route[MAX_IPOPTLEN/sizeof(struct in_addr)];
209df8bae1dSRodney W. Grimes } ip_srcrt;
210df8bae1dSRodney W. Grimes 
211f9e354dfSJulian Elischer struct sockaddr_in *ip_fw_fwd_addr;
212f9e354dfSJulian Elischer 
213df8bae1dSRodney W. Grimes static void	save_rte __P((u_char *, struct in_addr));
214d0ebc0d2SYaroslav Tykhiy static int	ip_dooptions __P((struct mbuf *, int));
2150312fbe9SPoul-Henning Kamp static void	ip_forward __P((struct mbuf *, int));
216462b86feSPoul-Henning Kamp static void	ip_freef __P((struct ipqhead *, struct ipq *));
2178948e4baSArchie Cobbs #ifdef IPDIVERT
218462b86feSPoul-Henning Kamp static struct	mbuf *ip_reass __P((struct mbuf *, struct ipqhead *, struct ipq *, u_int32_t *, u_int16_t *));
2198948e4baSArchie Cobbs #else
220462b86feSPoul-Henning Kamp static struct	mbuf *ip_reass __P((struct mbuf *, struct ipqhead *, struct ipq *));
2218948e4baSArchie Cobbs #endif
2220312fbe9SPoul-Henning Kamp static void	ipintr __P((void));
2238948e4baSArchie Cobbs 
224df8bae1dSRodney W. Grimes /*
225df8bae1dSRodney W. Grimes  * IP initialization: fill in IP protocol switch table.
226df8bae1dSRodney W. Grimes  * All protocols not implemented in kernel go to raw IP protocol handler.
227df8bae1dSRodney W. Grimes  */
228df8bae1dSRodney W. Grimes void
229df8bae1dSRodney W. Grimes ip_init()
230df8bae1dSRodney W. Grimes {
231f0ffb944SJulian Elischer 	register struct protosw *pr;
232df8bae1dSRodney W. Grimes 	register int i;
233df8bae1dSRodney W. Grimes 
23459562606SGarrett Wollman 	TAILQ_INIT(&in_ifaddrhead);
235ca925d9cSJonathan Lemon 	in_ifaddrhashtbl = hashinit(INADDR_NHASH, M_IFADDR, &in_ifaddrhmask);
236f0ffb944SJulian Elischer 	pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW);
237df8bae1dSRodney W. Grimes 	if (pr == 0)
238df8bae1dSRodney W. Grimes 		panic("ip_init");
239df8bae1dSRodney W. Grimes 	for (i = 0; i < IPPROTO_MAX; i++)
240df8bae1dSRodney W. Grimes 		ip_protox[i] = pr - inetsw;
241f0ffb944SJulian Elischer 	for (pr = inetdomain.dom_protosw;
242f0ffb944SJulian Elischer 	    pr < inetdomain.dom_protoswNPROTOSW; pr++)
243df8bae1dSRodney W. Grimes 		if (pr->pr_domain->dom_family == PF_INET &&
244df8bae1dSRodney W. Grimes 		    pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
245df8bae1dSRodney W. Grimes 			ip_protox[pr->pr_protocol] = pr - inetsw;
246194a213eSAndrey A. Chernov 
247194a213eSAndrey A. Chernov 	for (i = 0; i < IPREASS_NHASH; i++)
248462b86feSPoul-Henning Kamp 	    TAILQ_INIT(&ipq[i]);
249194a213eSAndrey A. Chernov 
250194a213eSAndrey A. Chernov 	maxnipq = nmbclusters / 4;
25196c2b042SJesper Skriver 	ip_maxfragpackets = nmbclusters / 4;
252194a213eSAndrey A. Chernov 
25364dddc18SKris Kennaway #ifndef RANDOM_IP_ID
254227ee8a1SPoul-Henning Kamp 	ip_id = time_second & 0xffff;
25564dddc18SKris Kennaway #endif
256df8bae1dSRodney W. Grimes 	ipintrq.ifq_maxlen = ipqmaxlen;
257df5e1987SJonathan Lemon 	mtx_init(&ipintrq.ifq_mtx, "ip_inq", MTX_DEF);
258242c5536SPeter Wemm 
259242c5536SPeter Wemm 	register_netisr(NETISR_IP, ipintr);
260df8bae1dSRodney W. Grimes }
261df8bae1dSRodney W. Grimes 
2620312fbe9SPoul-Henning Kamp static struct	sockaddr_in ipaddr = { sizeof(ipaddr), AF_INET };
2631e3d5af0SRuslan Ermilov struct	route ipforward_rt;
264df8bae1dSRodney W. Grimes 
265df8bae1dSRodney W. Grimes /*
266df8bae1dSRodney W. Grimes  * Ip input routine.  Checksum and byte swap header.  If fragmented
267df8bae1dSRodney W. Grimes  * try to reassemble.  Process options.  Pass to next level.
268df8bae1dSRodney W. Grimes  */
269c67b1d17SGarrett Wollman void
270c67b1d17SGarrett Wollman ip_input(struct mbuf *m)
271df8bae1dSRodney W. Grimes {
27223bf9953SPoul-Henning Kamp 	struct ip *ip;
27323bf9953SPoul-Henning Kamp 	struct ipq *fp;
2745da9f8faSJosef Karthauser 	struct in_ifaddr *ia = NULL;
275ca925d9cSJonathan Lemon 	struct ifaddr *ifa;
276823db0e9SDon Lewis 	int    i, hlen, checkif;
27747c861ecSBrian Somers 	u_short sum;
2788948e4baSArchie Cobbs 	u_int16_t divert_cookie;		/* firewall cookie */
2797538a9a0SJonathan Lemon 	struct in_addr pkt_dst;
2808948e4baSArchie Cobbs #ifdef IPDIVERT
2818948e4baSArchie Cobbs 	u_int32_t divert_info = 0;		/* packet divert/tee info */
282b715f178SLuigi Rizzo #endif
283830cc178SLuigi Rizzo 	struct ip_fw *rule = NULL;
284c4ac87eaSDarren Reed #ifdef PFIL_HOOKS
285c4ac87eaSDarren Reed 	struct packet_filter_hook *pfh;
286c4ac87eaSDarren Reed 	struct mbuf *m0;
287c4ac87eaSDarren Reed 	int rv;
288c4ac87eaSDarren Reed #endif /* PFIL_HOOKS */
289b715f178SLuigi Rizzo 
2908948e4baSArchie Cobbs #ifdef IPDIVERT
2918948e4baSArchie Cobbs 	/* Get and reset firewall cookie */
2928948e4baSArchie Cobbs 	divert_cookie = ip_divert_cookie;
2938948e4baSArchie Cobbs 	ip_divert_cookie = 0;
2948948e4baSArchie Cobbs #else
2958948e4baSArchie Cobbs 	divert_cookie = 0;
2968948e4baSArchie Cobbs #endif
2978948e4baSArchie Cobbs 
298b715f178SLuigi Rizzo         /*
299b715f178SLuigi Rizzo          * dummynet packet are prepended a vestigial mbuf with
300b715f178SLuigi Rizzo          * m_type = MT_DUMMYNET and m_data pointing to the matching
301b715f178SLuigi Rizzo          * rule.
302b715f178SLuigi Rizzo          */
303b715f178SLuigi Rizzo         if (m->m_type == MT_DUMMYNET) {
304830cc178SLuigi Rizzo             rule = (struct ip_fw *)(m->m_data) ;
305b715f178SLuigi Rizzo             m = m->m_next ;
306b715f178SLuigi Rizzo             ip = mtod(m, struct ip *);
307b715f178SLuigi Rizzo             hlen = IP_VHL_HL(ip->ip_vhl) << 2;
308b715f178SLuigi Rizzo             goto iphack ;
309b715f178SLuigi Rizzo         } else
310b715f178SLuigi Rizzo             rule = NULL ;
311df8bae1dSRodney W. Grimes 
312df8bae1dSRodney W. Grimes #ifdef	DIAGNOSTIC
313ed7509acSJulian Elischer 	if (m == NULL || (m->m_flags & M_PKTHDR) == 0)
31458938916SGarrett Wollman 		panic("ip_input no HDR");
315df8bae1dSRodney W. Grimes #endif
316df8bae1dSRodney W. Grimes 	ipstat.ips_total++;
31758938916SGarrett Wollman 
31858938916SGarrett Wollman 	if (m->m_pkthdr.len < sizeof(struct ip))
31958938916SGarrett Wollman 		goto tooshort;
32058938916SGarrett Wollman 
321df8bae1dSRodney W. Grimes 	if (m->m_len < sizeof (struct ip) &&
322df8bae1dSRodney W. Grimes 	    (m = m_pullup(m, sizeof (struct ip))) == 0) {
323df8bae1dSRodney W. Grimes 		ipstat.ips_toosmall++;
324c67b1d17SGarrett Wollman 		return;
325df8bae1dSRodney W. Grimes 	}
326df8bae1dSRodney W. Grimes 	ip = mtod(m, struct ip *);
32758938916SGarrett Wollman 
32858938916SGarrett Wollman 	if (IP_VHL_V(ip->ip_vhl) != IPVERSION) {
329df8bae1dSRodney W. Grimes 		ipstat.ips_badvers++;
330df8bae1dSRodney W. Grimes 		goto bad;
331df8bae1dSRodney W. Grimes 	}
33258938916SGarrett Wollman 
33358938916SGarrett Wollman 	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
334df8bae1dSRodney W. Grimes 	if (hlen < sizeof(struct ip)) {	/* minimum header length */
335df8bae1dSRodney W. Grimes 		ipstat.ips_badhlen++;
336df8bae1dSRodney W. Grimes 		goto bad;
337df8bae1dSRodney W. Grimes 	}
338df8bae1dSRodney W. Grimes 	if (hlen > m->m_len) {
339df8bae1dSRodney W. Grimes 		if ((m = m_pullup(m, hlen)) == 0) {
340df8bae1dSRodney W. Grimes 			ipstat.ips_badhlen++;
341c67b1d17SGarrett Wollman 			return;
342df8bae1dSRodney W. Grimes 		}
343df8bae1dSRodney W. Grimes 		ip = mtod(m, struct ip *);
344df8bae1dSRodney W. Grimes 	}
34533841545SHajimu UMEMOTO 
34633841545SHajimu UMEMOTO 	/* 127/8 must not appear on wire - RFC1122 */
34733841545SHajimu UMEMOTO 	if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
34833841545SHajimu UMEMOTO 	    (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
34933841545SHajimu UMEMOTO 		if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) {
35033841545SHajimu UMEMOTO 			ipstat.ips_badaddr++;
35133841545SHajimu UMEMOTO 			goto bad;
35233841545SHajimu UMEMOTO 		}
35333841545SHajimu UMEMOTO 	}
35433841545SHajimu UMEMOTO 
355db4f9cc7SJonathan Lemon 	if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
356db4f9cc7SJonathan Lemon 		sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
357db4f9cc7SJonathan Lemon 	} else {
35858938916SGarrett Wollman 		if (hlen == sizeof(struct ip)) {
35947c861ecSBrian Somers 			sum = in_cksum_hdr(ip);
36058938916SGarrett Wollman 		} else {
36147c861ecSBrian Somers 			sum = in_cksum(m, hlen);
36258938916SGarrett Wollman 		}
363db4f9cc7SJonathan Lemon 	}
36447c861ecSBrian Somers 	if (sum) {
365df8bae1dSRodney W. Grimes 		ipstat.ips_badsum++;
366df8bae1dSRodney W. Grimes 		goto bad;
367df8bae1dSRodney W. Grimes 	}
368df8bae1dSRodney W. Grimes 
369df8bae1dSRodney W. Grimes 	/*
370df8bae1dSRodney W. Grimes 	 * Convert fields to host representation.
371df8bae1dSRodney W. Grimes 	 */
372df8bae1dSRodney W. Grimes 	NTOHS(ip->ip_len);
373df8bae1dSRodney W. Grimes 	if (ip->ip_len < hlen) {
374df8bae1dSRodney W. Grimes 		ipstat.ips_badlen++;
375df8bae1dSRodney W. Grimes 		goto bad;
376df8bae1dSRodney W. Grimes 	}
377df8bae1dSRodney W. Grimes 	NTOHS(ip->ip_off);
378df8bae1dSRodney W. Grimes 
379df8bae1dSRodney W. Grimes 	/*
380df8bae1dSRodney W. Grimes 	 * Check that the amount of data in the buffers
381df8bae1dSRodney W. Grimes 	 * is as at least much as the IP header would have us expect.
382df8bae1dSRodney W. Grimes 	 * Trim mbufs if longer than we expect.
383df8bae1dSRodney W. Grimes 	 * Drop packet if shorter than we expect.
384df8bae1dSRodney W. Grimes 	 */
385df8bae1dSRodney W. Grimes 	if (m->m_pkthdr.len < ip->ip_len) {
38658938916SGarrett Wollman tooshort:
387df8bae1dSRodney W. Grimes 		ipstat.ips_tooshort++;
388df8bae1dSRodney W. Grimes 		goto bad;
389df8bae1dSRodney W. Grimes 	}
390df8bae1dSRodney W. Grimes 	if (m->m_pkthdr.len > ip->ip_len) {
391df8bae1dSRodney W. Grimes 		if (m->m_len == m->m_pkthdr.len) {
392df8bae1dSRodney W. Grimes 			m->m_len = ip->ip_len;
393df8bae1dSRodney W. Grimes 			m->m_pkthdr.len = ip->ip_len;
394df8bae1dSRodney W. Grimes 		} else
395df8bae1dSRodney W. Grimes 			m_adj(m, ip->ip_len - m->m_pkthdr.len);
396df8bae1dSRodney W. Grimes 	}
3973f67c834SDon Lewis 
39833841545SHajimu UMEMOTO #ifdef IPSEC
39933841545SHajimu UMEMOTO 	if (ipsec_gethist(m, NULL))
40033841545SHajimu UMEMOTO 		goto pass;
40133841545SHajimu UMEMOTO #endif
4023f67c834SDon Lewis 
4034dd1662bSUgen J.S. Antsilevich 	/*
4044dd1662bSUgen J.S. Antsilevich 	 * IpHack's section.
4054dd1662bSUgen J.S. Antsilevich 	 * Right now when no processing on packet has done
4064dd1662bSUgen J.S. Antsilevich 	 * and it is still fresh out of network we do our black
4074dd1662bSUgen J.S. Antsilevich 	 * deals with it.
40893e0e116SJulian Elischer 	 * - Firewall: deny/allow/divert
409fed1c7e9SSøren Schmidt 	 * - Xlate: translate packet's addr/port (NAT).
410b715f178SLuigi Rizzo 	 * - Pipe: pass pkt through dummynet.
4114dd1662bSUgen J.S. Antsilevich 	 * - Wrap: fake packet's addr/port <unimpl.>
4124dd1662bSUgen J.S. Antsilevich 	 * - Encapsulate: put it in another IP and send out. <unimp.>
4134dd1662bSUgen J.S. Antsilevich  	 */
414b715f178SLuigi Rizzo 
415b715f178SLuigi Rizzo iphack:
416df8bae1dSRodney W. Grimes 
417c4ac87eaSDarren Reed #ifdef PFIL_HOOKS
418c4ac87eaSDarren Reed 	/*
419c4ac87eaSDarren Reed 	 * Run through list of hooks for input packets.  If there are any
420c4ac87eaSDarren Reed 	 * filters which require that additional packets in the flow are
421c4ac87eaSDarren Reed 	 * not fast-forwarded, they must clear the M_CANFASTFWD flag.
422c4ac87eaSDarren Reed 	 * Note that filters must _never_ set this flag, as another filter
423c4ac87eaSDarren Reed 	 * in the list may have previously cleared it.
424c4ac87eaSDarren Reed 	 */
425c4ac87eaSDarren Reed 	m0 = m;
426c4ac87eaSDarren Reed 	pfh = pfil_hook_get(PFIL_IN, &inetsw[ip_protox[IPPROTO_IP]].pr_pfh);
427fc2ffbe6SPoul-Henning Kamp 	for (; pfh; pfh = TAILQ_NEXT(pfh, pfil_link))
428c4ac87eaSDarren Reed 		if (pfh->pfil_func) {
429c4ac87eaSDarren Reed 			rv = pfh->pfil_func(ip, hlen,
430c4ac87eaSDarren Reed 					    m->m_pkthdr.rcvif, 0, &m0);
431c4ac87eaSDarren Reed 			if (rv)
432beec8214SDarren Reed 				return;
433c4ac87eaSDarren Reed 			m = m0;
434c4ac87eaSDarren Reed 			if (m == NULL)
435c4ac87eaSDarren Reed 				return;
436c4ac87eaSDarren Reed 			ip = mtod(m, struct ip *);
437beec8214SDarren Reed 		}
438c4ac87eaSDarren Reed #endif /* PFIL_HOOKS */
439c4ac87eaSDarren Reed 
4407b109fa4SLuigi Rizzo 	if (fw_enable && IPFW_LOADED) {
441f9e354dfSJulian Elischer #ifdef IPFIREWALL_FORWARD
442f9e354dfSJulian Elischer 		/*
443f9e354dfSJulian Elischer 		 * If we've been forwarded from the output side, then
444f9e354dfSJulian Elischer 		 * skip the firewall a second time
445f9e354dfSJulian Elischer 		 */
446f9e354dfSJulian Elischer 		if (ip_fw_fwd_addr)
447f9e354dfSJulian Elischer 			goto ours;
448f9e354dfSJulian Elischer #endif	/* IPFIREWALL_FORWARD */
449f9e354dfSJulian Elischer 		/*
4508948e4baSArchie Cobbs 		 * See the comment in ip_output for the return values
451b715f178SLuigi Rizzo 		 * produced by the firewall.
452f9e354dfSJulian Elischer 		 */
4536f00486cSJonathan Lemon 		i = ip_fw_chk_ptr(&ip, hlen, NULL,
4546f00486cSJonathan Lemon 		    &divert_cookie, &m, &rule, &ip_fw_fwd_addr);
455507b4b54SLuigi Rizzo 		if (i & IP_FW_PORT_DENY_FLAG) { /* XXX new interface-denied */
456507b4b54SLuigi Rizzo 			if (m)
457507b4b54SLuigi Rizzo 				m_freem(m);
458b715f178SLuigi Rizzo 			return;
459507b4b54SLuigi Rizzo 		}
460507b4b54SLuigi Rizzo 		if (m == NULL) {	/* Packet discarded by firewall */
461507b4b54SLuigi Rizzo 			static int __debug=10;
462507b4b54SLuigi Rizzo 			if (__debug > 0) {
4636f00486cSJonathan Lemon 				printf(
4646f00486cSJonathan Lemon 				    "firewall returns NULL, please update!\n");
465507b4b54SLuigi Rizzo 				__debug--;
466507b4b54SLuigi Rizzo 			}
467507b4b54SLuigi Rizzo 			return;
468507b4b54SLuigi Rizzo 		}
469b715f178SLuigi Rizzo 		if (i == 0 && ip_fw_fwd_addr == NULL)	/* common case */
470b715f178SLuigi Rizzo 			goto pass;
4717b109fa4SLuigi Rizzo                 if (DUMMYNET_LOADED && (i & IP_FW_PORT_DYNT_FLAG) != 0) {
4728948e4baSArchie Cobbs                         /* Send packet to the appropriate pipe */
473db69a05dSPaul Saab                         ip_dn_io_ptr(i&0xffff,DN_TO_IP_IN,m,NULL,NULL,0, rule,
4746a800098SYoshinobu Inoue 				    0);
475e4676ba6SJulian Elischer 			return;
47693e0e116SJulian Elischer 		}
477b715f178SLuigi Rizzo #ifdef IPDIVERT
4788948e4baSArchie Cobbs 		if (i != 0 && (i & IP_FW_PORT_DYNT_FLAG) == 0) {
4798948e4baSArchie Cobbs 			/* Divert or tee packet */
4808948e4baSArchie Cobbs 			divert_info = i;
481b715f178SLuigi Rizzo 			goto ours;
482b715f178SLuigi Rizzo 		}
483b715f178SLuigi Rizzo #endif
484b715f178SLuigi Rizzo #ifdef IPFIREWALL_FORWARD
485b715f178SLuigi Rizzo 		if (i == 0 && ip_fw_fwd_addr != NULL)
486b715f178SLuigi Rizzo 			goto pass;
487b715f178SLuigi Rizzo #endif
488b715f178SLuigi Rizzo 		/*
489b715f178SLuigi Rizzo 		 * if we get here, the packet must be dropped
490b715f178SLuigi Rizzo 		 */
491b715f178SLuigi Rizzo 		m_freem(m);
492b715f178SLuigi Rizzo 		return;
493b715f178SLuigi Rizzo 	}
494b715f178SLuigi Rizzo pass:
495100ba1a6SJordan K. Hubbard 
496df8bae1dSRodney W. Grimes 	/*
497df8bae1dSRodney W. Grimes 	 * Process options and, if not destined for us,
498df8bae1dSRodney W. Grimes 	 * ship it on.  ip_dooptions returns 1 when an
499df8bae1dSRodney W. Grimes 	 * error was detected (causing an icmp message
500df8bae1dSRodney W. Grimes 	 * to be sent and the original packet to be freed).
501df8bae1dSRodney W. Grimes 	 */
502df8bae1dSRodney W. Grimes 	ip_nhops = 0;		/* for source routed packets */
503d0ebc0d2SYaroslav Tykhiy 	if (hlen > sizeof (struct ip) && ip_dooptions(m, 0)) {
504ed1ff184SJulian Elischer #ifdef IPFIREWALL_FORWARD
505ed1ff184SJulian Elischer 		ip_fw_fwd_addr = NULL;
506ed1ff184SJulian Elischer #endif
507c67b1d17SGarrett Wollman 		return;
508ed1ff184SJulian Elischer 	}
509df8bae1dSRodney W. Grimes 
510f0068c4aSGarrett Wollman         /* greedy RSVP, snatches any PATH packet of the RSVP protocol and no
511f0068c4aSGarrett Wollman          * matter if it is destined to another node, or whether it is
512f0068c4aSGarrett Wollman          * a multicast one, RSVP wants it! and prevents it from being forwarded
513f0068c4aSGarrett Wollman          * anywhere else. Also checks if the rsvp daemon is running before
514f0068c4aSGarrett Wollman 	 * grabbing the packet.
515f0068c4aSGarrett Wollman          */
5161c5de19aSGarrett Wollman 	if (rsvp_on && ip->ip_p==IPPROTO_RSVP)
517f0068c4aSGarrett Wollman 		goto ours;
518f0068c4aSGarrett Wollman 
519df8bae1dSRodney W. Grimes 	/*
520df8bae1dSRodney W. Grimes 	 * Check our list of addresses, to see if the packet is for us.
521cc766e04SGarrett Wollman 	 * If we don't have any addresses, assume any unicast packet
522cc766e04SGarrett Wollman 	 * we receive might be for us (and let the upper layers deal
523cc766e04SGarrett Wollman 	 * with it).
524df8bae1dSRodney W. Grimes 	 */
525cc766e04SGarrett Wollman 	if (TAILQ_EMPTY(&in_ifaddrhead) &&
526cc766e04SGarrett Wollman 	    (m->m_flags & (M_MCAST|M_BCAST)) == 0)
527cc766e04SGarrett Wollman 		goto ours;
528cc766e04SGarrett Wollman 
5297538a9a0SJonathan Lemon 	/*
5307538a9a0SJonathan Lemon 	 * Cache the destination address of the packet; this may be
5317538a9a0SJonathan Lemon 	 * changed by use of 'ipfw fwd'.
5327538a9a0SJonathan Lemon 	 */
5337538a9a0SJonathan Lemon 	pkt_dst = ip_fw_fwd_addr == NULL ?
5347538a9a0SJonathan Lemon 	    ip->ip_dst : ip_fw_fwd_addr->sin_addr;
5357538a9a0SJonathan Lemon 
536823db0e9SDon Lewis 	/*
537823db0e9SDon Lewis 	 * Enable a consistency check between the destination address
538823db0e9SDon Lewis 	 * and the arrival interface for a unicast packet (the RFC 1122
539823db0e9SDon Lewis 	 * strong ES model) if IP forwarding is disabled and the packet
540e15ae1b2SDon Lewis 	 * is not locally generated and the packet is not subject to
541e15ae1b2SDon Lewis 	 * 'ipfw fwd'.
5423f67c834SDon Lewis 	 *
5433f67c834SDon Lewis 	 * XXX - Checking also should be disabled if the destination
5443f67c834SDon Lewis 	 * address is ipnat'ed to a different interface.
5453f67c834SDon Lewis 	 *
546a8f12100SDon Lewis 	 * XXX - Checking is incompatible with IP aliases added
5473f67c834SDon Lewis 	 * to the loopback interface instead of the interface where
5483f67c834SDon Lewis 	 * the packets are received.
549823db0e9SDon Lewis 	 */
550823db0e9SDon Lewis 	checkif = ip_checkinterface && (ipforwarding == 0) &&
5519494d596SBrooks Davis 	    m->m_pkthdr.rcvif != NULL &&
552e15ae1b2SDon Lewis 	    ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) &&
553e15ae1b2SDon Lewis 	    (ip_fw_fwd_addr == NULL);
554823db0e9SDon Lewis 
555ca925d9cSJonathan Lemon 	/*
556ca925d9cSJonathan Lemon 	 * Check for exact addresses in the hash bucket.
557ca925d9cSJonathan Lemon 	 */
558ca925d9cSJonathan Lemon 	LIST_FOREACH(ia, INADDR_HASH(pkt_dst.s_addr), ia_hash) {
559f9e354dfSJulian Elischer 		/*
560823db0e9SDon Lewis 		 * If the address matches, verify that the packet
561823db0e9SDon Lewis 		 * arrived via the correct interface if checking is
562823db0e9SDon Lewis 		 * enabled.
563f9e354dfSJulian Elischer 		 */
564823db0e9SDon Lewis 		if (IA_SIN(ia)->sin_addr.s_addr == pkt_dst.s_addr &&
565823db0e9SDon Lewis 		    (!checkif || ia->ia_ifp == m->m_pkthdr.rcvif))
566ed1ff184SJulian Elischer 			goto ours;
567ca925d9cSJonathan Lemon 	}
568823db0e9SDon Lewis 	/*
569ca925d9cSJonathan Lemon 	 * Check for broadcast addresses.
570ca925d9cSJonathan Lemon 	 *
571ca925d9cSJonathan Lemon 	 * Only accept broadcast packets that arrive via the matching
572ca925d9cSJonathan Lemon 	 * interface.  Reception of forwarded directed broadcasts would
573ca925d9cSJonathan Lemon 	 * be handled via ip_forward() and ether_output() with the loopback
574ca925d9cSJonathan Lemon 	 * into the stack for SIMPLEX interfaces handled by ether_output().
575823db0e9SDon Lewis 	 */
576ca925d9cSJonathan Lemon 	if (m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) {
577ca925d9cSJonathan Lemon 	        TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrhead, ifa_link) {
578ca925d9cSJonathan Lemon 			if (ifa->ifa_addr->sa_family != AF_INET)
579ca925d9cSJonathan Lemon 				continue;
580ca925d9cSJonathan Lemon 			ia = ifatoia(ifa);
581df8bae1dSRodney W. Grimes 			if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr ==
5827538a9a0SJonathan Lemon 			    pkt_dst.s_addr)
583df8bae1dSRodney W. Grimes 				goto ours;
5847538a9a0SJonathan Lemon 			if (ia->ia_netbroadcast.s_addr == pkt_dst.s_addr)
585df8bae1dSRodney W. Grimes 				goto ours;
586ca925d9cSJonathan Lemon #ifdef BOOTP_COMPAT
587ca925d9cSJonathan Lemon 			if (IA_SIN(ia)->sin_addr.s_addr == INADDR_ANY)
588ca925d9cSJonathan Lemon 				goto ours;
589ca925d9cSJonathan Lemon #endif
590df8bae1dSRodney W. Grimes 		}
591df8bae1dSRodney W. Grimes 	}
592df8bae1dSRodney W. Grimes 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
593df8bae1dSRodney W. Grimes 		struct in_multi *inm;
594df8bae1dSRodney W. Grimes 		if (ip_mrouter) {
595df8bae1dSRodney W. Grimes 			/*
596df8bae1dSRodney W. Grimes 			 * If we are acting as a multicast router, all
597df8bae1dSRodney W. Grimes 			 * incoming multicast packets are passed to the
598df8bae1dSRodney W. Grimes 			 * kernel-level multicast forwarding function.
599df8bae1dSRodney W. Grimes 			 * The packet is returned (relatively) intact; if
600df8bae1dSRodney W. Grimes 			 * ip_mforward() returns a non-zero value, the packet
601df8bae1dSRodney W. Grimes 			 * must be discarded, else it may be accepted below.
602df8bae1dSRodney W. Grimes 			 */
603f0068c4aSGarrett Wollman 			if (ip_mforward(ip, m->m_pkthdr.rcvif, m, 0) != 0) {
604df8bae1dSRodney W. Grimes 				ipstat.ips_cantforward++;
605df8bae1dSRodney W. Grimes 				m_freem(m);
606c67b1d17SGarrett Wollman 				return;
607df8bae1dSRodney W. Grimes 			}
608df8bae1dSRodney W. Grimes 
609df8bae1dSRodney W. Grimes 			/*
610df8bae1dSRodney W. Grimes 			 * The process-level routing demon needs to receive
611df8bae1dSRodney W. Grimes 			 * all multicast IGMP packets, whether or not this
612df8bae1dSRodney W. Grimes 			 * host belongs to their destination groups.
613df8bae1dSRodney W. Grimes 			 */
614df8bae1dSRodney W. Grimes 			if (ip->ip_p == IPPROTO_IGMP)
615df8bae1dSRodney W. Grimes 				goto ours;
616df8bae1dSRodney W. Grimes 			ipstat.ips_forward++;
617df8bae1dSRodney W. Grimes 		}
618df8bae1dSRodney W. Grimes 		/*
619df8bae1dSRodney W. Grimes 		 * See if we belong to the destination multicast group on the
620df8bae1dSRodney W. Grimes 		 * arrival interface.
621df8bae1dSRodney W. Grimes 		 */
622df8bae1dSRodney W. Grimes 		IN_LOOKUP_MULTI(ip->ip_dst, m->m_pkthdr.rcvif, inm);
623df8bae1dSRodney W. Grimes 		if (inm == NULL) {
62482c39223SGarrett Wollman 			ipstat.ips_notmember++;
625df8bae1dSRodney W. Grimes 			m_freem(m);
626c67b1d17SGarrett Wollman 			return;
627df8bae1dSRodney W. Grimes 		}
628df8bae1dSRodney W. Grimes 		goto ours;
629df8bae1dSRodney W. Grimes 	}
630df8bae1dSRodney W. Grimes 	if (ip->ip_dst.s_addr == (u_long)INADDR_BROADCAST)
631df8bae1dSRodney W. Grimes 		goto ours;
632df8bae1dSRodney W. Grimes 	if (ip->ip_dst.s_addr == INADDR_ANY)
633df8bae1dSRodney W. Grimes 		goto ours;
634df8bae1dSRodney W. Grimes 
6356a800098SYoshinobu Inoue 	/*
6366a800098SYoshinobu Inoue 	 * FAITH(Firewall Aided Internet Translator)
6376a800098SYoshinobu Inoue 	 */
6386a800098SYoshinobu Inoue 	if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
6396a800098SYoshinobu Inoue 		if (ip_keepfaith) {
6406a800098SYoshinobu Inoue 			if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_ICMP)
6416a800098SYoshinobu Inoue 				goto ours;
6426a800098SYoshinobu Inoue 		}
6436a800098SYoshinobu Inoue 		m_freem(m);
6446a800098SYoshinobu Inoue 		return;
6456a800098SYoshinobu Inoue 	}
6469494d596SBrooks Davis 
647df8bae1dSRodney W. Grimes 	/*
648df8bae1dSRodney W. Grimes 	 * Not for us; forward if possible and desirable.
649df8bae1dSRodney W. Grimes 	 */
650df8bae1dSRodney W. Grimes 	if (ipforwarding == 0) {
651df8bae1dSRodney W. Grimes 		ipstat.ips_cantforward++;
652df8bae1dSRodney W. Grimes 		m_freem(m);
653df8bae1dSRodney W. Grimes 	} else
654df8bae1dSRodney W. Grimes 		ip_forward(m, 0);
655ed1ff184SJulian Elischer #ifdef IPFIREWALL_FORWARD
656ed1ff184SJulian Elischer 	ip_fw_fwd_addr = NULL;
657ed1ff184SJulian Elischer #endif
658c67b1d17SGarrett Wollman 	return;
659df8bae1dSRodney W. Grimes 
660df8bae1dSRodney W. Grimes ours:
661d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH
662d0ebc0d2SYaroslav Tykhiy 	/*
663d0ebc0d2SYaroslav Tykhiy 	 * IPSTEALTH: Process non-routing options only
664d0ebc0d2SYaroslav Tykhiy 	 * if the packet is destined for us.
665d0ebc0d2SYaroslav Tykhiy 	 */
666d0ebc0d2SYaroslav Tykhiy 	if (ipstealth && hlen > sizeof (struct ip) && ip_dooptions(m, 1)) {
667d0ebc0d2SYaroslav Tykhiy #ifdef IPFIREWALL_FORWARD
668d0ebc0d2SYaroslav Tykhiy 		ip_fw_fwd_addr = NULL;
669d0ebc0d2SYaroslav Tykhiy #endif
670d0ebc0d2SYaroslav Tykhiy 		return;
671d0ebc0d2SYaroslav Tykhiy 	}
672d0ebc0d2SYaroslav Tykhiy #endif /* IPSTEALTH */
673d0ebc0d2SYaroslav Tykhiy 
6745da9f8faSJosef Karthauser 	/* Count the packet in the ip address stats */
6755da9f8faSJosef Karthauser 	if (ia != NULL) {
6765da9f8faSJosef Karthauser 		ia->ia_ifa.if_ipackets++;
6775da9f8faSJosef Karthauser 		ia->ia_ifa.if_ibytes += m->m_pkthdr.len;
6785da9f8faSJosef Karthauser 	}
679100ba1a6SJordan K. Hubbard 
68063f8d699SJordan K. Hubbard 	/*
681df8bae1dSRodney W. Grimes 	 * If offset or IP_MF are set, must reassemble.
682df8bae1dSRodney W. Grimes 	 * Otherwise, nothing need be done.
683df8bae1dSRodney W. Grimes 	 * (We could look in the reassembly queue to see
684df8bae1dSRodney W. Grimes 	 * if the packet was previously fragmented,
685df8bae1dSRodney W. Grimes 	 * but it's not worth the time; just let them time out.)
686df8bae1dSRodney W. Grimes 	 */
687b6ea1aa5SRuslan Ermilov 	if (ip->ip_off & (IP_MF | IP_OFFMASK)) {
6886a800098SYoshinobu Inoue 
689194a213eSAndrey A. Chernov 		sum = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id);
690df8bae1dSRodney W. Grimes 		/*
691df8bae1dSRodney W. Grimes 		 * Look for queue of fragments
692df8bae1dSRodney W. Grimes 		 * of this datagram.
693df8bae1dSRodney W. Grimes 		 */
694462b86feSPoul-Henning Kamp 		TAILQ_FOREACH(fp, &ipq[sum], ipq_list)
695df8bae1dSRodney W. Grimes 			if (ip->ip_id == fp->ipq_id &&
696df8bae1dSRodney W. Grimes 			    ip->ip_src.s_addr == fp->ipq_src.s_addr &&
697df8bae1dSRodney W. Grimes 			    ip->ip_dst.s_addr == fp->ipq_dst.s_addr &&
698df8bae1dSRodney W. Grimes 			    ip->ip_p == fp->ipq_p)
699df8bae1dSRodney W. Grimes 				goto found;
700df8bae1dSRodney W. Grimes 
701194a213eSAndrey A. Chernov 		fp = 0;
702194a213eSAndrey A. Chernov 
703194a213eSAndrey A. Chernov 		/* check if there's a place for the new queue */
704194a213eSAndrey A. Chernov 		if (nipq > maxnipq) {
705194a213eSAndrey A. Chernov 		    /*
706194a213eSAndrey A. Chernov 		     * drop something from the tail of the current queue
707194a213eSAndrey A. Chernov 		     * before proceeding further
708194a213eSAndrey A. Chernov 		     */
709462b86feSPoul-Henning Kamp 		    struct ipq *q = TAILQ_LAST(&ipq[sum], ipqhead);
710462b86feSPoul-Henning Kamp 		    if (q == NULL) {   /* gak */
711194a213eSAndrey A. Chernov 			for (i = 0; i < IPREASS_NHASH; i++) {
712462b86feSPoul-Henning Kamp 			    struct ipq *r = TAILQ_LAST(&ipq[i], ipqhead);
713462b86feSPoul-Henning Kamp 			    if (r) {
714462b86feSPoul-Henning Kamp 				ip_freef(&ipq[i], r);
715194a213eSAndrey A. Chernov 				break;
716194a213eSAndrey A. Chernov 			    }
717194a213eSAndrey A. Chernov 			}
718194a213eSAndrey A. Chernov 		    } else
719462b86feSPoul-Henning Kamp 			ip_freef(&ipq[sum], q);
720194a213eSAndrey A. Chernov 		}
721194a213eSAndrey A. Chernov found:
722df8bae1dSRodney W. Grimes 		/*
723df8bae1dSRodney W. Grimes 		 * Adjust ip_len to not reflect header,
724df8bae1dSRodney W. Grimes 		 * convert offset of this to bytes.
725df8bae1dSRodney W. Grimes 		 */
726df8bae1dSRodney W. Grimes 		ip->ip_len -= hlen;
727b6ea1aa5SRuslan Ermilov 		if (ip->ip_off & IP_MF) {
7286effc713SDoug Rabson 		        /*
7296effc713SDoug Rabson 		         * Make sure that fragments have a data length
7306effc713SDoug Rabson 			 * that's a non-zero multiple of 8 bytes.
7316effc713SDoug Rabson 		         */
7326effc713SDoug Rabson 			if (ip->ip_len == 0 || (ip->ip_len & 0x7) != 0) {
7336effc713SDoug Rabson 				ipstat.ips_toosmall++; /* XXX */
7346effc713SDoug Rabson 				goto bad;
7356effc713SDoug Rabson 			}
7366effc713SDoug Rabson 			m->m_flags |= M_FRAG;
7376effc713SDoug Rabson 		}
738df8bae1dSRodney W. Grimes 		ip->ip_off <<= 3;
739df8bae1dSRodney W. Grimes 
740df8bae1dSRodney W. Grimes 		/*
741b6ea1aa5SRuslan Ermilov 		 * Attempt reassembly; if it succeeds, proceed.
742df8bae1dSRodney W. Grimes 		 */
743df8bae1dSRodney W. Grimes 		ipstat.ips_fragments++;
744487bdb38SRuslan Ermilov 		m->m_pkthdr.header = ip;
7458948e4baSArchie Cobbs #ifdef IPDIVERT
7466a800098SYoshinobu Inoue 		m = ip_reass(m,
747462b86feSPoul-Henning Kamp 		    &ipq[sum], fp, &divert_info, &divert_cookie);
7488948e4baSArchie Cobbs #else
749462b86feSPoul-Henning Kamp 		m = ip_reass(m, &ipq[sum], fp);
7508948e4baSArchie Cobbs #endif
7516a800098SYoshinobu Inoue 		if (m == 0) {
752f9e354dfSJulian Elischer #ifdef IPFIREWALL_FORWARD
753f9e354dfSJulian Elischer 			ip_fw_fwd_addr = NULL;
754f9e354dfSJulian Elischer #endif
755c67b1d17SGarrett Wollman 			return;
756f9e354dfSJulian Elischer 		}
757df8bae1dSRodney W. Grimes 		ipstat.ips_reassembled++;
7586a800098SYoshinobu Inoue 		ip = mtod(m, struct ip *);
7597e2df452SRuslan Ermilov 		/* Get the header length of the reassembled packet */
7607e2df452SRuslan Ermilov 		hlen = IP_VHL_HL(ip->ip_vhl) << 2;
761af782f1cSBrian Somers #ifdef IPDIVERT
7628948e4baSArchie Cobbs 		/* Restore original checksum before diverting packet */
7638948e4baSArchie Cobbs 		if (divert_info != 0) {
764af782f1cSBrian Somers 			ip->ip_len += hlen;
765af782f1cSBrian Somers 			HTONS(ip->ip_len);
766af782f1cSBrian Somers 			HTONS(ip->ip_off);
767af782f1cSBrian Somers 			ip->ip_sum = 0;
76860123168SRuslan Ermilov 			if (hlen == sizeof(struct ip))
769af782f1cSBrian Somers 				ip->ip_sum = in_cksum_hdr(ip);
77060123168SRuslan Ermilov 			else
77160123168SRuslan Ermilov 				ip->ip_sum = in_cksum(m, hlen);
772af782f1cSBrian Somers 			NTOHS(ip->ip_off);
773af782f1cSBrian Somers 			NTOHS(ip->ip_len);
774af782f1cSBrian Somers 			ip->ip_len -= hlen;
775af782f1cSBrian Somers 		}
776af782f1cSBrian Somers #endif
777df8bae1dSRodney W. Grimes 	} else
778df8bae1dSRodney W. Grimes 		ip->ip_len -= hlen;
779df8bae1dSRodney W. Grimes 
78093e0e116SJulian Elischer #ifdef IPDIVERT
78193e0e116SJulian Elischer 	/*
7828948e4baSArchie Cobbs 	 * Divert or tee packet to the divert protocol if required.
7838948e4baSArchie Cobbs 	 *
7848948e4baSArchie Cobbs 	 * If divert_info is zero then cookie should be too, so we shouldn't
7858948e4baSArchie Cobbs 	 * need to clear them here.  Assume divert_packet() does so also.
78693e0e116SJulian Elischer 	 */
7878948e4baSArchie Cobbs 	if (divert_info != 0) {
7888948e4baSArchie Cobbs 		struct mbuf *clone = NULL;
7898948e4baSArchie Cobbs 
7908948e4baSArchie Cobbs 		/* Clone packet if we're doing a 'tee' */
7918948e4baSArchie Cobbs 		if ((divert_info & IP_FW_PORT_TEE_FLAG) != 0)
7928948e4baSArchie Cobbs 			clone = m_dup(m, M_DONTWAIT);
7938948e4baSArchie Cobbs 
7948948e4baSArchie Cobbs 		/* Restore packet header fields to original values */
7958948e4baSArchie Cobbs 		ip->ip_len += hlen;
7968948e4baSArchie Cobbs 		HTONS(ip->ip_len);
7978948e4baSArchie Cobbs 		HTONS(ip->ip_off);
7988948e4baSArchie Cobbs 
7998948e4baSArchie Cobbs 		/* Deliver packet to divert input routine */
8008948e4baSArchie Cobbs 		ip_divert_cookie = divert_cookie;
8018948e4baSArchie Cobbs 		divert_packet(m, 1, divert_info & 0xffff);
802e4676ba6SJulian Elischer 		ipstat.ips_delivered++;
8038948e4baSArchie Cobbs 
8048948e4baSArchie Cobbs 		/* If 'tee', continue with original packet */
8058948e4baSArchie Cobbs 		if (clone == NULL)
80693e0e116SJulian Elischer 			return;
8078948e4baSArchie Cobbs 		m = clone;
8088948e4baSArchie Cobbs 		ip = mtod(m, struct ip *);
80993e0e116SJulian Elischer 	}
81093e0e116SJulian Elischer #endif
81193e0e116SJulian Elischer 
81233841545SHajimu UMEMOTO #ifdef IPSEC
81333841545SHajimu UMEMOTO 	/*
81433841545SHajimu UMEMOTO 	 * enforce IPsec policy checking if we are seeing last header.
81533841545SHajimu UMEMOTO 	 * note that we do not visit this with protocols with pcb layer
81633841545SHajimu UMEMOTO 	 * code - like udp/tcp/raw ip.
81733841545SHajimu UMEMOTO 	 */
81833841545SHajimu UMEMOTO 	if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0 &&
81933841545SHajimu UMEMOTO 	    ipsec4_in_reject(m, NULL)) {
82033841545SHajimu UMEMOTO 		ipsecstat.in_polvio++;
82133841545SHajimu UMEMOTO 		goto bad;
82233841545SHajimu UMEMOTO 	}
82333841545SHajimu UMEMOTO #endif
82433841545SHajimu UMEMOTO 
825df8bae1dSRodney W. Grimes 	/*
826df8bae1dSRodney W. Grimes 	 * Switch out to protocol's input routine.
827df8bae1dSRodney W. Grimes 	 */
828df8bae1dSRodney W. Grimes 	ipstat.ips_delivered++;
8296a800098SYoshinobu Inoue     {
830f0ffb944SJulian Elischer 	int off = hlen;
8316a800098SYoshinobu Inoue 
832f0ffb944SJulian Elischer 	(*inetsw[ip_protox[ip->ip_p]].pr_input)(m, off);
833f9e354dfSJulian Elischer #ifdef	IPFIREWALL_FORWARD
834f9e354dfSJulian Elischer 	ip_fw_fwd_addr = NULL;	/* tcp needed it */
835f9e354dfSJulian Elischer #endif
836c67b1d17SGarrett Wollman 	return;
8376a800098SYoshinobu Inoue     }
838df8bae1dSRodney W. Grimes bad:
839f9e354dfSJulian Elischer #ifdef	IPFIREWALL_FORWARD
840f9e354dfSJulian Elischer 	ip_fw_fwd_addr = NULL;
841f9e354dfSJulian Elischer #endif
842df8bae1dSRodney W. Grimes 	m_freem(m);
843c67b1d17SGarrett Wollman }
844c67b1d17SGarrett Wollman 
845c67b1d17SGarrett Wollman /*
846c67b1d17SGarrett Wollman  * IP software interrupt routine - to go away sometime soon
847c67b1d17SGarrett Wollman  */
848c67b1d17SGarrett Wollman static void
849c67b1d17SGarrett Wollman ipintr(void)
850c67b1d17SGarrett Wollman {
851c67b1d17SGarrett Wollman 	struct mbuf *m;
852c67b1d17SGarrett Wollman 
853c67b1d17SGarrett Wollman 	while (1) {
854c67b1d17SGarrett Wollman 		IF_DEQUEUE(&ipintrq, m);
855c67b1d17SGarrett Wollman 		if (m == 0)
856c67b1d17SGarrett Wollman 			return;
857c67b1d17SGarrett Wollman 		ip_input(m);
858c67b1d17SGarrett Wollman 	}
859df8bae1dSRodney W. Grimes }
860df8bae1dSRodney W. Grimes 
861df8bae1dSRodney W. Grimes /*
8628948e4baSArchie Cobbs  * Take incoming datagram fragment and try to reassemble it into
8638948e4baSArchie Cobbs  * whole datagram.  If a chain for reassembly of this datagram already
8648948e4baSArchie Cobbs  * exists, then it is given as fp; otherwise have to make a chain.
8658948e4baSArchie Cobbs  *
8668948e4baSArchie Cobbs  * When IPDIVERT enabled, keep additional state with each packet that
8678948e4baSArchie Cobbs  * tells us if we need to divert or tee the packet we're building.
868df8bae1dSRodney W. Grimes  */
8698948e4baSArchie Cobbs 
8706a800098SYoshinobu Inoue static struct mbuf *
8718948e4baSArchie Cobbs #ifdef IPDIVERT
872462b86feSPoul-Henning Kamp ip_reass(m, head, fp, divinfo, divcookie)
8738948e4baSArchie Cobbs #else
874462b86feSPoul-Henning Kamp ip_reass(m, head, fp)
8758948e4baSArchie Cobbs #endif
876462b86feSPoul-Henning Kamp 	struct mbuf *m;
877462b86feSPoul-Henning Kamp 	struct ipqhead *head;
878462b86feSPoul-Henning Kamp 	struct ipq *fp;
8798948e4baSArchie Cobbs #ifdef IPDIVERT
8808948e4baSArchie Cobbs 	u_int32_t *divinfo;
8818948e4baSArchie Cobbs 	u_int16_t *divcookie;
8828948e4baSArchie Cobbs #endif
883df8bae1dSRodney W. Grimes {
8846effc713SDoug Rabson 	struct ip *ip = mtod(m, struct ip *);
885b6ea1aa5SRuslan Ermilov 	register struct mbuf *p, *q, *nq;
886df8bae1dSRodney W. Grimes 	struct mbuf *t;
8876effc713SDoug Rabson 	int hlen = IP_VHL_HL(ip->ip_vhl) << 2;
888df8bae1dSRodney W. Grimes 	int i, next;
889df8bae1dSRodney W. Grimes 
890df8bae1dSRodney W. Grimes 	/*
891df8bae1dSRodney W. Grimes 	 * Presence of header sizes in mbufs
892df8bae1dSRodney W. Grimes 	 * would confuse code below.
893df8bae1dSRodney W. Grimes 	 */
894df8bae1dSRodney W. Grimes 	m->m_data += hlen;
895df8bae1dSRodney W. Grimes 	m->m_len -= hlen;
896df8bae1dSRodney W. Grimes 
897df8bae1dSRodney W. Grimes 	/*
898df8bae1dSRodney W. Grimes 	 * If first fragment to arrive, create a reassembly queue.
899df8bae1dSRodney W. Grimes 	 */
900df8bae1dSRodney W. Grimes 	if (fp == 0) {
901690a6055SJesper Skriver 		/*
902690a6055SJesper Skriver 		 * Enforce upper bound on number of fragmented packets
903690a6055SJesper Skriver 		 * for which we attempt reassembly;
904690a6055SJesper Skriver 		 * If maxfrag is 0, never accept fragments.
905690a6055SJesper Skriver 		 * If maxfrag is -1, accept all fragments without limitation.
906690a6055SJesper Skriver 		 */
907690a6055SJesper Skriver 		if ((ip_maxfragpackets >= 0) && (ip_nfragpackets >= ip_maxfragpackets))
908690a6055SJesper Skriver 			goto dropfrag;
909690a6055SJesper Skriver 		ip_nfragpackets++;
910df8bae1dSRodney W. Grimes 		if ((t = m_get(M_DONTWAIT, MT_FTABLE)) == NULL)
911df8bae1dSRodney W. Grimes 			goto dropfrag;
912df8bae1dSRodney W. Grimes 		fp = mtod(t, struct ipq *);
913462b86feSPoul-Henning Kamp 		TAILQ_INSERT_HEAD(head, fp, ipq_list);
914194a213eSAndrey A. Chernov 		nipq++;
915df8bae1dSRodney W. Grimes 		fp->ipq_ttl = IPFRAGTTL;
916df8bae1dSRodney W. Grimes 		fp->ipq_p = ip->ip_p;
917df8bae1dSRodney W. Grimes 		fp->ipq_id = ip->ip_id;
9186effc713SDoug Rabson 		fp->ipq_src = ip->ip_src;
9196effc713SDoug Rabson 		fp->ipq_dst = ip->ip_dst;
920af38c68cSLuigi Rizzo 		fp->ipq_frags = m;
921af38c68cSLuigi Rizzo 		m->m_nextpkt = NULL;
92293e0e116SJulian Elischer #ifdef IPDIVERT
9238948e4baSArchie Cobbs 		fp->ipq_div_info = 0;
924bb60f459SJulian Elischer 		fp->ipq_div_cookie = 0;
92593e0e116SJulian Elischer #endif
926af38c68cSLuigi Rizzo 		goto inserted;
927df8bae1dSRodney W. Grimes 	}
928df8bae1dSRodney W. Grimes 
9296effc713SDoug Rabson #define GETIP(m)	((struct ip*)((m)->m_pkthdr.header))
9306effc713SDoug Rabson 
931df8bae1dSRodney W. Grimes 	/*
932df8bae1dSRodney W. Grimes 	 * Find a segment which begins after this one does.
933df8bae1dSRodney W. Grimes 	 */
9346effc713SDoug Rabson 	for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt)
9356effc713SDoug Rabson 		if (GETIP(q)->ip_off > ip->ip_off)
936df8bae1dSRodney W. Grimes 			break;
937df8bae1dSRodney W. Grimes 
938df8bae1dSRodney W. Grimes 	/*
939df8bae1dSRodney W. Grimes 	 * If there is a preceding segment, it may provide some of
940df8bae1dSRodney W. Grimes 	 * our data already.  If so, drop the data from the incoming
941af38c68cSLuigi Rizzo 	 * segment.  If it provides all of our data, drop us, otherwise
942af38c68cSLuigi Rizzo 	 * stick new segment in the proper place.
943db4f9cc7SJonathan Lemon 	 *
944db4f9cc7SJonathan Lemon 	 * If some of the data is dropped from the the preceding
945db4f9cc7SJonathan Lemon 	 * segment, then it's checksum is invalidated.
946df8bae1dSRodney W. Grimes 	 */
9476effc713SDoug Rabson 	if (p) {
9486effc713SDoug Rabson 		i = GETIP(p)->ip_off + GETIP(p)->ip_len - ip->ip_off;
949df8bae1dSRodney W. Grimes 		if (i > 0) {
950df8bae1dSRodney W. Grimes 			if (i >= ip->ip_len)
951df8bae1dSRodney W. Grimes 				goto dropfrag;
9526a800098SYoshinobu Inoue 			m_adj(m, i);
953db4f9cc7SJonathan Lemon 			m->m_pkthdr.csum_flags = 0;
954df8bae1dSRodney W. Grimes 			ip->ip_off += i;
955df8bae1dSRodney W. Grimes 			ip->ip_len -= i;
956df8bae1dSRodney W. Grimes 		}
957af38c68cSLuigi Rizzo 		m->m_nextpkt = p->m_nextpkt;
958af38c68cSLuigi Rizzo 		p->m_nextpkt = m;
959af38c68cSLuigi Rizzo 	} else {
960af38c68cSLuigi Rizzo 		m->m_nextpkt = fp->ipq_frags;
961af38c68cSLuigi Rizzo 		fp->ipq_frags = m;
962df8bae1dSRodney W. Grimes 	}
963df8bae1dSRodney W. Grimes 
964df8bae1dSRodney W. Grimes 	/*
965df8bae1dSRodney W. Grimes 	 * While we overlap succeeding segments trim them or,
966df8bae1dSRodney W. Grimes 	 * if they are completely covered, dequeue them.
967df8bae1dSRodney W. Grimes 	 */
9686effc713SDoug Rabson 	for (; q != NULL && ip->ip_off + ip->ip_len > GETIP(q)->ip_off;
969af38c68cSLuigi Rizzo 	     q = nq) {
9706effc713SDoug Rabson 		i = (ip->ip_off + ip->ip_len) -
9716effc713SDoug Rabson 		    GETIP(q)->ip_off;
9726effc713SDoug Rabson 		if (i < GETIP(q)->ip_len) {
9736effc713SDoug Rabson 			GETIP(q)->ip_len -= i;
9746effc713SDoug Rabson 			GETIP(q)->ip_off += i;
9756effc713SDoug Rabson 			m_adj(q, i);
976db4f9cc7SJonathan Lemon 			q->m_pkthdr.csum_flags = 0;
977df8bae1dSRodney W. Grimes 			break;
978df8bae1dSRodney W. Grimes 		}
9796effc713SDoug Rabson 		nq = q->m_nextpkt;
980af38c68cSLuigi Rizzo 		m->m_nextpkt = nq;
9816effc713SDoug Rabson 		m_freem(q);
982df8bae1dSRodney W. Grimes 	}
983df8bae1dSRodney W. Grimes 
984af38c68cSLuigi Rizzo inserted:
98593e0e116SJulian Elischer 
98693e0e116SJulian Elischer #ifdef IPDIVERT
98793e0e116SJulian Elischer 	/*
9888948e4baSArchie Cobbs 	 * Transfer firewall instructions to the fragment structure.
9898948e4baSArchie Cobbs 	 * Any fragment diverting causes the whole packet to divert.
99093e0e116SJulian Elischer 	 */
9918948e4baSArchie Cobbs 	fp->ipq_div_info = *divinfo;
9928948e4baSArchie Cobbs 	fp->ipq_div_cookie = *divcookie;
9938948e4baSArchie Cobbs 	*divinfo = 0;
9948948e4baSArchie Cobbs 	*divcookie = 0;
99593e0e116SJulian Elischer #endif
99693e0e116SJulian Elischer 
997df8bae1dSRodney W. Grimes 	/*
998af38c68cSLuigi Rizzo 	 * Check for complete reassembly.
999df8bae1dSRodney W. Grimes 	 */
10006effc713SDoug Rabson 	next = 0;
10016effc713SDoug Rabson 	for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt) {
10026effc713SDoug Rabson 		if (GETIP(q)->ip_off != next)
10036effc713SDoug Rabson 			return (0);
10046effc713SDoug Rabson 		next += GETIP(q)->ip_len;
10056effc713SDoug Rabson 	}
10066effc713SDoug Rabson 	/* Make sure the last packet didn't have the IP_MF flag */
10076effc713SDoug Rabson 	if (p->m_flags & M_FRAG)
1008df8bae1dSRodney W. Grimes 		return (0);
1009df8bae1dSRodney W. Grimes 
1010df8bae1dSRodney W. Grimes 	/*
1011430d30d8SBill Fenner 	 * Reassembly is complete.  Make sure the packet is a sane size.
1012430d30d8SBill Fenner 	 */
10136effc713SDoug Rabson 	q = fp->ipq_frags;
10146effc713SDoug Rabson 	ip = GETIP(q);
10156effc713SDoug Rabson 	if (next + (IP_VHL_HL(ip->ip_vhl) << 2) > IP_MAXPACKET) {
1016430d30d8SBill Fenner 		ipstat.ips_toolong++;
1017462b86feSPoul-Henning Kamp 		ip_freef(head, fp);
1018430d30d8SBill Fenner 		return (0);
1019430d30d8SBill Fenner 	}
1020430d30d8SBill Fenner 
1021430d30d8SBill Fenner 	/*
1022430d30d8SBill Fenner 	 * Concatenate fragments.
1023df8bae1dSRodney W. Grimes 	 */
10246effc713SDoug Rabson 	m = q;
1025df8bae1dSRodney W. Grimes 	t = m->m_next;
1026df8bae1dSRodney W. Grimes 	m->m_next = 0;
1027df8bae1dSRodney W. Grimes 	m_cat(m, t);
10286effc713SDoug Rabson 	nq = q->m_nextpkt;
1029945aa40dSDoug Rabson 	q->m_nextpkt = 0;
10306effc713SDoug Rabson 	for (q = nq; q != NULL; q = nq) {
10316effc713SDoug Rabson 		nq = q->m_nextpkt;
1032945aa40dSDoug Rabson 		q->m_nextpkt = NULL;
1033db4f9cc7SJonathan Lemon 		m->m_pkthdr.csum_flags &= q->m_pkthdr.csum_flags;
1034db4f9cc7SJonathan Lemon 		m->m_pkthdr.csum_data += q->m_pkthdr.csum_data;
1035a8db1d93SJonathan Lemon 		m_cat(m, q);
1036df8bae1dSRodney W. Grimes 	}
1037df8bae1dSRodney W. Grimes 
103893e0e116SJulian Elischer #ifdef IPDIVERT
103993e0e116SJulian Elischer 	/*
10408948e4baSArchie Cobbs 	 * Extract firewall instructions from the fragment structure.
104193e0e116SJulian Elischer 	 */
10428948e4baSArchie Cobbs 	*divinfo = fp->ipq_div_info;
10438948e4baSArchie Cobbs 	*divcookie = fp->ipq_div_cookie;
104493e0e116SJulian Elischer #endif
104593e0e116SJulian Elischer 
1046df8bae1dSRodney W. Grimes 	/*
1047df8bae1dSRodney W. Grimes 	 * Create header for new ip packet by
1048df8bae1dSRodney W. Grimes 	 * modifying header of first packet;
1049df8bae1dSRodney W. Grimes 	 * dequeue and discard fragment reassembly header.
1050df8bae1dSRodney W. Grimes 	 * Make header visible.
1051df8bae1dSRodney W. Grimes 	 */
1052df8bae1dSRodney W. Grimes 	ip->ip_len = next;
10536effc713SDoug Rabson 	ip->ip_src = fp->ipq_src;
10546effc713SDoug Rabson 	ip->ip_dst = fp->ipq_dst;
1055462b86feSPoul-Henning Kamp 	TAILQ_REMOVE(head, fp, ipq_list);
1056194a213eSAndrey A. Chernov 	nipq--;
1057df8bae1dSRodney W. Grimes 	(void) m_free(dtom(fp));
1058690a6055SJesper Skriver 	ip_nfragpackets--;
10596effc713SDoug Rabson 	m->m_len += (IP_VHL_HL(ip->ip_vhl) << 2);
10606effc713SDoug Rabson 	m->m_data -= (IP_VHL_HL(ip->ip_vhl) << 2);
1061df8bae1dSRodney W. Grimes 	/* some debugging cruft by sklower, below, will go away soon */
1062df8bae1dSRodney W. Grimes 	if (m->m_flags & M_PKTHDR) { /* XXX this should be done elsewhere */
1063df8bae1dSRodney W. Grimes 		register int plen = 0;
10646a800098SYoshinobu Inoue 		for (t = m; t; t = t->m_next)
10656a800098SYoshinobu Inoue 			plen += t->m_len;
10666a800098SYoshinobu Inoue 		m->m_pkthdr.len = plen;
1067df8bae1dSRodney W. Grimes 	}
10686a800098SYoshinobu Inoue 	return (m);
1069df8bae1dSRodney W. Grimes 
1070df8bae1dSRodney W. Grimes dropfrag:
1071efe39c6aSJulian Elischer #ifdef IPDIVERT
10728948e4baSArchie Cobbs 	*divinfo = 0;
10738948e4baSArchie Cobbs 	*divcookie = 0;
1074efe39c6aSJulian Elischer #endif
1075df8bae1dSRodney W. Grimes 	ipstat.ips_fragdropped++;
1076df8bae1dSRodney W. Grimes 	m_freem(m);
1077df8bae1dSRodney W. Grimes 	return (0);
10786effc713SDoug Rabson 
10796effc713SDoug Rabson #undef GETIP
1080df8bae1dSRodney W. Grimes }
1081df8bae1dSRodney W. Grimes 
1082df8bae1dSRodney W. Grimes /*
1083df8bae1dSRodney W. Grimes  * Free a fragment reassembly header and all
1084df8bae1dSRodney W. Grimes  * associated datagrams.
1085df8bae1dSRodney W. Grimes  */
10860312fbe9SPoul-Henning Kamp static void
1087462b86feSPoul-Henning Kamp ip_freef(fhp, fp)
1088462b86feSPoul-Henning Kamp 	struct ipqhead *fhp;
1089df8bae1dSRodney W. Grimes 	struct ipq *fp;
1090df8bae1dSRodney W. Grimes {
10916effc713SDoug Rabson 	register struct mbuf *q;
1092df8bae1dSRodney W. Grimes 
10936effc713SDoug Rabson 	while (fp->ipq_frags) {
10946effc713SDoug Rabson 		q = fp->ipq_frags;
10956effc713SDoug Rabson 		fp->ipq_frags = q->m_nextpkt;
10966effc713SDoug Rabson 		m_freem(q);
1097df8bae1dSRodney W. Grimes 	}
1098462b86feSPoul-Henning Kamp 	TAILQ_REMOVE(fhp, fp, ipq_list);
1099df8bae1dSRodney W. Grimes 	(void) m_free(dtom(fp));
1100690a6055SJesper Skriver 	ip_nfragpackets--;
1101194a213eSAndrey A. Chernov 	nipq--;
1102df8bae1dSRodney W. Grimes }
1103df8bae1dSRodney W. Grimes 
1104df8bae1dSRodney W. Grimes /*
1105df8bae1dSRodney W. Grimes  * IP timer processing;
1106df8bae1dSRodney W. Grimes  * if a timer expires on a reassembly
1107df8bae1dSRodney W. Grimes  * queue, discard it.
1108df8bae1dSRodney W. Grimes  */
1109df8bae1dSRodney W. Grimes void
1110df8bae1dSRodney W. Grimes ip_slowtimo()
1111df8bae1dSRodney W. Grimes {
1112df8bae1dSRodney W. Grimes 	register struct ipq *fp;
1113df8bae1dSRodney W. Grimes 	int s = splnet();
1114194a213eSAndrey A. Chernov 	int i;
1115df8bae1dSRodney W. Grimes 
1116194a213eSAndrey A. Chernov 	for (i = 0; i < IPREASS_NHASH; i++) {
1117462b86feSPoul-Henning Kamp 		for(fp = TAILQ_FIRST(&ipq[i]); fp;) {
1118462b86feSPoul-Henning Kamp 			struct ipq *fpp;
1119462b86feSPoul-Henning Kamp 
1120462b86feSPoul-Henning Kamp 			fpp = fp;
1121462b86feSPoul-Henning Kamp 			fp = TAILQ_NEXT(fp, ipq_list);
1122462b86feSPoul-Henning Kamp 			if(--fpp->ipq_ttl == 0) {
1123df8bae1dSRodney W. Grimes 				ipstat.ips_fragtimeout++;
1124462b86feSPoul-Henning Kamp 				ip_freef(&ipq[i], fpp);
1125df8bae1dSRodney W. Grimes 			}
1126df8bae1dSRodney W. Grimes 		}
1127194a213eSAndrey A. Chernov 	}
1128690a6055SJesper Skriver 	/*
1129690a6055SJesper Skriver 	 * If we are over the maximum number of fragments
1130690a6055SJesper Skriver 	 * (due to the limit being lowered), drain off
1131690a6055SJesper Skriver 	 * enough to get down to the new limit.
1132690a6055SJesper Skriver 	 */
1133690a6055SJesper Skriver 	for (i = 0; i < IPREASS_NHASH; i++) {
1134690a6055SJesper Skriver 		if (ip_maxfragpackets >= 0) {
1135690a6055SJesper Skriver 			while (ip_nfragpackets > ip_maxfragpackets &&
1136690a6055SJesper Skriver 				!TAILQ_EMPTY(&ipq[i])) {
1137690a6055SJesper Skriver 				ipstat.ips_fragdropped++;
1138690a6055SJesper Skriver 				ip_freef(&ipq[i], TAILQ_FIRST(&ipq[i]));
1139690a6055SJesper Skriver 			}
1140690a6055SJesper Skriver 		}
1141690a6055SJesper Skriver 	}
11421f91d8c5SDavid Greenman 	ipflow_slowtimo();
1143df8bae1dSRodney W. Grimes 	splx(s);
1144df8bae1dSRodney W. Grimes }
1145df8bae1dSRodney W. Grimes 
1146df8bae1dSRodney W. Grimes /*
1147df8bae1dSRodney W. Grimes  * Drain off all datagram fragments.
1148df8bae1dSRodney W. Grimes  */
1149df8bae1dSRodney W. Grimes void
1150df8bae1dSRodney W. Grimes ip_drain()
1151df8bae1dSRodney W. Grimes {
1152194a213eSAndrey A. Chernov 	int     i;
1153ce29ab3aSGarrett Wollman 
1154194a213eSAndrey A. Chernov 	for (i = 0; i < IPREASS_NHASH; i++) {
1155462b86feSPoul-Henning Kamp 		while(!TAILQ_EMPTY(&ipq[i])) {
1156194a213eSAndrey A. Chernov 			ipstat.ips_fragdropped++;
1157462b86feSPoul-Henning Kamp 			ip_freef(&ipq[i], TAILQ_FIRST(&ipq[i]));
1158194a213eSAndrey A. Chernov 		}
1159194a213eSAndrey A. Chernov 	}
1160ce29ab3aSGarrett Wollman 	in_rtqdrain();
1161df8bae1dSRodney W. Grimes }
1162df8bae1dSRodney W. Grimes 
1163df8bae1dSRodney W. Grimes /*
1164df8bae1dSRodney W. Grimes  * Do option processing on a datagram,
1165df8bae1dSRodney W. Grimes  * possibly discarding it if bad options are encountered,
1166df8bae1dSRodney W. Grimes  * or forwarding it if source-routed.
1167d0ebc0d2SYaroslav Tykhiy  * The pass argument is used when operating in the IPSTEALTH
1168d0ebc0d2SYaroslav Tykhiy  * mode to tell what options to process:
1169d0ebc0d2SYaroslav Tykhiy  * [LS]SRR (pass 0) or the others (pass 1).
1170d0ebc0d2SYaroslav Tykhiy  * The reason for as many as two passes is that when doing IPSTEALTH,
1171d0ebc0d2SYaroslav Tykhiy  * non-routing options should be processed only if the packet is for us.
1172df8bae1dSRodney W. Grimes  * Returns 1 if packet has been forwarded/freed,
1173df8bae1dSRodney W. Grimes  * 0 if the packet should be processed further.
1174df8bae1dSRodney W. Grimes  */
11750312fbe9SPoul-Henning Kamp static int
1176d0ebc0d2SYaroslav Tykhiy ip_dooptions(m, pass)
1177df8bae1dSRodney W. Grimes 	struct mbuf *m;
1178d0ebc0d2SYaroslav Tykhiy 	int pass;
1179df8bae1dSRodney W. Grimes {
1180df8bae1dSRodney W. Grimes 	register struct ip *ip = mtod(m, struct ip *);
1181df8bae1dSRodney W. Grimes 	register u_char *cp;
1182df8bae1dSRodney W. Grimes 	register struct in_ifaddr *ia;
1183df8bae1dSRodney W. Grimes 	int opt, optlen, cnt, off, code, type = ICMP_PARAMPROB, forward = 0;
1184df8bae1dSRodney W. Grimes 	struct in_addr *sin, dst;
1185df8bae1dSRodney W. Grimes 	n_time ntime;
1186df8bae1dSRodney W. Grimes 
1187df8bae1dSRodney W. Grimes 	dst = ip->ip_dst;
1188df8bae1dSRodney W. Grimes 	cp = (u_char *)(ip + 1);
118958938916SGarrett Wollman 	cnt = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof (struct ip);
1190df8bae1dSRodney W. Grimes 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
1191df8bae1dSRodney W. Grimes 		opt = cp[IPOPT_OPTVAL];
1192df8bae1dSRodney W. Grimes 		if (opt == IPOPT_EOL)
1193df8bae1dSRodney W. Grimes 			break;
1194df8bae1dSRodney W. Grimes 		if (opt == IPOPT_NOP)
1195df8bae1dSRodney W. Grimes 			optlen = 1;
1196df8bae1dSRodney W. Grimes 		else {
1197fdcb8debSJun-ichiro itojun Hagino 			if (cnt < IPOPT_OLEN + sizeof(*cp)) {
1198fdcb8debSJun-ichiro itojun Hagino 				code = &cp[IPOPT_OLEN] - (u_char *)ip;
1199fdcb8debSJun-ichiro itojun Hagino 				goto bad;
1200fdcb8debSJun-ichiro itojun Hagino 			}
1201df8bae1dSRodney W. Grimes 			optlen = cp[IPOPT_OLEN];
1202707d00a3SJonathan Lemon 			if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) {
1203df8bae1dSRodney W. Grimes 				code = &cp[IPOPT_OLEN] - (u_char *)ip;
1204df8bae1dSRodney W. Grimes 				goto bad;
1205df8bae1dSRodney W. Grimes 			}
1206df8bae1dSRodney W. Grimes 		}
1207df8bae1dSRodney W. Grimes 		switch (opt) {
1208df8bae1dSRodney W. Grimes 
1209df8bae1dSRodney W. Grimes 		default:
1210df8bae1dSRodney W. Grimes 			break;
1211df8bae1dSRodney W. Grimes 
1212df8bae1dSRodney W. Grimes 		/*
1213df8bae1dSRodney W. Grimes 		 * Source routing with record.
1214df8bae1dSRodney W. Grimes 		 * Find interface with current destination address.
1215df8bae1dSRodney W. Grimes 		 * If none on this machine then drop if strictly routed,
1216df8bae1dSRodney W. Grimes 		 * or do nothing if loosely routed.
1217df8bae1dSRodney W. Grimes 		 * Record interface address and bring up next address
1218df8bae1dSRodney W. Grimes 		 * component.  If strictly routed make sure next
1219df8bae1dSRodney W. Grimes 		 * address is on directly accessible net.
1220df8bae1dSRodney W. Grimes 		 */
1221df8bae1dSRodney W. Grimes 		case IPOPT_LSRR:
1222df8bae1dSRodney W. Grimes 		case IPOPT_SSRR:
1223d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH
1224d0ebc0d2SYaroslav Tykhiy 			if (ipstealth && pass > 0)
1225d0ebc0d2SYaroslav Tykhiy 				break;
1226d0ebc0d2SYaroslav Tykhiy #endif
122733841545SHajimu UMEMOTO 			if (optlen < IPOPT_OFFSET + sizeof(*cp)) {
122833841545SHajimu UMEMOTO 				code = &cp[IPOPT_OLEN] - (u_char *)ip;
122933841545SHajimu UMEMOTO 				goto bad;
123033841545SHajimu UMEMOTO 			}
1231df8bae1dSRodney W. Grimes 			if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {
1232df8bae1dSRodney W. Grimes 				code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1233df8bae1dSRodney W. Grimes 				goto bad;
1234df8bae1dSRodney W. Grimes 			}
1235df8bae1dSRodney W. Grimes 			ipaddr.sin_addr = ip->ip_dst;
1236df8bae1dSRodney W. Grimes 			ia = (struct in_ifaddr *)
1237df8bae1dSRodney W. Grimes 				ifa_ifwithaddr((struct sockaddr *)&ipaddr);
1238df8bae1dSRodney W. Grimes 			if (ia == 0) {
1239df8bae1dSRodney W. Grimes 				if (opt == IPOPT_SSRR) {
1240df8bae1dSRodney W. Grimes 					type = ICMP_UNREACH;
1241df8bae1dSRodney W. Grimes 					code = ICMP_UNREACH_SRCFAIL;
1242df8bae1dSRodney W. Grimes 					goto bad;
1243df8bae1dSRodney W. Grimes 				}
1244bc189bf8SGuido van Rooij 				if (!ip_dosourceroute)
1245bc189bf8SGuido van Rooij 					goto nosourcerouting;
1246df8bae1dSRodney W. Grimes 				/*
1247df8bae1dSRodney W. Grimes 				 * Loose routing, and not at next destination
1248df8bae1dSRodney W. Grimes 				 * yet; nothing to do except forward.
1249df8bae1dSRodney W. Grimes 				 */
1250df8bae1dSRodney W. Grimes 				break;
1251df8bae1dSRodney W. Grimes 			}
1252df8bae1dSRodney W. Grimes 			off--;			/* 0 origin */
12535d5d5fc0SJonathan Lemon 			if (off > optlen - (int)sizeof(struct in_addr)) {
1254df8bae1dSRodney W. Grimes 				/*
1255df8bae1dSRodney W. Grimes 				 * End of source route.  Should be for us.
1256df8bae1dSRodney W. Grimes 				 */
12574fce5804SGuido van Rooij 				if (!ip_acceptsourceroute)
12584fce5804SGuido van Rooij 					goto nosourcerouting;
1259df8bae1dSRodney W. Grimes 				save_rte(cp, ip->ip_src);
1260df8bae1dSRodney W. Grimes 				break;
1261df8bae1dSRodney W. Grimes 			}
1262d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH
1263d0ebc0d2SYaroslav Tykhiy 			if (ipstealth)
1264d0ebc0d2SYaroslav Tykhiy 				goto dropit;
1265d0ebc0d2SYaroslav Tykhiy #endif
12661025071fSGarrett Wollman 			if (!ip_dosourceroute) {
12670af8d3ecSDavid Greenman 				if (ipforwarding) {
12680af8d3ecSDavid Greenman 					char buf[16]; /* aaa.bbb.ccc.ddd\0 */
12690af8d3ecSDavid Greenman 					/*
12700af8d3ecSDavid Greenman 					 * Acting as a router, so generate ICMP
12710af8d3ecSDavid Greenman 					 */
1272efa48587SGuido van Rooij nosourcerouting:
1273bc189bf8SGuido van Rooij 					strcpy(buf, inet_ntoa(ip->ip_dst));
12741025071fSGarrett Wollman 					log(LOG_WARNING,
12751025071fSGarrett Wollman 					    "attempted source route from %s to %s\n",
12761025071fSGarrett Wollman 					    inet_ntoa(ip->ip_src), buf);
12771025071fSGarrett Wollman 					type = ICMP_UNREACH;
12781025071fSGarrett Wollman 					code = ICMP_UNREACH_SRCFAIL;
12791025071fSGarrett Wollman 					goto bad;
12800af8d3ecSDavid Greenman 				} else {
12810af8d3ecSDavid Greenman 					/*
12820af8d3ecSDavid Greenman 					 * Not acting as a router, so silently drop.
12830af8d3ecSDavid Greenman 					 */
1284d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH
1285d0ebc0d2SYaroslav Tykhiy dropit:
1286d0ebc0d2SYaroslav Tykhiy #endif
12870af8d3ecSDavid Greenman 					ipstat.ips_cantforward++;
12880af8d3ecSDavid Greenman 					m_freem(m);
12890af8d3ecSDavid Greenman 					return (1);
12900af8d3ecSDavid Greenman 				}
12911025071fSGarrett Wollman 			}
12921025071fSGarrett Wollman 
1293df8bae1dSRodney W. Grimes 			/*
1294df8bae1dSRodney W. Grimes 			 * locate outgoing interface
1295df8bae1dSRodney W. Grimes 			 */
129694a5d9b6SDavid Greenman 			(void)memcpy(&ipaddr.sin_addr, cp + off,
1297df8bae1dSRodney W. Grimes 			    sizeof(ipaddr.sin_addr));
12981025071fSGarrett Wollman 
1299df8bae1dSRodney W. Grimes 			if (opt == IPOPT_SSRR) {
1300df8bae1dSRodney W. Grimes #define	INA	struct in_ifaddr *
1301df8bae1dSRodney W. Grimes #define	SA	struct sockaddr *
1302df8bae1dSRodney W. Grimes 			    if ((ia = (INA)ifa_ifwithdstaddr((SA)&ipaddr)) == 0)
1303df8bae1dSRodney W. Grimes 				ia = (INA)ifa_ifwithnet((SA)&ipaddr);
1304df8bae1dSRodney W. Grimes 			} else
1305bd714208SRuslan Ermilov 				ia = ip_rtaddr(ipaddr.sin_addr, &ipforward_rt);
1306df8bae1dSRodney W. Grimes 			if (ia == 0) {
1307df8bae1dSRodney W. Grimes 				type = ICMP_UNREACH;
1308df8bae1dSRodney W. Grimes 				code = ICMP_UNREACH_SRCFAIL;
1309df8bae1dSRodney W. Grimes 				goto bad;
1310df8bae1dSRodney W. Grimes 			}
1311df8bae1dSRodney W. Grimes 			ip->ip_dst = ipaddr.sin_addr;
131294a5d9b6SDavid Greenman 			(void)memcpy(cp + off, &(IA_SIN(ia)->sin_addr),
131394a5d9b6SDavid Greenman 			    sizeof(struct in_addr));
1314df8bae1dSRodney W. Grimes 			cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1315df8bae1dSRodney W. Grimes 			/*
1316df8bae1dSRodney W. Grimes 			 * Let ip_intr's mcast routing check handle mcast pkts
1317df8bae1dSRodney W. Grimes 			 */
1318df8bae1dSRodney W. Grimes 			forward = !IN_MULTICAST(ntohl(ip->ip_dst.s_addr));
1319df8bae1dSRodney W. Grimes 			break;
1320df8bae1dSRodney W. Grimes 
1321df8bae1dSRodney W. Grimes 		case IPOPT_RR:
1322d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH
1323d0ebc0d2SYaroslav Tykhiy 			if (ipstealth && pass == 0)
1324d0ebc0d2SYaroslav Tykhiy 				break;
1325d0ebc0d2SYaroslav Tykhiy #endif
1326707d00a3SJonathan Lemon 			if (optlen < IPOPT_OFFSET + sizeof(*cp)) {
1327707d00a3SJonathan Lemon 				code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1328707d00a3SJonathan Lemon 				goto bad;
1329707d00a3SJonathan Lemon 			}
1330df8bae1dSRodney W. Grimes 			if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {
1331df8bae1dSRodney W. Grimes 				code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1332df8bae1dSRodney W. Grimes 				goto bad;
1333df8bae1dSRodney W. Grimes 			}
1334df8bae1dSRodney W. Grimes 			/*
1335df8bae1dSRodney W. Grimes 			 * If no space remains, ignore.
1336df8bae1dSRodney W. Grimes 			 */
1337df8bae1dSRodney W. Grimes 			off--;			/* 0 origin */
13385d5d5fc0SJonathan Lemon 			if (off > optlen - (int)sizeof(struct in_addr))
1339df8bae1dSRodney W. Grimes 				break;
134094a5d9b6SDavid Greenman 			(void)memcpy(&ipaddr.sin_addr, &ip->ip_dst,
1341df8bae1dSRodney W. Grimes 			    sizeof(ipaddr.sin_addr));
1342df8bae1dSRodney W. Grimes 			/*
1343df8bae1dSRodney W. Grimes 			 * locate outgoing interface; if we're the destination,
1344df8bae1dSRodney W. Grimes 			 * use the incoming interface (should be same).
1345df8bae1dSRodney W. Grimes 			 */
1346df8bae1dSRodney W. Grimes 			if ((ia = (INA)ifa_ifwithaddr((SA)&ipaddr)) == 0 &&
1347bd714208SRuslan Ermilov 			    (ia = ip_rtaddr(ipaddr.sin_addr,
1348bd714208SRuslan Ermilov 			    &ipforward_rt)) == 0) {
1349df8bae1dSRodney W. Grimes 				type = ICMP_UNREACH;
1350df8bae1dSRodney W. Grimes 				code = ICMP_UNREACH_HOST;
1351df8bae1dSRodney W. Grimes 				goto bad;
1352df8bae1dSRodney W. Grimes 			}
135394a5d9b6SDavid Greenman 			(void)memcpy(cp + off, &(IA_SIN(ia)->sin_addr),
135494a5d9b6SDavid Greenman 			    sizeof(struct in_addr));
1355df8bae1dSRodney W. Grimes 			cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1356df8bae1dSRodney W. Grimes 			break;
1357df8bae1dSRodney W. Grimes 
1358df8bae1dSRodney W. Grimes 		case IPOPT_TS:
1359d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH
1360d0ebc0d2SYaroslav Tykhiy 			if (ipstealth && pass == 0)
1361d0ebc0d2SYaroslav Tykhiy 				break;
1362d0ebc0d2SYaroslav Tykhiy #endif
1363df8bae1dSRodney W. Grimes 			code = cp - (u_char *)ip;
136407514071SJonathan Lemon 			if (optlen < 4 || optlen > 40) {
136507514071SJonathan Lemon 				code = &cp[IPOPT_OLEN] - (u_char *)ip;
1366df8bae1dSRodney W. Grimes 				goto bad;
136733841545SHajimu UMEMOTO 			}
136807514071SJonathan Lemon 			if ((off = cp[IPOPT_OFFSET]) < 5) {
136907514071SJonathan Lemon 				code = &cp[IPOPT_OLEN] - (u_char *)ip;
137033841545SHajimu UMEMOTO 				goto bad;
137133841545SHajimu UMEMOTO 			}
137207514071SJonathan Lemon 			if (off > optlen - (int)sizeof(int32_t)) {
137307514071SJonathan Lemon 				cp[IPOPT_OFFSET + 1] += (1 << 4);
137407514071SJonathan Lemon 				if ((cp[IPOPT_OFFSET + 1] & 0xf0) == 0) {
137507514071SJonathan Lemon 					code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1376df8bae1dSRodney W. Grimes 					goto bad;
137733841545SHajimu UMEMOTO 				}
1378df8bae1dSRodney W. Grimes 				break;
1379df8bae1dSRodney W. Grimes 			}
138007514071SJonathan Lemon 			off--;				/* 0 origin */
138107514071SJonathan Lemon 			sin = (struct in_addr *)(cp + off);
138207514071SJonathan Lemon 			switch (cp[IPOPT_OFFSET + 1] & 0x0f) {
1383df8bae1dSRodney W. Grimes 
1384df8bae1dSRodney W. Grimes 			case IPOPT_TS_TSONLY:
1385df8bae1dSRodney W. Grimes 				break;
1386df8bae1dSRodney W. Grimes 
1387df8bae1dSRodney W. Grimes 			case IPOPT_TS_TSANDADDR:
138807514071SJonathan Lemon 				if (off + sizeof(n_time) +
138907514071SJonathan Lemon 				    sizeof(struct in_addr) > optlen) {
139007514071SJonathan Lemon 					code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1391df8bae1dSRodney W. Grimes 					goto bad;
139233841545SHajimu UMEMOTO 				}
1393df8bae1dSRodney W. Grimes 				ipaddr.sin_addr = dst;
1394df8bae1dSRodney W. Grimes 				ia = (INA)ifaof_ifpforaddr((SA)&ipaddr,
1395df8bae1dSRodney W. Grimes 							    m->m_pkthdr.rcvif);
1396df8bae1dSRodney W. Grimes 				if (ia == 0)
1397df8bae1dSRodney W. Grimes 					continue;
139894a5d9b6SDavid Greenman 				(void)memcpy(sin, &IA_SIN(ia)->sin_addr,
139994a5d9b6SDavid Greenman 				    sizeof(struct in_addr));
140007514071SJonathan Lemon 				cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1401df8bae1dSRodney W. Grimes 				break;
1402df8bae1dSRodney W. Grimes 
1403df8bae1dSRodney W. Grimes 			case IPOPT_TS_PRESPEC:
140407514071SJonathan Lemon 				if (off + sizeof(n_time) +
140507514071SJonathan Lemon 				    sizeof(struct in_addr) > optlen) {
140607514071SJonathan Lemon 					code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1407df8bae1dSRodney W. Grimes 					goto bad;
140833841545SHajimu UMEMOTO 				}
140994a5d9b6SDavid Greenman 				(void)memcpy(&ipaddr.sin_addr, sin,
1410df8bae1dSRodney W. Grimes 				    sizeof(struct in_addr));
1411df8bae1dSRodney W. Grimes 				if (ifa_ifwithaddr((SA)&ipaddr) == 0)
1412df8bae1dSRodney W. Grimes 					continue;
141307514071SJonathan Lemon 				cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1414df8bae1dSRodney W. Grimes 				break;
1415df8bae1dSRodney W. Grimes 
1416df8bae1dSRodney W. Grimes 			default:
141707514071SJonathan Lemon 				code = &cp[IPOPT_OFFSET + 1] - (u_char *)ip;
1418df8bae1dSRodney W. Grimes 				goto bad;
1419df8bae1dSRodney W. Grimes 			}
1420df8bae1dSRodney W. Grimes 			ntime = iptime();
142107514071SJonathan Lemon 			(void)memcpy(cp + off, &ntime, sizeof(n_time));
142207514071SJonathan Lemon 			cp[IPOPT_OFFSET] += sizeof(n_time);
1423df8bae1dSRodney W. Grimes 		}
1424df8bae1dSRodney W. Grimes 	}
142547174b49SAndrey A. Chernov 	if (forward && ipforwarding) {
1426df8bae1dSRodney W. Grimes 		ip_forward(m, 1);
1427df8bae1dSRodney W. Grimes 		return (1);
1428df8bae1dSRodney W. Grimes 	}
1429df8bae1dSRodney W. Grimes 	return (0);
1430df8bae1dSRodney W. Grimes bad:
1431df8bae1dSRodney W. Grimes 	icmp_error(m, type, code, 0, 0);
1432df8bae1dSRodney W. Grimes 	ipstat.ips_badoptions++;
1433df8bae1dSRodney W. Grimes 	return (1);
1434df8bae1dSRodney W. Grimes }
1435df8bae1dSRodney W. Grimes 
1436df8bae1dSRodney W. Grimes /*
1437df8bae1dSRodney W. Grimes  * Given address of next destination (final or next hop),
1438df8bae1dSRodney W. Grimes  * return internet address info of interface to be used to get there.
1439df8bae1dSRodney W. Grimes  */
1440bd714208SRuslan Ermilov struct in_ifaddr *
1441bd714208SRuslan Ermilov ip_rtaddr(dst, rt)
1442df8bae1dSRodney W. Grimes 	struct in_addr dst;
1443bd714208SRuslan Ermilov 	struct route *rt;
1444df8bae1dSRodney W. Grimes {
1445df8bae1dSRodney W. Grimes 	register struct sockaddr_in *sin;
1446df8bae1dSRodney W. Grimes 
1447bd714208SRuslan Ermilov 	sin = (struct sockaddr_in *)&rt->ro_dst;
1448df8bae1dSRodney W. Grimes 
1449bd714208SRuslan Ermilov 	if (rt->ro_rt == 0 ||
1450bd714208SRuslan Ermilov 	    !(rt->ro_rt->rt_flags & RTF_UP) ||
14514078ffb1SRuslan Ermilov 	    dst.s_addr != sin->sin_addr.s_addr) {
1452bd714208SRuslan Ermilov 		if (rt->ro_rt) {
1453bd714208SRuslan Ermilov 			RTFREE(rt->ro_rt);
1454bd714208SRuslan Ermilov 			rt->ro_rt = 0;
1455df8bae1dSRodney W. Grimes 		}
1456df8bae1dSRodney W. Grimes 		sin->sin_family = AF_INET;
1457df8bae1dSRodney W. Grimes 		sin->sin_len = sizeof(*sin);
1458df8bae1dSRodney W. Grimes 		sin->sin_addr = dst;
1459df8bae1dSRodney W. Grimes 
1460bd714208SRuslan Ermilov 		rtalloc_ign(rt, RTF_PRCLONING);
1461df8bae1dSRodney W. Grimes 	}
1462bd714208SRuslan Ermilov 	if (rt->ro_rt == 0)
1463df8bae1dSRodney W. Grimes 		return ((struct in_ifaddr *)0);
1464bd714208SRuslan Ermilov 	return (ifatoia(rt->ro_rt->rt_ifa));
1465df8bae1dSRodney W. Grimes }
1466df8bae1dSRodney W. Grimes 
1467df8bae1dSRodney W. Grimes /*
1468df8bae1dSRodney W. Grimes  * Save incoming source route for use in replies,
1469df8bae1dSRodney W. Grimes  * to be picked up later by ip_srcroute if the receiver is interested.
1470df8bae1dSRodney W. Grimes  */
1471df8bae1dSRodney W. Grimes void
1472df8bae1dSRodney W. Grimes save_rte(option, dst)
1473df8bae1dSRodney W. Grimes 	u_char *option;
1474df8bae1dSRodney W. Grimes 	struct in_addr dst;
1475df8bae1dSRodney W. Grimes {
1476df8bae1dSRodney W. Grimes 	unsigned olen;
1477df8bae1dSRodney W. Grimes 
1478df8bae1dSRodney W. Grimes 	olen = option[IPOPT_OLEN];
1479df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC
1480df8bae1dSRodney W. Grimes 	if (ipprintfs)
1481df8bae1dSRodney W. Grimes 		printf("save_rte: olen %d\n", olen);
1482df8bae1dSRodney W. Grimes #endif
1483df8bae1dSRodney W. Grimes 	if (olen > sizeof(ip_srcrt) - (1 + sizeof(dst)))
1484df8bae1dSRodney W. Grimes 		return;
14850453d3cbSBruce Evans 	bcopy(option, ip_srcrt.srcopt, olen);
1486df8bae1dSRodney W. Grimes 	ip_nhops = (olen - IPOPT_OFFSET - 1) / sizeof(struct in_addr);
1487df8bae1dSRodney W. Grimes 	ip_srcrt.dst = dst;
1488df8bae1dSRodney W. Grimes }
1489df8bae1dSRodney W. Grimes 
1490df8bae1dSRodney W. Grimes /*
1491df8bae1dSRodney W. Grimes  * Retrieve incoming source route for use in replies,
1492df8bae1dSRodney W. Grimes  * in the same form used by setsockopt.
1493df8bae1dSRodney W. Grimes  * The first hop is placed before the options, will be removed later.
1494df8bae1dSRodney W. Grimes  */
1495df8bae1dSRodney W. Grimes struct mbuf *
1496df8bae1dSRodney W. Grimes ip_srcroute()
1497df8bae1dSRodney W. Grimes {
1498df8bae1dSRodney W. Grimes 	register struct in_addr *p, *q;
1499df8bae1dSRodney W. Grimes 	register struct mbuf *m;
1500df8bae1dSRodney W. Grimes 
1501df8bae1dSRodney W. Grimes 	if (ip_nhops == 0)
1502df8bae1dSRodney W. Grimes 		return ((struct mbuf *)0);
1503cfe8b629SGarrett Wollman 	m = m_get(M_DONTWAIT, MT_HEADER);
1504df8bae1dSRodney W. Grimes 	if (m == 0)
1505df8bae1dSRodney W. Grimes 		return ((struct mbuf *)0);
1506df8bae1dSRodney W. Grimes 
1507df8bae1dSRodney W. Grimes #define OPTSIZ	(sizeof(ip_srcrt.nop) + sizeof(ip_srcrt.srcopt))
1508df8bae1dSRodney W. Grimes 
1509df8bae1dSRodney W. Grimes 	/* length is (nhops+1)*sizeof(addr) + sizeof(nop + srcrt header) */
1510df8bae1dSRodney W. Grimes 	m->m_len = ip_nhops * sizeof(struct in_addr) + sizeof(struct in_addr) +
1511df8bae1dSRodney W. Grimes 	    OPTSIZ;
1512df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC
1513df8bae1dSRodney W. Grimes 	if (ipprintfs)
1514df8bae1dSRodney W. Grimes 		printf("ip_srcroute: nhops %d mlen %d", ip_nhops, m->m_len);
1515df8bae1dSRodney W. Grimes #endif
1516df8bae1dSRodney W. Grimes 
1517df8bae1dSRodney W. Grimes 	/*
1518df8bae1dSRodney W. Grimes 	 * First save first hop for return route
1519df8bae1dSRodney W. Grimes 	 */
1520df8bae1dSRodney W. Grimes 	p = &ip_srcrt.route[ip_nhops - 1];
1521df8bae1dSRodney W. Grimes 	*(mtod(m, struct in_addr *)) = *p--;
1522df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC
1523df8bae1dSRodney W. Grimes 	if (ipprintfs)
1524af38c68cSLuigi Rizzo 		printf(" hops %lx", (u_long)ntohl(mtod(m, struct in_addr *)->s_addr));
1525df8bae1dSRodney W. Grimes #endif
1526df8bae1dSRodney W. Grimes 
1527df8bae1dSRodney W. Grimes 	/*
1528df8bae1dSRodney W. Grimes 	 * Copy option fields and padding (nop) to mbuf.
1529df8bae1dSRodney W. Grimes 	 */
1530df8bae1dSRodney W. Grimes 	ip_srcrt.nop = IPOPT_NOP;
1531df8bae1dSRodney W. Grimes 	ip_srcrt.srcopt[IPOPT_OFFSET] = IPOPT_MINOFF;
153294a5d9b6SDavid Greenman 	(void)memcpy(mtod(m, caddr_t) + sizeof(struct in_addr),
153394a5d9b6SDavid Greenman 	    &ip_srcrt.nop, OPTSIZ);
1534df8bae1dSRodney W. Grimes 	q = (struct in_addr *)(mtod(m, caddr_t) +
1535df8bae1dSRodney W. Grimes 	    sizeof(struct in_addr) + OPTSIZ);
1536df8bae1dSRodney W. Grimes #undef OPTSIZ
1537df8bae1dSRodney W. Grimes 	/*
1538df8bae1dSRodney W. Grimes 	 * Record return path as an IP source route,
1539df8bae1dSRodney W. Grimes 	 * reversing the path (pointers are now aligned).
1540df8bae1dSRodney W. Grimes 	 */
1541df8bae1dSRodney W. Grimes 	while (p >= ip_srcrt.route) {
1542df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC
1543df8bae1dSRodney W. Grimes 		if (ipprintfs)
1544af38c68cSLuigi Rizzo 			printf(" %lx", (u_long)ntohl(q->s_addr));
1545df8bae1dSRodney W. Grimes #endif
1546df8bae1dSRodney W. Grimes 		*q++ = *p--;
1547df8bae1dSRodney W. Grimes 	}
1548df8bae1dSRodney W. Grimes 	/*
1549df8bae1dSRodney W. Grimes 	 * Last hop goes to final destination.
1550df8bae1dSRodney W. Grimes 	 */
1551df8bae1dSRodney W. Grimes 	*q = ip_srcrt.dst;
1552df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC
1553df8bae1dSRodney W. Grimes 	if (ipprintfs)
1554af38c68cSLuigi Rizzo 		printf(" %lx\n", (u_long)ntohl(q->s_addr));
1555df8bae1dSRodney W. Grimes #endif
1556df8bae1dSRodney W. Grimes 	return (m);
1557df8bae1dSRodney W. Grimes }
1558df8bae1dSRodney W. Grimes 
1559df8bae1dSRodney W. Grimes /*
1560df8bae1dSRodney W. Grimes  * Strip out IP options, at higher
1561df8bae1dSRodney W. Grimes  * level protocol in the kernel.
1562df8bae1dSRodney W. Grimes  * Second argument is buffer to which options
1563df8bae1dSRodney W. Grimes  * will be moved, and return value is their length.
1564df8bae1dSRodney W. Grimes  * XXX should be deleted; last arg currently ignored.
1565df8bae1dSRodney W. Grimes  */
1566df8bae1dSRodney W. Grimes void
1567df8bae1dSRodney W. Grimes ip_stripoptions(m, mopt)
1568df8bae1dSRodney W. Grimes 	register struct mbuf *m;
1569df8bae1dSRodney W. Grimes 	struct mbuf *mopt;
1570df8bae1dSRodney W. Grimes {
1571df8bae1dSRodney W. Grimes 	register int i;
1572df8bae1dSRodney W. Grimes 	struct ip *ip = mtod(m, struct ip *);
1573df8bae1dSRodney W. Grimes 	register caddr_t opts;
1574df8bae1dSRodney W. Grimes 	int olen;
1575df8bae1dSRodney W. Grimes 
157658938916SGarrett Wollman 	olen = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof (struct ip);
1577df8bae1dSRodney W. Grimes 	opts = (caddr_t)(ip + 1);
1578df8bae1dSRodney W. Grimes 	i = m->m_len - (sizeof (struct ip) + olen);
1579df8bae1dSRodney W. Grimes 	bcopy(opts + olen, opts, (unsigned)i);
1580df8bae1dSRodney W. Grimes 	m->m_len -= olen;
1581df8bae1dSRodney W. Grimes 	if (m->m_flags & M_PKTHDR)
1582df8bae1dSRodney W. Grimes 		m->m_pkthdr.len -= olen;
158358938916SGarrett Wollman 	ip->ip_vhl = IP_MAKE_VHL(IPVERSION, sizeof(struct ip) >> 2);
1584df8bae1dSRodney W. Grimes }
1585df8bae1dSRodney W. Grimes 
1586df8bae1dSRodney W. Grimes u_char inetctlerrmap[PRC_NCMDS] = {
1587df8bae1dSRodney W. Grimes 	0,		0,		0,		0,
1588df8bae1dSRodney W. Grimes 	0,		EMSGSIZE,	EHOSTDOWN,	EHOSTUNREACH,
1589df8bae1dSRodney W. Grimes 	EHOSTUNREACH,	EHOSTUNREACH,	ECONNREFUSED,	ECONNREFUSED,
1590df8bae1dSRodney W. Grimes 	EMSGSIZE,	EHOSTUNREACH,	0,		0,
1591df8bae1dSRodney W. Grimes 	0,		0,		0,		0,
15923b8123b7SJesper Skriver 	ENOPROTOOPT,	ECONNREFUSED
1593df8bae1dSRodney W. Grimes };
1594df8bae1dSRodney W. Grimes 
1595df8bae1dSRodney W. Grimes /*
1596df8bae1dSRodney W. Grimes  * Forward a packet.  If some error occurs return the sender
1597df8bae1dSRodney W. Grimes  * an icmp packet.  Note we can't always generate a meaningful
1598df8bae1dSRodney W. Grimes  * icmp message because icmp doesn't have a large enough repertoire
1599df8bae1dSRodney W. Grimes  * of codes and types.
1600df8bae1dSRodney W. Grimes  *
1601df8bae1dSRodney W. Grimes  * If not forwarding, just drop the packet.  This could be confusing
1602df8bae1dSRodney W. Grimes  * if ipforwarding was zero but some routing protocol was advancing
1603df8bae1dSRodney W. Grimes  * us as a gateway to somewhere.  However, we must let the routing
1604df8bae1dSRodney W. Grimes  * protocol deal with that.
1605df8bae1dSRodney W. Grimes  *
1606df8bae1dSRodney W. Grimes  * The srcrt parameter indicates whether the packet is being forwarded
1607df8bae1dSRodney W. Grimes  * via a source route.
1608df8bae1dSRodney W. Grimes  */
16090312fbe9SPoul-Henning Kamp static void
1610df8bae1dSRodney W. Grimes ip_forward(m, srcrt)
1611df8bae1dSRodney W. Grimes 	struct mbuf *m;
1612df8bae1dSRodney W. Grimes 	int srcrt;
1613df8bae1dSRodney W. Grimes {
1614df8bae1dSRodney W. Grimes 	register struct ip *ip = mtod(m, struct ip *);
1615df8bae1dSRodney W. Grimes 	register struct rtentry *rt;
161626f9a767SRodney W. Grimes 	int error, type = 0, code = 0;
1617df8bae1dSRodney W. Grimes 	struct mbuf *mcopy;
1618df8bae1dSRodney W. Grimes 	n_long dest;
16193efc3014SJulian Elischer 	struct in_addr pkt_dst;
1620df8bae1dSRodney W. Grimes 	struct ifnet *destifp;
16216a800098SYoshinobu Inoue #ifdef IPSEC
16226a800098SYoshinobu Inoue 	struct ifnet dummyifp;
16236a800098SYoshinobu Inoue #endif
1624df8bae1dSRodney W. Grimes 
1625df8bae1dSRodney W. Grimes 	dest = 0;
16263efc3014SJulian Elischer 	/*
16273efc3014SJulian Elischer 	 * Cache the destination address of the packet; this may be
16283efc3014SJulian Elischer 	 * changed by use of 'ipfw fwd'.
16293efc3014SJulian Elischer 	 */
16303efc3014SJulian Elischer 	pkt_dst = ip_fw_fwd_addr == NULL ?
16313efc3014SJulian Elischer 	    ip->ip_dst : ip_fw_fwd_addr->sin_addr;
16323efc3014SJulian Elischer 
1633df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC
1634df8bae1dSRodney W. Grimes 	if (ipprintfs)
163561ce519bSPoul-Henning Kamp 		printf("forward: src %lx dst %lx ttl %x\n",
16363efc3014SJulian Elischer 		    (u_long)ip->ip_src.s_addr, (u_long)pkt_dst.s_addr,
1637162886e2SBruce Evans 		    ip->ip_ttl);
1638df8bae1dSRodney W. Grimes #endif
1639100ba1a6SJordan K. Hubbard 
1640100ba1a6SJordan K. Hubbard 
16413efc3014SJulian Elischer 	if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(pkt_dst) == 0) {
1642df8bae1dSRodney W. Grimes 		ipstat.ips_cantforward++;
1643df8bae1dSRodney W. Grimes 		m_freem(m);
1644df8bae1dSRodney W. Grimes 		return;
1645df8bae1dSRodney W. Grimes 	}
16461b968362SDag-Erling Smørgrav #ifdef IPSTEALTH
16471b968362SDag-Erling Smørgrav 	if (!ipstealth) {
16481b968362SDag-Erling Smørgrav #endif
1649df8bae1dSRodney W. Grimes 		if (ip->ip_ttl <= IPTTLDEC) {
16501b968362SDag-Erling Smørgrav 			icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS,
16511b968362SDag-Erling Smørgrav 			    dest, 0);
1652df8bae1dSRodney W. Grimes 			return;
1653df8bae1dSRodney W. Grimes 		}
16541b968362SDag-Erling Smørgrav #ifdef IPSTEALTH
16551b968362SDag-Erling Smørgrav 	}
16561b968362SDag-Erling Smørgrav #endif
1657df8bae1dSRodney W. Grimes 
16583efc3014SJulian Elischer 	if (ip_rtaddr(pkt_dst, &ipforward_rt) == 0) {
1659df8bae1dSRodney W. Grimes 		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, dest, 0);
1660df8bae1dSRodney W. Grimes 		return;
16614078ffb1SRuslan Ermilov 	} else
1662df8bae1dSRodney W. Grimes 		rt = ipforward_rt.ro_rt;
1663df8bae1dSRodney W. Grimes 
1664df8bae1dSRodney W. Grimes 	/*
1665bfef7ed4SIan Dowse 	 * Save the IP header and at most 8 bytes of the payload,
1666bfef7ed4SIan Dowse 	 * in case we need to generate an ICMP message to the src.
1667bfef7ed4SIan Dowse 	 *
1668bfef7ed4SIan Dowse 	 * We don't use m_copy() because it might return a reference
1669bfef7ed4SIan Dowse 	 * to a shared cluster. Both this function and ip_output()
1670bfef7ed4SIan Dowse 	 * assume exclusive access to the IP header in `m', so any
1671bfef7ed4SIan Dowse 	 * data in a cluster may change before we reach icmp_error().
1672df8bae1dSRodney W. Grimes 	 */
1673bfef7ed4SIan Dowse 	MGET(mcopy, M_DONTWAIT, m->m_type);
1674bfef7ed4SIan Dowse 	if (mcopy != NULL) {
1675bfef7ed4SIan Dowse 		M_COPY_PKTHDR(mcopy, m);
1676bfef7ed4SIan Dowse 		mcopy->m_len = imin((IP_VHL_HL(ip->ip_vhl) << 2) + 8,
1677bfef7ed4SIan Dowse 		    (int)ip->ip_len);
1678bfef7ed4SIan Dowse 		m_copydata(m, 0, mcopy->m_len, mtod(mcopy, caddr_t));
1679bfef7ed4SIan Dowse 	}
168004287599SRuslan Ermilov 
168104287599SRuslan Ermilov #ifdef IPSTEALTH
168204287599SRuslan Ermilov 	if (!ipstealth) {
168304287599SRuslan Ermilov #endif
168404287599SRuslan Ermilov 		ip->ip_ttl -= IPTTLDEC;
168504287599SRuslan Ermilov #ifdef IPSTEALTH
168604287599SRuslan Ermilov 	}
168704287599SRuslan Ermilov #endif
1688df8bae1dSRodney W. Grimes 
1689df8bae1dSRodney W. Grimes 	/*
1690df8bae1dSRodney W. Grimes 	 * If forwarding packet using same interface that it came in on,
1691df8bae1dSRodney W. Grimes 	 * perhaps should send a redirect to sender to shortcut a hop.
1692df8bae1dSRodney W. Grimes 	 * Only send redirect if source is sending directly to us,
1693df8bae1dSRodney W. Grimes 	 * and if packet was not source routed (or has any options).
1694df8bae1dSRodney W. Grimes 	 * Also, don't send redirect if forwarding using a default route
1695df8bae1dSRodney W. Grimes 	 * or a route modified by a redirect.
1696df8bae1dSRodney W. Grimes 	 */
1697df8bae1dSRodney W. Grimes 	if (rt->rt_ifp == m->m_pkthdr.rcvif &&
1698df8bae1dSRodney W. Grimes 	    (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0 &&
1699df8bae1dSRodney W. Grimes 	    satosin(rt_key(rt))->sin_addr.s_addr != 0 &&
17003efc3014SJulian Elischer 	    ipsendredirects && !srcrt && !ip_fw_fwd_addr) {
1701df8bae1dSRodney W. Grimes #define	RTA(rt)	((struct in_ifaddr *)(rt->rt_ifa))
1702df8bae1dSRodney W. Grimes 		u_long src = ntohl(ip->ip_src.s_addr);
1703df8bae1dSRodney W. Grimes 
1704df8bae1dSRodney W. Grimes 		if (RTA(rt) &&
1705df8bae1dSRodney W. Grimes 		    (src & RTA(rt)->ia_subnetmask) == RTA(rt)->ia_subnet) {
1706df8bae1dSRodney W. Grimes 		    if (rt->rt_flags & RTF_GATEWAY)
1707df8bae1dSRodney W. Grimes 			dest = satosin(rt->rt_gateway)->sin_addr.s_addr;
1708df8bae1dSRodney W. Grimes 		    else
17093efc3014SJulian Elischer 			dest = pkt_dst.s_addr;
1710df8bae1dSRodney W. Grimes 		    /* Router requirements says to only send host redirects */
1711df8bae1dSRodney W. Grimes 		    type = ICMP_REDIRECT;
1712df8bae1dSRodney W. Grimes 		    code = ICMP_REDIRECT_HOST;
1713df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC
1714df8bae1dSRodney W. Grimes 		    if (ipprintfs)
1715df8bae1dSRodney W. Grimes 		        printf("redirect (%d) to %lx\n", code, (u_long)dest);
1716df8bae1dSRodney W. Grimes #endif
1717df8bae1dSRodney W. Grimes 		}
1718df8bae1dSRodney W. Grimes 	}
1719df8bae1dSRodney W. Grimes 
1720b97d15cbSGarrett Wollman 	error = ip_output(m, (struct mbuf *)0, &ipforward_rt,
1721b97d15cbSGarrett Wollman 			  IP_FORWARDING, 0);
1722df8bae1dSRodney W. Grimes 	if (error)
1723df8bae1dSRodney W. Grimes 		ipstat.ips_cantforward++;
1724df8bae1dSRodney W. Grimes 	else {
1725df8bae1dSRodney W. Grimes 		ipstat.ips_forward++;
1726df8bae1dSRodney W. Grimes 		if (type)
1727df8bae1dSRodney W. Grimes 			ipstat.ips_redirectsent++;
1728df8bae1dSRodney W. Grimes 		else {
17291f91d8c5SDavid Greenman 			if (mcopy) {
17301f91d8c5SDavid Greenman 				ipflow_create(&ipforward_rt, mcopy);
1731df8bae1dSRodney W. Grimes 				m_freem(mcopy);
17321f91d8c5SDavid Greenman 			}
1733df8bae1dSRodney W. Grimes 			return;
1734df8bae1dSRodney W. Grimes 		}
1735df8bae1dSRodney W. Grimes 	}
1736df8bae1dSRodney W. Grimes 	if (mcopy == NULL)
1737df8bae1dSRodney W. Grimes 		return;
1738df8bae1dSRodney W. Grimes 	destifp = NULL;
1739df8bae1dSRodney W. Grimes 
1740df8bae1dSRodney W. Grimes 	switch (error) {
1741df8bae1dSRodney W. Grimes 
1742df8bae1dSRodney W. Grimes 	case 0:				/* forwarded, but need redirect */
1743df8bae1dSRodney W. Grimes 		/* type, code set above */
1744df8bae1dSRodney W. Grimes 		break;
1745df8bae1dSRodney W. Grimes 
1746df8bae1dSRodney W. Grimes 	case ENETUNREACH:		/* shouldn't happen, checked above */
1747df8bae1dSRodney W. Grimes 	case EHOSTUNREACH:
1748df8bae1dSRodney W. Grimes 	case ENETDOWN:
1749df8bae1dSRodney W. Grimes 	case EHOSTDOWN:
1750df8bae1dSRodney W. Grimes 	default:
1751df8bae1dSRodney W. Grimes 		type = ICMP_UNREACH;
1752df8bae1dSRodney W. Grimes 		code = ICMP_UNREACH_HOST;
1753df8bae1dSRodney W. Grimes 		break;
1754df8bae1dSRodney W. Grimes 
1755df8bae1dSRodney W. Grimes 	case EMSGSIZE:
1756df8bae1dSRodney W. Grimes 		type = ICMP_UNREACH;
1757df8bae1dSRodney W. Grimes 		code = ICMP_UNREACH_NEEDFRAG;
17586a800098SYoshinobu Inoue #ifndef IPSEC
1759df8bae1dSRodney W. Grimes 		if (ipforward_rt.ro_rt)
1760df8bae1dSRodney W. Grimes 			destifp = ipforward_rt.ro_rt->rt_ifp;
17616a800098SYoshinobu Inoue #else
17626a800098SYoshinobu Inoue 		/*
17636a800098SYoshinobu Inoue 		 * If the packet is routed over IPsec tunnel, tell the
17646a800098SYoshinobu Inoue 		 * originator the tunnel MTU.
17656a800098SYoshinobu Inoue 		 *	tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz
17666a800098SYoshinobu Inoue 		 * XXX quickhack!!!
17676a800098SYoshinobu Inoue 		 */
17686a800098SYoshinobu Inoue 		if (ipforward_rt.ro_rt) {
17696a800098SYoshinobu Inoue 			struct secpolicy *sp = NULL;
17706a800098SYoshinobu Inoue 			int ipsecerror;
17716a800098SYoshinobu Inoue 			int ipsechdr;
17726a800098SYoshinobu Inoue 			struct route *ro;
17736a800098SYoshinobu Inoue 
17746a800098SYoshinobu Inoue 			sp = ipsec4_getpolicybyaddr(mcopy,
17756a800098SYoshinobu Inoue 						    IPSEC_DIR_OUTBOUND,
17766a800098SYoshinobu Inoue 			                            IP_FORWARDING,
17776a800098SYoshinobu Inoue 			                            &ipsecerror);
17786a800098SYoshinobu Inoue 
17796a800098SYoshinobu Inoue 			if (sp == NULL)
17806a800098SYoshinobu Inoue 				destifp = ipforward_rt.ro_rt->rt_ifp;
17816a800098SYoshinobu Inoue 			else {
17826a800098SYoshinobu Inoue 				/* count IPsec header size */
17836a800098SYoshinobu Inoue 				ipsechdr = ipsec4_hdrsiz(mcopy,
17846a800098SYoshinobu Inoue 							 IPSEC_DIR_OUTBOUND,
17856a800098SYoshinobu Inoue 							 NULL);
17866a800098SYoshinobu Inoue 
17876a800098SYoshinobu Inoue 				/*
17886a800098SYoshinobu Inoue 				 * find the correct route for outer IPv4
17896a800098SYoshinobu Inoue 				 * header, compute tunnel MTU.
17906a800098SYoshinobu Inoue 				 *
17916a800098SYoshinobu Inoue 				 * XXX BUG ALERT
17926a800098SYoshinobu Inoue 				 * The "dummyifp" code relies upon the fact
17936a800098SYoshinobu Inoue 				 * that icmp_error() touches only ifp->if_mtu.
17946a800098SYoshinobu Inoue 				 */
17956a800098SYoshinobu Inoue 				/*XXX*/
17966a800098SYoshinobu Inoue 				destifp = NULL;
17976a800098SYoshinobu Inoue 				if (sp->req != NULL
17986a800098SYoshinobu Inoue 				 && sp->req->sav != NULL
17996a800098SYoshinobu Inoue 				 && sp->req->sav->sah != NULL) {
18006a800098SYoshinobu Inoue 					ro = &sp->req->sav->sah->sa_route;
18016a800098SYoshinobu Inoue 					if (ro->ro_rt && ro->ro_rt->rt_ifp) {
18026a800098SYoshinobu Inoue 						dummyifp.if_mtu =
18036a800098SYoshinobu Inoue 						    ro->ro_rt->rt_ifp->if_mtu;
18046a800098SYoshinobu Inoue 						dummyifp.if_mtu -= ipsechdr;
18056a800098SYoshinobu Inoue 						destifp = &dummyifp;
18066a800098SYoshinobu Inoue 					}
18076a800098SYoshinobu Inoue 				}
18086a800098SYoshinobu Inoue 
18096a800098SYoshinobu Inoue 				key_freesp(sp);
18106a800098SYoshinobu Inoue 			}
18116a800098SYoshinobu Inoue 		}
18126a800098SYoshinobu Inoue #endif /*IPSEC*/
1813df8bae1dSRodney W. Grimes 		ipstat.ips_cantfrag++;
1814df8bae1dSRodney W. Grimes 		break;
1815df8bae1dSRodney W. Grimes 
1816df8bae1dSRodney W. Grimes 	case ENOBUFS:
1817df8bae1dSRodney W. Grimes 		type = ICMP_SOURCEQUENCH;
1818df8bae1dSRodney W. Grimes 		code = 0;
1819df8bae1dSRodney W. Grimes 		break;
18203a06e3e0SRuslan Ermilov 
18213a06e3e0SRuslan Ermilov 	case EACCES:			/* ipfw denied packet */
18223a06e3e0SRuslan Ermilov 		m_freem(mcopy);
18233a06e3e0SRuslan Ermilov 		return;
1824df8bae1dSRodney W. Grimes 	}
1825df8bae1dSRodney W. Grimes 	icmp_error(mcopy, type, code, dest, destifp);
1826df8bae1dSRodney W. Grimes }
1827df8bae1dSRodney W. Grimes 
182882c23ebaSBill Fenner void
182982c23ebaSBill Fenner ip_savecontrol(inp, mp, ip, m)
183082c23ebaSBill Fenner 	register struct inpcb *inp;
183182c23ebaSBill Fenner 	register struct mbuf **mp;
183282c23ebaSBill Fenner 	register struct ip *ip;
183382c23ebaSBill Fenner 	register struct mbuf *m;
183482c23ebaSBill Fenner {
183582c23ebaSBill Fenner 	if (inp->inp_socket->so_options & SO_TIMESTAMP) {
183682c23ebaSBill Fenner 		struct timeval tv;
183782c23ebaSBill Fenner 
183882c23ebaSBill Fenner 		microtime(&tv);
183982c23ebaSBill Fenner 		*mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
184082c23ebaSBill Fenner 			SCM_TIMESTAMP, SOL_SOCKET);
184182c23ebaSBill Fenner 		if (*mp)
184282c23ebaSBill Fenner 			mp = &(*mp)->m_next;
184382c23ebaSBill Fenner 	}
184482c23ebaSBill Fenner 	if (inp->inp_flags & INP_RECVDSTADDR) {
184582c23ebaSBill Fenner 		*mp = sbcreatecontrol((caddr_t) &ip->ip_dst,
184682c23ebaSBill Fenner 		    sizeof(struct in_addr), IP_RECVDSTADDR, IPPROTO_IP);
184782c23ebaSBill Fenner 		if (*mp)
184882c23ebaSBill Fenner 			mp = &(*mp)->m_next;
184982c23ebaSBill Fenner 	}
185082c23ebaSBill Fenner #ifdef notyet
185182c23ebaSBill Fenner 	/* XXX
185282c23ebaSBill Fenner 	 * Moving these out of udp_input() made them even more broken
185382c23ebaSBill Fenner 	 * than they already were.
185482c23ebaSBill Fenner 	 */
185582c23ebaSBill Fenner 	/* options were tossed already */
185682c23ebaSBill Fenner 	if (inp->inp_flags & INP_RECVOPTS) {
185782c23ebaSBill Fenner 		*mp = sbcreatecontrol((caddr_t) opts_deleted_above,
185882c23ebaSBill Fenner 		    sizeof(struct in_addr), IP_RECVOPTS, IPPROTO_IP);
185982c23ebaSBill Fenner 		if (*mp)
186082c23ebaSBill Fenner 			mp = &(*mp)->m_next;
186182c23ebaSBill Fenner 	}
186282c23ebaSBill Fenner 	/* ip_srcroute doesn't do what we want here, need to fix */
186382c23ebaSBill Fenner 	if (inp->inp_flags & INP_RECVRETOPTS) {
186482c23ebaSBill Fenner 		*mp = sbcreatecontrol((caddr_t) ip_srcroute(),
186582c23ebaSBill Fenner 		    sizeof(struct in_addr), IP_RECVRETOPTS, IPPROTO_IP);
186682c23ebaSBill Fenner 		if (*mp)
186782c23ebaSBill Fenner 			mp = &(*mp)->m_next;
186882c23ebaSBill Fenner 	}
186982c23ebaSBill Fenner #endif
187082c23ebaSBill Fenner 	if (inp->inp_flags & INP_RECVIF) {
1871d314ad7bSJulian Elischer 		struct ifnet *ifp;
1872d314ad7bSJulian Elischer 		struct sdlbuf {
187382c23ebaSBill Fenner 			struct sockaddr_dl sdl;
1874d314ad7bSJulian Elischer 			u_char	pad[32];
1875d314ad7bSJulian Elischer 		} sdlbuf;
1876d314ad7bSJulian Elischer 		struct sockaddr_dl *sdp;
1877d314ad7bSJulian Elischer 		struct sockaddr_dl *sdl2 = &sdlbuf.sdl;
187882c23ebaSBill Fenner 
1879d314ad7bSJulian Elischer 		if (((ifp = m->m_pkthdr.rcvif))
1880d314ad7bSJulian Elischer 		&& ( ifp->if_index && (ifp->if_index <= if_index))) {
1881f9132cebSJonathan Lemon 			sdp = (struct sockaddr_dl *)
1882f9132cebSJonathan Lemon 			    (ifaddr_byindex(ifp->if_index)->ifa_addr);
1883d314ad7bSJulian Elischer 			/*
1884d314ad7bSJulian Elischer 			 * Change our mind and don't try copy.
1885d314ad7bSJulian Elischer 			 */
1886d314ad7bSJulian Elischer 			if ((sdp->sdl_family != AF_LINK)
1887d314ad7bSJulian Elischer 			|| (sdp->sdl_len > sizeof(sdlbuf))) {
1888d314ad7bSJulian Elischer 				goto makedummy;
1889d314ad7bSJulian Elischer 			}
1890d314ad7bSJulian Elischer 			bcopy(sdp, sdl2, sdp->sdl_len);
1891d314ad7bSJulian Elischer 		} else {
1892d314ad7bSJulian Elischer makedummy:
1893d314ad7bSJulian Elischer 			sdl2->sdl_len
1894d314ad7bSJulian Elischer 				= offsetof(struct sockaddr_dl, sdl_data[0]);
1895d314ad7bSJulian Elischer 			sdl2->sdl_family = AF_LINK;
1896d314ad7bSJulian Elischer 			sdl2->sdl_index = 0;
1897d314ad7bSJulian Elischer 			sdl2->sdl_nlen = sdl2->sdl_alen = sdl2->sdl_slen = 0;
1898d314ad7bSJulian Elischer 		}
1899d314ad7bSJulian Elischer 		*mp = sbcreatecontrol((caddr_t) sdl2, sdl2->sdl_len,
190082c23ebaSBill Fenner 			IP_RECVIF, IPPROTO_IP);
190182c23ebaSBill Fenner 		if (*mp)
190282c23ebaSBill Fenner 			mp = &(*mp)->m_next;
190382c23ebaSBill Fenner 	}
190482c23ebaSBill Fenner }
190582c23ebaSBill Fenner 
1906df8bae1dSRodney W. Grimes int
1907f0068c4aSGarrett Wollman ip_rsvp_init(struct socket *so)
1908f0068c4aSGarrett Wollman {
1909f0068c4aSGarrett Wollman 	if (so->so_type != SOCK_RAW ||
1910f0068c4aSGarrett Wollman 	    so->so_proto->pr_protocol != IPPROTO_RSVP)
1911f0068c4aSGarrett Wollman 	  return EOPNOTSUPP;
1912f0068c4aSGarrett Wollman 
1913f0068c4aSGarrett Wollman 	if (ip_rsvpd != NULL)
1914f0068c4aSGarrett Wollman 	  return EADDRINUSE;
1915f0068c4aSGarrett Wollman 
1916f0068c4aSGarrett Wollman 	ip_rsvpd = so;
19171c5de19aSGarrett Wollman 	/*
19181c5de19aSGarrett Wollman 	 * This may seem silly, but we need to be sure we don't over-increment
19191c5de19aSGarrett Wollman 	 * the RSVP counter, in case something slips up.
19201c5de19aSGarrett Wollman 	 */
19211c5de19aSGarrett Wollman 	if (!ip_rsvp_on) {
19221c5de19aSGarrett Wollman 		ip_rsvp_on = 1;
19231c5de19aSGarrett Wollman 		rsvp_on++;
19241c5de19aSGarrett Wollman 	}
1925f0068c4aSGarrett Wollman 
1926f0068c4aSGarrett Wollman 	return 0;
1927f0068c4aSGarrett Wollman }
1928f0068c4aSGarrett Wollman 
1929f0068c4aSGarrett Wollman int
1930f0068c4aSGarrett Wollman ip_rsvp_done(void)
1931f0068c4aSGarrett Wollman {
1932f0068c4aSGarrett Wollman 	ip_rsvpd = NULL;
19331c5de19aSGarrett Wollman 	/*
19341c5de19aSGarrett Wollman 	 * This may seem silly, but we need to be sure we don't over-decrement
19351c5de19aSGarrett Wollman 	 * the RSVP counter, in case something slips up.
19361c5de19aSGarrett Wollman 	 */
19371c5de19aSGarrett Wollman 	if (ip_rsvp_on) {
19381c5de19aSGarrett Wollman 		ip_rsvp_on = 0;
19391c5de19aSGarrett Wollman 		rsvp_on--;
19401c5de19aSGarrett Wollman 	}
1941f0068c4aSGarrett Wollman 	return 0;
1942f0068c4aSGarrett Wollman }
1943