1df8bae1dSRodney W. Grimes /* 2df8bae1dSRodney W. Grimes * Copyright (c) 1982, 1986, 1988, 1993 3df8bae1dSRodney W. Grimes * The Regents of the University of California. All rights reserved. 4df8bae1dSRodney W. Grimes * 5df8bae1dSRodney W. Grimes * Redistribution and use in source and binary forms, with or without 6df8bae1dSRodney W. Grimes * modification, are permitted provided that the following conditions 7df8bae1dSRodney W. Grimes * are met: 8df8bae1dSRodney W. Grimes * 1. Redistributions of source code must retain the above copyright 9df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer. 10df8bae1dSRodney W. Grimes * 2. Redistributions in binary form must reproduce the above copyright 11df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer in the 12df8bae1dSRodney W. Grimes * documentation and/or other materials provided with the distribution. 13df8bae1dSRodney W. Grimes * 3. All advertising materials mentioning features or use of this software 14df8bae1dSRodney W. Grimes * must display the following acknowledgement: 15df8bae1dSRodney W. Grimes * This product includes software developed by the University of 16df8bae1dSRodney W. Grimes * California, Berkeley and its contributors. 17df8bae1dSRodney W. Grimes * 4. Neither the name of the University nor the names of its contributors 18df8bae1dSRodney W. Grimes * may be used to endorse or promote products derived from this software 19df8bae1dSRodney W. Grimes * without specific prior written permission. 20df8bae1dSRodney W. Grimes * 21df8bae1dSRodney W. Grimes * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22df8bae1dSRodney W. Grimes * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23df8bae1dSRodney W. Grimes * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24df8bae1dSRodney W. Grimes * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25df8bae1dSRodney W. Grimes * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26df8bae1dSRodney W. Grimes * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27df8bae1dSRodney W. Grimes * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28df8bae1dSRodney W. Grimes * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29df8bae1dSRodney W. Grimes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30df8bae1dSRodney W. Grimes * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31df8bae1dSRodney W. Grimes * SUCH DAMAGE. 32df8bae1dSRodney W. Grimes * 33df8bae1dSRodney W. Grimes * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 34c3aac50fSPeter Wemm * $FreeBSD$ 35df8bae1dSRodney W. Grimes */ 36df8bae1dSRodney W. Grimes 3758938916SGarrett Wollman #define _IP_VHL 3858938916SGarrett Wollman 39e4f4247aSEivind Eklund #include "opt_bootp.h" 4074a9466cSGary Palmer #include "opt_ipfw.h" 41b715f178SLuigi Rizzo #include "opt_ipdn.h" 42fbd1372aSJoerg Wunsch #include "opt_ipdivert.h" 431ee25934SPeter Wemm #include "opt_ipfilter.h" 4427108a15SDag-Erling Smørgrav #include "opt_ipstealth.h" 456a800098SYoshinobu Inoue #include "opt_ipsec.h" 46c4ac87eaSDarren Reed #include "opt_pfil_hooks.h" 4764dddc18SKris Kennaway #include "opt_random_ip_id.h" 4874a9466cSGary Palmer 49df8bae1dSRodney W. Grimes #include <sys/param.h> 50df8bae1dSRodney W. Grimes #include <sys/systm.h> 51df8bae1dSRodney W. Grimes #include <sys/mbuf.h> 52b715f178SLuigi Rizzo #include <sys/malloc.h> 53df8bae1dSRodney W. Grimes #include <sys/domain.h> 54df8bae1dSRodney W. Grimes #include <sys/protosw.h> 55df8bae1dSRodney W. Grimes #include <sys/socket.h> 56df8bae1dSRodney W. Grimes #include <sys/time.h> 57df8bae1dSRodney W. Grimes #include <sys/kernel.h> 581025071fSGarrett Wollman #include <sys/syslog.h> 59b5e8ce9fSBruce Evans #include <sys/sysctl.h> 60df8bae1dSRodney W. Grimes 61c85540ddSAndrey A. Chernov #include <net/pfil.h> 62df8bae1dSRodney W. Grimes #include <net/if.h> 639494d596SBrooks Davis #include <net/if_types.h> 64d314ad7bSJulian Elischer #include <net/if_var.h> 6582c23ebaSBill Fenner #include <net/if_dl.h> 66df8bae1dSRodney W. Grimes #include <net/route.h> 67748e0b0aSGarrett Wollman #include <net/netisr.h> 68367d34f8SBrian Somers #include <net/intrq.h> 69df8bae1dSRodney W. Grimes 70df8bae1dSRodney W. Grimes #include <netinet/in.h> 71df8bae1dSRodney W. Grimes #include <netinet/in_systm.h> 72b5e8ce9fSBruce Evans #include <netinet/in_var.h> 73df8bae1dSRodney W. Grimes #include <netinet/ip.h> 74df8bae1dSRodney W. Grimes #include <netinet/in_pcb.h> 75df8bae1dSRodney W. Grimes #include <netinet/ip_var.h> 76df8bae1dSRodney W. Grimes #include <netinet/ip_icmp.h> 7758938916SGarrett Wollman #include <machine/in_cksum.h> 78df8bae1dSRodney W. Grimes 79f0068c4aSGarrett Wollman #include <sys/socketvar.h> 806ddbf1e2SGary Palmer 816ddbf1e2SGary Palmer #include <netinet/ip_fw.h> 82db69a05dSPaul Saab #include <netinet/ip_dummynet.h> 83db69a05dSPaul Saab 846a800098SYoshinobu Inoue #ifdef IPSEC 856a800098SYoshinobu Inoue #include <netinet6/ipsec.h> 866a800098SYoshinobu Inoue #include <netkey/key.h> 876a800098SYoshinobu Inoue #endif 886a800098SYoshinobu Inoue 891c5de19aSGarrett Wollman int rsvp_on = 0; 90f708ef1bSPoul-Henning Kamp static int ip_rsvp_on; 91f0068c4aSGarrett Wollman struct socket *ip_rsvpd; 92f0068c4aSGarrett Wollman 931f91d8c5SDavid Greenman int ipforwarding = 0; 940312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_FORWARDING, forwarding, CTLFLAG_RW, 953d177f46SBill Fumerola &ipforwarding, 0, "Enable IP forwarding between interfaces"); 960312fbe9SPoul-Henning Kamp 97d4fb926cSGarrett Wollman static int ipsendredirects = 1; /* XXX */ 980312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_SENDREDIRECTS, redirect, CTLFLAG_RW, 993d177f46SBill Fumerola &ipsendredirects, 0, "Enable sending IP redirects"); 1000312fbe9SPoul-Henning Kamp 101df8bae1dSRodney W. Grimes int ip_defttl = IPDEFTTL; 1020312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_DEFTTL, ttl, CTLFLAG_RW, 1033d177f46SBill Fumerola &ip_defttl, 0, "Maximum TTL on IP packets"); 1040312fbe9SPoul-Henning Kamp 1050312fbe9SPoul-Henning Kamp static int ip_dosourceroute = 0; 1060312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_SOURCEROUTE, sourceroute, CTLFLAG_RW, 1073d177f46SBill Fumerola &ip_dosourceroute, 0, "Enable forwarding source routed IP packets"); 1084fce5804SGuido van Rooij 1094fce5804SGuido van Rooij static int ip_acceptsourceroute = 0; 1104fce5804SGuido van Rooij SYSCTL_INT(_net_inet_ip, IPCTL_ACCEPTSOURCEROUTE, accept_sourceroute, 1113d177f46SBill Fumerola CTLFLAG_RW, &ip_acceptsourceroute, 0, 1123d177f46SBill Fumerola "Enable accepting source routed IP packets"); 1136a800098SYoshinobu Inoue 1146a800098SYoshinobu Inoue static int ip_keepfaith = 0; 1156a800098SYoshinobu Inoue SYSCTL_INT(_net_inet_ip, IPCTL_KEEPFAITH, keepfaith, CTLFLAG_RW, 1166a800098SYoshinobu Inoue &ip_keepfaith, 0, 1176a800098SYoshinobu Inoue "Enable packet capture for FAITH IPv4->IPv6 translater daemon"); 1186a800098SYoshinobu Inoue 119690a6055SJesper Skriver static int ip_nfragpackets = 0; 12096c2b042SJesper Skriver static int ip_maxfragpackets; /* initialized in ip_init() */ 121690a6055SJesper Skriver SYSCTL_INT(_net_inet_ip, OID_AUTO, maxfragpackets, CTLFLAG_RW, 122690a6055SJesper Skriver &ip_maxfragpackets, 0, 123690a6055SJesper Skriver "Maximum number of IPv4 fragment reassembly queue entries"); 124690a6055SJesper Skriver 125823db0e9SDon Lewis /* 126823db0e9SDon Lewis * XXX - Setting ip_checkinterface mostly implements the receive side of 127823db0e9SDon Lewis * the Strong ES model described in RFC 1122, but since the routing table 128a8f12100SDon Lewis * and transmit implementation do not implement the Strong ES model, 129823db0e9SDon Lewis * setting this to 1 results in an odd hybrid. 1303f67c834SDon Lewis * 131a8f12100SDon Lewis * XXX - ip_checkinterface currently must be disabled if you use ipnat 132a8f12100SDon Lewis * to translate the destination address to another local interface. 1333f67c834SDon Lewis * 1343f67c834SDon Lewis * XXX - ip_checkinterface must be disabled if you add IP aliases 1353f67c834SDon Lewis * to the loopback interface instead of the interface where the 1363f67c834SDon Lewis * packets for those addresses are received. 137823db0e9SDon Lewis */ 138b3e95d4eSJonathan Lemon static int ip_checkinterface = 1; 139b3e95d4eSJonathan Lemon SYSCTL_INT(_net_inet_ip, OID_AUTO, check_interface, CTLFLAG_RW, 140b3e95d4eSJonathan Lemon &ip_checkinterface, 0, "Verify packet arrives on correct interface"); 141b3e95d4eSJonathan Lemon 142df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC 1430312fbe9SPoul-Henning Kamp static int ipprintfs = 0; 144df8bae1dSRodney W. Grimes #endif 145df8bae1dSRodney W. Grimes 146ca925d9cSJonathan Lemon static int ipqmaxlen = IFQ_MAXLEN; 147ca925d9cSJonathan Lemon 148df8bae1dSRodney W. Grimes extern struct domain inetdomain; 149f0ffb944SJulian Elischer extern struct protosw inetsw[]; 150df8bae1dSRodney W. Grimes u_char ip_protox[IPPROTO_MAX]; 15159562606SGarrett Wollman struct in_ifaddrhead in_ifaddrhead; /* first inet address */ 152ca925d9cSJonathan Lemon struct in_ifaddrhashhead *in_ifaddrhashtbl; /* inet addr hash table */ 153ca925d9cSJonathan Lemon u_long in_ifaddrhmask; /* mask for hash table */ 154ca925d9cSJonathan Lemon 155afed1375SDavid Greenman SYSCTL_INT(_net_inet_ip, IPCTL_INTRQMAXLEN, intr_queue_maxlen, CTLFLAG_RW, 1563d177f46SBill Fumerola &ipintrq.ifq_maxlen, 0, "Maximum size of the IP input queue"); 1570312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_INTRQDROPS, intr_queue_drops, CTLFLAG_RD, 1583d177f46SBill Fumerola &ipintrq.ifq_drops, 0, "Number of packets dropped from the IP input queue"); 159df8bae1dSRodney W. Grimes 160f23b4c91SGarrett Wollman struct ipstat ipstat; 161c73d99b5SRuslan Ermilov SYSCTL_STRUCT(_net_inet_ip, IPCTL_STATS, stats, CTLFLAG_RW, 1623d177f46SBill Fumerola &ipstat, ipstat, "IP statistics (struct ipstat, netinet/ip_var.h)"); 163194a213eSAndrey A. Chernov 164194a213eSAndrey A. Chernov /* Packet reassembly stuff */ 165194a213eSAndrey A. Chernov #define IPREASS_NHASH_LOG2 6 166194a213eSAndrey A. Chernov #define IPREASS_NHASH (1 << IPREASS_NHASH_LOG2) 167194a213eSAndrey A. Chernov #define IPREASS_HMASK (IPREASS_NHASH - 1) 168194a213eSAndrey A. Chernov #define IPREASS_HASH(x,y) \ 169831a80b0SMatthew Dillon (((((x) & 0xF) | ((((x) >> 8) & 0xF) << 4)) ^ (y)) & IPREASS_HMASK) 170194a213eSAndrey A. Chernov 171462b86feSPoul-Henning Kamp static TAILQ_HEAD(ipqhead, ipq) ipq[IPREASS_NHASH]; 172194a213eSAndrey A. Chernov static int nipq = 0; /* total # of reass queues */ 173194a213eSAndrey A. Chernov static int maxnipq; 174367d34f8SBrian Somers const int ipintrq_present = 1; 175f23b4c91SGarrett Wollman 1760312fbe9SPoul-Henning Kamp #ifdef IPCTL_DEFMTU 1770312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_DEFMTU, mtu, CTLFLAG_RW, 1783d177f46SBill Fumerola &ip_mtu, 0, "Default MTU"); 1790312fbe9SPoul-Henning Kamp #endif 1800312fbe9SPoul-Henning Kamp 1811b968362SDag-Erling Smørgrav #ifdef IPSTEALTH 1821b968362SDag-Erling Smørgrav static int ipstealth = 0; 1831b968362SDag-Erling Smørgrav SYSCTL_INT(_net_inet_ip, OID_AUTO, stealth, CTLFLAG_RW, 1841b968362SDag-Erling Smørgrav &ipstealth, 0, ""); 1851b968362SDag-Erling Smørgrav #endif 1861b968362SDag-Erling Smørgrav 187cfe8b629SGarrett Wollman 18823bf9953SPoul-Henning Kamp /* Firewall hooks */ 18923bf9953SPoul-Henning Kamp ip_fw_chk_t *ip_fw_chk_ptr; 1909fcc0795SLuigi Rizzo int fw_enable = 1 ; 191e7319babSPoul-Henning Kamp 192db69a05dSPaul Saab /* Dummynet hooks */ 193db69a05dSPaul Saab ip_dn_io_t *ip_dn_io_ptr; 194b715f178SLuigi Rizzo 195afed1b49SDarren Reed 196e7319babSPoul-Henning Kamp /* 197df8bae1dSRodney W. Grimes * We need to save the IP options in case a protocol wants to respond 198df8bae1dSRodney W. Grimes * to an incoming packet over the same route if the packet got here 199df8bae1dSRodney W. Grimes * using IP source routing. This allows connection establishment and 200df8bae1dSRodney W. Grimes * maintenance when the remote end is on a network that is not known 201df8bae1dSRodney W. Grimes * to us. 202df8bae1dSRodney W. Grimes */ 2030312fbe9SPoul-Henning Kamp static int ip_nhops = 0; 204df8bae1dSRodney W. Grimes static struct ip_srcrt { 205df8bae1dSRodney W. Grimes struct in_addr dst; /* final destination */ 206df8bae1dSRodney W. Grimes char nop; /* one NOP to align */ 207df8bae1dSRodney W. Grimes char srcopt[IPOPT_OFFSET + 1]; /* OPTVAL, OLEN and OFFSET */ 208df8bae1dSRodney W. Grimes struct in_addr route[MAX_IPOPTLEN/sizeof(struct in_addr)]; 209df8bae1dSRodney W. Grimes } ip_srcrt; 210df8bae1dSRodney W. Grimes 211f9e354dfSJulian Elischer struct sockaddr_in *ip_fw_fwd_addr; 212f9e354dfSJulian Elischer 213df8bae1dSRodney W. Grimes static void save_rte __P((u_char *, struct in_addr)); 214d0ebc0d2SYaroslav Tykhiy static int ip_dooptions __P((struct mbuf *, int)); 2150312fbe9SPoul-Henning Kamp static void ip_forward __P((struct mbuf *, int)); 216462b86feSPoul-Henning Kamp static void ip_freef __P((struct ipqhead *, struct ipq *)); 2178948e4baSArchie Cobbs #ifdef IPDIVERT 218462b86feSPoul-Henning Kamp static struct mbuf *ip_reass __P((struct mbuf *, struct ipqhead *, struct ipq *, u_int32_t *, u_int16_t *)); 2198948e4baSArchie Cobbs #else 220462b86feSPoul-Henning Kamp static struct mbuf *ip_reass __P((struct mbuf *, struct ipqhead *, struct ipq *)); 2218948e4baSArchie Cobbs #endif 2220312fbe9SPoul-Henning Kamp static void ipintr __P((void)); 2238948e4baSArchie Cobbs 224df8bae1dSRodney W. Grimes /* 225df8bae1dSRodney W. Grimes * IP initialization: fill in IP protocol switch table. 226df8bae1dSRodney W. Grimes * All protocols not implemented in kernel go to raw IP protocol handler. 227df8bae1dSRodney W. Grimes */ 228df8bae1dSRodney W. Grimes void 229df8bae1dSRodney W. Grimes ip_init() 230df8bae1dSRodney W. Grimes { 231f0ffb944SJulian Elischer register struct protosw *pr; 232df8bae1dSRodney W. Grimes register int i; 233df8bae1dSRodney W. Grimes 23459562606SGarrett Wollman TAILQ_INIT(&in_ifaddrhead); 235ca925d9cSJonathan Lemon in_ifaddrhashtbl = hashinit(INADDR_NHASH, M_IFADDR, &in_ifaddrhmask); 236f0ffb944SJulian Elischer pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 237df8bae1dSRodney W. Grimes if (pr == 0) 238df8bae1dSRodney W. Grimes panic("ip_init"); 239df8bae1dSRodney W. Grimes for (i = 0; i < IPPROTO_MAX; i++) 240df8bae1dSRodney W. Grimes ip_protox[i] = pr - inetsw; 241f0ffb944SJulian Elischer for (pr = inetdomain.dom_protosw; 242f0ffb944SJulian Elischer pr < inetdomain.dom_protoswNPROTOSW; pr++) 243df8bae1dSRodney W. Grimes if (pr->pr_domain->dom_family == PF_INET && 244df8bae1dSRodney W. Grimes pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) 245df8bae1dSRodney W. Grimes ip_protox[pr->pr_protocol] = pr - inetsw; 246194a213eSAndrey A. Chernov 247194a213eSAndrey A. Chernov for (i = 0; i < IPREASS_NHASH; i++) 248462b86feSPoul-Henning Kamp TAILQ_INIT(&ipq[i]); 249194a213eSAndrey A. Chernov 250194a213eSAndrey A. Chernov maxnipq = nmbclusters / 4; 25196c2b042SJesper Skriver ip_maxfragpackets = nmbclusters / 4; 252194a213eSAndrey A. Chernov 25364dddc18SKris Kennaway #ifndef RANDOM_IP_ID 254227ee8a1SPoul-Henning Kamp ip_id = time_second & 0xffff; 25564dddc18SKris Kennaway #endif 256df8bae1dSRodney W. Grimes ipintrq.ifq_maxlen = ipqmaxlen; 257df5e1987SJonathan Lemon mtx_init(&ipintrq.ifq_mtx, "ip_inq", MTX_DEF); 258242c5536SPeter Wemm 259242c5536SPeter Wemm register_netisr(NETISR_IP, ipintr); 260df8bae1dSRodney W. Grimes } 261df8bae1dSRodney W. Grimes 2620312fbe9SPoul-Henning Kamp static struct sockaddr_in ipaddr = { sizeof(ipaddr), AF_INET }; 2631e3d5af0SRuslan Ermilov struct route ipforward_rt; 264df8bae1dSRodney W. Grimes 265df8bae1dSRodney W. Grimes /* 266df8bae1dSRodney W. Grimes * Ip input routine. Checksum and byte swap header. If fragmented 267df8bae1dSRodney W. Grimes * try to reassemble. Process options. Pass to next level. 268df8bae1dSRodney W. Grimes */ 269c67b1d17SGarrett Wollman void 270c67b1d17SGarrett Wollman ip_input(struct mbuf *m) 271df8bae1dSRodney W. Grimes { 27223bf9953SPoul-Henning Kamp struct ip *ip; 27323bf9953SPoul-Henning Kamp struct ipq *fp; 2745da9f8faSJosef Karthauser struct in_ifaddr *ia = NULL; 275ca925d9cSJonathan Lemon struct ifaddr *ifa; 276823db0e9SDon Lewis int i, hlen, checkif; 27747c861ecSBrian Somers u_short sum; 2788948e4baSArchie Cobbs u_int16_t divert_cookie; /* firewall cookie */ 2797538a9a0SJonathan Lemon struct in_addr pkt_dst; 2808948e4baSArchie Cobbs #ifdef IPDIVERT 2818948e4baSArchie Cobbs u_int32_t divert_info = 0; /* packet divert/tee info */ 282b715f178SLuigi Rizzo #endif 283830cc178SLuigi Rizzo struct ip_fw *rule = NULL; 284c4ac87eaSDarren Reed #ifdef PFIL_HOOKS 285c4ac87eaSDarren Reed struct packet_filter_hook *pfh; 286c4ac87eaSDarren Reed struct mbuf *m0; 287c4ac87eaSDarren Reed int rv; 288c4ac87eaSDarren Reed #endif /* PFIL_HOOKS */ 289b715f178SLuigi Rizzo 2908948e4baSArchie Cobbs #ifdef IPDIVERT 2918948e4baSArchie Cobbs /* Get and reset firewall cookie */ 2928948e4baSArchie Cobbs divert_cookie = ip_divert_cookie; 2938948e4baSArchie Cobbs ip_divert_cookie = 0; 2948948e4baSArchie Cobbs #else 2958948e4baSArchie Cobbs divert_cookie = 0; 2968948e4baSArchie Cobbs #endif 2978948e4baSArchie Cobbs 298b715f178SLuigi Rizzo /* 299b715f178SLuigi Rizzo * dummynet packet are prepended a vestigial mbuf with 300b715f178SLuigi Rizzo * m_type = MT_DUMMYNET and m_data pointing to the matching 301b715f178SLuigi Rizzo * rule. 302b715f178SLuigi Rizzo */ 303b715f178SLuigi Rizzo if (m->m_type == MT_DUMMYNET) { 304830cc178SLuigi Rizzo rule = (struct ip_fw *)(m->m_data) ; 305b715f178SLuigi Rizzo m = m->m_next ; 306b715f178SLuigi Rizzo ip = mtod(m, struct ip *); 307b715f178SLuigi Rizzo hlen = IP_VHL_HL(ip->ip_vhl) << 2; 308b715f178SLuigi Rizzo goto iphack ; 309b715f178SLuigi Rizzo } else 310b715f178SLuigi Rizzo rule = NULL ; 311df8bae1dSRodney W. Grimes 312df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC 313ed7509acSJulian Elischer if (m == NULL || (m->m_flags & M_PKTHDR) == 0) 31458938916SGarrett Wollman panic("ip_input no HDR"); 315df8bae1dSRodney W. Grimes #endif 316df8bae1dSRodney W. Grimes ipstat.ips_total++; 31758938916SGarrett Wollman 31858938916SGarrett Wollman if (m->m_pkthdr.len < sizeof(struct ip)) 31958938916SGarrett Wollman goto tooshort; 32058938916SGarrett Wollman 321df8bae1dSRodney W. Grimes if (m->m_len < sizeof (struct ip) && 322df8bae1dSRodney W. Grimes (m = m_pullup(m, sizeof (struct ip))) == 0) { 323df8bae1dSRodney W. Grimes ipstat.ips_toosmall++; 324c67b1d17SGarrett Wollman return; 325df8bae1dSRodney W. Grimes } 326df8bae1dSRodney W. Grimes ip = mtod(m, struct ip *); 32758938916SGarrett Wollman 32858938916SGarrett Wollman if (IP_VHL_V(ip->ip_vhl) != IPVERSION) { 329df8bae1dSRodney W. Grimes ipstat.ips_badvers++; 330df8bae1dSRodney W. Grimes goto bad; 331df8bae1dSRodney W. Grimes } 33258938916SGarrett Wollman 33358938916SGarrett Wollman hlen = IP_VHL_HL(ip->ip_vhl) << 2; 334df8bae1dSRodney W. Grimes if (hlen < sizeof(struct ip)) { /* minimum header length */ 335df8bae1dSRodney W. Grimes ipstat.ips_badhlen++; 336df8bae1dSRodney W. Grimes goto bad; 337df8bae1dSRodney W. Grimes } 338df8bae1dSRodney W. Grimes if (hlen > m->m_len) { 339df8bae1dSRodney W. Grimes if ((m = m_pullup(m, hlen)) == 0) { 340df8bae1dSRodney W. Grimes ipstat.ips_badhlen++; 341c67b1d17SGarrett Wollman return; 342df8bae1dSRodney W. Grimes } 343df8bae1dSRodney W. Grimes ip = mtod(m, struct ip *); 344df8bae1dSRodney W. Grimes } 34533841545SHajimu UMEMOTO 34633841545SHajimu UMEMOTO /* 127/8 must not appear on wire - RFC1122 */ 34733841545SHajimu UMEMOTO if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 34833841545SHajimu UMEMOTO (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) { 34933841545SHajimu UMEMOTO if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { 35033841545SHajimu UMEMOTO ipstat.ips_badaddr++; 35133841545SHajimu UMEMOTO goto bad; 35233841545SHajimu UMEMOTO } 35333841545SHajimu UMEMOTO } 35433841545SHajimu UMEMOTO 355db4f9cc7SJonathan Lemon if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) { 356db4f9cc7SJonathan Lemon sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID); 357db4f9cc7SJonathan Lemon } else { 35858938916SGarrett Wollman if (hlen == sizeof(struct ip)) { 35947c861ecSBrian Somers sum = in_cksum_hdr(ip); 36058938916SGarrett Wollman } else { 36147c861ecSBrian Somers sum = in_cksum(m, hlen); 36258938916SGarrett Wollman } 363db4f9cc7SJonathan Lemon } 36447c861ecSBrian Somers if (sum) { 365df8bae1dSRodney W. Grimes ipstat.ips_badsum++; 366df8bae1dSRodney W. Grimes goto bad; 367df8bae1dSRodney W. Grimes } 368df8bae1dSRodney W. Grimes 369df8bae1dSRodney W. Grimes /* 370df8bae1dSRodney W. Grimes * Convert fields to host representation. 371df8bae1dSRodney W. Grimes */ 372df8bae1dSRodney W. Grimes NTOHS(ip->ip_len); 373df8bae1dSRodney W. Grimes if (ip->ip_len < hlen) { 374df8bae1dSRodney W. Grimes ipstat.ips_badlen++; 375df8bae1dSRodney W. Grimes goto bad; 376df8bae1dSRodney W. Grimes } 377df8bae1dSRodney W. Grimes NTOHS(ip->ip_off); 378df8bae1dSRodney W. Grimes 379df8bae1dSRodney W. Grimes /* 380df8bae1dSRodney W. Grimes * Check that the amount of data in the buffers 381df8bae1dSRodney W. Grimes * is as at least much as the IP header would have us expect. 382df8bae1dSRodney W. Grimes * Trim mbufs if longer than we expect. 383df8bae1dSRodney W. Grimes * Drop packet if shorter than we expect. 384df8bae1dSRodney W. Grimes */ 385df8bae1dSRodney W. Grimes if (m->m_pkthdr.len < ip->ip_len) { 38658938916SGarrett Wollman tooshort: 387df8bae1dSRodney W. Grimes ipstat.ips_tooshort++; 388df8bae1dSRodney W. Grimes goto bad; 389df8bae1dSRodney W. Grimes } 390df8bae1dSRodney W. Grimes if (m->m_pkthdr.len > ip->ip_len) { 391df8bae1dSRodney W. Grimes if (m->m_len == m->m_pkthdr.len) { 392df8bae1dSRodney W. Grimes m->m_len = ip->ip_len; 393df8bae1dSRodney W. Grimes m->m_pkthdr.len = ip->ip_len; 394df8bae1dSRodney W. Grimes } else 395df8bae1dSRodney W. Grimes m_adj(m, ip->ip_len - m->m_pkthdr.len); 396df8bae1dSRodney W. Grimes } 3973f67c834SDon Lewis 39833841545SHajimu UMEMOTO #ifdef IPSEC 39933841545SHajimu UMEMOTO if (ipsec_gethist(m, NULL)) 40033841545SHajimu UMEMOTO goto pass; 40133841545SHajimu UMEMOTO #endif 4023f67c834SDon Lewis 4034dd1662bSUgen J.S. Antsilevich /* 4044dd1662bSUgen J.S. Antsilevich * IpHack's section. 4054dd1662bSUgen J.S. Antsilevich * Right now when no processing on packet has done 4064dd1662bSUgen J.S. Antsilevich * and it is still fresh out of network we do our black 4074dd1662bSUgen J.S. Antsilevich * deals with it. 40893e0e116SJulian Elischer * - Firewall: deny/allow/divert 409fed1c7e9SSøren Schmidt * - Xlate: translate packet's addr/port (NAT). 410b715f178SLuigi Rizzo * - Pipe: pass pkt through dummynet. 4114dd1662bSUgen J.S. Antsilevich * - Wrap: fake packet's addr/port <unimpl.> 4124dd1662bSUgen J.S. Antsilevich * - Encapsulate: put it in another IP and send out. <unimp.> 4134dd1662bSUgen J.S. Antsilevich */ 414b715f178SLuigi Rizzo 415b715f178SLuigi Rizzo iphack: 416df8bae1dSRodney W. Grimes 417c4ac87eaSDarren Reed #ifdef PFIL_HOOKS 418c4ac87eaSDarren Reed /* 419c4ac87eaSDarren Reed * Run through list of hooks for input packets. If there are any 420c4ac87eaSDarren Reed * filters which require that additional packets in the flow are 421c4ac87eaSDarren Reed * not fast-forwarded, they must clear the M_CANFASTFWD flag. 422c4ac87eaSDarren Reed * Note that filters must _never_ set this flag, as another filter 423c4ac87eaSDarren Reed * in the list may have previously cleared it. 424c4ac87eaSDarren Reed */ 425c4ac87eaSDarren Reed m0 = m; 426c4ac87eaSDarren Reed pfh = pfil_hook_get(PFIL_IN, &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); 427fc2ffbe6SPoul-Henning Kamp for (; pfh; pfh = TAILQ_NEXT(pfh, pfil_link)) 428c4ac87eaSDarren Reed if (pfh->pfil_func) { 429c4ac87eaSDarren Reed rv = pfh->pfil_func(ip, hlen, 430c4ac87eaSDarren Reed m->m_pkthdr.rcvif, 0, &m0); 431c4ac87eaSDarren Reed if (rv) 432beec8214SDarren Reed return; 433c4ac87eaSDarren Reed m = m0; 434c4ac87eaSDarren Reed if (m == NULL) 435c4ac87eaSDarren Reed return; 436c4ac87eaSDarren Reed ip = mtod(m, struct ip *); 437beec8214SDarren Reed } 438c4ac87eaSDarren Reed #endif /* PFIL_HOOKS */ 439c4ac87eaSDarren Reed 4407b109fa4SLuigi Rizzo if (fw_enable && IPFW_LOADED) { 441f9e354dfSJulian Elischer #ifdef IPFIREWALL_FORWARD 442f9e354dfSJulian Elischer /* 443f9e354dfSJulian Elischer * If we've been forwarded from the output side, then 444f9e354dfSJulian Elischer * skip the firewall a second time 445f9e354dfSJulian Elischer */ 446f9e354dfSJulian Elischer if (ip_fw_fwd_addr) 447f9e354dfSJulian Elischer goto ours; 448f9e354dfSJulian Elischer #endif /* IPFIREWALL_FORWARD */ 449f9e354dfSJulian Elischer /* 4508948e4baSArchie Cobbs * See the comment in ip_output for the return values 451b715f178SLuigi Rizzo * produced by the firewall. 452f9e354dfSJulian Elischer */ 4536f00486cSJonathan Lemon i = ip_fw_chk_ptr(&ip, hlen, NULL, 4546f00486cSJonathan Lemon &divert_cookie, &m, &rule, &ip_fw_fwd_addr); 455507b4b54SLuigi Rizzo if (i & IP_FW_PORT_DENY_FLAG) { /* XXX new interface-denied */ 456507b4b54SLuigi Rizzo if (m) 457507b4b54SLuigi Rizzo m_freem(m); 458b715f178SLuigi Rizzo return; 459507b4b54SLuigi Rizzo } 460507b4b54SLuigi Rizzo if (m == NULL) { /* Packet discarded by firewall */ 461507b4b54SLuigi Rizzo static int __debug=10; 462507b4b54SLuigi Rizzo if (__debug > 0) { 4636f00486cSJonathan Lemon printf( 4646f00486cSJonathan Lemon "firewall returns NULL, please update!\n"); 465507b4b54SLuigi Rizzo __debug--; 466507b4b54SLuigi Rizzo } 467507b4b54SLuigi Rizzo return; 468507b4b54SLuigi Rizzo } 469b715f178SLuigi Rizzo if (i == 0 && ip_fw_fwd_addr == NULL) /* common case */ 470b715f178SLuigi Rizzo goto pass; 4717b109fa4SLuigi Rizzo if (DUMMYNET_LOADED && (i & IP_FW_PORT_DYNT_FLAG) != 0) { 4728948e4baSArchie Cobbs /* Send packet to the appropriate pipe */ 473db69a05dSPaul Saab ip_dn_io_ptr(i&0xffff,DN_TO_IP_IN,m,NULL,NULL,0, rule, 4746a800098SYoshinobu Inoue 0); 475e4676ba6SJulian Elischer return; 47693e0e116SJulian Elischer } 477b715f178SLuigi Rizzo #ifdef IPDIVERT 4788948e4baSArchie Cobbs if (i != 0 && (i & IP_FW_PORT_DYNT_FLAG) == 0) { 4798948e4baSArchie Cobbs /* Divert or tee packet */ 4808948e4baSArchie Cobbs divert_info = i; 481b715f178SLuigi Rizzo goto ours; 482b715f178SLuigi Rizzo } 483b715f178SLuigi Rizzo #endif 484b715f178SLuigi Rizzo #ifdef IPFIREWALL_FORWARD 485b715f178SLuigi Rizzo if (i == 0 && ip_fw_fwd_addr != NULL) 486b715f178SLuigi Rizzo goto pass; 487b715f178SLuigi Rizzo #endif 488b715f178SLuigi Rizzo /* 489b715f178SLuigi Rizzo * if we get here, the packet must be dropped 490b715f178SLuigi Rizzo */ 491b715f178SLuigi Rizzo m_freem(m); 492b715f178SLuigi Rizzo return; 493b715f178SLuigi Rizzo } 494b715f178SLuigi Rizzo pass: 495100ba1a6SJordan K. Hubbard 496df8bae1dSRodney W. Grimes /* 497df8bae1dSRodney W. Grimes * Process options and, if not destined for us, 498df8bae1dSRodney W. Grimes * ship it on. ip_dooptions returns 1 when an 499df8bae1dSRodney W. Grimes * error was detected (causing an icmp message 500df8bae1dSRodney W. Grimes * to be sent and the original packet to be freed). 501df8bae1dSRodney W. Grimes */ 502df8bae1dSRodney W. Grimes ip_nhops = 0; /* for source routed packets */ 503d0ebc0d2SYaroslav Tykhiy if (hlen > sizeof (struct ip) && ip_dooptions(m, 0)) { 504ed1ff184SJulian Elischer #ifdef IPFIREWALL_FORWARD 505ed1ff184SJulian Elischer ip_fw_fwd_addr = NULL; 506ed1ff184SJulian Elischer #endif 507c67b1d17SGarrett Wollman return; 508ed1ff184SJulian Elischer } 509df8bae1dSRodney W. Grimes 510f0068c4aSGarrett Wollman /* greedy RSVP, snatches any PATH packet of the RSVP protocol and no 511f0068c4aSGarrett Wollman * matter if it is destined to another node, or whether it is 512f0068c4aSGarrett Wollman * a multicast one, RSVP wants it! and prevents it from being forwarded 513f0068c4aSGarrett Wollman * anywhere else. Also checks if the rsvp daemon is running before 514f0068c4aSGarrett Wollman * grabbing the packet. 515f0068c4aSGarrett Wollman */ 5161c5de19aSGarrett Wollman if (rsvp_on && ip->ip_p==IPPROTO_RSVP) 517f0068c4aSGarrett Wollman goto ours; 518f0068c4aSGarrett Wollman 519df8bae1dSRodney W. Grimes /* 520df8bae1dSRodney W. Grimes * Check our list of addresses, to see if the packet is for us. 521cc766e04SGarrett Wollman * If we don't have any addresses, assume any unicast packet 522cc766e04SGarrett Wollman * we receive might be for us (and let the upper layers deal 523cc766e04SGarrett Wollman * with it). 524df8bae1dSRodney W. Grimes */ 525cc766e04SGarrett Wollman if (TAILQ_EMPTY(&in_ifaddrhead) && 526cc766e04SGarrett Wollman (m->m_flags & (M_MCAST|M_BCAST)) == 0) 527cc766e04SGarrett Wollman goto ours; 528cc766e04SGarrett Wollman 5297538a9a0SJonathan Lemon /* 5307538a9a0SJonathan Lemon * Cache the destination address of the packet; this may be 5317538a9a0SJonathan Lemon * changed by use of 'ipfw fwd'. 5327538a9a0SJonathan Lemon */ 5337538a9a0SJonathan Lemon pkt_dst = ip_fw_fwd_addr == NULL ? 5347538a9a0SJonathan Lemon ip->ip_dst : ip_fw_fwd_addr->sin_addr; 5357538a9a0SJonathan Lemon 536823db0e9SDon Lewis /* 537823db0e9SDon Lewis * Enable a consistency check between the destination address 538823db0e9SDon Lewis * and the arrival interface for a unicast packet (the RFC 1122 539823db0e9SDon Lewis * strong ES model) if IP forwarding is disabled and the packet 540e15ae1b2SDon Lewis * is not locally generated and the packet is not subject to 541e15ae1b2SDon Lewis * 'ipfw fwd'. 5423f67c834SDon Lewis * 5433f67c834SDon Lewis * XXX - Checking also should be disabled if the destination 5443f67c834SDon Lewis * address is ipnat'ed to a different interface. 5453f67c834SDon Lewis * 546a8f12100SDon Lewis * XXX - Checking is incompatible with IP aliases added 5473f67c834SDon Lewis * to the loopback interface instead of the interface where 5483f67c834SDon Lewis * the packets are received. 549823db0e9SDon Lewis */ 550823db0e9SDon Lewis checkif = ip_checkinterface && (ipforwarding == 0) && 5519494d596SBrooks Davis m->m_pkthdr.rcvif != NULL && 552e15ae1b2SDon Lewis ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) && 553e15ae1b2SDon Lewis (ip_fw_fwd_addr == NULL); 554823db0e9SDon Lewis 555ca925d9cSJonathan Lemon /* 556ca925d9cSJonathan Lemon * Check for exact addresses in the hash bucket. 557ca925d9cSJonathan Lemon */ 558ca925d9cSJonathan Lemon LIST_FOREACH(ia, INADDR_HASH(pkt_dst.s_addr), ia_hash) { 559f9e354dfSJulian Elischer /* 560823db0e9SDon Lewis * If the address matches, verify that the packet 561823db0e9SDon Lewis * arrived via the correct interface if checking is 562823db0e9SDon Lewis * enabled. 563f9e354dfSJulian Elischer */ 564823db0e9SDon Lewis if (IA_SIN(ia)->sin_addr.s_addr == pkt_dst.s_addr && 565823db0e9SDon Lewis (!checkif || ia->ia_ifp == m->m_pkthdr.rcvif)) 566ed1ff184SJulian Elischer goto ours; 567ca925d9cSJonathan Lemon } 568823db0e9SDon Lewis /* 569ca925d9cSJonathan Lemon * Check for broadcast addresses. 570ca925d9cSJonathan Lemon * 571ca925d9cSJonathan Lemon * Only accept broadcast packets that arrive via the matching 572ca925d9cSJonathan Lemon * interface. Reception of forwarded directed broadcasts would 573ca925d9cSJonathan Lemon * be handled via ip_forward() and ether_output() with the loopback 574ca925d9cSJonathan Lemon * into the stack for SIMPLEX interfaces handled by ether_output(). 575823db0e9SDon Lewis */ 576ca925d9cSJonathan Lemon if (m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) { 577ca925d9cSJonathan Lemon TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrhead, ifa_link) { 578ca925d9cSJonathan Lemon if (ifa->ifa_addr->sa_family != AF_INET) 579ca925d9cSJonathan Lemon continue; 580ca925d9cSJonathan Lemon ia = ifatoia(ifa); 581df8bae1dSRodney W. Grimes if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr == 5827538a9a0SJonathan Lemon pkt_dst.s_addr) 583df8bae1dSRodney W. Grimes goto ours; 5847538a9a0SJonathan Lemon if (ia->ia_netbroadcast.s_addr == pkt_dst.s_addr) 585df8bae1dSRodney W. Grimes goto ours; 586ca925d9cSJonathan Lemon #ifdef BOOTP_COMPAT 587ca925d9cSJonathan Lemon if (IA_SIN(ia)->sin_addr.s_addr == INADDR_ANY) 588ca925d9cSJonathan Lemon goto ours; 589ca925d9cSJonathan Lemon #endif 590df8bae1dSRodney W. Grimes } 591df8bae1dSRodney W. Grimes } 592df8bae1dSRodney W. Grimes if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) { 593df8bae1dSRodney W. Grimes struct in_multi *inm; 594df8bae1dSRodney W. Grimes if (ip_mrouter) { 595df8bae1dSRodney W. Grimes /* 596df8bae1dSRodney W. Grimes * If we are acting as a multicast router, all 597df8bae1dSRodney W. Grimes * incoming multicast packets are passed to the 598df8bae1dSRodney W. Grimes * kernel-level multicast forwarding function. 599df8bae1dSRodney W. Grimes * The packet is returned (relatively) intact; if 600df8bae1dSRodney W. Grimes * ip_mforward() returns a non-zero value, the packet 601df8bae1dSRodney W. Grimes * must be discarded, else it may be accepted below. 602df8bae1dSRodney W. Grimes */ 603f0068c4aSGarrett Wollman if (ip_mforward(ip, m->m_pkthdr.rcvif, m, 0) != 0) { 604df8bae1dSRodney W. Grimes ipstat.ips_cantforward++; 605df8bae1dSRodney W. Grimes m_freem(m); 606c67b1d17SGarrett Wollman return; 607df8bae1dSRodney W. Grimes } 608df8bae1dSRodney W. Grimes 609df8bae1dSRodney W. Grimes /* 610df8bae1dSRodney W. Grimes * The process-level routing demon needs to receive 611df8bae1dSRodney W. Grimes * all multicast IGMP packets, whether or not this 612df8bae1dSRodney W. Grimes * host belongs to their destination groups. 613df8bae1dSRodney W. Grimes */ 614df8bae1dSRodney W. Grimes if (ip->ip_p == IPPROTO_IGMP) 615df8bae1dSRodney W. Grimes goto ours; 616df8bae1dSRodney W. Grimes ipstat.ips_forward++; 617df8bae1dSRodney W. Grimes } 618df8bae1dSRodney W. Grimes /* 619df8bae1dSRodney W. Grimes * See if we belong to the destination multicast group on the 620df8bae1dSRodney W. Grimes * arrival interface. 621df8bae1dSRodney W. Grimes */ 622df8bae1dSRodney W. Grimes IN_LOOKUP_MULTI(ip->ip_dst, m->m_pkthdr.rcvif, inm); 623df8bae1dSRodney W. Grimes if (inm == NULL) { 62482c39223SGarrett Wollman ipstat.ips_notmember++; 625df8bae1dSRodney W. Grimes m_freem(m); 626c67b1d17SGarrett Wollman return; 627df8bae1dSRodney W. Grimes } 628df8bae1dSRodney W. Grimes goto ours; 629df8bae1dSRodney W. Grimes } 630df8bae1dSRodney W. Grimes if (ip->ip_dst.s_addr == (u_long)INADDR_BROADCAST) 631df8bae1dSRodney W. Grimes goto ours; 632df8bae1dSRodney W. Grimes if (ip->ip_dst.s_addr == INADDR_ANY) 633df8bae1dSRodney W. Grimes goto ours; 634df8bae1dSRodney W. Grimes 6356a800098SYoshinobu Inoue /* 6366a800098SYoshinobu Inoue * FAITH(Firewall Aided Internet Translator) 6376a800098SYoshinobu Inoue */ 6386a800098SYoshinobu Inoue if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) { 6396a800098SYoshinobu Inoue if (ip_keepfaith) { 6406a800098SYoshinobu Inoue if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_ICMP) 6416a800098SYoshinobu Inoue goto ours; 6426a800098SYoshinobu Inoue } 6436a800098SYoshinobu Inoue m_freem(m); 6446a800098SYoshinobu Inoue return; 6456a800098SYoshinobu Inoue } 6469494d596SBrooks Davis 647df8bae1dSRodney W. Grimes /* 648df8bae1dSRodney W. Grimes * Not for us; forward if possible and desirable. 649df8bae1dSRodney W. Grimes */ 650df8bae1dSRodney W. Grimes if (ipforwarding == 0) { 651df8bae1dSRodney W. Grimes ipstat.ips_cantforward++; 652df8bae1dSRodney W. Grimes m_freem(m); 653df8bae1dSRodney W. Grimes } else 654df8bae1dSRodney W. Grimes ip_forward(m, 0); 655ed1ff184SJulian Elischer #ifdef IPFIREWALL_FORWARD 656ed1ff184SJulian Elischer ip_fw_fwd_addr = NULL; 657ed1ff184SJulian Elischer #endif 658c67b1d17SGarrett Wollman return; 659df8bae1dSRodney W. Grimes 660df8bae1dSRodney W. Grimes ours: 661d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH 662d0ebc0d2SYaroslav Tykhiy /* 663d0ebc0d2SYaroslav Tykhiy * IPSTEALTH: Process non-routing options only 664d0ebc0d2SYaroslav Tykhiy * if the packet is destined for us. 665d0ebc0d2SYaroslav Tykhiy */ 666d0ebc0d2SYaroslav Tykhiy if (ipstealth && hlen > sizeof (struct ip) && ip_dooptions(m, 1)) { 667d0ebc0d2SYaroslav Tykhiy #ifdef IPFIREWALL_FORWARD 668d0ebc0d2SYaroslav Tykhiy ip_fw_fwd_addr = NULL; 669d0ebc0d2SYaroslav Tykhiy #endif 670d0ebc0d2SYaroslav Tykhiy return; 671d0ebc0d2SYaroslav Tykhiy } 672d0ebc0d2SYaroslav Tykhiy #endif /* IPSTEALTH */ 673d0ebc0d2SYaroslav Tykhiy 6745da9f8faSJosef Karthauser /* Count the packet in the ip address stats */ 6755da9f8faSJosef Karthauser if (ia != NULL) { 6765da9f8faSJosef Karthauser ia->ia_ifa.if_ipackets++; 6775da9f8faSJosef Karthauser ia->ia_ifa.if_ibytes += m->m_pkthdr.len; 6785da9f8faSJosef Karthauser } 679100ba1a6SJordan K. Hubbard 68063f8d699SJordan K. Hubbard /* 681df8bae1dSRodney W. Grimes * If offset or IP_MF are set, must reassemble. 682df8bae1dSRodney W. Grimes * Otherwise, nothing need be done. 683df8bae1dSRodney W. Grimes * (We could look in the reassembly queue to see 684df8bae1dSRodney W. Grimes * if the packet was previously fragmented, 685df8bae1dSRodney W. Grimes * but it's not worth the time; just let them time out.) 686df8bae1dSRodney W. Grimes */ 687b6ea1aa5SRuslan Ermilov if (ip->ip_off & (IP_MF | IP_OFFMASK)) { 6886a800098SYoshinobu Inoue 689194a213eSAndrey A. Chernov sum = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id); 690df8bae1dSRodney W. Grimes /* 691df8bae1dSRodney W. Grimes * Look for queue of fragments 692df8bae1dSRodney W. Grimes * of this datagram. 693df8bae1dSRodney W. Grimes */ 694462b86feSPoul-Henning Kamp TAILQ_FOREACH(fp, &ipq[sum], ipq_list) 695df8bae1dSRodney W. Grimes if (ip->ip_id == fp->ipq_id && 696df8bae1dSRodney W. Grimes ip->ip_src.s_addr == fp->ipq_src.s_addr && 697df8bae1dSRodney W. Grimes ip->ip_dst.s_addr == fp->ipq_dst.s_addr && 698df8bae1dSRodney W. Grimes ip->ip_p == fp->ipq_p) 699df8bae1dSRodney W. Grimes goto found; 700df8bae1dSRodney W. Grimes 701194a213eSAndrey A. Chernov fp = 0; 702194a213eSAndrey A. Chernov 703194a213eSAndrey A. Chernov /* check if there's a place for the new queue */ 704194a213eSAndrey A. Chernov if (nipq > maxnipq) { 705194a213eSAndrey A. Chernov /* 706194a213eSAndrey A. Chernov * drop something from the tail of the current queue 707194a213eSAndrey A. Chernov * before proceeding further 708194a213eSAndrey A. Chernov */ 709462b86feSPoul-Henning Kamp struct ipq *q = TAILQ_LAST(&ipq[sum], ipqhead); 710462b86feSPoul-Henning Kamp if (q == NULL) { /* gak */ 711194a213eSAndrey A. Chernov for (i = 0; i < IPREASS_NHASH; i++) { 712462b86feSPoul-Henning Kamp struct ipq *r = TAILQ_LAST(&ipq[i], ipqhead); 713462b86feSPoul-Henning Kamp if (r) { 714462b86feSPoul-Henning Kamp ip_freef(&ipq[i], r); 715194a213eSAndrey A. Chernov break; 716194a213eSAndrey A. Chernov } 717194a213eSAndrey A. Chernov } 718194a213eSAndrey A. Chernov } else 719462b86feSPoul-Henning Kamp ip_freef(&ipq[sum], q); 720194a213eSAndrey A. Chernov } 721194a213eSAndrey A. Chernov found: 722df8bae1dSRodney W. Grimes /* 723df8bae1dSRodney W. Grimes * Adjust ip_len to not reflect header, 724df8bae1dSRodney W. Grimes * convert offset of this to bytes. 725df8bae1dSRodney W. Grimes */ 726df8bae1dSRodney W. Grimes ip->ip_len -= hlen; 727b6ea1aa5SRuslan Ermilov if (ip->ip_off & IP_MF) { 7286effc713SDoug Rabson /* 7296effc713SDoug Rabson * Make sure that fragments have a data length 7306effc713SDoug Rabson * that's a non-zero multiple of 8 bytes. 7316effc713SDoug Rabson */ 7326effc713SDoug Rabson if (ip->ip_len == 0 || (ip->ip_len & 0x7) != 0) { 7336effc713SDoug Rabson ipstat.ips_toosmall++; /* XXX */ 7346effc713SDoug Rabson goto bad; 7356effc713SDoug Rabson } 7366effc713SDoug Rabson m->m_flags |= M_FRAG; 7376effc713SDoug Rabson } 738df8bae1dSRodney W. Grimes ip->ip_off <<= 3; 739df8bae1dSRodney W. Grimes 740df8bae1dSRodney W. Grimes /* 741b6ea1aa5SRuslan Ermilov * Attempt reassembly; if it succeeds, proceed. 742df8bae1dSRodney W. Grimes */ 743df8bae1dSRodney W. Grimes ipstat.ips_fragments++; 744487bdb38SRuslan Ermilov m->m_pkthdr.header = ip; 7458948e4baSArchie Cobbs #ifdef IPDIVERT 7466a800098SYoshinobu Inoue m = ip_reass(m, 747462b86feSPoul-Henning Kamp &ipq[sum], fp, &divert_info, &divert_cookie); 7488948e4baSArchie Cobbs #else 749462b86feSPoul-Henning Kamp m = ip_reass(m, &ipq[sum], fp); 7508948e4baSArchie Cobbs #endif 7516a800098SYoshinobu Inoue if (m == 0) { 752f9e354dfSJulian Elischer #ifdef IPFIREWALL_FORWARD 753f9e354dfSJulian Elischer ip_fw_fwd_addr = NULL; 754f9e354dfSJulian Elischer #endif 755c67b1d17SGarrett Wollman return; 756f9e354dfSJulian Elischer } 757df8bae1dSRodney W. Grimes ipstat.ips_reassembled++; 7586a800098SYoshinobu Inoue ip = mtod(m, struct ip *); 7597e2df452SRuslan Ermilov /* Get the header length of the reassembled packet */ 7607e2df452SRuslan Ermilov hlen = IP_VHL_HL(ip->ip_vhl) << 2; 761af782f1cSBrian Somers #ifdef IPDIVERT 7628948e4baSArchie Cobbs /* Restore original checksum before diverting packet */ 7638948e4baSArchie Cobbs if (divert_info != 0) { 764af782f1cSBrian Somers ip->ip_len += hlen; 765af782f1cSBrian Somers HTONS(ip->ip_len); 766af782f1cSBrian Somers HTONS(ip->ip_off); 767af782f1cSBrian Somers ip->ip_sum = 0; 76860123168SRuslan Ermilov if (hlen == sizeof(struct ip)) 769af782f1cSBrian Somers ip->ip_sum = in_cksum_hdr(ip); 77060123168SRuslan Ermilov else 77160123168SRuslan Ermilov ip->ip_sum = in_cksum(m, hlen); 772af782f1cSBrian Somers NTOHS(ip->ip_off); 773af782f1cSBrian Somers NTOHS(ip->ip_len); 774af782f1cSBrian Somers ip->ip_len -= hlen; 775af782f1cSBrian Somers } 776af782f1cSBrian Somers #endif 777df8bae1dSRodney W. Grimes } else 778df8bae1dSRodney W. Grimes ip->ip_len -= hlen; 779df8bae1dSRodney W. Grimes 78093e0e116SJulian Elischer #ifdef IPDIVERT 78193e0e116SJulian Elischer /* 7828948e4baSArchie Cobbs * Divert or tee packet to the divert protocol if required. 7838948e4baSArchie Cobbs * 7848948e4baSArchie Cobbs * If divert_info is zero then cookie should be too, so we shouldn't 7858948e4baSArchie Cobbs * need to clear them here. Assume divert_packet() does so also. 78693e0e116SJulian Elischer */ 7878948e4baSArchie Cobbs if (divert_info != 0) { 7888948e4baSArchie Cobbs struct mbuf *clone = NULL; 7898948e4baSArchie Cobbs 7908948e4baSArchie Cobbs /* Clone packet if we're doing a 'tee' */ 7918948e4baSArchie Cobbs if ((divert_info & IP_FW_PORT_TEE_FLAG) != 0) 7928948e4baSArchie Cobbs clone = m_dup(m, M_DONTWAIT); 7938948e4baSArchie Cobbs 7948948e4baSArchie Cobbs /* Restore packet header fields to original values */ 7958948e4baSArchie Cobbs ip->ip_len += hlen; 7968948e4baSArchie Cobbs HTONS(ip->ip_len); 7978948e4baSArchie Cobbs HTONS(ip->ip_off); 7988948e4baSArchie Cobbs 7998948e4baSArchie Cobbs /* Deliver packet to divert input routine */ 8008948e4baSArchie Cobbs ip_divert_cookie = divert_cookie; 8018948e4baSArchie Cobbs divert_packet(m, 1, divert_info & 0xffff); 802e4676ba6SJulian Elischer ipstat.ips_delivered++; 8038948e4baSArchie Cobbs 8048948e4baSArchie Cobbs /* If 'tee', continue with original packet */ 8058948e4baSArchie Cobbs if (clone == NULL) 80693e0e116SJulian Elischer return; 8078948e4baSArchie Cobbs m = clone; 8088948e4baSArchie Cobbs ip = mtod(m, struct ip *); 80993e0e116SJulian Elischer } 81093e0e116SJulian Elischer #endif 81193e0e116SJulian Elischer 81233841545SHajimu UMEMOTO #ifdef IPSEC 81333841545SHajimu UMEMOTO /* 81433841545SHajimu UMEMOTO * enforce IPsec policy checking if we are seeing last header. 81533841545SHajimu UMEMOTO * note that we do not visit this with protocols with pcb layer 81633841545SHajimu UMEMOTO * code - like udp/tcp/raw ip. 81733841545SHajimu UMEMOTO */ 81833841545SHajimu UMEMOTO if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0 && 81933841545SHajimu UMEMOTO ipsec4_in_reject(m, NULL)) { 82033841545SHajimu UMEMOTO ipsecstat.in_polvio++; 82133841545SHajimu UMEMOTO goto bad; 82233841545SHajimu UMEMOTO } 82333841545SHajimu UMEMOTO #endif 82433841545SHajimu UMEMOTO 825df8bae1dSRodney W. Grimes /* 826df8bae1dSRodney W. Grimes * Switch out to protocol's input routine. 827df8bae1dSRodney W. Grimes */ 828df8bae1dSRodney W. Grimes ipstat.ips_delivered++; 8296a800098SYoshinobu Inoue { 830f0ffb944SJulian Elischer int off = hlen; 8316a800098SYoshinobu Inoue 832f0ffb944SJulian Elischer (*inetsw[ip_protox[ip->ip_p]].pr_input)(m, off); 833f9e354dfSJulian Elischer #ifdef IPFIREWALL_FORWARD 834f9e354dfSJulian Elischer ip_fw_fwd_addr = NULL; /* tcp needed it */ 835f9e354dfSJulian Elischer #endif 836c67b1d17SGarrett Wollman return; 8376a800098SYoshinobu Inoue } 838df8bae1dSRodney W. Grimes bad: 839f9e354dfSJulian Elischer #ifdef IPFIREWALL_FORWARD 840f9e354dfSJulian Elischer ip_fw_fwd_addr = NULL; 841f9e354dfSJulian Elischer #endif 842df8bae1dSRodney W. Grimes m_freem(m); 843c67b1d17SGarrett Wollman } 844c67b1d17SGarrett Wollman 845c67b1d17SGarrett Wollman /* 846c67b1d17SGarrett Wollman * IP software interrupt routine - to go away sometime soon 847c67b1d17SGarrett Wollman */ 848c67b1d17SGarrett Wollman static void 849c67b1d17SGarrett Wollman ipintr(void) 850c67b1d17SGarrett Wollman { 851c67b1d17SGarrett Wollman struct mbuf *m; 852c67b1d17SGarrett Wollman 853c67b1d17SGarrett Wollman while (1) { 854c67b1d17SGarrett Wollman IF_DEQUEUE(&ipintrq, m); 855c67b1d17SGarrett Wollman if (m == 0) 856c67b1d17SGarrett Wollman return; 857c67b1d17SGarrett Wollman ip_input(m); 858c67b1d17SGarrett Wollman } 859df8bae1dSRodney W. Grimes } 860df8bae1dSRodney W. Grimes 861df8bae1dSRodney W. Grimes /* 8628948e4baSArchie Cobbs * Take incoming datagram fragment and try to reassemble it into 8638948e4baSArchie Cobbs * whole datagram. If a chain for reassembly of this datagram already 8648948e4baSArchie Cobbs * exists, then it is given as fp; otherwise have to make a chain. 8658948e4baSArchie Cobbs * 8668948e4baSArchie Cobbs * When IPDIVERT enabled, keep additional state with each packet that 8678948e4baSArchie Cobbs * tells us if we need to divert or tee the packet we're building. 868df8bae1dSRodney W. Grimes */ 8698948e4baSArchie Cobbs 8706a800098SYoshinobu Inoue static struct mbuf * 8718948e4baSArchie Cobbs #ifdef IPDIVERT 872462b86feSPoul-Henning Kamp ip_reass(m, head, fp, divinfo, divcookie) 8738948e4baSArchie Cobbs #else 874462b86feSPoul-Henning Kamp ip_reass(m, head, fp) 8758948e4baSArchie Cobbs #endif 876462b86feSPoul-Henning Kamp struct mbuf *m; 877462b86feSPoul-Henning Kamp struct ipqhead *head; 878462b86feSPoul-Henning Kamp struct ipq *fp; 8798948e4baSArchie Cobbs #ifdef IPDIVERT 8808948e4baSArchie Cobbs u_int32_t *divinfo; 8818948e4baSArchie Cobbs u_int16_t *divcookie; 8828948e4baSArchie Cobbs #endif 883df8bae1dSRodney W. Grimes { 8846effc713SDoug Rabson struct ip *ip = mtod(m, struct ip *); 885b6ea1aa5SRuslan Ermilov register struct mbuf *p, *q, *nq; 886df8bae1dSRodney W. Grimes struct mbuf *t; 8876effc713SDoug Rabson int hlen = IP_VHL_HL(ip->ip_vhl) << 2; 888df8bae1dSRodney W. Grimes int i, next; 889df8bae1dSRodney W. Grimes 890df8bae1dSRodney W. Grimes /* 891df8bae1dSRodney W. Grimes * Presence of header sizes in mbufs 892df8bae1dSRodney W. Grimes * would confuse code below. 893df8bae1dSRodney W. Grimes */ 894df8bae1dSRodney W. Grimes m->m_data += hlen; 895df8bae1dSRodney W. Grimes m->m_len -= hlen; 896df8bae1dSRodney W. Grimes 897df8bae1dSRodney W. Grimes /* 898df8bae1dSRodney W. Grimes * If first fragment to arrive, create a reassembly queue. 899df8bae1dSRodney W. Grimes */ 900df8bae1dSRodney W. Grimes if (fp == 0) { 901690a6055SJesper Skriver /* 902690a6055SJesper Skriver * Enforce upper bound on number of fragmented packets 903690a6055SJesper Skriver * for which we attempt reassembly; 904690a6055SJesper Skriver * If maxfrag is 0, never accept fragments. 905690a6055SJesper Skriver * If maxfrag is -1, accept all fragments without limitation. 906690a6055SJesper Skriver */ 907690a6055SJesper Skriver if ((ip_maxfragpackets >= 0) && (ip_nfragpackets >= ip_maxfragpackets)) 908690a6055SJesper Skriver goto dropfrag; 909690a6055SJesper Skriver ip_nfragpackets++; 910df8bae1dSRodney W. Grimes if ((t = m_get(M_DONTWAIT, MT_FTABLE)) == NULL) 911df8bae1dSRodney W. Grimes goto dropfrag; 912df8bae1dSRodney W. Grimes fp = mtod(t, struct ipq *); 913462b86feSPoul-Henning Kamp TAILQ_INSERT_HEAD(head, fp, ipq_list); 914194a213eSAndrey A. Chernov nipq++; 915df8bae1dSRodney W. Grimes fp->ipq_ttl = IPFRAGTTL; 916df8bae1dSRodney W. Grimes fp->ipq_p = ip->ip_p; 917df8bae1dSRodney W. Grimes fp->ipq_id = ip->ip_id; 9186effc713SDoug Rabson fp->ipq_src = ip->ip_src; 9196effc713SDoug Rabson fp->ipq_dst = ip->ip_dst; 920af38c68cSLuigi Rizzo fp->ipq_frags = m; 921af38c68cSLuigi Rizzo m->m_nextpkt = NULL; 92293e0e116SJulian Elischer #ifdef IPDIVERT 9238948e4baSArchie Cobbs fp->ipq_div_info = 0; 924bb60f459SJulian Elischer fp->ipq_div_cookie = 0; 92593e0e116SJulian Elischer #endif 926af38c68cSLuigi Rizzo goto inserted; 927df8bae1dSRodney W. Grimes } 928df8bae1dSRodney W. Grimes 9296effc713SDoug Rabson #define GETIP(m) ((struct ip*)((m)->m_pkthdr.header)) 9306effc713SDoug Rabson 931df8bae1dSRodney W. Grimes /* 932df8bae1dSRodney W. Grimes * Find a segment which begins after this one does. 933df8bae1dSRodney W. Grimes */ 9346effc713SDoug Rabson for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt) 9356effc713SDoug Rabson if (GETIP(q)->ip_off > ip->ip_off) 936df8bae1dSRodney W. Grimes break; 937df8bae1dSRodney W. Grimes 938df8bae1dSRodney W. Grimes /* 939df8bae1dSRodney W. Grimes * If there is a preceding segment, it may provide some of 940df8bae1dSRodney W. Grimes * our data already. If so, drop the data from the incoming 941af38c68cSLuigi Rizzo * segment. If it provides all of our data, drop us, otherwise 942af38c68cSLuigi Rizzo * stick new segment in the proper place. 943db4f9cc7SJonathan Lemon * 944db4f9cc7SJonathan Lemon * If some of the data is dropped from the the preceding 945db4f9cc7SJonathan Lemon * segment, then it's checksum is invalidated. 946df8bae1dSRodney W. Grimes */ 9476effc713SDoug Rabson if (p) { 9486effc713SDoug Rabson i = GETIP(p)->ip_off + GETIP(p)->ip_len - ip->ip_off; 949df8bae1dSRodney W. Grimes if (i > 0) { 950df8bae1dSRodney W. Grimes if (i >= ip->ip_len) 951df8bae1dSRodney W. Grimes goto dropfrag; 9526a800098SYoshinobu Inoue m_adj(m, i); 953db4f9cc7SJonathan Lemon m->m_pkthdr.csum_flags = 0; 954df8bae1dSRodney W. Grimes ip->ip_off += i; 955df8bae1dSRodney W. Grimes ip->ip_len -= i; 956df8bae1dSRodney W. Grimes } 957af38c68cSLuigi Rizzo m->m_nextpkt = p->m_nextpkt; 958af38c68cSLuigi Rizzo p->m_nextpkt = m; 959af38c68cSLuigi Rizzo } else { 960af38c68cSLuigi Rizzo m->m_nextpkt = fp->ipq_frags; 961af38c68cSLuigi Rizzo fp->ipq_frags = m; 962df8bae1dSRodney W. Grimes } 963df8bae1dSRodney W. Grimes 964df8bae1dSRodney W. Grimes /* 965df8bae1dSRodney W. Grimes * While we overlap succeeding segments trim them or, 966df8bae1dSRodney W. Grimes * if they are completely covered, dequeue them. 967df8bae1dSRodney W. Grimes */ 9686effc713SDoug Rabson for (; q != NULL && ip->ip_off + ip->ip_len > GETIP(q)->ip_off; 969af38c68cSLuigi Rizzo q = nq) { 9706effc713SDoug Rabson i = (ip->ip_off + ip->ip_len) - 9716effc713SDoug Rabson GETIP(q)->ip_off; 9726effc713SDoug Rabson if (i < GETIP(q)->ip_len) { 9736effc713SDoug Rabson GETIP(q)->ip_len -= i; 9746effc713SDoug Rabson GETIP(q)->ip_off += i; 9756effc713SDoug Rabson m_adj(q, i); 976db4f9cc7SJonathan Lemon q->m_pkthdr.csum_flags = 0; 977df8bae1dSRodney W. Grimes break; 978df8bae1dSRodney W. Grimes } 9796effc713SDoug Rabson nq = q->m_nextpkt; 980af38c68cSLuigi Rizzo m->m_nextpkt = nq; 9816effc713SDoug Rabson m_freem(q); 982df8bae1dSRodney W. Grimes } 983df8bae1dSRodney W. Grimes 984af38c68cSLuigi Rizzo inserted: 98593e0e116SJulian Elischer 98693e0e116SJulian Elischer #ifdef IPDIVERT 98793e0e116SJulian Elischer /* 9888948e4baSArchie Cobbs * Transfer firewall instructions to the fragment structure. 9898948e4baSArchie Cobbs * Any fragment diverting causes the whole packet to divert. 99093e0e116SJulian Elischer */ 9918948e4baSArchie Cobbs fp->ipq_div_info = *divinfo; 9928948e4baSArchie Cobbs fp->ipq_div_cookie = *divcookie; 9938948e4baSArchie Cobbs *divinfo = 0; 9948948e4baSArchie Cobbs *divcookie = 0; 99593e0e116SJulian Elischer #endif 99693e0e116SJulian Elischer 997df8bae1dSRodney W. Grimes /* 998af38c68cSLuigi Rizzo * Check for complete reassembly. 999df8bae1dSRodney W. Grimes */ 10006effc713SDoug Rabson next = 0; 10016effc713SDoug Rabson for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt) { 10026effc713SDoug Rabson if (GETIP(q)->ip_off != next) 10036effc713SDoug Rabson return (0); 10046effc713SDoug Rabson next += GETIP(q)->ip_len; 10056effc713SDoug Rabson } 10066effc713SDoug Rabson /* Make sure the last packet didn't have the IP_MF flag */ 10076effc713SDoug Rabson if (p->m_flags & M_FRAG) 1008df8bae1dSRodney W. Grimes return (0); 1009df8bae1dSRodney W. Grimes 1010df8bae1dSRodney W. Grimes /* 1011430d30d8SBill Fenner * Reassembly is complete. Make sure the packet is a sane size. 1012430d30d8SBill Fenner */ 10136effc713SDoug Rabson q = fp->ipq_frags; 10146effc713SDoug Rabson ip = GETIP(q); 10156effc713SDoug Rabson if (next + (IP_VHL_HL(ip->ip_vhl) << 2) > IP_MAXPACKET) { 1016430d30d8SBill Fenner ipstat.ips_toolong++; 1017462b86feSPoul-Henning Kamp ip_freef(head, fp); 1018430d30d8SBill Fenner return (0); 1019430d30d8SBill Fenner } 1020430d30d8SBill Fenner 1021430d30d8SBill Fenner /* 1022430d30d8SBill Fenner * Concatenate fragments. 1023df8bae1dSRodney W. Grimes */ 10246effc713SDoug Rabson m = q; 1025df8bae1dSRodney W. Grimes t = m->m_next; 1026df8bae1dSRodney W. Grimes m->m_next = 0; 1027df8bae1dSRodney W. Grimes m_cat(m, t); 10286effc713SDoug Rabson nq = q->m_nextpkt; 1029945aa40dSDoug Rabson q->m_nextpkt = 0; 10306effc713SDoug Rabson for (q = nq; q != NULL; q = nq) { 10316effc713SDoug Rabson nq = q->m_nextpkt; 1032945aa40dSDoug Rabson q->m_nextpkt = NULL; 1033db4f9cc7SJonathan Lemon m->m_pkthdr.csum_flags &= q->m_pkthdr.csum_flags; 1034db4f9cc7SJonathan Lemon m->m_pkthdr.csum_data += q->m_pkthdr.csum_data; 1035a8db1d93SJonathan Lemon m_cat(m, q); 1036df8bae1dSRodney W. Grimes } 1037df8bae1dSRodney W. Grimes 103893e0e116SJulian Elischer #ifdef IPDIVERT 103993e0e116SJulian Elischer /* 10408948e4baSArchie Cobbs * Extract firewall instructions from the fragment structure. 104193e0e116SJulian Elischer */ 10428948e4baSArchie Cobbs *divinfo = fp->ipq_div_info; 10438948e4baSArchie Cobbs *divcookie = fp->ipq_div_cookie; 104493e0e116SJulian Elischer #endif 104593e0e116SJulian Elischer 1046df8bae1dSRodney W. Grimes /* 1047df8bae1dSRodney W. Grimes * Create header for new ip packet by 1048df8bae1dSRodney W. Grimes * modifying header of first packet; 1049df8bae1dSRodney W. Grimes * dequeue and discard fragment reassembly header. 1050df8bae1dSRodney W. Grimes * Make header visible. 1051df8bae1dSRodney W. Grimes */ 1052df8bae1dSRodney W. Grimes ip->ip_len = next; 10536effc713SDoug Rabson ip->ip_src = fp->ipq_src; 10546effc713SDoug Rabson ip->ip_dst = fp->ipq_dst; 1055462b86feSPoul-Henning Kamp TAILQ_REMOVE(head, fp, ipq_list); 1056194a213eSAndrey A. Chernov nipq--; 1057df8bae1dSRodney W. Grimes (void) m_free(dtom(fp)); 1058690a6055SJesper Skriver ip_nfragpackets--; 10596effc713SDoug Rabson m->m_len += (IP_VHL_HL(ip->ip_vhl) << 2); 10606effc713SDoug Rabson m->m_data -= (IP_VHL_HL(ip->ip_vhl) << 2); 1061df8bae1dSRodney W. Grimes /* some debugging cruft by sklower, below, will go away soon */ 1062df8bae1dSRodney W. Grimes if (m->m_flags & M_PKTHDR) { /* XXX this should be done elsewhere */ 1063df8bae1dSRodney W. Grimes register int plen = 0; 10646a800098SYoshinobu Inoue for (t = m; t; t = t->m_next) 10656a800098SYoshinobu Inoue plen += t->m_len; 10666a800098SYoshinobu Inoue m->m_pkthdr.len = plen; 1067df8bae1dSRodney W. Grimes } 10686a800098SYoshinobu Inoue return (m); 1069df8bae1dSRodney W. Grimes 1070df8bae1dSRodney W. Grimes dropfrag: 1071efe39c6aSJulian Elischer #ifdef IPDIVERT 10728948e4baSArchie Cobbs *divinfo = 0; 10738948e4baSArchie Cobbs *divcookie = 0; 1074efe39c6aSJulian Elischer #endif 1075df8bae1dSRodney W. Grimes ipstat.ips_fragdropped++; 1076df8bae1dSRodney W. Grimes m_freem(m); 1077df8bae1dSRodney W. Grimes return (0); 10786effc713SDoug Rabson 10796effc713SDoug Rabson #undef GETIP 1080df8bae1dSRodney W. Grimes } 1081df8bae1dSRodney W. Grimes 1082df8bae1dSRodney W. Grimes /* 1083df8bae1dSRodney W. Grimes * Free a fragment reassembly header and all 1084df8bae1dSRodney W. Grimes * associated datagrams. 1085df8bae1dSRodney W. Grimes */ 10860312fbe9SPoul-Henning Kamp static void 1087462b86feSPoul-Henning Kamp ip_freef(fhp, fp) 1088462b86feSPoul-Henning Kamp struct ipqhead *fhp; 1089df8bae1dSRodney W. Grimes struct ipq *fp; 1090df8bae1dSRodney W. Grimes { 10916effc713SDoug Rabson register struct mbuf *q; 1092df8bae1dSRodney W. Grimes 10936effc713SDoug Rabson while (fp->ipq_frags) { 10946effc713SDoug Rabson q = fp->ipq_frags; 10956effc713SDoug Rabson fp->ipq_frags = q->m_nextpkt; 10966effc713SDoug Rabson m_freem(q); 1097df8bae1dSRodney W. Grimes } 1098462b86feSPoul-Henning Kamp TAILQ_REMOVE(fhp, fp, ipq_list); 1099df8bae1dSRodney W. Grimes (void) m_free(dtom(fp)); 1100690a6055SJesper Skriver ip_nfragpackets--; 1101194a213eSAndrey A. Chernov nipq--; 1102df8bae1dSRodney W. Grimes } 1103df8bae1dSRodney W. Grimes 1104df8bae1dSRodney W. Grimes /* 1105df8bae1dSRodney W. Grimes * IP timer processing; 1106df8bae1dSRodney W. Grimes * if a timer expires on a reassembly 1107df8bae1dSRodney W. Grimes * queue, discard it. 1108df8bae1dSRodney W. Grimes */ 1109df8bae1dSRodney W. Grimes void 1110df8bae1dSRodney W. Grimes ip_slowtimo() 1111df8bae1dSRodney W. Grimes { 1112df8bae1dSRodney W. Grimes register struct ipq *fp; 1113df8bae1dSRodney W. Grimes int s = splnet(); 1114194a213eSAndrey A. Chernov int i; 1115df8bae1dSRodney W. Grimes 1116194a213eSAndrey A. Chernov for (i = 0; i < IPREASS_NHASH; i++) { 1117462b86feSPoul-Henning Kamp for(fp = TAILQ_FIRST(&ipq[i]); fp;) { 1118462b86feSPoul-Henning Kamp struct ipq *fpp; 1119462b86feSPoul-Henning Kamp 1120462b86feSPoul-Henning Kamp fpp = fp; 1121462b86feSPoul-Henning Kamp fp = TAILQ_NEXT(fp, ipq_list); 1122462b86feSPoul-Henning Kamp if(--fpp->ipq_ttl == 0) { 1123df8bae1dSRodney W. Grimes ipstat.ips_fragtimeout++; 1124462b86feSPoul-Henning Kamp ip_freef(&ipq[i], fpp); 1125df8bae1dSRodney W. Grimes } 1126df8bae1dSRodney W. Grimes } 1127194a213eSAndrey A. Chernov } 1128690a6055SJesper Skriver /* 1129690a6055SJesper Skriver * If we are over the maximum number of fragments 1130690a6055SJesper Skriver * (due to the limit being lowered), drain off 1131690a6055SJesper Skriver * enough to get down to the new limit. 1132690a6055SJesper Skriver */ 1133690a6055SJesper Skriver for (i = 0; i < IPREASS_NHASH; i++) { 1134690a6055SJesper Skriver if (ip_maxfragpackets >= 0) { 1135690a6055SJesper Skriver while (ip_nfragpackets > ip_maxfragpackets && 1136690a6055SJesper Skriver !TAILQ_EMPTY(&ipq[i])) { 1137690a6055SJesper Skriver ipstat.ips_fragdropped++; 1138690a6055SJesper Skriver ip_freef(&ipq[i], TAILQ_FIRST(&ipq[i])); 1139690a6055SJesper Skriver } 1140690a6055SJesper Skriver } 1141690a6055SJesper Skriver } 11421f91d8c5SDavid Greenman ipflow_slowtimo(); 1143df8bae1dSRodney W. Grimes splx(s); 1144df8bae1dSRodney W. Grimes } 1145df8bae1dSRodney W. Grimes 1146df8bae1dSRodney W. Grimes /* 1147df8bae1dSRodney W. Grimes * Drain off all datagram fragments. 1148df8bae1dSRodney W. Grimes */ 1149df8bae1dSRodney W. Grimes void 1150df8bae1dSRodney W. Grimes ip_drain() 1151df8bae1dSRodney W. Grimes { 1152194a213eSAndrey A. Chernov int i; 1153ce29ab3aSGarrett Wollman 1154194a213eSAndrey A. Chernov for (i = 0; i < IPREASS_NHASH; i++) { 1155462b86feSPoul-Henning Kamp while(!TAILQ_EMPTY(&ipq[i])) { 1156194a213eSAndrey A. Chernov ipstat.ips_fragdropped++; 1157462b86feSPoul-Henning Kamp ip_freef(&ipq[i], TAILQ_FIRST(&ipq[i])); 1158194a213eSAndrey A. Chernov } 1159194a213eSAndrey A. Chernov } 1160ce29ab3aSGarrett Wollman in_rtqdrain(); 1161df8bae1dSRodney W. Grimes } 1162df8bae1dSRodney W. Grimes 1163df8bae1dSRodney W. Grimes /* 1164df8bae1dSRodney W. Grimes * Do option processing on a datagram, 1165df8bae1dSRodney W. Grimes * possibly discarding it if bad options are encountered, 1166df8bae1dSRodney W. Grimes * or forwarding it if source-routed. 1167d0ebc0d2SYaroslav Tykhiy * The pass argument is used when operating in the IPSTEALTH 1168d0ebc0d2SYaroslav Tykhiy * mode to tell what options to process: 1169d0ebc0d2SYaroslav Tykhiy * [LS]SRR (pass 0) or the others (pass 1). 1170d0ebc0d2SYaroslav Tykhiy * The reason for as many as two passes is that when doing IPSTEALTH, 1171d0ebc0d2SYaroslav Tykhiy * non-routing options should be processed only if the packet is for us. 1172df8bae1dSRodney W. Grimes * Returns 1 if packet has been forwarded/freed, 1173df8bae1dSRodney W. Grimes * 0 if the packet should be processed further. 1174df8bae1dSRodney W. Grimes */ 11750312fbe9SPoul-Henning Kamp static int 1176d0ebc0d2SYaroslav Tykhiy ip_dooptions(m, pass) 1177df8bae1dSRodney W. Grimes struct mbuf *m; 1178d0ebc0d2SYaroslav Tykhiy int pass; 1179df8bae1dSRodney W. Grimes { 1180df8bae1dSRodney W. Grimes register struct ip *ip = mtod(m, struct ip *); 1181df8bae1dSRodney W. Grimes register u_char *cp; 1182df8bae1dSRodney W. Grimes register struct in_ifaddr *ia; 1183df8bae1dSRodney W. Grimes int opt, optlen, cnt, off, code, type = ICMP_PARAMPROB, forward = 0; 1184df8bae1dSRodney W. Grimes struct in_addr *sin, dst; 1185df8bae1dSRodney W. Grimes n_time ntime; 1186df8bae1dSRodney W. Grimes 1187df8bae1dSRodney W. Grimes dst = ip->ip_dst; 1188df8bae1dSRodney W. Grimes cp = (u_char *)(ip + 1); 118958938916SGarrett Wollman cnt = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof (struct ip); 1190df8bae1dSRodney W. Grimes for (; cnt > 0; cnt -= optlen, cp += optlen) { 1191df8bae1dSRodney W. Grimes opt = cp[IPOPT_OPTVAL]; 1192df8bae1dSRodney W. Grimes if (opt == IPOPT_EOL) 1193df8bae1dSRodney W. Grimes break; 1194df8bae1dSRodney W. Grimes if (opt == IPOPT_NOP) 1195df8bae1dSRodney W. Grimes optlen = 1; 1196df8bae1dSRodney W. Grimes else { 1197fdcb8debSJun-ichiro itojun Hagino if (cnt < IPOPT_OLEN + sizeof(*cp)) { 1198fdcb8debSJun-ichiro itojun Hagino code = &cp[IPOPT_OLEN] - (u_char *)ip; 1199fdcb8debSJun-ichiro itojun Hagino goto bad; 1200fdcb8debSJun-ichiro itojun Hagino } 1201df8bae1dSRodney W. Grimes optlen = cp[IPOPT_OLEN]; 1202707d00a3SJonathan Lemon if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) { 1203df8bae1dSRodney W. Grimes code = &cp[IPOPT_OLEN] - (u_char *)ip; 1204df8bae1dSRodney W. Grimes goto bad; 1205df8bae1dSRodney W. Grimes } 1206df8bae1dSRodney W. Grimes } 1207df8bae1dSRodney W. Grimes switch (opt) { 1208df8bae1dSRodney W. Grimes 1209df8bae1dSRodney W. Grimes default: 1210df8bae1dSRodney W. Grimes break; 1211df8bae1dSRodney W. Grimes 1212df8bae1dSRodney W. Grimes /* 1213df8bae1dSRodney W. Grimes * Source routing with record. 1214df8bae1dSRodney W. Grimes * Find interface with current destination address. 1215df8bae1dSRodney W. Grimes * If none on this machine then drop if strictly routed, 1216df8bae1dSRodney W. Grimes * or do nothing if loosely routed. 1217df8bae1dSRodney W. Grimes * Record interface address and bring up next address 1218df8bae1dSRodney W. Grimes * component. If strictly routed make sure next 1219df8bae1dSRodney W. Grimes * address is on directly accessible net. 1220df8bae1dSRodney W. Grimes */ 1221df8bae1dSRodney W. Grimes case IPOPT_LSRR: 1222df8bae1dSRodney W. Grimes case IPOPT_SSRR: 1223d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH 1224d0ebc0d2SYaroslav Tykhiy if (ipstealth && pass > 0) 1225d0ebc0d2SYaroslav Tykhiy break; 1226d0ebc0d2SYaroslav Tykhiy #endif 122733841545SHajimu UMEMOTO if (optlen < IPOPT_OFFSET + sizeof(*cp)) { 122833841545SHajimu UMEMOTO code = &cp[IPOPT_OLEN] - (u_char *)ip; 122933841545SHajimu UMEMOTO goto bad; 123033841545SHajimu UMEMOTO } 1231df8bae1dSRodney W. Grimes if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) { 1232df8bae1dSRodney W. Grimes code = &cp[IPOPT_OFFSET] - (u_char *)ip; 1233df8bae1dSRodney W. Grimes goto bad; 1234df8bae1dSRodney W. Grimes } 1235df8bae1dSRodney W. Grimes ipaddr.sin_addr = ip->ip_dst; 1236df8bae1dSRodney W. Grimes ia = (struct in_ifaddr *) 1237df8bae1dSRodney W. Grimes ifa_ifwithaddr((struct sockaddr *)&ipaddr); 1238df8bae1dSRodney W. Grimes if (ia == 0) { 1239df8bae1dSRodney W. Grimes if (opt == IPOPT_SSRR) { 1240df8bae1dSRodney W. Grimes type = ICMP_UNREACH; 1241df8bae1dSRodney W. Grimes code = ICMP_UNREACH_SRCFAIL; 1242df8bae1dSRodney W. Grimes goto bad; 1243df8bae1dSRodney W. Grimes } 1244bc189bf8SGuido van Rooij if (!ip_dosourceroute) 1245bc189bf8SGuido van Rooij goto nosourcerouting; 1246df8bae1dSRodney W. Grimes /* 1247df8bae1dSRodney W. Grimes * Loose routing, and not at next destination 1248df8bae1dSRodney W. Grimes * yet; nothing to do except forward. 1249df8bae1dSRodney W. Grimes */ 1250df8bae1dSRodney W. Grimes break; 1251df8bae1dSRodney W. Grimes } 1252df8bae1dSRodney W. Grimes off--; /* 0 origin */ 12535d5d5fc0SJonathan Lemon if (off > optlen - (int)sizeof(struct in_addr)) { 1254df8bae1dSRodney W. Grimes /* 1255df8bae1dSRodney W. Grimes * End of source route. Should be for us. 1256df8bae1dSRodney W. Grimes */ 12574fce5804SGuido van Rooij if (!ip_acceptsourceroute) 12584fce5804SGuido van Rooij goto nosourcerouting; 1259df8bae1dSRodney W. Grimes save_rte(cp, ip->ip_src); 1260df8bae1dSRodney W. Grimes break; 1261df8bae1dSRodney W. Grimes } 1262d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH 1263d0ebc0d2SYaroslav Tykhiy if (ipstealth) 1264d0ebc0d2SYaroslav Tykhiy goto dropit; 1265d0ebc0d2SYaroslav Tykhiy #endif 12661025071fSGarrett Wollman if (!ip_dosourceroute) { 12670af8d3ecSDavid Greenman if (ipforwarding) { 12680af8d3ecSDavid Greenman char buf[16]; /* aaa.bbb.ccc.ddd\0 */ 12690af8d3ecSDavid Greenman /* 12700af8d3ecSDavid Greenman * Acting as a router, so generate ICMP 12710af8d3ecSDavid Greenman */ 1272efa48587SGuido van Rooij nosourcerouting: 1273bc189bf8SGuido van Rooij strcpy(buf, inet_ntoa(ip->ip_dst)); 12741025071fSGarrett Wollman log(LOG_WARNING, 12751025071fSGarrett Wollman "attempted source route from %s to %s\n", 12761025071fSGarrett Wollman inet_ntoa(ip->ip_src), buf); 12771025071fSGarrett Wollman type = ICMP_UNREACH; 12781025071fSGarrett Wollman code = ICMP_UNREACH_SRCFAIL; 12791025071fSGarrett Wollman goto bad; 12800af8d3ecSDavid Greenman } else { 12810af8d3ecSDavid Greenman /* 12820af8d3ecSDavid Greenman * Not acting as a router, so silently drop. 12830af8d3ecSDavid Greenman */ 1284d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH 1285d0ebc0d2SYaroslav Tykhiy dropit: 1286d0ebc0d2SYaroslav Tykhiy #endif 12870af8d3ecSDavid Greenman ipstat.ips_cantforward++; 12880af8d3ecSDavid Greenman m_freem(m); 12890af8d3ecSDavid Greenman return (1); 12900af8d3ecSDavid Greenman } 12911025071fSGarrett Wollman } 12921025071fSGarrett Wollman 1293df8bae1dSRodney W. Grimes /* 1294df8bae1dSRodney W. Grimes * locate outgoing interface 1295df8bae1dSRodney W. Grimes */ 129694a5d9b6SDavid Greenman (void)memcpy(&ipaddr.sin_addr, cp + off, 1297df8bae1dSRodney W. Grimes sizeof(ipaddr.sin_addr)); 12981025071fSGarrett Wollman 1299df8bae1dSRodney W. Grimes if (opt == IPOPT_SSRR) { 1300df8bae1dSRodney W. Grimes #define INA struct in_ifaddr * 1301df8bae1dSRodney W. Grimes #define SA struct sockaddr * 1302df8bae1dSRodney W. Grimes if ((ia = (INA)ifa_ifwithdstaddr((SA)&ipaddr)) == 0) 1303df8bae1dSRodney W. Grimes ia = (INA)ifa_ifwithnet((SA)&ipaddr); 1304df8bae1dSRodney W. Grimes } else 1305bd714208SRuslan Ermilov ia = ip_rtaddr(ipaddr.sin_addr, &ipforward_rt); 1306df8bae1dSRodney W. Grimes if (ia == 0) { 1307df8bae1dSRodney W. Grimes type = ICMP_UNREACH; 1308df8bae1dSRodney W. Grimes code = ICMP_UNREACH_SRCFAIL; 1309df8bae1dSRodney W. Grimes goto bad; 1310df8bae1dSRodney W. Grimes } 1311df8bae1dSRodney W. Grimes ip->ip_dst = ipaddr.sin_addr; 131294a5d9b6SDavid Greenman (void)memcpy(cp + off, &(IA_SIN(ia)->sin_addr), 131394a5d9b6SDavid Greenman sizeof(struct in_addr)); 1314df8bae1dSRodney W. Grimes cp[IPOPT_OFFSET] += sizeof(struct in_addr); 1315df8bae1dSRodney W. Grimes /* 1316df8bae1dSRodney W. Grimes * Let ip_intr's mcast routing check handle mcast pkts 1317df8bae1dSRodney W. Grimes */ 1318df8bae1dSRodney W. Grimes forward = !IN_MULTICAST(ntohl(ip->ip_dst.s_addr)); 1319df8bae1dSRodney W. Grimes break; 1320df8bae1dSRodney W. Grimes 1321df8bae1dSRodney W. Grimes case IPOPT_RR: 1322d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH 1323d0ebc0d2SYaroslav Tykhiy if (ipstealth && pass == 0) 1324d0ebc0d2SYaroslav Tykhiy break; 1325d0ebc0d2SYaroslav Tykhiy #endif 1326707d00a3SJonathan Lemon if (optlen < IPOPT_OFFSET + sizeof(*cp)) { 1327707d00a3SJonathan Lemon code = &cp[IPOPT_OFFSET] - (u_char *)ip; 1328707d00a3SJonathan Lemon goto bad; 1329707d00a3SJonathan Lemon } 1330df8bae1dSRodney W. Grimes if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) { 1331df8bae1dSRodney W. Grimes code = &cp[IPOPT_OFFSET] - (u_char *)ip; 1332df8bae1dSRodney W. Grimes goto bad; 1333df8bae1dSRodney W. Grimes } 1334df8bae1dSRodney W. Grimes /* 1335df8bae1dSRodney W. Grimes * If no space remains, ignore. 1336df8bae1dSRodney W. Grimes */ 1337df8bae1dSRodney W. Grimes off--; /* 0 origin */ 13385d5d5fc0SJonathan Lemon if (off > optlen - (int)sizeof(struct in_addr)) 1339df8bae1dSRodney W. Grimes break; 134094a5d9b6SDavid Greenman (void)memcpy(&ipaddr.sin_addr, &ip->ip_dst, 1341df8bae1dSRodney W. Grimes sizeof(ipaddr.sin_addr)); 1342df8bae1dSRodney W. Grimes /* 1343df8bae1dSRodney W. Grimes * locate outgoing interface; if we're the destination, 1344df8bae1dSRodney W. Grimes * use the incoming interface (should be same). 1345df8bae1dSRodney W. Grimes */ 1346df8bae1dSRodney W. Grimes if ((ia = (INA)ifa_ifwithaddr((SA)&ipaddr)) == 0 && 1347bd714208SRuslan Ermilov (ia = ip_rtaddr(ipaddr.sin_addr, 1348bd714208SRuslan Ermilov &ipforward_rt)) == 0) { 1349df8bae1dSRodney W. Grimes type = ICMP_UNREACH; 1350df8bae1dSRodney W. Grimes code = ICMP_UNREACH_HOST; 1351df8bae1dSRodney W. Grimes goto bad; 1352df8bae1dSRodney W. Grimes } 135394a5d9b6SDavid Greenman (void)memcpy(cp + off, &(IA_SIN(ia)->sin_addr), 135494a5d9b6SDavid Greenman sizeof(struct in_addr)); 1355df8bae1dSRodney W. Grimes cp[IPOPT_OFFSET] += sizeof(struct in_addr); 1356df8bae1dSRodney W. Grimes break; 1357df8bae1dSRodney W. Grimes 1358df8bae1dSRodney W. Grimes case IPOPT_TS: 1359d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH 1360d0ebc0d2SYaroslav Tykhiy if (ipstealth && pass == 0) 1361d0ebc0d2SYaroslav Tykhiy break; 1362d0ebc0d2SYaroslav Tykhiy #endif 1363df8bae1dSRodney W. Grimes code = cp - (u_char *)ip; 136407514071SJonathan Lemon if (optlen < 4 || optlen > 40) { 136507514071SJonathan Lemon code = &cp[IPOPT_OLEN] - (u_char *)ip; 1366df8bae1dSRodney W. Grimes goto bad; 136733841545SHajimu UMEMOTO } 136807514071SJonathan Lemon if ((off = cp[IPOPT_OFFSET]) < 5) { 136907514071SJonathan Lemon code = &cp[IPOPT_OLEN] - (u_char *)ip; 137033841545SHajimu UMEMOTO goto bad; 137133841545SHajimu UMEMOTO } 137207514071SJonathan Lemon if (off > optlen - (int)sizeof(int32_t)) { 137307514071SJonathan Lemon cp[IPOPT_OFFSET + 1] += (1 << 4); 137407514071SJonathan Lemon if ((cp[IPOPT_OFFSET + 1] & 0xf0) == 0) { 137507514071SJonathan Lemon code = &cp[IPOPT_OFFSET] - (u_char *)ip; 1376df8bae1dSRodney W. Grimes goto bad; 137733841545SHajimu UMEMOTO } 1378df8bae1dSRodney W. Grimes break; 1379df8bae1dSRodney W. Grimes } 138007514071SJonathan Lemon off--; /* 0 origin */ 138107514071SJonathan Lemon sin = (struct in_addr *)(cp + off); 138207514071SJonathan Lemon switch (cp[IPOPT_OFFSET + 1] & 0x0f) { 1383df8bae1dSRodney W. Grimes 1384df8bae1dSRodney W. Grimes case IPOPT_TS_TSONLY: 1385df8bae1dSRodney W. Grimes break; 1386df8bae1dSRodney W. Grimes 1387df8bae1dSRodney W. Grimes case IPOPT_TS_TSANDADDR: 138807514071SJonathan Lemon if (off + sizeof(n_time) + 138907514071SJonathan Lemon sizeof(struct in_addr) > optlen) { 139007514071SJonathan Lemon code = &cp[IPOPT_OFFSET] - (u_char *)ip; 1391df8bae1dSRodney W. Grimes goto bad; 139233841545SHajimu UMEMOTO } 1393df8bae1dSRodney W. Grimes ipaddr.sin_addr = dst; 1394df8bae1dSRodney W. Grimes ia = (INA)ifaof_ifpforaddr((SA)&ipaddr, 1395df8bae1dSRodney W. Grimes m->m_pkthdr.rcvif); 1396df8bae1dSRodney W. Grimes if (ia == 0) 1397df8bae1dSRodney W. Grimes continue; 139894a5d9b6SDavid Greenman (void)memcpy(sin, &IA_SIN(ia)->sin_addr, 139994a5d9b6SDavid Greenman sizeof(struct in_addr)); 140007514071SJonathan Lemon cp[IPOPT_OFFSET] += sizeof(struct in_addr); 1401df8bae1dSRodney W. Grimes break; 1402df8bae1dSRodney W. Grimes 1403df8bae1dSRodney W. Grimes case IPOPT_TS_PRESPEC: 140407514071SJonathan Lemon if (off + sizeof(n_time) + 140507514071SJonathan Lemon sizeof(struct in_addr) > optlen) { 140607514071SJonathan Lemon code = &cp[IPOPT_OFFSET] - (u_char *)ip; 1407df8bae1dSRodney W. Grimes goto bad; 140833841545SHajimu UMEMOTO } 140994a5d9b6SDavid Greenman (void)memcpy(&ipaddr.sin_addr, sin, 1410df8bae1dSRodney W. Grimes sizeof(struct in_addr)); 1411df8bae1dSRodney W. Grimes if (ifa_ifwithaddr((SA)&ipaddr) == 0) 1412df8bae1dSRodney W. Grimes continue; 141307514071SJonathan Lemon cp[IPOPT_OFFSET] += sizeof(struct in_addr); 1414df8bae1dSRodney W. Grimes break; 1415df8bae1dSRodney W. Grimes 1416df8bae1dSRodney W. Grimes default: 141707514071SJonathan Lemon code = &cp[IPOPT_OFFSET + 1] - (u_char *)ip; 1418df8bae1dSRodney W. Grimes goto bad; 1419df8bae1dSRodney W. Grimes } 1420df8bae1dSRodney W. Grimes ntime = iptime(); 142107514071SJonathan Lemon (void)memcpy(cp + off, &ntime, sizeof(n_time)); 142207514071SJonathan Lemon cp[IPOPT_OFFSET] += sizeof(n_time); 1423df8bae1dSRodney W. Grimes } 1424df8bae1dSRodney W. Grimes } 142547174b49SAndrey A. Chernov if (forward && ipforwarding) { 1426df8bae1dSRodney W. Grimes ip_forward(m, 1); 1427df8bae1dSRodney W. Grimes return (1); 1428df8bae1dSRodney W. Grimes } 1429df8bae1dSRodney W. Grimes return (0); 1430df8bae1dSRodney W. Grimes bad: 1431df8bae1dSRodney W. Grimes icmp_error(m, type, code, 0, 0); 1432df8bae1dSRodney W. Grimes ipstat.ips_badoptions++; 1433df8bae1dSRodney W. Grimes return (1); 1434df8bae1dSRodney W. Grimes } 1435df8bae1dSRodney W. Grimes 1436df8bae1dSRodney W. Grimes /* 1437df8bae1dSRodney W. Grimes * Given address of next destination (final or next hop), 1438df8bae1dSRodney W. Grimes * return internet address info of interface to be used to get there. 1439df8bae1dSRodney W. Grimes */ 1440bd714208SRuslan Ermilov struct in_ifaddr * 1441bd714208SRuslan Ermilov ip_rtaddr(dst, rt) 1442df8bae1dSRodney W. Grimes struct in_addr dst; 1443bd714208SRuslan Ermilov struct route *rt; 1444df8bae1dSRodney W. Grimes { 1445df8bae1dSRodney W. Grimes register struct sockaddr_in *sin; 1446df8bae1dSRodney W. Grimes 1447bd714208SRuslan Ermilov sin = (struct sockaddr_in *)&rt->ro_dst; 1448df8bae1dSRodney W. Grimes 1449bd714208SRuslan Ermilov if (rt->ro_rt == 0 || 1450bd714208SRuslan Ermilov !(rt->ro_rt->rt_flags & RTF_UP) || 14514078ffb1SRuslan Ermilov dst.s_addr != sin->sin_addr.s_addr) { 1452bd714208SRuslan Ermilov if (rt->ro_rt) { 1453bd714208SRuslan Ermilov RTFREE(rt->ro_rt); 1454bd714208SRuslan Ermilov rt->ro_rt = 0; 1455df8bae1dSRodney W. Grimes } 1456df8bae1dSRodney W. Grimes sin->sin_family = AF_INET; 1457df8bae1dSRodney W. Grimes sin->sin_len = sizeof(*sin); 1458df8bae1dSRodney W. Grimes sin->sin_addr = dst; 1459df8bae1dSRodney W. Grimes 1460bd714208SRuslan Ermilov rtalloc_ign(rt, RTF_PRCLONING); 1461df8bae1dSRodney W. Grimes } 1462bd714208SRuslan Ermilov if (rt->ro_rt == 0) 1463df8bae1dSRodney W. Grimes return ((struct in_ifaddr *)0); 1464bd714208SRuslan Ermilov return (ifatoia(rt->ro_rt->rt_ifa)); 1465df8bae1dSRodney W. Grimes } 1466df8bae1dSRodney W. Grimes 1467df8bae1dSRodney W. Grimes /* 1468df8bae1dSRodney W. Grimes * Save incoming source route for use in replies, 1469df8bae1dSRodney W. Grimes * to be picked up later by ip_srcroute if the receiver is interested. 1470df8bae1dSRodney W. Grimes */ 1471df8bae1dSRodney W. Grimes void 1472df8bae1dSRodney W. Grimes save_rte(option, dst) 1473df8bae1dSRodney W. Grimes u_char *option; 1474df8bae1dSRodney W. Grimes struct in_addr dst; 1475df8bae1dSRodney W. Grimes { 1476df8bae1dSRodney W. Grimes unsigned olen; 1477df8bae1dSRodney W. Grimes 1478df8bae1dSRodney W. Grimes olen = option[IPOPT_OLEN]; 1479df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC 1480df8bae1dSRodney W. Grimes if (ipprintfs) 1481df8bae1dSRodney W. Grimes printf("save_rte: olen %d\n", olen); 1482df8bae1dSRodney W. Grimes #endif 1483df8bae1dSRodney W. Grimes if (olen > sizeof(ip_srcrt) - (1 + sizeof(dst))) 1484df8bae1dSRodney W. Grimes return; 14850453d3cbSBruce Evans bcopy(option, ip_srcrt.srcopt, olen); 1486df8bae1dSRodney W. Grimes ip_nhops = (olen - IPOPT_OFFSET - 1) / sizeof(struct in_addr); 1487df8bae1dSRodney W. Grimes ip_srcrt.dst = dst; 1488df8bae1dSRodney W. Grimes } 1489df8bae1dSRodney W. Grimes 1490df8bae1dSRodney W. Grimes /* 1491df8bae1dSRodney W. Grimes * Retrieve incoming source route for use in replies, 1492df8bae1dSRodney W. Grimes * in the same form used by setsockopt. 1493df8bae1dSRodney W. Grimes * The first hop is placed before the options, will be removed later. 1494df8bae1dSRodney W. Grimes */ 1495df8bae1dSRodney W. Grimes struct mbuf * 1496df8bae1dSRodney W. Grimes ip_srcroute() 1497df8bae1dSRodney W. Grimes { 1498df8bae1dSRodney W. Grimes register struct in_addr *p, *q; 1499df8bae1dSRodney W. Grimes register struct mbuf *m; 1500df8bae1dSRodney W. Grimes 1501df8bae1dSRodney W. Grimes if (ip_nhops == 0) 1502df8bae1dSRodney W. Grimes return ((struct mbuf *)0); 1503cfe8b629SGarrett Wollman m = m_get(M_DONTWAIT, MT_HEADER); 1504df8bae1dSRodney W. Grimes if (m == 0) 1505df8bae1dSRodney W. Grimes return ((struct mbuf *)0); 1506df8bae1dSRodney W. Grimes 1507df8bae1dSRodney W. Grimes #define OPTSIZ (sizeof(ip_srcrt.nop) + sizeof(ip_srcrt.srcopt)) 1508df8bae1dSRodney W. Grimes 1509df8bae1dSRodney W. Grimes /* length is (nhops+1)*sizeof(addr) + sizeof(nop + srcrt header) */ 1510df8bae1dSRodney W. Grimes m->m_len = ip_nhops * sizeof(struct in_addr) + sizeof(struct in_addr) + 1511df8bae1dSRodney W. Grimes OPTSIZ; 1512df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC 1513df8bae1dSRodney W. Grimes if (ipprintfs) 1514df8bae1dSRodney W. Grimes printf("ip_srcroute: nhops %d mlen %d", ip_nhops, m->m_len); 1515df8bae1dSRodney W. Grimes #endif 1516df8bae1dSRodney W. Grimes 1517df8bae1dSRodney W. Grimes /* 1518df8bae1dSRodney W. Grimes * First save first hop for return route 1519df8bae1dSRodney W. Grimes */ 1520df8bae1dSRodney W. Grimes p = &ip_srcrt.route[ip_nhops - 1]; 1521df8bae1dSRodney W. Grimes *(mtod(m, struct in_addr *)) = *p--; 1522df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC 1523df8bae1dSRodney W. Grimes if (ipprintfs) 1524af38c68cSLuigi Rizzo printf(" hops %lx", (u_long)ntohl(mtod(m, struct in_addr *)->s_addr)); 1525df8bae1dSRodney W. Grimes #endif 1526df8bae1dSRodney W. Grimes 1527df8bae1dSRodney W. Grimes /* 1528df8bae1dSRodney W. Grimes * Copy option fields and padding (nop) to mbuf. 1529df8bae1dSRodney W. Grimes */ 1530df8bae1dSRodney W. Grimes ip_srcrt.nop = IPOPT_NOP; 1531df8bae1dSRodney W. Grimes ip_srcrt.srcopt[IPOPT_OFFSET] = IPOPT_MINOFF; 153294a5d9b6SDavid Greenman (void)memcpy(mtod(m, caddr_t) + sizeof(struct in_addr), 153394a5d9b6SDavid Greenman &ip_srcrt.nop, OPTSIZ); 1534df8bae1dSRodney W. Grimes q = (struct in_addr *)(mtod(m, caddr_t) + 1535df8bae1dSRodney W. Grimes sizeof(struct in_addr) + OPTSIZ); 1536df8bae1dSRodney W. Grimes #undef OPTSIZ 1537df8bae1dSRodney W. Grimes /* 1538df8bae1dSRodney W. Grimes * Record return path as an IP source route, 1539df8bae1dSRodney W. Grimes * reversing the path (pointers are now aligned). 1540df8bae1dSRodney W. Grimes */ 1541df8bae1dSRodney W. Grimes while (p >= ip_srcrt.route) { 1542df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC 1543df8bae1dSRodney W. Grimes if (ipprintfs) 1544af38c68cSLuigi Rizzo printf(" %lx", (u_long)ntohl(q->s_addr)); 1545df8bae1dSRodney W. Grimes #endif 1546df8bae1dSRodney W. Grimes *q++ = *p--; 1547df8bae1dSRodney W. Grimes } 1548df8bae1dSRodney W. Grimes /* 1549df8bae1dSRodney W. Grimes * Last hop goes to final destination. 1550df8bae1dSRodney W. Grimes */ 1551df8bae1dSRodney W. Grimes *q = ip_srcrt.dst; 1552df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC 1553df8bae1dSRodney W. Grimes if (ipprintfs) 1554af38c68cSLuigi Rizzo printf(" %lx\n", (u_long)ntohl(q->s_addr)); 1555df8bae1dSRodney W. Grimes #endif 1556df8bae1dSRodney W. Grimes return (m); 1557df8bae1dSRodney W. Grimes } 1558df8bae1dSRodney W. Grimes 1559df8bae1dSRodney W. Grimes /* 1560df8bae1dSRodney W. Grimes * Strip out IP options, at higher 1561df8bae1dSRodney W. Grimes * level protocol in the kernel. 1562df8bae1dSRodney W. Grimes * Second argument is buffer to which options 1563df8bae1dSRodney W. Grimes * will be moved, and return value is their length. 1564df8bae1dSRodney W. Grimes * XXX should be deleted; last arg currently ignored. 1565df8bae1dSRodney W. Grimes */ 1566df8bae1dSRodney W. Grimes void 1567df8bae1dSRodney W. Grimes ip_stripoptions(m, mopt) 1568df8bae1dSRodney W. Grimes register struct mbuf *m; 1569df8bae1dSRodney W. Grimes struct mbuf *mopt; 1570df8bae1dSRodney W. Grimes { 1571df8bae1dSRodney W. Grimes register int i; 1572df8bae1dSRodney W. Grimes struct ip *ip = mtod(m, struct ip *); 1573df8bae1dSRodney W. Grimes register caddr_t opts; 1574df8bae1dSRodney W. Grimes int olen; 1575df8bae1dSRodney W. Grimes 157658938916SGarrett Wollman olen = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof (struct ip); 1577df8bae1dSRodney W. Grimes opts = (caddr_t)(ip + 1); 1578df8bae1dSRodney W. Grimes i = m->m_len - (sizeof (struct ip) + olen); 1579df8bae1dSRodney W. Grimes bcopy(opts + olen, opts, (unsigned)i); 1580df8bae1dSRodney W. Grimes m->m_len -= olen; 1581df8bae1dSRodney W. Grimes if (m->m_flags & M_PKTHDR) 1582df8bae1dSRodney W. Grimes m->m_pkthdr.len -= olen; 158358938916SGarrett Wollman ip->ip_vhl = IP_MAKE_VHL(IPVERSION, sizeof(struct ip) >> 2); 1584df8bae1dSRodney W. Grimes } 1585df8bae1dSRodney W. Grimes 1586df8bae1dSRodney W. Grimes u_char inetctlerrmap[PRC_NCMDS] = { 1587df8bae1dSRodney W. Grimes 0, 0, 0, 0, 1588df8bae1dSRodney W. Grimes 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, 1589df8bae1dSRodney W. Grimes EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, 1590df8bae1dSRodney W. Grimes EMSGSIZE, EHOSTUNREACH, 0, 0, 1591df8bae1dSRodney W. Grimes 0, 0, 0, 0, 15923b8123b7SJesper Skriver ENOPROTOOPT, ECONNREFUSED 1593df8bae1dSRodney W. Grimes }; 1594df8bae1dSRodney W. Grimes 1595df8bae1dSRodney W. Grimes /* 1596df8bae1dSRodney W. Grimes * Forward a packet. If some error occurs return the sender 1597df8bae1dSRodney W. Grimes * an icmp packet. Note we can't always generate a meaningful 1598df8bae1dSRodney W. Grimes * icmp message because icmp doesn't have a large enough repertoire 1599df8bae1dSRodney W. Grimes * of codes and types. 1600df8bae1dSRodney W. Grimes * 1601df8bae1dSRodney W. Grimes * If not forwarding, just drop the packet. This could be confusing 1602df8bae1dSRodney W. Grimes * if ipforwarding was zero but some routing protocol was advancing 1603df8bae1dSRodney W. Grimes * us as a gateway to somewhere. However, we must let the routing 1604df8bae1dSRodney W. Grimes * protocol deal with that. 1605df8bae1dSRodney W. Grimes * 1606df8bae1dSRodney W. Grimes * The srcrt parameter indicates whether the packet is being forwarded 1607df8bae1dSRodney W. Grimes * via a source route. 1608df8bae1dSRodney W. Grimes */ 16090312fbe9SPoul-Henning Kamp static void 1610df8bae1dSRodney W. Grimes ip_forward(m, srcrt) 1611df8bae1dSRodney W. Grimes struct mbuf *m; 1612df8bae1dSRodney W. Grimes int srcrt; 1613df8bae1dSRodney W. Grimes { 1614df8bae1dSRodney W. Grimes register struct ip *ip = mtod(m, struct ip *); 1615df8bae1dSRodney W. Grimes register struct rtentry *rt; 161626f9a767SRodney W. Grimes int error, type = 0, code = 0; 1617df8bae1dSRodney W. Grimes struct mbuf *mcopy; 1618df8bae1dSRodney W. Grimes n_long dest; 16193efc3014SJulian Elischer struct in_addr pkt_dst; 1620df8bae1dSRodney W. Grimes struct ifnet *destifp; 16216a800098SYoshinobu Inoue #ifdef IPSEC 16226a800098SYoshinobu Inoue struct ifnet dummyifp; 16236a800098SYoshinobu Inoue #endif 1624df8bae1dSRodney W. Grimes 1625df8bae1dSRodney W. Grimes dest = 0; 16263efc3014SJulian Elischer /* 16273efc3014SJulian Elischer * Cache the destination address of the packet; this may be 16283efc3014SJulian Elischer * changed by use of 'ipfw fwd'. 16293efc3014SJulian Elischer */ 16303efc3014SJulian Elischer pkt_dst = ip_fw_fwd_addr == NULL ? 16313efc3014SJulian Elischer ip->ip_dst : ip_fw_fwd_addr->sin_addr; 16323efc3014SJulian Elischer 1633df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC 1634df8bae1dSRodney W. Grimes if (ipprintfs) 163561ce519bSPoul-Henning Kamp printf("forward: src %lx dst %lx ttl %x\n", 16363efc3014SJulian Elischer (u_long)ip->ip_src.s_addr, (u_long)pkt_dst.s_addr, 1637162886e2SBruce Evans ip->ip_ttl); 1638df8bae1dSRodney W. Grimes #endif 1639100ba1a6SJordan K. Hubbard 1640100ba1a6SJordan K. Hubbard 16413efc3014SJulian Elischer if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(pkt_dst) == 0) { 1642df8bae1dSRodney W. Grimes ipstat.ips_cantforward++; 1643df8bae1dSRodney W. Grimes m_freem(m); 1644df8bae1dSRodney W. Grimes return; 1645df8bae1dSRodney W. Grimes } 16461b968362SDag-Erling Smørgrav #ifdef IPSTEALTH 16471b968362SDag-Erling Smørgrav if (!ipstealth) { 16481b968362SDag-Erling Smørgrav #endif 1649df8bae1dSRodney W. Grimes if (ip->ip_ttl <= IPTTLDEC) { 16501b968362SDag-Erling Smørgrav icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 16511b968362SDag-Erling Smørgrav dest, 0); 1652df8bae1dSRodney W. Grimes return; 1653df8bae1dSRodney W. Grimes } 16541b968362SDag-Erling Smørgrav #ifdef IPSTEALTH 16551b968362SDag-Erling Smørgrav } 16561b968362SDag-Erling Smørgrav #endif 1657df8bae1dSRodney W. Grimes 16583efc3014SJulian Elischer if (ip_rtaddr(pkt_dst, &ipforward_rt) == 0) { 1659df8bae1dSRodney W. Grimes icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, dest, 0); 1660df8bae1dSRodney W. Grimes return; 16614078ffb1SRuslan Ermilov } else 1662df8bae1dSRodney W. Grimes rt = ipforward_rt.ro_rt; 1663df8bae1dSRodney W. Grimes 1664df8bae1dSRodney W. Grimes /* 1665bfef7ed4SIan Dowse * Save the IP header and at most 8 bytes of the payload, 1666bfef7ed4SIan Dowse * in case we need to generate an ICMP message to the src. 1667bfef7ed4SIan Dowse * 1668bfef7ed4SIan Dowse * We don't use m_copy() because it might return a reference 1669bfef7ed4SIan Dowse * to a shared cluster. Both this function and ip_output() 1670bfef7ed4SIan Dowse * assume exclusive access to the IP header in `m', so any 1671bfef7ed4SIan Dowse * data in a cluster may change before we reach icmp_error(). 1672df8bae1dSRodney W. Grimes */ 1673bfef7ed4SIan Dowse MGET(mcopy, M_DONTWAIT, m->m_type); 1674bfef7ed4SIan Dowse if (mcopy != NULL) { 1675bfef7ed4SIan Dowse M_COPY_PKTHDR(mcopy, m); 1676bfef7ed4SIan Dowse mcopy->m_len = imin((IP_VHL_HL(ip->ip_vhl) << 2) + 8, 1677bfef7ed4SIan Dowse (int)ip->ip_len); 1678bfef7ed4SIan Dowse m_copydata(m, 0, mcopy->m_len, mtod(mcopy, caddr_t)); 1679bfef7ed4SIan Dowse } 168004287599SRuslan Ermilov 168104287599SRuslan Ermilov #ifdef IPSTEALTH 168204287599SRuslan Ermilov if (!ipstealth) { 168304287599SRuslan Ermilov #endif 168404287599SRuslan Ermilov ip->ip_ttl -= IPTTLDEC; 168504287599SRuslan Ermilov #ifdef IPSTEALTH 168604287599SRuslan Ermilov } 168704287599SRuslan Ermilov #endif 1688df8bae1dSRodney W. Grimes 1689df8bae1dSRodney W. Grimes /* 1690df8bae1dSRodney W. Grimes * If forwarding packet using same interface that it came in on, 1691df8bae1dSRodney W. Grimes * perhaps should send a redirect to sender to shortcut a hop. 1692df8bae1dSRodney W. Grimes * Only send redirect if source is sending directly to us, 1693df8bae1dSRodney W. Grimes * and if packet was not source routed (or has any options). 1694df8bae1dSRodney W. Grimes * Also, don't send redirect if forwarding using a default route 1695df8bae1dSRodney W. Grimes * or a route modified by a redirect. 1696df8bae1dSRodney W. Grimes */ 1697df8bae1dSRodney W. Grimes if (rt->rt_ifp == m->m_pkthdr.rcvif && 1698df8bae1dSRodney W. Grimes (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0 && 1699df8bae1dSRodney W. Grimes satosin(rt_key(rt))->sin_addr.s_addr != 0 && 17003efc3014SJulian Elischer ipsendredirects && !srcrt && !ip_fw_fwd_addr) { 1701df8bae1dSRodney W. Grimes #define RTA(rt) ((struct in_ifaddr *)(rt->rt_ifa)) 1702df8bae1dSRodney W. Grimes u_long src = ntohl(ip->ip_src.s_addr); 1703df8bae1dSRodney W. Grimes 1704df8bae1dSRodney W. Grimes if (RTA(rt) && 1705df8bae1dSRodney W. Grimes (src & RTA(rt)->ia_subnetmask) == RTA(rt)->ia_subnet) { 1706df8bae1dSRodney W. Grimes if (rt->rt_flags & RTF_GATEWAY) 1707df8bae1dSRodney W. Grimes dest = satosin(rt->rt_gateway)->sin_addr.s_addr; 1708df8bae1dSRodney W. Grimes else 17093efc3014SJulian Elischer dest = pkt_dst.s_addr; 1710df8bae1dSRodney W. Grimes /* Router requirements says to only send host redirects */ 1711df8bae1dSRodney W. Grimes type = ICMP_REDIRECT; 1712df8bae1dSRodney W. Grimes code = ICMP_REDIRECT_HOST; 1713df8bae1dSRodney W. Grimes #ifdef DIAGNOSTIC 1714df8bae1dSRodney W. Grimes if (ipprintfs) 1715df8bae1dSRodney W. Grimes printf("redirect (%d) to %lx\n", code, (u_long)dest); 1716df8bae1dSRodney W. Grimes #endif 1717df8bae1dSRodney W. Grimes } 1718df8bae1dSRodney W. Grimes } 1719df8bae1dSRodney W. Grimes 1720b97d15cbSGarrett Wollman error = ip_output(m, (struct mbuf *)0, &ipforward_rt, 1721b97d15cbSGarrett Wollman IP_FORWARDING, 0); 1722df8bae1dSRodney W. Grimes if (error) 1723df8bae1dSRodney W. Grimes ipstat.ips_cantforward++; 1724df8bae1dSRodney W. Grimes else { 1725df8bae1dSRodney W. Grimes ipstat.ips_forward++; 1726df8bae1dSRodney W. Grimes if (type) 1727df8bae1dSRodney W. Grimes ipstat.ips_redirectsent++; 1728df8bae1dSRodney W. Grimes else { 17291f91d8c5SDavid Greenman if (mcopy) { 17301f91d8c5SDavid Greenman ipflow_create(&ipforward_rt, mcopy); 1731df8bae1dSRodney W. Grimes m_freem(mcopy); 17321f91d8c5SDavid Greenman } 1733df8bae1dSRodney W. Grimes return; 1734df8bae1dSRodney W. Grimes } 1735df8bae1dSRodney W. Grimes } 1736df8bae1dSRodney W. Grimes if (mcopy == NULL) 1737df8bae1dSRodney W. Grimes return; 1738df8bae1dSRodney W. Grimes destifp = NULL; 1739df8bae1dSRodney W. Grimes 1740df8bae1dSRodney W. Grimes switch (error) { 1741df8bae1dSRodney W. Grimes 1742df8bae1dSRodney W. Grimes case 0: /* forwarded, but need redirect */ 1743df8bae1dSRodney W. Grimes /* type, code set above */ 1744df8bae1dSRodney W. Grimes break; 1745df8bae1dSRodney W. Grimes 1746df8bae1dSRodney W. Grimes case ENETUNREACH: /* shouldn't happen, checked above */ 1747df8bae1dSRodney W. Grimes case EHOSTUNREACH: 1748df8bae1dSRodney W. Grimes case ENETDOWN: 1749df8bae1dSRodney W. Grimes case EHOSTDOWN: 1750df8bae1dSRodney W. Grimes default: 1751df8bae1dSRodney W. Grimes type = ICMP_UNREACH; 1752df8bae1dSRodney W. Grimes code = ICMP_UNREACH_HOST; 1753df8bae1dSRodney W. Grimes break; 1754df8bae1dSRodney W. Grimes 1755df8bae1dSRodney W. Grimes case EMSGSIZE: 1756df8bae1dSRodney W. Grimes type = ICMP_UNREACH; 1757df8bae1dSRodney W. Grimes code = ICMP_UNREACH_NEEDFRAG; 17586a800098SYoshinobu Inoue #ifndef IPSEC 1759df8bae1dSRodney W. Grimes if (ipforward_rt.ro_rt) 1760df8bae1dSRodney W. Grimes destifp = ipforward_rt.ro_rt->rt_ifp; 17616a800098SYoshinobu Inoue #else 17626a800098SYoshinobu Inoue /* 17636a800098SYoshinobu Inoue * If the packet is routed over IPsec tunnel, tell the 17646a800098SYoshinobu Inoue * originator the tunnel MTU. 17656a800098SYoshinobu Inoue * tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz 17666a800098SYoshinobu Inoue * XXX quickhack!!! 17676a800098SYoshinobu Inoue */ 17686a800098SYoshinobu Inoue if (ipforward_rt.ro_rt) { 17696a800098SYoshinobu Inoue struct secpolicy *sp = NULL; 17706a800098SYoshinobu Inoue int ipsecerror; 17716a800098SYoshinobu Inoue int ipsechdr; 17726a800098SYoshinobu Inoue struct route *ro; 17736a800098SYoshinobu Inoue 17746a800098SYoshinobu Inoue sp = ipsec4_getpolicybyaddr(mcopy, 17756a800098SYoshinobu Inoue IPSEC_DIR_OUTBOUND, 17766a800098SYoshinobu Inoue IP_FORWARDING, 17776a800098SYoshinobu Inoue &ipsecerror); 17786a800098SYoshinobu Inoue 17796a800098SYoshinobu Inoue if (sp == NULL) 17806a800098SYoshinobu Inoue destifp = ipforward_rt.ro_rt->rt_ifp; 17816a800098SYoshinobu Inoue else { 17826a800098SYoshinobu Inoue /* count IPsec header size */ 17836a800098SYoshinobu Inoue ipsechdr = ipsec4_hdrsiz(mcopy, 17846a800098SYoshinobu Inoue IPSEC_DIR_OUTBOUND, 17856a800098SYoshinobu Inoue NULL); 17866a800098SYoshinobu Inoue 17876a800098SYoshinobu Inoue /* 17886a800098SYoshinobu Inoue * find the correct route for outer IPv4 17896a800098SYoshinobu Inoue * header, compute tunnel MTU. 17906a800098SYoshinobu Inoue * 17916a800098SYoshinobu Inoue * XXX BUG ALERT 17926a800098SYoshinobu Inoue * The "dummyifp" code relies upon the fact 17936a800098SYoshinobu Inoue * that icmp_error() touches only ifp->if_mtu. 17946a800098SYoshinobu Inoue */ 17956a800098SYoshinobu Inoue /*XXX*/ 17966a800098SYoshinobu Inoue destifp = NULL; 17976a800098SYoshinobu Inoue if (sp->req != NULL 17986a800098SYoshinobu Inoue && sp->req->sav != NULL 17996a800098SYoshinobu Inoue && sp->req->sav->sah != NULL) { 18006a800098SYoshinobu Inoue ro = &sp->req->sav->sah->sa_route; 18016a800098SYoshinobu Inoue if (ro->ro_rt && ro->ro_rt->rt_ifp) { 18026a800098SYoshinobu Inoue dummyifp.if_mtu = 18036a800098SYoshinobu Inoue ro->ro_rt->rt_ifp->if_mtu; 18046a800098SYoshinobu Inoue dummyifp.if_mtu -= ipsechdr; 18056a800098SYoshinobu Inoue destifp = &dummyifp; 18066a800098SYoshinobu Inoue } 18076a800098SYoshinobu Inoue } 18086a800098SYoshinobu Inoue 18096a800098SYoshinobu Inoue key_freesp(sp); 18106a800098SYoshinobu Inoue } 18116a800098SYoshinobu Inoue } 18126a800098SYoshinobu Inoue #endif /*IPSEC*/ 1813df8bae1dSRodney W. Grimes ipstat.ips_cantfrag++; 1814df8bae1dSRodney W. Grimes break; 1815df8bae1dSRodney W. Grimes 1816df8bae1dSRodney W. Grimes case ENOBUFS: 1817df8bae1dSRodney W. Grimes type = ICMP_SOURCEQUENCH; 1818df8bae1dSRodney W. Grimes code = 0; 1819df8bae1dSRodney W. Grimes break; 18203a06e3e0SRuslan Ermilov 18213a06e3e0SRuslan Ermilov case EACCES: /* ipfw denied packet */ 18223a06e3e0SRuslan Ermilov m_freem(mcopy); 18233a06e3e0SRuslan Ermilov return; 1824df8bae1dSRodney W. Grimes } 1825df8bae1dSRodney W. Grimes icmp_error(mcopy, type, code, dest, destifp); 1826df8bae1dSRodney W. Grimes } 1827df8bae1dSRodney W. Grimes 182882c23ebaSBill Fenner void 182982c23ebaSBill Fenner ip_savecontrol(inp, mp, ip, m) 183082c23ebaSBill Fenner register struct inpcb *inp; 183182c23ebaSBill Fenner register struct mbuf **mp; 183282c23ebaSBill Fenner register struct ip *ip; 183382c23ebaSBill Fenner register struct mbuf *m; 183482c23ebaSBill Fenner { 183582c23ebaSBill Fenner if (inp->inp_socket->so_options & SO_TIMESTAMP) { 183682c23ebaSBill Fenner struct timeval tv; 183782c23ebaSBill Fenner 183882c23ebaSBill Fenner microtime(&tv); 183982c23ebaSBill Fenner *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv), 184082c23ebaSBill Fenner SCM_TIMESTAMP, SOL_SOCKET); 184182c23ebaSBill Fenner if (*mp) 184282c23ebaSBill Fenner mp = &(*mp)->m_next; 184382c23ebaSBill Fenner } 184482c23ebaSBill Fenner if (inp->inp_flags & INP_RECVDSTADDR) { 184582c23ebaSBill Fenner *mp = sbcreatecontrol((caddr_t) &ip->ip_dst, 184682c23ebaSBill Fenner sizeof(struct in_addr), IP_RECVDSTADDR, IPPROTO_IP); 184782c23ebaSBill Fenner if (*mp) 184882c23ebaSBill Fenner mp = &(*mp)->m_next; 184982c23ebaSBill Fenner } 185082c23ebaSBill Fenner #ifdef notyet 185182c23ebaSBill Fenner /* XXX 185282c23ebaSBill Fenner * Moving these out of udp_input() made them even more broken 185382c23ebaSBill Fenner * than they already were. 185482c23ebaSBill Fenner */ 185582c23ebaSBill Fenner /* options were tossed already */ 185682c23ebaSBill Fenner if (inp->inp_flags & INP_RECVOPTS) { 185782c23ebaSBill Fenner *mp = sbcreatecontrol((caddr_t) opts_deleted_above, 185882c23ebaSBill Fenner sizeof(struct in_addr), IP_RECVOPTS, IPPROTO_IP); 185982c23ebaSBill Fenner if (*mp) 186082c23ebaSBill Fenner mp = &(*mp)->m_next; 186182c23ebaSBill Fenner } 186282c23ebaSBill Fenner /* ip_srcroute doesn't do what we want here, need to fix */ 186382c23ebaSBill Fenner if (inp->inp_flags & INP_RECVRETOPTS) { 186482c23ebaSBill Fenner *mp = sbcreatecontrol((caddr_t) ip_srcroute(), 186582c23ebaSBill Fenner sizeof(struct in_addr), IP_RECVRETOPTS, IPPROTO_IP); 186682c23ebaSBill Fenner if (*mp) 186782c23ebaSBill Fenner mp = &(*mp)->m_next; 186882c23ebaSBill Fenner } 186982c23ebaSBill Fenner #endif 187082c23ebaSBill Fenner if (inp->inp_flags & INP_RECVIF) { 1871d314ad7bSJulian Elischer struct ifnet *ifp; 1872d314ad7bSJulian Elischer struct sdlbuf { 187382c23ebaSBill Fenner struct sockaddr_dl sdl; 1874d314ad7bSJulian Elischer u_char pad[32]; 1875d314ad7bSJulian Elischer } sdlbuf; 1876d314ad7bSJulian Elischer struct sockaddr_dl *sdp; 1877d314ad7bSJulian Elischer struct sockaddr_dl *sdl2 = &sdlbuf.sdl; 187882c23ebaSBill Fenner 1879d314ad7bSJulian Elischer if (((ifp = m->m_pkthdr.rcvif)) 1880d314ad7bSJulian Elischer && ( ifp->if_index && (ifp->if_index <= if_index))) { 1881f9132cebSJonathan Lemon sdp = (struct sockaddr_dl *) 1882f9132cebSJonathan Lemon (ifaddr_byindex(ifp->if_index)->ifa_addr); 1883d314ad7bSJulian Elischer /* 1884d314ad7bSJulian Elischer * Change our mind and don't try copy. 1885d314ad7bSJulian Elischer */ 1886d314ad7bSJulian Elischer if ((sdp->sdl_family != AF_LINK) 1887d314ad7bSJulian Elischer || (sdp->sdl_len > sizeof(sdlbuf))) { 1888d314ad7bSJulian Elischer goto makedummy; 1889d314ad7bSJulian Elischer } 1890d314ad7bSJulian Elischer bcopy(sdp, sdl2, sdp->sdl_len); 1891d314ad7bSJulian Elischer } else { 1892d314ad7bSJulian Elischer makedummy: 1893d314ad7bSJulian Elischer sdl2->sdl_len 1894d314ad7bSJulian Elischer = offsetof(struct sockaddr_dl, sdl_data[0]); 1895d314ad7bSJulian Elischer sdl2->sdl_family = AF_LINK; 1896d314ad7bSJulian Elischer sdl2->sdl_index = 0; 1897d314ad7bSJulian Elischer sdl2->sdl_nlen = sdl2->sdl_alen = sdl2->sdl_slen = 0; 1898d314ad7bSJulian Elischer } 1899d314ad7bSJulian Elischer *mp = sbcreatecontrol((caddr_t) sdl2, sdl2->sdl_len, 190082c23ebaSBill Fenner IP_RECVIF, IPPROTO_IP); 190182c23ebaSBill Fenner if (*mp) 190282c23ebaSBill Fenner mp = &(*mp)->m_next; 190382c23ebaSBill Fenner } 190482c23ebaSBill Fenner } 190582c23ebaSBill Fenner 1906df8bae1dSRodney W. Grimes int 1907f0068c4aSGarrett Wollman ip_rsvp_init(struct socket *so) 1908f0068c4aSGarrett Wollman { 1909f0068c4aSGarrett Wollman if (so->so_type != SOCK_RAW || 1910f0068c4aSGarrett Wollman so->so_proto->pr_protocol != IPPROTO_RSVP) 1911f0068c4aSGarrett Wollman return EOPNOTSUPP; 1912f0068c4aSGarrett Wollman 1913f0068c4aSGarrett Wollman if (ip_rsvpd != NULL) 1914f0068c4aSGarrett Wollman return EADDRINUSE; 1915f0068c4aSGarrett Wollman 1916f0068c4aSGarrett Wollman ip_rsvpd = so; 19171c5de19aSGarrett Wollman /* 19181c5de19aSGarrett Wollman * This may seem silly, but we need to be sure we don't over-increment 19191c5de19aSGarrett Wollman * the RSVP counter, in case something slips up. 19201c5de19aSGarrett Wollman */ 19211c5de19aSGarrett Wollman if (!ip_rsvp_on) { 19221c5de19aSGarrett Wollman ip_rsvp_on = 1; 19231c5de19aSGarrett Wollman rsvp_on++; 19241c5de19aSGarrett Wollman } 1925f0068c4aSGarrett Wollman 1926f0068c4aSGarrett Wollman return 0; 1927f0068c4aSGarrett Wollman } 1928f0068c4aSGarrett Wollman 1929f0068c4aSGarrett Wollman int 1930f0068c4aSGarrett Wollman ip_rsvp_done(void) 1931f0068c4aSGarrett Wollman { 1932f0068c4aSGarrett Wollman ip_rsvpd = NULL; 19331c5de19aSGarrett Wollman /* 19341c5de19aSGarrett Wollman * This may seem silly, but we need to be sure we don't over-decrement 19351c5de19aSGarrett Wollman * the RSVP counter, in case something slips up. 19361c5de19aSGarrett Wollman */ 19371c5de19aSGarrett Wollman if (ip_rsvp_on) { 19381c5de19aSGarrett Wollman ip_rsvp_on = 0; 19391c5de19aSGarrett Wollman rsvp_on--; 19401c5de19aSGarrett Wollman } 1941f0068c4aSGarrett Wollman return 0; 1942f0068c4aSGarrett Wollman } 1943