1c398230bSWarner Losh /*- 2df8bae1dSRodney W. Grimes * Copyright (c) 1982, 1986, 1988, 1993 3df8bae1dSRodney W. Grimes * The Regents of the University of California. All rights reserved. 4df8bae1dSRodney W. Grimes * 5df8bae1dSRodney W. Grimes * Redistribution and use in source and binary forms, with or without 6df8bae1dSRodney W. Grimes * modification, are permitted provided that the following conditions 7df8bae1dSRodney W. Grimes * are met: 8df8bae1dSRodney W. Grimes * 1. Redistributions of source code must retain the above copyright 9df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer. 10df8bae1dSRodney W. Grimes * 2. Redistributions in binary form must reproduce the above copyright 11df8bae1dSRodney W. Grimes * notice, this list of conditions and the following disclaimer in the 12df8bae1dSRodney W. Grimes * documentation and/or other materials provided with the distribution. 13df8bae1dSRodney W. Grimes * 4. Neither the name of the University nor the names of its contributors 14df8bae1dSRodney W. Grimes * may be used to endorse or promote products derived from this software 15df8bae1dSRodney W. Grimes * without specific prior written permission. 16df8bae1dSRodney W. Grimes * 17df8bae1dSRodney W. Grimes * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18df8bae1dSRodney W. Grimes * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19df8bae1dSRodney W. Grimes * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20df8bae1dSRodney W. Grimes * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21df8bae1dSRodney W. Grimes * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22df8bae1dSRodney W. Grimes * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23df8bae1dSRodney W. Grimes * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24df8bae1dSRodney W. Grimes * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25df8bae1dSRodney W. Grimes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26df8bae1dSRodney W. Grimes * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27df8bae1dSRodney W. Grimes * SUCH DAMAGE. 28df8bae1dSRodney W. Grimes * 29df8bae1dSRodney W. Grimes * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 30df8bae1dSRodney W. Grimes */ 31df8bae1dSRodney W. Grimes 324b421e2dSMike Silbersack #include <sys/cdefs.h> 334b421e2dSMike Silbersack __FBSDID("$FreeBSD$"); 344b421e2dSMike Silbersack 350ac40133SBrian Somers #include "opt_bootp.h" 3674a9466cSGary Palmer #include "opt_ipfw.h" 3727108a15SDag-Erling Smørgrav #include "opt_ipstealth.h" 386a800098SYoshinobu Inoue #include "opt_ipsec.h" 3933553d6eSBjoern A. Zeeb #include "opt_route.h" 40a9771948SGleb Smirnoff #include "opt_carp.h" 4174a9466cSGary Palmer 42df8bae1dSRodney W. Grimes #include <sys/param.h> 43df8bae1dSRodney W. Grimes #include <sys/systm.h> 445f311da2SMike Silbersack #include <sys/callout.h> 45df8bae1dSRodney W. Grimes #include <sys/mbuf.h> 46b715f178SLuigi Rizzo #include <sys/malloc.h> 47df8bae1dSRodney W. Grimes #include <sys/domain.h> 48df8bae1dSRodney W. Grimes #include <sys/protosw.h> 49df8bae1dSRodney W. Grimes #include <sys/socket.h> 50df8bae1dSRodney W. Grimes #include <sys/time.h> 51df8bae1dSRodney W. Grimes #include <sys/kernel.h> 52385195c0SMarko Zec #include <sys/lock.h> 53385195c0SMarko Zec #include <sys/rwlock.h> 541025071fSGarrett Wollman #include <sys/syslog.h> 55b5e8ce9fSBruce Evans #include <sys/sysctl.h> 56603724d3SBjoern A. Zeeb #include <sys/vimage.h> 57df8bae1dSRodney W. Grimes 58c85540ddSAndrey A. Chernov #include <net/pfil.h> 59df8bae1dSRodney W. Grimes #include <net/if.h> 609494d596SBrooks Davis #include <net/if_types.h> 61d314ad7bSJulian Elischer #include <net/if_var.h> 6282c23ebaSBill Fenner #include <net/if_dl.h> 63df8bae1dSRodney W. Grimes #include <net/route.h> 64748e0b0aSGarrett Wollman #include <net/netisr.h> 654b79449eSBjoern A. Zeeb #include <net/vnet.h> 6665111ec7SKip Macy #include <net/flowtable.h> 67df8bae1dSRodney W. Grimes 68df8bae1dSRodney W. Grimes #include <netinet/in.h> 69df8bae1dSRodney W. Grimes #include <netinet/in_systm.h> 70b5e8ce9fSBruce Evans #include <netinet/in_var.h> 71df8bae1dSRodney W. Grimes #include <netinet/ip.h> 72df8bae1dSRodney W. Grimes #include <netinet/in_pcb.h> 73df8bae1dSRodney W. Grimes #include <netinet/ip_var.h> 74eddfbb76SRobert Watson #include <netinet/ip_fw.h> 75df8bae1dSRodney W. Grimes #include <netinet/ip_icmp.h> 76ef39adf0SAndre Oppermann #include <netinet/ip_options.h> 7758938916SGarrett Wollman #include <machine/in_cksum.h> 78a9771948SGleb Smirnoff #ifdef DEV_CARP 79a9771948SGleb Smirnoff #include <netinet/ip_carp.h> 80a9771948SGleb Smirnoff #endif 81b2630c29SGeorge V. Neville-Neil #ifdef IPSEC 821dfcf0d2SAndre Oppermann #include <netinet/ip_ipsec.h> 83b2630c29SGeorge V. Neville-Neil #endif /* IPSEC */ 84df8bae1dSRodney W. Grimes 85f0068c4aSGarrett Wollman #include <sys/socketvar.h> 866ddbf1e2SGary Palmer 87aed55708SRobert Watson #include <security/mac/mac_framework.h> 88aed55708SRobert Watson 89d2035ffbSEd Maste #ifdef CTASSERT 90d2035ffbSEd Maste CTASSERT(sizeof(struct ip) == 20); 91d2035ffbSEd Maste #endif 92d2035ffbSEd Maste 93eddfbb76SRobert Watson static VNET_DEFINE(int, ipsendredirects) = 1; /* XXX */ 94eddfbb76SRobert Watson static VNET_DEFINE(int, ip_checkinterface); 95eddfbb76SRobert Watson static VNET_DEFINE(int, ip_keepfaith); 96eddfbb76SRobert Watson static VNET_DEFINE(int, ip_sendsourcequench); 97385195c0SMarko Zec 98eddfbb76SRobert Watson #define V_ipsendredirects VNET_GET(ipsendredirects) 99eddfbb76SRobert Watson #define V_ip_checkinterface VNET_GET(ip_checkinterface) 100eddfbb76SRobert Watson #define V_ip_keepfaith VNET_GET(ip_keepfaith) 101eddfbb76SRobert Watson #define V_ip_sendsourcequench VNET_GET(ip_sendsourcequench) 102eddfbb76SRobert Watson 103eddfbb76SRobert Watson VNET_DEFINE(int, ip_defttl) = IPDEFTTL; 104eddfbb76SRobert Watson VNET_DEFINE(int, ip_do_randomid); 105eddfbb76SRobert Watson VNET_DEFINE(int, ipforwarding); 106eddfbb76SRobert Watson 107eddfbb76SRobert Watson VNET_DEFINE(struct in_ifaddrhead, in_ifaddrhead); /* first inet address */ 108eddfbb76SRobert Watson VNET_DEFINE(struct in_ifaddrhashhead *, in_ifaddrhashtbl); /* inet addr hash table */ 109eddfbb76SRobert Watson VNET_DEFINE(u_long, in_ifaddrhmask); /* mask for hash table */ 110eddfbb76SRobert Watson VNET_DEFINE(struct ipstat, ipstat); 111eddfbb76SRobert Watson 112eddfbb76SRobert Watson static VNET_DEFINE(int, ip_rsvp_on); 113eddfbb76SRobert Watson VNET_DEFINE(struct socket *, ip_rsvpd); 114eddfbb76SRobert Watson VNET_DEFINE(int, rsvp_on); 115eddfbb76SRobert Watson 116eddfbb76SRobert Watson #define V_ip_rsvp_on VNET_GET(ip_rsvp_on) 117eddfbb76SRobert Watson 118eddfbb76SRobert Watson static VNET_DEFINE(TAILQ_HEAD(ipqhead, ipq), ipq[IPREASS_NHASH]); 119eddfbb76SRobert Watson static VNET_DEFINE(int, maxnipq); /* Administrative limit on # reass queues. */ 120eddfbb76SRobert Watson static VNET_DEFINE(int, maxfragsperpacket); 121eddfbb76SRobert Watson static VNET_DEFINE(int, nipq); /* Total # of reass queues */ 122eddfbb76SRobert Watson 123eddfbb76SRobert Watson #define V_ipq VNET_GET(ipq) 124eddfbb76SRobert Watson #define V_maxnipq VNET_GET(maxnipq) 125eddfbb76SRobert Watson #define V_maxfragsperpacket VNET_GET(maxfragsperpacket) 126eddfbb76SRobert Watson #define V_nipq VNET_GET(nipq) 127eddfbb76SRobert Watson 128eddfbb76SRobert Watson VNET_DEFINE(int, ipstealth); 12964aeca7bSRobert Watson 1302d9cfabaSRobert Watson struct rwlock in_ifaddr_lock; 13164aeca7bSRobert Watson RW_SYSINIT(in_ifaddr_lock, &in_ifaddr_lock, "in_ifaddr_lock"); 132f0068c4aSGarrett Wollman 133eddfbb76SRobert Watson SYSCTL_VNET_INT(_net_inet_ip, IPCTL_FORWARDING, forwarding, CTLFLAG_RW, 134eddfbb76SRobert Watson &VNET_NAME(ipforwarding), 0, 1358b615593SMarko Zec "Enable IP forwarding between interfaces"); 1360312fbe9SPoul-Henning Kamp 137eddfbb76SRobert Watson SYSCTL_VNET_INT(_net_inet_ip, IPCTL_SENDREDIRECTS, redirect, CTLFLAG_RW, 138eddfbb76SRobert Watson &VNET_NAME(ipsendredirects), 0, 1398b615593SMarko Zec "Enable sending IP redirects"); 1400312fbe9SPoul-Henning Kamp 141eddfbb76SRobert Watson SYSCTL_VNET_INT(_net_inet_ip, IPCTL_DEFTTL, ttl, CTLFLAG_RW, 142eddfbb76SRobert Watson &VNET_NAME(ip_defttl), 0, 143eddfbb76SRobert Watson "Maximum TTL on IP packets"); 1440312fbe9SPoul-Henning Kamp 145eddfbb76SRobert Watson SYSCTL_VNET_INT(_net_inet_ip, IPCTL_KEEPFAITH, keepfaith, CTLFLAG_RW, 146eddfbb76SRobert Watson &VNET_NAME(ip_keepfaith), 0, 1476a800098SYoshinobu Inoue "Enable packet capture for FAITH IPv4->IPv6 translater daemon"); 1486a800098SYoshinobu Inoue 149eddfbb76SRobert Watson SYSCTL_VNET_INT(_net_inet_ip, OID_AUTO, sendsourcequench, CTLFLAG_RW, 150eddfbb76SRobert Watson &VNET_NAME(ip_sendsourcequench), 0, 151df285b3dSMike Silbersack "Enable the transmission of source quench packets"); 152df285b3dSMike Silbersack 153eddfbb76SRobert Watson SYSCTL_VNET_INT(_net_inet_ip, OID_AUTO, random_id, CTLFLAG_RW, 154eddfbb76SRobert Watson &VNET_NAME(ip_do_randomid), 0, 155eddfbb76SRobert Watson "Assign random ip_id values"); 1561f44b0a1SDavid Malone 157823db0e9SDon Lewis /* 158823db0e9SDon Lewis * XXX - Setting ip_checkinterface mostly implements the receive side of 159823db0e9SDon Lewis * the Strong ES model described in RFC 1122, but since the routing table 160a8f12100SDon Lewis * and transmit implementation do not implement the Strong ES model, 161823db0e9SDon Lewis * setting this to 1 results in an odd hybrid. 1623f67c834SDon Lewis * 163a8f12100SDon Lewis * XXX - ip_checkinterface currently must be disabled if you use ipnat 164a8f12100SDon Lewis * to translate the destination address to another local interface. 1653f67c834SDon Lewis * 1663f67c834SDon Lewis * XXX - ip_checkinterface must be disabled if you add IP aliases 1673f67c834SDon Lewis * to the loopback interface instead of the interface where the 1683f67c834SDon Lewis * packets for those addresses are received. 169823db0e9SDon Lewis */ 170eddfbb76SRobert Watson SYSCTL_VNET_INT(_net_inet_ip, OID_AUTO, check_interface, CTLFLAG_RW, 171eddfbb76SRobert Watson &VNET_NAME(ip_checkinterface), 0, 1728b615593SMarko Zec "Verify packet arrives on correct interface"); 173b3e95d4eSJonathan Lemon 174c21fd232SAndre Oppermann struct pfil_head inet_pfil_hook; /* Packet filter hooks */ 175df8bae1dSRodney W. Grimes 176d4b5cae4SRobert Watson static struct netisr_handler ip_nh = { 177d4b5cae4SRobert Watson .nh_name = "ip", 178d4b5cae4SRobert Watson .nh_handler = ip_input, 179d4b5cae4SRobert Watson .nh_proto = NETISR_IP, 180d4b5cae4SRobert Watson .nh_policy = NETISR_POLICY_FLOW, 181d4b5cae4SRobert Watson }; 182ca925d9cSJonathan Lemon 183df8bae1dSRodney W. Grimes extern struct domain inetdomain; 184f0ffb944SJulian Elischer extern struct protosw inetsw[]; 185df8bae1dSRodney W. Grimes u_char ip_protox[IPPROTO_MAX]; 186ca925d9cSJonathan Lemon 187eddfbb76SRobert Watson SYSCTL_VNET_STRUCT(_net_inet_ip, IPCTL_STATS, stats, CTLFLAG_RW, 188eddfbb76SRobert Watson &VNET_NAME(ipstat), ipstat, 189eddfbb76SRobert Watson "IP statistics (struct ipstat, netinet/ip_var.h)"); 190df8bae1dSRodney W. Grimes 191eddfbb76SRobert Watson static VNET_DEFINE(uma_zone_t, ipq_zone); 192eddfbb76SRobert Watson #define V_ipq_zone VNET_GET(ipq_zone) 193194a213eSAndrey A. Chernov 194dfa60d93SRobert Watson static struct mtx ipqlock; 1952fad1e93SSam Leffler 1962fad1e93SSam Leffler #define IPQ_LOCK() mtx_lock(&ipqlock) 1972fad1e93SSam Leffler #define IPQ_UNLOCK() mtx_unlock(&ipqlock) 198888c2a3cSSam Leffler #define IPQ_LOCK_INIT() mtx_init(&ipqlock, "ipqlock", NULL, MTX_DEF) 199888c2a3cSSam Leffler #define IPQ_LOCK_ASSERT() mtx_assert(&ipqlock, MA_OWNED) 200f23b4c91SGarrett Wollman 201d248c7d7SRobert Watson static void maxnipq_update(void); 2024f590175SPaul Saab static void ipq_zone_change(void *); 203d248c7d7SRobert Watson 204eddfbb76SRobert Watson SYSCTL_VNET_INT(_net_inet_ip, OID_AUTO, fragpackets, CTLFLAG_RD, 205eddfbb76SRobert Watson &VNET_NAME(nipq), 0, 2068b615593SMarko Zec "Current number of IPv4 fragment reassembly queue entries"); 207d248c7d7SRobert Watson 208eddfbb76SRobert Watson SYSCTL_VNET_INT(_net_inet_ip, OID_AUTO, maxfragsperpacket, CTLFLAG_RW, 209eddfbb76SRobert Watson &VNET_NAME(maxfragsperpacket), 0, 210d248c7d7SRobert Watson "Maximum number of IPv4 fragments allowed per packet"); 211d248c7d7SRobert Watson 212d248c7d7SRobert Watson struct callout ipport_tick_callout; 213d248c7d7SRobert Watson 2140312fbe9SPoul-Henning Kamp #ifdef IPCTL_DEFMTU 2150312fbe9SPoul-Henning Kamp SYSCTL_INT(_net_inet_ip, IPCTL_DEFMTU, mtu, CTLFLAG_RW, 2163d177f46SBill Fumerola &ip_mtu, 0, "Default MTU"); 2170312fbe9SPoul-Henning Kamp #endif 2180312fbe9SPoul-Henning Kamp 2191b968362SDag-Erling Smørgrav #ifdef IPSTEALTH 220eddfbb76SRobert Watson SYSCTL_VNET_INT(_net_inet_ip, OID_AUTO, stealth, CTLFLAG_RW, 221eddfbb76SRobert Watson &VNET_NAME(ipstealth), 0, 222eddfbb76SRobert Watson "IP stealth mode, no TTL decrementation on forwarding"); 2231b968362SDag-Erling Smørgrav #endif 224eddfbb76SRobert Watson 22553be8fcaSBjoern A. Zeeb #ifdef FLOWTABLE 226eddfbb76SRobert Watson static VNET_DEFINE(int, ip_output_flowtable_size) = 2048; 227eddfbb76SRobert Watson VNET_DEFINE(struct flowtable *, ip_ft); 228eddfbb76SRobert Watson #define V_ip_output_flowtable_size VNET_GET(ip_output_flowtable_size) 229eddfbb76SRobert Watson 230eddfbb76SRobert Watson SYSCTL_VNET_INT(_net_inet_ip, OID_AUTO, output_flowtable_size, CTLFLAG_RDTUN, 231eddfbb76SRobert Watson &VNET_NAME(ip_output_flowtable_size), 2048, 23265111ec7SKip Macy "number of entries in the per-cpu output flow caches"); 23353be8fcaSBjoern A. Zeeb #endif 23453be8fcaSBjoern A. Zeeb 235eddfbb76SRobert Watson VNET_DEFINE(int, fw_one_pass) = 1; 236010b65f5SJulian Elischer 2374d77a549SAlfred Perlstein static void ip_freef(struct ipqhead *, struct ipq *); 2388948e4baSArchie Cobbs 239eddfbb76SRobert Watson #ifdef VIMAGE 240eddfbb76SRobert Watson /* XXX only has to stay for .vmi_dependson elsewhere. */ 241bfe1aba4SMarko Zec static void vnet_inet_register(void); 242bfe1aba4SMarko Zec 243bfe1aba4SMarko Zec static const vnet_modinfo_t vnet_inet_modinfo = { 244bfe1aba4SMarko Zec .vmi_id = VNET_MOD_INET, 245bfe1aba4SMarko Zec .vmi_name = "inet", 246bfe1aba4SMarko Zec }; 247bfe1aba4SMarko Zec 248bfe1aba4SMarko Zec static void vnet_inet_register() 249bfe1aba4SMarko Zec { 250bfe1aba4SMarko Zec 251bfe1aba4SMarko Zec vnet_mod_register(&vnet_inet_modinfo); 252bfe1aba4SMarko Zec } 253bfe1aba4SMarko Zec 254bfe1aba4SMarko Zec SYSINIT(inet, SI_SUB_PROTO_BEGIN, SI_ORDER_FIRST, vnet_inet_register, 0); 255bfe1aba4SMarko Zec #endif 256bfe1aba4SMarko Zec 257d4b5cae4SRobert Watson static int 258d4b5cae4SRobert Watson sysctl_netinet_intr_queue_maxlen(SYSCTL_HANDLER_ARGS) 259d4b5cae4SRobert Watson { 260d4b5cae4SRobert Watson int error, qlimit; 261d4b5cae4SRobert Watson 262d4b5cae4SRobert Watson netisr_getqlimit(&ip_nh, &qlimit); 263d4b5cae4SRobert Watson error = sysctl_handle_int(oidp, &qlimit, 0, req); 264d4b5cae4SRobert Watson if (error || !req->newptr) 265d4b5cae4SRobert Watson return (error); 266d4b5cae4SRobert Watson if (qlimit < 1) 267d4b5cae4SRobert Watson return (EINVAL); 268d4b5cae4SRobert Watson return (netisr_setqlimit(&ip_nh, qlimit)); 269d4b5cae4SRobert Watson } 270d4b5cae4SRobert Watson SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQMAXLEN, intr_queue_maxlen, 271d4b5cae4SRobert Watson CTLTYPE_INT|CTLFLAG_RW, 0, 0, sysctl_netinet_intr_queue_maxlen, "I", 272d4b5cae4SRobert Watson "Maximum size of the IP input queue"); 273d4b5cae4SRobert Watson 274d4b5cae4SRobert Watson static int 275d4b5cae4SRobert Watson sysctl_netinet_intr_queue_drops(SYSCTL_HANDLER_ARGS) 276d4b5cae4SRobert Watson { 277d4b5cae4SRobert Watson u_int64_t qdrops_long; 278d4b5cae4SRobert Watson int error, qdrops; 279d4b5cae4SRobert Watson 280d4b5cae4SRobert Watson netisr_getqdrops(&ip_nh, &qdrops_long); 281d4b5cae4SRobert Watson qdrops = qdrops_long; 282d4b5cae4SRobert Watson error = sysctl_handle_int(oidp, &qdrops, 0, req); 283d4b5cae4SRobert Watson if (error || !req->newptr) 284d4b5cae4SRobert Watson return (error); 285d4b5cae4SRobert Watson if (qdrops != 0) 286d4b5cae4SRobert Watson return (EINVAL); 287d4b5cae4SRobert Watson netisr_clearqdrops(&ip_nh); 288d4b5cae4SRobert Watson return (0); 289d4b5cae4SRobert Watson } 290d4b5cae4SRobert Watson 291d4b5cae4SRobert Watson SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQDROPS, intr_queue_drops, 292d4b5cae4SRobert Watson CTLTYPE_INT|CTLFLAG_RD, 0, 0, sysctl_netinet_intr_queue_drops, "I", 293d4b5cae4SRobert Watson "Number of packets dropped from the IP input queue"); 294d4b5cae4SRobert Watson 295df8bae1dSRodney W. Grimes /* 296df8bae1dSRodney W. Grimes * IP initialization: fill in IP protocol switch table. 297df8bae1dSRodney W. Grimes * All protocols not implemented in kernel go to raw IP protocol handler. 298df8bae1dSRodney W. Grimes */ 299df8bae1dSRodney W. Grimes void 300f2565d68SRobert Watson ip_init(void) 301df8bae1dSRodney W. Grimes { 302f2565d68SRobert Watson struct protosw *pr; 303f2565d68SRobert Watson int i; 304df8bae1dSRodney W. Grimes 3051ed81b73SMarko Zec V_ip_id = time_second & 0xffff; 30644e33a07SMarko Zec 307603724d3SBjoern A. Zeeb TAILQ_INIT(&V_in_ifaddrhead); 308603724d3SBjoern A. Zeeb V_in_ifaddrhashtbl = hashinit(INADDR_NHASH, M_IFADDR, &V_in_ifaddrhmask); 3091ed81b73SMarko Zec 3101ed81b73SMarko Zec /* Initialize IP reassembly queue. */ 3111ed81b73SMarko Zec for (i = 0; i < IPREASS_NHASH; i++) 3121ed81b73SMarko Zec TAILQ_INIT(&V_ipq[i]); 3131ed81b73SMarko Zec V_maxnipq = nmbclusters / 32; 3141ed81b73SMarko Zec V_maxfragsperpacket = 16; 3151ed81b73SMarko Zec V_ipq_zone = uma_zcreate("ipq", sizeof(struct ipq), NULL, NULL, NULL, 3161ed81b73SMarko Zec NULL, UMA_ALIGN_PTR, 0); 3171ed81b73SMarko Zec maxnipq_update(); 3181ed81b73SMarko Zec 319fa057b15SMarko Zec #ifdef FLOWTABLE 320fa057b15SMarko Zec TUNABLE_INT_FETCH("net.inet.ip.output_flowtable_size", 321fa057b15SMarko Zec &V_ip_output_flowtable_size); 322fa057b15SMarko Zec V_ip_ft = flowtable_alloc(V_ip_output_flowtable_size, FL_PCPU); 323fa057b15SMarko Zec #endif 324fa057b15SMarko Zec 3251ed81b73SMarko Zec /* Skip initialization of globals for non-default instances. */ 3261ed81b73SMarko Zec if (!IS_DEFAULT_VNET(curvnet)) 3271ed81b73SMarko Zec return; 3281ed81b73SMarko Zec 329f0ffb944SJulian Elischer pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 33002410549SRobert Watson if (pr == NULL) 331db09bef3SAndre Oppermann panic("ip_init: PF_INET not found"); 332db09bef3SAndre Oppermann 333db09bef3SAndre Oppermann /* Initialize the entire ip_protox[] array to IPPROTO_RAW. */ 334df8bae1dSRodney W. Grimes for (i = 0; i < IPPROTO_MAX; i++) 335df8bae1dSRodney W. Grimes ip_protox[i] = pr - inetsw; 336db09bef3SAndre Oppermann /* 337db09bef3SAndre Oppermann * Cycle through IP protocols and put them into the appropriate place 338db09bef3SAndre Oppermann * in ip_protox[]. 339db09bef3SAndre Oppermann */ 340f0ffb944SJulian Elischer for (pr = inetdomain.dom_protosw; 341f0ffb944SJulian Elischer pr < inetdomain.dom_protoswNPROTOSW; pr++) 342df8bae1dSRodney W. Grimes if (pr->pr_domain->dom_family == PF_INET && 343db09bef3SAndre Oppermann pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) { 344db09bef3SAndre Oppermann /* Be careful to only index valid IP protocols. */ 345db77984cSSam Leffler if (pr->pr_protocol < IPPROTO_MAX) 346df8bae1dSRodney W. Grimes ip_protox[pr->pr_protocol] = pr - inetsw; 347db09bef3SAndre Oppermann } 348194a213eSAndrey A. Chernov 349c21fd232SAndre Oppermann /* Initialize packet filter hooks. */ 350134ea224SSam Leffler inet_pfil_hook.ph_type = PFIL_TYPE_AF; 351134ea224SSam Leffler inet_pfil_hook.ph_af = AF_INET; 352134ea224SSam Leffler if ((i = pfil_head_register(&inet_pfil_hook)) != 0) 353134ea224SSam Leffler printf("%s: WARNING: unable to register pfil hook, " 354134ea224SSam Leffler "error %d\n", __func__, i); 355134ea224SSam Leffler 3565f311da2SMike Silbersack /* Start ipport_tick. */ 3575f311da2SMike Silbersack callout_init(&ipport_tick_callout, CALLOUT_MPSAFE); 35821ca7b57SMarko Zec callout_reset(&ipport_tick_callout, 1, ipport_tick, NULL); 3595f311da2SMike Silbersack EVENTHANDLER_REGISTER(shutdown_pre_sync, ip_fini, NULL, 3605f311da2SMike Silbersack SHUTDOWN_PRI_DEFAULT); 3614f590175SPaul Saab EVENTHANDLER_REGISTER(nmbclusters_change, ipq_zone_change, 3624f590175SPaul Saab NULL, EVENTHANDLER_PRI_ANY); 3635f311da2SMike Silbersack 364db09bef3SAndre Oppermann /* Initialize various other remaining things. */ 3651ed81b73SMarko Zec IPQ_LOCK_INIT(); 366d4b5cae4SRobert Watson netisr_register(&ip_nh); 367df8bae1dSRodney W. Grimes } 368df8bae1dSRodney W. Grimes 369f2565d68SRobert Watson void 370f2565d68SRobert Watson ip_fini(void *xtp) 3715f311da2SMike Silbersack { 372f2565d68SRobert Watson 3735f311da2SMike Silbersack callout_stop(&ipport_tick_callout); 3745f311da2SMike Silbersack } 3755f311da2SMike Silbersack 3764d2e3692SLuigi Rizzo /* 377df8bae1dSRodney W. Grimes * Ip input routine. Checksum and byte swap header. If fragmented 378df8bae1dSRodney W. Grimes * try to reassemble. Process options. Pass to next level. 379df8bae1dSRodney W. Grimes */ 380c67b1d17SGarrett Wollman void 381c67b1d17SGarrett Wollman ip_input(struct mbuf *m) 382df8bae1dSRodney W. Grimes { 3839188b4a1SAndre Oppermann struct ip *ip = NULL; 3845da9f8faSJosef Karthauser struct in_ifaddr *ia = NULL; 385ca925d9cSJonathan Lemon struct ifaddr *ifa; 3860aade26eSRobert Watson struct ifnet *ifp; 3879b932e9eSAndre Oppermann int checkif, hlen = 0; 38847c861ecSBrian Somers u_short sum; 38902c1c707SAndre Oppermann int dchg = 0; /* dest changed after fw */ 390f51f805fSSam Leffler struct in_addr odst; /* original dst address */ 391b715f178SLuigi Rizzo 392fe584538SDag-Erling Smørgrav M_ASSERTPKTHDR(m); 393db40007dSAndrew R. Reiter 394ac9d7e26SMax Laier if (m->m_flags & M_FASTFWD_OURS) { 3959b932e9eSAndre Oppermann /* 39676ff6dcfSAndre Oppermann * Firewall or NAT changed destination to local. 39776ff6dcfSAndre Oppermann * We expect ip_len and ip_off to be in host byte order. 3989b932e9eSAndre Oppermann */ 39976ff6dcfSAndre Oppermann m->m_flags &= ~M_FASTFWD_OURS; 40076ff6dcfSAndre Oppermann /* Set up some basics that will be used later. */ 4012b25acc1SLuigi Rizzo ip = mtod(m, struct ip *); 40253be11f6SPoul-Henning Kamp hlen = ip->ip_hl << 2; 4039b932e9eSAndre Oppermann goto ours; 4042b25acc1SLuigi Rizzo } 4052b25acc1SLuigi Rizzo 40686425c62SRobert Watson IPSTAT_INC(ips_total); 40758938916SGarrett Wollman 40858938916SGarrett Wollman if (m->m_pkthdr.len < sizeof(struct ip)) 40958938916SGarrett Wollman goto tooshort; 41058938916SGarrett Wollman 411df8bae1dSRodney W. Grimes if (m->m_len < sizeof (struct ip) && 4120b17fba7SAndre Oppermann (m = m_pullup(m, sizeof (struct ip))) == NULL) { 41386425c62SRobert Watson IPSTAT_INC(ips_toosmall); 414c67b1d17SGarrett Wollman return; 415df8bae1dSRodney W. Grimes } 416df8bae1dSRodney W. Grimes ip = mtod(m, struct ip *); 41758938916SGarrett Wollman 41853be11f6SPoul-Henning Kamp if (ip->ip_v != IPVERSION) { 41986425c62SRobert Watson IPSTAT_INC(ips_badvers); 420df8bae1dSRodney W. Grimes goto bad; 421df8bae1dSRodney W. Grimes } 42258938916SGarrett Wollman 42353be11f6SPoul-Henning Kamp hlen = ip->ip_hl << 2; 424df8bae1dSRodney W. Grimes if (hlen < sizeof(struct ip)) { /* minimum header length */ 42586425c62SRobert Watson IPSTAT_INC(ips_badhlen); 426df8bae1dSRodney W. Grimes goto bad; 427df8bae1dSRodney W. Grimes } 428df8bae1dSRodney W. Grimes if (hlen > m->m_len) { 4290b17fba7SAndre Oppermann if ((m = m_pullup(m, hlen)) == NULL) { 43086425c62SRobert Watson IPSTAT_INC(ips_badhlen); 431c67b1d17SGarrett Wollman return; 432df8bae1dSRodney W. Grimes } 433df8bae1dSRodney W. Grimes ip = mtod(m, struct ip *); 434df8bae1dSRodney W. Grimes } 43533841545SHajimu UMEMOTO 43633841545SHajimu UMEMOTO /* 127/8 must not appear on wire - RFC1122 */ 4370aade26eSRobert Watson ifp = m->m_pkthdr.rcvif; 43833841545SHajimu UMEMOTO if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 43933841545SHajimu UMEMOTO (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) { 4400aade26eSRobert Watson if ((ifp->if_flags & IFF_LOOPBACK) == 0) { 44186425c62SRobert Watson IPSTAT_INC(ips_badaddr); 44233841545SHajimu UMEMOTO goto bad; 44333841545SHajimu UMEMOTO } 44433841545SHajimu UMEMOTO } 44533841545SHajimu UMEMOTO 446db4f9cc7SJonathan Lemon if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) { 447db4f9cc7SJonathan Lemon sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID); 448db4f9cc7SJonathan Lemon } else { 44958938916SGarrett Wollman if (hlen == sizeof(struct ip)) { 45047c861ecSBrian Somers sum = in_cksum_hdr(ip); 45158938916SGarrett Wollman } else { 45247c861ecSBrian Somers sum = in_cksum(m, hlen); 45358938916SGarrett Wollman } 454db4f9cc7SJonathan Lemon } 45547c861ecSBrian Somers if (sum) { 45686425c62SRobert Watson IPSTAT_INC(ips_badsum); 457df8bae1dSRodney W. Grimes goto bad; 458df8bae1dSRodney W. Grimes } 459df8bae1dSRodney W. Grimes 46002b199f1SMax Laier #ifdef ALTQ 46102b199f1SMax Laier if (altq_input != NULL && (*altq_input)(m, AF_INET) == 0) 46202b199f1SMax Laier /* packet is dropped by traffic conditioner */ 46302b199f1SMax Laier return; 46402b199f1SMax Laier #endif 46502b199f1SMax Laier 466df8bae1dSRodney W. Grimes /* 467df8bae1dSRodney W. Grimes * Convert fields to host representation. 468df8bae1dSRodney W. Grimes */ 469fd8e4ebcSMike Barcroft ip->ip_len = ntohs(ip->ip_len); 470df8bae1dSRodney W. Grimes if (ip->ip_len < hlen) { 47186425c62SRobert Watson IPSTAT_INC(ips_badlen); 472df8bae1dSRodney W. Grimes goto bad; 473df8bae1dSRodney W. Grimes } 474fd8e4ebcSMike Barcroft ip->ip_off = ntohs(ip->ip_off); 475df8bae1dSRodney W. Grimes 476df8bae1dSRodney W. Grimes /* 477df8bae1dSRodney W. Grimes * Check that the amount of data in the buffers 478df8bae1dSRodney W. Grimes * is as at least much as the IP header would have us expect. 479df8bae1dSRodney W. Grimes * Trim mbufs if longer than we expect. 480df8bae1dSRodney W. Grimes * Drop packet if shorter than we expect. 481df8bae1dSRodney W. Grimes */ 482df8bae1dSRodney W. Grimes if (m->m_pkthdr.len < ip->ip_len) { 48358938916SGarrett Wollman tooshort: 48486425c62SRobert Watson IPSTAT_INC(ips_tooshort); 485df8bae1dSRodney W. Grimes goto bad; 486df8bae1dSRodney W. Grimes } 487df8bae1dSRodney W. Grimes if (m->m_pkthdr.len > ip->ip_len) { 488df8bae1dSRodney W. Grimes if (m->m_len == m->m_pkthdr.len) { 489df8bae1dSRodney W. Grimes m->m_len = ip->ip_len; 490df8bae1dSRodney W. Grimes m->m_pkthdr.len = ip->ip_len; 491df8bae1dSRodney W. Grimes } else 492df8bae1dSRodney W. Grimes m_adj(m, ip->ip_len - m->m_pkthdr.len); 493df8bae1dSRodney W. Grimes } 494b2630c29SGeorge V. Neville-Neil #ifdef IPSEC 49514dd6717SSam Leffler /* 49614dd6717SSam Leffler * Bypass packet filtering for packets from a tunnel (gif). 49714dd6717SSam Leffler */ 498cc977adcSBjoern A. Zeeb if (ip_ipsec_filtertunnel(m)) 499c21fd232SAndre Oppermann goto passin; 500b2630c29SGeorge V. Neville-Neil #endif /* IPSEC */ 5013f67c834SDon Lewis 502c4ac87eaSDarren Reed /* 503134ea224SSam Leffler * Run through list of hooks for input packets. 504f51f805fSSam Leffler * 505f51f805fSSam Leffler * NB: Beware of the destination address changing (e.g. 506f51f805fSSam Leffler * by NAT rewriting). When this happens, tell 507f51f805fSSam Leffler * ip_forward to do the right thing. 508c4ac87eaSDarren Reed */ 509c21fd232SAndre Oppermann 510c21fd232SAndre Oppermann /* Jump over all PFIL processing if hooks are not active. */ 511604afec4SChristian S.J. Peron if (!PFIL_HOOKED(&inet_pfil_hook)) 512c21fd232SAndre Oppermann goto passin; 513c21fd232SAndre Oppermann 514f51f805fSSam Leffler odst = ip->ip_dst; 5150aade26eSRobert Watson if (pfil_run_hooks(&inet_pfil_hook, &m, ifp, PFIL_IN, NULL) != 0) 516beec8214SDarren Reed return; 517134ea224SSam Leffler if (m == NULL) /* consumed by filter */ 518c4ac87eaSDarren Reed return; 5199b932e9eSAndre Oppermann 520c4ac87eaSDarren Reed ip = mtod(m, struct ip *); 52102c1c707SAndre Oppermann dchg = (odst.s_addr != ip->ip_dst.s_addr); 5220aade26eSRobert Watson ifp = m->m_pkthdr.rcvif; 5239b932e9eSAndre Oppermann 5249b932e9eSAndre Oppermann #ifdef IPFIREWALL_FORWARD 5259b932e9eSAndre Oppermann if (m->m_flags & M_FASTFWD_OURS) { 5269b932e9eSAndre Oppermann m->m_flags &= ~M_FASTFWD_OURS; 5279b932e9eSAndre Oppermann goto ours; 5289b932e9eSAndre Oppermann } 529099dd043SAndre Oppermann if ((dchg = (m_tag_find(m, PACKET_TAG_IPFORWARD, NULL) != NULL)) != 0) { 530099dd043SAndre Oppermann /* 531099dd043SAndre Oppermann * Directly ship on the packet. This allows to forward packets 532099dd043SAndre Oppermann * that were destined for us to some other directly connected 533099dd043SAndre Oppermann * host. 534099dd043SAndre Oppermann */ 535099dd043SAndre Oppermann ip_forward(m, dchg); 536099dd043SAndre Oppermann return; 537099dd043SAndre Oppermann } 5389b932e9eSAndre Oppermann #endif /* IPFIREWALL_FORWARD */ 5399b932e9eSAndre Oppermann 540c21fd232SAndre Oppermann passin: 541df8bae1dSRodney W. Grimes /* 542df8bae1dSRodney W. Grimes * Process options and, if not destined for us, 543df8bae1dSRodney W. Grimes * ship it on. ip_dooptions returns 1 when an 544df8bae1dSRodney W. Grimes * error was detected (causing an icmp message 545df8bae1dSRodney W. Grimes * to be sent and the original packet to be freed). 546df8bae1dSRodney W. Grimes */ 5479b932e9eSAndre Oppermann if (hlen > sizeof (struct ip) && ip_dooptions(m, 0)) 548c67b1d17SGarrett Wollman return; 549df8bae1dSRodney W. Grimes 550f0068c4aSGarrett Wollman /* greedy RSVP, snatches any PATH packet of the RSVP protocol and no 551f0068c4aSGarrett Wollman * matter if it is destined to another node, or whether it is 552f0068c4aSGarrett Wollman * a multicast one, RSVP wants it! and prevents it from being forwarded 553f0068c4aSGarrett Wollman * anywhere else. Also checks if the rsvp daemon is running before 554f0068c4aSGarrett Wollman * grabbing the packet. 555f0068c4aSGarrett Wollman */ 556603724d3SBjoern A. Zeeb if (V_rsvp_on && ip->ip_p==IPPROTO_RSVP) 557f0068c4aSGarrett Wollman goto ours; 558f0068c4aSGarrett Wollman 559df8bae1dSRodney W. Grimes /* 560df8bae1dSRodney W. Grimes * Check our list of addresses, to see if the packet is for us. 561cc766e04SGarrett Wollman * If we don't have any addresses, assume any unicast packet 562cc766e04SGarrett Wollman * we receive might be for us (and let the upper layers deal 563cc766e04SGarrett Wollman * with it). 564df8bae1dSRodney W. Grimes */ 565603724d3SBjoern A. Zeeb if (TAILQ_EMPTY(&V_in_ifaddrhead) && 566cc766e04SGarrett Wollman (m->m_flags & (M_MCAST|M_BCAST)) == 0) 567cc766e04SGarrett Wollman goto ours; 568cc766e04SGarrett Wollman 5697538a9a0SJonathan Lemon /* 570823db0e9SDon Lewis * Enable a consistency check between the destination address 571823db0e9SDon Lewis * and the arrival interface for a unicast packet (the RFC 1122 572823db0e9SDon Lewis * strong ES model) if IP forwarding is disabled and the packet 573e15ae1b2SDon Lewis * is not locally generated and the packet is not subject to 574e15ae1b2SDon Lewis * 'ipfw fwd'. 5753f67c834SDon Lewis * 5763f67c834SDon Lewis * XXX - Checking also should be disabled if the destination 5773f67c834SDon Lewis * address is ipnat'ed to a different interface. 5783f67c834SDon Lewis * 579a8f12100SDon Lewis * XXX - Checking is incompatible with IP aliases added 5803f67c834SDon Lewis * to the loopback interface instead of the interface where 5813f67c834SDon Lewis * the packets are received. 582a9771948SGleb Smirnoff * 583a9771948SGleb Smirnoff * XXX - This is the case for carp vhost IPs as well so we 584a9771948SGleb Smirnoff * insert a workaround. If the packet got here, we already 585a9771948SGleb Smirnoff * checked with carp_iamatch() and carp_forus(). 586823db0e9SDon Lewis */ 587603724d3SBjoern A. Zeeb checkif = V_ip_checkinterface && (V_ipforwarding == 0) && 5880aade26eSRobert Watson ifp != NULL && ((ifp->if_flags & IFF_LOOPBACK) == 0) && 589a9771948SGleb Smirnoff #ifdef DEV_CARP 5900aade26eSRobert Watson !ifp->if_carp && 591a9771948SGleb Smirnoff #endif 5929b932e9eSAndre Oppermann (dchg == 0); 593823db0e9SDon Lewis 594ca925d9cSJonathan Lemon /* 595ca925d9cSJonathan Lemon * Check for exact addresses in the hash bucket. 596ca925d9cSJonathan Lemon */ 5972d9cfabaSRobert Watson /* IN_IFADDR_RLOCK(); */ 5989b932e9eSAndre Oppermann LIST_FOREACH(ia, INADDR_HASH(ip->ip_dst.s_addr), ia_hash) { 599f9e354dfSJulian Elischer /* 600823db0e9SDon Lewis * If the address matches, verify that the packet 601823db0e9SDon Lewis * arrived via the correct interface if checking is 602823db0e9SDon Lewis * enabled. 603f9e354dfSJulian Elischer */ 6049b932e9eSAndre Oppermann if (IA_SIN(ia)->sin_addr.s_addr == ip->ip_dst.s_addr && 6058c0fec80SRobert Watson (!checkif || ia->ia_ifp == ifp)) { 6068c0fec80SRobert Watson ifa_ref(&ia->ia_ifa); 6072d9cfabaSRobert Watson /* IN_IFADDR_RUNLOCK(); */ 608ed1ff184SJulian Elischer goto ours; 609ca925d9cSJonathan Lemon } 6108c0fec80SRobert Watson } 6112d9cfabaSRobert Watson /* IN_IFADDR_RUNLOCK(); */ 6122d9cfabaSRobert Watson 613823db0e9SDon Lewis /* 614ca925d9cSJonathan Lemon * Check for broadcast addresses. 615ca925d9cSJonathan Lemon * 616ca925d9cSJonathan Lemon * Only accept broadcast packets that arrive via the matching 617ca925d9cSJonathan Lemon * interface. Reception of forwarded directed broadcasts would 618ca925d9cSJonathan Lemon * be handled via ip_forward() and ether_output() with the loopback 619ca925d9cSJonathan Lemon * into the stack for SIMPLEX interfaces handled by ether_output(). 620823db0e9SDon Lewis */ 6210aade26eSRobert Watson if (ifp != NULL && ifp->if_flags & IFF_BROADCAST) { 6220aade26eSRobert Watson IF_ADDR_LOCK(ifp); 6230aade26eSRobert Watson TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 624ca925d9cSJonathan Lemon if (ifa->ifa_addr->sa_family != AF_INET) 625ca925d9cSJonathan Lemon continue; 626ca925d9cSJonathan Lemon ia = ifatoia(ifa); 627df8bae1dSRodney W. Grimes if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr == 6280aade26eSRobert Watson ip->ip_dst.s_addr) { 6298c0fec80SRobert Watson ifa_ref(ifa); 6300aade26eSRobert Watson IF_ADDR_UNLOCK(ifp); 631df8bae1dSRodney W. Grimes goto ours; 6320aade26eSRobert Watson } 6330aade26eSRobert Watson if (ia->ia_netbroadcast.s_addr == ip->ip_dst.s_addr) { 6348c0fec80SRobert Watson ifa_ref(ifa); 6350aade26eSRobert Watson IF_ADDR_UNLOCK(ifp); 636df8bae1dSRodney W. Grimes goto ours; 6370aade26eSRobert Watson } 6380ac40133SBrian Somers #ifdef BOOTP_COMPAT 6390aade26eSRobert Watson if (IA_SIN(ia)->sin_addr.s_addr == INADDR_ANY) { 6408c0fec80SRobert Watson ifa_ref(ifa); 6410aade26eSRobert Watson IF_ADDR_UNLOCK(ifp); 642ca925d9cSJonathan Lemon goto ours; 6430aade26eSRobert Watson } 6440ac40133SBrian Somers #endif 645df8bae1dSRodney W. Grimes } 6460aade26eSRobert Watson IF_ADDR_UNLOCK(ifp); 64719e5b0a7SRobert Watson ia = NULL; 648df8bae1dSRodney W. Grimes } 649f8429ca2SBruce M Simpson /* RFC 3927 2.7: Do not forward datagrams for 169.254.0.0/16. */ 650f8429ca2SBruce M Simpson if (IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr))) { 65186425c62SRobert Watson IPSTAT_INC(ips_cantforward); 652f8429ca2SBruce M Simpson m_freem(m); 653f8429ca2SBruce M Simpson return; 654f8429ca2SBruce M Simpson } 655df8bae1dSRodney W. Grimes if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) { 656603724d3SBjoern A. Zeeb if (V_ip_mrouter) { 657df8bae1dSRodney W. Grimes /* 658df8bae1dSRodney W. Grimes * If we are acting as a multicast router, all 659df8bae1dSRodney W. Grimes * incoming multicast packets are passed to the 660df8bae1dSRodney W. Grimes * kernel-level multicast forwarding function. 661df8bae1dSRodney W. Grimes * The packet is returned (relatively) intact; if 662df8bae1dSRodney W. Grimes * ip_mforward() returns a non-zero value, the packet 663df8bae1dSRodney W. Grimes * must be discarded, else it may be accepted below. 664df8bae1dSRodney W. Grimes */ 6650aade26eSRobert Watson if (ip_mforward && ip_mforward(ip, ifp, m, 0) != 0) { 66686425c62SRobert Watson IPSTAT_INC(ips_cantforward); 667df8bae1dSRodney W. Grimes m_freem(m); 668c67b1d17SGarrett Wollman return; 669df8bae1dSRodney W. Grimes } 670df8bae1dSRodney W. Grimes 671df8bae1dSRodney W. Grimes /* 67211612afaSDima Dorfman * The process-level routing daemon needs to receive 673df8bae1dSRodney W. Grimes * all multicast IGMP packets, whether or not this 674df8bae1dSRodney W. Grimes * host belongs to their destination groups. 675df8bae1dSRodney W. Grimes */ 676df8bae1dSRodney W. Grimes if (ip->ip_p == IPPROTO_IGMP) 677df8bae1dSRodney W. Grimes goto ours; 67886425c62SRobert Watson IPSTAT_INC(ips_forward); 679df8bae1dSRodney W. Grimes } 680df8bae1dSRodney W. Grimes /* 681d10910e6SBruce M Simpson * Assume the packet is for us, to avoid prematurely taking 682d10910e6SBruce M Simpson * a lock on the in_multi hash. Protocols must perform 683d10910e6SBruce M Simpson * their own filtering and update statistics accordingly. 684df8bae1dSRodney W. Grimes */ 685df8bae1dSRodney W. Grimes goto ours; 686df8bae1dSRodney W. Grimes } 687df8bae1dSRodney W. Grimes if (ip->ip_dst.s_addr == (u_long)INADDR_BROADCAST) 688df8bae1dSRodney W. Grimes goto ours; 689df8bae1dSRodney W. Grimes if (ip->ip_dst.s_addr == INADDR_ANY) 690df8bae1dSRodney W. Grimes goto ours; 691df8bae1dSRodney W. Grimes 6926a800098SYoshinobu Inoue /* 6936a800098SYoshinobu Inoue * FAITH(Firewall Aided Internet Translator) 6946a800098SYoshinobu Inoue */ 6950aade26eSRobert Watson if (ifp && ifp->if_type == IFT_FAITH) { 696603724d3SBjoern A. Zeeb if (V_ip_keepfaith) { 6976a800098SYoshinobu Inoue if (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_ICMP) 6986a800098SYoshinobu Inoue goto ours; 6996a800098SYoshinobu Inoue } 7006a800098SYoshinobu Inoue m_freem(m); 7016a800098SYoshinobu Inoue return; 7026a800098SYoshinobu Inoue } 7039494d596SBrooks Davis 704df8bae1dSRodney W. Grimes /* 705df8bae1dSRodney W. Grimes * Not for us; forward if possible and desirable. 706df8bae1dSRodney W. Grimes */ 707603724d3SBjoern A. Zeeb if (V_ipforwarding == 0) { 70886425c62SRobert Watson IPSTAT_INC(ips_cantforward); 709df8bae1dSRodney W. Grimes m_freem(m); 710546f251bSChris D. Faulhaber } else { 711b2630c29SGeorge V. Neville-Neil #ifdef IPSEC 7121dfcf0d2SAndre Oppermann if (ip_ipsec_fwd(m)) 713546f251bSChris D. Faulhaber goto bad; 714b2630c29SGeorge V. Neville-Neil #endif /* IPSEC */ 7159b932e9eSAndre Oppermann ip_forward(m, dchg); 716546f251bSChris D. Faulhaber } 717c67b1d17SGarrett Wollman return; 718df8bae1dSRodney W. Grimes 719df8bae1dSRodney W. Grimes ours: 720d0ebc0d2SYaroslav Tykhiy #ifdef IPSTEALTH 721d0ebc0d2SYaroslav Tykhiy /* 722d0ebc0d2SYaroslav Tykhiy * IPSTEALTH: Process non-routing options only 723d0ebc0d2SYaroslav Tykhiy * if the packet is destined for us. 724d0ebc0d2SYaroslav Tykhiy */ 72519e5b0a7SRobert Watson if (V_ipstealth && hlen > sizeof (struct ip) && ip_dooptions(m, 1)) { 72619e5b0a7SRobert Watson if (ia != NULL) 72719e5b0a7SRobert Watson ifa_free(&ia->ia_ifa); 728d0ebc0d2SYaroslav Tykhiy return; 72919e5b0a7SRobert Watson } 730d0ebc0d2SYaroslav Tykhiy #endif /* IPSTEALTH */ 731d0ebc0d2SYaroslav Tykhiy 7325da9f8faSJosef Karthauser /* Count the packet in the ip address stats */ 7335da9f8faSJosef Karthauser if (ia != NULL) { 7345da9f8faSJosef Karthauser ia->ia_ifa.if_ipackets++; 7355da9f8faSJosef Karthauser ia->ia_ifa.if_ibytes += m->m_pkthdr.len; 7368c0fec80SRobert Watson ifa_free(&ia->ia_ifa); 7375da9f8faSJosef Karthauser } 738100ba1a6SJordan K. Hubbard 73963f8d699SJordan K. Hubbard /* 740b6ea1aa5SRuslan Ermilov * Attempt reassembly; if it succeeds, proceed. 741ac9d7e26SMax Laier * ip_reass() will return a different mbuf. 742df8bae1dSRodney W. Grimes */ 743f0cada84SAndre Oppermann if (ip->ip_off & (IP_MF | IP_OFFMASK)) { 744f0cada84SAndre Oppermann m = ip_reass(m); 745f0cada84SAndre Oppermann if (m == NULL) 746c67b1d17SGarrett Wollman return; 7476a800098SYoshinobu Inoue ip = mtod(m, struct ip *); 7487e2df452SRuslan Ermilov /* Get the header length of the reassembled packet */ 74953be11f6SPoul-Henning Kamp hlen = ip->ip_hl << 2; 750f0cada84SAndre Oppermann } 751f0cada84SAndre Oppermann 752f0cada84SAndre Oppermann /* 753f0cada84SAndre Oppermann * Further protocols expect the packet length to be w/o the 754f0cada84SAndre Oppermann * IP header. 755f0cada84SAndre Oppermann */ 756df8bae1dSRodney W. Grimes ip->ip_len -= hlen; 757df8bae1dSRodney W. Grimes 758b2630c29SGeorge V. Neville-Neil #ifdef IPSEC 75933841545SHajimu UMEMOTO /* 76033841545SHajimu UMEMOTO * enforce IPsec policy checking if we are seeing last header. 76133841545SHajimu UMEMOTO * note that we do not visit this with protocols with pcb layer 76233841545SHajimu UMEMOTO * code - like udp/tcp/raw ip. 76333841545SHajimu UMEMOTO */ 7641dfcf0d2SAndre Oppermann if (ip_ipsec_input(m)) 76533841545SHajimu UMEMOTO goto bad; 766b2630c29SGeorge V. Neville-Neil #endif /* IPSEC */ 76733841545SHajimu UMEMOTO 768df8bae1dSRodney W. Grimes /* 769df8bae1dSRodney W. Grimes * Switch out to protocol's input routine. 770df8bae1dSRodney W. Grimes */ 77186425c62SRobert Watson IPSTAT_INC(ips_delivered); 7729b932e9eSAndre Oppermann 7732b25acc1SLuigi Rizzo (*inetsw[ip_protox[ip->ip_p]].pr_input)(m, hlen); 774c67b1d17SGarrett Wollman return; 775df8bae1dSRodney W. Grimes bad: 776df8bae1dSRodney W. Grimes m_freem(m); 777c67b1d17SGarrett Wollman } 778c67b1d17SGarrett Wollman 779c67b1d17SGarrett Wollman /* 780d248c7d7SRobert Watson * After maxnipq has been updated, propagate the change to UMA. The UMA zone 781d248c7d7SRobert Watson * max has slightly different semantics than the sysctl, for historical 782d248c7d7SRobert Watson * reasons. 783d248c7d7SRobert Watson */ 784d248c7d7SRobert Watson static void 785d248c7d7SRobert Watson maxnipq_update(void) 786d248c7d7SRobert Watson { 787d248c7d7SRobert Watson 788d248c7d7SRobert Watson /* 789d248c7d7SRobert Watson * -1 for unlimited allocation. 790d248c7d7SRobert Watson */ 791603724d3SBjoern A. Zeeb if (V_maxnipq < 0) 792603724d3SBjoern A. Zeeb uma_zone_set_max(V_ipq_zone, 0); 793d248c7d7SRobert Watson /* 794d248c7d7SRobert Watson * Positive number for specific bound. 795d248c7d7SRobert Watson */ 796603724d3SBjoern A. Zeeb if (V_maxnipq > 0) 797603724d3SBjoern A. Zeeb uma_zone_set_max(V_ipq_zone, V_maxnipq); 798d248c7d7SRobert Watson /* 799d248c7d7SRobert Watson * Zero specifies no further fragment queue allocation -- set the 800d248c7d7SRobert Watson * bound very low, but rely on implementation elsewhere to actually 801d248c7d7SRobert Watson * prevent allocation and reclaim current queues. 802d248c7d7SRobert Watson */ 803603724d3SBjoern A. Zeeb if (V_maxnipq == 0) 804603724d3SBjoern A. Zeeb uma_zone_set_max(V_ipq_zone, 1); 805d248c7d7SRobert Watson } 806d248c7d7SRobert Watson 8074f590175SPaul Saab static void 8084f590175SPaul Saab ipq_zone_change(void *tag) 8094f590175SPaul Saab { 8104f590175SPaul Saab 811603724d3SBjoern A. Zeeb if (V_maxnipq > 0 && V_maxnipq < (nmbclusters / 32)) { 812603724d3SBjoern A. Zeeb V_maxnipq = nmbclusters / 32; 8134f590175SPaul Saab maxnipq_update(); 8144f590175SPaul Saab } 8154f590175SPaul Saab } 8164f590175SPaul Saab 817d248c7d7SRobert Watson static int 818d248c7d7SRobert Watson sysctl_maxnipq(SYSCTL_HANDLER_ARGS) 819d248c7d7SRobert Watson { 820d248c7d7SRobert Watson int error, i; 821d248c7d7SRobert Watson 822603724d3SBjoern A. Zeeb i = V_maxnipq; 823d248c7d7SRobert Watson error = sysctl_handle_int(oidp, &i, 0, req); 824d248c7d7SRobert Watson if (error || !req->newptr) 825d248c7d7SRobert Watson return (error); 826d248c7d7SRobert Watson 827d248c7d7SRobert Watson /* 828d248c7d7SRobert Watson * XXXRW: Might be a good idea to sanity check the argument and place 829d248c7d7SRobert Watson * an extreme upper bound. 830d248c7d7SRobert Watson */ 831d248c7d7SRobert Watson if (i < -1) 832d248c7d7SRobert Watson return (EINVAL); 833603724d3SBjoern A. Zeeb V_maxnipq = i; 834d248c7d7SRobert Watson maxnipq_update(); 835d248c7d7SRobert Watson return (0); 836d248c7d7SRobert Watson } 837d248c7d7SRobert Watson 838d248c7d7SRobert Watson SYSCTL_PROC(_net_inet_ip, OID_AUTO, maxfragpackets, CTLTYPE_INT|CTLFLAG_RW, 839d248c7d7SRobert Watson NULL, 0, sysctl_maxnipq, "I", 840d248c7d7SRobert Watson "Maximum number of IPv4 fragment reassembly queue entries"); 841d248c7d7SRobert Watson 842d248c7d7SRobert Watson /* 8438948e4baSArchie Cobbs * Take incoming datagram fragment and try to reassemble it into 844f0cada84SAndre Oppermann * whole datagram. If the argument is the first fragment or one 845f0cada84SAndre Oppermann * in between the function will return NULL and store the mbuf 846f0cada84SAndre Oppermann * in the fragment chain. If the argument is the last fragment 847f0cada84SAndre Oppermann * the packet will be reassembled and the pointer to the new 848f0cada84SAndre Oppermann * mbuf returned for further processing. Only m_tags attached 849f0cada84SAndre Oppermann * to the first packet/fragment are preserved. 850f0cada84SAndre Oppermann * The IP header is *NOT* adjusted out of iplen. 851df8bae1dSRodney W. Grimes */ 852f0cada84SAndre Oppermann struct mbuf * 853f0cada84SAndre Oppermann ip_reass(struct mbuf *m) 854df8bae1dSRodney W. Grimes { 855f0cada84SAndre Oppermann struct ip *ip; 856f0cada84SAndre Oppermann struct mbuf *p, *q, *nq, *t; 857f0cada84SAndre Oppermann struct ipq *fp = NULL; 858f0cada84SAndre Oppermann struct ipqhead *head; 859f0cada84SAndre Oppermann int i, hlen, next; 86059dfcba4SHajimu UMEMOTO u_int8_t ecn, ecn0; 861f0cada84SAndre Oppermann u_short hash; 862df8bae1dSRodney W. Grimes 863800af1fbSMaxim Konovalov /* If maxnipq or maxfragsperpacket are 0, never accept fragments. */ 864603724d3SBjoern A. Zeeb if (V_maxnipq == 0 || V_maxfragsperpacket == 0) { 86586425c62SRobert Watson IPSTAT_INC(ips_fragments); 86686425c62SRobert Watson IPSTAT_INC(ips_fragdropped); 8679d804f81SAndre Oppermann m_freem(m); 8689d804f81SAndre Oppermann return (NULL); 869f0cada84SAndre Oppermann } 8702fad1e93SSam Leffler 871f0cada84SAndre Oppermann ip = mtod(m, struct ip *); 872f0cada84SAndre Oppermann hlen = ip->ip_hl << 2; 873f0cada84SAndre Oppermann 874f0cada84SAndre Oppermann hash = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id); 875603724d3SBjoern A. Zeeb head = &V_ipq[hash]; 876f0cada84SAndre Oppermann IPQ_LOCK(); 877f0cada84SAndre Oppermann 878f0cada84SAndre Oppermann /* 879f0cada84SAndre Oppermann * Look for queue of fragments 880f0cada84SAndre Oppermann * of this datagram. 881f0cada84SAndre Oppermann */ 882f0cada84SAndre Oppermann TAILQ_FOREACH(fp, head, ipq_list) 883f0cada84SAndre Oppermann if (ip->ip_id == fp->ipq_id && 884f0cada84SAndre Oppermann ip->ip_src.s_addr == fp->ipq_src.s_addr && 885f0cada84SAndre Oppermann ip->ip_dst.s_addr == fp->ipq_dst.s_addr && 886f0cada84SAndre Oppermann #ifdef MAC 88730d239bcSRobert Watson mac_ipq_match(m, fp) && 888f0cada84SAndre Oppermann #endif 889f0cada84SAndre Oppermann ip->ip_p == fp->ipq_p) 890f0cada84SAndre Oppermann goto found; 891f0cada84SAndre Oppermann 892f0cada84SAndre Oppermann fp = NULL; 893f0cada84SAndre Oppermann 894f0cada84SAndre Oppermann /* 895d248c7d7SRobert Watson * Attempt to trim the number of allocated fragment queues if it 896d248c7d7SRobert Watson * exceeds the administrative limit. 897f0cada84SAndre Oppermann */ 898603724d3SBjoern A. Zeeb if ((V_nipq > V_maxnipq) && (V_maxnipq > 0)) { 899f0cada84SAndre Oppermann /* 900f0cada84SAndre Oppermann * drop something from the tail of the current queue 901f0cada84SAndre Oppermann * before proceeding further 902f0cada84SAndre Oppermann */ 903f0cada84SAndre Oppermann struct ipq *q = TAILQ_LAST(head, ipqhead); 904f0cada84SAndre Oppermann if (q == NULL) { /* gak */ 905f0cada84SAndre Oppermann for (i = 0; i < IPREASS_NHASH; i++) { 906603724d3SBjoern A. Zeeb struct ipq *r = TAILQ_LAST(&V_ipq[i], ipqhead); 907f0cada84SAndre Oppermann if (r) { 90886425c62SRobert Watson IPSTAT_ADD(ips_fragtimeout, 90986425c62SRobert Watson r->ipq_nfrags); 910603724d3SBjoern A. Zeeb ip_freef(&V_ipq[i], r); 911f0cada84SAndre Oppermann break; 912f0cada84SAndre Oppermann } 913f0cada84SAndre Oppermann } 914f0cada84SAndre Oppermann } else { 91586425c62SRobert Watson IPSTAT_ADD(ips_fragtimeout, q->ipq_nfrags); 916f0cada84SAndre Oppermann ip_freef(head, q); 917f0cada84SAndre Oppermann } 918f0cada84SAndre Oppermann } 919f0cada84SAndre Oppermann 920f0cada84SAndre Oppermann found: 921f0cada84SAndre Oppermann /* 922f0cada84SAndre Oppermann * Adjust ip_len to not reflect header, 923f0cada84SAndre Oppermann * convert offset of this to bytes. 924f0cada84SAndre Oppermann */ 925f0cada84SAndre Oppermann ip->ip_len -= hlen; 926f0cada84SAndre Oppermann if (ip->ip_off & IP_MF) { 927f0cada84SAndre Oppermann /* 928f0cada84SAndre Oppermann * Make sure that fragments have a data length 929f0cada84SAndre Oppermann * that's a non-zero multiple of 8 bytes. 930f0cada84SAndre Oppermann */ 931f0cada84SAndre Oppermann if (ip->ip_len == 0 || (ip->ip_len & 0x7) != 0) { 93286425c62SRobert Watson IPSTAT_INC(ips_toosmall); /* XXX */ 933f0cada84SAndre Oppermann goto dropfrag; 934f0cada84SAndre Oppermann } 935f0cada84SAndre Oppermann m->m_flags |= M_FRAG; 936f0cada84SAndre Oppermann } else 937f0cada84SAndre Oppermann m->m_flags &= ~M_FRAG; 938f0cada84SAndre Oppermann ip->ip_off <<= 3; 939f0cada84SAndre Oppermann 940f0cada84SAndre Oppermann 941f0cada84SAndre Oppermann /* 942f0cada84SAndre Oppermann * Attempt reassembly; if it succeeds, proceed. 943f0cada84SAndre Oppermann * ip_reass() will return a different mbuf. 944f0cada84SAndre Oppermann */ 94586425c62SRobert Watson IPSTAT_INC(ips_fragments); 946f0cada84SAndre Oppermann m->m_pkthdr.header = ip; 947f0cada84SAndre Oppermann 948f0cada84SAndre Oppermann /* Previous ip_reass() started here. */ 949df8bae1dSRodney W. Grimes /* 950df8bae1dSRodney W. Grimes * Presence of header sizes in mbufs 951df8bae1dSRodney W. Grimes * would confuse code below. 952df8bae1dSRodney W. Grimes */ 953df8bae1dSRodney W. Grimes m->m_data += hlen; 954df8bae1dSRodney W. Grimes m->m_len -= hlen; 955df8bae1dSRodney W. Grimes 956df8bae1dSRodney W. Grimes /* 957df8bae1dSRodney W. Grimes * If first fragment to arrive, create a reassembly queue. 958df8bae1dSRodney W. Grimes */ 959042bbfa3SRobert Watson if (fp == NULL) { 960603724d3SBjoern A. Zeeb fp = uma_zalloc(V_ipq_zone, M_NOWAIT); 961d248c7d7SRobert Watson if (fp == NULL) 962df8bae1dSRodney W. Grimes goto dropfrag; 96336b0360bSRobert Watson #ifdef MAC 96430d239bcSRobert Watson if (mac_ipq_init(fp, M_NOWAIT) != 0) { 965603724d3SBjoern A. Zeeb uma_zfree(V_ipq_zone, fp); 9661d7d0bfeSPawel Jakub Dawidek fp = NULL; 9675e7ce478SRobert Watson goto dropfrag; 9685e7ce478SRobert Watson } 96930d239bcSRobert Watson mac_ipq_create(m, fp); 97036b0360bSRobert Watson #endif 971462b86feSPoul-Henning Kamp TAILQ_INSERT_HEAD(head, fp, ipq_list); 972603724d3SBjoern A. Zeeb V_nipq++; 973375386e2SMike Silbersack fp->ipq_nfrags = 1; 974df8bae1dSRodney W. Grimes fp->ipq_ttl = IPFRAGTTL; 975df8bae1dSRodney W. Grimes fp->ipq_p = ip->ip_p; 976df8bae1dSRodney W. Grimes fp->ipq_id = ip->ip_id; 9776effc713SDoug Rabson fp->ipq_src = ip->ip_src; 9786effc713SDoug Rabson fp->ipq_dst = ip->ip_dst; 979af38c68cSLuigi Rizzo fp->ipq_frags = m; 980af38c68cSLuigi Rizzo m->m_nextpkt = NULL; 981800af1fbSMaxim Konovalov goto done; 98236b0360bSRobert Watson } else { 983375386e2SMike Silbersack fp->ipq_nfrags++; 98436b0360bSRobert Watson #ifdef MAC 98530d239bcSRobert Watson mac_ipq_update(m, fp); 98636b0360bSRobert Watson #endif 987df8bae1dSRodney W. Grimes } 988df8bae1dSRodney W. Grimes 9896effc713SDoug Rabson #define GETIP(m) ((struct ip*)((m)->m_pkthdr.header)) 9906effc713SDoug Rabson 991df8bae1dSRodney W. Grimes /* 99259dfcba4SHajimu UMEMOTO * Handle ECN by comparing this segment with the first one; 99359dfcba4SHajimu UMEMOTO * if CE is set, do not lose CE. 99459dfcba4SHajimu UMEMOTO * drop if CE and not-ECT are mixed for the same packet. 99559dfcba4SHajimu UMEMOTO */ 99659dfcba4SHajimu UMEMOTO ecn = ip->ip_tos & IPTOS_ECN_MASK; 99759dfcba4SHajimu UMEMOTO ecn0 = GETIP(fp->ipq_frags)->ip_tos & IPTOS_ECN_MASK; 99859dfcba4SHajimu UMEMOTO if (ecn == IPTOS_ECN_CE) { 99959dfcba4SHajimu UMEMOTO if (ecn0 == IPTOS_ECN_NOTECT) 100059dfcba4SHajimu UMEMOTO goto dropfrag; 100159dfcba4SHajimu UMEMOTO if (ecn0 != IPTOS_ECN_CE) 100259dfcba4SHajimu UMEMOTO GETIP(fp->ipq_frags)->ip_tos |= IPTOS_ECN_CE; 100359dfcba4SHajimu UMEMOTO } 100459dfcba4SHajimu UMEMOTO if (ecn == IPTOS_ECN_NOTECT && ecn0 != IPTOS_ECN_NOTECT) 100559dfcba4SHajimu UMEMOTO goto dropfrag; 100659dfcba4SHajimu UMEMOTO 100759dfcba4SHajimu UMEMOTO /* 1008df8bae1dSRodney W. Grimes * Find a segment which begins after this one does. 1009df8bae1dSRodney W. Grimes */ 10106effc713SDoug Rabson for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt) 10116effc713SDoug Rabson if (GETIP(q)->ip_off > ip->ip_off) 1012df8bae1dSRodney W. Grimes break; 1013df8bae1dSRodney W. Grimes 1014df8bae1dSRodney W. Grimes /* 1015df8bae1dSRodney W. Grimes * If there is a preceding segment, it may provide some of 1016df8bae1dSRodney W. Grimes * our data already. If so, drop the data from the incoming 1017af38c68cSLuigi Rizzo * segment. If it provides all of our data, drop us, otherwise 1018af38c68cSLuigi Rizzo * stick new segment in the proper place. 1019db4f9cc7SJonathan Lemon * 1020db4f9cc7SJonathan Lemon * If some of the data is dropped from the the preceding 1021db4f9cc7SJonathan Lemon * segment, then it's checksum is invalidated. 1022df8bae1dSRodney W. Grimes */ 10236effc713SDoug Rabson if (p) { 10246effc713SDoug Rabson i = GETIP(p)->ip_off + GETIP(p)->ip_len - ip->ip_off; 1025df8bae1dSRodney W. Grimes if (i > 0) { 1026df8bae1dSRodney W. Grimes if (i >= ip->ip_len) 1027df8bae1dSRodney W. Grimes goto dropfrag; 10286a800098SYoshinobu Inoue m_adj(m, i); 1029db4f9cc7SJonathan Lemon m->m_pkthdr.csum_flags = 0; 1030df8bae1dSRodney W. Grimes ip->ip_off += i; 1031df8bae1dSRodney W. Grimes ip->ip_len -= i; 1032df8bae1dSRodney W. Grimes } 1033af38c68cSLuigi Rizzo m->m_nextpkt = p->m_nextpkt; 1034af38c68cSLuigi Rizzo p->m_nextpkt = m; 1035af38c68cSLuigi Rizzo } else { 1036af38c68cSLuigi Rizzo m->m_nextpkt = fp->ipq_frags; 1037af38c68cSLuigi Rizzo fp->ipq_frags = m; 1038df8bae1dSRodney W. Grimes } 1039df8bae1dSRodney W. Grimes 1040df8bae1dSRodney W. Grimes /* 1041df8bae1dSRodney W. Grimes * While we overlap succeeding segments trim them or, 1042df8bae1dSRodney W. Grimes * if they are completely covered, dequeue them. 1043df8bae1dSRodney W. Grimes */ 10446effc713SDoug Rabson for (; q != NULL && ip->ip_off + ip->ip_len > GETIP(q)->ip_off; 1045af38c68cSLuigi Rizzo q = nq) { 1046b36f5b37SMaxim Konovalov i = (ip->ip_off + ip->ip_len) - GETIP(q)->ip_off; 10476effc713SDoug Rabson if (i < GETIP(q)->ip_len) { 10486effc713SDoug Rabson GETIP(q)->ip_len -= i; 10496effc713SDoug Rabson GETIP(q)->ip_off += i; 10506effc713SDoug Rabson m_adj(q, i); 1051db4f9cc7SJonathan Lemon q->m_pkthdr.csum_flags = 0; 1052df8bae1dSRodney W. Grimes break; 1053df8bae1dSRodney W. Grimes } 10546effc713SDoug Rabson nq = q->m_nextpkt; 1055af38c68cSLuigi Rizzo m->m_nextpkt = nq; 105686425c62SRobert Watson IPSTAT_INC(ips_fragdropped); 1057375386e2SMike Silbersack fp->ipq_nfrags--; 10586effc713SDoug Rabson m_freem(q); 1059df8bae1dSRodney W. Grimes } 1060df8bae1dSRodney W. Grimes 1061df8bae1dSRodney W. Grimes /* 1062375386e2SMike Silbersack * Check for complete reassembly and perform frag per packet 1063375386e2SMike Silbersack * limiting. 1064375386e2SMike Silbersack * 1065375386e2SMike Silbersack * Frag limiting is performed here so that the nth frag has 1066375386e2SMike Silbersack * a chance to complete the packet before we drop the packet. 1067375386e2SMike Silbersack * As a result, n+1 frags are actually allowed per packet, but 1068375386e2SMike Silbersack * only n will ever be stored. (n = maxfragsperpacket.) 1069375386e2SMike Silbersack * 1070df8bae1dSRodney W. Grimes */ 10716effc713SDoug Rabson next = 0; 10726effc713SDoug Rabson for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt) { 1073375386e2SMike Silbersack if (GETIP(q)->ip_off != next) { 1074603724d3SBjoern A. Zeeb if (fp->ipq_nfrags > V_maxfragsperpacket) { 107586425c62SRobert Watson IPSTAT_ADD(ips_fragdropped, fp->ipq_nfrags); 1076375386e2SMike Silbersack ip_freef(head, fp); 107799e8617dSMaxim Konovalov } 1078f0cada84SAndre Oppermann goto done; 1079375386e2SMike Silbersack } 10806effc713SDoug Rabson next += GETIP(q)->ip_len; 10816effc713SDoug Rabson } 10826effc713SDoug Rabson /* Make sure the last packet didn't have the IP_MF flag */ 1083375386e2SMike Silbersack if (p->m_flags & M_FRAG) { 1084603724d3SBjoern A. Zeeb if (fp->ipq_nfrags > V_maxfragsperpacket) { 108586425c62SRobert Watson IPSTAT_ADD(ips_fragdropped, fp->ipq_nfrags); 1086375386e2SMike Silbersack ip_freef(head, fp); 108799e8617dSMaxim Konovalov } 1088f0cada84SAndre Oppermann goto done; 1089375386e2SMike Silbersack } 1090df8bae1dSRodney W. Grimes 1091df8bae1dSRodney W. Grimes /* 1092430d30d8SBill Fenner * Reassembly is complete. Make sure the packet is a sane size. 1093430d30d8SBill Fenner */ 10946effc713SDoug Rabson q = fp->ipq_frags; 10956effc713SDoug Rabson ip = GETIP(q); 109653be11f6SPoul-Henning Kamp if (next + (ip->ip_hl << 2) > IP_MAXPACKET) { 109786425c62SRobert Watson IPSTAT_INC(ips_toolong); 109886425c62SRobert Watson IPSTAT_ADD(ips_fragdropped, fp->ipq_nfrags); 1099462b86feSPoul-Henning Kamp ip_freef(head, fp); 1100f0cada84SAndre Oppermann goto done; 1101430d30d8SBill Fenner } 1102430d30d8SBill Fenner 1103430d30d8SBill Fenner /* 1104430d30d8SBill Fenner * Concatenate fragments. 1105df8bae1dSRodney W. Grimes */ 11066effc713SDoug Rabson m = q; 1107df8bae1dSRodney W. Grimes t = m->m_next; 110802410549SRobert Watson m->m_next = NULL; 1109df8bae1dSRodney W. Grimes m_cat(m, t); 11106effc713SDoug Rabson nq = q->m_nextpkt; 111102410549SRobert Watson q->m_nextpkt = NULL; 11126effc713SDoug Rabson for (q = nq; q != NULL; q = nq) { 11136effc713SDoug Rabson nq = q->m_nextpkt; 1114945aa40dSDoug Rabson q->m_nextpkt = NULL; 1115db4f9cc7SJonathan Lemon m->m_pkthdr.csum_flags &= q->m_pkthdr.csum_flags; 1116db4f9cc7SJonathan Lemon m->m_pkthdr.csum_data += q->m_pkthdr.csum_data; 1117a8db1d93SJonathan Lemon m_cat(m, q); 1118df8bae1dSRodney W. Grimes } 11196edb555dSOleg Bulyzhin /* 11206edb555dSOleg Bulyzhin * In order to do checksumming faster we do 'end-around carry' here 11216edb555dSOleg Bulyzhin * (and not in for{} loop), though it implies we are not going to 11226edb555dSOleg Bulyzhin * reassemble more than 64k fragments. 11236edb555dSOleg Bulyzhin */ 11246edb555dSOleg Bulyzhin m->m_pkthdr.csum_data = 11256edb555dSOleg Bulyzhin (m->m_pkthdr.csum_data & 0xffff) + (m->m_pkthdr.csum_data >> 16); 112636b0360bSRobert Watson #ifdef MAC 112730d239bcSRobert Watson mac_ipq_reassemble(fp, m); 112830d239bcSRobert Watson mac_ipq_destroy(fp); 112936b0360bSRobert Watson #endif 1130df8bae1dSRodney W. Grimes 1131df8bae1dSRodney W. Grimes /* 1132f0cada84SAndre Oppermann * Create header for new ip packet by modifying header of first 1133f0cada84SAndre Oppermann * packet; dequeue and discard fragment reassembly header. 1134df8bae1dSRodney W. Grimes * Make header visible. 1135df8bae1dSRodney W. Grimes */ 1136f0cada84SAndre Oppermann ip->ip_len = (ip->ip_hl << 2) + next; 11376effc713SDoug Rabson ip->ip_src = fp->ipq_src; 11386effc713SDoug Rabson ip->ip_dst = fp->ipq_dst; 1139462b86feSPoul-Henning Kamp TAILQ_REMOVE(head, fp, ipq_list); 1140603724d3SBjoern A. Zeeb V_nipq--; 1141603724d3SBjoern A. Zeeb uma_zfree(V_ipq_zone, fp); 114253be11f6SPoul-Henning Kamp m->m_len += (ip->ip_hl << 2); 114353be11f6SPoul-Henning Kamp m->m_data -= (ip->ip_hl << 2); 1144df8bae1dSRodney W. Grimes /* some debugging cruft by sklower, below, will go away soon */ 1145a5554bf0SPoul-Henning Kamp if (m->m_flags & M_PKTHDR) /* XXX this should be done elsewhere */ 1146a5554bf0SPoul-Henning Kamp m_fixhdr(m); 114786425c62SRobert Watson IPSTAT_INC(ips_reassembled); 1148f0cada84SAndre Oppermann IPQ_UNLOCK(); 11496a800098SYoshinobu Inoue return (m); 1150df8bae1dSRodney W. Grimes 1151df8bae1dSRodney W. Grimes dropfrag: 115286425c62SRobert Watson IPSTAT_INC(ips_fragdropped); 1153042bbfa3SRobert Watson if (fp != NULL) 1154375386e2SMike Silbersack fp->ipq_nfrags--; 1155df8bae1dSRodney W. Grimes m_freem(m); 1156f0cada84SAndre Oppermann done: 1157f0cada84SAndre Oppermann IPQ_UNLOCK(); 1158f0cada84SAndre Oppermann return (NULL); 11596effc713SDoug Rabson 11606effc713SDoug Rabson #undef GETIP 1161df8bae1dSRodney W. Grimes } 1162df8bae1dSRodney W. Grimes 1163df8bae1dSRodney W. Grimes /* 1164df8bae1dSRodney W. Grimes * Free a fragment reassembly header and all 1165df8bae1dSRodney W. Grimes * associated datagrams. 1166df8bae1dSRodney W. Grimes */ 11670312fbe9SPoul-Henning Kamp static void 1168f2565d68SRobert Watson ip_freef(struct ipqhead *fhp, struct ipq *fp) 1169df8bae1dSRodney W. Grimes { 1170f2565d68SRobert Watson struct mbuf *q; 1171df8bae1dSRodney W. Grimes 11722fad1e93SSam Leffler IPQ_LOCK_ASSERT(); 11732fad1e93SSam Leffler 11746effc713SDoug Rabson while (fp->ipq_frags) { 11756effc713SDoug Rabson q = fp->ipq_frags; 11766effc713SDoug Rabson fp->ipq_frags = q->m_nextpkt; 11776effc713SDoug Rabson m_freem(q); 1178df8bae1dSRodney W. Grimes } 1179462b86feSPoul-Henning Kamp TAILQ_REMOVE(fhp, fp, ipq_list); 1180603724d3SBjoern A. Zeeb uma_zfree(V_ipq_zone, fp); 1181603724d3SBjoern A. Zeeb V_nipq--; 1182df8bae1dSRodney W. Grimes } 1183df8bae1dSRodney W. Grimes 1184df8bae1dSRodney W. Grimes /* 1185df8bae1dSRodney W. Grimes * IP timer processing; 1186df8bae1dSRodney W. Grimes * if a timer expires on a reassembly 1187df8bae1dSRodney W. Grimes * queue, discard it. 1188df8bae1dSRodney W. Grimes */ 1189df8bae1dSRodney W. Grimes void 1190f2565d68SRobert Watson ip_slowtimo(void) 1191df8bae1dSRodney W. Grimes { 11928b615593SMarko Zec VNET_ITERATOR_DECL(vnet_iter); 1193f2565d68SRobert Watson struct ipq *fp; 1194194a213eSAndrey A. Chernov int i; 1195df8bae1dSRodney W. Grimes 11962fad1e93SSam Leffler IPQ_LOCK(); 11978b615593SMarko Zec VNET_LIST_RLOCK(); 11988b615593SMarko Zec VNET_FOREACH(vnet_iter) { 11998b615593SMarko Zec CURVNET_SET(vnet_iter); 1200194a213eSAndrey A. Chernov for (i = 0; i < IPREASS_NHASH; i++) { 1201603724d3SBjoern A. Zeeb for(fp = TAILQ_FIRST(&V_ipq[i]); fp;) { 1202462b86feSPoul-Henning Kamp struct ipq *fpp; 1203462b86feSPoul-Henning Kamp 1204462b86feSPoul-Henning Kamp fpp = fp; 1205462b86feSPoul-Henning Kamp fp = TAILQ_NEXT(fp, ipq_list); 1206462b86feSPoul-Henning Kamp if(--fpp->ipq_ttl == 0) { 120786425c62SRobert Watson IPSTAT_ADD(ips_fragtimeout, 120886425c62SRobert Watson fpp->ipq_nfrags); 1209603724d3SBjoern A. Zeeb ip_freef(&V_ipq[i], fpp); 1210df8bae1dSRodney W. Grimes } 1211df8bae1dSRodney W. Grimes } 1212194a213eSAndrey A. Chernov } 1213690a6055SJesper Skriver /* 1214690a6055SJesper Skriver * If we are over the maximum number of fragments 1215690a6055SJesper Skriver * (due to the limit being lowered), drain off 1216690a6055SJesper Skriver * enough to get down to the new limit. 1217690a6055SJesper Skriver */ 1218603724d3SBjoern A. Zeeb if (V_maxnipq >= 0 && V_nipq > V_maxnipq) { 1219690a6055SJesper Skriver for (i = 0; i < IPREASS_NHASH; i++) { 12208b615593SMarko Zec while (V_nipq > V_maxnipq && 12218b615593SMarko Zec !TAILQ_EMPTY(&V_ipq[i])) { 122286425c62SRobert Watson IPSTAT_ADD(ips_fragdropped, 122386425c62SRobert Watson TAILQ_FIRST(&V_ipq[i])->ipq_nfrags); 12248b615593SMarko Zec ip_freef(&V_ipq[i], 12258b615593SMarko Zec TAILQ_FIRST(&V_ipq[i])); 1226690a6055SJesper Skriver } 1227690a6055SJesper Skriver } 1228690a6055SJesper Skriver } 12298b615593SMarko Zec CURVNET_RESTORE(); 12308b615593SMarko Zec } 12318b615593SMarko Zec VNET_LIST_RUNLOCK(); 12322fad1e93SSam Leffler IPQ_UNLOCK(); 1233df8bae1dSRodney W. Grimes } 1234df8bae1dSRodney W. Grimes 1235df8bae1dSRodney W. Grimes /* 1236df8bae1dSRodney W. Grimes * Drain off all datagram fragments. 1237df8bae1dSRodney W. Grimes */ 1238df8bae1dSRodney W. Grimes void 1239f2565d68SRobert Watson ip_drain(void) 1240df8bae1dSRodney W. Grimes { 12418b615593SMarko Zec VNET_ITERATOR_DECL(vnet_iter); 1242194a213eSAndrey A. Chernov int i; 1243ce29ab3aSGarrett Wollman 12442fad1e93SSam Leffler IPQ_LOCK(); 12458b615593SMarko Zec VNET_LIST_RLOCK(); 12468b615593SMarko Zec VNET_FOREACH(vnet_iter) { 12478b615593SMarko Zec CURVNET_SET(vnet_iter); 1248194a213eSAndrey A. Chernov for (i = 0; i < IPREASS_NHASH; i++) { 1249603724d3SBjoern A. Zeeb while(!TAILQ_EMPTY(&V_ipq[i])) { 125086425c62SRobert Watson IPSTAT_ADD(ips_fragdropped, 125186425c62SRobert Watson TAILQ_FIRST(&V_ipq[i])->ipq_nfrags); 1252603724d3SBjoern A. Zeeb ip_freef(&V_ipq[i], TAILQ_FIRST(&V_ipq[i])); 1253194a213eSAndrey A. Chernov } 1254194a213eSAndrey A. Chernov } 12558b615593SMarko Zec CURVNET_RESTORE(); 12568b615593SMarko Zec } 12578b615593SMarko Zec VNET_LIST_RUNLOCK(); 12582fad1e93SSam Leffler IPQ_UNLOCK(); 1259ce29ab3aSGarrett Wollman in_rtqdrain(); 1260df8bae1dSRodney W. Grimes } 1261df8bae1dSRodney W. Grimes 1262df8bae1dSRodney W. Grimes /* 1263de38924dSAndre Oppermann * The protocol to be inserted into ip_protox[] must be already registered 1264de38924dSAndre Oppermann * in inetsw[], either statically or through pf_proto_register(). 1265de38924dSAndre Oppermann */ 1266de38924dSAndre Oppermann int 1267de38924dSAndre Oppermann ipproto_register(u_char ipproto) 1268de38924dSAndre Oppermann { 1269de38924dSAndre Oppermann struct protosw *pr; 1270de38924dSAndre Oppermann 1271de38924dSAndre Oppermann /* Sanity checks. */ 1272de38924dSAndre Oppermann if (ipproto == 0) 1273de38924dSAndre Oppermann return (EPROTONOSUPPORT); 1274de38924dSAndre Oppermann 1275de38924dSAndre Oppermann /* 1276de38924dSAndre Oppermann * The protocol slot must not be occupied by another protocol 1277de38924dSAndre Oppermann * already. An index pointing to IPPROTO_RAW is unused. 1278de38924dSAndre Oppermann */ 1279de38924dSAndre Oppermann pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 1280de38924dSAndre Oppermann if (pr == NULL) 1281de38924dSAndre Oppermann return (EPFNOSUPPORT); 1282de38924dSAndre Oppermann if (ip_protox[ipproto] != pr - inetsw) /* IPPROTO_RAW */ 1283de38924dSAndre Oppermann return (EEXIST); 1284de38924dSAndre Oppermann 1285de38924dSAndre Oppermann /* Find the protocol position in inetsw[] and set the index. */ 1286de38924dSAndre Oppermann for (pr = inetdomain.dom_protosw; 1287de38924dSAndre Oppermann pr < inetdomain.dom_protoswNPROTOSW; pr++) { 1288de38924dSAndre Oppermann if (pr->pr_domain->dom_family == PF_INET && 1289de38924dSAndre Oppermann pr->pr_protocol && pr->pr_protocol == ipproto) { 1290de38924dSAndre Oppermann /* Be careful to only index valid IP protocols. */ 1291db77984cSSam Leffler if (pr->pr_protocol < IPPROTO_MAX) { 1292de38924dSAndre Oppermann ip_protox[pr->pr_protocol] = pr - inetsw; 1293de38924dSAndre Oppermann return (0); 1294de38924dSAndre Oppermann } else 1295de38924dSAndre Oppermann return (EINVAL); 1296de38924dSAndre Oppermann } 1297de38924dSAndre Oppermann } 1298de38924dSAndre Oppermann return (EPROTONOSUPPORT); 1299de38924dSAndre Oppermann } 1300de38924dSAndre Oppermann 1301de38924dSAndre Oppermann int 1302de38924dSAndre Oppermann ipproto_unregister(u_char ipproto) 1303de38924dSAndre Oppermann { 1304de38924dSAndre Oppermann struct protosw *pr; 1305de38924dSAndre Oppermann 1306de38924dSAndre Oppermann /* Sanity checks. */ 1307de38924dSAndre Oppermann if (ipproto == 0) 1308de38924dSAndre Oppermann return (EPROTONOSUPPORT); 1309de38924dSAndre Oppermann 1310de38924dSAndre Oppermann /* Check if the protocol was indeed registered. */ 1311de38924dSAndre Oppermann pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 1312de38924dSAndre Oppermann if (pr == NULL) 1313de38924dSAndre Oppermann return (EPFNOSUPPORT); 1314de38924dSAndre Oppermann if (ip_protox[ipproto] == pr - inetsw) /* IPPROTO_RAW */ 1315de38924dSAndre Oppermann return (ENOENT); 1316de38924dSAndre Oppermann 1317de38924dSAndre Oppermann /* Reset the protocol slot to IPPROTO_RAW. */ 1318de38924dSAndre Oppermann ip_protox[ipproto] = pr - inetsw; 1319de38924dSAndre Oppermann return (0); 1320de38924dSAndre Oppermann } 1321de38924dSAndre Oppermann 1322df8bae1dSRodney W. Grimes /* 13238c0fec80SRobert Watson * Given address of next destination (final or next hop), return (referenced) 13248c0fec80SRobert Watson * internet address info of interface to be used to get there. 1325df8bae1dSRodney W. Grimes */ 1326bd714208SRuslan Ermilov struct in_ifaddr * 13278b07e49aSJulian Elischer ip_rtaddr(struct in_addr dst, u_int fibnum) 1328df8bae1dSRodney W. Grimes { 132997d8d152SAndre Oppermann struct route sro; 133002c1c707SAndre Oppermann struct sockaddr_in *sin; 133119e5b0a7SRobert Watson struct in_ifaddr *ia; 1332df8bae1dSRodney W. Grimes 13330cfbbe3bSAndre Oppermann bzero(&sro, sizeof(sro)); 133497d8d152SAndre Oppermann sin = (struct sockaddr_in *)&sro.ro_dst; 1335df8bae1dSRodney W. Grimes sin->sin_family = AF_INET; 1336df8bae1dSRodney W. Grimes sin->sin_len = sizeof(*sin); 1337df8bae1dSRodney W. Grimes sin->sin_addr = dst; 13386e6b3f7cSQing Li in_rtalloc_ign(&sro, 0, fibnum); 1339df8bae1dSRodney W. Grimes 134097d8d152SAndre Oppermann if (sro.ro_rt == NULL) 134102410549SRobert Watson return (NULL); 134202c1c707SAndre Oppermann 134319e5b0a7SRobert Watson ia = ifatoia(sro.ro_rt->rt_ifa); 134419e5b0a7SRobert Watson ifa_ref(&ia->ia_ifa); 134597d8d152SAndre Oppermann RTFREE(sro.ro_rt); 134619e5b0a7SRobert Watson return (ia); 1347df8bae1dSRodney W. Grimes } 1348df8bae1dSRodney W. Grimes 1349df8bae1dSRodney W. Grimes u_char inetctlerrmap[PRC_NCMDS] = { 1350df8bae1dSRodney W. Grimes 0, 0, 0, 0, 1351df8bae1dSRodney W. Grimes 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, 1352df8bae1dSRodney W. Grimes EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, 1353df8bae1dSRodney W. Grimes EMSGSIZE, EHOSTUNREACH, 0, 0, 1354fcaf9f91SMike Silbersack 0, 0, EHOSTUNREACH, 0, 13553b8123b7SJesper Skriver ENOPROTOOPT, ECONNREFUSED 1356df8bae1dSRodney W. Grimes }; 1357df8bae1dSRodney W. Grimes 1358df8bae1dSRodney W. Grimes /* 1359df8bae1dSRodney W. Grimes * Forward a packet. If some error occurs return the sender 1360df8bae1dSRodney W. Grimes * an icmp packet. Note we can't always generate a meaningful 1361df8bae1dSRodney W. Grimes * icmp message because icmp doesn't have a large enough repertoire 1362df8bae1dSRodney W. Grimes * of codes and types. 1363df8bae1dSRodney W. Grimes * 1364df8bae1dSRodney W. Grimes * If not forwarding, just drop the packet. This could be confusing 1365df8bae1dSRodney W. Grimes * if ipforwarding was zero but some routing protocol was advancing 1366df8bae1dSRodney W. Grimes * us as a gateway to somewhere. However, we must let the routing 1367df8bae1dSRodney W. Grimes * protocol deal with that. 1368df8bae1dSRodney W. Grimes * 1369df8bae1dSRodney W. Grimes * The srcrt parameter indicates whether the packet is being forwarded 1370df8bae1dSRodney W. Grimes * via a source route. 1371df8bae1dSRodney W. Grimes */ 13729b932e9eSAndre Oppermann void 13739b932e9eSAndre Oppermann ip_forward(struct mbuf *m, int srcrt) 1374df8bae1dSRodney W. Grimes { 13752b25acc1SLuigi Rizzo struct ip *ip = mtod(m, struct ip *); 1376efbad259SEdward Tomasz Napierala struct in_ifaddr *ia; 1377df8bae1dSRodney W. Grimes struct mbuf *mcopy; 13789b932e9eSAndre Oppermann struct in_addr dest; 1379b835b6feSBjoern A. Zeeb struct route ro; 1380c773494eSAndre Oppermann int error, type = 0, code = 0, mtu = 0; 13813efc3014SJulian Elischer 13829b932e9eSAndre Oppermann if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(ip->ip_dst) == 0) { 138386425c62SRobert Watson IPSTAT_INC(ips_cantforward); 1384df8bae1dSRodney W. Grimes m_freem(m); 1385df8bae1dSRodney W. Grimes return; 1386df8bae1dSRodney W. Grimes } 13871b968362SDag-Erling Smørgrav #ifdef IPSTEALTH 1388603724d3SBjoern A. Zeeb if (!V_ipstealth) { 13891b968362SDag-Erling Smørgrav #endif 1390df8bae1dSRodney W. Grimes if (ip->ip_ttl <= IPTTLDEC) { 13911b968362SDag-Erling Smørgrav icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 139202c1c707SAndre Oppermann 0, 0); 1393df8bae1dSRodney W. Grimes return; 1394df8bae1dSRodney W. Grimes } 13951b968362SDag-Erling Smørgrav #ifdef IPSTEALTH 13961b968362SDag-Erling Smørgrav } 13971b968362SDag-Erling Smørgrav #endif 1398df8bae1dSRodney W. Grimes 13998b07e49aSJulian Elischer ia = ip_rtaddr(ip->ip_dst, M_GETFIB(m)); 1400efbad259SEdward Tomasz Napierala #ifndef IPSEC 1401efbad259SEdward Tomasz Napierala /* 1402efbad259SEdward Tomasz Napierala * 'ia' may be NULL if there is no route for this destination. 1403efbad259SEdward Tomasz Napierala * In case of IPsec, Don't discard it just yet, but pass it to 1404efbad259SEdward Tomasz Napierala * ip_output in case of outgoing IPsec policy. 1405efbad259SEdward Tomasz Napierala */ 1406d23d475fSGuido van Rooij if (!srcrt && ia == NULL) { 140702c1c707SAndre Oppermann icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0); 1408df8bae1dSRodney W. Grimes return; 140902c1c707SAndre Oppermann } 1410efbad259SEdward Tomasz Napierala #endif 1411df8bae1dSRodney W. Grimes 1412df8bae1dSRodney W. Grimes /* 1413bfef7ed4SIan Dowse * Save the IP header and at most 8 bytes of the payload, 1414bfef7ed4SIan Dowse * in case we need to generate an ICMP message to the src. 1415bfef7ed4SIan Dowse * 14164d2e3692SLuigi Rizzo * XXX this can be optimized a lot by saving the data in a local 14174d2e3692SLuigi Rizzo * buffer on the stack (72 bytes at most), and only allocating the 14184d2e3692SLuigi Rizzo * mbuf if really necessary. The vast majority of the packets 14194d2e3692SLuigi Rizzo * are forwarded without having to send an ICMP back (either 14204d2e3692SLuigi Rizzo * because unnecessary, or because rate limited), so we are 14214d2e3692SLuigi Rizzo * really we are wasting a lot of work here. 14224d2e3692SLuigi Rizzo * 1423bfef7ed4SIan Dowse * We don't use m_copy() because it might return a reference 1424bfef7ed4SIan Dowse * to a shared cluster. Both this function and ip_output() 1425bfef7ed4SIan Dowse * assume exclusive access to the IP header in `m', so any 1426bfef7ed4SIan Dowse * data in a cluster may change before we reach icmp_error(). 1427df8bae1dSRodney W. Grimes */ 1428780b2f69SAndre Oppermann MGETHDR(mcopy, M_DONTWAIT, m->m_type); 1429a163d034SWarner Losh if (mcopy != NULL && !m_dup_pkthdr(mcopy, m, M_DONTWAIT)) { 14309967cafcSSam Leffler /* 14319967cafcSSam Leffler * It's probably ok if the pkthdr dup fails (because 14329967cafcSSam Leffler * the deep copy of the tag chain failed), but for now 14339967cafcSSam Leffler * be conservative and just discard the copy since 14349967cafcSSam Leffler * code below may some day want the tags. 14359967cafcSSam Leffler */ 14369967cafcSSam Leffler m_free(mcopy); 14379967cafcSSam Leffler mcopy = NULL; 14389967cafcSSam Leffler } 1439bfef7ed4SIan Dowse if (mcopy != NULL) { 1440780b2f69SAndre Oppermann mcopy->m_len = min(ip->ip_len, M_TRAILINGSPACE(mcopy)); 1441e6b0a570SBruce M Simpson mcopy->m_pkthdr.len = mcopy->m_len; 1442bfef7ed4SIan Dowse m_copydata(m, 0, mcopy->m_len, mtod(mcopy, caddr_t)); 1443bfef7ed4SIan Dowse } 144404287599SRuslan Ermilov 144504287599SRuslan Ermilov #ifdef IPSTEALTH 1446603724d3SBjoern A. Zeeb if (!V_ipstealth) { 144704287599SRuslan Ermilov #endif 144804287599SRuslan Ermilov ip->ip_ttl -= IPTTLDEC; 144904287599SRuslan Ermilov #ifdef IPSTEALTH 145004287599SRuslan Ermilov } 145104287599SRuslan Ermilov #endif 1452df8bae1dSRodney W. Grimes 1453df8bae1dSRodney W. Grimes /* 1454df8bae1dSRodney W. Grimes * If forwarding packet using same interface that it came in on, 1455df8bae1dSRodney W. Grimes * perhaps should send a redirect to sender to shortcut a hop. 1456df8bae1dSRodney W. Grimes * Only send redirect if source is sending directly to us, 1457df8bae1dSRodney W. Grimes * and if packet was not source routed (or has any options). 1458df8bae1dSRodney W. Grimes * Also, don't send redirect if forwarding using a default route 1459df8bae1dSRodney W. Grimes * or a route modified by a redirect. 1460df8bae1dSRodney W. Grimes */ 14619b932e9eSAndre Oppermann dest.s_addr = 0; 1462efbad259SEdward Tomasz Napierala if (!srcrt && V_ipsendredirects && 1463efbad259SEdward Tomasz Napierala ia != NULL && ia->ia_ifp == m->m_pkthdr.rcvif) { 146402c1c707SAndre Oppermann struct sockaddr_in *sin; 146502c1c707SAndre Oppermann struct rtentry *rt; 146602c1c707SAndre Oppermann 14670cfbbe3bSAndre Oppermann bzero(&ro, sizeof(ro)); 146802c1c707SAndre Oppermann sin = (struct sockaddr_in *)&ro.ro_dst; 146902c1c707SAndre Oppermann sin->sin_family = AF_INET; 147002c1c707SAndre Oppermann sin->sin_len = sizeof(*sin); 14719b932e9eSAndre Oppermann sin->sin_addr = ip->ip_dst; 14726e6b3f7cSQing Li in_rtalloc_ign(&ro, 0, M_GETFIB(m)); 147302c1c707SAndre Oppermann 147402c1c707SAndre Oppermann rt = ro.ro_rt; 147502c1c707SAndre Oppermann 147602c1c707SAndre Oppermann if (rt && (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0 && 14779b932e9eSAndre Oppermann satosin(rt_key(rt))->sin_addr.s_addr != 0) { 1478df8bae1dSRodney W. Grimes #define RTA(rt) ((struct in_ifaddr *)(rt->rt_ifa)) 1479df8bae1dSRodney W. Grimes u_long src = ntohl(ip->ip_src.s_addr); 1480df8bae1dSRodney W. Grimes 1481df8bae1dSRodney W. Grimes if (RTA(rt) && 1482df8bae1dSRodney W. Grimes (src & RTA(rt)->ia_subnetmask) == RTA(rt)->ia_subnet) { 1483df8bae1dSRodney W. Grimes if (rt->rt_flags & RTF_GATEWAY) 14849b932e9eSAndre Oppermann dest.s_addr = satosin(rt->rt_gateway)->sin_addr.s_addr; 1485df8bae1dSRodney W. Grimes else 14869b932e9eSAndre Oppermann dest.s_addr = ip->ip_dst.s_addr; 1487df8bae1dSRodney W. Grimes /* Router requirements says to only send host redirects */ 1488df8bae1dSRodney W. Grimes type = ICMP_REDIRECT; 1489df8bae1dSRodney W. Grimes code = ICMP_REDIRECT_HOST; 1490df8bae1dSRodney W. Grimes } 1491df8bae1dSRodney W. Grimes } 149202c1c707SAndre Oppermann if (rt) 149302c1c707SAndre Oppermann RTFREE(rt); 149402c1c707SAndre Oppermann } 1495df8bae1dSRodney W. Grimes 1496b835b6feSBjoern A. Zeeb /* 1497b835b6feSBjoern A. Zeeb * Try to cache the route MTU from ip_output so we can consider it for 1498b835b6feSBjoern A. Zeeb * the ICMP_UNREACH_NEEDFRAG "Next-Hop MTU" field described in RFC1191. 1499b835b6feSBjoern A. Zeeb */ 1500b835b6feSBjoern A. Zeeb bzero(&ro, sizeof(ro)); 1501b835b6feSBjoern A. Zeeb 1502b835b6feSBjoern A. Zeeb error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL, NULL); 1503b835b6feSBjoern A. Zeeb 1504b835b6feSBjoern A. Zeeb if (error == EMSGSIZE && ro.ro_rt) 1505b835b6feSBjoern A. Zeeb mtu = ro.ro_rt->rt_rmx.rmx_mtu; 1506b835b6feSBjoern A. Zeeb if (ro.ro_rt) 1507b835b6feSBjoern A. Zeeb RTFREE(ro.ro_rt); 1508b835b6feSBjoern A. Zeeb 1509df8bae1dSRodney W. Grimes if (error) 151086425c62SRobert Watson IPSTAT_INC(ips_cantforward); 1511df8bae1dSRodney W. Grimes else { 151286425c62SRobert Watson IPSTAT_INC(ips_forward); 1513df8bae1dSRodney W. Grimes if (type) 151486425c62SRobert Watson IPSTAT_INC(ips_redirectsent); 1515df8bae1dSRodney W. Grimes else { 15169188b4a1SAndre Oppermann if (mcopy) 1517df8bae1dSRodney W. Grimes m_freem(mcopy); 15188c0fec80SRobert Watson if (ia != NULL) 15198c0fec80SRobert Watson ifa_free(&ia->ia_ifa); 1520df8bae1dSRodney W. Grimes return; 1521df8bae1dSRodney W. Grimes } 1522df8bae1dSRodney W. Grimes } 15238c0fec80SRobert Watson if (mcopy == NULL) { 15248c0fec80SRobert Watson if (ia != NULL) 15258c0fec80SRobert Watson ifa_free(&ia->ia_ifa); 1526df8bae1dSRodney W. Grimes return; 15278c0fec80SRobert Watson } 1528df8bae1dSRodney W. Grimes 1529df8bae1dSRodney W. Grimes switch (error) { 1530df8bae1dSRodney W. Grimes 1531df8bae1dSRodney W. Grimes case 0: /* forwarded, but need redirect */ 1532df8bae1dSRodney W. Grimes /* type, code set above */ 1533df8bae1dSRodney W. Grimes break; 1534df8bae1dSRodney W. Grimes 1535efbad259SEdward Tomasz Napierala case ENETUNREACH: 1536df8bae1dSRodney W. Grimes case EHOSTUNREACH: 1537df8bae1dSRodney W. Grimes case ENETDOWN: 1538df8bae1dSRodney W. Grimes case EHOSTDOWN: 1539df8bae1dSRodney W. Grimes default: 1540df8bae1dSRodney W. Grimes type = ICMP_UNREACH; 1541df8bae1dSRodney W. Grimes code = ICMP_UNREACH_HOST; 1542df8bae1dSRodney W. Grimes break; 1543df8bae1dSRodney W. Grimes 1544df8bae1dSRodney W. Grimes case EMSGSIZE: 1545df8bae1dSRodney W. Grimes type = ICMP_UNREACH; 1546df8bae1dSRodney W. Grimes code = ICMP_UNREACH_NEEDFRAG; 15471dfcf0d2SAndre Oppermann 1548b2630c29SGeorge V. Neville-Neil #ifdef IPSEC 1549b835b6feSBjoern A. Zeeb /* 1550b835b6feSBjoern A. Zeeb * If IPsec is configured for this path, 1551b835b6feSBjoern A. Zeeb * override any possibly mtu value set by ip_output. 1552b835b6feSBjoern A. Zeeb */ 1553b835b6feSBjoern A. Zeeb mtu = ip_ipsec_mtu(m, mtu); 1554b2630c29SGeorge V. Neville-Neil #endif /* IPSEC */ 15559b932e9eSAndre Oppermann /* 1556b835b6feSBjoern A. Zeeb * If the MTU was set before make sure we are below the 1557b835b6feSBjoern A. Zeeb * interface MTU. 1558ab48768bSAndre Oppermann * If the MTU wasn't set before use the interface mtu or 1559ab48768bSAndre Oppermann * fall back to the next smaller mtu step compared to the 1560ab48768bSAndre Oppermann * current packet size. 15619b932e9eSAndre Oppermann */ 1562b835b6feSBjoern A. Zeeb if (mtu != 0) { 1563b835b6feSBjoern A. Zeeb if (ia != NULL) 1564b835b6feSBjoern A. Zeeb mtu = min(mtu, ia->ia_ifp->if_mtu); 1565b835b6feSBjoern A. Zeeb } else { 1566ab48768bSAndre Oppermann if (ia != NULL) 1567c773494eSAndre Oppermann mtu = ia->ia_ifp->if_mtu; 1568ab48768bSAndre Oppermann else 1569ab48768bSAndre Oppermann mtu = ip_next_mtu(ip->ip_len, 0); 1570ab48768bSAndre Oppermann } 157186425c62SRobert Watson IPSTAT_INC(ips_cantfrag); 1572df8bae1dSRodney W. Grimes break; 1573df8bae1dSRodney W. Grimes 1574df8bae1dSRodney W. Grimes case ENOBUFS: 1575df285b3dSMike Silbersack /* 1576df285b3dSMike Silbersack * A router should not generate ICMP_SOURCEQUENCH as 1577df285b3dSMike Silbersack * required in RFC1812 Requirements for IP Version 4 Routers. 1578df285b3dSMike Silbersack * Source quench could be a big problem under DoS attacks, 1579df285b3dSMike Silbersack * or if the underlying interface is rate-limited. 1580df285b3dSMike Silbersack * Those who need source quench packets may re-enable them 1581df285b3dSMike Silbersack * via the net.inet.ip.sendsourcequench sysctl. 1582df285b3dSMike Silbersack */ 1583603724d3SBjoern A. Zeeb if (V_ip_sendsourcequench == 0) { 1584df285b3dSMike Silbersack m_freem(mcopy); 15858c0fec80SRobert Watson if (ia != NULL) 15868c0fec80SRobert Watson ifa_free(&ia->ia_ifa); 1587df285b3dSMike Silbersack return; 1588df285b3dSMike Silbersack } else { 1589df8bae1dSRodney W. Grimes type = ICMP_SOURCEQUENCH; 1590df8bae1dSRodney W. Grimes code = 0; 1591df285b3dSMike Silbersack } 1592df8bae1dSRodney W. Grimes break; 15933a06e3e0SRuslan Ermilov 15943a06e3e0SRuslan Ermilov case EACCES: /* ipfw denied packet */ 15953a06e3e0SRuslan Ermilov m_freem(mcopy); 15968c0fec80SRobert Watson if (ia != NULL) 15978c0fec80SRobert Watson ifa_free(&ia->ia_ifa); 15983a06e3e0SRuslan Ermilov return; 1599df8bae1dSRodney W. Grimes } 16008c0fec80SRobert Watson if (ia != NULL) 16018c0fec80SRobert Watson ifa_free(&ia->ia_ifa); 1602c773494eSAndre Oppermann icmp_error(mcopy, type, code, dest.s_addr, mtu); 1603df8bae1dSRodney W. Grimes } 1604df8bae1dSRodney W. Grimes 160582c23ebaSBill Fenner void 1606f2565d68SRobert Watson ip_savecontrol(struct inpcb *inp, struct mbuf **mp, struct ip *ip, 1607f2565d68SRobert Watson struct mbuf *m) 160882c23ebaSBill Fenner { 16098b615593SMarko Zec 1610be8a62e8SPoul-Henning Kamp if (inp->inp_socket->so_options & (SO_BINTIME | SO_TIMESTAMP)) { 1611be8a62e8SPoul-Henning Kamp struct bintime bt; 1612be8a62e8SPoul-Henning Kamp 1613be8a62e8SPoul-Henning Kamp bintime(&bt); 1614be8a62e8SPoul-Henning Kamp if (inp->inp_socket->so_options & SO_BINTIME) { 1615be8a62e8SPoul-Henning Kamp *mp = sbcreatecontrol((caddr_t) &bt, sizeof(bt), 1616be8a62e8SPoul-Henning Kamp SCM_BINTIME, SOL_SOCKET); 1617be8a62e8SPoul-Henning Kamp if (*mp) 1618be8a62e8SPoul-Henning Kamp mp = &(*mp)->m_next; 1619be8a62e8SPoul-Henning Kamp } 162082c23ebaSBill Fenner if (inp->inp_socket->so_options & SO_TIMESTAMP) { 162182c23ebaSBill Fenner struct timeval tv; 162282c23ebaSBill Fenner 1623be8a62e8SPoul-Henning Kamp bintime2timeval(&bt, &tv); 162482c23ebaSBill Fenner *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv), 162582c23ebaSBill Fenner SCM_TIMESTAMP, SOL_SOCKET); 162682c23ebaSBill Fenner if (*mp) 162782c23ebaSBill Fenner mp = &(*mp)->m_next; 16284cc20ab1SSeigo Tanimura } 1629be8a62e8SPoul-Henning Kamp } 163082c23ebaSBill Fenner if (inp->inp_flags & INP_RECVDSTADDR) { 163182c23ebaSBill Fenner *mp = sbcreatecontrol((caddr_t) &ip->ip_dst, 163282c23ebaSBill Fenner sizeof(struct in_addr), IP_RECVDSTADDR, IPPROTO_IP); 163382c23ebaSBill Fenner if (*mp) 163482c23ebaSBill Fenner mp = &(*mp)->m_next; 163582c23ebaSBill Fenner } 16364957466bSMatthew N. Dodd if (inp->inp_flags & INP_RECVTTL) { 16374957466bSMatthew N. Dodd *mp = sbcreatecontrol((caddr_t) &ip->ip_ttl, 16384957466bSMatthew N. Dodd sizeof(u_char), IP_RECVTTL, IPPROTO_IP); 16394957466bSMatthew N. Dodd if (*mp) 16404957466bSMatthew N. Dodd mp = &(*mp)->m_next; 16414957466bSMatthew N. Dodd } 164282c23ebaSBill Fenner #ifdef notyet 164382c23ebaSBill Fenner /* XXX 164482c23ebaSBill Fenner * Moving these out of udp_input() made them even more broken 164582c23ebaSBill Fenner * than they already were. 164682c23ebaSBill Fenner */ 164782c23ebaSBill Fenner /* options were tossed already */ 164882c23ebaSBill Fenner if (inp->inp_flags & INP_RECVOPTS) { 164982c23ebaSBill Fenner *mp = sbcreatecontrol((caddr_t) opts_deleted_above, 165082c23ebaSBill Fenner sizeof(struct in_addr), IP_RECVOPTS, IPPROTO_IP); 165182c23ebaSBill Fenner if (*mp) 165282c23ebaSBill Fenner mp = &(*mp)->m_next; 165382c23ebaSBill Fenner } 165482c23ebaSBill Fenner /* ip_srcroute doesn't do what we want here, need to fix */ 165582c23ebaSBill Fenner if (inp->inp_flags & INP_RECVRETOPTS) { 1656e0982661SAndre Oppermann *mp = sbcreatecontrol((caddr_t) ip_srcroute(m), 165782c23ebaSBill Fenner sizeof(struct in_addr), IP_RECVRETOPTS, IPPROTO_IP); 165882c23ebaSBill Fenner if (*mp) 165982c23ebaSBill Fenner mp = &(*mp)->m_next; 166082c23ebaSBill Fenner } 166182c23ebaSBill Fenner #endif 166282c23ebaSBill Fenner if (inp->inp_flags & INP_RECVIF) { 1663d314ad7bSJulian Elischer struct ifnet *ifp; 1664d314ad7bSJulian Elischer struct sdlbuf { 166582c23ebaSBill Fenner struct sockaddr_dl sdl; 1666d314ad7bSJulian Elischer u_char pad[32]; 1667d314ad7bSJulian Elischer } sdlbuf; 1668d314ad7bSJulian Elischer struct sockaddr_dl *sdp; 1669d314ad7bSJulian Elischer struct sockaddr_dl *sdl2 = &sdlbuf.sdl; 167082c23ebaSBill Fenner 1671d314ad7bSJulian Elischer if (((ifp = m->m_pkthdr.rcvif)) 1672603724d3SBjoern A. Zeeb && ( ifp->if_index && (ifp->if_index <= V_if_index))) { 16734a0d6638SRuslan Ermilov sdp = (struct sockaddr_dl *)ifp->if_addr->ifa_addr; 1674d314ad7bSJulian Elischer /* 1675d314ad7bSJulian Elischer * Change our mind and don't try copy. 1676d314ad7bSJulian Elischer */ 1677d314ad7bSJulian Elischer if ((sdp->sdl_family != AF_LINK) 1678d314ad7bSJulian Elischer || (sdp->sdl_len > sizeof(sdlbuf))) { 1679d314ad7bSJulian Elischer goto makedummy; 1680d314ad7bSJulian Elischer } 1681d314ad7bSJulian Elischer bcopy(sdp, sdl2, sdp->sdl_len); 1682d314ad7bSJulian Elischer } else { 1683d314ad7bSJulian Elischer makedummy: 1684d314ad7bSJulian Elischer sdl2->sdl_len 1685d314ad7bSJulian Elischer = offsetof(struct sockaddr_dl, sdl_data[0]); 1686d314ad7bSJulian Elischer sdl2->sdl_family = AF_LINK; 1687d314ad7bSJulian Elischer sdl2->sdl_index = 0; 1688d314ad7bSJulian Elischer sdl2->sdl_nlen = sdl2->sdl_alen = sdl2->sdl_slen = 0; 1689d314ad7bSJulian Elischer } 1690d314ad7bSJulian Elischer *mp = sbcreatecontrol((caddr_t) sdl2, sdl2->sdl_len, 169182c23ebaSBill Fenner IP_RECVIF, IPPROTO_IP); 169282c23ebaSBill Fenner if (*mp) 169382c23ebaSBill Fenner mp = &(*mp)->m_next; 169482c23ebaSBill Fenner } 169582c23ebaSBill Fenner } 169682c23ebaSBill Fenner 16974d2e3692SLuigi Rizzo /* 169830916a2dSRobert Watson * XXXRW: Multicast routing code in ip_mroute.c is generally MPSAFE, but the 169930916a2dSRobert Watson * ip_rsvp and ip_rsvp_on variables need to be interlocked with rsvp_on 170030916a2dSRobert Watson * locking. This code remains in ip_input.c as ip_mroute.c is optionally 170130916a2dSRobert Watson * compiled. 17024d2e3692SLuigi Rizzo */ 1703df8bae1dSRodney W. Grimes int 1704f0068c4aSGarrett Wollman ip_rsvp_init(struct socket *so) 1705f0068c4aSGarrett Wollman { 17068b615593SMarko Zec 1707f0068c4aSGarrett Wollman if (so->so_type != SOCK_RAW || 1708f0068c4aSGarrett Wollman so->so_proto->pr_protocol != IPPROTO_RSVP) 1709f0068c4aSGarrett Wollman return EOPNOTSUPP; 1710f0068c4aSGarrett Wollman 1711603724d3SBjoern A. Zeeb if (V_ip_rsvpd != NULL) 1712f0068c4aSGarrett Wollman return EADDRINUSE; 1713f0068c4aSGarrett Wollman 1714603724d3SBjoern A. Zeeb V_ip_rsvpd = so; 17151c5de19aSGarrett Wollman /* 17161c5de19aSGarrett Wollman * This may seem silly, but we need to be sure we don't over-increment 17171c5de19aSGarrett Wollman * the RSVP counter, in case something slips up. 17181c5de19aSGarrett Wollman */ 1719603724d3SBjoern A. Zeeb if (!V_ip_rsvp_on) { 1720603724d3SBjoern A. Zeeb V_ip_rsvp_on = 1; 1721603724d3SBjoern A. Zeeb V_rsvp_on++; 17221c5de19aSGarrett Wollman } 1723f0068c4aSGarrett Wollman 1724f0068c4aSGarrett Wollman return 0; 1725f0068c4aSGarrett Wollman } 1726f0068c4aSGarrett Wollman 1727f0068c4aSGarrett Wollman int 1728f0068c4aSGarrett Wollman ip_rsvp_done(void) 1729f0068c4aSGarrett Wollman { 17308b615593SMarko Zec 1731603724d3SBjoern A. Zeeb V_ip_rsvpd = NULL; 17321c5de19aSGarrett Wollman /* 17331c5de19aSGarrett Wollman * This may seem silly, but we need to be sure we don't over-decrement 17341c5de19aSGarrett Wollman * the RSVP counter, in case something slips up. 17351c5de19aSGarrett Wollman */ 1736603724d3SBjoern A. Zeeb if (V_ip_rsvp_on) { 1737603724d3SBjoern A. Zeeb V_ip_rsvp_on = 0; 1738603724d3SBjoern A. Zeeb V_rsvp_on--; 17391c5de19aSGarrett Wollman } 1740f0068c4aSGarrett Wollman return 0; 1741f0068c4aSGarrett Wollman } 1742bbb4330bSLuigi Rizzo 1743bbb4330bSLuigi Rizzo void 1744bbb4330bSLuigi Rizzo rsvp_input(struct mbuf *m, int off) /* XXX must fixup manually */ 1745bbb4330bSLuigi Rizzo { 17468b615593SMarko Zec 1747bbb4330bSLuigi Rizzo if (rsvp_input_p) { /* call the real one if loaded */ 1748bbb4330bSLuigi Rizzo rsvp_input_p(m, off); 1749bbb4330bSLuigi Rizzo return; 1750bbb4330bSLuigi Rizzo } 1751bbb4330bSLuigi Rizzo 1752bbb4330bSLuigi Rizzo /* Can still get packets with rsvp_on = 0 if there is a local member 1753bbb4330bSLuigi Rizzo * of the group to which the RSVP packet is addressed. But in this 1754bbb4330bSLuigi Rizzo * case we want to throw the packet away. 1755bbb4330bSLuigi Rizzo */ 1756bbb4330bSLuigi Rizzo 1757603724d3SBjoern A. Zeeb if (!V_rsvp_on) { 1758bbb4330bSLuigi Rizzo m_freem(m); 1759bbb4330bSLuigi Rizzo return; 1760bbb4330bSLuigi Rizzo } 1761bbb4330bSLuigi Rizzo 1762603724d3SBjoern A. Zeeb if (V_ip_rsvpd != NULL) { 1763bbb4330bSLuigi Rizzo rip_input(m, off); 1764bbb4330bSLuigi Rizzo return; 1765bbb4330bSLuigi Rizzo } 1766bbb4330bSLuigi Rizzo /* Drop the packet */ 1767bbb4330bSLuigi Rizzo m_freem(m); 1768bbb4330bSLuigi Rizzo } 1769