1 /*- 2 * Copyright (c) 1982, 1986, 1988, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 4. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 * 29 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 30 */ 31 32 #include <sys/cdefs.h> 33 __FBSDID("$FreeBSD$"); 34 35 #include "opt_bootp.h" 36 #include "opt_ipfw.h" 37 #include "opt_ipstealth.h" 38 #include "opt_ipsec.h" 39 #include "opt_route.h" 40 #include "opt_rss.h" 41 42 #include <sys/param.h> 43 #include <sys/systm.h> 44 #include <sys/hhook.h> 45 #include <sys/mbuf.h> 46 #include <sys/malloc.h> 47 #include <sys/domain.h> 48 #include <sys/protosw.h> 49 #include <sys/socket.h> 50 #include <sys/time.h> 51 #include <sys/kernel.h> 52 #include <sys/lock.h> 53 #include <sys/rmlock.h> 54 #include <sys/rwlock.h> 55 #include <sys/sdt.h> 56 #include <sys/syslog.h> 57 #include <sys/sysctl.h> 58 59 #include <net/pfil.h> 60 #include <net/if.h> 61 #include <net/if_types.h> 62 #include <net/if_var.h> 63 #include <net/if_dl.h> 64 #include <net/route.h> 65 #include <net/netisr.h> 66 #include <net/rss_config.h> 67 #include <net/vnet.h> 68 69 #include <netinet/in.h> 70 #include <netinet/in_kdtrace.h> 71 #include <netinet/in_systm.h> 72 #include <netinet/in_var.h> 73 #include <netinet/ip.h> 74 #include <netinet/in_pcb.h> 75 #include <netinet/ip_var.h> 76 #include <netinet/ip_fw.h> 77 #include <netinet/ip_icmp.h> 78 #include <netinet/ip_options.h> 79 #include <machine/in_cksum.h> 80 #include <netinet/ip_carp.h> 81 #ifdef IPSEC 82 #include <netinet/ip_ipsec.h> 83 #include <netipsec/ipsec.h> 84 #include <netipsec/key.h> 85 #endif /* IPSEC */ 86 #include <netinet/in_rss.h> 87 88 #include <sys/socketvar.h> 89 90 #include <security/mac/mac_framework.h> 91 92 #ifdef CTASSERT 93 CTASSERT(sizeof(struct ip) == 20); 94 #endif 95 96 /* IP reassembly functions are defined in ip_reass.c. */ 97 extern void ipreass_init(void); 98 extern void ipreass_drain(void); 99 extern void ipreass_slowtimo(void); 100 #ifdef VIMAGE 101 extern void ipreass_destroy(void); 102 #endif 103 104 struct rmlock in_ifaddr_lock; 105 RM_SYSINIT(in_ifaddr_lock, &in_ifaddr_lock, "in_ifaddr_lock"); 106 107 VNET_DEFINE(int, rsvp_on); 108 109 VNET_DEFINE(int, ipforwarding); 110 SYSCTL_INT(_net_inet_ip, IPCTL_FORWARDING, forwarding, CTLFLAG_VNET | CTLFLAG_RW, 111 &VNET_NAME(ipforwarding), 0, 112 "Enable IP forwarding between interfaces"); 113 114 static VNET_DEFINE(int, ipsendredirects) = 1; /* XXX */ 115 #define V_ipsendredirects VNET(ipsendredirects) 116 SYSCTL_INT(_net_inet_ip, IPCTL_SENDREDIRECTS, redirect, CTLFLAG_VNET | CTLFLAG_RW, 117 &VNET_NAME(ipsendredirects), 0, 118 "Enable sending IP redirects"); 119 120 /* 121 * XXX - Setting ip_checkinterface mostly implements the receive side of 122 * the Strong ES model described in RFC 1122, but since the routing table 123 * and transmit implementation do not implement the Strong ES model, 124 * setting this to 1 results in an odd hybrid. 125 * 126 * XXX - ip_checkinterface currently must be disabled if you use ipnat 127 * to translate the destination address to another local interface. 128 * 129 * XXX - ip_checkinterface must be disabled if you add IP aliases 130 * to the loopback interface instead of the interface where the 131 * packets for those addresses are received. 132 */ 133 static VNET_DEFINE(int, ip_checkinterface); 134 #define V_ip_checkinterface VNET(ip_checkinterface) 135 SYSCTL_INT(_net_inet_ip, OID_AUTO, check_interface, CTLFLAG_VNET | CTLFLAG_RW, 136 &VNET_NAME(ip_checkinterface), 0, 137 "Verify packet arrives on correct interface"); 138 139 VNET_DEFINE(struct pfil_head, inet_pfil_hook); /* Packet filter hooks */ 140 141 static struct netisr_handler ip_nh = { 142 .nh_name = "ip", 143 .nh_handler = ip_input, 144 .nh_proto = NETISR_IP, 145 #ifdef RSS 146 .nh_m2cpuid = rss_soft_m2cpuid_v4, 147 .nh_policy = NETISR_POLICY_CPU, 148 .nh_dispatch = NETISR_DISPATCH_HYBRID, 149 #else 150 .nh_policy = NETISR_POLICY_FLOW, 151 #endif 152 }; 153 154 #ifdef RSS 155 /* 156 * Directly dispatched frames are currently assumed 157 * to have a flowid already calculated. 158 * 159 * It should likely have something that assert it 160 * actually has valid flow details. 161 */ 162 static struct netisr_handler ip_direct_nh = { 163 .nh_name = "ip_direct", 164 .nh_handler = ip_direct_input, 165 .nh_proto = NETISR_IP_DIRECT, 166 .nh_m2cpuid = rss_soft_m2cpuid_v4, 167 .nh_policy = NETISR_POLICY_CPU, 168 .nh_dispatch = NETISR_DISPATCH_HYBRID, 169 }; 170 #endif 171 172 extern struct domain inetdomain; 173 extern struct protosw inetsw[]; 174 u_char ip_protox[IPPROTO_MAX]; 175 VNET_DEFINE(struct in_ifaddrhead, in_ifaddrhead); /* first inet address */ 176 VNET_DEFINE(struct in_ifaddrhashhead *, in_ifaddrhashtbl); /* inet addr hash table */ 177 VNET_DEFINE(u_long, in_ifaddrhmask); /* mask for hash table */ 178 179 #ifdef IPCTL_DEFMTU 180 SYSCTL_INT(_net_inet_ip, IPCTL_DEFMTU, mtu, CTLFLAG_RW, 181 &ip_mtu, 0, "Default MTU"); 182 #endif 183 184 #ifdef IPSTEALTH 185 VNET_DEFINE(int, ipstealth); 186 SYSCTL_INT(_net_inet_ip, OID_AUTO, stealth, CTLFLAG_VNET | CTLFLAG_RW, 187 &VNET_NAME(ipstealth), 0, 188 "IP stealth mode, no TTL decrementation on forwarding"); 189 #endif 190 191 /* 192 * IP statistics are stored in the "array" of counter(9)s. 193 */ 194 VNET_PCPUSTAT_DEFINE(struct ipstat, ipstat); 195 VNET_PCPUSTAT_SYSINIT(ipstat); 196 SYSCTL_VNET_PCPUSTAT(_net_inet_ip, IPCTL_STATS, stats, struct ipstat, ipstat, 197 "IP statistics (struct ipstat, netinet/ip_var.h)"); 198 199 #ifdef VIMAGE 200 VNET_PCPUSTAT_SYSUNINIT(ipstat); 201 #endif /* VIMAGE */ 202 203 /* 204 * Kernel module interface for updating ipstat. The argument is an index 205 * into ipstat treated as an array. 206 */ 207 void 208 kmod_ipstat_inc(int statnum) 209 { 210 211 counter_u64_add(VNET(ipstat)[statnum], 1); 212 } 213 214 void 215 kmod_ipstat_dec(int statnum) 216 { 217 218 counter_u64_add(VNET(ipstat)[statnum], -1); 219 } 220 221 static int 222 sysctl_netinet_intr_queue_maxlen(SYSCTL_HANDLER_ARGS) 223 { 224 int error, qlimit; 225 226 netisr_getqlimit(&ip_nh, &qlimit); 227 error = sysctl_handle_int(oidp, &qlimit, 0, req); 228 if (error || !req->newptr) 229 return (error); 230 if (qlimit < 1) 231 return (EINVAL); 232 return (netisr_setqlimit(&ip_nh, qlimit)); 233 } 234 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQMAXLEN, intr_queue_maxlen, 235 CTLTYPE_INT|CTLFLAG_RW, 0, 0, sysctl_netinet_intr_queue_maxlen, "I", 236 "Maximum size of the IP input queue"); 237 238 static int 239 sysctl_netinet_intr_queue_drops(SYSCTL_HANDLER_ARGS) 240 { 241 u_int64_t qdrops_long; 242 int error, qdrops; 243 244 netisr_getqdrops(&ip_nh, &qdrops_long); 245 qdrops = qdrops_long; 246 error = sysctl_handle_int(oidp, &qdrops, 0, req); 247 if (error || !req->newptr) 248 return (error); 249 if (qdrops != 0) 250 return (EINVAL); 251 netisr_clearqdrops(&ip_nh); 252 return (0); 253 } 254 255 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQDROPS, intr_queue_drops, 256 CTLTYPE_INT|CTLFLAG_RD, 0, 0, sysctl_netinet_intr_queue_drops, "I", 257 "Number of packets dropped from the IP input queue"); 258 259 #ifdef RSS 260 static int 261 sysctl_netinet_intr_direct_queue_maxlen(SYSCTL_HANDLER_ARGS) 262 { 263 int error, qlimit; 264 265 netisr_getqlimit(&ip_direct_nh, &qlimit); 266 error = sysctl_handle_int(oidp, &qlimit, 0, req); 267 if (error || !req->newptr) 268 return (error); 269 if (qlimit < 1) 270 return (EINVAL); 271 return (netisr_setqlimit(&ip_direct_nh, qlimit)); 272 } 273 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQMAXLEN, intr_direct_queue_maxlen, 274 CTLTYPE_INT|CTLFLAG_RW, 0, 0, sysctl_netinet_intr_direct_queue_maxlen, "I", 275 "Maximum size of the IP direct input queue"); 276 277 static int 278 sysctl_netinet_intr_direct_queue_drops(SYSCTL_HANDLER_ARGS) 279 { 280 u_int64_t qdrops_long; 281 int error, qdrops; 282 283 netisr_getqdrops(&ip_direct_nh, &qdrops_long); 284 qdrops = qdrops_long; 285 error = sysctl_handle_int(oidp, &qdrops, 0, req); 286 if (error || !req->newptr) 287 return (error); 288 if (qdrops != 0) 289 return (EINVAL); 290 netisr_clearqdrops(&ip_direct_nh); 291 return (0); 292 } 293 294 SYSCTL_PROC(_net_inet_ip, IPCTL_INTRQDROPS, intr_direct_queue_drops, 295 CTLTYPE_INT|CTLFLAG_RD, 0, 0, sysctl_netinet_intr_direct_queue_drops, "I", 296 "Number of packets dropped from the IP direct input queue"); 297 #endif /* RSS */ 298 299 /* 300 * IP initialization: fill in IP protocol switch table. 301 * All protocols not implemented in kernel go to raw IP protocol handler. 302 */ 303 void 304 ip_init(void) 305 { 306 struct protosw *pr; 307 int i; 308 309 TAILQ_INIT(&V_in_ifaddrhead); 310 V_in_ifaddrhashtbl = hashinit(INADDR_NHASH, M_IFADDR, &V_in_ifaddrhmask); 311 312 /* Initialize IP reassembly queue. */ 313 ipreass_init(); 314 315 /* Initialize packet filter hooks. */ 316 V_inet_pfil_hook.ph_type = PFIL_TYPE_AF; 317 V_inet_pfil_hook.ph_af = AF_INET; 318 if ((i = pfil_head_register(&V_inet_pfil_hook)) != 0) 319 printf("%s: WARNING: unable to register pfil hook, " 320 "error %d\n", __func__, i); 321 322 if (hhook_head_register(HHOOK_TYPE_IPSEC_IN, AF_INET, 323 &V_ipsec_hhh_in[HHOOK_IPSEC_INET], 324 HHOOK_WAITOK | HHOOK_HEADISINVNET) != 0) 325 printf("%s: WARNING: unable to register input helper hook\n", 326 __func__); 327 if (hhook_head_register(HHOOK_TYPE_IPSEC_OUT, AF_INET, 328 &V_ipsec_hhh_out[HHOOK_IPSEC_INET], 329 HHOOK_WAITOK | HHOOK_HEADISINVNET) != 0) 330 printf("%s: WARNING: unable to register output helper hook\n", 331 __func__); 332 333 /* Skip initialization of globals for non-default instances. */ 334 #ifdef VIMAGE 335 if (!IS_DEFAULT_VNET(curvnet)) { 336 netisr_register_vnet(&ip_nh); 337 #ifdef RSS 338 netisr_register_vnet(&ip_direct_nh); 339 #endif 340 return; 341 } 342 #endif 343 344 pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 345 if (pr == NULL) 346 panic("ip_init: PF_INET not found"); 347 348 /* Initialize the entire ip_protox[] array to IPPROTO_RAW. */ 349 for (i = 0; i < IPPROTO_MAX; i++) 350 ip_protox[i] = pr - inetsw; 351 /* 352 * Cycle through IP protocols and put them into the appropriate place 353 * in ip_protox[]. 354 */ 355 for (pr = inetdomain.dom_protosw; 356 pr < inetdomain.dom_protoswNPROTOSW; pr++) 357 if (pr->pr_domain->dom_family == PF_INET && 358 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) { 359 /* Be careful to only index valid IP protocols. */ 360 if (pr->pr_protocol < IPPROTO_MAX) 361 ip_protox[pr->pr_protocol] = pr - inetsw; 362 } 363 364 netisr_register(&ip_nh); 365 #ifdef RSS 366 netisr_register(&ip_direct_nh); 367 #endif 368 } 369 370 #ifdef VIMAGE 371 static void 372 ip_destroy(void *unused __unused) 373 { 374 int error; 375 376 #ifdef RSS 377 netisr_unregister_vnet(&ip_direct_nh); 378 #endif 379 netisr_unregister_vnet(&ip_nh); 380 381 if ((error = pfil_head_unregister(&V_inet_pfil_hook)) != 0) 382 printf("%s: WARNING: unable to unregister pfil hook, " 383 "error %d\n", __func__, error); 384 385 error = hhook_head_deregister(V_ipsec_hhh_in[HHOOK_IPSEC_INET]); 386 if (error != 0) { 387 printf("%s: WARNING: unable to deregister input helper hook " 388 "type HHOOK_TYPE_IPSEC_IN, id HHOOK_IPSEC_INET: " 389 "error %d returned\n", __func__, error); 390 } 391 error = hhook_head_deregister(V_ipsec_hhh_out[HHOOK_IPSEC_INET]); 392 if (error != 0) { 393 printf("%s: WARNING: unable to deregister output helper hook " 394 "type HHOOK_TYPE_IPSEC_OUT, id HHOOK_IPSEC_INET: " 395 "error %d returned\n", __func__, error); 396 } 397 /* Cleanup in_ifaddr hash table; should be empty. */ 398 hashdestroy(V_in_ifaddrhashtbl, M_IFADDR, V_in_ifaddrhmask); 399 400 /* Destroy IP reassembly queue. */ 401 ipreass_destroy(); 402 } 403 404 VNET_SYSUNINIT(ip, SI_SUB_PROTO_DOMAIN, SI_ORDER_THIRD, ip_destroy, NULL); 405 #endif 406 407 #ifdef RSS 408 /* 409 * IP direct input routine. 410 * 411 * This is called when reinjecting completed fragments where 412 * all of the previous checking and book-keeping has been done. 413 */ 414 void 415 ip_direct_input(struct mbuf *m) 416 { 417 struct ip *ip; 418 int hlen; 419 420 ip = mtod(m, struct ip *); 421 hlen = ip->ip_hl << 2; 422 423 IPSTAT_INC(ips_delivered); 424 (*inetsw[ip_protox[ip->ip_p]].pr_input)(&m, &hlen, ip->ip_p); 425 return; 426 } 427 #endif 428 429 /* 430 * Ip input routine. Checksum and byte swap header. If fragmented 431 * try to reassemble. Process options. Pass to next level. 432 */ 433 void 434 ip_input(struct mbuf *m) 435 { 436 struct ip *ip = NULL; 437 struct in_ifaddr *ia = NULL; 438 struct ifaddr *ifa; 439 struct ifnet *ifp; 440 int checkif, hlen = 0; 441 uint16_t sum, ip_len; 442 int dchg = 0; /* dest changed after fw */ 443 struct in_addr odst; /* original dst address */ 444 445 M_ASSERTPKTHDR(m); 446 447 if (m->m_flags & M_FASTFWD_OURS) { 448 m->m_flags &= ~M_FASTFWD_OURS; 449 /* Set up some basics that will be used later. */ 450 ip = mtod(m, struct ip *); 451 hlen = ip->ip_hl << 2; 452 ip_len = ntohs(ip->ip_len); 453 goto ours; 454 } 455 456 IPSTAT_INC(ips_total); 457 458 if (m->m_pkthdr.len < sizeof(struct ip)) 459 goto tooshort; 460 461 if (m->m_len < sizeof (struct ip) && 462 (m = m_pullup(m, sizeof (struct ip))) == NULL) { 463 IPSTAT_INC(ips_toosmall); 464 return; 465 } 466 ip = mtod(m, struct ip *); 467 468 if (ip->ip_v != IPVERSION) { 469 IPSTAT_INC(ips_badvers); 470 goto bad; 471 } 472 473 hlen = ip->ip_hl << 2; 474 if (hlen < sizeof(struct ip)) { /* minimum header length */ 475 IPSTAT_INC(ips_badhlen); 476 goto bad; 477 } 478 if (hlen > m->m_len) { 479 if ((m = m_pullup(m, hlen)) == NULL) { 480 IPSTAT_INC(ips_badhlen); 481 return; 482 } 483 ip = mtod(m, struct ip *); 484 } 485 486 IP_PROBE(receive, NULL, NULL, ip, m->m_pkthdr.rcvif, ip, NULL); 487 488 /* 127/8 must not appear on wire - RFC1122 */ 489 ifp = m->m_pkthdr.rcvif; 490 if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 491 (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) { 492 if ((ifp->if_flags & IFF_LOOPBACK) == 0) { 493 IPSTAT_INC(ips_badaddr); 494 goto bad; 495 } 496 } 497 498 if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) { 499 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID); 500 } else { 501 if (hlen == sizeof(struct ip)) { 502 sum = in_cksum_hdr(ip); 503 } else { 504 sum = in_cksum(m, hlen); 505 } 506 } 507 if (sum) { 508 IPSTAT_INC(ips_badsum); 509 goto bad; 510 } 511 512 #ifdef ALTQ 513 if (altq_input != NULL && (*altq_input)(m, AF_INET) == 0) 514 /* packet is dropped by traffic conditioner */ 515 return; 516 #endif 517 518 ip_len = ntohs(ip->ip_len); 519 if (ip_len < hlen) { 520 IPSTAT_INC(ips_badlen); 521 goto bad; 522 } 523 524 /* 525 * Check that the amount of data in the buffers 526 * is as at least much as the IP header would have us expect. 527 * Trim mbufs if longer than we expect. 528 * Drop packet if shorter than we expect. 529 */ 530 if (m->m_pkthdr.len < ip_len) { 531 tooshort: 532 IPSTAT_INC(ips_tooshort); 533 goto bad; 534 } 535 if (m->m_pkthdr.len > ip_len) { 536 if (m->m_len == m->m_pkthdr.len) { 537 m->m_len = ip_len; 538 m->m_pkthdr.len = ip_len; 539 } else 540 m_adj(m, ip_len - m->m_pkthdr.len); 541 } 542 543 /* Try to forward the packet, but if we fail continue */ 544 #ifdef IPSEC 545 /* For now we do not handle IPSEC in tryforward. */ 546 if (!key_havesp(IPSEC_DIR_INBOUND) && !key_havesp(IPSEC_DIR_OUTBOUND) && 547 (V_ipforwarding == 1)) 548 if (ip_tryforward(m) == NULL) 549 return; 550 /* 551 * Bypass packet filtering for packets previously handled by IPsec. 552 */ 553 if (ip_ipsec_filtertunnel(m)) 554 goto passin; 555 #else 556 if (V_ipforwarding == 1) 557 if (ip_tryforward(m) == NULL) 558 return; 559 #endif /* IPSEC */ 560 561 /* 562 * Run through list of hooks for input packets. 563 * 564 * NB: Beware of the destination address changing (e.g. 565 * by NAT rewriting). When this happens, tell 566 * ip_forward to do the right thing. 567 */ 568 569 /* Jump over all PFIL processing if hooks are not active. */ 570 if (!PFIL_HOOKED(&V_inet_pfil_hook)) 571 goto passin; 572 573 odst = ip->ip_dst; 574 if (pfil_run_hooks(&V_inet_pfil_hook, &m, ifp, PFIL_IN, NULL) != 0) 575 return; 576 if (m == NULL) /* consumed by filter */ 577 return; 578 579 ip = mtod(m, struct ip *); 580 dchg = (odst.s_addr != ip->ip_dst.s_addr); 581 ifp = m->m_pkthdr.rcvif; 582 583 if (m->m_flags & M_FASTFWD_OURS) { 584 m->m_flags &= ~M_FASTFWD_OURS; 585 goto ours; 586 } 587 if (m->m_flags & M_IP_NEXTHOP) { 588 if (m_tag_find(m, PACKET_TAG_IPFORWARD, NULL) != NULL) { 589 /* 590 * Directly ship the packet on. This allows 591 * forwarding packets originally destined to us 592 * to some other directly connected host. 593 */ 594 ip_forward(m, 1); 595 return; 596 } 597 } 598 passin: 599 600 /* 601 * Process options and, if not destined for us, 602 * ship it on. ip_dooptions returns 1 when an 603 * error was detected (causing an icmp message 604 * to be sent and the original packet to be freed). 605 */ 606 if (hlen > sizeof (struct ip) && ip_dooptions(m, 0)) 607 return; 608 609 /* greedy RSVP, snatches any PATH packet of the RSVP protocol and no 610 * matter if it is destined to another node, or whether it is 611 * a multicast one, RSVP wants it! and prevents it from being forwarded 612 * anywhere else. Also checks if the rsvp daemon is running before 613 * grabbing the packet. 614 */ 615 if (V_rsvp_on && ip->ip_p==IPPROTO_RSVP) 616 goto ours; 617 618 /* 619 * Check our list of addresses, to see if the packet is for us. 620 * If we don't have any addresses, assume any unicast packet 621 * we receive might be for us (and let the upper layers deal 622 * with it). 623 */ 624 if (TAILQ_EMPTY(&V_in_ifaddrhead) && 625 (m->m_flags & (M_MCAST|M_BCAST)) == 0) 626 goto ours; 627 628 /* 629 * Enable a consistency check between the destination address 630 * and the arrival interface for a unicast packet (the RFC 1122 631 * strong ES model) if IP forwarding is disabled and the packet 632 * is not locally generated and the packet is not subject to 633 * 'ipfw fwd'. 634 * 635 * XXX - Checking also should be disabled if the destination 636 * address is ipnat'ed to a different interface. 637 * 638 * XXX - Checking is incompatible with IP aliases added 639 * to the loopback interface instead of the interface where 640 * the packets are received. 641 * 642 * XXX - This is the case for carp vhost IPs as well so we 643 * insert a workaround. If the packet got here, we already 644 * checked with carp_iamatch() and carp_forus(). 645 */ 646 checkif = V_ip_checkinterface && (V_ipforwarding == 0) && 647 ifp != NULL && ((ifp->if_flags & IFF_LOOPBACK) == 0) && 648 ifp->if_carp == NULL && (dchg == 0); 649 650 /* 651 * Check for exact addresses in the hash bucket. 652 */ 653 /* IN_IFADDR_RLOCK(); */ 654 LIST_FOREACH(ia, INADDR_HASH(ip->ip_dst.s_addr), ia_hash) { 655 /* 656 * If the address matches, verify that the packet 657 * arrived via the correct interface if checking is 658 * enabled. 659 */ 660 if (IA_SIN(ia)->sin_addr.s_addr == ip->ip_dst.s_addr && 661 (!checkif || ia->ia_ifp == ifp)) { 662 counter_u64_add(ia->ia_ifa.ifa_ipackets, 1); 663 counter_u64_add(ia->ia_ifa.ifa_ibytes, 664 m->m_pkthdr.len); 665 /* IN_IFADDR_RUNLOCK(); */ 666 goto ours; 667 } 668 } 669 /* IN_IFADDR_RUNLOCK(); */ 670 671 /* 672 * Check for broadcast addresses. 673 * 674 * Only accept broadcast packets that arrive via the matching 675 * interface. Reception of forwarded directed broadcasts would 676 * be handled via ip_forward() and ether_output() with the loopback 677 * into the stack for SIMPLEX interfaces handled by ether_output(). 678 */ 679 if (ifp != NULL && ifp->if_flags & IFF_BROADCAST) { 680 IF_ADDR_RLOCK(ifp); 681 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 682 if (ifa->ifa_addr->sa_family != AF_INET) 683 continue; 684 ia = ifatoia(ifa); 685 if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr == 686 ip->ip_dst.s_addr) { 687 counter_u64_add(ia->ia_ifa.ifa_ipackets, 1); 688 counter_u64_add(ia->ia_ifa.ifa_ibytes, 689 m->m_pkthdr.len); 690 IF_ADDR_RUNLOCK(ifp); 691 goto ours; 692 } 693 #ifdef BOOTP_COMPAT 694 if (IA_SIN(ia)->sin_addr.s_addr == INADDR_ANY) { 695 counter_u64_add(ia->ia_ifa.ifa_ipackets, 1); 696 counter_u64_add(ia->ia_ifa.ifa_ibytes, 697 m->m_pkthdr.len); 698 IF_ADDR_RUNLOCK(ifp); 699 goto ours; 700 } 701 #endif 702 } 703 IF_ADDR_RUNLOCK(ifp); 704 ia = NULL; 705 } 706 /* RFC 3927 2.7: Do not forward datagrams for 169.254.0.0/16. */ 707 if (IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr))) { 708 IPSTAT_INC(ips_cantforward); 709 m_freem(m); 710 return; 711 } 712 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) { 713 if (V_ip_mrouter) { 714 /* 715 * If we are acting as a multicast router, all 716 * incoming multicast packets are passed to the 717 * kernel-level multicast forwarding function. 718 * The packet is returned (relatively) intact; if 719 * ip_mforward() returns a non-zero value, the packet 720 * must be discarded, else it may be accepted below. 721 */ 722 if (ip_mforward && ip_mforward(ip, ifp, m, 0) != 0) { 723 IPSTAT_INC(ips_cantforward); 724 m_freem(m); 725 return; 726 } 727 728 /* 729 * The process-level routing daemon needs to receive 730 * all multicast IGMP packets, whether or not this 731 * host belongs to their destination groups. 732 */ 733 if (ip->ip_p == IPPROTO_IGMP) 734 goto ours; 735 IPSTAT_INC(ips_forward); 736 } 737 /* 738 * Assume the packet is for us, to avoid prematurely taking 739 * a lock on the in_multi hash. Protocols must perform 740 * their own filtering and update statistics accordingly. 741 */ 742 goto ours; 743 } 744 if (ip->ip_dst.s_addr == (u_long)INADDR_BROADCAST) 745 goto ours; 746 if (ip->ip_dst.s_addr == INADDR_ANY) 747 goto ours; 748 749 /* 750 * Not for us; forward if possible and desirable. 751 */ 752 if (V_ipforwarding == 0) { 753 IPSTAT_INC(ips_cantforward); 754 m_freem(m); 755 } else { 756 ip_forward(m, dchg); 757 } 758 return; 759 760 ours: 761 #ifdef IPSTEALTH 762 /* 763 * IPSTEALTH: Process non-routing options only 764 * if the packet is destined for us. 765 */ 766 if (V_ipstealth && hlen > sizeof (struct ip) && ip_dooptions(m, 1)) 767 return; 768 #endif /* IPSTEALTH */ 769 770 /* 771 * Attempt reassembly; if it succeeds, proceed. 772 * ip_reass() will return a different mbuf. 773 */ 774 if (ip->ip_off & htons(IP_MF | IP_OFFMASK)) { 775 /* XXXGL: shouldn't we save & set m_flags? */ 776 m = ip_reass(m); 777 if (m == NULL) 778 return; 779 ip = mtod(m, struct ip *); 780 /* Get the header length of the reassembled packet */ 781 hlen = ip->ip_hl << 2; 782 } 783 784 #ifdef IPSEC 785 /* 786 * enforce IPsec policy checking if we are seeing last header. 787 * note that we do not visit this with protocols with pcb layer 788 * code - like udp/tcp/raw ip. 789 */ 790 if (ip_ipsec_input(m, ip->ip_p) != 0) 791 goto bad; 792 #endif /* IPSEC */ 793 794 /* 795 * Switch out to protocol's input routine. 796 */ 797 IPSTAT_INC(ips_delivered); 798 799 (*inetsw[ip_protox[ip->ip_p]].pr_input)(&m, &hlen, ip->ip_p); 800 return; 801 bad: 802 m_freem(m); 803 } 804 805 /* 806 * IP timer processing; 807 * if a timer expires on a reassembly 808 * queue, discard it. 809 */ 810 void 811 ip_slowtimo(void) 812 { 813 VNET_ITERATOR_DECL(vnet_iter); 814 815 VNET_LIST_RLOCK_NOSLEEP(); 816 VNET_FOREACH(vnet_iter) { 817 CURVNET_SET(vnet_iter); 818 ipreass_slowtimo(); 819 CURVNET_RESTORE(); 820 } 821 VNET_LIST_RUNLOCK_NOSLEEP(); 822 } 823 824 void 825 ip_drain(void) 826 { 827 VNET_ITERATOR_DECL(vnet_iter); 828 829 VNET_LIST_RLOCK_NOSLEEP(); 830 VNET_FOREACH(vnet_iter) { 831 CURVNET_SET(vnet_iter); 832 ipreass_drain(); 833 CURVNET_RESTORE(); 834 } 835 VNET_LIST_RUNLOCK_NOSLEEP(); 836 } 837 838 /* 839 * The protocol to be inserted into ip_protox[] must be already registered 840 * in inetsw[], either statically or through pf_proto_register(). 841 */ 842 int 843 ipproto_register(short ipproto) 844 { 845 struct protosw *pr; 846 847 /* Sanity checks. */ 848 if (ipproto <= 0 || ipproto >= IPPROTO_MAX) 849 return (EPROTONOSUPPORT); 850 851 /* 852 * The protocol slot must not be occupied by another protocol 853 * already. An index pointing to IPPROTO_RAW is unused. 854 */ 855 pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 856 if (pr == NULL) 857 return (EPFNOSUPPORT); 858 if (ip_protox[ipproto] != pr - inetsw) /* IPPROTO_RAW */ 859 return (EEXIST); 860 861 /* Find the protocol position in inetsw[] and set the index. */ 862 for (pr = inetdomain.dom_protosw; 863 pr < inetdomain.dom_protoswNPROTOSW; pr++) { 864 if (pr->pr_domain->dom_family == PF_INET && 865 pr->pr_protocol && pr->pr_protocol == ipproto) { 866 ip_protox[pr->pr_protocol] = pr - inetsw; 867 return (0); 868 } 869 } 870 return (EPROTONOSUPPORT); 871 } 872 873 int 874 ipproto_unregister(short ipproto) 875 { 876 struct protosw *pr; 877 878 /* Sanity checks. */ 879 if (ipproto <= 0 || ipproto >= IPPROTO_MAX) 880 return (EPROTONOSUPPORT); 881 882 /* Check if the protocol was indeed registered. */ 883 pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 884 if (pr == NULL) 885 return (EPFNOSUPPORT); 886 if (ip_protox[ipproto] == pr - inetsw) /* IPPROTO_RAW */ 887 return (ENOENT); 888 889 /* Reset the protocol slot to IPPROTO_RAW. */ 890 ip_protox[ipproto] = pr - inetsw; 891 return (0); 892 } 893 894 u_char inetctlerrmap[PRC_NCMDS] = { 895 0, 0, 0, 0, 896 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, 897 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, 898 EMSGSIZE, EHOSTUNREACH, 0, 0, 899 0, 0, EHOSTUNREACH, 0, 900 ENOPROTOOPT, ECONNREFUSED 901 }; 902 903 /* 904 * Forward a packet. If some error occurs return the sender 905 * an icmp packet. Note we can't always generate a meaningful 906 * icmp message because icmp doesn't have a large enough repertoire 907 * of codes and types. 908 * 909 * If not forwarding, just drop the packet. This could be confusing 910 * if ipforwarding was zero but some routing protocol was advancing 911 * us as a gateway to somewhere. However, we must let the routing 912 * protocol deal with that. 913 * 914 * The srcrt parameter indicates whether the packet is being forwarded 915 * via a source route. 916 */ 917 void 918 ip_forward(struct mbuf *m, int srcrt) 919 { 920 struct ip *ip = mtod(m, struct ip *); 921 struct in_ifaddr *ia; 922 struct mbuf *mcopy; 923 struct sockaddr_in *sin; 924 struct in_addr dest; 925 struct route ro; 926 int error, type = 0, code = 0, mtu = 0; 927 928 if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(ip->ip_dst) == 0) { 929 IPSTAT_INC(ips_cantforward); 930 m_freem(m); 931 return; 932 } 933 #ifdef IPSEC 934 if (ip_ipsec_fwd(m) != 0) { 935 IPSTAT_INC(ips_cantforward); 936 m_freem(m); 937 return; 938 } 939 #endif /* IPSEC */ 940 #ifdef IPSTEALTH 941 if (!V_ipstealth) { 942 #endif 943 if (ip->ip_ttl <= IPTTLDEC) { 944 icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 945 0, 0); 946 return; 947 } 948 #ifdef IPSTEALTH 949 } 950 #endif 951 952 bzero(&ro, sizeof(ro)); 953 sin = (struct sockaddr_in *)&ro.ro_dst; 954 sin->sin_family = AF_INET; 955 sin->sin_len = sizeof(*sin); 956 sin->sin_addr = ip->ip_dst; 957 #ifdef RADIX_MPATH 958 rtalloc_mpath_fib(&ro, 959 ntohl(ip->ip_src.s_addr ^ ip->ip_dst.s_addr), 960 M_GETFIB(m)); 961 #else 962 in_rtalloc_ign(&ro, 0, M_GETFIB(m)); 963 #endif 964 if (ro.ro_rt != NULL) { 965 ia = ifatoia(ro.ro_rt->rt_ifa); 966 ifa_ref(&ia->ia_ifa); 967 } else 968 ia = NULL; 969 #ifndef IPSEC 970 /* 971 * 'ia' may be NULL if there is no route for this destination. 972 * In case of IPsec, Don't discard it just yet, but pass it to 973 * ip_output in case of outgoing IPsec policy. 974 */ 975 if (!srcrt && ia == NULL) { 976 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0); 977 RO_RTFREE(&ro); 978 return; 979 } 980 #endif 981 982 /* 983 * Save the IP header and at most 8 bytes of the payload, 984 * in case we need to generate an ICMP message to the src. 985 * 986 * XXX this can be optimized a lot by saving the data in a local 987 * buffer on the stack (72 bytes at most), and only allocating the 988 * mbuf if really necessary. The vast majority of the packets 989 * are forwarded without having to send an ICMP back (either 990 * because unnecessary, or because rate limited), so we are 991 * really we are wasting a lot of work here. 992 * 993 * We don't use m_copy() because it might return a reference 994 * to a shared cluster. Both this function and ip_output() 995 * assume exclusive access to the IP header in `m', so any 996 * data in a cluster may change before we reach icmp_error(). 997 */ 998 mcopy = m_gethdr(M_NOWAIT, m->m_type); 999 if (mcopy != NULL && !m_dup_pkthdr(mcopy, m, M_NOWAIT)) { 1000 /* 1001 * It's probably ok if the pkthdr dup fails (because 1002 * the deep copy of the tag chain failed), but for now 1003 * be conservative and just discard the copy since 1004 * code below may some day want the tags. 1005 */ 1006 m_free(mcopy); 1007 mcopy = NULL; 1008 } 1009 if (mcopy != NULL) { 1010 mcopy->m_len = min(ntohs(ip->ip_len), M_TRAILINGSPACE(mcopy)); 1011 mcopy->m_pkthdr.len = mcopy->m_len; 1012 m_copydata(m, 0, mcopy->m_len, mtod(mcopy, caddr_t)); 1013 } 1014 1015 #ifdef IPSTEALTH 1016 if (!V_ipstealth) { 1017 #endif 1018 ip->ip_ttl -= IPTTLDEC; 1019 #ifdef IPSTEALTH 1020 } 1021 #endif 1022 1023 /* 1024 * If forwarding packet using same interface that it came in on, 1025 * perhaps should send a redirect to sender to shortcut a hop. 1026 * Only send redirect if source is sending directly to us, 1027 * and if packet was not source routed (or has any options). 1028 * Also, don't send redirect if forwarding using a default route 1029 * or a route modified by a redirect. 1030 */ 1031 dest.s_addr = 0; 1032 if (!srcrt && V_ipsendredirects && 1033 ia != NULL && ia->ia_ifp == m->m_pkthdr.rcvif) { 1034 struct rtentry *rt; 1035 1036 rt = ro.ro_rt; 1037 1038 if (rt && (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0 && 1039 satosin(rt_key(rt))->sin_addr.s_addr != 0) { 1040 #define RTA(rt) ((struct in_ifaddr *)(rt->rt_ifa)) 1041 u_long src = ntohl(ip->ip_src.s_addr); 1042 1043 if (RTA(rt) && 1044 (src & RTA(rt)->ia_subnetmask) == RTA(rt)->ia_subnet) { 1045 if (rt->rt_flags & RTF_GATEWAY) 1046 dest.s_addr = satosin(rt->rt_gateway)->sin_addr.s_addr; 1047 else 1048 dest.s_addr = ip->ip_dst.s_addr; 1049 /* Router requirements says to only send host redirects */ 1050 type = ICMP_REDIRECT; 1051 code = ICMP_REDIRECT_HOST; 1052 } 1053 } 1054 } 1055 1056 error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL, NULL); 1057 1058 if (error == EMSGSIZE && ro.ro_rt) 1059 mtu = ro.ro_rt->rt_mtu; 1060 RO_RTFREE(&ro); 1061 1062 if (error) 1063 IPSTAT_INC(ips_cantforward); 1064 else { 1065 IPSTAT_INC(ips_forward); 1066 if (type) 1067 IPSTAT_INC(ips_redirectsent); 1068 else { 1069 if (mcopy) 1070 m_freem(mcopy); 1071 if (ia != NULL) 1072 ifa_free(&ia->ia_ifa); 1073 return; 1074 } 1075 } 1076 if (mcopy == NULL) { 1077 if (ia != NULL) 1078 ifa_free(&ia->ia_ifa); 1079 return; 1080 } 1081 1082 switch (error) { 1083 1084 case 0: /* forwarded, but need redirect */ 1085 /* type, code set above */ 1086 break; 1087 1088 case ENETUNREACH: 1089 case EHOSTUNREACH: 1090 case ENETDOWN: 1091 case EHOSTDOWN: 1092 default: 1093 type = ICMP_UNREACH; 1094 code = ICMP_UNREACH_HOST; 1095 break; 1096 1097 case EMSGSIZE: 1098 type = ICMP_UNREACH; 1099 code = ICMP_UNREACH_NEEDFRAG; 1100 1101 #ifdef IPSEC 1102 /* 1103 * If IPsec is configured for this path, 1104 * override any possibly mtu value set by ip_output. 1105 */ 1106 mtu = ip_ipsec_mtu(mcopy, mtu); 1107 #endif /* IPSEC */ 1108 /* 1109 * If the MTU was set before make sure we are below the 1110 * interface MTU. 1111 * If the MTU wasn't set before use the interface mtu or 1112 * fall back to the next smaller mtu step compared to the 1113 * current packet size. 1114 */ 1115 if (mtu != 0) { 1116 if (ia != NULL) 1117 mtu = min(mtu, ia->ia_ifp->if_mtu); 1118 } else { 1119 if (ia != NULL) 1120 mtu = ia->ia_ifp->if_mtu; 1121 else 1122 mtu = ip_next_mtu(ntohs(ip->ip_len), 0); 1123 } 1124 IPSTAT_INC(ips_cantfrag); 1125 break; 1126 1127 case ENOBUFS: 1128 case EACCES: /* ipfw denied packet */ 1129 m_freem(mcopy); 1130 if (ia != NULL) 1131 ifa_free(&ia->ia_ifa); 1132 return; 1133 } 1134 if (ia != NULL) 1135 ifa_free(&ia->ia_ifa); 1136 icmp_error(mcopy, type, code, dest.s_addr, mtu); 1137 } 1138 1139 void 1140 ip_savecontrol(struct inpcb *inp, struct mbuf **mp, struct ip *ip, 1141 struct mbuf *m) 1142 { 1143 1144 if (inp->inp_socket->so_options & (SO_BINTIME | SO_TIMESTAMP)) { 1145 struct bintime bt; 1146 1147 bintime(&bt); 1148 if (inp->inp_socket->so_options & SO_BINTIME) { 1149 *mp = sbcreatecontrol((caddr_t)&bt, sizeof(bt), 1150 SCM_BINTIME, SOL_SOCKET); 1151 if (*mp) 1152 mp = &(*mp)->m_next; 1153 } 1154 if (inp->inp_socket->so_options & SO_TIMESTAMP) { 1155 struct timeval tv; 1156 1157 bintime2timeval(&bt, &tv); 1158 *mp = sbcreatecontrol((caddr_t)&tv, sizeof(tv), 1159 SCM_TIMESTAMP, SOL_SOCKET); 1160 if (*mp) 1161 mp = &(*mp)->m_next; 1162 } 1163 } 1164 if (inp->inp_flags & INP_RECVDSTADDR) { 1165 *mp = sbcreatecontrol((caddr_t)&ip->ip_dst, 1166 sizeof(struct in_addr), IP_RECVDSTADDR, IPPROTO_IP); 1167 if (*mp) 1168 mp = &(*mp)->m_next; 1169 } 1170 if (inp->inp_flags & INP_RECVTTL) { 1171 *mp = sbcreatecontrol((caddr_t)&ip->ip_ttl, 1172 sizeof(u_char), IP_RECVTTL, IPPROTO_IP); 1173 if (*mp) 1174 mp = &(*mp)->m_next; 1175 } 1176 #ifdef notyet 1177 /* XXX 1178 * Moving these out of udp_input() made them even more broken 1179 * than they already were. 1180 */ 1181 /* options were tossed already */ 1182 if (inp->inp_flags & INP_RECVOPTS) { 1183 *mp = sbcreatecontrol((caddr_t)opts_deleted_above, 1184 sizeof(struct in_addr), IP_RECVOPTS, IPPROTO_IP); 1185 if (*mp) 1186 mp = &(*mp)->m_next; 1187 } 1188 /* ip_srcroute doesn't do what we want here, need to fix */ 1189 if (inp->inp_flags & INP_RECVRETOPTS) { 1190 *mp = sbcreatecontrol((caddr_t)ip_srcroute(m), 1191 sizeof(struct in_addr), IP_RECVRETOPTS, IPPROTO_IP); 1192 if (*mp) 1193 mp = &(*mp)->m_next; 1194 } 1195 #endif 1196 if (inp->inp_flags & INP_RECVIF) { 1197 struct ifnet *ifp; 1198 struct sdlbuf { 1199 struct sockaddr_dl sdl; 1200 u_char pad[32]; 1201 } sdlbuf; 1202 struct sockaddr_dl *sdp; 1203 struct sockaddr_dl *sdl2 = &sdlbuf.sdl; 1204 1205 if ((ifp = m->m_pkthdr.rcvif) && 1206 ifp->if_index && ifp->if_index <= V_if_index) { 1207 sdp = (struct sockaddr_dl *)ifp->if_addr->ifa_addr; 1208 /* 1209 * Change our mind and don't try copy. 1210 */ 1211 if (sdp->sdl_family != AF_LINK || 1212 sdp->sdl_len > sizeof(sdlbuf)) { 1213 goto makedummy; 1214 } 1215 bcopy(sdp, sdl2, sdp->sdl_len); 1216 } else { 1217 makedummy: 1218 sdl2->sdl_len = 1219 offsetof(struct sockaddr_dl, sdl_data[0]); 1220 sdl2->sdl_family = AF_LINK; 1221 sdl2->sdl_index = 0; 1222 sdl2->sdl_nlen = sdl2->sdl_alen = sdl2->sdl_slen = 0; 1223 } 1224 *mp = sbcreatecontrol((caddr_t)sdl2, sdl2->sdl_len, 1225 IP_RECVIF, IPPROTO_IP); 1226 if (*mp) 1227 mp = &(*mp)->m_next; 1228 } 1229 if (inp->inp_flags & INP_RECVTOS) { 1230 *mp = sbcreatecontrol((caddr_t)&ip->ip_tos, 1231 sizeof(u_char), IP_RECVTOS, IPPROTO_IP); 1232 if (*mp) 1233 mp = &(*mp)->m_next; 1234 } 1235 1236 if (inp->inp_flags2 & INP_RECVFLOWID) { 1237 uint32_t flowid, flow_type; 1238 1239 flowid = m->m_pkthdr.flowid; 1240 flow_type = M_HASHTYPE_GET(m); 1241 1242 /* 1243 * XXX should handle the failure of one or the 1244 * other - don't populate both? 1245 */ 1246 *mp = sbcreatecontrol((caddr_t) &flowid, 1247 sizeof(uint32_t), IP_FLOWID, IPPROTO_IP); 1248 if (*mp) 1249 mp = &(*mp)->m_next; 1250 *mp = sbcreatecontrol((caddr_t) &flow_type, 1251 sizeof(uint32_t), IP_FLOWTYPE, IPPROTO_IP); 1252 if (*mp) 1253 mp = &(*mp)->m_next; 1254 } 1255 1256 #ifdef RSS 1257 if (inp->inp_flags2 & INP_RECVRSSBUCKETID) { 1258 uint32_t flowid, flow_type; 1259 uint32_t rss_bucketid; 1260 1261 flowid = m->m_pkthdr.flowid; 1262 flow_type = M_HASHTYPE_GET(m); 1263 1264 if (rss_hash2bucket(flowid, flow_type, &rss_bucketid) == 0) { 1265 *mp = sbcreatecontrol((caddr_t) &rss_bucketid, 1266 sizeof(uint32_t), IP_RSSBUCKETID, IPPROTO_IP); 1267 if (*mp) 1268 mp = &(*mp)->m_next; 1269 } 1270 } 1271 #endif 1272 } 1273 1274 /* 1275 * XXXRW: Multicast routing code in ip_mroute.c is generally MPSAFE, but the 1276 * ip_rsvp and ip_rsvp_on variables need to be interlocked with rsvp_on 1277 * locking. This code remains in ip_input.c as ip_mroute.c is optionally 1278 * compiled. 1279 */ 1280 static VNET_DEFINE(int, ip_rsvp_on); 1281 VNET_DEFINE(struct socket *, ip_rsvpd); 1282 1283 #define V_ip_rsvp_on VNET(ip_rsvp_on) 1284 1285 int 1286 ip_rsvp_init(struct socket *so) 1287 { 1288 1289 if (so->so_type != SOCK_RAW || 1290 so->so_proto->pr_protocol != IPPROTO_RSVP) 1291 return EOPNOTSUPP; 1292 1293 if (V_ip_rsvpd != NULL) 1294 return EADDRINUSE; 1295 1296 V_ip_rsvpd = so; 1297 /* 1298 * This may seem silly, but we need to be sure we don't over-increment 1299 * the RSVP counter, in case something slips up. 1300 */ 1301 if (!V_ip_rsvp_on) { 1302 V_ip_rsvp_on = 1; 1303 V_rsvp_on++; 1304 } 1305 1306 return 0; 1307 } 1308 1309 int 1310 ip_rsvp_done(void) 1311 { 1312 1313 V_ip_rsvpd = NULL; 1314 /* 1315 * This may seem silly, but we need to be sure we don't over-decrement 1316 * the RSVP counter, in case something slips up. 1317 */ 1318 if (V_ip_rsvp_on) { 1319 V_ip_rsvp_on = 0; 1320 V_rsvp_on--; 1321 } 1322 return 0; 1323 } 1324 1325 int 1326 rsvp_input(struct mbuf **mp, int *offp, int proto) 1327 { 1328 struct mbuf *m; 1329 1330 m = *mp; 1331 *mp = NULL; 1332 1333 if (rsvp_input_p) { /* call the real one if loaded */ 1334 *mp = m; 1335 rsvp_input_p(mp, offp, proto); 1336 return (IPPROTO_DONE); 1337 } 1338 1339 /* Can still get packets with rsvp_on = 0 if there is a local member 1340 * of the group to which the RSVP packet is addressed. But in this 1341 * case we want to throw the packet away. 1342 */ 1343 1344 if (!V_rsvp_on) { 1345 m_freem(m); 1346 return (IPPROTO_DONE); 1347 } 1348 1349 if (V_ip_rsvpd != NULL) { 1350 *mp = m; 1351 rip_input(mp, offp, proto); 1352 return (IPPROTO_DONE); 1353 } 1354 /* Drop the packet */ 1355 m_freem(m); 1356 return (IPPROTO_DONE); 1357 } 1358