xref: /freebsd/sys/netinet/ip_output.c (revision a9148abd9da5db2f1c682fb17bed791845fc41c9)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_ipfw.h"
36 #include "opt_ipsec.h"
37 #include "opt_mac.h"
38 #include "opt_mbuf_stress_test.h"
39 #include "opt_mpath.h"
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/kernel.h>
44 #include <sys/malloc.h>
45 #include <sys/mbuf.h>
46 #include <sys/priv.h>
47 #include <sys/proc.h>
48 #include <sys/protosw.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/sysctl.h>
52 #include <sys/ucred.h>
53 #include <sys/vimage.h>
54 
55 #include <net/if.h>
56 #include <net/netisr.h>
57 #include <net/pfil.h>
58 #include <net/route.h>
59 #ifdef RADIX_MPATH
60 #include <net/radix_mpath.h>
61 #endif
62 
63 #include <netinet/in.h>
64 #include <netinet/in_systm.h>
65 #include <netinet/ip.h>
66 #include <netinet/in_pcb.h>
67 #include <netinet/in_var.h>
68 #include <netinet/ip_var.h>
69 #include <netinet/ip_options.h>
70 
71 #ifdef IPSEC
72 #include <netinet/ip_ipsec.h>
73 #include <netipsec/ipsec.h>
74 #endif /* IPSEC*/
75 
76 #include <machine/in_cksum.h>
77 
78 #include <security/mac/mac_framework.h>
79 
80 #define print_ip(x, a, y)	 printf("%s %d.%d.%d.%d%s",\
81 				x, (ntohl(a.s_addr)>>24)&0xFF,\
82 				  (ntohl(a.s_addr)>>16)&0xFF,\
83 				  (ntohl(a.s_addr)>>8)&0xFF,\
84 				  (ntohl(a.s_addr))&0xFF, y);
85 
86 u_short ip_id;
87 
88 #ifdef MBUF_STRESS_TEST
89 int mbuf_frag_size = 0;
90 SYSCTL_INT(_net_inet_ip, OID_AUTO, mbuf_frag_size, CTLFLAG_RW,
91 	&mbuf_frag_size, 0, "Fragment outgoing mbufs to this size");
92 #endif
93 
94 static void	ip_mloopback
95 	(struct ifnet *, struct mbuf *, struct sockaddr_in *, int);
96 
97 
98 extern	struct protosw inetsw[];
99 
100 /*
101  * IP output.  The packet in mbuf chain m contains a skeletal IP
102  * header (with len, off, ttl, proto, tos, src, dst).
103  * The mbuf chain containing the packet will be freed.
104  * The mbuf opt, if present, will not be freed.
105  * In the IP forwarding case, the packet will arrive with options already
106  * inserted, so must have a NULL opt pointer.
107  */
108 int
109 ip_output(struct mbuf *m, struct mbuf *opt, struct route *ro, int flags,
110     struct ip_moptions *imo, struct inpcb *inp)
111 {
112 	INIT_VNET_NET(curvnet);
113 	INIT_VNET_INET(curvnet);
114 	struct ip *ip;
115 	struct ifnet *ifp = NULL;	/* keep compiler happy */
116 	struct mbuf *m0;
117 	int hlen = sizeof (struct ip);
118 	int mtu;
119 	int len, error = 0;
120 	struct sockaddr_in *dst = NULL;	/* keep compiler happy */
121 	struct in_ifaddr *ia = NULL;
122 	int isbroadcast, sw_csum;
123 	struct route iproute;
124 	struct in_addr odst;
125 #ifdef IPFIREWALL_FORWARD
126 	struct m_tag *fwd_tag = NULL;
127 #endif
128 	M_ASSERTPKTHDR(m);
129 
130 	if (ro == NULL) {
131 		ro = &iproute;
132 		bzero(ro, sizeof (*ro));
133 	}
134 
135 	if (inp != NULL)
136 		INP_LOCK_ASSERT(inp);
137 
138 	if (opt) {
139 		len = 0;
140 		m = ip_insertoptions(m, opt, &len);
141 		if (len != 0)
142 			hlen = len;
143 	}
144 	ip = mtod(m, struct ip *);
145 
146 	/*
147 	 * Fill in IP header.  If we are not allowing fragmentation,
148 	 * then the ip_id field is meaningless, but we don't set it
149 	 * to zero.  Doing so causes various problems when devices along
150 	 * the path (routers, load balancers, firewalls, etc.) illegally
151 	 * disable DF on our packet.  Note that a 16-bit counter
152 	 * will wrap around in less than 10 seconds at 100 Mbit/s on a
153 	 * medium with MTU 1500.  See Steven M. Bellovin, "A Technique
154 	 * for Counting NATted Hosts", Proc. IMW'02, available at
155 	 * <http://www.cs.columbia.edu/~smb/papers/fnat.pdf>.
156 	 */
157 	if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) {
158 		ip->ip_v = IPVERSION;
159 		ip->ip_hl = hlen >> 2;
160 		ip->ip_id = ip_newid();
161 		V_ipstat.ips_localout++;
162 	} else {
163 		hlen = ip->ip_hl << 2;
164 	}
165 
166 	dst = (struct sockaddr_in *)&ro->ro_dst;
167 again:
168 	/*
169 	 * If there is a cached route,
170 	 * check that it is to the same destination
171 	 * and is still up.  If not, free it and try again.
172 	 * The address family should also be checked in case of sharing the
173 	 * cache with IPv6.
174 	 */
175 	if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
176 			  dst->sin_family != AF_INET ||
177 			  dst->sin_addr.s_addr != ip->ip_dst.s_addr)) {
178 		RTFREE(ro->ro_rt);
179 		ro->ro_rt = (struct rtentry *)NULL;
180 	}
181 #ifdef IPFIREWALL_FORWARD
182 	if (ro->ro_rt == NULL && fwd_tag == NULL) {
183 #else
184 	if (ro->ro_rt == NULL) {
185 #endif
186 		bzero(dst, sizeof(*dst));
187 		dst->sin_family = AF_INET;
188 		dst->sin_len = sizeof(*dst);
189 		dst->sin_addr = ip->ip_dst;
190 	}
191 	/*
192 	 * If routing to interface only, short circuit routing lookup.
193 	 * The use of an all-ones broadcast address implies this; an
194 	 * interface is specified by the broadcast address of an interface,
195 	 * or the destination address of a ptp interface.
196 	 */
197 	if (flags & IP_SENDONES) {
198 		if ((ia = ifatoia(ifa_ifwithbroadaddr(sintosa(dst)))) == NULL &&
199 		    (ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == NULL) {
200 			V_ipstat.ips_noroute++;
201 			error = ENETUNREACH;
202 			goto bad;
203 		}
204 		ip->ip_dst.s_addr = INADDR_BROADCAST;
205 		dst->sin_addr = ip->ip_dst;
206 		ifp = ia->ia_ifp;
207 		ip->ip_ttl = 1;
208 		isbroadcast = 1;
209 	} else if (flags & IP_ROUTETOIF) {
210 		if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == NULL &&
211 		    (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == NULL) {
212 			V_ipstat.ips_noroute++;
213 			error = ENETUNREACH;
214 			goto bad;
215 		}
216 		ifp = ia->ia_ifp;
217 		ip->ip_ttl = 1;
218 		isbroadcast = in_broadcast(dst->sin_addr, ifp);
219 	} else if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) &&
220 	    imo != NULL && imo->imo_multicast_ifp != NULL) {
221 		/*
222 		 * Bypass the normal routing lookup for multicast
223 		 * packets if the interface is specified.
224 		 */
225 		ifp = imo->imo_multicast_ifp;
226 		IFP_TO_IA(ifp, ia);
227 		isbroadcast = 0;	/* fool gcc */
228 	} else {
229 		/*
230 		 * We want to do any cloning requested by the link layer,
231 		 * as this is probably required in all cases for correct
232 		 * operation (as it is for ARP).
233 		 */
234 		if (ro->ro_rt == NULL)
235 #ifdef RADIX_MPATH
236 			rtalloc_mpath_fib(ro,
237 			    ntohl(ip->ip_src.s_addr ^ ip->ip_dst.s_addr),
238 			    inp ? inp->inp_inc.inc_fibnum : M_GETFIB(m));
239 #else
240 			in_rtalloc_ign(ro, 0,
241 			    inp ? inp->inp_inc.inc_fibnum : M_GETFIB(m));
242 #endif
243 		if (ro->ro_rt == NULL) {
244 			V_ipstat.ips_noroute++;
245 			error = EHOSTUNREACH;
246 			goto bad;
247 		}
248 		ia = ifatoia(ro->ro_rt->rt_ifa);
249 		ifp = ro->ro_rt->rt_ifp;
250 		ro->ro_rt->rt_rmx.rmx_pksent++;
251 		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
252 			dst = (struct sockaddr_in *)ro->ro_rt->rt_gateway;
253 		if (ro->ro_rt->rt_flags & RTF_HOST)
254 			isbroadcast = (ro->ro_rt->rt_flags & RTF_BROADCAST);
255 		else
256 			isbroadcast = in_broadcast(dst->sin_addr, ifp);
257 	}
258 	/*
259 	 * Calculate MTU.  If we have a route that is up, use that,
260 	 * otherwise use the interface's MTU.
261 	 */
262 	if (ro->ro_rt != NULL && (ro->ro_rt->rt_flags & (RTF_UP|RTF_HOST))) {
263 		/*
264 		 * This case can happen if the user changed the MTU
265 		 * of an interface after enabling IP on it.  Because
266 		 * most netifs don't keep track of routes pointing to
267 		 * them, there is no way for one to update all its
268 		 * routes when the MTU is changed.
269 		 */
270 		if (ro->ro_rt->rt_rmx.rmx_mtu > ifp->if_mtu)
271 			ro->ro_rt->rt_rmx.rmx_mtu = ifp->if_mtu;
272 		mtu = ro->ro_rt->rt_rmx.rmx_mtu;
273 	} else {
274 		mtu = ifp->if_mtu;
275 	}
276 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
277 		struct in_multi *inm;
278 
279 		m->m_flags |= M_MCAST;
280 		/*
281 		 * IP destination address is multicast.  Make sure "dst"
282 		 * still points to the address in "ro".  (It may have been
283 		 * changed to point to a gateway address, above.)
284 		 */
285 		dst = (struct sockaddr_in *)&ro->ro_dst;
286 		/*
287 		 * See if the caller provided any multicast options
288 		 */
289 		if (imo != NULL) {
290 			ip->ip_ttl = imo->imo_multicast_ttl;
291 			if (imo->imo_multicast_vif != -1)
292 				ip->ip_src.s_addr =
293 				    ip_mcast_src ?
294 				    ip_mcast_src(imo->imo_multicast_vif) :
295 				    INADDR_ANY;
296 		} else
297 			ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL;
298 		/*
299 		 * Confirm that the outgoing interface supports multicast.
300 		 */
301 		if ((imo == NULL) || (imo->imo_multicast_vif == -1)) {
302 			if ((ifp->if_flags & IFF_MULTICAST) == 0) {
303 				V_ipstat.ips_noroute++;
304 				error = ENETUNREACH;
305 				goto bad;
306 			}
307 		}
308 		/*
309 		 * If source address not specified yet, use address
310 		 * of outgoing interface.
311 		 */
312 		if (ip->ip_src.s_addr == INADDR_ANY) {
313 			/* Interface may have no addresses. */
314 			if (ia != NULL)
315 				ip->ip_src = IA_SIN(ia)->sin_addr;
316 		}
317 
318 		IN_MULTI_LOCK();
319 		IN_LOOKUP_MULTI(ip->ip_dst, ifp, inm);
320 		if (inm != NULL &&
321 		   (imo == NULL || imo->imo_multicast_loop)) {
322 			IN_MULTI_UNLOCK();
323 			/*
324 			 * If we belong to the destination multicast group
325 			 * on the outgoing interface, and the caller did not
326 			 * forbid loopback, loop back a copy.
327 			 */
328 			ip_mloopback(ifp, m, dst, hlen);
329 		}
330 		else {
331 			IN_MULTI_UNLOCK();
332 			/*
333 			 * If we are acting as a multicast router, perform
334 			 * multicast forwarding as if the packet had just
335 			 * arrived on the interface to which we are about
336 			 * to send.  The multicast forwarding function
337 			 * recursively calls this function, using the
338 			 * IP_FORWARDING flag to prevent infinite recursion.
339 			 *
340 			 * Multicasts that are looped back by ip_mloopback(),
341 			 * above, will be forwarded by the ip_input() routine,
342 			 * if necessary.
343 			 */
344 			if (V_ip_mrouter && (flags & IP_FORWARDING) == 0) {
345 				/*
346 				 * If rsvp daemon is not running, do not
347 				 * set ip_moptions. This ensures that the packet
348 				 * is multicast and not just sent down one link
349 				 * as prescribed by rsvpd.
350 				 */
351 				if (!V_rsvp_on)
352 					imo = NULL;
353 				if (ip_mforward &&
354 				    ip_mforward(ip, ifp, m, imo) != 0) {
355 					m_freem(m);
356 					goto done;
357 				}
358 			}
359 		}
360 
361 		/*
362 		 * Multicasts with a time-to-live of zero may be looped-
363 		 * back, above, but must not be transmitted on a network.
364 		 * Also, multicasts addressed to the loopback interface
365 		 * are not sent -- the above call to ip_mloopback() will
366 		 * loop back a copy if this host actually belongs to the
367 		 * destination group on the loopback interface.
368 		 */
369 		if (ip->ip_ttl == 0 || ifp->if_flags & IFF_LOOPBACK) {
370 			m_freem(m);
371 			goto done;
372 		}
373 
374 		goto sendit;
375 	}
376 
377 	/*
378 	 * If the source address is not specified yet, use the address
379 	 * of the outoing interface.
380 	 */
381 	if (ip->ip_src.s_addr == INADDR_ANY) {
382 		/* Interface may have no addresses. */
383 		if (ia != NULL) {
384 			ip->ip_src = IA_SIN(ia)->sin_addr;
385 		}
386 	}
387 
388 	/*
389 	 * Verify that we have any chance at all of being able to queue the
390 	 * packet or packet fragments, unless ALTQ is enabled on the given
391 	 * interface in which case packetdrop should be done by queueing.
392 	 */
393 #ifdef ALTQ
394 	if ((!ALTQ_IS_ENABLED(&ifp->if_snd)) &&
395 	    ((ifp->if_snd.ifq_len + ip->ip_len / mtu + 1) >=
396 	    ifp->if_snd.ifq_maxlen))
397 #else
398 	if ((ifp->if_snd.ifq_len + ip->ip_len / mtu + 1) >=
399 	    ifp->if_snd.ifq_maxlen)
400 #endif /* ALTQ */
401 	{
402 		error = ENOBUFS;
403 		V_ipstat.ips_odropped++;
404 		ifp->if_snd.ifq_drops += (ip->ip_len / ifp->if_mtu + 1);
405 		goto bad;
406 	}
407 
408 	/*
409 	 * Look for broadcast address and
410 	 * verify user is allowed to send
411 	 * such a packet.
412 	 */
413 	if (isbroadcast) {
414 		if ((ifp->if_flags & IFF_BROADCAST) == 0) {
415 			error = EADDRNOTAVAIL;
416 			goto bad;
417 		}
418 		if ((flags & IP_ALLOWBROADCAST) == 0) {
419 			error = EACCES;
420 			goto bad;
421 		}
422 		/* don't allow broadcast messages to be fragmented */
423 		if (ip->ip_len > mtu) {
424 			error = EMSGSIZE;
425 			goto bad;
426 		}
427 		m->m_flags |= M_BCAST;
428 	} else {
429 		m->m_flags &= ~M_BCAST;
430 	}
431 
432 sendit:
433 #ifdef IPSEC
434 	switch(ip_ipsec_output(&m, inp, &flags, &error, &ro, &iproute, &dst, &ia, &ifp)) {
435 	case 1:
436 		goto bad;
437 	case -1:
438 		goto done;
439 	case 0:
440 	default:
441 		break;	/* Continue with packet processing. */
442 	}
443 	/* Update variables that are affected by ipsec4_output(). */
444 	ip = mtod(m, struct ip *);
445 	hlen = ip->ip_hl << 2;
446 #endif /* IPSEC */
447 
448 	/* Jump over all PFIL processing if hooks are not active. */
449 	if (!PFIL_HOOKED(&inet_pfil_hook))
450 		goto passout;
451 
452 	/* Run through list of hooks for output packets. */
453 	odst.s_addr = ip->ip_dst.s_addr;
454 	error = pfil_run_hooks(&inet_pfil_hook, &m, ifp, PFIL_OUT, inp);
455 	if (error != 0 || m == NULL)
456 		goto done;
457 
458 	ip = mtod(m, struct ip *);
459 
460 	/* See if destination IP address was changed by packet filter. */
461 	if (odst.s_addr != ip->ip_dst.s_addr) {
462 		m->m_flags |= M_SKIP_FIREWALL;
463 		/* If destination is now ourself drop to ip_input(). */
464 		if (in_localip(ip->ip_dst)) {
465 			m->m_flags |= M_FASTFWD_OURS;
466 			if (m->m_pkthdr.rcvif == NULL)
467 				m->m_pkthdr.rcvif = V_loif;
468 			if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
469 				m->m_pkthdr.csum_flags |=
470 				    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
471 				m->m_pkthdr.csum_data = 0xffff;
472 			}
473 			m->m_pkthdr.csum_flags |=
474 			    CSUM_IP_CHECKED | CSUM_IP_VALID;
475 
476 			error = netisr_queue(NETISR_IP, m);
477 			goto done;
478 		} else
479 			goto again;	/* Redo the routing table lookup. */
480 	}
481 
482 #ifdef IPFIREWALL_FORWARD
483 	/* See if local, if yes, send it to netisr with IP_FASTFWD_OURS. */
484 	if (m->m_flags & M_FASTFWD_OURS) {
485 		if (m->m_pkthdr.rcvif == NULL)
486 			m->m_pkthdr.rcvif = V_loif;
487 		if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
488 			m->m_pkthdr.csum_flags |=
489 			    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
490 			m->m_pkthdr.csum_data = 0xffff;
491 		}
492 		m->m_pkthdr.csum_flags |=
493 			    CSUM_IP_CHECKED | CSUM_IP_VALID;
494 
495 		error = netisr_queue(NETISR_IP, m);
496 		goto done;
497 	}
498 	/* Or forward to some other address? */
499 	fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
500 	if (fwd_tag) {
501 		dst = (struct sockaddr_in *)&ro->ro_dst;
502 		bcopy((fwd_tag+1), dst, sizeof(struct sockaddr_in));
503 		m->m_flags |= M_SKIP_FIREWALL;
504 		m_tag_delete(m, fwd_tag);
505 		goto again;
506 	}
507 #endif /* IPFIREWALL_FORWARD */
508 
509 passout:
510 	/* 127/8 must not appear on wire - RFC1122. */
511 	if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
512 	    (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
513 		if ((ifp->if_flags & IFF_LOOPBACK) == 0) {
514 			V_ipstat.ips_badaddr++;
515 			error = EADDRNOTAVAIL;
516 			goto bad;
517 		}
518 	}
519 
520 	m->m_pkthdr.csum_flags |= CSUM_IP;
521 	sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_hwassist;
522 	if (sw_csum & CSUM_DELAY_DATA) {
523 		in_delayed_cksum(m);
524 		sw_csum &= ~CSUM_DELAY_DATA;
525 	}
526 	m->m_pkthdr.csum_flags &= ifp->if_hwassist;
527 
528 	/*
529 	 * If small enough for interface, or the interface will take
530 	 * care of the fragmentation for us, we can just send directly.
531 	 */
532 	if (ip->ip_len <= mtu ||
533 	    (m->m_pkthdr.csum_flags & ifp->if_hwassist & CSUM_TSO) != 0 ||
534 	    ((ip->ip_off & IP_DF) == 0 && (ifp->if_hwassist & CSUM_FRAGMENT))) {
535 		ip->ip_len = htons(ip->ip_len);
536 		ip->ip_off = htons(ip->ip_off);
537 		ip->ip_sum = 0;
538 		if (sw_csum & CSUM_DELAY_IP)
539 			ip->ip_sum = in_cksum(m, hlen);
540 
541 		/*
542 		 * Record statistics for this interface address.
543 		 * With CSUM_TSO the byte/packet count will be slightly
544 		 * incorrect because we count the IP+TCP headers only
545 		 * once instead of for every generated packet.
546 		 */
547 		if (!(flags & IP_FORWARDING) && ia) {
548 			if (m->m_pkthdr.csum_flags & CSUM_TSO)
549 				ia->ia_ifa.if_opackets +=
550 				    m->m_pkthdr.len / m->m_pkthdr.tso_segsz;
551 			else
552 				ia->ia_ifa.if_opackets++;
553 			ia->ia_ifa.if_obytes += m->m_pkthdr.len;
554 		}
555 #ifdef MBUF_STRESS_TEST
556 		if (mbuf_frag_size && m->m_pkthdr.len > mbuf_frag_size)
557 			m = m_fragment(m, M_DONTWAIT, mbuf_frag_size);
558 #endif
559 		/*
560 		 * Reset layer specific mbuf flags
561 		 * to avoid confusing lower layers.
562 		 */
563 		m->m_flags &= ~(M_PROTOFLAGS);
564 
565 		error = (*ifp->if_output)(ifp, m,
566 				(struct sockaddr *)dst, ro->ro_rt);
567 		goto done;
568 	}
569 
570 	/* Balk when DF bit is set or the interface didn't support TSO. */
571 	if ((ip->ip_off & IP_DF) || (m->m_pkthdr.csum_flags & CSUM_TSO)) {
572 		error = EMSGSIZE;
573 		V_ipstat.ips_cantfrag++;
574 		goto bad;
575 	}
576 
577 	/*
578 	 * Too large for interface; fragment if possible. If successful,
579 	 * on return, m will point to a list of packets to be sent.
580 	 */
581 	error = ip_fragment(ip, &m, mtu, ifp->if_hwassist, sw_csum);
582 	if (error)
583 		goto bad;
584 	for (; m; m = m0) {
585 		m0 = m->m_nextpkt;
586 		m->m_nextpkt = 0;
587 		if (error == 0) {
588 			/* Record statistics for this interface address. */
589 			if (ia != NULL) {
590 				ia->ia_ifa.if_opackets++;
591 				ia->ia_ifa.if_obytes += m->m_pkthdr.len;
592 			}
593 			/*
594 			 * Reset layer specific mbuf flags
595 			 * to avoid confusing upper layers.
596 			 */
597 			m->m_flags &= ~(M_PROTOFLAGS);
598 
599 			error = (*ifp->if_output)(ifp, m,
600 			    (struct sockaddr *)dst, ro->ro_rt);
601 		} else
602 			m_freem(m);
603 	}
604 
605 	if (error == 0)
606 		V_ipstat.ips_fragmented++;
607 
608 done:
609 	if (ro == &iproute && ro->ro_rt) {
610 		RTFREE(ro->ro_rt);
611 	}
612 	return (error);
613 bad:
614 	m_freem(m);
615 	goto done;
616 }
617 
618 /*
619  * Create a chain of fragments which fit the given mtu. m_frag points to the
620  * mbuf to be fragmented; on return it points to the chain with the fragments.
621  * Return 0 if no error. If error, m_frag may contain a partially built
622  * chain of fragments that should be freed by the caller.
623  *
624  * if_hwassist_flags is the hw offload capabilities (see if_data.ifi_hwassist)
625  * sw_csum contains the delayed checksums flags (e.g., CSUM_DELAY_IP).
626  */
627 int
628 ip_fragment(struct ip *ip, struct mbuf **m_frag, int mtu,
629     u_long if_hwassist_flags, int sw_csum)
630 {
631 	INIT_VNET_INET(curvnet);
632 	int error = 0;
633 	int hlen = ip->ip_hl << 2;
634 	int len = (mtu - hlen) & ~7;	/* size of payload in each fragment */
635 	int off;
636 	struct mbuf *m0 = *m_frag;	/* the original packet		*/
637 	int firstlen;
638 	struct mbuf **mnext;
639 	int nfrags;
640 
641 	if (ip->ip_off & IP_DF) {	/* Fragmentation not allowed */
642 		V_ipstat.ips_cantfrag++;
643 		return EMSGSIZE;
644 	}
645 
646 	/*
647 	 * Must be able to put at least 8 bytes per fragment.
648 	 */
649 	if (len < 8)
650 		return EMSGSIZE;
651 
652 	/*
653 	 * If the interface will not calculate checksums on
654 	 * fragmented packets, then do it here.
655 	 */
656 	if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA &&
657 	    (if_hwassist_flags & CSUM_IP_FRAGS) == 0) {
658 		in_delayed_cksum(m0);
659 		m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
660 	}
661 
662 	if (len > PAGE_SIZE) {
663 		/*
664 		 * Fragment large datagrams such that each segment
665 		 * contains a multiple of PAGE_SIZE amount of data,
666 		 * plus headers. This enables a receiver to perform
667 		 * page-flipping zero-copy optimizations.
668 		 *
669 		 * XXX When does this help given that sender and receiver
670 		 * could have different page sizes, and also mtu could
671 		 * be less than the receiver's page size ?
672 		 */
673 		int newlen;
674 		struct mbuf *m;
675 
676 		for (m = m0, off = 0; m && (off+m->m_len) <= mtu; m = m->m_next)
677 			off += m->m_len;
678 
679 		/*
680 		 * firstlen (off - hlen) must be aligned on an
681 		 * 8-byte boundary
682 		 */
683 		if (off < hlen)
684 			goto smart_frag_failure;
685 		off = ((off - hlen) & ~7) + hlen;
686 		newlen = (~PAGE_MASK) & mtu;
687 		if ((newlen + sizeof (struct ip)) > mtu) {
688 			/* we failed, go back the default */
689 smart_frag_failure:
690 			newlen = len;
691 			off = hlen + len;
692 		}
693 		len = newlen;
694 
695 	} else {
696 		off = hlen + len;
697 	}
698 
699 	firstlen = off - hlen;
700 	mnext = &m0->m_nextpkt;		/* pointer to next packet */
701 
702 	/*
703 	 * Loop through length of segment after first fragment,
704 	 * make new header and copy data of each part and link onto chain.
705 	 * Here, m0 is the original packet, m is the fragment being created.
706 	 * The fragments are linked off the m_nextpkt of the original
707 	 * packet, which after processing serves as the first fragment.
708 	 */
709 	for (nfrags = 1; off < ip->ip_len; off += len, nfrags++) {
710 		struct ip *mhip;	/* ip header on the fragment */
711 		struct mbuf *m;
712 		int mhlen = sizeof (struct ip);
713 
714 		MGETHDR(m, M_DONTWAIT, MT_DATA);
715 		if (m == NULL) {
716 			error = ENOBUFS;
717 			V_ipstat.ips_odropped++;
718 			goto done;
719 		}
720 		m->m_flags |= (m0->m_flags & M_MCAST) | M_FRAG;
721 		/*
722 		 * In the first mbuf, leave room for the link header, then
723 		 * copy the original IP header including options. The payload
724 		 * goes into an additional mbuf chain returned by m_copy().
725 		 */
726 		m->m_data += max_linkhdr;
727 		mhip = mtod(m, struct ip *);
728 		*mhip = *ip;
729 		if (hlen > sizeof (struct ip)) {
730 			mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);
731 			mhip->ip_v = IPVERSION;
732 			mhip->ip_hl = mhlen >> 2;
733 		}
734 		m->m_len = mhlen;
735 		/* XXX do we need to add ip->ip_off below ? */
736 		mhip->ip_off = ((off - hlen) >> 3) + ip->ip_off;
737 		if (off + len >= ip->ip_len) {	/* last fragment */
738 			len = ip->ip_len - off;
739 			m->m_flags |= M_LASTFRAG;
740 		} else
741 			mhip->ip_off |= IP_MF;
742 		mhip->ip_len = htons((u_short)(len + mhlen));
743 		m->m_next = m_copy(m0, off, len);
744 		if (m->m_next == NULL) {	/* copy failed */
745 			m_free(m);
746 			error = ENOBUFS;	/* ??? */
747 			V_ipstat.ips_odropped++;
748 			goto done;
749 		}
750 		m->m_pkthdr.len = mhlen + len;
751 		m->m_pkthdr.rcvif = NULL;
752 #ifdef MAC
753 		mac_netinet_fragment(m0, m);
754 #endif
755 		m->m_pkthdr.csum_flags = m0->m_pkthdr.csum_flags;
756 		mhip->ip_off = htons(mhip->ip_off);
757 		mhip->ip_sum = 0;
758 		if (sw_csum & CSUM_DELAY_IP)
759 			mhip->ip_sum = in_cksum(m, mhlen);
760 		*mnext = m;
761 		mnext = &m->m_nextpkt;
762 	}
763 	V_ipstat.ips_ofragments += nfrags;
764 
765 	/* set first marker for fragment chain */
766 	m0->m_flags |= M_FIRSTFRAG | M_FRAG;
767 	m0->m_pkthdr.csum_data = nfrags;
768 
769 	/*
770 	 * Update first fragment by trimming what's been copied out
771 	 * and updating header.
772 	 */
773 	m_adj(m0, hlen + firstlen - ip->ip_len);
774 	m0->m_pkthdr.len = hlen + firstlen;
775 	ip->ip_len = htons((u_short)m0->m_pkthdr.len);
776 	ip->ip_off |= IP_MF;
777 	ip->ip_off = htons(ip->ip_off);
778 	ip->ip_sum = 0;
779 	if (sw_csum & CSUM_DELAY_IP)
780 		ip->ip_sum = in_cksum(m0, hlen);
781 
782 done:
783 	*m_frag = m0;
784 	return error;
785 }
786 
787 void
788 in_delayed_cksum(struct mbuf *m)
789 {
790 	struct ip *ip;
791 	u_short csum, offset;
792 
793 	ip = mtod(m, struct ip *);
794 	offset = ip->ip_hl << 2 ;
795 	csum = in_cksum_skip(m, ip->ip_len, offset);
796 	if (m->m_pkthdr.csum_flags & CSUM_UDP && csum == 0)
797 		csum = 0xffff;
798 	offset += m->m_pkthdr.csum_data;	/* checksum offset */
799 
800 	if (offset + sizeof(u_short) > m->m_len) {
801 		printf("delayed m_pullup, m->len: %d  off: %d  p: %d\n",
802 		    m->m_len, offset, ip->ip_p);
803 		/*
804 		 * XXX
805 		 * this shouldn't happen, but if it does, the
806 		 * correct behavior may be to insert the checksum
807 		 * in the appropriate next mbuf in the chain.
808 		 */
809 		return;
810 	}
811 	*(u_short *)(m->m_data + offset) = csum;
812 }
813 
814 /*
815  * IP socket option processing.
816  */
817 int
818 ip_ctloutput(struct socket *so, struct sockopt *sopt)
819 {
820 	struct	inpcb *inp = sotoinpcb(so);
821 	int	error, optval;
822 
823 	error = optval = 0;
824 	if (sopt->sopt_level != IPPROTO_IP) {
825 		return (EINVAL);
826 	}
827 
828 	switch (sopt->sopt_dir) {
829 	case SOPT_SET:
830 		switch (sopt->sopt_name) {
831 		case IP_OPTIONS:
832 #ifdef notyet
833 		case IP_RETOPTS:
834 #endif
835 		{
836 			struct mbuf *m;
837 			if (sopt->sopt_valsize > MLEN) {
838 				error = EMSGSIZE;
839 				break;
840 			}
841 			MGET(m, sopt->sopt_td ? M_WAIT : M_DONTWAIT, MT_DATA);
842 			if (m == NULL) {
843 				error = ENOBUFS;
844 				break;
845 			}
846 			m->m_len = sopt->sopt_valsize;
847 			error = sooptcopyin(sopt, mtod(m, char *), m->m_len,
848 					    m->m_len);
849 			if (error) {
850 				m_free(m);
851 				break;
852 			}
853 			INP_WLOCK(inp);
854 			error = ip_pcbopts(inp, sopt->sopt_name, m);
855 			INP_WUNLOCK(inp);
856 			return (error);
857 		}
858 
859 		case IP_TOS:
860 		case IP_TTL:
861 		case IP_MINTTL:
862 		case IP_RECVOPTS:
863 		case IP_RECVRETOPTS:
864 		case IP_RECVDSTADDR:
865 		case IP_RECVTTL:
866 		case IP_RECVIF:
867 		case IP_FAITH:
868 		case IP_ONESBCAST:
869 		case IP_DONTFRAG:
870 			error = sooptcopyin(sopt, &optval, sizeof optval,
871 					    sizeof optval);
872 			if (error)
873 				break;
874 
875 			switch (sopt->sopt_name) {
876 			case IP_TOS:
877 				inp->inp_ip_tos = optval;
878 				break;
879 
880 			case IP_TTL:
881 				inp->inp_ip_ttl = optval;
882 				break;
883 
884 			case IP_MINTTL:
885 				if (optval > 0 && optval <= MAXTTL)
886 					inp->inp_ip_minttl = optval;
887 				else
888 					error = EINVAL;
889 				break;
890 
891 #define	OPTSET(bit) do {						\
892 	INP_WLOCK(inp);							\
893 	if (optval)							\
894 		inp->inp_flags |= bit;					\
895 	else								\
896 		inp->inp_flags &= ~bit;					\
897 	INP_WUNLOCK(inp);						\
898 } while (0)
899 
900 			case IP_RECVOPTS:
901 				OPTSET(INP_RECVOPTS);
902 				break;
903 
904 			case IP_RECVRETOPTS:
905 				OPTSET(INP_RECVRETOPTS);
906 				break;
907 
908 			case IP_RECVDSTADDR:
909 				OPTSET(INP_RECVDSTADDR);
910 				break;
911 
912 			case IP_RECVTTL:
913 				OPTSET(INP_RECVTTL);
914 				break;
915 
916 			case IP_RECVIF:
917 				OPTSET(INP_RECVIF);
918 				break;
919 
920 			case IP_FAITH:
921 				OPTSET(INP_FAITH);
922 				break;
923 
924 			case IP_ONESBCAST:
925 				OPTSET(INP_ONESBCAST);
926 				break;
927 			case IP_DONTFRAG:
928 				OPTSET(INP_DONTFRAG);
929 				break;
930 			}
931 			break;
932 #undef OPTSET
933 
934 		/*
935 		 * Multicast socket options are processed by the in_mcast
936 		 * module.
937 		 */
938 		case IP_MULTICAST_IF:
939 		case IP_MULTICAST_VIF:
940 		case IP_MULTICAST_TTL:
941 		case IP_MULTICAST_LOOP:
942 		case IP_ADD_MEMBERSHIP:
943 		case IP_DROP_MEMBERSHIP:
944 		case IP_ADD_SOURCE_MEMBERSHIP:
945 		case IP_DROP_SOURCE_MEMBERSHIP:
946 		case IP_BLOCK_SOURCE:
947 		case IP_UNBLOCK_SOURCE:
948 		case IP_MSFILTER:
949 		case MCAST_JOIN_GROUP:
950 		case MCAST_LEAVE_GROUP:
951 		case MCAST_JOIN_SOURCE_GROUP:
952 		case MCAST_LEAVE_SOURCE_GROUP:
953 		case MCAST_BLOCK_SOURCE:
954 		case MCAST_UNBLOCK_SOURCE:
955 			error = inp_setmoptions(inp, sopt);
956 			break;
957 
958 		case IP_PORTRANGE:
959 			error = sooptcopyin(sopt, &optval, sizeof optval,
960 					    sizeof optval);
961 			if (error)
962 				break;
963 
964 			INP_WLOCK(inp);
965 			switch (optval) {
966 			case IP_PORTRANGE_DEFAULT:
967 				inp->inp_flags &= ~(INP_LOWPORT);
968 				inp->inp_flags &= ~(INP_HIGHPORT);
969 				break;
970 
971 			case IP_PORTRANGE_HIGH:
972 				inp->inp_flags &= ~(INP_LOWPORT);
973 				inp->inp_flags |= INP_HIGHPORT;
974 				break;
975 
976 			case IP_PORTRANGE_LOW:
977 				inp->inp_flags &= ~(INP_HIGHPORT);
978 				inp->inp_flags |= INP_LOWPORT;
979 				break;
980 
981 			default:
982 				error = EINVAL;
983 				break;
984 			}
985 			INP_WUNLOCK(inp);
986 			break;
987 
988 #ifdef IPSEC
989 		case IP_IPSEC_POLICY:
990 		{
991 			caddr_t req;
992 			struct mbuf *m;
993 
994 			if ((error = soopt_getm(sopt, &m)) != 0) /* XXX */
995 				break;
996 			if ((error = soopt_mcopyin(sopt, m)) != 0) /* XXX */
997 				break;
998 			req = mtod(m, caddr_t);
999 			error = ipsec4_set_policy(inp, sopt->sopt_name, req,
1000 			    m->m_len, (sopt->sopt_td != NULL) ?
1001 			    sopt->sopt_td->td_ucred : NULL);
1002 			m_freem(m);
1003 			break;
1004 		}
1005 #endif /* IPSEC */
1006 
1007 		default:
1008 			error = ENOPROTOOPT;
1009 			break;
1010 		}
1011 		break;
1012 
1013 	case SOPT_GET:
1014 		switch (sopt->sopt_name) {
1015 		case IP_OPTIONS:
1016 		case IP_RETOPTS:
1017 			if (inp->inp_options)
1018 				error = sooptcopyout(sopt,
1019 						     mtod(inp->inp_options,
1020 							  char *),
1021 						     inp->inp_options->m_len);
1022 			else
1023 				sopt->sopt_valsize = 0;
1024 			break;
1025 
1026 		case IP_TOS:
1027 		case IP_TTL:
1028 		case IP_MINTTL:
1029 		case IP_RECVOPTS:
1030 		case IP_RECVRETOPTS:
1031 		case IP_RECVDSTADDR:
1032 		case IP_RECVTTL:
1033 		case IP_RECVIF:
1034 		case IP_PORTRANGE:
1035 		case IP_FAITH:
1036 		case IP_ONESBCAST:
1037 		case IP_DONTFRAG:
1038 			switch (sopt->sopt_name) {
1039 
1040 			case IP_TOS:
1041 				optval = inp->inp_ip_tos;
1042 				break;
1043 
1044 			case IP_TTL:
1045 				optval = inp->inp_ip_ttl;
1046 				break;
1047 
1048 			case IP_MINTTL:
1049 				optval = inp->inp_ip_minttl;
1050 				break;
1051 
1052 #define	OPTBIT(bit)	(inp->inp_flags & bit ? 1 : 0)
1053 
1054 			case IP_RECVOPTS:
1055 				optval = OPTBIT(INP_RECVOPTS);
1056 				break;
1057 
1058 			case IP_RECVRETOPTS:
1059 				optval = OPTBIT(INP_RECVRETOPTS);
1060 				break;
1061 
1062 			case IP_RECVDSTADDR:
1063 				optval = OPTBIT(INP_RECVDSTADDR);
1064 				break;
1065 
1066 			case IP_RECVTTL:
1067 				optval = OPTBIT(INP_RECVTTL);
1068 				break;
1069 
1070 			case IP_RECVIF:
1071 				optval = OPTBIT(INP_RECVIF);
1072 				break;
1073 
1074 			case IP_PORTRANGE:
1075 				if (inp->inp_flags & INP_HIGHPORT)
1076 					optval = IP_PORTRANGE_HIGH;
1077 				else if (inp->inp_flags & INP_LOWPORT)
1078 					optval = IP_PORTRANGE_LOW;
1079 				else
1080 					optval = 0;
1081 				break;
1082 
1083 			case IP_FAITH:
1084 				optval = OPTBIT(INP_FAITH);
1085 				break;
1086 
1087 			case IP_ONESBCAST:
1088 				optval = OPTBIT(INP_ONESBCAST);
1089 				break;
1090 			case IP_DONTFRAG:
1091 				optval = OPTBIT(INP_DONTFRAG);
1092 				break;
1093 			}
1094 			error = sooptcopyout(sopt, &optval, sizeof optval);
1095 			break;
1096 
1097 		/*
1098 		 * Multicast socket options are processed by the in_mcast
1099 		 * module.
1100 		 */
1101 		case IP_MULTICAST_IF:
1102 		case IP_MULTICAST_VIF:
1103 		case IP_MULTICAST_TTL:
1104 		case IP_MULTICAST_LOOP:
1105 		case IP_MSFILTER:
1106 			error = inp_getmoptions(inp, sopt);
1107 			break;
1108 
1109 #ifdef IPSEC
1110 		case IP_IPSEC_POLICY:
1111 		{
1112 			struct mbuf *m = NULL;
1113 			caddr_t req = NULL;
1114 			size_t len = 0;
1115 
1116 			if (m != 0) {
1117 				req = mtod(m, caddr_t);
1118 				len = m->m_len;
1119 			}
1120 			error = ipsec4_get_policy(sotoinpcb(so), req, len, &m);
1121 			if (error == 0)
1122 				error = soopt_mcopyout(sopt, m); /* XXX */
1123 			if (error == 0)
1124 				m_freem(m);
1125 			break;
1126 		}
1127 #endif /* IPSEC */
1128 
1129 		default:
1130 			error = ENOPROTOOPT;
1131 			break;
1132 		}
1133 		break;
1134 	}
1135 	return (error);
1136 }
1137 
1138 /*
1139  * Routine called from ip_output() to loop back a copy of an IP multicast
1140  * packet to the input queue of a specified interface.  Note that this
1141  * calls the output routine of the loopback "driver", but with an interface
1142  * pointer that might NOT be a loopback interface -- evil, but easier than
1143  * replicating that code here.
1144  */
1145 static void
1146 ip_mloopback(struct ifnet *ifp, struct mbuf *m, struct sockaddr_in *dst,
1147     int hlen)
1148 {
1149 	register struct ip *ip;
1150 	struct mbuf *copym;
1151 
1152 	/*
1153 	 * Make a deep copy of the packet because we're going to
1154 	 * modify the pack in order to generate checksums.
1155 	 */
1156 	copym = m_dup(m, M_DONTWAIT);
1157 	if (copym != NULL && (copym->m_flags & M_EXT || copym->m_len < hlen))
1158 		copym = m_pullup(copym, hlen);
1159 	if (copym != NULL) {
1160 		/* If needed, compute the checksum and mark it as valid. */
1161 		if (copym->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
1162 			in_delayed_cksum(copym);
1163 			copym->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
1164 			copym->m_pkthdr.csum_flags |=
1165 			    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
1166 			copym->m_pkthdr.csum_data = 0xffff;
1167 		}
1168 		/*
1169 		 * We don't bother to fragment if the IP length is greater
1170 		 * than the interface's MTU.  Can this possibly matter?
1171 		 */
1172 		ip = mtod(copym, struct ip *);
1173 		ip->ip_len = htons(ip->ip_len);
1174 		ip->ip_off = htons(ip->ip_off);
1175 		ip->ip_sum = 0;
1176 		ip->ip_sum = in_cksum(copym, hlen);
1177 #if 1 /* XXX */
1178 		if (dst->sin_family != AF_INET) {
1179 			printf("ip_mloopback: bad address family %d\n",
1180 						dst->sin_family);
1181 			dst->sin_family = AF_INET;
1182 		}
1183 #endif
1184 		if_simloop(ifp, copym, dst->sin_family, 0);
1185 	}
1186 }
1187