xref: /netbsd-src/sys/netinet/if_arp.c (revision 200d779b75dbeafa7bc01fd0f60bc61185f6967b)
1 /*	$NetBSD: if_arp.c,v 1.181 2015/09/11 10:33:32 roy Exp $	*/
2 
3 /*-
4  * Copyright (c) 1998, 2000, 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Public Access Networks Corporation ("Panix").  It was developed under
9  * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)if_ether.c	8.2 (Berkeley) 9/26/94
62  */
63 
64 /*
65  * Ethernet address resolution protocol.
66  * TODO:
67  *	add "inuse/lock" bit (or ref. count) along with valid bit
68  */
69 
70 #include <sys/cdefs.h>
71 __KERNEL_RCSID(0, "$NetBSD: if_arp.c,v 1.181 2015/09/11 10:33:32 roy Exp $");
72 
73 #ifdef _KERNEL_OPT
74 #include "opt_ddb.h"
75 #include "opt_inet.h"
76 #endif
77 
78 #ifdef INET
79 
80 #include "bridge.h"
81 
82 #include <sys/param.h>
83 #include <sys/systm.h>
84 #include <sys/callout.h>
85 #include <sys/malloc.h>
86 #include <sys/mbuf.h>
87 #include <sys/socket.h>
88 #include <sys/time.h>
89 #include <sys/timetc.h>
90 #include <sys/kernel.h>
91 #include <sys/errno.h>
92 #include <sys/ioctl.h>
93 #include <sys/syslog.h>
94 #include <sys/proc.h>
95 #include <sys/protosw.h>
96 #include <sys/domain.h>
97 #include <sys/sysctl.h>
98 #include <sys/socketvar.h>
99 #include <sys/percpu.h>
100 #include <sys/cprng.h>
101 #include <sys/kmem.h>
102 
103 #include <net/ethertypes.h>
104 #include <net/if.h>
105 #include <net/if_dl.h>
106 #include <net/if_token.h>
107 #include <net/if_types.h>
108 #include <net/if_ether.h>
109 #include <net/if_llatbl.h>
110 #include <net/net_osdep.h>
111 #include <net/route.h>
112 #include <net/net_stats.h>
113 
114 #include <netinet/in.h>
115 #include <netinet/in_systm.h>
116 #include <netinet/in_var.h>
117 #include <netinet/ip.h>
118 #include <netinet/if_inarp.h>
119 
120 #include "arcnet.h"
121 #if NARCNET > 0
122 #include <net/if_arc.h>
123 #endif
124 #include "fddi.h"
125 #if NFDDI > 0
126 #include <net/if_fddi.h>
127 #endif
128 #include "token.h"
129 #include "carp.h"
130 #if NCARP > 0
131 #include <netinet/ip_carp.h>
132 #endif
133 
134 #define SIN(s) ((struct sockaddr_in *)s)
135 #define SRP(s) ((struct sockaddr_inarp *)s)
136 
137 /*
138  * ARP trailer negotiation.  Trailer protocol is not IP specific,
139  * but ARP request/response use IP addresses.
140  */
141 #define ETHERTYPE_IPTRAILERS ETHERTYPE_TRAIL
142 
143 /* timer values */
144 static int	arpt_keep = (20*60);	/* once resolved, good for 20 more minutes */
145 static int	arpt_down = 20;		/* once declared down, don't send for 20 secs */
146 static int	arp_maxhold = 1;	/* number of packets to hold per ARP entry */
147 #define	rt_expire rt_rmx.rmx_expire
148 #define	rt_pksent rt_rmx.rmx_pksent
149 
150 int		ip_dad_count = PROBE_NUM;
151 #ifdef ARP_DEBUG
152 static int	arp_debug = 1;
153 #else
154 static int	arp_debug = 0;
155 #endif
156 #define arplog(x)	do { if (arp_debug) log x; } while (/*CONSTCOND*/ 0)
157 
158 static	void arp_init(void);
159 
160 static	struct sockaddr *arp_setgate(struct rtentry *, struct sockaddr *,
161 	    const struct sockaddr *);
162 static	void arptfree(struct rtentry *);
163 static	void arptimer(void *);
164 static	struct llentry *arplookup(struct ifnet *, struct mbuf *,
165 	    const struct in_addr *, int, int, int, struct rtentry *);
166 static	void in_arpinput(struct mbuf *);
167 static	void in_revarpinput(struct mbuf *);
168 static	void revarprequest(struct ifnet *);
169 
170 static	void arp_drainstub(void);
171 
172 static void arp_dad_timer(struct ifaddr *);
173 static void arp_dad_start(struct ifaddr *);
174 static void arp_dad_stop(struct ifaddr *);
175 static void arp_dad_duplicated(struct ifaddr *);
176 
177 struct	ifqueue arpintrq = {
178 	.ifq_head = NULL,
179 	.ifq_tail = NULL,
180 	.ifq_len = 0,
181 	.ifq_maxlen = 50,
182 	.ifq_drops = 0,
183 };
184 static int	arp_inuse, arp_allocated;
185 static int	arp_maxtries = 5;
186 static int	useloopback = 1;	/* use loopback interface for local traffic */
187 
188 static percpu_t *arpstat_percpu;
189 
190 #define	ARP_STAT_GETREF()	_NET_STAT_GETREF(arpstat_percpu)
191 #define	ARP_STAT_PUTREF()	_NET_STAT_PUTREF(arpstat_percpu)
192 
193 #define	ARP_STATINC(x)		_NET_STATINC(arpstat_percpu, x)
194 #define	ARP_STATADD(x, v)	_NET_STATADD(arpstat_percpu, x, v)
195 
196 /* revarp state */
197 static struct	in_addr myip, srv_ip;
198 static int	myip_initialized = 0;
199 static int	revarp_in_progress = 0;
200 static struct	ifnet *myip_ifp = NULL;
201 
202 #ifdef DDB
203 static void db_print_sa(const struct sockaddr *);
204 static void db_print_ifa(struct ifaddr *);
205 static void db_print_llinfo(void *);
206 static int db_show_rtentry(struct rtentry *, void *);
207 #endif
208 
209 static int arp_drainwanted;
210 
211 static int log_movements = 1;
212 static int log_permanent_modify = 1;
213 static int log_wrong_iface = 1;
214 static int log_unknown_network = 1;
215 
216 /*
217  * this should be elsewhere.
218  */
219 
220 static char *
221 lla_snprintf(u_int8_t *, int);
222 
223 static char *
224 lla_snprintf(u_int8_t *adrp, int len)
225 {
226 #define NUMBUFS 3
227 	static char buf[NUMBUFS][16*3];
228 	static int bnum = 0;
229 
230 	int i;
231 	char *p;
232 
233 	p = buf[bnum];
234 
235 	*p++ = hexdigits[(*adrp)>>4];
236 	*p++ = hexdigits[(*adrp++)&0xf];
237 
238 	for (i=1; i<len && i<16; i++) {
239 		*p++ = ':';
240 		*p++ = hexdigits[(*adrp)>>4];
241 		*p++ = hexdigits[(*adrp++)&0xf];
242 	}
243 
244 	*p = 0;
245 	p = buf[bnum];
246 	bnum = (bnum + 1) % NUMBUFS;
247 	return p;
248 }
249 
250 DOMAIN_DEFINE(arpdomain);	/* forward declare and add to link set */
251 
252 static void
253 arp_fasttimo(void)
254 {
255 	if (arp_drainwanted) {
256 		arp_drain();
257 		arp_drainwanted = 0;
258 	}
259 }
260 
261 const struct protosw arpsw[] = {
262 	{ .pr_type = 0,
263 	  .pr_domain = &arpdomain,
264 	  .pr_protocol = 0,
265 	  .pr_flags = 0,
266 	  .pr_input = 0,
267 	  .pr_output = 0,
268 	  .pr_ctlinput = 0,
269 	  .pr_ctloutput = 0,
270 	  .pr_usrreqs = 0,
271 	  .pr_init = arp_init,
272 	  .pr_fasttimo = arp_fasttimo,
273 	  .pr_slowtimo = 0,
274 	  .pr_drain = arp_drainstub,
275 	}
276 };
277 
278 struct domain arpdomain = {
279 	.dom_family = PF_ARP,
280 	.dom_name = "arp",
281 	.dom_protosw = arpsw,
282 	.dom_protoswNPROTOSW = &arpsw[__arraycount(arpsw)],
283 };
284 
285 static void sysctl_net_inet_arp_setup(struct sysctllog **);
286 
287 void
288 arp_init(void)
289 {
290 
291 	sysctl_net_inet_arp_setup(NULL);
292 	arpstat_percpu = percpu_alloc(sizeof(uint64_t) * ARP_NSTATS);
293 }
294 
295 static void
296 arp_drainstub(void)
297 {
298 	arp_drainwanted = 1;
299 }
300 
301 /*
302  * ARP protocol drain routine.  Called when memory is in short supply.
303  * Called at splvm();  don't acquire softnet_lock as can be called from
304  * hardware interrupt handlers.
305  */
306 void
307 arp_drain(void)
308 {
309 
310 	lltable_drain(AF_INET);
311 }
312 
313 static void
314 arptimer(void *arg)
315 {
316 	struct llentry *lle = arg;
317 	struct ifnet *ifp;
318 
319 	mutex_enter(softnet_lock);
320 
321 	if (lle == NULL)
322 		goto out;
323 
324 	if (lle->la_flags & LLE_STATIC)
325 		goto out;
326 
327 	LLE_WLOCK(lle);
328 	if (callout_pending(&lle->la_timer)) {
329 		/*
330 		 * Here we are a bit odd here in the treatment of
331 		 * active/pending. If the pending bit is set, it got
332 		 * rescheduled before I ran. The active
333 		 * bit we ignore, since if it was stopped
334 		 * in ll_tablefree() and was currently running
335 		 * it would have return 0 so the code would
336 		 * not have deleted it since the callout could
337 		 * not be stopped so we want to go through
338 		 * with the delete here now. If the callout
339 		 * was restarted, the pending bit will be back on and
340 		 * we just want to bail since the callout_reset would
341 		 * return 1 and our reference would have been removed
342 		 * by arpresolve() below.
343 		 */
344 		LLE_WUNLOCK(lle);
345 		goto out;
346 	}
347 	ifp = lle->lle_tbl->llt_ifp;
348 
349 	callout_stop(&lle->la_timer);
350 
351 	/* XXX: LOR avoidance. We still have ref on lle. */
352 	LLE_WUNLOCK(lle);
353 
354 	if (lle->la_rt != NULL) {
355 		/* We have to call arptfree w/o IF_AFDATA_LOCK */
356 		arptfree(lle->la_rt);
357 		lle->la_rt = NULL;
358 	}
359 
360 	IF_AFDATA_LOCK(ifp);
361 	LLE_WLOCK(lle);
362 
363 	/* Guard against race with other llentry_free(). */
364 	if (lle->la_flags & LLE_LINKED) {
365 		size_t pkts_dropped;
366 
367 		LLE_REMREF(lle);
368 		pkts_dropped = llentry_free(lle);
369 		ARP_STATADD(ARP_STAT_DFRDROPPED, pkts_dropped);
370 	} else {
371 		LLE_FREE_LOCKED(lle);
372 	}
373 
374 	IF_AFDATA_UNLOCK(ifp);
375 
376 out:
377 	mutex_exit(softnet_lock);
378 }
379 
380 /*
381  * We set the gateway for RTF_CLONING routes to a "prototype"
382  * link-layer sockaddr whose interface type (if_type) and interface
383  * index (if_index) fields are prepared.
384  */
385 static struct sockaddr *
386 arp_setgate(struct rtentry *rt, struct sockaddr *gate,
387     const struct sockaddr *netmask)
388 {
389 	const struct ifnet *ifp = rt->rt_ifp;
390 	uint8_t namelen = strlen(ifp->if_xname);
391 	uint8_t addrlen = ifp->if_addrlen;
392 
393 	/*
394 	 * XXX: If this is a manually added route to interface
395 	 * such as older version of routed or gated might provide,
396 	 * restore cloning bit.
397 	 */
398 	if ((rt->rt_flags & RTF_HOST) == 0 && netmask != NULL &&
399 	    satocsin(netmask)->sin_addr.s_addr != 0xffffffff)
400 		rt->rt_flags |= RTF_CLONING;
401 	if (rt->rt_flags & RTF_CLONING ||
402 	    ((rt->rt_flags & (RTF_LLINFO | RTF_LOCAL)) && !rt->rt_llinfo))
403 	{
404 		union {
405 			struct sockaddr sa;
406 			struct sockaddr_storage ss;
407 			struct sockaddr_dl sdl;
408 		} u;
409 		/*
410 		 * Case 1: This route should come from a route to iface.
411 		 */
412 		sockaddr_dl_init(&u.sdl, sizeof(u.ss),
413 		    ifp->if_index, ifp->if_type, NULL, namelen, NULL, addrlen);
414 		rt_setgate(rt, &u.sa);
415 		gate = rt->rt_gateway;
416 	}
417 	return gate;
418 }
419 
420 /*
421  * Parallel to llc_rtrequest.
422  */
423 void
424 arp_rtrequest(int req, struct rtentry *rt, const struct rt_addrinfo *info)
425 {
426 	struct sockaddr *gate = rt->rt_gateway;
427 	struct llentry *la = NULL;
428 	struct in_ifaddr *ia;
429 	struct ifaddr *ifa;
430 	struct ifnet *ifp = rt->rt_ifp;
431 	int flags = 0;
432 
433 	if (req == RTM_LLINFO_UPD) {
434 		struct in_addr *in;
435 
436 		if ((ifa = info->rti_ifa) == NULL)
437 			return;
438 
439 		in = &ifatoia(ifa)->ia_addr.sin_addr;
440 
441 		if (ifatoia(ifa)->ia4_flags &
442 		    (IN_IFF_NOTREADY | IN_IFF_DETACHED))
443 		{
444 			arplog((LOG_DEBUG, "arp_request: %s not ready\n",
445 			   in_fmtaddr(*in)));
446 			return;
447 		}
448 
449 		arprequest(ifa->ifa_ifp, in, in,
450 		    CLLADDR(ifa->ifa_ifp->if_sadl));
451 		return;
452 	}
453 
454 	if ((rt->rt_flags & RTF_GATEWAY) != 0) {
455 		if (req != RTM_ADD)
456 			return;
457 
458 		/*
459 		 * linklayers with particular link MTU limitation.
460 		 */
461 		switch(ifp->if_type) {
462 #if NFDDI > 0
463 		case IFT_FDDI:
464 			if (ifp->if_mtu > FDDIIPMTU)
465 				rt->rt_rmx.rmx_mtu = FDDIIPMTU;
466 			break;
467 #endif
468 #if NARCNET > 0
469 		case IFT_ARCNET:
470 		    {
471 			int arcipifmtu;
472 
473 			if (ifp->if_flags & IFF_LINK0)
474 				arcipifmtu = arc_ipmtu;
475 			else
476 				arcipifmtu = ARCMTU;
477 			if (ifp->if_mtu > arcipifmtu)
478 				rt->rt_rmx.rmx_mtu = arcipifmtu;
479 			break;
480 		    }
481 #endif
482 		}
483 		return;
484 	}
485 
486 	IF_AFDATA_RLOCK(ifp);
487 	la = lla_lookup(LLTABLE(ifp), flags, rt_getkey(rt));
488 	IF_AFDATA_RUNLOCK(ifp);
489 
490 	switch (req) {
491 	case RTM_SETGATE:
492 		gate = arp_setgate(rt, gate, info->rti_info[RTAX_NETMASK]);
493 		break;
494 	case RTM_ADD:
495 		gate = arp_setgate(rt, gate, info->rti_info[RTAX_NETMASK]);
496 		if (rt->rt_flags & RTF_CLONING ||
497 		    ((rt->rt_flags & (RTF_LLINFO | RTF_LOCAL)) && !la))
498 		{
499 			/*
500 			 * Give this route an expiration time, even though
501 			 * it's a "permanent" route, so that routes cloned
502 			 * from it do not need their expiration time set.
503 			 */
504 			KASSERT(time_uptime != 0);
505 			rt->rt_expire = time_uptime;
506 			/*
507 			 * linklayers with particular link MTU limitation.
508 			 */
509 			switch (ifp->if_type) {
510 #if NFDDI > 0
511 			case IFT_FDDI:
512 				if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0 &&
513 				    (rt->rt_rmx.rmx_mtu > FDDIIPMTU ||
514 				     (rt->rt_rmx.rmx_mtu == 0 &&
515 				      ifp->if_mtu > FDDIIPMTU)))
516 					rt->rt_rmx.rmx_mtu = FDDIIPMTU;
517 				break;
518 #endif
519 #if NARCNET > 0
520 			case IFT_ARCNET:
521 			    {
522 				int arcipifmtu;
523 				if (ifp->if_flags & IFF_LINK0)
524 					arcipifmtu = arc_ipmtu;
525 				else
526 					arcipifmtu = ARCMTU;
527 
528 				if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0 &&
529 				    (rt->rt_rmx.rmx_mtu > arcipifmtu ||
530 				     (rt->rt_rmx.rmx_mtu == 0 &&
531 				      ifp->if_mtu > arcipifmtu)))
532 					rt->rt_rmx.rmx_mtu = arcipifmtu;
533 				break;
534 			    }
535 #endif
536 			}
537 			if (rt->rt_flags & RTF_CLONING)
538 				break;
539 		}
540 		/* Announce a new entry if requested. */
541 		if (rt->rt_flags & RTF_ANNOUNCE) {
542 			INADDR_TO_IA(satocsin(rt_getkey(rt))->sin_addr, ia);
543 			while (ia && ia->ia_ifp != ifp)
544 				NEXT_IA_WITH_SAME_ADDR(ia);
545 			if (ia == NULL ||
546 			    ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
547 				;
548 			else
549 				arprequest(ifp,
550 				    &satocsin(rt_getkey(rt))->sin_addr,
551 				    &satocsin(rt_getkey(rt))->sin_addr,
552 				    CLLADDR(satocsdl(gate)));
553 		}
554 		/*FALLTHROUGH*/
555 	case RTM_RESOLVE:
556 		if (gate->sa_family != AF_LINK ||
557 		    gate->sa_len < sockaddr_dl_measure(0, ifp->if_addrlen)) {
558 			log(LOG_DEBUG, "arp_rtrequest: bad gateway value\n");
559 			break;
560 		}
561 
562 		satosdl(gate)->sdl_type = ifp->if_type;
563 		satosdl(gate)->sdl_index = ifp->if_index;
564 		if (la != NULL)
565 			break; /* This happens on a route change */
566 
567 		/* If the route is for a broadcast address mark it as such.
568 		 * This way we can avoid an expensive call to in_broadcast()
569 		 * in ip_output() most of the time (because the route passed
570 		 * to ip_output() is almost always a host route). */
571 		if (rt->rt_flags & RTF_HOST &&
572 		    !(rt->rt_flags & RTF_BROADCAST) &&
573 		    in_broadcast(satocsin(rt_getkey(rt))->sin_addr, rt->rt_ifp))
574 			rt->rt_flags |= RTF_BROADCAST;
575 		/* There is little point in resolving the broadcast address */
576 		if (rt->rt_flags & RTF_BROADCAST)
577 			break;
578 
579 		/*
580 		 * Case 2:  This route may come from cloning, or a manual route
581 		 * add with a LL address.
582 		 */
583 		flags = LLE_EXCLUSIVE;
584 		if ((rt->rt_flags & RTF_CLONED) == 0)
585 			flags |= LLE_IFADDR;
586 
587 		IF_AFDATA_WLOCK(ifp);
588 		la = lla_create(LLTABLE(ifp), flags, rt_getkey(rt));
589 		IF_AFDATA_WUNLOCK(ifp);
590 
591 		if (la == NULL) {
592 			log(LOG_DEBUG, "%s: lla_create failed\n",
593 			    __func__);
594 			rt->rt_llinfo = NULL;
595 			break;
596 		}
597 		rt->rt_llinfo = la;
598 		switch (ifp->if_type) {
599 #if NTOKEN > 0
600 		case IFT_ISO88025:
601 			la->la_opaque = kmem_alloc(sizeof(struct token_rif),
602 			    KM_SLEEP);
603 			break;
604 #endif /* NTOKEN > 0 */
605 		default:
606 			break;
607 		}
608 		la->la_rt = rt;
609 		rt->rt_refcnt++;
610 		rt->rt_flags |= RTF_LLINFO;
611 		arp_inuse++, arp_allocated++;
612 
613 		LLE_WUNLOCK(la);
614 		la = NULL;
615 
616 		INADDR_TO_IA(satocsin(rt_getkey(rt))->sin_addr, ia);
617 		while (ia && ia->ia_ifp != ifp)
618 			NEXT_IA_WITH_SAME_ADDR(ia);
619 		if (ia) {
620 			/*
621 			 * This test used to be
622 			 *	if (lo0ifp->if_flags & IFF_UP)
623 			 * It allowed local traffic to be forced through
624 			 * the hardware by configuring the loopback down.
625 			 * However, it causes problems during network
626 			 * configuration for boards that can't receive
627 			 * packets they send.  It is now necessary to clear
628 			 * "useloopback" and remove the route to force
629 			 * traffic out to the hardware.
630 			 *
631 			 * In 4.4BSD, the above "if" statement checked
632 			 * rt->rt_ifa against rt_getkey(rt).  It was changed
633 			 * to the current form so that we can provide a
634 			 * better support for multiple IPv4 addresses on a
635 			 * interface.
636 			 */
637 			rt->rt_expire = 0;
638 			if (sockaddr_dl_init(satosdl(gate), gate->sa_len,
639 			    ifp->if_index, ifp->if_type, NULL, 0,
640 			    CLLADDR(ifp->if_sadl), ifp->if_addrlen) == NULL) {
641 				panic("%s(%s): sockaddr_dl_init cannot fail",
642 				    __func__, ifp->if_xname);
643 			}
644 			if (useloopback) {
645 				ifp = rt->rt_ifp = lo0ifp;
646 				rt->rt_rmx.rmx_mtu = 0;
647 			}
648 			rt->rt_flags |= RTF_LOCAL;
649 			/*
650 			 * make sure to set rt->rt_ifa to the interface
651 			 * address we are using, otherwise we will have trouble
652 			 * with source address selection.
653 			 */
654 			ifa = &ia->ia_ifa;
655 			if (ifa != rt->rt_ifa)
656 				rt_replace_ifa(rt, ifa);
657 		}
658 		break;
659 
660 	case RTM_DELETE:
661 		if (la == NULL)
662 			break;
663 		arp_inuse--;
664 		rt->rt_llinfo = NULL;
665 		rt->rt_flags &= ~RTF_LLINFO;
666 
667 		LLE_RUNLOCK(la);
668 
669 		flags |= LLE_EXCLUSIVE;
670 		IF_AFDATA_WLOCK(ifp);
671 
672 		la = lla_lookup(LLTABLE(ifp), flags, rt_getkey(rt));
673 		/* This shouldn't happen */
674 		if (la == NULL) {
675 			IF_AFDATA_WUNLOCK(ifp);
676 			break;
677 		}
678 
679 		if (la->la_opaque != NULL) {
680 			switch (ifp->if_type) {
681 #if NTOKEN > 0
682 			case IFT_ISO88025:
683 				kmem_free(la->la_opaque,
684 				    sizeof(struct token_rif));
685 				break;
686 #endif /* NTOKEN > 0 */
687 			default:
688 				break;
689 			}
690 		}
691 
692 		if (la->la_rt != NULL) {
693 			/*
694 			 * Don't rtfree (may actually free objects) here.
695 			 * Leave it to rtrequest1.
696 			 */
697 			la->la_rt->rt_refcnt--;
698 			la->la_rt = NULL;
699 		}
700 		llentry_free(la);
701 
702 		IF_AFDATA_WUNLOCK(ifp);
703 		la = NULL;
704 	}
705 
706 	if (la != NULL) {
707 		if (flags & LLE_EXCLUSIVE)
708 			LLE_WUNLOCK(la);
709 		else
710 			LLE_RUNLOCK(la);
711 	}
712 }
713 
714 /*
715  * Broadcast an ARP request. Caller specifies:
716  *	- arp header source ip address
717  *	- arp header target ip address
718  *	- arp header source ethernet address
719  */
720 void
721 arprequest(struct ifnet *ifp,
722     const struct in_addr *sip, const struct in_addr *tip,
723     const u_int8_t *enaddr)
724 {
725 	struct mbuf *m;
726 	struct arphdr *ah;
727 	struct sockaddr sa;
728 	uint64_t *arps;
729 
730 	KASSERT(sip != NULL);
731 	KASSERT(tip != NULL);
732 	KASSERT(enaddr != NULL);
733 
734 	if ((m = m_gethdr(M_DONTWAIT, MT_DATA)) == NULL)
735 		return;
736 	MCLAIM(m, &arpdomain.dom_mowner);
737 	switch (ifp->if_type) {
738 	case IFT_IEEE1394:
739 		m->m_len = sizeof(*ah) + 2 * sizeof(struct in_addr) +
740 		    ifp->if_addrlen;
741 		break;
742 	default:
743 		m->m_len = sizeof(*ah) + 2 * sizeof(struct in_addr) +
744 		    2 * ifp->if_addrlen;
745 		break;
746 	}
747 	m->m_pkthdr.len = m->m_len;
748 	MH_ALIGN(m, m->m_len);
749 	ah = mtod(m, struct arphdr *);
750 	memset(ah, 0, m->m_len);
751 	switch (ifp->if_type) {
752 	case IFT_IEEE1394:	/* RFC2734 */
753 		/* fill it now for ar_tpa computation */
754 		ah->ar_hrd = htons(ARPHRD_IEEE1394);
755 		break;
756 	default:
757 		/* ifp->if_output will fill ar_hrd */
758 		break;
759 	}
760 	ah->ar_pro = htons(ETHERTYPE_IP);
761 	ah->ar_hln = ifp->if_addrlen;		/* hardware address length */
762 	ah->ar_pln = sizeof(struct in_addr);	/* protocol address length */
763 	ah->ar_op = htons(ARPOP_REQUEST);
764 	memcpy(ar_sha(ah), enaddr, ah->ar_hln);
765 	memcpy(ar_spa(ah), sip, ah->ar_pln);
766 	memcpy(ar_tpa(ah), tip, ah->ar_pln);
767 	sa.sa_family = AF_ARP;
768 	sa.sa_len = 2;
769 	m->m_flags |= M_BCAST;
770 	arps = ARP_STAT_GETREF();
771 	arps[ARP_STAT_SNDTOTAL]++;
772 	arps[ARP_STAT_SENDREQUEST]++;
773 	ARP_STAT_PUTREF();
774 	(*ifp->if_output)(ifp, m, &sa, NULL);
775 }
776 
777 /*
778  * Resolve an IP address into an ethernet address.  If success,
779  * desten is filled in.  If there is no entry in arptab,
780  * set one up and broadcast a request for the IP address.
781  * Hold onto this mbuf and resend it once the address
782  * is finally resolved.  A return value of 1 indicates
783  * that desten has been filled in and the packet should be sent
784  * normally; a 0 return indicates that the packet has been
785  * taken over here, either now or for later transmission.
786  */
787 int
788 arpresolve(struct ifnet *ifp, struct rtentry *rt, struct mbuf *m,
789     const struct sockaddr *dst, u_char *desten)
790 {
791 	struct llentry *la;
792 	const struct sockaddr_dl *sdl;
793 	int renew;
794 	int flags = 0;
795 	int error;
796 
797 	KASSERT(m != NULL);
798 
799 	la = arplookup(ifp, m, &satocsin(dst)->sin_addr, 1, 0, 0, rt);
800 	if (la != NULL)
801 		rt = la->la_rt;
802 
803 	if (la == NULL || rt == NULL) {
804 		ARP_STATINC(ARP_STAT_ALLOCFAIL);
805 		log(LOG_DEBUG,
806 		    "arpresolve: can't allocate llinfo on %s for %s\n",
807 		    ifp->if_xname, in_fmtaddr(satocsin(dst)->sin_addr));
808 		m_freem(m);
809 		if (la != NULL)
810 			LLE_RUNLOCK(la);
811 		return 0;
812 	}
813 	sdl = satocsdl(rt->rt_gateway);
814 	/*
815 	 * Check the address family and length is valid, the address
816 	 * is resolved; otherwise, try to resolve.
817 	 */
818 	if ((rt->rt_expire == 0 || rt->rt_expire > time_uptime) &&
819 	    sdl->sdl_family == AF_LINK && sdl->sdl_alen != 0) {
820 		memcpy(desten, CLLADDR(sdl),
821 		    min(sdl->sdl_alen, ifp->if_addrlen));
822 		rt->rt_pksent = time_uptime; /* Time for last pkt sent */
823 		LLE_RUNLOCK(la);
824 		return 1;
825 	}
826 
827 	/*
828 	 * Re-send the ARP request when appropriate.
829 	 */
830 #ifdef	DIAGNOSTIC
831 	if (rt->rt_expire == 0) {
832 		/* This should never happen. (Should it? -gwr) */
833 		printf("arpresolve: unresolved and rt_expire == 0\n");
834 		/* Set expiration time to now (expired). */
835 		rt->rt_expire = time_uptime;
836 	}
837 #endif
838 
839 retry:
840 	if (la == NULL) {
841 		IF_AFDATA_RLOCK(ifp);
842 		la = lla_lookup(LLTABLE(ifp), flags, dst);
843 		IF_AFDATA_RUNLOCK(ifp);
844 	}
845 
846 	if ((la == NULL) && ((flags & LLE_EXCLUSIVE) == 0)
847 #ifdef __FreeBSD__
848 	    && ((ifp->if_flags & (IFF_NOARP | IFF_STATICARP)) == 0)) {
849 #else
850 	    && ((ifp->if_flags & IFF_NOARP) == 0)) {
851 #endif
852 		flags |= LLE_EXCLUSIVE;
853 		IF_AFDATA_WLOCK(ifp);
854 		la = lla_create(LLTABLE(ifp), flags, dst);
855 		IF_AFDATA_WUNLOCK(ifp);
856 
857 		if (la == NULL) {
858 			log(LOG_DEBUG,
859 			    "%s: failed to create llentry for %s on %s\n",
860 			    __func__, inet_ntoa(satocsin(dst)->sin_addr),
861 			    ifp->if_xname);
862 		}
863 	}
864 
865 	if (la == NULL) {
866 		m_freem(m);
867 		return 0;
868 	}
869 
870 	if ((la->la_flags & LLE_VALID) &&
871 	    ((la->la_flags & LLE_STATIC) || la->la_expire > time_uptime)) {
872 		memcpy(desten, CLLADDR(sdl),
873 		    min(sdl->sdl_alen, ifp->if_addrlen));
874 		renew = 0;
875 		/*
876 		 * If entry has an expiry time and it is approaching,
877 		 * see if we need to send an ARP request within this
878 		 * arpt_down interval.
879 		 */
880 		if (!(la->la_flags & LLE_STATIC) &&
881 		    time_uptime + la->la_preempt > la->la_expire) {
882 			renew = 1;
883 			la->la_preempt--;
884 		}
885 
886 		if (flags & LLE_EXCLUSIVE)
887 			LLE_WUNLOCK(la);
888 		else
889 			LLE_RUNLOCK(la);
890 
891 		if (renew == 1) {
892 			const u_int8_t *enaddr =
893 #if NCARP > 0
894 			    (rt->rt_ifp->if_type == IFT_CARP) ?
895 			    CLLADDR(rt->rt_ifp->if_sadl):
896 #endif
897 			    CLLADDR(ifp->if_sadl);
898 			arprequest(ifp, &satocsin(rt->rt_ifa->ifa_addr)->sin_addr,
899 			    &satocsin(dst)->sin_addr, enaddr);
900 		}
901 
902 		return 1;
903 	}
904 
905 	if (la->la_flags & LLE_STATIC) {   /* should not happen! */
906 		log(LOG_DEBUG, "arpresolve: ouch, empty static llinfo for %s\n",
907 		    inet_ntoa(satocsin(dst)->sin_addr));
908 		m_freem(m);
909 		error = EINVAL;
910 		goto done;
911 	}
912 
913 	renew = (la->la_asked == 0 || la->la_expire != time_uptime);
914 	if (renew && (flags & LLE_EXCLUSIVE) == 0) {
915 		flags |= LLE_EXCLUSIVE;
916 		LLE_RUNLOCK(la);
917 		la = NULL;
918 		goto retry;
919 	}
920 
921 	/*
922 	 * There is an arptab entry, but no ethernet address
923 	 * response yet.  Add the mbuf to the list, dropping
924 	 * the oldest packet if we have exceeded the system
925 	 * setting.
926 	 */
927 	LLE_WLOCK_ASSERT(la);
928 	if (la->la_numheld >= arp_maxhold) {
929 		if (la->la_hold != NULL) {
930 			struct mbuf *next = la->la_hold->m_nextpkt;
931 			m_freem(la->la_hold);
932 			la->la_hold = next;
933 			la->la_numheld--;
934 			ARP_STATINC(ARP_STAT_DFRDROPPED);
935 		}
936 	}
937 	if (la->la_hold != NULL) {
938 		struct mbuf *curr = la->la_hold;
939 		while (curr->m_nextpkt != NULL)
940 			curr = curr->m_nextpkt;
941 		curr->m_nextpkt = m;
942 	} else
943 		la->la_hold = m;
944 	la->la_numheld++;
945 	if (renew == 0 && (flags & LLE_EXCLUSIVE)) {
946 		flags &= ~LLE_EXCLUSIVE;
947 		LLE_DOWNGRADE(la);
948 	}
949 
950 	/*
951 	 * Return EWOULDBLOCK if we have tried less than arp_maxtries. It
952 	 * will be masked by ether_output(). Return EHOSTDOWN/EHOSTUNREACH
953 	 * if we have already sent arp_maxtries ARP requests. Retransmit the
954 	 * ARP request, but not faster than one request per second.
955 	 */
956 	if (la->la_asked < arp_maxtries)
957 		error = EWOULDBLOCK;	/* First request. */
958 	else
959 		error = (rt->rt_flags & RTF_GATEWAY) ?
960 		    EHOSTUNREACH : EHOSTDOWN;
961 
962 	if (renew) {
963 		const u_int8_t *enaddr =
964 #if NCARP > 0
965 		    (rt->rt_ifp->if_type == IFT_CARP) ?
966 		    CLLADDR(rt->rt_ifp->if_sadl):
967 #endif
968 		    CLLADDR(ifp->if_sadl);
969 		LLE_ADDREF(la);
970 		la->la_expire = time_uptime;
971 		callout_reset(&la->la_timer, hz * arpt_down,
972 		    arptimer, la);
973 		la->la_asked++;
974 		if (flags & LLE_EXCLUSIVE)
975 			LLE_WUNLOCK(la);
976 		else
977 			LLE_RUNLOCK(la);
978 		arprequest(ifp, &satocsin(rt->rt_ifa->ifa_addr)->sin_addr,
979 		    &satocsin(dst)->sin_addr, enaddr);
980 		return error == 0;
981 	}
982 done:
983 	if (flags & LLE_EXCLUSIVE)
984 		LLE_WUNLOCK(la);
985 	else
986 		LLE_RUNLOCK(la);
987 	return error == 0;
988 }
989 
990 /*
991  * Common length and type checks are done here,
992  * then the protocol-specific routine is called.
993  */
994 void
995 arpintr(void)
996 {
997 	struct mbuf *m;
998 	struct arphdr *ar;
999 	int s;
1000 	int arplen;
1001 
1002 	mutex_enter(softnet_lock);
1003 	KERNEL_LOCK(1, NULL);
1004 	while (arpintrq.ifq_head) {
1005 		s = splnet();
1006 		IF_DEQUEUE(&arpintrq, m);
1007 		splx(s);
1008 		if (m == NULL || (m->m_flags & M_PKTHDR) == 0)
1009 			panic("arpintr");
1010 
1011 		MCLAIM(m, &arpdomain.dom_mowner);
1012 		ARP_STATINC(ARP_STAT_RCVTOTAL);
1013 
1014 		/*
1015 		 * First, make sure we have at least struct arphdr.
1016 		 */
1017 		if (m->m_len < sizeof(struct arphdr) ||
1018 		    (ar = mtod(m, struct arphdr *)) == NULL)
1019 			goto badlen;
1020 
1021 		switch (m->m_pkthdr.rcvif->if_type) {
1022 		case IFT_IEEE1394:
1023 			arplen = sizeof(struct arphdr) +
1024 			    ar->ar_hln + 2 * ar->ar_pln;
1025 			break;
1026 		default:
1027 			arplen = sizeof(struct arphdr) +
1028 			    2 * ar->ar_hln + 2 * ar->ar_pln;
1029 			break;
1030 		}
1031 
1032 		if (/* XXX ntohs(ar->ar_hrd) == ARPHRD_ETHER && */
1033 		    m->m_len >= arplen)
1034 			switch (ntohs(ar->ar_pro)) {
1035 			case ETHERTYPE_IP:
1036 			case ETHERTYPE_IPTRAILERS:
1037 				in_arpinput(m);
1038 				continue;
1039 			default:
1040 				ARP_STATINC(ARP_STAT_RCVBADPROTO);
1041 			}
1042 		else {
1043 badlen:
1044 			ARP_STATINC(ARP_STAT_RCVBADLEN);
1045 		}
1046 		m_freem(m);
1047 	}
1048 	KERNEL_UNLOCK_ONE(NULL);
1049 	mutex_exit(softnet_lock);
1050 }
1051 
1052 /*
1053  * ARP for Internet protocols on 10 Mb/s Ethernet.
1054  * Algorithm is that given in RFC 826.
1055  * In addition, a sanity check is performed on the sender
1056  * protocol address, to catch impersonators.
1057  * We no longer handle negotiations for use of trailer protocol:
1058  * Formerly, ARP replied for protocol type ETHERTYPE_TRAIL sent
1059  * along with IP replies if we wanted trailers sent to us,
1060  * and also sent them in response to IP replies.
1061  * This allowed either end to announce the desire to receive
1062  * trailer packets.
1063  * We no longer reply to requests for ETHERTYPE_TRAIL protocol either,
1064  * but formerly didn't normally send requests.
1065  */
1066 static void
1067 in_arpinput(struct mbuf *m)
1068 {
1069 	struct arphdr *ah;
1070 	struct ifnet *ifp = m->m_pkthdr.rcvif;
1071 	struct llentry *la = NULL;
1072 	struct rtentry  *rt = NULL;
1073 	struct in_ifaddr *ia;
1074 #if NBRIDGE > 0
1075 	struct in_ifaddr *bridge_ia = NULL;
1076 #endif
1077 #if NCARP > 0
1078 	u_int32_t count = 0, index = 0;
1079 #endif
1080 	struct sockaddr_dl *sdl = NULL;
1081 	struct sockaddr sa;
1082 	struct in_addr isaddr, itaddr, myaddr;
1083 	int op;
1084 	void *tha;
1085 	uint64_t *arps;
1086 
1087 	if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
1088 		goto out;
1089 	ah = mtod(m, struct arphdr *);
1090 	op = ntohs(ah->ar_op);
1091 
1092 	/*
1093 	 * Fix up ah->ar_hrd if necessary, before using ar_tha() or
1094 	 * ar_tpa().
1095 	 */
1096 	switch (ifp->if_type) {
1097 	case IFT_IEEE1394:
1098 		if (ntohs(ah->ar_hrd) == ARPHRD_IEEE1394)
1099 			;
1100 		else {
1101 			/* XXX this is to make sure we compute ar_tha right */
1102 			/* XXX check ar_hrd more strictly? */
1103 			ah->ar_hrd = htons(ARPHRD_IEEE1394);
1104 		}
1105 		break;
1106 	default:
1107 		/* XXX check ar_hrd? */
1108 		break;
1109 	}
1110 
1111 	memcpy(&isaddr, ar_spa(ah), sizeof (isaddr));
1112 	memcpy(&itaddr, ar_tpa(ah), sizeof (itaddr));
1113 
1114 	if (m->m_flags & (M_BCAST|M_MCAST))
1115 		ARP_STATINC(ARP_STAT_RCVMCAST);
1116 
1117 
1118 	/*
1119 	 * Search for a matching interface address
1120 	 * or any address on the interface to use
1121 	 * as a dummy address in the rest of this function
1122 	 */
1123 
1124 	INADDR_TO_IA(itaddr, ia);
1125 	while (ia != NULL) {
1126 #if NCARP > 0
1127 		if (ia->ia_ifp->if_type == IFT_CARP &&
1128 		    ((ia->ia_ifp->if_flags & (IFF_UP|IFF_RUNNING)) ==
1129 		    (IFF_UP|IFF_RUNNING))) {
1130 			index++;
1131 			if (ia->ia_ifp == m->m_pkthdr.rcvif &&
1132 			    carp_iamatch(ia, ar_sha(ah),
1133 			    &count, index)) {
1134 				break;
1135 				}
1136 		} else
1137 #endif
1138 			    if (ia->ia_ifp == m->m_pkthdr.rcvif)
1139 				break;
1140 #if NBRIDGE > 0
1141 		/*
1142 		 * If the interface we received the packet on
1143 		 * is part of a bridge, check to see if we need
1144 		 * to "bridge" the packet to ourselves at this
1145 		 * layer.  Note we still prefer a perfect match,
1146 		 * but allow this weaker match if necessary.
1147 		 */
1148 		if (m->m_pkthdr.rcvif->if_bridge != NULL &&
1149 		    m->m_pkthdr.rcvif->if_bridge == ia->ia_ifp->if_bridge)
1150 			bridge_ia = ia;
1151 #endif /* NBRIDGE > 0 */
1152 
1153 		NEXT_IA_WITH_SAME_ADDR(ia);
1154 	}
1155 
1156 #if NBRIDGE > 0
1157 	if (ia == NULL && bridge_ia != NULL) {
1158 		ia = bridge_ia;
1159 		ifp = bridge_ia->ia_ifp;
1160 	}
1161 #endif
1162 
1163 	if (ia == NULL) {
1164 		INADDR_TO_IA(isaddr, ia);
1165 		while ((ia != NULL) && ia->ia_ifp != m->m_pkthdr.rcvif)
1166 			NEXT_IA_WITH_SAME_ADDR(ia);
1167 
1168 		if (ia == NULL) {
1169 			IFP_TO_IA(ifp, ia);
1170 			if (ia == NULL) {
1171 				ARP_STATINC(ARP_STAT_RCVNOINT);
1172 				goto out;
1173 			}
1174 		}
1175 	}
1176 
1177 	myaddr = ia->ia_addr.sin_addr;
1178 
1179 	/* XXX checks for bridge case? */
1180 	if (!memcmp(ar_sha(ah), CLLADDR(ifp->if_sadl), ifp->if_addrlen)) {
1181 		ARP_STATINC(ARP_STAT_RCVLOCALSHA);
1182 		goto out;	/* it's from me, ignore it. */
1183 	}
1184 
1185 	/* XXX checks for bridge case? */
1186 	if (!memcmp(ar_sha(ah), ifp->if_broadcastaddr, ifp->if_addrlen)) {
1187 		ARP_STATINC(ARP_STAT_RCVBCASTSHA);
1188 		log(LOG_ERR,
1189 		    "%s: arp: link address is broadcast for IP address %s!\n",
1190 		    ifp->if_xname, in_fmtaddr(isaddr));
1191 		goto out;
1192 	}
1193 
1194 	/*
1195 	 * If the source IP address is zero, this is an RFC 5227 ARP probe
1196 	 */
1197 	if (in_nullhost(isaddr))
1198 		ARP_STATINC(ARP_STAT_RCVZEROSPA);
1199 	else if (in_hosteq(isaddr, myaddr))
1200 		ARP_STATINC(ARP_STAT_RCVLOCALSPA);
1201 
1202 	if (in_nullhost(itaddr))
1203 		ARP_STATINC(ARP_STAT_RCVZEROTPA);
1204 
1205 	/* DAD check, RFC 5227 2.1.1, Probe Details */
1206 	if (in_hosteq(isaddr, myaddr) ||
1207 	    (in_nullhost(isaddr) && in_hosteq(itaddr, myaddr)))
1208 	{
1209 		/* If our address is tentative, mark it as duplicated */
1210 		if (ia->ia4_flags & IN_IFF_TENTATIVE)
1211 			arp_dad_duplicated((struct ifaddr *)ia);
1212 		/* If our address is unuseable, don't reply */
1213 		if (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
1214 			goto out;
1215 	}
1216 
1217 	/*
1218 	 * If the target IP address is zero, ignore the packet.
1219 	 * This prevents the code below from tring to answer
1220 	 * when we are using IP address zero (booting).
1221 	 */
1222 	if (in_nullhost(itaddr))
1223 		goto out;
1224 
1225 	if (in_nullhost(isaddr))
1226 		goto reply;
1227 
1228 	if (in_hosteq(isaddr, myaddr)) {
1229 		log(LOG_ERR,
1230 		   "duplicate IP address %s sent from link address %s\n",
1231 		   in_fmtaddr(isaddr), lla_snprintf(ar_sha(ah), ah->ar_hln));
1232 		itaddr = myaddr;
1233 		goto reply;
1234 	}
1235 
1236 	la = arplookup(ifp, m, &isaddr, in_hosteq(itaddr, myaddr), 0, 1, NULL);
1237 	if (la != NULL) {
1238 		rt = la->la_rt;
1239 		if (rt != NULL)
1240 			sdl = satosdl(rt->rt_gateway);
1241 	}
1242 	if (sdl != NULL) {
1243 		if (sdl->sdl_alen &&
1244 		    memcmp(ar_sha(ah), CLLADDR(sdl), sdl->sdl_alen)) {
1245 			if (rt->rt_flags & RTF_STATIC) {
1246 				ARP_STATINC(ARP_STAT_RCVOVERPERM);
1247 				if (!log_permanent_modify)
1248 					goto out;
1249 				log(LOG_INFO,
1250 				    "%s tried to overwrite permanent arp info"
1251 				    " for %s\n",
1252 				    lla_snprintf(ar_sha(ah), ah->ar_hln),
1253 				    in_fmtaddr(isaddr));
1254 				goto out;
1255 			} else if (rt->rt_ifp != ifp) {
1256 				ARP_STATINC(ARP_STAT_RCVOVERINT);
1257 				if (!log_wrong_iface)
1258 					goto out;
1259 				log(LOG_INFO,
1260 				    "%s on %s tried to overwrite "
1261 				    "arp info for %s on %s\n",
1262 				    lla_snprintf(ar_sha(ah), ah->ar_hln),
1263 				    ifp->if_xname, in_fmtaddr(isaddr),
1264 				    rt->rt_ifp->if_xname);
1265 				    goto out;
1266 			} else {
1267 				ARP_STATINC(ARP_STAT_RCVOVER);
1268 				if (log_movements)
1269 					log(LOG_INFO, "arp info overwritten "
1270 					    "for %s by %s\n",
1271 					    in_fmtaddr(isaddr),
1272 					    lla_snprintf(ar_sha(ah),
1273 					    ah->ar_hln));
1274 			}
1275 		}
1276 		/*
1277 		 * sanity check for the address length.
1278 		 * XXX this does not work for protocols with variable address
1279 		 * length. -is
1280 		 */
1281 		if (sdl->sdl_alen &&
1282 		    sdl->sdl_alen != ah->ar_hln) {
1283 			ARP_STATINC(ARP_STAT_RCVLENCHG);
1284 			log(LOG_WARNING,
1285 			    "arp from %s: new addr len %d, was %d\n",
1286 			    in_fmtaddr(isaddr), ah->ar_hln, sdl->sdl_alen);
1287 		}
1288 		if (ifp->if_addrlen != ah->ar_hln) {
1289 			ARP_STATINC(ARP_STAT_RCVBADLEN);
1290 			log(LOG_WARNING,
1291 			    "arp from %s: addr len: new %d, i/f %d (ignored)\n",
1292 			    in_fmtaddr(isaddr), ah->ar_hln,
1293 			    ifp->if_addrlen);
1294 			goto reply;
1295 		}
1296 #if NTOKEN > 0
1297 		/*
1298 		 * XXX uses m_data and assumes the complete answer including
1299 		 * XXX token-ring headers is in the same buf
1300 		 */
1301 		if (ifp->if_type == IFT_ISO88025) {
1302 			struct token_header *trh;
1303 
1304 			trh = (struct token_header *)M_TRHSTART(m);
1305 			if (trh->token_shost[0] & TOKEN_RI_PRESENT) {
1306 				struct token_rif	*rif;
1307 				size_t	riflen;
1308 
1309 				rif = TOKEN_RIF(trh);
1310 				riflen = (ntohs(rif->tr_rcf) &
1311 				    TOKEN_RCF_LEN_MASK) >> 8;
1312 
1313 				if (riflen > 2 &&
1314 				    riflen < sizeof(struct token_rif) &&
1315 				    (riflen & 1) == 0) {
1316 					rif->tr_rcf ^= htons(TOKEN_RCF_DIRECTION);
1317 					rif->tr_rcf &= htons(~TOKEN_RCF_BROADCAST_MASK);
1318 					memcpy(TOKEN_RIF(la), rif, riflen);
1319 				}
1320 			}
1321 		}
1322 #endif /* NTOKEN > 0 */
1323 		(void)sockaddr_dl_setaddr(sdl, sdl->sdl_len, ar_sha(ah),
1324 		    ah->ar_hln);
1325 		if (rt->rt_expire) {
1326 			rt->rt_expire = time_uptime + arpt_keep;
1327 
1328 			KASSERT((la->la_flags & LLE_STATIC) == 0);
1329 			LLE_ADDREF(la);
1330 			callout_reset(&la->la_timer, hz * arpt_keep, arptimer, la);
1331 		}
1332 		rt->rt_flags &= ~RTF_REJECT;
1333 		la->la_asked = 0;
1334 
1335 		if (la->la_hold != NULL) {
1336 			int n = la->la_numheld;
1337 			struct mbuf *m_hold, *m_hold_next;
1338 
1339 			m_hold = la->la_hold;
1340 			la->la_hold = NULL;
1341 			la->la_numheld = 0;
1342 			/*
1343 			 * We have to unlock here because if_output would call
1344 			 * arpresolve
1345 			 */
1346 			LLE_WUNLOCK(la);
1347 			ARP_STATADD(ARP_STAT_DFRSENT, n);
1348 			for (; m_hold != NULL; m_hold = m_hold_next) {
1349 				m_hold_next = m_hold->m_nextpkt;
1350 				m_hold->m_nextpkt = NULL;
1351 				(*ifp->if_output)(ifp, m_hold, rt_getkey(rt), rt);
1352 			}
1353 		} else
1354 			LLE_WUNLOCK(la);
1355 		la = NULL;
1356 	}
1357 reply:
1358 	if (la != NULL) {
1359 		LLE_WUNLOCK(la);
1360 		la = NULL;
1361 	}
1362 	if (op != ARPOP_REQUEST) {
1363 		if (op == ARPOP_REPLY)
1364 			ARP_STATINC(ARP_STAT_RCVREPLY);
1365 		goto out;
1366 	}
1367 	ARP_STATINC(ARP_STAT_RCVREQUEST);
1368 	if (in_hosteq(itaddr, myaddr)) {
1369 		/* If our address is unuseable, don't reply */
1370 		if (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
1371 			goto out;
1372 		/* I am the target */
1373 		tha = ar_tha(ah);
1374 		if (tha)
1375 			memcpy(tha, ar_sha(ah), ah->ar_hln);
1376 		memcpy(ar_sha(ah), CLLADDR(ifp->if_sadl), ah->ar_hln);
1377 	} else {
1378 		la = arplookup(ifp, m, &itaddr, 0, SIN_PROXY, 0, NULL);
1379 		if (la == NULL)
1380 			goto out;
1381 		rt = la->la_rt;
1382 		LLE_RUNLOCK(la);
1383 		la = NULL;
1384 		if (rt->rt_ifp->if_type == IFT_CARP &&
1385 		    m->m_pkthdr.rcvif->if_type != IFT_CARP)
1386 			goto out;
1387 		tha = ar_tha(ah);
1388 		if (tha)
1389 			memcpy(tha, ar_sha(ah), ah->ar_hln);
1390 		sdl = satosdl(rt->rt_gateway);
1391 		memcpy(ar_sha(ah), CLLADDR(sdl), ah->ar_hln);
1392 	}
1393 
1394 	memcpy(ar_tpa(ah), ar_spa(ah), ah->ar_pln);
1395 	memcpy(ar_spa(ah), &itaddr, ah->ar_pln);
1396 	ah->ar_op = htons(ARPOP_REPLY);
1397 	ah->ar_pro = htons(ETHERTYPE_IP); /* let's be sure! */
1398 	switch (ifp->if_type) {
1399 	case IFT_IEEE1394:
1400 		/*
1401 		 * ieee1394 arp reply is broadcast
1402 		 */
1403 		m->m_flags &= ~M_MCAST;
1404 		m->m_flags |= M_BCAST;
1405 		m->m_len = sizeof(*ah) + (2 * ah->ar_pln) + ah->ar_hln;
1406 		break;
1407 
1408 	default:
1409 		m->m_flags &= ~(M_BCAST|M_MCAST); /* never reply by broadcast */
1410 		m->m_len = sizeof(*ah) + (2 * ah->ar_pln) + (2 * ah->ar_hln);
1411 		break;
1412 	}
1413 	m->m_pkthdr.len = m->m_len;
1414 	sa.sa_family = AF_ARP;
1415 	sa.sa_len = 2;
1416 	arps = ARP_STAT_GETREF();
1417 	arps[ARP_STAT_SNDTOTAL]++;
1418 	arps[ARP_STAT_SNDREPLY]++;
1419 	ARP_STAT_PUTREF();
1420 	(*ifp->if_output)(ifp, m, &sa, NULL);
1421 	return;
1422 
1423 out:
1424 	if (la != NULL)
1425 		LLE_WUNLOCK(la);
1426 	m_freem(m);
1427 }
1428 
1429 /*
1430  * Free an arp entry.
1431  */
1432 static void arptfree(struct rtentry *rt)
1433 {
1434 
1435 	rtrequest(RTM_DELETE, rt_getkey(rt), NULL, rt_mask(rt), 0, NULL);
1436 	rtfree(rt);
1437 }
1438 
1439 /*
1440  * Lookup or enter a new address in arptab.
1441  */
1442 static struct llentry *
1443 arplookup(struct ifnet *ifp, struct mbuf *m, const struct in_addr *addr,
1444     int create, int proxy, int wlock, struct rtentry *rt0)
1445 {
1446 	struct arphdr *ah;
1447 	struct rtentry *rt;
1448 	struct sockaddr_inarp sin;
1449 	const char *why = NULL;
1450 
1451 	ah = mtod(m, struct arphdr *);
1452 	if (rt0 == NULL) {
1453 		memset(&sin, 0, sizeof(sin));
1454 		sin.sin_len = sizeof(sin);
1455 		sin.sin_family = AF_INET;
1456 		sin.sin_addr = *addr;
1457 		sin.sin_other = proxy ? SIN_PROXY : 0;
1458 		rt = rtalloc1(sintosa(&sin), create);
1459 		if (rt == NULL)
1460 			return NULL;
1461 		rt->rt_refcnt--;
1462 	} else
1463 		rt = rt0;
1464 
1465 #define	IS_LLINFO(__rt)							  \
1466 	(((__rt)->rt_flags & (RTF_GATEWAY | RTF_LLINFO)) == RTF_LLINFO && \
1467 	 (__rt)->rt_gateway->sa_family == AF_LINK)
1468 
1469 
1470 	if (IS_LLINFO(rt)) {
1471 		struct llentry *la;
1472 		int flags = wlock ? LLE_EXCLUSIVE : 0;
1473 
1474 		if (create) {
1475 			IF_AFDATA_WLOCK(ifp);
1476 			la = lla_create(LLTABLE(ifp), flags, rt_getkey(rt));
1477 			IF_AFDATA_WUNLOCK(ifp);
1478 		} else {
1479 			IF_AFDATA_RLOCK(ifp);
1480 			la = lla_lookup(LLTABLE(ifp), flags, rt_getkey(rt));
1481 			IF_AFDATA_RUNLOCK(ifp);
1482 		}
1483 
1484 		return la;
1485 	}
1486 
1487 	if (create) {
1488 		if (rt->rt_flags & RTF_GATEWAY) {
1489 			if (log_unknown_network)
1490 				why = "host is not on local network";
1491 		} else if ((rt->rt_flags & RTF_LLINFO) == 0) {
1492 			ARP_STATINC(ARP_STAT_ALLOCFAIL);
1493 			why = "could not allocate llinfo";
1494 		} else
1495 			why = "gateway route is not ours";
1496 		if (why) {
1497 			log(LOG_DEBUG, "arplookup: unable to enter address"
1498 			    " for %s@%s on %s (%s)\n", in_fmtaddr(*addr),
1499 			    lla_snprintf(ar_sha(ah), ah->ar_hln),
1500 			    (ifp) ? ifp->if_xname : "null", why);
1501 		}
1502 		if ((rt->rt_flags & RTF_CLONED) != 0) {
1503 			rtrequest(RTM_DELETE, rt_getkey(rt),
1504 		    	    rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
1505 		}
1506 	}
1507 	return NULL;
1508 }
1509 
1510 int
1511 arpioctl(u_long cmd, void *data)
1512 {
1513 
1514 	return EOPNOTSUPP;
1515 }
1516 
1517 void
1518 arp_ifinit(struct ifnet *ifp, struct ifaddr *ifa)
1519 {
1520 	struct in_addr *ip;
1521 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1522 
1523 	/*
1524 	 * Warn the user if another station has this IP address,
1525 	 * but only if the interface IP address is not zero.
1526 	 */
1527 	ip = &IA_SIN(ifa)->sin_addr;
1528 	if (!in_nullhost(*ip) &&
1529 	    (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED)) == 0)
1530 		arprequest(ifp, ip, ip, CLLADDR(ifp->if_sadl));
1531 
1532 	ifa->ifa_rtrequest = arp_rtrequest;
1533 	ifa->ifa_flags |= RTF_CLONING;
1534 
1535 	/* ARP will handle DAD for this address. */
1536 	if (ia->ia4_flags & IN_IFF_TRYTENTATIVE) {
1537 		ia->ia4_flags |= IN_IFF_TENTATIVE;
1538 		ia->ia_dad_start = arp_dad_start;
1539 		ia->ia_dad_stop = arp_dad_stop;
1540 	}
1541 }
1542 
1543 TAILQ_HEAD(dadq_head, dadq);
1544 struct dadq {
1545 	TAILQ_ENTRY(dadq) dad_list;
1546 	struct ifaddr *dad_ifa;
1547 	int dad_count;		/* max ARP to send */
1548 	int dad_arp_tcount;	/* # of trials to send ARP */
1549 	int dad_arp_ocount;	/* ARP sent so far */
1550 	int dad_arp_announce;	/* max ARP announcements */
1551 	int dad_arp_acount;	/* # of announcements */
1552 	struct callout dad_timer_ch;
1553 };
1554 MALLOC_JUSTDEFINE(M_IPARP, "ARP DAD", "ARP DAD Structure");
1555 
1556 static struct dadq_head dadq;
1557 static int dad_init = 0;
1558 static int dad_maxtry = 15;     /* max # of *tries* to transmit DAD packet */
1559 
1560 static struct dadq *
1561 arp_dad_find(struct ifaddr *ifa)
1562 {
1563 	struct dadq *dp;
1564 
1565 	TAILQ_FOREACH(dp, &dadq, dad_list) {
1566 		if (dp->dad_ifa == ifa)
1567 			return dp;
1568 	}
1569 	return NULL;
1570 }
1571 
1572 static void
1573 arp_dad_starttimer(struct dadq *dp, int ticks)
1574 {
1575 
1576 	callout_reset(&dp->dad_timer_ch, ticks,
1577 	    (void (*)(void *))arp_dad_timer, (void *)dp->dad_ifa);
1578 }
1579 
1580 static void
1581 arp_dad_stoptimer(struct dadq *dp)
1582 {
1583 
1584 	callout_stop(&dp->dad_timer_ch);
1585 }
1586 
1587 static void
1588 arp_dad_output(struct dadq *dp, struct ifaddr *ifa)
1589 {
1590 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1591 	struct ifnet *ifp = ifa->ifa_ifp;
1592 	struct in_addr sip;
1593 
1594 	dp->dad_arp_tcount++;
1595 	if ((ifp->if_flags & IFF_UP) == 0)
1596 		return;
1597 	if ((ifp->if_flags & IFF_RUNNING) == 0)
1598 		return;
1599 
1600 	dp->dad_arp_tcount = 0;
1601 	dp->dad_arp_ocount++;
1602 
1603 	memset(&sip, 0, sizeof(sip));
1604 	arprequest(ifa->ifa_ifp, &sip, &ia->ia_addr.sin_addr,
1605 	    CLLADDR(ifa->ifa_ifp->if_sadl));
1606 }
1607 
1608 /*
1609  * Start Duplicate Address Detection (DAD) for specified interface address.
1610  */
1611 static void
1612 arp_dad_start(struct ifaddr *ifa)
1613 {
1614 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1615 	struct dadq *dp;
1616 
1617 	if (!dad_init) {
1618 		TAILQ_INIT(&dadq);
1619 		dad_init++;
1620 	}
1621 
1622 	/*
1623 	 * If we don't need DAD, don't do it.
1624 	 * - DAD is disabled (ip_dad_count == 0)
1625 	 */
1626 	if (!(ia->ia4_flags & IN_IFF_TENTATIVE)) {
1627 		log(LOG_DEBUG,
1628 			"arp_dad_start: called with non-tentative address "
1629 			"%s(%s)\n",
1630 			in_fmtaddr(ia->ia_addr.sin_addr),
1631 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1632 		return;
1633 	}
1634 	if (!ip_dad_count) {
1635 		struct in_addr *ip = &IA_SIN(ifa)->sin_addr;
1636 
1637 		ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1638 		rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1639 		arprequest(ifa->ifa_ifp, ip, ip,
1640 		    CLLADDR(ifa->ifa_ifp->if_sadl));
1641 		return;
1642 	}
1643 	if (ifa->ifa_ifp == NULL)
1644 		panic("arp_dad_start: ifa->ifa_ifp == NULL");
1645 	if (!(ifa->ifa_ifp->if_flags & IFF_UP))
1646 		return;
1647 	if (arp_dad_find(ifa) != NULL) {
1648 		/* DAD already in progress */
1649 		return;
1650 	}
1651 
1652 	dp = malloc(sizeof(*dp), M_IPARP, M_NOWAIT);
1653 	if (dp == NULL) {
1654 		log(LOG_ERR, "arp_dad_start: memory allocation failed for "
1655 			"%s(%s)\n",
1656 			in_fmtaddr(ia->ia_addr.sin_addr),
1657 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1658 		return;
1659 	}
1660 	memset(dp, 0, sizeof(*dp));
1661 	callout_init(&dp->dad_timer_ch, CALLOUT_MPSAFE);
1662 	TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list);
1663 
1664 	arplog((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
1665 	    in_fmtaddr(ia->ia_addr.sin_addr)));
1666 
1667 	/*
1668 	 * Send ARP packet for DAD, ip_dad_count times.
1669 	 * Note that we must delay the first transmission.
1670 	 */
1671 	dp->dad_ifa = ifa;
1672 	ifaref(ifa);	/* just for safety */
1673 	dp->dad_count = ip_dad_count;
1674 	dp->dad_arp_announce = 0; /* Will be set when starting to announce */
1675 	dp->dad_arp_acount = dp->dad_arp_ocount = dp->dad_arp_tcount = 0;
1676 
1677 	arp_dad_starttimer(dp, cprng_fast32() % (PROBE_WAIT * hz));
1678 }
1679 
1680 /*
1681  * terminate DAD unconditionally.  used for address removals.
1682  */
1683 static void
1684 arp_dad_stop(struct ifaddr *ifa)
1685 {
1686 	struct dadq *dp;
1687 
1688 	if (!dad_init)
1689 		return;
1690 	dp = arp_dad_find(ifa);
1691 	if (dp == NULL) {
1692 		/* DAD wasn't started yet */
1693 		return;
1694 	}
1695 
1696 	arp_dad_stoptimer(dp);
1697 
1698 	TAILQ_REMOVE(&dadq, dp, dad_list);
1699 	free(dp, M_IPARP);
1700 	dp = NULL;
1701 	ifafree(ifa);
1702 }
1703 
1704 static void
1705 arp_dad_timer(struct ifaddr *ifa)
1706 {
1707 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1708 	struct dadq *dp;
1709 	struct in_addr *ip;
1710 
1711 	mutex_enter(softnet_lock);
1712 	KERNEL_LOCK(1, NULL);
1713 
1714 	/* Sanity check */
1715 	if (ia == NULL) {
1716 		log(LOG_ERR, "arp_dad_timer: called with null parameter\n");
1717 		goto done;
1718 	}
1719 	dp = arp_dad_find(ifa);
1720 	if (dp == NULL) {
1721 		log(LOG_ERR, "arp_dad_timer: DAD structure not found\n");
1722 		goto done;
1723 	}
1724 	if (ia->ia4_flags & IN_IFF_DUPLICATED) {
1725 		log(LOG_ERR, "nd4_dad_timer: called with duplicate address "
1726 			"%s(%s)\n",
1727 			in_fmtaddr(ia->ia_addr.sin_addr),
1728 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1729 		goto done;
1730 	}
1731 	if ((ia->ia4_flags & IN_IFF_TENTATIVE) == 0 && dp->dad_arp_acount == 0){
1732 		log(LOG_ERR, "arp_dad_timer: called with non-tentative address "
1733 			"%s(%s)\n",
1734 			in_fmtaddr(ia->ia_addr.sin_addr),
1735 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1736 		goto done;
1737 	}
1738 
1739 	/* timeouted with IFF_{RUNNING,UP} check */
1740 	if (dp->dad_arp_tcount > dad_maxtry) {
1741 		arplog((LOG_INFO, "%s: could not run DAD, driver problem?\n",
1742 			if_name(ifa->ifa_ifp)));
1743 
1744 		TAILQ_REMOVE(&dadq, dp, dad_list);
1745 		free(dp, M_IPARP);
1746 		dp = NULL;
1747 		ifafree(ifa);
1748 		goto done;
1749 	}
1750 
1751 	/* Need more checks? */
1752 	if (dp->dad_arp_ocount < dp->dad_count) {
1753 		int adelay;
1754 
1755 		/*
1756 		 * We have more ARP to go.  Send ARP packet for DAD.
1757 		 */
1758 		arp_dad_output(dp, ifa);
1759 		if (dp->dad_arp_ocount < dp->dad_count)
1760 			adelay = (PROBE_MIN * hz) +
1761 			    (cprng_fast32() %
1762 			    ((PROBE_MAX * hz) - (PROBE_MIN * hz)));
1763 		else
1764 			adelay = ANNOUNCE_WAIT * hz;
1765 		arp_dad_starttimer(dp, adelay);
1766 		goto done;
1767 	} else if (dp->dad_arp_acount == 0) {
1768 		/*
1769 		 * We are done with DAD.
1770 		 * No duplicate address found.
1771 		 */
1772 		ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1773 		rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1774 		arplog((LOG_DEBUG,
1775 		    "%s: DAD complete for %s - no duplicates found\n",
1776 		    if_name(ifa->ifa_ifp),
1777 		    in_fmtaddr(ia->ia_addr.sin_addr)));
1778 		dp->dad_arp_announce = ANNOUNCE_NUM;
1779 		goto announce;
1780 	} else if (dp->dad_arp_acount < dp->dad_arp_announce) {
1781 announce:
1782 		/*
1783 		 * Announce the address.
1784 		 */
1785 		ip = &IA_SIN(ifa)->sin_addr;
1786 		arprequest(ifa->ifa_ifp, ip, ip,
1787 		    CLLADDR(ifa->ifa_ifp->if_sadl));
1788 		dp->dad_arp_acount++;
1789 		if (dp->dad_arp_acount < dp->dad_arp_announce) {
1790 			arp_dad_starttimer(dp, ANNOUNCE_INTERVAL * hz);
1791 			goto done;
1792 		}
1793 		arplog((LOG_DEBUG,
1794 		    "%s: ARP announcement complete for %s\n",
1795 		    if_name(ifa->ifa_ifp),
1796 		    in_fmtaddr(ia->ia_addr.sin_addr)));
1797 	}
1798 
1799 	TAILQ_REMOVE(&dadq, dp, dad_list);
1800 	free(dp, M_IPARP);
1801 	dp = NULL;
1802 	ifafree(ifa);
1803 
1804 done:
1805 	KERNEL_UNLOCK_ONE(NULL);
1806 	mutex_exit(softnet_lock);
1807 }
1808 
1809 static void
1810 arp_dad_duplicated(struct ifaddr *ifa)
1811 {
1812 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1813 	struct ifnet *ifp;
1814 	struct dadq *dp;
1815 
1816 	dp = arp_dad_find(ifa);
1817 	if (dp == NULL) {
1818 		log(LOG_ERR, "arp_dad_duplicated: DAD structure not found\n");
1819 		return;
1820 	}
1821 
1822 	ifp = ifa->ifa_ifp;
1823 	log(LOG_ERR, "%s: DAD detected duplicate IPv4 address %s: "
1824 	    "ARP out=%d\n",
1825 	    if_name(ifp), in_fmtaddr(ia->ia_addr.sin_addr),
1826 	    dp->dad_arp_ocount);
1827 
1828 	ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1829 	ia->ia4_flags |= IN_IFF_DUPLICATED;
1830 
1831 	/* We are done with DAD, with duplicated address found. (failure) */
1832 	arp_dad_stoptimer(dp);
1833 
1834 	/* Inform the routing socket that DAD has completed */
1835 	rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1836 
1837 	TAILQ_REMOVE(&dadq, dp, dad_list);
1838 	free(dp, M_IPARP);
1839 	dp = NULL;
1840 	ifafree(ifa);
1841 }
1842 
1843 /*
1844  * Called from 10 Mb/s Ethernet interrupt handlers
1845  * when ether packet type ETHERTYPE_REVARP
1846  * is received.  Common length and type checks are done here,
1847  * then the protocol-specific routine is called.
1848  */
1849 void
1850 revarpinput(struct mbuf *m)
1851 {
1852 	struct arphdr *ar;
1853 
1854 	if (m->m_len < sizeof(struct arphdr))
1855 		goto out;
1856 	ar = mtod(m, struct arphdr *);
1857 #if 0 /* XXX I don't think we need this... and it will prevent other LL */
1858 	if (ntohs(ar->ar_hrd) != ARPHRD_ETHER)
1859 		goto out;
1860 #endif
1861 	if (m->m_len < sizeof(struct arphdr) + 2 * (ar->ar_hln + ar->ar_pln))
1862 		goto out;
1863 	switch (ntohs(ar->ar_pro)) {
1864 	case ETHERTYPE_IP:
1865 	case ETHERTYPE_IPTRAILERS:
1866 		in_revarpinput(m);
1867 		return;
1868 
1869 	default:
1870 		break;
1871 	}
1872 out:
1873 	m_freem(m);
1874 }
1875 
1876 /*
1877  * RARP for Internet protocols on 10 Mb/s Ethernet.
1878  * Algorithm is that given in RFC 903.
1879  * We are only using for bootstrap purposes to get an ip address for one of
1880  * our interfaces.  Thus we support no user-interface.
1881  *
1882  * Since the contents of the RARP reply are specific to the interface that
1883  * sent the request, this code must ensure that they are properly associated.
1884  *
1885  * Note: also supports ARP via RARP packets, per the RFC.
1886  */
1887 void
1888 in_revarpinput(struct mbuf *m)
1889 {
1890 	struct ifnet *ifp;
1891 	struct arphdr *ah;
1892 	void *tha;
1893 	int op;
1894 
1895 	ah = mtod(m, struct arphdr *);
1896 	op = ntohs(ah->ar_op);
1897 
1898 	switch (m->m_pkthdr.rcvif->if_type) {
1899 	case IFT_IEEE1394:
1900 		/* ARP without target hardware address is not supported */
1901 		goto out;
1902 	default:
1903 		break;
1904 	}
1905 
1906 	switch (op) {
1907 	case ARPOP_REQUEST:
1908 	case ARPOP_REPLY:	/* per RFC */
1909 		in_arpinput(m);
1910 		return;
1911 	case ARPOP_REVREPLY:
1912 		break;
1913 	case ARPOP_REVREQUEST:	/* handled by rarpd(8) */
1914 	default:
1915 		goto out;
1916 	}
1917 	if (!revarp_in_progress)
1918 		goto out;
1919 	ifp = m->m_pkthdr.rcvif;
1920 	if (ifp != myip_ifp) /* !same interface */
1921 		goto out;
1922 	if (myip_initialized)
1923 		goto wake;
1924 	tha = ar_tha(ah);
1925 	if (tha == NULL)
1926 		goto out;
1927 	if (memcmp(tha, CLLADDR(ifp->if_sadl), ifp->if_sadl->sdl_alen))
1928 		goto out;
1929 	memcpy(&srv_ip, ar_spa(ah), sizeof(srv_ip));
1930 	memcpy(&myip, ar_tpa(ah), sizeof(myip));
1931 	myip_initialized = 1;
1932 wake:	/* Do wakeup every time in case it was missed. */
1933 	wakeup((void *)&myip);
1934 
1935 out:
1936 	m_freem(m);
1937 }
1938 
1939 /*
1940  * Send a RARP request for the ip address of the specified interface.
1941  * The request should be RFC 903-compliant.
1942  */
1943 void
1944 revarprequest(struct ifnet *ifp)
1945 {
1946 	struct sockaddr sa;
1947 	struct mbuf *m;
1948 	struct arphdr *ah;
1949 	void *tha;
1950 
1951 	if ((m = m_gethdr(M_DONTWAIT, MT_DATA)) == NULL)
1952 		return;
1953 	MCLAIM(m, &arpdomain.dom_mowner);
1954 	m->m_len = sizeof(*ah) + 2*sizeof(struct in_addr) +
1955 	    2*ifp->if_addrlen;
1956 	m->m_pkthdr.len = m->m_len;
1957 	MH_ALIGN(m, m->m_len);
1958 	ah = mtod(m, struct arphdr *);
1959 	memset(ah, 0, m->m_len);
1960 	ah->ar_pro = htons(ETHERTYPE_IP);
1961 	ah->ar_hln = ifp->if_addrlen;		/* hardware address length */
1962 	ah->ar_pln = sizeof(struct in_addr);	/* protocol address length */
1963 	ah->ar_op = htons(ARPOP_REVREQUEST);
1964 
1965 	memcpy(ar_sha(ah), CLLADDR(ifp->if_sadl), ah->ar_hln);
1966 	tha = ar_tha(ah);
1967 	if (tha == NULL) {
1968 		m_free(m);
1969 		return;
1970 	}
1971 	memcpy(tha, CLLADDR(ifp->if_sadl), ah->ar_hln);
1972 
1973 	sa.sa_family = AF_ARP;
1974 	sa.sa_len = 2;
1975 	m->m_flags |= M_BCAST;
1976 
1977 	KERNEL_LOCK(1, NULL);
1978 	(*ifp->if_output)(ifp, m, &sa, NULL);
1979 	KERNEL_UNLOCK_ONE(NULL);
1980 }
1981 
1982 /*
1983  * RARP for the ip address of the specified interface, but also
1984  * save the ip address of the server that sent the answer.
1985  * Timeout if no response is received.
1986  */
1987 int
1988 revarpwhoarewe(struct ifnet *ifp, struct in_addr *serv_in,
1989     struct in_addr *clnt_in)
1990 {
1991 	int result, count = 20;
1992 
1993 	myip_initialized = 0;
1994 	myip_ifp = ifp;
1995 
1996 	revarp_in_progress = 1;
1997 	while (count--) {
1998 		revarprequest(ifp);
1999 		result = tsleep((void *)&myip, PSOCK, "revarp", hz/2);
2000 		if (result != EWOULDBLOCK)
2001 			break;
2002 	}
2003 	revarp_in_progress = 0;
2004 
2005 	if (!myip_initialized)
2006 		return ENETUNREACH;
2007 
2008 	memcpy(serv_in, &srv_ip, sizeof(*serv_in));
2009 	memcpy(clnt_in, &myip, sizeof(*clnt_in));
2010 	return 0;
2011 }
2012 
2013 
2014 
2015 #ifdef DDB
2016 
2017 #include <machine/db_machdep.h>
2018 #include <ddb/db_interface.h>
2019 #include <ddb/db_output.h>
2020 
2021 static void
2022 db_print_sa(const struct sockaddr *sa)
2023 {
2024 	int len;
2025 	const u_char *p;
2026 
2027 	if (sa == NULL) {
2028 		db_printf("[NULL]");
2029 		return;
2030 	}
2031 
2032 	p = (const u_char *)sa;
2033 	len = sa->sa_len;
2034 	db_printf("[");
2035 	while (len > 0) {
2036 		db_printf("%d", *p);
2037 		p++; len--;
2038 		if (len) db_printf(",");
2039 	}
2040 	db_printf("]\n");
2041 }
2042 
2043 static void
2044 db_print_ifa(struct ifaddr *ifa)
2045 {
2046 	if (ifa == NULL)
2047 		return;
2048 	db_printf("  ifa_addr=");
2049 	db_print_sa(ifa->ifa_addr);
2050 	db_printf("  ifa_dsta=");
2051 	db_print_sa(ifa->ifa_dstaddr);
2052 	db_printf("  ifa_mask=");
2053 	db_print_sa(ifa->ifa_netmask);
2054 	db_printf("  flags=0x%x,refcnt=%d,metric=%d\n",
2055 			  ifa->ifa_flags,
2056 			  ifa->ifa_refcnt,
2057 			  ifa->ifa_metric);
2058 }
2059 
2060 static void
2061 db_print_llinfo(void *li)
2062 {
2063 	struct llinfo_arp *la;
2064 
2065 	if (li == NULL)
2066 		return;
2067 	la = (struct llinfo_arp *)li;
2068 	db_printf("  la_rt=%p la_hold=%p, la_asked=0x%lx\n",
2069 			  la->la_rt, la->la_hold, la->la_asked);
2070 }
2071 
2072 /*
2073  * Function to pass to rt_walktree().
2074  * Return non-zero error to abort walk.
2075  */
2076 static int
2077 db_show_rtentry(struct rtentry *rt, void *w)
2078 {
2079 	db_printf("rtentry=%p", rt);
2080 
2081 	db_printf(" flags=0x%x refcnt=%d use=%"PRId64" expire=%"PRId64"\n",
2082 			  rt->rt_flags, rt->rt_refcnt,
2083 			  rt->rt_use, (uint64_t)rt->rt_expire);
2084 
2085 	db_printf(" key="); db_print_sa(rt_getkey(rt));
2086 	db_printf(" mask="); db_print_sa(rt_mask(rt));
2087 	db_printf(" gw="); db_print_sa(rt->rt_gateway);
2088 
2089 	db_printf(" ifp=%p ", rt->rt_ifp);
2090 	if (rt->rt_ifp)
2091 		db_printf("(%s)", rt->rt_ifp->if_xname);
2092 	else
2093 		db_printf("(NULL)");
2094 
2095 	db_printf(" ifa=%p\n", rt->rt_ifa);
2096 	db_print_ifa(rt->rt_ifa);
2097 
2098 	db_printf(" gwroute=%p llinfo=%p\n",
2099 			  rt->rt_gwroute, rt->rt_llinfo);
2100 	db_print_llinfo(rt->rt_llinfo);
2101 
2102 	return 0;
2103 }
2104 
2105 /*
2106  * Function to print all the route trees.
2107  * Use this from ddb:  "show arptab"
2108  */
2109 void
2110 db_show_arptab(db_expr_t addr, bool have_addr,
2111     db_expr_t count, const char *modif)
2112 {
2113 	rt_walktree(AF_INET, db_show_rtentry, NULL);
2114 }
2115 #endif
2116 
2117 void
2118 arp_stat_add(int type, uint64_t count)
2119 {
2120 	ARP_STATADD(type, count);
2121 }
2122 
2123 static int
2124 sysctl_net_inet_arp_stats(SYSCTLFN_ARGS)
2125 {
2126 
2127 	return NETSTAT_SYSCTL(arpstat_percpu, ARP_NSTATS);
2128 }
2129 
2130 static void
2131 sysctl_net_inet_arp_setup(struct sysctllog **clog)
2132 {
2133 	const struct sysctlnode *node;
2134 
2135 	sysctl_createv(clog, 0, NULL, NULL,
2136 			CTLFLAG_PERMANENT,
2137 			CTLTYPE_NODE, "inet", NULL,
2138 			NULL, 0, NULL, 0,
2139 			CTL_NET, PF_INET, CTL_EOL);
2140 	sysctl_createv(clog, 0, NULL, &node,
2141 			CTLFLAG_PERMANENT,
2142 			CTLTYPE_NODE, "arp",
2143 			SYSCTL_DESCR("Address Resolution Protocol"),
2144 			NULL, 0, NULL, 0,
2145 			CTL_NET, PF_INET, CTL_CREATE, CTL_EOL);
2146 
2147 	sysctl_createv(clog, 0, NULL, NULL,
2148 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2149 			CTLTYPE_INT, "keep",
2150 			SYSCTL_DESCR("Valid ARP entry lifetime in seconds"),
2151 			NULL, 0, &arpt_keep, 0,
2152 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2153 
2154 	sysctl_createv(clog, 0, NULL, NULL,
2155 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2156 			CTLTYPE_INT, "down",
2157 			SYSCTL_DESCR("Failed ARP entry lifetime in seconds"),
2158 			NULL, 0, &arpt_down, 0,
2159 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2160 
2161 	sysctl_createv(clog, 0, NULL, NULL,
2162 			CTLFLAG_PERMANENT,
2163 			CTLTYPE_STRUCT, "stats",
2164 			SYSCTL_DESCR("ARP statistics"),
2165 			sysctl_net_inet_arp_stats, 0, NULL, 0,
2166 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2167 
2168 	sysctl_createv(clog, 0, NULL, NULL,
2169 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2170 			CTLTYPE_INT, "log_movements",
2171 			SYSCTL_DESCR("log ARP replies from MACs different than"
2172 			    " the one in the cache"),
2173 			NULL, 0, &log_movements, 0,
2174 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2175 
2176 	sysctl_createv(clog, 0, NULL, NULL,
2177 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2178 			CTLTYPE_INT, "log_permanent_modify",
2179 			SYSCTL_DESCR("log ARP replies from MACs different than"
2180 			    " the one in the permanent arp entry"),
2181 			NULL, 0, &log_permanent_modify, 0,
2182 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2183 
2184 	sysctl_createv(clog, 0, NULL, NULL,
2185 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2186 			CTLTYPE_INT, "log_wrong_iface",
2187 			SYSCTL_DESCR("log ARP packets arriving on the wrong"
2188 			    " interface"),
2189 			NULL, 0, &log_wrong_iface, 0,
2190 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2191 
2192 	sysctl_createv(clog, 0, NULL, NULL,
2193 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2194 			CTLTYPE_INT, "log_unknown_network",
2195 			SYSCTL_DESCR("log ARP packets from non-local network"),
2196 			NULL, 0, &log_unknown_network, 0,
2197 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2198 
2199 	sysctl_createv(clog, 0, NULL, NULL,
2200 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2201 		       CTLTYPE_INT, "debug",
2202 		       SYSCTL_DESCR("Enable ARP DAD debug output"),
2203 		       NULL, 0, &arp_debug, 0,
2204 		       CTL_NET, PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2205 }
2206 
2207 #endif /* INET */
2208