xref: /netbsd-src/sys/netinet/if_arp.c (revision 8ac07aec990b9d2e483062509d0a9fa5b4f57cf2)
1 /*	$NetBSD: if_arp.c,v 1.134 2008/04/24 11:38:37 ad Exp $	*/
2 
3 /*-
4  * Copyright (c) 1998, 2000, 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Public Access Networks Corporation ("Panix").  It was developed under
9  * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. All advertising materials mentioning features or use of this software
20  *    must display the following acknowledgement:
21  *	This product includes software developed by the NetBSD
22  *	Foundation, Inc. and its contributors.
23  * 4. Neither the name of The NetBSD Foundation nor the names of its
24  *    contributors may be used to endorse or promote products derived
25  *    from this software without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
28  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
29  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
30  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
31  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
32  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
33  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
34  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
35  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
36  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
37  * POSSIBILITY OF SUCH DAMAGE.
38  */
39 
40 /*
41  * Copyright (c) 1982, 1986, 1988, 1993
42  *	The Regents of the University of California.  All rights reserved.
43  *
44  * Redistribution and use in source and binary forms, with or without
45  * modification, are permitted provided that the following conditions
46  * are met:
47  * 1. Redistributions of source code must retain the above copyright
48  *    notice, this list of conditions and the following disclaimer.
49  * 2. Redistributions in binary form must reproduce the above copyright
50  *    notice, this list of conditions and the following disclaimer in the
51  *    documentation and/or other materials provided with the distribution.
52  * 3. Neither the name of the University nor the names of its contributors
53  *    may be used to endorse or promote products derived from this software
54  *    without specific prior written permission.
55  *
56  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
57  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
58  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
59  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
60  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
61  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
62  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
64  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
65  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
66  * SUCH DAMAGE.
67  *
68  *	@(#)if_ether.c	8.2 (Berkeley) 9/26/94
69  */
70 
71 /*
72  * Ethernet address resolution protocol.
73  * TODO:
74  *	add "inuse/lock" bit (or ref. count) along with valid bit
75  */
76 
77 #include <sys/cdefs.h>
78 __KERNEL_RCSID(0, "$NetBSD: if_arp.c,v 1.134 2008/04/24 11:38:37 ad Exp $");
79 
80 #include "opt_ddb.h"
81 #include "opt_inet.h"
82 
83 #ifdef INET
84 
85 #include "bridge.h"
86 
87 #include <sys/param.h>
88 #include <sys/systm.h>
89 #include <sys/callout.h>
90 #include <sys/malloc.h>
91 #include <sys/mbuf.h>
92 #include <sys/socket.h>
93 #include <sys/time.h>
94 #include <sys/timetc.h>
95 #include <sys/kernel.h>
96 #include <sys/errno.h>
97 #include <sys/ioctl.h>
98 #include <sys/syslog.h>
99 #include <sys/proc.h>
100 #include <sys/protosw.h>
101 #include <sys/domain.h>
102 #include <sys/sysctl.h>
103 #include <sys/socketvar.h>
104 #include <sys/percpu.h>
105 
106 #include <net/ethertypes.h>
107 #include <net/if.h>
108 #include <net/if_dl.h>
109 #include <net/if_token.h>
110 #include <net/if_types.h>
111 #include <net/if_ether.h>
112 #include <net/route.h>
113 #include <net/net_stats.h>
114 
115 #include <netinet/in.h>
116 #include <netinet/in_systm.h>
117 #include <netinet/in_var.h>
118 #include <netinet/ip.h>
119 #include <netinet/if_inarp.h>
120 
121 #include "arcnet.h"
122 #if NARCNET > 0
123 #include <net/if_arc.h>
124 #endif
125 #include "fddi.h"
126 #if NFDDI > 0
127 #include <net/if_fddi.h>
128 #endif
129 #include "token.h"
130 #include "carp.h"
131 #if NCARP > 0
132 #include <netinet/ip_carp.h>
133 #endif
134 
135 #define SIN(s) ((struct sockaddr_in *)s)
136 #define SRP(s) ((struct sockaddr_inarp *)s)
137 
138 /*
139  * ARP trailer negotiation.  Trailer protocol is not IP specific,
140  * but ARP request/response use IP addresses.
141  */
142 #define ETHERTYPE_IPTRAILERS ETHERTYPE_TRAIL
143 
144 /* timer values */
145 int	arpt_prune = (5*60*1);	/* walk list every 5 minutes */
146 int	arpt_keep = (20*60);	/* once resolved, good for 20 more minutes */
147 int	arpt_down = 20;		/* once declared down, don't send for 20 secs */
148 int	arpt_refresh = (5*60);	/* time left before refreshing */
149 #define	rt_expire rt_rmx.rmx_expire
150 #define	rt_pksent rt_rmx.rmx_pksent
151 
152 static	struct sockaddr *arp_setgate(struct rtentry *, struct sockaddr *,
153 	    const struct sockaddr *);
154 static	void arptfree(struct llinfo_arp *);
155 static	void arptimer(void *);
156 static	struct llinfo_arp *arplookup1(struct mbuf *, const struct in_addr *,
157 				      int, int, struct rtentry *);
158 static	struct llinfo_arp *arplookup(struct mbuf *, const struct in_addr *,
159 					  int, int);
160 static	void in_arpinput(struct mbuf *);
161 
162 LIST_HEAD(, llinfo_arp) llinfo_arp;
163 struct	ifqueue arpintrq = {
164 	.ifq_head = NULL,
165 	.ifq_tail = NULL,
166 	.ifq_len = 0,
167 	.ifq_maxlen = 50,
168 	.ifq_drops = 0,
169 };
170 int	arp_inuse, arp_allocated, arp_intimer;
171 int	arp_maxtries = 5;
172 int	useloopback = 1;	/* use loopback interface for local traffic */
173 int	arpinit_done = 0;
174 
175 static percpu_t *arpstat_percpu;
176 
177 #define	ARP_STAT_GETREF()	_NET_STAT_GETREF(arpstat_percpu)
178 #define	ARP_STAT_PUTREF()	_NET_STAT_PUTREF(arpstat_percpu)
179 
180 #define	ARP_STATINC(x)		_NET_STATINC(arpstat_percpu, x)
181 #define	ARP_STATADD(x, v)	_NET_STATADD(arpstat_percpu, x, v)
182 
183 struct	callout arptimer_ch;
184 
185 /* revarp state */
186 struct	in_addr myip, srv_ip;
187 int	myip_initialized = 0;
188 int	revarp_in_progress = 0;
189 struct	ifnet *myip_ifp = NULL;
190 
191 #ifdef DDB
192 static void db_print_sa(const struct sockaddr *);
193 static void db_print_ifa(struct ifaddr *);
194 static void db_print_llinfo(void *);
195 static int db_show_rtentry(struct rtentry *, void *);
196 #endif
197 
198 /*
199  * this should be elsewhere.
200  */
201 
202 static char *
203 lla_snprintf(u_int8_t *, int);
204 
205 static char *
206 lla_snprintf(u_int8_t *adrp, int len)
207 {
208 #define NUMBUFS 3
209 	static char buf[NUMBUFS][16*3];
210 	static int bnum = 0;
211 
212 	int i;
213 	char *p;
214 
215 	p = buf[bnum];
216 
217 	*p++ = hexdigits[(*adrp)>>4];
218 	*p++ = hexdigits[(*adrp++)&0xf];
219 
220 	for (i=1; i<len && i<16; i++) {
221 		*p++ = ':';
222 		*p++ = hexdigits[(*adrp)>>4];
223 		*p++ = hexdigits[(*adrp++)&0xf];
224 	}
225 
226 	*p = 0;
227 	p = buf[bnum];
228 	bnum = (bnum + 1) % NUMBUFS;
229 	return p;
230 }
231 
232 DOMAIN_DEFINE(arpdomain);	/* forward declare and add to link set */
233 
234 const struct protosw arpsw[] = {
235 	{ .pr_type = 0,
236 	  .pr_domain = &arpdomain,
237 	  .pr_protocol = 0,
238 	  .pr_flags = 0,
239 	  .pr_input = 0,
240 	  .pr_output = 0,
241 	  .pr_ctlinput = 0,
242 	  .pr_ctloutput = 0,
243 	  .pr_usrreq =  0,
244 	  .pr_init = arp_init,
245 	  .pr_fasttimo = 0,
246 	  .pr_slowtimo = 0,
247 	  .pr_drain = arp_drain,
248 	}
249 };
250 
251 
252 struct domain arpdomain = {
253 	.dom_family = PF_ARP,
254 	.dom_name = "arp",
255 	.dom_protosw = arpsw,
256 	.dom_protoswNPROTOSW = &arpsw[sizeof(arpsw)/sizeof(arpsw[0])],
257 };
258 
259 /*
260  * ARP table locking.
261  *
262  * to prevent lossage vs. the arp_drain routine (which may be called at
263  * any time, including in a device driver context), we do two things:
264  *
265  * 1) manipulation of la->la_hold is done at splnet() (for all of
266  * about two instructions).
267  *
268  * 2) manipulation of the arp table's linked list is done under the
269  * protection of the ARP_LOCK; if arp_drain() or arptimer is called
270  * while the arp table is locked, we punt and try again later.
271  */
272 
273 static int	arp_locked;
274 static inline int arp_lock_try(int);
275 static inline void arp_unlock(void);
276 
277 static inline int
278 arp_lock_try(int recurse)
279 {
280 	int s;
281 
282 	/*
283 	 * Use splvm() -- we're blocking things that would cause
284 	 * mbuf allocation.
285 	 */
286 	s = splvm();
287 	if (!recurse && arp_locked) {
288 		splx(s);
289 		return (0);
290 	}
291 	arp_locked++;
292 	splx(s);
293 	return (1);
294 }
295 
296 static inline void
297 arp_unlock(void)
298 {
299 	int s;
300 
301 	s = splvm();
302 	arp_locked--;
303 	splx(s);
304 }
305 
306 #ifdef DIAGNOSTIC
307 #define	ARP_LOCK(recurse)						\
308 do {									\
309 	if (arp_lock_try(recurse) == 0) {				\
310 		printf("%s:%d: arp already locked\n", __FILE__, __LINE__); \
311 		panic("arp_lock");					\
312 	}								\
313 } while (/*CONSTCOND*/ 0)
314 #define	ARP_LOCK_CHECK()						\
315 do {									\
316 	if (arp_locked == 0) {						\
317 		printf("%s:%d: arp lock not held\n", __FILE__, __LINE__); \
318 		panic("arp lock check");				\
319 	}								\
320 } while (/*CONSTCOND*/ 0)
321 #else
322 #define	ARP_LOCK(x)		(void) arp_lock_try(x)
323 #define	ARP_LOCK_CHECK()	/* nothing */
324 #endif
325 
326 #define	ARP_UNLOCK()		arp_unlock()
327 
328 void
329 arp_init(void)
330 {
331 
332 	arpstat_percpu = percpu_alloc(sizeof(uint64_t) * ARP_NSTATS);
333 }
334 
335 /*
336  * ARP protocol drain routine.  Called when memory is in short supply.
337  * Called at splvm();
338  */
339 void
340 arp_drain(void)
341 {
342 	struct llinfo_arp *la, *nla;
343 	int count = 0;
344 	struct mbuf *mold;
345 
346 	mutex_enter(softnet_lock);
347 	KERNEL_LOCK(1, NULL);
348 
349 	if (arp_lock_try(0) == 0) {
350 		printf("arp_drain: locked; punting\n");
351 		KERNEL_UNLOCK_ONE(NULL);
352 		mutex_exit(softnet_lock);
353 		return;
354 	}
355 
356 	for (la = LIST_FIRST(&llinfo_arp); la != 0; la = nla) {
357 		nla = LIST_NEXT(la, la_list);
358 
359 		mold = la->la_hold;
360 		la->la_hold = 0;
361 
362 		if (mold) {
363 			m_freem(mold);
364 			count++;
365 		}
366 	}
367 	ARP_UNLOCK();
368 	ARP_STATADD(ARP_STAT_DFRDROPPED, count);
369 	KERNEL_UNLOCK_ONE(NULL);
370 	mutex_exit(softnet_lock);
371 }
372 
373 
374 /*
375  * Timeout routine.  Age arp_tab entries periodically.
376  */
377 /* ARGSUSED */
378 static void
379 arptimer(void *arg)
380 {
381 	struct llinfo_arp *la, *nla;
382 
383 	mutex_enter(softnet_lock);
384 	KERNEL_LOCK(1, NULL);
385 
386 	if (arp_lock_try(0) == 0) {
387 		/* get it later.. */
388 		KERNEL_UNLOCK_ONE(NULL);
389 		mutex_exit(softnet_lock);
390 		return;
391 	}
392 
393 	callout_reset(&arptimer_ch, arpt_prune * hz, arptimer, NULL);
394 	for (la = LIST_FIRST(&llinfo_arp); la != 0; la = nla) {
395 		struct rtentry *rt = la->la_rt;
396 
397 		nla = LIST_NEXT(la, la_list);
398 		if (rt->rt_expire == 0)
399 			continue;
400 		if ((rt->rt_expire - time_second) < arpt_refresh &&
401 		    rt->rt_pksent > (time_second - arpt_keep)) {
402 			/*
403 			 * If the entry has been used during since last
404 			 * refresh, try to renew it before deleting.
405 			 */
406 			arprequest(rt->rt_ifp,
407 			    &satocsin(rt->rt_ifa->ifa_addr)->sin_addr,
408 			    &satocsin(rt_getkey(rt))->sin_addr,
409 			    CLLADDR(rt->rt_ifp->if_sadl));
410 		} else if (rt->rt_expire <= time_second)
411 			arptfree(la); /* timer has expired; clear */
412 	}
413 
414 	ARP_UNLOCK();
415 
416 	KERNEL_UNLOCK_ONE(NULL);
417 	mutex_exit(softnet_lock);
418 }
419 
420 /*
421  * We set the gateway for RTF_CLONING routes to a "prototype"
422  * link-layer sockaddr whose interface type (if_type) and interface
423  * index (if_index) fields are prepared.
424  */
425 static struct sockaddr *
426 arp_setgate(struct rtentry *rt, struct sockaddr *gate,
427     const struct sockaddr *netmask)
428 {
429 	const struct ifnet *ifp = rt->rt_ifp;
430 	uint8_t namelen = strlen(ifp->if_xname);
431 	uint8_t addrlen = ifp->if_addrlen;
432 
433 	/*
434 	 * XXX: If this is a manually added route to interface
435 	 * such as older version of routed or gated might provide,
436 	 * restore cloning bit.
437 	 */
438 	if ((rt->rt_flags & RTF_HOST) == 0 && netmask != NULL &&
439 	    satocsin(netmask)->sin_addr.s_addr != 0xffffffff)
440 		rt->rt_flags |= RTF_CLONING;
441 	if (rt->rt_flags & RTF_CLONING) {
442 		union {
443 			struct sockaddr sa;
444 			struct sockaddr_storage ss;
445 			struct sockaddr_dl sdl;
446 		} u;
447 		/*
448 		 * Case 1: This route should come from a route to iface.
449 		 */
450 		sockaddr_dl_init(&u.sdl, sizeof(u.ss),
451 		    ifp->if_index, ifp->if_type, NULL, namelen, NULL, addrlen);
452 		rt_setgate(rt, &u.sa);
453 		gate = rt->rt_gateway;
454 	}
455 	return gate;
456 }
457 
458 /*
459  * Parallel to llc_rtrequest.
460  */
461 void
462 arp_rtrequest(int req, struct rtentry *rt, struct rt_addrinfo *info)
463 {
464 	struct sockaddr *gate = rt->rt_gateway;
465 	struct llinfo_arp *la = (struct llinfo_arp *)rt->rt_llinfo;
466 	size_t allocsize;
467 	struct mbuf *mold;
468 	int s;
469 	struct in_ifaddr *ia;
470 	struct ifaddr *ifa;
471 	struct ifnet *ifp = rt->rt_ifp;
472 	uint8_t namelen = strlen(ifp->if_xname);
473 	uint8_t addrlen = ifp->if_addrlen;
474 
475 	if (!arpinit_done) {
476 		arpinit_done = 1;
477 		/*
478 		 * We generate expiration times from time_second
479 		 * so avoid accidentally creating permanent routes.
480 		 */
481 		if (time_second == 0) {
482 			struct timespec ts;
483 			ts.tv_sec = 1;
484 			ts.tv_nsec = 0;
485 			tc_setclock(&ts);
486 		}
487 		callout_init(&arptimer_ch, CALLOUT_MPSAFE);
488 		callout_reset(&arptimer_ch, hz, arptimer, NULL);
489 	}
490 
491 	if ((rt->rt_flags & RTF_GATEWAY) != 0) {
492 		if (req != RTM_ADD)
493 			return;
494 
495 		/*
496 		 * linklayers with particular link MTU limitation.
497 		 */
498 		switch(ifp->if_type) {
499 #if NFDDI > 0
500 		case IFT_FDDI:
501 			if (ifp->if_mtu > FDDIIPMTU)
502 				rt->rt_rmx.rmx_mtu = FDDIIPMTU;
503 			break;
504 #endif
505 #if NARC > 0
506 		case IFT_ARCNET:
507 		    {
508 			int arcipifmtu;
509 
510 			if (ifp->if_flags & IFF_LINK0)
511 				arcipifmtu = arc_ipmtu;
512 			else
513 				arcipifmtu = ARCMTU;
514 			if (ifp->if_mtu > arcipifmtu)
515 				rt->rt_rmx.rmx_mtu = arcipifmtu;
516 			break;
517 		    }
518 #endif
519 		}
520 		return;
521 	}
522 
523 	ARP_LOCK(1);		/* we may already be locked here. */
524 
525 	switch (req) {
526 
527 	case RTM_SETGATE:
528 		gate = arp_setgate(rt, gate, info->rti_info[RTAX_NETMASK]);
529 		break;
530 	case RTM_ADD:
531 		gate = arp_setgate(rt, gate, info->rti_info[RTAX_NETMASK]);
532 		if (rt->rt_flags & RTF_CLONING) {
533 			/*
534 			 * Give this route an expiration time, even though
535 			 * it's a "permanent" route, so that routes cloned
536 			 * from it do not need their expiration time set.
537 			 */
538 			rt->rt_expire = time_second;
539 			/*
540 			 * linklayers with particular link MTU limitation.
541 			 */
542 			switch (ifp->if_type) {
543 #if NFDDI > 0
544 			case IFT_FDDI:
545 				if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0 &&
546 				    (rt->rt_rmx.rmx_mtu > FDDIIPMTU ||
547 				     (rt->rt_rmx.rmx_mtu == 0 &&
548 				      ifp->if_mtu > FDDIIPMTU)))
549 					rt->rt_rmx.rmx_mtu = FDDIIPMTU;
550 				break;
551 #endif
552 #if NARC > 0
553 			case IFT_ARCNET:
554 			    {
555 				int arcipifmtu;
556 				if (ifp->if_flags & IFF_LINK0)
557 					arcipifmtu = arc_ipmtu;
558 				else
559 					arcipifmtu = ARCMTU;
560 
561 				if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0 &&
562 				    (rt->rt_rmx.rmx_mtu > arcipifmtu ||
563 				     (rt->rt_rmx.rmx_mtu == 0 &&
564 				      ifp->if_mtu > arcipifmtu)))
565 					rt->rt_rmx.rmx_mtu = arcipifmtu;
566 				break;
567 			    }
568 #endif
569 			}
570 			break;
571 		}
572 		/* Announce a new entry if requested. */
573 		if (rt->rt_flags & RTF_ANNOUNCE)
574 			arprequest(ifp,
575 			    &satocsin(rt_getkey(rt))->sin_addr,
576 			    &satocsin(rt_getkey(rt))->sin_addr,
577 			    CLLADDR(satocsdl(gate)));
578 		/*FALLTHROUGH*/
579 	case RTM_RESOLVE:
580 		if (gate->sa_family != AF_LINK ||
581 		    gate->sa_len < sockaddr_dl_measure(namelen, addrlen)) {
582 			log(LOG_DEBUG, "arp_rtrequest: bad gateway value\n");
583 			break;
584 		}
585 		satosdl(gate)->sdl_type = ifp->if_type;
586 		satosdl(gate)->sdl_index = ifp->if_index;
587 		if (la != 0)
588 			break; /* This happens on a route change */
589 		/*
590 		 * Case 2:  This route may come from cloning, or a manual route
591 		 * add with a LL address.
592 		 */
593 		switch (satocsdl(gate)->sdl_type) {
594 #if NTOKEN > 0
595 		case IFT_ISO88025:
596 			allocsize = sizeof(*la) + sizeof(struct token_rif);
597 			break;
598 #endif /* NTOKEN > 0 */
599 		default:
600 			allocsize = sizeof(*la);
601 		}
602 		R_Malloc(la, struct llinfo_arp *, allocsize);
603 		rt->rt_llinfo = (void *)la;
604 		if (la == 0) {
605 			log(LOG_DEBUG, "arp_rtrequest: malloc failed\n");
606 			break;
607 		}
608 		arp_inuse++, arp_allocated++;
609 		Bzero(la, allocsize);
610 		la->la_rt = rt;
611 		rt->rt_flags |= RTF_LLINFO;
612 		LIST_INSERT_HEAD(&llinfo_arp, la, la_list);
613 
614 		INADDR_TO_IA(satocsin(rt_getkey(rt))->sin_addr, ia);
615 		while (ia && ia->ia_ifp != ifp)
616 			NEXT_IA_WITH_SAME_ADDR(ia);
617 		if (ia) {
618 			/*
619 			 * This test used to be
620 			 *	if (lo0ifp->if_flags & IFF_UP)
621 			 * It allowed local traffic to be forced through
622 			 * the hardware by configuring the loopback down.
623 			 * However, it causes problems during network
624 			 * configuration for boards that can't receive
625 			 * packets they send.  It is now necessary to clear
626 			 * "useloopback" and remove the route to force
627 			 * traffic out to the hardware.
628 			 *
629 			 * In 4.4BSD, the above "if" statement checked
630 			 * rt->rt_ifa against rt_getkey(rt).  It was changed
631 			 * to the current form so that we can provide a
632 			 * better support for multiple IPv4 addresses on a
633 			 * interface.
634 			 */
635 			rt->rt_expire = 0;
636 			(void)sockaddr_dl_setaddr(satosdl(gate), gate->sa_len,
637 			    CLLADDR(ifp->if_sadl), ifp->if_addrlen);
638 			if (useloopback)
639 				ifp = rt->rt_ifp = lo0ifp;
640 			/*
641 			 * make sure to set rt->rt_ifa to the interface
642 			 * address we are using, otherwise we will have trouble
643 			 * with source address selection.
644 			 */
645 			ifa = &ia->ia_ifa;
646 			if (ifa != rt->rt_ifa)
647 				rt_replace_ifa(rt, ifa);
648 		}
649 		break;
650 
651 	case RTM_DELETE:
652 		if (la == 0)
653 			break;
654 		arp_inuse--;
655 		LIST_REMOVE(la, la_list);
656 		rt->rt_llinfo = 0;
657 		rt->rt_flags &= ~RTF_LLINFO;
658 
659 		s = splnet();
660 		mold = la->la_hold;
661 		la->la_hold = 0;
662 		splx(s);
663 
664 		if (mold)
665 			m_freem(mold);
666 
667 		Free((void *)la);
668 	}
669 	ARP_UNLOCK();
670 }
671 
672 /*
673  * Broadcast an ARP request. Caller specifies:
674  *	- arp header source ip address
675  *	- arp header target ip address
676  *	- arp header source ethernet address
677  */
678 void
679 arprequest(struct ifnet *ifp,
680     const struct in_addr *sip, const struct in_addr *tip,
681     const u_int8_t *enaddr)
682 {
683 	struct mbuf *m;
684 	struct arphdr *ah;
685 	struct sockaddr sa;
686 	uint64_t *arps;
687 
688 	if ((m = m_gethdr(M_DONTWAIT, MT_DATA)) == NULL)
689 		return;
690 	MCLAIM(m, &arpdomain.dom_mowner);
691 	switch (ifp->if_type) {
692 	case IFT_IEEE1394:
693 		m->m_len = sizeof(*ah) + 2 * sizeof(struct in_addr) +
694 		    ifp->if_addrlen;
695 		break;
696 	default:
697 		m->m_len = sizeof(*ah) + 2 * sizeof(struct in_addr) +
698 		    2 * ifp->if_addrlen;
699 		break;
700 	}
701 	m->m_pkthdr.len = m->m_len;
702 	MH_ALIGN(m, m->m_len);
703 	ah = mtod(m, struct arphdr *);
704 	bzero((void *)ah, m->m_len);
705 	switch (ifp->if_type) {
706 	case IFT_IEEE1394:	/* RFC2734 */
707 		/* fill it now for ar_tpa computation */
708 		ah->ar_hrd = htons(ARPHRD_IEEE1394);
709 		break;
710 	default:
711 		/* ifp->if_output will fill ar_hrd */
712 		break;
713 	}
714 	ah->ar_pro = htons(ETHERTYPE_IP);
715 	ah->ar_hln = ifp->if_addrlen;		/* hardware address length */
716 	ah->ar_pln = sizeof(struct in_addr);	/* protocol address length */
717 	ah->ar_op = htons(ARPOP_REQUEST);
718 	memcpy(ar_sha(ah), enaddr, ah->ar_hln);
719 	memcpy(ar_spa(ah), sip, ah->ar_pln);
720 	memcpy(ar_tpa(ah), tip, ah->ar_pln);
721 	sa.sa_family = AF_ARP;
722 	sa.sa_len = 2;
723 	m->m_flags |= M_BCAST;
724 	arps = ARP_STAT_GETREF();
725 	arps[ARP_STAT_SNDTOTAL]++;
726 	arps[ARP_STAT_SENDREQUEST]++;
727 	ARP_STAT_PUTREF();
728 	(*ifp->if_output)(ifp, m, &sa, NULL);
729 }
730 
731 /*
732  * Resolve an IP address into an ethernet address.  If success,
733  * desten is filled in.  If there is no entry in arptab,
734  * set one up and broadcast a request for the IP address.
735  * Hold onto this mbuf and resend it once the address
736  * is finally resolved.  A return value of 1 indicates
737  * that desten has been filled in and the packet should be sent
738  * normally; a 0 return indicates that the packet has been
739  * taken over here, either now or for later transmission.
740  */
741 int
742 arpresolve(struct ifnet *ifp, struct rtentry *rt, struct mbuf *m,
743     const struct sockaddr *dst, u_char *desten)
744 {
745 	struct llinfo_arp *la;
746 	const struct sockaddr_dl *sdl;
747 	struct mbuf *mold;
748 	int s;
749 
750 	if ((la = arplookup1(m, &satocsin(dst)->sin_addr, 1, 0, rt)) != NULL)
751 		rt = la->la_rt;
752 
753 	if (la == 0 || rt == 0) {
754 		ARP_STATINC(ARP_STAT_ALLOCFAIL);
755 		log(LOG_DEBUG,
756 		    "arpresolve: can't allocate llinfo on %s for %s\n",
757 		    ifp->if_xname, in_fmtaddr(satocsin(dst)->sin_addr));
758 		m_freem(m);
759 		return (0);
760 	}
761 	sdl = satocsdl(rt->rt_gateway);
762 	/*
763 	 * Check the address family and length is valid, the address
764 	 * is resolved; otherwise, try to resolve.
765 	 */
766 	if ((rt->rt_expire == 0 || rt->rt_expire > time_second) &&
767 	    sdl->sdl_family == AF_LINK && sdl->sdl_alen != 0) {
768 		bcopy(CLLADDR(sdl), desten,
769 		    min(sdl->sdl_alen, ifp->if_addrlen));
770 		rt->rt_pksent = time_second; /* Time for last pkt sent */
771 		return 1;
772 	}
773 	/*
774 	 * There is an arptab entry, but no ethernet address
775 	 * response yet.  Replace the held mbuf with this
776 	 * latest one.
777 	 */
778 
779 	ARP_STATINC(ARP_STAT_DFRTOTAL);
780 	s = splnet();
781 	mold = la->la_hold;
782 	la->la_hold = m;
783 	splx(s);
784 
785 	if (mold) {
786 		ARP_STATINC(ARP_STAT_DFRDROPPED);
787 		m_freem(mold);
788 	}
789 
790 	/*
791 	 * Re-send the ARP request when appropriate.
792 	 */
793 #ifdef	DIAGNOSTIC
794 	if (rt->rt_expire == 0) {
795 		/* This should never happen. (Should it? -gwr) */
796 		printf("arpresolve: unresolved and rt_expire == 0\n");
797 		/* Set expiration time to now (expired). */
798 		rt->rt_expire = time_second;
799 	}
800 #endif
801 	if (rt->rt_expire) {
802 		rt->rt_flags &= ~RTF_REJECT;
803 		if (la->la_asked == 0 || rt->rt_expire != time_second) {
804 			rt->rt_expire = time_second;
805 			if (la->la_asked++ < arp_maxtries)
806 				arprequest(ifp,
807 				    &satocsin(rt->rt_ifa->ifa_addr)->sin_addr,
808 				    &satocsin(dst)->sin_addr,
809 #if NCARP > 0
810 				    (rt->rt_ifp->if_type == IFT_CARP) ?
811 				    CLLADDR(rt->rt_ifp->if_sadl):
812 #endif
813 				    CLLADDR(ifp->if_sadl));
814 			else {
815 				rt->rt_flags |= RTF_REJECT;
816 				rt->rt_expire += arpt_down;
817 				la->la_asked = 0;
818 			}
819 		}
820 	}
821 	return (0);
822 }
823 
824 /*
825  * Common length and type checks are done here,
826  * then the protocol-specific routine is called.
827  */
828 void
829 arpintr(void)
830 {
831 	struct mbuf *m;
832 	struct arphdr *ar;
833 	int s;
834 	int arplen;
835 
836 	mutex_enter(softnet_lock);
837 	KERNEL_LOCK(1, NULL);
838 	while (arpintrq.ifq_head) {
839 		s = splnet();
840 		IF_DEQUEUE(&arpintrq, m);
841 		splx(s);
842 		if (m == 0 || (m->m_flags & M_PKTHDR) == 0)
843 			panic("arpintr");
844 
845 		MCLAIM(m, &arpdomain.dom_mowner);
846 		ARP_STATINC(ARP_STAT_RCVTOTAL);
847 
848 		/*
849 		 * First, make sure we have at least struct arphdr.
850 		 */
851 		if (m->m_len < sizeof(struct arphdr) ||
852 		    (ar = mtod(m, struct arphdr *)) == NULL)
853 			goto badlen;
854 
855 		switch (m->m_pkthdr.rcvif->if_type) {
856 		case IFT_IEEE1394:
857 			arplen = sizeof(struct arphdr) +
858 			    ar->ar_hln + 2 * ar->ar_pln;
859 			break;
860 		default:
861 			arplen = sizeof(struct arphdr) +
862 			    2 * ar->ar_hln + 2 * ar->ar_pln;
863 			break;
864 		}
865 
866 		if (/* XXX ntohs(ar->ar_hrd) == ARPHRD_ETHER && */
867 		    m->m_len >= arplen)
868 			switch (ntohs(ar->ar_pro)) {
869 			case ETHERTYPE_IP:
870 			case ETHERTYPE_IPTRAILERS:
871 				in_arpinput(m);
872 				continue;
873 			default:
874 				ARP_STATINC(ARP_STAT_RCVBADPROTO);
875 			}
876 		else {
877 badlen:
878 			ARP_STATINC(ARP_STAT_RCVBADLEN);
879 		}
880 		m_freem(m);
881 	}
882 	KERNEL_UNLOCK_ONE(NULL);
883 	mutex_exit(softnet_lock);
884 }
885 
886 /*
887  * ARP for Internet protocols on 10 Mb/s Ethernet.
888  * Algorithm is that given in RFC 826.
889  * In addition, a sanity check is performed on the sender
890  * protocol address, to catch impersonators.
891  * We no longer handle negotiations for use of trailer protocol:
892  * Formerly, ARP replied for protocol type ETHERTYPE_TRAIL sent
893  * along with IP replies if we wanted trailers sent to us,
894  * and also sent them in response to IP replies.
895  * This allowed either end to announce the desire to receive
896  * trailer packets.
897  * We no longer reply to requests for ETHERTYPE_TRAIL protocol either,
898  * but formerly didn't normally send requests.
899  */
900 static void
901 in_arpinput(struct mbuf *m)
902 {
903 	struct arphdr *ah;
904 	struct ifnet *ifp = m->m_pkthdr.rcvif;
905 	struct llinfo_arp *la = 0;
906 	struct rtentry  *rt;
907 	struct in_ifaddr *ia;
908 #if NBRIDGE > 0
909 	struct in_ifaddr *bridge_ia = NULL;
910 #endif
911 #if NCARP > 0
912 	u_int32_t count = 0, index = 0;
913 #endif
914 	struct sockaddr_dl *sdl;
915 	struct sockaddr sa;
916 	struct in_addr isaddr, itaddr, myaddr;
917 	int op;
918 	struct mbuf *mold;
919 	void *tha;
920 	int s;
921 	uint64_t *arps;
922 
923 	if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
924 		goto out;
925 	ah = mtod(m, struct arphdr *);
926 	op = ntohs(ah->ar_op);
927 
928 	/*
929 	 * Fix up ah->ar_hrd if necessary, before using ar_tha() or
930 	 * ar_tpa().
931 	 */
932 	switch (ifp->if_type) {
933 	case IFT_IEEE1394:
934 		if (ntohs(ah->ar_hrd) == ARPHRD_IEEE1394)
935 			;
936 		else {
937 			/* XXX this is to make sure we compute ar_tha right */
938 			/* XXX check ar_hrd more strictly? */
939 			ah->ar_hrd = htons(ARPHRD_IEEE1394);
940 		}
941 		break;
942 	default:
943 		/* XXX check ar_hrd? */
944 		break;
945 	}
946 
947 	memcpy(&isaddr, ar_spa(ah), sizeof (isaddr));
948 	memcpy(&itaddr, ar_tpa(ah), sizeof (itaddr));
949 
950 	if (m->m_flags & (M_BCAST|M_MCAST))
951 		ARP_STATINC(ARP_STAT_RCVMCAST);
952 
953 	/*
954 	 * If the target IP address is zero, ignore the packet.
955 	 * This prevents the code below from tring to answer
956 	 * when we are using IP address zero (booting).
957 	 */
958 	if (in_nullhost(itaddr)) {
959 		ARP_STATINC(ARP_STAT_RCVZEROTPA);
960 		goto out;
961 	}
962 
963 	/*
964 	 * If the source IP address is zero, this is most likely a
965 	 * confused host trying to use IP address zero. (Windoze?)
966 	 * XXX: Should we bother trying to reply to these?
967 	 */
968 	if (in_nullhost(isaddr)) {
969 		ARP_STATINC(ARP_STAT_RCVZEROSPA);
970 		goto out;
971 	}
972 
973 	/*
974 	 * Search for a matching interface address
975 	 * or any address on the interface to use
976 	 * as a dummy address in the rest of this function
977 	 */
978 
979 	INADDR_TO_IA(itaddr, ia);
980 	while (ia != NULL) {
981 #if NCARP > 0
982 		if (ia->ia_ifp->if_type == IFT_CARP &&
983 		    ((ia->ia_ifp->if_flags & (IFF_UP|IFF_RUNNING)) ==
984 		    (IFF_UP|IFF_RUNNING))) {
985 			index++;
986 			if (ia->ia_ifp == m->m_pkthdr.rcvif &&
987 			    carp_iamatch(ia, ar_sha(ah),
988 			    &count, index)) {
989 				break;
990 				}
991 		} else
992 #endif
993 			    if (ia->ia_ifp == m->m_pkthdr.rcvif)
994 				break;
995 #if NBRIDGE > 0
996 		/*
997 		 * If the interface we received the packet on
998 		 * is part of a bridge, check to see if we need
999 		 * to "bridge" the packet to ourselves at this
1000 		 * layer.  Note we still prefer a perfect match,
1001 		 * but allow this weaker match if necessary.
1002 		 */
1003 		if (m->m_pkthdr.rcvif->if_bridge != NULL &&
1004 		    m->m_pkthdr.rcvif->if_bridge == ia->ia_ifp->if_bridge)
1005 			bridge_ia = ia;
1006 #endif /* NBRIDGE > 0 */
1007 
1008 		NEXT_IA_WITH_SAME_ADDR(ia);
1009 	}
1010 
1011 #if NBRIDGE > 0
1012 	if (ia == NULL && bridge_ia != NULL) {
1013 		ia = bridge_ia;
1014 		ifp = bridge_ia->ia_ifp;
1015 	}
1016 #endif
1017 
1018 	if (ia == NULL) {
1019 		INADDR_TO_IA(isaddr, ia);
1020 		while ((ia != NULL) && ia->ia_ifp != m->m_pkthdr.rcvif)
1021 			NEXT_IA_WITH_SAME_ADDR(ia);
1022 
1023 		if (ia == NULL) {
1024 			IFP_TO_IA(ifp, ia);
1025 			if (ia == NULL) {
1026 				ARP_STATINC(ARP_STAT_RCVNOINT);
1027 				goto out;
1028 			}
1029 		}
1030 	}
1031 
1032 	myaddr = ia->ia_addr.sin_addr;
1033 
1034 	/* XXX checks for bridge case? */
1035 	if (!memcmp(ar_sha(ah), CLLADDR(ifp->if_sadl), ifp->if_addrlen)) {
1036 		ARP_STATINC(ARP_STAT_RCVLOCALSHA);
1037 		goto out;	/* it's from me, ignore it. */
1038 	}
1039 
1040 	/* XXX checks for bridge case? */
1041 	if (!memcmp(ar_sha(ah), ifp->if_broadcastaddr, ifp->if_addrlen)) {
1042 		ARP_STATINC(ARP_STAT_RCVBCASTSHA);
1043 		log(LOG_ERR,
1044 		    "%s: arp: link address is broadcast for IP address %s!\n",
1045 		    ifp->if_xname, in_fmtaddr(isaddr));
1046 		goto out;
1047 	}
1048 
1049 	if (in_hosteq(isaddr, myaddr)) {
1050 		ARP_STATINC(ARP_STAT_RCVLOCALSPA);
1051 		log(LOG_ERR,
1052 		   "duplicate IP address %s sent from link address %s\n",
1053 		   in_fmtaddr(isaddr), lla_snprintf(ar_sha(ah), ah->ar_hln));
1054 		itaddr = myaddr;
1055 		goto reply;
1056 	}
1057 	la = arplookup(m, &isaddr, in_hosteq(itaddr, myaddr), 0);
1058 	if (la && (rt = la->la_rt) && (sdl = satosdl(rt->rt_gateway))) {
1059 		if (sdl->sdl_alen &&
1060 		    memcmp(ar_sha(ah), CLLADDR(sdl), sdl->sdl_alen)) {
1061 			if (rt->rt_flags & RTF_STATIC) {
1062 				ARP_STATINC(ARP_STAT_RCVOVERPERM);
1063 				log(LOG_INFO,
1064 				    "%s tried to overwrite permanent arp info"
1065 				    " for %s\n",
1066 				    lla_snprintf(ar_sha(ah), ah->ar_hln),
1067 				    in_fmtaddr(isaddr));
1068 				goto out;
1069 			} else if (rt->rt_ifp != ifp) {
1070 				ARP_STATINC(ARP_STAT_RCVOVERINT);
1071 				log(LOG_INFO,
1072 				    "%s on %s tried to overwrite "
1073 				    "arp info for %s on %s\n",
1074 				    lla_snprintf(ar_sha(ah), ah->ar_hln),
1075 				    ifp->if_xname, in_fmtaddr(isaddr),
1076 				    rt->rt_ifp->if_xname);
1077 				    goto out;
1078 			} else {
1079 				ARP_STATINC(ARP_STAT_RCVOVER);
1080 				log(LOG_INFO,
1081 				    "arp info overwritten for %s by %s\n",
1082 				    in_fmtaddr(isaddr),
1083 				    lla_snprintf(ar_sha(ah), ah->ar_hln));
1084 			}
1085 		}
1086 		/*
1087 		 * sanity check for the address length.
1088 		 * XXX this does not work for protocols with variable address
1089 		 * length. -is
1090 		 */
1091 		if (sdl->sdl_alen &&
1092 		    sdl->sdl_alen != ah->ar_hln) {
1093 			ARP_STATINC(ARP_STAT_RCVLENCHG);
1094 			log(LOG_WARNING,
1095 			    "arp from %s: new addr len %d, was %d",
1096 			    in_fmtaddr(isaddr), ah->ar_hln, sdl->sdl_alen);
1097 		}
1098 		if (ifp->if_addrlen != ah->ar_hln) {
1099 			ARP_STATINC(ARP_STAT_RCVBADLEN);
1100 			log(LOG_WARNING,
1101 			    "arp from %s: addr len: new %d, i/f %d (ignored)",
1102 			    in_fmtaddr(isaddr), ah->ar_hln,
1103 			    ifp->if_addrlen);
1104 			goto reply;
1105 		}
1106 #if NTOKEN > 0
1107 		/*
1108 		 * XXX uses m_data and assumes the complete answer including
1109 		 * XXX token-ring headers is in the same buf
1110 		 */
1111 		if (ifp->if_type == IFT_ISO88025) {
1112 			struct token_header *trh;
1113 
1114 			trh = (struct token_header *)M_TRHSTART(m);
1115 			if (trh->token_shost[0] & TOKEN_RI_PRESENT) {
1116 				struct token_rif	*rif;
1117 				size_t	riflen;
1118 
1119 				rif = TOKEN_RIF(trh);
1120 				riflen = (ntohs(rif->tr_rcf) &
1121 				    TOKEN_RCF_LEN_MASK) >> 8;
1122 
1123 				if (riflen > 2 &&
1124 				    riflen < sizeof(struct token_rif) &&
1125 				    (riflen & 1) == 0) {
1126 					rif->tr_rcf ^= htons(TOKEN_RCF_DIRECTION);
1127 					rif->tr_rcf &= htons(~TOKEN_RCF_BROADCAST_MASK);
1128 					bcopy(rif, TOKEN_RIF(la), riflen);
1129 				}
1130 			}
1131 		}
1132 #endif /* NTOKEN > 0 */
1133 		(void)sockaddr_dl_setaddr(sdl, sdl->sdl_len, ar_sha(ah),
1134 		    ah->ar_hln);
1135 		if (rt->rt_expire)
1136 			rt->rt_expire = time_second + arpt_keep;
1137 		rt->rt_flags &= ~RTF_REJECT;
1138 		la->la_asked = 0;
1139 
1140 		s = splnet();
1141 		mold = la->la_hold;
1142 		la->la_hold = 0;
1143 		splx(s);
1144 
1145 		if (mold) {
1146 			ARP_STATINC(ARP_STAT_DFRSENT);
1147 			(*ifp->if_output)(ifp, mold, rt_getkey(rt), rt);
1148 		}
1149 	}
1150 reply:
1151 	if (op != ARPOP_REQUEST) {
1152 		if (op == ARPOP_REPLY)
1153 			ARP_STATINC(ARP_STAT_RCVREPLY);
1154 	out:
1155 		m_freem(m);
1156 		return;
1157 	}
1158 	ARP_STATINC(ARP_STAT_RCVREQUEST);
1159 	if (in_hosteq(itaddr, myaddr)) {
1160 		/* I am the target */
1161 		tha = ar_tha(ah);
1162 		if (tha)
1163 			memcpy(tha, ar_sha(ah), ah->ar_hln);
1164 		memcpy(ar_sha(ah), CLLADDR(ifp->if_sadl), ah->ar_hln);
1165 	} else {
1166 		la = arplookup(m, &itaddr, 0, SIN_PROXY);
1167 		if (la == 0)
1168 			goto out;
1169 		rt = la->la_rt;
1170 		if (rt->rt_ifp->if_type == IFT_CARP &&
1171 		    m->m_pkthdr.rcvif->if_type != IFT_CARP)
1172 			goto out;
1173 		tha = ar_tha(ah);
1174 		if (tha)
1175 			memcpy(tha, ar_sha(ah), ah->ar_hln);
1176 		sdl = satosdl(rt->rt_gateway);
1177 		memcpy(ar_sha(ah), CLLADDR(sdl), ah->ar_hln);
1178 	}
1179 
1180 	memcpy(ar_tpa(ah), ar_spa(ah), ah->ar_pln);
1181 	memcpy(ar_spa(ah), &itaddr, ah->ar_pln);
1182 	ah->ar_op = htons(ARPOP_REPLY);
1183 	ah->ar_pro = htons(ETHERTYPE_IP); /* let's be sure! */
1184 	switch (ifp->if_type) {
1185 	case IFT_IEEE1394:
1186 		/*
1187 		 * ieee1394 arp reply is broadcast
1188 		 */
1189 		m->m_flags &= ~M_MCAST;
1190 		m->m_flags |= M_BCAST;
1191 		m->m_len = sizeof(*ah) + (2 * ah->ar_pln) + ah->ar_hln;
1192 		break;
1193 
1194 	default:
1195 		m->m_flags &= ~(M_BCAST|M_MCAST); /* never reply by broadcast */
1196 		m->m_len = sizeof(*ah) + (2 * ah->ar_pln) + (2 * ah->ar_hln);
1197 		break;
1198 	}
1199 	m->m_pkthdr.len = m->m_len;
1200 	sa.sa_family = AF_ARP;
1201 	sa.sa_len = 2;
1202 	arps = ARP_STAT_GETREF();
1203 	arps[ARP_STAT_SNDTOTAL]++;
1204 	arps[ARP_STAT_SNDREPLY]++;
1205 	ARP_STAT_PUTREF();
1206 	(*ifp->if_output)(ifp, m, &sa, (struct rtentry *)0);
1207 	return;
1208 }
1209 
1210 /*
1211  * Free an arp entry.
1212  */
1213 static void arptfree(struct llinfo_arp *la)
1214 {
1215 	struct rtentry *rt = la->la_rt;
1216 	struct sockaddr_dl *sdl;
1217 
1218 	ARP_LOCK_CHECK();
1219 
1220 	if (rt == 0)
1221 		panic("arptfree");
1222 	if (rt->rt_refcnt > 0 && (sdl = satosdl(rt->rt_gateway)) &&
1223 	    sdl->sdl_family == AF_LINK) {
1224 		sdl->sdl_alen = 0;
1225 		la->la_asked = 0;
1226 		rt->rt_flags &= ~RTF_REJECT;
1227 		return;
1228 	}
1229 	rtrequest(RTM_DELETE, rt_getkey(rt), NULL, rt_mask(rt), 0, NULL);
1230 }
1231 
1232 static struct llinfo_arp *
1233 arplookup(struct mbuf *m, const struct in_addr *addr, int create, int proxy)
1234 {
1235 	return arplookup1(m, addr, create, proxy, NULL);
1236 }
1237 
1238 /*
1239  * Lookup or enter a new address in arptab.
1240  */
1241 static struct llinfo_arp *
1242 arplookup1(struct mbuf *m, const struct in_addr *addr, int create, int proxy,
1243     struct rtentry *rt0)
1244 {
1245 	struct arphdr *ah;
1246 	struct ifnet *ifp = m->m_pkthdr.rcvif;
1247 	struct rtentry *rt;
1248 	static struct sockaddr_inarp sin;
1249 	const char *why = 0;
1250 
1251 	ah = mtod(m, struct arphdr *);
1252 	if (rt0 == NULL) {
1253 		sin.sin_len = sizeof(sin);
1254 		sin.sin_family = AF_INET;
1255 		sin.sin_addr = *addr;
1256 		sin.sin_other = proxy ? SIN_PROXY : 0;
1257 		rt = rtalloc1(sintosa(&sin), create);
1258 		if (rt == NULL)
1259 			return (NULL);
1260 		rt->rt_refcnt--;
1261 	} else
1262 		rt = rt0;
1263 
1264 #define	IS_LLINFO(__rt)							  \
1265 	(((__rt)->rt_flags & (RTF_GATEWAY | RTF_LLINFO)) == RTF_LLINFO && \
1266 	 (__rt)->rt_gateway->sa_family == AF_LINK)
1267 
1268 
1269 	if (IS_LLINFO(rt))
1270 		return ((struct llinfo_arp *)rt->rt_llinfo);
1271 
1272 	if (create) {
1273 		if (rt->rt_flags & RTF_GATEWAY)
1274 			why = "host is not on local network";
1275 		else if ((rt->rt_flags & RTF_LLINFO) == 0) {
1276 			ARP_STATINC(ARP_STAT_ALLOCFAIL);
1277 			why = "could not allocate llinfo";
1278 		} else
1279 			why = "gateway route is not ours";
1280 		log(LOG_DEBUG, "arplookup: unable to enter address"
1281 		    " for %s@%s on %s (%s)\n",
1282 		    in_fmtaddr(*addr), lla_snprintf(ar_sha(ah), ah->ar_hln),
1283 		    (ifp) ? ifp->if_xname : 0, why);
1284 		if (rt->rt_refcnt <= 0 && (rt->rt_flags & RTF_CLONED) != 0) {
1285 			rtrequest(RTM_DELETE, rt_getkey(rt),
1286 		    	    rt->rt_gateway, rt_mask(rt), rt->rt_flags, 0);
1287 		}
1288 	}
1289 	return (0);
1290 }
1291 
1292 int
1293 arpioctl(u_long cmd, void *data)
1294 {
1295 
1296 	return (EOPNOTSUPP);
1297 }
1298 
1299 void
1300 arp_ifinit(struct ifnet *ifp, struct ifaddr *ifa)
1301 {
1302 	struct in_addr *ip;
1303 
1304 	/*
1305 	 * Warn the user if another station has this IP address,
1306 	 * but only if the interface IP address is not zero.
1307 	 */
1308 	ip = &IA_SIN(ifa)->sin_addr;
1309 	if (!in_nullhost(*ip))
1310 		arprequest(ifp, ip, ip, CLLADDR(ifp->if_sadl));
1311 
1312 	ifa->ifa_rtrequest = arp_rtrequest;
1313 	ifa->ifa_flags |= RTF_CLONING;
1314 }
1315 
1316 /*
1317  * Called from 10 Mb/s Ethernet interrupt handlers
1318  * when ether packet type ETHERTYPE_REVARP
1319  * is received.  Common length and type checks are done here,
1320  * then the protocol-specific routine is called.
1321  */
1322 void
1323 revarpinput(struct mbuf *m)
1324 {
1325 	struct arphdr *ar;
1326 
1327 	if (m->m_len < sizeof(struct arphdr))
1328 		goto out;
1329 	ar = mtod(m, struct arphdr *);
1330 #if 0 /* XXX I don't think we need this... and it will prevent other LL */
1331 	if (ntohs(ar->ar_hrd) != ARPHRD_ETHER)
1332 		goto out;
1333 #endif
1334 	if (m->m_len < sizeof(struct arphdr) + 2 * (ar->ar_hln + ar->ar_pln))
1335 		goto out;
1336 	switch (ntohs(ar->ar_pro)) {
1337 	case ETHERTYPE_IP:
1338 	case ETHERTYPE_IPTRAILERS:
1339 		in_revarpinput(m);
1340 		return;
1341 
1342 	default:
1343 		break;
1344 	}
1345 out:
1346 	m_freem(m);
1347 }
1348 
1349 /*
1350  * RARP for Internet protocols on 10 Mb/s Ethernet.
1351  * Algorithm is that given in RFC 903.
1352  * We are only using for bootstrap purposes to get an ip address for one of
1353  * our interfaces.  Thus we support no user-interface.
1354  *
1355  * Since the contents of the RARP reply are specific to the interface that
1356  * sent the request, this code must ensure that they are properly associated.
1357  *
1358  * Note: also supports ARP via RARP packets, per the RFC.
1359  */
1360 void
1361 in_revarpinput(struct mbuf *m)
1362 {
1363 	struct ifnet *ifp;
1364 	struct arphdr *ah;
1365 	void *tha;
1366 	int op;
1367 
1368 	ah = mtod(m, struct arphdr *);
1369 	op = ntohs(ah->ar_op);
1370 
1371 	switch (m->m_pkthdr.rcvif->if_type) {
1372 	case IFT_IEEE1394:
1373 		/* ARP without target hardware address is not supported */
1374 		goto out;
1375 	default:
1376 		break;
1377 	}
1378 
1379 	switch (op) {
1380 	case ARPOP_REQUEST:
1381 	case ARPOP_REPLY:	/* per RFC */
1382 		in_arpinput(m);
1383 		return;
1384 	case ARPOP_REVREPLY:
1385 		break;
1386 	case ARPOP_REVREQUEST:	/* handled by rarpd(8) */
1387 	default:
1388 		goto out;
1389 	}
1390 	if (!revarp_in_progress)
1391 		goto out;
1392 	ifp = m->m_pkthdr.rcvif;
1393 	if (ifp != myip_ifp) /* !same interface */
1394 		goto out;
1395 	if (myip_initialized)
1396 		goto wake;
1397 	tha = ar_tha(ah);
1398 	KASSERT(tha);
1399 	if (bcmp(tha, CLLADDR(ifp->if_sadl), ifp->if_sadl->sdl_alen))
1400 		goto out;
1401 	memcpy(&srv_ip, ar_spa(ah), sizeof(srv_ip));
1402 	memcpy(&myip, ar_tpa(ah), sizeof(myip));
1403 	myip_initialized = 1;
1404 wake:	/* Do wakeup every time in case it was missed. */
1405 	wakeup((void *)&myip);
1406 
1407 out:
1408 	m_freem(m);
1409 }
1410 
1411 /*
1412  * Send a RARP request for the ip address of the specified interface.
1413  * The request should be RFC 903-compliant.
1414  */
1415 void
1416 revarprequest(struct ifnet *ifp)
1417 {
1418 	struct sockaddr sa;
1419 	struct mbuf *m;
1420 	struct arphdr *ah;
1421 	void *tha;
1422 
1423 	if ((m = m_gethdr(M_DONTWAIT, MT_DATA)) == NULL)
1424 		return;
1425 	MCLAIM(m, &arpdomain.dom_mowner);
1426 	m->m_len = sizeof(*ah) + 2*sizeof(struct in_addr) +
1427 	    2*ifp->if_addrlen;
1428 	m->m_pkthdr.len = m->m_len;
1429 	MH_ALIGN(m, m->m_len);
1430 	ah = mtod(m, struct arphdr *);
1431 	bzero((void *)ah, m->m_len);
1432 	ah->ar_pro = htons(ETHERTYPE_IP);
1433 	ah->ar_hln = ifp->if_addrlen;		/* hardware address length */
1434 	ah->ar_pln = sizeof(struct in_addr);	/* protocol address length */
1435 	ah->ar_op = htons(ARPOP_REVREQUEST);
1436 
1437 	memcpy(ar_sha(ah), CLLADDR(ifp->if_sadl), ah->ar_hln);
1438 	tha = ar_tha(ah);
1439 	KASSERT(tha);
1440 	bcopy(CLLADDR(ifp->if_sadl), tha, ah->ar_hln);
1441 
1442 	sa.sa_family = AF_ARP;
1443 	sa.sa_len = 2;
1444 	m->m_flags |= M_BCAST;
1445 	(*ifp->if_output)(ifp, m, &sa, (struct rtentry *)0);
1446 
1447 }
1448 
1449 /*
1450  * RARP for the ip address of the specified interface, but also
1451  * save the ip address of the server that sent the answer.
1452  * Timeout if no response is received.
1453  */
1454 int
1455 revarpwhoarewe(struct ifnet *ifp, struct in_addr *serv_in,
1456     struct in_addr *clnt_in)
1457 {
1458 	int result, count = 20;
1459 
1460 	myip_initialized = 0;
1461 	myip_ifp = ifp;
1462 
1463 	revarp_in_progress = 1;
1464 	while (count--) {
1465 		revarprequest(ifp);
1466 		result = tsleep((void *)&myip, PSOCK, "revarp", hz/2);
1467 		if (result != EWOULDBLOCK)
1468 			break;
1469 	}
1470 	revarp_in_progress = 0;
1471 
1472 	if (!myip_initialized)
1473 		return ENETUNREACH;
1474 
1475 	bcopy((void *)&srv_ip, serv_in, sizeof(*serv_in));
1476 	bcopy((void *)&myip, clnt_in, sizeof(*clnt_in));
1477 	return 0;
1478 }
1479 
1480 
1481 
1482 #ifdef DDB
1483 
1484 #include <machine/db_machdep.h>
1485 #include <ddb/db_interface.h>
1486 #include <ddb/db_output.h>
1487 
1488 static void
1489 db_print_sa(const struct sockaddr *sa)
1490 {
1491 	int len;
1492 	const u_char *p;
1493 
1494 	if (sa == 0) {
1495 		db_printf("[NULL]");
1496 		return;
1497 	}
1498 
1499 	p = (const u_char *)sa;
1500 	len = sa->sa_len;
1501 	db_printf("[");
1502 	while (len > 0) {
1503 		db_printf("%d", *p);
1504 		p++; len--;
1505 		if (len) db_printf(",");
1506 	}
1507 	db_printf("]\n");
1508 }
1509 
1510 static void
1511 db_print_ifa(struct ifaddr *ifa)
1512 {
1513 	if (ifa == 0)
1514 		return;
1515 	db_printf("  ifa_addr=");
1516 	db_print_sa(ifa->ifa_addr);
1517 	db_printf("  ifa_dsta=");
1518 	db_print_sa(ifa->ifa_dstaddr);
1519 	db_printf("  ifa_mask=");
1520 	db_print_sa(ifa->ifa_netmask);
1521 	db_printf("  flags=0x%x,refcnt=%d,metric=%d\n",
1522 			  ifa->ifa_flags,
1523 			  ifa->ifa_refcnt,
1524 			  ifa->ifa_metric);
1525 }
1526 
1527 static void
1528 db_print_llinfo(void *li)
1529 {
1530 	struct llinfo_arp *la;
1531 
1532 	if (li == 0)
1533 		return;
1534 	la = (struct llinfo_arp *)li;
1535 	db_printf("  la_rt=%p la_hold=%p, la_asked=0x%lx\n",
1536 			  la->la_rt, la->la_hold, la->la_asked);
1537 }
1538 
1539 /*
1540  * Function to pass to rt_walktree().
1541  * Return non-zero error to abort walk.
1542  */
1543 static int
1544 db_show_rtentry(struct rtentry *rt, void *w)
1545 {
1546 	db_printf("rtentry=%p", rt);
1547 
1548 	db_printf(" flags=0x%x refcnt=%d use=%ld expire=%ld\n",
1549 			  rt->rt_flags, rt->rt_refcnt,
1550 			  rt->rt_use, rt->rt_expire);
1551 
1552 	db_printf(" key="); db_print_sa(rt_getkey(rt));
1553 	db_printf(" mask="); db_print_sa(rt_mask(rt));
1554 	db_printf(" gw="); db_print_sa(rt->rt_gateway);
1555 
1556 	db_printf(" ifp=%p ", rt->rt_ifp);
1557 	if (rt->rt_ifp)
1558 		db_printf("(%s)", rt->rt_ifp->if_xname);
1559 	else
1560 		db_printf("(NULL)");
1561 
1562 	db_printf(" ifa=%p\n", rt->rt_ifa);
1563 	db_print_ifa(rt->rt_ifa);
1564 
1565 	db_printf(" gwroute=%p llinfo=%p\n",
1566 			  rt->rt_gwroute, rt->rt_llinfo);
1567 	db_print_llinfo(rt->rt_llinfo);
1568 
1569 	return (0);
1570 }
1571 
1572 /*
1573  * Function to print all the route trees.
1574  * Use this from ddb:  "show arptab"
1575  */
1576 void
1577 db_show_arptab(db_expr_t addr, bool have_addr,
1578     db_expr_t count, const char *modif)
1579 {
1580 	rt_walktree(AF_INET, db_show_rtentry, NULL);
1581 }
1582 #endif
1583 
1584 static int
1585 sysctl_net_inet_arp_stats(SYSCTLFN_ARGS)
1586 {
1587 	netstat_sysctl_context ctx;
1588 	uint64_t arps[ARP_NSTATS];
1589 
1590 	ctx.ctx_stat = arpstat_percpu;
1591 	ctx.ctx_counters = arps;
1592 	ctx.ctx_ncounters = ARP_NSTATS;
1593 	return (NETSTAT_SYSCTL(&ctx));
1594 }
1595 
1596 SYSCTL_SETUP(sysctl_net_inet_arp_setup, "sysctl net.inet.arp subtree setup")
1597 {
1598 	const struct sysctlnode *node;
1599 
1600 	sysctl_createv(clog, 0, NULL, NULL,
1601 			CTLFLAG_PERMANENT,
1602 			CTLTYPE_NODE, "net", NULL,
1603 			NULL, 0, NULL, 0,
1604 			CTL_NET, CTL_EOL);
1605 	sysctl_createv(clog, 0, NULL, NULL,
1606 			CTLFLAG_PERMANENT,
1607 			CTLTYPE_NODE, "inet", NULL,
1608 			NULL, 0, NULL, 0,
1609 			CTL_NET, PF_INET, CTL_EOL);
1610 	sysctl_createv(clog, 0, NULL, &node,
1611 			CTLFLAG_PERMANENT,
1612 			CTLTYPE_NODE, "arp",
1613 			SYSCTL_DESCR("Address Resolution Protocol"),
1614 			NULL, 0, NULL, 0,
1615 			CTL_NET, PF_INET, CTL_CREATE, CTL_EOL);
1616 
1617 	sysctl_createv(clog, 0, NULL, NULL,
1618 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1619 			CTLTYPE_INT, "prune",
1620 			SYSCTL_DESCR("ARP cache pruning interval"),
1621 			NULL, 0, &arpt_prune, 0,
1622 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1623 
1624 	sysctl_createv(clog, 0, NULL, NULL,
1625 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1626 			CTLTYPE_INT, "keep",
1627 			SYSCTL_DESCR("Valid ARP entry lifetime"),
1628 			NULL, 0, &arpt_keep, 0,
1629 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1630 
1631 	sysctl_createv(clog, 0, NULL, NULL,
1632 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1633 			CTLTYPE_INT, "down",
1634 			SYSCTL_DESCR("Failed ARP entry lifetime"),
1635 			NULL, 0, &arpt_down, 0,
1636 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1637 
1638 	sysctl_createv(clog, 0, NULL, NULL,
1639 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1640 			CTLTYPE_INT, "refresh",
1641 			SYSCTL_DESCR("ARP entry refresh interval"),
1642 			NULL, 0, &arpt_refresh, 0,
1643 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1644 
1645 	sysctl_createv(clog, 0, NULL, NULL,
1646 			CTLFLAG_PERMANENT,
1647 			CTLTYPE_STRUCT, "stats",
1648 			SYSCTL_DESCR("ARP statistics"),
1649 			sysctl_net_inet_arp_stats, 0, NULL, 0,
1650 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1651 }
1652 
1653 #endif /* INET */
1654