xref: /netbsd-src/sys/netinet/if_arp.c (revision a24efa7dea9f1f56c3bdb15a927d3516792ace1c)
1 /*	$NetBSD: if_arp.c,v 1.210 2016/05/17 09:00:24 ozaki-r Exp $	*/
2 
3 /*-
4  * Copyright (c) 1998, 2000, 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Public Access Networks Corporation ("Panix").  It was developed under
9  * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)if_ether.c	8.2 (Berkeley) 9/26/94
62  */
63 
64 /*
65  * Ethernet address resolution protocol.
66  * TODO:
67  *	add "inuse/lock" bit (or ref. count) along with valid bit
68  */
69 
70 #include <sys/cdefs.h>
71 __KERNEL_RCSID(0, "$NetBSD: if_arp.c,v 1.210 2016/05/17 09:00:24 ozaki-r Exp $");
72 
73 #ifdef _KERNEL_OPT
74 #include "opt_ddb.h"
75 #include "opt_inet.h"
76 #endif
77 
78 #ifdef INET
79 
80 #include "bridge.h"
81 
82 #include <sys/param.h>
83 #include <sys/systm.h>
84 #include <sys/callout.h>
85 #include <sys/malloc.h>
86 #include <sys/mbuf.h>
87 #include <sys/socket.h>
88 #include <sys/time.h>
89 #include <sys/timetc.h>
90 #include <sys/kernel.h>
91 #include <sys/errno.h>
92 #include <sys/ioctl.h>
93 #include <sys/syslog.h>
94 #include <sys/proc.h>
95 #include <sys/protosw.h>
96 #include <sys/domain.h>
97 #include <sys/sysctl.h>
98 #include <sys/socketvar.h>
99 #include <sys/percpu.h>
100 #include <sys/cprng.h>
101 #include <sys/kmem.h>
102 
103 #include <net/ethertypes.h>
104 #include <net/if.h>
105 #include <net/if_dl.h>
106 #include <net/if_token.h>
107 #include <net/if_types.h>
108 #include <net/if_ether.h>
109 #include <net/if_llatbl.h>
110 #include <net/net_osdep.h>
111 #include <net/route.h>
112 #include <net/net_stats.h>
113 
114 #include <netinet/in.h>
115 #include <netinet/in_systm.h>
116 #include <netinet/in_var.h>
117 #include <netinet/ip.h>
118 #include <netinet/if_inarp.h>
119 
120 #include "arcnet.h"
121 #if NARCNET > 0
122 #include <net/if_arc.h>
123 #endif
124 #include "fddi.h"
125 #if NFDDI > 0
126 #include <net/if_fddi.h>
127 #endif
128 #include "token.h"
129 #include "carp.h"
130 #if NCARP > 0
131 #include <netinet/ip_carp.h>
132 #endif
133 
134 #define SIN(s) ((struct sockaddr_in *)s)
135 #define SRP(s) ((struct sockaddr_inarp *)s)
136 
137 /*
138  * ARP trailer negotiation.  Trailer protocol is not IP specific,
139  * but ARP request/response use IP addresses.
140  */
141 #define ETHERTYPE_IPTRAILERS ETHERTYPE_TRAIL
142 
143 /* timer values */
144 static int	arpt_keep = (20*60);	/* once resolved, good for 20 more minutes */
145 static int	arpt_down = 20;		/* once declared down, don't send for 20 secs */
146 static int	arp_maxhold = 1;	/* number of packets to hold per ARP entry */
147 #define	rt_expire rt_rmx.rmx_expire
148 #define	rt_pksent rt_rmx.rmx_pksent
149 
150 int		ip_dad_count = PROBE_NUM;
151 #ifdef ARP_DEBUG
152 static int	arp_debug = 1;
153 #else
154 static int	arp_debug = 0;
155 #endif
156 #define arplog(x)	do { if (arp_debug) log x; } while (/*CONSTCOND*/ 0)
157 
158 static	void arp_init(void);
159 
160 static	struct sockaddr *arp_setgate(struct rtentry *, struct sockaddr *,
161 	    const struct sockaddr *);
162 static	void arptimer(void *);
163 static	void arp_settimer(struct llentry *, int);
164 static	struct llentry *arplookup(struct ifnet *, struct mbuf *,
165 	    const struct in_addr *, const struct sockaddr *, int);
166 static	struct llentry *arpcreate(struct ifnet *, struct mbuf *,
167 	    const struct in_addr *, const struct sockaddr *, int);
168 static	void in_arpinput(struct mbuf *);
169 static	void in_revarpinput(struct mbuf *);
170 static	void revarprequest(struct ifnet *);
171 
172 static	void arp_drainstub(void);
173 
174 static void arp_dad_timer(struct ifaddr *);
175 static void arp_dad_start(struct ifaddr *);
176 static void arp_dad_stop(struct ifaddr *);
177 static void arp_dad_duplicated(struct ifaddr *);
178 
179 static void arp_init_llentry(struct ifnet *, struct llentry *);
180 #if NTOKEN > 0
181 static void arp_free_llentry_tokenring(struct llentry *);
182 #endif
183 
184 struct	ifqueue arpintrq = {
185 	.ifq_head = NULL,
186 	.ifq_tail = NULL,
187 	.ifq_len = 0,
188 	.ifq_maxlen = 50,
189 	.ifq_drops = 0,
190 };
191 static int	arp_maxtries = 5;
192 static int	useloopback = 1;	/* use loopback interface for local traffic */
193 
194 static percpu_t *arpstat_percpu;
195 
196 #define	ARP_STAT_GETREF()	_NET_STAT_GETREF(arpstat_percpu)
197 #define	ARP_STAT_PUTREF()	_NET_STAT_PUTREF(arpstat_percpu)
198 
199 #define	ARP_STATINC(x)		_NET_STATINC(arpstat_percpu, x)
200 #define	ARP_STATADD(x, v)	_NET_STATADD(arpstat_percpu, x, v)
201 
202 /* revarp state */
203 static struct	in_addr myip, srv_ip;
204 static int	myip_initialized = 0;
205 static int	revarp_in_progress = 0;
206 static struct	ifnet *myip_ifp = NULL;
207 
208 static int arp_drainwanted;
209 
210 static int log_movements = 1;
211 static int log_permanent_modify = 1;
212 static int log_wrong_iface = 1;
213 static int log_unknown_network = 1;
214 
215 /*
216  * this should be elsewhere.
217  */
218 
219 static char *
220 lla_snprintf(u_int8_t *, int);
221 
222 static char *
223 lla_snprintf(u_int8_t *adrp, int len)
224 {
225 #define NUMBUFS 3
226 	static char buf[NUMBUFS][16*3];
227 	static int bnum = 0;
228 
229 	int i;
230 	char *p;
231 
232 	p = buf[bnum];
233 
234 	*p++ = hexdigits[(*adrp)>>4];
235 	*p++ = hexdigits[(*adrp++)&0xf];
236 
237 	for (i=1; i<len && i<16; i++) {
238 		*p++ = ':';
239 		*p++ = hexdigits[(*adrp)>>4];
240 		*p++ = hexdigits[(*adrp++)&0xf];
241 	}
242 
243 	*p = 0;
244 	p = buf[bnum];
245 	bnum = (bnum + 1) % NUMBUFS;
246 	return p;
247 }
248 
249 DOMAIN_DEFINE(arpdomain);	/* forward declare and add to link set */
250 
251 static void
252 arp_fasttimo(void)
253 {
254 	if (arp_drainwanted) {
255 		arp_drain();
256 		arp_drainwanted = 0;
257 	}
258 }
259 
260 const struct protosw arpsw[] = {
261 	{ .pr_type = 0,
262 	  .pr_domain = &arpdomain,
263 	  .pr_protocol = 0,
264 	  .pr_flags = 0,
265 	  .pr_input = 0,
266 	  .pr_ctlinput = 0,
267 	  .pr_ctloutput = 0,
268 	  .pr_usrreqs = 0,
269 	  .pr_init = arp_init,
270 	  .pr_fasttimo = arp_fasttimo,
271 	  .pr_slowtimo = 0,
272 	  .pr_drain = arp_drainstub,
273 	}
274 };
275 
276 struct domain arpdomain = {
277 	.dom_family = PF_ARP,
278 	.dom_name = "arp",
279 	.dom_protosw = arpsw,
280 	.dom_protoswNPROTOSW = &arpsw[__arraycount(arpsw)],
281 };
282 
283 static void sysctl_net_inet_arp_setup(struct sysctllog **);
284 
285 void
286 arp_init(void)
287 {
288 
289 	sysctl_net_inet_arp_setup(NULL);
290 	arpstat_percpu = percpu_alloc(sizeof(uint64_t) * ARP_NSTATS);
291 }
292 
293 static void
294 arp_drainstub(void)
295 {
296 	arp_drainwanted = 1;
297 }
298 
299 /*
300  * ARP protocol drain routine.  Called when memory is in short supply.
301  * Called at splvm();  don't acquire softnet_lock as can be called from
302  * hardware interrupt handlers.
303  */
304 void
305 arp_drain(void)
306 {
307 
308 	lltable_drain(AF_INET);
309 }
310 
311 static void
312 arptimer(void *arg)
313 {
314 	struct llentry *lle = arg;
315 	struct ifnet *ifp;
316 
317 	if (lle == NULL)
318 		return;
319 
320 	if (lle->la_flags & LLE_STATIC)
321 		return;
322 
323 	LLE_WLOCK(lle);
324 	if (callout_pending(&lle->la_timer)) {
325 		/*
326 		 * Here we are a bit odd here in the treatment of
327 		 * active/pending. If the pending bit is set, it got
328 		 * rescheduled before I ran. The active
329 		 * bit we ignore, since if it was stopped
330 		 * in ll_tablefree() and was currently running
331 		 * it would have return 0 so the code would
332 		 * not have deleted it since the callout could
333 		 * not be stopped so we want to go through
334 		 * with the delete here now. If the callout
335 		 * was restarted, the pending bit will be back on and
336 		 * we just want to bail since the callout_reset would
337 		 * return 1 and our reference would have been removed
338 		 * by arpresolve() below.
339 		 */
340 		LLE_WUNLOCK(lle);
341 		return;
342 	}
343 	ifp = lle->lle_tbl->llt_ifp;
344 
345 	callout_stop(&lle->la_timer);
346 
347 	/* XXX: LOR avoidance. We still have ref on lle. */
348 	LLE_WUNLOCK(lle);
349 
350 	IF_AFDATA_LOCK(ifp);
351 	LLE_WLOCK(lle);
352 
353 	/* Guard against race with other llentry_free(). */
354 	if (lle->la_flags & LLE_LINKED) {
355 		size_t pkts_dropped;
356 
357 		LLE_REMREF(lle);
358 		pkts_dropped = llentry_free(lle);
359 		ARP_STATADD(ARP_STAT_DFRDROPPED, pkts_dropped);
360 	} else {
361 		LLE_FREE_LOCKED(lle);
362 	}
363 
364 	IF_AFDATA_UNLOCK(ifp);
365 }
366 
367 static void
368 arp_settimer(struct llentry *la, int sec)
369 {
370 
371 	LLE_WLOCK_ASSERT(la);
372 	LLE_ADDREF(la);
373 	callout_reset(&la->la_timer, hz * sec, arptimer, la);
374 }
375 
376 /*
377  * We set the gateway for RTF_CLONING routes to a "prototype"
378  * link-layer sockaddr whose interface type (if_type) and interface
379  * index (if_index) fields are prepared.
380  */
381 static struct sockaddr *
382 arp_setgate(struct rtentry *rt, struct sockaddr *gate,
383     const struct sockaddr *netmask)
384 {
385 	const struct ifnet *ifp = rt->rt_ifp;
386 	uint8_t namelen = strlen(ifp->if_xname);
387 	uint8_t addrlen = ifp->if_addrlen;
388 
389 	/*
390 	 * XXX: If this is a manually added route to interface
391 	 * such as older version of routed or gated might provide,
392 	 * restore cloning bit.
393 	 */
394 	if ((rt->rt_flags & RTF_HOST) == 0 && netmask != NULL &&
395 	    satocsin(netmask)->sin_addr.s_addr != 0xffffffff)
396 		rt->rt_flags |= RTF_CONNECTED;
397 
398 	if ((rt->rt_flags & (RTF_CONNECTED | RTF_LOCAL))) {
399 		union {
400 			struct sockaddr sa;
401 			struct sockaddr_storage ss;
402 			struct sockaddr_dl sdl;
403 		} u;
404 		/*
405 		 * Case 1: This route should come from a route to iface.
406 		 */
407 		sockaddr_dl_init(&u.sdl, sizeof(u.ss),
408 		    ifp->if_index, ifp->if_type, NULL, namelen, NULL, addrlen);
409 		rt_setgate(rt, &u.sa);
410 		gate = rt->rt_gateway;
411 	}
412 	return gate;
413 }
414 
415 static void
416 arp_init_llentry(struct ifnet *ifp, struct llentry *lle)
417 {
418 
419 	switch (ifp->if_type) {
420 #if NTOKEN > 0
421 	case IFT_ISO88025:
422 		lle->la_opaque = kmem_intr_alloc(sizeof(struct token_rif),
423 		    KM_NOSLEEP);
424 		lle->lle_ll_free = arp_free_llentry_tokenring;
425 		break;
426 #endif
427 	}
428 }
429 
430 #if NTOKEN > 0
431 static void
432 arp_free_llentry_tokenring(struct llentry *lle)
433 {
434 
435 	kmem_intr_free(lle->la_opaque, sizeof(struct token_rif));
436 }
437 #endif
438 
439 /*
440  * Parallel to llc_rtrequest.
441  */
442 void
443 arp_rtrequest(int req, struct rtentry *rt, const struct rt_addrinfo *info)
444 {
445 	struct sockaddr *gate = rt->rt_gateway;
446 	struct in_ifaddr *ia;
447 	struct ifaddr *ifa;
448 	struct ifnet *ifp = rt->rt_ifp;
449 
450 	if (req == RTM_LLINFO_UPD) {
451 		struct in_addr *in;
452 
453 		if ((ifa = info->rti_ifa) == NULL)
454 			return;
455 
456 		in = &ifatoia(ifa)->ia_addr.sin_addr;
457 
458 		if (ifatoia(ifa)->ia4_flags &
459 		    (IN_IFF_NOTREADY | IN_IFF_DETACHED))
460 		{
461 			arplog((LOG_DEBUG, "arp_request: %s not ready\n",
462 			   in_fmtaddr(*in)));
463 			return;
464 		}
465 
466 		arprequest(ifa->ifa_ifp, in, in,
467 		    CLLADDR(ifa->ifa_ifp->if_sadl));
468 		return;
469 	}
470 
471 	if ((rt->rt_flags & RTF_GATEWAY) != 0) {
472 		if (req != RTM_ADD)
473 			return;
474 
475 		/*
476 		 * linklayers with particular link MTU limitation.
477 		 */
478 		switch(ifp->if_type) {
479 #if NFDDI > 0
480 		case IFT_FDDI:
481 			if (ifp->if_mtu > FDDIIPMTU)
482 				rt->rt_rmx.rmx_mtu = FDDIIPMTU;
483 			break;
484 #endif
485 #if NARCNET > 0
486 		case IFT_ARCNET:
487 		    {
488 			int arcipifmtu;
489 
490 			if (ifp->if_flags & IFF_LINK0)
491 				arcipifmtu = arc_ipmtu;
492 			else
493 				arcipifmtu = ARCMTU;
494 			if (ifp->if_mtu > arcipifmtu)
495 				rt->rt_rmx.rmx_mtu = arcipifmtu;
496 			break;
497 		    }
498 #endif
499 		}
500 		return;
501 	}
502 
503 	switch (req) {
504 	case RTM_SETGATE:
505 		gate = arp_setgate(rt, gate, info->rti_info[RTAX_NETMASK]);
506 		break;
507 	case RTM_ADD:
508 		gate = arp_setgate(rt, gate, info->rti_info[RTAX_NETMASK]);
509 		if (gate == NULL) {
510 			log(LOG_ERR, "%s: arp_setgate failed\n", __func__);
511 			break;
512 		}
513 		if ((rt->rt_flags & RTF_CONNECTED) ||
514 		    (rt->rt_flags & RTF_LOCAL)) {
515 			/*
516 			 * Give this route an expiration time, even though
517 			 * it's a "permanent" route, so that routes cloned
518 			 * from it do not need their expiration time set.
519 			 */
520 			KASSERT(time_uptime != 0);
521 			rt->rt_expire = time_uptime;
522 			/*
523 			 * linklayers with particular link MTU limitation.
524 			 */
525 			switch (ifp->if_type) {
526 #if NFDDI > 0
527 			case IFT_FDDI:
528 				if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0 &&
529 				    (rt->rt_rmx.rmx_mtu > FDDIIPMTU ||
530 				     (rt->rt_rmx.rmx_mtu == 0 &&
531 				      ifp->if_mtu > FDDIIPMTU)))
532 					rt->rt_rmx.rmx_mtu = FDDIIPMTU;
533 				break;
534 #endif
535 #if NARCNET > 0
536 			case IFT_ARCNET:
537 			    {
538 				int arcipifmtu;
539 				if (ifp->if_flags & IFF_LINK0)
540 					arcipifmtu = arc_ipmtu;
541 				else
542 					arcipifmtu = ARCMTU;
543 
544 				if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0 &&
545 				    (rt->rt_rmx.rmx_mtu > arcipifmtu ||
546 				     (rt->rt_rmx.rmx_mtu == 0 &&
547 				      ifp->if_mtu > arcipifmtu)))
548 					rt->rt_rmx.rmx_mtu = arcipifmtu;
549 				break;
550 			    }
551 #endif
552 			}
553 			if (rt->rt_flags & RTF_CONNECTED)
554 				break;
555 		}
556 		/* Announce a new entry if requested. */
557 		if (rt->rt_flags & RTF_ANNOUNCE) {
558 			INADDR_TO_IA(satocsin(rt_getkey(rt))->sin_addr, ia);
559 			while (ia && ia->ia_ifp != ifp)
560 				NEXT_IA_WITH_SAME_ADDR(ia);
561 			if (ia == NULL ||
562 			    ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
563 				;
564 			else
565 				arprequest(ifp,
566 				    &satocsin(rt_getkey(rt))->sin_addr,
567 				    &satocsin(rt_getkey(rt))->sin_addr,
568 				    CLLADDR(satocsdl(gate)));
569 		}
570 
571 		if (gate->sa_family != AF_LINK ||
572 		    gate->sa_len < sockaddr_dl_measure(0, ifp->if_addrlen)) {
573 			log(LOG_DEBUG, "%s: bad gateway value\n", __func__);
574 			break;
575 		}
576 
577 		satosdl(gate)->sdl_type = ifp->if_type;
578 		satosdl(gate)->sdl_index = ifp->if_index;
579 
580 		/* If the route is for a broadcast address mark it as such.
581 		 * This way we can avoid an expensive call to in_broadcast()
582 		 * in ip_output() most of the time (because the route passed
583 		 * to ip_output() is almost always a host route). */
584 		if (rt->rt_flags & RTF_HOST &&
585 		    !(rt->rt_flags & RTF_BROADCAST) &&
586 		    in_broadcast(satocsin(rt_getkey(rt))->sin_addr, rt->rt_ifp))
587 			rt->rt_flags |= RTF_BROADCAST;
588 		/* There is little point in resolving the broadcast address */
589 		if (rt->rt_flags & RTF_BROADCAST)
590 			break;
591 
592 		INADDR_TO_IA(satocsin(rt_getkey(rt))->sin_addr, ia);
593 		while (ia && ia->ia_ifp != ifp)
594 			NEXT_IA_WITH_SAME_ADDR(ia);
595 
596 		if (ia == NULL)
597 			break;
598 
599 		rt->rt_expire = 0;
600 		if (useloopback) {
601 			rt->rt_ifp = lo0ifp;
602 			rt->rt_rmx.rmx_mtu = 0;
603 		}
604 		rt->rt_flags |= RTF_LOCAL;
605 		/*
606 		 * make sure to set rt->rt_ifa to the interface
607 		 * address we are using, otherwise we will have trouble
608 		 * with source address selection.
609 		 */
610 		ifa = &ia->ia_ifa;
611 		if (ifa != rt->rt_ifa)
612 			rt_replace_ifa(rt, ifa);
613 		break;
614 	}
615 }
616 
617 /*
618  * Broadcast an ARP request. Caller specifies:
619  *	- arp header source ip address
620  *	- arp header target ip address
621  *	- arp header source ethernet address
622  */
623 void
624 arprequest(struct ifnet *ifp,
625     const struct in_addr *sip, const struct in_addr *tip,
626     const u_int8_t *enaddr)
627 {
628 	struct mbuf *m;
629 	struct arphdr *ah;
630 	struct sockaddr sa;
631 	uint64_t *arps;
632 
633 	KASSERT(sip != NULL);
634 	KASSERT(tip != NULL);
635 	KASSERT(enaddr != NULL);
636 
637 	if ((m = m_gethdr(M_DONTWAIT, MT_DATA)) == NULL)
638 		return;
639 	MCLAIM(m, &arpdomain.dom_mowner);
640 	switch (ifp->if_type) {
641 	case IFT_IEEE1394:
642 		m->m_len = sizeof(*ah) + 2 * sizeof(struct in_addr) +
643 		    ifp->if_addrlen;
644 		break;
645 	default:
646 		m->m_len = sizeof(*ah) + 2 * sizeof(struct in_addr) +
647 		    2 * ifp->if_addrlen;
648 		break;
649 	}
650 	m->m_pkthdr.len = m->m_len;
651 	MH_ALIGN(m, m->m_len);
652 	ah = mtod(m, struct arphdr *);
653 	memset(ah, 0, m->m_len);
654 	switch (ifp->if_type) {
655 	case IFT_IEEE1394:	/* RFC2734 */
656 		/* fill it now for ar_tpa computation */
657 		ah->ar_hrd = htons(ARPHRD_IEEE1394);
658 		break;
659 	default:
660 		/* ifp->if_output will fill ar_hrd */
661 		break;
662 	}
663 	ah->ar_pro = htons(ETHERTYPE_IP);
664 	ah->ar_hln = ifp->if_addrlen;		/* hardware address length */
665 	ah->ar_pln = sizeof(struct in_addr);	/* protocol address length */
666 	ah->ar_op = htons(ARPOP_REQUEST);
667 	memcpy(ar_sha(ah), enaddr, ah->ar_hln);
668 	memcpy(ar_spa(ah), sip, ah->ar_pln);
669 	memcpy(ar_tpa(ah), tip, ah->ar_pln);
670 	sa.sa_family = AF_ARP;
671 	sa.sa_len = 2;
672 	m->m_flags |= M_BCAST;
673 	arps = ARP_STAT_GETREF();
674 	arps[ARP_STAT_SNDTOTAL]++;
675 	arps[ARP_STAT_SENDREQUEST]++;
676 	ARP_STAT_PUTREF();
677 	(*ifp->if_output)(ifp, m, &sa, NULL);
678 }
679 
680 /*
681  * Resolve an IP address into an ethernet address.  If success,
682  * desten is filled in.  If there is no entry in arptab,
683  * set one up and broadcast a request for the IP address.
684  * Hold onto this mbuf and resend it once the address
685  * is finally resolved.  A return value of 0 indicates
686  * that desten has been filled in and the packet should be sent
687  * normally; a return value of EWOULDBLOCK indicates that the packet has been
688  * held pending resolution.
689  * Any other value indicates an error.
690  */
691 int
692 arpresolve(struct ifnet *ifp, const struct rtentry *rt, struct mbuf *m,
693     const struct sockaddr *dst, void *desten, size_t destlen)
694 {
695 	struct llentry *la;
696 	const char *create_lookup;
697 	bool renew;
698 	int error;
699 
700 	KASSERT(m != NULL);
701 
702 	la = arplookup(ifp, m, NULL, dst, 0);
703 	if (la == NULL)
704 		goto notfound;
705 
706 	if ((la->la_flags & LLE_VALID) &&
707 	    ((la->la_flags & LLE_STATIC) || la->la_expire > time_uptime)) {
708 		KASSERT(destlen >= ifp->if_addrlen);
709 		memcpy(desten, &la->ll_addr, ifp->if_addrlen);
710 		LLE_RUNLOCK(la);
711 		return 0;
712 	}
713 
714 notfound:
715 #ifdef IFF_STATICARP /* FreeBSD */
716 #define _IFF_NOARP (IFF_NOARP | IFF_STATICARP)
717 #else
718 #define _IFF_NOARP IFF_NOARP
719 #endif
720 	if (ifp->if_flags & _IFF_NOARP) {
721 		if (la != NULL)
722 			LLE_RUNLOCK(la);
723 		error = ENOTSUP;
724 		goto bad;
725 	}
726 #undef _IFF_NOARP
727 	if (la == NULL) {
728 		create_lookup = "create";
729 		IF_AFDATA_WLOCK(ifp);
730 		la = lla_create(LLTABLE(ifp), LLE_EXCLUSIVE, dst);
731 		IF_AFDATA_WUNLOCK(ifp);
732 		if (la == NULL)
733 			ARP_STATINC(ARP_STAT_ALLOCFAIL);
734 		else
735 			arp_init_llentry(ifp, la);
736 	} else if (LLE_TRY_UPGRADE(la) == 0) {
737 		create_lookup = "lookup";
738 		LLE_RUNLOCK(la);
739 		IF_AFDATA_RLOCK(ifp);
740 		la = lla_lookup(LLTABLE(ifp), LLE_EXCLUSIVE, dst);
741 		IF_AFDATA_RUNLOCK(ifp);
742 	}
743 
744 	error = EINVAL;
745 	if (la == NULL) {
746 		log(LOG_DEBUG,
747 		    "%s: failed to %s llentry for %s on %s\n",
748 		    __func__, create_lookup, inet_ntoa(satocsin(dst)->sin_addr),
749 		    ifp->if_xname);
750 		goto bad;
751 	}
752 
753 	if ((la->la_flags & LLE_VALID) &&
754 	    ((la->la_flags & LLE_STATIC) || la->la_expire > time_uptime))
755 	{
756 		KASSERT(destlen >= ifp->if_addrlen);
757 		memcpy(desten, &la->ll_addr, ifp->if_addrlen);
758 		renew = false;
759 		/*
760 		 * If entry has an expiry time and it is approaching,
761 		 * see if we need to send an ARP request within this
762 		 * arpt_down interval.
763 		 */
764 		if (!(la->la_flags & LLE_STATIC) &&
765 		    time_uptime + la->la_preempt > la->la_expire)
766 		{
767 			renew = true;
768 			la->la_preempt--;
769 		}
770 
771 		LLE_WUNLOCK(la);
772 
773 		if (renew) {
774 			const u_int8_t *enaddr =
775 #if NCARP > 0
776 			    (ifp->if_type == IFT_CARP) ?
777 			    CLLADDR(ifp->if_sadl):
778 #endif
779 			    CLLADDR(ifp->if_sadl);
780 			arprequest(ifp,
781 			    &satocsin(rt->rt_ifa->ifa_addr)->sin_addr,
782 			    &satocsin(dst)->sin_addr, enaddr);
783 		}
784 
785 		return 0;
786 	}
787 
788 	if (la->la_flags & LLE_STATIC) {   /* should not happen! */
789 		LLE_RUNLOCK(la);
790 		log(LOG_DEBUG, "%s: ouch, empty static llinfo for %s\n",
791 		    __func__, inet_ntoa(satocsin(dst)->sin_addr));
792 		error = EINVAL;
793 		goto bad;
794 	}
795 
796 	renew = (la->la_asked == 0 || la->la_expire != time_uptime);
797 
798 	/*
799 	 * There is an arptab entry, but no ethernet address
800 	 * response yet.  Add the mbuf to the list, dropping
801 	 * the oldest packet if we have exceeded the system
802 	 * setting.
803 	 */
804 	LLE_WLOCK_ASSERT(la);
805 	if (la->la_numheld >= arp_maxhold) {
806 		if (la->la_hold != NULL) {
807 			struct mbuf *next = la->la_hold->m_nextpkt;
808 			m_freem(la->la_hold);
809 			la->la_hold = next;
810 			la->la_numheld--;
811 			ARP_STATINC(ARP_STAT_DFRDROPPED);
812 		}
813 	}
814 	if (la->la_hold != NULL) {
815 		struct mbuf *curr = la->la_hold;
816 		while (curr->m_nextpkt != NULL)
817 			curr = curr->m_nextpkt;
818 		curr->m_nextpkt = m;
819 	} else
820 		la->la_hold = m;
821 	la->la_numheld++;
822 	if (!renew)
823 		LLE_DOWNGRADE(la);
824 
825 	/*
826 	 * Return EWOULDBLOCK if we have tried less than arp_maxtries. It
827 	 * will be masked by ether_output(). Return EHOSTDOWN/EHOSTUNREACH
828 	 * if we have already sent arp_maxtries ARP requests. Retransmit the
829 	 * ARP request, but not faster than one request per second.
830 	 */
831 	if (la->la_asked < arp_maxtries)
832 		error = EWOULDBLOCK;	/* First request. */
833 	else
834 		error = (rt != NULL && rt->rt_flags & RTF_GATEWAY) ?
835 		    EHOSTUNREACH : EHOSTDOWN;
836 
837 	if (renew) {
838 		const u_int8_t *enaddr =
839 #if NCARP > 0
840 		    (rt != NULL && rt->rt_ifp->if_type == IFT_CARP) ?
841 		    CLLADDR(rt->rt_ifp->if_sadl):
842 #endif
843 		    CLLADDR(ifp->if_sadl);
844 		la->la_expire = time_uptime;
845 		arp_settimer(la, arpt_down);
846 		la->la_asked++;
847 		LLE_WUNLOCK(la);
848 
849 		if (rt != NULL) {
850 			arprequest(ifp, &satocsin(rt->rt_ifa->ifa_addr)->sin_addr,
851 			    &satocsin(dst)->sin_addr, enaddr);
852 		} else {
853 			struct sockaddr_in sin;
854 			struct rtentry *_rt;
855 
856 			sockaddr_in_init(&sin, &la->r_l3addr.addr4, 0);
857 
858 			/* XXX */
859 			_rt = rtalloc1((struct sockaddr *)&sin, 0);
860 			if (_rt == NULL)
861 				goto bad;
862 			arprequest(ifp,
863 			    &satocsin(_rt->rt_ifa->ifa_addr)->sin_addr,
864 			    &satocsin(dst)->sin_addr, enaddr);
865 			rtfree(_rt);
866 		}
867 		return error;
868 	}
869 
870 	LLE_RUNLOCK(la);
871 	return error;
872 
873 bad:
874 	m_freem(m);
875 	return error;
876 }
877 
878 /*
879  * Common length and type checks are done here,
880  * then the protocol-specific routine is called.
881  */
882 void
883 arpintr(void)
884 {
885 	struct mbuf *m;
886 	struct arphdr *ar;
887 	int s;
888 	int arplen;
889 
890 	mutex_enter(softnet_lock);
891 	KERNEL_LOCK(1, NULL);
892 	while (arpintrq.ifq_head) {
893 		s = splnet();
894 		IF_DEQUEUE(&arpintrq, m);
895 		splx(s);
896 		if (m == NULL || (m->m_flags & M_PKTHDR) == 0)
897 			panic("arpintr");
898 
899 		MCLAIM(m, &arpdomain.dom_mowner);
900 		ARP_STATINC(ARP_STAT_RCVTOTAL);
901 
902 		/*
903 		 * First, make sure we have at least struct arphdr.
904 		 */
905 		if (m->m_len < sizeof(struct arphdr) ||
906 		    (ar = mtod(m, struct arphdr *)) == NULL)
907 			goto badlen;
908 
909 		switch (m->m_pkthdr.rcvif->if_type) {
910 		case IFT_IEEE1394:
911 			arplen = sizeof(struct arphdr) +
912 			    ar->ar_hln + 2 * ar->ar_pln;
913 			break;
914 		default:
915 			arplen = sizeof(struct arphdr) +
916 			    2 * ar->ar_hln + 2 * ar->ar_pln;
917 			break;
918 		}
919 
920 		if (/* XXX ntohs(ar->ar_hrd) == ARPHRD_ETHER && */
921 		    m->m_len >= arplen)
922 			switch (ntohs(ar->ar_pro)) {
923 			case ETHERTYPE_IP:
924 			case ETHERTYPE_IPTRAILERS:
925 				in_arpinput(m);
926 				continue;
927 			default:
928 				ARP_STATINC(ARP_STAT_RCVBADPROTO);
929 			}
930 		else {
931 badlen:
932 			ARP_STATINC(ARP_STAT_RCVBADLEN);
933 		}
934 		m_freem(m);
935 	}
936 	KERNEL_UNLOCK_ONE(NULL);
937 	mutex_exit(softnet_lock);
938 }
939 
940 /*
941  * ARP for Internet protocols on 10 Mb/s Ethernet.
942  * Algorithm is that given in RFC 826.
943  * In addition, a sanity check is performed on the sender
944  * protocol address, to catch impersonators.
945  * We no longer handle negotiations for use of trailer protocol:
946  * Formerly, ARP replied for protocol type ETHERTYPE_TRAIL sent
947  * along with IP replies if we wanted trailers sent to us,
948  * and also sent them in response to IP replies.
949  * This allowed either end to announce the desire to receive
950  * trailer packets.
951  * We no longer reply to requests for ETHERTYPE_TRAIL protocol either,
952  * but formerly didn't normally send requests.
953  */
954 static void
955 in_arpinput(struct mbuf *m)
956 {
957 	struct arphdr *ah;
958 	struct ifnet *ifp = m->m_pkthdr.rcvif;
959 	struct llentry *la = NULL;
960 	struct in_ifaddr *ia;
961 #if NBRIDGE > 0
962 	struct in_ifaddr *bridge_ia = NULL;
963 #endif
964 #if NCARP > 0
965 	u_int32_t count = 0, index = 0;
966 #endif
967 	struct sockaddr sa;
968 	struct in_addr isaddr, itaddr, myaddr;
969 	int op;
970 	void *tha;
971 	uint64_t *arps;
972 
973 	if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
974 		goto out;
975 	ah = mtod(m, struct arphdr *);
976 	op = ntohs(ah->ar_op);
977 
978 	/*
979 	 * Fix up ah->ar_hrd if necessary, before using ar_tha() or
980 	 * ar_tpa().
981 	 */
982 	switch (ifp->if_type) {
983 	case IFT_IEEE1394:
984 		if (ntohs(ah->ar_hrd) == ARPHRD_IEEE1394)
985 			;
986 		else {
987 			/* XXX this is to make sure we compute ar_tha right */
988 			/* XXX check ar_hrd more strictly? */
989 			ah->ar_hrd = htons(ARPHRD_IEEE1394);
990 		}
991 		break;
992 	default:
993 		/* XXX check ar_hrd? */
994 		break;
995 	}
996 
997 	memcpy(&isaddr, ar_spa(ah), sizeof (isaddr));
998 	memcpy(&itaddr, ar_tpa(ah), sizeof (itaddr));
999 
1000 	if (m->m_flags & (M_BCAST|M_MCAST))
1001 		ARP_STATINC(ARP_STAT_RCVMCAST);
1002 
1003 
1004 	/*
1005 	 * Search for a matching interface address
1006 	 * or any address on the interface to use
1007 	 * as a dummy address in the rest of this function
1008 	 */
1009 
1010 	INADDR_TO_IA(itaddr, ia);
1011 	while (ia != NULL) {
1012 #if NCARP > 0
1013 		if (ia->ia_ifp->if_type == IFT_CARP &&
1014 		    ((ia->ia_ifp->if_flags & (IFF_UP|IFF_RUNNING)) ==
1015 		    (IFF_UP|IFF_RUNNING))) {
1016 			index++;
1017 			if (ia->ia_ifp == m->m_pkthdr.rcvif &&
1018 			    carp_iamatch(ia, ar_sha(ah),
1019 			    &count, index)) {
1020 				break;
1021 				}
1022 		} else
1023 #endif
1024 			    if (ia->ia_ifp == m->m_pkthdr.rcvif)
1025 				break;
1026 #if NBRIDGE > 0
1027 		/*
1028 		 * If the interface we received the packet on
1029 		 * is part of a bridge, check to see if we need
1030 		 * to "bridge" the packet to ourselves at this
1031 		 * layer.  Note we still prefer a perfect match,
1032 		 * but allow this weaker match if necessary.
1033 		 */
1034 		if (m->m_pkthdr.rcvif->if_bridge != NULL &&
1035 		    m->m_pkthdr.rcvif->if_bridge == ia->ia_ifp->if_bridge)
1036 			bridge_ia = ia;
1037 #endif /* NBRIDGE > 0 */
1038 
1039 		NEXT_IA_WITH_SAME_ADDR(ia);
1040 	}
1041 
1042 #if NBRIDGE > 0
1043 	if (ia == NULL && bridge_ia != NULL) {
1044 		ia = bridge_ia;
1045 		ifp = bridge_ia->ia_ifp;
1046 	}
1047 #endif
1048 
1049 	if (ia == NULL) {
1050 		INADDR_TO_IA(isaddr, ia);
1051 		while ((ia != NULL) && ia->ia_ifp != m->m_pkthdr.rcvif)
1052 			NEXT_IA_WITH_SAME_ADDR(ia);
1053 
1054 		if (ia == NULL) {
1055 			IFP_TO_IA(ifp, ia);
1056 			if (ia == NULL) {
1057 				ARP_STATINC(ARP_STAT_RCVNOINT);
1058 				goto out;
1059 			}
1060 		}
1061 	}
1062 
1063 	myaddr = ia->ia_addr.sin_addr;
1064 
1065 	/* XXX checks for bridge case? */
1066 	if (!memcmp(ar_sha(ah), CLLADDR(ifp->if_sadl), ifp->if_addrlen)) {
1067 		ARP_STATINC(ARP_STAT_RCVLOCALSHA);
1068 		goto out;	/* it's from me, ignore it. */
1069 	}
1070 
1071 	/* XXX checks for bridge case? */
1072 	if (!memcmp(ar_sha(ah), ifp->if_broadcastaddr, ifp->if_addrlen)) {
1073 		ARP_STATINC(ARP_STAT_RCVBCASTSHA);
1074 		log(LOG_ERR,
1075 		    "%s: arp: link address is broadcast for IP address %s!\n",
1076 		    ifp->if_xname, in_fmtaddr(isaddr));
1077 		goto out;
1078 	}
1079 
1080 	/*
1081 	 * If the source IP address is zero, this is an RFC 5227 ARP probe
1082 	 */
1083 	if (in_nullhost(isaddr))
1084 		ARP_STATINC(ARP_STAT_RCVZEROSPA);
1085 	else if (in_hosteq(isaddr, myaddr))
1086 		ARP_STATINC(ARP_STAT_RCVLOCALSPA);
1087 
1088 	if (in_nullhost(itaddr))
1089 		ARP_STATINC(ARP_STAT_RCVZEROTPA);
1090 
1091 	/* DAD check, RFC 5227 2.1.1, Probe Details */
1092 	if (in_hosteq(isaddr, myaddr) ||
1093 	    (in_nullhost(isaddr) && in_hosteq(itaddr, myaddr)))
1094 	{
1095 		/* If our address is tentative, mark it as duplicated */
1096 		if (ia->ia4_flags & IN_IFF_TENTATIVE)
1097 			arp_dad_duplicated((struct ifaddr *)ia);
1098 		/* If our address is unuseable, don't reply */
1099 		if (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
1100 			goto out;
1101 	}
1102 
1103 	/*
1104 	 * If the target IP address is zero, ignore the packet.
1105 	 * This prevents the code below from tring to answer
1106 	 * when we are using IP address zero (booting).
1107 	 */
1108 	if (in_nullhost(itaddr))
1109 		goto out;
1110 
1111 	if (in_nullhost(isaddr))
1112 		goto reply;
1113 
1114 	if (in_hosteq(isaddr, myaddr)) {
1115 		log(LOG_ERR,
1116 		   "duplicate IP address %s sent from link address %s\n",
1117 		   in_fmtaddr(isaddr), lla_snprintf(ar_sha(ah), ah->ar_hln));
1118 		itaddr = myaddr;
1119 		goto reply;
1120 	}
1121 
1122 	if (in_hosteq(itaddr, myaddr))
1123 		la = arpcreate(ifp, m, &isaddr, NULL, 1);
1124 	else
1125 		la = arplookup(ifp, m, &isaddr, NULL, 1);
1126 	if (la == NULL)
1127 		goto reply;
1128 
1129 	if ((la->la_flags & LLE_VALID) &&
1130 	    memcmp(ar_sha(ah), &la->ll_addr, ifp->if_addrlen)) {
1131 		if (la->la_flags & LLE_STATIC) {
1132 			ARP_STATINC(ARP_STAT_RCVOVERPERM);
1133 			if (!log_permanent_modify)
1134 				goto out;
1135 			log(LOG_INFO,
1136 			    "%s tried to overwrite permanent arp info"
1137 			    " for %s\n",
1138 			    lla_snprintf(ar_sha(ah), ah->ar_hln),
1139 			    in_fmtaddr(isaddr));
1140 			goto out;
1141 		} else if (la->lle_tbl->llt_ifp != ifp) {
1142 			/* XXX should not happen? */
1143 			ARP_STATINC(ARP_STAT_RCVOVERINT);
1144 			if (!log_wrong_iface)
1145 				goto out;
1146 			log(LOG_INFO,
1147 			    "%s on %s tried to overwrite "
1148 			    "arp info for %s on %s\n",
1149 			    lla_snprintf(ar_sha(ah), ah->ar_hln),
1150 			    ifp->if_xname, in_fmtaddr(isaddr),
1151 			    la->lle_tbl->llt_ifp->if_xname);
1152 				goto out;
1153 		} else {
1154 			ARP_STATINC(ARP_STAT_RCVOVER);
1155 			if (log_movements)
1156 				log(LOG_INFO, "arp info overwritten "
1157 				    "for %s by %s\n",
1158 				    in_fmtaddr(isaddr),
1159 				    lla_snprintf(ar_sha(ah),
1160 				    ah->ar_hln));
1161 		}
1162 	}
1163 
1164 	/* XXX llentry should have addrlen? */
1165 #if 0
1166 	/*
1167 	 * sanity check for the address length.
1168 	 * XXX this does not work for protocols with variable address
1169 	 * length. -is
1170 	 */
1171 	if (sdl->sdl_alen && sdl->sdl_alen != ah->ar_hln) {
1172 		ARP_STATINC(ARP_STAT_RCVLENCHG);
1173 		log(LOG_WARNING,
1174 		    "arp from %s: new addr len %d, was %d\n",
1175 		    in_fmtaddr(isaddr), ah->ar_hln, sdl->sdl_alen);
1176 	}
1177 #endif
1178 
1179 	if (ifp->if_addrlen != ah->ar_hln) {
1180 		ARP_STATINC(ARP_STAT_RCVBADLEN);
1181 		log(LOG_WARNING,
1182 		    "arp from %s: addr len: new %d, i/f %d (ignored)\n",
1183 		    in_fmtaddr(isaddr), ah->ar_hln,
1184 		    ifp->if_addrlen);
1185 		goto reply;
1186 	}
1187 
1188 #if NTOKEN > 0
1189 	/*
1190 	 * XXX uses m_data and assumes the complete answer including
1191 	 * XXX token-ring headers is in the same buf
1192 	 */
1193 	if (ifp->if_type == IFT_ISO88025) {
1194 		struct token_header *trh;
1195 
1196 		trh = (struct token_header *)M_TRHSTART(m);
1197 		if (trh->token_shost[0] & TOKEN_RI_PRESENT) {
1198 			struct token_rif *rif;
1199 			size_t riflen;
1200 
1201 			rif = TOKEN_RIF(trh);
1202 			riflen = (ntohs(rif->tr_rcf) &
1203 			    TOKEN_RCF_LEN_MASK) >> 8;
1204 
1205 			if (riflen > 2 &&
1206 			    riflen < sizeof(struct token_rif) &&
1207 			    (riflen & 1) == 0) {
1208 				rif->tr_rcf ^= htons(TOKEN_RCF_DIRECTION);
1209 				rif->tr_rcf &= htons(~TOKEN_RCF_BROADCAST_MASK);
1210 				memcpy(TOKEN_RIF_LLE(la), rif, riflen);
1211 			}
1212 		}
1213 	}
1214 #endif /* NTOKEN > 0 */
1215 
1216 	KASSERT(sizeof(la->ll_addr) >= ifp->if_addrlen);
1217 	(void)memcpy(&la->ll_addr, ar_sha(ah), ifp->if_addrlen);
1218 	la->la_flags |= LLE_VALID;
1219 	if ((la->la_flags & LLE_STATIC) == 0) {
1220 		la->la_expire = time_uptime + arpt_keep;
1221 		arp_settimer(la, arpt_keep);
1222 	}
1223 	la->la_asked = 0;
1224 	/* rt->rt_flags &= ~RTF_REJECT; */
1225 
1226 	if (la->la_hold != NULL) {
1227 		int n = la->la_numheld;
1228 		struct mbuf *m_hold, *m_hold_next;
1229 		struct sockaddr_in sin;
1230 
1231 		sockaddr_in_init(&sin, &la->r_l3addr.addr4, 0);
1232 
1233 		m_hold = la->la_hold;
1234 		la->la_hold = NULL;
1235 		la->la_numheld = 0;
1236 		/*
1237 		 * We have to unlock here because if_output would call
1238 		 * arpresolve
1239 		 */
1240 		LLE_WUNLOCK(la);
1241 		ARP_STATADD(ARP_STAT_DFRSENT, n);
1242 		for (; m_hold != NULL; m_hold = m_hold_next) {
1243 			m_hold_next = m_hold->m_nextpkt;
1244 			m_hold->m_nextpkt = NULL;
1245 			(*ifp->if_output)(ifp, m_hold, sintosa(&sin), NULL);
1246 		}
1247 	} else
1248 		LLE_WUNLOCK(la);
1249 	la = NULL;
1250 
1251 reply:
1252 	if (la != NULL) {
1253 		LLE_WUNLOCK(la);
1254 		la = NULL;
1255 	}
1256 	if (op != ARPOP_REQUEST) {
1257 		if (op == ARPOP_REPLY)
1258 			ARP_STATINC(ARP_STAT_RCVREPLY);
1259 		goto out;
1260 	}
1261 	ARP_STATINC(ARP_STAT_RCVREQUEST);
1262 	if (in_hosteq(itaddr, myaddr)) {
1263 		/* If our address is unuseable, don't reply */
1264 		if (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
1265 			goto out;
1266 		/* I am the target */
1267 		tha = ar_tha(ah);
1268 		if (tha)
1269 			memcpy(tha, ar_sha(ah), ah->ar_hln);
1270 		memcpy(ar_sha(ah), CLLADDR(ifp->if_sadl), ah->ar_hln);
1271 	} else {
1272 		/* Proxy ARP */
1273 		struct llentry *lle = NULL;
1274 		struct sockaddr_in sin;
1275 
1276 #if NCARP > 0
1277 		if (ifp->if_type == IFT_CARP &&
1278 		    m->m_pkthdr.rcvif->if_type != IFT_CARP)
1279 			goto out;
1280 #endif
1281 
1282 		tha = ar_tha(ah);
1283 
1284 		sockaddr_in_init(&sin, &itaddr, 0);
1285 
1286 		IF_AFDATA_RLOCK(ifp);
1287 		lle = lla_lookup(LLTABLE(ifp), 0, (struct sockaddr *)&sin);
1288 		IF_AFDATA_RUNLOCK(ifp);
1289 
1290 		if ((lle != NULL) && (lle->la_flags & LLE_PUB)) {
1291 			(void)memcpy(tha, ar_sha(ah), ah->ar_hln);
1292 			(void)memcpy(ar_sha(ah), &lle->ll_addr, ah->ar_hln);
1293 			LLE_RUNLOCK(lle);
1294 		} else {
1295 			if (lle != NULL)
1296 				LLE_RUNLOCK(lle);
1297 			goto drop;
1298 		}
1299 	}
1300 
1301 	memcpy(ar_tpa(ah), ar_spa(ah), ah->ar_pln);
1302 	memcpy(ar_spa(ah), &itaddr, ah->ar_pln);
1303 	ah->ar_op = htons(ARPOP_REPLY);
1304 	ah->ar_pro = htons(ETHERTYPE_IP); /* let's be sure! */
1305 	switch (ifp->if_type) {
1306 	case IFT_IEEE1394:
1307 		/*
1308 		 * ieee1394 arp reply is broadcast
1309 		 */
1310 		m->m_flags &= ~M_MCAST;
1311 		m->m_flags |= M_BCAST;
1312 		m->m_len = sizeof(*ah) + (2 * ah->ar_pln) + ah->ar_hln;
1313 		break;
1314 
1315 	default:
1316 		m->m_flags &= ~(M_BCAST|M_MCAST); /* never reply by broadcast */
1317 		m->m_len = sizeof(*ah) + (2 * ah->ar_pln) + (2 * ah->ar_hln);
1318 		break;
1319 	}
1320 	m->m_pkthdr.len = m->m_len;
1321 	sa.sa_family = AF_ARP;
1322 	sa.sa_len = 2;
1323 	arps = ARP_STAT_GETREF();
1324 	arps[ARP_STAT_SNDTOTAL]++;
1325 	arps[ARP_STAT_SNDREPLY]++;
1326 	ARP_STAT_PUTREF();
1327 	(*ifp->if_output)(ifp, m, &sa, NULL);
1328 	return;
1329 
1330 out:
1331 	if (la != NULL)
1332 		LLE_WUNLOCK(la);
1333 drop:
1334 	m_freem(m);
1335 }
1336 
1337 /*
1338  * Lookup or a new address in arptab.
1339  */
1340 static struct llentry *
1341 arplookup(struct ifnet *ifp, struct mbuf *m, const struct in_addr *addr,
1342     const struct sockaddr *sa, int wlock)
1343 {
1344 	struct sockaddr_in sin;
1345 	struct llentry *la;
1346 	int flags = wlock ? LLE_EXCLUSIVE : 0;
1347 
1348 
1349 	if (sa == NULL) {
1350 		KASSERT(addr != NULL);
1351 		sockaddr_in_init(&sin, addr, 0);
1352 		sa = sintocsa(&sin);
1353 	}
1354 
1355 	IF_AFDATA_RLOCK(ifp);
1356 	la = lla_lookup(LLTABLE(ifp), flags, sa);
1357 	IF_AFDATA_RUNLOCK(ifp);
1358 
1359 	return la;
1360 }
1361 
1362 static struct llentry *
1363 arpcreate(struct ifnet *ifp, struct mbuf *m, const struct in_addr *addr,
1364     const struct sockaddr *sa, int wlock)
1365 {
1366 	struct sockaddr_in sin;
1367 	struct llentry *la;
1368 	int flags = wlock ? LLE_EXCLUSIVE : 0;
1369 
1370 	if (sa == NULL) {
1371 		KASSERT(addr != NULL);
1372 		sockaddr_in_init(&sin, addr, 0);
1373 		sa = sintocsa(&sin);
1374 	}
1375 
1376 	la = arplookup(ifp, m, addr, sa, wlock);
1377 
1378 	if (la == NULL) {
1379 		IF_AFDATA_WLOCK(ifp);
1380 		la = lla_create(LLTABLE(ifp), flags, sa);
1381 		IF_AFDATA_WUNLOCK(ifp);
1382 
1383 		if (la != NULL)
1384 			arp_init_llentry(ifp, la);
1385 	}
1386 
1387 	return la;
1388 }
1389 
1390 int
1391 arpioctl(u_long cmd, void *data)
1392 {
1393 
1394 	return EOPNOTSUPP;
1395 }
1396 
1397 void
1398 arp_ifinit(struct ifnet *ifp, struct ifaddr *ifa)
1399 {
1400 	struct in_addr *ip;
1401 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1402 
1403 	/*
1404 	 * Warn the user if another station has this IP address,
1405 	 * but only if the interface IP address is not zero.
1406 	 */
1407 	ip = &IA_SIN(ifa)->sin_addr;
1408 	if (!in_nullhost(*ip) &&
1409 	    (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED)) == 0) {
1410 		struct llentry *lle;
1411 
1412 		arprequest(ifp, ip, ip, CLLADDR(ifp->if_sadl));
1413 
1414 		/*
1415 		 * interface address is considered static entry
1416 		 * because the output of the arp utility shows
1417 		 * that L2 entry as permanent
1418 		 */
1419 		IF_AFDATA_WLOCK(ifp);
1420 		lle = lla_create(LLTABLE(ifp), (LLE_IFADDR | LLE_STATIC),
1421 				 (struct sockaddr *)IA_SIN(ifa));
1422 		IF_AFDATA_WUNLOCK(ifp);
1423 		if (lle == NULL)
1424 			log(LOG_INFO, "%s: cannot create arp entry for"
1425 			    " interface address\n", __func__);
1426 		else {
1427 			arp_init_llentry(ifp, lle);
1428 			LLE_RUNLOCK(lle);
1429 		}
1430 	}
1431 
1432 	ifa->ifa_rtrequest = arp_rtrequest;
1433 	ifa->ifa_flags |= RTF_CONNECTED;
1434 
1435 	/* ARP will handle DAD for this address. */
1436 	if (ia->ia4_flags & IN_IFF_TRYTENTATIVE) {
1437 		ia->ia4_flags |= IN_IFF_TENTATIVE;
1438 		ia->ia_dad_start = arp_dad_start;
1439 		ia->ia_dad_stop = arp_dad_stop;
1440 	}
1441 }
1442 
1443 TAILQ_HEAD(dadq_head, dadq);
1444 struct dadq {
1445 	TAILQ_ENTRY(dadq) dad_list;
1446 	struct ifaddr *dad_ifa;
1447 	int dad_count;		/* max ARP to send */
1448 	int dad_arp_tcount;	/* # of trials to send ARP */
1449 	int dad_arp_ocount;	/* ARP sent so far */
1450 	int dad_arp_announce;	/* max ARP announcements */
1451 	int dad_arp_acount;	/* # of announcements */
1452 	struct callout dad_timer_ch;
1453 };
1454 MALLOC_JUSTDEFINE(M_IPARP, "ARP DAD", "ARP DAD Structure");
1455 
1456 static struct dadq_head dadq;
1457 static int dad_init = 0;
1458 static int dad_maxtry = 15;     /* max # of *tries* to transmit DAD packet */
1459 
1460 static struct dadq *
1461 arp_dad_find(struct ifaddr *ifa)
1462 {
1463 	struct dadq *dp;
1464 
1465 	TAILQ_FOREACH(dp, &dadq, dad_list) {
1466 		if (dp->dad_ifa == ifa)
1467 			return dp;
1468 	}
1469 	return NULL;
1470 }
1471 
1472 static void
1473 arp_dad_starttimer(struct dadq *dp, int ticks)
1474 {
1475 
1476 	callout_reset(&dp->dad_timer_ch, ticks,
1477 	    (void (*)(void *))arp_dad_timer, (void *)dp->dad_ifa);
1478 }
1479 
1480 static void
1481 arp_dad_stoptimer(struct dadq *dp)
1482 {
1483 
1484 	callout_stop(&dp->dad_timer_ch);
1485 }
1486 
1487 static void
1488 arp_dad_output(struct dadq *dp, struct ifaddr *ifa)
1489 {
1490 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1491 	struct ifnet *ifp = ifa->ifa_ifp;
1492 	struct in_addr sip;
1493 
1494 	dp->dad_arp_tcount++;
1495 	if ((ifp->if_flags & IFF_UP) == 0)
1496 		return;
1497 	if ((ifp->if_flags & IFF_RUNNING) == 0)
1498 		return;
1499 
1500 	dp->dad_arp_tcount = 0;
1501 	dp->dad_arp_ocount++;
1502 
1503 	memset(&sip, 0, sizeof(sip));
1504 	arprequest(ifa->ifa_ifp, &sip, &ia->ia_addr.sin_addr,
1505 	    CLLADDR(ifa->ifa_ifp->if_sadl));
1506 }
1507 
1508 /*
1509  * Start Duplicate Address Detection (DAD) for specified interface address.
1510  */
1511 static void
1512 arp_dad_start(struct ifaddr *ifa)
1513 {
1514 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1515 	struct dadq *dp;
1516 
1517 	if (!dad_init) {
1518 		TAILQ_INIT(&dadq);
1519 		dad_init++;
1520 	}
1521 
1522 	/*
1523 	 * If we don't need DAD, don't do it.
1524 	 * - DAD is disabled (ip_dad_count == 0)
1525 	 */
1526 	if (!(ia->ia4_flags & IN_IFF_TENTATIVE)) {
1527 		log(LOG_DEBUG,
1528 		    "%s: called with non-tentative address %s(%s)\n", __func__,
1529 		    in_fmtaddr(ia->ia_addr.sin_addr),
1530 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1531 		return;
1532 	}
1533 	if (!ip_dad_count) {
1534 		struct in_addr *ip = &IA_SIN(ifa)->sin_addr;
1535 
1536 		ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1537 		rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1538 		arprequest(ifa->ifa_ifp, ip, ip,
1539 		    CLLADDR(ifa->ifa_ifp->if_sadl));
1540 		return;
1541 	}
1542 	if (ifa->ifa_ifp == NULL)
1543 		panic("arp_dad_start: ifa->ifa_ifp == NULL");
1544 	if (!(ifa->ifa_ifp->if_flags & IFF_UP))
1545 		return;
1546 	if (arp_dad_find(ifa) != NULL) {
1547 		/* DAD already in progress */
1548 		return;
1549 	}
1550 
1551 	dp = malloc(sizeof(*dp), M_IPARP, M_NOWAIT);
1552 	if (dp == NULL) {
1553 		log(LOG_ERR, "%s: memory allocation failed for %s(%s)\n",
1554 		    __func__, in_fmtaddr(ia->ia_addr.sin_addr),
1555 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1556 		return;
1557 	}
1558 	memset(dp, 0, sizeof(*dp));
1559 	callout_init(&dp->dad_timer_ch, CALLOUT_MPSAFE);
1560 	TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list);
1561 
1562 	arplog((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
1563 	    in_fmtaddr(ia->ia_addr.sin_addr)));
1564 
1565 	/*
1566 	 * Send ARP packet for DAD, ip_dad_count times.
1567 	 * Note that we must delay the first transmission.
1568 	 */
1569 	dp->dad_ifa = ifa;
1570 	ifaref(ifa);	/* just for safety */
1571 	dp->dad_count = ip_dad_count;
1572 	dp->dad_arp_announce = 0; /* Will be set when starting to announce */
1573 	dp->dad_arp_acount = dp->dad_arp_ocount = dp->dad_arp_tcount = 0;
1574 
1575 	arp_dad_starttimer(dp, cprng_fast32() % (PROBE_WAIT * hz));
1576 }
1577 
1578 /*
1579  * terminate DAD unconditionally.  used for address removals.
1580  */
1581 static void
1582 arp_dad_stop(struct ifaddr *ifa)
1583 {
1584 	struct dadq *dp;
1585 
1586 	if (!dad_init)
1587 		return;
1588 	dp = arp_dad_find(ifa);
1589 	if (dp == NULL) {
1590 		/* DAD wasn't started yet */
1591 		return;
1592 	}
1593 
1594 	arp_dad_stoptimer(dp);
1595 
1596 	TAILQ_REMOVE(&dadq, dp, dad_list);
1597 	free(dp, M_IPARP);
1598 	dp = NULL;
1599 	ifafree(ifa);
1600 }
1601 
1602 static void
1603 arp_dad_timer(struct ifaddr *ifa)
1604 {
1605 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1606 	struct dadq *dp;
1607 	struct in_addr *ip;
1608 
1609 	mutex_enter(softnet_lock);
1610 	KERNEL_LOCK(1, NULL);
1611 
1612 	/* Sanity check */
1613 	if (ia == NULL) {
1614 		log(LOG_ERR, "%s: called with null parameter\n", __func__);
1615 		goto done;
1616 	}
1617 	dp = arp_dad_find(ifa);
1618 	if (dp == NULL) {
1619 		log(LOG_ERR, "%s: DAD structure not found\n", __func__);
1620 		goto done;
1621 	}
1622 	if (ia->ia4_flags & IN_IFF_DUPLICATED) {
1623 		log(LOG_ERR, "%s: called with duplicate address %s(%s)\n",
1624 		    __func__, in_fmtaddr(ia->ia_addr.sin_addr),
1625 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1626 		goto done;
1627 	}
1628 	if ((ia->ia4_flags & IN_IFF_TENTATIVE) == 0 && dp->dad_arp_acount == 0)
1629 	{
1630 		log(LOG_ERR, "%s: called with non-tentative address %s(%s)\n",
1631 		    __func__, in_fmtaddr(ia->ia_addr.sin_addr),
1632 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1633 		goto done;
1634 	}
1635 
1636 	/* timeouted with IFF_{RUNNING,UP} check */
1637 	if (dp->dad_arp_tcount > dad_maxtry) {
1638 		arplog((LOG_INFO, "%s: could not run DAD, driver problem?\n",
1639 		    if_name(ifa->ifa_ifp)));
1640 
1641 		TAILQ_REMOVE(&dadq, dp, dad_list);
1642 		free(dp, M_IPARP);
1643 		dp = NULL;
1644 		ifafree(ifa);
1645 		goto done;
1646 	}
1647 
1648 	/* Need more checks? */
1649 	if (dp->dad_arp_ocount < dp->dad_count) {
1650 		int adelay;
1651 
1652 		/*
1653 		 * We have more ARP to go.  Send ARP packet for DAD.
1654 		 */
1655 		arp_dad_output(dp, ifa);
1656 		if (dp->dad_arp_ocount < dp->dad_count)
1657 			adelay = (PROBE_MIN * hz) +
1658 			    (cprng_fast32() %
1659 			    ((PROBE_MAX * hz) - (PROBE_MIN * hz)));
1660 		else
1661 			adelay = ANNOUNCE_WAIT * hz;
1662 		arp_dad_starttimer(dp, adelay);
1663 		goto done;
1664 	} else if (dp->dad_arp_acount == 0) {
1665 		/*
1666 		 * We are done with DAD.
1667 		 * No duplicate address found.
1668 		 */
1669 		ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1670 		rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1671 		arplog((LOG_DEBUG,
1672 		    "%s: DAD complete for %s - no duplicates found\n",
1673 		    if_name(ifa->ifa_ifp),
1674 		    in_fmtaddr(ia->ia_addr.sin_addr)));
1675 		dp->dad_arp_announce = ANNOUNCE_NUM;
1676 		goto announce;
1677 	} else if (dp->dad_arp_acount < dp->dad_arp_announce) {
1678 announce:
1679 		/*
1680 		 * Announce the address.
1681 		 */
1682 		ip = &IA_SIN(ifa)->sin_addr;
1683 		arprequest(ifa->ifa_ifp, ip, ip,
1684 		    CLLADDR(ifa->ifa_ifp->if_sadl));
1685 		dp->dad_arp_acount++;
1686 		if (dp->dad_arp_acount < dp->dad_arp_announce) {
1687 			arp_dad_starttimer(dp, ANNOUNCE_INTERVAL * hz);
1688 			goto done;
1689 		}
1690 		arplog((LOG_DEBUG,
1691 		    "%s: ARP announcement complete for %s\n",
1692 		    if_name(ifa->ifa_ifp),
1693 		    in_fmtaddr(ia->ia_addr.sin_addr)));
1694 	}
1695 
1696 	TAILQ_REMOVE(&dadq, dp, dad_list);
1697 	free(dp, M_IPARP);
1698 	dp = NULL;
1699 	ifafree(ifa);
1700 
1701 done:
1702 	KERNEL_UNLOCK_ONE(NULL);
1703 	mutex_exit(softnet_lock);
1704 }
1705 
1706 static void
1707 arp_dad_duplicated(struct ifaddr *ifa)
1708 {
1709 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1710 	struct ifnet *ifp;
1711 	struct dadq *dp;
1712 
1713 	dp = arp_dad_find(ifa);
1714 	if (dp == NULL) {
1715 		log(LOG_ERR, "%s: DAD structure not found\n", __func__);
1716 		return;
1717 	}
1718 
1719 	ifp = ifa->ifa_ifp;
1720 	log(LOG_ERR,
1721 	    "%s: DAD detected duplicate IPv4 address %s: ARP out=%d\n",
1722 	    if_name(ifp), in_fmtaddr(ia->ia_addr.sin_addr),
1723 	    dp->dad_arp_ocount);
1724 
1725 	ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1726 	ia->ia4_flags |= IN_IFF_DUPLICATED;
1727 
1728 	/* We are done with DAD, with duplicated address found. (failure) */
1729 	arp_dad_stoptimer(dp);
1730 
1731 	/* Inform the routing socket that DAD has completed */
1732 	rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1733 
1734 	TAILQ_REMOVE(&dadq, dp, dad_list);
1735 	free(dp, M_IPARP);
1736 	dp = NULL;
1737 	ifafree(ifa);
1738 }
1739 
1740 /*
1741  * Called from 10 Mb/s Ethernet interrupt handlers
1742  * when ether packet type ETHERTYPE_REVARP
1743  * is received.  Common length and type checks are done here,
1744  * then the protocol-specific routine is called.
1745  */
1746 void
1747 revarpinput(struct mbuf *m)
1748 {
1749 	struct arphdr *ar;
1750 
1751 	if (m->m_len < sizeof(struct arphdr))
1752 		goto out;
1753 	ar = mtod(m, struct arphdr *);
1754 #if 0 /* XXX I don't think we need this... and it will prevent other LL */
1755 	if (ntohs(ar->ar_hrd) != ARPHRD_ETHER)
1756 		goto out;
1757 #endif
1758 	if (m->m_len < sizeof(struct arphdr) + 2 * (ar->ar_hln + ar->ar_pln))
1759 		goto out;
1760 	switch (ntohs(ar->ar_pro)) {
1761 	case ETHERTYPE_IP:
1762 	case ETHERTYPE_IPTRAILERS:
1763 		in_revarpinput(m);
1764 		return;
1765 
1766 	default:
1767 		break;
1768 	}
1769 out:
1770 	m_freem(m);
1771 }
1772 
1773 /*
1774  * RARP for Internet protocols on 10 Mb/s Ethernet.
1775  * Algorithm is that given in RFC 903.
1776  * We are only using for bootstrap purposes to get an ip address for one of
1777  * our interfaces.  Thus we support no user-interface.
1778  *
1779  * Since the contents of the RARP reply are specific to the interface that
1780  * sent the request, this code must ensure that they are properly associated.
1781  *
1782  * Note: also supports ARP via RARP packets, per the RFC.
1783  */
1784 void
1785 in_revarpinput(struct mbuf *m)
1786 {
1787 	struct ifnet *ifp;
1788 	struct arphdr *ah;
1789 	void *tha;
1790 	int op;
1791 
1792 	ah = mtod(m, struct arphdr *);
1793 	op = ntohs(ah->ar_op);
1794 
1795 	switch (m->m_pkthdr.rcvif->if_type) {
1796 	case IFT_IEEE1394:
1797 		/* ARP without target hardware address is not supported */
1798 		goto out;
1799 	default:
1800 		break;
1801 	}
1802 
1803 	switch (op) {
1804 	case ARPOP_REQUEST:
1805 	case ARPOP_REPLY:	/* per RFC */
1806 		in_arpinput(m);
1807 		return;
1808 	case ARPOP_REVREPLY:
1809 		break;
1810 	case ARPOP_REVREQUEST:	/* handled by rarpd(8) */
1811 	default:
1812 		goto out;
1813 	}
1814 	if (!revarp_in_progress)
1815 		goto out;
1816 	ifp = m->m_pkthdr.rcvif;
1817 	if (ifp != myip_ifp) /* !same interface */
1818 		goto out;
1819 	if (myip_initialized)
1820 		goto wake;
1821 	tha = ar_tha(ah);
1822 	if (tha == NULL)
1823 		goto out;
1824 	if (memcmp(tha, CLLADDR(ifp->if_sadl), ifp->if_sadl->sdl_alen))
1825 		goto out;
1826 	memcpy(&srv_ip, ar_spa(ah), sizeof(srv_ip));
1827 	memcpy(&myip, ar_tpa(ah), sizeof(myip));
1828 	myip_initialized = 1;
1829 wake:	/* Do wakeup every time in case it was missed. */
1830 	wakeup((void *)&myip);
1831 
1832 out:
1833 	m_freem(m);
1834 }
1835 
1836 /*
1837  * Send a RARP request for the ip address of the specified interface.
1838  * The request should be RFC 903-compliant.
1839  */
1840 static void
1841 revarprequest(struct ifnet *ifp)
1842 {
1843 	struct sockaddr sa;
1844 	struct mbuf *m;
1845 	struct arphdr *ah;
1846 	void *tha;
1847 
1848 	if ((m = m_gethdr(M_DONTWAIT, MT_DATA)) == NULL)
1849 		return;
1850 	MCLAIM(m, &arpdomain.dom_mowner);
1851 	m->m_len = sizeof(*ah) + 2*sizeof(struct in_addr) +
1852 	    2*ifp->if_addrlen;
1853 	m->m_pkthdr.len = m->m_len;
1854 	MH_ALIGN(m, m->m_len);
1855 	ah = mtod(m, struct arphdr *);
1856 	memset(ah, 0, m->m_len);
1857 	ah->ar_pro = htons(ETHERTYPE_IP);
1858 	ah->ar_hln = ifp->if_addrlen;		/* hardware address length */
1859 	ah->ar_pln = sizeof(struct in_addr);	/* protocol address length */
1860 	ah->ar_op = htons(ARPOP_REVREQUEST);
1861 
1862 	memcpy(ar_sha(ah), CLLADDR(ifp->if_sadl), ah->ar_hln);
1863 	tha = ar_tha(ah);
1864 	if (tha == NULL) {
1865 		m_free(m);
1866 		return;
1867 	}
1868 	memcpy(tha, CLLADDR(ifp->if_sadl), ah->ar_hln);
1869 
1870 	sa.sa_family = AF_ARP;
1871 	sa.sa_len = 2;
1872 	m->m_flags |= M_BCAST;
1873 
1874 	KERNEL_LOCK(1, NULL);
1875 	(*ifp->if_output)(ifp, m, &sa, NULL);
1876 	KERNEL_UNLOCK_ONE(NULL);
1877 }
1878 
1879 /*
1880  * RARP for the ip address of the specified interface, but also
1881  * save the ip address of the server that sent the answer.
1882  * Timeout if no response is received.
1883  */
1884 int
1885 revarpwhoarewe(struct ifnet *ifp, struct in_addr *serv_in,
1886     struct in_addr *clnt_in)
1887 {
1888 	int result, count = 20;
1889 
1890 	myip_initialized = 0;
1891 	myip_ifp = ifp;
1892 
1893 	revarp_in_progress = 1;
1894 	while (count--) {
1895 		revarprequest(ifp);
1896 		result = tsleep((void *)&myip, PSOCK, "revarp", hz/2);
1897 		if (result != EWOULDBLOCK)
1898 			break;
1899 	}
1900 	revarp_in_progress = 0;
1901 
1902 	if (!myip_initialized)
1903 		return ENETUNREACH;
1904 
1905 	memcpy(serv_in, &srv_ip, sizeof(*serv_in));
1906 	memcpy(clnt_in, &myip, sizeof(*clnt_in));
1907 	return 0;
1908 }
1909 
1910 void
1911 arp_stat_add(int type, uint64_t count)
1912 {
1913 	ARP_STATADD(type, count);
1914 }
1915 
1916 static int
1917 sysctl_net_inet_arp_stats(SYSCTLFN_ARGS)
1918 {
1919 
1920 	return NETSTAT_SYSCTL(arpstat_percpu, ARP_NSTATS);
1921 }
1922 
1923 static void
1924 sysctl_net_inet_arp_setup(struct sysctllog **clog)
1925 {
1926 	const struct sysctlnode *node;
1927 
1928 	sysctl_createv(clog, 0, NULL, NULL,
1929 			CTLFLAG_PERMANENT,
1930 			CTLTYPE_NODE, "inet", NULL,
1931 			NULL, 0, NULL, 0,
1932 			CTL_NET, PF_INET, CTL_EOL);
1933 	sysctl_createv(clog, 0, NULL, &node,
1934 			CTLFLAG_PERMANENT,
1935 			CTLTYPE_NODE, "arp",
1936 			SYSCTL_DESCR("Address Resolution Protocol"),
1937 			NULL, 0, NULL, 0,
1938 			CTL_NET, PF_INET, CTL_CREATE, CTL_EOL);
1939 
1940 	sysctl_createv(clog, 0, NULL, NULL,
1941 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1942 			CTLTYPE_INT, "keep",
1943 			SYSCTL_DESCR("Valid ARP entry lifetime in seconds"),
1944 			NULL, 0, &arpt_keep, 0,
1945 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1946 
1947 	sysctl_createv(clog, 0, NULL, NULL,
1948 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1949 			CTLTYPE_INT, "down",
1950 			SYSCTL_DESCR("Failed ARP entry lifetime in seconds"),
1951 			NULL, 0, &arpt_down, 0,
1952 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1953 
1954 	sysctl_createv(clog, 0, NULL, NULL,
1955 			CTLFLAG_PERMANENT,
1956 			CTLTYPE_STRUCT, "stats",
1957 			SYSCTL_DESCR("ARP statistics"),
1958 			sysctl_net_inet_arp_stats, 0, NULL, 0,
1959 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1960 
1961 	sysctl_createv(clog, 0, NULL, NULL,
1962 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1963 			CTLTYPE_INT, "log_movements",
1964 			SYSCTL_DESCR("log ARP replies from MACs different than"
1965 			    " the one in the cache"),
1966 			NULL, 0, &log_movements, 0,
1967 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1968 
1969 	sysctl_createv(clog, 0, NULL, NULL,
1970 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1971 			CTLTYPE_INT, "log_permanent_modify",
1972 			SYSCTL_DESCR("log ARP replies from MACs different than"
1973 			    " the one in the permanent arp entry"),
1974 			NULL, 0, &log_permanent_modify, 0,
1975 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1976 
1977 	sysctl_createv(clog, 0, NULL, NULL,
1978 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1979 			CTLTYPE_INT, "log_wrong_iface",
1980 			SYSCTL_DESCR("log ARP packets arriving on the wrong"
1981 			    " interface"),
1982 			NULL, 0, &log_wrong_iface, 0,
1983 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1984 
1985 	sysctl_createv(clog, 0, NULL, NULL,
1986 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1987 			CTLTYPE_INT, "log_unknown_network",
1988 			SYSCTL_DESCR("log ARP packets from non-local network"),
1989 			NULL, 0, &log_unknown_network, 0,
1990 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1991 
1992 	sysctl_createv(clog, 0, NULL, NULL,
1993 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1994 		       CTLTYPE_INT, "debug",
1995 		       SYSCTL_DESCR("Enable ARP DAD debug output"),
1996 		       NULL, 0, &arp_debug, 0,
1997 		       CTL_NET, PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
1998 }
1999 
2000 #endif /* INET */
2001