xref: /netbsd-src/sys/netinet/if_arp.c (revision d909946ca08dceb44d7d0f22ec9488679695d976)
1 /*	$NetBSD: if_arp.c,v 1.222 2016/08/08 06:28:09 ozaki-r Exp $	*/
2 
3 /*-
4  * Copyright (c) 1998, 2000, 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Public Access Networks Corporation ("Panix").  It was developed under
9  * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)if_ether.c	8.2 (Berkeley) 9/26/94
62  */
63 
64 /*
65  * Ethernet address resolution protocol.
66  * TODO:
67  *	add "inuse/lock" bit (or ref. count) along with valid bit
68  */
69 
70 #include <sys/cdefs.h>
71 __KERNEL_RCSID(0, "$NetBSD: if_arp.c,v 1.222 2016/08/08 06:28:09 ozaki-r Exp $");
72 
73 #ifdef _KERNEL_OPT
74 #include "opt_ddb.h"
75 #include "opt_inet.h"
76 #endif
77 
78 #ifdef INET
79 
80 #include "bridge.h"
81 
82 #include <sys/param.h>
83 #include <sys/systm.h>
84 #include <sys/callout.h>
85 #include <sys/malloc.h>
86 #include <sys/mbuf.h>
87 #include <sys/socket.h>
88 #include <sys/time.h>
89 #include <sys/timetc.h>
90 #include <sys/kernel.h>
91 #include <sys/errno.h>
92 #include <sys/ioctl.h>
93 #include <sys/syslog.h>
94 #include <sys/proc.h>
95 #include <sys/protosw.h>
96 #include <sys/domain.h>
97 #include <sys/sysctl.h>
98 #include <sys/socketvar.h>
99 #include <sys/percpu.h>
100 #include <sys/cprng.h>
101 #include <sys/kmem.h>
102 
103 #include <net/ethertypes.h>
104 #include <net/if.h>
105 #include <net/if_dl.h>
106 #include <net/if_token.h>
107 #include <net/if_types.h>
108 #include <net/if_ether.h>
109 #include <net/if_llatbl.h>
110 #include <net/net_osdep.h>
111 #include <net/route.h>
112 #include <net/net_stats.h>
113 
114 #include <netinet/in.h>
115 #include <netinet/in_systm.h>
116 #include <netinet/in_var.h>
117 #include <netinet/ip.h>
118 #include <netinet/if_inarp.h>
119 
120 #include "arcnet.h"
121 #if NARCNET > 0
122 #include <net/if_arc.h>
123 #endif
124 #include "fddi.h"
125 #if NFDDI > 0
126 #include <net/if_fddi.h>
127 #endif
128 #include "token.h"
129 #include "carp.h"
130 #if NCARP > 0
131 #include <netinet/ip_carp.h>
132 #endif
133 
134 #define SIN(s) ((struct sockaddr_in *)s)
135 #define SRP(s) ((struct sockaddr_inarp *)s)
136 
137 /*
138  * ARP trailer negotiation.  Trailer protocol is not IP specific,
139  * but ARP request/response use IP addresses.
140  */
141 #define ETHERTYPE_IPTRAILERS ETHERTYPE_TRAIL
142 
143 /* timer values */
144 static int	arpt_keep = (20*60);	/* once resolved, good for 20 more minutes */
145 static int	arpt_down = 20;		/* once declared down, don't send for 20 secs */
146 static int	arp_maxhold = 1;	/* number of packets to hold per ARP entry */
147 #define	rt_expire rt_rmx.rmx_expire
148 #define	rt_pksent rt_rmx.rmx_pksent
149 
150 int		ip_dad_count = PROBE_NUM;
151 #ifdef ARP_DEBUG
152 static int	arp_debug = 1;
153 #else
154 static int	arp_debug = 0;
155 #endif
156 #define arplog(x)	do { if (arp_debug) log x; } while (/*CONSTCOND*/ 0)
157 
158 static	void arp_init(void);
159 
160 static	struct sockaddr *arp_setgate(struct rtentry *, struct sockaddr *,
161 	    const struct sockaddr *);
162 static	void arptimer(void *);
163 static	void arp_settimer(struct llentry *, int);
164 static	struct llentry *arplookup(struct ifnet *, struct mbuf *,
165 	    const struct in_addr *, const struct sockaddr *, int);
166 static	struct llentry *arpcreate(struct ifnet *, struct mbuf *,
167 	    const struct in_addr *, const struct sockaddr *, int);
168 static	void in_arpinput(struct mbuf *);
169 static	void in_revarpinput(struct mbuf *);
170 static	void revarprequest(struct ifnet *);
171 
172 static	void arp_drainstub(void);
173 
174 static void arp_dad_timer(struct ifaddr *);
175 static void arp_dad_start(struct ifaddr *);
176 static void arp_dad_stop(struct ifaddr *);
177 static void arp_dad_duplicated(struct ifaddr *);
178 
179 static void arp_init_llentry(struct ifnet *, struct llentry *);
180 #if NTOKEN > 0
181 static void arp_free_llentry_tokenring(struct llentry *);
182 #endif
183 
184 struct	ifqueue arpintrq = {
185 	.ifq_head = NULL,
186 	.ifq_tail = NULL,
187 	.ifq_len = 0,
188 	.ifq_maxlen = 50,
189 	.ifq_drops = 0,
190 };
191 static int	arp_maxtries = 5;
192 static int	useloopback = 1;	/* use loopback interface for local traffic */
193 
194 static percpu_t *arpstat_percpu;
195 
196 #define	ARP_STAT_GETREF()	_NET_STAT_GETREF(arpstat_percpu)
197 #define	ARP_STAT_PUTREF()	_NET_STAT_PUTREF(arpstat_percpu)
198 
199 #define	ARP_STATINC(x)		_NET_STATINC(arpstat_percpu, x)
200 #define	ARP_STATADD(x, v)	_NET_STATADD(arpstat_percpu, x, v)
201 
202 /* revarp state */
203 static struct	in_addr myip, srv_ip;
204 static int	myip_initialized = 0;
205 static int	revarp_in_progress = 0;
206 static struct	ifnet *myip_ifp = NULL;
207 
208 static int arp_drainwanted;
209 
210 static int log_movements = 1;
211 static int log_permanent_modify = 1;
212 static int log_wrong_iface = 1;
213 static int log_unknown_network = 1;
214 
215 /*
216  * this should be elsewhere.
217  */
218 
219 static char *
220 lla_snprintf(u_int8_t *, int);
221 
222 static char *
223 lla_snprintf(u_int8_t *adrp, int len)
224 {
225 #define NUMBUFS 3
226 	static char buf[NUMBUFS][16*3];
227 	static int bnum = 0;
228 
229 	int i;
230 	char *p;
231 
232 	p = buf[bnum];
233 
234 	*p++ = hexdigits[(*adrp)>>4];
235 	*p++ = hexdigits[(*adrp++)&0xf];
236 
237 	for (i=1; i<len && i<16; i++) {
238 		*p++ = ':';
239 		*p++ = hexdigits[(*adrp)>>4];
240 		*p++ = hexdigits[(*adrp++)&0xf];
241 	}
242 
243 	*p = 0;
244 	p = buf[bnum];
245 	bnum = (bnum + 1) % NUMBUFS;
246 	return p;
247 }
248 
249 DOMAIN_DEFINE(arpdomain);	/* forward declare and add to link set */
250 
251 static void
252 arp_fasttimo(void)
253 {
254 	if (arp_drainwanted) {
255 		arp_drain();
256 		arp_drainwanted = 0;
257 	}
258 }
259 
260 const struct protosw arpsw[] = {
261 	{ .pr_type = 0,
262 	  .pr_domain = &arpdomain,
263 	  .pr_protocol = 0,
264 	  .pr_flags = 0,
265 	  .pr_input = 0,
266 	  .pr_ctlinput = 0,
267 	  .pr_ctloutput = 0,
268 	  .pr_usrreqs = 0,
269 	  .pr_init = arp_init,
270 	  .pr_fasttimo = arp_fasttimo,
271 	  .pr_slowtimo = 0,
272 	  .pr_drain = arp_drainstub,
273 	}
274 };
275 
276 struct domain arpdomain = {
277 	.dom_family = PF_ARP,
278 	.dom_name = "arp",
279 	.dom_protosw = arpsw,
280 	.dom_protoswNPROTOSW = &arpsw[__arraycount(arpsw)],
281 };
282 
283 static void sysctl_net_inet_arp_setup(struct sysctllog **);
284 
285 void
286 arp_init(void)
287 {
288 
289 	sysctl_net_inet_arp_setup(NULL);
290 	arpstat_percpu = percpu_alloc(sizeof(uint64_t) * ARP_NSTATS);
291 }
292 
293 static void
294 arp_drainstub(void)
295 {
296 	arp_drainwanted = 1;
297 }
298 
299 /*
300  * ARP protocol drain routine.  Called when memory is in short supply.
301  * Called at splvm();  don't acquire softnet_lock as can be called from
302  * hardware interrupt handlers.
303  */
304 void
305 arp_drain(void)
306 {
307 
308 	lltable_drain(AF_INET);
309 }
310 
311 static void
312 arptimer(void *arg)
313 {
314 	struct llentry *lle = arg;
315 	struct ifnet *ifp;
316 
317 	if (lle == NULL)
318 		return;
319 
320 	if (lle->la_flags & LLE_STATIC)
321 		return;
322 
323 	LLE_WLOCK(lle);
324 	if (callout_pending(&lle->la_timer)) {
325 		/*
326 		 * Here we are a bit odd here in the treatment of
327 		 * active/pending. If the pending bit is set, it got
328 		 * rescheduled before I ran. The active
329 		 * bit we ignore, since if it was stopped
330 		 * in ll_tablefree() and was currently running
331 		 * it would have return 0 so the code would
332 		 * not have deleted it since the callout could
333 		 * not be stopped so we want to go through
334 		 * with the delete here now. If the callout
335 		 * was restarted, the pending bit will be back on and
336 		 * we just want to bail since the callout_reset would
337 		 * return 1 and our reference would have been removed
338 		 * by arpresolve() below.
339 		 */
340 		LLE_WUNLOCK(lle);
341 		return;
342 	}
343 	ifp = lle->lle_tbl->llt_ifp;
344 
345 	callout_stop(&lle->la_timer);
346 
347 	/* XXX: LOR avoidance. We still have ref on lle. */
348 	LLE_WUNLOCK(lle);
349 
350 	IF_AFDATA_LOCK(ifp);
351 	LLE_WLOCK(lle);
352 
353 	/* Guard against race with other llentry_free(). */
354 	if (lle->la_flags & LLE_LINKED) {
355 		size_t pkts_dropped;
356 
357 		LLE_REMREF(lle);
358 		pkts_dropped = llentry_free(lle);
359 		ARP_STATADD(ARP_STAT_DFRDROPPED, pkts_dropped);
360 		ARP_STATADD(ARP_STAT_DFRTOTAL, pkts_dropped);
361 	} else {
362 		LLE_FREE_LOCKED(lle);
363 	}
364 
365 	IF_AFDATA_UNLOCK(ifp);
366 }
367 
368 static void
369 arp_settimer(struct llentry *la, int sec)
370 {
371 
372 	LLE_WLOCK_ASSERT(la);
373 	LLE_ADDREF(la);
374 	callout_reset(&la->la_timer, hz * sec, arptimer, la);
375 }
376 
377 /*
378  * We set the gateway for RTF_CLONING routes to a "prototype"
379  * link-layer sockaddr whose interface type (if_type) and interface
380  * index (if_index) fields are prepared.
381  */
382 static struct sockaddr *
383 arp_setgate(struct rtentry *rt, struct sockaddr *gate,
384     const struct sockaddr *netmask)
385 {
386 	const struct ifnet *ifp = rt->rt_ifp;
387 	uint8_t namelen = strlen(ifp->if_xname);
388 	uint8_t addrlen = ifp->if_addrlen;
389 
390 	/*
391 	 * XXX: If this is a manually added route to interface
392 	 * such as older version of routed or gated might provide,
393 	 * restore cloning bit.
394 	 */
395 	if ((rt->rt_flags & RTF_HOST) == 0 && netmask != NULL &&
396 	    satocsin(netmask)->sin_addr.s_addr != 0xffffffff)
397 		rt->rt_flags |= RTF_CONNECTED;
398 
399 	if ((rt->rt_flags & (RTF_CONNECTED | RTF_LOCAL))) {
400 		union {
401 			struct sockaddr sa;
402 			struct sockaddr_storage ss;
403 			struct sockaddr_dl sdl;
404 		} u;
405 		/*
406 		 * Case 1: This route should come from a route to iface.
407 		 */
408 		sockaddr_dl_init(&u.sdl, sizeof(u.ss),
409 		    ifp->if_index, ifp->if_type, NULL, namelen, NULL, addrlen);
410 		rt_setgate(rt, &u.sa);
411 		gate = rt->rt_gateway;
412 	}
413 	return gate;
414 }
415 
416 static void
417 arp_init_llentry(struct ifnet *ifp, struct llentry *lle)
418 {
419 
420 	switch (ifp->if_type) {
421 #if NTOKEN > 0
422 	case IFT_ISO88025:
423 		lle->la_opaque = kmem_intr_alloc(sizeof(struct token_rif),
424 		    KM_NOSLEEP);
425 		lle->lle_ll_free = arp_free_llentry_tokenring;
426 		break;
427 #endif
428 	}
429 }
430 
431 #if NTOKEN > 0
432 static void
433 arp_free_llentry_tokenring(struct llentry *lle)
434 {
435 
436 	kmem_intr_free(lle->la_opaque, sizeof(struct token_rif));
437 }
438 #endif
439 
440 /*
441  * Parallel to llc_rtrequest.
442  */
443 void
444 arp_rtrequest(int req, struct rtentry *rt, const struct rt_addrinfo *info)
445 {
446 	struct sockaddr *gate = rt->rt_gateway;
447 	struct in_ifaddr *ia;
448 	struct ifaddr *ifa;
449 	struct ifnet *ifp = rt->rt_ifp;
450 	int bound;
451 	int s;
452 
453 	if (req == RTM_LLINFO_UPD) {
454 		struct in_addr *in;
455 
456 		if ((ifa = info->rti_ifa) == NULL)
457 			return;
458 
459 		in = &ifatoia(ifa)->ia_addr.sin_addr;
460 
461 		if (ifatoia(ifa)->ia4_flags &
462 		    (IN_IFF_NOTREADY | IN_IFF_DETACHED))
463 		{
464 			arplog((LOG_DEBUG, "arp_request: %s not ready\n",
465 			   in_fmtaddr(*in)));
466 			return;
467 		}
468 
469 		arprequest(ifa->ifa_ifp, in, in,
470 		    CLLADDR(ifa->ifa_ifp->if_sadl));
471 		return;
472 	}
473 
474 	if ((rt->rt_flags & RTF_GATEWAY) != 0) {
475 		if (req != RTM_ADD)
476 			return;
477 
478 		/*
479 		 * linklayers with particular link MTU limitation.
480 		 */
481 		switch(ifp->if_type) {
482 #if NFDDI > 0
483 		case IFT_FDDI:
484 			if (ifp->if_mtu > FDDIIPMTU)
485 				rt->rt_rmx.rmx_mtu = FDDIIPMTU;
486 			break;
487 #endif
488 #if NARCNET > 0
489 		case IFT_ARCNET:
490 		    {
491 			int arcipifmtu;
492 
493 			if (ifp->if_flags & IFF_LINK0)
494 				arcipifmtu = arc_ipmtu;
495 			else
496 				arcipifmtu = ARCMTU;
497 			if (ifp->if_mtu > arcipifmtu)
498 				rt->rt_rmx.rmx_mtu = arcipifmtu;
499 			break;
500 		    }
501 #endif
502 		}
503 		return;
504 	}
505 
506 	switch (req) {
507 	case RTM_SETGATE:
508 		gate = arp_setgate(rt, gate, info->rti_info[RTAX_NETMASK]);
509 		break;
510 	case RTM_ADD:
511 		gate = arp_setgate(rt, gate, info->rti_info[RTAX_NETMASK]);
512 		if (gate == NULL) {
513 			log(LOG_ERR, "%s: arp_setgate failed\n", __func__);
514 			break;
515 		}
516 		if ((rt->rt_flags & RTF_CONNECTED) ||
517 		    (rt->rt_flags & RTF_LOCAL)) {
518 			/*
519 			 * Give this route an expiration time, even though
520 			 * it's a "permanent" route, so that routes cloned
521 			 * from it do not need their expiration time set.
522 			 */
523 			KASSERT(time_uptime != 0);
524 			rt->rt_expire = time_uptime;
525 			/*
526 			 * linklayers with particular link MTU limitation.
527 			 */
528 			switch (ifp->if_type) {
529 #if NFDDI > 0
530 			case IFT_FDDI:
531 				if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0 &&
532 				    (rt->rt_rmx.rmx_mtu > FDDIIPMTU ||
533 				     (rt->rt_rmx.rmx_mtu == 0 &&
534 				      ifp->if_mtu > FDDIIPMTU)))
535 					rt->rt_rmx.rmx_mtu = FDDIIPMTU;
536 				break;
537 #endif
538 #if NARCNET > 0
539 			case IFT_ARCNET:
540 			    {
541 				int arcipifmtu;
542 				if (ifp->if_flags & IFF_LINK0)
543 					arcipifmtu = arc_ipmtu;
544 				else
545 					arcipifmtu = ARCMTU;
546 
547 				if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0 &&
548 				    (rt->rt_rmx.rmx_mtu > arcipifmtu ||
549 				     (rt->rt_rmx.rmx_mtu == 0 &&
550 				      ifp->if_mtu > arcipifmtu)))
551 					rt->rt_rmx.rmx_mtu = arcipifmtu;
552 				break;
553 			    }
554 #endif
555 			}
556 			if (rt->rt_flags & RTF_CONNECTED)
557 				break;
558 		}
559 
560 		bound = curlwp_bind();
561 		/* Announce a new entry if requested. */
562 		if (rt->rt_flags & RTF_ANNOUNCE) {
563 			struct psref psref;
564 			ia = in_get_ia_on_iface_psref(
565 			    satocsin(rt_getkey(rt))->sin_addr, ifp, &psref);
566 			if (ia == NULL ||
567 			    ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
568 				;
569 			else
570 				arprequest(ifp,
571 				    &satocsin(rt_getkey(rt))->sin_addr,
572 				    &satocsin(rt_getkey(rt))->sin_addr,
573 				    CLLADDR(satocsdl(gate)));
574 			if (ia != NULL)
575 				ia4_release(ia, &psref);
576 		}
577 
578 		if (gate->sa_family != AF_LINK ||
579 		    gate->sa_len < sockaddr_dl_measure(0, ifp->if_addrlen)) {
580 			log(LOG_DEBUG, "%s: bad gateway value\n", __func__);
581 			goto out;
582 		}
583 
584 		satosdl(gate)->sdl_type = ifp->if_type;
585 		satosdl(gate)->sdl_index = ifp->if_index;
586 
587 		/* If the route is for a broadcast address mark it as such.
588 		 * This way we can avoid an expensive call to in_broadcast()
589 		 * in ip_output() most of the time (because the route passed
590 		 * to ip_output() is almost always a host route). */
591 		if (rt->rt_flags & RTF_HOST &&
592 		    !(rt->rt_flags & RTF_BROADCAST) &&
593 		    in_broadcast(satocsin(rt_getkey(rt))->sin_addr, rt->rt_ifp))
594 			rt->rt_flags |= RTF_BROADCAST;
595 		/* There is little point in resolving the broadcast address */
596 		if (rt->rt_flags & RTF_BROADCAST)
597 			goto out;
598 
599 		/*
600 		 * When called from rt_ifa_addlocal, we cannot depend on that
601 		 * the address (rt_getkey(rt)) exits in the address list of the
602 		 * interface. So check RTF_LOCAL instead.
603 		 */
604 		if (rt->rt_flags & RTF_LOCAL) {
605 			rt->rt_expire = 0;
606 			if (useloopback) {
607 				rt->rt_ifp = lo0ifp;
608 				rt->rt_rmx.rmx_mtu = 0;
609 			}
610 			goto out;
611 		}
612 
613 		s = pserialize_read_enter();
614 		ia = in_get_ia_on_iface(satocsin(rt_getkey(rt))->sin_addr, ifp);
615 		if (ia == NULL) {
616 			pserialize_read_exit(s);
617 			goto out;
618 		}
619 
620 		rt->rt_expire = 0;
621 		if (useloopback) {
622 			rt->rt_ifp = lo0ifp;
623 			rt->rt_rmx.rmx_mtu = 0;
624 		}
625 		rt->rt_flags |= RTF_LOCAL;
626 		/*
627 		 * make sure to set rt->rt_ifa to the interface
628 		 * address we are using, otherwise we will have trouble
629 		 * with source address selection.
630 		 */
631 		ifa = &ia->ia_ifa;
632 		if (ifa != rt->rt_ifa)
633 			/* Assume it doesn't sleep */
634 			rt_replace_ifa(rt, ifa);
635 		pserialize_read_exit(s);
636 	out:
637 		curlwp_bindx(bound);
638 		break;
639 	}
640 }
641 
642 /*
643  * Broadcast an ARP request. Caller specifies:
644  *	- arp header source ip address
645  *	- arp header target ip address
646  *	- arp header source ethernet address
647  */
648 void
649 arprequest(struct ifnet *ifp,
650     const struct in_addr *sip, const struct in_addr *tip,
651     const u_int8_t *enaddr)
652 {
653 	struct mbuf *m;
654 	struct arphdr *ah;
655 	struct sockaddr sa;
656 	uint64_t *arps;
657 
658 	KASSERT(sip != NULL);
659 	KASSERT(tip != NULL);
660 	KASSERT(enaddr != NULL);
661 
662 	if ((m = m_gethdr(M_DONTWAIT, MT_DATA)) == NULL)
663 		return;
664 	MCLAIM(m, &arpdomain.dom_mowner);
665 	switch (ifp->if_type) {
666 	case IFT_IEEE1394:
667 		m->m_len = sizeof(*ah) + 2 * sizeof(struct in_addr) +
668 		    ifp->if_addrlen;
669 		break;
670 	default:
671 		m->m_len = sizeof(*ah) + 2 * sizeof(struct in_addr) +
672 		    2 * ifp->if_addrlen;
673 		break;
674 	}
675 	m->m_pkthdr.len = m->m_len;
676 	MH_ALIGN(m, m->m_len);
677 	ah = mtod(m, struct arphdr *);
678 	memset(ah, 0, m->m_len);
679 	switch (ifp->if_type) {
680 	case IFT_IEEE1394:	/* RFC2734 */
681 		/* fill it now for ar_tpa computation */
682 		ah->ar_hrd = htons(ARPHRD_IEEE1394);
683 		break;
684 	default:
685 		/* ifp->if_output will fill ar_hrd */
686 		break;
687 	}
688 	ah->ar_pro = htons(ETHERTYPE_IP);
689 	ah->ar_hln = ifp->if_addrlen;		/* hardware address length */
690 	ah->ar_pln = sizeof(struct in_addr);	/* protocol address length */
691 	ah->ar_op = htons(ARPOP_REQUEST);
692 	memcpy(ar_sha(ah), enaddr, ah->ar_hln);
693 	memcpy(ar_spa(ah), sip, ah->ar_pln);
694 	memcpy(ar_tpa(ah), tip, ah->ar_pln);
695 	sa.sa_family = AF_ARP;
696 	sa.sa_len = 2;
697 	m->m_flags |= M_BCAST;
698 	arps = ARP_STAT_GETREF();
699 	arps[ARP_STAT_SNDTOTAL]++;
700 	arps[ARP_STAT_SENDREQUEST]++;
701 	ARP_STAT_PUTREF();
702 	if_output_lock(ifp, ifp, m, &sa, NULL);
703 }
704 
705 /*
706  * Resolve an IP address into an ethernet address.  If success,
707  * desten is filled in.  If there is no entry in arptab,
708  * set one up and broadcast a request for the IP address.
709  * Hold onto this mbuf and resend it once the address
710  * is finally resolved.  A return value of 0 indicates
711  * that desten has been filled in and the packet should be sent
712  * normally; a return value of EWOULDBLOCK indicates that the packet has been
713  * held pending resolution.
714  * Any other value indicates an error.
715  */
716 int
717 arpresolve(struct ifnet *ifp, const struct rtentry *rt, struct mbuf *m,
718     const struct sockaddr *dst, void *desten, size_t destlen)
719 {
720 	struct llentry *la;
721 	const char *create_lookup;
722 	bool renew;
723 	int error;
724 
725 	KASSERT(m != NULL);
726 
727 	la = arplookup(ifp, m, NULL, dst, 0);
728 	if (la == NULL)
729 		goto notfound;
730 
731 	if ((la->la_flags & LLE_VALID) &&
732 	    ((la->la_flags & LLE_STATIC) || la->la_expire > time_uptime)) {
733 		KASSERT(destlen >= ifp->if_addrlen);
734 		memcpy(desten, &la->ll_addr, ifp->if_addrlen);
735 		LLE_RUNLOCK(la);
736 		return 0;
737 	}
738 
739 notfound:
740 #ifdef IFF_STATICARP /* FreeBSD */
741 #define _IFF_NOARP (IFF_NOARP | IFF_STATICARP)
742 #else
743 #define _IFF_NOARP IFF_NOARP
744 #endif
745 	if (ifp->if_flags & _IFF_NOARP) {
746 		if (la != NULL)
747 			LLE_RUNLOCK(la);
748 		error = ENOTSUP;
749 		goto bad;
750 	}
751 #undef _IFF_NOARP
752 	if (la == NULL) {
753 		create_lookup = "create";
754 		IF_AFDATA_WLOCK(ifp);
755 		la = lla_create(LLTABLE(ifp), LLE_EXCLUSIVE, dst);
756 		IF_AFDATA_WUNLOCK(ifp);
757 		if (la == NULL)
758 			ARP_STATINC(ARP_STAT_ALLOCFAIL);
759 		else
760 			arp_init_llentry(ifp, la);
761 	} else if (LLE_TRY_UPGRADE(la) == 0) {
762 		create_lookup = "lookup";
763 		LLE_RUNLOCK(la);
764 		IF_AFDATA_RLOCK(ifp);
765 		la = lla_lookup(LLTABLE(ifp), LLE_EXCLUSIVE, dst);
766 		IF_AFDATA_RUNLOCK(ifp);
767 	}
768 
769 	error = EINVAL;
770 	if (la == NULL) {
771 		log(LOG_DEBUG,
772 		    "%s: failed to %s llentry for %s on %s\n",
773 		    __func__, create_lookup, inet_ntoa(satocsin(dst)->sin_addr),
774 		    ifp->if_xname);
775 		goto bad;
776 	}
777 
778 	if ((la->la_flags & LLE_VALID) &&
779 	    ((la->la_flags & LLE_STATIC) || la->la_expire > time_uptime))
780 	{
781 		KASSERT(destlen >= ifp->if_addrlen);
782 		memcpy(desten, &la->ll_addr, ifp->if_addrlen);
783 		renew = false;
784 		/*
785 		 * If entry has an expiry time and it is approaching,
786 		 * see if we need to send an ARP request within this
787 		 * arpt_down interval.
788 		 */
789 		if (!(la->la_flags & LLE_STATIC) &&
790 		    time_uptime + la->la_preempt > la->la_expire)
791 		{
792 			renew = true;
793 			la->la_preempt--;
794 		}
795 
796 		LLE_WUNLOCK(la);
797 
798 		if (renew) {
799 			const u_int8_t *enaddr =
800 #if NCARP > 0
801 			    (ifp->if_type == IFT_CARP) ?
802 			    CLLADDR(ifp->if_sadl):
803 #endif
804 			    CLLADDR(ifp->if_sadl);
805 			arprequest(ifp,
806 			    &satocsin(rt->rt_ifa->ifa_addr)->sin_addr,
807 			    &satocsin(dst)->sin_addr, enaddr);
808 		}
809 
810 		return 0;
811 	}
812 
813 	if (la->la_flags & LLE_STATIC) {   /* should not happen! */
814 		LLE_RUNLOCK(la);
815 		log(LOG_DEBUG, "%s: ouch, empty static llinfo for %s\n",
816 		    __func__, inet_ntoa(satocsin(dst)->sin_addr));
817 		error = EINVAL;
818 		goto bad;
819 	}
820 
821 	renew = (la->la_asked == 0 || la->la_expire != time_uptime);
822 
823 	/*
824 	 * There is an arptab entry, but no ethernet address
825 	 * response yet.  Add the mbuf to the list, dropping
826 	 * the oldest packet if we have exceeded the system
827 	 * setting.
828 	 */
829 	LLE_WLOCK_ASSERT(la);
830 	if (la->la_numheld >= arp_maxhold) {
831 		if (la->la_hold != NULL) {
832 			struct mbuf *next = la->la_hold->m_nextpkt;
833 			m_freem(la->la_hold);
834 			la->la_hold = next;
835 			la->la_numheld--;
836 			ARP_STATINC(ARP_STAT_DFRDROPPED);
837 			ARP_STATINC(ARP_STAT_DFRTOTAL);
838 		}
839 	}
840 	if (la->la_hold != NULL) {
841 		struct mbuf *curr = la->la_hold;
842 		while (curr->m_nextpkt != NULL)
843 			curr = curr->m_nextpkt;
844 		curr->m_nextpkt = m;
845 	} else
846 		la->la_hold = m;
847 	la->la_numheld++;
848 	if (!renew)
849 		LLE_DOWNGRADE(la);
850 
851 	/*
852 	 * Return EWOULDBLOCK if we have tried less than arp_maxtries. It
853 	 * will be masked by ether_output(). Return EHOSTDOWN/EHOSTUNREACH
854 	 * if we have already sent arp_maxtries ARP requests. Retransmit the
855 	 * ARP request, but not faster than one request per second.
856 	 */
857 	if (la->la_asked < arp_maxtries)
858 		error = EWOULDBLOCK;	/* First request. */
859 	else
860 		error = (rt != NULL && rt->rt_flags & RTF_GATEWAY) ?
861 		    EHOSTUNREACH : EHOSTDOWN;
862 
863 	if (renew) {
864 		const u_int8_t *enaddr =
865 #if NCARP > 0
866 		    (rt != NULL && rt->rt_ifp->if_type == IFT_CARP) ?
867 		    CLLADDR(rt->rt_ifp->if_sadl):
868 #endif
869 		    CLLADDR(ifp->if_sadl);
870 		la->la_expire = time_uptime;
871 		arp_settimer(la, arpt_down);
872 		la->la_asked++;
873 		LLE_WUNLOCK(la);
874 
875 		if (rt != NULL) {
876 			arprequest(ifp, &satocsin(rt->rt_ifa->ifa_addr)->sin_addr,
877 			    &satocsin(dst)->sin_addr, enaddr);
878 		} else {
879 			struct sockaddr_in sin;
880 			struct rtentry *_rt;
881 
882 			sockaddr_in_init(&sin, &la->r_l3addr.addr4, 0);
883 
884 			/* XXX */
885 			_rt = rtalloc1((struct sockaddr *)&sin, 0);
886 			if (_rt == NULL)
887 				goto bad;
888 			arprequest(ifp,
889 			    &satocsin(_rt->rt_ifa->ifa_addr)->sin_addr,
890 			    &satocsin(dst)->sin_addr, enaddr);
891 			rtfree(_rt);
892 		}
893 		return error;
894 	}
895 
896 	LLE_RUNLOCK(la);
897 	return error;
898 
899 bad:
900 	m_freem(m);
901 	return error;
902 }
903 
904 /*
905  * Common length and type checks are done here,
906  * then the protocol-specific routine is called.
907  */
908 void
909 arpintr(void)
910 {
911 	struct mbuf *m;
912 	struct arphdr *ar;
913 	int s;
914 	int arplen;
915 
916 	mutex_enter(softnet_lock);
917 	KERNEL_LOCK(1, NULL);
918 	while (arpintrq.ifq_head) {
919 		struct ifnet *rcvif;
920 
921 		s = splnet();
922 		IF_DEQUEUE(&arpintrq, m);
923 		splx(s);
924 		if (m == NULL || (m->m_flags & M_PKTHDR) == 0)
925 			panic("arpintr");
926 
927 		MCLAIM(m, &arpdomain.dom_mowner);
928 		ARP_STATINC(ARP_STAT_RCVTOTAL);
929 
930 		/*
931 		 * First, make sure we have at least struct arphdr.
932 		 */
933 		if (m->m_len < sizeof(struct arphdr) ||
934 		    (ar = mtod(m, struct arphdr *)) == NULL)
935 			goto badlen;
936 
937 		rcvif = m_get_rcvif(m, &s);
938 		switch (rcvif->if_type) {
939 		case IFT_IEEE1394:
940 			arplen = sizeof(struct arphdr) +
941 			    ar->ar_hln + 2 * ar->ar_pln;
942 			break;
943 		default:
944 			arplen = sizeof(struct arphdr) +
945 			    2 * ar->ar_hln + 2 * ar->ar_pln;
946 			break;
947 		}
948 		m_put_rcvif(rcvif, &s);
949 
950 		if (/* XXX ntohs(ar->ar_hrd) == ARPHRD_ETHER && */
951 		    m->m_len >= arplen)
952 			switch (ntohs(ar->ar_pro)) {
953 			case ETHERTYPE_IP:
954 			case ETHERTYPE_IPTRAILERS:
955 				in_arpinput(m);
956 				continue;
957 			default:
958 				ARP_STATINC(ARP_STAT_RCVBADPROTO);
959 			}
960 		else {
961 badlen:
962 			ARP_STATINC(ARP_STAT_RCVBADLEN);
963 		}
964 		m_freem(m);
965 	}
966 	KERNEL_UNLOCK_ONE(NULL);
967 	mutex_exit(softnet_lock);
968 }
969 
970 /*
971  * ARP for Internet protocols on 10 Mb/s Ethernet.
972  * Algorithm is that given in RFC 826.
973  * In addition, a sanity check is performed on the sender
974  * protocol address, to catch impersonators.
975  * We no longer handle negotiations for use of trailer protocol:
976  * Formerly, ARP replied for protocol type ETHERTYPE_TRAIL sent
977  * along with IP replies if we wanted trailers sent to us,
978  * and also sent them in response to IP replies.
979  * This allowed either end to announce the desire to receive
980  * trailer packets.
981  * We no longer reply to requests for ETHERTYPE_TRAIL protocol either,
982  * but formerly didn't normally send requests.
983  */
984 static void
985 in_arpinput(struct mbuf *m)
986 {
987 	struct arphdr *ah;
988 	struct ifnet *ifp, *rcvif = NULL;
989 	struct llentry *la = NULL;
990 	struct in_ifaddr *ia = NULL;
991 #if NBRIDGE > 0
992 	struct in_ifaddr *bridge_ia = NULL;
993 #endif
994 #if NCARP > 0
995 	u_int32_t count = 0, index = 0;
996 #endif
997 	struct sockaddr sa;
998 	struct in_addr isaddr, itaddr, myaddr;
999 	int op;
1000 	void *tha;
1001 	uint64_t *arps;
1002 	struct psref psref, psref_ia;
1003 	int s;
1004 
1005 	if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
1006 		goto out;
1007 	ah = mtod(m, struct arphdr *);
1008 	op = ntohs(ah->ar_op);
1009 
1010 	rcvif = ifp = m_get_rcvif_psref(m, &psref);
1011 	if (__predict_false(rcvif == NULL))
1012 		goto drop;
1013 	/*
1014 	 * Fix up ah->ar_hrd if necessary, before using ar_tha() or
1015 	 * ar_tpa().
1016 	 */
1017 	switch (ifp->if_type) {
1018 	case IFT_IEEE1394:
1019 		if (ntohs(ah->ar_hrd) == ARPHRD_IEEE1394)
1020 			;
1021 		else {
1022 			/* XXX this is to make sure we compute ar_tha right */
1023 			/* XXX check ar_hrd more strictly? */
1024 			ah->ar_hrd = htons(ARPHRD_IEEE1394);
1025 		}
1026 		break;
1027 	default:
1028 		/* XXX check ar_hrd? */
1029 		break;
1030 	}
1031 
1032 	memcpy(&isaddr, ar_spa(ah), sizeof (isaddr));
1033 	memcpy(&itaddr, ar_tpa(ah), sizeof (itaddr));
1034 
1035 	if (m->m_flags & (M_BCAST|M_MCAST))
1036 		ARP_STATINC(ARP_STAT_RCVMCAST);
1037 
1038 
1039 	/*
1040 	 * Search for a matching interface address
1041 	 * or any address on the interface to use
1042 	 * as a dummy address in the rest of this function
1043 	 */
1044 	s = pserialize_read_enter();
1045 	IN_ADDRHASH_READER_FOREACH(ia, itaddr.s_addr) {
1046 		if (!in_hosteq(ia->ia_addr.sin_addr, itaddr))
1047 			continue;
1048 #if NCARP > 0
1049 		if (ia->ia_ifp->if_type == IFT_CARP &&
1050 		    ((ia->ia_ifp->if_flags & (IFF_UP|IFF_RUNNING)) ==
1051 		    (IFF_UP|IFF_RUNNING))) {
1052 			index++;
1053 			if (ia->ia_ifp == rcvif &&
1054 			    carp_iamatch(ia, ar_sha(ah),
1055 			    &count, index)) {
1056 				break;
1057 			}
1058 		} else
1059 #endif
1060 		if (ia->ia_ifp == rcvif)
1061 			break;
1062 #if NBRIDGE > 0
1063 		/*
1064 		 * If the interface we received the packet on
1065 		 * is part of a bridge, check to see if we need
1066 		 * to "bridge" the packet to ourselves at this
1067 		 * layer.  Note we still prefer a perfect match,
1068 		 * but allow this weaker match if necessary.
1069 		 */
1070 		if (rcvif->if_bridge != NULL &&
1071 		    rcvif->if_bridge == ia->ia_ifp->if_bridge)
1072 			bridge_ia = ia;
1073 #endif /* NBRIDGE > 0 */
1074 	}
1075 
1076 #if NBRIDGE > 0
1077 	if (ia == NULL && bridge_ia != NULL) {
1078 		ia = bridge_ia;
1079 		m_put_rcvif_psref(rcvif, &psref);
1080 		rcvif = NULL;
1081 		/* FIXME */
1082 		ifp = bridge_ia->ia_ifp;
1083 	}
1084 #endif
1085 	if (ia != NULL)
1086 		ia4_acquire(ia, &psref_ia);
1087 	pserialize_read_exit(s);
1088 
1089 	if (ia == NULL) {
1090 		ia = in_get_ia_on_iface_psref(isaddr, rcvif, &psref_ia);
1091 		if (ia == NULL) {
1092 			ia = in_get_ia_from_ifp_psref(ifp, &psref_ia);
1093 			if (ia == NULL) {
1094 				ARP_STATINC(ARP_STAT_RCVNOINT);
1095 				goto out;
1096 			}
1097 		}
1098 	}
1099 
1100 	myaddr = ia->ia_addr.sin_addr;
1101 
1102 	/* XXX checks for bridge case? */
1103 	if (!memcmp(ar_sha(ah), CLLADDR(ifp->if_sadl), ifp->if_addrlen)) {
1104 		ARP_STATINC(ARP_STAT_RCVLOCALSHA);
1105 		goto out;	/* it's from me, ignore it. */
1106 	}
1107 
1108 	/* XXX checks for bridge case? */
1109 	if (!memcmp(ar_sha(ah), ifp->if_broadcastaddr, ifp->if_addrlen)) {
1110 		ARP_STATINC(ARP_STAT_RCVBCASTSHA);
1111 		log(LOG_ERR,
1112 		    "%s: arp: link address is broadcast for IP address %s!\n",
1113 		    ifp->if_xname, in_fmtaddr(isaddr));
1114 		goto out;
1115 	}
1116 
1117 	/*
1118 	 * If the source IP address is zero, this is an RFC 5227 ARP probe
1119 	 */
1120 	if (in_nullhost(isaddr))
1121 		ARP_STATINC(ARP_STAT_RCVZEROSPA);
1122 	else if (in_hosteq(isaddr, myaddr))
1123 		ARP_STATINC(ARP_STAT_RCVLOCALSPA);
1124 
1125 	if (in_nullhost(itaddr))
1126 		ARP_STATINC(ARP_STAT_RCVZEROTPA);
1127 
1128 	/* DAD check, RFC 5227 2.1.1, Probe Details */
1129 	if (in_hosteq(isaddr, myaddr) ||
1130 	    (in_nullhost(isaddr) && in_hosteq(itaddr, myaddr)))
1131 	{
1132 		/* If our address is tentative, mark it as duplicated */
1133 		if (ia->ia4_flags & IN_IFF_TENTATIVE)
1134 			arp_dad_duplicated((struct ifaddr *)ia);
1135 		/* If our address is unuseable, don't reply */
1136 		if (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
1137 			goto out;
1138 	}
1139 
1140 	/*
1141 	 * If the target IP address is zero, ignore the packet.
1142 	 * This prevents the code below from tring to answer
1143 	 * when we are using IP address zero (booting).
1144 	 */
1145 	if (in_nullhost(itaddr))
1146 		goto out;
1147 
1148 	if (in_nullhost(isaddr))
1149 		goto reply;
1150 
1151 	if (in_hosteq(isaddr, myaddr)) {
1152 		log(LOG_ERR,
1153 		   "duplicate IP address %s sent from link address %s\n",
1154 		   in_fmtaddr(isaddr), lla_snprintf(ar_sha(ah), ah->ar_hln));
1155 		itaddr = myaddr;
1156 		goto reply;
1157 	}
1158 
1159 	if (in_hosteq(itaddr, myaddr))
1160 		la = arpcreate(ifp, m, &isaddr, NULL, 1);
1161 	else
1162 		la = arplookup(ifp, m, &isaddr, NULL, 1);
1163 	if (la == NULL)
1164 		goto reply;
1165 
1166 	if ((la->la_flags & LLE_VALID) &&
1167 	    memcmp(ar_sha(ah), &la->ll_addr, ifp->if_addrlen)) {
1168 		if (la->la_flags & LLE_STATIC) {
1169 			ARP_STATINC(ARP_STAT_RCVOVERPERM);
1170 			if (!log_permanent_modify)
1171 				goto out;
1172 			log(LOG_INFO,
1173 			    "%s tried to overwrite permanent arp info"
1174 			    " for %s\n",
1175 			    lla_snprintf(ar_sha(ah), ah->ar_hln),
1176 			    in_fmtaddr(isaddr));
1177 			goto out;
1178 		} else if (la->lle_tbl->llt_ifp != ifp) {
1179 			/* XXX should not happen? */
1180 			ARP_STATINC(ARP_STAT_RCVOVERINT);
1181 			if (!log_wrong_iface)
1182 				goto out;
1183 			log(LOG_INFO,
1184 			    "%s on %s tried to overwrite "
1185 			    "arp info for %s on %s\n",
1186 			    lla_snprintf(ar_sha(ah), ah->ar_hln),
1187 			    ifp->if_xname, in_fmtaddr(isaddr),
1188 			    la->lle_tbl->llt_ifp->if_xname);
1189 				goto out;
1190 		} else {
1191 			ARP_STATINC(ARP_STAT_RCVOVER);
1192 			if (log_movements)
1193 				log(LOG_INFO, "arp info overwritten "
1194 				    "for %s by %s\n",
1195 				    in_fmtaddr(isaddr),
1196 				    lla_snprintf(ar_sha(ah),
1197 				    ah->ar_hln));
1198 		}
1199 	}
1200 
1201 	/* XXX llentry should have addrlen? */
1202 #if 0
1203 	/*
1204 	 * sanity check for the address length.
1205 	 * XXX this does not work for protocols with variable address
1206 	 * length. -is
1207 	 */
1208 	if (sdl->sdl_alen && sdl->sdl_alen != ah->ar_hln) {
1209 		ARP_STATINC(ARP_STAT_RCVLENCHG);
1210 		log(LOG_WARNING,
1211 		    "arp from %s: new addr len %d, was %d\n",
1212 		    in_fmtaddr(isaddr), ah->ar_hln, sdl->sdl_alen);
1213 	}
1214 #endif
1215 
1216 	if (ifp->if_addrlen != ah->ar_hln) {
1217 		ARP_STATINC(ARP_STAT_RCVBADLEN);
1218 		log(LOG_WARNING,
1219 		    "arp from %s: addr len: new %d, i/f %d (ignored)\n",
1220 		    in_fmtaddr(isaddr), ah->ar_hln,
1221 		    ifp->if_addrlen);
1222 		goto reply;
1223 	}
1224 
1225 #if NTOKEN > 0
1226 	/*
1227 	 * XXX uses m_data and assumes the complete answer including
1228 	 * XXX token-ring headers is in the same buf
1229 	 */
1230 	if (ifp->if_type == IFT_ISO88025) {
1231 		struct token_header *trh;
1232 
1233 		trh = (struct token_header *)M_TRHSTART(m);
1234 		if (trh->token_shost[0] & TOKEN_RI_PRESENT) {
1235 			struct token_rif *rif;
1236 			size_t riflen;
1237 
1238 			rif = TOKEN_RIF(trh);
1239 			riflen = (ntohs(rif->tr_rcf) &
1240 			    TOKEN_RCF_LEN_MASK) >> 8;
1241 
1242 			if (riflen > 2 &&
1243 			    riflen < sizeof(struct token_rif) &&
1244 			    (riflen & 1) == 0) {
1245 				rif->tr_rcf ^= htons(TOKEN_RCF_DIRECTION);
1246 				rif->tr_rcf &= htons(~TOKEN_RCF_BROADCAST_MASK);
1247 				memcpy(TOKEN_RIF_LLE(la), rif, riflen);
1248 			}
1249 		}
1250 	}
1251 #endif /* NTOKEN > 0 */
1252 
1253 	KASSERT(sizeof(la->ll_addr) >= ifp->if_addrlen);
1254 	(void)memcpy(&la->ll_addr, ar_sha(ah), ifp->if_addrlen);
1255 	la->la_flags |= LLE_VALID;
1256 	if ((la->la_flags & LLE_STATIC) == 0) {
1257 		la->la_expire = time_uptime + arpt_keep;
1258 		arp_settimer(la, arpt_keep);
1259 	}
1260 	la->la_asked = 0;
1261 	/* rt->rt_flags &= ~RTF_REJECT; */
1262 
1263 	if (la->la_hold != NULL) {
1264 		int n = la->la_numheld;
1265 		struct mbuf *m_hold, *m_hold_next;
1266 		struct sockaddr_in sin;
1267 
1268 		sockaddr_in_init(&sin, &la->r_l3addr.addr4, 0);
1269 
1270 		m_hold = la->la_hold;
1271 		la->la_hold = NULL;
1272 		la->la_numheld = 0;
1273 		/*
1274 		 * We have to unlock here because if_output would call
1275 		 * arpresolve
1276 		 */
1277 		LLE_WUNLOCK(la);
1278 		ARP_STATADD(ARP_STAT_DFRSENT, n);
1279 		ARP_STATADD(ARP_STAT_DFRTOTAL, n);
1280 		for (; m_hold != NULL; m_hold = m_hold_next) {
1281 			m_hold_next = m_hold->m_nextpkt;
1282 			m_hold->m_nextpkt = NULL;
1283 			if_output_lock(ifp, ifp, m_hold, sintosa(&sin), NULL);
1284 		}
1285 	} else
1286 		LLE_WUNLOCK(la);
1287 	la = NULL;
1288 
1289 reply:
1290 	if (la != NULL) {
1291 		LLE_WUNLOCK(la);
1292 		la = NULL;
1293 	}
1294 	if (op != ARPOP_REQUEST) {
1295 		if (op == ARPOP_REPLY)
1296 			ARP_STATINC(ARP_STAT_RCVREPLY);
1297 		goto out;
1298 	}
1299 	ARP_STATINC(ARP_STAT_RCVREQUEST);
1300 	if (in_hosteq(itaddr, myaddr)) {
1301 		/* If our address is unuseable, don't reply */
1302 		if (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
1303 			goto out;
1304 		/* I am the target */
1305 		tha = ar_tha(ah);
1306 		if (tha)
1307 			memcpy(tha, ar_sha(ah), ah->ar_hln);
1308 		memcpy(ar_sha(ah), CLLADDR(ifp->if_sadl), ah->ar_hln);
1309 	} else {
1310 		/* Proxy ARP */
1311 		struct llentry *lle = NULL;
1312 		struct sockaddr_in sin;
1313 #if NCARP > 0
1314 		struct ifnet *_rcvif = m_get_rcvif(m, &s);
1315 		if (ifp->if_type == IFT_CARP && _rcvif->if_type != IFT_CARP)
1316 			goto out;
1317 		m_put_rcvif(_rcvif, &s);
1318 #endif
1319 
1320 		tha = ar_tha(ah);
1321 
1322 		sockaddr_in_init(&sin, &itaddr, 0);
1323 
1324 		IF_AFDATA_RLOCK(ifp);
1325 		lle = lla_lookup(LLTABLE(ifp), 0, (struct sockaddr *)&sin);
1326 		IF_AFDATA_RUNLOCK(ifp);
1327 
1328 		if ((lle != NULL) && (lle->la_flags & LLE_PUB)) {
1329 			(void)memcpy(tha, ar_sha(ah), ah->ar_hln);
1330 			(void)memcpy(ar_sha(ah), &lle->ll_addr, ah->ar_hln);
1331 			LLE_RUNLOCK(lle);
1332 		} else {
1333 			if (lle != NULL)
1334 				LLE_RUNLOCK(lle);
1335 			goto drop;
1336 		}
1337 	}
1338 	ia4_release(ia, &psref_ia);
1339 
1340 	memcpy(ar_tpa(ah), ar_spa(ah), ah->ar_pln);
1341 	memcpy(ar_spa(ah), &itaddr, ah->ar_pln);
1342 	ah->ar_op = htons(ARPOP_REPLY);
1343 	ah->ar_pro = htons(ETHERTYPE_IP); /* let's be sure! */
1344 	switch (ifp->if_type) {
1345 	case IFT_IEEE1394:
1346 		/*
1347 		 * ieee1394 arp reply is broadcast
1348 		 */
1349 		m->m_flags &= ~M_MCAST;
1350 		m->m_flags |= M_BCAST;
1351 		m->m_len = sizeof(*ah) + (2 * ah->ar_pln) + ah->ar_hln;
1352 		break;
1353 
1354 	default:
1355 		m->m_flags &= ~(M_BCAST|M_MCAST); /* never reply by broadcast */
1356 		m->m_len = sizeof(*ah) + (2 * ah->ar_pln) + (2 * ah->ar_hln);
1357 		break;
1358 	}
1359 	m->m_pkthdr.len = m->m_len;
1360 	sa.sa_family = AF_ARP;
1361 	sa.sa_len = 2;
1362 	arps = ARP_STAT_GETREF();
1363 	arps[ARP_STAT_SNDTOTAL]++;
1364 	arps[ARP_STAT_SNDREPLY]++;
1365 	ARP_STAT_PUTREF();
1366 	if_output_lock(ifp, ifp, m, &sa, NULL);
1367 	if (rcvif != NULL)
1368 		m_put_rcvif_psref(rcvif, &psref);
1369 	return;
1370 
1371 out:
1372 	if (la != NULL)
1373 		LLE_WUNLOCK(la);
1374 drop:
1375 	if (ia != NULL)
1376 		ia4_release(ia, &psref_ia);
1377 	if (rcvif != NULL)
1378 		m_put_rcvif_psref(rcvif, &psref);
1379 	m_freem(m);
1380 }
1381 
1382 /*
1383  * Lookup or a new address in arptab.
1384  */
1385 static struct llentry *
1386 arplookup(struct ifnet *ifp, struct mbuf *m, const struct in_addr *addr,
1387     const struct sockaddr *sa, int wlock)
1388 {
1389 	struct sockaddr_in sin;
1390 	struct llentry *la;
1391 	int flags = wlock ? LLE_EXCLUSIVE : 0;
1392 
1393 
1394 	if (sa == NULL) {
1395 		KASSERT(addr != NULL);
1396 		sockaddr_in_init(&sin, addr, 0);
1397 		sa = sintocsa(&sin);
1398 	}
1399 
1400 	IF_AFDATA_RLOCK(ifp);
1401 	la = lla_lookup(LLTABLE(ifp), flags, sa);
1402 	IF_AFDATA_RUNLOCK(ifp);
1403 
1404 	return la;
1405 }
1406 
1407 static struct llentry *
1408 arpcreate(struct ifnet *ifp, struct mbuf *m, const struct in_addr *addr,
1409     const struct sockaddr *sa, int wlock)
1410 {
1411 	struct sockaddr_in sin;
1412 	struct llentry *la;
1413 	int flags = wlock ? LLE_EXCLUSIVE : 0;
1414 
1415 	if (sa == NULL) {
1416 		KASSERT(addr != NULL);
1417 		sockaddr_in_init(&sin, addr, 0);
1418 		sa = sintocsa(&sin);
1419 	}
1420 
1421 	la = arplookup(ifp, m, addr, sa, wlock);
1422 
1423 	if (la == NULL) {
1424 		IF_AFDATA_WLOCK(ifp);
1425 		la = lla_create(LLTABLE(ifp), flags, sa);
1426 		IF_AFDATA_WUNLOCK(ifp);
1427 
1428 		if (la != NULL)
1429 			arp_init_llentry(ifp, la);
1430 	}
1431 
1432 	return la;
1433 }
1434 
1435 int
1436 arpioctl(u_long cmd, void *data)
1437 {
1438 
1439 	return EOPNOTSUPP;
1440 }
1441 
1442 void
1443 arp_ifinit(struct ifnet *ifp, struct ifaddr *ifa)
1444 {
1445 	struct in_addr *ip;
1446 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1447 
1448 	/*
1449 	 * Warn the user if another station has this IP address,
1450 	 * but only if the interface IP address is not zero.
1451 	 */
1452 	ip = &IA_SIN(ifa)->sin_addr;
1453 	if (!in_nullhost(*ip) &&
1454 	    (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED)) == 0) {
1455 		struct llentry *lle;
1456 
1457 		arprequest(ifp, ip, ip, CLLADDR(ifp->if_sadl));
1458 
1459 		/*
1460 		 * interface address is considered static entry
1461 		 * because the output of the arp utility shows
1462 		 * that L2 entry as permanent
1463 		 */
1464 		IF_AFDATA_WLOCK(ifp);
1465 		lle = lla_create(LLTABLE(ifp), (LLE_IFADDR | LLE_STATIC),
1466 				 (struct sockaddr *)IA_SIN(ifa));
1467 		IF_AFDATA_WUNLOCK(ifp);
1468 		if (lle == NULL)
1469 			log(LOG_INFO, "%s: cannot create arp entry for"
1470 			    " interface address\n", __func__);
1471 		else {
1472 			arp_init_llentry(ifp, lle);
1473 			LLE_RUNLOCK(lle);
1474 		}
1475 	}
1476 
1477 	ifa->ifa_rtrequest = arp_rtrequest;
1478 	ifa->ifa_flags |= RTF_CONNECTED;
1479 
1480 	/* ARP will handle DAD for this address. */
1481 	if (ia->ia4_flags & IN_IFF_TRYTENTATIVE) {
1482 		ia->ia4_flags |= IN_IFF_TENTATIVE;
1483 		ia->ia_dad_start = arp_dad_start;
1484 		ia->ia_dad_stop = arp_dad_stop;
1485 	}
1486 }
1487 
1488 TAILQ_HEAD(dadq_head, dadq);
1489 struct dadq {
1490 	TAILQ_ENTRY(dadq) dad_list;
1491 	struct ifaddr *dad_ifa;
1492 	int dad_count;		/* max ARP to send */
1493 	int dad_arp_tcount;	/* # of trials to send ARP */
1494 	int dad_arp_ocount;	/* ARP sent so far */
1495 	int dad_arp_announce;	/* max ARP announcements */
1496 	int dad_arp_acount;	/* # of announcements */
1497 	struct callout dad_timer_ch;
1498 };
1499 MALLOC_JUSTDEFINE(M_IPARP, "ARP DAD", "ARP DAD Structure");
1500 
1501 static struct dadq_head dadq;
1502 static int dad_init = 0;
1503 static int dad_maxtry = 15;     /* max # of *tries* to transmit DAD packet */
1504 static kmutex_t arp_dad_lock;
1505 
1506 static struct dadq *
1507 arp_dad_find(struct ifaddr *ifa)
1508 {
1509 	struct dadq *dp;
1510 
1511 	KASSERT(mutex_owned(&arp_dad_lock));
1512 
1513 	TAILQ_FOREACH(dp, &dadq, dad_list) {
1514 		if (dp->dad_ifa == ifa)
1515 			return dp;
1516 	}
1517 	return NULL;
1518 }
1519 
1520 static void
1521 arp_dad_starttimer(struct dadq *dp, int ticks)
1522 {
1523 
1524 	callout_reset(&dp->dad_timer_ch, ticks,
1525 	    (void (*)(void *))arp_dad_timer, (void *)dp->dad_ifa);
1526 }
1527 
1528 static void
1529 arp_dad_stoptimer(struct dadq *dp)
1530 {
1531 
1532 	callout_halt(&dp->dad_timer_ch, softnet_lock);
1533 }
1534 
1535 static void
1536 arp_dad_output(struct dadq *dp, struct ifaddr *ifa)
1537 {
1538 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1539 	struct ifnet *ifp = ifa->ifa_ifp;
1540 	struct in_addr sip;
1541 
1542 	dp->dad_arp_tcount++;
1543 	if ((ifp->if_flags & IFF_UP) == 0)
1544 		return;
1545 	if ((ifp->if_flags & IFF_RUNNING) == 0)
1546 		return;
1547 
1548 	dp->dad_arp_tcount = 0;
1549 	dp->dad_arp_ocount++;
1550 
1551 	memset(&sip, 0, sizeof(sip));
1552 	arprequest(ifa->ifa_ifp, &sip, &ia->ia_addr.sin_addr,
1553 	    CLLADDR(ifa->ifa_ifp->if_sadl));
1554 }
1555 
1556 /*
1557  * Start Duplicate Address Detection (DAD) for specified interface address.
1558  */
1559 static void
1560 arp_dad_start(struct ifaddr *ifa)
1561 {
1562 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1563 	struct dadq *dp;
1564 
1565 	if (!dad_init) {
1566 		TAILQ_INIT(&dadq);
1567 		mutex_init(&arp_dad_lock, MUTEX_DEFAULT, IPL_NONE);
1568 		dad_init++;
1569 	}
1570 
1571 	/*
1572 	 * If we don't need DAD, don't do it.
1573 	 * - DAD is disabled (ip_dad_count == 0)
1574 	 */
1575 	if (!(ia->ia4_flags & IN_IFF_TENTATIVE)) {
1576 		log(LOG_DEBUG,
1577 		    "%s: called with non-tentative address %s(%s)\n", __func__,
1578 		    in_fmtaddr(ia->ia_addr.sin_addr),
1579 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1580 		return;
1581 	}
1582 	if (!ip_dad_count) {
1583 		struct in_addr *ip = &IA_SIN(ifa)->sin_addr;
1584 
1585 		ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1586 		rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1587 		arprequest(ifa->ifa_ifp, ip, ip,
1588 		    CLLADDR(ifa->ifa_ifp->if_sadl));
1589 		return;
1590 	}
1591 	KASSERT(ifa->ifa_ifp != NULL);
1592 	if (!(ifa->ifa_ifp->if_flags & IFF_UP))
1593 		return;
1594 
1595 	mutex_enter(&arp_dad_lock);
1596 	if (arp_dad_find(ifa) != NULL) {
1597 		mutex_exit(&arp_dad_lock);
1598 		/* DAD already in progress */
1599 		return;
1600 	}
1601 
1602 	dp = malloc(sizeof(*dp), M_IPARP, M_NOWAIT);
1603 	if (dp == NULL) {
1604 		mutex_exit(&arp_dad_lock);
1605 		log(LOG_ERR, "%s: memory allocation failed for %s(%s)\n",
1606 		    __func__, in_fmtaddr(ia->ia_addr.sin_addr),
1607 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1608 		return;
1609 	}
1610 	memset(dp, 0, sizeof(*dp));
1611 	callout_init(&dp->dad_timer_ch, CALLOUT_MPSAFE);
1612 
1613 	/*
1614 	 * Send ARP packet for DAD, ip_dad_count times.
1615 	 * Note that we must delay the first transmission.
1616 	 */
1617 	dp->dad_ifa = ifa;
1618 	ifaref(ifa);	/* just for safety */
1619 	dp->dad_count = ip_dad_count;
1620 	dp->dad_arp_announce = 0; /* Will be set when starting to announce */
1621 	dp->dad_arp_acount = dp->dad_arp_ocount = dp->dad_arp_tcount = 0;
1622 	TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list);
1623 
1624 	arplog((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
1625 	    in_fmtaddr(ia->ia_addr.sin_addr)));
1626 
1627 	arp_dad_starttimer(dp, cprng_fast32() % (PROBE_WAIT * hz));
1628 
1629 	mutex_exit(&arp_dad_lock);
1630 }
1631 
1632 /*
1633  * terminate DAD unconditionally.  used for address removals.
1634  */
1635 static void
1636 arp_dad_stop(struct ifaddr *ifa)
1637 {
1638 	struct dadq *dp;
1639 
1640 	if (!dad_init)
1641 		return;
1642 
1643 	mutex_enter(&arp_dad_lock);
1644 	dp = arp_dad_find(ifa);
1645 	if (dp == NULL) {
1646 		mutex_exit(&arp_dad_lock);
1647 		/* DAD wasn't started yet */
1648 		return;
1649 	}
1650 
1651 	/* Prevent the timer from running anymore. */
1652 	TAILQ_REMOVE(&dadq, dp, dad_list);
1653 	mutex_exit(&arp_dad_lock);
1654 
1655 	arp_dad_stoptimer(dp);
1656 
1657 	free(dp, M_IPARP);
1658 	dp = NULL;
1659 	ifafree(ifa);
1660 }
1661 
1662 static void
1663 arp_dad_timer(struct ifaddr *ifa)
1664 {
1665 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1666 	struct dadq *dp;
1667 	struct in_addr *ip;
1668 
1669 	mutex_enter(softnet_lock);
1670 	KERNEL_LOCK(1, NULL);
1671 	mutex_enter(&arp_dad_lock);
1672 
1673 	/* Sanity check */
1674 	if (ia == NULL) {
1675 		log(LOG_ERR, "%s: called with null parameter\n", __func__);
1676 		goto done;
1677 	}
1678 	dp = arp_dad_find(ifa);
1679 	if (dp == NULL) {
1680 		/* DAD seems to be stopping, so do nothing. */
1681 		goto done;
1682 	}
1683 	if (ia->ia4_flags & IN_IFF_DUPLICATED) {
1684 		log(LOG_ERR, "%s: called with duplicate address %s(%s)\n",
1685 		    __func__, in_fmtaddr(ia->ia_addr.sin_addr),
1686 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1687 		goto done;
1688 	}
1689 	if ((ia->ia4_flags & IN_IFF_TENTATIVE) == 0 && dp->dad_arp_acount == 0)
1690 	{
1691 		log(LOG_ERR, "%s: called with non-tentative address %s(%s)\n",
1692 		    __func__, in_fmtaddr(ia->ia_addr.sin_addr),
1693 		    ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1694 		goto done;
1695 	}
1696 
1697 	/* timeouted with IFF_{RUNNING,UP} check */
1698 	if (dp->dad_arp_tcount > dad_maxtry) {
1699 		arplog((LOG_INFO, "%s: could not run DAD, driver problem?\n",
1700 		    if_name(ifa->ifa_ifp)));
1701 
1702 		TAILQ_REMOVE(&dadq, dp, dad_list);
1703 		free(dp, M_IPARP);
1704 		dp = NULL;
1705 		ifafree(ifa);
1706 		goto done;
1707 	}
1708 
1709 	/* Need more checks? */
1710 	if (dp->dad_arp_ocount < dp->dad_count) {
1711 		int adelay;
1712 
1713 		/*
1714 		 * We have more ARP to go.  Send ARP packet for DAD.
1715 		 */
1716 		arp_dad_output(dp, ifa);
1717 		if (dp->dad_arp_ocount < dp->dad_count)
1718 			adelay = (PROBE_MIN * hz) +
1719 			    (cprng_fast32() %
1720 			    ((PROBE_MAX * hz) - (PROBE_MIN * hz)));
1721 		else
1722 			adelay = ANNOUNCE_WAIT * hz;
1723 		arp_dad_starttimer(dp, adelay);
1724 		goto done;
1725 	} else if (dp->dad_arp_acount == 0) {
1726 		/*
1727 		 * We are done with DAD.
1728 		 * No duplicate address found.
1729 		 */
1730 		ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1731 		rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1732 		arplog((LOG_DEBUG,
1733 		    "%s: DAD complete for %s - no duplicates found\n",
1734 		    if_name(ifa->ifa_ifp),
1735 		    in_fmtaddr(ia->ia_addr.sin_addr)));
1736 		dp->dad_arp_announce = ANNOUNCE_NUM;
1737 		goto announce;
1738 	} else if (dp->dad_arp_acount < dp->dad_arp_announce) {
1739 announce:
1740 		/*
1741 		 * Announce the address.
1742 		 */
1743 		ip = &IA_SIN(ifa)->sin_addr;
1744 		arprequest(ifa->ifa_ifp, ip, ip,
1745 		    CLLADDR(ifa->ifa_ifp->if_sadl));
1746 		dp->dad_arp_acount++;
1747 		if (dp->dad_arp_acount < dp->dad_arp_announce) {
1748 			arp_dad_starttimer(dp, ANNOUNCE_INTERVAL * hz);
1749 			goto done;
1750 		}
1751 		arplog((LOG_DEBUG,
1752 		    "%s: ARP announcement complete for %s\n",
1753 		    if_name(ifa->ifa_ifp),
1754 		    in_fmtaddr(ia->ia_addr.sin_addr)));
1755 	}
1756 
1757 	TAILQ_REMOVE(&dadq, dp, dad_list);
1758 	free(dp, M_IPARP);
1759 	dp = NULL;
1760 	ifafree(ifa);
1761 
1762 done:
1763 	mutex_exit(&arp_dad_lock);
1764 	KERNEL_UNLOCK_ONE(NULL);
1765 	mutex_exit(softnet_lock);
1766 }
1767 
1768 static void
1769 arp_dad_duplicated(struct ifaddr *ifa)
1770 {
1771 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1772 	struct ifnet *ifp;
1773 	struct dadq *dp;
1774 
1775 	mutex_enter(&arp_dad_lock);
1776 	dp = arp_dad_find(ifa);
1777 	if (dp == NULL) {
1778 		mutex_exit(&arp_dad_lock);
1779 		/* DAD seems to be stopping, so do nothing. */
1780 		return;
1781 	}
1782 
1783 	ifp = ifa->ifa_ifp;
1784 	log(LOG_ERR,
1785 	    "%s: DAD detected duplicate IPv4 address %s: ARP out=%d\n",
1786 	    if_name(ifp), in_fmtaddr(ia->ia_addr.sin_addr),
1787 	    dp->dad_arp_ocount);
1788 
1789 	ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1790 	ia->ia4_flags |= IN_IFF_DUPLICATED;
1791 
1792 	/* We are done with DAD, with duplicated address found. (failure) */
1793 	arp_dad_stoptimer(dp);
1794 
1795 	/* Inform the routing socket that DAD has completed */
1796 	rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1797 
1798 	TAILQ_REMOVE(&dadq, dp, dad_list);
1799 	mutex_exit(&arp_dad_lock);
1800 
1801 	free(dp, M_IPARP);
1802 	dp = NULL;
1803 	ifafree(ifa);
1804 }
1805 
1806 /*
1807  * Called from 10 Mb/s Ethernet interrupt handlers
1808  * when ether packet type ETHERTYPE_REVARP
1809  * is received.  Common length and type checks are done here,
1810  * then the protocol-specific routine is called.
1811  */
1812 void
1813 revarpinput(struct mbuf *m)
1814 {
1815 	struct arphdr *ar;
1816 
1817 	if (m->m_len < sizeof(struct arphdr))
1818 		goto out;
1819 	ar = mtod(m, struct arphdr *);
1820 #if 0 /* XXX I don't think we need this... and it will prevent other LL */
1821 	if (ntohs(ar->ar_hrd) != ARPHRD_ETHER)
1822 		goto out;
1823 #endif
1824 	if (m->m_len < sizeof(struct arphdr) + 2 * (ar->ar_hln + ar->ar_pln))
1825 		goto out;
1826 	switch (ntohs(ar->ar_pro)) {
1827 	case ETHERTYPE_IP:
1828 	case ETHERTYPE_IPTRAILERS:
1829 		in_revarpinput(m);
1830 		return;
1831 
1832 	default:
1833 		break;
1834 	}
1835 out:
1836 	m_freem(m);
1837 }
1838 
1839 /*
1840  * RARP for Internet protocols on 10 Mb/s Ethernet.
1841  * Algorithm is that given in RFC 903.
1842  * We are only using for bootstrap purposes to get an ip address for one of
1843  * our interfaces.  Thus we support no user-interface.
1844  *
1845  * Since the contents of the RARP reply are specific to the interface that
1846  * sent the request, this code must ensure that they are properly associated.
1847  *
1848  * Note: also supports ARP via RARP packets, per the RFC.
1849  */
1850 void
1851 in_revarpinput(struct mbuf *m)
1852 {
1853 	struct arphdr *ah;
1854 	void *tha;
1855 	int op;
1856 	struct ifnet *rcvif;
1857 	int s;
1858 
1859 	ah = mtod(m, struct arphdr *);
1860 	op = ntohs(ah->ar_op);
1861 
1862 	rcvif = m_get_rcvif(m, &s);
1863 	switch (rcvif->if_type) {
1864 	case IFT_IEEE1394:
1865 		/* ARP without target hardware address is not supported */
1866 		goto out;
1867 	default:
1868 		break;
1869 	}
1870 
1871 	switch (op) {
1872 	case ARPOP_REQUEST:
1873 	case ARPOP_REPLY:	/* per RFC */
1874 		m_put_rcvif(rcvif, &s);
1875 		in_arpinput(m);
1876 		return;
1877 	case ARPOP_REVREPLY:
1878 		break;
1879 	case ARPOP_REVREQUEST:	/* handled by rarpd(8) */
1880 	default:
1881 		goto out;
1882 	}
1883 	if (!revarp_in_progress)
1884 		goto out;
1885 	if (rcvif != myip_ifp) /* !same interface */
1886 		goto out;
1887 	if (myip_initialized)
1888 		goto wake;
1889 	tha = ar_tha(ah);
1890 	if (tha == NULL)
1891 		goto out;
1892 	if (memcmp(tha, CLLADDR(rcvif->if_sadl), rcvif->if_sadl->sdl_alen))
1893 		goto out;
1894 	memcpy(&srv_ip, ar_spa(ah), sizeof(srv_ip));
1895 	memcpy(&myip, ar_tpa(ah), sizeof(myip));
1896 	myip_initialized = 1;
1897 wake:	/* Do wakeup every time in case it was missed. */
1898 	wakeup((void *)&myip);
1899 
1900 out:
1901 	m_put_rcvif(rcvif, &s);
1902 	m_freem(m);
1903 }
1904 
1905 /*
1906  * Send a RARP request for the ip address of the specified interface.
1907  * The request should be RFC 903-compliant.
1908  */
1909 static void
1910 revarprequest(struct ifnet *ifp)
1911 {
1912 	struct sockaddr sa;
1913 	struct mbuf *m;
1914 	struct arphdr *ah;
1915 	void *tha;
1916 
1917 	if ((m = m_gethdr(M_DONTWAIT, MT_DATA)) == NULL)
1918 		return;
1919 	MCLAIM(m, &arpdomain.dom_mowner);
1920 	m->m_len = sizeof(*ah) + 2*sizeof(struct in_addr) +
1921 	    2*ifp->if_addrlen;
1922 	m->m_pkthdr.len = m->m_len;
1923 	MH_ALIGN(m, m->m_len);
1924 	ah = mtod(m, struct arphdr *);
1925 	memset(ah, 0, m->m_len);
1926 	ah->ar_pro = htons(ETHERTYPE_IP);
1927 	ah->ar_hln = ifp->if_addrlen;		/* hardware address length */
1928 	ah->ar_pln = sizeof(struct in_addr);	/* protocol address length */
1929 	ah->ar_op = htons(ARPOP_REVREQUEST);
1930 
1931 	memcpy(ar_sha(ah), CLLADDR(ifp->if_sadl), ah->ar_hln);
1932 	tha = ar_tha(ah);
1933 	if (tha == NULL) {
1934 		m_free(m);
1935 		return;
1936 	}
1937 	memcpy(tha, CLLADDR(ifp->if_sadl), ah->ar_hln);
1938 
1939 	sa.sa_family = AF_ARP;
1940 	sa.sa_len = 2;
1941 	m->m_flags |= M_BCAST;
1942 
1943 	if_output_lock(ifp, ifp, m, &sa, NULL);
1944 }
1945 
1946 /*
1947  * RARP for the ip address of the specified interface, but also
1948  * save the ip address of the server that sent the answer.
1949  * Timeout if no response is received.
1950  */
1951 int
1952 revarpwhoarewe(struct ifnet *ifp, struct in_addr *serv_in,
1953     struct in_addr *clnt_in)
1954 {
1955 	int result, count = 20;
1956 
1957 	myip_initialized = 0;
1958 	myip_ifp = ifp;
1959 
1960 	revarp_in_progress = 1;
1961 	while (count--) {
1962 		revarprequest(ifp);
1963 		result = tsleep((void *)&myip, PSOCK, "revarp", hz/2);
1964 		if (result != EWOULDBLOCK)
1965 			break;
1966 	}
1967 	revarp_in_progress = 0;
1968 
1969 	if (!myip_initialized)
1970 		return ENETUNREACH;
1971 
1972 	memcpy(serv_in, &srv_ip, sizeof(*serv_in));
1973 	memcpy(clnt_in, &myip, sizeof(*clnt_in));
1974 	return 0;
1975 }
1976 
1977 void
1978 arp_stat_add(int type, uint64_t count)
1979 {
1980 	ARP_STATADD(type, count);
1981 }
1982 
1983 static int
1984 sysctl_net_inet_arp_stats(SYSCTLFN_ARGS)
1985 {
1986 
1987 	return NETSTAT_SYSCTL(arpstat_percpu, ARP_NSTATS);
1988 }
1989 
1990 static void
1991 sysctl_net_inet_arp_setup(struct sysctllog **clog)
1992 {
1993 	const struct sysctlnode *node;
1994 
1995 	sysctl_createv(clog, 0, NULL, NULL,
1996 			CTLFLAG_PERMANENT,
1997 			CTLTYPE_NODE, "inet", NULL,
1998 			NULL, 0, NULL, 0,
1999 			CTL_NET, PF_INET, CTL_EOL);
2000 	sysctl_createv(clog, 0, NULL, &node,
2001 			CTLFLAG_PERMANENT,
2002 			CTLTYPE_NODE, "arp",
2003 			SYSCTL_DESCR("Address Resolution Protocol"),
2004 			NULL, 0, NULL, 0,
2005 			CTL_NET, PF_INET, CTL_CREATE, CTL_EOL);
2006 
2007 	sysctl_createv(clog, 0, NULL, NULL,
2008 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2009 			CTLTYPE_INT, "keep",
2010 			SYSCTL_DESCR("Valid ARP entry lifetime in seconds"),
2011 			NULL, 0, &arpt_keep, 0,
2012 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2013 
2014 	sysctl_createv(clog, 0, NULL, NULL,
2015 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2016 			CTLTYPE_INT, "down",
2017 			SYSCTL_DESCR("Failed ARP entry lifetime in seconds"),
2018 			NULL, 0, &arpt_down, 0,
2019 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2020 
2021 	sysctl_createv(clog, 0, NULL, NULL,
2022 			CTLFLAG_PERMANENT,
2023 			CTLTYPE_STRUCT, "stats",
2024 			SYSCTL_DESCR("ARP statistics"),
2025 			sysctl_net_inet_arp_stats, 0, NULL, 0,
2026 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2027 
2028 	sysctl_createv(clog, 0, NULL, NULL,
2029 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2030 			CTLTYPE_INT, "log_movements",
2031 			SYSCTL_DESCR("log ARP replies from MACs different than"
2032 			    " the one in the cache"),
2033 			NULL, 0, &log_movements, 0,
2034 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2035 
2036 	sysctl_createv(clog, 0, NULL, NULL,
2037 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2038 			CTLTYPE_INT, "log_permanent_modify",
2039 			SYSCTL_DESCR("log ARP replies from MACs different than"
2040 			    " the one in the permanent arp entry"),
2041 			NULL, 0, &log_permanent_modify, 0,
2042 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2043 
2044 	sysctl_createv(clog, 0, NULL, NULL,
2045 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2046 			CTLTYPE_INT, "log_wrong_iface",
2047 			SYSCTL_DESCR("log ARP packets arriving on the wrong"
2048 			    " interface"),
2049 			NULL, 0, &log_wrong_iface, 0,
2050 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2051 
2052 	sysctl_createv(clog, 0, NULL, NULL,
2053 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2054 			CTLTYPE_INT, "log_unknown_network",
2055 			SYSCTL_DESCR("log ARP packets from non-local network"),
2056 			NULL, 0, &log_unknown_network, 0,
2057 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2058 
2059 	sysctl_createv(clog, 0, NULL, NULL,
2060 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2061 		       CTLTYPE_INT, "debug",
2062 		       SYSCTL_DESCR("Enable ARP DAD debug output"),
2063 		       NULL, 0, &arp_debug, 0,
2064 		       CTL_NET, PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2065 }
2066 
2067 #endif /* INET */
2068