xref: /netbsd-src/sys/netinet/if_arp.c (revision fa28c6faa16e0b00edee7acdcaf4899797043def)
1 /*	$NetBSD: if_arp.c,v 1.199 2016/01/05 05:37:06 ozaki-r Exp $	*/
2 
3 /*-
4  * Copyright (c) 1998, 2000, 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Public Access Networks Corporation ("Panix").  It was developed under
9  * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)if_ether.c	8.2 (Berkeley) 9/26/94
62  */
63 
64 /*
65  * Ethernet address resolution protocol.
66  * TODO:
67  *	add "inuse/lock" bit (or ref. count) along with valid bit
68  */
69 
70 #include <sys/cdefs.h>
71 __KERNEL_RCSID(0, "$NetBSD: if_arp.c,v 1.199 2016/01/05 05:37:06 ozaki-r Exp $");
72 
73 #ifdef _KERNEL_OPT
74 #include "opt_ddb.h"
75 #include "opt_inet.h"
76 #endif
77 
78 #ifdef INET
79 
80 #include "bridge.h"
81 
82 #include <sys/param.h>
83 #include <sys/systm.h>
84 #include <sys/callout.h>
85 #include <sys/malloc.h>
86 #include <sys/mbuf.h>
87 #include <sys/socket.h>
88 #include <sys/time.h>
89 #include <sys/timetc.h>
90 #include <sys/kernel.h>
91 #include <sys/errno.h>
92 #include <sys/ioctl.h>
93 #include <sys/syslog.h>
94 #include <sys/proc.h>
95 #include <sys/protosw.h>
96 #include <sys/domain.h>
97 #include <sys/sysctl.h>
98 #include <sys/socketvar.h>
99 #include <sys/percpu.h>
100 #include <sys/cprng.h>
101 #include <sys/kmem.h>
102 
103 #include <net/ethertypes.h>
104 #include <net/if.h>
105 #include <net/if_dl.h>
106 #include <net/if_token.h>
107 #include <net/if_types.h>
108 #include <net/if_ether.h>
109 #include <net/if_llatbl.h>
110 #include <net/net_osdep.h>
111 #include <net/route.h>
112 #include <net/net_stats.h>
113 
114 #include <netinet/in.h>
115 #include <netinet/in_systm.h>
116 #include <netinet/in_var.h>
117 #include <netinet/ip.h>
118 #include <netinet/if_inarp.h>
119 
120 #include "arcnet.h"
121 #if NARCNET > 0
122 #include <net/if_arc.h>
123 #endif
124 #include "fddi.h"
125 #if NFDDI > 0
126 #include <net/if_fddi.h>
127 #endif
128 #include "token.h"
129 #include "carp.h"
130 #if NCARP > 0
131 #include <netinet/ip_carp.h>
132 #endif
133 
134 #define SIN(s) ((struct sockaddr_in *)s)
135 #define SRP(s) ((struct sockaddr_inarp *)s)
136 
137 /*
138  * ARP trailer negotiation.  Trailer protocol is not IP specific,
139  * but ARP request/response use IP addresses.
140  */
141 #define ETHERTYPE_IPTRAILERS ETHERTYPE_TRAIL
142 
143 /* timer values */
144 static int	arpt_keep = (20*60);	/* once resolved, good for 20 more minutes */
145 static int	arpt_down = 20;		/* once declared down, don't send for 20 secs */
146 static int	arp_maxhold = 1;	/* number of packets to hold per ARP entry */
147 #define	rt_expire rt_rmx.rmx_expire
148 #define	rt_pksent rt_rmx.rmx_pksent
149 
150 int		ip_dad_count = PROBE_NUM;
151 #ifdef ARP_DEBUG
152 static int	arp_debug = 1;
153 #else
154 static int	arp_debug = 0;
155 #endif
156 #define arplog(x)	do { if (arp_debug) log x; } while (/*CONSTCOND*/ 0)
157 
158 static	void arp_init(void);
159 
160 static	struct sockaddr *arp_setgate(struct rtentry *, struct sockaddr *,
161 	    const struct sockaddr *);
162 static	void arptfree(struct rtentry *);
163 static	void arptimer(void *);
164 static	void arp_settimer(struct llentry *, int);
165 static	struct llentry *arplookup(struct ifnet *, struct mbuf *,
166 	    const struct in_addr *, int, int, int, struct rtentry *);
167 static	void in_arpinput(struct mbuf *);
168 static	void in_revarpinput(struct mbuf *);
169 static	void revarprequest(struct ifnet *);
170 
171 static	void arp_drainstub(void);
172 
173 static void arp_dad_timer(struct ifaddr *);
174 static void arp_dad_start(struct ifaddr *);
175 static void arp_dad_stop(struct ifaddr *);
176 static void arp_dad_duplicated(struct ifaddr *);
177 
178 static void arp_init_llentry(struct ifnet *, struct llentry *);
179 #if NTOKEN > 0
180 static void arp_free_llentry_tokenring(struct llentry *);
181 #endif
182 
183 struct	ifqueue arpintrq = {
184 	.ifq_head = NULL,
185 	.ifq_tail = NULL,
186 	.ifq_len = 0,
187 	.ifq_maxlen = 50,
188 	.ifq_drops = 0,
189 };
190 static int	arp_inuse, arp_allocated;
191 static int	arp_maxtries = 5;
192 static int	useloopback = 1;	/* use loopback interface for local traffic */
193 
194 static percpu_t *arpstat_percpu;
195 
196 #define	ARP_STAT_GETREF()	_NET_STAT_GETREF(arpstat_percpu)
197 #define	ARP_STAT_PUTREF()	_NET_STAT_PUTREF(arpstat_percpu)
198 
199 #define	ARP_STATINC(x)		_NET_STATINC(arpstat_percpu, x)
200 #define	ARP_STATADD(x, v)	_NET_STATADD(arpstat_percpu, x, v)
201 
202 /* revarp state */
203 static struct	in_addr myip, srv_ip;
204 static int	myip_initialized = 0;
205 static int	revarp_in_progress = 0;
206 static struct	ifnet *myip_ifp = NULL;
207 
208 #ifdef DDB
209 static void db_print_sa(const struct sockaddr *);
210 static void db_print_ifa(struct ifaddr *);
211 static void db_print_llinfo(struct llentry *);
212 static int db_show_rtentry(struct rtentry *, void *);
213 #endif
214 
215 static int arp_drainwanted;
216 
217 static int log_movements = 1;
218 static int log_permanent_modify = 1;
219 static int log_wrong_iface = 1;
220 static int log_unknown_network = 1;
221 
222 /*
223  * this should be elsewhere.
224  */
225 
226 static char *
227 lla_snprintf(u_int8_t *, int);
228 
229 static char *
230 lla_snprintf(u_int8_t *adrp, int len)
231 {
232 #define NUMBUFS 3
233 	static char buf[NUMBUFS][16*3];
234 	static int bnum = 0;
235 
236 	int i;
237 	char *p;
238 
239 	p = buf[bnum];
240 
241 	*p++ = hexdigits[(*adrp)>>4];
242 	*p++ = hexdigits[(*adrp++)&0xf];
243 
244 	for (i=1; i<len && i<16; i++) {
245 		*p++ = ':';
246 		*p++ = hexdigits[(*adrp)>>4];
247 		*p++ = hexdigits[(*adrp++)&0xf];
248 	}
249 
250 	*p = 0;
251 	p = buf[bnum];
252 	bnum = (bnum + 1) % NUMBUFS;
253 	return p;
254 }
255 
256 DOMAIN_DEFINE(arpdomain);	/* forward declare and add to link set */
257 
258 static void
259 arp_fasttimo(void)
260 {
261 	if (arp_drainwanted) {
262 		arp_drain();
263 		arp_drainwanted = 0;
264 	}
265 }
266 
267 const struct protosw arpsw[] = {
268 	{ .pr_type = 0,
269 	  .pr_domain = &arpdomain,
270 	  .pr_protocol = 0,
271 	  .pr_flags = 0,
272 	  .pr_input = 0,
273 	  .pr_output = 0,
274 	  .pr_ctlinput = 0,
275 	  .pr_ctloutput = 0,
276 	  .pr_usrreqs = 0,
277 	  .pr_init = arp_init,
278 	  .pr_fasttimo = arp_fasttimo,
279 	  .pr_slowtimo = 0,
280 	  .pr_drain = arp_drainstub,
281 	}
282 };
283 
284 struct domain arpdomain = {
285 	.dom_family = PF_ARP,
286 	.dom_name = "arp",
287 	.dom_protosw = arpsw,
288 	.dom_protoswNPROTOSW = &arpsw[__arraycount(arpsw)],
289 };
290 
291 static void sysctl_net_inet_arp_setup(struct sysctllog **);
292 
293 void
294 arp_init(void)
295 {
296 
297 	sysctl_net_inet_arp_setup(NULL);
298 	arpstat_percpu = percpu_alloc(sizeof(uint64_t) * ARP_NSTATS);
299 }
300 
301 static void
302 arp_drainstub(void)
303 {
304 	arp_drainwanted = 1;
305 }
306 
307 /*
308  * ARP protocol drain routine.  Called when memory is in short supply.
309  * Called at splvm();  don't acquire softnet_lock as can be called from
310  * hardware interrupt handlers.
311  */
312 void
313 arp_drain(void)
314 {
315 
316 	lltable_drain(AF_INET);
317 }
318 
319 static void
320 arptimer(void *arg)
321 {
322 	struct llentry *lle = arg;
323 	struct ifnet *ifp;
324 	struct rtentry *rt;
325 
326 	if (lle == NULL)
327 		return;
328 
329 	if (lle->la_flags & LLE_STATIC)
330 		return;
331 
332 	LLE_WLOCK(lle);
333 	if (callout_pending(&lle->la_timer)) {
334 		/*
335 		 * Here we are a bit odd here in the treatment of
336 		 * active/pending. If the pending bit is set, it got
337 		 * rescheduled before I ran. The active
338 		 * bit we ignore, since if it was stopped
339 		 * in ll_tablefree() and was currently running
340 		 * it would have return 0 so the code would
341 		 * not have deleted it since the callout could
342 		 * not be stopped so we want to go through
343 		 * with the delete here now. If the callout
344 		 * was restarted, the pending bit will be back on and
345 		 * we just want to bail since the callout_reset would
346 		 * return 1 and our reference would have been removed
347 		 * by arpresolve() below.
348 		 */
349 		LLE_WUNLOCK(lle);
350 		return;
351 	}
352 	ifp = lle->lle_tbl->llt_ifp;
353 	rt = lle->la_rt;
354 	lle->la_rt = NULL;
355 
356 	callout_stop(&lle->la_timer);
357 
358 	/* XXX: LOR avoidance. We still have ref on lle. */
359 	LLE_WUNLOCK(lle);
360 
361 	if (rt != NULL) {
362 		/* We have to call arptfree w/o IF_AFDATA_LOCK */
363 		arptfree(rt);
364 	}
365 
366 	IF_AFDATA_LOCK(ifp);
367 	LLE_WLOCK(lle);
368 
369 	/* Guard against race with other llentry_free(). */
370 	if (lle->la_flags & LLE_LINKED) {
371 		size_t pkts_dropped;
372 
373 		LLE_REMREF(lle);
374 		pkts_dropped = llentry_free(lle);
375 		ARP_STATADD(ARP_STAT_DFRDROPPED, pkts_dropped);
376 	} else {
377 		LLE_FREE_LOCKED(lle);
378 	}
379 
380 	IF_AFDATA_UNLOCK(ifp);
381 }
382 
383 static void
384 arp_settimer(struct llentry *la, int sec)
385 {
386 
387 	LLE_WLOCK_ASSERT(la);
388 	LLE_ADDREF(la);
389 	callout_reset(&la->la_timer, hz * sec, arptimer, la);
390 }
391 
392 /*
393  * We set the gateway for RTF_CLONING routes to a "prototype"
394  * link-layer sockaddr whose interface type (if_type) and interface
395  * index (if_index) fields are prepared.
396  */
397 static struct sockaddr *
398 arp_setgate(struct rtentry *rt, struct sockaddr *gate,
399     const struct sockaddr *netmask)
400 {
401 	const struct ifnet *ifp = rt->rt_ifp;
402 	uint8_t namelen = strlen(ifp->if_xname);
403 	uint8_t addrlen = ifp->if_addrlen;
404 
405 	/*
406 	 * XXX: If this is a manually added route to interface
407 	 * such as older version of routed or gated might provide,
408 	 * restore cloning bit.
409 	 */
410 	if ((rt->rt_flags & RTF_HOST) == 0 && netmask != NULL &&
411 	    satocsin(netmask)->sin_addr.s_addr != 0xffffffff)
412 		rt->rt_flags |= RTF_CLONING;
413 	if (rt->rt_flags & RTF_CLONING ||
414 	    ((rt->rt_flags & (RTF_LLINFO | RTF_LOCAL)) && !rt->rt_llinfo))
415 	{
416 		union {
417 			struct sockaddr sa;
418 			struct sockaddr_storage ss;
419 			struct sockaddr_dl sdl;
420 		} u;
421 		/*
422 		 * Case 1: This route should come from a route to iface.
423 		 */
424 		sockaddr_dl_init(&u.sdl, sizeof(u.ss),
425 		    ifp->if_index, ifp->if_type, NULL, namelen, NULL, addrlen);
426 		rt_setgate(rt, &u.sa);
427 		gate = rt->rt_gateway;
428 	}
429 	return gate;
430 }
431 
432 static void
433 arp_init_llentry(struct ifnet *ifp, struct llentry *lle)
434 {
435 
436 	switch (ifp->if_type) {
437 #if NTOKEN > 0
438 	case IFT_ISO88025:
439 		lle->la_opaque = kmem_intr_alloc(sizeof(struct token_rif),
440 		    KM_NOSLEEP);
441 		lle->lle_ll_free = arp_free_llentry_tokenring;
442 		break;
443 #endif
444 	}
445 }
446 
447 #if NTOKEN > 0
448 static void
449 arp_free_llentry_tokenring(struct llentry *lle)
450 {
451 
452 	kmem_intr_free(lle->la_opaque, sizeof(struct token_rif));
453 }
454 #endif
455 
456 /*
457  * Parallel to llc_rtrequest.
458  */
459 void
460 arp_rtrequest(int req, struct rtentry *rt, const struct rt_addrinfo *info)
461 {
462 	struct sockaddr *gate = rt->rt_gateway;
463 	struct llentry *la = NULL;
464 	struct in_ifaddr *ia;
465 	struct ifaddr *ifa;
466 	struct ifnet *ifp = rt->rt_ifp;
467 	int flags = 0;
468 
469 	if (req == RTM_LLINFO_UPD) {
470 		struct in_addr *in;
471 
472 		if ((ifa = info->rti_ifa) == NULL)
473 			return;
474 
475 		in = &ifatoia(ifa)->ia_addr.sin_addr;
476 
477 		if (ifatoia(ifa)->ia4_flags &
478 		    (IN_IFF_NOTREADY | IN_IFF_DETACHED))
479 		{
480 			arplog((LOG_DEBUG, "arp_request: %s not ready\n",
481 			   in_fmtaddr(*in)));
482 			return;
483 		}
484 
485 		arprequest(ifa->ifa_ifp, in, in,
486 		    CLLADDR(ifa->ifa_ifp->if_sadl));
487 		return;
488 	}
489 
490 	if ((rt->rt_flags & RTF_GATEWAY) != 0) {
491 		if (req != RTM_ADD)
492 			return;
493 
494 		/*
495 		 * linklayers with particular link MTU limitation.
496 		 */
497 		switch(ifp->if_type) {
498 #if NFDDI > 0
499 		case IFT_FDDI:
500 			if (ifp->if_mtu > FDDIIPMTU)
501 				rt->rt_rmx.rmx_mtu = FDDIIPMTU;
502 			break;
503 #endif
504 #if NARCNET > 0
505 		case IFT_ARCNET:
506 		    {
507 			int arcipifmtu;
508 
509 			if (ifp->if_flags & IFF_LINK0)
510 				arcipifmtu = arc_ipmtu;
511 			else
512 				arcipifmtu = ARCMTU;
513 			if (ifp->if_mtu > arcipifmtu)
514 				rt->rt_rmx.rmx_mtu = arcipifmtu;
515 			break;
516 		    }
517 #endif
518 		}
519 		return;
520 	}
521 
522 	IF_AFDATA_RLOCK(ifp);
523 	la = lla_lookup(LLTABLE(ifp), flags, rt_getkey(rt));
524 	IF_AFDATA_RUNLOCK(ifp);
525 
526 	switch (req) {
527 	case RTM_SETGATE:
528 		gate = arp_setgate(rt, gate, info->rti_info[RTAX_NETMASK]);
529 		break;
530 	case RTM_ADD:
531 		gate = arp_setgate(rt, gate, info->rti_info[RTAX_NETMASK]);
532 		if (rt->rt_flags & RTF_CLONING ||
533 		    ((rt->rt_flags & (RTF_LLINFO | RTF_LOCAL)) && !la))
534 		{
535 			/*
536 			 * Give this route an expiration time, even though
537 			 * it's a "permanent" route, so that routes cloned
538 			 * from it do not need their expiration time set.
539 			 */
540 			KASSERT(time_uptime != 0);
541 			rt->rt_expire = time_uptime;
542 			/*
543 			 * linklayers with particular link MTU limitation.
544 			 */
545 			switch (ifp->if_type) {
546 #if NFDDI > 0
547 			case IFT_FDDI:
548 				if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0 &&
549 				    (rt->rt_rmx.rmx_mtu > FDDIIPMTU ||
550 				     (rt->rt_rmx.rmx_mtu == 0 &&
551 				      ifp->if_mtu > FDDIIPMTU)))
552 					rt->rt_rmx.rmx_mtu = FDDIIPMTU;
553 				break;
554 #endif
555 #if NARCNET > 0
556 			case IFT_ARCNET:
557 			    {
558 				int arcipifmtu;
559 				if (ifp->if_flags & IFF_LINK0)
560 					arcipifmtu = arc_ipmtu;
561 				else
562 					arcipifmtu = ARCMTU;
563 
564 				if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0 &&
565 				    (rt->rt_rmx.rmx_mtu > arcipifmtu ||
566 				     (rt->rt_rmx.rmx_mtu == 0 &&
567 				      ifp->if_mtu > arcipifmtu)))
568 					rt->rt_rmx.rmx_mtu = arcipifmtu;
569 				break;
570 			    }
571 #endif
572 			}
573 			if (rt->rt_flags & RTF_CLONING)
574 				break;
575 		}
576 		/* Announce a new entry if requested. */
577 		if (rt->rt_flags & RTF_ANNOUNCE) {
578 			INADDR_TO_IA(satocsin(rt_getkey(rt))->sin_addr, ia);
579 			while (ia && ia->ia_ifp != ifp)
580 				NEXT_IA_WITH_SAME_ADDR(ia);
581 			if (ia == NULL ||
582 			    ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
583 				;
584 			else
585 				arprequest(ifp,
586 				    &satocsin(rt_getkey(rt))->sin_addr,
587 				    &satocsin(rt_getkey(rt))->sin_addr,
588 				    CLLADDR(satocsdl(gate)));
589 		}
590 		/*FALLTHROUGH*/
591 	case RTM_RESOLVE:
592 		if (gate->sa_family != AF_LINK ||
593 		    gate->sa_len < sockaddr_dl_measure(0, ifp->if_addrlen)) {
594 			log(LOG_DEBUG, "arp_rtrequest: bad gateway value\n");
595 			break;
596 		}
597 
598 		satosdl(gate)->sdl_type = ifp->if_type;
599 		satosdl(gate)->sdl_index = ifp->if_index;
600 		if (la != NULL)
601 			break; /* This happens on a route change */
602 
603 		/* If the route is for a broadcast address mark it as such.
604 		 * This way we can avoid an expensive call to in_broadcast()
605 		 * in ip_output() most of the time (because the route passed
606 		 * to ip_output() is almost always a host route). */
607 		if (rt->rt_flags & RTF_HOST &&
608 		    !(rt->rt_flags & RTF_BROADCAST) &&
609 		    in_broadcast(satocsin(rt_getkey(rt))->sin_addr, rt->rt_ifp))
610 			rt->rt_flags |= RTF_BROADCAST;
611 		/* There is little point in resolving the broadcast address */
612 		if (rt->rt_flags & RTF_BROADCAST)
613 			break;
614 
615 		INADDR_TO_IA(satocsin(rt_getkey(rt))->sin_addr, ia);
616 		while (ia && ia->ia_ifp != ifp)
617 			NEXT_IA_WITH_SAME_ADDR(ia);
618 		if (ia) {
619 			/*
620 			 * This test used to be
621 			 *	if (lo0ifp->if_flags & IFF_UP)
622 			 * It allowed local traffic to be forced through
623 			 * the hardware by configuring the loopback down.
624 			 * However, it causes problems during network
625 			 * configuration for boards that can't receive
626 			 * packets they send.  It is now necessary to clear
627 			 * "useloopback" and remove the route to force
628 			 * traffic out to the hardware.
629 			 *
630 			 * In 4.4BSD, the above "if" statement checked
631 			 * rt->rt_ifa against rt_getkey(rt).  It was changed
632 			 * to the current form so that we can provide a
633 			 * better support for multiple IPv4 addresses on a
634 			 * interface.
635 			 */
636 			rt->rt_expire = 0;
637 			if (sockaddr_dl_init(satosdl(gate), gate->sa_len,
638 			    ifp->if_index, ifp->if_type, NULL, 0,
639 			    CLLADDR(ifp->if_sadl), ifp->if_addrlen) == NULL) {
640 				panic("%s(%s): sockaddr_dl_init cannot fail",
641 				    __func__, ifp->if_xname);
642 			}
643 			if (useloopback) {
644 				ifp = rt->rt_ifp = lo0ifp;
645 				rt->rt_rmx.rmx_mtu = 0;
646 			}
647 			rt->rt_flags |= RTF_LOCAL;
648 			/*
649 			 * make sure to set rt->rt_ifa to the interface
650 			 * address we are using, otherwise we will have trouble
651 			 * with source address selection.
652 			 */
653 			ifa = &ia->ia_ifa;
654 			if (ifa != rt->rt_ifa)
655 				rt_replace_ifa(rt, ifa);
656 		}
657 
658 		/*
659 		 * Case 2:  This route may come from cloning, or a manual route
660 		 * add with a LL address.
661 		 */
662 		flags = LLE_EXCLUSIVE;
663 		if ((rt->rt_flags & RTF_CLONING) != 0)
664 			flags |= LLE_IFADDR;
665 
666 		IF_AFDATA_WLOCK(ifp);
667 		la = lla_create(LLTABLE(ifp), flags, rt_getkey(rt));
668 		IF_AFDATA_WUNLOCK(ifp);
669 
670 		if (la == NULL) {
671 			log(LOG_DEBUG, "%s: lla_create failed\n",
672 			    __func__);
673 			rt->rt_llinfo = NULL;
674 			break;
675 		}
676 		rt->rt_llinfo = la;
677 		LLE_ADDREF(la);
678 		la->la_rt = rt;
679 		rt->rt_refcnt++;
680 		rt->rt_flags |= RTF_LLINFO;
681 		arp_inuse++, arp_allocated++;
682 		arp_init_llentry(ifp, la);
683 
684 		LLE_WUNLOCK(la);
685 		la = NULL;
686 
687 		break;
688 
689 	case RTM_DELETE:
690 		if (la == NULL)
691 			break;
692 		arp_inuse--;
693 		rt->rt_llinfo = NULL;
694 		rt->rt_flags &= ~RTF_LLINFO;
695 
696 		/* Have to do before IF_AFDATA_WLOCK to avoid deadlock */
697 		callout_halt(&la->la_timer, &la->lle_lock);
698 		/* XXX: LOR avoidance. We still have ref on lle. */
699 		LLE_RUNLOCK(la);
700 
701 		flags |= LLE_EXCLUSIVE;
702 		IF_AFDATA_WLOCK(ifp);
703 		LLE_WLOCK(la);
704 
705 		if (la->la_rt != NULL) {
706 			/*
707 			 * Don't rtfree (may actually free objects) here.
708 			 * Leave it to rtrequest1.
709 			 */
710 			la->la_rt->rt_refcnt--;
711 			la->la_rt = NULL;
712 		}
713 
714 		/* Guard against race with other llentry_free(). */
715 		if (la->la_flags & LLE_LINKED) {
716 			size_t pkts_dropped;
717 
718 			LLE_REMREF(la);
719 			pkts_dropped = llentry_free(la);
720 			ARP_STATADD(ARP_STAT_DFRDROPPED, pkts_dropped);
721 		} else {
722 			LLE_FREE_LOCKED(la);
723 		}
724 		la = NULL;
725 
726 		IF_AFDATA_WUNLOCK(ifp);
727 	}
728 
729 	if (la != NULL) {
730 		if (flags & LLE_EXCLUSIVE)
731 			LLE_WUNLOCK(la);
732 		else
733 			LLE_RUNLOCK(la);
734 	}
735 }
736 
737 /*
738  * Broadcast an ARP request. Caller specifies:
739  *	- arp header source ip address
740  *	- arp header target ip address
741  *	- arp header source ethernet address
742  */
743 void
744 arprequest(struct ifnet *ifp,
745     const struct in_addr *sip, const struct in_addr *tip,
746     const u_int8_t *enaddr)
747 {
748 	struct mbuf *m;
749 	struct arphdr *ah;
750 	struct sockaddr sa;
751 	uint64_t *arps;
752 
753 	KASSERT(sip != NULL);
754 	KASSERT(tip != NULL);
755 	KASSERT(enaddr != NULL);
756 
757 	if ((m = m_gethdr(M_DONTWAIT, MT_DATA)) == NULL)
758 		return;
759 	MCLAIM(m, &arpdomain.dom_mowner);
760 	switch (ifp->if_type) {
761 	case IFT_IEEE1394:
762 		m->m_len = sizeof(*ah) + 2 * sizeof(struct in_addr) +
763 		    ifp->if_addrlen;
764 		break;
765 	default:
766 		m->m_len = sizeof(*ah) + 2 * sizeof(struct in_addr) +
767 		    2 * ifp->if_addrlen;
768 		break;
769 	}
770 	m->m_pkthdr.len = m->m_len;
771 	MH_ALIGN(m, m->m_len);
772 	ah = mtod(m, struct arphdr *);
773 	memset(ah, 0, m->m_len);
774 	switch (ifp->if_type) {
775 	case IFT_IEEE1394:	/* RFC2734 */
776 		/* fill it now for ar_tpa computation */
777 		ah->ar_hrd = htons(ARPHRD_IEEE1394);
778 		break;
779 	default:
780 		/* ifp->if_output will fill ar_hrd */
781 		break;
782 	}
783 	ah->ar_pro = htons(ETHERTYPE_IP);
784 	ah->ar_hln = ifp->if_addrlen;		/* hardware address length */
785 	ah->ar_pln = sizeof(struct in_addr);	/* protocol address length */
786 	ah->ar_op = htons(ARPOP_REQUEST);
787 	memcpy(ar_sha(ah), enaddr, ah->ar_hln);
788 	memcpy(ar_spa(ah), sip, ah->ar_pln);
789 	memcpy(ar_tpa(ah), tip, ah->ar_pln);
790 	sa.sa_family = AF_ARP;
791 	sa.sa_len = 2;
792 	m->m_flags |= M_BCAST;
793 	arps = ARP_STAT_GETREF();
794 	arps[ARP_STAT_SNDTOTAL]++;
795 	arps[ARP_STAT_SENDREQUEST]++;
796 	ARP_STAT_PUTREF();
797 	(*ifp->if_output)(ifp, m, &sa, NULL);
798 }
799 
800 /*
801  * Resolve an IP address into an ethernet address.  If success,
802  * desten is filled in.  If there is no entry in arptab,
803  * set one up and broadcast a request for the IP address.
804  * Hold onto this mbuf and resend it once the address
805  * is finally resolved.  A return value of 0 indicates
806  * that desten has been filled in and the packet should be sent
807  * normally; a return value of EWOULDBLOCK indicates that the packet has been
808  * held pending resolution.
809  * Any other value indicates an error.
810  */
811 int
812 arpresolve(struct ifnet *ifp, struct rtentry *rt, struct mbuf *m,
813     const struct sockaddr *dst, u_char *desten)
814 {
815 	struct llentry *la;
816 	const struct sockaddr_dl *sdl;
817 	const char *create_lookup;
818 	bool renew;
819 	int error;
820 
821 	KASSERT(m != NULL);
822 
823 	la = arplookup(ifp, m, &satocsin(dst)->sin_addr, 0, 0, 0, rt);
824 	if (la == NULL || la->la_rt == NULL)
825 		goto notfound;
826 
827 	rt = la->la_rt;
828 	sdl = satocsdl(rt->rt_gateway);
829 	/*
830 	 * Check the address family and length is valid, the address
831 	 * is resolved; otherwise, try to resolve.
832 	 */
833 	if ((rt->rt_expire == 0 || rt->rt_expire > time_uptime) &&
834 	    sdl->sdl_family == AF_LINK && sdl->sdl_alen != 0) {
835 		memcpy(desten, CLLADDR(sdl),
836 		    min(sdl->sdl_alen, ifp->if_addrlen));
837 		rt->rt_pksent = time_uptime; /* Time for last pkt sent */
838 		LLE_RUNLOCK(la);
839 		return 0;
840 	}
841 
842 	/*
843 	 * Re-send the ARP request when appropriate.
844 	 */
845 #ifdef	DIAGNOSTIC
846 	if (rt->rt_expire == 0) {
847 		/* This should never happen. (Should it? -gwr) */
848 		printf("arpresolve: unresolved and rt_expire == 0\n");
849 		/* Set expiration time to now (expired). */
850 		rt->rt_expire = time_uptime;
851 	}
852 #endif
853 
854 notfound:
855 #ifdef IFF_STATICARP /* FreeBSD */
856 #define _IFF_NOARP (IFF_NOARP | IFF_STATICARP)
857 #else
858 #define _IFF_NOARP IFF_NOARP
859 #endif
860 	if (ifp->if_flags & _IFF_NOARP) {
861 		if (la != NULL)
862 			LLE_RUNLOCK(la);
863 		error = ENOTSUP;
864 		goto bad;
865 	}
866 #undef _IFF_NOARP
867 	if (la == NULL) {
868 		create_lookup = "create";
869 		IF_AFDATA_WLOCK(ifp);
870 		la = lla_create(LLTABLE(ifp), LLE_EXCLUSIVE, dst);
871 		IF_AFDATA_WUNLOCK(ifp);
872 		if (la == NULL)
873 			ARP_STATINC(ARP_STAT_ALLOCFAIL);
874 	} else if (LLE_TRY_UPGRADE(la) == 0) {
875 		create_lookup = "lookup";
876 		LLE_RUNLOCK(la);
877 		IF_AFDATA_RLOCK(ifp);
878 		la = lla_lookup(LLTABLE(ifp), LLE_EXCLUSIVE, dst);
879 		IF_AFDATA_RUNLOCK(ifp);
880 	}
881 
882 	error = EINVAL;
883 	if (la == NULL) {
884 		log(LOG_DEBUG,
885 		    "%s: failed to %s llentry for %s on %s\n",
886 		    __func__, create_lookup, inet_ntoa(satocsin(dst)->sin_addr),
887 		    ifp->if_xname);
888 		goto bad;
889 	}
890 
891 	/* Just in case */
892 	if (la->la_rt == NULL) {
893 		LLE_WUNLOCK(la);
894 		log(LOG_DEBUG,
895 		    "%s: valid llentry has no rtentry for %s on %s\n",
896 		    __func__, inet_ntoa(satocsin(dst)->sin_addr),
897 		    ifp->if_xname);
898 		goto bad;
899 	}
900 	rt = la->la_rt;
901 
902 	if ((la->la_flags & LLE_VALID) &&
903 	    ((la->la_flags & LLE_STATIC) || la->la_expire > time_uptime))
904 	{
905 		sdl = satocsdl(rt->rt_gateway);
906 		memcpy(desten, CLLADDR(sdl),
907 		    min(sdl->sdl_alen, ifp->if_addrlen));
908 		renew = false;
909 		/*
910 		 * If entry has an expiry time and it is approaching,
911 		 * see if we need to send an ARP request within this
912 		 * arpt_down interval.
913 		 */
914 		if (!(la->la_flags & LLE_STATIC) &&
915 		    time_uptime + la->la_preempt > la->la_expire)
916 		{
917 			renew = true;
918 			la->la_preempt--;
919 		}
920 
921 		LLE_WUNLOCK(la);
922 
923 		if (renew) {
924 			const u_int8_t *enaddr =
925 #if NCARP > 0
926 			    (rt->rt_ifp->if_type == IFT_CARP) ?
927 			    CLLADDR(rt->rt_ifp->if_sadl):
928 #endif
929 			    CLLADDR(ifp->if_sadl);
930 			arprequest(ifp,
931 			    &satocsin(rt->rt_ifa->ifa_addr)->sin_addr,
932 			    &satocsin(dst)->sin_addr, enaddr);
933 		}
934 
935 		return 0;
936 	}
937 
938 	if (la->la_flags & LLE_STATIC) {   /* should not happen! */
939 		LLE_RUNLOCK(la);
940 		log(LOG_DEBUG, "arpresolve: ouch, empty static llinfo for %s\n",
941 		    inet_ntoa(satocsin(dst)->sin_addr));
942 		error = EINVAL;
943 		goto bad;
944 	}
945 
946 	renew = (la->la_asked == 0 || la->la_expire != time_uptime);
947 
948 	/*
949 	 * There is an arptab entry, but no ethernet address
950 	 * response yet.  Add the mbuf to the list, dropping
951 	 * the oldest packet if we have exceeded the system
952 	 * setting.
953 	 */
954 	LLE_WLOCK_ASSERT(la);
955 	if (la->la_numheld >= arp_maxhold) {
956 		if (la->la_hold != NULL) {
957 			struct mbuf *next = la->la_hold->m_nextpkt;
958 			m_freem(la->la_hold);
959 			la->la_hold = next;
960 			la->la_numheld--;
961 			ARP_STATINC(ARP_STAT_DFRDROPPED);
962 		}
963 	}
964 	if (la->la_hold != NULL) {
965 		struct mbuf *curr = la->la_hold;
966 		while (curr->m_nextpkt != NULL)
967 			curr = curr->m_nextpkt;
968 		curr->m_nextpkt = m;
969 	} else
970 		la->la_hold = m;
971 	la->la_numheld++;
972 	if (!renew)
973 		LLE_DOWNGRADE(la);
974 
975 	/*
976 	 * Return EWOULDBLOCK if we have tried less than arp_maxtries. It
977 	 * will be masked by ether_output(). Return EHOSTDOWN/EHOSTUNREACH
978 	 * if we have already sent arp_maxtries ARP requests. Retransmit the
979 	 * ARP request, but not faster than one request per second.
980 	 */
981 	if (la->la_asked < arp_maxtries)
982 		error = EWOULDBLOCK;	/* First request. */
983 	else
984 		error = (rt->rt_flags & RTF_GATEWAY) ?
985 		    EHOSTUNREACH : EHOSTDOWN;
986 
987 	if (renew) {
988 		const u_int8_t *enaddr =
989 #if NCARP > 0
990 		    (rt->rt_ifp->if_type == IFT_CARP) ?
991 		    CLLADDR(rt->rt_ifp->if_sadl):
992 #endif
993 		    CLLADDR(ifp->if_sadl);
994 		la->la_expire = time_uptime;
995 		arp_settimer(la, arpt_down);
996 		la->la_asked++;
997 		LLE_WUNLOCK(la);
998 
999 		arprequest(ifp, &satocsin(rt->rt_ifa->ifa_addr)->sin_addr,
1000 		    &satocsin(dst)->sin_addr, enaddr);
1001 		return error;
1002 	}
1003 
1004 	LLE_RUNLOCK(la);
1005 	return error;
1006 
1007 bad:
1008 	m_freem(m);
1009 	if (rt != NULL && (rt->rt_flags & RTF_CLONED) != 0) {
1010 		rtrequest(RTM_DELETE, rt_getkey(rt),
1011 		    rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
1012 	}
1013 	return error;
1014 }
1015 
1016 /*
1017  * Common length and type checks are done here,
1018  * then the protocol-specific routine is called.
1019  */
1020 void
1021 arpintr(void)
1022 {
1023 	struct mbuf *m;
1024 	struct arphdr *ar;
1025 	int s;
1026 	int arplen;
1027 
1028 	mutex_enter(softnet_lock);
1029 	KERNEL_LOCK(1, NULL);
1030 	while (arpintrq.ifq_head) {
1031 		s = splnet();
1032 		IF_DEQUEUE(&arpintrq, m);
1033 		splx(s);
1034 		if (m == NULL || (m->m_flags & M_PKTHDR) == 0)
1035 			panic("arpintr");
1036 
1037 		MCLAIM(m, &arpdomain.dom_mowner);
1038 		ARP_STATINC(ARP_STAT_RCVTOTAL);
1039 
1040 		/*
1041 		 * First, make sure we have at least struct arphdr.
1042 		 */
1043 		if (m->m_len < sizeof(struct arphdr) ||
1044 		    (ar = mtod(m, struct arphdr *)) == NULL)
1045 			goto badlen;
1046 
1047 		switch (m->m_pkthdr.rcvif->if_type) {
1048 		case IFT_IEEE1394:
1049 			arplen = sizeof(struct arphdr) +
1050 			    ar->ar_hln + 2 * ar->ar_pln;
1051 			break;
1052 		default:
1053 			arplen = sizeof(struct arphdr) +
1054 			    2 * ar->ar_hln + 2 * ar->ar_pln;
1055 			break;
1056 		}
1057 
1058 		if (/* XXX ntohs(ar->ar_hrd) == ARPHRD_ETHER && */
1059 		    m->m_len >= arplen)
1060 			switch (ntohs(ar->ar_pro)) {
1061 			case ETHERTYPE_IP:
1062 			case ETHERTYPE_IPTRAILERS:
1063 				in_arpinput(m);
1064 				continue;
1065 			default:
1066 				ARP_STATINC(ARP_STAT_RCVBADPROTO);
1067 			}
1068 		else {
1069 badlen:
1070 			ARP_STATINC(ARP_STAT_RCVBADLEN);
1071 		}
1072 		m_freem(m);
1073 	}
1074 	KERNEL_UNLOCK_ONE(NULL);
1075 	mutex_exit(softnet_lock);
1076 }
1077 
1078 /*
1079  * ARP for Internet protocols on 10 Mb/s Ethernet.
1080  * Algorithm is that given in RFC 826.
1081  * In addition, a sanity check is performed on the sender
1082  * protocol address, to catch impersonators.
1083  * We no longer handle negotiations for use of trailer protocol:
1084  * Formerly, ARP replied for protocol type ETHERTYPE_TRAIL sent
1085  * along with IP replies if we wanted trailers sent to us,
1086  * and also sent them in response to IP replies.
1087  * This allowed either end to announce the desire to receive
1088  * trailer packets.
1089  * We no longer reply to requests for ETHERTYPE_TRAIL protocol either,
1090  * but formerly didn't normally send requests.
1091  */
1092 static void
1093 in_arpinput(struct mbuf *m)
1094 {
1095 	struct arphdr *ah;
1096 	struct ifnet *ifp = m->m_pkthdr.rcvif;
1097 	struct llentry *la = NULL;
1098 	struct rtentry  *rt = NULL;
1099 	struct in_ifaddr *ia;
1100 #if NBRIDGE > 0
1101 	struct in_ifaddr *bridge_ia = NULL;
1102 #endif
1103 #if NCARP > 0
1104 	u_int32_t count = 0, index = 0;
1105 #endif
1106 	struct sockaddr_dl *sdl = NULL;
1107 	struct sockaddr sa;
1108 	struct in_addr isaddr, itaddr, myaddr;
1109 	int op;
1110 	void *tha;
1111 	uint64_t *arps;
1112 
1113 	if (__predict_false(m_makewritable(&m, 0, m->m_pkthdr.len, M_DONTWAIT)))
1114 		goto out;
1115 	ah = mtod(m, struct arphdr *);
1116 	op = ntohs(ah->ar_op);
1117 
1118 	/*
1119 	 * Fix up ah->ar_hrd if necessary, before using ar_tha() or
1120 	 * ar_tpa().
1121 	 */
1122 	switch (ifp->if_type) {
1123 	case IFT_IEEE1394:
1124 		if (ntohs(ah->ar_hrd) == ARPHRD_IEEE1394)
1125 			;
1126 		else {
1127 			/* XXX this is to make sure we compute ar_tha right */
1128 			/* XXX check ar_hrd more strictly? */
1129 			ah->ar_hrd = htons(ARPHRD_IEEE1394);
1130 		}
1131 		break;
1132 	default:
1133 		/* XXX check ar_hrd? */
1134 		break;
1135 	}
1136 
1137 	memcpy(&isaddr, ar_spa(ah), sizeof (isaddr));
1138 	memcpy(&itaddr, ar_tpa(ah), sizeof (itaddr));
1139 
1140 	if (m->m_flags & (M_BCAST|M_MCAST))
1141 		ARP_STATINC(ARP_STAT_RCVMCAST);
1142 
1143 
1144 	/*
1145 	 * Search for a matching interface address
1146 	 * or any address on the interface to use
1147 	 * as a dummy address in the rest of this function
1148 	 */
1149 
1150 	INADDR_TO_IA(itaddr, ia);
1151 	while (ia != NULL) {
1152 #if NCARP > 0
1153 		if (ia->ia_ifp->if_type == IFT_CARP &&
1154 		    ((ia->ia_ifp->if_flags & (IFF_UP|IFF_RUNNING)) ==
1155 		    (IFF_UP|IFF_RUNNING))) {
1156 			index++;
1157 			if (ia->ia_ifp == m->m_pkthdr.rcvif &&
1158 			    carp_iamatch(ia, ar_sha(ah),
1159 			    &count, index)) {
1160 				break;
1161 				}
1162 		} else
1163 #endif
1164 			    if (ia->ia_ifp == m->m_pkthdr.rcvif)
1165 				break;
1166 #if NBRIDGE > 0
1167 		/*
1168 		 * If the interface we received the packet on
1169 		 * is part of a bridge, check to see if we need
1170 		 * to "bridge" the packet to ourselves at this
1171 		 * layer.  Note we still prefer a perfect match,
1172 		 * but allow this weaker match if necessary.
1173 		 */
1174 		if (m->m_pkthdr.rcvif->if_bridge != NULL &&
1175 		    m->m_pkthdr.rcvif->if_bridge == ia->ia_ifp->if_bridge)
1176 			bridge_ia = ia;
1177 #endif /* NBRIDGE > 0 */
1178 
1179 		NEXT_IA_WITH_SAME_ADDR(ia);
1180 	}
1181 
1182 #if NBRIDGE > 0
1183 	if (ia == NULL && bridge_ia != NULL) {
1184 		ia = bridge_ia;
1185 		ifp = bridge_ia->ia_ifp;
1186 	}
1187 #endif
1188 
1189 	if (ia == NULL) {
1190 		INADDR_TO_IA(isaddr, ia);
1191 		while ((ia != NULL) && ia->ia_ifp != m->m_pkthdr.rcvif)
1192 			NEXT_IA_WITH_SAME_ADDR(ia);
1193 
1194 		if (ia == NULL) {
1195 			IFP_TO_IA(ifp, ia);
1196 			if (ia == NULL) {
1197 				ARP_STATINC(ARP_STAT_RCVNOINT);
1198 				goto out;
1199 			}
1200 		}
1201 	}
1202 
1203 	myaddr = ia->ia_addr.sin_addr;
1204 
1205 	/* XXX checks for bridge case? */
1206 	if (!memcmp(ar_sha(ah), CLLADDR(ifp->if_sadl), ifp->if_addrlen)) {
1207 		ARP_STATINC(ARP_STAT_RCVLOCALSHA);
1208 		goto out;	/* it's from me, ignore it. */
1209 	}
1210 
1211 	/* XXX checks for bridge case? */
1212 	if (!memcmp(ar_sha(ah), ifp->if_broadcastaddr, ifp->if_addrlen)) {
1213 		ARP_STATINC(ARP_STAT_RCVBCASTSHA);
1214 		log(LOG_ERR,
1215 		    "%s: arp: link address is broadcast for IP address %s!\n",
1216 		    ifp->if_xname, in_fmtaddr(isaddr));
1217 		goto out;
1218 	}
1219 
1220 	/*
1221 	 * If the source IP address is zero, this is an RFC 5227 ARP probe
1222 	 */
1223 	if (in_nullhost(isaddr))
1224 		ARP_STATINC(ARP_STAT_RCVZEROSPA);
1225 	else if (in_hosteq(isaddr, myaddr))
1226 		ARP_STATINC(ARP_STAT_RCVLOCALSPA);
1227 
1228 	if (in_nullhost(itaddr))
1229 		ARP_STATINC(ARP_STAT_RCVZEROTPA);
1230 
1231 	/* DAD check, RFC 5227 2.1.1, Probe Details */
1232 	if (in_hosteq(isaddr, myaddr) ||
1233 	    (in_nullhost(isaddr) && in_hosteq(itaddr, myaddr)))
1234 	{
1235 		/* If our address is tentative, mark it as duplicated */
1236 		if (ia->ia4_flags & IN_IFF_TENTATIVE)
1237 			arp_dad_duplicated((struct ifaddr *)ia);
1238 		/* If our address is unuseable, don't reply */
1239 		if (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
1240 			goto out;
1241 	}
1242 
1243 	/*
1244 	 * If the target IP address is zero, ignore the packet.
1245 	 * This prevents the code below from tring to answer
1246 	 * when we are using IP address zero (booting).
1247 	 */
1248 	if (in_nullhost(itaddr))
1249 		goto out;
1250 
1251 	if (in_nullhost(isaddr))
1252 		goto reply;
1253 
1254 	if (in_hosteq(isaddr, myaddr)) {
1255 		log(LOG_ERR,
1256 		   "duplicate IP address %s sent from link address %s\n",
1257 		   in_fmtaddr(isaddr), lla_snprintf(ar_sha(ah), ah->ar_hln));
1258 		itaddr = myaddr;
1259 		goto reply;
1260 	}
1261 
1262 	la = arplookup(ifp, m, &isaddr, in_hosteq(itaddr, myaddr), 0, 1, NULL);
1263 	if (la != NULL) {
1264 		rt = la->la_rt;
1265 		if (rt != NULL)
1266 			sdl = satosdl(rt->rt_gateway);
1267 	}
1268 	if (sdl == NULL)
1269 		goto reply;
1270 
1271 	if (sdl->sdl_alen && memcmp(ar_sha(ah), CLLADDR(sdl), sdl->sdl_alen)) {
1272 		if (rt->rt_flags & RTF_STATIC) {
1273 			ARP_STATINC(ARP_STAT_RCVOVERPERM);
1274 			if (!log_permanent_modify)
1275 				goto out;
1276 			log(LOG_INFO,
1277 			    "%s tried to overwrite permanent arp info"
1278 			    " for %s\n",
1279 			    lla_snprintf(ar_sha(ah), ah->ar_hln),
1280 			    in_fmtaddr(isaddr));
1281 			goto out;
1282 		} else if (rt->rt_ifp != ifp) {
1283 			ARP_STATINC(ARP_STAT_RCVOVERINT);
1284 			if (!log_wrong_iface)
1285 				goto out;
1286 			log(LOG_INFO,
1287 			    "%s on %s tried to overwrite "
1288 			    "arp info for %s on %s\n",
1289 			    lla_snprintf(ar_sha(ah), ah->ar_hln),
1290 			    ifp->if_xname, in_fmtaddr(isaddr),
1291 			    rt->rt_ifp->if_xname);
1292 				goto out;
1293 		} else {
1294 			ARP_STATINC(ARP_STAT_RCVOVER);
1295 			if (log_movements)
1296 				log(LOG_INFO, "arp info overwritten "
1297 				    "for %s by %s\n",
1298 				    in_fmtaddr(isaddr),
1299 				    lla_snprintf(ar_sha(ah),
1300 				    ah->ar_hln));
1301 		}
1302 	}
1303 
1304 	/*
1305 	 * sanity check for the address length.
1306 	 * XXX this does not work for protocols with variable address
1307 	 * length. -is
1308 	 */
1309 	if (sdl->sdl_alen && sdl->sdl_alen != ah->ar_hln) {
1310 		ARP_STATINC(ARP_STAT_RCVLENCHG);
1311 		log(LOG_WARNING,
1312 		    "arp from %s: new addr len %d, was %d\n",
1313 		    in_fmtaddr(isaddr), ah->ar_hln, sdl->sdl_alen);
1314 	}
1315 	if (ifp->if_addrlen != ah->ar_hln) {
1316 		ARP_STATINC(ARP_STAT_RCVBADLEN);
1317 		log(LOG_WARNING,
1318 		    "arp from %s: addr len: new %d, i/f %d (ignored)\n",
1319 		    in_fmtaddr(isaddr), ah->ar_hln,
1320 		    ifp->if_addrlen);
1321 		goto reply;
1322 	}
1323 
1324 #if NTOKEN > 0
1325 	/*
1326 	 * XXX uses m_data and assumes the complete answer including
1327 	 * XXX token-ring headers is in the same buf
1328 	 */
1329 	if (ifp->if_type == IFT_ISO88025) {
1330 		struct token_header *trh;
1331 
1332 		trh = (struct token_header *)M_TRHSTART(m);
1333 		if (trh->token_shost[0] & TOKEN_RI_PRESENT) {
1334 			struct token_rif *rif;
1335 			size_t riflen;
1336 
1337 			rif = TOKEN_RIF(trh);
1338 			riflen = (ntohs(rif->tr_rcf) &
1339 			    TOKEN_RCF_LEN_MASK) >> 8;
1340 
1341 			if (riflen > 2 &&
1342 			    riflen < sizeof(struct token_rif) &&
1343 			    (riflen & 1) == 0) {
1344 				rif->tr_rcf ^= htons(TOKEN_RCF_DIRECTION);
1345 				rif->tr_rcf &= htons(~TOKEN_RCF_BROADCAST_MASK);
1346 				memcpy(TOKEN_RIF_LLE(la), rif, riflen);
1347 			}
1348 		}
1349 	}
1350 #endif /* NTOKEN > 0 */
1351 	(void)sockaddr_dl_setaddr(sdl, sdl->sdl_len, ar_sha(ah), ah->ar_hln);
1352 	if (rt->rt_expire) {
1353 		rt->rt_expire = time_uptime + arpt_keep;
1354 
1355 		KASSERT((la->la_flags & LLE_STATIC) == 0);
1356 		arp_settimer(la, arpt_keep);
1357 	}
1358 	rt->rt_flags &= ~RTF_REJECT;
1359 	la->la_asked = 0;
1360 
1361 	if (la->la_hold != NULL) {
1362 		int n = la->la_numheld;
1363 		struct mbuf *m_hold, *m_hold_next;
1364 
1365 		m_hold = la->la_hold;
1366 		la->la_hold = NULL;
1367 		la->la_numheld = 0;
1368 		/*
1369 		 * We have to unlock here because if_output would call
1370 		 * arpresolve
1371 		 */
1372 		LLE_WUNLOCK(la);
1373 		ARP_STATADD(ARP_STAT_DFRSENT, n);
1374 		for (; m_hold != NULL; m_hold = m_hold_next) {
1375 			m_hold_next = m_hold->m_nextpkt;
1376 			m_hold->m_nextpkt = NULL;
1377 			(*ifp->if_output)(ifp, m_hold, rt_getkey(rt), rt);
1378 		}
1379 	} else
1380 		LLE_WUNLOCK(la);
1381 	la = NULL;
1382 
1383 reply:
1384 	if (la != NULL) {
1385 		LLE_WUNLOCK(la);
1386 		la = NULL;
1387 	}
1388 	if (op != ARPOP_REQUEST) {
1389 		if (op == ARPOP_REPLY)
1390 			ARP_STATINC(ARP_STAT_RCVREPLY);
1391 		goto out;
1392 	}
1393 	ARP_STATINC(ARP_STAT_RCVREQUEST);
1394 	if (in_hosteq(itaddr, myaddr)) {
1395 		/* If our address is unuseable, don't reply */
1396 		if (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED))
1397 			goto out;
1398 		/* I am the target */
1399 		tha = ar_tha(ah);
1400 		if (tha)
1401 			memcpy(tha, ar_sha(ah), ah->ar_hln);
1402 		memcpy(ar_sha(ah), CLLADDR(ifp->if_sadl), ah->ar_hln);
1403 	} else {
1404 		la = arplookup(ifp, m, &itaddr, 0, SIN_PROXY, 0, NULL);
1405 		if (la == NULL)
1406 			goto out;
1407 		rt = la->la_rt;
1408 		LLE_RUNLOCK(la);
1409 		la = NULL;
1410 		if (rt->rt_ifp->if_type == IFT_CARP &&
1411 		    m->m_pkthdr.rcvif->if_type != IFT_CARP)
1412 			goto out;
1413 		tha = ar_tha(ah);
1414 		if (tha)
1415 			memcpy(tha, ar_sha(ah), ah->ar_hln);
1416 		sdl = satosdl(rt->rt_gateway);
1417 		memcpy(ar_sha(ah), CLLADDR(sdl), ah->ar_hln);
1418 	}
1419 
1420 	memcpy(ar_tpa(ah), ar_spa(ah), ah->ar_pln);
1421 	memcpy(ar_spa(ah), &itaddr, ah->ar_pln);
1422 	ah->ar_op = htons(ARPOP_REPLY);
1423 	ah->ar_pro = htons(ETHERTYPE_IP); /* let's be sure! */
1424 	switch (ifp->if_type) {
1425 	case IFT_IEEE1394:
1426 		/*
1427 		 * ieee1394 arp reply is broadcast
1428 		 */
1429 		m->m_flags &= ~M_MCAST;
1430 		m->m_flags |= M_BCAST;
1431 		m->m_len = sizeof(*ah) + (2 * ah->ar_pln) + ah->ar_hln;
1432 		break;
1433 
1434 	default:
1435 		m->m_flags &= ~(M_BCAST|M_MCAST); /* never reply by broadcast */
1436 		m->m_len = sizeof(*ah) + (2 * ah->ar_pln) + (2 * ah->ar_hln);
1437 		break;
1438 	}
1439 	m->m_pkthdr.len = m->m_len;
1440 	sa.sa_family = AF_ARP;
1441 	sa.sa_len = 2;
1442 	arps = ARP_STAT_GETREF();
1443 	arps[ARP_STAT_SNDTOTAL]++;
1444 	arps[ARP_STAT_SNDREPLY]++;
1445 	ARP_STAT_PUTREF();
1446 	(*ifp->if_output)(ifp, m, &sa, NULL);
1447 	return;
1448 
1449 out:
1450 	if (la != NULL)
1451 		LLE_WUNLOCK(la);
1452 	m_freem(m);
1453 }
1454 
1455 /*
1456  * Free an arp entry.
1457  */
1458 static void arptfree(struct rtentry *rt)
1459 {
1460 
1461 	/* We still need to hold the locks */
1462 	mutex_enter(softnet_lock);
1463 	KERNEL_LOCK(1, NULL);
1464 
1465 	rtrequest(RTM_DELETE, rt_getkey(rt), NULL, rt_mask(rt), 0, NULL);
1466 	rtfree(rt);
1467 
1468 	KERNEL_UNLOCK_ONE(NULL);
1469 	mutex_exit(softnet_lock);
1470 }
1471 
1472 /*
1473  * Lookup or enter a new address in arptab.
1474  */
1475 static struct llentry *
1476 arplookup(struct ifnet *ifp, struct mbuf *m, const struct in_addr *addr,
1477     int create, int proxy, int wlock, struct rtentry *rt0)
1478 {
1479 	struct arphdr *ah;
1480 	struct rtentry *rt;
1481 	struct sockaddr_inarp sin;
1482 	const char *why = NULL;
1483 
1484 	ah = mtod(m, struct arphdr *);
1485 	if (rt0 == NULL) {
1486 		memset(&sin, 0, sizeof(sin));
1487 		sin.sin_len = sizeof(sin);
1488 		sin.sin_family = AF_INET;
1489 		sin.sin_addr = *addr;
1490 		sin.sin_other = proxy ? SIN_PROXY : 0;
1491 		rt = rtalloc1(sintosa(&sin), create);
1492 		if (rt == NULL)
1493 			return NULL;
1494 		rt->rt_refcnt--;
1495 	} else
1496 		rt = rt0;
1497 
1498 #define	IS_LLINFO(__rt)							  \
1499 	(((__rt)->rt_flags & (RTF_GATEWAY | RTF_LLINFO)) == RTF_LLINFO && \
1500 	 (__rt)->rt_gateway->sa_family == AF_LINK)
1501 
1502 
1503 	if (IS_LLINFO(rt)) {
1504 		struct llentry *la;
1505 		int flags = wlock ? LLE_EXCLUSIVE : 0;
1506 
1507 		IF_AFDATA_RLOCK(ifp);
1508 		la = lla_lookup(LLTABLE(ifp), flags, rt_getkey(rt));
1509 		IF_AFDATA_RUNLOCK(ifp);
1510 
1511 		if (la == NULL && create) {
1512 			IF_AFDATA_WLOCK(ifp);
1513 			la = lla_create(LLTABLE(ifp), flags, rt_getkey(rt));
1514 			IF_AFDATA_WUNLOCK(ifp);
1515 		}
1516 
1517 		return la;
1518 	}
1519 
1520 	if (create) {
1521 		if (rt->rt_flags & RTF_GATEWAY) {
1522 			if (log_unknown_network)
1523 				why = "host is not on local network";
1524 		} else if ((rt->rt_flags & RTF_LLINFO) == 0) {
1525 			ARP_STATINC(ARP_STAT_ALLOCFAIL);
1526 			why = "could not allocate llinfo";
1527 		} else
1528 			why = "gateway route is not ours";
1529 		if (why) {
1530 			log(LOG_DEBUG, "arplookup: unable to enter address"
1531 			    " for %s@%s on %s (%s)\n", in_fmtaddr(*addr),
1532 			    lla_snprintf(ar_sha(ah), ah->ar_hln),
1533 			    (ifp) ? ifp->if_xname : "null", why);
1534 		}
1535 		if ((rt->rt_flags & RTF_CLONED) != 0) {
1536 			rtrequest(RTM_DELETE, rt_getkey(rt),
1537 		    	    rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
1538 		}
1539 	}
1540 	return NULL;
1541 }
1542 
1543 int
1544 arpioctl(u_long cmd, void *data)
1545 {
1546 
1547 	return EOPNOTSUPP;
1548 }
1549 
1550 void
1551 arp_ifinit(struct ifnet *ifp, struct ifaddr *ifa)
1552 {
1553 	struct in_addr *ip;
1554 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1555 
1556 	/*
1557 	 * Warn the user if another station has this IP address,
1558 	 * but only if the interface IP address is not zero.
1559 	 */
1560 	ip = &IA_SIN(ifa)->sin_addr;
1561 	if (!in_nullhost(*ip) &&
1562 	    (ia->ia4_flags & (IN_IFF_NOTREADY | IN_IFF_DETACHED)) == 0)
1563 		arprequest(ifp, ip, ip, CLLADDR(ifp->if_sadl));
1564 
1565 	ifa->ifa_rtrequest = arp_rtrequest;
1566 	ifa->ifa_flags |= RTF_CLONING;
1567 
1568 	/* ARP will handle DAD for this address. */
1569 	if (ia->ia4_flags & IN_IFF_TRYTENTATIVE) {
1570 		ia->ia4_flags |= IN_IFF_TENTATIVE;
1571 		ia->ia_dad_start = arp_dad_start;
1572 		ia->ia_dad_stop = arp_dad_stop;
1573 	}
1574 }
1575 
1576 TAILQ_HEAD(dadq_head, dadq);
1577 struct dadq {
1578 	TAILQ_ENTRY(dadq) dad_list;
1579 	struct ifaddr *dad_ifa;
1580 	int dad_count;		/* max ARP to send */
1581 	int dad_arp_tcount;	/* # of trials to send ARP */
1582 	int dad_arp_ocount;	/* ARP sent so far */
1583 	int dad_arp_announce;	/* max ARP announcements */
1584 	int dad_arp_acount;	/* # of announcements */
1585 	struct callout dad_timer_ch;
1586 };
1587 MALLOC_JUSTDEFINE(M_IPARP, "ARP DAD", "ARP DAD Structure");
1588 
1589 static struct dadq_head dadq;
1590 static int dad_init = 0;
1591 static int dad_maxtry = 15;     /* max # of *tries* to transmit DAD packet */
1592 
1593 static struct dadq *
1594 arp_dad_find(struct ifaddr *ifa)
1595 {
1596 	struct dadq *dp;
1597 
1598 	TAILQ_FOREACH(dp, &dadq, dad_list) {
1599 		if (dp->dad_ifa == ifa)
1600 			return dp;
1601 	}
1602 	return NULL;
1603 }
1604 
1605 static void
1606 arp_dad_starttimer(struct dadq *dp, int ticks)
1607 {
1608 
1609 	callout_reset(&dp->dad_timer_ch, ticks,
1610 	    (void (*)(void *))arp_dad_timer, (void *)dp->dad_ifa);
1611 }
1612 
1613 static void
1614 arp_dad_stoptimer(struct dadq *dp)
1615 {
1616 
1617 	callout_stop(&dp->dad_timer_ch);
1618 }
1619 
1620 static void
1621 arp_dad_output(struct dadq *dp, struct ifaddr *ifa)
1622 {
1623 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1624 	struct ifnet *ifp = ifa->ifa_ifp;
1625 	struct in_addr sip;
1626 
1627 	dp->dad_arp_tcount++;
1628 	if ((ifp->if_flags & IFF_UP) == 0)
1629 		return;
1630 	if ((ifp->if_flags & IFF_RUNNING) == 0)
1631 		return;
1632 
1633 	dp->dad_arp_tcount = 0;
1634 	dp->dad_arp_ocount++;
1635 
1636 	memset(&sip, 0, sizeof(sip));
1637 	arprequest(ifa->ifa_ifp, &sip, &ia->ia_addr.sin_addr,
1638 	    CLLADDR(ifa->ifa_ifp->if_sadl));
1639 }
1640 
1641 /*
1642  * Start Duplicate Address Detection (DAD) for specified interface address.
1643  */
1644 static void
1645 arp_dad_start(struct ifaddr *ifa)
1646 {
1647 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1648 	struct dadq *dp;
1649 
1650 	if (!dad_init) {
1651 		TAILQ_INIT(&dadq);
1652 		dad_init++;
1653 	}
1654 
1655 	/*
1656 	 * If we don't need DAD, don't do it.
1657 	 * - DAD is disabled (ip_dad_count == 0)
1658 	 */
1659 	if (!(ia->ia4_flags & IN_IFF_TENTATIVE)) {
1660 		log(LOG_DEBUG,
1661 			"arp_dad_start: called with non-tentative address "
1662 			"%s(%s)\n",
1663 			in_fmtaddr(ia->ia_addr.sin_addr),
1664 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1665 		return;
1666 	}
1667 	if (!ip_dad_count) {
1668 		struct in_addr *ip = &IA_SIN(ifa)->sin_addr;
1669 
1670 		ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1671 		rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1672 		arprequest(ifa->ifa_ifp, ip, ip,
1673 		    CLLADDR(ifa->ifa_ifp->if_sadl));
1674 		return;
1675 	}
1676 	if (ifa->ifa_ifp == NULL)
1677 		panic("arp_dad_start: ifa->ifa_ifp == NULL");
1678 	if (!(ifa->ifa_ifp->if_flags & IFF_UP))
1679 		return;
1680 	if (arp_dad_find(ifa) != NULL) {
1681 		/* DAD already in progress */
1682 		return;
1683 	}
1684 
1685 	dp = malloc(sizeof(*dp), M_IPARP, M_NOWAIT);
1686 	if (dp == NULL) {
1687 		log(LOG_ERR, "arp_dad_start: memory allocation failed for "
1688 			"%s(%s)\n",
1689 			in_fmtaddr(ia->ia_addr.sin_addr),
1690 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1691 		return;
1692 	}
1693 	memset(dp, 0, sizeof(*dp));
1694 	callout_init(&dp->dad_timer_ch, CALLOUT_MPSAFE);
1695 	TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list);
1696 
1697 	arplog((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
1698 	    in_fmtaddr(ia->ia_addr.sin_addr)));
1699 
1700 	/*
1701 	 * Send ARP packet for DAD, ip_dad_count times.
1702 	 * Note that we must delay the first transmission.
1703 	 */
1704 	dp->dad_ifa = ifa;
1705 	ifaref(ifa);	/* just for safety */
1706 	dp->dad_count = ip_dad_count;
1707 	dp->dad_arp_announce = 0; /* Will be set when starting to announce */
1708 	dp->dad_arp_acount = dp->dad_arp_ocount = dp->dad_arp_tcount = 0;
1709 
1710 	arp_dad_starttimer(dp, cprng_fast32() % (PROBE_WAIT * hz));
1711 }
1712 
1713 /*
1714  * terminate DAD unconditionally.  used for address removals.
1715  */
1716 static void
1717 arp_dad_stop(struct ifaddr *ifa)
1718 {
1719 	struct dadq *dp;
1720 
1721 	if (!dad_init)
1722 		return;
1723 	dp = arp_dad_find(ifa);
1724 	if (dp == NULL) {
1725 		/* DAD wasn't started yet */
1726 		return;
1727 	}
1728 
1729 	arp_dad_stoptimer(dp);
1730 
1731 	TAILQ_REMOVE(&dadq, dp, dad_list);
1732 	free(dp, M_IPARP);
1733 	dp = NULL;
1734 	ifafree(ifa);
1735 }
1736 
1737 static void
1738 arp_dad_timer(struct ifaddr *ifa)
1739 {
1740 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1741 	struct dadq *dp;
1742 	struct in_addr *ip;
1743 
1744 	mutex_enter(softnet_lock);
1745 	KERNEL_LOCK(1, NULL);
1746 
1747 	/* Sanity check */
1748 	if (ia == NULL) {
1749 		log(LOG_ERR, "arp_dad_timer: called with null parameter\n");
1750 		goto done;
1751 	}
1752 	dp = arp_dad_find(ifa);
1753 	if (dp == NULL) {
1754 		log(LOG_ERR, "arp_dad_timer: DAD structure not found\n");
1755 		goto done;
1756 	}
1757 	if (ia->ia4_flags & IN_IFF_DUPLICATED) {
1758 		log(LOG_ERR, "nd4_dad_timer: called with duplicate address "
1759 			"%s(%s)\n",
1760 			in_fmtaddr(ia->ia_addr.sin_addr),
1761 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1762 		goto done;
1763 	}
1764 	if ((ia->ia4_flags & IN_IFF_TENTATIVE) == 0 && dp->dad_arp_acount == 0){
1765 		log(LOG_ERR, "arp_dad_timer: called with non-tentative address "
1766 			"%s(%s)\n",
1767 			in_fmtaddr(ia->ia_addr.sin_addr),
1768 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1769 		goto done;
1770 	}
1771 
1772 	/* timeouted with IFF_{RUNNING,UP} check */
1773 	if (dp->dad_arp_tcount > dad_maxtry) {
1774 		arplog((LOG_INFO, "%s: could not run DAD, driver problem?\n",
1775 			if_name(ifa->ifa_ifp)));
1776 
1777 		TAILQ_REMOVE(&dadq, dp, dad_list);
1778 		free(dp, M_IPARP);
1779 		dp = NULL;
1780 		ifafree(ifa);
1781 		goto done;
1782 	}
1783 
1784 	/* Need more checks? */
1785 	if (dp->dad_arp_ocount < dp->dad_count) {
1786 		int adelay;
1787 
1788 		/*
1789 		 * We have more ARP to go.  Send ARP packet for DAD.
1790 		 */
1791 		arp_dad_output(dp, ifa);
1792 		if (dp->dad_arp_ocount < dp->dad_count)
1793 			adelay = (PROBE_MIN * hz) +
1794 			    (cprng_fast32() %
1795 			    ((PROBE_MAX * hz) - (PROBE_MIN * hz)));
1796 		else
1797 			adelay = ANNOUNCE_WAIT * hz;
1798 		arp_dad_starttimer(dp, adelay);
1799 		goto done;
1800 	} else if (dp->dad_arp_acount == 0) {
1801 		/*
1802 		 * We are done with DAD.
1803 		 * No duplicate address found.
1804 		 */
1805 		ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1806 		rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1807 		arplog((LOG_DEBUG,
1808 		    "%s: DAD complete for %s - no duplicates found\n",
1809 		    if_name(ifa->ifa_ifp),
1810 		    in_fmtaddr(ia->ia_addr.sin_addr)));
1811 		dp->dad_arp_announce = ANNOUNCE_NUM;
1812 		goto announce;
1813 	} else if (dp->dad_arp_acount < dp->dad_arp_announce) {
1814 announce:
1815 		/*
1816 		 * Announce the address.
1817 		 */
1818 		ip = &IA_SIN(ifa)->sin_addr;
1819 		arprequest(ifa->ifa_ifp, ip, ip,
1820 		    CLLADDR(ifa->ifa_ifp->if_sadl));
1821 		dp->dad_arp_acount++;
1822 		if (dp->dad_arp_acount < dp->dad_arp_announce) {
1823 			arp_dad_starttimer(dp, ANNOUNCE_INTERVAL * hz);
1824 			goto done;
1825 		}
1826 		arplog((LOG_DEBUG,
1827 		    "%s: ARP announcement complete for %s\n",
1828 		    if_name(ifa->ifa_ifp),
1829 		    in_fmtaddr(ia->ia_addr.sin_addr)));
1830 	}
1831 
1832 	TAILQ_REMOVE(&dadq, dp, dad_list);
1833 	free(dp, M_IPARP);
1834 	dp = NULL;
1835 	ifafree(ifa);
1836 
1837 done:
1838 	KERNEL_UNLOCK_ONE(NULL);
1839 	mutex_exit(softnet_lock);
1840 }
1841 
1842 static void
1843 arp_dad_duplicated(struct ifaddr *ifa)
1844 {
1845 	struct in_ifaddr *ia = (struct in_ifaddr *)ifa;
1846 	struct ifnet *ifp;
1847 	struct dadq *dp;
1848 
1849 	dp = arp_dad_find(ifa);
1850 	if (dp == NULL) {
1851 		log(LOG_ERR, "arp_dad_duplicated: DAD structure not found\n");
1852 		return;
1853 	}
1854 
1855 	ifp = ifa->ifa_ifp;
1856 	log(LOG_ERR, "%s: DAD detected duplicate IPv4 address %s: "
1857 	    "ARP out=%d\n",
1858 	    if_name(ifp), in_fmtaddr(ia->ia_addr.sin_addr),
1859 	    dp->dad_arp_ocount);
1860 
1861 	ia->ia4_flags &= ~IN_IFF_TENTATIVE;
1862 	ia->ia4_flags |= IN_IFF_DUPLICATED;
1863 
1864 	/* We are done with DAD, with duplicated address found. (failure) */
1865 	arp_dad_stoptimer(dp);
1866 
1867 	/* Inform the routing socket that DAD has completed */
1868 	rt_newaddrmsg(RTM_NEWADDR, ifa, 0, NULL);
1869 
1870 	TAILQ_REMOVE(&dadq, dp, dad_list);
1871 	free(dp, M_IPARP);
1872 	dp = NULL;
1873 	ifafree(ifa);
1874 }
1875 
1876 /*
1877  * Called from 10 Mb/s Ethernet interrupt handlers
1878  * when ether packet type ETHERTYPE_REVARP
1879  * is received.  Common length and type checks are done here,
1880  * then the protocol-specific routine is called.
1881  */
1882 void
1883 revarpinput(struct mbuf *m)
1884 {
1885 	struct arphdr *ar;
1886 
1887 	if (m->m_len < sizeof(struct arphdr))
1888 		goto out;
1889 	ar = mtod(m, struct arphdr *);
1890 #if 0 /* XXX I don't think we need this... and it will prevent other LL */
1891 	if (ntohs(ar->ar_hrd) != ARPHRD_ETHER)
1892 		goto out;
1893 #endif
1894 	if (m->m_len < sizeof(struct arphdr) + 2 * (ar->ar_hln + ar->ar_pln))
1895 		goto out;
1896 	switch (ntohs(ar->ar_pro)) {
1897 	case ETHERTYPE_IP:
1898 	case ETHERTYPE_IPTRAILERS:
1899 		in_revarpinput(m);
1900 		return;
1901 
1902 	default:
1903 		break;
1904 	}
1905 out:
1906 	m_freem(m);
1907 }
1908 
1909 /*
1910  * RARP for Internet protocols on 10 Mb/s Ethernet.
1911  * Algorithm is that given in RFC 903.
1912  * We are only using for bootstrap purposes to get an ip address for one of
1913  * our interfaces.  Thus we support no user-interface.
1914  *
1915  * Since the contents of the RARP reply are specific to the interface that
1916  * sent the request, this code must ensure that they are properly associated.
1917  *
1918  * Note: also supports ARP via RARP packets, per the RFC.
1919  */
1920 void
1921 in_revarpinput(struct mbuf *m)
1922 {
1923 	struct ifnet *ifp;
1924 	struct arphdr *ah;
1925 	void *tha;
1926 	int op;
1927 
1928 	ah = mtod(m, struct arphdr *);
1929 	op = ntohs(ah->ar_op);
1930 
1931 	switch (m->m_pkthdr.rcvif->if_type) {
1932 	case IFT_IEEE1394:
1933 		/* ARP without target hardware address is not supported */
1934 		goto out;
1935 	default:
1936 		break;
1937 	}
1938 
1939 	switch (op) {
1940 	case ARPOP_REQUEST:
1941 	case ARPOP_REPLY:	/* per RFC */
1942 		in_arpinput(m);
1943 		return;
1944 	case ARPOP_REVREPLY:
1945 		break;
1946 	case ARPOP_REVREQUEST:	/* handled by rarpd(8) */
1947 	default:
1948 		goto out;
1949 	}
1950 	if (!revarp_in_progress)
1951 		goto out;
1952 	ifp = m->m_pkthdr.rcvif;
1953 	if (ifp != myip_ifp) /* !same interface */
1954 		goto out;
1955 	if (myip_initialized)
1956 		goto wake;
1957 	tha = ar_tha(ah);
1958 	if (tha == NULL)
1959 		goto out;
1960 	if (memcmp(tha, CLLADDR(ifp->if_sadl), ifp->if_sadl->sdl_alen))
1961 		goto out;
1962 	memcpy(&srv_ip, ar_spa(ah), sizeof(srv_ip));
1963 	memcpy(&myip, ar_tpa(ah), sizeof(myip));
1964 	myip_initialized = 1;
1965 wake:	/* Do wakeup every time in case it was missed. */
1966 	wakeup((void *)&myip);
1967 
1968 out:
1969 	m_freem(m);
1970 }
1971 
1972 /*
1973  * Send a RARP request for the ip address of the specified interface.
1974  * The request should be RFC 903-compliant.
1975  */
1976 static void
1977 revarprequest(struct ifnet *ifp)
1978 {
1979 	struct sockaddr sa;
1980 	struct mbuf *m;
1981 	struct arphdr *ah;
1982 	void *tha;
1983 
1984 	if ((m = m_gethdr(M_DONTWAIT, MT_DATA)) == NULL)
1985 		return;
1986 	MCLAIM(m, &arpdomain.dom_mowner);
1987 	m->m_len = sizeof(*ah) + 2*sizeof(struct in_addr) +
1988 	    2*ifp->if_addrlen;
1989 	m->m_pkthdr.len = m->m_len;
1990 	MH_ALIGN(m, m->m_len);
1991 	ah = mtod(m, struct arphdr *);
1992 	memset(ah, 0, m->m_len);
1993 	ah->ar_pro = htons(ETHERTYPE_IP);
1994 	ah->ar_hln = ifp->if_addrlen;		/* hardware address length */
1995 	ah->ar_pln = sizeof(struct in_addr);	/* protocol address length */
1996 	ah->ar_op = htons(ARPOP_REVREQUEST);
1997 
1998 	memcpy(ar_sha(ah), CLLADDR(ifp->if_sadl), ah->ar_hln);
1999 	tha = ar_tha(ah);
2000 	if (tha == NULL) {
2001 		m_free(m);
2002 		return;
2003 	}
2004 	memcpy(tha, CLLADDR(ifp->if_sadl), ah->ar_hln);
2005 
2006 	sa.sa_family = AF_ARP;
2007 	sa.sa_len = 2;
2008 	m->m_flags |= M_BCAST;
2009 
2010 	KERNEL_LOCK(1, NULL);
2011 	(*ifp->if_output)(ifp, m, &sa, NULL);
2012 	KERNEL_UNLOCK_ONE(NULL);
2013 }
2014 
2015 /*
2016  * RARP for the ip address of the specified interface, but also
2017  * save the ip address of the server that sent the answer.
2018  * Timeout if no response is received.
2019  */
2020 int
2021 revarpwhoarewe(struct ifnet *ifp, struct in_addr *serv_in,
2022     struct in_addr *clnt_in)
2023 {
2024 	int result, count = 20;
2025 
2026 	myip_initialized = 0;
2027 	myip_ifp = ifp;
2028 
2029 	revarp_in_progress = 1;
2030 	while (count--) {
2031 		revarprequest(ifp);
2032 		result = tsleep((void *)&myip, PSOCK, "revarp", hz/2);
2033 		if (result != EWOULDBLOCK)
2034 			break;
2035 	}
2036 	revarp_in_progress = 0;
2037 
2038 	if (!myip_initialized)
2039 		return ENETUNREACH;
2040 
2041 	memcpy(serv_in, &srv_ip, sizeof(*serv_in));
2042 	memcpy(clnt_in, &myip, sizeof(*clnt_in));
2043 	return 0;
2044 }
2045 
2046 
2047 
2048 #ifdef DDB
2049 
2050 #include <machine/db_machdep.h>
2051 #include <ddb/db_interface.h>
2052 #include <ddb/db_output.h>
2053 
2054 static void
2055 db_print_sa(const struct sockaddr *sa)
2056 {
2057 	int len;
2058 	const u_char *p;
2059 
2060 	if (sa == NULL) {
2061 		db_printf("[NULL]");
2062 		return;
2063 	}
2064 
2065 	p = (const u_char *)sa;
2066 	len = sa->sa_len;
2067 	db_printf("[");
2068 	while (len > 0) {
2069 		db_printf("%d", *p);
2070 		p++; len--;
2071 		if (len) db_printf(",");
2072 	}
2073 	db_printf("]\n");
2074 }
2075 
2076 static void
2077 db_print_ifa(struct ifaddr *ifa)
2078 {
2079 	if (ifa == NULL)
2080 		return;
2081 	db_printf("  ifa_addr=");
2082 	db_print_sa(ifa->ifa_addr);
2083 	db_printf("  ifa_dsta=");
2084 	db_print_sa(ifa->ifa_dstaddr);
2085 	db_printf("  ifa_mask=");
2086 	db_print_sa(ifa->ifa_netmask);
2087 	db_printf("  flags=0x%x,refcnt=%d,metric=%d\n",
2088 			  ifa->ifa_flags,
2089 			  ifa->ifa_refcnt,
2090 			  ifa->ifa_metric);
2091 }
2092 
2093 static void
2094 db_print_llinfo(struct llentry *la)
2095 {
2096 	if (la == NULL)
2097 		return;
2098 	db_printf("  la_rt=%p la_hold=%p, la_asked=%d\n",
2099 			  la->la_rt, la->la_hold, la->la_asked);
2100 	db_printf("  la_flags=0x%x\n", la->la_flags);
2101 }
2102 
2103 /*
2104  * Function to pass to rt_walktree().
2105  * Return non-zero error to abort walk.
2106  */
2107 static int
2108 db_show_rtentry(struct rtentry *rt, void *w)
2109 {
2110 	db_printf("rtentry=%p", rt);
2111 
2112 	db_printf(" flags=0x%x refcnt=%d use=%"PRId64" expire=%"PRId64"\n",
2113 			  rt->rt_flags, rt->rt_refcnt,
2114 			  rt->rt_use, (uint64_t)rt->rt_expire);
2115 
2116 	db_printf(" key="); db_print_sa(rt_getkey(rt));
2117 	db_printf(" mask="); db_print_sa(rt_mask(rt));
2118 	db_printf(" gw="); db_print_sa(rt->rt_gateway);
2119 
2120 	db_printf(" ifp=%p ", rt->rt_ifp);
2121 	if (rt->rt_ifp)
2122 		db_printf("(%s)", rt->rt_ifp->if_xname);
2123 	else
2124 		db_printf("(NULL)");
2125 
2126 	db_printf(" ifa=%p\n", rt->rt_ifa);
2127 	db_print_ifa(rt->rt_ifa);
2128 
2129 	db_printf(" gwroute=%p llinfo=%p\n",
2130 			  rt->rt_gwroute, rt->rt_llinfo);
2131 	db_print_llinfo(rt->rt_llinfo);
2132 
2133 	return 0;
2134 }
2135 
2136 /*
2137  * Function to print all the route trees.
2138  * Use this from ddb:  "show arptab"
2139  */
2140 void
2141 db_show_arptab(db_expr_t addr, bool have_addr,
2142     db_expr_t count, const char *modif)
2143 {
2144 	rt_walktree(AF_INET, db_show_rtentry, NULL);
2145 }
2146 #endif
2147 
2148 void
2149 arp_stat_add(int type, uint64_t count)
2150 {
2151 	ARP_STATADD(type, count);
2152 }
2153 
2154 static int
2155 sysctl_net_inet_arp_stats(SYSCTLFN_ARGS)
2156 {
2157 
2158 	return NETSTAT_SYSCTL(arpstat_percpu, ARP_NSTATS);
2159 }
2160 
2161 static void
2162 sysctl_net_inet_arp_setup(struct sysctllog **clog)
2163 {
2164 	const struct sysctlnode *node;
2165 
2166 	sysctl_createv(clog, 0, NULL, NULL,
2167 			CTLFLAG_PERMANENT,
2168 			CTLTYPE_NODE, "inet", NULL,
2169 			NULL, 0, NULL, 0,
2170 			CTL_NET, PF_INET, CTL_EOL);
2171 	sysctl_createv(clog, 0, NULL, &node,
2172 			CTLFLAG_PERMANENT,
2173 			CTLTYPE_NODE, "arp",
2174 			SYSCTL_DESCR("Address Resolution Protocol"),
2175 			NULL, 0, NULL, 0,
2176 			CTL_NET, PF_INET, CTL_CREATE, CTL_EOL);
2177 
2178 	sysctl_createv(clog, 0, NULL, NULL,
2179 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2180 			CTLTYPE_INT, "keep",
2181 			SYSCTL_DESCR("Valid ARP entry lifetime in seconds"),
2182 			NULL, 0, &arpt_keep, 0,
2183 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2184 
2185 	sysctl_createv(clog, 0, NULL, NULL,
2186 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2187 			CTLTYPE_INT, "down",
2188 			SYSCTL_DESCR("Failed ARP entry lifetime in seconds"),
2189 			NULL, 0, &arpt_down, 0,
2190 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2191 
2192 	sysctl_createv(clog, 0, NULL, NULL,
2193 			CTLFLAG_PERMANENT,
2194 			CTLTYPE_STRUCT, "stats",
2195 			SYSCTL_DESCR("ARP statistics"),
2196 			sysctl_net_inet_arp_stats, 0, NULL, 0,
2197 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2198 
2199 	sysctl_createv(clog, 0, NULL, NULL,
2200 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2201 			CTLTYPE_INT, "log_movements",
2202 			SYSCTL_DESCR("log ARP replies from MACs different than"
2203 			    " the one in the cache"),
2204 			NULL, 0, &log_movements, 0,
2205 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2206 
2207 	sysctl_createv(clog, 0, NULL, NULL,
2208 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2209 			CTLTYPE_INT, "log_permanent_modify",
2210 			SYSCTL_DESCR("log ARP replies from MACs different than"
2211 			    " the one in the permanent arp entry"),
2212 			NULL, 0, &log_permanent_modify, 0,
2213 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2214 
2215 	sysctl_createv(clog, 0, NULL, NULL,
2216 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2217 			CTLTYPE_INT, "log_wrong_iface",
2218 			SYSCTL_DESCR("log ARP packets arriving on the wrong"
2219 			    " interface"),
2220 			NULL, 0, &log_wrong_iface, 0,
2221 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2222 
2223 	sysctl_createv(clog, 0, NULL, NULL,
2224 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2225 			CTLTYPE_INT, "log_unknown_network",
2226 			SYSCTL_DESCR("log ARP packets from non-local network"),
2227 			NULL, 0, &log_unknown_network, 0,
2228 			CTL_NET,PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2229 
2230 	sysctl_createv(clog, 0, NULL, NULL,
2231 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2232 		       CTLTYPE_INT, "debug",
2233 		       SYSCTL_DESCR("Enable ARP DAD debug output"),
2234 		       NULL, 0, &arp_debug, 0,
2235 		       CTL_NET, PF_INET, node->sysctl_num, CTL_CREATE, CTL_EOL);
2236 }
2237 
2238 #endif /* INET */
2239