1 /* $NetBSD: ip_input.c,v 1.272 2008/05/05 17:11:17 ad Exp $ */ 2 3 /* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /*- 33 * Copyright (c) 1998 The NetBSD Foundation, Inc. 34 * All rights reserved. 35 * 36 * This code is derived from software contributed to The NetBSD Foundation 37 * by Public Access Networks Corporation ("Panix"). It was developed under 38 * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon. 39 * 40 * Redistribution and use in source and binary forms, with or without 41 * modification, are permitted provided that the following conditions 42 * are met: 43 * 1. Redistributions of source code must retain the above copyright 44 * notice, this list of conditions and the following disclaimer. 45 * 2. Redistributions in binary form must reproduce the above copyright 46 * notice, this list of conditions and the following disclaimer in the 47 * documentation and/or other materials provided with the distribution. 48 * 49 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 50 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 51 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 52 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 53 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 54 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 55 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 56 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 57 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 58 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 59 * POSSIBILITY OF SUCH DAMAGE. 60 */ 61 62 /* 63 * Copyright (c) 1982, 1986, 1988, 1993 64 * The Regents of the University of California. All rights reserved. 65 * 66 * Redistribution and use in source and binary forms, with or without 67 * modification, are permitted provided that the following conditions 68 * are met: 69 * 1. Redistributions of source code must retain the above copyright 70 * notice, this list of conditions and the following disclaimer. 71 * 2. Redistributions in binary form must reproduce the above copyright 72 * notice, this list of conditions and the following disclaimer in the 73 * documentation and/or other materials provided with the distribution. 74 * 3. Neither the name of the University nor the names of its contributors 75 * may be used to endorse or promote products derived from this software 76 * without specific prior written permission. 77 * 78 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 79 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 80 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 81 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 82 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 83 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 84 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 85 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 86 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 87 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 88 * SUCH DAMAGE. 89 * 90 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 91 */ 92 93 #include <sys/cdefs.h> 94 __KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.272 2008/05/05 17:11:17 ad Exp $"); 95 96 #include "opt_inet.h" 97 #include "opt_gateway.h" 98 #include "opt_pfil_hooks.h" 99 #include "opt_ipsec.h" 100 #include "opt_mrouting.h" 101 #include "opt_mbuftrace.h" 102 #include "opt_inet_csum.h" 103 104 #include <sys/param.h> 105 #include <sys/systm.h> 106 #include <sys/malloc.h> 107 #include <sys/mbuf.h> 108 #include <sys/domain.h> 109 #include <sys/protosw.h> 110 #include <sys/socket.h> 111 #include <sys/socketvar.h> 112 #include <sys/errno.h> 113 #include <sys/time.h> 114 #include <sys/kernel.h> 115 #include <sys/pool.h> 116 #include <sys/sysctl.h> 117 #include <sys/kauth.h> 118 119 #include <net/if.h> 120 #include <net/if_dl.h> 121 #include <net/route.h> 122 #include <net/pfil.h> 123 124 #include <netinet/in.h> 125 #include <netinet/in_systm.h> 126 #include <netinet/ip.h> 127 #include <netinet/in_pcb.h> 128 #include <netinet/in_proto.h> 129 #include <netinet/in_var.h> 130 #include <netinet/ip_var.h> 131 #include <netinet/ip_private.h> 132 #include <netinet/ip_icmp.h> 133 /* just for gif_ttl */ 134 #include <netinet/in_gif.h> 135 #include "gif.h" 136 #include <net/if_gre.h> 137 #include "gre.h" 138 139 #ifdef MROUTING 140 #include <netinet/ip_mroute.h> 141 #endif 142 143 #ifdef IPSEC 144 #include <netinet6/ipsec.h> 145 #include <netinet6/ipsec_private.h> 146 #include <netkey/key.h> 147 #endif 148 #ifdef FAST_IPSEC 149 #include <netipsec/ipsec.h> 150 #include <netipsec/key.h> 151 #endif /* FAST_IPSEC*/ 152 153 #ifndef IPFORWARDING 154 #ifdef GATEWAY 155 #define IPFORWARDING 1 /* forward IP packets not for us */ 156 #else /* GATEWAY */ 157 #define IPFORWARDING 0 /* don't forward IP packets not for us */ 158 #endif /* GATEWAY */ 159 #endif /* IPFORWARDING */ 160 #ifndef IPSENDREDIRECTS 161 #define IPSENDREDIRECTS 1 162 #endif 163 #ifndef IPFORWSRCRT 164 #define IPFORWSRCRT 1 /* forward source-routed packets */ 165 #endif 166 #ifndef IPALLOWSRCRT 167 #define IPALLOWSRCRT 1 /* allow source-routed packets */ 168 #endif 169 #ifndef IPMTUDISC 170 #define IPMTUDISC 1 171 #endif 172 #ifndef IPMTUDISCTIMEOUT 173 #define IPMTUDISCTIMEOUT (10 * 60) /* as per RFC 1191 */ 174 #endif 175 176 /* 177 * Note: DIRECTED_BROADCAST is handled this way so that previous 178 * configuration using this option will Just Work. 179 */ 180 #ifndef IPDIRECTEDBCAST 181 #ifdef DIRECTED_BROADCAST 182 #define IPDIRECTEDBCAST 1 183 #else 184 #define IPDIRECTEDBCAST 0 185 #endif /* DIRECTED_BROADCAST */ 186 #endif /* IPDIRECTEDBCAST */ 187 int ipforwarding = IPFORWARDING; 188 int ipsendredirects = IPSENDREDIRECTS; 189 int ip_defttl = IPDEFTTL; 190 int ip_forwsrcrt = IPFORWSRCRT; 191 int ip_directedbcast = IPDIRECTEDBCAST; 192 int ip_allowsrcrt = IPALLOWSRCRT; 193 int ip_mtudisc = IPMTUDISC; 194 int ip_mtudisc_timeout = IPMTUDISCTIMEOUT; 195 #ifdef DIAGNOSTIC 196 int ipprintfs = 0; 197 #endif 198 199 int ip_do_randomid = 0; 200 201 /* 202 * XXX - Setting ip_checkinterface mostly implements the receive side of 203 * the Strong ES model described in RFC 1122, but since the routing table 204 * and transmit implementation do not implement the Strong ES model, 205 * setting this to 1 results in an odd hybrid. 206 * 207 * XXX - ip_checkinterface currently must be disabled if you use ipnat 208 * to translate the destination address to another local interface. 209 * 210 * XXX - ip_checkinterface must be disabled if you add IP aliases 211 * to the loopback interface instead of the interface where the 212 * packets for those addresses are received. 213 */ 214 int ip_checkinterface = 0; 215 216 217 struct rttimer_queue *ip_mtudisc_timeout_q = NULL; 218 219 int ipqmaxlen = IFQ_MAXLEN; 220 u_long in_ifaddrhash; /* size of hash table - 1 */ 221 int in_ifaddrentries; /* total number of addrs */ 222 struct in_ifaddrhead in_ifaddrhead; 223 struct in_ifaddrhashhead *in_ifaddrhashtbl; 224 u_long in_multihash; /* size of hash table - 1 */ 225 int in_multientries; /* total number of addrs */ 226 struct in_multihashhead *in_multihashtbl; 227 struct ifqueue ipintrq; 228 uint16_t ip_id; 229 230 percpu_t *ipstat_percpu; 231 232 #ifdef PFIL_HOOKS 233 struct pfil_head inet_pfil_hook; 234 #endif 235 236 /* 237 * Cached copy of nmbclusters. If nbclusters is different, 238 * recalculate IP parameters derived from nmbclusters. 239 */ 240 static int ip_nmbclusters; /* copy of nmbclusters */ 241 static void ip_nmbclusters_changed(void); /* recalc limits */ 242 243 #define CHECK_NMBCLUSTER_PARAMS() \ 244 do { \ 245 if (__predict_false(ip_nmbclusters != nmbclusters)) \ 246 ip_nmbclusters_changed(); \ 247 } while (/*CONSTCOND*/0) 248 249 /* IP datagram reassembly queues (hashed) */ 250 #define IPREASS_NHASH_LOG2 6 251 #define IPREASS_NHASH (1 << IPREASS_NHASH_LOG2) 252 #define IPREASS_HMASK (IPREASS_NHASH - 1) 253 #define IPREASS_HASH(x,y) \ 254 (((((x) & 0xF) | ((((x) >> 8) & 0xF) << 4)) ^ (y)) & IPREASS_HMASK) 255 struct ipqhead ipq[IPREASS_NHASH]; 256 int ipq_locked; 257 static int ip_nfragpackets; /* packets in reass queue */ 258 static int ip_nfrags; /* total fragments in reass queues */ 259 260 int ip_maxfragpackets = 200; /* limit on packets. XXX sysctl */ 261 int ip_maxfrags; /* limit on fragments. XXX sysctl */ 262 263 264 /* 265 * Additive-Increase/Multiplicative-Decrease (AIMD) strategy for 266 * IP reassembly queue buffer managment. 267 * 268 * We keep a count of total IP fragments (NB: not fragmented packets!) 269 * awaiting reassembly (ip_nfrags) and a limit (ip_maxfrags) on fragments. 270 * If ip_nfrags exceeds ip_maxfrags the limit, we drop half the 271 * total fragments in reassembly queues.This AIMD policy avoids 272 * repeatedly deleting single packets under heavy fragmentation load 273 * (e.g., from lossy NFS peers). 274 */ 275 static u_int ip_reass_ttl_decr(u_int ticks); 276 static void ip_reass_drophalf(void); 277 278 279 static inline int ipq_lock_try(void); 280 static inline void ipq_unlock(void); 281 282 static inline int 283 ipq_lock_try(void) 284 { 285 int s; 286 287 /* 288 * Use splvm() -- we're blocking things that would cause 289 * mbuf allocation. 290 */ 291 s = splvm(); 292 if (ipq_locked) { 293 splx(s); 294 return (0); 295 } 296 ipq_locked = 1; 297 splx(s); 298 return (1); 299 } 300 301 static inline void 302 ipq_unlock(void) 303 { 304 int s; 305 306 s = splvm(); 307 ipq_locked = 0; 308 splx(s); 309 } 310 311 #ifdef DIAGNOSTIC 312 #define IPQ_LOCK() \ 313 do { \ 314 if (ipq_lock_try() == 0) { \ 315 printf("%s:%d: ipq already locked\n", __FILE__, __LINE__); \ 316 panic("ipq_lock"); \ 317 } \ 318 } while (/*CONSTCOND*/ 0) 319 #define IPQ_LOCK_CHECK() \ 320 do { \ 321 if (ipq_locked == 0) { \ 322 printf("%s:%d: ipq lock not held\n", __FILE__, __LINE__); \ 323 panic("ipq lock check"); \ 324 } \ 325 } while (/*CONSTCOND*/ 0) 326 #else 327 #define IPQ_LOCK() (void) ipq_lock_try() 328 #define IPQ_LOCK_CHECK() /* nothing */ 329 #endif 330 331 #define IPQ_UNLOCK() ipq_unlock() 332 333 POOL_INIT(inmulti_pool, sizeof(struct in_multi), 0, 0, 0, "inmltpl", NULL, 334 IPL_SOFTNET); 335 POOL_INIT(ipqent_pool, sizeof(struct ipqent), 0, 0, 0, "ipqepl", NULL, 336 IPL_VM); 337 338 #ifdef INET_CSUM_COUNTERS 339 #include <sys/device.h> 340 341 struct evcnt ip_hwcsum_bad = EVCNT_INITIALIZER(EVCNT_TYPE_MISC, 342 NULL, "inet", "hwcsum bad"); 343 struct evcnt ip_hwcsum_ok = EVCNT_INITIALIZER(EVCNT_TYPE_MISC, 344 NULL, "inet", "hwcsum ok"); 345 struct evcnt ip_swcsum = EVCNT_INITIALIZER(EVCNT_TYPE_MISC, 346 NULL, "inet", "swcsum"); 347 348 #define INET_CSUM_COUNTER_INCR(ev) (ev)->ev_count++ 349 350 EVCNT_ATTACH_STATIC(ip_hwcsum_bad); 351 EVCNT_ATTACH_STATIC(ip_hwcsum_ok); 352 EVCNT_ATTACH_STATIC(ip_swcsum); 353 354 #else 355 356 #define INET_CSUM_COUNTER_INCR(ev) /* nothing */ 357 358 #endif /* INET_CSUM_COUNTERS */ 359 360 /* 361 * We need to save the IP options in case a protocol wants to respond 362 * to an incoming packet over the same route if the packet got here 363 * using IP source routing. This allows connection establishment and 364 * maintenance when the remote end is on a network that is not known 365 * to us. 366 */ 367 int ip_nhops = 0; 368 static struct ip_srcrt { 369 struct in_addr dst; /* final destination */ 370 char nop; /* one NOP to align */ 371 char srcopt[IPOPT_OFFSET + 1]; /* OPTVAL, OLEN and OFFSET */ 372 struct in_addr route[MAX_IPOPTLEN/sizeof(struct in_addr)]; 373 } ip_srcrt; 374 375 static void save_rte(u_char *, struct in_addr); 376 377 #ifdef MBUFTRACE 378 struct mowner ip_rx_mowner = MOWNER_INIT("internet", "rx"); 379 struct mowner ip_tx_mowner = MOWNER_INIT("internet", "tx"); 380 #endif 381 382 /* 383 * Compute IP limits derived from the value of nmbclusters. 384 */ 385 static void 386 ip_nmbclusters_changed(void) 387 { 388 ip_maxfrags = nmbclusters / 4; 389 ip_nmbclusters = nmbclusters; 390 } 391 392 /* 393 * IP initialization: fill in IP protocol switch table. 394 * All protocols not implemented in kernel go to raw IP protocol handler. 395 */ 396 void 397 ip_init(void) 398 { 399 const struct protosw *pr; 400 int i; 401 402 pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 403 if (pr == 0) 404 panic("ip_init"); 405 for (i = 0; i < IPPROTO_MAX; i++) 406 ip_protox[i] = pr - inetsw; 407 for (pr = inetdomain.dom_protosw; 408 pr < inetdomain.dom_protoswNPROTOSW; pr++) 409 if (pr->pr_domain->dom_family == PF_INET && 410 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) 411 ip_protox[pr->pr_protocol] = pr - inetsw; 412 413 for (i = 0; i < IPREASS_NHASH; i++) 414 LIST_INIT(&ipq[i]); 415 416 ip_initid(); 417 ip_id = time_second & 0xfffff; 418 419 ipintrq.ifq_maxlen = ipqmaxlen; 420 ip_nmbclusters_changed(); 421 422 TAILQ_INIT(&in_ifaddrhead); 423 in_ifaddrhashtbl = hashinit(IN_IFADDR_HASH_SIZE, HASH_LIST, true, 424 &in_ifaddrhash); 425 in_multihashtbl = hashinit(IN_IFADDR_HASH_SIZE, HASH_LIST, true, 426 &in_multihash); 427 ip_mtudisc_timeout_q = rt_timer_queue_create(ip_mtudisc_timeout); 428 #ifdef GATEWAY 429 ipflow_init(ip_hashsize); 430 #endif 431 432 #ifdef PFIL_HOOKS 433 /* Register our Packet Filter hook. */ 434 inet_pfil_hook.ph_type = PFIL_TYPE_AF; 435 inet_pfil_hook.ph_af = AF_INET; 436 i = pfil_head_register(&inet_pfil_hook); 437 if (i != 0) 438 printf("ip_init: WARNING: unable to register pfil hook, " 439 "error %d\n", i); 440 #endif /* PFIL_HOOKS */ 441 442 #ifdef MBUFTRACE 443 MOWNER_ATTACH(&ip_tx_mowner); 444 MOWNER_ATTACH(&ip_rx_mowner); 445 #endif /* MBUFTRACE */ 446 447 ipstat_percpu = percpu_alloc(sizeof(uint64_t) * IP_NSTATS); 448 } 449 450 struct sockaddr_in ipaddr = { 451 .sin_len = sizeof(ipaddr), 452 .sin_family = AF_INET, 453 }; 454 struct route ipforward_rt; 455 456 /* 457 * IP software interrupt routine 458 */ 459 void 460 ipintr(void) 461 { 462 int s; 463 struct mbuf *m; 464 465 mutex_enter(softnet_lock); 466 KERNEL_LOCK(1, NULL); 467 while (!IF_IS_EMPTY(&ipintrq)) { 468 s = splnet(); 469 IF_DEQUEUE(&ipintrq, m); 470 splx(s); 471 if (m == NULL) 472 break; 473 ip_input(m); 474 } 475 KERNEL_UNLOCK_ONE(NULL); 476 mutex_exit(softnet_lock); 477 } 478 479 /* 480 * Ip input routine. Checksum and byte swap header. If fragmented 481 * try to reassemble. Process options. Pass to next level. 482 */ 483 void 484 ip_input(struct mbuf *m) 485 { 486 struct ip *ip = NULL; 487 struct ipq *fp; 488 struct in_ifaddr *ia; 489 struct ifaddr *ifa; 490 struct ipqent *ipqe; 491 int hlen = 0, mff, len; 492 int downmatch; 493 int checkif; 494 int srcrt = 0; 495 int s; 496 u_int hash; 497 #ifdef FAST_IPSEC 498 struct m_tag *mtag; 499 struct tdb_ident *tdbi; 500 struct secpolicy *sp; 501 int error; 502 #endif /* FAST_IPSEC */ 503 504 MCLAIM(m, &ip_rx_mowner); 505 #ifdef DIAGNOSTIC 506 if ((m->m_flags & M_PKTHDR) == 0) 507 panic("ipintr no HDR"); 508 #endif 509 510 /* 511 * If no IP addresses have been set yet but the interfaces 512 * are receiving, can't do anything with incoming packets yet. 513 */ 514 if (TAILQ_FIRST(&in_ifaddrhead) == 0) 515 goto bad; 516 IP_STATINC(IP_STAT_TOTAL); 517 /* 518 * If the IP header is not aligned, slurp it up into a new 519 * mbuf with space for link headers, in the event we forward 520 * it. Otherwise, if it is aligned, make sure the entire 521 * base IP header is in the first mbuf of the chain. 522 */ 523 if (IP_HDR_ALIGNED_P(mtod(m, void *)) == 0) { 524 if ((m = m_copyup(m, sizeof(struct ip), 525 (max_linkhdr + 3) & ~3)) == NULL) { 526 /* XXXJRT new stat, please */ 527 IP_STATINC(IP_STAT_TOOSMALL); 528 return; 529 } 530 } else if (__predict_false(m->m_len < sizeof (struct ip))) { 531 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) { 532 IP_STATINC(IP_STAT_TOOSMALL); 533 return; 534 } 535 } 536 ip = mtod(m, struct ip *); 537 if (ip->ip_v != IPVERSION) { 538 IP_STATINC(IP_STAT_BADVERS); 539 goto bad; 540 } 541 hlen = ip->ip_hl << 2; 542 if (hlen < sizeof(struct ip)) { /* minimum header length */ 543 IP_STATINC(IP_STAT_BADHLEN); 544 goto bad; 545 } 546 if (hlen > m->m_len) { 547 if ((m = m_pullup(m, hlen)) == 0) { 548 IP_STATINC(IP_STAT_BADHLEN); 549 return; 550 } 551 ip = mtod(m, struct ip *); 552 } 553 554 /* 555 * RFC1122: packets with a multicast source address are 556 * not allowed. 557 */ 558 if (IN_MULTICAST(ip->ip_src.s_addr)) { 559 IP_STATINC(IP_STAT_BADADDR); 560 goto bad; 561 } 562 563 /* 127/8 must not appear on wire - RFC1122 */ 564 if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 565 (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) { 566 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { 567 IP_STATINC(IP_STAT_BADADDR); 568 goto bad; 569 } 570 } 571 572 switch (m->m_pkthdr.csum_flags & 573 ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_IPv4) | 574 M_CSUM_IPv4_BAD)) { 575 case M_CSUM_IPv4|M_CSUM_IPv4_BAD: 576 INET_CSUM_COUNTER_INCR(&ip_hwcsum_bad); 577 goto badcsum; 578 579 case M_CSUM_IPv4: 580 /* Checksum was okay. */ 581 INET_CSUM_COUNTER_INCR(&ip_hwcsum_ok); 582 break; 583 584 default: 585 /* 586 * Must compute it ourselves. Maybe skip checksum on 587 * loopback interfaces. 588 */ 589 if (__predict_true(!(m->m_pkthdr.rcvif->if_flags & 590 IFF_LOOPBACK) || ip_do_loopback_cksum)) { 591 INET_CSUM_COUNTER_INCR(&ip_swcsum); 592 if (in_cksum(m, hlen) != 0) 593 goto badcsum; 594 } 595 break; 596 } 597 598 /* Retrieve the packet length. */ 599 len = ntohs(ip->ip_len); 600 601 /* 602 * Check for additional length bogosity 603 */ 604 if (len < hlen) { 605 IP_STATINC(IP_STAT_BADLEN); 606 goto bad; 607 } 608 609 /* 610 * Check that the amount of data in the buffers 611 * is as at least much as the IP header would have us expect. 612 * Trim mbufs if longer than we expect. 613 * Drop packet if shorter than we expect. 614 */ 615 if (m->m_pkthdr.len < len) { 616 IP_STATINC(IP_STAT_TOOSHORT); 617 goto bad; 618 } 619 if (m->m_pkthdr.len > len) { 620 if (m->m_len == m->m_pkthdr.len) { 621 m->m_len = len; 622 m->m_pkthdr.len = len; 623 } else 624 m_adj(m, len - m->m_pkthdr.len); 625 } 626 627 #if defined(IPSEC) 628 /* ipflow (IP fast forwarding) is not compatible with IPsec. */ 629 m->m_flags &= ~M_CANFASTFWD; 630 #else 631 /* 632 * Assume that we can create a fast-forward IP flow entry 633 * based on this packet. 634 */ 635 m->m_flags |= M_CANFASTFWD; 636 #endif 637 638 #ifdef PFIL_HOOKS 639 /* 640 * Run through list of hooks for input packets. If there are any 641 * filters which require that additional packets in the flow are 642 * not fast-forwarded, they must clear the M_CANFASTFWD flag. 643 * Note that filters must _never_ set this flag, as another filter 644 * in the list may have previously cleared it. 645 */ 646 /* 647 * let ipfilter look at packet on the wire, 648 * not the decapsulated packet. 649 */ 650 #ifdef IPSEC 651 if (!ipsec_getnhist(m)) 652 #elif defined(FAST_IPSEC) 653 if (!ipsec_indone(m)) 654 #else 655 if (1) 656 #endif 657 { 658 struct in_addr odst; 659 660 odst = ip->ip_dst; 661 if (pfil_run_hooks(&inet_pfil_hook, &m, m->m_pkthdr.rcvif, 662 PFIL_IN) != 0) 663 return; 664 if (m == NULL) 665 return; 666 ip = mtod(m, struct ip *); 667 hlen = ip->ip_hl << 2; 668 /* 669 * XXX The setting of "srcrt" here is to prevent ip_forward() 670 * from generating ICMP redirects for packets that have 671 * been redirected by a hook back out on to the same LAN that 672 * they came from and is not an indication that the packet 673 * is being inffluenced by source routing options. This 674 * allows things like 675 * "rdr tlp0 0/0 port 80 -> 1.1.1.200 3128 tcp" 676 * where tlp0 is both on the 1.1.1.0/24 network and is the 677 * default route for hosts on 1.1.1.0/24. Of course this 678 * also requires a "map tlp0 ..." to complete the story. 679 * One might argue whether or not this kind of network config. 680 * should be supported in this manner... 681 */ 682 srcrt = (odst.s_addr != ip->ip_dst.s_addr); 683 } 684 #endif /* PFIL_HOOKS */ 685 686 #ifdef ALTQ 687 /* XXX Temporary until ALTQ is changed to use a pfil hook */ 688 if (altq_input != NULL && (*altq_input)(m, AF_INET) == 0) { 689 /* packet dropped by traffic conditioner */ 690 return; 691 } 692 #endif 693 694 /* 695 * Process options and, if not destined for us, 696 * ship it on. ip_dooptions returns 1 when an 697 * error was detected (causing an icmp message 698 * to be sent and the original packet to be freed). 699 */ 700 ip_nhops = 0; /* for source routed packets */ 701 if (hlen > sizeof (struct ip) && ip_dooptions(m)) 702 return; 703 704 /* 705 * Enable a consistency check between the destination address 706 * and the arrival interface for a unicast packet (the RFC 1122 707 * strong ES model) if IP forwarding is disabled and the packet 708 * is not locally generated. 709 * 710 * XXX - Checking also should be disabled if the destination 711 * address is ipnat'ed to a different interface. 712 * 713 * XXX - Checking is incompatible with IP aliases added 714 * to the loopback interface instead of the interface where 715 * the packets are received. 716 * 717 * XXX - We need to add a per ifaddr flag for this so that 718 * we get finer grain control. 719 */ 720 checkif = ip_checkinterface && (ipforwarding == 0) && 721 (m->m_pkthdr.rcvif != NULL) && 722 ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0); 723 724 /* 725 * Check our list of addresses, to see if the packet is for us. 726 * 727 * Traditional 4.4BSD did not consult IFF_UP at all. 728 * The behavior here is to treat addresses on !IFF_UP interface 729 * as not mine. 730 */ 731 downmatch = 0; 732 LIST_FOREACH(ia, &IN_IFADDR_HASH(ip->ip_dst.s_addr), ia_hash) { 733 if (in_hosteq(ia->ia_addr.sin_addr, ip->ip_dst)) { 734 if (checkif && ia->ia_ifp != m->m_pkthdr.rcvif) 735 continue; 736 if ((ia->ia_ifp->if_flags & IFF_UP) != 0) 737 break; 738 else 739 downmatch++; 740 } 741 } 742 if (ia != NULL) 743 goto ours; 744 if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) { 745 IFADDR_FOREACH(ifa, m->m_pkthdr.rcvif) { 746 if (ifa->ifa_addr->sa_family != AF_INET) 747 continue; 748 ia = ifatoia(ifa); 749 if (in_hosteq(ip->ip_dst, ia->ia_broadaddr.sin_addr) || 750 in_hosteq(ip->ip_dst, ia->ia_netbroadcast) || 751 /* 752 * Look for all-0's host part (old broadcast addr), 753 * either for subnet or net. 754 */ 755 ip->ip_dst.s_addr == ia->ia_subnet || 756 ip->ip_dst.s_addr == ia->ia_net) 757 goto ours; 758 /* 759 * An interface with IP address zero accepts 760 * all packets that arrive on that interface. 761 */ 762 if (in_nullhost(ia->ia_addr.sin_addr)) 763 goto ours; 764 } 765 } 766 if (IN_MULTICAST(ip->ip_dst.s_addr)) { 767 struct in_multi *inm; 768 #ifdef MROUTING 769 extern struct socket *ip_mrouter; 770 771 if (ip_mrouter) { 772 /* 773 * If we are acting as a multicast router, all 774 * incoming multicast packets are passed to the 775 * kernel-level multicast forwarding function. 776 * The packet is returned (relatively) intact; if 777 * ip_mforward() returns a non-zero value, the packet 778 * must be discarded, else it may be accepted below. 779 * 780 * (The IP ident field is put in the same byte order 781 * as expected when ip_mforward() is called from 782 * ip_output().) 783 */ 784 if (ip_mforward(m, m->m_pkthdr.rcvif) != 0) { 785 IP_STATINC(IP_STAT_CANTFORWARD); 786 m_freem(m); 787 return; 788 } 789 790 /* 791 * The process-level routing demon needs to receive 792 * all multicast IGMP packets, whether or not this 793 * host belongs to their destination groups. 794 */ 795 if (ip->ip_p == IPPROTO_IGMP) 796 goto ours; 797 IP_STATINC(IP_STAT_CANTFORWARD); 798 } 799 #endif 800 /* 801 * See if we belong to the destination multicast group on the 802 * arrival interface. 803 */ 804 IN_LOOKUP_MULTI(ip->ip_dst, m->m_pkthdr.rcvif, inm); 805 if (inm == NULL) { 806 IP_STATINC(IP_STAT_CANTFORWARD); 807 m_freem(m); 808 return; 809 } 810 goto ours; 811 } 812 if (ip->ip_dst.s_addr == INADDR_BROADCAST || 813 in_nullhost(ip->ip_dst)) 814 goto ours; 815 816 /* 817 * Not for us; forward if possible and desirable. 818 */ 819 if (ipforwarding == 0) { 820 IP_STATINC(IP_STAT_CANTFORWARD); 821 m_freem(m); 822 } else { 823 /* 824 * If ip_dst matched any of my address on !IFF_UP interface, 825 * and there's no IFF_UP interface that matches ip_dst, 826 * send icmp unreach. Forwarding it will result in in-kernel 827 * forwarding loop till TTL goes to 0. 828 */ 829 if (downmatch) { 830 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0); 831 IP_STATINC(IP_STAT_CANTFORWARD); 832 return; 833 } 834 #ifdef IPSEC 835 if (ipsec4_in_reject(m, NULL)) { 836 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); 837 goto bad; 838 } 839 #endif 840 #ifdef FAST_IPSEC 841 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); 842 s = splsoftnet(); 843 if (mtag != NULL) { 844 tdbi = (struct tdb_ident *)(mtag + 1); 845 sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND); 846 } else { 847 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, 848 IP_FORWARDING, &error); 849 } 850 if (sp == NULL) { /* NB: can happen if error */ 851 splx(s); 852 /*XXX error stat???*/ 853 DPRINTF(("ip_input: no SP for forwarding\n")); /*XXX*/ 854 goto bad; 855 } 856 857 /* 858 * Check security policy against packet attributes. 859 */ 860 error = ipsec_in_reject(sp, m); 861 KEY_FREESP(&sp); 862 splx(s); 863 if (error) { 864 IP_STATINC(IP_STAT_CANTFORWARD); 865 goto bad; 866 } 867 868 /* 869 * Peek at the outbound SP for this packet to determine if 870 * it's a Fast Forward candidate. 871 */ 872 mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL); 873 if (mtag != NULL) 874 m->m_flags &= ~M_CANFASTFWD; 875 else { 876 s = splsoftnet(); 877 sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND, 878 (IP_FORWARDING | 879 (ip_directedbcast ? IP_ALLOWBROADCAST : 0)), 880 &error, NULL); 881 if (sp != NULL) { 882 m->m_flags &= ~M_CANFASTFWD; 883 KEY_FREESP(&sp); 884 } 885 splx(s); 886 } 887 #endif /* FAST_IPSEC */ 888 889 ip_forward(m, srcrt); 890 } 891 return; 892 893 ours: 894 /* 895 * If offset or IP_MF are set, must reassemble. 896 * Otherwise, nothing need be done. 897 * (We could look in the reassembly queue to see 898 * if the packet was previously fragmented, 899 * but it's not worth the time; just let them time out.) 900 */ 901 if (ip->ip_off & ~htons(IP_DF|IP_RF)) { 902 uint16_t off; 903 /* 904 * Prevent TCP blind data attacks by not allowing non-initial 905 * fragments to start at less than 68 bytes (minimal fragment 906 * size) and making sure the first fragment is at least 68 907 * bytes. 908 */ 909 off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3; 910 if ((off > 0 ? off + hlen : len) < IP_MINFRAGSIZE - 1) { 911 IP_STATINC(IP_STAT_BADFRAGS); 912 goto bad; 913 } 914 /* 915 * Look for queue of fragments 916 * of this datagram. 917 */ 918 IPQ_LOCK(); 919 hash = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id); 920 LIST_FOREACH(fp, &ipq[hash], ipq_q) { 921 if (ip->ip_id == fp->ipq_id && 922 in_hosteq(ip->ip_src, fp->ipq_src) && 923 in_hosteq(ip->ip_dst, fp->ipq_dst) && 924 ip->ip_p == fp->ipq_p) { 925 /* 926 * Make sure the TOS is matches previous 927 * fragments. 928 */ 929 if (ip->ip_tos != fp->ipq_tos) { 930 IP_STATINC(IP_STAT_BADFRAGS); 931 goto bad; 932 } 933 goto found; 934 } 935 } 936 fp = 0; 937 found: 938 939 /* 940 * Adjust ip_len to not reflect header, 941 * set ipqe_mff if more fragments are expected, 942 * convert offset of this to bytes. 943 */ 944 ip->ip_len = htons(ntohs(ip->ip_len) - hlen); 945 mff = (ip->ip_off & htons(IP_MF)) != 0; 946 if (mff) { 947 /* 948 * Make sure that fragments have a data length 949 * that's a non-zero multiple of 8 bytes. 950 */ 951 if (ntohs(ip->ip_len) == 0 || 952 (ntohs(ip->ip_len) & 0x7) != 0) { 953 IP_STATINC(IP_STAT_BADFRAGS); 954 IPQ_UNLOCK(); 955 goto bad; 956 } 957 } 958 ip->ip_off = htons((ntohs(ip->ip_off) & IP_OFFMASK) << 3); 959 960 /* 961 * If datagram marked as having more fragments 962 * or if this is not the first fragment, 963 * attempt reassembly; if it succeeds, proceed. 964 */ 965 if (mff || ip->ip_off != htons(0)) { 966 IP_STATINC(IP_STAT_FRAGMENTS); 967 s = splvm(); 968 ipqe = pool_get(&ipqent_pool, PR_NOWAIT); 969 splx(s); 970 if (ipqe == NULL) { 971 IP_STATINC(IP_STAT_RCVMEMDROP); 972 IPQ_UNLOCK(); 973 goto bad; 974 } 975 ipqe->ipqe_mff = mff; 976 ipqe->ipqe_m = m; 977 ipqe->ipqe_ip = ip; 978 m = ip_reass(ipqe, fp, &ipq[hash]); 979 if (m == 0) { 980 IPQ_UNLOCK(); 981 return; 982 } 983 IP_STATINC(IP_STAT_REASSEMBLED); 984 ip = mtod(m, struct ip *); 985 hlen = ip->ip_hl << 2; 986 ip->ip_len = htons(ntohs(ip->ip_len) + hlen); 987 } else 988 if (fp) 989 ip_freef(fp); 990 IPQ_UNLOCK(); 991 } 992 993 #if defined(IPSEC) 994 /* 995 * enforce IPsec policy checking if we are seeing last header. 996 * note that we do not visit this with protocols with pcb layer 997 * code - like udp/tcp/raw ip. 998 */ 999 if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0 && 1000 ipsec4_in_reject(m, NULL)) { 1001 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); 1002 goto bad; 1003 } 1004 #endif 1005 #ifdef FAST_IPSEC 1006 /* 1007 * enforce IPsec policy checking if we are seeing last header. 1008 * note that we do not visit this with protocols with pcb layer 1009 * code - like udp/tcp/raw ip. 1010 */ 1011 if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0) { 1012 /* 1013 * Check if the packet has already had IPsec processing 1014 * done. If so, then just pass it along. This tag gets 1015 * set during AH, ESP, etc. input handling, before the 1016 * packet is returned to the ip input queue for delivery. 1017 */ 1018 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); 1019 s = splsoftnet(); 1020 if (mtag != NULL) { 1021 tdbi = (struct tdb_ident *)(mtag + 1); 1022 sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND); 1023 } else { 1024 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, 1025 IP_FORWARDING, &error); 1026 } 1027 if (sp != NULL) { 1028 /* 1029 * Check security policy against packet attributes. 1030 */ 1031 error = ipsec_in_reject(sp, m); 1032 KEY_FREESP(&sp); 1033 } else { 1034 /* XXX error stat??? */ 1035 error = EINVAL; 1036 DPRINTF(("ip_input: no SP, packet discarded\n"));/*XXX*/ 1037 } 1038 splx(s); 1039 if (error) 1040 goto bad; 1041 } 1042 #endif /* FAST_IPSEC */ 1043 1044 /* 1045 * Switch out to protocol's input routine. 1046 */ 1047 #if IFA_STATS 1048 if (ia && ip) 1049 ia->ia_ifa.ifa_data.ifad_inbytes += ntohs(ip->ip_len); 1050 #endif 1051 IP_STATINC(IP_STAT_DELIVERED); 1052 { 1053 int off = hlen, nh = ip->ip_p; 1054 1055 (*inetsw[ip_protox[nh]].pr_input)(m, off, nh); 1056 return; 1057 } 1058 bad: 1059 m_freem(m); 1060 return; 1061 1062 badcsum: 1063 IP_STATINC(IP_STAT_BADSUM); 1064 m_freem(m); 1065 } 1066 1067 /* 1068 * Take incoming datagram fragment and try to 1069 * reassemble it into whole datagram. If a chain for 1070 * reassembly of this datagram already exists, then it 1071 * is given as fp; otherwise have to make a chain. 1072 */ 1073 struct mbuf * 1074 ip_reass(struct ipqent *ipqe, struct ipq *fp, struct ipqhead *ipqhead) 1075 { 1076 struct mbuf *m = ipqe->ipqe_m; 1077 struct ipqent *nq, *p, *q; 1078 struct ip *ip; 1079 struct mbuf *t; 1080 int hlen = ipqe->ipqe_ip->ip_hl << 2; 1081 int i, next, s; 1082 1083 IPQ_LOCK_CHECK(); 1084 1085 /* 1086 * Presence of header sizes in mbufs 1087 * would confuse code below. 1088 */ 1089 m->m_data += hlen; 1090 m->m_len -= hlen; 1091 1092 #ifdef notyet 1093 /* make sure fragment limit is up-to-date */ 1094 CHECK_NMBCLUSTER_PARAMS(); 1095 1096 /* If we have too many fragments, drop the older half. */ 1097 if (ip_nfrags >= ip_maxfrags) 1098 ip_reass_drophalf(void); 1099 #endif 1100 1101 /* 1102 * We are about to add a fragment; increment frag count. 1103 */ 1104 ip_nfrags++; 1105 1106 /* 1107 * If first fragment to arrive, create a reassembly queue. 1108 */ 1109 if (fp == 0) { 1110 /* 1111 * Enforce upper bound on number of fragmented packets 1112 * for which we attempt reassembly; 1113 * If maxfrag is 0, never accept fragments. 1114 * If maxfrag is -1, accept all fragments without limitation. 1115 */ 1116 if (ip_maxfragpackets < 0) 1117 ; 1118 else if (ip_nfragpackets >= ip_maxfragpackets) 1119 goto dropfrag; 1120 ip_nfragpackets++; 1121 MALLOC(fp, struct ipq *, sizeof (struct ipq), 1122 M_FTABLE, M_NOWAIT); 1123 if (fp == NULL) 1124 goto dropfrag; 1125 LIST_INSERT_HEAD(ipqhead, fp, ipq_q); 1126 fp->ipq_nfrags = 1; 1127 fp->ipq_ttl = IPFRAGTTL; 1128 fp->ipq_p = ipqe->ipqe_ip->ip_p; 1129 fp->ipq_id = ipqe->ipqe_ip->ip_id; 1130 fp->ipq_tos = ipqe->ipqe_ip->ip_tos; 1131 TAILQ_INIT(&fp->ipq_fragq); 1132 fp->ipq_src = ipqe->ipqe_ip->ip_src; 1133 fp->ipq_dst = ipqe->ipqe_ip->ip_dst; 1134 p = NULL; 1135 goto insert; 1136 } else { 1137 fp->ipq_nfrags++; 1138 } 1139 1140 /* 1141 * Find a segment which begins after this one does. 1142 */ 1143 for (p = NULL, q = TAILQ_FIRST(&fp->ipq_fragq); q != NULL; 1144 p = q, q = TAILQ_NEXT(q, ipqe_q)) 1145 if (ntohs(q->ipqe_ip->ip_off) > ntohs(ipqe->ipqe_ip->ip_off)) 1146 break; 1147 1148 /* 1149 * If there is a preceding segment, it may provide some of 1150 * our data already. If so, drop the data from the incoming 1151 * segment. If it provides all of our data, drop us. 1152 */ 1153 if (p != NULL) { 1154 i = ntohs(p->ipqe_ip->ip_off) + ntohs(p->ipqe_ip->ip_len) - 1155 ntohs(ipqe->ipqe_ip->ip_off); 1156 if (i > 0) { 1157 if (i >= ntohs(ipqe->ipqe_ip->ip_len)) 1158 goto dropfrag; 1159 m_adj(ipqe->ipqe_m, i); 1160 ipqe->ipqe_ip->ip_off = 1161 htons(ntohs(ipqe->ipqe_ip->ip_off) + i); 1162 ipqe->ipqe_ip->ip_len = 1163 htons(ntohs(ipqe->ipqe_ip->ip_len) - i); 1164 } 1165 } 1166 1167 /* 1168 * While we overlap succeeding segments trim them or, 1169 * if they are completely covered, dequeue them. 1170 */ 1171 for (; q != NULL && 1172 ntohs(ipqe->ipqe_ip->ip_off) + ntohs(ipqe->ipqe_ip->ip_len) > 1173 ntohs(q->ipqe_ip->ip_off); q = nq) { 1174 i = (ntohs(ipqe->ipqe_ip->ip_off) + 1175 ntohs(ipqe->ipqe_ip->ip_len)) - ntohs(q->ipqe_ip->ip_off); 1176 if (i < ntohs(q->ipqe_ip->ip_len)) { 1177 q->ipqe_ip->ip_len = 1178 htons(ntohs(q->ipqe_ip->ip_len) - i); 1179 q->ipqe_ip->ip_off = 1180 htons(ntohs(q->ipqe_ip->ip_off) + i); 1181 m_adj(q->ipqe_m, i); 1182 break; 1183 } 1184 nq = TAILQ_NEXT(q, ipqe_q); 1185 m_freem(q->ipqe_m); 1186 TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q); 1187 s = splvm(); 1188 pool_put(&ipqent_pool, q); 1189 splx(s); 1190 fp->ipq_nfrags--; 1191 ip_nfrags--; 1192 } 1193 1194 insert: 1195 /* 1196 * Stick new segment in its place; 1197 * check for complete reassembly. 1198 */ 1199 if (p == NULL) { 1200 TAILQ_INSERT_HEAD(&fp->ipq_fragq, ipqe, ipqe_q); 1201 } else { 1202 TAILQ_INSERT_AFTER(&fp->ipq_fragq, p, ipqe, ipqe_q); 1203 } 1204 next = 0; 1205 for (p = NULL, q = TAILQ_FIRST(&fp->ipq_fragq); q != NULL; 1206 p = q, q = TAILQ_NEXT(q, ipqe_q)) { 1207 if (ntohs(q->ipqe_ip->ip_off) != next) 1208 return (0); 1209 next += ntohs(q->ipqe_ip->ip_len); 1210 } 1211 if (p->ipqe_mff) 1212 return (0); 1213 1214 /* 1215 * Reassembly is complete. Check for a bogus message size and 1216 * concatenate fragments. 1217 */ 1218 q = TAILQ_FIRST(&fp->ipq_fragq); 1219 ip = q->ipqe_ip; 1220 if ((next + (ip->ip_hl << 2)) > IP_MAXPACKET) { 1221 IP_STATINC(IP_STAT_TOOLONG); 1222 ip_freef(fp); 1223 return (0); 1224 } 1225 m = q->ipqe_m; 1226 t = m->m_next; 1227 m->m_next = 0; 1228 m_cat(m, t); 1229 nq = TAILQ_NEXT(q, ipqe_q); 1230 s = splvm(); 1231 pool_put(&ipqent_pool, q); 1232 splx(s); 1233 for (q = nq; q != NULL; q = nq) { 1234 t = q->ipqe_m; 1235 nq = TAILQ_NEXT(q, ipqe_q); 1236 s = splvm(); 1237 pool_put(&ipqent_pool, q); 1238 splx(s); 1239 m_cat(m, t); 1240 } 1241 ip_nfrags -= fp->ipq_nfrags; 1242 1243 /* 1244 * Create header for new ip packet by 1245 * modifying header of first packet; 1246 * dequeue and discard fragment reassembly header. 1247 * Make header visible. 1248 */ 1249 ip->ip_len = htons(next); 1250 ip->ip_src = fp->ipq_src; 1251 ip->ip_dst = fp->ipq_dst; 1252 LIST_REMOVE(fp, ipq_q); 1253 FREE(fp, M_FTABLE); 1254 ip_nfragpackets--; 1255 m->m_len += (ip->ip_hl << 2); 1256 m->m_data -= (ip->ip_hl << 2); 1257 /* some debugging cruft by sklower, below, will go away soon */ 1258 if (m->m_flags & M_PKTHDR) { /* XXX this should be done elsewhere */ 1259 int plen = 0; 1260 for (t = m; t; t = t->m_next) 1261 plen += t->m_len; 1262 m->m_pkthdr.len = plen; 1263 m->m_pkthdr.csum_flags = 0; 1264 } 1265 return (m); 1266 1267 dropfrag: 1268 if (fp != 0) 1269 fp->ipq_nfrags--; 1270 ip_nfrags--; 1271 IP_STATINC(IP_STAT_FRAGDROPPED); 1272 m_freem(m); 1273 s = splvm(); 1274 pool_put(&ipqent_pool, ipqe); 1275 splx(s); 1276 return (0); 1277 } 1278 1279 /* 1280 * Free a fragment reassembly header and all 1281 * associated datagrams. 1282 */ 1283 void 1284 ip_freef(struct ipq *fp) 1285 { 1286 struct ipqent *q, *p; 1287 u_int nfrags = 0; 1288 int s; 1289 1290 IPQ_LOCK_CHECK(); 1291 1292 for (q = TAILQ_FIRST(&fp->ipq_fragq); q != NULL; q = p) { 1293 p = TAILQ_NEXT(q, ipqe_q); 1294 m_freem(q->ipqe_m); 1295 nfrags++; 1296 TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q); 1297 s = splvm(); 1298 pool_put(&ipqent_pool, q); 1299 splx(s); 1300 } 1301 1302 if (nfrags != fp->ipq_nfrags) 1303 printf("ip_freef: nfrags %d != %d\n", fp->ipq_nfrags, nfrags); 1304 ip_nfrags -= nfrags; 1305 LIST_REMOVE(fp, ipq_q); 1306 FREE(fp, M_FTABLE); 1307 ip_nfragpackets--; 1308 } 1309 1310 /* 1311 * IP reassembly TTL machinery for multiplicative drop. 1312 */ 1313 static u_int fragttl_histo[(IPFRAGTTL+1)]; 1314 1315 1316 /* 1317 * Decrement TTL of all reasembly queue entries by `ticks'. 1318 * Count number of distinct fragments (as opposed to partial, fragmented 1319 * datagrams) in the reassembly queue. While we traverse the entire 1320 * reassembly queue, compute and return the median TTL over all fragments. 1321 */ 1322 static u_int 1323 ip_reass_ttl_decr(u_int ticks) 1324 { 1325 u_int nfrags, median, dropfraction, keepfraction; 1326 struct ipq *fp, *nfp; 1327 int i; 1328 1329 nfrags = 0; 1330 memset(fragttl_histo, 0, sizeof fragttl_histo); 1331 1332 for (i = 0; i < IPREASS_NHASH; i++) { 1333 for (fp = LIST_FIRST(&ipq[i]); fp != NULL; fp = nfp) { 1334 fp->ipq_ttl = ((fp->ipq_ttl <= ticks) ? 1335 0 : fp->ipq_ttl - ticks); 1336 nfp = LIST_NEXT(fp, ipq_q); 1337 if (fp->ipq_ttl == 0) { 1338 IP_STATINC(IP_STAT_FRAGTIMEOUT); 1339 ip_freef(fp); 1340 } else { 1341 nfrags += fp->ipq_nfrags; 1342 fragttl_histo[fp->ipq_ttl] += fp->ipq_nfrags; 1343 } 1344 } 1345 } 1346 1347 KASSERT(ip_nfrags == nfrags); 1348 1349 /* Find median (or other drop fraction) in histogram. */ 1350 dropfraction = (ip_nfrags / 2); 1351 keepfraction = ip_nfrags - dropfraction; 1352 for (i = IPFRAGTTL, median = 0; i >= 0; i--) { 1353 median += fragttl_histo[i]; 1354 if (median >= keepfraction) 1355 break; 1356 } 1357 1358 /* Return TTL of median (or other fraction). */ 1359 return (u_int)i; 1360 } 1361 1362 void 1363 ip_reass_drophalf(void) 1364 { 1365 1366 u_int median_ticks; 1367 /* 1368 * Compute median TTL of all fragments, and count frags 1369 * with that TTL or lower (roughly half of all fragments). 1370 */ 1371 median_ticks = ip_reass_ttl_decr(0); 1372 1373 /* Drop half. */ 1374 median_ticks = ip_reass_ttl_decr(median_ticks); 1375 1376 } 1377 1378 /* 1379 * IP timer processing; 1380 * if a timer expires on a reassembly 1381 * queue, discard it. 1382 */ 1383 void 1384 ip_slowtimo(void) 1385 { 1386 static u_int dropscanidx = 0; 1387 u_int i; 1388 u_int median_ttl; 1389 1390 mutex_enter(softnet_lock); 1391 KERNEL_LOCK(1, NULL); 1392 1393 IPQ_LOCK(); 1394 1395 /* Age TTL of all fragments by 1 tick .*/ 1396 median_ttl = ip_reass_ttl_decr(1); 1397 1398 /* make sure fragment limit is up-to-date */ 1399 CHECK_NMBCLUSTER_PARAMS(); 1400 1401 /* If we have too many fragments, drop the older half. */ 1402 if (ip_nfrags > ip_maxfrags) 1403 ip_reass_ttl_decr(median_ttl); 1404 1405 /* 1406 * If we are over the maximum number of fragmented packets 1407 * (due to the limit being lowered), drain off 1408 * enough to get down to the new limit. Start draining 1409 * from the reassembly hashqueue most recently drained. 1410 */ 1411 if (ip_maxfragpackets < 0) 1412 ; 1413 else { 1414 int wrapped = 0; 1415 1416 i = dropscanidx; 1417 while (ip_nfragpackets > ip_maxfragpackets && wrapped == 0) { 1418 while (LIST_FIRST(&ipq[i]) != NULL) 1419 ip_freef(LIST_FIRST(&ipq[i])); 1420 if (++i >= IPREASS_NHASH) { 1421 i = 0; 1422 } 1423 /* 1424 * Dont scan forever even if fragment counters are 1425 * wrong: stop after scanning entire reassembly queue. 1426 */ 1427 if (i == dropscanidx) 1428 wrapped = 1; 1429 } 1430 dropscanidx = i; 1431 } 1432 IPQ_UNLOCK(); 1433 1434 KERNEL_UNLOCK_ONE(NULL); 1435 mutex_exit(softnet_lock); 1436 } 1437 1438 /* 1439 * Drain off all datagram fragments. Don't acquire softnet_lock as 1440 * can be called from hardware interrupt context. 1441 */ 1442 void 1443 ip_drain(void) 1444 { 1445 1446 KERNEL_LOCK(1, NULL); 1447 1448 /* 1449 * We may be called from a device's interrupt context. If 1450 * the ipq is already busy, just bail out now. 1451 */ 1452 if (ipq_lock_try() != 0) { 1453 /* 1454 * Drop half the total fragments now. If more mbufs are 1455 * needed, we will be called again soon. 1456 */ 1457 ip_reass_drophalf(); 1458 IPQ_UNLOCK(); 1459 } 1460 1461 KERNEL_UNLOCK_ONE(NULL); 1462 } 1463 1464 /* 1465 * Do option processing on a datagram, 1466 * possibly discarding it if bad options are encountered, 1467 * or forwarding it if source-routed. 1468 * Returns 1 if packet has been forwarded/freed, 1469 * 0 if the packet should be processed further. 1470 */ 1471 int 1472 ip_dooptions(struct mbuf *m) 1473 { 1474 struct ip *ip = mtod(m, struct ip *); 1475 u_char *cp, *cp0; 1476 struct ip_timestamp *ipt; 1477 struct in_ifaddr *ia; 1478 int opt, optlen, cnt, off, code, type = ICMP_PARAMPROB, forward = 0; 1479 struct in_addr dst; 1480 n_time ntime; 1481 1482 dst = ip->ip_dst; 1483 cp = (u_char *)(ip + 1); 1484 cnt = (ip->ip_hl << 2) - sizeof (struct ip); 1485 for (; cnt > 0; cnt -= optlen, cp += optlen) { 1486 opt = cp[IPOPT_OPTVAL]; 1487 if (opt == IPOPT_EOL) 1488 break; 1489 if (opt == IPOPT_NOP) 1490 optlen = 1; 1491 else { 1492 if (cnt < IPOPT_OLEN + sizeof(*cp)) { 1493 code = &cp[IPOPT_OLEN] - (u_char *)ip; 1494 goto bad; 1495 } 1496 optlen = cp[IPOPT_OLEN]; 1497 if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) { 1498 code = &cp[IPOPT_OLEN] - (u_char *)ip; 1499 goto bad; 1500 } 1501 } 1502 switch (opt) { 1503 1504 default: 1505 break; 1506 1507 /* 1508 * Source routing with record. 1509 * Find interface with current destination address. 1510 * If none on this machine then drop if strictly routed, 1511 * or do nothing if loosely routed. 1512 * Record interface address and bring up next address 1513 * component. If strictly routed make sure next 1514 * address is on directly accessible net. 1515 */ 1516 case IPOPT_LSRR: 1517 case IPOPT_SSRR: 1518 if (ip_allowsrcrt == 0) { 1519 type = ICMP_UNREACH; 1520 code = ICMP_UNREACH_NET_PROHIB; 1521 goto bad; 1522 } 1523 if (optlen < IPOPT_OFFSET + sizeof(*cp)) { 1524 code = &cp[IPOPT_OLEN] - (u_char *)ip; 1525 goto bad; 1526 } 1527 if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) { 1528 code = &cp[IPOPT_OFFSET] - (u_char *)ip; 1529 goto bad; 1530 } 1531 ipaddr.sin_addr = ip->ip_dst; 1532 ia = ifatoia(ifa_ifwithaddr(sintosa(&ipaddr))); 1533 if (ia == 0) { 1534 if (opt == IPOPT_SSRR) { 1535 type = ICMP_UNREACH; 1536 code = ICMP_UNREACH_SRCFAIL; 1537 goto bad; 1538 } 1539 /* 1540 * Loose routing, and not at next destination 1541 * yet; nothing to do except forward. 1542 */ 1543 break; 1544 } 1545 off--; /* 0 origin */ 1546 if ((off + sizeof(struct in_addr)) > optlen) { 1547 /* 1548 * End of source route. Should be for us. 1549 */ 1550 save_rte(cp, ip->ip_src); 1551 break; 1552 } 1553 /* 1554 * locate outgoing interface 1555 */ 1556 bcopy((void *)(cp + off), (void *)&ipaddr.sin_addr, 1557 sizeof(ipaddr.sin_addr)); 1558 if (opt == IPOPT_SSRR) 1559 ia = ifatoia(ifa_ifwithladdr(sintosa(&ipaddr))); 1560 else 1561 ia = ip_rtaddr(ipaddr.sin_addr); 1562 if (ia == 0) { 1563 type = ICMP_UNREACH; 1564 code = ICMP_UNREACH_SRCFAIL; 1565 goto bad; 1566 } 1567 ip->ip_dst = ipaddr.sin_addr; 1568 bcopy((void *)&ia->ia_addr.sin_addr, 1569 (void *)(cp + off), sizeof(struct in_addr)); 1570 cp[IPOPT_OFFSET] += sizeof(struct in_addr); 1571 /* 1572 * Let ip_intr's mcast routing check handle mcast pkts 1573 */ 1574 forward = !IN_MULTICAST(ip->ip_dst.s_addr); 1575 break; 1576 1577 case IPOPT_RR: 1578 if (optlen < IPOPT_OFFSET + sizeof(*cp)) { 1579 code = &cp[IPOPT_OLEN] - (u_char *)ip; 1580 goto bad; 1581 } 1582 if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) { 1583 code = &cp[IPOPT_OFFSET] - (u_char *)ip; 1584 goto bad; 1585 } 1586 /* 1587 * If no space remains, ignore. 1588 */ 1589 off--; /* 0 origin */ 1590 if ((off + sizeof(struct in_addr)) > optlen) 1591 break; 1592 bcopy((void *)(&ip->ip_dst), (void *)&ipaddr.sin_addr, 1593 sizeof(ipaddr.sin_addr)); 1594 /* 1595 * locate outgoing interface; if we're the destination, 1596 * use the incoming interface (should be same). 1597 */ 1598 if ((ia = ifatoia(ifa_ifwithaddr(sintosa(&ipaddr)))) 1599 == NULL && 1600 (ia = ip_rtaddr(ipaddr.sin_addr)) == NULL) { 1601 type = ICMP_UNREACH; 1602 code = ICMP_UNREACH_HOST; 1603 goto bad; 1604 } 1605 bcopy((void *)&ia->ia_addr.sin_addr, 1606 (void *)(cp + off), sizeof(struct in_addr)); 1607 cp[IPOPT_OFFSET] += sizeof(struct in_addr); 1608 break; 1609 1610 case IPOPT_TS: 1611 code = cp - (u_char *)ip; 1612 ipt = (struct ip_timestamp *)cp; 1613 if (ipt->ipt_len < 4 || ipt->ipt_len > 40) { 1614 code = (u_char *)&ipt->ipt_len - (u_char *)ip; 1615 goto bad; 1616 } 1617 if (ipt->ipt_ptr < 5) { 1618 code = (u_char *)&ipt->ipt_ptr - (u_char *)ip; 1619 goto bad; 1620 } 1621 if (ipt->ipt_ptr > ipt->ipt_len - sizeof (int32_t)) { 1622 if (++ipt->ipt_oflw == 0) { 1623 code = (u_char *)&ipt->ipt_ptr - 1624 (u_char *)ip; 1625 goto bad; 1626 } 1627 break; 1628 } 1629 cp0 = (cp + ipt->ipt_ptr - 1); 1630 switch (ipt->ipt_flg) { 1631 1632 case IPOPT_TS_TSONLY: 1633 break; 1634 1635 case IPOPT_TS_TSANDADDR: 1636 if (ipt->ipt_ptr - 1 + sizeof(n_time) + 1637 sizeof(struct in_addr) > ipt->ipt_len) { 1638 code = (u_char *)&ipt->ipt_ptr - 1639 (u_char *)ip; 1640 goto bad; 1641 } 1642 ipaddr.sin_addr = dst; 1643 ia = ifatoia(ifaof_ifpforaddr(sintosa(&ipaddr), 1644 m->m_pkthdr.rcvif)); 1645 if (ia == 0) 1646 continue; 1647 bcopy(&ia->ia_addr.sin_addr, 1648 cp0, sizeof(struct in_addr)); 1649 ipt->ipt_ptr += sizeof(struct in_addr); 1650 break; 1651 1652 case IPOPT_TS_PRESPEC: 1653 if (ipt->ipt_ptr - 1 + sizeof(n_time) + 1654 sizeof(struct in_addr) > ipt->ipt_len) { 1655 code = (u_char *)&ipt->ipt_ptr - 1656 (u_char *)ip; 1657 goto bad; 1658 } 1659 bcopy(cp0, &ipaddr.sin_addr, 1660 sizeof(struct in_addr)); 1661 if (ifatoia(ifa_ifwithaddr(sintosa(&ipaddr))) 1662 == NULL) 1663 continue; 1664 ipt->ipt_ptr += sizeof(struct in_addr); 1665 break; 1666 1667 default: 1668 /* XXX can't take &ipt->ipt_flg */ 1669 code = (u_char *)&ipt->ipt_ptr - 1670 (u_char *)ip + 1; 1671 goto bad; 1672 } 1673 ntime = iptime(); 1674 cp0 = (u_char *) &ntime; /* XXX grumble, GCC... */ 1675 memmove((char *)cp + ipt->ipt_ptr - 1, cp0, 1676 sizeof(n_time)); 1677 ipt->ipt_ptr += sizeof(n_time); 1678 } 1679 } 1680 if (forward) { 1681 if (ip_forwsrcrt == 0) { 1682 type = ICMP_UNREACH; 1683 code = ICMP_UNREACH_SRCFAIL; 1684 goto bad; 1685 } 1686 ip_forward(m, 1); 1687 return (1); 1688 } 1689 return (0); 1690 bad: 1691 icmp_error(m, type, code, 0, 0); 1692 IP_STATINC(IP_STAT_BADOPTIONS); 1693 return (1); 1694 } 1695 1696 /* 1697 * Given address of next destination (final or next hop), 1698 * return internet address info of interface to be used to get there. 1699 */ 1700 struct in_ifaddr * 1701 ip_rtaddr(struct in_addr dst) 1702 { 1703 struct rtentry *rt; 1704 union { 1705 struct sockaddr dst; 1706 struct sockaddr_in dst4; 1707 } u; 1708 1709 sockaddr_in_init(&u.dst4, &dst, 0); 1710 1711 if ((rt = rtcache_lookup(&ipforward_rt, &u.dst)) == NULL) 1712 return NULL; 1713 1714 return ifatoia(rt->rt_ifa); 1715 } 1716 1717 /* 1718 * Save incoming source route for use in replies, 1719 * to be picked up later by ip_srcroute if the receiver is interested. 1720 */ 1721 void 1722 save_rte(u_char *option, struct in_addr dst) 1723 { 1724 unsigned olen; 1725 1726 olen = option[IPOPT_OLEN]; 1727 #ifdef DIAGNOSTIC 1728 if (ipprintfs) 1729 printf("save_rte: olen %d\n", olen); 1730 #endif /* 0 */ 1731 if (olen > sizeof(ip_srcrt) - (1 + sizeof(dst))) 1732 return; 1733 bcopy((void *)option, (void *)ip_srcrt.srcopt, olen); 1734 ip_nhops = (olen - IPOPT_OFFSET - 1) / sizeof(struct in_addr); 1735 ip_srcrt.dst = dst; 1736 } 1737 1738 /* 1739 * Retrieve incoming source route for use in replies, 1740 * in the same form used by setsockopt. 1741 * The first hop is placed before the options, will be removed later. 1742 */ 1743 struct mbuf * 1744 ip_srcroute(void) 1745 { 1746 struct in_addr *p, *q; 1747 struct mbuf *m; 1748 1749 if (ip_nhops == 0) 1750 return NULL; 1751 m = m_get(M_DONTWAIT, MT_SOOPTS); 1752 if (m == 0) 1753 return NULL; 1754 1755 MCLAIM(m, &inetdomain.dom_mowner); 1756 #define OPTSIZ (sizeof(ip_srcrt.nop) + sizeof(ip_srcrt.srcopt)) 1757 1758 /* length is (nhops+1)*sizeof(addr) + sizeof(nop + srcrt header) */ 1759 m->m_len = ip_nhops * sizeof(struct in_addr) + sizeof(struct in_addr) + 1760 OPTSIZ; 1761 #ifdef DIAGNOSTIC 1762 if (ipprintfs) 1763 printf("ip_srcroute: nhops %d mlen %d", ip_nhops, m->m_len); 1764 #endif 1765 1766 /* 1767 * First save first hop for return route 1768 */ 1769 p = &ip_srcrt.route[ip_nhops - 1]; 1770 *(mtod(m, struct in_addr *)) = *p--; 1771 #ifdef DIAGNOSTIC 1772 if (ipprintfs) 1773 printf(" hops %x", ntohl(mtod(m, struct in_addr *)->s_addr)); 1774 #endif 1775 1776 /* 1777 * Copy option fields and padding (nop) to mbuf. 1778 */ 1779 ip_srcrt.nop = IPOPT_NOP; 1780 ip_srcrt.srcopt[IPOPT_OFFSET] = IPOPT_MINOFF; 1781 memmove(mtod(m, char *) + sizeof(struct in_addr), &ip_srcrt.nop, 1782 OPTSIZ); 1783 q = (struct in_addr *)(mtod(m, char *) + 1784 sizeof(struct in_addr) + OPTSIZ); 1785 #undef OPTSIZ 1786 /* 1787 * Record return path as an IP source route, 1788 * reversing the path (pointers are now aligned). 1789 */ 1790 while (p >= ip_srcrt.route) { 1791 #ifdef DIAGNOSTIC 1792 if (ipprintfs) 1793 printf(" %x", ntohl(q->s_addr)); 1794 #endif 1795 *q++ = *p--; 1796 } 1797 /* 1798 * Last hop goes to final destination. 1799 */ 1800 *q = ip_srcrt.dst; 1801 #ifdef DIAGNOSTIC 1802 if (ipprintfs) 1803 printf(" %x\n", ntohl(q->s_addr)); 1804 #endif 1805 return (m); 1806 } 1807 1808 const int inetctlerrmap[PRC_NCMDS] = { 1809 [PRC_MSGSIZE] = EMSGSIZE, 1810 [PRC_HOSTDEAD] = EHOSTDOWN, 1811 [PRC_HOSTUNREACH] = EHOSTUNREACH, 1812 [PRC_UNREACH_NET] = EHOSTUNREACH, 1813 [PRC_UNREACH_HOST] = EHOSTUNREACH, 1814 [PRC_UNREACH_PROTOCOL] = ECONNREFUSED, 1815 [PRC_UNREACH_PORT] = ECONNREFUSED, 1816 [PRC_UNREACH_SRCFAIL] = EHOSTUNREACH, 1817 [PRC_PARAMPROB] = ENOPROTOOPT, 1818 }; 1819 1820 /* 1821 * Forward a packet. If some error occurs return the sender 1822 * an icmp packet. Note we can't always generate a meaningful 1823 * icmp message because icmp doesn't have a large enough repertoire 1824 * of codes and types. 1825 * 1826 * If not forwarding, just drop the packet. This could be confusing 1827 * if ipforwarding was zero but some routing protocol was advancing 1828 * us as a gateway to somewhere. However, we must let the routing 1829 * protocol deal with that. 1830 * 1831 * The srcrt parameter indicates whether the packet is being forwarded 1832 * via a source route. 1833 */ 1834 void 1835 ip_forward(struct mbuf *m, int srcrt) 1836 { 1837 struct ip *ip = mtod(m, struct ip *); 1838 struct rtentry *rt; 1839 int error, type = 0, code = 0, destmtu = 0; 1840 struct mbuf *mcopy; 1841 n_long dest; 1842 union { 1843 struct sockaddr dst; 1844 struct sockaddr_in dst4; 1845 } u; 1846 1847 /* 1848 * We are now in the output path. 1849 */ 1850 MCLAIM(m, &ip_tx_mowner); 1851 1852 /* 1853 * Clear any in-bound checksum flags for this packet. 1854 */ 1855 m->m_pkthdr.csum_flags = 0; 1856 1857 dest = 0; 1858 #ifdef DIAGNOSTIC 1859 if (ipprintfs) { 1860 printf("forward: src %s ", inet_ntoa(ip->ip_src)); 1861 printf("dst %s ttl %x\n", inet_ntoa(ip->ip_dst), ip->ip_ttl); 1862 } 1863 #endif 1864 if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(ip->ip_dst) == 0) { 1865 IP_STATINC(IP_STAT_CANTFORWARD); 1866 m_freem(m); 1867 return; 1868 } 1869 if (ip->ip_ttl <= IPTTLDEC) { 1870 icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, dest, 0); 1871 return; 1872 } 1873 1874 sockaddr_in_init(&u.dst4, &ip->ip_dst, 0); 1875 if ((rt = rtcache_lookup(&ipforward_rt, &u.dst)) == NULL) { 1876 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_NET, dest, 0); 1877 return; 1878 } 1879 1880 /* 1881 * Save at most 68 bytes of the packet in case 1882 * we need to generate an ICMP message to the src. 1883 * Pullup to avoid sharing mbuf cluster between m and mcopy. 1884 */ 1885 mcopy = m_copym(m, 0, imin(ntohs(ip->ip_len), 68), M_DONTWAIT); 1886 if (mcopy) 1887 mcopy = m_pullup(mcopy, ip->ip_hl << 2); 1888 1889 ip->ip_ttl -= IPTTLDEC; 1890 1891 /* 1892 * If forwarding packet using same interface that it came in on, 1893 * perhaps should send a redirect to sender to shortcut a hop. 1894 * Only send redirect if source is sending directly to us, 1895 * and if packet was not source routed (or has any options). 1896 * Also, don't send redirect if forwarding using a default route 1897 * or a route modified by a redirect. 1898 */ 1899 if (rt->rt_ifp == m->m_pkthdr.rcvif && 1900 (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0 && 1901 !in_nullhost(satocsin(rt_getkey(rt))->sin_addr) && 1902 ipsendredirects && !srcrt) { 1903 if (rt->rt_ifa && 1904 (ip->ip_src.s_addr & ifatoia(rt->rt_ifa)->ia_subnetmask) == 1905 ifatoia(rt->rt_ifa)->ia_subnet) { 1906 if (rt->rt_flags & RTF_GATEWAY) 1907 dest = satosin(rt->rt_gateway)->sin_addr.s_addr; 1908 else 1909 dest = ip->ip_dst.s_addr; 1910 /* 1911 * Router requirements says to only send host 1912 * redirects. 1913 */ 1914 type = ICMP_REDIRECT; 1915 code = ICMP_REDIRECT_HOST; 1916 #ifdef DIAGNOSTIC 1917 if (ipprintfs) 1918 printf("redirect (%d) to %x\n", code, 1919 (u_int32_t)dest); 1920 #endif 1921 } 1922 } 1923 1924 error = ip_output(m, NULL, &ipforward_rt, 1925 (IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)), 1926 (struct ip_moptions *)NULL, (struct socket *)NULL); 1927 1928 if (error) 1929 IP_STATINC(IP_STAT_CANTFORWARD); 1930 else { 1931 uint64_t *ips = IP_STAT_GETREF(); 1932 ips[IP_STAT_FORWARD]++; 1933 if (type) { 1934 ips[IP_STAT_REDIRECTSENT]++; 1935 IP_STAT_PUTREF(); 1936 } else { 1937 IP_STAT_PUTREF(); 1938 if (mcopy) { 1939 #ifdef GATEWAY 1940 if (mcopy->m_flags & M_CANFASTFWD) 1941 ipflow_create(&ipforward_rt, mcopy); 1942 #endif 1943 m_freem(mcopy); 1944 } 1945 return; 1946 } 1947 } 1948 if (mcopy == NULL) 1949 return; 1950 1951 switch (error) { 1952 1953 case 0: /* forwarded, but need redirect */ 1954 /* type, code set above */ 1955 break; 1956 1957 case ENETUNREACH: /* shouldn't happen, checked above */ 1958 case EHOSTUNREACH: 1959 case ENETDOWN: 1960 case EHOSTDOWN: 1961 default: 1962 type = ICMP_UNREACH; 1963 code = ICMP_UNREACH_HOST; 1964 break; 1965 1966 case EMSGSIZE: 1967 type = ICMP_UNREACH; 1968 code = ICMP_UNREACH_NEEDFRAG; 1969 1970 if ((rt = rtcache_validate(&ipforward_rt)) != NULL) { 1971 1972 #if defined(IPSEC) || defined(FAST_IPSEC) 1973 /* 1974 * If the packet is routed over IPsec tunnel, tell the 1975 * originator the tunnel MTU. 1976 * tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz 1977 * XXX quickhack!!! 1978 */ 1979 1980 struct secpolicy *sp; 1981 int ipsecerror; 1982 size_t ipsechdr; 1983 struct route *ro; 1984 1985 sp = ipsec4_getpolicybyaddr(mcopy, 1986 IPSEC_DIR_OUTBOUND, IP_FORWARDING, 1987 &ipsecerror); 1988 #endif 1989 1990 destmtu = rt->rt_ifp->if_mtu; 1991 #if defined(IPSEC) || defined(FAST_IPSEC) 1992 if (sp != NULL) { 1993 /* count IPsec header size */ 1994 ipsechdr = ipsec4_hdrsiz(mcopy, 1995 IPSEC_DIR_OUTBOUND, NULL); 1996 1997 /* 1998 * find the correct route for outer IPv4 1999 * header, compute tunnel MTU. 2000 */ 2001 2002 if (sp->req != NULL 2003 && sp->req->sav != NULL 2004 && sp->req->sav->sah != NULL) { 2005 ro = &sp->req->sav->sah->sa_route; 2006 if (rt && rt->rt_ifp) { 2007 destmtu = 2008 rt->rt_rmx.rmx_mtu ? 2009 rt->rt_rmx.rmx_mtu : 2010 rt->rt_ifp->if_mtu; 2011 destmtu -= ipsechdr; 2012 } 2013 } 2014 2015 #ifdef IPSEC 2016 key_freesp(sp); 2017 #else 2018 KEY_FREESP(&sp); 2019 #endif 2020 } 2021 #endif /*defined(IPSEC) || defined(FAST_IPSEC)*/ 2022 } 2023 IP_STATINC(IP_STAT_CANTFRAG); 2024 break; 2025 2026 case ENOBUFS: 2027 #if 1 2028 /* 2029 * a router should not generate ICMP_SOURCEQUENCH as 2030 * required in RFC1812 Requirements for IP Version 4 Routers. 2031 * source quench could be a big problem under DoS attacks, 2032 * or if the underlying interface is rate-limited. 2033 */ 2034 if (mcopy) 2035 m_freem(mcopy); 2036 return; 2037 #else 2038 type = ICMP_SOURCEQUENCH; 2039 code = 0; 2040 break; 2041 #endif 2042 } 2043 icmp_error(mcopy, type, code, dest, destmtu); 2044 } 2045 2046 void 2047 ip_savecontrol(struct inpcb *inp, struct mbuf **mp, struct ip *ip, 2048 struct mbuf *m) 2049 { 2050 2051 if (inp->inp_socket->so_options & SO_TIMESTAMP) { 2052 struct timeval tv; 2053 2054 microtime(&tv); 2055 *mp = sbcreatecontrol((void *) &tv, sizeof(tv), 2056 SCM_TIMESTAMP, SOL_SOCKET); 2057 if (*mp) 2058 mp = &(*mp)->m_next; 2059 } 2060 if (inp->inp_flags & INP_RECVDSTADDR) { 2061 *mp = sbcreatecontrol((void *) &ip->ip_dst, 2062 sizeof(struct in_addr), IP_RECVDSTADDR, IPPROTO_IP); 2063 if (*mp) 2064 mp = &(*mp)->m_next; 2065 } 2066 #ifdef notyet 2067 /* 2068 * XXX 2069 * Moving these out of udp_input() made them even more broken 2070 * than they already were. 2071 * - fenner@parc.xerox.com 2072 */ 2073 /* options were tossed already */ 2074 if (inp->inp_flags & INP_RECVOPTS) { 2075 *mp = sbcreatecontrol((void *) opts_deleted_above, 2076 sizeof(struct in_addr), IP_RECVOPTS, IPPROTO_IP); 2077 if (*mp) 2078 mp = &(*mp)->m_next; 2079 } 2080 /* ip_srcroute doesn't do what we want here, need to fix */ 2081 if (inp->inp_flags & INP_RECVRETOPTS) { 2082 *mp = sbcreatecontrol((void *) ip_srcroute(), 2083 sizeof(struct in_addr), IP_RECVRETOPTS, IPPROTO_IP); 2084 if (*mp) 2085 mp = &(*mp)->m_next; 2086 } 2087 #endif 2088 if (inp->inp_flags & INP_RECVIF) { 2089 struct sockaddr_dl sdl; 2090 2091 sockaddr_dl_init(&sdl, sizeof(sdl), 2092 (m->m_pkthdr.rcvif != NULL) 2093 ? m->m_pkthdr.rcvif->if_index 2094 : 0, 2095 0, NULL, 0, NULL, 0); 2096 *mp = sbcreatecontrol(&sdl, sdl.sdl_len, IP_RECVIF, IPPROTO_IP); 2097 if (*mp) 2098 mp = &(*mp)->m_next; 2099 } 2100 } 2101 2102 /* 2103 * sysctl helper routine for net.inet.ip.forwsrcrt. 2104 */ 2105 static int 2106 sysctl_net_inet_ip_forwsrcrt(SYSCTLFN_ARGS) 2107 { 2108 int error, tmp; 2109 struct sysctlnode node; 2110 2111 node = *rnode; 2112 tmp = ip_forwsrcrt; 2113 node.sysctl_data = &tmp; 2114 error = sysctl_lookup(SYSCTLFN_CALL(&node)); 2115 if (error || newp == NULL) 2116 return (error); 2117 2118 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FORWSRCRT, 2119 0, NULL, NULL, NULL)) 2120 return (EPERM); 2121 2122 ip_forwsrcrt = tmp; 2123 2124 return (0); 2125 } 2126 2127 /* 2128 * sysctl helper routine for net.inet.ip.mtudisctimeout. checks the 2129 * range of the new value and tweaks timers if it changes. 2130 */ 2131 static int 2132 sysctl_net_inet_ip_pmtudto(SYSCTLFN_ARGS) 2133 { 2134 int error, tmp; 2135 struct sysctlnode node; 2136 2137 node = *rnode; 2138 tmp = ip_mtudisc_timeout; 2139 node.sysctl_data = &tmp; 2140 error = sysctl_lookup(SYSCTLFN_CALL(&node)); 2141 if (error || newp == NULL) 2142 return (error); 2143 if (tmp < 0) 2144 return (EINVAL); 2145 2146 ip_mtudisc_timeout = tmp; 2147 rt_timer_queue_change(ip_mtudisc_timeout_q, ip_mtudisc_timeout); 2148 2149 return (0); 2150 } 2151 2152 #ifdef GATEWAY 2153 /* 2154 * sysctl helper routine for net.inet.ip.maxflows. 2155 */ 2156 static int 2157 sysctl_net_inet_ip_maxflows(SYSCTLFN_ARGS) 2158 { 2159 int s; 2160 2161 s = sysctl_lookup(SYSCTLFN_CALL(rnode)); 2162 if (s || newp == NULL) 2163 return (s); 2164 2165 s = splsoftnet(); 2166 ipflow_prune(); 2167 splx(s); 2168 2169 return (0); 2170 } 2171 2172 static int 2173 sysctl_net_inet_ip_hashsize(SYSCTLFN_ARGS) 2174 { 2175 int error, tmp; 2176 struct sysctlnode node; 2177 2178 node = *rnode; 2179 tmp = ip_hashsize; 2180 node.sysctl_data = &tmp; 2181 error = sysctl_lookup(SYSCTLFN_CALL(&node)); 2182 if (error || newp == NULL) 2183 return (error); 2184 2185 if ((tmp & (tmp - 1)) == 0 && tmp != 0) { 2186 /* 2187 * Can only fail due to malloc() 2188 */ 2189 if (ipflow_invalidate_all(tmp)) 2190 return ENOMEM; 2191 } else { 2192 /* 2193 * EINVAL if not a power of 2 2194 */ 2195 return EINVAL; 2196 } 2197 2198 return (0); 2199 } 2200 #endif /* GATEWAY */ 2201 2202 static int 2203 sysctl_net_inet_ip_stats(SYSCTLFN_ARGS) 2204 { 2205 2206 return (NETSTAT_SYSCTL(ipstat_percpu, IP_NSTATS)); 2207 } 2208 2209 SYSCTL_SETUP(sysctl_net_inet_ip_setup, "sysctl net.inet.ip subtree setup") 2210 { 2211 extern int subnetsarelocal, hostzeroisbroadcast; 2212 2213 sysctl_createv(clog, 0, NULL, NULL, 2214 CTLFLAG_PERMANENT, 2215 CTLTYPE_NODE, "net", NULL, 2216 NULL, 0, NULL, 0, 2217 CTL_NET, CTL_EOL); 2218 sysctl_createv(clog, 0, NULL, NULL, 2219 CTLFLAG_PERMANENT, 2220 CTLTYPE_NODE, "inet", 2221 SYSCTL_DESCR("PF_INET related settings"), 2222 NULL, 0, NULL, 0, 2223 CTL_NET, PF_INET, CTL_EOL); 2224 sysctl_createv(clog, 0, NULL, NULL, 2225 CTLFLAG_PERMANENT, 2226 CTLTYPE_NODE, "ip", 2227 SYSCTL_DESCR("IPv4 related settings"), 2228 NULL, 0, NULL, 0, 2229 CTL_NET, PF_INET, IPPROTO_IP, CTL_EOL); 2230 2231 sysctl_createv(clog, 0, NULL, NULL, 2232 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2233 CTLTYPE_INT, "forwarding", 2234 SYSCTL_DESCR("Enable forwarding of INET datagrams"), 2235 NULL, 0, &ipforwarding, 0, 2236 CTL_NET, PF_INET, IPPROTO_IP, 2237 IPCTL_FORWARDING, CTL_EOL); 2238 sysctl_createv(clog, 0, NULL, NULL, 2239 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2240 CTLTYPE_INT, "redirect", 2241 SYSCTL_DESCR("Enable sending of ICMP redirect messages"), 2242 NULL, 0, &ipsendredirects, 0, 2243 CTL_NET, PF_INET, IPPROTO_IP, 2244 IPCTL_SENDREDIRECTS, CTL_EOL); 2245 sysctl_createv(clog, 0, NULL, NULL, 2246 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2247 CTLTYPE_INT, "ttl", 2248 SYSCTL_DESCR("Default TTL for an INET datagram"), 2249 NULL, 0, &ip_defttl, 0, 2250 CTL_NET, PF_INET, IPPROTO_IP, 2251 IPCTL_DEFTTL, CTL_EOL); 2252 #ifdef IPCTL_DEFMTU 2253 sysctl_createv(clog, 0, NULL, NULL, 2254 CTLFLAG_PERMANENT /* |CTLFLAG_READWRITE? */, 2255 CTLTYPE_INT, "mtu", 2256 SYSCTL_DESCR("Default MTA for an INET route"), 2257 NULL, 0, &ip_mtu, 0, 2258 CTL_NET, PF_INET, IPPROTO_IP, 2259 IPCTL_DEFMTU, CTL_EOL); 2260 #endif /* IPCTL_DEFMTU */ 2261 sysctl_createv(clog, 0, NULL, NULL, 2262 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2263 CTLTYPE_INT, "forwsrcrt", 2264 SYSCTL_DESCR("Enable forwarding of source-routed " 2265 "datagrams"), 2266 sysctl_net_inet_ip_forwsrcrt, 0, &ip_forwsrcrt, 0, 2267 CTL_NET, PF_INET, IPPROTO_IP, 2268 IPCTL_FORWSRCRT, CTL_EOL); 2269 sysctl_createv(clog, 0, NULL, NULL, 2270 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2271 CTLTYPE_INT, "directed-broadcast", 2272 SYSCTL_DESCR("Enable forwarding of broadcast datagrams"), 2273 NULL, 0, &ip_directedbcast, 0, 2274 CTL_NET, PF_INET, IPPROTO_IP, 2275 IPCTL_DIRECTEDBCAST, CTL_EOL); 2276 sysctl_createv(clog, 0, NULL, NULL, 2277 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2278 CTLTYPE_INT, "allowsrcrt", 2279 SYSCTL_DESCR("Accept source-routed datagrams"), 2280 NULL, 0, &ip_allowsrcrt, 0, 2281 CTL_NET, PF_INET, IPPROTO_IP, 2282 IPCTL_ALLOWSRCRT, CTL_EOL); 2283 sysctl_createv(clog, 0, NULL, NULL, 2284 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2285 CTLTYPE_INT, "subnetsarelocal", 2286 SYSCTL_DESCR("Whether logical subnets are considered " 2287 "local"), 2288 NULL, 0, &subnetsarelocal, 0, 2289 CTL_NET, PF_INET, IPPROTO_IP, 2290 IPCTL_SUBNETSARELOCAL, CTL_EOL); 2291 sysctl_createv(clog, 0, NULL, NULL, 2292 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2293 CTLTYPE_INT, "mtudisc", 2294 SYSCTL_DESCR("Use RFC1191 Path MTU Discovery"), 2295 NULL, 0, &ip_mtudisc, 0, 2296 CTL_NET, PF_INET, IPPROTO_IP, 2297 IPCTL_MTUDISC, CTL_EOL); 2298 sysctl_createv(clog, 0, NULL, NULL, 2299 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2300 CTLTYPE_INT, "anonportmin", 2301 SYSCTL_DESCR("Lowest ephemeral port number to assign"), 2302 sysctl_net_inet_ip_ports, 0, &anonportmin, 0, 2303 CTL_NET, PF_INET, IPPROTO_IP, 2304 IPCTL_ANONPORTMIN, CTL_EOL); 2305 sysctl_createv(clog, 0, NULL, NULL, 2306 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2307 CTLTYPE_INT, "anonportmax", 2308 SYSCTL_DESCR("Highest ephemeral port number to assign"), 2309 sysctl_net_inet_ip_ports, 0, &anonportmax, 0, 2310 CTL_NET, PF_INET, IPPROTO_IP, 2311 IPCTL_ANONPORTMAX, CTL_EOL); 2312 sysctl_createv(clog, 0, NULL, NULL, 2313 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2314 CTLTYPE_INT, "mtudisctimeout", 2315 SYSCTL_DESCR("Lifetime of a Path MTU Discovered route"), 2316 sysctl_net_inet_ip_pmtudto, 0, &ip_mtudisc_timeout, 0, 2317 CTL_NET, PF_INET, IPPROTO_IP, 2318 IPCTL_MTUDISCTIMEOUT, CTL_EOL); 2319 #ifdef GATEWAY 2320 sysctl_createv(clog, 0, NULL, NULL, 2321 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2322 CTLTYPE_INT, "maxflows", 2323 SYSCTL_DESCR("Number of flows for fast forwarding"), 2324 sysctl_net_inet_ip_maxflows, 0, &ip_maxflows, 0, 2325 CTL_NET, PF_INET, IPPROTO_IP, 2326 IPCTL_MAXFLOWS, CTL_EOL); 2327 sysctl_createv(clog, 0, NULL, NULL, 2328 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2329 CTLTYPE_INT, "hashsize", 2330 SYSCTL_DESCR("Size of hash table for fast forwarding (IPv4)"), 2331 sysctl_net_inet_ip_hashsize, 0, &ip_hashsize, 0, 2332 CTL_NET, PF_INET, IPPROTO_IP, 2333 CTL_CREATE, CTL_EOL); 2334 #endif /* GATEWAY */ 2335 sysctl_createv(clog, 0, NULL, NULL, 2336 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2337 CTLTYPE_INT, "hostzerobroadcast", 2338 SYSCTL_DESCR("All zeroes address is broadcast address"), 2339 NULL, 0, &hostzeroisbroadcast, 0, 2340 CTL_NET, PF_INET, IPPROTO_IP, 2341 IPCTL_HOSTZEROBROADCAST, CTL_EOL); 2342 #if NGIF > 0 2343 sysctl_createv(clog, 0, NULL, NULL, 2344 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2345 CTLTYPE_INT, "gifttl", 2346 SYSCTL_DESCR("Default TTL for a gif tunnel datagram"), 2347 NULL, 0, &ip_gif_ttl, 0, 2348 CTL_NET, PF_INET, IPPROTO_IP, 2349 IPCTL_GIF_TTL, CTL_EOL); 2350 #endif /* NGIF */ 2351 #ifndef IPNOPRIVPORTS 2352 sysctl_createv(clog, 0, NULL, NULL, 2353 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2354 CTLTYPE_INT, "lowportmin", 2355 SYSCTL_DESCR("Lowest privileged ephemeral port number " 2356 "to assign"), 2357 sysctl_net_inet_ip_ports, 0, &lowportmin, 0, 2358 CTL_NET, PF_INET, IPPROTO_IP, 2359 IPCTL_LOWPORTMIN, CTL_EOL); 2360 sysctl_createv(clog, 0, NULL, NULL, 2361 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2362 CTLTYPE_INT, "lowportmax", 2363 SYSCTL_DESCR("Highest privileged ephemeral port number " 2364 "to assign"), 2365 sysctl_net_inet_ip_ports, 0, &lowportmax, 0, 2366 CTL_NET, PF_INET, IPPROTO_IP, 2367 IPCTL_LOWPORTMAX, CTL_EOL); 2368 #endif /* IPNOPRIVPORTS */ 2369 sysctl_createv(clog, 0, NULL, NULL, 2370 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2371 CTLTYPE_INT, "maxfragpackets", 2372 SYSCTL_DESCR("Maximum number of fragments to retain for " 2373 "possible reassembly"), 2374 NULL, 0, &ip_maxfragpackets, 0, 2375 CTL_NET, PF_INET, IPPROTO_IP, 2376 IPCTL_MAXFRAGPACKETS, CTL_EOL); 2377 #if NGRE > 0 2378 sysctl_createv(clog, 0, NULL, NULL, 2379 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2380 CTLTYPE_INT, "grettl", 2381 SYSCTL_DESCR("Default TTL for a gre tunnel datagram"), 2382 NULL, 0, &ip_gre_ttl, 0, 2383 CTL_NET, PF_INET, IPPROTO_IP, 2384 IPCTL_GRE_TTL, CTL_EOL); 2385 #endif /* NGRE */ 2386 sysctl_createv(clog, 0, NULL, NULL, 2387 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2388 CTLTYPE_INT, "checkinterface", 2389 SYSCTL_DESCR("Enable receive side of Strong ES model " 2390 "from RFC1122"), 2391 NULL, 0, &ip_checkinterface, 0, 2392 CTL_NET, PF_INET, IPPROTO_IP, 2393 IPCTL_CHECKINTERFACE, CTL_EOL); 2394 sysctl_createv(clog, 0, NULL, NULL, 2395 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2396 CTLTYPE_INT, "random_id", 2397 SYSCTL_DESCR("Assign random ip_id values"), 2398 NULL, 0, &ip_do_randomid, 0, 2399 CTL_NET, PF_INET, IPPROTO_IP, 2400 IPCTL_RANDOMID, CTL_EOL); 2401 sysctl_createv(clog, 0, NULL, NULL, 2402 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 2403 CTLTYPE_INT, "do_loopback_cksum", 2404 SYSCTL_DESCR("Perform IP checksum on loopback"), 2405 NULL, 0, &ip_do_loopback_cksum, 0, 2406 CTL_NET, PF_INET, IPPROTO_IP, 2407 IPCTL_LOOPBACKCKSUM, CTL_EOL); 2408 sysctl_createv(clog, 0, NULL, NULL, 2409 CTLFLAG_PERMANENT, 2410 CTLTYPE_STRUCT, "stats", 2411 SYSCTL_DESCR("IP statistics"), 2412 sysctl_net_inet_ip_stats, 0, NULL, 0, 2413 CTL_NET, PF_INET, IPPROTO_IP, IPCTL_STATS, 2414 CTL_EOL); 2415 } 2416 2417 void 2418 ip_statinc(u_int stat) 2419 { 2420 2421 KASSERT(stat < IP_NSTATS); 2422 IP_STATINC(stat); 2423 } 2424