src/sys/netinet/ip_input.c - diff

Return to ip_input.c CVS log

Up to [cvs.NetBSD.org] / src / sys / netinet

Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.

Diff for /src/sys/netinet/ip_input.c between version 1.169.2.8 and 1.170

version 1.169.2.8, 2005/11/10 14:11:07

version 1.170, 2003/07/03 05:03:53

Line 78

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

* 3. Neither the name of the University nor the names of its contributors

* 3. All advertising materials mentioning features or use of this software

* must display the following acknowledgement:

* This product includes software developed by the University of

* California, Berkeley and its contributors.

* 4. Neither the name of the University nor the names of its contributors

* may be used to endorse or promote products derived from this software

* without specific prior written permission.

Line 100

Line 104

#include <sys/cdefs.h>

__KERNEL_RCSID(0, "$NetBSD$");

#include "opt_inet.h"

#include "opt_gateway.h"

#include "opt_pfil_hooks.h"

#include "opt_ipsec.h"

Line 131 __KERNEL_RCSID(0, "$NetBSD$");

Line 134 __KERNEL_RCSID(0, "$NetBSD$");

#include <netinet/in_systm.h>

#include <netinet/ip.h>

#include <netinet/in_pcb.h>

#include <netinet/in_proto.h>

#include <netinet/in_var.h>

#include <netinet/ip_var.h>

#include <netinet/ip_icmp.h>

Line 149 __KERNEL_RCSID(0, "$NetBSD$");

Line 151 __KERNEL_RCSID(0, "$NetBSD$");

#include <netinet6/ipsec.h>

#include <netkey/key.h>

#endif

#ifdef FAST_IPSEC

#include <netipsec/ipsec.h>

#include <netipsec/key.h>

#endif /* FAST_IPSEC*/

#ifndef IPFORWARDING

#ifdef GATEWAY

Line 199 int ip_mtudisc_timeout = IPMTUDISCTIMEOU

Line 197 int ip_mtudisc_timeout = IPMTUDISCTIMEOU

#ifdef DIAGNOSTIC

int ipprintfs = 0;

#endif

int ip_do_randomid = 0;

* XXX - Setting ip_checkinterface mostly implements the receive side of

* the Strong ES model described in RFC 1122, but since the routing table

Line 220 int ip_checkinterface = 0;

Line 215 int ip_checkinterface = 0;

struct rttimer_queue *ip_mtudisc_timeout_q = NULL;

extern struct domain inetdomain;

int ipqmaxlen = IFQ_MAXLEN;

u_long in_ifaddrhash; /* size of hash table - 1 */

int in_ifaddrentries; /* total number of addrs */

struct in_ifaddrhead in_ifaddrhead;

struct in_ifaddrhead in_ifaddr;

struct in_ifaddrhashhead *in_ifaddrhashtbl;

u_long in_multihash; /* size of hash table - 1 */

int in_multientries; /* total number of addrs */

struct in_multihead in_multi;

struct in_multihashhead *in_multihashtbl;

struct ifqueue ipintrq;

struct ipstat ipstat;

uint16_t ip_id;

u_int16_t ip_id;

#ifdef PFIL_HOOKS

struct pfil_head inet_pfil_hook;

#endif

struct ipqhead ipq;

* Cached copy of nmbclusters. If nbclusters is different,

* recalculate IP parameters derived from nmbclusters.

static int ip_nmbclusters; /* copy of nmbclusters */

static void ip_nmbclusters_changed(void); /* recalc limits */

#define CHECK_NMBCLUSTER_PARAMS() \

do { \

if (__predict_false(ip_nmbclusters != nmbclusters)) \

ip_nmbclusters_changed(); \

} while (/*CONSTCOND*/0)

/* IP datagram reassembly queues (hashed) */

#define IPREASS_NHASH_LOG2 6

#define IPREASS_NHASH (1 << IPREASS_NHASH_LOG2)

#define IPREASS_HMASK (IPREASS_NHASH - 1)

#define IPREASS_HASH(x,y) \

(((((x) & 0xF) | ((((x) >> 8) & 0xF) << 4)) ^ (y)) & IPREASS_HMASK)

struct ipqhead ipq[IPREASS_NHASH];

int ipq_locked;

static int ip_nfragpackets; /* packets in reass queue */

int ip_nfragpackets = 0;

static int ip_nfrags; /* total fragments in reass queues */

int ip_maxfragpackets = 200;

int ip_maxfragpackets = 200; /* limit on packets. XXX sysctl */

int ip_maxfrags; /* limit on fragments. XXX sysctl */

* Additive-Increase/Multiplicative-Decrease (AIMD) strategy for

* IP reassembly queue buffer managment.

* We keep a count of total IP fragments (NB: not fragmented packets!)

* awaiting reassembly (ip_nfrags) and a limit (ip_maxfrags) on fragments.

* If ip_nfrags exceeds ip_maxfrags the limit, we drop half the

* total fragments in reassembly queues.This AIMD policy avoids

* repeatedly deleting single packets under heavy fragmentation load

* (e.g., from lossy NFS peers).

static u_int ip_reass_ttl_decr(u_int ticks);

static void ip_reass_drophalf(void);

static __inline int ipq_lock_try __P((void));

static __inline int ipq_lock_try(void);

static __inline void ipq_unlock __P((void));

static __inline void ipq_unlock(void);

static __inline int

ipq_lock_try(void)

ipq_lock_try()

{

int s;

Line 302 ipq_lock_try(void)

Line 261 ipq_lock_try(void)

}

static __inline void

ipq_unlock(void)

ipq_unlock()

{

int s;

Line 333 do { \

Line 292 do { \

#define IPQ_UNLOCK() ipq_unlock()

POOL_INIT(inmulti_pool, sizeof(struct in_multi), 0, 0, 0, "inmltpl", NULL);

struct pool inmulti_pool;

POOL_INIT(ipqent_pool, sizeof(struct ipqent), 0, 0, 0, "ipqepl", NULL);

struct pool ipqent_pool;

#ifdef INET_CSUM_COUNTERS

#include <sys/device.h>

Line 348 struct evcnt ip_swcsum = EVCNT_INITIALIZ

Line 307 struct evcnt ip_swcsum = EVCNT_INITIALIZ

#define INET_CSUM_COUNTER_INCR(ev) (ev)->ev_count++

EVCNT_ATTACH_STATIC(ip_hwcsum_bad);

EVCNT_ATTACH_STATIC(ip_hwcsum_ok);

EVCNT_ATTACH_STATIC(ip_swcsum);

#else

#define INET_CSUM_COUNTER_INCR(ev) /* nothing */

Line 373 static struct ip_srcrt {

Line 328 static struct ip_srcrt {

struct in_addr route[MAX_IPOPTLEN/sizeof(struct in_addr)];

} ip_srcrt;

static void save_rte(u_char *, struct in_addr);

static void save_rte __P((u_char *, struct in_addr));

#ifdef MBUFTRACE

struct mowner ip_rx_mowner = { "internet", "rx" };

Line 381 struct mowner ip_tx_mowner = { "internet

Line 336 struct mowner ip_tx_mowner = { "internet

#endif

* Compute IP limits derived from the value of nmbclusters.

static void

ip_nmbclusters_changed(void)

{

ip_maxfrags = nmbclusters / 4;

ip_nmbclusters = nmbclusters;

}

* IP initialization: fill in IP protocol switch table.

* All protocols not implemented in kernel go to raw IP protocol handler.

void

ip_init(void)

ip_init()

{

const struct protosw *pr;

struct protosw *pr;

int i;

pool_init(&inmulti_pool, sizeof(struct in_multi), 0, 0, 0, "inmltpl",

NULL);

pool_init(&ipqent_pool, sizeof(struct ipqent), 0, 0, 0, "ipqepl",

NULL);

pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW);

if (pr == 0)

panic("ip_init");

Line 410 ip_init(void)

Line 360 ip_init(void)

if (pr->pr_domain->dom_family == PF_INET &&

pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)

ip_protox[pr->pr_protocol] = pr - inetsw;

LIST_INIT(&ipq);

for (i = 0; i < IPREASS_NHASH; i++)

ip_id = time.tv_sec & 0xffff;

LIST_INIT(&ipq[i]);

ip_id = time.tv_sec & 0xfffff;

ipintrq.ifq_maxlen = ipqmaxlen;

ip_nmbclusters_changed();

TAILQ_INIT(&in_ifaddr);

TAILQ_INIT(&in_ifaddrhead);

in_ifaddrhashtbl = hashinit(IN_IFADDR_HASH_SIZE, HASH_LIST, M_IFADDR,

M_WAITOK, &in_ifaddrhash);

in_multihashtbl = hashinit(IN_IFADDR_HASH_SIZE, HASH_LIST, M_IPMADDR,

Line 439 ip_init(void)

Line 383 ip_init(void)

"error %d\n", i);

#endif /* PFIL_HOOKS */

#ifdef INET_CSUM_COUNTERS

evcnt_attach_static(&ip_hwcsum_bad);

evcnt_attach_static(&ip_hwcsum_ok);

evcnt_attach_static(&ip_swcsum);

#endif /* INET_CSUM_COUNTERS */

#ifdef MBUFTRACE

MOWNER_ATTACH(&ip_tx_mowner);

MOWNER_ATTACH(&ip_rx_mowner);

Line 452 struct route ipforward_rt;

Line 402 struct route ipforward_rt;

* IP software interrupt routine

void

ipintr(void)

ipintr()

{

int s;

struct mbuf *m;

Line 484 ip_input(struct mbuf *m)

Line 434 ip_input(struct mbuf *m)

int downmatch;

int checkif;

int srcrt = 0;

u_int hash;

#ifdef FAST_IPSEC

struct m_tag *mtag;

struct tdb_ident *tdbi;

struct secpolicy *sp;

int s, error;

#endif /* FAST_IPSEC */

MCLAIM(m, &ip_rx_mowner);

#ifdef DIAGNOSTIC

if ((m->m_flags & M_PKTHDR) == 0)

panic("ipintr no HDR");

#endif

#ifdef IPSEC

* should the inner packet be considered authentic?

* see comment in ah4_input().

if (m) {

m->m_flags &= ~M_AUTHIPHDR;

m->m_flags &= ~M_AUTHIPDGM;

}

#endif

* If no IP addresses have been set yet but the interfaces

* are receiving, can't do anything with incoming packets yet.

if (TAILQ_FIRST(&in_ifaddrhead) == 0)

if (TAILQ_FIRST(&in_ifaddr) == 0)

goto bad;

ipstat.ips_total++;

Line 573 ip_input(struct mbuf *m)

Line 526 ip_input(struct mbuf *m)

break;

default:

/* Must compute it ourselves. */

* Must compute it ourselves. Maybe skip checksum on

INET_CSUM_COUNTER_INCR(&ip_swcsum);

* loopback interfaces.

if (in_cksum(m, hlen) != 0)

goto bad;

if (__predict_true(!(m->m_pkthdr.rcvif->if_flags &

IFF_LOOPBACK) || ip_do_loopback_cksum)) {

INET_CSUM_COUNTER_INCR(&ip_swcsum);

if (in_cksum(m, hlen) != 0)

goto badcsum;

}

break;

}

Line 615 ip_input(struct mbuf *m)

Line 562 ip_input(struct mbuf *m)

m_adj(m, len - m->m_pkthdr.len);

}

#if defined(IPSEC)

#ifdef IPSEC

/* ipflow (IP fast forwarding) is not compatible with IPsec. */

m->m_flags &= ~M_CANFASTFWD;

#else

Line 640 ip_input(struct mbuf *m)

Line 587 ip_input(struct mbuf *m)

#ifdef IPSEC

if (!ipsec_getnhist(m))

#elif defined(FAST_IPSEC)

if (!ipsec_indone(m))

#else

if (1)

#endif

Line 656 ip_input(struct mbuf *m)

Line 601 ip_input(struct mbuf *m)

return;

ip = mtod(m, struct ip *);

hlen = ip->ip_hl << 2;

* XXX The setting of "srcrt" here is to prevent ip_forward()

* from generating ICMP redirects for packets that have

* been redirected by a hook back out on to the same LAN that

* they came from and is not an indication that the packet

* is being inffluenced by source routing options. This

* allows things like

* "rdr tlp0 0/0 port 80 -> 1.1.1.200 3128 tcp"

* where tlp0 is both on the 1.1.1.0/24 network and is the

* default route for hosts on 1.1.1.0/24. Of course this

* also requires a "map tlp0 ..." to complete the story.

* One might argue whether or not this kind of network config.

* should be supported in this manner...

srcrt = (odst.s_addr != ip->ip_dst.s_addr);

}

#endif /* PFIL_HOOKS */

Line 733 ip_input(struct mbuf *m)

Line 664 ip_input(struct mbuf *m)

if (ia != NULL)

goto ours;

if (m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) {

IFADDR_FOREACH(ifa, m->m_pkthdr.rcvif) {

TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrlist, ifa_list) {

if (ifa->ifa_addr->sa_family != AF_INET)

continue;

ia = ifatoia(ifa);

Line 759 ip_input(struct mbuf *m)

Line 690 ip_input(struct mbuf *m)

#ifdef MROUTING

extern struct socket *ip_mrouter;

if (M_READONLY(m)) {

if ((m = m_pullup(m, hlen)) == 0) {

ipstat.ips_toosmall++;

return;

}

ip = mtod(m, struct ip *);

}

if (ip_mrouter) {

* If we are acting as a multicast router, all

Line 828 ip_input(struct mbuf *m)

Line 767 ip_input(struct mbuf *m)

goto bad;

}

#endif

#ifdef FAST_IPSEC

mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);

s = splsoftnet();

if (mtag != NULL) {

tdbi = (struct tdb_ident *)(mtag + 1);

sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND);

} else {

sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND,

IP_FORWARDING, &error);

}

if (sp == NULL) { /* NB: can happen if error */

splx(s);

/*XXX error stat???*/

DPRINTF(("ip_input: no SP for forwarding\n")); /*XXX*/

goto bad;

}

* Check security policy against packet attributes.

error = ipsec_in_reject(sp, m);

KEY_FREESP(&sp);

splx(s);

if (error) {

ipstat.ips_cantforward++;

goto bad;

}

* Peek at the outbound SP for this packet to determine if

* it's a Fast Forward candidate.

mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL);

if (mtag != NULL)

m->m_flags &= ~M_CANFASTFWD;

else {

s = splsoftnet();

sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND,

(IP_FORWARDING |

(ip_directedbcast ? IP_ALLOWBROADCAST : 0)),

&error, NULL);

if (sp != NULL) {

m->m_flags &= ~M_CANFASTFWD;

KEY_FREESP(&sp);

}

splx(s);

}

#endif /* FAST_IPSEC */

ip_forward(m, srcrt);

}

Line 890 ours:

Line 781 ours:

* but it's not worth the time; just let them time out.)

if (ip->ip_off & ~htons(IP_DF|IP_RF)) {

if (M_READONLY(m)) {

if ((m = m_pullup(m, hlen)) == NULL) {

ipstat.ips_toosmall++;

goto bad;

}

ip = mtod(m, struct ip *);

}

* Look for queue of fragments

* of this datagram.

IPQ_LOCK();

hash = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id);

LIST_FOREACH(fp, &ipq, ipq_q)

/* XXX LIST_FOREACH(fp, &ipq[hash], ipq_q) */

for (fp = LIST_FIRST(&ipq[hash]); fp != NULL;

fp = LIST_NEXT(fp, ipq_q)) {

if (ip->ip_id == fp->ipq_id &&

in_hosteq(ip->ip_src, fp->ipq_src) &&

in_hosteq(ip->ip_dst, fp->ipq_dst) &&

ip->ip_p == fp->ipq_p)

goto found;

}

fp = 0;

found:

Line 947 found:

Line 840 found:

ipqe->ipqe_mff = mff;

ipqe->ipqe_m = m;

ipqe->ipqe_ip = ip;

m = ip_reass(ipqe, fp, &ipq[hash]);

m = ip_reass(ipqe, fp);

if (m == 0) {

IPQ_UNLOCK();

return;

Line 962 found:

Line 855 found:

IPQ_UNLOCK();

}

#if defined(IPSEC)

#ifdef IPSEC

* enforce IPsec policy checking if we are seeing last header.

* note that we do not visit this with protocols with pcb layer

Line 974 found:

Line 867 found:

goto bad;

}

#endif

#if FAST_IPSEC

* enforce IPsec policy checking if we are seeing last header.

* note that we do not visit this with protocols with pcb layer

* code - like udp/tcp/raw ip.

if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0) {

* Check if the packet has already had IPsec processing

* done. If so, then just pass it along. This tag gets

* set during AH, ESP, etc. input handling, before the

* packet is returned to the ip input queue for delivery.

mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);

s = splsoftnet();

if (mtag != NULL) {

tdbi = (struct tdb_ident *)(mtag + 1);

sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND);

} else {

sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND,

IP_FORWARDING, &error);

}

if (sp != NULL) {

* Check security policy against packet attributes.

error = ipsec_in_reject(sp, m);

KEY_FREESP(&sp);

} else {

/* XXX error stat??? */

error = EINVAL;

DPRINTF(("ip_input: no SP, packet discarded\n"));/*XXX*/

goto bad;

}

splx(s);

if (error)

goto bad;

}

#endif /* FAST_IPSEC */

* Switch out to protocol's input routine.

Line 1044 badcsum:

Line 898 badcsum:

* is given as fp; otherwise have to make a chain.

struct mbuf *

ip_reass(struct ipqent *ipqe, struct ipq *fp, struct ipqhead *ipqhead)

ip_reass(ipqe, fp)

struct ipqent *ipqe;

struct ipq *fp;

{

struct mbuf *m = ipqe->ipqe_m;

struct ipqent *nq, *p, *q;

Line 1062 ip_reass(struct ipqent *ipqe, struct ipq

Line 918 ip_reass(struct ipqent *ipqe, struct ipq

m->m_data += hlen;

m->m_len -= hlen;

#ifdef notyet

/* make sure fragment limit is up-to-date */

CHECK_NMBCLUSTER_PARAMS();

/* If we have too many fragments, drop the older half. */

if (ip_nfrags >= ip_maxfrags)

ip_reass_drophalf(void);

#endif

* We are about to add a fragment; increment frag count.

ip_nfrags++;

* If first fragment to arrive, create a reassembly queue.

Line 1095 ip_reass(struct ipqent *ipqe, struct ipq

Line 937 ip_reass(struct ipqent *ipqe, struct ipq

M_FTABLE, M_NOWAIT);

if (fp == NULL)

goto dropfrag;

LIST_INSERT_HEAD(ipqhead, fp, ipq_q);

LIST_INSERT_HEAD(&ipq, fp, ipq_q);

fp->ipq_nfrags = 1;

fp->ipq_ttl = IPFRAGTTL;

fp->ipq_p = ipqe->ipqe_ip->ip_p;

fp->ipq_id = ipqe->ipqe_ip->ip_id;

Line 1105 ip_reass(struct ipqent *ipqe, struct ipq

Line 946 ip_reass(struct ipqent *ipqe, struct ipq

fp->ipq_dst = ipqe->ipqe_ip->ip_dst;

p = NULL;

goto insert;

} else {

fp->ipq_nfrags++;

}

Line 1157 ip_reass(struct ipqent *ipqe, struct ipq

Line 996 ip_reass(struct ipqent *ipqe, struct ipq

m_freem(q->ipqe_m);

TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q);

pool_put(&ipqent_pool, q);

fp->ipq_nfrags--;

ip_nfrags--;

}

insert:

Line 1204 insert:

Line 1041 insert:

pool_put(&ipqent_pool, q);

m_cat(m, t);

}

ip_nfrags -= fp->ipq_nfrags;

* Create header for new ip packet by

Line 1226 insert:

Line 1062 insert:

for (t = m; t; t = t->m_next)

plen += t->m_len;

m->m_pkthdr.len = plen;

m->m_pkthdr.csum_flags = 0;

}

return (m);

dropfrag:

if (fp != 0)

fp->ipq_nfrags--;

ip_nfrags--;

ipstat.ips_fragdropped++;

m_freem(m);

pool_put(&ipqent_pool, ipqe);

Line 1245 dropfrag:

Line 1077 dropfrag:

* associated datagrams.

void

ip_freef(struct ipq *fp)

ip_freef(fp)

struct ipq *fp;

{

struct ipqent *q, *p;

u_int nfrags = 0;

IPQ_LOCK_CHECK();

for (q = TAILQ_FIRST(&fp->ipq_fragq); q != NULL; q = p) {

p = TAILQ_NEXT(q, ipqe_q);

m_freem(q->ipqe_m);

nfrags++;

TAILQ_REMOVE(&fp->ipq_fragq, q, ipqe_q);

pool_put(&ipqent_pool, q);

}

if (nfrags != fp->ipq_nfrags)

printf("ip_freef: nfrags %d != %d\n", fp->ipq_nfrags, nfrags);

ip_nfrags -= nfrags;

LIST_REMOVE(fp, ipq_q);

FREE(fp, M_FTABLE);

ip_nfragpackets--;

}

* IP reassembly TTL machinery for multiplicative drop.

static u_int fragttl_histo[(IPFRAGTTL+1)];

* Decrement TTL of all reasembly queue entries by `ticks'.

* Count number of distinct fragments (as opposed to partial, fragmented

* datagrams) in the reassembly queue. While we traverse the entire

* reassembly queue, compute and return the median TTL over all fragments.

static u_int

ip_reass_ttl_decr(u_int ticks)

{

u_int nfrags, median, dropfraction, keepfraction;

struct ipq *fp, *nfp;

int i;

nfrags = 0;

memset(fragttl_histo, 0, sizeof fragttl_histo);

for (i = 0; i < IPREASS_NHASH; i++) {

for (fp = LIST_FIRST(&ipq[i]); fp != NULL; fp = nfp) {

fp->ipq_ttl = ((fp->ipq_ttl <= ticks) ?

0 : fp->ipq_ttl - ticks);

nfp = LIST_NEXT(fp, ipq_q);

if (fp->ipq_ttl == 0) {

ipstat.ips_fragtimeout++;

ip_freef(fp);

} else {

nfrags += fp->ipq_nfrags;

fragttl_histo[fp->ipq_ttl] += fp->ipq_nfrags;

}

KASSERT(ip_nfrags == nfrags);

/* Find median (or other drop fraction) in histogram. */

dropfraction = (ip_nfrags / 2);

keepfraction = ip_nfrags - dropfraction;

for (i = IPFRAGTTL, median = 0; i >= 0; i--) {

median += fragttl_histo[i];

if (median >= keepfraction)

break;

}

/* Return TTL of median (or other fraction). */

return (u_int)i;

}

void

ip_reass_drophalf(void)

{

u_int median_ticks;

* Compute median TTL of all fragments, and count frags

* with that TTL or lower (roughly half of all fragments).

median_ticks = ip_reass_ttl_decr(0);

/* Drop half. */

median_ticks = ip_reass_ttl_decr(median_ticks);

}

* IP timer processing;

* if a timer expires on a reassembly

* queue, discard it.

void

ip_slowtimo(void)

ip_slowtimo()

{

static u_int dropscanidx = 0;

struct ipq *fp, *nfp;

u_int i;

u_int median_ttl;

int s = splsoftnet();

IPQ_LOCK();

for (fp = LIST_FIRST(&ipq); fp != NULL; fp = nfp) {

/* Age TTL of all fragments by 1 tick .*/

nfp = LIST_NEXT(fp, ipq_q);

median_ttl = ip_reass_ttl_decr(1);

if (--fp->ipq_ttl == 0) {

ipstat.ips_fragtimeout++;

/* make sure fragment limit is up-to-date */

ip_freef(fp);

CHECK_NMBCLUSTER_PARAMS();

}

/* If we have too many fragments, drop the older half. */

if (ip_nfrags > ip_maxfrags)

ip_reass_ttl_decr(median_ttl);

* If we are over the maximum number of fragmented packets

* If we are over the maximum number of fragments

* (due to the limit being lowered), drain off

* enough to get down to the new limit. Start draining

* enough to get down to the new limit.

* from the reassembly hashqueue most recently drained.

if (ip_maxfragpackets < 0)

;

else {

int wrapped = 0;

while (ip_nfragpackets > ip_maxfragpackets && LIST_FIRST(&ipq))

ip_freef(LIST_FIRST(&ipq));

i = dropscanidx;

while (ip_nfragpackets > ip_maxfragpackets && wrapped == 0) {

while (LIST_FIRST(&ipq[i]) != NULL)

ip_freef(LIST_FIRST(&ipq[i]));

if (++i >= IPREASS_NHASH) {

i = 0;

}

* Dont scan forever even if fragment counters are

* wrong: stop after scanning entire reassembly queue.

if (i == dropscanidx)

wrapped = 1;

}

dropscanidx = i;

}

IPQ_UNLOCK();

#ifdef GATEWAY

Line 1399 ip_slowtimo(void)

Line 1136 ip_slowtimo(void)

* Drain off all datagram fragments.

void

ip_drain(void)

ip_drain()

{

Line 1409 ip_drain(void)

Line 1146 ip_drain(void)

if (ipq_lock_try() == 0)

return;

while (LIST_FIRST(&ipq) != NULL) {

* Drop half the total fragments now. If more mbufs are needed,

ipstat.ips_fragdropped++;

* we will be called again soon.

ip_freef(LIST_FIRST(&ipq));

}

ip_reass_drophalf();

IPQ_UNLOCK();

}

Line 1426 ip_drain(void)

Line 1162 ip_drain(void)

* 0 if the packet should be processed further.

int

ip_dooptions(struct mbuf *m)

ip_dooptions(m)

struct mbuf *m;

{

struct ip *ip = mtod(m, struct ip *);

u_char *cp, *cp0;

Line 1513 ip_dooptions(struct mbuf *m)

Line 1250 ip_dooptions(struct mbuf *m)

bcopy((caddr_t)(cp + off), (caddr_t)&ipaddr.sin_addr,

sizeof(ipaddr.sin_addr));

if (opt == IPOPT_SSRR)

ia = ifatoia(ifa_ifwithladdr(sintosa(&ipaddr)));

ia = ifatoia(ifa_ifwithaddr(sintosa(&ipaddr)));

else

ia = ip_rtaddr(ipaddr.sin_addr);

if (ia == 0) {

Line 1655 bad:

Line 1392 bad:

* return internet address info of interface to be used to get there.

struct in_ifaddr *

ip_rtaddr(struct in_addr dst)

ip_rtaddr(dst)

struct in_addr dst;

{

struct sockaddr_in *sin;

Line 1682 ip_rtaddr(struct in_addr dst)

Line 1420 ip_rtaddr(struct in_addr dst)

* to be picked up later by ip_srcroute if the receiver is interested.

void

save_rte(u_char *option, struct in_addr dst)

save_rte(option, dst)

u_char *option;

struct in_addr dst;

{

unsigned olen;

Line 1704 save_rte(u_char *option, struct in_addr

Line 1444 save_rte(u_char *option, struct in_addr

* The first hop is placed before the options, will be removed later.

struct mbuf *

ip_srcroute(void)

ip_srcroute()

{

struct in_addr *p, *q;

struct mbuf *m;

Line 1776 ip_srcroute(void)

Line 1516 ip_srcroute(void)

* XXX should be deleted; last arg currently ignored.

void

ip_stripoptions(struct mbuf *m, struct mbuf *mopt)

ip_stripoptions(m, mopt)

struct mbuf *m;

struct mbuf *mopt;

{

int i;

struct ip *ip = mtod(m, struct ip *);

Line 1818 const int inetctlerrmap[PRC_NCMDS] = {

Line 1560 const int inetctlerrmap[PRC_NCMDS] = {

* via a source route.

void

ip_forward(struct mbuf *m, int srcrt)

ip_forward(m, srcrt)

struct mbuf *m;

int srcrt;

{

struct ip *ip = mtod(m, struct ip *);

struct sockaddr_in *sin;

struct rtentry *rt;

int error, type = 0, code = 0, destmtu = 0;

int error, type = 0, code = 0;

struct mbuf *mcopy;

n_long dest;

struct ifnet *destifp;

#ifdef IPSEC

struct ifnet dummyifp;

#endif

* We are now in the output path.

Line 1853 ip_forward(struct mbuf *m, int srcrt)

Line 1601 ip_forward(struct mbuf *m, int srcrt)

icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, dest, 0);

return;

}

ip->ip_ttl -= IPTTLDEC;

sin = satosin(&ipforward_rt.ro_dst);

if ((rt = ipforward_rt.ro_rt) == 0 ||

Line 1867 ip_forward(struct mbuf *m, int srcrt)

Line 1616 ip_forward(struct mbuf *m, int srcrt)

rtalloc(&ipforward_rt);

if (ipforward_rt.ro_rt == 0) {

icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_NET, dest, 0);

icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, dest, 0);

return;

}

rt = ipforward_rt.ro_rt;

Line 1882 ip_forward(struct mbuf *m, int srcrt)

Line 1631 ip_forward(struct mbuf *m, int srcrt)

if (mcopy)

mcopy = m_pullup(mcopy, ip->ip_hl << 2);

ip->ip_ttl -= IPTTLDEC;

* If forwarding packet using same interface that it came in on,

* perhaps should send a redirect to sender to shortcut a hop.

Line 1917 ip_forward(struct mbuf *m, int srcrt)

Line 1664 ip_forward(struct mbuf *m, int srcrt)

}

#ifdef IPSEC

/* Don't lookup socket in forwarding case */

(void)ipsec_setsocket(m, NULL);

#endif

error = ip_output(m, (struct mbuf *)0, &ipforward_rt,

(IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)),

(IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)), 0);

(struct ip_moptions *)NULL, (struct socket *)NULL);

if (error)

ipstat.ips_cantforward++;

else {

Line 1940 ip_forward(struct mbuf *m, int srcrt)

Line 1689 ip_forward(struct mbuf *m, int srcrt)

}

if (mcopy == NULL)

return;

destifp = NULL;

switch (error) {

Line 1959 ip_forward(struct mbuf *m, int srcrt)

Line 1709 ip_forward(struct mbuf *m, int srcrt)

case EMSGSIZE:

type = ICMP_UNREACH;

code = ICMP_UNREACH_NEEDFRAG;

#if !defined(IPSEC) && !defined(FAST_IPSEC)

#ifndef IPSEC

if (ipforward_rt.ro_rt)

destmtu = ipforward_rt.ro_rt->rt_ifp->if_mtu;

destifp = ipforward_rt.ro_rt->rt_ifp;

#else

* If the packet is routed over IPsec tunnel, tell the

Line 1980 ip_forward(struct mbuf *m, int srcrt)

Line 1730 ip_forward(struct mbuf *m, int srcrt)

&ipsecerror);

if (sp == NULL)

destmtu = ipforward_rt.ro_rt->rt_ifp->if_mtu;

destifp = ipforward_rt.ro_rt->rt_ifp;

else {

/* count IPsec header size */

ipsechdr = ipsec4_hdrsiz(mcopy,

Line 1989 ip_forward(struct mbuf *m, int srcrt)

Line 1739 ip_forward(struct mbuf *m, int srcrt)

* find the correct route for outer IPv4

* header, compute tunnel MTU.

* XXX BUG ALERT

* The "dummyifp" code relies upon the fact

* that icmp_error() touches only ifp->if_mtu.

/*XXX*/

destifp = NULL;

if (sp->req != NULL

&& sp->req->sav != NULL

&& sp->req->sav->sah != NULL) {

ro = &sp->req->sav->sah->sa_route;

if (ro->ro_rt && ro->ro_rt->rt_ifp) {

destmtu =

dummyifp.if_mtu =

ro->ro_rt->rt_rmx.rmx_mtu ?

ro->ro_rt->rt_rmx.rmx_mtu :

ro->ro_rt->rt_ifp->if_mtu;

destmtu -= ipsechdr;

dummyifp.if_mtu -= ipsechdr;

destifp = &dummyifp;

}

#ifdef IPSEC

key_freesp(sp);

#else

KEY_FREESP(&sp);

#endif

}

#endif /*IPSEC*/

Line 2032 ip_forward(struct mbuf *m, int srcrt)

Line 1784 ip_forward(struct mbuf *m, int srcrt)

break;

#endif

}

icmp_error(mcopy, type, code, dest, destmtu);

icmp_error(mcopy, type, code, dest, destifp);

}

void

ip_savecontrol(struct inpcb *inp, struct mbuf **mp, struct ip *ip,

ip_savecontrol(inp, mp, ip, m)

struct mbuf *m)

struct inpcb *inp;

struct mbuf **mp;

struct ip *ip;

struct mbuf *m;

{

if (inp->inp_socket->so_options & SO_TIMESTAMP) {

Line 2092 ip_savecontrol(struct inpcb *inp, struct

Line 1847 ip_savecontrol(struct inpcb *inp, struct

}

int

* sysctl helper routine for net.inet.ip.mtudisctimeout. checks the

ip_sysctl(name, namelen, oldp, oldlenp, newp, newlen)

* range of the new value and tweaks timers if it changes.

int *name;

u_int namelen;

static int

void *oldp;

sysctl_net_inet_ip_pmtudto(SYSCTLFN_ARGS)

size_t *oldlenp;

void *newp;

size_t newlen;

{

int error, tmp;

extern int subnetsarelocal, hostzeroisbroadcast;

struct sysctlnode node;

node = *rnode;

tmp = ip_mtudisc_timeout;

node.sysctl_data = &tmp;

error = sysctl_lookup(SYSCTLFN_CALL(&node));

if (error || newp == NULL)

return (error);

if (tmp < 0)

return (EINVAL);

ip_mtudisc_timeout = tmp;

int error, old;

rt_timer_queue_change(ip_mtudisc_timeout_q, ip_mtudisc_timeout);

return (0);

}

/* All sysctl names at this level are terminal. */

if (namelen != 1)

return (ENOTDIR);

switch (name[0]) {

case IPCTL_FORWARDING:

return (sysctl_int(oldp, oldlenp, newp, newlen, &ipforwarding));

case IPCTL_SENDREDIRECTS:

return (sysctl_int(oldp, oldlenp, newp, newlen,

&ipsendredirects));

case IPCTL_DEFTTL:

return (sysctl_int(oldp, oldlenp, newp, newlen, &ip_defttl));

#ifdef notyet

case IPCTL_DEFMTU:

return (sysctl_int(oldp, oldlenp, newp, newlen, &ip_mtu));

#endif

case IPCTL_FORWSRCRT:

/* Don't allow this to change in a secure environment. */

if (securelevel > 0)

return (sysctl_rdint(oldp, oldlenp, newp,

ip_forwsrcrt));

else

return (sysctl_int(oldp, oldlenp, newp, newlen,

&ip_forwsrcrt));

case IPCTL_DIRECTEDBCAST:

return (sysctl_int(oldp, oldlenp, newp, newlen,

&ip_directedbcast));

case IPCTL_ALLOWSRCRT:

return (sysctl_int(oldp, oldlenp, newp, newlen,

&ip_allowsrcrt));

case IPCTL_SUBNETSARELOCAL:

return (sysctl_int(oldp, oldlenp, newp, newlen,

&subnetsarelocal));

case IPCTL_MTUDISC:

error = sysctl_int(oldp, oldlenp, newp, newlen,

&ip_mtudisc);

if (error == 0 && ip_mtudisc == 0)

rt_timer_queue_remove_all(ip_mtudisc_timeout_q, TRUE);

return error;

case IPCTL_ANONPORTMIN:

old = anonportmin;

error = sysctl_int(oldp, oldlenp, newp, newlen, &anonportmin);

if (anonportmin >= anonportmax || anonportmin < 0

|| anonportmin > 65535

#ifndef IPNOPRIVPORTS

|| anonportmin < IPPORT_RESERVED

#endif

) {

anonportmin = old;

return (EINVAL);

}

return (error);

case IPCTL_ANONPORTMAX:

old = anonportmax;

error = sysctl_int(oldp, oldlenp, newp, newlen, &anonportmax);

if (anonportmin >= anonportmax || anonportmax < 0

|| anonportmax > 65535

#ifndef IPNOPRIVPORTS

|| anonportmax < IPPORT_RESERVED

#endif

) {

anonportmax = old;

return (EINVAL);

}

return (error);

case IPCTL_MTUDISCTIMEOUT:

old = ip_mtudisc_timeout;

error = sysctl_int(oldp, oldlenp, newp, newlen,

&ip_mtudisc_timeout);

if (ip_mtudisc_timeout < 0) {

ip_mtudisc_timeout = old;

return (EINVAL);

}

if (error == 0)

rt_timer_queue_change(ip_mtudisc_timeout_q,

ip_mtudisc_timeout);

return (error);

#ifdef GATEWAY

case IPCTL_MAXFLOWS:

* sysctl helper routine for net.inet.ip.maxflows. apparently if

{

* maxflows is even looked up, we "reap flows".

int s;

static int

sysctl_net_inet_ip_maxflows(SYSCTLFN_ARGS)

{

int s;

s = sysctl_lookup(SYSCTLFN_CALL(rnode));

if (s)

return (s);

s = splsoftnet();

ipflow_reap(0);

splx(s);

return (0);

}

#endif /* GATEWAY */

error = sysctl_int(oldp, oldlenp, newp, newlen,

&ip_maxflows);

s = splsoftnet();

ipflow_reap(0);

splx(s);

return (error);

}

#endif

case IPCTL_HOSTZEROBROADCAST:

return (sysctl_int(oldp, oldlenp, newp, newlen,

&hostzeroisbroadcast));

#if NGIF > 0

case IPCTL_GIF_TTL:

return (sysctl_int(oldp, oldlenp, newp, newlen,

&ip_gif_ttl));

#endif

SYSCTL_SETUP(sysctl_net_inet_ip_setup, "sysctl net.inet.ip subtree setup")

#if NGRE > 0

{

case IPCTL_GRE_TTL:

extern int subnetsarelocal, hostzeroisbroadcast;

return (sysctl_int(oldp, oldlenp, newp, newlen,

&ip_gre_ttl));

#endif

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT,

CTLTYPE_NODE, "net", NULL,

NULL, 0, NULL, 0,

CTL_NET, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT,

CTLTYPE_NODE, "inet",

SYSCTL_DESCR("PF_INET related settings"),

NULL, 0, NULL, 0,

CTL_NET, PF_INET, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT,

CTLTYPE_NODE, "ip",

SYSCTL_DESCR("IPv4 related settings"),

NULL, 0, NULL, 0,

CTL_NET, PF_INET, IPPROTO_IP, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "forwarding",

SYSCTL_DESCR("Enable forwarding of INET datagrams"),

NULL, 0, &ipforwarding, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_FORWARDING, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "redirect",

SYSCTL_DESCR("Enable sending of ICMP redirect messages"),

NULL, 0, &ipsendredirects, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_SENDREDIRECTS, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "ttl",

SYSCTL_DESCR("Default TTL for an INET datagram"),

NULL, 0, &ip_defttl, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_DEFTTL, CTL_EOL);

#ifdef IPCTL_DEFMTU

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT /* |CTLFLAG_READWRITE? */,

CTLTYPE_INT, "mtu",

SYSCTL_DESCR("Default MTA for an INET route"),

NULL, 0, &ip_mtu, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_DEFMTU, CTL_EOL);

#endif /* IPCTL_DEFMTU */

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READONLY1,

CTLTYPE_INT, "forwsrcrt",

SYSCTL_DESCR("Enable forwarding of source-routed "

"datagrams"),

NULL, 0, &ip_forwsrcrt, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_FORWSRCRT, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "directed-broadcast",

SYSCTL_DESCR("Enable forwarding of broadcast datagrams"),

NULL, 0, &ip_directedbcast, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_DIRECTEDBCAST, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "allowsrcrt",

SYSCTL_DESCR("Accept source-routed datagrams"),

NULL, 0, &ip_allowsrcrt, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_ALLOWSRCRT, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "subnetsarelocal",

SYSCTL_DESCR("Whether logical subnets are considered "

"local"),

NULL, 0, &subnetsarelocal, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_SUBNETSARELOCAL, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "mtudisc",

SYSCTL_DESCR("Use RFC1191 Path MTU Discovery"),

NULL, 0, &ip_mtudisc, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_MTUDISC, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "anonportmin",

SYSCTL_DESCR("Lowest ephemeral port number to assign"),

sysctl_net_inet_ip_ports, 0, &anonportmin, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_ANONPORTMIN, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "anonportmax",

SYSCTL_DESCR("Highest ephemeral port number to assign"),

sysctl_net_inet_ip_ports, 0, &anonportmax, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_ANONPORTMAX, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "mtudisctimeout",

SYSCTL_DESCR("Lifetime of a Path MTU Discovered route"),

sysctl_net_inet_ip_pmtudto, 0, &ip_mtudisc_timeout, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_MTUDISCTIMEOUT, CTL_EOL);

#ifdef GATEWAY

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "maxflows",

SYSCTL_DESCR("Number of flows for fast forwarding"),

sysctl_net_inet_ip_maxflows, 0, &ip_maxflows, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_MAXFLOWS, CTL_EOL);

#endif /* GATEWAY */

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "hostzerobroadcast",

SYSCTL_DESCR("All zeroes address is broadcast address"),

NULL, 0, &hostzeroisbroadcast, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_HOSTZEROBROADCAST, CTL_EOL);

#if NGIF > 0

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "gifttl",

SYSCTL_DESCR("Default TTL for a gif tunnel datagram"),

NULL, 0, &ip_gif_ttl, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_GIF_TTL, CTL_EOL);

#endif /* NGIF */

#ifndef IPNOPRIVPORTS

sysctl_createv(clog, 0, NULL, NULL,

case IPCTL_LOWPORTMIN:

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

old = lowportmin;

CTLTYPE_INT, "lowportmin",

error = sysctl_int(oldp, oldlenp, newp, newlen, &lowportmin);

SYSCTL_DESCR("Lowest privileged ephemeral port number "

if (lowportmin >= lowportmax

"to assign"),

|| lowportmin > IPPORT_RESERVEDMAX

sysctl_net_inet_ip_ports, 0, &lowportmin, 0,

|| lowportmin < IPPORT_RESERVEDMIN

CTL_NET, PF_INET, IPPROTO_IP,

) {

IPCTL_LOWPORTMIN, CTL_EOL);

lowportmin = old;

sysctl_createv(clog, 0, NULL, NULL,

return (EINVAL);

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

}

CTLTYPE_INT, "lowportmax",

return (error);

SYSCTL_DESCR("Highest privileged ephemeral port number "

case IPCTL_LOWPORTMAX:

"to assign"),

old = lowportmax;

sysctl_net_inet_ip_ports, 0, &lowportmax, 0,

error = sysctl_int(oldp, oldlenp, newp, newlen, &lowportmax);

CTL_NET, PF_INET, IPPROTO_IP,

if (lowportmin >= lowportmax

IPCTL_LOWPORTMAX, CTL_EOL);

|| lowportmax > IPPORT_RESERVEDMAX

#endif /* IPNOPRIVPORTS */

|| lowportmax < IPPORT_RESERVEDMIN

sysctl_createv(clog, 0, NULL, NULL,

) {

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

lowportmax = old;

CTLTYPE_INT, "maxfragpackets",

return (EINVAL);

SYSCTL_DESCR("Maximum number of fragments to retain for "

}

"possible reassembly"),

return (error);

NULL, 0, &ip_maxfragpackets, 0,

#endif

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_MAXFRAGPACKETS, CTL_EOL);

case IPCTL_MAXFRAGPACKETS:

#if NGRE > 0

return (sysctl_int(oldp, oldlenp, newp, newlen,

sysctl_createv(clog, 0, NULL, NULL,

&ip_maxfragpackets));

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "grettl",

case IPCTL_CHECKINTERFACE:

SYSCTL_DESCR("Default TTL for a gre tunnel datagram"),

return (sysctl_int(oldp, oldlenp, newp, newlen,

NULL, 0, &ip_gre_ttl, 0,

&ip_checkinterface));

CTL_NET, PF_INET, IPPROTO_IP,

default:

IPCTL_GRE_TTL, CTL_EOL);

return (EOPNOTSUPP);

#endif /* NGRE */

}

sysctl_createv(clog, 0, NULL, NULL,

/* NOTREACHED */

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "checkinterface",

SYSCTL_DESCR("Enable receive side of Strong ES model "

"from RFC1122"),

NULL, 0, &ip_checkinterface, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_CHECKINTERFACE, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "random_id",

SYSCTL_DESCR("Assign random ip_id values"),

NULL, 0, &ip_do_randomid, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_RANDOMID, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "do_loopback_cksum",

SYSCTL_DESCR("Perform IP checksum on loopback"),

NULL, 0, &ip_do_loopback_cksum, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_LOOPBACKCKSUM, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT,

CTLTYPE_STRUCT, "stats",

SYSCTL_DESCR("IP statistics"),

NULL, 0, &ipstat, sizeof(ipstat),

CTL_NET, PF_INET, IPPROTO_IP, IPCTL_STATS,

CTL_EOL);

}

CVSweb <webmaster@jp.NetBSD.org>