src/sys/netinet/ip_input.c - diff

Return to ip_input.c CVS log

Up to [cvs.NetBSD.org] / src / sys / netinet

Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.

Diff for /src/sys/netinet/ip_input.c between version 1.288 and 1.314

version 1.288, 2010/07/13 22:16:10

version 1.314, 2014/05/23 23:38:48

Line 96 __KERNEL_RCSID(0, "$NetBSD$");

#include "opt_inet.h"

#include "opt_compat_netbsd.h"

#include "opt_gateway.h"

#include "opt_pfil_hooks.h"

#include "opt_ipsec.h"

#include "opt_mrouting.h"

#include "opt_mbuftrace.h"

Line 139 __KERNEL_RCSID(0, "$NetBSD$");

Line 138 __KERNEL_RCSID(0, "$NetBSD$");

#ifdef MROUTING

#include <netinet/ip_mroute.h>

#endif

#include <netinet/portalgo.h>

#ifdef IPSEC

#include <netinet6/ipsec.h>

#include <netinet6/ipsec_private.h>

#include <netkey/key.h>

#endif

#ifdef FAST_IPSEC

#include <netipsec/ipsec.h>

#include <netipsec/key.h>

#endif

#endif /* FAST_IPSEC*/

#ifndef IPFORWARDING

#ifdef GATEWAY

Line 218 int ip_do_randomid = 0;

Line 212 int ip_do_randomid = 0;

int ip_checkinterface = 0;

struct rttimer_queue *ip_mtudisc_timeout_q = NULL;

int ipqmaxlen = IFQ_MAXLEN;

u_long in_ifaddrhash; /* size of hash table - 1 */

int in_ifaddrentries; /* total number of addrs */

struct in_ifaddrhead in_ifaddrhead;

struct in_ifaddrhashhead *in_ifaddrhashtbl;

u_long in_multihash; /* size of hash table - 1 */

int in_multientries; /* total number of addrs */

struct in_multihashhead *in_multihashtbl;

struct ifqueue ipintrq;

ipid_state_t * ip_ids;

uint16_t ip_id;

percpu_t *ipstat_percpu;

#ifdef PFIL_HOOKS

pfil_head_t *inet_pfil_hook;

struct pfil_head inet_pfil_hook;

#endif

struct pool inmulti_pool;

#ifdef INET_CSUM_COUNTERS

#include <sys/device.h>

Line 270 EVCNT_ATTACH_STATIC(ip_swcsum);

Line 252 EVCNT_ATTACH_STATIC(ip_swcsum);

* maintenance when the remote end is on a network that is not known

* to us.

int ip_nhops = 0;

static int ip_nhops = 0;

static struct ip_srcrt {

struct in_addr dst; /* final destination */

char nop; /* one NOP to align */

Line 278 static struct ip_srcrt {

Line 262 static struct ip_srcrt {

struct in_addr route[MAX_IPOPTLEN/sizeof(struct in_addr)];

} ip_srcrt;

static int ip_drainwanted;

static void save_rte(u_char *, struct in_addr);

#ifdef MBUFTRACE

Line 285 struct mowner ip_rx_mowner = MOWNER_INIT

Line 271 struct mowner ip_rx_mowner = MOWNER_INIT

struct mowner ip_tx_mowner = MOWNER_INIT("internet", "tx");

#endif

static void sysctl_net_inet_ip_setup(struct sysctllog **);

static void ip_input(struct mbuf *);

static void ip_forward(struct mbuf *, int);

static bool ip_dooptions(struct mbuf *);

static struct in_ifaddr *ip_rtaddr(struct in_addr);

static void sysctl_net_inet_ip_setup(struct sysctllog **);

* IP initialization: fill in IP protocol switch table.

Line 295 void

Line 285 void

ip_init(void)

{

const struct protosw *pr;

int i;

in_init();

sysctl_net_inet_ip_setup(NULL);

pool_init(&inmulti_pool, sizeof(struct in_multi), 0, 0, 0, "inmltpl",

NULL, IPL_SOFTNET);

pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW);

if (pr == 0)

KASSERT(pr != NULL);

panic("ip_init");

for (i = 0; i < IPPROTO_MAX; i++)

for (u_int i = 0; i < IPPROTO_MAX; i++) {

ip_protox[i] = pr - inetsw;

}

for (pr = inetdomain.dom_protosw;

pr < inetdomain.dom_protoswNPROTOSW; pr++)

if (pr->pr_domain->dom_family == PF_INET &&

Line 315 ip_init(void)

Line 303 ip_init(void)

ip_reass_init();

ip_initid();

ip_ids = ip_id_init();

ip_id = time_second & 0xfffff;

ipintrq.ifq_maxlen = ipqmaxlen;

ipintrq.ifq_maxlen = IFQ_MAXLEN;

TAILQ_INIT(&in_ifaddrhead);

in_ifaddrhashtbl = hashinit(IN_IFADDR_HASH_SIZE, HASH_LIST, true,

&in_ifaddrhash);

in_multihashtbl = hashinit(IN_IFADDR_HASH_SIZE, HASH_LIST, true,

&in_multihash);

ip_mtudisc_timeout_q = rt_timer_queue_create(ip_mtudisc_timeout);

#ifdef GATEWAY

ipflow_init(ip_hashsize);

ipflow_init();

#endif

#ifdef PFIL_HOOKS

/* Register our Packet Filter hook. */

inet_pfil_hook.ph_type = PFIL_TYPE_AF;

inet_pfil_hook = pfil_head_create(PFIL_TYPE_AF, (void *)AF_INET);

inet_pfil_hook.ph_af = AF_INET;

KASSERT(inet_pfil_hook != NULL);

i = pfil_head_register(&inet_pfil_hook);

if (i != 0)

printf("ip_init: WARNING: unable to register pfil hook, "

"error %d\n", i);

#endif /* PFIL_HOOKS */

#ifdef MBUFTRACE

MOWNER_ATTACH(&ip_tx_mowner);

Line 352 struct sockaddr_in ipaddr = {

Line 329 struct sockaddr_in ipaddr = {

.sin_len = sizeof(ipaddr),

.sin_family = AF_INET,

};

struct route ipforward_rt;

static struct route ipforward_rt;

* IP software interrupt routine

Line 365 ipintr(void)

Line 343 ipintr(void)

struct ifqueue lcl_intrq;

memset(&lcl_intrq, 0, sizeof(lcl_intrq));

ipintrq.ifq_maxlen = ipqmaxlen;

mutex_enter(softnet_lock);

KERNEL_LOCK(1, NULL);

Line 398 ipintr(void)

Line 375 ipintr(void)

* Ip input routine. Checksum and byte swap header. If fragmented

* try to reassemble. Process options. Pass to next level.

void

static void

ip_input(struct mbuf *m)

{

struct ip *ip = NULL;

Line 408 ip_input(struct mbuf *m)

Line 385 ip_input(struct mbuf *m)

int downmatch;

int checkif;

int srcrt = 0;

#ifdef FAST_IPSEC

ifnet_t *ifp;

struct m_tag *mtag;

struct tdb_ident *tdbi;

struct secpolicy *sp;

int error;

#endif /* FAST_IPSEC */

MCLAIM(m, &ip_rx_mowner);

#ifdef DIAGNOSTIC

KASSERT((m->m_flags & M_PKTHDR) != 0);

if ((m->m_flags & M_PKTHDR) == 0)

ifp = m->m_pkthdr.rcvif;

panic("ipintr no HDR");

#endif

* If no IP addresses have been set yet but the interfaces

Line 458 ip_input(struct mbuf *m)

Line 428 ip_input(struct mbuf *m)

goto bad;

}

if (hlen > m->m_len) {

if ((m = m_pullup(m, hlen)) == 0) {

if ((m = m_pullup(m, hlen)) == NULL) {

IP_STATINC(IP_STAT_BADHLEN);

return;

}

Line 477 ip_input(struct mbuf *m)

Line 447 ip_input(struct mbuf *m)

/* 127/8 must not appear on wire - RFC1122 */

if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||

(ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {

if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) {

if ((ifp->if_flags & IFF_LOOPBACK) == 0) {

IP_STATINC(IP_STAT_BADADDR);

goto bad;

}

switch (m->m_pkthdr.csum_flags &

((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_IPv4) |

((ifp->if_csum_flags_rx & M_CSUM_IPv4) |

M_CSUM_IPv4_BAD)) {

case M_CSUM_IPv4|M_CSUM_IPv4_BAD:

INET_CSUM_COUNTER_INCR(&ip_hwcsum_bad);

Line 500 ip_input(struct mbuf *m)

Line 470 ip_input(struct mbuf *m)

* Must compute it ourselves. Maybe skip checksum on

* loopback interfaces.

if (__predict_true(!(m->m_pkthdr.rcvif->if_flags &

if (__predict_true(!(ifp->if_flags & IFF_LOOPBACK) ||

IFF_LOOPBACK) || ip_do_loopback_cksum)) {

ip_do_loopback_cksum)) {

INET_CSUM_COUNTER_INCR(&ip_swcsum);

if (in_cksum(m, hlen) != 0)

goto badcsum;

Line 538 ip_input(struct mbuf *m)

Line 508 ip_input(struct mbuf *m)

m_adj(m, len - m->m_pkthdr.len);

}

#if defined(IPSEC)

/* ipflow (IP fast forwarding) is not compatible with IPsec. */

m->m_flags &= ~M_CANFASTFWD;

#else

* Assume that we can create a fast-forward IP flow entry

* based on this packet.

m->m_flags |= M_CANFASTFWD;

#endif

#ifdef PFIL_HOOKS

* Run through list of hooks for input packets. If there are any

* filters which require that additional packets in the flow are

Line 557 ip_input(struct mbuf *m)

Line 521 ip_input(struct mbuf *m)

* Note that filters must _never_ set this flag, as another filter

* in the list may have previously cleared it.

#if defined(IPSEC)

* let ipfilter look at packet on the wire,

* not the decapsulated packet.

#ifdef IPSEC

if (!ipsec_getnhist(m))

#elif defined(FAST_IPSEC)

if (!ipsec_indone(m))

#else

if (1)

#endif

{

struct in_addr odst;

struct in_addr odst = ip->ip_dst;

odst = ip->ip_dst;

if (pfil_run_hooks(inet_pfil_hook, &m, ifp, PFIL_IN) != 0)

if (pfil_run_hooks(&inet_pfil_hook, &m, m->m_pkthdr.rcvif,

PFIL_IN) != 0)

return;

if (m == NULL)

return;

Line 595 ip_input(struct mbuf *m)

Line 551 ip_input(struct mbuf *m)

srcrt = (odst.s_addr != ip->ip_dst.s_addr);

}

#endif /* PFIL_HOOKS */

#ifdef ALTQ

/* XXX Temporary until ALTQ is changed to use a pfil hook */

Line 632 ip_input(struct mbuf *m)

Line 587 ip_input(struct mbuf *m)

* we get finer grain control.

checkif = ip_checkinterface && (ipforwarding == 0) &&

(m->m_pkthdr.rcvif != NULL) &&

ifp && (ifp->if_flags & IFF_LOOPBACK) == 0;

((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0);

* Check our list of addresses, to see if the packet is for us.

Line 645 ip_input(struct mbuf *m)

Line 599 ip_input(struct mbuf *m)

downmatch = 0;

LIST_FOREACH(ia, &IN_IFADDR_HASH(ip->ip_dst.s_addr), ia_hash) {

if (in_hosteq(ia->ia_addr.sin_addr, ip->ip_dst)) {

if (checkif && ia->ia_ifp != m->m_pkthdr.rcvif)

if (checkif && ia->ia_ifp != ifp)

continue;

if ((ia->ia_ifp->if_flags & IFF_UP) != 0)

break;

Line 655 ip_input(struct mbuf *m)

Line 609 ip_input(struct mbuf *m)

}

if (ia != NULL)

goto ours;

if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) {

if (ifp && ifp->if_flags & IFF_BROADCAST) {

IFADDR_FOREACH(ifa, m->m_pkthdr.rcvif) {

IFADDR_FOREACH(ifa, ifp) {

if (ifa->ifa_addr->sa_family != AF_INET)

continue;

ia = ifatoia(ifa);

Line 695 ip_input(struct mbuf *m)

Line 649 ip_input(struct mbuf *m)

* as expected when ip_mforward() is called from

* ip_output().)

if (ip_mforward(m, m->m_pkthdr.rcvif) != 0) {

if (ip_mforward(m, ifp) != 0) {

IP_STATINC(IP_STAT_CANTFORWARD);

m_freem(m);

return;

Line 715 ip_input(struct mbuf *m)

Line 669 ip_input(struct mbuf *m)

* See if we belong to the destination multicast group on the

* arrival interface.

IN_LOOKUP_MULTI(ip->ip_dst, m->m_pkthdr.rcvif, inm);

IN_LOOKUP_MULTI(ip->ip_dst, ifp, inm);

if (inm == NULL) {

IP_STATINC(IP_STAT_CANTFORWARD);

m_freem(m);

Line 746 ip_input(struct mbuf *m)

Line 700 ip_input(struct mbuf *m)

return;

}

#ifdef IPSEC

if (ipsec4_in_reject(m, NULL)) {

/* Perform IPsec, if any. */

IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);

if (ipsec4_input(m, IP_FORWARDING | (ip_directedbcast ?

IP_ALLOWBROADCAST : 0)) != 0) {

goto bad;

}

#endif

#ifdef FAST_IPSEC

mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);

s = splsoftnet();

if (mtag != NULL) {

tdbi = (struct tdb_ident *)(mtag + 1);

sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND);

} else {

sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND,

IP_FORWARDING, &error);

}

if (sp == NULL) { /* NB: can happen if error */

splx(s);

/*XXX error stat???*/

DPRINTF(("ip_input: no SP for forwarding\n")); /*XXX*/

goto bad;

}

* Check security policy against packet attributes.

error = ipsec_in_reject(sp, m);

KEY_FREESP(&sp);

splx(s);

if (error) {

IP_STATINC(IP_STAT_CANTFORWARD);

goto bad;

}

* Peek at the outbound SP for this packet to determine if

* it's a Fast Forward candidate.

mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL);

if (mtag != NULL)

m->m_flags &= ~M_CANFASTFWD;

else {

s = splsoftnet();

sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND,

(IP_FORWARDING |

(ip_directedbcast ? IP_ALLOWBROADCAST : 0)),

&error, NULL);

if (sp != NULL) {

m->m_flags &= ~M_CANFASTFWD;

KEY_FREESP(&sp);

}

splx(s);

}

#endif /* FAST_IPSEC */

ip_forward(m, srcrt);

}

return;

Line 809 ours:

Line 715 ours:

* If offset or IP_MF are set, must reassemble.

if (ip->ip_off & ~htons(IP_DF|IP_RF)) {

struct ipq *fp;

u_int off, hash;

bool mff;

* Prevent TCP blind data attacks by not allowing non-initial

* Pass to IP reassembly mechanism.

* fragments to start at less than 68 bytes (minimal fragment

* size) and making sure the first fragment is at least 68

* bytes.

off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;

if (ip_reass_packet(&m, ip) != 0) {

if ((off > 0 ? off + hlen : len) < IP_MINFRAGSIZE - 1) {

/* Failed; invalid fragment(s) or packet. */

IP_STATINC(IP_STAT_BADFRAGS);

goto bad;

}

if (m == NULL) {

/* More fragments should come; silently return. */

* Adjust total IP length to not reflect header. Set 'mff'

return;

* indicator, if more fragments are expected. Convert offset

* of this to bytes.

ip->ip_len = htons(ntohs(ip->ip_len) - hlen);

mff = (ip->ip_off & htons(IP_MF)) != 0;

if (mff) {

* Make sure that fragments have a data length

* which is non-zero and multiple of 8 bytes.

if (ntohs(ip->ip_len) == 0 ||

(ntohs(ip->ip_len) & 0x7) != 0) {

IP_STATINC(IP_STAT_BADFRAGS);

goto bad;

}

ip->ip_off = htons((ntohs(ip->ip_off) & IP_OFFMASK) << 3);

/* Look for queue of fragments of this datagram. */

fp = ip_reass_lookup(ip, &hash);

/* Make sure the TOS matches previous fragments. */

if (fp && fp->ipq_tos != ip->ip_tos) {

IP_STATINC(IP_STAT_BADFRAGS);

ip_reass_unlock();

goto bad;

}

* If datagram marked as having more fragments

* Reassembly is done, we have the final packet.

* or if this is not the first fragment,

* Updated cached data in local variable(s).

* attempt reassembly; if it succeeds, proceed.

if (mff || ip->ip_off != htons(0)) {

ip = mtod(m, struct ip *);

struct ipqent *ipqe;

hlen = ip->ip_hl << 2;

ipqe = ip_reass_getent();

if (ipqe == NULL) {

IP_STATINC(IP_STAT_RCVMEMDROP);

ip_reass_unlock();

goto bad;

}

ipqe->ipqe_mff = mff;

ipqe->ipqe_m = m;

ipqe->ipqe_ip = ip;

m = ip_reass(ipqe, fp, hash);

if (m == NULL) {

return;

}

IP_STATINC(IP_STAT_REASSEMBLED);

ip = mtod(m, struct ip *);

hlen = ip->ip_hl << 2;

ip->ip_len = htons(ntohs(ip->ip_len) + hlen);

} else if (fp) {

ip_freef(fp);

ip_reass_unlock();

}

#if defined(IPSEC)

#ifdef IPSEC

* enforce IPsec policy checking if we are seeing last header.

* note that we do not visit this with protocols with pcb layer

* code - like udp/tcp/raw ip.

if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0 &&

ipsec4_in_reject(m, NULL)) {

IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);

goto bad;

}

#endif

#ifdef FAST_IPSEC

* enforce IPsec policy checking if we are seeing last header.

* Enforce IPsec policy checking if we are seeing last header.

* note that we do not visit this with protocols with pcb layer

* Note that we do not visit this with protocols with PCB layer

* code - like udp/tcp/raw ip.

* code - like UDP/TCP/raw IP.

if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0) {

if (ipsec4_input(m, 0) != 0) {

* Check if the packet has already had IPsec processing

* done. If so, then just pass it along. This tag gets

* set during AH, ESP, etc. input handling, before the

* packet is returned to the ip input queue for delivery.

mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);

s = splsoftnet();

if (mtag != NULL) {

tdbi = (struct tdb_ident *)(mtag + 1);

sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND);

} else {

sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND,

IP_FORWARDING, &error);

}

if (sp != NULL) {

* Check security policy against packet attributes.

error = ipsec_in_reject(sp, m);

KEY_FREESP(&sp);

} else {

/* XXX error stat??? */

error = EINVAL;

DPRINTF(("ip_input: no SP, packet discarded\n"));/*XXX*/

}

splx(s);

if (error)

goto bad;

}

#endif /* FAST_IPSEC */

#endif

* Switch out to protocol's input routine.

Line 989 ip_drain(void)

Line 799 ip_drain(void)

}

* Do option processing on a datagram,

* ip_dooptions: perform option processing on a datagram, possibly discarding

* possibly discarding it if bad options are encountered,

* it if bad options are encountered, or forwarding it if source-routed.

* or forwarding it if source-routed.

* Returns 1 if packet has been forwarded/freed,

* => Returns true if packet has been forwarded/freed.

* 0 if the packet should be processed further.

* => Returns false if the packet should be processed further.

int

static bool

ip_dooptions(struct mbuf *m)

{

struct ip *ip = mtod(m, struct ip *);

Line 1211 ip_dooptions(struct mbuf *m)

Line 1021 ip_dooptions(struct mbuf *m)

goto bad;

}

ip_forward(m, 1);

return (1);

return true;

}

return (0);

return false;

bad:

icmp_error(m, type, code, 0, 0);

IP_STATINC(IP_STAT_BADOPTIONS);

return (1);

return true;

}

* Given address of next destination (final or next hop),

* ip_rtaddr: given address of next destination (final or next hop),

* return internet address info of interface to be used to get there.

struct in_ifaddr *

static struct in_ifaddr *

ip_rtaddr(struct in_addr dst)

{

struct rtentry *rt;

Line 1242 ip_rtaddr(struct in_addr dst)

Line 1052 ip_rtaddr(struct in_addr dst)

}

* Save incoming source route for use in replies,

* save_rte: save incoming source route for use in replies, to be picked

* to be picked up later by ip_srcroute if the receiver is interested.

* up later by ip_srcroute if the receiver is interested.

void

static void

save_rte(u_char *option, struct in_addr dst)

{

unsigned olen;

olen = option[IPOPT_OLEN];

#ifdef DIAGNOSTIC

if (ipprintfs)

printf("save_rte: olen %d\n", olen);

#endif /* 0 */

if (olen > sizeof(ip_srcrt) - (1 + sizeof(dst)))

return;

memcpy((void *)ip_srcrt.srcopt, (void *)option, olen);

Line 1285 ip_srcroute(void)

Line 1091 ip_srcroute(void)

/* length is (nhops+1)*sizeof(addr) + sizeof(nop + srcrt header) */

m->m_len = ip_nhops * sizeof(struct in_addr) + sizeof(struct in_addr) +

OPTSIZ;

#ifdef DIAGNOSTIC

if (ipprintfs)

printf("ip_srcroute: nhops %d mlen %d", ip_nhops, m->m_len);

#endif

* First save first hop for return route

p = &ip_srcrt.route[ip_nhops - 1];

*(mtod(m, struct in_addr *)) = *p--;

#ifdef DIAGNOSTIC

if (ipprintfs)

printf(" hops %x", ntohl(mtod(m, struct in_addr *)->s_addr));

#endif

* Copy option fields and padding (nop) to mbuf.

Line 1315 ip_srcroute(void)

Line 1113 ip_srcroute(void)

* reversing the path (pointers are now aligned).

while (p >= ip_srcrt.route) {

#ifdef DIAGNOSTIC

if (ipprintfs)

printf(" %x", ntohl(q->s_addr));

#endif

*q++ = *p--;

}

* Last hop goes to final destination.

*q = ip_srcrt.dst;

#ifdef DIAGNOSTIC

if (ipprintfs)

printf(" %x\n", ntohl(q->s_addr));

#endif

return (m);

}

Line 1344 const int inetctlerrmap[PRC_NCMDS] = {

Line 1134 const int inetctlerrmap[PRC_NCMDS] = {

[PRC_PARAMPROB] = ENOPROTOOPT,

};

void

ip_fasttimo(void)

{

if (ip_drainwanted) {

ip_drain();

ip_drainwanted = 0;

}

void

ip_drainstub(void)

{

ip_drainwanted = 1;

}

* Forward a packet. If some error occurs return the sender

* an icmp packet. Note we can't always generate a meaningful

Line 1358 const int inetctlerrmap[PRC_NCMDS] = {

Line 1163 const int inetctlerrmap[PRC_NCMDS] = {

* The srcrt parameter indicates whether the packet is being forwarded

* via a source route.

void

static void

ip_forward(struct mbuf *m, int srcrt)

{

struct ip *ip = mtod(m, struct ip *);

Line 1382 ip_forward(struct mbuf *m, int srcrt)

Line 1187 ip_forward(struct mbuf *m, int srcrt)

m->m_pkthdr.csum_flags = 0;

dest = 0;

#ifdef DIAGNOSTIC

if (ipprintfs) {

printf("forward: src %s ", inet_ntoa(ip->ip_src));

printf("dst %s ttl %x\n", inet_ntoa(ip->ip_dst), ip->ip_ttl);

}

#endif

if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(ip->ip_dst) == 0) {

IP_STATINC(IP_STAT_CANTFORWARD);

m_freem(m);

Line 1440 ip_forward(struct mbuf *m, int srcrt)

Line 1239 ip_forward(struct mbuf *m, int srcrt)

type = ICMP_REDIRECT;

code = ICMP_REDIRECT_HOST;

#ifdef DIAGNOSTIC

if (ipprintfs)

printf("redirect (%d) to %x\n", code,

(u_int32_t)dest);

#endif

}

error = ip_output(m, NULL, &ipforward_rt,

(IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)),

(struct ip_moptions *)NULL, (struct socket *)NULL);

NULL, NULL);

if (error)

IP_STATINC(IP_STAT_CANTFORWARD);

Line 1496 ip_forward(struct mbuf *m, int srcrt)

Line 1290 ip_forward(struct mbuf *m, int srcrt)

if ((rt = rtcache_validate(&ipforward_rt)) != NULL)

destmtu = rt->rt_ifp->if_mtu;

#ifdef IPSEC

#if defined(IPSEC) || defined(FAST_IPSEC)

(void)ipsec4_forward(mcopy, &destmtu);

{

* If the packet is routed over IPsec tunnel, tell the

* originator the tunnel MTU.

* tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz

* XXX quickhack!!!

struct secpolicy *sp;

int ipsecerror;

size_t ipsechdr;

struct route *ro;

sp = ipsec4_getpolicybyaddr(mcopy,

IPSEC_DIR_OUTBOUND, IP_FORWARDING,

&ipsecerror);

if (sp != NULL) {

/* count IPsec header size */

ipsechdr = ipsec4_hdrsiz(mcopy,

IPSEC_DIR_OUTBOUND, NULL);

* find the correct route for outer IPv4

* header, compute tunnel MTU.

if (sp->req != NULL

&& sp->req->sav != NULL

&& sp->req->sav->sah != NULL) {

ro = &sp->req->sav->sah->sa_route;

rt = rtcache_validate(ro);

if (rt && rt->rt_ifp) {

destmtu =

rt->rt_rmx.rmx_mtu ?

rt->rt_rmx.rmx_mtu :

rt->rt_ifp->if_mtu;

destmtu -= ipsechdr;

}

#ifdef IPSEC

key_freesp(sp);

#else

KEY_FREESP(&sp);

#endif

}

#endif /*defined(IPSEC) || defined(FAST_IPSEC)*/

IP_STATINC(IP_STAT_CANTFRAG);

break;

case ENOBUFS:

#if 1

* a router should not generate ICMP_SOURCEQUENCH as

* Do not generate ICMP_SOURCEQUENCH as required in RFC 1812,

* required in RFC1812 Requirements for IP Version 4 Routers.

* Requirements for IP Version 4 Routers. Source quench can

* source quench could be a big problem under DoS attacks,

* big problem under DoS attacks or if the underlying

* or if the underlying interface is rate-limited.

* interface is rate-limited.

if (mcopy)

m_freem(mcopy);

return;

#else

type = ICMP_SOURCEQUENCH;

code = 0;

break;

#endif

}

icmp_error(mcopy, type, code, dest, destmtu);

}

Line 1574 void

Line 1314 void

ip_savecontrol(struct inpcb *inp, struct mbuf **mp, struct ip *ip,

struct mbuf *m)

{

struct socket *so = inp->inp_socket;

ifnet_t *ifp = m->m_pkthdr.rcvif;

int inpflags = inp->inp_flags;

if (inp->inp_socket->so_options & SO_TIMESTAMP

if (so->so_options & SO_TIMESTAMP

#ifdef SO_OTIMESTAMP

|| inp->inp_socket->so_options & SO_OTIMESTAMP

|| so->so_options & SO_OTIMESTAMP

#endif

) {

struct timeval tv;

microtime(&tv);

#ifdef SO_OTIMESTAMP

if (inp->inp_socket->so_options & SO_OTIMESTAMP) {

if (so->so_options & SO_OTIMESTAMP) {

struct timeval50 tv50;

timeval_to_timeval50(&tv, &tv50);

*mp = sbcreatecontrol((void *) &tv50, sizeof(tv50),

Line 1596 ip_savecontrol(struct inpcb *inp, struct

Line 1339 ip_savecontrol(struct inpcb *inp, struct

if (*mp)

mp = &(*mp)->m_next;

}

if (inp->inp_flags & INP_RECVDSTADDR) {

if (inpflags & INP_RECVDSTADDR) {

*mp = sbcreatecontrol((void *) &ip->ip_dst,

sizeof(struct in_addr), IP_RECVDSTADDR, IPPROTO_IP);

if (*mp)

mp = &(*mp)->m_next;

}

#ifdef notyet

if (inpflags & INP_RECVPKTINFO) {

struct in_pktinfo ipi;

* XXX

ipi.ipi_addr = ip->ip_src;

* Moving these out of udp_input() made them even more broken

ipi.ipi_ifindex = ifp->if_index;

* than they already were.

*mp = sbcreatecontrol((void *) &ipi,

* - fenner@parc.xerox.com

sizeof(ipi), IP_RECVPKTINFO, IPPROTO_IP);

/* options were tossed already */

if (inp->inp_flags & INP_RECVOPTS) {

*mp = sbcreatecontrol((void *) opts_deleted_above,

sizeof(struct in_addr), IP_RECVOPTS, IPPROTO_IP);

if (*mp)

mp = &(*mp)->m_next;

}

/* ip_srcroute doesn't do what we want here, need to fix */

if (inpflags & INP_PKTINFO) {

if (inp->inp_flags & INP_RECVRETOPTS) {

struct in_pktinfo ipi;

*mp = sbcreatecontrol((void *) ip_srcroute(),

ipi.ipi_addr = ip->ip_dst;

sizeof(struct in_addr), IP_RECVRETOPTS, IPPROTO_IP);

ipi.ipi_ifindex = ifp->if_index;

*mp = sbcreatecontrol((void *) &ipi,

sizeof(ipi), IP_PKTINFO, IPPROTO_IP);

if (*mp)

mp = &(*mp)->m_next;

}

#endif

if (inpflags & INP_RECVIF) {

if (inp->inp_flags & INP_RECVIF) {

struct sockaddr_dl sdl;

sockaddr_dl_init(&sdl, sizeof(sdl),

sockaddr_dl_init(&sdl, sizeof(sdl), ifp ?

(m->m_pkthdr.rcvif != NULL)

ifp->if_index : 0, 0, NULL, 0, NULL, 0);

? m->m_pkthdr.rcvif->if_index

: 0,

0, NULL, 0, NULL, 0);

*mp = sbcreatecontrol(&sdl, sdl.sdl_len, IP_RECVIF, IPPROTO_IP);

if (*mp)

mp = &(*mp)->m_next;

}

if (inp->inp_flags & INP_RECVTTL) {

if (inpflags & INP_RECVTTL) {

*mp = sbcreatecontrol((void *) &ip->ip_ttl,

sizeof(uint8_t), IP_RECVTTL, IPPROTO_IP);

if (*mp)

Line 1699 sysctl_net_inet_ip_pmtudto(SYSCTLFN_ARGS

Line 1435 sysctl_net_inet_ip_pmtudto(SYSCTLFN_ARGS

return (0);

}

#ifdef GATEWAY

* sysctl helper routine for net.inet.ip.maxflows.

static int

sysctl_net_inet_ip_maxflows(SYSCTLFN_ARGS)

{

int error;

error = sysctl_lookup(SYSCTLFN_CALL(rnode));

if (error || newp == NULL)

return (error);

mutex_enter(softnet_lock);

KERNEL_LOCK(1, NULL);

ipflow_prune();

KERNEL_UNLOCK_ONE(NULL);

mutex_exit(softnet_lock);

return (0);

}

static int

sysctl_net_inet_ip_hashsize(SYSCTLFN_ARGS)

{

int error, tmp;

struct sysctlnode node;

node = *rnode;

tmp = ip_hashsize;

node.sysctl_data = &tmp;

error = sysctl_lookup(SYSCTLFN_CALL(&node));

if (error || newp == NULL)

return (error);

if ((tmp & (tmp - 1)) == 0 && tmp != 0) {

* Can only fail due to malloc()

mutex_enter(softnet_lock);

KERNEL_LOCK(1, NULL);

error = ipflow_invalidate_all(tmp);

KERNEL_UNLOCK_ONE(NULL);

mutex_exit(softnet_lock);

} else {

* EINVAL if not a power of 2

error = EINVAL;

}

return error;

}

#endif /* GATEWAY */

static int

sysctl_net_inet_ip_stats(SYSCTLFN_ARGS)

{

Line 1769 sysctl_net_inet_ip_stats(SYSCTLFN_ARGS)

Line 1445 sysctl_net_inet_ip_stats(SYSCTLFN_ARGS)

static void

sysctl_net_inet_ip_setup(struct sysctllog **clog)

{

extern int subnetsarelocal, hostzeroisbroadcast;

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT,

CTLTYPE_NODE, "net", NULL,

NULL, 0, NULL, 0,

CTL_NET, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT,

CTLTYPE_NODE, "inet",

Line 1841 sysctl_net_inet_ip_setup(struct sysctllo

Line 1510 sysctl_net_inet_ip_setup(struct sysctllo

NULL, 0, &ip_allowsrcrt, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_ALLOWSRCRT, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "subnetsarelocal",

SYSCTL_DESCR("Whether logical subnets are considered "

"local"),

NULL, 0, &subnetsarelocal, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_SUBNETSARELOCAL, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "mtudisc",

Line 1874 sysctl_net_inet_ip_setup(struct sysctllo

Line 1536 sysctl_net_inet_ip_setup(struct sysctllo

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "mtudisctimeout",

SYSCTL_DESCR("Lifetime of a Path MTU Discovered route"),

sysctl_net_inet_ip_pmtudto, 0, &ip_mtudisc_timeout, 0,

sysctl_net_inet_ip_pmtudto, 0, (void *)&ip_mtudisc_timeout, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_MTUDISCTIMEOUT, CTL_EOL);

#ifdef GATEWAY

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "maxflows",

SYSCTL_DESCR("Number of flows for fast forwarding"),

sysctl_net_inet_ip_maxflows, 0, &ip_maxflows, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_MAXFLOWS, CTL_EOL);

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "hashsize",

SYSCTL_DESCR("Size of hash table for fast forwarding (IPv4)"),

sysctl_net_inet_ip_hashsize, 0, &ip_hashsize, 0,

CTL_NET, PF_INET, IPPROTO_IP,

CTL_CREATE, CTL_EOL);

#endif /* GATEWAY */

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_INT, "hostzerobroadcast",

SYSCTL_DESCR("All zeroes address is broadcast address"),

NULL, 0, &hostzeroisbroadcast, 0,

CTL_NET, PF_INET, IPPROTO_IP,

IPCTL_HOSTZEROBROADCAST, CTL_EOL);

#if NGIF > 0

sysctl_createv(clog, 0, NULL, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

Line 1965 sysctl_net_inet_ip_setup(struct sysctllo

Line 1604 sysctl_net_inet_ip_setup(struct sysctllo

sysctl_net_inet_ip_stats, 0, NULL, 0,

CTL_NET, PF_INET, IPPROTO_IP, IPCTL_STATS,

CTL_EOL);

/* anonportalgo RFC6056 subtree */

const struct sysctlnode *portalgo_node;

sysctl_createv(clog, 0, NULL, &portalgo_node,

CTLFLAG_PERMANENT,

CTLTYPE_NODE, "anonportalgo",

SYSCTL_DESCR("Anonymous Port Algorithm Selection (RFC 6056)"),

NULL, 0, NULL, 0,

CTL_NET, PF_INET, IPPROTO_IP, CTL_CREATE, CTL_EOL);

sysctl_createv(clog, 0, &portalgo_node, NULL,

CTLFLAG_PERMANENT,

CTLTYPE_STRING, "available",

SYSCTL_DESCR("available algorithms"),

sysctl_portalgo_available, 0, NULL, PORTALGO_MAXLEN,

CTL_CREATE, CTL_EOL);

sysctl_createv(clog, 0, &portalgo_node, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_STRING, "selected",

SYSCTL_DESCR("selected algorithm"),

sysctl_portalgo_selected4, 0, NULL, PORTALGO_MAXLEN,

CTL_CREATE, CTL_EOL);

sysctl_createv(clog, 0, &portalgo_node, NULL,

CTLFLAG_PERMANENT|CTLFLAG_READWRITE,

CTLTYPE_STRUCT, "reserve",

SYSCTL_DESCR("bitmap of reserved ports"),

sysctl_portalgo_reserve4, 0, NULL, 0,

CTL_CREATE, CTL_EOL);

}

void

CVSweb <webmaster@jp.NetBSD.org>