![[BACK]](/icons/back.gif){kind=icon}
Return to ip_output.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / netinet|
Return to ip_output.c CVS log | Up to [local] / sys / netinet |
1.1 ! nbrk 1: /* $OpenBSD: ip_output.c,v 1.188 2007/07/20 19:00:35 claudio Exp $ */
! 2: /* $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $ */
! 3:
! 4: /*
! 5: * Copyright (c) 1982, 1986, 1988, 1990, 1993
! 6: * The Regents of the University of California. All rights reserved.
! 7: *
! 8: * Redistribution and use in source and binary forms, with or without
! 9: * modification, are permitted provided that the following conditions
! 10: * are met:
! 11: * 1. Redistributions of source code must retain the above copyright
! 12: * notice, this list of conditions and the following disclaimer.
! 13: * 2. Redistributions in binary form must reproduce the above copyright
! 14: * notice, this list of conditions and the following disclaimer in the
! 15: * documentation and/or other materials provided with the distribution.
! 16: * 3. Neither the name of the University nor the names of its contributors
! 17: * may be used to endorse or promote products derived from this software
! 18: * without specific prior written permission.
! 19: *
! 20: * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
! 21: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
! 22: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
! 23: * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
! 24: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
! 25: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
! 26: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
! 27: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
! 28: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
! 29: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
! 30: * SUCH DAMAGE.
! 31: *
! 32: * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
! 33: */
! 34:
! 35: #include "pf.h"
! 36:
! 37: #include <sys/param.h>
! 38: #include <sys/systm.h>
! 39: #include <sys/mbuf.h>
! 40: #include <sys/protosw.h>
! 41: #include <sys/socket.h>
! 42: #include <sys/socketvar.h>
! 43: #include <sys/proc.h>
! 44: #include <sys/kernel.h>
! 45:
! 46: #include <net/if.h>
! 47: #include <net/if_enc.h>
! 48: #include <net/route.h>
! 49:
! 50: #include <netinet/in.h>
! 51: #include <netinet/in_systm.h>
! 52: #include <netinet/ip.h>
! 53: #include <netinet/in_pcb.h>
! 54: #include <netinet/in_var.h>
! 55: #include <netinet/ip_var.h>
! 56: #include <netinet/ip_icmp.h>
! 57: #include <netinet/tcp.h>
! 58: #include <netinet/udp.h>
! 59: #include <netinet/tcp_timer.h>
! 60: #include <netinet/tcp_var.h>
! 61: #include <netinet/udp_var.h>
! 62:
! 63: #if NPF > 0
! 64: #include <net/pfvar.h>
! 65: #endif
! 66:
! 67: #ifdef IPSEC
! 68: #ifdef ENCDEBUG
! 69: #define DPRINTF(x) do { if (encdebug) printf x ; } while (0)
! 70: #else
! 71: #define DPRINTF(x)
! 72: #endif
! 73:
! 74: extern u_int8_t get_sa_require(struct inpcb *);
! 75:
! 76: extern int ipsec_auth_default_level;
! 77: extern int ipsec_esp_trans_default_level;
! 78: extern int ipsec_esp_network_default_level;
! 79: extern int ipsec_ipcomp_default_level;
! 80: extern int ipforwarding;
! 81: #endif /* IPSEC */
! 82:
! 83: #ifdef MROUTING
! 84: extern int ipmforwarding;
! 85: #endif
! 86:
! 87: struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *);
! 88: void ip_mloopback(struct ifnet *, struct mbuf *, struct sockaddr_in *);
! 89:
! 90: /*
! 91: * IP output. The packet in mbuf chain m contains a skeletal IP
! 92: * header (with len, off, ttl, proto, tos, src, dst).
! 93: * The mbuf chain containing the packet will be freed.
! 94: * The mbuf opt, if present, will not be freed.
! 95: */
! 96: int
! 97: ip_output(struct mbuf *m0, ...)
! 98: {
! 99: struct ip *ip;
! 100: struct ifnet *ifp;
! 101: struct mbuf *m = m0;
! 102: int hlen = sizeof (struct ip);
! 103: int len, error = 0;
! 104: struct route iproute;
! 105: struct sockaddr_in *dst;
! 106: struct in_ifaddr *ia;
! 107: struct mbuf *opt;
! 108: struct route *ro;
! 109: int flags;
! 110: struct ip_moptions *imo;
! 111: va_list ap;
! 112: u_int8_t sproto = 0, donerouting = 0;
! 113: u_long mtu;
! 114: #ifdef IPSEC
! 115: u_int32_t icmp_mtu = 0;
! 116: union sockaddr_union sdst;
! 117: u_int32_t sspi;
! 118: struct m_tag *mtag;
! 119: struct tdb_ident *tdbi;
! 120:
! 121: struct inpcb *inp;
! 122: struct tdb *tdb;
! 123: int s;
! 124: #endif /* IPSEC */
! 125:
! 126: va_start(ap, m0);
! 127: opt = va_arg(ap, struct mbuf *);
! 128: ro = va_arg(ap, struct route *);
! 129: flags = va_arg(ap, int);
! 130: imo = va_arg(ap, struct ip_moptions *);
! 131: #ifdef IPSEC
! 132: inp = va_arg(ap, struct inpcb *);
! 133: if (inp && (inp->inp_flags & INP_IPV6) != 0)
! 134: panic("ip_output: IPv6 pcb is passed");
! 135: #endif /* IPSEC */
! 136: va_end(ap);
! 137:
! 138: #ifdef DIAGNOSTIC
! 139: if ((m->m_flags & M_PKTHDR) == 0)
! 140: panic("ip_output no HDR");
! 141: #endif
! 142: if (opt) {
! 143: m = ip_insertoptions(m, opt, &len);
! 144: hlen = len;
! 145: }
! 146:
! 147: ip = mtod(m, struct ip *);
! 148:
! 149: /*
! 150: * Fill in IP header.
! 151: */
! 152: if ((flags & (IP_FORWARDING|IP_RAWOUTPUT)) == 0) {
! 153: ip->ip_v = IPVERSION;
! 154: ip->ip_off &= htons(IP_DF);
! 155: ip->ip_id = htons(ip_randomid());
! 156: ip->ip_hl = hlen >> 2;
! 157: ipstat.ips_localout++;
! 158: } else {
! 159: hlen = ip->ip_hl << 2;
! 160: }
! 161:
! 162: /*
! 163: * If we're missing the IP source address, do a route lookup. We'll
! 164: * remember this result, in case we don't need to do any IPsec
! 165: * processing on the packet. We need the source address so we can
! 166: * do an SPD lookup in IPsec; for most packets, the source address
! 167: * is set at a higher level protocol. ICMPs and other packets
! 168: * though (e.g., traceroute) have a source address of zeroes.
! 169: */
! 170: if (ip->ip_src.s_addr == INADDR_ANY) {
! 171: if (flags & IP_ROUTETOETHER) {
! 172: error = EINVAL;
! 173: goto bad;
! 174: }
! 175: donerouting = 1;
! 176:
! 177: if (ro == 0) {
! 178: ro = &iproute;
! 179: bzero((caddr_t)ro, sizeof (*ro));
! 180: }
! 181:
! 182: dst = satosin(&ro->ro_dst);
! 183:
! 184: /*
! 185: * If there is a cached route, check that it is to the same
! 186: * destination and is still up. If not, free it and try again.
! 187: */
! 188: if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
! 189: dst->sin_addr.s_addr != ip->ip_dst.s_addr)) {
! 190: RTFREE(ro->ro_rt);
! 191: ro->ro_rt = (struct rtentry *)0;
! 192: }
! 193:
! 194: if (ro->ro_rt == 0) {
! 195: dst->sin_family = AF_INET;
! 196: dst->sin_len = sizeof(*dst);
! 197: dst->sin_addr = ip->ip_dst;
! 198: }
! 199:
! 200: /*
! 201: * If routing to interface only, short-circuit routing lookup.
! 202: */
! 203: if (flags & IP_ROUTETOIF) {
! 204: if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == 0 &&
! 205: (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == 0) {
! 206: ipstat.ips_noroute++;
! 207: error = ENETUNREACH;
! 208: goto bad;
! 209: }
! 210:
! 211: ifp = ia->ia_ifp;
! 212: mtu = ifp->if_mtu;
! 213: ip->ip_ttl = 1;
! 214: } else if ((IN_MULTICAST(ip->ip_dst.s_addr) ||
! 215: (ip->ip_dst.s_addr == INADDR_BROADCAST)) &&
! 216: imo != NULL && imo->imo_multicast_ifp != NULL) {
! 217: ifp = imo->imo_multicast_ifp;
! 218: mtu = ifp->if_mtu;
! 219: IFP_TO_IA(ifp, ia);
! 220: } else {
! 221: if (ro->ro_rt == 0)
! 222: rtalloc_mpath(ro, NULL, 0);
! 223:
! 224: if (ro->ro_rt == 0) {
! 225: ipstat.ips_noroute++;
! 226: error = EHOSTUNREACH;
! 227: goto bad;
! 228: }
! 229:
! 230: ia = ifatoia(ro->ro_rt->rt_ifa);
! 231: ifp = ro->ro_rt->rt_ifp;
! 232: if ((mtu = ro->ro_rt->rt_rmx.rmx_mtu) == 0)
! 233: mtu = ifp->if_mtu;
! 234: ro->ro_rt->rt_use++;
! 235:
! 236: if (ro->ro_rt->rt_flags & RTF_GATEWAY)
! 237: dst = satosin(ro->ro_rt->rt_gateway);
! 238: }
! 239:
! 240: /* Set the source IP address */
! 241: if (!IN_MULTICAST(ip->ip_dst.s_addr))
! 242: ip->ip_src = ia->ia_addr.sin_addr;
! 243: }
! 244:
! 245: #ifdef IPSEC
! 246: if (!ipsec_in_use && inp == NULL)
! 247: goto done_spd;
! 248:
! 249: /*
! 250: * splnet is chosen over spltdb because we are not allowed to
! 251: * lower the level, and udp_output calls us in splnet().
! 252: */
! 253: s = splnet();
! 254:
! 255: /* Do we have any pending SAs to apply ? */
! 256: mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL);
! 257: if (mtag != NULL) {
! 258: #ifdef DIAGNOSTIC
! 259: if (mtag->m_tag_len != sizeof (struct tdb_ident))
! 260: panic("ip_output: tag of length %d (should be %d",
! 261: mtag->m_tag_len, sizeof (struct tdb_ident));
! 262: #endif
! 263: tdbi = (struct tdb_ident *)(mtag + 1);
! 264: tdb = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto);
! 265: if (tdb == NULL)
! 266: error = -EINVAL;
! 267: m_tag_delete(m, mtag);
! 268: }
! 269: else
! 270: tdb = ipsp_spd_lookup(m, AF_INET, hlen, &error,
! 271: IPSP_DIRECTION_OUT, NULL, inp);
! 272:
! 273: if (tdb == NULL) {
! 274: splx(s);
! 275:
! 276: if (error == 0) {
! 277: /*
! 278: * No IPsec processing required, we'll just send the
! 279: * packet out.
! 280: */
! 281: sproto = 0;
! 282:
! 283: /* Fall through to routing/multicast handling */
! 284: } else {
! 285: /*
! 286: * -EINVAL is used to indicate that the packet should
! 287: * be silently dropped, typically because we've asked
! 288: * key management for an SA.
! 289: */
! 290: if (error == -EINVAL) /* Should silently drop packet */
! 291: error = 0;
! 292:
! 293: m_freem(m);
! 294: goto done;
! 295: }
! 296: } else {
! 297: /* Loop detection */
! 298: for (mtag = m_tag_first(m); mtag != NULL;
! 299: mtag = m_tag_next(m, mtag)) {
! 300: if (mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_DONE &&
! 301: mtag->m_tag_id !=
! 302: PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED)
! 303: continue;
! 304: tdbi = (struct tdb_ident *)(mtag + 1);
! 305: if (tdbi->spi == tdb->tdb_spi &&
! 306: tdbi->proto == tdb->tdb_sproto &&
! 307: !bcmp(&tdbi->dst, &tdb->tdb_dst,
! 308: sizeof(union sockaddr_union))) {
! 309: splx(s);
! 310: sproto = 0; /* mark as no-IPsec-needed */
! 311: goto done_spd;
! 312: }
! 313: }
! 314:
! 315: /* We need to do IPsec */
! 316: bcopy(&tdb->tdb_dst, &sdst, sizeof(sdst));
! 317: sspi = tdb->tdb_spi;
! 318: sproto = tdb->tdb_sproto;
! 319: splx(s);
! 320:
! 321: /*
! 322: * If it needs TCP/UDP hardware-checksumming, do the
! 323: * computation now.
! 324: */
! 325: if (m->m_pkthdr.csum_flags & (M_TCPV4_CSUM_OUT | M_UDPV4_CSUM_OUT)) {
! 326: in_delayed_cksum(m);
! 327: m->m_pkthdr.csum_flags &=
! 328: ~(M_UDPV4_CSUM_OUT | M_TCPV4_CSUM_OUT);
! 329: }
! 330:
! 331: /* If it's not a multicast packet, try to fast-path */
! 332: if (!IN_MULTICAST(ip->ip_dst.s_addr)) {
! 333: goto sendit;
! 334: }
! 335: }
! 336:
! 337: /* Fall through to the routing/multicast handling code */
! 338: done_spd:
! 339: #endif /* IPSEC */
! 340:
! 341: if (flags & IP_ROUTETOETHER) {
! 342: dst = satosin(&ro->ro_dst);
! 343: ifp = ro->ro_rt->rt_ifp;
! 344: mtu = ifp->if_mtu;
! 345: ro->ro_rt = NULL;
! 346: } else if (donerouting == 0) {
! 347: if (ro == 0) {
! 348: ro = &iproute;
! 349: bzero((caddr_t)ro, sizeof (*ro));
! 350: }
! 351:
! 352: dst = satosin(&ro->ro_dst);
! 353:
! 354: /*
! 355: * If there is a cached route, check that it is to the same
! 356: * destination and is still up. If not, free it and try again.
! 357: */
! 358: if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
! 359: dst->sin_addr.s_addr != ip->ip_dst.s_addr)) {
! 360: RTFREE(ro->ro_rt);
! 361: ro->ro_rt = (struct rtentry *)0;
! 362: }
! 363:
! 364: if (ro->ro_rt == 0) {
! 365: dst->sin_family = AF_INET;
! 366: dst->sin_len = sizeof(*dst);
! 367: dst->sin_addr = ip->ip_dst;
! 368: }
! 369:
! 370: /*
! 371: * If routing to interface only, short-circuit routing lookup.
! 372: */
! 373: if (flags & IP_ROUTETOIF) {
! 374: if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == 0 &&
! 375: (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == 0) {
! 376: ipstat.ips_noroute++;
! 377: error = ENETUNREACH;
! 378: goto bad;
! 379: }
! 380:
! 381: ifp = ia->ia_ifp;
! 382: mtu = ifp->if_mtu;
! 383: ip->ip_ttl = 1;
! 384: } else if ((IN_MULTICAST(ip->ip_dst.s_addr) ||
! 385: (ip->ip_dst.s_addr == INADDR_BROADCAST)) &&
! 386: imo != NULL && imo->imo_multicast_ifp != NULL) {
! 387: ifp = imo->imo_multicast_ifp;
! 388: mtu = ifp->if_mtu;
! 389: IFP_TO_IA(ifp, ia);
! 390: } else {
! 391: if (ro->ro_rt == 0)
! 392: rtalloc_mpath(ro, &ip->ip_src.s_addr, 0);
! 393:
! 394: if (ro->ro_rt == 0) {
! 395: ipstat.ips_noroute++;
! 396: error = EHOSTUNREACH;
! 397: goto bad;
! 398: }
! 399:
! 400: ia = ifatoia(ro->ro_rt->rt_ifa);
! 401: ifp = ro->ro_rt->rt_ifp;
! 402: if ((mtu = ro->ro_rt->rt_rmx.rmx_mtu) == 0)
! 403: mtu = ifp->if_mtu;
! 404: ro->ro_rt->rt_use++;
! 405:
! 406: if (ro->ro_rt->rt_flags & RTF_GATEWAY)
! 407: dst = satosin(ro->ro_rt->rt_gateway);
! 408: }
! 409:
! 410: /* Set the source IP address */
! 411: if (ip->ip_src.s_addr == INADDR_ANY)
! 412: ip->ip_src = ia->ia_addr.sin_addr;
! 413: }
! 414:
! 415: if (IN_MULTICAST(ip->ip_dst.s_addr) ||
! 416: (ip->ip_dst.s_addr == INADDR_BROADCAST)) {
! 417: struct in_multi *inm;
! 418:
! 419: m->m_flags |= (ip->ip_dst.s_addr == INADDR_BROADCAST) ?
! 420: M_BCAST : M_MCAST;
! 421:
! 422: /*
! 423: * IP destination address is multicast. Make sure "dst"
! 424: * still points to the address in "ro". (It may have been
! 425: * changed to point to a gateway address, above.)
! 426: */
! 427: dst = satosin(&ro->ro_dst);
! 428:
! 429: /*
! 430: * See if the caller provided any multicast options
! 431: */
! 432: if (imo != NULL)
! 433: ip->ip_ttl = imo->imo_multicast_ttl;
! 434: else
! 435: ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL;
! 436:
! 437: /*
! 438: * if we don't know the outgoing ifp yet, we can't generate
! 439: * output
! 440: */
! 441: if (!ifp) {
! 442: ipstat.ips_noroute++;
! 443: error = EHOSTUNREACH;
! 444: goto bad;
! 445: }
! 446:
! 447: /*
! 448: * Confirm that the outgoing interface supports multicast,
! 449: * but only if the packet actually is going out on that
! 450: * interface (i.e., no IPsec is applied).
! 451: */
! 452: if ((((m->m_flags & M_MCAST) &&
! 453: (ifp->if_flags & IFF_MULTICAST) == 0) ||
! 454: ((m->m_flags & M_BCAST) &&
! 455: (ifp->if_flags & IFF_BROADCAST) == 0)) && (sproto == 0)) {
! 456: ipstat.ips_noroute++;
! 457: error = ENETUNREACH;
! 458: goto bad;
! 459: }
! 460:
! 461: /*
! 462: * If source address not specified yet, use address
! 463: * of outgoing interface.
! 464: */
! 465: if (ip->ip_src.s_addr == INADDR_ANY) {
! 466: struct in_ifaddr *ia;
! 467:
! 468: TAILQ_FOREACH(ia, &in_ifaddr, ia_list)
! 469: if (ia->ia_ifp == ifp) {
! 470: ip->ip_src = ia->ia_addr.sin_addr;
! 471: break;
! 472: }
! 473: }
! 474:
! 475: IN_LOOKUP_MULTI(ip->ip_dst, ifp, inm);
! 476: if (inm != NULL &&
! 477: (imo == NULL || imo->imo_multicast_loop)) {
! 478: /*
! 479: * If we belong to the destination multicast group
! 480: * on the outgoing interface, and the caller did not
! 481: * forbid loopback, loop back a copy.
! 482: * Can't defer TCP/UDP checksumming, do the
! 483: * computation now.
! 484: */
! 485: if (m->m_pkthdr.csum_flags &
! 486: (M_TCPV4_CSUM_OUT | M_UDPV4_CSUM_OUT)) {
! 487: in_delayed_cksum(m);
! 488: m->m_pkthdr.csum_flags &=
! 489: ~(M_UDPV4_CSUM_OUT | M_TCPV4_CSUM_OUT);
! 490: }
! 491: ip_mloopback(ifp, m, dst);
! 492: }
! 493: #ifdef MROUTING
! 494: else {
! 495: /*
! 496: * If we are acting as a multicast router, perform
! 497: * multicast forwarding as if the packet had just
! 498: * arrived on the interface to which we are about
! 499: * to send. The multicast forwarding function
! 500: * recursively calls this function, using the
! 501: * IP_FORWARDING flag to prevent infinite recursion.
! 502: *
! 503: * Multicasts that are looped back by ip_mloopback(),
! 504: * above, will be forwarded by the ip_input() routine,
! 505: * if necessary.
! 506: */
! 507: extern struct socket *ip_mrouter;
! 508:
! 509: if (ipmforwarding && ip_mrouter &&
! 510: (flags & IP_FORWARDING) == 0) {
! 511: if (ip_mforward(m, ifp) != 0) {
! 512: m_freem(m);
! 513: goto done;
! 514: }
! 515: }
! 516: }
! 517: #endif
! 518: /*
! 519: * Multicasts with a time-to-live of zero may be looped-
! 520: * back, above, but must not be transmitted on a network.
! 521: * Also, multicasts addressed to the loopback interface
! 522: * are not sent -- the above call to ip_mloopback() will
! 523: * loop back a copy if this host actually belongs to the
! 524: * destination group on the loopback interface.
! 525: */
! 526: if (ip->ip_ttl == 0 || (ifp->if_flags & IFF_LOOPBACK) != 0) {
! 527: m_freem(m);
! 528: goto done;
! 529: }
! 530:
! 531: goto sendit;
! 532: }
! 533:
! 534: /*
! 535: * Look for broadcast address and and verify user is allowed to send
! 536: * such a packet; if the packet is going in an IPsec tunnel, skip
! 537: * this check.
! 538: */
! 539: if ((sproto == 0) && (in_broadcast(dst->sin_addr, ifp))) {
! 540: if ((ifp->if_flags & IFF_BROADCAST) == 0) {
! 541: error = EADDRNOTAVAIL;
! 542: goto bad;
! 543: }
! 544: if ((flags & IP_ALLOWBROADCAST) == 0) {
! 545: error = EACCES;
! 546: goto bad;
! 547: }
! 548:
! 549: /* Don't allow broadcast messages to be fragmented */
! 550: if (ntohs(ip->ip_len) > ifp->if_mtu) {
! 551: error = EMSGSIZE;
! 552: goto bad;
! 553: }
! 554: m->m_flags |= M_BCAST;
! 555: } else
! 556: m->m_flags &= ~M_BCAST;
! 557:
! 558: sendit:
! 559: /*
! 560: * If we're doing Path MTU discovery, we need to set DF unless
! 561: * the route's MTU is locked.
! 562: */
! 563: if ((flags & IP_MTUDISC) && ro && ro->ro_rt &&
! 564: (ro->ro_rt->rt_rmx.rmx_locks & RTV_MTU) == 0)
! 565: ip->ip_off |= htons(IP_DF);
! 566:
! 567: #ifdef IPSEC
! 568: /*
! 569: * Check if the packet needs encapsulation.
! 570: */
! 571: if (sproto != 0) {
! 572: s = splnet();
! 573:
! 574: /*
! 575: * Packet filter
! 576: */
! 577: #if NPF > 0
! 578:
! 579: if (pf_test(PF_OUT, &encif[0].sc_if, &m, NULL) != PF_PASS) {
! 580: error = EHOSTUNREACH;
! 581: splx(s);
! 582: m_freem(m);
! 583: goto done;
! 584: }
! 585: if (m == NULL) {
! 586: splx(s);
! 587: goto done;
! 588: }
! 589: ip = mtod(m, struct ip *);
! 590: hlen = ip->ip_hl << 2;
! 591: #endif
! 592:
! 593: tdb = gettdb(sspi, &sdst, sproto);
! 594: if (tdb == NULL) {
! 595: DPRINTF(("ip_output: unknown TDB"));
! 596: error = EHOSTUNREACH;
! 597: splx(s);
! 598: m_freem(m);
! 599: goto done;
! 600: }
! 601:
! 602: /* Check if we are allowed to fragment */
! 603: if (ip_mtudisc && (ip->ip_off & htons(IP_DF)) && tdb->tdb_mtu &&
! 604: ntohs(ip->ip_len) > tdb->tdb_mtu &&
! 605: tdb->tdb_mtutimeout > time_second) {
! 606: struct rtentry *rt = NULL;
! 607: int rt_mtucloned = 0;
! 608: int transportmode = 0;
! 609:
! 610: transportmode = (tdb->tdb_dst.sa.sa_family == AF_INET) &&
! 611: (tdb->tdb_dst.sin.sin_addr.s_addr ==
! 612: ip->ip_dst.s_addr);
! 613: icmp_mtu = tdb->tdb_mtu;
! 614: splx(s);
! 615:
! 616: /* Find a host route to store the mtu in */
! 617: if (ro != NULL)
! 618: rt = ro->ro_rt;
! 619: /* but don't add a PMTU route for transport mode SAs */
! 620: if (transportmode)
! 621: rt = NULL;
! 622: else if (rt == NULL || (rt->rt_flags & RTF_HOST) == 0) {
! 623: struct sockaddr_in dst = {
! 624: sizeof(struct sockaddr_in), AF_INET};
! 625: dst.sin_addr = ip->ip_dst;
! 626: rt = icmp_mtudisc_clone((struct sockaddr *)&dst);
! 627: rt_mtucloned = 1;
! 628: }
! 629: DPRINTF(("ip_output: spi %08x mtu %d rt %p cloned %d\n",
! 630: ntohl(tdb->tdb_spi), icmp_mtu, rt, rt_mtucloned));
! 631: if (rt != NULL) {
! 632: rt->rt_rmx.rmx_mtu = icmp_mtu;
! 633: if (ro && ro->ro_rt != NULL) {
! 634: RTFREE(ro->ro_rt);
! 635: ro->ro_rt = (struct rtentry *) 0;
! 636: rtalloc(ro);
! 637: }
! 638: if (rt_mtucloned)
! 639: rtfree(rt);
! 640: }
! 641: error = EMSGSIZE;
! 642: goto bad;
! 643: }
! 644:
! 645: /*
! 646: * Clear these -- they'll be set in the recursive invocation
! 647: * as needed.
! 648: */
! 649: m->m_flags &= ~(M_MCAST | M_BCAST);
! 650:
! 651: /* Callee frees mbuf */
! 652: error = ipsp_process_packet(m, tdb, AF_INET, 0);
! 653: splx(s);
! 654: return error; /* Nothing more to be done */
! 655: }
! 656:
! 657: /*
! 658: * If deferred crypto processing is needed, check that the
! 659: * interface supports it.
! 660: */
! 661: if (ipsec_in_use && (mtag = m_tag_find(m,
! 662: PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL)) != NULL &&
! 663: (ifp->if_capabilities & IFCAP_IPSEC) == 0) {
! 664: /* Notify IPsec to do its own crypto. */
! 665: ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1));
! 666: m_freem(m);
! 667: error = EHOSTUNREACH;
! 668: goto done;
! 669: }
! 670: #endif /* IPSEC */
! 671:
! 672: /* Catch routing changes wrt. hardware checksumming for TCP or UDP. */
! 673: if (m->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT) {
! 674: if (!(ifp->if_capabilities & IFCAP_CSUM_TCPv4) ||
! 675: ifp->if_bridge != NULL) {
! 676: in_delayed_cksum(m);
! 677: m->m_pkthdr.csum_flags &= ~M_TCPV4_CSUM_OUT; /* Clear */
! 678: }
! 679: } else if (m->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT) {
! 680: if (!(ifp->if_capabilities & IFCAP_CSUM_UDPv4) ||
! 681: ifp->if_bridge != NULL) {
! 682: in_delayed_cksum(m);
! 683: m->m_pkthdr.csum_flags &= ~M_UDPV4_CSUM_OUT; /* Clear */
! 684: }
! 685: }
! 686:
! 687: /*
! 688: * Packet filter
! 689: */
! 690: #if NPF > 0
! 691: if (pf_test(PF_OUT, ifp, &m, NULL) != PF_PASS) {
! 692: error = EHOSTUNREACH;
! 693: m_freem(m);
! 694: goto done;
! 695: }
! 696: if (m == NULL)
! 697: goto done;
! 698:
! 699: ip = mtod(m, struct ip *);
! 700: hlen = ip->ip_hl << 2;
! 701: #endif
! 702:
! 703: #ifdef IPSEC
! 704: if (ipsec_in_use && (flags & IP_FORWARDING) && (ipforwarding == 2) &&
! 705: (m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) == NULL)) {
! 706: error = EHOSTUNREACH;
! 707: m_freem(m);
! 708: goto done;
! 709: }
! 710: #endif
! 711:
! 712: /* XXX
! 713: * Try to use jumbograms based on socket option, or the route
! 714: * or... for other reasons later on.
! 715: */
! 716: if ((flags & IP_JUMBO) && ro->ro_rt && (ro->ro_rt->rt_flags & RTF_JUMBO) &&
! 717: ro->ro_rt->rt_ifp)
! 718: mtu = ro->ro_rt->rt_ifp->if_hardmtu;
! 719:
! 720: /*
! 721: * If small enough for interface, can just send directly.
! 722: */
! 723: if (ntohs(ip->ip_len) <= mtu) {
! 724: if ((ifp->if_capabilities & IFCAP_CSUM_IPv4) &&
! 725: ifp->if_bridge == NULL) {
! 726: m->m_pkthdr.csum_flags |= M_IPV4_CSUM_OUT;
! 727: ipstat.ips_outhwcsum++;
! 728: } else {
! 729: ip->ip_sum = 0;
! 730: ip->ip_sum = in_cksum(m, hlen);
! 731: }
! 732: /* Update relevant hardware checksum stats for TCP/UDP */
! 733: if (m->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT)
! 734: tcpstat.tcps_outhwcsum++;
! 735: else if (m->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT)
! 736: udpstat.udps_outhwcsum++;
! 737: error = (*ifp->if_output)(ifp, m, sintosa(dst), ro->ro_rt);
! 738: goto done;
! 739: }
! 740:
! 741: /*
! 742: * Too large for interface; fragment if possible.
! 743: * Must be able to put at least 8 bytes per fragment.
! 744: */
! 745: if (ip->ip_off & htons(IP_DF)) {
! 746: #ifdef IPSEC
! 747: icmp_mtu = ifp->if_mtu;
! 748: #endif
! 749: error = EMSGSIZE;
! 750: /*
! 751: * This case can happen if the user changed the MTU
! 752: * of an interface after enabling IP on it. Because
! 753: * most netifs don't keep track of routes pointing to
! 754: * them, there is no way for one to update all its
! 755: * routes when the MTU is changed.
! 756: */
! 757: if ((ro->ro_rt->rt_flags & (RTF_UP | RTF_HOST)) &&
! 758: !(ro->ro_rt->rt_rmx.rmx_locks & RTV_MTU) &&
! 759: (ro->ro_rt->rt_rmx.rmx_mtu > ifp->if_mtu)) {
! 760: ro->ro_rt->rt_rmx.rmx_mtu = ifp->if_mtu;
! 761: }
! 762: ipstat.ips_cantfrag++;
! 763: goto bad;
! 764: }
! 765:
! 766: error = ip_fragment(m, ifp, mtu);
! 767: if (error) {
! 768: m = m0 = NULL;
! 769: goto bad;
! 770: }
! 771:
! 772: for (; m; m = m0) {
! 773: m0 = m->m_nextpkt;
! 774: m->m_nextpkt = 0;
! 775: if (error == 0)
! 776: error = (*ifp->if_output)(ifp, m, sintosa(dst),
! 777: ro->ro_rt);
! 778: else
! 779: m_freem(m);
! 780: }
! 781:
! 782: if (error == 0)
! 783: ipstat.ips_fragmented++;
! 784:
! 785: done:
! 786: if (ro == &iproute && (flags & IP_ROUTETOIF) == 0 && ro->ro_rt)
! 787: RTFREE(ro->ro_rt);
! 788: return (error);
! 789: bad:
! 790: #ifdef IPSEC
! 791: if (error == EMSGSIZE && ip_mtudisc && icmp_mtu != 0 && m != NULL)
! 792: ipsec_adjust_mtu(m, icmp_mtu);
! 793: #endif
! 794: m_freem(m0);
! 795: goto done;
! 796: }
! 797:
! 798: int
! 799: ip_fragment(struct mbuf *m, struct ifnet *ifp, u_long mtu)
! 800: {
! 801: struct ip *ip, *mhip;
! 802: struct mbuf *m0;
! 803: int len, hlen, off;
! 804: int mhlen, firstlen;
! 805: struct mbuf **mnext;
! 806: int fragments = 0;
! 807: int s;
! 808: int error = 0;
! 809:
! 810: ip = mtod(m, struct ip *);
! 811: hlen = ip->ip_hl << 2;
! 812:
! 813: len = (mtu - hlen) &~ 7;
! 814: if (len < 8) {
! 815: m_freem(m);
! 816: return (EMSGSIZE);
! 817: }
! 818:
! 819: /*
! 820: * If we are doing fragmentation, we can't defer TCP/UDP
! 821: * checksumming; compute the checksum and clear the flag.
! 822: */
! 823: if (m->m_pkthdr.csum_flags & (M_TCPV4_CSUM_OUT | M_UDPV4_CSUM_OUT)) {
! 824: in_delayed_cksum(m);
! 825: m->m_pkthdr.csum_flags &= ~(M_UDPV4_CSUM_OUT | M_TCPV4_CSUM_OUT);
! 826: }
! 827:
! 828: firstlen = len;
! 829: mnext = &m->m_nextpkt;
! 830:
! 831: /*
! 832: * Loop through length of segment after first fragment,
! 833: * make new header and copy data of each part and link onto chain.
! 834: */
! 835: m0 = m;
! 836: mhlen = sizeof (struct ip);
! 837: for (off = hlen + len; off < ntohs(ip->ip_len); off += len) {
! 838: MGETHDR(m, M_DONTWAIT, MT_HEADER);
! 839: if (m == 0) {
! 840: ipstat.ips_odropped++;
! 841: error = ENOBUFS;
! 842: goto sendorfree;
! 843: }
! 844: *mnext = m;
! 845: mnext = &m->m_nextpkt;
! 846: m->m_data += max_linkhdr;
! 847: mhip = mtod(m, struct ip *);
! 848: *mhip = *ip;
! 849: /* we must inherit MCAST and BCAST flags */
! 850: m->m_flags |= m0->m_flags & (M_MCAST|M_BCAST);
! 851: if (hlen > sizeof (struct ip)) {
! 852: mhlen = ip_optcopy(ip, mhip) + sizeof (struct ip);
! 853: mhip->ip_hl = mhlen >> 2;
! 854: }
! 855: m->m_len = mhlen;
! 856: mhip->ip_off = ((off - hlen) >> 3) +
! 857: (ntohs(ip->ip_off) & ~IP_MF);
! 858: if (ip->ip_off & htons(IP_MF))
! 859: mhip->ip_off |= IP_MF;
! 860: if (off + len >= ntohs(ip->ip_len))
! 861: len = ntohs(ip->ip_len) - off;
! 862: else
! 863: mhip->ip_off |= IP_MF;
! 864: mhip->ip_len = htons((u_int16_t)(len + mhlen));
! 865: m->m_next = m_copy(m0, off, len);
! 866: if (m->m_next == 0) {
! 867: ipstat.ips_odropped++;
! 868: error = ENOBUFS;
! 869: goto sendorfree;
! 870: }
! 871: m->m_pkthdr.len = mhlen + len;
! 872: m->m_pkthdr.rcvif = (struct ifnet *)0;
! 873: mhip->ip_off = htons((u_int16_t)mhip->ip_off);
! 874: if ((ifp != NULL) &&
! 875: (ifp->if_capabilities & IFCAP_CSUM_IPv4) &&
! 876: ifp->if_bridge == NULL) {
! 877: m->m_pkthdr.csum_flags |= M_IPV4_CSUM_OUT;
! 878: ipstat.ips_outhwcsum++;
! 879: } else {
! 880: mhip->ip_sum = 0;
! 881: mhip->ip_sum = in_cksum(m, mhlen);
! 882: }
! 883: ipstat.ips_ofragments++;
! 884: fragments++;
! 885: }
! 886: /*
! 887: * Update first fragment by trimming what's been copied out
! 888: * and updating header, then send each fragment (in order).
! 889: */
! 890: m = m0;
! 891: m_adj(m, hlen + firstlen - ntohs(ip->ip_len));
! 892: m->m_pkthdr.len = hlen + firstlen;
! 893: ip->ip_len = htons((u_int16_t)m->m_pkthdr.len);
! 894: ip->ip_off |= htons(IP_MF);
! 895: if ((ifp != NULL) &&
! 896: (ifp->if_capabilities & IFCAP_CSUM_IPv4) &&
! 897: ifp->if_bridge == NULL) {
! 898: m->m_pkthdr.csum_flags |= M_IPV4_CSUM_OUT;
! 899: ipstat.ips_outhwcsum++;
! 900: } else {
! 901: ip->ip_sum = 0;
! 902: ip->ip_sum = in_cksum(m, hlen);
! 903: }
! 904: sendorfree:
! 905: /*
! 906: * If there is no room for all the fragments, don't queue
! 907: * any of them.
! 908: */
! 909: if (ifp != NULL) {
! 910: s = splnet();
! 911: if (ifp->if_snd.ifq_maxlen - ifp->if_snd.ifq_len < fragments &&
! 912: error == 0) {
! 913: error = ENOBUFS;
! 914: ipstat.ips_odropped++;
! 915: IFQ_INC_DROPS(&ifp->if_snd);
! 916: }
! 917: splx(s);
! 918: }
! 919: if (error) {
! 920: for (m = m0; m; m = m0) {
! 921: m0 = m->m_nextpkt;
! 922: m->m_nextpkt = NULL;
! 923: m_freem(m);
! 924: }
! 925: }
! 926:
! 927: return (error);
! 928: }
! 929:
! 930: /*
! 931: * Insert IP options into preformed packet.
! 932: * Adjust IP destination as required for IP source routing,
! 933: * as indicated by a non-zero in_addr at the start of the options.
! 934: */
! 935: struct mbuf *
! 936: ip_insertoptions(m, opt, phlen)
! 937: struct mbuf *m;
! 938: struct mbuf *opt;
! 939: int *phlen;
! 940: {
! 941: struct ipoption *p = mtod(opt, struct ipoption *);
! 942: struct mbuf *n;
! 943: struct ip *ip = mtod(m, struct ip *);
! 944: unsigned optlen;
! 945:
! 946: optlen = opt->m_len - sizeof(p->ipopt_dst);
! 947: if (optlen + ntohs(ip->ip_len) > IP_MAXPACKET)
! 948: return (m); /* XXX should fail */
! 949: if (p->ipopt_dst.s_addr)
! 950: ip->ip_dst = p->ipopt_dst;
! 951: if (m->m_flags & M_EXT || m->m_data - optlen < m->m_pktdat) {
! 952: MGETHDR(n, M_DONTWAIT, MT_HEADER);
! 953: if (n == 0)
! 954: return (m);
! 955: M_MOVE_HDR(n, m);
! 956: n->m_pkthdr.len += optlen;
! 957: m->m_len -= sizeof(struct ip);
! 958: m->m_data += sizeof(struct ip);
! 959: n->m_next = m;
! 960: m = n;
! 961: m->m_len = optlen + sizeof(struct ip);
! 962: m->m_data += max_linkhdr;
! 963: bcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));
! 964: } else {
! 965: m->m_data -= optlen;
! 966: m->m_len += optlen;
! 967: m->m_pkthdr.len += optlen;
! 968: ovbcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));
! 969: }
! 970: ip = mtod(m, struct ip *);
! 971: bcopy((caddr_t)p->ipopt_list, (caddr_t)(ip + 1), (unsigned)optlen);
! 972: *phlen = sizeof(struct ip) + optlen;
! 973: ip->ip_len = htons(ntohs(ip->ip_len) + optlen);
! 974: return (m);
! 975: }
! 976:
! 977: /*
! 978: * Copy options from ip to jp,
! 979: * omitting those not copied during fragmentation.
! 980: */
! 981: int
! 982: ip_optcopy(ip, jp)
! 983: struct ip *ip, *jp;
! 984: {
! 985: u_char *cp, *dp;
! 986: int opt, optlen, cnt;
! 987:
! 988: cp = (u_char *)(ip + 1);
! 989: dp = (u_char *)(jp + 1);
! 990: cnt = (ip->ip_hl << 2) - sizeof (struct ip);
! 991: for (; cnt > 0; cnt -= optlen, cp += optlen) {
! 992: opt = cp[0];
! 993: if (opt == IPOPT_EOL)
! 994: break;
! 995: if (opt == IPOPT_NOP) {
! 996: /* Preserve for IP mcast tunnel's LSRR alignment. */
! 997: *dp++ = IPOPT_NOP;
! 998: optlen = 1;
! 999: continue;
! 1000: }
! 1001: #ifdef DIAGNOSTIC
! 1002: if (cnt < IPOPT_OLEN + sizeof(*cp))
! 1003: panic("malformed IPv4 option passed to ip_optcopy");
! 1004: #endif
! 1005: optlen = cp[IPOPT_OLEN];
! 1006: #ifdef DIAGNOSTIC
! 1007: if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)
! 1008: panic("malformed IPv4 option passed to ip_optcopy");
! 1009: #endif
! 1010: /* bogus lengths should have been caught by ip_dooptions */
! 1011: if (optlen > cnt)
! 1012: optlen = cnt;
! 1013: if (IPOPT_COPIED(opt)) {
! 1014: bcopy((caddr_t)cp, (caddr_t)dp, (unsigned)optlen);
! 1015: dp += optlen;
! 1016: }
! 1017: }
! 1018: for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++)
! 1019: *dp++ = IPOPT_EOL;
! 1020: return (optlen);
! 1021: }
! 1022:
! 1023: /*
! 1024: * IP socket option processing.
! 1025: */
! 1026: int
! 1027: ip_ctloutput(op, so, level, optname, mp)
! 1028: int op;
! 1029: struct socket *so;
! 1030: int level, optname;
! 1031: struct mbuf **mp;
! 1032: {
! 1033: struct inpcb *inp = sotoinpcb(so);
! 1034: struct mbuf *m = *mp;
! 1035: int optval = 0;
! 1036: #ifdef IPSEC
! 1037: struct proc *p = curproc; /* XXX */
! 1038: struct ipsec_ref *ipr;
! 1039: u_int16_t opt16val;
! 1040: #endif
! 1041: int error = 0;
! 1042:
! 1043: if (level != IPPROTO_IP) {
! 1044: error = EINVAL;
! 1045: if (op == PRCO_SETOPT && *mp)
! 1046: (void) m_free(*mp);
! 1047: } else switch (op) {
! 1048: case PRCO_SETOPT:
! 1049: switch (optname) {
! 1050: case IP_OPTIONS:
! 1051: #ifdef notyet
! 1052: case IP_RETOPTS:
! 1053: return (ip_pcbopts(optname, &inp->inp_options, m));
! 1054: #else
! 1055: return (ip_pcbopts(&inp->inp_options, m));
! 1056: #endif
! 1057:
! 1058: case IP_TOS:
! 1059: case IP_TTL:
! 1060: case IP_MINTTL:
! 1061: case IP_RECVOPTS:
! 1062: case IP_RECVRETOPTS:
! 1063: case IP_RECVDSTADDR:
! 1064: case IP_RECVIF:
! 1065: case IP_RECVTTL:
! 1066: if (m == NULL || m->m_len != sizeof(int))
! 1067: error = EINVAL;
! 1068: else {
! 1069: optval = *mtod(m, int *);
! 1070: switch (optname) {
! 1071:
! 1072: case IP_TOS:
! 1073: inp->inp_ip.ip_tos = optval;
! 1074: break;
! 1075:
! 1076: case IP_TTL:
! 1077: if (optval > 0 && optval <= MAXTTL)
! 1078: inp->inp_ip.ip_ttl = optval;
! 1079: else
! 1080: error = EINVAL;
! 1081: break;
! 1082:
! 1083: case IP_MINTTL:
! 1084: if (optval > 0 && optval <= MAXTTL)
! 1085: inp->inp_ip_minttl = optval;
! 1086: else
! 1087: error = EINVAL;
! 1088: break;
! 1089: #define OPTSET(bit) \
! 1090: if (optval) \
! 1091: inp->inp_flags |= bit; \
! 1092: else \
! 1093: inp->inp_flags &= ~bit;
! 1094:
! 1095: case IP_RECVOPTS:
! 1096: OPTSET(INP_RECVOPTS);
! 1097: break;
! 1098:
! 1099: case IP_RECVRETOPTS:
! 1100: OPTSET(INP_RECVRETOPTS);
! 1101: break;
! 1102:
! 1103: case IP_RECVDSTADDR:
! 1104: OPTSET(INP_RECVDSTADDR);
! 1105: break;
! 1106: case IP_RECVIF:
! 1107: OPTSET(INP_RECVIF);
! 1108: break;
! 1109: case IP_RECVTTL:
! 1110: OPTSET(INP_RECVTTL);
! 1111: break;
! 1112: }
! 1113: }
! 1114: break;
! 1115: #undef OPTSET
! 1116:
! 1117: case IP_MULTICAST_IF:
! 1118: case IP_MULTICAST_TTL:
! 1119: case IP_MULTICAST_LOOP:
! 1120: case IP_ADD_MEMBERSHIP:
! 1121: case IP_DROP_MEMBERSHIP:
! 1122: error = ip_setmoptions(optname, &inp->inp_moptions, m);
! 1123: break;
! 1124:
! 1125: case IP_PORTRANGE:
! 1126: if (m == 0 || m->m_len != sizeof(int))
! 1127: error = EINVAL;
! 1128: else {
! 1129: optval = *mtod(m, int *);
! 1130:
! 1131: switch (optval) {
! 1132:
! 1133: case IP_PORTRANGE_DEFAULT:
! 1134: inp->inp_flags &= ~(INP_LOWPORT);
! 1135: inp->inp_flags &= ~(INP_HIGHPORT);
! 1136: break;
! 1137:
! 1138: case IP_PORTRANGE_HIGH:
! 1139: inp->inp_flags &= ~(INP_LOWPORT);
! 1140: inp->inp_flags |= INP_HIGHPORT;
! 1141: break;
! 1142:
! 1143: case IP_PORTRANGE_LOW:
! 1144: inp->inp_flags &= ~(INP_HIGHPORT);
! 1145: inp->inp_flags |= INP_LOWPORT;
! 1146: break;
! 1147:
! 1148: default:
! 1149:
! 1150: error = EINVAL;
! 1151: break;
! 1152: }
! 1153: }
! 1154: break;
! 1155: case IP_AUTH_LEVEL:
! 1156: case IP_ESP_TRANS_LEVEL:
! 1157: case IP_ESP_NETWORK_LEVEL:
! 1158: case IP_IPCOMP_LEVEL:
! 1159: #ifndef IPSEC
! 1160: error = EOPNOTSUPP;
! 1161: #else
! 1162: if (m == 0 || m->m_len != sizeof(int)) {
! 1163: error = EINVAL;
! 1164: break;
! 1165: }
! 1166: optval = *mtod(m, int *);
! 1167:
! 1168: if (optval < IPSEC_LEVEL_BYPASS ||
! 1169: optval > IPSEC_LEVEL_UNIQUE) {
! 1170: error = EINVAL;
! 1171: break;
! 1172: }
! 1173:
! 1174: /* Unlink cached output TDB to force a re-search */
! 1175: if (inp->inp_tdb_out) {
! 1176: int s = spltdb();
! 1177: TAILQ_REMOVE(&inp->inp_tdb_out->tdb_inp_out,
! 1178: inp, inp_tdb_out_next);
! 1179: splx(s);
! 1180: }
! 1181:
! 1182: if (inp->inp_tdb_in) {
! 1183: int s = spltdb();
! 1184: TAILQ_REMOVE(&inp->inp_tdb_in->tdb_inp_in,
! 1185: inp, inp_tdb_in_next);
! 1186: splx(s);
! 1187: }
! 1188:
! 1189: switch (optname) {
! 1190: case IP_AUTH_LEVEL:
! 1191: if (optval < ipsec_auth_default_level &&
! 1192: suser(p, 0)) {
! 1193: error = EACCES;
! 1194: break;
! 1195: }
! 1196: inp->inp_seclevel[SL_AUTH] = optval;
! 1197: break;
! 1198:
! 1199: case IP_ESP_TRANS_LEVEL:
! 1200: if (optval < ipsec_esp_trans_default_level &&
! 1201: suser(p, 0)) {
! 1202: error = EACCES;
! 1203: break;
! 1204: }
! 1205: inp->inp_seclevel[SL_ESP_TRANS] = optval;
! 1206: break;
! 1207:
! 1208: case IP_ESP_NETWORK_LEVEL:
! 1209: if (optval < ipsec_esp_network_default_level &&
! 1210: suser(p, 0)) {
! 1211: error = EACCES;
! 1212: break;
! 1213: }
! 1214: inp->inp_seclevel[SL_ESP_NETWORK] = optval;
! 1215: break;
! 1216: case IP_IPCOMP_LEVEL:
! 1217: if (optval < ipsec_ipcomp_default_level &&
! 1218: suser(p, 0)) {
! 1219: error = EACCES;
! 1220: break;
! 1221: }
! 1222: inp->inp_seclevel[SL_IPCOMP] = optval;
! 1223: break;
! 1224: }
! 1225: if (!error)
! 1226: inp->inp_secrequire = get_sa_require(inp);
! 1227: #endif
! 1228: break;
! 1229:
! 1230: case IP_IPSEC_REMOTE_CRED:
! 1231: case IP_IPSEC_REMOTE_AUTH:
! 1232: /* Can't set the remote credential or key */
! 1233: error = EOPNOTSUPP;
! 1234: break;
! 1235:
! 1236: case IP_IPSEC_LOCAL_ID:
! 1237: case IP_IPSEC_REMOTE_ID:
! 1238: case IP_IPSEC_LOCAL_CRED:
! 1239: case IP_IPSEC_LOCAL_AUTH:
! 1240: #ifndef IPSEC
! 1241: error = EOPNOTSUPP;
! 1242: #else
! 1243: if (m->m_len < 2) {
! 1244: error = EINVAL;
! 1245: break;
! 1246: }
! 1247:
! 1248: m_copydata(m, 0, 2, (caddr_t) &opt16val);
! 1249:
! 1250: /* If the type is 0, then we cleanup and return */
! 1251: if (opt16val == 0) {
! 1252: switch (optname) {
! 1253: case IP_IPSEC_LOCAL_ID:
! 1254: if (inp->inp_ipo != NULL &&
! 1255: inp->inp_ipo->ipo_srcid != NULL) {
! 1256: ipsp_reffree(inp->inp_ipo->ipo_srcid);
! 1257: inp->inp_ipo->ipo_srcid = NULL;
! 1258: }
! 1259: break;
! 1260:
! 1261: case IP_IPSEC_REMOTE_ID:
! 1262: if (inp->inp_ipo != NULL &&
! 1263: inp->inp_ipo->ipo_dstid != NULL) {
! 1264: ipsp_reffree(inp->inp_ipo->ipo_dstid);
! 1265: inp->inp_ipo->ipo_dstid = NULL;
! 1266: }
! 1267: break;
! 1268:
! 1269: case IP_IPSEC_LOCAL_CRED:
! 1270: if (inp->inp_ipo != NULL &&
! 1271: inp->inp_ipo->ipo_local_cred != NULL) {
! 1272: ipsp_reffree(inp->inp_ipo->ipo_local_cred);
! 1273: inp->inp_ipo->ipo_local_cred = NULL;
! 1274: }
! 1275: break;
! 1276:
! 1277: case IP_IPSEC_LOCAL_AUTH:
! 1278: if (inp->inp_ipo != NULL &&
! 1279: inp->inp_ipo->ipo_local_auth != NULL) {
! 1280: ipsp_reffree(inp->inp_ipo->ipo_local_auth);
! 1281: inp->inp_ipo->ipo_local_auth = NULL;
! 1282: }
! 1283: break;
! 1284: }
! 1285:
! 1286: error = 0;
! 1287: break;
! 1288: }
! 1289:
! 1290: /* Can't have an empty payload */
! 1291: if (m->m_len == 2) {
! 1292: error = EINVAL;
! 1293: break;
! 1294: }
! 1295:
! 1296: /* Allocate if needed */
! 1297: if (inp->inp_ipo == NULL) {
! 1298: inp->inp_ipo = ipsec_add_policy(inp,
! 1299: AF_INET, IPSP_DIRECTION_OUT);
! 1300: if (inp->inp_ipo == NULL) {
! 1301: error = ENOBUFS;
! 1302: break;
! 1303: }
! 1304: }
! 1305:
! 1306: MALLOC(ipr, struct ipsec_ref *,
! 1307: sizeof(struct ipsec_ref) + m->m_len - 2,
! 1308: M_CREDENTIALS, M_NOWAIT);
! 1309: if (ipr == NULL) {
! 1310: error = ENOBUFS;
! 1311: break;
! 1312: }
! 1313:
! 1314: ipr->ref_count = 1;
! 1315: ipr->ref_malloctype = M_CREDENTIALS;
! 1316: ipr->ref_len = m->m_len - 2;
! 1317: ipr->ref_type = opt16val;
! 1318: m_copydata(m, 2, m->m_len - 2, (caddr_t)(ipr + 1));
! 1319:
! 1320: switch (optname) {
! 1321: case IP_IPSEC_LOCAL_ID:
! 1322: /* Check valid types and NUL-termination */
! 1323: if (ipr->ref_type < IPSP_IDENTITY_PREFIX ||
! 1324: ipr->ref_type > IPSP_IDENTITY_CONNECTION ||
! 1325: ((char *)(ipr + 1))[ipr->ref_len - 1]) {
! 1326: FREE(ipr, M_CREDENTIALS);
! 1327: error = EINVAL;
! 1328: } else {
! 1329: if (inp->inp_ipo->ipo_srcid != NULL)
! 1330: ipsp_reffree(inp->inp_ipo->ipo_srcid);
! 1331: inp->inp_ipo->ipo_srcid = ipr;
! 1332: }
! 1333: break;
! 1334: case IP_IPSEC_REMOTE_ID:
! 1335: /* Check valid types and NUL-termination */
! 1336: if (ipr->ref_type < IPSP_IDENTITY_PREFIX ||
! 1337: ipr->ref_type > IPSP_IDENTITY_CONNECTION ||
! 1338: ((char *)(ipr + 1))[ipr->ref_len - 1]) {
! 1339: FREE(ipr, M_CREDENTIALS);
! 1340: error = EINVAL;
! 1341: } else {
! 1342: if (inp->inp_ipo->ipo_dstid != NULL)
! 1343: ipsp_reffree(inp->inp_ipo->ipo_dstid);
! 1344: inp->inp_ipo->ipo_dstid = ipr;
! 1345: }
! 1346: break;
! 1347: case IP_IPSEC_LOCAL_CRED:
! 1348: if (ipr->ref_type < IPSP_CRED_KEYNOTE ||
! 1349: ipr->ref_type > IPSP_CRED_X509) {
! 1350: FREE(ipr, M_CREDENTIALS);
! 1351: error = EINVAL;
! 1352: } else {
! 1353: if (inp->inp_ipo->ipo_local_cred != NULL)
! 1354: ipsp_reffree(inp->inp_ipo->ipo_local_cred);
! 1355: inp->inp_ipo->ipo_local_cred = ipr;
! 1356: }
! 1357: break;
! 1358: case IP_IPSEC_LOCAL_AUTH:
! 1359: if (ipr->ref_type < IPSP_AUTH_PASSPHRASE ||
! 1360: ipr->ref_type > IPSP_AUTH_RSA) {
! 1361: FREE(ipr, M_CREDENTIALS);
! 1362: error = EINVAL;
! 1363: } else {
! 1364: if (inp->inp_ipo->ipo_local_auth != NULL)
! 1365: ipsp_reffree(inp->inp_ipo->ipo_local_auth);
! 1366: inp->inp_ipo->ipo_local_auth = ipr;
! 1367: }
! 1368: break;
! 1369: }
! 1370:
! 1371: /* Unlink cached output TDB to force a re-search */
! 1372: if (inp->inp_tdb_out) {
! 1373: int s = spltdb();
! 1374: TAILQ_REMOVE(&inp->inp_tdb_out->tdb_inp_out,
! 1375: inp, inp_tdb_out_next);
! 1376: splx(s);
! 1377: }
! 1378:
! 1379: if (inp->inp_tdb_in) {
! 1380: int s = spltdb();
! 1381: TAILQ_REMOVE(&inp->inp_tdb_in->tdb_inp_in,
! 1382: inp, inp_tdb_in_next);
! 1383: splx(s);
! 1384: }
! 1385: #endif
! 1386: break;
! 1387: default:
! 1388: error = ENOPROTOOPT;
! 1389: break;
! 1390: }
! 1391: if (m)
! 1392: (void)m_free(m);
! 1393: break;
! 1394:
! 1395: case PRCO_GETOPT:
! 1396: switch (optname) {
! 1397: case IP_OPTIONS:
! 1398: case IP_RETOPTS:
! 1399: *mp = m = m_get(M_WAIT, MT_SOOPTS);
! 1400: if (inp->inp_options) {
! 1401: m->m_len = inp->inp_options->m_len;
! 1402: bcopy(mtod(inp->inp_options, caddr_t),
! 1403: mtod(m, caddr_t), (unsigned)m->m_len);
! 1404: } else
! 1405: m->m_len = 0;
! 1406: break;
! 1407:
! 1408: case IP_TOS:
! 1409: case IP_TTL:
! 1410: case IP_MINTTL:
! 1411: case IP_RECVOPTS:
! 1412: case IP_RECVRETOPTS:
! 1413: case IP_RECVDSTADDR:
! 1414: case IP_RECVIF:
! 1415: case IP_RECVTTL:
! 1416: *mp = m = m_get(M_WAIT, MT_SOOPTS);
! 1417: m->m_len = sizeof(int);
! 1418: switch (optname) {
! 1419:
! 1420: case IP_TOS:
! 1421: optval = inp->inp_ip.ip_tos;
! 1422: break;
! 1423:
! 1424: case IP_TTL:
! 1425: optval = inp->inp_ip.ip_ttl;
! 1426: break;
! 1427:
! 1428: case IP_MINTTL:
! 1429: optval = inp->inp_ip_minttl;
! 1430: break;
! 1431:
! 1432: #define OPTBIT(bit) (inp->inp_flags & bit ? 1 : 0)
! 1433:
! 1434: case IP_RECVOPTS:
! 1435: optval = OPTBIT(INP_RECVOPTS);
! 1436: break;
! 1437:
! 1438: case IP_RECVRETOPTS:
! 1439: optval = OPTBIT(INP_RECVRETOPTS);
! 1440: break;
! 1441:
! 1442: case IP_RECVDSTADDR:
! 1443: optval = OPTBIT(INP_RECVDSTADDR);
! 1444: break;
! 1445: case IP_RECVIF:
! 1446: optval = OPTBIT(INP_RECVIF);
! 1447: break;
! 1448: case IP_RECVTTL:
! 1449: optval = OPTBIT(INP_RECVTTL);
! 1450: break;
! 1451: }
! 1452: *mtod(m, int *) = optval;
! 1453: break;
! 1454:
! 1455: case IP_MULTICAST_IF:
! 1456: case IP_MULTICAST_TTL:
! 1457: case IP_MULTICAST_LOOP:
! 1458: case IP_ADD_MEMBERSHIP:
! 1459: case IP_DROP_MEMBERSHIP:
! 1460: error = ip_getmoptions(optname, inp->inp_moptions, mp);
! 1461: break;
! 1462:
! 1463: case IP_PORTRANGE:
! 1464: *mp = m = m_get(M_WAIT, MT_SOOPTS);
! 1465: m->m_len = sizeof(int);
! 1466:
! 1467: if (inp->inp_flags & INP_HIGHPORT)
! 1468: optval = IP_PORTRANGE_HIGH;
! 1469: else if (inp->inp_flags & INP_LOWPORT)
! 1470: optval = IP_PORTRANGE_LOW;
! 1471: else
! 1472: optval = 0;
! 1473:
! 1474: *mtod(m, int *) = optval;
! 1475: break;
! 1476:
! 1477: case IP_AUTH_LEVEL:
! 1478: case IP_ESP_TRANS_LEVEL:
! 1479: case IP_ESP_NETWORK_LEVEL:
! 1480: case IP_IPCOMP_LEVEL:
! 1481: #ifndef IPSEC
! 1482: m->m_len = sizeof(int);
! 1483: *mtod(m, int *) = IPSEC_LEVEL_NONE;
! 1484: #else
! 1485: m->m_len = sizeof(int);
! 1486: switch (optname) {
! 1487: case IP_AUTH_LEVEL:
! 1488: optval = inp->inp_seclevel[SL_AUTH];
! 1489: break;
! 1490:
! 1491: case IP_ESP_TRANS_LEVEL:
! 1492: optval = inp->inp_seclevel[SL_ESP_TRANS];
! 1493: break;
! 1494:
! 1495: case IP_ESP_NETWORK_LEVEL:
! 1496: optval = inp->inp_seclevel[SL_ESP_NETWORK];
! 1497: break;
! 1498: case IP_IPCOMP_LEVEL:
! 1499: optval = inp->inp_seclevel[SL_IPCOMP];
! 1500: break;
! 1501: }
! 1502: *mtod(m, int *) = optval;
! 1503: #endif
! 1504: break;
! 1505: case IP_IPSEC_LOCAL_ID:
! 1506: case IP_IPSEC_REMOTE_ID:
! 1507: case IP_IPSEC_LOCAL_CRED:
! 1508: case IP_IPSEC_REMOTE_CRED:
! 1509: case IP_IPSEC_LOCAL_AUTH:
! 1510: case IP_IPSEC_REMOTE_AUTH:
! 1511: #ifndef IPSEC
! 1512: error = EOPNOTSUPP;
! 1513: #else
! 1514: *mp = m = m_get(M_WAIT, MT_SOOPTS);
! 1515: m->m_len = sizeof(u_int16_t);
! 1516: ipr = NULL;
! 1517: switch (optname) {
! 1518: case IP_IPSEC_LOCAL_ID:
! 1519: if (inp->inp_ipo != NULL)
! 1520: ipr = inp->inp_ipo->ipo_srcid;
! 1521: opt16val = IPSP_IDENTITY_NONE;
! 1522: break;
! 1523: case IP_IPSEC_REMOTE_ID:
! 1524: if (inp->inp_ipo != NULL)
! 1525: ipr = inp->inp_ipo->ipo_dstid;
! 1526: opt16val = IPSP_IDENTITY_NONE;
! 1527: break;
! 1528: case IP_IPSEC_LOCAL_CRED:
! 1529: if (inp->inp_ipo != NULL)
! 1530: ipr = inp->inp_ipo->ipo_local_cred;
! 1531: opt16val = IPSP_CRED_NONE;
! 1532: break;
! 1533: case IP_IPSEC_REMOTE_CRED:
! 1534: ipr = inp->inp_ipsec_remotecred;
! 1535: opt16val = IPSP_CRED_NONE;
! 1536: break;
! 1537: case IP_IPSEC_LOCAL_AUTH:
! 1538: if (inp->inp_ipo != NULL)
! 1539: ipr = inp->inp_ipo->ipo_local_auth;
! 1540: break;
! 1541: case IP_IPSEC_REMOTE_AUTH:
! 1542: ipr = inp->inp_ipsec_remoteauth;
! 1543: break;
! 1544: }
! 1545: if (ipr == NULL)
! 1546: *mtod(m, u_int16_t *) = opt16val;
! 1547: else {
! 1548: size_t len;
! 1549:
! 1550: len = m->m_len + ipr->ref_len;
! 1551: if (len > MCLBYTES) {
! 1552: m_free(m);
! 1553: error = EINVAL;
! 1554: break;
! 1555: }
! 1556: /* allocate mbuf cluster for larger option */
! 1557: if (len > MLEN) {
! 1558: MCLGET(m, M_WAITOK);
! 1559: if ((m->m_flags & M_EXT) == 0) {
! 1560: m_free(m);
! 1561: error = ENOBUFS;
! 1562: break;
! 1563: }
! 1564:
! 1565: }
! 1566: m->m_len = len;
! 1567: *mtod(m, u_int16_t *) = ipr->ref_type;
! 1568: m_copyback(m, sizeof(u_int16_t), ipr->ref_len,
! 1569: ipr + 1);
! 1570: }
! 1571: #endif
! 1572: break;
! 1573: default:
! 1574: error = ENOPROTOOPT;
! 1575: break;
! 1576: }
! 1577: break;
! 1578: }
! 1579: return (error);
! 1580: }
! 1581:
! 1582: /*
! 1583: * Set up IP options in pcb for insertion in output packets.
! 1584: * Store in mbuf with pointer in pcbopt, adding pseudo-option
! 1585: * with destination address if source routed.
! 1586: */
! 1587: int
! 1588: #ifdef notyet
! 1589: ip_pcbopts(optname, pcbopt, m)
! 1590: int optname;
! 1591: #else
! 1592: ip_pcbopts(pcbopt, m)
! 1593: #endif
! 1594: struct mbuf **pcbopt;
! 1595: struct mbuf *m;
! 1596: {
! 1597: int cnt, optlen;
! 1598: u_char *cp;
! 1599: u_char opt;
! 1600:
! 1601: /* turn off any old options */
! 1602: if (*pcbopt)
! 1603: (void)m_free(*pcbopt);
! 1604: *pcbopt = 0;
! 1605: if (m == (struct mbuf *)0 || m->m_len == 0) {
! 1606: /*
! 1607: * Only turning off any previous options.
! 1608: */
! 1609: if (m)
! 1610: (void)m_free(m);
! 1611: return (0);
! 1612: }
! 1613:
! 1614: if (m->m_len % sizeof(int32_t))
! 1615: goto bad;
! 1616:
! 1617: /*
! 1618: * IP first-hop destination address will be stored before
! 1619: * actual options; move other options back
! 1620: * and clear it when none present.
! 1621: */
! 1622: if (m->m_data + m->m_len + sizeof(struct in_addr) >= &m->m_dat[MLEN])
! 1623: goto bad;
! 1624: cnt = m->m_len;
! 1625: m->m_len += sizeof(struct in_addr);
! 1626: cp = mtod(m, u_char *) + sizeof(struct in_addr);
! 1627: ovbcopy(mtod(m, caddr_t), (caddr_t)cp, (unsigned)cnt);
! 1628: bzero(mtod(m, caddr_t), sizeof(struct in_addr));
! 1629:
! 1630: for (; cnt > 0; cnt -= optlen, cp += optlen) {
! 1631: opt = cp[IPOPT_OPTVAL];
! 1632: if (opt == IPOPT_EOL)
! 1633: break;
! 1634: if (opt == IPOPT_NOP)
! 1635: optlen = 1;
! 1636: else {
! 1637: if (cnt < IPOPT_OLEN + sizeof(*cp))
! 1638: goto bad;
! 1639: optlen = cp[IPOPT_OLEN];
! 1640: if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)
! 1641: goto bad;
! 1642: }
! 1643: switch (opt) {
! 1644:
! 1645: default:
! 1646: break;
! 1647:
! 1648: case IPOPT_LSRR:
! 1649: case IPOPT_SSRR:
! 1650: /*
! 1651: * user process specifies route as:
! 1652: * ->A->B->C->D
! 1653: * D must be our final destination (but we can't
! 1654: * check that since we may not have connected yet).
! 1655: * A is first hop destination, which doesn't appear in
! 1656: * actual IP option, but is stored before the options.
! 1657: */
! 1658: if (optlen < IPOPT_MINOFF - 1 + sizeof(struct in_addr))
! 1659: goto bad;
! 1660: m->m_len -= sizeof(struct in_addr);
! 1661: cnt -= sizeof(struct in_addr);
! 1662: optlen -= sizeof(struct in_addr);
! 1663: cp[IPOPT_OLEN] = optlen;
! 1664: /*
! 1665: * Move first hop before start of options.
! 1666: */
! 1667: bcopy((caddr_t)&cp[IPOPT_OFFSET+1], mtod(m, caddr_t),
! 1668: sizeof(struct in_addr));
! 1669: /*
! 1670: * Then copy rest of options back
! 1671: * to close up the deleted entry.
! 1672: */
! 1673: ovbcopy((caddr_t)(&cp[IPOPT_OFFSET+1] +
! 1674: sizeof(struct in_addr)),
! 1675: (caddr_t)&cp[IPOPT_OFFSET+1],
! 1676: (unsigned)cnt - (IPOPT_OFFSET+1));
! 1677: break;
! 1678: }
! 1679: }
! 1680: if (m->m_len > MAX_IPOPTLEN + sizeof(struct in_addr))
! 1681: goto bad;
! 1682: *pcbopt = m;
! 1683: return (0);
! 1684:
! 1685: bad:
! 1686: (void)m_free(m);
! 1687: return (EINVAL);
! 1688: }
! 1689:
! 1690: /*
! 1691: * Set the IP multicast options in response to user setsockopt().
! 1692: */
! 1693: int
! 1694: ip_setmoptions(optname, imop, m)
! 1695: int optname;
! 1696: struct ip_moptions **imop;
! 1697: struct mbuf *m;
! 1698: {
! 1699: int error = 0;
! 1700: u_char loop;
! 1701: int i;
! 1702: struct in_addr addr;
! 1703: struct ip_mreq *mreq;
! 1704: struct ifnet *ifp;
! 1705: struct ip_moptions *imo = *imop;
! 1706: struct route ro;
! 1707: struct sockaddr_in *dst;
! 1708:
! 1709: if (imo == NULL) {
! 1710: /*
! 1711: * No multicast option buffer attached to the pcb;
! 1712: * allocate one and initialize to default values.
! 1713: */
! 1714: imo = (struct ip_moptions *)malloc(sizeof(*imo), M_IPMOPTS,
! 1715: M_WAITOK);
! 1716:
! 1717: *imop = imo;
! 1718: imo->imo_multicast_ifp = NULL;
! 1719: imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
! 1720: imo->imo_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
! 1721: imo->imo_num_memberships = 0;
! 1722: }
! 1723:
! 1724: switch (optname) {
! 1725:
! 1726: case IP_MULTICAST_IF:
! 1727: /*
! 1728: * Select the interface for outgoing multicast packets.
! 1729: */
! 1730: if (m == NULL || m->m_len != sizeof(struct in_addr)) {
! 1731: error = EINVAL;
! 1732: break;
! 1733: }
! 1734: addr = *(mtod(m, struct in_addr *));
! 1735: /*
! 1736: * INADDR_ANY is used to remove a previous selection.
! 1737: * When no interface is selected, a default one is
! 1738: * chosen every time a multicast packet is sent.
! 1739: */
! 1740: if (addr.s_addr == INADDR_ANY) {
! 1741: imo->imo_multicast_ifp = NULL;
! 1742: break;
! 1743: }
! 1744: /*
! 1745: * The selected interface is identified by its local
! 1746: * IP address. Find the interface and confirm that
! 1747: * it supports multicasting.
! 1748: */
! 1749: INADDR_TO_IFP(addr, ifp);
! 1750: if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
! 1751: error = EADDRNOTAVAIL;
! 1752: break;
! 1753: }
! 1754: imo->imo_multicast_ifp = ifp;
! 1755: break;
! 1756:
! 1757: case IP_MULTICAST_TTL:
! 1758: /*
! 1759: * Set the IP time-to-live for outgoing multicast packets.
! 1760: */
! 1761: if (m == NULL || m->m_len != 1) {
! 1762: error = EINVAL;
! 1763: break;
! 1764: }
! 1765: imo->imo_multicast_ttl = *(mtod(m, u_char *));
! 1766: break;
! 1767:
! 1768: case IP_MULTICAST_LOOP:
! 1769: /*
! 1770: * Set the loopback flag for outgoing multicast packets.
! 1771: * Must be zero or one.
! 1772: */
! 1773: if (m == NULL || m->m_len != 1 ||
! 1774: (loop = *(mtod(m, u_char *))) > 1) {
! 1775: error = EINVAL;
! 1776: break;
! 1777: }
! 1778: imo->imo_multicast_loop = loop;
! 1779: break;
! 1780:
! 1781: case IP_ADD_MEMBERSHIP:
! 1782: /*
! 1783: * Add a multicast group membership.
! 1784: * Group must be a valid IP multicast address.
! 1785: */
! 1786: if (m == NULL || m->m_len != sizeof(struct ip_mreq)) {
! 1787: error = EINVAL;
! 1788: break;
! 1789: }
! 1790: mreq = mtod(m, struct ip_mreq *);
! 1791: if (!IN_MULTICAST(mreq->imr_multiaddr.s_addr)) {
! 1792: error = EINVAL;
! 1793: break;
! 1794: }
! 1795: /*
! 1796: * If no interface address was provided, use the interface of
! 1797: * the route to the given multicast address.
! 1798: */
! 1799: if (mreq->imr_interface.s_addr == INADDR_ANY) {
! 1800: ro.ro_rt = NULL;
! 1801: dst = satosin(&ro.ro_dst);
! 1802: dst->sin_len = sizeof(*dst);
! 1803: dst->sin_family = AF_INET;
! 1804: dst->sin_addr = mreq->imr_multiaddr;
! 1805: rtalloc(&ro);
! 1806: if (ro.ro_rt == NULL) {
! 1807: error = EADDRNOTAVAIL;
! 1808: break;
! 1809: }
! 1810: ifp = ro.ro_rt->rt_ifp;
! 1811: rtfree(ro.ro_rt);
! 1812: } else {
! 1813: INADDR_TO_IFP(mreq->imr_interface, ifp);
! 1814: }
! 1815: /*
! 1816: * See if we found an interface, and confirm that it
! 1817: * supports multicast.
! 1818: */
! 1819: if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
! 1820: error = EADDRNOTAVAIL;
! 1821: break;
! 1822: }
! 1823: /*
! 1824: * See if the membership already exists or if all the
! 1825: * membership slots are full.
! 1826: */
! 1827: for (i = 0; i < imo->imo_num_memberships; ++i) {
! 1828: if (imo->imo_membership[i]->inm_ia->ia_ifp == ifp &&
! 1829: imo->imo_membership[i]->inm_addr.s_addr
! 1830: == mreq->imr_multiaddr.s_addr)
! 1831: break;
! 1832: }
! 1833: if (i < imo->imo_num_memberships) {
! 1834: error = EADDRINUSE;
! 1835: break;
! 1836: }
! 1837: if (i == IP_MAX_MEMBERSHIPS) {
! 1838: error = ETOOMANYREFS;
! 1839: break;
! 1840: }
! 1841: /*
! 1842: * Everything looks good; add a new record to the multicast
! 1843: * address list for the given interface.
! 1844: */
! 1845: if ((imo->imo_membership[i] =
! 1846: in_addmulti(&mreq->imr_multiaddr, ifp)) == NULL) {
! 1847: error = ENOBUFS;
! 1848: break;
! 1849: }
! 1850: ++imo->imo_num_memberships;
! 1851: break;
! 1852:
! 1853: case IP_DROP_MEMBERSHIP:
! 1854: /*
! 1855: * Drop a multicast group membership.
! 1856: * Group must be a valid IP multicast address.
! 1857: */
! 1858: if (m == NULL || m->m_len != sizeof(struct ip_mreq)) {
! 1859: error = EINVAL;
! 1860: break;
! 1861: }
! 1862: mreq = mtod(m, struct ip_mreq *);
! 1863: if (!IN_MULTICAST(mreq->imr_multiaddr.s_addr)) {
! 1864: error = EINVAL;
! 1865: break;
! 1866: }
! 1867: /*
! 1868: * If an interface address was specified, get a pointer
! 1869: * to its ifnet structure.
! 1870: */
! 1871: if (mreq->imr_interface.s_addr == INADDR_ANY)
! 1872: ifp = NULL;
! 1873: else {
! 1874: INADDR_TO_IFP(mreq->imr_interface, ifp);
! 1875: if (ifp == NULL) {
! 1876: error = EADDRNOTAVAIL;
! 1877: break;
! 1878: }
! 1879: }
! 1880: /*
! 1881: * Find the membership in the membership array.
! 1882: */
! 1883: for (i = 0; i < imo->imo_num_memberships; ++i) {
! 1884: if ((ifp == NULL ||
! 1885: imo->imo_membership[i]->inm_ia->ia_ifp == ifp) &&
! 1886: imo->imo_membership[i]->inm_addr.s_addr ==
! 1887: mreq->imr_multiaddr.s_addr)
! 1888: break;
! 1889: }
! 1890: if (i == imo->imo_num_memberships) {
! 1891: error = EADDRNOTAVAIL;
! 1892: break;
! 1893: }
! 1894: /*
! 1895: * Give up the multicast address record to which the
! 1896: * membership points.
! 1897: */
! 1898: in_delmulti(imo->imo_membership[i]);
! 1899: /*
! 1900: * Remove the gap in the membership array.
! 1901: */
! 1902: for (++i; i < imo->imo_num_memberships; ++i)
! 1903: imo->imo_membership[i-1] = imo->imo_membership[i];
! 1904: --imo->imo_num_memberships;
! 1905: break;
! 1906:
! 1907: default:
! 1908: error = EOPNOTSUPP;
! 1909: break;
! 1910: }
! 1911:
! 1912: /*
! 1913: * If all options have default values, no need to keep the mbuf.
! 1914: */
! 1915: if (imo->imo_multicast_ifp == NULL &&
! 1916: imo->imo_multicast_ttl == IP_DEFAULT_MULTICAST_TTL &&
! 1917: imo->imo_multicast_loop == IP_DEFAULT_MULTICAST_LOOP &&
! 1918: imo->imo_num_memberships == 0) {
! 1919: free(*imop, M_IPMOPTS);
! 1920: *imop = NULL;
! 1921: }
! 1922:
! 1923: return (error);
! 1924: }
! 1925:
! 1926: /*
! 1927: * Return the IP multicast options in response to user getsockopt().
! 1928: */
! 1929: int
! 1930: ip_getmoptions(optname, imo, mp)
! 1931: int optname;
! 1932: struct ip_moptions *imo;
! 1933: struct mbuf **mp;
! 1934: {
! 1935: u_char *ttl;
! 1936: u_char *loop;
! 1937: struct in_addr *addr;
! 1938: struct in_ifaddr *ia;
! 1939:
! 1940: *mp = m_get(M_WAIT, MT_SOOPTS);
! 1941:
! 1942: switch (optname) {
! 1943:
! 1944: case IP_MULTICAST_IF:
! 1945: addr = mtod(*mp, struct in_addr *);
! 1946: (*mp)->m_len = sizeof(struct in_addr);
! 1947: if (imo == NULL || imo->imo_multicast_ifp == NULL)
! 1948: addr->s_addr = INADDR_ANY;
! 1949: else {
! 1950: IFP_TO_IA(imo->imo_multicast_ifp, ia);
! 1951: addr->s_addr = (ia == NULL) ? INADDR_ANY
! 1952: : ia->ia_addr.sin_addr.s_addr;
! 1953: }
! 1954: return (0);
! 1955:
! 1956: case IP_MULTICAST_TTL:
! 1957: ttl = mtod(*mp, u_char *);
! 1958: (*mp)->m_len = 1;
! 1959: *ttl = (imo == NULL) ? IP_DEFAULT_MULTICAST_TTL
! 1960: : imo->imo_multicast_ttl;
! 1961: return (0);
! 1962:
! 1963: case IP_MULTICAST_LOOP:
! 1964: loop = mtod(*mp, u_char *);
! 1965: (*mp)->m_len = 1;
! 1966: *loop = (imo == NULL) ? IP_DEFAULT_MULTICAST_LOOP
! 1967: : imo->imo_multicast_loop;
! 1968: return (0);
! 1969:
! 1970: default:
! 1971: return (EOPNOTSUPP);
! 1972: }
! 1973: }
! 1974:
! 1975: /*
! 1976: * Discard the IP multicast options.
! 1977: */
! 1978: void
! 1979: ip_freemoptions(imo)
! 1980: struct ip_moptions *imo;
! 1981: {
! 1982: int i;
! 1983:
! 1984: if (imo != NULL) {
! 1985: for (i = 0; i < imo->imo_num_memberships; ++i)
! 1986: in_delmulti(imo->imo_membership[i]);
! 1987: free(imo, M_IPMOPTS);
! 1988: }
! 1989: }
! 1990:
! 1991: /*
! 1992: * Routine called from ip_output() to loop back a copy of an IP multicast
! 1993: * packet to the input queue of a specified interface. Note that this
! 1994: * calls the output routine of the loopback "driver", but with an interface
! 1995: * pointer that might NOT be &loif -- easier than replicating that code here.
! 1996: */
! 1997: void
! 1998: ip_mloopback(ifp, m, dst)
! 1999: struct ifnet *ifp;
! 2000: struct mbuf *m;
! 2001: struct sockaddr_in *dst;
! 2002: {
! 2003: struct ip *ip;
! 2004: struct mbuf *copym;
! 2005:
! 2006: copym = m_copym2(m, 0, M_COPYALL, M_DONTWAIT);
! 2007: if (copym != NULL) {
! 2008: /*
! 2009: * We don't bother to fragment if the IP length is greater
! 2010: * than the interface's MTU. Can this possibly matter?
! 2011: */
! 2012: ip = mtod(copym, struct ip *);
! 2013: ip->ip_sum = 0;
! 2014: ip->ip_sum = in_cksum(copym, ip->ip_hl << 2);
! 2015: (void) looutput(ifp, copym, sintosa(dst), NULL);
! 2016: }
! 2017: }
! 2018:
! 2019: /*
! 2020: * Process a delayed payload checksum calculation.
! 2021: */
! 2022: void
! 2023: in_delayed_cksum(struct mbuf *m)
! 2024: {
! 2025: struct ip *ip;
! 2026: u_int16_t csum, offset;
! 2027:
! 2028: ip = mtod(m, struct ip *);
! 2029: offset = ip->ip_hl << 2;
! 2030: csum = in4_cksum(m, 0, offset, m->m_pkthdr.len - offset);
! 2031: if (csum == 0 && ip->ip_p == IPPROTO_UDP)
! 2032: csum = 0xffff;
! 2033:
! 2034: switch (ip->ip_p) {
! 2035: case IPPROTO_TCP:
! 2036: offset += offsetof(struct tcphdr, th_sum);
! 2037: break;
! 2038:
! 2039: case IPPROTO_UDP:
! 2040: offset += offsetof(struct udphdr, uh_sum);
! 2041: break;
! 2042:
! 2043: default:
! 2044: return;
! 2045: }
! 2046:
! 2047: if ((offset + sizeof(u_int16_t)) > m->m_len)
! 2048: m_copyback(m, offset, sizeof(csum), &csum);
! 2049: else
! 2050: *(u_int16_t *)(mtod(m, caddr_t) + offset) = csum;
! 2051: }