if_ether.c revision 194951
1139823Simp/*- 21541Srgrimes * Copyright (c) 1982, 1986, 1988, 1993 31541Srgrimes * The Regents of the University of California. All rights reserved. 41541Srgrimes * 51541Srgrimes * Redistribution and use in source and binary forms, with or without 61541Srgrimes * modification, are permitted provided that the following conditions 71541Srgrimes * are met: 81541Srgrimes * 1. Redistributions of source code must retain the above copyright 91541Srgrimes * notice, this list of conditions and the following disclaimer. 101541Srgrimes * 2. Redistributions in binary form must reproduce the above copyright 111541Srgrimes * notice, this list of conditions and the following disclaimer in the 121541Srgrimes * documentation and/or other materials provided with the distribution. 131541Srgrimes * 4. Neither the name of the University nor the names of its contributors 141541Srgrimes * may be used to endorse or promote products derived from this software 151541Srgrimes * without specific prior written permission. 161541Srgrimes * 171541Srgrimes * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 181541Srgrimes * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 191541Srgrimes * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 201541Srgrimes * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 211541Srgrimes * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 221541Srgrimes * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 231541Srgrimes * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 241541Srgrimes * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 251541Srgrimes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 261541Srgrimes * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 271541Srgrimes * SUCH DAMAGE. 281541Srgrimes * 291541Srgrimes * @(#)if_ether.c 8.1 (Berkeley) 6/10/93 301541Srgrimes */ 311541Srgrimes 321541Srgrimes/* 331541Srgrimes * Ethernet address resolution protocol. 341541Srgrimes * TODO: 351541Srgrimes * add "inuse/lock" bit (or ref. count) along with valid bit 361541Srgrimes */ 371541Srgrimes 38172467Ssilby#include <sys/cdefs.h> 39172467Ssilby__FBSDID("$FreeBSD: head/sys/netinet/if_ether.c 194951 2009-06-25 11:52:33Z rwatson $"); 40172467Ssilby 4132350Seivind#include "opt_inet.h" 42142215Sglebius#include "opt_carp.h" 4332350Seivind 441541Srgrimes#include <sys/param.h> 4512693Sphk#include <sys/kernel.h> 4644078Sdfr#include <sys/queue.h> 4712693Sphk#include <sys/sysctl.h> 481541Srgrimes#include <sys/systm.h> 4912693Sphk#include <sys/mbuf.h> 501541Srgrimes#include <sys/malloc.h> 51183014Sjulian#include <sys/proc.h> 5218892Sbde#include <sys/socket.h> 531541Srgrimes#include <sys/syslog.h> 54181803Sbz#include <sys/vimage.h> 551541Srgrimes 561541Srgrimes#include <net/if.h> 571541Srgrimes#include <net/if_dl.h> 5844165Sjulian#include <net/if_types.h> 598426Swollman#include <net/netisr.h> 6058313Slile#include <net/if_llc.h> 6171963Sjulian#include <net/ethernet.h> 62194739Sbz#include <net/route.h> 631541Srgrimes 641541Srgrimes#include <netinet/in.h> 651541Srgrimes#include <netinet/in_var.h> 66186119Sqingli#include <net/if_llatbl.h> 671541Srgrimes#include <netinet/if_ether.h> 68185571Sbz#include <netinet/vinet.h> 691541Srgrimes 7084931Sfjoe#include <net/if_arc.h> 7144627Sjulian#include <net/iso88025.h> 7244627Sjulian 73142215Sglebius#ifdef DEV_CARP 74142215Sglebius#include <netinet/ip_carp.h> 75142215Sglebius#endif 76142215Sglebius 77163606Srwatson#include <security/mac/mac_framework.h> 78163606Srwatson 791541Srgrimes#define SIN(s) ((struct sockaddr_in *)s) 801541Srgrimes#define SDL(s) ((struct sockaddr_dl *)s) 811541Srgrimes 8244078SdfrSYSCTL_DECL(_net_link_ether); 8312942SwollmanSYSCTL_NODE(_net_link_ether, PF_INET, inet, CTLFLAG_RW, 0, ""); 841541Srgrimes 8512693Sphk/* timer values */ 86185088Szec#ifdef VIMAGE_GLOBALS 87185088Szecstatic int arpt_keep; /* once resolved, good for 20 more minutes */ 88185088Szecstatic int arp_maxtries; 89186119Sqingliint useloopback; /* use loopback interface for local traffic */ 90185088Szecstatic int arp_proxyall; 91185088Szec#endif 921541Srgrimes 93185348SzecSYSCTL_V_INT(V_NET, vnet_inet, _net_link_ether_inet, OID_AUTO, max_age, 94185348Szec CTLFLAG_RW, arpt_keep, 0, "ARP entry lifetime in seconds"); 9512693Sphk 96183550SzecSYSCTL_V_INT(V_NET, vnet_inet, _net_link_ether_inet, OID_AUTO, maxtries, 97183550Szec CTLFLAG_RW, arp_maxtries, 0, 98183550Szec "ARP resolution attempts before returning error"); 99183550SzecSYSCTL_V_INT(V_NET, vnet_inet, _net_link_ether_inet, OID_AUTO, useloopback, 100183550Szec CTLFLAG_RW, useloopback, 0, 101183550Szec "Use the loopback interface for local traffic"); 102183550SzecSYSCTL_V_INT(V_NET, vnet_inet, _net_link_ether_inet, OID_AUTO, proxyall, 103183550Szec CTLFLAG_RW, arp_proxyall, 0, 104183550Szec "Enable proxy ARP for all suitable requests"); 10512693Sphk 10692723Salfredstatic void arp_init(void); 107190787Szecstatic int arp_iattach(const void *); 108186119Sqinglivoid arprequest(struct ifnet *, 10992723Salfred struct in_addr *, struct in_addr *, u_char *); 110111888Sjlemonstatic void arpintr(struct mbuf *); 11192723Salfredstatic void arptimer(void *); 11232350Seivind#ifdef INET 11392723Salfredstatic void in_arpinput(struct mbuf *); 11432350Seivind#endif 11512693Sphk 116193219Srwatsonstatic const struct netisr_handler arp_nh = { 117193219Srwatson .nh_name = "arp", 118193219Srwatson .nh_handler = arpintr, 119193219Srwatson .nh_proto = NETISR_ARP, 120193219Srwatson .nh_policy = NETISR_POLICY_SOURCE, 121193219Srwatson}; 122193219Srwatson 123190909Szec#ifndef VIMAGE_GLOBALS 124190909Szecstatic const vnet_modinfo_t vnet_arp_modinfo = { 125190909Szec .vmi_id = VNET_MOD_ARP, 126190909Szec .vmi_name = "arp", 127190909Szec .vmi_dependson = VNET_MOD_INET, 128190909Szec .vmi_iattach = arp_iattach 129190909Szec}; 130190909Szec#endif /* !VIMAGE_GLOBALS */ 131190909Szec 132186119Sqingli#ifdef AF_INET 133186119Sqinglivoid arp_ifscrub(struct ifnet *ifp, uint32_t addr); 134186119Sqingli 1351541Srgrimes/* 136186119Sqingli * called by in_ifscrub to remove entry from the table when 137186119Sqingli * the interface goes away 1381541Srgrimes */ 139186119Sqinglivoid 140186119Sqingliarp_ifscrub(struct ifnet *ifp, uint32_t addr) 1411541Srgrimes{ 142186119Sqingli struct sockaddr_in addr4; 1431541Srgrimes 144186119Sqingli bzero((void *)&addr4, sizeof(addr4)); 145186119Sqingli addr4.sin_len = sizeof(addr4); 146186119Sqingli addr4.sin_family = AF_INET; 147186119Sqingli addr4.sin_addr.s_addr = addr; 148191816Szec CURVNET_SET(ifp->if_vnet); 149186119Sqingli IF_AFDATA_LOCK(ifp); 150186119Sqingli lla_lookup(LLTABLE(ifp), (LLE_DELETE | LLE_IFADDR), 151186119Sqingli (struct sockaddr *)&addr4); 152186119Sqingli IF_AFDATA_UNLOCK(ifp); 153191816Szec CURVNET_RESTORE(); 1541541Srgrimes} 155186119Sqingli#endif 1561541Srgrimes 1571541Srgrimes/* 158186119Sqingli * Timeout routine. Age arp_tab entries periodically. 1591541Srgrimes */ 1605196Swollmanstatic void 161186119Sqingliarptimer(void *arg) 1621541Srgrimes{ 163186119Sqingli struct ifnet *ifp; 164186119Sqingli struct llentry *lle = (struct llentry *)arg; 1651541Srgrimes 166186119Sqingli if (lle == NULL) { 167186119Sqingli panic("%s: NULL entry!\n", __func__); 1681541Srgrimes return; 169186119Sqingli } 170186119Sqingli ifp = lle->lle_tbl->llt_ifp; 171186119Sqingli IF_AFDATA_LOCK(ifp); 172186119Sqingli LLE_WLOCK(lle); 173186474Skmacy if (((lle->la_flags & LLE_DELETED) 174186474Skmacy || (time_second >= lle->la_expire)) 175186474Skmacy && (!callout_pending(&lle->la_timer) && 176186474Skmacy callout_active(&lle->la_timer))) 177186474Skmacy (void) llentry_free(lle); 178186474Skmacy else { 1791541Srgrimes /* 180186119Sqingli * Still valid, just drop our reference 1811541Srgrimes */ 182186119Sqingli LLE_FREE_LOCKED(lle); 1831541Srgrimes } 184186119Sqingli IF_AFDATA_UNLOCK(ifp); 1851541Srgrimes} 1861541Srgrimes 1871541Srgrimes/* 1881541Srgrimes * Broadcast an ARP request. Caller specifies: 1891541Srgrimes * - arp header source ip address 1901541Srgrimes * - arp header target ip address 1911541Srgrimes * - arp header source ethernet address 1921541Srgrimes */ 193186119Sqinglivoid 194186119Sqingliarprequest(struct ifnet *ifp, struct in_addr *sip, struct in_addr *tip, 195169454Srwatson u_char *enaddr) 1961541Srgrimes{ 197126936Smdodd struct mbuf *m; 198126936Smdodd struct arphdr *ah; 1991541Srgrimes struct sockaddr sa; 2001541Srgrimes 201186119Sqingli if (sip == NULL) { 202186119Sqingli /* XXX don't believe this can happen (or explain why) */ 203186119Sqingli /* 204186119Sqingli * The caller did not supply a source address, try to find 205186119Sqingli * a compatible one among those assigned to this interface. 206186119Sqingli */ 207186119Sqingli struct ifaddr *ifa; 208186119Sqingli 209186119Sqingli TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 210186119Sqingli if (!ifa->ifa_addr || 211186119Sqingli ifa->ifa_addr->sa_family != AF_INET) 212186119Sqingli continue; 213186119Sqingli sip = &SIN(ifa->ifa_addr)->sin_addr; 214186119Sqingli if (0 == ((sip->s_addr ^ tip->s_addr) & 215186119Sqingli SIN(ifa->ifa_netmask)->sin_addr.s_addr) ) 216186119Sqingli break; /* found it. */ 217186119Sqingli } 218186119Sqingli if (sip == NULL) { 219186119Sqingli printf("%s: cannot find matching address\n", __func__); 220186119Sqingli return; 221186119Sqingli } 222186119Sqingli } 223186119Sqingli 224111119Simp if ((m = m_gethdr(M_DONTWAIT, MT_DATA)) == NULL) 2251541Srgrimes return; 226127261Smdodd m->m_len = sizeof(*ah) + 2*sizeof(struct in_addr) + 227127261Smdodd 2*ifp->if_data.ifi_addrlen; 228127277Smdodd m->m_pkthdr.len = m->m_len; 229127277Smdodd MH_ALIGN(m, m->m_len); 230127277Smdodd ah = mtod(m, struct arphdr *); 231127261Smdodd bzero((caddr_t)ah, m->m_len); 232101090Srwatson#ifdef MAC 233173095Srwatson mac_netinet_arp_send(ifp, m); 234101090Srwatson#endif 23584931Sfjoe ah->ar_pro = htons(ETHERTYPE_IP); 23684931Sfjoe ah->ar_hln = ifp->if_addrlen; /* hardware address length */ 23784931Sfjoe ah->ar_pln = sizeof(struct in_addr); /* protocol address length */ 23884931Sfjoe ah->ar_op = htons(ARPOP_REQUEST); 239127261Smdodd bcopy((caddr_t)enaddr, (caddr_t)ar_sha(ah), ah->ar_hln); 240127261Smdodd bcopy((caddr_t)sip, (caddr_t)ar_spa(ah), ah->ar_pln); 241127261Smdodd bcopy((caddr_t)tip, (caddr_t)ar_tpa(ah), ah->ar_pln); 242127261Smdodd sa.sa_family = AF_ARP; 243127261Smdodd sa.sa_len = 2; 244127261Smdodd m->m_flags |= M_BCAST; 245191148Skmacy (*ifp->if_output)(ifp, m, &sa, NULL); 2461541Srgrimes} 2471541Srgrimes 2481541Srgrimes/* 249128636Sluigi * Resolve an IP address into an ethernet address. 250128636Sluigi * On input: 251128636Sluigi * ifp is the interface we use 252175025Sjulian * rt0 is the route to the final destination (possibly useless) 253175025Sjulian * m is the mbuf. May be NULL if we don't have a packet. 254128636Sluigi * dst is the next hop, 255128636Sluigi * desten is where we want the address. 256128636Sluigi * 257128636Sluigi * On success, desten is filled in and the function returns 0; 258128636Sluigi * If the packet must be held pending resolution, we return EWOULDBLOCK 259128636Sluigi * On other errors, we return the corresponding error code. 260175025Sjulian * Note that m_freem() handles NULL. 2611541Srgrimes */ 2621541Srgrimesint 263128636Sluigiarpresolve(struct ifnet *ifp, struct rtentry *rt0, struct mbuf *m, 264186119Sqingli struct sockaddr *dst, u_char *desten, struct llentry **lle) 2651541Srgrimes{ 266183550Szec INIT_VNET_INET(ifp->if_vnet); 267186119Sqingli struct llentry *la = 0; 268186200Skmacy u_int flags = 0; 269186119Sqingli int error, renew; 2701541Srgrimes 271186119Sqingli *lle = NULL; 272186119Sqingli if (m != NULL) { 273175025Sjulian if (m->m_flags & M_BCAST) { 274175025Sjulian /* broadcast */ 275175025Sjulian (void)memcpy(desten, 276175025Sjulian ifp->if_broadcastaddr, ifp->if_addrlen); 277175025Sjulian return (0); 278175025Sjulian } 279175025Sjulian if (m->m_flags & M_MCAST && ifp->if_type != IFT_ARCNET) { 280175025Sjulian /* multicast */ 281175025Sjulian ETHER_MAP_IP_MULTICAST(&SIN(dst)->sin_addr, desten); 282175025Sjulian return (0); 283175025Sjulian } 2841541Srgrimes } 285186119Sqingli /* XXXXX 286183013Sjulian */ 287186119Sqingliretry: 288186200Skmacy IF_AFDATA_RLOCK(ifp); 289186119Sqingli la = lla_lookup(LLTABLE(ifp), flags, dst); 290186200Skmacy IF_AFDATA_RUNLOCK(ifp); 291186200Skmacy if ((la == NULL) && ((flags & LLE_EXCLUSIVE) == 0) 292186200Skmacy && ((ifp->if_flags & (IFF_NOARP | IFF_STATICARP)) == 0)) { 293186200Skmacy flags |= (LLE_CREATE | LLE_EXCLUSIVE); 294186200Skmacy IF_AFDATA_WLOCK(ifp); 295186200Skmacy la = lla_lookup(LLTABLE(ifp), flags, dst); 296186200Skmacy IF_AFDATA_WUNLOCK(ifp); 297186200Skmacy } 298148955Sglebius if (la == NULL) { 299186119Sqingli if (flags & LLE_CREATE) 300148955Sglebius log(LOG_DEBUG, 301148955Sglebius "arpresolve: can't allocate llinfo for %s\n", 302148955Sglebius inet_ntoa(SIN(dst)->sin_addr)); 303186119Sqingli m_freem(m); 304186119Sqingli return (EINVAL); 305186119Sqingli } 306149909Sglebius 307186119Sqingli if ((la->la_flags & LLE_VALID) && 308186119Sqingli ((la->la_flags & LLE_STATIC) || la->la_expire > time_uptime)) { 309186119Sqingli bcopy(&la->ll_addr, desten, ifp->if_addrlen); 31092802Sorion /* 31192802Sorion * If entry has an expiry time and it is approaching, 312186119Sqingli * see if we need to send an ARP request within this 313186119Sqingli * arpt_down interval. 31492802Sorion */ 315186119Sqingli if (!(la->la_flags & LLE_STATIC) && 316186119Sqingli time_uptime + la->la_preempt > la->la_expire) { 317186119Sqingli arprequest(ifp, NULL, 318186119Sqingli &SIN(dst)->sin_addr, IF_LLADDR(ifp)); 319149909Sglebius 320110544Sorion la->la_preempt--; 321186119Sqingli } 322186119Sqingli 323186119Sqingli *lle = la; 324186119Sqingli error = 0; 325186119Sqingli goto done; 326186119Sqingli } 327186119Sqingli 328186119Sqingli if (la->la_flags & LLE_STATIC) { /* should not happen! */ 329186119Sqingli log(LOG_DEBUG, "arpresolve: ouch, empty static llinfo for %s\n", 330186119Sqingli inet_ntoa(SIN(dst)->sin_addr)); 331186119Sqingli m_freem(m); 332186119Sqingli error = EINVAL; 333186119Sqingli goto done; 334186119Sqingli } 33592802Sorion 336186119Sqingli renew = (la->la_asked == 0 || la->la_expire != time_uptime); 337186119Sqingli if ((renew || m != NULL) && (flags & LLE_EXCLUSIVE) == 0) { 338186119Sqingli flags |= LLE_EXCLUSIVE; 339186119Sqingli LLE_RUNLOCK(la); 340186119Sqingli goto retry; 3411541Srgrimes } 3421541Srgrimes /* 3431541Srgrimes * There is an arptab entry, but no ethernet address 3441541Srgrimes * response yet. Replace the held mbuf with this 3451541Srgrimes * latest one. 3461541Srgrimes */ 347186119Sqingli if (m != NULL) { 348186119Sqingli if (la->la_hold != NULL) 349175025Sjulian m_freem(la->la_hold); 350175025Sjulian la->la_hold = m; 351186119Sqingli if (renew == 0 && (flags & LLE_EXCLUSIVE)) { 352186119Sqingli flags &= ~LLE_EXCLUSIVE; 353186119Sqingli LLE_DOWNGRADE(la); 354186119Sqingli } 355186119Sqingli 356174699Skmacy } 357152188Sglebius /* 358152188Sglebius * Return EWOULDBLOCK if we have tried less than arp_maxtries. It 359152188Sglebius * will be masked by ether_output(). Return EHOSTDOWN/EHOSTUNREACH 360152188Sglebius * if we have already sent arp_maxtries ARP requests. Retransmit the 361152188Sglebius * ARP request, but not faster than one request per second. 362152188Sglebius */ 363181803Sbz if (la->la_asked < V_arp_maxtries) 364152188Sglebius error = EWOULDBLOCK; /* First request. */ 365152188Sglebius else 366186119Sqingli error = 367186119Sqingli (rt0->rt_flags & RTF_GATEWAY) ? EHOSTDOWN : EHOSTUNREACH; 368152188Sglebius 369186119Sqingli if (renew) { 370186119Sqingli LLE_ADDREF(la); 371186119Sqingli la->la_expire = time_uptime; 372186119Sqingli callout_reset(&la->la_timer, hz, arptimer, la); 373166010Smaxim la->la_asked++; 374186119Sqingli LLE_WUNLOCK(la); 375186119Sqingli arprequest(ifp, NULL, &SIN(dst)->sin_addr, 376152188Sglebius IF_LLADDR(ifp)); 377186119Sqingli return (error); 378186119Sqingli } 379186119Sqinglidone: 380186119Sqingli if (flags & LLE_EXCLUSIVE) 381186119Sqingli LLE_WUNLOCK(la); 382186119Sqingli else 383186119Sqingli LLE_RUNLOCK(la); 384152188Sglebius return (error); 3851541Srgrimes} 3861541Srgrimes 3871541Srgrimes/* 3881541Srgrimes * Common length and type checks are done here, 3891541Srgrimes * then the protocol-specific routine is called. 3901541Srgrimes */ 39112693Sphkstatic void 392111888Sjlemonarpintr(struct mbuf *m) 3931541Srgrimes{ 394111888Sjlemon struct arphdr *ar; 3951541Srgrimes 396111888Sjlemon if (m->m_len < sizeof(struct arphdr) && 397111888Sjlemon ((m = m_pullup(m, sizeof(struct arphdr))) == NULL)) { 398111888Sjlemon log(LOG_ERR, "arp: runt packet -- m_pullup failed\n"); 399111888Sjlemon return; 400111888Sjlemon } 401111888Sjlemon ar = mtod(m, struct arphdr *); 4021541Srgrimes 403111888Sjlemon if (ntohs(ar->ar_hrd) != ARPHRD_ETHER && 404111888Sjlemon ntohs(ar->ar_hrd) != ARPHRD_IEEE802 && 405130407Sdfr ntohs(ar->ar_hrd) != ARPHRD_ARCNET && 406130407Sdfr ntohs(ar->ar_hrd) != ARPHRD_IEEE1394) { 407111888Sjlemon log(LOG_ERR, "arp: unknown hardware address format (0x%2D)\n", 408111888Sjlemon (unsigned char *)&ar->ar_hrd, ""); 409111888Sjlemon m_freem(m); 410111888Sjlemon return; 411111888Sjlemon } 4121541Srgrimes 413123768Sru if (m->m_len < arphdr_len(ar)) { 414123765Sru if ((m = m_pullup(m, arphdr_len(ar))) == NULL) { 415123765Sru log(LOG_ERR, "arp: runt packet\n"); 416123765Sru m_freem(m); 417123765Sru return; 418123765Sru } 419123765Sru ar = mtod(m, struct arphdr *); 420111888Sjlemon } 42157900Srwatson 422111888Sjlemon switch (ntohs(ar->ar_pro)) { 42332350Seivind#ifdef INET 424111888Sjlemon case ETHERTYPE_IP: 425111888Sjlemon in_arpinput(m); 426111888Sjlemon return; 42732350Seivind#endif 4281541Srgrimes } 429111888Sjlemon m_freem(m); 4301541Srgrimes} 4311541Srgrimes 43232350Seivind#ifdef INET 4331541Srgrimes/* 4341541Srgrimes * ARP for Internet protocols on 10 Mb/s Ethernet. 4351541Srgrimes * Algorithm is that given in RFC 826. 4361541Srgrimes * In addition, a sanity check is performed on the sender 4371541Srgrimes * protocol address, to catch impersonators. 4381541Srgrimes * We no longer handle negotiations for use of trailer protocol: 4391541Srgrimes * Formerly, ARP replied for protocol type ETHERTYPE_TRAIL sent 4401541Srgrimes * along with IP replies if we wanted trailers sent to us, 4411541Srgrimes * and also sent them in response to IP replies. 4421541Srgrimes * This allowed either end to announce the desire to receive 4431541Srgrimes * trailer packets. 4441541Srgrimes * We no longer reply to requests for ETHERTYPE_TRAIL protocol either, 4451541Srgrimes * but formerly didn't normally send requests. 4461541Srgrimes */ 44770699Salfredstatic int log_arp_wrong_iface = 1; 44882893Salfredstatic int log_arp_movements = 1; 449153513Sglebiusstatic int log_arp_permanent_modify = 1; 45070699Salfred 45170699SalfredSYSCTL_INT(_net_link_ether_inet, OID_AUTO, log_arp_wrong_iface, CTLFLAG_RW, 45270699Salfred &log_arp_wrong_iface, 0, 45370699Salfred "log arp packets arriving on the wrong interface"); 45482893SalfredSYSCTL_INT(_net_link_ether_inet, OID_AUTO, log_arp_movements, CTLFLAG_RW, 45582893Salfred &log_arp_movements, 0, 45682966Salfred "log arp replies from MACs different than the one in the cache"); 457153513SglebiusSYSCTL_INT(_net_link_ether_inet, OID_AUTO, log_arp_permanent_modify, CTLFLAG_RW, 458153513Sglebius &log_arp_permanent_modify, 0, 459153513Sglebius "log arp replies from MACs different than the one in the permanent arp entry"); 46070699Salfred 46182893Salfred 4621541Srgrimesstatic void 463169454Srwatsonin_arpinput(struct mbuf *m) 4641541Srgrimes{ 465126936Smdodd struct arphdr *ah; 466126936Smdodd struct ifnet *ifp = m->m_pkthdr.rcvif; 467186119Sqingli struct llentry *la = NULL; 468126936Smdodd struct rtentry *rt; 46984102Sjlemon struct ifaddr *ifa; 47084102Sjlemon struct in_ifaddr *ia; 4711541Srgrimes struct sockaddr sa; 4721541Srgrimes struct in_addr isaddr, itaddr, myaddr; 473142215Sglebius u_int8_t *enaddr = NULL; 474186119Sqingli int op, flags; 475186119Sqingli struct mbuf *m0; 47684931Sfjoe int req_len; 477181824Sphilip int bridged = 0, is_bridge = 0; 478143491Sglebius#ifdef DEV_CARP 479143314Sglebius int carp_match = 0; 480143491Sglebius#endif 481174559Skmacy struct sockaddr_in sin; 482174559Skmacy sin.sin_len = sizeof(struct sockaddr_in); 483174559Skmacy sin.sin_family = AF_INET; 484174703Skmacy sin.sin_addr.s_addr = 0; 485183550Szec INIT_VNET_INET(ifp->if_vnet); 486183550Szec 487155018Sthompsa if (ifp->if_bridge) 488146986Sthompsa bridged = 1; 489181824Sphilip if (ifp->if_type == IFT_BRIDGE) 490181824Sphilip is_bridge = 1; 491146986Sthompsa 49284931Sfjoe req_len = arphdr_len2(ifp->if_addrlen, sizeof(struct in_addr)); 49384931Sfjoe if (m->m_len < req_len && (m = m_pullup(m, req_len)) == NULL) { 49474851Syar log(LOG_ERR, "in_arp: runt packet -- m_pullup failed\n"); 49574851Syar return; 49674851Syar } 49774851Syar 49884931Sfjoe ah = mtod(m, struct arphdr *); 49984931Sfjoe op = ntohs(ah->ar_op); 50084931Sfjoe (void)memcpy(&isaddr, ar_spa(ah), sizeof (isaddr)); 50184931Sfjoe (void)memcpy(&itaddr, ar_tpa(ah), sizeof (itaddr)); 502134991Sglebius 50384102Sjlemon /* 50484102Sjlemon * For a bridge, we want to check the address irrespective 50584102Sjlemon * of the receive interface. (This will change slightly 50684102Sjlemon * when we have clusters of interfaces). 507142215Sglebius * If the interface does not match, but the recieving interface 508142215Sglebius * is part of carp, we call carp_iamatch to see if this is a 509142215Sglebius * request for the virtual host ip. 510142215Sglebius * XXX: This is really ugly! 51184102Sjlemon */ 512194951Srwatson IN_IFADDR_RLOCK(); 513143314Sglebius LIST_FOREACH(ia, INADDR_HASH(itaddr.s_addr), ia_hash) { 514156409Sthompsa if (((bridged && ia->ia_ifp->if_bridge != NULL) || 515186119Sqingli ia->ia_ifp == ifp) && 516194820Srwatson itaddr.s_addr == ia->ia_addr.sin_addr.s_addr) { 517194820Srwatson ifa_ref(&ia->ia_ifa); 518194951Srwatson IN_IFADDR_RUNLOCK(); 519143314Sglebius goto match; 520194820Srwatson } 521142215Sglebius#ifdef DEV_CARP 522143314Sglebius if (ifp->if_carp != NULL && 523143314Sglebius carp_iamatch(ifp->if_carp, ia, &isaddr, &enaddr) && 524143314Sglebius itaddr.s_addr == ia->ia_addr.sin_addr.s_addr) { 525143314Sglebius carp_match = 1; 526194820Srwatson ifa_ref(&ia->ia_ifa); 527194951Srwatson IN_IFADDR_RUNLOCK(); 528143314Sglebius goto match; 529143314Sglebius } 530142215Sglebius#endif 531143314Sglebius } 53284102Sjlemon LIST_FOREACH(ia, INADDR_HASH(isaddr.s_addr), ia_hash) 533156409Sthompsa if (((bridged && ia->ia_ifp->if_bridge != NULL) || 534186119Sqingli ia->ia_ifp == ifp) && 535194820Srwatson isaddr.s_addr == ia->ia_addr.sin_addr.s_addr) { 536194820Srwatson ifa_ref(&ia->ia_ifa); 537194951Srwatson IN_IFADDR_RUNLOCK(); 53884102Sjlemon goto match; 539194820Srwatson } 540181824Sphilip 541181824Sphilip#define BDG_MEMBER_MATCHES_ARP(addr, ifp, ia) \ 542181824Sphilip (ia->ia_ifp->if_bridge == ifp->if_softc && \ 543181824Sphilip !bcmp(IF_LLADDR(ia->ia_ifp), IF_LLADDR(ifp), ifp->if_addrlen) && \ 544181824Sphilip addr == ia->ia_addr.sin_addr.s_addr) 54584102Sjlemon /* 546181824Sphilip * Check the case when bridge shares its MAC address with 547181824Sphilip * some of its children, so packets are claimed by bridge 548181824Sphilip * itself (bridge_input() does it first), but they are really 549181824Sphilip * meant to be destined to the bridge member. 550181824Sphilip */ 551181824Sphilip if (is_bridge) { 552181824Sphilip LIST_FOREACH(ia, INADDR_HASH(itaddr.s_addr), ia_hash) { 553181824Sphilip if (BDG_MEMBER_MATCHES_ARP(itaddr.s_addr, ifp, ia)) { 554194820Srwatson ifa_ref(&ia->ia_ifa); 555181824Sphilip ifp = ia->ia_ifp; 556194951Srwatson IN_IFADDR_RUNLOCK(); 557181824Sphilip goto match; 558181824Sphilip } 559181824Sphilip } 560181824Sphilip } 561181824Sphilip#undef BDG_MEMBER_MATCHES_ARP 562194951Srwatson IN_IFADDR_RUNLOCK(); 563181824Sphilip 564181824Sphilip /* 56585223Sjlemon * No match, use the first inet address on the receive interface 56684102Sjlemon * as a dummy address for the rest of the function. 56784102Sjlemon */ 568194820Srwatson IF_ADDR_LOCK(ifp); 56985223Sjlemon TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) 570160038Syar if (ifa->ifa_addr->sa_family == AF_INET) { 57185466Sjlemon ia = ifatoia(ifa); 572194820Srwatson ifa_ref(ifa); 573194837Srwatson IF_ADDR_UNLOCK(ifp); 57485466Sjlemon goto match; 57585466Sjlemon } 576194820Srwatson IF_ADDR_UNLOCK(ifp); 577194820Srwatson 57885466Sjlemon /* 57985466Sjlemon * If bridging, fall back to using any inet address. 58085466Sjlemon */ 581194951Srwatson IN_IFADDR_RLOCK(); 582194951Srwatson if (!bridged || (ia = TAILQ_FIRST(&V_in_ifaddrhead)) == NULL) { 583194951Srwatson IN_IFADDR_RUNLOCK(); 584128645Sluigi goto drop; 585194951Srwatson } 586194820Srwatson ifa_ref(&ia->ia_ifa); 587194951Srwatson IN_IFADDR_RUNLOCK(); 58884102Sjlemonmatch: 589142215Sglebius if (!enaddr) 590142215Sglebius enaddr = (u_int8_t *)IF_LLADDR(ifp); 59184102Sjlemon myaddr = ia->ia_addr.sin_addr; 592194820Srwatson ifa_free(&ia->ia_ifa); 593142215Sglebius if (!bcmp(ar_sha(ah), enaddr, ifp->if_addrlen)) 594128645Sluigi goto drop; /* it's from me, ignore it. */ 59584931Sfjoe if (!bcmp(ar_sha(ah), ifp->if_broadcastaddr, ifp->if_addrlen)) { 5961541Srgrimes log(LOG_ERR, 59784931Sfjoe "arp: link address is broadcast for IP address %s!\n", 5987088Swollman inet_ntoa(isaddr)); 599128645Sluigi goto drop; 6001541Srgrimes } 601136441Srwatson /* 602136441Srwatson * Warn if another host is using the same IP address, but only if the 603136441Srwatson * IP address isn't 0.0.0.0, which is used for DHCP only, in which 604136441Srwatson * case we suppress the warning to avoid false positive complaints of 605136441Srwatson * potential misconfiguration. 606136441Srwatson */ 607150942Sthompsa if (!bridged && isaddr.s_addr == myaddr.s_addr && myaddr.s_addr != 0) { 6081541Srgrimes log(LOG_ERR, 609174256Syar "arp: %*D is using my IP address %s on %s!\n", 61084931Sfjoe ifp->if_addrlen, (u_char *)ar_sha(ah), ":", 611174256Syar inet_ntoa(isaddr), ifp->if_xname); 6121541Srgrimes itaddr = myaddr; 6131541Srgrimes goto reply; 6141541Srgrimes } 615120626Sru if (ifp->if_flags & IFF_STATICARP) 616120626Sru goto reply; 617148955Sglebius 618186119Sqingli bzero(&sin, sizeof(sin)); 619186119Sqingli sin.sin_len = sizeof(struct sockaddr_in); 620186119Sqingli sin.sin_family = AF_INET; 621186119Sqingli sin.sin_addr = isaddr; 622186119Sqingli flags = (itaddr.s_addr == myaddr.s_addr) ? LLE_CREATE : 0; 623186119Sqingli flags |= LLE_EXCLUSIVE; 624186119Sqingli IF_AFDATA_LOCK(ifp); 625186119Sqingli la = lla_lookup(LLTABLE(ifp), flags, (struct sockaddr *)&sin); 626186119Sqingli IF_AFDATA_UNLOCK(ifp); 627186119Sqingli if (la != NULL) { 628186119Sqingli /* the following is not an error when doing bridging */ 629186119Sqingli if (!bridged && la->lle_tbl->llt_ifp != ifp 630143491Sglebius#ifdef DEV_CARP 631186119Sqingli && (ifp->if_type != IFT_CARP || !carp_match) 632143491Sglebius#endif 633186119Sqingli ) { 634186119Sqingli if (log_arp_wrong_iface) 635186119Sqingli log(LOG_ERR, "arp: %s is on %s " 636186119Sqingli "but got reply from %*D on %s\n", 637186119Sqingli inet_ntoa(isaddr), 638186119Sqingli la->lle_tbl->llt_ifp->if_xname, 639186119Sqingli ifp->if_addrlen, (u_char *)ar_sha(ah), ":", 640186119Sqingli ifp->if_xname); 641186119Sqingli goto reply; 642186119Sqingli } 643186119Sqingli if ((la->la_flags & LLE_VALID) && 644186119Sqingli bcmp(ar_sha(ah), &la->ll_addr, ifp->if_addrlen)) { 645186119Sqingli if (la->la_flags & LLE_STATIC) { 646186119Sqingli log(LOG_ERR, 647186119Sqingli "arp: %*D attempts to modify permanent " 648186119Sqingli "entry for %s on %s\n", 649186119Sqingli ifp->if_addrlen, (u_char *)ar_sha(ah), ":", 650186119Sqingli inet_ntoa(isaddr), ifp->if_xname); 651186119Sqingli goto reply; 652178888Sjulian } 653186119Sqingli if (log_arp_movements) { 654186119Sqingli log(LOG_INFO, "arp: %s moved from %*D " 655186119Sqingli "to %*D on %s\n", 656186119Sqingli inet_ntoa(isaddr), 657186119Sqingli ifp->if_addrlen, 658186119Sqingli (u_char *)&la->ll_addr, ":", 659186119Sqingli ifp->if_addrlen, (u_char *)ar_sha(ah), ":", 660186119Sqingli ifp->if_xname); 661178888Sjulian } 662178888Sjulian } 663186119Sqingli 664186119Sqingli if (ifp->if_addrlen != ah->ar_hln) { 665186119Sqingli log(LOG_WARNING, 666186119Sqingli "arp from %*D: addr len: new %d, i/f %d (ignored)", 667186119Sqingli ifp->if_addrlen, (u_char *) ar_sha(ah), ":", 668186119Sqingli ah->ar_hln, ifp->if_addrlen); 669186119Sqingli goto reply; 670178888Sjulian } 671186119Sqingli (void)memcpy(&la->ll_addr, ar_sha(ah), ifp->if_addrlen); 672186119Sqingli la->la_flags |= LLE_VALID; 673178888Sjulian 674186119Sqingli if (!(la->la_flags & LLE_STATIC)) { 675186119Sqingli la->la_expire = time_uptime + V_arpt_keep; 676181803Sbz callout_reset(&la->la_timer, hz * V_arpt_keep, 677186119Sqingli arptimer, la); 67839389Sfenner } 679178888Sjulian la->la_asked = 0; 680181803Sbz la->la_preempt = V_arp_maxtries; 681186119Sqingli if (la->la_hold != NULL) { 682186119Sqingli m0 = la->la_hold; 683186119Sqingli la->la_hold = 0; 684186119Sqingli memcpy(&sa, L3_ADDR(la), sizeof(sa)); 685186119Sqingli LLE_WUNLOCK(la); 686186119Sqingli 687186119Sqingli (*ifp->if_output)(ifp, m0, &sa, NULL); 688186119Sqingli return; 689186119Sqingli } 690186119Sqingli } 691178888Sjulianreply: 692128645Sluigi if (op != ARPOP_REQUEST) 693128645Sluigi goto drop; 694186119Sqingli 6951541Srgrimes if (itaddr.s_addr == myaddr.s_addr) { 696178888Sjulian /* Shortcut.. the receiving interface is the target. */ 69784931Sfjoe (void)memcpy(ar_tha(ah), ar_sha(ah), ah->ar_hln); 698142215Sglebius (void)memcpy(ar_sha(ah), enaddr, ah->ar_hln); 6991541Srgrimes } else { 700186317Sqingli struct llentry *lle = NULL; 7013282Swollman 702186317Sqingli if (!V_arp_proxyall) 703186317Sqingli goto drop; 704186317Sqingli 705186317Sqingli sin.sin_addr = itaddr; 706186317Sqingli /* XXX MRT use table 0 for arp reply */ 707186317Sqingli rt = in_rtalloc1((struct sockaddr *)&sin, 0, 0UL, 0); 708186317Sqingli if (!rt) 709186317Sqingli goto drop; 710186317Sqingli 711186317Sqingli /* 712186317Sqingli * Don't send proxies for nodes on the same interface 713186317Sqingli * as this one came out of, or we'll get into a fight 714186317Sqingli * over who claims what Ether address. 715186317Sqingli */ 716186317Sqingli if (!rt->rt_ifp || rt->rt_ifp == ifp) { 717185713Scsjp RTFREE_LOCKED(rt); 718186317Sqingli goto drop; 719186317Sqingli } 720186317Sqingli IF_AFDATA_LOCK(rt->rt_ifp); 721186317Sqingli lle = lla_lookup(LLTABLE(rt->rt_ifp), 0, (struct sockaddr *)&sin); 722186317Sqingli IF_AFDATA_UNLOCK(rt->rt_ifp); 723186317Sqingli RTFREE_LOCKED(rt); 72463080Sdwmalone 725186317Sqingli if (lle != NULL) { 726186317Sqingli (void)memcpy(ar_tha(ah), ar_sha(ah), ah->ar_hln); 727186317Sqingli (void)memcpy(ar_sha(ah), &lle->ll_addr, ah->ar_hln); 728186317Sqingli LLE_RUNLOCK(lle); 729186317Sqingli } else 730186317Sqingli goto drop; 73163080Sdwmalone 732186317Sqingli /* 733186317Sqingli * Also check that the node which sent the ARP packet 734186317Sqingli * is on the the interface we expect it to be on. This 735186317Sqingli * avoids ARP chaos if an interface is connected to the 736186317Sqingli * wrong network. 737186317Sqingli */ 738186317Sqingli sin.sin_addr = isaddr; 739186317Sqingli 740186317Sqingli /* XXX MRT use table 0 for arp checks */ 741186317Sqingli rt = in_rtalloc1((struct sockaddr *)&sin, 0, 0UL, 0); 742186317Sqingli if (!rt) 743186317Sqingli goto drop; 744186317Sqingli if (rt->rt_ifp != ifp) { 745186317Sqingli log(LOG_INFO, "arp_proxy: ignoring request" 746186317Sqingli " from %s via %s, expecting %s\n", 747186317Sqingli inet_ntoa(isaddr), ifp->if_xname, 748186317Sqingli rt->rt_ifp->if_xname); 749185713Scsjp RTFREE_LOCKED(rt); 750186317Sqingli goto drop; 751186317Sqingli } 752186317Sqingli RTFREE_LOCKED(rt); 75363080Sdwmalone 7544069Swollman#ifdef DEBUG_PROXY 755186317Sqingli printf("arp: proxying for %s\n", 756186317Sqingli inet_ntoa(itaddr)); 7574069Swollman#endif 7581541Srgrimes } 7591541Srgrimes 760186119Sqingli if (la != NULL) 761186119Sqingli LLE_WUNLOCK(la); 762166436Sbms if (itaddr.s_addr == myaddr.s_addr && 763166436Sbms IN_LINKLOCAL(ntohl(itaddr.s_addr))) { 764166436Sbms /* RFC 3927 link-local IPv4; always reply by broadcast. */ 765166436Sbms#ifdef DEBUG_LINKLOCAL 766166436Sbms printf("arp: sending reply for link-local addr %s\n", 767166436Sbms inet_ntoa(itaddr)); 768166436Sbms#endif 769166436Sbms m->m_flags |= M_BCAST; 770166436Sbms m->m_flags &= ~M_MCAST; 771166436Sbms } else { 772166436Sbms /* default behaviour; never reply by broadcast. */ 773166436Sbms m->m_flags &= ~(M_BCAST|M_MCAST); 774166436Sbms } 77584931Sfjoe (void)memcpy(ar_tpa(ah), ar_spa(ah), ah->ar_pln); 77684931Sfjoe (void)memcpy(ar_spa(ah), &itaddr, ah->ar_pln); 77784931Sfjoe ah->ar_op = htons(ARPOP_REPLY); 77884931Sfjoe ah->ar_pro = htons(ETHERTYPE_IP); /* let's be sure! */ 779127261Smdodd m->m_len = sizeof(*ah) + (2 * ah->ar_pln) + (2 * ah->ar_hln); 780127261Smdodd m->m_pkthdr.len = m->m_len; 781127261Smdodd sa.sa_family = AF_ARP; 782127261Smdodd sa.sa_len = 2; 783191148Skmacy (*ifp->if_output)(ifp, m, &sa, NULL); 7841541Srgrimes return; 785128645Sluigi 786128645Sluigidrop: 787186119Sqingli if (la != NULL) 788186119Sqingli LLE_WUNLOCK(la); 789128645Sluigi m_freem(m); 7901541Srgrimes} 79132350Seivind#endif 7921541Srgrimes 7935195Swollmanvoid 794169454Srwatsonarp_ifinit(struct ifnet *ifp, struct ifaddr *ifa) 7955195Swollman{ 796186119Sqingli struct llentry *lle; 797186119Sqingli 798186411Sqingli if (ntohl(IA_SIN(ifa)->sin_addr.s_addr) != INADDR_ANY) { 79984931Sfjoe arprequest(ifp, &IA_SIN(ifa)->sin_addr, 80084931Sfjoe &IA_SIN(ifa)->sin_addr, IF_LLADDR(ifp)); 801186411Sqingli /* 802186411Sqingli * interface address is considered static entry 803186411Sqingli * because the output of the arp utility shows 804186411Sqingli * that L2 entry as permanent 805186411Sqingli */ 806186411Sqingli IF_AFDATA_LOCK(ifp); 807186411Sqingli lle = lla_lookup(LLTABLE(ifp), (LLE_CREATE | LLE_IFADDR | LLE_STATIC), 808186411Sqingli (struct sockaddr *)IA_SIN(ifa)); 809186411Sqingli IF_AFDATA_UNLOCK(ifp); 810186411Sqingli if (lle == NULL) 811186411Sqingli log(LOG_INFO, "arp_ifinit: cannot create arp " 812186411Sqingli "entry for interface address\n"); 813186411Sqingli else 814186411Sqingli LLE_RUNLOCK(lle); 815186411Sqingli } 816186119Sqingli ifa->ifa_rtrequest = NULL; 8175195Swollman} 81869152Sjlemon 819142215Sglebiusvoid 820169454Srwatsonarp_ifinit2(struct ifnet *ifp, struct ifaddr *ifa, u_char *enaddr) 821142215Sglebius{ 822142215Sglebius if (ntohl(IA_SIN(ifa)->sin_addr.s_addr) != INADDR_ANY) 823142215Sglebius arprequest(ifp, &IA_SIN(ifa)->sin_addr, 824142215Sglebius &IA_SIN(ifa)->sin_addr, enaddr); 825186119Sqingli ifa->ifa_rtrequest = NULL; 826142215Sglebius} 827142215Sglebius 828190787Szecstatic int 829190787Szecarp_iattach(const void *unused __unused) 83069152Sjlemon{ 831185088Szec INIT_VNET_INET(curvnet); 83269152Sjlemon 833185088Szec V_arpt_keep = (20*60); /* once resolved, good for 20 more minutes */ 834185088Szec V_arp_maxtries = 5; 835185088Szec V_useloopback = 1; /* use loopback interface for local traffic */ 836185088Szec V_arp_proxyall = 0; 837185088Szec 838190787Szec return (0); 839190787Szec} 840190787Szec 841190787Szecstatic void 842190787Szecarp_init(void) 843190787Szec{ 844190787Szec 845190909Szec#ifndef VIMAGE_GLOBALS 846190909Szec vnet_mod_register(&vnet_arp_modinfo); 847190909Szec#else 848190787Szec arp_iattach(NULL); 849190909Szec#endif 850190787Szec 851193219Srwatson netisr_register(&arp_nh); 85269152Sjlemon} 85369152SjlemonSYSINIT(arp, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY, arp_init, 0); 854