1/*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1991, 1993 5 * The Regents of the University of California. All rights reserved. 6 * Copyright (C) 2001 WIDE Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 * 32 * @(#)in.c 8.4 (Berkeley) 1/9/95 33 */ 34 35#include <sys/cdefs.h> 36__FBSDID("$FreeBSD$"); 37 38#include <sys/param.h> 39#include <sys/eventhandler.h> 40#include <sys/systm.h> 41#include <sys/sockio.h> 42#include <sys/malloc.h> 43#include <sys/priv.h> 44#include <sys/socket.h> 45#include <sys/jail.h> 46#include <sys/kernel.h> 47#include <sys/lock.h> 48#include <sys/proc.h> 49#include <sys/rmlock.h> 50#include <sys/sysctl.h> 51#include <sys/syslog.h> 52#include <sys/sx.h> 53 54#include <net/if.h> 55#include <net/if_var.h> 56#include <net/if_arp.h> 57#include <net/if_dl.h> 58#include <net/if_llatbl.h> 59#include <net/if_types.h> 60#include <net/route.h> 61#include <net/route/nhop.h> 62#include <net/route/route_ctl.h> 63#include <net/vnet.h> 64 65#include <netinet/if_ether.h> 66#include <netinet/in.h> 67#include <netinet/in_var.h> 68#include <netinet/in_pcb.h> 69#include <netinet/ip_var.h> 70#include <netinet/ip_carp.h> 71#include <netinet/igmp_var.h> 72#include <netinet/udp.h> 73#include <netinet/udp_var.h> 74 75static int in_aifaddr_ioctl(u_long, caddr_t, struct ifnet *, struct thread *); 76static int in_difaddr_ioctl(u_long, caddr_t, struct ifnet *, struct thread *); 77static int in_gifaddr_ioctl(u_long, caddr_t, struct ifnet *, struct thread *); 78 79static void in_socktrim(struct sockaddr_in *); 80static void in_purgemaddrs(struct ifnet *); 81 82static bool ia_need_loopback_route(const struct in_ifaddr *); 83 84VNET_DEFINE_STATIC(int, nosameprefix); 85#define V_nosameprefix VNET(nosameprefix) 86SYSCTL_INT(_net_inet_ip, OID_AUTO, no_same_prefix, CTLFLAG_VNET | CTLFLAG_RW, 87 &VNET_NAME(nosameprefix), 0, 88 "Refuse to create same prefixes on different interfaces"); 89 90VNET_DECLARE(struct inpcbinfo, ripcbinfo); 91#define V_ripcbinfo VNET(ripcbinfo) 92 93static struct sx in_control_sx; 94SX_SYSINIT(in_control_sx, &in_control_sx, "in_control"); 95 96/* 97 * Return 1 if an internet address is for a ``local'' host 98 * (one to which we have a connection). 99 */ 100int 101in_localaddr(struct in_addr in) 102{ 103 struct rm_priotracker in_ifa_tracker; 104 u_long i = ntohl(in.s_addr); 105 struct in_ifaddr *ia; 106 107 IN_IFADDR_RLOCK(&in_ifa_tracker); 108 CK_STAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) { 109 if ((i & ia->ia_subnetmask) == ia->ia_subnet) { 110 IN_IFADDR_RUNLOCK(&in_ifa_tracker); 111 return (1); 112 } 113 } 114 IN_IFADDR_RUNLOCK(&in_ifa_tracker); 115 return (0); 116} 117 118/* 119 * Return 1 if an internet address is for the local host and configured 120 * on one of its interfaces. 121 */ 122int 123in_localip(struct in_addr in) 124{ 125 struct rm_priotracker in_ifa_tracker; 126 struct in_ifaddr *ia; 127 128 IN_IFADDR_RLOCK(&in_ifa_tracker); 129 LIST_FOREACH(ia, INADDR_HASH(in.s_addr), ia_hash) { 130 if (IA_SIN(ia)->sin_addr.s_addr == in.s_addr) { 131 IN_IFADDR_RUNLOCK(&in_ifa_tracker); 132 return (1); 133 } 134 } 135 IN_IFADDR_RUNLOCK(&in_ifa_tracker); 136 return (0); 137} 138 139/* 140 * Return 1 if an internet address is configured on an interface. 141 */ 142int 143in_ifhasaddr(struct ifnet *ifp, struct in_addr in) 144{ 145 struct ifaddr *ifa; 146 struct in_ifaddr *ia; 147 148 NET_EPOCH_ASSERT(); 149 150 CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 151 if (ifa->ifa_addr->sa_family != AF_INET) 152 continue; 153 ia = (struct in_ifaddr *)ifa; 154 if (ia->ia_addr.sin_addr.s_addr == in.s_addr) 155 return (1); 156 } 157 158 return (0); 159} 160 161/* 162 * Return a reference to the interface address which is different to 163 * the supplied one but with same IP address value. 164 */ 165static struct in_ifaddr * 166in_localip_more(struct in_ifaddr *original_ia) 167{ 168 struct rm_priotracker in_ifa_tracker; 169 in_addr_t original_addr = IA_SIN(original_ia)->sin_addr.s_addr; 170 uint32_t original_fib = original_ia->ia_ifa.ifa_ifp->if_fib; 171 struct in_ifaddr *ia; 172 173 IN_IFADDR_RLOCK(&in_ifa_tracker); 174 LIST_FOREACH(ia, INADDR_HASH(original_addr), ia_hash) { 175 in_addr_t addr = IA_SIN(ia)->sin_addr.s_addr; 176 uint32_t fib = ia->ia_ifa.ifa_ifp->if_fib; 177 if (!V_rt_add_addr_allfibs && (original_fib != fib)) 178 continue; 179 if ((original_ia != ia) && (original_addr == addr)) { 180 ifa_ref(&ia->ia_ifa); 181 IN_IFADDR_RUNLOCK(&in_ifa_tracker); 182 return (ia); 183 } 184 } 185 IN_IFADDR_RUNLOCK(&in_ifa_tracker); 186 187 return (NULL); 188} 189 190/* 191 * Determine whether an IP address is in a reserved set of addresses 192 * that may not be forwarded, or whether datagrams to that destination 193 * may be forwarded. 194 */ 195int 196in_canforward(struct in_addr in) 197{ 198 u_long i = ntohl(in.s_addr); 199 200 if (IN_EXPERIMENTAL(i) || IN_MULTICAST(i) || IN_LINKLOCAL(i) || 201 IN_ZERONET(i) || IN_LOOPBACK(i)) 202 return (0); 203 return (1); 204} 205 206/* 207 * Trim a mask in a sockaddr 208 */ 209static void 210in_socktrim(struct sockaddr_in *ap) 211{ 212 char *cplim = (char *) &ap->sin_addr; 213 char *cp = (char *) (&ap->sin_addr + 1); 214 215 ap->sin_len = 0; 216 while (--cp >= cplim) 217 if (*cp) { 218 (ap)->sin_len = cp - (char *) (ap) + 1; 219 break; 220 } 221} 222 223/* 224 * Generic internet control operations (ioctl's). 225 */ 226int 227in_control(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp, 228 struct thread *td) 229{ 230 struct ifreq *ifr = (struct ifreq *)data; 231 struct sockaddr_in *addr = (struct sockaddr_in *)&ifr->ifr_addr; 232 struct epoch_tracker et; 233 struct ifaddr *ifa; 234 struct in_ifaddr *ia; 235 int error; 236 237 if (ifp == NULL) 238 return (EADDRNOTAVAIL); 239 240 /* 241 * Filter out 4 ioctls we implement directly. Forward the rest 242 * to specific functions and ifp->if_ioctl(). 243 */ 244 switch (cmd) { 245 case SIOCGIFADDR: 246 case SIOCGIFBRDADDR: 247 case SIOCGIFDSTADDR: 248 case SIOCGIFNETMASK: 249 break; 250 case SIOCGIFALIAS: 251 sx_xlock(&in_control_sx); 252 error = in_gifaddr_ioctl(cmd, data, ifp, td); 253 sx_xunlock(&in_control_sx); 254 return (error); 255 case SIOCDIFADDR: 256 sx_xlock(&in_control_sx); 257 error = in_difaddr_ioctl(cmd, data, ifp, td); 258 sx_xunlock(&in_control_sx); 259 return (error); 260 case OSIOCAIFADDR: /* 9.x compat */ 261 case SIOCAIFADDR: 262 sx_xlock(&in_control_sx); 263 error = in_aifaddr_ioctl(cmd, data, ifp, td); 264 sx_xunlock(&in_control_sx); 265 return (error); 266 case SIOCSIFADDR: 267 case SIOCSIFBRDADDR: 268 case SIOCSIFDSTADDR: 269 case SIOCSIFNETMASK: 270 /* We no longer support that old commands. */ 271 return (EINVAL); 272 default: 273 if (ifp->if_ioctl == NULL) 274 return (EOPNOTSUPP); 275 return ((*ifp->if_ioctl)(ifp, cmd, data)); 276 } 277 278 if (addr->sin_addr.s_addr != INADDR_ANY && 279 prison_check_ip4(td->td_ucred, &addr->sin_addr) != 0) 280 return (EADDRNOTAVAIL); 281 282 /* 283 * Find address for this interface, if it exists. If an 284 * address was specified, find that one instead of the 285 * first one on the interface, if possible. 286 */ 287 NET_EPOCH_ENTER(et); 288 CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 289 if (ifa->ifa_addr->sa_family != AF_INET) 290 continue; 291 ia = (struct in_ifaddr *)ifa; 292 if (ia->ia_addr.sin_addr.s_addr == addr->sin_addr.s_addr) 293 break; 294 } 295 if (ifa == NULL) 296 CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) 297 if (ifa->ifa_addr->sa_family == AF_INET) { 298 ia = (struct in_ifaddr *)ifa; 299 if (prison_check_ip4(td->td_ucred, 300 &ia->ia_addr.sin_addr) == 0) 301 break; 302 } 303 304 if (ifa == NULL) { 305 NET_EPOCH_EXIT(et); 306 return (EADDRNOTAVAIL); 307 } 308 309 error = 0; 310 switch (cmd) { 311 case SIOCGIFADDR: 312 *addr = ia->ia_addr; 313 break; 314 315 case SIOCGIFBRDADDR: 316 if ((ifp->if_flags & IFF_BROADCAST) == 0) { 317 error = EINVAL; 318 break; 319 } 320 *addr = ia->ia_broadaddr; 321 break; 322 323 case SIOCGIFDSTADDR: 324 if ((ifp->if_flags & IFF_POINTOPOINT) == 0) { 325 error = EINVAL; 326 break; 327 } 328 *addr = ia->ia_dstaddr; 329 break; 330 331 case SIOCGIFNETMASK: 332 *addr = ia->ia_sockmask; 333 break; 334 } 335 336 NET_EPOCH_EXIT(et); 337 338 return (error); 339} 340 341static int 342in_aifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) 343{ 344 const struct in_aliasreq *ifra = (struct in_aliasreq *)data; 345 const struct sockaddr_in *addr = &ifra->ifra_addr; 346 const struct sockaddr_in *broadaddr = &ifra->ifra_broadaddr; 347 const struct sockaddr_in *mask = &ifra->ifra_mask; 348 const struct sockaddr_in *dstaddr = &ifra->ifra_dstaddr; 349 const int vhid = (cmd == SIOCAIFADDR) ? ifra->ifra_vhid : 0; 350 struct epoch_tracker et; 351 struct ifaddr *ifa; 352 struct in_ifaddr *ia; 353 bool iaIsFirst; 354 int error = 0; 355 356 error = priv_check(td, PRIV_NET_ADDIFADDR); 357 if (error) 358 return (error); 359 360 /* 361 * ifra_addr must be present and be of INET family. 362 * ifra_broadaddr/ifra_dstaddr and ifra_mask are optional. 363 */ 364 if (addr->sin_len != sizeof(struct sockaddr_in) || 365 addr->sin_family != AF_INET) 366 return (EINVAL); 367 if (broadaddr->sin_len != 0 && 368 (broadaddr->sin_len != sizeof(struct sockaddr_in) || 369 broadaddr->sin_family != AF_INET)) 370 return (EINVAL); 371 if (mask->sin_len != 0 && 372 (mask->sin_len != sizeof(struct sockaddr_in) || 373 mask->sin_family != AF_INET)) 374 return (EINVAL); 375 if ((ifp->if_flags & IFF_POINTOPOINT) && 376 (dstaddr->sin_len != sizeof(struct sockaddr_in) || 377 dstaddr->sin_addr.s_addr == INADDR_ANY)) 378 return (EDESTADDRREQ); 379 if (vhid > 0 && carp_attach_p == NULL) 380 return (EPROTONOSUPPORT); 381 382 /* 383 * See whether address already exist. 384 */ 385 iaIsFirst = true; 386 ia = NULL; 387 NET_EPOCH_ENTER(et); 388 CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 389 struct in_ifaddr *it; 390 391 if (ifa->ifa_addr->sa_family != AF_INET) 392 continue; 393 394 it = (struct in_ifaddr *)ifa; 395 if (it->ia_addr.sin_addr.s_addr == addr->sin_addr.s_addr && 396 prison_check_ip4(td->td_ucred, &addr->sin_addr) == 0) 397 ia = it; 398 else 399 iaIsFirst = false; 400 } 401 NET_EPOCH_EXIT(et); 402 403 if (ia != NULL) 404 (void )in_difaddr_ioctl(cmd, data, ifp, td); 405 406 ifa = ifa_alloc(sizeof(struct in_ifaddr), M_WAITOK); 407 ia = (struct in_ifaddr *)ifa; 408 ifa->ifa_addr = (struct sockaddr *)&ia->ia_addr; 409 ifa->ifa_dstaddr = (struct sockaddr *)&ia->ia_dstaddr; 410 ifa->ifa_netmask = (struct sockaddr *)&ia->ia_sockmask; 411 callout_init_rw(&ia->ia_garp_timer, &ifp->if_addr_lock, 412 CALLOUT_RETURNUNLOCKED); 413 414 ia->ia_ifp = ifp; 415 ia->ia_addr = *addr; 416 if (mask->sin_len != 0) { 417 ia->ia_sockmask = *mask; 418 ia->ia_subnetmask = ntohl(ia->ia_sockmask.sin_addr.s_addr); 419 } else { 420 in_addr_t i = ntohl(addr->sin_addr.s_addr); 421 422 /* 423 * Be compatible with network classes, if netmask isn't 424 * supplied, guess it based on classes. 425 */ 426 if (IN_CLASSA(i)) 427 ia->ia_subnetmask = IN_CLASSA_NET; 428 else if (IN_CLASSB(i)) 429 ia->ia_subnetmask = IN_CLASSB_NET; 430 else 431 ia->ia_subnetmask = IN_CLASSC_NET; 432 ia->ia_sockmask.sin_addr.s_addr = htonl(ia->ia_subnetmask); 433 } 434 ia->ia_subnet = ntohl(addr->sin_addr.s_addr) & ia->ia_subnetmask; 435 in_socktrim(&ia->ia_sockmask); 436 437 if (ifp->if_flags & IFF_BROADCAST) { 438 if (broadaddr->sin_len != 0) { 439 ia->ia_broadaddr = *broadaddr; 440 } else if (ia->ia_subnetmask == IN_RFC3021_MASK) { 441 ia->ia_broadaddr.sin_addr.s_addr = INADDR_BROADCAST; 442 ia->ia_broadaddr.sin_len = sizeof(struct sockaddr_in); 443 ia->ia_broadaddr.sin_family = AF_INET; 444 } else { 445 ia->ia_broadaddr.sin_addr.s_addr = 446 htonl(ia->ia_subnet | ~ia->ia_subnetmask); 447 ia->ia_broadaddr.sin_len = sizeof(struct sockaddr_in); 448 ia->ia_broadaddr.sin_family = AF_INET; 449 } 450 } 451 452 if (ifp->if_flags & IFF_POINTOPOINT) 453 ia->ia_dstaddr = *dstaddr; 454 455 if (vhid != 0) { 456 error = (*carp_attach_p)(&ia->ia_ifa, vhid); 457 if (error) 458 return (error); 459 } 460 461 /* if_addrhead is already referenced by ifa_alloc() */ 462 IF_ADDR_WLOCK(ifp); 463 CK_STAILQ_INSERT_TAIL(&ifp->if_addrhead, ifa, ifa_link); 464 IF_ADDR_WUNLOCK(ifp); 465 466 ifa_ref(ifa); /* in_ifaddrhead */ 467 IN_IFADDR_WLOCK(); 468 CK_STAILQ_INSERT_TAIL(&V_in_ifaddrhead, ia, ia_link); 469 LIST_INSERT_HEAD(INADDR_HASH(ia->ia_addr.sin_addr.s_addr), ia, ia_hash); 470 IN_IFADDR_WUNLOCK(); 471 472 /* 473 * Give the interface a chance to initialize 474 * if this is its first address, 475 * and to validate the address if necessary. 476 */ 477 if (ifp->if_ioctl != NULL) { 478 error = (*ifp->if_ioctl)(ifp, SIOCSIFADDR, (caddr_t)ia); 479 if (error) 480 goto fail1; 481 } 482 483 /* 484 * Add route for the network. 485 */ 486 if (vhid == 0) { 487 error = in_addprefix(ia); 488 if (error) 489 goto fail1; 490 } 491 492 /* 493 * Add a loopback route to self. 494 */ 495 if (vhid == 0 && ia_need_loopback_route(ia)) { 496 struct in_ifaddr *eia; 497 498 eia = in_localip_more(ia); 499 500 if (eia == NULL) { 501 error = ifa_add_loopback_route((struct ifaddr *)ia, 502 (struct sockaddr *)&ia->ia_addr); 503 if (error) 504 goto fail2; 505 } else 506 ifa_free(&eia->ia_ifa); 507 } 508 509 if (iaIsFirst && (ifp->if_flags & IFF_MULTICAST)) { 510 struct in_addr allhosts_addr; 511 struct in_ifinfo *ii; 512 513 ii = ((struct in_ifinfo *)ifp->if_afdata[AF_INET]); 514 allhosts_addr.s_addr = htonl(INADDR_ALLHOSTS_GROUP); 515 516 error = in_joingroup(ifp, &allhosts_addr, NULL, 517 &ii->ii_allhosts); 518 } 519 520 /* 521 * Note: we don't need extra reference for ifa, since we called 522 * with sx lock held, and ifaddr can not be deleted in concurrent 523 * thread. 524 */ 525 EVENTHANDLER_INVOKE(ifaddr_event_ext, ifp, ifa, IFADDR_EVENT_ADD); 526 527 return (error); 528 529fail2: 530 if (vhid == 0) 531 (void )in_scrubprefix(ia, LLE_STATIC); 532 533fail1: 534 if (ia->ia_ifa.ifa_carp) 535 (*carp_detach_p)(&ia->ia_ifa, false); 536 537 IF_ADDR_WLOCK(ifp); 538 CK_STAILQ_REMOVE(&ifp->if_addrhead, &ia->ia_ifa, ifaddr, ifa_link); 539 IF_ADDR_WUNLOCK(ifp); 540 ifa_free(&ia->ia_ifa); /* if_addrhead */ 541 542 IN_IFADDR_WLOCK(); 543 CK_STAILQ_REMOVE(&V_in_ifaddrhead, ia, in_ifaddr, ia_link); 544 LIST_REMOVE(ia, ia_hash); 545 IN_IFADDR_WUNLOCK(); 546 ifa_free(&ia->ia_ifa); /* in_ifaddrhead */ 547 548 return (error); 549} 550 551static int 552in_difaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) 553{ 554 const struct ifreq *ifr = (struct ifreq *)data; 555 const struct sockaddr_in *addr = (const struct sockaddr_in *) 556 &ifr->ifr_addr; 557 struct ifaddr *ifa; 558 struct in_ifaddr *ia; 559 bool deleteAny, iaIsLast; 560 int error; 561 562 if (td != NULL) { 563 error = priv_check(td, PRIV_NET_DELIFADDR); 564 if (error) 565 return (error); 566 } 567 568 if (addr->sin_len != sizeof(struct sockaddr_in) || 569 addr->sin_family != AF_INET) 570 deleteAny = true; 571 else 572 deleteAny = false; 573 574 iaIsLast = true; 575 ia = NULL; 576 IF_ADDR_WLOCK(ifp); 577 CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 578 struct in_ifaddr *it; 579 580 if (ifa->ifa_addr->sa_family != AF_INET) 581 continue; 582 583 it = (struct in_ifaddr *)ifa; 584 if (deleteAny && ia == NULL && (td == NULL || 585 prison_check_ip4(td->td_ucred, &it->ia_addr.sin_addr) == 0)) 586 ia = it; 587 588 if (it->ia_addr.sin_addr.s_addr == addr->sin_addr.s_addr && 589 (td == NULL || prison_check_ip4(td->td_ucred, 590 &addr->sin_addr) == 0)) 591 ia = it; 592 593 if (it != ia) 594 iaIsLast = false; 595 } 596 597 if (ia == NULL) { 598 IF_ADDR_WUNLOCK(ifp); 599 return (EADDRNOTAVAIL); 600 } 601 602 CK_STAILQ_REMOVE(&ifp->if_addrhead, &ia->ia_ifa, ifaddr, ifa_link); 603 IF_ADDR_WUNLOCK(ifp); 604 ifa_free(&ia->ia_ifa); /* if_addrhead */ 605 606 IN_IFADDR_WLOCK(); 607 CK_STAILQ_REMOVE(&V_in_ifaddrhead, ia, in_ifaddr, ia_link); 608 LIST_REMOVE(ia, ia_hash); 609 IN_IFADDR_WUNLOCK(); 610 611 /* 612 * in_scrubprefix() kills the interface route. 613 */ 614 in_scrubprefix(ia, LLE_STATIC); 615 616 /* 617 * in_ifadown gets rid of all the rest of 618 * the routes. This is not quite the right 619 * thing to do, but at least if we are running 620 * a routing process they will come back. 621 */ 622 in_ifadown(&ia->ia_ifa, 1); 623 624 if (ia->ia_ifa.ifa_carp) 625 (*carp_detach_p)(&ia->ia_ifa, cmd == SIOCAIFADDR); 626 627 /* 628 * If this is the last IPv4 address configured on this 629 * interface, leave the all-hosts group. 630 * No state-change report need be transmitted. 631 */ 632 if (iaIsLast && (ifp->if_flags & IFF_MULTICAST)) { 633 struct in_ifinfo *ii; 634 635 ii = ((struct in_ifinfo *)ifp->if_afdata[AF_INET]); 636 if (ii->ii_allhosts) { 637 (void)in_leavegroup(ii->ii_allhosts, NULL); 638 ii->ii_allhosts = NULL; 639 } 640 } 641 642 IF_ADDR_WLOCK(ifp); 643 if (callout_stop(&ia->ia_garp_timer) == 1) { 644 ifa_free(&ia->ia_ifa); 645 } 646 IF_ADDR_WUNLOCK(ifp); 647 648 EVENTHANDLER_INVOKE(ifaddr_event_ext, ifp, &ia->ia_ifa, 649 IFADDR_EVENT_DEL); 650 ifa_free(&ia->ia_ifa); /* in_ifaddrhead */ 651 652 return (0); 653} 654 655static int 656in_gifaddr_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td) 657{ 658 struct in_aliasreq *ifra = (struct in_aliasreq *)data; 659 const struct sockaddr_in *addr = &ifra->ifra_addr; 660 struct epoch_tracker et; 661 struct ifaddr *ifa; 662 struct in_ifaddr *ia; 663 664 /* 665 * ifra_addr must be present and be of INET family. 666 */ 667 if (addr->sin_len != sizeof(struct sockaddr_in) || 668 addr->sin_family != AF_INET) 669 return (EINVAL); 670 671 /* 672 * See whether address exist. 673 */ 674 ia = NULL; 675 NET_EPOCH_ENTER(et); 676 CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 677 struct in_ifaddr *it; 678 679 if (ifa->ifa_addr->sa_family != AF_INET) 680 continue; 681 682 it = (struct in_ifaddr *)ifa; 683 if (it->ia_addr.sin_addr.s_addr == addr->sin_addr.s_addr && 684 prison_check_ip4(td->td_ucred, &addr->sin_addr) == 0) { 685 ia = it; 686 break; 687 } 688 } 689 if (ia == NULL) { 690 NET_EPOCH_EXIT(et); 691 return (EADDRNOTAVAIL); 692 } 693 694 ifra->ifra_mask = ia->ia_sockmask; 695 if ((ifp->if_flags & IFF_POINTOPOINT) && 696 ia->ia_dstaddr.sin_family == AF_INET) 697 ifra->ifra_dstaddr = ia->ia_dstaddr; 698 else if ((ifp->if_flags & IFF_BROADCAST) && 699 ia->ia_broadaddr.sin_family == AF_INET) 700 ifra->ifra_broadaddr = ia->ia_broadaddr; 701 else 702 memset(&ifra->ifra_broadaddr, 0, 703 sizeof(ifra->ifra_broadaddr)); 704 705 NET_EPOCH_EXIT(et); 706 return (0); 707} 708 709static int 710in_match_ifaddr(const struct rtentry *rt, const struct nhop_object *nh, void *arg) 711{ 712 713 if (nh->nh_ifa == (struct ifaddr *)arg) 714 return (1); 715 716 return (0); 717} 718 719static int 720in_handle_prefix_route(uint32_t fibnum, int cmd, 721 struct sockaddr_in *dst, struct sockaddr_in *netmask, struct ifaddr *ifa, 722 struct ifnet *ifp) 723{ 724 725 NET_EPOCH_ASSERT(); 726 727 /* Prepare gateway */ 728 struct sockaddr_dl_short sdl = { 729 .sdl_family = AF_LINK, 730 .sdl_len = sizeof(struct sockaddr_dl_short), 731 .sdl_type = ifa->ifa_ifp->if_type, 732 .sdl_index = ifa->ifa_ifp->if_index, 733 }; 734 735 struct rt_addrinfo info = { 736 .rti_ifa = ifa, 737 .rti_ifp = ifp, 738 .rti_flags = RTF_PINNED | ((netmask != NULL) ? 0 : RTF_HOST), 739 .rti_info = { 740 [RTAX_DST] = (struct sockaddr *)dst, 741 [RTAX_NETMASK] = (struct sockaddr *)netmask, 742 [RTAX_GATEWAY] = (struct sockaddr *)&sdl, 743 }, 744 /* Ensure we delete the prefix IFF prefix ifa matches */ 745 .rti_filter = in_match_ifaddr, 746 .rti_filterdata = ifa, 747 }; 748 749 return (rib_handle_ifaddr_info(fibnum, cmd, &info)); 750} 751 752/* 753 * Routing table interaction with interface addresses. 754 * 755 * In general, two types of routes needs to be installed: 756 * a) "interface" or "prefix" route, telling user that the addresses 757 * behind the ifa prefix are reached directly. 758 * b) "loopback" route installed for the ifa address, telling user that 759 * the address belongs to local system. 760 * 761 * Handling for (a) and (b) differs in multi-fib aspects, hence they 762 * are implemented in different functions below. 763 * 764 * The cases above may intersect - /32 interface aliases results in 765 * the same prefix produced by (a) and (b). This blurs the definition 766 * of the "loopback" route and complicate interactions. The interaction 767 * table is defined below. The case numbers are used in the multiple 768 * functions below to refer to the particular test case. 769 * 770 * There can be multiple options: 771 * 1) Adding address with prefix on non-p2p/non-loopback interface. 772 * Example: 192.0.2.1/24. Action: 773 * * add "prefix" route towards 192.0.2.0/24 via @ia interface, 774 * using @ia as an address source. 775 * * add "loopback" route towards 192.0.2.1 via V_loif, saving 776 * @ia ifp in the gateway and using @ia as an address source. 777 * 778 * 2) Adding address with /32 mask to non-p2p/non-loopback interface. 779 * Example: 192.0.2.2/32. Action: 780 * * add "prefix" host route via V_loif, using @ia as an address source. 781 * 782 * 3) Adding address with or without prefix to p2p interface. 783 * Example: 10.0.0.1/24->10.0.0.2. Action: 784 * * add "prefix" host route towards 10.0.0.2 via this interface, using @ia 785 * as an address source. Note: no sense in installing full /24 as the interface 786 * is point-to-point. 787 * * add "loopback" route towards 10.0.9.1 via V_loif, saving 788 * @ia ifp in the gateway and using @ia as an address source. 789 * 790 * 4) Adding address with or without prefix to loopback interface. 791 * Example: 192.0.2.1/24. Action: 792 * * add "prefix" host route via @ia interface, using @ia as an address source. 793 * Note: Skip installing /24 prefix as it would introduce TTL loop 794 * for the traffic destined to these addresses. 795 */ 796 797/* 798 * Checks if @ia needs to install loopback route to @ia address via 799 * ifa_maintain_loopback_route(). 800 * 801 * Return true on success. 802 */ 803static bool 804ia_need_loopback_route(const struct in_ifaddr *ia) 805{ 806 struct ifnet *ifp = ia->ia_ifp; 807 808 /* Case 4: Skip loopback interfaces */ 809 if ((ifp->if_flags & IFF_LOOPBACK) || 810 (ia->ia_addr.sin_addr.s_addr == INADDR_ANY)) 811 return (false); 812 813 /* Clash avoidance: Skip p2p interfaces with both addresses are equal */ 814 if ((ifp->if_flags & IFF_POINTOPOINT) && 815 ia->ia_dstaddr.sin_addr.s_addr == ia->ia_addr.sin_addr.s_addr) 816 return (false); 817 818 /* Case 2: skip /32 prefixes */ 819 if (!(ifp->if_flags & IFF_POINTOPOINT) && 820 (ia->ia_sockmask.sin_addr.s_addr == INADDR_BROADCAST)) 821 return (false); 822 823 return (true); 824} 825 826/* 827 * Calculate "prefix" route corresponding to @ia. 828 */ 829static void 830ia_getrtprefix(const struct in_ifaddr *ia, struct in_addr *prefix, struct in_addr *mask) 831{ 832 833 if (ia->ia_ifp->if_flags & IFF_POINTOPOINT) { 834 /* Case 3: return host route for dstaddr */ 835 *prefix = ia->ia_dstaddr.sin_addr; 836 mask->s_addr = INADDR_BROADCAST; 837 } else if (ia->ia_ifp->if_flags & IFF_LOOPBACK) { 838 /* Case 4: return host route for ifaddr */ 839 *prefix = ia->ia_addr.sin_addr; 840 mask->s_addr = INADDR_BROADCAST; 841 } else { 842 /* Cases 1,2: return actual ia prefix */ 843 *prefix = ia->ia_addr.sin_addr; 844 *mask = ia->ia_sockmask.sin_addr; 845 prefix->s_addr &= mask->s_addr; 846 } 847} 848 849/* 850 * Adds or delete interface "prefix" route corresponding to @ifa. 851 * Returns 0 on success or errno. 852 */ 853int 854in_handle_ifaddr_route(int cmd, struct in_ifaddr *ia) 855{ 856 struct ifaddr *ifa = &ia->ia_ifa; 857 struct in_addr daddr, maddr; 858 struct sockaddr_in *pmask; 859 struct epoch_tracker et; 860 int error; 861 862 ia_getrtprefix(ia, &daddr, &maddr); 863 864 struct sockaddr_in mask = { 865 .sin_family = AF_INET, 866 .sin_len = sizeof(struct sockaddr_in), 867 .sin_addr = maddr, 868 }; 869 870 pmask = (maddr.s_addr != INADDR_BROADCAST) ? &mask : NULL; 871 872 struct sockaddr_in dst = { 873 .sin_family = AF_INET, 874 .sin_len = sizeof(struct sockaddr_in), 875 .sin_addr.s_addr = daddr.s_addr & maddr.s_addr, 876 }; 877 878 struct ifnet *ifp = ia->ia_ifp; 879 880 if ((maddr.s_addr == INADDR_BROADCAST) && 881 (!(ia->ia_ifp->if_flags & (IFF_POINTOPOINT|IFF_LOOPBACK)))) { 882 /* Case 2: host route on broadcast interface */ 883 ifp = V_loif; 884 } 885 886 uint32_t fibnum = ifa->ifa_ifp->if_fib; 887 NET_EPOCH_ENTER(et); 888 error = in_handle_prefix_route(fibnum, cmd, &dst, pmask, ifa, ifp); 889 NET_EPOCH_EXIT(et); 890 891 return (error); 892} 893 894/* 895 * Check if we have a route for the given prefix already. 896 */ 897static bool 898in_hasrtprefix(struct in_ifaddr *target) 899{ 900 struct rm_priotracker in_ifa_tracker; 901 struct in_ifaddr *ia; 902 struct in_addr prefix, mask, p, m; 903 bool result = false; 904 905 ia_getrtprefix(target, &prefix, &mask); 906 907 IN_IFADDR_RLOCK(&in_ifa_tracker); 908 /* Look for an existing address with the same prefix, mask, and fib */ 909 CK_STAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) { 910 ia_getrtprefix(ia, &p, &m); 911 912 if (prefix.s_addr != p.s_addr || 913 mask.s_addr != m.s_addr) 914 continue; 915 916 if (target->ia_ifp->if_fib != ia->ia_ifp->if_fib) 917 continue; 918 919 /* 920 * If we got a matching prefix route inserted by other 921 * interface address, we are done here. 922 */ 923 if (ia->ia_flags & IFA_ROUTE) { 924 result = true; 925 break; 926 } 927 } 928 IN_IFADDR_RUNLOCK(&in_ifa_tracker); 929 930 return (result); 931} 932 933int 934in_addprefix(struct in_ifaddr *target) 935{ 936 int error; 937 938 if (in_hasrtprefix(target)) { 939 if (V_nosameprefix) 940 return (EEXIST); 941 else { 942 rt_addrmsg(RTM_ADD, &target->ia_ifa, 943 target->ia_ifp->if_fib); 944 return (0); 945 } 946 } 947 948 /* 949 * No-one seem to have this prefix route, so we try to insert it. 950 */ 951 rt_addrmsg(RTM_ADD, &target->ia_ifa, target->ia_ifp->if_fib); 952 error = in_handle_ifaddr_route(RTM_ADD, target); 953 if (!error) 954 target->ia_flags |= IFA_ROUTE; 955 return (error); 956} 957 958/* 959 * Removes either all lle entries for given @ia, or lle 960 * corresponding to @ia address. 961 */ 962static void 963in_scrubprefixlle(struct in_ifaddr *ia, int all, u_int flags) 964{ 965 struct sockaddr_in addr, mask; 966 struct sockaddr *saddr, *smask; 967 struct ifnet *ifp; 968 969 saddr = (struct sockaddr *)&addr; 970 bzero(&addr, sizeof(addr)); 971 addr.sin_len = sizeof(addr); 972 addr.sin_family = AF_INET; 973 smask = (struct sockaddr *)&mask; 974 bzero(&mask, sizeof(mask)); 975 mask.sin_len = sizeof(mask); 976 mask.sin_family = AF_INET; 977 mask.sin_addr.s_addr = ia->ia_subnetmask; 978 ifp = ia->ia_ifp; 979 980 if (all) { 981 /* 982 * Remove all L2 entries matching given prefix. 983 * Convert address to host representation to avoid 984 * doing this on every callback. ia_subnetmask is already 985 * stored in host representation. 986 */ 987 addr.sin_addr.s_addr = ntohl(ia->ia_addr.sin_addr.s_addr); 988 lltable_prefix_free(AF_INET, saddr, smask, flags); 989 } else { 990 /* Remove interface address only */ 991 addr.sin_addr.s_addr = ia->ia_addr.sin_addr.s_addr; 992 lltable_delete_addr(LLTABLE(ifp), LLE_IFADDR, saddr); 993 } 994} 995 996/* 997 * If there is no other address in the system that can serve a route to the 998 * same prefix, remove the route. Hand over the route to the new address 999 * otherwise. 1000 */ 1001int 1002in_scrubprefix(struct in_ifaddr *target, u_int flags) 1003{ 1004 struct rm_priotracker in_ifa_tracker; 1005 struct in_ifaddr *ia; 1006 struct in_addr prefix, mask, p, m; 1007 int error = 0; 1008 1009 /* 1010 * Remove the loopback route to the interface address. 1011 */ 1012 if (ia_need_loopback_route(target) && (flags & LLE_STATIC)) { 1013 struct in_ifaddr *eia; 1014 1015 eia = in_localip_more(target); 1016 1017 if (eia != NULL) { 1018 error = ifa_switch_loopback_route((struct ifaddr *)eia, 1019 (struct sockaddr *)&target->ia_addr); 1020 ifa_free(&eia->ia_ifa); 1021 } else { 1022 error = ifa_del_loopback_route((struct ifaddr *)target, 1023 (struct sockaddr *)&target->ia_addr); 1024 } 1025 } 1026 1027 ia_getrtprefix(target, &prefix, &mask); 1028 1029 if ((target->ia_flags & IFA_ROUTE) == 0) { 1030 rt_addrmsg(RTM_DELETE, &target->ia_ifa, target->ia_ifp->if_fib); 1031 1032 /* 1033 * Removing address from !IFF_UP interface or 1034 * prefix which exists on other interface (along with route). 1035 * No entries should exist here except target addr. 1036 * Given that, delete this entry only. 1037 */ 1038 in_scrubprefixlle(target, 0, flags); 1039 return (0); 1040 } 1041 1042 IN_IFADDR_RLOCK(&in_ifa_tracker); 1043 CK_STAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) { 1044 ia_getrtprefix(ia, &p, &m); 1045 1046 if (prefix.s_addr != p.s_addr || 1047 mask.s_addr != m.s_addr) 1048 continue; 1049 1050 if ((ia->ia_ifp->if_flags & IFF_UP) == 0) 1051 continue; 1052 1053 /* 1054 * If we got a matching prefix address, move IFA_ROUTE and 1055 * the route itself to it. Make sure that routing daemons 1056 * get a heads-up. 1057 */ 1058 if ((ia->ia_flags & IFA_ROUTE) == 0) { 1059 ifa_ref(&ia->ia_ifa); 1060 IN_IFADDR_RUNLOCK(&in_ifa_tracker); 1061 error = in_handle_ifaddr_route(RTM_DELETE, target); 1062 if (error == 0) 1063 target->ia_flags &= ~IFA_ROUTE; 1064 else 1065 log(LOG_INFO, "in_scrubprefix: err=%d, old prefix delete failed\n", 1066 error); 1067 /* Scrub all entries IFF interface is different */ 1068 in_scrubprefixlle(target, target->ia_ifp != ia->ia_ifp, 1069 flags); 1070 error = in_handle_ifaddr_route(RTM_ADD, ia); 1071 if (error == 0) 1072 ia->ia_flags |= IFA_ROUTE; 1073 else 1074 log(LOG_INFO, "in_scrubprefix: err=%d, new prefix add failed\n", 1075 error); 1076 ifa_free(&ia->ia_ifa); 1077 return (error); 1078 } 1079 } 1080 IN_IFADDR_RUNLOCK(&in_ifa_tracker); 1081 1082 /* 1083 * remove all L2 entries on the given prefix 1084 */ 1085 in_scrubprefixlle(target, 1, flags); 1086 1087 /* 1088 * As no-one seem to have this prefix, we can remove the route. 1089 */ 1090 rt_addrmsg(RTM_DELETE, &target->ia_ifa, target->ia_ifp->if_fib); 1091 error = in_handle_ifaddr_route(RTM_DELETE, target); 1092 if (error == 0) 1093 target->ia_flags &= ~IFA_ROUTE; 1094 else 1095 log(LOG_INFO, "in_scrubprefix: err=%d, prefix delete failed\n", error); 1096 return (error); 1097} 1098 1099void 1100in_ifscrub_all(void) 1101{ 1102 struct ifnet *ifp; 1103 struct ifaddr *ifa, *nifa; 1104 struct ifaliasreq ifr; 1105 1106 IFNET_RLOCK(); 1107 CK_STAILQ_FOREACH(ifp, &V_ifnet, if_link) { 1108 /* Cannot lock here - lock recursion. */ 1109 /* NET_EPOCH_ENTER(et); */ 1110 CK_STAILQ_FOREACH_SAFE(ifa, &ifp->if_addrhead, ifa_link, nifa) { 1111 if (ifa->ifa_addr->sa_family != AF_INET) 1112 continue; 1113 1114 /* 1115 * This is ugly but the only way for legacy IP to 1116 * cleanly remove addresses and everything attached. 1117 */ 1118 bzero(&ifr, sizeof(ifr)); 1119 ifr.ifra_addr = *ifa->ifa_addr; 1120 if (ifa->ifa_dstaddr) 1121 ifr.ifra_broadaddr = *ifa->ifa_dstaddr; 1122 (void)in_control(NULL, SIOCDIFADDR, (caddr_t)&ifr, 1123 ifp, NULL); 1124 } 1125 /* NET_EPOCH_EXIT(et); */ 1126 in_purgemaddrs(ifp); 1127 igmp_domifdetach(ifp); 1128 } 1129 IFNET_RUNLOCK(); 1130} 1131 1132int 1133in_ifaddr_broadcast(struct in_addr in, struct in_ifaddr *ia) 1134{ 1135 1136 return ((in.s_addr == ia->ia_broadaddr.sin_addr.s_addr || 1137 /* 1138 * Check for old-style (host 0) broadcast, but 1139 * taking into account that RFC 3021 obsoletes it. 1140 */ 1141 (ia->ia_subnetmask != IN_RFC3021_MASK && 1142 ntohl(in.s_addr) == ia->ia_subnet)) && 1143 /* 1144 * Check for an all one subnetmask. These 1145 * only exist when an interface gets a secondary 1146 * address. 1147 */ 1148 ia->ia_subnetmask != (u_long)0xffffffff); 1149} 1150 1151/* 1152 * Return 1 if the address might be a local broadcast address. 1153 */ 1154int 1155in_broadcast(struct in_addr in, struct ifnet *ifp) 1156{ 1157 struct ifaddr *ifa; 1158 int found; 1159 1160 NET_EPOCH_ASSERT(); 1161 1162 if (in.s_addr == INADDR_BROADCAST || 1163 in.s_addr == INADDR_ANY) 1164 return (1); 1165 if ((ifp->if_flags & IFF_BROADCAST) == 0) 1166 return (0); 1167 found = 0; 1168 /* 1169 * Look through the list of addresses for a match 1170 * with a broadcast address. 1171 */ 1172 CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) 1173 if (ifa->ifa_addr->sa_family == AF_INET && 1174 in_ifaddr_broadcast(in, (struct in_ifaddr *)ifa)) { 1175 found = 1; 1176 break; 1177 } 1178 return (found); 1179} 1180 1181/* 1182 * On interface removal, clean up IPv4 data structures hung off of the ifnet. 1183 */ 1184void 1185in_ifdetach(struct ifnet *ifp) 1186{ 1187 IN_MULTI_LOCK(); 1188 in_pcbpurgeif0(&V_ripcbinfo, ifp); 1189 in_pcbpurgeif0(&V_udbinfo, ifp); 1190 in_pcbpurgeif0(&V_ulitecbinfo, ifp); 1191 in_purgemaddrs(ifp); 1192 IN_MULTI_UNLOCK(); 1193 1194 /* 1195 * Make sure all multicast deletions invoking if_ioctl() are 1196 * completed before returning. Else we risk accessing a freed 1197 * ifnet structure pointer. 1198 */ 1199 inm_release_wait(NULL); 1200} 1201 1202/* 1203 * Delete all IPv4 multicast address records, and associated link-layer 1204 * multicast address records, associated with ifp. 1205 * XXX It looks like domifdetach runs AFTER the link layer cleanup. 1206 * XXX This should not race with ifma_protospec being set during 1207 * a new allocation, if it does, we have bigger problems. 1208 */ 1209static void 1210in_purgemaddrs(struct ifnet *ifp) 1211{ 1212 struct in_multi_head purgeinms; 1213 struct in_multi *inm; 1214 struct ifmultiaddr *ifma, *next; 1215 1216 SLIST_INIT(&purgeinms); 1217 IN_MULTI_LIST_LOCK(); 1218 1219 /* 1220 * Extract list of in_multi associated with the detaching ifp 1221 * which the PF_INET layer is about to release. 1222 * We need to do this as IF_ADDR_LOCK() may be re-acquired 1223 * by code further down. 1224 */ 1225 IF_ADDR_WLOCK(ifp); 1226 restart: 1227 CK_STAILQ_FOREACH_SAFE(ifma, &ifp->if_multiaddrs, ifma_link, next) { 1228 if (ifma->ifma_addr->sa_family != AF_INET || 1229 ifma->ifma_protospec == NULL) 1230 continue; 1231 inm = (struct in_multi *)ifma->ifma_protospec; 1232 inm_rele_locked(&purgeinms, inm); 1233 if (__predict_false(ifma_restart)) { 1234 ifma_restart = true; 1235 goto restart; 1236 } 1237 } 1238 IF_ADDR_WUNLOCK(ifp); 1239 1240 inm_release_list_deferred(&purgeinms); 1241 igmp_ifdetach(ifp); 1242 IN_MULTI_LIST_UNLOCK(); 1243} 1244 1245struct in_llentry { 1246 struct llentry base; 1247}; 1248 1249#define IN_LLTBL_DEFAULT_HSIZE 32 1250#define IN_LLTBL_HASH(k, h) \ 1251 (((((((k >> 8) ^ k) >> 8) ^ k) >> 8) ^ k) & ((h) - 1)) 1252 1253/* 1254 * Do actual deallocation of @lle. 1255 */ 1256static void 1257in_lltable_destroy_lle_unlocked(epoch_context_t ctx) 1258{ 1259 struct llentry *lle; 1260 1261 lle = __containerof(ctx, struct llentry, lle_epoch_ctx); 1262 LLE_LOCK_DESTROY(lle); 1263 LLE_REQ_DESTROY(lle); 1264 free(lle, M_LLTABLE); 1265} 1266 1267/* 1268 * Called by the datapath to indicate that 1269 * the entry was used. 1270 */ 1271static void 1272in_lltable_mark_used(struct llentry *lle) 1273{ 1274 1275 LLE_REQ_LOCK(lle); 1276 lle->r_skip_req = 0; 1277 LLE_REQ_UNLOCK(lle); 1278} 1279 1280/* 1281 * Called by LLE_FREE_LOCKED when number of references 1282 * drops to zero. 1283 */ 1284static void 1285in_lltable_destroy_lle(struct llentry *lle) 1286{ 1287 1288 LLE_WUNLOCK(lle); 1289 NET_EPOCH_CALL(in_lltable_destroy_lle_unlocked, &lle->lle_epoch_ctx); 1290} 1291 1292static struct llentry * 1293in_lltable_new(struct in_addr addr4, u_int flags) 1294{ 1295 struct in_llentry *lle; 1296 1297 lle = malloc(sizeof(struct in_llentry), M_LLTABLE, M_NOWAIT | M_ZERO); 1298 if (lle == NULL) /* NB: caller generates msg */ 1299 return NULL; 1300 1301 /* 1302 * For IPv4 this will trigger "arpresolve" to generate 1303 * an ARP request. 1304 */ 1305 lle->base.la_expire = time_uptime; /* mark expired */ 1306 lle->base.r_l3addr.addr4 = addr4; 1307 lle->base.lle_refcnt = 1; 1308 lle->base.lle_free = in_lltable_destroy_lle; 1309 LLE_LOCK_INIT(&lle->base); 1310 LLE_REQ_INIT(&lle->base); 1311 callout_init(&lle->base.lle_timer, 1); 1312 1313 return (&lle->base); 1314} 1315 1316#define IN_ARE_MASKED_ADDR_EQUAL(d, a, m) ( \ 1317 ((((d).s_addr ^ (a).s_addr) & (m).s_addr)) == 0 ) 1318 1319static int 1320in_lltable_match_prefix(const struct sockaddr *saddr, 1321 const struct sockaddr *smask, u_int flags, struct llentry *lle) 1322{ 1323 struct in_addr addr, mask, lle_addr; 1324 1325 addr = ((const struct sockaddr_in *)saddr)->sin_addr; 1326 mask = ((const struct sockaddr_in *)smask)->sin_addr; 1327 lle_addr.s_addr = ntohl(lle->r_l3addr.addr4.s_addr); 1328 1329 if (IN_ARE_MASKED_ADDR_EQUAL(lle_addr, addr, mask) == 0) 1330 return (0); 1331 1332 if (lle->la_flags & LLE_IFADDR) { 1333 /* 1334 * Delete LLE_IFADDR records IFF address & flag matches. 1335 * Note that addr is the interface address within prefix 1336 * being matched. 1337 * Note also we should handle 'ifdown' cases without removing 1338 * ifaddr macs. 1339 */ 1340 if (addr.s_addr == lle_addr.s_addr && (flags & LLE_STATIC) != 0) 1341 return (1); 1342 return (0); 1343 } 1344 1345 /* flags & LLE_STATIC means deleting both dynamic and static entries */ 1346 if ((flags & LLE_STATIC) || !(lle->la_flags & LLE_STATIC)) 1347 return (1); 1348 1349 return (0); 1350} 1351 1352static void 1353in_lltable_free_entry(struct lltable *llt, struct llentry *lle) 1354{ 1355 size_t pkts_dropped; 1356 1357 LLE_WLOCK_ASSERT(lle); 1358 KASSERT(llt != NULL, ("lltable is NULL")); 1359 1360 /* Unlink entry from table if not already */ 1361 if ((lle->la_flags & LLE_LINKED) != 0) { 1362 IF_AFDATA_WLOCK_ASSERT(llt->llt_ifp); 1363 lltable_unlink_entry(llt, lle); 1364 } 1365 1366 /* Drop hold queue */ 1367 pkts_dropped = llentry_free(lle); 1368 ARPSTAT_ADD(dropped, pkts_dropped); 1369} 1370 1371static int 1372in_lltable_rtcheck(struct ifnet *ifp, u_int flags, const struct sockaddr *l3addr) 1373{ 1374 struct rt_addrinfo info; 1375 struct sockaddr_in rt_key, rt_mask; 1376 struct sockaddr rt_gateway; 1377 int rt_flags; 1378 1379 KASSERT(l3addr->sa_family == AF_INET, 1380 ("sin_family %d", l3addr->sa_family)); 1381 1382 bzero(&rt_key, sizeof(rt_key)); 1383 rt_key.sin_len = sizeof(rt_key); 1384 bzero(&rt_mask, sizeof(rt_mask)); 1385 rt_mask.sin_len = sizeof(rt_mask); 1386 bzero(&rt_gateway, sizeof(rt_gateway)); 1387 rt_gateway.sa_len = sizeof(rt_gateway); 1388 1389 bzero(&info, sizeof(info)); 1390 info.rti_info[RTAX_DST] = (struct sockaddr *)&rt_key; 1391 info.rti_info[RTAX_NETMASK] = (struct sockaddr *)&rt_mask; 1392 info.rti_info[RTAX_GATEWAY] = (struct sockaddr *)&rt_gateway; 1393 1394 if (rib_lookup_info(ifp->if_fib, l3addr, NHR_REF, 0, &info) != 0) 1395 return (EINVAL); 1396 1397 rt_flags = info.rti_flags; 1398 1399 /* 1400 * If the gateway for an existing host route matches the target L3 1401 * address, which is a special route inserted by some implementation 1402 * such as MANET, and the interface is of the correct type, then 1403 * allow for ARP to proceed. 1404 */ 1405 if (rt_flags & RTF_GATEWAY) { 1406 if (!(rt_flags & RTF_HOST) || !info.rti_ifp || 1407 info.rti_ifp->if_type != IFT_ETHER || 1408 (info.rti_ifp->if_flags & (IFF_NOARP | IFF_STATICARP)) != 0 || 1409 memcmp(rt_gateway.sa_data, l3addr->sa_data, 1410 sizeof(in_addr_t)) != 0) { 1411 rib_free_info(&info); 1412 return (EINVAL); 1413 } 1414 } 1415 rib_free_info(&info); 1416 1417 /* 1418 * Make sure that at least the destination address is covered 1419 * by the route. This is for handling the case where 2 or more 1420 * interfaces have the same prefix. An incoming packet arrives 1421 * on one interface and the corresponding outgoing packet leaves 1422 * another interface. 1423 */ 1424 if (!(rt_flags & RTF_HOST) && info.rti_ifp != ifp) { 1425 const char *sa, *mask, *addr, *lim; 1426 const struct sockaddr_in *l3sin; 1427 1428 mask = (const char *)&rt_mask; 1429 /* 1430 * Just being extra cautious to avoid some custom 1431 * code getting into trouble. 1432 */ 1433 if ((info.rti_addrs & RTA_NETMASK) == 0) 1434 return (EINVAL); 1435 1436 sa = (const char *)&rt_key; 1437 addr = (const char *)l3addr; 1438 l3sin = (const struct sockaddr_in *)l3addr; 1439 lim = addr + l3sin->sin_len; 1440 1441 for ( ; addr < lim; sa++, mask++, addr++) { 1442 if ((*sa ^ *addr) & *mask) { 1443#ifdef DIAGNOSTIC 1444 char addrbuf[INET_ADDRSTRLEN]; 1445 1446 log(LOG_INFO, "IPv4 address: \"%s\" " 1447 "is not on the network\n", 1448 inet_ntoa_r(l3sin->sin_addr, addrbuf)); 1449#endif 1450 return (EINVAL); 1451 } 1452 } 1453 } 1454 1455 return (0); 1456} 1457 1458static inline uint32_t 1459in_lltable_hash_dst(const struct in_addr dst, uint32_t hsize) 1460{ 1461 1462 return (IN_LLTBL_HASH(dst.s_addr, hsize)); 1463} 1464 1465static uint32_t 1466in_lltable_hash(const struct llentry *lle, uint32_t hsize) 1467{ 1468 1469 return (in_lltable_hash_dst(lle->r_l3addr.addr4, hsize)); 1470} 1471 1472static void 1473in_lltable_fill_sa_entry(const struct llentry *lle, struct sockaddr *sa) 1474{ 1475 struct sockaddr_in *sin; 1476 1477 sin = (struct sockaddr_in *)sa; 1478 bzero(sin, sizeof(*sin)); 1479 sin->sin_family = AF_INET; 1480 sin->sin_len = sizeof(*sin); 1481 sin->sin_addr = lle->r_l3addr.addr4; 1482} 1483 1484static inline struct llentry * 1485in_lltable_find_dst(struct lltable *llt, struct in_addr dst) 1486{ 1487 struct llentry *lle; 1488 struct llentries *lleh; 1489 u_int hashidx; 1490 1491 hashidx = in_lltable_hash_dst(dst, llt->llt_hsize); 1492 lleh = &llt->lle_head[hashidx]; 1493 CK_LIST_FOREACH(lle, lleh, lle_next) { 1494 if (lle->la_flags & LLE_DELETED) 1495 continue; 1496 if (lle->r_l3addr.addr4.s_addr == dst.s_addr) 1497 break; 1498 } 1499 1500 return (lle); 1501} 1502 1503static void 1504in_lltable_delete_entry(struct lltable *llt, struct llentry *lle) 1505{ 1506 1507 lle->la_flags |= LLE_DELETED; 1508 EVENTHANDLER_INVOKE(lle_event, lle, LLENTRY_DELETED); 1509#ifdef DIAGNOSTIC 1510 log(LOG_INFO, "ifaddr cache = %p is deleted\n", lle); 1511#endif 1512 llentry_free(lle); 1513} 1514 1515static struct llentry * 1516in_lltable_alloc(struct lltable *llt, u_int flags, const struct sockaddr *l3addr) 1517{ 1518 const struct sockaddr_in *sin = (const struct sockaddr_in *)l3addr; 1519 struct ifnet *ifp = llt->llt_ifp; 1520 struct llentry *lle; 1521 char linkhdr[LLE_MAX_LINKHDR]; 1522 size_t linkhdrsize; 1523 int lladdr_off; 1524 1525 KASSERT(l3addr->sa_family == AF_INET, 1526 ("sin_family %d", l3addr->sa_family)); 1527 1528 /* 1529 * A route that covers the given address must have 1530 * been installed 1st because we are doing a resolution, 1531 * verify this. 1532 */ 1533 if (!(flags & LLE_IFADDR) && 1534 in_lltable_rtcheck(ifp, flags, l3addr) != 0) 1535 return (NULL); 1536 1537 lle = in_lltable_new(sin->sin_addr, flags); 1538 if (lle == NULL) { 1539 log(LOG_INFO, "lla_lookup: new lle malloc failed\n"); 1540 return (NULL); 1541 } 1542 lle->la_flags = flags; 1543 if (flags & LLE_STATIC) 1544 lle->r_flags |= RLLE_VALID; 1545 if ((flags & LLE_IFADDR) == LLE_IFADDR) { 1546 linkhdrsize = LLE_MAX_LINKHDR; 1547 if (lltable_calc_llheader(ifp, AF_INET, IF_LLADDR(ifp), 1548 linkhdr, &linkhdrsize, &lladdr_off) != 0) { 1549 NET_EPOCH_CALL(in_lltable_destroy_lle_unlocked, &lle->lle_epoch_ctx); 1550 return (NULL); 1551 } 1552 lltable_set_entry_addr(ifp, lle, linkhdr, linkhdrsize, 1553 lladdr_off); 1554 lle->la_flags |= LLE_STATIC; 1555 lle->r_flags |= (RLLE_VALID | RLLE_IFADDR); 1556 } 1557 1558 return (lle); 1559} 1560 1561/* 1562 * Return NULL if not found or marked for deletion. 1563 * If found return lle read locked. 1564 */ 1565static struct llentry * 1566in_lltable_lookup(struct lltable *llt, u_int flags, const struct sockaddr *l3addr) 1567{ 1568 const struct sockaddr_in *sin = (const struct sockaddr_in *)l3addr; 1569 struct llentry *lle; 1570 1571 IF_AFDATA_LOCK_ASSERT(llt->llt_ifp); 1572 KASSERT(l3addr->sa_family == AF_INET, 1573 ("sin_family %d", l3addr->sa_family)); 1574 KASSERT((flags & (LLE_UNLOCKED | LLE_EXCLUSIVE)) != 1575 (LLE_UNLOCKED | LLE_EXCLUSIVE), 1576 ("wrong lle request flags: %#x", flags)); 1577 1578 lle = in_lltable_find_dst(llt, sin->sin_addr); 1579 if (lle == NULL) 1580 return (NULL); 1581 if (flags & LLE_UNLOCKED) 1582 return (lle); 1583 1584 if (flags & LLE_EXCLUSIVE) 1585 LLE_WLOCK(lle); 1586 else 1587 LLE_RLOCK(lle); 1588 1589 /* 1590 * If the afdata lock is not held, the LLE may have been unlinked while 1591 * we were blocked on the LLE lock. Check for this case. 1592 */ 1593 if (__predict_false((lle->la_flags & LLE_LINKED) == 0)) { 1594 if (flags & LLE_EXCLUSIVE) 1595 LLE_WUNLOCK(lle); 1596 else 1597 LLE_RUNLOCK(lle); 1598 return (NULL); 1599 } 1600 return (lle); 1601} 1602 1603static int 1604in_lltable_dump_entry(struct lltable *llt, struct llentry *lle, 1605 struct sysctl_req *wr) 1606{ 1607 struct ifnet *ifp = llt->llt_ifp; 1608 /* XXX stack use */ 1609 struct { 1610 struct rt_msghdr rtm; 1611 struct sockaddr_in sin; 1612 struct sockaddr_dl sdl; 1613 } arpc; 1614 struct sockaddr_dl *sdl; 1615 int error; 1616 1617 bzero(&arpc, sizeof(arpc)); 1618 /* skip deleted entries */ 1619 if ((lle->la_flags & LLE_DELETED) == LLE_DELETED) 1620 return (0); 1621 /* Skip if jailed and not a valid IP of the prison. */ 1622 lltable_fill_sa_entry(lle,(struct sockaddr *)&arpc.sin); 1623 if (prison_if(wr->td->td_ucred, (struct sockaddr *)&arpc.sin) != 0) 1624 return (0); 1625 /* 1626 * produce a msg made of: 1627 * struct rt_msghdr; 1628 * struct sockaddr_in; (IPv4) 1629 * struct sockaddr_dl; 1630 */ 1631 arpc.rtm.rtm_msglen = sizeof(arpc); 1632 arpc.rtm.rtm_version = RTM_VERSION; 1633 arpc.rtm.rtm_type = RTM_GET; 1634 arpc.rtm.rtm_flags = RTF_UP; 1635 arpc.rtm.rtm_addrs = RTA_DST | RTA_GATEWAY; 1636 1637 /* publish */ 1638 if (lle->la_flags & LLE_PUB) 1639 arpc.rtm.rtm_flags |= RTF_ANNOUNCE; 1640 1641 sdl = &arpc.sdl; 1642 sdl->sdl_family = AF_LINK; 1643 sdl->sdl_len = sizeof(*sdl); 1644 sdl->sdl_index = ifp->if_index; 1645 sdl->sdl_type = ifp->if_type; 1646 if ((lle->la_flags & LLE_VALID) == LLE_VALID) { 1647 sdl->sdl_alen = ifp->if_addrlen; 1648 bcopy(lle->ll_addr, LLADDR(sdl), ifp->if_addrlen); 1649 } else { 1650 sdl->sdl_alen = 0; 1651 bzero(LLADDR(sdl), ifp->if_addrlen); 1652 } 1653 1654 arpc.rtm.rtm_rmx.rmx_expire = 1655 lle->la_flags & LLE_STATIC ? 0 : lle->la_expire; 1656 arpc.rtm.rtm_flags |= (RTF_HOST | RTF_LLDATA); 1657 if (lle->la_flags & LLE_STATIC) 1658 arpc.rtm.rtm_flags |= RTF_STATIC; 1659 if (lle->la_flags & LLE_IFADDR) 1660 arpc.rtm.rtm_flags |= RTF_PINNED; 1661 arpc.rtm.rtm_index = ifp->if_index; 1662 error = SYSCTL_OUT(wr, &arpc, sizeof(arpc)); 1663 1664 return (error); 1665} 1666 1667static struct lltable * 1668in_lltattach(struct ifnet *ifp) 1669{ 1670 struct lltable *llt; 1671 1672 llt = lltable_allocate_htbl(IN_LLTBL_DEFAULT_HSIZE); 1673 llt->llt_af = AF_INET; 1674 llt->llt_ifp = ifp; 1675 1676 llt->llt_lookup = in_lltable_lookup; 1677 llt->llt_alloc_entry = in_lltable_alloc; 1678 llt->llt_delete_entry = in_lltable_delete_entry; 1679 llt->llt_dump_entry = in_lltable_dump_entry; 1680 llt->llt_hash = in_lltable_hash; 1681 llt->llt_fill_sa_entry = in_lltable_fill_sa_entry; 1682 llt->llt_free_entry = in_lltable_free_entry; 1683 llt->llt_match_prefix = in_lltable_match_prefix; 1684 llt->llt_mark_used = in_lltable_mark_used; 1685 lltable_link(llt); 1686 1687 return (llt); 1688} 1689 1690void * 1691in_domifattach(struct ifnet *ifp) 1692{ 1693 struct in_ifinfo *ii; 1694 1695 ii = malloc(sizeof(struct in_ifinfo), M_IFADDR, M_WAITOK|M_ZERO); 1696 1697 ii->ii_llt = in_lltattach(ifp); 1698 ii->ii_igmp = igmp_domifattach(ifp); 1699 1700 return (ii); 1701} 1702 1703void 1704in_domifdetach(struct ifnet *ifp, void *aux) 1705{ 1706 struct in_ifinfo *ii = (struct in_ifinfo *)aux; 1707 1708 igmp_domifdetach(ifp); 1709 lltable_free(ii->ii_llt); 1710 free(ii, M_IFADDR); 1711} 1712