ip_options.c revision 152592
1/* 2 * Copyright (c) 1982, 1986, 1988, 1993 3 * The Regents of the University of California. All rights reserved. 4 * Copyright (c) 2005 5 * Andre Oppermann, Internet Business Solutions AG. All right reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 4. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 * 31 * $FreeBSD: head/sys/netinet/ip_options.c 152592 2005-11-18 20:12:40Z andre $ 32 */ 33 34#include "opt_ipstealth.h" 35#include "opt_mac.h" 36 37#include <sys/param.h> 38#include <sys/systm.h> 39#include <sys/mac.h> 40#include <sys/mbuf.h> 41/* #include <sys/malloc.h> */ 42#include <sys/domain.h> 43#include <sys/protosw.h> 44#include <sys/socket.h> 45#include <sys/time.h> 46#include <sys/kernel.h> 47#include <sys/syslog.h> 48#include <sys/sysctl.h> 49 50#include <net/if.h> 51#include <net/if_types.h> 52#include <net/if_var.h> 53#include <net/if_dl.h> 54#include <net/route.h> 55#include <net/netisr.h> 56 57#include <netinet/in.h> 58#include <netinet/in_systm.h> 59#include <netinet/in_var.h> 60#include <netinet/ip.h> 61#include <netinet/in_pcb.h> 62#include <netinet/ip_var.h> 63#include <netinet/ip_options.h> 64#include <netinet/ip_icmp.h> 65#include <machine/in_cksum.h> 66 67#include <sys/socketvar.h> 68 69static int ip_dosourceroute = 0; 70SYSCTL_INT(_net_inet_ip, IPCTL_SOURCEROUTE, sourceroute, CTLFLAG_RW, 71 &ip_dosourceroute, 0, "Enable forwarding source routed IP packets"); 72 73static int ip_acceptsourceroute = 0; 74SYSCTL_INT(_net_inet_ip, IPCTL_ACCEPTSOURCEROUTE, accept_sourceroute, 75 CTLFLAG_RW, &ip_acceptsourceroute, 0, 76 "Enable accepting source routed IP packets"); 77 78int ip_doopts = 1; /* 0 = ignore, 1 = process, 2 = reject */ 79SYSCTL_INT(_net_inet_ip, OID_AUTO, process_options, CTLFLAG_RW, 80 &ip_doopts, 0, "Enable IP options processing ([LS]SRR, RR, TS)"); 81 82static void save_rte(struct mbuf *m, u_char *, struct in_addr); 83 84/* 85 * Do option processing on a datagram, 86 * possibly discarding it if bad options are encountered, 87 * or forwarding it if source-routed. 88 * The pass argument is used when operating in the IPSTEALTH 89 * mode to tell what options to process: 90 * [LS]SRR (pass 0) or the others (pass 1). 91 * The reason for as many as two passes is that when doing IPSTEALTH, 92 * non-routing options should be processed only if the packet is for us. 93 * Returns 1 if packet has been forwarded/freed, 94 * 0 if the packet should be processed further. 95 */ 96int 97ip_dooptions(struct mbuf *m, int pass) 98{ 99 struct ip *ip = mtod(m, struct ip *); 100 u_char *cp; 101 struct in_ifaddr *ia; 102 int opt, optlen, cnt, off, code, type = ICMP_PARAMPROB, forward = 0; 103 struct in_addr *sin, dst; 104 n_time ntime; 105 struct sockaddr_in ipaddr = { sizeof(ipaddr), AF_INET }; 106 107 /* ignore or reject packets with IP options */ 108 if (ip_doopts == 0) 109 return 0; 110 else if (ip_doopts == 2) { 111 type = ICMP_UNREACH; 112 code = ICMP_UNREACH_FILTER_PROHIB; 113 goto bad; 114 } 115 116 dst = ip->ip_dst; 117 cp = (u_char *)(ip + 1); 118 cnt = (ip->ip_hl << 2) - sizeof (struct ip); 119 for (; cnt > 0; cnt -= optlen, cp += optlen) { 120 opt = cp[IPOPT_OPTVAL]; 121 if (opt == IPOPT_EOL) 122 break; 123 if (opt == IPOPT_NOP) 124 optlen = 1; 125 else { 126 if (cnt < IPOPT_OLEN + sizeof(*cp)) { 127 code = &cp[IPOPT_OLEN] - (u_char *)ip; 128 goto bad; 129 } 130 optlen = cp[IPOPT_OLEN]; 131 if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) { 132 code = &cp[IPOPT_OLEN] - (u_char *)ip; 133 goto bad; 134 } 135 } 136 switch (opt) { 137 138 default: 139 break; 140 141 /* 142 * Source routing with record. 143 * Find interface with current destination address. 144 * If none on this machine then drop if strictly routed, 145 * or do nothing if loosely routed. 146 * Record interface address and bring up next address 147 * component. If strictly routed make sure next 148 * address is on directly accessible net. 149 */ 150 case IPOPT_LSRR: 151 case IPOPT_SSRR: 152#ifdef IPSTEALTH 153 if (ipstealth && pass > 0) 154 break; 155#endif 156 if (optlen < IPOPT_OFFSET + sizeof(*cp)) { 157 code = &cp[IPOPT_OLEN] - (u_char *)ip; 158 goto bad; 159 } 160 if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) { 161 code = &cp[IPOPT_OFFSET] - (u_char *)ip; 162 goto bad; 163 } 164 ipaddr.sin_addr = ip->ip_dst; 165 ia = (struct in_ifaddr *) 166 ifa_ifwithaddr((struct sockaddr *)&ipaddr); 167 if (ia == NULL) { 168 if (opt == IPOPT_SSRR) { 169 type = ICMP_UNREACH; 170 code = ICMP_UNREACH_SRCFAIL; 171 goto bad; 172 } 173 if (!ip_dosourceroute) 174 goto nosourcerouting; 175 /* 176 * Loose routing, and not at next destination 177 * yet; nothing to do except forward. 178 */ 179 break; 180 } 181 off--; /* 0 origin */ 182 if (off > optlen - (int)sizeof(struct in_addr)) { 183 /* 184 * End of source route. Should be for us. 185 */ 186 if (!ip_acceptsourceroute) 187 goto nosourcerouting; 188 save_rte(m, cp, ip->ip_src); 189 break; 190 } 191#ifdef IPSTEALTH 192 if (ipstealth) 193 goto dropit; 194#endif 195 if (!ip_dosourceroute) { 196 if (ipforwarding) { 197 char buf[16]; /* aaa.bbb.ccc.ddd\0 */ 198 /* 199 * Acting as a router, so generate ICMP 200 */ 201nosourcerouting: 202 strcpy(buf, inet_ntoa(ip->ip_dst)); 203 log(LOG_WARNING, 204 "attempted source route from %s to %s\n", 205 inet_ntoa(ip->ip_src), buf); 206 type = ICMP_UNREACH; 207 code = ICMP_UNREACH_SRCFAIL; 208 goto bad; 209 } else { 210 /* 211 * Not acting as a router, so silently drop. 212 */ 213#ifdef IPSTEALTH 214dropit: 215#endif 216 ipstat.ips_cantforward++; 217 m_freem(m); 218 return (1); 219 } 220 } 221 222 /* 223 * locate outgoing interface 224 */ 225 (void)memcpy(&ipaddr.sin_addr, cp + off, 226 sizeof(ipaddr.sin_addr)); 227 228 if (opt == IPOPT_SSRR) { 229#define INA struct in_ifaddr * 230#define SA struct sockaddr * 231 if ((ia = (INA)ifa_ifwithdstaddr((SA)&ipaddr)) == NULL) 232 ia = (INA)ifa_ifwithnet((SA)&ipaddr); 233 } else 234 ia = ip_rtaddr(ipaddr.sin_addr); 235 if (ia == NULL) { 236 type = ICMP_UNREACH; 237 code = ICMP_UNREACH_SRCFAIL; 238 goto bad; 239 } 240 ip->ip_dst = ipaddr.sin_addr; 241 (void)memcpy(cp + off, &(IA_SIN(ia)->sin_addr), 242 sizeof(struct in_addr)); 243 cp[IPOPT_OFFSET] += sizeof(struct in_addr); 244 /* 245 * Let ip_intr's mcast routing check handle mcast pkts 246 */ 247 forward = !IN_MULTICAST(ntohl(ip->ip_dst.s_addr)); 248 break; 249 250 case IPOPT_RR: 251#ifdef IPSTEALTH 252 if (ipstealth && pass == 0) 253 break; 254#endif 255 if (optlen < IPOPT_OFFSET + sizeof(*cp)) { 256 code = &cp[IPOPT_OFFSET] - (u_char *)ip; 257 goto bad; 258 } 259 if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) { 260 code = &cp[IPOPT_OFFSET] - (u_char *)ip; 261 goto bad; 262 } 263 /* 264 * If no space remains, ignore. 265 */ 266 off--; /* 0 origin */ 267 if (off > optlen - (int)sizeof(struct in_addr)) 268 break; 269 (void)memcpy(&ipaddr.sin_addr, &ip->ip_dst, 270 sizeof(ipaddr.sin_addr)); 271 /* 272 * locate outgoing interface; if we're the destination, 273 * use the incoming interface (should be same). 274 */ 275 if ((ia = (INA)ifa_ifwithaddr((SA)&ipaddr)) == NULL && 276 (ia = ip_rtaddr(ipaddr.sin_addr)) == NULL) { 277 type = ICMP_UNREACH; 278 code = ICMP_UNREACH_HOST; 279 goto bad; 280 } 281 (void)memcpy(cp + off, &(IA_SIN(ia)->sin_addr), 282 sizeof(struct in_addr)); 283 cp[IPOPT_OFFSET] += sizeof(struct in_addr); 284 break; 285 286 case IPOPT_TS: 287#ifdef IPSTEALTH 288 if (ipstealth && pass == 0) 289 break; 290#endif 291 code = cp - (u_char *)ip; 292 if (optlen < 4 || optlen > 40) { 293 code = &cp[IPOPT_OLEN] - (u_char *)ip; 294 goto bad; 295 } 296 if ((off = cp[IPOPT_OFFSET]) < 5) { 297 code = &cp[IPOPT_OLEN] - (u_char *)ip; 298 goto bad; 299 } 300 if (off > optlen - (int)sizeof(int32_t)) { 301 cp[IPOPT_OFFSET + 1] += (1 << 4); 302 if ((cp[IPOPT_OFFSET + 1] & 0xf0) == 0) { 303 code = &cp[IPOPT_OFFSET] - (u_char *)ip; 304 goto bad; 305 } 306 break; 307 } 308 off--; /* 0 origin */ 309 sin = (struct in_addr *)(cp + off); 310 switch (cp[IPOPT_OFFSET + 1] & 0x0f) { 311 312 case IPOPT_TS_TSONLY: 313 break; 314 315 case IPOPT_TS_TSANDADDR: 316 if (off + sizeof(n_time) + 317 sizeof(struct in_addr) > optlen) { 318 code = &cp[IPOPT_OFFSET] - (u_char *)ip; 319 goto bad; 320 } 321 ipaddr.sin_addr = dst; 322 ia = (INA)ifaof_ifpforaddr((SA)&ipaddr, 323 m->m_pkthdr.rcvif); 324 if (ia == NULL) 325 continue; 326 (void)memcpy(sin, &IA_SIN(ia)->sin_addr, 327 sizeof(struct in_addr)); 328 cp[IPOPT_OFFSET] += sizeof(struct in_addr); 329 off += sizeof(struct in_addr); 330 break; 331 332 case IPOPT_TS_PRESPEC: 333 if (off + sizeof(n_time) + 334 sizeof(struct in_addr) > optlen) { 335 code = &cp[IPOPT_OFFSET] - (u_char *)ip; 336 goto bad; 337 } 338 (void)memcpy(&ipaddr.sin_addr, sin, 339 sizeof(struct in_addr)); 340 if (ifa_ifwithaddr((SA)&ipaddr) == NULL) 341 continue; 342 cp[IPOPT_OFFSET] += sizeof(struct in_addr); 343 off += sizeof(struct in_addr); 344 break; 345 346 default: 347 code = &cp[IPOPT_OFFSET + 1] - (u_char *)ip; 348 goto bad; 349 } 350 ntime = iptime(); 351 (void)memcpy(cp + off, &ntime, sizeof(n_time)); 352 cp[IPOPT_OFFSET] += sizeof(n_time); 353 } 354 } 355 if (forward && ipforwarding) { 356 ip_forward(m, 1); 357 return (1); 358 } 359 return (0); 360bad: 361 icmp_error(m, type, code, 0, 0); 362 ipstat.ips_badoptions++; 363 return (1); 364} 365 366/* 367 * Save incoming source route for use in replies, 368 * to be picked up later by ip_srcroute if the receiver is interested. 369 */ 370static void 371save_rte(m, option, dst) 372 struct mbuf *m; 373 u_char *option; 374 struct in_addr dst; 375{ 376 unsigned olen; 377 struct ipopt_tag *opts; 378 379 opts = (struct ipopt_tag *)m_tag_get(PACKET_TAG_IPOPTIONS, 380 sizeof(struct ipopt_tag), M_NOWAIT); 381 if (opts == NULL) 382 return; 383 384 olen = option[IPOPT_OLEN]; 385#ifdef DIAGNOSTIC 386 if (ipprintfs) 387 printf("save_rte: olen %d\n", olen); 388#endif 389 if (olen > sizeof(opts->ip_srcrt) - (1 + sizeof(dst))) { 390 m_tag_free((struct m_tag *)opts); 391 return; 392 } 393 bcopy(option, opts->ip_srcrt.srcopt, olen); 394 opts->ip_nhops = (olen - IPOPT_OFFSET - 1) / sizeof(struct in_addr); 395 opts->ip_srcrt.dst = dst; 396 m_tag_prepend(m, (struct m_tag *)opts); 397} 398 399/* 400 * Retrieve incoming source route for use in replies, 401 * in the same form used by setsockopt. 402 * The first hop is placed before the options, will be removed later. 403 */ 404struct mbuf * 405ip_srcroute(m0) 406 struct mbuf *m0; 407{ 408 register struct in_addr *p, *q; 409 register struct mbuf *m; 410 struct ipopt_tag *opts; 411 412 opts = (struct ipopt_tag *)m_tag_find(m0, PACKET_TAG_IPOPTIONS, NULL); 413 if (opts == NULL) 414 return (NULL); 415 416 if (opts->ip_nhops == 0) 417 return (NULL); 418 m = m_get(M_DONTWAIT, MT_DATA); 419 if (m == NULL) 420 return (NULL); 421 422#define OPTSIZ (sizeof(opts->ip_srcrt.nop) + sizeof(opts->ip_srcrt.srcopt)) 423 424 /* length is (nhops+1)*sizeof(addr) + sizeof(nop + srcrt header) */ 425 m->m_len = opts->ip_nhops * sizeof(struct in_addr) + 426 sizeof(struct in_addr) + OPTSIZ; 427#ifdef DIAGNOSTIC 428 if (ipprintfs) 429 printf("ip_srcroute: nhops %d mlen %d", opts->ip_nhops, m->m_len); 430#endif 431 432 /* 433 * First save first hop for return route 434 */ 435 p = &(opts->ip_srcrt.route[opts->ip_nhops - 1]); 436 *(mtod(m, struct in_addr *)) = *p--; 437#ifdef DIAGNOSTIC 438 if (ipprintfs) 439 printf(" hops %lx", (u_long)ntohl(mtod(m, struct in_addr *)->s_addr)); 440#endif 441 442 /* 443 * Copy option fields and padding (nop) to mbuf. 444 */ 445 opts->ip_srcrt.nop = IPOPT_NOP; 446 opts->ip_srcrt.srcopt[IPOPT_OFFSET] = IPOPT_MINOFF; 447 (void)memcpy(mtod(m, caddr_t) + sizeof(struct in_addr), 448 &(opts->ip_srcrt.nop), OPTSIZ); 449 q = (struct in_addr *)(mtod(m, caddr_t) + 450 sizeof(struct in_addr) + OPTSIZ); 451#undef OPTSIZ 452 /* 453 * Record return path as an IP source route, 454 * reversing the path (pointers are now aligned). 455 */ 456 while (p >= opts->ip_srcrt.route) { 457#ifdef DIAGNOSTIC 458 if (ipprintfs) 459 printf(" %lx", (u_long)ntohl(q->s_addr)); 460#endif 461 *q++ = *p--; 462 } 463 /* 464 * Last hop goes to final destination. 465 */ 466 *q = opts->ip_srcrt.dst; 467#ifdef DIAGNOSTIC 468 if (ipprintfs) 469 printf(" %lx\n", (u_long)ntohl(q->s_addr)); 470#endif 471 m_tag_delete(m0, (struct m_tag *)opts); 472 return (m); 473} 474 475/* 476 * Strip out IP options, at higher 477 * level protocol in the kernel. 478 * Second argument is buffer to which options 479 * will be moved, and return value is their length. 480 * XXX should be deleted; last arg currently ignored. 481 */ 482void 483ip_stripoptions(m, mopt) 484 register struct mbuf *m; 485 struct mbuf *mopt; 486{ 487 register int i; 488 struct ip *ip = mtod(m, struct ip *); 489 register caddr_t opts; 490 int olen; 491 492 olen = (ip->ip_hl << 2) - sizeof (struct ip); 493 opts = (caddr_t)(ip + 1); 494 i = m->m_len - (sizeof (struct ip) + olen); 495 bcopy(opts + olen, opts, (unsigned)i); 496 m->m_len -= olen; 497 if (m->m_flags & M_PKTHDR) 498 m->m_pkthdr.len -= olen; 499 ip->ip_v = IPVERSION; 500 ip->ip_hl = sizeof(struct ip) >> 2; 501} 502 503/* 504 * Insert IP options into preformed packet. 505 * Adjust IP destination as required for IP source routing, 506 * as indicated by a non-zero in_addr at the start of the options. 507 * 508 * XXX This routine assumes that the packet has no options in place. 509 */ 510struct mbuf * 511ip_insertoptions(m, opt, phlen) 512 register struct mbuf *m; 513 struct mbuf *opt; 514 int *phlen; 515{ 516 register struct ipoption *p = mtod(opt, struct ipoption *); 517 struct mbuf *n; 518 register struct ip *ip = mtod(m, struct ip *); 519 unsigned optlen; 520 521 optlen = opt->m_len - sizeof(p->ipopt_dst); 522 if (optlen + ip->ip_len > IP_MAXPACKET) { 523 *phlen = 0; 524 return (m); /* XXX should fail */ 525 } 526 if (p->ipopt_dst.s_addr) 527 ip->ip_dst = p->ipopt_dst; 528 if (m->m_flags & M_EXT || m->m_data - optlen < m->m_pktdat) { 529 MGETHDR(n, M_DONTWAIT, MT_DATA); 530 if (n == NULL) { 531 *phlen = 0; 532 return (m); 533 } 534 M_MOVE_PKTHDR(n, m); 535 n->m_pkthdr.rcvif = NULL; 536#ifdef MAC 537 mac_copy_mbuf(m, n); 538#endif 539 n->m_pkthdr.len += optlen; 540 m->m_len -= sizeof(struct ip); 541 m->m_data += sizeof(struct ip); 542 n->m_next = m; 543 m = n; 544 m->m_len = optlen + sizeof(struct ip); 545 m->m_data += max_linkhdr; 546 bcopy(ip, mtod(m, void *), sizeof(struct ip)); 547 } else { 548 m->m_data -= optlen; 549 m->m_len += optlen; 550 m->m_pkthdr.len += optlen; 551 bcopy(ip, mtod(m, void *), sizeof(struct ip)); 552 } 553 ip = mtod(m, struct ip *); 554 bcopy(p->ipopt_list, ip + 1, optlen); 555 *phlen = sizeof(struct ip) + optlen; 556 ip->ip_v = IPVERSION; 557 ip->ip_hl = *phlen >> 2; 558 ip->ip_len += optlen; 559 return (m); 560} 561 562/* 563 * Copy options from ip to jp, 564 * omitting those not copied during fragmentation. 565 */ 566int 567ip_optcopy(ip, jp) 568 struct ip *ip, *jp; 569{ 570 register u_char *cp, *dp; 571 int opt, optlen, cnt; 572 573 cp = (u_char *)(ip + 1); 574 dp = (u_char *)(jp + 1); 575 cnt = (ip->ip_hl << 2) - sizeof (struct ip); 576 for (; cnt > 0; cnt -= optlen, cp += optlen) { 577 opt = cp[0]; 578 if (opt == IPOPT_EOL) 579 break; 580 if (opt == IPOPT_NOP) { 581 /* Preserve for IP mcast tunnel's LSRR alignment. */ 582 *dp++ = IPOPT_NOP; 583 optlen = 1; 584 continue; 585 } 586 587 KASSERT(cnt >= IPOPT_OLEN + sizeof(*cp), 588 ("ip_optcopy: malformed ipv4 option")); 589 optlen = cp[IPOPT_OLEN]; 590 KASSERT(optlen >= IPOPT_OLEN + sizeof(*cp) && optlen <= cnt, 591 ("ip_optcopy: malformed ipv4 option")); 592 593 /* bogus lengths should have been caught by ip_dooptions */ 594 if (optlen > cnt) 595 optlen = cnt; 596 if (IPOPT_COPIED(opt)) { 597 bcopy(cp, dp, optlen); 598 dp += optlen; 599 } 600 } 601 for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++) 602 *dp++ = IPOPT_EOL; 603 return (optlen); 604} 605 606/* 607 * Set up IP options in pcb for insertion in output packets. 608 * Store in mbuf with pointer in pcbopt, adding pseudo-option 609 * with destination address if source routed. 610 */ 611int 612ip_pcbopts(struct inpcb *inp, int optname, struct mbuf *m) 613{ 614 register int cnt, optlen; 615 register u_char *cp; 616 struct mbuf **pcbopt; 617 u_char opt; 618 619 INP_LOCK_ASSERT(inp); 620 621 pcbopt = &inp->inp_options; 622 623 /* turn off any old options */ 624 if (*pcbopt) 625 (void)m_free(*pcbopt); 626 *pcbopt = 0; 627 if (m == NULL || m->m_len == 0) { 628 /* 629 * Only turning off any previous options. 630 */ 631 if (m != NULL) 632 (void)m_free(m); 633 return (0); 634 } 635 636 if (m->m_len % sizeof(int32_t)) 637 goto bad; 638 /* 639 * IP first-hop destination address will be stored before 640 * actual options; move other options back 641 * and clear it when none present. 642 */ 643 if (m->m_data + m->m_len + sizeof(struct in_addr) >= &m->m_dat[MLEN]) 644 goto bad; 645 cnt = m->m_len; 646 m->m_len += sizeof(struct in_addr); 647 cp = mtod(m, u_char *) + sizeof(struct in_addr); 648 bcopy(mtod(m, void *), cp, (unsigned)cnt); 649 bzero(mtod(m, void *), sizeof(struct in_addr)); 650 651 for (; cnt > 0; cnt -= optlen, cp += optlen) { 652 opt = cp[IPOPT_OPTVAL]; 653 if (opt == IPOPT_EOL) 654 break; 655 if (opt == IPOPT_NOP) 656 optlen = 1; 657 else { 658 if (cnt < IPOPT_OLEN + sizeof(*cp)) 659 goto bad; 660 optlen = cp[IPOPT_OLEN]; 661 if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) 662 goto bad; 663 } 664 switch (opt) { 665 666 default: 667 break; 668 669 case IPOPT_LSRR: 670 case IPOPT_SSRR: 671 /* 672 * user process specifies route as: 673 * ->A->B->C->D 674 * D must be our final destination (but we can't 675 * check that since we may not have connected yet). 676 * A is first hop destination, which doesn't appear in 677 * actual IP option, but is stored before the options. 678 */ 679 if (optlen < IPOPT_MINOFF - 1 + sizeof(struct in_addr)) 680 goto bad; 681 m->m_len -= sizeof(struct in_addr); 682 cnt -= sizeof(struct in_addr); 683 optlen -= sizeof(struct in_addr); 684 cp[IPOPT_OLEN] = optlen; 685 /* 686 * Move first hop before start of options. 687 */ 688 bcopy((caddr_t)&cp[IPOPT_OFFSET+1], mtod(m, caddr_t), 689 sizeof(struct in_addr)); 690 /* 691 * Then copy rest of options back 692 * to close up the deleted entry. 693 */ 694 bcopy((&cp[IPOPT_OFFSET+1] + sizeof(struct in_addr)), 695 &cp[IPOPT_OFFSET+1], 696 (unsigned)cnt - (IPOPT_MINOFF - 1)); 697 break; 698 } 699 } 700 if (m->m_len > MAX_IPOPTLEN + sizeof(struct in_addr)) 701 goto bad; 702 *pcbopt = m; 703 return (0); 704 705bad: 706 (void)m_free(m); 707 return (EINVAL); 708} 709