ip_input.c revision 1.60
1/* $NetBSD: ip_input.c,v 1.60 1998/04/29 03:44:11 kml Exp $ */ 2 3/*- 4 * Copyright (c) 1998 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Public Access Networks Corporation ("Panix"). It was developed under 9 * contract to Panix by Eric Haszlakiewicz and Thor Lancelot Simon. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by the NetBSD 22 * Foundation, Inc. and its contributors. 23 * 4. Neither the name of The NetBSD Foundation nor the names of its 24 * contributors may be used to endorse or promote products derived 25 * from this software without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37 * POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40/* 41 * Copyright (c) 1982, 1986, 1988, 1993 42 * The Regents of the University of California. All rights reserved. 43 * 44 * Redistribution and use in source and binary forms, with or without 45 * modification, are permitted provided that the following conditions 46 * are met: 47 * 1. Redistributions of source code must retain the above copyright 48 * notice, this list of conditions and the following disclaimer. 49 * 2. Redistributions in binary form must reproduce the above copyright 50 * notice, this list of conditions and the following disclaimer in the 51 * documentation and/or other materials provided with the distribution. 52 * 3. All advertising materials mentioning features or use of this software 53 * must display the following acknowledgement: 54 * This product includes software developed by the University of 55 * California, Berkeley and its contributors. 56 * 4. Neither the name of the University nor the names of its contributors 57 * may be used to endorse or promote products derived from this software 58 * without specific prior written permission. 59 * 60 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 61 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 62 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 63 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 64 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 65 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 66 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 67 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 68 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 69 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 70 * SUCH DAMAGE. 71 * 72 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 73 */ 74 75#include "opt_mrouting.h" 76 77#include <sys/param.h> 78#include <sys/systm.h> 79#include <sys/malloc.h> 80#include <sys/mbuf.h> 81#include <sys/domain.h> 82#include <sys/protosw.h> 83#include <sys/socket.h> 84#include <sys/socketvar.h> 85#include <sys/errno.h> 86#include <sys/time.h> 87#include <sys/kernel.h> 88#include <sys/proc.h> 89 90#include <vm/vm.h> 91#include <sys/sysctl.h> 92 93#include <net/if.h> 94#include <net/if_dl.h> 95#include <net/route.h> 96#include <net/pfil.h> 97 98#include <netinet/in.h> 99#include <netinet/in_systm.h> 100#include <netinet/ip.h> 101#include <netinet/in_pcb.h> 102#include <netinet/in_var.h> 103#include <netinet/ip_var.h> 104#include <netinet/ip_icmp.h> 105 106#ifndef IPFORWARDING 107#ifdef GATEWAY 108#define IPFORWARDING 1 /* forward IP packets not for us */ 109#else /* GATEWAY */ 110#define IPFORWARDING 0 /* don't forward IP packets not for us */ 111#endif /* GATEWAY */ 112#endif /* IPFORWARDING */ 113#ifndef IPSENDREDIRECTS 114#define IPSENDREDIRECTS 1 115#endif 116#ifndef IPFORWSRCRT 117#define IPFORWSRCRT 1 /* forward source-routed packets */ 118#endif 119#ifndef IPALLOWSRCRT 120#define IPALLOWSRCRT 1 /* allow source-routed packets */ 121#endif 122#ifndef IPMTUDISC 123#define IPMTUDISC 0 124#endif 125#ifndef IPMTUDISCTIMEOUT 126#define IPMTUDISCTIMEOUT (1 * 60) /* experimental short timeout value! */ 127#endif 128 129/* 130 * Note: DIRECTED_BROADCAST is handled this way so that previous 131 * configuration using this option will Just Work. 132 */ 133#ifndef IPDIRECTEDBCAST 134#ifdef DIRECTED_BROADCAST 135#define IPDIRECTEDBCAST 1 136#else 137#define IPDIRECTEDBCAST 0 138#endif /* DIRECTED_BROADCAST */ 139#endif /* IPDIRECTEDBCAST */ 140int ipforwarding = IPFORWARDING; 141int ipsendredirects = IPSENDREDIRECTS; 142int ip_defttl = IPDEFTTL; 143int ip_forwsrcrt = IPFORWSRCRT; 144int ip_directedbcast = IPDIRECTEDBCAST; 145int ip_allowsrcrt = IPALLOWSRCRT; 146int ip_mtudisc = IPMTUDISC; 147u_int ip_mtudisc_timeout = IPMTUDISCTIMEOUT; 148#ifdef DIAGNOSTIC 149int ipprintfs = 0; 150#endif 151 152struct rttimer_queue *ip_mtudisc_timeout_q = NULL; 153 154extern struct domain inetdomain; 155extern struct protosw inetsw[]; 156u_char ip_protox[IPPROTO_MAX]; 157int ipqmaxlen = IFQ_MAXLEN; 158struct in_ifaddrhead in_ifaddr; 159struct in_ifaddrhashhead *in_ifaddrhashtbl; 160struct ifqueue ipintrq; 161 162/* 163 * We need to save the IP options in case a protocol wants to respond 164 * to an incoming packet over the same route if the packet got here 165 * using IP source routing. This allows connection establishment and 166 * maintenance when the remote end is on a network that is not known 167 * to us. 168 */ 169int ip_nhops = 0; 170static struct ip_srcrt { 171 struct in_addr dst; /* final destination */ 172 char nop; /* one NOP to align */ 173 char srcopt[IPOPT_OFFSET + 1]; /* OPTVAL, OLEN and OFFSET */ 174 struct in_addr route[MAX_IPOPTLEN/sizeof(struct in_addr)]; 175} ip_srcrt; 176 177static void save_rte __P((u_char *, struct in_addr)); 178 179/* 180 * IP initialization: fill in IP protocol switch table. 181 * All protocols not implemented in kernel go to raw IP protocol handler. 182 */ 183void 184ip_init() 185{ 186 register struct protosw *pr; 187 register int i; 188 189 pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW); 190 if (pr == 0) 191 panic("ip_init"); 192 for (i = 0; i < IPPROTO_MAX; i++) 193 ip_protox[i] = pr - inetsw; 194 for (pr = inetdomain.dom_protosw; 195 pr < inetdomain.dom_protoswNPROTOSW; pr++) 196 if (pr->pr_domain->dom_family == PF_INET && 197 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) 198 ip_protox[pr->pr_protocol] = pr - inetsw; 199 LIST_INIT(&ipq); 200 ip_id = time.tv_sec & 0xffff; 201 ipintrq.ifq_maxlen = ipqmaxlen; 202 TAILQ_INIT(&in_ifaddr); 203 in_ifaddrhashtbl = 204 hashinit(IN_IFADDR_HASH_SIZE, M_IFADDR, M_WAITOK, &in_ifaddrhash); 205 if (ip_mtudisc != 0) 206 ip_mtudisc_timeout_q = 207 rt_timer_queue_create(ip_mtudisc_timeout); 208} 209 210struct sockaddr_in ipaddr = { sizeof(ipaddr), AF_INET }; 211struct route ipforward_rt; 212 213/* 214 * Ip input routine. Checksum and byte swap header. If fragmented 215 * try to reassemble. Process options. Pass to next level. 216 */ 217void 218ipintr() 219{ 220 register struct ip *ip = NULL; 221 register struct mbuf *m; 222 register struct ipq *fp; 223 register struct in_ifaddr *ia; 224 register struct ifaddr *ifa; 225 struct ipqent *ipqe; 226 int hlen = 0, mff, len, s; 227#ifdef PFIL_HOOKS 228 struct packet_filter_hook *pfh; 229 struct mbuf *m0; 230 int rv; 231#endif /* PFIL_HOOKS */ 232 233next: 234 /* 235 * Get next datagram off input queue and get IP header 236 * in first mbuf. 237 */ 238 s = splimp(); 239 IF_DEQUEUE(&ipintrq, m); 240 splx(s); 241 if (m == 0) 242 return; 243#ifdef DIAGNOSTIC 244 if ((m->m_flags & M_PKTHDR) == 0) 245 panic("ipintr no HDR"); 246#endif 247 /* 248 * If no IP addresses have been set yet but the interfaces 249 * are receiving, can't do anything with incoming packets yet. 250 */ 251 if (in_ifaddr.tqh_first == 0) 252 goto bad; 253 ipstat.ips_total++; 254 if (m->m_len < sizeof (struct ip) && 255 (m = m_pullup(m, sizeof (struct ip))) == 0) { 256 ipstat.ips_toosmall++; 257 goto next; 258 } 259 ip = mtod(m, struct ip *); 260 if (ip->ip_v != IPVERSION) { 261 ipstat.ips_badvers++; 262 goto bad; 263 } 264 hlen = ip->ip_hl << 2; 265 if (hlen < sizeof(struct ip)) { /* minimum header length */ 266 ipstat.ips_badhlen++; 267 goto bad; 268 } 269 if (hlen > m->m_len) { 270 if ((m = m_pullup(m, hlen)) == 0) { 271 ipstat.ips_badhlen++; 272 goto next; 273 } 274 ip = mtod(m, struct ip *); 275 } 276 if ((ip->ip_sum = in_cksum(m, hlen)) != 0) { 277 ipstat.ips_badsum++; 278 goto bad; 279 } 280 281 /* 282 * Convert fields to host representation. 283 */ 284 NTOHS(ip->ip_len); 285 NTOHS(ip->ip_id); 286 NTOHS(ip->ip_off); 287 len = ip->ip_len; 288 289 /* 290 * Check that the amount of data in the buffers 291 * is as at least much as the IP header would have us expect. 292 * Trim mbufs if longer than we expect. 293 * Drop packet if shorter than we expect. 294 */ 295 if (m->m_pkthdr.len < len) { 296 ipstat.ips_tooshort++; 297 goto bad; 298 } 299 if (m->m_pkthdr.len > len) { 300 if (m->m_len == m->m_pkthdr.len) { 301 m->m_len = len; 302 m->m_pkthdr.len = len; 303 } else 304 m_adj(m, len - m->m_pkthdr.len); 305 } 306 307#ifdef PFIL_HOOKS 308 /* 309 * Run through list of hooks for input packets. 310 */ 311 m0 = m; 312 for (pfh = pfil_hook_get(PFIL_IN); pfh; pfh = pfh->pfil_link.tqe_next) 313 if (pfh->pfil_func) { 314 rv = pfh->pfil_func(ip, hlen, m->m_pkthdr.rcvif, 0, &m0); 315 if (rv) 316 goto next; 317 ip = mtod(m = m0, struct ip *); 318 } 319#endif /* PFIL_HOOKS */ 320 321 /* 322 * Process options and, if not destined for us, 323 * ship it on. ip_dooptions returns 1 when an 324 * error was detected (causing an icmp message 325 * to be sent and the original packet to be freed). 326 */ 327 ip_nhops = 0; /* for source routed packets */ 328 if (hlen > sizeof (struct ip) && ip_dooptions(m)) 329 goto next; 330 331 /* 332 * Check our list of addresses, to see if the packet is for us. 333 */ 334 INADDR_TO_IA(ip->ip_dst, ia); 335 if (ia != NULL) goto ours; 336 if (m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) { 337 for (ifa = m->m_pkthdr.rcvif->if_addrlist.tqh_first; 338 ifa != NULL; ifa = ifa->ifa_list.tqe_next) { 339 if (ifa->ifa_addr->sa_family != AF_INET) continue; 340 ia = ifatoia(ifa); 341 if (in_hosteq(ip->ip_dst, ia->ia_broadaddr.sin_addr) || 342 in_hosteq(ip->ip_dst, ia->ia_netbroadcast) || 343 /* 344 * Look for all-0's host part (old broadcast addr), 345 * either for subnet or net. 346 */ 347 ip->ip_dst.s_addr == ia->ia_subnet || 348 ip->ip_dst.s_addr == ia->ia_net) 349 goto ours; 350 /* 351 * An interface with IP address zero accepts 352 * all packets that arrive on that interface. 353 */ 354 if (in_nullhost(ia->ia_addr.sin_addr)) 355 goto ours; 356 } 357 } 358 if (IN_MULTICAST(ip->ip_dst.s_addr)) { 359 struct in_multi *inm; 360#ifdef MROUTING 361 extern struct socket *ip_mrouter; 362 363 if (m->m_flags & M_EXT) { 364 if ((m = m_pullup(m, hlen)) == 0) { 365 ipstat.ips_toosmall++; 366 goto next; 367 } 368 ip = mtod(m, struct ip *); 369 } 370 371 if (ip_mrouter) { 372 /* 373 * If we are acting as a multicast router, all 374 * incoming multicast packets are passed to the 375 * kernel-level multicast forwarding function. 376 * The packet is returned (relatively) intact; if 377 * ip_mforward() returns a non-zero value, the packet 378 * must be discarded, else it may be accepted below. 379 * 380 * (The IP ident field is put in the same byte order 381 * as expected when ip_mforward() is called from 382 * ip_output().) 383 */ 384 ip->ip_id = htons(ip->ip_id); 385 if (ip_mforward(m, m->m_pkthdr.rcvif) != 0) { 386 ipstat.ips_cantforward++; 387 m_freem(m); 388 goto next; 389 } 390 ip->ip_id = ntohs(ip->ip_id); 391 392 /* 393 * The process-level routing demon needs to receive 394 * all multicast IGMP packets, whether or not this 395 * host belongs to their destination groups. 396 */ 397 if (ip->ip_p == IPPROTO_IGMP) 398 goto ours; 399 ipstat.ips_forward++; 400 } 401#endif 402 /* 403 * See if we belong to the destination multicast group on the 404 * arrival interface. 405 */ 406 IN_LOOKUP_MULTI(ip->ip_dst, m->m_pkthdr.rcvif, inm); 407 if (inm == NULL) { 408 ipstat.ips_cantforward++; 409 m_freem(m); 410 goto next; 411 } 412 goto ours; 413 } 414 if (ip->ip_dst.s_addr == INADDR_BROADCAST || 415 in_nullhost(ip->ip_dst)) 416 goto ours; 417 418 /* 419 * Not for us; forward if possible and desirable. 420 */ 421 if (ipforwarding == 0) { 422 ipstat.ips_cantforward++; 423 m_freem(m); 424 } else 425 ip_forward(m, 0); 426 goto next; 427 428ours: 429 /* 430 * If offset or IP_MF are set, must reassemble. 431 * Otherwise, nothing need be done. 432 * (We could look in the reassembly queue to see 433 * if the packet was previously fragmented, 434 * but it's not worth the time; just let them time out.) 435 */ 436 if (ip->ip_off & ~(IP_DF|IP_RF)) { 437 /* 438 * Look for queue of fragments 439 * of this datagram. 440 */ 441 for (fp = ipq.lh_first; fp != NULL; fp = fp->ipq_q.le_next) 442 if (ip->ip_id == fp->ipq_id && 443 in_hosteq(ip->ip_src, fp->ipq_src) && 444 in_hosteq(ip->ip_dst, fp->ipq_dst) && 445 ip->ip_p == fp->ipq_p) 446 goto found; 447 fp = 0; 448found: 449 450 /* 451 * Adjust ip_len to not reflect header, 452 * set ipqe_mff if more fragments are expected, 453 * convert offset of this to bytes. 454 */ 455 ip->ip_len -= hlen; 456 mff = (ip->ip_off & IP_MF) != 0; 457 if (mff) { 458 /* 459 * Make sure that fragments have a data length 460 * that's a non-zero multiple of 8 bytes. 461 */ 462 if (ip->ip_len == 0 || (ip->ip_len & 0x7) != 0) { 463 ipstat.ips_badfrags++; 464 goto bad; 465 } 466 } 467 ip->ip_off <<= 3; 468 469 /* 470 * If datagram marked as having more fragments 471 * or if this is not the first fragment, 472 * attempt reassembly; if it succeeds, proceed. 473 */ 474 if (mff || ip->ip_off) { 475 ipstat.ips_fragments++; 476 MALLOC(ipqe, struct ipqent *, sizeof (struct ipqent), 477 M_IPQ, M_NOWAIT); 478 if (ipqe == NULL) { 479 ipstat.ips_rcvmemdrop++; 480 goto bad; 481 } 482 ipqe->ipqe_mff = mff; 483 ipqe->ipqe_m = m; 484 ipqe->ipqe_ip = ip; 485 m = ip_reass(ipqe, fp); 486 if (m == 0) 487 goto next; 488 ipstat.ips_reassembled++; 489 ip = mtod(m, struct ip *); 490 } else 491 if (fp) 492 ip_freef(fp); 493 } else 494 ip->ip_len -= hlen; 495 496 /* 497 * Switch out to protocol's input routine. 498 */ 499 ipstat.ips_delivered++; 500 (*inetsw[ip_protox[ip->ip_p]].pr_input)(m, hlen); 501 goto next; 502bad: 503 m_freem(m); 504 goto next; 505} 506 507/* 508 * Take incoming datagram fragment and try to 509 * reassemble it into whole datagram. If a chain for 510 * reassembly of this datagram already exists, then it 511 * is given as fp; otherwise have to make a chain. 512 */ 513struct mbuf * 514ip_reass(ipqe, fp) 515 register struct ipqent *ipqe; 516 register struct ipq *fp; 517{ 518 register struct mbuf *m = ipqe->ipqe_m; 519 register struct ipqent *nq, *p, *q; 520 struct ip *ip; 521 struct mbuf *t; 522 int hlen = ipqe->ipqe_ip->ip_hl << 2; 523 int i, next; 524 525 /* 526 * Presence of header sizes in mbufs 527 * would confuse code below. 528 */ 529 m->m_data += hlen; 530 m->m_len -= hlen; 531 532 /* 533 * If first fragment to arrive, create a reassembly queue. 534 */ 535 if (fp == 0) { 536 MALLOC(fp, struct ipq *, sizeof (struct ipq), 537 M_FTABLE, M_NOWAIT); 538 if (fp == NULL) 539 goto dropfrag; 540 LIST_INSERT_HEAD(&ipq, fp, ipq_q); 541 fp->ipq_ttl = IPFRAGTTL; 542 fp->ipq_p = ipqe->ipqe_ip->ip_p; 543 fp->ipq_id = ipqe->ipqe_ip->ip_id; 544 LIST_INIT(&fp->ipq_fragq); 545 fp->ipq_src = ipqe->ipqe_ip->ip_src; 546 fp->ipq_dst = ipqe->ipqe_ip->ip_dst; 547 p = NULL; 548 goto insert; 549 } 550 551 /* 552 * Find a segment which begins after this one does. 553 */ 554 for (p = NULL, q = fp->ipq_fragq.lh_first; q != NULL; 555 p = q, q = q->ipqe_q.le_next) 556 if (q->ipqe_ip->ip_off > ipqe->ipqe_ip->ip_off) 557 break; 558 559 /* 560 * If there is a preceding segment, it may provide some of 561 * our data already. If so, drop the data from the incoming 562 * segment. If it provides all of our data, drop us. 563 */ 564 if (p != NULL) { 565 i = p->ipqe_ip->ip_off + p->ipqe_ip->ip_len - 566 ipqe->ipqe_ip->ip_off; 567 if (i > 0) { 568 if (i >= ipqe->ipqe_ip->ip_len) 569 goto dropfrag; 570 m_adj(ipqe->ipqe_m, i); 571 ipqe->ipqe_ip->ip_off += i; 572 ipqe->ipqe_ip->ip_len -= i; 573 } 574 } 575 576 /* 577 * While we overlap succeeding segments trim them or, 578 * if they are completely covered, dequeue them. 579 */ 580 for (; q != NULL && ipqe->ipqe_ip->ip_off + ipqe->ipqe_ip->ip_len > 581 q->ipqe_ip->ip_off; q = nq) { 582 i = (ipqe->ipqe_ip->ip_off + ipqe->ipqe_ip->ip_len) - 583 q->ipqe_ip->ip_off; 584 if (i < q->ipqe_ip->ip_len) { 585 q->ipqe_ip->ip_len -= i; 586 q->ipqe_ip->ip_off += i; 587 m_adj(q->ipqe_m, i); 588 break; 589 } 590 nq = q->ipqe_q.le_next; 591 m_freem(q->ipqe_m); 592 LIST_REMOVE(q, ipqe_q); 593 FREE(q, M_IPQ); 594 } 595 596insert: 597 /* 598 * Stick new segment in its place; 599 * check for complete reassembly. 600 */ 601 if (p == NULL) { 602 LIST_INSERT_HEAD(&fp->ipq_fragq, ipqe, ipqe_q); 603 } else { 604 LIST_INSERT_AFTER(p, ipqe, ipqe_q); 605 } 606 next = 0; 607 for (p = NULL, q = fp->ipq_fragq.lh_first; q != NULL; 608 p = q, q = q->ipqe_q.le_next) { 609 if (q->ipqe_ip->ip_off != next) 610 return (0); 611 next += q->ipqe_ip->ip_len; 612 } 613 if (p->ipqe_mff) 614 return (0); 615 616 /* 617 * Reassembly is complete. Check for a bogus message size and 618 * concatenate fragments. 619 */ 620 q = fp->ipq_fragq.lh_first; 621 ip = q->ipqe_ip; 622 if ((next + (ip->ip_hl << 2)) > IP_MAXPACKET) { 623 ipstat.ips_toolong++; 624 ip_freef(fp); 625 return (0); 626 } 627 m = q->ipqe_m; 628 t = m->m_next; 629 m->m_next = 0; 630 m_cat(m, t); 631 nq = q->ipqe_q.le_next; 632 FREE(q, M_IPQ); 633 for (q = nq; q != NULL; q = nq) { 634 t = q->ipqe_m; 635 nq = q->ipqe_q.le_next; 636 FREE(q, M_IPQ); 637 m_cat(m, t); 638 } 639 640 /* 641 * Create header for new ip packet by 642 * modifying header of first packet; 643 * dequeue and discard fragment reassembly header. 644 * Make header visible. 645 */ 646 ip->ip_len = next; 647 ip->ip_src = fp->ipq_src; 648 ip->ip_dst = fp->ipq_dst; 649 LIST_REMOVE(fp, ipq_q); 650 FREE(fp, M_FTABLE); 651 m->m_len += (ip->ip_hl << 2); 652 m->m_data -= (ip->ip_hl << 2); 653 /* some debugging cruft by sklower, below, will go away soon */ 654 if (m->m_flags & M_PKTHDR) { /* XXX this should be done elsewhere */ 655 register int plen = 0; 656 for (t = m; t; t = t->m_next) 657 plen += t->m_len; 658 m->m_pkthdr.len = plen; 659 } 660 return (m); 661 662dropfrag: 663 ipstat.ips_fragdropped++; 664 m_freem(m); 665 FREE(ipqe, M_IPQ); 666 return (0); 667} 668 669/* 670 * Free a fragment reassembly header and all 671 * associated datagrams. 672 */ 673void 674ip_freef(fp) 675 struct ipq *fp; 676{ 677 register struct ipqent *q, *p; 678 679 for (q = fp->ipq_fragq.lh_first; q != NULL; q = p) { 680 p = q->ipqe_q.le_next; 681 m_freem(q->ipqe_m); 682 LIST_REMOVE(q, ipqe_q); 683 FREE(q, M_IPQ); 684 } 685 LIST_REMOVE(fp, ipq_q); 686 FREE(fp, M_FTABLE); 687} 688 689/* 690 * IP timer processing; 691 * if a timer expires on a reassembly 692 * queue, discard it. 693 */ 694void 695ip_slowtimo() 696{ 697 register struct ipq *fp, *nfp; 698 int s = splsoftnet(); 699 700 for (fp = ipq.lh_first; fp != NULL; fp = nfp) { 701 nfp = fp->ipq_q.le_next; 702 if (--fp->ipq_ttl == 0) { 703 ipstat.ips_fragtimeout++; 704 ip_freef(fp); 705 } 706 } 707 splx(s); 708} 709 710/* 711 * Drain off all datagram fragments. 712 */ 713void 714ip_drain() 715{ 716 717 while (ipq.lh_first != NULL) { 718 ipstat.ips_fragdropped++; 719 ip_freef(ipq.lh_first); 720 } 721} 722 723/* 724 * Do option processing on a datagram, 725 * possibly discarding it if bad options are encountered, 726 * or forwarding it if source-routed. 727 * Returns 1 if packet has been forwarded/freed, 728 * 0 if the packet should be processed further. 729 */ 730int 731ip_dooptions(m) 732 struct mbuf *m; 733{ 734 register struct ip *ip = mtod(m, struct ip *); 735 register u_char *cp; 736 register struct ip_timestamp *ipt; 737 register struct in_ifaddr *ia; 738 int opt, optlen, cnt, off, code, type = ICMP_PARAMPROB, forward = 0; 739 struct in_addr *sin, dst; 740 n_time ntime; 741 742 dst = ip->ip_dst; 743 cp = (u_char *)(ip + 1); 744 cnt = (ip->ip_hl << 2) - sizeof (struct ip); 745 for (; cnt > 0; cnt -= optlen, cp += optlen) { 746 opt = cp[IPOPT_OPTVAL]; 747 if (opt == IPOPT_EOL) 748 break; 749 if (opt == IPOPT_NOP) 750 optlen = 1; 751 else { 752 optlen = cp[IPOPT_OLEN]; 753 if (optlen <= 0 || optlen > cnt) { 754 code = &cp[IPOPT_OLEN] - (u_char *)ip; 755 goto bad; 756 } 757 } 758 switch (opt) { 759 760 default: 761 break; 762 763 /* 764 * Source routing with record. 765 * Find interface with current destination address. 766 * If none on this machine then drop if strictly routed, 767 * or do nothing if loosely routed. 768 * Record interface address and bring up next address 769 * component. If strictly routed make sure next 770 * address is on directly accessible net. 771 */ 772 case IPOPT_LSRR: 773 case IPOPT_SSRR: 774 if (ip_allowsrcrt == 0) { 775 type = ICMP_UNREACH; 776 code = ICMP_UNREACH_NET_PROHIB; 777 goto bad; 778 } 779 if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) { 780 code = &cp[IPOPT_OFFSET] - (u_char *)ip; 781 goto bad; 782 } 783 ipaddr.sin_addr = ip->ip_dst; 784 ia = ifatoia(ifa_ifwithaddr(sintosa(&ipaddr))); 785 if (ia == 0) { 786 if (opt == IPOPT_SSRR) { 787 type = ICMP_UNREACH; 788 code = ICMP_UNREACH_SRCFAIL; 789 goto bad; 790 } 791 /* 792 * Loose routing, and not at next destination 793 * yet; nothing to do except forward. 794 */ 795 break; 796 } 797 off--; /* 0 origin */ 798 if (off > optlen - sizeof(struct in_addr)) { 799 /* 800 * End of source route. Should be for us. 801 */ 802 save_rte(cp, ip->ip_src); 803 break; 804 } 805 /* 806 * locate outgoing interface 807 */ 808 bcopy((caddr_t)(cp + off), (caddr_t)&ipaddr.sin_addr, 809 sizeof(ipaddr.sin_addr)); 810 if (opt == IPOPT_SSRR) { 811#define INA struct in_ifaddr * 812#define SA struct sockaddr * 813 ia = (INA)ifa_ifwithladdr((SA)&ipaddr); 814 } else 815 ia = ip_rtaddr(ipaddr.sin_addr); 816 if (ia == 0) { 817 type = ICMP_UNREACH; 818 code = ICMP_UNREACH_SRCFAIL; 819 goto bad; 820 } 821 ip->ip_dst = ipaddr.sin_addr; 822 bcopy((caddr_t)&ia->ia_addr.sin_addr, 823 (caddr_t)(cp + off), sizeof(struct in_addr)); 824 cp[IPOPT_OFFSET] += sizeof(struct in_addr); 825 /* 826 * Let ip_intr's mcast routing check handle mcast pkts 827 */ 828 forward = !IN_MULTICAST(ip->ip_dst.s_addr); 829 break; 830 831 case IPOPT_RR: 832 if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) { 833 code = &cp[IPOPT_OFFSET] - (u_char *)ip; 834 goto bad; 835 } 836 /* 837 * If no space remains, ignore. 838 */ 839 off--; /* 0 origin */ 840 if (off > optlen - sizeof(struct in_addr)) 841 break; 842 bcopy((caddr_t)(&ip->ip_dst), (caddr_t)&ipaddr.sin_addr, 843 sizeof(ipaddr.sin_addr)); 844 /* 845 * locate outgoing interface; if we're the destination, 846 * use the incoming interface (should be same). 847 */ 848 if ((ia = (INA)ifa_ifwithaddr((SA)&ipaddr)) == 0 && 849 (ia = ip_rtaddr(ipaddr.sin_addr)) == 0) { 850 type = ICMP_UNREACH; 851 code = ICMP_UNREACH_HOST; 852 goto bad; 853 } 854 bcopy((caddr_t)&ia->ia_addr.sin_addr, 855 (caddr_t)(cp + off), sizeof(struct in_addr)); 856 cp[IPOPT_OFFSET] += sizeof(struct in_addr); 857 break; 858 859 case IPOPT_TS: 860 code = cp - (u_char *)ip; 861 ipt = (struct ip_timestamp *)cp; 862 if (ipt->ipt_len < 5) 863 goto bad; 864 if (ipt->ipt_ptr > ipt->ipt_len - sizeof (int32_t)) { 865 if (++ipt->ipt_oflw == 0) 866 goto bad; 867 break; 868 } 869 sin = (struct in_addr *)(cp + ipt->ipt_ptr - 1); 870 switch (ipt->ipt_flg) { 871 872 case IPOPT_TS_TSONLY: 873 break; 874 875 case IPOPT_TS_TSANDADDR: 876 if (ipt->ipt_ptr + sizeof(n_time) + 877 sizeof(struct in_addr) > ipt->ipt_len) 878 goto bad; 879 ipaddr.sin_addr = dst; 880 ia = (INA)ifaof_ifpforaddr((SA)&ipaddr, 881 m->m_pkthdr.rcvif); 882 if (ia == 0) 883 continue; 884 bcopy((caddr_t)&ia->ia_addr.sin_addr, 885 (caddr_t)sin, sizeof(struct in_addr)); 886 ipt->ipt_ptr += sizeof(struct in_addr); 887 break; 888 889 case IPOPT_TS_PRESPEC: 890 if (ipt->ipt_ptr + sizeof(n_time) + 891 sizeof(struct in_addr) > ipt->ipt_len) 892 goto bad; 893 bcopy((caddr_t)sin, (caddr_t)&ipaddr.sin_addr, 894 sizeof(struct in_addr)); 895 if (ifa_ifwithaddr((SA)&ipaddr) == 0) 896 continue; 897 ipt->ipt_ptr += sizeof(struct in_addr); 898 break; 899 900 default: 901 goto bad; 902 } 903 ntime = iptime(); 904 bcopy((caddr_t)&ntime, (caddr_t)cp + ipt->ipt_ptr - 1, 905 sizeof(n_time)); 906 ipt->ipt_ptr += sizeof(n_time); 907 } 908 } 909 if (forward) { 910 if (ip_forwsrcrt == 0) { 911 type = ICMP_UNREACH; 912 code = ICMP_UNREACH_SRCFAIL; 913 goto bad; 914 } 915 ip_forward(m, 1); 916 return (1); 917 } 918 return (0); 919bad: 920 ip->ip_len -= ip->ip_hl << 2; /* XXX icmp_error adds in hdr length */ 921 icmp_error(m, type, code, 0, 0); 922 ipstat.ips_badoptions++; 923 return (1); 924} 925 926/* 927 * Given address of next destination (final or next hop), 928 * return internet address info of interface to be used to get there. 929 */ 930struct in_ifaddr * 931ip_rtaddr(dst) 932 struct in_addr dst; 933{ 934 register struct sockaddr_in *sin; 935 936 sin = satosin(&ipforward_rt.ro_dst); 937 938 if (ipforward_rt.ro_rt == 0 || !in_hosteq(dst, sin->sin_addr)) { 939 if (ipforward_rt.ro_rt) { 940 RTFREE(ipforward_rt.ro_rt); 941 ipforward_rt.ro_rt = 0; 942 } 943 sin->sin_family = AF_INET; 944 sin->sin_len = sizeof(*sin); 945 sin->sin_addr = dst; 946 947 rtalloc(&ipforward_rt); 948 } 949 if (ipforward_rt.ro_rt == 0) 950 return ((struct in_ifaddr *)0); 951 return (ifatoia(ipforward_rt.ro_rt->rt_ifa)); 952} 953 954/* 955 * Save incoming source route for use in replies, 956 * to be picked up later by ip_srcroute if the receiver is interested. 957 */ 958void 959save_rte(option, dst) 960 u_char *option; 961 struct in_addr dst; 962{ 963 unsigned olen; 964 965 olen = option[IPOPT_OLEN]; 966#ifdef DIAGNOSTIC 967 if (ipprintfs) 968 printf("save_rte: olen %d\n", olen); 969#endif 970 if (olen > sizeof(ip_srcrt) - (1 + sizeof(dst))) 971 return; 972 bcopy((caddr_t)option, (caddr_t)ip_srcrt.srcopt, olen); 973 ip_nhops = (olen - IPOPT_OFFSET - 1) / sizeof(struct in_addr); 974 ip_srcrt.dst = dst; 975} 976 977/* 978 * Retrieve incoming source route for use in replies, 979 * in the same form used by setsockopt. 980 * The first hop is placed before the options, will be removed later. 981 */ 982struct mbuf * 983ip_srcroute() 984{ 985 register struct in_addr *p, *q; 986 register struct mbuf *m; 987 988 if (ip_nhops == 0) 989 return ((struct mbuf *)0); 990 m = m_get(M_DONTWAIT, MT_SOOPTS); 991 if (m == 0) 992 return ((struct mbuf *)0); 993 994#define OPTSIZ (sizeof(ip_srcrt.nop) + sizeof(ip_srcrt.srcopt)) 995 996 /* length is (nhops+1)*sizeof(addr) + sizeof(nop + srcrt header) */ 997 m->m_len = ip_nhops * sizeof(struct in_addr) + sizeof(struct in_addr) + 998 OPTSIZ; 999#ifdef DIAGNOSTIC 1000 if (ipprintfs) 1001 printf("ip_srcroute: nhops %d mlen %d", ip_nhops, m->m_len); 1002#endif 1003 1004 /* 1005 * First save first hop for return route 1006 */ 1007 p = &ip_srcrt.route[ip_nhops - 1]; 1008 *(mtod(m, struct in_addr *)) = *p--; 1009#ifdef DIAGNOSTIC 1010 if (ipprintfs) 1011 printf(" hops %x", ntohl(mtod(m, struct in_addr *)->s_addr)); 1012#endif 1013 1014 /* 1015 * Copy option fields and padding (nop) to mbuf. 1016 */ 1017 ip_srcrt.nop = IPOPT_NOP; 1018 ip_srcrt.srcopt[IPOPT_OFFSET] = IPOPT_MINOFF; 1019 bcopy((caddr_t)&ip_srcrt.nop, 1020 mtod(m, caddr_t) + sizeof(struct in_addr), OPTSIZ); 1021 q = (struct in_addr *)(mtod(m, caddr_t) + 1022 sizeof(struct in_addr) + OPTSIZ); 1023#undef OPTSIZ 1024 /* 1025 * Record return path as an IP source route, 1026 * reversing the path (pointers are now aligned). 1027 */ 1028 while (p >= ip_srcrt.route) { 1029#ifdef DIAGNOSTIC 1030 if (ipprintfs) 1031 printf(" %x", ntohl(q->s_addr)); 1032#endif 1033 *q++ = *p--; 1034 } 1035 /* 1036 * Last hop goes to final destination. 1037 */ 1038 *q = ip_srcrt.dst; 1039#ifdef DIAGNOSTIC 1040 if (ipprintfs) 1041 printf(" %x\n", ntohl(q->s_addr)); 1042#endif 1043 return (m); 1044} 1045 1046/* 1047 * Strip out IP options, at higher 1048 * level protocol in the kernel. 1049 * Second argument is buffer to which options 1050 * will be moved, and return value is their length. 1051 * XXX should be deleted; last arg currently ignored. 1052 */ 1053void 1054ip_stripoptions(m, mopt) 1055 register struct mbuf *m; 1056 struct mbuf *mopt; 1057{ 1058 register int i; 1059 struct ip *ip = mtod(m, struct ip *); 1060 register caddr_t opts; 1061 int olen; 1062 1063 olen = (ip->ip_hl<<2) - sizeof (struct ip); 1064 opts = (caddr_t)(ip + 1); 1065 i = m->m_len - (sizeof (struct ip) + olen); 1066 bcopy(opts + olen, opts, (unsigned)i); 1067 m->m_len -= olen; 1068 if (m->m_flags & M_PKTHDR) 1069 m->m_pkthdr.len -= olen; 1070 ip->ip_hl = sizeof(struct ip) >> 2; 1071} 1072 1073int inetctlerrmap[PRC_NCMDS] = { 1074 0, 0, 0, 0, 1075 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, 1076 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, 1077 EMSGSIZE, EHOSTUNREACH, 0, 0, 1078 0, 0, 0, 0, 1079 ENOPROTOOPT 1080}; 1081 1082/* 1083 * Forward a packet. If some error occurs return the sender 1084 * an icmp packet. Note we can't always generate a meaningful 1085 * icmp message because icmp doesn't have a large enough repertoire 1086 * of codes and types. 1087 * 1088 * If not forwarding, just drop the packet. This could be confusing 1089 * if ipforwarding was zero but some routing protocol was advancing 1090 * us as a gateway to somewhere. However, we must let the routing 1091 * protocol deal with that. 1092 * 1093 * The srcrt parameter indicates whether the packet is being forwarded 1094 * via a source route. 1095 */ 1096void 1097ip_forward(m, srcrt) 1098 struct mbuf *m; 1099 int srcrt; 1100{ 1101 register struct ip *ip = mtod(m, struct ip *); 1102 register struct sockaddr_in *sin; 1103 register struct rtentry *rt; 1104 int error, type = 0, code = 0; 1105 struct mbuf *mcopy; 1106 n_long dest; 1107 struct ifnet *destifp; 1108 1109 dest = 0; 1110#ifdef DIAGNOSTIC 1111 if (ipprintfs) 1112 printf("forward: src %x dst %x ttl %x\n", 1113 ip->ip_src.s_addr, ip->ip_dst.s_addr, ip->ip_ttl); 1114#endif 1115 if (m->m_flags & M_BCAST || in_canforward(ip->ip_dst) == 0) { 1116 ipstat.ips_cantforward++; 1117 m_freem(m); 1118 return; 1119 } 1120 HTONS(ip->ip_id); 1121 if (ip->ip_ttl <= IPTTLDEC) { 1122 icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, dest, 0); 1123 return; 1124 } 1125 ip->ip_ttl -= IPTTLDEC; 1126 1127 sin = satosin(&ipforward_rt.ro_dst); 1128 if ((rt = ipforward_rt.ro_rt) == 0 || 1129 !in_hosteq(ip->ip_dst, sin->sin_addr)) { 1130 if (ipforward_rt.ro_rt) { 1131 RTFREE(ipforward_rt.ro_rt); 1132 ipforward_rt.ro_rt = 0; 1133 } 1134 sin->sin_family = AF_INET; 1135 sin->sin_len = sizeof(struct sockaddr_in); 1136 sin->sin_addr = ip->ip_dst; 1137 1138 rtalloc(&ipforward_rt); 1139 if (ipforward_rt.ro_rt == 0) { 1140 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, dest, 0); 1141 return; 1142 } 1143 rt = ipforward_rt.ro_rt; 1144 } 1145 1146 /* 1147 * Save at most 68 bytes of the packet in case 1148 * we need to generate an ICMP message to the src. 1149 */ 1150 mcopy = m_copy(m, 0, imin((int)ip->ip_len, 68)); 1151 1152 /* 1153 * If forwarding packet using same interface that it came in on, 1154 * perhaps should send a redirect to sender to shortcut a hop. 1155 * Only send redirect if source is sending directly to us, 1156 * and if packet was not source routed (or has any options). 1157 * Also, don't send redirect if forwarding using a default route 1158 * or a route modified by a redirect. 1159 */ 1160 if (rt->rt_ifp == m->m_pkthdr.rcvif && 1161 (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0 && 1162 !in_nullhost(satosin(rt_key(rt))->sin_addr) && 1163 ipsendredirects && !srcrt) { 1164 if (rt->rt_ifa && 1165 (ip->ip_src.s_addr & ifatoia(rt->rt_ifa)->ia_subnetmask) == 1166 ifatoia(rt->rt_ifa)->ia_subnet) { 1167 if (rt->rt_flags & RTF_GATEWAY) 1168 dest = satosin(rt->rt_gateway)->sin_addr.s_addr; 1169 else 1170 dest = ip->ip_dst.s_addr; 1171 /* Router requirements says to only send host redirects */ 1172 type = ICMP_REDIRECT; 1173 code = ICMP_REDIRECT_HOST; 1174#ifdef DIAGNOSTIC 1175 if (ipprintfs) 1176 printf("redirect (%d) to %x\n", code, (u_int32_t)dest); 1177#endif 1178 } 1179 } 1180 1181 error = ip_output(m, (struct mbuf *)0, &ipforward_rt, 1182 (IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)), 0); 1183 if (error) 1184 ipstat.ips_cantforward++; 1185 else { 1186 ipstat.ips_forward++; 1187 if (type) 1188 ipstat.ips_redirectsent++; 1189 else { 1190 if (mcopy) 1191 m_freem(mcopy); 1192 return; 1193 } 1194 } 1195 if (mcopy == NULL) 1196 return; 1197 destifp = NULL; 1198 1199 switch (error) { 1200 1201 case 0: /* forwarded, but need redirect */ 1202 /* type, code set above */ 1203 break; 1204 1205 case ENETUNREACH: /* shouldn't happen, checked above */ 1206 case EHOSTUNREACH: 1207 case ENETDOWN: 1208 case EHOSTDOWN: 1209 default: 1210 type = ICMP_UNREACH; 1211 code = ICMP_UNREACH_HOST; 1212 break; 1213 1214 case EMSGSIZE: 1215 type = ICMP_UNREACH; 1216 code = ICMP_UNREACH_NEEDFRAG; 1217 if (ipforward_rt.ro_rt) 1218 destifp = ipforward_rt.ro_rt->rt_ifp; 1219 ipstat.ips_cantfrag++; 1220 break; 1221 1222 case ENOBUFS: 1223 type = ICMP_SOURCEQUENCH; 1224 code = 0; 1225 break; 1226 } 1227 icmp_error(mcopy, type, code, dest, destifp); 1228} 1229 1230void 1231ip_savecontrol(inp, mp, ip, m) 1232 register struct inpcb *inp; 1233 register struct mbuf **mp; 1234 register struct ip *ip; 1235 register struct mbuf *m; 1236{ 1237 1238 if (inp->inp_socket->so_options & SO_TIMESTAMP) { 1239 struct timeval tv; 1240 1241 microtime(&tv); 1242 *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv), 1243 SCM_TIMESTAMP, SOL_SOCKET); 1244 if (*mp) 1245 mp = &(*mp)->m_next; 1246 } 1247 if (inp->inp_flags & INP_RECVDSTADDR) { 1248 *mp = sbcreatecontrol((caddr_t) &ip->ip_dst, 1249 sizeof(struct in_addr), IP_RECVDSTADDR, IPPROTO_IP); 1250 if (*mp) 1251 mp = &(*mp)->m_next; 1252 } 1253#ifdef notyet 1254 /* 1255 * XXX 1256 * Moving these out of udp_input() made them even more broken 1257 * than they already were. 1258 * - fenner@parc.xerox.com 1259 */ 1260 /* options were tossed already */ 1261 if (inp->inp_flags & INP_RECVOPTS) { 1262 *mp = sbcreatecontrol((caddr_t) opts_deleted_above, 1263 sizeof(struct in_addr), IP_RECVOPTS, IPPROTO_IP); 1264 if (*mp) 1265 mp = &(*mp)->m_next; 1266 } 1267 /* ip_srcroute doesn't do what we want here, need to fix */ 1268 if (inp->inp_flags & INP_RECVRETOPTS) { 1269 *mp = sbcreatecontrol((caddr_t) ip_srcroute(), 1270 sizeof(struct in_addr), IP_RECVRETOPTS, IPPROTO_IP); 1271 if (*mp) 1272 mp = &(*mp)->m_next; 1273 } 1274#endif 1275 if (inp->inp_flags & INP_RECVIF) { 1276 struct sockaddr_dl sdl; 1277 1278 sdl.sdl_len = offsetof(struct sockaddr_dl, sdl_data[0]); 1279 sdl.sdl_family = AF_LINK; 1280 sdl.sdl_index = m->m_pkthdr.rcvif ? 1281 m->m_pkthdr.rcvif->if_index : 0; 1282 sdl.sdl_nlen = sdl.sdl_alen = sdl.sdl_slen = 0; 1283 *mp = sbcreatecontrol((caddr_t) &sdl, sdl.sdl_len, 1284 IP_RECVIF, IPPROTO_IP); 1285 if (*mp) 1286 mp = &(*mp)->m_next; 1287 } 1288} 1289 1290int 1291ip_sysctl(name, namelen, oldp, oldlenp, newp, newlen) 1292 int *name; 1293 u_int namelen; 1294 void *oldp; 1295 size_t *oldlenp; 1296 void *newp; 1297 size_t newlen; 1298{ 1299 extern int subnetsarelocal; 1300 1301 int error, old; 1302 1303 /* All sysctl names at this level are terminal. */ 1304 if (namelen != 1) 1305 return (ENOTDIR); 1306 1307 switch (name[0]) { 1308 case IPCTL_FORWARDING: 1309 return (sysctl_int(oldp, oldlenp, newp, newlen, &ipforwarding)); 1310 case IPCTL_SENDREDIRECTS: 1311 return (sysctl_int(oldp, oldlenp, newp, newlen, 1312 &ipsendredirects)); 1313 case IPCTL_DEFTTL: 1314 return (sysctl_int(oldp, oldlenp, newp, newlen, &ip_defttl)); 1315#ifdef notyet 1316 case IPCTL_DEFMTU: 1317 return (sysctl_int(oldp, oldlenp, newp, newlen, &ip_mtu)); 1318#endif 1319 case IPCTL_FORWSRCRT: 1320 /* Don't allow this to change in a secure environment. */ 1321 if (securelevel > 0) 1322 return (sysctl_rdint(oldp, oldlenp, newp, 1323 ip_forwsrcrt)); 1324 else 1325 return (sysctl_int(oldp, oldlenp, newp, newlen, 1326 &ip_forwsrcrt)); 1327 case IPCTL_DIRECTEDBCAST: 1328 return (sysctl_int(oldp, oldlenp, newp, newlen, 1329 &ip_directedbcast)); 1330 case IPCTL_ALLOWSRCRT: 1331 return (sysctl_int(oldp, oldlenp, newp, newlen, 1332 &ip_allowsrcrt)); 1333 case IPCTL_SUBNETSARELOCAL: 1334 return (sysctl_int(oldp, oldlenp, newp, newlen, 1335 &subnetsarelocal)); 1336 case IPCTL_MTUDISC: 1337 error = sysctl_int(oldp, oldlenp, newp, newlen, 1338 &ip_mtudisc); 1339 if (ip_mtudisc != 0 && ip_mtudisc_timeout_q == NULL) { 1340 ip_mtudisc_timeout_q = 1341 rt_timer_queue_create(ip_mtudisc_timeout); 1342 } else if (ip_mtudisc == 0 && ip_mtudisc_timeout_q != NULL) { 1343 rt_timer_queue_destroy(ip_mtudisc_timeout_q, TRUE); 1344 ip_mtudisc_timeout_q = NULL; 1345 } 1346 return error; 1347 case IPCTL_ANONPORTMIN: 1348 old = anonportmin; 1349 error = sysctl_int(oldp, oldlenp, newp, newlen, &anonportmin); 1350 if (anonportmin >= anonportmax || anonportmin > 65535 1351#ifndef IPNOPRIVPORTS 1352 || anonportmin < IPPORT_RESERVED 1353#endif 1354 ) { 1355 anonportmin = old; 1356 return (EINVAL); 1357 } 1358 return (error); 1359 case IPCTL_ANONPORTMAX: 1360 old = anonportmax; 1361 error = sysctl_int(oldp, oldlenp, newp, newlen, &anonportmax); 1362 if (anonportmin >= anonportmax || anonportmax > 65535 1363#ifndef IPNOPRIVPORTS 1364 || anonportmax < IPPORT_RESERVED 1365#endif 1366 ) { 1367 anonportmax = old; 1368 return (EINVAL); 1369 } 1370 return (error); 1371 case IPCTL_MTUDISCTIMEOUT: 1372 error = sysctl_int(oldp, oldlenp, newp, newlen, 1373 &ip_mtudisc_timeout); 1374 if (ip_mtudisc_timeout_q != NULL) 1375 rt_timer_queue_change(ip_mtudisc_timeout_q, 1376 ip_mtudisc_timeout); 1377 return (error); 1378 default: 1379 return (EOPNOTSUPP); 1380 } 1381 /* NOTREACHED */ 1382} 1383