xref: /dragonfly/sys/netinet/ip_input.c (revision b272101a)
1 /*
2  * Copyright (c) 2003, 2004 Jeffrey M. Hsu.  All rights reserved.
3  * Copyright (c) 2003, 2004 The DragonFly Project.  All rights reserved.
4  *
5  * This code is derived from software contributed to The DragonFly Project
6  * by Jeffrey M. Hsu.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of The DragonFly Project nor the names of its
17  *    contributors may be used to endorse or promote products derived
18  *    from this software without specific, prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
24  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
30  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 /*
35  * Copyright (c) 1982, 1986, 1988, 1993
36  *	The Regents of the University of California.  All rights reserved.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  * 3. Neither the name of the University nor the names of its contributors
47  *    may be used to endorse or promote products derived from this software
48  *    without specific prior written permission.
49  *
50  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60  * SUCH DAMAGE.
61  *
62  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
63  * $FreeBSD: src/sys/netinet/ip_input.c,v 1.130.2.52 2003/03/07 07:01:28 silby Exp $
64  */
65 
66 #define	_IP_VHL
67 
68 #include "opt_bootp.h"
69 #include "opt_ipdn.h"
70 #include "opt_ipdivert.h"
71 #include "opt_ipstealth.h"
72 #include "opt_rss.h"
73 
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/mbuf.h>
77 #include <sys/malloc.h>
78 #include <sys/mpipe.h>
79 #include <sys/domain.h>
80 #include <sys/protosw.h>
81 #include <sys/socket.h>
82 #include <sys/time.h>
83 #include <sys/globaldata.h>
84 #include <sys/thread.h>
85 #include <sys/kernel.h>
86 #include <sys/syslog.h>
87 #include <sys/sysctl.h>
88 #include <sys/in_cksum.h>
89 #include <sys/lock.h>
90 
91 #include <sys/mplock2.h>
92 
93 #include <machine/stdarg.h>
94 
95 #include <net/if.h>
96 #include <net/if_types.h>
97 #include <net/if_var.h>
98 #include <net/if_dl.h>
99 #include <net/pfil.h>
100 #include <net/route.h>
101 #include <net/netisr2.h>
102 
103 #include <netinet/in.h>
104 #include <netinet/in_systm.h>
105 #include <netinet/in_var.h>
106 #include <netinet/ip.h>
107 #include <netinet/in_pcb.h>
108 #include <netinet/ip_var.h>
109 #include <netinet/ip_icmp.h>
110 #include <netinet/ip_divert.h>
111 #include <netinet/ip_flow.h>
112 
113 #include <sys/thread2.h>
114 #include <sys/msgport2.h>
115 #include <net/netmsg2.h>
116 
117 #include <sys/socketvar.h>
118 
119 #include <net/ipfw/ip_fw.h>
120 #include <net/dummynet/ip_dummynet.h>
121 
122 __read_mostly int rsvp_on = 0;
123 __read_mostly static int ip_rsvp_on;
124 struct socket *ip_rsvpd;
125 
126 __read_mostly int ipforwarding = 0;
127 SYSCTL_INT(_net_inet_ip, IPCTL_FORWARDING, forwarding, CTLFLAG_RW,
128     &ipforwarding, 0, "Enable IP forwarding between interfaces");
129 
130 __read_mostly static int ipsendredirects = 1; /* XXX */
131 SYSCTL_INT(_net_inet_ip, IPCTL_SENDREDIRECTS, redirect, CTLFLAG_RW,
132     &ipsendredirects, 0, "Enable sending IP redirects");
133 
134 __read_mostly int ip_defttl = IPDEFTTL;
135 SYSCTL_INT(_net_inet_ip, IPCTL_DEFTTL, ttl, CTLFLAG_RW,
136     &ip_defttl, 0, "Maximum TTL on IP packets");
137 
138 __read_mostly static int ip_dosourceroute = 0;
139 SYSCTL_INT(_net_inet_ip, IPCTL_SOURCEROUTE, sourceroute, CTLFLAG_RW,
140     &ip_dosourceroute, 0, "Enable forwarding source routed IP packets");
141 
142 __read_mostly static int ip_acceptsourceroute = 0;
143 SYSCTL_INT(_net_inet_ip, IPCTL_ACCEPTSOURCEROUTE, accept_sourceroute,
144     CTLFLAG_RW, &ip_acceptsourceroute, 0,
145     "Enable accepting source routed IP packets");
146 
147 __read_mostly static int maxnipq;
148 SYSCTL_INT(_net_inet_ip, OID_AUTO, maxfragpackets, CTLFLAG_RW,
149     &maxnipq, 0,
150     "Maximum number of IPv4 fragment reassembly queue entries");
151 
152 __read_mostly static int maxfragsperpacket;
153 SYSCTL_INT(_net_inet_ip, OID_AUTO, maxfragsperpacket, CTLFLAG_RW,
154     &maxfragsperpacket, 0,
155     "Maximum number of IPv4 fragments allowed per packet");
156 
157 __read_mostly static int ip_sendsourcequench = 0;
158 SYSCTL_INT(_net_inet_ip, OID_AUTO, sendsourcequench, CTLFLAG_RW,
159     &ip_sendsourcequench, 0,
160     "Enable the transmission of source quench packets");
161 
162 __read_mostly int ip_do_randomid = 1;
163 SYSCTL_INT(_net_inet_ip, OID_AUTO, random_id, CTLFLAG_RW,
164     &ip_do_randomid, 0,
165     "Assign random ip_id values");
166 /*
167  * XXX - Setting ip_checkinterface mostly implements the receive side of
168  * the Strong ES model described in RFC 1122, but since the routing table
169  * and transmit implementation do not implement the Strong ES model,
170  * setting this to 1 results in an odd hybrid.
171  *
172  * XXX - ip_checkinterface currently must be disabled if you use ipnat
173  * to translate the destination address to another local interface.
174  *
175  * XXX - ip_checkinterface must be disabled if you add IP aliases
176  * to the loopback interface instead of the interface where the
177  * packets for those addresses are received.
178  */
179 __read_mostly static int ip_checkinterface = 0;
180 SYSCTL_INT(_net_inet_ip, OID_AUTO, check_interface, CTLFLAG_RW,
181     &ip_checkinterface, 0, "Verify packet arrives on correct interface");
182 
183 #ifdef RSS_DEBUG
184 static u_long ip_rehash_count = 0;
185 SYSCTL_ULONG(_net_inet_ip, OID_AUTO, rehash_count, CTLFLAG_RD,
186     &ip_rehash_count, 0, "Number of packets rehashed by IP");
187 
188 static u_long ip_dispatch_fast = 0;
189 SYSCTL_ULONG(_net_inet_ip, OID_AUTO, dispatch_fast_count, CTLFLAG_RD,
190     &ip_dispatch_fast, 0, "Number of packets handled on current CPU");
191 
192 static u_long ip_dispatch_slow = 0;
193 SYSCTL_ULONG(_net_inet_ip, OID_AUTO, dispatch_slow_count, CTLFLAG_RD,
194     &ip_dispatch_slow, 0, "Number of packets messaged to another CPU");
195 #endif
196 
197 #ifdef DIAGNOSTIC
198 static int ipprintfs = 0;
199 #endif
200 
201 extern	struct domain inetdomain;
202 extern	struct protosw inetsw[];
203 u_char	ip_protox[IPPROTO_MAX];
204 struct	in_ifaddrhead in_ifaddrheads[MAXCPU];	/* first inet address */
205 struct	in_ifaddrhashhead *in_ifaddrhashtbls[MAXCPU];
206 						/* inet addr hash table */
207 __read_mostly u_long	in_ifaddrhmask;		/* mask for hash table */
208 
209 static struct mbuf *ipforward_mtemp[MAXCPU];
210 
211 struct ip_stats ipstats_percpu[MAXCPU] __cachealign;
212 
213 static int
sysctl_ipstats(SYSCTL_HANDLER_ARGS)214 sysctl_ipstats(SYSCTL_HANDLER_ARGS)
215 {
216 	int cpu, error = 0;
217 
218 	for (cpu = 0; cpu < netisr_ncpus; ++cpu) {
219 		if ((error = SYSCTL_OUT(req, &ipstats_percpu[cpu],
220 					sizeof(struct ip_stats))))
221 			break;
222 		if ((error = SYSCTL_IN(req, &ipstats_percpu[cpu],
223 				       sizeof(struct ip_stats))))
224 			break;
225 	}
226 
227 	return (error);
228 }
229 SYSCTL_PROC(_net_inet_ip, IPCTL_STATS, stats, (CTLTYPE_OPAQUE | CTLFLAG_RW),
230     0, 0, sysctl_ipstats, "S,ip_stats", "IP statistics");
231 
232 /* Packet reassembly stuff */
233 #define	IPREASS_NHASH_LOG2	6
234 #define	IPREASS_NHASH		(1 << IPREASS_NHASH_LOG2)
235 #define	IPREASS_HMASK		(IPREASS_NHASH - 1)
236 #define	IPREASS_HASH(x,y)						\
237     (((((x) & 0xF) | ((((x) >> 8) & 0xF) << 4)) ^ (y)) & IPREASS_HMASK)
238 
239 TAILQ_HEAD(ipqhead, ipq);
240 struct ipfrag_queue {
241 	int			nipq;
242 	volatile int		draining;
243 	struct netmsg_base	timeo_netmsg;
244 	struct callout		timeo_ch;
245 	struct netmsg_base	drain_netmsg;
246 	struct ipqhead		ipq[IPREASS_NHASH];
247 } __cachealign;
248 
249 static struct ipfrag_queue	ipfrag_queue_pcpu[MAXCPU];
250 
251 #ifdef IPCTL_DEFMTU
252 SYSCTL_INT(_net_inet_ip, IPCTL_DEFMTU, mtu, CTLFLAG_RW,
253     &ip_mtu, 0, "Default MTU");
254 #endif
255 
256 #ifdef IPSTEALTH
257 static int ipstealth = 0;
258 SYSCTL_INT(_net_inet_ip, OID_AUTO, stealth, CTLFLAG_RW, &ipstealth, 0, "");
259 #else
260 static const int ipstealth = 0;
261 #endif
262 
263 struct mbuf *(*ip_divert_p)(struct mbuf *, int, int);
264 
265 struct pfil_head inet_pfil_hook;
266 
267 /*
268  * struct ip_srcrt_opt is used to store packet state while it travels
269  * through the stack.
270  *
271  * XXX Note that the code even makes assumptions on the size and
272  * alignment of fields inside struct ip_srcrt so e.g. adding some
273  * fields will break the code.  This needs to be fixed.
274  *
275  * We need to save the IP options in case a protocol wants to respond
276  * to an incoming packet over the same route if the packet got here
277  * using IP source routing.  This allows connection establishment and
278  * maintenance when the remote end is on a network that is not known
279  * to us.
280  */
281 struct ip_srcrt {
282 	struct	in_addr dst;			/* final destination */
283 	char	nop;				/* one NOP to align */
284 	char	srcopt[IPOPT_OFFSET + 1];	/* OPTVAL, OLEN and OFFSET */
285 	struct	in_addr route[MAX_IPOPTLEN/sizeof(struct in_addr)];
286 };
287 
288 struct ip_srcrt_opt {
289 	int		ip_nhops;
290 	struct ip_srcrt	ip_srcrt;
291 };
292 
293 #define IPFRAG_MPIPE_MAX	4096
294 #define MAXIPFRAG_MIN		((IPFRAG_MPIPE_MAX * 2) / 256)
295 
296 #define IPFRAG_TIMEO		(hz / PR_SLOWHZ)
297 
298 static MALLOC_DEFINE(M_IPQ, "ipq", "IP Fragment Management");
299 static struct malloc_pipe ipq_mpipe;
300 
301 static void		save_rte(struct mbuf *, u_char *, struct in_addr);
302 static int		ip_dooptions(struct mbuf *m, int, struct sockaddr_in *);
303 static void		ip_freef(struct ipfrag_queue *, struct ipqhead *,
304 			    struct ipq *);
305 static void		ip_input_handler(netmsg_t);
306 static void		ip_forward_redispatch(struct lwkt_port *port,
307 			    struct mbuf *m, boolean_t srcrt);
308 
309 static void		ipfrag_timeo_dispatch(netmsg_t);
310 static void		ipfrag_timeo(void *);
311 static void		ipfrag_drain_dispatch(netmsg_t);
312 
313 /*
314  * IP initialization: fill in IP protocol switch table.
315  * All protocols not implemented in kernel go to raw IP protocol handler.
316  */
317 void
ip_init(void)318 ip_init(void)
319 {
320 	struct ipfrag_queue *fragq;
321 	struct protosw *pr;
322 	int cpu, i;
323 
324 	/*
325 	 * Make sure we can handle a reasonable number of fragments but
326 	 * cap it at IPFRAG_MPIPE_MAX.
327 	 */
328 	mpipe_init(&ipq_mpipe, M_IPQ, sizeof(struct ipq),
329 	    IFQ_MAXLEN, IPFRAG_MPIPE_MAX, 0, NULL, NULL, NULL);
330 
331 	/*
332 	 * Make in_ifaddrhead and in_ifaddrhashtbl available on all CPUs,
333 	 * since they could be accessed by any threads.
334 	 */
335 	for (cpu = 0; cpu < ncpus; ++cpu) {
336 		TAILQ_INIT(&in_ifaddrheads[cpu]);
337 		in_ifaddrhashtbls[cpu] =
338 		    hashinit(INADDR_NHASH, M_IFADDR, &in_ifaddrhmask);
339 	}
340 
341 	pr = pffindproto(PF_INET, IPPROTO_RAW, SOCK_RAW);
342 	if (pr == NULL)
343 		panic("ip_init");
344 	for (i = 0; i < IPPROTO_MAX; i++)
345 		ip_protox[i] = pr - inetsw;
346 	for (pr = inetdomain.dom_protosw;
347 	     pr < inetdomain.dom_protoswNPROTOSW; pr++) {
348 		if (pr->pr_domain->dom_family == PF_INET && pr->pr_protocol) {
349 			if (pr->pr_protocol != IPPROTO_RAW)
350 				ip_protox[pr->pr_protocol] = pr - inetsw;
351 		}
352 	}
353 
354 	inet_pfil_hook.ph_type = PFIL_TYPE_AF;
355 	inet_pfil_hook.ph_af = AF_INET;
356 	if ((i = pfil_head_register(&inet_pfil_hook)) != 0) {
357 		kprintf("%s: WARNING: unable to register pfil hook, "
358 			"error %d\n", __func__, i);
359 	}
360 
361 	maxnipq = (nmbclusters / 32) / netisr_ncpus;
362 	if (maxnipq < MAXIPFRAG_MIN)
363 		maxnipq = MAXIPFRAG_MIN;
364 	maxfragsperpacket = 16;
365 
366 	ip_id = time_second & 0xffff;	/* time_second survives reboots */
367 
368 	for (cpu = 0; cpu < netisr_ncpus; ++cpu) {
369 		/*
370 		 * Initialize IP statistics counters for each CPU.
371 		 */
372 		bzero(&ipstats_percpu[cpu], sizeof(struct ip_stats));
373 
374 		/*
375 		 * Preallocate mbuf template for forwarding
376 		 */
377 		MGETHDR(ipforward_mtemp[cpu], M_WAITOK, MT_DATA);
378 
379 		/*
380 		 * Initialize per-cpu ip fragments queues
381 		 */
382 		fragq = &ipfrag_queue_pcpu[cpu];
383 		for (i = 0; i < IPREASS_NHASH; i++)
384 			TAILQ_INIT(&fragq->ipq[i]);
385 
386 		callout_init_mp(&fragq->timeo_ch);
387 		netmsg_init(&fragq->timeo_netmsg, NULL, &netisr_adone_rport,
388 			    MSGF_PRIORITY, ipfrag_timeo_dispatch);
389 		netmsg_init(&fragq->drain_netmsg, NULL, &netisr_adone_rport,
390 			    MSGF_PRIORITY, ipfrag_drain_dispatch);
391 	}
392 
393 	netisr_register(NETISR_IP, ip_input_handler, ip_hashfn);
394 	netisr_register_hashcheck(NETISR_IP, ip_hashcheck);
395 
396 	for (cpu = 0; cpu < netisr_ncpus; ++cpu) {
397 		fragq = &ipfrag_queue_pcpu[cpu];
398 		callout_reset_bycpu(&fragq->timeo_ch, IPFRAG_TIMEO,
399 				    ipfrag_timeo, NULL, cpu);
400 	}
401 
402 	ip_porthash_trycount = 2 * netisr_ncpus;
403 }
404 
405 /* Do transport protocol processing. */
406 static void
transport_processing_oncpu(struct mbuf * m,int hlen,struct ip * ip)407 transport_processing_oncpu(struct mbuf *m, int hlen, struct ip *ip)
408 {
409 	const struct protosw *pr = &inetsw[ip_protox[ip->ip_p]];
410 
411 	/*
412 	 * Switch out to protocol's input routine.
413 	 */
414 	PR_GET_MPLOCK(pr);
415 	pr->pr_input(&m, &hlen, ip->ip_p);
416 	PR_REL_MPLOCK(pr);
417 }
418 
419 static void
transport_processing_handler(netmsg_t msg)420 transport_processing_handler(netmsg_t msg)
421 {
422 	struct netmsg_packet *pmsg = &msg->packet;
423 	struct ip *ip;
424 	int hlen;
425 
426 	ip = mtod(pmsg->nm_packet, struct ip *);
427 	hlen = pmsg->base.lmsg.u.ms_result;
428 
429 	transport_processing_oncpu(pmsg->nm_packet, hlen, ip);
430 	/* msg was embedded in the mbuf, do not reply! */
431 }
432 
433 static void
ip_input_handler(netmsg_t msg)434 ip_input_handler(netmsg_t msg)
435 {
436 	ip_input(msg->packet.nm_packet);
437 	/* msg was embedded in the mbuf, do not reply! */
438 }
439 
440 /*
441  * IP input routine.  Checksum and byte swap header.  If fragmented
442  * try to reassemble.  Process options.  Pass to next level.
443  */
444 void
ip_input(struct mbuf * m)445 ip_input(struct mbuf *m)
446 {
447 	struct ip *ip;
448 	struct in_ifaddr *ia = NULL;
449 	struct in_ifaddr_container *iac;
450 	int hlen, checkif;
451 	u_short sum;
452 	uint16_t ip_len;
453 	struct in_addr pkt_dst;
454 	boolean_t using_srcrt = FALSE;		/* forward (by PFIL_HOOKS) */
455 	struct in_addr odst;			/* original dst address(NAT) */
456 	struct m_tag *mtag;
457 	struct sockaddr_in *next_hop = NULL;
458 	lwkt_port_t port;
459 
460 	ASSERT_NETISR_NCPUS(mycpuid);
461 	M_ASSERTPKTHDR(m);
462 
463 	if (m->m_len < sizeof(struct ip)) {
464 		kprintf("Issuer to ip_input failed to check IP header atomicy (%d)\n",
465 			m->m_len);
466 		ipstat.ips_badlen++;
467 		goto bad;
468 	}
469 #if 0
470 	/* length checks already done in ip_hashfn() */
471 	KASSERT(m->m_len >= sizeof(struct ip), ("IP header not in one mbuf"));
472 #endif
473 
474 	/*
475 	 * This routine is called from numerous places which may not have
476 	 * characterized the packet.
477 	 */
478 	ip = mtod(m, struct ip *);
479 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
480 	    (ip->ip_off & htons(IP_MF | IP_OFFMASK)))
481 	{
482 		/*
483 		 * Force hash recalculation for fragments and multicast
484 		 * packets; hardware may not do it correctly.
485 		 * XXX add flag to indicate the hash is from hardware
486 		 */
487 		m->m_flags &= ~M_HASH;
488 	}
489 	if ((m->m_flags & M_HASH) == 0) {
490 		ip_hashfn(&m, 0);
491 		if (m == NULL)
492 			return;
493 		KKASSERT(m->m_flags & M_HASH);
494 
495 		if (&curthread->td_msgport !=
496 		    netisr_hashport(m->m_pkthdr.hash)) {
497 			netisr_queue(NETISR_IP, m);
498 			/* Requeued to other netisr msgport; done */
499 			return;
500 		}
501 
502 		/* mbuf could have been changed */
503 		ip = mtod(m, struct ip *);
504 	}
505 
506 	/*
507 	 * Pull out certain tags
508 	 */
509 	if (m->m_pkthdr.fw_flags & IPFORWARD_MBUF_TAGGED) {
510 		/* Next hop */
511 		mtag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
512 		KKASSERT(mtag != NULL);
513 		next_hop = m_tag_data(mtag);
514 	}
515 
516 	if (m->m_pkthdr.fw_flags &
517 	    (DUMMYNET_MBUF_TAGGED | IPFW_MBUF_CONTINUE)) {
518 		/*
519 		 * - Dummynet already filtered this packet.
520 		 * - This packet was processed by ipfw on another
521 		 *   cpu, and the rest of the ipfw processing should
522 		 *   be carried out on this cpu.
523 		 */
524 		ip = mtod(m, struct ip *);
525 		hlen = IP_VHL_HL(ip->ip_vhl) << 2;
526 		goto iphack;
527 	}
528 
529 	ipstat.ips_total++;
530 
531 	if (IP_VHL_V(ip->ip_vhl) != IPVERSION) {
532 		ipstat.ips_badvers++;
533 		goto bad;
534 	}
535 
536 	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
537 	/* length checks already done in ip_hashfn() */
538 	KASSERT(hlen >= sizeof(struct ip), ("IP header len too small"));
539 	KASSERT(m->m_len >= hlen, ("complete IP header not in one mbuf"));
540 
541 	/* 127/8 must not appear on wire - RFC1122 */
542 	if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
543 	    (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
544 		if (!(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) {
545 			ipstat.ips_badaddr++;
546 			goto bad;
547 		}
548 	}
549 
550 	if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
551 		sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
552 	} else {
553 		if (hlen == sizeof(struct ip))
554 			sum = in_cksum_hdr(ip);
555 		else
556 			sum = in_cksum(m, hlen);
557 	}
558 	if (sum != 0) {
559 		ipstat.ips_badsum++;
560 		goto bad;
561 	}
562 
563 #ifdef ALTQ
564 	if (altq_input != NULL && (*altq_input)(m, AF_INET) == 0) {
565 		/* packet is dropped by traffic conditioner */
566 		return;
567 	}
568 #endif
569 	/*
570 	 * Convert fields to host representation.
571 	 */
572 	ip_len = ntohs(ip->ip_len);
573 
574 	/* length checks already done in ip_hashfn() */
575 	KASSERT(ip_len >= hlen, ("total length incl header"));
576 	KASSERT(m->m_pkthdr.len >= ip_len, ("mbuf too short"));
577 
578 	/*
579 	 * Trim mbufs if longer than the IP header would have us expect.
580 	 */
581 	if (m->m_pkthdr.len > ip_len) {
582 		if (m->m_len == m->m_pkthdr.len) {
583 			m->m_len = ip_len;
584 			m->m_pkthdr.len = ip_len;
585 		} else {
586 			m_adj(m, ip_len - m->m_pkthdr.len);
587 		}
588 	}
589 
590 	/*
591 	 * IpHack's section.
592 	 * Right now when no processing on packet has done
593 	 * and it is still fresh out of network we do our black
594 	 * deals with it.
595 	 * - Firewall: deny/allow/divert
596 	 * - Xlate: translate packet's addr/port (NAT).
597 	 * - Pipe: pass pkt through dummynet.
598 	 * - Wrap: fake packet's addr/port <unimpl.>
599 	 * - Encapsulate: put it in another IP and send out. <unimp.>
600 	 */
601 
602 iphack:
603 	/*
604 	 * If we've been forwarded from the output side, then
605 	 * skip the firewall a second time
606 	 */
607 	if (next_hop != NULL)
608 		goto ours;
609 
610 	/* No pfil hooks */
611 	if (!pfil_has_hooks(&inet_pfil_hook)) {
612 		if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED) {
613 			/*
614 			 * Strip dummynet tags from stranded packets
615 			 */
616 			mtag = m_tag_find(m, PACKET_TAG_DUMMYNET, NULL);
617 			KKASSERT(mtag != NULL);
618 			m_tag_delete(m, mtag);
619 			m->m_pkthdr.fw_flags &= ~DUMMYNET_MBUF_TAGGED;
620 		}
621 		goto pass;
622 	}
623 
624 	/*
625 	 * Run through list of hooks for input packets.
626 	 *
627 	 * NOTE!  If the packet is rewritten pf/ipfw/whoever must
628 	 *	  clear M_HASH.
629 	 */
630 	odst = ip->ip_dst;
631 	if (pfil_run_hooks(&inet_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN))
632 		return;
633 	if (m == NULL)	/* consumed by filter */
634 		return;
635 	ip = mtod(m, struct ip *);
636 	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
637 	using_srcrt = (odst.s_addr != ip->ip_dst.s_addr);
638 
639 	if (m->m_pkthdr.fw_flags & IPFORWARD_MBUF_TAGGED) {
640 		mtag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
641 		KKASSERT(mtag != NULL);
642 		next_hop = m_tag_data(mtag);
643 	}
644 	if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED) {
645 		ip_dn_queue(m);
646 		return;
647 	}
648 	if (m->m_pkthdr.fw_flags & FW_MBUF_REDISPATCH)
649 		m->m_pkthdr.fw_flags &= ~FW_MBUF_REDISPATCH;
650 	if (m->m_pkthdr.fw_flags & IPFW_MBUF_CONTINUE) {
651 		/* ipfw was disabled/unloaded. */
652 		goto bad;
653 	}
654 pass:
655 	/*
656 	 * Process options and, if not destined for us,
657 	 * ship it on.  ip_dooptions returns 1 when an
658 	 * error was detected (causing an icmp message
659 	 * to be sent and the original packet to be freed).
660 	 */
661 	if (hlen > sizeof(struct ip) && ip_dooptions(m, 0, next_hop))
662 		return;
663 
664 	/* greedy RSVP, snatches any PATH packet of the RSVP protocol and no
665 	 * matter if it is destined to another node, or whether it is
666 	 * a multicast one, RSVP wants it! and prevents it from being forwarded
667 	 * anywhere else. Also checks if the rsvp daemon is running before
668 	 * grabbing the packet.
669 	 */
670 	if (rsvp_on && ip->ip_p == IPPROTO_RSVP)
671 		goto ours;
672 
673 	/*
674 	 * Check our list of addresses, to see if the packet is for us.
675 	 * If we don't have any addresses, assume any unicast packet
676 	 * we receive might be for us (and let the upper layers deal
677 	 * with it).
678 	 */
679 	if (TAILQ_EMPTY(&in_ifaddrheads[mycpuid]) &&
680 	    !(m->m_flags & (M_MCAST | M_BCAST)))
681 	{
682 		goto ours;
683 	}
684 
685 	/*
686 	 * Cache the destination address of the packet; this may be
687 	 * changed by use of 'ipfw fwd'.
688 	 */
689 	pkt_dst = next_hop ? next_hop->sin_addr : ip->ip_dst;
690 
691 	/*
692 	 * Enable a consistency check between the destination address
693 	 * and the arrival interface for a unicast packet (the RFC 1122
694 	 * strong ES model) if IP forwarding is disabled and the packet
695 	 * is not locally generated and the packet is not subject to
696 	 * 'ipfw fwd'.
697 	 *
698 	 * XXX - Checking also should be disabled if the destination
699 	 * address is ipnat'ed to a different interface.
700 	 *
701 	 * XXX - Checking is incompatible with IP aliases added
702 	 * to the loopback interface instead of the interface where
703 	 * the packets are received.
704 	 */
705 	checkif = ip_checkinterface &&
706 		  !ipforwarding &&
707 		  m->m_pkthdr.rcvif != NULL &&
708 		  !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) &&
709 		  next_hop == NULL;
710 
711 	/*
712 	 * Check for exact addresses in the hash bucket.
713 	 */
714 	LIST_FOREACH(iac, INADDR_HASH(pkt_dst.s_addr), ia_hash) {
715 		ia = iac->ia;
716 
717 		/*
718 		 * If the address matches, verify that the packet
719 		 * arrived via the correct interface if checking is
720 		 * enabled.
721 		 */
722 		if (IA_SIN(ia)->sin_addr.s_addr == pkt_dst.s_addr &&
723 		    (!checkif || ia->ia_ifp == m->m_pkthdr.rcvif))
724 		{
725 			goto ours;
726 		}
727 	}
728 	ia = NULL;
729 
730 	/*
731 	 * Check for broadcast addresses.
732 	 *
733 	 * Only accept broadcast packets that arrive via the matching
734 	 * interface.  Reception of forwarded directed broadcasts would
735 	 * be handled via ip_forward() and ether_output() with the loopback
736 	 * into the stack for SIMPLEX interfaces handled by ether_output().
737 	 */
738 	if (m->m_pkthdr.rcvif != NULL &&
739 	    m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) {
740 		struct ifaddr_container *ifac;
741 
742 		TAILQ_FOREACH(ifac, &m->m_pkthdr.rcvif->if_addrheads[mycpuid],
743 			      ifa_link) {
744 			struct ifaddr *ifa = ifac->ifa;
745 
746 			if (ifa->ifa_addr == NULL) /* shutdown/startup race */
747 				continue;
748 			if (ifa->ifa_addr->sa_family != AF_INET)
749 				continue;
750 			ia = ifatoia(ifa);
751 			if (satosin(&ia->ia_broadaddr)->sin_addr.s_addr ==
752 								pkt_dst.s_addr)
753 				goto ours;
754 			if (ia->ia_netbroadcast.s_addr == pkt_dst.s_addr)
755 				goto ours;
756 #ifdef BOOTP_COMPAT
757 			if (IA_SIN(ia)->sin_addr.s_addr == INADDR_ANY)
758 				goto ours;
759 #endif
760 		}
761 	}
762 	if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr))) {
763 		struct in_multi *inm;
764 
765 		if (ip_mrouter != NULL) {
766 			/* XXX Multicast routing is not MPSAFE yet */
767 			get_mplock();
768 
769 			/*
770 			 * If we are acting as a multicast router, all
771 			 * incoming multicast packets are passed to the
772 			 * kernel-level multicast forwarding function.
773 			 * The packet is returned (relatively) intact; if
774 			 * ip_mforward() returns a non-zero value, the packet
775 			 * must be discarded, else it may be accepted below.
776 			 */
777 			if (ip_mforward != NULL &&
778 			    ip_mforward(ip, m->m_pkthdr.rcvif, m, NULL) != 0) {
779 				rel_mplock();
780 				ipstat.ips_cantforward++;
781 				m_freem(m);
782 				return;
783 			}
784 
785 			rel_mplock();
786 
787 			/*
788 			 * The process-level routing daemon needs to receive
789 			 * all multicast IGMP packets, whether or not this
790 			 * host belongs to their destination groups.
791 			 */
792 			if (ip->ip_p == IPPROTO_IGMP)
793 				goto ours;
794 			ipstat.ips_forward++;
795 		}
796 		/*
797 		 * See if we belong to the destination multicast group on the
798 		 * arrival interface.
799 		 */
800 		inm = IN_LOOKUP_MULTI(&ip->ip_dst, m->m_pkthdr.rcvif);
801 		if (inm == NULL) {
802 			ipstat.ips_notmember++;
803 			m_freem(m);
804 			return;
805 		}
806 		goto ours;
807 	}
808 	if (ip->ip_dst.s_addr == INADDR_BROADCAST)
809 		goto ours;
810 	if (ip->ip_dst.s_addr == INADDR_ANY)
811 		goto ours;
812 
813 	/*
814 	 * Not for us; forward if possible and desirable.
815 	 */
816 	if (!ipforwarding) {
817 		ipstat.ips_cantforward++;
818 		m_freem(m);
819 	} else {
820 		ip_forward(m, using_srcrt, next_hop);
821 	}
822 	return;
823 
824 ours:
825 
826 	/*
827 	 * IPSTEALTH: Process non-routing options only
828 	 * if the packet is destined for us.
829 	 */
830 	if (ipstealth &&
831 	    hlen > sizeof(struct ip) &&
832 	    ip_dooptions(m, 1, next_hop))
833 	{
834 		return;
835 	}
836 
837 	/* Count the packet in the ip address stats */
838 	if (ia != NULL) {
839 		IFA_STAT_INC(&ia->ia_ifa, ipackets, 1);
840 		IFA_STAT_INC(&ia->ia_ifa, ibytes, m->m_pkthdr.len);
841 	}
842 
843 	/*
844 	 * If offset or IP_MF are set, must reassemble.
845 	 * Otherwise, nothing need be done.
846 	 * (We could look in the reassembly queue to see
847 	 * if the packet was previously fragmented,
848 	 * but it's not worth the time; just let them time out.)
849 	 */
850 	if (ip->ip_off & htons(IP_MF | IP_OFFMASK)) {
851 		/*
852 		 * Attempt reassembly; if it succeeds, proceed.  ip_reass()
853 		 * will return a different mbuf.
854 		 *
855 		 * NOTE: ip_reass() returns m with M_HASH cleared to force
856 		 *	 us to recharacterize the packet.
857 		 */
858 		m = ip_reass(m);
859 		if (m == NULL)
860 			return;
861 		ip = mtod(m, struct ip *);
862 
863 		/* Get the header length of the reassembled packet */
864 		hlen = IP_VHL_HL(ip->ip_vhl) << 2;
865 	}
866 
867 	/*
868 	 * We must forward the packet to the correct protocol thread if
869 	 * we are not already in it.
870 	 *
871 	 * NOTE: ip_len is left in network form.  ip_len is not adjusted
872 	 *	 further for protocol processing, instead we pass hlen
873 	 *	 to the protosw and let it deal with it.
874 	 */
875 	ipstat.ips_delivered++;
876 
877 	if ((m->m_flags & M_HASH) == 0) {
878 		m = ip_rehashm(m);
879 		if (m == NULL)
880 			return;
881 		ip = mtod(m, struct ip *);
882 	}
883 	port = netisr_hashport(m->m_pkthdr.hash);
884 
885 	if (port != &curthread->td_msgport) {
886 		ip_transport_redispatch(port, m, hlen);
887 	} else {
888 #ifdef RSS_DEBUG
889 		atomic_add_long(&ip_dispatch_fast, 1);
890 #endif
891 		transport_processing_oncpu(m, hlen, ip);
892 	}
893 	return;
894 
895 bad:
896 	m_freem(m);
897 }
898 
899 struct mbuf *
ip_rehashm(struct mbuf * m)900 ip_rehashm(struct mbuf *m)
901 {
902 	struct ip *ip = mtod(m, struct ip *);
903 
904 #ifdef RSS_DEBUG
905 	atomic_add_long(&ip_rehash_count, 1);
906 #endif
907 	ip_hashfn(&m, 0);
908 	if (m == NULL)
909 		return NULL;
910 
911 	/* 'm' might be changed by ip_hashfn(). */
912 	ip = mtod(m, struct ip *);
913 	KASSERT(m->m_flags & M_HASH, ("no hash"));
914 
915 	return (m);
916 }
917 
918 void
ip_transport_redispatch(struct lwkt_port * port,struct mbuf * m,int hlen)919 ip_transport_redispatch(struct lwkt_port *port, struct mbuf *m, int hlen)
920 {
921 	struct netmsg_packet *pmsg;
922 
923 #ifdef RSS_DEBUG
924 	atomic_add_long(&ip_dispatch_slow, 1);
925 #endif
926 
927 	pmsg = &m->m_hdr.mh_netmsg;
928 	netmsg_init(&pmsg->base, NULL, &netisr_apanic_rport,
929 		    0, transport_processing_handler);
930 	pmsg->nm_packet = m;
931 	pmsg->base.lmsg.u.ms_result = hlen;
932 	lwkt_sendmsg(port, &pmsg->base.lmsg);
933 }
934 
935 static void
ip_forward_handler(netmsg_t msg)936 ip_forward_handler(netmsg_t msg)
937 {
938 	struct netmsg_forward *fmsg;
939 	struct mbuf *m;
940 	struct m_tag *mtag;
941 	struct sockaddr_in *next_hop = NULL;
942 
943 	fmsg = &msg->forward;
944 	m = fmsg->nm_packet;
945 
946 	/* Re-extract the next hop if it exists */
947 	if (m->m_pkthdr.fw_flags & IPFORWARD_MBUF_TAGGED) {
948 		/* Next hop */
949 		mtag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
950 		KKASSERT(mtag != NULL);
951 		next_hop = m_tag_data(mtag);
952 	}
953 
954 	ip_forward(m, fmsg->using_srcrt, next_hop);
955 	/* msg was embedded in the mbuf, do not reply! */
956 }
957 
958 static void
ip_forward_redispatch(struct lwkt_port * port,struct mbuf * m,boolean_t srcrt)959 ip_forward_redispatch(struct lwkt_port *port, struct mbuf *m, boolean_t srcrt)
960 {
961 	struct netmsg_forward *fmsg;
962 
963 	fmsg = &m->m_hdr.mh_fwdmsg;
964 	netmsg_init(&fmsg->base, NULL, &netisr_apanic_rport,
965 		    0, ip_forward_handler);
966 	fmsg->nm_packet = m;
967 	fmsg->using_srcrt = srcrt;
968 	lwkt_sendmsg(port, &fmsg->base.lmsg);
969 }
970 
971 /*
972  * Take incoming datagram fragment and try to reassemble it into
973  * whole datagram.  If a chain for reassembly of this datagram already
974  * exists, then it is given as fp; otherwise have to make a chain.
975  */
976 struct mbuf *
ip_reass(struct mbuf * m)977 ip_reass(struct mbuf *m)
978 {
979 	struct ipfrag_queue *fragq = &ipfrag_queue_pcpu[mycpuid];
980 	struct ip *ip = mtod(m, struct ip *);
981 	struct mbuf *p = NULL, *q, *nq;
982 	struct mbuf *n;
983 	struct ipq *fp = NULL;
984 	struct ipqhead *head;
985 	int hlen = IP_VHL_HL(ip->ip_vhl) << 2;
986 	int i, next;
987 	u_short sum;
988 	uint16_t ip_off;
989 	uint16_t ip_len;
990 
991 	/* If maxnipq or maxfragsperpacket are 0, never accept fragments. */
992 	if (maxnipq == 0 || maxfragsperpacket == 0) {
993 		ipstat.ips_fragments++;
994 		ipstat.ips_fragdropped++;
995 		m_freem(m);
996 		return NULL;
997 	}
998 
999 	sum = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id);
1000 	/*
1001 	 * Look for queue of fragments of this datagram.
1002 	 */
1003 	head = &fragq->ipq[sum];
1004 	TAILQ_FOREACH(fp, head, ipq_list) {
1005 		if (ip->ip_id == fp->ipq_id &&
1006 		    ip->ip_src.s_addr == fp->ipq_src.s_addr &&
1007 		    ip->ip_dst.s_addr == fp->ipq_dst.s_addr &&
1008 		    ip->ip_p == fp->ipq_p)
1009 		{
1010 			goto found;
1011 		}
1012 	}
1013 
1014 	fp = NULL;
1015 
1016 	/*
1017 	 * Enforce upper bound on number of fragmented packets
1018 	 * for which we attempt reassembly;
1019 	 * If maxnipq is -1, accept all fragments without limitation.
1020 	 */
1021 	if (fragq->nipq > maxnipq && maxnipq > 0) {
1022 		/*
1023 		 * drop something from the tail of the current queue
1024 		 * before proceeding further
1025 		 */
1026 		struct ipq *q = TAILQ_LAST(head, ipqhead);
1027 		if (q == NULL) {
1028 			/*
1029 			 * The current queue is empty,
1030 			 * so drop from one of the others.
1031 			 */
1032 			for (i = 0; i < IPREASS_NHASH; i++) {
1033 				struct ipq *r;
1034 
1035 				r = TAILQ_LAST(&fragq->ipq[i], ipqhead);
1036 				if (r) {
1037 					ipstat.ips_fragtimeout += r->ipq_nfrags;
1038 					ip_freef(fragq, &fragq->ipq[i], r);
1039 					break;
1040 				}
1041 			}
1042 		} else {
1043 			ipstat.ips_fragtimeout += q->ipq_nfrags;
1044 			ip_freef(fragq, head, q);
1045 		}
1046 	}
1047 found:
1048 	/*
1049 	 * NOTE: ip_len is no longer adjusted to remove the header length.
1050 	 */
1051 	if (ip->ip_off & htons(IP_MF)) {
1052 		/*
1053 		 * Make sure that fragments have a data length
1054 		 * that's a non-zero multiple of 8 bytes.  The
1055 		 * IP header itself might be in multiples of 4
1056 		 * bytes and is discounted.
1057 		 */
1058 		ip_len = ntohs(ip->ip_len) - hlen;
1059 		if (ip_len == 0 || (ip_len & 7) != 0) {
1060 			ipstat.ips_toosmall++; /* XXX */
1061 			m_freem(m);
1062 			goto done;
1063 		}
1064 		m->m_flags |= M_FRAG;
1065 	} else {
1066 		m->m_flags &= ~M_FRAG;
1067 	}
1068 
1069 	ipstat.ips_fragments++;
1070 	m->m_pkthdr.header = ip;
1071 
1072 	/*
1073 	 * If the hardware has not done csum over this fragment
1074 	 * then csum_data is not valid at all.
1075 	 */
1076 	if ((m->m_pkthdr.csum_flags & (CSUM_FRAG_NOT_CHECKED | CSUM_DATA_VALID))
1077 	    == (CSUM_FRAG_NOT_CHECKED | CSUM_DATA_VALID))
1078 	{
1079 		m->m_pkthdr.csum_data = 0;
1080 		m->m_pkthdr.csum_flags &= ~(CSUM_DATA_VALID | CSUM_PSEUDO_HDR);
1081 	}
1082 
1083 	/*
1084 	 * Presence of header sizes in mbufs would confuse code below.
1085 	 * Note that ip->ip_len is not modified and retains the header length,
1086 	 * but local ip_len and fp_len variables remove the header length.
1087 	 */
1088 	m->m_data += hlen;
1089 	m->m_len -= hlen;
1090 
1091 	/*
1092 	 * If first fragment to arrive, create a reassembly queue.
1093 	 */
1094 	if (fp == NULL) {
1095 		if ((fp = mpipe_alloc_nowait(&ipq_mpipe)) == NULL)
1096 			goto dropfrag;
1097 		TAILQ_INSERT_HEAD(head, fp, ipq_list);
1098 		fragq->nipq++;
1099 		fp->ipq_nfrags = 1;
1100 		fp->ipq_ttl = IPFRAGTTL;
1101 		fp->ipq_p = ip->ip_p;
1102 		fp->ipq_id = ip->ip_id;
1103 		fp->ipq_src = ip->ip_src;
1104 		fp->ipq_dst = ip->ip_dst;
1105 		fp->ipq_frags = m;
1106 		m->m_nextpkt = NULL;
1107 		goto inserted;
1108 	}
1109 	fp->ipq_nfrags++;
1110 
1111 #define	GETIP(m)	((struct ip*)((m)->m_pkthdr.header))
1112 
1113 	/*
1114 	 * Find a segment which begins after this one does.  We
1115 	 * don't have to fully convert the offset field for this
1116 	 * test.
1117 	 */
1118 	for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt) {
1119 		if ((ntohs(GETIP(q)->ip_off) & IP_OFFMASK) >
1120 		    (ntohs(ip->ip_off) & IP_OFFMASK))
1121 		{
1122 			break;
1123 		}
1124 	}
1125 
1126 	/*
1127 	 * Drop fragment if it overflows the maximum allowed IP
1128 	 * packet size.
1129 	 */
1130 	ip_off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;
1131 	ip_len = ntohs(ip->ip_len);
1132 
1133 	if (ip_off + ip_len > 65535U)
1134 		goto dropfrag;
1135 
1136 	ip_len -= hlen;
1137 
1138 	/*
1139 	 * If there is a preceding segment, it may provide some of
1140 	 * our data already.  If so, drop the data from the incoming
1141 	 * segment.  If it provides all of our data, drop us, otherwise
1142 	 * stick new segment in the proper place.
1143 	 *
1144 	 * If some of the data is dropped from the the preceding
1145 	 * segment, then it's checksum is invalidated.
1146 	 */
1147 
1148 	if (p) {
1149 		uint16_t fp_off;
1150 		uint16_t fp_len;
1151 
1152 		/*
1153 		 * Calculations in bytes and ip_len/fp_len do not reflect
1154 		 * the header size.
1155 		 */
1156 		fp_off = (ntohs(GETIP(p)->ip_off) & IP_OFFMASK) << 3;
1157 		fp_len = ntohs(GETIP(p)->ip_len) -
1158 			 (IP_VHL_HL(GETIP(p)->ip_vhl) << 2);
1159 
1160 		if (fp_off + fp_len > ip_off) {
1161 			i = fp_off + fp_len - ip_off;
1162 			if (i >= ip_len)
1163 				goto dropfrag;
1164 			m_adj(m, i);
1165 			m->m_pkthdr.csum_flags = 0;
1166 			ip_off = fp_off + fp_len;
1167 			ip_len -= i;
1168 
1169 			/*
1170 			 * Non-optimal modification of packet content, but
1171 			 * in this rare case we don't care.
1172 			 */
1173 			ip->ip_off = htons(ip_off >> 3);
1174 			ip->ip_len = htons(ip_len + hlen);
1175 		}
1176 		m->m_nextpkt = p->m_nextpkt;
1177 		p->m_nextpkt = m;
1178 	} else {
1179 		m->m_nextpkt = fp->ipq_frags;
1180 		fp->ipq_frags = m;
1181 	}
1182 
1183 	/*
1184 	 * Dequeue any later segments that we completely overlap.
1185 	 * While we overlap succeeding segments trim them or,
1186 	 * if they are completely covered, dequeue them.
1187 	 */
1188 	while (q) {
1189 		uint16_t fp_off;
1190 		uint16_t fp_len;
1191 		uint16_t fp_hlen;
1192 
1193 		fp_off = (ntohs(GETIP(q)->ip_off) & IP_OFFMASK) << 3;
1194 		fp_hlen = (IP_VHL_HL(GETIP(q)->ip_vhl) << 2);
1195 		fp_len = ntohs(GETIP(q)->ip_len) - fp_hlen;
1196 		if (ip_off + ip_len <= fp_off)
1197 			break;
1198 		i = ip_off + ip_len - fp_off;	/* bytes overlapped */
1199 
1200 		if (i < fp_len) {
1201 			/*
1202 			 * Non-optimal modification of packet content, but
1203 			 * in this rare case we don't care.
1204 			 */
1205 			GETIP(q)->ip_len = htons(fp_len - i + fp_hlen);
1206 			GETIP(q)->ip_off = htons((fp_off + i) >> 3);
1207 			m_adj(q, i);
1208 			q->m_pkthdr.csum_flags = 0;
1209 			break;
1210 		}
1211 		nq = q->m_nextpkt;
1212 		m->m_nextpkt = nq;
1213 		ipstat.ips_fragdropped++;
1214 		fp->ipq_nfrags--;
1215 		q->m_nextpkt = NULL;
1216 		m_freem(q);
1217 
1218 		q = nq;
1219 	}
1220 
1221 inserted:
1222 	/*
1223 	 * Check for complete reassembly and perform frag per packet
1224 	 * limiting.
1225 	 *
1226 	 * Frag limiting is performed here so that the nth frag has
1227 	 * a chance to complete the packet before we drop the packet.
1228 	 * As a result, n+1 frags are actually allowed per packet, but
1229 	 * only n will ever be stored. (n = maxfragsperpacket.)
1230 	 *
1231 	 */
1232 	next = 0;
1233 	for (p = NULL, q = fp->ipq_frags; q; p = q, q = q->m_nextpkt) {
1234 		uint16_t fp_off;
1235 		uint16_t fp_len;
1236 		uint16_t fp_hlen;
1237 
1238 		fp_off = (ntohs(GETIP(q)->ip_off) & IP_OFFMASK) << 3;
1239 		fp_hlen = (IP_VHL_HL(GETIP(q)->ip_vhl) << 2);
1240 		fp_len = ntohs(GETIP(q)->ip_len) - fp_hlen;
1241 		if (fp_off != next) {
1242 			if (fp->ipq_nfrags > maxfragsperpacket) {
1243 				ipstat.ips_fragdropped += fp->ipq_nfrags;
1244 				ip_freef(fragq, head, fp);
1245 			}
1246 			goto done;
1247 		}
1248 		next += fp_len;
1249 	}
1250 	/* Make sure the last packet didn't have the IP_MF flag */
1251 	if (p->m_flags & M_FRAG) {
1252 		if (fp->ipq_nfrags > maxfragsperpacket) {
1253 			ipstat.ips_fragdropped += fp->ipq_nfrags;
1254 			ip_freef(fragq, head, fp);
1255 		}
1256 		goto done;
1257 	}
1258 
1259 	/*
1260 	 * Reassembly is complete.  Make sure the packet is a sane size.
1261 	 */
1262 	q = fp->ipq_frags;
1263 	ip = GETIP(q);
1264 	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1265 	if (next + (IP_VHL_HL(ip->ip_vhl) << 2) > IP_MAXPACKET) {
1266 		ipstat.ips_toolong++;
1267 		ipstat.ips_fragdropped += fp->ipq_nfrags;
1268 		ip_freef(fragq, head, fp);
1269 		goto done;
1270 	}
1271 
1272 	/*
1273 	 * Concatenate fragments.
1274 	 */
1275 	m = q;
1276 	n = m->m_next;
1277 	m->m_next = NULL;
1278 	m_cat(m, n);
1279 	nq = q->m_nextpkt;
1280 	q->m_nextpkt = NULL;
1281 	for (q = nq; q != NULL; q = nq) {
1282 		nq = q->m_nextpkt;
1283 		q->m_nextpkt = NULL;
1284 		m->m_pkthdr.csum_flags &= q->m_pkthdr.csum_flags;
1285 		m->m_pkthdr.csum_data += q->m_pkthdr.csum_data;
1286 		m_cat(m, q);
1287 	}
1288 
1289 	/*
1290 	 * Clean up the 1's complement checksum.  Carry over 16 bits must
1291 	 * be added back.  This assumes no more then 65535 packet fragments
1292 	 * were reassembled.  A second carry can also occur (but not a third).
1293 	 */
1294 	m->m_pkthdr.csum_data = (m->m_pkthdr.csum_data & 0xffff) +
1295 				(m->m_pkthdr.csum_data >> 16);
1296 	if (m->m_pkthdr.csum_data > 0xFFFF)
1297 		m->m_pkthdr.csum_data -= 0xFFFF;
1298 
1299 	/*
1300 	 * Create header for new ip packet by modifying the header of the
1301 	 * first packet.  Dequeue and discard the fragment reassembly header.
1302 	 * Make the header visible.  Set the offset to 0 and keep only the
1303 	 * DF flag from the first packet's ip_off field.
1304 	 *
1305 	 * Note that ip_len includes the header length.
1306 	 */
1307 	ip->ip_len = htons(next + hlen);
1308 	ip->ip_src = fp->ipq_src;
1309 	ip->ip_dst = fp->ipq_dst;
1310 	ip->ip_off &= htons(IP_DF);
1311 	TAILQ_REMOVE(head, fp, ipq_list);
1312 	fragq->nipq--;
1313 	mpipe_free(&ipq_mpipe, fp);
1314 
1315 	m->m_len += (IP_VHL_HL(ip->ip_vhl) << 2);
1316 	m->m_data -= (IP_VHL_HL(ip->ip_vhl) << 2);
1317 	/* some debugging cruft by sklower, below, will go away soon */
1318 	if (m->m_flags & M_PKTHDR) { /* XXX this should be done elsewhere */
1319 		int plen = 0;
1320 
1321 		for (n = m; n; n = n->m_next)
1322 			plen += n->m_len;
1323 		m->m_pkthdr.len = plen;
1324 	}
1325 
1326 	/*
1327 	 * Reassembly complete, return the next protocol.
1328 	 *
1329 	 * Be sure to clear M_HASH to force the packet
1330 	 * to be re-characterized.
1331 	 *
1332 	 * Clear M_FRAG, we are no longer a fragment.
1333 	 */
1334 	m->m_flags &= ~(M_HASH | M_FRAG);
1335 
1336 	ipstat.ips_reassembled++;
1337 	return (m);
1338 
1339 dropfrag:
1340 	ipstat.ips_fragdropped++;
1341 	if (fp != NULL)
1342 		fp->ipq_nfrags--;
1343 	m_freem(m);
1344 done:
1345 	return (NULL);
1346 
1347 #undef GETIP
1348 }
1349 
1350 /*
1351  * Free a fragment reassembly header and all
1352  * associated datagrams.
1353  */
1354 static void
ip_freef(struct ipfrag_queue * fragq,struct ipqhead * fhp,struct ipq * fp)1355 ip_freef(struct ipfrag_queue *fragq, struct ipqhead *fhp, struct ipq *fp)
1356 {
1357 	struct mbuf *q;
1358 
1359 	/*
1360 	 * Remove first to protect against blocking
1361 	 */
1362 	TAILQ_REMOVE(fhp, fp, ipq_list);
1363 
1364 	/*
1365 	 * Clean out at our leisure
1366 	 */
1367 	while (fp->ipq_frags) {
1368 		q = fp->ipq_frags;
1369 		fp->ipq_frags = q->m_nextpkt;
1370 		q->m_nextpkt = NULL;
1371 		m_freem(q);
1372 	}
1373 	mpipe_free(&ipq_mpipe, fp);
1374 	fragq->nipq--;
1375 }
1376 
1377 /*
1378  * If a timer expires on a reassembly queue, discard it.
1379  */
1380 static void
ipfrag_timeo_dispatch(netmsg_t nmsg)1381 ipfrag_timeo_dispatch(netmsg_t nmsg)
1382 {
1383 	struct ipfrag_queue *fragq = &ipfrag_queue_pcpu[mycpuid];
1384 	struct ipq *fp, *fp_temp;
1385 	struct ipqhead *head;
1386 	int i;
1387 
1388 	crit_enter();
1389 	netisr_replymsg(&nmsg->base, 0);  /* reply ASAP */
1390 	crit_exit();
1391 
1392 	if (fragq->nipq == 0)
1393 		goto done;
1394 
1395 	for (i = 0; i < IPREASS_NHASH; i++) {
1396 		head = &fragq->ipq[i];
1397 		TAILQ_FOREACH_MUTABLE(fp, head, ipq_list, fp_temp) {
1398 			if (--fp->ipq_ttl == 0) {
1399 				ipstat.ips_fragtimeout += fp->ipq_nfrags;
1400 				ip_freef(fragq, head, fp);
1401 			}
1402 		}
1403 	}
1404 	/*
1405 	 * If we are over the maximum number of fragments
1406 	 * (due to the limit being lowered), drain off
1407 	 * enough to get down to the new limit.
1408 	 */
1409 	if (maxnipq >= 0 && fragq->nipq > maxnipq) {
1410 		for (i = 0; i < IPREASS_NHASH; i++) {
1411 			head = &fragq->ipq[i];
1412 			while (fragq->nipq > maxnipq && !TAILQ_EMPTY(head)) {
1413 				ipstat.ips_fragdropped +=
1414 				    TAILQ_FIRST(head)->ipq_nfrags;
1415 				ip_freef(fragq, head, TAILQ_FIRST(head));
1416 			}
1417 		}
1418 	}
1419 done:
1420 	callout_reset(&fragq->timeo_ch, IPFRAG_TIMEO, ipfrag_timeo, NULL);
1421 }
1422 
1423 static void
ipfrag_timeo(void * dummy __unused)1424 ipfrag_timeo(void *dummy __unused)
1425 {
1426 	struct netmsg_base *msg = &ipfrag_queue_pcpu[mycpuid].timeo_netmsg;
1427 
1428 	crit_enter();
1429 	if (msg->lmsg.ms_flags & MSGF_DONE)
1430 		netisr_sendmsg_oncpu(msg);
1431 	crit_exit();
1432 }
1433 
1434 /*
1435  * Drain off all datagram fragments.
1436  */
1437 static void
ipfrag_drain_oncpu(struct ipfrag_queue * fragq)1438 ipfrag_drain_oncpu(struct ipfrag_queue *fragq)
1439 {
1440 	struct ipqhead *head;
1441 	int i;
1442 
1443 	for (i = 0; i < IPREASS_NHASH; i++) {
1444 		head = &fragq->ipq[i];
1445 		while (!TAILQ_EMPTY(head)) {
1446 			ipstat.ips_fragdropped += TAILQ_FIRST(head)->ipq_nfrags;
1447 			ip_freef(fragq, head, TAILQ_FIRST(head));
1448 		}
1449 	}
1450 }
1451 
1452 static void
ipfrag_drain_dispatch(netmsg_t nmsg)1453 ipfrag_drain_dispatch(netmsg_t nmsg)
1454 {
1455 	struct ipfrag_queue *fragq = &ipfrag_queue_pcpu[mycpuid];
1456 
1457 	crit_enter();
1458 	lwkt_replymsg(&nmsg->lmsg, 0);  /* reply ASAP */
1459 	crit_exit();
1460 
1461 	ipfrag_drain_oncpu(fragq);
1462 	fragq->draining = 0;
1463 }
1464 
1465 static void
ipfrag_drain_ipi(void * arg __unused)1466 ipfrag_drain_ipi(void *arg __unused)
1467 {
1468 	int cpu = mycpuid;
1469 	struct lwkt_msg *msg = &ipfrag_queue_pcpu[cpu].drain_netmsg.lmsg;
1470 
1471 	crit_enter();
1472 	if (msg->ms_flags & MSGF_DONE)
1473 		lwkt_sendmsg_oncpu(netisr_cpuport(cpu), msg);
1474 	crit_exit();
1475 }
1476 
1477 static void
ipfrag_drain(void)1478 ipfrag_drain(void)
1479 {
1480 	cpumask_t mask;
1481 	int cpu;
1482 
1483 	CPUMASK_ASSBMASK(mask, netisr_ncpus);
1484 	CPUMASK_ANDMASK(mask, smp_active_mask);
1485 
1486 	if (IN_NETISR_NCPUS(mycpuid)) {
1487 		ipfrag_drain_oncpu(&ipfrag_queue_pcpu[mycpuid]);
1488 		CPUMASK_NANDBIT(mask, mycpuid);
1489 	}
1490 
1491 	for (cpu = 0; cpu < netisr_ncpus; ++cpu) {
1492 		struct ipfrag_queue *fragq = &ipfrag_queue_pcpu[cpu];
1493 
1494 		if (!CPUMASK_TESTBIT(mask, cpu))
1495 			continue;
1496 
1497 		if (fragq->nipq == 0 || fragq->draining) {
1498 			/* No fragments or is draining; skip this cpu. */
1499 			CPUMASK_NANDBIT(mask, cpu);
1500 			continue;
1501 		}
1502 		fragq->draining = 1;
1503 	}
1504 
1505 	if (CPUMASK_TESTNZERO(mask))
1506 		lwkt_send_ipiq_mask(mask, ipfrag_drain_ipi, NULL);
1507 }
1508 
1509 void
ip_drain(void)1510 ip_drain(void)
1511 {
1512 	ipfrag_drain();
1513 	in_rtqdrain();
1514 }
1515 
1516 /*
1517  * Do option processing on a datagram,
1518  * possibly discarding it if bad options are encountered,
1519  * or forwarding it if source-routed.
1520  * The pass argument is used when operating in the IPSTEALTH
1521  * mode to tell what options to process:
1522  * [LS]SRR (pass 0) or the others (pass 1).
1523  * The reason for as many as two passes is that when doing IPSTEALTH,
1524  * non-routing options should be processed only if the packet is for us.
1525  * Returns 1 if packet has been forwarded/freed,
1526  * 0 if the packet should be processed further.
1527  */
1528 static int
ip_dooptions(struct mbuf * m,int pass,struct sockaddr_in * next_hop)1529 ip_dooptions(struct mbuf *m, int pass, struct sockaddr_in *next_hop)
1530 {
1531 	struct sockaddr_in ipaddr = { sizeof ipaddr, AF_INET };
1532 	struct ip *ip = mtod(m, struct ip *);
1533 	u_char *cp;
1534 	struct in_ifaddr *ia;
1535 	int opt, optlen, cnt, off, code, type = ICMP_PARAMPROB;
1536 	boolean_t forward = FALSE;
1537 	struct in_addr *sin, dst;
1538 	n_time ntime;
1539 
1540 	dst = ip->ip_dst;
1541 	cp = (u_char *)(ip + 1);
1542 	cnt = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
1543 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
1544 		opt = cp[IPOPT_OPTVAL];
1545 		if (opt == IPOPT_EOL)
1546 			break;
1547 		if (opt == IPOPT_NOP)
1548 			optlen = 1;
1549 		else {
1550 			if (cnt < IPOPT_OLEN + sizeof(*cp)) {
1551 				code = &cp[IPOPT_OLEN] - (u_char *)ip;
1552 				goto bad;
1553 			}
1554 			optlen = cp[IPOPT_OLEN];
1555 			if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) {
1556 				code = &cp[IPOPT_OLEN] - (u_char *)ip;
1557 				goto bad;
1558 			}
1559 		}
1560 		switch (opt) {
1561 
1562 		default:
1563 			break;
1564 
1565 		/*
1566 		 * Source routing with record.
1567 		 * Find interface with current destination address.
1568 		 * If none on this machine then drop if strictly routed,
1569 		 * or do nothing if loosely routed.
1570 		 * Record interface address and bring up next address
1571 		 * component.  If strictly routed make sure next
1572 		 * address is on directly accessible net.
1573 		 */
1574 		case IPOPT_LSRR:
1575 		case IPOPT_SSRR:
1576 			if (ipstealth && pass > 0)
1577 				break;
1578 			if (optlen < IPOPT_OFFSET + sizeof(*cp)) {
1579 				code = &cp[IPOPT_OLEN] - (u_char *)ip;
1580 				goto bad;
1581 			}
1582 			if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {
1583 				code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1584 				goto bad;
1585 			}
1586 			ipaddr.sin_addr = ip->ip_dst;
1587 			ia = (struct in_ifaddr *)
1588 				ifa_ifwithaddr((struct sockaddr *)&ipaddr);
1589 			if (ia == NULL) {
1590 				if (opt == IPOPT_SSRR) {
1591 					type = ICMP_UNREACH;
1592 					code = ICMP_UNREACH_SRCFAIL;
1593 					goto bad;
1594 				}
1595 				if (!ip_dosourceroute)
1596 					goto nosourcerouting;
1597 				/*
1598 				 * Loose routing, and not at next destination
1599 				 * yet; nothing to do except forward.
1600 				 */
1601 				break;
1602 			}
1603 			off--;			/* 0 origin */
1604 			if (off > optlen - (int)sizeof(struct in_addr)) {
1605 				/*
1606 				 * End of source route.  Should be for us.
1607 				 */
1608 				if (!ip_acceptsourceroute)
1609 					goto nosourcerouting;
1610 				save_rte(m, cp, ip->ip_src);
1611 				break;
1612 			}
1613 			if (ipstealth)
1614 				goto dropit;
1615 			if (!ip_dosourceroute) {
1616 				if (ipforwarding) {
1617 					char sbuf[INET_ADDRSTRLEN];
1618 					char dbuf[INET_ADDRSTRLEN];
1619 
1620 					/*
1621 					 * Acting as a router, so generate ICMP
1622 					 */
1623 nosourcerouting:
1624 					log(LOG_WARNING,
1625 					    "attempted source route from %s to %s\n",
1626 					    kinet_ntoa(ip->ip_src, sbuf),
1627 					    kinet_ntoa(ip->ip_dst, dbuf));
1628 					type = ICMP_UNREACH;
1629 					code = ICMP_UNREACH_SRCFAIL;
1630 					goto bad;
1631 				} else {
1632 					/*
1633 					 * Not acting as a router,
1634 					 * so silently drop.
1635 					 */
1636 dropit:
1637 					ipstat.ips_cantforward++;
1638 					m_freem(m);
1639 					return (1);
1640 				}
1641 			}
1642 
1643 			/*
1644 			 * locate outgoing interface
1645 			 */
1646 			memcpy(&ipaddr.sin_addr, cp + off,
1647 			    sizeof ipaddr.sin_addr);
1648 
1649 			if (opt == IPOPT_SSRR) {
1650 #define	INA	struct in_ifaddr *
1651 #define	SA	struct sockaddr *
1652 				if ((ia = (INA)ifa_ifwithdstaddr((SA)&ipaddr))
1653 									== NULL)
1654 					ia = (INA)ifa_ifwithnet((SA)&ipaddr);
1655 			} else {
1656 				ia = ip_rtaddr(ipaddr.sin_addr, NULL);
1657 			}
1658 			if (ia == NULL) {
1659 				type = ICMP_UNREACH;
1660 				code = ICMP_UNREACH_SRCFAIL;
1661 				goto bad;
1662 			}
1663 			ip->ip_dst = ipaddr.sin_addr;
1664 			memcpy(cp + off, &IA_SIN(ia)->sin_addr,
1665 			    sizeof(struct in_addr));
1666 			cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1667 			/*
1668 			 * Let ip_intr's mcast routing check handle mcast pkts
1669 			 */
1670 			forward = !IN_MULTICAST(ntohl(ip->ip_dst.s_addr));
1671 			break;
1672 
1673 		case IPOPT_RR:
1674 			if (ipstealth && pass == 0)
1675 				break;
1676 			if (optlen < IPOPT_OFFSET + sizeof(*cp)) {
1677 				code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1678 				goto bad;
1679 			}
1680 			if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {
1681 				code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1682 				goto bad;
1683 			}
1684 			/*
1685 			 * If no space remains, ignore.
1686 			 */
1687 			off--;			/* 0 origin */
1688 			if (off > optlen - (int)sizeof(struct in_addr))
1689 				break;
1690 			memcpy(&ipaddr.sin_addr, &ip->ip_dst,
1691 			    sizeof ipaddr.sin_addr);
1692 			/*
1693 			 * locate outgoing interface; if we're the destination,
1694 			 * use the incoming interface (should be same).
1695 			 */
1696 			if ((ia = (INA)ifa_ifwithaddr((SA)&ipaddr)) == NULL &&
1697 			    (ia = ip_rtaddr(ipaddr.sin_addr, NULL)) == NULL) {
1698 				type = ICMP_UNREACH;
1699 				code = ICMP_UNREACH_HOST;
1700 				goto bad;
1701 			}
1702 			memcpy(cp + off, &IA_SIN(ia)->sin_addr,
1703 			    sizeof(struct in_addr));
1704 			cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1705 			break;
1706 
1707 		case IPOPT_TS:
1708 			if (ipstealth && pass == 0)
1709 				break;
1710 			code = cp - (u_char *)ip;
1711 			if (optlen < 4 || optlen > 40) {
1712 				code = &cp[IPOPT_OLEN] - (u_char *)ip;
1713 				goto bad;
1714 			}
1715 			if ((off = cp[IPOPT_OFFSET]) < 5) {
1716 				code = &cp[IPOPT_OLEN] - (u_char *)ip;
1717 				goto bad;
1718 			}
1719 			if (off > optlen - (int)sizeof(int32_t)) {
1720 				cp[IPOPT_OFFSET + 1] += (1 << 4);
1721 				if ((cp[IPOPT_OFFSET + 1] & 0xf0) == 0) {
1722 					code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1723 					goto bad;
1724 				}
1725 				break;
1726 			}
1727 			off--;				/* 0 origin */
1728 			sin = (struct in_addr *)(cp + off);
1729 			switch (cp[IPOPT_OFFSET + 1] & 0x0f) {
1730 
1731 			case IPOPT_TS_TSONLY:
1732 				break;
1733 
1734 			case IPOPT_TS_TSANDADDR:
1735 				if (off + sizeof(n_time) +
1736 				    sizeof(struct in_addr) > optlen) {
1737 					code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1738 					goto bad;
1739 				}
1740 				ipaddr.sin_addr = dst;
1741 				ia = (INA)ifaof_ifpforaddr((SA)&ipaddr,
1742 							    m->m_pkthdr.rcvif);
1743 				if (ia == NULL)
1744 					continue;
1745 				memcpy(sin, &IA_SIN(ia)->sin_addr,
1746 				    sizeof(struct in_addr));
1747 				cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1748 				off += sizeof(struct in_addr);
1749 				break;
1750 
1751 			case IPOPT_TS_PRESPEC:
1752 				if (off + sizeof(n_time) +
1753 				    sizeof(struct in_addr) > optlen) {
1754 					code = &cp[IPOPT_OFFSET] - (u_char *)ip;
1755 					goto bad;
1756 				}
1757 				memcpy(&ipaddr.sin_addr, sin,
1758 				    sizeof(struct in_addr));
1759 				if (ifa_ifwithaddr((SA)&ipaddr) == NULL)
1760 					continue;
1761 				cp[IPOPT_OFFSET] += sizeof(struct in_addr);
1762 				off += sizeof(struct in_addr);
1763 				break;
1764 
1765 			default:
1766 				code = &cp[IPOPT_OFFSET + 1] - (u_char *)ip;
1767 				goto bad;
1768 			}
1769 			ntime = iptime();
1770 			memcpy(cp + off, &ntime, sizeof(n_time));
1771 			cp[IPOPT_OFFSET] += sizeof(n_time);
1772 		}
1773 	}
1774 	if (forward && ipforwarding) {
1775 		ip_forward(m, TRUE, next_hop);
1776 		return (1);
1777 	}
1778 	return (0);
1779 bad:
1780 	icmp_error(m, type, code, 0, 0);
1781 	ipstat.ips_badoptions++;
1782 	return (1);
1783 }
1784 
1785 /*
1786  * Given address of next destination (final or next hop),
1787  * return internet address info of interface to be used to get there.
1788  */
1789 struct in_ifaddr *
ip_rtaddr(struct in_addr dst,struct route * ro0)1790 ip_rtaddr(struct in_addr dst, struct route *ro0)
1791 {
1792 	struct route sro, *ro;
1793 	struct sockaddr_in *sin;
1794 	struct in_ifaddr *ia;
1795 
1796 	if (ro0 != NULL) {
1797 		ro = ro0;
1798 	} else {
1799 		bzero(&sro, sizeof(sro));
1800 		ro = &sro;
1801 	}
1802 
1803 	sin = (struct sockaddr_in *)&ro->ro_dst;
1804 
1805 	if (ro->ro_rt == NULL || dst.s_addr != sin->sin_addr.s_addr) {
1806 		if (ro->ro_rt != NULL) {
1807 			RTFREE(ro->ro_rt);
1808 			ro->ro_rt = NULL;
1809 		}
1810 		sin->sin_family = AF_INET;
1811 		sin->sin_len = sizeof *sin;
1812 		sin->sin_addr = dst;
1813 		rtalloc_ign(ro, RTF_PRCLONING);
1814 	}
1815 
1816 	if (ro->ro_rt == NULL)
1817 		return (NULL);
1818 
1819 	ia = ifatoia(ro->ro_rt->rt_ifa);
1820 
1821 	if (ro == &sro)
1822 		RTFREE(ro->ro_rt);
1823 	return ia;
1824 }
1825 
1826 /*
1827  * Save incoming source route for use in replies,
1828  * to be picked up later by ip_srcroute if the receiver is interested.
1829  */
1830 static void
save_rte(struct mbuf * m,u_char * option,struct in_addr dst)1831 save_rte(struct mbuf *m, u_char *option, struct in_addr dst)
1832 {
1833 	struct m_tag *mtag;
1834 	struct ip_srcrt_opt *opt;
1835 	unsigned olen;
1836 
1837 	mtag = m_tag_get(PACKET_TAG_IPSRCRT, sizeof(*opt), M_NOWAIT);
1838 	if (mtag == NULL)
1839 		return;
1840 	opt = m_tag_data(mtag);
1841 
1842 	olen = option[IPOPT_OLEN];
1843 #ifdef DIAGNOSTIC
1844 	if (ipprintfs)
1845 		kprintf("save_rte: olen %d\n", olen);
1846 #endif
1847 	if (olen > sizeof(opt->ip_srcrt) - (1 + sizeof(dst))) {
1848 		m_tag_free(mtag);
1849 		return;
1850 	}
1851 	bcopy(option, opt->ip_srcrt.srcopt, olen);
1852 	opt->ip_nhops = (olen - IPOPT_OFFSET - 1) / sizeof(struct in_addr);
1853 	opt->ip_srcrt.dst = dst;
1854 	m_tag_prepend(m, mtag);
1855 }
1856 
1857 /*
1858  * Retrieve incoming source route for use in replies,
1859  * in the same form used by setsockopt.
1860  * The first hop is placed before the options, will be removed later.
1861  */
1862 struct mbuf *
ip_srcroute(struct mbuf * m0)1863 ip_srcroute(struct mbuf *m0)
1864 {
1865 	struct in_addr *p, *q;
1866 	struct mbuf *m;
1867 	struct m_tag *mtag;
1868 	struct ip_srcrt_opt *opt;
1869 
1870 	if (m0 == NULL)
1871 		return NULL;
1872 
1873 	mtag = m_tag_find(m0, PACKET_TAG_IPSRCRT, NULL);
1874 	if (mtag == NULL)
1875 		return NULL;
1876 	opt = m_tag_data(mtag);
1877 
1878 	if (opt->ip_nhops == 0)
1879 		return (NULL);
1880 	m = m_get(M_NOWAIT, MT_HEADER);
1881 	if (m == NULL)
1882 		return (NULL);
1883 
1884 #define	OPTSIZ	(sizeof(opt->ip_srcrt.nop) + sizeof(opt->ip_srcrt.srcopt))
1885 
1886 	/* length is (nhops+1)*sizeof(addr) + sizeof(nop + srcrt header) */
1887 	m->m_len = opt->ip_nhops * sizeof(struct in_addr) +
1888 		   sizeof(struct in_addr) + OPTSIZ;
1889 #ifdef DIAGNOSTIC
1890 	if (ipprintfs) {
1891 		kprintf("ip_srcroute: nhops %d mlen %d",
1892 			opt->ip_nhops, m->m_len);
1893 	}
1894 #endif
1895 
1896 	/*
1897 	 * First save first hop for return route
1898 	 */
1899 	p = &opt->ip_srcrt.route[opt->ip_nhops - 1];
1900 	*(mtod(m, struct in_addr *)) = *p--;
1901 #ifdef DIAGNOSTIC
1902 	if (ipprintfs)
1903 		kprintf(" hops %x", ntohl(mtod(m, struct in_addr *)->s_addr));
1904 #endif
1905 
1906 	/*
1907 	 * Copy option fields and padding (nop) to mbuf.
1908 	 */
1909 	opt->ip_srcrt.nop = IPOPT_NOP;
1910 	opt->ip_srcrt.srcopt[IPOPT_OFFSET] = IPOPT_MINOFF;
1911 	memcpy(mtod(m, caddr_t) + sizeof(struct in_addr), &opt->ip_srcrt.nop,
1912 	    OPTSIZ);
1913 	q = (struct in_addr *)(mtod(m, caddr_t) +
1914 	    sizeof(struct in_addr) + OPTSIZ);
1915 #undef OPTSIZ
1916 	/*
1917 	 * Record return path as an IP source route,
1918 	 * reversing the path (pointers are now aligned).
1919 	 */
1920 	while (p >= opt->ip_srcrt.route) {
1921 #ifdef DIAGNOSTIC
1922 		if (ipprintfs)
1923 			kprintf(" %x", ntohl(q->s_addr));
1924 #endif
1925 		*q++ = *p--;
1926 	}
1927 	/*
1928 	 * Last hop goes to final destination.
1929 	 */
1930 	*q = opt->ip_srcrt.dst;
1931 	m_tag_delete(m0, mtag);
1932 #ifdef DIAGNOSTIC
1933 	if (ipprintfs)
1934 		kprintf(" %x\n", ntohl(q->s_addr));
1935 #endif
1936 	return (m);
1937 }
1938 
1939 /*
1940  * Strip out IP options.
1941  */
1942 void
ip_stripoptions(struct mbuf * m)1943 ip_stripoptions(struct mbuf *m)
1944 {
1945 	int datalen;
1946 	struct ip *ip = mtod(m, struct ip *);
1947 	caddr_t opts;
1948 	int optlen;
1949 
1950 	optlen = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
1951 	opts = (caddr_t)(ip + 1);
1952 	datalen = m->m_len - (sizeof(struct ip) + optlen);
1953 	bcopy(opts + optlen, opts, datalen);
1954 	m->m_len -= optlen;
1955 	if (m->m_flags & M_PKTHDR)
1956 		m->m_pkthdr.len -= optlen;
1957 	/* leave ip version intact */
1958 	ip->ip_len = htons(ntohs(ip->ip_len) - optlen);
1959 	ip->ip_vhl = IP_MAKE_VHL(IP_VHL_V(ip->ip_vhl), sizeof(struct ip) >> 2);
1960 }
1961 
1962 u_char inetctlerrmap[PRC_NCMDS] = {
1963 	0,		0,		0,		0,
1964 	0,		EMSGSIZE,	EHOSTDOWN,	EHOSTUNREACH,
1965 	EHOSTUNREACH,	EHOSTUNREACH,	ECONNREFUSED,	ECONNREFUSED,
1966 	EMSGSIZE,	EHOSTUNREACH,	0,		0,
1967 	0,		0,		0,		0,
1968 	ENOPROTOOPT,	ECONNREFUSED
1969 };
1970 
1971 /*
1972  * Forward a packet.  If some error occurs return the sender
1973  * an icmp packet.  Note we can't always generate a meaningful
1974  * icmp message because icmp doesn't have a large enough repertoire
1975  * of codes and types.
1976  *
1977  * If not forwarding, just drop the packet.  This could be confusing
1978  * if ipforwarding was zero but some routing protocol was advancing
1979  * us as a gateway to somewhere.  However, we must let the routing
1980  * protocol deal with that.
1981  *
1982  * The using_srcrt parameter indicates whether the packet is being forwarded
1983  * via a source route.
1984  */
1985 void
ip_forward(struct mbuf * m,boolean_t using_srcrt,struct sockaddr_in * next_hop)1986 ip_forward(struct mbuf *m, boolean_t using_srcrt, struct sockaddr_in *next_hop)
1987 {
1988 	struct ip *ip = mtod(m, struct ip *);
1989 	struct rtentry *rt;
1990 	struct route fwd_ro;
1991 	int error, type = 0, code = 0, destmtu = 0;
1992 	struct mbuf *mcopy, *mtemp = NULL;
1993 	n_long dest;
1994 	struct in_addr pkt_dst;
1995 
1996 	dest = INADDR_ANY;
1997 	/*
1998 	 * Cache the destination address of the packet; this may be
1999 	 * changed by use of 'ipfw fwd'.
2000 	 */
2001 	pkt_dst = (next_hop != NULL) ? next_hop->sin_addr : ip->ip_dst;
2002 
2003 #ifdef DIAGNOSTIC
2004 	if (ipprintfs)
2005 		kprintf("forward: src %x dst %x ttl %x\n",
2006 		       ip->ip_src.s_addr, pkt_dst.s_addr, ip->ip_ttl);
2007 #endif
2008 
2009 	if ((m->m_flags & M_HASH) == 0) {
2010 		lwkt_port_t port;
2011 
2012 		m = ip_rehashm(m);
2013 		if (m == NULL)
2014 			return;
2015 
2016 		port = netisr_hashport(m->m_pkthdr.hash);
2017 
2018 		if (port != &curthread->td_msgport) {
2019 			ip_forward_redispatch(port, m, using_srcrt);
2020 			/* Requeued to other msgport; done */
2021 			return;
2022 		}
2023 	}
2024 	if (m->m_flags & (M_BCAST | M_MCAST) || !in_canforward(pkt_dst)) {
2025 		ipstat.ips_cantforward++;
2026 		m_freem(m);
2027 		return;
2028 	}
2029 	if (!ipstealth && ip->ip_ttl <= IPTTLDEC) {
2030 		icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, dest, 0);
2031 		return;
2032 	}
2033 
2034 	bzero(&fwd_ro, sizeof(fwd_ro));
2035 	ip_rtaddr(pkt_dst, &fwd_ro);
2036 	if (fwd_ro.ro_rt == NULL) {
2037 		icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, dest, 0);
2038 		return;
2039 	}
2040 	rt = fwd_ro.ro_rt;
2041 
2042 	if (curthread->td_type == TD_TYPE_NETISR) {
2043 		/*
2044 		 * Save the IP header and at most 8 bytes of the payload,
2045 		 * in case we need to generate an ICMP message to the src.
2046 		 */
2047 		mtemp = ipforward_mtemp[mycpuid];
2048 		KASSERT((mtemp->m_flags & M_EXT) == 0 &&
2049 		    mtemp->m_data == mtemp->m_pktdat &&
2050 		    m_tag_first(mtemp) == NULL,
2051 		    ("ip_forward invalid mtemp1"));
2052 
2053 		if (!m_dup_pkthdr(mtemp, m, M_NOWAIT)) {
2054 			/*
2055 			 * It's probably ok if the pkthdr dup fails (because
2056 			 * the deep copy of the tag chain failed), but for now
2057 			 * be conservative and just discard the copy since
2058 			 * code below may some day want the tags.
2059 			 */
2060 			mtemp = NULL;
2061 		} else {
2062 			mtemp->m_type = m->m_type;
2063 			mtemp->m_len = imin((IP_VHL_HL(ip->ip_vhl) << 2) + 8,
2064 					    (int)ntohs(ip->ip_len));
2065 			mtemp->m_pkthdr.len = mtemp->m_len;
2066 			m_copydata(m, 0, mtemp->m_len, mtod(mtemp, void *));
2067 		}
2068 	}
2069 
2070 	if (!ipstealth)
2071 		ip->ip_ttl -= IPTTLDEC;
2072 
2073 	/*
2074 	 * If forwarding packet using same interface that it came in on,
2075 	 * perhaps should send a redirect to sender to shortcut a hop.
2076 	 * Only send redirect if source is sending directly to us,
2077 	 * and if packet was not source routed (or has any options).
2078 	 * Also, don't send redirect if forwarding using a default route
2079 	 * or a route modified by a redirect.
2080 	 */
2081 	if (rt->rt_ifp == m->m_pkthdr.rcvif &&
2082 	    !(rt->rt_flags & (RTF_DYNAMIC | RTF_MODIFIED)) &&
2083 	    satosin(rt_key(rt))->sin_addr.s_addr != INADDR_ANY &&
2084 	    ipsendredirects && !using_srcrt && next_hop == NULL) {
2085 		u_long src = ntohl(ip->ip_src.s_addr);
2086 		struct in_ifaddr *rt_ifa = (struct in_ifaddr *)rt->rt_ifa;
2087 
2088 		if (rt_ifa != NULL &&
2089 		    (src & rt_ifa->ia_subnetmask) == rt_ifa->ia_subnet) {
2090 			if (rt->rt_flags & RTF_GATEWAY)
2091 				dest = satosin(rt->rt_gateway)->sin_addr.s_addr;
2092 			else
2093 				dest = pkt_dst.s_addr;
2094 			/*
2095 			 * Router requirements says to only send
2096 			 * host redirects.
2097 			 */
2098 			type = ICMP_REDIRECT;
2099 			code = ICMP_REDIRECT_HOST;
2100 #ifdef DIAGNOSTIC
2101 			if (ipprintfs)
2102 				kprintf("redirect (%d) to %x\n", code, dest);
2103 #endif
2104 		}
2105 	}
2106 
2107 	error = ip_output(m, NULL, &fwd_ro, IP_FORWARDING, NULL, NULL);
2108 	if (error == 0) {
2109 		ipstat.ips_forward++;
2110 		if (type == 0) {
2111 			if (mtemp)
2112 				ipflow_create(&fwd_ro, mtemp);
2113 			goto done;
2114 		}
2115 		ipstat.ips_redirectsent++;
2116 	} else {
2117 		ipstat.ips_cantforward++;
2118 	}
2119 
2120 	if (mtemp == NULL)
2121 		goto done;
2122 
2123 	/*
2124 	 * Errors that do not require generating ICMP message
2125 	 */
2126 	switch (error) {
2127 	case ENOBUFS:
2128 		/*
2129 		 * A router should not generate ICMP_SOURCEQUENCH as
2130 		 * required in RFC1812 Requirements for IP Version 4 Routers.
2131 		 * Source quench could be a big problem under DoS attacks,
2132 		 * or if the underlying interface is rate-limited.
2133 		 * Those who need source quench packets may re-enable them
2134 		 * via the net.inet.ip.sendsourcequench sysctl.
2135 		 */
2136 		if (!ip_sendsourcequench)
2137 			goto done;
2138 		break;
2139 
2140 	case EACCES:			/* ipfw denied packet */
2141 		goto done;
2142 	}
2143 
2144 	KASSERT((mtemp->m_flags & M_EXT) == 0 &&
2145 	    mtemp->m_data == mtemp->m_pktdat,
2146 	    ("ip_forward invalid mtemp2"));
2147 	mcopy = m_copym(mtemp, 0, mtemp->m_len, M_NOWAIT);
2148 	if (mcopy == NULL)
2149 		goto done;
2150 
2151 	/*
2152 	 * Send ICMP message.
2153 	 */
2154 	switch (error) {
2155 	case 0:				/* forwarded, but need redirect */
2156 		/* type, code set above */
2157 		break;
2158 
2159 	case ENETUNREACH:		/* shouldn't happen, checked above */
2160 	case EHOSTUNREACH:
2161 	case ENETDOWN:
2162 	case EHOSTDOWN:
2163 	default:
2164 		type = ICMP_UNREACH;
2165 		code = ICMP_UNREACH_HOST;
2166 		break;
2167 
2168 	case EMSGSIZE:
2169 		type = ICMP_UNREACH;
2170 		code = ICMP_UNREACH_NEEDFRAG;
2171 		if (fwd_ro.ro_rt != NULL)
2172 			destmtu = fwd_ro.ro_rt->rt_ifp->if_mtu;
2173 		ipstat.ips_cantfrag++;
2174 		break;
2175 
2176 	case ENOBUFS:
2177 		type = ICMP_SOURCEQUENCH;
2178 		code = 0;
2179 		break;
2180 
2181 	case EACCES:			/* ipfw denied packet */
2182 		panic("ip_forward EACCES should not reach");
2183 	}
2184 	icmp_error(mcopy, type, code, dest, destmtu);
2185 done:
2186 	if (mtemp != NULL)
2187 		m_tag_delete_chain(mtemp);
2188 	if (fwd_ro.ro_rt != NULL)
2189 		RTFREE(fwd_ro.ro_rt);
2190 }
2191 
2192 void
ip_savecontrol(struct inpcb * inp,struct mbuf ** mp,struct ip * ip,struct mbuf * m)2193 ip_savecontrol(struct inpcb *inp, struct mbuf **mp, struct ip *ip,
2194 	       struct mbuf *m)
2195 {
2196 	if (inp->inp_socket->so_options & SO_TIMESTAMP) {
2197 		struct timeval tv;
2198 
2199 		microtime(&tv);
2200 		*mp = sbcreatecontrol(&tv, sizeof(tv),
2201 		    SCM_TIMESTAMP, SOL_SOCKET);
2202 		if (*mp)
2203 			mp = &(*mp)->m_next;
2204 	}
2205 	if (inp->inp_flags & INP_RECVDSTADDR) {
2206 		*mp = sbcreatecontrol(&ip->ip_dst, sizeof(struct in_addr),
2207 		    IP_RECVDSTADDR, IPPROTO_IP);
2208 		if (*mp)
2209 			mp = &(*mp)->m_next;
2210 	}
2211 	if (inp->inp_flags & INP_RECVTTL) {
2212 		*mp = sbcreatecontrol(&ip->ip_ttl, sizeof(u_char),
2213 		    IP_RECVTTL, IPPROTO_IP);
2214 		if (*mp)
2215 			mp = &(*mp)->m_next;
2216 	}
2217 	if (inp->inp_flags & INP_RECVTOS) {
2218 		*mp = sbcreatecontrol(&ip->ip_tos, sizeof(u_char),
2219 		    IP_RECVTOS, IPPROTO_IP);
2220 		if (*mp)
2221 			mp = &(*mp)->m_next;
2222 	}
2223 #ifdef notyet
2224 	/* XXX
2225 	 * Moving these out of udp_input() made them even more broken
2226 	 * than they already were.
2227 	 */
2228 	/* options were tossed already */
2229 	if (inp->inp_flags & INP_RECVOPTS) {
2230 		*mp = sbcreatecontrol(opts_deleted_above,
2231 		    sizeof(struct in_addr), IP_RECVOPTS, IPPROTO_IP);
2232 		if (*mp)
2233 			mp = &(*mp)->m_next;
2234 	}
2235 	/* ip_srcroute doesn't do what we want here, need to fix */
2236 	if (inp->inp_flags & INP_RECVRETOPTS) {
2237 		*mp = sbcreatecontrol(ip_srcroute(m), sizeof(struct in_addr),
2238 		    IP_RECVRETOPTS, IPPROTO_IP);
2239 		if (*mp)
2240 			mp = &(*mp)->m_next;
2241 	}
2242 #endif
2243 	if (inp->inp_flags & INP_RECVIF) {
2244 		struct ifnet *ifp;
2245 		struct sdlbuf {
2246 			struct sockaddr_dl sdl;
2247 			u_char	pad[32];
2248 		} sdlbuf;
2249 		struct sockaddr_dl *sdp;
2250 		struct sockaddr_dl *sdl2 = &sdlbuf.sdl;
2251 
2252 		if (((ifp = m->m_pkthdr.rcvif)) &&
2253 		    ((ifp->if_index != 0) && (ifp->if_index <= if_index))) {
2254 			sdp = IF_LLSOCKADDR(ifp);
2255 			/*
2256 			 * Change our mind and don't try copy.
2257 			 */
2258 			if ((sdp->sdl_family != AF_LINK) ||
2259 			    (sdp->sdl_len > sizeof(sdlbuf))) {
2260 				goto makedummy;
2261 			}
2262 			bcopy(sdp, sdl2, sdp->sdl_len);
2263 		} else {
2264 makedummy:
2265 			sdl2->sdl_len =
2266 			    offsetof(struct sockaddr_dl, sdl_data[0]);
2267 			sdl2->sdl_family = AF_LINK;
2268 			sdl2->sdl_index = 0;
2269 			sdl2->sdl_nlen = sdl2->sdl_alen = sdl2->sdl_slen = 0;
2270 		}
2271 		*mp = sbcreatecontrol(sdl2, sdl2->sdl_len,
2272 		    IP_RECVIF, IPPROTO_IP);
2273 		if (*mp)
2274 			mp = &(*mp)->m_next;
2275 	}
2276 }
2277 
2278 /*
2279  * XXX these routines are called from the upper part of the kernel.
2280  *
2281  * They could also be moved to ip_mroute.c, since all the RSVP
2282  *  handling is done there already.
2283  */
2284 int
ip_rsvp_init(struct socket * so)2285 ip_rsvp_init(struct socket *so)
2286 {
2287 	if (so->so_type != SOCK_RAW ||
2288 	    so->so_proto->pr_protocol != IPPROTO_RSVP)
2289 		return EOPNOTSUPP;
2290 
2291 	if (ip_rsvpd != NULL)
2292 		return EADDRINUSE;
2293 
2294 	ip_rsvpd = so;
2295 	/*
2296 	 * This may seem silly, but we need to be sure we don't over-increment
2297 	 * the RSVP counter, in case something slips up.
2298 	 */
2299 	if (!ip_rsvp_on) {
2300 		ip_rsvp_on = 1;
2301 		rsvp_on++;
2302 	}
2303 
2304 	return 0;
2305 }
2306 
2307 int
ip_rsvp_done(void)2308 ip_rsvp_done(void)
2309 {
2310 	ip_rsvpd = NULL;
2311 	/*
2312 	 * This may seem silly, but we need to be sure we don't over-decrement
2313 	 * the RSVP counter, in case something slips up.
2314 	 */
2315 	if (ip_rsvp_on) {
2316 		ip_rsvp_on = 0;
2317 		rsvp_on--;
2318 	}
2319 	return 0;
2320 }
2321 
2322 int
rsvp_input(struct mbuf ** mp,int * offp,int proto)2323 rsvp_input(struct mbuf **mp, int *offp, int proto)
2324 {
2325 	struct mbuf *m = *mp;
2326 
2327 	*mp = NULL;
2328 
2329 	if (rsvp_input_p) { /* call the real one if loaded */
2330 		*mp = m;
2331 		rsvp_input_p(mp, offp, proto);
2332 		return(IPPROTO_DONE);
2333 	}
2334 
2335 	/* Can still get packets with rsvp_on = 0 if there is a local member
2336 	 * of the group to which the RSVP packet is addressed.  But in this
2337 	 * case we want to throw the packet away.
2338 	 */
2339 
2340 	if (!rsvp_on) {
2341 		m_freem(m);
2342 		return(IPPROTO_DONE);
2343 	}
2344 
2345 	if (ip_rsvpd != NULL) {
2346 		*mp = m;
2347 		rip_input(mp, offp, proto);
2348 		return(IPPROTO_DONE);
2349 	}
2350 	/* Drop the packet */
2351 	m_freem(m);
2352 	return(IPPROTO_DONE);
2353 }
2354