sys/netinet/ip_output.c

   1 /*
   2  * Copyright (c) 1982, 1986, 1988, 1990, 1993
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. Neither the name of the University nor the names of its contributors
  14  *    may be used to endorse or promote products derived from this software
  15  *    without specific prior written permission.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  *
  29  *      @(#)ip_output.c 8.3 (Berkeley) 1/21/94
  30  * $FreeBSD: src/sys/netinet/ip_output.c,v 1.99.2.37 2003/04/15 06:44:45 silby Exp $
  31  * $DragonFly: src/sys/netinet/ip_output.c,v 1.66 2008/10/27 10:51:09 sephe Exp $
  32  */
  33
  34 #define _IP_VHL
  35
  36 #include "opt_ipfw.h"
  37 #include "opt_ipdn.h"
  38 #include "opt_ipdivert.h"
  39 #include "opt_ipfilter.h"
  40 #include "opt_ipsec.h"
  41 #include "opt_mbuf_stress_test.h"
  42 #include "opt_mpls.h"
  43
  44 #include <sys/param.h>
  45 #include <sys/systm.h>
  46 #include <sys/kernel.h>
  47 #include <sys/malloc.h>
  48 #include <sys/mbuf.h>
  49 #include <sys/protosw.h>
  50 #include <sys/socket.h>
  51 #include <sys/socketvar.h>
  52 #include <sys/proc.h>
  53 #include <sys/sysctl.h>
  54 #include <sys/thread2.h>
  55 #include <sys/in_cksum.h>
  56 #include <sys/lock.h>
  57
  58 #include <net/if.h>
  59 #include <net/netisr.h>
  60 #include <net/pfil.h>
  61 #include <net/route.h>
  62
  63 #include <netinet/in.h>
  64 #include <netinet/in_systm.h>
  65 #include <netinet/ip.h>
  66 #include <netinet/in_pcb.h>
  67 #include <netinet/in_var.h>
  68 #include <netinet/ip_var.h>
  69
  70 #include <netproto/mpls/mpls_var.h>
  71
  72 static MALLOC_DEFINE(M_IPMOPTS, "ip_moptions", "internet multicast options");
  73
  74 #ifdef IPSEC
  75 #include <netinet6/ipsec.h>
  76 #include <netproto/key/key.h>
  77 #ifdef IPSEC_DEBUG
  78 #include <netproto/key/key_debug.h>
  79 #else
  80 #define KEYDEBUG(lev,arg)
  81 #endif
  82 #endif /*IPSEC*/
  83
  84 #ifdef FAST_IPSEC
  85 #include <netproto/ipsec/ipsec.h>
  86 #include <netproto/ipsec/xform.h>
  87 #include <netproto/ipsec/key.h>
  88 #endif /*FAST_IPSEC*/
  89
  90 #include <net/ipfw/ip_fw.h>
  91 #include <net/dummynet/ip_dummynet.h>
  92
  93 #define print_ip(x, a, y)        kprintf("%s %d.%d.%d.%d%s",\
  94                                 x, (ntohl(a.s_addr)>>24)&0xFF,\
  95                                   (ntohl(a.s_addr)>>16)&0xFF,\
  96                                   (ntohl(a.s_addr)>>8)&0xFF,\
  97                                   (ntohl(a.s_addr))&0xFF, y);
  98
  99 u_short ip_id;
 100
 101 #ifdef MBUF_STRESS_TEST
 102 int mbuf_frag_size = 0;
 103 SYSCTL_INT(_net_inet_ip, OID_AUTO, mbuf_frag_size, CTLFLAG_RW,
 104         &mbuf_frag_size, 0, "Fragment outgoing mbufs to this size");
 105 #endif
 106
 107 static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *);
 108 static struct ifnet *ip_multicast_if(struct in_addr *, int *);
 109 static void     ip_mloopback
 110         (struct ifnet *, struct mbuf *, struct sockaddr_in *, int);
 111 static int      ip_getmoptions
 112         (struct sockopt *, struct ip_moptions *);
 113 static int      ip_pcbopts(int, struct mbuf **, struct mbuf *);
 114 static int      ip_setmoptions
 115         (struct sockopt *, struct ip_moptions **);
 116
 117 int     ip_optcopy(struct ip *, struct ip *);
 118
 119 extern  int route_assert_owner_access;
 120 extern  void db_print_backtrace(void);
 121
 122 extern  struct protosw inetsw[];
 123
 124 static int
 125 ip_localforward(struct mbuf *m, const struct sockaddr_in *dst)
 126 {
 127         struct in_ifaddr_container *iac;
 128
 129         /*
 130          * We need to figure out if we have been forwarded to a local
 131          * socket.  If so, then we should somehow "loop back" to
 132          * ip_input(), and get directed to the PCB as if we had received
 133          * this packet.  This is because it may be difficult to identify
 134          * the packets you want to forward until they are being output
 135          * and have selected an interface (e.g. locally initiated
 136          * packets).  If we used the loopback inteface, we would not be
 137          * able to control what happens as the packet runs through
 138          * ip_input() as it is done through a ISR.
 139          */
 140         LIST_FOREACH(iac, INADDR_HASH(dst->sin_addr.s_addr), ia_hash) {
 141                 /*
 142                  * If the addr to forward to is one of ours, we pretend
 143                  * to be the destination for this packet.
 144                  */
 145                 if (IA_SIN(iac->ia)->sin_addr.s_addr == dst->sin_addr.s_addr)
 146                         break;
 147         }
 148         if (iac != NULL) {
 149                 struct ip *ip = mtod(m, struct ip *);
 150
 151                 if (m->m_pkthdr.rcvif == NULL)
 152                         m->m_pkthdr.rcvif = ifunit("lo0");
 153                 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
 154                         m->m_pkthdr.csum_flags |= CSUM_DATA_VALID |
 155                                                   CSUM_PSEUDO_HDR;
 156                         m->m_pkthdr.csum_data = 0xffff;
 157                 }
 158                 m->m_pkthdr.csum_flags |= CSUM_IP_CHECKED | CSUM_IP_VALID;
 159
 160                 ip->ip_len = htons(ip->ip_len);
 161                 ip->ip_off = htons(ip->ip_off);
 162                 ip_input(m);
 163
 164                 return 1; /* Packet gets forwarded locally */
 165         }
 166         return 0;
 167 }
 168
 169 /*
 170  * IP output.  The packet in mbuf chain m contains a skeletal IP
 171  * header (with len, off, ttl, proto, tos, src, dst).
 172  * The mbuf chain containing the packet will be freed.
 173  * The mbuf opt, if present, will not be freed.
 174  */
 175 int
 176 ip_output(struct mbuf *m0, struct mbuf *opt, struct route *ro,
 177           int flags, struct ip_moptions *imo, struct inpcb *inp)
 178 {
 179         struct ip *ip;
 180         struct ifnet *ifp = NULL;       /* keep compiler happy */
 181         struct mbuf *m;
 182         int hlen = sizeof(struct ip);
 183         int len, error = 0;
 184         struct sockaddr_in *dst = NULL; /* keep compiler happy */
 185         struct in_ifaddr *ia = NULL;
 186         int isbroadcast, sw_csum;
 187         struct in_addr pkt_dst;
 188         struct route iproute;
 189         struct m_tag *mtag;
 190 #ifdef IPSEC
 191         struct secpolicy *sp = NULL;
 192         struct socket *so = inp ? inp->inp_socket : NULL;
 193 #endif
 194 #ifdef FAST_IPSEC
 195         struct secpolicy *sp = NULL;
 196         struct tdb_ident *tdbi;
 197 #endif /* FAST_IPSEC */
 198         struct sockaddr_in *next_hop = NULL;
 199         int src_was_INADDR_ANY = 0;     /* as the name says... */
 200
 201         m = m0;
 202         M_ASSERTPKTHDR(m);
 203
 204         if (ro == NULL) {
 205                 ro = &iproute;
 206                 bzero(ro, sizeof *ro);
 207         } else if (ro->ro_rt != NULL && ro->ro_rt->rt_cpuid != mycpuid) {
 208                 if (flags & IP_DEBUGROUTE) {
 209                         if (route_assert_owner_access) {
 210                                 panic("ip_output: "
 211                                       "rt rt_cpuid %d accessed on cpu %d\n",
 212                                       ro->ro_rt->rt_cpuid, mycpuid);
 213                         } else {
 214                                 kprintf("ip_output: "
 215                                         "rt rt_cpuid %d accessed on cpu %d\n",
 216                                         ro->ro_rt->rt_cpuid, mycpuid);
 217                                 db_print_backtrace();
 218                         }
 219                 }
 220
 221                 /*
 222                  * XXX
 223                  * If the cached rtentry's owner CPU is not the current CPU,
 224                  * then don't touch the cached rtentry (remote free is too
 225                  * expensive in this context); just relocate the route.
 226                  */
 227                 ro = &iproute;
 228                 bzero(ro, sizeof *ro);
 229         }
 230
 231         if (m->m_pkthdr.fw_flags & IPFORWARD_MBUF_TAGGED) {
 232                 /* Next hop */
 233                 mtag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
 234                 KKASSERT(mtag != NULL);
 235                 next_hop = m_tag_data(mtag);
 236         }
 237
 238         if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED) {
 239                 struct dn_pkt *dn_pkt;
 240
 241                 /* Extract info from dummynet tag */
 242                 mtag = m_tag_find(m, PACKET_TAG_DUMMYNET, NULL);
 243                 KKASSERT(mtag != NULL);
 244                 dn_pkt = m_tag_data(mtag);
 245
 246                 /*
 247                  * The packet was already tagged, so part of the
 248                  * processing was already done, and we need to go down.
 249                  * Get the calculated parameters from the tag.
 250                  */
 251                 ifp = dn_pkt->ifp;
 252
 253                 KKASSERT(ro == &iproute);
 254                 *ro = dn_pkt->ro; /* structure copy */
 255                 KKASSERT(ro->ro_rt == NULL || ro->ro_rt->rt_cpuid == mycpuid);
 256
 257                 dst = dn_pkt->dn_dst;
 258                 if (dst == (struct sockaddr_in *)&(dn_pkt->ro.ro_dst)) {
 259                         /* If 'dst' points into dummynet tag, adjust it */
 260                         dst = (struct sockaddr_in *)&(ro->ro_dst);
 261                 }
 262
 263                 ip = mtod(m, struct ip *);
 264                 hlen = IP_VHL_HL(ip->ip_vhl) << 2 ;
 265                 if (ro->ro_rt)
 266                         ia = ifatoia(ro->ro_rt->rt_ifa);
 267                 goto sendit;
 268         }
 269
 270         if (opt) {
 271                 len = 0;
 272                 m = ip_insertoptions(m, opt, &len);
 273                 if (len != 0)
 274                         hlen = len;
 275         }
 276         ip = mtod(m, struct ip *);
 277
 278         /*
 279          * Fill in IP header.
 280          */
 281         if (!(flags & (IP_FORWARDING|IP_RAWOUTPUT))) {
 282                 ip->ip_vhl = IP_MAKE_VHL(IPVERSION, hlen >> 2);
 283                 ip->ip_off &= IP_DF;
 284                 ip->ip_id = ip_newid();
 285                 ipstat.ips_localout++;
 286         } else {
 287                 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
 288         }
 289
 290 reroute:
 291         pkt_dst = next_hop ? next_hop->sin_addr : ip->ip_dst;
 292
 293 #ifdef INVARIANTS
 294         if (IN_MULTICAST(ntohl(pkt_dst.s_addr))) {
 295                 /*
 296                  * XXX
 297                  * Multicast is not MPSAFE yet.  Caller must hold
 298                  * BGL when output a multicast IP packet.
 299                  */
 300                 ASSERT_MP_LOCK_HELD(curthread);
 301         }
 302 #endif
 303
 304         dst = (struct sockaddr_in *)&ro->ro_dst;
 305         /*
 306          * If there is a cached route,
 307          * check that it is to the same destination
 308          * and is still up.  If not, free it and try again.
 309          * The address family should also be checked in case of sharing the
 310          * cache with IPv6.
 311          */
 312         if (ro->ro_rt &&
 313             (!(ro->ro_rt->rt_flags & RTF_UP) ||
 314              dst->sin_family != AF_INET ||
 315              dst->sin_addr.s_addr != pkt_dst.s_addr)) {
 316                 rtfree(ro->ro_rt);
 317                 ro->ro_rt = (struct rtentry *)NULL;
 318         }
 319         if (ro->ro_rt == NULL) {
 320                 bzero(dst, sizeof *dst);
 321                 dst->sin_family = AF_INET;
 322                 dst->sin_len = sizeof *dst;
 323                 dst->sin_addr = pkt_dst;
 324         }
 325         /*
 326          * If routing to interface only,
 327          * short circuit routing lookup.
 328          */
 329         if (flags & IP_ROUTETOIF) {
 330                 if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == NULL &&
 331                     (ia = ifatoia(ifa_ifwithnet(sintosa(dst)))) == NULL) {
 332                         ipstat.ips_noroute++;
 333                         error = ENETUNREACH;
 334                         goto bad;
 335                 }
 336                 ifp = ia->ia_ifp;
 337                 ip->ip_ttl = 1;
 338                 isbroadcast = in_broadcast(dst->sin_addr, ifp);
 339         } else if (IN_MULTICAST(ntohl(pkt_dst.s_addr)) &&
 340                    imo != NULL && imo->imo_multicast_ifp != NULL) {
 341                 /*
 342                  * Bypass the normal routing lookup for multicast
 343                  * packets if the interface is specified.
 344                  */
 345                 ifp = imo->imo_multicast_ifp;
 346                 ia = IFP_TO_IA(ifp);
 347                 isbroadcast = 0;        /* fool gcc */
 348         } else {
 349                 /*
 350                  * If this is the case, we probably don't want to allocate
 351                  * a protocol-cloned route since we didn't get one from the
 352                  * ULP.  This lets TCP do its thing, while not burdening
 353                  * forwarding or ICMP with the overhead of cloning a route.
 354                  * Of course, we still want to do any cloning requested by
 355                  * the link layer, as this is probably required in all cases
 356                  * for correct operation (as it is for ARP).
 357                  */
 358                 if (ro->ro_rt == NULL)
 359                         rtalloc_ign(ro, RTF_PRCLONING);
 360                 if (ro->ro_rt == NULL) {
 361                         ipstat.ips_noroute++;
 362                         error = EHOSTUNREACH;
 363                         goto bad;
 364                 }
 365                 ia = ifatoia(ro->ro_rt->rt_ifa);
 366                 ifp = ro->ro_rt->rt_ifp;
 367                 ro->ro_rt->rt_use++;
 368                 if (ro->ro_rt->rt_flags & RTF_GATEWAY)
 369                         dst = (struct sockaddr_in *)ro->ro_rt->rt_gateway;
 370                 if (ro->ro_rt->rt_flags & RTF_HOST)
 371                         isbroadcast = (ro->ro_rt->rt_flags & RTF_BROADCAST);
 372                 else
 373                         isbroadcast = in_broadcast(dst->sin_addr, ifp);
 374         }
 375         if (IN_MULTICAST(ntohl(pkt_dst.s_addr))) {
 376                 struct in_multi *inm;
 377
 378                 m->m_flags |= M_MCAST;
 379                 /*
 380                  * IP destination address is multicast.  Make sure "dst"
 381                  * still points to the address in "ro".  (It may have been
 382                  * changed to point to a gateway address, above.)
 383                  */
 384                 dst = (struct sockaddr_in *)&ro->ro_dst;
 385                 /*
 386                  * See if the caller provided any multicast options
 387                  */
 388                 if (imo != NULL) {
 389                         ip->ip_ttl = imo->imo_multicast_ttl;
 390                         if (imo->imo_multicast_vif != -1) {
 391                                 ip->ip_src.s_addr =
 392                                     ip_mcast_src ?
 393                                     ip_mcast_src(imo->imo_multicast_vif) :
 394                                     INADDR_ANY;
 395                         }
 396                 } else {
 397                         ip->ip_ttl = IP_DEFAULT_MULTICAST_TTL;
 398                 }
 399                 /*
 400                  * Confirm that the outgoing interface supports multicast.
 401                  */
 402                 if ((imo == NULL) || (imo->imo_multicast_vif == -1)) {
 403                         if (!(ifp->if_flags & IFF_MULTICAST)) {
 404                                 ipstat.ips_noroute++;
 405                                 error = ENETUNREACH;
 406                                 goto bad;
 407                         }
 408                 }
 409                 /*
 410                  * If source address not specified yet, use address
 411                  * of outgoing interface.
 412                  */
 413                 if (ip->ip_src.s_addr == INADDR_ANY) {
 414                         /* Interface may have no addresses. */
 415                         if (ia != NULL)
 416                                 ip->ip_src = IA_SIN(ia)->sin_addr;
 417                 }
 418
 419                 IN_LOOKUP_MULTI(pkt_dst, ifp, inm);
 420                 if (inm != NULL &&
 421                     (imo == NULL || imo->imo_multicast_loop)) {
 422                         /*
 423                          * If we belong to the destination multicast group
 424                          * on the outgoing interface, and the caller did not
 425                          * forbid loopback, loop back a copy.
 426                          */
 427                         ip_mloopback(ifp, m, dst, hlen);
 428                 } else {
 429                         /*
 430                          * If we are acting as a multicast router, perform
 431                          * multicast forwarding as if the packet had just
 432                          * arrived on the interface to which we are about
 433                          * to send.  The multicast forwarding function
 434                          * recursively calls this function, using the
 435                          * IP_FORWARDING flag to prevent infinite recursion.
 436                          *
 437                          * Multicasts that are looped back by ip_mloopback(),
 438                          * above, will be forwarded by the ip_input() routine,
 439                          * if necessary.
 440                          */
 441                         if (ip_mrouter && !(flags & IP_FORWARDING)) {
 442                                 /*
 443                                  * If rsvp daemon is not running, do not
 444                                  * set ip_moptions. This ensures that the packet
 445                                  * is multicast and not just sent down one link
 446                                  * as prescribed by rsvpd.
 447                                  */
 448                                 if (!rsvp_on)
 449                                         imo = NULL;
 450                                 if (ip_mforward &&
 451                                     ip_mforward(ip, ifp, m, imo) != 0) {
 452                                         m_freem(m);
 453                                         goto done;
 454                                 }
 455                         }
 456                 }
 457
 458                 /*
 459                  * Multicasts with a time-to-live of zero may be looped-
 460                  * back, above, but must not be transmitted on a network.
 461                  * Also, multicasts addressed to the loopback interface
 462                  * are not sent -- the above call to ip_mloopback() will
 463                  * loop back a copy if this host actually belongs to the
 464                  * destination group on the loopback interface.
 465                  */
 466                 if (ip->ip_ttl == 0 || ifp->if_flags & IFF_LOOPBACK) {
 467                         m_freem(m);
 468                         goto done;
 469                 }
 470
 471                 goto sendit;
 472         } else {
 473                 m->m_flags &= ~M_MCAST;
 474         }
 475
 476         /*
 477          * If the source address is not specified yet, use the address
 478          * of the outoing interface. In case, keep note we did that, so
 479          * if the the firewall changes the next-hop causing the output
 480          * interface to change, we can fix that.
 481          */
 482         if (ip->ip_src.s_addr == INADDR_ANY || src_was_INADDR_ANY) {
 483                 /* Interface may have no addresses. */
 484                 if (ia != NULL) {
 485                         ip->ip_src = IA_SIN(ia)->sin_addr;
 486                         src_was_INADDR_ANY = 1;
 487                 }
 488         }
 489
 490 #ifdef ALTQ
 491         /*
 492          * Disable packet drop hack.
 493          * Packetdrop should be done by queueing.
 494          */
 495 #else /* !ALTQ */
 496         /*
 497          * Verify that we have any chance at all of being able to queue
 498          *      the packet or packet fragments
 499          */
 500         if ((ifp->if_snd.ifq_len + ip->ip_len / ifp->if_mtu + 1) >=
 501             ifp->if_snd.ifq_maxlen) {
 502                 error = ENOBUFS;
 503                 ipstat.ips_odropped++;
 504                 goto bad;
 505         }
 506 #endif /* !ALTQ */
 507
 508         /*
 509          * Look for broadcast address and
 510          * verify user is allowed to send
 511          * such a packet.
 512          */
 513         if (isbroadcast) {
 514                 if (!(ifp->if_flags & IFF_BROADCAST)) {
 515                         error = EADDRNOTAVAIL;
 516                         goto bad;
 517                 }
 518                 if (!(flags & IP_ALLOWBROADCAST)) {
 519                         error = EACCES;
 520                         goto bad;
 521                 }
 522                 /* don't allow broadcast messages to be fragmented */
 523                 if (ip->ip_len > ifp->if_mtu) {
 524                         error = EMSGSIZE;
 525                         goto bad;
 526                 }
 527                 m->m_flags |= M_BCAST;
 528         } else {
 529                 m->m_flags &= ~M_BCAST;
 530         }
 531
 532 sendit:
 533 #ifdef IPSEC
 534         /* get SP for this packet */
 535         if (so == NULL)
 536                 sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, flags, &error);
 537         else
 538                 sp = ipsec4_getpolicybysock(m, IPSEC_DIR_OUTBOUND, so, &error);
 539
 540         if (sp == NULL) {
 541                 ipsecstat.out_inval++;
 542                 goto bad;
 543         }
 544
 545         error = 0;
 546
 547         /* check policy */
 548         switch (sp->policy) {
 549         case IPSEC_POLICY_DISCARD:
 550                 /*
 551                  * This packet is just discarded.
 552                  */
 553                 ipsecstat.out_polvio++;
 554                 goto bad;
 555
 556         case IPSEC_POLICY_BYPASS:
 557         case IPSEC_POLICY_NONE:
 558                 /* no need to do IPsec. */
 559                 goto skip_ipsec;
 560
 561         case IPSEC_POLICY_IPSEC:
 562                 if (sp->req == NULL) {
 563                         /* acquire a policy */
 564                         error = key_spdacquire(sp);
 565                         goto bad;
 566                 }
 567                 break;
 568
 569         case IPSEC_POLICY_ENTRUST:
 570         default:
 571                 kprintf("ip_output: Invalid policy found. %d\n", sp->policy);
 572         }
 573     {
 574         struct ipsec_output_state state;
 575         bzero(&state, sizeof state);
 576         state.m = m;
 577         if (flags & IP_ROUTETOIF) {
 578                 state.ro = &iproute;
 579                 bzero(&iproute, sizeof iproute);
 580         } else
 581                 state.ro = ro;
 582         state.dst = (struct sockaddr *)dst;
 583
 584         ip->ip_sum = 0;
 585
 586         /*
 587          * XXX
 588          * delayed checksums are not currently compatible with IPsec
 589          */
 590         if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
 591                 in_delayed_cksum(m);
 592                 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
 593         }
 594
 595         ip->ip_len = htons(ip->ip_len);
 596         ip->ip_off = htons(ip->ip_off);
 597
 598         error = ipsec4_output(&state, sp, flags);
 599
 600         m = state.m;
 601         if (flags & IP_ROUTETOIF) {
 602                 /*
 603                  * if we have tunnel mode SA, we may need to ignore
 604                  * IP_ROUTETOIF.
 605                  */
 606                 if (state.ro != &iproute || state.ro->ro_rt != NULL) {
 607                         flags &= ~IP_ROUTETOIF;
 608                         ro = state.ro;
 609                 }
 610         } else
 611                 ro = state.ro;
 612         dst = (struct sockaddr_in *)state.dst;
 613         if (error) {
 614                 /* mbuf is already reclaimed in ipsec4_output. */
 615                 m0 = NULL;
 616                 switch (error) {
 617                 case EHOSTUNREACH:
 618                 case ENETUNREACH:
 619                 case EMSGSIZE:
 620                 case ENOBUFS:
 621                 case ENOMEM:
 622                         break;
 623                 default:
 624                         kprintf("ip4_output (ipsec): error code %d\n", error);
 625                         /*fall through*/
 626                 case ENOENT:
 627                         /* don't show these error codes to the user */
 628                         error = 0;
 629                         break;
 630                 }
 631                 goto bad;
 632         }
 633     }
 634
 635         /* be sure to update variables that are affected by ipsec4_output() */
 636         ip = mtod(m, struct ip *);
 637 #ifdef _IP_VHL
 638         hlen = IP_VHL_HL(ip->ip_vhl) << 2;
 639 #else
 640         hlen = ip->ip_hl << 2;
 641 #endif
 642         if (ro->ro_rt == NULL) {
 643                 if (!(flags & IP_ROUTETOIF)) {
 644                         kprintf("ip_output: "
 645                                 "can't update route after IPsec processing\n");
 646                         error = EHOSTUNREACH;   /*XXX*/
 647                         goto bad;
 648                 }
 649         } else {
 650                 ia = ifatoia(ro->ro_rt->rt_ifa);
 651                 ifp = ro->ro_rt->rt_ifp;
 652         }
 653
 654         /* make it flipped, again. */
 655         ip->ip_len = ntohs(ip->ip_len);
 656         ip->ip_off = ntohs(ip->ip_off);
 657 skip_ipsec:
 658 #endif /*IPSEC*/
 659 #ifdef FAST_IPSEC
 660         /*
 661          * Check the security policy (SP) for the packet and, if
 662          * required, do IPsec-related processing.  There are two
 663          * cases here; the first time a packet is sent through
 664          * it will be untagged and handled by ipsec4_checkpolicy.
 665          * If the packet is resubmitted to ip_output (e.g. after
 666          * AH, ESP, etc. processing), there will be a tag to bypass
 667          * the lookup and related policy checking.
 668          */
 669         mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL);
 670         crit_enter();
 671         if (mtag != NULL) {
 672                 tdbi = (struct tdb_ident *)m_tag_data(mtag);
 673                 sp = ipsec_getpolicy(tdbi, IPSEC_DIR_OUTBOUND);
 674                 if (sp == NULL)
 675                         error = -EINVAL;        /* force silent drop */
 676                 m_tag_delete(m, mtag);
 677         } else {
 678                 sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags,
 679                                         &error, inp);
 680         }
 681         /*
 682          * There are four return cases:
 683          *    sp != NULL                    apply IPsec policy
 684          *    sp == NULL, error == 0        no IPsec handling needed
 685          *    sp == NULL, error == -EINVAL  discard packet w/o error
 686          *    sp == NULL, error != 0        discard packet, report error
 687          */
 688         if (sp != NULL) {
 689                 /* Loop detection, check if ipsec processing already done */
 690                 KASSERT(sp->req != NULL, ("ip_output: no ipsec request"));
 691                 for (mtag = m_tag_first(m); mtag != NULL;
 692                      mtag = m_tag_next(m, mtag)) {
 693                         if (mtag->m_tag_cookie != MTAG_ABI_COMPAT)
 694                                 continue;
 695                         if (mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_DONE &&
 696                             mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED)
 697                                 continue;
 698                         /*
 699                          * Check if policy has an SA associated with it.
 700                          * This can happen when an SP has yet to acquire
 701                          * an SA; e.g. on first reference.  If it occurs,
 702                          * then we let ipsec4_process_packet do its thing.
 703                          */
 704                         if (sp->req->sav == NULL)
 705                                 break;
 706                         tdbi = (struct tdb_ident *)m_tag_data(mtag);
 707                         if (tdbi->spi == sp->req->sav->spi &&
 708                             tdbi->proto == sp->req->sav->sah->saidx.proto &&
 709                             bcmp(&tdbi->dst, &sp->req->sav->sah->saidx.dst,
 710                                  sizeof(union sockaddr_union)) == 0) {
 711                                 /*
 712                                  * No IPsec processing is needed, free
 713                                  * reference to SP.
 714                                  *
 715                                  * NB: null pointer to avoid free at
 716                                  *     done: below.
 717                                  */
 718                                 KEY_FREESP(&sp), sp = NULL;
 719                                 crit_exit();
 720                                 goto spd_done;
 721                         }
 722                 }
 723
 724                 /*
 725                  * Do delayed checksums now because we send before
 726                  * this is done in the normal processing path.
 727                  */
 728                 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
 729                         in_delayed_cksum(m);
 730                         m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
 731                 }
 732
 733                 ip->ip_len = htons(ip->ip_len);
 734                 ip->ip_off = htons(ip->ip_off);
 735
 736                 /* NB: callee frees mbuf */
 737                 error = ipsec4_process_packet(m, sp->req, flags, 0);
 738                 /*
 739                  * Preserve KAME behaviour: ENOENT can be returned
 740                  * when an SA acquire is in progress.  Don't propagate
 741                  * this to user-level; it confuses applications.
 742                  *
 743                  * XXX this will go away when the SADB is redone.
 744                  */
 745                 if (error == ENOENT)
 746                         error = 0;
 747                 crit_exit();
 748                 goto done;
 749         } else {
 750                 crit_exit();
 751
 752                 if (error != 0) {
 753                         /*
 754                          * Hack: -EINVAL is used to signal that a packet
 755                          * should be silently discarded.  This is typically
 756                          * because we asked key management for an SA and
 757                          * it was delayed (e.g. kicked up to IKE).
 758                          */
 759                         if (error == -EINVAL)
 760                                 error = 0;
 761                         goto bad;
 762                 } else {
 763                         /* No IPsec processing for this packet. */
 764                 }
 765 #ifdef notyet
 766                 /*
 767                  * If deferred crypto processing is needed, check that
 768                  * the interface supports it.
 769                  */
 770                 mtag = m_tag_find(m, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL);
 771                 if (mtag != NULL && !(ifp->if_capenable & IFCAP_IPSEC)) {
 772                         /* notify IPsec to do its own crypto */
 773                         ipsp_skipcrypto_unmark((struct tdb_ident *)m_tag_data(mtag));
 774                         error = EHOSTUNREACH;
 775                         goto bad;
 776                 }
 777 #endif
 778         }
 779 spd_done:
 780 #endif /* FAST_IPSEC */
 781
 782         /* We are already being fwd'd from a firewall. */
 783         if (next_hop != NULL)
 784                 goto pass;
 785
 786         /* No pfil hooks */
 787         if (!pfil_has_hooks(&inet_pfil_hook)) {
 788                 if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED) {
 789                         /*
 790                          * Strip dummynet tags from stranded packets
 791                          */
 792                         mtag = m_tag_find(m, PACKET_TAG_DUMMYNET, NULL);
 793                         KKASSERT(mtag != NULL);
 794                         m_tag_delete(m, mtag);
 795                         m->m_pkthdr.fw_flags &= ~DUMMYNET_MBUF_TAGGED;
 796                 }
 797                 goto pass;
 798         }
 799
 800         /*
 801          * IpHack's section.
 802          * - Xlate: translate packet's addr/port (NAT).
 803          * - Firewall: deny/allow/etc.
 804          * - Wrap: fake packet's addr/port <unimpl.>
 805          * - Encapsulate: put it in another IP and send out. <unimp.>
 806          */
 807
 808         /*
 809          * Run through list of hooks for output packets.
 810          */
 811         error = pfil_run_hooks(&inet_pfil_hook, &m, ifp, PFIL_OUT);
 812         if (error != 0 || m == NULL)
 813                 goto done;
 814         ip = mtod(m, struct ip *);
 815
 816         if (m->m_pkthdr.fw_flags & IPFORWARD_MBUF_TAGGED) {
 817                 /*
 818                  * Check dst to make sure it is directly reachable on the
 819                  * interface we previously thought it was.
 820                  * If it isn't (which may be likely in some situations) we have
 821                  * to re-route it (ie, find a route for the next-hop and the
 822                  * associated interface) and set them here. This is nested
 823                  * forwarding which in most cases is undesirable, except where
 824                  * such control is nigh impossible. So we do it here.
 825                  * And I'm babbling.
 826                  */
 827                 mtag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
 828                 KKASSERT(mtag != NULL);
 829                 next_hop = m_tag_data(mtag);
 830
 831                 /*
 832                  * Try local forwarding first
 833                  */
 834                 if (ip_localforward(m, next_hop))
 835                         goto done;
 836
 837                 /*
 838                  * Relocate the route based on next_hop.
 839                  * If the current route is inp's cache, keep it untouched.
 840                  */
 841                 if (ro == &iproute && ro->ro_rt != NULL) {
 842                         RTFREE(ro->ro_rt);
 843                         ro->ro_rt = NULL;
 844                 }
 845                 ro = &iproute;
 846                 bzero(ro, sizeof *ro);
 847
 848                 /*
 849                  * Forwarding to broadcast address is not allowed.
 850                  * XXX Should we follow IP_ROUTETOIF?
 851                  */
 852                 flags &= ~(IP_ALLOWBROADCAST | IP_ROUTETOIF);
 853
 854                 /* We are doing forwarding now */
 855                 flags |= IP_FORWARDING;
 856
 857                 goto reroute;
 858         }
 859
 860         if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED) {
 861                 struct dn_pkt *dn_pkt;
 862
 863                 mtag = m_tag_find(m, PACKET_TAG_DUMMYNET, NULL);
 864                 KKASSERT(mtag != NULL);
 865                 dn_pkt = m_tag_data(mtag);
 866
 867                 /*
 868                  * Under certain cases it is not possible to recalculate
 869                  * 'ro' and 'dst', let alone 'flags', so just save them in
 870                  * dummynet tag and avoid the possible wrong reculcalation
 871                  * when we come back to ip_output() again.
 872                  *
 873                  * All other parameters have been already used and so they
 874                  * are not needed anymore.
 875                  * XXX if the ifp is deleted while a pkt is in dummynet,
 876                  * we are in trouble! (TODO use ifnet_detach_event)
 877                  *
 878                  * We need to copy *ro because for ICMP pkts (and maybe
 879                  * others) the caller passed a pointer into the stack;
 880                  * dst might also be a pointer into *ro so it needs to
 881                  * be updated.
 882                  */
 883                 dn_pkt->ro = *ro;
 884                 if (ro->ro_rt)
 885                         ro->ro_rt->rt_refcnt++;
 886                 if (dst == (struct sockaddr_in *)&ro->ro_dst) {
 887                         /* 'dst' points into 'ro' */
 888                         dst = (struct sockaddr_in *)&(dn_pkt->ro.ro_dst);
 889                 }
 890                 dn_pkt->dn_dst = dst;
 891                 dn_pkt->flags = flags;
 892
 893                 ip_dn_queue(m);
 894                 goto done;
 895         }
 896 pass:
 897         /* 127/8 must not appear on wire - RFC1122. */
 898         if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
 899             (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
 900                 if (!(ifp->if_flags & IFF_LOOPBACK)) {
 901                         ipstat.ips_badaddr++;
 902                         error = EADDRNOTAVAIL;
 903                         goto bad;
 904                 }
 905         }
 906
 907         m->m_pkthdr.csum_flags |= CSUM_IP;
 908         sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_hwassist;
 909         if (sw_csum & CSUM_DELAY_DATA) {
 910                 in_delayed_cksum(m);
 911                 sw_csum &= ~CSUM_DELAY_DATA;
 912         }
 913         m->m_pkthdr.csum_flags &= ifp->if_hwassist;
 914
 915         /*
 916          * If small enough for interface, or the interface will take
 917          * care of the fragmentation for us, can just send directly.
 918          */
 919         if (ip->ip_len <= ifp->if_mtu || ((ifp->if_hwassist & CSUM_FRAGMENT) &&
 920             !(ip->ip_off & IP_DF))) {
 921                 ip->ip_len = htons(ip->ip_len);
 922                 ip->ip_off = htons(ip->ip_off);
 923                 ip->ip_sum = 0;
 924                 if (sw_csum & CSUM_DELAY_IP) {
 925                         if (ip->ip_vhl == IP_VHL_BORING)
 926                                 ip->ip_sum = in_cksum_hdr(ip);
 927                         else
 928                                 ip->ip_sum = in_cksum(m, hlen);
 929                 }
 930
 931                 /* Record statistics for this interface address. */
 932                 if (!(flags & IP_FORWARDING) && ia) {
 933                         ia->ia_ifa.if_opackets++;
 934                         ia->ia_ifa.if_obytes += m->m_pkthdr.len;
 935                 }
 936
 937 #ifdef IPSEC
 938                 /* clean ipsec history once it goes out of the node */
 939                 ipsec_delaux(m);
 940 #endif
 941
 942 #ifdef MBUF_STRESS_TEST
 943                 if (mbuf_frag_size && m->m_pkthdr.len > mbuf_frag_size) {
 944                         struct mbuf *m1, *m2;
 945                         int length, tmp;
 946
 947                         tmp = length = m->m_pkthdr.len;
 948
 949                         while ((length -= mbuf_frag_size) >= 1) {
 950                                 m1 = m_split(m, length, MB_DONTWAIT);
 951                                 if (m1 == NULL)
 952                                         break;
 953                                 m2 = m;
 954                                 while (m2->m_next != NULL)
 955                                         m2 = m2->m_next;
 956                                 m2->m_next = m1;
 957                         }
 958                         m->m_pkthdr.len = tmp;
 959                 }
 960 #endif
 961
 962 #ifdef MPLS
 963                 if (!mpls_output_process(m, ro->ro_rt))
 964                         goto done;
 965 #endif
 966                 error = ifp->if_output(ifp, m, (struct sockaddr *)dst,
 967                                        ro->ro_rt);
 968                 goto done;
 969         }
 970
 971         if (ip->ip_off & IP_DF) {
 972                 error = EMSGSIZE;
 973                 /*
 974                  * This case can happen if the user changed the MTU
 975                  * of an interface after enabling IP on it.  Because
 976                  * most netifs don't keep track of routes pointing to
 977                  * them, there is no way for one to update all its
 978                  * routes when the MTU is changed.
 979                  */
 980                 if ((ro->ro_rt->rt_flags & (RTF_UP | RTF_HOST)) &&
 981                     !(ro->ro_rt->rt_rmx.rmx_locks & RTV_MTU) &&
 982                     (ro->ro_rt->rt_rmx.rmx_mtu > ifp->if_mtu)) {
 983                         ro->ro_rt->rt_rmx.rmx_mtu = ifp->if_mtu;
 984                 }
 985                 ipstat.ips_cantfrag++;
 986                 goto bad;
 987         }
 988
 989         /*
 990          * Too large for interface; fragment if possible. If successful,
 991          * on return, m will point to a list of packets to be sent.
 992          */
 993         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist, sw_csum);
 994         if (error)
 995                 goto bad;
 996         for (; m; m = m0) {
 997                 m0 = m->m_nextpkt;
 998                 m->m_nextpkt = NULL;
 999 #ifdef IPSEC
1000                 /* clean ipsec history once it goes out of the node */
1001                 ipsec_delaux(m);
1002 #endif
1003                 if (error == 0) {
1004                         /* Record statistics for this interface address. */
1005                         if (ia != NULL) {
1006                                 ia->ia_ifa.if_opackets++;
1007                                 ia->ia_ifa.if_obytes += m->m_pkthdr.len;
1008                         }
1009 #ifdef MPLS
1010                         if (!mpls_output_process(m, ro->ro_rt))
1011                                 continue;
1012 #endif
1013                         error = ifp->if_output(ifp, m, (struct sockaddr *)dst,
1014                                                ro->ro_rt);
1015                 } else {
1016                         m_freem(m);
1017                 }
1018         }
1019
1020         if (error == 0)
1021                 ipstat.ips_fragmented++;
1022
1023 done:
1024         if (ro == &iproute && ro->ro_rt != NULL) {
1025                 RTFREE(ro->ro_rt);
1026                 ro->ro_rt = NULL;
1027         }
1028 #ifdef IPSEC
1029         if (sp != NULL) {
1030                 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1031                         kprintf("DP ip_output call free SP:%p\n", sp));
1032                 key_freesp(sp);
1033         }
1034 #endif
1035 #ifdef FAST_IPSEC
1036         if (sp != NULL)
1037                 KEY_FREESP(&sp);
1038 #endif
1039         return (error);
1040 bad:
1041         m_freem(m);
1042         goto done;
1043 }
1044
1045 /*
1046  * Create a chain of fragments which fit the given mtu. m_frag points to the
1047  * mbuf to be fragmented; on return it points to the chain with the fragments.
1048  * Return 0 if no error. If error, m_frag may contain a partially built
1049  * chain of fragments that should be freed by the caller.
1050  *
1051  * if_hwassist_flags is the hw offload capabilities (see if_data.ifi_hwassist)
1052  * sw_csum contains the delayed checksums flags (e.g., CSUM_DELAY_IP).
1053  */
1054 int
1055 ip_fragment(struct ip *ip, struct mbuf **m_frag, int mtu,
1056             u_long if_hwassist_flags, int sw_csum)
1057 {
1058         int error = 0;
1059         int hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1060         int len = (mtu - hlen) & ~7;    /* size of payload in each fragment */
1061         int off;
1062         struct mbuf *m0 = *m_frag;      /* the original packet          */
1063         int firstlen;
1064         struct mbuf **mnext;
1065         int nfrags;
1066
1067         if (ip->ip_off & IP_DF) {       /* Fragmentation not allowed */
1068                 ipstat.ips_cantfrag++;
1069                 return EMSGSIZE;
1070         }
1071
1072         /*
1073          * Must be able to put at least 8 bytes per fragment.
1074          */
1075         if (len < 8)
1076                 return EMSGSIZE;
1077
1078         /*
1079          * If the interface will not calculate checksums on
1080          * fragmented packets, then do it here.
1081          */
1082         if ((m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA) &&
1083             !(if_hwassist_flags & CSUM_IP_FRAGS)) {
1084                 in_delayed_cksum(m0);
1085                 m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
1086         }
1087
1088         if (len > PAGE_SIZE) {
1089                 /*
1090                  * Fragment large datagrams such that each segment
1091                  * contains a multiple of PAGE_SIZE amount of data,
1092                  * plus headers. This enables a receiver to perform
1093                  * page-flipping zero-copy optimizations.
1094                  *
1095                  * XXX When does this help given that sender and receiver
1096                  * could have different page sizes, and also mtu could
1097                  * be less than the receiver's page size ?
1098                  */
1099                 int newlen;
1100                 struct mbuf *m;
1101
1102                 for (m = m0, off = 0; m && (off+m->m_len) <= mtu; m = m->m_next)
1103                         off += m->m_len;
1104
1105                 /*
1106                  * firstlen (off - hlen) must be aligned on an
1107                  * 8-byte boundary
1108                  */
1109                 if (off < hlen)
1110                         goto smart_frag_failure;
1111                 off = ((off - hlen) & ~7) + hlen;
1112                 newlen = (~PAGE_MASK) & mtu;
1113                 if ((newlen + sizeof(struct ip)) > mtu) {
1114                         /* we failed, go back the default */
1115 smart_frag_failure:
1116                         newlen = len;
1117                         off = hlen + len;
1118                 }
1119                 len = newlen;
1120
1121         } else {
1122                 off = hlen + len;
1123         }
1124
1125         firstlen = off - hlen;
1126         mnext = &m0->m_nextpkt;         /* pointer to next packet */
1127
1128         /*
1129          * Loop through length of segment after first fragment,
1130          * make new header and copy data of each part and link onto chain.
1131          * Here, m0 is the original packet, m is the fragment being created.
1132          * The fragments are linked off the m_nextpkt of the original
1133          * packet, which after processing serves as the first fragment.
1134          */
1135         for (nfrags = 1; off < ip->ip_len; off += len, nfrags++) {
1136                 struct ip *mhip;        /* ip header on the fragment */
1137                 struct mbuf *m;
1138                 int mhlen = sizeof(struct ip);
1139
1140                 MGETHDR(m, MB_DONTWAIT, MT_HEADER);
1141                 if (m == NULL) {
1142                         error = ENOBUFS;
1143                         ipstat.ips_odropped++;
1144                         goto done;
1145                 }
1146                 m->m_flags |= (m0->m_flags & M_MCAST) | M_FRAG;
1147                 /*
1148                  * In the first mbuf, leave room for the link header, then
1149                  * copy the original IP header including options. The payload
1150                  * goes into an additional mbuf chain returned by m_copy().
1151                  */
1152                 m->m_data += max_linkhdr;
1153                 mhip = mtod(m, struct ip *);
1154                 *mhip = *ip;
1155                 if (hlen > sizeof(struct ip)) {
1156                         mhlen = ip_optcopy(ip, mhip) + sizeof(struct ip);
1157                         mhip->ip_vhl = IP_MAKE_VHL(IPVERSION, mhlen >> 2);
1158                 }
1159                 m->m_len = mhlen;
1160                 /* XXX do we need to add ip->ip_off below ? */
1161                 mhip->ip_off = ((off - hlen) >> 3) + ip->ip_off;
1162                 if (off + len >= ip->ip_len) {  /* last fragment */
1163                         len = ip->ip_len - off;
1164                         m->m_flags |= M_LASTFRAG;
1165                 } else
1166                         mhip->ip_off |= IP_MF;
1167                 mhip->ip_len = htons((u_short)(len + mhlen));
1168                 m->m_next = m_copy(m0, off, len);
1169                 if (m->m_next == NULL) {                /* copy failed */
1170                         m_free(m);
1171                         error = ENOBUFS;        /* ??? */
1172                         ipstat.ips_odropped++;
1173                         goto done;
1174                 }
1175                 m->m_pkthdr.len = mhlen + len;
1176                 m->m_pkthdr.rcvif = (struct ifnet *)NULL;
1177                 m->m_pkthdr.csum_flags = m0->m_pkthdr.csum_flags;
1178                 mhip->ip_off = htons(mhip->ip_off);
1179                 mhip->ip_sum = 0;
1180                 if (sw_csum & CSUM_DELAY_IP)
1181                         mhip->ip_sum = in_cksum(m, mhlen);
1182                 *mnext = m;
1183                 mnext = &m->m_nextpkt;
1184         }
1185         ipstat.ips_ofragments += nfrags;
1186
1187         /* set first marker for fragment chain */
1188         m0->m_flags |= M_FIRSTFRAG | M_FRAG;
1189         m0->m_pkthdr.csum_data = nfrags;
1190
1191         /*
1192          * Update first fragment by trimming what's been copied out
1193          * and updating header.
1194          */
1195         m_adj(m0, hlen + firstlen - ip->ip_len);
1196         m0->m_pkthdr.len = hlen + firstlen;
1197         ip->ip_len = htons((u_short)m0->m_pkthdr.len);
1198         ip->ip_off |= IP_MF;
1199         ip->ip_off = htons(ip->ip_off);
1200         ip->ip_sum = 0;
1201         if (sw_csum & CSUM_DELAY_IP)
1202                 ip->ip_sum = in_cksum(m0, hlen);
1203
1204 done:
1205         *m_frag = m0;
1206         return error;
1207 }
1208
1209 void
1210 in_delayed_cksum(struct mbuf *m)
1211 {
1212         struct ip *ip;
1213         u_short csum, offset;
1214
1215         ip = mtod(m, struct ip *);
1216         offset = IP_VHL_HL(ip->ip_vhl) << 2 ;
1217         csum = in_cksum_skip(m, ip->ip_len, offset);
1218         if (m->m_pkthdr.csum_flags & CSUM_UDP && csum == 0)
1219                 csum = 0xffff;
1220         offset += m->m_pkthdr.csum_data;        /* checksum offset */
1221
1222         if (offset + sizeof(u_short) > m->m_len) {
1223                 kprintf("delayed m_pullup, m->len: %d  off: %d  p: %d\n",
1224                     m->m_len, offset, ip->ip_p);
1225                 /*
1226                  * XXX
1227                  * this shouldn't happen, but if it does, the
1228                  * correct behavior may be to insert the checksum
1229                  * in the existing chain instead of rearranging it.
1230                  */
1231                 m = m_pullup(m, offset + sizeof(u_short));
1232         }
1233         *(u_short *)(m->m_data + offset) = csum;
1234 }
1235
1236 /*
1237  * Insert IP options into preformed packet.
1238  * Adjust IP destination as required for IP source routing,
1239  * as indicated by a non-zero in_addr at the start of the options.
1240  *
1241  * XXX This routine assumes that the packet has no options in place.
1242  */
1243 static struct mbuf *
1244 ip_insertoptions(struct mbuf *m, struct mbuf *opt, int *phlen)
1245 {
1246         struct ipoption *p = mtod(opt, struct ipoption *);
1247         struct mbuf *n;
1248         struct ip *ip = mtod(m, struct ip *);
1249         unsigned optlen;
1250
1251         optlen = opt->m_len - sizeof p->ipopt_dst;
1252         if (optlen + (u_short)ip->ip_len > IP_MAXPACKET) {
1253                 *phlen = 0;
1254                 return (m);             /* XXX should fail */
1255         }
1256         if (p->ipopt_dst.s_addr)
1257                 ip->ip_dst = p->ipopt_dst;
1258         if (m->m_flags & M_EXT || m->m_data - optlen < m->m_pktdat) {
1259                 MGETHDR(n, MB_DONTWAIT, MT_HEADER);
1260                 if (n == NULL) {
1261                         *phlen = 0;
1262                         return (m);
1263                 }
1264                 n->m_pkthdr.rcvif = (struct ifnet *)NULL;
1265                 n->m_pkthdr.len = m->m_pkthdr.len + optlen;
1266                 m->m_len -= sizeof(struct ip);
1267                 m->m_data += sizeof(struct ip);
1268                 n->m_next = m;
1269                 m = n;
1270                 m->m_len = optlen + sizeof(struct ip);
1271                 m->m_data += max_linkhdr;
1272                 memcpy(mtod(m, void *), ip, sizeof(struct ip));
1273         } else {
1274                 m->m_data -= optlen;
1275                 m->m_len += optlen;
1276                 m->m_pkthdr.len += optlen;
1277                 ovbcopy(ip, mtod(m, caddr_t), sizeof(struct ip));
1278         }
1279         ip = mtod(m, struct ip *);
1280         bcopy(p->ipopt_list, ip + 1, optlen);
1281         *phlen = sizeof(struct ip) + optlen;
1282         ip->ip_vhl = IP_MAKE_VHL(IPVERSION, *phlen >> 2);
1283         ip->ip_len += optlen;
1284         return (m);
1285 }
1286
1287 /*
1288  * Copy options from ip to jp,
1289  * omitting those not copied during fragmentation.
1290  */
1291 int
1292 ip_optcopy(struct ip *ip, struct ip *jp)
1293 {
1294         u_char *cp, *dp;
1295         int opt, optlen, cnt;
1296
1297         cp = (u_char *)(ip + 1);
1298         dp = (u_char *)(jp + 1);
1299         cnt = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
1300         for (; cnt > 0; cnt -= optlen, cp += optlen) {
1301                 opt = cp[0];
1302                 if (opt == IPOPT_EOL)
1303                         break;
1304                 if (opt == IPOPT_NOP) {
1305                         /* Preserve for IP mcast tunnel's LSRR alignment. */
1306                         *dp++ = IPOPT_NOP;
1307                         optlen = 1;
1308                         continue;
1309                 }
1310
1311                 KASSERT(cnt >= IPOPT_OLEN + sizeof *cp,
1312                     ("ip_optcopy: malformed ipv4 option"));
1313                 optlen = cp[IPOPT_OLEN];
1314                 KASSERT(optlen >= IPOPT_OLEN + sizeof *cp && optlen <= cnt,
1315                     ("ip_optcopy: malformed ipv4 option"));
1316
1317                 /* bogus lengths should have been caught by ip_dooptions */
1318                 if (optlen > cnt)
1319                         optlen = cnt;
1320                 if (IPOPT_COPIED(opt)) {
1321                         bcopy(cp, dp, optlen);
1322                         dp += optlen;
1323                 }
1324         }
1325         for (optlen = dp - (u_char *)(jp+1); optlen & 0x3; optlen++)
1326                 *dp++ = IPOPT_EOL;
1327         return (optlen);
1328 }
1329
1330 /*
1331  * IP socket option processing.
1332  */
1333 int
1334 ip_ctloutput(struct socket *so, struct sockopt *sopt)
1335 {
1336         struct  inpcb *inp = so->so_pcb;
1337         int     error, optval;
1338
1339         error = optval = 0;
1340         if (sopt->sopt_level != IPPROTO_IP) {
1341                 return (EINVAL);
1342         }
1343
1344         switch (sopt->sopt_dir) {
1345         case SOPT_SET:
1346                 switch (sopt->sopt_name) {
1347                 case IP_OPTIONS:
1348 #ifdef notyet
1349                 case IP_RETOPTS:
1350 #endif
1351                 {
1352                         struct mbuf *m;
1353                         if (sopt->sopt_valsize > MLEN) {
1354                                 error = EMSGSIZE;
1355                                 break;
1356                         }
1357                         MGET(m, sopt->sopt_td ? MB_WAIT : MB_DONTWAIT, MT_HEADER);
1358                         if (m == NULL) {
1359                                 error = ENOBUFS;
1360                                 break;
1361                         }
1362                         m->m_len = sopt->sopt_valsize;
1363                         error = soopt_to_kbuf(sopt, mtod(m, void *), m->m_len,
1364                                               m->m_len);
1365                         return (ip_pcbopts(sopt->sopt_name, &inp->inp_options,
1366                                            m));
1367                 }
1368
1369                 case IP_TOS:
1370                 case IP_TTL:
1371                 case IP_MINTTL:
1372                 case IP_RECVOPTS:
1373                 case IP_RECVRETOPTS:
1374                 case IP_RECVDSTADDR:
1375                 case IP_RECVIF:
1376                 case IP_RECVTTL:
1377                 case IP_FAITH:
1378                         error = soopt_to_kbuf(sopt, &optval, sizeof optval,
1379                                              sizeof optval);
1380                         if (error)
1381                                 break;
1382                         switch (sopt->sopt_name) {
1383                         case IP_TOS:
1384                                 inp->inp_ip_tos = optval;
1385                                 break;
1386
1387                         case IP_TTL:
1388                                 inp->inp_ip_ttl = optval;
1389                                 break;
1390                         case IP_MINTTL:
1391                                 if (optval > 0 && optval <= MAXTTL)
1392                                         inp->inp_ip_minttl = optval;
1393                                 else
1394                                         error = EINVAL;
1395                                 break;
1396 #define OPTSET(bit) \
1397         if (optval) \
1398                 inp->inp_flags |= bit; \
1399         else \
1400                 inp->inp_flags &= ~bit;
1401
1402                         case IP_RECVOPTS:
1403                                 OPTSET(INP_RECVOPTS);
1404                                 break;
1405
1406                         case IP_RECVRETOPTS:
1407                                 OPTSET(INP_RECVRETOPTS);
1408                                 break;
1409
1410                         case IP_RECVDSTADDR:
1411                                 OPTSET(INP_RECVDSTADDR);
1412                                 break;
1413
1414                         case IP_RECVIF:
1415                                 OPTSET(INP_RECVIF);
1416                                 break;
1417
1418                         case IP_RECVTTL:
1419                                 OPTSET(INP_RECVTTL);
1420                                 break;
1421
1422                         case IP_FAITH:
1423                                 OPTSET(INP_FAITH);
1424                                 break;
1425                         }
1426                         break;
1427 #undef OPTSET
1428
1429                 case IP_MULTICAST_IF:
1430                 case IP_MULTICAST_VIF:
1431                 case IP_MULTICAST_TTL:
1432                 case IP_MULTICAST_LOOP:
1433                 case IP_ADD_MEMBERSHIP:
1434                 case IP_DROP_MEMBERSHIP:
1435                         error = ip_setmoptions(sopt, &inp->inp_moptions);
1436                         break;
1437
1438                 case IP_PORTRANGE:
1439                         error = soopt_to_kbuf(sopt, &optval, sizeof optval,
1440                                             sizeof optval);
1441                         if (error)
1442                                 break;
1443
1444                         switch (optval) {
1445                         case IP_PORTRANGE_DEFAULT:
1446                                 inp->inp_flags &= ~(INP_LOWPORT);
1447                                 inp->inp_flags &= ~(INP_HIGHPORT);
1448                                 break;
1449
1450                         case IP_PORTRANGE_HIGH:
1451                                 inp->inp_flags &= ~(INP_LOWPORT);
1452                                 inp->inp_flags |= INP_HIGHPORT;
1453                                 break;
1454
1455                         case IP_PORTRANGE_LOW:
1456                                 inp->inp_flags &= ~(INP_HIGHPORT);
1457                                 inp->inp_flags |= INP_LOWPORT;
1458                                 break;
1459
1460                         default:
1461                                 error = EINVAL;
1462                                 break;
1463                         }
1464                         break;
1465
1466 #if defined(IPSEC) || defined(FAST_IPSEC)
1467                 case IP_IPSEC_POLICY:
1468                 {
1469                         caddr_t req;
1470                         size_t len = 0;
1471                         int priv;
1472                         struct mbuf *m;
1473                         int optname;
1474
1475                         if ((error = soopt_getm(sopt, &m)) != 0) /* XXX */
1476                                 break;
1477                         soopt_to_mbuf(sopt, m);
1478                         priv = (sopt->sopt_td != NULL &&
1479                                 suser(sopt->sopt_td) != 0) ? 0 : 1;
1480                         req = mtod(m, caddr_t);
1481                         len = m->m_len;
1482                         optname = sopt->sopt_name;
1483                         error = ipsec4_set_policy(inp, optname, req, len, priv);
1484                         m_freem(m);
1485                         break;
1486                 }
1487 #endif /*IPSEC*/
1488
1489                 default:
1490                         error = ENOPROTOOPT;
1491                         break;
1492                 }
1493                 break;
1494
1495         case SOPT_GET:
1496                 switch (sopt->sopt_name) {
1497                 case IP_OPTIONS:
1498                 case IP_RETOPTS:
1499                         if (inp->inp_options)
1500                                 soopt_from_kbuf(sopt, mtod(inp->inp_options,
1501                                                            char *),
1502                                                 inp->inp_options->m_len);
1503                         else
1504                                 sopt->sopt_valsize = 0;
1505                         break;
1506
1507                 case IP_TOS:
1508                 case IP_TTL:
1509                 case IP_MINTTL:
1510                 case IP_RECVOPTS:
1511                 case IP_RECVRETOPTS:
1512                 case IP_RECVDSTADDR:
1513                 case IP_RECVTTL:
1514                 case IP_RECVIF:
1515                 case IP_PORTRANGE:
1516                 case IP_FAITH:
1517                         switch (sopt->sopt_name) {
1518
1519                         case IP_TOS:
1520                                 optval = inp->inp_ip_tos;
1521                                 break;
1522
1523                         case IP_TTL:
1524                                 optval = inp->inp_ip_ttl;
1525                                 break;
1526                         case IP_MINTTL:
1527                                 optval = inp->inp_ip_minttl;
1528                                 break;
1529
1530 #define OPTBIT(bit)     (inp->inp_flags & bit ? 1 : 0)
1531
1532                         case IP_RECVOPTS:
1533                                 optval = OPTBIT(INP_RECVOPTS);
1534                                 break;
1535
1536                         case IP_RECVRETOPTS:
1537                                 optval = OPTBIT(INP_RECVRETOPTS);
1538                                 break;
1539
1540                         case IP_RECVDSTADDR:
1541                                 optval = OPTBIT(INP_RECVDSTADDR);
1542                                 break;
1543
1544                         case IP_RECVTTL:
1545                                 optval = OPTBIT(INP_RECVTTL);
1546                                 break;
1547
1548                         case IP_RECVIF:
1549                                 optval = OPTBIT(INP_RECVIF);
1550                                 break;
1551
1552                         case IP_PORTRANGE:
1553                                 if (inp->inp_flags & INP_HIGHPORT)
1554                                         optval = IP_PORTRANGE_HIGH;
1555                                 else if (inp->inp_flags & INP_LOWPORT)
1556                                         optval = IP_PORTRANGE_LOW;
1557                                 else
1558                                         optval = 0;
1559                                 break;
1560
1561                         case IP_FAITH:
1562                                 optval = OPTBIT(INP_FAITH);
1563                                 break;
1564                         }
1565                         soopt_from_kbuf(sopt, &optval, sizeof optval);
1566                         break;
1567
1568                 case IP_MULTICAST_IF:
1569                 case IP_MULTICAST_VIF:
1570                 case IP_MULTICAST_TTL:
1571                 case IP_MULTICAST_LOOP:
1572                 case IP_ADD_MEMBERSHIP:
1573                 case IP_DROP_MEMBERSHIP:
1574                         error = ip_getmoptions(sopt, inp->inp_moptions);
1575                         break;
1576
1577 #if defined(IPSEC) || defined(FAST_IPSEC)
1578                 case IP_IPSEC_POLICY:
1579                 {
1580                         struct mbuf *m = NULL;
1581                         caddr_t req = NULL;
1582                         size_t len = 0;
1583
1584                         if (m != NULL) {
1585                                 req = mtod(m, caddr_t);
1586                                 len = m->m_len;
1587                         }
1588                         error = ipsec4_get_policy(so->so_pcb, req, len, &m);
1589                         if (error == 0)
1590                                 error = soopt_from_mbuf(sopt, m); /* XXX */
1591                         if (error == 0)
1592                                 m_freem(m);
1593                         break;
1594                 }
1595 #endif /*IPSEC*/
1596
1597                 default:
1598                         error = ENOPROTOOPT;
1599                         break;
1600                 }
1601                 break;
1602         }
1603         return (error);
1604 }
1605
1606 /*
1607  * Set up IP options in pcb for insertion in output packets.
1608  * Store in mbuf with pointer in pcbopt, adding pseudo-option
1609  * with destination address if source routed.
1610  */
1611 static int
1612 ip_pcbopts(int optname, struct mbuf **pcbopt, struct mbuf *m)
1613 {
1614         int cnt, optlen;
1615         u_char *cp;
1616         u_char opt;
1617
1618         /* turn off any old options */
1619         if (*pcbopt)
1620                 m_free(*pcbopt);
1621         *pcbopt = 0;
1622         if (m == NULL || m->m_len == 0) {
1623                 /*
1624                  * Only turning off any previous options.
1625                  */
1626                 if (m != NULL)
1627                         m_free(m);
1628                 return (0);
1629         }
1630
1631         if (m->m_len % sizeof(int32_t))
1632                 goto bad;
1633         /*
1634          * IP first-hop destination address will be stored before
1635          * actual options; move other options back
1636          * and clear it when none present.
1637          */
1638         if (m->m_data + m->m_len + sizeof(struct in_addr) >= &m->m_dat[MLEN])
1639                 goto bad;
1640         cnt = m->m_len;
1641         m->m_len += sizeof(struct in_addr);
1642         cp = mtod(m, u_char *) + sizeof(struct in_addr);
1643         ovbcopy(mtod(m, caddr_t), cp, cnt);
1644         bzero(mtod(m, caddr_t), sizeof(struct in_addr));
1645
1646         for (; cnt > 0; cnt -= optlen, cp += optlen) {
1647                 opt = cp[IPOPT_OPTVAL];
1648                 if (opt == IPOPT_EOL)
1649                         break;
1650                 if (opt == IPOPT_NOP)
1651                         optlen = 1;
1652                 else {
1653                         if (cnt < IPOPT_OLEN + sizeof *cp)
1654                                 goto bad;
1655                         optlen = cp[IPOPT_OLEN];
1656                         if (optlen < IPOPT_OLEN + sizeof *cp || optlen > cnt)
1657                                 goto bad;
1658                 }
1659                 switch (opt) {
1660
1661                 default:
1662                         break;
1663
1664                 case IPOPT_LSRR:
1665                 case IPOPT_SSRR:
1666                         /*
1667                          * user process specifies route as:
1668                          *      ->A->B->C->D
1669                          * D must be our final destination (but we can't
1670                          * check that since we may not have connected yet).
1671                          * A is first hop destination, which doesn't appear in
1672                          * actual IP option, but is stored before the options.
1673                          */
1674                         if (optlen < IPOPT_MINOFF - 1 + sizeof(struct in_addr))
1675                                 goto bad;
1676                         m->m_len -= sizeof(struct in_addr);
1677                         cnt -= sizeof(struct in_addr);
1678                         optlen -= sizeof(struct in_addr);
1679                         cp[IPOPT_OLEN] = optlen;
1680                         /*
1681                          * Move first hop before start of options.
1682                          */
1683                         bcopy(&cp[IPOPT_OFFSET+1], mtod(m, caddr_t),
1684                               sizeof(struct in_addr));
1685                         /*
1686                          * Then copy rest of options back
1687                          * to close up the deleted entry.
1688                          */
1689                         ovbcopy(&cp[IPOPT_OFFSET+1] + sizeof(struct in_addr),
1690                                 &cp[IPOPT_OFFSET+1],
1691                                 cnt - (IPOPT_MINOFF - 1));
1692                         break;
1693                 }
1694         }
1695         if (m->m_len > MAX_IPOPTLEN + sizeof(struct in_addr))
1696                 goto bad;
1697         *pcbopt = m;
1698         return (0);
1699
1700 bad:
1701         m_free(m);
1702         return (EINVAL);
1703 }
1704
1705 /*
1706  * XXX
1707  * The whole multicast option thing needs to be re-thought.
1708  * Several of these options are equally applicable to non-multicast
1709  * transmission, and one (IP_MULTICAST_TTL) totally duplicates a
1710  * standard option (IP_TTL).
1711  */
1712
1713 /*
1714  * following RFC1724 section 3.3, 0.0.0.0/8 is interpreted as interface index.
1715  */
1716 static struct ifnet *
1717 ip_multicast_if(struct in_addr *a, int *ifindexp)
1718 {
1719         int ifindex;
1720         struct ifnet *ifp;
1721
1722         if (ifindexp)
1723                 *ifindexp = 0;
1724         if (ntohl(a->s_addr) >> 24 == 0) {
1725                 ifindex = ntohl(a->s_addr) & 0xffffff;
1726                 if (ifindex < 0 || if_index < ifindex)
1727                         return NULL;
1728                 ifp = ifindex2ifnet[ifindex];
1729                 if (ifindexp)
1730                         *ifindexp = ifindex;
1731         } else {
1732                 ifp = INADDR_TO_IFP(a);
1733         }
1734         return ifp;
1735 }
1736
1737 /*
1738  * Set the IP multicast options in response to user setsockopt().
1739  */
1740 static int
1741 ip_setmoptions(struct sockopt *sopt, struct ip_moptions **imop)
1742 {
1743         int error = 0;
1744         int i;
1745         struct in_addr addr;
1746         struct ip_mreq mreq;
1747         struct ifnet *ifp;
1748         struct ip_moptions *imo = *imop;
1749         int ifindex;
1750
1751         if (imo == NULL) {
1752                 /*
1753                  * No multicast option buffer attached to the pcb;
1754                  * allocate one and initialize to default values.
1755                  */
1756                 imo = kmalloc(sizeof *imo, M_IPMOPTS, M_WAITOK);
1757
1758                 *imop = imo;
1759                 imo->imo_multicast_ifp = NULL;
1760                 imo->imo_multicast_addr.s_addr = INADDR_ANY;
1761                 imo->imo_multicast_vif = -1;
1762                 imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
1763                 imo->imo_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
1764                 imo->imo_num_memberships = 0;
1765         }
1766         switch (sopt->sopt_name) {
1767         /* store an index number for the vif you wanna use in the send */
1768         case IP_MULTICAST_VIF:
1769                 if (legal_vif_num == 0) {
1770                         error = EOPNOTSUPP;
1771                         break;
1772                 }
1773                 error = soopt_to_kbuf(sopt, &i, sizeof i, sizeof i);
1774                 if (error)
1775                         break;
1776                 if (!legal_vif_num(i) && (i != -1)) {
1777                         error = EINVAL;
1778                         break;
1779                 }
1780                 imo->imo_multicast_vif = i;
1781                 break;
1782
1783         case IP_MULTICAST_IF:
1784                 /*
1785                  * Select the interface for outgoing multicast packets.
1786                  */
1787                 error = soopt_to_kbuf(sopt, &addr, sizeof addr, sizeof addr);
1788                 if (error)
1789                         break;
1790
1791                 /*
1792                  * INADDR_ANY is used to remove a previous selection.
1793                  * When no interface is selected, a default one is
1794                  * chosen every time a multicast packet is sent.
1795                  */
1796                 if (addr.s_addr == INADDR_ANY) {
1797                         imo->imo_multicast_ifp = NULL;
1798                         break;
1799                 }
1800                 /*
1801                  * The selected interface is identified by its local
1802                  * IP address.  Find the interface and confirm that
1803                  * it supports multicasting.
1804                  */
1805                 crit_enter();
1806                 ifp = ip_multicast_if(&addr, &ifindex);
1807                 if (ifp == NULL || !(ifp->if_flags & IFF_MULTICAST)) {
1808                         crit_exit();
1809                         error = EADDRNOTAVAIL;
1810                         break;
1811                 }
1812                 imo->imo_multicast_ifp = ifp;
1813                 if (ifindex)
1814                         imo->imo_multicast_addr = addr;
1815                 else
1816                         imo->imo_multicast_addr.s_addr = INADDR_ANY;
1817                 crit_exit();
1818                 break;
1819
1820         case IP_MULTICAST_TTL:
1821                 /*
1822                  * Set the IP time-to-live for outgoing multicast packets.
1823                  * The original multicast API required a char argument,
1824                  * which is inconsistent with the rest of the socket API.
1825                  * We allow either a char or an int.
1826                  */
1827                 if (sopt->sopt_valsize == 1) {
1828                         u_char ttl;
1829                         error = soopt_to_kbuf(sopt, &ttl, 1, 1);
1830                         if (error)
1831                                 break;
1832                         imo->imo_multicast_ttl = ttl;
1833                 } else {
1834                         u_int ttl;
1835                         error = soopt_to_kbuf(sopt, &ttl, sizeof ttl, sizeof ttl);
1836                         if (error)
1837                                 break;
1838                         if (ttl > 255)
1839                                 error = EINVAL;
1840                         else
1841                                 imo->imo_multicast_ttl = ttl;
1842                 }
1843                 break;
1844
1845         case IP_MULTICAST_LOOP:
1846                 /*
1847                  * Set the loopback flag for outgoing multicast packets.
1848                  * Must be zero or one.  The original multicast API required a
1849                  * char argument, which is inconsistent with the rest
1850                  * of the socket API.  We allow either a char or an int.
1851                  */
1852                 if (sopt->sopt_valsize == 1) {
1853                         u_char loop;
1854
1855                         error = soopt_to_kbuf(sopt, &loop, 1, 1);
1856                         if (error)
1857                                 break;
1858                         imo->imo_multicast_loop = !!loop;
1859                 } else {
1860                         u_int loop;
1861
1862                         error = soopt_to_kbuf(sopt, &loop, sizeof loop,
1863                                             sizeof loop);
1864                         if (error)
1865                                 break;
1866                         imo->imo_multicast_loop = !!loop;
1867                 }
1868                 break;
1869
1870         case IP_ADD_MEMBERSHIP:
1871                 /*
1872                  * Add a multicast group membership.
1873                  * Group must be a valid IP multicast address.
1874                  */
1875                 error = soopt_to_kbuf(sopt, &mreq, sizeof mreq, sizeof mreq);
1876                 if (error)
1877                         break;
1878
1879                 if (!IN_MULTICAST(ntohl(mreq.imr_multiaddr.s_addr))) {
1880                         error = EINVAL;
1881                         break;
1882                 }
1883                 crit_enter();
1884                 /*
1885                  * If no interface address was provided, use the interface of
1886                  * the route to the given multicast address.
1887                  */
1888                 if (mreq.imr_interface.s_addr == INADDR_ANY) {
1889                         struct sockaddr_in dst;
1890                         struct rtentry *rt;
1891
1892                         bzero(&dst, sizeof(struct sockaddr_in));
1893                         dst.sin_len = sizeof(struct sockaddr_in);
1894                         dst.sin_family = AF_INET;
1895                         dst.sin_addr = mreq.imr_multiaddr;
1896                         rt = rtlookup((struct sockaddr *)&dst);
1897                         if (rt == NULL) {
1898                                 error = EADDRNOTAVAIL;
1899                                 crit_exit();
1900                                 break;
1901                         }
1902                         --rt->rt_refcnt;
1903                         ifp = rt->rt_ifp;
1904                 } else {
1905                         ifp = ip_multicast_if(&mreq.imr_interface, NULL);
1906                 }
1907
1908                 /*
1909                  * See if we found an interface, and confirm that it
1910                  * supports multicast.
1911                  */
1912                 if (ifp == NULL || !(ifp->if_flags & IFF_MULTICAST)) {
1913                         error = EADDRNOTAVAIL;
1914                         crit_exit();
1915                         break;
1916                 }
1917                 /*
1918                  * See if the membership already exists or if all the
1919                  * membership slots are full.
1920                  */
1921                 for (i = 0; i < imo->imo_num_memberships; ++i) {
1922                         if (imo->imo_membership[i]->inm_ifp == ifp &&
1923                             imo->imo_membership[i]->inm_addr.s_addr
1924                                                 == mreq.imr_multiaddr.s_addr)
1925                                 break;
1926                 }
1927                 if (i < imo->imo_num_memberships) {
1928                         error = EADDRINUSE;
1929                         crit_exit();
1930                         break;
1931                 }
1932                 if (i == IP_MAX_MEMBERSHIPS) {
1933                         error = ETOOMANYREFS;
1934                         crit_exit();
1935                         break;
1936                 }
1937                 /*
1938                  * Everything looks good; add a new record to the multicast
1939                  * address list for the given interface.
1940                  */
1941                 if ((imo->imo_membership[i] =
1942                      in_addmulti(&mreq.imr_multiaddr, ifp)) == NULL) {
1943                         error = ENOBUFS;
1944                         crit_exit();
1945                         break;
1946                 }
1947                 ++imo->imo_num_memberships;
1948                 crit_exit();
1949                 break;
1950
1951         case IP_DROP_MEMBERSHIP:
1952                 /*
1953                  * Drop a multicast group membership.
1954                  * Group must be a valid IP multicast address.
1955                  */
1956                 error = soopt_to_kbuf(sopt, &mreq, sizeof mreq, sizeof mreq);
1957                 if (error)
1958                         break;
1959
1960                 if (!IN_MULTICAST(ntohl(mreq.imr_multiaddr.s_addr))) {
1961                         error = EINVAL;
1962                         break;
1963                 }
1964
1965                 crit_enter();
1966                 /*
1967                  * If an interface address was specified, get a pointer
1968                  * to its ifnet structure.
1969                  */
1970                 if (mreq.imr_interface.s_addr == INADDR_ANY)
1971                         ifp = NULL;
1972                 else {
1973                         ifp = ip_multicast_if(&mreq.imr_interface, NULL);
1974                         if (ifp == NULL) {
1975                                 error = EADDRNOTAVAIL;
1976                                 crit_exit();
1977                                 break;
1978                         }
1979                 }
1980                 /*
1981                  * Find the membership in the membership array.
1982                  */
1983                 for (i = 0; i < imo->imo_num_memberships; ++i) {
1984                         if ((ifp == NULL ||
1985                              imo->imo_membership[i]->inm_ifp == ifp) &&
1986                             imo->imo_membership[i]->inm_addr.s_addr ==
1987                             mreq.imr_multiaddr.s_addr)
1988                                 break;
1989                 }
1990                 if (i == imo->imo_num_memberships) {
1991                         error = EADDRNOTAVAIL;
1992                         crit_exit();
1993                         break;
1994                 }
1995                 /*
1996                  * Give up the multicast address record to which the
1997                  * membership points.
1998                  */
1999                 in_delmulti(imo->imo_membership[i]);
2000                 /*
2001                  * Remove the gap in the membership array.
2002                  */
2003                 for (++i; i < imo->imo_num_memberships; ++i)
2004                         imo->imo_membership[i-1] = imo->imo_membership[i];
2005                 --imo->imo_num_memberships;
2006                 crit_exit();
2007                 break;
2008
2009         default:
2010                 error = EOPNOTSUPP;
2011                 break;
2012         }
2013
2014         /*
2015          * If all options have default values, no need to keep the mbuf.
2016          */
2017         if (imo->imo_multicast_ifp == NULL &&
2018             imo->imo_multicast_vif == -1 &&
2019             imo->imo_multicast_ttl == IP_DEFAULT_MULTICAST_TTL &&
2020             imo->imo_multicast_loop == IP_DEFAULT_MULTICAST_LOOP &&
2021             imo->imo_num_memberships == 0) {
2022                 kfree(*imop, M_IPMOPTS);
2023                 *imop = NULL;
2024         }
2025
2026         return (error);
2027 }
2028
2029 /*
2030  * Return the IP multicast options in response to user getsockopt().
2031  */
2032 static int
2033 ip_getmoptions(struct sockopt *sopt, struct ip_moptions *imo)
2034 {
2035         struct in_addr addr;
2036         struct in_ifaddr *ia;
2037         int error, optval;
2038         u_char coptval;
2039
2040         error = 0;
2041         switch (sopt->sopt_name) {
2042         case IP_MULTICAST_VIF:
2043                 if (imo != NULL)
2044                         optval = imo->imo_multicast_vif;
2045                 else
2046                         optval = -1;
2047                 soopt_from_kbuf(sopt, &optval, sizeof optval);
2048                 break;
2049
2050         case IP_MULTICAST_IF:
2051                 if (imo == NULL || imo->imo_multicast_ifp == NULL)
2052                         addr.s_addr = INADDR_ANY;
2053                 else if (imo->imo_multicast_addr.s_addr) {
2054                         /* return the value user has set */
2055                         addr = imo->imo_multicast_addr;
2056                 } else {
2057                         ia = IFP_TO_IA(imo->imo_multicast_ifp);
2058                         addr.s_addr = (ia == NULL) ? INADDR_ANY
2059                                 : IA_SIN(ia)->sin_addr.s_addr;
2060                 }
2061                 soopt_from_kbuf(sopt, &addr, sizeof addr);
2062                 break;
2063
2064         case IP_MULTICAST_TTL:
2065                 if (imo == NULL)
2066                         optval = coptval = IP_DEFAULT_MULTICAST_TTL;
2067                 else
2068                         optval = coptval = imo->imo_multicast_ttl;
2069                 if (sopt->sopt_valsize == 1)
2070                         soopt_from_kbuf(sopt, &coptval, 1);
2071                 else
2072                         soopt_from_kbuf(sopt, &optval, sizeof optval);
2073                 break;
2074
2075         case IP_MULTICAST_LOOP:
2076                 if (imo == NULL)
2077                         optval = coptval = IP_DEFAULT_MULTICAST_LOOP;
2078                 else
2079                         optval = coptval = imo->imo_multicast_loop;
2080                 if (sopt->sopt_valsize == 1)
2081                         soopt_from_kbuf(sopt, &coptval, 1);
2082                 else
2083                         soopt_from_kbuf(sopt, &optval, sizeof optval);
2084                 break;
2085
2086         default:
2087                 error = ENOPROTOOPT;
2088                 break;
2089         }
2090         return (error);
2091 }
2092
2093 /*
2094  * Discard the IP multicast options.
2095  */
2096 void
2097 ip_freemoptions(struct ip_moptions *imo)
2098 {
2099         int i;
2100
2101         if (imo != NULL) {
2102                 for (i = 0; i < imo->imo_num_memberships; ++i)
2103                         in_delmulti(imo->imo_membership[i]);
2104                 kfree(imo, M_IPMOPTS);
2105         }
2106 }
2107
2108 /*
2109  * Routine called from ip_output() to loop back a copy of an IP multicast
2110  * packet to the input queue of a specified interface.  Note that this
2111  * calls the output routine of the loopback "driver", but with an interface
2112  * pointer that might NOT be a loopback interface -- evil, but easier than
2113  * replicating that code here.
2114  */
2115 static void
2116 ip_mloopback(struct ifnet *ifp, struct mbuf *m, struct sockaddr_in *dst,
2117              int hlen)
2118 {
2119         struct ip *ip;
2120         struct mbuf *copym;
2121
2122         copym = m_copypacket(m, MB_DONTWAIT);
2123         if (copym != NULL && (copym->m_flags & M_EXT || copym->m_len < hlen))
2124                 copym = m_pullup(copym, hlen);
2125         if (copym != NULL) {
2126                 /*
2127                  * if the checksum hasn't been computed, mark it as valid
2128                  */
2129                 if (copym->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
2130                         in_delayed_cksum(copym);
2131                         copym->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
2132                         copym->m_pkthdr.csum_flags |=
2133                             CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
2134                         copym->m_pkthdr.csum_data = 0xffff;
2135                 }
2136                 /*
2137                  * We don't bother to fragment if the IP length is greater
2138                  * than the interface's MTU.  Can this possibly matter?
2139                  */
2140                 ip = mtod(copym, struct ip *);
2141                 ip->ip_len = htons(ip->ip_len);
2142                 ip->ip_off = htons(ip->ip_off);
2143                 ip->ip_sum = 0;
2144                 if (ip->ip_vhl == IP_VHL_BORING) {
2145                         ip->ip_sum = in_cksum_hdr(ip);
2146                 } else {
2147                         ip->ip_sum = in_cksum(copym, hlen);
2148                 }
2149                 /*
2150                  * NB:
2151                  * It's not clear whether there are any lingering
2152                  * reentrancy problems in other areas which might
2153                  * be exposed by using ip_input directly (in
2154                  * particular, everything which modifies the packet
2155                  * in-place).  Yet another option is using the
2156                  * protosw directly to deliver the looped back
2157                  * packet.  For the moment, we'll err on the side
2158                  * of safety by using if_simloop().
2159                  */
2160 #if 1 /* XXX */
2161                 if (dst->sin_family != AF_INET) {
2162                         kprintf("ip_mloopback: bad address family %d\n",
2163                                                 dst->sin_family);
2164                         dst->sin_family = AF_INET;
2165                 }
2166 #endif
2167
2168 #ifdef notdef
2169                 copym->m_pkthdr.rcvif = ifp;
2170                 ip_input(copym);
2171 #else
2172                 if_simloop(ifp, copym, dst->sin_family, 0);
2173 #endif
2174         }
2175 }