2 * Copyright (c) 1982, 1986, 1988, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by the University of
16 * California, Berkeley and its contributors.
17 * 4. Neither the name of the University nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * @(#)raw_ip.c 8.7 (Berkeley) 5/15/95
37 #include "opt_inet6.h"
38 #include "opt_ipsec.h"
40 #include "opt_random_ip_id.h"
42 #include <sys/param.h>
43 #include <sys/kernel.h>
46 #include <sys/malloc.h>
49 #include <sys/protosw.h>
50 #include <sys/signalvar.h>
51 #include <sys/socket.h>
52 #include <sys/socketvar.h>
54 #include <sys/sysctl.h>
55 #include <sys/systm.h>
60 #include <net/route.h>
62 #include <netinet/in.h>
63 #include <netinet/in_systm.h>
64 #include <netinet/in_pcb.h>
65 #include <netinet/in_var.h>
66 #include <netinet/ip.h>
67 #include <netinet/ip_var.h>
68 #include <netinet/ip_mroute.h>
70 #include <netinet/ip_fw.h>
71 #include <netinet/ip_dummynet.h>
74 #include <netipsec/ipsec.h>
78 #include <netinet6/ipsec.h>
81 struct inpcbhead ripcb;
82 struct inpcbinfo ripcbinfo;
84 /* control hooks for ipfw and dummynet */
85 ip_fw_ctl_t *ip_fw_ctl_ptr;
86 ip_dn_ctl_t *ip_dn_ctl_ptr;
89 * hooks for multicast routing. They all default to NULL,
90 * so leave them not initialized and rely on BSS being set to 0.
93 /* The socket used to communicate with the multicast routing daemon. */
94 struct socket *ip_mrouter;
96 /* The various mrouter and rsvp functions */
97 int (*ip_mrouter_set)(struct socket *, struct sockopt *);
98 int (*ip_mrouter_get)(struct socket *, struct sockopt *);
99 int (*ip_mrouter_done)(void);
100 int (*ip_mforward)(struct ip *, struct ifnet *, struct mbuf *,
101 struct ip_moptions *);
102 int (*mrt_ioctl)(int, caddr_t);
103 int (*legal_vif_num)(int);
104 u_long (*ip_mcast_src)(int);
106 void (*rsvp_input_p)(struct mbuf *m, int off);
107 int (*ip_rsvp_vif)(struct socket *, struct sockopt *);
108 void (*ip_rsvp_force_done)(struct socket *);
111 * Nominal space allocated to a raw ip socket.
117 * Raw interface to IP protocol.
121 * Initialize raw connection block q.
126 INP_INFO_LOCK_INIT(&ripcbinfo, "rip");
128 ripcbinfo.listhead = &ripcb;
130 * XXX We don't use the hash list for raw IP, but it's easier
131 * to allocate a one entry hash list than it is to check all
132 * over the place for hashbase == NULL.
134 ripcbinfo.hashbase = hashinit(1, M_PCB, &ripcbinfo.hashmask);
135 ripcbinfo.porthashbase = hashinit(1, M_PCB, &ripcbinfo.porthashmask);
136 ripcbinfo.ipi_zone = uma_zcreate("ripcb", sizeof(struct inpcb),
137 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
138 uma_zone_set_max(ripcbinfo.ipi_zone, maxsockets);
141 static struct sockaddr_in ripsrc = { sizeof(ripsrc), AF_INET };
144 raw_append(struct inpcb *last, struct ip *ip, struct mbuf *n)
148 #if defined(IPSEC) || defined(FAST_IPSEC)
149 /* check AH/ESP integrity. */
150 if (ipsec4_in_reject(n, last)) {
153 ipsecstat.in_polvio++;
155 /* do not inject data to pcb */
157 #endif /*IPSEC || FAST_IPSEC*/
159 if (!policyfail && mac_check_inpcb_deliver(last, n) != 0)
163 struct mbuf *opts = NULL;
165 if ((last->inp_flags & INP_CONTROLOPTS) ||
166 (last->inp_socket->so_options & SO_TIMESTAMP))
167 ip_savecontrol(last, &opts, ip, n);
168 if (sbappendaddr(&last->inp_socket->so_rcv,
169 (struct sockaddr *)&ripsrc, n, opts) == 0) {
170 /* should notify about lost packet */
175 sorwakeup(last->inp_socket);
182 * Setup generic address and protocol structures
183 * for raw_input routine, then pass them along with
187 rip_input(struct mbuf *m, int off)
189 struct ip *ip = mtod(m, struct ip *);
190 int proto = ip->ip_p;
191 struct inpcb *inp, *last;
193 INP_INFO_RLOCK(&ripcbinfo);
194 ripsrc.sin_addr = ip->ip_src;
196 LIST_FOREACH(inp, &ripcb, inp_list) {
198 if (inp->inp_ip_p && inp->inp_ip_p != proto) {
204 if ((inp->inp_vflag & INP_IPV4) == 0)
207 if (inp->inp_laddr.s_addr &&
208 inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
210 if (inp->inp_faddr.s_addr &&
211 inp->inp_faddr.s_addr != ip->ip_src.s_addr)
216 n = m_copy(m, 0, (int)M_COPYALL);
218 (void) raw_append(last, ip, n);
219 /* XXX count dropped packet */
225 if (raw_append(last, ip, m) != 0)
226 ipstat.ips_delivered--;
230 ipstat.ips_noproto++;
231 ipstat.ips_delivered--;
233 INP_INFO_RUNLOCK(&ripcbinfo);
237 * Generate IP header and pass packet to ip_output.
238 * Tack on options user may have setup with control call.
241 rip_output(struct mbuf *m, struct socket *so, u_long dst)
244 struct inpcb *inp = sotoinpcb(so);
245 int flags = (so->so_options & SO_DONTROUTE) | IP_ALLOWBROADCAST;
248 mac_create_mbuf_from_socket(so, m);
252 * If the user handed us a complete IP packet, use it.
253 * Otherwise, allocate an mbuf for a header and fill it in.
255 if ((inp->inp_flags & INP_HDRINCL) == 0) {
256 if (m->m_pkthdr.len + sizeof(struct ip) > IP_MAXPACKET) {
260 M_PREPEND(m, sizeof(struct ip), M_TRYWAIT);
263 ip = mtod(m, struct ip *);
264 ip->ip_tos = inp->inp_ip_tos;
266 ip->ip_p = inp->inp_ip_p;
267 ip->ip_len = m->m_pkthdr.len;
268 ip->ip_src = inp->inp_laddr;
269 ip->ip_dst.s_addr = dst;
270 ip->ip_ttl = inp->inp_ip_ttl;
272 if (m->m_pkthdr.len > IP_MAXPACKET) {
276 ip = mtod(m, struct ip *);
277 /* don't allow both user specified and setsockopt options,
278 and don't allow packet length sizes that will crash */
279 if (((ip->ip_hl != (sizeof (*ip) >> 2))
281 || (ip->ip_len > m->m_pkthdr.len)
282 || (ip->ip_len < (ip->ip_hl << 2))) {
288 ip->ip_id = ip_randomid();
290 ip->ip_id = htons(ip_id++);
292 /* XXX prevent ip_output from overwriting header fields */
293 flags |= IP_RAWOUTPUT;
297 if (inp->inp_flags & INP_ONESBCAST)
298 flags |= IP_SENDONES;
300 return (ip_output(m, inp->inp_options, NULL, flags,
301 inp->inp_moptions, inp));
305 * Raw IP socket option processing.
307 * Note that access to all of the IP administrative functions here is
308 * implicitly protected by suser() as gaining access to a raw socket
309 * requires either that the thread pass a suser() check, or that it be
310 * passed a raw socket by another thread that has passed a suser() check.
311 * If FreeBSD moves to a more fine-grained access control mechanism,
312 * additional checks will need to be placed here if the raw IP attachment
313 * check is not equivilent the the check required for these
314 * administrative operations; in some cases, these checks are already
318 rip_ctloutput(struct socket *so, struct sockopt *sopt)
320 struct inpcb *inp = sotoinpcb(so);
323 if (sopt->sopt_level != IPPROTO_IP)
328 switch (sopt->sopt_dir) {
330 switch (sopt->sopt_name) {
332 optval = inp->inp_flags & INP_HDRINCL;
333 error = sooptcopyout(sopt, &optval, sizeof optval);
336 case IP_FW_ADD: /* ADD actually returns the body... */
339 error = ip_fw_ctl_ptr(sopt);
344 case IP_DUMMYNET_GET:
346 error = ip_dn_ctl_ptr(sopt);
359 case MRT_API_SUPPORT:
361 case MRT_ADD_BW_UPCALL:
362 case MRT_DEL_BW_UPCALL:
363 error = ip_mrouter_get ? ip_mrouter_get(so, sopt) :
368 error = ip_ctloutput(so, sopt);
374 switch (sopt->sopt_name) {
376 error = sooptcopyin(sopt, &optval, sizeof optval,
381 inp->inp_flags |= INP_HDRINCL;
383 inp->inp_flags &= ~INP_HDRINCL;
392 error = ip_fw_ctl_ptr(sopt);
397 case IP_DUMMYNET_CONFIGURE:
398 case IP_DUMMYNET_DEL:
399 case IP_DUMMYNET_FLUSH:
401 error = ip_dn_ctl_ptr(sopt);
403 error = ENOPROTOOPT ;
407 error = ip_rsvp_init(so);
411 error = ip_rsvp_done();
415 case IP_RSVP_VIF_OFF:
416 error = ip_rsvp_vif ?
417 ip_rsvp_vif(so, sopt) : EINVAL;
428 case MRT_API_SUPPORT:
430 case MRT_ADD_BW_UPCALL:
431 case MRT_DEL_BW_UPCALL:
432 error = ip_mrouter_set ? ip_mrouter_set(so, sopt) :
437 error = ip_ctloutput(so, sopt);
447 * This function exists solely to receive the PRC_IFDOWN messages which
448 * are sent by if_down(). It looks for an ifaddr whose ifa_addr is sa,
449 * and calls in_ifadown() to remove all routes corresponding to that address.
450 * It also receives the PRC_IFUP messages from if_up() and reinstalls the
454 rip_ctlinput(int cmd, struct sockaddr *sa, void *vip)
456 struct in_ifaddr *ia;
463 TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
464 if (ia->ia_ifa.ifa_addr == sa
465 && (ia->ia_flags & IFA_ROUTE)) {
467 * in_ifscrub kills the interface route.
469 in_ifscrub(ia->ia_ifp, ia);
471 * in_ifadown gets rid of all the rest of
472 * the routes. This is not quite the right
473 * thing to do, but at least if we are running
474 * a routing process they will come back.
476 in_ifadown(&ia->ia_ifa, 0);
483 TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
484 if (ia->ia_ifa.ifa_addr == sa)
487 if (ia == 0 || (ia->ia_flags & IFA_ROUTE))
490 ifp = ia->ia_ifa.ifa_ifp;
492 if ((ifp->if_flags & IFF_LOOPBACK)
493 || (ifp->if_flags & IFF_POINTOPOINT))
496 err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
498 ia->ia_flags |= IFA_ROUTE;
503 u_long rip_sendspace = RIPSNDQ;
504 u_long rip_recvspace = RIPRCVQ;
506 SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW,
507 &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
508 SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW,
509 &rip_recvspace, 0, "Maximum space for incoming raw IP datagrams");
512 rip_attach(struct socket *so, int proto, struct thread *td)
517 /* XXX why not lower? */
518 INP_INFO_WLOCK(&ripcbinfo);
521 /* XXX counter, printf */
522 INP_INFO_WUNLOCK(&ripcbinfo);
525 if (td && (error = suser(td)) != 0) {
526 INP_INFO_WUNLOCK(&ripcbinfo);
529 if (proto >= IPPROTO_MAX || proto < 0) {
530 INP_INFO_WUNLOCK(&ripcbinfo);
531 return EPROTONOSUPPORT;
534 error = soreserve(so, rip_sendspace, rip_recvspace);
536 INP_INFO_WUNLOCK(&ripcbinfo);
539 error = in_pcballoc(so, &ripcbinfo, "rawinp");
541 INP_INFO_WUNLOCK(&ripcbinfo);
544 inp = (struct inpcb *)so->so_pcb;
546 INP_INFO_WUNLOCK(&ripcbinfo);
547 inp->inp_vflag |= INP_IPV4;
548 inp->inp_ip_p = proto;
549 inp->inp_ip_ttl = ip_defttl;
555 rip_pcbdetach(struct socket *so, struct inpcb *inp)
557 INP_INFO_WLOCK_ASSERT(&ripcbinfo);
558 INP_LOCK_ASSERT(inp);
560 if (so == ip_mrouter && ip_mrouter_done)
562 if (ip_rsvp_force_done)
563 ip_rsvp_force_done(so);
570 rip_detach(struct socket *so)
574 INP_INFO_WLOCK(&ripcbinfo);
577 /* XXX counter, printf */
578 INP_INFO_WUNLOCK(&ripcbinfo);
582 rip_pcbdetach(so, inp);
583 INP_INFO_WUNLOCK(&ripcbinfo);
588 rip_abort(struct socket *so)
592 INP_INFO_WLOCK(&ripcbinfo);
595 INP_INFO_WUNLOCK(&ripcbinfo);
596 return EINVAL; /* ??? possible? panic instead? */
599 soisdisconnected(so);
600 if (so->so_state & SS_NOFDREF)
601 rip_pcbdetach(so, inp);
604 INP_INFO_WUNLOCK(&ripcbinfo);
609 rip_disconnect(struct socket *so)
611 if ((so->so_state & SS_ISCONNECTED) == 0)
613 return rip_abort(so);
617 rip_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
619 struct sockaddr_in *addr = (struct sockaddr_in *)nam;
622 if (nam->sa_len != sizeof(*addr))
625 if (TAILQ_EMPTY(&ifnet) ||
626 (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) ||
627 (addr->sin_addr.s_addr &&
628 ifa_ifwithaddr((struct sockaddr *)addr) == 0))
629 return EADDRNOTAVAIL;
631 INP_INFO_WLOCK(&ripcbinfo);
634 INP_INFO_WUNLOCK(&ripcbinfo);
638 inp->inp_laddr = addr->sin_addr;
640 INP_INFO_WUNLOCK(&ripcbinfo);
645 rip_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
647 struct sockaddr_in *addr = (struct sockaddr_in *)nam;
650 if (nam->sa_len != sizeof(*addr))
652 if (TAILQ_EMPTY(&ifnet))
653 return EADDRNOTAVAIL;
654 if (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK)
657 INP_INFO_WLOCK(&ripcbinfo);
660 INP_INFO_WUNLOCK(&ripcbinfo);
664 inp->inp_faddr = addr->sin_addr;
667 INP_INFO_WUNLOCK(&ripcbinfo);
672 rip_shutdown(struct socket *so)
676 INP_INFO_RLOCK(&ripcbinfo);
679 INP_INFO_RUNLOCK(&ripcbinfo);
683 INP_INFO_RUNLOCK(&ripcbinfo);
690 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
691 struct mbuf *control, struct thread *td)
697 INP_INFO_WLOCK(&ripcbinfo);
699 if (so->so_state & SS_ISCONNECTED) {
701 INP_INFO_WUNLOCK(&ripcbinfo);
705 dst = inp->inp_faddr.s_addr;
708 INP_INFO_WUNLOCK(&ripcbinfo);
712 dst = ((struct sockaddr_in *)nam)->sin_addr.s_addr;
715 ret = rip_output(m, so, dst);
717 INP_INFO_WUNLOCK(&ripcbinfo);
722 rip_pcblist(SYSCTL_HANDLER_ARGS)
725 struct inpcb *inp, **inp_list;
730 * The process of preparing the TCB list is too time-consuming and
731 * resource-intensive to repeat twice on every request.
733 if (req->oldptr == 0) {
734 n = ripcbinfo.ipi_count;
735 req->oldidx = 2 * (sizeof xig)
736 + (n + n/8) * sizeof(struct xinpcb);
740 if (req->newptr != 0)
744 * OK, now we're committed to doing something.
746 INP_INFO_RLOCK(&ripcbinfo);
747 gencnt = ripcbinfo.ipi_gencnt;
748 n = ripcbinfo.ipi_count;
749 INP_INFO_RUNLOCK(&ripcbinfo);
751 xig.xig_len = sizeof xig;
753 xig.xig_gen = gencnt;
754 xig.xig_sogen = so_gencnt;
755 error = SYSCTL_OUT(req, &xig, sizeof xig);
759 inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
763 INP_INFO_RLOCK(&ripcbinfo);
764 for (inp = LIST_FIRST(ripcbinfo.listhead), i = 0; inp && i < n;
765 inp = LIST_NEXT(inp, inp_list)) {
767 if (inp->inp_gencnt <= gencnt &&
768 cr_canseesocket(req->td->td_ucred, inp->inp_socket) == 0) {
769 /* XXX held references? */
774 INP_INFO_RUNLOCK(&ripcbinfo);
778 for (i = 0; i < n; i++) {
780 if (inp->inp_gencnt <= gencnt) {
782 xi.xi_len = sizeof xi;
783 /* XXX should avoid extra copy */
784 bcopy(inp, &xi.xi_inp, sizeof *inp);
786 sotoxsocket(inp->inp_socket, &xi.xi_socket);
787 error = SYSCTL_OUT(req, &xi, sizeof xi);
792 * Give the user an updated idea of our state.
793 * If the generation differs from what we told
794 * her before, she knows that something happened
795 * while we were processing this request, and it
796 * might be necessary to retry.
798 INP_INFO_RLOCK(&ripcbinfo);
799 xig.xig_gen = ripcbinfo.ipi_gencnt;
800 xig.xig_sogen = so_gencnt;
801 xig.xig_count = ripcbinfo.ipi_count;
802 INP_INFO_RUNLOCK(&ripcbinfo);
803 error = SYSCTL_OUT(req, &xig, sizeof xig);
805 free(inp_list, M_TEMP);
810 * This is the wrapper function for in_setsockaddr. We just pass down
811 * the pcbinfo for in_setpeeraddr to lock.
814 rip_sockaddr(struct socket *so, struct sockaddr **nam)
816 return (in_setsockaddr(so, nam, &ripcbinfo));
820 * This is the wrapper function for in_setpeeraddr. We just pass down
821 * the pcbinfo for in_setpeeraddr to lock.
824 rip_peeraddr(struct socket *so, struct sockaddr **nam)
826 return (in_setpeeraddr(so, nam, &ripcbinfo));
830 SYSCTL_PROC(_net_inet_raw, OID_AUTO/*XXX*/, pcblist, CTLFLAG_RD, 0, 0,
831 rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
833 struct pr_usrreqs rip_usrreqs = {
834 rip_abort, pru_accept_notsupp, rip_attach, rip_bind, rip_connect,
835 pru_connect2_notsupp, in_control, rip_detach, rip_disconnect,
836 pru_listen_notsupp, rip_peeraddr, pru_rcvd_notsupp,
837 pru_rcvoob_notsupp, rip_send, pru_sense_null, rip_shutdown,
838 rip_sockaddr, sosend, soreceive, sopoll, in_pcbsosetlabel