1 /*
2 * Copyright (c) 2000-2024 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1988, 1990, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #define _IP_VHL
70
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/kernel.h>
74 #include <sys/malloc.h>
75 #include <sys/mbuf.h>
76 #include <sys/protosw.h>
77 #include <sys/socket.h>
78 #include <sys/socketvar.h>
79 #include <kern/locks.h>
80 #include <sys/sysctl.h>
81 #include <sys/mcache.h>
82 #include <sys/kdebug.h>
83
84 #include <machine/endian.h>
85 #include <pexpert/pexpert.h>
86 #include <mach/sdt.h>
87
88 #include <libkern/OSAtomic.h>
89 #include <libkern/OSByteOrder.h>
90
91 #include <net/if.h>
92 #include <net/if_dl.h>
93 #include <net/if_types.h>
94 #include <net/route.h>
95 #include <net/ntstat.h>
96 #include <net/net_osdep.h>
97 #include <net/dlil.h>
98 #include <net/net_perf.h>
99 #include <net/droptap.h>
100
101 #include <netinet/in.h>
102 #include <netinet/in_systm.h>
103 #include <netinet/ip.h>
104 #include <netinet/in_pcb.h>
105 #include <netinet/in_var.h>
106 #include <netinet/ip_var.h>
107 #include <netinet/kpi_ipfilter_var.h>
108 #include <netinet/in_tclass.h>
109 #include <netinet/udp.h>
110
111 #include <netinet6/nd6.h>
112
113 #define DBG_LAYER_BEG NETDBG_CODE(DBG_NETIP, 1)
114 #define DBG_LAYER_END NETDBG_CODE(DBG_NETIP, 3)
115 #define DBG_FNC_IP_OUTPUT NETDBG_CODE(DBG_NETIP, (1 << 8) | 1)
116 #define DBG_FNC_IPSEC4_OUTPUT NETDBG_CODE(DBG_NETIP, (2 << 8) | 1)
117
118 #if IPSEC
119 #include <netinet6/ipsec.h>
120 #include <netkey/key.h>
121 #if IPSEC_DEBUG
122 #include <netkey/key_debug.h>
123 #else
124 #define KEYDEBUG(lev, arg)
125 #endif
126 #endif /* IPSEC */
127
128 #if NECP
129 #include <net/necp.h>
130 #endif /* NECP */
131
132
133 #if DUMMYNET
134 #include <netinet/ip_dummynet.h>
135 #endif
136
137 #if PF
138 #include <net/pfvar.h>
139 #endif /* PF */
140
141 #include <net/sockaddr_utils.h>
142
143 u_short ip_id;
144
145 static int sysctl_reset_ip_output_stats SYSCTL_HANDLER_ARGS;
146 static int sysctl_ip_output_measure_bins SYSCTL_HANDLER_ARGS;
147 static int sysctl_ip_output_getperf SYSCTL_HANDLER_ARGS;
148 static void ip_out_cksum_stats(int, u_int32_t);
149 static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *);
150 static int ip_optcopy(struct ip *__indexable, struct ip *__indexable);
151 static int ip_pcbopts(int, struct mbuf **, struct mbuf *);
152 static void imo_trace(struct ip_moptions *, int);
153 static void ip_mloopback(struct ifnet *, struct ifnet *, struct mbuf *,
154 struct sockaddr_in *, int);
155 static struct ifaddr *in_selectsrcif(struct ip *, struct route *, unsigned int);
156
157 extern struct ip_linklocal_stat ip_linklocal_stat;
158
159 /* temporary: for testing */
160 #if IPSEC
161 extern int ipsec_bypass;
162 #endif
163
164 static int force_ipsum = 0;
165 static int ip_maxchainsent = 0;
166 SYSCTL_INT(_net_inet_ip, OID_AUTO, maxchainsent,
167 CTLFLAG_RW | CTLFLAG_LOCKED, &ip_maxchainsent, 0,
168 "use dlil_output_list");
169
170 SYSCTL_INT(_net_inet_ip, OID_AUTO, force_ipsum,
171 CTLFLAG_RW | CTLFLAG_LOCKED, &force_ipsum, 0,
172 "force IP checksum");
173 #if DEBUG
174 static int forge_ce = 0;
175 SYSCTL_INT(_net_inet_ip, OID_AUTO, forge_ce,
176 CTLFLAG_RW | CTLFLAG_LOCKED, &forge_ce, 0,
177 "Forge ECN CE");
178 #endif /* DEBUG */
179
180 static int ip_select_srcif_debug = 0;
181 SYSCTL_INT(_net_inet_ip, OID_AUTO, select_srcif_debug,
182 CTLFLAG_RW | CTLFLAG_LOCKED, &ip_select_srcif_debug, 0,
183 "log source interface selection debug info");
184
185 static int ip_output_measure = 0;
186 SYSCTL_PROC(_net_inet_ip, OID_AUTO, output_perf,
187 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
188 &ip_output_measure, 0, sysctl_reset_ip_output_stats, "I",
189 "Do time measurement");
190
191 static uint64_t ip_output_measure_bins = 0;
192 SYSCTL_PROC(_net_inet_ip, OID_AUTO, output_perf_bins,
193 CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED, &ip_output_measure_bins, 0,
194 sysctl_ip_output_measure_bins, "I",
195 "bins for chaining performance data histogram");
196
197 static net_perf_t net_perf;
198 SYSCTL_PROC(_net_inet_ip, OID_AUTO, output_perf_data,
199 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
200 0, 0, sysctl_ip_output_getperf, "S,net_perf",
201 "IP output performance data (struct net_perf, net/net_perf.h)");
202
203 __private_extern__ int rfc6864 = 1;
204 SYSCTL_INT(_net_inet_ip, OID_AUTO, rfc6864, CTLFLAG_RW | CTLFLAG_LOCKED,
205 &rfc6864, 0, "updated ip id field behavior");
206
207 #define IMO_TRACE_HIST_SIZE 32 /* size of trace history */
208
209 /* For gdb */
210 __private_extern__ unsigned int imo_trace_hist_size = IMO_TRACE_HIST_SIZE;
211
212 struct ip_moptions_dbg {
213 struct ip_moptions imo; /* ip_moptions */
214 u_int16_t imo_refhold_cnt; /* # of IMO_ADDREF */
215 u_int16_t imo_refrele_cnt; /* # of IMO_REMREF */
216 /*
217 * Alloc and free callers.
218 */
219 ctrace_t imo_alloc;
220 ctrace_t imo_free;
221 /*
222 * Circular lists of IMO_ADDREF and IMO_REMREF callers.
223 */
224 ctrace_t imo_refhold[IMO_TRACE_HIST_SIZE];
225 ctrace_t imo_refrele[IMO_TRACE_HIST_SIZE];
226 };
227
228 #if DEBUG
229 static unsigned int imo_debug = 1; /* debugging (enabled) */
230 #else
231 static unsigned int imo_debug; /* debugging (disabled) */
232 #endif /* !DEBUG */
233
234 ZONE_DECLARE(imo_zone, struct ip_moptions);
235 #define IMO_ZONE_NAME "ip_moptions" /* zone name */
236 zone_t imo_zone = {0}; /* zone for ip_moptions */
237
238 #if PF
239 __attribute__((noinline))
240 static int
ip_output_pf_dn_hook(struct ifnet * ifp,struct mbuf ** mppn,struct mbuf ** mp,struct pf_rule * dn_pf_rule,struct route * ro,struct sockaddr_in * dst,int flags,struct ip_out_args * ipoa)241 ip_output_pf_dn_hook(struct ifnet *ifp, struct mbuf **mppn, struct mbuf **mp,
242 struct pf_rule *dn_pf_rule, struct route *ro, struct sockaddr_in *dst, int flags,
243 struct ip_out_args *ipoa)
244 {
245 int rc;
246 struct ip_fw_args args = {};
247
248 args.fwa_pf_rule = dn_pf_rule;
249 args.fwa_oif = ifp;
250 args.fwa_ro = ro;
251 args.fwa_dst = dst;
252 args.fwa_oflags = flags;
253 if (flags & IP_OUTARGS) {
254 args.fwa_ipoa = ipoa;
255 }
256 rc = pf_af_hook(ifp, mppn, mp, AF_INET, FALSE, &args);
257
258 return rc;
259 }
260
261 #endif /* PF */
262
263
264 /*
265 * IP output. The packet in mbuf chain m contains a skeletal IP
266 * header (with len, off, ttl, proto, tos, src, dst).
267 * The mbuf chain containing the packet will be freed.
268 * The mbuf opt, if present, will not be freed.
269 */
270 int
ip_output(struct mbuf * m0,struct mbuf * opt,struct route * ro,int flags,struct ip_moptions * imo,struct ip_out_args * ipoa)271 ip_output(struct mbuf *m0, struct mbuf *opt, struct route *ro, int flags,
272 struct ip_moptions *imo, struct ip_out_args *ipoa)
273 {
274 return ip_output_list(m0, 0, opt, ro, flags, imo, ipoa);
275 }
276
277 /*
278 * IP output. The packet in mbuf chain m contains a skeletal IP
279 * header (with len, off, ttl, proto, tos, src, dst).
280 * The mbuf chain containing the packet will be freed.
281 * The mbuf opt, if present, will not be freed.
282 *
283 * Route ro MUST be non-NULL; if ro->ro_rt is valid, route lookup would be
284 * skipped and ro->ro_rt would be used. Otherwise the result of route
285 * lookup is stored in ro->ro_rt.
286 *
287 * In the IP forwarding case, the packet will arrive with options already
288 * inserted, so must have a NULL opt pointer.
289 */
290 int
ip_output_list(struct mbuf * m0,int packetchain,struct mbuf * opt,struct route * ro,int flags,struct ip_moptions * imo,struct ip_out_args * ipoa)291 ip_output_list(struct mbuf *m0, int packetchain, struct mbuf *opt,
292 struct route *ro, int flags, struct ip_moptions *imo,
293 struct ip_out_args *ipoa)
294 {
295 struct ip *ip;
296 struct ifnet *ifp = NULL; /* not refcnt'd */
297 mbuf_ref_t m = m0, prevnxt = NULL, *mppn = &prevnxt;
298 int hlen = sizeof(struct ip);
299 int len = 0, error = 0;
300 struct sockaddr_in *__single dst = NULL;
301 struct in_ifaddr *__single ia = NULL, *__single src_ia = NULL;
302 struct in_addr pkt_dst;
303 struct ipf_pktopts *__single ippo = NULL;
304 ipfilter_t inject_filter_ref __single = NULL;
305 mbuf_ref_t packetlist;
306 uint32_t sw_csum, pktcnt = 0, scnt = 0, bytecnt = 0;
307 uint32_t packets_processed = 0;
308 unsigned int ifscope = IFSCOPE_NONE;
309 struct flowadv *adv = NULL;
310 struct timeval start_tv;
311 #if IPSEC
312 struct socket *__single so = NULL;
313 struct secpolicy *__single sp = NULL;
314 #endif /* IPSEC */
315 #if NECP
316 necp_kernel_policy_result necp_result = 0;
317 necp_kernel_policy_result_parameter necp_result_parameter;
318 necp_kernel_policy_id necp_matched_policy_id = 0;
319 #endif /* NECP */
320 #if DUMMYNET
321 struct m_tag *__single tag;
322 struct ip_out_args saved_ipoa;
323 struct sockaddr_in dst_buf;
324 #endif /* DUMMYNET */
325 struct {
326 #if IPSEC
327 struct ipsec_output_state ipsec_state;
328 #endif /* IPSEC */
329 #if NECP
330 struct route necp_route;
331 #endif /* NECP */
332 #if DUMMYNET
333 struct route saved_route;
334 #endif /* DUMMYNET */
335 struct ipf_pktopts ipf_pktopts;
336 } ipobz;
337 #define ipsec_state ipobz.ipsec_state
338 #define necp_route ipobz.necp_route
339 #define sro_fwd ipobz.sro_fwd
340 #define saved_route ipobz.saved_route
341 #define ipf_pktopts ipobz.ipf_pktopts
342 union {
343 struct {
344 boolean_t select_srcif : 1; /* set once */
345 boolean_t srcbound : 1; /* set once */
346 boolean_t nocell : 1; /* set once */
347 boolean_t isbroadcast : 1;
348 boolean_t didfilter : 1;
349 boolean_t noexpensive : 1; /* set once */
350 boolean_t noconstrained : 1; /* set once */
351 boolean_t awdl_unrestricted : 1; /* set once */
352 boolean_t management_allowed : 1; /* set once */
353 };
354 uint32_t raw;
355 } ipobf = { .raw = 0 };
356
357 int interface_mtu = 0;
358 struct pf_rule *__single dn_pf_rule = NULL;
359 drop_reason_t drop_reason = DROP_REASON_UNSPECIFIED;
360 /*
361 * Here we check for restrictions when sending frames.
362 * N.B.: IPv4 over internal co-processor interfaces is not allowed.
363 */
364 #define IP_CHECK_RESTRICTIONS(_ifp, _ipobf) \
365 (((_ipobf).nocell && IFNET_IS_CELLULAR(_ifp)) || \
366 ((_ipobf).noexpensive && IFNET_IS_EXPENSIVE(_ifp)) || \
367 ((_ipobf).noconstrained && IFNET_IS_CONSTRAINED(_ifp)) || \
368 (IFNET_IS_INTCOPROC(_ifp)) || \
369 (!(_ipobf).management_allowed && IFNET_IS_MANAGEMENT(_ifp)) || \
370 (!(_ipobf).awdl_unrestricted && IFNET_IS_AWDL_RESTRICTED(_ifp)))
371
372 if (ip_output_measure) {
373 net_perf_start_time(&net_perf, &start_tv);
374 }
375 KERNEL_DEBUG(DBG_FNC_IP_OUTPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
376
377 VERIFY(m0->m_flags & M_PKTHDR);
378 packetlist = m0;
379
380 /* zero out {ipsec_state, args, sro_fwd, saved_route, ipf_pktops} */
381 bzero(&ipobz, sizeof(ipobz));
382 ippo = &ipf_pktopts;
383
384 #if DUMMYNET
385 if (SLIST_EMPTY(&m0->m_pkthdr.tags)) {
386 goto ipfw_tags_done;
387 }
388
389 /* Grab info from mtags prepended to the chain */
390 if ((tag = m_tag_locate(m0, KERNEL_MODULE_TAG_ID,
391 KERNEL_TAG_TYPE_DUMMYNET)) != NULL) {
392 struct dn_pkt_tag *dn_tag;
393
394 dn_tag = (struct dn_pkt_tag *)(tag->m_tag_data);
395 dn_pf_rule = dn_tag->dn_pf_rule;
396 opt = NULL;
397 saved_route = dn_tag->dn_ro;
398 ro = &saved_route;
399
400 imo = NULL;
401 SOCKADDR_COPY(&dn_tag->dn_dst, &dst_buf, sizeof(dst_buf));
402 dst = &dst_buf;
403 ifp = dn_tag->dn_ifp;
404 flags = dn_tag->dn_flags;
405 if ((dn_tag->dn_flags & IP_OUTARGS)) {
406 saved_ipoa = dn_tag->dn_ipoa;
407 ipoa = &saved_ipoa;
408 }
409
410 m_tag_delete(m0, tag);
411 }
412 ipfw_tags_done:
413 #endif /* DUMMYNET */
414
415 m = m0;
416 m->m_pkthdr.pkt_flags &= ~(PKTF_LOOP | PKTF_IFAINFO);
417
418 #if IPSEC
419 if (ipsec_bypass == 0 && !(flags & IP_NOIPSEC)) {
420 /* If packet is bound to an interface, check bound policies */
421 if ((flags & IP_OUTARGS) && (ipoa != NULL) &&
422 (ipoa->ipoa_flags & IPOAF_BOUND_IF) &&
423 ipoa->ipoa_boundif != IFSCOPE_NONE) {
424 if (ipsec4_getpolicybyinterface(m, IPSEC_DIR_OUTBOUND,
425 &flags, ipoa, &sp) != 0) {
426 drop_reason = DROP_REASON_IP_OUTBOUND_IPSEC_POLICY;
427 goto bad;
428 }
429 }
430 }
431 #endif /* IPSEC */
432
433 VERIFY(ro != NULL);
434
435 if (flags & IP_OUTARGS) {
436 /*
437 * In the forwarding case, only the ifscope value is used,
438 * as source interface selection doesn't take place.
439 */
440 if ((ipobf.select_srcif = (!(flags & IP_FORWARDING) &&
441 (ipoa->ipoa_flags & IPOAF_SELECT_SRCIF)))) {
442 ipf_pktopts.ippo_flags |= IPPOF_SELECT_SRCIF;
443 }
444
445 if ((ipoa->ipoa_flags & IPOAF_BOUND_IF) &&
446 ipoa->ipoa_boundif != IFSCOPE_NONE) {
447 ifscope = ipoa->ipoa_boundif;
448 ipf_pktopts.ippo_flags |=
449 (IPPOF_BOUND_IF | (ifscope << IPPOF_SHIFT_IFSCOPE));
450 }
451
452 /* double negation needed for bool bit field */
453 ipobf.srcbound = !!(ipoa->ipoa_flags & IPOAF_BOUND_SRCADDR);
454 if (ipobf.srcbound) {
455 ipf_pktopts.ippo_flags |= IPPOF_BOUND_SRCADDR;
456 }
457 } else {
458 ipobf.select_srcif = FALSE;
459 ipobf.srcbound = FALSE;
460 ifscope = IFSCOPE_NONE;
461 if (flags & IP_OUTARGS) {
462 ipoa->ipoa_boundif = IFSCOPE_NONE;
463 ipoa->ipoa_flags &= ~(IPOAF_SELECT_SRCIF |
464 IPOAF_BOUND_IF | IPOAF_BOUND_SRCADDR);
465 }
466 }
467
468 if (flags & IP_OUTARGS) {
469 if (ipoa->ipoa_flags & IPOAF_NO_CELLULAR) {
470 ipobf.nocell = true;
471 ipf_pktopts.ippo_flags |= IPPOF_NO_IFT_CELLULAR;
472 }
473 if (ipoa->ipoa_flags & IPOAF_NO_EXPENSIVE) {
474 ipobf.noexpensive = true;
475 ipf_pktopts.ippo_flags |= IPPOF_NO_IFF_EXPENSIVE;
476 }
477 if (ipoa->ipoa_flags & IPOAF_NO_CONSTRAINED) {
478 ipobf.noconstrained = true;
479 ipf_pktopts.ippo_flags |= IPPOF_NO_IFF_CONSTRAINED;
480 }
481 if (ipoa->ipoa_flags & IPOAF_AWDL_UNRESTRICTED) {
482 ipobf.awdl_unrestricted = true;
483 }
484 if (ipoa->ipoa_flags & IPOAF_MANAGEMENT_ALLOWED) {
485 ipobf.management_allowed = true;
486 }
487 adv = &ipoa->ipoa_flowadv;
488 adv->code = FADV_SUCCESS;
489 ipoa->ipoa_flags &= ~IPOAF_RET_MASK;
490 }
491
492 #if IPSEC
493 if (ipsec_bypass == 0 && !(flags & IP_NOIPSEC)) {
494 so = ipsec_getsocket(m);
495 if (so != NULL) {
496 (void) ipsec_setsocket(m, NULL);
497 }
498 }
499 #endif /* IPSEC */
500
501 #if DUMMYNET
502 if (dn_pf_rule != NULL) {
503 /* dummynet already saw us */
504 ip = mtod(m, struct ip *);
505 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
506 pkt_dst = ip->ip_dst;
507 if (ro->ro_rt != NULL) {
508 RT_LOCK_SPIN(ro->ro_rt);
509 ia = ifatoia(ro->ro_rt->rt_ifa);
510 if (ia) {
511 /* Become a regular mutex */
512 RT_CONVERT_LOCK(ro->ro_rt);
513 ifa_addref(&ia->ia_ifa);
514 }
515 RT_UNLOCK(ro->ro_rt);
516 }
517
518 goto sendit;
519 }
520 #endif /* DUMMYNET */
521
522 loopit:
523 packets_processed++;
524 ipobf.isbroadcast = FALSE;
525 ipobf.didfilter = FALSE;
526
527 VERIFY(m->m_flags & M_PKTHDR);
528 /*
529 * No need to proccess packet twice if we've already seen it.
530 */
531 if (!SLIST_EMPTY(&m->m_pkthdr.tags)) {
532 inject_filter_ref = ipf_get_inject_filter(m);
533 } else {
534 inject_filter_ref = NULL;
535 }
536
537 if (opt) {
538 m = ip_insertoptions(m, opt, &len);
539 hlen = len;
540 /* Update the chain */
541 if (m != m0) {
542 if (m0 == packetlist) {
543 packetlist = m;
544 }
545 m0 = m;
546 }
547 }
548 ip = mtod(m, struct ip *);
549
550 pkt_dst = ip->ip_dst;
551
552 /*
553 * We must not send if the packet is destined to network zero.
554 * RFC1122 3.2.1.3 (a) and (b).
555 */
556 if (IN_ZERONET(ntohl(pkt_dst.s_addr))) {
557 error = EHOSTUNREACH;
558 drop_reason = DROP_REASON_IP_ZERO_NET;
559 goto bad;
560 }
561
562 /*
563 * Fill in IP header.
564 */
565 if (!(flags & (IP_FORWARDING | IP_RAWOUTPUT))) {
566 ip->ip_vhl = IP_MAKE_VHL(IPVERSION, hlen >> 2);
567 ip->ip_off &= IP_DF;
568 if (rfc6864 && IP_OFF_IS_ATOMIC(ip->ip_off)) {
569 // Per RFC6864, value of ip_id is undefined for atomic ip packets
570 ip->ip_id = 0;
571 } else {
572 ip->ip_id = ip_randomid((uint64_t)m);
573 }
574 OSAddAtomic(1, &ipstat.ips_localout);
575 } else {
576 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
577 }
578
579 #if DEBUG
580 /* For debugging, we let the stack forge congestion */
581 if (forge_ce != 0 &&
582 ((ip->ip_tos & IPTOS_ECN_MASK) == IPTOS_ECN_ECT1 ||
583 (ip->ip_tos & IPTOS_ECN_MASK) == IPTOS_ECN_ECT0)) {
584 ip->ip_tos = (ip->ip_tos & ~IPTOS_ECN_MASK) | IPTOS_ECN_CE;
585 forge_ce--;
586 }
587 #endif /* DEBUG */
588
589 if ((ip->ip_tos & IPTOS_ECN_MASK) == IPTOS_ECN_ECT1) {
590 m->m_pkthdr.pkt_ext_flags |= PKTF_EXT_L4S;
591 }
592
593 KERNEL_DEBUG(DBG_LAYER_BEG, ip->ip_dst.s_addr, ip->ip_src.s_addr,
594 ip->ip_p, ip->ip_off, ip->ip_len);
595
596 dst = SIN(&ro->ro_dst);
597
598 /*
599 * If there is a cached route,
600 * check that it is to the same destination
601 * and is still up. If not, free it and try again.
602 * The address family should also be checked in case of sharing the
603 * cache with IPv6.
604 */
605
606 if (ro->ro_rt != NULL) {
607 if (ROUTE_UNUSABLE(ro) && ip->ip_src.s_addr != INADDR_ANY &&
608 !(flags & (IP_ROUTETOIF | IP_FORWARDING))) {
609 src_ia = ifa_foraddr(ip->ip_src.s_addr);
610 if (src_ia == NULL) {
611 OSAddAtomic(1, &ipstat.ips_src_addr_not_avail);
612 error = EADDRNOTAVAIL;
613 drop_reason = DROP_REASON_IP_SRC_ADDR_NO_AVAIL;
614 goto bad;
615 }
616 ifa_remref(&src_ia->ia_ifa);
617 src_ia = NULL;
618 }
619 /*
620 * Test rt_flags without holding rt_lock for performance
621 * reasons; if the route is down it will hopefully be
622 * caught by the layer below (since it uses this route
623 * as a hint) or during the next transmit.
624 */
625 if (ROUTE_UNUSABLE(ro) || dst->sin_family != AF_INET ||
626 dst->sin_addr.s_addr != pkt_dst.s_addr) {
627 ROUTE_RELEASE(ro);
628 }
629
630 /*
631 * If we're doing source interface selection, we may not
632 * want to use this route; only synch up the generation
633 * count otherwise.
634 */
635 if (!ipobf.select_srcif && ro->ro_rt != NULL &&
636 RT_GENID_OUTOFSYNC(ro->ro_rt)) {
637 RT_GENID_SYNC(ro->ro_rt);
638 }
639 }
640 if (ro->ro_rt == NULL) {
641 SOCKADDR_ZERO(dst, sizeof(*dst));
642 dst->sin_family = AF_INET;
643 dst->sin_len = sizeof(*dst);
644 dst->sin_addr = pkt_dst;
645 }
646 /*
647 * If routing to interface only,
648 * short circuit routing lookup.
649 */
650 if (flags & IP_ROUTETOIF) {
651 if (ia != NULL) {
652 ifa_remref(&ia->ia_ifa);
653 }
654 if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == NULL) {
655 ia = ifatoia(ifa_ifwithnet(sintosa(dst)));
656 if (ia == NULL) {
657 OSAddAtomic(1, &ipstat.ips_noroute);
658 error = ENETUNREACH;
659 /* XXX IPv6 APN fallback notification?? */
660 drop_reason = DROP_REASON_IP_DST_ADDR_NO_AVAIL;
661 goto bad;
662 }
663 }
664 ifp = ia->ia_ifp;
665 ip->ip_ttl = 1;
666 ipobf.isbroadcast = in_broadcast(dst->sin_addr, ifp);
667 /*
668 * For consistency with other cases below. Loopback
669 * multicast case is handled separately by ip_mloopback().
670 */
671 if ((ifp->if_flags & IFF_LOOPBACK) &&
672 !IN_MULTICAST(ntohl(pkt_dst.s_addr))) {
673 m->m_pkthdr.rcvif = ifp;
674 ip_setsrcifaddr_info(m, ifp->if_index, NULL);
675 ip_setdstifaddr_info(m, ifp->if_index, NULL);
676 }
677 } else if (IN_MULTICAST(ntohl(pkt_dst.s_addr)) &&
678 imo != NULL && (ifp = imo->imo_multicast_ifp) != NULL) {
679 /*
680 * Bypass the normal routing lookup for multicast
681 * packets if the interface is specified.
682 */
683 ipobf.isbroadcast = FALSE;
684 if (ia != NULL) {
685 ifa_remref(&ia->ia_ifa);
686 }
687
688 /* Macro takes reference on ia */
689 IFP_TO_IA(ifp, ia);
690 } else {
691 struct ifaddr *ia0 = NULL;
692 boolean_t cloneok = FALSE;
693 /*
694 * Perform source interface selection; the source IP address
695 * must belong to one of the addresses of the interface used
696 * by the route. For performance reasons, do this only if
697 * there is no route, or if the routing table has changed,
698 * or if we haven't done source interface selection on this
699 * route (for this PCB instance) before.
700 */
701 if (ipobf.select_srcif &&
702 ip->ip_src.s_addr != INADDR_ANY && (ROUTE_UNUSABLE(ro) ||
703 !(ro->ro_flags & ROF_SRCIF_SELECTED))) {
704 /* Find the source interface */
705 ia0 = in_selectsrcif(ip, ro, ifscope);
706
707 /*
708 * If the source address belongs to a restricted
709 * interface and the caller forbids our using
710 * interfaces of such type, pretend that there is no
711 * route.
712 */
713 if (ia0 != NULL &&
714 IP_CHECK_RESTRICTIONS(ia0->ifa_ifp, ipobf)) {
715 ifa_remref(ia0);
716 ia0 = NULL;
717 error = EHOSTUNREACH;
718 if (flags & IP_OUTARGS) {
719 ipoa->ipoa_flags |= IPOAF_R_IFDENIED;
720 }
721 drop_reason = DROP_REASON_IP_TO_RESTRICTED_IF;
722 goto bad;
723 }
724
725 /*
726 * If the source address is spoofed (in the case of
727 * IP_RAWOUTPUT on an unbounded socket), or if this
728 * is destined for local/loopback, just let it go out
729 * using the interface of the route. Otherwise,
730 * there's no interface having such an address,
731 * so bail out.
732 */
733 if (ia0 == NULL && (!(flags & IP_RAWOUTPUT) ||
734 ipobf.srcbound) && ifscope != lo_ifp->if_index) {
735 error = EADDRNOTAVAIL;
736 OSAddAtomic(1, &ipstat.ips_src_addr_not_avail);
737 drop_reason = DROP_REASON_IP_SRC_ADDR_NO_AVAIL;
738 goto bad;
739 }
740
741 /*
742 * If the caller didn't explicitly specify the scope,
743 * pick it up from the source interface. If the cached
744 * route was wrong and was blown away as part of source
745 * interface selection, don't mask out RTF_PRCLONING
746 * since that route may have been allocated by the ULP,
747 * unless the IP header was created by the caller or
748 * the destination is IPv4 LLA. The check for the
749 * latter is needed because IPv4 LLAs are never scoped
750 * in the current implementation, and we don't want to
751 * replace the resolved IPv4 LLA route with one whose
752 * gateway points to that of the default gateway on
753 * the primary interface of the system.
754 */
755 if (ia0 != NULL) {
756 if (ifscope == IFSCOPE_NONE) {
757 ifscope = ia0->ifa_ifp->if_index;
758 }
759 cloneok = (!(flags & IP_RAWOUTPUT) &&
760 !(IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr))));
761 }
762 }
763
764 /*
765 * If this is the case, we probably don't want to allocate
766 * a protocol-cloned route since we didn't get one from the
767 * ULP. This lets TCP do its thing, while not burdening
768 * forwarding or ICMP with the overhead of cloning a route.
769 * Of course, we still want to do any cloning requested by
770 * the link layer, as this is probably required in all cases
771 * for correct operation (as it is for ARP).
772 */
773 if (ro->ro_rt == NULL) {
774 uint32_t ign = RTF_PRCLONING;
775 /*
776 * We make an exception here: if the destination
777 * address is INADDR_BROADCAST, allocate a protocol-
778 * cloned host route so that we end up with a route
779 * marked with the RTF_BROADCAST flag. Otherwise,
780 * we would end up referring to the default route,
781 * instead of creating a cloned host route entry.
782 * That would introduce inconsistencies between ULPs
783 * that allocate a route and those that don't. The
784 * RTF_BROADCAST route is important since we'd want
785 * to send out undirected IP broadcast packets using
786 * link-level broadcast address. Another exception
787 * is for ULP-created routes that got blown away by
788 * source interface selection (see above).
789 *
790 * These exceptions will no longer be necessary when
791 * the RTF_PRCLONING scheme is no longer present.
792 */
793 if (cloneok || dst->sin_addr.s_addr == INADDR_BROADCAST) {
794 ign &= ~RTF_PRCLONING;
795 }
796
797 /*
798 * Loosen the route lookup criteria if the ifscope
799 * corresponds to the loopback interface; this is
800 * needed to support Application Layer Gateways
801 * listening on loopback, in conjunction with packet
802 * filter redirection rules. The final source IP
803 * address will be rewritten by the packet filter
804 * prior to the RFC1122 loopback check below.
805 */
806 if (ifscope == lo_ifp->if_index) {
807 rtalloc_ign(ro, ign);
808 } else {
809 rtalloc_scoped_ign(ro, ign, ifscope);
810 }
811
812 /*
813 * If the route points to a cellular/expensive interface
814 * and the caller forbids our using interfaces of such type,
815 * pretend that there is no route.
816 */
817 if (ro->ro_rt != NULL) {
818 RT_LOCK_SPIN(ro->ro_rt);
819 if (IP_CHECK_RESTRICTIONS(ro->ro_rt->rt_ifp,
820 ipobf)) {
821 RT_UNLOCK(ro->ro_rt);
822 ROUTE_RELEASE(ro);
823 if (flags & IP_OUTARGS) {
824 ipoa->ipoa_flags |=
825 IPOAF_R_IFDENIED;
826 }
827 } else {
828 RT_UNLOCK(ro->ro_rt);
829 }
830 }
831 }
832
833 if (ro->ro_rt == NULL) {
834 OSAddAtomic(1, &ipstat.ips_noroute);
835 error = EHOSTUNREACH;
836 if (ia0 != NULL) {
837 ifa_remref(ia0);
838 ia0 = NULL;
839 }
840 drop_reason = DROP_REASON_IP_NO_ROUTE;
841 goto bad;
842 }
843
844 if (ia != NULL) {
845 ifa_remref(&ia->ia_ifa);
846 }
847 RT_LOCK_SPIN(ro->ro_rt);
848 ia = ifatoia(ro->ro_rt->rt_ifa);
849 if (ia != NULL) {
850 /* Become a regular mutex */
851 RT_CONVERT_LOCK(ro->ro_rt);
852 ifa_addref(&ia->ia_ifa);
853 }
854 /*
855 * Note: ia_ifp may not be the same as rt_ifp; the latter
856 * is what we use for determining outbound i/f, mtu, etc.
857 */
858 ifp = ro->ro_rt->rt_ifp;
859 ro->ro_rt->rt_use++;
860 if (ro->ro_rt->rt_flags & RTF_GATEWAY) {
861 dst = SIN(ro->ro_rt->rt_gateway);
862 }
863 if (ro->ro_rt->rt_flags & RTF_HOST) {
864 /* double negation needed for bool bit field */
865 ipobf.isbroadcast =
866 !!(ro->ro_rt->rt_flags & RTF_BROADCAST);
867 } else {
868 /* Become a regular mutex */
869 RT_CONVERT_LOCK(ro->ro_rt);
870 ipobf.isbroadcast = in_broadcast(dst->sin_addr, ifp);
871 }
872 /*
873 * For consistency with IPv6, as well as to ensure that
874 * IP_RECVIF is set correctly for packets that are sent
875 * to one of the local addresses. ia (rt_ifa) would have
876 * been fixed up by rt_setif for local routes. This
877 * would make it appear as if the packet arrives on the
878 * interface which owns the local address. Loopback
879 * multicast case is handled separately by ip_mloopback().
880 */
881 if (ia != NULL && (ifp->if_flags & IFF_LOOPBACK) &&
882 !IN_MULTICAST(ntohl(pkt_dst.s_addr))) {
883 uint16_t srcidx;
884
885 m->m_pkthdr.rcvif = ia->ia_ifa.ifa_ifp;
886
887 if (ia0 != NULL) {
888 srcidx = ia0->ifa_ifp->if_index;
889 } else if ((ro->ro_flags & ROF_SRCIF_SELECTED) &&
890 ro->ro_srcia != NULL) {
891 srcidx = ro->ro_srcia->ifa_ifp->if_index;
892 } else {
893 srcidx = 0;
894 }
895
896 ip_setsrcifaddr_info(m, srcidx, NULL);
897 ip_setdstifaddr_info(m, 0, ia);
898 }
899 RT_UNLOCK(ro->ro_rt);
900 if (ia0 != NULL) {
901 ifa_remref(ia0);
902 ia0 = NULL;
903 }
904 }
905
906 if (IN_MULTICAST(ntohl(pkt_dst.s_addr))) {
907 struct ifnet *srcifp = NULL;
908 struct in_multi *inm;
909 u_int32_t vif = 0;
910 u_int8_t ttl = IP_DEFAULT_MULTICAST_TTL;
911 u_int8_t loop = IP_DEFAULT_MULTICAST_LOOP;
912
913 m->m_flags |= M_MCAST;
914 /*
915 * IP destination address is multicast. Make sure "dst"
916 * still points to the address in "ro". (It may have been
917 * changed to point to a gateway address, above.)
918 */
919 dst = SIN(&ro->ro_dst);
920 /*
921 * See if the caller provided any multicast options
922 */
923 if (imo != NULL) {
924 IMO_LOCK(imo);
925 vif = imo->imo_multicast_vif;
926 ttl = imo->imo_multicast_ttl;
927 loop = imo->imo_multicast_loop;
928 if (!(flags & IP_RAWOUTPUT)) {
929 ip->ip_ttl = ttl;
930 }
931 if (imo->imo_multicast_ifp != NULL) {
932 ifp = imo->imo_multicast_ifp;
933 }
934 IMO_UNLOCK(imo);
935 } else if (!(flags & IP_RAWOUTPUT)) {
936 vif = -1;
937 ip->ip_ttl = ttl;
938 }
939 /*
940 * Confirm that the outgoing interface supports multicast.
941 */
942 if (imo == NULL || vif == -1) {
943 if (!(ifp->if_flags & IFF_MULTICAST)) {
944 OSAddAtomic(1, &ipstat.ips_noroute);
945 error = ENETUNREACH;
946 drop_reason = DROP_REASON_IP_IF_CANNOT_MULTICAST;
947 goto bad;
948 }
949 }
950 /*
951 * If source address not specified yet, use address
952 * of outgoing interface.
953 */
954 if (ip->ip_src.s_addr == INADDR_ANY) {
955 struct in_ifaddr *ia1;
956 lck_rw_lock_shared(&in_ifaddr_rwlock);
957 TAILQ_FOREACH(ia1, &in_ifaddrhead, ia_link) {
958 IFA_LOCK_SPIN(&ia1->ia_ifa);
959 if (ia1->ia_ifp == ifp) {
960 ip->ip_src = IA_SIN(ia1)->sin_addr;
961 srcifp = ifp;
962 IFA_UNLOCK(&ia1->ia_ifa);
963 break;
964 }
965 IFA_UNLOCK(&ia1->ia_ifa);
966 }
967 lck_rw_done(&in_ifaddr_rwlock);
968 if (ip->ip_src.s_addr == INADDR_ANY) {
969 error = ENETUNREACH;
970 drop_reason = DROP_REASON_IP_SRC_ADDR_ANY;
971 goto bad;
972 }
973 }
974
975 in_multihead_lock_shared();
976 IN_LOOKUP_MULTI(&pkt_dst, ifp, inm);
977 in_multihead_lock_done();
978 if (inm != NULL && (imo == NULL || loop)) {
979 /*
980 * If we belong to the destination multicast group
981 * on the outgoing interface, and the caller did not
982 * forbid loopback, loop back a copy.
983 */
984 if (!TAILQ_EMPTY(&ipv4_filters)
985 #if NECP
986 && !necp_packet_should_skip_filters(m)
987 #endif // NECP
988 ) {
989 struct ipfilter *filter;
990 int seen = (inject_filter_ref == NULL);
991
992 if (imo != NULL) {
993 ipf_pktopts.ippo_flags |=
994 IPPOF_MCAST_OPTS;
995 ipf_pktopts.ippo_mcast_ifnet = ifp;
996 ipf_pktopts.ippo_mcast_ttl = ttl;
997 ipf_pktopts.ippo_mcast_loop = loop;
998 }
999
1000 ipf_ref();
1001
1002 /*
1003 * 4135317 - always pass network byte
1004 * order to filter
1005 */
1006 #if BYTE_ORDER != BIG_ENDIAN
1007 HTONS(ip->ip_len);
1008 HTONS(ip->ip_off);
1009 #endif
1010 TAILQ_FOREACH(filter, &ipv4_filters, ipf_link) {
1011 if (seen == 0) {
1012 if ((struct ipfilter *)
1013 inject_filter_ref == filter) {
1014 seen = 1;
1015 }
1016 } else if (filter->ipf_filter.
1017 ipf_output != NULL) {
1018 errno_t result;
1019 result = filter->ipf_filter.
1020 ipf_output(filter->
1021 ipf_filter.cookie,
1022 (mbuf_t *)&m, ippo);
1023 if (result == EJUSTRETURN) {
1024 ipf_unref();
1025 INM_REMREF(inm);
1026 goto done;
1027 }
1028 if (result != 0) {
1029 ipf_unref();
1030 INM_REMREF(inm);
1031 drop_reason = DROP_REASON_IP_FILTER_DROP;
1032 goto bad;
1033 }
1034 }
1035 }
1036
1037 /* set back to host byte order */
1038 ip = mtod(m, struct ip *);
1039 #if BYTE_ORDER != BIG_ENDIAN
1040 NTOHS(ip->ip_len);
1041 NTOHS(ip->ip_off);
1042 #endif
1043 ipf_unref();
1044 ipobf.didfilter = true;
1045 }
1046 ip_mloopback(srcifp, ifp, m, dst, hlen);
1047 }
1048 if (inm != NULL) {
1049 INM_REMREF(inm);
1050 }
1051 /*
1052 * Multicasts with a time-to-live of zero may be looped-
1053 * back, above, but must not be transmitted on a network.
1054 * Also, multicasts addressed to the loopback interface
1055 * are not sent -- the above call to ip_mloopback() will
1056 * loop back a copy if this host actually belongs to the
1057 * destination group on the loopback interface.
1058 */
1059 if (ip->ip_ttl == 0 || ifp->if_flags & IFF_LOOPBACK) {
1060 m_freem(m);
1061 goto done;
1062 }
1063
1064 goto sendit;
1065 }
1066 /*
1067 * If source address not specified yet, use address
1068 * of outgoing interface.
1069 */
1070 if (ip->ip_src.s_addr == INADDR_ANY) {
1071 IFA_LOCK_SPIN(&ia->ia_ifa);
1072 ip->ip_src = IA_SIN(ia)->sin_addr;
1073 IFA_UNLOCK(&ia->ia_ifa);
1074 }
1075
1076 /*
1077 * Look for broadcast address and
1078 * and verify user is allowed to send
1079 * such a packet.
1080 */
1081 if (ipobf.isbroadcast) {
1082 if (!(ifp->if_flags & IFF_BROADCAST)) {
1083 error = EADDRNOTAVAIL;
1084 drop_reason = DROP_REASON_IP_IF_CANNOT_BROADCAST;
1085 goto bad;
1086 }
1087 if (!(flags & IP_ALLOWBROADCAST)) {
1088 error = EACCES;
1089 drop_reason = DROP_REASON_IP_BROADCAST_NOT_ALLOWED;
1090 goto bad;
1091 }
1092 /* don't allow broadcast messages to be fragmented */
1093 if ((u_short)ip->ip_len > ifp->if_mtu) {
1094 drop_reason = DROP_REASON_IP_BROADCAST_TOO_BIG;
1095 error = EMSGSIZE;
1096 goto bad;
1097 }
1098 m->m_flags |= M_BCAST;
1099 } else {
1100 m->m_flags &= ~M_BCAST;
1101 }
1102
1103 sendit:
1104 #if PF
1105 /* Invoke outbound packet filter */
1106 if (PF_IS_ENABLED) {
1107 int rc;
1108
1109 m0 = m; /* Save for later */
1110 #if DUMMYNET
1111 rc = ip_output_pf_dn_hook(ifp, mppn, &m, dn_pf_rule, ro, dst, flags, ipoa);
1112 #else /* DUMMYNET */
1113 rc = pf_af_hook(ifp, mppn, &m, AF_INET, FALSE, NULL);
1114 #endif /* DUMMYNET */
1115 if (rc != 0 || m == NULL) {
1116 /* Move to the next packet */
1117 m = *mppn;
1118
1119 /* Skip ahead if first packet in list got dropped */
1120 if (packetlist == m0) {
1121 packetlist = m;
1122 }
1123
1124 if (m != NULL) {
1125 m0 = m;
1126 /* Next packet in the chain */
1127 goto loopit;
1128 } else if (packetlist != NULL) {
1129 /* No more packet; send down the chain */
1130 goto sendchain;
1131 }
1132 /* Nothing left; we're done */
1133 goto done;
1134 }
1135 m0 = m;
1136 ip = mtod(m, struct ip *);
1137 pkt_dst = ip->ip_dst;
1138 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1139 }
1140 #endif /* PF */
1141 /*
1142 * Force IP TTL to 255 following draft-ietf-zeroconf-ipv4-linklocal.txt
1143 */
1144 if (IN_LINKLOCAL(ntohl(ip->ip_src.s_addr)) ||
1145 IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr))) {
1146 ip_linklocal_stat.iplls_out_total++;
1147 if (ip->ip_ttl != MAXTTL) {
1148 ip_linklocal_stat.iplls_out_badttl++;
1149 ip->ip_ttl = MAXTTL;
1150 }
1151 }
1152
1153 if (!ipobf.didfilter &&
1154 !TAILQ_EMPTY(&ipv4_filters)
1155 #if NECP
1156 && !necp_packet_should_skip_filters(m)
1157 #endif // NECP
1158 ) {
1159 struct ipfilter *filter;
1160 int seen = (inject_filter_ref == NULL);
1161 ipf_pktopts.ippo_flags &= ~IPPOF_MCAST_OPTS;
1162
1163 /*
1164 * Check that a TSO frame isn't passed to a filter.
1165 * This could happen if a filter is inserted while
1166 * TCP is sending the TSO packet.
1167 */
1168 if (m->m_pkthdr.csum_flags & CSUM_TSO_IPV4) {
1169 error = EMSGSIZE;
1170 drop_reason = DROP_REASON_IP_FILTER_TSO;
1171 goto bad;
1172 }
1173
1174 ipf_ref();
1175
1176 /* 4135317 - always pass network byte order to filter */
1177 #if BYTE_ORDER != BIG_ENDIAN
1178 HTONS(ip->ip_len);
1179 HTONS(ip->ip_off);
1180 #endif
1181 TAILQ_FOREACH(filter, &ipv4_filters, ipf_link) {
1182 if (seen == 0) {
1183 if ((struct ipfilter *)inject_filter_ref ==
1184 filter) {
1185 seen = 1;
1186 }
1187 } else if (filter->ipf_filter.ipf_output) {
1188 errno_t result;
1189 result = filter->ipf_filter.
1190 ipf_output(filter->ipf_filter.cookie,
1191 (mbuf_t *)&m, ippo);
1192 if (result == EJUSTRETURN) {
1193 ipf_unref();
1194 goto done;
1195 }
1196 if (result != 0) {
1197 ipf_unref();
1198 drop_reason = DROP_REASON_IP_FILTER_DROP;
1199 goto bad;
1200 }
1201 }
1202 }
1203 /* set back to host byte order */
1204 ip = mtod(m, struct ip *);
1205 #if BYTE_ORDER != BIG_ENDIAN
1206 NTOHS(ip->ip_len);
1207 NTOHS(ip->ip_off);
1208 #endif
1209 ipf_unref();
1210 }
1211
1212 #if NECP
1213 /* Process Network Extension Policy. Will Pass, Drop, or Rebind packet. */
1214 necp_matched_policy_id = necp_ip_output_find_policy_match(m,
1215 flags, (flags & IP_OUTARGS) ? ipoa : NULL, ro ? ro->ro_rt : NULL, &necp_result, &necp_result_parameter);
1216 if (necp_matched_policy_id) {
1217 necp_mark_packet_from_ip(m, necp_matched_policy_id);
1218 switch (necp_result) {
1219 case NECP_KERNEL_POLICY_RESULT_PASS:
1220 if (necp_result_parameter.pass_flags & NECP_KERNEL_POLICY_PASS_NO_SKIP_IPSEC) {
1221 break;
1222 }
1223 /* Check if the interface is allowed */
1224 if (!necp_packet_is_allowed_over_interface(m, ifp)) {
1225 error = EHOSTUNREACH;
1226 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1227 drop_reason = DROP_REASON_IP_NECP_POLICY_NO_ALLOW_IF;
1228 goto bad;
1229 }
1230 goto skip_ipsec;
1231 case NECP_KERNEL_POLICY_RESULT_DROP:
1232 error = EHOSTUNREACH;
1233 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1234 drop_reason = DROP_REASON_IP_NECP_POLICY_DROP;
1235 goto bad;
1236 case NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT:
1237 /* Flow divert packets should be blocked at the IP layer */
1238 error = EHOSTUNREACH;
1239 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1240 drop_reason = DROP_REASON_IP_NECP_POLICY_SOCKET_DIVERT;
1241 goto bad;
1242 case NECP_KERNEL_POLICY_RESULT_IP_TUNNEL: {
1243 /* Verify that the packet is being routed to the tunnel */
1244 struct ifnet *policy_ifp = necp_get_ifnet_from_result_parameter(&necp_result_parameter);
1245 if (policy_ifp == ifp) {
1246 /* Check if the interface is allowed */
1247 if (!necp_packet_is_allowed_over_interface(m, ifp)) {
1248 error = EHOSTUNREACH;
1249 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1250 drop_reason = DROP_REASON_IP_NECP_POLICY_TUN_NO_ALLOW_IF;
1251 goto bad;
1252 }
1253 goto skip_ipsec;
1254 } else {
1255 if (necp_packet_can_rebind_to_ifnet(m, policy_ifp, &necp_route, AF_INET)) {
1256 /* Check if the interface is allowed */
1257 if (!necp_packet_is_allowed_over_interface(m, policy_ifp)) {
1258 error = EHOSTUNREACH;
1259 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1260 drop_reason = DROP_REASON_IP_NECP_POLICY_TUN_REBIND_NO_ALLOW_IF;
1261 goto bad;
1262 }
1263
1264 /*
1265 * Update the QOS marking policy if
1266 * 1. up layer asks it to do so
1267 * 2. net_qos_policy_restricted is not set
1268 * 3. qos_marking_gencount doesn't match necp_kernel_socket_policies_gencount (checked in necp_lookup_current_qos_marking)
1269 */
1270 if (ipoa != NULL &&
1271 (ipoa->ipoa_flags & IPOAF_REDO_QOSMARKING_POLICY) &&
1272 net_qos_policy_restricted != 0) {
1273 bool qos_marking = (ipoa->ipoa_flags & IPOAF_QOSMARKING_ALLOWED) ? TRUE : FALSE;
1274 qos_marking = necp_lookup_current_qos_marking(&ipoa->qos_marking_gencount, NULL, policy_ifp, necp_result_parameter.route_rule_id, qos_marking);
1275 if (qos_marking) {
1276 ipoa->ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
1277 } else {
1278 ipoa->ipoa_flags &= ~IPOAF_QOSMARKING_ALLOWED;
1279 }
1280 }
1281
1282 /* Set ifp to the tunnel interface, since it is compatible with the packet */
1283 ifp = policy_ifp;
1284 ro = &necp_route;
1285 goto skip_ipsec;
1286 } else {
1287 error = ENETUNREACH;
1288 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1289 drop_reason = DROP_REASON_IP_NECP_POLICY_TUN_NO_REBIND_IF;
1290 goto bad;
1291 }
1292 }
1293 }
1294 default:
1295 break;
1296 }
1297 }
1298 /* Catch-all to check if the interface is allowed */
1299 if (!necp_packet_is_allowed_over_interface(m, ifp)) {
1300 error = EHOSTUNREACH;
1301 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1302 drop_reason = DROP_REASON_IP_NECP_NO_ALLOW_IF;
1303 goto bad;
1304 }
1305 #endif /* NECP */
1306
1307 #if IPSEC
1308 if (ipsec_bypass != 0 || (flags & IP_NOIPSEC)) {
1309 goto skip_ipsec;
1310 }
1311
1312 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
1313
1314 if (sp == NULL) {
1315 /* get SP for this packet */
1316 if (so != NULL) {
1317 sp = ipsec4_getpolicybysock(m, IPSEC_DIR_OUTBOUND,
1318 so, &error);
1319 } else {
1320 sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND,
1321 flags, &error);
1322 }
1323 if (sp == NULL) {
1324 IPSEC_STAT_INCREMENT(ipsecstat.out_inval);
1325 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1326 0, 0, 0, 0, 0);
1327 drop_reason = DROP_REASON_IP_OUTBOUND_IPSEC_POLICY;
1328 goto bad;
1329 }
1330 }
1331
1332 error = 0;
1333
1334 /* check policy */
1335 switch (sp->policy) {
1336 case IPSEC_POLICY_DISCARD:
1337 case IPSEC_POLICY_GENERATE:
1338 /*
1339 * This packet is just discarded.
1340 */
1341 IPSEC_STAT_INCREMENT(ipsecstat.out_polvio);
1342 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1343 1, 0, 0, 0, 0);
1344 drop_reason = DROP_REASON_IP_OUTBOUND_IPSEC_POLICY;
1345 goto bad;
1346
1347 case IPSEC_POLICY_BYPASS:
1348 case IPSEC_POLICY_NONE:
1349 /* no need to do IPsec. */
1350 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1351 2, 0, 0, 0, 0);
1352 drop_reason = DROP_REASON_IP_OUTBOUND_IPSEC_POLICY;
1353 goto skip_ipsec;
1354
1355 case IPSEC_POLICY_IPSEC:
1356 if (sp->req == NULL) {
1357 /* acquire a policy */
1358 error = key_spdacquire(sp);
1359 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1360 3, 0, 0, 0, 0);
1361 drop_reason = DROP_REASON_IP_OUTBOUND_IPSEC_POLICY;
1362 goto bad;
1363 }
1364 if (sp->ipsec_if) {
1365 /* Verify the redirect to ipsec interface */
1366 if (sp->ipsec_if == ifp) {
1367 goto skip_ipsec;
1368 }
1369 drop_reason = DROP_REASON_IP_OUTBOUND_IPSEC_POLICY;
1370 goto bad;
1371 }
1372 break;
1373
1374 case IPSEC_POLICY_ENTRUST:
1375 default:
1376 printf("ip_output: Invalid policy found. %d\n", sp->policy);
1377 }
1378 {
1379 ipsec_state.m = m;
1380 if (flags & IP_ROUTETOIF) {
1381 bzero(&ipsec_state.ro, sizeof(ipsec_state.ro));
1382 } else {
1383 route_copyout((struct route *)&ipsec_state.ro, ro, sizeof(struct route));
1384 }
1385 ipsec_state.dst = SA(dst);
1386
1387 ip->ip_sum = 0;
1388
1389 /*
1390 * XXX
1391 * delayed checksums are not currently compatible with IPsec
1392 */
1393 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
1394 in_delayed_cksum(m);
1395 }
1396
1397 #if BYTE_ORDER != BIG_ENDIAN
1398 HTONS(ip->ip_len);
1399 HTONS(ip->ip_off);
1400 #endif
1401
1402 DTRACE_IP6(send, struct mbuf *, m, struct inpcb *, NULL,
1403 struct ip *, ip, struct ifnet *, ifp,
1404 struct ip *, ip, struct ip6_hdr *, NULL);
1405
1406 error = ipsec4_output(&ipsec_state, sp, flags);
1407 if (ipsec_state.tunneled == 6) {
1408 m0 = m = NULL;
1409 error = 0;
1410 goto bad;
1411 }
1412
1413 m0 = m = ipsec_state.m;
1414
1415 #if DUMMYNET
1416 /*
1417 * If we're about to use the route in ipsec_state
1418 * and this came from dummynet, cleaup now.
1419 */
1420 if (ro == &saved_route &&
1421 (!(flags & IP_ROUTETOIF) || ipsec_state.tunneled)) {
1422 ROUTE_RELEASE(ro);
1423 }
1424 #endif /* DUMMYNET */
1425
1426 if (flags & IP_ROUTETOIF) {
1427 /*
1428 * if we have tunnel mode SA, we may need to ignore
1429 * IP_ROUTETOIF.
1430 */
1431 if (ipsec_state.tunneled) {
1432 flags &= ~IP_ROUTETOIF;
1433 ro = (struct route *)&ipsec_state.ro;
1434 }
1435 } else {
1436 ro = (struct route *)&ipsec_state.ro;
1437 }
1438 dst = SIN(ipsec_state.dst);
1439 if (error) {
1440 /* mbuf is already reclaimed in ipsec4_output. */
1441 m0 = NULL;
1442 switch (error) {
1443 case EHOSTUNREACH:
1444 case ENETUNREACH:
1445 case EMSGSIZE:
1446 case ENOBUFS:
1447 case ENOMEM:
1448 break;
1449 default:
1450 printf("ip4_output (ipsec): error code %d\n", error);
1451 OS_FALLTHROUGH;
1452 case ENOENT:
1453 /* don't show these error codes to the user */
1454 error = 0;
1455 break;
1456 }
1457 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1458 4, 0, 0, 0, 0);
1459 goto bad;
1460 }
1461 }
1462
1463 /* be sure to update variables that are affected by ipsec4_output() */
1464 ip = mtod(m, struct ip *);
1465
1466 #ifdef _IP_VHL
1467 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1468 #else /* !_IP_VHL */
1469 hlen = ip->ip_hl << 2;
1470 #endif /* !_IP_VHL */
1471 /* Check that there wasn't a route change and src is still valid */
1472 if (ROUTE_UNUSABLE(ro)) {
1473 ROUTE_RELEASE(ro);
1474 VERIFY(src_ia == NULL);
1475 if (ip->ip_src.s_addr != INADDR_ANY &&
1476 !(flags & (IP_ROUTETOIF | IP_FORWARDING)) &&
1477 (src_ia = ifa_foraddr(ip->ip_src.s_addr)) == NULL) {
1478 error = EADDRNOTAVAIL;
1479 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1480 5, 0, 0, 0, 0);
1481 OSAddAtomic(1, &ipstat.ips_src_addr_not_avail);
1482 drop_reason = DROP_REASON_IP_SRC_ADDR_NO_AVAIL;
1483 goto bad;
1484 }
1485 if (src_ia != NULL) {
1486 ifa_remref(&src_ia->ia_ifa);
1487 src_ia = NULL;
1488 }
1489 }
1490
1491 if (ro->ro_rt == NULL) {
1492 if (!(flags & IP_ROUTETOIF)) {
1493 printf("%s: can't update route after "
1494 "IPsec processing\n", __func__);
1495 error = EHOSTUNREACH; /* XXX */
1496 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1497 6, 0, 0, 0, 0);
1498 drop_reason = DROP_REASON_IP_NO_ROUTE;
1499 goto bad;
1500 }
1501 } else {
1502 if (ia != NULL) {
1503 ifa_remref(&ia->ia_ifa);
1504 }
1505 RT_LOCK_SPIN(ro->ro_rt);
1506 ia = ifatoia(ro->ro_rt->rt_ifa);
1507 if (ia != NULL) {
1508 /* Become a regular mutex */
1509 RT_CONVERT_LOCK(ro->ro_rt);
1510 ifa_addref(&ia->ia_ifa);
1511 }
1512 ifp = ro->ro_rt->rt_ifp;
1513 RT_UNLOCK(ro->ro_rt);
1514 }
1515
1516 /* make it flipped, again. */
1517 #if BYTE_ORDER != BIG_ENDIAN
1518 NTOHS(ip->ip_len);
1519 NTOHS(ip->ip_off);
1520 #endif
1521 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1522 7, 0xff, 0xff, 0xff, 0xff);
1523
1524 /* Pass to filters again */
1525 if (!TAILQ_EMPTY(&ipv4_filters)
1526 #if NECP
1527 && !necp_packet_should_skip_filters(m)
1528 #endif // NECP
1529 ) {
1530 struct ipfilter *filter;
1531
1532 ipf_pktopts.ippo_flags &= ~IPPOF_MCAST_OPTS;
1533
1534 /*
1535 * Check that a TSO frame isn't passed to a filter.
1536 * This could happen if a filter is inserted while
1537 * TCP is sending the TSO packet.
1538 */
1539 if (m->m_pkthdr.csum_flags & CSUM_TSO_IPV4) {
1540 error = EMSGSIZE;
1541 drop_reason = DROP_REASON_IP_FILTER_TSO;
1542 goto bad;
1543 }
1544
1545 ipf_ref();
1546
1547 /* 4135317 - always pass network byte order to filter */
1548 #if BYTE_ORDER != BIG_ENDIAN
1549 HTONS(ip->ip_len);
1550 HTONS(ip->ip_off);
1551 #endif
1552 TAILQ_FOREACH(filter, &ipv4_filters, ipf_link) {
1553 if (filter->ipf_filter.ipf_output) {
1554 errno_t result;
1555 result = filter->ipf_filter.
1556 ipf_output(filter->ipf_filter.cookie,
1557 (mbuf_t *)&m, ippo);
1558 if (result == EJUSTRETURN) {
1559 ipf_unref();
1560 goto done;
1561 }
1562 if (result != 0) {
1563 ipf_unref();
1564 drop_reason = DROP_REASON_IP_FILTER_DROP;
1565 goto bad;
1566 }
1567 }
1568 }
1569 /* set back to host byte order */
1570 ip = mtod(m, struct ip *);
1571 #if BYTE_ORDER != BIG_ENDIAN
1572 NTOHS(ip->ip_len);
1573 NTOHS(ip->ip_off);
1574 #endif
1575 ipf_unref();
1576 }
1577 skip_ipsec:
1578 #endif /* IPSEC */
1579
1580
1581 /* 127/8 must not appear on wire - RFC1122 */
1582 if (!(ifp->if_flags & IFF_LOOPBACK) &&
1583 ((ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
1584 (ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET)) {
1585 OSAddAtomic(1, &ipstat.ips_badaddr);
1586 error = EADDRNOTAVAIL;
1587 drop_reason = DROP_REASON_IP_INVALID_ADDR;
1588 goto bad;
1589 }
1590
1591 if (ipoa != NULL) {
1592 u_int8_t dscp = ip->ip_tos >> IPTOS_DSCP_SHIFT;
1593
1594 error = set_packet_qos(m, ifp,
1595 ipoa->ipoa_flags & IPOAF_QOSMARKING_ALLOWED ? TRUE : FALSE,
1596 ipoa->ipoa_sotc, ipoa->ipoa_netsvctype, &dscp);
1597 if (error == 0) {
1598 ip->ip_tos &= IPTOS_ECN_MASK;
1599 ip->ip_tos |= (u_char)(dscp << IPTOS_DSCP_SHIFT);
1600 } else {
1601 printf("%s if_dscp_for_mbuf() error %d\n", __func__, error);
1602 error = 0;
1603 }
1604 }
1605
1606 ip_output_checksum(ifp, m, (IP_VHL_HL(ip->ip_vhl) << 2),
1607 ip->ip_len, &sw_csum);
1608
1609 interface_mtu = ifp->if_mtu;
1610
1611 if (INTF_ADJUST_MTU_FOR_CLAT46(ifp)) {
1612 interface_mtu = IN6_LINKMTU(ifp);
1613 /* Further adjust the size for CLAT46 expansion */
1614 interface_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
1615 }
1616
1617 /*
1618 * If small enough for interface, or the interface will take
1619 * care of the fragmentation for us, can just send directly.
1620 */
1621 if ((u_short)ip->ip_len <= interface_mtu || TSO_IPV4_OK(ifp, m) ||
1622 (!(ip->ip_off & IP_DF) && (ifp->if_hwassist & CSUM_FRAGMENT))) {
1623 #if BYTE_ORDER != BIG_ENDIAN
1624 HTONS(ip->ip_len);
1625 HTONS(ip->ip_off);
1626 #endif
1627
1628 ip->ip_sum = 0;
1629 if ((sw_csum & CSUM_DELAY_IP) || __improbable(force_ipsum != 0)) {
1630 ip->ip_sum = ip_cksum_hdr_out(m, hlen);
1631 sw_csum &= ~CSUM_DELAY_IP;
1632 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_IP;
1633 }
1634
1635 #if IPSEC
1636 /* clean ipsec history once it goes out of the node */
1637 if (ipsec_bypass == 0 && !(flags & IP_NOIPSEC)) {
1638 ipsec_delaux(m);
1639 }
1640 #endif /* IPSEC */
1641 if ((m->m_pkthdr.csum_flags & CSUM_TSO_IPV4) &&
1642 (m->m_pkthdr.tso_segsz > 0)) {
1643 scnt += m->m_pkthdr.len / m->m_pkthdr.tso_segsz;
1644 } else {
1645 scnt++;
1646 }
1647
1648 if (packetchain == 0) {
1649 if (ro->ro_rt != NULL && nstat_collect) {
1650 nstat_route_tx(ro->ro_rt, scnt,
1651 m->m_pkthdr.len, 0);
1652 }
1653
1654 error = dlil_output(ifp, PF_INET, m, ro->ro_rt,
1655 SA(dst), 0, adv);
1656 if (dlil_verbose && error) {
1657 printf("dlil_output error on interface %s: %d\n",
1658 ifp->if_xname, error);
1659 }
1660 scnt = 0;
1661 goto done;
1662 } else {
1663 /*
1664 * packet chaining allows us to reuse the
1665 * route for all packets
1666 */
1667 bytecnt += m->m_pkthdr.len;
1668 mppn = &m->m_nextpkt;
1669 m = m->m_nextpkt;
1670 if (m == NULL) {
1671 #if PF
1672 sendchain:
1673 #endif /* PF */
1674 if (pktcnt > ip_maxchainsent) {
1675 ip_maxchainsent = pktcnt;
1676 }
1677 if (ro->ro_rt != NULL && nstat_collect) {
1678 nstat_route_tx(ro->ro_rt, scnt,
1679 bytecnt, 0);
1680 }
1681
1682 error = dlil_output(ifp, PF_INET, packetlist,
1683 ro->ro_rt, SA(dst), 0, adv);
1684 if (dlil_verbose && error) {
1685 printf("dlil_output error on interface %s: %d\n",
1686 ifp->if_xname, error);
1687 }
1688 pktcnt = 0;
1689 scnt = 0;
1690 bytecnt = 0;
1691 goto done;
1692 }
1693 m0 = m;
1694 pktcnt++;
1695 goto loopit;
1696 }
1697 }
1698
1699 VERIFY(interface_mtu != 0);
1700 /*
1701 * Too large for interface; fragment if possible.
1702 * Must be able to put at least 8 bytes per fragment.
1703 * Balk when DF bit is set or the interface didn't support TSO.
1704 */
1705 if ((ip->ip_off & IP_DF) || pktcnt > 0 ||
1706 (m->m_pkthdr.csum_flags & CSUM_TSO_IPV4)) {
1707 error = EMSGSIZE;
1708 /*
1709 * This case can happen if the user changed the MTU
1710 * of an interface after enabling IP on it. Because
1711 * most netifs don't keep track of routes pointing to
1712 * them, there is no way for one to update all its
1713 * routes when the MTU is changed.
1714 */
1715 if (ro->ro_rt) {
1716 RT_LOCK_SPIN(ro->ro_rt);
1717 if ((ro->ro_rt->rt_flags & (RTF_UP | RTF_HOST)) &&
1718 !(ro->ro_rt->rt_rmx.rmx_locks & RTV_MTU) &&
1719 (ro->ro_rt->rt_rmx.rmx_mtu > interface_mtu)) {
1720 ro->ro_rt->rt_rmx.rmx_mtu = interface_mtu;
1721 }
1722 RT_UNLOCK(ro->ro_rt);
1723 }
1724 if (pktcnt > 0) {
1725 m0 = packetlist;
1726 }
1727 OSAddAtomic(1, &ipstat.ips_cantfrag);
1728 drop_reason = DROP_REASON_IP_CANNOT_FRAGMENT;
1729 goto bad;
1730 }
1731
1732 /*
1733 * XXX Only TCP seems to be passing a list of packets here.
1734 * The following issue is limited to UDP datagrams with 0 checksum.
1735 * For now limit it to the case when single packet is passed down.
1736 */
1737 if (packetchain == 0 && IS_INTF_CLAT46(ifp)) {
1738 /*
1739 * If it is a UDP packet that has checksum set to 0
1740 * and is also not being offloaded, compute a full checksum
1741 * and update the UDP checksum.
1742 */
1743 if (ip->ip_p == IPPROTO_UDP &&
1744 !(m->m_pkthdr.csum_flags & (CSUM_UDP | CSUM_PARTIAL))) {
1745 struct udphdr *uh = NULL;
1746
1747 if (m->m_len < hlen + sizeof(struct udphdr)) {
1748 m = m_pullup(m, hlen + sizeof(struct udphdr));
1749 if (m == NULL) {
1750 error = ENOBUFS;
1751 m0 = m;
1752 goto bad;
1753 }
1754 m0 = m;
1755 ip = mtod(m, struct ip *);
1756 }
1757 /*
1758 * Get UDP header and if checksum is 0, then compute the full
1759 * checksum.
1760 */
1761 uh = (struct udphdr *)(void *)((caddr_t)ip + hlen);
1762 if (uh->uh_sum == 0) {
1763 uh->uh_sum = inet_cksum(m, IPPROTO_UDP, hlen,
1764 ip->ip_len - hlen);
1765 if (uh->uh_sum == 0) {
1766 uh->uh_sum = 0xffff;
1767 }
1768 }
1769 }
1770 }
1771
1772 error = ip_fragment(m, ifp, interface_mtu, sw_csum);
1773 if (error != 0) {
1774 m0 = m = NULL;
1775 /* ip_fragment() takes care of calling m_drop() */
1776 goto done;
1777 }
1778
1779 KERNEL_DEBUG(DBG_LAYER_END, ip->ip_dst.s_addr,
1780 ip->ip_src.s_addr, ip->ip_p, ip->ip_off, ip->ip_len);
1781
1782 for (m = m0; m; m = m0) {
1783 m0 = m->m_nextpkt;
1784 m->m_nextpkt = 0;
1785 #if IPSEC
1786 /* clean ipsec history once it goes out of the node */
1787 if (ipsec_bypass == 0 && !(flags & IP_NOIPSEC)) {
1788 ipsec_delaux(m);
1789 }
1790 #endif /* IPSEC */
1791 if (error == 0) {
1792 if ((packetchain != 0) && (pktcnt > 0)) {
1793 panic("%s: mix of packet in packetlist is "
1794 "wrong=%p", __func__, packetlist);
1795 /* NOTREACHED */
1796 }
1797 if (ro->ro_rt != NULL && nstat_collect) {
1798 nstat_route_tx(ro->ro_rt, 1,
1799 m->m_pkthdr.len, 0);
1800 }
1801 error = dlil_output(ifp, PF_INET, m, ro->ro_rt,
1802 SA(dst), 0, adv);
1803 if (dlil_verbose && error) {
1804 printf("dlil_output error on interface %s: %d\n",
1805 ifp->if_xname, error);
1806 }
1807 } else {
1808 m_freem(m);
1809 }
1810 }
1811
1812 if (error == 0) {
1813 OSAddAtomic(1, &ipstat.ips_fragmented);
1814 }
1815
1816 done:
1817 if (ia != NULL) {
1818 ifa_remref(&ia->ia_ifa);
1819 ia = NULL;
1820 }
1821 #if IPSEC
1822 ROUTE_RELEASE(&ipsec_state.ro);
1823 if (sp != NULL) {
1824 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1825 printf("DP ip_output call free SP:%x\n", sp));
1826 key_freesp(sp, KEY_SADB_UNLOCKED);
1827 }
1828 #endif /* IPSEC */
1829 #if NECP
1830 ROUTE_RELEASE(&necp_route);
1831 #endif /* NECP */
1832 #if DUMMYNET
1833 ROUTE_RELEASE(&saved_route);
1834 #endif /* DUMMYNET */
1835
1836 KERNEL_DEBUG(DBG_FNC_IP_OUTPUT | DBG_FUNC_END, error, 0, 0, 0, 0);
1837 if (ip_output_measure) {
1838 net_perf_measure_time(&net_perf, &start_tv, packets_processed);
1839 net_perf_histogram(&net_perf, packets_processed);
1840 }
1841 return error;
1842 bad:
1843 if (pktcnt > 0) {
1844 m0 = packetlist;
1845 }
1846 m_drop_list(m0, ifp, DROPTAP_FLAG_DIR_OUT | DROPTAP_FLAG_L2_MISSING, drop_reason, NULL, 0);
1847 goto done;
1848
1849 #undef ipsec_state
1850 #undef args
1851 #undef sro_fwd
1852 #undef saved_route
1853 #undef ipf_pktopts
1854 #undef IP_CHECK_RESTRICTIONS
1855 }
1856
1857 int
ip_fragment(struct mbuf * m,struct ifnet * ifp,uint32_t mtu,int sw_csum)1858 ip_fragment(struct mbuf *m, struct ifnet *ifp, uint32_t mtu, int sw_csum)
1859 {
1860 struct ip *ip, *mhip;
1861 int len, hlen, mhlen, firstlen, off;
1862 struct mbuf **mnext = &m->m_nextpkt, *m0;
1863 int nfrags = 1;
1864
1865 ip = mtod(m, struct ip *);
1866 #ifdef _IP_VHL
1867 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1868 #else /* !_IP_VHL */
1869 hlen = ip->ip_hl << 2;
1870 #endif /* !_IP_VHL */
1871
1872 /*
1873 * We need to adjust the fragment sizes to account
1874 * for IPv6 fragment header if it needs to be translated
1875 * from IPv4 to IPv6.
1876 */
1877 if (IS_INTF_CLAT46(ifp)) {
1878 mtu -= sizeof(struct ip6_frag);
1879 }
1880
1881 firstlen = len = (mtu - hlen) & ~7;
1882 if (len < 8) {
1883 OSAddAtomic(1, &ipstat.ips_odropped);
1884 m_drop(m, DROPTAP_FLAG_DIR_OUT | DROPTAP_FLAG_L2_MISSING, DROP_REASON_IP_FRAG_TOO_SMALL,
1885 NULL, 0);
1886 return EMSGSIZE;
1887 }
1888
1889 /*
1890 * if the interface will not calculate checksums on
1891 * fragmented packets, then do it here.
1892 */
1893 if ((m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) &&
1894 !(ifp->if_hwassist & CSUM_IP_FRAGS)) {
1895 in_delayed_cksum(m);
1896 }
1897
1898 /*
1899 * Loop through length of segment after first fragment,
1900 * make new header and copy data of each part and link onto chain.
1901 */
1902 m0 = m;
1903 mhlen = sizeof(struct ip);
1904 for (off = hlen + len; off < (u_short)ip->ip_len; off += len) {
1905 MGETHDR(m, M_DONTWAIT, MT_HEADER); /* MAC-OK */
1906 if (m == NULL) {
1907 m_drop(m, DROPTAP_FLAG_DIR_OUT | DROPTAP_FLAG_L2_MISSING, DROP_REASON_IP_FRAG_NO_MEM,
1908 NULL, 0);
1909 OSAddAtomic(1, &ipstat.ips_odropped);
1910 return ENOBUFS;
1911 }
1912 m->m_flags |= (m0->m_flags & M_MCAST) | M_FRAG;
1913 m->m_data += max_linkhdr;
1914 mhip = mtod(m, struct ip *);
1915 *mhip = *ip;
1916 if (hlen > sizeof(struct ip)) {
1917 mhlen = ip_optcopy(ip, mhip) + sizeof(struct ip);
1918 mhip->ip_vhl = IP_MAKE_VHL(IPVERSION, mhlen >> 2);
1919 }
1920 m->m_len = mhlen;
1921 mhip->ip_off = (u_short)(((off - hlen) >> 3) + (ip->ip_off & ~IP_MF));
1922 if (ip->ip_off & IP_MF) {
1923 mhip->ip_off |= IP_MF;
1924 }
1925 if (off + len >= (u_short)ip->ip_len) {
1926 len = (u_short)ip->ip_len - off;
1927 } else {
1928 mhip->ip_off |= IP_MF;
1929 }
1930 mhip->ip_len = htons((u_short)(len + mhlen));
1931 m->m_next = m_copy(m0, off, len);
1932 if (m->m_next == NULL) {
1933 m_drop(m, DROPTAP_FLAG_DIR_OUT | DROPTAP_FLAG_L2_MISSING, DROP_REASON_IP_FRAG_NO_MEM,
1934 NULL, 0);
1935 OSAddAtomic(1, &ipstat.ips_odropped);
1936 return ENOBUFS;
1937 }
1938 m->m_pkthdr.len = mhlen + len;
1939 m->m_pkthdr.rcvif = NULL;
1940 m->m_pkthdr.csum_flags = m0->m_pkthdr.csum_flags;
1941
1942 M_COPY_CLASSIFIER(m, m0);
1943 M_COPY_PFTAG(m, m0);
1944 M_COPY_NECPTAG(m, m0);
1945
1946 #if BYTE_ORDER != BIG_ENDIAN
1947 HTONS(mhip->ip_off);
1948 #endif
1949
1950 mhip->ip_sum = 0;
1951 if (sw_csum & CSUM_DELAY_IP) {
1952 mhip->ip_sum = ip_cksum_hdr_out(m, mhlen);
1953 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_IP;
1954 }
1955 *mnext = m;
1956 mnext = &m->m_nextpkt;
1957 nfrags++;
1958 }
1959 OSAddAtomic(nfrags, &ipstat.ips_ofragments);
1960
1961 /* set first/last markers for fragment chain */
1962 m->m_flags |= M_LASTFRAG;
1963 m0->m_flags |= M_FIRSTFRAG | M_FRAG;
1964 m0->m_pkthdr.csum_data = nfrags;
1965
1966 /*
1967 * Update first fragment by trimming what's been copied out
1968 * and updating header, then send each fragment (in order).
1969 */
1970 m = m0;
1971 m_adj(m, hlen + firstlen - (u_short)ip->ip_len);
1972 m->m_pkthdr.len = hlen + firstlen;
1973 ip->ip_len = htons((u_short)m->m_pkthdr.len);
1974 ip->ip_off |= IP_MF;
1975
1976 #if BYTE_ORDER != BIG_ENDIAN
1977 HTONS(ip->ip_off);
1978 #endif
1979
1980 ip->ip_sum = 0;
1981 if (sw_csum & CSUM_DELAY_IP) {
1982 ip->ip_sum = ip_cksum_hdr_out(m, hlen);
1983 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_IP;
1984 }
1985
1986 return 0;
1987 }
1988
1989 static void
ip_out_cksum_stats(int proto,u_int32_t len)1990 ip_out_cksum_stats(int proto, u_int32_t len)
1991 {
1992 switch (proto) {
1993 case IPPROTO_TCP:
1994 tcp_out_cksum_stats(len);
1995 break;
1996 case IPPROTO_UDP:
1997 udp_out_cksum_stats(len);
1998 break;
1999 default:
2000 /* keep only TCP or UDP stats for now */
2001 break;
2002 }
2003 }
2004
2005 /*
2006 * Process a delayed payload checksum calculation (outbound path.)
2007 *
2008 * hoff is the number of bytes beyond the mbuf data pointer which
2009 * points to the IP header.
2010 *
2011 * Returns a bitmask representing all the work done in software.
2012 */
2013 uint32_t
in_finalize_cksum(struct mbuf * m,uint32_t hoff,uint32_t csum_flags)2014 in_finalize_cksum(struct mbuf *m, uint32_t hoff, uint32_t csum_flags)
2015 {
2016 unsigned char buf[15 << 2] __attribute__((aligned(8)));
2017 struct ip *__single ip;
2018 uint32_t offset, _hlen, mlen, hlen, len, sw_csum;
2019 uint16_t csum, ip_len;
2020
2021 _CASSERT(sizeof(csum) == sizeof(uint16_t));
2022 VERIFY(m->m_flags & M_PKTHDR);
2023
2024 sw_csum = (csum_flags & m->m_pkthdr.csum_flags);
2025
2026 if ((sw_csum &= (CSUM_DELAY_IP | CSUM_DELAY_DATA)) == 0) {
2027 goto done;
2028 }
2029
2030 mlen = m->m_pkthdr.len; /* total mbuf len */
2031
2032 /* sanity check (need at least simple IP header) */
2033 if (mlen < (hoff + sizeof(*ip))) {
2034 panic("%s: mbuf %p pkt len (%u) < hoff+ip_hdr "
2035 "(%u+%u)\n", __func__, m, mlen, hoff,
2036 (uint32_t)sizeof(*ip));
2037 /* NOTREACHED */
2038 }
2039
2040 /*
2041 * In case the IP header is not contiguous, or not 32-bit aligned,
2042 * or if we're computing the IP header checksum, copy it to a local
2043 * buffer. Copy only the simple IP header here (IP options case
2044 * is handled below.)
2045 */
2046 if ((sw_csum & CSUM_DELAY_IP) || (hoff + sizeof(*ip)) > m->m_len ||
2047 !IP_HDR_ALIGNED_P(mtod(m, caddr_t) + hoff)) {
2048 m_copydata(m, hoff, sizeof(*ip), (caddr_t)buf);
2049 ip = (struct ip *)(void *)buf;
2050 _hlen = sizeof(*ip);
2051 } else {
2052 ip = (struct ip *)(void *)(m_mtod_current(m) + hoff);
2053 _hlen = 0;
2054 }
2055
2056 hlen = IP_VHL_HL(ip->ip_vhl) << 2; /* IP header len */
2057
2058 /* sanity check */
2059 if (mlen < (hoff + hlen)) {
2060 panic("%s: mbuf %p pkt too short (%d) for IP header (%u), "
2061 "hoff %u", __func__, m, mlen, hlen, hoff);
2062 /* NOTREACHED */
2063 }
2064
2065 /*
2066 * We could be in the context of an IP or interface filter; in the
2067 * former case, ip_len would be in host (correct) order while for
2068 * the latter it would be in network order. Because of this, we
2069 * attempt to interpret the length field by comparing it against
2070 * the actual packet length. If the comparison fails, byte swap
2071 * the length and check again. If it still fails, use the actual
2072 * packet length. This also covers the trailing bytes case.
2073 */
2074 ip_len = ip->ip_len;
2075 if (ip_len != (mlen - hoff)) {
2076 ip_len = OSSwapInt16(ip_len);
2077 if (ip_len != (mlen - hoff)) {
2078 printf("%s: mbuf 0x%llx proto %d IP len %d (%x) "
2079 "[swapped %d (%x)] doesn't match actual packet "
2080 "length; %d is used instead\n", __func__,
2081 (uint64_t)VM_KERNEL_ADDRHASH(m), ip->ip_p,
2082 ip->ip_len, ip->ip_len, ip_len, ip_len,
2083 (mlen - hoff));
2084 if (mlen - hoff > UINT16_MAX) {
2085 panic("%s: mlen %u - hoff %u > 65535",
2086 __func__, mlen, hoff);
2087 }
2088 ip_len = (uint16_t)(mlen - hoff);
2089 }
2090 }
2091
2092 len = ip_len - hlen; /* csum span */
2093
2094 if (sw_csum & CSUM_DELAY_DATA) {
2095 uint16_t ulpoff;
2096
2097 /*
2098 * offset is added to the lower 16-bit value of csum_data,
2099 * which is expected to contain the ULP offset; therefore
2100 * CSUM_PARTIAL offset adjustment must be undone.
2101 */
2102 if ((m->m_pkthdr.csum_flags & (CSUM_PARTIAL | CSUM_DATA_VALID)) ==
2103 (CSUM_PARTIAL | CSUM_DATA_VALID)) {
2104 /*
2105 * Get back the original ULP offset (this will
2106 * undo the CSUM_PARTIAL logic in ip_output.)
2107 */
2108 m->m_pkthdr.csum_data = (m->m_pkthdr.csum_tx_stuff -
2109 m->m_pkthdr.csum_tx_start);
2110 }
2111
2112 ulpoff = (m->m_pkthdr.csum_data & 0xffff); /* ULP csum offset */
2113 offset = hoff + hlen; /* ULP header */
2114
2115 if (mlen < (ulpoff + sizeof(csum))) {
2116 panic("%s: mbuf %p pkt len (%u) proto %d invalid ULP "
2117 "cksum offset (%u) cksum flags 0x%x\n", __func__,
2118 m, mlen, ip->ip_p, ulpoff, m->m_pkthdr.csum_flags);
2119 /* NOTREACHED */
2120 }
2121
2122 csum = inet_cksum(m, 0, offset, len);
2123
2124 /* Update stats */
2125 ip_out_cksum_stats(ip->ip_p, len);
2126
2127 /* RFC1122 4.1.3.4 */
2128 if (csum == 0 &&
2129 (m->m_pkthdr.csum_flags & (CSUM_UDP | CSUM_ZERO_INVERT))) {
2130 csum = 0xffff;
2131 }
2132
2133 /* Insert the checksum in the ULP csum field */
2134 offset += ulpoff;
2135 if (offset + sizeof(csum) > m->m_len) {
2136 m_copyback(m, offset, sizeof(csum), &csum);
2137 } else if (IP_HDR_ALIGNED_P(mtod(m, char *) + hoff)) {
2138 *(uint16_t *)(void *)(mtod(m, char *) + offset) = csum;
2139 } else {
2140 bcopy(&csum, (mtod(m, char *) + offset), sizeof(csum));
2141 }
2142 m->m_pkthdr.csum_flags &= ~(CSUM_DELAY_DATA | CSUM_DATA_VALID |
2143 CSUM_PARTIAL | CSUM_ZERO_INVERT);
2144 }
2145
2146 if (sw_csum & CSUM_DELAY_IP) {
2147 /* IP header must be in the local buffer */
2148 VERIFY(_hlen == sizeof(*ip));
2149 if (_hlen != hlen) {
2150 VERIFY(hlen <= sizeof(buf));
2151 m_copydata(m, hoff, hlen, (caddr_t)buf);
2152 ip = (struct ip *)(void *)buf;
2153 _hlen = hlen;
2154 }
2155
2156 /*
2157 * Compute the IP header checksum as if the IP length
2158 * is the length which we believe is "correct"; see
2159 * how ip_len gets calculated above. Note that this
2160 * is done on the local copy and not on the real one.
2161 */
2162 ip->ip_len = htons(ip_len);
2163 ip->ip_sum = 0;
2164 csum = in_cksum_hdr_opt(ip);
2165
2166 /* Update stats */
2167 ipstat.ips_snd_swcsum++;
2168 ipstat.ips_snd_swcsum_bytes += hlen;
2169
2170 /*
2171 * Insert only the checksum in the existing IP header
2172 * csum field; all other fields are left unchanged.
2173 */
2174 offset = hoff + offsetof(struct ip, ip_sum);
2175 if (offset + sizeof(csum) > m->m_len) {
2176 m_copyback(m, offset, sizeof(csum), &csum);
2177 } else if (IP_HDR_ALIGNED_P(mtod(m, char *) + hoff)) {
2178 *(uint16_t *)(void *)(mtod(m, char *) + offset) = csum;
2179 } else {
2180 bcopy(&csum, (mtod(m, char *) + offset), sizeof(csum));
2181 }
2182 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_IP;
2183 }
2184
2185 done:
2186 return sw_csum;
2187 }
2188
2189 /*
2190 * Insert IP options into preformed packet.
2191 * Adjust IP destination as required for IP source routing,
2192 * as indicated by a non-zero in_addr at the start of the options.
2193 *
2194 * XXX This routine assumes that the packet has no options in place.
2195 */
2196 static struct mbuf *
ip_insertoptions(struct mbuf * m,struct mbuf * opt,int * phlen)2197 ip_insertoptions(struct mbuf *m, struct mbuf *opt, int *phlen)
2198 {
2199 struct ipoption *p = mtod(opt, struct ipoption *);
2200 struct mbuf *n;
2201 struct ip *ip = mtod(m, struct ip *);
2202 unsigned optlen;
2203
2204 optlen = opt->m_len - sizeof(p->ipopt_dst);
2205 if (optlen + (u_short)ip->ip_len > IP_MAXPACKET) {
2206 return m; /* XXX should fail */
2207 }
2208 if (p->ipopt_dst.s_addr) {
2209 ip->ip_dst = p->ipopt_dst;
2210 }
2211 if (m->m_flags & M_EXT || m_mtod_current(m) - optlen < m->m_pktdat) {
2212 MGETHDR(n, M_DONTWAIT, MT_HEADER); /* MAC-OK */
2213 if (n == NULL) {
2214 return m;
2215 }
2216 n->m_pkthdr.rcvif = 0;
2217 n->m_pkthdr.len = m->m_pkthdr.len + optlen;
2218 m->m_len -= sizeof(struct ip);
2219 m->m_data += sizeof(struct ip);
2220 n->m_next = m;
2221 m = n;
2222 m->m_len = optlen + sizeof(struct ip);
2223 m->m_data += max_linkhdr;
2224 (void) memcpy(mtod(m, void *), ip, sizeof(struct ip));
2225 } else {
2226 m->m_data -= optlen;
2227 m->m_len += optlen;
2228 m->m_pkthdr.len += optlen;
2229 ovbcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));
2230 }
2231 ip = mtod(m, struct ip *);
2232 bcopy(p->ipopt_list, ip + 1, optlen);
2233 *phlen = sizeof(struct ip) + optlen;
2234 ip->ip_vhl = IP_MAKE_VHL(IPVERSION, *phlen >> 2);
2235 ip->ip_len += optlen;
2236 return m;
2237 }
2238
2239 /*
2240 * Copy options from ip to jp,
2241 * omitting those not copied during fragmentation.
2242 */
2243 static int
ip_optcopy(struct ip * __indexable ip,struct ip * __indexable jp)2244 ip_optcopy(struct ip *__indexable ip, struct ip *__indexable jp)
2245 {
2246 u_char *cp, *dp;
2247 int opt, optlen, cnt;
2248
2249 cp = (u_char *)(ip + 1);
2250 dp = (u_char *)(jp + 1);
2251 cnt = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
2252 for (; cnt > 0; cnt -= optlen, cp += optlen) {
2253 opt = cp[0];
2254 if (opt == IPOPT_EOL) {
2255 break;
2256 }
2257 if (opt == IPOPT_NOP) {
2258 /* Preserve for IP mcast tunnel's LSRR alignment. */
2259 *dp++ = IPOPT_NOP;
2260 optlen = 1;
2261 continue;
2262 }
2263 #if DIAGNOSTIC
2264 if (cnt < IPOPT_OLEN + sizeof(*cp)) {
2265 panic("malformed IPv4 option passed to ip_optcopy");
2266 /* NOTREACHED */
2267 }
2268 #endif
2269 optlen = cp[IPOPT_OLEN];
2270 #if DIAGNOSTIC
2271 if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) {
2272 panic("malformed IPv4 option passed to ip_optcopy");
2273 /* NOTREACHED */
2274 }
2275 #endif
2276 /* bogus lengths should have been caught by ip_dooptions */
2277 if (optlen > cnt) {
2278 optlen = cnt;
2279 }
2280 if (IPOPT_COPIED(opt)) {
2281 bcopy(cp, dp, optlen);
2282 dp += optlen;
2283 }
2284 }
2285 for (optlen = (int)(dp - (u_char *)(jp + 1)); optlen & 0x3; optlen++) {
2286 *dp++ = IPOPT_EOL;
2287 }
2288 return optlen;
2289 }
2290
2291
2292 /*
2293 * IP socket option processing.
2294 */
2295 int
ip_ctloutput(struct socket * so,struct sockopt * sopt)2296 ip_ctloutput(struct socket *so, struct sockopt *sopt)
2297 {
2298 struct inpcb *inp = sotoinpcb(so);
2299 int error, optval;
2300
2301 error = optval = 0;
2302
2303 if (sopt->sopt_level != IPPROTO_IP && !(sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_BINDTODEVICE)) {
2304 return EINVAL;
2305 }
2306
2307 switch (sopt->sopt_dir) {
2308 case SOPT_SET:
2309 /*
2310 * Wait if we are in the middle of ip_output
2311 * as we unlocked the socket there and don't
2312 * want to overwrite the IP options
2313 */
2314 if (inp->inp_sndinprog_cnt > 0) {
2315 lck_mtx_t *__single mutex_held = NULL;
2316
2317 mutex_held = socket_getlock(so, PR_F_WILLUNLOCK);
2318
2319 inp->inp_sndingprog_waiters++;
2320
2321 while (inp->inp_sndinprog_cnt > 0) {
2322 msleep(&inp->inp_sndinprog_cnt, mutex_held,
2323 PSOCK | PCATCH, "inp_sndinprog_cnt", NULL);
2324 }
2325 inp->inp_sndingprog_waiters--;
2326 }
2327 if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_BINDTODEVICE) {
2328 char namebuf[IFNAMSIZ + 1] = {};
2329
2330 error = sooptcopyin_bindtodevice(sopt, namebuf, sizeof(namebuf));
2331 if (error != 0) {
2332 break;
2333 }
2334 namebuf[IFNAMSIZ] = 0;
2335
2336 error = inp_bindtodevice(inp, __unsafe_null_terminated_from_indexable(namebuf, namebuf + IFNAMSIZ));
2337
2338 break;
2339 }
2340 switch (sopt->sopt_name) {
2341 #ifdef notyet
2342 case IP_RETOPTS:
2343 #endif
2344 case IP_OPTIONS: {
2345 struct mbuf *m;
2346
2347 if (sopt->sopt_valsize > MLEN) {
2348 error = EMSGSIZE;
2349 break;
2350 }
2351 MGET(m, sopt->sopt_p != kernproc ? M_WAIT : M_DONTWAIT,
2352 MT_HEADER);
2353 if (m == NULL) {
2354 error = ENOBUFS;
2355 break;
2356 }
2357 m->m_len = (int32_t)sopt->sopt_valsize;
2358 error = sooptcopyin(sopt, mtod(m, char *),
2359 m->m_len, m->m_len);
2360 if (error) {
2361 m_freem(m);
2362 break;
2363 }
2364
2365 return ip_pcbopts(sopt->sopt_name,
2366 &inp->inp_options, m);
2367 }
2368
2369 case IP_TOS:
2370 case IP_TTL:
2371 case IP_RECVOPTS:
2372 case IP_RECVRETOPTS:
2373 case IP_RECVDSTADDR:
2374 case IP_RECVIF:
2375 case IP_RECVTTL:
2376 case IP_RECVPKTINFO:
2377 case IP_RECVTOS:
2378 case IP_DONTFRAG:
2379 error = sooptcopyin(sopt, &optval, sizeof(optval),
2380 sizeof(optval));
2381 if (error) {
2382 break;
2383 }
2384
2385 switch (sopt->sopt_name) {
2386 case IP_TOS:
2387 if (optval > UINT8_MAX) {
2388 error = EINVAL;
2389 break;
2390 }
2391 inp->inp_ip_tos = (uint8_t)optval;
2392 break;
2393
2394 case IP_TTL:
2395 if (optval > UINT8_MAX) {
2396 error = EINVAL;
2397 break;
2398 }
2399 inp->inp_ip_ttl = (uint8_t)optval;
2400 break;
2401 #define OPTSET(bit) do { \
2402 if (optval) { \
2403 inp->inp_flags |= bit; \
2404 } else { \
2405 inp->inp_flags &= ~bit; \
2406 } \
2407 } while (0)
2408
2409 #define OPTSET2(bit) do { \
2410 if (optval) { \
2411 inp->inp_flags2 |= bit; \
2412 } else { \
2413 inp->inp_flags2 &= ~bit; \
2414 } \
2415 } while (0)
2416
2417 case IP_RECVOPTS:
2418 OPTSET(INP_RECVOPTS);
2419 break;
2420
2421 case IP_RECVRETOPTS:
2422 OPTSET(INP_RECVRETOPTS);
2423 break;
2424
2425 case IP_RECVDSTADDR:
2426 OPTSET(INP_RECVDSTADDR);
2427 break;
2428
2429 case IP_RECVIF:
2430 OPTSET(INP_RECVIF);
2431 break;
2432
2433 case IP_RECVTTL:
2434 OPTSET(INP_RECVTTL);
2435 break;
2436
2437 case IP_RECVPKTINFO:
2438 OPTSET(INP_PKTINFO);
2439 break;
2440
2441 case IP_RECVTOS:
2442 OPTSET(INP_RECVTOS);
2443 break;
2444
2445 case IP_DONTFRAG:
2446 /* This option is settable only for IPv4 */
2447 if (!(inp->inp_vflag & INP_IPV4)) {
2448 error = EINVAL;
2449 break;
2450 }
2451 OPTSET2(INP2_DONTFRAG);
2452 break;
2453 #undef OPTSET
2454 #undef OPTSET2
2455 }
2456 break;
2457 /*
2458 * Multicast socket options are processed by the in_mcast
2459 * module.
2460 */
2461 case IP_MULTICAST_IF:
2462 case IP_MULTICAST_IFINDEX:
2463 case IP_MULTICAST_VIF:
2464 case IP_MULTICAST_TTL:
2465 case IP_MULTICAST_LOOP:
2466 case IP_ADD_MEMBERSHIP:
2467 case IP_DROP_MEMBERSHIP:
2468 case IP_ADD_SOURCE_MEMBERSHIP:
2469 case IP_DROP_SOURCE_MEMBERSHIP:
2470 case IP_BLOCK_SOURCE:
2471 case IP_UNBLOCK_SOURCE:
2472 case IP_MSFILTER:
2473 case MCAST_JOIN_GROUP:
2474 case MCAST_LEAVE_GROUP:
2475 case MCAST_JOIN_SOURCE_GROUP:
2476 case MCAST_LEAVE_SOURCE_GROUP:
2477 case MCAST_BLOCK_SOURCE:
2478 case MCAST_UNBLOCK_SOURCE:
2479 error = inp_setmoptions(inp, sopt);
2480 break;
2481
2482 case IP_PORTRANGE:
2483 error = sooptcopyin(sopt, &optval, sizeof(optval),
2484 sizeof(optval));
2485 if (error) {
2486 break;
2487 }
2488
2489 switch (optval) {
2490 case IP_PORTRANGE_DEFAULT:
2491 inp->inp_flags &= ~(INP_LOWPORT);
2492 inp->inp_flags &= ~(INP_HIGHPORT);
2493 break;
2494
2495 case IP_PORTRANGE_HIGH:
2496 inp->inp_flags &= ~(INP_LOWPORT);
2497 inp->inp_flags |= INP_HIGHPORT;
2498 break;
2499
2500 case IP_PORTRANGE_LOW:
2501 inp->inp_flags &= ~(INP_HIGHPORT);
2502 inp->inp_flags |= INP_LOWPORT;
2503 break;
2504
2505 default:
2506 error = EINVAL;
2507 break;
2508 }
2509 break;
2510
2511 #if IPSEC
2512 case IP_IPSEC_POLICY: {
2513 caddr_t req = NULL;
2514 size_t len = 0;
2515 int priv;
2516 mbuf_ref_t m;
2517 int optname;
2518
2519 if ((error = soopt_getm(sopt, &m)) != 0) { /* XXX */
2520 break;
2521 }
2522 if ((error = soopt_mcopyin(sopt, m)) != 0) { /* XXX */
2523 break;
2524 }
2525 priv = (proc_suser(sopt->sopt_p) == 0);
2526 if (m) {
2527 req = mtod(m, caddr_t);
2528 len = m->m_len;
2529 }
2530 optname = sopt->sopt_name;
2531 error = ipsec4_set_policy(inp, optname, req, len, priv);
2532 m_freem(m);
2533 break;
2534 }
2535 #endif /* IPSEC */
2536
2537 #if TRAFFIC_MGT
2538 case IP_TRAFFIC_MGT_BACKGROUND: {
2539 unsigned background = 0;
2540
2541 error = sooptcopyin(sopt, &background,
2542 sizeof(background), sizeof(background));
2543 if (error) {
2544 break;
2545 }
2546
2547 if (background) {
2548 socket_set_traffic_mgt_flags_locked(so,
2549 TRAFFIC_MGT_SO_BACKGROUND);
2550 } else {
2551 socket_clear_traffic_mgt_flags_locked(so,
2552 TRAFFIC_MGT_SO_BACKGROUND);
2553 }
2554
2555 break;
2556 }
2557 #endif /* TRAFFIC_MGT */
2558
2559 /*
2560 * On a multihomed system, scoped routing can be used to
2561 * restrict the source interface used for sending packets.
2562 * The socket option IP_BOUND_IF binds a particular AF_INET
2563 * socket to an interface such that data sent on the socket
2564 * is restricted to that interface. This is unlike the
2565 * SO_DONTROUTE option where the routing table is bypassed;
2566 * therefore it allows for a greater flexibility and control
2567 * over the system behavior, and does not place any restriction
2568 * on the destination address type (e.g. unicast, multicast,
2569 * or broadcast if applicable) or whether or not the host is
2570 * directly reachable. Note that in the multicast transmit
2571 * case, IP_MULTICAST_{IF,IFINDEX} takes precedence over
2572 * IP_BOUND_IF, since the former practically bypasses the
2573 * routing table; in this case, IP_BOUND_IF sets the default
2574 * interface used for sending multicast packets in the absence
2575 * of an explicit multicast transmit interface.
2576 */
2577 case IP_BOUND_IF:
2578 /* This option is settable only for IPv4 */
2579 if (!(inp->inp_vflag & INP_IPV4)) {
2580 error = EINVAL;
2581 break;
2582 }
2583
2584 error = sooptcopyin(sopt, &optval, sizeof(optval),
2585 sizeof(optval));
2586
2587 if (error) {
2588 break;
2589 }
2590
2591 error = inp_bindif(inp, optval, NULL);
2592 break;
2593
2594 case IP_NO_IFT_CELLULAR:
2595 /* This option is settable only for IPv4 */
2596 if (!(inp->inp_vflag & INP_IPV4)) {
2597 error = EINVAL;
2598 break;
2599 }
2600
2601 error = sooptcopyin(sopt, &optval, sizeof(optval),
2602 sizeof(optval));
2603
2604 if (error) {
2605 break;
2606 }
2607
2608 /* once set, it cannot be unset */
2609 if (!optval && INP_NO_CELLULAR(inp)) {
2610 error = EINVAL;
2611 break;
2612 }
2613
2614 error = so_set_restrictions(so,
2615 SO_RESTRICT_DENY_CELLULAR);
2616 break;
2617
2618 case IP_OUT_IF:
2619 /* This option is not settable */
2620 error = EINVAL;
2621 break;
2622
2623 default:
2624 error = ENOPROTOOPT;
2625 break;
2626 }
2627 break;
2628
2629 case SOPT_GET:
2630 if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_BINDTODEVICE) {
2631 char namebuf[IFNAMSIZ + 1] = {};
2632
2633 if (inp->inp_flags & INP_BOUND_IF) {
2634 strlcpy(namebuf, inp->inp_boundifp->if_xname, IFNAMSIZ);
2635 }
2636 error = sooptcopyout(sopt, &namebuf, IFNAMSIZ);
2637 break;
2638 }
2639 switch (sopt->sopt_name) {
2640 case IP_OPTIONS:
2641 case IP_RETOPTS:
2642 if (inp->inp_options) {
2643 error = sooptcopyout(sopt,
2644 mtod(inp->inp_options, char *),
2645 inp->inp_options->m_len);
2646 } else {
2647 sopt->sopt_valsize = 0;
2648 }
2649 break;
2650
2651 case IP_TOS:
2652 case IP_TTL:
2653 case IP_RECVOPTS:
2654 case IP_RECVRETOPTS:
2655 case IP_RECVDSTADDR:
2656 case IP_RECVIF:
2657 case IP_RECVTTL:
2658 case IP_PORTRANGE:
2659 case IP_RECVPKTINFO:
2660 case IP_RECVTOS:
2661 case IP_DONTFRAG:
2662 switch (sopt->sopt_name) {
2663 case IP_TOS:
2664 optval = inp->inp_ip_tos;
2665 break;
2666
2667 case IP_TTL:
2668 optval = inp->inp_ip_ttl;
2669 break;
2670
2671 #define OPTBIT(bit) (inp->inp_flags & bit ? 1 : 0)
2672 #define OPTBIT2(bit) (inp->inp_flags2 & bit ? 1 : 0)
2673 case IP_RECVOPTS:
2674 optval = OPTBIT(INP_RECVOPTS);
2675 break;
2676
2677 case IP_RECVRETOPTS:
2678 optval = OPTBIT(INP_RECVRETOPTS);
2679 break;
2680
2681 case IP_RECVDSTADDR:
2682 optval = OPTBIT(INP_RECVDSTADDR);
2683 break;
2684
2685 case IP_RECVIF:
2686 optval = OPTBIT(INP_RECVIF);
2687 break;
2688
2689 case IP_RECVTTL:
2690 optval = OPTBIT(INP_RECVTTL);
2691 break;
2692
2693 case IP_PORTRANGE:
2694 if (inp->inp_flags & INP_HIGHPORT) {
2695 optval = IP_PORTRANGE_HIGH;
2696 } else if (inp->inp_flags & INP_LOWPORT) {
2697 optval = IP_PORTRANGE_LOW;
2698 } else {
2699 optval = 0;
2700 }
2701 break;
2702
2703 case IP_RECVPKTINFO:
2704 optval = OPTBIT(INP_PKTINFO);
2705 break;
2706
2707 case IP_RECVTOS:
2708 optval = OPTBIT(INP_RECVTOS);
2709 break;
2710 case IP_DONTFRAG:
2711 optval = OPTBIT2(INP2_DONTFRAG);
2712 break;
2713 }
2714 error = sooptcopyout(sopt, &optval, sizeof(optval));
2715 break;
2716
2717 case IP_MULTICAST_IF:
2718 case IP_MULTICAST_IFINDEX:
2719 case IP_MULTICAST_VIF:
2720 case IP_MULTICAST_TTL:
2721 case IP_MULTICAST_LOOP:
2722 case IP_MSFILTER:
2723 error = inp_getmoptions(inp, sopt);
2724 break;
2725
2726 #if IPSEC
2727 case IP_IPSEC_POLICY: {
2728 error = 0; /* This option is no longer supported */
2729 break;
2730 }
2731 #endif /* IPSEC */
2732
2733 #if TRAFFIC_MGT
2734 case IP_TRAFFIC_MGT_BACKGROUND: {
2735 unsigned background = (so->so_flags1 &
2736 SOF1_TRAFFIC_MGT_SO_BACKGROUND) ? 1 : 0;
2737 return sooptcopyout(sopt, &background,
2738 sizeof(background));
2739 }
2740 #endif /* TRAFFIC_MGT */
2741
2742 case IP_BOUND_IF:
2743 if (inp->inp_flags & INP_BOUND_IF) {
2744 optval = inp->inp_boundifp->if_index;
2745 }
2746 error = sooptcopyout(sopt, &optval, sizeof(optval));
2747 break;
2748
2749 case IP_NO_IFT_CELLULAR:
2750 optval = INP_NO_CELLULAR(inp) ? 1 : 0;
2751 error = sooptcopyout(sopt, &optval, sizeof(optval));
2752 break;
2753
2754 case IP_OUT_IF:
2755 optval = (inp->inp_last_outifp != NULL) ?
2756 inp->inp_last_outifp->if_index : 0;
2757 error = sooptcopyout(sopt, &optval, sizeof(optval));
2758 break;
2759
2760 default:
2761 error = ENOPROTOOPT;
2762 break;
2763 }
2764 break;
2765 }
2766 return error;
2767 }
2768
2769 /*
2770 * Set up IP options in pcb for insertion in output packets.
2771 * Store in mbuf with pointer in pcbopt, adding pseudo-option
2772 * with destination address if source routed.
2773 */
2774 static int
ip_pcbopts(int optname,struct mbuf ** pcbopt,struct mbuf * m)2775 ip_pcbopts(int optname, struct mbuf **pcbopt, struct mbuf *m)
2776 {
2777 #pragma unused(optname)
2778 int cnt, optlen;
2779 u_char *cp;
2780 u_char opt;
2781
2782 /* turn off any old options */
2783 if (*pcbopt) {
2784 (void) m_free(*pcbopt);
2785 }
2786 *pcbopt = 0;
2787 if (m == (struct mbuf *)0 || m->m_len == 0) {
2788 /*
2789 * Only turning off any previous options.
2790 */
2791 if (m) {
2792 (void) m_free(m);
2793 }
2794 return 0;
2795 }
2796
2797 if (m->m_len % sizeof(int32_t)) {
2798 goto bad;
2799 }
2800
2801 /*
2802 * IP first-hop destination address will be stored before
2803 * actual options; move other options back
2804 * and clear it when none present.
2805 */
2806 if (m_mtod_upper_bound(m) - m_mtod_end(m) < sizeof(struct in_addr)) {
2807 goto bad;
2808 }
2809 cnt = m->m_len;
2810 m->m_len += sizeof(struct in_addr);
2811 cp = mtod(m, u_char *) + sizeof(struct in_addr);
2812 ovbcopy(mtod(m, caddr_t), (caddr_t)cp, (unsigned)cnt);
2813 bzero(mtod(m, caddr_t), sizeof(struct in_addr));
2814
2815 for (; cnt > 0; cnt -= optlen, cp += optlen) {
2816 opt = cp[IPOPT_OPTVAL];
2817 if (opt == IPOPT_EOL) {
2818 break;
2819 }
2820 if (opt == IPOPT_NOP) {
2821 optlen = 1;
2822 } else {
2823 if (cnt < IPOPT_OLEN + sizeof(*cp)) {
2824 goto bad;
2825 }
2826 optlen = cp[IPOPT_OLEN];
2827 if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) {
2828 goto bad;
2829 }
2830 }
2831 switch (opt) {
2832 default:
2833 break;
2834
2835 case IPOPT_LSRR:
2836 case IPOPT_SSRR:
2837 /*
2838 * user process specifies route as:
2839 * ->A->B->C->D
2840 * D must be our final destination (but we can't
2841 * check that since we may not have connected yet).
2842 * A is first hop destination, which doesn't appear in
2843 * actual IP option, but is stored before the options.
2844 */
2845 if (optlen < IPOPT_MINOFF - 1 + sizeof(struct in_addr)) {
2846 goto bad;
2847 }
2848 if (optlen > UINT8_MAX) {
2849 goto bad;
2850 }
2851 m->m_len -= sizeof(struct in_addr);
2852 cnt -= sizeof(struct in_addr);
2853 optlen -= sizeof(struct in_addr);
2854 cp[IPOPT_OLEN] = (uint8_t)optlen;
2855 /*
2856 * Move first hop before start of options.
2857 */
2858 bcopy((caddr_t)&cp[IPOPT_OFFSET + 1], mtod(m, caddr_t),
2859 sizeof(struct in_addr));
2860 /*
2861 * Then copy rest of options back
2862 * to close up the deleted entry.
2863 */
2864 ovbcopy((caddr_t)(&cp[IPOPT_OFFSET + 1] +
2865 sizeof(struct in_addr)),
2866 (caddr_t)&cp[IPOPT_OFFSET + 1],
2867 (unsigned)cnt - (IPOPT_MINOFF - 1));
2868 break;
2869 }
2870 }
2871 if (m->m_len > MAX_IPOPTLEN + sizeof(struct in_addr)) {
2872 goto bad;
2873 }
2874 *pcbopt = m;
2875 return 0;
2876
2877 bad:
2878 (void) m_free(m);
2879 return EINVAL;
2880 }
2881
2882 void
ip_moptions_init(void)2883 ip_moptions_init(void)
2884 {
2885 PE_parse_boot_argn("ifa_debug", &imo_debug, sizeof(imo_debug));
2886
2887 vm_size_t imo_size = (imo_debug == 0) ? sizeof(struct ip_moptions) :
2888 sizeof(struct ip_moptions_dbg);
2889
2890 imo_zone = zone_create(IMO_ZONE_NAME, imo_size, ZC_ZFREE_CLEARMEM);
2891 }
2892
2893 void
imo_addref(struct ip_moptions * imo,int locked)2894 imo_addref(struct ip_moptions *imo, int locked)
2895 {
2896 if (!locked) {
2897 IMO_LOCK(imo);
2898 } else {
2899 IMO_LOCK_ASSERT_HELD(imo);
2900 }
2901
2902 if (++imo->imo_refcnt == 0) {
2903 panic("%s: imo %p wraparound refcnt", __func__, imo);
2904 /* NOTREACHED */
2905 } else if (imo->imo_trace != NULL) {
2906 (*imo->imo_trace)(imo, TRUE);
2907 }
2908
2909 if (!locked) {
2910 IMO_UNLOCK(imo);
2911 }
2912 }
2913
2914 void
imo_remref(struct ip_moptions * imo)2915 imo_remref(struct ip_moptions *imo)
2916 {
2917 IMO_LOCK(imo);
2918 if (imo->imo_refcnt == 0) {
2919 panic("%s: imo %p negative refcnt", __func__, imo);
2920 /* NOTREACHED */
2921 } else if (imo->imo_trace != NULL) {
2922 (*imo->imo_trace)(imo, FALSE);
2923 }
2924
2925 --imo->imo_refcnt;
2926 if (imo->imo_refcnt > 0) {
2927 IMO_UNLOCK(imo);
2928 return;
2929 }
2930
2931 IMO_PURGE_LOCKED(imo);
2932
2933 IMO_UNLOCK(imo);
2934
2935 kfree_type_counted_by(struct in_multi *, imo->imo_max_memberships, imo->imo_membership);
2936 kfree_type_counted_by(struct in_mfilter, imo->imo_max_filters, imo->imo_mfilters);
2937
2938 lck_mtx_destroy(&imo->imo_lock, &ifa_mtx_grp);
2939
2940 if (!(imo->imo_debug & IFD_ALLOC)) {
2941 panic("%s: imo %p cannot be freed", __func__, imo);
2942 /* NOTREACHED */
2943 }
2944 zfree(imo_zone, imo);
2945 }
2946
2947 static void
imo_trace(struct ip_moptions * imo,int refhold)2948 imo_trace(struct ip_moptions *imo, int refhold)
2949 {
2950 struct ip_moptions_dbg *imo_dbg = (struct ip_moptions_dbg *)imo;
2951 ctrace_t *tr;
2952 u_int32_t idx;
2953 u_int16_t *cnt;
2954
2955 if (!(imo->imo_debug & IFD_DEBUG)) {
2956 panic("%s: imo %p has no debug structure", __func__, imo);
2957 /* NOTREACHED */
2958 }
2959 if (refhold) {
2960 cnt = &imo_dbg->imo_refhold_cnt;
2961 tr = imo_dbg->imo_refhold;
2962 } else {
2963 cnt = &imo_dbg->imo_refrele_cnt;
2964 tr = imo_dbg->imo_refrele;
2965 }
2966
2967 idx = os_atomic_inc_orig(cnt, relaxed) % IMO_TRACE_HIST_SIZE;
2968 ctrace_record(&tr[idx]);
2969 }
2970
2971 struct ip_moptions *
ip_allocmoptions(zalloc_flags_t how)2972 ip_allocmoptions(zalloc_flags_t how)
2973 {
2974 struct ip_moptions *imo;
2975
2976 imo = zalloc_flags(imo_zone, how | Z_ZERO);
2977 if (imo != NULL) {
2978 lck_mtx_init(&imo->imo_lock, &ifa_mtx_grp, &ifa_mtx_attr);
2979 imo->imo_debug |= IFD_ALLOC;
2980 if (imo_debug != 0) {
2981 imo->imo_debug |= IFD_DEBUG;
2982 imo->imo_trace = imo_trace;
2983 }
2984 IMO_ADDREF(imo);
2985 }
2986
2987 return imo;
2988 }
2989
2990 /*
2991 * Routine called from ip_output() to loop back a copy of an IP multicast
2992 * packet to the input queue of a specified interface. Note that this
2993 * calls the output routine of the loopback "driver", but with an interface
2994 * pointer that might NOT be a loopback interface -- evil, but easier than
2995 * replicating that code here.
2996 */
2997 static void
ip_mloopback(struct ifnet * srcifp,struct ifnet * origifp,struct mbuf * m,struct sockaddr_in * dst,int hlen)2998 ip_mloopback(struct ifnet *srcifp, struct ifnet *origifp, struct mbuf *m,
2999 struct sockaddr_in *dst, int hlen)
3000 {
3001 struct mbuf *copym;
3002 struct ip *ip;
3003
3004 if (lo_ifp == NULL) {
3005 return;
3006 }
3007
3008 /*
3009 * Copy the packet header as it's needed for the checksum
3010 * Make sure to deep-copy IP header portion in case the data
3011 * is in an mbuf cluster, so that we can safely override the IP
3012 * header portion later.
3013 */
3014 copym = m_copym_mode(m, 0, M_COPYALL, M_DONTWAIT, NULL, NULL, M_COPYM_COPY_HDR);
3015 if (copym != NULL && ((copym->m_flags & M_EXT) || copym->m_len < hlen)) {
3016 copym = m_pullup(copym, hlen);
3017 }
3018
3019 if (copym == NULL) {
3020 return;
3021 }
3022
3023 /*
3024 * We don't bother to fragment if the IP length is greater
3025 * than the interface's MTU. Can this possibly matter?
3026 */
3027 ip = mtod(copym, struct ip *);
3028 #if BYTE_ORDER != BIG_ENDIAN
3029 HTONS(ip->ip_len);
3030 HTONS(ip->ip_off);
3031 #endif
3032 ip->ip_sum = 0;
3033 ip->ip_sum = ip_cksum_hdr_out(copym, hlen);
3034
3035 /*
3036 * Mark checksum as valid unless receive checksum offload is
3037 * disabled; if so, compute checksum in software. If the
3038 * interface itself is lo0, this will be overridden by if_loop.
3039 */
3040 if (hwcksum_rx) {
3041 copym->m_pkthdr.csum_flags &= ~(CSUM_PARTIAL | CSUM_ZERO_INVERT);
3042 copym->m_pkthdr.csum_flags |=
3043 CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
3044 copym->m_pkthdr.csum_data = 0xffff;
3045 } else if (copym->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
3046 #if BYTE_ORDER != BIG_ENDIAN
3047 NTOHS(ip->ip_len);
3048 #endif
3049 in_delayed_cksum(copym);
3050 #if BYTE_ORDER != BIG_ENDIAN
3051 HTONS(ip->ip_len);
3052 #endif
3053 }
3054
3055 /*
3056 * Stuff the 'real' ifp into the pkthdr, to be used in matching
3057 * in ip_input(); we need the loopback ifp/dl_tag passed as args
3058 * to make the loopback driver compliant with the data link
3059 * requirements.
3060 */
3061 copym->m_pkthdr.rcvif = origifp;
3062
3063 /*
3064 * Also record the source interface (which owns the source address).
3065 * This is basically a stripped down version of ifa_foraddr().
3066 */
3067 if (srcifp == NULL) {
3068 struct in_ifaddr *ia;
3069
3070 lck_rw_lock_shared(&in_ifaddr_rwlock);
3071 TAILQ_FOREACH(ia, INADDR_HASH(ip->ip_src.s_addr), ia_hash) {
3072 IFA_LOCK_SPIN(&ia->ia_ifa);
3073 if (IA_SIN(ia)->sin_addr.s_addr == ip->ip_src.s_addr) {
3074 srcifp = ia->ia_ifp;
3075 IFA_UNLOCK(&ia->ia_ifa);
3076 break;
3077 }
3078 IFA_UNLOCK(&ia->ia_ifa);
3079 }
3080 lck_rw_done(&in_ifaddr_rwlock);
3081 }
3082 if (srcifp != NULL) {
3083 ip_setsrcifaddr_info(copym, srcifp->if_index, NULL);
3084 }
3085 ip_setdstifaddr_info(copym, origifp->if_index, NULL);
3086
3087 dlil_output(lo_ifp, PF_INET, copym, NULL, SA(dst), 0, NULL);
3088 }
3089
3090 /*
3091 * Given a source IP address (and route, if available), determine the best
3092 * interface to send the packet from. Checking for (and updating) the
3093 * ROF_SRCIF_SELECTED flag in the pcb-supplied route placeholder is done
3094 * without any locks based on the assumption that ip_output() is single-
3095 * threaded per-pcb, i.e. for any given pcb there can only be one thread
3096 * performing output at the IP layer.
3097 *
3098 * This routine is analogous to in6_selectroute() for IPv6.
3099 */
3100 static struct ifaddr *
in_selectsrcif(struct ip * ip,struct route * ro,unsigned int ifscope)3101 in_selectsrcif(struct ip *ip, struct route *ro, unsigned int ifscope)
3102 {
3103 struct ifaddr *ifa = NULL;
3104 struct in_addr src = ip->ip_src;
3105 struct in_addr dst = ip->ip_dst;
3106 struct ifnet *rt_ifp;
3107 char s_src[MAX_IPv4_STR_LEN], s_dst[MAX_IPv4_STR_LEN];
3108
3109 VERIFY(src.s_addr != INADDR_ANY);
3110
3111 if (ip_select_srcif_debug) {
3112 (void) inet_ntop(AF_INET, &src.s_addr, s_src, sizeof(s_src));
3113 (void) inet_ntop(AF_INET, &dst.s_addr, s_dst, sizeof(s_dst));
3114 }
3115
3116 if (ro->ro_rt != NULL) {
3117 RT_LOCK(ro->ro_rt);
3118 }
3119
3120 rt_ifp = (ro->ro_rt != NULL) ? ro->ro_rt->rt_ifp : NULL;
3121
3122 /*
3123 * Given the source IP address, find a suitable source interface
3124 * to use for transmission; if the caller has specified a scope,
3125 * optimize the search by looking at the addresses only for that
3126 * interface. This is still suboptimal, however, as we need to
3127 * traverse the per-interface list.
3128 */
3129 if (ifscope != IFSCOPE_NONE || ro->ro_rt != NULL) {
3130 unsigned int scope = ifscope;
3131
3132 /*
3133 * If no scope is specified and the route is stale (pointing
3134 * to a defunct interface) use the current primary interface;
3135 * this happens when switching between interfaces configured
3136 * with the same IP address. Otherwise pick up the scope
3137 * information from the route; the ULP may have looked up a
3138 * correct route and we just need to verify it here and mark
3139 * it with the ROF_SRCIF_SELECTED flag below.
3140 */
3141 if (scope == IFSCOPE_NONE) {
3142 scope = rt_ifp->if_index;
3143 if (scope != get_primary_ifscope(AF_INET) &&
3144 ROUTE_UNUSABLE(ro)) {
3145 scope = get_primary_ifscope(AF_INET);
3146 }
3147 }
3148
3149 ifa = (struct ifaddr *)ifa_foraddr_scoped(src.s_addr, scope);
3150
3151 if (ifa == NULL && ip->ip_p != IPPROTO_UDP &&
3152 ip->ip_p != IPPROTO_TCP && ipforwarding) {
3153 /*
3154 * If forwarding is enabled, and if the packet isn't
3155 * TCP or UDP, check if the source address belongs
3156 * to one of our own interfaces; if so, demote the
3157 * interface scope and do a route lookup right below.
3158 */
3159 ifa = (struct ifaddr *)ifa_foraddr(src.s_addr);
3160 if (ifa != NULL) {
3161 ifa_remref(ifa);
3162 ifa = NULL;
3163 ifscope = IFSCOPE_NONE;
3164 }
3165 }
3166
3167 if (ip_select_srcif_debug && ifa != NULL) {
3168 if (ro->ro_rt != NULL) {
3169 printf("%s->%s ifscope %d->%d ifa_if %s "
3170 "ro_if %s\n", s_src, s_dst, ifscope,
3171 scope, if_name(ifa->ifa_ifp),
3172 if_name(rt_ifp));
3173 } else {
3174 printf("%s->%s ifscope %d->%d ifa_if %s\n",
3175 s_src, s_dst, ifscope, scope,
3176 if_name(ifa->ifa_ifp));
3177 }
3178 }
3179 }
3180
3181 /*
3182 * Slow path; search for an interface having the corresponding source
3183 * IP address if the scope was not specified by the caller, and:
3184 *
3185 * 1) There currently isn't any route, or,
3186 * 2) The interface used by the route does not own that source
3187 * IP address; in this case, the route will get blown away
3188 * and we'll do a more specific scoped search using the newly
3189 * found interface.
3190 */
3191 if (ifa == NULL && ifscope == IFSCOPE_NONE) {
3192 ifa = (struct ifaddr *)ifa_foraddr(src.s_addr);
3193
3194 /*
3195 * If we have the IP address, but not the route, we don't
3196 * really know whether or not it belongs to the correct
3197 * interface (it could be shared across multiple interfaces.)
3198 * The only way to find out is to do a route lookup.
3199 */
3200 if (ifa != NULL && ro->ro_rt == NULL) {
3201 struct rtentry *rt;
3202 struct sockaddr_in sin;
3203 struct ifaddr *oifa = NULL;
3204
3205 SOCKADDR_ZERO(&sin, sizeof(sin));
3206 sin.sin_family = AF_INET;
3207 sin.sin_len = sizeof(sin);
3208 sin.sin_addr = dst;
3209
3210 lck_mtx_lock(rnh_lock);
3211 if ((rt = rt_lookup(TRUE, SA(&sin), NULL,
3212 rt_tables[AF_INET], IFSCOPE_NONE)) != NULL) {
3213 RT_LOCK(rt);
3214 /*
3215 * If the route uses a different interface,
3216 * use that one instead. The IP address of
3217 * the ifaddr that we pick up here is not
3218 * relevant.
3219 */
3220 if (ifa->ifa_ifp != rt->rt_ifp) {
3221 oifa = ifa;
3222 ifa = rt->rt_ifa;
3223 ifa_addref(ifa);
3224 RT_UNLOCK(rt);
3225 } else {
3226 RT_UNLOCK(rt);
3227 }
3228 rtfree_locked(rt);
3229 }
3230 lck_mtx_unlock(rnh_lock);
3231
3232 if (oifa != NULL) {
3233 struct ifaddr *iifa;
3234
3235 /*
3236 * See if the interface pointed to by the
3237 * route is configured with the source IP
3238 * address of the packet.
3239 */
3240 iifa = (struct ifaddr *)ifa_foraddr_scoped(
3241 src.s_addr, ifa->ifa_ifp->if_index);
3242
3243 if (iifa != NULL) {
3244 /*
3245 * Found it; drop the original one
3246 * as well as the route interface
3247 * address, and use this instead.
3248 */
3249 ifa_remref(oifa);
3250 ifa_remref(ifa);
3251 ifa = iifa;
3252 } else if (!ipforwarding ||
3253 (rt->rt_flags & RTF_GATEWAY)) {
3254 /*
3255 * This interface doesn't have that
3256 * source IP address; drop the route
3257 * interface address and just use the
3258 * original one, and let the caller
3259 * do a scoped route lookup.
3260 */
3261 ifa_remref(ifa);
3262 ifa = oifa;
3263 } else {
3264 /*
3265 * Forwarding is enabled and the source
3266 * address belongs to one of our own
3267 * interfaces which isn't the outgoing
3268 * interface, and we have a route, and
3269 * the destination is on a network that
3270 * is directly attached (onlink); drop
3271 * the original one and use the route
3272 * interface address instead.
3273 */
3274 ifa_remref(oifa);
3275 }
3276 }
3277 } else if (ifa != NULL && ro->ro_rt != NULL &&
3278 !(ro->ro_rt->rt_flags & RTF_GATEWAY) &&
3279 ifa->ifa_ifp != ro->ro_rt->rt_ifp && ipforwarding) {
3280 /*
3281 * Forwarding is enabled and the source address belongs
3282 * to one of our own interfaces which isn't the same
3283 * as the interface used by the known route; drop the
3284 * original one and use the route interface address.
3285 */
3286 ifa_remref(ifa);
3287 ifa = ro->ro_rt->rt_ifa;
3288 ifa_addref(ifa);
3289 }
3290
3291 if (ip_select_srcif_debug && ifa != NULL) {
3292 printf("%s->%s ifscope %d ifa_if %s\n",
3293 s_src, s_dst, ifscope, if_name(ifa->ifa_ifp));
3294 }
3295 }
3296
3297 if (ro->ro_rt != NULL) {
3298 RT_LOCK_ASSERT_HELD(ro->ro_rt);
3299 }
3300 /*
3301 * If there is a non-loopback route with the wrong interface, or if
3302 * there is no interface configured with such an address, blow it
3303 * away. Except for local/loopback, we look for one with a matching
3304 * interface scope/index.
3305 */
3306 if (ro->ro_rt != NULL &&
3307 (ifa == NULL || (ifa->ifa_ifp != rt_ifp && rt_ifp != lo_ifp) ||
3308 !(ro->ro_rt->rt_flags & RTF_UP))) {
3309 if (ip_select_srcif_debug) {
3310 if (ifa != NULL) {
3311 printf("%s->%s ifscope %d ro_if %s != "
3312 "ifa_if %s (cached route cleared)\n",
3313 s_src, s_dst, ifscope, if_name(rt_ifp),
3314 if_name(ifa->ifa_ifp));
3315 } else {
3316 printf("%s->%s ifscope %d ro_if %s "
3317 "(no ifa_if found)\n",
3318 s_src, s_dst, ifscope, if_name(rt_ifp));
3319 }
3320 }
3321
3322 RT_UNLOCK(ro->ro_rt);
3323 ROUTE_RELEASE(ro);
3324
3325 /*
3326 * If the destination is IPv4 LLA and the route's interface
3327 * doesn't match the source interface, then the source IP
3328 * address is wrong; it most likely belongs to the primary
3329 * interface associated with the IPv4 LL subnet. Drop the
3330 * packet rather than letting it go out and return an error
3331 * to the ULP. This actually applies not only to IPv4 LL
3332 * but other shared subnets; for now we explicitly test only
3333 * for the former case and save the latter for future.
3334 */
3335 if (IN_LINKLOCAL(ntohl(dst.s_addr)) &&
3336 !IN_LINKLOCAL(ntohl(src.s_addr)) && ifa != NULL) {
3337 ifa_remref(ifa);
3338 ifa = NULL;
3339 }
3340 }
3341
3342 if (ip_select_srcif_debug && ifa == NULL) {
3343 printf("%s->%s ifscope %d (neither ro_if/ifa_if found)\n",
3344 s_src, s_dst, ifscope);
3345 }
3346
3347 /*
3348 * If there is a route, mark it accordingly. If there isn't one,
3349 * we'll get here again during the next transmit (possibly with a
3350 * route) and the flag will get set at that point. For IPv4 LLA
3351 * destination, mark it only if the route has been fully resolved;
3352 * otherwise we want to come back here again when the route points
3353 * to the interface over which the ARP reply arrives on.
3354 */
3355 if (ro->ro_rt != NULL && (!IN_LINKLOCAL(ntohl(dst.s_addr)) ||
3356 (ro->ro_rt->rt_gateway->sa_family == AF_LINK &&
3357 SDL(ro->ro_rt->rt_gateway)->sdl_alen != 0))) {
3358 if (ifa != NULL) {
3359 ifa_addref(ifa); /* for route */
3360 }
3361 if (ro->ro_srcia != NULL) {
3362 ifa_remref(ro->ro_srcia);
3363 }
3364 ro->ro_srcia = ifa;
3365 ro->ro_flags |= ROF_SRCIF_SELECTED;
3366 RT_GENID_SYNC(ro->ro_rt);
3367 }
3368
3369 if (ro->ro_rt != NULL) {
3370 RT_UNLOCK(ro->ro_rt);
3371 }
3372
3373 return ifa;
3374 }
3375
3376 /*
3377 * @brief Given outgoing interface it determines what checksum needs
3378 * to be computed in software and what needs to be offloaded to the
3379 * interface.
3380 *
3381 * @param ifp Pointer to the outgoing interface
3382 * @param m Pointer to the packet
3383 * @param hlen IP header length
3384 * @param ip_len Total packet size i.e. headers + data payload
3385 * @param sw_csum Pointer to a software checksum flag set
3386 *
3387 * @return void
3388 */
3389 void
ip_output_checksum(struct ifnet * ifp,struct mbuf * m,int hlen,int ip_len,uint32_t * sw_csum)3390 ip_output_checksum(struct ifnet *ifp, struct mbuf *m, int hlen, int ip_len,
3391 uint32_t *sw_csum)
3392 {
3393 uint32_t hwcap = ifp->if_hwassist;
3394
3395 m->m_pkthdr.csum_flags |= CSUM_IP;
3396
3397 if (!hwcksum_tx) {
3398 /* do all in software; hardware checksum offload is disabled */
3399 *sw_csum = (CSUM_DELAY_DATA | CSUM_DELAY_IP) &
3400 m->m_pkthdr.csum_flags;
3401 } else {
3402 /* do in software what the hardware cannot */
3403 *sw_csum = m->m_pkthdr.csum_flags & ~IF_HWASSIST_CSUM_FLAGS(hwcap);
3404 }
3405
3406 if (hlen != sizeof(struct ip)) {
3407 *sw_csum |= ((CSUM_DELAY_DATA | CSUM_DELAY_IP) &
3408 m->m_pkthdr.csum_flags);
3409 } else if ((*sw_csum & CSUM_DELAY_DATA) && (hwcap & CSUM_PARTIAL)) {
3410 /*
3411 * If the explicitly required data csum offload is not supported by hardware,
3412 * do it by partial checksum. Here we assume TSO implies support for IP
3413 * and data sum.
3414 */
3415 int interface_mtu = ifp->if_mtu;
3416
3417 if (INTF_ADJUST_MTU_FOR_CLAT46(ifp)) {
3418 interface_mtu = IN6_LINKMTU(ifp);
3419 /* Further adjust the size for CLAT46 expansion */
3420 interface_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
3421 }
3422
3423 /*
3424 * Partial checksum offload, if non-IP fragment, and TCP only
3425 * (no UDP support, as the hardware may not be able to convert
3426 * +0 to -0 (0xffff) per RFC1122 4.1.3.4. unless the interface
3427 * supports "invert zero" capability.)
3428 */
3429 if (hwcksum_tx &&
3430 ((m->m_pkthdr.csum_flags & CSUM_TCP) ||
3431 ((hwcap & CSUM_ZERO_INVERT) &&
3432 (m->m_pkthdr.csum_flags & CSUM_ZERO_INVERT))) &&
3433 ip_len <= interface_mtu) {
3434 uint16_t start = sizeof(struct ip);
3435 uint16_t ulpoff = m->m_pkthdr.csum_data & 0xffff;
3436 m->m_pkthdr.csum_flags |=
3437 (CSUM_DATA_VALID | CSUM_PARTIAL);
3438 m->m_pkthdr.csum_tx_stuff = (ulpoff + start);
3439 m->m_pkthdr.csum_tx_start = start;
3440 /* do IP hdr chksum in software */
3441 *sw_csum = CSUM_DELAY_IP;
3442 } else {
3443 *sw_csum |= (CSUM_DELAY_DATA & m->m_pkthdr.csum_flags);
3444 }
3445 }
3446
3447 if (*sw_csum & CSUM_DELAY_DATA) {
3448 in_delayed_cksum(m);
3449 *sw_csum &= ~CSUM_DELAY_DATA;
3450 }
3451
3452 if (hwcksum_tx) {
3453 uint32_t delay_data = m->m_pkthdr.csum_flags & CSUM_DELAY_DATA;
3454 uint32_t hw_csum = IF_HWASSIST_CSUM_FLAGS(hwcap);
3455
3456 /*
3457 * Drop off bits that aren't supported by hardware;
3458 * also make sure to preserve non-checksum related bits.
3459 */
3460 m->m_pkthdr.csum_flags =
3461 ((m->m_pkthdr.csum_flags & (hw_csum | CSUM_DATA_VALID)) |
3462 (m->m_pkthdr.csum_flags & ~IF_HWASSIST_CSUM_MASK));
3463
3464 /*
3465 * If hardware supports partial checksum but not delay_data,
3466 * add back delay_data.
3467 */
3468 if ((hw_csum & CSUM_PARTIAL) != 0 &&
3469 (hw_csum & delay_data) == 0) {
3470 m->m_pkthdr.csum_flags |= delay_data;
3471 }
3472 } else {
3473 /* drop all bits; hardware checksum offload is disabled */
3474 m->m_pkthdr.csum_flags = 0;
3475 }
3476 }
3477
3478 /*
3479 * GRE protocol output for PPP/PPTP
3480 */
3481 int
ip_gre_output(struct mbuf * m)3482 ip_gre_output(struct mbuf *m)
3483 {
3484 struct route ro;
3485 int error;
3486
3487 bzero(&ro, sizeof(ro));
3488
3489 error = ip_output(m, NULL, &ro, 0, NULL, NULL);
3490
3491 ROUTE_RELEASE(&ro);
3492
3493 return error;
3494 }
3495
3496 static int
3497 sysctl_reset_ip_output_stats SYSCTL_HANDLER_ARGS
3498 {
3499 #pragma unused(arg1, arg2)
3500 int error, i;
3501
3502 i = ip_output_measure;
3503 error = sysctl_handle_int(oidp, &i, 0, req);
3504 if (error || req->newptr == USER_ADDR_NULL) {
3505 goto done;
3506 }
3507 /* impose bounds */
3508 if (i < 0 || i > 1) {
3509 error = EINVAL;
3510 goto done;
3511 }
3512 if (ip_output_measure != i && i == 1) {
3513 net_perf_initialize(&net_perf, ip_output_measure_bins);
3514 }
3515 ip_output_measure = i;
3516 done:
3517 return error;
3518 }
3519
3520 static int
3521 sysctl_ip_output_measure_bins SYSCTL_HANDLER_ARGS
3522 {
3523 #pragma unused(arg1, arg2)
3524 int error;
3525 uint64_t i;
3526
3527 i = ip_output_measure_bins;
3528 error = sysctl_handle_quad(oidp, &i, 0, req);
3529 if (error || req->newptr == USER_ADDR_NULL) {
3530 goto done;
3531 }
3532 /* validate data */
3533 if (!net_perf_validate_bins(i)) {
3534 error = EINVAL;
3535 goto done;
3536 }
3537 ip_output_measure_bins = i;
3538 done:
3539 return error;
3540 }
3541
3542 static int
3543 sysctl_ip_output_getperf SYSCTL_HANDLER_ARGS
3544 {
3545 #pragma unused(oidp, arg1, arg2)
3546 if (req->oldptr == USER_ADDR_NULL) {
3547 req->oldlen = (size_t)sizeof(struct ipstat);
3548 }
3549
3550 return SYSCTL_OUT(req, &net_perf, MIN(sizeof(net_perf), req->oldlen));
3551 }
3552