1 /*
2 * Copyright (c) 2004-2022 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1989, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 */
61
62 #include <kern/debug.h>
63 #include <netinet/in_arp.h>
64 #include <sys/types.h>
65 #include <sys/param.h>
66 #include <sys/kernel_types.h>
67 #include <sys/syslog.h>
68 #include <sys/systm.h>
69 #include <sys/time.h>
70 #include <sys/kernel.h>
71 #include <sys/mbuf.h>
72 #include <sys/sysctl.h>
73 #include <sys/mcache.h>
74 #include <sys/protosw.h>
75 #include <string.h>
76 #include <net/if_arp.h>
77 #include <net/if_dl.h>
78 #include <net/dlil.h>
79 #include <net/if_types.h>
80 #include <net/if_llreach.h>
81 #include <net/route.h>
82 #include <net/nwk_wq.h>
83
84 #include <netinet/if_ether.h>
85 #include <netinet/in_var.h>
86 #include <netinet/ip.h>
87 #include <netinet/ip6.h>
88 #include <kern/zalloc.h>
89
90 #include <kern/thread.h>
91 #include <kern/sched_prim.h>
92
93 #include <net/sockaddr_utils.h>
94
95 static const size_t MAX_HW_LEN = 10;
96
97 /*
98 * Synchronization notes:
99 *
100 * The global list of ARP entries are stored in llinfo_arp; an entry
101 * gets inserted into the list when the route is created and gets
102 * removed from the list when it is deleted; this is done as part
103 * of RTM_ADD/RTM_RESOLVE/RTM_DELETE in arp_rtrequest().
104 *
105 * Because rnh_lock and rt_lock for the entry are held during those
106 * operations, the same locks (and thus lock ordering) must be used
107 * elsewhere to access the relevant data structure fields:
108 *
109 * la_le.{le_next,le_prev}, la_rt
110 *
111 * - Routing lock (rnh_lock)
112 *
113 * la_holdq, la_asked, la_llreach, la_lastused, la_flags
114 *
115 * - Routing entry lock (rt_lock)
116 *
117 * Due to the dependency on rt_lock, llinfo_arp has the same lifetime
118 * as the route entry itself. When a route is deleted (RTM_DELETE),
119 * it is simply removed from the global list but the memory is not
120 * freed until the route itself is freed.
121 */
122 struct llinfo_arp {
123 /*
124 * The following are protected by rnh_lock
125 */
126 LIST_ENTRY(llinfo_arp) la_le;
127 struct rtentry *la_rt;
128 /*
129 * The following are protected by rt_lock
130 */
131 class_queue_t la_holdq; /* packets awaiting resolution */
132 struct if_llreach *la_llreach; /* link-layer reachability record */
133 u_int64_t la_lastused; /* last used timestamp */
134 u_int32_t la_asked; /* # of requests sent */
135 u_int32_t la_maxtries; /* retry limit */
136 u_int64_t la_probeexp; /* probe deadline timestamp */
137 u_int32_t la_prbreq_cnt; /* probe request count */
138 u_int32_t la_flags;
139 #define LLINFO_RTRFAIL_EVTSENT 0x1 /* sent an ARP event */
140 #define LLINFO_PROBING 0x2 /* waiting for an ARP reply */
141 };
142
143 static LIST_HEAD(, llinfo_arp) llinfo_arp = LIST_HEAD_INITIALIZER(llinfo_arp);
144
145 static thread_call_t arp_timeout_tcall;
146 static int arp_timeout_run; /* arp_timeout is scheduled to run */
147 static void arp_timeout(thread_call_param_t arg0, thread_call_param_t arg1);
148 static void arp_sched_timeout(struct timeval *);
149
150 static thread_call_t arp_probe_tcall;
151 static int arp_probe_run; /* arp_probe is scheduled to run */
152 static void arp_probe(thread_call_param_t arg0, thread_call_param_t arg1);
153 static void arp_sched_probe(struct timeval *);
154
155 static void arptfree(struct llinfo_arp *, void *);
156 static errno_t arp_lookup_route(const struct in_addr *, int,
157 int, route_t *, unsigned int);
158 static int arp_getstat SYSCTL_HANDLER_ARGS;
159
160 static struct llinfo_arp *arp_llinfo_alloc(zalloc_flags_t);
161 static void arp_llinfo_free(void *);
162 static uint32_t arp_llinfo_flushq(struct llinfo_arp *);
163 static void arp_llinfo_purge(struct rtentry *);
164 static void arp_llinfo_get_ri(struct rtentry *, struct rt_reach_info *);
165 static void arp_llinfo_get_iflri(struct rtentry *, struct ifnet_llreach_info *);
166 static void arp_llinfo_refresh(struct rtentry *);
167
168 static __inline void arp_llreach_use(struct llinfo_arp *);
169 static __inline int arp_llreach_reachable(struct llinfo_arp *);
170 static void arp_llreach_alloc(struct rtentry *, struct ifnet *,
171 void *__sized_by(alen)addr,
172 unsigned int alen, boolean_t, uint32_t *);
173
174 extern int tvtohz(struct timeval *);
175
176 SYSCTL_DECL(_net_link_ether);
177 SYSCTL_NODE(_net_link_ether, PF_INET, inet, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "");
178
179 static int arpt_prune = (5 * 60 * 1); /* walk list every 5 minutes */
180 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, prune_intvl,
181 CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_prune, 0, "");
182
183 #define ARP_PROBE_TIME 7 /* seconds */
184 static u_int32_t arpt_probe = ARP_PROBE_TIME;
185 SYSCTL_UINT(_net_link_ether_inet, OID_AUTO, probe_intvl,
186 CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_probe, 0, "");
187
188 static int arpt_keep = (20 * 60); /* once resolved, good for 20 more minutes */
189 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, max_age,
190 CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_keep, 0, "");
191
192 static int arpt_down = 20; /* once declared down, don't send for 20 sec */
193 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, host_down_time,
194 CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_down, 0, "");
195
196 static int arp_llreach_base = 120; /* seconds */
197 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, arp_llreach_base,
198 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_llreach_base, 0,
199 "default ARP link-layer reachability max lifetime (in seconds)");
200
201 #define ARP_UNICAST_LIMIT 3 /* # of probes until ARP refresh broadcast */
202 static u_int32_t arp_unicast_lim = ARP_UNICAST_LIMIT;
203 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, arp_unicast_lim,
204 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_unicast_lim, ARP_UNICAST_LIMIT,
205 "number of unicast ARP refresh probes before using broadcast");
206
207 static u_int32_t arp_maxtries = 5;
208 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, maxtries,
209 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_maxtries, 0, "");
210
211 static u_int32_t arp_maxhold = 16;
212 SYSCTL_UINT(_net_link_ether_inet, OID_AUTO, maxhold,
213 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_maxhold, 0, "");
214
215 static int useloopback = 1; /* use loopback interface for local traffic */
216 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, useloopback,
217 CTLFLAG_RW | CTLFLAG_LOCKED, &useloopback, 0, "");
218
219 static int arp_proxyall = 0;
220 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, proxyall,
221 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_proxyall, 0, "");
222
223 static int arp_sendllconflict = 0;
224 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, sendllconflict,
225 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_sendllconflict, 0, "");
226
227 static int log_arp_warnings = 0; /* Thread safe: no accumulated state */
228 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, log_arp_warnings,
229 CTLFLAG_RW | CTLFLAG_LOCKED,
230 &log_arp_warnings, 0,
231 "log arp warning messages");
232
233 static int keep_announcements = 1; /* Thread safe: no aging of state */
234 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, keep_announcements,
235 CTLFLAG_RW | CTLFLAG_LOCKED,
236 &keep_announcements, 0,
237 "keep arp announcements");
238
239 static int send_conflicting_probes = 1; /* Thread safe: no accumulated state */
240 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, send_conflicting_probes,
241 CTLFLAG_RW | CTLFLAG_LOCKED,
242 &send_conflicting_probes, 0,
243 "send conflicting link-local arp probes");
244
245 static int arp_verbose;
246 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, verbose,
247 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_verbose, 0, "");
248
249 static uint32_t arp_maxhold_total = 1024; /* max total packets in the holdq */
250 SYSCTL_INT(_net_link_ether_inet, OID_AUTO, maxhold_total,
251 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_maxhold_total, 0, "");
252
253
254 /*
255 * Generally protected by rnh_lock; use atomic operations on fields
256 * that are also modified outside of that lock (if needed).
257 */
258 struct arpstat arpstat __attribute__((aligned(sizeof(uint64_t))));
259 SYSCTL_PROC(_net_link_ether_inet, OID_AUTO, stats,
260 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
261 0, 0, arp_getstat, "S,arpstat",
262 "ARP statistics (struct arpstat, net/if_arp.h)");
263
264 static struct llinfo_arp *
arp_llinfo_alloc(zalloc_flags_t how)265 arp_llinfo_alloc(zalloc_flags_t how)
266 {
267 struct llinfo_arp *la = kalloc_type(struct llinfo_arp, how | Z_ZERO);
268
269 if (la != NULL) {
270 /*
271 * The type of queue (Q_DROPHEAD) here is just a hint;
272 * the actual logic that works on this queue performs
273 * a head drop, details in arp_llinfo_addq().
274 */
275 _qinit(&la->la_holdq, Q_DROPHEAD, (arp_maxhold == 0) ?
276 (uint32_t)-1 : arp_maxhold, QP_MBUF);
277 }
278 return la;
279 }
280
281 static void
arp_llinfo_free(void * arg)282 arp_llinfo_free(void *arg)
283 {
284 struct llinfo_arp *__single la = arg;
285
286 if (la->la_le.le_next != NULL || la->la_le.le_prev != NULL) {
287 panic("%s: trying to free %p when it is in use", __func__, la);
288 /* NOTREACHED */
289 }
290
291 /* Free any held packets */
292 (void) arp_llinfo_flushq(la);
293
294 /* Purge any link-layer info caching */
295 VERIFY(la->la_rt->rt_llinfo == la);
296 if (la->la_rt->rt_llinfo_purge != NULL) {
297 la->la_rt->rt_llinfo_purge(la->la_rt);
298 }
299
300 kfree_type(struct llinfo_arp, la);
301 }
302
303 static bool
arp_llinfo_addq(struct llinfo_arp * la,struct mbuf * m)304 arp_llinfo_addq(struct llinfo_arp *la, struct mbuf *m)
305 {
306 classq_pkt_t pkt = CLASSQ_PKT_INITIALIZER(pkt);
307
308 if (arpstat.held >= arp_maxhold_total) {
309 if (arp_verbose) {
310 log(LOG_DEBUG,
311 "%s: dropping packet due to maxhold_total\n",
312 __func__);
313 }
314 os_atomic_inc(&arpstat.dropped, relaxed);
315 return false;
316 }
317
318 if (qlen(&la->la_holdq) >= qlimit(&la->la_holdq)) {
319 struct mbuf *_m;
320 /* prune less than CTL, else take what's at the head */
321 _getq_scidx_lt(&la->la_holdq, &pkt, SCIDX_CTL);
322 _m = pkt.cp_mbuf;
323 if (_m == NULL) {
324 _getq(&la->la_holdq, &pkt);
325 _m = pkt.cp_mbuf;
326 }
327 VERIFY(_m != NULL);
328 if (arp_verbose) {
329 log(LOG_DEBUG, "%s: dropping packet (scidx %u)\n",
330 __func__, MBUF_SCIDX(mbuf_get_service_class(_m)));
331 }
332 m_freem(_m);
333 os_atomic_inc(&arpstat.dropped, relaxed);
334 os_atomic_dec(&arpstat.held, relaxed);
335 }
336 CLASSQ_PKT_INIT_MBUF(&pkt, m);
337 _addq(&la->la_holdq, &pkt);
338 os_atomic_inc(&arpstat.held, relaxed);
339 if (arp_verbose) {
340 log(LOG_DEBUG, "%s: enqueued packet (scidx %u), qlen now %u\n",
341 __func__, MBUF_SCIDX(mbuf_get_service_class(m)),
342 qlen(&la->la_holdq));
343 }
344
345 return true;
346 }
347
348 static uint32_t
arp_llinfo_flushq(struct llinfo_arp * la)349 arp_llinfo_flushq(struct llinfo_arp *la)
350 {
351 uint32_t held = qlen(&la->la_holdq);
352
353 if (held != 0) {
354 os_atomic_add(&arpstat.purged, held, relaxed);
355 os_atomic_add(&arpstat.held, -held, relaxed);
356 _flushq(&la->la_holdq);
357 }
358 la->la_prbreq_cnt = 0;
359 VERIFY(qempty(&la->la_holdq));
360 return held;
361 }
362
363 static void
arp_llinfo_purge(struct rtentry * rt)364 arp_llinfo_purge(struct rtentry *rt)
365 {
366 struct llinfo_arp *__single la = rt->rt_llinfo;
367
368 RT_LOCK_ASSERT_HELD(rt);
369 VERIFY(rt->rt_llinfo_purge == arp_llinfo_purge && la != NULL);
370
371 if (la->la_llreach != NULL) {
372 RT_CONVERT_LOCK(rt);
373 ifnet_llreach_free(la->la_llreach);
374 la->la_llreach = NULL;
375 }
376 la->la_lastused = 0;
377 }
378
379 static void
arp_llinfo_get_ri(struct rtentry * rt,struct rt_reach_info * ri)380 arp_llinfo_get_ri(struct rtentry *rt, struct rt_reach_info *ri)
381 {
382 struct llinfo_arp *__single la = rt->rt_llinfo;
383 struct if_llreach *lr = la->la_llreach;
384
385 if (lr == NULL) {
386 bzero(ri, sizeof(*ri));
387 ri->ri_rssi = IFNET_RSSI_UNKNOWN;
388 ri->ri_lqm = IFNET_LQM_THRESH_OFF;
389 ri->ri_npm = IFNET_NPM_THRESH_UNKNOWN;
390 } else {
391 IFLR_LOCK(lr);
392 /* Export to rt_reach_info structure */
393 ifnet_lr2ri(lr, ri);
394 /* Export ARP send expiration (calendar) time */
395 ri->ri_snd_expire =
396 ifnet_llreach_up2calexp(lr, la->la_lastused);
397 IFLR_UNLOCK(lr);
398 }
399 }
400
401 static void
arp_llinfo_get_iflri(struct rtentry * rt,struct ifnet_llreach_info * iflri)402 arp_llinfo_get_iflri(struct rtentry *rt, struct ifnet_llreach_info *iflri)
403 {
404 struct llinfo_arp *__single la = rt->rt_llinfo;
405 struct if_llreach *lr = la->la_llreach;
406
407 if (lr == NULL) {
408 bzero(iflri, sizeof(*iflri));
409 iflri->iflri_rssi = IFNET_RSSI_UNKNOWN;
410 iflri->iflri_lqm = IFNET_LQM_THRESH_OFF;
411 iflri->iflri_npm = IFNET_NPM_THRESH_UNKNOWN;
412 } else {
413 IFLR_LOCK(lr);
414 /* Export to ifnet_llreach_info structure */
415 ifnet_lr2iflri(lr, iflri);
416 /* Export ARP send expiration (uptime) time */
417 iflri->iflri_snd_expire =
418 ifnet_llreach_up2upexp(lr, la->la_lastused);
419 IFLR_UNLOCK(lr);
420 }
421 }
422
423 static void
arp_llinfo_refresh(struct rtentry * rt)424 arp_llinfo_refresh(struct rtentry *rt)
425 {
426 uint64_t timenow = net_uptime();
427 /*
428 * If route entry is permanent or if expiry is less
429 * than timenow and extra time taken for unicast probe
430 * we can't expedite the refresh
431 */
432 if ((rt->rt_expire == 0) ||
433 (rt->rt_flags & RTF_STATIC) ||
434 !(rt->rt_flags & RTF_LLINFO)) {
435 return;
436 }
437
438 if (rt->rt_expire > timenow) {
439 rt->rt_expire = timenow;
440 }
441 return;
442 }
443
444 void
arp_llreach_set_reachable(struct ifnet * ifp,void * __sized_by (alen)addr,unsigned int alen)445 arp_llreach_set_reachable(struct ifnet *ifp, void *__sized_by(alen)addr,
446 unsigned int alen)
447 {
448 /* Nothing more to do if it's disabled */
449 if (arp_llreach_base == 0) {
450 return;
451 }
452
453 ifnet_llreach_set_reachable(ifp, ETHERTYPE_IP, addr, alen);
454 }
455
456 static __inline void
arp_llreach_use(struct llinfo_arp * la)457 arp_llreach_use(struct llinfo_arp *la)
458 {
459 if (la->la_llreach != NULL) {
460 la->la_lastused = net_uptime();
461 }
462 }
463
464 static __inline int
arp_llreach_reachable(struct llinfo_arp * la)465 arp_llreach_reachable(struct llinfo_arp *la)
466 {
467 struct if_llreach *lr;
468 const char *why = NULL;
469
470 /* Nothing more to do if it's disabled; pretend it's reachable */
471 if (arp_llreach_base == 0) {
472 return 1;
473 }
474
475 if ((lr = la->la_llreach) == NULL) {
476 /*
477 * Link-layer reachability record isn't present for this
478 * ARP entry; pretend it's reachable and use it as is.
479 */
480 return 1;
481 } else if (ifnet_llreach_reachable(lr)) {
482 /*
483 * Record is present, it's not shared with other ARP
484 * entries and a packet has recently been received
485 * from the remote host; consider it reachable.
486 */
487 if (lr->lr_reqcnt == 1) {
488 return 1;
489 }
490
491 /* Prime it up, if this is the first time */
492 if (la->la_lastused == 0) {
493 VERIFY(la->la_llreach != NULL);
494 arp_llreach_use(la);
495 }
496
497 /*
498 * Record is present and shared with one or more ARP
499 * entries, and a packet has recently been received
500 * from the remote host. Since it's shared by more
501 * than one IP addresses, we can't rely on the link-
502 * layer reachability alone; consider it reachable if
503 * this ARP entry has been used "recently."
504 */
505 if (ifnet_llreach_reachable_delta(lr, la->la_lastused)) {
506 return 1;
507 }
508
509 why = "has alias(es) and hasn't been used in a while";
510 } else {
511 why = "haven't heard from it in a while";
512 }
513
514 if (arp_verbose > 1) {
515 char tmp[MAX_IPv4_STR_LEN];
516 u_int64_t now = net_uptime();
517
518 log(LOG_DEBUG, "%s: ARP probe(s) needed for %s; "
519 "%s [lastused %lld, lastrcvd %lld] secs ago\n",
520 if_name(lr->lr_ifp), inet_ntop(AF_INET,
521 &SIN(rt_key(la->la_rt))->sin_addr, tmp, sizeof(tmp)), why,
522 (la->la_lastused ? (int64_t)(now - la->la_lastused) : -1),
523 (lr->lr_lastrcvd ? (int64_t)(now - lr->lr_lastrcvd) : -1));
524 }
525 return 0;
526 }
527
528 /*
529 * Obtain a link-layer source cache entry for the sender.
530 *
531 * NOTE: This is currently only for ARP/Ethernet.
532 */
533 static void
arp_llreach_alloc(struct rtentry * rt,struct ifnet * ifp,void * __sized_by (alen)addr,unsigned int alen,boolean_t solicited,uint32_t * p_rt_event_code)534 arp_llreach_alloc(struct rtentry *rt, struct ifnet *ifp, void *__sized_by(alen)addr,
535 unsigned int alen, boolean_t solicited, uint32_t *p_rt_event_code)
536 {
537 VERIFY(rt->rt_expire == 0 || rt->rt_rmx.rmx_expire != 0);
538 VERIFY(rt->rt_expire != 0 || rt->rt_rmx.rmx_expire == 0);
539
540 if (arp_llreach_base != 0 && rt->rt_expire != 0 &&
541 !(rt->rt_ifp->if_flags & IFF_LOOPBACK) &&
542 ifp->if_addrlen == IF_LLREACH_MAXLEN && /* Ethernet */
543 alen == ifp->if_addrlen) {
544 struct llinfo_arp *__single la = rt->rt_llinfo;
545 struct if_llreach *lr;
546 const char *why = NULL, *type = "";
547
548 /* Become a regular mutex, just in case */
549 RT_CONVERT_LOCK(rt);
550
551 if ((lr = la->la_llreach) != NULL) {
552 type = (solicited ? "ARP reply" : "ARP announcement");
553 /*
554 * If target has changed, create a new record;
555 * otherwise keep existing record.
556 */
557 IFLR_LOCK(lr);
558 if (bcmp(addr, lr->lr_key.addr, alen) != 0) {
559 IFLR_UNLOCK(lr);
560 /* Purge any link-layer info caching */
561 VERIFY(rt->rt_llinfo_purge != NULL);
562 rt->rt_llinfo_purge(rt);
563 lr = NULL;
564 why = " for different target HW address; "
565 "using new llreach record";
566 *p_rt_event_code = ROUTE_LLENTRY_CHANGED;
567 } else {
568 /*
569 * If we were doing unicast probing, we need to
570 * deliver an event for neighbor cache resolution
571 */
572 if (lr->lr_probes != 0) {
573 *p_rt_event_code = ROUTE_LLENTRY_RESOLVED;
574 }
575
576 lr->lr_probes = 0; /* reset probe count */
577 IFLR_UNLOCK(lr);
578 if (solicited) {
579 why = " for same target HW address; "
580 "keeping existing llreach record";
581 }
582 }
583 }
584
585 if (lr == NULL) {
586 lr = la->la_llreach = ifnet_llreach_alloc(ifp,
587 ETHERTYPE_IP, addr, alen, arp_llreach_base);
588 if (lr != NULL) {
589 lr->lr_probes = 0; /* reset probe count */
590 if (why == NULL) {
591 why = "creating new llreach record";
592 }
593 }
594 *p_rt_event_code = ROUTE_LLENTRY_RESOLVED;
595 }
596
597 if (arp_verbose > 1 && lr != NULL && why != NULL) {
598 char tmp[MAX_IPv4_STR_LEN];
599
600 log(LOG_DEBUG, "%s: %s%s for %s\n", if_name(ifp),
601 type, why, inet_ntop(AF_INET,
602 &SIN(rt_key(rt))->sin_addr, tmp, sizeof(tmp)));
603 }
604 }
605 }
606
607 struct arptf_arg {
608 boolean_t draining;
609 boolean_t probing;
610 uint32_t killed;
611 uint32_t aging;
612 uint32_t sticky;
613 uint32_t found;
614 uint32_t qlen;
615 uint32_t qsize;
616 };
617
618 /*
619 * Free an arp entry.
620 */
621 static void
arptfree(struct llinfo_arp * la,void * arg)622 arptfree(struct llinfo_arp *la, void *arg)
623 {
624 struct arptf_arg *__single ap = arg;
625 struct rtentry *rt = la->la_rt;
626 uint64_t timenow;
627
628 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
629
630 /* rnh_lock acquired by caller protects rt from going away */
631 RT_LOCK(rt);
632
633 VERIFY(rt->rt_expire == 0 || rt->rt_rmx.rmx_expire != 0);
634 VERIFY(rt->rt_expire != 0 || rt->rt_rmx.rmx_expire == 0);
635
636 ap->found++;
637 timenow = net_uptime();
638
639 /* If we're probing, flush out held packets upon probe expiration */
640 if (ap->probing && (la->la_flags & LLINFO_PROBING) &&
641 la->la_probeexp <= timenow) {
642 struct sockaddr_dl *sdl = SDL(rt->rt_gateway);
643 if (sdl != NULL) {
644 sdl->sdl_alen = 0;
645 }
646 (void) arp_llinfo_flushq(la);
647 /*
648 * Enqueue work item to invoke callback for this route entry
649 */
650 route_event_enqueue_nwk_wq_entry(rt, NULL,
651 ROUTE_LLENTRY_UNREACH, NULL, TRUE);
652 }
653
654 /*
655 * The following is mostly being used to arm the timer
656 * again and for logging.
657 * qlen is used to re-arm the timer. Therefore, pure probe
658 * requests can be considered as 0 length packets
659 * contributing only to length but not to the size.
660 */
661 ap->qlen += qlen(&la->la_holdq);
662 ap->qlen += la->la_prbreq_cnt;
663 ap->qsize += qsize(&la->la_holdq);
664
665 if (rt->rt_expire == 0 || (rt->rt_flags & RTF_STATIC)) {
666 ap->sticky++;
667 /* ARP entry is permanent? */
668 if (rt->rt_expire == 0) {
669 RT_UNLOCK(rt);
670 return;
671 }
672 }
673
674 /* ARP entry hasn't expired and we're not draining? */
675 if (!ap->draining && rt->rt_expire > timenow) {
676 RT_UNLOCK(rt);
677 ap->aging++;
678 return;
679 }
680
681 if (rt->rt_refcnt > 0) {
682 /*
683 * ARP entry has expired, with outstanding refcnt.
684 * If we're not draining, force ARP query to be
685 * generated next time this entry is used.
686 */
687 if (!ap->draining && !ap->probing) {
688 struct sockaddr_dl *sdl = SDL(rt->rt_gateway);
689 if (sdl != NULL) {
690 sdl->sdl_alen = 0;
691 }
692 la->la_asked = 0;
693 rt->rt_flags &= ~RTF_REJECT;
694 }
695 RT_UNLOCK(rt);
696 } else if (!(rt->rt_flags & RTF_STATIC) && !ap->probing) {
697 /*
698 * ARP entry has no outstanding refcnt, and we're either
699 * draining or it has expired; delete it from the routing
700 * table. Safe to drop rt_lock and use rt_key, since holding
701 * rnh_lock here prevents another thread from calling
702 * rt_setgate() on this route.
703 */
704 RT_UNLOCK(rt);
705 rtrequest_locked(RTM_DELETE, rt_key(rt), NULL,
706 rt_mask(rt), 0, NULL);
707 arpstat.timeouts++;
708 ap->killed++;
709 } else {
710 /* ARP entry is static; let it linger */
711 RT_UNLOCK(rt);
712 }
713 }
714
715 void
in_arpdrain(void * arg)716 in_arpdrain(void *arg)
717 {
718 #pragma unused(arg)
719 struct llinfo_arp *la, *ola;
720 struct arptf_arg farg;
721
722 if (arp_verbose) {
723 log(LOG_DEBUG, "%s: draining ARP entries\n", __func__);
724 }
725
726 lck_mtx_lock(rnh_lock);
727 la = llinfo_arp.lh_first;
728 bzero(&farg, sizeof(farg));
729 farg.draining = TRUE;
730 while ((ola = la) != NULL) {
731 la = la->la_le.le_next;
732 arptfree(ola, &farg);
733 }
734 if (arp_verbose) {
735 log(LOG_DEBUG, "%s: found %u, aging %u, sticky %u, killed %u; "
736 "%u pkts held (%u bytes)\n", __func__, farg.found,
737 farg.aging, farg.sticky, farg.killed, farg.qlen,
738 farg.qsize);
739 }
740 lck_mtx_unlock(rnh_lock);
741 }
742
743 /*
744 * Timeout routine. Age arp_tab entries periodically.
745 */
746 static void
arp_timeout(thread_call_param_t arg0,thread_call_param_t arg1)747 arp_timeout(thread_call_param_t arg0, thread_call_param_t arg1)
748 {
749 #pragma unused(arg0, arg1)
750 struct llinfo_arp *la, *ola;
751 struct timeval atv;
752 struct arptf_arg farg;
753
754 lck_mtx_lock(rnh_lock);
755 la = llinfo_arp.lh_first;
756 bzero(&farg, sizeof(farg));
757 while ((ola = la) != NULL) {
758 la = la->la_le.le_next;
759 arptfree(ola, &farg);
760 }
761 if (arp_verbose) {
762 log(LOG_DEBUG, "%s: found %u, aging %u, sticky %u, killed %u; "
763 "%u pkts held (%u bytes)\n", __func__, farg.found,
764 farg.aging, farg.sticky, farg.killed, farg.qlen,
765 farg.qsize);
766 }
767 atv.tv_usec = 0;
768 atv.tv_sec = MAX(arpt_prune, 5);
769 /* re-arm the timer if there's work to do */
770 arp_timeout_run = 0;
771 if (farg.aging > 0) {
772 arp_sched_timeout(&atv);
773 } else if (arp_verbose) {
774 log(LOG_DEBUG, "%s: not rescheduling timer\n", __func__);
775 }
776 lck_mtx_unlock(rnh_lock);
777 }
778
779 static void
arp_sched_timeout(struct timeval * atv)780 arp_sched_timeout(struct timeval *atv)
781 {
782 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
783
784 if (!arp_timeout_run) {
785 struct timeval tv;
786 uint64_t deadline = 0;
787
788 if (arp_timeout_tcall == NULL) {
789 arp_timeout_tcall =
790 thread_call_allocate(arp_timeout, NULL);
791 VERIFY(arp_timeout_tcall != NULL);
792 }
793
794 if (atv == NULL) {
795 tv.tv_usec = 0;
796 tv.tv_sec = MAX(arpt_prune / 5, 1);
797 atv = &tv;
798 }
799 if (arp_verbose) {
800 log(LOG_DEBUG, "%s: timer scheduled in "
801 "T+%llus.%lluu\n", __func__,
802 (uint64_t)atv->tv_sec, (uint64_t)atv->tv_usec);
803 }
804 arp_timeout_run = 1;
805
806 clock_deadline_for_periodic_event(atv->tv_sec * NSEC_PER_SEC,
807 mach_absolute_time(), &deadline);
808 (void) thread_call_enter_delayed(arp_timeout_tcall, deadline);
809 }
810 }
811
812 /*
813 * Probe routine.
814 */
815 static void
arp_probe(thread_call_param_t arg0,thread_call_param_t arg1)816 arp_probe(thread_call_param_t arg0, thread_call_param_t arg1)
817 {
818 #pragma unused(arg0, arg1)
819 struct llinfo_arp *la, *ola;
820 struct timeval atv;
821 struct arptf_arg farg;
822
823 lck_mtx_lock(rnh_lock);
824 la = llinfo_arp.lh_first;
825 bzero(&farg, sizeof(farg));
826 farg.probing = TRUE;
827 while ((ola = la) != NULL) {
828 la = la->la_le.le_next;
829 arptfree(ola, &farg);
830 }
831 if (arp_verbose) {
832 log(LOG_DEBUG, "%s: found %u, aging %u, sticky %u, killed %u; "
833 "%u pkts held (%u bytes)\n", __func__, farg.found,
834 farg.aging, farg.sticky, farg.killed, farg.qlen,
835 farg.qsize);
836 }
837 atv.tv_usec = 0;
838 atv.tv_sec = MAX(arpt_probe, ARP_PROBE_TIME);
839 /* re-arm the probe if there's work to do */
840 arp_probe_run = 0;
841 if (farg.qlen > 0) {
842 arp_sched_probe(&atv);
843 } else if (arp_verbose) {
844 log(LOG_DEBUG, "%s: not rescheduling probe\n", __func__);
845 }
846 lck_mtx_unlock(rnh_lock);
847 }
848
849 static void
arp_sched_probe(struct timeval * atv)850 arp_sched_probe(struct timeval *atv)
851 {
852 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
853
854 if (!arp_probe_run) {
855 struct timeval tv;
856 uint64_t deadline = 0;
857
858 if (arp_probe_tcall == NULL) {
859 arp_probe_tcall =
860 thread_call_allocate(arp_probe, NULL);
861 VERIFY(arp_probe_tcall != NULL);
862 }
863
864 if (atv == NULL) {
865 tv.tv_usec = 0;
866 tv.tv_sec = MAX(arpt_probe, ARP_PROBE_TIME);
867 atv = &tv;
868 }
869 if (arp_verbose) {
870 log(LOG_DEBUG, "%s: probe scheduled in "
871 "T+%llus.%lluu\n", __func__,
872 (uint64_t)atv->tv_sec, (uint64_t)atv->tv_usec);
873 }
874 arp_probe_run = 1;
875
876 clock_deadline_for_periodic_event(atv->tv_sec * NSEC_PER_SEC,
877 mach_absolute_time(), &deadline);
878 (void) thread_call_enter_delayed(arp_probe_tcall, deadline);
879 }
880 }
881
882 /*
883 * ifa_rtrequest() callback
884 */
885 static void
arp_rtrequest(int req,struct rtentry * rt,struct sockaddr * sa)886 arp_rtrequest(int req, struct rtentry *rt, struct sockaddr *sa)
887 {
888 #pragma unused(sa)
889 struct sockaddr *gate = rt->rt_gateway;
890 struct llinfo_arp *__single la = rt->rt_llinfo;
891 static struct sockaddr_dl null_sdl =
892 { .sdl_len = sizeof(null_sdl), .sdl_family = AF_LINK };
893 uint64_t timenow;
894 char buf[MAX_IPv4_STR_LEN];
895
896 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
897 RT_LOCK_ASSERT_HELD(rt);
898
899 if (rt->rt_flags & RTF_GATEWAY) {
900 return;
901 }
902
903 timenow = net_uptime();
904 switch (req) {
905 case RTM_ADD:
906 /*
907 * XXX: If this is a manually added route to interface
908 * such as older version of routed or gated might provide,
909 * restore cloning bit.
910 */
911 if (!(rt->rt_flags & RTF_HOST) && rt_mask(rt) != NULL &&
912 SIN(rt_mask(rt))->sin_addr.s_addr != INADDR_BROADCAST) {
913 rt->rt_flags |= RTF_CLONING;
914 }
915
916 if (rt->rt_flags & RTF_CLONING) {
917 /*
918 * Case 1: This route should come from a route to iface.
919 */
920 if (rt_setgate(rt, rt_key(rt), SA(&null_sdl)) == 0) {
921 gate = rt->rt_gateway;
922 SDL(gate)->sdl_type = rt->rt_ifp->if_type;
923 SDL(gate)->sdl_index = rt->rt_ifp->if_index;
924 /*
925 * In case we're called before 1.0 sec.
926 * has elapsed.
927 */
928 rt_setexpire(rt, MAX(timenow, 1));
929 }
930 break;
931 }
932 /* Announce a new entry if requested. */
933 if (rt->rt_flags & RTF_ANNOUNCE) {
934 if (la != NULL) {
935 arp_llreach_use(la); /* Mark use timestamp */
936 }
937 if ((rt->rt_ifp->if_flags & IFF_NOARP) == 0) {
938 RT_UNLOCK(rt);
939 dlil_send_arp(rt->rt_ifp, ARPOP_REQUEST,
940 SDL(gate), rt_key(rt), NULL, rt_key(rt), 0);
941 RT_LOCK(rt);
942 arpstat.txannounces++;
943 }
944 }
945 OS_FALLTHROUGH;
946 case RTM_RESOLVE:
947 if (gate->sa_family != AF_LINK ||
948 gate->sa_len < sizeof(null_sdl)) {
949 arpstat.invalidreqs++;
950 log(LOG_ERR, "%s: route to %s has bad gateway address "
951 "(sa_family %u sa_len %u) on %s\n",
952 __func__, inet_ntop(AF_INET,
953 &SIN(rt_key(rt))->sin_addr.s_addr, buf,
954 sizeof(buf)), gate->sa_family, gate->sa_len,
955 if_name(rt->rt_ifp));
956 break;
957 }
958 SDL(gate)->sdl_type = rt->rt_ifp->if_type;
959 SDL(gate)->sdl_index = rt->rt_ifp->if_index;
960
961 if (la != NULL) {
962 break; /* This happens on a route change */
963 }
964 /*
965 * Case 2: This route may come from cloning, or a manual route
966 * add with a LL address.
967 */
968 rt->rt_llinfo = la = arp_llinfo_alloc(Z_WAITOK);
969
970 rt->rt_llinfo_get_ri = arp_llinfo_get_ri;
971 rt->rt_llinfo_get_iflri = arp_llinfo_get_iflri;
972 rt->rt_llinfo_purge = arp_llinfo_purge;
973 rt->rt_llinfo_free = arp_llinfo_free;
974 rt->rt_llinfo_refresh = arp_llinfo_refresh;
975 rt->rt_flags |= RTF_LLINFO;
976 la->la_rt = rt;
977 LIST_INSERT_HEAD(&llinfo_arp, la, la_le);
978 arpstat.inuse++;
979
980 /* We have at least one entry; arm the timer if not already */
981 arp_sched_timeout(NULL);
982
983 /*
984 * This keeps the multicast addresses from showing up
985 * in `arp -a' listings as unresolved. It's not actually
986 * functional. Then the same for broadcast. For IPv4
987 * link-local address, keep the entry around even after
988 * it has expired.
989 */
990 if (IN_MULTICAST(ntohl(SIN(rt_key(rt))->sin_addr.s_addr))) {
991 RT_UNLOCK(rt);
992 dlil_resolve_multi(rt->rt_ifp, rt_key(rt), gate,
993 sizeof(struct sockaddr_dl));
994 RT_LOCK(rt);
995 rt_setexpire(rt, 0);
996 } else if (in_broadcast(SIN(rt_key(rt))->sin_addr,
997 rt->rt_ifp)) {
998 struct sockaddr_dl *gate_ll = SDL(gate);
999 size_t broadcast_len;
1000 int ret = ifnet_llbroadcast_copy_bytes(rt->rt_ifp,
1001 LLADDR(gate_ll), sizeof(gate_ll->sdl_data),
1002 &broadcast_len);
1003 if (ret == 0 && broadcast_len <= UINT8_MAX) {
1004 gate_ll->sdl_alen = (u_char)broadcast_len;
1005 gate_ll->sdl_family = AF_LINK;
1006 gate_ll->sdl_len = sizeof(struct sockaddr_dl);
1007 }
1008 /* In case we're called before 1.0 sec. has elapsed */
1009 rt_setexpire(rt, MAX(timenow, 1));
1010 } else if (IN_LINKLOCAL(ntohl(SIN(rt_key(rt))->
1011 sin_addr.s_addr))) {
1012 rt->rt_flags |= RTF_STATIC;
1013 }
1014
1015 /* Set default maximum number of retries */
1016 la->la_maxtries = arp_maxtries;
1017
1018 /* Become a regular mutex, just in case */
1019 RT_CONVERT_LOCK(rt);
1020 IFA_LOCK_SPIN(rt->rt_ifa);
1021 if (SIN(rt_key(rt))->sin_addr.s_addr ==
1022 (IA_SIN(rt->rt_ifa))->sin_addr.s_addr) {
1023 IFA_UNLOCK(rt->rt_ifa);
1024 /*
1025 * This test used to be
1026 * if (loif.if_flags & IFF_UP)
1027 * It allowed local traffic to be forced through the
1028 * hardware by configuring the loopback down. However,
1029 * it causes problems during network configuration
1030 * for boards that can't receive packets they send.
1031 * It is now necessary to clear "useloopback" and
1032 * remove the route to force traffic out to the
1033 * hardware.
1034 */
1035 rt_setexpire(rt, 0);
1036 struct sockaddr_dl *gate_ll = SDL(gate);
1037 ifnet_lladdr_copy_bytes(rt->rt_ifp, LLADDR(gate_ll),
1038 SDL(gate)->sdl_alen = rt->rt_ifp->if_addrlen);
1039 if (useloopback) {
1040 if (rt->rt_ifp != lo_ifp) {
1041 /*
1042 * Purge any link-layer info caching.
1043 */
1044 if (rt->rt_llinfo_purge != NULL) {
1045 rt->rt_llinfo_purge(rt);
1046 }
1047
1048 /*
1049 * Adjust route ref count for the
1050 * interfaces.
1051 */
1052 if (rt->rt_if_ref_fn != NULL) {
1053 rt->rt_if_ref_fn(lo_ifp, 1);
1054 rt->rt_if_ref_fn(rt->rt_ifp, -1);
1055 }
1056 }
1057 rt->rt_ifp = lo_ifp;
1058 /*
1059 * If rmx_mtu is not locked, update it
1060 * to the MTU used by the new interface.
1061 */
1062 if (!(rt->rt_rmx.rmx_locks & RTV_MTU)) {
1063 rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu;
1064 }
1065 }
1066 } else {
1067 IFA_UNLOCK(rt->rt_ifa);
1068 }
1069 break;
1070
1071 case RTM_DELETE:
1072 if (la == NULL) {
1073 break;
1074 }
1075 /*
1076 * Unchain it but defer the actual freeing until the route
1077 * itself is to be freed. rt->rt_llinfo still points to
1078 * llinfo_arp, and likewise, la->la_rt still points to this
1079 * route entry, except that RTF_LLINFO is now cleared.
1080 */
1081 LIST_REMOVE(la, la_le);
1082 la->la_le.le_next = NULL;
1083 la->la_le.le_prev = NULL;
1084 arpstat.inuse--;
1085
1086 /*
1087 * Purge any link-layer info caching.
1088 */
1089 if (rt->rt_llinfo_purge != NULL) {
1090 rt->rt_llinfo_purge(rt);
1091 }
1092
1093 rt->rt_flags &= ~RTF_LLINFO;
1094 (void) arp_llinfo_flushq(la);
1095 }
1096 }
1097
1098 /*
1099 * convert hardware address to hex string for logging errors.
1100 */
1101 static const char *__bidi_indexable
sdl_addr_to_hex(const struct sockaddr_dl * sdl_orig,char * __sized_by (buflen)orig_buf,int buflen)1102 sdl_addr_to_hex(const struct sockaddr_dl *sdl_orig,
1103 char *__sized_by(buflen)orig_buf, int buflen)
1104 {
1105 char *buf = orig_buf;
1106 int i;
1107 const struct sockaddr_dl *sdl = SDL(sdl_orig);
1108 const uint8_t *lladdr = CONST_LLADDR(sdl);
1109 int maxbytes = buflen / 3;
1110
1111 if (maxbytes > sdl->sdl_alen) {
1112 maxbytes = sdl->sdl_alen;
1113 }
1114 *buf = '\0';
1115 for (i = 0; i < maxbytes; i++) {
1116 snprintf(buf, 3, "%02x", lladdr[i]);
1117 buf += 2;
1118 *buf = (i == maxbytes - 1) ? '\0' : ':';
1119 buf++;
1120 }
1121 return orig_buf;
1122 }
1123
1124 /*
1125 * arp_lookup_route will lookup the route for a given address.
1126 *
1127 * The address must be for a host on a local network on this interface.
1128 * If the returned route is non-NULL, the route is locked and the caller
1129 * is responsible for unlocking it and releasing its reference.
1130 */
1131 static errno_t
arp_lookup_route(const struct in_addr * addr,int create,int proxy,route_t * route,unsigned int ifscope)1132 arp_lookup_route(const struct in_addr *addr, int create, int proxy,
1133 route_t *route, unsigned int ifscope)
1134 {
1135 struct sockaddr_inarp sin =
1136 { sizeof(sin), AF_INET, 0, { 0 }, { 0 }, 0, 0 };
1137 const char *why = NULL;
1138 errno_t error = 0;
1139 route_t rt;
1140
1141 *route = NULL;
1142
1143 sin.sin_addr.s_addr = addr->s_addr;
1144 sin.sin_other = proxy ? SIN_PROXY : 0;
1145
1146 /*
1147 * If the destination is a link-local address, don't
1148 * constrain the lookup (don't scope it).
1149 */
1150 if (IN_LINKLOCAL(ntohl(addr->s_addr))) {
1151 ifscope = IFSCOPE_NONE;
1152 }
1153
1154 rt = rtalloc1_scoped(SA(&sin), create, 0, ifscope);
1155 if (rt == NULL) {
1156 return ENETUNREACH;
1157 }
1158
1159 RT_LOCK(rt);
1160
1161 if (rt->rt_flags & RTF_GATEWAY) {
1162 why = "host is not on local network";
1163 error = ENETUNREACH;
1164 } else if (!(rt->rt_flags & RTF_LLINFO)) {
1165 why = "could not allocate llinfo";
1166 error = ENOMEM;
1167 } else if (rt->rt_gateway->sa_family != AF_LINK) {
1168 why = "gateway route is not ours";
1169 error = EPROTONOSUPPORT;
1170 }
1171
1172 if (error != 0) {
1173 if (create && (arp_verbose || log_arp_warnings)) {
1174 char tmp[MAX_IPv4_STR_LEN];
1175 log(LOG_DEBUG, "%s: link#%d %s failed: %s\n",
1176 __func__, ifscope, inet_ntop(AF_INET, addr, tmp,
1177 sizeof(tmp)), why);
1178 }
1179
1180 /*
1181 * If there are no references to this route, and it is
1182 * a cloned route, and not static, and ARP had created
1183 * the route, then purge it from the routing table as
1184 * it is probably bogus.
1185 */
1186 if (rt->rt_refcnt == 1 &&
1187 (rt->rt_flags & (RTF_WASCLONED | RTF_STATIC)) ==
1188 RTF_WASCLONED) {
1189 /*
1190 * Prevent another thread from modiying rt_key,
1191 * rt_gateway via rt_setgate() after rt_lock is
1192 * dropped by marking the route as defunct.
1193 */
1194 rt->rt_flags |= RTF_CONDEMNED;
1195 RT_UNLOCK(rt);
1196 rtrequest(RTM_DELETE, rt_key(rt), rt->rt_gateway,
1197 rt_mask(rt), rt->rt_flags, NULL);
1198 rtfree(rt);
1199 } else {
1200 RT_REMREF_LOCKED(rt);
1201 RT_UNLOCK(rt);
1202 }
1203 return error;
1204 }
1205
1206 /*
1207 * Caller releases reference and does RT_UNLOCK(rt).
1208 */
1209 *route = rt;
1210 return 0;
1211 }
1212
1213 boolean_t
arp_is_entry_probing(route_t p_route)1214 arp_is_entry_probing(route_t p_route)
1215 {
1216 struct llinfo_arp *__single llinfo = p_route->rt_llinfo;
1217
1218 if (llinfo != NULL &&
1219 llinfo->la_llreach != NULL &&
1220 llinfo->la_llreach->lr_probes != 0) {
1221 return TRUE;
1222 }
1223
1224 return FALSE;
1225 }
1226
1227 __attribute__((noinline))
1228 static void
post_kev_in_arpfailure(struct ifnet * ifp)1229 post_kev_in_arpfailure(struct ifnet *ifp)
1230 {
1231 struct kev_msg ev_msg = {};
1232 struct kev_in_arpfailure in_arpfailure = {};
1233
1234 in_arpfailure.link_data.if_family = ifp->if_family;
1235 in_arpfailure.link_data.if_unit = ifp->if_unit;
1236 strlcpy(in_arpfailure.link_data.if_name, ifp->if_name, IFNAMSIZ);
1237 ev_msg.vendor_code = KEV_VENDOR_APPLE;
1238 ev_msg.kev_class = KEV_NETWORK_CLASS;
1239 ev_msg.kev_subclass = KEV_INET_SUBCLASS;
1240 ev_msg.event_code = KEV_INET_ARPRTRFAILURE;
1241 ev_msg.dv[0].data_ptr = &in_arpfailure;
1242 ev_msg.dv[0].data_length = sizeof(struct kev_in_arpfailure);
1243 dlil_post_complete_msg(NULL, &ev_msg);
1244 }
1245
1246 __attribute__((noinline))
1247 static void
arp_send_probe_notification(route_t route)1248 arp_send_probe_notification(route_t route)
1249 {
1250 route_event_enqueue_nwk_wq_entry(route, NULL,
1251 ROUTE_LLENTRY_PROBED, NULL, TRUE);
1252
1253 if (route->rt_flags & RTF_ROUTER) {
1254 struct radix_node_head *rnh = NULL;
1255 struct route_event rt_ev;
1256 route_event_init(&rt_ev, route, NULL, ROUTE_LLENTRY_PROBED);
1257 /*
1258 * We already have a reference on rt. The function
1259 * frees it before returning.
1260 */
1261 RT_UNLOCK(route);
1262 lck_mtx_lock(rnh_lock);
1263 rnh = rt_tables[AF_INET];
1264
1265 if (rnh != NULL) {
1266 (void) rnh->rnh_walktree(rnh,
1267 route_event_walktree, (void *)&rt_ev);
1268 }
1269 lck_mtx_unlock(rnh_lock);
1270 RT_LOCK(route);
1271 }
1272 }
1273
1274 /*
1275 * This is the ARP pre-output routine; care must be taken to ensure that
1276 * the "hint" route never gets freed via rtfree(), since the caller may
1277 * have stored it inside a struct route with a reference held for that
1278 * placeholder.
1279 */
1280 errno_t
arp_lookup_ip(ifnet_t ifp,const struct sockaddr_in * net_dest,struct sockaddr_dl * __sized_by (ll_dest_len)ll_dest,size_t ll_dest_len,route_t hint,mbuf_t packet)1281 arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
1282 struct sockaddr_dl *__sized_by(ll_dest_len)ll_dest,
1283 size_t ll_dest_len, route_t hint,
1284 mbuf_t packet)
1285 {
1286 route_t route __single = NULL; /* output route */
1287 errno_t result = 0;
1288 struct sockaddr_dl *gateway;
1289 struct llinfo_arp *__single llinfo = NULL;
1290 boolean_t usable, probing = FALSE;
1291 uint64_t timenow;
1292 struct if_llreach *lr;
1293 struct ifaddr *rt_ifa;
1294 struct sockaddr *sa;
1295 uint32_t rtflags;
1296 struct sockaddr_dl sdl = {};
1297 boolean_t send_probe_notif = FALSE;
1298 boolean_t enqueued = FALSE;
1299
1300 if (ifp == NULL || net_dest == NULL) {
1301 return EINVAL;
1302 }
1303
1304 if (net_dest->sin_family != AF_INET) {
1305 return EAFNOSUPPORT;
1306 }
1307
1308 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) != (IFF_UP | IFF_RUNNING)) {
1309 return ENETDOWN;
1310 }
1311
1312 /*
1313 * If we were given a route, verify the route and grab the gateway
1314 */
1315 if (hint != NULL) {
1316 /*
1317 * Callee holds a reference on the route and returns
1318 * with the route entry locked, upon success.
1319 */
1320 result = route_to_gwroute(SA(net_dest), hint, &route);
1321 if (result != 0) {
1322 return result;
1323 }
1324 if (route != NULL) {
1325 RT_LOCK_ASSERT_HELD(route);
1326 }
1327 }
1328
1329 if ((packet != NULL && (packet->m_flags & M_BCAST)) ||
1330 in_broadcast(net_dest->sin_addr, ifp)) {
1331 size_t broadcast_len;
1332 SOCKADDR_ZERO(ll_dest, ll_dest_len);
1333 result = ifnet_llbroadcast_copy_bytes(ifp, LLADDR(ll_dest),
1334 ll_dest_len - offsetof(struct sockaddr_dl, sdl_data),
1335 &broadcast_len);
1336 if (result == 0 && broadcast_len <= UINT8_MAX) {
1337 ll_dest->sdl_alen = (u_char)broadcast_len;
1338 ll_dest->sdl_family = AF_LINK;
1339 ll_dest->sdl_len = sizeof(struct sockaddr_dl);
1340 }
1341 goto release;
1342 }
1343 if ((packet != NULL && (packet->m_flags & M_MCAST)) ||
1344 ((ifp->if_flags & IFF_MULTICAST) &&
1345 IN_MULTICAST(ntohl(net_dest->sin_addr.s_addr)))) {
1346 if (route != NULL) {
1347 RT_UNLOCK(route);
1348 }
1349 result = dlil_resolve_multi(ifp,
1350 SA(net_dest),
1351 SA(ll_dest), ll_dest_len);
1352 if (route != NULL) {
1353 RT_LOCK(route);
1354 }
1355 goto release;
1356 }
1357
1358 /*
1359 * If we didn't find a route, or the route doesn't have
1360 * link layer information, trigger the creation of the
1361 * route and link layer information.
1362 */
1363 if (route == NULL || route->rt_llinfo == NULL) {
1364 /* Clean up now while we can */
1365 if (route != NULL) {
1366 if (route == hint) {
1367 RT_REMREF_LOCKED(route);
1368 RT_UNLOCK(route);
1369 } else {
1370 RT_UNLOCK(route);
1371 rtfree(route);
1372 }
1373 }
1374 /*
1375 * Callee holds a reference on the route and returns
1376 * with the route entry locked, upon success.
1377 */
1378 result = arp_lookup_route(&net_dest->sin_addr, 1, 0, &route,
1379 ifp->if_index);
1380 if (result == 0) {
1381 RT_LOCK_ASSERT_HELD(route);
1382 }
1383 }
1384
1385 if (result || route == NULL || (llinfo = route->rt_llinfo) == NULL) {
1386 /* In case result is 0 but no route, return an error */
1387 if (result == 0) {
1388 result = EHOSTUNREACH;
1389 }
1390
1391 if (route != NULL && route->rt_llinfo == NULL) {
1392 char tmp[MAX_IPv4_STR_LEN];
1393 log(LOG_ERR, "%s: can't allocate llinfo for %s\n",
1394 __func__, inet_ntop(AF_INET, &net_dest->sin_addr,
1395 tmp, sizeof(tmp)));
1396 }
1397 goto release;
1398 }
1399
1400 if ((ifp->if_flags & IFF_NOARP) != 0) {
1401 result = ENOTSUP;
1402 goto release;
1403 }
1404
1405 /*
1406 * Now that we have the right route, is it filled in?
1407 */
1408 gateway = SDL(route->rt_gateway);
1409 timenow = net_uptime();
1410 VERIFY(route->rt_expire == 0 || route->rt_rmx.rmx_expire != 0);
1411 VERIFY(route->rt_expire != 0 || route->rt_rmx.rmx_expire == 0);
1412
1413 usable = ((route->rt_expire == 0 || route->rt_expire > timenow) &&
1414 gateway != NULL && gateway->sdl_family == AF_LINK &&
1415 gateway->sdl_alen != 0);
1416
1417 if (usable) {
1418 boolean_t unreachable = !arp_llreach_reachable(llinfo);
1419
1420 /* Entry is usable, so fill in info for caller */
1421 SOCKADDR_COPY(gateway, ll_dest, MIN(gateway->sdl_len, ll_dest_len));
1422 result = 0;
1423 arp_llreach_use(llinfo); /* Mark use timestamp */
1424
1425 lr = llinfo->la_llreach;
1426 if (lr == NULL) {
1427 goto release;
1428 }
1429 rt_ifa = route->rt_ifa;
1430
1431 /* Become a regular mutex, just in case */
1432 RT_CONVERT_LOCK(route);
1433 IFLR_LOCK_SPIN(lr);
1434
1435 if ((unreachable || (llinfo->la_flags & LLINFO_PROBING)) &&
1436 lr->lr_probes < arp_unicast_lim) {
1437 /*
1438 * Thus mark the entry with la_probeexp deadline to
1439 * trigger the probe timer to be scheduled (if not
1440 * already). This gets cleared the moment we get
1441 * an ARP reply.
1442 */
1443 probing = TRUE;
1444 if (lr->lr_probes == 0) {
1445 llinfo->la_probeexp = (timenow + arpt_probe);
1446 llinfo->la_flags |= LLINFO_PROBING;
1447 /*
1448 * Provide notification that ARP unicast
1449 * probing has started.
1450 * We only do it for the first unicast probe
1451 * attempt.
1452 */
1453 send_probe_notif = TRUE;
1454 }
1455
1456 /*
1457 * Start the unicast probe and anticipate a reply;
1458 * afterwards, return existing entry to caller and
1459 * let it be used anyway. If peer is non-existent
1460 * we'll broadcast ARP next time around.
1461 */
1462 lr->lr_probes++;
1463 SOCKADDR_ZERO(&sdl, sizeof(sdl));
1464 sdl.sdl_alen = ifp->if_addrlen;
1465 bcopy(&lr->lr_key.addr, LLADDR(&sdl),
1466 ifp->if_addrlen);
1467 IFLR_UNLOCK(lr);
1468 IFA_LOCK_SPIN(rt_ifa);
1469 ifa_addref(rt_ifa);
1470 sa = rt_ifa->ifa_addr;
1471 IFA_UNLOCK(rt_ifa);
1472 rtflags = route->rt_flags;
1473 RT_UNLOCK(route);
1474 dlil_send_arp(ifp, ARPOP_REQUEST, NULL, sa,
1475 SDL(&sdl),
1476 SA(net_dest), rtflags);
1477 ifa_remref(rt_ifa);
1478 RT_LOCK(route);
1479 goto release;
1480 } else {
1481 IFLR_UNLOCK(lr);
1482 if (!unreachable &&
1483 !(llinfo->la_flags & LLINFO_PROBING)) {
1484 /*
1485 * Normal case where peer is still reachable,
1486 * we're not probing and if_addrlen is anything
1487 * but IF_LLREACH_MAXLEN.
1488 */
1489 goto release;
1490 }
1491 }
1492 }
1493
1494 /*
1495 * Route wasn't complete/valid; we need to send out ARP request.
1496 * If we've exceeded the limit of la_holdq, drop from the head
1497 * of queue and add this packet to the tail. If we end up with
1498 * RTF_REJECT below, we'll dequeue this from tail and have the
1499 * caller free the packet instead. It's safe to do that since
1500 * we still hold the route's rt_lock.
1501 */
1502 if (packet != NULL) {
1503 enqueued = arp_llinfo_addq(llinfo, packet);
1504 } else {
1505 llinfo->la_prbreq_cnt++;
1506 }
1507 /*
1508 * Regardless of permanent vs. expirable entry, we need to
1509 * avoid having packets sit in la_holdq forever; thus mark the
1510 * entry with la_probeexp deadline to trigger the probe timer
1511 * to be scheduled (if not already). This gets cleared the
1512 * moment we get an ARP reply.
1513 */
1514 probing = TRUE;
1515 if ((qlen(&llinfo->la_holdq) + llinfo->la_prbreq_cnt) == 1) {
1516 llinfo->la_probeexp = (timenow + arpt_probe);
1517 llinfo->la_flags |= LLINFO_PROBING;
1518 }
1519
1520 if (route->rt_expire) {
1521 route->rt_flags &= ~RTF_REJECT;
1522 if (llinfo->la_asked == 0 || route->rt_expire != timenow) {
1523 rt_setexpire(route, timenow);
1524 if (llinfo->la_asked++ < llinfo->la_maxtries) {
1525 boolean_t sendkev = FALSE;
1526
1527 rt_ifa = route->rt_ifa;
1528 lr = llinfo->la_llreach;
1529 /* Become a regular mutex, just in case */
1530 RT_CONVERT_LOCK(route);
1531 /* Update probe count, if applicable */
1532 if (lr != NULL) {
1533 IFLR_LOCK_SPIN(lr);
1534 lr->lr_probes++;
1535 IFLR_UNLOCK(lr);
1536 }
1537 if (ifp->if_addrlen == IF_LLREACH_MAXLEN &&
1538 route->rt_flags & RTF_ROUTER &&
1539 llinfo->la_asked > 1) {
1540 sendkev = TRUE;
1541 llinfo->la_flags |= LLINFO_RTRFAIL_EVTSENT;
1542 }
1543 IFA_LOCK_SPIN(rt_ifa);
1544 ifa_addref(rt_ifa);
1545 sa = rt_ifa->ifa_addr;
1546 IFA_UNLOCK(rt_ifa);
1547 arp_llreach_use(llinfo); /* Mark use tstamp */
1548 rtflags = route->rt_flags;
1549 RT_UNLOCK(route);
1550 dlil_send_arp(ifp, ARPOP_REQUEST, NULL, sa,
1551 NULL, SA(net_dest),
1552 rtflags);
1553 ifa_remref(rt_ifa);
1554 if (sendkev) {
1555 post_kev_in_arpfailure(ifp);
1556 }
1557 RT_LOCK(route);
1558 goto release_just_return;
1559 } else {
1560 route->rt_flags |= RTF_REJECT;
1561 rt_setexpire(route,
1562 route->rt_expire + arpt_down);
1563 llinfo->la_asked = 0;
1564 /*
1565 * Remove the packet that was just added above;
1566 * don't free it since we're not returning
1567 * EJUSTRETURN. The caller will handle the
1568 * freeing. Since we haven't dropped rt_lock
1569 * from the time of _addq() above, this packet
1570 * must be at the tail.
1571 */
1572 if (packet != NULL && enqueued) {
1573 classq_pkt_t pkt =
1574 CLASSQ_PKT_INITIALIZER(pkt);
1575
1576 _getq_tail(&llinfo->la_holdq, &pkt);
1577 os_atomic_dec(&arpstat.held, relaxed);
1578 VERIFY(pkt.cp_mbuf == packet);
1579 }
1580 result = EHOSTUNREACH;
1581 /*
1582 * Enqueue work item to invoke callback for this route entry
1583 */
1584 route_event_enqueue_nwk_wq_entry(route, NULL,
1585 ROUTE_LLENTRY_UNREACH, NULL, TRUE);
1586 goto release;
1587 }
1588 }
1589 }
1590
1591
1592 release_just_return:
1593 /* The packet is now held inside la_holdq or dropped */
1594 result = EJUSTRETURN;
1595 if (packet != NULL && !enqueued) {
1596 m_freem(packet);
1597 packet = NULL;
1598 }
1599
1600 release:
1601 if (result == EHOSTUNREACH) {
1602 os_atomic_inc(&arpstat.dropped, relaxed);
1603 }
1604
1605 if (route != NULL) {
1606 if (send_probe_notif) {
1607 arp_send_probe_notification(route);
1608 }
1609
1610 if (route == hint) {
1611 RT_REMREF_LOCKED(route);
1612 RT_UNLOCK(route);
1613 } else {
1614 RT_UNLOCK(route);
1615 rtfree(route);
1616 }
1617 }
1618 if (probing) {
1619 /* Do this after we drop rt_lock to preserve ordering */
1620 lck_mtx_lock(rnh_lock);
1621 arp_sched_probe(NULL);
1622 lck_mtx_unlock(rnh_lock);
1623 }
1624 return result;
1625 }
1626
1627 errno_t
arp_ip_handle_input(ifnet_t ifp,u_short arpop,const struct sockaddr_dl * sender_hw_orig,const struct sockaddr_in * sender_ip,const struct sockaddr_in * target_ip)1628 arp_ip_handle_input(ifnet_t ifp, u_short arpop,
1629 const struct sockaddr_dl *sender_hw_orig, const struct sockaddr_in *sender_ip,
1630 const struct sockaddr_in *target_ip)
1631 {
1632 char ipv4str[MAX_IPv4_STR_LEN];
1633 struct sockaddr_dl proxied = {};
1634 struct sockaddr_dl *gateway, *target_hw = NULL;
1635 struct ifaddr *ifa;
1636 struct in_ifaddr *ia;
1637 struct in_ifaddr *best_ia = NULL;
1638 struct sockaddr_in best_ia_sin;
1639 route_t __single route = NULL;
1640 char buf[3 * MAX_HW_LEN]; /* enough for MAX_HW_LEN byte hw address */
1641 struct llinfo_arp *__single llinfo;
1642 errno_t error;
1643 int created_announcement = 0;
1644 int bridged = 0, is_bridge = 0;
1645 uint32_t rt_evcode = 0;
1646
1647 /*
1648 * Forge the sender_hw sockaddr to extract the
1649 * complete hardware address.
1650 */
1651 const struct sockaddr_dl *sender_hw = SDL(sender_hw_orig);
1652 /*
1653 * Here and other places within this routine where we don't hold
1654 * rnh_lock, trade accuracy for speed for the common scenarios
1655 * and avoid the use of atomic updates.
1656 */
1657 arpstat.received++;
1658
1659 /* Do not respond to requests for 0.0.0.0 */
1660 if (target_ip->sin_addr.s_addr == INADDR_ANY && arpop == ARPOP_REQUEST) {
1661 goto done;
1662 }
1663
1664 if (ifp->if_bridge) {
1665 bridged = 1;
1666 }
1667 if (ifp->if_type == IFT_BRIDGE) {
1668 is_bridge = 1;
1669 }
1670
1671 if (arpop == ARPOP_REPLY) {
1672 arpstat.rxreplies++;
1673 }
1674
1675 /*
1676 * Determine if this ARP is for us
1677 */
1678 lck_rw_lock_shared(&in_ifaddr_rwlock);
1679 TAILQ_FOREACH(ia, INADDR_HASH(target_ip->sin_addr.s_addr), ia_hash) {
1680 IFA_LOCK_SPIN(&ia->ia_ifa);
1681 if (ia->ia_ifp == ifp &&
1682 ia->ia_addr.sin_addr.s_addr == target_ip->sin_addr.s_addr) {
1683 best_ia = ia;
1684 best_ia_sin = best_ia->ia_addr;
1685 ifa_addref(&ia->ia_ifa);
1686 IFA_UNLOCK(&ia->ia_ifa);
1687 lck_rw_done(&in_ifaddr_rwlock);
1688 goto match;
1689 }
1690 IFA_UNLOCK(&ia->ia_ifa);
1691 }
1692
1693 TAILQ_FOREACH(ia, INADDR_HASH(sender_ip->sin_addr.s_addr), ia_hash) {
1694 IFA_LOCK_SPIN(&ia->ia_ifa);
1695 if (ia->ia_ifp == ifp &&
1696 ia->ia_addr.sin_addr.s_addr == sender_ip->sin_addr.s_addr) {
1697 best_ia = ia;
1698 best_ia_sin = best_ia->ia_addr;
1699 ifa_addref(&ia->ia_ifa);
1700 IFA_UNLOCK(&ia->ia_ifa);
1701 lck_rw_done(&in_ifaddr_rwlock);
1702 goto match;
1703 }
1704 IFA_UNLOCK(&ia->ia_ifa);
1705 }
1706
1707 #define BDG_MEMBER_MATCHES_ARP(addr, ifp, ia) \
1708 (ia->ia_ifp->if_bridge == ifp->if_softc && \
1709 bcmp(IF_LLADDR(ia->ia_ifp), IF_LLADDR(ifp), ifp->if_addrlen) == 0 && \
1710 addr == ia->ia_addr.sin_addr.s_addr)
1711 /*
1712 * Check the case when bridge shares its MAC address with
1713 * some of its children, so packets are claimed by bridge
1714 * itself (bridge_input() does it first), but they are really
1715 * meant to be destined to the bridge member.
1716 */
1717 if (is_bridge) {
1718 TAILQ_FOREACH(ia, INADDR_HASH(target_ip->sin_addr.s_addr),
1719 ia_hash) {
1720 IFA_LOCK_SPIN(&ia->ia_ifa);
1721 if (BDG_MEMBER_MATCHES_ARP(target_ip->sin_addr.s_addr,
1722 ifp, ia)) {
1723 ifp = ia->ia_ifp;
1724 best_ia = ia;
1725 best_ia_sin = best_ia->ia_addr;
1726 ifa_addref(&ia->ia_ifa);
1727 IFA_UNLOCK(&ia->ia_ifa);
1728 lck_rw_done(&in_ifaddr_rwlock);
1729 goto match;
1730 }
1731 IFA_UNLOCK(&ia->ia_ifa);
1732 }
1733 }
1734 #undef BDG_MEMBER_MATCHES_ARP
1735 lck_rw_done(&in_ifaddr_rwlock);
1736
1737 /*
1738 * No match, use the first inet address on the receive interface
1739 * as a dummy address for the rest of the function; we may be
1740 * proxying for another address.
1741 */
1742 ifnet_lock_shared(ifp);
1743 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1744 IFA_LOCK_SPIN(ifa);
1745 if (ifa->ifa_addr->sa_family != AF_INET) {
1746 IFA_UNLOCK(ifa);
1747 continue;
1748 }
1749 best_ia = (struct in_ifaddr *__single)ifa;
1750 best_ia_sin = best_ia->ia_addr;
1751 ifa_addref(ifa);
1752 IFA_UNLOCK(ifa);
1753 ifnet_lock_done(ifp);
1754 goto match;
1755 }
1756 ifnet_lock_done(ifp);
1757
1758 /*
1759 * If we're not a bridge member, or if we are but there's no
1760 * IPv4 address to use for the interface, drop the packet.
1761 */
1762 if (!bridged || best_ia == NULL) {
1763 goto done;
1764 }
1765
1766 match:
1767 /* If the packet is from this interface, ignore the packet */
1768 if (bcmp(CONST_LLADDR(sender_hw), IF_LLADDR(ifp),
1769 sender_hw->sdl_alen) == 0) {
1770 goto done;
1771 }
1772
1773 /* Check for a conflict */
1774 if (!bridged &&
1775 sender_ip->sin_addr.s_addr == best_ia_sin.sin_addr.s_addr) {
1776 struct kev_msg ev_msg;
1777 struct kev_in_collision *in_collision;
1778 u_char storage[sizeof(struct kev_in_collision) + MAX_HW_LEN];
1779
1780 bzero(&ev_msg, sizeof(struct kev_msg));
1781 bzero(storage, (sizeof(struct kev_in_collision) + MAX_HW_LEN));
1782 in_collision = (struct kev_in_collision *)(void *)storage;
1783 log(LOG_ERR, "%s duplicate IP address %s sent from "
1784 "address %s\n", if_name(ifp),
1785 inet_ntop(AF_INET, &sender_ip->sin_addr, ipv4str,
1786 sizeof(ipv4str)), sdl_addr_to_hex(sender_hw, buf,
1787 (int)sizeof(buf)));
1788
1789 /* Send a kernel event so anyone can learn of the conflict */
1790 in_collision->link_data.if_family = ifp->if_family;
1791 in_collision->link_data.if_unit = ifp->if_unit;
1792 strlcpy(&in_collision->link_data.if_name[0],
1793 ifp->if_name, IFNAMSIZ);
1794 in_collision->ia_ipaddr = sender_ip->sin_addr;
1795 in_collision->hw_len = (sender_hw->sdl_alen < MAX_HW_LEN) ?
1796 sender_hw->sdl_alen : MAX_HW_LEN;
1797 bcopy(CONST_LLADDR(sender_hw), (caddr_t)in_collision->hw_addr,
1798 in_collision->hw_len);
1799 ev_msg.vendor_code = KEV_VENDOR_APPLE;
1800 ev_msg.kev_class = KEV_NETWORK_CLASS;
1801 ev_msg.kev_subclass = KEV_INET_SUBCLASS;
1802 ev_msg.event_code = KEV_INET_ARPCOLLISION;
1803 ev_msg.dv[0].data_ptr = in_collision;
1804 ev_msg.dv[0].data_length =
1805 sizeof(struct kev_in_collision) + in_collision->hw_len;
1806 ev_msg.dv[1].data_length = 0;
1807 dlil_post_complete_msg(NULL, &ev_msg);
1808 os_atomic_inc(&arpstat.dupips, relaxed);
1809 goto respond;
1810 }
1811
1812 /*
1813 * Look up the routing entry. If it doesn't exist and we are the
1814 * target, and the sender isn't 0.0.0.0, go ahead and create one.
1815 * Callee holds a reference on the route and returns with the route
1816 * entry locked, upon success.
1817 */
1818 error = arp_lookup_route(&sender_ip->sin_addr,
1819 (target_ip->sin_addr.s_addr == best_ia_sin.sin_addr.s_addr &&
1820 sender_ip->sin_addr.s_addr != 0), 0, &route, ifp->if_index);
1821
1822 if (error == 0) {
1823 RT_LOCK_ASSERT_HELD(route);
1824 }
1825
1826 if (error || route == NULL || route->rt_gateway == NULL) {
1827 if (arpop != ARPOP_REQUEST) {
1828 goto respond;
1829 }
1830
1831 if (arp_sendllconflict && send_conflicting_probes != 0 &&
1832 (ifp->if_eflags & IFEF_ARPLL) &&
1833 IN_LINKLOCAL(ntohl(target_ip->sin_addr.s_addr)) &&
1834 sender_ip->sin_addr.s_addr == INADDR_ANY) {
1835 /*
1836 * Verify this ARP probe doesn't conflict with
1837 * an IPv4LL we know of on another interface.
1838 */
1839 if (route != NULL) {
1840 RT_REMREF_LOCKED(route);
1841 RT_UNLOCK(route);
1842 route = NULL;
1843 }
1844 /*
1845 * Callee holds a reference on the route and returns
1846 * with the route entry locked, upon success.
1847 */
1848 error = arp_lookup_route(&target_ip->sin_addr, 0, 0,
1849 &route, ifp->if_index);
1850
1851 if (error != 0 || route == NULL ||
1852 route->rt_gateway == NULL) {
1853 goto respond;
1854 }
1855
1856 RT_LOCK_ASSERT_HELD(route);
1857
1858 gateway = SDL(route->rt_gateway);
1859 if (route->rt_ifp != ifp && gateway->sdl_alen != 0 &&
1860 (gateway->sdl_alen != sender_hw->sdl_alen ||
1861 bcmp(CONST_LLADDR(gateway), CONST_LLADDR(sender_hw),
1862 gateway->sdl_alen) != 0)) {
1863 /*
1864 * A node is probing for an IPv4LL we know
1865 * exists on a different interface. We respond
1866 * with a conflicting probe to force the new
1867 * device to pick a different IPv4LL address.
1868 */
1869 if (arp_verbose || log_arp_warnings) {
1870 log(LOG_INFO, "arp: %s on %s sent "
1871 "probe for %s, already on %s\n",
1872 sdl_addr_to_hex(sender_hw, buf,
1873 (int)sizeof(buf)), if_name(ifp),
1874 inet_ntop(AF_INET,
1875 &target_ip->sin_addr, ipv4str,
1876 sizeof(ipv4str)),
1877 if_name(route->rt_ifp));
1878 log(LOG_INFO, "arp: sending "
1879 "conflicting probe to %s on %s\n",
1880 sdl_addr_to_hex(sender_hw, buf,
1881 (int)sizeof(buf)), if_name(ifp));
1882 }
1883 /* Mark use timestamp */
1884 if (route->rt_llinfo != NULL) {
1885 arp_llreach_use(route->rt_llinfo);
1886 }
1887 /* We're done with the route */
1888 RT_REMREF_LOCKED(route);
1889 RT_UNLOCK(route);
1890 route = NULL;
1891 /*
1892 * Send a conservative unicast "ARP probe".
1893 * This should force the other device to pick
1894 * a new number. This will not force the
1895 * device to pick a new number if the device
1896 * has already assigned that number. This will
1897 * not imply to the device that we own that
1898 * address. The link address is always
1899 * present; it's never freed.
1900 */
1901 ifnet_lock_shared(ifp);
1902 ifa = ifp->if_lladdr;
1903 ifa_addref(ifa);
1904 ifnet_lock_done(ifp);
1905 dlil_send_arp_internal(ifp, ARPOP_REQUEST,
1906 SDL(ifa->ifa_addr),
1907 SA(sender_ip),
1908 sender_hw,
1909 SA(target_ip));
1910 ifa_remref(ifa);
1911 ifa = NULL;
1912 os_atomic_inc(&arpstat.txconflicts, relaxed);
1913 }
1914 goto respond;
1915 } else if (keep_announcements != 0 &&
1916 target_ip->sin_addr.s_addr == sender_ip->sin_addr.s_addr) {
1917 /*
1918 * Don't create entry if link-local address and
1919 * link-local is disabled
1920 */
1921 if (!IN_LINKLOCAL(ntohl(sender_ip->sin_addr.s_addr)) ||
1922 (ifp->if_eflags & IFEF_ARPLL)) {
1923 if (route != NULL) {
1924 RT_REMREF_LOCKED(route);
1925 RT_UNLOCK(route);
1926 route = NULL;
1927 }
1928 /*
1929 * Callee holds a reference on the route and
1930 * returns with the route entry locked, upon
1931 * success.
1932 */
1933 error = arp_lookup_route(&sender_ip->sin_addr,
1934 1, 0, &route, ifp->if_index);
1935
1936 if (error == 0) {
1937 RT_LOCK_ASSERT_HELD(route);
1938 }
1939
1940 if (error == 0 && route != NULL &&
1941 route->rt_gateway != NULL) {
1942 created_announcement = 1;
1943 }
1944 }
1945 if (created_announcement == 0) {
1946 goto respond;
1947 }
1948 } else {
1949 goto respond;
1950 }
1951 }
1952
1953 RT_LOCK_ASSERT_HELD(route);
1954 VERIFY(route->rt_expire == 0 || route->rt_rmx.rmx_expire != 0);
1955 VERIFY(route->rt_expire != 0 || route->rt_rmx.rmx_expire == 0);
1956
1957 gateway = SDL(route->rt_gateway);
1958 if (!bridged && route->rt_ifp != ifp) {
1959 if (!IN_LINKLOCAL(ntohl(sender_ip->sin_addr.s_addr)) ||
1960 !(ifp->if_eflags & IFEF_ARPLL)) {
1961 if (arp_verbose || log_arp_warnings) {
1962 log(LOG_ERR, "arp: %s is on %s but got "
1963 "reply from %s on %s\n",
1964 inet_ntop(AF_INET, &sender_ip->sin_addr,
1965 ipv4str, sizeof(ipv4str)),
1966 if_name(route->rt_ifp),
1967 sdl_addr_to_hex(sender_hw, buf,
1968 (int)sizeof(buf)), if_name(ifp));
1969 }
1970 goto respond;
1971 } else {
1972 /* Don't change a permanent address */
1973 if (route->rt_expire == 0) {
1974 goto respond;
1975 }
1976
1977 /*
1978 * We're about to check and/or change the route's ifp
1979 * and ifa, so do the lock dance: drop rt_lock, hold
1980 * rnh_lock and re-hold rt_lock to avoid violating the
1981 * lock ordering. We have an extra reference on the
1982 * route, so it won't go away while we do this.
1983 */
1984 RT_UNLOCK(route);
1985 lck_mtx_lock(rnh_lock);
1986 RT_LOCK(route);
1987 /*
1988 * Don't change the cloned route away from the
1989 * parent's interface if the address did resolve
1990 * or if the route is defunct. rt_ifp on both
1991 * the parent and the clone can now be freely
1992 * accessed now that we have acquired rnh_lock.
1993 */
1994 gateway = SDL(route->rt_gateway);
1995 if ((gateway->sdl_alen != 0 &&
1996 route->rt_parent != NULL &&
1997 route->rt_parent->rt_ifp == route->rt_ifp) ||
1998 (route->rt_flags & RTF_CONDEMNED)) {
1999 RT_REMREF_LOCKED(route);
2000 RT_UNLOCK(route);
2001 route = NULL;
2002 lck_mtx_unlock(rnh_lock);
2003 goto respond;
2004 }
2005 if (route->rt_ifp != ifp) {
2006 /*
2007 * Purge any link-layer info caching.
2008 */
2009 if (route->rt_llinfo_purge != NULL) {
2010 route->rt_llinfo_purge(route);
2011 }
2012
2013 /* Adjust route ref count for the interfaces */
2014 if (route->rt_if_ref_fn != NULL) {
2015 route->rt_if_ref_fn(ifp, 1);
2016 route->rt_if_ref_fn(route->rt_ifp, -1);
2017 }
2018 }
2019 /* Change the interface when the existing route is on */
2020 route->rt_ifp = ifp;
2021 /*
2022 * If rmx_mtu is not locked, update it
2023 * to the MTU used by the new interface.
2024 */
2025 if (!(route->rt_rmx.rmx_locks & RTV_MTU)) {
2026 route->rt_rmx.rmx_mtu = route->rt_ifp->if_mtu;
2027 if (INTF_ADJUST_MTU_FOR_CLAT46(ifp)) {
2028 route->rt_rmx.rmx_mtu = IN6_LINKMTU(route->rt_ifp);
2029 /* Further adjust the size for CLAT46 expansion */
2030 route->rt_rmx.rmx_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
2031 }
2032 }
2033
2034 rtsetifa(route, &best_ia->ia_ifa);
2035 gateway->sdl_index = ifp->if_index;
2036 RT_UNLOCK(route);
2037 lck_mtx_unlock(rnh_lock);
2038 RT_LOCK(route);
2039 /* Don't bother if the route is down */
2040 if (!(route->rt_flags & RTF_UP)) {
2041 goto respond;
2042 }
2043 /* Refresh gateway pointer */
2044 gateway = SDL(route->rt_gateway);
2045 }
2046 RT_LOCK_ASSERT_HELD(route);
2047 }
2048
2049 if (gateway->sdl_alen != 0 && bcmp(LLADDR(gateway),
2050 CONST_LLADDR(sender_hw), gateway->sdl_alen) != 0) {
2051 if (route->rt_expire != 0 &&
2052 (arp_verbose || log_arp_warnings)) {
2053 char buf2[3 * MAX_HW_LEN];
2054 log(LOG_INFO, "arp: %s moved from %s to %s on %s\n",
2055 inet_ntop(AF_INET, &sender_ip->sin_addr, ipv4str,
2056 sizeof(ipv4str)),
2057 sdl_addr_to_hex(gateway, buf, (int)sizeof(buf)),
2058 sdl_addr_to_hex(sender_hw, buf2, (int)sizeof(buf2)),
2059 if_name(ifp));
2060 } else if (route->rt_expire == 0) {
2061 if (arp_verbose || log_arp_warnings) {
2062 log(LOG_ERR, "arp: %s attempts to modify "
2063 "permanent entry for %s on %s\n",
2064 sdl_addr_to_hex(sender_hw, buf,
2065 (int)sizeof(buf)),
2066 inet_ntop(AF_INET, &sender_ip->sin_addr,
2067 ipv4str, sizeof(ipv4str)),
2068 if_name(ifp));
2069 }
2070 goto respond;
2071 }
2072 }
2073
2074 /* Copy the sender hardware address in to the route's gateway address */
2075 gateway->sdl_alen = sender_hw->sdl_alen;
2076 bcopy(CONST_LLADDR(sender_hw), LLADDR(gateway), gateway->sdl_alen);
2077
2078 /* Update the expire time for the route and clear the reject flag */
2079 if (route->rt_expire != 0) {
2080 rt_setexpire(route, net_uptime() + arpt_keep);
2081 }
2082 route->rt_flags &= ~RTF_REJECT;
2083
2084 /* cache the gateway (sender HW) address */
2085 arp_llreach_alloc(route, ifp, LLADDR(gateway), gateway->sdl_alen,
2086 (arpop == ARPOP_REPLY), &rt_evcode);
2087
2088 llinfo = route->rt_llinfo;
2089 /* send a notification that the route is back up */
2090 if (ifp->if_addrlen == IF_LLREACH_MAXLEN &&
2091 route->rt_flags & RTF_ROUTER &&
2092 llinfo->la_flags & LLINFO_RTRFAIL_EVTSENT) {
2093 struct kev_msg ev_msg;
2094 struct kev_in_arpalive in_arpalive;
2095
2096 llinfo->la_flags &= ~LLINFO_RTRFAIL_EVTSENT;
2097 RT_UNLOCK(route);
2098 bzero(&ev_msg, sizeof(ev_msg));
2099 bzero(&in_arpalive, sizeof(in_arpalive));
2100 in_arpalive.link_data.if_family = ifp->if_family;
2101 in_arpalive.link_data.if_unit = ifp->if_unit;
2102 strlcpy(in_arpalive.link_data.if_name, ifp->if_name, IFNAMSIZ);
2103 ev_msg.vendor_code = KEV_VENDOR_APPLE;
2104 ev_msg.kev_class = KEV_NETWORK_CLASS;
2105 ev_msg.kev_subclass = KEV_INET_SUBCLASS;
2106 ev_msg.event_code = KEV_INET_ARPRTRALIVE;
2107 ev_msg.dv[0].data_ptr = &in_arpalive;
2108 ev_msg.dv[0].data_length = sizeof(struct kev_in_arpalive);
2109 dlil_post_complete_msg(NULL, &ev_msg);
2110 RT_LOCK(route);
2111 }
2112 /* Update the llinfo, send out all queued packets at once */
2113 llinfo->la_asked = 0;
2114 llinfo->la_flags &= ~LLINFO_PROBING;
2115 llinfo->la_prbreq_cnt = 0;
2116
2117 if (rt_evcode) {
2118 /*
2119 * Enqueue work item to invoke callback for this route entry
2120 */
2121 route_event_enqueue_nwk_wq_entry(route, NULL, rt_evcode, NULL, TRUE);
2122
2123 if (route->rt_flags & RTF_ROUTER) {
2124 struct radix_node_head *rnh = NULL;
2125 struct route_event rt_ev;
2126 route_event_init(&rt_ev, route, NULL, rt_evcode);
2127 /*
2128 * We already have a reference on rt. The function
2129 * frees it before returning.
2130 */
2131 RT_UNLOCK(route);
2132 lck_mtx_lock(rnh_lock);
2133 rnh = rt_tables[AF_INET];
2134
2135 if (rnh != NULL) {
2136 (void) rnh->rnh_walktree(rnh, route_event_walktree,
2137 (void *)&rt_ev);
2138 }
2139 lck_mtx_unlock(rnh_lock);
2140 RT_LOCK(route);
2141 }
2142 }
2143
2144 if (!qempty(&llinfo->la_holdq)) {
2145 uint32_t held;
2146 struct mbuf *m0;
2147 classq_pkt_t pkt = CLASSQ_PKT_INITIALIZER(pkt);
2148
2149 _getq_all(&llinfo->la_holdq, &pkt, NULL, &held, NULL);
2150 m0 = pkt.cp_mbuf;
2151 if (arp_verbose) {
2152 log(LOG_DEBUG, "%s: sending %u held packets\n",
2153 __func__, held);
2154 }
2155 os_atomic_add(&arpstat.held, -held, relaxed);
2156 VERIFY(qempty(&llinfo->la_holdq));
2157 RT_UNLOCK(route);
2158 dlil_output(ifp, PF_INET, m0, (caddr_t)route,
2159 rt_key(route), 0, NULL);
2160 RT_REMREF(route);
2161 route = NULL;
2162 }
2163
2164 respond:
2165 if (route != NULL) {
2166 /* Mark use timestamp if we're going to send a reply */
2167 if (arpop == ARPOP_REQUEST && route->rt_llinfo != NULL) {
2168 arp_llreach_use(route->rt_llinfo);
2169 }
2170 RT_REMREF_LOCKED(route);
2171 RT_UNLOCK(route);
2172 route = NULL;
2173 }
2174
2175 if (arpop != ARPOP_REQUEST) {
2176 goto done;
2177 }
2178
2179 /* See comments at the beginning of this routine */
2180 arpstat.rxrequests++;
2181
2182 /* If we are not the target, check if we should proxy */
2183 if (target_ip->sin_addr.s_addr != best_ia_sin.sin_addr.s_addr) {
2184 /*
2185 * Find a proxy route; callee holds a reference on the
2186 * route and returns with the route entry locked, upon
2187 * success.
2188 */
2189 error = arp_lookup_route(&target_ip->sin_addr, 0, SIN_PROXY,
2190 &route, ifp->if_index);
2191
2192 if (error == 0) {
2193 RT_LOCK_ASSERT_HELD(route);
2194 /*
2195 * Return proxied ARP replies only on the interface
2196 * or bridge cluster where this network resides.
2197 * Otherwise we may conflict with the host we are
2198 * proxying for.
2199 */
2200 if (route->rt_ifp != ifp &&
2201 (route->rt_ifp->if_bridge != ifp->if_bridge ||
2202 ifp->if_bridge == NULL)) {
2203 RT_REMREF_LOCKED(route);
2204 RT_UNLOCK(route);
2205 goto done;
2206 }
2207 proxied = *SDL(route->rt_gateway);
2208 target_hw = &proxied;
2209 } else {
2210 /*
2211 * We don't have a route entry indicating we should
2212 * use proxy. If we aren't supposed to proxy all,
2213 * we are done.
2214 */
2215 if (!arp_proxyall) {
2216 goto done;
2217 }
2218
2219 /*
2220 * See if we have a route to the target ip before
2221 * we proxy it.
2222 */
2223 route = rtalloc1_scoped(__DECONST_SA(target_ip), 0, 0, ifp->if_index);
2224 if (!route) {
2225 goto done;
2226 }
2227
2228 /*
2229 * Don't proxy for hosts already on the same interface.
2230 */
2231 RT_LOCK(route);
2232 if (route->rt_ifp == ifp) {
2233 RT_UNLOCK(route);
2234 rtfree(route);
2235 goto done;
2236 }
2237 }
2238 /* Mark use timestamp */
2239 if (route->rt_llinfo != NULL) {
2240 arp_llreach_use(route->rt_llinfo);
2241 }
2242 RT_REMREF_LOCKED(route);
2243 RT_UNLOCK(route);
2244 }
2245
2246 dlil_send_arp(ifp, ARPOP_REPLY,
2247 target_hw, SA(target_ip),
2248 sender_hw, SA(sender_ip), 0);
2249
2250 done:
2251 if (best_ia != NULL) {
2252 ifa_remref(&best_ia->ia_ifa);
2253 }
2254 return 0;
2255 }
2256
2257 void
arp_ifinit(struct ifnet * ifp,struct ifaddr * ifa)2258 arp_ifinit(struct ifnet *ifp, struct ifaddr *ifa)
2259 {
2260 struct sockaddr *sa;
2261
2262 IFA_LOCK(ifa);
2263 ifa->ifa_rtrequest = arp_rtrequest;
2264 ifa->ifa_flags |= RTF_CLONING;
2265 sa = ifa->ifa_addr;
2266 IFA_UNLOCK(ifa);
2267 if ((ifp->if_flags & IFF_NOARP) == 0) {
2268 dlil_send_arp(ifp, ARPOP_REQUEST, NULL, sa, NULL, sa, 0);
2269 }
2270 }
2271
2272 static int
2273 arp_getstat SYSCTL_HANDLER_ARGS
2274 {
2275 #pragma unused(oidp, arg1, arg2)
2276 if (req->oldptr == USER_ADDR_NULL) {
2277 req->oldlen = (size_t)sizeof(struct arpstat);
2278 }
2279
2280 return SYSCTL_OUT(req, &arpstat, MIN(sizeof(arpstat), req->oldlen));
2281 }
2282