1 /*
2 * Copyright (c) 2000-2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 1982, 1986, 1988, 1990, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
61 */
62 /*
63 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
64 * support for mandatory and extensible security protections. This notice
65 * is included in support of clause 2.2 (b) of the Apple Public License,
66 * Version 2.0.
67 */
68
69 #define _IP_VHL
70
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/kernel.h>
74 #include <sys/malloc.h>
75 #include <sys/mbuf.h>
76 #include <sys/protosw.h>
77 #include <sys/socket.h>
78 #include <sys/socketvar.h>
79 #include <kern/locks.h>
80 #include <sys/sysctl.h>
81 #include <sys/mcache.h>
82 #include <sys/kdebug.h>
83
84 #include <machine/endian.h>
85 #include <pexpert/pexpert.h>
86 #include <mach/sdt.h>
87
88 #include <libkern/OSAtomic.h>
89 #include <libkern/OSByteOrder.h>
90
91 #include <net/if.h>
92 #include <net/if_dl.h>
93 #include <net/if_types.h>
94 #include <net/route.h>
95 #include <net/ntstat.h>
96 #include <net/net_osdep.h>
97 #include <net/dlil.h>
98 #include <net/net_perf.h>
99
100 #include <netinet/in.h>
101 #include <netinet/in_systm.h>
102 #include <netinet/ip.h>
103 #include <netinet/in_pcb.h>
104 #include <netinet/in_var.h>
105 #include <netinet/ip_var.h>
106 #include <netinet/kpi_ipfilter_var.h>
107 #include <netinet/in_tclass.h>
108 #include <netinet/udp.h>
109
110 #include <netinet6/nd6.h>
111
112 #define DBG_LAYER_BEG NETDBG_CODE(DBG_NETIP, 1)
113 #define DBG_LAYER_END NETDBG_CODE(DBG_NETIP, 3)
114 #define DBG_FNC_IP_OUTPUT NETDBG_CODE(DBG_NETIP, (1 << 8) | 1)
115 #define DBG_FNC_IPSEC4_OUTPUT NETDBG_CODE(DBG_NETIP, (2 << 8) | 1)
116
117 #if IPSEC
118 #include <netinet6/ipsec.h>
119 #include <netkey/key.h>
120 #if IPSEC_DEBUG
121 #include <netkey/key_debug.h>
122 #else
123 #define KEYDEBUG(lev, arg)
124 #endif
125 #endif /* IPSEC */
126
127 #if NECP
128 #include <net/necp.h>
129 #endif /* NECP */
130
131
132 #if DUMMYNET
133 #include <netinet/ip_dummynet.h>
134 #endif
135
136 #if PF
137 #include <net/pfvar.h>
138 #endif /* PF */
139
140
141 u_short ip_id;
142
143 static int sysctl_reset_ip_output_stats SYSCTL_HANDLER_ARGS;
144 static int sysctl_ip_output_measure_bins SYSCTL_HANDLER_ARGS;
145 static int sysctl_ip_output_getperf SYSCTL_HANDLER_ARGS;
146 static void ip_out_cksum_stats(int, u_int32_t);
147 static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *);
148 static int ip_optcopy(struct ip *, struct ip *);
149 static int ip_pcbopts(int, struct mbuf **, struct mbuf *);
150 static void imo_trace(struct ip_moptions *, int);
151 static void ip_mloopback(struct ifnet *, struct ifnet *, struct mbuf *,
152 struct sockaddr_in *, int);
153 static struct ifaddr *in_selectsrcif(struct ip *, struct route *, unsigned int);
154
155 extern struct ip_linklocal_stat ip_linklocal_stat;
156
157 /* temporary: for testing */
158 #if IPSEC
159 extern int ipsec_bypass;
160 #endif
161
162 static int ip_maxchainsent = 0;
163 SYSCTL_INT(_net_inet_ip, OID_AUTO, maxchainsent,
164 CTLFLAG_RW | CTLFLAG_LOCKED, &ip_maxchainsent, 0,
165 "use dlil_output_list");
166 #if DEBUG
167 static int forge_ce = 0;
168 SYSCTL_INT(_net_inet_ip, OID_AUTO, forge_ce,
169 CTLFLAG_RW | CTLFLAG_LOCKED, &forge_ce, 0,
170 "Forge ECN CE");
171 #endif /* DEBUG */
172
173 static int ip_select_srcif_debug = 0;
174 SYSCTL_INT(_net_inet_ip, OID_AUTO, select_srcif_debug,
175 CTLFLAG_RW | CTLFLAG_LOCKED, &ip_select_srcif_debug, 0,
176 "log source interface selection debug info");
177
178 static int ip_output_measure = 0;
179 SYSCTL_PROC(_net_inet_ip, OID_AUTO, output_perf,
180 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
181 &ip_output_measure, 0, sysctl_reset_ip_output_stats, "I",
182 "Do time measurement");
183
184 static uint64_t ip_output_measure_bins = 0;
185 SYSCTL_PROC(_net_inet_ip, OID_AUTO, output_perf_bins,
186 CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED, &ip_output_measure_bins, 0,
187 sysctl_ip_output_measure_bins, "I",
188 "bins for chaining performance data histogram");
189
190 static net_perf_t net_perf;
191 SYSCTL_PROC(_net_inet_ip, OID_AUTO, output_perf_data,
192 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
193 0, 0, sysctl_ip_output_getperf, "S,net_perf",
194 "IP output performance data (struct net_perf, net/net_perf.h)");
195
196 __private_extern__ int rfc6864 = 1;
197 SYSCTL_INT(_net_inet_ip, OID_AUTO, rfc6864, CTLFLAG_RW | CTLFLAG_LOCKED,
198 &rfc6864, 0, "updated ip id field behavior");
199
200 #define IMO_TRACE_HIST_SIZE 32 /* size of trace history */
201
202 /* For gdb */
203 __private_extern__ unsigned int imo_trace_hist_size = IMO_TRACE_HIST_SIZE;
204
205 struct ip_moptions_dbg {
206 struct ip_moptions imo; /* ip_moptions */
207 u_int16_t imo_refhold_cnt; /* # of IMO_ADDREF */
208 u_int16_t imo_refrele_cnt; /* # of IMO_REMREF */
209 /*
210 * Alloc and free callers.
211 */
212 ctrace_t imo_alloc;
213 ctrace_t imo_free;
214 /*
215 * Circular lists of IMO_ADDREF and IMO_REMREF callers.
216 */
217 ctrace_t imo_refhold[IMO_TRACE_HIST_SIZE];
218 ctrace_t imo_refrele[IMO_TRACE_HIST_SIZE];
219 };
220
221 #if DEBUG
222 static unsigned int imo_debug = 1; /* debugging (enabled) */
223 #else
224 static unsigned int imo_debug; /* debugging (disabled) */
225 #endif /* !DEBUG */
226
227 static struct zone *imo_zone; /* zone for ip_moptions */
228 #define IMO_ZONE_NAME "ip_moptions" /* zone name */
229
230 #if PF
231 __attribute__((noinline))
232 static int
ip_output_pf_dn_hook(struct ifnet * ifp,struct mbuf ** mppn,struct mbuf ** mp,struct pf_rule * dn_pf_rule,struct route * ro,struct sockaddr_in * dst,int flags,struct ip_out_args * ipoa)233 ip_output_pf_dn_hook(struct ifnet *ifp, struct mbuf **mppn, struct mbuf **mp,
234 struct pf_rule *dn_pf_rule, struct route *ro, struct sockaddr_in *dst, int flags,
235 struct ip_out_args *ipoa)
236 {
237 int rc;
238 struct ip_fw_args args = {};
239
240 args.fwa_pf_rule = dn_pf_rule;
241 args.fwa_oif = ifp;
242 args.fwa_ro = ro;
243 args.fwa_dst = dst;
244 args.fwa_oflags = flags;
245 if (flags & IP_OUTARGS) {
246 args.fwa_ipoa = ipoa;
247 }
248 rc = pf_af_hook(ifp, mppn, mp, AF_INET, FALSE, &args);
249
250 return rc;
251 }
252
253 #endif /* PF */
254
255
256 /*
257 * IP output. The packet in mbuf chain m contains a skeletal IP
258 * header (with len, off, ttl, proto, tos, src, dst).
259 * The mbuf chain containing the packet will be freed.
260 * The mbuf opt, if present, will not be freed.
261 */
262 int
ip_output(struct mbuf * m0,struct mbuf * opt,struct route * ro,int flags,struct ip_moptions * imo,struct ip_out_args * ipoa)263 ip_output(struct mbuf *m0, struct mbuf *opt, struct route *ro, int flags,
264 struct ip_moptions *imo, struct ip_out_args *ipoa)
265 {
266 return ip_output_list(m0, 0, opt, ro, flags, imo, ipoa);
267 }
268
269 /*
270 * IP output. The packet in mbuf chain m contains a skeletal IP
271 * header (with len, off, ttl, proto, tos, src, dst).
272 * The mbuf chain containing the packet will be freed.
273 * The mbuf opt, if present, will not be freed.
274 *
275 * Route ro MUST be non-NULL; if ro->ro_rt is valid, route lookup would be
276 * skipped and ro->ro_rt would be used. Otherwise the result of route
277 * lookup is stored in ro->ro_rt.
278 *
279 * In the IP forwarding case, the packet will arrive with options already
280 * inserted, so must have a NULL opt pointer.
281 */
282 int
ip_output_list(struct mbuf * m0,int packetchain,struct mbuf * opt,struct route * ro,int flags,struct ip_moptions * imo,struct ip_out_args * ipoa)283 ip_output_list(struct mbuf *m0, int packetchain, struct mbuf *opt,
284 struct route *ro, int flags, struct ip_moptions *imo,
285 struct ip_out_args *ipoa)
286 {
287 struct ip *ip;
288 struct ifnet *ifp = NULL; /* not refcnt'd */
289 struct mbuf *m = m0, *prevnxt = NULL, **mppn = &prevnxt;
290 int hlen = sizeof(struct ip);
291 int len = 0, error = 0;
292 struct sockaddr_in *dst = NULL;
293 struct in_ifaddr *ia = NULL, *src_ia = NULL;
294 struct in_addr pkt_dst;
295 struct ipf_pktopts *ippo = NULL;
296 ipfilter_t inject_filter_ref = NULL;
297 struct mbuf *packetlist;
298 uint32_t sw_csum, pktcnt = 0, scnt = 0, bytecnt = 0;
299 uint32_t packets_processed = 0;
300 unsigned int ifscope = IFSCOPE_NONE;
301 struct flowadv *adv = NULL;
302 struct timeval start_tv;
303 #if IPSEC
304 struct socket *so = NULL;
305 struct secpolicy *sp = NULL;
306 #endif /* IPSEC */
307 #if NECP
308 necp_kernel_policy_result necp_result = 0;
309 necp_kernel_policy_result_parameter necp_result_parameter;
310 necp_kernel_policy_id necp_matched_policy_id = 0;
311 #endif /* NECP */
312 #if DUMMYNET
313 struct m_tag *tag;
314 struct ip_out_args saved_ipoa;
315 struct sockaddr_in dst_buf;
316 #endif /* DUMMYNET */
317 struct {
318 #if IPSEC
319 struct ipsec_output_state ipsec_state;
320 #endif /* IPSEC */
321 #if NECP
322 struct route necp_route;
323 #endif /* NECP */
324 #if DUMMYNET
325 struct route saved_route;
326 #endif /* DUMMYNET */
327 struct ipf_pktopts ipf_pktopts;
328 } ipobz;
329 #define ipsec_state ipobz.ipsec_state
330 #define necp_route ipobz.necp_route
331 #define sro_fwd ipobz.sro_fwd
332 #define saved_route ipobz.saved_route
333 #define ipf_pktopts ipobz.ipf_pktopts
334 union {
335 struct {
336 boolean_t select_srcif : 1; /* set once */
337 boolean_t srcbound : 1; /* set once */
338 boolean_t nocell : 1; /* set once */
339 boolean_t isbroadcast : 1;
340 boolean_t didfilter : 1;
341 boolean_t noexpensive : 1; /* set once */
342 boolean_t noconstrained : 1; /* set once */
343 boolean_t awdl_unrestricted : 1; /* set once */
344 };
345 uint32_t raw;
346 } ipobf = { .raw = 0 };
347
348 int interface_mtu = 0;
349 struct pf_rule *dn_pf_rule = NULL;
350 /*
351 * Here we check for restrictions when sending frames.
352 * N.B.: IPv4 over internal co-processor interfaces is not allowed.
353 */
354 #define IP_CHECK_RESTRICTIONS(_ifp, _ipobf) \
355 (((_ipobf).nocell && IFNET_IS_CELLULAR(_ifp)) || \
356 ((_ipobf).noexpensive && IFNET_IS_EXPENSIVE(_ifp)) || \
357 ((_ipobf).noconstrained && IFNET_IS_CONSTRAINED(_ifp)) || \
358 (IFNET_IS_INTCOPROC(_ifp)) || \
359 (!(_ipobf).awdl_unrestricted && IFNET_IS_AWDL_RESTRICTED(_ifp)))
360
361 if (ip_output_measure) {
362 net_perf_start_time(&net_perf, &start_tv);
363 }
364 KERNEL_DEBUG(DBG_FNC_IP_OUTPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
365
366 VERIFY(m0->m_flags & M_PKTHDR);
367 packetlist = m0;
368
369 /* zero out {ipsec_state, args, sro_fwd, saved_route, ipf_pktops} */
370 bzero(&ipobz, sizeof(ipobz));
371 ippo = &ipf_pktopts;
372
373 #if DUMMYNET
374 if (SLIST_EMPTY(&m0->m_pkthdr.tags)) {
375 goto ipfw_tags_done;
376 }
377
378 /* Grab info from mtags prepended to the chain */
379 if ((tag = m_tag_locate(m0, KERNEL_MODULE_TAG_ID,
380 KERNEL_TAG_TYPE_DUMMYNET, NULL)) != NULL) {
381 struct dn_pkt_tag *dn_tag;
382
383 dn_tag = (struct dn_pkt_tag *)(tag + 1);
384 dn_pf_rule = dn_tag->dn_pf_rule;
385 opt = NULL;
386 saved_route = dn_tag->dn_ro;
387 ro = &saved_route;
388
389 imo = NULL;
390 bcopy(&dn_tag->dn_dst, &dst_buf, sizeof(dst_buf));
391 dst = &dst_buf;
392 ifp = dn_tag->dn_ifp;
393 flags = dn_tag->dn_flags;
394 if ((dn_tag->dn_flags & IP_OUTARGS)) {
395 saved_ipoa = dn_tag->dn_ipoa;
396 ipoa = &saved_ipoa;
397 }
398
399 m_tag_delete(m0, tag);
400 }
401 ipfw_tags_done:
402 #endif /* DUMMYNET */
403
404 m = m0;
405 m->m_pkthdr.pkt_flags &= ~(PKTF_LOOP | PKTF_IFAINFO);
406
407 #if IPSEC
408 if (ipsec_bypass == 0 && !(flags & IP_NOIPSEC)) {
409 /* If packet is bound to an interface, check bound policies */
410 if ((flags & IP_OUTARGS) && (ipoa != NULL) &&
411 (ipoa->ipoa_flags & IPOAF_BOUND_IF) &&
412 ipoa->ipoa_boundif != IFSCOPE_NONE) {
413 if (ipsec4_getpolicybyinterface(m, IPSEC_DIR_OUTBOUND,
414 &flags, ipoa, &sp) != 0) {
415 goto bad;
416 }
417 }
418 }
419 #endif /* IPSEC */
420
421 VERIFY(ro != NULL);
422
423 if (flags & IP_OUTARGS) {
424 /*
425 * In the forwarding case, only the ifscope value is used,
426 * as source interface selection doesn't take place.
427 */
428 if ((ipobf.select_srcif = (!(flags & IP_FORWARDING) &&
429 (ipoa->ipoa_flags & IPOAF_SELECT_SRCIF)))) {
430 ipf_pktopts.ippo_flags |= IPPOF_SELECT_SRCIF;
431 }
432
433 if ((ipoa->ipoa_flags & IPOAF_BOUND_IF) &&
434 ipoa->ipoa_boundif != IFSCOPE_NONE) {
435 ifscope = ipoa->ipoa_boundif;
436 ipf_pktopts.ippo_flags |=
437 (IPPOF_BOUND_IF | (ifscope << IPPOF_SHIFT_IFSCOPE));
438 }
439
440 /* double negation needed for bool bit field */
441 ipobf.srcbound = !!(ipoa->ipoa_flags & IPOAF_BOUND_SRCADDR);
442 if (ipobf.srcbound) {
443 ipf_pktopts.ippo_flags |= IPPOF_BOUND_SRCADDR;
444 }
445 } else {
446 ipobf.select_srcif = FALSE;
447 ipobf.srcbound = FALSE;
448 ifscope = IFSCOPE_NONE;
449 if (flags & IP_OUTARGS) {
450 ipoa->ipoa_boundif = IFSCOPE_NONE;
451 ipoa->ipoa_flags &= ~(IPOAF_SELECT_SRCIF |
452 IPOAF_BOUND_IF | IPOAF_BOUND_SRCADDR);
453 }
454 }
455
456 if (flags & IP_OUTARGS) {
457 if (ipoa->ipoa_flags & IPOAF_NO_CELLULAR) {
458 ipobf.nocell = TRUE;
459 ipf_pktopts.ippo_flags |= IPPOF_NO_IFT_CELLULAR;
460 }
461 if (ipoa->ipoa_flags & IPOAF_NO_EXPENSIVE) {
462 ipobf.noexpensive = TRUE;
463 ipf_pktopts.ippo_flags |= IPPOF_NO_IFF_EXPENSIVE;
464 }
465 if (ipoa->ipoa_flags & IPOAF_NO_CONSTRAINED) {
466 ipobf.noconstrained = TRUE;
467 ipf_pktopts.ippo_flags |= IPPOF_NO_IFF_CONSTRAINED;
468 }
469 if (ipoa->ipoa_flags & IPOAF_AWDL_UNRESTRICTED) {
470 ipobf.awdl_unrestricted = TRUE;
471 }
472 adv = &ipoa->ipoa_flowadv;
473 adv->code = FADV_SUCCESS;
474 ipoa->ipoa_flags &= ~IPOAF_RET_MASK;
475 }
476
477 #if IPSEC
478 if (ipsec_bypass == 0 && !(flags & IP_NOIPSEC)) {
479 so = ipsec_getsocket(m);
480 if (so != NULL) {
481 (void) ipsec_setsocket(m, NULL);
482 }
483 }
484 #endif /* IPSEC */
485
486 #if DUMMYNET
487 if (dn_pf_rule != NULL) {
488 /* dummynet already saw us */
489 ip = mtod(m, struct ip *);
490 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
491 pkt_dst = ip->ip_dst;
492 if (ro->ro_rt != NULL) {
493 RT_LOCK_SPIN(ro->ro_rt);
494 ia = (struct in_ifaddr *)ro->ro_rt->rt_ifa;
495 if (ia) {
496 /* Become a regular mutex */
497 RT_CONVERT_LOCK(ro->ro_rt);
498 IFA_ADDREF(&ia->ia_ifa);
499 }
500 RT_UNLOCK(ro->ro_rt);
501 }
502
503 goto sendit;
504 }
505 #endif /* DUMMYNET */
506
507 loopit:
508 packets_processed++;
509 ipobf.isbroadcast = FALSE;
510 ipobf.didfilter = FALSE;
511
512 VERIFY(m->m_flags & M_PKTHDR);
513 /*
514 * No need to proccess packet twice if we've already seen it.
515 */
516 if (!SLIST_EMPTY(&m->m_pkthdr.tags)) {
517 inject_filter_ref = ipf_get_inject_filter(m);
518 } else {
519 inject_filter_ref = NULL;
520 }
521
522 if (opt) {
523 m = ip_insertoptions(m, opt, &len);
524 hlen = len;
525 /* Update the chain */
526 if (m != m0) {
527 if (m0 == packetlist) {
528 packetlist = m;
529 }
530 m0 = m;
531 }
532 }
533 ip = mtod(m, struct ip *);
534
535 pkt_dst = ip->ip_dst;
536
537 /*
538 * We must not send if the packet is destined to network zero.
539 * RFC1122 3.2.1.3 (a) and (b).
540 */
541 if (IN_ZERONET(ntohl(pkt_dst.s_addr))) {
542 error = EHOSTUNREACH;
543 goto bad;
544 }
545
546 /*
547 * Fill in IP header.
548 */
549 if (!(flags & (IP_FORWARDING | IP_RAWOUTPUT))) {
550 ip->ip_vhl = IP_MAKE_VHL(IPVERSION, hlen >> 2);
551 ip->ip_off &= IP_DF;
552 if (rfc6864 && IP_OFF_IS_ATOMIC(ip->ip_off)) {
553 // Per RFC6864, value of ip_id is undefined for atomic ip packets
554 ip->ip_id = 0;
555 } else {
556 ip->ip_id = ip_randomid((uint64_t)m);
557 }
558 OSAddAtomic(1, &ipstat.ips_localout);
559 } else {
560 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
561 }
562
563 #if DEBUG
564 /* For debugging, we let the stack forge congestion */
565 if (forge_ce != 0 &&
566 ((ip->ip_tos & IPTOS_ECN_MASK) == IPTOS_ECN_ECT1 ||
567 (ip->ip_tos & IPTOS_ECN_MASK) == IPTOS_ECN_ECT0)) {
568 ip->ip_tos = (ip->ip_tos & ~IPTOS_ECN_MASK) | IPTOS_ECN_CE;
569 forge_ce--;
570 }
571 #endif /* DEBUG */
572
573 KERNEL_DEBUG(DBG_LAYER_BEG, ip->ip_dst.s_addr, ip->ip_src.s_addr,
574 ip->ip_p, ip->ip_off, ip->ip_len);
575
576 dst = SIN(&ro->ro_dst);
577
578 /*
579 * If there is a cached route,
580 * check that it is to the same destination
581 * and is still up. If not, free it and try again.
582 * The address family should also be checked in case of sharing the
583 * cache with IPv6.
584 */
585
586 if (ro->ro_rt != NULL) {
587 if (ROUTE_UNUSABLE(ro) && ip->ip_src.s_addr != INADDR_ANY &&
588 !(flags & (IP_ROUTETOIF | IP_FORWARDING))) {
589 src_ia = ifa_foraddr(ip->ip_src.s_addr);
590 if (src_ia == NULL) {
591 error = EADDRNOTAVAIL;
592 goto bad;
593 }
594 IFA_REMREF(&src_ia->ia_ifa);
595 src_ia = NULL;
596 }
597 /*
598 * Test rt_flags without holding rt_lock for performance
599 * reasons; if the route is down it will hopefully be
600 * caught by the layer below (since it uses this route
601 * as a hint) or during the next transmit.
602 */
603 if (ROUTE_UNUSABLE(ro) || dst->sin_family != AF_INET ||
604 dst->sin_addr.s_addr != pkt_dst.s_addr) {
605 ROUTE_RELEASE(ro);
606 }
607
608 /*
609 * If we're doing source interface selection, we may not
610 * want to use this route; only synch up the generation
611 * count otherwise.
612 */
613 if (!ipobf.select_srcif && ro->ro_rt != NULL &&
614 RT_GENID_OUTOFSYNC(ro->ro_rt)) {
615 RT_GENID_SYNC(ro->ro_rt);
616 }
617 }
618 if (ro->ro_rt == NULL) {
619 bzero(dst, sizeof(*dst));
620 dst->sin_family = AF_INET;
621 dst->sin_len = sizeof(*dst);
622 dst->sin_addr = pkt_dst;
623 }
624 /*
625 * If routing to interface only,
626 * short circuit routing lookup.
627 */
628 if (flags & IP_ROUTETOIF) {
629 if (ia != NULL) {
630 IFA_REMREF(&ia->ia_ifa);
631 }
632 if ((ia = ifatoia(ifa_ifwithdstaddr(sintosa(dst)))) == NULL) {
633 ia = ifatoia(ifa_ifwithnet(sintosa(dst)));
634 if (ia == NULL) {
635 OSAddAtomic(1, &ipstat.ips_noroute);
636 error = ENETUNREACH;
637 /* XXX IPv6 APN fallback notification?? */
638 goto bad;
639 }
640 }
641 ifp = ia->ia_ifp;
642 ip->ip_ttl = 1;
643 ipobf.isbroadcast = in_broadcast(dst->sin_addr, ifp);
644 /*
645 * For consistency with other cases below. Loopback
646 * multicast case is handled separately by ip_mloopback().
647 */
648 if ((ifp->if_flags & IFF_LOOPBACK) &&
649 !IN_MULTICAST(ntohl(pkt_dst.s_addr))) {
650 m->m_pkthdr.rcvif = ifp;
651 ip_setsrcifaddr_info(m, ifp->if_index, NULL);
652 ip_setdstifaddr_info(m, ifp->if_index, NULL);
653 }
654 } else if (IN_MULTICAST(ntohl(pkt_dst.s_addr)) &&
655 imo != NULL && (ifp = imo->imo_multicast_ifp) != NULL) {
656 /*
657 * Bypass the normal routing lookup for multicast
658 * packets if the interface is specified.
659 */
660 ipobf.isbroadcast = FALSE;
661 if (ia != NULL) {
662 IFA_REMREF(&ia->ia_ifa);
663 }
664
665 /* Macro takes reference on ia */
666 IFP_TO_IA(ifp, ia);
667 } else {
668 struct ifaddr *ia0 = NULL;
669 boolean_t cloneok = FALSE;
670 /*
671 * Perform source interface selection; the source IP address
672 * must belong to one of the addresses of the interface used
673 * by the route. For performance reasons, do this only if
674 * there is no route, or if the routing table has changed,
675 * or if we haven't done source interface selection on this
676 * route (for this PCB instance) before.
677 */
678 if (ipobf.select_srcif &&
679 ip->ip_src.s_addr != INADDR_ANY && (ROUTE_UNUSABLE(ro) ||
680 !(ro->ro_flags & ROF_SRCIF_SELECTED))) {
681 /* Find the source interface */
682 ia0 = in_selectsrcif(ip, ro, ifscope);
683
684 /*
685 * If the source address belongs to a restricted
686 * interface and the caller forbids our using
687 * interfaces of such type, pretend that there is no
688 * route.
689 */
690 if (ia0 != NULL &&
691 IP_CHECK_RESTRICTIONS(ia0->ifa_ifp, ipobf)) {
692 IFA_REMREF(ia0);
693 ia0 = NULL;
694 error = EHOSTUNREACH;
695 if (flags & IP_OUTARGS) {
696 ipoa->ipoa_flags |= IPOAF_R_IFDENIED;
697 }
698 goto bad;
699 }
700
701 /*
702 * If the source address is spoofed (in the case of
703 * IP_RAWOUTPUT on an unbounded socket), or if this
704 * is destined for local/loopback, just let it go out
705 * using the interface of the route. Otherwise,
706 * there's no interface having such an address,
707 * so bail out.
708 */
709 if (ia0 == NULL && (!(flags & IP_RAWOUTPUT) ||
710 ipobf.srcbound) && ifscope != lo_ifp->if_index) {
711 error = EADDRNOTAVAIL;
712 goto bad;
713 }
714
715 /*
716 * If the caller didn't explicitly specify the scope,
717 * pick it up from the source interface. If the cached
718 * route was wrong and was blown away as part of source
719 * interface selection, don't mask out RTF_PRCLONING
720 * since that route may have been allocated by the ULP,
721 * unless the IP header was created by the caller or
722 * the destination is IPv4 LLA. The check for the
723 * latter is needed because IPv4 LLAs are never scoped
724 * in the current implementation, and we don't want to
725 * replace the resolved IPv4 LLA route with one whose
726 * gateway points to that of the default gateway on
727 * the primary interface of the system.
728 */
729 if (ia0 != NULL) {
730 if (ifscope == IFSCOPE_NONE) {
731 ifscope = ia0->ifa_ifp->if_index;
732 }
733 cloneok = (!(flags & IP_RAWOUTPUT) &&
734 !(IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr))));
735 }
736 }
737
738 /*
739 * If this is the case, we probably don't want to allocate
740 * a protocol-cloned route since we didn't get one from the
741 * ULP. This lets TCP do its thing, while not burdening
742 * forwarding or ICMP with the overhead of cloning a route.
743 * Of course, we still want to do any cloning requested by
744 * the link layer, as this is probably required in all cases
745 * for correct operation (as it is for ARP).
746 */
747 if (ro->ro_rt == NULL) {
748 uint32_t ign = RTF_PRCLONING;
749 /*
750 * We make an exception here: if the destination
751 * address is INADDR_BROADCAST, allocate a protocol-
752 * cloned host route so that we end up with a route
753 * marked with the RTF_BROADCAST flag. Otherwise,
754 * we would end up referring to the default route,
755 * instead of creating a cloned host route entry.
756 * That would introduce inconsistencies between ULPs
757 * that allocate a route and those that don't. The
758 * RTF_BROADCAST route is important since we'd want
759 * to send out undirected IP broadcast packets using
760 * link-level broadcast address. Another exception
761 * is for ULP-created routes that got blown away by
762 * source interface selection (see above).
763 *
764 * These exceptions will no longer be necessary when
765 * the RTF_PRCLONING scheme is no longer present.
766 */
767 if (cloneok || dst->sin_addr.s_addr == INADDR_BROADCAST) {
768 ign &= ~RTF_PRCLONING;
769 }
770
771 /*
772 * Loosen the route lookup criteria if the ifscope
773 * corresponds to the loopback interface; this is
774 * needed to support Application Layer Gateways
775 * listening on loopback, in conjunction with packet
776 * filter redirection rules. The final source IP
777 * address will be rewritten by the packet filter
778 * prior to the RFC1122 loopback check below.
779 */
780 if (ifscope == lo_ifp->if_index) {
781 rtalloc_ign(ro, ign);
782 } else {
783 rtalloc_scoped_ign(ro, ign, ifscope);
784 }
785
786 /*
787 * If the route points to a cellular/expensive interface
788 * and the caller forbids our using interfaces of such type,
789 * pretend that there is no route.
790 */
791 if (ro->ro_rt != NULL) {
792 RT_LOCK_SPIN(ro->ro_rt);
793 if (IP_CHECK_RESTRICTIONS(ro->ro_rt->rt_ifp,
794 ipobf)) {
795 RT_UNLOCK(ro->ro_rt);
796 ROUTE_RELEASE(ro);
797 if (flags & IP_OUTARGS) {
798 ipoa->ipoa_flags |=
799 IPOAF_R_IFDENIED;
800 }
801 } else {
802 RT_UNLOCK(ro->ro_rt);
803 }
804 }
805 }
806
807 if (ro->ro_rt == NULL) {
808 OSAddAtomic(1, &ipstat.ips_noroute);
809 error = EHOSTUNREACH;
810 if (ia0 != NULL) {
811 IFA_REMREF(ia0);
812 ia0 = NULL;
813 }
814 goto bad;
815 }
816
817 if (ia != NULL) {
818 IFA_REMREF(&ia->ia_ifa);
819 }
820 RT_LOCK_SPIN(ro->ro_rt);
821 ia = ifatoia(ro->ro_rt->rt_ifa);
822 if (ia != NULL) {
823 /* Become a regular mutex */
824 RT_CONVERT_LOCK(ro->ro_rt);
825 IFA_ADDREF(&ia->ia_ifa);
826 }
827 /*
828 * Note: ia_ifp may not be the same as rt_ifp; the latter
829 * is what we use for determining outbound i/f, mtu, etc.
830 */
831 ifp = ro->ro_rt->rt_ifp;
832 ro->ro_rt->rt_use++;
833 if (ro->ro_rt->rt_flags & RTF_GATEWAY) {
834 dst = SIN(ro->ro_rt->rt_gateway);
835 }
836 if (ro->ro_rt->rt_flags & RTF_HOST) {
837 /* double negation needed for bool bit field */
838 ipobf.isbroadcast =
839 !!(ro->ro_rt->rt_flags & RTF_BROADCAST);
840 } else {
841 /* Become a regular mutex */
842 RT_CONVERT_LOCK(ro->ro_rt);
843 ipobf.isbroadcast = in_broadcast(dst->sin_addr, ifp);
844 }
845 /*
846 * For consistency with IPv6, as well as to ensure that
847 * IP_RECVIF is set correctly for packets that are sent
848 * to one of the local addresses. ia (rt_ifa) would have
849 * been fixed up by rt_setif for local routes. This
850 * would make it appear as if the packet arrives on the
851 * interface which owns the local address. Loopback
852 * multicast case is handled separately by ip_mloopback().
853 */
854 if (ia != NULL && (ifp->if_flags & IFF_LOOPBACK) &&
855 !IN_MULTICAST(ntohl(pkt_dst.s_addr))) {
856 uint16_t srcidx;
857
858 m->m_pkthdr.rcvif = ia->ia_ifa.ifa_ifp;
859
860 if (ia0 != NULL) {
861 srcidx = ia0->ifa_ifp->if_index;
862 } else if ((ro->ro_flags & ROF_SRCIF_SELECTED) &&
863 ro->ro_srcia != NULL) {
864 srcidx = ro->ro_srcia->ifa_ifp->if_index;
865 } else {
866 srcidx = 0;
867 }
868
869 ip_setsrcifaddr_info(m, srcidx, NULL);
870 ip_setdstifaddr_info(m, 0, ia);
871 }
872 RT_UNLOCK(ro->ro_rt);
873 if (ia0 != NULL) {
874 IFA_REMREF(ia0);
875 ia0 = NULL;
876 }
877 }
878
879 if (IN_MULTICAST(ntohl(pkt_dst.s_addr))) {
880 struct ifnet *srcifp = NULL;
881 struct in_multi *inm;
882 u_int32_t vif = 0;
883 u_int8_t ttl = IP_DEFAULT_MULTICAST_TTL;
884 u_int8_t loop = IP_DEFAULT_MULTICAST_LOOP;
885
886 m->m_flags |= M_MCAST;
887 /*
888 * IP destination address is multicast. Make sure "dst"
889 * still points to the address in "ro". (It may have been
890 * changed to point to a gateway address, above.)
891 */
892 dst = SIN(&ro->ro_dst);
893 /*
894 * See if the caller provided any multicast options
895 */
896 if (imo != NULL) {
897 IMO_LOCK(imo);
898 vif = imo->imo_multicast_vif;
899 ttl = imo->imo_multicast_ttl;
900 loop = imo->imo_multicast_loop;
901 if (!(flags & IP_RAWOUTPUT)) {
902 ip->ip_ttl = ttl;
903 }
904 if (imo->imo_multicast_ifp != NULL) {
905 ifp = imo->imo_multicast_ifp;
906 }
907 IMO_UNLOCK(imo);
908 } else if (!(flags & IP_RAWOUTPUT)) {
909 vif = -1;
910 ip->ip_ttl = ttl;
911 }
912 /*
913 * Confirm that the outgoing interface supports multicast.
914 */
915 if (imo == NULL || vif == -1) {
916 if (!(ifp->if_flags & IFF_MULTICAST)) {
917 OSAddAtomic(1, &ipstat.ips_noroute);
918 error = ENETUNREACH;
919 goto bad;
920 }
921 }
922 /*
923 * If source address not specified yet, use address
924 * of outgoing interface.
925 */
926 if (ip->ip_src.s_addr == INADDR_ANY) {
927 struct in_ifaddr *ia1;
928 lck_rw_lock_shared(&in_ifaddr_rwlock);
929 TAILQ_FOREACH(ia1, &in_ifaddrhead, ia_link) {
930 IFA_LOCK_SPIN(&ia1->ia_ifa);
931 if (ia1->ia_ifp == ifp) {
932 ip->ip_src = IA_SIN(ia1)->sin_addr;
933 srcifp = ifp;
934 IFA_UNLOCK(&ia1->ia_ifa);
935 break;
936 }
937 IFA_UNLOCK(&ia1->ia_ifa);
938 }
939 lck_rw_done(&in_ifaddr_rwlock);
940 if (ip->ip_src.s_addr == INADDR_ANY) {
941 error = ENETUNREACH;
942 goto bad;
943 }
944 }
945
946 in_multihead_lock_shared();
947 IN_LOOKUP_MULTI(&pkt_dst, ifp, inm);
948 in_multihead_lock_done();
949 if (inm != NULL && (imo == NULL || loop)) {
950 /*
951 * If we belong to the destination multicast group
952 * on the outgoing interface, and the caller did not
953 * forbid loopback, loop back a copy.
954 */
955 if (!TAILQ_EMPTY(&ipv4_filters)
956 #if NECP
957 && !necp_packet_should_skip_filters(m)
958 #endif // NECP
959 ) {
960 struct ipfilter *filter;
961 int seen = (inject_filter_ref == NULL);
962
963 if (imo != NULL) {
964 ipf_pktopts.ippo_flags |=
965 IPPOF_MCAST_OPTS;
966 ipf_pktopts.ippo_mcast_ifnet = ifp;
967 ipf_pktopts.ippo_mcast_ttl = ttl;
968 ipf_pktopts.ippo_mcast_loop = loop;
969 }
970
971 ipf_ref();
972
973 /*
974 * 4135317 - always pass network byte
975 * order to filter
976 */
977 #if BYTE_ORDER != BIG_ENDIAN
978 HTONS(ip->ip_len);
979 HTONS(ip->ip_off);
980 #endif
981 TAILQ_FOREACH(filter, &ipv4_filters, ipf_link) {
982 if (seen == 0) {
983 if ((struct ipfilter *)
984 inject_filter_ref == filter) {
985 seen = 1;
986 }
987 } else if (filter->ipf_filter.
988 ipf_output != NULL) {
989 errno_t result;
990 result = filter->ipf_filter.
991 ipf_output(filter->
992 ipf_filter.cookie,
993 (mbuf_t *)&m, ippo);
994 if (result == EJUSTRETURN) {
995 ipf_unref();
996 INM_REMREF(inm);
997 goto done;
998 }
999 if (result != 0) {
1000 ipf_unref();
1001 INM_REMREF(inm);
1002 goto bad;
1003 }
1004 }
1005 }
1006
1007 /* set back to host byte order */
1008 ip = mtod(m, struct ip *);
1009 #if BYTE_ORDER != BIG_ENDIAN
1010 NTOHS(ip->ip_len);
1011 NTOHS(ip->ip_off);
1012 #endif
1013 ipf_unref();
1014 ipobf.didfilter = TRUE;
1015 }
1016 ip_mloopback(srcifp, ifp, m, dst, hlen);
1017 }
1018 if (inm != NULL) {
1019 INM_REMREF(inm);
1020 }
1021 /*
1022 * Multicasts with a time-to-live of zero may be looped-
1023 * back, above, but must not be transmitted on a network.
1024 * Also, multicasts addressed to the loopback interface
1025 * are not sent -- the above call to ip_mloopback() will
1026 * loop back a copy if this host actually belongs to the
1027 * destination group on the loopback interface.
1028 */
1029 if (ip->ip_ttl == 0 || ifp->if_flags & IFF_LOOPBACK) {
1030 m_freem(m);
1031 goto done;
1032 }
1033
1034 goto sendit;
1035 }
1036 /*
1037 * If source address not specified yet, use address
1038 * of outgoing interface.
1039 */
1040 if (ip->ip_src.s_addr == INADDR_ANY) {
1041 IFA_LOCK_SPIN(&ia->ia_ifa);
1042 ip->ip_src = IA_SIN(ia)->sin_addr;
1043 IFA_UNLOCK(&ia->ia_ifa);
1044 }
1045
1046 /*
1047 * Look for broadcast address and
1048 * and verify user is allowed to send
1049 * such a packet.
1050 */
1051 if (ipobf.isbroadcast) {
1052 if (!(ifp->if_flags & IFF_BROADCAST)) {
1053 error = EADDRNOTAVAIL;
1054 goto bad;
1055 }
1056 if (!(flags & IP_ALLOWBROADCAST)) {
1057 error = EACCES;
1058 goto bad;
1059 }
1060 /* don't allow broadcast messages to be fragmented */
1061 if ((u_short)ip->ip_len > ifp->if_mtu) {
1062 error = EMSGSIZE;
1063 goto bad;
1064 }
1065 m->m_flags |= M_BCAST;
1066 } else {
1067 m->m_flags &= ~M_BCAST;
1068 }
1069
1070 sendit:
1071 #if PF
1072 /* Invoke outbound packet filter */
1073 if (PF_IS_ENABLED) {
1074 int rc;
1075
1076 m0 = m; /* Save for later */
1077 #if DUMMYNET
1078 rc = ip_output_pf_dn_hook(ifp, mppn, &m, dn_pf_rule, ro, dst, flags, ipoa);
1079 #else /* DUMMYNET */
1080 rc = pf_af_hook(ifp, mppn, &m, AF_INET, FALSE, NULL);
1081 #endif /* DUMMYNET */
1082 if (rc != 0 || m == NULL) {
1083 /* Move to the next packet */
1084 m = *mppn;
1085
1086 /* Skip ahead if first packet in list got dropped */
1087 if (packetlist == m0) {
1088 packetlist = m;
1089 }
1090
1091 if (m != NULL) {
1092 m0 = m;
1093 /* Next packet in the chain */
1094 goto loopit;
1095 } else if (packetlist != NULL) {
1096 /* No more packet; send down the chain */
1097 goto sendchain;
1098 }
1099 /* Nothing left; we're done */
1100 goto done;
1101 }
1102 m0 = m;
1103 ip = mtod(m, struct ip *);
1104 pkt_dst = ip->ip_dst;
1105 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1106 }
1107 #endif /* PF */
1108 /*
1109 * Force IP TTL to 255 following draft-ietf-zeroconf-ipv4-linklocal.txt
1110 */
1111 if (IN_LINKLOCAL(ntohl(ip->ip_src.s_addr)) ||
1112 IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr))) {
1113 ip_linklocal_stat.iplls_out_total++;
1114 if (ip->ip_ttl != MAXTTL) {
1115 ip_linklocal_stat.iplls_out_badttl++;
1116 ip->ip_ttl = MAXTTL;
1117 }
1118 }
1119
1120 if (!ipobf.didfilter &&
1121 !TAILQ_EMPTY(&ipv4_filters)
1122 #if NECP
1123 && !necp_packet_should_skip_filters(m)
1124 #endif // NECP
1125 ) {
1126 struct ipfilter *filter;
1127 int seen = (inject_filter_ref == NULL);
1128 ipf_pktopts.ippo_flags &= ~IPPOF_MCAST_OPTS;
1129
1130 /*
1131 * Check that a TSO frame isn't passed to a filter.
1132 * This could happen if a filter is inserted while
1133 * TCP is sending the TSO packet.
1134 */
1135 if (m->m_pkthdr.csum_flags & CSUM_TSO_IPV4) {
1136 error = EMSGSIZE;
1137 goto bad;
1138 }
1139
1140 ipf_ref();
1141
1142 /* 4135317 - always pass network byte order to filter */
1143 #if BYTE_ORDER != BIG_ENDIAN
1144 HTONS(ip->ip_len);
1145 HTONS(ip->ip_off);
1146 #endif
1147 TAILQ_FOREACH(filter, &ipv4_filters, ipf_link) {
1148 if (seen == 0) {
1149 if ((struct ipfilter *)inject_filter_ref ==
1150 filter) {
1151 seen = 1;
1152 }
1153 } else if (filter->ipf_filter.ipf_output) {
1154 errno_t result;
1155 result = filter->ipf_filter.
1156 ipf_output(filter->ipf_filter.cookie,
1157 (mbuf_t *)&m, ippo);
1158 if (result == EJUSTRETURN) {
1159 ipf_unref();
1160 goto done;
1161 }
1162 if (result != 0) {
1163 ipf_unref();
1164 goto bad;
1165 }
1166 }
1167 }
1168 /* set back to host byte order */
1169 ip = mtod(m, struct ip *);
1170 #if BYTE_ORDER != BIG_ENDIAN
1171 NTOHS(ip->ip_len);
1172 NTOHS(ip->ip_off);
1173 #endif
1174 ipf_unref();
1175 }
1176
1177 #if NECP
1178 /* Process Network Extension Policy. Will Pass, Drop, or Rebind packet. */
1179 necp_matched_policy_id = necp_ip_output_find_policy_match(m,
1180 flags, (flags & IP_OUTARGS) ? ipoa : NULL, ro ? ro->ro_rt : NULL, &necp_result, &necp_result_parameter);
1181 if (necp_matched_policy_id) {
1182 necp_mark_packet_from_ip(m, necp_matched_policy_id);
1183 switch (necp_result) {
1184 case NECP_KERNEL_POLICY_RESULT_PASS:
1185 if (necp_result_parameter.pass_flags & NECP_KERNEL_POLICY_PASS_NO_SKIP_IPSEC) {
1186 break;
1187 }
1188 /* Check if the interface is allowed */
1189 if (!necp_packet_is_allowed_over_interface(m, ifp)) {
1190 error = EHOSTUNREACH;
1191 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1192 goto bad;
1193 }
1194 goto skip_ipsec;
1195 case NECP_KERNEL_POLICY_RESULT_DROP:
1196 case NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT:
1197 /* Flow divert packets should be blocked at the IP layer */
1198 error = EHOSTUNREACH;
1199 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1200 goto bad;
1201 case NECP_KERNEL_POLICY_RESULT_IP_TUNNEL: {
1202 /* Verify that the packet is being routed to the tunnel */
1203 struct ifnet *policy_ifp = necp_get_ifnet_from_result_parameter(&necp_result_parameter);
1204 if (policy_ifp == ifp) {
1205 /* Check if the interface is allowed */
1206 if (!necp_packet_is_allowed_over_interface(m, ifp)) {
1207 error = EHOSTUNREACH;
1208 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1209 goto bad;
1210 }
1211 goto skip_ipsec;
1212 } else {
1213 if (necp_packet_can_rebind_to_ifnet(m, policy_ifp, &necp_route, AF_INET)) {
1214 /* Check if the interface is allowed */
1215 if (!necp_packet_is_allowed_over_interface(m, policy_ifp)) {
1216 error = EHOSTUNREACH;
1217 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1218 goto bad;
1219 }
1220
1221 /*
1222 * Update the QOS marking policy if
1223 * 1. up layer asks it to do so
1224 * 2. net_qos_policy_restricted is not set
1225 * 3. qos_marking_gencount doesn't match necp_kernel_socket_policies_gencount (checked in necp_lookup_current_qos_marking)
1226 */
1227 if (ipoa != NULL &&
1228 (ipoa->ipoa_flags & IPOAF_REDO_QOSMARKING_POLICY) &&
1229 net_qos_policy_restricted != 0) {
1230 bool qos_marking = (ipoa->ipoa_flags & IPOAF_QOSMARKING_ALLOWED) ? TRUE : FALSE;
1231 qos_marking = necp_lookup_current_qos_marking(&ipoa->qos_marking_gencount, NULL, policy_ifp, necp_result_parameter.route_rule_id, qos_marking);
1232 if (qos_marking) {
1233 ipoa->ipoa_flags |= IPOAF_QOSMARKING_ALLOWED;
1234 } else {
1235 ipoa->ipoa_flags &= ~IPOAF_QOSMARKING_ALLOWED;
1236 }
1237 }
1238
1239 /* Set ifp to the tunnel interface, since it is compatible with the packet */
1240 ifp = policy_ifp;
1241 ro = &necp_route;
1242 goto skip_ipsec;
1243 } else {
1244 error = ENETUNREACH;
1245 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1246 goto bad;
1247 }
1248 }
1249 }
1250 default:
1251 break;
1252 }
1253 }
1254 /* Catch-all to check if the interface is allowed */
1255 if (!necp_packet_is_allowed_over_interface(m, ifp)) {
1256 error = EHOSTUNREACH;
1257 OSAddAtomic(1, &ipstat.ips_necp_policy_drop);
1258 goto bad;
1259 }
1260 #endif /* NECP */
1261
1262 #if IPSEC
1263 if (ipsec_bypass != 0 || (flags & IP_NOIPSEC)) {
1264 goto skip_ipsec;
1265 }
1266
1267 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_START, 0, 0, 0, 0, 0);
1268
1269 if (sp == NULL) {
1270 /* get SP for this packet */
1271 if (so != NULL) {
1272 sp = ipsec4_getpolicybysock(m, IPSEC_DIR_OUTBOUND,
1273 so, &error);
1274 } else {
1275 sp = ipsec4_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND,
1276 flags, &error);
1277 }
1278 if (sp == NULL) {
1279 IPSEC_STAT_INCREMENT(ipsecstat.out_inval);
1280 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1281 0, 0, 0, 0, 0);
1282 goto bad;
1283 }
1284 }
1285
1286 error = 0;
1287
1288 /* check policy */
1289 switch (sp->policy) {
1290 case IPSEC_POLICY_DISCARD:
1291 case IPSEC_POLICY_GENERATE:
1292 /*
1293 * This packet is just discarded.
1294 */
1295 IPSEC_STAT_INCREMENT(ipsecstat.out_polvio);
1296 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1297 1, 0, 0, 0, 0);
1298 goto bad;
1299
1300 case IPSEC_POLICY_BYPASS:
1301 case IPSEC_POLICY_NONE:
1302 /* no need to do IPsec. */
1303 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1304 2, 0, 0, 0, 0);
1305 goto skip_ipsec;
1306
1307 case IPSEC_POLICY_IPSEC:
1308 if (sp->req == NULL) {
1309 /* acquire a policy */
1310 error = key_spdacquire(sp);
1311 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1312 3, 0, 0, 0, 0);
1313 goto bad;
1314 }
1315 if (sp->ipsec_if) {
1316 /* Verify the redirect to ipsec interface */
1317 if (sp->ipsec_if == ifp) {
1318 goto skip_ipsec;
1319 }
1320 goto bad;
1321 }
1322 break;
1323
1324 case IPSEC_POLICY_ENTRUST:
1325 default:
1326 printf("ip_output: Invalid policy found. %d\n", sp->policy);
1327 }
1328 {
1329 ipsec_state.m = m;
1330 if (flags & IP_ROUTETOIF) {
1331 bzero(&ipsec_state.ro, sizeof(ipsec_state.ro));
1332 } else {
1333 route_copyout((struct route *)&ipsec_state.ro, ro, sizeof(struct route));
1334 }
1335 ipsec_state.dst = SA(dst);
1336
1337 ip->ip_sum = 0;
1338
1339 /*
1340 * XXX
1341 * delayed checksums are not currently compatible with IPsec
1342 */
1343 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
1344 in_delayed_cksum(m);
1345 }
1346
1347 #if BYTE_ORDER != BIG_ENDIAN
1348 HTONS(ip->ip_len);
1349 HTONS(ip->ip_off);
1350 #endif
1351
1352 DTRACE_IP6(send, struct mbuf *, m, struct inpcb *, NULL,
1353 struct ip *, ip, struct ifnet *, ifp,
1354 struct ip *, ip, struct ip6_hdr *, NULL);
1355
1356 error = ipsec4_output(&ipsec_state, sp, flags);
1357 if (ipsec_state.tunneled == 6) {
1358 m0 = m = NULL;
1359 error = 0;
1360 goto bad;
1361 }
1362
1363 m0 = m = ipsec_state.m;
1364
1365 #if DUMMYNET
1366 /*
1367 * If we're about to use the route in ipsec_state
1368 * and this came from dummynet, cleaup now.
1369 */
1370 if (ro == &saved_route &&
1371 (!(flags & IP_ROUTETOIF) || ipsec_state.tunneled)) {
1372 ROUTE_RELEASE(ro);
1373 }
1374 #endif /* DUMMYNET */
1375
1376 if (flags & IP_ROUTETOIF) {
1377 /*
1378 * if we have tunnel mode SA, we may need to ignore
1379 * IP_ROUTETOIF.
1380 */
1381 if (ipsec_state.tunneled) {
1382 flags &= ~IP_ROUTETOIF;
1383 ro = (struct route *)&ipsec_state.ro;
1384 }
1385 } else {
1386 ro = (struct route *)&ipsec_state.ro;
1387 }
1388 dst = SIN(ipsec_state.dst);
1389 if (error) {
1390 /* mbuf is already reclaimed in ipsec4_output. */
1391 m0 = NULL;
1392 switch (error) {
1393 case EHOSTUNREACH:
1394 case ENETUNREACH:
1395 case EMSGSIZE:
1396 case ENOBUFS:
1397 case ENOMEM:
1398 break;
1399 default:
1400 printf("ip4_output (ipsec): error code %d\n", error);
1401 OS_FALLTHROUGH;
1402 case ENOENT:
1403 /* don't show these error codes to the user */
1404 error = 0;
1405 break;
1406 }
1407 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1408 4, 0, 0, 0, 0);
1409 goto bad;
1410 }
1411 }
1412
1413 /* be sure to update variables that are affected by ipsec4_output() */
1414 ip = mtod(m, struct ip *);
1415
1416 #ifdef _IP_VHL
1417 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1418 #else /* !_IP_VHL */
1419 hlen = ip->ip_hl << 2;
1420 #endif /* !_IP_VHL */
1421 /* Check that there wasn't a route change and src is still valid */
1422 if (ROUTE_UNUSABLE(ro)) {
1423 ROUTE_RELEASE(ro);
1424 VERIFY(src_ia == NULL);
1425 if (ip->ip_src.s_addr != INADDR_ANY &&
1426 !(flags & (IP_ROUTETOIF | IP_FORWARDING)) &&
1427 (src_ia = ifa_foraddr(ip->ip_src.s_addr)) == NULL) {
1428 error = EADDRNOTAVAIL;
1429 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1430 5, 0, 0, 0, 0);
1431 goto bad;
1432 }
1433 if (src_ia != NULL) {
1434 IFA_REMREF(&src_ia->ia_ifa);
1435 src_ia = NULL;
1436 }
1437 }
1438
1439 if (ro->ro_rt == NULL) {
1440 if (!(flags & IP_ROUTETOIF)) {
1441 printf("%s: can't update route after "
1442 "IPsec processing\n", __func__);
1443 error = EHOSTUNREACH; /* XXX */
1444 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1445 6, 0, 0, 0, 0);
1446 goto bad;
1447 }
1448 } else {
1449 if (ia != NULL) {
1450 IFA_REMREF(&ia->ia_ifa);
1451 }
1452 RT_LOCK_SPIN(ro->ro_rt);
1453 ia = ifatoia(ro->ro_rt->rt_ifa);
1454 if (ia != NULL) {
1455 /* Become a regular mutex */
1456 RT_CONVERT_LOCK(ro->ro_rt);
1457 IFA_ADDREF(&ia->ia_ifa);
1458 }
1459 ifp = ro->ro_rt->rt_ifp;
1460 RT_UNLOCK(ro->ro_rt);
1461 }
1462
1463 /* make it flipped, again. */
1464 #if BYTE_ORDER != BIG_ENDIAN
1465 NTOHS(ip->ip_len);
1466 NTOHS(ip->ip_off);
1467 #endif
1468 KERNEL_DEBUG(DBG_FNC_IPSEC4_OUTPUT | DBG_FUNC_END,
1469 7, 0xff, 0xff, 0xff, 0xff);
1470
1471 /* Pass to filters again */
1472 if (!TAILQ_EMPTY(&ipv4_filters)
1473 #if NECP
1474 && !necp_packet_should_skip_filters(m)
1475 #endif // NECP
1476 ) {
1477 struct ipfilter *filter;
1478
1479 ipf_pktopts.ippo_flags &= ~IPPOF_MCAST_OPTS;
1480
1481 /*
1482 * Check that a TSO frame isn't passed to a filter.
1483 * This could happen if a filter is inserted while
1484 * TCP is sending the TSO packet.
1485 */
1486 if (m->m_pkthdr.csum_flags & CSUM_TSO_IPV4) {
1487 error = EMSGSIZE;
1488 goto bad;
1489 }
1490
1491 ipf_ref();
1492
1493 /* 4135317 - always pass network byte order to filter */
1494 #if BYTE_ORDER != BIG_ENDIAN
1495 HTONS(ip->ip_len);
1496 HTONS(ip->ip_off);
1497 #endif
1498 TAILQ_FOREACH(filter, &ipv4_filters, ipf_link) {
1499 if (filter->ipf_filter.ipf_output) {
1500 errno_t result;
1501 result = filter->ipf_filter.
1502 ipf_output(filter->ipf_filter.cookie,
1503 (mbuf_t *)&m, ippo);
1504 if (result == EJUSTRETURN) {
1505 ipf_unref();
1506 goto done;
1507 }
1508 if (result != 0) {
1509 ipf_unref();
1510 goto bad;
1511 }
1512 }
1513 }
1514 /* set back to host byte order */
1515 ip = mtod(m, struct ip *);
1516 #if BYTE_ORDER != BIG_ENDIAN
1517 NTOHS(ip->ip_len);
1518 NTOHS(ip->ip_off);
1519 #endif
1520 ipf_unref();
1521 }
1522 skip_ipsec:
1523 #endif /* IPSEC */
1524
1525
1526 /* 127/8 must not appear on wire - RFC1122 */
1527 if (!(ifp->if_flags & IFF_LOOPBACK) &&
1528 ((ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
1529 (ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET)) {
1530 OSAddAtomic(1, &ipstat.ips_badaddr);
1531 error = EADDRNOTAVAIL;
1532 goto bad;
1533 }
1534
1535 if (ipoa != NULL) {
1536 u_int8_t dscp = ip->ip_tos >> IPTOS_DSCP_SHIFT;
1537
1538 error = set_packet_qos(m, ifp,
1539 ipoa->ipoa_flags & IPOAF_QOSMARKING_ALLOWED ? TRUE : FALSE,
1540 ipoa->ipoa_sotc, ipoa->ipoa_netsvctype, &dscp);
1541 if (error == 0) {
1542 ip->ip_tos &= IPTOS_ECN_MASK;
1543 ip->ip_tos |= dscp << IPTOS_DSCP_SHIFT;
1544 } else {
1545 printf("%s if_dscp_for_mbuf() error %d\n", __func__, error);
1546 error = 0;
1547 }
1548 }
1549
1550 ip_output_checksum(ifp, m, (IP_VHL_HL(ip->ip_vhl) << 2),
1551 ip->ip_len, &sw_csum);
1552
1553 interface_mtu = ifp->if_mtu;
1554
1555 if (INTF_ADJUST_MTU_FOR_CLAT46(ifp)) {
1556 interface_mtu = IN6_LINKMTU(ifp);
1557 /* Further adjust the size for CLAT46 expansion */
1558 interface_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
1559 }
1560
1561 /*
1562 * If small enough for interface, or the interface will take
1563 * care of the fragmentation for us, can just send directly.
1564 */
1565 if ((u_short)ip->ip_len <= interface_mtu || TSO_IPV4_OK(ifp, m) ||
1566 (!(ip->ip_off & IP_DF) && (ifp->if_hwassist & CSUM_FRAGMENT))) {
1567 #if BYTE_ORDER != BIG_ENDIAN
1568 HTONS(ip->ip_len);
1569 HTONS(ip->ip_off);
1570 #endif
1571
1572 ip->ip_sum = 0;
1573 if (sw_csum & CSUM_DELAY_IP) {
1574 ip->ip_sum = ip_cksum_hdr_out(m, hlen);
1575 sw_csum &= ~CSUM_DELAY_IP;
1576 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_IP;
1577 }
1578
1579 #if IPSEC
1580 /* clean ipsec history once it goes out of the node */
1581 if (ipsec_bypass == 0 && !(flags & IP_NOIPSEC)) {
1582 ipsec_delaux(m);
1583 }
1584 #endif /* IPSEC */
1585 if ((m->m_pkthdr.csum_flags & CSUM_TSO_IPV4) &&
1586 (m->m_pkthdr.tso_segsz > 0)) {
1587 scnt += m->m_pkthdr.len / m->m_pkthdr.tso_segsz;
1588 } else {
1589 scnt++;
1590 }
1591
1592 if (packetchain == 0) {
1593 if (ro->ro_rt != NULL && nstat_collect) {
1594 nstat_route_tx(ro->ro_rt, scnt,
1595 m->m_pkthdr.len, 0);
1596 }
1597
1598 error = dlil_output(ifp, PF_INET, m, ro->ro_rt,
1599 SA(dst), 0, adv);
1600 if (dlil_verbose && error) {
1601 printf("dlil_output error on interface %s: %d\n",
1602 ifp->if_xname, error);
1603 }
1604 scnt = 0;
1605 goto done;
1606 } else {
1607 /*
1608 * packet chaining allows us to reuse the
1609 * route for all packets
1610 */
1611 bytecnt += m->m_pkthdr.len;
1612 mppn = &m->m_nextpkt;
1613 m = m->m_nextpkt;
1614 if (m == NULL) {
1615 #if PF
1616 sendchain:
1617 #endif /* PF */
1618 if (pktcnt > ip_maxchainsent) {
1619 ip_maxchainsent = pktcnt;
1620 }
1621 if (ro->ro_rt != NULL && nstat_collect) {
1622 nstat_route_tx(ro->ro_rt, scnt,
1623 bytecnt, 0);
1624 }
1625
1626 error = dlil_output(ifp, PF_INET, packetlist,
1627 ro->ro_rt, SA(dst), 0, adv);
1628 if (dlil_verbose && error) {
1629 printf("dlil_output error on interface %s: %d\n",
1630 ifp->if_xname, error);
1631 }
1632 pktcnt = 0;
1633 scnt = 0;
1634 bytecnt = 0;
1635 goto done;
1636 }
1637 m0 = m;
1638 pktcnt++;
1639 goto loopit;
1640 }
1641 }
1642
1643 VERIFY(interface_mtu != 0);
1644 /*
1645 * Too large for interface; fragment if possible.
1646 * Must be able to put at least 8 bytes per fragment.
1647 * Balk when DF bit is set or the interface didn't support TSO.
1648 */
1649 if ((ip->ip_off & IP_DF) || pktcnt > 0 ||
1650 (m->m_pkthdr.csum_flags & CSUM_TSO_IPV4)) {
1651 error = EMSGSIZE;
1652 /*
1653 * This case can happen if the user changed the MTU
1654 * of an interface after enabling IP on it. Because
1655 * most netifs don't keep track of routes pointing to
1656 * them, there is no way for one to update all its
1657 * routes when the MTU is changed.
1658 */
1659 if (ro->ro_rt) {
1660 RT_LOCK_SPIN(ro->ro_rt);
1661 if ((ro->ro_rt->rt_flags & (RTF_UP | RTF_HOST)) &&
1662 !(ro->ro_rt->rt_rmx.rmx_locks & RTV_MTU) &&
1663 (ro->ro_rt->rt_rmx.rmx_mtu > interface_mtu)) {
1664 ro->ro_rt->rt_rmx.rmx_mtu = interface_mtu;
1665 }
1666 RT_UNLOCK(ro->ro_rt);
1667 }
1668 if (pktcnt > 0) {
1669 m0 = packetlist;
1670 }
1671 OSAddAtomic(1, &ipstat.ips_cantfrag);
1672 goto bad;
1673 }
1674
1675 /*
1676 * XXX Only TCP seems to be passing a list of packets here.
1677 * The following issue is limited to UDP datagrams with 0 checksum.
1678 * For now limit it to the case when single packet is passed down.
1679 */
1680 if (packetchain == 0 && IS_INTF_CLAT46(ifp)) {
1681 /*
1682 * If it is a UDP packet that has checksum set to 0
1683 * and is also not being offloaded, compute a full checksum
1684 * and update the UDP checksum.
1685 */
1686 if (ip->ip_p == IPPROTO_UDP &&
1687 !(m->m_pkthdr.csum_flags & (CSUM_UDP | CSUM_PARTIAL))) {
1688 struct udphdr *uh = NULL;
1689
1690 if (m->m_len < hlen + sizeof(struct udphdr)) {
1691 m = m_pullup(m, hlen + sizeof(struct udphdr));
1692 if (m == NULL) {
1693 error = ENOBUFS;
1694 m0 = m;
1695 goto bad;
1696 }
1697 m0 = m;
1698 ip = mtod(m, struct ip *);
1699 }
1700 /*
1701 * Get UDP header and if checksum is 0, then compute the full
1702 * checksum.
1703 */
1704 uh = (struct udphdr *)(void *)((caddr_t)ip + hlen);
1705 if (uh->uh_sum == 0) {
1706 uh->uh_sum = inet_cksum(m, IPPROTO_UDP, hlen,
1707 ip->ip_len - hlen);
1708 if (uh->uh_sum == 0) {
1709 uh->uh_sum = 0xffff;
1710 }
1711 }
1712 }
1713 }
1714
1715 error = ip_fragment(m, ifp, interface_mtu, sw_csum);
1716 if (error != 0) {
1717 m0 = m = NULL;
1718 goto bad;
1719 }
1720
1721 KERNEL_DEBUG(DBG_LAYER_END, ip->ip_dst.s_addr,
1722 ip->ip_src.s_addr, ip->ip_p, ip->ip_off, ip->ip_len);
1723
1724 for (m = m0; m; m = m0) {
1725 m0 = m->m_nextpkt;
1726 m->m_nextpkt = 0;
1727 #if IPSEC
1728 /* clean ipsec history once it goes out of the node */
1729 if (ipsec_bypass == 0 && !(flags & IP_NOIPSEC)) {
1730 ipsec_delaux(m);
1731 }
1732 #endif /* IPSEC */
1733 if (error == 0) {
1734 if ((packetchain != 0) && (pktcnt > 0)) {
1735 panic("%s: mix of packet in packetlist is "
1736 "wrong=%p", __func__, packetlist);
1737 /* NOTREACHED */
1738 }
1739 if (ro->ro_rt != NULL && nstat_collect) {
1740 nstat_route_tx(ro->ro_rt, 1,
1741 m->m_pkthdr.len, 0);
1742 }
1743 error = dlil_output(ifp, PF_INET, m, ro->ro_rt,
1744 SA(dst), 0, adv);
1745 if (dlil_verbose && error) {
1746 printf("dlil_output error on interface %s: %d\n",
1747 ifp->if_xname, error);
1748 }
1749 } else {
1750 m_freem(m);
1751 }
1752 }
1753
1754 if (error == 0) {
1755 OSAddAtomic(1, &ipstat.ips_fragmented);
1756 }
1757
1758 done:
1759 if (ia != NULL) {
1760 IFA_REMREF(&ia->ia_ifa);
1761 ia = NULL;
1762 }
1763 #if IPSEC
1764 ROUTE_RELEASE(&ipsec_state.ro);
1765 if (sp != NULL) {
1766 KEYDEBUG(KEYDEBUG_IPSEC_STAMP,
1767 printf("DP ip_output call free SP:%x\n", sp));
1768 key_freesp(sp, KEY_SADB_UNLOCKED);
1769 }
1770 #endif /* IPSEC */
1771 #if NECP
1772 ROUTE_RELEASE(&necp_route);
1773 #endif /* NECP */
1774 #if DUMMYNET
1775 ROUTE_RELEASE(&saved_route);
1776 #endif /* DUMMYNET */
1777
1778 KERNEL_DEBUG(DBG_FNC_IP_OUTPUT | DBG_FUNC_END, error, 0, 0, 0, 0);
1779 if (ip_output_measure) {
1780 net_perf_measure_time(&net_perf, &start_tv, packets_processed);
1781 net_perf_histogram(&net_perf, packets_processed);
1782 }
1783 return error;
1784 bad:
1785 if (pktcnt > 0) {
1786 m0 = packetlist;
1787 }
1788 m_freem_list(m0);
1789 goto done;
1790
1791 #undef ipsec_state
1792 #undef args
1793 #undef sro_fwd
1794 #undef saved_route
1795 #undef ipf_pktopts
1796 #undef IP_CHECK_RESTRICTIONS
1797 }
1798
1799 int
ip_fragment(struct mbuf * m,struct ifnet * ifp,uint32_t mtu,int sw_csum)1800 ip_fragment(struct mbuf *m, struct ifnet *ifp, uint32_t mtu, int sw_csum)
1801 {
1802 struct ip *ip, *mhip;
1803 int len, hlen, mhlen, firstlen, off, error = 0;
1804 struct mbuf **mnext = &m->m_nextpkt, *m0;
1805 int nfrags = 1;
1806
1807 ip = mtod(m, struct ip *);
1808 #ifdef _IP_VHL
1809 hlen = IP_VHL_HL(ip->ip_vhl) << 2;
1810 #else /* !_IP_VHL */
1811 hlen = ip->ip_hl << 2;
1812 #endif /* !_IP_VHL */
1813
1814 /*
1815 * We need to adjust the fragment sizes to account
1816 * for IPv6 fragment header if it needs to be translated
1817 * from IPv4 to IPv6.
1818 */
1819 if (IS_INTF_CLAT46(ifp)) {
1820 mtu -= sizeof(struct ip6_frag);
1821 }
1822
1823 firstlen = len = (mtu - hlen) & ~7;
1824 if (len < 8) {
1825 m_freem(m);
1826 return EMSGSIZE;
1827 }
1828
1829 /*
1830 * if the interface will not calculate checksums on
1831 * fragmented packets, then do it here.
1832 */
1833 if ((m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) &&
1834 !(ifp->if_hwassist & CSUM_IP_FRAGS)) {
1835 in_delayed_cksum(m);
1836 }
1837
1838 /*
1839 * Loop through length of segment after first fragment,
1840 * make new header and copy data of each part and link onto chain.
1841 */
1842 m0 = m;
1843 mhlen = sizeof(struct ip);
1844 for (off = hlen + len; off < (u_short)ip->ip_len; off += len) {
1845 MGETHDR(m, M_DONTWAIT, MT_HEADER); /* MAC-OK */
1846 if (m == NULL) {
1847 error = ENOBUFS;
1848 OSAddAtomic(1, &ipstat.ips_odropped);
1849 goto sendorfree;
1850 }
1851 m->m_flags |= (m0->m_flags & M_MCAST) | M_FRAG;
1852 m->m_data += max_linkhdr;
1853 mhip = mtod(m, struct ip *);
1854 *mhip = *ip;
1855 if (hlen > sizeof(struct ip)) {
1856 mhlen = ip_optcopy(ip, mhip) + sizeof(struct ip);
1857 mhip->ip_vhl = IP_MAKE_VHL(IPVERSION, mhlen >> 2);
1858 }
1859 m->m_len = mhlen;
1860 mhip->ip_off = (u_short)(((off - hlen) >> 3) + (ip->ip_off & ~IP_MF));
1861 if (ip->ip_off & IP_MF) {
1862 mhip->ip_off |= IP_MF;
1863 }
1864 if (off + len >= (u_short)ip->ip_len) {
1865 len = (u_short)ip->ip_len - off;
1866 } else {
1867 mhip->ip_off |= IP_MF;
1868 }
1869 mhip->ip_len = htons((u_short)(len + mhlen));
1870 m->m_next = m_copy(m0, off, len);
1871 if (m->m_next == NULL) {
1872 (void) m_free(m);
1873 error = ENOBUFS; /* ??? */
1874 OSAddAtomic(1, &ipstat.ips_odropped);
1875 goto sendorfree;
1876 }
1877 m->m_pkthdr.len = mhlen + len;
1878 m->m_pkthdr.rcvif = NULL;
1879 m->m_pkthdr.csum_flags = m0->m_pkthdr.csum_flags;
1880
1881 M_COPY_CLASSIFIER(m, m0);
1882 M_COPY_PFTAG(m, m0);
1883 M_COPY_NECPTAG(m, m0);
1884
1885 #if BYTE_ORDER != BIG_ENDIAN
1886 HTONS(mhip->ip_off);
1887 #endif
1888
1889 mhip->ip_sum = 0;
1890 if (sw_csum & CSUM_DELAY_IP) {
1891 mhip->ip_sum = ip_cksum_hdr_out(m, mhlen);
1892 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_IP;
1893 }
1894 *mnext = m;
1895 mnext = &m->m_nextpkt;
1896 nfrags++;
1897 }
1898 OSAddAtomic(nfrags, &ipstat.ips_ofragments);
1899
1900 /* set first/last markers for fragment chain */
1901 m->m_flags |= M_LASTFRAG;
1902 m0->m_flags |= M_FIRSTFRAG | M_FRAG;
1903 m0->m_pkthdr.csum_data = nfrags;
1904
1905 /*
1906 * Update first fragment by trimming what's been copied out
1907 * and updating header, then send each fragment (in order).
1908 */
1909 m = m0;
1910 m_adj(m, hlen + firstlen - (u_short)ip->ip_len);
1911 m->m_pkthdr.len = hlen + firstlen;
1912 ip->ip_len = htons((u_short)m->m_pkthdr.len);
1913 ip->ip_off |= IP_MF;
1914
1915 #if BYTE_ORDER != BIG_ENDIAN
1916 HTONS(ip->ip_off);
1917 #endif
1918
1919 ip->ip_sum = 0;
1920 if (sw_csum & CSUM_DELAY_IP) {
1921 ip->ip_sum = ip_cksum_hdr_out(m, hlen);
1922 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_IP;
1923 }
1924 sendorfree:
1925 if (error) {
1926 m_freem_list(m0);
1927 }
1928
1929 return error;
1930 }
1931
1932 static void
ip_out_cksum_stats(int proto,u_int32_t len)1933 ip_out_cksum_stats(int proto, u_int32_t len)
1934 {
1935 switch (proto) {
1936 case IPPROTO_TCP:
1937 tcp_out_cksum_stats(len);
1938 break;
1939 case IPPROTO_UDP:
1940 udp_out_cksum_stats(len);
1941 break;
1942 default:
1943 /* keep only TCP or UDP stats for now */
1944 break;
1945 }
1946 }
1947
1948 /*
1949 * Process a delayed payload checksum calculation (outbound path.)
1950 *
1951 * hoff is the number of bytes beyond the mbuf data pointer which
1952 * points to the IP header.
1953 *
1954 * Returns a bitmask representing all the work done in software.
1955 */
1956 uint32_t
in_finalize_cksum(struct mbuf * m,uint32_t hoff,uint32_t csum_flags)1957 in_finalize_cksum(struct mbuf *m, uint32_t hoff, uint32_t csum_flags)
1958 {
1959 unsigned char buf[15 << 2] __attribute__((aligned(8)));
1960 struct ip *ip;
1961 uint32_t offset, _hlen, mlen, hlen, len, sw_csum;
1962 uint16_t csum, ip_len;
1963
1964 _CASSERT(sizeof(csum) == sizeof(uint16_t));
1965 VERIFY(m->m_flags & M_PKTHDR);
1966
1967 sw_csum = (csum_flags & m->m_pkthdr.csum_flags);
1968
1969 if ((sw_csum &= (CSUM_DELAY_IP | CSUM_DELAY_DATA)) == 0) {
1970 goto done;
1971 }
1972
1973 mlen = m->m_pkthdr.len; /* total mbuf len */
1974
1975 /* sanity check (need at least simple IP header) */
1976 if (mlen < (hoff + sizeof(*ip))) {
1977 panic("%s: mbuf %p pkt len (%u) < hoff+ip_hdr "
1978 "(%u+%u)\n", __func__, m, mlen, hoff,
1979 (uint32_t)sizeof(*ip));
1980 /* NOTREACHED */
1981 }
1982
1983 /*
1984 * In case the IP header is not contiguous, or not 32-bit aligned,
1985 * or if we're computing the IP header checksum, copy it to a local
1986 * buffer. Copy only the simple IP header here (IP options case
1987 * is handled below.)
1988 */
1989 if ((sw_csum & CSUM_DELAY_IP) || (hoff + sizeof(*ip)) > m->m_len ||
1990 !IP_HDR_ALIGNED_P(mtod(m, caddr_t) + hoff)) {
1991 m_copydata(m, hoff, sizeof(*ip), (caddr_t)buf);
1992 ip = (struct ip *)(void *)buf;
1993 _hlen = sizeof(*ip);
1994 } else {
1995 ip = (struct ip *)(void *)(m->m_data + hoff);
1996 _hlen = 0;
1997 }
1998
1999 hlen = IP_VHL_HL(ip->ip_vhl) << 2; /* IP header len */
2000
2001 /* sanity check */
2002 if (mlen < (hoff + hlen)) {
2003 panic("%s: mbuf %p pkt too short (%d) for IP header (%u), "
2004 "hoff %u", __func__, m, mlen, hlen, hoff);
2005 /* NOTREACHED */
2006 }
2007
2008 /*
2009 * We could be in the context of an IP or interface filter; in the
2010 * former case, ip_len would be in host (correct) order while for
2011 * the latter it would be in network order. Because of this, we
2012 * attempt to interpret the length field by comparing it against
2013 * the actual packet length. If the comparison fails, byte swap
2014 * the length and check again. If it still fails, use the actual
2015 * packet length. This also covers the trailing bytes case.
2016 */
2017 ip_len = ip->ip_len;
2018 if (ip_len != (mlen - hoff)) {
2019 ip_len = OSSwapInt16(ip_len);
2020 if (ip_len != (mlen - hoff)) {
2021 printf("%s: mbuf 0x%llx proto %d IP len %d (%x) "
2022 "[swapped %d (%x)] doesn't match actual packet "
2023 "length; %d is used instead\n", __func__,
2024 (uint64_t)VM_KERNEL_ADDRPERM(m), ip->ip_p,
2025 ip->ip_len, ip->ip_len, ip_len, ip_len,
2026 (mlen - hoff));
2027 if (mlen - hoff > UINT16_MAX) {
2028 panic("%s: mlen %u - hoff %u > 65535",
2029 __func__, mlen, hoff);
2030 }
2031 ip_len = (uint16_t)(mlen - hoff);
2032 }
2033 }
2034
2035 len = ip_len - hlen; /* csum span */
2036
2037 if (sw_csum & CSUM_DELAY_DATA) {
2038 uint16_t ulpoff;
2039
2040 /*
2041 * offset is added to the lower 16-bit value of csum_data,
2042 * which is expected to contain the ULP offset; therefore
2043 * CSUM_PARTIAL offset adjustment must be undone.
2044 */
2045 if ((m->m_pkthdr.csum_flags & (CSUM_PARTIAL | CSUM_DATA_VALID)) ==
2046 (CSUM_PARTIAL | CSUM_DATA_VALID)) {
2047 /*
2048 * Get back the original ULP offset (this will
2049 * undo the CSUM_PARTIAL logic in ip_output.)
2050 */
2051 m->m_pkthdr.csum_data = (m->m_pkthdr.csum_tx_stuff -
2052 m->m_pkthdr.csum_tx_start);
2053 }
2054
2055 ulpoff = (m->m_pkthdr.csum_data & 0xffff); /* ULP csum offset */
2056 offset = hoff + hlen; /* ULP header */
2057
2058 if (mlen < (ulpoff + sizeof(csum))) {
2059 panic("%s: mbuf %p pkt len (%u) proto %d invalid ULP "
2060 "cksum offset (%u) cksum flags 0x%x\n", __func__,
2061 m, mlen, ip->ip_p, ulpoff, m->m_pkthdr.csum_flags);
2062 /* NOTREACHED */
2063 }
2064
2065 csum = inet_cksum(m, 0, offset, len);
2066
2067 /* Update stats */
2068 ip_out_cksum_stats(ip->ip_p, len);
2069
2070 /* RFC1122 4.1.3.4 */
2071 if (csum == 0 &&
2072 (m->m_pkthdr.csum_flags & (CSUM_UDP | CSUM_ZERO_INVERT))) {
2073 csum = 0xffff;
2074 }
2075
2076 /* Insert the checksum in the ULP csum field */
2077 offset += ulpoff;
2078 if (offset + sizeof(csum) > m->m_len) {
2079 m_copyback(m, offset, sizeof(csum), &csum);
2080 } else if (IP_HDR_ALIGNED_P(mtod(m, char *) + hoff)) {
2081 *(uint16_t *)(void *)(mtod(m, char *) + offset) = csum;
2082 } else {
2083 bcopy(&csum, (mtod(m, char *) + offset), sizeof(csum));
2084 }
2085 m->m_pkthdr.csum_flags &= ~(CSUM_DELAY_DATA | CSUM_DATA_VALID |
2086 CSUM_PARTIAL | CSUM_ZERO_INVERT);
2087 }
2088
2089 if (sw_csum & CSUM_DELAY_IP) {
2090 /* IP header must be in the local buffer */
2091 VERIFY(_hlen == sizeof(*ip));
2092 if (_hlen != hlen) {
2093 VERIFY(hlen <= sizeof(buf));
2094 m_copydata(m, hoff, hlen, (caddr_t)buf);
2095 ip = (struct ip *)(void *)buf;
2096 _hlen = hlen;
2097 }
2098
2099 /*
2100 * Compute the IP header checksum as if the IP length
2101 * is the length which we believe is "correct"; see
2102 * how ip_len gets calculated above. Note that this
2103 * is done on the local copy and not on the real one.
2104 */
2105 ip->ip_len = htons(ip_len);
2106 ip->ip_sum = 0;
2107 csum = in_cksum_hdr_opt(ip);
2108
2109 /* Update stats */
2110 ipstat.ips_snd_swcsum++;
2111 ipstat.ips_snd_swcsum_bytes += hlen;
2112
2113 /*
2114 * Insert only the checksum in the existing IP header
2115 * csum field; all other fields are left unchanged.
2116 */
2117 offset = hoff + offsetof(struct ip, ip_sum);
2118 if (offset + sizeof(csum) > m->m_len) {
2119 m_copyback(m, offset, sizeof(csum), &csum);
2120 } else if (IP_HDR_ALIGNED_P(mtod(m, char *) + hoff)) {
2121 *(uint16_t *)(void *)(mtod(m, char *) + offset) = csum;
2122 } else {
2123 bcopy(&csum, (mtod(m, char *) + offset), sizeof(csum));
2124 }
2125 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_IP;
2126 }
2127
2128 done:
2129 return sw_csum;
2130 }
2131
2132 /*
2133 * Insert IP options into preformed packet.
2134 * Adjust IP destination as required for IP source routing,
2135 * as indicated by a non-zero in_addr at the start of the options.
2136 *
2137 * XXX This routine assumes that the packet has no options in place.
2138 */
2139 static struct mbuf *
ip_insertoptions(struct mbuf * m,struct mbuf * opt,int * phlen)2140 ip_insertoptions(struct mbuf *m, struct mbuf *opt, int *phlen)
2141 {
2142 struct ipoption *p = mtod(opt, struct ipoption *);
2143 struct mbuf *n;
2144 struct ip *ip = mtod(m, struct ip *);
2145 unsigned optlen;
2146
2147 optlen = opt->m_len - sizeof(p->ipopt_dst);
2148 if (optlen + (u_short)ip->ip_len > IP_MAXPACKET) {
2149 return m; /* XXX should fail */
2150 }
2151 if (p->ipopt_dst.s_addr) {
2152 ip->ip_dst = p->ipopt_dst;
2153 }
2154 if (m->m_flags & M_EXT || m->m_data - optlen < m->m_pktdat) {
2155 MGETHDR(n, M_DONTWAIT, MT_HEADER); /* MAC-OK */
2156 if (n == NULL) {
2157 return m;
2158 }
2159 n->m_pkthdr.rcvif = 0;
2160 n->m_pkthdr.len = m->m_pkthdr.len + optlen;
2161 m->m_len -= sizeof(struct ip);
2162 m->m_data += sizeof(struct ip);
2163 n->m_next = m;
2164 m = n;
2165 m->m_len = optlen + sizeof(struct ip);
2166 m->m_data += max_linkhdr;
2167 (void) memcpy(mtod(m, void *), ip, sizeof(struct ip));
2168 } else {
2169 m->m_data -= optlen;
2170 m->m_len += optlen;
2171 m->m_pkthdr.len += optlen;
2172 ovbcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));
2173 }
2174 ip = mtod(m, struct ip *);
2175 bcopy(p->ipopt_list, ip + 1, optlen);
2176 *phlen = sizeof(struct ip) + optlen;
2177 ip->ip_vhl = IP_MAKE_VHL(IPVERSION, *phlen >> 2);
2178 ip->ip_len += optlen;
2179 return m;
2180 }
2181
2182 /*
2183 * Copy options from ip to jp,
2184 * omitting those not copied during fragmentation.
2185 */
2186 static int
ip_optcopy(struct ip * ip,struct ip * jp)2187 ip_optcopy(struct ip *ip, struct ip *jp)
2188 {
2189 u_char *cp, *dp;
2190 int opt, optlen, cnt;
2191
2192 cp = (u_char *)(ip + 1);
2193 dp = (u_char *)(jp + 1);
2194 cnt = (IP_VHL_HL(ip->ip_vhl) << 2) - sizeof(struct ip);
2195 for (; cnt > 0; cnt -= optlen, cp += optlen) {
2196 opt = cp[0];
2197 if (opt == IPOPT_EOL) {
2198 break;
2199 }
2200 if (opt == IPOPT_NOP) {
2201 /* Preserve for IP mcast tunnel's LSRR alignment. */
2202 *dp++ = IPOPT_NOP;
2203 optlen = 1;
2204 continue;
2205 }
2206 #if DIAGNOSTIC
2207 if (cnt < IPOPT_OLEN + sizeof(*cp)) {
2208 panic("malformed IPv4 option passed to ip_optcopy");
2209 /* NOTREACHED */
2210 }
2211 #endif
2212 optlen = cp[IPOPT_OLEN];
2213 #if DIAGNOSTIC
2214 if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) {
2215 panic("malformed IPv4 option passed to ip_optcopy");
2216 /* NOTREACHED */
2217 }
2218 #endif
2219 /* bogus lengths should have been caught by ip_dooptions */
2220 if (optlen > cnt) {
2221 optlen = cnt;
2222 }
2223 if (IPOPT_COPIED(opt)) {
2224 bcopy(cp, dp, optlen);
2225 dp += optlen;
2226 }
2227 }
2228 for (optlen = (int)(dp - (u_char *)(jp + 1)); optlen & 0x3; optlen++) {
2229 *dp++ = IPOPT_EOL;
2230 }
2231 return optlen;
2232 }
2233
2234 /*
2235 * IP socket option processing.
2236 */
2237 int
ip_ctloutput(struct socket * so,struct sockopt * sopt)2238 ip_ctloutput(struct socket *so, struct sockopt *sopt)
2239 {
2240 struct inpcb *inp = sotoinpcb(so);
2241 int error, optval;
2242 lck_mtx_t *mutex_held = NULL;
2243
2244 error = optval = 0;
2245 if (sopt->sopt_level != IPPROTO_IP) {
2246 return EINVAL;
2247 }
2248
2249 switch (sopt->sopt_dir) {
2250 case SOPT_SET:
2251 mutex_held = socket_getlock(so, PR_F_WILLUNLOCK);
2252 /*
2253 * Wait if we are in the middle of ip_output
2254 * as we unlocked the socket there and don't
2255 * want to overwrite the IP options
2256 */
2257 if (inp->inp_sndinprog_cnt > 0) {
2258 inp->inp_sndingprog_waiters++;
2259
2260 while (inp->inp_sndinprog_cnt > 0) {
2261 msleep(&inp->inp_sndinprog_cnt, mutex_held,
2262 PSOCK | PCATCH, "inp_sndinprog_cnt", NULL);
2263 }
2264 inp->inp_sndingprog_waiters--;
2265 }
2266 switch (sopt->sopt_name) {
2267 #ifdef notyet
2268 case IP_RETOPTS:
2269 #endif
2270 case IP_OPTIONS: {
2271 struct mbuf *m;
2272
2273 if (sopt->sopt_valsize > MLEN) {
2274 error = EMSGSIZE;
2275 break;
2276 }
2277 MGET(m, sopt->sopt_p != kernproc ? M_WAIT : M_DONTWAIT,
2278 MT_HEADER);
2279 if (m == NULL) {
2280 error = ENOBUFS;
2281 break;
2282 }
2283 m->m_len = (int32_t)sopt->sopt_valsize;
2284 error = sooptcopyin(sopt, mtod(m, char *),
2285 m->m_len, m->m_len);
2286 if (error) {
2287 m_freem(m);
2288 break;
2289 }
2290
2291 return ip_pcbopts(sopt->sopt_name,
2292 &inp->inp_options, m);
2293 }
2294
2295 case IP_TOS:
2296 case IP_TTL:
2297 case IP_RECVOPTS:
2298 case IP_RECVRETOPTS:
2299 case IP_RECVDSTADDR:
2300 case IP_RECVIF:
2301 case IP_RECVTTL:
2302 case IP_RECVPKTINFO:
2303 case IP_RECVTOS:
2304 case IP_DONTFRAG:
2305 error = sooptcopyin(sopt, &optval, sizeof(optval),
2306 sizeof(optval));
2307 if (error) {
2308 break;
2309 }
2310
2311 switch (sopt->sopt_name) {
2312 case IP_TOS:
2313 if (optval > UINT8_MAX) {
2314 error = EINVAL;
2315 break;
2316 }
2317 inp->inp_ip_tos = (uint8_t)optval;
2318 break;
2319
2320 case IP_TTL:
2321 if (optval > UINT8_MAX) {
2322 error = EINVAL;
2323 break;
2324 }
2325 inp->inp_ip_ttl = (uint8_t)optval;
2326 break;
2327 #define OPTSET(bit) do { \
2328 if (optval) { \
2329 inp->inp_flags |= bit; \
2330 } else { \
2331 inp->inp_flags &= ~bit; \
2332 } \
2333 } while (0)
2334
2335 #define OPTSET2(bit) do { \
2336 if (optval) { \
2337 inp->inp_flags2 |= bit; \
2338 } else { \
2339 inp->inp_flags2 &= ~bit; \
2340 } \
2341 } while (0)
2342
2343 case IP_RECVOPTS:
2344 OPTSET(INP_RECVOPTS);
2345 break;
2346
2347 case IP_RECVRETOPTS:
2348 OPTSET(INP_RECVRETOPTS);
2349 break;
2350
2351 case IP_RECVDSTADDR:
2352 OPTSET(INP_RECVDSTADDR);
2353 break;
2354
2355 case IP_RECVIF:
2356 OPTSET(INP_RECVIF);
2357 break;
2358
2359 case IP_RECVTTL:
2360 OPTSET(INP_RECVTTL);
2361 break;
2362
2363 case IP_RECVPKTINFO:
2364 OPTSET(INP_PKTINFO);
2365 break;
2366
2367 case IP_RECVTOS:
2368 OPTSET(INP_RECVTOS);
2369 break;
2370
2371 case IP_DONTFRAG:
2372 /* This option is settable only for IPv4 */
2373 if (!(inp->inp_vflag & INP_IPV4)) {
2374 error = EINVAL;
2375 break;
2376 }
2377 OPTSET2(INP2_DONTFRAG);
2378 break;
2379 #undef OPTSET
2380 #undef OPTSET2
2381 }
2382 break;
2383 /*
2384 * Multicast socket options are processed by the in_mcast
2385 * module.
2386 */
2387 case IP_MULTICAST_IF:
2388 case IP_MULTICAST_IFINDEX:
2389 case IP_MULTICAST_VIF:
2390 case IP_MULTICAST_TTL:
2391 case IP_MULTICAST_LOOP:
2392 case IP_ADD_MEMBERSHIP:
2393 case IP_DROP_MEMBERSHIP:
2394 case IP_ADD_SOURCE_MEMBERSHIP:
2395 case IP_DROP_SOURCE_MEMBERSHIP:
2396 case IP_BLOCK_SOURCE:
2397 case IP_UNBLOCK_SOURCE:
2398 case IP_MSFILTER:
2399 case MCAST_JOIN_GROUP:
2400 case MCAST_LEAVE_GROUP:
2401 case MCAST_JOIN_SOURCE_GROUP:
2402 case MCAST_LEAVE_SOURCE_GROUP:
2403 case MCAST_BLOCK_SOURCE:
2404 case MCAST_UNBLOCK_SOURCE:
2405 error = inp_setmoptions(inp, sopt);
2406 break;
2407
2408 case IP_PORTRANGE:
2409 error = sooptcopyin(sopt, &optval, sizeof(optval),
2410 sizeof(optval));
2411 if (error) {
2412 break;
2413 }
2414
2415 switch (optval) {
2416 case IP_PORTRANGE_DEFAULT:
2417 inp->inp_flags &= ~(INP_LOWPORT);
2418 inp->inp_flags &= ~(INP_HIGHPORT);
2419 break;
2420
2421 case IP_PORTRANGE_HIGH:
2422 inp->inp_flags &= ~(INP_LOWPORT);
2423 inp->inp_flags |= INP_HIGHPORT;
2424 break;
2425
2426 case IP_PORTRANGE_LOW:
2427 inp->inp_flags &= ~(INP_HIGHPORT);
2428 inp->inp_flags |= INP_LOWPORT;
2429 break;
2430
2431 default:
2432 error = EINVAL;
2433 break;
2434 }
2435 break;
2436
2437 #if IPSEC
2438 case IP_IPSEC_POLICY: {
2439 caddr_t req = NULL;
2440 size_t len = 0;
2441 int priv;
2442 struct mbuf *m;
2443 int optname;
2444
2445 if ((error = soopt_getm(sopt, &m)) != 0) { /* XXX */
2446 break;
2447 }
2448 if ((error = soopt_mcopyin(sopt, m)) != 0) { /* XXX */
2449 break;
2450 }
2451 priv = (proc_suser(sopt->sopt_p) == 0);
2452 if (m) {
2453 req = mtod(m, caddr_t);
2454 len = m->m_len;
2455 }
2456 optname = sopt->sopt_name;
2457 error = ipsec4_set_policy(inp, optname, req, len, priv);
2458 m_freem(m);
2459 break;
2460 }
2461 #endif /* IPSEC */
2462
2463 #if TRAFFIC_MGT
2464 case IP_TRAFFIC_MGT_BACKGROUND: {
2465 unsigned background = 0;
2466
2467 error = sooptcopyin(sopt, &background,
2468 sizeof(background), sizeof(background));
2469 if (error) {
2470 break;
2471 }
2472
2473 if (background) {
2474 socket_set_traffic_mgt_flags_locked(so,
2475 TRAFFIC_MGT_SO_BACKGROUND);
2476 } else {
2477 socket_clear_traffic_mgt_flags_locked(so,
2478 TRAFFIC_MGT_SO_BACKGROUND);
2479 }
2480
2481 break;
2482 }
2483 #endif /* TRAFFIC_MGT */
2484
2485 /*
2486 * On a multihomed system, scoped routing can be used to
2487 * restrict the source interface used for sending packets.
2488 * The socket option IP_BOUND_IF binds a particular AF_INET
2489 * socket to an interface such that data sent on the socket
2490 * is restricted to that interface. This is unlike the
2491 * SO_DONTROUTE option where the routing table is bypassed;
2492 * therefore it allows for a greater flexibility and control
2493 * over the system behavior, and does not place any restriction
2494 * on the destination address type (e.g. unicast, multicast,
2495 * or broadcast if applicable) or whether or not the host is
2496 * directly reachable. Note that in the multicast transmit
2497 * case, IP_MULTICAST_{IF,IFINDEX} takes precedence over
2498 * IP_BOUND_IF, since the former practically bypasses the
2499 * routing table; in this case, IP_BOUND_IF sets the default
2500 * interface used for sending multicast packets in the absence
2501 * of an explicit multicast transmit interface.
2502 */
2503 case IP_BOUND_IF:
2504 /* This option is settable only for IPv4 */
2505 if (!(inp->inp_vflag & INP_IPV4)) {
2506 error = EINVAL;
2507 break;
2508 }
2509
2510 error = sooptcopyin(sopt, &optval, sizeof(optval),
2511 sizeof(optval));
2512
2513 if (error) {
2514 break;
2515 }
2516
2517 error = inp_bindif(inp, optval, NULL);
2518 break;
2519
2520 case IP_NO_IFT_CELLULAR:
2521 /* This option is settable only for IPv4 */
2522 if (!(inp->inp_vflag & INP_IPV4)) {
2523 error = EINVAL;
2524 break;
2525 }
2526
2527 error = sooptcopyin(sopt, &optval, sizeof(optval),
2528 sizeof(optval));
2529
2530 if (error) {
2531 break;
2532 }
2533
2534 /* once set, it cannot be unset */
2535 if (!optval && INP_NO_CELLULAR(inp)) {
2536 error = EINVAL;
2537 break;
2538 }
2539
2540 error = so_set_restrictions(so,
2541 SO_RESTRICT_DENY_CELLULAR);
2542 break;
2543
2544 case IP_OUT_IF:
2545 /* This option is not settable */
2546 error = EINVAL;
2547 break;
2548
2549 default:
2550 error = ENOPROTOOPT;
2551 break;
2552 }
2553 break;
2554
2555 case SOPT_GET:
2556 switch (sopt->sopt_name) {
2557 case IP_OPTIONS:
2558 case IP_RETOPTS:
2559 if (inp->inp_options) {
2560 error = sooptcopyout(sopt,
2561 mtod(inp->inp_options, char *),
2562 inp->inp_options->m_len);
2563 } else {
2564 sopt->sopt_valsize = 0;
2565 }
2566 break;
2567
2568 case IP_TOS:
2569 case IP_TTL:
2570 case IP_RECVOPTS:
2571 case IP_RECVRETOPTS:
2572 case IP_RECVDSTADDR:
2573 case IP_RECVIF:
2574 case IP_RECVTTL:
2575 case IP_PORTRANGE:
2576 case IP_RECVPKTINFO:
2577 case IP_RECVTOS:
2578 case IP_DONTFRAG:
2579 switch (sopt->sopt_name) {
2580 case IP_TOS:
2581 optval = inp->inp_ip_tos;
2582 break;
2583
2584 case IP_TTL:
2585 optval = inp->inp_ip_ttl;
2586 break;
2587
2588 #define OPTBIT(bit) (inp->inp_flags & bit ? 1 : 0)
2589 #define OPTBIT2(bit) (inp->inp_flags2 & bit ? 1 : 0)
2590 case IP_RECVOPTS:
2591 optval = OPTBIT(INP_RECVOPTS);
2592 break;
2593
2594 case IP_RECVRETOPTS:
2595 optval = OPTBIT(INP_RECVRETOPTS);
2596 break;
2597
2598 case IP_RECVDSTADDR:
2599 optval = OPTBIT(INP_RECVDSTADDR);
2600 break;
2601
2602 case IP_RECVIF:
2603 optval = OPTBIT(INP_RECVIF);
2604 break;
2605
2606 case IP_RECVTTL:
2607 optval = OPTBIT(INP_RECVTTL);
2608 break;
2609
2610 case IP_PORTRANGE:
2611 if (inp->inp_flags & INP_HIGHPORT) {
2612 optval = IP_PORTRANGE_HIGH;
2613 } else if (inp->inp_flags & INP_LOWPORT) {
2614 optval = IP_PORTRANGE_LOW;
2615 } else {
2616 optval = 0;
2617 }
2618 break;
2619
2620 case IP_RECVPKTINFO:
2621 optval = OPTBIT(INP_PKTINFO);
2622 break;
2623
2624 case IP_RECVTOS:
2625 optval = OPTBIT(INP_RECVTOS);
2626 break;
2627 case IP_DONTFRAG:
2628 optval = OPTBIT2(INP2_DONTFRAG);
2629 break;
2630 }
2631 error = sooptcopyout(sopt, &optval, sizeof(optval));
2632 break;
2633
2634 case IP_MULTICAST_IF:
2635 case IP_MULTICAST_IFINDEX:
2636 case IP_MULTICAST_VIF:
2637 case IP_MULTICAST_TTL:
2638 case IP_MULTICAST_LOOP:
2639 case IP_MSFILTER:
2640 error = inp_getmoptions(inp, sopt);
2641 break;
2642
2643 #if IPSEC
2644 case IP_IPSEC_POLICY: {
2645 error = 0; /* This option is no longer supported */
2646 break;
2647 }
2648 #endif /* IPSEC */
2649
2650 #if TRAFFIC_MGT
2651 case IP_TRAFFIC_MGT_BACKGROUND: {
2652 unsigned background = (so->so_flags1 &
2653 SOF1_TRAFFIC_MGT_SO_BACKGROUND) ? 1 : 0;
2654 return sooptcopyout(sopt, &background,
2655 sizeof(background));
2656 }
2657 #endif /* TRAFFIC_MGT */
2658
2659 case IP_BOUND_IF:
2660 if (inp->inp_flags & INP_BOUND_IF) {
2661 optval = inp->inp_boundifp->if_index;
2662 }
2663 error = sooptcopyout(sopt, &optval, sizeof(optval));
2664 break;
2665
2666 case IP_NO_IFT_CELLULAR:
2667 optval = INP_NO_CELLULAR(inp) ? 1 : 0;
2668 error = sooptcopyout(sopt, &optval, sizeof(optval));
2669 break;
2670
2671 case IP_OUT_IF:
2672 optval = (inp->inp_last_outifp != NULL) ?
2673 inp->inp_last_outifp->if_index : 0;
2674 error = sooptcopyout(sopt, &optval, sizeof(optval));
2675 break;
2676
2677 default:
2678 error = ENOPROTOOPT;
2679 break;
2680 }
2681 break;
2682 }
2683 return error;
2684 }
2685
2686 /*
2687 * Set up IP options in pcb for insertion in output packets.
2688 * Store in mbuf with pointer in pcbopt, adding pseudo-option
2689 * with destination address if source routed.
2690 */
2691 static int
ip_pcbopts(int optname,struct mbuf ** pcbopt,struct mbuf * m)2692 ip_pcbopts(int optname, struct mbuf **pcbopt, struct mbuf *m)
2693 {
2694 #pragma unused(optname)
2695 int cnt, optlen;
2696 u_char *cp;
2697 u_char opt;
2698
2699 /* turn off any old options */
2700 if (*pcbopt) {
2701 (void) m_free(*pcbopt);
2702 }
2703 *pcbopt = 0;
2704 if (m == (struct mbuf *)0 || m->m_len == 0) {
2705 /*
2706 * Only turning off any previous options.
2707 */
2708 if (m) {
2709 (void) m_free(m);
2710 }
2711 return 0;
2712 }
2713
2714 if (m->m_len % sizeof(int32_t)) {
2715 goto bad;
2716 }
2717
2718 /*
2719 * IP first-hop destination address will be stored before
2720 * actual options; move other options back
2721 * and clear it when none present.
2722 */
2723 if (m->m_data + m->m_len + sizeof(struct in_addr) >= &m->m_dat[MLEN]) {
2724 goto bad;
2725 }
2726 cnt = m->m_len;
2727 m->m_len += sizeof(struct in_addr);
2728 cp = mtod(m, u_char *) + sizeof(struct in_addr);
2729 ovbcopy(mtod(m, caddr_t), (caddr_t)cp, (unsigned)cnt);
2730 bzero(mtod(m, caddr_t), sizeof(struct in_addr));
2731
2732 for (; cnt > 0; cnt -= optlen, cp += optlen) {
2733 opt = cp[IPOPT_OPTVAL];
2734 if (opt == IPOPT_EOL) {
2735 break;
2736 }
2737 if (opt == IPOPT_NOP) {
2738 optlen = 1;
2739 } else {
2740 if (cnt < IPOPT_OLEN + sizeof(*cp)) {
2741 goto bad;
2742 }
2743 optlen = cp[IPOPT_OLEN];
2744 if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) {
2745 goto bad;
2746 }
2747 }
2748 switch (opt) {
2749 default:
2750 break;
2751
2752 case IPOPT_LSRR:
2753 case IPOPT_SSRR:
2754 /*
2755 * user process specifies route as:
2756 * ->A->B->C->D
2757 * D must be our final destination (but we can't
2758 * check that since we may not have connected yet).
2759 * A is first hop destination, which doesn't appear in
2760 * actual IP option, but is stored before the options.
2761 */
2762 if (optlen < IPOPT_MINOFF - 1 + sizeof(struct in_addr)) {
2763 goto bad;
2764 }
2765 if (optlen > UINT8_MAX) {
2766 goto bad;
2767 }
2768 m->m_len -= sizeof(struct in_addr);
2769 cnt -= sizeof(struct in_addr);
2770 optlen -= sizeof(struct in_addr);
2771 cp[IPOPT_OLEN] = (uint8_t)optlen;
2772 /*
2773 * Move first hop before start of options.
2774 */
2775 bcopy((caddr_t)&cp[IPOPT_OFFSET + 1], mtod(m, caddr_t),
2776 sizeof(struct in_addr));
2777 /*
2778 * Then copy rest of options back
2779 * to close up the deleted entry.
2780 */
2781 ovbcopy((caddr_t)(&cp[IPOPT_OFFSET + 1] +
2782 sizeof(struct in_addr)),
2783 (caddr_t)&cp[IPOPT_OFFSET + 1],
2784 (unsigned)cnt - (IPOPT_MINOFF - 1));
2785 break;
2786 }
2787 }
2788 if (m->m_len > MAX_IPOPTLEN + sizeof(struct in_addr)) {
2789 goto bad;
2790 }
2791 *pcbopt = m;
2792 return 0;
2793
2794 bad:
2795 (void) m_free(m);
2796 return EINVAL;
2797 }
2798
2799 void
ip_moptions_init(void)2800 ip_moptions_init(void)
2801 {
2802 PE_parse_boot_argn("ifa_debug", &imo_debug, sizeof(imo_debug));
2803
2804 vm_size_t imo_size = (imo_debug == 0) ? sizeof(struct ip_moptions) :
2805 sizeof(struct ip_moptions_dbg);
2806
2807 imo_zone = zone_create(IMO_ZONE_NAME, imo_size, ZC_ZFREE_CLEARMEM);
2808 }
2809
2810 void
imo_addref(struct ip_moptions * imo,int locked)2811 imo_addref(struct ip_moptions *imo, int locked)
2812 {
2813 if (!locked) {
2814 IMO_LOCK(imo);
2815 } else {
2816 IMO_LOCK_ASSERT_HELD(imo);
2817 }
2818
2819 if (++imo->imo_refcnt == 0) {
2820 panic("%s: imo %p wraparound refcnt", __func__, imo);
2821 /* NOTREACHED */
2822 } else if (imo->imo_trace != NULL) {
2823 (*imo->imo_trace)(imo, TRUE);
2824 }
2825
2826 if (!locked) {
2827 IMO_UNLOCK(imo);
2828 }
2829 }
2830
2831 void
imo_remref(struct ip_moptions * imo)2832 imo_remref(struct ip_moptions *imo)
2833 {
2834 int i;
2835
2836 IMO_LOCK(imo);
2837 if (imo->imo_refcnt == 0) {
2838 panic("%s: imo %p negative refcnt", __func__, imo);
2839 /* NOTREACHED */
2840 } else if (imo->imo_trace != NULL) {
2841 (*imo->imo_trace)(imo, FALSE);
2842 }
2843
2844 --imo->imo_refcnt;
2845 if (imo->imo_refcnt > 0) {
2846 IMO_UNLOCK(imo);
2847 return;
2848 }
2849
2850 for (i = 0; i < imo->imo_num_memberships; ++i) {
2851 struct in_mfilter *imf;
2852
2853 imf = imo->imo_mfilters ? &imo->imo_mfilters[i] : NULL;
2854 if (imf != NULL) {
2855 imf_leave(imf);
2856 }
2857
2858 (void) in_leavegroup(imo->imo_membership[i], imf);
2859
2860 if (imf != NULL) {
2861 imf_purge(imf);
2862 }
2863
2864 INM_REMREF(imo->imo_membership[i]);
2865 imo->imo_membership[i] = NULL;
2866 }
2867 imo->imo_num_memberships = 0;
2868 IMO_UNLOCK(imo);
2869
2870 kfree_type(struct in_multi *, imo->imo_max_memberships, imo->imo_membership);
2871 kfree_type(struct in_mfilter, imo->imo_max_memberships, imo->imo_mfilters);
2872 lck_mtx_destroy(&imo->imo_lock, &ifa_mtx_grp);
2873
2874 if (!(imo->imo_debug & IFD_ALLOC)) {
2875 panic("%s: imo %p cannot be freed", __func__, imo);
2876 /* NOTREACHED */
2877 }
2878 zfree(imo_zone, imo);
2879 }
2880
2881 static void
imo_trace(struct ip_moptions * imo,int refhold)2882 imo_trace(struct ip_moptions *imo, int refhold)
2883 {
2884 struct ip_moptions_dbg *imo_dbg = (struct ip_moptions_dbg *)imo;
2885 ctrace_t *tr;
2886 u_int32_t idx;
2887 u_int16_t *cnt;
2888
2889 if (!(imo->imo_debug & IFD_DEBUG)) {
2890 panic("%s: imo %p has no debug structure", __func__, imo);
2891 /* NOTREACHED */
2892 }
2893 if (refhold) {
2894 cnt = &imo_dbg->imo_refhold_cnt;
2895 tr = imo_dbg->imo_refhold;
2896 } else {
2897 cnt = &imo_dbg->imo_refrele_cnt;
2898 tr = imo_dbg->imo_refrele;
2899 }
2900
2901 idx = atomic_add_16_ov(cnt, 1) % IMO_TRACE_HIST_SIZE;
2902 ctrace_record(&tr[idx]);
2903 }
2904
2905 struct ip_moptions *
ip_allocmoptions(zalloc_flags_t how)2906 ip_allocmoptions(zalloc_flags_t how)
2907 {
2908 struct ip_moptions *imo;
2909
2910 imo = zalloc_flags(imo_zone, how | Z_ZERO);
2911 if (imo != NULL) {
2912 lck_mtx_init(&imo->imo_lock, &ifa_mtx_grp, &ifa_mtx_attr);
2913 imo->imo_debug |= IFD_ALLOC;
2914 if (imo_debug != 0) {
2915 imo->imo_debug |= IFD_DEBUG;
2916 imo->imo_trace = imo_trace;
2917 }
2918 IMO_ADDREF(imo);
2919 }
2920
2921 return imo;
2922 }
2923
2924 /*
2925 * Routine called from ip_output() to loop back a copy of an IP multicast
2926 * packet to the input queue of a specified interface. Note that this
2927 * calls the output routine of the loopback "driver", but with an interface
2928 * pointer that might NOT be a loopback interface -- evil, but easier than
2929 * replicating that code here.
2930 */
2931 static void
ip_mloopback(struct ifnet * srcifp,struct ifnet * origifp,struct mbuf * m,struct sockaddr_in * dst,int hlen)2932 ip_mloopback(struct ifnet *srcifp, struct ifnet *origifp, struct mbuf *m,
2933 struct sockaddr_in *dst, int hlen)
2934 {
2935 struct mbuf *copym;
2936 struct ip *ip;
2937
2938 if (lo_ifp == NULL) {
2939 return;
2940 }
2941
2942 /*
2943 * Copy the packet header as it's needed for the checksum
2944 * Make sure to deep-copy IP header portion in case the data
2945 * is in an mbuf cluster, so that we can safely override the IP
2946 * header portion later.
2947 */
2948 copym = m_copym_mode(m, 0, M_COPYALL, M_DONTWAIT, M_COPYM_COPY_HDR);
2949 if (copym != NULL && ((copym->m_flags & M_EXT) || copym->m_len < hlen)) {
2950 copym = m_pullup(copym, hlen);
2951 }
2952
2953 if (copym == NULL) {
2954 return;
2955 }
2956
2957 /*
2958 * We don't bother to fragment if the IP length is greater
2959 * than the interface's MTU. Can this possibly matter?
2960 */
2961 ip = mtod(copym, struct ip *);
2962 #if BYTE_ORDER != BIG_ENDIAN
2963 HTONS(ip->ip_len);
2964 HTONS(ip->ip_off);
2965 #endif
2966 ip->ip_sum = 0;
2967 ip->ip_sum = ip_cksum_hdr_out(copym, hlen);
2968
2969 /*
2970 * Mark checksum as valid unless receive checksum offload is
2971 * disabled; if so, compute checksum in software. If the
2972 * interface itself is lo0, this will be overridden by if_loop.
2973 */
2974 if (hwcksum_rx) {
2975 copym->m_pkthdr.csum_flags &= ~(CSUM_PARTIAL | CSUM_ZERO_INVERT);
2976 copym->m_pkthdr.csum_flags |=
2977 CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
2978 copym->m_pkthdr.csum_data = 0xffff;
2979 } else if (copym->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
2980 #if BYTE_ORDER != BIG_ENDIAN
2981 NTOHS(ip->ip_len);
2982 #endif
2983 in_delayed_cksum(copym);
2984 #if BYTE_ORDER != BIG_ENDIAN
2985 HTONS(ip->ip_len);
2986 #endif
2987 }
2988
2989 /*
2990 * Stuff the 'real' ifp into the pkthdr, to be used in matching
2991 * in ip_input(); we need the loopback ifp/dl_tag passed as args
2992 * to make the loopback driver compliant with the data link
2993 * requirements.
2994 */
2995 copym->m_pkthdr.rcvif = origifp;
2996
2997 /*
2998 * Also record the source interface (which owns the source address).
2999 * This is basically a stripped down version of ifa_foraddr().
3000 */
3001 if (srcifp == NULL) {
3002 struct in_ifaddr *ia;
3003
3004 lck_rw_lock_shared(&in_ifaddr_rwlock);
3005 TAILQ_FOREACH(ia, INADDR_HASH(ip->ip_src.s_addr), ia_hash) {
3006 IFA_LOCK_SPIN(&ia->ia_ifa);
3007 if (IA_SIN(ia)->sin_addr.s_addr == ip->ip_src.s_addr) {
3008 srcifp = ia->ia_ifp;
3009 IFA_UNLOCK(&ia->ia_ifa);
3010 break;
3011 }
3012 IFA_UNLOCK(&ia->ia_ifa);
3013 }
3014 lck_rw_done(&in_ifaddr_rwlock);
3015 }
3016 if (srcifp != NULL) {
3017 ip_setsrcifaddr_info(copym, srcifp->if_index, NULL);
3018 }
3019 ip_setdstifaddr_info(copym, origifp->if_index, NULL);
3020
3021 dlil_output(lo_ifp, PF_INET, copym, NULL, SA(dst), 0, NULL);
3022 }
3023
3024 /*
3025 * Given a source IP address (and route, if available), determine the best
3026 * interface to send the packet from. Checking for (and updating) the
3027 * ROF_SRCIF_SELECTED flag in the pcb-supplied route placeholder is done
3028 * without any locks based on the assumption that ip_output() is single-
3029 * threaded per-pcb, i.e. for any given pcb there can only be one thread
3030 * performing output at the IP layer.
3031 *
3032 * This routine is analogous to in6_selectroute() for IPv6.
3033 */
3034 static struct ifaddr *
in_selectsrcif(struct ip * ip,struct route * ro,unsigned int ifscope)3035 in_selectsrcif(struct ip *ip, struct route *ro, unsigned int ifscope)
3036 {
3037 struct ifaddr *ifa = NULL;
3038 struct in_addr src = ip->ip_src;
3039 struct in_addr dst = ip->ip_dst;
3040 struct ifnet *rt_ifp;
3041 char s_src[MAX_IPv4_STR_LEN], s_dst[MAX_IPv4_STR_LEN];
3042
3043 VERIFY(src.s_addr != INADDR_ANY);
3044
3045 if (ip_select_srcif_debug) {
3046 (void) inet_ntop(AF_INET, &src.s_addr, s_src, sizeof(s_src));
3047 (void) inet_ntop(AF_INET, &dst.s_addr, s_dst, sizeof(s_dst));
3048 }
3049
3050 if (ro->ro_rt != NULL) {
3051 RT_LOCK(ro->ro_rt);
3052 }
3053
3054 rt_ifp = (ro->ro_rt != NULL) ? ro->ro_rt->rt_ifp : NULL;
3055
3056 /*
3057 * Given the source IP address, find a suitable source interface
3058 * to use for transmission; if the caller has specified a scope,
3059 * optimize the search by looking at the addresses only for that
3060 * interface. This is still suboptimal, however, as we need to
3061 * traverse the per-interface list.
3062 */
3063 if (ifscope != IFSCOPE_NONE || ro->ro_rt != NULL) {
3064 unsigned int scope = ifscope;
3065
3066 /*
3067 * If no scope is specified and the route is stale (pointing
3068 * to a defunct interface) use the current primary interface;
3069 * this happens when switching between interfaces configured
3070 * with the same IP address. Otherwise pick up the scope
3071 * information from the route; the ULP may have looked up a
3072 * correct route and we just need to verify it here and mark
3073 * it with the ROF_SRCIF_SELECTED flag below.
3074 */
3075 if (scope == IFSCOPE_NONE) {
3076 scope = rt_ifp->if_index;
3077 if (scope != get_primary_ifscope(AF_INET) &&
3078 ROUTE_UNUSABLE(ro)) {
3079 scope = get_primary_ifscope(AF_INET);
3080 }
3081 }
3082
3083 ifa = (struct ifaddr *)ifa_foraddr_scoped(src.s_addr, scope);
3084
3085 if (ifa == NULL && ip->ip_p != IPPROTO_UDP &&
3086 ip->ip_p != IPPROTO_TCP && ipforwarding) {
3087 /*
3088 * If forwarding is enabled, and if the packet isn't
3089 * TCP or UDP, check if the source address belongs
3090 * to one of our own interfaces; if so, demote the
3091 * interface scope and do a route lookup right below.
3092 */
3093 ifa = (struct ifaddr *)ifa_foraddr(src.s_addr);
3094 if (ifa != NULL) {
3095 IFA_REMREF(ifa);
3096 ifa = NULL;
3097 ifscope = IFSCOPE_NONE;
3098 }
3099 }
3100
3101 if (ip_select_srcif_debug && ifa != NULL) {
3102 if (ro->ro_rt != NULL) {
3103 printf("%s->%s ifscope %d->%d ifa_if %s "
3104 "ro_if %s\n", s_src, s_dst, ifscope,
3105 scope, if_name(ifa->ifa_ifp),
3106 if_name(rt_ifp));
3107 } else {
3108 printf("%s->%s ifscope %d->%d ifa_if %s\n",
3109 s_src, s_dst, ifscope, scope,
3110 if_name(ifa->ifa_ifp));
3111 }
3112 }
3113 }
3114
3115 /*
3116 * Slow path; search for an interface having the corresponding source
3117 * IP address if the scope was not specified by the caller, and:
3118 *
3119 * 1) There currently isn't any route, or,
3120 * 2) The interface used by the route does not own that source
3121 * IP address; in this case, the route will get blown away
3122 * and we'll do a more specific scoped search using the newly
3123 * found interface.
3124 */
3125 if (ifa == NULL && ifscope == IFSCOPE_NONE) {
3126 ifa = (struct ifaddr *)ifa_foraddr(src.s_addr);
3127
3128 /*
3129 * If we have the IP address, but not the route, we don't
3130 * really know whether or not it belongs to the correct
3131 * interface (it could be shared across multiple interfaces.)
3132 * The only way to find out is to do a route lookup.
3133 */
3134 if (ifa != NULL && ro->ro_rt == NULL) {
3135 struct rtentry *rt;
3136 struct sockaddr_in sin;
3137 struct ifaddr *oifa = NULL;
3138
3139 bzero(&sin, sizeof(sin));
3140 sin.sin_family = AF_INET;
3141 sin.sin_len = sizeof(sin);
3142 sin.sin_addr = dst;
3143
3144 lck_mtx_lock(rnh_lock);
3145 if ((rt = rt_lookup(TRUE, SA(&sin), NULL,
3146 rt_tables[AF_INET], IFSCOPE_NONE)) != NULL) {
3147 RT_LOCK(rt);
3148 /*
3149 * If the route uses a different interface,
3150 * use that one instead. The IP address of
3151 * the ifaddr that we pick up here is not
3152 * relevant.
3153 */
3154 if (ifa->ifa_ifp != rt->rt_ifp) {
3155 oifa = ifa;
3156 ifa = rt->rt_ifa;
3157 IFA_ADDREF(ifa);
3158 RT_UNLOCK(rt);
3159 } else {
3160 RT_UNLOCK(rt);
3161 }
3162 rtfree_locked(rt);
3163 }
3164 lck_mtx_unlock(rnh_lock);
3165
3166 if (oifa != NULL) {
3167 struct ifaddr *iifa;
3168
3169 /*
3170 * See if the interface pointed to by the
3171 * route is configured with the source IP
3172 * address of the packet.
3173 */
3174 iifa = (struct ifaddr *)ifa_foraddr_scoped(
3175 src.s_addr, ifa->ifa_ifp->if_index);
3176
3177 if (iifa != NULL) {
3178 /*
3179 * Found it; drop the original one
3180 * as well as the route interface
3181 * address, and use this instead.
3182 */
3183 IFA_REMREF(oifa);
3184 IFA_REMREF(ifa);
3185 ifa = iifa;
3186 } else if (!ipforwarding ||
3187 (rt->rt_flags & RTF_GATEWAY)) {
3188 /*
3189 * This interface doesn't have that
3190 * source IP address; drop the route
3191 * interface address and just use the
3192 * original one, and let the caller
3193 * do a scoped route lookup.
3194 */
3195 IFA_REMREF(ifa);
3196 ifa = oifa;
3197 } else {
3198 /*
3199 * Forwarding is enabled and the source
3200 * address belongs to one of our own
3201 * interfaces which isn't the outgoing
3202 * interface, and we have a route, and
3203 * the destination is on a network that
3204 * is directly attached (onlink); drop
3205 * the original one and use the route
3206 * interface address instead.
3207 */
3208 IFA_REMREF(oifa);
3209 }
3210 }
3211 } else if (ifa != NULL && ro->ro_rt != NULL &&
3212 !(ro->ro_rt->rt_flags & RTF_GATEWAY) &&
3213 ifa->ifa_ifp != ro->ro_rt->rt_ifp && ipforwarding) {
3214 /*
3215 * Forwarding is enabled and the source address belongs
3216 * to one of our own interfaces which isn't the same
3217 * as the interface used by the known route; drop the
3218 * original one and use the route interface address.
3219 */
3220 IFA_REMREF(ifa);
3221 ifa = ro->ro_rt->rt_ifa;
3222 IFA_ADDREF(ifa);
3223 }
3224
3225 if (ip_select_srcif_debug && ifa != NULL) {
3226 printf("%s->%s ifscope %d ifa_if %s\n",
3227 s_src, s_dst, ifscope, if_name(ifa->ifa_ifp));
3228 }
3229 }
3230
3231 if (ro->ro_rt != NULL) {
3232 RT_LOCK_ASSERT_HELD(ro->ro_rt);
3233 }
3234 /*
3235 * If there is a non-loopback route with the wrong interface, or if
3236 * there is no interface configured with such an address, blow it
3237 * away. Except for local/loopback, we look for one with a matching
3238 * interface scope/index.
3239 */
3240 if (ro->ro_rt != NULL &&
3241 (ifa == NULL || (ifa->ifa_ifp != rt_ifp && rt_ifp != lo_ifp) ||
3242 !(ro->ro_rt->rt_flags & RTF_UP))) {
3243 if (ip_select_srcif_debug) {
3244 if (ifa != NULL) {
3245 printf("%s->%s ifscope %d ro_if %s != "
3246 "ifa_if %s (cached route cleared)\n",
3247 s_src, s_dst, ifscope, if_name(rt_ifp),
3248 if_name(ifa->ifa_ifp));
3249 } else {
3250 printf("%s->%s ifscope %d ro_if %s "
3251 "(no ifa_if found)\n",
3252 s_src, s_dst, ifscope, if_name(rt_ifp));
3253 }
3254 }
3255
3256 RT_UNLOCK(ro->ro_rt);
3257 ROUTE_RELEASE(ro);
3258
3259 /*
3260 * If the destination is IPv4 LLA and the route's interface
3261 * doesn't match the source interface, then the source IP
3262 * address is wrong; it most likely belongs to the primary
3263 * interface associated with the IPv4 LL subnet. Drop the
3264 * packet rather than letting it go out and return an error
3265 * to the ULP. This actually applies not only to IPv4 LL
3266 * but other shared subnets; for now we explicitly test only
3267 * for the former case and save the latter for future.
3268 */
3269 if (IN_LINKLOCAL(ntohl(dst.s_addr)) &&
3270 !IN_LINKLOCAL(ntohl(src.s_addr)) && ifa != NULL) {
3271 IFA_REMREF(ifa);
3272 ifa = NULL;
3273 }
3274 }
3275
3276 if (ip_select_srcif_debug && ifa == NULL) {
3277 printf("%s->%s ifscope %d (neither ro_if/ifa_if found)\n",
3278 s_src, s_dst, ifscope);
3279 }
3280
3281 /*
3282 * If there is a route, mark it accordingly. If there isn't one,
3283 * we'll get here again during the next transmit (possibly with a
3284 * route) and the flag will get set at that point. For IPv4 LLA
3285 * destination, mark it only if the route has been fully resolved;
3286 * otherwise we want to come back here again when the route points
3287 * to the interface over which the ARP reply arrives on.
3288 */
3289 if (ro->ro_rt != NULL && (!IN_LINKLOCAL(ntohl(dst.s_addr)) ||
3290 (ro->ro_rt->rt_gateway->sa_family == AF_LINK &&
3291 SDL(ro->ro_rt->rt_gateway)->sdl_alen != 0))) {
3292 if (ifa != NULL) {
3293 IFA_ADDREF(ifa); /* for route */
3294 }
3295 if (ro->ro_srcia != NULL) {
3296 IFA_REMREF(ro->ro_srcia);
3297 }
3298 ro->ro_srcia = ifa;
3299 ro->ro_flags |= ROF_SRCIF_SELECTED;
3300 RT_GENID_SYNC(ro->ro_rt);
3301 }
3302
3303 if (ro->ro_rt != NULL) {
3304 RT_UNLOCK(ro->ro_rt);
3305 }
3306
3307 return ifa;
3308 }
3309
3310 /*
3311 * @brief Given outgoing interface it determines what checksum needs
3312 * to be computed in software and what needs to be offloaded to the
3313 * interface.
3314 *
3315 * @param ifp Pointer to the outgoing interface
3316 * @param m Pointer to the packet
3317 * @param hlen IP header length
3318 * @param ip_len Total packet size i.e. headers + data payload
3319 * @param sw_csum Pointer to a software checksum flag set
3320 *
3321 * @return void
3322 */
3323 void
ip_output_checksum(struct ifnet * ifp,struct mbuf * m,int hlen,int ip_len,uint32_t * sw_csum)3324 ip_output_checksum(struct ifnet *ifp, struct mbuf *m, int hlen, int ip_len,
3325 uint32_t *sw_csum)
3326 {
3327 int tso = TSO_IPV4_OK(ifp, m);
3328 uint32_t hwcap = ifp->if_hwassist;
3329
3330 m->m_pkthdr.csum_flags |= CSUM_IP;
3331
3332 if (!hwcksum_tx) {
3333 /* do all in software; hardware checksum offload is disabled */
3334 *sw_csum = (CSUM_DELAY_DATA | CSUM_DELAY_IP) &
3335 m->m_pkthdr.csum_flags;
3336 } else {
3337 /* do in software what the hardware cannot */
3338 *sw_csum = m->m_pkthdr.csum_flags &
3339 ~IF_HWASSIST_CSUM_FLAGS(hwcap);
3340 }
3341
3342 if (hlen != sizeof(struct ip)) {
3343 *sw_csum |= ((CSUM_DELAY_DATA | CSUM_DELAY_IP) &
3344 m->m_pkthdr.csum_flags);
3345 } else if (!(*sw_csum & CSUM_DELAY_DATA) && (hwcap & CSUM_PARTIAL)) {
3346 int interface_mtu = ifp->if_mtu;
3347
3348 if (INTF_ADJUST_MTU_FOR_CLAT46(ifp)) {
3349 interface_mtu = IN6_LINKMTU(ifp);
3350 /* Further adjust the size for CLAT46 expansion */
3351 interface_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
3352 }
3353
3354 /*
3355 * Partial checksum offload, if non-IP fragment, and TCP only
3356 * (no UDP support, as the hardware may not be able to convert
3357 * +0 to -0 (0xffff) per RFC1122 4.1.3.4. unless the interface
3358 * supports "invert zero" capability.)
3359 */
3360 if (hwcksum_tx && !tso &&
3361 ((m->m_pkthdr.csum_flags & CSUM_TCP) ||
3362 ((hwcap & CSUM_ZERO_INVERT) &&
3363 (m->m_pkthdr.csum_flags & CSUM_ZERO_INVERT))) &&
3364 ip_len <= interface_mtu) {
3365 uint16_t start = sizeof(struct ip);
3366 uint16_t ulpoff = m->m_pkthdr.csum_data & 0xffff;
3367 m->m_pkthdr.csum_flags |=
3368 (CSUM_DATA_VALID | CSUM_PARTIAL);
3369 m->m_pkthdr.csum_tx_stuff = (ulpoff + start);
3370 m->m_pkthdr.csum_tx_start = start;
3371 /* do IP hdr chksum in software */
3372 *sw_csum = CSUM_DELAY_IP;
3373 } else {
3374 *sw_csum |= (CSUM_DELAY_DATA & m->m_pkthdr.csum_flags);
3375 }
3376 }
3377
3378 if (*sw_csum & CSUM_DELAY_DATA) {
3379 in_delayed_cksum(m);
3380 *sw_csum &= ~CSUM_DELAY_DATA;
3381 }
3382
3383 if (hwcksum_tx) {
3384 /*
3385 * Drop off bits that aren't supported by hardware;
3386 * also make sure to preserve non-checksum related bits.
3387 */
3388 m->m_pkthdr.csum_flags =
3389 ((m->m_pkthdr.csum_flags &
3390 (IF_HWASSIST_CSUM_FLAGS(hwcap) | CSUM_DATA_VALID)) |
3391 (m->m_pkthdr.csum_flags & ~IF_HWASSIST_CSUM_MASK));
3392 } else {
3393 /* drop all bits; hardware checksum offload is disabled */
3394 m->m_pkthdr.csum_flags = 0;
3395 }
3396 }
3397
3398 /*
3399 * GRE protocol output for PPP/PPTP
3400 */
3401 int
ip_gre_output(struct mbuf * m)3402 ip_gre_output(struct mbuf *m)
3403 {
3404 struct route ro;
3405 int error;
3406
3407 bzero(&ro, sizeof(ro));
3408
3409 error = ip_output(m, NULL, &ro, 0, NULL, NULL);
3410
3411 ROUTE_RELEASE(&ro);
3412
3413 return error;
3414 }
3415
3416 static int
3417 sysctl_reset_ip_output_stats SYSCTL_HANDLER_ARGS
3418 {
3419 #pragma unused(arg1, arg2)
3420 int error, i;
3421
3422 i = ip_output_measure;
3423 error = sysctl_handle_int(oidp, &i, 0, req);
3424 if (error || req->newptr == USER_ADDR_NULL) {
3425 goto done;
3426 }
3427 /* impose bounds */
3428 if (i < 0 || i > 1) {
3429 error = EINVAL;
3430 goto done;
3431 }
3432 if (ip_output_measure != i && i == 1) {
3433 net_perf_initialize(&net_perf, ip_output_measure_bins);
3434 }
3435 ip_output_measure = i;
3436 done:
3437 return error;
3438 }
3439
3440 static int
3441 sysctl_ip_output_measure_bins SYSCTL_HANDLER_ARGS
3442 {
3443 #pragma unused(arg1, arg2)
3444 int error;
3445 uint64_t i;
3446
3447 i = ip_output_measure_bins;
3448 error = sysctl_handle_quad(oidp, &i, 0, req);
3449 if (error || req->newptr == USER_ADDR_NULL) {
3450 goto done;
3451 }
3452 /* validate data */
3453 if (!net_perf_validate_bins(i)) {
3454 error = EINVAL;
3455 goto done;
3456 }
3457 ip_output_measure_bins = i;
3458 done:
3459 return error;
3460 }
3461
3462 static int
3463 sysctl_ip_output_getperf SYSCTL_HANDLER_ARGS
3464 {
3465 #pragma unused(oidp, arg1, arg2)
3466 if (req->oldptr == USER_ADDR_NULL) {
3467 req->oldlen = (size_t)sizeof(struct ipstat);
3468 }
3469
3470 return SYSCTL_OUT(req, &net_perf, MIN(sizeof(net_perf), req->oldlen));
3471 }
3472