1/*
2 * Copyright (c) 2004-2022 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1982, 1989, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 */
61
62#include <kern/debug.h>
63#include <netinet/in_arp.h>
64#include <sys/types.h>
65#include <sys/param.h>
66#include <sys/kernel_types.h>
67#include <sys/syslog.h>
68#include <sys/systm.h>
69#include <sys/time.h>
70#include <sys/kernel.h>
71#include <sys/mbuf.h>
72#include <sys/sysctl.h>
73#include <sys/mcache.h>
74#include <sys/protosw.h>
75#include <string.h>
76#include <net/if_arp.h>
77#include <net/if_dl.h>
78#include <net/dlil.h>
79#include <net/if_types.h>
80#include <net/if_llreach.h>
81#include <net/route.h>
82#include <net/nwk_wq.h>
83
84#include <netinet/if_ether.h>
85#include <netinet/in_var.h>
86#include <netinet/ip.h>
87#include <netinet/ip6.h>
88#include <kern/zalloc.h>
89
90#include <kern/thread.h>
91#include <kern/sched_prim.h>
92
93#include <net/sockaddr_utils.h>
94
95#define CONST_LLADDR(s) ((const u_char*)((s)->sdl_data + (s)->sdl_nlen))
96
97static const size_t MAX_HW_LEN = 10;
98
99/*
100 * Synchronization notes:
101 *
102 * The global list of ARP entries are stored in llinfo_arp; an entry
103 * gets inserted into the list when the route is created and gets
104 * removed from the list when it is deleted; this is done as part
105 * of RTM_ADD/RTM_RESOLVE/RTM_DELETE in arp_rtrequest().
106 *
107 * Because rnh_lock and rt_lock for the entry are held during those
108 * operations, the same locks (and thus lock ordering) must be used
109 * elsewhere to access the relevant data structure fields:
110 *
111 * la_le.{le_next,le_prev}, la_rt
112 *
113 * - Routing lock (rnh_lock)
114 *
115 * la_holdq, la_asked, la_llreach, la_lastused, la_flags
116 *
117 * - Routing entry lock (rt_lock)
118 *
119 * Due to the dependency on rt_lock, llinfo_arp has the same lifetime
120 * as the route entry itself. When a route is deleted (RTM_DELETE),
121 * it is simply removed from the global list but the memory is not
122 * freed until the route itself is freed.
123 */
124struct llinfo_arp {
125 /*
126 * The following are protected by rnh_lock
127 */
128 LIST_ENTRY(llinfo_arp) la_le;
129 struct rtentry *la_rt;
130 /*
131 * The following are protected by rt_lock
132 */
133 class_queue_t la_holdq; /* packets awaiting resolution */
134 struct if_llreach *la_llreach; /* link-layer reachability record */
135 u_int64_t la_lastused; /* last used timestamp */
136 u_int32_t la_asked; /* # of requests sent */
137 u_int32_t la_maxtries; /* retry limit */
138 u_int64_t la_probeexp; /* probe deadline timestamp */
139 u_int32_t la_prbreq_cnt; /* probe request count */
140 u_int32_t la_flags;
141#define LLINFO_RTRFAIL_EVTSENT 0x1 /* sent an ARP event */
142#define LLINFO_PROBING 0x2 /* waiting for an ARP reply */
143};
144
145static LIST_HEAD(, llinfo_arp) llinfo_arp;
146
147static thread_call_t arp_timeout_tcall;
148static int arp_timeout_run; /* arp_timeout is scheduled to run */
149static void arp_timeout(thread_call_param_t arg0, thread_call_param_t arg1);
150static void arp_sched_timeout(struct timeval *);
151
152static thread_call_t arp_probe_tcall;
153static int arp_probe_run; /* arp_probe is scheduled to run */
154static void arp_probe(thread_call_param_t arg0, thread_call_param_t arg1);
155static void arp_sched_probe(struct timeval *);
156
157static void arptfree(struct llinfo_arp *, void *);
158static errno_t arp_lookup_route(const struct in_addr *, int,
159 int, route_t *, unsigned int);
160static int arp_getstat SYSCTL_HANDLER_ARGS;
161
162static struct llinfo_arp *arp_llinfo_alloc(zalloc_flags_t);
163static void arp_llinfo_free(void *);
164static uint32_t arp_llinfo_flushq(struct llinfo_arp *);
165static void arp_llinfo_purge(struct rtentry *);
166static void arp_llinfo_get_ri(struct rtentry *, struct rt_reach_info *);
167static void arp_llinfo_get_iflri(struct rtentry *, struct ifnet_llreach_info *);
168static void arp_llinfo_refresh(struct rtentry *);
169
170static __inline void arp_llreach_use(struct llinfo_arp *);
171static __inline int arp_llreach_reachable(struct llinfo_arp *);
172static void arp_llreach_alloc(struct rtentry *, struct ifnet *, void *,
173 unsigned int, boolean_t, uint32_t *);
174
175extern int tvtohz(struct timeval *);
176
177static int arpinit_done;
178
179SYSCTL_DECL(_net_link_ether);
180SYSCTL_NODE(_net_link_ether, PF_INET, inet, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "");
181
182static int arpt_prune = (5 * 60 * 1); /* walk list every 5 minutes */
183SYSCTL_INT(_net_link_ether_inet, OID_AUTO, prune_intvl,
184 CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_prune, 0, "");
185
186#define ARP_PROBE_TIME 7 /* seconds */
187static u_int32_t arpt_probe = ARP_PROBE_TIME;
188SYSCTL_UINT(_net_link_ether_inet, OID_AUTO, probe_intvl,
189 CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_probe, 0, "");
190
191static int arpt_keep = (20 * 60); /* once resolved, good for 20 more minutes */
192SYSCTL_INT(_net_link_ether_inet, OID_AUTO, max_age,
193 CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_keep, 0, "");
194
195static int arpt_down = 20; /* once declared down, don't send for 20 sec */
196SYSCTL_INT(_net_link_ether_inet, OID_AUTO, host_down_time,
197 CTLFLAG_RW | CTLFLAG_LOCKED, &arpt_down, 0, "");
198
199static int arp_llreach_base = 120; /* seconds */
200SYSCTL_INT(_net_link_ether_inet, OID_AUTO, arp_llreach_base,
201 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_llreach_base, 0,
202 "default ARP link-layer reachability max lifetime (in seconds)");
203
204#define ARP_UNICAST_LIMIT 3 /* # of probes until ARP refresh broadcast */
205static u_int32_t arp_unicast_lim = ARP_UNICAST_LIMIT;
206SYSCTL_INT(_net_link_ether_inet, OID_AUTO, arp_unicast_lim,
207 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_unicast_lim, ARP_UNICAST_LIMIT,
208 "number of unicast ARP refresh probes before using broadcast");
209
210static u_int32_t arp_maxtries = 5;
211SYSCTL_INT(_net_link_ether_inet, OID_AUTO, maxtries,
212 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_maxtries, 0, "");
213
214static u_int32_t arp_maxhold = 16;
215SYSCTL_UINT(_net_link_ether_inet, OID_AUTO, maxhold,
216 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_maxhold, 0, "");
217
218static int useloopback = 1; /* use loopback interface for local traffic */
219SYSCTL_INT(_net_link_ether_inet, OID_AUTO, useloopback,
220 CTLFLAG_RW | CTLFLAG_LOCKED, &useloopback, 0, "");
221
222static int arp_proxyall = 0;
223SYSCTL_INT(_net_link_ether_inet, OID_AUTO, proxyall,
224 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_proxyall, 0, "");
225
226static int arp_sendllconflict = 0;
227SYSCTL_INT(_net_link_ether_inet, OID_AUTO, sendllconflict,
228 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_sendllconflict, 0, "");
229
230static int log_arp_warnings = 0; /* Thread safe: no accumulated state */
231SYSCTL_INT(_net_link_ether_inet, OID_AUTO, log_arp_warnings,
232 CTLFLAG_RW | CTLFLAG_LOCKED,
233 &log_arp_warnings, 0,
234 "log arp warning messages");
235
236static int keep_announcements = 1; /* Thread safe: no aging of state */
237SYSCTL_INT(_net_link_ether_inet, OID_AUTO, keep_announcements,
238 CTLFLAG_RW | CTLFLAG_LOCKED,
239 &keep_announcements, 0,
240 "keep arp announcements");
241
242static int send_conflicting_probes = 1; /* Thread safe: no accumulated state */
243SYSCTL_INT(_net_link_ether_inet, OID_AUTO, send_conflicting_probes,
244 CTLFLAG_RW | CTLFLAG_LOCKED,
245 &send_conflicting_probes, 0,
246 "send conflicting link-local arp probes");
247
248static int arp_verbose;
249SYSCTL_INT(_net_link_ether_inet, OID_AUTO, verbose,
250 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_verbose, 0, "");
251
252static uint32_t arp_maxhold_total = 1024; /* max total packets in the holdq */
253SYSCTL_INT(_net_link_ether_inet, OID_AUTO, maxhold_total,
254 CTLFLAG_RW | CTLFLAG_LOCKED, &arp_maxhold_total, 0, "");
255
256
257/*
258 * Generally protected by rnh_lock; use atomic operations on fields
259 * that are also modified outside of that lock (if needed).
260 */
261struct arpstat arpstat __attribute__((aligned(sizeof(uint64_t))));
262SYSCTL_PROC(_net_link_ether_inet, OID_AUTO, stats,
263 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
264 0, 0, arp_getstat, "S,arpstat",
265 "ARP statistics (struct arpstat, net/if_arp.h)");
266
267static KALLOC_TYPE_DEFINE(llinfo_arp_zone, struct llinfo_arp, NET_KT_DEFAULT);
268
269void
270arp_init(void)
271{
272 VERIFY(!arpinit_done);
273
274 LIST_INIT(&llinfo_arp);
275
276 arpinit_done = 1;
277}
278
279static struct llinfo_arp *
280arp_llinfo_alloc(zalloc_flags_t how)
281{
282 struct llinfo_arp *la = zalloc_flags(llinfo_arp_zone, how | Z_ZERO);
283
284 if (la) {
285 /*
286 * The type of queue (Q_DROPHEAD) here is just a hint;
287 * the actual logic that works on this queue performs
288 * a head drop, details in arp_llinfo_addq().
289 */
290 _qinit(&la->la_holdq, Q_DROPHEAD, (arp_maxhold == 0) ?
291 (uint32_t)-1 : arp_maxhold, QP_MBUF);
292 }
293 return la;
294}
295
296static void
297arp_llinfo_free(void *arg)
298{
299 struct llinfo_arp *la = arg;
300
301 if (la->la_le.le_next != NULL || la->la_le.le_prev != NULL) {
302 panic("%s: trying to free %p when it is in use", __func__, la);
303 /* NOTREACHED */
304 }
305
306 /* Free any held packets */
307 (void) arp_llinfo_flushq(la);
308
309 /* Purge any link-layer info caching */
310 VERIFY(la->la_rt->rt_llinfo == la);
311 if (la->la_rt->rt_llinfo_purge != NULL) {
312 la->la_rt->rt_llinfo_purge(la->la_rt);
313 }
314
315 zfree(llinfo_arp_zone, la);
316}
317
318static bool
319arp_llinfo_addq(struct llinfo_arp *la, struct mbuf *m)
320{
321 classq_pkt_t pkt = CLASSQ_PKT_INITIALIZER(pkt);
322
323 if (arpstat.held >= arp_maxhold_total) {
324 if (arp_verbose) {
325 log(LOG_DEBUG,
326 "%s: dropping packet due to maxhold_total\n",
327 __func__);
328 }
329 os_atomic_inc(&arpstat.dropped, relaxed);
330 return false;
331 }
332
333 if (qlen(&la->la_holdq) >= qlimit(&la->la_holdq)) {
334 struct mbuf *_m;
335 /* prune less than CTL, else take what's at the head */
336 _getq_scidx_lt(&la->la_holdq, &pkt, SCIDX_CTL);
337 _m = pkt.cp_mbuf;
338 if (_m == NULL) {
339 _getq(&la->la_holdq, &pkt);
340 _m = pkt.cp_mbuf;
341 }
342 VERIFY(_m != NULL);
343 if (arp_verbose) {
344 log(LOG_DEBUG, "%s: dropping packet (scidx %u)\n",
345 __func__, MBUF_SCIDX(mbuf_get_service_class(_m)));
346 }
347 m_freem(_m);
348 os_atomic_inc(&arpstat.dropped, relaxed);
349 os_atomic_dec(&arpstat.held, relaxed);
350 }
351 CLASSQ_PKT_INIT_MBUF(&pkt, m);
352 _addq(&la->la_holdq, &pkt);
353 os_atomic_inc(&arpstat.held, relaxed);
354 if (arp_verbose) {
355 log(LOG_DEBUG, "%s: enqueued packet (scidx %u), qlen now %u\n",
356 __func__, MBUF_SCIDX(mbuf_get_service_class(m)),
357 qlen(&la->la_holdq));
358 }
359
360 return true;
361}
362
363static uint32_t
364arp_llinfo_flushq(struct llinfo_arp *la)
365{
366 uint32_t held = qlen(&la->la_holdq);
367
368 if (held != 0) {
369 os_atomic_add(&arpstat.purged, held, relaxed);
370 os_atomic_add(&arpstat.held, -held, relaxed);
371 _flushq(&la->la_holdq);
372 }
373 la->la_prbreq_cnt = 0;
374 VERIFY(qempty(&la->la_holdq));
375 return held;
376}
377
378static void
379arp_llinfo_purge(struct rtentry *rt)
380{
381 struct llinfo_arp *la = rt->rt_llinfo;
382
383 RT_LOCK_ASSERT_HELD(rt);
384 VERIFY(rt->rt_llinfo_purge == arp_llinfo_purge && la != NULL);
385
386 if (la->la_llreach != NULL) {
387 RT_CONVERT_LOCK(rt);
388 ifnet_llreach_free(la->la_llreach);
389 la->la_llreach = NULL;
390 }
391 la->la_lastused = 0;
392}
393
394static void
395arp_llinfo_get_ri(struct rtentry *rt, struct rt_reach_info *ri)
396{
397 struct llinfo_arp *la = rt->rt_llinfo;
398 struct if_llreach *lr = la->la_llreach;
399
400 if (lr == NULL) {
401 bzero(s: ri, n: sizeof(*ri));
402 ri->ri_rssi = IFNET_RSSI_UNKNOWN;
403 ri->ri_lqm = IFNET_LQM_THRESH_OFF;
404 ri->ri_npm = IFNET_NPM_THRESH_UNKNOWN;
405 } else {
406 IFLR_LOCK(lr);
407 /* Export to rt_reach_info structure */
408 ifnet_lr2ri(lr, ri);
409 /* Export ARP send expiration (calendar) time */
410 ri->ri_snd_expire =
411 ifnet_llreach_up2calexp(lr, la->la_lastused);
412 IFLR_UNLOCK(lr);
413 }
414}
415
416static void
417arp_llinfo_get_iflri(struct rtentry *rt, struct ifnet_llreach_info *iflri)
418{
419 struct llinfo_arp *la = rt->rt_llinfo;
420 struct if_llreach *lr = la->la_llreach;
421
422 if (lr == NULL) {
423 bzero(s: iflri, n: sizeof(*iflri));
424 iflri->iflri_rssi = IFNET_RSSI_UNKNOWN;
425 iflri->iflri_lqm = IFNET_LQM_THRESH_OFF;
426 iflri->iflri_npm = IFNET_NPM_THRESH_UNKNOWN;
427 } else {
428 IFLR_LOCK(lr);
429 /* Export to ifnet_llreach_info structure */
430 ifnet_lr2iflri(lr, iflri);
431 /* Export ARP send expiration (uptime) time */
432 iflri->iflri_snd_expire =
433 ifnet_llreach_up2upexp(lr, la->la_lastused);
434 IFLR_UNLOCK(lr);
435 }
436}
437
438static void
439arp_llinfo_refresh(struct rtentry *rt)
440{
441 uint64_t timenow = net_uptime();
442 /*
443 * If route entry is permanent or if expiry is less
444 * than timenow and extra time taken for unicast probe
445 * we can't expedite the refresh
446 */
447 if ((rt->rt_expire == 0) ||
448 (rt->rt_flags & RTF_STATIC) ||
449 !(rt->rt_flags & RTF_LLINFO)) {
450 return;
451 }
452
453 if (rt->rt_expire > timenow) {
454 rt->rt_expire = timenow;
455 }
456 return;
457}
458
459void
460arp_llreach_set_reachable(struct ifnet *ifp, void *addr, unsigned int alen)
461{
462 /* Nothing more to do if it's disabled */
463 if (arp_llreach_base == 0) {
464 return;
465 }
466
467 ifnet_llreach_set_reachable(ifp, ETHERTYPE_IP, addr, alen);
468}
469
470static __inline void
471arp_llreach_use(struct llinfo_arp *la)
472{
473 if (la->la_llreach != NULL) {
474 la->la_lastused = net_uptime();
475 }
476}
477
478static __inline int
479arp_llreach_reachable(struct llinfo_arp *la)
480{
481 struct if_llreach *lr;
482 const char *why = NULL;
483
484 /* Nothing more to do if it's disabled; pretend it's reachable */
485 if (arp_llreach_base == 0) {
486 return 1;
487 }
488
489 if ((lr = la->la_llreach) == NULL) {
490 /*
491 * Link-layer reachability record isn't present for this
492 * ARP entry; pretend it's reachable and use it as is.
493 */
494 return 1;
495 } else if (ifnet_llreach_reachable(lr)) {
496 /*
497 * Record is present, it's not shared with other ARP
498 * entries and a packet has recently been received
499 * from the remote host; consider it reachable.
500 */
501 if (lr->lr_reqcnt == 1) {
502 return 1;
503 }
504
505 /* Prime it up, if this is the first time */
506 if (la->la_lastused == 0) {
507 VERIFY(la->la_llreach != NULL);
508 arp_llreach_use(la);
509 }
510
511 /*
512 * Record is present and shared with one or more ARP
513 * entries, and a packet has recently been received
514 * from the remote host. Since it's shared by more
515 * than one IP addresses, we can't rely on the link-
516 * layer reachability alone; consider it reachable if
517 * this ARP entry has been used "recently."
518 */
519 if (ifnet_llreach_reachable_delta(lr, la->la_lastused)) {
520 return 1;
521 }
522
523 why = "has alias(es) and hasn't been used in a while";
524 } else {
525 why = "haven't heard from it in a while";
526 }
527
528 if (arp_verbose > 1) {
529 char tmp[MAX_IPv4_STR_LEN];
530 u_int64_t now = net_uptime();
531
532 log(LOG_DEBUG, "%s: ARP probe(s) needed for %s; "
533 "%s [lastused %lld, lastrcvd %lld] secs ago\n",
534 if_name(lr->lr_ifp), inet_ntop(AF_INET,
535 &SIN(rt_key(la->la_rt))->sin_addr, tmp, sizeof(tmp)), why,
536 (la->la_lastused ? (int64_t)(now - la->la_lastused) : -1),
537 (lr->lr_lastrcvd ? (int64_t)(now - lr->lr_lastrcvd) : -1));
538 }
539 return 0;
540}
541
542/*
543 * Obtain a link-layer source cache entry for the sender.
544 *
545 * NOTE: This is currently only for ARP/Ethernet.
546 */
547static void
548arp_llreach_alloc(struct rtentry *rt, struct ifnet *ifp, void *addr,
549 unsigned int alen, boolean_t solicited, uint32_t *p_rt_event_code)
550{
551 VERIFY(rt->rt_expire == 0 || rt->rt_rmx.rmx_expire != 0);
552 VERIFY(rt->rt_expire != 0 || rt->rt_rmx.rmx_expire == 0);
553
554 if (arp_llreach_base != 0 && rt->rt_expire != 0 &&
555 !(rt->rt_ifp->if_flags & IFF_LOOPBACK) &&
556 ifp->if_addrlen == IF_LLREACH_MAXLEN && /* Ethernet */
557 alen == ifp->if_addrlen) {
558 struct llinfo_arp *la = rt->rt_llinfo;
559 struct if_llreach *lr;
560 const char *why = NULL, *type = "";
561
562 /* Become a regular mutex, just in case */
563 RT_CONVERT_LOCK(rt);
564
565 if ((lr = la->la_llreach) != NULL) {
566 type = (solicited ? "ARP reply" : "ARP announcement");
567 /*
568 * If target has changed, create a new record;
569 * otherwise keep existing record.
570 */
571 IFLR_LOCK(lr);
572 if (bcmp(s1: addr, s2: lr->lr_key.addr, n: alen) != 0) {
573 IFLR_UNLOCK(lr);
574 /* Purge any link-layer info caching */
575 VERIFY(rt->rt_llinfo_purge != NULL);
576 rt->rt_llinfo_purge(rt);
577 lr = NULL;
578 why = " for different target HW address; "
579 "using new llreach record";
580 *p_rt_event_code = ROUTE_LLENTRY_CHANGED;
581 } else {
582 /*
583 * If we were doing unicast probing, we need to
584 * deliver an event for neighbor cache resolution
585 */
586 if (lr->lr_probes != 0) {
587 *p_rt_event_code = ROUTE_LLENTRY_RESOLVED;
588 }
589
590 lr->lr_probes = 0; /* reset probe count */
591 IFLR_UNLOCK(lr);
592 if (solicited) {
593 why = " for same target HW address; "
594 "keeping existing llreach record";
595 }
596 }
597 }
598
599 if (lr == NULL) {
600 lr = la->la_llreach = ifnet_llreach_alloc(ifp,
601 ETHERTYPE_IP, addr, alen, arp_llreach_base);
602 if (lr != NULL) {
603 lr->lr_probes = 0; /* reset probe count */
604 if (why == NULL) {
605 why = "creating new llreach record";
606 }
607 }
608 *p_rt_event_code = ROUTE_LLENTRY_RESOLVED;
609 }
610
611 if (arp_verbose > 1 && lr != NULL && why != NULL) {
612 char tmp[MAX_IPv4_STR_LEN];
613
614 log(LOG_DEBUG, "%s: %s%s for %s\n", if_name(ifp),
615 type, why, inet_ntop(AF_INET,
616 &SIN(rt_key(rt))->sin_addr, tmp, sizeof(tmp)));
617 }
618 }
619}
620
621struct arptf_arg {
622 boolean_t draining;
623 boolean_t probing;
624 uint32_t killed;
625 uint32_t aging;
626 uint32_t sticky;
627 uint32_t found;
628 uint32_t qlen;
629 uint32_t qsize;
630};
631
632/*
633 * Free an arp entry.
634 */
635static void
636arptfree(struct llinfo_arp *la, void *arg)
637{
638 struct arptf_arg *ap = arg;
639 struct rtentry *rt = la->la_rt;
640 uint64_t timenow;
641
642 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
643
644 /* rnh_lock acquired by caller protects rt from going away */
645 RT_LOCK(rt);
646
647 VERIFY(rt->rt_expire == 0 || rt->rt_rmx.rmx_expire != 0);
648 VERIFY(rt->rt_expire != 0 || rt->rt_rmx.rmx_expire == 0);
649
650 ap->found++;
651 timenow = net_uptime();
652
653 /* If we're probing, flush out held packets upon probe expiration */
654 if (ap->probing && (la->la_flags & LLINFO_PROBING) &&
655 la->la_probeexp <= timenow) {
656 struct sockaddr_dl *sdl = SDL(rt->rt_gateway);
657 if (sdl != NULL) {
658 sdl->sdl_alen = 0;
659 }
660 (void) arp_llinfo_flushq(la);
661 /*
662 * Enqueue work item to invoke callback for this route entry
663 */
664 route_event_enqueue_nwk_wq_entry(rt, NULL,
665 ROUTE_LLENTRY_UNREACH, NULL, TRUE);
666 }
667
668 /*
669 * The following is mostly being used to arm the timer
670 * again and for logging.
671 * qlen is used to re-arm the timer. Therefore, pure probe
672 * requests can be considered as 0 length packets
673 * contributing only to length but not to the size.
674 */
675 ap->qlen += qlen(&la->la_holdq);
676 ap->qlen += la->la_prbreq_cnt;
677 ap->qsize += qsize(&la->la_holdq);
678
679 if (rt->rt_expire == 0 || (rt->rt_flags & RTF_STATIC)) {
680 ap->sticky++;
681 /* ARP entry is permanent? */
682 if (rt->rt_expire == 0) {
683 RT_UNLOCK(rt);
684 return;
685 }
686 }
687
688 /* ARP entry hasn't expired and we're not draining? */
689 if (!ap->draining && rt->rt_expire > timenow) {
690 RT_UNLOCK(rt);
691 ap->aging++;
692 return;
693 }
694
695 if (rt->rt_refcnt > 0) {
696 /*
697 * ARP entry has expired, with outstanding refcnt.
698 * If we're not draining, force ARP query to be
699 * generated next time this entry is used.
700 */
701 if (!ap->draining && !ap->probing) {
702 struct sockaddr_dl *sdl = SDL(rt->rt_gateway);
703 if (sdl != NULL) {
704 sdl->sdl_alen = 0;
705 }
706 la->la_asked = 0;
707 rt->rt_flags &= ~RTF_REJECT;
708 }
709 RT_UNLOCK(rt);
710 } else if (!(rt->rt_flags & RTF_STATIC) && !ap->probing) {
711 /*
712 * ARP entry has no outstanding refcnt, and we're either
713 * draining or it has expired; delete it from the routing
714 * table. Safe to drop rt_lock and use rt_key, since holding
715 * rnh_lock here prevents another thread from calling
716 * rt_setgate() on this route.
717 */
718 RT_UNLOCK(rt);
719 rtrequest_locked(RTM_DELETE, rt_key(rt), NULL,
720 rt_mask(rt), 0, NULL);
721 arpstat.timeouts++;
722 ap->killed++;
723 } else {
724 /* ARP entry is static; let it linger */
725 RT_UNLOCK(rt);
726 }
727}
728
729void
730in_arpdrain(void *arg)
731{
732#pragma unused(arg)
733 struct llinfo_arp *la, *ola;
734 struct arptf_arg farg;
735
736 if (arp_verbose) {
737 log(LOG_DEBUG, "%s: draining ARP entries\n", __func__);
738 }
739
740 lck_mtx_lock(rnh_lock);
741 la = llinfo_arp.lh_first;
742 bzero(s: &farg, n: sizeof(farg));
743 farg.draining = TRUE;
744 while ((ola = la) != NULL) {
745 la = la->la_le.le_next;
746 arptfree(la: ola, arg: &farg);
747 }
748 if (arp_verbose) {
749 log(LOG_DEBUG, "%s: found %u, aging %u, sticky %u, killed %u; "
750 "%u pkts held (%u bytes)\n", __func__, farg.found,
751 farg.aging, farg.sticky, farg.killed, farg.qlen,
752 farg.qsize);
753 }
754 lck_mtx_unlock(rnh_lock);
755}
756
757/*
758 * Timeout routine. Age arp_tab entries periodically.
759 */
760static void
761arp_timeout(thread_call_param_t arg0, thread_call_param_t arg1)
762{
763#pragma unused(arg0, arg1)
764 struct llinfo_arp *la, *ola;
765 struct timeval atv;
766 struct arptf_arg farg;
767
768 lck_mtx_lock(rnh_lock);
769 la = llinfo_arp.lh_first;
770 bzero(s: &farg, n: sizeof(farg));
771 while ((ola = la) != NULL) {
772 la = la->la_le.le_next;
773 arptfree(la: ola, arg: &farg);
774 }
775 if (arp_verbose) {
776 log(LOG_DEBUG, "%s: found %u, aging %u, sticky %u, killed %u; "
777 "%u pkts held (%u bytes)\n", __func__, farg.found,
778 farg.aging, farg.sticky, farg.killed, farg.qlen,
779 farg.qsize);
780 }
781 atv.tv_usec = 0;
782 atv.tv_sec = MAX(arpt_prune, 5);
783 /* re-arm the timer if there's work to do */
784 arp_timeout_run = 0;
785 if (farg.aging > 0) {
786 arp_sched_timeout(&atv);
787 } else if (arp_verbose) {
788 log(LOG_DEBUG, "%s: not rescheduling timer\n", __func__);
789 }
790 lck_mtx_unlock(rnh_lock);
791}
792
793static void
794arp_sched_timeout(struct timeval *atv)
795{
796 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
797
798 if (!arp_timeout_run) {
799 struct timeval tv;
800 uint64_t deadline = 0;
801
802 if (arp_timeout_tcall == NULL) {
803 arp_timeout_tcall =
804 thread_call_allocate(func: arp_timeout, NULL);
805 VERIFY(arp_timeout_tcall != NULL);
806 }
807
808 if (atv == NULL) {
809 tv.tv_usec = 0;
810 tv.tv_sec = MAX(arpt_prune / 5, 1);
811 atv = &tv;
812 }
813 if (arp_verbose) {
814 log(LOG_DEBUG, "%s: timer scheduled in "
815 "T+%llus.%lluu\n", __func__,
816 (uint64_t)atv->tv_sec, (uint64_t)atv->tv_usec);
817 }
818 arp_timeout_run = 1;
819
820 clock_deadline_for_periodic_event(interval: atv->tv_sec * NSEC_PER_SEC,
821 abstime: mach_absolute_time(), deadline: &deadline);
822 (void) thread_call_enter_delayed(call: arp_timeout_tcall, deadline);
823 }
824}
825
826/*
827 * Probe routine.
828 */
829static void
830arp_probe(thread_call_param_t arg0, thread_call_param_t arg1)
831{
832#pragma unused(arg0, arg1)
833 struct llinfo_arp *la, *ola;
834 struct timeval atv;
835 struct arptf_arg farg;
836
837 lck_mtx_lock(rnh_lock);
838 la = llinfo_arp.lh_first;
839 bzero(s: &farg, n: sizeof(farg));
840 farg.probing = TRUE;
841 while ((ola = la) != NULL) {
842 la = la->la_le.le_next;
843 arptfree(la: ola, arg: &farg);
844 }
845 if (arp_verbose) {
846 log(LOG_DEBUG, "%s: found %u, aging %u, sticky %u, killed %u; "
847 "%u pkts held (%u bytes)\n", __func__, farg.found,
848 farg.aging, farg.sticky, farg.killed, farg.qlen,
849 farg.qsize);
850 }
851 atv.tv_usec = 0;
852 atv.tv_sec = MAX(arpt_probe, ARP_PROBE_TIME);
853 /* re-arm the probe if there's work to do */
854 arp_probe_run = 0;
855 if (farg.qlen > 0) {
856 arp_sched_probe(&atv);
857 } else if (arp_verbose) {
858 log(LOG_DEBUG, "%s: not rescheduling probe\n", __func__);
859 }
860 lck_mtx_unlock(rnh_lock);
861}
862
863static void
864arp_sched_probe(struct timeval *atv)
865{
866 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
867
868 if (!arp_probe_run) {
869 struct timeval tv;
870 uint64_t deadline = 0;
871
872 if (arp_probe_tcall == NULL) {
873 arp_probe_tcall =
874 thread_call_allocate(func: arp_probe, NULL);
875 VERIFY(arp_probe_tcall != NULL);
876 }
877
878 if (atv == NULL) {
879 tv.tv_usec = 0;
880 tv.tv_sec = MAX(arpt_probe, ARP_PROBE_TIME);
881 atv = &tv;
882 }
883 if (arp_verbose) {
884 log(LOG_DEBUG, "%s: probe scheduled in "
885 "T+%llus.%lluu\n", __func__,
886 (uint64_t)atv->tv_sec, (uint64_t)atv->tv_usec);
887 }
888 arp_probe_run = 1;
889
890 clock_deadline_for_periodic_event(interval: atv->tv_sec * NSEC_PER_SEC,
891 abstime: mach_absolute_time(), deadline: &deadline);
892 (void) thread_call_enter_delayed(call: arp_probe_tcall, deadline);
893 }
894}
895
896/*
897 * ifa_rtrequest() callback
898 */
899static void
900arp_rtrequest(int req, struct rtentry *rt, struct sockaddr *sa)
901{
902#pragma unused(sa)
903 struct sockaddr *gate = rt->rt_gateway;
904 struct llinfo_arp *la = rt->rt_llinfo;
905 static struct sockaddr_dl null_sdl =
906 { .sdl_len = sizeof(null_sdl), .sdl_family = AF_LINK };
907 uint64_t timenow;
908 char buf[MAX_IPv4_STR_LEN];
909
910 VERIFY(arpinit_done);
911 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
912 RT_LOCK_ASSERT_HELD(rt);
913
914 if (rt->rt_flags & RTF_GATEWAY) {
915 return;
916 }
917
918 timenow = net_uptime();
919 switch (req) {
920 case RTM_ADD:
921 /*
922 * XXX: If this is a manually added route to interface
923 * such as older version of routed or gated might provide,
924 * restore cloning bit.
925 */
926 if (!(rt->rt_flags & RTF_HOST) && rt_mask(rt) != NULL &&
927 SIN(rt_mask(rt))->sin_addr.s_addr != INADDR_BROADCAST) {
928 rt->rt_flags |= RTF_CLONING;
929 }
930
931 if (rt->rt_flags & RTF_CLONING) {
932 /*
933 * Case 1: This route should come from a route to iface.
934 */
935 if (rt_setgate(rt, rt_key(rt), SA(&null_sdl)) == 0) {
936 gate = rt->rt_gateway;
937 SDL(gate)->sdl_type = rt->rt_ifp->if_type;
938 SDL(gate)->sdl_index = rt->rt_ifp->if_index;
939 /*
940 * In case we're called before 1.0 sec.
941 * has elapsed.
942 */
943 rt_setexpire(rt, MAX(timenow, 1));
944 }
945 break;
946 }
947 /* Announce a new entry if requested. */
948 if (rt->rt_flags & RTF_ANNOUNCE) {
949 if (la != NULL) {
950 arp_llreach_use(la); /* Mark use timestamp */
951 }
952 if ((rt->rt_ifp->if_flags & IFF_NOARP) == 0) {
953 RT_UNLOCK(rt);
954 dlil_send_arp(rt->rt_ifp, ARPOP_REQUEST,
955 SDL(gate), rt_key(rt), NULL, rt_key(rt), 0);
956 RT_LOCK(rt);
957 arpstat.txannounces++;
958 }
959 }
960 OS_FALLTHROUGH;
961 case RTM_RESOLVE:
962 if (gate->sa_family != AF_LINK ||
963 gate->sa_len < sizeof(null_sdl)) {
964 arpstat.invalidreqs++;
965 log(LOG_ERR, "%s: route to %s has bad gateway address "
966 "(sa_family %u sa_len %u) on %s\n",
967 __func__, inet_ntop(AF_INET,
968 &SIN(rt_key(rt))->sin_addr.s_addr, buf,
969 sizeof(buf)), gate->sa_family, gate->sa_len,
970 if_name(rt->rt_ifp));
971 break;
972 }
973 SDL(gate)->sdl_type = rt->rt_ifp->if_type;
974 SDL(gate)->sdl_index = rt->rt_ifp->if_index;
975
976 if (la != NULL) {
977 break; /* This happens on a route change */
978 }
979 /*
980 * Case 2: This route may come from cloning, or a manual route
981 * add with a LL address.
982 */
983 rt->rt_llinfo = la = arp_llinfo_alloc(how: Z_WAITOK);
984
985 rt->rt_llinfo_get_ri = arp_llinfo_get_ri;
986 rt->rt_llinfo_get_iflri = arp_llinfo_get_iflri;
987 rt->rt_llinfo_purge = arp_llinfo_purge;
988 rt->rt_llinfo_free = arp_llinfo_free;
989 rt->rt_llinfo_refresh = arp_llinfo_refresh;
990 rt->rt_flags |= RTF_LLINFO;
991 la->la_rt = rt;
992 LIST_INSERT_HEAD(&llinfo_arp, la, la_le);
993 arpstat.inuse++;
994
995 /* We have at least one entry; arm the timer if not already */
996 arp_sched_timeout(NULL);
997
998 /*
999 * This keeps the multicast addresses from showing up
1000 * in `arp -a' listings as unresolved. It's not actually
1001 * functional. Then the same for broadcast. For IPv4
1002 * link-local address, keep the entry around even after
1003 * it has expired.
1004 */
1005 if (IN_MULTICAST(ntohl(SIN(rt_key(rt))->sin_addr.s_addr))) {
1006 RT_UNLOCK(rt);
1007 dlil_resolve_multi(rt->rt_ifp, rt_key(rt), gate,
1008 sizeof(struct sockaddr_dl));
1009 RT_LOCK(rt);
1010 rt_setexpire(rt, 0);
1011 } else if (in_broadcast(SIN(rt_key(rt))->sin_addr,
1012 rt->rt_ifp)) {
1013 struct sockaddr_dl *gate_ll = SDL(gate);
1014 size_t broadcast_len;
1015 int ret = ifnet_llbroadcast_copy_bytes(interface: rt->rt_ifp,
1016 LLADDR(gate_ll), bufferlen: sizeof(gate_ll->sdl_data),
1017 out_len: &broadcast_len);
1018 if (ret == 0 && broadcast_len <= UINT8_MAX) {
1019 gate_ll->sdl_alen = (u_char)broadcast_len;
1020 gate_ll->sdl_family = AF_LINK;
1021 gate_ll->sdl_len = sizeof(struct sockaddr_dl);
1022 }
1023 /* In case we're called before 1.0 sec. has elapsed */
1024 rt_setexpire(rt, MAX(timenow, 1));
1025 } else if (IN_LINKLOCAL(ntohl(SIN(rt_key(rt))->
1026 sin_addr.s_addr))) {
1027 rt->rt_flags |= RTF_STATIC;
1028 }
1029
1030 /* Set default maximum number of retries */
1031 la->la_maxtries = arp_maxtries;
1032
1033 /* Become a regular mutex, just in case */
1034 RT_CONVERT_LOCK(rt);
1035 IFA_LOCK_SPIN(rt->rt_ifa);
1036 if (SIN(rt_key(rt))->sin_addr.s_addr ==
1037 (IA_SIN(rt->rt_ifa))->sin_addr.s_addr) {
1038 IFA_UNLOCK(rt->rt_ifa);
1039 /*
1040 * This test used to be
1041 * if (loif.if_flags & IFF_UP)
1042 * It allowed local traffic to be forced through the
1043 * hardware by configuring the loopback down. However,
1044 * it causes problems during network configuration
1045 * for boards that can't receive packets they send.
1046 * It is now necessary to clear "useloopback" and
1047 * remove the route to force traffic out to the
1048 * hardware.
1049 */
1050 rt_setexpire(rt, 0);
1051 ifnet_lladdr_copy_bytes(interface: rt->rt_ifp, LLADDR(SDL(gate)),
1052 SDL(gate)->sdl_alen = rt->rt_ifp->if_addrlen);
1053 if (useloopback) {
1054 if (rt->rt_ifp != lo_ifp) {
1055 /*
1056 * Purge any link-layer info caching.
1057 */
1058 if (rt->rt_llinfo_purge != NULL) {
1059 rt->rt_llinfo_purge(rt);
1060 }
1061
1062 /*
1063 * Adjust route ref count for the
1064 * interfaces.
1065 */
1066 if (rt->rt_if_ref_fn != NULL) {
1067 rt->rt_if_ref_fn(lo_ifp, 1);
1068 rt->rt_if_ref_fn(rt->rt_ifp, -1);
1069 }
1070 }
1071 rt->rt_ifp = lo_ifp;
1072 /*
1073 * If rmx_mtu is not locked, update it
1074 * to the MTU used by the new interface.
1075 */
1076 if (!(rt->rt_rmx.rmx_locks & RTV_MTU)) {
1077 rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu;
1078 }
1079 }
1080 } else {
1081 IFA_UNLOCK(rt->rt_ifa);
1082 }
1083 break;
1084
1085 case RTM_DELETE:
1086 if (la == NULL) {
1087 break;
1088 }
1089 /*
1090 * Unchain it but defer the actual freeing until the route
1091 * itself is to be freed. rt->rt_llinfo still points to
1092 * llinfo_arp, and likewise, la->la_rt still points to this
1093 * route entry, except that RTF_LLINFO is now cleared.
1094 */
1095 LIST_REMOVE(la, la_le);
1096 la->la_le.le_next = NULL;
1097 la->la_le.le_prev = NULL;
1098 arpstat.inuse--;
1099
1100 /*
1101 * Purge any link-layer info caching.
1102 */
1103 if (rt->rt_llinfo_purge != NULL) {
1104 rt->rt_llinfo_purge(rt);
1105 }
1106
1107 rt->rt_flags &= ~RTF_LLINFO;
1108 (void) arp_llinfo_flushq(la);
1109 }
1110}
1111
1112/*
1113 * convert hardware address to hex string for logging errors.
1114 */
1115static const char *
1116sdl_addr_to_hex(const struct sockaddr_dl *sdl, char *orig_buf, int buflen)
1117{
1118 char *buf = orig_buf;
1119 int i;
1120 const u_char *lladdr = (u_char *)(size_t)sdl->sdl_data;
1121 int maxbytes = buflen / 3;
1122
1123 if (maxbytes > sdl->sdl_alen) {
1124 maxbytes = sdl->sdl_alen;
1125 }
1126 *buf = '\0';
1127 for (i = 0; i < maxbytes; i++) {
1128 snprintf(buf, count: 3, "%02x", lladdr[i]);
1129 buf += 2;
1130 *buf = (i == maxbytes - 1) ? '\0' : ':';
1131 buf++;
1132 }
1133 return orig_buf;
1134}
1135
1136/*
1137 * arp_lookup_route will lookup the route for a given address.
1138 *
1139 * The address must be for a host on a local network on this interface.
1140 * If the returned route is non-NULL, the route is locked and the caller
1141 * is responsible for unlocking it and releasing its reference.
1142 */
1143static errno_t
1144arp_lookup_route(const struct in_addr *addr, int create, int proxy,
1145 route_t *route, unsigned int ifscope)
1146{
1147 struct sockaddr_inarp sin =
1148 { sizeof(sin), AF_INET, 0, { 0 }, { 0 }, 0, 0 };
1149 const char *why = NULL;
1150 errno_t error = 0;
1151 route_t rt;
1152
1153 *route = NULL;
1154
1155 sin.sin_addr.s_addr = addr->s_addr;
1156 sin.sin_other = proxy ? SIN_PROXY : 0;
1157
1158 /*
1159 * If the destination is a link-local address, don't
1160 * constrain the lookup (don't scope it).
1161 */
1162 if (IN_LINKLOCAL(ntohl(addr->s_addr))) {
1163 ifscope = IFSCOPE_NONE;
1164 }
1165
1166 rt = rtalloc1_scoped(SA(&sin), create, 0, ifscope);
1167 if (rt == NULL) {
1168 return ENETUNREACH;
1169 }
1170
1171 RT_LOCK(rt);
1172
1173 if (rt->rt_flags & RTF_GATEWAY) {
1174 why = "host is not on local network";
1175 error = ENETUNREACH;
1176 } else if (!(rt->rt_flags & RTF_LLINFO)) {
1177 why = "could not allocate llinfo";
1178 error = ENOMEM;
1179 } else if (rt->rt_gateway->sa_family != AF_LINK) {
1180 why = "gateway route is not ours";
1181 error = EPROTONOSUPPORT;
1182 }
1183
1184 if (error != 0) {
1185 if (create && (arp_verbose || log_arp_warnings)) {
1186 char tmp[MAX_IPv4_STR_LEN];
1187 log(LOG_DEBUG, "%s: link#%d %s failed: %s\n",
1188 __func__, ifscope, inet_ntop(AF_INET, addr, tmp,
1189 sizeof(tmp)), why);
1190 }
1191
1192 /*
1193 * If there are no references to this route, and it is
1194 * a cloned route, and not static, and ARP had created
1195 * the route, then purge it from the routing table as
1196 * it is probably bogus.
1197 */
1198 if (rt->rt_refcnt == 1 &&
1199 (rt->rt_flags & (RTF_WASCLONED | RTF_STATIC)) ==
1200 RTF_WASCLONED) {
1201 /*
1202 * Prevent another thread from modiying rt_key,
1203 * rt_gateway via rt_setgate() after rt_lock is
1204 * dropped by marking the route as defunct.
1205 */
1206 rt->rt_flags |= RTF_CONDEMNED;
1207 RT_UNLOCK(rt);
1208 rtrequest(RTM_DELETE, rt_key(rt), rt->rt_gateway,
1209 rt_mask(rt), rt->rt_flags, NULL);
1210 rtfree(rt);
1211 } else {
1212 RT_REMREF_LOCKED(rt);
1213 RT_UNLOCK(rt);
1214 }
1215 return error;
1216 }
1217
1218 /*
1219 * Caller releases reference and does RT_UNLOCK(rt).
1220 */
1221 *route = rt;
1222 return 0;
1223}
1224
1225boolean_t
1226arp_is_entry_probing(route_t p_route)
1227{
1228 struct llinfo_arp *llinfo = p_route->rt_llinfo;
1229
1230 if (llinfo != NULL &&
1231 llinfo->la_llreach != NULL &&
1232 llinfo->la_llreach->lr_probes != 0) {
1233 return TRUE;
1234 }
1235
1236 return FALSE;
1237}
1238
1239__attribute__((noinline))
1240static void
1241post_kev_in_arpfailure(struct ifnet *ifp)
1242{
1243 struct kev_msg ev_msg = {};
1244 struct kev_in_arpfailure in_arpfailure = {};
1245
1246 in_arpfailure.link_data.if_family = ifp->if_family;
1247 in_arpfailure.link_data.if_unit = ifp->if_unit;
1248 strlcpy(dst: in_arpfailure.link_data.if_name, src: ifp->if_name, IFNAMSIZ);
1249 ev_msg.vendor_code = KEV_VENDOR_APPLE;
1250 ev_msg.kev_class = KEV_NETWORK_CLASS;
1251 ev_msg.kev_subclass = KEV_INET_SUBCLASS;
1252 ev_msg.event_code = KEV_INET_ARPRTRFAILURE;
1253 ev_msg.dv[0].data_ptr = &in_arpfailure;
1254 ev_msg.dv[0].data_length = sizeof(struct kev_in_arpfailure);
1255 dlil_post_complete_msg(NULL, &ev_msg);
1256}
1257
1258__attribute__((noinline))
1259static void
1260arp_send_probe_notification(route_t route)
1261{
1262 route_event_enqueue_nwk_wq_entry(route, NULL,
1263 ROUTE_LLENTRY_PROBED, NULL, TRUE);
1264
1265 if (route->rt_flags & RTF_ROUTER) {
1266 struct radix_node_head *rnh = NULL;
1267 struct route_event rt_ev;
1268 route_event_init(p_route_ev: &rt_ev, rt: route, NULL, route_ev_code: ROUTE_LLENTRY_PROBED);
1269 /*
1270 * We already have a reference on rt. The function
1271 * frees it before returning.
1272 */
1273 RT_UNLOCK(route);
1274 lck_mtx_lock(rnh_lock);
1275 rnh = rt_tables[AF_INET];
1276
1277 if (rnh != NULL) {
1278 (void) rnh->rnh_walktree(rnh,
1279 route_event_walktree, (void *)&rt_ev);
1280 }
1281 lck_mtx_unlock(rnh_lock);
1282 RT_LOCK(route);
1283 }
1284}
1285
1286/*
1287 * This is the ARP pre-output routine; care must be taken to ensure that
1288 * the "hint" route never gets freed via rtfree(), since the caller may
1289 * have stored it inside a struct route with a reference held for that
1290 * placeholder.
1291 */
1292errno_t
1293arp_lookup_ip(ifnet_t ifp, const struct sockaddr_in *net_dest,
1294 struct sockaddr_dl *ll_dest, size_t ll_dest_len, route_t hint,
1295 mbuf_t packet)
1296{
1297 route_t route __single = NULL; /* output route */
1298 errno_t result = 0;
1299 struct sockaddr_dl *gateway;
1300 struct llinfo_arp *llinfo = NULL;
1301 boolean_t usable, probing = FALSE;
1302 uint64_t timenow;
1303 struct if_llreach *lr;
1304 struct ifaddr *rt_ifa;
1305 struct sockaddr *sa;
1306 uint32_t rtflags;
1307 struct sockaddr_dl sdl = {};
1308 boolean_t send_probe_notif = FALSE;
1309 boolean_t enqueued = FALSE;
1310
1311 if (ifp == NULL || net_dest == NULL) {
1312 return EINVAL;
1313 }
1314
1315 if (net_dest->sin_family != AF_INET) {
1316 return EAFNOSUPPORT;
1317 }
1318
1319 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) != (IFF_UP | IFF_RUNNING)) {
1320 return ENETDOWN;
1321 }
1322
1323 /*
1324 * If we were given a route, verify the route and grab the gateway
1325 */
1326 if (hint != NULL) {
1327 /*
1328 * Callee holds a reference on the route and returns
1329 * with the route entry locked, upon success.
1330 */
1331 result = route_to_gwroute(SA(net_dest), hint, &route);
1332 if (result != 0) {
1333 return result;
1334 }
1335 if (route != NULL) {
1336 RT_LOCK_ASSERT_HELD(route);
1337 }
1338 }
1339
1340 if ((packet != NULL && (packet->m_flags & M_BCAST)) ||
1341 in_broadcast(net_dest->sin_addr, ifp)) {
1342 size_t broadcast_len;
1343 SOCKADDR_ZERO(ll_dest, ll_dest_len);
1344 result = ifnet_llbroadcast_copy_bytes(interface: ifp, LLADDR(ll_dest),
1345 bufferlen: ll_dest_len - offsetof(struct sockaddr_dl, sdl_data),
1346 out_len: &broadcast_len);
1347 if (result == 0 && broadcast_len <= UINT8_MAX) {
1348 ll_dest->sdl_alen = (u_char)broadcast_len;
1349 ll_dest->sdl_family = AF_LINK;
1350 ll_dest->sdl_len = sizeof(struct sockaddr_dl);
1351 }
1352 goto release;
1353 }
1354 if ((packet != NULL && (packet->m_flags & M_MCAST)) ||
1355 ((ifp->if_flags & IFF_MULTICAST) &&
1356 IN_MULTICAST(ntohl(net_dest->sin_addr.s_addr)))) {
1357 if (route != NULL) {
1358 RT_UNLOCK(route);
1359 }
1360 result = dlil_resolve_multi(ifp,
1361 SA(net_dest),
1362 SA(ll_dest), ll_dest_len);
1363 if (route != NULL) {
1364 RT_LOCK(route);
1365 }
1366 goto release;
1367 }
1368
1369 /*
1370 * If we didn't find a route, or the route doesn't have
1371 * link layer information, trigger the creation of the
1372 * route and link layer information.
1373 */
1374 if (route == NULL || route->rt_llinfo == NULL) {
1375 /* Clean up now while we can */
1376 if (route != NULL) {
1377 if (route == hint) {
1378 RT_REMREF_LOCKED(route);
1379 RT_UNLOCK(route);
1380 } else {
1381 RT_UNLOCK(route);
1382 rtfree(route);
1383 }
1384 }
1385 /*
1386 * Callee holds a reference on the route and returns
1387 * with the route entry locked, upon success.
1388 */
1389 result = arp_lookup_route(addr: &net_dest->sin_addr, create: 1, proxy: 0, route: &route,
1390 ifscope: ifp->if_index);
1391 if (result == 0) {
1392 RT_LOCK_ASSERT_HELD(route);
1393 }
1394 }
1395
1396 if (result || route == NULL || (llinfo = route->rt_llinfo) == NULL) {
1397 /* In case result is 0 but no route, return an error */
1398 if (result == 0) {
1399 result = EHOSTUNREACH;
1400 }
1401
1402 if (route != NULL && route->rt_llinfo == NULL) {
1403 char tmp[MAX_IPv4_STR_LEN];
1404 log(LOG_ERR, "%s: can't allocate llinfo for %s\n",
1405 __func__, inet_ntop(AF_INET, &net_dest->sin_addr,
1406 tmp, sizeof(tmp)));
1407 }
1408 goto release;
1409 }
1410
1411 if ((ifp->if_flags & IFF_NOARP) != 0) {
1412 result = ENOTSUP;
1413 goto release;
1414 }
1415
1416 /*
1417 * Now that we have the right route, is it filled in?
1418 */
1419 gateway = SDL(route->rt_gateway);
1420 timenow = net_uptime();
1421 VERIFY(route->rt_expire == 0 || route->rt_rmx.rmx_expire != 0);
1422 VERIFY(route->rt_expire != 0 || route->rt_rmx.rmx_expire == 0);
1423
1424 usable = ((route->rt_expire == 0 || route->rt_expire > timenow) &&
1425 gateway != NULL && gateway->sdl_family == AF_LINK &&
1426 gateway->sdl_alen != 0);
1427
1428 if (usable) {
1429 boolean_t unreachable = !arp_llreach_reachable(la: llinfo);
1430
1431 /* Entry is usable, so fill in info for caller */
1432 SOCKADDR_COPY(gateway, ll_dest, MIN(gateway->sdl_len, ll_dest_len));
1433 result = 0;
1434 arp_llreach_use(la: llinfo); /* Mark use timestamp */
1435
1436 lr = llinfo->la_llreach;
1437 if (lr == NULL) {
1438 goto release;
1439 }
1440 rt_ifa = route->rt_ifa;
1441
1442 /* Become a regular mutex, just in case */
1443 RT_CONVERT_LOCK(route);
1444 IFLR_LOCK_SPIN(lr);
1445
1446 if ((unreachable || (llinfo->la_flags & LLINFO_PROBING)) &&
1447 lr->lr_probes < arp_unicast_lim) {
1448 /*
1449 * Thus mark the entry with la_probeexp deadline to
1450 * trigger the probe timer to be scheduled (if not
1451 * already). This gets cleared the moment we get
1452 * an ARP reply.
1453 */
1454 probing = TRUE;
1455 if (lr->lr_probes == 0) {
1456 llinfo->la_probeexp = (timenow + arpt_probe);
1457 llinfo->la_flags |= LLINFO_PROBING;
1458 /*
1459 * Provide notification that ARP unicast
1460 * probing has started.
1461 * We only do it for the first unicast probe
1462 * attempt.
1463 */
1464 send_probe_notif = TRUE;
1465 }
1466
1467 /*
1468 * Start the unicast probe and anticipate a reply;
1469 * afterwards, return existing entry to caller and
1470 * let it be used anyway. If peer is non-existent
1471 * we'll broadcast ARP next time around.
1472 */
1473 lr->lr_probes++;
1474 SOCKADDR_ZERO(&sdl, sizeof(sdl));
1475 sdl.sdl_alen = ifp->if_addrlen;
1476 bcopy(src: &lr->lr_key.addr, LLADDR(&sdl),
1477 n: ifp->if_addrlen);
1478 IFLR_UNLOCK(lr);
1479 IFA_LOCK_SPIN(rt_ifa);
1480 ifa_addref(ifa: rt_ifa);
1481 sa = rt_ifa->ifa_addr;
1482 IFA_UNLOCK(rt_ifa);
1483 rtflags = route->rt_flags;
1484 RT_UNLOCK(route);
1485 dlil_send_arp(ifp, ARPOP_REQUEST, NULL, sa,
1486 SDL(&sdl),
1487 SA(net_dest), rtflags);
1488 ifa_remref(ifa: rt_ifa);
1489 RT_LOCK(route);
1490 goto release;
1491 } else {
1492 IFLR_UNLOCK(lr);
1493 if (!unreachable &&
1494 !(llinfo->la_flags & LLINFO_PROBING)) {
1495 /*
1496 * Normal case where peer is still reachable,
1497 * we're not probing and if_addrlen is anything
1498 * but IF_LLREACH_MAXLEN.
1499 */
1500 goto release;
1501 }
1502 }
1503 }
1504
1505 /*
1506 * Route wasn't complete/valid; we need to send out ARP request.
1507 * If we've exceeded the limit of la_holdq, drop from the head
1508 * of queue and add this packet to the tail. If we end up with
1509 * RTF_REJECT below, we'll dequeue this from tail and have the
1510 * caller free the packet instead. It's safe to do that since
1511 * we still hold the route's rt_lock.
1512 */
1513 if (packet != NULL) {
1514 enqueued = arp_llinfo_addq(la: llinfo, m: packet);
1515 } else {
1516 llinfo->la_prbreq_cnt++;
1517 }
1518 /*
1519 * Regardless of permanent vs. expirable entry, we need to
1520 * avoid having packets sit in la_holdq forever; thus mark the
1521 * entry with la_probeexp deadline to trigger the probe timer
1522 * to be scheduled (if not already). This gets cleared the
1523 * moment we get an ARP reply.
1524 */
1525 probing = TRUE;
1526 if ((qlen(&llinfo->la_holdq) + llinfo->la_prbreq_cnt) == 1) {
1527 llinfo->la_probeexp = (timenow + arpt_probe);
1528 llinfo->la_flags |= LLINFO_PROBING;
1529 }
1530
1531 if (route->rt_expire) {
1532 route->rt_flags &= ~RTF_REJECT;
1533 if (llinfo->la_asked == 0 || route->rt_expire != timenow) {
1534 rt_setexpire(route, timenow);
1535 if (llinfo->la_asked++ < llinfo->la_maxtries) {
1536 boolean_t sendkev = FALSE;
1537
1538 rt_ifa = route->rt_ifa;
1539 lr = llinfo->la_llreach;
1540 /* Become a regular mutex, just in case */
1541 RT_CONVERT_LOCK(route);
1542 /* Update probe count, if applicable */
1543 if (lr != NULL) {
1544 IFLR_LOCK_SPIN(lr);
1545 lr->lr_probes++;
1546 IFLR_UNLOCK(lr);
1547 }
1548 if (ifp->if_addrlen == IF_LLREACH_MAXLEN &&
1549 route->rt_flags & RTF_ROUTER &&
1550 llinfo->la_asked > 1) {
1551 sendkev = TRUE;
1552 llinfo->la_flags |= LLINFO_RTRFAIL_EVTSENT;
1553 }
1554 IFA_LOCK_SPIN(rt_ifa);
1555 ifa_addref(ifa: rt_ifa);
1556 sa = rt_ifa->ifa_addr;
1557 IFA_UNLOCK(rt_ifa);
1558 arp_llreach_use(la: llinfo); /* Mark use tstamp */
1559 rtflags = route->rt_flags;
1560 RT_UNLOCK(route);
1561 dlil_send_arp(ifp, ARPOP_REQUEST, NULL, sa,
1562 NULL, SA(net_dest),
1563 rtflags);
1564 ifa_remref(ifa: rt_ifa);
1565 if (sendkev) {
1566 post_kev_in_arpfailure(ifp);
1567 }
1568 RT_LOCK(route);
1569 goto release_just_return;
1570 } else {
1571 route->rt_flags |= RTF_REJECT;
1572 rt_setexpire(route,
1573 route->rt_expire + arpt_down);
1574 llinfo->la_asked = 0;
1575 /*
1576 * Remove the packet that was just added above;
1577 * don't free it since we're not returning
1578 * EJUSTRETURN. The caller will handle the
1579 * freeing. Since we haven't dropped rt_lock
1580 * from the time of _addq() above, this packet
1581 * must be at the tail.
1582 */
1583 if (packet != NULL && enqueued) {
1584 classq_pkt_t pkt =
1585 CLASSQ_PKT_INITIALIZER(pkt);
1586
1587 _getq_tail(&llinfo->la_holdq, &pkt);
1588 os_atomic_dec(&arpstat.held, relaxed);
1589 VERIFY(pkt.cp_mbuf == packet);
1590 }
1591 result = EHOSTUNREACH;
1592 /*
1593 * Enqueue work item to invoke callback for this route entry
1594 */
1595 route_event_enqueue_nwk_wq_entry(route, NULL,
1596 ROUTE_LLENTRY_UNREACH, NULL, TRUE);
1597 goto release;
1598 }
1599 }
1600 }
1601
1602
1603release_just_return:
1604 /* The packet is now held inside la_holdq or dropped */
1605 result = EJUSTRETURN;
1606 if (packet != NULL && !enqueued) {
1607 m_freem(packet);
1608 packet = NULL;
1609 }
1610
1611release:
1612 if (result == EHOSTUNREACH) {
1613 os_atomic_inc(&arpstat.dropped, relaxed);
1614 }
1615
1616 if (route != NULL) {
1617 if (send_probe_notif) {
1618 arp_send_probe_notification(route);
1619 }
1620
1621 if (route == hint) {
1622 RT_REMREF_LOCKED(route);
1623 RT_UNLOCK(route);
1624 } else {
1625 RT_UNLOCK(route);
1626 rtfree(route);
1627 }
1628 }
1629 if (probing) {
1630 /* Do this after we drop rt_lock to preserve ordering */
1631 lck_mtx_lock(rnh_lock);
1632 arp_sched_probe(NULL);
1633 lck_mtx_unlock(rnh_lock);
1634 }
1635 return result;
1636}
1637
1638errno_t
1639arp_ip_handle_input(ifnet_t ifp, u_short arpop,
1640 const struct sockaddr_dl *sender_hw, const struct sockaddr_in *sender_ip,
1641 const struct sockaddr_in *target_ip)
1642{
1643 char ipv4str[MAX_IPv4_STR_LEN];
1644 struct sockaddr_dl proxied = {};
1645 struct sockaddr_dl *gateway, *target_hw = NULL;
1646 struct ifaddr *ifa;
1647 struct in_ifaddr *ia;
1648 struct in_ifaddr *best_ia = NULL;
1649 struct sockaddr_in best_ia_sin;
1650 route_t route = NULL;
1651 char buf[3 * MAX_HW_LEN]; /* enough for MAX_HW_LEN byte hw address */
1652 struct llinfo_arp *llinfo;
1653 errno_t error;
1654 int created_announcement = 0;
1655 int bridged = 0, is_bridge = 0;
1656 uint32_t rt_evcode = 0;
1657
1658 /*
1659 * Here and other places within this routine where we don't hold
1660 * rnh_lock, trade accuracy for speed for the common scenarios
1661 * and avoid the use of atomic updates.
1662 */
1663 arpstat.received++;
1664
1665 /* Do not respond to requests for 0.0.0.0 */
1666 if (target_ip->sin_addr.s_addr == INADDR_ANY && arpop == ARPOP_REQUEST) {
1667 goto done;
1668 }
1669
1670 if (ifp->if_bridge) {
1671 bridged = 1;
1672 }
1673 if (ifp->if_type == IFT_BRIDGE) {
1674 is_bridge = 1;
1675 }
1676
1677 if (arpop == ARPOP_REPLY) {
1678 arpstat.rxreplies++;
1679 }
1680
1681 /*
1682 * Determine if this ARP is for us
1683 */
1684 lck_rw_lock_shared(lck: &in_ifaddr_rwlock);
1685 TAILQ_FOREACH(ia, INADDR_HASH(target_ip->sin_addr.s_addr), ia_hash) {
1686 IFA_LOCK_SPIN(&ia->ia_ifa);
1687 if (ia->ia_ifp == ifp &&
1688 ia->ia_addr.sin_addr.s_addr == target_ip->sin_addr.s_addr) {
1689 best_ia = ia;
1690 best_ia_sin = best_ia->ia_addr;
1691 ifa_addref(ifa: &ia->ia_ifa);
1692 IFA_UNLOCK(&ia->ia_ifa);
1693 lck_rw_done(lck: &in_ifaddr_rwlock);
1694 goto match;
1695 }
1696 IFA_UNLOCK(&ia->ia_ifa);
1697 }
1698
1699 TAILQ_FOREACH(ia, INADDR_HASH(sender_ip->sin_addr.s_addr), ia_hash) {
1700 IFA_LOCK_SPIN(&ia->ia_ifa);
1701 if (ia->ia_ifp == ifp &&
1702 ia->ia_addr.sin_addr.s_addr == sender_ip->sin_addr.s_addr) {
1703 best_ia = ia;
1704 best_ia_sin = best_ia->ia_addr;
1705 ifa_addref(ifa: &ia->ia_ifa);
1706 IFA_UNLOCK(&ia->ia_ifa);
1707 lck_rw_done(lck: &in_ifaddr_rwlock);
1708 goto match;
1709 }
1710 IFA_UNLOCK(&ia->ia_ifa);
1711 }
1712
1713#define BDG_MEMBER_MATCHES_ARP(addr, ifp, ia) \
1714 (ia->ia_ifp->if_bridge == ifp->if_softc && \
1715 bcmp(IF_LLADDR(ia->ia_ifp), IF_LLADDR(ifp), ifp->if_addrlen) == 0 && \
1716 addr == ia->ia_addr.sin_addr.s_addr)
1717 /*
1718 * Check the case when bridge shares its MAC address with
1719 * some of its children, so packets are claimed by bridge
1720 * itself (bridge_input() does it first), but they are really
1721 * meant to be destined to the bridge member.
1722 */
1723 if (is_bridge) {
1724 TAILQ_FOREACH(ia, INADDR_HASH(target_ip->sin_addr.s_addr),
1725 ia_hash) {
1726 IFA_LOCK_SPIN(&ia->ia_ifa);
1727 if (BDG_MEMBER_MATCHES_ARP(target_ip->sin_addr.s_addr,
1728 ifp, ia)) {
1729 ifp = ia->ia_ifp;
1730 best_ia = ia;
1731 best_ia_sin = best_ia->ia_addr;
1732 ifa_addref(ifa: &ia->ia_ifa);
1733 IFA_UNLOCK(&ia->ia_ifa);
1734 lck_rw_done(lck: &in_ifaddr_rwlock);
1735 goto match;
1736 }
1737 IFA_UNLOCK(&ia->ia_ifa);
1738 }
1739 }
1740#undef BDG_MEMBER_MATCHES_ARP
1741 lck_rw_done(lck: &in_ifaddr_rwlock);
1742
1743 /*
1744 * No match, use the first inet address on the receive interface
1745 * as a dummy address for the rest of the function; we may be
1746 * proxying for another address.
1747 */
1748 ifnet_lock_shared(ifp);
1749 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1750 IFA_LOCK_SPIN(ifa);
1751 if (ifa->ifa_addr->sa_family != AF_INET) {
1752 IFA_UNLOCK(ifa);
1753 continue;
1754 }
1755 best_ia = (struct in_ifaddr *)ifa;
1756 best_ia_sin = best_ia->ia_addr;
1757 ifa_addref(ifa);
1758 IFA_UNLOCK(ifa);
1759 ifnet_lock_done(ifp);
1760 goto match;
1761 }
1762 ifnet_lock_done(ifp);
1763
1764 /*
1765 * If we're not a bridge member, or if we are but there's no
1766 * IPv4 address to use for the interface, drop the packet.
1767 */
1768 if (!bridged || best_ia == NULL) {
1769 goto done;
1770 }
1771
1772match:
1773 /* If the packet is from this interface, ignore the packet */
1774 if (bcmp(CONST_LLADDR(sender_hw), IF_LLADDR(ifp),
1775 n: sender_hw->sdl_alen) == 0) {
1776 goto done;
1777 }
1778
1779 /* Check for a conflict */
1780 if (!bridged &&
1781 sender_ip->sin_addr.s_addr == best_ia_sin.sin_addr.s_addr) {
1782 struct kev_msg ev_msg;
1783 struct kev_in_collision *in_collision;
1784 u_char storage[sizeof(struct kev_in_collision) + MAX_HW_LEN];
1785
1786 bzero(s: &ev_msg, n: sizeof(struct kev_msg));
1787 bzero(s: storage, n: (sizeof(struct kev_in_collision) + MAX_HW_LEN));
1788 in_collision = (struct kev_in_collision *)(void *)storage;
1789 log(LOG_ERR, "%s duplicate IP address %s sent from "
1790 "address %s\n", if_name(ifp),
1791 inet_ntop(AF_INET, &sender_ip->sin_addr, ipv4str,
1792 sizeof(ipv4str)), sdl_addr_to_hex(sdl: sender_hw, orig_buf: buf,
1793 buflen: (int)sizeof(buf)));
1794
1795 /* Send a kernel event so anyone can learn of the conflict */
1796 in_collision->link_data.if_family = ifp->if_family;
1797 in_collision->link_data.if_unit = ifp->if_unit;
1798 strlcpy(dst: &in_collision->link_data.if_name[0],
1799 src: ifp->if_name, IFNAMSIZ);
1800 in_collision->ia_ipaddr = sender_ip->sin_addr;
1801 in_collision->hw_len = (sender_hw->sdl_alen < MAX_HW_LEN) ?
1802 sender_hw->sdl_alen : MAX_HW_LEN;
1803 bcopy(CONST_LLADDR(sender_hw), dst: (caddr_t)in_collision->hw_addr,
1804 n: in_collision->hw_len);
1805 ev_msg.vendor_code = KEV_VENDOR_APPLE;
1806 ev_msg.kev_class = KEV_NETWORK_CLASS;
1807 ev_msg.kev_subclass = KEV_INET_SUBCLASS;
1808 ev_msg.event_code = KEV_INET_ARPCOLLISION;
1809 ev_msg.dv[0].data_ptr = in_collision;
1810 ev_msg.dv[0].data_length =
1811 sizeof(struct kev_in_collision) + in_collision->hw_len;
1812 ev_msg.dv[1].data_length = 0;
1813 dlil_post_complete_msg(NULL, &ev_msg);
1814 os_atomic_inc(&arpstat.dupips, relaxed);
1815 goto respond;
1816 }
1817
1818 /*
1819 * Look up the routing entry. If it doesn't exist and we are the
1820 * target, and the sender isn't 0.0.0.0, go ahead and create one.
1821 * Callee holds a reference on the route and returns with the route
1822 * entry locked, upon success.
1823 */
1824 error = arp_lookup_route(addr: &sender_ip->sin_addr,
1825 create: (target_ip->sin_addr.s_addr == best_ia_sin.sin_addr.s_addr &&
1826 sender_ip->sin_addr.s_addr != 0), proxy: 0, route: &route, ifscope: ifp->if_index);
1827
1828 if (error == 0) {
1829 RT_LOCK_ASSERT_HELD(route);
1830 }
1831
1832 if (error || route == NULL || route->rt_gateway == NULL) {
1833 if (arpop != ARPOP_REQUEST) {
1834 goto respond;
1835 }
1836
1837 if (arp_sendllconflict && send_conflicting_probes != 0 &&
1838 (ifp->if_eflags & IFEF_ARPLL) &&
1839 IN_LINKLOCAL(ntohl(target_ip->sin_addr.s_addr)) &&
1840 sender_ip->sin_addr.s_addr == INADDR_ANY) {
1841 /*
1842 * Verify this ARP probe doesn't conflict with
1843 * an IPv4LL we know of on another interface.
1844 */
1845 if (route != NULL) {
1846 RT_REMREF_LOCKED(route);
1847 RT_UNLOCK(route);
1848 route = NULL;
1849 }
1850 /*
1851 * Callee holds a reference on the route and returns
1852 * with the route entry locked, upon success.
1853 */
1854 error = arp_lookup_route(addr: &target_ip->sin_addr, create: 0, proxy: 0,
1855 route: &route, ifscope: ifp->if_index);
1856
1857 if (error != 0 || route == NULL ||
1858 route->rt_gateway == NULL) {
1859 goto respond;
1860 }
1861
1862 RT_LOCK_ASSERT_HELD(route);
1863
1864 gateway = SDL(route->rt_gateway);
1865 if (route->rt_ifp != ifp && gateway->sdl_alen != 0 &&
1866 (gateway->sdl_alen != sender_hw->sdl_alen ||
1867 bcmp(CONST_LLADDR(gateway), CONST_LLADDR(sender_hw),
1868 n: gateway->sdl_alen) != 0)) {
1869 /*
1870 * A node is probing for an IPv4LL we know
1871 * exists on a different interface. We respond
1872 * with a conflicting probe to force the new
1873 * device to pick a different IPv4LL address.
1874 */
1875 if (arp_verbose || log_arp_warnings) {
1876 log(LOG_INFO, "arp: %s on %s sent "
1877 "probe for %s, already on %s\n",
1878 sdl_addr_to_hex(sdl: sender_hw, orig_buf: buf,
1879 buflen: (int)sizeof(buf)), if_name(ifp),
1880 inet_ntop(AF_INET,
1881 &target_ip->sin_addr, ipv4str,
1882 sizeof(ipv4str)),
1883 if_name(route->rt_ifp));
1884 log(LOG_INFO, "arp: sending "
1885 "conflicting probe to %s on %s\n",
1886 sdl_addr_to_hex(sdl: sender_hw, orig_buf: buf,
1887 buflen: (int)sizeof(buf)), if_name(ifp));
1888 }
1889 /* Mark use timestamp */
1890 if (route->rt_llinfo != NULL) {
1891 arp_llreach_use(la: route->rt_llinfo);
1892 }
1893 /* We're done with the route */
1894 RT_REMREF_LOCKED(route);
1895 RT_UNLOCK(route);
1896 route = NULL;
1897 /*
1898 * Send a conservative unicast "ARP probe".
1899 * This should force the other device to pick
1900 * a new number. This will not force the
1901 * device to pick a new number if the device
1902 * has already assigned that number. This will
1903 * not imply to the device that we own that
1904 * address. The link address is always
1905 * present; it's never freed.
1906 */
1907 ifnet_lock_shared(ifp);
1908 ifa = ifp->if_lladdr;
1909 ifa_addref(ifa);
1910 ifnet_lock_done(ifp);
1911 dlil_send_arp_internal(ifp, ARPOP_REQUEST,
1912 SDL(ifa->ifa_addr),
1913 SA(sender_ip),
1914 sender_hw,
1915 SA(target_ip));
1916 ifa_remref(ifa);
1917 ifa = NULL;
1918 os_atomic_inc(&arpstat.txconflicts, relaxed);
1919 }
1920 goto respond;
1921 } else if (keep_announcements != 0 &&
1922 target_ip->sin_addr.s_addr == sender_ip->sin_addr.s_addr) {
1923 /*
1924 * Don't create entry if link-local address and
1925 * link-local is disabled
1926 */
1927 if (!IN_LINKLOCAL(ntohl(sender_ip->sin_addr.s_addr)) ||
1928 (ifp->if_eflags & IFEF_ARPLL)) {
1929 if (route != NULL) {
1930 RT_REMREF_LOCKED(route);
1931 RT_UNLOCK(route);
1932 route = NULL;
1933 }
1934 /*
1935 * Callee holds a reference on the route and
1936 * returns with the route entry locked, upon
1937 * success.
1938 */
1939 error = arp_lookup_route(addr: &sender_ip->sin_addr,
1940 create: 1, proxy: 0, route: &route, ifscope: ifp->if_index);
1941
1942 if (error == 0) {
1943 RT_LOCK_ASSERT_HELD(route);
1944 }
1945
1946 if (error == 0 && route != NULL &&
1947 route->rt_gateway != NULL) {
1948 created_announcement = 1;
1949 }
1950 }
1951 if (created_announcement == 0) {
1952 goto respond;
1953 }
1954 } else {
1955 goto respond;
1956 }
1957 }
1958
1959 RT_LOCK_ASSERT_HELD(route);
1960 VERIFY(route->rt_expire == 0 || route->rt_rmx.rmx_expire != 0);
1961 VERIFY(route->rt_expire != 0 || route->rt_rmx.rmx_expire == 0);
1962
1963 gateway = SDL(route->rt_gateway);
1964 if (!bridged && route->rt_ifp != ifp) {
1965 if (!IN_LINKLOCAL(ntohl(sender_ip->sin_addr.s_addr)) ||
1966 !(ifp->if_eflags & IFEF_ARPLL)) {
1967 if (arp_verbose || log_arp_warnings) {
1968 log(LOG_ERR, "arp: %s is on %s but got "
1969 "reply from %s on %s\n",
1970 inet_ntop(AF_INET, &sender_ip->sin_addr,
1971 ipv4str, sizeof(ipv4str)),
1972 if_name(route->rt_ifp),
1973 sdl_addr_to_hex(sdl: sender_hw, orig_buf: buf,
1974 buflen: (int)sizeof(buf)), if_name(ifp));
1975 }
1976 goto respond;
1977 } else {
1978 /* Don't change a permanent address */
1979 if (route->rt_expire == 0) {
1980 goto respond;
1981 }
1982
1983 /*
1984 * We're about to check and/or change the route's ifp
1985 * and ifa, so do the lock dance: drop rt_lock, hold
1986 * rnh_lock and re-hold rt_lock to avoid violating the
1987 * lock ordering. We have an extra reference on the
1988 * route, so it won't go away while we do this.
1989 */
1990 RT_UNLOCK(route);
1991 lck_mtx_lock(rnh_lock);
1992 RT_LOCK(route);
1993 /*
1994 * Don't change the cloned route away from the
1995 * parent's interface if the address did resolve
1996 * or if the route is defunct. rt_ifp on both
1997 * the parent and the clone can now be freely
1998 * accessed now that we have acquired rnh_lock.
1999 */
2000 gateway = SDL(route->rt_gateway);
2001 if ((gateway->sdl_alen != 0 &&
2002 route->rt_parent != NULL &&
2003 route->rt_parent->rt_ifp == route->rt_ifp) ||
2004 (route->rt_flags & RTF_CONDEMNED)) {
2005 RT_REMREF_LOCKED(route);
2006 RT_UNLOCK(route);
2007 route = NULL;
2008 lck_mtx_unlock(rnh_lock);
2009 goto respond;
2010 }
2011 if (route->rt_ifp != ifp) {
2012 /*
2013 * Purge any link-layer info caching.
2014 */
2015 if (route->rt_llinfo_purge != NULL) {
2016 route->rt_llinfo_purge(route);
2017 }
2018
2019 /* Adjust route ref count for the interfaces */
2020 if (route->rt_if_ref_fn != NULL) {
2021 route->rt_if_ref_fn(ifp, 1);
2022 route->rt_if_ref_fn(route->rt_ifp, -1);
2023 }
2024 }
2025 /* Change the interface when the existing route is on */
2026 route->rt_ifp = ifp;
2027 /*
2028 * If rmx_mtu is not locked, update it
2029 * to the MTU used by the new interface.
2030 */
2031 if (!(route->rt_rmx.rmx_locks & RTV_MTU)) {
2032 route->rt_rmx.rmx_mtu = route->rt_ifp->if_mtu;
2033 if (INTF_ADJUST_MTU_FOR_CLAT46(ifp)) {
2034 route->rt_rmx.rmx_mtu = IN6_LINKMTU(route->rt_ifp);
2035 /* Further adjust the size for CLAT46 expansion */
2036 route->rt_rmx.rmx_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
2037 }
2038 }
2039
2040 rtsetifa(route, &best_ia->ia_ifa);
2041 gateway->sdl_index = ifp->if_index;
2042 RT_UNLOCK(route);
2043 lck_mtx_unlock(rnh_lock);
2044 RT_LOCK(route);
2045 /* Don't bother if the route is down */
2046 if (!(route->rt_flags & RTF_UP)) {
2047 goto respond;
2048 }
2049 /* Refresh gateway pointer */
2050 gateway = SDL(route->rt_gateway);
2051 }
2052 RT_LOCK_ASSERT_HELD(route);
2053 }
2054
2055 if (gateway->sdl_alen != 0 && bcmp(LLADDR(gateway),
2056 CONST_LLADDR(sender_hw), n: gateway->sdl_alen) != 0) {
2057 if (route->rt_expire != 0 &&
2058 (arp_verbose || log_arp_warnings)) {
2059 char buf2[3 * MAX_HW_LEN];
2060 log(LOG_INFO, "arp: %s moved from %s to %s on %s\n",
2061 inet_ntop(AF_INET, &sender_ip->sin_addr, ipv4str,
2062 sizeof(ipv4str)),
2063 sdl_addr_to_hex(sdl: gateway, orig_buf: buf, buflen: (int)sizeof(buf)),
2064 sdl_addr_to_hex(sdl: sender_hw, orig_buf: buf2, buflen: (int)sizeof(buf2)),
2065 if_name(ifp));
2066 } else if (route->rt_expire == 0) {
2067 if (arp_verbose || log_arp_warnings) {
2068 log(LOG_ERR, "arp: %s attempts to modify "
2069 "permanent entry for %s on %s\n",
2070 sdl_addr_to_hex(sdl: sender_hw, orig_buf: buf,
2071 buflen: (int)sizeof(buf)),
2072 inet_ntop(AF_INET, &sender_ip->sin_addr,
2073 ipv4str, sizeof(ipv4str)),
2074 if_name(ifp));
2075 }
2076 goto respond;
2077 }
2078 }
2079
2080 /* Copy the sender hardware address in to the route's gateway address */
2081 gateway->sdl_alen = sender_hw->sdl_alen;
2082 bcopy(CONST_LLADDR(sender_hw), LLADDR(gateway), n: gateway->sdl_alen);
2083
2084 /* Update the expire time for the route and clear the reject flag */
2085 if (route->rt_expire != 0) {
2086 rt_setexpire(route, net_uptime() + arpt_keep);
2087 }
2088 route->rt_flags &= ~RTF_REJECT;
2089
2090 /* cache the gateway (sender HW) address */
2091 arp_llreach_alloc(rt: route, ifp, LLADDR(gateway), alen: gateway->sdl_alen,
2092 solicited: (arpop == ARPOP_REPLY), p_rt_event_code: &rt_evcode);
2093
2094 llinfo = route->rt_llinfo;
2095 /* send a notification that the route is back up */
2096 if (ifp->if_addrlen == IF_LLREACH_MAXLEN &&
2097 route->rt_flags & RTF_ROUTER &&
2098 llinfo->la_flags & LLINFO_RTRFAIL_EVTSENT) {
2099 struct kev_msg ev_msg;
2100 struct kev_in_arpalive in_arpalive;
2101
2102 llinfo->la_flags &= ~LLINFO_RTRFAIL_EVTSENT;
2103 RT_UNLOCK(route);
2104 bzero(s: &ev_msg, n: sizeof(ev_msg));
2105 bzero(s: &in_arpalive, n: sizeof(in_arpalive));
2106 in_arpalive.link_data.if_family = ifp->if_family;
2107 in_arpalive.link_data.if_unit = ifp->if_unit;
2108 strlcpy(dst: in_arpalive.link_data.if_name, src: ifp->if_name, IFNAMSIZ);
2109 ev_msg.vendor_code = KEV_VENDOR_APPLE;
2110 ev_msg.kev_class = KEV_NETWORK_CLASS;
2111 ev_msg.kev_subclass = KEV_INET_SUBCLASS;
2112 ev_msg.event_code = KEV_INET_ARPRTRALIVE;
2113 ev_msg.dv[0].data_ptr = &in_arpalive;
2114 ev_msg.dv[0].data_length = sizeof(struct kev_in_arpalive);
2115 dlil_post_complete_msg(NULL, &ev_msg);
2116 RT_LOCK(route);
2117 }
2118 /* Update the llinfo, send out all queued packets at once */
2119 llinfo->la_asked = 0;
2120 llinfo->la_flags &= ~LLINFO_PROBING;
2121 llinfo->la_prbreq_cnt = 0;
2122
2123 if (rt_evcode) {
2124 /*
2125 * Enqueue work item to invoke callback for this route entry
2126 */
2127 route_event_enqueue_nwk_wq_entry(route, NULL, rt_evcode, NULL, TRUE);
2128
2129 if (route->rt_flags & RTF_ROUTER) {
2130 struct radix_node_head *rnh = NULL;
2131 struct route_event rt_ev;
2132 route_event_init(p_route_ev: &rt_ev, rt: route, NULL, route_ev_code: rt_evcode);
2133 /*
2134 * We already have a reference on rt. The function
2135 * frees it before returning.
2136 */
2137 RT_UNLOCK(route);
2138 lck_mtx_lock(rnh_lock);
2139 rnh = rt_tables[AF_INET];
2140
2141 if (rnh != NULL) {
2142 (void) rnh->rnh_walktree(rnh, route_event_walktree,
2143 (void *)&rt_ev);
2144 }
2145 lck_mtx_unlock(rnh_lock);
2146 RT_LOCK(route);
2147 }
2148 }
2149
2150 if (!qempty(&llinfo->la_holdq)) {
2151 uint32_t held;
2152 struct mbuf *m0;
2153 classq_pkt_t pkt = CLASSQ_PKT_INITIALIZER(pkt);
2154
2155 _getq_all(&llinfo->la_holdq, &pkt, NULL, &held, NULL);
2156 m0 = pkt.cp_mbuf;
2157 if (arp_verbose) {
2158 log(LOG_DEBUG, "%s: sending %u held packets\n",
2159 __func__, held);
2160 }
2161 os_atomic_add(&arpstat.held, -held, relaxed);
2162 VERIFY(qempty(&llinfo->la_holdq));
2163 RT_UNLOCK(route);
2164 dlil_output(ifp, PF_INET, m0, (caddr_t)route,
2165 rt_key(route), 0, NULL);
2166 RT_REMREF(route);
2167 route = NULL;
2168 }
2169
2170respond:
2171 if (route != NULL) {
2172 /* Mark use timestamp if we're going to send a reply */
2173 if (arpop == ARPOP_REQUEST && route->rt_llinfo != NULL) {
2174 arp_llreach_use(la: route->rt_llinfo);
2175 }
2176 RT_REMREF_LOCKED(route);
2177 RT_UNLOCK(route);
2178 route = NULL;
2179 }
2180
2181 if (arpop != ARPOP_REQUEST) {
2182 goto done;
2183 }
2184
2185 /* See comments at the beginning of this routine */
2186 arpstat.rxrequests++;
2187
2188 /* If we are not the target, check if we should proxy */
2189 if (target_ip->sin_addr.s_addr != best_ia_sin.sin_addr.s_addr) {
2190 /*
2191 * Find a proxy route; callee holds a reference on the
2192 * route and returns with the route entry locked, upon
2193 * success.
2194 */
2195 error = arp_lookup_route(addr: &target_ip->sin_addr, create: 0, SIN_PROXY,
2196 route: &route, ifscope: ifp->if_index);
2197
2198 if (error == 0) {
2199 RT_LOCK_ASSERT_HELD(route);
2200 /*
2201 * Return proxied ARP replies only on the interface
2202 * or bridge cluster where this network resides.
2203 * Otherwise we may conflict with the host we are
2204 * proxying for.
2205 */
2206 if (route->rt_ifp != ifp &&
2207 (route->rt_ifp->if_bridge != ifp->if_bridge ||
2208 ifp->if_bridge == NULL)) {
2209 RT_REMREF_LOCKED(route);
2210 RT_UNLOCK(route);
2211 goto done;
2212 }
2213 proxied = *SDL(route->rt_gateway);
2214 target_hw = &proxied;
2215 } else {
2216 /*
2217 * We don't have a route entry indicating we should
2218 * use proxy. If we aren't supposed to proxy all,
2219 * we are done.
2220 */
2221 if (!arp_proxyall) {
2222 goto done;
2223 }
2224
2225 /*
2226 * See if we have a route to the target ip before
2227 * we proxy it.
2228 */
2229 route = rtalloc1_scoped(__DECONST_SA(target_ip), 0, 0, ifp->if_index);
2230 if (!route) {
2231 goto done;
2232 }
2233
2234 /*
2235 * Don't proxy for hosts already on the same interface.
2236 */
2237 RT_LOCK(route);
2238 if (route->rt_ifp == ifp) {
2239 RT_UNLOCK(route);
2240 rtfree(route);
2241 goto done;
2242 }
2243 }
2244 /* Mark use timestamp */
2245 if (route->rt_llinfo != NULL) {
2246 arp_llreach_use(la: route->rt_llinfo);
2247 }
2248 RT_REMREF_LOCKED(route);
2249 RT_UNLOCK(route);
2250 }
2251
2252 dlil_send_arp(ifp, ARPOP_REPLY,
2253 target_hw, SA(target_ip),
2254 sender_hw, SA(sender_ip), 0);
2255
2256done:
2257 if (best_ia != NULL) {
2258 ifa_remref(ifa: &best_ia->ia_ifa);
2259 }
2260 return 0;
2261}
2262
2263void
2264arp_ifinit(struct ifnet *ifp, struct ifaddr *ifa)
2265{
2266 struct sockaddr *sa;
2267
2268 IFA_LOCK(ifa);
2269 ifa->ifa_rtrequest = arp_rtrequest;
2270 ifa->ifa_flags |= RTF_CLONING;
2271 sa = ifa->ifa_addr;
2272 IFA_UNLOCK(ifa);
2273 if ((ifp->if_flags & IFF_NOARP) == 0) {
2274 dlil_send_arp(ifp, ARPOP_REQUEST, NULL, sa, NULL, sa, 0);
2275 }
2276}
2277
2278static int
2279arp_getstat SYSCTL_HANDLER_ARGS
2280{
2281#pragma unused(oidp, arg1, arg2)
2282 if (req->oldptr == USER_ADDR_NULL) {
2283 req->oldlen = (size_t)sizeof(struct arpstat);
2284 }
2285
2286 return SYSCTL_OUT(req, &arpstat, MIN(sizeof(arpstat), req->oldlen));
2287}
2288