Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. =================================================================== RCS file: /ftp/cvs/cvsroot/src/sys/netinet/ip_input.c,v rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet/ip_input.c,v: warning: Unknown phrases like `commitid ...;' are present. retrieving revision 1.93.2.4 retrieving revision 1.109 diff -u -p -r1.93.2.4 -r1.109 --- src/sys/netinet/ip_input.c 2001/01/05 17:36:55 1.93.2.4 +++ src/sys/netinet/ip_input.c 2000/03/30 13:24:59 1.109 @@ -1,4 +1,4 @@ -/* $NetBSD: ip_input.c,v 1.93.2.4 2001/01/05 17:36:55 bouyer Exp $ */ +/* $NetBSD: ip_input.c,v 1.109 2000/03/30 13:24:59 augustss Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -120,8 +120,7 @@ #include #include -#include - +#include #include #include @@ -140,13 +139,10 @@ #include #include "gif.h" -#ifdef MROUTING -#include -#endif - #ifdef IPSEC #include #include +#include #endif #ifndef IPFORWARDING @@ -205,10 +201,6 @@ struct ifqueue ipintrq; struct ipstat ipstat; u_int16_t ip_id; -#ifdef PFIL_HOOKS -struct pfil_head inet_pfil_hook; -#endif - struct ipqhead ipq; int ipq_locked; @@ -308,24 +300,14 @@ ip_init() ip_id = time.tv_sec & 0xffff; ipintrq.ifq_maxlen = ipqmaxlen; TAILQ_INIT(&in_ifaddr); - in_ifaddrhashtbl = hashinit(IN_IFADDR_HASH_SIZE, HASH_LIST, M_IFADDR, - M_WAITOK, &in_ifaddrhash); + in_ifaddrhashtbl = + hashinit(IN_IFADDR_HASH_SIZE, M_IFADDR, M_WAITOK, &in_ifaddrhash); if (ip_mtudisc != 0) ip_mtudisc_timeout_q = rt_timer_queue_create(ip_mtudisc_timeout); #ifdef GATEWAY ipflow_init(); #endif - -#ifdef PFIL_HOOKS - /* Register our Packet Filter hook. */ - inet_pfil_hook.ph_type = PFIL_TYPE_AF; - inet_pfil_hook.ph_af = AF_INET; - i = pfil_head_register(&inet_pfil_hook); - if (i != 0) - printf("ip_init: WARNING: unable to register pfil hook, " - "error %d\n", i); -#endif /* PFIL_HOOKS */ } struct sockaddr_in ipaddr = { sizeof(ipaddr), AF_INET }; @@ -364,6 +346,11 @@ ip_input(struct mbuf *m) struct ipqent *ipqe; int hlen = 0, mff, len; int downmatch; +#ifdef PFIL_HOOKS + struct packet_filter_hook *pfh; + struct mbuf *m0; + int rv; +#endif /* PFIL_HOOKS */ #ifdef DIAGNOSTIC if ((m->m_flags & M_PKTHDR) == 0) @@ -423,8 +410,12 @@ ip_input(struct mbuf *m) goto bad; } - /* Retrieve the packet length. */ - len = ntohs(ip->ip_len); + /* + * Convert fields to host representation. + */ + NTOHS(ip->ip_len); + NTOHS(ip->ip_off); + len = ip->ip_len; /* * Check for additional length bogosity @@ -471,28 +462,21 @@ ip_input(struct mbuf *m) * Note that filters must _never_ set this flag, as another filter * in the list may have previously cleared it. */ - if (pfil_run_hooks(&inet_pfil_hook, &m, m->m_pkthdr.rcvif, - PFIL_IN) != 0) - return; - if (m == NULL) - return; - ip = mtod(m, struct ip *); + m0 = m; + pfh = pfil_hook_get(PFIL_IN, &inetsw[ip_protox[IPPROTO_IP]].pr_pfh); + for (; pfh; pfh = pfh->pfil_link.tqe_next) + if (pfh->pfil_func) { + rv = pfh->pfil_func(ip, hlen, + m->m_pkthdr.rcvif, 0, &m0); + if (rv) + return; + m = m0; + if (m == NULL) + return; + ip = mtod(m, struct ip *); + } #endif /* PFIL_HOOKS */ -#ifdef ALTQ - /* XXX Temporary until ALTQ is changed to use a pfil hook */ - if (altq_input != NULL && (*altq_input)(m, AF_INET) == 0) { - /* packet dropped by traffic conditioner */ - return; - } -#endif - - /* - * Convert fields to host representation. - */ - NTOHS(ip->ip_len); - NTOHS(ip->ip_off); - /* * Process options and, if not destined for us, * ship it on. ip_dooptions returns 1 when an @@ -703,8 +687,7 @@ found: * Switch out to protocol's input routine. */ #if IFA_STATS - if (ia && ip) - ia->ia_ifa.ifa_data.ifad_inbytes += ip->ip_len; + ia->ia_ifa.ifa_data.ifad_inbytes += ip->ip_len; #endif ipstat.ips_delivered++; { @@ -980,12 +963,8 @@ ip_dooptions(m) if (opt == IPOPT_NOP) optlen = 1; else { - if (cnt < IPOPT_OLEN + sizeof(*cp)) { - code = &cp[IPOPT_OLEN] - (u_char *)ip; - goto bad; - } optlen = cp[IPOPT_OLEN]; - if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) { + if (optlen <= 0 || optlen > cnt) { code = &cp[IPOPT_OLEN] - (u_char *)ip; goto bad; } @@ -1011,10 +990,6 @@ ip_dooptions(m) code = ICMP_UNREACH_NET_PROHIB; goto bad; } - if (optlen < IPOPT_OFFSET + sizeof(*cp)) { - code = &cp[IPOPT_OLEN] - (u_char *)ip; - goto bad; - } if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) { code = &cp[IPOPT_OFFSET] - (u_char *)ip; goto bad; @@ -1034,7 +1009,7 @@ ip_dooptions(m) break; } off--; /* 0 origin */ - if ((off + sizeof(struct in_addr)) > optlen) { + if (off > optlen - sizeof(struct in_addr)) { /* * End of source route. Should be for us. */ @@ -1066,10 +1041,6 @@ ip_dooptions(m) break; case IPOPT_RR: - if (optlen < IPOPT_OFFSET + sizeof(*cp)) { - code = &cp[IPOPT_OLEN] - (u_char *)ip; - goto bad; - } if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) { code = &cp[IPOPT_OFFSET] - (u_char *)ip; goto bad; @@ -1078,7 +1049,7 @@ ip_dooptions(m) * If no space remains, ignore. */ off--; /* 0 origin */ - if ((off + sizeof(struct in_addr)) > optlen) + if (off > optlen - sizeof(struct in_addr)) break; bcopy((caddr_t)(&ip->ip_dst), (caddr_t)&ipaddr.sin_addr, sizeof(ipaddr.sin_addr)); @@ -1101,20 +1072,11 @@ ip_dooptions(m) case IPOPT_TS: code = cp - (u_char *)ip; ipt = (struct ip_timestamp *)cp; - if (ipt->ipt_len < 4 || ipt->ipt_len > 40) { - code = (u_char *)&ipt->ipt_len - (u_char *)ip; - goto bad; - } - if (ipt->ipt_ptr < 5) { - code = (u_char *)&ipt->ipt_ptr - (u_char *)ip; + if (ipt->ipt_len < 5) goto bad; - } if (ipt->ipt_ptr > ipt->ipt_len - sizeof (int32_t)) { - if (++ipt->ipt_oflw == 0) { - code = (u_char *)&ipt->ipt_ptr - - (u_char *)ip; + if (++ipt->ipt_oflw == 0) goto bad; - } break; } cp0 = (cp + ipt->ipt_ptr - 1); @@ -1125,11 +1087,8 @@ ip_dooptions(m) case IPOPT_TS_TSANDADDR: if (ipt->ipt_ptr - 1 + sizeof(n_time) + - sizeof(struct in_addr) > ipt->ipt_len) { - code = (u_char *)&ipt->ipt_ptr - - (u_char *)ip; + sizeof(struct in_addr) > ipt->ipt_len) goto bad; - } ipaddr.sin_addr = dst; ia = ifatoia(ifaof_ifpforaddr(sintosa(&ipaddr), m->m_pkthdr.rcvif)); @@ -1142,11 +1101,8 @@ ip_dooptions(m) case IPOPT_TS_PRESPEC: if (ipt->ipt_ptr - 1 + sizeof(n_time) + - sizeof(struct in_addr) > ipt->ipt_len) { - code = (u_char *)&ipt->ipt_ptr - - (u_char *)ip; + sizeof(struct in_addr) > ipt->ipt_len) goto bad; - } bcopy(cp0, &ipaddr.sin_addr, sizeof(struct in_addr)); if (ifatoia(ifa_ifwithaddr(sintosa(&ipaddr))) @@ -1156,9 +1112,6 @@ ip_dooptions(m) break; default: - /* XXX can't take &ipt->ipt_flg */ - code = (u_char *)&ipt->ipt_ptr - - (u_char *)ip + 1; goto bad; } ntime = iptime(); @@ -1411,11 +1364,8 @@ ip_forward(m, srcrt) /* * Save at most 68 bytes of the packet in case * we need to generate an ICMP message to the src. - * Pullup to avoid sharing mbuf cluster between m and mcopy. */ - mcopy = m_copym(m, 0, imin((int)ip->ip_len, 68), M_DONTWAIT); - if (mcopy) - mcopy = m_pullup(mcopy, ip->ip_hl << 2); + mcopy = m_copy(m, 0, imin((int)ip->ip_len, 68)); /* * If forwarding packet using same interface that it came in on, @@ -1681,8 +1631,7 @@ ip_sysctl(name, namelen, oldp, oldlenp, case IPCTL_ANONPORTMIN: old = anonportmin; error = sysctl_int(oldp, oldlenp, newp, newlen, &anonportmin); - if (anonportmin >= anonportmax || anonportmin < 0 - || anonportmin > 65535 + if (anonportmin >= anonportmax || anonportmin > 65535 #ifndef IPNOPRIVPORTS || anonportmin < IPPORT_RESERVED #endif @@ -1694,8 +1643,7 @@ ip_sysctl(name, namelen, oldp, oldlenp, case IPCTL_ANONPORTMAX: old = anonportmax; error = sysctl_int(oldp, oldlenp, newp, newlen, &anonportmax); - if (anonportmin >= anonportmax || anonportmax < 0 - || anonportmax > 65535 + if (anonportmin >= anonportmax || anonportmax > 65535 #ifndef IPNOPRIVPORTS || anonportmax < IPPORT_RESERVED #endif @@ -1733,31 +1681,6 @@ ip_sysctl(name, namelen, oldp, oldlenp, &ip_gif_ttl)); #endif -#ifndef IPNOPRIVPORTS - case IPCTL_LOWPORTMIN: - old = lowportmin; - error = sysctl_int(oldp, oldlenp, newp, newlen, &lowportmin); - if (lowportmin >= lowportmax - || lowportmin > IPPORT_RESERVEDMAX - || lowportmin < IPPORT_RESERVEDMIN - ) { - lowportmin = old; - return (EINVAL); - } - return (error); - case IPCTL_LOWPORTMAX: - old = lowportmax; - error = sysctl_int(oldp, oldlenp, newp, newlen, &lowportmax); - if (lowportmin >= lowportmax - || lowportmax > IPPORT_RESERVEDMAX - || lowportmax < IPPORT_RESERVEDMIN - ) { - lowportmax = old; - return (EINVAL); - } - return (error); -#endif - default: return (EOPNOTSUPP); }