Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. =================================================================== RCS file: /ftp/cvs/cvsroot/src/sys/netinet/ip_input.c,v rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet/ip_input.c,v: warning: Unknown phrases like `commitid ...;' are present. retrieving revision 1.244 retrieving revision 1.260 diff -u -p -r1.244 -r1.260 --- src/sys/netinet/ip_input.c 2007/03/04 06:03:21 1.244 +++ src/sys/netinet/ip_input.c 2007/12/22 15:41:11 1.260 @@ -1,4 +1,4 @@ -/* $NetBSD: ip_input.c,v 1.244 2007/03/04 06:03:21 christos Exp $ */ +/* $NetBSD: ip_input.c,v 1.260 2007/12/22 15:41:11 matt Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -98,7 +98,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.244 2007/03/04 06:03:21 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.260 2007/12/22 15:41:11 matt Exp $"); #include "opt_inet.h" #include "opt_gateway.h" @@ -334,8 +334,10 @@ do { \ #define IPQ_UNLOCK() ipq_unlock() -POOL_INIT(inmulti_pool, sizeof(struct in_multi), 0, 0, 0, "inmltpl", NULL); -POOL_INIT(ipqent_pool, sizeof(struct ipqent), 0, 0, 0, "ipqepl", NULL); +POOL_INIT(inmulti_pool, sizeof(struct in_multi), 0, 0, 0, "inmltpl", NULL, + IPL_SOFTNET); +POOL_INIT(ipqent_pool, sizeof(struct ipqent), 0, 0, 0, "ipqepl", NULL, + IPL_VM); #ifdef INET_CSUM_COUNTERS #include @@ -427,7 +429,7 @@ ip_init(void) M_WAITOK, &in_multihash); ip_mtudisc_timeout_q = rt_timer_queue_create(ip_mtudisc_timeout); #ifdef GATEWAY - ipflow_init(); + ipflow_init(ip_hashsize); #endif #ifdef PFIL_HOOKS @@ -467,7 +469,6 @@ ipintr(void) splx(s); if (m == 0) return; - MCLAIM(m, &ip_rx_mowner); ip_input(m); } } @@ -895,22 +896,39 @@ ours: * but it's not worth the time; just let them time out.) */ if (ip->ip_off & ~htons(IP_DF|IP_RF)) { - + uint16_t off; + /* + * Prevent TCP blind data attacks by not allowing non-initial + * fragments to start at less than 68 bytes (minimal fragment + * size) and making sure the first fragment is at least 68 + * bytes. + */ + off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3; + if ((off > 0 ? off + hlen : len) < IP_MINFRAGSIZE - 1) { + ipstat.ips_badfrags++; + goto bad; + } /* * Look for queue of fragments * of this datagram. */ IPQ_LOCK(); hash = IPREASS_HASH(ip->ip_src.s_addr, ip->ip_id); - /* XXX LIST_FOREACH(fp, &ipq[hash], ipq_q) */ - for (fp = LIST_FIRST(&ipq[hash]); fp != NULL; - fp = LIST_NEXT(fp, ipq_q)) { + LIST_FOREACH(fp, &ipq[hash], ipq_q) { if (ip->ip_id == fp->ipq_id && in_hosteq(ip->ip_src, fp->ipq_src) && in_hosteq(ip->ip_dst, fp->ipq_dst) && - ip->ip_p == fp->ipq_p) + ip->ip_p == fp->ipq_p) { + /* + * Make sure the TOS is matches previous + * fragments. + */ + if (ip->ip_tos != fp->ipq_tos) { + ipstat.ips_badfrags++; + goto bad; + } goto found; - + } } fp = 0; found: @@ -1013,7 +1031,6 @@ found: /* XXX error stat??? */ error = EINVAL; DPRINTF(("ip_input: no SP, packet discarded\n"));/*XXX*/ - goto bad; } splx(s); if (error) @@ -1107,6 +1124,7 @@ ip_reass(struct ipqent *ipqe, struct ipq fp->ipq_ttl = IPFRAGTTL; fp->ipq_p = ipqe->ipqe_ip->ip_p; fp->ipq_id = ipqe->ipqe_ip->ip_id; + fp->ipq_tos = ipqe->ipqe_ip->ip_tos; TAILQ_INIT(&fp->ipq_fragq); fp->ipq_src = ipqe->ipqe_ip->ip_src; fp->ipq_dst = ipqe->ipqe_ip->ip_dst; @@ -1407,9 +1425,6 @@ ip_slowtimo(void) dropscanidx = i; } IPQ_UNLOCK(); -#ifdef GATEWAY - ipflow_slowtimo(); -#endif splx(s); } @@ -1675,23 +1690,18 @@ bad: struct in_ifaddr * ip_rtaddr(struct in_addr dst) { - if (!in_hosteq(dst, satocsin(rtcache_getdst(&ipforward_rt))->sin_addr)) - rtcache_free(&ipforward_rt); - else - rtcache_check(&ipforward_rt); - - if (ipforward_rt.ro_rt == NULL) { - struct sockaddr_in *sin = satosin(&ipforward_rt.ro_dst); - - sin->sin_family = AF_INET; - sin->sin_len = sizeof(*sin); - sin->sin_addr = dst; - - rtcache_init(&ipforward_rt); - if (ipforward_rt.ro_rt == NULL) - return NULL; - } - return ifatoia(ipforward_rt.ro_rt->rt_ifa); + struct rtentry *rt; + union { + struct sockaddr dst; + struct sockaddr_in dst4; + } u; + + sockaddr_in_init(&u.dst4, &dst, 0); + + if ((rt = rtcache_lookup(&ipforward_rt, &u.dst)) == NULL) + return NULL; + + return ifatoia(rt->rt_ifa); } /* @@ -1785,39 +1795,16 @@ ip_srcroute(void) return (m); } -/* - * Strip out IP options, at higher - * level protocol in the kernel. - * Second argument is buffer to which options - * will be moved, and return value is their length. - * XXX should be deleted; last arg currently ignored. - */ -void -ip_stripoptions(struct mbuf *m, struct mbuf *mopt) -{ - int i; - struct ip *ip = mtod(m, struct ip *); - void *opts; - int olen; - - olen = (ip->ip_hl << 2) - sizeof (struct ip); - opts = (void *)(ip + 1); - i = m->m_len - (sizeof (struct ip) + olen); - memmove(opts, (char *)opts + olen, (unsigned)i); - m->m_len -= olen; - if (m->m_flags & M_PKTHDR) - m->m_pkthdr.len -= olen; - ip->ip_len = htons(ntohs(ip->ip_len) - olen); - ip->ip_hl = sizeof (struct ip) >> 2; -} - const int inetctlerrmap[PRC_NCMDS] = { - 0, 0, 0, 0, - 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, - EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, - EMSGSIZE, EHOSTUNREACH, 0, 0, - 0, 0, 0, 0, - ENOPROTOOPT + [PRC_MSGSIZE] = EMSGSIZE, + [PRC_HOSTDEAD] = EHOSTDOWN, + [PRC_HOSTUNREACH] = EHOSTUNREACH, + [PRC_UNREACH_NET] = EHOSTUNREACH, + [PRC_UNREACH_HOST] = EHOSTUNREACH, + [PRC_UNREACH_PROTOCOL] = ECONNREFUSED, + [PRC_UNREACH_PORT] = ECONNREFUSED, + [PRC_UNREACH_SRCFAIL] = EHOSTUNREACH, + [PRC_PARAMPROB] = ENOPROTOOPT, }; /* @@ -1842,6 +1829,10 @@ ip_forward(struct mbuf *m, int srcrt) int error, type = 0, code = 0, destmtu = 0; struct mbuf *mcopy; n_long dest; + union { + struct sockaddr dst; + struct sockaddr_in dst4; + } u; /* * We are now in the output path. @@ -1870,25 +1861,11 @@ ip_forward(struct mbuf *m, int srcrt) return; } - if (!in_hosteq(ip->ip_dst, - satocsin(rtcache_getdst(&ipforward_rt))->sin_addr)) - rtcache_free(&ipforward_rt); - else - rtcache_check(&ipforward_rt); - if (ipforward_rt.ro_rt == NULL) { - struct sockaddr_in *sin = satosin(&ipforward_rt.ro_dst); - - sin->sin_family = AF_INET; - sin->sin_len = sizeof(*sin); - sin->sin_addr = ip->ip_dst; - - rtcache_init(&ipforward_rt); - if (ipforward_rt.ro_rt == NULL) { - icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_NET, dest, 0); - return; - } + sockaddr_in_init(&u.dst4, &ip->ip_dst, 0); + if ((rt = rtcache_lookup(&ipforward_rt, &u.dst)) == NULL) { + icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_NET, dest, 0); + return; } - rt = ipforward_rt.ro_rt; /* * Save at most 68 bytes of the packet in case @@ -1911,7 +1888,7 @@ ip_forward(struct mbuf *m, int srcrt) */ if (rt->rt_ifp == m->m_pkthdr.rcvif && (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0 && - !in_nullhost(satosin(rt_key(rt))->sin_addr) && + !in_nullhost(satocsin(rt_getkey(rt))->sin_addr) && ipsendredirects && !srcrt) { if (rt->rt_ifa && (ip->ip_src.s_addr & ifatoia(rt->rt_ifa)->ia_subnetmask) == @@ -1977,8 +1954,8 @@ ip_forward(struct mbuf *m, int srcrt) type = ICMP_UNREACH; code = ICMP_UNREACH_NEEDFRAG; #if !defined(IPSEC) && !defined(FAST_IPSEC) - if (ipforward_rt.ro_rt != NULL) - destmtu = ipforward_rt.ro_rt->rt_ifp->if_mtu; + if ((rt = rtcache_getrt(&ipforward_rt)) != NULL) + destmtu = rt->rt_ifp->if_mtu; #else /* * If the packet is routed over IPsec tunnel, tell the @@ -1986,7 +1963,7 @@ ip_forward(struct mbuf *m, int srcrt) * tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz * XXX quickhack!!! */ - if (ipforward_rt.ro_rt != NULL) { + if ((rt = rtcache_getrt(&ipforward_rt)) != NULL) { struct secpolicy *sp; int ipsecerror; size_t ipsechdr; @@ -1997,7 +1974,7 @@ ip_forward(struct mbuf *m, int srcrt) &ipsecerror); if (sp == NULL) - destmtu = ipforward_rt.ro_rt->rt_ifp->if_mtu; + destmtu = rt->rt_ifp->if_mtu; else { /* count IPsec header size */ ipsechdr = ipsec4_hdrsiz(mcopy, @@ -2012,11 +1989,11 @@ ip_forward(struct mbuf *m, int srcrt) && sp->req->sav != NULL && sp->req->sav->sah != NULL) { ro = &sp->req->sav->sah->sa_route; - if (ro->ro_rt && ro->ro_rt->rt_ifp) { + if (rt && rt->rt_ifp) { destmtu = - ro->ro_rt->rt_rmx.rmx_mtu ? - ro->ro_rt->rt_rmx.rmx_mtu : - ro->ro_rt->rt_ifp->if_mtu; + rt->rt_rmx.rmx_mtu ? + rt->rt_rmx.rmx_mtu : + rt->rt_ifp->if_mtu; destmtu -= ipsechdr; } } @@ -2097,13 +2074,12 @@ ip_savecontrol(struct inpcb *inp, struct if (inp->inp_flags & INP_RECVIF) { struct sockaddr_dl sdl; - sdl.sdl_len = offsetof(struct sockaddr_dl, sdl_data[0]); - sdl.sdl_family = AF_LINK; - sdl.sdl_index = m->m_pkthdr.rcvif ? - m->m_pkthdr.rcvif->if_index : 0; - sdl.sdl_nlen = sdl.sdl_alen = sdl.sdl_slen = 0; - *mp = sbcreatecontrol((void *) &sdl, sdl.sdl_len, - IP_RECVIF, IPPROTO_IP); + sockaddr_dl_init(&sdl, sizeof(sdl), + (m->m_pkthdr.rcvif != NULL) + ? m->m_pkthdr.rcvif->if_index + : 0, + 0, NULL, 0, NULL, 0); + *mp = sbcreatecontrol(&sdl, sdl.sdl_len, IP_RECVIF, IPPROTO_IP); if (*mp) mp = &(*mp)->m_next; } @@ -2161,8 +2137,7 @@ sysctl_net_inet_ip_pmtudto(SYSCTLFN_ARGS #ifdef GATEWAY /* - * sysctl helper routine for net.inet.ip.maxflows. apparently if - * maxflows is even looked up, we "reap flows". + * sysctl helper routine for net.inet.ip.maxflows. */ static int sysctl_net_inet_ip_maxflows(SYSCTLFN_ARGS) @@ -2170,7 +2145,7 @@ sysctl_net_inet_ip_maxflows(SYSCTLFN_ARG int s; s = sysctl_lookup(SYSCTLFN_CALL(rnode)); - if (s) + if (s || newp == NULL) return (s); s = splsoftnet(); @@ -2179,6 +2154,35 @@ sysctl_net_inet_ip_maxflows(SYSCTLFN_ARG return (0); } + +static int +sysctl_net_inet_ip_hashsize(SYSCTLFN_ARGS) +{ + int error, tmp; + struct sysctlnode node; + + node = *rnode; + tmp = ip_hashsize; + node.sysctl_data = &tmp; + error = sysctl_lookup(SYSCTLFN_CALL(&node)); + if (error || newp == NULL) + return (error); + + if ((tmp & (tmp - 1)) == 0 && tmp != 0) { + /* + * Can only fail due to malloc() + */ + if (ipflow_invalidate_all(tmp)) + return ENOMEM; + } else { + /* + * EINVAL if not a power of 2 + */ + return EINVAL; + } + + return (0); +} #endif /* GATEWAY */ @@ -2300,6 +2304,13 @@ SYSCTL_SETUP(sysctl_net_inet_ip_setup, " sysctl_net_inet_ip_maxflows, 0, &ip_maxflows, 0, CTL_NET, PF_INET, IPPROTO_IP, IPCTL_MAXFLOWS, CTL_EOL); + sysctl_createv(clog, 0, NULL, NULL, + CTLFLAG_PERMANENT|CTLFLAG_READWRITE, + CTLTYPE_INT, "hashsize", + SYSCTL_DESCR("Size of hash table for fast forwarding (IPv4)"), + sysctl_net_inet_ip_hashsize, 0, &ip_hashsize, 0, + CTL_NET, PF_INET, IPPROTO_IP, + CTL_CREATE, CTL_EOL); #endif /* GATEWAY */ sysctl_createv(clog, 0, NULL, NULL, CTLFLAG_PERMANENT|CTLFLAG_READWRITE,