version 1.218.2.8, 2008/01/21 09:47:16 |
version 1.270, 2008/05/02 13:40:32 |
|
|
* 2. Redistributions in binary form must reproduce the above copyright |
* 2. Redistributions in binary form must reproduce the above copyright |
* notice, this list of conditions and the following disclaimer in the |
* notice, this list of conditions and the following disclaimer in the |
* documentation and/or other materials provided with the distribution. |
* documentation and/or other materials provided with the distribution. |
* 3. All advertising materials mentioning features or use of this software |
|
* must display the following acknowledgement: |
|
* This product includes software developed by the NetBSD |
|
* Foundation, Inc. and its contributors. |
|
* 4. Neither the name of The NetBSD Foundation nor the names of its |
|
* contributors may be used to endorse or promote products derived |
|
* from this software without specific prior written permission. |
|
* |
* |
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS |
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS |
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED |
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED |
Line 135 __KERNEL_RCSID(0, "$NetBSD$"); |
|
Line 128 __KERNEL_RCSID(0, "$NetBSD$"); |
|
#include <netinet/in_proto.h> |
#include <netinet/in_proto.h> |
#include <netinet/in_var.h> |
#include <netinet/in_var.h> |
#include <netinet/ip_var.h> |
#include <netinet/ip_var.h> |
|
#include <netinet/ip_private.h> |
#include <netinet/ip_icmp.h> |
#include <netinet/ip_icmp.h> |
/* just for gif_ttl */ |
/* just for gif_ttl */ |
#include <netinet/in_gif.h> |
#include <netinet/in_gif.h> |
Line 148 __KERNEL_RCSID(0, "$NetBSD$"); |
|
Line 142 __KERNEL_RCSID(0, "$NetBSD$"); |
|
|
|
#ifdef IPSEC |
#ifdef IPSEC |
#include <netinet6/ipsec.h> |
#include <netinet6/ipsec.h> |
|
#include <netinet6/ipsec_private.h> |
#include <netkey/key.h> |
#include <netkey/key.h> |
#endif |
#endif |
#ifdef FAST_IPSEC |
#ifdef FAST_IPSEC |
Line 230 u_long in_multihash; /* size of hash |
|
Line 225 u_long in_multihash; /* size of hash |
|
int in_multientries; /* total number of addrs */ |
int in_multientries; /* total number of addrs */ |
struct in_multihashhead *in_multihashtbl; |
struct in_multihashhead *in_multihashtbl; |
struct ifqueue ipintrq; |
struct ifqueue ipintrq; |
struct ipstat ipstat; |
|
uint16_t ip_id; |
uint16_t ip_id; |
|
|
|
percpu_t *ipstat_percpu; |
|
|
#ifdef PFIL_HOOKS |
#ifdef PFIL_HOOKS |
struct pfil_head inet_pfil_hook; |
struct pfil_head inet_pfil_hook; |
#endif |
#endif |
|
|
for (i = 0; i < IPREASS_NHASH; i++) |
for (i = 0; i < IPREASS_NHASH; i++) |
LIST_INIT(&ipq[i]); |
LIST_INIT(&ipq[i]); |
|
|
|
ip_initid(); |
ip_id = time_second & 0xfffff; |
ip_id = time_second & 0xfffff; |
|
|
ipintrq.ifq_maxlen = ipqmaxlen; |
ipintrq.ifq_maxlen = ipqmaxlen; |
|
|
MOWNER_ATTACH(&ip_tx_mowner); |
MOWNER_ATTACH(&ip_tx_mowner); |
MOWNER_ATTACH(&ip_rx_mowner); |
MOWNER_ATTACH(&ip_rx_mowner); |
#endif /* MBUFTRACE */ |
#endif /* MBUFTRACE */ |
|
|
|
ipstat_percpu = percpu_alloc(sizeof(uint64_t) * IP_NSTATS); |
} |
} |
|
|
struct sockaddr_in ipaddr = { |
struct sockaddr_in ipaddr = { |
|
|
int s; |
int s; |
struct mbuf *m; |
struct mbuf *m; |
|
|
|
mutex_enter(softnet_lock); |
|
KERNEL_LOCK(1, NULL); |
while (!IF_IS_EMPTY(&ipintrq)) { |
while (!IF_IS_EMPTY(&ipintrq)) { |
s = splnet(); |
s = splnet(); |
IF_DEQUEUE(&ipintrq, m); |
IF_DEQUEUE(&ipintrq, m); |
splx(s); |
splx(s); |
if (m == 0) |
if (m == NULL) |
return; |
break; |
ip_input(m); |
ip_input(m); |
} |
} |
|
KERNEL_UNLOCK_ONE(NULL); |
|
mutex_exit(softnet_lock); |
} |
} |
|
|
/* |
/* |
Line 510 ip_input(struct mbuf *m) |
|
Line 513 ip_input(struct mbuf *m) |
|
*/ |
*/ |
if (TAILQ_FIRST(&in_ifaddrhead) == 0) |
if (TAILQ_FIRST(&in_ifaddrhead) == 0) |
goto bad; |
goto bad; |
ipstat.ips_total++; |
IP_STATINC(IP_STAT_TOTAL); |
/* |
/* |
* If the IP header is not aligned, slurp it up into a new |
* If the IP header is not aligned, slurp it up into a new |
* mbuf with space for link headers, in the event we forward |
* mbuf with space for link headers, in the event we forward |
Line 521 ip_input(struct mbuf *m) |
|
Line 524 ip_input(struct mbuf *m) |
|
if ((m = m_copyup(m, sizeof(struct ip), |
if ((m = m_copyup(m, sizeof(struct ip), |
(max_linkhdr + 3) & ~3)) == NULL) { |
(max_linkhdr + 3) & ~3)) == NULL) { |
/* XXXJRT new stat, please */ |
/* XXXJRT new stat, please */ |
ipstat.ips_toosmall++; |
IP_STATINC(IP_STAT_TOOSMALL); |
return; |
return; |
} |
} |
} else if (__predict_false(m->m_len < sizeof (struct ip))) { |
} else if (__predict_false(m->m_len < sizeof (struct ip))) { |
if ((m = m_pullup(m, sizeof (struct ip))) == NULL) { |
if ((m = m_pullup(m, sizeof (struct ip))) == NULL) { |
ipstat.ips_toosmall++; |
IP_STATINC(IP_STAT_TOOSMALL); |
return; |
return; |
} |
} |
} |
} |
ip = mtod(m, struct ip *); |
ip = mtod(m, struct ip *); |
if (ip->ip_v != IPVERSION) { |
if (ip->ip_v != IPVERSION) { |
ipstat.ips_badvers++; |
IP_STATINC(IP_STAT_BADVERS); |
goto bad; |
goto bad; |
} |
} |
hlen = ip->ip_hl << 2; |
hlen = ip->ip_hl << 2; |
if (hlen < sizeof(struct ip)) { /* minimum header length */ |
if (hlen < sizeof(struct ip)) { /* minimum header length */ |
ipstat.ips_badhlen++; |
IP_STATINC(IP_STAT_BADHLEN); |
goto bad; |
goto bad; |
} |
} |
if (hlen > m->m_len) { |
if (hlen > m->m_len) { |
if ((m = m_pullup(m, hlen)) == 0) { |
if ((m = m_pullup(m, hlen)) == 0) { |
ipstat.ips_badhlen++; |
IP_STATINC(IP_STAT_BADHLEN); |
return; |
return; |
} |
} |
ip = mtod(m, struct ip *); |
ip = mtod(m, struct ip *); |
Line 553 ip_input(struct mbuf *m) |
|
Line 556 ip_input(struct mbuf *m) |
|
* not allowed. |
* not allowed. |
*/ |
*/ |
if (IN_MULTICAST(ip->ip_src.s_addr)) { |
if (IN_MULTICAST(ip->ip_src.s_addr)) { |
ipstat.ips_badaddr++; |
IP_STATINC(IP_STAT_BADADDR); |
goto bad; |
goto bad; |
} |
} |
|
|
Line 561 ip_input(struct mbuf *m) |
|
Line 564 ip_input(struct mbuf *m) |
|
if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || |
if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || |
(ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) { |
(ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) { |
if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { |
if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { |
ipstat.ips_badaddr++; |
IP_STATINC(IP_STAT_BADADDR); |
goto bad; |
goto bad; |
} |
} |
} |
} |
Line 599 ip_input(struct mbuf *m) |
|
Line 602 ip_input(struct mbuf *m) |
|
* Check for additional length bogosity |
* Check for additional length bogosity |
*/ |
*/ |
if (len < hlen) { |
if (len < hlen) { |
ipstat.ips_badlen++; |
IP_STATINC(IP_STAT_BADLEN); |
goto bad; |
goto bad; |
} |
} |
|
|
Line 610 ip_input(struct mbuf *m) |
|
Line 613 ip_input(struct mbuf *m) |
|
* Drop packet if shorter than we expect. |
* Drop packet if shorter than we expect. |
*/ |
*/ |
if (m->m_pkthdr.len < len) { |
if (m->m_pkthdr.len < len) { |
ipstat.ips_tooshort++; |
IP_STATINC(IP_STAT_TOOSHORT); |
goto bad; |
goto bad; |
} |
} |
if (m->m_pkthdr.len > len) { |
if (m->m_pkthdr.len > len) { |
Line 779 ip_input(struct mbuf *m) |
|
Line 782 ip_input(struct mbuf *m) |
|
* ip_output().) |
* ip_output().) |
*/ |
*/ |
if (ip_mforward(m, m->m_pkthdr.rcvif) != 0) { |
if (ip_mforward(m, m->m_pkthdr.rcvif) != 0) { |
ipstat.ips_cantforward++; |
IP_STATINC(IP_STAT_CANTFORWARD); |
m_freem(m); |
m_freem(m); |
return; |
return; |
} |
} |
Line 791 ip_input(struct mbuf *m) |
|
Line 794 ip_input(struct mbuf *m) |
|
*/ |
*/ |
if (ip->ip_p == IPPROTO_IGMP) |
if (ip->ip_p == IPPROTO_IGMP) |
goto ours; |
goto ours; |
ipstat.ips_forward++; |
IP_STATINC(IP_STAT_CANTFORWARD); |
} |
} |
#endif |
#endif |
/* |
/* |
Line 800 ip_input(struct mbuf *m) |
|
Line 803 ip_input(struct mbuf *m) |
|
*/ |
*/ |
IN_LOOKUP_MULTI(ip->ip_dst, m->m_pkthdr.rcvif, inm); |
IN_LOOKUP_MULTI(ip->ip_dst, m->m_pkthdr.rcvif, inm); |
if (inm == NULL) { |
if (inm == NULL) { |
ipstat.ips_cantforward++; |
IP_STATINC(IP_STAT_CANTFORWARD); |
m_freem(m); |
m_freem(m); |
return; |
return; |
} |
} |
Line 814 ip_input(struct mbuf *m) |
|
Line 817 ip_input(struct mbuf *m) |
|
* Not for us; forward if possible and desirable. |
* Not for us; forward if possible and desirable. |
*/ |
*/ |
if (ipforwarding == 0) { |
if (ipforwarding == 0) { |
ipstat.ips_cantforward++; |
IP_STATINC(IP_STAT_CANTFORWARD); |
m_freem(m); |
m_freem(m); |
} else { |
} else { |
/* |
/* |
Line 825 ip_input(struct mbuf *m) |
|
Line 828 ip_input(struct mbuf *m) |
|
*/ |
*/ |
if (downmatch) { |
if (downmatch) { |
icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0); |
icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0); |
ipstat.ips_cantforward++; |
IP_STATINC(IP_STAT_CANTFORWARD); |
return; |
return; |
} |
} |
#ifdef IPSEC |
#ifdef IPSEC |
if (ipsec4_in_reject(m, NULL)) { |
if (ipsec4_in_reject(m, NULL)) { |
ipsecstat.in_polvio++; |
IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); |
goto bad; |
goto bad; |
} |
} |
#endif |
#endif |
Line 858 ip_input(struct mbuf *m) |
|
Line 861 ip_input(struct mbuf *m) |
|
KEY_FREESP(&sp); |
KEY_FREESP(&sp); |
splx(s); |
splx(s); |
if (error) { |
if (error) { |
ipstat.ips_cantforward++; |
IP_STATINC(IP_STAT_CANTFORWARD); |
goto bad; |
goto bad; |
} |
} |
|
|
|
|
*/ |
*/ |
off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3; |
off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3; |
if ((off > 0 ? off + hlen : len) < IP_MINFRAGSIZE - 1) { |
if ((off > 0 ? off + hlen : len) < IP_MINFRAGSIZE - 1) { |
ipstat.ips_badfrags++; |
IP_STATINC(IP_STAT_BADFRAGS); |
goto bad; |
goto bad; |
} |
} |
/* |
/* |
|
|
* fragments. |
* fragments. |
*/ |
*/ |
if (ip->ip_tos != fp->ipq_tos) { |
if (ip->ip_tos != fp->ipq_tos) { |
ipstat.ips_badfrags++; |
IP_STATINC(IP_STAT_BADFRAGS); |
goto bad; |
goto bad; |
} |
} |
goto found; |
goto found; |
|
|
*/ |
*/ |
if (ntohs(ip->ip_len) == 0 || |
if (ntohs(ip->ip_len) == 0 || |
(ntohs(ip->ip_len) & 0x7) != 0) { |
(ntohs(ip->ip_len) & 0x7) != 0) { |
ipstat.ips_badfrags++; |
IP_STATINC(IP_STAT_BADFRAGS); |
IPQ_UNLOCK(); |
IPQ_UNLOCK(); |
goto bad; |
goto bad; |
} |
} |
|
|
* attempt reassembly; if it succeeds, proceed. |
* attempt reassembly; if it succeeds, proceed. |
*/ |
*/ |
if (mff || ip->ip_off != htons(0)) { |
if (mff || ip->ip_off != htons(0)) { |
ipstat.ips_fragments++; |
IP_STATINC(IP_STAT_FRAGMENTS); |
s = splvm(); |
s = splvm(); |
ipqe = pool_get(&ipqent_pool, PR_NOWAIT); |
ipqe = pool_get(&ipqent_pool, PR_NOWAIT); |
splx(s); |
splx(s); |
if (ipqe == NULL) { |
if (ipqe == NULL) { |
ipstat.ips_rcvmemdrop++; |
IP_STATINC(IP_STAT_RCVMEMDROP); |
IPQ_UNLOCK(); |
IPQ_UNLOCK(); |
goto bad; |
goto bad; |
} |
} |
|
|
IPQ_UNLOCK(); |
IPQ_UNLOCK(); |
return; |
return; |
} |
} |
ipstat.ips_reassembled++; |
IP_STATINC(IP_STAT_REASSEMBLED); |
ip = mtod(m, struct ip *); |
ip = mtod(m, struct ip *); |
hlen = ip->ip_hl << 2; |
hlen = ip->ip_hl << 2; |
ip->ip_len = htons(ntohs(ip->ip_len) + hlen); |
ip->ip_len = htons(ntohs(ip->ip_len) + hlen); |
|
|
*/ |
*/ |
if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0 && |
if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0 && |
ipsec4_in_reject(m, NULL)) { |
ipsec4_in_reject(m, NULL)) { |
ipsecstat.in_polvio++; |
IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); |
goto bad; |
goto bad; |
} |
} |
#endif |
#endif |
Line 1045 DPRINTF(("ip_input: no SP, packet discar |
|
Line 1048 DPRINTF(("ip_input: no SP, packet discar |
|
if (ia && ip) |
if (ia && ip) |
ia->ia_ifa.ifa_data.ifad_inbytes += ntohs(ip->ip_len); |
ia->ia_ifa.ifa_data.ifad_inbytes += ntohs(ip->ip_len); |
#endif |
#endif |
ipstat.ips_delivered++; |
IP_STATINC(IP_STAT_DELIVERED); |
{ |
{ |
int off = hlen, nh = ip->ip_p; |
int off = hlen, nh = ip->ip_p; |
|
|
|
|
return; |
return; |
|
|
badcsum: |
badcsum: |
ipstat.ips_badsum++; |
IP_STATINC(IP_STAT_BADSUM); |
m_freem(m); |
m_freem(m); |
} |
} |
|
|
|
|
q = TAILQ_FIRST(&fp->ipq_fragq); |
q = TAILQ_FIRST(&fp->ipq_fragq); |
ip = q->ipqe_ip; |
ip = q->ipqe_ip; |
if ((next + (ip->ip_hl << 2)) > IP_MAXPACKET) { |
if ((next + (ip->ip_hl << 2)) > IP_MAXPACKET) { |
ipstat.ips_toolong++; |
IP_STATINC(IP_STAT_TOOLONG); |
ip_freef(fp); |
ip_freef(fp); |
return (0); |
return (0); |
} |
} |
|
|
if (fp != 0) |
if (fp != 0) |
fp->ipq_nfrags--; |
fp->ipq_nfrags--; |
ip_nfrags--; |
ip_nfrags--; |
ipstat.ips_fragdropped++; |
IP_STATINC(IP_STAT_FRAGDROPPED); |
m_freem(m); |
m_freem(m); |
s = splvm(); |
s = splvm(); |
pool_put(&ipqent_pool, ipqe); |
pool_put(&ipqent_pool, ipqe); |
Line 1332 ip_reass_ttl_decr(u_int ticks) |
|
Line 1335 ip_reass_ttl_decr(u_int ticks) |
|
0 : fp->ipq_ttl - ticks); |
0 : fp->ipq_ttl - ticks); |
nfp = LIST_NEXT(fp, ipq_q); |
nfp = LIST_NEXT(fp, ipq_q); |
if (fp->ipq_ttl == 0) { |
if (fp->ipq_ttl == 0) { |
ipstat.ips_fragtimeout++; |
IP_STATINC(IP_STAT_FRAGTIMEOUT); |
ip_freef(fp); |
ip_freef(fp); |
} else { |
} else { |
nfrags += fp->ipq_nfrags; |
nfrags += fp->ipq_nfrags; |
Line 1383 ip_slowtimo(void) |
|
Line 1386 ip_slowtimo(void) |
|
static u_int dropscanidx = 0; |
static u_int dropscanidx = 0; |
u_int i; |
u_int i; |
u_int median_ttl; |
u_int median_ttl; |
int s = splsoftnet(); |
|
|
mutex_enter(softnet_lock); |
|
KERNEL_LOCK(1, NULL); |
|
|
IPQ_LOCK(); |
IPQ_LOCK(); |
|
|
Line 1425 ip_slowtimo(void) |
|
Line 1430 ip_slowtimo(void) |
|
dropscanidx = i; |
dropscanidx = i; |
} |
} |
IPQ_UNLOCK(); |
IPQ_UNLOCK(); |
splx(s); |
|
|
KERNEL_UNLOCK_ONE(NULL); |
|
mutex_exit(softnet_lock); |
} |
} |
|
|
/* |
/* |
* Drain off all datagram fragments. |
* Drain off all datagram fragments. Don't acquire softnet_lock as |
|
* can be called from hardware interrupt context. |
*/ |
*/ |
void |
void |
ip_drain(void) |
ip_drain(void) |
{ |
{ |
|
|
|
KERNEL_LOCK(1, NULL); |
|
|
/* |
/* |
* We may be called from a device's interrupt context. If |
* We may be called from a device's interrupt context. If |
* the ipq is already busy, just bail out now. |
* the ipq is already busy, just bail out now. |
*/ |
*/ |
if (ipq_lock_try() == 0) |
if (ipq_lock_try() != 0) { |
return; |
/* |
|
* Drop half the total fragments now. If more mbufs are |
/* |
* needed, we will be called again soon. |
* Drop half the total fragments now. If more mbufs are needed, |
*/ |
* we will be called again soon. |
ip_reass_drophalf(); |
*/ |
IPQ_UNLOCK(); |
ip_reass_drophalf(); |
} |
|
|
IPQ_UNLOCK(); |
KERNEL_UNLOCK_ONE(NULL); |
} |
} |
|
|
/* |
/* |
Line 1679 ip_dooptions(struct mbuf *m) |
|
Line 1689 ip_dooptions(struct mbuf *m) |
|
return (0); |
return (0); |
bad: |
bad: |
icmp_error(m, type, code, 0, 0); |
icmp_error(m, type, code, 0, 0); |
ipstat.ips_badoptions++; |
IP_STATINC(IP_STAT_BADOPTIONS); |
return (1); |
return (1); |
} |
} |
|
|
Line 1852 ip_forward(struct mbuf *m, int srcrt) |
|
Line 1862 ip_forward(struct mbuf *m, int srcrt) |
|
} |
} |
#endif |
#endif |
if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(ip->ip_dst) == 0) { |
if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(ip->ip_dst) == 0) { |
ipstat.ips_cantforward++; |
IP_STATINC(IP_STAT_CANTFORWARD); |
m_freem(m); |
m_freem(m); |
return; |
return; |
} |
} |
Line 1916 ip_forward(struct mbuf *m, int srcrt) |
|
Line 1926 ip_forward(struct mbuf *m, int srcrt) |
|
(struct ip_moptions *)NULL, (struct socket *)NULL); |
(struct ip_moptions *)NULL, (struct socket *)NULL); |
|
|
if (error) |
if (error) |
ipstat.ips_cantforward++; |
IP_STATINC(IP_STAT_CANTFORWARD); |
else { |
else { |
ipstat.ips_forward++; |
uint64_t *ips = IP_STAT_GETREF(); |
if (type) |
ips[IP_STAT_FORWARD]++; |
ipstat.ips_redirectsent++; |
if (type) { |
else { |
ips[IP_STAT_REDIRECTSENT]++; |
|
IP_STAT_PUTREF(); |
|
} else { |
|
IP_STAT_PUTREF(); |
if (mcopy) { |
if (mcopy) { |
#ifdef GATEWAY |
#ifdef GATEWAY |
if (mcopy->m_flags & M_CANFASTFWD) |
if (mcopy->m_flags & M_CANFASTFWD) |
Line 1953 ip_forward(struct mbuf *m, int srcrt) |
|
Line 1966 ip_forward(struct mbuf *m, int srcrt) |
|
case EMSGSIZE: |
case EMSGSIZE: |
type = ICMP_UNREACH; |
type = ICMP_UNREACH; |
code = ICMP_UNREACH_NEEDFRAG; |
code = ICMP_UNREACH_NEEDFRAG; |
#if !defined(IPSEC) && !defined(FAST_IPSEC) |
|
if ((rt = rtcache_validate(&ipforward_rt)) != NULL) |
|
destmtu = rt->rt_ifp->if_mtu; |
|
#else |
|
/* |
|
* If the packet is routed over IPsec tunnel, tell the |
|
* originator the tunnel MTU. |
|
* tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz |
|
* XXX quickhack!!! |
|
*/ |
|
if ((rt = rtcache_validate(&ipforward_rt)) != NULL) { |
if ((rt = rtcache_validate(&ipforward_rt)) != NULL) { |
|
|
|
#if defined(IPSEC) || defined(FAST_IPSEC) |
|
/* |
|
* If the packet is routed over IPsec tunnel, tell the |
|
* originator the tunnel MTU. |
|
* tunnel MTU = if MTU - sizeof(IP) - ESP/AH hdrsiz |
|
* XXX quickhack!!! |
|
*/ |
|
|
struct secpolicy *sp; |
struct secpolicy *sp; |
int ipsecerror; |
int ipsecerror; |
size_t ipsechdr; |
size_t ipsechdr; |
Line 1972 ip_forward(struct mbuf *m, int srcrt) |
|
Line 1985 ip_forward(struct mbuf *m, int srcrt) |
|
sp = ipsec4_getpolicybyaddr(mcopy, |
sp = ipsec4_getpolicybyaddr(mcopy, |
IPSEC_DIR_OUTBOUND, IP_FORWARDING, |
IPSEC_DIR_OUTBOUND, IP_FORWARDING, |
&ipsecerror); |
&ipsecerror); |
|
#endif |
|
|
if (sp == NULL) |
destmtu = rt->rt_ifp->if_mtu; |
destmtu = rt->rt_ifp->if_mtu; |
#if defined(IPSEC) || defined(FAST_IPSEC) |
else { |
if (sp != NULL) { |
/* count IPsec header size */ |
/* count IPsec header size */ |
ipsechdr = ipsec4_hdrsiz(mcopy, |
ipsechdr = ipsec4_hdrsiz(mcopy, |
IPSEC_DIR_OUTBOUND, NULL); |
IPSEC_DIR_OUTBOUND, NULL); |
Line 2004 ip_forward(struct mbuf *m, int srcrt) |
|
Line 2018 ip_forward(struct mbuf *m, int srcrt) |
|
KEY_FREESP(&sp); |
KEY_FREESP(&sp); |
#endif |
#endif |
} |
} |
|
#endif /*defined(IPSEC) || defined(FAST_IPSEC)*/ |
} |
} |
#endif /*IPSEC*/ |
IP_STATINC(IP_STAT_CANTFRAG); |
ipstat.ips_cantfrag++; |
|
break; |
break; |
|
|
case ENOBUFS: |
case ENOBUFS: |
Line 2149 sysctl_net_inet_ip_maxflows(SYSCTLFN_ARG |
|
Line 2163 sysctl_net_inet_ip_maxflows(SYSCTLFN_ARG |
|
return (s); |
return (s); |
|
|
s = splsoftnet(); |
s = splsoftnet(); |
ipflow_reap(0); |
ipflow_prune(); |
splx(s); |
splx(s); |
|
|
return (0); |
return (0); |
Line 2185 sysctl_net_inet_ip_hashsize(SYSCTLFN_ARG |
|
Line 2199 sysctl_net_inet_ip_hashsize(SYSCTLFN_ARG |
|
} |
} |
#endif /* GATEWAY */ |
#endif /* GATEWAY */ |
|
|
|
static int |
|
sysctl_net_inet_ip_stats(SYSCTLFN_ARGS) |
|
{ |
|
netstat_sysctl_context ctx; |
|
uint64_t ips[IP_NSTATS]; |
|
|
|
ctx.ctx_stat = ipstat_percpu; |
|
ctx.ctx_counters = ips; |
|
ctx.ctx_ncounters = IP_NSTATS; |
|
return (NETSTAT_SYSCTL(&ctx)); |
|
} |
|
|
SYSCTL_SETUP(sysctl_net_inet_ip_setup, "sysctl net.inet.ip subtree setup") |
SYSCTL_SETUP(sysctl_net_inet_ip_setup, "sysctl net.inet.ip subtree setup") |
{ |
{ |
Line 2389 SYSCTL_SETUP(sysctl_net_inet_ip_setup, " |
|
Line 2414 SYSCTL_SETUP(sysctl_net_inet_ip_setup, " |
|
CTLFLAG_PERMANENT, |
CTLFLAG_PERMANENT, |
CTLTYPE_STRUCT, "stats", |
CTLTYPE_STRUCT, "stats", |
SYSCTL_DESCR("IP statistics"), |
SYSCTL_DESCR("IP statistics"), |
NULL, 0, &ipstat, sizeof(ipstat), |
sysctl_net_inet_ip_stats, 0, NULL, 0, |
CTL_NET, PF_INET, IPPROTO_IP, IPCTL_STATS, |
CTL_NET, PF_INET, IPPROTO_IP, IPCTL_STATS, |
CTL_EOL); |
CTL_EOL); |
} |
} |
|
|
|
void |
|
ip_statinc(u_int stat) |
|
{ |
|
|
|
KASSERT(stat < IP_NSTATS); |
|
IP_STATINC(stat); |
|
} |