version 1.288, 2010/07/13 22:16:10 |
version 1.298.6.1, 2018/02/09 14:12:22 |
Line 140 __KERNEL_RCSID(0, "$NetBSD$"); |
|
Line 140 __KERNEL_RCSID(0, "$NetBSD$"); |
|
#include <netinet/ip_mroute.h> |
#include <netinet/ip_mroute.h> |
#endif |
#endif |
|
|
#ifdef IPSEC |
#ifdef KAME_IPSEC |
#include <netinet6/ipsec.h> |
#include <netinet6/ipsec.h> |
#include <netinet6/ipsec_private.h> |
#include <netinet6/ipsec_private.h> |
#include <netkey/key.h> |
#include <netkey/key.h> |
Line 161 __KERNEL_RCSID(0, "$NetBSD$"); |
|
Line 161 __KERNEL_RCSID(0, "$NetBSD$"); |
|
#define IPSENDREDIRECTS 1 |
#define IPSENDREDIRECTS 1 |
#endif |
#endif |
#ifndef IPFORWSRCRT |
#ifndef IPFORWSRCRT |
#define IPFORWSRCRT 1 /* forward source-routed packets */ |
#define IPFORWSRCRT 0 /* forward source-routed packets */ |
#endif |
#endif |
#ifndef IPALLOWSRCRT |
#ifndef IPALLOWSRCRT |
#define IPALLOWSRCRT 1 /* allow source-routed packets */ |
#define IPALLOWSRCRT 0 /* allow source-routed packets */ |
#endif |
#endif |
#ifndef IPMTUDISC |
#ifndef IPMTUDISC |
#define IPMTUDISC 1 |
#define IPMTUDISC 1 |
Line 221 int ip_checkinterface = 0; |
|
Line 221 int ip_checkinterface = 0; |
|
|
|
struct rttimer_queue *ip_mtudisc_timeout_q = NULL; |
struct rttimer_queue *ip_mtudisc_timeout_q = NULL; |
|
|
int ipqmaxlen = IFQ_MAXLEN; |
|
u_long in_ifaddrhash; /* size of hash table - 1 */ |
u_long in_ifaddrhash; /* size of hash table - 1 */ |
int in_ifaddrentries; /* total number of addrs */ |
int in_ifaddrentries; /* total number of addrs */ |
struct in_ifaddrhead in_ifaddrhead; |
struct in_ifaddrhead in_ifaddrhead; |
Line 231 int in_multientries; /* total number o |
|
Line 230 int in_multientries; /* total number o |
|
struct in_multihashhead *in_multihashtbl; |
struct in_multihashhead *in_multihashtbl; |
struct ifqueue ipintrq; |
struct ifqueue ipintrq; |
|
|
|
ipid_state_t * ip_ids; |
uint16_t ip_id; |
uint16_t ip_id; |
|
|
percpu_t *ipstat_percpu; |
percpu_t *ipstat_percpu; |
Line 278 static struct ip_srcrt { |
|
Line 278 static struct ip_srcrt { |
|
struct in_addr route[MAX_IPOPTLEN/sizeof(struct in_addr)]; |
struct in_addr route[MAX_IPOPTLEN/sizeof(struct in_addr)]; |
} ip_srcrt; |
} ip_srcrt; |
|
|
|
static int ip_drainwanted; |
|
|
static void save_rte(u_char *, struct in_addr); |
static void save_rte(u_char *, struct in_addr); |
|
|
#ifdef MBUFTRACE |
#ifdef MBUFTRACE |
|
|
|
|
ip_reass_init(); |
ip_reass_init(); |
|
|
ip_initid(); |
ip_ids = ip_id_init(); |
ip_id = time_second & 0xfffff; |
ip_id = time_second & 0xfffff; |
|
|
ipintrq.ifq_maxlen = ipqmaxlen; |
ipintrq.ifq_maxlen = IFQ_MAXLEN; |
|
|
TAILQ_INIT(&in_ifaddrhead); |
TAILQ_INIT(&in_ifaddrhead); |
in_ifaddrhashtbl = hashinit(IN_IFADDR_HASH_SIZE, HASH_LIST, true, |
in_ifaddrhashtbl = hashinit(IN_IFADDR_HASH_SIZE, HASH_LIST, true, |
|
|
struct ifqueue lcl_intrq; |
struct ifqueue lcl_intrq; |
|
|
memset(&lcl_intrq, 0, sizeof(lcl_intrq)); |
memset(&lcl_intrq, 0, sizeof(lcl_intrq)); |
ipintrq.ifq_maxlen = ipqmaxlen; |
|
|
|
mutex_enter(softnet_lock); |
mutex_enter(softnet_lock); |
KERNEL_LOCK(1, NULL); |
KERNEL_LOCK(1, NULL); |
Line 412 ip_input(struct mbuf *m) |
|
Line 413 ip_input(struct mbuf *m) |
|
struct m_tag *mtag; |
struct m_tag *mtag; |
struct tdb_ident *tdbi; |
struct tdb_ident *tdbi; |
struct secpolicy *sp; |
struct secpolicy *sp; |
int error; |
int error, s; |
#endif /* FAST_IPSEC */ |
#endif /* FAST_IPSEC */ |
|
|
MCLAIM(m, &ip_rx_mowner); |
MCLAIM(m, &ip_rx_mowner); |
#ifdef DIAGNOSTIC |
KASSERT((m->m_flags & M_PKTHDR) != 0); |
if ((m->m_flags & M_PKTHDR) == 0) |
|
panic("ipintr no HDR"); |
|
#endif |
|
|
|
/* |
/* |
* If no IP addresses have been set yet but the interfaces |
* If no IP addresses have been set yet but the interfaces |
Line 458 ip_input(struct mbuf *m) |
|
Line 456 ip_input(struct mbuf *m) |
|
goto bad; |
goto bad; |
} |
} |
if (hlen > m->m_len) { |
if (hlen > m->m_len) { |
if ((m = m_pullup(m, hlen)) == 0) { |
if ((m = m_pullup(m, hlen)) == NULL) { |
IP_STATINC(IP_STAT_BADHLEN); |
IP_STATINC(IP_STAT_BADHLEN); |
return; |
return; |
} |
} |
Line 538 ip_input(struct mbuf *m) |
|
Line 536 ip_input(struct mbuf *m) |
|
m_adj(m, len - m->m_pkthdr.len); |
m_adj(m, len - m->m_pkthdr.len); |
} |
} |
|
|
#if defined(IPSEC) |
#if defined(KAME_IPSEC) |
/* ipflow (IP fast forwarding) is not compatible with IPsec. */ |
/* ipflow (IP fast forwarding) is not compatible with IPsec. */ |
m->m_flags &= ~M_CANFASTFWD; |
m->m_flags &= ~M_CANFASTFWD; |
#else |
#else |
Line 561 ip_input(struct mbuf *m) |
|
Line 559 ip_input(struct mbuf *m) |
|
* let ipfilter look at packet on the wire, |
* let ipfilter look at packet on the wire, |
* not the decapsulated packet. |
* not the decapsulated packet. |
*/ |
*/ |
#ifdef IPSEC |
#ifdef KAME_IPSEC |
if (!ipsec_getnhist(m)) |
if (!ipsec_getnhist(m)) |
#elif defined(FAST_IPSEC) |
#elif defined(FAST_IPSEC) |
if (!ipsec_indone(m)) |
if (!ipsec_indone(m)) |
Line 745 ip_input(struct mbuf *m) |
|
Line 743 ip_input(struct mbuf *m) |
|
IP_STATINC(IP_STAT_CANTFORWARD); |
IP_STATINC(IP_STAT_CANTFORWARD); |
return; |
return; |
} |
} |
#ifdef IPSEC |
#ifdef KAME_IPSEC |
if (ipsec4_in_reject(m, NULL)) { |
if (ipsec4_in_reject(m, NULL)) { |
IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); |
IPSEC_STATINC(IPSEC_STAT_IN_POLVIO); |
goto bad; |
goto bad; |
|
|
* If offset or IP_MF are set, must reassemble. |
* If offset or IP_MF are set, must reassemble. |
*/ |
*/ |
if (ip->ip_off & ~htons(IP_DF|IP_RF)) { |
if (ip->ip_off & ~htons(IP_DF|IP_RF)) { |
struct ipq *fp; |
|
u_int off, hash; |
|
bool mff; |
|
|
|
/* |
/* |
* Prevent TCP blind data attacks by not allowing non-initial |
* Pass to IP reassembly mechanism. |
* fragments to start at less than 68 bytes (minimal fragment |
|
* size) and making sure the first fragment is at least 68 |
|
* bytes. |
|
*/ |
*/ |
off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3; |
if (ip_reass_packet(&m, ip) != 0) { |
if ((off > 0 ? off + hlen : len) < IP_MINFRAGSIZE - 1) { |
/* Failed; invalid fragment(s) or packet. */ |
IP_STATINC(IP_STAT_BADFRAGS); |
|
goto bad; |
goto bad; |
} |
} |
|
if (m == NULL) { |
/* |
/* More fragments should come; silently return. */ |
* Adjust total IP length to not reflect header. Set 'mff' |
return; |
* indicator, if more fragments are expected. Convert offset |
|
* of this to bytes. |
|
*/ |
|
ip->ip_len = htons(ntohs(ip->ip_len) - hlen); |
|
mff = (ip->ip_off & htons(IP_MF)) != 0; |
|
if (mff) { |
|
/* |
|
* Make sure that fragments have a data length |
|
* which is non-zero and multiple of 8 bytes. |
|
*/ |
|
if (ntohs(ip->ip_len) == 0 || |
|
(ntohs(ip->ip_len) & 0x7) != 0) { |
|
IP_STATINC(IP_STAT_BADFRAGS); |
|
goto bad; |
|
} |
|
} |
|
ip->ip_off = htons((ntohs(ip->ip_off) & IP_OFFMASK) << 3); |
|
|
|
/* Look for queue of fragments of this datagram. */ |
|
fp = ip_reass_lookup(ip, &hash); |
|
|
|
/* Make sure the TOS matches previous fragments. */ |
|
if (fp && fp->ipq_tos != ip->ip_tos) { |
|
IP_STATINC(IP_STAT_BADFRAGS); |
|
ip_reass_unlock(); |
|
goto bad; |
|
} |
} |
|
|
/* |
/* |
* If datagram marked as having more fragments |
* Reassembly is done, we have the final packet. |
* or if this is not the first fragment, |
* Updated cached data in local variable(s). |
* attempt reassembly; if it succeeds, proceed. |
|
*/ |
*/ |
if (mff || ip->ip_off != htons(0)) { |
ip = mtod(m, struct ip *); |
struct ipqent *ipqe; |
hlen = ip->ip_hl << 2; |
|
|
ipqe = ip_reass_getent(); |
|
if (ipqe == NULL) { |
|
IP_STATINC(IP_STAT_RCVMEMDROP); |
|
ip_reass_unlock(); |
|
goto bad; |
|
} |
|
ipqe->ipqe_mff = mff; |
|
ipqe->ipqe_m = m; |
|
ipqe->ipqe_ip = ip; |
|
m = ip_reass(ipqe, fp, hash); |
|
if (m == NULL) { |
|
return; |
|
} |
|
IP_STATINC(IP_STAT_REASSEMBLED); |
|
ip = mtod(m, struct ip *); |
|
hlen = ip->ip_hl << 2; |
|
ip->ip_len = htons(ntohs(ip->ip_len) + hlen); |
|
} else if (fp) { |
|
ip_freef(fp); |
|
ip_reass_unlock(); |
|
} |
|
} |
} |
|
|
#if defined(IPSEC) |
#if defined(KAME_IPSEC) |
/* |
/* |
* enforce IPsec policy checking if we are seeing last header. |
* enforce IPsec policy checking if we are seeing last header. |
* note that we do not visit this with protocols with pcb layer |
* note that we do not visit this with protocols with pcb layer |
Line 1344 const int inetctlerrmap[PRC_NCMDS] = { |
|
Line 1284 const int inetctlerrmap[PRC_NCMDS] = { |
|
[PRC_PARAMPROB] = ENOPROTOOPT, |
[PRC_PARAMPROB] = ENOPROTOOPT, |
}; |
}; |
|
|
|
void |
|
ip_fasttimo(void) |
|
{ |
|
if (ip_drainwanted) { |
|
ip_drain(); |
|
ip_drainwanted = 0; |
|
} |
|
} |
|
|
|
void |
|
ip_drainstub(void) |
|
{ |
|
ip_drainwanted = 1; |
|
} |
|
|
/* |
/* |
* Forward a packet. If some error occurs return the sender |
* Forward a packet. If some error occurs return the sender |
* an icmp packet. Note we can't always generate a meaningful |
* an icmp packet. Note we can't always generate a meaningful |
Line 1450 ip_forward(struct mbuf *m, int srcrt) |
|
Line 1405 ip_forward(struct mbuf *m, int srcrt) |
|
|
|
error = ip_output(m, NULL, &ipforward_rt, |
error = ip_output(m, NULL, &ipforward_rt, |
(IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)), |
(IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)), |
(struct ip_moptions *)NULL, (struct socket *)NULL); |
NULL, NULL); |
|
|
if (error) |
if (error) |
IP_STATINC(IP_STAT_CANTFORWARD); |
IP_STATINC(IP_STAT_CANTFORWARD); |
Line 1497 ip_forward(struct mbuf *m, int srcrt) |
|
Line 1452 ip_forward(struct mbuf *m, int srcrt) |
|
if ((rt = rtcache_validate(&ipforward_rt)) != NULL) |
if ((rt = rtcache_validate(&ipforward_rt)) != NULL) |
destmtu = rt->rt_ifp->if_mtu; |
destmtu = rt->rt_ifp->if_mtu; |
|
|
#if defined(IPSEC) || defined(FAST_IPSEC) |
#if defined(KAME_IPSEC) || defined(FAST_IPSEC) |
{ |
{ |
/* |
/* |
* If the packet is routed over IPsec tunnel, tell the |
* If the packet is routed over IPsec tunnel, tell the |
Line 1539 ip_forward(struct mbuf *m, int srcrt) |
|
Line 1494 ip_forward(struct mbuf *m, int srcrt) |
|
} |
} |
} |
} |
|
|
#ifdef IPSEC |
#ifdef KAME_IPSEC |
key_freesp(sp); |
key_freesp(sp); |
#else |
#else |
KEY_FREESP(&sp); |
KEY_FREESP(&sp); |
#endif |
#endif |
} |
} |
} |
} |
#endif /*defined(IPSEC) || defined(FAST_IPSEC)*/ |
#endif /*defined(KAME_IPSEC) || defined(FAST_IPSEC)*/ |
IP_STATINC(IP_STAT_CANTFRAG); |
IP_STATINC(IP_STAT_CANTFRAG); |
break; |
break; |
|
|