Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/sys/netinet/ip_input.c,v
rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet/ip_input.c,v: warning: Unknown phrases like `commitid ...;' are present.
retrieving revision 1.22
retrieving revision 1.30
diff -u -p -r1.22 -r1.30
--- src/sys/netinet/ip_input.c	1995/06/12 00:47:41	1.22
+++ src/sys/netinet/ip_input.c	1996/03/16 23:53:58	1.30
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_input.c,v 1.22 1995/06/12 00:47:41 mycroft Exp $	*/
+/*	$NetBSD: ip_input.c,v 1.30 1996/03/16 23:53:58 christos Exp $	*/
 
 /*
  * Copyright (c) 1982, 1986, 1988, 1993
@@ -45,6 +45,10 @@
 #include <sys/errno.h>
 #include <sys/time.h>
 #include <sys/kernel.h>
+#include <sys/proc.h>
+
+#include <vm/vm.h>
+#include <sys/sysctl.h>
 
 #include <net/if.h>
 #include <net/route.h>
@@ -67,9 +71,25 @@
 #ifndef	IPSENDREDIRECTS
 #define	IPSENDREDIRECTS	1
 #endif
+#ifndef IPFORWSRCRT
+#define	IPFORWSRCRT	1	/* allow source-routed packets */
+#endif
+/*
+ * Note: DIRECTED_BROADCAST is handled this way so that previous
+ * configuration using this option will Just Work.
+ */
+#ifndef IPDIRECTEDBCAST
+#ifdef DIRECTED_BROADCAST
+#define IPDIRECTEDBCAST	1
+#else
+#define	IPDIRECTEDBCAST	0
+#endif /* DIRECTED_BROADCAST */
+#endif /* IPDIRECTEDBCAST */
 int	ipforwarding = IPFORWARDING;
 int	ipsendredirects = IPSENDREDIRECTS;
 int	ip_defttl = IPDEFTTL;
+int	ip_forwsrcrt = IPFORWSRCRT;
+int	ip_directedbcast = IPDIRECTEDBCAST;
 #ifdef DIAGNOSTIC
 int	ipprintfs = 0;
 #endif
@@ -117,7 +137,7 @@ ip_init()
 		if (pr->pr_domain->dom_family == PF_INET &&
 		    pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
 			ip_protox[pr->pr_protocol] = pr - inetsw;
-	ipq.next = ipq.prev = &ipq;
+	LIST_INIT(&ipq);
 	ip_id = time.tv_sec & 0xffff;
 	ipintrq.ifq_maxlen = ipqmaxlen;
 	TAILQ_INIT(&in_ifaddr);
@@ -137,7 +157,8 @@ ipintr()
 	register struct mbuf *m;
 	register struct ipq *fp;
 	register struct in_ifaddr *ia;
-	int hlen, s;
+	struct ipqent *ipqe;
+	int hlen, mff, s;
 
 next:
 	/*
@@ -182,7 +203,7 @@ next:
 		}
 		ip = mtod(m, struct ip *);
 	}
-	if (ip->ip_sum = in_cksum(m, hlen)) {
+	if ((ip->ip_sum = in_cksum(m, hlen)) != 0) {
 		ipstat.ips_badsum++;
 		goto bad;
 	}
@@ -232,10 +253,8 @@ next:
 	for (ia = in_ifaddr.tqh_first; ia; ia = ia->ia_list.tqe_next) {
 		if (ip->ip_dst.s_addr == ia->ia_addr.sin_addr.s_addr)
 			goto ours;
-		if (
-#ifdef	DIRECTED_BROADCAST
-		    ia->ia_ifp == m->m_pkthdr.rcvif &&
-#endif
+		if (((ip_directedbcast == 0) || (ip_directedbcast &&
+		    ia->ia_ifp == m->m_pkthdr.rcvif)) &&
 		    (ia->ia_ifp->if_flags & IFF_BROADCAST)) {
 			if (ip->ip_dst.s_addr == ia->ia_broadaddr.sin_addr.s_addr ||
 			    ip->ip_dst.s_addr == ia->ia_netbroadcast.s_addr ||
@@ -338,7 +357,7 @@ ours:
 		 * Look for queue of fragments
 		 * of this datagram.
 		 */
-		for (fp = ipq.next; fp != &ipq; fp = fp->next)
+		for (fp = ipq.lh_first; fp != NULL; fp = fp->ipq_q.le_next)
 			if (ip->ip_id == fp->ipq_id &&
 			    ip->ip_src.s_addr == fp->ipq_src.s_addr &&
 			    ip->ip_dst.s_addr == fp->ipq_dst.s_addr &&
@@ -349,12 +368,12 @@ found:
 
 		/*
 		 * Adjust ip_len to not reflect header,
-		 * set ip_mff if more fragments are expected,
+		 * set ipqe_mff if more fragments are expected,
 		 * convert offset of this to bytes.
 		 */
 		ip->ip_len -= hlen;
-		((struct ipasfrag *)ip)->ipf_mff &= ~1;
-		if (ip->ip_off & IP_MF) {
+		mff = (ip->ip_off & IP_MF) != 0;
+		if (mff) {
 		        /*
 		         * Make sure that fragments have a data length
 			 * that's a non-zero multiple of 8 bytes.
@@ -363,7 +382,6 @@ found:
 				ipstat.ips_badfrags++;
 				goto bad;
 			}
-			((struct ipasfrag *)ip)->ipf_mff |= 1;
 		}
 		ip->ip_off <<= 3;
 
@@ -372,9 +390,17 @@ found:
 		 * or if this is not the first fragment,
 		 * attempt reassembly; if it succeeds, proceed.
 		 */
-		if (((struct ipasfrag *)ip)->ipf_mff & 1 || ip->ip_off) {
+		if (mff || ip->ip_off) {
 			ipstat.ips_fragments++;
-			ip = ip_reass((struct ipasfrag *)ip, fp);
+			MALLOC(ipqe, struct ipqent *, sizeof (struct ipqent),
+			    M_IPQ, M_NOWAIT);
+			if (ipqe == NULL) {
+				ipstat.ips_rcvmemdrop++;
+				goto bad;
+			}
+			ipqe->ipqe_mff = mff;
+			ipqe->ipqe_ip = ip;
+			ip = ip_reass(ipqe, fp);
 			if (ip == 0)
 				goto next;
 			ipstat.ips_reassembled++;
@@ -403,14 +429,15 @@ bad:
  * is given as fp; otherwise have to make a chain.
  */
 struct ip *
-ip_reass(ip, fp)
-	register struct ipasfrag *ip;
+ip_reass(ipqe, fp)
+	register struct ipqent *ipqe;
 	register struct ipq *fp;
 {
-	register struct mbuf *m = dtom(ip);
-	register struct ipasfrag *q;
+	register struct mbuf *m = dtom(ipqe->ipqe_ip);
+	register struct ipqent *nq, *p, *q;
+	struct ip *ip;
 	struct mbuf *t;
-	int hlen = ip->ip_hl << 2;
+	int hlen = ipqe->ipqe_ip->ip_hl << 2;
 	int i, next;
 
 	/*
@@ -427,22 +454,23 @@ ip_reass(ip, fp)
 		if ((t = m_get(M_DONTWAIT, MT_FTABLE)) == NULL)
 			goto dropfrag;
 		fp = mtod(t, struct ipq *);
-		insque(fp, &ipq);
+		LIST_INSERT_HEAD(&ipq, fp, ipq_q);
 		fp->ipq_ttl = IPFRAGTTL;
-		fp->ipq_p = ip->ip_p;
-		fp->ipq_id = ip->ip_id;
-		fp->ipq_next = fp->ipq_prev = (struct ipasfrag *)fp;
-		fp->ipq_src = ((struct ip *)ip)->ip_src;
-		fp->ipq_dst = ((struct ip *)ip)->ip_dst;
-		q = (struct ipasfrag *)fp;
+		fp->ipq_p = ipqe->ipqe_ip->ip_p;
+		fp->ipq_id = ipqe->ipqe_ip->ip_id;
+		LIST_INIT(&fp->ipq_fragq);
+		fp->ipq_src = ipqe->ipqe_ip->ip_src;
+		fp->ipq_dst = ipqe->ipqe_ip->ip_dst;
+		p = NULL;
 		goto insert;
 	}
 
 	/*
 	 * Find a segment which begins after this one does.
 	 */
-	for (q = fp->ipq_next; q != (struct ipasfrag *)fp; q = q->ipf_next)
-		if (q->ip_off > ip->ip_off)
+	for (p = NULL, q = fp->ipq_fragq.lh_first; q != NULL;
+	    p = q, q = q->ipqe_q.le_next)
+		if (q->ipqe_ip->ip_off > ipqe->ipqe_ip->ip_off)
 			break;
 
 	/*
@@ -450,14 +478,15 @@ ip_reass(ip, fp)
 	 * our data already.  If so, drop the data from the incoming
 	 * segment.  If it provides all of our data, drop us.
 	 */
-	if (q->ipf_prev != (struct ipasfrag *)fp) {
-		i = q->ipf_prev->ip_off + q->ipf_prev->ip_len - ip->ip_off;
+	if (p != NULL) {
+		i = p->ipqe_ip->ip_off + p->ipqe_ip->ip_len -
+		    ipqe->ipqe_ip->ip_off;
 		if (i > 0) {
-			if (i >= ip->ip_len)
+			if (i >= ipqe->ipqe_ip->ip_len)
 				goto dropfrag;
-			m_adj(dtom(ip), i);
-			ip->ip_off += i;
-			ip->ip_len -= i;
+			m_adj(dtom(ipqe->ipqe_ip), i);
+			ipqe->ipqe_ip->ip_off += i;
+			ipqe->ipqe_ip->ip_len -= i;
 		}
 	}
 
@@ -465,17 +494,20 @@ ip_reass(ip, fp)
 	 * While we overlap succeeding segments trim them or,
 	 * if they are completely covered, dequeue them.
 	 */
-	while (q != (struct ipasfrag *)fp && ip->ip_off + ip->ip_len > q->ip_off) {
-		i = (ip->ip_off + ip->ip_len) - q->ip_off;
-		if (i < q->ip_len) {
-			q->ip_len -= i;
-			q->ip_off += i;
-			m_adj(dtom(q), i);
+	for (; q != NULL && ipqe->ipqe_ip->ip_off + ipqe->ipqe_ip->ip_len >
+	    q->ipqe_ip->ip_off; q = nq) {
+		i = (ipqe->ipqe_ip->ip_off + ipqe->ipqe_ip->ip_len) -
+		    q->ipqe_ip->ip_off;
+		if (i < q->ipqe_ip->ip_len) {
+			q->ipqe_ip->ip_len -= i;
+			q->ipqe_ip->ip_off += i;
+			m_adj(dtom(q->ipqe_ip), i);
 			break;
 		}
-		q = q->ipf_next;
-		m_freem(dtom(q->ipf_prev));
-		ip_deq(q->ipf_prev);
+		nq = q->ipqe_q.le_next;
+		m_freem(dtom(q->ipqe_ip));
+		LIST_REMOVE(q, ipqe_q);
+		FREE(q, M_IPQ);
 	}
 
 insert:
@@ -483,28 +515,36 @@ insert:
 	 * Stick new segment in its place;
 	 * check for complete reassembly.
 	 */
-	ip_enq(ip, q->ipf_prev);
+	if (p == NULL) {
+		LIST_INSERT_HEAD(&fp->ipq_fragq, ipqe, ipqe_q);
+	} else {
+		LIST_INSERT_AFTER(p, ipqe, ipqe_q);
+	}
 	next = 0;
-	for (q = fp->ipq_next; q != (struct ipasfrag *)fp; q = q->ipf_next) {
-		if (q->ip_off != next)
+	for (p = NULL, q = fp->ipq_fragq.lh_first; q != NULL;
+	    p = q, q = q->ipqe_q.le_next) {
+		if (q->ipqe_ip->ip_off != next)
 			return (0);
-		next += q->ip_len;
+		next += q->ipqe_ip->ip_len;
 	}
-	if (q->ipf_prev->ipf_mff & 1)
+	if (p->ipqe_mff)
 		return (0);
 
 	/*
 	 * Reassembly is complete; concatenate fragments.
 	 */
-	q = fp->ipq_next;
-	m = dtom(q);
+	q = fp->ipq_fragq.lh_first;
+	ip = q->ipqe_ip;
+	m = dtom(q->ipqe_ip);
 	t = m->m_next;
 	m->m_next = 0;
 	m_cat(m, t);
-	q = q->ipf_next;
-	while (q != (struct ipasfrag *)fp) {
-		t = dtom(q);
-		q = q->ipf_next;
+	nq = q->ipqe_q.le_next;
+	FREE(q, M_IPQ);
+	for (q = nq; q != NULL; q = nq) {
+		t = dtom(q->ipqe_ip);
+		nq = q->ipqe_q.le_next;
+		FREE(q, M_IPQ);
 		m_cat(m, t);
 	}
 
@@ -514,14 +554,11 @@ insert:
 	 * dequeue and discard fragment reassembly header.
 	 * Make header visible.
 	 */
-	ip = fp->ipq_next;
 	ip->ip_len = next;
-	ip->ipf_mff &= ~1;
-	((struct ip *)ip)->ip_src = fp->ipq_src;
-	((struct ip *)ip)->ip_dst = fp->ipq_dst;
-	remque(fp);
+	ip->ip_src = fp->ipq_src;
+	ip->ip_dst = fp->ipq_dst;
+	LIST_REMOVE(fp, ipq_q);
 	(void) m_free(dtom(fp));
-	m = dtom(ip);
 	m->m_len += (ip->ip_hl << 2);
 	m->m_data -= (ip->ip_hl << 2);
 	/* some debugging cruft by sklower, below, will go away soon */
@@ -531,11 +568,12 @@ insert:
 			plen += m->m_len;
 		t->m_pkthdr.len = plen;
 	}
-	return ((struct ip *)ip);
+	return (ip);
 
 dropfrag:
 	ipstat.ips_fragdropped++;
 	m_freem(m);
+	FREE(ipqe, M_IPQ);
 	return (0);
 }
 
@@ -547,45 +585,19 @@ void
 ip_freef(fp)
 	struct ipq *fp;
 {
-	register struct ipasfrag *q, *p;
+	register struct ipqent *q, *p;
 
-	for (q = fp->ipq_next; q != (struct ipasfrag *)fp; q = p) {
-		p = q->ipf_next;
-		ip_deq(q);
-		m_freem(dtom(q));
+	for (q = fp->ipq_fragq.lh_first; q != NULL; q = p) {
+		p = q->ipqe_q.le_next;
+		m_freem(dtom(q->ipqe_ip));
+		LIST_REMOVE(q, ipqe_q);
+		FREE(q, M_IPQ);
 	}
-	remque(fp);
+	LIST_REMOVE(fp, ipq_q);
 	(void) m_free(dtom(fp));
 }
 
 /*
- * Put an ip fragment on a reassembly chain.
- * Like insque, but pointers in middle of structure.
- */
-void
-ip_enq(p, prev)
-	register struct ipasfrag *p, *prev;
-{
-
-	p->ipf_prev = prev;
-	p->ipf_next = prev->ipf_next;
-	prev->ipf_next->ipf_prev = p;
-	prev->ipf_next = p;
-}
-
-/*
- * To ip_enq as remque is to insque.
- */
-void
-ip_deq(p)
-	register struct ipasfrag *p;
-{
-
-	p->ipf_prev->ipf_next = p->ipf_next;
-	p->ipf_next->ipf_prev = p->ipf_prev;
-}
-
-/*
  * IP timer processing;
  * if a timer expires on a reassembly
  * queue, discard it.
@@ -593,20 +605,14 @@ ip_deq(p)
 void
 ip_slowtimo()
 {
-	register struct ipq *fp;
-	int s = splnet();
+	register struct ipq *fp, *nfp;
+	int s = splsoftnet();
 
-	fp = ipq.next;
-	if (fp == 0) {
-		splx(s);
-		return;
-	}
-	while (fp != &ipq) {
-		--fp->ipq_ttl;
-		fp = fp->next;
-		if (fp->prev->ipq_ttl == 0) {
+	for (fp = ipq.lh_first; fp != NULL; fp = nfp) {
+		nfp = fp->ipq_q.le_next;
+		if (--fp->ipq_ttl == 0) {
 			ipstat.ips_fragtimeout++;
-			ip_freef(fp->prev);
+			ip_freef(fp);
 		}
 	}
 	splx(s);
@@ -619,9 +625,9 @@ void
 ip_drain()
 {
 
-	while (ipq.next != &ipq) {
+	while (ipq.lh_first != NULL) {
 		ipstat.ips_fragdropped++;
-		ip_freef(ipq.next);
+		ip_freef(ipq.lh_first);
 	}
 }
 
@@ -710,8 +716,7 @@ ip_dooptions(m)
 			if (opt == IPOPT_SSRR) {
 #define	INA	struct in_ifaddr *
 #define	SA	struct sockaddr *
-			    if ((ia = (INA)ifa_ifwithdstaddr((SA)&ipaddr)) == 0)
-				ia = (INA)ifa_ifwithnet((SA)&ipaddr);
+			    ia = (INA)ifa_ifwithladdr((SA)&ipaddr);
 			} else
 				ia = ip_rtaddr(ipaddr.sin_addr);
 			if (ia == 0) {
@@ -808,6 +813,11 @@ ip_dooptions(m)
 		}
 	}
 	if (forward) {
+		if (ip_forwsrcrt == 0) {
+			type = ICMP_UNREACH;
+			code = ICMP_UNREACH_SRCFAIL;
+			goto bad;
+		}
 		ip_forward(m, 1);
 		return (1);
 	}
@@ -904,7 +914,7 @@ ip_srcroute()
 	*(mtod(m, struct in_addr *)) = *p--;
 #ifdef DIAGNOSTIC
 	if (ipprintfs)
-		printf(" hops %lx", ntohl(mtod(m, struct in_addr *)->s_addr));
+		printf(" hops %x", ntohl(mtod(m, struct in_addr *)->s_addr));
 #endif
 
 	/*
@@ -924,7 +934,7 @@ ip_srcroute()
 	while (p >= ip_srcrt.route) {
 #ifdef DIAGNOSTIC
 		if (ipprintfs)
-			printf(" %lx", ntohl(q->s_addr));
+			printf(" %x", ntohl(q->s_addr));
 #endif
 		*q++ = *p--;
 	}
@@ -934,7 +944,7 @@ ip_srcroute()
 	*q = ip_srcrt.dst;
 #ifdef DIAGNOSTIC
 	if (ipprintfs)
-		printf(" %lx\n", ntohl(q->s_addr));
+		printf(" %x\n", ntohl(q->s_addr));
 #endif
 	return (m);
 }
@@ -966,7 +976,7 @@ ip_stripoptions(m, mopt)
 	ip->ip_hl = sizeof(struct ip) >> 2;
 }
 
-u_char inetctlerrmap[PRC_NCMDS] = {
+int inetctlerrmap[PRC_NCMDS] = {
 	0,		0,		0,		0,
 	0,		EMSGSIZE,	EHOSTDOWN,	EHOSTUNREACH,
 	EHOSTUNREACH,	EHOSTUNREACH,	ECONNREFUSED,	ECONNREFUSED,
@@ -997,7 +1007,7 @@ ip_forward(m, srcrt)
 	register struct ip *ip = mtod(m, struct ip *);
 	register struct sockaddr_in *sin;
 	register struct rtentry *rt;
-	int error, type = 0, code;
+	int error, type = 0, code = 0;
 	struct mbuf *mcopy;
 	n_long dest;
 	struct ifnet *destifp;
@@ -1005,8 +1015,8 @@ ip_forward(m, srcrt)
 	dest = 0;
 #ifdef DIAGNOSTIC
 	if (ipprintfs)
-		printf("forward: src %x dst %x ttl %x\n", ip->ip_src,
-			ip->ip_dst, ip->ip_ttl);
+		printf("forward: src %x dst %x ttl %x\n",
+		       ip->ip_src.s_addr, ip->ip_dst.s_addr, ip->ip_ttl);
 #endif
 	if (m->m_flags & M_BCAST || in_canforward(ip->ip_dst) == 0) {
 		ipstat.ips_cantforward++;
@@ -1069,16 +1079,13 @@ ip_forward(m, srcrt)
 		    code = ICMP_REDIRECT_HOST;
 #ifdef DIAGNOSTIC
 		    if (ipprintfs)
-		        printf("redirect (%d) to %lx\n", code, (u_int32_t)dest);
+		        printf("redirect (%d) to %x\n", code, (u_int32_t)dest);
 #endif
 		}
 	}
 
-	error = ip_output(m, (struct mbuf *)0, &ipforward_rt, IP_FORWARDING
-#ifdef DIRECTED_BROADCAST
-			    | IP_ALLOWBROADCAST
-#endif
-						, 0);
+	error = ip_output(m, (struct mbuf *)0, &ipforward_rt,
+	    (IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)), 0);
 	if (error)
 		ipstat.ips_cantforward++;
 	else {
@@ -1151,6 +1158,17 @@ ip_sysctl(name, namelen, oldp, oldlenp, 
 	case IPCTL_DEFMTU:
 		return (sysctl_int(oldp, oldlenp, newp, newlen, &ip_mtu));
 #endif
+	case IPCTL_FORWSRCRT:
+		/*
+		 * Don't allow this to change in a secure environment.
+		 */
+		if (securelevel > 0)
+			return (EPERM);
+		return (sysctl_int(oldp, oldlenp, newp, newlen,
+		    &ip_forwsrcrt));
+	case IPCTL_DIRECTEDBCAST:
+		return (sysctl_int(oldp, oldlenp, newp, newlen,
+		    &ip_directedbcast));
 	default:
 		return (EOPNOTSUPP);
 	}