Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. =================================================================== RCS file: /ftp/cvs/cvsroot/src/sys/netinet/ip_input.c,v rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet/ip_input.c,v: warning: Unknown phrases like `commitid ...;' are present. retrieving revision 1.82.2.2.2.2 retrieving revision 1.99 diff -u -p -r1.82.2.2.2.2 -r1.99 --- src/sys/netinet/ip_input.c 1999/07/01 23:47:01 1.82.2.2.2.2 +++ src/sys/netinet/ip_input.c 2000/02/12 18:00:00 1.99 @@ -1,4 +1,4 @@ -/* $NetBSD: ip_input.c,v 1.82.2.2.2.2 1999/07/01 23:47:01 thorpej Exp $ */ +/* $NetBSD: ip_input.c,v 1.99 2000/02/12 18:00:00 thorpej Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -103,6 +103,7 @@ #include "opt_gateway.h" #include "opt_pfil_hooks.h" +#include "opt_ipsec.h" #include "opt_mrouting.h" #include @@ -140,10 +141,6 @@ #ifdef IPSEC #include -#include -#ifdef IPSEC_ESP -#include -#endif #include #include #endif @@ -400,11 +397,13 @@ ip_input(struct mbuf *m) } ip = mtod(m, struct ip *); } + /* - * we drop packets that have a multicast address as source - * as wanted by rfc 1112 + * RFC1122: packets with a multicast source address are + * not allowed. */ if (IN_MULTICAST(ip->ip_src.s_addr)) { + /* XXX stat */ goto bad; } @@ -446,11 +445,16 @@ ip_input(struct mbuf *m) m_adj(m, len - m->m_pkthdr.len); } +#ifdef IPSEC + /* ipflow (IP fast fowarding) is not compatible with IPsec. */ + m->m_flags &= ~M_CANFASTFWD; +#else /* * Assume that we can create a fast-forward IP flow entry * based on this packet. */ m->m_flags |= M_CANFASTFWD; +#endif #ifdef PFIL_HOOKS /* @@ -486,7 +490,19 @@ ip_input(struct mbuf *m) /* * Check our list of addresses, to see if the packet is for us. */ - INADDR_TO_IA(ip->ip_dst, ia); + for (ia = IN_IFADDR_HASH(ip->ip_dst.s_addr).lh_first; + ia != NULL; + ia = ia->ia_hash.le_next) { + if (in_hosteq(ia->ia_addr.sin_addr, ip->ip_dst)) { + if ((ia->ia_ifp->if_flags & IFF_UP) != 0) + break; + else { + icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, + 0, m->m_pkthdr.rcvif); + return; + } + } + } if (ia != NULL) goto ours; if (m->m_pkthdr.rcvif->if_flags & IFF_BROADCAST) { @@ -993,11 +1009,9 @@ ip_dooptions(m) */ bcopy((caddr_t)(cp + off), (caddr_t)&ipaddr.sin_addr, sizeof(ipaddr.sin_addr)); - if (opt == IPOPT_SSRR) { -#define INA struct in_ifaddr * -#define SA struct sockaddr * - ia = (INA)ifa_ifwithladdr((SA)&ipaddr); - } else + if (opt == IPOPT_SSRR) + ia = ifatoia(ifa_ifwithaddr(sintosa(&ipaddr))); + else ia = ip_rtaddr(ipaddr.sin_addr); if (ia == 0) { type = ICMP_UNREACH; @@ -1031,8 +1045,9 @@ ip_dooptions(m) * locate outgoing interface; if we're the destination, * use the incoming interface (should be same). */ - if ((ia = (INA)ifa_ifwithaddr((SA)&ipaddr)) == 0 && - (ia = ip_rtaddr(ipaddr.sin_addr)) == 0) { + if ((ia = ifatoia(ifa_ifwithaddr(sintosa(&ipaddr)))) + == NULL && + (ia = ip_rtaddr(ipaddr.sin_addr)) == NULL) { type = ICMP_UNREACH; code = ICMP_UNREACH_HOST; goto bad; @@ -1063,8 +1078,8 @@ ip_dooptions(m) sizeof(struct in_addr) > ipt->ipt_len) goto bad; ipaddr.sin_addr = dst; - ia = (INA)ifaof_ifpforaddr((SA)&ipaddr, - m->m_pkthdr.rcvif); + ia = ifatoia(ifaof_ifpforaddr(sintosa(&ipaddr), + m->m_pkthdr.rcvif)); if (ia == 0) continue; bcopy((caddr_t)&ia->ia_addr.sin_addr, @@ -1078,7 +1093,8 @@ ip_dooptions(m) goto bad; bcopy((caddr_t)sin, (caddr_t)&ipaddr.sin_addr, sizeof(struct in_addr)); - if (ifa_ifwithaddr((SA)&ipaddr) == 0) + if (ifatoia(ifa_ifwithaddr(sintosa(&ipaddr))) + == NULL) continue; ipt->ipt_ptr += sizeof(struct in_addr); break; @@ -1302,7 +1318,7 @@ ip_forward(m, srcrt) ntohl(ip->ip_src.s_addr), ntohl(ip->ip_dst.s_addr), ip->ip_ttl); #endif - if (m->m_flags & M_BCAST || in_canforward(ip->ip_dst) == 0) { + if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(ip->ip_dst) == 0) { ipstat.ips_cantforward++; m_freem(m); return; @@ -1428,18 +1444,21 @@ ip_forward(m, srcrt) if (ipforward_rt.ro_rt) { struct secpolicy *sp; int ipsecerror; - int ipsechdr; + size_t ipsechdr; struct route *ro; sp = ipsec4_getpolicybyaddr(mcopy, - IP_FORWARDING, - &ipsecerror); + IPSEC_DIR_OUTBOUND, + IP_FORWARDING, + &ipsecerror); if (sp == NULL) destifp = ipforward_rt.ro_rt->rt_ifp; else { /* count IPsec header size */ - ipsechdr = ipsec4_hdrsiz(mcopy, NULL); + ipsechdr = ipsec4_hdrsiz(mcopy, + IPSEC_DIR_OUTBOUND, + NULL); /* * find the correct route for outer IPv4 @@ -1452,8 +1471,9 @@ ip_forward(m, srcrt) /*XXX*/ destifp = NULL; if (sp->req != NULL - && sp->req->sa != NULL) { - ro = &sp->req->sa->saidx->sa_route; + && sp->req->sav != NULL + && sp->req->sav->sah != NULL) { + ro = &sp->req->sav->sah->sa_route; if (ro->ro_rt && ro->ro_rt->rt_ifp) { dummyifp.if_mtu = ro->ro_rt->rt_ifp->if_mtu; @@ -1638,14 +1658,14 @@ ip_sysctl(name, namelen, oldp, oldlenp, return (error); } #endif + case IPCTL_HOSTZEROBROADCAST: + return (sysctl_int(oldp, oldlenp, newp, newlen, + &hostzeroisbroadcast)); #if NGIF > 0 case IPCTL_GIF_TTL: return(sysctl_int(oldp, oldlenp, newp, newlen, - &gif_ttl)); + &ip_gif_ttl)); #endif - case IPCTL_HOSTZEROBROADCAST: - return (sysctl_int(oldp, oldlenp, newp, newlen, - &hostzeroisbroadcast)); default: return (EOPNOTSUPP);