Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/sys/netinet/raw_ip.c,v
rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet/raw_ip.c,v: warning: Unknown phrases like `commitid ...;' are present.
retrieving revision 1.43
retrieving revision 1.57.4.1
diff -u -p -r1.43 -r1.57.4.1
--- src/sys/netinet/raw_ip.c	1999/07/01 08:12:51	1.43
+++ src/sys/netinet/raw_ip.c	2001/11/12 21:19:26	1.57.4.1
@@ -1,4 +1,4 @@
-/*	$NetBSD: raw_ip.c,v 1.43 1999/07/01 08:12:51 itojun Exp $	*/
+/*	$NetBSD: raw_ip.c,v 1.57.4.1 2001/11/12 21:19:26 thorpej Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -64,6 +64,7 @@
  *	@(#)raw_ip.c	8.7 (Berkeley) 5/15/95
  */
 
+#include "opt_ipsec.h"
 #include "opt_mrouting.h"
 
 #include <sys/param.h>
@@ -84,6 +85,7 @@
 #include <netinet/ip.h>
 #include <netinet/ip_var.h>
 #include <netinet/ip_mroute.h>
+#include <netinet/ip_icmp.h>
 #include <netinet/in_pcb.h>
 #include <netinet/in_var.h>
 
@@ -136,8 +138,8 @@ rip_input(m, va_alist)
 #endif
 {
 	int off, proto;
-	register struct ip *ip = mtod(m, struct ip *);
-	register struct inpcb *inp;
+	struct ip *ip = mtod(m, struct ip *);
+	struct inpcb *inp;
 	struct inpcb *last = 0;
 	struct mbuf *opts = 0;
 	struct sockaddr_in ripsrc;
@@ -160,9 +162,7 @@ rip_input(m, va_alist)
 	 */
 	ip->ip_len -= ip->ip_hl << 2;
 
-	for (inp = rawcbtable.inpt_queue.cqh_first;
-	    inp != (struct inpcb *)&rawcbtable.inpt_queue;
-	    inp = inp->inp_queue.cqe_next) {
+	CIRCLEQ_FOREACH(inp, &rawcbtable.inpt_queue, inp_queue) {
 		if (inp->inp_ip.ip_p && inp->inp_ip.ip_p != proto)
 			continue;
 		if (!in_nullhost(inp->inp_laddr) &&
@@ -173,6 +173,14 @@ rip_input(m, va_alist)
 			continue;
 		if (last) {
 			struct mbuf *n;
+
+#ifdef IPSEC
+			/* check AH/ESP integrity. */
+			if (ipsec4_in_reject_so(m, last->inp_socket)) {
+				ipsecstat.in_polvio++;
+				/* do not inject data to pcb */
+			} else
+#endif /*IPSEC*/
 			if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
 				if (last->inp_flags & INP_CONTROLOPTS ||
 				    last->inp_socket->so_options & SO_TIMESTAMP)
@@ -190,6 +198,15 @@ rip_input(m, va_alist)
 		}
 		last = inp;
 	}
+#ifdef IPSEC
+	/* check AH/ESP integrity. */
+	if (last && ipsec4_in_reject_so(m, last->inp_socket)) {
+		m_freem(m);
+		ipsecstat.in_polvio++;
+		ipstat.ips_delivered--;
+		/* do not inject data to pcb */
+	} else
+#endif /*IPSEC*/
 	if (last) {
 		if (last->inp_flags & INP_CONTROLOPTS ||
 		    last->inp_socket->so_options & SO_TIMESTAMP)
@@ -202,9 +219,13 @@ rip_input(m, va_alist)
 		} else
 			sorwakeup(last->inp_socket);
 	} else {
-		m_freem(m);
-		ipstat.ips_noproto++;
-		ipstat.ips_delivered--;
+		if (inetsw[ip_protox[ip->ip_p]].pr_input == rip_input) {
+			icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PROTOCOL,
+			    0, 0);
+			ipstat.ips_noproto++;
+			ipstat.ips_delivered--;
+		} else
+			m_freem(m);
 	}
 	return;
 }
@@ -222,8 +243,8 @@ rip_output(m, va_alist)
 	va_dcl
 #endif
 {
-	register struct inpcb *inp;
-	register struct ip *ip;
+	struct inpcb *inp;
+	struct ip *ip;
 	struct mbuf *opts;
 	int flags;
 	va_list ap;
@@ -273,7 +294,10 @@ rip_output(m, va_alist)
 		ipstat.ips_rawout++;
 	}
 #ifdef IPSEC
-	m->m_pkthdr.rcvif = (struct ifnet *)inp->inp_socket;	/*XXX*/
+	if (ipsec_setsocket(m, inp->inp_socket) != 0) {
+		m_freem(m);
+		return ENOBUFS;
+	}
 #endif /*IPSEC*/
 	return (ip_output(m, opts, &inp->inp_route, flags, inp->inp_moptions, &inp->inp_errormtu));
 }
@@ -288,7 +312,7 @@ rip_ctloutput(op, so, level, optname, m)
 	int level, optname;
 	struct mbuf **m;
 {
-	register struct inpcb *inp = sotoinpcb(so);
+	struct inpcb *inp = sotoinpcb(so);
 	int error = 0;
 
 	if (level != IPPROTO_IP) {
@@ -363,7 +387,7 @@ rip_bind(inp, nam)
 
 	if (nam->m_len != sizeof(*addr))
 		return (EINVAL);
-	if (ifnet.tqh_first == 0)
+	if (TAILQ_FIRST(&ifnet) == 0)
 		return (EADDRNOTAVAIL);
 	if (addr->sin_family != AF_INET &&
 	    addr->sin_family != AF_IMPLINK)
@@ -384,7 +408,7 @@ rip_connect(inp, nam)
 
 	if (nam->m_len != sizeof(*addr))
 		return (EINVAL);
-	if (ifnet.tqh_first == 0)
+	if (TAILQ_FIRST(&ifnet) == 0)
 		return (EADDRNOTAVAIL);
 	if (addr->sin_family != AF_INET &&
 	    addr->sin_family != AF_IMPLINK)
@@ -407,14 +431,14 @@ u_long	rip_recvspace = RIPRCVQ;
 /*ARGSUSED*/
 int
 rip_usrreq(so, req, m, nam, control, p)
-	register struct socket *so;
+	struct socket *so;
 	int req;
 	struct mbuf *m, *nam, *control;
 	struct proc *p;
 {
-	register struct inpcb *inp;
+	struct inpcb *inp;
 	int s;
-	register int error = 0;
+	int error = 0;
 #ifdef MROUTING
 	extern struct socket *ip_mrouter;
 #endif
@@ -423,6 +447,13 @@ rip_usrreq(so, req, m, nam, control, p)
 		return (in_control(so, (long)m, (caddr_t)nam,
 		    (struct ifnet *)control, p));
 
+	if (req == PRU_PURGEIF) {
+		in_pcbpurgeif0(&rawcbtable, (struct ifnet *)control);
+		in_purgeif((struct ifnet *)control);
+		in_pcbpurgeif(&rawcbtable, (struct ifnet *)control);
+		return (0);
+	}
+
 	s = splsoftnet();
 	inp = sotoinpcb(so);
 #ifdef DIAGNOSTIC
@@ -455,9 +486,6 @@ rip_usrreq(so, req, m, nam, control, p)
 			break;
 		inp = sotoinpcb(so);
 		inp->inp_ip.ip_p = (long)nam;
-#ifdef IPSEC
-		error = ipsec_init_policy(&inp->inp_sp);
-#endif /*IPSEC*/
 		break;
 
 	case PRU_DETACH: