Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/sys/netinet/raw_ip.c,v
retrieving revision 1.46
retrieving revision 1.46.2.3
diff -u -p -r1.46 -r1.46.2.3
--- src/sys/netinet/raw_ip.c	1999/09/13 12:15:55	1.46
+++ src/sys/netinet/raw_ip.c	2001/03/12 13:31:51	1.46.2.3
@@ -1,4 +1,4 @@
-/*	$NetBSD: raw_ip.c,v 1.46 1999/09/13 12:15:55 itojun Exp $	*/
+/*	$NetBSD: raw_ip.c,v 1.46.2.3 2001/03/12 13:31:51 bouyer Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -95,8 +95,6 @@
 #include <netinet6/ipsec.h>
 #endif /*IPSEC*/
 
-extern u_char ip_protox[];
-extern struct  protosw inetsw[];
 struct inpcbtable rawcbtable;
 
 int	 rip_bind __P((struct inpcb *, struct mbuf *));
@@ -140,8 +138,8 @@ rip_input(m, va_alist)
 #endif
 {
 	int off, proto;
-	register struct ip *ip = mtod(m, struct ip *);
-	register struct inpcb *inp;
+	struct ip *ip = mtod(m, struct ip *);
+	struct inpcb *inp;
 	struct inpcb *last = 0;
 	struct mbuf *opts = 0;
 	struct sockaddr_in ripsrc;
@@ -177,6 +175,14 @@ rip_input(m, va_alist)
 			continue;
 		if (last) {
 			struct mbuf *n;
+
+#ifdef IPSEC
+			/* check AH/ESP integrity. */
+			if (ipsec4_in_reject_so(m, last->inp_socket)) {
+				ipsecstat.in_polvio++;
+				/* do not inject data to pcb */
+			} else
+#endif /*IPSEC*/
 			if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
 				if (last->inp_flags & INP_CONTROLOPTS ||
 				    last->inp_socket->so_options & SO_TIMESTAMP)
@@ -194,6 +200,15 @@ rip_input(m, va_alist)
 		}
 		last = inp;
 	}
+#ifdef IPSEC
+	/* check AH/ESP integrity. */
+	if (last && ipsec4_in_reject_so(m, last->inp_socket)) {
+		m_freem(m);
+		ipsecstat.in_polvio++;
+		ipstat.ips_delivered--;
+		/* do not inject data to pcb */
+	} else
+#endif /*IPSEC*/
 	if (last) {
 		if (last->inp_flags & INP_CONTROLOPTS ||
 		    last->inp_socket->so_options & SO_TIMESTAMP)
@@ -207,7 +222,8 @@ rip_input(m, va_alist)
 			sorwakeup(last->inp_socket);
 	} else {
 		if (inetsw[ip_protox[ip->ip_p]].pr_input == rip_input) {
-			icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PROTOCOL,0,0);
+			icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PROTOCOL,
+			    0, 0);
 			ipstat.ips_noproto++;
 			ipstat.ips_delivered--;
 		} else
@@ -229,8 +245,8 @@ rip_output(m, va_alist)
 	va_dcl
 #endif
 {
-	register struct inpcb *inp;
-	register struct ip *ip;
+	struct inpcb *inp;
+	struct ip *ip;
 	struct mbuf *opts;
 	int flags;
 	va_list ap;
@@ -280,7 +296,10 @@ rip_output(m, va_alist)
 		ipstat.ips_rawout++;
 	}
 #ifdef IPSEC
-	m->m_pkthdr.rcvif = (struct ifnet *)inp->inp_socket;	/*XXX*/
+	if (ipsec_setsocket(m, inp->inp_socket) != 0) {
+		m_freem(m);
+		return ENOBUFS;
+	}
 #endif /*IPSEC*/
 	return (ip_output(m, opts, &inp->inp_route, flags, inp->inp_moptions, &inp->inp_errormtu));
 }
@@ -295,7 +314,7 @@ rip_ctloutput(op, so, level, optname, m)
 	int level, optname;
 	struct mbuf **m;
 {
-	register struct inpcb *inp = sotoinpcb(so);
+	struct inpcb *inp = sotoinpcb(so);
 	int error = 0;
 
 	if (level != IPPROTO_IP) {
@@ -414,14 +433,14 @@ u_long	rip_recvspace = RIPRCVQ;
 /*ARGSUSED*/
 int
 rip_usrreq(so, req, m, nam, control, p)
-	register struct socket *so;
+	struct socket *so;
 	int req;
 	struct mbuf *m, *nam, *control;
 	struct proc *p;
 {
-	register struct inpcb *inp;
+	struct inpcb *inp;
 	int s;
-	register int error = 0;
+	int error = 0;
 #ifdef MROUTING
 	extern struct socket *ip_mrouter;
 #endif
@@ -430,6 +449,12 @@ rip_usrreq(so, req, m, nam, control, p)
 		return (in_control(so, (long)m, (caddr_t)nam,
 		    (struct ifnet *)control, p));
 
+	if (req == PRU_PURGEIF) {
+		in_purgeif((struct ifnet *)control);
+		in_pcbpurgeif(&rawcbtable, (struct ifnet *)control);
+		return (0);
+	}
+
 	s = splsoftnet();
 	inp = sotoinpcb(so);
 #ifdef DIAGNOSTIC
@@ -463,8 +488,11 @@ rip_usrreq(so, req, m, nam, control, p)
 		inp = sotoinpcb(so);
 		inp->inp_ip.ip_p = (long)nam;
 #ifdef IPSEC
-		if ((error = ipsec_init_policy(&inp->inp_sp)) != 0)
+		error = ipsec_init_policy(so, &inp->inp_sp);
+		if (error != 0) {
 			in_pcbdetach(inp);
+			break;
+		}
 #endif /*IPSEC*/
 		break;