Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. =================================================================== RCS file: /ftp/cvs/cvsroot/src/sys/netinet/raw_ip.c,v rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet/raw_ip.c,v: warning: Unknown phrases like `commitid ...;' are present. retrieving revision 1.42.6.3 retrieving revision 1.60 diff -u -p -r1.42.6.3 -r1.60 --- src/sys/netinet/raw_ip.c 1999/11/30 13:35:34 1.42.6.3 +++ src/sys/netinet/raw_ip.c 2001/12/21 02:51:47 1.60 @@ -1,4 +1,4 @@ -/* $NetBSD: raw_ip.c,v 1.42.6.3 1999/11/30 13:35:34 itojun Exp $ */ +/* $NetBSD: raw_ip.c,v 1.60 2001/12/21 02:51:47 itojun Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -64,6 +64,9 @@ * @(#)raw_ip.c 8.7 (Berkeley) 5/15/95 */ +#include +__KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.60 2001/12/21 02:51:47 itojun Exp $"); + #include "opt_ipsec.h" #include "opt_mrouting.h" @@ -85,6 +88,7 @@ #include #include #include +#include #include #include @@ -96,6 +100,8 @@ struct inpcbtable rawcbtable; +int rip_pcbnotify __P((struct inpcbtable *, struct in_addr, + struct in_addr, int, int, void (*) __P((struct inpcb *, int)))); int rip_bind __P((struct inpcb *, struct mbuf *)); int rip_connect __P((struct inpcb *, struct mbuf *)); void rip_disconnect __P((struct inpcb *)); @@ -137,8 +143,8 @@ rip_input(m, va_alist) #endif { int off, proto; - register struct ip *ip = mtod(m, struct ip *); - register struct inpcb *inp; + struct ip *ip = mtod(m, struct ip *); + struct inpcb *inp; struct inpcb *last = 0; struct mbuf *opts = 0; struct sockaddr_in ripsrc; @@ -161,9 +167,7 @@ rip_input(m, va_alist) */ ip->ip_len -= ip->ip_hl << 2; - for (inp = rawcbtable.inpt_queue.cqh_first; - inp != (struct inpcb *)&rawcbtable.inpt_queue; - inp = inp->inp_queue.cqe_next) { + CIRCLEQ_FOREACH(inp, &rawcbtable.inpt_queue, inp_queue) { if (inp->inp_ip.ip_p && inp->inp_ip.ip_p != proto) continue; if (!in_nullhost(inp->inp_laddr) && @@ -174,6 +178,14 @@ rip_input(m, va_alist) continue; if (last) { struct mbuf *n; + +#ifdef IPSEC + /* check AH/ESP integrity. */ + if (ipsec4_in_reject_so(m, last->inp_socket)) { + ipsecstat.in_polvio++; + /* do not inject data to pcb */ + } else +#endif /*IPSEC*/ if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) { if (last->inp_flags & INP_CONTROLOPTS || last->inp_socket->so_options & SO_TIMESTAMP) @@ -191,6 +203,15 @@ rip_input(m, va_alist) } last = inp; } +#ifdef IPSEC + /* check AH/ESP integrity. */ + if (last && ipsec4_in_reject_so(m, last->inp_socket)) { + m_freem(m); + ipsecstat.in_polvio++; + ipstat.ips_delivered--; + /* do not inject data to pcb */ + } else +#endif /*IPSEC*/ if (last) { if (last->inp_flags & INP_CONTROLOPTS || last->inp_socket->so_options & SO_TIMESTAMP) @@ -203,13 +224,78 @@ rip_input(m, va_alist) } else sorwakeup(last->inp_socket); } else { - m_freem(m); - ipstat.ips_noproto++; - ipstat.ips_delivered--; + if (inetsw[ip_protox[ip->ip_p]].pr_input == rip_input) { + icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PROTOCOL, + 0, 0); + ipstat.ips_noproto++; + ipstat.ips_delivered--; + } else + m_freem(m); } return; } +int +rip_pcbnotify(table, faddr, laddr, proto, errno, notify) + struct inpcbtable *table; + struct in_addr faddr, laddr; + int proto; + int errno; + void (*notify) __P((struct inpcb *, int)); +{ + struct inpcb *inp, *ninp; + int nmatch; + + nmatch = 0; + for (inp = CIRCLEQ_FIRST(&table->inpt_queue); + inp != (struct inpcb *)&table->inpt_queue; + inp = ninp) { + ninp = inp->inp_queue.cqe_next; + if (inp->inp_ip.ip_p && inp->inp_ip.ip_p != proto) + continue; + if (in_hosteq(inp->inp_faddr, faddr) && + in_hosteq(inp->inp_laddr, laddr)) { + (*notify)(inp, errno); + nmatch++; + } + } + + return nmatch; +} + +void * +rip_ctlinput(cmd, sa, v) + int cmd; + struct sockaddr *sa; + void *v; +{ + struct ip *ip = v; + void (*notify) __P((struct inpcb *, int)) = in_rtchange; + int errno; + + if (sa->sa_family != AF_INET || + sa->sa_len != sizeof(struct sockaddr_in)) + return NULL; + if ((unsigned)cmd >= PRC_NCMDS) + return NULL; + errno = inetctlerrmap[cmd]; + if (PRC_IS_REDIRECT(cmd)) + notify = in_rtchange, ip = 0; + else if (cmd == PRC_HOSTDEAD) + ip = 0; + else if (errno == 0) + return NULL; + if (ip) { + rip_pcbnotify(&rawcbtable, satosin(sa)->sin_addr, + ip->ip_src, ip->ip_p, errno, notify); + + /* XXX mapped address case */ + } else + in_pcbnotifyall(&rawcbtable, satosin(sa)->sin_addr, errno, + notify); + return NULL; +} + /* * Generate IP header and pass packet to ip_output. * Tack on options user may have setup with control call. @@ -223,8 +309,8 @@ rip_output(m, va_alist) va_dcl #endif { - register struct inpcb *inp; - register struct ip *ip; + struct inpcb *inp; + struct ip *ip; struct mbuf *opts; int flags; va_list ap; @@ -274,7 +360,10 @@ rip_output(m, va_alist) ipstat.ips_rawout++; } #ifdef IPSEC - m->m_pkthdr.rcvif = (struct ifnet *)inp->inp_socket; /*XXX*/ + if (ipsec_setsocket(m, inp->inp_socket) != 0) { + m_freem(m); + return ENOBUFS; + } #endif /*IPSEC*/ return (ip_output(m, opts, &inp->inp_route, flags, inp->inp_moptions, &inp->inp_errormtu)); } @@ -289,7 +378,7 @@ rip_ctloutput(op, so, level, optname, m) int level, optname; struct mbuf **m; { - register struct inpcb *inp = sotoinpcb(so); + struct inpcb *inp = sotoinpcb(so); int error = 0; if (level != IPPROTO_IP) { @@ -364,7 +453,7 @@ rip_bind(inp, nam) if (nam->m_len != sizeof(*addr)) return (EINVAL); - if (ifnet.tqh_first == 0) + if (TAILQ_FIRST(&ifnet) == 0) return (EADDRNOTAVAIL); if (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) @@ -385,7 +474,7 @@ rip_connect(inp, nam) if (nam->m_len != sizeof(*addr)) return (EINVAL); - if (ifnet.tqh_first == 0) + if (TAILQ_FIRST(&ifnet) == 0) return (EADDRNOTAVAIL); if (addr->sin_family != AF_INET && addr->sin_family != AF_IMPLINK) @@ -408,14 +497,14 @@ u_long rip_recvspace = RIPRCVQ; /*ARGSUSED*/ int rip_usrreq(so, req, m, nam, control, p) - register struct socket *so; + struct socket *so; int req; struct mbuf *m, *nam, *control; struct proc *p; { - register struct inpcb *inp; + struct inpcb *inp; int s; - register int error = 0; + int error = 0; #ifdef MROUTING extern struct socket *ip_mrouter; #endif @@ -424,6 +513,13 @@ rip_usrreq(so, req, m, nam, control, p) return (in_control(so, (long)m, (caddr_t)nam, (struct ifnet *)control, p)); + if (req == PRU_PURGEIF) { + in_pcbpurgeif0(&rawcbtable, (struct ifnet *)control); + in_purgeif((struct ifnet *)control); + in_pcbpurgeif(&rawcbtable, (struct ifnet *)control); + return (0); + } + s = splsoftnet(); inp = sotoinpcb(so); #ifdef DIAGNOSTIC @@ -456,13 +552,6 @@ rip_usrreq(so, req, m, nam, control, p) break; inp = sotoinpcb(so); inp->inp_ip.ip_p = (long)nam; -#ifdef IPSEC - error = ipsec_init_policy(so, &inp->inp_sp); - if (error != 0) { - in_pcbdetach(inp); - break; - } -#endif /*IPSEC*/ break; case PRU_DETACH: