Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. =================================================================== RCS file: /ftp/cvs/cvsroot/src/sys/netinet/udp_usrreq.c,v rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet/udp_usrreq.c,v: warning: Unknown phrases like `commitid ...;' are present. retrieving revision 1.134 retrieving revision 1.134.2.6 diff -u -p -r1.134 -r1.134.2.6 --- src/sys/netinet/udp_usrreq.c 2005/03/11 06:16:16 1.134 +++ src/sys/netinet/udp_usrreq.c 2005/12/29 16:10:18 1.134.2.6 @@ -1,4 +1,4 @@ -/* $NetBSD: udp_usrreq.c,v 1.134 2005/03/11 06:16:16 atatat Exp $ */ +/* $NetBSD: udp_usrreq.c,v 1.134.2.6 2005/12/29 16:10:18 riz Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -61,7 +61,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.134 2005/03/11 06:16:16 atatat Exp $"); +__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.134.2.6 2005/12/29 16:10:18 riz Exp $"); #include "opt_inet.h" #include "opt_ipsec.h" @@ -146,20 +146,19 @@ int udpcksum = 1; #else int udpcksum = 0; /* XXX */ #endif -int udp_do_loopback_cksum = 0; struct inpcbtable udbtable; struct udpstat udpstat; #ifdef INET #ifdef IPSEC_NAT_T -static int udp4_espinudp (struct mbuf *, int, struct sockaddr *, +static int udp4_espinudp (struct mbuf **, int, struct sockaddr *, struct socket *); #endif static void udp4_sendup (struct mbuf *, int, struct sockaddr *, struct socket *); static int udp4_realinput (struct sockaddr_in *, struct sockaddr_in *, - struct mbuf *, int); + struct mbuf **, int); static int udp4_input_checksum(struct mbuf *, const struct udphdr *, int, int); #endif #ifdef INET6 @@ -383,7 +382,10 @@ udp_input(struct mbuf *m, ...) bcopy(&ip->ip_dst, &dst.sin_addr, sizeof(dst.sin_addr)); dst.sin_port = uh->uh_dport; - n = udp4_realinput(&src, &dst, m, iphlen); + if ((n = udp4_realinput(&src, &dst, &m, iphlen)) == -1) { + udpstat.udps_hdrops++; + return; + } #ifdef INET6 if (IN_MULTICAST(ip->ip_dst.s_addr) || n == 0) { struct sockaddr_in6 src6, dst6; @@ -660,13 +662,14 @@ udp6_sendup(struct mbuf *m, int off /* o #ifdef INET static int udp4_realinput(struct sockaddr_in *src, struct sockaddr_in *dst, - struct mbuf *m, int off /* offset of udphdr */) + struct mbuf **mp, int off /* offset of udphdr */) { u_int16_t *sport, *dport; int rcvcnt; struct in_addr *src4, *dst4; struct inpcb_hdr *inph; struct inpcb *inp; + struct mbuf *m = *mp; rcvcnt = 0; off += sizeof(struct udphdr); /* now, offset of payload */ @@ -754,12 +757,26 @@ udp4_realinput(struct sockaddr_in *src, if (inp->inp_flags & INP_ESPINUDP_ALL) { struct sockaddr *sa = (struct sockaddr *)src; - if (udp4_espinudp(m, off, sa, inp->inp_socket) != 0) { + switch(udp4_espinudp(mp, off, sa, inp->inp_socket)) { + case -1: /* Error, m was freeed */ + rcvcnt = -1; + goto bad; + break; + + case 1: /* ESP over UDP */ rcvcnt++; goto bad; - } + break; - /* Normal UDP processing will take place */ + case 0: /* plain UDP */ + default: /* Unexpected */ + /* + * Normal UDP processing will take place + * m may have changed. + */ + m = *mp; + break; + } } #endif @@ -1080,18 +1097,11 @@ udp_output(struct mbuf *m, ...) /* * XXX Cache pseudo-header checksum part for * XXX "connected" UDP sockets. - * Maybe skip checksums on loopback interfaces. */ ui->ui_sum = in_cksum_phdr(ui->ui_src.s_addr, ui->ui_dst.s_addr, htons((u_int16_t)len + sizeof(struct udphdr) + IPPROTO_UDP)); - if (__predict_true(ro->ro_rt == NULL || - !(ro->ro_rt->rt_ifp->if_flags & - IFF_LOOPBACK) || - udp_do_loopback_cksum)) - m->m_pkthdr.csum_flags = M_CSUM_UDPv4; - else - m->m_pkthdr.csum_flags = 0; + m->m_pkthdr.csum_flags = M_CSUM_UDPv4; m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum); } else ui->ui_sum = 0; @@ -1349,10 +1359,11 @@ SYSCTL_SETUP(sysctl_net_inet_udp_setup, * Returns: * 1 if the packet was processed * 0 if normal UDP processing should take place + * -1 if an error occurent and m was freed */ static int -udp4_espinudp(m, off, src, so) - struct mbuf *m; +udp4_espinudp(mp, off, src, so) + struct mbuf **mp; int off; struct sockaddr *src; struct socket *so; @@ -1365,6 +1376,10 @@ udp4_espinudp(m, off, src, so) size_t iphdrlen; struct ip *ip; struct mbuf *n; + struct m_tag *tag; + struct udphdr *udphdr; + u_int16_t sport, dport; + struct mbuf *m = *mp; /* * Collapse the mbuf chain if the first mbuf is too short @@ -1375,10 +1390,11 @@ udp4_espinudp(m, off, src, so) minlen = m->m_pkthdr.len; if (m->m_len < minlen) { - if ((m = m_pullup(m, minlen)) == NULL) { + if ((*mp = m_pullup(m, minlen)) == NULL) { printf("udp4_espinudp: m_pullup failed\n"); - return 0; + return -1; } + m = *mp; } len = m->m_len - off; @@ -1405,16 +1421,24 @@ udp4_espinudp(m, off, src, so) } if (inp->inp_flags & INP_ESPINUDP_NON_IKE) { - u_int64_t *st = (u_int64_t *)data; + u_int32_t *st = (u_int32_t *)data; if ((len <= sizeof(u_int64_t) + sizeof(struct esp)) - || (*st != 0)) + || ((st[0] | st[1]) != 0)) return 0; /* Normal UDP processing */ skip = sizeof(struct udphdr) + sizeof(u_int64_t); } /* + * Get the UDP ports. They are handled in network + * order everywhere in IPSEC_NAT_T code. + */ + udphdr = (struct udphdr *)(data - skip); + sport = udphdr->uh_sport; + dport = udphdr->uh_dport; + + /* * Remove the UDP header (and possibly the non ESP marker) * IP header lendth is iphdrlen * Before: @@ -1447,6 +1471,22 @@ udp4_espinudp(m, off, src, so) return 0; } + /* + * Add a PACKET_TAG_IPSEC_NAT_T_PORT tag to remember + * the source UDP port. This is required if we want + * to select the right SPD for multiple hosts behind + * same NAT + */ + if ((tag = m_tag_get(PACKET_TAG_IPSEC_NAT_T_PORTS, + sizeof(sport) + sizeof(dport), M_DONTWAIT)) == NULL) { + printf("udp4_espinudp: m_tag_get failed\n"); + m_freem(n); + return 0; + } + ((u_int16_t *)(tag + 1))[0] = sport; + ((u_int16_t *)(tag + 1))[1] = dport; + m_tag_prepend(n, tag); + esp4_input(n, iphdrlen); /* We handled it, it shoudln't be handled by UDP */