Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. =================================================================== RCS file: /ftp/cvs/cvsroot/src/sys/netinet6/ip6_input.c,v rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet6/ip6_input.c,v: warning: Unknown phrases like `commitid ...;' are present. retrieving revision 1.129.4.1 retrieving revision 1.136.2.2 diff -u -p -r1.129.4.1 -r1.136.2.2 --- src/sys/netinet6/ip6_input.c 2011/05/31 03:05:08 1.129.4.1 +++ src/sys/netinet6/ip6_input.c 2018/01/30 18:44:22 1.136.2.2 @@ -1,4 +1,4 @@ -/* $NetBSD: ip6_input.c,v 1.129.4.1 2011/05/31 03:05:08 rmind Exp $ */ +/* $NetBSD: ip6_input.c,v 1.136.2.2 2018/01/30 18:44:22 martin Exp $ */ /* $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $ */ /* @@ -62,7 +62,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.129.4.1 2011/05/31 03:05:08 rmind Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.136.2.2 2018/01/30 18:44:22 martin Exp $"); #include "opt_gateway.h" #include "opt_inet.h" @@ -85,6 +85,7 @@ __KERNEL_RCSID(0, "$NetBSD: ip6_input.c, #include #include #include +#include #include #include @@ -111,7 +112,7 @@ __KERNEL_RCSID(0, "$NetBSD: ip6_input.c, #include #include -#ifdef IPSEC +#ifdef KAME_IPSEC #include #include #endif @@ -138,8 +139,6 @@ __KERNEL_RCSID(0, "$NetBSD: ip6_input.c, #include -extern struct inpcbtable tcbtable; /* XXX include of tcp_var.h no good */ - extern struct domain inet6domain; u_char ip6_protox[IPPROTO_MAX]; @@ -162,7 +161,8 @@ percpu_t *ip6stat_percpu; static void ip6_init2(void *); static struct m_tag *ip6_setdstifaddr(struct mbuf *, const struct in6_ifaddr *); -static int ip6_hopopts_input(u_int32_t *, u_int32_t *, struct mbuf **, int *); +static int ip6_process_hopopts(struct mbuf *, u_int8_t *, int, u_int32_t *, + u_int32_t *); static struct mbuf *ip6_pullexthdr(struct mbuf *, size_t, int); static void sysctl_net_inet6_ip6_setup(struct sysctllog **); @@ -192,9 +192,9 @@ ip6_init(void) addrsel_policy_init(); nd6_init(); frag6_init(); - ip6_desync_factor = arc4random() % MAX_TEMP_DESYNC_FACTOR; + ip6_desync_factor = cprng_fast32() % MAX_TEMP_DESYNC_FACTOR; - ip6_init2((void *)0); + ip6_init2(NULL); #ifdef GATEWAY ip6flow_init(ip6_hashsize); #endif @@ -280,7 +280,7 @@ ip6_input(struct mbuf *m) int s, error; #endif -#ifdef IPSEC +#ifdef KAME_IPSEC /* * should the inner packet be considered authentic? * see comment in ah4_input(). @@ -352,7 +352,7 @@ ip6_input(struct mbuf *m) goto bad; } -#if defined(IPSEC) +#if defined(KAME_IPSEC) /* IPv6 fast forwarding is not compatible with IPsec. */ m->m_flags &= ~M_CANFASTFWD; #else @@ -375,7 +375,7 @@ ip6_input(struct mbuf *m) * let ipfilter look at packet on the wire, * not the decapsulated packet. */ -#ifdef IPSEC +#ifdef KAME_IPSEC if (!ipsec_getnhist(m)) #elif defined(FAST_IPSEC) if (!ipsec_indone(m)) @@ -786,7 +786,7 @@ ip6_input(struct mbuf *m) } } -#ifdef IPSEC +#ifdef KAME_IPSEC /* * enforce IPsec policy checking if we are seeing last header. * note that we do not visit this with protocols with pcb layer @@ -883,7 +883,7 @@ ip6_getdstifaddr(struct mbuf *m) * * rtalertp - XXX: should be stored more smart way */ -static int +int ip6_hopopts_input(u_int32_t *plenp, u_int32_t *rtalertp, struct mbuf **mp, int *offp) { @@ -928,7 +928,7 @@ ip6_hopopts_input(u_int32_t *plenp, u_in * (RFC2460 p7), opthead is pointer into data content in m, and opthead to * opthead + hbhlen is located in continuous memory region. */ -int +static int ip6_process_hopopts(struct mbuf *m, u_int8_t *opthead, int hbhlen, u_int32_t *rtalertp, u_int32_t *plenp) { @@ -1419,50 +1419,44 @@ ip6_pullexthdr(struct mbuf *m, size_t of } /* - * Get pointer to the previous header followed by the header + * Get offset to the previous header followed by the header * currently processed. - * XXX: This function supposes that - * M includes all headers, - * the next header field and the header length field of each header - * are valid, and - * the sum of each header length equals to OFF. - * Because of these assumptions, this function must be called very - * carefully. Moreover, it will not be used in the near future when - * we develop `neater' mechanism to process extension headers. */ -u_int8_t * +int ip6_get_prevhdr(struct mbuf *m, int off) { struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); - if (off == sizeof(struct ip6_hdr)) - return (&ip6->ip6_nxt); - else { - int len, nxt; - struct ip6_ext *ip6e = NULL; + if (off == sizeof(struct ip6_hdr)) { + return offsetof(struct ip6_hdr, ip6_nxt); + } else if (off < sizeof(struct ip6_hdr)) { + panic("%s: off < sizeof(struct ip6_hdr)", __func__); + } else { + int len, nlen, nxt; + struct ip6_ext ip6e; nxt = ip6->ip6_nxt; len = sizeof(struct ip6_hdr); + nlen = 0; while (len < off) { - ip6e = (struct ip6_ext *)(mtod(m, char *) + len); + m_copydata(m, len, sizeof(ip6e), &ip6e); switch (nxt) { case IPPROTO_FRAGMENT: - len += sizeof(struct ip6_frag); + nlen = sizeof(struct ip6_frag); break; case IPPROTO_AH: - len += (ip6e->ip6e_len + 2) << 2; + nlen = (ip6e.ip6e_len + 2) << 2; break; default: - len += (ip6e->ip6e_len + 1) << 3; + nlen = (ip6e.ip6e_len + 1) << 3; break; } - nxt = ip6e->ip6e_nxt; + len += nlen; + nxt = ip6e.ip6e_nxt; } - if (ip6e) - return (&ip6e->ip6e_nxt); - else - return NULL; + + return (len - nlen); } } @@ -1989,6 +1983,38 @@ sysctl_net_inet6_ip6_setup(struct sysctl CTL_NET, PF_INET6, IPPROTO_IPV6, CTL_CREATE, CTL_EOL); #endif + sysctl_createv(clog, 0, NULL, NULL, + CTLFLAG_PERMANENT|CTLFLAG_READWRITE, + CTLTYPE_INT, "neighborgcthresh", + SYSCTL_DESCR("Maximum number of entries in neighbor" + " cache"), + NULL, 1, &ip6_neighborgcthresh, 0, + CTL_NET, PF_INET6, IPPROTO_IPV6, + CTL_CREATE, CTL_EOL); + sysctl_createv(clog, 0, NULL, NULL, + CTLFLAG_PERMANENT|CTLFLAG_READWRITE, + CTLTYPE_INT, "maxifprefixes", + SYSCTL_DESCR("Maximum number of prefixes created by" + " route advertisement per interface"), + NULL, 1, &ip6_maxifprefixes, 0, + CTL_NET, PF_INET6, IPPROTO_IPV6, + CTL_CREATE, CTL_EOL); + sysctl_createv(clog, 0, NULL, NULL, + CTLFLAG_PERMANENT|CTLFLAG_READWRITE, + CTLTYPE_INT, "maxifdefrouters", + SYSCTL_DESCR("Maximum number of default routers created" + " by route advertisement per interface"), + NULL, 1, &ip6_maxifdefrouters, 0, + CTL_NET, PF_INET6, IPPROTO_IPV6, + CTL_CREATE, CTL_EOL); + sysctl_createv(clog, 0, NULL, NULL, + CTLFLAG_PERMANENT|CTLFLAG_READWRITE, + CTLTYPE_INT, "maxdynroutes", + SYSCTL_DESCR("Maximum number of routes created via" + " redirect"), + NULL, 1, &ip6_maxdynroutes, 0, + CTL_NET, PF_INET6, IPPROTO_IPV6, + CTL_CREATE, CTL_EOL); } void