Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. =================================================================== RCS file: /ftp/cvs/cvsroot/src/sys/netinet6/ip6_input.c,v rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet6/ip6_input.c,v: warning: Unknown phrases like `commitid ...;' are present. retrieving revision 1.82.6.1 retrieving revision 1.94 diff -u -p -r1.82.6.1 -r1.94 --- src/sys/netinet6/ip6_input.c 2006/03/13 09:07:39 1.82.6.1 +++ src/sys/netinet6/ip6_input.c 2007/02/10 09:43:05 1.94 @@ -1,4 +1,4 @@ -/* $NetBSD: ip6_input.c,v 1.82.6.1 2006/03/13 09:07:39 yamt Exp $ */ +/* $NetBSD: ip6_input.c,v 1.94 2007/02/10 09:43:05 degroote Exp $ */ /* $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $ */ /* @@ -62,9 +62,10 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.82.6.1 2006/03/13 09:07:39 yamt Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.94 2007/02/10 09:43:05 degroote Exp $"); #include "opt_inet.h" +#include "opt_inet6.h" #include "opt_ipsec.h" #include "opt_pfil_hooks.h" @@ -111,6 +112,12 @@ __KERNEL_RCSID(0, "$NetBSD: ip6_input.c, #include #endif +#ifdef FAST_IPSEC +#include +#include +#include +#endif /* FAST_IPSEC */ + #include #include "faith.h" @@ -188,8 +195,7 @@ ip6_init() } static void -ip6_init2(dummy) - void *dummy; +ip6_init2(void *dummy) { /* nd6_timer_init */ @@ -241,6 +247,12 @@ ip6_input(m) int nxt, ours = 0; struct ifnet *deliverifp = NULL; int srcrt = 0; +#ifdef FAST_IPSEC + struct m_tag *mtag; + struct tdb_ident *tdbi; + struct secpolicy *sp; + int s, error; +#endif #ifdef IPSEC /* @@ -327,6 +339,8 @@ ip6_input(m) */ #ifdef IPSEC if (!ipsec_getnhist(m)) +#elif defined(FAST_IPSEC) + if (!ipsec_indone(m)) #else if (1) #endif @@ -409,6 +423,10 @@ ip6_input(m) * dst are the loopback address and the receiving interface * is not loopback. */ + if (__predict_false( + m_makewritable(&m, 0, sizeof(struct ip6_hdr), M_DONTWAIT))) + goto bad; + ip6 = mtod(m, struct ip6_hdr *); if (in6_clearscope(&ip6->ip6_src) || in6_clearscope(&ip6->ip6_dst)) { ip6stat.ip6s_badscope++; /* XXX */ goto bad; @@ -446,20 +464,18 @@ ip6_input(m) /* * Unicast check */ - if (ip6_forward_rt.ro_rt != NULL && - (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) != 0 && - IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, + if (!IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &((struct sockaddr_in6 *)(&ip6_forward_rt.ro_dst))->sin6_addr)) + rtcache_free((struct route *)&ip6_forward_rt); + else + rtcache_check((struct route *)&ip6_forward_rt); + if (ip6_forward_rt.ro_rt != NULL) { + /* XXX Revalidated route is accounted wrongly. */ ip6stat.ip6s_forward_cachehit++; - else { + } else { struct sockaddr_in6 *dst6; - if (ip6_forward_rt.ro_rt) { - /* route is down or destination is different */ - ip6stat.ip6s_forward_cachemiss++; - RTFREE(ip6_forward_rt.ro_rt); - ip6_forward_rt.ro_rt = 0; - } + ip6stat.ip6s_forward_cachemiss++; bzero(&ip6_forward_rt.ro_dst, sizeof(struct sockaddr_in6)); dst6 = (struct sockaddr_in6 *)&ip6_forward_rt.ro_dst; @@ -467,7 +483,7 @@ ip6_input(m) dst6->sin6_family = AF_INET6; dst6->sin6_addr = ip6->ip6_dst; - rtalloc((struct route *)&ip6_forward_rt); + rtcache_init((struct route *)&ip6_forward_rt); } #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key)) @@ -481,7 +497,7 @@ ip6_input(m) * But we think it's even useful in some situations, e.g. when using * a special daemon which wants to intercept the packet. */ - if (ip6_forward_rt.ro_rt && + if (ip6_forward_rt.ro_rt != NULL && (ip6_forward_rt.ro_rt->rt_flags & (RTF_HOST|RTF_GATEWAY)) == RTF_HOST && !(ip6_forward_rt.ro_rt->rt_flags & RTF_CLONED) && @@ -524,7 +540,8 @@ ip6_input(m) */ #if defined(NFAITH) && 0 < NFAITH if (ip6_keepfaith) { - if (ip6_forward_rt.ro_rt && ip6_forward_rt.ro_rt->rt_ifp && + if (ip6_forward_rt.ro_rt != NULL && + ip6_forward_rt.ro_rt->rt_ifp != NULL && ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) { /* XXX do we need more sanity checks? */ ours = 1; @@ -542,9 +559,7 @@ ip6_input(m) * working right. */ struct ifaddr *ifa; - for (ifa = m->m_pkthdr.rcvif->if_addrlist.tqh_first; - ifa; - ifa = ifa->ifa_list.tqe_next) { + TAILQ_FOREACH(ifa, &m->m_pkthdr.rcvif->if_addrlist, ifa_list) { if (ifa->ifa_addr == NULL) continue; /* just for safety */ if (ifa->ifa_addr->sa_family != AF_INET6) @@ -752,6 +767,46 @@ ip6_input(m) goto bad; } #endif +#ifdef FAST_IPSEC + /* + * enforce IPsec policy checking if we are seeing last header. + * note that we do not visit this with protocols with pcb layer + * code - like udp/tcp/raw ip. + */ + if ((inet6sw[ip_protox[nxt]].pr_flags & PR_LASTHDR) != 0) { + /* + * Check if the packet has already had IPsec processing + * done. If so, then just pass it along. This tag gets + * set during AH, ESP, etc. input handling, before the + * packet is returned to the ip input queue for delivery. + */ + mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); + s = splsoftnet(); + if (mtag != NULL) { + tdbi = (struct tdb_ident *)(mtag + 1); + sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND); + } else { + sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, + IP_FORWARDING, &error); + } + if (sp != NULL) { + /* + * Check security policy against packet attributes. + */ + error = ipsec_in_reject(sp, m); + KEY_FREESP(&sp); + } else { + /* XXX error stat??? */ + error = EINVAL; + DPRINTF(("ip6_input: no SP, packet discarded\n"));/*XXX*/ + goto bad; + } + splx(s); + if (error) + goto bad; + } +#endif /* FAST_IPSEC */ + nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); } @@ -1030,6 +1085,11 @@ ip6_savecontrol(in6p, mp, ip6, m) struct ip6_hdr *ip6; struct mbuf *m; { +#ifdef RFC2292 +#define IS2292(x, y) ((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y)) +#else +#define IS2292(x, y) (y) +#endif #ifdef SO_TIMESTAMP if (in6p->in6p_socket->so_options & SO_TIMESTAMP) { @@ -1042,50 +1102,56 @@ ip6_savecontrol(in6p, mp, ip6, m) mp = &(*mp)->m_next; } #endif - if (in6p->in6p_flags & IN6P_RECVDSTADDR) { - *mp = sbcreatecontrol((caddr_t) &ip6->ip6_dst, - sizeof(struct in6_addr), IPV6_RECVDSTADDR, IPPROTO_IPV6); - if (*mp) - mp = &(*mp)->m_next; - } -#ifdef noyet - /* options were tossed above */ - if (in6p->in6p_flags & IN6P_RECVOPTS) - /* broken */ - /* ip6_srcroute doesn't do what we want here, need to fix */ - if (in6p->in6p_flags & IPV6P_RECVRETOPTS) - /* broken */ -#endif + /* some OSes call this logic with IPv4 packet, for SO_TIMESTAMP */ + if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) + return; /* RFC 2292 sec. 5 */ if ((in6p->in6p_flags & IN6P_PKTINFO) != 0) { struct in6_pktinfo pi6; + bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr)); in6_clearscope(&pi6.ipi6_addr); /* XXX */ - pi6.ipi6_ifindex = (m && m->m_pkthdr.rcvif) - ? m->m_pkthdr.rcvif->if_index - : 0; + pi6.ipi6_ifindex = m->m_pkthdr.rcvif ? + m->m_pkthdr.rcvif->if_index : 0; *mp = sbcreatecontrol((caddr_t) &pi6, - sizeof(struct in6_pktinfo), IPV6_PKTINFO, IPPROTO_IPV6); + sizeof(struct in6_pktinfo), + IS2292(IPV6_2292PKTINFO, IPV6_PKTINFO), IPPROTO_IPV6); if (*mp) mp = &(*mp)->m_next; } + if (in6p->in6p_flags & IN6P_HOPLIMIT) { int hlim = ip6->ip6_hlim & 0xff; + *mp = sbcreatecontrol((caddr_t) &hlim, sizeof(int), - IPV6_HOPLIMIT, IPPROTO_IPV6); + IS2292(IPV6_2292HOPLIMIT, IPV6_HOPLIMIT), IPPROTO_IPV6); + if (*mp) + mp = &(*mp)->m_next; + } + + if ((in6p->in6p_flags & IN6P_TCLASS) != 0) { + u_int32_t flowinfo; + int tclass; + + flowinfo = (u_int32_t)ntohl(ip6->ip6_flow & IPV6_FLOWINFO_MASK); + flowinfo >>= 20; + + tclass = flowinfo & 0xff; + *mp = sbcreatecontrol((caddr_t)&tclass, sizeof(tclass), + IPV6_TCLASS, IPPROTO_IPV6); + if (*mp) mp = &(*mp)->m_next; } - /* IN6P_NEXTHOP - for outgoing packet only */ /* * IPV6_HOPOPTS socket option. Recall that we required super-user * privilege for the option (see ip6_ctloutput), but it might be too * strict, since there might be some hop-by-hop options which can be * returned to normal user. - * See also RFC 2292 section 6. + * See also RFC3542 section 8 (or RFC2292 section 6). */ if ((in6p->in6p_flags & IN6P_HOPOPTS) != 0) { /* @@ -1119,10 +1185,11 @@ ip6_savecontrol(in6p, mp, ip6, m) * XXX: We copy whole the header even if a jumbo * payload option is included, which option is to * be removed before returning in the RFC 2292. - * But it's too painful operation... + * Note: this constraint is removed in RFC3542. */ *mp = sbcreatecontrol((caddr_t)hbh, hbhlen, - IPV6_HOPOPTS, IPPROTO_IPV6); + IS2292(IPV6_2292HOPOPTS, IPV6_HOPOPTS), + IPPROTO_IPV6); if (*mp) mp = &(*mp)->m_next; m_freem(ext); @@ -1141,7 +1208,7 @@ ip6_savecontrol(in6p, mp, ip6, m) * Note that the order of the headers remains in * the chain of ancillary data. */ - while (1) { /* is explicit loop prevention necessary? */ + for (;;) { /* is explicit loop prevention necessary? */ struct ip6_ext *ip6e = NULL; int elen; struct mbuf *ext = NULL; @@ -1183,7 +1250,8 @@ ip6_savecontrol(in6p, mp, ip6, m) break; *mp = sbcreatecontrol((caddr_t)ip6e, elen, - IPV6_DSTOPTS, IPPROTO_IPV6); + IS2292(IPV6_2292DSTOPTS, IPV6_DSTOPTS), + IPPROTO_IPV6); if (*mp) mp = &(*mp)->m_next; break; @@ -1193,7 +1261,8 @@ ip6_savecontrol(in6p, mp, ip6, m) break; *mp = sbcreatecontrol((caddr_t)ip6e, elen, - IPV6_RTHDR, IPPROTO_IPV6); + IS2292(IPV6_2292RTHDR, IPV6_RTHDR), + IPPROTO_IPV6); if (*mp) mp = &(*mp)->m_next; break; @@ -1225,6 +1294,45 @@ ip6_savecontrol(in6p, mp, ip6, m) ; } } +#undef IS2292 + + +void +ip6_notify_pmtu(struct in6pcb *in6p, struct sockaddr_in6 *dst, uint32_t *mtu) +{ + struct socket *so; + struct mbuf *m_mtu; + struct ip6_mtuinfo mtuctl; + + so = in6p->in6p_socket; + + if (mtu == NULL) + return; + +#ifdef DIAGNOSTIC + if (so == NULL) /* I believe this is impossible */ + panic("ip6_notify_pmtu: socket is NULL"); +#endif + + memset(&mtuctl, 0, sizeof(mtuctl)); /* zero-clear for safety */ + mtuctl.ip6m_mtu = *mtu; + mtuctl.ip6m_addr = *dst; + if (sa6_recoverscope(&mtuctl.ip6m_addr)) + return; + + if ((m_mtu = sbcreatecontrol((caddr_t)&mtuctl, sizeof(mtuctl), + IPV6_PATHMTU, IPPROTO_IPV6)) == NULL) + return; + + if (sbappendaddr(&so->so_rcv, (struct sockaddr *)dst, NULL, m_mtu) + == 0) { + m_freem(m_mtu); + /* XXX: should count statistics */ + } else + sorwakeup(so); + + return; +} /* * pull single extension header from mbuf chain. returns single mbuf that @@ -1430,7 +1538,7 @@ ip6_lasthdr(m, off, proto, nxtp) nxt = -1; nxtp = &nxt; } - while (1) { + for (;;) { newoff = ip6_nexthdr(m, off, proto, nxtp); if (newoff < 0) return off; @@ -1498,6 +1606,11 @@ u_char inet6ctlerrmap[PRC_NCMDS] = { SYSCTL_SETUP(sysctl_net_inet6_ip6_setup, "sysctl net.inet6.ip6 subtree setup") { +#ifdef RFC2292 +#define IS2292(x, y) ((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y)) +#else +#define IS2292(x, y) (y) +#endif sysctl_createv(clog, 0, NULL, NULL, CTLFLAG_PERMANENT,