summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
authorjonathan <jonathan@NetBSD.org>2003-08-15 03:42:00 +0000
committerjonathan <jonathan@NetBSD.org>2003-08-15 03:42:00 +0000
commit28b5f5dfabb831ea8baec8eba121fa1d14aa5138 (patch)
tree6e6f1fcd7eef12f388fa2883f9e0bf69657c98be /sys
parentbc73aa40f55fc89ab83adcff00d2421b868a93d8 (diff)
(fast-ipsec): Add hooks to pass IPv4 IPsec traffic into fast-ipsec, if
configured with ``options FAST_IPSEC''. Kernels with KAME IPsec or with no IPsec should work as before. All calls to ip_output() now always pass an additional compulsory argument: the inpcb associated with the packet being sent, or 0 if no inpcb is available. Fast-ipsec tested with ICMP or UDP over ESP. TCP doesn't work, yet.
Diffstat (limited to 'sys')
-rw-r--r--sys/net/if_gre.c7
-rw-r--r--sys/net/if_stf.c7
-rw-r--r--sys/net/pfkeyv2.h5
-rw-r--r--sys/netinet/igmp.c6
-rw-r--r--sys/netinet/in_pcb.c17
-rw-r--r--sys/netinet/in_proto.c32
-rw-r--r--sys/netinet/ip_auth.c7
-rw-r--r--sys/netinet/ip_icmp.c14
-rw-r--r--sys/netinet/ip_input.c95
-rw-r--r--sys/netinet/ip_mroute.c13
-rw-r--r--sys/netinet/ip_output.c156
-rw-r--r--sys/netinet/raw_ip.c14
-rw-r--r--sys/netinet/tcp_input.c22
-rw-r--r--sys/netinet/tcp_output.c14
-rw-r--r--sys/netinet/tcp_subr.c17
-rw-r--r--sys/netinet/udp_usrreq.c17
-rw-r--r--sys/netinet6/udp6_output.c7
-rw-r--r--sys/netipsec/ipsec_output.c8
-rw-r--r--sys/netiso/if_eon.c7
-rw-r--r--sys/netiso/tp_inet.c7
-rw-r--r--sys/netns/ns_ip.c7
21 files changed, 392 insertions, 87 deletions
diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c
index d9d74272936..8b80ef22ac5 100644
--- a/sys/net/if_gre.c
+++ b/sys/net/if_gre.c
@@ -1,4 +1,4 @@
-/* $NetBSD: if_gre.c,v 1.45 2003/05/06 17:54:27 grant Exp $ */
+/* $NetBSD: if_gre.c,v 1.46 2003/08/15 03:42:00 jonathan Exp $ */
/*
* Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -46,7 +46,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_gre.c,v 1.45 2003/05/06 17:54:27 grant Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_gre.c,v 1.46 2003/08/15 03:42:00 jonathan Exp $");
#include "opt_inet.h"
#include "opt_ns.h"
@@ -336,7 +336,8 @@ gre_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
ifp->if_opackets++;
ifp->if_obytes += m->m_pkthdr.len;
/* send it off */
- error = ip_output(m, NULL, &sc->route, 0, NULL);
+ error = ip_output(m, NULL, &sc->route, 0,
+ (struct ip_moptions *)0, (struct inpcb *)0);
end:
if (error)
ifp->if_oerrors++;
diff --git a/sys/net/if_stf.c b/sys/net/if_stf.c
index 9a0f954eb48..095a55b34e6 100644
--- a/sys/net/if_stf.c
+++ b/sys/net/if_stf.c
@@ -1,4 +1,4 @@
-/* $NetBSD: if_stf.c,v 1.33 2003/05/01 07:52:59 itojun Exp $ */
+/* $NetBSD: if_stf.c,v 1.34 2003/08/15 03:42:00 jonathan Exp $ */
/* $KAME: if_stf.c,v 1.62 2001/06/07 22:32:16 itojun Exp $ */
/*
@@ -75,7 +75,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_stf.c,v 1.33 2003/05/01 07:52:59 itojun Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_stf.c,v 1.34 2003/08/15 03:42:00 jonathan Exp $");
#include "opt_inet.h"
@@ -465,7 +465,8 @@ stf_output(ifp, m, dst, rt)
}
ifp->if_opackets++;
- return ip_output(m, NULL, &sc->sc_ro, 0, NULL);
+ return ip_output(m, NULL, &sc->sc_ro, 0,
+ (struct ip_moptions *)0, (struct inpcb *)0);
}
static int
diff --git a/sys/net/pfkeyv2.h b/sys/net/pfkeyv2.h
index b6a90aa37f1..69ea2061458 100644
--- a/sys/net/pfkeyv2.h
+++ b/sys/net/pfkeyv2.h
@@ -1,4 +1,4 @@
-/* $NetBSD: pfkeyv2.h,v 1.14 2003/07/25 10:00:49 itojun Exp $ */
+/* $NetBSD: pfkeyv2.h,v 1.15 2003/08/15 03:42:00 jonathan Exp $ */
/* $KAME: pfkeyv2.h,v 1.36 2003/07/25 09:33:37 itojun Exp $ */
/*
@@ -317,7 +317,7 @@ struct sadb_x_ipsecrequest {
#define SADB_EALG_DESCBC 2
#define SADB_EALG_3DESCBC 3
#define SADB_EALG_NULL 11
-#define SADB_EALG_MAX 249
+#define SADB_EALG_MAX 250
/* private allocations - based on RFC2407/IANA assignment */
#define SADB_X_EALG_CAST128CBC 6
#define SADB_X_EALG_BLOWFISHCBC 7
@@ -325,6 +325,7 @@ struct sadb_x_ipsecrequest {
#define SADB_X_EALG_AES 12
/* private allocations should use 249-255 (RFC2407) */
#define SADB_X_EALG_AESCTR 249 /* draft-ietf-ipsec-ciph-aes-ctr-03 */
+#define SADB_X_EALG_SKIPJACK 250
/* private allocations - based on RFC2407/IANA assignment */
#define SADB_X_CALG_NONE 0
diff --git a/sys/netinet/igmp.c b/sys/netinet/igmp.c
index 5787980fc99..d7196011ac8 100644
--- a/sys/netinet/igmp.c
+++ b/sys/netinet/igmp.c
@@ -1,4 +1,4 @@
-/* $NetBSD: igmp.c,v 1.34 2003/06/26 03:11:08 itojun Exp $ */
+/* $NetBSD: igmp.c,v 1.35 2003/08/15 03:42:01 jonathan Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -40,7 +40,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: igmp.c,v 1.34 2003/06/26 03:11:08 itojun Exp $");
+__KERNEL_RCSID(0, "$NetBSD: igmp.c,v 1.35 2003/08/15 03:42:01 jonathan Exp $");
#include "opt_mrouting.h"
@@ -585,7 +585,7 @@ igmp_sendpkt(inm, type)
#endif /* MROUTING */
ip_output(m, (struct mbuf *)0, (struct route *)0, IP_MULTICASTOPTS,
- &imo);
+ &imo, (struct inpcb *)0);
++igmpstat.igps_snd_reports;
}
diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index 2b5cc266e41..7a1772d71ed 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -1,4 +1,4 @@
-/* $NetBSD: in_pcb.c,v 1.86 2003/08/07 16:33:10 agc Exp $ */
+/* $NetBSD: in_pcb.c,v 1.87 2003/08/15 03:42:01 jonathan Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -98,7 +98,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: in_pcb.c,v 1.86 2003/08/07 16:33:10 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: in_pcb.c,v 1.87 2003/08/15 03:42:01 jonathan Exp $");
#include "opt_ipsec.h"
@@ -128,6 +128,9 @@ __KERNEL_RCSID(0, "$NetBSD: in_pcb.c,v 1.86 2003/08/07 16:33:10 agc Exp $");
#ifdef IPSEC
#include <netinet6/ipsec.h>
#include <netkey/key.h>
+#elif FAST_IPSEC
+#include <netipsec/ipsec.h>
+#include <netipsec/key.h>
#endif /* IPSEC */
struct in_addr zeroin_addr;
@@ -181,7 +184,7 @@ in_pcballoc(so, v)
struct inpcbtable *table = v;
struct inpcb *inp;
int s;
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
int error;
#endif
@@ -192,7 +195,7 @@ in_pcballoc(so, v)
inp->inp_table = table;
inp->inp_socket = so;
inp->inp_errormtu = -1;
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
error = ipsec_init_pcbpolicy(so, &inp->inp_sp);
if (error != 0) {
pool_put(&inpcb_pool, inp);
@@ -446,7 +449,7 @@ in_pcbconnect(v, nam)
inp->inp_faddr = sin->sin_addr;
inp->inp_fport = sin->sin_port;
in_pcbstate(inp, INP_CONNECTED);
-#ifdef IPSEC
+#if defined(IPSEC) /*|| defined(FAST_IPSEC)*/ /*XXX*/
if (inp->inp_socket->so_type == SOCK_STREAM)
ipsec_pcbconn(inp->inp_sp);
#endif
@@ -464,7 +467,7 @@ in_pcbdisconnect(v)
in_pcbstate(inp, INP_BOUND);
if (inp->inp_socket->so_state & SS_NOFDREF)
in_pcbdetach(inp);
-#ifdef IPSEC
+#if defined(IPSEC) /*|| defined(FAST_IPSEC)*/ /*XXX*/
ipsec_pcbdisconn(inp->inp_sp);
#endif
}
@@ -477,7 +480,7 @@ in_pcbdetach(v)
struct socket *so = inp->inp_socket;
int s;
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
ipsec4_delete_pcbpolicy(inp);
#endif /*IPSEC*/
so->so_pcb = 0;
diff --git a/sys/netinet/in_proto.c b/sys/netinet/in_proto.c
index 4daeffa751e..23fea42d315 100644
--- a/sys/netinet/in_proto.c
+++ b/sys/netinet/in_proto.c
@@ -1,4 +1,4 @@
-/* $NetBSD: in_proto.c,v 1.60 2003/08/14 07:57:40 itojun Exp $ */
+/* $NetBSD: in_proto.c,v 1.61 2003/08/15 03:42:01 jonathan Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -61,7 +61,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: in_proto.c,v 1.60 2003/08/14 07:57:40 itojun Exp $");
+__KERNEL_RCSID(0, "$NetBSD: in_proto.c,v 1.61 2003/08/15 03:42:01 jonathan Exp $");
#include "opt_mrouting.h"
#include "opt_eon.h" /* ISO CLNL over IP */
@@ -118,6 +118,11 @@ __KERNEL_RCSID(0, "$NetBSD: in_proto.c,v 1.60 2003/08/14 07:57:40 itojun Exp $")
#include <netinet6/ipcomp.h>
#endif /* IPSEC */
+#ifdef FAST_IPSEC
+#include <netipsec/ipsec.h>
+#include <netipsec/key.h>
+#endif /* FAST_IPSEC */
+
#ifdef NSIP
#include <netns/ns_var.h>
#include <netns/idp_var.h>
@@ -173,17 +178,36 @@ struct protosw inetsw[] = {
},
#ifdef IPSEC_ESP
{ SOCK_RAW, &inetdomain, IPPROTO_ESP, PR_ATOMIC|PR_ADDR,
- esp4_input, 0, esp4_ctlinput, 0,
+ esp4_input,
+ 0, esp4_ctlinput, 0,
0,
0, 0, 0, 0, ipsec_sysctl
},
#endif
{ SOCK_RAW, &inetdomain, IPPROTO_IPCOMP, PR_ATOMIC|PR_ADDR,
- ipcomp4_input, 0, 0, 0,
+ ipcomp4_input,
+ 0, 0, 0,
0,
0, 0, 0, 0, ipsec_sysctl
},
#endif /* IPSEC */
+#ifdef FAST_IPSEC
+{ SOCK_RAW, &inetdomain, IPPROTO_AH, PR_ATOMIC|PR_ADDR,
+ ipsec4_common_input, 0, ah4_ctlinput, 0,
+ 0,
+ 0, 0, 0, 0, ipsec_sysctl
+},
+{ SOCK_RAW, &inetdomain, IPPROTO_ESP, PR_ATOMIC|PR_ADDR,
+ ipsec4_common_input, 0, esp4_ctlinput, 0,
+ 0,
+ 0, 0, 0, 0, ipsec_sysctl
+},
+{ SOCK_RAW, &inetdomain, IPPROTO_IPCOMP, PR_ATOMIC|PR_ADDR,
+ ipsec4_common_input, 0, 0, 0,
+ 0,
+ 0, 0, 0, 0, ipsec_sysctl
+},
+#endif /* FAST_IPSEC */
{ SOCK_RAW, &inetdomain, IPPROTO_IPV4, PR_ATOMIC|PR_ADDR|PR_LASTHDR,
encap4_input, rip_output, rip_ctlinput, rip_ctloutput,
rip_usrreq, /*XXX*/
diff --git a/sys/netinet/ip_auth.c b/sys/netinet/ip_auth.c
index e8eed541dd3..f192bd882ca 100644
--- a/sys/netinet/ip_auth.c
+++ b/sys/netinet/ip_auth.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ip_auth.c,v 1.30 2002/09/19 08:12:45 martti Exp $ */
+/* $NetBSD: ip_auth.c,v 1.31 2003/08/15 03:42:02 jonathan Exp $ */
/*
* Copyright (C) 1998-2001 by Darren Reed & Guido van Rooij.
@@ -108,7 +108,7 @@ extern struct ifqueue ipintrq; /* ip packet input queue */
#if !defined(lint)
#if defined(__NetBSD__)
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_auth.c,v 1.30 2002/09/19 08:12:45 martti Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_auth.c,v 1.31 2003/08/15 03:42:02 jonathan Exp $");
#else
static const char rcsid[] = "@(#)Id: ip_auth.c,v 2.11.2.20 2002/06/04 14:40:42 darrenr Exp";
#endif
@@ -464,7 +464,8 @@ fr_authioctlloop:
error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL,
NULL);
# else
- error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL);
+ error = ip_output(m, NULL, &ro, IP_FORWARDING,
+ (struct ip_moptions *)0, (struct inpcb *)0);
# endif
if (ro.ro_rt) {
RTFREE(ro.ro_rt);
diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c
index 94574cef6f0..5307b310140 100644
--- a/sys/netinet/ip_icmp.c
+++ b/sys/netinet/ip_icmp.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ip_icmp.c,v 1.75 2003/08/07 16:33:12 agc Exp $ */
+/* $NetBSD: ip_icmp.c,v 1.76 2003/08/15 03:42:02 jonathan Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -101,7 +101,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.75 2003/08/07 16:33:12 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.76 2003/08/15 03:42:02 jonathan Exp $");
#include "opt_ipsec.h"
@@ -133,6 +133,11 @@ __KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.75 2003/08/07 16:33:12 agc Exp $");
#include <netkey/key.h>
#endif
+#ifdef FAST_IPSEC
+#include <netipsec/ipsec.h>
+#include <netipsec/key.h>
+#endif /* FAST_IPSEC*/
+
#include <machine/stdarg.h>
/*
@@ -603,7 +608,7 @@ reflect:
rtfree(rt);
pfctlinput(PRC_REDIRECT_HOST, sintosa(&icmpsrc));
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
key_sa_routechange((struct sockaddr *)&icmpsrc);
#endif
break;
@@ -872,7 +877,8 @@ icmp_send(m, opts)
/* Don't lookup socket */
(void)ipsec_setsocket(m, NULL);
#endif
- (void) ip_output(m, opts, NULL, 0, NULL);
+ (void) ip_output(m, opts, NULL, 0,
+ (struct ip_moptions *)0, (struct inpcb *)0);
}
n_time
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index 73f6ec69b4f..7835c52a847 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ip_input.c,v 1.172 2003/08/07 16:33:12 agc Exp $ */
+/* $NetBSD: ip_input.c,v 1.173 2003/08/15 03:42:02 jonathan Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -98,7 +98,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.172 2003/08/07 16:33:12 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.173 2003/08/15 03:42:02 jonathan Exp $");
#include "opt_gateway.h"
#include "opt_pfil_hooks.h"
@@ -147,6 +147,10 @@ __KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.172 2003/08/07 16:33:12 agc Exp $");
#include <netinet6/ipsec.h>
#include <netkey/key.h>
#endif
+#ifdef FAST_IPSEC
+#include <netipsec/ipsec.h>
+#include <netipsec/key.h>
+#endif /* FAST_IPSEC*/
#ifndef IPFORWARDING
#ifdef GATEWAY
@@ -429,6 +433,12 @@ ip_input(struct mbuf *m)
int downmatch;
int checkif;
int srcrt = 0;
+#ifdef FAST_IPSEC
+ struct m_tag *mtag;
+ struct tdb_ident *tdbi;
+ struct secpolicy *sp;
+ int s, error;
+#endif /* FAST_IPSEC */
MCLAIM(m, &ip_rx_mowner);
#ifdef DIAGNOSTIC
@@ -762,6 +772,34 @@ ip_input(struct mbuf *m)
goto bad;
}
#endif
+#ifdef FAST_IPSEC
+ mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
+ s = splsoftnet();
+ if (mtag != NULL) {
+ tdbi = (struct tdb_ident *)(mtag + 1);
+ sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND);
+ } else {
+ sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND,
+ IP_FORWARDING, &error);
+ }
+ if (sp == NULL) { /* NB: can happen if error */
+ splx(s);
+ /*XXX error stat???*/
+ DPRINTF(("ip_input: no SP for forwarding\n")); /*XXX*/
+ goto bad;
+ }
+
+ /*
+ * Check security policy against packet attributes.
+ */
+ error = ipsec_in_reject(sp, m);
+ KEY_FREESP(&sp);
+ splx(s);
+ if (error) {
+ ipstat.ips_cantforward++;
+ goto bad;
+ }
+#endif /* FAST_IPSEC */
ip_forward(m, srcrt);
}
@@ -850,7 +888,7 @@ found:
IPQ_UNLOCK();
}
-#ifdef IPSEC
+#if defined(IPSEC)
/*
* enforce IPsec policy checking if we are seeing last header.
* note that we do not visit this with protocols with pcb layer
@@ -862,6 +900,45 @@ found:
goto bad;
}
#endif
+#if FAST_IPSEC
+ /*
+ * enforce IPsec policy checking if we are seeing last header.
+ * note that we do not visit this with protocols with pcb layer
+ * code - like udp/tcp/raw ip.
+ */
+ if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0) {
+ /*
+ * Check if the packet has already had IPsec processing
+ * done. If so, then just pass it along. This tag gets
+ * set during AH, ESP, etc. input handling, before the
+ * packet is returned to the ip input queue for delivery.
+ */
+ mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
+ s = splsoftnet();
+ if (mtag != NULL) {
+ tdbi = (struct tdb_ident *)(mtag + 1);
+ sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND);
+ } else {
+ sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND,
+ IP_FORWARDING, &error);
+ }
+ if (sp != NULL) {
+ /*
+ * Check security policy against packet attributes.
+ */
+ error = ipsec_in_reject(sp, m);
+ KEY_FREESP(&sp);
+ } else {
+ /* XXX error stat??? */
+ error = EINVAL;
+DPRINTF(("ip_input: no SP, packet discarded\n"));/*XXX*/
+ goto bad;
+ }
+ splx(s);
+ if (error)
+ goto bad;
+ }
+#endif /* FAST_IPSEC */
/*
* Switch out to protocol's input routine.
@@ -1566,7 +1643,7 @@ ip_forward(m, srcrt)
struct mbuf *mcopy;
n_long dest;
struct ifnet *destifp;
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
struct ifnet dummyifp;
#endif
@@ -1664,7 +1741,9 @@ ip_forward(m, srcrt)
(void)ipsec_setsocket(m, NULL);
#endif
error = ip_output(m, (struct mbuf *)0, &ipforward_rt,
- (IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)), 0);
+ (IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)),
+ (struct ip_moptions *)0, (struct inpcb *)0);
+
if (error)
ipstat.ips_cantforward++;
else {
@@ -1704,7 +1783,7 @@ ip_forward(m, srcrt)
case EMSGSIZE:
type = ICMP_UNREACH;
code = ICMP_UNREACH_NEEDFRAG;
-#ifndef IPSEC
+#if !defined(IPSEC) && !defined(FAST_IPSEC)
if (ipforward_rt.ro_rt)
destifp = ipforward_rt.ro_rt->rt_ifp;
#else
@@ -1755,7 +1834,11 @@ ip_forward(m, srcrt)
}
}
+#ifdef IPSEC
key_freesp(sp);
+#else
+ KEY_FREESP(&sp);
+#endif
}
}
#endif /*IPSEC*/
diff --git a/sys/netinet/ip_mroute.c b/sys/netinet/ip_mroute.c
index 6918501d282..1d6ff195032 100644
--- a/sys/netinet/ip_mroute.c
+++ b/sys/netinet/ip_mroute.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ip_mroute.c,v 1.76 2003/08/07 16:33:13 agc Exp $ */
+/* $NetBSD: ip_mroute.c,v 1.77 2003/08/15 03:42:03 jonathan Exp $ */
/*
* Copyright (c) 1992, 1993
@@ -86,7 +86,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.76 2003/08/07 16:33:13 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.77 2003/08/15 03:42:03 jonathan Exp $");
#include "opt_ipsec.h"
@@ -122,6 +122,11 @@ __KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.76 2003/08/07 16:33:13 agc Exp $");
#include <netkey/key.h>
#endif
+#ifdef FAST_IPSEC
+#include <netipsec/ipsec.h>
+#include <netipsec/key.h>
+#endif
+
#include <machine/stdarg.h>
#define IP_MULTICASTOPTS 0
@@ -1847,7 +1852,7 @@ tbf_send_packet(vifp, m)
(void)ipsec_setsocket(m, NULL);
#endif
ip_output(m, (struct mbuf *)0, &vifp->v_route,
- IP_FORWARDING, (struct ip_moptions *)0);
+ IP_FORWARDING, (struct ip_moptions *)0, (struct inpcb *)0);
} else {
/* if physical interface option, extract the options and then send */
struct ip_moptions imo;
@@ -1864,7 +1869,7 @@ tbf_send_packet(vifp, m)
(void)ipsec_setsocket(m, NULL);
#endif
error = ip_output(m, (struct mbuf *)0, (struct route *)0,
- IP_FORWARDING|IP_MULTICASTOPTS, &imo);
+ IP_FORWARDING|IP_MULTICASTOPTS, &imo, (struct inpcb *)0);
if (mrtdebug & DEBUG_XMIT)
log(LOG_DEBUG, "phyint_send on vif %ld err %d\n",
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index a5d9b0a86f5..a6cee268812 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ip_output.c,v 1.108 2003/08/07 16:33:14 agc Exp $ */
+/* $NetBSD: ip_output.c,v 1.109 2003/08/15 03:42:03 jonathan Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -98,7 +98,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.108 2003/08/07 16:33:14 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.109 2003/08/15 03:42:03 jonathan Exp $");
#include "opt_pfil_hooks.h"
#include "opt_ipsec.h"
@@ -137,6 +137,12 @@ __KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.108 2003/08/07 16:33:14 agc Exp $");
#include <netkey/key_debug.h>
#endif /*IPSEC*/
+#ifdef FAST_IPSEC
+#include <netipsec/ipsec.h>
+#include <netipsec/key.h>
+#include <netipsec/xform.h>
+#endif /* FAST_IPSEC*/
+
static struct mbuf *ip_insertoptions __P((struct mbuf *, struct mbuf *, int *));
static struct ifnet *ip_multicast_if __P((struct in_addr *, int *));
static void ip_mloopback
@@ -175,11 +181,18 @@ ip_output(m0, va_alist)
int *mtu_p;
u_long mtu;
struct ip_moptions *imo;
+ struct inpcb *inp;
va_list ap;
#ifdef IPSEC
struct socket *so;
struct secpolicy *sp = NULL;
#endif /*IPSEC*/
+#ifdef FAST_IPSEC
+ struct m_tag *mtag;
+ struct secpolicy *sp = NULL;
+ struct tdb_ident *tdbi;
+ int s;
+#endif
u_int16_t ip_len;
len = 0;
@@ -188,6 +201,7 @@ ip_output(m0, va_alist)
ro = va_arg(ap, struct route *);
flags = va_arg(ap, int);
imo = va_arg(ap, struct ip_moptions *);
+ inp = va_arg(ap, struct inpcb *);
if (flags & IP_RETURNMTU)
mtu_p = va_arg(ap, int *);
else
@@ -195,7 +209,7 @@ ip_output(m0, va_alist)
va_end(ap);
MCLAIM(m, &ip_tx_mowner);
-#ifdef IPSEC
+#ifdef IPSEC /* XXX so = ((inp == NULL) ? NULL : inp->inp_socket; */
so = ipsec_getsocket(m);
(void)ipsec_setsocket(m, NULL);
#endif /*IPSEC*/
@@ -573,6 +587,132 @@ sendit:
skip_ipsec:
#endif /*IPSEC*/
+#ifdef FAST_IPSEC
+ /*
+ * Check the security policy (SP) for the packet and, if
+ * required, do IPsec-related processing. There are two
+ * cases here; the first time a packet is sent through
+ * it will be untagged and handled by ipsec4_checkpolicy.
+ * If the packet is resubmitted to ip_output (e.g. after
+ * AH, ESP, etc. processing), there will be a tag to bypass
+ * the lookup and related policy checking.
+ */
+ mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL);
+ s = splsoftnet();
+ if (mtag != NULL) {
+ tdbi = (struct tdb_ident *)(mtag + 1);
+ sp = ipsec_getpolicy(tdbi, IPSEC_DIR_OUTBOUND);
+ if (sp == NULL)
+ error = -EINVAL; /* force silent drop */
+ m_tag_delete(m, mtag);
+ } else {
+ sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags,
+ &error, inp);
+ }
+ /*
+ * There are four return cases:
+ * sp != NULL apply IPsec policy
+ * sp == NULL, error == 0 no IPsec handling needed
+ * sp == NULL, error == -EINVAL discard packet w/o error
+ * sp == NULL, error != 0 discard packet, report error
+ */
+ if (sp != NULL) {
+ /* Loop detection, check if ipsec processing already done */
+ IPSEC_ASSERT(sp->req != NULL, ("ip_output: no ipsec request"));
+ for (mtag = m_tag_first(m); mtag != NULL;
+ mtag = m_tag_next(m, mtag)) {
+#ifdef MTAG_ABI_COMPAT
+ if (mtag->m_tag_cookie != MTAG_ABI_COMPAT)
+ continue;
+#endif
+ if (mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_DONE &&
+ mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED)
+ continue;
+ /*
+ * Check if policy has an SA associated with it.
+ * This can happen when an SP has yet to acquire
+ * an SA; e.g. on first reference. If it occurs,
+ * then we let ipsec4_process_packet do its thing.
+ */
+ if (sp->req->sav == NULL)
+ break;
+ tdbi = (struct tdb_ident *)(mtag + 1);
+ if (tdbi->spi == sp->req->sav->spi &&
+ tdbi->proto == sp->req->sav->sah->saidx.proto &&
+ bcmp(&tdbi->dst, &sp->req->sav->sah->saidx.dst,
+ sizeof (union sockaddr_union)) == 0) {
+ /*
+ * No IPsec processing is needed, free
+ * reference to SP.
+ *
+ * NB: null pointer to avoid free at
+ * done: below.
+ */
+ KEY_FREESP(&sp), sp = NULL;
+ splx(s);
+ goto spd_done;
+ }
+ }
+
+ /*
+ * Do delayed checksums now because we send before
+ * this is done in the normal processing path.
+ */
+ if (m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) {
+ in_delayed_cksum(m);
+ m->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv4|M_CSUM_UDPv4);
+ }
+
+#ifdef __FreeBSD__
+ ip->ip_len = htons(ip->ip_len);
+ ip->ip_off = htons(ip->ip_off);
+#endif
+
+ /* NB: callee frees mbuf */
+ error = ipsec4_process_packet(m, sp->req, flags, 0);
+ /*
+ * Preserve KAME behaviour: ENOENT can be returned
+ * when an SA acquire is in progress. Don't propagate
+ * this to user-level; it confuses applications.
+ *
+ * XXX this will go away when the SADB is redone.
+ */
+ if (error == ENOENT)
+ error = 0;
+ splx(s);
+ goto done;
+ } else {
+ splx(s);
+
+ if (error != 0) {
+ /*
+ * Hack: -EINVAL is used to signal that a packet
+ * should be silently discarded. This is typically
+ * because we asked key management for an SA and
+ * it was delayed (e.g. kicked up to IKE).
+ */
+ if (error == -EINVAL)
+ error = 0;
+ goto bad;
+ } else {
+ /* No IPsec processing for this packet. */
+ }
+#ifdef notyet
+ /*
+ * If deferred crypto processing is needed, check that
+ * the interface supports it.
+ */
+ mtag = m_tag_find(m, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL);
+ if (mtag != NULL && (ifp->if_capenable & IFCAP_IPSEC) == 0) {
+ /* notify IPsec to do its own crypto */
+ ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1));
+ error = EHOSTUNREACH;
+ goto bad;
+ }
+#endif
+ }
+spd_done:
+#endif /* FAST_IPSEC */
#ifdef PFIL_HOOKS
/*
@@ -787,6 +927,10 @@ done:
key_freesp(sp);
}
#endif /* IPSEC */
+#ifdef FAST_IPSEC
+ if (sp != NULL)
+ KEY_FREESP(&sp);
+#endif /* FAST_IPSEC */
return (error);
bad:
@@ -947,7 +1091,7 @@ ip_ctloutput(op, so, level, optname, mp)
struct mbuf *m = *mp;
int optval = 0;
int error = 0;
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
#ifdef __NetBSD__
struct proc *p = curproc; /*XXX*/
#endif
@@ -1046,7 +1190,7 @@ ip_ctloutput(op, so, level, optname, mp)
}
break;
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
case IP_IPSEC_POLICY:
{
caddr_t req = NULL;
@@ -1137,7 +1281,7 @@ ip_ctloutput(op, so, level, optname, mp)
*mtod(m, int *) = optval;
break;
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
case IP_IPSEC_POLICY:
{
caddr_t req = NULL;
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index db14416f259..83105eabcfe 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -1,4 +1,4 @@
-/* $NetBSD: raw_ip.c,v 1.71 2003/08/07 16:33:14 agc Exp $ */
+/* $NetBSD: raw_ip.c,v 1.72 2003/08/15 03:42:03 jonathan Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -61,7 +61,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.71 2003/08/07 16:33:14 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.72 2003/08/15 03:42:03 jonathan Exp $");
#include "opt_ipsec.h"
#include "opt_mrouting.h"
@@ -94,6 +94,10 @@ __KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.71 2003/08/07 16:33:14 agc Exp $");
#include <netinet6/ipsec.h>
#endif /*IPSEC*/
+#ifdef FAST_IPSEC
+#include <netipsec/ipsec.h>
+#endif /* FAST_IPSEC*/
+
struct inpcbtable rawcbtable;
int rip_pcbnotify __P((struct inpcbtable *, struct in_addr,
@@ -175,7 +179,7 @@ rip_input(m, va_alist)
if (last) {
struct mbuf *n;
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
/* check AH/ESP integrity. */
if (ipsec4_in_reject_so(m, last->inp_socket)) {
ipsecstat.in_polvio++;
@@ -199,7 +203,7 @@ rip_input(m, va_alist)
}
last = inp;
}
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
/* check AH/ESP integrity. */
if (last && ipsec4_in_reject_so(m, last->inp_socket)) {
m_freem(m);
@@ -382,7 +386,7 @@ rip_output(m, va_alist)
}
#endif /*IPSEC*/
return (ip_output(m, opts, &inp->inp_route, flags, inp->inp_moptions,
- &inp->inp_errormtu));
+ inp, &inp->inp_errormtu));
}
/*
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index af66ab3c883..db782a8ae21 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -1,4 +1,4 @@
-/* $NetBSD: tcp_input.c,v 1.174 2003/08/07 16:33:15 agc Exp $ */
+/* $NetBSD: tcp_input.c,v 1.175 2003/08/15 03:42:04 jonathan Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -148,7 +148,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.174 2003/08/07 16:33:15 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.175 2003/08/15 03:42:04 jonathan Exp $");
#include "opt_inet.h"
#include "opt_ipsec.h"
@@ -216,7 +216,13 @@ __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.174 2003/08/07 16:33:15 agc Exp $");
#if defined(NFAITH) && NFAITH > 0
#include <net/if_faith.h>
#endif
-#endif
+#endif /* IPSEC */
+
+#ifdef FAST_IPSEC
+#include <netipsec/ipsec.h>
+#include <netipsec/key.h>
+#endif /* FAST_IPSEC*/
+
int tcprexmtthresh = 3;
int tcp_log_refused;
@@ -1005,7 +1011,7 @@ findpcb:
TCP_FIELDS_TO_HOST(th);
goto dropwithreset_ratelim;
}
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
if (inp && ipsec4_in_reject(m, inp)) {
ipsecstat.in_polvio++;
goto drop;
@@ -1045,7 +1051,7 @@ findpcb:
TCP_FIELDS_TO_HOST(th);
goto dropwithreset_ratelim;
}
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
if (ipsec6_in_reject(m, in6p)) {
ipsec6stat.in_polvio++;
goto drop;
@@ -3210,7 +3216,7 @@ syn_cache_get(src, dst, th, hlen, tlen, so, m)
}
#endif
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
/*
* we make a copy of policy, instead of sharing the policy,
* for better behavior in terms of SA lookup and dead SA removal.
@@ -3798,8 +3804,8 @@ syn_cache_respond(sc, m)
#ifdef INET
case AF_INET:
error = ip_output(m, sc->sc_ipopts, ro,
- (ip_mtudisc ? IP_MTUDISC : 0),
- NULL);
+ (ip_mtudisc ? IP_MTUDISC : 0),
+ (struct ip_moptions *)0, (struct inpcb *)0);
break;
#endif
#ifdef INET6
diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
index a44e3e3d1de..7dab7ebb013 100644
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -1,4 +1,4 @@
-/* $NetBSD: tcp_output.c,v 1.97 2003/08/07 16:33:17 agc Exp $ */
+/* $NetBSD: tcp_output.c,v 1.98 2003/08/15 03:42:04 jonathan Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -138,7 +138,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.97 2003/08/07 16:33:17 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.98 2003/08/15 03:42:04 jonathan Exp $");
#include "opt_inet.h"
#include "opt_ipsec.h"
@@ -175,6 +175,9 @@ __KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.97 2003/08/07 16:33:17 agc Exp $");
#include <netinet6/nd6.h>
#endif
+#ifdef FAST_IPSEC
+#include <netipsec/ipsec.h>
+#endif /* FAST_IPSEC*/
#ifdef IPSEC
#include <netinet6/ipsec.h>
#endif
@@ -322,7 +325,7 @@ tcp_segsize(struct tcpcb *tp, int *txsegsizep, int *rxsegsizep)
*/
#ifdef INET
if (inp) {
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
optlen += ipsec4_hdrsiz_tcp(tp);
#endif
optlen += ip_optlen(inp);
@@ -331,7 +334,7 @@ tcp_segsize(struct tcpcb *tp, int *txsegsizep, int *rxsegsizep)
#ifdef INET6
#ifdef INET
if (in6p && tp->t_family == AF_INET) {
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
optlen += ipsec4_hdrsiz_tcp(tp);
#endif
/* XXX size -= ip_optlen(in6p); */
@@ -1169,7 +1172,8 @@ send:
error = ip_output(m, opts, ro,
(tp->t_mtudisc ? IP_MTUDISC : 0) |
(so->so_options & SO_DONTROUTE),
- 0);
+ (struct ip_moptions *)0,
+ (tp == NULL ? (struct inpcb *)0 : tp->t_inpcb));
break;
}
#endif
diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c
index edcfd87f829..55650336f85 100644
--- a/sys/netinet/tcp_subr.c
+++ b/sys/netinet/tcp_subr.c
@@ -1,4 +1,4 @@
-/* $NetBSD: tcp_subr.c,v 1.145 2003/08/07 16:33:18 agc Exp $ */
+/* $NetBSD: tcp_subr.c,v 1.146 2003/08/15 03:42:05 jonathan Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -98,7 +98,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tcp_subr.c,v 1.145 2003/08/07 16:33:18 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcp_subr.c,v 1.146 2003/08/15 03:42:05 jonathan Exp $");
#include "opt_inet.h"
#include "opt_ipsec.h"
@@ -157,6 +157,14 @@ __KERNEL_RCSID(0, "$NetBSD: tcp_subr.c,v 1.145 2003/08/07 16:33:18 agc Exp $");
#include <netinet6/ipsec.h>
#endif /*IPSEC*/
+#ifdef FAST_IPSEC
+#include <netipsec/ipsec.h>
+#ifdef INET6
+#include <netipsec/ipsec6.h>
+#endif
+#endif /* FAST_IPSEC*/
+
+
#ifdef INET6
struct in6pcb tcb6;
#endif
@@ -865,7 +873,8 @@ tcp_respond(tp, template, m, th0, ack, seq, flags)
case AF_INET:
error = ip_output(m, NULL, ro,
(tp && tp->t_mtudisc ? IP_MTUDISC : 0),
- NULL);
+ (struct ip_moptions *)0,
+ (tp == NULL ? (struct inpcb *)0 : tp->t_inpcb));
break;
#endif
#ifdef INET6
@@ -2134,7 +2143,7 @@ tcp_new_iss1(void *laddr, void *faddr, u_int16_t lport, u_int16_t fport,
return (tcp_iss);
}
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
/* compute ESP/AH header size for TCP, including outer IP header. */
size_t
ipsec4_hdrsiz_tcp(tp)
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index f737cc8a725..144656ba936 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,4 +1,4 @@
-/* $NetBSD: udp_usrreq.c,v 1.104 2003/08/07 16:33:20 agc Exp $ */
+/* $NetBSD: udp_usrreq.c,v 1.105 2003/08/15 03:42:05 jonathan Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -61,7 +61,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.104 2003/08/07 16:33:20 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.105 2003/08/15 03:42:05 jonathan Exp $");
#include "opt_inet.h"
#include "opt_ipsec.h"
@@ -115,6 +115,13 @@ __KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.104 2003/08/07 16:33:20 agc Exp $")
#include <machine/stdarg.h>
+#ifdef FAST_IPSEC
+#include <netipsec/ipsec.h>
+#ifdef INET6
+#include <netipsec/ipsec6.h>
+#endif
+#endif /* FAST_IPSEC*/
+
#ifdef IPSEC
#include <netinet6/ipsec.h>
#include <netkey/key.h>
@@ -486,7 +493,7 @@ udp4_sendup(m, off, src, so)
return;
}
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
/* check AH/ESP integrity. */
if (so != NULL && ipsec4_in_reject_so(m, so)) {
ipsecstat.in_polvio++;
@@ -532,7 +539,7 @@ udp6_sendup(m, off, src, so)
return;
in6p = sotoin6pcb(so);
-#ifdef IPSEC
+#if defined(IPSEC) || defined(FAST_IPSEC)
/* check AH/ESP integrity. */
if (so != NULL && ipsec6_in_reject_so(m, so)) {
ipsec6stat.in_polvio++;
@@ -903,7 +910,7 @@ udp_output(m, va_alist)
return (ip_output(m, inp->inp_options, &inp->inp_route,
inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST),
- inp->inp_moptions));
+ inp->inp_moptions, inp));
release:
m_freem(m);
diff --git a/sys/netinet6/udp6_output.c b/sys/netinet6/udp6_output.c
index 4760c021ff7..39a9f6a5869 100644
--- a/sys/netinet6/udp6_output.c
+++ b/sys/netinet6/udp6_output.c
@@ -1,4 +1,4 @@
-/* $NetBSD: udp6_output.c,v 1.11 2003/08/07 16:33:30 agc Exp $ */
+/* $NetBSD: udp6_output.c,v 1.12 2003/08/15 03:42:06 jonathan Exp $ */
/* $KAME: udp6_output.c,v 1.43 2001/10/15 09:19:52 itojun Exp $ */
/*
@@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: udp6_output.c,v 1.11 2003/08/07 16:33:30 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: udp6_output.c,v 1.12 2003/08/15 03:42:06 jonathan Exp $");
#include "opt_ipsec.h"
#include "opt_inet.h"
@@ -386,7 +386,8 @@ udp6_output(in6p, m, addr6, control, p)
#ifdef IPSEC
(void)ipsec_setsocket(m, NULL); /* XXX */
#endif /* IPSEC */
- error = ip_output(m, NULL, &in6p->in6p_route, flags /* XXX */);
+ error = ip_output(m, NULL, &in6p->in6p_route, flags /* XXX */,
+ (struct ip_moptions *)0, (struct inpcb *)0);
break;
#else
error = EAFNOSUPPORT;
diff --git a/sys/netipsec/ipsec_output.c b/sys/netipsec/ipsec_output.c
index 5a9b5fd1a67..5a5d0b31e5c 100644
--- a/sys/netipsec/ipsec_output.c
+++ b/sys/netipsec/ipsec_output.c
@@ -1,9 +1,9 @@
-/* $NetBSD: ipsec_output.c,v 1.1 2003/08/13 20:06:51 jonathan Exp $ */
+/* $NetBSD: ipsec_output.c,v 1.2 2003/08/15 03:42:07 jonathan Exp $ */
/* $FreeBSD: src/sys/netipsec/ipsec_output.c,v 1.3.2.1 2003/01/24 05:11:35 sam Exp $ */
/* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec_output.c,v 1.1 2003/08/13 20:06:51 jonathan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec_output.c,v 1.2 2003/08/15 03:42:07 jonathan Exp $");
/*
* IPsec output processing.
@@ -151,7 +151,9 @@ ipsec_process_done(struct mbuf *m, struct ipsecrequest *isr)
ip->ip_len = ntohs(ip->ip_len);
ip->ip_off = ntohs(ip->ip_off);
#endif /* __FreeBSD_ */
- return ip_output(m, NULL, NULL, IP_RAWOUTPUT, NULL, NULL);
+ return ip_output(m, NULL, NULL, IP_RAWOUTPUT,
+ (struct ip_moptions *)0, (struct inpcb*)0);
+
#endif /* INET */
#ifdef INET6
case AF_INET6:
diff --git a/sys/netiso/if_eon.c b/sys/netiso/if_eon.c
index 6aec0de5f79..1bd58be4c73 100644
--- a/sys/netiso/if_eon.c
+++ b/sys/netiso/if_eon.c
@@ -1,4 +1,4 @@
-/* $NetBSD: if_eon.c,v 1.39 2003/08/07 16:33:35 agc Exp $ */
+/* $NetBSD: if_eon.c,v 1.40 2003/08/15 03:42:06 jonathan Exp $ */
/*-
* Copyright (c) 1991, 1993
@@ -67,7 +67,7 @@ SOFTWARE.
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_eon.c,v 1.39 2003/08/07 16:33:35 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_eon.c,v 1.40 2003/08/15 03:42:06 jonathan Exp $");
#include "opt_eon.h"
@@ -447,7 +447,8 @@ send:
}
#endif
- error = ip_output(m, (struct mbuf *) 0, ro, 0, NULL);
+ error = ip_output(m, (struct mbuf *) 0, ro, 0,
+ (struct ip_moptions *)0, (struct inpcb *)0);
m = 0;
if (error) {
ifp->if_oerrors++;
diff --git a/sys/netiso/tp_inet.c b/sys/netiso/tp_inet.c
index 6ea1207e6b0..c8b82ee3aee 100644
--- a/sys/netiso/tp_inet.c
+++ b/sys/netiso/tp_inet.c
@@ -1,4 +1,4 @@
-/* $NetBSD: tp_inet.c,v 1.24 2003/08/11 15:17:30 itojun Exp $ */
+/* $NetBSD: tp_inet.c,v 1.25 2003/08/15 03:42:06 jonathan Exp $ */
/*-
* Copyright (c) 1991, 1993
@@ -73,7 +73,7 @@ SOFTWARE.
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tp_inet.c,v 1.24 2003/08/11 15:17:30 itojun Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tp_inet.c,v 1.25 2003/08/15 03:42:06 jonathan Exp $");
#include "opt_inet.h"
#include "opt_iso.h"
@@ -485,7 +485,8 @@ tpip_output_dg(m0, va_alist)
}
#endif
- error = ip_output(m, (struct mbuf *) 0, ro, IP_ALLOWBROADCAST, NULL);
+ error = ip_output(m, (struct mbuf *) 0, ro, IP_ALLOWBROADCAST,
+ (struct ip_moptions *)0, (struct inpcb *)0);
#ifdef ARGO_DEBUG
if (argo_debug[D_EMIT]) {
diff --git a/sys/netns/ns_ip.c b/sys/netns/ns_ip.c
index 5d10482d0e0..aabb647d898 100644
--- a/sys/netns/ns_ip.c
+++ b/sys/netns/ns_ip.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ns_ip.c,v 1.33 2003/08/07 16:33:46 agc Exp $ */
+/* $NetBSD: ns_ip.c,v 1.34 2003/08/15 03:42:07 jonathan Exp $ */
/*
* Copyright (c) 1984, 1985, 1986, 1987, 1993
@@ -36,7 +36,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ns_ip.c,v 1.33 2003/08/07 16:33:46 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ns_ip.c,v 1.34 2003/08/15 03:42:07 jonathan Exp $");
#include "opt_ns.h" /* options NSIP, needed by ns_if.h */
@@ -329,7 +329,8 @@ nsipoutput(ifp, m, dst, rt)
/*
* Output final datagram.
*/
- error = ip_output(m, (struct mbuf *)0, ro, SO_BROADCAST, NULL);
+ error = ip_output(m, (struct mbuf *)0, ro, SO_BROADCAST,
+ (struct ip_moptions *)0, (struct inpcb *)0);
if (error) {
ifn->ifen_ifnet.if_oerrors++;
ifn->ifen_ifnet.if_ierrors = error;