diff options
| author | jonathan <jonathan@NetBSD.org> | 2003-08-15 03:42:00 +0000 |
|---|---|---|
| committer | jonathan <jonathan@NetBSD.org> | 2003-08-15 03:42:00 +0000 |
| commit | 28b5f5dfabb831ea8baec8eba121fa1d14aa5138 (patch) | |
| tree | 6e6f1fcd7eef12f388fa2883f9e0bf69657c98be /sys | |
| parent | bc73aa40f55fc89ab83adcff00d2421b868a93d8 (diff) | |
(fast-ipsec): Add hooks to pass IPv4 IPsec traffic into fast-ipsec, if
configured with ``options FAST_IPSEC''. Kernels with KAME IPsec or
with no IPsec should work as before.
All calls to ip_output() now always pass an additional compulsory
argument: the inpcb associated with the packet being sent,
or 0 if no inpcb is available.
Fast-ipsec tested with ICMP or UDP over ESP. TCP doesn't work, yet.
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/net/if_gre.c | 7 | ||||
| -rw-r--r-- | sys/net/if_stf.c | 7 | ||||
| -rw-r--r-- | sys/net/pfkeyv2.h | 5 | ||||
| -rw-r--r-- | sys/netinet/igmp.c | 6 | ||||
| -rw-r--r-- | sys/netinet/in_pcb.c | 17 | ||||
| -rw-r--r-- | sys/netinet/in_proto.c | 32 | ||||
| -rw-r--r-- | sys/netinet/ip_auth.c | 7 | ||||
| -rw-r--r-- | sys/netinet/ip_icmp.c | 14 | ||||
| -rw-r--r-- | sys/netinet/ip_input.c | 95 | ||||
| -rw-r--r-- | sys/netinet/ip_mroute.c | 13 | ||||
| -rw-r--r-- | sys/netinet/ip_output.c | 156 | ||||
| -rw-r--r-- | sys/netinet/raw_ip.c | 14 | ||||
| -rw-r--r-- | sys/netinet/tcp_input.c | 22 | ||||
| -rw-r--r-- | sys/netinet/tcp_output.c | 14 | ||||
| -rw-r--r-- | sys/netinet/tcp_subr.c | 17 | ||||
| -rw-r--r-- | sys/netinet/udp_usrreq.c | 17 | ||||
| -rw-r--r-- | sys/netinet6/udp6_output.c | 7 | ||||
| -rw-r--r-- | sys/netipsec/ipsec_output.c | 8 | ||||
| -rw-r--r-- | sys/netiso/if_eon.c | 7 | ||||
| -rw-r--r-- | sys/netiso/tp_inet.c | 7 | ||||
| -rw-r--r-- | sys/netns/ns_ip.c | 7 |
21 files changed, 392 insertions, 87 deletions
diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c index d9d74272936..8b80ef22ac5 100644 --- a/sys/net/if_gre.c +++ b/sys/net/if_gre.c @@ -1,4 +1,4 @@ -/* $NetBSD: if_gre.c,v 1.45 2003/05/06 17:54:27 grant Exp $ */ +/* $NetBSD: if_gre.c,v 1.46 2003/08/15 03:42:00 jonathan Exp $ */ /* * Copyright (c) 1998 The NetBSD Foundation, Inc. @@ -46,7 +46,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: if_gre.c,v 1.45 2003/05/06 17:54:27 grant Exp $"); +__KERNEL_RCSID(0, "$NetBSD: if_gre.c,v 1.46 2003/08/15 03:42:00 jonathan Exp $"); #include "opt_inet.h" #include "opt_ns.h" @@ -336,7 +336,8 @@ gre_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst, ifp->if_opackets++; ifp->if_obytes += m->m_pkthdr.len; /* send it off */ - error = ip_output(m, NULL, &sc->route, 0, NULL); + error = ip_output(m, NULL, &sc->route, 0, + (struct ip_moptions *)0, (struct inpcb *)0); end: if (error) ifp->if_oerrors++; diff --git a/sys/net/if_stf.c b/sys/net/if_stf.c index 9a0f954eb48..095a55b34e6 100644 --- a/sys/net/if_stf.c +++ b/sys/net/if_stf.c @@ -1,4 +1,4 @@ -/* $NetBSD: if_stf.c,v 1.33 2003/05/01 07:52:59 itojun Exp $ */ +/* $NetBSD: if_stf.c,v 1.34 2003/08/15 03:42:00 jonathan Exp $ */ /* $KAME: if_stf.c,v 1.62 2001/06/07 22:32:16 itojun Exp $ */ /* @@ -75,7 +75,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: if_stf.c,v 1.33 2003/05/01 07:52:59 itojun Exp $"); +__KERNEL_RCSID(0, "$NetBSD: if_stf.c,v 1.34 2003/08/15 03:42:00 jonathan Exp $"); #include "opt_inet.h" @@ -465,7 +465,8 @@ stf_output(ifp, m, dst, rt) } ifp->if_opackets++; - return ip_output(m, NULL, &sc->sc_ro, 0, NULL); + return ip_output(m, NULL, &sc->sc_ro, 0, + (struct ip_moptions *)0, (struct inpcb *)0); } static int diff --git a/sys/net/pfkeyv2.h b/sys/net/pfkeyv2.h index b6a90aa37f1..69ea2061458 100644 --- a/sys/net/pfkeyv2.h +++ b/sys/net/pfkeyv2.h @@ -1,4 +1,4 @@ -/* $NetBSD: pfkeyv2.h,v 1.14 2003/07/25 10:00:49 itojun Exp $ */ +/* $NetBSD: pfkeyv2.h,v 1.15 2003/08/15 03:42:00 jonathan Exp $ */ /* $KAME: pfkeyv2.h,v 1.36 2003/07/25 09:33:37 itojun Exp $ */ /* @@ -317,7 +317,7 @@ struct sadb_x_ipsecrequest { #define SADB_EALG_DESCBC 2 #define SADB_EALG_3DESCBC 3 #define SADB_EALG_NULL 11 -#define SADB_EALG_MAX 249 +#define SADB_EALG_MAX 250 /* private allocations - based on RFC2407/IANA assignment */ #define SADB_X_EALG_CAST128CBC 6 #define SADB_X_EALG_BLOWFISHCBC 7 @@ -325,6 +325,7 @@ struct sadb_x_ipsecrequest { #define SADB_X_EALG_AES 12 /* private allocations should use 249-255 (RFC2407) */ #define SADB_X_EALG_AESCTR 249 /* draft-ietf-ipsec-ciph-aes-ctr-03 */ +#define SADB_X_EALG_SKIPJACK 250 /* private allocations - based on RFC2407/IANA assignment */ #define SADB_X_CALG_NONE 0 diff --git a/sys/netinet/igmp.c b/sys/netinet/igmp.c index 5787980fc99..d7196011ac8 100644 --- a/sys/netinet/igmp.c +++ b/sys/netinet/igmp.c @@ -1,4 +1,4 @@ -/* $NetBSD: igmp.c,v 1.34 2003/06/26 03:11:08 itojun Exp $ */ +/* $NetBSD: igmp.c,v 1.35 2003/08/15 03:42:01 jonathan Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -40,7 +40,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: igmp.c,v 1.34 2003/06/26 03:11:08 itojun Exp $"); +__KERNEL_RCSID(0, "$NetBSD: igmp.c,v 1.35 2003/08/15 03:42:01 jonathan Exp $"); #include "opt_mrouting.h" @@ -585,7 +585,7 @@ igmp_sendpkt(inm, type) #endif /* MROUTING */ ip_output(m, (struct mbuf *)0, (struct route *)0, IP_MULTICASTOPTS, - &imo); + &imo, (struct inpcb *)0); ++igmpstat.igps_snd_reports; } diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c index 2b5cc266e41..7a1772d71ed 100644 --- a/sys/netinet/in_pcb.c +++ b/sys/netinet/in_pcb.c @@ -1,4 +1,4 @@ -/* $NetBSD: in_pcb.c,v 1.86 2003/08/07 16:33:10 agc Exp $ */ +/* $NetBSD: in_pcb.c,v 1.87 2003/08/15 03:42:01 jonathan Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -98,7 +98,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: in_pcb.c,v 1.86 2003/08/07 16:33:10 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: in_pcb.c,v 1.87 2003/08/15 03:42:01 jonathan Exp $"); #include "opt_ipsec.h" @@ -128,6 +128,9 @@ __KERNEL_RCSID(0, "$NetBSD: in_pcb.c,v 1.86 2003/08/07 16:33:10 agc Exp $"); #ifdef IPSEC #include <netinet6/ipsec.h> #include <netkey/key.h> +#elif FAST_IPSEC +#include <netipsec/ipsec.h> +#include <netipsec/key.h> #endif /* IPSEC */ struct in_addr zeroin_addr; @@ -181,7 +184,7 @@ in_pcballoc(so, v) struct inpcbtable *table = v; struct inpcb *inp; int s; -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) int error; #endif @@ -192,7 +195,7 @@ in_pcballoc(so, v) inp->inp_table = table; inp->inp_socket = so; inp->inp_errormtu = -1; -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) error = ipsec_init_pcbpolicy(so, &inp->inp_sp); if (error != 0) { pool_put(&inpcb_pool, inp); @@ -446,7 +449,7 @@ in_pcbconnect(v, nam) inp->inp_faddr = sin->sin_addr; inp->inp_fport = sin->sin_port; in_pcbstate(inp, INP_CONNECTED); -#ifdef IPSEC +#if defined(IPSEC) /*|| defined(FAST_IPSEC)*/ /*XXX*/ if (inp->inp_socket->so_type == SOCK_STREAM) ipsec_pcbconn(inp->inp_sp); #endif @@ -464,7 +467,7 @@ in_pcbdisconnect(v) in_pcbstate(inp, INP_BOUND); if (inp->inp_socket->so_state & SS_NOFDREF) in_pcbdetach(inp); -#ifdef IPSEC +#if defined(IPSEC) /*|| defined(FAST_IPSEC)*/ /*XXX*/ ipsec_pcbdisconn(inp->inp_sp); #endif } @@ -477,7 +480,7 @@ in_pcbdetach(v) struct socket *so = inp->inp_socket; int s; -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) ipsec4_delete_pcbpolicy(inp); #endif /*IPSEC*/ so->so_pcb = 0; diff --git a/sys/netinet/in_proto.c b/sys/netinet/in_proto.c index 4daeffa751e..23fea42d315 100644 --- a/sys/netinet/in_proto.c +++ b/sys/netinet/in_proto.c @@ -1,4 +1,4 @@ -/* $NetBSD: in_proto.c,v 1.60 2003/08/14 07:57:40 itojun Exp $ */ +/* $NetBSD: in_proto.c,v 1.61 2003/08/15 03:42:01 jonathan Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -61,7 +61,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: in_proto.c,v 1.60 2003/08/14 07:57:40 itojun Exp $"); +__KERNEL_RCSID(0, "$NetBSD: in_proto.c,v 1.61 2003/08/15 03:42:01 jonathan Exp $"); #include "opt_mrouting.h" #include "opt_eon.h" /* ISO CLNL over IP */ @@ -118,6 +118,11 @@ __KERNEL_RCSID(0, "$NetBSD: in_proto.c,v 1.60 2003/08/14 07:57:40 itojun Exp $") #include <netinet6/ipcomp.h> #endif /* IPSEC */ +#ifdef FAST_IPSEC +#include <netipsec/ipsec.h> +#include <netipsec/key.h> +#endif /* FAST_IPSEC */ + #ifdef NSIP #include <netns/ns_var.h> #include <netns/idp_var.h> @@ -173,17 +178,36 @@ struct protosw inetsw[] = { }, #ifdef IPSEC_ESP { SOCK_RAW, &inetdomain, IPPROTO_ESP, PR_ATOMIC|PR_ADDR, - esp4_input, 0, esp4_ctlinput, 0, + esp4_input, + 0, esp4_ctlinput, 0, 0, 0, 0, 0, 0, ipsec_sysctl }, #endif { SOCK_RAW, &inetdomain, IPPROTO_IPCOMP, PR_ATOMIC|PR_ADDR, - ipcomp4_input, 0, 0, 0, + ipcomp4_input, + 0, 0, 0, 0, 0, 0, 0, 0, ipsec_sysctl }, #endif /* IPSEC */ +#ifdef FAST_IPSEC +{ SOCK_RAW, &inetdomain, IPPROTO_AH, PR_ATOMIC|PR_ADDR, + ipsec4_common_input, 0, ah4_ctlinput, 0, + 0, + 0, 0, 0, 0, ipsec_sysctl +}, +{ SOCK_RAW, &inetdomain, IPPROTO_ESP, PR_ATOMIC|PR_ADDR, + ipsec4_common_input, 0, esp4_ctlinput, 0, + 0, + 0, 0, 0, 0, ipsec_sysctl +}, +{ SOCK_RAW, &inetdomain, IPPROTO_IPCOMP, PR_ATOMIC|PR_ADDR, + ipsec4_common_input, 0, 0, 0, + 0, + 0, 0, 0, 0, ipsec_sysctl +}, +#endif /* FAST_IPSEC */ { SOCK_RAW, &inetdomain, IPPROTO_IPV4, PR_ATOMIC|PR_ADDR|PR_LASTHDR, encap4_input, rip_output, rip_ctlinput, rip_ctloutput, rip_usrreq, /*XXX*/ diff --git a/sys/netinet/ip_auth.c b/sys/netinet/ip_auth.c index e8eed541dd3..f192bd882ca 100644 --- a/sys/netinet/ip_auth.c +++ b/sys/netinet/ip_auth.c @@ -1,4 +1,4 @@ -/* $NetBSD: ip_auth.c,v 1.30 2002/09/19 08:12:45 martti Exp $ */ +/* $NetBSD: ip_auth.c,v 1.31 2003/08/15 03:42:02 jonathan Exp $ */ /* * Copyright (C) 1998-2001 by Darren Reed & Guido van Rooij. @@ -108,7 +108,7 @@ extern struct ifqueue ipintrq; /* ip packet input queue */ #if !defined(lint) #if defined(__NetBSD__) #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ip_auth.c,v 1.30 2002/09/19 08:12:45 martti Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ip_auth.c,v 1.31 2003/08/15 03:42:02 jonathan Exp $"); #else static const char rcsid[] = "@(#)Id: ip_auth.c,v 2.11.2.20 2002/06/04 14:40:42 darrenr Exp"; #endif @@ -464,7 +464,8 @@ fr_authioctlloop: error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL, NULL); # else - error = ip_output(m, NULL, &ro, IP_FORWARDING, NULL); + error = ip_output(m, NULL, &ro, IP_FORWARDING, + (struct ip_moptions *)0, (struct inpcb *)0); # endif if (ro.ro_rt) { RTFREE(ro.ro_rt); diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c index 94574cef6f0..5307b310140 100644 --- a/sys/netinet/ip_icmp.c +++ b/sys/netinet/ip_icmp.c @@ -1,4 +1,4 @@ -/* $NetBSD: ip_icmp.c,v 1.75 2003/08/07 16:33:12 agc Exp $ */ +/* $NetBSD: ip_icmp.c,v 1.76 2003/08/15 03:42:02 jonathan Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -101,7 +101,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.75 2003/08/07 16:33:12 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.76 2003/08/15 03:42:02 jonathan Exp $"); #include "opt_ipsec.h" @@ -133,6 +133,11 @@ __KERNEL_RCSID(0, "$NetBSD: ip_icmp.c,v 1.75 2003/08/07 16:33:12 agc Exp $"); #include <netkey/key.h> #endif +#ifdef FAST_IPSEC +#include <netipsec/ipsec.h> +#include <netipsec/key.h> +#endif /* FAST_IPSEC*/ + #include <machine/stdarg.h> /* @@ -603,7 +608,7 @@ reflect: rtfree(rt); pfctlinput(PRC_REDIRECT_HOST, sintosa(&icmpsrc)); -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) key_sa_routechange((struct sockaddr *)&icmpsrc); #endif break; @@ -872,7 +877,8 @@ icmp_send(m, opts) /* Don't lookup socket */ (void)ipsec_setsocket(m, NULL); #endif - (void) ip_output(m, opts, NULL, 0, NULL); + (void) ip_output(m, opts, NULL, 0, + (struct ip_moptions *)0, (struct inpcb *)0); } n_time diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index 73f6ec69b4f..7835c52a847 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -1,4 +1,4 @@ -/* $NetBSD: ip_input.c,v 1.172 2003/08/07 16:33:12 agc Exp $ */ +/* $NetBSD: ip_input.c,v 1.173 2003/08/15 03:42:02 jonathan Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -98,7 +98,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.172 2003/08/07 16:33:12 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.173 2003/08/15 03:42:02 jonathan Exp $"); #include "opt_gateway.h" #include "opt_pfil_hooks.h" @@ -147,6 +147,10 @@ __KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.172 2003/08/07 16:33:12 agc Exp $"); #include <netinet6/ipsec.h> #include <netkey/key.h> #endif +#ifdef FAST_IPSEC +#include <netipsec/ipsec.h> +#include <netipsec/key.h> +#endif /* FAST_IPSEC*/ #ifndef IPFORWARDING #ifdef GATEWAY @@ -429,6 +433,12 @@ ip_input(struct mbuf *m) int downmatch; int checkif; int srcrt = 0; +#ifdef FAST_IPSEC + struct m_tag *mtag; + struct tdb_ident *tdbi; + struct secpolicy *sp; + int s, error; +#endif /* FAST_IPSEC */ MCLAIM(m, &ip_rx_mowner); #ifdef DIAGNOSTIC @@ -762,6 +772,34 @@ ip_input(struct mbuf *m) goto bad; } #endif +#ifdef FAST_IPSEC + mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); + s = splsoftnet(); + if (mtag != NULL) { + tdbi = (struct tdb_ident *)(mtag + 1); + sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND); + } else { + sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, + IP_FORWARDING, &error); + } + if (sp == NULL) { /* NB: can happen if error */ + splx(s); + /*XXX error stat???*/ + DPRINTF(("ip_input: no SP for forwarding\n")); /*XXX*/ + goto bad; + } + + /* + * Check security policy against packet attributes. + */ + error = ipsec_in_reject(sp, m); + KEY_FREESP(&sp); + splx(s); + if (error) { + ipstat.ips_cantforward++; + goto bad; + } +#endif /* FAST_IPSEC */ ip_forward(m, srcrt); } @@ -850,7 +888,7 @@ found: IPQ_UNLOCK(); } -#ifdef IPSEC +#if defined(IPSEC) /* * enforce IPsec policy checking if we are seeing last header. * note that we do not visit this with protocols with pcb layer @@ -862,6 +900,45 @@ found: goto bad; } #endif +#if FAST_IPSEC + /* + * enforce IPsec policy checking if we are seeing last header. + * note that we do not visit this with protocols with pcb layer + * code - like udp/tcp/raw ip. + */ + if ((inetsw[ip_protox[ip->ip_p]].pr_flags & PR_LASTHDR) != 0) { + /* + * Check if the packet has already had IPsec processing + * done. If so, then just pass it along. This tag gets + * set during AH, ESP, etc. input handling, before the + * packet is returned to the ip input queue for delivery. + */ + mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); + s = splsoftnet(); + if (mtag != NULL) { + tdbi = (struct tdb_ident *)(mtag + 1); + sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND); + } else { + sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, + IP_FORWARDING, &error); + } + if (sp != NULL) { + /* + * Check security policy against packet attributes. + */ + error = ipsec_in_reject(sp, m); + KEY_FREESP(&sp); + } else { + /* XXX error stat??? */ + error = EINVAL; +DPRINTF(("ip_input: no SP, packet discarded\n"));/*XXX*/ + goto bad; + } + splx(s); + if (error) + goto bad; + } +#endif /* FAST_IPSEC */ /* * Switch out to protocol's input routine. @@ -1566,7 +1643,7 @@ ip_forward(m, srcrt) struct mbuf *mcopy; n_long dest; struct ifnet *destifp; -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) struct ifnet dummyifp; #endif @@ -1664,7 +1741,9 @@ ip_forward(m, srcrt) (void)ipsec_setsocket(m, NULL); #endif error = ip_output(m, (struct mbuf *)0, &ipforward_rt, - (IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)), 0); + (IP_FORWARDING | (ip_directedbcast ? IP_ALLOWBROADCAST : 0)), + (struct ip_moptions *)0, (struct inpcb *)0); + if (error) ipstat.ips_cantforward++; else { @@ -1704,7 +1783,7 @@ ip_forward(m, srcrt) case EMSGSIZE: type = ICMP_UNREACH; code = ICMP_UNREACH_NEEDFRAG; -#ifndef IPSEC +#if !defined(IPSEC) && !defined(FAST_IPSEC) if (ipforward_rt.ro_rt) destifp = ipforward_rt.ro_rt->rt_ifp; #else @@ -1755,7 +1834,11 @@ ip_forward(m, srcrt) } } +#ifdef IPSEC key_freesp(sp); +#else + KEY_FREESP(&sp); +#endif } } #endif /*IPSEC*/ diff --git a/sys/netinet/ip_mroute.c b/sys/netinet/ip_mroute.c index 6918501d282..1d6ff195032 100644 --- a/sys/netinet/ip_mroute.c +++ b/sys/netinet/ip_mroute.c @@ -1,4 +1,4 @@ -/* $NetBSD: ip_mroute.c,v 1.76 2003/08/07 16:33:13 agc Exp $ */ +/* $NetBSD: ip_mroute.c,v 1.77 2003/08/15 03:42:03 jonathan Exp $ */ /* * Copyright (c) 1992, 1993 @@ -86,7 +86,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.76 2003/08/07 16:33:13 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.77 2003/08/15 03:42:03 jonathan Exp $"); #include "opt_ipsec.h" @@ -122,6 +122,11 @@ __KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.76 2003/08/07 16:33:13 agc Exp $"); #include <netkey/key.h> #endif +#ifdef FAST_IPSEC +#include <netipsec/ipsec.h> +#include <netipsec/key.h> +#endif + #include <machine/stdarg.h> #define IP_MULTICASTOPTS 0 @@ -1847,7 +1852,7 @@ tbf_send_packet(vifp, m) (void)ipsec_setsocket(m, NULL); #endif ip_output(m, (struct mbuf *)0, &vifp->v_route, - IP_FORWARDING, (struct ip_moptions *)0); + IP_FORWARDING, (struct ip_moptions *)0, (struct inpcb *)0); } else { /* if physical interface option, extract the options and then send */ struct ip_moptions imo; @@ -1864,7 +1869,7 @@ tbf_send_packet(vifp, m) (void)ipsec_setsocket(m, NULL); #endif error = ip_output(m, (struct mbuf *)0, (struct route *)0, - IP_FORWARDING|IP_MULTICASTOPTS, &imo); + IP_FORWARDING|IP_MULTICASTOPTS, &imo, (struct inpcb *)0); if (mrtdebug & DEBUG_XMIT) log(LOG_DEBUG, "phyint_send on vif %ld err %d\n", diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index a5d9b0a86f5..a6cee268812 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -1,4 +1,4 @@ -/* $NetBSD: ip_output.c,v 1.108 2003/08/07 16:33:14 agc Exp $ */ +/* $NetBSD: ip_output.c,v 1.109 2003/08/15 03:42:03 jonathan Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -98,7 +98,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.108 2003/08/07 16:33:14 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.109 2003/08/15 03:42:03 jonathan Exp $"); #include "opt_pfil_hooks.h" #include "opt_ipsec.h" @@ -137,6 +137,12 @@ __KERNEL_RCSID(0, "$NetBSD: ip_output.c,v 1.108 2003/08/07 16:33:14 agc Exp $"); #include <netkey/key_debug.h> #endif /*IPSEC*/ +#ifdef FAST_IPSEC +#include <netipsec/ipsec.h> +#include <netipsec/key.h> +#include <netipsec/xform.h> +#endif /* FAST_IPSEC*/ + static struct mbuf *ip_insertoptions __P((struct mbuf *, struct mbuf *, int *)); static struct ifnet *ip_multicast_if __P((struct in_addr *, int *)); static void ip_mloopback @@ -175,11 +181,18 @@ ip_output(m0, va_alist) int *mtu_p; u_long mtu; struct ip_moptions *imo; + struct inpcb *inp; va_list ap; #ifdef IPSEC struct socket *so; struct secpolicy *sp = NULL; #endif /*IPSEC*/ +#ifdef FAST_IPSEC + struct m_tag *mtag; + struct secpolicy *sp = NULL; + struct tdb_ident *tdbi; + int s; +#endif u_int16_t ip_len; len = 0; @@ -188,6 +201,7 @@ ip_output(m0, va_alist) ro = va_arg(ap, struct route *); flags = va_arg(ap, int); imo = va_arg(ap, struct ip_moptions *); + inp = va_arg(ap, struct inpcb *); if (flags & IP_RETURNMTU) mtu_p = va_arg(ap, int *); else @@ -195,7 +209,7 @@ ip_output(m0, va_alist) va_end(ap); MCLAIM(m, &ip_tx_mowner); -#ifdef IPSEC +#ifdef IPSEC /* XXX so = ((inp == NULL) ? NULL : inp->inp_socket; */ so = ipsec_getsocket(m); (void)ipsec_setsocket(m, NULL); #endif /*IPSEC*/ @@ -573,6 +587,132 @@ sendit: skip_ipsec: #endif /*IPSEC*/ +#ifdef FAST_IPSEC + /* + * Check the security policy (SP) for the packet and, if + * required, do IPsec-related processing. There are two + * cases here; the first time a packet is sent through + * it will be untagged and handled by ipsec4_checkpolicy. + * If the packet is resubmitted to ip_output (e.g. after + * AH, ESP, etc. processing), there will be a tag to bypass + * the lookup and related policy checking. + */ + mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL); + s = splsoftnet(); + if (mtag != NULL) { + tdbi = (struct tdb_ident *)(mtag + 1); + sp = ipsec_getpolicy(tdbi, IPSEC_DIR_OUTBOUND); + if (sp == NULL) + error = -EINVAL; /* force silent drop */ + m_tag_delete(m, mtag); + } else { + sp = ipsec4_checkpolicy(m, IPSEC_DIR_OUTBOUND, flags, + &error, inp); + } + /* + * There are four return cases: + * sp != NULL apply IPsec policy + * sp == NULL, error == 0 no IPsec handling needed + * sp == NULL, error == -EINVAL discard packet w/o error + * sp == NULL, error != 0 discard packet, report error + */ + if (sp != NULL) { + /* Loop detection, check if ipsec processing already done */ + IPSEC_ASSERT(sp->req != NULL, ("ip_output: no ipsec request")); + for (mtag = m_tag_first(m); mtag != NULL; + mtag = m_tag_next(m, mtag)) { +#ifdef MTAG_ABI_COMPAT + if (mtag->m_tag_cookie != MTAG_ABI_COMPAT) + continue; +#endif + if (mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_DONE && + mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED) + continue; + /* + * Check if policy has an SA associated with it. + * This can happen when an SP has yet to acquire + * an SA; e.g. on first reference. If it occurs, + * then we let ipsec4_process_packet do its thing. + */ + if (sp->req->sav == NULL) + break; + tdbi = (struct tdb_ident *)(mtag + 1); + if (tdbi->spi == sp->req->sav->spi && + tdbi->proto == sp->req->sav->sah->saidx.proto && + bcmp(&tdbi->dst, &sp->req->sav->sah->saidx.dst, + sizeof (union sockaddr_union)) == 0) { + /* + * No IPsec processing is needed, free + * reference to SP. + * + * NB: null pointer to avoid free at + * done: below. + */ + KEY_FREESP(&sp), sp = NULL; + splx(s); + goto spd_done; + } + } + + /* + * Do delayed checksums now because we send before + * this is done in the normal processing path. + */ + if (m->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { + in_delayed_cksum(m); + m->m_pkthdr.csum_flags &= ~(M_CSUM_TCPv4|M_CSUM_UDPv4); + } + +#ifdef __FreeBSD__ + ip->ip_len = htons(ip->ip_len); + ip->ip_off = htons(ip->ip_off); +#endif + + /* NB: callee frees mbuf */ + error = ipsec4_process_packet(m, sp->req, flags, 0); + /* + * Preserve KAME behaviour: ENOENT can be returned + * when an SA acquire is in progress. Don't propagate + * this to user-level; it confuses applications. + * + * XXX this will go away when the SADB is redone. + */ + if (error == ENOENT) + error = 0; + splx(s); + goto done; + } else { + splx(s); + + if (error != 0) { + /* + * Hack: -EINVAL is used to signal that a packet + * should be silently discarded. This is typically + * because we asked key management for an SA and + * it was delayed (e.g. kicked up to IKE). + */ + if (error == -EINVAL) + error = 0; + goto bad; + } else { + /* No IPsec processing for this packet. */ + } +#ifdef notyet + /* + * If deferred crypto processing is needed, check that + * the interface supports it. + */ + mtag = m_tag_find(m, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL); + if (mtag != NULL && (ifp->if_capenable & IFCAP_IPSEC) == 0) { + /* notify IPsec to do its own crypto */ + ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1)); + error = EHOSTUNREACH; + goto bad; + } +#endif + } +spd_done: +#endif /* FAST_IPSEC */ #ifdef PFIL_HOOKS /* @@ -787,6 +927,10 @@ done: key_freesp(sp); } #endif /* IPSEC */ +#ifdef FAST_IPSEC + if (sp != NULL) + KEY_FREESP(&sp); +#endif /* FAST_IPSEC */ return (error); bad: @@ -947,7 +1091,7 @@ ip_ctloutput(op, so, level, optname, mp) struct mbuf *m = *mp; int optval = 0; int error = 0; -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) #ifdef __NetBSD__ struct proc *p = curproc; /*XXX*/ #endif @@ -1046,7 +1190,7 @@ ip_ctloutput(op, so, level, optname, mp) } break; -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) case IP_IPSEC_POLICY: { caddr_t req = NULL; @@ -1137,7 +1281,7 @@ ip_ctloutput(op, so, level, optname, mp) *mtod(m, int *) = optval; break; -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) case IP_IPSEC_POLICY: { caddr_t req = NULL; diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c index db14416f259..83105eabcfe 100644 --- a/sys/netinet/raw_ip.c +++ b/sys/netinet/raw_ip.c @@ -1,4 +1,4 @@ -/* $NetBSD: raw_ip.c,v 1.71 2003/08/07 16:33:14 agc Exp $ */ +/* $NetBSD: raw_ip.c,v 1.72 2003/08/15 03:42:03 jonathan Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -61,7 +61,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.71 2003/08/07 16:33:14 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.72 2003/08/15 03:42:03 jonathan Exp $"); #include "opt_ipsec.h" #include "opt_mrouting.h" @@ -94,6 +94,10 @@ __KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.71 2003/08/07 16:33:14 agc Exp $"); #include <netinet6/ipsec.h> #endif /*IPSEC*/ +#ifdef FAST_IPSEC +#include <netipsec/ipsec.h> +#endif /* FAST_IPSEC*/ + struct inpcbtable rawcbtable; int rip_pcbnotify __P((struct inpcbtable *, struct in_addr, @@ -175,7 +179,7 @@ rip_input(m, va_alist) if (last) { struct mbuf *n; -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) /* check AH/ESP integrity. */ if (ipsec4_in_reject_so(m, last->inp_socket)) { ipsecstat.in_polvio++; @@ -199,7 +203,7 @@ rip_input(m, va_alist) } last = inp; } -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) /* check AH/ESP integrity. */ if (last && ipsec4_in_reject_so(m, last->inp_socket)) { m_freem(m); @@ -382,7 +386,7 @@ rip_output(m, va_alist) } #endif /*IPSEC*/ return (ip_output(m, opts, &inp->inp_route, flags, inp->inp_moptions, - &inp->inp_errormtu)); + inp, &inp->inp_errormtu)); } /* diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c index af66ab3c883..db782a8ae21 100644 --- a/sys/netinet/tcp_input.c +++ b/sys/netinet/tcp_input.c @@ -1,4 +1,4 @@ -/* $NetBSD: tcp_input.c,v 1.174 2003/08/07 16:33:15 agc Exp $ */ +/* $NetBSD: tcp_input.c,v 1.175 2003/08/15 03:42:04 jonathan Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -148,7 +148,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.174 2003/08/07 16:33:15 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.175 2003/08/15 03:42:04 jonathan Exp $"); #include "opt_inet.h" #include "opt_ipsec.h" @@ -216,7 +216,13 @@ __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.174 2003/08/07 16:33:15 agc Exp $"); #if defined(NFAITH) && NFAITH > 0 #include <net/if_faith.h> #endif -#endif +#endif /* IPSEC */ + +#ifdef FAST_IPSEC +#include <netipsec/ipsec.h> +#include <netipsec/key.h> +#endif /* FAST_IPSEC*/ + int tcprexmtthresh = 3; int tcp_log_refused; @@ -1005,7 +1011,7 @@ findpcb: TCP_FIELDS_TO_HOST(th); goto dropwithreset_ratelim; } -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) if (inp && ipsec4_in_reject(m, inp)) { ipsecstat.in_polvio++; goto drop; @@ -1045,7 +1051,7 @@ findpcb: TCP_FIELDS_TO_HOST(th); goto dropwithreset_ratelim; } -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) if (ipsec6_in_reject(m, in6p)) { ipsec6stat.in_polvio++; goto drop; @@ -3210,7 +3216,7 @@ syn_cache_get(src, dst, th, hlen, tlen, so, m) } #endif -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) /* * we make a copy of policy, instead of sharing the policy, * for better behavior in terms of SA lookup and dead SA removal. @@ -3798,8 +3804,8 @@ syn_cache_respond(sc, m) #ifdef INET case AF_INET: error = ip_output(m, sc->sc_ipopts, ro, - (ip_mtudisc ? IP_MTUDISC : 0), - NULL); + (ip_mtudisc ? IP_MTUDISC : 0), + (struct ip_moptions *)0, (struct inpcb *)0); break; #endif #ifdef INET6 diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c index a44e3e3d1de..7dab7ebb013 100644 --- a/sys/netinet/tcp_output.c +++ b/sys/netinet/tcp_output.c @@ -1,4 +1,4 @@ -/* $NetBSD: tcp_output.c,v 1.97 2003/08/07 16:33:17 agc Exp $ */ +/* $NetBSD: tcp_output.c,v 1.98 2003/08/15 03:42:04 jonathan Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -138,7 +138,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.97 2003/08/07 16:33:17 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.98 2003/08/15 03:42:04 jonathan Exp $"); #include "opt_inet.h" #include "opt_ipsec.h" @@ -175,6 +175,9 @@ __KERNEL_RCSID(0, "$NetBSD: tcp_output.c,v 1.97 2003/08/07 16:33:17 agc Exp $"); #include <netinet6/nd6.h> #endif +#ifdef FAST_IPSEC +#include <netipsec/ipsec.h> +#endif /* FAST_IPSEC*/ #ifdef IPSEC #include <netinet6/ipsec.h> #endif @@ -322,7 +325,7 @@ tcp_segsize(struct tcpcb *tp, int *txsegsizep, int *rxsegsizep) */ #ifdef INET if (inp) { -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) optlen += ipsec4_hdrsiz_tcp(tp); #endif optlen += ip_optlen(inp); @@ -331,7 +334,7 @@ tcp_segsize(struct tcpcb *tp, int *txsegsizep, int *rxsegsizep) #ifdef INET6 #ifdef INET if (in6p && tp->t_family == AF_INET) { -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) optlen += ipsec4_hdrsiz_tcp(tp); #endif /* XXX size -= ip_optlen(in6p); */ @@ -1169,7 +1172,8 @@ send: error = ip_output(m, opts, ro, (tp->t_mtudisc ? IP_MTUDISC : 0) | (so->so_options & SO_DONTROUTE), - 0); + (struct ip_moptions *)0, + (tp == NULL ? (struct inpcb *)0 : tp->t_inpcb)); break; } #endif diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index edcfd87f829..55650336f85 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -1,4 +1,4 @@ -/* $NetBSD: tcp_subr.c,v 1.145 2003/08/07 16:33:18 agc Exp $ */ +/* $NetBSD: tcp_subr.c,v 1.146 2003/08/15 03:42:05 jonathan Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -98,7 +98,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: tcp_subr.c,v 1.145 2003/08/07 16:33:18 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: tcp_subr.c,v 1.146 2003/08/15 03:42:05 jonathan Exp $"); #include "opt_inet.h" #include "opt_ipsec.h" @@ -157,6 +157,14 @@ __KERNEL_RCSID(0, "$NetBSD: tcp_subr.c,v 1.145 2003/08/07 16:33:18 agc Exp $"); #include <netinet6/ipsec.h> #endif /*IPSEC*/ +#ifdef FAST_IPSEC +#include <netipsec/ipsec.h> +#ifdef INET6 +#include <netipsec/ipsec6.h> +#endif +#endif /* FAST_IPSEC*/ + + #ifdef INET6 struct in6pcb tcb6; #endif @@ -865,7 +873,8 @@ tcp_respond(tp, template, m, th0, ack, seq, flags) case AF_INET: error = ip_output(m, NULL, ro, (tp && tp->t_mtudisc ? IP_MTUDISC : 0), - NULL); + (struct ip_moptions *)0, + (tp == NULL ? (struct inpcb *)0 : tp->t_inpcb)); break; #endif #ifdef INET6 @@ -2134,7 +2143,7 @@ tcp_new_iss1(void *laddr, void *faddr, u_int16_t lport, u_int16_t fport, return (tcp_iss); } -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) /* compute ESP/AH header size for TCP, including outer IP header. */ size_t ipsec4_hdrsiz_tcp(tp) diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c index f737cc8a725..144656ba936 100644 --- a/sys/netinet/udp_usrreq.c +++ b/sys/netinet/udp_usrreq.c @@ -1,4 +1,4 @@ -/* $NetBSD: udp_usrreq.c,v 1.104 2003/08/07 16:33:20 agc Exp $ */ +/* $NetBSD: udp_usrreq.c,v 1.105 2003/08/15 03:42:05 jonathan Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -61,7 +61,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.104 2003/08/07 16:33:20 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.105 2003/08/15 03:42:05 jonathan Exp $"); #include "opt_inet.h" #include "opt_ipsec.h" @@ -115,6 +115,13 @@ __KERNEL_RCSID(0, "$NetBSD: udp_usrreq.c,v 1.104 2003/08/07 16:33:20 agc Exp $") #include <machine/stdarg.h> +#ifdef FAST_IPSEC +#include <netipsec/ipsec.h> +#ifdef INET6 +#include <netipsec/ipsec6.h> +#endif +#endif /* FAST_IPSEC*/ + #ifdef IPSEC #include <netinet6/ipsec.h> #include <netkey/key.h> @@ -486,7 +493,7 @@ udp4_sendup(m, off, src, so) return; } -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) /* check AH/ESP integrity. */ if (so != NULL && ipsec4_in_reject_so(m, so)) { ipsecstat.in_polvio++; @@ -532,7 +539,7 @@ udp6_sendup(m, off, src, so) return; in6p = sotoin6pcb(so); -#ifdef IPSEC +#if defined(IPSEC) || defined(FAST_IPSEC) /* check AH/ESP integrity. */ if (so != NULL && ipsec6_in_reject_so(m, so)) { ipsec6stat.in_polvio++; @@ -903,7 +910,7 @@ udp_output(m, va_alist) return (ip_output(m, inp->inp_options, &inp->inp_route, inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST), - inp->inp_moptions)); + inp->inp_moptions, inp)); release: m_freem(m); diff --git a/sys/netinet6/udp6_output.c b/sys/netinet6/udp6_output.c index 4760c021ff7..39a9f6a5869 100644 --- a/sys/netinet6/udp6_output.c +++ b/sys/netinet6/udp6_output.c @@ -1,4 +1,4 @@ -/* $NetBSD: udp6_output.c,v 1.11 2003/08/07 16:33:30 agc Exp $ */ +/* $NetBSD: udp6_output.c,v 1.12 2003/08/15 03:42:06 jonathan Exp $ */ /* $KAME: udp6_output.c,v 1.43 2001/10/15 09:19:52 itojun Exp $ */ /* @@ -62,7 +62,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: udp6_output.c,v 1.11 2003/08/07 16:33:30 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: udp6_output.c,v 1.12 2003/08/15 03:42:06 jonathan Exp $"); #include "opt_ipsec.h" #include "opt_inet.h" @@ -386,7 +386,8 @@ udp6_output(in6p, m, addr6, control, p) #ifdef IPSEC (void)ipsec_setsocket(m, NULL); /* XXX */ #endif /* IPSEC */ - error = ip_output(m, NULL, &in6p->in6p_route, flags /* XXX */); + error = ip_output(m, NULL, &in6p->in6p_route, flags /* XXX */, + (struct ip_moptions *)0, (struct inpcb *)0); break; #else error = EAFNOSUPPORT; diff --git a/sys/netipsec/ipsec_output.c b/sys/netipsec/ipsec_output.c index 5a9b5fd1a67..5a5d0b31e5c 100644 --- a/sys/netipsec/ipsec_output.c +++ b/sys/netipsec/ipsec_output.c @@ -1,9 +1,9 @@ -/* $NetBSD: ipsec_output.c,v 1.1 2003/08/13 20:06:51 jonathan Exp $ */ +/* $NetBSD: ipsec_output.c,v 1.2 2003/08/15 03:42:07 jonathan Exp $ */ /* $FreeBSD: src/sys/netipsec/ipsec_output.c,v 1.3.2.1 2003/01/24 05:11:35 sam Exp $ */ /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ipsec_output.c,v 1.1 2003/08/13 20:06:51 jonathan Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ipsec_output.c,v 1.2 2003/08/15 03:42:07 jonathan Exp $"); /* * IPsec output processing. @@ -151,7 +151,9 @@ ipsec_process_done(struct mbuf *m, struct ipsecrequest *isr) ip->ip_len = ntohs(ip->ip_len); ip->ip_off = ntohs(ip->ip_off); #endif /* __FreeBSD_ */ - return ip_output(m, NULL, NULL, IP_RAWOUTPUT, NULL, NULL); + return ip_output(m, NULL, NULL, IP_RAWOUTPUT, + (struct ip_moptions *)0, (struct inpcb*)0); + #endif /* INET */ #ifdef INET6 case AF_INET6: diff --git a/sys/netiso/if_eon.c b/sys/netiso/if_eon.c index 6aec0de5f79..1bd58be4c73 100644 --- a/sys/netiso/if_eon.c +++ b/sys/netiso/if_eon.c @@ -1,4 +1,4 @@ -/* $NetBSD: if_eon.c,v 1.39 2003/08/07 16:33:35 agc Exp $ */ +/* $NetBSD: if_eon.c,v 1.40 2003/08/15 03:42:06 jonathan Exp $ */ /*- * Copyright (c) 1991, 1993 @@ -67,7 +67,7 @@ SOFTWARE. */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: if_eon.c,v 1.39 2003/08/07 16:33:35 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: if_eon.c,v 1.40 2003/08/15 03:42:06 jonathan Exp $"); #include "opt_eon.h" @@ -447,7 +447,8 @@ send: } #endif - error = ip_output(m, (struct mbuf *) 0, ro, 0, NULL); + error = ip_output(m, (struct mbuf *) 0, ro, 0, + (struct ip_moptions *)0, (struct inpcb *)0); m = 0; if (error) { ifp->if_oerrors++; diff --git a/sys/netiso/tp_inet.c b/sys/netiso/tp_inet.c index 6ea1207e6b0..c8b82ee3aee 100644 --- a/sys/netiso/tp_inet.c +++ b/sys/netiso/tp_inet.c @@ -1,4 +1,4 @@ -/* $NetBSD: tp_inet.c,v 1.24 2003/08/11 15:17:30 itojun Exp $ */ +/* $NetBSD: tp_inet.c,v 1.25 2003/08/15 03:42:06 jonathan Exp $ */ /*- * Copyright (c) 1991, 1993 @@ -73,7 +73,7 @@ SOFTWARE. */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: tp_inet.c,v 1.24 2003/08/11 15:17:30 itojun Exp $"); +__KERNEL_RCSID(0, "$NetBSD: tp_inet.c,v 1.25 2003/08/15 03:42:06 jonathan Exp $"); #include "opt_inet.h" #include "opt_iso.h" @@ -485,7 +485,8 @@ tpip_output_dg(m0, va_alist) } #endif - error = ip_output(m, (struct mbuf *) 0, ro, IP_ALLOWBROADCAST, NULL); + error = ip_output(m, (struct mbuf *) 0, ro, IP_ALLOWBROADCAST, + (struct ip_moptions *)0, (struct inpcb *)0); #ifdef ARGO_DEBUG if (argo_debug[D_EMIT]) { diff --git a/sys/netns/ns_ip.c b/sys/netns/ns_ip.c index 5d10482d0e0..aabb647d898 100644 --- a/sys/netns/ns_ip.c +++ b/sys/netns/ns_ip.c @@ -1,4 +1,4 @@ -/* $NetBSD: ns_ip.c,v 1.33 2003/08/07 16:33:46 agc Exp $ */ +/* $NetBSD: ns_ip.c,v 1.34 2003/08/15 03:42:07 jonathan Exp $ */ /* * Copyright (c) 1984, 1985, 1986, 1987, 1993 @@ -36,7 +36,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ns_ip.c,v 1.33 2003/08/07 16:33:46 agc Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ns_ip.c,v 1.34 2003/08/15 03:42:07 jonathan Exp $"); #include "opt_ns.h" /* options NSIP, needed by ns_if.h */ @@ -329,7 +329,8 @@ nsipoutput(ifp, m, dst, rt) /* * Output final datagram. */ - error = ip_output(m, (struct mbuf *)0, ro, SO_BROADCAST, NULL); + error = ip_output(m, (struct mbuf *)0, ro, SO_BROADCAST, + (struct ip_moptions *)0, (struct inpcb *)0); if (error) { ifn->ifen_ifnet.if_oerrors++; ifn->ifen_ifnet.if_ierrors = error; |
