xnu-792.tar.gz

[apple/xnu.git] / bsd / netinet6 / in6_gif.c

diff --git a/bsd/netinet6/in6_gif.c b/bsd/netinet6/in6_gif.c
index 8d963768c3c94e548b18357b0cd3dae4a94c9a65..5c1138d0a34ff8e419e68f943d50d9dbf16e7395 100644 (file)
--- a/bsd/netinet6/in6_gif.c
+++ b/bsd/netinet6/in6_gif.c
@@ -68,11 +68,11 @@
 #include <net/net_osdep.h>
 
 int
-in6_gif_output(ifp, family, m, rt)
-       struct ifnet *ifp;
-       int family; /* family of the packet to be encapsulate. */
-       struct mbuf *m;
-       struct rtentry *rt;
+in6_gif_output(
+       struct ifnet *ifp,
+       int family, /* family of the packet to be encapsulate. */
+       struct mbuf *m,
+       struct rtentry *rt)
 {
        struct gif_softc *sc = (struct gif_softc*)ifp;
        struct sockaddr_in6 *dst = (struct sockaddr_in6 *)&sc->gif_ro6.ro_dst;
@@ -201,9 +201,9 @@ in6_gif_output(ifp, family, m, rt)
         * it is too painful to ask for resend of inner packet, to achieve
         * path MTU discovery for encapsulated packets.
         */
-       return(ip6_output(m, 0, &sc->gif_ro6, IPV6_MINMTU, 0, NULL));
+       return(ip6_output(m, 0, &sc->gif_ro6, IPV6_MINMTU, 0, NULL, 0));
 #else
-       return(ip6_output(m, 0, &sc->gif_ro6, 0, 0, NULL));
+       return(ip6_output(m, 0, &sc->gif_ro6, 0, 0, NULL, 0));
 #endif
 }
 
@@ -282,53 +282,45 @@ int in6_gif_input(mp, offp)
 }
 
 /*
- * we know that we are in IFF_UP, outer address available, and outer family
- * matched the physical addr family.  see gif_encapcheck().
+ * validate outer address.
  */
-int
-gif_encapcheck6(m, off, proto, arg)
-       const struct mbuf *m;
-       int off;
-       int proto;
-       void *arg;
-{
-       struct ip6_hdr ip6;
+static int
+gif_validate6(ip6, sc, ifp)
+       const struct ip6_hdr *ip6;
        struct gif_softc *sc;
+       struct ifnet *ifp;
+{
        struct sockaddr_in6 *src, *dst;
-       int addrmatch;
 
-       /* sanity check done in caller */
-       sc = (struct gif_softc *)arg;
        src = (struct sockaddr_in6 *)sc->gif_psrc;
        dst = (struct sockaddr_in6 *)sc->gif_pdst;
 
-       /* LINTED const cast */
-       m_copydata((struct mbuf *)m, 0, sizeof(ip6), (caddr_t)&ip6);
-
-       /* check for address match */
-       addrmatch = 0;
-       if (IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6.ip6_dst))
-               addrmatch |= 1;
-       if (IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6.ip6_src))
-               addrmatch |= 2;
-       if (addrmatch != 3)
+       /*
+        * Check for address match.  Note that the check is for an incoming
+        * packet.  We should compare the *source* address in our configuration
+        * and the *destination* address of the packet, and vice versa.
+        */
+       if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) ||
+           !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src))
                return 0;
 
        /* martian filters on outer source - done in ip6_input */
 
        /* ingress filters on outer source */
-       if ((sc->gif_if.if_flags & IFF_LINK2) == 0 &&
-           (m->m_flags & M_PKTHDR) != 0 && m->m_pkthdr.rcvif) {
+       if ((sc->gif_if.if_flags & IFF_LINK2) == 0 && ifp) {
                struct sockaddr_in6 sin6;
                struct rtentry *rt;
 
                bzero(&sin6, sizeof(sin6));
                sin6.sin6_family = AF_INET6;
                sin6.sin6_len = sizeof(struct sockaddr_in6);
-               sin6.sin6_addr = ip6.ip6_src;
-               /* XXX scopeid */
+               sin6.sin6_addr = ip6->ip6_src;
+#ifndef SCOPEDROUTING
+               sin6.sin6_scope_id = 0; /* XXX */
+#endif
+
                rt = rtalloc1((struct sockaddr *)&sin6, 0, 0UL);
-               if (!rt || rt->rt_ifp != m->m_pkthdr.rcvif) {
+               if (!rt || rt->rt_ifp != ifp) {
 #if 0
                        log(LOG_WARNING, "%s: packet from %s dropped "
                            "due to ingress filter\n", if_name(&sc->gif_if),
@@ -343,3 +335,29 @@ gif_encapcheck6(m, off, proto, arg)
 
        return 128 * 2;
 }
+
+/*
+ * we know that we are in IFF_UP, outer address available, and outer family
+ * matched the physical addr family.  see gif_encapcheck().
+ * sanity check for arg should have been done in the caller.
+ */
+int
+gif_encapcheck6(m, off, proto, arg)
+       const struct mbuf *m;
+       int off;
+       int proto;
+       void *arg;
+{
+       struct ip6_hdr ip6;
+       struct gif_softc *sc;
+       struct ifnet *ifp;
+
+       /* sanity check done in caller */
+       sc = (struct gif_softc *)arg;
+
+       /* LINTED const cast */
+       m_copydata(m, 0, sizeof(ip6), (caddr_t)&ip6);
+       ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL;
+
+       return gif_validate6(&ip6, sc, ifp);
+}