From owner-svn-src-all@FreeBSD.ORG Fri Apr 4 16:58:33 2014 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 3C6B9C6C; Fri, 4 Apr 2014 16:58:33 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 0F39277A; Fri, 4 Apr 2014 16:58:33 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.8/8.14.8) with ESMTP id s34GwW1o089912; Fri, 4 Apr 2014 16:58:32 GMT (envelope-from ae@svn.freebsd.org) Received: (from ae@localhost) by svn.freebsd.org (8.14.8/8.14.8/Submit) id s34GwWkW089911; Fri, 4 Apr 2014 16:58:32 GMT (envelope-from ae@svn.freebsd.org) Message-Id: <201404041658.s34GwWkW089911@svn.freebsd.org> From: "Andrey V. Elsukov" Date: Fri, 4 Apr 2014 16:58:32 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r264126 - head/sys/netipsec X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Apr 2014 16:58:33 -0000 Author: ae Date: Fri Apr 4 16:58:32 2014 New Revision: 264126 URL: http://svnweb.freebsd.org/changeset/base/264126 Log: The check for local address spoofing lacks ifaddr locking. Remove these loops and use in_localip() and in6_localip() functions instead. MFC after: 1 week Sponsored by: Yandex LLC Modified: head/sys/netipsec/xform_ipip.c Modified: head/sys/netipsec/xform_ipip.c ============================================================================== --- head/sys/netipsec/xform_ipip.c Fri Apr 4 15:57:27 2014 (r264125) +++ head/sys/netipsec/xform_ipip.c Fri Apr 4 16:58:32 2014 (r264126) @@ -159,14 +159,8 @@ ip4_input(struct mbuf *m, int off) static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp) { -#ifdef INET - register struct sockaddr_in *sin; -#endif - register struct ifnet *ifp; - register struct ifaddr *ifa; struct ip *ipo; #ifdef INET6 - register struct sockaddr_in6 *sin6; struct ip6_hdr *ip6 = NULL; u_int8_t itos; #endif @@ -294,47 +288,22 @@ _ipip_input(struct mbuf *m, int iphlen, if ((m->m_pkthdr.rcvif == NULL || !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) && V_ipip_allow != 2) { - IFNET_RLOCK_NOSLEEP(); - TAILQ_FOREACH(ifp, &V_ifnet, if_link) { - TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { -#ifdef INET - if (ipo) { - if (ifa->ifa_addr->sa_family != - AF_INET) - continue; - - sin = (struct sockaddr_in *) ifa->ifa_addr; - - if (sin->sin_addr.s_addr == - ipo->ip_src.s_addr) { - IPIPSTAT_INC(ipips_spoof); - m_freem(m); - IFNET_RUNLOCK_NOSLEEP(); - return; - } - } -#endif /* INET */ - +#ifdef INET + if ((v >> 4) == IPVERSION && + in_localip(ipo->ip_src) != 0) { + IPIPSTAT_INC(ipips_spoof); + m_freem(m); + return; + } +#endif #ifdef INET6 - if (ip6) { - if (ifa->ifa_addr->sa_family != - AF_INET6) - continue; - - sin6 = (struct sockaddr_in6 *) ifa->ifa_addr; - - if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_src)) { - IPIPSTAT_INC(ipips_spoof); - m_freem(m); - IFNET_RUNLOCK_NOSLEEP(); - return; - } - - } -#endif /* INET6 */ - } + if ((v & IPV6_VERSION_MASK) == IPV6_VERSION && + in6_localip(&ip6->ip6_src) != 0) { + IPIPSTAT_INC(ipips_spoof); + m_freem(m); + return; } - IFNET_RUNLOCK_NOSLEEP(); +#endif } /* Statistics */