Eliminate the use of m_copydata() in gif_encapcheck().

ip_encap already has inspected mbuf's data, at least an IP header.
And it is safe to use mtod() and do direct access to needed fields.
Add M_ASSERTPKTHDR() to gif_encapcheck(), since the code expects that
mbuf has a packet header.
Move the code from gif_validate[46] into in[6]_gif_encapcheck(), also
remove "martian filters" checks. According to RFC 4213 it is enough to
verify that the source address is the address of the encapsulator, as
configured on the decapsulator.

Reviewed by:	melifaro
Obtained from:	Yandex LLC
Sponsored by:	Yandex LLC

diff --git a/sys/net/if_gif.c b/sys/net/if_gif.c
index 48a842a9dd93bab0cf2e74e8c1e967d485dcb308..78b4d9da443054bb0c6a64b6c2b37443694b8fb1 100644 (file)
--- a/sys/net/if_gif.c
+++ b/sys/net/if_gif.c
@@ -280,9 +280,9 @@ int
 gif_encapcheck(const struct mbuf *m, int off, int proto, void *arg)
 {
        GIF_RLOCK_TRACKER;
+       const struct ip *ip;
        struct gif_softc *sc;
        int ret;
-       uint8_t ver;
 
        sc = (struct gif_softc *)arg;
        if (sc == NULL || (GIF2IFP(sc)->if_flags & IFF_UP) == 0)
@@ -309,11 +309,12 @@ gif_encapcheck(const struct mbuf *m, int off, int proto, void *arg)
        }
 
        /* Bail on short packets */
+       M_ASSERTPKTHDR(m);
        if (m->m_pkthdr.len < sizeof(struct ip))
                goto done;
 
-       m_copydata(m, 0, 1, &ver);
-       switch (ver >> 4) {
+       ip = mtod(m, const struct ip *);
+       switch (ip->ip_v) {
 #ifdef INET
        case 4:
                if (sc->gif_family != AF_INET)

diff --git a/sys/netinet/in_gif.c b/sys/netinet/in_gif.c
index e634987cf4c9e3ad3819dbc1b34b0772b69504a5..0afdea278c3995f030533e71917048cc70424765 100644 (file)
--- a/sys/netinet/in_gif.c
+++ b/sys/netinet/in_gif.c
@@ -67,8 +67,6 @@ __FBSDID("$FreeBSD$");
 
 #include <net/if_gif.h>
 
-static int gif_validate4(const struct ip *, struct gif_softc *,
-       struct ifnet *);
 static int in_gif_input(struct mbuf **, int *, int);
 
 extern  struct domain inetdomain;
@@ -163,16 +161,22 @@ in_gif_input(struct mbuf **mp, int *offp, int proto)
 }
 
 /*
- * validate outer address.
+ * we know that we are in IFF_UP, outer address available, and outer family
+ * matched the physical addr family.  see gif_encapcheck().
  */
-static int
-gif_validate4(const struct ip *ip, struct gif_softc *sc, struct ifnet *ifp)
+int
+in_gif_encapcheck(const struct mbuf *m, int off, int proto, void *arg)
 {
+       const struct ip *ip;
+       struct gif_softc *sc;
        int ret;
 
+       /* sanity check done in caller */
+       sc = (struct gif_softc *)arg;
        GIF_RLOCK_ASSERT(sc);
 
        /* check for address match */
+       ip = mtod(m, const struct ip *);
        if (sc->gif_iphdr->ip_src.s_addr != ip->ip_dst.s_addr)
                return (0);
        ret = 32;
@@ -182,18 +186,8 @@ gif_validate4(const struct ip *ip, struct gif_softc *sc, struct ifnet *ifp)
        } else
                ret += 32;
 
-       /* martian filters on outer source - NOT done in ip_input! */
-       if (IN_MULTICAST(ntohl(ip->ip_src.s_addr)))
-               return (0);
-       switch ((ntohl(ip->ip_src.s_addr) & 0xff000000) >> 24) {
-       case 0:
-       case 127:
-       case 255:
-               return (0);
-       }
-
        /* ingress filters on outer source */
-       if ((GIF2IFP(sc)->if_flags & IFF_LINK2) == 0 && ifp) {
+       if ((GIF2IFP(sc)->if_flags & IFF_LINK2) == 0) {
                struct sockaddr_in sin;
                struct rtentry *rt;
 
@@ -204,8 +198,8 @@ gif_validate4(const struct ip *ip, struct gif_softc *sc, struct ifnet *ifp)
                /* XXX MRT  check for the interface we would use on output */
                rt = in_rtalloc1((struct sockaddr *)&sin, 0,
                    0UL, sc->gif_fibnum);
-               if (!rt || rt->rt_ifp != ifp) {
-                       if (rt)
+               if (rt == NULL || rt->rt_ifp != m->m_pkthdr.rcvif) {
+                       if (rt != NULL)
                                RTFREE_LOCKED(rt);
                        return (0);
                }
@@ -214,26 +208,6 @@ gif_validate4(const struct ip *ip, struct gif_softc *sc, struct ifnet *ifp)
        return (ret);
 }
 
-/*
- * we know that we are in IFF_UP, outer address available, and outer family
- * matched the physical addr family.  see gif_encapcheck().
- */
-int
-in_gif_encapcheck(const struct mbuf *m, int off, int proto, void *arg)
-{
-       struct ip ip;
-       struct gif_softc *sc;
-       struct ifnet *ifp;
-
-       /* sanity check done in caller */
-       sc = (struct gif_softc *)arg;
-       GIF_RLOCK_ASSERT(sc);
-
-       m_copydata(m, 0, sizeof(ip), (caddr_t)&ip);
-       ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL;
-       return (gif_validate4(&ip, sc, ifp));
-}
-
 int
 in_gif_attach(struct gif_softc *sc)
 {

diff --git a/sys/netinet6/in6_gif.c b/sys/netinet6/in6_gif.c
index 126890f730779ba25f8b813adfbe237275d7fa73..d714f236384e305c09ef0a6ab011d110fb7a0f69 100644 (file)
--- a/sys/netinet6/in6_gif.c
+++ b/sys/netinet6/in6_gif.c
@@ -81,8 +81,6 @@ SYSCTL_DECL(_net_inet6_ip6);
 SYSCTL_INT(_net_inet6_ip6, IPV6CTL_GIF_HLIM, gifhlim, CTLFLAG_VNET | CTLFLAG_RW,
     &VNET_NAME(ip6_gif_hlim), 0, "");
 
-static int gif_validate6(const struct ip6_hdr *, struct gif_softc *,
-                        struct ifnet *);
 static int in6_gif_input(struct mbuf **, int *, int);
 
 extern  struct domain inet6domain;
@@ -174,20 +172,26 @@ in6_gif_input(struct mbuf **mp, int *offp, int proto)
 }
 
 /*
- * validate outer address.
+ * we know that we are in IFF_UP, outer address available, and outer family
+ * matched the physical addr family.  see gif_encapcheck().
  */
-static int
-gif_validate6(const struct ip6_hdr *ip6, struct gif_softc *sc,
-    struct ifnet *ifp)
+int
+in6_gif_encapcheck(const struct mbuf *m, int off, int proto, void *arg)
 {
+       const struct ip6_hdr *ip6;
+       struct gif_softc *sc;
        int ret;
 
+       /* sanity check done in caller */
+       sc = (struct gif_softc *)arg;
        GIF_RLOCK_ASSERT(sc);
+
        /*
         * Check for address match.  Note that the check is for an incoming
         * packet.  We should compare the *source* address in our configuration
         * and the *destination* address of the packet, and vice versa.
         */
+       ip6 = mtod(m, const struct ip6_hdr *);
        if (!IN6_ARE_ADDR_EQUAL(&sc->gif_ip6hdr->ip6_src, &ip6->ip6_dst))
                return (0);
        ret = 128;
@@ -197,10 +201,8 @@ gif_validate6(const struct ip6_hdr *ip6, struct gif_softc *sc,
        } else
                ret += 128;
 
-       /* martian filters on outer source - done in ip6_input */
-
        /* ingress filters on outer source */
-       if ((GIF2IFP(sc)->if_flags & IFF_LINK2) == 0 && ifp) {
+       if ((GIF2IFP(sc)->if_flags & IFF_LINK2) == 0) {
                struct sockaddr_in6 sin6;
                struct rtentry *rt;
 
@@ -212,37 +214,16 @@ gif_validate6(const struct ip6_hdr *ip6, struct gif_softc *sc,
 
                rt = in6_rtalloc1((struct sockaddr *)&sin6, 0, 0UL,
                    sc->gif_fibnum);
-               if (!rt || rt->rt_ifp != ifp) {
-                       if (rt)
+               if (rt == NULL || rt->rt_ifp != m->m_pkthdr.rcvif) {
+                       if (rt != NULL)
                                RTFREE_LOCKED(rt);
                        return (0);
                }
                RTFREE_LOCKED(rt);
        }
-
        return (ret);
 }
 
-/*
- * we know that we are in IFF_UP, outer address available, and outer family
- * matched the physical addr family.  see gif_encapcheck().
- */
-int
-in6_gif_encapcheck(const struct mbuf *m, int off, int proto, void *arg)
-{
-       struct ip6_hdr ip6;
-       struct gif_softc *sc;
-       struct ifnet *ifp;
-
-       /* sanity check done in caller */
-       sc = (struct gif_softc *)arg;
-       GIF_RLOCK_ASSERT(sc);
-
-       m_copydata(m, 0, sizeof(ip6), (caddr_t)&ip6);
-       ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL;
-       return (gif_validate6(&ip6, sc, ifp));
-}
-
 int
 in6_gif_attach(struct gif_softc *sc)
 {