From owner-svn-src-all@FreeBSD.ORG Mon Sep 15 07:20:41 2014 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 794B1E7B; Mon, 15 Sep 2014 07:20:41 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 59BE26BF; Mon, 15 Sep 2014 07:20:41 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id s8F7Kfj2018303; Mon, 15 Sep 2014 07:20:41 GMT (envelope-from hrs@FreeBSD.org) Received: (from hrs@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id s8F7KeJW018298; Mon, 15 Sep 2014 07:20:40 GMT (envelope-from hrs@FreeBSD.org) Message-Id: <201409150720.s8F7KeJW018298@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: hrs set sender to hrs@FreeBSD.org using -f From: Hiroki Sato Date: Mon, 15 Sep 2014 07:20:40 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r271610 - in head: etc/rc.d sys/netinet X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Sep 2014 07:20:41 -0000 Author: hrs Date: Mon Sep 15 07:20:40 2014 New Revision: 271610 URL: http://svnweb.freebsd.org/changeset/base/271610 Log: Make net.inet.ip.sourceroute, net.inet.ip.accept_sourceroute, and net.inet.ip.process_options vnet-aware. Revert changes in r271545. Suggested by: bz Modified: head/etc/rc.d/routing head/sys/netinet/ip_fastfwd.c head/sys/netinet/ip_options.c head/sys/netinet/ip_options.h Modified: head/etc/rc.d/routing ============================================================================== --- head/etc/rc.d/routing Mon Sep 15 06:21:28 2014 (r271609) +++ head/etc/rc.d/routing Mon Sep 15 07:20:40 2014 (r271610) @@ -326,22 +326,20 @@ options_inet() ${SYSCTL} net.inet.ip.forwarding=0 > /dev/null fi - if ! check_jail vnet; then - if checkyesno forward_sourceroute; then - ropts_init inet - echo -n ' do source routing=YES' - ${SYSCTL} net.inet.ip.sourceroute=1 > /dev/null - else - ${SYSCTL} net.inet.ip.sourceroute=0 > /dev/null - fi - - if checkyesno accept_sourceroute; then - ropts_init inet - echo -n ' accept source routing=YES' - ${SYSCTL} net.inet.ip.accept_sourceroute=1 > /dev/null - else - ${SYSCTL} net.inet.ip.accept_sourceroute=0 > /dev/null - fi + if checkyesno forward_sourceroute; then + ropts_init inet + echo -n ' do source routing=YES' + ${SYSCTL} net.inet.ip.sourceroute=1 > /dev/null + else + ${SYSCTL} net.inet.ip.sourceroute=0 > /dev/null + fi + + if checkyesno accept_sourceroute; then + ropts_init inet + echo -n ' accept source routing=YES' + ${SYSCTL} net.inet.ip.accept_sourceroute=1 > /dev/null + else + ${SYSCTL} net.inet.ip.accept_sourceroute=0 > /dev/null fi if checkyesno arpproxy_all; then Modified: head/sys/netinet/ip_fastfwd.c ============================================================================== --- head/sys/netinet/ip_fastfwd.c Mon Sep 15 06:21:28 2014 (r271609) +++ head/sys/netinet/ip_fastfwd.c Mon Sep 15 07:20:40 2014 (r271610) @@ -296,9 +296,9 @@ ip_fastforward(struct mbuf *m) * Only IP packets without options */ if (ip->ip_hl != (sizeof(struct ip) >> 2)) { - if (ip_doopts == 1) + if (V_ip_doopts == 1) return m; - else if (ip_doopts == 2) { + else if (V_ip_doopts == 2) { icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB, 0, 0); return NULL; /* mbuf already free'd */ Modified: head/sys/netinet/ip_options.c ============================================================================== --- head/sys/netinet/ip_options.c Mon Sep 15 06:21:28 2014 (r271609) +++ head/sys/netinet/ip_options.c Mon Sep 15 07:20:40 2014 (r271610) @@ -65,18 +65,21 @@ __FBSDID("$FreeBSD$"); #include -static int ip_dosourceroute = 0; -SYSCTL_INT(_net_inet_ip, IPCTL_SOURCEROUTE, sourceroute, CTLFLAG_RW, - &ip_dosourceroute, 0, "Enable forwarding source routed IP packets"); - -static int ip_acceptsourceroute = 0; -SYSCTL_INT(_net_inet_ip, IPCTL_ACCEPTSOURCEROUTE, accept_sourceroute, - CTLFLAG_RW, &ip_acceptsourceroute, 0, +static VNET_DEFINE(int, ip_dosourceroute); +SYSCTL_VNET_INT(_net_inet_ip, IPCTL_SOURCEROUTE, sourceroute, CTLFLAG_RW, + &VNET_NAME(ip_dosourceroute), 0, + "Enable forwarding source routed IP packets"); +#define V_ip_dosourceroute VNET(ip_dosourceroute) + +static VNET_DEFINE(int, ip_acceptsourceroute); +SYSCTL_VNET_INT(_net_inet_ip, IPCTL_ACCEPTSOURCEROUTE, accept_sourceroute, + CTLFLAG_RW, &VNET_NAME(ip_acceptsourceroute), 0, "Enable accepting source routed IP packets"); +#define V_ip_acceptsourceroute VNET(ip_acceptsourceroute) -int ip_doopts = 1; /* 0 = ignore, 1 = process, 2 = reject */ -SYSCTL_INT(_net_inet_ip, OID_AUTO, process_options, CTLFLAG_RW, - &ip_doopts, 0, "Enable IP options processing ([LS]SRR, RR, TS)"); +VNET_DEFINE(int, ip_doopts) = 1; /* 0 = ignore, 1 = process, 2 = reject */ +SYSCTL_VNET_INT(_net_inet_ip, OID_AUTO, process_options, CTLFLAG_RW, + &VNET_NAME(ip_doopts), 0, "Enable IP options processing ([LS]SRR, RR, TS)"); static void save_rte(struct mbuf *m, u_char *, struct in_addr); @@ -104,9 +107,9 @@ ip_dooptions(struct mbuf *m, int pass) struct sockaddr_in ipaddr = { sizeof(ipaddr), AF_INET }; /* Ignore or reject packets with IP options. */ - if (ip_doopts == 0) + if (V_ip_doopts == 0) return 0; - else if (ip_doopts == 2) { + else if (V_ip_doopts == 2) { type = ICMP_UNREACH; code = ICMP_UNREACH_FILTER_PROHIB; goto bad; @@ -167,7 +170,7 @@ ip_dooptions(struct mbuf *m, int pass) code = ICMP_UNREACH_SRCFAIL; goto bad; } - if (!ip_dosourceroute) + if (!V_ip_dosourceroute) goto nosourcerouting; /* * Loose routing, and not at next destination @@ -180,7 +183,7 @@ ip_dooptions(struct mbuf *m, int pass) /* * End of source route. Should be for us. */ - if (!ip_acceptsourceroute) + if (!V_ip_acceptsourceroute) goto nosourcerouting; save_rte(m, cp, ip->ip_src); break; @@ -189,7 +192,7 @@ ip_dooptions(struct mbuf *m, int pass) if (V_ipstealth) goto dropit; #endif - if (!ip_dosourceroute) { + if (!V_ip_dosourceroute) { if (V_ipforwarding) { char buf[16]; /* aaa.bbb.ccc.ddd\0 */ /* Modified: head/sys/netinet/ip_options.h ============================================================================== --- head/sys/netinet/ip_options.h Mon Sep 15 06:21:28 2014 (r271609) +++ head/sys/netinet/ip_options.h Mon Sep 15 07:20:40 2014 (r271610) @@ -47,7 +47,8 @@ struct ipopt_tag { struct ipoptrt ip_srcrt; }; -extern int ip_doopts; /* process or ignore IP options */ +VNET_DECLARE(int, ip_doopts); /* process or ignore IP options */ +#define V_ip_doopts VNET(ip_doopts) int ip_checkrouteralert(struct mbuf *); int ip_dooptions(struct mbuf *, int);