sync with KAME/NetBSD 1.4, SNAP kit 19990705.

key changes are:
- icmp6 redirect fix (dst check)
- revised ip6 multicast check for loopback i/f
- several RCS ID cleanups

sys/net/pfkeyv2.h

@@ -1 +1,37 @@
+/*	$NetBSD: pfkeyv2.h,v 1.3 1999/07/06 12:23:19 itojun Exp $	*/
+
+/*
+ * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef _NET_PFKEYV2_H_
+#define _NET_PFKEYV2_H_
+
 #include <netkey/keyv2.h>
+
+#endif /* _NET_PFKEYV2_H_ */

sys/netinet/in_gif.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: in_gif.c,v 1.3 1999/07/03 21:24:45 thorpej Exp $	*/
+/*	$NetBSD: in_gif.c,v 1.4 1999/07/06 12:23:20 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -79,9 +79,9 @@
 #endif
 
 #if NGIF > 0
-int gif_ttl = GIF_TTL;
+int ip_gif_ttl = GIF_TTL;
 #else
-int gif_ttl = 0;
+int ip_gif_ttl = 0;
 #endif
 
 int
@@ -171,7 +171,7 @@ in_gif_output(ifp, family, m, rt)
 	}
 	iphdr.ip_p = proto;
 	/* version will be set in ip_output() */
-	iphdr.ip_ttl = gif_ttl;
+	iphdr.ip_ttl = ip_gif_ttl;
 	iphdr.ip_len = m->m_pkthdr.len + sizeof(struct ip);
 	if (ifp->if_flags & IFF_LINK1)
 		ip_ecn_ingress(ECN_ALLOWED, &iphdr.ip_tos, &tos);

sys/netinet/in_gif.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: in_gif.h,v 1.3 1999/07/03 21:24:45 thorpej Exp $	*/
+/*	$NetBSD: in_gif.h,v 1.4 1999/07/06 12:23:20 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -34,7 +34,7 @@
 
 #define GIF_TTL		30
 
-extern int gif_ttl;
+extern int ip_gif_ttl;
 
 void in_gif_input __P((struct mbuf *, ...));
 int in_gif_output __P((struct ifnet *, int, struct mbuf *, struct rtentry *));

sys/netinet/ip_ecn.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_ecn.c,v 1.3 1999/07/03 21:24:45 thorpej Exp $	*/
+/*	$NetBSD: ip_ecn.c,v 1.4 1999/07/06 12:23:20 itojun Exp $	*/
 
 /*
  * Copyright (C) 1999 WIDE Project.
@@ -28,7 +28,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: ip_ecn.c,v 1.3 1999/07/03 21:24:45 thorpej Exp $
+ * KAME Id: ip_ecn.c,v 1.1.4.1 1999/05/07 15:59:14 itojun Exp
  */
 /*
  * ECN consideration on tunnel ingress/egress operation.

sys/netinet/ip_ecn.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_ecn.h,v 1.3 1999/07/03 21:24:45 thorpej Exp $	*/
+/*	$NetBSD: ip_ecn.h,v 1.4 1999/07/06 12:23:20 itojun Exp $	*/
 
 /*
  * Copyright (C) 1999 WIDE Project.
@@ -28,7 +28,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: ip_ecn.h,v 1.3 1999/07/03 21:24:45 thorpej Exp $
+ * KAME Id: ip_ecn.h,v 1.1.4.1 1999/05/07 15:59:16 itojun Exp
  */
 /*
  * ECN consideration on tunnel ingress/egress operation.

sys/netinet/ip_input.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_input.c,v 1.89 1999/07/01 08:12:50 itojun Exp $	*/
+/*	$NetBSD: ip_input.c,v 1.90 1999/07/06 12:23:20 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -1637,15 +1637,15 @@ ip_sysctl(name, namelen, oldp, oldlenp, newp, newlen)
 		splx(s);
 		return (error);
 	    }
-#endif
-#if NGIF > 0
-	case IPCTL_GIF_TTL:
-		return(sysctl_int(oldp, oldlenp, newp, newlen,
-				  &gif_ttl));
 #endif
 	case IPCTL_HOSTZEROBROADCAST:
 		return (sysctl_int(oldp, oldlenp, newp, newlen,
 		    &hostzeroisbroadcast));
+#if NGIF > 0
+	case IPCTL_GIF_TTL:
+		return(sysctl_int(oldp, oldlenp, newp, newlen,
+				  &ip_gif_ttl));
+#endif
 
 	default:
 		return (EOPNOTSUPP);

sys/netinet/ip_var.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_var.h,v 1.37 1999/07/01 08:12:51 itojun Exp $	*/
+/*	$NetBSD: ip_var.h,v 1.38 1999/07/06 12:23:21 itojun Exp $	*/
 
 /*
  * Copyright (c) 1982, 1986, 1993
@@ -184,7 +184,7 @@ extern LIST_HEAD(ipqhead, ipq) ipq;	/* ip reass. queue */
 extern u_int16_t ip_id;			/* ip packet ctr, for ids */
 extern int   ip_defttl;			/* default IP ttl */
 extern int   ipforwarding;		/* ip forwarding */
-extern int   gif_ttl;			/* default TTL for gif encap packet */
+extern int   ip_gif_ttl;		/* default TTL for gif encap packet */
 extern int   ip_mtudisc;		/* mtu discovery */
 extern u_int ip_mtudisc_timeout;	/* seconds to timeout mtu discovery */
 extern int   anonportmin;		/* minimum ephemeral port */

sys/netinet6/icmp6.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: icmp6.c,v 1.4 1999/07/06 08:55:56 itojun Exp $	*/
+/*	$NetBSD: icmp6.c,v 1.5 1999/07/06 12:23:21 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -345,7 +345,7 @@ icmp6_input(mp, offp, proto)
 #endif
 
 #ifdef IPSEC
-	/*drop it if it does not match the default policy */
+	/* drop it if it does not match the default policy */
 	if (ipsec6_in_reject(m, NULL)) {
 		ipsecstat.in_polvio++;
 		goto freeit;
@@ -1512,7 +1512,16 @@ icmp6_redirect_output(m0, rt)
 	/* sanity check */
 	if (!m0 || !rt || !(rt->rt_flags & RTF_UP) || !(ifp = rt->rt_ifp))
 		goto fail;
+
+	/*
+	 * Address check:
+	 *  the source address must identify a neighbor, and
+	 *  the destination address must not be a multicast address
+	 *  [RFC 2461, sec 8.2]
+	 */
 	sip6 = mtod(m0, struct ip6_hdr *);
+	if (nd6_is_addr_neighbor(&sip6->ip6_src, ifp) == 0)
+		goto fail;
 	if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst))
 		goto fail;	/* what should we do here? */
 

sys/netinet6/in6.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: in6.h,v 1.5 1999/07/03 21:30:18 thorpej Exp $	*/
+/*	$NetBSD: in6.h,v 1.6 1999/07/06 12:23:22 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -75,7 +75,7 @@
  * Identification of the network protocol stack
  */
 #define __KAME__
-#define __KAME_VERSION		"SNAP 19990628/NetBSD-current"
+#define __KAME_VERSION		"SNAP 19990705/NetBSD-current"
 
 /*
  * Local port number conventions:

sys/netinet6/ip6.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: ip6.h,v 1.3 1999/07/03 21:30:18 thorpej Exp $	*/
+/*	$NetBSD: ip6.h,v 1.4 1999/07/06 12:23:22 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -69,7 +69,7 @@
 
 /*
  * Definition for internet protocol version 6.
- * RFC 1883
+ * RFC 2460
  */
 
 struct ip6_hdr {
@@ -142,8 +142,9 @@ struct ip6_dest {
 #define IP6OPT_JUMBO_LEN	6
 #define IP6OPT_RTALERT		0x05	/* 00 0 00101 */
 #define IP6OPT_RTALERT_LEN	4
-#define IP6OPT_RTALERT_MLD	0	/* Datagram contains MLD message */
+#define IP6OPT_RTALERT_MLD	0	/* Datagram contains an MLD message */
-#define IP6OPT_RTALERT_RSVP	1	/* Datagram contains RSVP message */
+#define IP6OPT_RTALERT_RSVP	1	/* Datagram contains an RSVP message */
+#define IP6OPT_RTALERT_ACTNET	2 	/* contains an Active Networks msg */
 #define IP6OPT_MINLEN		2
 
 #define IP6OPT_TYPE(o)		((o) & 0xC0)

sys/netinet6/ip6_mroute.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: ip6_mroute.c,v 1.5 1999/07/06 08:55:56 itojun Exp $	*/
+/*	$NetBSD: ip6_mroute.c,v 1.6 1999/07/06 12:23:22 itojun Exp $	*/
 
 /*
  * Copyright (C) 1998 WIDE Project.
@@ -922,13 +922,6 @@ ip6_mforward(ip6, ifp, m)
 		    ip6_sprintf(&ip6->ip6_src), ip6_sprintf(&ip6->ip6_dst),
 		    ifp->if_index);
 #endif
-	/*
-	 * If the packet is loop-backed, it should be for local listeners
-	 * and need not to be forwarded any more.
-	 * XXX: M_LOOP is an ad-hoc hack...
-	 */
-	if (m->m_flags & M_LOOP)
-		return 0;
 
 	/*
 	 * Don't forward a packet with Hop limit of zero or one,
@@ -1223,7 +1216,12 @@ ip6_mdq(m, ifp, rt)
 		if(mifi < nummifs) /* have to make sure this is a valid mif */
 			if(mif6table[mifi].m6_ifp)
 
-				if (pim6) {
+				if (pim6 && (m->m_flags & M_LOOP) == 0) {
+					/*
+					 * Check the M_LOOP flag to avoid an
+					 * unnecessary PIM assert.
+					 * XXX: M_LOOP is an ad-hoc hack...
+					 */
 					static struct sockaddr_in6 sin6 =
 					{ sizeof(sin6), AF_INET6 };
 

sys/netinet6/nd6.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: nd6.c,v 1.5 1999/07/04 02:01:15 itojun Exp $	*/
+/*	$NetBSD: nd6.c,v 1.6 1999/07/06 12:23:22 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -619,6 +619,60 @@ nd6_lookup(addr6, create, ifp)
 	return(rt);
 }
 
+/*
+ * Detect if a given IPv6 address identifies a neighbor on a given link.
+ * XXX: should take care of the destination of a p2p link? 
+ */
+int
+nd6_is_addr_neighbor(addr, ifp)
+	struct in6_addr *addr;
+	struct ifnet *ifp;
+{
+	register struct ifaddr *ifa;
+	int i;
+
+#define IFADDR6(a) ((((struct in6_ifaddr *)(a))->ia_addr).sin6_addr)
+#define IFMASK6(a) ((((struct in6_ifaddr *)(a))->ia_prefixmask).sin6_addr)
+
+	/* A link-local address is always a neighbor. */
+	if (IN6_IS_ADDR_LINKLOCAL(addr))
+		return(1);
+
+	/*
+	 * If the address matches one of our addresses,
+	 * it should be a neighbor.
+	 */
+#ifdef __bsdi__
+	for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
+#else
+	for (ifa = ifp->if_addrlist.tqh_first;
+	     ifa;
+	     ifa = ifa->ifa_list.tqe_next)
+#endif
+	{
+		if (ifa->ifa_addr->sa_family != AF_INET6)
+			next: continue;
+
+		for (i = 0; i < 4; i++) {
+			if ((IFADDR6(ifa).s6_addr32[i] ^ addr->s6_addr32[i]) &
+			    IFMASK6(ifa).s6_addr32[i])
+				goto next;
+		}
+		return(1);
+	}
+
+	/*
+	 * Even if the address matches none of our addresses, it might be
+	 * in the neighbor cache.
+	 */
+	if (nd6_lookup(addr, 0, ifp))
+		return(1);
+
+	return(0);
+#undef IFADDR6
+#undef IFMASK6
+}
+
 /*
  * Free an nd6 llinfo entry.
  */

sys/netinet6/nd6.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: nd6.h,v 1.3 1999/07/03 21:30:19 thorpej Exp $	*/
+/*	$NetBSD: nd6.h,v 1.4 1999/07/06 12:23:22 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -258,6 +258,7 @@ union nd_opts {
 /* nd6.c */
 void nd6_init __P((void));
 void nd6_ifattach __P((struct ifnet *));
+int nd6_is_addr_neighbor __P((struct in6_addr *, struct ifnet *));
 void nd6_option_init __P((void *, int, union nd_opts *));
 struct nd_opt_hdr *nd6_option __P((union nd_opts *));
 int nd6_options __P((union nd_opts *));

sys/netinet6/pim6_var.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: pim6_var.h,v 1.3 1999/07/03 21:30:19 thorpej Exp $	*/
+/*	$NetBSD: pim6_var.h,v 1.4 1999/07/06 12:23:23 itojun Exp $	*/
 
 /*
  * Copyright (C) 1998 WIDE Project.
@@ -28,7 +28,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-/* $Id: pim6_var.h,v 1.3 1999/07/03 21:30:19 thorpej Exp $ */
+/* KAME Id: pim6_var.h,v 1.1.4.2.6.2 1999/05/20 06:11:08 itojun Exp */
 
 #ifndef _NETINET6_PIM6_VAR_H_
 #define _NETINET6_PIM6_VAR_H_

sys/netkey/key.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: key.c,v 1.6 1999/07/04 02:01:16 itojun Exp $	*/
+/*	$NetBSD: key.c,v 1.7 1999/07/06 12:23:23 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -29,7 +29,7 @@
  * SUCH DAMAGE.
  */
 
-/* KAME $Id: key.c,v 1.6 1999/07/04 02:01:16 itojun Exp $ */
+/* KAME Id: key.c,v 1.1.6.5.2.18 1999/07/04 02:06:37 itojun Exp */
 
 /*
  * This code is referd to RFC 2367,
@@ -617,6 +617,10 @@ key_do_allocsa_policy(saidx, proto, mode, state)
 		if (sa->type != proto)
 			continue;
 
+		/* check transport mode */
+		if (mode == IPSEC_MODE_TRANSPORT && sa->proxy != NULL)
+			continue;
+
 		/* check proxy address for tunnel mode */
 		if (mode == IPSEC_MODE_TUNNEL && sa->proxy == NULL)
 			continue;
@@ -2286,10 +2290,8 @@ key_setsaval(sa, mhp)
 #ifdef IPSEC_ESP
 	    {
 		struct esp_algorithm *algo;
-		int siz;
 
 		algo = &esp_algorithms[sa->alg_enc];
-		siz = (sa->flags & SADB_X_EXT_IV4B) ? 4 : 0;
 		if (algo && algo->ivlen)
 			sa->ivlen = (*algo->ivlen)(sa);
 		KMALLOC(sa->iv, caddr_t, sa->ivlen);

sys/netkey/key.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: key.h,v 1.3 1999/07/03 21:32:48 thorpej Exp $	*/
+/*	$NetBSD: key.h,v 1.4 1999/07/06 12:23:23 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -29,7 +29,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: key.h,v 1.3 1999/07/03 21:32:48 thorpej Exp $ */
+/* KAME Id: key.h,v 1.1.6.1.6.1 1999/05/17 17:03:14 itojun Exp */
 
 #ifndef _NETKEY_KEY_H_
 #define _NETKEY_KEY_H_

sys/netkey/key_debug.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: key_debug.c,v 1.6 1999/07/05 08:15:39 cjs Exp $	*/
+/*	$NetBSD: key_debug.c,v 1.7 1999/07/06 12:23:26 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -29,7 +29,7 @@
  * SUCH DAMAGE.
  */
 
-/* KAME @(#)$Id: key_debug.c,v 1.6 1999/07/05 08:15:39 cjs Exp $ */
+/* KAME Id: key_debug.c,v 1.1.6.2.4.3 1999/07/06 12:05:13 itojun Exp */
 
 #ifdef _KERNEL
 # define KERNEL

sys/netkey/key_debug.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: key_debug.h,v 1.3 1999/07/03 21:32:48 thorpej Exp $	*/
+/*	$NetBSD: key_debug.h,v 1.4 1999/07/06 12:23:26 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -29,7 +29,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: key_debug.h,v 1.3 1999/07/03 21:32:48 thorpej Exp $ */
+/* KAME Id: key_debug.h,v 1.1.6.2.6.1 1999/05/17 17:03:16 itojun Exp */
 
 #ifndef _NETKEY_KEY_DEBUG_H_
 #define _NETKEY_KEY_DEBUG_H_

sys/netkey/keysock.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: keysock.c,v 1.4 1999/07/04 02:01:16 itojun Exp $	*/
+/*	$NetBSD: keysock.c,v 1.5 1999/07/06 12:23:26 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -29,7 +29,7 @@
  * SUCH DAMAGE.
  */
 
-/* KAME @(#)$Id: keysock.c,v 1.4 1999/07/04 02:01:16 itojun Exp $ */
+/* KAME Id: keysock.c,v 1.1.6.4.2.2 1999/07/04 02:06:39 itojun Exp */
 
 #if defined(__FreeBSD__) && __FreeBSD__ >= 3
 #include "opt_inet.h"

sys/netkey/keysock.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: keysock.h,v 1.3 1999/07/03 21:32:49 thorpej Exp $	*/
+/*	$NetBSD: keysock.h,v 1.4 1999/07/06 12:23:26 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -29,7 +29,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: keysock.h,v 1.3 1999/07/03 21:32:49 thorpej Exp $ */
+/* KAME Id: keysock.h,v 1.1.6.3.6.1 1999/05/17 17:03:19 itojun Exp */
 
 #ifndef _NETKEY_KEYSOCK_H_
 #define _NETKEY_KEYSOCK_H_

sys/netkey/keyv2.h

@@ -1,4 +1,4 @@
-/*	$NetBSD: keyv2.h,v 1.4 1999/07/03 21:32:49 thorpej Exp $	*/
+/*	$NetBSD: keyv2.h,v 1.5 1999/07/06 12:23:26 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -29,7 +29,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: keyv2.h,v 1.4 1999/07/03 21:32:49 thorpej Exp $ */
+/* KAME Id: keyv2.h,v 1.1.6.1.6.4 1999/06/08 05:33:39 itojun Exp */
 
 /*
  * This file has been derived rfc 2367,