-/* $OpenBSD: in_proto.c,v 1.111 2024/08/21 07:36:12 mvs Exp $ */
+/* $OpenBSD: in_proto.c,v 1.112 2024/08/21 12:53:36 mvs Exp $ */
/* $NetBSD: in_proto.c,v 1.14 1996/02/18 18:58:32 christos Exp $ */
/*
.pr_type = SOCK_RAW,
.pr_domain = &inetdomain,
.pr_protocol = IPPROTO_IPV4,
- .pr_flags = PR_ATOMIC|PR_ADDR|PR_MPSOCKET|PR_MPSYSCTL,
+ .pr_flags = PR_ATOMIC|PR_ADDR|PR_MPSOCKET,
#if NGIF > 0
.pr_input = in_gif_input,
#else
-/* $OpenBSD: ip_ipip.c,v 1.103 2024/08/21 07:36:12 mvs Exp $ */
+/* $OpenBSD: ip_ipip.c,v 1.104 2024/08/21 12:53:36 mvs Exp $ */
/*
* The authors of this code are John Ioannidis (ji@tla.org),
* Angelos D. Keromytis (kermit@csd.uch.gr) and
#include <net/pfvar.h>
#endif
-/*
- * Locks used to protect data:
- * a atomic
- */
-
#ifdef ENCDEBUG
#define DPRINTF(fmt, args...) \
do { \
* We can control the acceptance of IP4 packets by altering the sysctl
* net.inet.ipip.allow value. Zero means drop them, all else is acceptance.
*/
-int ipip_allow = 0; /* [a] */
+int ipip_allow = 0;
struct cpumem *ipipcounters;
struct ifnet *ifp;
/* If we do not accept IP-in-IP explicitly, drop. */
- if (atomic_load_int(&ipip_allow) == 0 &&
- ((*mp)->m_flags & (M_AUTH|M_CONF)) == 0) {
+ if (!ipip_allow && ((*mp)->m_flags & (M_AUTH|M_CONF)) == 0) {
DPRINTF("dropped due to policy");
ipipstat_inc(ipips_pdrops);
m_freemp(mp);
}
/* Check for local address spoofing. */
- if (!(ifp->if_flags & IFF_LOOPBACK) &&
- atomic_load_int(&ipip_allow) != 2) {
+ if (!(ifp->if_flags & IFF_LOOPBACK) && ipip_allow != 2) {
struct sockaddr_storage ss;
struct rtentry *rt;
ipip_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
size_t newlen)
{
+ int error;
+
/* All sysctl names at this level are terminal. */
if (namelen != 1)
return (ENOTDIR);
switch (name[0]) {
case IPIPCTL_ALLOW:
- return (sysctl_int_bounded(oldp, oldlenp, newp, newlen,
- &ipip_allow, 0, 2));
+ NET_LOCK();
+ error = sysctl_int_bounded(oldp, oldlenp, newp, newlen,
+ &ipip_allow, 0, 2);
+ NET_UNLOCK();
+ return (error);
case IPIPCTL_STATS:
return (ipip_sysctl_ipipstat(oldp, oldlenp, newp));
default: