-/* $OpenBSD: in_proto.c,v 1.110 2024/08/20 07:47:25 mvs Exp $ */
+/* $OpenBSD: in_proto.c,v 1.111 2024/08/21 07:36:12 mvs Exp $ */
/* $NetBSD: in_proto.c,v 1.14 1996/02/18 18:58:32 christos Exp $ */
/*
.pr_type = SOCK_RAW,
.pr_domain = &inetdomain,
.pr_protocol = IPPROTO_IPV4,
- .pr_flags = PR_ATOMIC|PR_ADDR|PR_MPSOCKET,
+ .pr_flags = PR_ATOMIC|PR_ADDR|PR_MPSOCKET|PR_MPSYSCTL,
#if NGIF > 0
.pr_input = in_gif_input,
#else
-/* $OpenBSD: ip_ipip.c,v 1.102 2024/05/17 20:44:36 bluhm Exp $ */
+/* $OpenBSD: ip_ipip.c,v 1.103 2024/08/21 07:36:12 mvs Exp $ */
/*
* The authors of this code are John Ioannidis (ji@tla.org),
* Angelos D. Keromytis (kermit@csd.uch.gr) and
#include <net/pfvar.h>
#endif
+/*
+ * Locks used to protect data:
+ * a atomic
+ */
+
#ifdef ENCDEBUG
#define DPRINTF(fmt, args...) \
do { \
* We can control the acceptance of IP4 packets by altering the sysctl
* net.inet.ipip.allow value. Zero means drop them, all else is acceptance.
*/
-int ipip_allow = 0;
+int ipip_allow = 0; /* [a] */
struct cpumem *ipipcounters;
struct ifnet *ifp;
/* If we do not accept IP-in-IP explicitly, drop. */
- if (!ipip_allow && ((*mp)->m_flags & (M_AUTH|M_CONF)) == 0) {
+ if (atomic_load_int(&ipip_allow) == 0 &&
+ ((*mp)->m_flags & (M_AUTH|M_CONF)) == 0) {
DPRINTF("dropped due to policy");
ipipstat_inc(ipips_pdrops);
m_freemp(mp);
}
/* Check for local address spoofing. */
- if (!(ifp->if_flags & IFF_LOOPBACK) && ipip_allow != 2) {
+ if (!(ifp->if_flags & IFF_LOOPBACK) &&
+ atomic_load_int(&ipip_allow) != 2) {
struct sockaddr_storage ss;
struct rtentry *rt;
ipip_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
size_t newlen)
{
- int error;
-
/* All sysctl names at this level are terminal. */
if (namelen != 1)
return (ENOTDIR);
switch (name[0]) {
case IPIPCTL_ALLOW:
- NET_LOCK();
- error = sysctl_int_bounded(oldp, oldlenp, newp, newlen,
- &ipip_allow, 0, 2);
- NET_UNLOCK();
- return (error);
+ return (sysctl_int_bounded(oldp, oldlenp, newp, newlen,
+ &ipip_allow, 0, 2));
case IPIPCTL_STATS:
return (ipip_sysctl_ipipstat(oldp, oldlenp, newp));
default: