From nobody Tue Oct 04 11:12:47 2022 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4MhZn12qFbz4d776 for ; Tue, 4 Oct 2022 11:12:53 +0000 (UTC) (envelope-from rrs@netflix.com) Received: from mail-pj1-x1032.google.com (mail-pj1-x1032.google.com [IPv6:2607:f8b0:4864:20::1032]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1D4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4MhZn10ZQCz3R3c for ; Tue, 4 Oct 2022 11:12:53 +0000 (UTC) (envelope-from rrs@netflix.com) Received: by mail-pj1-x1032.google.com with SMTP id p3-20020a17090a284300b0020a85fa3ffcso6629985pjf.2 for ; Tue, 04 Oct 2022 04:12:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netflix.com; s=google; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:from:to:cc:subject:date; bh=3FQrTP5f99RdLMupgHiGF37jQ8dbLu8D0sSVFiJ4KEA=; b=rDd4gybGs8hFt+uLfBaBSv9tgEwlj13Yu2iYScdPDFiPJ2DtJ9qBcB6kfHE3KKHpm7 P1UPdDyFcYlTrqIj3RLQubT5+6vL8aSbnJjDi1po3YxkyFcDHmWKO4vkliuVp29RlDwp er+b+wBDEBk2hjOXW0AUabryKgp1L6sT+0tb8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:x-gm-message-state:from:to:cc:subject:date; bh=3FQrTP5f99RdLMupgHiGF37jQ8dbLu8D0sSVFiJ4KEA=; b=cNML+magPM+iNEM99zrGgrzlN+jzP4jenUV44cUNg9tSpv4BOnanQV9ZgAMoriYCeZ vDwspmx55bYExwBrf0x8DdInpTx3hnK1vbV+pvAEL19VlsMOPE6jR+LdZl8IJCRwzZmv wFTimGiTQ/nX3B9iV2ZXiu8qtEGloHBMGge3qC/PtjAqoQDPOdqzER/qB/dmM9hyEgG4 yA5zAfAUsyKSIn9uCEwVdYNLLbl4CnQfwMjFSsvUggmqKZ87yMZ0v9Mz/ME0sAGk8jF0 xD7q95sDBFmBSfVimAp0gLq0UBamGFvkaAtyZ3KA4OTp/1+oIjjmdD9d1MlF16/zNNUb VFRA== X-Gm-Message-State: ACrzQf1V8cyGBLvxHnH6SJzCAgtqf3mZ9g/ATFoFfZWktG/o2RiL2Nbm skyzqiBGxJ5i3NZ5Cbo224+J/g== X-Google-Smtp-Source: AMsMyM63VYtUvPfimU5bDbtG/rZb4Aq6LTZ9nKOuts+PsN5OH77UHwBP1NaDsi3xnLYpcQ7kRkMKqg== X-Received: by 2002:a17:902:d4d2:b0:178:491b:40d with SMTP id o18-20020a170902d4d200b00178491b040dmr26650420plg.79.1664881971379; Tue, 04 Oct 2022 04:12:51 -0700 (PDT) Received: from smtpclient.apple (072-239-136-185.res.spectrum.com. [72.239.136.185]) by smtp.gmail.com with ESMTPSA id i61-20020a17090a3dc300b0020647f279fbsm9594069pjc.29.2022.10.04.04.12.49 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 04 Oct 2022 04:12:50 -0700 (PDT) From: Randall Stewart Message-Id: <1B7EBA3D-9673-4E13-9F06-C295EA0FFA40@netflix.com> Content-Type: multipart/signed; boundary="Apple-Mail=_98AE2EC2-43A2-4380-8D04-F61A7835F5FE"; protocol="application/pkcs7-signature"; micalg=sha-256 List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\)) Subject: Re: git: fcb3f813f379 - main - netinet*: remove PRC_ constants and streamline ICMP processing Date: Tue, 4 Oct 2022 07:12:47 -0400 In-Reply-To: Cc: Gleb Smirnoff , src-committers , "" , dev-commits-src-main@freebsd.org To: Dmitry Chagin References: <202210040357.2943vbxw015435@gitrepo.freebsd.org> X-Mailer: Apple Mail (2.3696.120.41.1.1) X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; none X-Rspamd-Queue-Id: 4MhZn10ZQCz3R3c X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[] X-ThisMailContainsUnwantedMimeParts: N --Apple-Mail=_98AE2EC2-43A2-4380-8D04-F61A7835F5FE Content-Type: multipart/alternative; boundary="Apple-Mail=_FE64714B-3FA1-431C-B3A8-2221B729D6F9" --Apple-Mail=_FE64714B-3FA1-431C-B3A8-2221B729D6F9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Dmitry: Yeah I hit the same issue.. I did find that if you add nooptions IPSEC_SUPPORT to your build it will work. Also making LINT works so I suspect its something minor in Gleb=E2=80=99s re-arrangement.=20 Though its like 4am right now in California so he won=E2=80=99t be up for a while I suspect :) R > On Oct 4, 2022, at 7:10 AM, Dmitry Chagin = wrote: >=20 > On Tue, Oct 04, 2022 at 03:57:37AM +0000, Gleb Smirnoff wrote: >> The branch main has been updated by glebius: >>=20 >> URL: = https://www.google.com/url?q=3Dhttps://cgit.FreeBSD.org/src/commit/?id%3Df= cb3f813f379f544f9cd2a10d18045588da0e132&source=3Dgmail-imap&ust=3D16654866= 31000000&usg=3DAOvVaw2VvUECoWSpNqOYdx0tDraU >>=20 >> commit fcb3f813f379f544f9cd2a10d18045588da0e132 >> Author: Gleb Smirnoff >> AuthorDate: 2022-10-04 03:53:04 +0000 >> Commit: Gleb Smirnoff >> CommitDate: 2022-10-04 03:53:04 +0000 >>=20 >> netinet*: remove PRC_ constants and streamline ICMP processing >>=20 >> In the original design of the network stack from the protocol = control >> input method pr_ctlinput was used notify the protocols about two = very >> different kinds of events: internal system events and receival of = an >> ICMP messages from outside. These events were coded with PRC_ = codes. >> Today these methods are removed from the protosw(9) and are = isolated >> to IPv4 and IPv6 stacks and are called only from icmp*_input(). = The >> PRC_ codes now just create a shim layer between ICMP codes and = errors >> or actions taken by protocols. >>=20 >> - Change ipproto_ctlinput_t to pass just pointer to ICMP header. = This >> allows protocols to not deduct it from the internal IP header. >> - Change ip6proto_ctlinput_t to pass just struct ip6ctlparam = pointer. >> It has all the information needed to the protocols. In the = structure, >> change ip6c_finaldst fields to sockaddr_in6. The reason is that >> icmp6_input() already has this address wrapped in sockaddr, and = the >> protocols want this address as sockaddr. >> - For UDP tunneling control input, as well as for IPSEC control = input, >> change the prototypes to accept a transparent union of either = ICMP >> header pointer or struct ip6ctlparam pointer. >> - In icmp_input() and icmp6_input() do only validation of ICMP = header and >> count bad packets. The translation of ICMP codes to = errors/actions is >> done by protocols. >> - Provide icmp_errmap() and icmp6_errmap() as substitute to = inetctlerrmap, >> inet6ctlerrmap arrays. >> - In protocol ctlinput methods either trust what icmp_errmap() = recommend, >> or do our own logic based on the ICMP header. >>=20 >> Differential revision: = https://www.google.com/url?q=3Dhttps://reviews.freebsd.org/D36731&source=3D= gmail-imap&ust=3D1665486631000000&usg=3DAOvVaw1JtS6e8srYG7hprLpt68zn >> --- >> sys/netinet/icmp6.h | 1 + >> sys/netinet/in_var.h | 2 - >> sys/netinet/ip_icmp.c | 106 = +++++++++++++++++++---------------- >> sys/netinet/ip_icmp.h | 1 + >> sys/netinet/ip_input.c | 17 ------ >> sys/netinet/ip_var.h | 3 +- >> sys/netinet/raw_ip.c | 11 +--- >> sys/netinet/sctp_usrreq.c | 10 ++-- >> sys/netinet/sctp_var.h | 2 +- >> sys/netinet/sctputil.c | 13 ++--- >> sys/netinet/tcp_subr.c | 128 = +++++++++++++++++++++++++------------------ >> sys/netinet/udp_usrreq.c | 24 ++++---- >> sys/netinet/udp_var.h | 6 +- >> sys/netinet6/icmp6.c | 100 ++++++++++++++++++--------------- >> sys/netinet6/in6_pcb.c | 26 +-------- >> sys/netinet6/in6_var.h | 1 - >> sys/netinet6/ip6_input.c | 20 ------- >> sys/netinet6/ip6_var.h | 11 ++-- >> sys/netinet6/raw_ip6.c | 31 ++--------- >> sys/netinet6/sctp6_usrreq.c | 8 +-- >> sys/netinet6/udp6_usrreq.c | 26 ++++----- >> sys/netipsec/ipsec_input.c | 24 ++++---- >> sys/netipsec/ipsec_support.h | 17 ++++-- >> sys/sys/protosw.h | 43 --------------- >> 24 files changed, 274 insertions(+), 357 deletions(-) >>=20 >> diff --git a/sys/netinet/icmp6.h b/sys/netinet/icmp6.h >> index 9628c0957c4a..7429b8173b6a 100644 >> --- a/sys/netinet/icmp6.h >> +++ b/sys/netinet/icmp6.h >> @@ -701,6 +701,7 @@ struct rttimer; >> struct in6_multi; >> # endif >> void icmp6_paramerror(struct mbuf *, int); >> +int icmp6_errmap(const struct icmp6_hdr *); >> void icmp6_error(struct mbuf *, int, int, int); >> void icmp6_error2(struct mbuf *, int, int, int, struct ifnet *); >> int icmp6_input(struct mbuf **, int *, int); >> diff --git a/sys/netinet/in_var.h b/sys/netinet/in_var.h >> index 40e1c1a23c40..c4cfeea66ba8 100644 >> --- a/sys/netinet/in_var.h >> +++ b/sys/netinet/in_var.h >> @@ -100,8 +100,6 @@ struct in_ifaddr { >> #define IN_LNAOF(in, ifa) \ >> ((ntohl((in).s_addr) & ~((struct in_ifaddr = *)(ifa)->ia_subnetmask)) >>=20 >> -extern u_char inetctlerrmap[]; >> - >> #define LLTABLE(ifp) \ >> ((struct in_ifinfo *)(ifp)->if_afdata[AF_INET])->ii_llt >> /* >> diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c >> index f0cc703c2757..fdde24fd94be 100644 >> --- a/sys/netinet/ip_icmp.c >> +++ b/sys/netinet/ip_icmp.c >> @@ -403,6 +403,55 @@ freeit: >> m_freem(n); >> } >>=20 >> +int >> +icmp_errmap(const struct icmp *icp) >> +{ >> + >> + switch (icp->icmp_type) { >> + case ICMP_UNREACH: >> + switch (icp->icmp_code) { >> + case ICMP_UNREACH_NET: >> + case ICMP_UNREACH_HOST: >> + case ICMP_UNREACH_SRCFAIL: >> + case ICMP_UNREACH_NET_UNKNOWN: >> + case ICMP_UNREACH_HOST_UNKNOWN: >> + case ICMP_UNREACH_ISOLATED: >> + case ICMP_UNREACH_TOSNET: >> + case ICMP_UNREACH_TOSHOST: >> + case ICMP_UNREACH_HOST_PRECEDENCE: >> + case ICMP_UNREACH_PRECEDENCE_CUTOFF: >> + return (EHOSTUNREACH); >> + case ICMP_UNREACH_NEEDFRAG: >> + return (EMSGSIZE); >> + case ICMP_UNREACH_PROTOCOL: >> + case ICMP_UNREACH_PORT: >> + case ICMP_UNREACH_NET_PROHIB: >> + case ICMP_UNREACH_HOST_PROHIB: >> + case ICMP_UNREACH_FILTER_PROHIB: >> + return (ECONNREFUSED); >> + default: >> + return (0); >> + } >> + case ICMP_TIMXCEED: >> + switch (icp->icmp_code) { >> + case ICMP_TIMXCEED_INTRANS: >> + return (EHOSTUNREACH); >> + default: >> + return (0); >> + } >> + case ICMP_PARAMPROB: >> + switch (icp->icmp_code) { >> + case ICMP_PARAMPROB_ERRATPTR: >> + case ICMP_PARAMPROB_OPTABSENT: >> + return (ENOPROTOOPT); >> + default: >> + return (0); >> + } >> + default: >> + return (0); >> + } >> +} >> + >> /* >> * Process a received ICMP message. >> */ >> @@ -484,56 +533,21 @@ icmp_input(struct mbuf **mp, int *offp, int = proto) >> code =3D icp->icmp_code; >> switch (icp->icmp_type) { >> case ICMP_UNREACH: >> - switch (code) { >> - case ICMP_UNREACH_NET: >> - case ICMP_UNREACH_HOST: >> - case ICMP_UNREACH_SRCFAIL: >> - case ICMP_UNREACH_NET_UNKNOWN: >> - case ICMP_UNREACH_HOST_UNKNOWN: >> - case ICMP_UNREACH_ISOLATED: >> - case ICMP_UNREACH_TOSNET: >> - case ICMP_UNREACH_TOSHOST: >> - case ICMP_UNREACH_HOST_PRECEDENCE: >> - case ICMP_UNREACH_PRECEDENCE_CUTOFF: >> - code =3D PRC_UNREACH_NET; >> - break; >> - >> - case ICMP_UNREACH_NEEDFRAG: >> - code =3D PRC_MSGSIZE; >> - break; >> - >> - /* >> - * RFC 1122, Sections 3.2.2.1 and 4.2.3.9. >> - * Treat subcodes 2,3 as immediate RST >> - */ >> - case ICMP_UNREACH_PROTOCOL: >> - code =3D PRC_UNREACH_PROTOCOL; >> - break; >> - case ICMP_UNREACH_PORT: >> - code =3D PRC_UNREACH_PORT; >> - break; >> - >> - case ICMP_UNREACH_NET_PROHIB: >> - case ICMP_UNREACH_HOST_PROHIB: >> - case ICMP_UNREACH_FILTER_PROHIB: >> - code =3D PRC_UNREACH_ADMIN_PROHIB; >> - break; >> - >> - default: >> - goto badcode; >> - } >> - goto deliver; >> + if (code > ICMP_UNREACH_PRECEDENCE_CUTOFF) >> + goto badcode; >> + else >> + goto deliver; >>=20 >> case ICMP_TIMXCEED: >> - if (code > 1) >> + if (code > ICMP_TIMXCEED_REASS) >> goto badcode; >> - code +=3D PRC_TIMXCEED_INTRANS; >> - goto deliver; >> + else >> + goto deliver; >>=20 >> case ICMP_PARAMPROB: >> - if (code > 1) >> + if (code > ICMP_PARAMPROB_LENGTH) >> goto badcode; >> - code =3D PRC_PARAMPROB; >> + >> deliver: >> /* >> * Problem with datagram; advise higher level routines. >> @@ -553,7 +567,6 @@ icmp_input(struct mbuf **mp, int *offp, int = proto) >> if (icmpprintfs) >> printf("deliver to protocol %d\n", = icp->icmp_ip.ip_p); >> #endif >> - icmpsrc.sin_addr =3D icp->icmp_ip.ip_dst; >> /* >> * XXX if the packet contains [IPv4 AH TCP], we can't = make a >> * notification to TCP layer. >> @@ -576,8 +589,7 @@ icmp_input(struct mbuf **mp, int *offp, int = proto) >> * ICMP_ADVLENPREF. See its definition in ip_icmp.h. >> */ >> if (ip_ctlprotox[icp->icmp_ip.ip_p] !=3D NULL) >> - ip_ctlprotox[icp->icmp_ip.ip_p](code, &icmpsrc, >> - &icp->icmp_ip); >> + ip_ctlprotox[icp->icmp_ip.ip_p](icp); >> break; >>=20 >> badcode: >> diff --git a/sys/netinet/ip_icmp.h b/sys/netinet/ip_icmp.h >> index 0303a09509c7..fefece665a00 100644 >> --- a/sys/netinet/ip_icmp.h >> +++ b/sys/netinet/ip_icmp.h >> @@ -216,6 +216,7 @@ struct icmp { >> (type) =3D=3D ICMP_MASKREQ || (type) =3D=3D ICMP_MASKREPLY) >>=20 >> #ifdef _KERNEL >> +int icmp_errmap(const struct icmp *); >> void icmp_error(struct mbuf *, int, int, uint32_t, int); >> int icmp_input(struct mbuf **, int *, int); >> int ip_next_mtu(int, int); >> diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c >> index 145c4464b855..88fd4f5e4def 100644 >> --- a/sys/netinet/ip_input.c >> +++ b/sys/netinet/ip_input.c >> @@ -873,23 +873,6 @@ ipproto_unregister(uint8_t proto) >> return (ENOENT); >> } >>=20 >> -/* (x) - issued by icmp_input() */ >> -u_char inetctlerrmap[PRC_NCMDS] =3D { >> - [PRC_MSGSIZE] =3D EMSGSIZE, /* (x) */ >> - [PRC_HOSTDEAD] =3D EHOSTDOWN, >> - [PRC_HOSTUNREACH] =3D EHOSTUNREACH, >> - [PRC_UNREACH_NET] =3D EHOSTUNREACH, /* (x) */ >> - [PRC_UNREACH_HOST] =3D EHOSTUNREACH, >> - [PRC_UNREACH_PROTOCOL] =3D ECONNREFUSED, /* (x) = */ >> - [PRC_UNREACH_PORT] =3D ECONNREFUSED, /* (x) */ >> - [12] =3D EMSGSIZE, >> - [PRC_UNREACH_SRCFAIL] =3D EHOSTUNREACH, >> - [PRC_TIMXCEED_INTRANS] =3D EHOSTUNREACH, /* (x) = */ >> - [PRC_TIMXCEED_REASS] =3D 0, /* (x) */ >> - [PRC_PARAMPROB] =3D ENOPROTOOPT, /* (x) = */ >> - [PRC_UNREACH_ADMIN_PROHIB] =3D ECONNREFUSED, /* (x) */ >> -}; >> - >> /* >> * Forward a packet. If some error occurs return the sender >> * an icmp packet. Note we can't always generate a meaningful >> diff --git a/sys/netinet/ip_var.h b/sys/netinet/ip_var.h >> index 070c82677150..0a2d915b12b3 100644 >> --- a/sys/netinet/ip_var.h >> +++ b/sys/netinet/ip_var.h >> @@ -238,7 +238,8 @@ extern void (*ip_rsvp_force_done)(struct = socket *); >> extern int (*rsvp_input_p)(struct mbuf **, int *, int); >>=20 >> typedef int ipproto_input_t(struct mbuf **, int *, int); >> -typedef void ipproto_ctlinput_t(int, struct sockaddr_in *, = struct ip *); >> +struct icmp; >> +typedef void ipproto_ctlinput_t(struct icmp *); >> int ipproto_register(uint8_t, ipproto_input_t, ipproto_ctlinput_t); >> int ipproto_unregister(uint8_t); >> #define IPPROTO_REGISTER(prot, input, ctl) do { = \ >> diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c >> index fb692e0822cf..2065b47883bb 100644 >> --- a/sys/netinet/raw_ip.c >> +++ b/sys/netinet/raw_ip.c >> @@ -804,17 +804,12 @@ rip_ctloutput(struct socket *so, struct sockopt = *sopt) >> } >>=20 >> void >> -rip_ctlinput(int cmd, struct sockaddr_in *sin, struct ip *ip) >> +rip_ctlinput(struct icmp *icmp) >> { >> - >> - switch (cmd) { >> #if defined(IPSEC) || defined(IPSEC_SUPPORT) >> - case PRC_MSGSIZE: >> - if (IPSEC_ENABLED(ipv4)) >> - IPSEC_CTLINPUT(ipv4, cmd, (struct sockaddr = *)sin, ip); >> - break; >> + if (IPSEC_ENABLED(ipv4)) >> + IPSEC_CTLINPUT(ipv4, icmp); >> #endif >=20 > hi,=20 >=20 > me/dchagin/freebsd/sys/netinet/raw_ip.c:811:3: error: too few = arguments > to function call, expected 4, have 2 > IPSEC_CTLINPUT(ipv4, icmp); >=20 > /home/dchagin/freebsd/sys/netipsec/ipsec_support.h:222:61: note: > expanded from macro 'IPSEC_CTLINPUT' > ipsec_kmod_ctlinput(proto ## _ipsec_support, __VA_ARGS__) >=20 >=20 > /home/dchagin/freebsd/sys/netipsec/ipsec_support.h:196:5: note: > 'ipsec_kmod_ctlinput' declared here > int ipsec_kmod_ctlinput(struct ipsec_support * const, int, >=20 >=20 > 1 error generated. > *** [raw_ip.o] Error code 1 >=20 >=20 ------ Randall Stewart rrs@netflix.com --Apple-Mail=_FE64714B-3FA1-431C-B3A8-2221B729D6F9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Dmitry:

Yeah I hit the same issue.. I did find that if you = add

nooptions=       IPSEC_SUPPORT

to your build it will work. Also making = LINT works
so I suspect its something minor in Gleb=E2=80=99s = re-arrangement. 
Though its like 4am right now in = California so he won=E2=80=99t
be up for a while I suspect = :)

R

On Oct = 4, 2022, at 7:10 AM, Dmitry Chagin <dchagin@heemeyer.club> wrote:

On = Tue, Oct 04, 2022 at 03:57:37AM +0000, Gleb Smirnoff wrote:
The branch main has been = updated by glebius:

URL: https://www.google.com/url?q=3Dhttps://cgit.FreeBSD.org/src/com= mit/?id%3Dfcb3f813f379f544f9cd2a10d18045588da0e132&source=3Dgmail-imap= &ust=3D1665486631000000&usg=3DAOvVaw2VvUECoWSpNqOYdx0tDraU

commit = fcb3f813f379f544f9cd2a10d18045588da0e132
Author: =     Gleb Smirnoff <glebius@FreeBSD.org>
AuthorDate: = 2022-10-04 03:53:04 +0000
Commit: =     Gleb Smirnoff <glebius@FreeBSD.org>
CommitDate: = 2022-10-04 03:53:04 +0000

=    netinet*: remove PRC_ constants and streamline ICMP = processing

   In the = original design of the network stack from the protocol control
   input method pr_ctlinput was used notify = the protocols about two very
   different = kinds of events: internal system events and receival of an
=    ICMP messages from outside.  These events were = coded with PRC_ codes.
   Today these = methods are removed from the protosw(9) and are isolated
=    to IPv4 and IPv6 stacks and are called only from = icmp*_input().  The
   PRC_ codes now = just create a shim layer between ICMP codes and errors
=    or actions taken by protocols.

   - Change ipproto_ctlinput_t to pass just = pointer to ICMP header.  This
=      allows protocols to not deduct it from the = internal IP header.
   - Change = ip6proto_ctlinput_t to pass just struct ip6ctlparam pointer.
     It has all the information = needed to the protocols.  In the structure,
=      change ip6c_finaldst fields to = sockaddr_in6.  The reason is that
=      icmp6_input() already has this address = wrapped in sockaddr, and the
=      protocols want this address as = sockaddr.
   - For UDP tunneling control = input, as well as for IPSEC control input,
=      change the prototypes to accept a = transparent union of either ICMP
=      header pointer or struct ip6ctlparam = pointer.
   - In icmp_input() and = icmp6_input() do only validation of ICMP header and
=      count bad packets.  The translation = of ICMP codes to errors/actions is
=      done by protocols.
=    - Provide icmp_errmap() and icmp6_errmap() as = substitute to inetctlerrmap,
=      inet6ctlerrmap arrays.
=    - In protocol ctlinput methods either trust what = icmp_errmap() recommend,
     or = do our own logic based on the ICMP header.

=    Differential revision:  https://www.google.com/url?q=3Dhttps://reviews.freebsd.org/D367= 31&source=3Dgmail-imap&ust=3D1665486631000000&usg=3DAOvVaw1JtS= 6e8srYG7hprLpt68zn
---
= sys/netinet/icmp6.h =          |   1 = +
sys/netinet/in_var.h =         |   2 -
sys/netinet/ip_icmp.c =        | 106 = +++++++++++++++++++----------------
sys/netinet/ip_icmp.h =        |   1 +
= sys/netinet/ip_input.c       |  17 = ------
sys/netinet/ip_var.h =         |   3 +-
sys/netinet/raw_ip.c =         |  11 +---
sys/netinet/sctp_usrreq.c    |  10 = ++--
sys/netinet/sctp_var.h =       |   2 +-
= sys/netinet/sctputil.c       |  13 = ++---
sys/netinet/tcp_subr.c =       | 128 = +++++++++++++++++++++++++------------------
= sys/netinet/udp_usrreq.c     |  24 ++++----
sys/netinet/udp_var.h =        |   6 +-
sys/netinet6/icmp6.c =         | 100 = ++++++++++++++++++---------------
sys/netinet6/in6_pcb.c =       |  26 +--------
= sys/netinet6/in6_var.h       | =   1 -
sys/netinet6/ip6_input.c =     |  20 -------
= sys/netinet6/ip6_var.h       |  11 = ++--
sys/netinet6/raw_ip6.c =       |  31 ++---------
= sys/netinet6/sctp6_usrreq.c  |   8 +--
= sys/netinet6/udp6_usrreq.c   |  26 ++++-----
= sys/netipsec/ipsec_input.c   |  24 ++++----
= sys/netipsec/ipsec_support.h |  17 ++++--
= sys/sys/protosw.h =            | =  43 ---------------
24 files changed, 274 = insertions(+), 357 deletions(-)

diff --git = a/sys/netinet/icmp6.h b/sys/netinet/icmp6.h
index = 9628c0957c4a..7429b8173b6a 100644
--- = a/sys/netinet/icmp6.h
+++ b/sys/netinet/icmp6.h
@@ -701,6 +701,7 @@ struct rttimer;
= struct = in6_multi;
# endif
void = icmp6_paramerror(struct mbuf *, int);
+int = icmp6_errmap(const struct icmp6_hdr *);
void = icmp6_error(struct mbuf *, int, int, int);
= void = icmp6_error2(struct mbuf *, int, int, int, struct ifnet *);
int = icmp6_input(struct mbuf **, int *, int);
diff --git = a/sys/netinet/in_var.h b/sys/netinet/in_var.h
index = 40e1c1a23c40..c4cfeea66ba8 100644
--- = a/sys/netinet/in_var.h
+++ b/sys/netinet/in_var.h
@@ -100,8 +100,6 @@ struct in_ifaddr {
#define = IN_LNAOF(in, ifa) \
((ntohl((in).s_addr) & = ~((struct in_ifaddr *)(ifa)->ia_subnetmask))

-extern u_char = inetctlerrmap[];
-
#define = LLTABLE(ifp) = \
((struct in_ifinfo = *)(ifp)->if_afdata[AF_INET])->ii_llt
/*
diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c
index f0cc703c2757..fdde24fd94be 100644
--- = a/sys/netinet/ip_icmp.c
+++ b/sys/netinet/ip_icmp.c
@@ -403,6 +403,55 @@ freeit:
= m_freem(n);
}

+int
+icmp_errmap(const struct icmp *icp)
+{
+
+ switch (icp->icmp_type) {
+ = case ICMP_UNREACH:
+ switch (icp->icmp_code) {
+ = = case ICMP_UNREACH_NET:
+ case = ICMP_UNREACH_HOST:
+ case ICMP_UNREACH_SRCFAIL:
+ = = case ICMP_UNREACH_NET_UNKNOWN:
+ case = ICMP_UNREACH_HOST_UNKNOWN:
+ case ICMP_UNREACH_ISOLATED:
+ = = case ICMP_UNREACH_TOSNET:
+ case = ICMP_UNREACH_TOSHOST:
+ case = ICMP_UNREACH_HOST_PRECEDENCE:
+ case = ICMP_UNREACH_PRECEDENCE_CUTOFF:
+ return = (EHOSTUNREACH);
+ case ICMP_UNREACH_NEEDFRAG:
+ = = = return (EMSGSIZE);
+ case ICMP_UNREACH_PROTOCOL:
+ = = case ICMP_UNREACH_PORT:
+ case = ICMP_UNREACH_NET_PROHIB:
+ case ICMP_UNREACH_HOST_PROHIB:
+ = = case ICMP_UNREACH_FILTER_PROHIB:
+ return = (ECONNREFUSED);
+ default:
+ return = (0);
+ }
+ case = ICMP_TIMXCEED:
+ switch (icp->icmp_code) {
+ = = case ICMP_TIMXCEED_INTRANS:
+ return = (EHOSTUNREACH);
+ default:
+ return = (0);
+ }
+ case = ICMP_PARAMPROB:
+ switch (icp->icmp_code) {
+ = = case ICMP_PARAMPROB_ERRATPTR:
+ case = ICMP_PARAMPROB_OPTABSENT:
+ return (ENOPROTOOPT);
+ = = default:
+ return (0);
+ }
+ = default:
+ return (0);
+ }
+}
+
/*
 * = Process a received ICMP message.
 */
@@ = -484,56 +533,21 @@ icmp_input(struct mbuf **mp, int *offp, int proto)
= code =3D icp->icmp_code;
switch = (icp->icmp_type) {
case ICMP_UNREACH:
- = = switch (code) {
- case ICMP_UNREACH_NET:
- = = = case ICMP_UNREACH_HOST:
- case = ICMP_UNREACH_SRCFAIL:
- case ICMP_UNREACH_NET_UNKNOWN:
- = = = case ICMP_UNREACH_HOST_UNKNOWN:
- case = ICMP_UNREACH_ISOLATED:
- case ICMP_UNREACH_TOSNET:
- = = = case ICMP_UNREACH_TOSHOST:
- case = ICMP_UNREACH_HOST_PRECEDENCE:
- case = ICMP_UNREACH_PRECEDENCE_CUTOFF:
- code =3D = PRC_UNREACH_NET;
- break;
-
- = = = case ICMP_UNREACH_NEEDFRAG:
- code =3D = PRC_MSGSIZE;
- break;
-
- = = = /*
- * RFC 1122, Sections 3.2.2.1 and = 4.2.3.9.
- * Treat subcodes 2,3 as = immediate RST
- */
- case = ICMP_UNREACH_PROTOCOL:
- code =3D PRC_UNREACH_PROTOCOL;
- = = = = break;
- case ICMP_UNREACH_PORT:
- = = = = code =3D PRC_UNREACH_PORT;
- break;
-
- case ICMP_UNREACH_NET_PROHIB:
- = = = case ICMP_UNREACH_HOST_PROHIB:
- case = ICMP_UNREACH_FILTER_PROHIB:
- code =3D = PRC_UNREACH_ADMIN_PROHIB;
- break;
-
- = = = default:
- goto badcode;
- }
- = = goto deliver;
+ if (code > = ICMP_UNREACH_PRECEDENCE_CUTOFF)
+ goto = badcode;
+ else
+ goto = deliver;

case ICMP_TIMXCEED:
- = = if (code > 1)
+ if (code > = ICMP_TIMXCEED_REASS)
goto badcode;
- code +=3D = PRC_TIMXCEED_INTRANS;
- goto deliver;
+ else
+ = = = goto deliver;

case = ICMP_PARAMPROB:
- if (code > 1)
+ = = if (code > ICMP_PARAMPROB_LENGTH)
goto = badcode;
- code =3D PRC_PARAMPROB;
+
deliver:
/*
= = * Problem with datagram; advise higher level routines.
@@ -553,7 +567,6 @@ icmp_input(struct mbuf **mp, int *offp, = int proto)
if (icmpprintfs)
= = = = printf("deliver to protocol %d\n", icp->icmp_ip.ip_p);
#endif
- icmpsrc.sin_addr =3D = icp->icmp_ip.ip_dst;
/*
* XXX if = the packet contains [IPv4 AH TCP], we can't make a
* = notification to TCP layer.
@@ -576,8 +589,7 @@ = icmp_input(struct mbuf **mp, int *offp, int proto)
* =   ICMP_ADVLENPREF. See its definition in ip_icmp.h.
= = */
if = (ip_ctlprotox[icp->icmp_ip.ip_p] !=3D NULL)
- = ip_ctlprotox[icp->icmp_ip.ip_p](code, &icmpsrc,
- = = =    &icp->icmp_ip);
+ = ip_ctlprotox[icp->icmp_ip.ip_p](icp);
break;

badcode:
diff --git = a/sys/netinet/ip_icmp.h b/sys/netinet/ip_icmp.h
index = 0303a09509c7..fefece665a00 100644
--- = a/sys/netinet/ip_icmp.h
+++ b/sys/netinet/ip_icmp.h
@@ -216,6 +216,7 @@ struct icmp {
(type) =3D=3D= ICMP_MASKREQ || (type) =3D=3D ICMP_MASKREPLY)

#ifdef _KERNEL
+int = icmp_errmap(const struct icmp *);
void = icmp_error(struct mbuf *, int, int, uint32_t, int);
= int = icmp_input(struct mbuf **, int *, int);
int = ip_next_mtu(int, int);
diff --git = a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index = 145c4464b855..88fd4f5e4def 100644
--- = a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -873,23 +873,6 @@ ipproto_unregister(uint8_t proto)
= = return (ENOENT);
}

-/* = (x) - issued by icmp_input() */
-u_char = inetctlerrmap[PRC_NCMDS] =3D {
- = [PRC_MSGSIZE] =3D EMSGSIZE, /* (x) */
- = [PRC_HOSTDEAD] =3D EHOSTDOWN,
- = [PRC_HOSTUNREACH] =3D EHOSTUNREACH,
- = [PRC_UNREACH_NET] =3D EHOSTUNREACH, /* (x) */
- = [PRC_UNREACH_HOST] =3D EHOSTUNREACH,
- = [PRC_UNREACH_PROTOCOL] =3D ECONNREFUSED, /* (x) = */
- [PRC_UNREACH_PORT] =3D = ECONNREFUSED, = = /* (x) */
- [12] =3D EMSGSIZE,
- = [PRC_UNREACH_SRCFAIL] =3D EHOSTUNREACH,
- = [PRC_TIMXCEED_INTRANS] =3D EHOSTUNREACH, /* (x) = */
- [PRC_TIMXCEED_REASS] =3D 0, /* (x) = */
- [PRC_PARAMPROB] =3D = ENOPROTOOPT, = = = /* (x) */
- [PRC_UNREACH_ADMIN_PROHIB] =3D = ECONNREFUSED, = /* (x) */
-};
-
/*
 * Forward a packet.  If some error occurs return = the sender
 * an icmp packet.  Note we can't = always generate a meaningful
diff --git = a/sys/netinet/ip_var.h b/sys/netinet/ip_var.h
index = 070c82677150..0a2d915b12b3 100644
--- = a/sys/netinet/ip_var.h
+++ b/sys/netinet/ip_var.h
@@ -238,7 +238,8 @@ extern void (*ip_rsvp_force_done)(struct = socket *);
extern int (*rsvp_input_p)(struct mbuf **, = int *, int);

typedef int = ipproto_input_t(struct mbuf **, int *, int);
-typedef= void = ipproto_ctlinput_t(int, struct sockaddr_in *, struct ip *);
+struct icmp;
+typedef void = ipproto_ctlinput_t(struct icmp *);
int = ipproto_register(uint8_t, ipproto_input_t, = ipproto_ctlinput_t);
int ipproto_unregister(uint8_t);
#define IPPROTO_REGISTER(prot, input, = ctl) = do { = = = \
diff --git a/sys/netinet/raw_ip.c = b/sys/netinet/raw_ip.c
index fb692e0822cf..2065b47883bb = 100644
--- a/sys/netinet/raw_ip.c
+++ = b/sys/netinet/raw_ip.c
@@ -804,17 +804,12 @@ = rip_ctloutput(struct socket *so, struct sockopt *sopt)
= }

void
-rip_ctlinput(int = cmd, struct sockaddr_in *sin, struct ip *ip)
+rip_ctlinput(struct icmp *icmp)
{
-
- switch (cmd) {
#if = defined(IPSEC) || defined(IPSEC_SUPPORT)
- case = PRC_MSGSIZE:
- if (IPSEC_ENABLED(ipv4))
- = = = IPSEC_CTLINPUT(ipv4, cmd, (struct sockaddr *)sin, ip);
- = = break;
+ if (IPSEC_ENABLED(ipv4))
+ = = IPSEC_CTLINPUT(ipv4, icmp);
#endif

hi,

me/dchagin/freebsd/sys/netinet/raw_ip.c:811:3: error: too few = arguments
to function call, expected 4, have 2
=             &n= bsp;  IPSEC_CTLINPUT(ipv4, icmp);

/home/dchagin/freebsd/sys/netipsec/ipsec_support.h:222:61: = note:
expanded from macro 'IPSEC_CTLINPUT'
=    ipsec_kmod_ctlinput(proto ## _ipsec_support, = __VA_ARGS__)


/home/dchagin/freebsd/sys/netipsec/ipsec_support.h:196:5: = note:
'ipsec_kmod_ctlinput' declared here
int = ipsec_kmod_ctlinput(struct ipsec_support * const, int,


1 error generated.
*** = [raw_ip.o] Error code 1



------
Randall = Stewart



= --Apple-Mail=_FE64714B-3FA1-431C-B3A8-2221B729D6F9-- --Apple-Mail=_98AE2EC2-43A2-4380-8D04-F61A7835F5FE Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCAzYw ggMyMIICGqADAgECAgqxywKqrHPB2ybTMA0GCSqGSIb3DQEBCwUAMEcxGDAWBgNVBAMTD1JhbmRh bGwgU3Rld2FydDEeMBwGCSqGSIb3DQEJARYPcnJzQG5ldGZsaXguY29tMQswCQYDVQQGEwJVUzAe Fw0yMTAxMjQxMjIwMTRaFw0yNjAxMjQxMjIwMTRaMEcxGDAWBgNVBAMTD1JhbmRhbGwgU3Rld2Fy dDEeMBwGCSqGSIb3DQEJARYPcnJzQG5ldGZsaXguY29tMQswCQYDVQQGEwJVUzCCASIwDQYJKoZI hvcNAQEBBQADggEPADCCAQoCggEBAMUAht2nr/NFlK+tmmN9PdO3DBPfeYh9fLcbVihR+/dipO41 AsFy9y+2uDVaFhTEvp406P0o9PQQTuYXqrCr76eWQIj3V787e1WKjTup1mIyQeWHGf1gvb/7vmI2 zHg6QZEIC4W8xeO8SLKyHiwlFHZn8Rn1HxtB7Ge+NulygkgUgJYhXD5E29jVGXAc6Qn9Vr9AexPf KaOhHCaNB/Twcinayz6D8CO/Ym1LOs3+ceSOa4cB07fepmbqDSXDkOeA3U7KLaluHrRTlj6DO+JU nqKXX7jJ68KTYSZ0qH4fZsk8cxFkwYI/3HDJi+oF+FDkf7SRo1Q2w+e3M/5MReLIQ7sCAwEAAaMg MB4wDwYJKoZIhvcvAQEKBAIFADALBgNVHQ8EBAMCB4AwDQYJKoZIhvcNAQELBQADggEBAHJfum1j 1WIVFjOJT/hqMIN751aXkablmwesW94lNJKjslPULbbcP5nZGg2lGpHcZ+0I5F/1TTiEsT2H2rhA uAnSsUxTpxRA+aoe+xtJOa5vle3CprhFkHAvB7EIoLiNaPd0DNK6kKYsbvr5Z5Eq7TF3SIO77Qh9 /8VgUfOb0ARDgix59Q6MM0NmIabEwh0cDWQYlGgDDtN9DNk5PGM4pjs48suwEdLmFTMOmGTkCp7I Vq6iHDNinBiB6+BB4VYMAO1o9qS+0pnfdmPJybt0zVGrhm/c1Fmm3Jec7NEuiKeXmhPIwdwMkKyp AsX0sHuFCYwioBTHHZpvnir+H2rRakgxggHrMIIB5wIBATBVMEcxGDAWBgNVBAMTD1JhbmRhbGwg U3Rld2FydDEeMBwGCSqGSIb3DQEJARYPcnJzQG5ldGZsaXguY29tMQswCQYDVQQGEwJVUwIKscsC qqxzwdsm0zANBglghkgBZQMEAgEFAKBpMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTIyMTAwNDExMTI0N1owLwYJKoZIhvcNAQkEMSIEIOR9Xq0Gp/1l+/ZWDQSgltZ0 RS1v87SihMrisUa59PmlMA0GCSqGSIb3DQEBCwUABIIBAGbRtQmlzC94YDqCXha1YWZEBmStT0M3 fNV5wpf6cOJn7ElrwjquiuWUQwhAHtL5NlJhZZJvNktCjxcca9PTeuq4hHWZj7Cal2LiVAvl0AyB twNgY/s61jvjYC0hkSOvkb5OpCOja4Dd3B8sGfZDGnOVGL/LiSNnURlofyAZAM8lGEwv3xnwWN+M RfpopcjQj4oZVPe0+h9jo4kZa8Z+MP6sUS+c4xopo3vxRLtVA60RB9Zu48ovhL4ZIPfUGwwG3s5k 6HjGT3ANv3evgpLusv+EtzBOidIpocrUpZt0a7pkibQ5lxqWy6lUZ4T5CnXD7FHeu0jkC2/Zup+T 5A+HbJoAAAAAAAA= --Apple-Mail=_98AE2EC2-43A2-4380-8D04-F61A7835F5FE--