[ICMP]: Avoid sparse warnings in net/ipv4/icmp.c

[linux-2.6] / net / ipv4 / icmp.c

diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 82baea026484d6b311986f24db8855dbf184b611..1a6024978e28b3ae84b33f04a1431a9a293e0adf 100644 (file)
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -92,6 +92,7 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 #include <net/checksum.h>
+#include <net/xfrm.h>
 
 /*
  *     Build xmit assembly blocks
@@ -231,7 +232,7 @@ static const struct icmp_control icmp_pointers[NR_ICMP_TYPES+1];
 static DEFINE_PER_CPU(struct socket *, __icmp_socket) = NULL;
 #define icmp_socket    __get_cpu_var(__icmp_socket)
 
-static __inline__ int icmp_xmit_lock(void)
+static inline int icmp_xmit_lock(void)
 {
        local_bh_disable();
 
@@ -245,7 +246,7 @@ static __inline__ int icmp_xmit_lock(void)
        return 0;
 }
 
-static void icmp_xmit_unlock(void)
+static inline void icmp_xmit_unlock(void)
 {
        spin_unlock_bh(&icmp_socket->sk->sk_lock.slock);
 }
@@ -563,11 +564,71 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                                }
                        }
                };
+               int err;
+               struct rtable *rt2;
+
                security_skb_classify_flow(skb_in, &fl);
-               if (ip_route_output_key(&rt, &fl))
+               if (__ip_route_output_key(&rt, &fl))
+                       goto out_unlock;
+
+               /* No need to clone since we're just using its address. */
+               rt2 = rt;
+
+               err = xfrm_lookup((struct dst_entry **)&rt, &fl, NULL, 0);
+               switch (err) {
+               case 0:
+                       if (rt != rt2)
+                               goto route_done;
+                       break;
+               case -EPERM:
+                       rt = NULL;
+                       break;
+               default:
+                       goto out_unlock;
+               }
+
+               if (xfrm_decode_session_reverse(skb_in, &fl, AF_INET))
+                       goto out_unlock;
+
+               if (inet_addr_type(fl.fl4_src) == RTN_LOCAL)
+                       err = __ip_route_output_key(&rt2, &fl);
+               else {
+                       struct flowi fl2 = {};
+                       struct dst_entry *odst;
+
+                       fl2.fl4_dst = fl.fl4_src;
+                       if (ip_route_output_key(&rt2, &fl2))
+                               goto out_unlock;
+
+                       /* Ugh! */
+                       odst = skb_in->dst;
+                       err = ip_route_input(skb_in, fl.fl4_dst, fl.fl4_src,
+                                            RT_TOS(tos), rt2->u.dst.dev);
+
+                       dst_release(&rt2->u.dst);
+                       rt2 = (struct rtable *)skb_in->dst;
+                       skb_in->dst = odst;
+               }
+
+               if (err)
+                       goto out_unlock;
+
+               err = xfrm_lookup((struct dst_entry **)&rt2, &fl, NULL,
+                                 XFRM_LOOKUP_ICMP);
+               if (err == -ENOENT) {
+                       if (!rt)
+                               goto out_unlock;
+                       goto route_done;
+               }
+
+               dst_release(&rt->u.dst);
+               rt = rt2;
+
+               if (err)
                        goto out_unlock;
        }
 
+route_done:
        if (!icmpv4_xrlim_allow(rt, type, code))
                goto ende;
 
@@ -603,7 +664,6 @@ static void icmp_unreach(struct sk_buff *skb)
        struct icmphdr *icmph;
        int hash, protocol;
        struct net_protocol *ipprot;
-       struct sock *raw_sk;
        u32 info = 0;
 
        /*
@@ -697,21 +757,9 @@ static void icmp_unreach(struct sk_buff *skb)
        /*
         *      Deliver ICMP message to raw sockets. Pretty useless feature?
         */
+       raw_icmp_error(skb, protocol, info);
 
-       /* Note: See raw.c and net/raw.h, RAWV4_HTABLE_SIZE==MAX_INET_PROTOS */
        hash = protocol & (MAX_INET_PROTOS - 1);
-       read_lock(&raw_v4_lock);
-       if ((raw_sk = sk_head(&raw_v4_htable[hash])) != NULL) {
-               while ((raw_sk = __raw_v4_lookup(raw_sk, protocol, iph->daddr,
-                                                iph->saddr,
-                                                skb->dev->ifindex)) != NULL) {
-                       raw_err(raw_sk, skb, info);
-                       raw_sk = sk_next(raw_sk);
-                       iph = (struct iphdr *)skb->data;
-               }
-       }
-       read_unlock(&raw_v4_lock);
-
        rcu_read_lock();
        ipprot = rcu_dereference(inet_protos[hash]);
        if (ipprot && ipprot->err_handler)
@@ -929,6 +977,25 @@ int icmp_rcv(struct sk_buff *skb)
        struct icmphdr *icmph;
        struct rtable *rt = (struct rtable *)skb->dst;
 
+       if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
+               int nh;
+
+               if (!(skb->sp && skb->sp->xvec[skb->sp->len - 1]->props.flags &
+                                XFRM_STATE_ICMP))
+                       goto drop;
+
+               if (!pskb_may_pull(skb, sizeof(*icmph) + sizeof(struct iphdr)))
+                       goto drop;
+
+               nh = skb_network_offset(skb);
+               skb_set_network_header(skb, sizeof(*icmph));
+
+               if (!xfrm4_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
+                       goto drop;
+
+               skb_set_network_header(skb, nh);
+       }
+
        ICMP_INC_STATS_BH(ICMP_MIB_INMSGS);
 
        switch (skb->ip_summed) {
@@ -942,8 +1009,7 @@ int icmp_rcv(struct sk_buff *skb)
                        goto error;
        }
 
-       if (!pskb_pull(skb, sizeof(struct icmphdr)))
-               goto error;
+       __skb_pull(skb, sizeof(*icmph));
 
        icmph = icmp_hdr(skb);