Merge remote-tracking branch 'origin/stable/10' into devel

3 files changed, 28 insertions, 4 deletions

diff --git a/sys/net/if_gif.c b/sys/net/if_gif.c
index f2a38c1..589fa3f 100644
--- a/sys/net/if_gif.c
+++ b/sys/net/if_gif.c
@@ -196,6 +196,8 @@ gif_clone_create(struct if_clone *ifc, int unit, caddr_t params)
 	GIF2IFP(sc)->if_transmit  = gif_transmit;
 	GIF2IFP(sc)->if_qflush  = gif_qflush;
 	GIF2IFP(sc)->if_output = gif_output;
+	GIF2IFP(sc)->if_capabilities |= IFCAP_LINKSTATE;
+	GIF2IFP(sc)->if_capenable |= IFCAP_LINKSTATE;
 	if_attach(GIF2IFP(sc));
 	bpfattach(GIF2IFP(sc), DLT_NULL, sizeof(u_int32_t));
 	if (ng_gif_attach_p != NULL)
@@ -1038,10 +1040,13 @@ gif_set_tunnel(struct ifnet *ifp, struct sockaddr *src, struct sockaddr *dst)
 #if defined(INET) || defined(INET6)
 bad:
 #endif
-	if (error == 0 && sc->gif_family != 0)
+	if (error == 0 && sc->gif_family != 0) {
 		ifp->if_drv_flags |= IFF_DRV_RUNNING;
-	else
+		if_link_state_change(ifp, LINK_STATE_UP);
+	} else {
 		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
+		if_link_state_change(ifp, LINK_STATE_DOWN);
+	}
 	return (error);
 }
 
@@ -1063,4 +1068,5 @@ gif_delete_tunnel(struct ifnet *ifp)
 		free(sc->gif_hdr, M_GIF);
 	}
 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
+	if_link_state_change(ifp, LINK_STATE_DOWN);
 }
diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c
index 3e2d826..17a324c 100644
--- a/sys/net/if_gre.c
+++ b/sys/net/if_gre.c
@@ -179,6 +179,8 @@ gre_clone_create(struct if_clone *ifc, int unit, caddr_t params)
 	GRE2IFP(sc)->if_ioctl = gre_ioctl;
 	GRE2IFP(sc)->if_transmit = gre_transmit;
 	GRE2IFP(sc)->if_qflush = gre_qflush;
+	GRE2IFP(sc)->if_capabilities |= IFCAP_LINKSTATE;
+	GRE2IFP(sc)->if_capenable |= IFCAP_LINKSTATE;
 	if_attach(GRE2IFP(sc));
 	bpfattach(GRE2IFP(sc), DLT_NULL, sizeof(u_int32_t));
 	GRE_LIST_LOCK();
@@ -648,8 +650,10 @@ gre_set_tunnel(struct ifnet *ifp, struct sockaddr *src,
 		break;
 #endif
 	}
-	if (error == 0)
+	if (error == 0) {
 		ifp->if_drv_flags |= IFF_DRV_RUNNING;
+		if_link_state_change(ifp, LINK_STATE_UP);
+	}
 	return (error);
 }
 
@@ -668,6 +672,7 @@ gre_delete_tunnel(struct ifnet *ifp)
 		free(sc->gre_hdr, M_GRE);
 	}
 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
+	if_link_state_change(ifp, LINK_STATE_DOWN);
 }
 
 int
@@ -686,6 +691,14 @@ gre_input(struct mbuf **mp, int *offp, int proto)
 	KASSERT(sc != NULL, ("encap_getarg returned NULL"));
 
 	ifp = GRE2IFP(sc);
+	hlen = *offp + sizeof(struct grehdr) + 4 * sizeof(uint32_t);
+	if (m->m_pkthdr.len < hlen)
+		goto drop;
+	if (m->m_len < hlen) {
+		m = m_pullup(m, hlen);
+		if (m == NULL)
+			goto drop;
+	}
 	gh = (struct grehdr *)mtodo(m, *offp);
 	flags = ntohs(gh->gre_flags);
 	if (flags & ~GRE_FLAGS_MASK)
diff --git a/sys/net/if_me.c b/sys/net/if_me.c
index 1e927a8..effb758 100644
--- a/sys/net/if_me.c
+++ b/sys/net/if_me.c
@@ -193,6 +193,8 @@ me_clone_create(struct if_clone *ifc, int unit, caddr_t params)
 	ME2IFP(sc)->if_ioctl = me_ioctl;
 	ME2IFP(sc)->if_transmit = me_transmit;
 	ME2IFP(sc)->if_qflush = me_qflush;
+	ME2IFP(sc)->if_capabilities |= IFCAP_LINKSTATE;
+	ME2IFP(sc)->if_capenable |= IFCAP_LINKSTATE;
 	if_attach(ME2IFP(sc));
 	bpfattach(ME2IFP(sc), DLT_NULL, sizeof(u_int32_t));
 	ME_LIST_LOCK();
@@ -377,8 +379,10 @@ me_set_tunnel(struct ifnet *ifp, struct sockaddr_in *src,
 	if (sc->me_ecookie == NULL)
 		sc->me_ecookie = encap_attach_func(AF_INET, IPPROTO_MOBILE,
 		    me_encapcheck, &in_mobile_protosw, sc);
-	if (sc->me_ecookie != NULL)
+	if (sc->me_ecookie != NULL) {
 		ifp->if_drv_flags |= IFF_DRV_RUNNING;
+		if_link_state_change(ifp, LINK_STATE_UP);
+	}
 	return (0);
 }
 
@@ -396,6 +400,7 @@ me_delete_tunnel(struct ifnet *ifp)
 	sc->me_dst.s_addr = 0;
 	ME_WUNLOCK(sc);
 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
+	if_link_state_change(ifp, LINK_STATE_DOWN);
 }
 
 static uint16_t