add ECN support in layer-3.

 - implement the tunnel egress rule in ip_ecn_egress() in ip_ecn.c.
   make ip{,6}_ecn_egress() return integer to tell the caller that
   this packet should be dropped.
 - handle ECN at fragment reassembly in ip_input.c and frag6.c.

Obtained from:	KAME

1 files changed, 15 insertions, 13 deletions

diff --git a/sys/netinet6/in6_gif.c b/sys/netinet6/in6_gif.c
index fae8a98..e3cd124 100644
--- a/sys/netinet6/in6_gif.c
+++ b/sys/netinet6/in6_gif.c
@@ -168,11 +168,9 @@ in6_gif_output(ifp, family, m)
 		m_freem(m);
 		return ENETUNREACH;
 	}
-	if (ifp->if_flags & IFF_LINK1)
-		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
-	else
-		ip_ecn_ingress(ECN_NOCARE, &otos, &itos);
-	ip6->ip6_flow &= ~ntohl(0xff00000);
+	ip_ecn_ingress((ifp->if_flags & IFF_LINK1) ? ECN_ALLOWED : ECN_NOCARE,
+		       &otos, &itos);
+	ip6->ip6_flow &= ~htonl(0xff << 20);
 	ip6->ip6_flow |= htonl((u_int32_t)otos << 20);
 
 	if (dst->sin6_family != sin6_dst->sin6_family ||
@@ -259,10 +257,12 @@ in6_gif_input(mp, offp, proto)
 				return IPPROTO_DONE;
 		}
 		ip = mtod(m, struct ip *);
-		if (gifp->if_flags & IFF_LINK1)
-			ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos);
-		else
-			ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos);
+		if (ip_ecn_egress((gifp->if_flags & IFF_LINK1) ?
+				  ECN_ALLOWED : ECN_NOCARE,
+				  &otos8, &ip->ip_tos) == 0) {
+			m_freem(m);
+			return IPPROTO_DONE;
+		}
 		break;
 	    }
 #endif /* INET */
@@ -277,10 +277,12 @@ in6_gif_input(mp, offp, proto)
 				return IPPROTO_DONE;
 		}
 		ip6 = mtod(m, struct ip6_hdr *);
-		if (gifp->if_flags & IFF_LINK1)
-			ip6_ecn_egress(ECN_ALLOWED, &otos, &ip6->ip6_flow);
-		else
-			ip6_ecn_egress(ECN_NOCARE, &otos, &ip6->ip6_flow);
+		if (ip6_ecn_egress((gifp->if_flags & IFF_LINK1) ?
+				   ECN_ALLOWED : ECN_NOCARE,
+				   &otos, &ip6->ip6_flow) == 0) {
+			m_freem(m);
+			return IPPROTO_DONE;
+		}
 		break;
 	    }
 #endif