summaryrefslogtreecommitdiffstats
path: root/sys
diff options
context:
space:
mode:
Diffstat (limited to 'sys')
-rw-r--r--sys/netinet/ip_options.c61
-rw-r--r--sys/netinet/ip_options.h1
2 files changed, 62 insertions, 0 deletions
diff --git a/sys/netinet/ip_options.c b/sys/netinet/ip_options.c
index 27b1569..74d54f2 100644
--- a/sys/netinet/ip_options.c
+++ b/sys/netinet/ip_options.c
@@ -683,3 +683,64 @@ bad:
(void)m_free(m);
return (EINVAL);
}
+
+/*
+ * Check for the presence of the IP Router Alert option [RFC2113]
+ * in the header of an IPv4 datagram.
+ *
+ * This call is not intended for use from the forwarding path; it is here
+ * so that protocol domains may check for the presence of the option.
+ * Given how FreeBSD's IPv4 stack is currently structured, the Router Alert
+ * option does not have much relevance to the implementation, though this
+ * may change in future.
+ * Router alert options SHOULD be passed if running in IPSTEALTH mode and
+ * we are not the endpoint.
+ * Length checks on individual options should already have been peformed
+ * by ip_dooptions() therefore they are folded under INVARIANTS here.
+ *
+ * Return zero if not present or options are invalid, non-zero if present.
+ */
+int
+ip_checkrouteralert(struct mbuf *m)
+{
+ struct ip *ip = mtod(m, struct ip *);
+ u_char *cp;
+ int opt, optlen, cnt, found_ra;
+
+ found_ra = 0;
+ cp = (u_char *)(ip + 1);
+ cnt = (ip->ip_hl << 2) - sizeof (struct ip);
+ for (; cnt > 0; cnt -= optlen, cp += optlen) {
+ opt = cp[IPOPT_OPTVAL];
+ if (opt == IPOPT_EOL)
+ break;
+ if (opt == IPOPT_NOP)
+ optlen = 1;
+ else {
+#ifdef INVARIANTS
+ if (cnt < IPOPT_OLEN + sizeof(*cp))
+ break;
+#endif
+ optlen = cp[IPOPT_OLEN];
+#ifdef INVARIANTS
+ if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)
+ break;
+#endif
+ }
+ switch (opt) {
+ case IPOPT_RA:
+#ifdef INVARIANTS
+ if (optlen != IPOPT_OFFSET + sizeof(uint16_t) ||
+ (*((uint16_t *)&cp[IPOPT_OFFSET]) != 0))
+ break;
+ else
+#endif
+ found_ra = 1;
+ break;
+ default:
+ break;
+ }
+ }
+
+ return (found_ra);
+}
diff --git a/sys/netinet/ip_options.h b/sys/netinet/ip_options.h
index 0633fce..7ba5ae6 100644
--- a/sys/netinet/ip_options.h
+++ b/sys/netinet/ip_options.h
@@ -49,6 +49,7 @@ struct ipopt_tag {
extern int ip_doopts; /* process or ignore IP options */
+int ip_checkrouteralert(struct mbuf *);
int ip_dooptions(struct mbuf *, int);
struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *);
int ip_optcopy(struct ip *, struct ip *);
OpenPOWER on IntegriCloud