| 528 | } |
| 529 | |
| 530 | static int |
| 531 | stf_checkaddr4(struct stf_softc *sc, struct in_addr *in, struct ifnet *inifp) |
| 532 | { |
| 533 | struct rm_priotracker in_ifa_tracker; |
| 534 | struct in_ifaddr *ia4; |
| 535 | |
| 536 | /* |
| 537 | * reject packets with the following address: |
| 538 | * 224.0.0.0/4 0.0.0.0/8 127.0.0.0/8 255.0.0.0/8 |
| 539 | */ |
| 540 | if (IN_MULTICAST(ntohl(in->s_addr))) |
| 541 | return -1; |
| 542 | switch ((ntohl(in->s_addr) & 0xff000000) >> 24) { |
| 543 | case 0: case 127: case 255: |
| 544 | return -1; |
| 545 | } |
| 546 | |
| 547 | /* |
| 548 | * reject packets with private address range. |
| 549 | * (requirement from RFC3056 section 2 1st paragraph) |
| 550 | */ |
| 551 | if (isrfc1918addr(in)) |
| 552 | return -1; |
| 553 | |
| 554 | /* |
| 555 | * reject packets with broadcast |
| 556 | */ |
| 557 | IN_IFADDR_RLOCK(&in_ifa_tracker); |
| 558 | CK_STAILQ_FOREACH(ia4, &V_in_ifaddrhead, ia_link) { |
| 559 | if ((ia4->ia_ifa.ifa_ifp->if_flags & IFF_BROADCAST) == 0) |
| 560 | continue; |
| 561 | if (in->s_addr == ia4->ia_broadaddr.sin_addr.s_addr) { |
| 562 | IN_IFADDR_RUNLOCK(&in_ifa_tracker); |
| 563 | return -1; |
| 564 | } |
| 565 | } |
| 566 | IN_IFADDR_RUNLOCK(&in_ifa_tracker); |
| 567 | |
| 568 | /* |
| 569 | * perform ingress filter |
| 570 | */ |
| 571 | if (sc && (STF2IFP(sc)->if_flags & IFF_LINK2) == 0 && inifp) { |
| 572 | struct nhop_object *nh; |
| 573 | |
| 574 | NET_EPOCH_ASSERT(); |
| 575 | nh = fib4_lookup(sc->sc_fibnum, *in, 0, 0, 0); |
| 576 | if (nh == NULL) |
| 577 | return (-1); |
| 578 | |
| 579 | if (nh->nh_ifp != inifp) |
| 580 | return (-1); |
| 581 | } |
| 582 | |
| 583 | return 0; |
| 584 | } |
| 585 | |
| 586 | static int |
| 587 | stf_checkaddr6(struct stf_softc *sc, struct in6_addr *in6, struct ifnet *inifp) |
no test coverage detected