1 /* $FreeBSD: src/sys/netinet6/ip6_input.c,v 1.11.2.15 2003/01/24 05:11:35 sam Exp $ */
2 /* $DragonFly: src/sys/netinet6/ip6_input.c,v 1.38 2008/09/24 14:26:39 sephe Exp $ */
3 /* $KAME: ip6_input.c,v 1.259 2002/01/21 04:58:09 jinmei Exp $ */
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * Copyright (c) 1982, 1986, 1988, 1993
36 * The Regents of the University of California. All rights reserved.
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
66 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94
69 #include "opt_ip6fw.h"
71 #include "opt_inet6.h"
72 #include "opt_ipsec.h"
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/malloc.h>
78 #include <sys/domain.h>
79 #include <sys/protosw.h>
80 #include <sys/socket.h>
81 #include <sys/socketvar.h>
82 #include <sys/errno.h>
84 #include <sys/kernel.h>
85 #include <sys/syslog.h>
88 #include <sys/thread2.h>
89 #include <sys/msgport2.h>
92 #include <net/if_types.h>
93 #include <net/if_dl.h>
94 #include <net/route.h>
95 #include <net/netisr.h>
98 #include <netinet/in.h>
99 #include <netinet/in_systm.h>
101 #include <netinet/ip.h>
102 #include <netinet/ip_icmp.h>
104 #include <netinet/ip6.h>
105 #include <netinet6/in6_var.h>
106 #include <netinet6/ip6_var.h>
107 #include <netinet/in_pcb.h>
108 #include <netinet/icmp6.h>
109 #include <netinet6/scope6_var.h>
110 #include <netinet6/in6_ifattach.h>
111 #include <netinet6/nd6.h>
112 #include <netinet6/in6_prefix.h>
115 #include <netinet6/ipsec.h>
117 #include <netinet6/ipsec6.h>
122 #include <netproto/ipsec/ipsec.h>
123 #include <netproto/ipsec/ipsec6.h>
125 #endif /* FAST_IPSEC */
127 #include <net/ip6fw/ip6_fw.h>
129 #include <netinet6/ip6protosw.h>
131 /* we need it for NLOOP. */
132 #include "use_loop.h"
134 #include <net/net_osdep.h>
136 extern struct domain inet6domain
;
137 extern struct ip6protosw inet6sw
[];
139 u_char ip6_protox
[IPPROTO_MAX
];
140 struct in6_ifaddr
*in6_ifaddr
;
142 extern struct callout in6_tmpaddrtimer_ch
;
144 int ip6_forward_srcrt
; /* XXX */
145 int ip6_sourcecheck
; /* XXX */
146 int ip6_sourcecheck_interval
; /* XXX */
148 int ip6_ours_check_algorithm
;
150 struct pfil_head inet6_pfil_hook
;
153 ip6_fw_chk_t
*ip6_fw_chk_ptr
;
154 ip6_fw_ctl_t
*ip6_fw_ctl_ptr
;
155 int ip6_fw_enable
= 1;
157 struct ip6stat ip6stat
;
159 static void ip6_init2 (void *);
160 static struct ip6aux
*ip6_setdstifaddr (struct mbuf
*, struct in6_ifaddr
*);
161 static int ip6_hopopts_input (u_int32_t
*, u_int32_t
*, struct mbuf
**, int *);
162 static void ip6_input(struct netmsg
*msg
);
164 static struct mbuf
*ip6_pullexthdr (struct mbuf
*, size_t, int);
168 * IP6 initialization: fill in IP6 protocol switch table.
169 * All protocols not implemented in kernel go to raw IP6 protocol handler.
174 struct ip6protosw
*pr
;
179 if (sizeof(struct protosw
) != sizeof(struct ip6protosw
))
180 panic("sizeof(protosw) != sizeof(ip6protosw)");
182 pr
= (struct ip6protosw
*)pffindproto(PF_INET6
, IPPROTO_RAW
, SOCK_RAW
);
185 for (i
= 0; i
< IPPROTO_MAX
; i
++)
186 ip6_protox
[i
] = pr
- inet6sw
;
187 for (pr
= (struct ip6protosw
*)inet6domain
.dom_protosw
;
188 pr
< (struct ip6protosw
*)inet6domain
.dom_protoswNPROTOSW
; pr
++)
189 if (pr
->pr_domain
->dom_family
== PF_INET6
&&
190 pr
->pr_protocol
&& pr
->pr_protocol
!= IPPROTO_RAW
)
191 ip6_protox
[pr
->pr_protocol
] = pr
- inet6sw
;
193 inet6_pfil_hook
.ph_type
= PFIL_TYPE_AF
;
194 inet6_pfil_hook
.ph_af
= AF_INET6
;
195 if ((i
= pfil_head_register(&inet6_pfil_hook
)) != 0) {
196 kprintf("%s: WARNING: unable to register pfil hook, "
197 "error %d\n", __func__
, i
);
200 netisr_register(NETISR_IPV6
, cpu0_portfn
, ip6_input
,
201 NETISR_FLAG_NOTMPSAFE
);
203 addrsel_policy_init();
207 * in many cases, random() here does NOT return random number
208 * as initialization during bootstrap time occur in fixed order.
211 ip6_flow_seq
= krandom() ^ tv
.tv_usec
;
213 ip6_desync_factor
= (krandom() ^ tv
.tv_usec
) % MAX_TEMP_DESYNC_FACTOR
;
217 ip6_init2(void *dummy
)
220 callout_init(&nd6_timer_ch
);
221 callout_reset(&nd6_timer_ch
, hz
, nd6_timer
, NULL
);
223 /* router renumbering prefix list maintenance */
224 callout_init(&in6_rr_timer_ch
);
225 callout_reset(&in6_rr_timer_ch
, hz
, in6_rr_timer
, NULL
);
227 /* timer for regeneranation of temporary addresses randomize ID */
228 callout_init(&in6_tmpaddrtimer_ch
);
229 callout_reset(&in6_tmpaddrtimer_ch
,
230 (ip6_temp_preferred_lifetime
- ip6_desync_factor
-
231 ip6_temp_regen_advance
) * hz
,
232 in6_tmpaddrtimer
, NULL
);
236 /* This must be after route_init(), which is now SI_ORDER_THIRD */
237 SYSINIT(netinet6init2
, SI_SUB_PROTO_DOMAIN
, SI_ORDER_MIDDLE
, ip6_init2
, NULL
);
239 extern struct route_in6 ip6_forward_rt
;
243 ip6_input(struct netmsg
*msg
)
245 struct mbuf
*m
= ((struct netmsg_packet
*)msg
)->nm_packet
;
247 int off
= sizeof(struct ip6_hdr
), nest
;
249 u_int32_t rtalert
= ~0;
250 int nxt
, ours
= 0, rh_present
= 0;
251 struct ifnet
*deliverifp
= NULL
;
252 struct in6_addr odst
;
257 * should the inner packet be considered authentic?
258 * see comment in ah4_input().
261 m
->m_flags
&= ~M_AUTHIPHDR
;
262 m
->m_flags
&= ~M_AUTHIPDGM
;
267 * make sure we don't have onion peering information into m_aux.
274 if (m
->m_flags
& M_EXT
) {
276 ip6stat
.ip6s_mext2m
++;
278 ip6stat
.ip6s_mext1
++;
280 #define M2MMAX (sizeof(ip6stat.ip6s_m2m)/sizeof(ip6stat.ip6s_m2m[0]))
282 if (m
->m_flags
& M_LOOP
) {
283 ip6stat
.ip6s_m2m
[loif
[0].if_index
]++; /* XXX */
284 } else if (m
->m_pkthdr
.rcvif
->if_index
< M2MMAX
)
285 ip6stat
.ip6s_m2m
[m
->m_pkthdr
.rcvif
->if_index
]++;
287 ip6stat
.ip6s_m2m
[0]++;
293 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_receive
);
294 ip6stat
.ip6s_total
++;
296 #ifndef PULLDOWN_TEST
298 * L2 bridge code and some other code can return mbuf chain
299 * that does not conform to KAME requirement. too bad.
300 * XXX: fails to join if interface MTU > MCLBYTES. jumbogram?
302 if (m
&& m
->m_next
!= NULL
&& m
->m_pkthdr
.len
< MCLBYTES
) {
305 n
= m_getb(m
->m_pkthdr
.len
, MB_DONTWAIT
, MT_HEADER
, M_PKTHDR
);
310 m_copydata(m
, 0, n
->m_pkthdr
.len
, mtod(n
, caddr_t
));
311 n
->m_len
= n
->m_pkthdr
.len
;
315 IP6_EXTHDR_CHECK_VOIDRET(m
, 0, sizeof(struct ip6_hdr
));
318 if (m
->m_len
< sizeof(struct ip6_hdr
)) {
320 inifp
= m
->m_pkthdr
.rcvif
;
321 if ((m
= m_pullup(m
, sizeof(struct ip6_hdr
))) == 0) {
322 ip6stat
.ip6s_toosmall
++;
323 in6_ifstat_inc(inifp
, ifs6_in_hdrerr
);
328 ip6
= mtod(m
, struct ip6_hdr
*);
330 if ((ip6
->ip6_vfc
& IPV6_VERSION_MASK
) != IPV6_VERSION
) {
331 ip6stat
.ip6s_badvers
++;
332 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
337 * Run through list of hooks for input packets.
339 * NB: Beware of the destination address changing
340 * (e.g. by NAT rewriting). When this happens,
341 * tell ip6_forward to do the right thing.
343 if (pfil_has_hooks(&inet6_pfil_hook
)) {
345 if (pfil_run_hooks(&inet6_pfil_hook
, &m
,
346 m
->m_pkthdr
.rcvif
, PFIL_IN
)) {
349 if (m
== NULL
) /* consumed by filter */
351 ip6
= mtod(m
, struct ip6_hdr
*);
352 srcrt
= !IN6_ARE_ADDR_EQUAL(&odst
, &ip6
->ip6_dst
);
355 ip6stat
.ip6s_nxthist
[ip6
->ip6_nxt
]++;
358 if (altq_input
!= NULL
&& (*altq_input
)(m
, AF_INET6
) == 0) {
359 /* packet is dropped by traffic conditioner */
365 * Check with the firewall...
367 if (ip6_fw_enable
&& ip6_fw_chk_ptr
) {
369 /* If ipfw says divert, we have to just drop packet */
370 /* use port as a dummy argument */
371 if ((*ip6_fw_chk_ptr
)(&ip6
, NULL
, &port
, &m
)) {
380 * Check against address spoofing/corruption.
382 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_src
) ||
383 IN6_IS_ADDR_UNSPECIFIED(&ip6
->ip6_dst
)) {
385 * XXX: "badscope" is not very suitable for a multicast source.
387 ip6stat
.ip6s_badscope
++;
388 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
391 if ((IN6_IS_ADDR_LOOPBACK(&ip6
->ip6_src
) ||
392 IN6_IS_ADDR_LOOPBACK(&ip6
->ip6_dst
)) &&
393 (m
->m_pkthdr
.rcvif
->if_flags
& IFF_LOOPBACK
) == 0) {
394 ip6stat
.ip6s_badscope
++;
395 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
400 * The following check is not documented in specs. A malicious
401 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
402 * and bypass security checks (act as if it was from 127.0.0.1 by using
403 * IPv6 src ::ffff:127.0.0.1). Be cautious.
405 * This check chokes if we are in an SIIT cloud. As none of BSDs
406 * support IPv4-less kernel compilation, we cannot support SIIT
407 * environment at all. So, it makes more sense for us to reject any
408 * malicious packets for non-SIIT environment, than try to do a
409 * partical support for SIIT environment.
411 if (IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_src
) ||
412 IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_dst
)) {
413 ip6stat
.ip6s_badscope
++;
414 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
419 * Reject packets with IPv4 compatible addresses (auto tunnel).
421 * The code forbids auto tunnel relay case in RFC1933 (the check is
422 * stronger than RFC1933). We may want to re-enable it if mech-xx
423 * is revised to forbid relaying case.
425 if (IN6_IS_ADDR_V4COMPAT(&ip6
->ip6_src
) ||
426 IN6_IS_ADDR_V4COMPAT(&ip6
->ip6_dst
)) {
427 ip6stat
.ip6s_badscope
++;
428 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
433 /* drop packets if interface ID portion is already filled */
434 if ((m
->m_pkthdr
.rcvif
->if_flags
& IFF_LOOPBACK
) == 0) {
435 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_src
) &&
436 ip6
->ip6_src
.s6_addr16
[1]) {
437 ip6stat
.ip6s_badscope
++;
440 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_dst
) &&
441 ip6
->ip6_dst
.s6_addr16
[1]) {
442 ip6stat
.ip6s_badscope
++;
447 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_src
))
448 ip6
->ip6_src
.s6_addr16
[1]
449 = htons(m
->m_pkthdr
.rcvif
->if_index
);
450 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_dst
))
451 ip6
->ip6_dst
.s6_addr16
[1]
452 = htons(m
->m_pkthdr
.rcvif
->if_index
);
454 #if 0 /* this case seems to be unnecessary. (jinmei, 20010401) */
456 * We use rt->rt_ifp to determine if the address is ours or not.
457 * If rt_ifp is lo0, the address is ours.
458 * The problem here is, rt->rt_ifp for fe80::%lo0/64 is set to lo0,
459 * so any address under fe80::%lo0/64 will be mistakenly considered
460 * local. The special case is supplied to handle the case properly
461 * by actually looking at interface addresses
462 * (using in6ifa_ifpwithaddr).
464 if ((m
->m_pkthdr
.rcvif
->if_flags
& IFF_LOOPBACK
) &&
465 IN6_IS_ADDR_LINKLOCAL(&ip6
->ip6_dst
)) {
466 if (!in6ifa_ifpwithaddr(m
->m_pkthdr
.rcvif
, &ip6
->ip6_dst
)) {
467 icmp6_error(m
, ICMP6_DST_UNREACH
,
468 ICMP6_DST_UNREACH_ADDR
, 0);
469 /* m is already freed */
474 deliverifp
= m
->m_pkthdr
.rcvif
;
482 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
)) {
483 struct in6_multi
*in6m
= 0;
485 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_mcast
);
487 * See if we belong to the destination multicast group on the
490 IN6_LOOKUP_MULTI(ip6
->ip6_dst
, m
->m_pkthdr
.rcvif
, in6m
);
493 else if (!ip6_mrouter
) {
494 ip6stat
.ip6s_notmember
++;
495 ip6stat
.ip6s_cantforward
++;
496 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
499 deliverifp
= m
->m_pkthdr
.rcvif
;
506 switch (ip6_ours_check_algorithm
) {
509 * XXX: I intentionally broke our indentation rule here,
510 * since this switch-case is just for measurement and
511 * therefore should soon be removed.
513 if (ip6_forward_rt
.ro_rt
!= NULL
&&
514 (ip6_forward_rt
.ro_rt
->rt_flags
& RTF_UP
) &&
515 IN6_ARE_ADDR_EQUAL(&ip6
->ip6_dst
,
516 &((struct sockaddr_in6
*)(&ip6_forward_rt
.ro_dst
))->sin6_addr
))
517 ip6stat
.ip6s_forward_cachehit
++;
519 struct sockaddr_in6
*dst6
;
521 if (ip6_forward_rt
.ro_rt
) {
522 /* route is down or destination is different */
523 ip6stat
.ip6s_forward_cachemiss
++;
524 RTFREE(ip6_forward_rt
.ro_rt
);
525 ip6_forward_rt
.ro_rt
= 0;
528 bzero(&ip6_forward_rt
.ro_dst
, sizeof(struct sockaddr_in6
));
529 dst6
= &ip6_forward_rt
.ro_dst
;
530 dst6
->sin6_len
= sizeof(struct sockaddr_in6
);
531 dst6
->sin6_family
= AF_INET6
;
532 dst6
->sin6_addr
= ip6
->ip6_dst
;
534 rtalloc_ign((struct route
*)&ip6_forward_rt
, RTF_PRCLONING
);
537 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key))
540 * Accept the packet if the forwarding interface to the destination
541 * according to the routing table is the loopback interface,
542 * unless the associated route has a gateway.
543 * Note that this approach causes to accept a packet if there is a
544 * route to the loopback interface for the destination of the packet.
545 * But we think it's even useful in some situations, e.g. when using
546 * a special daemon which wants to intercept the packet.
548 * XXX: some OSes automatically make a cloned route for the destination
549 * of an outgoing packet. If the outgoing interface of the packet
550 * is a loopback one, the kernel would consider the packet to be
551 * accepted, even if we have no such address assinged on the interface.
552 * We check the cloned flag of the route entry to reject such cases,
553 * assuming that route entries for our own addresses are not made by
554 * cloning (it should be true because in6_addloop explicitly installs
555 * the host route). However, we might have to do an explicit check
556 * while it would be less efficient. Or, should we rather install a
557 * reject route for such a case?
559 if (ip6_forward_rt
.ro_rt
&&
560 (ip6_forward_rt
.ro_rt
->rt_flags
&
561 (RTF_HOST
|RTF_GATEWAY
)) == RTF_HOST
&&
563 !(ip6_forward_rt
.ro_rt
->rt_flags
& RTF_WASCLONED
) &&
566 !(ip6_forward_rt
.ro_rt
->rt_flags
& RTF_CLONED
) &&
570 * The check below is redundant since the comparison of
571 * the destination and the key of the rtentry has
572 * already done through looking up the routing table.
574 IN6_ARE_ADDR_EQUAL(&ip6
->ip6_dst
,
575 &rt6_key(ip6_forward_rt
.ro_rt
)->sin6_addr
)
577 ip6_forward_rt
.ro_rt
->rt_ifp
->if_type
== IFT_LOOP
) {
578 struct in6_ifaddr
*ia6
=
579 (struct in6_ifaddr
*)ip6_forward_rt
.ro_rt
->rt_ifa
;
582 * record address information into m_aux.
584 ip6_setdstifaddr(m
, ia6
);
587 * packets to a tentative, duplicated, or somehow invalid
588 * address must not be accepted.
590 if (!(ia6
->ia6_flags
& IN6_IFF_NOTREADY
)) {
591 /* this address is ready */
593 deliverifp
= ia6
->ia_ifp
; /* correct? */
594 /* Count the packet in the ip address stats */
595 ia6
->ia_ifa
.if_ipackets
++;
596 ia6
->ia_ifa
.if_ibytes
+= m
->m_pkthdr
.len
;
599 /* address is not ready, so discard the packet. */
601 "ip6_input: packet to an unready address %s->%s\n",
602 ip6_sprintf(&ip6
->ip6_src
),
603 ip6_sprintf(&ip6
->ip6_dst
)));
608 } /* XXX indentation (see above) */
611 * FAITH(Firewall Aided Internet Translator)
614 if (ip6_forward_rt
.ro_rt
&& ip6_forward_rt
.ro_rt
->rt_ifp
615 && ip6_forward_rt
.ro_rt
->rt_ifp
->if_type
== IFT_FAITH
) {
616 /* XXX do we need more sanity checks? */
618 deliverifp
= ip6_forward_rt
.ro_rt
->rt_ifp
; /* faith */
624 * Now there is no reason to process the packet if it's not our own
625 * and we're not a router.
627 if (!ip6_forwarding
) {
628 ip6stat
.ip6s_cantforward
++;
629 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
635 * record address information into m_aux, if we don't have one yet.
636 * note that we are unable to record it, if the address is not listed
637 * as our interface address (e.g. multicast addresses, addresses
638 * within FAITH prefixes and such).
640 if (deliverifp
&& !ip6_getdstifaddr(m
)) {
641 struct in6_ifaddr
*ia6
;
643 ia6
= in6_ifawithifp(deliverifp
, &ip6
->ip6_dst
);
645 if (!ip6_setdstifaddr(m
, ia6
)) {
647 * XXX maybe we should drop the packet here,
648 * as we could not provide enough information
649 * to the upper layers.
656 * Process Hop-by-Hop options header if it's contained.
657 * m may be modified in ip6_hopopts_input().
658 * If a JumboPayload option is included, plen will also be modified.
660 plen
= (u_int32_t
)ntohs(ip6
->ip6_plen
);
661 if (ip6
->ip6_nxt
== IPPROTO_HOPOPTS
) {
664 if (ip6_hopopts_input(&plen
, &rtalert
, &m
, &off
)) {
665 #if 0 /*touches NULL pointer*/
666 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
668 goto bad2
; /* m have already been freed */
672 ip6
= mtod(m
, struct ip6_hdr
*);
675 * if the payload length field is 0 and the next header field
676 * indicates Hop-by-Hop Options header, then a Jumbo Payload
677 * option MUST be included.
679 if (ip6
->ip6_plen
== 0 && plen
== 0) {
681 * Note that if a valid jumbo payload option is
682 * contained, ip6_hoptops_input() must set a valid
683 * (non-zero) payload length to the variable plen.
685 ip6stat
.ip6s_badoptions
++;
686 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
687 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
688 icmp6_error(m
, ICMP6_PARAM_PROB
,
689 ICMP6_PARAMPROB_HEADER
,
690 (caddr_t
)&ip6
->ip6_plen
- (caddr_t
)ip6
);
693 #ifndef PULLDOWN_TEST
694 /* ip6_hopopts_input() ensures that mbuf is contiguous */
695 hbh
= (struct ip6_hbh
*)(ip6
+ 1);
697 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
, sizeof(struct ip6_hdr
),
698 sizeof(struct ip6_hbh
));
700 ip6stat
.ip6s_tooshort
++;
707 * If we are acting as a router and the packet contains a
708 * router alert option, see if we know the option value.
709 * Currently, we only support the option value for MLD, in which
710 * case we should pass the packet to the multicast routing
713 if (rtalert
!= ~0 && ip6_forwarding
) {
715 case IP6OPT_RTALERT_MLD
:
720 * RFC2711 requires unrecognized values must be
730 * Check that the amount of data in the buffers
731 * is as at least much as the IPv6 header would have us expect.
732 * Trim mbufs if longer than we expect.
733 * Drop packet if shorter than we expect.
735 if (m
->m_pkthdr
.len
- sizeof(struct ip6_hdr
) < plen
) {
736 ip6stat
.ip6s_tooshort
++;
737 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_truncated
);
740 if (m
->m_pkthdr
.len
> sizeof(struct ip6_hdr
) + plen
) {
741 if (m
->m_len
== m
->m_pkthdr
.len
) {
742 m
->m_len
= sizeof(struct ip6_hdr
) + plen
;
743 m
->m_pkthdr
.len
= sizeof(struct ip6_hdr
) + plen
;
745 m_adj(m
, sizeof(struct ip6_hdr
) + plen
- m
->m_pkthdr
.len
);
749 * Forward if desirable.
751 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
)) {
753 * If we are acting as a multicast router, all
754 * incoming multicast packets are passed to the
755 * kernel-level multicast forwarding function.
756 * The packet is returned (relatively) intact; if
757 * ip6_mforward() returns a non-zero value, the packet
758 * must be discarded, else it may be accepted below.
760 if (ip6_mrouter
&& ip6_mforward(ip6
, m
->m_pkthdr
.rcvif
, m
)) {
761 ip6stat
.ip6s_cantforward
++;
767 ip6_forward(m
, srcrt
);
771 ip6
= mtod(m
, struct ip6_hdr
*);
774 * Malicious party may be able to use IPv4 mapped addr to confuse
775 * tcp/udp stack and bypass security checks (act as if it was from
776 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious.
778 * For SIIT end node behavior, you may want to disable the check.
779 * However, you will become vulnerable to attacks using IPv4 mapped
782 if (IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_src
) ||
783 IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_dst
)) {
784 ip6stat
.ip6s_badscope
++;
785 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
790 * Tell launch routine the next header
792 ip6stat
.ip6s_delivered
++;
793 in6_ifstat_inc(deliverifp
, ifs6_in_deliver
);
797 while (nxt
!= IPPROTO_DONE
) {
798 if (ip6_hdrnestlimit
&& (++nest
> ip6_hdrnestlimit
)) {
799 ip6stat
.ip6s_toomanyhdr
++;
800 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
805 * protection against faulty packet - there should be
806 * more sanity checks in header chain processing.
808 if (m
->m_pkthdr
.len
< off
) {
809 ip6stat
.ip6s_tooshort
++;
810 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_truncated
);
816 * do we need to do it for every header? yeah, other
817 * functions can play with it (like re-allocate and copy).
819 mhist
= ip6_addaux(m
);
820 if (mhist
&& M_TRAILINGSPACE(mhist
) >= sizeof(nxt
)) {
821 hist
= mtod(mhist
, caddr_t
) + mhist
->m_len
;
822 bcopy(&nxt
, hist
, sizeof(nxt
));
823 mhist
->m_len
+= sizeof(nxt
);
825 ip6stat
.ip6s_toomanyhdr
++;
830 if (nxt
== IPPROTO_ROUTING
) {
832 in6_ifstat_inc(m
->m_pkthdr
.rcvif
,
834 ip6stat
.ip6s_badoptions
++;
841 * enforce IPsec policy checking if we are seeing last header.
842 * note that we do not visit this with protocols with pcb layer
843 * code - like udp/tcp/raw ip.
845 if ((inet6sw
[ip6_protox
[nxt
]].pr_flags
& PR_LASTHDR
) &&
846 ipsec6_in_reject(m
, NULL
)) {
847 ipsec6stat
.in_polvio
++;
852 nxt
= (*inet6sw
[ip6_protox
[nxt
]].pr_input
)(&m
, &off
, nxt
);
859 /* msg was embedded in the mbuf, do not reply! */
863 * set/grab in6_ifaddr correspond to IPv6 destination address.
864 * XXX backward compatibility wrapper
866 static struct ip6aux
*
867 ip6_setdstifaddr(struct mbuf
*m
, struct in6_ifaddr
*ia6
)
873 n
->ip6a_dstia6
= ia6
;
874 return n
; /* NULL if failed to set */
878 ip6_getdstifaddr(struct mbuf
*m
)
884 return n
->ip6a_dstia6
;
890 * Hop-by-Hop options header processing. If a valid jumbo payload option is
891 * included, the real payload length will be stored in plenp.
894 ip6_hopopts_input(u_int32_t
*plenp
,
895 u_int32_t
*rtalertp
,/* XXX: should be stored more smart way */
899 struct mbuf
*m
= *mp
;
900 int off
= *offp
, hbhlen
;
904 /* validation of the length of the header */
905 #ifndef PULLDOWN_TEST
906 IP6_EXTHDR_CHECK(m
, off
, sizeof(*hbh
), -1);
907 hbh
= (struct ip6_hbh
*)(mtod(m
, caddr_t
) + off
);
908 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
910 IP6_EXTHDR_CHECK(m
, off
, hbhlen
, -1);
911 hbh
= (struct ip6_hbh
*)(mtod(m
, caddr_t
) + off
);
913 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
,
914 sizeof(struct ip6_hdr
), sizeof(struct ip6_hbh
));
916 ip6stat
.ip6s_tooshort
++;
919 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
920 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
, sizeof(struct ip6_hdr
),
923 ip6stat
.ip6s_tooshort
++;
928 hbhlen
-= sizeof(struct ip6_hbh
);
929 opt
= (u_int8_t
*)hbh
+ sizeof(struct ip6_hbh
);
931 if (ip6_process_hopopts(m
, (u_int8_t
*)hbh
+ sizeof(struct ip6_hbh
),
932 hbhlen
, rtalertp
, plenp
) < 0)
941 * Search header for all Hop-by-hop options and process each option.
942 * This function is separate from ip6_hopopts_input() in order to
943 * handle a case where the sending node itself process its hop-by-hop
944 * options header. In such a case, the function is called from ip6_output().
946 * The function assumes that hbh header is located right after the IPv6 header
947 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
948 * opthead + hbhlen is located in continuous memory region.
951 ip6_process_hopopts(struct mbuf
*m
, u_int8_t
*opthead
, int hbhlen
,
952 u_int32_t
*rtalertp
, u_int32_t
*plenp
)
956 u_int8_t
*opt
= opthead
;
957 u_int16_t rtalert_val
;
959 const int erroff
= sizeof(struct ip6_hdr
) + sizeof(struct ip6_hbh
);
961 for (; hbhlen
> 0; hbhlen
-= optlen
, opt
+= optlen
) {
967 if (hbhlen
< IP6OPT_MINLEN
) {
968 ip6stat
.ip6s_toosmall
++;
971 optlen
= *(opt
+ 1) + 2;
974 /* XXX may need check for alignment */
975 if (hbhlen
< IP6OPT_RTALERT_LEN
) {
976 ip6stat
.ip6s_toosmall
++;
979 if (*(opt
+ 1) != IP6OPT_RTALERT_LEN
- 2) {
981 icmp6_error(m
, ICMP6_PARAM_PROB
,
982 ICMP6_PARAMPROB_HEADER
,
983 erroff
+ opt
+ 1 - opthead
);
986 optlen
= IP6OPT_RTALERT_LEN
;
987 bcopy((caddr_t
)(opt
+ 2), (caddr_t
)&rtalert_val
, 2);
988 *rtalertp
= ntohs(rtalert_val
);
991 /* XXX may need check for alignment */
992 if (hbhlen
< IP6OPT_JUMBO_LEN
) {
993 ip6stat
.ip6s_toosmall
++;
996 if (*(opt
+ 1) != IP6OPT_JUMBO_LEN
- 2) {
998 icmp6_error(m
, ICMP6_PARAM_PROB
,
999 ICMP6_PARAMPROB_HEADER
,
1000 erroff
+ opt
+ 1 - opthead
);
1003 optlen
= IP6OPT_JUMBO_LEN
;
1006 * IPv6 packets that have non 0 payload length
1007 * must not contain a jumbo payload option.
1009 ip6
= mtod(m
, struct ip6_hdr
*);
1010 if (ip6
->ip6_plen
) {
1011 ip6stat
.ip6s_badoptions
++;
1012 icmp6_error(m
, ICMP6_PARAM_PROB
,
1013 ICMP6_PARAMPROB_HEADER
,
1014 erroff
+ opt
- opthead
);
1019 * We may see jumbolen in unaligned location, so
1020 * we'd need to perform bcopy().
1022 bcopy(opt
+ 2, &jumboplen
, sizeof(jumboplen
));
1023 jumboplen
= (u_int32_t
)htonl(jumboplen
);
1027 * if there are multiple jumbo payload options,
1028 * *plenp will be non-zero and the packet will be
1030 * the behavior may need some debate in ipngwg -
1031 * multiple options does not make sense, however,
1032 * there's no explicit mention in specification.
1035 ip6stat
.ip6s_badoptions
++;
1036 icmp6_error(m
, ICMP6_PARAM_PROB
,
1037 ICMP6_PARAMPROB_HEADER
,
1038 erroff
+ opt
+ 2 - opthead
);
1044 * jumbo payload length must be larger than 65535.
1046 if (jumboplen
<= IPV6_MAXPACKET
) {
1047 ip6stat
.ip6s_badoptions
++;
1048 icmp6_error(m
, ICMP6_PARAM_PROB
,
1049 ICMP6_PARAMPROB_HEADER
,
1050 erroff
+ opt
+ 2 - opthead
);
1056 default: /* unknown option */
1057 if (hbhlen
< IP6OPT_MINLEN
) {
1058 ip6stat
.ip6s_toosmall
++;
1061 optlen
= ip6_unknown_opt(opt
, m
,
1062 erroff
+ opt
- opthead
);
1078 * Unknown option processing.
1079 * The third argument `off' is the offset from the IPv6 header to the option,
1080 * which is necessary if the IPv6 header the and option header and IPv6 header
1081 * is not continuous in order to return an ICMPv6 error.
1084 ip6_unknown_opt(u_int8_t
*optp
, struct mbuf
*m
, int off
)
1086 struct ip6_hdr
*ip6
;
1088 switch (IP6OPT_TYPE(*optp
)) {
1089 case IP6OPT_TYPE_SKIP
: /* ignore the option */
1090 return ((int)*(optp
+ 1));
1091 case IP6OPT_TYPE_DISCARD
: /* silently discard */
1094 case IP6OPT_TYPE_FORCEICMP
: /* send ICMP even if multicasted */
1095 ip6stat
.ip6s_badoptions
++;
1096 icmp6_error(m
, ICMP6_PARAM_PROB
, ICMP6_PARAMPROB_OPTION
, off
);
1098 case IP6OPT_TYPE_ICMP
: /* send ICMP if not multicasted */
1099 ip6stat
.ip6s_badoptions
++;
1100 ip6
= mtod(m
, struct ip6_hdr
*);
1101 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
) ||
1102 (m
->m_flags
& (M_BCAST
|M_MCAST
)))
1105 icmp6_error(m
, ICMP6_PARAM_PROB
,
1106 ICMP6_PARAMPROB_OPTION
, off
);
1110 m_freem(m
); /* XXX: NOTREACHED */
1115 * Create the "control" list for this pcb.
1116 * The function will not modify mbuf chain at all.
1118 * with KAME mbuf chain restriction:
1119 * The routine will be called from upper layer handlers like tcp6_input().
1120 * Thus the routine assumes that the caller (tcp6_input) have already
1121 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the
1122 * very first mbuf on the mbuf chain.
1125 ip6_savecontrol(struct inpcb
*in6p
, struct mbuf
**mp
, struct ip6_hdr
*ip6
,
1128 #define IS2292(x, y) ((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y))
1129 struct thread
*td
= curthread
; /* XXX */
1131 int rthdr_exist
= 0;
1138 if (in6p
->in6p_socket
->so_options
& SO_TIMESTAMP
) {
1142 *mp
= sbcreatecontrol((caddr_t
) &tv
, sizeof(tv
),
1143 SCM_TIMESTAMP
, SOL_SOCKET
);
1145 mp
= &(*mp
)->m_next
;
1150 /* RFC 2292 sec. 5 */
1151 if (in6p
->in6p_flags
& IN6P_PKTINFO
) {
1152 struct in6_pktinfo pi6
;
1153 bcopy(&ip6
->ip6_dst
, &pi6
.ipi6_addr
, sizeof(struct in6_addr
));
1154 if (IN6_IS_SCOPE_LINKLOCAL(&pi6
.ipi6_addr
))
1155 pi6
.ipi6_addr
.s6_addr16
[1] = 0;
1156 pi6
.ipi6_ifindex
= (m
&& m
->m_pkthdr
.rcvif
)
1157 ? m
->m_pkthdr
.rcvif
->if_index
1159 *mp
= sbcreatecontrol((caddr_t
) &pi6
,
1160 sizeof(struct in6_pktinfo
), IS2292(IPV6_2292PKTINFO
, IPV6_PKTINFO
),
1163 mp
= &(*mp
)->m_next
;
1166 if (in6p
->in6p_flags
& IN6P_HOPLIMIT
) {
1167 int hlim
= ip6
->ip6_hlim
& 0xff;
1168 *mp
= sbcreatecontrol((caddr_t
) &hlim
,
1169 sizeof(int), IS2292(IPV6_2292HOPLIMIT
, IPV6_HOPLIMIT
), IPPROTO_IPV6
);
1171 mp
= &(*mp
)->m_next
;
1174 if ((in6p
->in6p_flags
& IN6P_TCLASS
) != 0) {
1178 flowinfo
= (u_int32_t
)ntohl(ip6
->ip6_flow
& IPV6_FLOWINFO_MASK
);
1181 tclass
= flowinfo
& 0xff;
1182 *mp
= sbcreatecontrol((caddr_t
) &tclass
, sizeof(tclass
),
1183 IPV6_TCLASS
, IPPROTO_IPV6
);
1185 mp
= &(*mp
)->m_next
;
1189 * IPV6_HOPOPTS socket option. We require super-user privilege
1190 * for the option, but it might be too strict, since there might
1191 * be some hop-by-hop options which can be returned to normal user.
1192 * See RFC 2292 section 6.
1194 if ((in6p
->in6p_flags
& IN6P_HOPOPTS
) && privileged
) {
1196 * Check if a hop-by-hop options header is contatined in the
1197 * received packet, and if so, store the options as ancillary
1198 * data. Note that a hop-by-hop options header must be
1199 * just after the IPv6 header, which fact is assured through
1200 * the IPv6 input processing.
1202 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1203 if (ip6
->ip6_nxt
== IPPROTO_HOPOPTS
) {
1204 struct ip6_hbh
*hbh
;
1206 #ifdef PULLDOWN_TEST
1210 #ifndef PULLDOWN_TEST
1211 hbh
= (struct ip6_hbh
*)(ip6
+ 1);
1212 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
1214 ext
= ip6_pullexthdr(m
, sizeof(struct ip6_hdr
),
1217 ip6stat
.ip6s_tooshort
++;
1220 hbh
= mtod(ext
, struct ip6_hbh
*);
1221 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
1222 if (hbhlen
!= ext
->m_len
) {
1224 ip6stat
.ip6s_tooshort
++;
1230 * XXX: We copy whole the header even if a jumbo
1231 * payload option is included, which option is to
1232 * be removed before returning in the RFC 2292.
1233 * Note: this constraint is removed in 2292bis.
1235 *mp
= sbcreatecontrol((caddr_t
)hbh
, hbhlen
,
1236 IS2292(IPV6_2292HOPOPTS
, IPV6_HOPOPTS
), IPPROTO_IPV6
);
1238 mp
= &(*mp
)->m_next
;
1239 #ifdef PULLDOWN_TEST
1245 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */
1246 if ((in6p
->in6p_flags
& (IN6P_DSTOPTS
| IN6P_RTHDRDSTOPTS
)) != 0) {
1247 int proto
, off
, nxt
;
1250 * go through the header chain to see if a routing header is
1251 * contained in the packet. We need this information to store
1252 * destination options headers (if any) properly.
1253 * XXX: performance issue. We should record this info when
1254 * processing extension headers in incoming routine.
1257 proto
= IPPROTO_IPV6
;
1263 newoff
= ip6_nexthdr(m
, off
, proto
, &nxt
);
1266 if (newoff
< off
) /* invalid, check for safety */
1268 if ((proto
= nxt
) == IPPROTO_ROUTING
) {
1276 if ((in6p
->in6p_flags
&
1277 (IN6P_RTHDR
| IN6P_DSTOPTS
| IN6P_RTHDRDSTOPTS
)) != 0) {
1278 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1279 int nxt
= ip6
->ip6_nxt
, off
= sizeof(struct ip6_hdr
);
1282 * Search for destination options headers or routing
1283 * header(s) through the header chain, and stores each
1284 * header as ancillary data.
1285 * Note that the order of the headers remains in
1286 * the chain of ancillary data.
1288 while (1) { /* is explicit loop prevention necessary? */
1289 struct ip6_ext
*ip6e
= NULL
;
1291 #ifdef PULLDOWN_TEST
1292 struct mbuf
*ext
= NULL
;
1296 * if it is not an extension header, don't try to
1297 * pull it from the chain.
1300 case IPPROTO_DSTOPTS
:
1301 case IPPROTO_ROUTING
:
1302 case IPPROTO_HOPOPTS
:
1303 case IPPROTO_AH
: /* is it possible? */
1309 #ifndef PULLDOWN_TEST
1310 if (off
+ sizeof(*ip6e
) > m
->m_len
)
1312 ip6e
= (struct ip6_ext
*)(mtod(m
, caddr_t
) + off
);
1313 if (nxt
== IPPROTO_AH
)
1314 elen
= (ip6e
->ip6e_len
+ 2) << 2;
1316 elen
= (ip6e
->ip6e_len
+ 1) << 3;
1317 if (off
+ elen
> m
->m_len
)
1320 ext
= ip6_pullexthdr(m
, off
, nxt
);
1322 ip6stat
.ip6s_tooshort
++;
1325 ip6e
= mtod(ext
, struct ip6_ext
*);
1326 if (nxt
== IPPROTO_AH
)
1327 elen
= (ip6e
->ip6e_len
+ 2) << 2;
1329 elen
= (ip6e
->ip6e_len
+ 1) << 3;
1330 if (elen
!= ext
->m_len
) {
1332 ip6stat
.ip6s_tooshort
++;
1338 case IPPROTO_DSTOPTS
:
1339 if ((in6p
->in6p_flags
& IN6P_DSTOPTS
) == 0)
1343 * We also require super-user privilege for
1345 * See the comments on IN6_HOPOPTS.
1350 *mp
= sbcreatecontrol((caddr_t
)ip6e
, elen
,
1351 IS2292(IPV6_2292DSTOPTS
, IPV6_DSTOPTS
),
1354 mp
= &(*mp
)->m_next
;
1356 case IPPROTO_ROUTING
:
1357 if (!in6p
->in6p_flags
& IN6P_RTHDR
)
1360 *mp
= sbcreatecontrol((caddr_t
)ip6e
, elen
,
1361 IS2292(IPV6_2292RTHDR
, IPV6_RTHDR
),
1364 mp
= &(*mp
)->m_next
;
1366 case IPPROTO_HOPOPTS
:
1367 case IPPROTO_AH
: /* is it possible? */
1372 * other cases have been filtered in the above.
1373 * none will visit this case. here we supply
1374 * the code just in case (nxt overwritten or
1377 #ifdef PULLDOWN_TEST
1384 /* proceed with the next header. */
1386 nxt
= ip6e
->ip6e_nxt
;
1388 #ifdef PULLDOWN_TEST
1400 ip6_notify_pmtu(struct inpcb
*in6p
, struct sockaddr_in6
*dst
, u_int32_t
*mtu
)
1404 struct ip6_mtuinfo mtuctl
;
1406 so
= in6p
->inp_socket
;
1412 if (so
== NULL
) /* I believe this is impossible */
1413 panic("ip6_notify_pmtu: socket is NULL");
1416 bzero(&mtuctl
, sizeof(mtuctl
)); /* zero-clear for safety */
1417 mtuctl
.ip6m_mtu
= *mtu
;
1418 mtuctl
.ip6m_addr
= *dst
;
1420 if ((m_mtu
= sbcreatecontrol((caddr_t
)&mtuctl
, sizeof(mtuctl
),
1421 IPV6_PATHMTU
, IPPROTO_IPV6
)) == NULL
)
1424 if (sbappendaddr(&so
->so_rcv
, (struct sockaddr
*)dst
, NULL
, m_mtu
)
1427 /* XXX: should count statistics */
1434 #ifdef PULLDOWN_TEST
1436 * pull single extension header from mbuf chain. returns single mbuf that
1437 * contains the result, or NULL on error.
1439 static struct mbuf
*
1440 ip6_pullexthdr(struct mbuf
*m
, size_t off
, int nxt
)
1442 struct ip6_ext ip6e
;
1448 case IPPROTO_DSTOPTS
:
1449 case IPPROTO_ROUTING
:
1450 case IPPROTO_HOPOPTS
:
1451 case IPPROTO_AH
: /* is it possible? */
1454 kprintf("ip6_pullexthdr: invalid nxt=%d\n", nxt
);
1458 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1459 if (nxt
== IPPROTO_AH
)
1460 elen
= (ip6e
.ip6e_len
+ 2) << 2;
1462 elen
= (ip6e
.ip6e_len
+ 1) << 3;
1464 n
= m_getb(elen
, MB_DONTWAIT
, MT_DATA
, 0);
1469 if (elen
>= M_TRAILINGSPACE(n
)) {
1474 m_copydata(m
, off
, elen
, mtod(n
, caddr_t
));
1481 * Get pointer to the previous header followed by the header
1482 * currently processed.
1483 * XXX: This function supposes that
1484 * M includes all headers,
1485 * the next header field and the header length field of each header
1487 * the sum of each header length equals to OFF.
1488 * Because of these assumptions, this function must be called very
1489 * carefully. Moreover, it will not be used in the near future when
1490 * we develop `neater' mechanism to process extension headers.
1493 ip6_get_prevhdr(struct mbuf
*m
, int off
)
1495 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1497 if (off
== sizeof(struct ip6_hdr
))
1498 return (&ip6
->ip6_nxt
);
1501 struct ip6_ext
*ip6e
= NULL
;
1504 len
= sizeof(struct ip6_hdr
);
1506 ip6e
= (struct ip6_ext
*)(mtod(m
, caddr_t
) + len
);
1509 case IPPROTO_FRAGMENT
:
1510 len
+= sizeof(struct ip6_frag
);
1513 len
+= (ip6e
->ip6e_len
+ 2) << 2;
1516 len
+= (ip6e
->ip6e_len
+ 1) << 3;
1519 nxt
= ip6e
->ip6e_nxt
;
1522 return (&ip6e
->ip6e_nxt
);
1529 * get next header offset. m will be retained.
1532 ip6_nexthdr(struct mbuf
*m
, int off
, int proto
, int *nxtp
)
1535 struct ip6_ext ip6e
;
1540 panic("ip6_nexthdr: m == NULL");
1541 if ((m
->m_flags
& M_PKTHDR
) == 0 || m
->m_pkthdr
.len
< off
)
1546 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6
))
1548 m_copydata(m
, off
, sizeof(ip6
), (caddr_t
)&ip6
);
1550 *nxtp
= ip6
.ip6_nxt
;
1554 case IPPROTO_FRAGMENT
:
1556 * terminate parsing if it is not the first fragment,
1557 * it does not make sense to parse through it.
1559 if (m
->m_pkthdr
.len
< off
+ sizeof(fh
))
1561 m_copydata(m
, off
, sizeof(fh
), (caddr_t
)&fh
);
1562 /* IP6F_OFF_MASK = 0xfff8(BigEndian), 0xf8ff(LittleEndian) */
1563 if (fh
.ip6f_offlg
& IP6F_OFF_MASK
)
1566 *nxtp
= fh
.ip6f_nxt
;
1567 off
+= sizeof(struct ip6_frag
);
1571 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6e
))
1573 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1575 *nxtp
= ip6e
.ip6e_nxt
;
1576 off
+= (ip6e
.ip6e_len
+ 2) << 2;
1579 case IPPROTO_HOPOPTS
:
1580 case IPPROTO_ROUTING
:
1581 case IPPROTO_DSTOPTS
:
1582 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6e
))
1584 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1586 *nxtp
= ip6e
.ip6e_nxt
;
1587 off
+= (ip6e
.ip6e_len
+ 1) << 3;
1592 case IPPROTO_IPCOMP
:
1604 * get offset for the last header in the chain. m will be kept untainted.
1607 ip6_lasthdr(struct mbuf
*m
, int off
, int proto
, int *nxtp
)
1617 newoff
= ip6_nexthdr(m
, off
, proto
, nxtp
);
1620 else if (newoff
< off
)
1621 return -1; /* invalid */
1622 else if (newoff
== off
)
1631 ip6_addaux(struct mbuf
*m
)
1633 struct m_tag
*tag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1635 tag
= m_tag_get(PACKET_TAG_IPV6_INPUT
,
1636 sizeof (struct ip6aux
),
1639 m_tag_prepend(m
, tag
);
1642 bzero(m_tag_data(tag
), sizeof (struct ip6aux
));
1643 return tag
? (struct ip6aux
*)m_tag_data(tag
) : NULL
;
1647 ip6_findaux(struct mbuf
*m
)
1649 struct m_tag
*tag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1650 return tag
? (struct ip6aux
*)(tag
+1) : NULL
;
1654 ip6_delaux(struct mbuf
*m
)
1656 struct m_tag
*tag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1658 m_tag_delete(m
, tag
);
1662 * System control for IP6
1665 u_char inet6ctlerrmap
[PRC_NCMDS
] = {
1667 0, EMSGSIZE
, EHOSTDOWN
, EHOSTUNREACH
,
1668 EHOSTUNREACH
, EHOSTUNREACH
, ECONNREFUSED
, ECONNREFUSED
,
1669 EMSGSIZE
, EHOSTUNREACH
, 0, 0,