1 /* $FreeBSD: src/sys/netinet6/ip6_input.c,v 1.11.2.15 2003/01/24 05:11:35 sam Exp $ */
2 /* $DragonFly: src/sys/netinet6/ip6_input.c,v 1.38 2008/09/24 14:26:39 sephe Exp $ */
3 /* $KAME: ip6_input.c,v 1.259 2002/01/21 04:58:09 jinmei Exp $ */
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * Copyright (c) 1982, 1986, 1988, 1993
36 * The Regents of the University of California. All rights reserved.
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
66 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94
69 #include "opt_ip6fw.h"
71 #include "opt_inet6.h"
72 #include "opt_ipsec.h"
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/malloc.h>
78 #include <sys/domain.h>
79 #include <sys/protosw.h>
80 #include <sys/socket.h>
81 #include <sys/socketvar.h>
82 #include <sys/errno.h>
84 #include <sys/kernel.h>
85 #include <sys/syslog.h>
89 #include <sys/thread2.h>
90 #include <sys/msgport2.h>
93 #include <net/if_types.h>
94 #include <net/if_dl.h>
95 #include <net/route.h>
96 #include <net/netisr.h>
99 #include <netinet/in.h>
100 #include <netinet/in_systm.h>
102 #include <netinet/ip.h>
103 #include <netinet/ip_icmp.h>
105 #include <netinet/ip6.h>
106 #include <netinet6/in6_var.h>
107 #include <netinet6/ip6_var.h>
108 #include <netinet/in_pcb.h>
109 #include <netinet/icmp6.h>
110 #include <netinet6/scope6_var.h>
111 #include <netinet6/in6_ifattach.h>
112 #include <netinet6/nd6.h>
113 #include <netinet6/in6_prefix.h>
116 #include <netinet6/ipsec.h>
118 #include <netinet6/ipsec6.h>
123 #include <netproto/ipsec/ipsec.h>
124 #include <netproto/ipsec/ipsec6.h>
126 #endif /* FAST_IPSEC */
128 #include <net/ip6fw/ip6_fw.h>
130 #include <netinet6/ip6protosw.h>
132 /* we need it for NLOOP. */
133 #include "use_loop.h"
135 #include <net/net_osdep.h>
137 extern struct domain inet6domain
;
138 extern struct ip6protosw inet6sw
[];
140 u_char ip6_protox
[IPPROTO_MAX
];
141 struct in6_ifaddr
*in6_ifaddr
;
143 extern struct callout in6_tmpaddrtimer_ch
;
145 int ip6_forward_srcrt
; /* XXX */
146 int ip6_sourcecheck
; /* XXX */
147 int ip6_sourcecheck_interval
; /* XXX */
149 int ip6_ours_check_algorithm
;
151 struct pfil_head inet6_pfil_hook
;
154 ip6_fw_chk_t
*ip6_fw_chk_ptr
;
155 ip6_fw_ctl_t
*ip6_fw_ctl_ptr
;
156 int ip6_fw_enable
= 1;
158 struct ip6stat ip6stat
;
160 static void ip6_init2 (void *);
161 static struct ip6aux
*ip6_setdstifaddr (struct mbuf
*, struct in6_ifaddr
*);
162 static int ip6_hopopts_input (u_int32_t
*, u_int32_t
*, struct mbuf
**, int *);
163 static void ip6_input(struct netmsg
*msg
);
165 static struct mbuf
*ip6_pullexthdr (struct mbuf
*, size_t, int);
169 * IP6 initialization: fill in IP6 protocol switch table.
170 * All protocols not implemented in kernel go to raw IP6 protocol handler.
175 struct ip6protosw
*pr
;
180 if (sizeof(struct protosw
) != sizeof(struct ip6protosw
))
181 panic("sizeof(protosw) != sizeof(ip6protosw)");
183 pr
= (struct ip6protosw
*)pffindproto(PF_INET6
, IPPROTO_RAW
, SOCK_RAW
);
186 for (i
= 0; i
< IPPROTO_MAX
; i
++)
187 ip6_protox
[i
] = pr
- inet6sw
;
188 for (pr
= (struct ip6protosw
*)inet6domain
.dom_protosw
;
189 pr
< (struct ip6protosw
*)inet6domain
.dom_protoswNPROTOSW
; pr
++)
190 if (pr
->pr_domain
->dom_family
== PF_INET6
&&
191 pr
->pr_protocol
&& pr
->pr_protocol
!= IPPROTO_RAW
)
192 ip6_protox
[pr
->pr_protocol
] = pr
- inet6sw
;
194 inet6_pfil_hook
.ph_type
= PFIL_TYPE_AF
;
195 inet6_pfil_hook
.ph_af
= AF_INET6
;
196 if ((i
= pfil_head_register(&inet6_pfil_hook
)) != 0) {
197 kprintf("%s: WARNING: unable to register pfil hook, "
198 "error %d\n", __func__
, i
);
201 netisr_register(NETISR_IPV6
, cpu0_portfn
, pktinfo_portfn_cpu0
,
202 ip6_input
, NETISR_FLAG_NOTMPSAFE
);
204 addrsel_policy_init();
208 * in many cases, random() here does NOT return random number
209 * as initialization during bootstrap time occur in fixed order.
212 ip6_flow_seq
= krandom() ^ tv
.tv_usec
;
214 ip6_desync_factor
= (krandom() ^ tv
.tv_usec
) % MAX_TEMP_DESYNC_FACTOR
;
218 ip6_init2(void *dummy
)
221 callout_init(&nd6_timer_ch
);
222 callout_reset(&nd6_timer_ch
, hz
, nd6_timer
, NULL
);
224 /* router renumbering prefix list maintenance */
225 callout_init(&in6_rr_timer_ch
);
226 callout_reset(&in6_rr_timer_ch
, hz
, in6_rr_timer
, NULL
);
228 /* timer for regeneranation of temporary addresses randomize ID */
229 callout_init(&in6_tmpaddrtimer_ch
);
230 callout_reset(&in6_tmpaddrtimer_ch
,
231 (ip6_temp_preferred_lifetime
- ip6_desync_factor
-
232 ip6_temp_regen_advance
) * hz
,
233 in6_tmpaddrtimer
, NULL
);
237 /* This must be after route_init(), which is now SI_ORDER_THIRD */
238 SYSINIT(netinet6init2
, SI_SUB_PROTO_DOMAIN
, SI_ORDER_MIDDLE
, ip6_init2
, NULL
);
240 extern struct route_in6 ip6_forward_rt
;
244 ip6_input(struct netmsg
*msg
)
246 struct mbuf
*m
= ((struct netmsg_packet
*)msg
)->nm_packet
;
248 int off
= sizeof(struct ip6_hdr
), nest
;
250 u_int32_t rtalert
= ~0;
251 int nxt
, ours
= 0, rh_present
= 0;
252 struct ifnet
*deliverifp
= NULL
;
253 struct in6_addr odst
;
258 * should the inner packet be considered authentic?
259 * see comment in ah4_input().
262 m
->m_flags
&= ~M_AUTHIPHDR
;
263 m
->m_flags
&= ~M_AUTHIPDGM
;
268 * make sure we don't have onion peering information into m_aux.
275 if (m
->m_flags
& M_EXT
) {
277 ip6stat
.ip6s_mext2m
++;
279 ip6stat
.ip6s_mext1
++;
281 #define M2MMAX (sizeof(ip6stat.ip6s_m2m)/sizeof(ip6stat.ip6s_m2m[0]))
283 if (m
->m_flags
& M_LOOP
) {
284 ip6stat
.ip6s_m2m
[loif
[0].if_index
]++; /* XXX */
285 } else if (m
->m_pkthdr
.rcvif
->if_index
< M2MMAX
)
286 ip6stat
.ip6s_m2m
[m
->m_pkthdr
.rcvif
->if_index
]++;
288 ip6stat
.ip6s_m2m
[0]++;
294 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_receive
);
295 ip6stat
.ip6s_total
++;
297 #ifndef PULLDOWN_TEST
299 * L2 bridge code and some other code can return mbuf chain
300 * that does not conform to KAME requirement. too bad.
301 * XXX: fails to join if interface MTU > MCLBYTES. jumbogram?
303 if (m
&& m
->m_next
!= NULL
&& m
->m_pkthdr
.len
< MCLBYTES
) {
306 n
= m_getb(m
->m_pkthdr
.len
, MB_DONTWAIT
, MT_HEADER
, M_PKTHDR
);
311 m_copydata(m
, 0, n
->m_pkthdr
.len
, mtod(n
, caddr_t
));
312 n
->m_len
= n
->m_pkthdr
.len
;
316 IP6_EXTHDR_CHECK_VOIDRET(m
, 0, sizeof(struct ip6_hdr
));
319 if (m
->m_len
< sizeof(struct ip6_hdr
)) {
321 inifp
= m
->m_pkthdr
.rcvif
;
322 if ((m
= m_pullup(m
, sizeof(struct ip6_hdr
))) == 0) {
323 ip6stat
.ip6s_toosmall
++;
324 in6_ifstat_inc(inifp
, ifs6_in_hdrerr
);
329 ip6
= mtod(m
, struct ip6_hdr
*);
331 if ((ip6
->ip6_vfc
& IPV6_VERSION_MASK
) != IPV6_VERSION
) {
332 ip6stat
.ip6s_badvers
++;
333 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
338 * Run through list of hooks for input packets.
340 * NB: Beware of the destination address changing
341 * (e.g. by NAT rewriting). When this happens,
342 * tell ip6_forward to do the right thing.
344 if (pfil_has_hooks(&inet6_pfil_hook
)) {
346 if (pfil_run_hooks(&inet6_pfil_hook
, &m
,
347 m
->m_pkthdr
.rcvif
, PFIL_IN
)) {
350 if (m
== NULL
) /* consumed by filter */
352 ip6
= mtod(m
, struct ip6_hdr
*);
353 srcrt
= !IN6_ARE_ADDR_EQUAL(&odst
, &ip6
->ip6_dst
);
356 ip6stat
.ip6s_nxthist
[ip6
->ip6_nxt
]++;
359 if (altq_input
!= NULL
&& (*altq_input
)(m
, AF_INET6
) == 0) {
360 /* packet is dropped by traffic conditioner */
366 * Check with the firewall...
368 if (ip6_fw_enable
&& ip6_fw_chk_ptr
) {
370 /* If ipfw says divert, we have to just drop packet */
371 /* use port as a dummy argument */
372 if ((*ip6_fw_chk_ptr
)(&ip6
, NULL
, &port
, &m
)) {
381 * Check against address spoofing/corruption.
383 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_src
) ||
384 IN6_IS_ADDR_UNSPECIFIED(&ip6
->ip6_dst
)) {
386 * XXX: "badscope" is not very suitable for a multicast source.
388 ip6stat
.ip6s_badscope
++;
389 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
392 if ((IN6_IS_ADDR_LOOPBACK(&ip6
->ip6_src
) ||
393 IN6_IS_ADDR_LOOPBACK(&ip6
->ip6_dst
)) &&
394 (m
->m_pkthdr
.rcvif
->if_flags
& IFF_LOOPBACK
) == 0) {
395 ip6stat
.ip6s_badscope
++;
396 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
401 * The following check is not documented in specs. A malicious
402 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
403 * and bypass security checks (act as if it was from 127.0.0.1 by using
404 * IPv6 src ::ffff:127.0.0.1). Be cautious.
406 * This check chokes if we are in an SIIT cloud. As none of BSDs
407 * support IPv4-less kernel compilation, we cannot support SIIT
408 * environment at all. So, it makes more sense for us to reject any
409 * malicious packets for non-SIIT environment, than try to do a
410 * partical support for SIIT environment.
412 if (IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_src
) ||
413 IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_dst
)) {
414 ip6stat
.ip6s_badscope
++;
415 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
420 * Reject packets with IPv4 compatible addresses (auto tunnel).
422 * The code forbids auto tunnel relay case in RFC1933 (the check is
423 * stronger than RFC1933). We may want to re-enable it if mech-xx
424 * is revised to forbid relaying case.
426 if (IN6_IS_ADDR_V4COMPAT(&ip6
->ip6_src
) ||
427 IN6_IS_ADDR_V4COMPAT(&ip6
->ip6_dst
)) {
428 ip6stat
.ip6s_badscope
++;
429 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
434 /* drop packets if interface ID portion is already filled */
435 if ((m
->m_pkthdr
.rcvif
->if_flags
& IFF_LOOPBACK
) == 0) {
436 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_src
) &&
437 ip6
->ip6_src
.s6_addr16
[1]) {
438 ip6stat
.ip6s_badscope
++;
441 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_dst
) &&
442 ip6
->ip6_dst
.s6_addr16
[1]) {
443 ip6stat
.ip6s_badscope
++;
448 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_src
))
449 ip6
->ip6_src
.s6_addr16
[1]
450 = htons(m
->m_pkthdr
.rcvif
->if_index
);
451 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_dst
))
452 ip6
->ip6_dst
.s6_addr16
[1]
453 = htons(m
->m_pkthdr
.rcvif
->if_index
);
455 #if 0 /* this case seems to be unnecessary. (jinmei, 20010401) */
457 * We use rt->rt_ifp to determine if the address is ours or not.
458 * If rt_ifp is lo0, the address is ours.
459 * The problem here is, rt->rt_ifp for fe80::%lo0/64 is set to lo0,
460 * so any address under fe80::%lo0/64 will be mistakenly considered
461 * local. The special case is supplied to handle the case properly
462 * by actually looking at interface addresses
463 * (using in6ifa_ifpwithaddr).
465 if ((m
->m_pkthdr
.rcvif
->if_flags
& IFF_LOOPBACK
) &&
466 IN6_IS_ADDR_LINKLOCAL(&ip6
->ip6_dst
)) {
467 if (!in6ifa_ifpwithaddr(m
->m_pkthdr
.rcvif
, &ip6
->ip6_dst
)) {
468 icmp6_error(m
, ICMP6_DST_UNREACH
,
469 ICMP6_DST_UNREACH_ADDR
, 0);
470 /* m is already freed */
475 deliverifp
= m
->m_pkthdr
.rcvif
;
483 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
)) {
484 struct in6_multi
*in6m
= 0;
486 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_mcast
);
488 * See if we belong to the destination multicast group on the
491 IN6_LOOKUP_MULTI(ip6
->ip6_dst
, m
->m_pkthdr
.rcvif
, in6m
);
494 else if (!ip6_mrouter
) {
495 ip6stat
.ip6s_notmember
++;
496 ip6stat
.ip6s_cantforward
++;
497 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
500 deliverifp
= m
->m_pkthdr
.rcvif
;
507 switch (ip6_ours_check_algorithm
) {
510 * XXX: I intentionally broke our indentation rule here,
511 * since this switch-case is just for measurement and
512 * therefore should soon be removed.
514 if (ip6_forward_rt
.ro_rt
!= NULL
&&
515 (ip6_forward_rt
.ro_rt
->rt_flags
& RTF_UP
) &&
516 IN6_ARE_ADDR_EQUAL(&ip6
->ip6_dst
,
517 &((struct sockaddr_in6
*)(&ip6_forward_rt
.ro_dst
))->sin6_addr
))
518 ip6stat
.ip6s_forward_cachehit
++;
520 struct sockaddr_in6
*dst6
;
522 if (ip6_forward_rt
.ro_rt
) {
523 /* route is down or destination is different */
524 ip6stat
.ip6s_forward_cachemiss
++;
525 RTFREE(ip6_forward_rt
.ro_rt
);
526 ip6_forward_rt
.ro_rt
= 0;
529 bzero(&ip6_forward_rt
.ro_dst
, sizeof(struct sockaddr_in6
));
530 dst6
= &ip6_forward_rt
.ro_dst
;
531 dst6
->sin6_len
= sizeof(struct sockaddr_in6
);
532 dst6
->sin6_family
= AF_INET6
;
533 dst6
->sin6_addr
= ip6
->ip6_dst
;
535 rtalloc_ign((struct route
*)&ip6_forward_rt
, RTF_PRCLONING
);
538 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key))
541 * Accept the packet if the forwarding interface to the destination
542 * according to the routing table is the loopback interface,
543 * unless the associated route has a gateway.
544 * Note that this approach causes to accept a packet if there is a
545 * route to the loopback interface for the destination of the packet.
546 * But we think it's even useful in some situations, e.g. when using
547 * a special daemon which wants to intercept the packet.
549 * XXX: some OSes automatically make a cloned route for the destination
550 * of an outgoing packet. If the outgoing interface of the packet
551 * is a loopback one, the kernel would consider the packet to be
552 * accepted, even if we have no such address assinged on the interface.
553 * We check the cloned flag of the route entry to reject such cases,
554 * assuming that route entries for our own addresses are not made by
555 * cloning (it should be true because in6_addloop explicitly installs
556 * the host route). However, we might have to do an explicit check
557 * while it would be less efficient. Or, should we rather install a
558 * reject route for such a case?
560 if (ip6_forward_rt
.ro_rt
&&
561 (ip6_forward_rt
.ro_rt
->rt_flags
&
562 (RTF_HOST
|RTF_GATEWAY
)) == RTF_HOST
&&
564 !(ip6_forward_rt
.ro_rt
->rt_flags
& RTF_WASCLONED
) &&
567 !(ip6_forward_rt
.ro_rt
->rt_flags
& RTF_CLONED
) &&
571 * The check below is redundant since the comparison of
572 * the destination and the key of the rtentry has
573 * already done through looking up the routing table.
575 IN6_ARE_ADDR_EQUAL(&ip6
->ip6_dst
,
576 &rt6_key(ip6_forward_rt
.ro_rt
)->sin6_addr
)
578 ip6_forward_rt
.ro_rt
->rt_ifp
->if_type
== IFT_LOOP
) {
579 struct in6_ifaddr
*ia6
=
580 (struct in6_ifaddr
*)ip6_forward_rt
.ro_rt
->rt_ifa
;
583 * record address information into m_aux.
585 ip6_setdstifaddr(m
, ia6
);
588 * packets to a tentative, duplicated, or somehow invalid
589 * address must not be accepted.
591 if (!(ia6
->ia6_flags
& IN6_IFF_NOTREADY
)) {
592 /* this address is ready */
594 deliverifp
= ia6
->ia_ifp
; /* correct? */
595 /* Count the packet in the ip address stats */
596 ia6
->ia_ifa
.if_ipackets
++;
597 ia6
->ia_ifa
.if_ibytes
+= m
->m_pkthdr
.len
;
600 /* address is not ready, so discard the packet. */
602 "ip6_input: packet to an unready address %s->%s\n",
603 ip6_sprintf(&ip6
->ip6_src
),
604 ip6_sprintf(&ip6
->ip6_dst
)));
609 } /* XXX indentation (see above) */
612 * FAITH(Firewall Aided Internet Translator)
615 if (ip6_forward_rt
.ro_rt
&& ip6_forward_rt
.ro_rt
->rt_ifp
616 && ip6_forward_rt
.ro_rt
->rt_ifp
->if_type
== IFT_FAITH
) {
617 /* XXX do we need more sanity checks? */
619 deliverifp
= ip6_forward_rt
.ro_rt
->rt_ifp
; /* faith */
625 * Now there is no reason to process the packet if it's not our own
626 * and we're not a router.
628 if (!ip6_forwarding
) {
629 ip6stat
.ip6s_cantforward
++;
630 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
636 * record address information into m_aux, if we don't have one yet.
637 * note that we are unable to record it, if the address is not listed
638 * as our interface address (e.g. multicast addresses, addresses
639 * within FAITH prefixes and such).
641 if (deliverifp
&& !ip6_getdstifaddr(m
)) {
642 struct in6_ifaddr
*ia6
;
644 ia6
= in6_ifawithifp(deliverifp
, &ip6
->ip6_dst
);
646 if (!ip6_setdstifaddr(m
, ia6
)) {
648 * XXX maybe we should drop the packet here,
649 * as we could not provide enough information
650 * to the upper layers.
657 * Process Hop-by-Hop options header if it's contained.
658 * m may be modified in ip6_hopopts_input().
659 * If a JumboPayload option is included, plen will also be modified.
661 plen
= (u_int32_t
)ntohs(ip6
->ip6_plen
);
662 if (ip6
->ip6_nxt
== IPPROTO_HOPOPTS
) {
665 if (ip6_hopopts_input(&plen
, &rtalert
, &m
, &off
)) {
666 #if 0 /*touches NULL pointer*/
667 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
669 goto bad2
; /* m have already been freed */
673 ip6
= mtod(m
, struct ip6_hdr
*);
676 * if the payload length field is 0 and the next header field
677 * indicates Hop-by-Hop Options header, then a Jumbo Payload
678 * option MUST be included.
680 if (ip6
->ip6_plen
== 0 && plen
== 0) {
682 * Note that if a valid jumbo payload option is
683 * contained, ip6_hoptops_input() must set a valid
684 * (non-zero) payload length to the variable plen.
686 ip6stat
.ip6s_badoptions
++;
687 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
688 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
689 icmp6_error(m
, ICMP6_PARAM_PROB
,
690 ICMP6_PARAMPROB_HEADER
,
691 (caddr_t
)&ip6
->ip6_plen
- (caddr_t
)ip6
);
694 #ifndef PULLDOWN_TEST
695 /* ip6_hopopts_input() ensures that mbuf is contiguous */
696 hbh
= (struct ip6_hbh
*)(ip6
+ 1);
698 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
, sizeof(struct ip6_hdr
),
699 sizeof(struct ip6_hbh
));
701 ip6stat
.ip6s_tooshort
++;
708 * If we are acting as a router and the packet contains a
709 * router alert option, see if we know the option value.
710 * Currently, we only support the option value for MLD, in which
711 * case we should pass the packet to the multicast routing
714 if (rtalert
!= ~0 && ip6_forwarding
) {
716 case IP6OPT_RTALERT_MLD
:
721 * RFC2711 requires unrecognized values must be
731 * Check that the amount of data in the buffers
732 * is as at least much as the IPv6 header would have us expect.
733 * Trim mbufs if longer than we expect.
734 * Drop packet if shorter than we expect.
736 if (m
->m_pkthdr
.len
- sizeof(struct ip6_hdr
) < plen
) {
737 ip6stat
.ip6s_tooshort
++;
738 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_truncated
);
741 if (m
->m_pkthdr
.len
> sizeof(struct ip6_hdr
) + plen
) {
742 if (m
->m_len
== m
->m_pkthdr
.len
) {
743 m
->m_len
= sizeof(struct ip6_hdr
) + plen
;
744 m
->m_pkthdr
.len
= sizeof(struct ip6_hdr
) + plen
;
746 m_adj(m
, sizeof(struct ip6_hdr
) + plen
- m
->m_pkthdr
.len
);
750 * Forward if desirable.
752 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
)) {
754 * If we are acting as a multicast router, all
755 * incoming multicast packets are passed to the
756 * kernel-level multicast forwarding function.
757 * The packet is returned (relatively) intact; if
758 * ip6_mforward() returns a non-zero value, the packet
759 * must be discarded, else it may be accepted below.
761 if (ip6_mrouter
&& ip6_mforward(ip6
, m
->m_pkthdr
.rcvif
, m
)) {
762 ip6stat
.ip6s_cantforward
++;
768 ip6_forward(m
, srcrt
);
772 ip6
= mtod(m
, struct ip6_hdr
*);
775 * Malicious party may be able to use IPv4 mapped addr to confuse
776 * tcp/udp stack and bypass security checks (act as if it was from
777 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious.
779 * For SIIT end node behavior, you may want to disable the check.
780 * However, you will become vulnerable to attacks using IPv4 mapped
783 if (IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_src
) ||
784 IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_dst
)) {
785 ip6stat
.ip6s_badscope
++;
786 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
791 * Tell launch routine the next header
793 ip6stat
.ip6s_delivered
++;
794 in6_ifstat_inc(deliverifp
, ifs6_in_deliver
);
798 while (nxt
!= IPPROTO_DONE
) {
799 if (ip6_hdrnestlimit
&& (++nest
> ip6_hdrnestlimit
)) {
800 ip6stat
.ip6s_toomanyhdr
++;
801 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
806 * protection against faulty packet - there should be
807 * more sanity checks in header chain processing.
809 if (m
->m_pkthdr
.len
< off
) {
810 ip6stat
.ip6s_tooshort
++;
811 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_truncated
);
817 * do we need to do it for every header? yeah, other
818 * functions can play with it (like re-allocate and copy).
820 mhist
= ip6_addaux(m
);
821 if (mhist
&& M_TRAILINGSPACE(mhist
) >= sizeof(nxt
)) {
822 hist
= mtod(mhist
, caddr_t
) + mhist
->m_len
;
823 bcopy(&nxt
, hist
, sizeof(nxt
));
824 mhist
->m_len
+= sizeof(nxt
);
826 ip6stat
.ip6s_toomanyhdr
++;
831 if (nxt
== IPPROTO_ROUTING
) {
833 in6_ifstat_inc(m
->m_pkthdr
.rcvif
,
835 ip6stat
.ip6s_badoptions
++;
842 * enforce IPsec policy checking if we are seeing last header.
843 * note that we do not visit this with protocols with pcb layer
844 * code - like udp/tcp/raw ip.
846 if ((inet6sw
[ip6_protox
[nxt
]].pr_flags
& PR_LASTHDR
) &&
847 ipsec6_in_reject(m
, NULL
)) {
848 ipsec6stat
.in_polvio
++;
853 nxt
= (*inet6sw
[ip6_protox
[nxt
]].pr_input
)(&m
, &off
, nxt
);
860 /* msg was embedded in the mbuf, do not reply! */
864 * set/grab in6_ifaddr correspond to IPv6 destination address.
865 * XXX backward compatibility wrapper
867 static struct ip6aux
*
868 ip6_setdstifaddr(struct mbuf
*m
, struct in6_ifaddr
*ia6
)
874 n
->ip6a_dstia6
= ia6
;
875 return n
; /* NULL if failed to set */
879 ip6_getdstifaddr(struct mbuf
*m
)
885 return n
->ip6a_dstia6
;
891 * Hop-by-Hop options header processing. If a valid jumbo payload option is
892 * included, the real payload length will be stored in plenp.
895 ip6_hopopts_input(u_int32_t
*plenp
,
896 u_int32_t
*rtalertp
,/* XXX: should be stored more smart way */
900 struct mbuf
*m
= *mp
;
901 int off
= *offp
, hbhlen
;
905 /* validation of the length of the header */
906 #ifndef PULLDOWN_TEST
907 IP6_EXTHDR_CHECK(m
, off
, sizeof(*hbh
), -1);
908 hbh
= (struct ip6_hbh
*)(mtod(m
, caddr_t
) + off
);
909 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
911 IP6_EXTHDR_CHECK(m
, off
, hbhlen
, -1);
912 hbh
= (struct ip6_hbh
*)(mtod(m
, caddr_t
) + off
);
914 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
,
915 sizeof(struct ip6_hdr
), sizeof(struct ip6_hbh
));
917 ip6stat
.ip6s_tooshort
++;
920 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
921 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
, sizeof(struct ip6_hdr
),
924 ip6stat
.ip6s_tooshort
++;
929 hbhlen
-= sizeof(struct ip6_hbh
);
930 opt
= (u_int8_t
*)hbh
+ sizeof(struct ip6_hbh
);
932 if (ip6_process_hopopts(m
, (u_int8_t
*)hbh
+ sizeof(struct ip6_hbh
),
933 hbhlen
, rtalertp
, plenp
) < 0)
942 * Search header for all Hop-by-hop options and process each option.
943 * This function is separate from ip6_hopopts_input() in order to
944 * handle a case where the sending node itself process its hop-by-hop
945 * options header. In such a case, the function is called from ip6_output().
947 * The function assumes that hbh header is located right after the IPv6 header
948 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
949 * opthead + hbhlen is located in continuous memory region.
952 ip6_process_hopopts(struct mbuf
*m
, u_int8_t
*opthead
, int hbhlen
,
953 u_int32_t
*rtalertp
, u_int32_t
*plenp
)
957 u_int8_t
*opt
= opthead
;
958 u_int16_t rtalert_val
;
960 const int erroff
= sizeof(struct ip6_hdr
) + sizeof(struct ip6_hbh
);
962 for (; hbhlen
> 0; hbhlen
-= optlen
, opt
+= optlen
) {
968 if (hbhlen
< IP6OPT_MINLEN
) {
969 ip6stat
.ip6s_toosmall
++;
972 optlen
= *(opt
+ 1) + 2;
975 /* XXX may need check for alignment */
976 if (hbhlen
< IP6OPT_RTALERT_LEN
) {
977 ip6stat
.ip6s_toosmall
++;
980 if (*(opt
+ 1) != IP6OPT_RTALERT_LEN
- 2) {
982 icmp6_error(m
, ICMP6_PARAM_PROB
,
983 ICMP6_PARAMPROB_HEADER
,
984 erroff
+ opt
+ 1 - opthead
);
987 optlen
= IP6OPT_RTALERT_LEN
;
988 bcopy((caddr_t
)(opt
+ 2), (caddr_t
)&rtalert_val
, 2);
989 *rtalertp
= ntohs(rtalert_val
);
992 /* XXX may need check for alignment */
993 if (hbhlen
< IP6OPT_JUMBO_LEN
) {
994 ip6stat
.ip6s_toosmall
++;
997 if (*(opt
+ 1) != IP6OPT_JUMBO_LEN
- 2) {
999 icmp6_error(m
, ICMP6_PARAM_PROB
,
1000 ICMP6_PARAMPROB_HEADER
,
1001 erroff
+ opt
+ 1 - opthead
);
1004 optlen
= IP6OPT_JUMBO_LEN
;
1007 * IPv6 packets that have non 0 payload length
1008 * must not contain a jumbo payload option.
1010 ip6
= mtod(m
, struct ip6_hdr
*);
1011 if (ip6
->ip6_plen
) {
1012 ip6stat
.ip6s_badoptions
++;
1013 icmp6_error(m
, ICMP6_PARAM_PROB
,
1014 ICMP6_PARAMPROB_HEADER
,
1015 erroff
+ opt
- opthead
);
1020 * We may see jumbolen in unaligned location, so
1021 * we'd need to perform bcopy().
1023 bcopy(opt
+ 2, &jumboplen
, sizeof(jumboplen
));
1024 jumboplen
= (u_int32_t
)htonl(jumboplen
);
1028 * if there are multiple jumbo payload options,
1029 * *plenp will be non-zero and the packet will be
1031 * the behavior may need some debate in ipngwg -
1032 * multiple options does not make sense, however,
1033 * there's no explicit mention in specification.
1036 ip6stat
.ip6s_badoptions
++;
1037 icmp6_error(m
, ICMP6_PARAM_PROB
,
1038 ICMP6_PARAMPROB_HEADER
,
1039 erroff
+ opt
+ 2 - opthead
);
1045 * jumbo payload length must be larger than 65535.
1047 if (jumboplen
<= IPV6_MAXPACKET
) {
1048 ip6stat
.ip6s_badoptions
++;
1049 icmp6_error(m
, ICMP6_PARAM_PROB
,
1050 ICMP6_PARAMPROB_HEADER
,
1051 erroff
+ opt
+ 2 - opthead
);
1057 default: /* unknown option */
1058 if (hbhlen
< IP6OPT_MINLEN
) {
1059 ip6stat
.ip6s_toosmall
++;
1062 optlen
= ip6_unknown_opt(opt
, m
,
1063 erroff
+ opt
- opthead
);
1079 * Unknown option processing.
1080 * The third argument `off' is the offset from the IPv6 header to the option,
1081 * which is necessary if the IPv6 header the and option header and IPv6 header
1082 * is not continuous in order to return an ICMPv6 error.
1085 ip6_unknown_opt(u_int8_t
*optp
, struct mbuf
*m
, int off
)
1087 struct ip6_hdr
*ip6
;
1089 switch (IP6OPT_TYPE(*optp
)) {
1090 case IP6OPT_TYPE_SKIP
: /* ignore the option */
1091 return ((int)*(optp
+ 1));
1092 case IP6OPT_TYPE_DISCARD
: /* silently discard */
1095 case IP6OPT_TYPE_FORCEICMP
: /* send ICMP even if multicasted */
1096 ip6stat
.ip6s_badoptions
++;
1097 icmp6_error(m
, ICMP6_PARAM_PROB
, ICMP6_PARAMPROB_OPTION
, off
);
1099 case IP6OPT_TYPE_ICMP
: /* send ICMP if not multicasted */
1100 ip6stat
.ip6s_badoptions
++;
1101 ip6
= mtod(m
, struct ip6_hdr
*);
1102 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
) ||
1103 (m
->m_flags
& (M_BCAST
|M_MCAST
)))
1106 icmp6_error(m
, ICMP6_PARAM_PROB
,
1107 ICMP6_PARAMPROB_OPTION
, off
);
1111 m_freem(m
); /* XXX: NOTREACHED */
1116 * Create the "control" list for this pcb.
1117 * The function will not modify mbuf chain at all.
1119 * with KAME mbuf chain restriction:
1120 * The routine will be called from upper layer handlers like tcp6_input().
1121 * Thus the routine assumes that the caller (tcp6_input) have already
1122 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the
1123 * very first mbuf on the mbuf chain.
1126 ip6_savecontrol(struct inpcb
*in6p
, struct mbuf
**mp
, struct ip6_hdr
*ip6
,
1129 #define IS2292(x, y) ((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y))
1130 struct thread
*td
= curthread
; /* XXX */
1132 int rthdr_exist
= 0;
1135 if (priv_check(td
, PRIV_ROOT
) == 0)
1139 if (in6p
->in6p_socket
->so_options
& SO_TIMESTAMP
) {
1143 *mp
= sbcreatecontrol((caddr_t
) &tv
, sizeof(tv
),
1144 SCM_TIMESTAMP
, SOL_SOCKET
);
1146 mp
= &(*mp
)->m_next
;
1151 /* RFC 2292 sec. 5 */
1152 if (in6p
->in6p_flags
& IN6P_PKTINFO
) {
1153 struct in6_pktinfo pi6
;
1154 bcopy(&ip6
->ip6_dst
, &pi6
.ipi6_addr
, sizeof(struct in6_addr
));
1155 if (IN6_IS_SCOPE_LINKLOCAL(&pi6
.ipi6_addr
))
1156 pi6
.ipi6_addr
.s6_addr16
[1] = 0;
1157 pi6
.ipi6_ifindex
= (m
&& m
->m_pkthdr
.rcvif
)
1158 ? m
->m_pkthdr
.rcvif
->if_index
1160 *mp
= sbcreatecontrol((caddr_t
) &pi6
,
1161 sizeof(struct in6_pktinfo
), IS2292(IPV6_2292PKTINFO
, IPV6_PKTINFO
),
1164 mp
= &(*mp
)->m_next
;
1167 if (in6p
->in6p_flags
& IN6P_HOPLIMIT
) {
1168 int hlim
= ip6
->ip6_hlim
& 0xff;
1169 *mp
= sbcreatecontrol((caddr_t
) &hlim
,
1170 sizeof(int), IS2292(IPV6_2292HOPLIMIT
, IPV6_HOPLIMIT
), IPPROTO_IPV6
);
1172 mp
= &(*mp
)->m_next
;
1175 if ((in6p
->in6p_flags
& IN6P_TCLASS
) != 0) {
1179 flowinfo
= (u_int32_t
)ntohl(ip6
->ip6_flow
& IPV6_FLOWINFO_MASK
);
1182 tclass
= flowinfo
& 0xff;
1183 *mp
= sbcreatecontrol((caddr_t
) &tclass
, sizeof(tclass
),
1184 IPV6_TCLASS
, IPPROTO_IPV6
);
1186 mp
= &(*mp
)->m_next
;
1190 * IPV6_HOPOPTS socket option. We require super-user privilege
1191 * for the option, but it might be too strict, since there might
1192 * be some hop-by-hop options which can be returned to normal user.
1193 * See RFC 2292 section 6.
1195 if ((in6p
->in6p_flags
& IN6P_HOPOPTS
) && privileged
) {
1197 * Check if a hop-by-hop options header is contatined in the
1198 * received packet, and if so, store the options as ancillary
1199 * data. Note that a hop-by-hop options header must be
1200 * just after the IPv6 header, which fact is assured through
1201 * the IPv6 input processing.
1203 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1204 if (ip6
->ip6_nxt
== IPPROTO_HOPOPTS
) {
1205 struct ip6_hbh
*hbh
;
1207 #ifdef PULLDOWN_TEST
1211 #ifndef PULLDOWN_TEST
1212 hbh
= (struct ip6_hbh
*)(ip6
+ 1);
1213 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
1215 ext
= ip6_pullexthdr(m
, sizeof(struct ip6_hdr
),
1218 ip6stat
.ip6s_tooshort
++;
1221 hbh
= mtod(ext
, struct ip6_hbh
*);
1222 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
1223 if (hbhlen
!= ext
->m_len
) {
1225 ip6stat
.ip6s_tooshort
++;
1231 * XXX: We copy whole the header even if a jumbo
1232 * payload option is included, which option is to
1233 * be removed before returning in the RFC 2292.
1234 * Note: this constraint is removed in 2292bis.
1236 *mp
= sbcreatecontrol((caddr_t
)hbh
, hbhlen
,
1237 IS2292(IPV6_2292HOPOPTS
, IPV6_HOPOPTS
), IPPROTO_IPV6
);
1239 mp
= &(*mp
)->m_next
;
1240 #ifdef PULLDOWN_TEST
1246 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */
1247 if ((in6p
->in6p_flags
& (IN6P_DSTOPTS
| IN6P_RTHDRDSTOPTS
)) != 0) {
1248 int proto
, off
, nxt
;
1251 * go through the header chain to see if a routing header is
1252 * contained in the packet. We need this information to store
1253 * destination options headers (if any) properly.
1254 * XXX: performance issue. We should record this info when
1255 * processing extension headers in incoming routine.
1258 proto
= IPPROTO_IPV6
;
1264 newoff
= ip6_nexthdr(m
, off
, proto
, &nxt
);
1267 if (newoff
< off
) /* invalid, check for safety */
1269 if ((proto
= nxt
) == IPPROTO_ROUTING
) {
1277 if ((in6p
->in6p_flags
&
1278 (IN6P_RTHDR
| IN6P_DSTOPTS
| IN6P_RTHDRDSTOPTS
)) != 0) {
1279 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1280 int nxt
= ip6
->ip6_nxt
, off
= sizeof(struct ip6_hdr
);
1283 * Search for destination options headers or routing
1284 * header(s) through the header chain, and stores each
1285 * header as ancillary data.
1286 * Note that the order of the headers remains in
1287 * the chain of ancillary data.
1289 while (1) { /* is explicit loop prevention necessary? */
1290 struct ip6_ext
*ip6e
= NULL
;
1292 #ifdef PULLDOWN_TEST
1293 struct mbuf
*ext
= NULL
;
1297 * if it is not an extension header, don't try to
1298 * pull it from the chain.
1301 case IPPROTO_DSTOPTS
:
1302 case IPPROTO_ROUTING
:
1303 case IPPROTO_HOPOPTS
:
1304 case IPPROTO_AH
: /* is it possible? */
1310 #ifndef PULLDOWN_TEST
1311 if (off
+ sizeof(*ip6e
) > m
->m_len
)
1313 ip6e
= (struct ip6_ext
*)(mtod(m
, caddr_t
) + off
);
1314 if (nxt
== IPPROTO_AH
)
1315 elen
= (ip6e
->ip6e_len
+ 2) << 2;
1317 elen
= (ip6e
->ip6e_len
+ 1) << 3;
1318 if (off
+ elen
> m
->m_len
)
1321 ext
= ip6_pullexthdr(m
, off
, nxt
);
1323 ip6stat
.ip6s_tooshort
++;
1326 ip6e
= mtod(ext
, struct ip6_ext
*);
1327 if (nxt
== IPPROTO_AH
)
1328 elen
= (ip6e
->ip6e_len
+ 2) << 2;
1330 elen
= (ip6e
->ip6e_len
+ 1) << 3;
1331 if (elen
!= ext
->m_len
) {
1333 ip6stat
.ip6s_tooshort
++;
1339 case IPPROTO_DSTOPTS
:
1340 if ((in6p
->in6p_flags
& IN6P_DSTOPTS
) == 0)
1344 * We also require super-user privilege for
1346 * See the comments on IN6_HOPOPTS.
1351 *mp
= sbcreatecontrol((caddr_t
)ip6e
, elen
,
1352 IS2292(IPV6_2292DSTOPTS
, IPV6_DSTOPTS
),
1355 mp
= &(*mp
)->m_next
;
1357 case IPPROTO_ROUTING
:
1358 if (!in6p
->in6p_flags
& IN6P_RTHDR
)
1361 *mp
= sbcreatecontrol((caddr_t
)ip6e
, elen
,
1362 IS2292(IPV6_2292RTHDR
, IPV6_RTHDR
),
1365 mp
= &(*mp
)->m_next
;
1367 case IPPROTO_HOPOPTS
:
1368 case IPPROTO_AH
: /* is it possible? */
1373 * other cases have been filtered in the above.
1374 * none will visit this case. here we supply
1375 * the code just in case (nxt overwritten or
1378 #ifdef PULLDOWN_TEST
1385 /* proceed with the next header. */
1387 nxt
= ip6e
->ip6e_nxt
;
1389 #ifdef PULLDOWN_TEST
1401 ip6_notify_pmtu(struct inpcb
*in6p
, struct sockaddr_in6
*dst
, u_int32_t
*mtu
)
1405 struct ip6_mtuinfo mtuctl
;
1407 so
= in6p
->inp_socket
;
1413 if (so
== NULL
) /* I believe this is impossible */
1414 panic("ip6_notify_pmtu: socket is NULL");
1417 bzero(&mtuctl
, sizeof(mtuctl
)); /* zero-clear for safety */
1418 mtuctl
.ip6m_mtu
= *mtu
;
1419 mtuctl
.ip6m_addr
= *dst
;
1421 if ((m_mtu
= sbcreatecontrol((caddr_t
)&mtuctl
, sizeof(mtuctl
),
1422 IPV6_PATHMTU
, IPPROTO_IPV6
)) == NULL
)
1425 if (sbappendaddr(&so
->so_rcv
.sb
, (struct sockaddr
*)dst
, NULL
, m_mtu
)
1428 /* XXX: should count statistics */
1435 #ifdef PULLDOWN_TEST
1437 * pull single extension header from mbuf chain. returns single mbuf that
1438 * contains the result, or NULL on error.
1440 static struct mbuf
*
1441 ip6_pullexthdr(struct mbuf
*m
, size_t off
, int nxt
)
1443 struct ip6_ext ip6e
;
1449 case IPPROTO_DSTOPTS
:
1450 case IPPROTO_ROUTING
:
1451 case IPPROTO_HOPOPTS
:
1452 case IPPROTO_AH
: /* is it possible? */
1455 kprintf("ip6_pullexthdr: invalid nxt=%d\n", nxt
);
1459 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1460 if (nxt
== IPPROTO_AH
)
1461 elen
= (ip6e
.ip6e_len
+ 2) << 2;
1463 elen
= (ip6e
.ip6e_len
+ 1) << 3;
1465 n
= m_getb(elen
, MB_DONTWAIT
, MT_DATA
, 0);
1470 if (elen
>= M_TRAILINGSPACE(n
)) {
1475 m_copydata(m
, off
, elen
, mtod(n
, caddr_t
));
1482 * Get pointer to the previous header followed by the header
1483 * currently processed.
1484 * XXX: This function supposes that
1485 * M includes all headers,
1486 * the next header field and the header length field of each header
1488 * the sum of each header length equals to OFF.
1489 * Because of these assumptions, this function must be called very
1490 * carefully. Moreover, it will not be used in the near future when
1491 * we develop `neater' mechanism to process extension headers.
1494 ip6_get_prevhdr(struct mbuf
*m
, int off
)
1496 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1498 if (off
== sizeof(struct ip6_hdr
))
1499 return (&ip6
->ip6_nxt
);
1502 struct ip6_ext
*ip6e
= NULL
;
1505 len
= sizeof(struct ip6_hdr
);
1507 ip6e
= (struct ip6_ext
*)(mtod(m
, caddr_t
) + len
);
1510 case IPPROTO_FRAGMENT
:
1511 len
+= sizeof(struct ip6_frag
);
1514 len
+= (ip6e
->ip6e_len
+ 2) << 2;
1517 len
+= (ip6e
->ip6e_len
+ 1) << 3;
1520 nxt
= ip6e
->ip6e_nxt
;
1523 return (&ip6e
->ip6e_nxt
);
1530 * get next header offset. m will be retained.
1533 ip6_nexthdr(struct mbuf
*m
, int off
, int proto
, int *nxtp
)
1536 struct ip6_ext ip6e
;
1541 panic("ip6_nexthdr: m == NULL");
1542 if ((m
->m_flags
& M_PKTHDR
) == 0 || m
->m_pkthdr
.len
< off
)
1547 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6
))
1549 m_copydata(m
, off
, sizeof(ip6
), (caddr_t
)&ip6
);
1551 *nxtp
= ip6
.ip6_nxt
;
1555 case IPPROTO_FRAGMENT
:
1557 * terminate parsing if it is not the first fragment,
1558 * it does not make sense to parse through it.
1560 if (m
->m_pkthdr
.len
< off
+ sizeof(fh
))
1562 m_copydata(m
, off
, sizeof(fh
), (caddr_t
)&fh
);
1563 /* IP6F_OFF_MASK = 0xfff8(BigEndian), 0xf8ff(LittleEndian) */
1564 if (fh
.ip6f_offlg
& IP6F_OFF_MASK
)
1567 *nxtp
= fh
.ip6f_nxt
;
1568 off
+= sizeof(struct ip6_frag
);
1572 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6e
))
1574 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1576 *nxtp
= ip6e
.ip6e_nxt
;
1577 off
+= (ip6e
.ip6e_len
+ 2) << 2;
1580 case IPPROTO_HOPOPTS
:
1581 case IPPROTO_ROUTING
:
1582 case IPPROTO_DSTOPTS
:
1583 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6e
))
1585 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1587 *nxtp
= ip6e
.ip6e_nxt
;
1588 off
+= (ip6e
.ip6e_len
+ 1) << 3;
1593 case IPPROTO_IPCOMP
:
1605 * get offset for the last header in the chain. m will be kept untainted.
1608 ip6_lasthdr(struct mbuf
*m
, int off
, int proto
, int *nxtp
)
1618 newoff
= ip6_nexthdr(m
, off
, proto
, nxtp
);
1621 else if (newoff
< off
)
1622 return -1; /* invalid */
1623 else if (newoff
== off
)
1632 ip6_addaux(struct mbuf
*m
)
1634 struct m_tag
*tag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1636 tag
= m_tag_get(PACKET_TAG_IPV6_INPUT
,
1637 sizeof (struct ip6aux
),
1640 m_tag_prepend(m
, tag
);
1643 bzero(m_tag_data(tag
), sizeof (struct ip6aux
));
1644 return tag
? (struct ip6aux
*)m_tag_data(tag
) : NULL
;
1648 ip6_findaux(struct mbuf
*m
)
1650 struct m_tag
*tag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1651 return tag
? (struct ip6aux
*)(tag
+1) : NULL
;
1655 ip6_delaux(struct mbuf
*m
)
1657 struct m_tag
*tag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1659 m_tag_delete(m
, tag
);
1663 * System control for IP6
1666 u_char inet6ctlerrmap
[PRC_NCMDS
] = {
1668 0, EMSGSIZE
, EHOSTDOWN
, EHOSTUNREACH
,
1669 EHOSTUNREACH
, EHOSTUNREACH
, ECONNREFUSED
, ECONNREFUSED
,
1670 EMSGSIZE
, EHOSTUNREACH
, 0, 0,