1 /* $FreeBSD: src/sys/netinet6/ip6_input.c,v 1.11.2.15 2003/01/24 05:11:35 sam Exp $ */
2 /* $KAME: ip6_input.c,v 1.259 2002/01/21 04:58:09 jinmei Exp $ */
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * Copyright (c) 1982, 1986, 1988, 1993
35 * The Regents of the University of California. All rights reserved.
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. Neither the name of the University nor the names of its contributors
46 * may be used to endorse or promote products derived from this software
47 * without specific prior written permission.
49 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
61 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94
64 #include "opt_ip6fw.h"
66 #include "opt_inet6.h"
67 #include "opt_ipsec.h"
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/malloc.h>
73 #include <sys/domain.h>
74 #include <sys/protosw.h>
75 #include <sys/socket.h>
76 #include <sys/socketvar.h>
77 #include <sys/errno.h>
79 #include <sys/kernel.h>
80 #include <sys/syslog.h>
85 #include <net/if_types.h>
86 #include <net/if_dl.h>
87 #include <net/route.h>
88 #include <net/netisr.h>
91 #include <sys/thread2.h>
92 #include <sys/msgport2.h>
93 #include <net/netmsg2.h>
94 #include <net/netisr2.h>
96 #include <netinet/in.h>
97 #include <netinet/in_systm.h>
99 #include <netinet/ip.h>
100 #include <netinet/ip_icmp.h>
102 #include <netinet/ip6.h>
103 #include <netinet6/in6_var.h>
104 #include <netinet6/ip6_var.h>
105 #include <netinet/in_pcb.h>
106 #include <netinet/icmp6.h>
107 #include <netinet6/scope6_var.h>
108 #include <netinet6/in6_ifattach.h>
109 #include <netinet6/nd6.h>
112 #include <netinet6/ipsec.h>
114 #include <netinet6/ipsec6.h>
119 #include <netproto/ipsec/ipsec.h>
120 #include <netproto/ipsec/ipsec6.h>
122 #endif /* FAST_IPSEC */
124 #include <net/ip6fw/ip6_fw.h>
126 #include <netinet6/ip6protosw.h>
128 #include <net/net_osdep.h>
130 extern struct domain inet6domain
;
131 extern struct protosw inet6sw
[];
133 u_char ip6_protox
[IPPROTO_MAX
];
134 struct in6_ifaddr
*in6_ifaddr
;
136 int ip6_forward_srcrt
; /* XXX */
137 int ip6_sourcecheck
; /* XXX */
138 int ip6_sourcecheck_interval
; /* XXX */
140 int ip6_ours_check_algorithm
;
142 struct pfil_head inet6_pfil_hook
;
145 ip6_fw_chk_t
*ip6_fw_chk_ptr
;
146 ip6_fw_ctl_t
*ip6_fw_ctl_ptr
;
147 int ip6_fw_enable
= 1;
149 struct ip6stat ip6stat
;
151 static void ip6_init2 (void *);
152 static struct ip6aux
*ip6_setdstifaddr (struct mbuf
*, struct in6_ifaddr
*);
153 static int ip6_hopopts_input (u_int32_t
*, u_int32_t
*, struct mbuf
**, int *);
154 static void ip6_input(netmsg_t msg
);
156 static struct mbuf
*ip6_pullexthdr (struct mbuf
*, size_t, int);
158 static void transport6_processing_handler(netmsg_t netmsg
);
161 * IP6 initialization: fill in IP6 protocol switch table.
162 * All protocols not implemented in kernel go to raw IP6 protocol handler.
171 pr
= pffindproto(PF_INET6
, IPPROTO_RAW
, SOCK_RAW
);
174 for (i
= 0; i
< IPPROTO_MAX
; i
++)
175 ip6_protox
[i
] = pr
- inet6sw
;
176 for (pr
= inet6domain
.dom_protosw
;
177 pr
< inet6domain
.dom_protoswNPROTOSW
; pr
++)
178 if (pr
->pr_domain
->dom_family
== PF_INET6
&&
179 pr
->pr_protocol
&& pr
->pr_protocol
!= IPPROTO_RAW
)
180 ip6_protox
[pr
->pr_protocol
] = pr
- inet6sw
;
182 inet6_pfil_hook
.ph_type
= PFIL_TYPE_AF
;
183 inet6_pfil_hook
.ph_af
= AF_INET6
;
184 if ((i
= pfil_head_register(&inet6_pfil_hook
)) != 0) {
185 kprintf("%s: WARNING: unable to register pfil hook, "
186 "error %d\n", __func__
, i
);
189 netisr_register(NETISR_IPV6
, ip6_input
, NULL
); /* XXX hashfn */
191 addrsel_policy_init();
195 * in many cases, random() here does NOT return random number
196 * as initialization during bootstrap time occur in fixed order.
199 ip6_flow_seq
= krandom() ^ tv
.tv_usec
;
201 ip6_desync_factor
= (krandom() ^ tv
.tv_usec
) % MAX_TEMP_DESYNC_FACTOR
;
205 ip6_init2(void *dummy
)
208 in6_tmpaddrtimer_init();
212 /* This must be after route_init(), which is now SI_ORDER_THIRD */
213 SYSINIT(netinet6init2
, SI_SUB_PROTO_DOMAIN
, SI_ORDER_MIDDLE
, ip6_init2
, NULL
);
215 extern struct route_in6 ip6_forward_rt
;
218 ip6_input(netmsg_t msg
)
220 struct mbuf
*m
= msg
->packet
.nm_packet
;
222 int off
= sizeof(struct ip6_hdr
), nest
;
224 u_int32_t rtalert
= ~0;
225 int nxt
, ours
= 0, rh_present
= 0;
226 struct ifnet
*deliverifp
= NULL
;
227 struct in6_addr odst
;
232 * should the inner packet be considered authentic?
233 * see comment in ah4_input().
236 m
->m_flags
&= ~M_AUTHIPHDR
;
237 m
->m_flags
&= ~M_AUTHIPDGM
;
242 * make sure we don't have onion peering information into m_aux.
249 if (m
->m_flags
& M_EXT
) {
251 ip6stat
.ip6s_mext2m
++;
253 ip6stat
.ip6s_mext1
++;
255 #define M2MMAX NELEM(ip6stat.ip6s_m2m)
257 if (m
->m_flags
& M_LOOP
) {
258 ip6stat
.ip6s_m2m
[loif
->if_index
]++; /* XXX */
259 } else if (m
->m_pkthdr
.rcvif
->if_index
< M2MMAX
)
260 ip6stat
.ip6s_m2m
[m
->m_pkthdr
.rcvif
->if_index
]++;
262 ip6stat
.ip6s_m2m
[0]++;
268 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_receive
);
269 ip6stat
.ip6s_total
++;
271 #ifndef PULLDOWN_TEST
273 * L2 bridge code and some other code can return mbuf chain
274 * that does not conform to KAME requirement. too bad.
275 * XXX: fails to join if interface MTU > MCLBYTES. jumbogram?
277 if (m
&& m
->m_next
!= NULL
&& m
->m_pkthdr
.len
< MCLBYTES
) {
280 n
= m_getb(m
->m_pkthdr
.len
, M_NOWAIT
, MT_HEADER
, M_PKTHDR
);
285 m_copydata(m
, 0, n
->m_pkthdr
.len
, mtod(n
, caddr_t
));
286 n
->m_len
= n
->m_pkthdr
.len
;
290 IP6_EXTHDR_CHECK_VOIDRET(m
, 0, sizeof(struct ip6_hdr
));
293 if (m
->m_len
< sizeof(struct ip6_hdr
)) {
295 inifp
= m
->m_pkthdr
.rcvif
;
296 if ((m
= m_pullup(m
, sizeof(struct ip6_hdr
))) == NULL
) {
297 ip6stat
.ip6s_toosmall
++;
298 in6_ifstat_inc(inifp
, ifs6_in_hdrerr
);
303 ip6
= mtod(m
, struct ip6_hdr
*);
305 if ((ip6
->ip6_vfc
& IPV6_VERSION_MASK
) != IPV6_VERSION
) {
306 ip6stat
.ip6s_badvers
++;
307 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
312 * Run through list of hooks for input packets.
314 * NB: Beware of the destination address changing
315 * (e.g. by NAT rewriting). When this happens,
316 * tell ip6_forward to do the right thing.
318 if (pfil_has_hooks(&inet6_pfil_hook
)) {
320 if (pfil_run_hooks(&inet6_pfil_hook
, &m
,
321 m
->m_pkthdr
.rcvif
, PFIL_IN
)) {
324 if (m
== NULL
) /* consumed by filter */
326 ip6
= mtod(m
, struct ip6_hdr
*);
327 srcrt
= !IN6_ARE_ADDR_EQUAL(&odst
, &ip6
->ip6_dst
);
330 ip6stat
.ip6s_nxthist
[ip6
->ip6_nxt
]++;
333 if (altq_input
!= NULL
&& (*altq_input
)(m
, AF_INET6
) == 0) {
334 /* packet is dropped by traffic conditioner */
340 * Check with the firewall...
342 if (ip6_fw_enable
&& ip6_fw_chk_ptr
) {
344 /* If ipfw says divert, we have to just drop packet */
345 /* use port as a dummy argument */
346 if ((*ip6_fw_chk_ptr
)(&ip6
, NULL
, &port
, &m
)) {
355 * Check against address spoofing/corruption.
357 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_src
) ||
358 IN6_IS_ADDR_UNSPECIFIED(&ip6
->ip6_dst
)) {
360 * XXX: "badscope" is not very suitable for a multicast source.
362 ip6stat
.ip6s_badscope
++;
363 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
366 if ((IN6_IS_ADDR_LOOPBACK(&ip6
->ip6_src
) ||
367 IN6_IS_ADDR_LOOPBACK(&ip6
->ip6_dst
)) &&
368 (m
->m_pkthdr
.rcvif
->if_flags
& IFF_LOOPBACK
) == 0) {
369 ip6stat
.ip6s_badscope
++;
370 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
375 * The following check is not documented in specs. A malicious
376 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
377 * and bypass security checks (act as if it was from 127.0.0.1 by using
378 * IPv6 src ::ffff:127.0.0.1). Be cautious.
380 * This check chokes if we are in an SIIT cloud. As none of BSDs
381 * support IPv4-less kernel compilation, we cannot support SIIT
382 * environment at all. So, it makes more sense for us to reject any
383 * malicious packets for non-SIIT environment, than try to do a
384 * partial support for SIIT environment.
386 if (IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_src
) ||
387 IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_dst
)) {
388 ip6stat
.ip6s_badscope
++;
389 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
394 * Reject packets with IPv4 compatible addresses (auto tunnel).
396 * The code forbids auto tunnel relay case in RFC1933 (the check is
397 * stronger than RFC1933). We may want to re-enable it if mech-xx
398 * is revised to forbid relaying case.
400 if (IN6_IS_ADDR_V4COMPAT(&ip6
->ip6_src
) ||
401 IN6_IS_ADDR_V4COMPAT(&ip6
->ip6_dst
)) {
402 ip6stat
.ip6s_badscope
++;
403 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
408 /* drop packets if interface ID portion is already filled */
409 if ((m
->m_pkthdr
.rcvif
->if_flags
& IFF_LOOPBACK
) == 0) {
410 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_src
) &&
411 ip6
->ip6_src
.s6_addr16
[1]) {
412 ip6stat
.ip6s_badscope
++;
415 if ((IN6_IS_ADDR_MC_INTFACELOCAL(&ip6
->ip6_dst
) ||
416 IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_dst
)) &&
417 ip6
->ip6_dst
.s6_addr16
[1]) {
418 ip6stat
.ip6s_badscope
++;
423 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_src
))
424 ip6
->ip6_src
.s6_addr16
[1]
425 = htons(m
->m_pkthdr
.rcvif
->if_index
);
426 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_dst
))
427 ip6
->ip6_dst
.s6_addr16
[1]
428 = htons(m
->m_pkthdr
.rcvif
->if_index
);
433 * WARNING! For general subnet proxying the interface hw will
434 * likely filter out the multicast solicitations, so
435 * the interface must be in promiscuous mode.
437 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
)) {
439 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_mcast
);
440 deliverifp
= m
->m_pkthdr
.rcvif
;
447 if (ip6_forward_rt
.ro_rt
!= NULL
&&
448 (ip6_forward_rt
.ro_rt
->rt_flags
& RTF_UP
) &&
449 IN6_ARE_ADDR_EQUAL(&ip6
->ip6_dst
,
450 &((struct sockaddr_in6
*)(&ip6_forward_rt
.ro_dst
))->sin6_addr
)) {
451 ip6stat
.ip6s_forward_cachehit
++;
453 struct sockaddr_in6
*dst6
;
455 if (ip6_forward_rt
.ro_rt
) {
456 /* route is down or destination is different */
457 ip6stat
.ip6s_forward_cachemiss
++;
458 RTFREE(ip6_forward_rt
.ro_rt
);
459 ip6_forward_rt
.ro_rt
= 0;
462 bzero(&ip6_forward_rt
.ro_dst
, sizeof(struct sockaddr_in6
));
463 dst6
= &ip6_forward_rt
.ro_dst
;
464 dst6
->sin6_len
= sizeof(struct sockaddr_in6
);
465 dst6
->sin6_family
= AF_INET6
;
466 dst6
->sin6_addr
= ip6
->ip6_dst
;
468 rtalloc_ign((struct route
*)&ip6_forward_rt
, RTF_PRCLONING
);
471 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key))
474 * Accept the packet if the forwarding interface to the destination
475 * according to the routing table is the loopback interface,
476 * unless the associated route has a gateway.
477 * Note that this approach causes to accept a packet if there is a
478 * route to the loopback interface for the destination of the packet.
479 * But we think it's even useful in some situations, e.g. when using
480 * a special daemon which wants to intercept the packet.
482 * XXX: some OSes automatically make a cloned route for the destination
483 * of an outgoing packet. If the outgoing interface of the packet
484 * is a loopback one, the kernel would consider the packet to be
485 * accepted, even if we have no such address assinged on the interface.
486 * We check the cloned flag of the route entry to reject such cases,
487 * assuming that route entries for our own addresses are not made by
488 * cloning (it should be true because in6_addloop explicitly installs
489 * the host route). However, we might have to do an explicit check
490 * while it would be less efficient. Or, should we rather install a
491 * reject route for such a case?
493 if (ip6_forward_rt
.ro_rt
&&
494 (ip6_forward_rt
.ro_rt
->rt_flags
&
495 (RTF_HOST
|RTF_GATEWAY
)) == RTF_HOST
&&
497 !(ip6_forward_rt
.ro_rt
->rt_flags
& RTF_WASCLONED
) &&
500 !(ip6_forward_rt
.ro_rt
->rt_flags
& RTF_CLONED
) &&
504 * The check below is redundant since the comparison of
505 * the destination and the key of the rtentry has
506 * already done through looking up the routing table.
508 IN6_ARE_ADDR_EQUAL(&ip6
->ip6_dst
,
509 &rt6_key(ip6_forward_rt
.ro_rt
)->sin6_addr
)
511 ip6_forward_rt
.ro_rt
->rt_ifp
->if_type
== IFT_LOOP
) {
512 struct in6_ifaddr
*ia6
=
513 (struct in6_ifaddr
*)ip6_forward_rt
.ro_rt
->rt_ifa
;
516 * record address information into m_aux.
518 ip6_setdstifaddr(m
, ia6
);
521 * packets to a tentative, duplicated, or somehow invalid
522 * address must not be accepted.
524 if (!(ia6
->ia6_flags
& IN6_IFF_NOTREADY
)) {
525 /* this address is ready */
527 deliverifp
= ia6
->ia_ifp
; /* correct? */
528 /* Count the packet in the ip address stats */
529 IFA_STAT_INC(&ia6
->ia_ifa
, ipackets
, 1);
530 IFA_STAT_INC(&ia6
->ia_ifa
, ibytes
, m
->m_pkthdr
.len
);
533 /* address is not ready, so discard the packet. */
535 "ip6_input: packet to an unready address %s->%s\n",
536 ip6_sprintf(&ip6
->ip6_src
),
537 ip6_sprintf(&ip6
->ip6_dst
)));
544 * FAITH (Firewall Aided Internet Translator)
547 if (ip6_forward_rt
.ro_rt
&& ip6_forward_rt
.ro_rt
->rt_ifp
548 && ip6_forward_rt
.ro_rt
->rt_ifp
->if_type
== IFT_FAITH
) {
549 /* XXX do we need more sanity checks? */
551 deliverifp
= ip6_forward_rt
.ro_rt
->rt_ifp
; /* faith */
557 * Now there is no reason to process the packet if it's not our own
558 * and we're not a router.
560 if (!ip6_forwarding
) {
561 ip6stat
.ip6s_cantforward
++;
562 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
568 * record address information into m_aux, if we don't have one yet.
569 * note that we are unable to record it, if the address is not listed
570 * as our interface address (e.g. multicast addresses, addresses
571 * within FAITH prefixes and such).
573 if (deliverifp
&& !ip6_getdstifaddr(m
)) {
574 struct in6_ifaddr
*ia6
;
576 ia6
= in6_ifawithifp(deliverifp
, &ip6
->ip6_dst
);
578 if (!ip6_setdstifaddr(m
, ia6
)) {
580 * XXX maybe we should drop the packet here,
581 * as we could not provide enough information
582 * to the upper layers.
589 * Process Hop-by-Hop options header if it's contained.
590 * m may be modified in ip6_hopopts_input().
591 * If a JumboPayload option is included, plen will also be modified.
593 plen
= (u_int32_t
)ntohs(ip6
->ip6_plen
);
594 if (ip6
->ip6_nxt
== IPPROTO_HOPOPTS
) {
597 if (ip6_hopopts_input(&plen
, &rtalert
, &m
, &off
)) {
598 #if 0 /*touches NULL pointer*/
599 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
601 goto bad2
; /* m have already been freed */
605 ip6
= mtod(m
, struct ip6_hdr
*);
608 * if the payload length field is 0 and the next header field
609 * indicates Hop-by-Hop Options header, then a Jumbo Payload
610 * option MUST be included.
612 if (ip6
->ip6_plen
== 0 && plen
== 0) {
614 * Note that if a valid jumbo payload option is
615 * contained, ip6_hoptops_input() must set a valid
616 * (non-zero) payload length to the variable plen.
618 ip6stat
.ip6s_badoptions
++;
619 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
620 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
621 icmp6_error(m
, ICMP6_PARAM_PROB
,
622 ICMP6_PARAMPROB_HEADER
,
623 (caddr_t
)&ip6
->ip6_plen
- (caddr_t
)ip6
);
626 #ifndef PULLDOWN_TEST
627 /* ip6_hopopts_input() ensures that mbuf is contiguous */
628 hbh
= (struct ip6_hbh
*)(ip6
+ 1);
630 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
, sizeof(struct ip6_hdr
),
631 sizeof(struct ip6_hbh
));
633 ip6stat
.ip6s_tooshort
++;
640 * If we are acting as a router and the packet contains a
641 * router alert option, see if we know the option value.
642 * Currently, we only support the option value for MLD, in which
643 * case we should pass the packet to the multicast routing
646 if (rtalert
!= ~0 && ip6_forwarding
) {
648 case IP6OPT_RTALERT_MLD
:
653 * RFC2711 requires unrecognized values must be
663 * Check that the amount of data in the buffers
664 * is as at least much as the IPv6 header would have us expect.
665 * Trim mbufs if longer than we expect.
666 * Drop packet if shorter than we expect.
668 if (m
->m_pkthdr
.len
- sizeof(struct ip6_hdr
) < plen
) {
669 ip6stat
.ip6s_tooshort
++;
670 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_truncated
);
673 if (m
->m_pkthdr
.len
> sizeof(struct ip6_hdr
) + plen
) {
674 if (m
->m_len
== m
->m_pkthdr
.len
) {
675 m
->m_len
= sizeof(struct ip6_hdr
) + plen
;
676 m
->m_pkthdr
.len
= sizeof(struct ip6_hdr
) + plen
;
678 m_adj(m
, sizeof(struct ip6_hdr
) + plen
- m
->m_pkthdr
.len
);
682 * Forward if desirable.
684 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
)) {
686 * If we are acting as a multicast router, all
687 * incoming multicast packets are passed to the
688 * kernel-level multicast forwarding function.
689 * The packet is returned (relatively) intact; if
690 * ip6_mforward() returns a non-zero value, the packet
691 * must be discarded, else it may be accepted below.
693 if (ip6_mrouter
&& ip6_mforward(ip6
, m
->m_pkthdr
.rcvif
, m
)) {
694 ip6stat
.ip6s_cantforward
++;
700 ip6_forward(m
, srcrt
);
704 ip6
= mtod(m
, struct ip6_hdr
*);
707 * Malicious party may be able to use IPv4 mapped addr to confuse
708 * tcp/udp stack and bypass security checks (act as if it was from
709 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious.
711 * For SIIT end node behavior, you may want to disable the check.
712 * However, you will become vulnerable to attacks using IPv4 mapped
715 if (IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_src
) ||
716 IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_dst
)) {
717 ip6stat
.ip6s_badscope
++;
718 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
723 * Tell launch routine the next header
725 ip6stat
.ip6s_delivered
++;
726 in6_ifstat_inc(deliverifp
, ifs6_in_deliver
);
730 while (nxt
!= IPPROTO_DONE
) {
733 if (ip6_hdrnestlimit
&& (++nest
> ip6_hdrnestlimit
)) {
734 ip6stat
.ip6s_toomanyhdr
++;
735 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
740 * protection against faulty packet - there should be
741 * more sanity checks in header chain processing.
743 if (m
->m_pkthdr
.len
< off
) {
744 ip6stat
.ip6s_tooshort
++;
745 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_truncated
);
751 * do we need to do it for every header? yeah, other
752 * functions can play with it (like re-allocate and copy).
754 mhist
= ip6_addaux(m
);
755 if (mhist
&& M_TRAILINGSPACE(mhist
) >= sizeof(nxt
)) {
756 hist
= mtod(mhist
, caddr_t
) + mhist
->m_len
;
757 bcopy(&nxt
, hist
, sizeof(nxt
));
758 mhist
->m_len
+= sizeof(nxt
);
760 ip6stat
.ip6s_toomanyhdr
++;
765 if (nxt
== IPPROTO_ROUTING
) {
767 in6_ifstat_inc(m
->m_pkthdr
.rcvif
,
769 ip6stat
.ip6s_badoptions
++;
774 sw6
= &inet6sw
[ip6_protox
[nxt
]];
777 * enforce IPsec policy checking if we are seeing last header.
778 * note that we do not visit this with protocols with pcb layer
779 * code - like udp/tcp/raw ip.
781 if ((sw6
->pr_flags
& PR_LASTHDR
) && ipsec6_in_reject(m
, NULL
)) {
782 ipsec6stat
.in_polvio
++;
787 * If this is a terminal header forward to the port, otherwise
788 * process synchronously for more headers.
790 if (sw6
->pr_flags
& PR_LASTHDR
) {
791 struct netmsg_packet
*pmsg
;
794 port
= netisr_cpuport(0); /* XXX */
795 if ((m
->m_flags
& M_HASH
) == 0)
796 m_sethash(m
, 0); /* XXX */
798 KKASSERT(port
!= NULL
);
799 pmsg
= &m
->m_hdr
.mh_netmsg
;
800 netmsg_init(&pmsg
->base
, NULL
,
801 &netisr_apanic_rport
,
802 0, transport6_processing_handler
);
805 pmsg
->base
.lmsg
.u
.ms_result
= off
;
806 lwkt_sendmsg(port
, &pmsg
->base
.lmsg
);
810 nxt
= sw6
->pr_input(&m
, &off
, nxt
);
818 /* msg was embedded in the mbuf, do not reply! */
822 * We have to call the pr_input() function from the correct protocol
823 * thread. The sw6->pr_soport() request at the end of ip6_input()
824 * returns the port and we forward a netmsg to the port to execute
828 transport6_processing_handler(netmsg_t netmsg
)
830 struct netmsg_packet
*pmsg
= (struct netmsg_packet
*)netmsg
;
835 sw6
= &inet6sw
[ip6_protox
[pmsg
->nm_nxt
]];
836 hlen
= pmsg
->base
.lmsg
.u
.ms_result
;
838 nxt
= sw6
->pr_input(&pmsg
->nm_packet
, &hlen
, pmsg
->nm_nxt
);
839 KKASSERT(nxt
== IPPROTO_DONE
);
840 /* netmsg was embedded in the mbuf, do not reply! */
844 * set/grab in6_ifaddr correspond to IPv6 destination address.
845 * XXX backward compatibility wrapper
847 static struct ip6aux
*
848 ip6_setdstifaddr(struct mbuf
*m
, struct in6_ifaddr
*ia6
)
854 n
->ip6a_dstia6
= ia6
;
855 return n
; /* NULL if failed to set */
859 ip6_getdstifaddr(struct mbuf
*m
)
865 return n
->ip6a_dstia6
;
871 * Hop-by-Hop options header processing. If a valid jumbo payload option is
872 * included, the real payload length will be stored in plenp.
875 ip6_hopopts_input(u_int32_t
*plenp
,
876 u_int32_t
*rtalertp
,/* XXX: should be stored more smart way */
880 struct mbuf
*m
= *mp
;
881 int off
= *offp
, hbhlen
;
884 /* validation of the length of the header */
885 #ifndef PULLDOWN_TEST
886 IP6_EXTHDR_CHECK(m
, off
, sizeof(*hbh
), -1);
887 hbh
= (struct ip6_hbh
*)(mtod(m
, caddr_t
) + off
);
888 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
890 IP6_EXTHDR_CHECK(m
, off
, hbhlen
, -1);
891 hbh
= (struct ip6_hbh
*)(mtod(m
, caddr_t
) + off
);
893 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
,
894 sizeof(struct ip6_hdr
), sizeof(struct ip6_hbh
));
896 ip6stat
.ip6s_tooshort
++;
899 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
900 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
, sizeof(struct ip6_hdr
),
903 ip6stat
.ip6s_tooshort
++;
908 hbhlen
-= sizeof(struct ip6_hbh
);
910 if (ip6_process_hopopts(m
, (u_int8_t
*)hbh
+ sizeof(struct ip6_hbh
),
911 hbhlen
, rtalertp
, plenp
) < 0)
920 * Search header for all Hop-by-hop options and process each option.
921 * This function is separate from ip6_hopopts_input() in order to
922 * handle a case where the sending node itself process its hop-by-hop
923 * options header. In such a case, the function is called from ip6_output().
925 * The function assumes that hbh header is located right after the IPv6 header
926 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
927 * opthead + hbhlen is located in continuous memory region.
930 ip6_process_hopopts(struct mbuf
*m
, u_int8_t
*opthead
, int hbhlen
,
931 u_int32_t
*rtalertp
, u_int32_t
*plenp
)
935 u_int8_t
*opt
= opthead
;
936 u_int16_t rtalert_val
;
938 const int erroff
= sizeof(struct ip6_hdr
) + sizeof(struct ip6_hbh
);
940 for (; hbhlen
> 0; hbhlen
-= optlen
, opt
+= optlen
) {
946 if (hbhlen
< IP6OPT_MINLEN
) {
947 ip6stat
.ip6s_toosmall
++;
950 optlen
= *(opt
+ 1) + 2;
953 /* XXX may need check for alignment */
954 if (hbhlen
< IP6OPT_RTALERT_LEN
) {
955 ip6stat
.ip6s_toosmall
++;
958 if (*(opt
+ 1) != IP6OPT_RTALERT_LEN
- 2) {
960 icmp6_error(m
, ICMP6_PARAM_PROB
,
961 ICMP6_PARAMPROB_HEADER
,
962 erroff
+ opt
+ 1 - opthead
);
965 optlen
= IP6OPT_RTALERT_LEN
;
966 bcopy((caddr_t
)(opt
+ 2), (caddr_t
)&rtalert_val
, 2);
967 *rtalertp
= ntohs(rtalert_val
);
970 /* XXX may need check for alignment */
971 if (hbhlen
< IP6OPT_JUMBO_LEN
) {
972 ip6stat
.ip6s_toosmall
++;
975 if (*(opt
+ 1) != IP6OPT_JUMBO_LEN
- 2) {
977 icmp6_error(m
, ICMP6_PARAM_PROB
,
978 ICMP6_PARAMPROB_HEADER
,
979 erroff
+ opt
+ 1 - opthead
);
982 optlen
= IP6OPT_JUMBO_LEN
;
985 * IPv6 packets that have non 0 payload length
986 * must not contain a jumbo payload option.
988 ip6
= mtod(m
, struct ip6_hdr
*);
990 ip6stat
.ip6s_badoptions
++;
991 icmp6_error(m
, ICMP6_PARAM_PROB
,
992 ICMP6_PARAMPROB_HEADER
,
993 erroff
+ opt
- opthead
);
998 * We may see jumbolen in unaligned location, so
999 * we'd need to perform bcopy().
1001 bcopy(opt
+ 2, &jumboplen
, sizeof(jumboplen
));
1002 jumboplen
= (u_int32_t
)htonl(jumboplen
);
1006 * if there are multiple jumbo payload options,
1007 * *plenp will be non-zero and the packet will be
1009 * the behavior may need some debate in ipngwg -
1010 * multiple options does not make sense, however,
1011 * there's no explicit mention in specification.
1014 ip6stat
.ip6s_badoptions
++;
1015 icmp6_error(m
, ICMP6_PARAM_PROB
,
1016 ICMP6_PARAMPROB_HEADER
,
1017 erroff
+ opt
+ 2 - opthead
);
1023 * jumbo payload length must be larger than 65535.
1025 if (jumboplen
<= IPV6_MAXPACKET
) {
1026 ip6stat
.ip6s_badoptions
++;
1027 icmp6_error(m
, ICMP6_PARAM_PROB
,
1028 ICMP6_PARAMPROB_HEADER
,
1029 erroff
+ opt
+ 2 - opthead
);
1035 default: /* unknown option */
1036 if (hbhlen
< IP6OPT_MINLEN
) {
1037 ip6stat
.ip6s_toosmall
++;
1040 optlen
= ip6_unknown_opt(opt
, m
,
1041 erroff
+ opt
- opthead
);
1057 * Unknown option processing.
1058 * The third argument `off' is the offset from the IPv6 header to the option,
1059 * which is necessary if the IPv6 header the and option header and IPv6 header
1060 * is not continuous in order to return an ICMPv6 error.
1063 ip6_unknown_opt(u_int8_t
*optp
, struct mbuf
*m
, int off
)
1065 struct ip6_hdr
*ip6
;
1067 switch (IP6OPT_TYPE(*optp
)) {
1068 case IP6OPT_TYPE_SKIP
: /* ignore the option */
1069 return ((int)*(optp
+ 1));
1070 case IP6OPT_TYPE_DISCARD
: /* silently discard */
1073 case IP6OPT_TYPE_FORCEICMP
: /* send ICMP even if multicasted */
1074 ip6stat
.ip6s_badoptions
++;
1075 icmp6_error(m
, ICMP6_PARAM_PROB
, ICMP6_PARAMPROB_OPTION
, off
);
1077 case IP6OPT_TYPE_ICMP
: /* send ICMP if not multicasted */
1078 ip6stat
.ip6s_badoptions
++;
1079 ip6
= mtod(m
, struct ip6_hdr
*);
1080 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
) ||
1081 (m
->m_flags
& (M_BCAST
|M_MCAST
)))
1084 icmp6_error(m
, ICMP6_PARAM_PROB
,
1085 ICMP6_PARAMPROB_OPTION
, off
);
1089 m_freem(m
); /* XXX: NOTREACHED */
1094 * Create the "control" list for this pcb.
1095 * The function will not modify mbuf chain at all.
1097 * with KAME mbuf chain restriction:
1098 * The routine will be called from upper layer handlers like tcp6_input().
1099 * Thus the routine assumes that the caller (tcp6_input) have already
1100 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the
1101 * very first mbuf on the mbuf chain.
1104 ip6_savecontrol(struct inpcb
*in6p
, struct mbuf
**mp
, struct ip6_hdr
*ip6
,
1107 #define IS2292(x, y) ((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y))
1108 struct thread
*td
= curthread
; /* XXX */
1112 if (priv_check(td
, PRIV_ROOT
) == 0)
1116 if (in6p
->in6p_socket
->so_options
& SO_TIMESTAMP
) {
1120 *mp
= sbcreatecontrol((caddr_t
)&tv
, sizeof(tv
),
1121 SCM_TIMESTAMP
, SOL_SOCKET
);
1123 mp
= &(*mp
)->m_next
;
1128 /* RFC 2292 sec. 5 */
1129 if (in6p
->in6p_flags
& IN6P_PKTINFO
) {
1130 struct in6_pktinfo pi6
;
1132 bcopy(&ip6
->ip6_dst
, &pi6
.ipi6_addr
, sizeof(struct in6_addr
));
1133 in6_clearscope(&pi6
.ipi6_addr
); /* XXX */
1134 pi6
.ipi6_ifindex
= (m
&& m
->m_pkthdr
.rcvif
) ?
1135 m
->m_pkthdr
.rcvif
->if_index
: 0;
1136 *mp
= sbcreatecontrol((caddr_t
)&pi6
, sizeof(struct in6_pktinfo
),
1137 IS2292(IPV6_2292PKTINFO
, IPV6_PKTINFO
), IPPROTO_IPV6
);
1139 mp
= &(*mp
)->m_next
;
1142 if (in6p
->in6p_flags
& IN6P_HOPLIMIT
) {
1143 int hlim
= ip6
->ip6_hlim
& 0xff;
1145 *mp
= sbcreatecontrol((caddr_t
)&hlim
, sizeof(int),
1146 IS2292(IPV6_2292HOPLIMIT
, IPV6_HOPLIMIT
), IPPROTO_IPV6
);
1148 mp
= &(*mp
)->m_next
;
1151 if ((in6p
->in6p_flags
& IN6P_TCLASS
) != 0) {
1155 flowinfo
= (u_int32_t
)ntohl(ip6
->ip6_flow
& IPV6_FLOWINFO_MASK
);
1158 tclass
= flowinfo
& 0xff;
1159 *mp
= sbcreatecontrol((caddr_t
) &tclass
, sizeof(tclass
),
1160 IPV6_TCLASS
, IPPROTO_IPV6
);
1162 mp
= &(*mp
)->m_next
;
1166 * IPV6_HOPOPTS socket option. We require super-user privilege
1167 * for the option, but it might be too strict, since there might
1168 * be some hop-by-hop options which can be returned to normal user.
1169 * See RFC 2292 section 6.
1171 if ((in6p
->in6p_flags
& IN6P_HOPOPTS
) && privileged
) {
1173 * Check if a hop-by-hop options header is contatined in the
1174 * received packet, and if so, store the options as ancillary
1175 * data. Note that a hop-by-hop options header must be
1176 * just after the IPv6 header, which is assured through the
1177 * IPv6 input processing.
1179 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1180 if (ip6
->ip6_nxt
== IPPROTO_HOPOPTS
) {
1181 struct ip6_hbh
*hbh
;
1183 #ifdef PULLDOWN_TEST
1187 #ifndef PULLDOWN_TEST
1188 hbh
= (struct ip6_hbh
*)(ip6
+ 1);
1189 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
1191 ext
= ip6_pullexthdr(m
, sizeof(struct ip6_hdr
),
1194 ip6stat
.ip6s_tooshort
++;
1197 hbh
= mtod(ext
, struct ip6_hbh
*);
1198 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
1199 if (hbhlen
!= ext
->m_len
) {
1201 ip6stat
.ip6s_tooshort
++;
1207 * XXX: We copy the whole header even if a
1208 * jumbo payload option is included, the option which
1209 * is to be removed before returning according to
1211 * Note: this constraint is removed in 2292bis.
1213 *mp
= sbcreatecontrol((caddr_t
)hbh
, hbhlen
,
1214 IS2292(IPV6_2292HOPOPTS
, IPV6_HOPOPTS
),
1217 mp
= &(*mp
)->m_next
;
1218 #ifdef PULLDOWN_TEST
1224 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */
1225 if ((in6p
->in6p_flags
& (IN6P_DSTOPTS
| IN6P_RTHDRDSTOPTS
)) != 0) {
1226 int proto
, off
, nxt
;
1229 * go through the header chain to see if a routing header is
1230 * contained in the packet. We need this information to store
1231 * destination options headers (if any) properly.
1232 * XXX: performance issue. We should record this info when
1233 * processing extension headers in incoming routine.
1236 proto
= IPPROTO_IPV6
;
1242 newoff
= ip6_nexthdr(m
, off
, proto
, &nxt
);
1245 if (newoff
< off
) /* invalid, check for safety */
1247 if ((proto
= nxt
) == IPPROTO_ROUTING
)
1253 if ((in6p
->in6p_flags
&
1254 (IN6P_RTHDR
| IN6P_DSTOPTS
| IN6P_RTHDRDSTOPTS
)) != 0) {
1255 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1256 int nxt
= ip6
->ip6_nxt
, off
= sizeof(struct ip6_hdr
);
1259 * Search for destination options headers or routing
1260 * header(s) through the header chain, and stores each
1261 * header as ancillary data.
1262 * Note that the order of the headers remains in
1263 * the chain of ancillary data.
1265 while (1) { /* is explicit loop prevention necessary? */
1266 struct ip6_ext
*ip6e
= NULL
;
1268 #ifdef PULLDOWN_TEST
1269 struct mbuf
*ext
= NULL
;
1273 * if it is not an extension header, don't try to
1274 * pull it from the chain.
1277 case IPPROTO_DSTOPTS
:
1278 case IPPROTO_ROUTING
:
1279 case IPPROTO_HOPOPTS
:
1280 case IPPROTO_AH
: /* is it possible? */
1286 #ifndef PULLDOWN_TEST
1287 if (off
+ sizeof(*ip6e
) > m
->m_len
)
1289 ip6e
= (struct ip6_ext
*)(mtod(m
, caddr_t
) + off
);
1290 if (nxt
== IPPROTO_AH
)
1291 elen
= (ip6e
->ip6e_len
+ 2) << 2;
1293 elen
= (ip6e
->ip6e_len
+ 1) << 3;
1294 if (off
+ elen
> m
->m_len
)
1297 ext
= ip6_pullexthdr(m
, off
, nxt
);
1299 ip6stat
.ip6s_tooshort
++;
1302 ip6e
= mtod(ext
, struct ip6_ext
*);
1303 if (nxt
== IPPROTO_AH
)
1304 elen
= (ip6e
->ip6e_len
+ 2) << 2;
1306 elen
= (ip6e
->ip6e_len
+ 1) << 3;
1307 if (elen
!= ext
->m_len
) {
1309 ip6stat
.ip6s_tooshort
++;
1315 case IPPROTO_DSTOPTS
:
1316 if ((in6p
->in6p_flags
& IN6P_DSTOPTS
) == 0)
1320 * We also require super-user privilege for
1321 * the option. See comments on IN6_HOPOPTS.
1326 *mp
= sbcreatecontrol((caddr_t
)ip6e
, elen
,
1327 IS2292(IPV6_2292DSTOPTS
, IPV6_DSTOPTS
),
1330 mp
= &(*mp
)->m_next
;
1332 case IPPROTO_ROUTING
:
1333 if (!(in6p
->in6p_flags
& IN6P_RTHDR
))
1336 *mp
= sbcreatecontrol((caddr_t
)ip6e
, elen
,
1337 IS2292(IPV6_2292RTHDR
, IPV6_RTHDR
),
1340 mp
= &(*mp
)->m_next
;
1342 case IPPROTO_HOPOPTS
:
1343 case IPPROTO_AH
: /* is it possible? */
1348 * other cases have been filtered in the above.
1349 * none will visit this case. here we supply
1350 * the code just in case (nxt overwritten or
1353 #ifdef PULLDOWN_TEST
1360 /* proceed with the next header. */
1362 nxt
= ip6e
->ip6e_nxt
;
1364 #ifdef PULLDOWN_TEST
1376 ip6_notify_pmtu(struct inpcb
*in6p
, struct sockaddr_in6
*dst
, u_int32_t
*mtu
)
1380 struct ip6_mtuinfo mtuctl
;
1382 so
= in6p
->inp_socket
;
1388 if (so
== NULL
) /* I believe this is impossible */
1389 panic("ip6_notify_pmtu: socket is NULL");
1392 bzero(&mtuctl
, sizeof(mtuctl
)); /* zero-clear for safety */
1393 mtuctl
.ip6m_mtu
= *mtu
;
1394 mtuctl
.ip6m_addr
= *dst
;
1396 if ((m_mtu
= sbcreatecontrol((caddr_t
)&mtuctl
, sizeof(mtuctl
),
1397 IPV6_PATHMTU
, IPPROTO_IPV6
)) == NULL
)
1400 lwkt_gettoken(&so
->so_rcv
.ssb_token
);
1401 if (sbappendaddr(&so
->so_rcv
.sb
, (struct sockaddr
*)dst
, NULL
, m_mtu
)
1404 /* XXX: should count statistics */
1408 lwkt_reltoken(&so
->so_rcv
.ssb_token
);
1411 #ifdef PULLDOWN_TEST
1413 * pull single extension header from mbuf chain. returns single mbuf that
1414 * contains the result, or NULL on error.
1416 static struct mbuf
*
1417 ip6_pullexthdr(struct mbuf
*m
, size_t off
, int nxt
)
1419 struct ip6_ext ip6e
;
1425 case IPPROTO_DSTOPTS
:
1426 case IPPROTO_ROUTING
:
1427 case IPPROTO_HOPOPTS
:
1428 case IPPROTO_AH
: /* is it possible? */
1431 kprintf("ip6_pullexthdr: invalid nxt=%d\n", nxt
);
1435 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1436 if (nxt
== IPPROTO_AH
)
1437 elen
= (ip6e
.ip6e_len
+ 2) << 2;
1439 elen
= (ip6e
.ip6e_len
+ 1) << 3;
1441 n
= m_getb(elen
, M_NOWAIT
, MT_DATA
, 0);
1446 if (elen
>= M_TRAILINGSPACE(n
)) {
1451 m_copydata(m
, off
, elen
, mtod(n
, caddr_t
));
1458 * Get pointer to the previous header followed by the header
1459 * currently processed.
1460 * XXX: This function supposes that
1461 * M includes all headers,
1462 * the next header field and the header length field of each header
1464 * the sum of each header length equals to OFF.
1465 * Because of these assumptions, this function must be called very
1466 * carefully. Moreover, it will not be used in the near future when
1467 * we develop `neater' mechanism to process extension headers.
1470 ip6_get_prevhdr(struct mbuf
*m
, int off
)
1472 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1474 if (off
== sizeof(struct ip6_hdr
))
1475 return (&ip6
->ip6_nxt
);
1478 struct ip6_ext
*ip6e
= NULL
;
1481 len
= sizeof(struct ip6_hdr
);
1483 ip6e
= (struct ip6_ext
*)(mtod(m
, caddr_t
) + len
);
1486 case IPPROTO_FRAGMENT
:
1487 len
+= sizeof(struct ip6_frag
);
1490 len
+= (ip6e
->ip6e_len
+ 2) << 2;
1493 len
+= (ip6e
->ip6e_len
+ 1) << 3;
1496 nxt
= ip6e
->ip6e_nxt
;
1499 return (&ip6e
->ip6e_nxt
);
1506 * get next header offset. m will be retained.
1509 ip6_nexthdr(struct mbuf
*m
, int off
, int proto
, int *nxtp
)
1512 struct ip6_ext ip6e
;
1517 panic("ip6_nexthdr: m == NULL");
1518 if ((m
->m_flags
& M_PKTHDR
) == 0 || m
->m_pkthdr
.len
< off
)
1523 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6
))
1525 m_copydata(m
, off
, sizeof(ip6
), (caddr_t
)&ip6
);
1527 *nxtp
= ip6
.ip6_nxt
;
1531 case IPPROTO_FRAGMENT
:
1533 * terminate parsing if it is not the first fragment,
1534 * it does not make sense to parse through it.
1536 if (m
->m_pkthdr
.len
< off
+ sizeof(fh
))
1538 m_copydata(m
, off
, sizeof(fh
), (caddr_t
)&fh
);
1539 /* IP6F_OFF_MASK = 0xfff8(BigEndian), 0xf8ff(LittleEndian) */
1540 if (fh
.ip6f_offlg
& IP6F_OFF_MASK
)
1543 *nxtp
= fh
.ip6f_nxt
;
1544 off
+= sizeof(struct ip6_frag
);
1548 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6e
))
1550 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1552 *nxtp
= ip6e
.ip6e_nxt
;
1553 off
+= (ip6e
.ip6e_len
+ 2) << 2;
1556 case IPPROTO_HOPOPTS
:
1557 case IPPROTO_ROUTING
:
1558 case IPPROTO_DSTOPTS
:
1559 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6e
))
1561 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1563 *nxtp
= ip6e
.ip6e_nxt
;
1564 off
+= (ip6e
.ip6e_len
+ 1) << 3;
1569 case IPPROTO_IPCOMP
:
1581 * get offset for the last header in the chain. m will be kept untainted.
1584 ip6_lasthdr(struct mbuf
*m
, int off
, int proto
, int *nxtp
)
1594 newoff
= ip6_nexthdr(m
, off
, proto
, nxtp
);
1597 else if (newoff
< off
)
1598 return -1; /* invalid */
1599 else if (newoff
== off
)
1608 ip6_addaux(struct mbuf
*m
)
1612 mtag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1614 mtag
= m_tag_get(PACKET_TAG_IPV6_INPUT
, sizeof(struct ip6aux
),
1617 m_tag_prepend(m
, mtag
);
1620 bzero(m_tag_data(mtag
), sizeof(struct ip6aux
));
1621 return mtag
? (struct ip6aux
*)m_tag_data(mtag
) : NULL
;
1625 ip6_findaux(struct mbuf
*m
)
1629 mtag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1630 return mtag
? (struct ip6aux
*)m_tag_data(mtag
) : NULL
;
1634 ip6_delaux(struct mbuf
*m
)
1638 mtag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1640 m_tag_delete(m
, mtag
);
1644 * System control for IP6
1647 u_char inet6ctlerrmap
[PRC_NCMDS
] = {
1649 0, EMSGSIZE
, EHOSTDOWN
, EHOSTUNREACH
,
1650 EHOSTUNREACH
, EHOSTUNREACH
, ECONNREFUSED
, ECONNREFUSED
,
1651 EMSGSIZE
, EHOSTUNREACH
, 0, 0,