1 /* $FreeBSD: src/sys/netinet6/ip6_input.c,v 1.11.2.15 2003/01/24 05:11:35 sam Exp $ */
2 /* $KAME: ip6_input.c,v 1.259 2002/01/21 04:58:09 jinmei Exp $ */
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * Copyright (c) 1982, 1986, 1988, 1993
35 * The Regents of the University of California. All rights reserved.
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. Neither the name of the University nor the names of its contributors
46 * may be used to endorse or promote products derived from this software
47 * without specific prior written permission.
49 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
61 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94
64 #include "opt_ip6fw.h"
66 #include "opt_inet6.h"
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/malloc.h>
72 #include <sys/domain.h>
73 #include <sys/protosw.h>
74 #include <sys/socket.h>
75 #include <sys/socketvar.h>
76 #include <sys/errno.h>
78 #include <sys/kernel.h>
79 #include <sys/syslog.h>
84 #include <net/if_types.h>
85 #include <net/if_dl.h>
86 #include <net/route.h>
87 #include <net/netisr.h>
90 #include <sys/thread2.h>
91 #include <sys/msgport2.h>
92 #include <net/netmsg2.h>
93 #include <net/netisr2.h>
95 #include <netinet/in.h>
96 #include <netinet/in_systm.h>
98 #include <netinet/ip.h>
99 #include <netinet/ip_icmp.h>
101 #include <netinet/ip6.h>
102 #include <netinet6/in6_var.h>
103 #include <netinet6/ip6_var.h>
104 #include <netinet/in_pcb.h>
105 #include <netinet/icmp6.h>
106 #include <netinet6/scope6_var.h>
107 #include <netinet6/in6_ifattach.h>
108 #include <netinet6/nd6.h>
110 #include <net/ip6fw/ip6_fw.h>
112 #include <netinet6/ip6protosw.h>
114 #include <net/net_osdep.h>
116 extern struct domain inet6domain
;
117 extern struct protosw inet6sw
[];
119 u_char ip6_protox
[IPPROTO_MAX
];
120 struct in6_ifaddr
*in6_ifaddr
;
122 int ip6_forward_srcrt
; /* XXX */
123 int ip6_sourcecheck
; /* XXX */
124 int ip6_sourcecheck_interval
; /* XXX */
126 int ip6_ours_check_algorithm
;
128 struct pfil_head inet6_pfil_hook
;
131 ip6_fw_chk_t
*ip6_fw_chk_ptr
;
132 ip6_fw_ctl_t
*ip6_fw_ctl_ptr
;
133 int ip6_fw_enable
= 1;
135 struct ip6stat ip6stat
;
137 static void ip6_init2 (void *);
138 static struct ip6aux
*ip6_setdstifaddr (struct mbuf
*, struct in6_ifaddr
*);
139 static int ip6_hopopts_input (u_int32_t
*, u_int32_t
*, struct mbuf
**, int *);
140 static void ip6_input(netmsg_t msg
);
142 static struct mbuf
*ip6_pullexthdr (struct mbuf
*, size_t, int);
144 static void transport6_processing_handler(netmsg_t netmsg
);
147 * IP6 initialization: fill in IP6 protocol switch table.
148 * All protocols not implemented in kernel go to raw IP6 protocol handler.
157 pr
= pffindproto(PF_INET6
, IPPROTO_RAW
, SOCK_RAW
);
160 for (i
= 0; i
< IPPROTO_MAX
; i
++)
161 ip6_protox
[i
] = pr
- inet6sw
;
162 for (pr
= inet6domain
.dom_protosw
;
163 pr
< inet6domain
.dom_protoswNPROTOSW
; pr
++)
164 if (pr
->pr_domain
->dom_family
== PF_INET6
&&
165 pr
->pr_protocol
&& pr
->pr_protocol
!= IPPROTO_RAW
)
166 ip6_protox
[pr
->pr_protocol
] = pr
- inet6sw
;
168 inet6_pfil_hook
.ph_type
= PFIL_TYPE_AF
;
169 inet6_pfil_hook
.ph_af
= AF_INET6
;
170 if ((i
= pfil_head_register(&inet6_pfil_hook
)) != 0) {
171 kprintf("%s: WARNING: unable to register pfil hook, "
172 "error %d\n", __func__
, i
);
175 netisr_register(NETISR_IPV6
, ip6_input
, NULL
); /* XXX hashfn */
177 addrsel_policy_init();
181 * in many cases, random() here does NOT return random number
182 * as initialization during bootstrap time occur in fixed order.
185 ip6_flow_seq
= krandom() ^ tv
.tv_usec
;
187 ip6_desync_factor
= (krandom() ^ tv
.tv_usec
) % MAX_TEMP_DESYNC_FACTOR
;
191 ip6_init2(void *dummy
)
194 in6_tmpaddrtimer_init();
198 /* This must be after route_init(), which is now SI_ORDER_THIRD */
199 SYSINIT(netinet6init2
, SI_SUB_PROTO_DOMAIN
, SI_ORDER_MIDDLE
, ip6_init2
, NULL
);
201 extern struct route_in6 ip6_forward_rt
;
204 ip6_input(netmsg_t msg
)
206 struct mbuf
*m
= msg
->packet
.nm_packet
;
208 int off
= sizeof(struct ip6_hdr
), nest
;
210 u_int32_t rtalert
= ~0;
211 int nxt
, ours
= 0, rh_present
= 0;
212 struct ifnet
*deliverifp
= NULL
;
213 struct in6_addr odst
;
217 * make sure we don't have onion peering information into m_aux.
224 if (m
->m_flags
& M_EXT
) {
226 ip6stat
.ip6s_mext2m
++;
228 ip6stat
.ip6s_mext1
++;
230 #define M2MMAX NELEM(ip6stat.ip6s_m2m)
232 if (m
->m_flags
& M_LOOP
) {
233 ip6stat
.ip6s_m2m
[loif
->if_index
]++; /* XXX */
234 } else if (m
->m_pkthdr
.rcvif
->if_index
< M2MMAX
)
235 ip6stat
.ip6s_m2m
[m
->m_pkthdr
.rcvif
->if_index
]++;
237 ip6stat
.ip6s_m2m
[0]++;
243 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_receive
);
244 ip6stat
.ip6s_total
++;
246 #ifndef PULLDOWN_TEST
248 * L2 bridge code and some other code can return mbuf chain
249 * that does not conform to KAME requirement. too bad.
250 * XXX: fails to join if interface MTU > MCLBYTES. jumbogram?
252 if (m
&& m
->m_next
!= NULL
&& m
->m_pkthdr
.len
< MCLBYTES
) {
255 n
= m_getb(m
->m_pkthdr
.len
, M_NOWAIT
, MT_HEADER
, M_PKTHDR
);
260 m_copydata(m
, 0, n
->m_pkthdr
.len
, mtod(n
, caddr_t
));
261 n
->m_len
= n
->m_pkthdr
.len
;
265 IP6_EXTHDR_CHECK_VOIDRET(m
, 0, sizeof(struct ip6_hdr
));
268 if (m
->m_len
< sizeof(struct ip6_hdr
)) {
270 inifp
= m
->m_pkthdr
.rcvif
;
271 if ((m
= m_pullup(m
, sizeof(struct ip6_hdr
))) == NULL
) {
272 ip6stat
.ip6s_toosmall
++;
273 in6_ifstat_inc(inifp
, ifs6_in_hdrerr
);
278 ip6
= mtod(m
, struct ip6_hdr
*);
280 if ((ip6
->ip6_vfc
& IPV6_VERSION_MASK
) != IPV6_VERSION
) {
281 ip6stat
.ip6s_badvers
++;
282 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
287 * Run through list of hooks for input packets.
289 * NB: Beware of the destination address changing
290 * (e.g. by NAT rewriting). When this happens,
291 * tell ip6_forward to do the right thing.
293 if (pfil_has_hooks(&inet6_pfil_hook
)) {
295 if (pfil_run_hooks(&inet6_pfil_hook
, &m
,
296 m
->m_pkthdr
.rcvif
, PFIL_IN
)) {
299 if (m
== NULL
) /* consumed by filter */
301 ip6
= mtod(m
, struct ip6_hdr
*);
302 srcrt
= !IN6_ARE_ADDR_EQUAL(&odst
, &ip6
->ip6_dst
);
305 ip6stat
.ip6s_nxthist
[ip6
->ip6_nxt
]++;
308 if (altq_input
!= NULL
&& (*altq_input
)(m
, AF_INET6
) == 0) {
309 /* packet is dropped by traffic conditioner */
315 * Check with the firewall...
317 if (ip6_fw_enable
&& ip6_fw_chk_ptr
) {
319 /* If ipfw says divert, we have to just drop packet */
320 /* use port as a dummy argument */
321 if ((*ip6_fw_chk_ptr
)(&ip6
, NULL
, &port
, &m
)) {
330 * Check against address spoofing/corruption.
332 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_src
) ||
333 IN6_IS_ADDR_UNSPECIFIED(&ip6
->ip6_dst
)) {
335 * XXX: "badscope" is not very suitable for a multicast source.
337 ip6stat
.ip6s_badscope
++;
338 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
341 if ((IN6_IS_ADDR_LOOPBACK(&ip6
->ip6_src
) ||
342 IN6_IS_ADDR_LOOPBACK(&ip6
->ip6_dst
)) &&
343 (m
->m_pkthdr
.rcvif
->if_flags
& IFF_LOOPBACK
) == 0) {
344 ip6stat
.ip6s_badscope
++;
345 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
350 * The following check is not documented in specs. A malicious
351 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
352 * and bypass security checks (act as if it was from 127.0.0.1 by using
353 * IPv6 src ::ffff:127.0.0.1). Be cautious.
355 * This check chokes if we are in an SIIT cloud. As none of BSDs
356 * support IPv4-less kernel compilation, we cannot support SIIT
357 * environment at all. So, it makes more sense for us to reject any
358 * malicious packets for non-SIIT environment, than try to do a
359 * partial support for SIIT environment.
361 if (IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_src
) ||
362 IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_dst
)) {
363 ip6stat
.ip6s_badscope
++;
364 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
369 * Reject packets with IPv4 compatible addresses (auto tunnel).
371 * The code forbids auto tunnel relay case in RFC1933 (the check is
372 * stronger than RFC1933). We may want to re-enable it if mech-xx
373 * is revised to forbid relaying case.
375 if (IN6_IS_ADDR_V4COMPAT(&ip6
->ip6_src
) ||
376 IN6_IS_ADDR_V4COMPAT(&ip6
->ip6_dst
)) {
377 ip6stat
.ip6s_badscope
++;
378 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
383 /* drop packets if interface ID portion is already filled */
384 if ((m
->m_pkthdr
.rcvif
->if_flags
& IFF_LOOPBACK
) == 0) {
385 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_src
) &&
386 ip6
->ip6_src
.s6_addr16
[1]) {
387 ip6stat
.ip6s_badscope
++;
390 if ((IN6_IS_ADDR_MC_INTFACELOCAL(&ip6
->ip6_dst
) ||
391 IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_dst
)) &&
392 ip6
->ip6_dst
.s6_addr16
[1]) {
393 ip6stat
.ip6s_badscope
++;
398 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_src
))
399 ip6
->ip6_src
.s6_addr16
[1]
400 = htons(m
->m_pkthdr
.rcvif
->if_index
);
401 if (IN6_IS_SCOPE_LINKLOCAL(&ip6
->ip6_dst
))
402 ip6
->ip6_dst
.s6_addr16
[1]
403 = htons(m
->m_pkthdr
.rcvif
->if_index
);
408 * WARNING! For general subnet proxying the interface hw will
409 * likely filter out the multicast solicitations, so
410 * the interface must be in promiscuous mode.
412 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
)) {
414 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_mcast
);
415 deliverifp
= m
->m_pkthdr
.rcvif
;
422 if (ip6_forward_rt
.ro_rt
!= NULL
&&
423 (ip6_forward_rt
.ro_rt
->rt_flags
& RTF_UP
) &&
424 IN6_ARE_ADDR_EQUAL(&ip6
->ip6_dst
,
425 &((struct sockaddr_in6
*)(&ip6_forward_rt
.ro_dst
))->sin6_addr
)) {
426 ip6stat
.ip6s_forward_cachehit
++;
428 struct sockaddr_in6
*dst6
;
430 if (ip6_forward_rt
.ro_rt
) {
431 /* route is down or destination is different */
432 ip6stat
.ip6s_forward_cachemiss
++;
433 RTFREE(ip6_forward_rt
.ro_rt
);
434 ip6_forward_rt
.ro_rt
= 0;
437 bzero(&ip6_forward_rt
.ro_dst
, sizeof(struct sockaddr_in6
));
438 dst6
= &ip6_forward_rt
.ro_dst
;
439 dst6
->sin6_len
= sizeof(struct sockaddr_in6
);
440 dst6
->sin6_family
= AF_INET6
;
441 dst6
->sin6_addr
= ip6
->ip6_dst
;
443 rtalloc_ign((struct route
*)&ip6_forward_rt
, RTF_PRCLONING
);
446 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key))
449 * Accept the packet if the forwarding interface to the destination
450 * according to the routing table is the loopback interface,
451 * unless the associated route has a gateway.
452 * Note that this approach causes to accept a packet if there is a
453 * route to the loopback interface for the destination of the packet.
454 * But we think it's even useful in some situations, e.g. when using
455 * a special daemon which wants to intercept the packet.
457 * XXX: some OSes automatically make a cloned route for the destination
458 * of an outgoing packet. If the outgoing interface of the packet
459 * is a loopback one, the kernel would consider the packet to be
460 * accepted, even if we have no such address assinged on the interface.
461 * We check the cloned flag of the route entry to reject such cases,
462 * assuming that route entries for our own addresses are not made by
463 * cloning (it should be true because in6_addloop explicitly installs
464 * the host route). However, we might have to do an explicit check
465 * while it would be less efficient. Or, should we rather install a
466 * reject route for such a case?
468 if (ip6_forward_rt
.ro_rt
&&
469 (ip6_forward_rt
.ro_rt
->rt_flags
&
470 (RTF_HOST
|RTF_GATEWAY
)) == RTF_HOST
&&
472 !(ip6_forward_rt
.ro_rt
->rt_flags
& RTF_WASCLONED
) &&
475 !(ip6_forward_rt
.ro_rt
->rt_flags
& RTF_CLONED
) &&
479 * The check below is redundant since the comparison of
480 * the destination and the key of the rtentry has
481 * already done through looking up the routing table.
483 IN6_ARE_ADDR_EQUAL(&ip6
->ip6_dst
,
484 &rt6_key(ip6_forward_rt
.ro_rt
)->sin6_addr
)
486 ip6_forward_rt
.ro_rt
->rt_ifp
->if_type
== IFT_LOOP
) {
487 struct in6_ifaddr
*ia6
=
488 (struct in6_ifaddr
*)ip6_forward_rt
.ro_rt
->rt_ifa
;
491 * record address information into m_aux.
493 ip6_setdstifaddr(m
, ia6
);
496 * packets to a tentative, duplicated, or somehow invalid
497 * address must not be accepted.
499 if (!(ia6
->ia6_flags
& IN6_IFF_NOTREADY
)) {
500 /* this address is ready */
502 deliverifp
= ia6
->ia_ifp
; /* correct? */
503 /* Count the packet in the ip address stats */
504 IFA_STAT_INC(&ia6
->ia_ifa
, ipackets
, 1);
505 IFA_STAT_INC(&ia6
->ia_ifa
, ibytes
, m
->m_pkthdr
.len
);
508 /* address is not ready, so discard the packet. */
510 "ip6_input: packet to an unready address %s->%s\n",
511 ip6_sprintf(&ip6
->ip6_src
),
512 ip6_sprintf(&ip6
->ip6_dst
)));
519 * Now there is no reason to process the packet if it's not our own
520 * and we're not a router.
522 if (!ip6_forwarding
) {
523 ip6stat
.ip6s_cantforward
++;
524 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
530 * record address information into m_aux, if we don't have one yet.
531 * note that we are unable to record it, if the address is not listed
532 * as our interface address (e.g. multicast addresses and such).
534 if (deliverifp
&& !ip6_getdstifaddr(m
)) {
535 struct in6_ifaddr
*ia6
;
537 ia6
= in6_ifawithifp(deliverifp
, &ip6
->ip6_dst
);
539 if (!ip6_setdstifaddr(m
, ia6
)) {
541 * XXX maybe we should drop the packet here,
542 * as we could not provide enough information
543 * to the upper layers.
550 * Process Hop-by-Hop options header if it's contained.
551 * m may be modified in ip6_hopopts_input().
552 * If a JumboPayload option is included, plen will also be modified.
554 plen
= (u_int32_t
)ntohs(ip6
->ip6_plen
);
555 if (ip6
->ip6_nxt
== IPPROTO_HOPOPTS
) {
558 if (ip6_hopopts_input(&plen
, &rtalert
, &m
, &off
)) {
559 #if 0 /*touches NULL pointer*/
560 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
562 goto bad2
; /* m have already been freed */
566 ip6
= mtod(m
, struct ip6_hdr
*);
569 * if the payload length field is 0 and the next header field
570 * indicates Hop-by-Hop Options header, then a Jumbo Payload
571 * option MUST be included.
573 if (ip6
->ip6_plen
== 0 && plen
== 0) {
575 * Note that if a valid jumbo payload option is
576 * contained, ip6_hoptops_input() must set a valid
577 * (non-zero) payload length to the variable plen.
579 ip6stat
.ip6s_badoptions
++;
580 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_discard
);
581 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
582 icmp6_error(m
, ICMP6_PARAM_PROB
,
583 ICMP6_PARAMPROB_HEADER
,
584 (caddr_t
)&ip6
->ip6_plen
- (caddr_t
)ip6
);
587 #ifndef PULLDOWN_TEST
588 /* ip6_hopopts_input() ensures that mbuf is contiguous */
589 hbh
= (struct ip6_hbh
*)(ip6
+ 1);
591 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
, sizeof(struct ip6_hdr
),
592 sizeof(struct ip6_hbh
));
594 ip6stat
.ip6s_tooshort
++;
601 * If we are acting as a router and the packet contains a
602 * router alert option, see if we know the option value.
603 * Currently, we only support the option value for MLD, in which
604 * case we should pass the packet to the multicast routing
607 if (rtalert
!= ~0 && ip6_forwarding
) {
609 case IP6OPT_RTALERT_MLD
:
614 * RFC2711 requires unrecognized values must be
624 * Check that the amount of data in the buffers
625 * is as at least much as the IPv6 header would have us expect.
626 * Trim mbufs if longer than we expect.
627 * Drop packet if shorter than we expect.
629 if (m
->m_pkthdr
.len
- sizeof(struct ip6_hdr
) < plen
) {
630 ip6stat
.ip6s_tooshort
++;
631 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_truncated
);
634 if (m
->m_pkthdr
.len
> sizeof(struct ip6_hdr
) + plen
) {
635 if (m
->m_len
== m
->m_pkthdr
.len
) {
636 m
->m_len
= sizeof(struct ip6_hdr
) + plen
;
637 m
->m_pkthdr
.len
= sizeof(struct ip6_hdr
) + plen
;
639 m_adj(m
, sizeof(struct ip6_hdr
) + plen
- m
->m_pkthdr
.len
);
643 * Forward if desirable.
645 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
)) {
647 * If we are acting as a multicast router, all
648 * incoming multicast packets are passed to the
649 * kernel-level multicast forwarding function.
650 * The packet is returned (relatively) intact; if
651 * ip6_mforward() returns a non-zero value, the packet
652 * must be discarded, else it may be accepted below.
654 if (ip6_mrouter
&& ip6_mforward(ip6
, m
->m_pkthdr
.rcvif
, m
)) {
655 ip6stat
.ip6s_cantforward
++;
661 ip6_forward(m
, srcrt
);
665 ip6
= mtod(m
, struct ip6_hdr
*);
668 * Malicious party may be able to use IPv4 mapped addr to confuse
669 * tcp/udp stack and bypass security checks (act as if it was from
670 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious.
672 * For SIIT end node behavior, you may want to disable the check.
673 * However, you will become vulnerable to attacks using IPv4 mapped
676 if (IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_src
) ||
677 IN6_IS_ADDR_V4MAPPED(&ip6
->ip6_dst
)) {
678 ip6stat
.ip6s_badscope
++;
679 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_addrerr
);
684 * Tell launch routine the next header
686 ip6stat
.ip6s_delivered
++;
687 in6_ifstat_inc(deliverifp
, ifs6_in_deliver
);
691 while (nxt
!= IPPROTO_DONE
) {
694 if (ip6_hdrnestlimit
&& (++nest
> ip6_hdrnestlimit
)) {
695 ip6stat
.ip6s_toomanyhdr
++;
696 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_hdrerr
);
701 * protection against faulty packet - there should be
702 * more sanity checks in header chain processing.
704 if (m
->m_pkthdr
.len
< off
) {
705 ip6stat
.ip6s_tooshort
++;
706 in6_ifstat_inc(m
->m_pkthdr
.rcvif
, ifs6_in_truncated
);
712 * do we need to do it for every header? yeah, other
713 * functions can play with it (like re-allocate and copy).
715 mhist
= ip6_addaux(m
);
716 if (mhist
&& M_TRAILINGSPACE(mhist
) >= sizeof(nxt
)) {
717 hist
= mtod(mhist
, caddr_t
) + mhist
->m_len
;
718 bcopy(&nxt
, hist
, sizeof(nxt
));
719 mhist
->m_len
+= sizeof(nxt
);
721 ip6stat
.ip6s_toomanyhdr
++;
726 if (nxt
== IPPROTO_ROUTING
) {
728 in6_ifstat_inc(m
->m_pkthdr
.rcvif
,
730 ip6stat
.ip6s_badoptions
++;
735 sw6
= &inet6sw
[ip6_protox
[nxt
]];
737 * If this is a terminal header forward to the port, otherwise
738 * process synchronously for more headers.
740 if (sw6
->pr_flags
& PR_LASTHDR
) {
741 struct netmsg_packet
*pmsg
;
744 port
= netisr_cpuport(0); /* XXX */
745 if ((m
->m_flags
& M_HASH
) == 0)
746 m_sethash(m
, 0); /* XXX */
748 KKASSERT(port
!= NULL
);
749 pmsg
= &m
->m_hdr
.mh_netmsg
;
750 netmsg_init(&pmsg
->base
, NULL
,
751 &netisr_apanic_rport
,
752 0, transport6_processing_handler
);
755 pmsg
->base
.lmsg
.u
.ms_result
= off
;
756 lwkt_sendmsg(port
, &pmsg
->base
.lmsg
);
760 nxt
= sw6
->pr_input(&m
, &off
, nxt
);
768 /* msg was embedded in the mbuf, do not reply! */
772 * We have to call the pr_input() function from the correct protocol
773 * thread. The sw6->pr_soport() request at the end of ip6_input()
774 * returns the port and we forward a netmsg to the port to execute
778 transport6_processing_handler(netmsg_t netmsg
)
780 struct netmsg_packet
*pmsg
= (struct netmsg_packet
*)netmsg
;
785 sw6
= &inet6sw
[ip6_protox
[pmsg
->nm_nxt
]];
786 hlen
= pmsg
->base
.lmsg
.u
.ms_result
;
788 nxt
= sw6
->pr_input(&pmsg
->nm_packet
, &hlen
, pmsg
->nm_nxt
);
789 KKASSERT(nxt
== IPPROTO_DONE
);
790 /* netmsg was embedded in the mbuf, do not reply! */
794 * set/grab in6_ifaddr correspond to IPv6 destination address.
795 * XXX backward compatibility wrapper
797 static struct ip6aux
*
798 ip6_setdstifaddr(struct mbuf
*m
, struct in6_ifaddr
*ia6
)
804 n
->ip6a_dstia6
= ia6
;
805 return n
; /* NULL if failed to set */
809 ip6_getdstifaddr(struct mbuf
*m
)
815 return n
->ip6a_dstia6
;
821 * Hop-by-Hop options header processing. If a valid jumbo payload option is
822 * included, the real payload length will be stored in plenp.
825 ip6_hopopts_input(u_int32_t
*plenp
,
826 u_int32_t
*rtalertp
,/* XXX: should be stored more smart way */
830 struct mbuf
*m
= *mp
;
831 int off
= *offp
, hbhlen
;
834 /* validation of the length of the header */
835 #ifndef PULLDOWN_TEST
836 IP6_EXTHDR_CHECK(m
, off
, sizeof(*hbh
), -1);
837 hbh
= (struct ip6_hbh
*)(mtod(m
, caddr_t
) + off
);
838 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
840 IP6_EXTHDR_CHECK(m
, off
, hbhlen
, -1);
841 hbh
= (struct ip6_hbh
*)(mtod(m
, caddr_t
) + off
);
843 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
,
844 sizeof(struct ip6_hdr
), sizeof(struct ip6_hbh
));
846 ip6stat
.ip6s_tooshort
++;
849 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
850 IP6_EXTHDR_GET(hbh
, struct ip6_hbh
*, m
, sizeof(struct ip6_hdr
),
853 ip6stat
.ip6s_tooshort
++;
858 hbhlen
-= sizeof(struct ip6_hbh
);
860 if (ip6_process_hopopts(m
, (u_int8_t
*)hbh
+ sizeof(struct ip6_hbh
),
861 hbhlen
, rtalertp
, plenp
) < 0)
870 * Search header for all Hop-by-hop options and process each option.
871 * This function is separate from ip6_hopopts_input() in order to
872 * handle a case where the sending node itself process its hop-by-hop
873 * options header. In such a case, the function is called from ip6_output().
875 * The function assumes that hbh header is located right after the IPv6 header
876 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
877 * opthead + hbhlen is located in continuous memory region.
880 ip6_process_hopopts(struct mbuf
*m
, u_int8_t
*opthead
, int hbhlen
,
881 u_int32_t
*rtalertp
, u_int32_t
*plenp
)
885 u_int8_t
*opt
= opthead
;
886 u_int16_t rtalert_val
;
888 const int erroff
= sizeof(struct ip6_hdr
) + sizeof(struct ip6_hbh
);
890 for (; hbhlen
> 0; hbhlen
-= optlen
, opt
+= optlen
) {
896 if (hbhlen
< IP6OPT_MINLEN
) {
897 ip6stat
.ip6s_toosmall
++;
900 optlen
= *(opt
+ 1) + 2;
903 /* XXX may need check for alignment */
904 if (hbhlen
< IP6OPT_RTALERT_LEN
) {
905 ip6stat
.ip6s_toosmall
++;
908 if (*(opt
+ 1) != IP6OPT_RTALERT_LEN
- 2) {
910 icmp6_error(m
, ICMP6_PARAM_PROB
,
911 ICMP6_PARAMPROB_HEADER
,
912 erroff
+ opt
+ 1 - opthead
);
915 optlen
= IP6OPT_RTALERT_LEN
;
916 bcopy((caddr_t
)(opt
+ 2), (caddr_t
)&rtalert_val
, 2);
917 *rtalertp
= ntohs(rtalert_val
);
920 /* XXX may need check for alignment */
921 if (hbhlen
< IP6OPT_JUMBO_LEN
) {
922 ip6stat
.ip6s_toosmall
++;
925 if (*(opt
+ 1) != IP6OPT_JUMBO_LEN
- 2) {
927 icmp6_error(m
, ICMP6_PARAM_PROB
,
928 ICMP6_PARAMPROB_HEADER
,
929 erroff
+ opt
+ 1 - opthead
);
932 optlen
= IP6OPT_JUMBO_LEN
;
935 * IPv6 packets that have non 0 payload length
936 * must not contain a jumbo payload option.
938 ip6
= mtod(m
, struct ip6_hdr
*);
940 ip6stat
.ip6s_badoptions
++;
941 icmp6_error(m
, ICMP6_PARAM_PROB
,
942 ICMP6_PARAMPROB_HEADER
,
943 erroff
+ opt
- opthead
);
948 * We may see jumbolen in unaligned location, so
949 * we'd need to perform bcopy().
951 bcopy(opt
+ 2, &jumboplen
, sizeof(jumboplen
));
952 jumboplen
= (u_int32_t
)htonl(jumboplen
);
956 * if there are multiple jumbo payload options,
957 * *plenp will be non-zero and the packet will be
959 * the behavior may need some debate in ipngwg -
960 * multiple options does not make sense, however,
961 * there's no explicit mention in specification.
964 ip6stat
.ip6s_badoptions
++;
965 icmp6_error(m
, ICMP6_PARAM_PROB
,
966 ICMP6_PARAMPROB_HEADER
,
967 erroff
+ opt
+ 2 - opthead
);
973 * jumbo payload length must be larger than 65535.
975 if (jumboplen
<= IPV6_MAXPACKET
) {
976 ip6stat
.ip6s_badoptions
++;
977 icmp6_error(m
, ICMP6_PARAM_PROB
,
978 ICMP6_PARAMPROB_HEADER
,
979 erroff
+ opt
+ 2 - opthead
);
985 default: /* unknown option */
986 if (hbhlen
< IP6OPT_MINLEN
) {
987 ip6stat
.ip6s_toosmall
++;
990 optlen
= ip6_unknown_opt(opt
, m
,
991 erroff
+ opt
- opthead
);
1007 * Unknown option processing.
1008 * The third argument `off' is the offset from the IPv6 header to the option,
1009 * which is necessary if the IPv6 header the and option header and IPv6 header
1010 * is not continuous in order to return an ICMPv6 error.
1013 ip6_unknown_opt(u_int8_t
*optp
, struct mbuf
*m
, int off
)
1015 struct ip6_hdr
*ip6
;
1017 switch (IP6OPT_TYPE(*optp
)) {
1018 case IP6OPT_TYPE_SKIP
: /* ignore the option */
1019 return ((int)*(optp
+ 1));
1020 case IP6OPT_TYPE_DISCARD
: /* silently discard */
1023 case IP6OPT_TYPE_FORCEICMP
: /* send ICMP even if multicasted */
1024 ip6stat
.ip6s_badoptions
++;
1025 icmp6_error(m
, ICMP6_PARAM_PROB
, ICMP6_PARAMPROB_OPTION
, off
);
1027 case IP6OPT_TYPE_ICMP
: /* send ICMP if not multicasted */
1028 ip6stat
.ip6s_badoptions
++;
1029 ip6
= mtod(m
, struct ip6_hdr
*);
1030 if (IN6_IS_ADDR_MULTICAST(&ip6
->ip6_dst
) ||
1031 (m
->m_flags
& (M_BCAST
|M_MCAST
)))
1034 icmp6_error(m
, ICMP6_PARAM_PROB
,
1035 ICMP6_PARAMPROB_OPTION
, off
);
1039 m_freem(m
); /* XXX: NOTREACHED */
1044 * Create the "control" list for this pcb.
1045 * The function will not modify mbuf chain at all.
1047 * with KAME mbuf chain restriction:
1048 * The routine will be called from upper layer handlers like tcp6_input().
1049 * Thus the routine assumes that the caller (tcp6_input) have already
1050 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the
1051 * very first mbuf on the mbuf chain.
1054 ip6_savecontrol(struct inpcb
*in6p
, struct mbuf
**mp
, struct ip6_hdr
*ip6
,
1057 #define IS2292(x, y) ((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y))
1058 struct thread
*td
= curthread
; /* XXX */
1062 if (priv_check(td
, PRIV_ROOT
) == 0)
1066 if (in6p
->in6p_socket
->so_options
& SO_TIMESTAMP
) {
1070 *mp
= sbcreatecontrol((caddr_t
)&tv
, sizeof(tv
),
1071 SCM_TIMESTAMP
, SOL_SOCKET
);
1073 mp
= &(*mp
)->m_next
;
1078 /* RFC 2292 sec. 5 */
1079 if (in6p
->in6p_flags
& IN6P_PKTINFO
) {
1080 struct in6_pktinfo pi6
;
1082 bcopy(&ip6
->ip6_dst
, &pi6
.ipi6_addr
, sizeof(struct in6_addr
));
1083 in6_clearscope(&pi6
.ipi6_addr
); /* XXX */
1084 pi6
.ipi6_ifindex
= (m
&& m
->m_pkthdr
.rcvif
) ?
1085 m
->m_pkthdr
.rcvif
->if_index
: 0;
1086 *mp
= sbcreatecontrol((caddr_t
)&pi6
, sizeof(struct in6_pktinfo
),
1087 IS2292(IPV6_2292PKTINFO
, IPV6_PKTINFO
), IPPROTO_IPV6
);
1089 mp
= &(*mp
)->m_next
;
1092 if (in6p
->in6p_flags
& IN6P_HOPLIMIT
) {
1093 int hlim
= ip6
->ip6_hlim
& 0xff;
1095 *mp
= sbcreatecontrol((caddr_t
)&hlim
, sizeof(int),
1096 IS2292(IPV6_2292HOPLIMIT
, IPV6_HOPLIMIT
), IPPROTO_IPV6
);
1098 mp
= &(*mp
)->m_next
;
1101 if ((in6p
->in6p_flags
& IN6P_TCLASS
) != 0) {
1105 flowinfo
= (u_int32_t
)ntohl(ip6
->ip6_flow
& IPV6_FLOWINFO_MASK
);
1108 tclass
= flowinfo
& 0xff;
1109 *mp
= sbcreatecontrol((caddr_t
) &tclass
, sizeof(tclass
),
1110 IPV6_TCLASS
, IPPROTO_IPV6
);
1112 mp
= &(*mp
)->m_next
;
1116 * IPV6_HOPOPTS socket option. We require super-user privilege
1117 * for the option, but it might be too strict, since there might
1118 * be some hop-by-hop options which can be returned to normal user.
1119 * See RFC 2292 section 6.
1121 if ((in6p
->in6p_flags
& IN6P_HOPOPTS
) && privileged
) {
1123 * Check if a hop-by-hop options header is contatined in the
1124 * received packet, and if so, store the options as ancillary
1125 * data. Note that a hop-by-hop options header must be
1126 * just after the IPv6 header, which is assured through the
1127 * IPv6 input processing.
1129 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1130 if (ip6
->ip6_nxt
== IPPROTO_HOPOPTS
) {
1131 struct ip6_hbh
*hbh
;
1133 #ifdef PULLDOWN_TEST
1137 #ifndef PULLDOWN_TEST
1138 hbh
= (struct ip6_hbh
*)(ip6
+ 1);
1139 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
1141 ext
= ip6_pullexthdr(m
, sizeof(struct ip6_hdr
),
1144 ip6stat
.ip6s_tooshort
++;
1147 hbh
= mtod(ext
, struct ip6_hbh
*);
1148 hbhlen
= (hbh
->ip6h_len
+ 1) << 3;
1149 if (hbhlen
!= ext
->m_len
) {
1151 ip6stat
.ip6s_tooshort
++;
1157 * XXX: We copy the whole header even if a
1158 * jumbo payload option is included, the option which
1159 * is to be removed before returning according to
1161 * Note: this constraint is removed in 2292bis.
1163 *mp
= sbcreatecontrol((caddr_t
)hbh
, hbhlen
,
1164 IS2292(IPV6_2292HOPOPTS
, IPV6_HOPOPTS
),
1167 mp
= &(*mp
)->m_next
;
1168 #ifdef PULLDOWN_TEST
1174 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */
1175 if ((in6p
->in6p_flags
& (IN6P_DSTOPTS
| IN6P_RTHDRDSTOPTS
)) != 0) {
1176 int proto
, off
, nxt
;
1179 * go through the header chain to see if a routing header is
1180 * contained in the packet. We need this information to store
1181 * destination options headers (if any) properly.
1182 * XXX: performance issue. We should record this info when
1183 * processing extension headers in incoming routine.
1186 proto
= IPPROTO_IPV6
;
1192 newoff
= ip6_nexthdr(m
, off
, proto
, &nxt
);
1195 if (newoff
< off
) /* invalid, check for safety */
1197 if ((proto
= nxt
) == IPPROTO_ROUTING
)
1203 if ((in6p
->in6p_flags
&
1204 (IN6P_RTHDR
| IN6P_DSTOPTS
| IN6P_RTHDRDSTOPTS
)) != 0) {
1205 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1206 int nxt
= ip6
->ip6_nxt
, off
= sizeof(struct ip6_hdr
);
1209 * Search for destination options headers or routing
1210 * header(s) through the header chain, and stores each
1211 * header as ancillary data.
1212 * Note that the order of the headers remains in
1213 * the chain of ancillary data.
1215 while (1) { /* is explicit loop prevention necessary? */
1216 struct ip6_ext
*ip6e
= NULL
;
1218 #ifdef PULLDOWN_TEST
1219 struct mbuf
*ext
= NULL
;
1223 * if it is not an extension header, don't try to
1224 * pull it from the chain.
1227 case IPPROTO_DSTOPTS
:
1228 case IPPROTO_ROUTING
:
1229 case IPPROTO_HOPOPTS
:
1230 case IPPROTO_AH
: /* is it possible? */
1236 #ifndef PULLDOWN_TEST
1237 if (off
+ sizeof(*ip6e
) > m
->m_len
)
1239 ip6e
= (struct ip6_ext
*)(mtod(m
, caddr_t
) + off
);
1240 if (nxt
== IPPROTO_AH
)
1241 elen
= (ip6e
->ip6e_len
+ 2) << 2;
1243 elen
= (ip6e
->ip6e_len
+ 1) << 3;
1244 if (off
+ elen
> m
->m_len
)
1247 ext
= ip6_pullexthdr(m
, off
, nxt
);
1249 ip6stat
.ip6s_tooshort
++;
1252 ip6e
= mtod(ext
, struct ip6_ext
*);
1253 if (nxt
== IPPROTO_AH
)
1254 elen
= (ip6e
->ip6e_len
+ 2) << 2;
1256 elen
= (ip6e
->ip6e_len
+ 1) << 3;
1257 if (elen
!= ext
->m_len
) {
1259 ip6stat
.ip6s_tooshort
++;
1265 case IPPROTO_DSTOPTS
:
1266 if ((in6p
->in6p_flags
& IN6P_DSTOPTS
) == 0)
1270 * We also require super-user privilege for
1271 * the option. See comments on IN6_HOPOPTS.
1276 *mp
= sbcreatecontrol((caddr_t
)ip6e
, elen
,
1277 IS2292(IPV6_2292DSTOPTS
, IPV6_DSTOPTS
),
1280 mp
= &(*mp
)->m_next
;
1282 case IPPROTO_ROUTING
:
1283 if (!(in6p
->in6p_flags
& IN6P_RTHDR
))
1286 *mp
= sbcreatecontrol((caddr_t
)ip6e
, elen
,
1287 IS2292(IPV6_2292RTHDR
, IPV6_RTHDR
),
1290 mp
= &(*mp
)->m_next
;
1292 case IPPROTO_HOPOPTS
:
1293 case IPPROTO_AH
: /* is it possible? */
1298 * other cases have been filtered in the above.
1299 * none will visit this case. here we supply
1300 * the code just in case (nxt overwritten or
1303 #ifdef PULLDOWN_TEST
1310 /* proceed with the next header. */
1312 nxt
= ip6e
->ip6e_nxt
;
1314 #ifdef PULLDOWN_TEST
1326 ip6_notify_pmtu(struct inpcb
*in6p
, struct sockaddr_in6
*dst
, u_int32_t
*mtu
)
1330 struct ip6_mtuinfo mtuctl
;
1332 so
= in6p
->inp_socket
;
1338 if (so
== NULL
) /* I believe this is impossible */
1339 panic("ip6_notify_pmtu: socket is NULL");
1342 bzero(&mtuctl
, sizeof(mtuctl
)); /* zero-clear for safety */
1343 mtuctl
.ip6m_mtu
= *mtu
;
1344 mtuctl
.ip6m_addr
= *dst
;
1346 if ((m_mtu
= sbcreatecontrol((caddr_t
)&mtuctl
, sizeof(mtuctl
),
1347 IPV6_PATHMTU
, IPPROTO_IPV6
)) == NULL
)
1350 lwkt_gettoken(&so
->so_rcv
.ssb_token
);
1351 if (sbappendaddr(&so
->so_rcv
.sb
, (struct sockaddr
*)dst
, NULL
, m_mtu
)
1354 /* XXX: should count statistics */
1358 lwkt_reltoken(&so
->so_rcv
.ssb_token
);
1361 #ifdef PULLDOWN_TEST
1363 * pull single extension header from mbuf chain. returns single mbuf that
1364 * contains the result, or NULL on error.
1366 static struct mbuf
*
1367 ip6_pullexthdr(struct mbuf
*m
, size_t off
, int nxt
)
1369 struct ip6_ext ip6e
;
1375 case IPPROTO_DSTOPTS
:
1376 case IPPROTO_ROUTING
:
1377 case IPPROTO_HOPOPTS
:
1378 case IPPROTO_AH
: /* is it possible? */
1381 kprintf("ip6_pullexthdr: invalid nxt=%d\n", nxt
);
1385 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1386 if (nxt
== IPPROTO_AH
)
1387 elen
= (ip6e
.ip6e_len
+ 2) << 2;
1389 elen
= (ip6e
.ip6e_len
+ 1) << 3;
1391 n
= m_getb(elen
, M_NOWAIT
, MT_DATA
, 0);
1396 if (elen
>= M_TRAILINGSPACE(n
)) {
1401 m_copydata(m
, off
, elen
, mtod(n
, caddr_t
));
1408 * Get pointer to the previous header followed by the header
1409 * currently processed.
1410 * XXX: This function supposes that
1411 * M includes all headers,
1412 * the next header field and the header length field of each header
1414 * the sum of each header length equals to OFF.
1415 * Because of these assumptions, this function must be called very
1416 * carefully. Moreover, it will not be used in the near future when
1417 * we develop `neater' mechanism to process extension headers.
1420 ip6_get_prevhdr(struct mbuf
*m
, int off
)
1422 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
1424 if (off
== sizeof(struct ip6_hdr
))
1425 return (&ip6
->ip6_nxt
);
1428 struct ip6_ext
*ip6e
= NULL
;
1431 len
= sizeof(struct ip6_hdr
);
1433 ip6e
= (struct ip6_ext
*)(mtod(m
, caddr_t
) + len
);
1436 case IPPROTO_FRAGMENT
:
1437 len
+= sizeof(struct ip6_frag
);
1440 len
+= (ip6e
->ip6e_len
+ 2) << 2;
1443 len
+= (ip6e
->ip6e_len
+ 1) << 3;
1446 nxt
= ip6e
->ip6e_nxt
;
1449 return (&ip6e
->ip6e_nxt
);
1456 * get next header offset. m will be retained.
1459 ip6_nexthdr(struct mbuf
*m
, int off
, int proto
, int *nxtp
)
1462 struct ip6_ext ip6e
;
1467 panic("ip6_nexthdr: m == NULL");
1468 if ((m
->m_flags
& M_PKTHDR
) == 0 || m
->m_pkthdr
.len
< off
)
1473 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6
))
1475 m_copydata(m
, off
, sizeof(ip6
), (caddr_t
)&ip6
);
1477 *nxtp
= ip6
.ip6_nxt
;
1481 case IPPROTO_FRAGMENT
:
1483 * terminate parsing if it is not the first fragment,
1484 * it does not make sense to parse through it.
1486 if (m
->m_pkthdr
.len
< off
+ sizeof(fh
))
1488 m_copydata(m
, off
, sizeof(fh
), (caddr_t
)&fh
);
1489 /* IP6F_OFF_MASK = 0xfff8(BigEndian), 0xf8ff(LittleEndian) */
1490 if (fh
.ip6f_offlg
& IP6F_OFF_MASK
)
1493 *nxtp
= fh
.ip6f_nxt
;
1494 off
+= sizeof(struct ip6_frag
);
1498 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6e
))
1500 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1502 *nxtp
= ip6e
.ip6e_nxt
;
1503 off
+= (ip6e
.ip6e_len
+ 2) << 2;
1506 case IPPROTO_HOPOPTS
:
1507 case IPPROTO_ROUTING
:
1508 case IPPROTO_DSTOPTS
:
1509 if (m
->m_pkthdr
.len
< off
+ sizeof(ip6e
))
1511 m_copydata(m
, off
, sizeof(ip6e
), (caddr_t
)&ip6e
);
1513 *nxtp
= ip6e
.ip6e_nxt
;
1514 off
+= (ip6e
.ip6e_len
+ 1) << 3;
1519 case IPPROTO_IPCOMP
:
1531 * get offset for the last header in the chain. m will be kept untainted.
1534 ip6_lasthdr(struct mbuf
*m
, int off
, int proto
, int *nxtp
)
1544 newoff
= ip6_nexthdr(m
, off
, proto
, nxtp
);
1547 else if (newoff
< off
)
1548 return -1; /* invalid */
1549 else if (newoff
== off
)
1558 ip6_addaux(struct mbuf
*m
)
1562 mtag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1564 mtag
= m_tag_get(PACKET_TAG_IPV6_INPUT
, sizeof(struct ip6aux
),
1567 m_tag_prepend(m
, mtag
);
1570 bzero(m_tag_data(mtag
), sizeof(struct ip6aux
));
1571 return mtag
? (struct ip6aux
*)m_tag_data(mtag
) : NULL
;
1575 ip6_findaux(struct mbuf
*m
)
1579 mtag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1580 return mtag
? (struct ip6aux
*)m_tag_data(mtag
) : NULL
;
1584 ip6_delaux(struct mbuf
*m
)
1588 mtag
= m_tag_find(m
, PACKET_TAG_IPV6_INPUT
, NULL
);
1590 m_tag_delete(m
, mtag
);
1594 * System control for IP6
1597 u_char inet6ctlerrmap
[PRC_NCMDS
] = {
1599 0, EMSGSIZE
, EHOSTDOWN
, EHOSTUNREACH
,
1600 EHOSTUNREACH
, EHOSTUNREACH
, ECONNREFUSED
, ECONNREFUSED
,
1601 EMSGSIZE
, EHOSTUNREACH
, 0, 0,