1 /* $OpenBSD: icmp6.c,v 1.252 2024/04/21 17:32:10 florian Exp $ */
2 /* $KAME: icmp6.c,v 1.217 2001/06/20 15:03:29 jinmei Exp $ */
3
4 /*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 /*
34 * Copyright (c) 1982, 1986, 1988, 1993
35 * The Regents of the University of California. All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. Neither the name of the University nor the names of its contributors
46 * may be used to endorse or promote products derived from this software
47 * without specific prior written permission.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59 * SUCH DAMAGE.
60 *
61 * @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94
62 */
63
64 #include "carp.h"
65 #include "pf.h"
66
67 #include <sys/param.h>
68 #include <sys/systm.h>
69 #include <sys/malloc.h>
70 #include <sys/mbuf.h>
71 #include <sys/sysctl.h>
72 #include <sys/protosw.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <sys/time.h>
76 #include <sys/kernel.h>
77 #include <sys/syslog.h>
78
79 #include <net/if.h>
80 #include <net/if_var.h>
81 #include <net/route.h>
82 #include <net/if_dl.h>
83 #include <net/if_types.h>
84
85 #include <netinet/in.h>
86 #include <netinet/ip.h>
87 #include <netinet6/in6_var.h>
88 #include <netinet/ip6.h>
89 #include <netinet6/ip6_var.h>
90 #include <netinet/icmp6.h>
91 #include <netinet6/mld6_var.h>
92 #include <netinet/in_pcb.h>
93 #include <netinet6/nd6.h>
94 #include <netinet6/ip6protosw.h>
95
96 #if NCARP > 0
97 #include <netinet/ip_carp.h>
98 #endif
99
100 #if NPF > 0
101 #include <net/pfvar.h>
102 #endif
103
104 struct cpumem *icmp6counters;
105
106 extern int icmp6errppslim;
107 static int icmp6errpps_count = 0;
108 static struct timeval icmp6errppslim_last;
109
110 /*
111 * List of callbacks to notify when Path MTU changes are made.
112 */
113 struct icmp6_mtudisc_callback {
114 LIST_ENTRY(icmp6_mtudisc_callback) mc_list;
115 void (*mc_func)(struct sockaddr_in6 *, u_int);
116 };
117
118 LIST_HEAD(, icmp6_mtudisc_callback) icmp6_mtudisc_callbacks =
119 LIST_HEAD_INITIALIZER(icmp6_mtudisc_callbacks);
120
121 struct rttimer_queue icmp6_mtudisc_timeout_q;
122
123 /* XXX do these values make any sense? */
124 static int icmp6_mtudisc_hiwat = 1280;
125 static int icmp6_mtudisc_lowat = 256;
126
127 /*
128 * keep track of # of redirect routes.
129 */
130 struct rttimer_queue icmp6_redirect_timeout_q;
131
132 void icmp6_errcount(int, int);
133 int icmp6_ratelimit(const struct in6_addr *, const int, const int);
134 const char *icmp6_redirect_diag(struct in6_addr *, struct in6_addr *,
135 struct in6_addr *);
136 int icmp6_notify_error(struct mbuf *, int, int, int);
137 void icmp6_mtudisc_timeout(struct rtentry *, u_int);
138
139 void
icmp6_init(void)140 icmp6_init(void)
141 {
142 mld6_init();
143 rt_timer_queue_init(&icmp6_mtudisc_timeout_q, ip6_mtudisc_timeout,
144 &icmp6_mtudisc_timeout);
145 rt_timer_queue_init(&icmp6_redirect_timeout_q, icmp6_redirtimeout,
146 NULL);
147 icmp6counters = counters_alloc(icp6s_ncounters);
148 }
149
150 void
icmp6_errcount(int type,int code)151 icmp6_errcount(int type, int code)
152 {
153 enum icmp6stat_counters c = icp6s_ounknown;
154
155 switch (type) {
156 case ICMP6_DST_UNREACH:
157 switch (code) {
158 case ICMP6_DST_UNREACH_NOROUTE:
159 c = icp6s_odst_unreach_noroute;
160 break;
161 case ICMP6_DST_UNREACH_ADMIN:
162 c = icp6s_odst_unreach_admin;
163 break;
164 case ICMP6_DST_UNREACH_BEYONDSCOPE:
165 c = icp6s_odst_unreach_beyondscope;
166 break;
167 case ICMP6_DST_UNREACH_ADDR:
168 c = icp6s_odst_unreach_addr;
169 break;
170 case ICMP6_DST_UNREACH_NOPORT:
171 c = icp6s_odst_unreach_noport;
172 break;
173 }
174 break;
175 case ICMP6_PACKET_TOO_BIG:
176 c = icp6s_opacket_too_big;
177 break;
178 case ICMP6_TIME_EXCEEDED:
179 switch (code) {
180 case ICMP6_TIME_EXCEED_TRANSIT:
181 c = icp6s_otime_exceed_transit;
182 break;
183 case ICMP6_TIME_EXCEED_REASSEMBLY:
184 c = icp6s_otime_exceed_reassembly;
185 break;
186 }
187 break;
188 case ICMP6_PARAM_PROB:
189 switch (code) {
190 case ICMP6_PARAMPROB_HEADER:
191 c = icp6s_oparamprob_header;
192 break;
193 case ICMP6_PARAMPROB_NEXTHEADER:
194 c = icp6s_oparamprob_nextheader;
195 break;
196 case ICMP6_PARAMPROB_OPTION:
197 c = icp6s_oparamprob_option;
198 break;
199 }
200 break;
201 case ND_REDIRECT:
202 c = icp6s_oredirect;
203 break;
204 }
205
206 icmp6stat_inc(c);
207 }
208
209 /*
210 * Register a Path MTU Discovery callback.
211 */
212 void
icmp6_mtudisc_callback_register(void (* func)(struct sockaddr_in6 *,u_int))213 icmp6_mtudisc_callback_register(void (*func)(struct sockaddr_in6 *, u_int))
214 {
215 struct icmp6_mtudisc_callback *mc;
216
217 LIST_FOREACH(mc, &icmp6_mtudisc_callbacks, mc_list) {
218 if (mc->mc_func == func)
219 return;
220 }
221
222 mc = malloc(sizeof(*mc), M_PCB, M_NOWAIT);
223 if (mc == NULL)
224 panic("%s", __func__);
225
226 mc->mc_func = func;
227 LIST_INSERT_HEAD(&icmp6_mtudisc_callbacks, mc, mc_list);
228 }
229
230 struct mbuf *
icmp6_do_error(struct mbuf * m,int type,int code,int param)231 icmp6_do_error(struct mbuf *m, int type, int code, int param)
232 {
233 struct ip6_hdr *oip6, *nip6;
234 struct icmp6_hdr *icmp6;
235 u_int preplen;
236 int off;
237 int nxt;
238
239 icmp6stat_inc(icp6s_error);
240
241 /* count per-type-code statistics */
242 icmp6_errcount(type, code);
243
244 if (m->m_len < sizeof(struct ip6_hdr)) {
245 m = m_pullup(m, sizeof(struct ip6_hdr));
246 if (m == NULL)
247 return (NULL);
248 }
249 oip6 = mtod(m, struct ip6_hdr *);
250
251 /*
252 * If the destination address of the erroneous packet is a multicast
253 * address, or the packet was sent using link-layer multicast,
254 * we should basically suppress sending an error (RFC 2463, Section
255 * 2.4).
256 * We have two exceptions (the item e.2 in that section):
257 * - the Packet Too Big message can be sent for path MTU discovery.
258 * - the Parameter Problem Message that can be allowed an icmp6 error
259 * in the option type field. This check has been done in
260 * ip6_unknown_opt(), so we can just check the type and code.
261 */
262 if ((m->m_flags & (M_BCAST|M_MCAST) ||
263 IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) &&
264 (type != ICMP6_PACKET_TOO_BIG &&
265 (type != ICMP6_PARAM_PROB ||
266 code != ICMP6_PARAMPROB_OPTION)))
267 goto freeit;
268
269 /*
270 * RFC 2463, 2.4 (e.5): source address check.
271 * XXX: the case of anycast source?
272 */
273 if (IN6_IS_ADDR_UNSPECIFIED(&oip6->ip6_src) ||
274 IN6_IS_ADDR_MULTICAST(&oip6->ip6_src))
275 goto freeit;
276
277 /*
278 * If we are about to send ICMPv6 against ICMPv6 error/redirect,
279 * don't do it.
280 */
281 nxt = -1;
282 off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
283 if (off >= 0 && nxt == IPPROTO_ICMPV6) {
284 struct icmp6_hdr *icp;
285
286 IP6_EXTHDR_GET(icp, struct icmp6_hdr *, m, off,
287 sizeof(*icp));
288 if (icp == NULL) {
289 icmp6stat_inc(icp6s_tooshort);
290 return (NULL);
291 }
292 if (icp->icmp6_type < ICMP6_ECHO_REQUEST ||
293 icp->icmp6_type == ND_REDIRECT) {
294 /*
295 * ICMPv6 error
296 * Special case: for redirect (which is
297 * informational) we must not send icmp6 error.
298 */
299 icmp6stat_inc(icp6s_canterror);
300 goto freeit;
301 } else {
302 /* ICMPv6 informational - send the error */
303 }
304 }
305 else {
306 /* non-ICMPv6 - send the error */
307 }
308
309 oip6 = mtod(m, struct ip6_hdr *); /* adjust pointer */
310
311 /* Finally, do rate limitation check. */
312 if (icmp6_ratelimit(&oip6->ip6_src, type, code)) {
313 icmp6stat_inc(icp6s_toofreq);
314 goto freeit;
315 }
316
317 /*
318 * OK, ICMP6 can be generated.
319 */
320
321 if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN)
322 m_adj(m, ICMPV6_PLD_MAXLEN - m->m_pkthdr.len);
323
324 preplen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
325 M_PREPEND(m, preplen, M_DONTWAIT);
326 if (m && m->m_len < preplen)
327 m = m_pullup(m, preplen);
328 if (m == NULL) {
329 nd6log((LOG_DEBUG, "ENOBUFS in icmp6_error %d\n", __LINE__));
330 return (NULL);
331 }
332
333 nip6 = mtod(m, struct ip6_hdr *);
334 nip6->ip6_src = oip6->ip6_src;
335 nip6->ip6_dst = oip6->ip6_dst;
336
337 if (IN6_IS_SCOPE_EMBED(&oip6->ip6_src))
338 oip6->ip6_src.s6_addr16[1] = 0;
339 if (IN6_IS_SCOPE_EMBED(&oip6->ip6_dst))
340 oip6->ip6_dst.s6_addr16[1] = 0;
341
342 icmp6 = (struct icmp6_hdr *)(nip6 + 1);
343 icmp6->icmp6_type = type;
344 icmp6->icmp6_code = code;
345 icmp6->icmp6_pptr = htonl((u_int32_t)param);
346
347 /*
348 * icmp6_reflect() is designed to be in the input path.
349 * icmp6_error() can be called from both input and output path,
350 * and if we are in output path rcvif could contain bogus value.
351 * clear m->m_pkthdr.ph_ifidx for safety, we should have enough
352 * scope information in ip header (nip6).
353 */
354 m->m_pkthdr.ph_ifidx = 0;
355
356 icmp6stat_inc(icp6s_outhist + type);
357
358 return (m);
359
360 freeit:
361 /*
362 * If we can't tell whether or not we can generate ICMP6, free it.
363 */
364 return (m_freem(m));
365 }
366
367 /*
368 * Generate an error packet of type error in response to bad IP6 packet.
369 */
370 void
icmp6_error(struct mbuf * m,int type,int code,int param)371 icmp6_error(struct mbuf *m, int type, int code, int param)
372 {
373 struct mbuf *n;
374
375 n = icmp6_do_error(m, type, code, param);
376 if (n != NULL) {
377 /* header order: IPv6 - ICMPv6 */
378 if (!icmp6_reflect(&n, sizeof(struct ip6_hdr), NULL))
379 ip6_send(n);
380 }
381 }
382
383 /*
384 * Process a received ICMP6 message.
385 */
386 int
icmp6_input(struct mbuf ** mp,int * offp,int proto,int af)387 icmp6_input(struct mbuf **mp, int *offp, int proto, int af)
388 {
389 #if NCARP > 0
390 struct ifnet *ifp;
391 #endif
392 struct mbuf *m = *mp, *n;
393 struct ip6_hdr *ip6, *nip6;
394 struct icmp6_hdr *icmp6, *nicmp6;
395 int off = *offp;
396 int icmp6len = m->m_pkthdr.len - off;
397 int code, sum, noff;
398 char src[INET6_ADDRSTRLEN], dst[INET6_ADDRSTRLEN];
399
400 /*
401 * Locate icmp6 structure in mbuf, and check
402 * that not corrupted and of at least minimum length
403 */
404
405 ip6 = mtod(m, struct ip6_hdr *);
406 if (icmp6len < sizeof(struct icmp6_hdr)) {
407 icmp6stat_inc(icp6s_tooshort);
408 goto freeit;
409 }
410
411 /*
412 * calculate the checksum
413 */
414 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6));
415 if (icmp6 == NULL) {
416 icmp6stat_inc(icp6s_tooshort);
417 return IPPROTO_DONE;
418 }
419 code = icmp6->icmp6_code;
420
421 if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) {
422 nd6log((LOG_ERR,
423 "ICMP6 checksum error(%d|%x) %s\n",
424 icmp6->icmp6_type, sum,
425 inet_ntop(AF_INET6, &ip6->ip6_src, src, sizeof(src))));
426 icmp6stat_inc(icp6s_checksum);
427 goto freeit;
428 }
429
430 #if NPF > 0
431 if (m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) {
432 switch (icmp6->icmp6_type) {
433 /*
434 * These ICMP6 types map to other connections. They must be
435 * delivered to pr_ctlinput() also for diverted connections.
436 */
437 case ICMP6_DST_UNREACH:
438 case ICMP6_PACKET_TOO_BIG:
439 case ICMP6_TIME_EXCEEDED:
440 case ICMP6_PARAM_PROB:
441 /*
442 * Do not use the divert-to property of the TCP or UDP
443 * rule when doing the PCB lookup for the raw socket.
444 */
445 m->m_pkthdr.pf.flags &=~ PF_TAG_DIVERTED;
446 break;
447 default:
448 goto raw;
449 }
450 }
451 #endif /* NPF */
452
453 #if NCARP > 0
454 ifp = if_get(m->m_pkthdr.ph_ifidx);
455 if (ifp == NULL)
456 goto freeit;
457
458 if (icmp6->icmp6_type == ICMP6_ECHO_REQUEST &&
459 carp_lsdrop(ifp, m, AF_INET6, ip6->ip6_src.s6_addr32,
460 ip6->ip6_dst.s6_addr32, 1)) {
461 if_put(ifp);
462 goto freeit;
463 }
464
465 if_put(ifp);
466 #endif
467 icmp6stat_inc(icp6s_inhist + icmp6->icmp6_type);
468
469 switch (icmp6->icmp6_type) {
470 case ICMP6_DST_UNREACH:
471 switch (code) {
472 case ICMP6_DST_UNREACH_NOROUTE:
473 code = PRC_UNREACH_NET;
474 break;
475 case ICMP6_DST_UNREACH_ADMIN:
476 code = PRC_UNREACH_PROTOCOL; /* is this a good code? */
477 break;
478 case ICMP6_DST_UNREACH_ADDR:
479 code = PRC_HOSTDEAD;
480 break;
481 case ICMP6_DST_UNREACH_BEYONDSCOPE:
482 /* I mean "source address was incorrect." */
483 code = PRC_PARAMPROB;
484 break;
485 case ICMP6_DST_UNREACH_NOPORT:
486 code = PRC_UNREACH_PORT;
487 break;
488 default:
489 goto badcode;
490 }
491 goto deliver;
492
493 case ICMP6_PACKET_TOO_BIG:
494 /* MTU is checked in icmp6_mtudisc_update. */
495 code = PRC_MSGSIZE;
496
497 /*
498 * Updating the path MTU will be done after examining
499 * intermediate extension headers.
500 */
501 goto deliver;
502
503 case ICMP6_TIME_EXCEEDED:
504 switch (code) {
505 case ICMP6_TIME_EXCEED_TRANSIT:
506 code = PRC_TIMXCEED_INTRANS;
507 break;
508 case ICMP6_TIME_EXCEED_REASSEMBLY:
509 code = PRC_TIMXCEED_REASS;
510 break;
511 default:
512 goto badcode;
513 }
514 goto deliver;
515
516 case ICMP6_PARAM_PROB:
517 switch (code) {
518 case ICMP6_PARAMPROB_NEXTHEADER:
519 code = PRC_UNREACH_PROTOCOL;
520 break;
521 case ICMP6_PARAMPROB_HEADER:
522 case ICMP6_PARAMPROB_OPTION:
523 code = PRC_PARAMPROB;
524 break;
525 default:
526 goto badcode;
527 }
528 goto deliver;
529
530 case ICMP6_ECHO_REQUEST:
531 if (code != 0)
532 goto badcode;
533 /*
534 * Copy mbuf to send to two data paths: userland socket(s),
535 * and to the querier (echo reply).
536 * m: a copy for socket, n: a copy for querier
537 */
538 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
539 /* Give up local */
540 n = m;
541 m = *mp = NULL;
542 goto deliverecho;
543 }
544 /*
545 * If the first mbuf is shared, or the first mbuf is too short,
546 * copy the first part of the data into a fresh mbuf.
547 * Otherwise, we will wrongly overwrite both copies.
548 */
549 if ((n->m_flags & M_EXT) != 0 ||
550 n->m_len < off + sizeof(struct icmp6_hdr)) {
551 struct mbuf *n0 = n;
552 const int maxlen = sizeof(*nip6) + sizeof(*nicmp6);
553
554 /*
555 * Prepare an internal mbuf. m_pullup() doesn't
556 * always copy the length we specified.
557 */
558 if (maxlen >= MCLBYTES) {
559 /* Give up remote */
560 m_freem(n0);
561 break;
562 }
563 MGETHDR(n, M_DONTWAIT, n0->m_type);
564 if (n && maxlen >= MHLEN) {
565 MCLGET(n, M_DONTWAIT);
566 if ((n->m_flags & M_EXT) == 0) {
567 m_free(n);
568 n = NULL;
569 }
570 }
571 if (n == NULL) {
572 /* Give up local */
573 m_freem(n0);
574 n = m;
575 m = *mp = NULL;
576 goto deliverecho;
577 }
578 M_MOVE_PKTHDR(n, n0);
579 /*
580 * Copy IPv6 and ICMPv6 only.
581 */
582 nip6 = mtod(n, struct ip6_hdr *);
583 bcopy(ip6, nip6, sizeof(struct ip6_hdr));
584 nicmp6 = (struct icmp6_hdr *)(nip6 + 1);
585 bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr));
586 noff = sizeof(struct ip6_hdr);
587 n->m_len = noff + sizeof(struct icmp6_hdr);
588 /*
589 * Adjust mbuf. ip6_plen will be adjusted in
590 * ip6_output().
591 * n->m_pkthdr.len == n0->m_pkthdr.len at this point.
592 */
593 n->m_pkthdr.len += noff + sizeof(struct icmp6_hdr);
594 n->m_pkthdr.len -= (off + sizeof(struct icmp6_hdr));
595 m_adj(n0, off + sizeof(struct icmp6_hdr));
596 n->m_next = n0;
597 } else {
598 deliverecho:
599 IP6_EXTHDR_GET(nicmp6, struct icmp6_hdr *, n, off,
600 sizeof(*nicmp6));
601 noff = off;
602 }
603 if (n) {
604 nicmp6->icmp6_type = ICMP6_ECHO_REPLY;
605 nicmp6->icmp6_code = 0;
606 icmp6stat_inc(icp6s_reflect);
607 icmp6stat_inc(icp6s_outhist + ICMP6_ECHO_REPLY);
608 if (!icmp6_reflect(&n, noff, NULL))
609 ip6_send(n);
610 }
611 if (!m)
612 goto freeit;
613 break;
614
615 case ICMP6_ECHO_REPLY:
616 if (code != 0)
617 goto badcode;
618 break;
619
620 case MLD_LISTENER_QUERY:
621 case MLD_LISTENER_REPORT:
622 if (icmp6len < sizeof(struct mld_hdr))
623 goto badlen;
624 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
625 /* give up local */
626 mld6_input(m, off);
627 m = NULL;
628 goto freeit;
629 }
630 mld6_input(n, off);
631 /* m stays. */
632 break;
633
634 case MLD_LISTENER_DONE:
635 if (icmp6len < sizeof(struct mld_hdr)) /* necessary? */
636 goto badlen;
637 break; /* nothing to be done in kernel */
638
639 case MLD_MTRACE_RESP:
640 case MLD_MTRACE:
641 /* XXX: these two are experimental. not officially defined. */
642 /* XXX: per-interface statistics? */
643 break; /* just pass it to applications */
644
645 case ICMP6_WRUREQUEST: /* ICMP6_FQDN_QUERY */
646 /* IPv6 Node Information Queries are not supported */
647 break;
648 case ICMP6_WRUREPLY:
649 break;
650
651 case ND_ROUTER_SOLICIT:
652 case ND_ROUTER_ADVERT:
653 if (code != 0)
654 goto badcode;
655 if ((icmp6->icmp6_type == ND_ROUTER_SOLICIT && icmp6len <
656 sizeof(struct nd_router_solicit)) ||
657 (icmp6->icmp6_type == ND_ROUTER_ADVERT && icmp6len <
658 sizeof(struct nd_router_advert)))
659 goto badlen;
660
661 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
662 /* give up local */
663 nd6_rtr_cache(m, off, icmp6len,
664 icmp6->icmp6_type);
665 m = NULL;
666 goto freeit;
667 }
668 nd6_rtr_cache(n, off, icmp6len, icmp6->icmp6_type);
669 /* m stays. */
670 break;
671
672 case ND_NEIGHBOR_SOLICIT:
673 if (code != 0)
674 goto badcode;
675 if (icmp6len < sizeof(struct nd_neighbor_solicit))
676 goto badlen;
677 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
678 /* give up local */
679 nd6_ns_input(m, off, icmp6len);
680 m = NULL;
681 goto freeit;
682 }
683 nd6_ns_input(n, off, icmp6len);
684 /* m stays. */
685 break;
686
687 case ND_NEIGHBOR_ADVERT:
688 if (code != 0)
689 goto badcode;
690 if (icmp6len < sizeof(struct nd_neighbor_advert))
691 goto badlen;
692 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
693 /* give up local */
694 nd6_na_input(m, off, icmp6len);
695 m = NULL;
696 goto freeit;
697 }
698 nd6_na_input(n, off, icmp6len);
699 /* m stays. */
700 break;
701
702 case ND_REDIRECT:
703 if (code != 0)
704 goto badcode;
705 if (icmp6len < sizeof(struct nd_redirect))
706 goto badlen;
707 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
708 /* give up local */
709 icmp6_redirect_input(m, off);
710 m = NULL;
711 goto freeit;
712 }
713 icmp6_redirect_input(n, off);
714 /* m stays. */
715 break;
716
717 case ICMP6_ROUTER_RENUMBERING:
718 if (code != ICMP6_ROUTER_RENUMBERING_COMMAND &&
719 code != ICMP6_ROUTER_RENUMBERING_RESULT)
720 goto badcode;
721 if (icmp6len < sizeof(struct icmp6_router_renum))
722 goto badlen;
723 break;
724
725 default:
726 nd6log((LOG_DEBUG,
727 "icmp6_input: unknown type %d(src=%s, dst=%s, ifid=%u)\n",
728 icmp6->icmp6_type,
729 inet_ntop(AF_INET6, &ip6->ip6_src, src, sizeof(src)),
730 inet_ntop(AF_INET6, &ip6->ip6_dst, dst, sizeof(dst)),
731 m->m_pkthdr.ph_ifidx));
732 if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST) {
733 /* ICMPv6 error: MUST deliver it by spec... */
734 code = PRC_NCMDS;
735 /* deliver */
736 } else {
737 /* ICMPv6 informational: MUST not deliver */
738 break;
739 }
740 deliver:
741 if (icmp6_notify_error(m, off, icmp6len, code)) {
742 /* In this case, m should've been freed. */
743 return (IPPROTO_DONE);
744 }
745 break;
746
747 badcode:
748 icmp6stat_inc(icp6s_badcode);
749 break;
750
751 badlen:
752 icmp6stat_inc(icp6s_badlen);
753 break;
754 }
755
756 #if NPF > 0
757 raw:
758 #endif
759 /* deliver the packet to appropriate sockets */
760 return rip6_input(mp, offp, proto, af);
761
762 freeit:
763 m_freem(m);
764 return IPPROTO_DONE;
765 }
766
767 int
icmp6_notify_error(struct mbuf * m,int off,int icmp6len,int code)768 icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
769 {
770 struct icmp6_hdr *icmp6;
771 struct ip6_hdr *eip6;
772 u_int32_t notifymtu;
773 struct sockaddr_in6 icmp6src, icmp6dst;
774
775 if (icmp6len < sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr)) {
776 icmp6stat_inc(icp6s_tooshort);
777 goto freeit;
778 }
779 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,
780 sizeof(*icmp6) + sizeof(struct ip6_hdr));
781 if (icmp6 == NULL) {
782 icmp6stat_inc(icp6s_tooshort);
783 return (-1);
784 }
785 eip6 = (struct ip6_hdr *)(icmp6 + 1);
786
787 /* Detect the upper level protocol */
788 {
789 void (*ctlfunc)(int, struct sockaddr *, u_int, void *);
790 u_int8_t nxt = eip6->ip6_nxt;
791 int eoff = off + sizeof(struct icmp6_hdr) +
792 sizeof(struct ip6_hdr);
793 struct ip6ctlparam ip6cp;
794 struct in6_addr *finaldst = NULL;
795 int icmp6type = icmp6->icmp6_type;
796 struct ip6_frag *fh;
797 struct ip6_rthdr *rth;
798 struct ip6_rthdr0 *rth0;
799 int rthlen;
800
801 while (1) { /* XXX: should avoid infinite loop explicitly? */
802 struct ip6_ext *eh;
803
804 switch (nxt) {
805 case IPPROTO_HOPOPTS:
806 case IPPROTO_DSTOPTS:
807 case IPPROTO_AH:
808 IP6_EXTHDR_GET(eh, struct ip6_ext *, m,
809 eoff, sizeof(*eh));
810 if (eh == NULL) {
811 icmp6stat_inc(icp6s_tooshort);
812 return (-1);
813 }
814
815 if (nxt == IPPROTO_AH)
816 eoff += (eh->ip6e_len + 2) << 2;
817 else
818 eoff += (eh->ip6e_len + 1) << 3;
819 nxt = eh->ip6e_nxt;
820 break;
821 case IPPROTO_ROUTING:
822 /*
823 * When the erroneous packet contains a
824 * routing header, we should examine the
825 * header to determine the final destination.
826 * Otherwise, we can't properly update
827 * information that depends on the final
828 * destination (e.g. path MTU).
829 */
830 IP6_EXTHDR_GET(rth, struct ip6_rthdr *, m,
831 eoff, sizeof(*rth));
832 if (rth == NULL) {
833 icmp6stat_inc(icp6s_tooshort);
834 return (-1);
835 }
836 rthlen = (rth->ip6r_len + 1) << 3;
837 /*
838 * XXX: currently there is no
839 * officially defined type other
840 * than type-0.
841 * Note that if the segment left field
842 * is 0, all intermediate hops must
843 * have been passed.
844 */
845 if (rth->ip6r_segleft &&
846 rth->ip6r_type == IPV6_RTHDR_TYPE_0) {
847 int hops;
848
849 IP6_EXTHDR_GET(rth0,
850 struct ip6_rthdr0 *, m,
851 eoff, rthlen);
852 if (rth0 == NULL) {
853 icmp6stat_inc(icp6s_tooshort);
854 return (-1);
855 }
856 /* just ignore a bogus header */
857 if ((rth0->ip6r0_len % 2) == 0 &&
858 (hops = rth0->ip6r0_len/2))
859 finaldst = (struct in6_addr *)(rth0 + 1) + (hops - 1);
860 }
861 eoff += rthlen;
862 nxt = rth->ip6r_nxt;
863 break;
864 case IPPROTO_FRAGMENT:
865 IP6_EXTHDR_GET(fh, struct ip6_frag *, m,
866 eoff, sizeof(*fh));
867 if (fh == NULL) {
868 icmp6stat_inc(icp6s_tooshort);
869 return (-1);
870 }
871 /*
872 * Data after a fragment header is meaningless
873 * unless it is the first fragment, but
874 * we'll go to the notify label for path MTU
875 * discovery.
876 */
877 if (fh->ip6f_offlg & IP6F_OFF_MASK)
878 goto notify;
879
880 eoff += sizeof(struct ip6_frag);
881 nxt = fh->ip6f_nxt;
882 break;
883 default:
884 /*
885 * This case includes ESP and the No Next
886 * Header. In such cases going to the notify
887 * label does not have any meaning
888 * (i.e. ctlfunc will be NULL), but we go
889 * anyway since we might have to update
890 * path MTU information.
891 */
892 goto notify;
893 }
894 }
895 notify:
896 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,
897 sizeof(*icmp6) + sizeof(struct ip6_hdr));
898 if (icmp6 == NULL) {
899 icmp6stat_inc(icp6s_tooshort);
900 return (-1);
901 }
902
903 eip6 = (struct ip6_hdr *)(icmp6 + 1);
904 bzero(&icmp6dst, sizeof(icmp6dst));
905 icmp6dst.sin6_len = sizeof(struct sockaddr_in6);
906 icmp6dst.sin6_family = AF_INET6;
907 if (finaldst == NULL)
908 icmp6dst.sin6_addr = eip6->ip6_dst;
909 else
910 icmp6dst.sin6_addr = *finaldst;
911 icmp6dst.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.ph_ifidx,
912 &icmp6dst.sin6_addr);
913 if (in6_embedscope(&icmp6dst.sin6_addr, &icmp6dst,
914 NULL, NULL)) {
915 /* should be impossible */
916 nd6log((LOG_DEBUG,
917 "icmp6_notify_error: in6_embedscope failed\n"));
918 goto freeit;
919 }
920
921 /*
922 * retrieve parameters from the inner IPv6 header, and convert
923 * them into sockaddr structures.
924 */
925 bzero(&icmp6src, sizeof(icmp6src));
926 icmp6src.sin6_len = sizeof(struct sockaddr_in6);
927 icmp6src.sin6_family = AF_INET6;
928 icmp6src.sin6_addr = eip6->ip6_src;
929 icmp6src.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.ph_ifidx,
930 &icmp6src.sin6_addr);
931 if (in6_embedscope(&icmp6src.sin6_addr, &icmp6src,
932 NULL, NULL)) {
933 /* should be impossible */
934 nd6log((LOG_DEBUG,
935 "icmp6_notify_error: in6_embedscope failed\n"));
936 goto freeit;
937 }
938 icmp6src.sin6_flowinfo =
939 (eip6->ip6_flow & IPV6_FLOWLABEL_MASK);
940
941 if (finaldst == NULL)
942 finaldst = &eip6->ip6_dst;
943 ip6cp.ip6c_m = m;
944 ip6cp.ip6c_icmp6 = icmp6;
945 ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1);
946 ip6cp.ip6c_off = eoff;
947 ip6cp.ip6c_finaldst = finaldst;
948 ip6cp.ip6c_src = &icmp6src;
949 ip6cp.ip6c_nxt = nxt;
950 #if NPF > 0
951 pf_pkt_addr_changed(m);
952 #endif
953
954 if (icmp6type == ICMP6_PACKET_TOO_BIG) {
955 notifymtu = ntohl(icmp6->icmp6_mtu);
956 ip6cp.ip6c_cmdarg = (void *)¬ifymtu;
957 }
958
959 ctlfunc = inet6sw[ip6_protox[nxt]].pr_ctlinput;
960 if (ctlfunc)
961 (*ctlfunc)(code, sin6tosa(&icmp6dst),
962 m->m_pkthdr.ph_rtableid, &ip6cp);
963 }
964 return (0);
965
966 freeit:
967 m_freem(m);
968 return (-1);
969 }
970
971 void
icmp6_mtudisc_update(struct ip6ctlparam * ip6cp,int validated)972 icmp6_mtudisc_update(struct ip6ctlparam *ip6cp, int validated)
973 {
974 unsigned long rtcount;
975 struct icmp6_mtudisc_callback *mc;
976 struct in6_addr *dst = ip6cp->ip6c_finaldst;
977 struct icmp6_hdr *icmp6 = ip6cp->ip6c_icmp6;
978 struct mbuf *m = ip6cp->ip6c_m; /* will be necessary for scope issue */
979 u_int mtu = ntohl(icmp6->icmp6_mtu);
980 struct rtentry *rt = NULL;
981 struct sockaddr_in6 sin6;
982
983 if (mtu < IPV6_MMTU)
984 return;
985
986 /*
987 * allow non-validated cases if memory is plenty, to make traffic
988 * from non-connected pcb happy.
989 */
990 rtcount = rt_timer_queue_count(&icmp6_mtudisc_timeout_q);
991 if (validated) {
992 if (0 <= icmp6_mtudisc_hiwat && rtcount > icmp6_mtudisc_hiwat)
993 return;
994 else if (0 <= icmp6_mtudisc_lowat &&
995 rtcount > icmp6_mtudisc_lowat) {
996 /*
997 * XXX nuke a victim, install the new one.
998 */
999 }
1000 } else {
1001 if (0 <= icmp6_mtudisc_lowat && rtcount > icmp6_mtudisc_lowat)
1002 return;
1003 }
1004
1005 bzero(&sin6, sizeof(sin6));
1006 sin6.sin6_family = PF_INET6;
1007 sin6.sin6_len = sizeof(struct sockaddr_in6);
1008 sin6.sin6_addr = *dst;
1009 /* XXX normally, this won't happen */
1010 if (IN6_IS_ADDR_LINKLOCAL(dst)) {
1011 sin6.sin6_addr.s6_addr16[1] = htons(m->m_pkthdr.ph_ifidx);
1012 }
1013 sin6.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.ph_ifidx,
1014 &sin6.sin6_addr);
1015
1016 rt = icmp6_mtudisc_clone(&sin6, m->m_pkthdr.ph_rtableid, 0);
1017
1018 if (rt != NULL && ISSET(rt->rt_flags, RTF_HOST) &&
1019 !(rt->rt_locks & RTV_MTU) &&
1020 (rt->rt_mtu > mtu || rt->rt_mtu == 0)) {
1021 struct ifnet *ifp;
1022
1023 ifp = if_get(rt->rt_ifidx);
1024 if (ifp != NULL && mtu < ifp->if_mtu) {
1025 icmp6stat_inc(icp6s_pmtuchg);
1026 rt->rt_mtu = mtu;
1027 }
1028 if_put(ifp);
1029 }
1030 rtfree(rt);
1031
1032 /*
1033 * Notify protocols that the MTU for this destination
1034 * has changed.
1035 */
1036 LIST_FOREACH(mc, &icmp6_mtudisc_callbacks, mc_list)
1037 (*mc->mc_func)(&sin6, m->m_pkthdr.ph_rtableid);
1038 }
1039
1040 /*
1041 * Reflect the ip6 packet back to the source.
1042 * OFF points to the icmp6 header, counted from the top of the mbuf.
1043 */
1044 int
icmp6_reflect(struct mbuf ** mp,size_t off,struct sockaddr * sa)1045 icmp6_reflect(struct mbuf **mp, size_t off, struct sockaddr *sa)
1046 {
1047 struct mbuf *m = *mp;
1048 struct rtentry *rt = NULL;
1049 struct ip6_hdr *ip6;
1050 struct icmp6_hdr *icmp6;
1051 struct in6_addr t, *src = NULL;
1052 struct sockaddr_in6 sa6_src, sa6_dst;
1053 u_int rtableid;
1054 u_int8_t pfflags;
1055
1056 CTASSERT(sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) <= MHLEN);
1057
1058 /* too short to reflect */
1059 if (off < sizeof(struct ip6_hdr)) {
1060 nd6log((LOG_DEBUG,
1061 "sanity fail: off=%lx, sizeof(ip6)=%lx in %s:%d\n",
1062 (u_long)off, (u_long)sizeof(struct ip6_hdr),
1063 __FILE__, __LINE__));
1064 goto bad;
1065 }
1066
1067 if (m->m_pkthdr.ph_loopcnt++ >= M_MAXLOOP) {
1068 m_freemp(mp);
1069 return (ELOOP);
1070 }
1071 rtableid = m->m_pkthdr.ph_rtableid;
1072 pfflags = m->m_pkthdr.pf.flags;
1073 m_resethdr(m);
1074 m->m_pkthdr.ph_rtableid = rtableid;
1075 m->m_pkthdr.pf.flags = pfflags & PF_TAG_GENERATED;
1076
1077 /*
1078 * If there are extra headers between IPv6 and ICMPv6, strip
1079 * off that header first.
1080 */
1081 if (off > sizeof(struct ip6_hdr)) {
1082 size_t l;
1083 struct ip6_hdr nip6;
1084
1085 l = off - sizeof(struct ip6_hdr);
1086 m_copydata(m, 0, sizeof(nip6), (caddr_t)&nip6);
1087 m_adj(m, l);
1088 l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
1089 if (m->m_len < l) {
1090 if ((m = *mp = m_pullup(m, l)) == NULL)
1091 return (EMSGSIZE);
1092 }
1093 memcpy(mtod(m, caddr_t), &nip6, sizeof(nip6));
1094 } else /* off == sizeof(struct ip6_hdr) */ {
1095 size_t l;
1096 l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
1097 if (m->m_len < l) {
1098 if ((m = *mp = m_pullup(m, l)) == NULL)
1099 return (EMSGSIZE);
1100 }
1101 }
1102 ip6 = mtod(m, struct ip6_hdr *);
1103 ip6->ip6_nxt = IPPROTO_ICMPV6;
1104 icmp6 = (struct icmp6_hdr *)(ip6 + 1);
1105
1106 t = ip6->ip6_dst;
1107 /*
1108 * ip6_input() drops a packet if its src is multicast.
1109 * So, the src is never multicast.
1110 */
1111 ip6->ip6_dst = ip6->ip6_src;
1112
1113 /*
1114 * XXX: make sure to embed scope zone information, using
1115 * already embedded IDs or the received interface (if any).
1116 * Note that rcvif may be NULL.
1117 * TODO: scoped routing case (XXX).
1118 */
1119 bzero(&sa6_src, sizeof(sa6_src));
1120 sa6_src.sin6_family = AF_INET6;
1121 sa6_src.sin6_len = sizeof(sa6_src);
1122 sa6_src.sin6_addr = ip6->ip6_dst;
1123 bzero(&sa6_dst, sizeof(sa6_dst));
1124 sa6_dst.sin6_family = AF_INET6;
1125 sa6_dst.sin6_len = sizeof(sa6_dst);
1126 sa6_dst.sin6_addr = t;
1127
1128 if (sa == NULL) {
1129 /*
1130 * If the incoming packet was addressed directly to us (i.e.
1131 * unicast), use dst as the src for the reply. The
1132 * IN6_IFF_TENTATIVE|IN6_IFF_DUPLICATED case would be VERY rare,
1133 * but is possible (for example) when we encounter an error
1134 * while forwarding procedure destined to a duplicated address
1135 * of ours.
1136 */
1137 rt = rtalloc(sin6tosa(&sa6_dst), 0, rtableid);
1138 if (rtisvalid(rt) && ISSET(rt->rt_flags, RTF_LOCAL) &&
1139 !ISSET(ifatoia6(rt->rt_ifa)->ia6_flags,
1140 IN6_IFF_ANYCAST|IN6_IFF_TENTATIVE|IN6_IFF_DUPLICATED)) {
1141 src = &t;
1142 }
1143 rtfree(rt);
1144 rt = NULL;
1145 sa = sin6tosa(&sa6_src);
1146 }
1147
1148 if (src == NULL) {
1149 struct in6_ifaddr *ia6;
1150
1151 /*
1152 * This case matches to multicasts, our anycast, or unicasts
1153 * that we do not own. Select a source address based on the
1154 * source address of the erroneous packet.
1155 */
1156 rt = rtalloc(sa, RT_RESOLVE, rtableid);
1157 if (!rtisvalid(rt)) {
1158 char addr[INET6_ADDRSTRLEN];
1159
1160 nd6log((LOG_DEBUG,
1161 "%s: source can't be determined: dst=%s\n",
1162 __func__, inet_ntop(AF_INET6, &sa6_src.sin6_addr,
1163 addr, sizeof(addr))));
1164 rtfree(rt);
1165 goto bad;
1166 }
1167 ia6 = in6_ifawithscope(rt->rt_ifa->ifa_ifp, &t, rtableid, rt);
1168 if (ia6 != NULL)
1169 src = &ia6->ia_addr.sin6_addr;
1170 if (src == NULL)
1171 src = &ifatoia6(rt->rt_ifa)->ia_addr.sin6_addr;
1172 }
1173
1174 ip6->ip6_src = *src;
1175 rtfree(rt);
1176
1177 ip6->ip6_flow = 0;
1178 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
1179 ip6->ip6_vfc |= IPV6_VERSION;
1180 ip6->ip6_nxt = IPPROTO_ICMPV6;
1181 ip6->ip6_hlim = ip6_defhlim;
1182
1183 icmp6->icmp6_cksum = 0;
1184 m->m_pkthdr.csum_flags = M_ICMP_CSUM_OUT;
1185
1186 /*
1187 * XXX option handling
1188 */
1189
1190 m->m_flags &= ~(M_BCAST|M_MCAST);
1191 return (0);
1192
1193 bad:
1194 m_freemp(mp);
1195 return (EHOSTUNREACH);
1196 }
1197
1198 void
icmp6_fasttimo(void)1199 icmp6_fasttimo(void)
1200 {
1201
1202 mld6_fasttimeo();
1203 }
1204
1205 const char *
icmp6_redirect_diag(struct in6_addr * src6,struct in6_addr * dst6,struct in6_addr * tgt6)1206 icmp6_redirect_diag(struct in6_addr *src6, struct in6_addr *dst6,
1207 struct in6_addr *tgt6)
1208 {
1209 static char buf[1024]; /* XXX */
1210 char src[INET6_ADDRSTRLEN];
1211 char dst[INET6_ADDRSTRLEN];
1212 char tgt[INET6_ADDRSTRLEN];
1213
1214 snprintf(buf, sizeof(buf), "(src=%s dst=%s tgt=%s)",
1215 inet_ntop(AF_INET6, src6, src, sizeof(src)),
1216 inet_ntop(AF_INET6, dst6, dst, sizeof(dst)),
1217 inet_ntop(AF_INET6, tgt6, tgt, sizeof(tgt)));
1218 return buf;
1219 }
1220
1221 void
icmp6_redirect_input(struct mbuf * m,int off)1222 icmp6_redirect_input(struct mbuf *m, int off)
1223 {
1224 struct ifnet *ifp;
1225 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1226 struct nd_redirect *nd_rd;
1227 int icmp6len = ntohs(ip6->ip6_plen);
1228 char *lladdr = NULL;
1229 int lladdrlen = 0;
1230 struct rtentry *rt = NULL;
1231 int is_router;
1232 int is_onlink;
1233 struct in6_addr src6 = ip6->ip6_src;
1234 struct in6_addr redtgt6;
1235 struct in6_addr reddst6;
1236 struct nd_opts ndopts;
1237 char addr[INET6_ADDRSTRLEN];
1238
1239 ifp = if_get(m->m_pkthdr.ph_ifidx);
1240 if (ifp == NULL)
1241 return;
1242
1243 /* XXX if we are router, we don't update route by icmp6 redirect */
1244 if (ip6_forwarding)
1245 goto freeit;
1246 if (!(ifp->if_xflags & IFXF_AUTOCONF6))
1247 goto freeit;
1248
1249 IP6_EXTHDR_GET(nd_rd, struct nd_redirect *, m, off, icmp6len);
1250 if (nd_rd == NULL) {
1251 icmp6stat_inc(icp6s_tooshort);
1252 if_put(ifp);
1253 return;
1254 }
1255 redtgt6 = nd_rd->nd_rd_target;
1256 reddst6 = nd_rd->nd_rd_dst;
1257
1258 if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
1259 redtgt6.s6_addr16[1] = htons(ifp->if_index);
1260 if (IN6_IS_ADDR_LINKLOCAL(&reddst6))
1261 reddst6.s6_addr16[1] = htons(ifp->if_index);
1262
1263 /* validation */
1264 if (!IN6_IS_ADDR_LINKLOCAL(&src6)) {
1265 nd6log((LOG_ERR,
1266 "ICMP6 redirect sent from %s rejected; "
1267 "must be from linklocal\n",
1268 inet_ntop(AF_INET6, &src6, addr, sizeof(addr))));
1269 goto bad;
1270 }
1271 if (ip6->ip6_hlim != 255) {
1272 nd6log((LOG_ERR,
1273 "ICMP6 redirect sent from %s rejected; "
1274 "hlim=%d (must be 255)\n",
1275 inet_ntop(AF_INET6, &src6, addr, sizeof(addr)),
1276 ip6->ip6_hlim));
1277 goto bad;
1278 }
1279 if (IN6_IS_ADDR_MULTICAST(&reddst6)) {
1280 nd6log((LOG_ERR,
1281 "ICMP6 redirect rejected; "
1282 "redirect dst must be unicast: %s\n",
1283 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1284 goto bad;
1285 }
1286 {
1287 /* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */
1288 struct sockaddr_in6 sin6;
1289 struct in6_addr *gw6;
1290
1291 bzero(&sin6, sizeof(sin6));
1292 sin6.sin6_family = AF_INET6;
1293 sin6.sin6_len = sizeof(struct sockaddr_in6);
1294 memcpy(&sin6.sin6_addr, &reddst6, sizeof(reddst6));
1295 rt = rtalloc(sin6tosa(&sin6), 0, m->m_pkthdr.ph_rtableid);
1296 if (rt) {
1297 if (rt->rt_gateway == NULL ||
1298 rt->rt_gateway->sa_family != AF_INET6) {
1299 nd6log((LOG_ERR,
1300 "ICMP6 redirect rejected; no route "
1301 "with inet6 gateway found for redirect dst: %s\n",
1302 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1303 rtfree(rt);
1304 goto bad;
1305 }
1306
1307 gw6 = &(satosin6(rt->rt_gateway)->sin6_addr);
1308 if (bcmp(&src6, gw6, sizeof(struct in6_addr)) != 0) {
1309 nd6log((LOG_ERR,
1310 "ICMP6 redirect rejected; "
1311 "not equal to gw-for-src=%s (must be same): "
1312 "%s\n",
1313 inet_ntop(AF_INET6, gw6, addr, sizeof(addr)),
1314 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1315 rtfree(rt);
1316 goto bad;
1317 }
1318 } else {
1319 nd6log((LOG_ERR,
1320 "ICMP6 redirect rejected; "
1321 "no route found for redirect dst: %s\n",
1322 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1323 goto bad;
1324 }
1325 rtfree(rt);
1326 rt = NULL;
1327 }
1328
1329 is_router = is_onlink = 0;
1330 if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
1331 is_router = 1; /* router case */
1332 if (bcmp(&redtgt6, &reddst6, sizeof(redtgt6)) == 0)
1333 is_onlink = 1; /* on-link destination case */
1334 if (!is_router && !is_onlink) {
1335 nd6log((LOG_ERR,
1336 "ICMP6 redirect rejected; "
1337 "neither router case nor onlink case: %s\n",
1338 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1339 goto bad;
1340 }
1341 /* validation passed */
1342
1343 icmp6len -= sizeof(*nd_rd);
1344 if (nd6_options(nd_rd + 1, icmp6len, &ndopts) < 0) {
1345 nd6log((LOG_INFO, "icmp6_redirect_input: "
1346 "invalid ND option, rejected: %s\n",
1347 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1348 /* nd6_options have incremented stats */
1349 goto freeit;
1350 }
1351
1352 if (ndopts.nd_opts_tgt_lladdr) {
1353 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1);
1354 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
1355 }
1356
1357 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
1358 nd6log((LOG_INFO,
1359 "icmp6_redirect_input: lladdrlen mismatch for %s "
1360 "(if %d, icmp6 packet %d): %s\n",
1361 inet_ntop(AF_INET6, &redtgt6, addr, sizeof(addr)),
1362 ifp->if_addrlen, lladdrlen - 2,
1363 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1364 goto bad;
1365 }
1366
1367 /* RFC 2461 8.3 */
1368 nd6_cache_lladdr(ifp, &redtgt6, lladdr, lladdrlen, ND_REDIRECT,
1369 is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER);
1370
1371 if (!is_onlink) { /* better router case. perform rtredirect. */
1372 /* perform rtredirect */
1373 struct sockaddr_in6 sdst;
1374 struct sockaddr_in6 sgw;
1375 struct sockaddr_in6 ssrc;
1376 unsigned long rtcount;
1377 struct rtentry *newrt = NULL;
1378
1379 /*
1380 * do not install redirect route, if the number of entries
1381 * is too much (> hiwat). note that, the node (= host) will
1382 * work just fine even if we do not install redirect route
1383 * (there will be additional hops, though).
1384 */
1385 rtcount = rt_timer_queue_count(&icmp6_redirect_timeout_q);
1386 if (0 <= ip6_maxdynroutes && rtcount >= ip6_maxdynroutes)
1387 goto freeit;
1388
1389 bzero(&sdst, sizeof(sdst));
1390 bzero(&sgw, sizeof(sgw));
1391 bzero(&ssrc, sizeof(ssrc));
1392 sdst.sin6_family = sgw.sin6_family = ssrc.sin6_family = AF_INET6;
1393 sdst.sin6_len = sgw.sin6_len = ssrc.sin6_len =
1394 sizeof(struct sockaddr_in6);
1395 memcpy(&sgw.sin6_addr, &redtgt6, sizeof(struct in6_addr));
1396 memcpy(&sdst.sin6_addr, &reddst6, sizeof(struct in6_addr));
1397 memcpy(&ssrc.sin6_addr, &src6, sizeof(struct in6_addr));
1398 rtredirect(sin6tosa(&sdst), sin6tosa(&sgw), sin6tosa(&ssrc),
1399 &newrt, m->m_pkthdr.ph_rtableid);
1400 if (newrt != NULL && icmp6_redirtimeout > 0) {
1401 rt_timer_add(newrt, &icmp6_redirect_timeout_q,
1402 m->m_pkthdr.ph_rtableid);
1403 }
1404 rtfree(newrt);
1405 }
1406 /* finally update cached route in each socket via pfctlinput */
1407 {
1408 struct sockaddr_in6 sdst;
1409
1410 bzero(&sdst, sizeof(sdst));
1411 sdst.sin6_family = AF_INET6;
1412 sdst.sin6_len = sizeof(struct sockaddr_in6);
1413 memcpy(&sdst.sin6_addr, &reddst6, sizeof(struct in6_addr));
1414 pfctlinput(PRC_REDIRECT_HOST, sin6tosa(&sdst));
1415 }
1416
1417 freeit:
1418 if_put(ifp);
1419 m_freem(m);
1420 return;
1421
1422 bad:
1423 if_put(ifp);
1424 icmp6stat_inc(icp6s_badredirect);
1425 m_freem(m);
1426 }
1427
1428 void
icmp6_redirect_output(struct mbuf * m0,struct rtentry * rt)1429 icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
1430 {
1431 struct ifnet *ifp = NULL;
1432 struct in6_addr *ifp_ll6;
1433 struct in6_addr *nexthop;
1434 struct ip6_hdr *sip6; /* m0 as struct ip6_hdr */
1435 struct mbuf *m = NULL; /* newly allocated one */
1436 struct ip6_hdr *ip6; /* m as struct ip6_hdr */
1437 struct nd_redirect *nd_rd;
1438 size_t maxlen;
1439 u_char *p;
1440 struct sockaddr_in6 src_sa;
1441
1442 icmp6_errcount(ND_REDIRECT, 0);
1443
1444 /* if we are not router, we don't send icmp6 redirect */
1445 if (!ip6_forwarding)
1446 goto fail;
1447
1448 /* sanity check */
1449 if (m0 == NULL || !rtisvalid(rt))
1450 goto fail;
1451
1452 ifp = if_get(rt->rt_ifidx);
1453 if (ifp == NULL)
1454 goto fail;
1455
1456 /*
1457 * Address check:
1458 * the source address must identify a neighbor, and
1459 * the destination address must not be a multicast address
1460 * [RFC 2461, sec 8.2]
1461 */
1462 sip6 = mtod(m0, struct ip6_hdr *);
1463 bzero(&src_sa, sizeof(src_sa));
1464 src_sa.sin6_family = AF_INET6;
1465 src_sa.sin6_len = sizeof(src_sa);
1466 src_sa.sin6_addr = sip6->ip6_src;
1467 /* we don't currently use sin6_scope_id, but eventually use it */
1468 src_sa.sin6_scope_id = in6_addr2scopeid(ifp->if_index, &sip6->ip6_src);
1469 if (nd6_is_addr_neighbor(&src_sa, ifp) == 0)
1470 goto fail;
1471 if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst))
1472 goto fail; /* what should we do here? */
1473
1474 /* rate limit */
1475 if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0))
1476 goto fail;
1477
1478 /*
1479 * Since we are going to append up to 1280 bytes (= IPV6_MMTU),
1480 * we almost always ask for an mbuf cluster for simplicity.
1481 * (MHLEN < IPV6_MMTU is almost always true)
1482 */
1483 #if IPV6_MMTU >= MCLBYTES
1484 # error assumption failed about IPV6_MMTU and MCLBYTES
1485 #endif
1486 MGETHDR(m, M_DONTWAIT, MT_HEADER);
1487 if (m && IPV6_MMTU >= MHLEN)
1488 MCLGET(m, M_DONTWAIT);
1489 if (!m)
1490 goto fail;
1491 m->m_pkthdr.ph_ifidx = 0;
1492 m->m_len = 0;
1493 maxlen = m_trailingspace(m);
1494 maxlen = min(IPV6_MMTU, maxlen);
1495 /* just for safety */
1496 if (maxlen < sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) +
1497 ((sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7)) {
1498 goto fail;
1499 }
1500
1501 {
1502 /* get ip6 linklocal address for ifp(my outgoing interface). */
1503 struct in6_ifaddr *ia6;
1504 if ((ia6 = in6ifa_ifpforlinklocal(ifp, IN6_IFF_TENTATIVE|
1505 IN6_IFF_DUPLICATED|IN6_IFF_ANYCAST)) == NULL)
1506 goto fail;
1507 ifp_ll6 = &ia6->ia_addr.sin6_addr;
1508 }
1509
1510 /* get ip6 linklocal address for the router. */
1511 if (rt->rt_gateway && (rt->rt_flags & RTF_GATEWAY)) {
1512 struct sockaddr_in6 *sin6;
1513 sin6 = satosin6(rt->rt_gateway);
1514 nexthop = &sin6->sin6_addr;
1515 if (!IN6_IS_ADDR_LINKLOCAL(nexthop))
1516 nexthop = NULL;
1517 } else
1518 nexthop = NULL;
1519
1520 /* ip6 */
1521 ip6 = mtod(m, struct ip6_hdr *);
1522 ip6->ip6_flow = 0;
1523 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
1524 ip6->ip6_vfc |= IPV6_VERSION;
1525 /* ip6->ip6_plen will be set later */
1526 ip6->ip6_nxt = IPPROTO_ICMPV6;
1527 ip6->ip6_hlim = 255;
1528 /* ip6->ip6_src must be linklocal addr for my outgoing if. */
1529 bcopy(ifp_ll6, &ip6->ip6_src, sizeof(struct in6_addr));
1530 bcopy(&sip6->ip6_src, &ip6->ip6_dst, sizeof(struct in6_addr));
1531
1532 /* ND Redirect */
1533 nd_rd = (struct nd_redirect *)(ip6 + 1);
1534 nd_rd->nd_rd_type = ND_REDIRECT;
1535 nd_rd->nd_rd_code = 0;
1536 nd_rd->nd_rd_reserved = 0;
1537 if (rt->rt_flags & RTF_GATEWAY) {
1538 /*
1539 * nd_rd->nd_rd_target must be a link-local address in
1540 * better router cases.
1541 */
1542 if (!nexthop)
1543 goto fail;
1544 bcopy(nexthop, &nd_rd->nd_rd_target,
1545 sizeof(nd_rd->nd_rd_target));
1546 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
1547 sizeof(nd_rd->nd_rd_dst));
1548 } else {
1549 /* make sure redtgt == reddst */
1550 nexthop = &sip6->ip6_dst;
1551 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_target,
1552 sizeof(nd_rd->nd_rd_target));
1553 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
1554 sizeof(nd_rd->nd_rd_dst));
1555 }
1556
1557 p = (u_char *)(nd_rd + 1);
1558
1559 {
1560 /* target lladdr option */
1561 struct rtentry *nrt;
1562 int len;
1563 struct sockaddr_dl *sdl;
1564 struct nd_opt_hdr *nd_opt;
1565 char *lladdr;
1566
1567 len = sizeof(*nd_opt) + ifp->if_addrlen;
1568 len = (len + 7) & ~7; /* round by 8 */
1569 /* safety check */
1570 if (len + (p - (u_char *)ip6) > maxlen)
1571 goto nolladdropt;
1572 nrt = nd6_lookup(nexthop, 0, ifp, ifp->if_rdomain);
1573 if ((nrt != NULL) &&
1574 (nrt->rt_flags & (RTF_GATEWAY|RTF_LLINFO)) == RTF_LLINFO &&
1575 (nrt->rt_gateway->sa_family == AF_LINK) &&
1576 (sdl = satosdl(nrt->rt_gateway)) &&
1577 sdl->sdl_alen) {
1578 nd_opt = (struct nd_opt_hdr *)p;
1579 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
1580 nd_opt->nd_opt_len = len >> 3;
1581 lladdr = (char *)(nd_opt + 1);
1582 bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen);
1583 p += len;
1584 }
1585 rtfree(nrt);
1586 }
1587 nolladdropt:;
1588
1589 m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
1590
1591 /* just to be safe */
1592 if (p - (u_char *)ip6 > maxlen)
1593 goto noredhdropt;
1594
1595 {
1596 /* redirected header option */
1597 int len;
1598 struct nd_opt_rd_hdr *nd_opt_rh;
1599
1600 /*
1601 * compute the maximum size for icmp6 redirect header option.
1602 * XXX room for auth header?
1603 */
1604 len = maxlen - (p - (u_char *)ip6);
1605 len &= ~7;
1606
1607 /*
1608 * Redirected header option spec (RFC2461 4.6.3) talks nothing
1609 * about padding/truncate rule for the original IP packet.
1610 * From the discussion on IPv6imp in Feb 1999,
1611 * the consensus was:
1612 * - "attach as much as possible" is the goal
1613 * - pad if not aligned (original size can be guessed by
1614 * original ip6 header)
1615 * Following code adds the padding if it is simple enough,
1616 * and truncates if not.
1617 */
1618 if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) {
1619 /* not enough room, truncate */
1620 m_adj(m0, (len - sizeof(*nd_opt_rh)) -
1621 m0->m_pkthdr.len);
1622 } else {
1623 /*
1624 * enough room, truncate if not aligned.
1625 * we don't pad here for simplicity.
1626 */
1627 size_t extra;
1628
1629 extra = m0->m_pkthdr.len % 8;
1630 if (extra) {
1631 /* truncate */
1632 m_adj(m0, -extra);
1633 }
1634 len = m0->m_pkthdr.len + sizeof(*nd_opt_rh);
1635 }
1636
1637 nd_opt_rh = (struct nd_opt_rd_hdr *)p;
1638 bzero(nd_opt_rh, sizeof(*nd_opt_rh));
1639 nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER;
1640 nd_opt_rh->nd_opt_rh_len = len >> 3;
1641 p += sizeof(*nd_opt_rh);
1642 m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
1643
1644 /* connect m0 to m */
1645 m->m_pkthdr.len += m0->m_pkthdr.len;
1646 m_cat(m, m0);
1647 m0 = NULL;
1648 }
1649 noredhdropt:
1650 m_freem(m0);
1651 m0 = NULL;
1652
1653 sip6 = mtod(m, struct ip6_hdr *);
1654 if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_src))
1655 sip6->ip6_src.s6_addr16[1] = 0;
1656 if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_dst))
1657 sip6->ip6_dst.s6_addr16[1] = 0;
1658 #if 0
1659 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src))
1660 ip6->ip6_src.s6_addr16[1] = 0;
1661 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst))
1662 ip6->ip6_dst.s6_addr16[1] = 0;
1663 #endif
1664 if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_target))
1665 nd_rd->nd_rd_target.s6_addr16[1] = 0;
1666 if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_dst))
1667 nd_rd->nd_rd_dst.s6_addr16[1] = 0;
1668
1669 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
1670
1671 nd_rd->nd_rd_cksum = 0;
1672 m->m_pkthdr.csum_flags = M_ICMP_CSUM_OUT;
1673
1674 /* send the packet to outside... */
1675 ip6_output(m, NULL, NULL, 0, NULL, NULL);
1676
1677 icmp6stat_inc(icp6s_outhist + ND_REDIRECT);
1678
1679 if_put(ifp);
1680 return;
1681
1682 fail:
1683 if_put(ifp);
1684 m_freem(m);
1685 m_freem(m0);
1686 }
1687
1688 /*
1689 * ICMPv6 socket option processing.
1690 */
1691 int
icmp6_ctloutput(int op,struct socket * so,int level,int optname,struct mbuf * m)1692 icmp6_ctloutput(int op, struct socket *so, int level, int optname,
1693 struct mbuf *m)
1694 {
1695 int error = 0;
1696 struct inpcb *inp = sotoinpcb(so);
1697
1698 if (level != IPPROTO_ICMPV6)
1699 return EINVAL;
1700
1701 switch (op) {
1702 case PRCO_SETOPT:
1703 switch (optname) {
1704 case ICMP6_FILTER:
1705 {
1706 struct icmp6_filter *p;
1707
1708 if (m == NULL || m->m_len != sizeof(*p)) {
1709 error = EMSGSIZE;
1710 break;
1711 }
1712 p = mtod(m, struct icmp6_filter *);
1713 if (!p || !inp->inp_icmp6filt) {
1714 error = EINVAL;
1715 break;
1716 }
1717 bcopy(p, inp->inp_icmp6filt,
1718 sizeof(struct icmp6_filter));
1719 error = 0;
1720 break;
1721 }
1722
1723 default:
1724 error = ENOPROTOOPT;
1725 break;
1726 }
1727 break;
1728
1729 case PRCO_GETOPT:
1730 switch (optname) {
1731 case ICMP6_FILTER:
1732 {
1733 struct icmp6_filter *p;
1734
1735 if (!inp->inp_icmp6filt) {
1736 error = EINVAL;
1737 break;
1738 }
1739 m->m_len = sizeof(struct icmp6_filter);
1740 p = mtod(m, struct icmp6_filter *);
1741 bcopy(inp->inp_icmp6filt, p,
1742 sizeof(struct icmp6_filter));
1743 error = 0;
1744 break;
1745 }
1746
1747 default:
1748 error = ENOPROTOOPT;
1749 break;
1750 }
1751 break;
1752 }
1753
1754 return (error);
1755 }
1756
1757 /*
1758 * Perform rate limit check.
1759 * Returns 0 if it is okay to send the icmp6 packet.
1760 * Returns 1 if the router SHOULD NOT send this icmp6 packet due to rate
1761 * limitation.
1762 *
1763 * XXX per-destination/type check necessary?
1764 *
1765 * dst - not used at this moment
1766 * type - not used at this moment
1767 * code - not used at this moment
1768 */
1769 int
icmp6_ratelimit(const struct in6_addr * dst,const int type,const int code)1770 icmp6_ratelimit(const struct in6_addr *dst, const int type, const int code)
1771 {
1772 /* PPS limit */
1773 if (!ppsratecheck(&icmp6errppslim_last, &icmp6errpps_count,
1774 icmp6errppslim))
1775 return 1; /* The packet is subject to rate limit */
1776 return 0; /* okay to send */
1777 }
1778
1779 struct rtentry *
icmp6_mtudisc_clone(struct sockaddr_in6 * dst,u_int rtableid,int ipsec)1780 icmp6_mtudisc_clone(struct sockaddr_in6 *dst, u_int rtableid, int ipsec)
1781 {
1782 struct rtentry *rt;
1783 int error;
1784
1785 rt = rtalloc(sin6tosa(dst), RT_RESOLVE, rtableid);
1786
1787 /* Check if the route is actually usable */
1788 if (!rtisvalid(rt))
1789 goto bad;
1790 /* IPsec needs the route only for PMTU, it can use reject for that */
1791 if (!ipsec && (rt->rt_flags & (RTF_REJECT|RTF_BLACKHOLE)))
1792 goto bad;
1793
1794 /*
1795 * No PMTU for local routes and permanent neighbors,
1796 * ARP and NDP use the same expire timer as the route.
1797 */
1798 if (ISSET(rt->rt_flags, RTF_LOCAL) ||
1799 (ISSET(rt->rt_flags, RTF_LLINFO) && rt->rt_expire == 0))
1800 goto bad;
1801
1802 /* If we didn't get a host route, allocate one */
1803 if ((rt->rt_flags & RTF_HOST) == 0) {
1804 struct rtentry *nrt;
1805 struct rt_addrinfo info;
1806 struct sockaddr_rtlabel sa_rl;
1807
1808 memset(&info, 0, sizeof(info));
1809 info.rti_ifa = rt->rt_ifa;
1810 info.rti_flags = RTF_GATEWAY | RTF_HOST | RTF_DYNAMIC;
1811 info.rti_info[RTAX_DST] = sin6tosa(dst);
1812 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1813 info.rti_info[RTAX_LABEL] =
1814 rtlabel_id2sa(rt->rt_labelid, &sa_rl);
1815
1816 error = rtrequest(RTM_ADD, &info, rt->rt_priority, &nrt,
1817 rtableid);
1818 if (error)
1819 goto bad;
1820 nrt->rt_rmx = rt->rt_rmx;
1821 rtfree(rt);
1822 rt = nrt;
1823 rtm_send(rt, RTM_ADD, 0, rtableid);
1824 }
1825 error = rt_timer_add(rt, &icmp6_mtudisc_timeout_q, rtableid);
1826 if (error)
1827 goto bad;
1828
1829 return (rt);
1830 bad:
1831 rtfree(rt);
1832 return (NULL);
1833 }
1834
1835 void
icmp6_mtudisc_timeout(struct rtentry * rt,u_int rtableid)1836 icmp6_mtudisc_timeout(struct rtentry *rt, u_int rtableid)
1837 {
1838 struct ifnet *ifp;
1839
1840 NET_ASSERT_LOCKED();
1841
1842 ifp = if_get(rt->rt_ifidx);
1843 if (ifp == NULL)
1844 return;
1845
1846 if ((rt->rt_flags & (RTF_DYNAMIC|RTF_HOST)) == (RTF_DYNAMIC|RTF_HOST)) {
1847 rtdeletemsg(rt, ifp, rtableid);
1848 } else {
1849 if (!(rt->rt_locks & RTV_MTU))
1850 rt->rt_mtu = 0;
1851 }
1852
1853 if_put(ifp);
1854 }
1855
1856 const struct sysctl_bounded_args icmpv6ctl_vars[] = {
1857 { ICMPV6CTL_ND6_DELAY, &nd6_delay, 0, INT_MAX },
1858 { ICMPV6CTL_ND6_UMAXTRIES, &nd6_umaxtries, 0, INT_MAX },
1859 { ICMPV6CTL_ND6_MMAXTRIES, &nd6_mmaxtries, 0, INT_MAX },
1860 { ICMPV6CTL_ERRPPSLIMIT, &icmp6errppslim, -1, 1000 },
1861 { ICMPV6CTL_ND6_MAXNUDHINT, &nd6_maxnudhint, 0, INT_MAX },
1862 { ICMPV6CTL_MTUDISC_HIWAT, &icmp6_mtudisc_hiwat, -1, INT_MAX },
1863 { ICMPV6CTL_MTUDISC_LOWAT, &icmp6_mtudisc_lowat, -1, INT_MAX },
1864 { ICMPV6CTL_ND6_DEBUG, &nd6_debug, 0, 1 },
1865 };
1866
1867 int
icmp6_sysctl_icmp6stat(void * oldp,size_t * oldlenp,void * newp)1868 icmp6_sysctl_icmp6stat(void *oldp, size_t *oldlenp, void *newp)
1869 {
1870 struct icmp6stat *icmp6stat;
1871 int ret;
1872
1873 CTASSERT(sizeof(*icmp6stat) == icp6s_ncounters * sizeof(uint64_t));
1874 icmp6stat = malloc(sizeof(*icmp6stat), M_TEMP, M_WAITOK|M_ZERO);
1875 counters_read(icmp6counters, (uint64_t *)icmp6stat, icp6s_ncounters,
1876 NULL);
1877 ret = sysctl_rdstruct(oldp, oldlenp, newp,
1878 icmp6stat, sizeof(*icmp6stat));
1879 free(icmp6stat, M_TEMP, sizeof(*icmp6stat));
1880
1881 return (ret);
1882 }
1883
1884 int
icmp6_sysctl(int * name,u_int namelen,void * oldp,size_t * oldlenp,void * newp,size_t newlen)1885 icmp6_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp,
1886 void *newp, size_t newlen)
1887 {
1888 int error;
1889
1890 /* All sysctl names at this level are terminal. */
1891 if (namelen != 1)
1892 return (ENOTDIR);
1893
1894 switch (name[0]) {
1895 case ICMPV6CTL_REDIRTIMEOUT:
1896 NET_LOCK();
1897 error = sysctl_int_bounded(oldp, oldlenp, newp, newlen,
1898 &icmp6_redirtimeout, 0, INT_MAX);
1899 rt_timer_queue_change(&icmp6_redirect_timeout_q,
1900 icmp6_redirtimeout);
1901 NET_UNLOCK();
1902 break;
1903
1904 case ICMPV6CTL_STATS:
1905 error = icmp6_sysctl_icmp6stat(oldp, oldlenp, newp);
1906 break;
1907
1908 case ICMPV6CTL_ND6_QUEUED:
1909 error = sysctl_rdint(oldp, oldlenp, newp,
1910 atomic_load_int(&ln_hold_total));
1911 break;
1912
1913 default:
1914 NET_LOCK();
1915 error = sysctl_bounded_arr(icmpv6ctl_vars,
1916 nitems(icmpv6ctl_vars), name, namelen, oldp, oldlenp, newp,
1917 newlen);
1918 NET_UNLOCK();
1919 break;
1920 }
1921
1922 return (error);
1923 }
1924