1 /* $OpenBSD: ip6_input.c,v 1.262 2024/05/08 13:01:30 bluhm Exp $ */
2 /* $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $ */
3
4 /*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 /*
34 * Copyright (c) 1982, 1986, 1988, 1993
35 * The Regents of the University of California. All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. Neither the name of the University nor the names of its contributors
46 * may be used to endorse or promote products derived from this software
47 * without specific prior written permission.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59 * SUCH DAMAGE.
60 *
61 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94
62 */
63
64 #include "pf.h"
65 #include "carp.h"
66
67 #include <sys/param.h>
68 #include <sys/systm.h>
69 #include <sys/mbuf.h>
70 #include <sys/domain.h>
71 #include <sys/sysctl.h>
72 #include <sys/protosw.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <sys/errno.h>
76 #include <sys/time.h>
77 #include <sys/timeout.h>
78 #include <sys/kernel.h>
79 #include <sys/syslog.h>
80 #include <sys/task.h>
81
82 #include <net/if.h>
83 #include <net/if_var.h>
84 #include <net/if_types.h>
85 #include <net/route.h>
86 #include <net/netisr.h>
87
88 #include <netinet/in.h>
89
90 #include <netinet/ip.h>
91
92 #include <netinet/in_pcb.h>
93 #include <netinet/ip_var.h>
94 #include <netinet6/in6_var.h>
95 #include <netinet6/in6_ifattach.h>
96 #include <netinet/ip6.h>
97 #include <netinet6/ip6_var.h>
98 #include <netinet/icmp6.h>
99 #include <netinet6/nd6.h>
100
101 #include "gif.h"
102 #include "bpfilter.h"
103
104 #ifdef MROUTING
105 #include <netinet6/ip6_mroute.h>
106 #endif
107
108 #if NPF > 0
109 #include <net/pfvar.h>
110 #endif
111
112 #if NCARP > 0
113 #include <netinet/ip_carp.h>
114 #endif
115
116 struct niqueue ip6intrq = NIQUEUE_INITIALIZER(IPQ_MAXLEN, NETISR_IPV6);
117
118 struct cpumem *ip6counters;
119
120 uint8_t ip6_soiikey[IP6_SOIIKEY_LEN];
121
122 int ip6_ours(struct mbuf **, int *, int, int);
123 int ip6_check_rh0hdr(struct mbuf *, int *);
124 int ip6_hbhchcheck(struct mbuf **, int *, int *);
125 int ip6_hopopts_input(struct mbuf **, int *, u_int32_t *, u_int32_t *);
126 struct mbuf *ip6_pullexthdr(struct mbuf *, size_t, int);
127 int ip6_sysctl_soiikey(void *, size_t *, void *, size_t);
128
129 static struct mbuf_queue ip6send_mq;
130
131 static void ip6_send_dispatch(void *);
132 static struct task ip6send_task =
133 TASK_INITIALIZER(ip6_send_dispatch, &ip6send_mq);
134
135 /*
136 * IP6 initialization: fill in IP6 protocol switch table.
137 * All protocols not implemented in kernel go to raw IP6 protocol handler.
138 */
139 void
ip6_init(void)140 ip6_init(void)
141 {
142 const struct protosw *pr;
143 int i;
144
145 pr = pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW);
146 if (pr == NULL)
147 panic("%s", __func__);
148 for (i = 0; i < IPPROTO_MAX; i++)
149 ip6_protox[i] = pr - inet6sw;
150 for (pr = inet6domain.dom_protosw;
151 pr < inet6domain.dom_protoswNPROTOSW; pr++)
152 if (pr->pr_domain->dom_family == PF_INET6 &&
153 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW &&
154 pr->pr_protocol < IPPROTO_MAX)
155 ip6_protox[pr->pr_protocol] = pr - inet6sw;
156 ip6_randomid_init();
157 nd6_init();
158 frag6_init();
159
160 mq_init(&ip6send_mq, 64, IPL_SOFTNET);
161
162 ip6counters = counters_alloc(ip6s_ncounters);
163 #ifdef MROUTING
164 rt_timer_queue_init(&ip6_mrouterq, MCAST_EXPIRE_TIMEOUT,
165 &mf6c_expire_route);
166 #endif
167 }
168
169 /*
170 * Enqueue packet for local delivery. Queuing is used as a boundary
171 * between the network layer (input/forward path) running with
172 * NET_LOCK_SHARED() and the transport layer needing it exclusively.
173 */
174 int
ip6_ours(struct mbuf ** mp,int * offp,int nxt,int af)175 ip6_ours(struct mbuf **mp, int *offp, int nxt, int af)
176 {
177 /* ip6_hbhchcheck() may be run before, then off and nxt are set */
178 if (*offp == 0) {
179 nxt = ip6_hbhchcheck(mp, offp, NULL);
180 if (nxt == IPPROTO_DONE)
181 return IPPROTO_DONE;
182 }
183
184 /* We are already in a IPv4/IPv6 local deliver loop. */
185 if (af != AF_UNSPEC)
186 return nxt;
187
188 nxt = ip_deliver(mp, offp, nxt, AF_INET6, 1);
189 if (nxt == IPPROTO_DONE)
190 return IPPROTO_DONE;
191
192 /* save values for later, use after dequeue */
193 if (*offp != sizeof(struct ip6_hdr)) {
194 struct m_tag *mtag;
195 struct ipoffnxt *ion;
196
197 /* mbuf tags are expensive, but only used for header options */
198 mtag = m_tag_get(PACKET_TAG_IP6_OFFNXT, sizeof(*ion),
199 M_NOWAIT);
200 if (mtag == NULL) {
201 ip6stat_inc(ip6s_idropped);
202 m_freemp(mp);
203 return IPPROTO_DONE;
204 }
205 ion = (struct ipoffnxt *)(mtag + 1);
206 ion->ion_off = *offp;
207 ion->ion_nxt = nxt;
208
209 m_tag_prepend(*mp, mtag);
210 }
211
212 niq_enqueue(&ip6intrq, *mp);
213 *mp = NULL;
214 return IPPROTO_DONE;
215 }
216
217 /*
218 * Dequeue and process locally delivered packets.
219 * This is called with exclusive NET_LOCK().
220 */
221 void
ip6intr(void)222 ip6intr(void)
223 {
224 struct mbuf *m;
225
226 while ((m = niq_dequeue(&ip6intrq)) != NULL) {
227 struct m_tag *mtag;
228 int off, nxt;
229
230 #ifdef DIAGNOSTIC
231 if ((m->m_flags & M_PKTHDR) == 0)
232 panic("ip6intr no HDR");
233 #endif
234 mtag = m_tag_find(m, PACKET_TAG_IP6_OFFNXT, NULL);
235 if (mtag != NULL) {
236 struct ipoffnxt *ion;
237
238 ion = (struct ipoffnxt *)(mtag + 1);
239 off = ion->ion_off;
240 nxt = ion->ion_nxt;
241
242 m_tag_delete(m, mtag);
243 } else {
244 struct ip6_hdr *ip6;
245
246 ip6 = mtod(m, struct ip6_hdr *);
247 off = sizeof(struct ip6_hdr);
248 nxt = ip6->ip6_nxt;
249 }
250 nxt = ip_deliver(&m, &off, nxt, AF_INET6, 0);
251 KASSERT(nxt == IPPROTO_DONE);
252 }
253 }
254
255 void
ipv6_input(struct ifnet * ifp,struct mbuf * m)256 ipv6_input(struct ifnet *ifp, struct mbuf *m)
257 {
258 int off, nxt;
259
260 off = 0;
261 nxt = ip6_input_if(&m, &off, IPPROTO_IPV6, AF_UNSPEC, ifp);
262 KASSERT(nxt == IPPROTO_DONE);
263 }
264
265 struct mbuf *
ipv6_check(struct ifnet * ifp,struct mbuf * m)266 ipv6_check(struct ifnet *ifp, struct mbuf *m)
267 {
268 struct ip6_hdr *ip6;
269
270 if (m->m_len < sizeof(*ip6)) {
271 m = m_pullup(m, sizeof(*ip6));
272 if (m == NULL) {
273 ip6stat_inc(ip6s_toosmall);
274 return (NULL);
275 }
276 }
277
278 ip6 = mtod(m, struct ip6_hdr *);
279
280 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
281 ip6stat_inc(ip6s_badvers);
282 goto bad;
283 }
284
285 /*
286 * Check against address spoofing/corruption.
287 */
288 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) ||
289 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) {
290 /*
291 * XXX: "badscope" is not very suitable for a multicast source.
292 */
293 ip6stat_inc(ip6s_badscope);
294 goto bad;
295 }
296 if ((IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) ||
297 IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) &&
298 (ifp->if_flags & IFF_LOOPBACK) == 0) {
299 ip6stat_inc(ip6s_badscope);
300 goto bad;
301 }
302 /* Drop packets if interface ID portion is already filled. */
303 if (((IN6_IS_SCOPE_EMBED(&ip6->ip6_src) && ip6->ip6_src.s6_addr16[1]) ||
304 (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst) && ip6->ip6_dst.s6_addr16[1])) &&
305 (ifp->if_flags & IFF_LOOPBACK) == 0) {
306 ip6stat_inc(ip6s_badscope);
307 goto bad;
308 }
309 if (IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst) &&
310 !(m->m_flags & M_LOOP)) {
311 /*
312 * In this case, the packet should come from the loopback
313 * interface. However, we cannot just check the if_flags,
314 * because ip6_mloopback() passes the "actual" interface
315 * as the outgoing/incoming interface.
316 */
317 ip6stat_inc(ip6s_badscope);
318 goto bad;
319 }
320
321 /*
322 * The following check is not documented in specs. A malicious
323 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
324 * and bypass security checks (act as if it was from 127.0.0.1 by using
325 * IPv6 src ::ffff:127.0.0.1). Be cautious.
326 *
327 * This check chokes if we are in an SIIT cloud. As none of BSDs
328 * support IPv4-less kernel compilation, we cannot support SIIT
329 * environment at all. So, it makes more sense for us to reject any
330 * malicious packets for non-SIIT environment, than try to do a
331 * partial support for SIIT environment.
332 */
333 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
334 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
335 ip6stat_inc(ip6s_badscope);
336 goto bad;
337 }
338
339 /*
340 * Reject packets with IPv4 compatible addresses (auto tunnel).
341 *
342 * The code forbids automatic tunneling as per RFC4213.
343 */
344 if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) ||
345 IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) {
346 ip6stat_inc(ip6s_badscope);
347 goto bad;
348 }
349
350 return (m);
351 bad:
352 m_freem(m);
353 return (NULL);
354 }
355
356 int
ip6_input_if(struct mbuf ** mp,int * offp,int nxt,int af,struct ifnet * ifp)357 ip6_input_if(struct mbuf **mp, int *offp, int nxt, int af, struct ifnet *ifp)
358 {
359 struct route ro;
360 struct mbuf *m;
361 struct ip6_hdr *ip6;
362 struct rtentry *rt;
363 int ours = 0;
364 u_int16_t src_scope, dst_scope;
365 #if NPF > 0
366 struct in6_addr odst;
367 #endif
368 int pfrdr = 0;
369
370 KASSERT(*offp == 0);
371
372 ro.ro_rt = NULL;
373 ip6stat_inc(ip6s_total);
374 m = *mp = ipv6_check(ifp, *mp);
375 if (m == NULL)
376 goto bad;
377
378 ip6 = mtod(m, struct ip6_hdr *);
379
380 #if NCARP > 0
381 if (carp_lsdrop(ifp, m, AF_INET6, ip6->ip6_src.s6_addr32,
382 ip6->ip6_dst.s6_addr32, (ip6->ip6_nxt == IPPROTO_ICMPV6 ? 0 : 1)))
383 goto bad;
384 #endif
385 ip6stat_inc(ip6s_nxthist + ip6->ip6_nxt);
386
387 /*
388 * If the packet has been received on a loopback interface it
389 * can be destined to any local address, not necessarily to
390 * an address configured on `ifp'.
391 */
392 if (ifp->if_flags & IFF_LOOPBACK) {
393 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
394 src_scope = ip6->ip6_src.s6_addr16[1];
395 ip6->ip6_src.s6_addr16[1] = 0;
396 }
397 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
398 dst_scope = ip6->ip6_dst.s6_addr16[1];
399 ip6->ip6_dst.s6_addr16[1] = 0;
400 }
401 }
402
403 #if NPF > 0
404 /*
405 * Packet filter
406 */
407 odst = ip6->ip6_dst;
408 if (pf_test(AF_INET6, PF_IN, ifp, mp) != PF_PASS)
409 goto bad;
410 m = *mp;
411 if (m == NULL)
412 goto bad;
413
414 ip6 = mtod(m, struct ip6_hdr *);
415 pfrdr = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst);
416 #endif
417
418 /*
419 * Without embedded scope ID we cannot find link-local
420 * addresses in the routing table.
421 */
422 if (ifp->if_flags & IFF_LOOPBACK) {
423 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src))
424 ip6->ip6_src.s6_addr16[1] = src_scope;
425 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst))
426 ip6->ip6_dst.s6_addr16[1] = dst_scope;
427 } else {
428 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src))
429 ip6->ip6_src.s6_addr16[1] = htons(ifp->if_index);
430 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst))
431 ip6->ip6_dst.s6_addr16[1] = htons(ifp->if_index);
432 }
433
434 /*
435 * Be more secure than RFC5095 and scan for type 0 routing headers.
436 * If pf has already scanned the header chain, do not do it twice.
437 */
438 if (!(m->m_pkthdr.pf.flags & PF_TAG_PROCESSED) &&
439 ip6_check_rh0hdr(m, offp)) {
440 ip6stat_inc(ip6s_badoptions);
441 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, *offp);
442 m = *mp = NULL;
443 goto bad;
444 }
445
446 #if NPF > 0
447 if (pf_ouraddr(m) == 1) {
448 nxt = ip6_ours(mp, offp, nxt, af);
449 goto out;
450 }
451 #endif
452
453 /*
454 * Multicast check
455 */
456 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
457 /*
458 * Make sure M_MCAST is set. It should theoretically
459 * already be there, but let's play safe because upper
460 * layers check for this flag.
461 */
462 m->m_flags |= M_MCAST;
463
464 /*
465 * See if we belong to the destination multicast group on the
466 * arrival interface.
467 */
468 if (in6_hasmulti(&ip6->ip6_dst, ifp))
469 ours = 1;
470
471 #ifdef MROUTING
472 if (ip6_mforwarding && ip6_mrouter[ifp->if_rdomain]) {
473 int error;
474
475 nxt = ip6_hbhchcheck(&m, offp, &ours);
476 if (nxt == IPPROTO_DONE)
477 goto out;
478
479 ip6 = mtod(m, struct ip6_hdr *);
480
481 /*
482 * If we are acting as a multicast router, all
483 * incoming multicast packets are passed to the
484 * kernel-level multicast forwarding function.
485 * The packet is returned (relatively) intact; if
486 * ip6_mforward() returns a non-zero value, the packet
487 * must be discarded, else it may be accepted below.
488 */
489 KERNEL_LOCK();
490 error = ip6_mforward(ip6, ifp, m);
491 KERNEL_UNLOCK();
492 if (error) {
493 ip6stat_inc(ip6s_cantforward);
494 goto bad;
495 }
496
497 if (ours) {
498 if (af == AF_UNSPEC)
499 nxt = ip6_ours(mp, offp, nxt, af);
500 goto out;
501 }
502 goto bad;
503 }
504 #endif
505 if (!ours) {
506 ip6stat_inc(ip6s_notmember);
507 if (!IN6_IS_ADDR_MC_LINKLOCAL(&ip6->ip6_dst))
508 ip6stat_inc(ip6s_cantforward);
509 goto bad;
510 }
511 nxt = ip6_ours(mp, offp, nxt, af);
512 goto out;
513 }
514
515
516 /*
517 * Unicast check
518 */
519 rt = route6_mpath(&ro, &ip6->ip6_dst, &ip6->ip6_src,
520 m->m_pkthdr.ph_rtableid);
521
522 /*
523 * Accept the packet if the route to the destination is marked
524 * as local.
525 */
526 if (rt != NULL && ISSET(rt->rt_flags, RTF_LOCAL)) {
527 struct in6_ifaddr *ia6 = ifatoia6(rt->rt_ifa);
528
529 if (ip6_forwarding == 0 && rt->rt_ifidx != ifp->if_index &&
530 !((ifp->if_flags & IFF_LOOPBACK) ||
531 (ifp->if_type == IFT_ENC) ||
532 (m->m_pkthdr.pf.flags & PF_TAG_TRANSLATE_LOCALHOST))) {
533 /* received on wrong interface */
534 #if NCARP > 0
535 struct ifnet *out_if;
536
537 /*
538 * Virtual IPs on carp interfaces need to be checked
539 * also against the parent interface and other carp
540 * interfaces sharing the same parent.
541 */
542 out_if = if_get(rt->rt_ifidx);
543 if (!(out_if && carp_strict_addr_chk(out_if, ifp))) {
544 ip6stat_inc(ip6s_wrongif);
545 if_put(out_if);
546 goto bad;
547 }
548 if_put(out_if);
549 #else
550 ip6stat_inc(ip6s_wrongif);
551 goto bad;
552 #endif
553 }
554 /*
555 * packets to a tentative, duplicated, or somehow invalid
556 * address must not be accepted.
557 */
558 if ((ia6->ia6_flags & (IN6_IFF_TENTATIVE|IN6_IFF_DUPLICATED))) {
559 char src[INET6_ADDRSTRLEN], dst[INET6_ADDRSTRLEN];
560
561 inet_ntop(AF_INET6, &ip6->ip6_src, src, sizeof(src));
562 inet_ntop(AF_INET6, &ip6->ip6_dst, dst, sizeof(dst));
563 /* address is not ready, so discard the packet. */
564 nd6log((LOG_INFO,
565 "%s: packet to an unready address %s->%s\n",
566 __func__, src, dst));
567
568 goto bad;
569 } else {
570 nxt = ip6_ours(mp, offp, nxt, af);
571 goto out;
572 }
573 }
574
575 #if NCARP > 0
576 if (ip6->ip6_nxt == IPPROTO_ICMPV6 &&
577 carp_lsdrop(ifp, m, AF_INET6, ip6->ip6_src.s6_addr32,
578 ip6->ip6_dst.s6_addr32, 1))
579 goto bad;
580 #endif
581 /*
582 * Now there is no reason to process the packet if it's not our own
583 * and we're not a router.
584 */
585 if (!ip6_forwarding) {
586 ip6stat_inc(ip6s_cantforward);
587 goto bad;
588 }
589
590 nxt = ip6_hbhchcheck(&m, offp, &ours);
591 if (nxt == IPPROTO_DONE)
592 goto out;
593
594 if (ours) {
595 if (af == AF_UNSPEC)
596 nxt = ip6_ours(mp, offp, nxt, af);
597 goto out;
598 }
599
600 #ifdef IPSEC
601 if (ipsec_in_use) {
602 int rv;
603
604 rv = ipsec_forward_check(m, *offp, AF_INET6);
605 if (rv != 0) {
606 ip6stat_inc(ip6s_cantforward);
607 goto bad;
608 }
609 /*
610 * Fall through, forward packet. Outbound IPsec policy
611 * checking will occur in ip6_forward().
612 */
613 }
614 #endif /* IPSEC */
615
616 ip6_forward(m, &ro, pfrdr);
617 *mp = NULL;
618 rtfree(ro.ro_rt);
619 return IPPROTO_DONE;
620 bad:
621 nxt = IPPROTO_DONE;
622 m_freemp(mp);
623 out:
624 rtfree(ro.ro_rt);
625 return nxt;
626 }
627
628 /* On error free mbuf and return IPPROTO_DONE. */
629 int
ip6_hbhchcheck(struct mbuf ** mp,int * offp,int * oursp)630 ip6_hbhchcheck(struct mbuf **mp, int *offp, int *oursp)
631 {
632 struct ip6_hdr *ip6;
633 u_int32_t plen, rtalert = ~0;
634 int nxt;
635
636 ip6 = mtod(*mp, struct ip6_hdr *);
637
638 /*
639 * Process Hop-by-Hop options header if it's contained.
640 * m may be modified in ip6_hopopts_input().
641 * If a JumboPayload option is included, plen will also be modified.
642 */
643 plen = (u_int32_t)ntohs(ip6->ip6_plen);
644 *offp = sizeof(struct ip6_hdr);
645 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
646 struct ip6_hbh *hbh;
647
648 if (ip6_hopopts_input(mp, offp, &plen, &rtalert))
649 goto bad; /* m have already been freed */
650
651 /* adjust pointer */
652 ip6 = mtod(*mp, struct ip6_hdr *);
653
654 /*
655 * if the payload length field is 0 and the next header field
656 * indicates Hop-by-Hop Options header, then a Jumbo Payload
657 * option MUST be included.
658 */
659 if (ip6->ip6_plen == 0 && plen == 0) {
660 /*
661 * Note that if a valid jumbo payload option is
662 * contained, ip6_hopopts_input() must set a valid
663 * (non-zero) payload length to the variable plen.
664 */
665 ip6stat_inc(ip6s_badoptions);
666 icmp6_error(*mp, ICMP6_PARAM_PROB,
667 ICMP6_PARAMPROB_HEADER,
668 (caddr_t)&ip6->ip6_plen - (caddr_t)ip6);
669 goto bad;
670 }
671 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, *mp,
672 sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
673 if (hbh == NULL) {
674 ip6stat_inc(ip6s_tooshort);
675 goto bad;
676 }
677 nxt = hbh->ip6h_nxt;
678
679 /*
680 * accept the packet if a router alert option is included
681 * and we act as an IPv6 router.
682 */
683 if (rtalert != ~0 && ip6_forwarding && oursp != NULL)
684 *oursp = 1;
685 } else
686 nxt = ip6->ip6_nxt;
687
688 /*
689 * Check that the amount of data in the buffers
690 * is as at least much as the IPv6 header would have us expect.
691 * Trim mbufs if longer than we expect.
692 * Drop packet if shorter than we expect.
693 */
694 if ((*mp)->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
695 ip6stat_inc(ip6s_tooshort);
696 m_freemp(mp);
697 goto bad;
698 }
699 if ((*mp)->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
700 if ((*mp)->m_len == (*mp)->m_pkthdr.len) {
701 (*mp)->m_len = sizeof(struct ip6_hdr) + plen;
702 (*mp)->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
703 } else {
704 m_adj((*mp), sizeof(struct ip6_hdr) + plen -
705 (*mp)->m_pkthdr.len);
706 }
707 }
708
709 return nxt;
710 bad:
711 return IPPROTO_DONE;
712 }
713
714 /* scan packet for RH0 routing header. Mostly stolen from pf.c:pf_test() */
715 int
ip6_check_rh0hdr(struct mbuf * m,int * offp)716 ip6_check_rh0hdr(struct mbuf *m, int *offp)
717 {
718 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
719 struct ip6_rthdr rthdr;
720 struct ip6_ext opt6;
721 u_int8_t proto = ip6->ip6_nxt;
722 int done = 0, lim, off, rh_cnt = 0;
723
724 off = ((caddr_t)ip6 - m->m_data) + sizeof(struct ip6_hdr);
725 lim = min(m->m_pkthdr.len, ntohs(ip6->ip6_plen) + sizeof(*ip6));
726 do {
727 switch (proto) {
728 case IPPROTO_ROUTING:
729 if (rh_cnt++) {
730 /* more than one rh header present */
731 *offp = off;
732 return (1);
733 }
734
735 if (off + sizeof(rthdr) > lim) {
736 /* packet to short to make sense */
737 *offp = off;
738 return (1);
739 }
740
741 m_copydata(m, off, sizeof(rthdr), &rthdr);
742
743 if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
744 *offp = off +
745 offsetof(struct ip6_rthdr, ip6r_type);
746 return (1);
747 }
748
749 off += (rthdr.ip6r_len + 1) * 8;
750 proto = rthdr.ip6r_nxt;
751 break;
752 case IPPROTO_AH:
753 case IPPROTO_HOPOPTS:
754 case IPPROTO_DSTOPTS:
755 /* get next header and header length */
756 if (off + sizeof(opt6) > lim) {
757 /*
758 * Packet to short to make sense, we could
759 * reject the packet but as a router we
760 * should not do that so forward it.
761 */
762 return (0);
763 }
764
765 m_copydata(m, off, sizeof(opt6), &opt6);
766
767 if (proto == IPPROTO_AH)
768 off += (opt6.ip6e_len + 2) * 4;
769 else
770 off += (opt6.ip6e_len + 1) * 8;
771 proto = opt6.ip6e_nxt;
772 break;
773 case IPPROTO_FRAGMENT:
774 default:
775 /* end of header stack */
776 done = 1;
777 break;
778 }
779 } while (!done);
780
781 return (0);
782 }
783
784 /*
785 * Hop-by-Hop options header processing. If a valid jumbo payload option is
786 * included, the real payload length will be stored in plenp.
787 * On error free mbuf and return -1.
788 *
789 * rtalertp - XXX: should be stored in a more smart way
790 */
791 int
ip6_hopopts_input(struct mbuf ** mp,int * offp,u_int32_t * plenp,u_int32_t * rtalertp)792 ip6_hopopts_input(struct mbuf **mp, int *offp, u_int32_t *plenp,
793 u_int32_t *rtalertp)
794 {
795 int off = *offp, hbhlen;
796 struct ip6_hbh *hbh;
797
798 /* validation of the length of the header */
799 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, *mp,
800 sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
801 if (hbh == NULL) {
802 ip6stat_inc(ip6s_tooshort);
803 return -1;
804 }
805 hbhlen = (hbh->ip6h_len + 1) << 3;
806 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, *mp, sizeof(struct ip6_hdr),
807 hbhlen);
808 if (hbh == NULL) {
809 ip6stat_inc(ip6s_tooshort);
810 return -1;
811 }
812 off += hbhlen;
813 hbhlen -= sizeof(struct ip6_hbh);
814
815 if (ip6_process_hopopts(mp, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
816 hbhlen, rtalertp, plenp) < 0)
817 return (-1);
818
819 *offp = off;
820 return (0);
821 }
822
823 /*
824 * Search header for all Hop-by-hop options and process each option.
825 * This function is separate from ip6_hopopts_input() in order to
826 * handle a case where the sending node itself process its hop-by-hop
827 * options header. In such a case, the function is called from ip6_output().
828 * On error free mbuf and return -1.
829 *
830 * The function assumes that hbh header is located right after the IPv6 header
831 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
832 * opthead + hbhlen is located in continuous memory region.
833 */
834 int
ip6_process_hopopts(struct mbuf ** mp,u_int8_t * opthead,int hbhlen,u_int32_t * rtalertp,u_int32_t * plenp)835 ip6_process_hopopts(struct mbuf **mp, u_int8_t *opthead, int hbhlen,
836 u_int32_t *rtalertp, u_int32_t *plenp)
837 {
838 struct ip6_hdr *ip6;
839 int optlen = 0;
840 u_int8_t *opt = opthead;
841 u_int16_t rtalert_val;
842 u_int32_t jumboplen;
843 const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh);
844
845 for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) {
846 switch (*opt) {
847 case IP6OPT_PAD1:
848 optlen = 1;
849 break;
850 case IP6OPT_PADN:
851 if (hbhlen < IP6OPT_MINLEN) {
852 ip6stat_inc(ip6s_toosmall);
853 goto bad;
854 }
855 optlen = *(opt + 1) + 2;
856 break;
857 case IP6OPT_ROUTER_ALERT:
858 /* XXX may need check for alignment */
859 if (hbhlen < IP6OPT_RTALERT_LEN) {
860 ip6stat_inc(ip6s_toosmall);
861 goto bad;
862 }
863 if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) {
864 /* XXX stat */
865 icmp6_error(*mp, ICMP6_PARAM_PROB,
866 ICMP6_PARAMPROB_HEADER,
867 erroff + opt + 1 - opthead);
868 return (-1);
869 }
870 optlen = IP6OPT_RTALERT_LEN;
871 memcpy((caddr_t)&rtalert_val, (caddr_t)(opt + 2), 2);
872 *rtalertp = ntohs(rtalert_val);
873 break;
874 case IP6OPT_JUMBO:
875 /* XXX may need check for alignment */
876 if (hbhlen < IP6OPT_JUMBO_LEN) {
877 ip6stat_inc(ip6s_toosmall);
878 goto bad;
879 }
880 if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) {
881 /* XXX stat */
882 icmp6_error(*mp, ICMP6_PARAM_PROB,
883 ICMP6_PARAMPROB_HEADER,
884 erroff + opt + 1 - opthead);
885 return (-1);
886 }
887 optlen = IP6OPT_JUMBO_LEN;
888
889 /*
890 * IPv6 packets that have non 0 payload length
891 * must not contain a jumbo payload option.
892 */
893 ip6 = mtod(*mp, struct ip6_hdr *);
894 if (ip6->ip6_plen) {
895 ip6stat_inc(ip6s_badoptions);
896 icmp6_error(*mp, ICMP6_PARAM_PROB,
897 ICMP6_PARAMPROB_HEADER,
898 erroff + opt - opthead);
899 return (-1);
900 }
901
902 /*
903 * We may see jumbolen in unaligned location, so
904 * we'd need to perform memcpy().
905 */
906 memcpy(&jumboplen, opt + 2, sizeof(jumboplen));
907 jumboplen = (u_int32_t)htonl(jumboplen);
908
909 #if 1
910 /*
911 * if there are multiple jumbo payload options,
912 * *plenp will be non-zero and the packet will be
913 * rejected.
914 * the behavior may need some debate in ipngwg -
915 * multiple options does not make sense, however,
916 * there's no explicit mention in specification.
917 */
918 if (*plenp != 0) {
919 ip6stat_inc(ip6s_badoptions);
920 icmp6_error(*mp, ICMP6_PARAM_PROB,
921 ICMP6_PARAMPROB_HEADER,
922 erroff + opt + 2 - opthead);
923 return (-1);
924 }
925 #endif
926
927 /*
928 * jumbo payload length must be larger than 65535.
929 */
930 if (jumboplen <= IPV6_MAXPACKET) {
931 ip6stat_inc(ip6s_badoptions);
932 icmp6_error(*mp, ICMP6_PARAM_PROB,
933 ICMP6_PARAMPROB_HEADER,
934 erroff + opt + 2 - opthead);
935 return (-1);
936 }
937 *plenp = jumboplen;
938
939 break;
940 default: /* unknown option */
941 if (hbhlen < IP6OPT_MINLEN) {
942 ip6stat_inc(ip6s_toosmall);
943 goto bad;
944 }
945 optlen = ip6_unknown_opt(mp, opt,
946 erroff + opt - opthead);
947 if (optlen == -1)
948 return (-1);
949 optlen += 2;
950 break;
951 }
952 }
953
954 return (0);
955
956 bad:
957 m_freemp(mp);
958 return (-1);
959 }
960
961 /*
962 * Unknown option processing.
963 * The third argument `off' is the offset from the IPv6 header to the option,
964 * which allows returning an ICMPv6 error even if the IPv6 header and the
965 * option header are not continuous.
966 * On error free mbuf and return -1.
967 */
968 int
ip6_unknown_opt(struct mbuf ** mp,u_int8_t * optp,int off)969 ip6_unknown_opt(struct mbuf **mp, u_int8_t *optp, int off)
970 {
971 struct ip6_hdr *ip6;
972
973 switch (IP6OPT_TYPE(*optp)) {
974 case IP6OPT_TYPE_SKIP: /* ignore the option */
975 return ((int)*(optp + 1));
976 case IP6OPT_TYPE_DISCARD: /* silently discard */
977 m_freemp(mp);
978 return (-1);
979 case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */
980 ip6stat_inc(ip6s_badoptions);
981 icmp6_error(*mp, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off);
982 return (-1);
983 case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */
984 ip6stat_inc(ip6s_badoptions);
985 ip6 = mtod(*mp, struct ip6_hdr *);
986 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
987 ((*mp)->m_flags & (M_BCAST|M_MCAST)))
988 m_freemp(mp);
989 else
990 icmp6_error(*mp, ICMP6_PARAM_PROB,
991 ICMP6_PARAMPROB_OPTION, off);
992 return (-1);
993 }
994
995 m_freemp(mp); /* XXX: NOTREACHED */
996 return (-1);
997 }
998
999 /*
1000 * Create the "control" list for this pcb.
1001 *
1002 * The routine will be called from upper layer handlers like udp_input().
1003 * Thus the routine assumes that the caller (udp_input) have already
1004 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the
1005 * very first mbuf on the mbuf chain.
1006 * We may want to add some infinite loop prevention or sanity checks for safety.
1007 * (This applies only when you are using KAME mbuf chain restriction, i.e.
1008 * you are using IP6_EXTHDR_CHECK() not m_pulldown())
1009 */
1010 void
ip6_savecontrol(struct inpcb * inp,struct mbuf * m,struct mbuf ** mp)1011 ip6_savecontrol(struct inpcb *inp, struct mbuf *m, struct mbuf **mp)
1012 {
1013 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1014
1015 if (inp->inp_socket->so_options & SO_TIMESTAMP) {
1016 struct timeval tv;
1017
1018 m_microtime(m, &tv);
1019 *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
1020 SCM_TIMESTAMP, SOL_SOCKET);
1021 if (*mp)
1022 mp = &(*mp)->m_next;
1023 }
1024
1025 /* RFC 2292 sec. 5 */
1026 if ((inp->inp_flags & IN6P_PKTINFO) != 0) {
1027 struct in6_pktinfo pi6;
1028 memcpy(&pi6.ipi6_addr, &ip6->ip6_dst, sizeof(struct in6_addr));
1029 if (IN6_IS_SCOPE_EMBED(&pi6.ipi6_addr))
1030 pi6.ipi6_addr.s6_addr16[1] = 0;
1031 pi6.ipi6_ifindex = m ? m->m_pkthdr.ph_ifidx : 0;
1032 *mp = sbcreatecontrol((caddr_t) &pi6,
1033 sizeof(struct in6_pktinfo),
1034 IPV6_PKTINFO, IPPROTO_IPV6);
1035 if (*mp)
1036 mp = &(*mp)->m_next;
1037 }
1038
1039 if ((inp->inp_flags & IN6P_HOPLIMIT) != 0) {
1040 int hlim = ip6->ip6_hlim & 0xff;
1041 *mp = sbcreatecontrol((caddr_t) &hlim, sizeof(int),
1042 IPV6_HOPLIMIT, IPPROTO_IPV6);
1043 if (*mp)
1044 mp = &(*mp)->m_next;
1045 }
1046
1047 if ((inp->inp_flags & IN6P_TCLASS) != 0) {
1048 u_int32_t flowinfo;
1049 int tclass;
1050
1051 flowinfo = (u_int32_t)ntohl(ip6->ip6_flow & IPV6_FLOWINFO_MASK);
1052 flowinfo >>= 20;
1053
1054 tclass = flowinfo & 0xff;
1055 *mp = sbcreatecontrol((caddr_t)&tclass, sizeof(tclass),
1056 IPV6_TCLASS, IPPROTO_IPV6);
1057 if (*mp)
1058 mp = &(*mp)->m_next;
1059 }
1060
1061 /*
1062 * IPV6_HOPOPTS socket option. Recall that we required super-user
1063 * privilege for the option (see ip6_ctloutput), but it might be too
1064 * strict, since there might be some hop-by-hop options which can be
1065 * returned to normal user.
1066 * See also RFC 2292 section 6 (or RFC 3542 section 8).
1067 */
1068 if ((inp->inp_flags & IN6P_HOPOPTS) != 0) {
1069 /*
1070 * Check if a hop-by-hop options header is contained in the
1071 * received packet, and if so, store the options as ancillary
1072 * data. Note that a hop-by-hop options header must be
1073 * just after the IPv6 header, which is assured through the
1074 * IPv6 input processing.
1075 */
1076 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1077 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
1078 struct ip6_hbh *hbh;
1079 int hbhlen = 0;
1080 struct mbuf *ext;
1081
1082 ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr),
1083 ip6->ip6_nxt);
1084 if (ext == NULL) {
1085 ip6stat_inc(ip6s_tooshort);
1086 return;
1087 }
1088 hbh = mtod(ext, struct ip6_hbh *);
1089 hbhlen = (hbh->ip6h_len + 1) << 3;
1090 if (hbhlen != ext->m_len) {
1091 m_freem(ext);
1092 ip6stat_inc(ip6s_tooshort);
1093 return;
1094 }
1095
1096 /*
1097 * XXX: We copy the whole header even if a
1098 * jumbo payload option is included, the option which
1099 * is to be removed before returning according to
1100 * RFC2292.
1101 * Note: this constraint is removed in RFC3542.
1102 */
1103 *mp = sbcreatecontrol((caddr_t)hbh, hbhlen,
1104 IPV6_HOPOPTS,
1105 IPPROTO_IPV6);
1106 if (*mp)
1107 mp = &(*mp)->m_next;
1108 m_freem(ext);
1109 }
1110 }
1111
1112 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */
1113 if ((inp->inp_flags & (IN6P_RTHDR | IN6P_DSTOPTS)) != 0) {
1114 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1115 int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr);
1116
1117 /*
1118 * Search for destination options headers or routing
1119 * header(s) through the header chain, and stores each
1120 * header as ancillary data.
1121 * Note that the order of the headers remains in
1122 * the chain of ancillary data.
1123 */
1124 while (1) { /* is explicit loop prevention necessary? */
1125 struct ip6_ext *ip6e = NULL;
1126 int elen;
1127 struct mbuf *ext = NULL;
1128
1129 /*
1130 * if it is not an extension header, don't try to
1131 * pull it from the chain.
1132 */
1133 switch (nxt) {
1134 case IPPROTO_DSTOPTS:
1135 case IPPROTO_ROUTING:
1136 case IPPROTO_HOPOPTS:
1137 case IPPROTO_AH: /* is it possible? */
1138 break;
1139 default:
1140 goto loopend;
1141 }
1142
1143 ext = ip6_pullexthdr(m, off, nxt);
1144 if (ext == NULL) {
1145 ip6stat_inc(ip6s_tooshort);
1146 return;
1147 }
1148 ip6e = mtod(ext, struct ip6_ext *);
1149 if (nxt == IPPROTO_AH)
1150 elen = (ip6e->ip6e_len + 2) << 2;
1151 else
1152 elen = (ip6e->ip6e_len + 1) << 3;
1153 if (elen != ext->m_len) {
1154 m_freem(ext);
1155 ip6stat_inc(ip6s_tooshort);
1156 return;
1157 }
1158
1159 switch (nxt) {
1160 case IPPROTO_DSTOPTS:
1161 if (!(inp->inp_flags & IN6P_DSTOPTS))
1162 break;
1163
1164 *mp = sbcreatecontrol((caddr_t)ip6e, elen,
1165 IPV6_DSTOPTS,
1166 IPPROTO_IPV6);
1167 if (*mp)
1168 mp = &(*mp)->m_next;
1169 break;
1170
1171 case IPPROTO_ROUTING:
1172 if (!(inp->inp_flags & IN6P_RTHDR))
1173 break;
1174
1175 *mp = sbcreatecontrol((caddr_t)ip6e, elen,
1176 IPV6_RTHDR,
1177 IPPROTO_IPV6);
1178 if (*mp)
1179 mp = &(*mp)->m_next;
1180 break;
1181
1182 case IPPROTO_HOPOPTS:
1183 case IPPROTO_AH: /* is it possible? */
1184 break;
1185
1186 default:
1187 /*
1188 * other cases have been filtered in the above.
1189 * none will visit this case. here we supply
1190 * the code just in case (nxt overwritten or
1191 * other cases).
1192 */
1193 m_freem(ext);
1194 goto loopend;
1195
1196 }
1197
1198 /* proceed with the next header. */
1199 off += elen;
1200 nxt = ip6e->ip6e_nxt;
1201 ip6e = NULL;
1202 m_freem(ext);
1203 ext = NULL;
1204 }
1205 loopend:
1206 ;
1207 }
1208 }
1209
1210 /*
1211 * pull single extension header from mbuf chain. returns single mbuf that
1212 * contains the result, or NULL on error.
1213 */
1214 struct mbuf *
ip6_pullexthdr(struct mbuf * m,size_t off,int nxt)1215 ip6_pullexthdr(struct mbuf *m, size_t off, int nxt)
1216 {
1217 struct ip6_ext ip6e;
1218 size_t elen;
1219 struct mbuf *n;
1220
1221 #ifdef DIAGNOSTIC
1222 switch (nxt) {
1223 case IPPROTO_DSTOPTS:
1224 case IPPROTO_ROUTING:
1225 case IPPROTO_HOPOPTS:
1226 case IPPROTO_AH: /* is it possible? */
1227 break;
1228 default:
1229 printf("ip6_pullexthdr: invalid nxt=%d\n", nxt);
1230 }
1231 #endif
1232
1233 if (off + sizeof(ip6e) > m->m_pkthdr.len)
1234 return NULL;
1235
1236 m_copydata(m, off, sizeof(ip6e), &ip6e);
1237 if (nxt == IPPROTO_AH)
1238 elen = (ip6e.ip6e_len + 2) << 2;
1239 else
1240 elen = (ip6e.ip6e_len + 1) << 3;
1241
1242 if (off + elen > m->m_pkthdr.len)
1243 return NULL;
1244
1245 MGET(n, M_DONTWAIT, MT_DATA);
1246 if (n && elen >= MLEN) {
1247 MCLGET(n, M_DONTWAIT);
1248 if ((n->m_flags & M_EXT) == 0) {
1249 m_free(n);
1250 n = NULL;
1251 }
1252 }
1253 if (n == NULL) {
1254 ip6stat_inc(ip6s_idropped);
1255 return NULL;
1256 }
1257
1258 n->m_len = 0;
1259 if (elen >= m_trailingspace(n)) {
1260 m_free(n);
1261 return NULL;
1262 }
1263
1264 m_copydata(m, off, elen, mtod(n, caddr_t));
1265 n->m_len = elen;
1266 return n;
1267 }
1268
1269 /*
1270 * Get offset to the previous header followed by the header
1271 * currently processed.
1272 */
1273 int
ip6_get_prevhdr(struct mbuf * m,int off)1274 ip6_get_prevhdr(struct mbuf *m, int off)
1275 {
1276 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1277
1278 if (off == sizeof(struct ip6_hdr)) {
1279 return offsetof(struct ip6_hdr, ip6_nxt);
1280 } else if (off < sizeof(struct ip6_hdr)) {
1281 panic("%s: off < sizeof(struct ip6_hdr)", __func__);
1282 } else {
1283 int len, nlen, nxt;
1284 struct ip6_ext ip6e;
1285
1286 nxt = ip6->ip6_nxt;
1287 len = sizeof(struct ip6_hdr);
1288 nlen = 0;
1289 while (len < off) {
1290 m_copydata(m, len, sizeof(ip6e), &ip6e);
1291
1292 switch (nxt) {
1293 case IPPROTO_FRAGMENT:
1294 nlen = sizeof(struct ip6_frag);
1295 break;
1296 case IPPROTO_AH:
1297 nlen = (ip6e.ip6e_len + 2) << 2;
1298 break;
1299 default:
1300 nlen = (ip6e.ip6e_len + 1) << 3;
1301 break;
1302 }
1303 len += nlen;
1304 nxt = ip6e.ip6e_nxt;
1305 }
1306
1307 return (len - nlen);
1308 }
1309 }
1310
1311 /*
1312 * get next header offset. m will be retained.
1313 */
1314 int
ip6_nexthdr(struct mbuf * m,int off,int proto,int * nxtp)1315 ip6_nexthdr(struct mbuf *m, int off, int proto, int *nxtp)
1316 {
1317 struct ip6_hdr ip6;
1318 struct ip6_ext ip6e;
1319 struct ip6_frag fh;
1320
1321 /* just in case */
1322 if (m == NULL)
1323 panic("%s: m == NULL", __func__);
1324 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off)
1325 return -1;
1326
1327 switch (proto) {
1328 case IPPROTO_IPV6:
1329 if (m->m_pkthdr.len < off + sizeof(ip6))
1330 return -1;
1331 m_copydata(m, off, sizeof(ip6), &ip6);
1332 if (nxtp)
1333 *nxtp = ip6.ip6_nxt;
1334 off += sizeof(ip6);
1335 return off;
1336
1337 case IPPROTO_FRAGMENT:
1338 /*
1339 * terminate parsing if it is not the first fragment,
1340 * it does not make sense to parse through it.
1341 */
1342 if (m->m_pkthdr.len < off + sizeof(fh))
1343 return -1;
1344 m_copydata(m, off, sizeof(fh), &fh);
1345 if ((fh.ip6f_offlg & IP6F_OFF_MASK) != 0)
1346 return -1;
1347 if (nxtp)
1348 *nxtp = fh.ip6f_nxt;
1349 off += sizeof(struct ip6_frag);
1350 return off;
1351
1352 case IPPROTO_AH:
1353 if (m->m_pkthdr.len < off + sizeof(ip6e))
1354 return -1;
1355 m_copydata(m, off, sizeof(ip6e), &ip6e);
1356 if (nxtp)
1357 *nxtp = ip6e.ip6e_nxt;
1358 off += (ip6e.ip6e_len + 2) << 2;
1359 if (m->m_pkthdr.len < off)
1360 return -1;
1361 return off;
1362
1363 case IPPROTO_HOPOPTS:
1364 case IPPROTO_ROUTING:
1365 case IPPROTO_DSTOPTS:
1366 if (m->m_pkthdr.len < off + sizeof(ip6e))
1367 return -1;
1368 m_copydata(m, off, sizeof(ip6e), &ip6e);
1369 if (nxtp)
1370 *nxtp = ip6e.ip6e_nxt;
1371 off += (ip6e.ip6e_len + 1) << 3;
1372 if (m->m_pkthdr.len < off)
1373 return -1;
1374 return off;
1375
1376 case IPPROTO_NONE:
1377 case IPPROTO_ESP:
1378 case IPPROTO_IPCOMP:
1379 /* give up */
1380 return -1;
1381
1382 default:
1383 return -1;
1384 }
1385
1386 return -1;
1387 }
1388
1389 /*
1390 * get offset for the last header in the chain. m will be kept untainted.
1391 */
1392 int
ip6_lasthdr(struct mbuf * m,int off,int proto,int * nxtp)1393 ip6_lasthdr(struct mbuf *m, int off, int proto, int *nxtp)
1394 {
1395 int newoff;
1396 int nxt;
1397
1398 if (!nxtp) {
1399 nxt = -1;
1400 nxtp = &nxt;
1401 }
1402 while (1) {
1403 newoff = ip6_nexthdr(m, off, proto, nxtp);
1404 if (newoff < 0)
1405 return off;
1406 else if (newoff < off)
1407 return -1; /* invalid */
1408 else if (newoff == off)
1409 return newoff;
1410
1411 off = newoff;
1412 proto = *nxtp;
1413 }
1414 }
1415
1416 /*
1417 * System control for IP6
1418 */
1419
1420 const u_char inet6ctlerrmap[PRC_NCMDS] = {
1421 0, 0, 0, 0,
1422 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH,
1423 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED,
1424 EMSGSIZE, EHOSTUNREACH, 0, 0,
1425 0, 0, 0, 0,
1426 ENOPROTOOPT
1427 };
1428
1429 #ifdef MROUTING
1430 extern int ip6_mrtproto;
1431 #endif
1432
1433 const struct sysctl_bounded_args ipv6ctl_vars[] = {
1434 { IPV6CTL_DAD_PENDING, &ip6_dad_pending, SYSCTL_INT_READONLY },
1435 #ifdef MROUTING
1436 { IPV6CTL_MRTPROTO, &ip6_mrtproto, SYSCTL_INT_READONLY },
1437 #endif
1438 { IPV6CTL_FORWARDING, &ip6_forwarding, 0, 1 },
1439 { IPV6CTL_SENDREDIRECTS, &ip6_sendredirects, 0, 1 },
1440 { IPV6CTL_DEFHLIM, &ip6_defhlim, 0, 255 },
1441 { IPV6CTL_MAXFRAGPACKETS, &ip6_maxfragpackets, 0, 1000 },
1442 { IPV6CTL_LOG_INTERVAL, &ip6_log_interval, 0, INT_MAX },
1443 { IPV6CTL_HDRNESTLIMIT, &ip6_hdrnestlimit, 0, 100 },
1444 { IPV6CTL_DAD_COUNT, &ip6_dad_count, 0, 10 },
1445 { IPV6CTL_AUTO_FLOWLABEL, &ip6_auto_flowlabel, 0, 1 },
1446 { IPV6CTL_DEFMCASTHLIM, &ip6_defmcasthlim, 0, 255 },
1447 { IPV6CTL_USE_DEPRECATED, &ip6_use_deprecated, 0, 1 },
1448 { IPV6CTL_MAXFRAGS, &ip6_maxfrags, 0, 1000 },
1449 { IPV6CTL_MFORWARDING, &ip6_mforwarding, 0, 1 },
1450 { IPV6CTL_MCAST_PMTU, &ip6_mcast_pmtu, 0, 1 },
1451 { IPV6CTL_NEIGHBORGCTHRESH, &ip6_neighborgcthresh, -1, 5 * 2048 },
1452 { IPV6CTL_MAXDYNROUTES, &ip6_maxdynroutes, -1, 5 * 4096 },
1453 };
1454
1455 int
ip6_sysctl_ip6stat(void * oldp,size_t * oldlenp,void * newp)1456 ip6_sysctl_ip6stat(void *oldp, size_t *oldlenp, void *newp)
1457 {
1458 struct ip6stat *ip6stat;
1459 int ret;
1460
1461 CTASSERT(sizeof(*ip6stat) == (ip6s_ncounters * sizeof(uint64_t)));
1462
1463 ip6stat = malloc(sizeof(*ip6stat), M_TEMP, M_WAITOK);
1464 counters_read(ip6counters, (uint64_t *)ip6stat, ip6s_ncounters, NULL);
1465 ret = sysctl_rdstruct(oldp, oldlenp, newp,
1466 ip6stat, sizeof(*ip6stat));
1467 free(ip6stat, M_TEMP, sizeof(*ip6stat));
1468
1469 return (ret);
1470 }
1471
1472 int
ip6_sysctl_soiikey(void * oldp,size_t * oldlenp,void * newp,size_t newlen)1473 ip6_sysctl_soiikey(void *oldp, size_t *oldlenp, void *newp, size_t newlen)
1474 {
1475 uint8_t oldkey[IP6_SOIIKEY_LEN];
1476 int error;
1477
1478 error = suser(curproc);
1479 if (error != 0)
1480 return (error);
1481
1482 memcpy(oldkey, ip6_soiikey, sizeof(oldkey));
1483
1484 error = sysctl_struct(oldp, oldlenp, newp, newlen, ip6_soiikey,
1485 sizeof(ip6_soiikey));
1486
1487 return (error);
1488 }
1489
1490 int
ip6_sysctl(int * name,u_int namelen,void * oldp,size_t * oldlenp,void * newp,size_t newlen)1491 ip6_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp,
1492 void *newp, size_t newlen)
1493 {
1494 #ifdef MROUTING
1495 extern struct mrt6stat mrt6stat;
1496 #endif
1497 int oldval, error;
1498
1499 /* Almost all sysctl names at this level are terminal. */
1500 if (namelen != 1 && name[0] != IPV6CTL_IFQUEUE)
1501 return (ENOTDIR);
1502
1503 switch (name[0]) {
1504 case IPV6CTL_STATS:
1505 return (ip6_sysctl_ip6stat(oldp, oldlenp, newp));
1506 #ifdef MROUTING
1507 case IPV6CTL_MRTSTATS:
1508 if (newp != NULL)
1509 return (EPERM);
1510 NET_LOCK();
1511 error = sysctl_struct(oldp, oldlenp, newp, newlen,
1512 &mrt6stat, sizeof(mrt6stat));
1513 NET_UNLOCK();
1514 return (error);
1515 case IPV6CTL_MRTMIF:
1516 if (newp)
1517 return (EPERM);
1518 NET_LOCK();
1519 error = mrt6_sysctl_mif(oldp, oldlenp);
1520 NET_UNLOCK();
1521 return (error);
1522 case IPV6CTL_MRTMFC:
1523 if (newp)
1524 return (EPERM);
1525 NET_LOCK();
1526 error = mrt6_sysctl_mfc(oldp, oldlenp);
1527 NET_UNLOCK();
1528 return (error);
1529 #else
1530 case IPV6CTL_MRTSTATS:
1531 case IPV6CTL_MRTPROTO:
1532 case IPV6CTL_MRTMIF:
1533 case IPV6CTL_MRTMFC:
1534 return (EOPNOTSUPP);
1535 #endif
1536 case IPV6CTL_MTUDISCTIMEOUT:
1537 NET_LOCK();
1538 error = sysctl_int_bounded(oldp, oldlenp, newp, newlen,
1539 &ip6_mtudisc_timeout, 0, INT_MAX);
1540 rt_timer_queue_change(&icmp6_mtudisc_timeout_q,
1541 ip6_mtudisc_timeout);
1542 NET_UNLOCK();
1543 return (error);
1544 case IPV6CTL_IFQUEUE:
1545 return (sysctl_niq(name + 1, namelen - 1,
1546 oldp, oldlenp, newp, newlen, &ip6intrq));
1547 case IPV6CTL_SOIIKEY:
1548 return (ip6_sysctl_soiikey(oldp, oldlenp, newp, newlen));
1549 case IPV6CTL_MULTIPATH:
1550 NET_LOCK();
1551 oldval = ip6_multipath;
1552 error = sysctl_int_bounded(oldp, oldlenp, newp, newlen,
1553 &ip6_multipath, 0, 1);
1554 if (oldval != ip6_multipath)
1555 atomic_inc_long(&rtgeneration);
1556 NET_UNLOCK();
1557 return (error);
1558 default:
1559 NET_LOCK();
1560 error = sysctl_bounded_arr(ipv6ctl_vars, nitems(ipv6ctl_vars),
1561 name, namelen, oldp, oldlenp, newp, newlen);
1562 NET_UNLOCK();
1563 return (error);
1564 }
1565 /* NOTREACHED */
1566 }
1567
1568 void
ip6_send_dispatch(void * xmq)1569 ip6_send_dispatch(void *xmq)
1570 {
1571 struct mbuf_queue *mq = xmq;
1572 struct mbuf *m;
1573 struct mbuf_list ml;
1574
1575 mq_delist(mq, &ml);
1576 if (ml_empty(&ml))
1577 return;
1578
1579 NET_LOCK_SHARED();
1580 while ((m = ml_dequeue(&ml)) != NULL) {
1581 ip6_output(m, NULL, NULL, 0, NULL, NULL);
1582 }
1583 NET_UNLOCK_SHARED();
1584 }
1585
1586 void
ip6_send(struct mbuf * m)1587 ip6_send(struct mbuf *m)
1588 {
1589 mq_enqueue(&ip6send_mq, m);
1590 task_add(net_tq(0), &ip6send_task);
1591 }
1592