1 /* $OpenBSD: ip6_input.c,v 1.266 2024/07/19 16:58:32 bluhm Exp $ */
2 /* $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $ */
3
4 /*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 /*
34 * Copyright (c) 1982, 1986, 1988, 1993
35 * The Regents of the University of California. All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. Neither the name of the University nor the names of its contributors
46 * may be used to endorse or promote products derived from this software
47 * without specific prior written permission.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59 * SUCH DAMAGE.
60 *
61 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94
62 */
63
64 #include "pf.h"
65 #include "carp.h"
66
67 #include <sys/param.h>
68 #include <sys/systm.h>
69 #include <sys/mbuf.h>
70 #include <sys/domain.h>
71 #include <sys/sysctl.h>
72 #include <sys/protosw.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <sys/errno.h>
76 #include <sys/time.h>
77 #include <sys/timeout.h>
78 #include <sys/kernel.h>
79 #include <sys/syslog.h>
80 #include <sys/task.h>
81
82 #include <net/if.h>
83 #include <net/if_var.h>
84 #include <net/if_types.h>
85 #include <net/route.h>
86 #include <net/netisr.h>
87
88 #include <netinet/in.h>
89
90 #include <netinet/ip.h>
91
92 #include <netinet/in_pcb.h>
93 #include <netinet/ip_var.h>
94 #include <netinet6/in6_var.h>
95 #include <netinet6/in6_ifattach.h>
96 #include <netinet/ip6.h>
97 #include <netinet6/ip6_var.h>
98 #include <netinet/icmp6.h>
99 #include <netinet6/nd6.h>
100
101 #include "gif.h"
102 #include "bpfilter.h"
103
104 #ifdef MROUTING
105 #include <netinet6/ip6_mroute.h>
106 #endif
107
108 #if NPF > 0
109 #include <net/pfvar.h>
110 #endif
111
112 #if NCARP > 0
113 #include <netinet/ip_carp.h>
114 #endif
115
116 struct niqueue ip6intrq = NIQUEUE_INITIALIZER(IPQ_MAXLEN, NETISR_IPV6);
117
118 struct cpumem *ip6counters;
119
120 uint8_t ip6_soiikey[IP6_SOIIKEY_LEN];
121
122 int ip6_ours(struct mbuf **, int *, int, int, int);
123 int ip6_check_rh0hdr(struct mbuf *, int *);
124 int ip6_hbhchcheck(struct mbuf **, int *, int *, int);
125 int ip6_hopopts_input(struct mbuf **, int *, u_int32_t *, u_int32_t *);
126 struct mbuf *ip6_pullexthdr(struct mbuf *, size_t, int);
127 int ip6_sysctl_soiikey(void *, size_t *, void *, size_t);
128
129 static struct mbuf_queue ip6send_mq;
130
131 static void ip6_send_dispatch(void *);
132 static struct task ip6send_task =
133 TASK_INITIALIZER(ip6_send_dispatch, &ip6send_mq);
134
135 /*
136 * IP6 initialization: fill in IP6 protocol switch table.
137 * All protocols not implemented in kernel go to raw IP6 protocol handler.
138 */
139 void
ip6_init(void)140 ip6_init(void)
141 {
142 const struct protosw *pr;
143 int i;
144
145 pr = pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW);
146 if (pr == NULL)
147 panic("%s", __func__);
148 for (i = 0; i < IPPROTO_MAX; i++)
149 ip6_protox[i] = pr - inet6sw;
150 for (pr = inet6domain.dom_protosw;
151 pr < inet6domain.dom_protoswNPROTOSW; pr++)
152 if (pr->pr_domain->dom_family == PF_INET6 &&
153 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW &&
154 pr->pr_protocol < IPPROTO_MAX)
155 ip6_protox[pr->pr_protocol] = pr - inet6sw;
156 ip6_randomid_init();
157 nd6_init();
158 frag6_init();
159
160 mq_init(&ip6send_mq, 64, IPL_SOFTNET);
161
162 ip6counters = counters_alloc(ip6s_ncounters);
163 #ifdef MROUTING
164 rt_timer_queue_init(&ip6_mrouterq, MCAST_EXPIRE_TIMEOUT,
165 &mf6c_expire_route);
166 #endif
167 }
168
169 /*
170 * Enqueue packet for local delivery. Queuing is used as a boundary
171 * between the network layer (input/forward path) running with
172 * NET_LOCK_SHARED() and the transport layer needing it exclusively.
173 */
174 int
ip6_ours(struct mbuf ** mp,int * offp,int nxt,int af,int flags)175 ip6_ours(struct mbuf **mp, int *offp, int nxt, int af, int flags)
176 {
177 /* ip6_hbhchcheck() may be run before, then off and nxt are set */
178 if (*offp == 0) {
179 nxt = ip6_hbhchcheck(mp, offp, NULL, flags);
180 if (nxt == IPPROTO_DONE)
181 return IPPROTO_DONE;
182 }
183
184 /* We are already in a IPv4/IPv6 local deliver loop. */
185 if (af != AF_UNSPEC)
186 return nxt;
187
188 nxt = ip_deliver(mp, offp, nxt, AF_INET6, 1);
189 if (nxt == IPPROTO_DONE)
190 return IPPROTO_DONE;
191
192 /* save values for later, use after dequeue */
193 if (*offp != sizeof(struct ip6_hdr)) {
194 struct m_tag *mtag;
195 struct ipoffnxt *ion;
196
197 /* mbuf tags are expensive, but only used for header options */
198 mtag = m_tag_get(PACKET_TAG_IP6_OFFNXT, sizeof(*ion),
199 M_NOWAIT);
200 if (mtag == NULL) {
201 ip6stat_inc(ip6s_idropped);
202 m_freemp(mp);
203 return IPPROTO_DONE;
204 }
205 ion = (struct ipoffnxt *)(mtag + 1);
206 ion->ion_off = *offp;
207 ion->ion_nxt = nxt;
208
209 m_tag_prepend(*mp, mtag);
210 }
211
212 niq_enqueue(&ip6intrq, *mp);
213 *mp = NULL;
214 return IPPROTO_DONE;
215 }
216
217 /*
218 * Dequeue and process locally delivered packets.
219 * This is called with exclusive NET_LOCK().
220 */
221 void
ip6intr(void)222 ip6intr(void)
223 {
224 struct mbuf *m;
225
226 while ((m = niq_dequeue(&ip6intrq)) != NULL) {
227 struct m_tag *mtag;
228 int off, nxt;
229
230 #ifdef DIAGNOSTIC
231 if ((m->m_flags & M_PKTHDR) == 0)
232 panic("ip6intr no HDR");
233 #endif
234 mtag = m_tag_find(m, PACKET_TAG_IP6_OFFNXT, NULL);
235 if (mtag != NULL) {
236 struct ipoffnxt *ion;
237
238 ion = (struct ipoffnxt *)(mtag + 1);
239 off = ion->ion_off;
240 nxt = ion->ion_nxt;
241
242 m_tag_delete(m, mtag);
243 } else {
244 struct ip6_hdr *ip6;
245
246 ip6 = mtod(m, struct ip6_hdr *);
247 off = sizeof(struct ip6_hdr);
248 nxt = ip6->ip6_nxt;
249 }
250 nxt = ip_deliver(&m, &off, nxt, AF_INET6, 0);
251 KASSERT(nxt == IPPROTO_DONE);
252 }
253 }
254
255 void
ipv6_input(struct ifnet * ifp,struct mbuf * m)256 ipv6_input(struct ifnet *ifp, struct mbuf *m)
257 {
258 int off, nxt;
259
260 off = 0;
261 nxt = ip6_input_if(&m, &off, IPPROTO_IPV6, AF_UNSPEC, ifp);
262 KASSERT(nxt == IPPROTO_DONE);
263 }
264
265 struct mbuf *
ipv6_check(struct ifnet * ifp,struct mbuf * m)266 ipv6_check(struct ifnet *ifp, struct mbuf *m)
267 {
268 struct ip6_hdr *ip6;
269
270 if (m->m_len < sizeof(*ip6)) {
271 m = m_pullup(m, sizeof(*ip6));
272 if (m == NULL) {
273 ip6stat_inc(ip6s_toosmall);
274 return (NULL);
275 }
276 }
277
278 ip6 = mtod(m, struct ip6_hdr *);
279
280 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
281 ip6stat_inc(ip6s_badvers);
282 goto bad;
283 }
284
285 /*
286 * Check against address spoofing/corruption.
287 */
288 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) ||
289 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) {
290 /*
291 * XXX: "badscope" is not very suitable for a multicast source.
292 */
293 ip6stat_inc(ip6s_badscope);
294 goto bad;
295 }
296 if ((IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) ||
297 IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) &&
298 (ifp->if_flags & IFF_LOOPBACK) == 0) {
299 ip6stat_inc(ip6s_badscope);
300 goto bad;
301 }
302 /* Drop packets if interface ID portion is already filled. */
303 if (((IN6_IS_SCOPE_EMBED(&ip6->ip6_src) && ip6->ip6_src.s6_addr16[1]) ||
304 (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst) && ip6->ip6_dst.s6_addr16[1])) &&
305 (ifp->if_flags & IFF_LOOPBACK) == 0) {
306 ip6stat_inc(ip6s_badscope);
307 goto bad;
308 }
309 if (IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst) &&
310 !(m->m_flags & M_LOOP)) {
311 /*
312 * In this case, the packet should come from the loopback
313 * interface. However, we cannot just check the if_flags,
314 * because ip6_mloopback() passes the "actual" interface
315 * as the outgoing/incoming interface.
316 */
317 ip6stat_inc(ip6s_badscope);
318 goto bad;
319 }
320
321 /*
322 * The following check is not documented in specs. A malicious
323 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
324 * and bypass security checks (act as if it was from 127.0.0.1 by using
325 * IPv6 src ::ffff:127.0.0.1). Be cautious.
326 *
327 * This check chokes if we are in an SIIT cloud. As none of BSDs
328 * support IPv4-less kernel compilation, we cannot support SIIT
329 * environment at all. So, it makes more sense for us to reject any
330 * malicious packets for non-SIIT environment, than try to do a
331 * partial support for SIIT environment.
332 */
333 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
334 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
335 ip6stat_inc(ip6s_badscope);
336 goto bad;
337 }
338
339 /*
340 * Reject packets with IPv4 compatible addresses (auto tunnel).
341 *
342 * The code forbids automatic tunneling as per RFC4213.
343 */
344 if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) ||
345 IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) {
346 ip6stat_inc(ip6s_badscope);
347 goto bad;
348 }
349
350 return (m);
351 bad:
352 m_freem(m);
353 return (NULL);
354 }
355
356 int
ip6_input_if(struct mbuf ** mp,int * offp,int nxt,int af,struct ifnet * ifp)357 ip6_input_if(struct mbuf **mp, int *offp, int nxt, int af, struct ifnet *ifp)
358 {
359 struct route ro;
360 struct mbuf *m;
361 struct ip6_hdr *ip6;
362 struct rtentry *rt;
363 int ours = 0;
364 u_int16_t src_scope, dst_scope;
365 #if NPF > 0
366 struct in6_addr odst;
367 #endif
368 int flags = 0;
369
370 KASSERT(*offp == 0);
371
372 ro.ro_rt = NULL;
373 ip6stat_inc(ip6s_total);
374 m = *mp = ipv6_check(ifp, *mp);
375 if (m == NULL)
376 goto bad;
377
378 ip6 = mtod(m, struct ip6_hdr *);
379
380 #if NCARP > 0
381 if (carp_lsdrop(ifp, m, AF_INET6, ip6->ip6_src.s6_addr32,
382 ip6->ip6_dst.s6_addr32, (ip6->ip6_nxt == IPPROTO_ICMPV6 ? 0 : 1)))
383 goto bad;
384 #endif
385 ip6stat_inc(ip6s_nxthist + ip6->ip6_nxt);
386
387 /*
388 * If the packet has been received on a loopback interface it
389 * can be destined to any local address, not necessarily to
390 * an address configured on `ifp'.
391 */
392 if (ifp->if_flags & IFF_LOOPBACK) {
393 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
394 src_scope = ip6->ip6_src.s6_addr16[1];
395 ip6->ip6_src.s6_addr16[1] = 0;
396 }
397 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
398 dst_scope = ip6->ip6_dst.s6_addr16[1];
399 ip6->ip6_dst.s6_addr16[1] = 0;
400 }
401 }
402
403 #if NPF > 0
404 /*
405 * Packet filter
406 */
407 odst = ip6->ip6_dst;
408 if (pf_test(AF_INET6, PF_IN, ifp, mp) != PF_PASS)
409 goto bad;
410 m = *mp;
411 if (m == NULL)
412 goto bad;
413
414 ip6 = mtod(m, struct ip6_hdr *);
415 if (!IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst))
416 SET(flags, IPV6_REDIRECT);
417 #endif
418
419 switch (atomic_load_int(&ip6_forwarding)) {
420 case 2:
421 SET(flags, IPV6_FORWARDING_IPSEC);
422 /* FALLTHROUGH */
423 case 1:
424 SET(flags, IPV6_FORWARDING);
425 break;
426 }
427
428 /*
429 * Without embedded scope ID we cannot find link-local
430 * addresses in the routing table.
431 */
432 if (ifp->if_flags & IFF_LOOPBACK) {
433 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src))
434 ip6->ip6_src.s6_addr16[1] = src_scope;
435 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst))
436 ip6->ip6_dst.s6_addr16[1] = dst_scope;
437 } else {
438 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src))
439 ip6->ip6_src.s6_addr16[1] = htons(ifp->if_index);
440 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst))
441 ip6->ip6_dst.s6_addr16[1] = htons(ifp->if_index);
442 }
443
444 /*
445 * Be more secure than RFC5095 and scan for type 0 routing headers.
446 * If pf has already scanned the header chain, do not do it twice.
447 */
448 if (!(m->m_pkthdr.pf.flags & PF_TAG_PROCESSED) &&
449 ip6_check_rh0hdr(m, offp)) {
450 ip6stat_inc(ip6s_badoptions);
451 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, *offp);
452 m = *mp = NULL;
453 goto bad;
454 }
455
456 #if NPF > 0
457 if (pf_ouraddr(m) == 1) {
458 nxt = ip6_ours(mp, offp, nxt, af, flags);
459 goto out;
460 }
461 #endif
462
463 /*
464 * Multicast check
465 */
466 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
467 /*
468 * Make sure M_MCAST is set. It should theoretically
469 * already be there, but let's play safe because upper
470 * layers check for this flag.
471 */
472 m->m_flags |= M_MCAST;
473
474 /*
475 * See if we belong to the destination multicast group on the
476 * arrival interface.
477 */
478 if (in6_hasmulti(&ip6->ip6_dst, ifp))
479 ours = 1;
480
481 #ifdef MROUTING
482 if (ip6_mforwarding && ip6_mrouter[ifp->if_rdomain]) {
483 int error;
484
485 nxt = ip6_hbhchcheck(&m, offp, &ours, flags);
486 if (nxt == IPPROTO_DONE)
487 goto out;
488
489 ip6 = mtod(m, struct ip6_hdr *);
490
491 /*
492 * If we are acting as a multicast router, all
493 * incoming multicast packets are passed to the
494 * kernel-level multicast forwarding function.
495 * The packet is returned (relatively) intact; if
496 * ip6_mforward() returns a non-zero value, the packet
497 * must be discarded, else it may be accepted below.
498 */
499 KERNEL_LOCK();
500 error = ip6_mforward(ip6, ifp, m, flags);
501 KERNEL_UNLOCK();
502 if (error) {
503 ip6stat_inc(ip6s_cantforward);
504 goto bad;
505 }
506
507 if (ours) {
508 if (af == AF_UNSPEC)
509 nxt = ip6_ours(mp, offp, nxt, af,
510 flags);
511 goto out;
512 }
513 goto bad;
514 }
515 #endif
516 if (!ours) {
517 ip6stat_inc(ip6s_notmember);
518 if (!IN6_IS_ADDR_MC_LINKLOCAL(&ip6->ip6_dst))
519 ip6stat_inc(ip6s_cantforward);
520 goto bad;
521 }
522 nxt = ip6_ours(mp, offp, nxt, af, flags);
523 goto out;
524 }
525
526
527 /*
528 * Unicast check
529 */
530 rt = route6_mpath(&ro, &ip6->ip6_dst, &ip6->ip6_src,
531 m->m_pkthdr.ph_rtableid);
532
533 /*
534 * Accept the packet if the route to the destination is marked
535 * as local.
536 */
537 if (rt != NULL && ISSET(rt->rt_flags, RTF_LOCAL)) {
538 struct in6_ifaddr *ia6 = ifatoia6(rt->rt_ifa);
539
540 if (!ISSET(flags, IPV6_FORWARDING) &&
541 rt->rt_ifidx != ifp->if_index &&
542 !((ifp->if_flags & IFF_LOOPBACK) ||
543 (ifp->if_type == IFT_ENC) ||
544 (m->m_pkthdr.pf.flags & PF_TAG_TRANSLATE_LOCALHOST))) {
545 /* received on wrong interface */
546 #if NCARP > 0
547 struct ifnet *out_if;
548
549 /*
550 * Virtual IPs on carp interfaces need to be checked
551 * also against the parent interface and other carp
552 * interfaces sharing the same parent.
553 */
554 out_if = if_get(rt->rt_ifidx);
555 if (!(out_if && carp_strict_addr_chk(out_if, ifp))) {
556 ip6stat_inc(ip6s_wrongif);
557 if_put(out_if);
558 goto bad;
559 }
560 if_put(out_if);
561 #else
562 ip6stat_inc(ip6s_wrongif);
563 goto bad;
564 #endif
565 }
566 /*
567 * packets to a tentative, duplicated, or somehow invalid
568 * address must not be accepted.
569 */
570 if ((ia6->ia6_flags & (IN6_IFF_TENTATIVE|IN6_IFF_DUPLICATED))) {
571 char src[INET6_ADDRSTRLEN], dst[INET6_ADDRSTRLEN];
572
573 inet_ntop(AF_INET6, &ip6->ip6_src, src, sizeof(src));
574 inet_ntop(AF_INET6, &ip6->ip6_dst, dst, sizeof(dst));
575 /* address is not ready, so discard the packet. */
576 nd6log((LOG_INFO,
577 "%s: packet to an unready address %s->%s\n",
578 __func__, src, dst));
579
580 goto bad;
581 } else {
582 nxt = ip6_ours(mp, offp, nxt, af, flags);
583 goto out;
584 }
585 }
586
587 #if NCARP > 0
588 if (ip6->ip6_nxt == IPPROTO_ICMPV6 &&
589 carp_lsdrop(ifp, m, AF_INET6, ip6->ip6_src.s6_addr32,
590 ip6->ip6_dst.s6_addr32, 1))
591 goto bad;
592 #endif
593 /*
594 * Now there is no reason to process the packet if it's not our own
595 * and we're not a router.
596 */
597 if (!ISSET(flags, IPV6_FORWARDING)) {
598 ip6stat_inc(ip6s_cantforward);
599 goto bad;
600 }
601
602 nxt = ip6_hbhchcheck(&m, offp, &ours, flags);
603 if (nxt == IPPROTO_DONE)
604 goto out;
605
606 if (ours) {
607 if (af == AF_UNSPEC)
608 nxt = ip6_ours(mp, offp, nxt, af, flags);
609 goto out;
610 }
611
612 #ifdef IPSEC
613 if (ipsec_in_use) {
614 int rv;
615
616 rv = ipsec_forward_check(m, *offp, AF_INET6);
617 if (rv != 0) {
618 ip6stat_inc(ip6s_cantforward);
619 goto bad;
620 }
621 /*
622 * Fall through, forward packet. Outbound IPsec policy
623 * checking will occur in ip6_forward().
624 */
625 }
626 #endif /* IPSEC */
627
628 ip6_forward(m, &ro, flags);
629 *mp = NULL;
630 rtfree(ro.ro_rt);
631 return IPPROTO_DONE;
632 bad:
633 nxt = IPPROTO_DONE;
634 m_freemp(mp);
635 out:
636 rtfree(ro.ro_rt);
637 return nxt;
638 }
639
640 /* On error free mbuf and return IPPROTO_DONE. */
641 int
ip6_hbhchcheck(struct mbuf ** mp,int * offp,int * oursp,int flags)642 ip6_hbhchcheck(struct mbuf **mp, int *offp, int *oursp, int flags)
643 {
644 struct ip6_hdr *ip6;
645 u_int32_t plen, rtalert = ~0;
646 int nxt;
647
648 ip6 = mtod(*mp, struct ip6_hdr *);
649
650 /*
651 * Process Hop-by-Hop options header if it's contained.
652 * m may be modified in ip6_hopopts_input().
653 * If a JumboPayload option is included, plen will also be modified.
654 */
655 plen = (u_int32_t)ntohs(ip6->ip6_plen);
656 *offp = sizeof(struct ip6_hdr);
657 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
658 struct ip6_hbh *hbh;
659
660 if (ip6_hopopts_input(mp, offp, &plen, &rtalert))
661 goto bad; /* m have already been freed */
662
663 /* adjust pointer */
664 ip6 = mtod(*mp, struct ip6_hdr *);
665
666 /*
667 * if the payload length field is 0 and the next header field
668 * indicates Hop-by-Hop Options header, then a Jumbo Payload
669 * option MUST be included.
670 */
671 if (ip6->ip6_plen == 0 && plen == 0) {
672 /*
673 * Note that if a valid jumbo payload option is
674 * contained, ip6_hopopts_input() must set a valid
675 * (non-zero) payload length to the variable plen.
676 */
677 ip6stat_inc(ip6s_badoptions);
678 icmp6_error(*mp, ICMP6_PARAM_PROB,
679 ICMP6_PARAMPROB_HEADER,
680 (caddr_t)&ip6->ip6_plen - (caddr_t)ip6);
681 goto bad;
682 }
683 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, *mp,
684 sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
685 if (hbh == NULL) {
686 ip6stat_inc(ip6s_tooshort);
687 goto bad;
688 }
689 nxt = hbh->ip6h_nxt;
690
691 /*
692 * accept the packet if a router alert option is included
693 * and we act as an IPv6 router.
694 */
695 if (rtalert != ~0 && ISSET(flags, IPV6_FORWARDING) &&
696 oursp != NULL)
697 *oursp = 1;
698 } else
699 nxt = ip6->ip6_nxt;
700
701 /*
702 * Check that the amount of data in the buffers
703 * is as at least much as the IPv6 header would have us expect.
704 * Trim mbufs if longer than we expect.
705 * Drop packet if shorter than we expect.
706 */
707 if ((*mp)->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
708 ip6stat_inc(ip6s_tooshort);
709 m_freemp(mp);
710 goto bad;
711 }
712 if ((*mp)->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
713 if ((*mp)->m_len == (*mp)->m_pkthdr.len) {
714 (*mp)->m_len = sizeof(struct ip6_hdr) + plen;
715 (*mp)->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
716 } else {
717 m_adj((*mp), sizeof(struct ip6_hdr) + plen -
718 (*mp)->m_pkthdr.len);
719 }
720 }
721
722 return nxt;
723 bad:
724 return IPPROTO_DONE;
725 }
726
727 /* scan packet for RH0 routing header. Mostly stolen from pf.c:pf_test() */
728 int
ip6_check_rh0hdr(struct mbuf * m,int * offp)729 ip6_check_rh0hdr(struct mbuf *m, int *offp)
730 {
731 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
732 struct ip6_rthdr rthdr;
733 struct ip6_ext opt6;
734 u_int8_t proto = ip6->ip6_nxt;
735 int done = 0, lim, off, rh_cnt = 0;
736
737 off = ((caddr_t)ip6 - m->m_data) + sizeof(struct ip6_hdr);
738 lim = min(m->m_pkthdr.len, ntohs(ip6->ip6_plen) + sizeof(*ip6));
739 do {
740 switch (proto) {
741 case IPPROTO_ROUTING:
742 if (rh_cnt++) {
743 /* more than one rh header present */
744 *offp = off;
745 return (1);
746 }
747
748 if (off + sizeof(rthdr) > lim) {
749 /* packet to short to make sense */
750 *offp = off;
751 return (1);
752 }
753
754 m_copydata(m, off, sizeof(rthdr), &rthdr);
755
756 if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
757 *offp = off +
758 offsetof(struct ip6_rthdr, ip6r_type);
759 return (1);
760 }
761
762 off += (rthdr.ip6r_len + 1) * 8;
763 proto = rthdr.ip6r_nxt;
764 break;
765 case IPPROTO_AH:
766 case IPPROTO_HOPOPTS:
767 case IPPROTO_DSTOPTS:
768 /* get next header and header length */
769 if (off + sizeof(opt6) > lim) {
770 /*
771 * Packet to short to make sense, we could
772 * reject the packet but as a router we
773 * should not do that so forward it.
774 */
775 return (0);
776 }
777
778 m_copydata(m, off, sizeof(opt6), &opt6);
779
780 if (proto == IPPROTO_AH)
781 off += (opt6.ip6e_len + 2) * 4;
782 else
783 off += (opt6.ip6e_len + 1) * 8;
784 proto = opt6.ip6e_nxt;
785 break;
786 case IPPROTO_FRAGMENT:
787 default:
788 /* end of header stack */
789 done = 1;
790 break;
791 }
792 } while (!done);
793
794 return (0);
795 }
796
797 /*
798 * Hop-by-Hop options header processing. If a valid jumbo payload option is
799 * included, the real payload length will be stored in plenp.
800 * On error free mbuf and return -1.
801 *
802 * rtalertp - XXX: should be stored in a more smart way
803 */
804 int
ip6_hopopts_input(struct mbuf ** mp,int * offp,u_int32_t * plenp,u_int32_t * rtalertp)805 ip6_hopopts_input(struct mbuf **mp, int *offp, u_int32_t *plenp,
806 u_int32_t *rtalertp)
807 {
808 int off = *offp, hbhlen;
809 struct ip6_hbh *hbh;
810
811 /* validation of the length of the header */
812 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, *mp,
813 sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
814 if (hbh == NULL) {
815 ip6stat_inc(ip6s_tooshort);
816 return -1;
817 }
818 hbhlen = (hbh->ip6h_len + 1) << 3;
819 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, *mp, sizeof(struct ip6_hdr),
820 hbhlen);
821 if (hbh == NULL) {
822 ip6stat_inc(ip6s_tooshort);
823 return -1;
824 }
825 off += hbhlen;
826 hbhlen -= sizeof(struct ip6_hbh);
827
828 if (ip6_process_hopopts(mp, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
829 hbhlen, rtalertp, plenp) < 0)
830 return (-1);
831
832 *offp = off;
833 return (0);
834 }
835
836 /*
837 * Search header for all Hop-by-hop options and process each option.
838 * This function is separate from ip6_hopopts_input() in order to
839 * handle a case where the sending node itself process its hop-by-hop
840 * options header. In such a case, the function is called from ip6_output().
841 * On error free mbuf and return -1.
842 *
843 * The function assumes that hbh header is located right after the IPv6 header
844 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
845 * opthead + hbhlen is located in continuous memory region.
846 */
847 int
ip6_process_hopopts(struct mbuf ** mp,u_int8_t * opthead,int hbhlen,u_int32_t * rtalertp,u_int32_t * plenp)848 ip6_process_hopopts(struct mbuf **mp, u_int8_t *opthead, int hbhlen,
849 u_int32_t *rtalertp, u_int32_t *plenp)
850 {
851 struct ip6_hdr *ip6;
852 int optlen = 0;
853 u_int8_t *opt = opthead;
854 u_int16_t rtalert_val;
855 u_int32_t jumboplen;
856 const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh);
857
858 for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) {
859 switch (*opt) {
860 case IP6OPT_PAD1:
861 optlen = 1;
862 break;
863 case IP6OPT_PADN:
864 if (hbhlen < IP6OPT_MINLEN) {
865 ip6stat_inc(ip6s_toosmall);
866 goto bad;
867 }
868 optlen = *(opt + 1) + 2;
869 break;
870 case IP6OPT_ROUTER_ALERT:
871 /* XXX may need check for alignment */
872 if (hbhlen < IP6OPT_RTALERT_LEN) {
873 ip6stat_inc(ip6s_toosmall);
874 goto bad;
875 }
876 if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) {
877 /* XXX stat */
878 icmp6_error(*mp, ICMP6_PARAM_PROB,
879 ICMP6_PARAMPROB_HEADER,
880 erroff + opt + 1 - opthead);
881 return (-1);
882 }
883 optlen = IP6OPT_RTALERT_LEN;
884 memcpy((caddr_t)&rtalert_val, (caddr_t)(opt + 2), 2);
885 *rtalertp = ntohs(rtalert_val);
886 break;
887 case IP6OPT_JUMBO:
888 /* XXX may need check for alignment */
889 if (hbhlen < IP6OPT_JUMBO_LEN) {
890 ip6stat_inc(ip6s_toosmall);
891 goto bad;
892 }
893 if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) {
894 /* XXX stat */
895 icmp6_error(*mp, ICMP6_PARAM_PROB,
896 ICMP6_PARAMPROB_HEADER,
897 erroff + opt + 1 - opthead);
898 return (-1);
899 }
900 optlen = IP6OPT_JUMBO_LEN;
901
902 /*
903 * IPv6 packets that have non 0 payload length
904 * must not contain a jumbo payload option.
905 */
906 ip6 = mtod(*mp, struct ip6_hdr *);
907 if (ip6->ip6_plen) {
908 ip6stat_inc(ip6s_badoptions);
909 icmp6_error(*mp, ICMP6_PARAM_PROB,
910 ICMP6_PARAMPROB_HEADER,
911 erroff + opt - opthead);
912 return (-1);
913 }
914
915 /*
916 * We may see jumbolen in unaligned location, so
917 * we'd need to perform memcpy().
918 */
919 memcpy(&jumboplen, opt + 2, sizeof(jumboplen));
920 jumboplen = (u_int32_t)htonl(jumboplen);
921
922 #if 1
923 /*
924 * if there are multiple jumbo payload options,
925 * *plenp will be non-zero and the packet will be
926 * rejected.
927 * the behavior may need some debate in ipngwg -
928 * multiple options does not make sense, however,
929 * there's no explicit mention in specification.
930 */
931 if (*plenp != 0) {
932 ip6stat_inc(ip6s_badoptions);
933 icmp6_error(*mp, ICMP6_PARAM_PROB,
934 ICMP6_PARAMPROB_HEADER,
935 erroff + opt + 2 - opthead);
936 return (-1);
937 }
938 #endif
939
940 /*
941 * jumbo payload length must be larger than 65535.
942 */
943 if (jumboplen <= IPV6_MAXPACKET) {
944 ip6stat_inc(ip6s_badoptions);
945 icmp6_error(*mp, ICMP6_PARAM_PROB,
946 ICMP6_PARAMPROB_HEADER,
947 erroff + opt + 2 - opthead);
948 return (-1);
949 }
950 *plenp = jumboplen;
951
952 break;
953 default: /* unknown option */
954 if (hbhlen < IP6OPT_MINLEN) {
955 ip6stat_inc(ip6s_toosmall);
956 goto bad;
957 }
958 optlen = ip6_unknown_opt(mp, opt,
959 erroff + opt - opthead);
960 if (optlen == -1)
961 return (-1);
962 optlen += 2;
963 break;
964 }
965 }
966
967 return (0);
968
969 bad:
970 m_freemp(mp);
971 return (-1);
972 }
973
974 /*
975 * Unknown option processing.
976 * The third argument `off' is the offset from the IPv6 header to the option,
977 * which allows returning an ICMPv6 error even if the IPv6 header and the
978 * option header are not continuous.
979 * On error free mbuf and return -1.
980 */
981 int
ip6_unknown_opt(struct mbuf ** mp,u_int8_t * optp,int off)982 ip6_unknown_opt(struct mbuf **mp, u_int8_t *optp, int off)
983 {
984 struct ip6_hdr *ip6;
985
986 switch (IP6OPT_TYPE(*optp)) {
987 case IP6OPT_TYPE_SKIP: /* ignore the option */
988 return ((int)*(optp + 1));
989 case IP6OPT_TYPE_DISCARD: /* silently discard */
990 m_freemp(mp);
991 return (-1);
992 case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */
993 ip6stat_inc(ip6s_badoptions);
994 icmp6_error(*mp, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off);
995 return (-1);
996 case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */
997 ip6stat_inc(ip6s_badoptions);
998 ip6 = mtod(*mp, struct ip6_hdr *);
999 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
1000 ((*mp)->m_flags & (M_BCAST|M_MCAST)))
1001 m_freemp(mp);
1002 else
1003 icmp6_error(*mp, ICMP6_PARAM_PROB,
1004 ICMP6_PARAMPROB_OPTION, off);
1005 return (-1);
1006 }
1007
1008 m_freemp(mp); /* XXX: NOTREACHED */
1009 return (-1);
1010 }
1011
1012 /*
1013 * Create the "control" list for this pcb.
1014 *
1015 * The routine will be called from upper layer handlers like udp_input().
1016 * Thus the routine assumes that the caller (udp_input) have already
1017 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the
1018 * very first mbuf on the mbuf chain.
1019 * We may want to add some infinite loop prevention or sanity checks for safety.
1020 * (This applies only when you are using KAME mbuf chain restriction, i.e.
1021 * you are using IP6_EXTHDR_CHECK() not m_pulldown())
1022 */
1023 void
ip6_savecontrol(struct inpcb * inp,struct mbuf * m,struct mbuf ** mp)1024 ip6_savecontrol(struct inpcb *inp, struct mbuf *m, struct mbuf **mp)
1025 {
1026 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1027
1028 if (inp->inp_socket->so_options & SO_TIMESTAMP) {
1029 struct timeval tv;
1030
1031 m_microtime(m, &tv);
1032 *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
1033 SCM_TIMESTAMP, SOL_SOCKET);
1034 if (*mp)
1035 mp = &(*mp)->m_next;
1036 }
1037
1038 /* RFC 2292 sec. 5 */
1039 if ((inp->inp_flags & IN6P_PKTINFO) != 0) {
1040 struct in6_pktinfo pi6;
1041 memcpy(&pi6.ipi6_addr, &ip6->ip6_dst, sizeof(struct in6_addr));
1042 if (IN6_IS_SCOPE_EMBED(&pi6.ipi6_addr))
1043 pi6.ipi6_addr.s6_addr16[1] = 0;
1044 pi6.ipi6_ifindex = m ? m->m_pkthdr.ph_ifidx : 0;
1045 *mp = sbcreatecontrol((caddr_t) &pi6,
1046 sizeof(struct in6_pktinfo),
1047 IPV6_PKTINFO, IPPROTO_IPV6);
1048 if (*mp)
1049 mp = &(*mp)->m_next;
1050 }
1051
1052 if ((inp->inp_flags & IN6P_HOPLIMIT) != 0) {
1053 int hlim = ip6->ip6_hlim & 0xff;
1054 *mp = sbcreatecontrol((caddr_t) &hlim, sizeof(int),
1055 IPV6_HOPLIMIT, IPPROTO_IPV6);
1056 if (*mp)
1057 mp = &(*mp)->m_next;
1058 }
1059
1060 if ((inp->inp_flags & IN6P_TCLASS) != 0) {
1061 u_int32_t flowinfo;
1062 int tclass;
1063
1064 flowinfo = (u_int32_t)ntohl(ip6->ip6_flow & IPV6_FLOWINFO_MASK);
1065 flowinfo >>= 20;
1066
1067 tclass = flowinfo & 0xff;
1068 *mp = sbcreatecontrol((caddr_t)&tclass, sizeof(tclass),
1069 IPV6_TCLASS, IPPROTO_IPV6);
1070 if (*mp)
1071 mp = &(*mp)->m_next;
1072 }
1073
1074 /*
1075 * IPV6_HOPOPTS socket option. Recall that we required super-user
1076 * privilege for the option (see ip6_ctloutput), but it might be too
1077 * strict, since there might be some hop-by-hop options which can be
1078 * returned to normal user.
1079 * See also RFC 2292 section 6 (or RFC 3542 section 8).
1080 */
1081 if ((inp->inp_flags & IN6P_HOPOPTS) != 0) {
1082 /*
1083 * Check if a hop-by-hop options header is contained in the
1084 * received packet, and if so, store the options as ancillary
1085 * data. Note that a hop-by-hop options header must be
1086 * just after the IPv6 header, which is assured through the
1087 * IPv6 input processing.
1088 */
1089 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1090 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
1091 struct ip6_hbh *hbh;
1092 int hbhlen = 0;
1093 struct mbuf *ext;
1094
1095 ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr),
1096 ip6->ip6_nxt);
1097 if (ext == NULL) {
1098 ip6stat_inc(ip6s_tooshort);
1099 return;
1100 }
1101 hbh = mtod(ext, struct ip6_hbh *);
1102 hbhlen = (hbh->ip6h_len + 1) << 3;
1103 if (hbhlen != ext->m_len) {
1104 m_freem(ext);
1105 ip6stat_inc(ip6s_tooshort);
1106 return;
1107 }
1108
1109 /*
1110 * XXX: We copy the whole header even if a
1111 * jumbo payload option is included, the option which
1112 * is to be removed before returning according to
1113 * RFC2292.
1114 * Note: this constraint is removed in RFC3542.
1115 */
1116 *mp = sbcreatecontrol((caddr_t)hbh, hbhlen,
1117 IPV6_HOPOPTS,
1118 IPPROTO_IPV6);
1119 if (*mp)
1120 mp = &(*mp)->m_next;
1121 m_freem(ext);
1122 }
1123 }
1124
1125 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */
1126 if ((inp->inp_flags & (IN6P_RTHDR | IN6P_DSTOPTS)) != 0) {
1127 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1128 int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr);
1129
1130 /*
1131 * Search for destination options headers or routing
1132 * header(s) through the header chain, and stores each
1133 * header as ancillary data.
1134 * Note that the order of the headers remains in
1135 * the chain of ancillary data.
1136 */
1137 while (1) { /* is explicit loop prevention necessary? */
1138 struct ip6_ext *ip6e = NULL;
1139 int elen;
1140 struct mbuf *ext = NULL;
1141
1142 /*
1143 * if it is not an extension header, don't try to
1144 * pull it from the chain.
1145 */
1146 switch (nxt) {
1147 case IPPROTO_DSTOPTS:
1148 case IPPROTO_ROUTING:
1149 case IPPROTO_HOPOPTS:
1150 case IPPROTO_AH: /* is it possible? */
1151 break;
1152 default:
1153 goto loopend;
1154 }
1155
1156 ext = ip6_pullexthdr(m, off, nxt);
1157 if (ext == NULL) {
1158 ip6stat_inc(ip6s_tooshort);
1159 return;
1160 }
1161 ip6e = mtod(ext, struct ip6_ext *);
1162 if (nxt == IPPROTO_AH)
1163 elen = (ip6e->ip6e_len + 2) << 2;
1164 else
1165 elen = (ip6e->ip6e_len + 1) << 3;
1166 if (elen != ext->m_len) {
1167 m_freem(ext);
1168 ip6stat_inc(ip6s_tooshort);
1169 return;
1170 }
1171
1172 switch (nxt) {
1173 case IPPROTO_DSTOPTS:
1174 if (!(inp->inp_flags & IN6P_DSTOPTS))
1175 break;
1176
1177 *mp = sbcreatecontrol((caddr_t)ip6e, elen,
1178 IPV6_DSTOPTS,
1179 IPPROTO_IPV6);
1180 if (*mp)
1181 mp = &(*mp)->m_next;
1182 break;
1183
1184 case IPPROTO_ROUTING:
1185 if (!(inp->inp_flags & IN6P_RTHDR))
1186 break;
1187
1188 *mp = sbcreatecontrol((caddr_t)ip6e, elen,
1189 IPV6_RTHDR,
1190 IPPROTO_IPV6);
1191 if (*mp)
1192 mp = &(*mp)->m_next;
1193 break;
1194
1195 case IPPROTO_HOPOPTS:
1196 case IPPROTO_AH: /* is it possible? */
1197 break;
1198
1199 default:
1200 /*
1201 * other cases have been filtered in the above.
1202 * none will visit this case. here we supply
1203 * the code just in case (nxt overwritten or
1204 * other cases).
1205 */
1206 m_freem(ext);
1207 goto loopend;
1208
1209 }
1210
1211 /* proceed with the next header. */
1212 off += elen;
1213 nxt = ip6e->ip6e_nxt;
1214 ip6e = NULL;
1215 m_freem(ext);
1216 ext = NULL;
1217 }
1218 loopend:
1219 ;
1220 }
1221 }
1222
1223 /*
1224 * pull single extension header from mbuf chain. returns single mbuf that
1225 * contains the result, or NULL on error.
1226 */
1227 struct mbuf *
ip6_pullexthdr(struct mbuf * m,size_t off,int nxt)1228 ip6_pullexthdr(struct mbuf *m, size_t off, int nxt)
1229 {
1230 struct ip6_ext ip6e;
1231 size_t elen;
1232 struct mbuf *n;
1233
1234 #ifdef DIAGNOSTIC
1235 switch (nxt) {
1236 case IPPROTO_DSTOPTS:
1237 case IPPROTO_ROUTING:
1238 case IPPROTO_HOPOPTS:
1239 case IPPROTO_AH: /* is it possible? */
1240 break;
1241 default:
1242 printf("ip6_pullexthdr: invalid nxt=%d\n", nxt);
1243 }
1244 #endif
1245
1246 if (off + sizeof(ip6e) > m->m_pkthdr.len)
1247 return NULL;
1248
1249 m_copydata(m, off, sizeof(ip6e), &ip6e);
1250 if (nxt == IPPROTO_AH)
1251 elen = (ip6e.ip6e_len + 2) << 2;
1252 else
1253 elen = (ip6e.ip6e_len + 1) << 3;
1254
1255 if (off + elen > m->m_pkthdr.len)
1256 return NULL;
1257
1258 MGET(n, M_DONTWAIT, MT_DATA);
1259 if (n && elen >= MLEN) {
1260 MCLGET(n, M_DONTWAIT);
1261 if ((n->m_flags & M_EXT) == 0) {
1262 m_free(n);
1263 n = NULL;
1264 }
1265 }
1266 if (n == NULL) {
1267 ip6stat_inc(ip6s_idropped);
1268 return NULL;
1269 }
1270
1271 n->m_len = 0;
1272 if (elen >= m_trailingspace(n)) {
1273 m_free(n);
1274 return NULL;
1275 }
1276
1277 m_copydata(m, off, elen, mtod(n, caddr_t));
1278 n->m_len = elen;
1279 return n;
1280 }
1281
1282 /*
1283 * Get offset to the previous header followed by the header
1284 * currently processed.
1285 */
1286 int
ip6_get_prevhdr(struct mbuf * m,int off)1287 ip6_get_prevhdr(struct mbuf *m, int off)
1288 {
1289 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1290
1291 if (off == sizeof(struct ip6_hdr)) {
1292 return offsetof(struct ip6_hdr, ip6_nxt);
1293 } else if (off < sizeof(struct ip6_hdr)) {
1294 panic("%s: off < sizeof(struct ip6_hdr)", __func__);
1295 } else {
1296 int len, nlen, nxt;
1297 struct ip6_ext ip6e;
1298
1299 nxt = ip6->ip6_nxt;
1300 len = sizeof(struct ip6_hdr);
1301 nlen = 0;
1302 while (len < off) {
1303 m_copydata(m, len, sizeof(ip6e), &ip6e);
1304
1305 switch (nxt) {
1306 case IPPROTO_FRAGMENT:
1307 nlen = sizeof(struct ip6_frag);
1308 break;
1309 case IPPROTO_AH:
1310 nlen = (ip6e.ip6e_len + 2) << 2;
1311 break;
1312 default:
1313 nlen = (ip6e.ip6e_len + 1) << 3;
1314 break;
1315 }
1316 len += nlen;
1317 nxt = ip6e.ip6e_nxt;
1318 }
1319
1320 return (len - nlen);
1321 }
1322 }
1323
1324 /*
1325 * get next header offset. m will be retained.
1326 */
1327 int
ip6_nexthdr(struct mbuf * m,int off,int proto,int * nxtp)1328 ip6_nexthdr(struct mbuf *m, int off, int proto, int *nxtp)
1329 {
1330 struct ip6_hdr ip6;
1331 struct ip6_ext ip6e;
1332 struct ip6_frag fh;
1333
1334 /* just in case */
1335 if (m == NULL)
1336 panic("%s: m == NULL", __func__);
1337 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off)
1338 return -1;
1339
1340 switch (proto) {
1341 case IPPROTO_IPV6:
1342 if (m->m_pkthdr.len < off + sizeof(ip6))
1343 return -1;
1344 m_copydata(m, off, sizeof(ip6), &ip6);
1345 if (nxtp)
1346 *nxtp = ip6.ip6_nxt;
1347 off += sizeof(ip6);
1348 return off;
1349
1350 case IPPROTO_FRAGMENT:
1351 /*
1352 * terminate parsing if it is not the first fragment,
1353 * it does not make sense to parse through it.
1354 */
1355 if (m->m_pkthdr.len < off + sizeof(fh))
1356 return -1;
1357 m_copydata(m, off, sizeof(fh), &fh);
1358 if ((fh.ip6f_offlg & IP6F_OFF_MASK) != 0)
1359 return -1;
1360 if (nxtp)
1361 *nxtp = fh.ip6f_nxt;
1362 off += sizeof(struct ip6_frag);
1363 return off;
1364
1365 case IPPROTO_AH:
1366 if (m->m_pkthdr.len < off + sizeof(ip6e))
1367 return -1;
1368 m_copydata(m, off, sizeof(ip6e), &ip6e);
1369 if (nxtp)
1370 *nxtp = ip6e.ip6e_nxt;
1371 off += (ip6e.ip6e_len + 2) << 2;
1372 if (m->m_pkthdr.len < off)
1373 return -1;
1374 return off;
1375
1376 case IPPROTO_HOPOPTS:
1377 case IPPROTO_ROUTING:
1378 case IPPROTO_DSTOPTS:
1379 if (m->m_pkthdr.len < off + sizeof(ip6e))
1380 return -1;
1381 m_copydata(m, off, sizeof(ip6e), &ip6e);
1382 if (nxtp)
1383 *nxtp = ip6e.ip6e_nxt;
1384 off += (ip6e.ip6e_len + 1) << 3;
1385 if (m->m_pkthdr.len < off)
1386 return -1;
1387 return off;
1388
1389 case IPPROTO_NONE:
1390 case IPPROTO_ESP:
1391 case IPPROTO_IPCOMP:
1392 /* give up */
1393 return -1;
1394
1395 default:
1396 return -1;
1397 }
1398
1399 return -1;
1400 }
1401
1402 /*
1403 * get offset for the last header in the chain. m will be kept untainted.
1404 */
1405 int
ip6_lasthdr(struct mbuf * m,int off,int proto,int * nxtp)1406 ip6_lasthdr(struct mbuf *m, int off, int proto, int *nxtp)
1407 {
1408 int newoff;
1409 int nxt;
1410
1411 if (!nxtp) {
1412 nxt = -1;
1413 nxtp = &nxt;
1414 }
1415 while (1) {
1416 newoff = ip6_nexthdr(m, off, proto, nxtp);
1417 if (newoff < 0)
1418 return off;
1419 else if (newoff < off)
1420 return -1; /* invalid */
1421 else if (newoff == off)
1422 return newoff;
1423
1424 off = newoff;
1425 proto = *nxtp;
1426 }
1427 }
1428
1429 /*
1430 * System control for IP6
1431 */
1432
1433 const u_char inet6ctlerrmap[PRC_NCMDS] = {
1434 0, 0, 0, 0,
1435 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH,
1436 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED,
1437 EMSGSIZE, EHOSTUNREACH, 0, 0,
1438 0, 0, 0, 0,
1439 ENOPROTOOPT
1440 };
1441
1442 #ifdef MROUTING
1443 extern int ip6_mrtproto;
1444 #endif
1445
1446 const struct sysctl_bounded_args ipv6ctl_vars_unlocked[] = {
1447 { IPV6CTL_FORWARDING, &ip6_forwarding, 0, 2 },
1448 { IPV6CTL_SENDREDIRECTS, &ip6_sendredirects, 0, 1 },
1449 };
1450
1451 const struct sysctl_bounded_args ipv6ctl_vars[] = {
1452 { IPV6CTL_DAD_PENDING, &ip6_dad_pending, SYSCTL_INT_READONLY },
1453 #ifdef MROUTING
1454 { IPV6CTL_MRTPROTO, &ip6_mrtproto, SYSCTL_INT_READONLY },
1455 #endif
1456 { IPV6CTL_DEFHLIM, &ip6_defhlim, 0, 255 },
1457 { IPV6CTL_MAXFRAGPACKETS, &ip6_maxfragpackets, 0, 1000 },
1458 { IPV6CTL_LOG_INTERVAL, &ip6_log_interval, 0, INT_MAX },
1459 { IPV6CTL_HDRNESTLIMIT, &ip6_hdrnestlimit, 0, 100 },
1460 { IPV6CTL_DAD_COUNT, &ip6_dad_count, 0, 10 },
1461 { IPV6CTL_AUTO_FLOWLABEL, &ip6_auto_flowlabel, 0, 1 },
1462 { IPV6CTL_DEFMCASTHLIM, &ip6_defmcasthlim, 0, 255 },
1463 { IPV6CTL_USE_DEPRECATED, &ip6_use_deprecated, 0, 1 },
1464 { IPV6CTL_MAXFRAGS, &ip6_maxfrags, 0, 1000 },
1465 { IPV6CTL_MFORWARDING, &ip6_mforwarding, 0, 1 },
1466 { IPV6CTL_MCAST_PMTU, &ip6_mcast_pmtu, 0, 1 },
1467 { IPV6CTL_NEIGHBORGCTHRESH, &ip6_neighborgcthresh, -1, 5 * 2048 },
1468 { IPV6CTL_MAXDYNROUTES, &ip6_maxdynroutes, -1, 5 * 4096 },
1469 };
1470
1471 int
ip6_sysctl_ip6stat(void * oldp,size_t * oldlenp,void * newp)1472 ip6_sysctl_ip6stat(void *oldp, size_t *oldlenp, void *newp)
1473 {
1474 struct ip6stat *ip6stat;
1475 int ret;
1476
1477 CTASSERT(sizeof(*ip6stat) == (ip6s_ncounters * sizeof(uint64_t)));
1478
1479 ip6stat = malloc(sizeof(*ip6stat), M_TEMP, M_WAITOK);
1480 counters_read(ip6counters, (uint64_t *)ip6stat, ip6s_ncounters, NULL);
1481 ret = sysctl_rdstruct(oldp, oldlenp, newp,
1482 ip6stat, sizeof(*ip6stat));
1483 free(ip6stat, M_TEMP, sizeof(*ip6stat));
1484
1485 return (ret);
1486 }
1487
1488 int
ip6_sysctl_soiikey(void * oldp,size_t * oldlenp,void * newp,size_t newlen)1489 ip6_sysctl_soiikey(void *oldp, size_t *oldlenp, void *newp, size_t newlen)
1490 {
1491 uint8_t oldkey[IP6_SOIIKEY_LEN];
1492 int error;
1493
1494 error = suser(curproc);
1495 if (error != 0)
1496 return (error);
1497
1498 memcpy(oldkey, ip6_soiikey, sizeof(oldkey));
1499
1500 error = sysctl_struct(oldp, oldlenp, newp, newlen, ip6_soiikey,
1501 sizeof(ip6_soiikey));
1502
1503 return (error);
1504 }
1505
1506 int
ip6_sysctl(int * name,u_int namelen,void * oldp,size_t * oldlenp,void * newp,size_t newlen)1507 ip6_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp,
1508 void *newp, size_t newlen)
1509 {
1510 #ifdef MROUTING
1511 extern struct mrt6stat mrt6stat;
1512 #endif
1513 int oldval, error;
1514
1515 /* Almost all sysctl names at this level are terminal. */
1516 if (namelen != 1 && name[0] != IPV6CTL_IFQUEUE)
1517 return (ENOTDIR);
1518
1519 switch (name[0]) {
1520 case IPV6CTL_STATS:
1521 return (ip6_sysctl_ip6stat(oldp, oldlenp, newp));
1522 #ifdef MROUTING
1523 case IPV6CTL_MRTSTATS:
1524 if (newp != NULL)
1525 return (EPERM);
1526 NET_LOCK();
1527 error = sysctl_struct(oldp, oldlenp, newp, newlen,
1528 &mrt6stat, sizeof(mrt6stat));
1529 NET_UNLOCK();
1530 return (error);
1531 case IPV6CTL_MRTMIF:
1532 if (newp)
1533 return (EPERM);
1534 NET_LOCK();
1535 error = mrt6_sysctl_mif(oldp, oldlenp);
1536 NET_UNLOCK();
1537 return (error);
1538 case IPV6CTL_MRTMFC:
1539 if (newp)
1540 return (EPERM);
1541 NET_LOCK();
1542 error = mrt6_sysctl_mfc(oldp, oldlenp);
1543 NET_UNLOCK();
1544 return (error);
1545 #else
1546 case IPV6CTL_MRTSTATS:
1547 case IPV6CTL_MRTPROTO:
1548 case IPV6CTL_MRTMIF:
1549 case IPV6CTL_MRTMFC:
1550 return (EOPNOTSUPP);
1551 #endif
1552 case IPV6CTL_MTUDISCTIMEOUT:
1553 NET_LOCK();
1554 error = sysctl_int_bounded(oldp, oldlenp, newp, newlen,
1555 &ip6_mtudisc_timeout, 0, INT_MAX);
1556 rt_timer_queue_change(&icmp6_mtudisc_timeout_q,
1557 ip6_mtudisc_timeout);
1558 NET_UNLOCK();
1559 return (error);
1560 case IPV6CTL_IFQUEUE:
1561 return (sysctl_niq(name + 1, namelen - 1,
1562 oldp, oldlenp, newp, newlen, &ip6intrq));
1563 case IPV6CTL_SOIIKEY:
1564 return (ip6_sysctl_soiikey(oldp, oldlenp, newp, newlen));
1565 case IPV6CTL_MULTIPATH:
1566 NET_LOCK();
1567 oldval = ip6_multipath;
1568 error = sysctl_int_bounded(oldp, oldlenp, newp, newlen,
1569 &ip6_multipath, 0, 1);
1570 if (oldval != ip6_multipath)
1571 atomic_inc_long(&rtgeneration);
1572 NET_UNLOCK();
1573 return (error);
1574 case IPV6CTL_FORWARDING:
1575 case IPV6CTL_SENDREDIRECTS:
1576 return (sysctl_bounded_arr(
1577 ipv6ctl_vars_unlocked, nitems(ipv6ctl_vars_unlocked),
1578 name, namelen, oldp, oldlenp, newp, newlen));
1579 default:
1580 NET_LOCK();
1581 error = sysctl_bounded_arr(ipv6ctl_vars, nitems(ipv6ctl_vars),
1582 name, namelen, oldp, oldlenp, newp, newlen);
1583 NET_UNLOCK();
1584 return (error);
1585 }
1586 /* NOTREACHED */
1587 }
1588
1589 void
ip6_send_dispatch(void * xmq)1590 ip6_send_dispatch(void *xmq)
1591 {
1592 struct mbuf_queue *mq = xmq;
1593 struct mbuf *m;
1594 struct mbuf_list ml;
1595
1596 mq_delist(mq, &ml);
1597 if (ml_empty(&ml))
1598 return;
1599
1600 NET_LOCK_SHARED();
1601 while ((m = ml_dequeue(&ml)) != NULL) {
1602 ip6_output(m, NULL, NULL, 0, NULL, NULL);
1603 }
1604 NET_UNLOCK_SHARED();
1605 }
1606
1607 void
ip6_send(struct mbuf * m)1608 ip6_send(struct mbuf *m)
1609 {
1610 mq_enqueue(&ip6send_mq, m);
1611 task_add(net_tq(0), &ip6send_task);
1612 }
1613