1 /* $FreeBSD: src/sys/netinet6/ip6_input.c,v 1.11.2.15 2003/01/24 05:11:35 sam Exp $ */ 2 /* $DragonFly: src/sys/netinet6/ip6_input.c,v 1.12 2004/03/06 01:58:56 hsu Exp $ */ 3 /* $KAME: ip6_input.c,v 1.259 2002/01/21 04:58:09 jinmei Exp $ */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 /* 35 * Copyright (c) 1982, 1986, 1988, 1993 36 * The Regents of the University of California. All rights reserved. 37 * 38 * Redistribution and use in source and binary forms, with or without 39 * modification, are permitted provided that the following conditions 40 * are met: 41 * 1. Redistributions of source code must retain the above copyright 42 * notice, this list of conditions and the following disclaimer. 43 * 2. Redistributions in binary form must reproduce the above copyright 44 * notice, this list of conditions and the following disclaimer in the 45 * documentation and/or other materials provided with the distribution. 46 * 3. All advertising materials mentioning features or use of this software 47 * must display the following acknowledgement: 48 * This product includes software developed by the University of 49 * California, Berkeley and its contributors. 50 * 4. Neither the name of the University nor the names of its contributors 51 * may be used to endorse or promote products derived from this software 52 * without specific prior written permission. 53 * 54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 64 * SUCH DAMAGE. 65 * 66 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 67 */ 68 69 #include "opt_ip6fw.h" 70 #include "opt_inet.h" 71 #include "opt_inet6.h" 72 #include "opt_ipsec.h" 73 #include "opt_pfil_hooks.h" 74 75 #include <sys/param.h> 76 #include <sys/systm.h> 77 #include <sys/malloc.h> 78 #include <sys/mbuf.h> 79 #include <sys/domain.h> 80 #include <sys/protosw.h> 81 #include <sys/socket.h> 82 #include <sys/socketvar.h> 83 #include <sys/errno.h> 84 #include <sys/time.h> 85 #include <sys/kernel.h> 86 #include <sys/syslog.h> 87 #include <sys/proc.h> 88 89 #include <net/if.h> 90 #include <net/if_types.h> 91 #include <net/if_dl.h> 92 #include <net/route.h> 93 #include <net/netisr.h> 94 #ifdef PFIL_HOOKS 95 #include <net/pfil.h> 96 #endif 97 98 #include <netinet/in.h> 99 #include <netinet/in_systm.h> 100 #ifdef INET 101 #include <netinet/ip.h> 102 #include <netinet/ip_icmp.h> 103 #endif /* INET */ 104 #include <netinet/ip6.h> 105 #include <netinet6/in6_var.h> 106 #include <netinet6/ip6_var.h> 107 #include <netinet/in_pcb.h> 108 #include <netinet/icmp6.h> 109 #include <netinet6/in6_ifattach.h> 110 #include <netinet6/nd6.h> 111 #include <netinet6/in6_prefix.h> 112 113 #ifdef IPSEC 114 #include <netinet6/ipsec.h> 115 #ifdef INET6 116 #include <netinet6/ipsec6.h> 117 #endif 118 #endif 119 120 #ifdef FAST_IPSEC 121 #include "ipsec.h" 122 #include "ipsec6.h" 123 #define IPSEC 124 #endif /* FAST_IPSEC */ 125 126 #include <net/ip6fw/ip6_fw.h> 127 128 #include <netinet6/ip6protosw.h> 129 130 /* we need it for NLOOP. */ 131 #include "use_loop.h" 132 133 #include <net/net_osdep.h> 134 135 extern struct domain inet6domain; 136 extern struct ip6protosw inet6sw[]; 137 138 u_char ip6_protox[IPPROTO_MAX]; 139 struct in6_ifaddr *in6_ifaddr; 140 141 extern struct callout in6_tmpaddrtimer_ch; 142 143 int ip6_forward_srcrt; /* XXX */ 144 int ip6_sourcecheck; /* XXX */ 145 int ip6_sourcecheck_interval; /* XXX */ 146 147 int ip6_ours_check_algorithm; 148 149 #ifdef PFIL_HOOKS 150 struct pfil_head inet6_pfil_hook; 151 #endif 152 153 /* firewall hooks */ 154 ip6_fw_chk_t *ip6_fw_chk_ptr; 155 ip6_fw_ctl_t *ip6_fw_ctl_ptr; 156 int ip6_fw_enable = 1; 157 158 struct ip6stat ip6stat; 159 160 static void ip6_init2 (void *); 161 static struct ip6aux *ip6_setdstifaddr (struct mbuf *, struct in6_ifaddr *); 162 static int ip6_hopopts_input (u_int32_t *, u_int32_t *, struct mbuf **, int *); 163 #ifdef PULLDOWN_TEST 164 static struct mbuf *ip6_pullexthdr (struct mbuf *, size_t, int); 165 #endif 166 167 /* 168 * IP6 initialization: fill in IP6 protocol switch table. 169 * All protocols not implemented in kernel go to raw IP6 protocol handler. 170 */ 171 void 172 ip6_init() 173 { 174 struct ip6protosw *pr; 175 int i; 176 struct timeval tv; 177 178 #ifdef DIAGNOSTIC 179 if (sizeof(struct protosw) != sizeof(struct ip6protosw)) 180 panic("sizeof(protosw) != sizeof(ip6protosw)"); 181 #endif 182 pr = (struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW); 183 if (pr == 0) 184 panic("ip6_init"); 185 for (i = 0; i < IPPROTO_MAX; i++) 186 ip6_protox[i] = pr - inet6sw; 187 for (pr = (struct ip6protosw *)inet6domain.dom_protosw; 188 pr < (struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++) 189 if (pr->pr_domain->dom_family == PF_INET6 && 190 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) 191 ip6_protox[pr->pr_protocol] = pr - inet6sw; 192 193 #ifdef PFIL_HOOKS 194 inet6_pfil_hook.ph_type = PFIL_TYPE_AF; 195 inet6_pfil_hook.ph_af = AF_INET6; 196 if ((i = pfil_head_register(&inet6_pfil_hook)) != 0) 197 printf("%s: WARNING: unable to register pfil hook, " 198 "error %d\n", __func__, i); 199 #endif /* PFIL_HOOKS */ 200 201 netisr_register(NETISR_IPV6, cpu0_portfn, ip6_input); 202 nd6_init(); 203 frag6_init(); 204 /* 205 * in many cases, random() here does NOT return random number 206 * as initialization during bootstrap time occur in fixed order. 207 */ 208 microtime(&tv); 209 ip6_flow_seq = random() ^ tv.tv_usec; 210 microtime(&tv); 211 ip6_desync_factor = (random() ^ tv.tv_usec) % MAX_TEMP_DESYNC_FACTOR; 212 } 213 214 static void 215 ip6_init2(dummy) 216 void *dummy; 217 { 218 219 /* 220 * to route local address of p2p link to loopback, 221 * assign loopback address first. 222 */ 223 in6_ifattach(&loif[0], NULL); 224 225 /* nd6_timer_init */ 226 callout_init(&nd6_timer_ch); 227 callout_reset(&nd6_timer_ch, hz, nd6_timer, NULL); 228 229 /* router renumbering prefix list maintenance */ 230 callout_init(&in6_rr_timer_ch); 231 callout_reset(&in6_rr_timer_ch, hz, in6_rr_timer, NULL); 232 233 /* timer for regeneranation of temporary addresses randomize ID */ 234 callout_reset(&in6_tmpaddrtimer_ch, 235 (ip6_temp_preferred_lifetime - ip6_desync_factor - 236 ip6_temp_regen_advance) * hz, 237 in6_tmpaddrtimer, NULL); 238 } 239 240 /* cheat */ 241 /* This must be after route_init(), which is now SI_ORDER_THIRD */ 242 SYSINIT(netinet6init2, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ip6_init2, NULL); 243 244 extern struct route_in6 ip6_forward_rt; 245 246 void 247 ip6_input(struct netmsg *msg) 248 { 249 struct mbuf *m = ((struct netmsg_packet *)msg)->nm_packet; 250 struct ip6_hdr *ip6; 251 int off = sizeof(struct ip6_hdr), nest; 252 u_int32_t plen; 253 u_int32_t rtalert = ~0; 254 int nxt, ours = 0; 255 struct ifnet *deliverifp = NULL; 256 #ifdef PFIL_HOOKS 257 struct in6_addr odst; 258 #endif 259 int srcrt = 0; 260 261 #ifdef IPSEC 262 /* 263 * should the inner packet be considered authentic? 264 * see comment in ah4_input(). 265 */ 266 if (m) { 267 m->m_flags &= ~M_AUTHIPHDR; 268 m->m_flags &= ~M_AUTHIPDGM; 269 } 270 #endif 271 272 /* 273 * make sure we don't have onion peering information into m_aux. 274 */ 275 ip6_delaux(m); 276 277 /* 278 * mbuf statistics 279 */ 280 if (m->m_flags & M_EXT) { 281 if (m->m_next) 282 ip6stat.ip6s_mext2m++; 283 else 284 ip6stat.ip6s_mext1++; 285 } else { 286 #define M2MMAX (sizeof(ip6stat.ip6s_m2m)/sizeof(ip6stat.ip6s_m2m[0])) 287 if (m->m_next) { 288 if (m->m_flags & M_LOOP) { 289 ip6stat.ip6s_m2m[loif[0].if_index]++; /* XXX */ 290 } else if (m->m_pkthdr.rcvif->if_index < M2MMAX) 291 ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++; 292 else 293 ip6stat.ip6s_m2m[0]++; 294 } else 295 ip6stat.ip6s_m1++; 296 #undef M2MMAX 297 } 298 299 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive); 300 ip6stat.ip6s_total++; 301 302 #ifndef PULLDOWN_TEST 303 /* 304 * L2 bridge code and some other code can return mbuf chain 305 * that does not conform to KAME requirement. too bad. 306 * XXX: fails to join if interface MTU > MCLBYTES. jumbogram? 307 */ 308 if (m && m->m_next != NULL && m->m_pkthdr.len < MCLBYTES) { 309 struct mbuf *n; 310 311 MGETHDR(n, M_DONTWAIT, MT_HEADER); 312 if (n) 313 M_MOVE_PKTHDR(n, m); 314 if (n && n->m_pkthdr.len > MHLEN) { 315 MCLGET(n, M_DONTWAIT); 316 if ((n->m_flags & M_EXT) == 0) { 317 m_freem(n); 318 n = NULL; 319 } 320 } 321 if (n == NULL) { 322 m_freem(m); 323 return; /*ENOBUFS*/ 324 } 325 326 m_copydata(m, 0, n->m_pkthdr.len, mtod(n, caddr_t)); 327 n->m_len = n->m_pkthdr.len; 328 m_freem(m); 329 m = n; 330 } 331 IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), /*nothing*/); 332 #endif 333 334 if (m->m_len < sizeof(struct ip6_hdr)) { 335 struct ifnet *inifp; 336 inifp = m->m_pkthdr.rcvif; 337 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == 0) { 338 ip6stat.ip6s_toosmall++; 339 in6_ifstat_inc(inifp, ifs6_in_hdrerr); 340 return; 341 } 342 } 343 344 ip6 = mtod(m, struct ip6_hdr *); 345 346 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) { 347 ip6stat.ip6s_badvers++; 348 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 349 goto bad; 350 } 351 352 #ifdef PFIL_HOOKS 353 /* 354 * Run through list of hooks for input packets. 355 * 356 * NB: Beware of the destination address changing 357 * (e.g. by NAT rewriting). When this happens, 358 * tell ip6_forward to do the right thing. 359 */ 360 odst = ip6->ip6_dst; 361 if (pfil_run_hooks(&inet6_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN)) 362 return; 363 if (m == NULL) /* consumed by filter */ 364 return; 365 ip6 = mtod(m, struct ip6_hdr *); 366 srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst); 367 #endif /* PFIL_HOOKS */ 368 369 ip6stat.ip6s_nxthist[ip6->ip6_nxt]++; 370 371 /* 372 * Check with the firewall... 373 */ 374 if (ip6_fw_enable && ip6_fw_chk_ptr) { 375 u_short port = 0; 376 /* If ipfw says divert, we have to just drop packet */ 377 /* use port as a dummy argument */ 378 if ((*ip6_fw_chk_ptr)(&ip6, NULL, &port, &m)) { 379 m_freem(m); 380 m = NULL; 381 } 382 if (!m) 383 return; 384 } 385 386 /* 387 * Check against address spoofing/corruption. 388 */ 389 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) || 390 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { 391 /* 392 * XXX: "badscope" is not very suitable for a multicast source. 393 */ 394 ip6stat.ip6s_badscope++; 395 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 396 goto bad; 397 } 398 if ((IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) || 399 IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) && 400 (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { 401 ip6stat.ip6s_badscope++; 402 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 403 goto bad; 404 } 405 406 /* 407 * The following check is not documented in specs. A malicious 408 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack 409 * and bypass security checks (act as if it was from 127.0.0.1 by using 410 * IPv6 src ::ffff:127.0.0.1). Be cautious. 411 * 412 * This check chokes if we are in an SIIT cloud. As none of BSDs 413 * support IPv4-less kernel compilation, we cannot support SIIT 414 * environment at all. So, it makes more sense for us to reject any 415 * malicious packets for non-SIIT environment, than try to do a 416 * partical support for SIIT environment. 417 */ 418 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 419 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 420 ip6stat.ip6s_badscope++; 421 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 422 goto bad; 423 } 424 #if 0 425 /* 426 * Reject packets with IPv4 compatible addresses (auto tunnel). 427 * 428 * The code forbids auto tunnel relay case in RFC1933 (the check is 429 * stronger than RFC1933). We may want to re-enable it if mech-xx 430 * is revised to forbid relaying case. 431 */ 432 if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) || 433 IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) { 434 ip6stat.ip6s_badscope++; 435 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 436 goto bad; 437 } 438 #endif 439 440 /* drop packets if interface ID portion is already filled */ 441 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { 442 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src) && 443 ip6->ip6_src.s6_addr16[1]) { 444 ip6stat.ip6s_badscope++; 445 goto bad; 446 } 447 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) && 448 ip6->ip6_dst.s6_addr16[1]) { 449 ip6stat.ip6s_badscope++; 450 goto bad; 451 } 452 } 453 454 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) 455 ip6->ip6_src.s6_addr16[1] 456 = htons(m->m_pkthdr.rcvif->if_index); 457 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) 458 ip6->ip6_dst.s6_addr16[1] 459 = htons(m->m_pkthdr.rcvif->if_index); 460 461 #if 0 /* this case seems to be unnecessary. (jinmei, 20010401) */ 462 /* 463 * We use rt->rt_ifp to determine if the address is ours or not. 464 * If rt_ifp is lo0, the address is ours. 465 * The problem here is, rt->rt_ifp for fe80::%lo0/64 is set to lo0, 466 * so any address under fe80::%lo0/64 will be mistakenly considered 467 * local. The special case is supplied to handle the case properly 468 * by actually looking at interface addresses 469 * (using in6ifa_ifpwithaddr). 470 */ 471 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) != 0 && 472 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) { 473 if (!in6ifa_ifpwithaddr(m->m_pkthdr.rcvif, &ip6->ip6_dst)) { 474 icmp6_error(m, ICMP6_DST_UNREACH, 475 ICMP6_DST_UNREACH_ADDR, 0); 476 /* m is already freed */ 477 return; 478 } 479 480 ours = 1; 481 deliverifp = m->m_pkthdr.rcvif; 482 goto hbhcheck; 483 } 484 #endif 485 486 /* 487 * Multicast check 488 */ 489 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 490 struct in6_multi *in6m = 0; 491 492 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast); 493 /* 494 * See if we belong to the destination multicast group on the 495 * arrival interface. 496 */ 497 IN6_LOOKUP_MULTI(ip6->ip6_dst, m->m_pkthdr.rcvif, in6m); 498 if (in6m) 499 ours = 1; 500 else if (!ip6_mrouter) { 501 ip6stat.ip6s_notmember++; 502 ip6stat.ip6s_cantforward++; 503 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 504 goto bad; 505 } 506 deliverifp = m->m_pkthdr.rcvif; 507 goto hbhcheck; 508 } 509 510 /* 511 * Unicast check 512 */ 513 switch (ip6_ours_check_algorithm) { 514 default: 515 /* 516 * XXX: I intentionally broke our indentation rule here, 517 * since this switch-case is just for measurement and 518 * therefore should soon be removed. 519 */ 520 if (ip6_forward_rt.ro_rt != NULL && 521 (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) != 0 && 522 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 523 &((struct sockaddr_in6 *)(&ip6_forward_rt.ro_dst))->sin6_addr)) 524 ip6stat.ip6s_forward_cachehit++; 525 else { 526 struct sockaddr_in6 *dst6; 527 528 if (ip6_forward_rt.ro_rt) { 529 /* route is down or destination is different */ 530 ip6stat.ip6s_forward_cachemiss++; 531 RTFREE(ip6_forward_rt.ro_rt); 532 ip6_forward_rt.ro_rt = 0; 533 } 534 535 bzero(&ip6_forward_rt.ro_dst, sizeof(struct sockaddr_in6)); 536 dst6 = (struct sockaddr_in6 *)&ip6_forward_rt.ro_dst; 537 dst6->sin6_len = sizeof(struct sockaddr_in6); 538 dst6->sin6_family = AF_INET6; 539 dst6->sin6_addr = ip6->ip6_dst; 540 #ifdef SCOPEDROUTING 541 ip6_forward_rt.ro_dst.sin6_scope_id = 542 in6_addr2scopeid(m->m_pkthdr.rcvif, &ip6->ip6_dst); 543 #endif 544 545 rtalloc_ign((struct route *)&ip6_forward_rt, RTF_PRCLONING); 546 } 547 548 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key)) 549 550 /* 551 * Accept the packet if the forwarding interface to the destination 552 * according to the routing table is the loopback interface, 553 * unless the associated route has a gateway. 554 * Note that this approach causes to accept a packet if there is a 555 * route to the loopback interface for the destination of the packet. 556 * But we think it's even useful in some situations, e.g. when using 557 * a special daemon which wants to intercept the packet. 558 * 559 * XXX: some OSes automatically make a cloned route for the destination 560 * of an outgoing packet. If the outgoing interface of the packet 561 * is a loopback one, the kernel would consider the packet to be 562 * accepted, even if we have no such address assinged on the interface. 563 * We check the cloned flag of the route entry to reject such cases, 564 * assuming that route entries for our own addresses are not made by 565 * cloning (it should be true because in6_addloop explicitly installs 566 * the host route). However, we might have to do an explicit check 567 * while it would be less efficient. Or, should we rather install a 568 * reject route for such a case? 569 */ 570 if (ip6_forward_rt.ro_rt && 571 (ip6_forward_rt.ro_rt->rt_flags & 572 (RTF_HOST|RTF_GATEWAY)) == RTF_HOST && 573 #ifdef RTF_WASCLONED 574 !(ip6_forward_rt.ro_rt->rt_flags & RTF_WASCLONED) && 575 #endif 576 #ifdef RTF_CLONED 577 !(ip6_forward_rt.ro_rt->rt_flags & RTF_CLONED) && 578 #endif 579 #if 0 580 /* 581 * The check below is redundant since the comparison of 582 * the destination and the key of the rtentry has 583 * already done through looking up the routing table. 584 */ 585 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 586 &rt6_key(ip6_forward_rt.ro_rt)->sin6_addr) 587 #endif 588 ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_LOOP) { 589 struct in6_ifaddr *ia6 = 590 (struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa; 591 592 /* 593 * record address information into m_aux. 594 */ 595 (void)ip6_setdstifaddr(m, ia6); 596 597 /* 598 * packets to a tentative, duplicated, or somehow invalid 599 * address must not be accepted. 600 */ 601 if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) { 602 /* this address is ready */ 603 ours = 1; 604 deliverifp = ia6->ia_ifp; /* correct? */ 605 /* Count the packet in the ip address stats */ 606 ia6->ia_ifa.if_ipackets++; 607 ia6->ia_ifa.if_ibytes += m->m_pkthdr.len; 608 goto hbhcheck; 609 } else { 610 /* address is not ready, so discard the packet. */ 611 nd6log((LOG_INFO, 612 "ip6_input: packet to an unready address %s->%s\n", 613 ip6_sprintf(&ip6->ip6_src), 614 ip6_sprintf(&ip6->ip6_dst))); 615 616 goto bad; 617 } 618 } 619 } /* XXX indentation (see above) */ 620 621 /* 622 * FAITH(Firewall Aided Internet Translator) 623 */ 624 if (ip6_keepfaith) { 625 if (ip6_forward_rt.ro_rt && ip6_forward_rt.ro_rt->rt_ifp 626 && ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) { 627 /* XXX do we need more sanity checks? */ 628 ours = 1; 629 deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /* faith */ 630 goto hbhcheck; 631 } 632 } 633 634 /* 635 * Now there is no reason to process the packet if it's not our own 636 * and we're not a router. 637 */ 638 if (!ip6_forwarding) { 639 ip6stat.ip6s_cantforward++; 640 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 641 goto bad; 642 } 643 644 hbhcheck: 645 /* 646 * record address information into m_aux, if we don't have one yet. 647 * note that we are unable to record it, if the address is not listed 648 * as our interface address (e.g. multicast addresses, addresses 649 * within FAITH prefixes and such). 650 */ 651 if (deliverifp && !ip6_getdstifaddr(m)) { 652 struct in6_ifaddr *ia6; 653 654 ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst); 655 if (ia6) { 656 if (!ip6_setdstifaddr(m, ia6)) { 657 /* 658 * XXX maybe we should drop the packet here, 659 * as we could not provide enough information 660 * to the upper layers. 661 */ 662 } 663 } 664 } 665 666 /* 667 * Process Hop-by-Hop options header if it's contained. 668 * m may be modified in ip6_hopopts_input(). 669 * If a JumboPayload option is included, plen will also be modified. 670 */ 671 plen = (u_int32_t)ntohs(ip6->ip6_plen); 672 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 673 struct ip6_hbh *hbh; 674 675 if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) { 676 #if 0 /*touches NULL pointer*/ 677 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 678 #endif 679 return; /* m have already been freed */ 680 } 681 682 /* adjust pointer */ 683 ip6 = mtod(m, struct ip6_hdr *); 684 685 /* 686 * if the payload length field is 0 and the next header field 687 * indicates Hop-by-Hop Options header, then a Jumbo Payload 688 * option MUST be included. 689 */ 690 if (ip6->ip6_plen == 0 && plen == 0) { 691 /* 692 * Note that if a valid jumbo payload option is 693 * contained, ip6_hoptops_input() must set a valid 694 * (non-zero) payload length to the variable plen. 695 */ 696 ip6stat.ip6s_badoptions++; 697 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 698 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 699 icmp6_error(m, ICMP6_PARAM_PROB, 700 ICMP6_PARAMPROB_HEADER, 701 (caddr_t)&ip6->ip6_plen - (caddr_t)ip6); 702 return; 703 } 704 #ifndef PULLDOWN_TEST 705 /* ip6_hopopts_input() ensures that mbuf is contiguous */ 706 hbh = (struct ip6_hbh *)(ip6 + 1); 707 #else 708 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 709 sizeof(struct ip6_hbh)); 710 if (hbh == NULL) { 711 ip6stat.ip6s_tooshort++; 712 return; 713 } 714 #endif 715 nxt = hbh->ip6h_nxt; 716 717 /* 718 * accept the packet if a router alert option is included 719 * and we act as an IPv6 router. 720 */ 721 if (rtalert != ~0 && ip6_forwarding) 722 ours = 1; 723 } else 724 nxt = ip6->ip6_nxt; 725 726 /* 727 * Check that the amount of data in the buffers 728 * is as at least much as the IPv6 header would have us expect. 729 * Trim mbufs if longer than we expect. 730 * Drop packet if shorter than we expect. 731 */ 732 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) { 733 ip6stat.ip6s_tooshort++; 734 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 735 goto bad; 736 } 737 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) { 738 if (m->m_len == m->m_pkthdr.len) { 739 m->m_len = sizeof(struct ip6_hdr) + plen; 740 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen; 741 } else 742 m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len); 743 } 744 745 /* 746 * Forward if desirable. 747 */ 748 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 749 /* 750 * If we are acting as a multicast router, all 751 * incoming multicast packets are passed to the 752 * kernel-level multicast forwarding function. 753 * The packet is returned (relatively) intact; if 754 * ip6_mforward() returns a non-zero value, the packet 755 * must be discarded, else it may be accepted below. 756 */ 757 if (ip6_mrouter && ip6_mforward(ip6, m->m_pkthdr.rcvif, m)) { 758 ip6stat.ip6s_cantforward++; 759 m_freem(m); 760 return; 761 } 762 if (!ours) { 763 m_freem(m); 764 return; 765 } 766 } else if (!ours) { 767 ip6_forward(m, srcrt); 768 return; 769 } 770 771 ip6 = mtod(m, struct ip6_hdr *); 772 773 /* 774 * Malicious party may be able to use IPv4 mapped addr to confuse 775 * tcp/udp stack and bypass security checks (act as if it was from 776 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious. 777 * 778 * For SIIT end node behavior, you may want to disable the check. 779 * However, you will become vulnerable to attacks using IPv4 mapped 780 * source. 781 */ 782 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 783 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 784 ip6stat.ip6s_badscope++; 785 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 786 goto bad; 787 } 788 789 /* 790 * Tell launch routine the next header 791 */ 792 ip6stat.ip6s_delivered++; 793 in6_ifstat_inc(deliverifp, ifs6_in_deliver); 794 nest = 0; 795 796 while (nxt != IPPROTO_DONE) { 797 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 798 ip6stat.ip6s_toomanyhdr++; 799 goto bad; 800 } 801 802 /* 803 * protection against faulty packet - there should be 804 * more sanity checks in header chain processing. 805 */ 806 if (m->m_pkthdr.len < off) { 807 ip6stat.ip6s_tooshort++; 808 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 809 goto bad; 810 } 811 812 #if 0 813 /* 814 * do we need to do it for every header? yeah, other 815 * functions can play with it (like re-allocate and copy). 816 */ 817 mhist = ip6_addaux(m); 818 if (mhist && M_TRAILINGSPACE(mhist) >= sizeof(nxt)) { 819 hist = mtod(mhist, caddr_t) + mhist->m_len; 820 bcopy(&nxt, hist, sizeof(nxt)); 821 mhist->m_len += sizeof(nxt); 822 } else { 823 ip6stat.ip6s_toomanyhdr++; 824 goto bad; 825 } 826 #endif 827 828 #ifdef IPSEC 829 /* 830 * enforce IPsec policy checking if we are seeing last header. 831 * note that we do not visit this with protocols with pcb layer 832 * code - like udp/tcp/raw ip. 833 */ 834 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 835 ipsec6_in_reject(m, NULL)) { 836 ipsec6stat.in_polvio++; 837 goto bad; 838 } 839 #endif 840 841 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); 842 } 843 return; 844 bad: 845 m_freem(m); 846 } 847 848 /* 849 * set/grab in6_ifaddr correspond to IPv6 destination address. 850 * XXX backward compatibility wrapper 851 */ 852 static struct ip6aux * 853 ip6_setdstifaddr(m, ia6) 854 struct mbuf *m; 855 struct in6_ifaddr *ia6; 856 { 857 struct ip6aux *n; 858 859 n = ip6_addaux(m); 860 if (n) 861 n->ip6a_dstia6 = ia6; 862 return n; /* NULL if failed to set */ 863 } 864 865 struct in6_ifaddr * 866 ip6_getdstifaddr(m) 867 struct mbuf *m; 868 { 869 struct ip6aux *n; 870 871 n = ip6_findaux(m); 872 if (n) 873 return n->ip6a_dstia6; 874 else 875 return NULL; 876 } 877 878 /* 879 * Hop-by-Hop options header processing. If a valid jumbo payload option is 880 * included, the real payload length will be stored in plenp. 881 */ 882 static int 883 ip6_hopopts_input(plenp, rtalertp, mp, offp) 884 u_int32_t *plenp; 885 u_int32_t *rtalertp; /* XXX: should be stored more smart way */ 886 struct mbuf **mp; 887 int *offp; 888 { 889 struct mbuf *m = *mp; 890 int off = *offp, hbhlen; 891 struct ip6_hbh *hbh; 892 u_int8_t *opt; 893 894 /* validation of the length of the header */ 895 #ifndef PULLDOWN_TEST 896 IP6_EXTHDR_CHECK(m, off, sizeof(*hbh), -1); 897 hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off); 898 hbhlen = (hbh->ip6h_len + 1) << 3; 899 900 IP6_EXTHDR_CHECK(m, off, hbhlen, -1); 901 hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off); 902 #else 903 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, 904 sizeof(struct ip6_hdr), sizeof(struct ip6_hbh)); 905 if (hbh == NULL) { 906 ip6stat.ip6s_tooshort++; 907 return -1; 908 } 909 hbhlen = (hbh->ip6h_len + 1) << 3; 910 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 911 hbhlen); 912 if (hbh == NULL) { 913 ip6stat.ip6s_tooshort++; 914 return -1; 915 } 916 #endif 917 off += hbhlen; 918 hbhlen -= sizeof(struct ip6_hbh); 919 opt = (u_int8_t *)hbh + sizeof(struct ip6_hbh); 920 921 if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh), 922 hbhlen, rtalertp, plenp) < 0) 923 return(-1); 924 925 *offp = off; 926 *mp = m; 927 return(0); 928 } 929 930 /* 931 * Search header for all Hop-by-hop options and process each option. 932 * This function is separate from ip6_hopopts_input() in order to 933 * handle a case where the sending node itself process its hop-by-hop 934 * options header. In such a case, the function is called from ip6_output(). 935 * 936 * The function assumes that hbh header is located right after the IPv6 header 937 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to 938 * opthead + hbhlen is located in continuous memory region. 939 */ 940 int 941 ip6_process_hopopts(m, opthead, hbhlen, rtalertp, plenp) 942 struct mbuf *m; 943 u_int8_t *opthead; 944 int hbhlen; 945 u_int32_t *rtalertp; 946 u_int32_t *plenp; 947 { 948 struct ip6_hdr *ip6; 949 int optlen = 0; 950 u_int8_t *opt = opthead; 951 u_int16_t rtalert_val; 952 u_int32_t jumboplen; 953 const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh); 954 955 for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) { 956 switch (*opt) { 957 case IP6OPT_PAD1: 958 optlen = 1; 959 break; 960 case IP6OPT_PADN: 961 if (hbhlen < IP6OPT_MINLEN) { 962 ip6stat.ip6s_toosmall++; 963 goto bad; 964 } 965 optlen = *(opt + 1) + 2; 966 break; 967 case IP6OPT_RTALERT: 968 /* XXX may need check for alignment */ 969 if (hbhlen < IP6OPT_RTALERT_LEN) { 970 ip6stat.ip6s_toosmall++; 971 goto bad; 972 } 973 if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) { 974 /* XXX stat */ 975 icmp6_error(m, ICMP6_PARAM_PROB, 976 ICMP6_PARAMPROB_HEADER, 977 erroff + opt + 1 - opthead); 978 return(-1); 979 } 980 optlen = IP6OPT_RTALERT_LEN; 981 bcopy((caddr_t)(opt + 2), (caddr_t)&rtalert_val, 2); 982 *rtalertp = ntohs(rtalert_val); 983 break; 984 case IP6OPT_JUMBO: 985 /* XXX may need check for alignment */ 986 if (hbhlen < IP6OPT_JUMBO_LEN) { 987 ip6stat.ip6s_toosmall++; 988 goto bad; 989 } 990 if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) { 991 /* XXX stat */ 992 icmp6_error(m, ICMP6_PARAM_PROB, 993 ICMP6_PARAMPROB_HEADER, 994 erroff + opt + 1 - opthead); 995 return(-1); 996 } 997 optlen = IP6OPT_JUMBO_LEN; 998 999 /* 1000 * IPv6 packets that have non 0 payload length 1001 * must not contain a jumbo payload option. 1002 */ 1003 ip6 = mtod(m, struct ip6_hdr *); 1004 if (ip6->ip6_plen) { 1005 ip6stat.ip6s_badoptions++; 1006 icmp6_error(m, ICMP6_PARAM_PROB, 1007 ICMP6_PARAMPROB_HEADER, 1008 erroff + opt - opthead); 1009 return(-1); 1010 } 1011 1012 /* 1013 * We may see jumbolen in unaligned location, so 1014 * we'd need to perform bcopy(). 1015 */ 1016 bcopy(opt + 2, &jumboplen, sizeof(jumboplen)); 1017 jumboplen = (u_int32_t)htonl(jumboplen); 1018 1019 #if 1 1020 /* 1021 * if there are multiple jumbo payload options, 1022 * *plenp will be non-zero and the packet will be 1023 * rejected. 1024 * the behavior may need some debate in ipngwg - 1025 * multiple options does not make sense, however, 1026 * there's no explicit mention in specification. 1027 */ 1028 if (*plenp != 0) { 1029 ip6stat.ip6s_badoptions++; 1030 icmp6_error(m, ICMP6_PARAM_PROB, 1031 ICMP6_PARAMPROB_HEADER, 1032 erroff + opt + 2 - opthead); 1033 return(-1); 1034 } 1035 #endif 1036 1037 /* 1038 * jumbo payload length must be larger than 65535. 1039 */ 1040 if (jumboplen <= IPV6_MAXPACKET) { 1041 ip6stat.ip6s_badoptions++; 1042 icmp6_error(m, ICMP6_PARAM_PROB, 1043 ICMP6_PARAMPROB_HEADER, 1044 erroff + opt + 2 - opthead); 1045 return(-1); 1046 } 1047 *plenp = jumboplen; 1048 1049 break; 1050 default: /* unknown option */ 1051 if (hbhlen < IP6OPT_MINLEN) { 1052 ip6stat.ip6s_toosmall++; 1053 goto bad; 1054 } 1055 optlen = ip6_unknown_opt(opt, m, 1056 erroff + opt - opthead); 1057 if (optlen == -1) 1058 return(-1); 1059 optlen += 2; 1060 break; 1061 } 1062 } 1063 1064 return(0); 1065 1066 bad: 1067 m_freem(m); 1068 return(-1); 1069 } 1070 1071 /* 1072 * Unknown option processing. 1073 * The third argument `off' is the offset from the IPv6 header to the option, 1074 * which is necessary if the IPv6 header the and option header and IPv6 header 1075 * is not continuous in order to return an ICMPv6 error. 1076 */ 1077 int 1078 ip6_unknown_opt(optp, m, off) 1079 u_int8_t *optp; 1080 struct mbuf *m; 1081 int off; 1082 { 1083 struct ip6_hdr *ip6; 1084 1085 switch (IP6OPT_TYPE(*optp)) { 1086 case IP6OPT_TYPE_SKIP: /* ignore the option */ 1087 return((int)*(optp + 1)); 1088 case IP6OPT_TYPE_DISCARD: /* silently discard */ 1089 m_freem(m); 1090 return(-1); 1091 case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */ 1092 ip6stat.ip6s_badoptions++; 1093 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off); 1094 return(-1); 1095 case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */ 1096 ip6stat.ip6s_badoptions++; 1097 ip6 = mtod(m, struct ip6_hdr *); 1098 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 1099 (m->m_flags & (M_BCAST|M_MCAST))) 1100 m_freem(m); 1101 else 1102 icmp6_error(m, ICMP6_PARAM_PROB, 1103 ICMP6_PARAMPROB_OPTION, off); 1104 return(-1); 1105 } 1106 1107 m_freem(m); /* XXX: NOTREACHED */ 1108 return(-1); 1109 } 1110 1111 /* 1112 * Create the "control" list for this pcb. 1113 * The function will not modify mbuf chain at all. 1114 * 1115 * with KAME mbuf chain restriction: 1116 * The routine will be called from upper layer handlers like tcp6_input(). 1117 * Thus the routine assumes that the caller (tcp6_input) have already 1118 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the 1119 * very first mbuf on the mbuf chain. 1120 */ 1121 void 1122 ip6_savecontrol(in6p, mp, ip6, m) 1123 struct inpcb *in6p; 1124 struct mbuf **mp; 1125 struct ip6_hdr *ip6; 1126 struct mbuf *m; 1127 { 1128 struct thread *td = curthread; /* XXX */ 1129 int privileged = 0; 1130 int rthdr_exist = 0; 1131 1132 1133 if (suser(td) == 0) 1134 privileged++; 1135 1136 #ifdef SO_TIMESTAMP 1137 if ((in6p->in6p_socket->so_options & SO_TIMESTAMP) != 0) { 1138 struct timeval tv; 1139 1140 microtime(&tv); 1141 *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv), 1142 SCM_TIMESTAMP, SOL_SOCKET); 1143 if (*mp) { 1144 mp = &(*mp)->m_next; 1145 } 1146 } 1147 #endif 1148 1149 /* RFC 2292 sec. 5 */ 1150 if ((in6p->in6p_flags & IN6P_PKTINFO) != 0) { 1151 struct in6_pktinfo pi6; 1152 bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr)); 1153 if (IN6_IS_SCOPE_LINKLOCAL(&pi6.ipi6_addr)) 1154 pi6.ipi6_addr.s6_addr16[1] = 0; 1155 pi6.ipi6_ifindex = (m && m->m_pkthdr.rcvif) 1156 ? m->m_pkthdr.rcvif->if_index 1157 : 0; 1158 *mp = sbcreatecontrol((caddr_t) &pi6, 1159 sizeof(struct in6_pktinfo), IPV6_PKTINFO, 1160 IPPROTO_IPV6); 1161 if (*mp) 1162 mp = &(*mp)->m_next; 1163 } 1164 1165 if ((in6p->in6p_flags & IN6P_HOPLIMIT) != 0) { 1166 int hlim = ip6->ip6_hlim & 0xff; 1167 *mp = sbcreatecontrol((caddr_t) &hlim, 1168 sizeof(int), IPV6_HOPLIMIT, IPPROTO_IPV6); 1169 if (*mp) 1170 mp = &(*mp)->m_next; 1171 } 1172 1173 /* 1174 * IPV6_HOPOPTS socket option. We require super-user privilege 1175 * for the option, but it might be too strict, since there might 1176 * be some hop-by-hop options which can be returned to normal user. 1177 * See RFC 2292 section 6. 1178 */ 1179 if ((in6p->in6p_flags & IN6P_HOPOPTS) != 0 && privileged) { 1180 /* 1181 * Check if a hop-by-hop options header is contatined in the 1182 * received packet, and if so, store the options as ancillary 1183 * data. Note that a hop-by-hop options header must be 1184 * just after the IPv6 header, which fact is assured through 1185 * the IPv6 input processing. 1186 */ 1187 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1188 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 1189 struct ip6_hbh *hbh; 1190 int hbhlen = 0; 1191 #ifdef PULLDOWN_TEST 1192 struct mbuf *ext; 1193 #endif 1194 1195 #ifndef PULLDOWN_TEST 1196 hbh = (struct ip6_hbh *)(ip6 + 1); 1197 hbhlen = (hbh->ip6h_len + 1) << 3; 1198 #else 1199 ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr), 1200 ip6->ip6_nxt); 1201 if (ext == NULL) { 1202 ip6stat.ip6s_tooshort++; 1203 return; 1204 } 1205 hbh = mtod(ext, struct ip6_hbh *); 1206 hbhlen = (hbh->ip6h_len + 1) << 3; 1207 if (hbhlen != ext->m_len) { 1208 m_freem(ext); 1209 ip6stat.ip6s_tooshort++; 1210 return; 1211 } 1212 #endif 1213 1214 /* 1215 * XXX: We copy whole the header even if a jumbo 1216 * payload option is included, which option is to 1217 * be removed before returning in the RFC 2292. 1218 * Note: this constraint is removed in 2292bis. 1219 */ 1220 *mp = sbcreatecontrol((caddr_t)hbh, hbhlen, 1221 IPV6_HOPOPTS, IPPROTO_IPV6); 1222 if (*mp) 1223 mp = &(*mp)->m_next; 1224 #ifdef PULLDOWN_TEST 1225 m_freem(ext); 1226 #endif 1227 } 1228 } 1229 1230 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */ 1231 if ((in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDRDSTOPTS)) != 0) { 1232 int proto, off, nxt; 1233 1234 /* 1235 * go through the header chain to see if a routing header is 1236 * contained in the packet. We need this information to store 1237 * destination options headers (if any) properly. 1238 * XXX: performance issue. We should record this info when 1239 * processing extension headers in incoming routine. 1240 * (todo) use m_aux? 1241 */ 1242 proto = IPPROTO_IPV6; 1243 off = 0; 1244 nxt = -1; 1245 while (1) { 1246 int newoff; 1247 1248 newoff = ip6_nexthdr(m, off, proto, &nxt); 1249 if (newoff < 0) 1250 break; 1251 if (newoff < off) /* invalid, check for safety */ 1252 break; 1253 if ((proto = nxt) == IPPROTO_ROUTING) { 1254 rthdr_exist = 1; 1255 break; 1256 } 1257 off = newoff; 1258 } 1259 } 1260 1261 if ((in6p->in6p_flags & 1262 (IN6P_RTHDR | IN6P_DSTOPTS | IN6P_RTHDRDSTOPTS)) != 0) { 1263 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1264 int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr); 1265 1266 /* 1267 * Search for destination options headers or routing 1268 * header(s) through the header chain, and stores each 1269 * header as ancillary data. 1270 * Note that the order of the headers remains in 1271 * the chain of ancillary data. 1272 */ 1273 while (1) { /* is explicit loop prevention necessary? */ 1274 struct ip6_ext *ip6e = NULL; 1275 int elen; 1276 #ifdef PULLDOWN_TEST 1277 struct mbuf *ext = NULL; 1278 #endif 1279 1280 /* 1281 * if it is not an extension header, don't try to 1282 * pull it from the chain. 1283 */ 1284 switch (nxt) { 1285 case IPPROTO_DSTOPTS: 1286 case IPPROTO_ROUTING: 1287 case IPPROTO_HOPOPTS: 1288 case IPPROTO_AH: /* is it possible? */ 1289 break; 1290 default: 1291 goto loopend; 1292 } 1293 1294 #ifndef PULLDOWN_TEST 1295 if (off + sizeof(*ip6e) > m->m_len) 1296 goto loopend; 1297 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off); 1298 if (nxt == IPPROTO_AH) 1299 elen = (ip6e->ip6e_len + 2) << 2; 1300 else 1301 elen = (ip6e->ip6e_len + 1) << 3; 1302 if (off + elen > m->m_len) 1303 goto loopend; 1304 #else 1305 ext = ip6_pullexthdr(m, off, nxt); 1306 if (ext == NULL) { 1307 ip6stat.ip6s_tooshort++; 1308 return; 1309 } 1310 ip6e = mtod(ext, struct ip6_ext *); 1311 if (nxt == IPPROTO_AH) 1312 elen = (ip6e->ip6e_len + 2) << 2; 1313 else 1314 elen = (ip6e->ip6e_len + 1) << 3; 1315 if (elen != ext->m_len) { 1316 m_freem(ext); 1317 ip6stat.ip6s_tooshort++; 1318 return; 1319 } 1320 #endif 1321 1322 switch (nxt) { 1323 case IPPROTO_DSTOPTS: 1324 if ((in6p->in6p_flags & IN6P_DSTOPTS) == 0) 1325 break; 1326 1327 /* 1328 * We also require super-user privilege for 1329 * the option. 1330 * See the comments on IN6_HOPOPTS. 1331 */ 1332 if (!privileged) 1333 break; 1334 1335 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1336 IPV6_DSTOPTS, 1337 IPPROTO_IPV6); 1338 if (*mp) 1339 mp = &(*mp)->m_next; 1340 break; 1341 case IPPROTO_ROUTING: 1342 if (!in6p->in6p_flags & IN6P_RTHDR) 1343 break; 1344 1345 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1346 IPV6_RTHDR, 1347 IPPROTO_IPV6); 1348 if (*mp) 1349 mp = &(*mp)->m_next; 1350 break; 1351 case IPPROTO_HOPOPTS: 1352 case IPPROTO_AH: /* is it possible? */ 1353 break; 1354 1355 default: 1356 /* 1357 * other cases have been filtered in the above. 1358 * none will visit this case. here we supply 1359 * the code just in case (nxt overwritten or 1360 * other cases). 1361 */ 1362 #ifdef PULLDOWN_TEST 1363 m_freem(ext); 1364 #endif 1365 goto loopend; 1366 1367 } 1368 1369 /* proceed with the next header. */ 1370 off += elen; 1371 nxt = ip6e->ip6e_nxt; 1372 ip6e = NULL; 1373 #ifdef PULLDOWN_TEST 1374 m_freem(ext); 1375 ext = NULL; 1376 #endif 1377 } 1378 loopend: 1379 ; 1380 } 1381 1382 } 1383 1384 #ifdef PULLDOWN_TEST 1385 /* 1386 * pull single extension header from mbuf chain. returns single mbuf that 1387 * contains the result, or NULL on error. 1388 */ 1389 static struct mbuf * 1390 ip6_pullexthdr(m, off, nxt) 1391 struct mbuf *m; 1392 size_t off; 1393 int nxt; 1394 { 1395 struct ip6_ext ip6e; 1396 size_t elen; 1397 struct mbuf *n; 1398 1399 #ifdef DIAGNOSTIC 1400 switch (nxt) { 1401 case IPPROTO_DSTOPTS: 1402 case IPPROTO_ROUTING: 1403 case IPPROTO_HOPOPTS: 1404 case IPPROTO_AH: /* is it possible? */ 1405 break; 1406 default: 1407 printf("ip6_pullexthdr: invalid nxt=%d\n", nxt); 1408 } 1409 #endif 1410 1411 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1412 if (nxt == IPPROTO_AH) 1413 elen = (ip6e.ip6e_len + 2) << 2; 1414 else 1415 elen = (ip6e.ip6e_len + 1) << 3; 1416 1417 MGET(n, M_DONTWAIT, MT_DATA); 1418 if (n && elen >= MLEN) { 1419 MCLGET(n, M_DONTWAIT); 1420 if ((n->m_flags & M_EXT) == 0) { 1421 m_free(n); 1422 n = NULL; 1423 } 1424 } 1425 if (!n) 1426 return NULL; 1427 1428 n->m_len = 0; 1429 if (elen >= M_TRAILINGSPACE(n)) { 1430 m_free(n); 1431 return NULL; 1432 } 1433 1434 m_copydata(m, off, elen, mtod(n, caddr_t)); 1435 n->m_len = elen; 1436 return n; 1437 } 1438 #endif 1439 1440 /* 1441 * Get pointer to the previous header followed by the header 1442 * currently processed. 1443 * XXX: This function supposes that 1444 * M includes all headers, 1445 * the next header field and the header length field of each header 1446 * are valid, and 1447 * the sum of each header length equals to OFF. 1448 * Because of these assumptions, this function must be called very 1449 * carefully. Moreover, it will not be used in the near future when 1450 * we develop `neater' mechanism to process extension headers. 1451 */ 1452 char * 1453 ip6_get_prevhdr(m, off) 1454 struct mbuf *m; 1455 int off; 1456 { 1457 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1458 1459 if (off == sizeof(struct ip6_hdr)) 1460 return(&ip6->ip6_nxt); 1461 else { 1462 int len, nxt; 1463 struct ip6_ext *ip6e = NULL; 1464 1465 nxt = ip6->ip6_nxt; 1466 len = sizeof(struct ip6_hdr); 1467 while (len < off) { 1468 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + len); 1469 1470 switch (nxt) { 1471 case IPPROTO_FRAGMENT: 1472 len += sizeof(struct ip6_frag); 1473 break; 1474 case IPPROTO_AH: 1475 len += (ip6e->ip6e_len + 2) << 2; 1476 break; 1477 default: 1478 len += (ip6e->ip6e_len + 1) << 3; 1479 break; 1480 } 1481 nxt = ip6e->ip6e_nxt; 1482 } 1483 if (ip6e) 1484 return(&ip6e->ip6e_nxt); 1485 else 1486 return NULL; 1487 } 1488 } 1489 1490 /* 1491 * get next header offset. m will be retained. 1492 */ 1493 int 1494 ip6_nexthdr(m, off, proto, nxtp) 1495 struct mbuf *m; 1496 int off; 1497 int proto; 1498 int *nxtp; 1499 { 1500 struct ip6_hdr ip6; 1501 struct ip6_ext ip6e; 1502 struct ip6_frag fh; 1503 1504 /* just in case */ 1505 if (m == NULL) 1506 panic("ip6_nexthdr: m == NULL"); 1507 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off) 1508 return -1; 1509 1510 switch (proto) { 1511 case IPPROTO_IPV6: 1512 if (m->m_pkthdr.len < off + sizeof(ip6)) 1513 return -1; 1514 m_copydata(m, off, sizeof(ip6), (caddr_t)&ip6); 1515 if (nxtp) 1516 *nxtp = ip6.ip6_nxt; 1517 off += sizeof(ip6); 1518 return off; 1519 1520 case IPPROTO_FRAGMENT: 1521 /* 1522 * terminate parsing if it is not the first fragment, 1523 * it does not make sense to parse through it. 1524 */ 1525 if (m->m_pkthdr.len < off + sizeof(fh)) 1526 return -1; 1527 m_copydata(m, off, sizeof(fh), (caddr_t)&fh); 1528 if ((ntohs(fh.ip6f_offlg) & IP6F_OFF_MASK) != 0) 1529 return -1; 1530 if (nxtp) 1531 *nxtp = fh.ip6f_nxt; 1532 off += sizeof(struct ip6_frag); 1533 return off; 1534 1535 case IPPROTO_AH: 1536 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1537 return -1; 1538 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1539 if (nxtp) 1540 *nxtp = ip6e.ip6e_nxt; 1541 off += (ip6e.ip6e_len + 2) << 2; 1542 return off; 1543 1544 case IPPROTO_HOPOPTS: 1545 case IPPROTO_ROUTING: 1546 case IPPROTO_DSTOPTS: 1547 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1548 return -1; 1549 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1550 if (nxtp) 1551 *nxtp = ip6e.ip6e_nxt; 1552 off += (ip6e.ip6e_len + 1) << 3; 1553 return off; 1554 1555 case IPPROTO_NONE: 1556 case IPPROTO_ESP: 1557 case IPPROTO_IPCOMP: 1558 /* give up */ 1559 return -1; 1560 1561 default: 1562 return -1; 1563 } 1564 1565 return -1; 1566 } 1567 1568 /* 1569 * get offset for the last header in the chain. m will be kept untainted. 1570 */ 1571 int 1572 ip6_lasthdr(m, off, proto, nxtp) 1573 struct mbuf *m; 1574 int off; 1575 int proto; 1576 int *nxtp; 1577 { 1578 int newoff; 1579 int nxt; 1580 1581 if (!nxtp) { 1582 nxt = -1; 1583 nxtp = &nxt; 1584 } 1585 while (1) { 1586 newoff = ip6_nexthdr(m, off, proto, nxtp); 1587 if (newoff < 0) 1588 return off; 1589 else if (newoff < off) 1590 return -1; /* invalid */ 1591 else if (newoff == off) 1592 return newoff; 1593 1594 off = newoff; 1595 proto = *nxtp; 1596 } 1597 } 1598 1599 struct ip6aux * 1600 ip6_addaux(m) 1601 struct mbuf *m; 1602 { 1603 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1604 if (!tag) { 1605 tag = m_tag_get(PACKET_TAG_IPV6_INPUT, 1606 sizeof (struct ip6aux), 1607 M_DONTWAIT); 1608 if (tag) 1609 m_tag_prepend(m, tag); 1610 } 1611 if (tag) 1612 bzero(tag+1, sizeof (struct ip6aux)); 1613 return tag ? (struct ip6aux*)(tag+1) : NULL; 1614 } 1615 1616 struct ip6aux * 1617 ip6_findaux(m) 1618 struct mbuf *m; 1619 { 1620 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1621 return tag ? (struct ip6aux*)(tag+1) : NULL; 1622 } 1623 1624 void 1625 ip6_delaux(m) 1626 struct mbuf *m; 1627 { 1628 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1629 if (tag) 1630 m_tag_delete(m, tag); 1631 } 1632 1633 /* 1634 * System control for IP6 1635 */ 1636 1637 u_char inet6ctlerrmap[PRC_NCMDS] = { 1638 0, 0, 0, 0, 1639 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, 1640 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, 1641 EMSGSIZE, EHOSTUNREACH, 0, 0, 1642 0, 0, 0, 0, 1643 ENOPROTOOPT 1644 }; 1645