1 /* $FreeBSD: src/sys/netinet6/ip6_input.c,v 1.11.2.15 2003/01/24 05:11:35 sam Exp $ */ 2 /* $DragonFly: src/sys/netinet6/ip6_input.c,v 1.32 2006/12/22 23:57:53 swildner Exp $ */ 3 /* $KAME: ip6_input.c,v 1.259 2002/01/21 04:58:09 jinmei Exp $ */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 /* 35 * Copyright (c) 1982, 1986, 1988, 1993 36 * The Regents of the University of California. All rights reserved. 37 * 38 * Redistribution and use in source and binary forms, with or without 39 * modification, are permitted provided that the following conditions 40 * are met: 41 * 1. Redistributions of source code must retain the above copyright 42 * notice, this list of conditions and the following disclaimer. 43 * 2. Redistributions in binary form must reproduce the above copyright 44 * notice, this list of conditions and the following disclaimer in the 45 * documentation and/or other materials provided with the distribution. 46 * 3. All advertising materials mentioning features or use of this software 47 * must display the following acknowledgement: 48 * This product includes software developed by the University of 49 * California, Berkeley and its contributors. 50 * 4. Neither the name of the University nor the names of its contributors 51 * may be used to endorse or promote products derived from this software 52 * without specific prior written permission. 53 * 54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 64 * SUCH DAMAGE. 65 * 66 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 67 */ 68 69 #include "opt_ip6fw.h" 70 #include "opt_inet.h" 71 #include "opt_inet6.h" 72 #include "opt_ipsec.h" 73 74 #include <sys/param.h> 75 #include <sys/systm.h> 76 #include <sys/malloc.h> 77 #include <sys/mbuf.h> 78 #include <sys/domain.h> 79 #include <sys/protosw.h> 80 #include <sys/socket.h> 81 #include <sys/socketvar.h> 82 #include <sys/errno.h> 83 #include <sys/time.h> 84 #include <sys/kernel.h> 85 #include <sys/syslog.h> 86 #include <sys/proc.h> 87 88 #include <sys/thread2.h> 89 #include <sys/msgport2.h> 90 91 #include <net/if.h> 92 #include <net/if_types.h> 93 #include <net/if_dl.h> 94 #include <net/route.h> 95 #include <net/netisr.h> 96 #include <net/pfil.h> 97 98 #include <netinet/in.h> 99 #include <netinet/in_systm.h> 100 #ifdef INET 101 #include <netinet/ip.h> 102 #include <netinet/ip_icmp.h> 103 #endif /* INET */ 104 #include <netinet/ip6.h> 105 #include <netinet6/in6_var.h> 106 #include <netinet6/ip6_var.h> 107 #include <netinet/in_pcb.h> 108 #include <netinet/icmp6.h> 109 #include <netinet6/scope6_var.h> 110 #include <netinet6/in6_ifattach.h> 111 #include <netinet6/nd6.h> 112 #include <netinet6/in6_prefix.h> 113 114 #ifdef IPSEC 115 #include <netinet6/ipsec.h> 116 #ifdef INET6 117 #include <netinet6/ipsec6.h> 118 #endif 119 #endif 120 121 #ifdef FAST_IPSEC 122 #include <netproto/ipsec/ipsec.h> 123 #include <netproto/ipsec/ipsec6.h> 124 #define IPSEC 125 #endif /* FAST_IPSEC */ 126 127 #include <net/ip6fw/ip6_fw.h> 128 129 #include <netinet6/ip6protosw.h> 130 131 /* we need it for NLOOP. */ 132 #include "use_loop.h" 133 134 #include <net/net_osdep.h> 135 136 extern struct domain inet6domain; 137 extern struct ip6protosw inet6sw[]; 138 139 u_char ip6_protox[IPPROTO_MAX]; 140 struct in6_ifaddr *in6_ifaddr; 141 142 extern struct callout in6_tmpaddrtimer_ch; 143 144 int ip6_forward_srcrt; /* XXX */ 145 int ip6_sourcecheck; /* XXX */ 146 int ip6_sourcecheck_interval; /* XXX */ 147 148 int ip6_ours_check_algorithm; 149 150 struct pfil_head inet6_pfil_hook; 151 152 /* firewall hooks */ 153 ip6_fw_chk_t *ip6_fw_chk_ptr; 154 ip6_fw_ctl_t *ip6_fw_ctl_ptr; 155 int ip6_fw_enable = 1; 156 157 struct ip6stat ip6stat; 158 159 static void ip6_init2 (void *); 160 static struct ip6aux *ip6_setdstifaddr (struct mbuf *, struct in6_ifaddr *); 161 static int ip6_hopopts_input (u_int32_t *, u_int32_t *, struct mbuf **, int *); 162 static int ip6_input(struct netmsg *msg); 163 #ifdef PULLDOWN_TEST 164 static struct mbuf *ip6_pullexthdr (struct mbuf *, size_t, int); 165 #endif 166 167 /* 168 * IP6 initialization: fill in IP6 protocol switch table. 169 * All protocols not implemented in kernel go to raw IP6 protocol handler. 170 */ 171 void 172 ip6_init(void) 173 { 174 struct ip6protosw *pr; 175 int i; 176 struct timeval tv; 177 178 #ifdef DIAGNOSTIC 179 if (sizeof(struct protosw) != sizeof(struct ip6protosw)) 180 panic("sizeof(protosw) != sizeof(ip6protosw)"); 181 #endif 182 pr = (struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW); 183 if (pr == 0) 184 panic("ip6_init"); 185 for (i = 0; i < IPPROTO_MAX; i++) 186 ip6_protox[i] = pr - inet6sw; 187 for (pr = (struct ip6protosw *)inet6domain.dom_protosw; 188 pr < (struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++) 189 if (pr->pr_domain->dom_family == PF_INET6 && 190 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) 191 ip6_protox[pr->pr_protocol] = pr - inet6sw; 192 193 inet6_pfil_hook.ph_type = PFIL_TYPE_AF; 194 inet6_pfil_hook.ph_af = AF_INET6; 195 if ((i = pfil_head_register(&inet6_pfil_hook)) != 0) { 196 kprintf("%s: WARNING: unable to register pfil hook, " 197 "error %d\n", __func__, i); 198 } 199 200 netisr_register(NETISR_IPV6, cpu0_portfn, ip6_input); 201 scope6_init(); 202 nd6_init(); 203 frag6_init(); 204 /* 205 * in many cases, random() here does NOT return random number 206 * as initialization during bootstrap time occur in fixed order. 207 */ 208 microtime(&tv); 209 ip6_flow_seq = krandom() ^ tv.tv_usec; 210 microtime(&tv); 211 ip6_desync_factor = (krandom() ^ tv.tv_usec) % MAX_TEMP_DESYNC_FACTOR; 212 } 213 214 static void 215 ip6_init2(void *dummy) 216 { 217 /* nd6_timer_init */ 218 callout_init(&nd6_timer_ch); 219 callout_reset(&nd6_timer_ch, hz, nd6_timer, NULL); 220 221 /* router renumbering prefix list maintenance */ 222 callout_init(&in6_rr_timer_ch); 223 callout_reset(&in6_rr_timer_ch, hz, in6_rr_timer, NULL); 224 225 /* timer for regeneranation of temporary addresses randomize ID */ 226 callout_init(&in6_tmpaddrtimer_ch); 227 callout_reset(&in6_tmpaddrtimer_ch, 228 (ip6_temp_preferred_lifetime - ip6_desync_factor - 229 ip6_temp_regen_advance) * hz, 230 in6_tmpaddrtimer, NULL); 231 } 232 233 /* cheat */ 234 /* This must be after route_init(), which is now SI_ORDER_THIRD */ 235 SYSINIT(netinet6init2, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ip6_init2, NULL); 236 237 extern struct route_in6 ip6_forward_rt; 238 239 static 240 int 241 ip6_input(struct netmsg *msg) 242 { 243 struct mbuf *m = ((struct netmsg_packet *)msg)->nm_packet; 244 struct ip6_hdr *ip6; 245 int off = sizeof(struct ip6_hdr), nest; 246 u_int32_t plen; 247 u_int32_t rtalert = ~0; 248 int nxt, ours = 0; 249 struct ifnet *deliverifp = NULL; 250 struct in6_addr odst; 251 int srcrt = 0; 252 253 #ifdef IPSEC 254 /* 255 * should the inner packet be considered authentic? 256 * see comment in ah4_input(). 257 */ 258 if (m) { 259 m->m_flags &= ~M_AUTHIPHDR; 260 m->m_flags &= ~M_AUTHIPDGM; 261 } 262 #endif 263 264 /* 265 * make sure we don't have onion peering information into m_aux. 266 */ 267 ip6_delaux(m); 268 269 /* 270 * mbuf statistics 271 */ 272 if (m->m_flags & M_EXT) { 273 if (m->m_next) 274 ip6stat.ip6s_mext2m++; 275 else 276 ip6stat.ip6s_mext1++; 277 } else { 278 #define M2MMAX (sizeof(ip6stat.ip6s_m2m)/sizeof(ip6stat.ip6s_m2m[0])) 279 if (m->m_next) { 280 if (m->m_flags & M_LOOP) { 281 ip6stat.ip6s_m2m[loif[0].if_index]++; /* XXX */ 282 } else if (m->m_pkthdr.rcvif->if_index < M2MMAX) 283 ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++; 284 else 285 ip6stat.ip6s_m2m[0]++; 286 } else 287 ip6stat.ip6s_m1++; 288 #undef M2MMAX 289 } 290 291 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive); 292 ip6stat.ip6s_total++; 293 294 #ifndef PULLDOWN_TEST 295 /* 296 * L2 bridge code and some other code can return mbuf chain 297 * that does not conform to KAME requirement. too bad. 298 * XXX: fails to join if interface MTU > MCLBYTES. jumbogram? 299 */ 300 if (m && m->m_next != NULL && m->m_pkthdr.len < MCLBYTES) { 301 struct mbuf *n; 302 303 n = m_getb(m->m_pkthdr.len, MB_DONTWAIT, MT_HEADER, M_PKTHDR); 304 if (n == NULL) 305 goto bad; 306 M_MOVE_PKTHDR(n, m); 307 308 m_copydata(m, 0, n->m_pkthdr.len, mtod(n, caddr_t)); 309 n->m_len = n->m_pkthdr.len; 310 m_freem(m); 311 m = n; 312 } 313 IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), EASYNC); 314 #endif 315 316 if (m->m_len < sizeof(struct ip6_hdr)) { 317 struct ifnet *inifp; 318 inifp = m->m_pkthdr.rcvif; 319 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == 0) { 320 ip6stat.ip6s_toosmall++; 321 in6_ifstat_inc(inifp, ifs6_in_hdrerr); 322 goto bad2; 323 } 324 } 325 326 ip6 = mtod(m, struct ip6_hdr *); 327 328 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) { 329 ip6stat.ip6s_badvers++; 330 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 331 goto bad; 332 } 333 334 /* 335 * Run through list of hooks for input packets. 336 * 337 * NB: Beware of the destination address changing 338 * (e.g. by NAT rewriting). When this happens, 339 * tell ip6_forward to do the right thing. 340 */ 341 if (pfil_has_hooks(&inet6_pfil_hook)) { 342 odst = ip6->ip6_dst; 343 if (pfil_run_hooks(&inet6_pfil_hook, &m, 344 m->m_pkthdr.rcvif, PFIL_IN)) { 345 goto bad2; 346 } 347 if (m == NULL) /* consumed by filter */ 348 goto bad2; 349 ip6 = mtod(m, struct ip6_hdr *); 350 srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst); 351 } 352 353 ip6stat.ip6s_nxthist[ip6->ip6_nxt]++; 354 355 #ifdef ALTQ 356 if (altq_input != NULL && (*altq_input)(m, AF_INET6) == 0) { 357 /* packet is dropped by traffic conditioner */ 358 return (ENOBUFS); 359 } 360 #endif 361 362 /* 363 * Check with the firewall... 364 */ 365 if (ip6_fw_enable && ip6_fw_chk_ptr) { 366 u_short port = 0; 367 /* If ipfw says divert, we have to just drop packet */ 368 /* use port as a dummy argument */ 369 if ((*ip6_fw_chk_ptr)(&ip6, NULL, &port, &m)) { 370 m_freem(m); 371 m = NULL; 372 } 373 if (!m) 374 goto bad2; 375 } 376 377 /* 378 * Check against address spoofing/corruption. 379 */ 380 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) || 381 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { 382 /* 383 * XXX: "badscope" is not very suitable for a multicast source. 384 */ 385 ip6stat.ip6s_badscope++; 386 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 387 goto bad; 388 } 389 if ((IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) || 390 IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) && 391 (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { 392 ip6stat.ip6s_badscope++; 393 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 394 goto bad; 395 } 396 397 /* 398 * The following check is not documented in specs. A malicious 399 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack 400 * and bypass security checks (act as if it was from 127.0.0.1 by using 401 * IPv6 src ::ffff:127.0.0.1). Be cautious. 402 * 403 * This check chokes if we are in an SIIT cloud. As none of BSDs 404 * support IPv4-less kernel compilation, we cannot support SIIT 405 * environment at all. So, it makes more sense for us to reject any 406 * malicious packets for non-SIIT environment, than try to do a 407 * partical support for SIIT environment. 408 */ 409 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 410 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 411 ip6stat.ip6s_badscope++; 412 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 413 goto bad; 414 } 415 #if 0 416 /* 417 * Reject packets with IPv4 compatible addresses (auto tunnel). 418 * 419 * The code forbids auto tunnel relay case in RFC1933 (the check is 420 * stronger than RFC1933). We may want to re-enable it if mech-xx 421 * is revised to forbid relaying case. 422 */ 423 if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) || 424 IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) { 425 ip6stat.ip6s_badscope++; 426 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 427 goto bad; 428 } 429 #endif 430 431 /* drop packets if interface ID portion is already filled */ 432 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { 433 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src) && 434 ip6->ip6_src.s6_addr16[1]) { 435 ip6stat.ip6s_badscope++; 436 goto bad; 437 } 438 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) && 439 ip6->ip6_dst.s6_addr16[1]) { 440 ip6stat.ip6s_badscope++; 441 goto bad; 442 } 443 } 444 445 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) 446 ip6->ip6_src.s6_addr16[1] 447 = htons(m->m_pkthdr.rcvif->if_index); 448 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) 449 ip6->ip6_dst.s6_addr16[1] 450 = htons(m->m_pkthdr.rcvif->if_index); 451 452 #if 0 /* this case seems to be unnecessary. (jinmei, 20010401) */ 453 /* 454 * We use rt->rt_ifp to determine if the address is ours or not. 455 * If rt_ifp is lo0, the address is ours. 456 * The problem here is, rt->rt_ifp for fe80::%lo0/64 is set to lo0, 457 * so any address under fe80::%lo0/64 will be mistakenly considered 458 * local. The special case is supplied to handle the case properly 459 * by actually looking at interface addresses 460 * (using in6ifa_ifpwithaddr). 461 */ 462 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) && 463 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) { 464 if (!in6ifa_ifpwithaddr(m->m_pkthdr.rcvif, &ip6->ip6_dst)) { 465 icmp6_error(m, ICMP6_DST_UNREACH, 466 ICMP6_DST_UNREACH_ADDR, 0); 467 /* m is already freed */ 468 goto bad2; 469 } 470 471 ours = 1; 472 deliverifp = m->m_pkthdr.rcvif; 473 goto hbhcheck; 474 } 475 #endif 476 477 /* 478 * Multicast check 479 */ 480 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 481 struct in6_multi *in6m = 0; 482 483 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast); 484 /* 485 * See if we belong to the destination multicast group on the 486 * arrival interface. 487 */ 488 IN6_LOOKUP_MULTI(ip6->ip6_dst, m->m_pkthdr.rcvif, in6m); 489 if (in6m) 490 ours = 1; 491 else if (!ip6_mrouter) { 492 ip6stat.ip6s_notmember++; 493 ip6stat.ip6s_cantforward++; 494 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 495 goto bad; 496 } 497 deliverifp = m->m_pkthdr.rcvif; 498 goto hbhcheck; 499 } 500 501 /* 502 * Unicast check 503 */ 504 switch (ip6_ours_check_algorithm) { 505 default: 506 /* 507 * XXX: I intentionally broke our indentation rule here, 508 * since this switch-case is just for measurement and 509 * therefore should soon be removed. 510 */ 511 if (ip6_forward_rt.ro_rt != NULL && 512 (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) && 513 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 514 &((struct sockaddr_in6 *)(&ip6_forward_rt.ro_dst))->sin6_addr)) 515 ip6stat.ip6s_forward_cachehit++; 516 else { 517 struct sockaddr_in6 *dst6; 518 519 if (ip6_forward_rt.ro_rt) { 520 /* route is down or destination is different */ 521 ip6stat.ip6s_forward_cachemiss++; 522 RTFREE(ip6_forward_rt.ro_rt); 523 ip6_forward_rt.ro_rt = 0; 524 } 525 526 bzero(&ip6_forward_rt.ro_dst, sizeof(struct sockaddr_in6)); 527 dst6 = &ip6_forward_rt.ro_dst; 528 dst6->sin6_len = sizeof(struct sockaddr_in6); 529 dst6->sin6_family = AF_INET6; 530 dst6->sin6_addr = ip6->ip6_dst; 531 532 rtalloc_ign((struct route *)&ip6_forward_rt, RTF_PRCLONING); 533 } 534 535 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key)) 536 537 /* 538 * Accept the packet if the forwarding interface to the destination 539 * according to the routing table is the loopback interface, 540 * unless the associated route has a gateway. 541 * Note that this approach causes to accept a packet if there is a 542 * route to the loopback interface for the destination of the packet. 543 * But we think it's even useful in some situations, e.g. when using 544 * a special daemon which wants to intercept the packet. 545 * 546 * XXX: some OSes automatically make a cloned route for the destination 547 * of an outgoing packet. If the outgoing interface of the packet 548 * is a loopback one, the kernel would consider the packet to be 549 * accepted, even if we have no such address assinged on the interface. 550 * We check the cloned flag of the route entry to reject such cases, 551 * assuming that route entries for our own addresses are not made by 552 * cloning (it should be true because in6_addloop explicitly installs 553 * the host route). However, we might have to do an explicit check 554 * while it would be less efficient. Or, should we rather install a 555 * reject route for such a case? 556 */ 557 if (ip6_forward_rt.ro_rt && 558 (ip6_forward_rt.ro_rt->rt_flags & 559 (RTF_HOST|RTF_GATEWAY)) == RTF_HOST && 560 #ifdef RTF_WASCLONED 561 !(ip6_forward_rt.ro_rt->rt_flags & RTF_WASCLONED) && 562 #endif 563 #ifdef RTF_CLONED 564 !(ip6_forward_rt.ro_rt->rt_flags & RTF_CLONED) && 565 #endif 566 #if 0 567 /* 568 * The check below is redundant since the comparison of 569 * the destination and the key of the rtentry has 570 * already done through looking up the routing table. 571 */ 572 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 573 &rt6_key(ip6_forward_rt.ro_rt)->sin6_addr) 574 #endif 575 ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_LOOP) { 576 struct in6_ifaddr *ia6 = 577 (struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa; 578 579 /* 580 * record address information into m_aux. 581 */ 582 ip6_setdstifaddr(m, ia6); 583 584 /* 585 * packets to a tentative, duplicated, or somehow invalid 586 * address must not be accepted. 587 */ 588 if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) { 589 /* this address is ready */ 590 ours = 1; 591 deliverifp = ia6->ia_ifp; /* correct? */ 592 /* Count the packet in the ip address stats */ 593 ia6->ia_ifa.if_ipackets++; 594 ia6->ia_ifa.if_ibytes += m->m_pkthdr.len; 595 goto hbhcheck; 596 } else { 597 /* address is not ready, so discard the packet. */ 598 nd6log((LOG_INFO, 599 "ip6_input: packet to an unready address %s->%s\n", 600 ip6_sprintf(&ip6->ip6_src), 601 ip6_sprintf(&ip6->ip6_dst))); 602 603 goto bad; 604 } 605 } 606 } /* XXX indentation (see above) */ 607 608 /* 609 * FAITH(Firewall Aided Internet Translator) 610 */ 611 if (ip6_keepfaith) { 612 if (ip6_forward_rt.ro_rt && ip6_forward_rt.ro_rt->rt_ifp 613 && ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) { 614 /* XXX do we need more sanity checks? */ 615 ours = 1; 616 deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /* faith */ 617 goto hbhcheck; 618 } 619 } 620 621 /* 622 * Now there is no reason to process the packet if it's not our own 623 * and we're not a router. 624 */ 625 if (!ip6_forwarding) { 626 ip6stat.ip6s_cantforward++; 627 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 628 goto bad; 629 } 630 631 hbhcheck: 632 /* 633 * record address information into m_aux, if we don't have one yet. 634 * note that we are unable to record it, if the address is not listed 635 * as our interface address (e.g. multicast addresses, addresses 636 * within FAITH prefixes and such). 637 */ 638 if (deliverifp && !ip6_getdstifaddr(m)) { 639 struct in6_ifaddr *ia6; 640 641 ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst); 642 if (ia6) { 643 if (!ip6_setdstifaddr(m, ia6)) { 644 /* 645 * XXX maybe we should drop the packet here, 646 * as we could not provide enough information 647 * to the upper layers. 648 */ 649 } 650 } 651 } 652 653 /* 654 * Process Hop-by-Hop options header if it's contained. 655 * m may be modified in ip6_hopopts_input(). 656 * If a JumboPayload option is included, plen will also be modified. 657 */ 658 plen = (u_int32_t)ntohs(ip6->ip6_plen); 659 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 660 struct ip6_hbh *hbh; 661 662 if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) { 663 #if 0 /*touches NULL pointer*/ 664 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 665 #endif 666 goto bad2; /* m have already been freed */ 667 } 668 669 /* adjust pointer */ 670 ip6 = mtod(m, struct ip6_hdr *); 671 672 /* 673 * if the payload length field is 0 and the next header field 674 * indicates Hop-by-Hop Options header, then a Jumbo Payload 675 * option MUST be included. 676 */ 677 if (ip6->ip6_plen == 0 && plen == 0) { 678 /* 679 * Note that if a valid jumbo payload option is 680 * contained, ip6_hoptops_input() must set a valid 681 * (non-zero) payload length to the variable plen. 682 */ 683 ip6stat.ip6s_badoptions++; 684 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 685 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 686 icmp6_error(m, ICMP6_PARAM_PROB, 687 ICMP6_PARAMPROB_HEADER, 688 (caddr_t)&ip6->ip6_plen - (caddr_t)ip6); 689 goto bad2; 690 } 691 #ifndef PULLDOWN_TEST 692 /* ip6_hopopts_input() ensures that mbuf is contiguous */ 693 hbh = (struct ip6_hbh *)(ip6 + 1); 694 #else 695 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 696 sizeof(struct ip6_hbh)); 697 if (hbh == NULL) { 698 ip6stat.ip6s_tooshort++; 699 goto bad2; 700 } 701 #endif 702 nxt = hbh->ip6h_nxt; 703 704 /* 705 * accept the packet if a router alert option is included 706 * and we act as an IPv6 router. 707 */ 708 if (rtalert != ~0 && ip6_forwarding) 709 ours = 1; 710 } else 711 nxt = ip6->ip6_nxt; 712 713 /* 714 * Check that the amount of data in the buffers 715 * is as at least much as the IPv6 header would have us expect. 716 * Trim mbufs if longer than we expect. 717 * Drop packet if shorter than we expect. 718 */ 719 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) { 720 ip6stat.ip6s_tooshort++; 721 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 722 goto bad; 723 } 724 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) { 725 if (m->m_len == m->m_pkthdr.len) { 726 m->m_len = sizeof(struct ip6_hdr) + plen; 727 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen; 728 } else 729 m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len); 730 } 731 732 /* 733 * Forward if desirable. 734 */ 735 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 736 /* 737 * If we are acting as a multicast router, all 738 * incoming multicast packets are passed to the 739 * kernel-level multicast forwarding function. 740 * The packet is returned (relatively) intact; if 741 * ip6_mforward() returns a non-zero value, the packet 742 * must be discarded, else it may be accepted below. 743 */ 744 if (ip6_mrouter && ip6_mforward(ip6, m->m_pkthdr.rcvif, m)) { 745 ip6stat.ip6s_cantforward++; 746 goto bad; 747 } 748 if (!ours) 749 goto bad; 750 } else if (!ours) { 751 ip6_forward(m, srcrt); 752 goto bad2; 753 } 754 755 ip6 = mtod(m, struct ip6_hdr *); 756 757 /* 758 * Malicious party may be able to use IPv4 mapped addr to confuse 759 * tcp/udp stack and bypass security checks (act as if it was from 760 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious. 761 * 762 * For SIIT end node behavior, you may want to disable the check. 763 * However, you will become vulnerable to attacks using IPv4 mapped 764 * source. 765 */ 766 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 767 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 768 ip6stat.ip6s_badscope++; 769 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 770 goto bad; 771 } 772 773 /* 774 * Tell launch routine the next header 775 */ 776 ip6stat.ip6s_delivered++; 777 in6_ifstat_inc(deliverifp, ifs6_in_deliver); 778 nest = 0; 779 780 while (nxt != IPPROTO_DONE) { 781 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 782 ip6stat.ip6s_toomanyhdr++; 783 goto bad; 784 } 785 786 /* 787 * protection against faulty packet - there should be 788 * more sanity checks in header chain processing. 789 */ 790 if (m->m_pkthdr.len < off) { 791 ip6stat.ip6s_tooshort++; 792 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 793 goto bad; 794 } 795 796 #if 0 797 /* 798 * do we need to do it for every header? yeah, other 799 * functions can play with it (like re-allocate and copy). 800 */ 801 mhist = ip6_addaux(m); 802 if (mhist && M_TRAILINGSPACE(mhist) >= sizeof(nxt)) { 803 hist = mtod(mhist, caddr_t) + mhist->m_len; 804 bcopy(&nxt, hist, sizeof(nxt)); 805 mhist->m_len += sizeof(nxt); 806 } else { 807 ip6stat.ip6s_toomanyhdr++; 808 goto bad; 809 } 810 #endif 811 812 #ifdef IPSEC 813 /* 814 * enforce IPsec policy checking if we are seeing last header. 815 * note that we do not visit this with protocols with pcb layer 816 * code - like udp/tcp/raw ip. 817 */ 818 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) && 819 ipsec6_in_reject(m, NULL)) { 820 ipsec6stat.in_polvio++; 821 goto bad; 822 } 823 #endif 824 825 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); 826 } 827 goto bad2; 828 bad: 829 m_freem(m); 830 bad2: 831 /* msg was embedded in the mbuf, do not reply! */ 832 return (EASYNC); 833 } 834 835 /* 836 * set/grab in6_ifaddr correspond to IPv6 destination address. 837 * XXX backward compatibility wrapper 838 */ 839 static struct ip6aux * 840 ip6_setdstifaddr(struct mbuf *m, struct in6_ifaddr *ia6) 841 { 842 struct ip6aux *n; 843 844 n = ip6_addaux(m); 845 if (n) 846 n->ip6a_dstia6 = ia6; 847 return n; /* NULL if failed to set */ 848 } 849 850 struct in6_ifaddr * 851 ip6_getdstifaddr(struct mbuf *m) 852 { 853 struct ip6aux *n; 854 855 n = ip6_findaux(m); 856 if (n) 857 return n->ip6a_dstia6; 858 else 859 return NULL; 860 } 861 862 /* 863 * Hop-by-Hop options header processing. If a valid jumbo payload option is 864 * included, the real payload length will be stored in plenp. 865 */ 866 static int 867 ip6_hopopts_input(u_int32_t *plenp, 868 u_int32_t *rtalertp,/* XXX: should be stored more smart way */ 869 struct mbuf **mp, 870 int *offp) 871 { 872 struct mbuf *m = *mp; 873 int off = *offp, hbhlen; 874 struct ip6_hbh *hbh; 875 u_int8_t *opt; 876 877 /* validation of the length of the header */ 878 #ifndef PULLDOWN_TEST 879 IP6_EXTHDR_CHECK(m, off, sizeof(*hbh), -1); 880 hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off); 881 hbhlen = (hbh->ip6h_len + 1) << 3; 882 883 IP6_EXTHDR_CHECK(m, off, hbhlen, -1); 884 hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off); 885 #else 886 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, 887 sizeof(struct ip6_hdr), sizeof(struct ip6_hbh)); 888 if (hbh == NULL) { 889 ip6stat.ip6s_tooshort++; 890 return -1; 891 } 892 hbhlen = (hbh->ip6h_len + 1) << 3; 893 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 894 hbhlen); 895 if (hbh == NULL) { 896 ip6stat.ip6s_tooshort++; 897 return -1; 898 } 899 #endif 900 off += hbhlen; 901 hbhlen -= sizeof(struct ip6_hbh); 902 opt = (u_int8_t *)hbh + sizeof(struct ip6_hbh); 903 904 if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh), 905 hbhlen, rtalertp, plenp) < 0) 906 return (-1); 907 908 *offp = off; 909 *mp = m; 910 return (0); 911 } 912 913 /* 914 * Search header for all Hop-by-hop options and process each option. 915 * This function is separate from ip6_hopopts_input() in order to 916 * handle a case where the sending node itself process its hop-by-hop 917 * options header. In such a case, the function is called from ip6_output(). 918 * 919 * The function assumes that hbh header is located right after the IPv6 header 920 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to 921 * opthead + hbhlen is located in continuous memory region. 922 */ 923 int 924 ip6_process_hopopts(struct mbuf *m, u_int8_t *opthead, int hbhlen, 925 u_int32_t *rtalertp, u_int32_t *plenp) 926 { 927 struct ip6_hdr *ip6; 928 int optlen = 0; 929 u_int8_t *opt = opthead; 930 u_int16_t rtalert_val; 931 u_int32_t jumboplen; 932 const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh); 933 934 for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) { 935 switch (*opt) { 936 case IP6OPT_PAD1: 937 optlen = 1; 938 break; 939 case IP6OPT_PADN: 940 if (hbhlen < IP6OPT_MINLEN) { 941 ip6stat.ip6s_toosmall++; 942 goto bad; 943 } 944 optlen = *(opt + 1) + 2; 945 break; 946 case IP6OPT_RTALERT: 947 /* XXX may need check for alignment */ 948 if (hbhlen < IP6OPT_RTALERT_LEN) { 949 ip6stat.ip6s_toosmall++; 950 goto bad; 951 } 952 if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) { 953 /* XXX stat */ 954 icmp6_error(m, ICMP6_PARAM_PROB, 955 ICMP6_PARAMPROB_HEADER, 956 erroff + opt + 1 - opthead); 957 return (-1); 958 } 959 optlen = IP6OPT_RTALERT_LEN; 960 bcopy((caddr_t)(opt + 2), (caddr_t)&rtalert_val, 2); 961 *rtalertp = ntohs(rtalert_val); 962 break; 963 case IP6OPT_JUMBO: 964 /* XXX may need check for alignment */ 965 if (hbhlen < IP6OPT_JUMBO_LEN) { 966 ip6stat.ip6s_toosmall++; 967 goto bad; 968 } 969 if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) { 970 /* XXX stat */ 971 icmp6_error(m, ICMP6_PARAM_PROB, 972 ICMP6_PARAMPROB_HEADER, 973 erroff + opt + 1 - opthead); 974 return (-1); 975 } 976 optlen = IP6OPT_JUMBO_LEN; 977 978 /* 979 * IPv6 packets that have non 0 payload length 980 * must not contain a jumbo payload option. 981 */ 982 ip6 = mtod(m, struct ip6_hdr *); 983 if (ip6->ip6_plen) { 984 ip6stat.ip6s_badoptions++; 985 icmp6_error(m, ICMP6_PARAM_PROB, 986 ICMP6_PARAMPROB_HEADER, 987 erroff + opt - opthead); 988 return (-1); 989 } 990 991 /* 992 * We may see jumbolen in unaligned location, so 993 * we'd need to perform bcopy(). 994 */ 995 bcopy(opt + 2, &jumboplen, sizeof(jumboplen)); 996 jumboplen = (u_int32_t)htonl(jumboplen); 997 998 #if 1 999 /* 1000 * if there are multiple jumbo payload options, 1001 * *plenp will be non-zero and the packet will be 1002 * rejected. 1003 * the behavior may need some debate in ipngwg - 1004 * multiple options does not make sense, however, 1005 * there's no explicit mention in specification. 1006 */ 1007 if (*plenp != 0) { 1008 ip6stat.ip6s_badoptions++; 1009 icmp6_error(m, ICMP6_PARAM_PROB, 1010 ICMP6_PARAMPROB_HEADER, 1011 erroff + opt + 2 - opthead); 1012 return (-1); 1013 } 1014 #endif 1015 1016 /* 1017 * jumbo payload length must be larger than 65535. 1018 */ 1019 if (jumboplen <= IPV6_MAXPACKET) { 1020 ip6stat.ip6s_badoptions++; 1021 icmp6_error(m, ICMP6_PARAM_PROB, 1022 ICMP6_PARAMPROB_HEADER, 1023 erroff + opt + 2 - opthead); 1024 return (-1); 1025 } 1026 *plenp = jumboplen; 1027 1028 break; 1029 default: /* unknown option */ 1030 if (hbhlen < IP6OPT_MINLEN) { 1031 ip6stat.ip6s_toosmall++; 1032 goto bad; 1033 } 1034 optlen = ip6_unknown_opt(opt, m, 1035 erroff + opt - opthead); 1036 if (optlen == -1) 1037 return (-1); 1038 optlen += 2; 1039 break; 1040 } 1041 } 1042 1043 return (0); 1044 1045 bad: 1046 m_freem(m); 1047 return (-1); 1048 } 1049 1050 /* 1051 * Unknown option processing. 1052 * The third argument `off' is the offset from the IPv6 header to the option, 1053 * which is necessary if the IPv6 header the and option header and IPv6 header 1054 * is not continuous in order to return an ICMPv6 error. 1055 */ 1056 int 1057 ip6_unknown_opt(u_int8_t *optp, struct mbuf *m, int off) 1058 { 1059 struct ip6_hdr *ip6; 1060 1061 switch (IP6OPT_TYPE(*optp)) { 1062 case IP6OPT_TYPE_SKIP: /* ignore the option */ 1063 return ((int)*(optp + 1)); 1064 case IP6OPT_TYPE_DISCARD: /* silently discard */ 1065 m_freem(m); 1066 return (-1); 1067 case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */ 1068 ip6stat.ip6s_badoptions++; 1069 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off); 1070 return (-1); 1071 case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */ 1072 ip6stat.ip6s_badoptions++; 1073 ip6 = mtod(m, struct ip6_hdr *); 1074 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 1075 (m->m_flags & (M_BCAST|M_MCAST))) 1076 m_freem(m); 1077 else 1078 icmp6_error(m, ICMP6_PARAM_PROB, 1079 ICMP6_PARAMPROB_OPTION, off); 1080 return (-1); 1081 } 1082 1083 m_freem(m); /* XXX: NOTREACHED */ 1084 return (-1); 1085 } 1086 1087 /* 1088 * Create the "control" list for this pcb. 1089 * The function will not modify mbuf chain at all. 1090 * 1091 * with KAME mbuf chain restriction: 1092 * The routine will be called from upper layer handlers like tcp6_input(). 1093 * Thus the routine assumes that the caller (tcp6_input) have already 1094 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the 1095 * very first mbuf on the mbuf chain. 1096 */ 1097 void 1098 ip6_savecontrol(struct inpcb *in6p, struct mbuf **mp, struct ip6_hdr *ip6, 1099 struct mbuf *m) 1100 { 1101 struct thread *td = curthread; /* XXX */ 1102 int privileged = 0; 1103 int rthdr_exist = 0; 1104 1105 1106 if (suser(td) == 0) 1107 privileged++; 1108 1109 #ifdef SO_TIMESTAMP 1110 if (in6p->in6p_socket->so_options & SO_TIMESTAMP) { 1111 struct timeval tv; 1112 1113 microtime(&tv); 1114 *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv), 1115 SCM_TIMESTAMP, SOL_SOCKET); 1116 if (*mp) { 1117 mp = &(*mp)->m_next; 1118 } 1119 } 1120 #endif 1121 1122 /* RFC 2292 sec. 5 */ 1123 if (in6p->in6p_flags & IN6P_PKTINFO) { 1124 struct in6_pktinfo pi6; 1125 bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr)); 1126 if (IN6_IS_SCOPE_LINKLOCAL(&pi6.ipi6_addr)) 1127 pi6.ipi6_addr.s6_addr16[1] = 0; 1128 pi6.ipi6_ifindex = (m && m->m_pkthdr.rcvif) 1129 ? m->m_pkthdr.rcvif->if_index 1130 : 0; 1131 *mp = sbcreatecontrol((caddr_t) &pi6, 1132 sizeof(struct in6_pktinfo), IPV6_PKTINFO, 1133 IPPROTO_IPV6); 1134 if (*mp) 1135 mp = &(*mp)->m_next; 1136 } 1137 1138 if (in6p->in6p_flags & IN6P_HOPLIMIT) { 1139 int hlim = ip6->ip6_hlim & 0xff; 1140 *mp = sbcreatecontrol((caddr_t) &hlim, 1141 sizeof(int), IPV6_HOPLIMIT, IPPROTO_IPV6); 1142 if (*mp) 1143 mp = &(*mp)->m_next; 1144 } 1145 1146 /* 1147 * IPV6_HOPOPTS socket option. We require super-user privilege 1148 * for the option, but it might be too strict, since there might 1149 * be some hop-by-hop options which can be returned to normal user. 1150 * See RFC 2292 section 6. 1151 */ 1152 if ((in6p->in6p_flags & IN6P_HOPOPTS) && privileged) { 1153 /* 1154 * Check if a hop-by-hop options header is contatined in the 1155 * received packet, and if so, store the options as ancillary 1156 * data. Note that a hop-by-hop options header must be 1157 * just after the IPv6 header, which fact is assured through 1158 * the IPv6 input processing. 1159 */ 1160 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1161 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 1162 struct ip6_hbh *hbh; 1163 int hbhlen = 0; 1164 #ifdef PULLDOWN_TEST 1165 struct mbuf *ext; 1166 #endif 1167 1168 #ifndef PULLDOWN_TEST 1169 hbh = (struct ip6_hbh *)(ip6 + 1); 1170 hbhlen = (hbh->ip6h_len + 1) << 3; 1171 #else 1172 ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr), 1173 ip6->ip6_nxt); 1174 if (ext == NULL) { 1175 ip6stat.ip6s_tooshort++; 1176 return; 1177 } 1178 hbh = mtod(ext, struct ip6_hbh *); 1179 hbhlen = (hbh->ip6h_len + 1) << 3; 1180 if (hbhlen != ext->m_len) { 1181 m_freem(ext); 1182 ip6stat.ip6s_tooshort++; 1183 return; 1184 } 1185 #endif 1186 1187 /* 1188 * XXX: We copy whole the header even if a jumbo 1189 * payload option is included, which option is to 1190 * be removed before returning in the RFC 2292. 1191 * Note: this constraint is removed in 2292bis. 1192 */ 1193 *mp = sbcreatecontrol((caddr_t)hbh, hbhlen, 1194 IPV6_HOPOPTS, IPPROTO_IPV6); 1195 if (*mp) 1196 mp = &(*mp)->m_next; 1197 #ifdef PULLDOWN_TEST 1198 m_freem(ext); 1199 #endif 1200 } 1201 } 1202 1203 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */ 1204 if ((in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDRDSTOPTS)) != 0) { 1205 int proto, off, nxt; 1206 1207 /* 1208 * go through the header chain to see if a routing header is 1209 * contained in the packet. We need this information to store 1210 * destination options headers (if any) properly. 1211 * XXX: performance issue. We should record this info when 1212 * processing extension headers in incoming routine. 1213 * (todo) use m_aux? 1214 */ 1215 proto = IPPROTO_IPV6; 1216 off = 0; 1217 nxt = -1; 1218 while (1) { 1219 int newoff; 1220 1221 newoff = ip6_nexthdr(m, off, proto, &nxt); 1222 if (newoff < 0) 1223 break; 1224 if (newoff < off) /* invalid, check for safety */ 1225 break; 1226 if ((proto = nxt) == IPPROTO_ROUTING) { 1227 rthdr_exist = 1; 1228 break; 1229 } 1230 off = newoff; 1231 } 1232 } 1233 1234 if ((in6p->in6p_flags & 1235 (IN6P_RTHDR | IN6P_DSTOPTS | IN6P_RTHDRDSTOPTS)) != 0) { 1236 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1237 int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr); 1238 1239 /* 1240 * Search for destination options headers or routing 1241 * header(s) through the header chain, and stores each 1242 * header as ancillary data. 1243 * Note that the order of the headers remains in 1244 * the chain of ancillary data. 1245 */ 1246 while (1) { /* is explicit loop prevention necessary? */ 1247 struct ip6_ext *ip6e = NULL; 1248 int elen; 1249 #ifdef PULLDOWN_TEST 1250 struct mbuf *ext = NULL; 1251 #endif 1252 1253 /* 1254 * if it is not an extension header, don't try to 1255 * pull it from the chain. 1256 */ 1257 switch (nxt) { 1258 case IPPROTO_DSTOPTS: 1259 case IPPROTO_ROUTING: 1260 case IPPROTO_HOPOPTS: 1261 case IPPROTO_AH: /* is it possible? */ 1262 break; 1263 default: 1264 goto loopend; 1265 } 1266 1267 #ifndef PULLDOWN_TEST 1268 if (off + sizeof(*ip6e) > m->m_len) 1269 goto loopend; 1270 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off); 1271 if (nxt == IPPROTO_AH) 1272 elen = (ip6e->ip6e_len + 2) << 2; 1273 else 1274 elen = (ip6e->ip6e_len + 1) << 3; 1275 if (off + elen > m->m_len) 1276 goto loopend; 1277 #else 1278 ext = ip6_pullexthdr(m, off, nxt); 1279 if (ext == NULL) { 1280 ip6stat.ip6s_tooshort++; 1281 return; 1282 } 1283 ip6e = mtod(ext, struct ip6_ext *); 1284 if (nxt == IPPROTO_AH) 1285 elen = (ip6e->ip6e_len + 2) << 2; 1286 else 1287 elen = (ip6e->ip6e_len + 1) << 3; 1288 if (elen != ext->m_len) { 1289 m_freem(ext); 1290 ip6stat.ip6s_tooshort++; 1291 return; 1292 } 1293 #endif 1294 1295 switch (nxt) { 1296 case IPPROTO_DSTOPTS: 1297 if ((in6p->in6p_flags & IN6P_DSTOPTS) == 0) 1298 break; 1299 1300 /* 1301 * We also require super-user privilege for 1302 * the option. 1303 * See the comments on IN6_HOPOPTS. 1304 */ 1305 if (!privileged) 1306 break; 1307 1308 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1309 IPV6_DSTOPTS, 1310 IPPROTO_IPV6); 1311 if (*mp) 1312 mp = &(*mp)->m_next; 1313 break; 1314 case IPPROTO_ROUTING: 1315 if (!in6p->in6p_flags & IN6P_RTHDR) 1316 break; 1317 1318 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1319 IPV6_RTHDR, 1320 IPPROTO_IPV6); 1321 if (*mp) 1322 mp = &(*mp)->m_next; 1323 break; 1324 case IPPROTO_HOPOPTS: 1325 case IPPROTO_AH: /* is it possible? */ 1326 break; 1327 1328 default: 1329 /* 1330 * other cases have been filtered in the above. 1331 * none will visit this case. here we supply 1332 * the code just in case (nxt overwritten or 1333 * other cases). 1334 */ 1335 #ifdef PULLDOWN_TEST 1336 m_freem(ext); 1337 #endif 1338 goto loopend; 1339 1340 } 1341 1342 /* proceed with the next header. */ 1343 off += elen; 1344 nxt = ip6e->ip6e_nxt; 1345 ip6e = NULL; 1346 #ifdef PULLDOWN_TEST 1347 m_freem(ext); 1348 ext = NULL; 1349 #endif 1350 } 1351 loopend: 1352 ; 1353 } 1354 1355 } 1356 1357 #ifdef PULLDOWN_TEST 1358 /* 1359 * pull single extension header from mbuf chain. returns single mbuf that 1360 * contains the result, or NULL on error. 1361 */ 1362 static struct mbuf * 1363 ip6_pullexthdr(struct mbuf *m, size_t off, int nxt) 1364 { 1365 struct ip6_ext ip6e; 1366 size_t elen; 1367 struct mbuf *n; 1368 1369 #ifdef DIAGNOSTIC 1370 switch (nxt) { 1371 case IPPROTO_DSTOPTS: 1372 case IPPROTO_ROUTING: 1373 case IPPROTO_HOPOPTS: 1374 case IPPROTO_AH: /* is it possible? */ 1375 break; 1376 default: 1377 kprintf("ip6_pullexthdr: invalid nxt=%d\n", nxt); 1378 } 1379 #endif 1380 1381 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1382 if (nxt == IPPROTO_AH) 1383 elen = (ip6e.ip6e_len + 2) << 2; 1384 else 1385 elen = (ip6e.ip6e_len + 1) << 3; 1386 1387 n = m_getb(elen, MB_DONTWAIT, MT_DATA, 0); 1388 if (n == NULL) 1389 return NULL; 1390 n->m_len = 0; 1391 1392 if (elen >= M_TRAILINGSPACE(n)) { 1393 m_free(n); 1394 return NULL; 1395 } 1396 1397 m_copydata(m, off, elen, mtod(n, caddr_t)); 1398 n->m_len = elen; 1399 return n; 1400 } 1401 #endif 1402 1403 /* 1404 * Get pointer to the previous header followed by the header 1405 * currently processed. 1406 * XXX: This function supposes that 1407 * M includes all headers, 1408 * the next header field and the header length field of each header 1409 * are valid, and 1410 * the sum of each header length equals to OFF. 1411 * Because of these assumptions, this function must be called very 1412 * carefully. Moreover, it will not be used in the near future when 1413 * we develop `neater' mechanism to process extension headers. 1414 */ 1415 char * 1416 ip6_get_prevhdr(struct mbuf *m, int off) 1417 { 1418 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1419 1420 if (off == sizeof(struct ip6_hdr)) 1421 return (&ip6->ip6_nxt); 1422 else { 1423 int len, nxt; 1424 struct ip6_ext *ip6e = NULL; 1425 1426 nxt = ip6->ip6_nxt; 1427 len = sizeof(struct ip6_hdr); 1428 while (len < off) { 1429 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + len); 1430 1431 switch (nxt) { 1432 case IPPROTO_FRAGMENT: 1433 len += sizeof(struct ip6_frag); 1434 break; 1435 case IPPROTO_AH: 1436 len += (ip6e->ip6e_len + 2) << 2; 1437 break; 1438 default: 1439 len += (ip6e->ip6e_len + 1) << 3; 1440 break; 1441 } 1442 nxt = ip6e->ip6e_nxt; 1443 } 1444 if (ip6e) 1445 return (&ip6e->ip6e_nxt); 1446 else 1447 return NULL; 1448 } 1449 } 1450 1451 /* 1452 * get next header offset. m will be retained. 1453 */ 1454 int 1455 ip6_nexthdr(struct mbuf *m, int off, int proto, int *nxtp) 1456 { 1457 struct ip6_hdr ip6; 1458 struct ip6_ext ip6e; 1459 struct ip6_frag fh; 1460 1461 /* just in case */ 1462 if (m == NULL) 1463 panic("ip6_nexthdr: m == NULL"); 1464 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off) 1465 return -1; 1466 1467 switch (proto) { 1468 case IPPROTO_IPV6: 1469 if (m->m_pkthdr.len < off + sizeof(ip6)) 1470 return -1; 1471 m_copydata(m, off, sizeof(ip6), (caddr_t)&ip6); 1472 if (nxtp) 1473 *nxtp = ip6.ip6_nxt; 1474 off += sizeof(ip6); 1475 return off; 1476 1477 case IPPROTO_FRAGMENT: 1478 /* 1479 * terminate parsing if it is not the first fragment, 1480 * it does not make sense to parse through it. 1481 */ 1482 if (m->m_pkthdr.len < off + sizeof(fh)) 1483 return -1; 1484 m_copydata(m, off, sizeof(fh), (caddr_t)&fh); 1485 /* IP6F_OFF_MASK = 0xfff8(BigEndian), 0xf8ff(LittleEndian) */ 1486 if (fh.ip6f_offlg & IP6F_OFF_MASK) 1487 return -1; 1488 if (nxtp) 1489 *nxtp = fh.ip6f_nxt; 1490 off += sizeof(struct ip6_frag); 1491 return off; 1492 1493 case IPPROTO_AH: 1494 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1495 return -1; 1496 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1497 if (nxtp) 1498 *nxtp = ip6e.ip6e_nxt; 1499 off += (ip6e.ip6e_len + 2) << 2; 1500 return off; 1501 1502 case IPPROTO_HOPOPTS: 1503 case IPPROTO_ROUTING: 1504 case IPPROTO_DSTOPTS: 1505 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1506 return -1; 1507 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1508 if (nxtp) 1509 *nxtp = ip6e.ip6e_nxt; 1510 off += (ip6e.ip6e_len + 1) << 3; 1511 return off; 1512 1513 case IPPROTO_NONE: 1514 case IPPROTO_ESP: 1515 case IPPROTO_IPCOMP: 1516 /* give up */ 1517 return -1; 1518 1519 default: 1520 return -1; 1521 } 1522 1523 return -1; 1524 } 1525 1526 /* 1527 * get offset for the last header in the chain. m will be kept untainted. 1528 */ 1529 int 1530 ip6_lasthdr(struct mbuf *m, int off, int proto, int *nxtp) 1531 { 1532 int newoff; 1533 int nxt; 1534 1535 if (!nxtp) { 1536 nxt = -1; 1537 nxtp = &nxt; 1538 } 1539 while (1) { 1540 newoff = ip6_nexthdr(m, off, proto, nxtp); 1541 if (newoff < 0) 1542 return off; 1543 else if (newoff < off) 1544 return -1; /* invalid */ 1545 else if (newoff == off) 1546 return newoff; 1547 1548 off = newoff; 1549 proto = *nxtp; 1550 } 1551 } 1552 1553 struct ip6aux * 1554 ip6_addaux(struct mbuf *m) 1555 { 1556 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1557 if (!tag) { 1558 tag = m_tag_get(PACKET_TAG_IPV6_INPUT, 1559 sizeof (struct ip6aux), 1560 MB_DONTWAIT); 1561 if (tag) 1562 m_tag_prepend(m, tag); 1563 } 1564 if (tag) 1565 bzero(m_tag_data(tag), sizeof (struct ip6aux)); 1566 return tag ? (struct ip6aux *)m_tag_data(tag) : NULL; 1567 } 1568 1569 struct ip6aux * 1570 ip6_findaux(struct mbuf *m) 1571 { 1572 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1573 return tag ? (struct ip6aux*)(tag+1) : NULL; 1574 } 1575 1576 void 1577 ip6_delaux(struct mbuf *m) 1578 { 1579 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1580 if (tag) 1581 m_tag_delete(m, tag); 1582 } 1583 1584 /* 1585 * System control for IP6 1586 */ 1587 1588 u_char inet6ctlerrmap[PRC_NCMDS] = { 1589 0, 0, 0, 0, 1590 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, 1591 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, 1592 EMSGSIZE, EHOSTUNREACH, 0, 0, 1593 0, 0, 0, 0, 1594 ENOPROTOOPT 1595 }; 1596