1 /* $FreeBSD: src/sys/netinet6/ip6_input.c,v 1.11.2.15 2003/01/24 05:11:35 sam Exp $ */ 2 /* $DragonFly: src/sys/netinet6/ip6_input.c,v 1.33 2007/05/07 13:00:16 hasso Exp $ */ 3 /* $KAME: ip6_input.c,v 1.259 2002/01/21 04:58:09 jinmei Exp $ */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 /* 35 * Copyright (c) 1982, 1986, 1988, 1993 36 * The Regents of the University of California. All rights reserved. 37 * 38 * Redistribution and use in source and binary forms, with or without 39 * modification, are permitted provided that the following conditions 40 * are met: 41 * 1. Redistributions of source code must retain the above copyright 42 * notice, this list of conditions and the following disclaimer. 43 * 2. Redistributions in binary form must reproduce the above copyright 44 * notice, this list of conditions and the following disclaimer in the 45 * documentation and/or other materials provided with the distribution. 46 * 3. All advertising materials mentioning features or use of this software 47 * must display the following acknowledgement: 48 * This product includes software developed by the University of 49 * California, Berkeley and its contributors. 50 * 4. Neither the name of the University nor the names of its contributors 51 * may be used to endorse or promote products derived from this software 52 * without specific prior written permission. 53 * 54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 64 * SUCH DAMAGE. 65 * 66 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 67 */ 68 69 #include "opt_ip6fw.h" 70 #include "opt_inet.h" 71 #include "opt_inet6.h" 72 #include "opt_ipsec.h" 73 74 #include <sys/param.h> 75 #include <sys/systm.h> 76 #include <sys/malloc.h> 77 #include <sys/mbuf.h> 78 #include <sys/domain.h> 79 #include <sys/protosw.h> 80 #include <sys/socket.h> 81 #include <sys/socketvar.h> 82 #include <sys/errno.h> 83 #include <sys/time.h> 84 #include <sys/kernel.h> 85 #include <sys/syslog.h> 86 #include <sys/proc.h> 87 88 #include <sys/thread2.h> 89 #include <sys/msgport2.h> 90 91 #include <net/if.h> 92 #include <net/if_types.h> 93 #include <net/if_dl.h> 94 #include <net/route.h> 95 #include <net/netisr.h> 96 #include <net/pfil.h> 97 98 #include <netinet/in.h> 99 #include <netinet/in_systm.h> 100 #ifdef INET 101 #include <netinet/ip.h> 102 #include <netinet/ip_icmp.h> 103 #endif /* INET */ 104 #include <netinet/ip6.h> 105 #include <netinet6/in6_var.h> 106 #include <netinet6/ip6_var.h> 107 #include <netinet/in_pcb.h> 108 #include <netinet/icmp6.h> 109 #include <netinet6/scope6_var.h> 110 #include <netinet6/in6_ifattach.h> 111 #include <netinet6/nd6.h> 112 #include <netinet6/in6_prefix.h> 113 114 #ifdef IPSEC 115 #include <netinet6/ipsec.h> 116 #ifdef INET6 117 #include <netinet6/ipsec6.h> 118 #endif 119 #endif 120 121 #ifdef FAST_IPSEC 122 #include <netproto/ipsec/ipsec.h> 123 #include <netproto/ipsec/ipsec6.h> 124 #define IPSEC 125 #endif /* FAST_IPSEC */ 126 127 #include <net/ip6fw/ip6_fw.h> 128 129 #include <netinet6/ip6protosw.h> 130 131 /* we need it for NLOOP. */ 132 #include "use_loop.h" 133 134 #include <net/net_osdep.h> 135 136 extern struct domain inet6domain; 137 extern struct ip6protosw inet6sw[]; 138 139 u_char ip6_protox[IPPROTO_MAX]; 140 struct in6_ifaddr *in6_ifaddr; 141 142 extern struct callout in6_tmpaddrtimer_ch; 143 144 int ip6_forward_srcrt; /* XXX */ 145 int ip6_sourcecheck; /* XXX */ 146 int ip6_sourcecheck_interval; /* XXX */ 147 148 int ip6_ours_check_algorithm; 149 150 struct pfil_head inet6_pfil_hook; 151 152 /* firewall hooks */ 153 ip6_fw_chk_t *ip6_fw_chk_ptr; 154 ip6_fw_ctl_t *ip6_fw_ctl_ptr; 155 int ip6_fw_enable = 1; 156 157 struct ip6stat ip6stat; 158 159 static void ip6_init2 (void *); 160 static struct ip6aux *ip6_setdstifaddr (struct mbuf *, struct in6_ifaddr *); 161 static int ip6_hopopts_input (u_int32_t *, u_int32_t *, struct mbuf **, int *); 162 static int ip6_input(struct netmsg *msg); 163 #ifdef PULLDOWN_TEST 164 static struct mbuf *ip6_pullexthdr (struct mbuf *, size_t, int); 165 #endif 166 167 /* 168 * IP6 initialization: fill in IP6 protocol switch table. 169 * All protocols not implemented in kernel go to raw IP6 protocol handler. 170 */ 171 void 172 ip6_init(void) 173 { 174 struct ip6protosw *pr; 175 int i; 176 struct timeval tv; 177 178 #ifdef DIAGNOSTIC 179 if (sizeof(struct protosw) != sizeof(struct ip6protosw)) 180 panic("sizeof(protosw) != sizeof(ip6protosw)"); 181 #endif 182 pr = (struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW); 183 if (pr == 0) 184 panic("ip6_init"); 185 for (i = 0; i < IPPROTO_MAX; i++) 186 ip6_protox[i] = pr - inet6sw; 187 for (pr = (struct ip6protosw *)inet6domain.dom_protosw; 188 pr < (struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++) 189 if (pr->pr_domain->dom_family == PF_INET6 && 190 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) 191 ip6_protox[pr->pr_protocol] = pr - inet6sw; 192 193 inet6_pfil_hook.ph_type = PFIL_TYPE_AF; 194 inet6_pfil_hook.ph_af = AF_INET6; 195 if ((i = pfil_head_register(&inet6_pfil_hook)) != 0) { 196 kprintf("%s: WARNING: unable to register pfil hook, " 197 "error %d\n", __func__, i); 198 } 199 200 netisr_register(NETISR_IPV6, cpu0_portfn, ip6_input); 201 scope6_init(); 202 nd6_init(); 203 frag6_init(); 204 /* 205 * in many cases, random() here does NOT return random number 206 * as initialization during bootstrap time occur in fixed order. 207 */ 208 microtime(&tv); 209 ip6_flow_seq = krandom() ^ tv.tv_usec; 210 microtime(&tv); 211 ip6_desync_factor = (krandom() ^ tv.tv_usec) % MAX_TEMP_DESYNC_FACTOR; 212 } 213 214 static void 215 ip6_init2(void *dummy) 216 { 217 /* nd6_timer_init */ 218 callout_init(&nd6_timer_ch); 219 callout_reset(&nd6_timer_ch, hz, nd6_timer, NULL); 220 221 /* router renumbering prefix list maintenance */ 222 callout_init(&in6_rr_timer_ch); 223 callout_reset(&in6_rr_timer_ch, hz, in6_rr_timer, NULL); 224 225 /* timer for regeneranation of temporary addresses randomize ID */ 226 callout_init(&in6_tmpaddrtimer_ch); 227 callout_reset(&in6_tmpaddrtimer_ch, 228 (ip6_temp_preferred_lifetime - ip6_desync_factor - 229 ip6_temp_regen_advance) * hz, 230 in6_tmpaddrtimer, NULL); 231 } 232 233 /* cheat */ 234 /* This must be after route_init(), which is now SI_ORDER_THIRD */ 235 SYSINIT(netinet6init2, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ip6_init2, NULL); 236 237 extern struct route_in6 ip6_forward_rt; 238 239 static 240 int 241 ip6_input(struct netmsg *msg) 242 { 243 struct mbuf *m = ((struct netmsg_packet *)msg)->nm_packet; 244 struct ip6_hdr *ip6; 245 int off = sizeof(struct ip6_hdr), nest; 246 u_int32_t plen; 247 u_int32_t rtalert = ~0; 248 int nxt, ours = 0, rh_present = 0; 249 struct ifnet *deliverifp = NULL; 250 struct in6_addr odst; 251 int srcrt = 0; 252 253 #ifdef IPSEC 254 /* 255 * should the inner packet be considered authentic? 256 * see comment in ah4_input(). 257 */ 258 if (m) { 259 m->m_flags &= ~M_AUTHIPHDR; 260 m->m_flags &= ~M_AUTHIPDGM; 261 } 262 #endif 263 264 /* 265 * make sure we don't have onion peering information into m_aux. 266 */ 267 ip6_delaux(m); 268 269 /* 270 * mbuf statistics 271 */ 272 if (m->m_flags & M_EXT) { 273 if (m->m_next) 274 ip6stat.ip6s_mext2m++; 275 else 276 ip6stat.ip6s_mext1++; 277 } else { 278 #define M2MMAX (sizeof(ip6stat.ip6s_m2m)/sizeof(ip6stat.ip6s_m2m[0])) 279 if (m->m_next) { 280 if (m->m_flags & M_LOOP) { 281 ip6stat.ip6s_m2m[loif[0].if_index]++; /* XXX */ 282 } else if (m->m_pkthdr.rcvif->if_index < M2MMAX) 283 ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++; 284 else 285 ip6stat.ip6s_m2m[0]++; 286 } else 287 ip6stat.ip6s_m1++; 288 #undef M2MMAX 289 } 290 291 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive); 292 ip6stat.ip6s_total++; 293 294 #ifndef PULLDOWN_TEST 295 /* 296 * L2 bridge code and some other code can return mbuf chain 297 * that does not conform to KAME requirement. too bad. 298 * XXX: fails to join if interface MTU > MCLBYTES. jumbogram? 299 */ 300 if (m && m->m_next != NULL && m->m_pkthdr.len < MCLBYTES) { 301 struct mbuf *n; 302 303 n = m_getb(m->m_pkthdr.len, MB_DONTWAIT, MT_HEADER, M_PKTHDR); 304 if (n == NULL) 305 goto bad; 306 M_MOVE_PKTHDR(n, m); 307 308 m_copydata(m, 0, n->m_pkthdr.len, mtod(n, caddr_t)); 309 n->m_len = n->m_pkthdr.len; 310 m_freem(m); 311 m = n; 312 } 313 IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), EASYNC); 314 #endif 315 316 if (m->m_len < sizeof(struct ip6_hdr)) { 317 struct ifnet *inifp; 318 inifp = m->m_pkthdr.rcvif; 319 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == 0) { 320 ip6stat.ip6s_toosmall++; 321 in6_ifstat_inc(inifp, ifs6_in_hdrerr); 322 goto bad2; 323 } 324 } 325 326 ip6 = mtod(m, struct ip6_hdr *); 327 328 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) { 329 ip6stat.ip6s_badvers++; 330 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 331 goto bad; 332 } 333 334 /* 335 * Run through list of hooks for input packets. 336 * 337 * NB: Beware of the destination address changing 338 * (e.g. by NAT rewriting). When this happens, 339 * tell ip6_forward to do the right thing. 340 */ 341 if (pfil_has_hooks(&inet6_pfil_hook)) { 342 odst = ip6->ip6_dst; 343 if (pfil_run_hooks(&inet6_pfil_hook, &m, 344 m->m_pkthdr.rcvif, PFIL_IN)) { 345 goto bad2; 346 } 347 if (m == NULL) /* consumed by filter */ 348 goto bad2; 349 ip6 = mtod(m, struct ip6_hdr *); 350 srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst); 351 } 352 353 ip6stat.ip6s_nxthist[ip6->ip6_nxt]++; 354 355 #ifdef ALTQ 356 if (altq_input != NULL && (*altq_input)(m, AF_INET6) == 0) { 357 /* packet is dropped by traffic conditioner */ 358 return (ENOBUFS); 359 } 360 #endif 361 362 /* 363 * Check with the firewall... 364 */ 365 if (ip6_fw_enable && ip6_fw_chk_ptr) { 366 u_short port = 0; 367 /* If ipfw says divert, we have to just drop packet */ 368 /* use port as a dummy argument */ 369 if ((*ip6_fw_chk_ptr)(&ip6, NULL, &port, &m)) { 370 m_freem(m); 371 m = NULL; 372 } 373 if (!m) 374 goto bad2; 375 } 376 377 /* 378 * Check against address spoofing/corruption. 379 */ 380 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) || 381 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { 382 /* 383 * XXX: "badscope" is not very suitable for a multicast source. 384 */ 385 ip6stat.ip6s_badscope++; 386 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 387 goto bad; 388 } 389 if ((IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) || 390 IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) && 391 (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { 392 ip6stat.ip6s_badscope++; 393 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 394 goto bad; 395 } 396 397 /* 398 * The following check is not documented in specs. A malicious 399 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack 400 * and bypass security checks (act as if it was from 127.0.0.1 by using 401 * IPv6 src ::ffff:127.0.0.1). Be cautious. 402 * 403 * This check chokes if we are in an SIIT cloud. As none of BSDs 404 * support IPv4-less kernel compilation, we cannot support SIIT 405 * environment at all. So, it makes more sense for us to reject any 406 * malicious packets for non-SIIT environment, than try to do a 407 * partical support for SIIT environment. 408 */ 409 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 410 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 411 ip6stat.ip6s_badscope++; 412 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 413 goto bad; 414 } 415 #if 0 416 /* 417 * Reject packets with IPv4 compatible addresses (auto tunnel). 418 * 419 * The code forbids auto tunnel relay case in RFC1933 (the check is 420 * stronger than RFC1933). We may want to re-enable it if mech-xx 421 * is revised to forbid relaying case. 422 */ 423 if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) || 424 IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) { 425 ip6stat.ip6s_badscope++; 426 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 427 goto bad; 428 } 429 #endif 430 431 /* drop packets if interface ID portion is already filled */ 432 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { 433 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src) && 434 ip6->ip6_src.s6_addr16[1]) { 435 ip6stat.ip6s_badscope++; 436 goto bad; 437 } 438 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) && 439 ip6->ip6_dst.s6_addr16[1]) { 440 ip6stat.ip6s_badscope++; 441 goto bad; 442 } 443 } 444 445 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) 446 ip6->ip6_src.s6_addr16[1] 447 = htons(m->m_pkthdr.rcvif->if_index); 448 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) 449 ip6->ip6_dst.s6_addr16[1] 450 = htons(m->m_pkthdr.rcvif->if_index); 451 452 #if 0 /* this case seems to be unnecessary. (jinmei, 20010401) */ 453 /* 454 * We use rt->rt_ifp to determine if the address is ours or not. 455 * If rt_ifp is lo0, the address is ours. 456 * The problem here is, rt->rt_ifp for fe80::%lo0/64 is set to lo0, 457 * so any address under fe80::%lo0/64 will be mistakenly considered 458 * local. The special case is supplied to handle the case properly 459 * by actually looking at interface addresses 460 * (using in6ifa_ifpwithaddr). 461 */ 462 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) && 463 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) { 464 if (!in6ifa_ifpwithaddr(m->m_pkthdr.rcvif, &ip6->ip6_dst)) { 465 icmp6_error(m, ICMP6_DST_UNREACH, 466 ICMP6_DST_UNREACH_ADDR, 0); 467 /* m is already freed */ 468 goto bad2; 469 } 470 471 ours = 1; 472 deliverifp = m->m_pkthdr.rcvif; 473 goto hbhcheck; 474 } 475 #endif 476 477 /* 478 * Multicast check 479 */ 480 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 481 struct in6_multi *in6m = 0; 482 483 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast); 484 /* 485 * See if we belong to the destination multicast group on the 486 * arrival interface. 487 */ 488 IN6_LOOKUP_MULTI(ip6->ip6_dst, m->m_pkthdr.rcvif, in6m); 489 if (in6m) 490 ours = 1; 491 else if (!ip6_mrouter) { 492 ip6stat.ip6s_notmember++; 493 ip6stat.ip6s_cantforward++; 494 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 495 goto bad; 496 } 497 deliverifp = m->m_pkthdr.rcvif; 498 goto hbhcheck; 499 } 500 501 /* 502 * Unicast check 503 */ 504 switch (ip6_ours_check_algorithm) { 505 default: 506 /* 507 * XXX: I intentionally broke our indentation rule here, 508 * since this switch-case is just for measurement and 509 * therefore should soon be removed. 510 */ 511 if (ip6_forward_rt.ro_rt != NULL && 512 (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) && 513 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 514 &((struct sockaddr_in6 *)(&ip6_forward_rt.ro_dst))->sin6_addr)) 515 ip6stat.ip6s_forward_cachehit++; 516 else { 517 struct sockaddr_in6 *dst6; 518 519 if (ip6_forward_rt.ro_rt) { 520 /* route is down or destination is different */ 521 ip6stat.ip6s_forward_cachemiss++; 522 RTFREE(ip6_forward_rt.ro_rt); 523 ip6_forward_rt.ro_rt = 0; 524 } 525 526 bzero(&ip6_forward_rt.ro_dst, sizeof(struct sockaddr_in6)); 527 dst6 = &ip6_forward_rt.ro_dst; 528 dst6->sin6_len = sizeof(struct sockaddr_in6); 529 dst6->sin6_family = AF_INET6; 530 dst6->sin6_addr = ip6->ip6_dst; 531 532 rtalloc_ign((struct route *)&ip6_forward_rt, RTF_PRCLONING); 533 } 534 535 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key)) 536 537 /* 538 * Accept the packet if the forwarding interface to the destination 539 * according to the routing table is the loopback interface, 540 * unless the associated route has a gateway. 541 * Note that this approach causes to accept a packet if there is a 542 * route to the loopback interface for the destination of the packet. 543 * But we think it's even useful in some situations, e.g. when using 544 * a special daemon which wants to intercept the packet. 545 * 546 * XXX: some OSes automatically make a cloned route for the destination 547 * of an outgoing packet. If the outgoing interface of the packet 548 * is a loopback one, the kernel would consider the packet to be 549 * accepted, even if we have no such address assinged on the interface. 550 * We check the cloned flag of the route entry to reject such cases, 551 * assuming that route entries for our own addresses are not made by 552 * cloning (it should be true because in6_addloop explicitly installs 553 * the host route). However, we might have to do an explicit check 554 * while it would be less efficient. Or, should we rather install a 555 * reject route for such a case? 556 */ 557 if (ip6_forward_rt.ro_rt && 558 (ip6_forward_rt.ro_rt->rt_flags & 559 (RTF_HOST|RTF_GATEWAY)) == RTF_HOST && 560 #ifdef RTF_WASCLONED 561 !(ip6_forward_rt.ro_rt->rt_flags & RTF_WASCLONED) && 562 #endif 563 #ifdef RTF_CLONED 564 !(ip6_forward_rt.ro_rt->rt_flags & RTF_CLONED) && 565 #endif 566 #if 0 567 /* 568 * The check below is redundant since the comparison of 569 * the destination and the key of the rtentry has 570 * already done through looking up the routing table. 571 */ 572 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 573 &rt6_key(ip6_forward_rt.ro_rt)->sin6_addr) 574 #endif 575 ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_LOOP) { 576 struct in6_ifaddr *ia6 = 577 (struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa; 578 579 /* 580 * record address information into m_aux. 581 */ 582 ip6_setdstifaddr(m, ia6); 583 584 /* 585 * packets to a tentative, duplicated, or somehow invalid 586 * address must not be accepted. 587 */ 588 if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) { 589 /* this address is ready */ 590 ours = 1; 591 deliverifp = ia6->ia_ifp; /* correct? */ 592 /* Count the packet in the ip address stats */ 593 ia6->ia_ifa.if_ipackets++; 594 ia6->ia_ifa.if_ibytes += m->m_pkthdr.len; 595 goto hbhcheck; 596 } else { 597 /* address is not ready, so discard the packet. */ 598 nd6log((LOG_INFO, 599 "ip6_input: packet to an unready address %s->%s\n", 600 ip6_sprintf(&ip6->ip6_src), 601 ip6_sprintf(&ip6->ip6_dst))); 602 603 goto bad; 604 } 605 } 606 } /* XXX indentation (see above) */ 607 608 /* 609 * FAITH(Firewall Aided Internet Translator) 610 */ 611 if (ip6_keepfaith) { 612 if (ip6_forward_rt.ro_rt && ip6_forward_rt.ro_rt->rt_ifp 613 && ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) { 614 /* XXX do we need more sanity checks? */ 615 ours = 1; 616 deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /* faith */ 617 goto hbhcheck; 618 } 619 } 620 621 /* 622 * Now there is no reason to process the packet if it's not our own 623 * and we're not a router. 624 */ 625 if (!ip6_forwarding) { 626 ip6stat.ip6s_cantforward++; 627 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 628 goto bad; 629 } 630 631 hbhcheck: 632 /* 633 * record address information into m_aux, if we don't have one yet. 634 * note that we are unable to record it, if the address is not listed 635 * as our interface address (e.g. multicast addresses, addresses 636 * within FAITH prefixes and such). 637 */ 638 if (deliverifp && !ip6_getdstifaddr(m)) { 639 struct in6_ifaddr *ia6; 640 641 ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst); 642 if (ia6) { 643 if (!ip6_setdstifaddr(m, ia6)) { 644 /* 645 * XXX maybe we should drop the packet here, 646 * as we could not provide enough information 647 * to the upper layers. 648 */ 649 } 650 } 651 } 652 653 /* 654 * Process Hop-by-Hop options header if it's contained. 655 * m may be modified in ip6_hopopts_input(). 656 * If a JumboPayload option is included, plen will also be modified. 657 */ 658 plen = (u_int32_t)ntohs(ip6->ip6_plen); 659 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 660 struct ip6_hbh *hbh; 661 662 if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) { 663 #if 0 /*touches NULL pointer*/ 664 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 665 #endif 666 goto bad2; /* m have already been freed */ 667 } 668 669 /* adjust pointer */ 670 ip6 = mtod(m, struct ip6_hdr *); 671 672 /* 673 * if the payload length field is 0 and the next header field 674 * indicates Hop-by-Hop Options header, then a Jumbo Payload 675 * option MUST be included. 676 */ 677 if (ip6->ip6_plen == 0 && plen == 0) { 678 /* 679 * Note that if a valid jumbo payload option is 680 * contained, ip6_hoptops_input() must set a valid 681 * (non-zero) payload length to the variable plen. 682 */ 683 ip6stat.ip6s_badoptions++; 684 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 685 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 686 icmp6_error(m, ICMP6_PARAM_PROB, 687 ICMP6_PARAMPROB_HEADER, 688 (caddr_t)&ip6->ip6_plen - (caddr_t)ip6); 689 goto bad2; 690 } 691 #ifndef PULLDOWN_TEST 692 /* ip6_hopopts_input() ensures that mbuf is contiguous */ 693 hbh = (struct ip6_hbh *)(ip6 + 1); 694 #else 695 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 696 sizeof(struct ip6_hbh)); 697 if (hbh == NULL) { 698 ip6stat.ip6s_tooshort++; 699 goto bad2; 700 } 701 #endif 702 nxt = hbh->ip6h_nxt; 703 704 /* 705 * accept the packet if a router alert option is included 706 * and we act as an IPv6 router. 707 */ 708 if (rtalert != ~0 && ip6_forwarding) 709 ours = 1; 710 } else 711 nxt = ip6->ip6_nxt; 712 713 /* 714 * Check that the amount of data in the buffers 715 * is as at least much as the IPv6 header would have us expect. 716 * Trim mbufs if longer than we expect. 717 * Drop packet if shorter than we expect. 718 */ 719 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) { 720 ip6stat.ip6s_tooshort++; 721 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 722 goto bad; 723 } 724 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) { 725 if (m->m_len == m->m_pkthdr.len) { 726 m->m_len = sizeof(struct ip6_hdr) + plen; 727 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen; 728 } else 729 m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len); 730 } 731 732 /* 733 * Forward if desirable. 734 */ 735 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 736 /* 737 * If we are acting as a multicast router, all 738 * incoming multicast packets are passed to the 739 * kernel-level multicast forwarding function. 740 * The packet is returned (relatively) intact; if 741 * ip6_mforward() returns a non-zero value, the packet 742 * must be discarded, else it may be accepted below. 743 */ 744 if (ip6_mrouter && ip6_mforward(ip6, m->m_pkthdr.rcvif, m)) { 745 ip6stat.ip6s_cantforward++; 746 goto bad; 747 } 748 if (!ours) 749 goto bad; 750 } else if (!ours) { 751 ip6_forward(m, srcrt); 752 goto bad2; 753 } 754 755 ip6 = mtod(m, struct ip6_hdr *); 756 757 /* 758 * Malicious party may be able to use IPv4 mapped addr to confuse 759 * tcp/udp stack and bypass security checks (act as if it was from 760 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious. 761 * 762 * For SIIT end node behavior, you may want to disable the check. 763 * However, you will become vulnerable to attacks using IPv4 mapped 764 * source. 765 */ 766 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 767 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 768 ip6stat.ip6s_badscope++; 769 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 770 goto bad; 771 } 772 773 /* 774 * Tell launch routine the next header 775 */ 776 ip6stat.ip6s_delivered++; 777 in6_ifstat_inc(deliverifp, ifs6_in_deliver); 778 nest = 0; 779 780 rh_present = 0; 781 while (nxt != IPPROTO_DONE) { 782 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 783 ip6stat.ip6s_toomanyhdr++; 784 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 785 goto bad; 786 } 787 788 /* 789 * protection against faulty packet - there should be 790 * more sanity checks in header chain processing. 791 */ 792 if (m->m_pkthdr.len < off) { 793 ip6stat.ip6s_tooshort++; 794 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 795 goto bad; 796 } 797 798 #if 0 799 /* 800 * do we need to do it for every header? yeah, other 801 * functions can play with it (like re-allocate and copy). 802 */ 803 mhist = ip6_addaux(m); 804 if (mhist && M_TRAILINGSPACE(mhist) >= sizeof(nxt)) { 805 hist = mtod(mhist, caddr_t) + mhist->m_len; 806 bcopy(&nxt, hist, sizeof(nxt)); 807 mhist->m_len += sizeof(nxt); 808 } else { 809 ip6stat.ip6s_toomanyhdr++; 810 goto bad; 811 } 812 #endif 813 814 if (nxt == IPPROTO_ROUTING) { 815 if (rh_present++) { 816 in6_ifstat_inc(m->m_pkthdr.rcvif, 817 ifs6_in_hdrerr); 818 ip6stat.ip6s_badoptions++; 819 goto bad; 820 } 821 } 822 823 #ifdef IPSEC 824 /* 825 * enforce IPsec policy checking if we are seeing last header. 826 * note that we do not visit this with protocols with pcb layer 827 * code - like udp/tcp/raw ip. 828 */ 829 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) && 830 ipsec6_in_reject(m, NULL)) { 831 ipsec6stat.in_polvio++; 832 goto bad; 833 } 834 #endif 835 836 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); 837 } 838 goto bad2; 839 bad: 840 m_freem(m); 841 bad2: 842 /* msg was embedded in the mbuf, do not reply! */ 843 return (EASYNC); 844 } 845 846 /* 847 * set/grab in6_ifaddr correspond to IPv6 destination address. 848 * XXX backward compatibility wrapper 849 */ 850 static struct ip6aux * 851 ip6_setdstifaddr(struct mbuf *m, struct in6_ifaddr *ia6) 852 { 853 struct ip6aux *n; 854 855 n = ip6_addaux(m); 856 if (n) 857 n->ip6a_dstia6 = ia6; 858 return n; /* NULL if failed to set */ 859 } 860 861 struct in6_ifaddr * 862 ip6_getdstifaddr(struct mbuf *m) 863 { 864 struct ip6aux *n; 865 866 n = ip6_findaux(m); 867 if (n) 868 return n->ip6a_dstia6; 869 else 870 return NULL; 871 } 872 873 /* 874 * Hop-by-Hop options header processing. If a valid jumbo payload option is 875 * included, the real payload length will be stored in plenp. 876 */ 877 static int 878 ip6_hopopts_input(u_int32_t *plenp, 879 u_int32_t *rtalertp,/* XXX: should be stored more smart way */ 880 struct mbuf **mp, 881 int *offp) 882 { 883 struct mbuf *m = *mp; 884 int off = *offp, hbhlen; 885 struct ip6_hbh *hbh; 886 u_int8_t *opt; 887 888 /* validation of the length of the header */ 889 #ifndef PULLDOWN_TEST 890 IP6_EXTHDR_CHECK(m, off, sizeof(*hbh), -1); 891 hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off); 892 hbhlen = (hbh->ip6h_len + 1) << 3; 893 894 IP6_EXTHDR_CHECK(m, off, hbhlen, -1); 895 hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off); 896 #else 897 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, 898 sizeof(struct ip6_hdr), sizeof(struct ip6_hbh)); 899 if (hbh == NULL) { 900 ip6stat.ip6s_tooshort++; 901 return -1; 902 } 903 hbhlen = (hbh->ip6h_len + 1) << 3; 904 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 905 hbhlen); 906 if (hbh == NULL) { 907 ip6stat.ip6s_tooshort++; 908 return -1; 909 } 910 #endif 911 off += hbhlen; 912 hbhlen -= sizeof(struct ip6_hbh); 913 opt = (u_int8_t *)hbh + sizeof(struct ip6_hbh); 914 915 if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh), 916 hbhlen, rtalertp, plenp) < 0) 917 return (-1); 918 919 *offp = off; 920 *mp = m; 921 return (0); 922 } 923 924 /* 925 * Search header for all Hop-by-hop options and process each option. 926 * This function is separate from ip6_hopopts_input() in order to 927 * handle a case where the sending node itself process its hop-by-hop 928 * options header. In such a case, the function is called from ip6_output(). 929 * 930 * The function assumes that hbh header is located right after the IPv6 header 931 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to 932 * opthead + hbhlen is located in continuous memory region. 933 */ 934 int 935 ip6_process_hopopts(struct mbuf *m, u_int8_t *opthead, int hbhlen, 936 u_int32_t *rtalertp, u_int32_t *plenp) 937 { 938 struct ip6_hdr *ip6; 939 int optlen = 0; 940 u_int8_t *opt = opthead; 941 u_int16_t rtalert_val; 942 u_int32_t jumboplen; 943 const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh); 944 945 for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) { 946 switch (*opt) { 947 case IP6OPT_PAD1: 948 optlen = 1; 949 break; 950 case IP6OPT_PADN: 951 if (hbhlen < IP6OPT_MINLEN) { 952 ip6stat.ip6s_toosmall++; 953 goto bad; 954 } 955 optlen = *(opt + 1) + 2; 956 break; 957 case IP6OPT_RTALERT: 958 /* XXX may need check for alignment */ 959 if (hbhlen < IP6OPT_RTALERT_LEN) { 960 ip6stat.ip6s_toosmall++; 961 goto bad; 962 } 963 if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) { 964 /* XXX stat */ 965 icmp6_error(m, ICMP6_PARAM_PROB, 966 ICMP6_PARAMPROB_HEADER, 967 erroff + opt + 1 - opthead); 968 return (-1); 969 } 970 optlen = IP6OPT_RTALERT_LEN; 971 bcopy((caddr_t)(opt + 2), (caddr_t)&rtalert_val, 2); 972 *rtalertp = ntohs(rtalert_val); 973 break; 974 case IP6OPT_JUMBO: 975 /* XXX may need check for alignment */ 976 if (hbhlen < IP6OPT_JUMBO_LEN) { 977 ip6stat.ip6s_toosmall++; 978 goto bad; 979 } 980 if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) { 981 /* XXX stat */ 982 icmp6_error(m, ICMP6_PARAM_PROB, 983 ICMP6_PARAMPROB_HEADER, 984 erroff + opt + 1 - opthead); 985 return (-1); 986 } 987 optlen = IP6OPT_JUMBO_LEN; 988 989 /* 990 * IPv6 packets that have non 0 payload length 991 * must not contain a jumbo payload option. 992 */ 993 ip6 = mtod(m, struct ip6_hdr *); 994 if (ip6->ip6_plen) { 995 ip6stat.ip6s_badoptions++; 996 icmp6_error(m, ICMP6_PARAM_PROB, 997 ICMP6_PARAMPROB_HEADER, 998 erroff + opt - opthead); 999 return (-1); 1000 } 1001 1002 /* 1003 * We may see jumbolen in unaligned location, so 1004 * we'd need to perform bcopy(). 1005 */ 1006 bcopy(opt + 2, &jumboplen, sizeof(jumboplen)); 1007 jumboplen = (u_int32_t)htonl(jumboplen); 1008 1009 #if 1 1010 /* 1011 * if there are multiple jumbo payload options, 1012 * *plenp will be non-zero and the packet will be 1013 * rejected. 1014 * the behavior may need some debate in ipngwg - 1015 * multiple options does not make sense, however, 1016 * there's no explicit mention in specification. 1017 */ 1018 if (*plenp != 0) { 1019 ip6stat.ip6s_badoptions++; 1020 icmp6_error(m, ICMP6_PARAM_PROB, 1021 ICMP6_PARAMPROB_HEADER, 1022 erroff + opt + 2 - opthead); 1023 return (-1); 1024 } 1025 #endif 1026 1027 /* 1028 * jumbo payload length must be larger than 65535. 1029 */ 1030 if (jumboplen <= IPV6_MAXPACKET) { 1031 ip6stat.ip6s_badoptions++; 1032 icmp6_error(m, ICMP6_PARAM_PROB, 1033 ICMP6_PARAMPROB_HEADER, 1034 erroff + opt + 2 - opthead); 1035 return (-1); 1036 } 1037 *plenp = jumboplen; 1038 1039 break; 1040 default: /* unknown option */ 1041 if (hbhlen < IP6OPT_MINLEN) { 1042 ip6stat.ip6s_toosmall++; 1043 goto bad; 1044 } 1045 optlen = ip6_unknown_opt(opt, m, 1046 erroff + opt - opthead); 1047 if (optlen == -1) 1048 return (-1); 1049 optlen += 2; 1050 break; 1051 } 1052 } 1053 1054 return (0); 1055 1056 bad: 1057 m_freem(m); 1058 return (-1); 1059 } 1060 1061 /* 1062 * Unknown option processing. 1063 * The third argument `off' is the offset from the IPv6 header to the option, 1064 * which is necessary if the IPv6 header the and option header and IPv6 header 1065 * is not continuous in order to return an ICMPv6 error. 1066 */ 1067 int 1068 ip6_unknown_opt(u_int8_t *optp, struct mbuf *m, int off) 1069 { 1070 struct ip6_hdr *ip6; 1071 1072 switch (IP6OPT_TYPE(*optp)) { 1073 case IP6OPT_TYPE_SKIP: /* ignore the option */ 1074 return ((int)*(optp + 1)); 1075 case IP6OPT_TYPE_DISCARD: /* silently discard */ 1076 m_freem(m); 1077 return (-1); 1078 case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */ 1079 ip6stat.ip6s_badoptions++; 1080 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off); 1081 return (-1); 1082 case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */ 1083 ip6stat.ip6s_badoptions++; 1084 ip6 = mtod(m, struct ip6_hdr *); 1085 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 1086 (m->m_flags & (M_BCAST|M_MCAST))) 1087 m_freem(m); 1088 else 1089 icmp6_error(m, ICMP6_PARAM_PROB, 1090 ICMP6_PARAMPROB_OPTION, off); 1091 return (-1); 1092 } 1093 1094 m_freem(m); /* XXX: NOTREACHED */ 1095 return (-1); 1096 } 1097 1098 /* 1099 * Create the "control" list for this pcb. 1100 * The function will not modify mbuf chain at all. 1101 * 1102 * with KAME mbuf chain restriction: 1103 * The routine will be called from upper layer handlers like tcp6_input(). 1104 * Thus the routine assumes that the caller (tcp6_input) have already 1105 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the 1106 * very first mbuf on the mbuf chain. 1107 */ 1108 void 1109 ip6_savecontrol(struct inpcb *in6p, struct mbuf **mp, struct ip6_hdr *ip6, 1110 struct mbuf *m) 1111 { 1112 struct thread *td = curthread; /* XXX */ 1113 int privileged = 0; 1114 int rthdr_exist = 0; 1115 1116 1117 if (suser(td) == 0) 1118 privileged++; 1119 1120 #ifdef SO_TIMESTAMP 1121 if (in6p->in6p_socket->so_options & SO_TIMESTAMP) { 1122 struct timeval tv; 1123 1124 microtime(&tv); 1125 *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv), 1126 SCM_TIMESTAMP, SOL_SOCKET); 1127 if (*mp) { 1128 mp = &(*mp)->m_next; 1129 } 1130 } 1131 #endif 1132 1133 /* RFC 2292 sec. 5 */ 1134 if (in6p->in6p_flags & IN6P_PKTINFO) { 1135 struct in6_pktinfo pi6; 1136 bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr)); 1137 if (IN6_IS_SCOPE_LINKLOCAL(&pi6.ipi6_addr)) 1138 pi6.ipi6_addr.s6_addr16[1] = 0; 1139 pi6.ipi6_ifindex = (m && m->m_pkthdr.rcvif) 1140 ? m->m_pkthdr.rcvif->if_index 1141 : 0; 1142 *mp = sbcreatecontrol((caddr_t) &pi6, 1143 sizeof(struct in6_pktinfo), IPV6_PKTINFO, 1144 IPPROTO_IPV6); 1145 if (*mp) 1146 mp = &(*mp)->m_next; 1147 } 1148 1149 if (in6p->in6p_flags & IN6P_HOPLIMIT) { 1150 int hlim = ip6->ip6_hlim & 0xff; 1151 *mp = sbcreatecontrol((caddr_t) &hlim, 1152 sizeof(int), IPV6_HOPLIMIT, IPPROTO_IPV6); 1153 if (*mp) 1154 mp = &(*mp)->m_next; 1155 } 1156 1157 /* 1158 * IPV6_HOPOPTS socket option. We require super-user privilege 1159 * for the option, but it might be too strict, since there might 1160 * be some hop-by-hop options which can be returned to normal user. 1161 * See RFC 2292 section 6. 1162 */ 1163 if ((in6p->in6p_flags & IN6P_HOPOPTS) && privileged) { 1164 /* 1165 * Check if a hop-by-hop options header is contatined in the 1166 * received packet, and if so, store the options as ancillary 1167 * data. Note that a hop-by-hop options header must be 1168 * just after the IPv6 header, which fact is assured through 1169 * the IPv6 input processing. 1170 */ 1171 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1172 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 1173 struct ip6_hbh *hbh; 1174 int hbhlen = 0; 1175 #ifdef PULLDOWN_TEST 1176 struct mbuf *ext; 1177 #endif 1178 1179 #ifndef PULLDOWN_TEST 1180 hbh = (struct ip6_hbh *)(ip6 + 1); 1181 hbhlen = (hbh->ip6h_len + 1) << 3; 1182 #else 1183 ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr), 1184 ip6->ip6_nxt); 1185 if (ext == NULL) { 1186 ip6stat.ip6s_tooshort++; 1187 return; 1188 } 1189 hbh = mtod(ext, struct ip6_hbh *); 1190 hbhlen = (hbh->ip6h_len + 1) << 3; 1191 if (hbhlen != ext->m_len) { 1192 m_freem(ext); 1193 ip6stat.ip6s_tooshort++; 1194 return; 1195 } 1196 #endif 1197 1198 /* 1199 * XXX: We copy whole the header even if a jumbo 1200 * payload option is included, which option is to 1201 * be removed before returning in the RFC 2292. 1202 * Note: this constraint is removed in 2292bis. 1203 */ 1204 *mp = sbcreatecontrol((caddr_t)hbh, hbhlen, 1205 IPV6_HOPOPTS, IPPROTO_IPV6); 1206 if (*mp) 1207 mp = &(*mp)->m_next; 1208 #ifdef PULLDOWN_TEST 1209 m_freem(ext); 1210 #endif 1211 } 1212 } 1213 1214 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */ 1215 if ((in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDRDSTOPTS)) != 0) { 1216 int proto, off, nxt; 1217 1218 /* 1219 * go through the header chain to see if a routing header is 1220 * contained in the packet. We need this information to store 1221 * destination options headers (if any) properly. 1222 * XXX: performance issue. We should record this info when 1223 * processing extension headers in incoming routine. 1224 * (todo) use m_aux? 1225 */ 1226 proto = IPPROTO_IPV6; 1227 off = 0; 1228 nxt = -1; 1229 while (1) { 1230 int newoff; 1231 1232 newoff = ip6_nexthdr(m, off, proto, &nxt); 1233 if (newoff < 0) 1234 break; 1235 if (newoff < off) /* invalid, check for safety */ 1236 break; 1237 if ((proto = nxt) == IPPROTO_ROUTING) { 1238 rthdr_exist = 1; 1239 break; 1240 } 1241 off = newoff; 1242 } 1243 } 1244 1245 if ((in6p->in6p_flags & 1246 (IN6P_RTHDR | IN6P_DSTOPTS | IN6P_RTHDRDSTOPTS)) != 0) { 1247 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1248 int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr); 1249 1250 /* 1251 * Search for destination options headers or routing 1252 * header(s) through the header chain, and stores each 1253 * header as ancillary data. 1254 * Note that the order of the headers remains in 1255 * the chain of ancillary data. 1256 */ 1257 while (1) { /* is explicit loop prevention necessary? */ 1258 struct ip6_ext *ip6e = NULL; 1259 int elen; 1260 #ifdef PULLDOWN_TEST 1261 struct mbuf *ext = NULL; 1262 #endif 1263 1264 /* 1265 * if it is not an extension header, don't try to 1266 * pull it from the chain. 1267 */ 1268 switch (nxt) { 1269 case IPPROTO_DSTOPTS: 1270 case IPPROTO_ROUTING: 1271 case IPPROTO_HOPOPTS: 1272 case IPPROTO_AH: /* is it possible? */ 1273 break; 1274 default: 1275 goto loopend; 1276 } 1277 1278 #ifndef PULLDOWN_TEST 1279 if (off + sizeof(*ip6e) > m->m_len) 1280 goto loopend; 1281 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off); 1282 if (nxt == IPPROTO_AH) 1283 elen = (ip6e->ip6e_len + 2) << 2; 1284 else 1285 elen = (ip6e->ip6e_len + 1) << 3; 1286 if (off + elen > m->m_len) 1287 goto loopend; 1288 #else 1289 ext = ip6_pullexthdr(m, off, nxt); 1290 if (ext == NULL) { 1291 ip6stat.ip6s_tooshort++; 1292 return; 1293 } 1294 ip6e = mtod(ext, struct ip6_ext *); 1295 if (nxt == IPPROTO_AH) 1296 elen = (ip6e->ip6e_len + 2) << 2; 1297 else 1298 elen = (ip6e->ip6e_len + 1) << 3; 1299 if (elen != ext->m_len) { 1300 m_freem(ext); 1301 ip6stat.ip6s_tooshort++; 1302 return; 1303 } 1304 #endif 1305 1306 switch (nxt) { 1307 case IPPROTO_DSTOPTS: 1308 if ((in6p->in6p_flags & IN6P_DSTOPTS) == 0) 1309 break; 1310 1311 /* 1312 * We also require super-user privilege for 1313 * the option. 1314 * See the comments on IN6_HOPOPTS. 1315 */ 1316 if (!privileged) 1317 break; 1318 1319 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1320 IPV6_DSTOPTS, 1321 IPPROTO_IPV6); 1322 if (*mp) 1323 mp = &(*mp)->m_next; 1324 break; 1325 case IPPROTO_ROUTING: 1326 if (!in6p->in6p_flags & IN6P_RTHDR) 1327 break; 1328 1329 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1330 IPV6_RTHDR, 1331 IPPROTO_IPV6); 1332 if (*mp) 1333 mp = &(*mp)->m_next; 1334 break; 1335 case IPPROTO_HOPOPTS: 1336 case IPPROTO_AH: /* is it possible? */ 1337 break; 1338 1339 default: 1340 /* 1341 * other cases have been filtered in the above. 1342 * none will visit this case. here we supply 1343 * the code just in case (nxt overwritten or 1344 * other cases). 1345 */ 1346 #ifdef PULLDOWN_TEST 1347 m_freem(ext); 1348 #endif 1349 goto loopend; 1350 1351 } 1352 1353 /* proceed with the next header. */ 1354 off += elen; 1355 nxt = ip6e->ip6e_nxt; 1356 ip6e = NULL; 1357 #ifdef PULLDOWN_TEST 1358 m_freem(ext); 1359 ext = NULL; 1360 #endif 1361 } 1362 loopend: 1363 ; 1364 } 1365 1366 } 1367 1368 #ifdef PULLDOWN_TEST 1369 /* 1370 * pull single extension header from mbuf chain. returns single mbuf that 1371 * contains the result, or NULL on error. 1372 */ 1373 static struct mbuf * 1374 ip6_pullexthdr(struct mbuf *m, size_t off, int nxt) 1375 { 1376 struct ip6_ext ip6e; 1377 size_t elen; 1378 struct mbuf *n; 1379 1380 #ifdef DIAGNOSTIC 1381 switch (nxt) { 1382 case IPPROTO_DSTOPTS: 1383 case IPPROTO_ROUTING: 1384 case IPPROTO_HOPOPTS: 1385 case IPPROTO_AH: /* is it possible? */ 1386 break; 1387 default: 1388 kprintf("ip6_pullexthdr: invalid nxt=%d\n", nxt); 1389 } 1390 #endif 1391 1392 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1393 if (nxt == IPPROTO_AH) 1394 elen = (ip6e.ip6e_len + 2) << 2; 1395 else 1396 elen = (ip6e.ip6e_len + 1) << 3; 1397 1398 n = m_getb(elen, MB_DONTWAIT, MT_DATA, 0); 1399 if (n == NULL) 1400 return NULL; 1401 n->m_len = 0; 1402 1403 if (elen >= M_TRAILINGSPACE(n)) { 1404 m_free(n); 1405 return NULL; 1406 } 1407 1408 m_copydata(m, off, elen, mtod(n, caddr_t)); 1409 n->m_len = elen; 1410 return n; 1411 } 1412 #endif 1413 1414 /* 1415 * Get pointer to the previous header followed by the header 1416 * currently processed. 1417 * XXX: This function supposes that 1418 * M includes all headers, 1419 * the next header field and the header length field of each header 1420 * are valid, and 1421 * the sum of each header length equals to OFF. 1422 * Because of these assumptions, this function must be called very 1423 * carefully. Moreover, it will not be used in the near future when 1424 * we develop `neater' mechanism to process extension headers. 1425 */ 1426 char * 1427 ip6_get_prevhdr(struct mbuf *m, int off) 1428 { 1429 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1430 1431 if (off == sizeof(struct ip6_hdr)) 1432 return (&ip6->ip6_nxt); 1433 else { 1434 int len, nxt; 1435 struct ip6_ext *ip6e = NULL; 1436 1437 nxt = ip6->ip6_nxt; 1438 len = sizeof(struct ip6_hdr); 1439 while (len < off) { 1440 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + len); 1441 1442 switch (nxt) { 1443 case IPPROTO_FRAGMENT: 1444 len += sizeof(struct ip6_frag); 1445 break; 1446 case IPPROTO_AH: 1447 len += (ip6e->ip6e_len + 2) << 2; 1448 break; 1449 default: 1450 len += (ip6e->ip6e_len + 1) << 3; 1451 break; 1452 } 1453 nxt = ip6e->ip6e_nxt; 1454 } 1455 if (ip6e) 1456 return (&ip6e->ip6e_nxt); 1457 else 1458 return NULL; 1459 } 1460 } 1461 1462 /* 1463 * get next header offset. m will be retained. 1464 */ 1465 int 1466 ip6_nexthdr(struct mbuf *m, int off, int proto, int *nxtp) 1467 { 1468 struct ip6_hdr ip6; 1469 struct ip6_ext ip6e; 1470 struct ip6_frag fh; 1471 1472 /* just in case */ 1473 if (m == NULL) 1474 panic("ip6_nexthdr: m == NULL"); 1475 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off) 1476 return -1; 1477 1478 switch (proto) { 1479 case IPPROTO_IPV6: 1480 if (m->m_pkthdr.len < off + sizeof(ip6)) 1481 return -1; 1482 m_copydata(m, off, sizeof(ip6), (caddr_t)&ip6); 1483 if (nxtp) 1484 *nxtp = ip6.ip6_nxt; 1485 off += sizeof(ip6); 1486 return off; 1487 1488 case IPPROTO_FRAGMENT: 1489 /* 1490 * terminate parsing if it is not the first fragment, 1491 * it does not make sense to parse through it. 1492 */ 1493 if (m->m_pkthdr.len < off + sizeof(fh)) 1494 return -1; 1495 m_copydata(m, off, sizeof(fh), (caddr_t)&fh); 1496 /* IP6F_OFF_MASK = 0xfff8(BigEndian), 0xf8ff(LittleEndian) */ 1497 if (fh.ip6f_offlg & IP6F_OFF_MASK) 1498 return -1; 1499 if (nxtp) 1500 *nxtp = fh.ip6f_nxt; 1501 off += sizeof(struct ip6_frag); 1502 return off; 1503 1504 case IPPROTO_AH: 1505 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1506 return -1; 1507 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1508 if (nxtp) 1509 *nxtp = ip6e.ip6e_nxt; 1510 off += (ip6e.ip6e_len + 2) << 2; 1511 return off; 1512 1513 case IPPROTO_HOPOPTS: 1514 case IPPROTO_ROUTING: 1515 case IPPROTO_DSTOPTS: 1516 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1517 return -1; 1518 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1519 if (nxtp) 1520 *nxtp = ip6e.ip6e_nxt; 1521 off += (ip6e.ip6e_len + 1) << 3; 1522 return off; 1523 1524 case IPPROTO_NONE: 1525 case IPPROTO_ESP: 1526 case IPPROTO_IPCOMP: 1527 /* give up */ 1528 return -1; 1529 1530 default: 1531 return -1; 1532 } 1533 1534 return -1; 1535 } 1536 1537 /* 1538 * get offset for the last header in the chain. m will be kept untainted. 1539 */ 1540 int 1541 ip6_lasthdr(struct mbuf *m, int off, int proto, int *nxtp) 1542 { 1543 int newoff; 1544 int nxt; 1545 1546 if (!nxtp) { 1547 nxt = -1; 1548 nxtp = &nxt; 1549 } 1550 while (1) { 1551 newoff = ip6_nexthdr(m, off, proto, nxtp); 1552 if (newoff < 0) 1553 return off; 1554 else if (newoff < off) 1555 return -1; /* invalid */ 1556 else if (newoff == off) 1557 return newoff; 1558 1559 off = newoff; 1560 proto = *nxtp; 1561 } 1562 } 1563 1564 struct ip6aux * 1565 ip6_addaux(struct mbuf *m) 1566 { 1567 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1568 if (!tag) { 1569 tag = m_tag_get(PACKET_TAG_IPV6_INPUT, 1570 sizeof (struct ip6aux), 1571 MB_DONTWAIT); 1572 if (tag) 1573 m_tag_prepend(m, tag); 1574 } 1575 if (tag) 1576 bzero(m_tag_data(tag), sizeof (struct ip6aux)); 1577 return tag ? (struct ip6aux *)m_tag_data(tag) : NULL; 1578 } 1579 1580 struct ip6aux * 1581 ip6_findaux(struct mbuf *m) 1582 { 1583 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1584 return tag ? (struct ip6aux*)(tag+1) : NULL; 1585 } 1586 1587 void 1588 ip6_delaux(struct mbuf *m) 1589 { 1590 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1591 if (tag) 1592 m_tag_delete(m, tag); 1593 } 1594 1595 /* 1596 * System control for IP6 1597 */ 1598 1599 u_char inet6ctlerrmap[PRC_NCMDS] = { 1600 0, 0, 0, 0, 1601 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, 1602 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, 1603 EMSGSIZE, EHOSTUNREACH, 0, 0, 1604 0, 0, 0, 0, 1605 ENOPROTOOPT 1606 }; 1607