1 /* $FreeBSD: src/sys/netinet6/ip6_input.c,v 1.11.2.15 2003/01/24 05:11:35 sam Exp $ */ 2 /* $DragonFly: src/sys/netinet6/ip6_input.c,v 1.38 2008/09/24 14:26:39 sephe Exp $ */ 3 /* $KAME: ip6_input.c,v 1.259 2002/01/21 04:58:09 jinmei Exp $ */ 4 5 /* 6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. Neither the name of the project nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 /* 35 * Copyright (c) 1982, 1986, 1988, 1993 36 * The Regents of the University of California. All rights reserved. 37 * 38 * Redistribution and use in source and binary forms, with or without 39 * modification, are permitted provided that the following conditions 40 * are met: 41 * 1. Redistributions of source code must retain the above copyright 42 * notice, this list of conditions and the following disclaimer. 43 * 2. Redistributions in binary form must reproduce the above copyright 44 * notice, this list of conditions and the following disclaimer in the 45 * documentation and/or other materials provided with the distribution. 46 * 3. All advertising materials mentioning features or use of this software 47 * must display the following acknowledgement: 48 * This product includes software developed by the University of 49 * California, Berkeley and its contributors. 50 * 4. Neither the name of the University nor the names of its contributors 51 * may be used to endorse or promote products derived from this software 52 * without specific prior written permission. 53 * 54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 64 * SUCH DAMAGE. 65 * 66 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 67 */ 68 69 #include "opt_ip6fw.h" 70 #include "opt_inet.h" 71 #include "opt_inet6.h" 72 #include "opt_ipsec.h" 73 74 #include <sys/param.h> 75 #include <sys/systm.h> 76 #include <sys/malloc.h> 77 #include <sys/mbuf.h> 78 #include <sys/domain.h> 79 #include <sys/protosw.h> 80 #include <sys/socket.h> 81 #include <sys/socketvar.h> 82 #include <sys/errno.h> 83 #include <sys/time.h> 84 #include <sys/kernel.h> 85 #include <sys/syslog.h> 86 #include <sys/proc.h> 87 #include <sys/priv.h> 88 89 #include <net/if.h> 90 #include <net/if_types.h> 91 #include <net/if_dl.h> 92 #include <net/route.h> 93 #include <net/netisr.h> 94 #include <net/pfil.h> 95 96 #include <sys/thread2.h> 97 #include <sys/msgport2.h> 98 #include <net/netmsg2.h> 99 100 #include <netinet/in.h> 101 #include <netinet/in_systm.h> 102 #ifdef INET 103 #include <netinet/ip.h> 104 #include <netinet/ip_icmp.h> 105 #endif /* INET */ 106 #include <netinet/ip6.h> 107 #include <netinet6/in6_var.h> 108 #include <netinet6/ip6_var.h> 109 #include <netinet/in_pcb.h> 110 #include <netinet/icmp6.h> 111 #include <netinet6/scope6_var.h> 112 #include <netinet6/in6_ifattach.h> 113 #include <netinet6/nd6.h> 114 #include <netinet6/in6_prefix.h> 115 116 #ifdef IPSEC 117 #include <netinet6/ipsec.h> 118 #ifdef INET6 119 #include <netinet6/ipsec6.h> 120 #endif 121 #endif 122 123 #ifdef FAST_IPSEC 124 #include <netproto/ipsec/ipsec.h> 125 #include <netproto/ipsec/ipsec6.h> 126 #define IPSEC 127 #endif /* FAST_IPSEC */ 128 129 #include <net/ip6fw/ip6_fw.h> 130 131 #include <netinet6/ip6protosw.h> 132 133 /* we need it for NLOOP. */ 134 #include "use_loop.h" 135 136 #include <net/net_osdep.h> 137 138 extern struct domain inet6domain; 139 extern struct protosw inet6sw[]; 140 141 u_char ip6_protox[IPPROTO_MAX]; 142 struct in6_ifaddr *in6_ifaddr; 143 144 extern struct callout in6_tmpaddrtimer_ch; 145 146 int ip6_forward_srcrt; /* XXX */ 147 int ip6_sourcecheck; /* XXX */ 148 int ip6_sourcecheck_interval; /* XXX */ 149 150 int ip6_ours_check_algorithm; 151 152 struct pfil_head inet6_pfil_hook; 153 154 /* firewall hooks */ 155 ip6_fw_chk_t *ip6_fw_chk_ptr; 156 ip6_fw_ctl_t *ip6_fw_ctl_ptr; 157 int ip6_fw_enable = 1; 158 159 struct ip6stat ip6stat; 160 161 static void ip6_init2 (void *); 162 static struct ip6aux *ip6_setdstifaddr (struct mbuf *, struct in6_ifaddr *); 163 static int ip6_hopopts_input (u_int32_t *, u_int32_t *, struct mbuf **, int *); 164 static void ip6_input(netmsg_t msg); 165 #ifdef PULLDOWN_TEST 166 static struct mbuf *ip6_pullexthdr (struct mbuf *, size_t, int); 167 #endif 168 static void transport6_processing_handler(netmsg_t netmsg); 169 170 /* 171 * IP6 initialization: fill in IP6 protocol switch table. 172 * All protocols not implemented in kernel go to raw IP6 protocol handler. 173 */ 174 void 175 ip6_init(void) 176 { 177 struct protosw *pr; 178 int i; 179 struct timeval tv; 180 181 pr = pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW); 182 if (pr == 0) 183 panic("ip6_init"); 184 for (i = 0; i < IPPROTO_MAX; i++) 185 ip6_protox[i] = pr - inet6sw; 186 for (pr = inet6domain.dom_protosw; 187 pr < inet6domain.dom_protoswNPROTOSW; pr++) 188 if (pr->pr_domain->dom_family == PF_INET6 && 189 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) 190 ip6_protox[pr->pr_protocol] = pr - inet6sw; 191 192 inet6_pfil_hook.ph_type = PFIL_TYPE_AF; 193 inet6_pfil_hook.ph_af = AF_INET6; 194 if ((i = pfil_head_register(&inet6_pfil_hook)) != 0) { 195 kprintf("%s: WARNING: unable to register pfil hook, " 196 "error %d\n", __func__, i); 197 } 198 199 netisr_register(NETISR_IPV6, ip6_input, NULL); /* XXX cpufn */ 200 scope6_init(); 201 addrsel_policy_init(); 202 nd6_init(); 203 frag6_init(); 204 /* 205 * in many cases, random() here does NOT return random number 206 * as initialization during bootstrap time occur in fixed order. 207 */ 208 microtime(&tv); 209 ip6_flow_seq = krandom() ^ tv.tv_usec; 210 microtime(&tv); 211 ip6_desync_factor = (krandom() ^ tv.tv_usec) % MAX_TEMP_DESYNC_FACTOR; 212 } 213 214 static void 215 ip6_init2(void *dummy) 216 { 217 /* nd6_timer_init */ 218 callout_init(&nd6_timer_ch); 219 callout_reset(&nd6_timer_ch, hz, nd6_timer, NULL); 220 221 /* router renumbering prefix list maintenance */ 222 callout_init(&in6_rr_timer_ch); 223 callout_reset(&in6_rr_timer_ch, hz, in6_rr_timer, NULL); 224 225 /* timer for regeneranation of temporary addresses randomize ID */ 226 callout_init(&in6_tmpaddrtimer_ch); 227 callout_reset(&in6_tmpaddrtimer_ch, 228 (ip6_temp_preferred_lifetime - ip6_desync_factor - 229 ip6_temp_regen_advance) * hz, 230 in6_tmpaddrtimer, NULL); 231 } 232 233 /* cheat */ 234 /* This must be after route_init(), which is now SI_ORDER_THIRD */ 235 SYSINIT(netinet6init2, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ip6_init2, NULL); 236 237 extern struct route_in6 ip6_forward_rt; 238 239 static 240 void 241 ip6_input(netmsg_t msg) 242 { 243 struct mbuf *m = msg->packet.nm_packet; 244 struct ip6_hdr *ip6; 245 int off = sizeof(struct ip6_hdr), nest; 246 u_int32_t plen; 247 u_int32_t rtalert = ~0; 248 int nxt, ours = 0, rh_present = 0; 249 struct ifnet *deliverifp = NULL; 250 struct in6_addr odst; 251 int srcrt = 0; 252 253 #ifdef IPSEC 254 /* 255 * should the inner packet be considered authentic? 256 * see comment in ah4_input(). 257 */ 258 if (m) { 259 m->m_flags &= ~M_AUTHIPHDR; 260 m->m_flags &= ~M_AUTHIPDGM; 261 } 262 #endif 263 264 /* 265 * make sure we don't have onion peering information into m_aux. 266 */ 267 ip6_delaux(m); 268 269 /* 270 * mbuf statistics 271 */ 272 if (m->m_flags & M_EXT) { 273 if (m->m_next) 274 ip6stat.ip6s_mext2m++; 275 else 276 ip6stat.ip6s_mext1++; 277 } else { 278 #define M2MMAX (sizeof(ip6stat.ip6s_m2m)/sizeof(ip6stat.ip6s_m2m[0])) 279 if (m->m_next) { 280 if (m->m_flags & M_LOOP) { 281 ip6stat.ip6s_m2m[loif[0].if_index]++; /* XXX */ 282 } else if (m->m_pkthdr.rcvif->if_index < M2MMAX) 283 ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++; 284 else 285 ip6stat.ip6s_m2m[0]++; 286 } else 287 ip6stat.ip6s_m1++; 288 #undef M2MMAX 289 } 290 291 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive); 292 ip6stat.ip6s_total++; 293 294 #ifndef PULLDOWN_TEST 295 /* 296 * L2 bridge code and some other code can return mbuf chain 297 * that does not conform to KAME requirement. too bad. 298 * XXX: fails to join if interface MTU > MCLBYTES. jumbogram? 299 */ 300 if (m && m->m_next != NULL && m->m_pkthdr.len < MCLBYTES) { 301 struct mbuf *n; 302 303 n = m_getb(m->m_pkthdr.len, MB_DONTWAIT, MT_HEADER, M_PKTHDR); 304 if (n == NULL) 305 goto bad; 306 M_MOVE_PKTHDR(n, m); 307 308 m_copydata(m, 0, n->m_pkthdr.len, mtod(n, caddr_t)); 309 n->m_len = n->m_pkthdr.len; 310 m_freem(m); 311 m = n; 312 } 313 IP6_EXTHDR_CHECK_VOIDRET(m, 0, sizeof(struct ip6_hdr)); 314 #endif 315 316 if (m->m_len < sizeof(struct ip6_hdr)) { 317 struct ifnet *inifp; 318 inifp = m->m_pkthdr.rcvif; 319 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == 0) { 320 ip6stat.ip6s_toosmall++; 321 in6_ifstat_inc(inifp, ifs6_in_hdrerr); 322 goto bad2; 323 } 324 } 325 326 ip6 = mtod(m, struct ip6_hdr *); 327 328 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) { 329 ip6stat.ip6s_badvers++; 330 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 331 goto bad; 332 } 333 334 /* 335 * Run through list of hooks for input packets. 336 * 337 * NB: Beware of the destination address changing 338 * (e.g. by NAT rewriting). When this happens, 339 * tell ip6_forward to do the right thing. 340 */ 341 if (pfil_has_hooks(&inet6_pfil_hook)) { 342 odst = ip6->ip6_dst; 343 if (pfil_run_hooks(&inet6_pfil_hook, &m, 344 m->m_pkthdr.rcvif, PFIL_IN)) { 345 goto bad2; 346 } 347 if (m == NULL) /* consumed by filter */ 348 goto bad2; 349 ip6 = mtod(m, struct ip6_hdr *); 350 srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst); 351 } 352 353 ip6stat.ip6s_nxthist[ip6->ip6_nxt]++; 354 355 #ifdef ALTQ 356 if (altq_input != NULL && (*altq_input)(m, AF_INET6) == 0) { 357 /* packet is dropped by traffic conditioner */ 358 return; 359 } 360 #endif 361 362 /* 363 * Check with the firewall... 364 */ 365 if (ip6_fw_enable && ip6_fw_chk_ptr) { 366 u_short port = 0; 367 /* If ipfw says divert, we have to just drop packet */ 368 /* use port as a dummy argument */ 369 if ((*ip6_fw_chk_ptr)(&ip6, NULL, &port, &m)) { 370 m_freem(m); 371 m = NULL; 372 } 373 if (!m) 374 goto bad2; 375 } 376 377 /* 378 * Check against address spoofing/corruption. 379 */ 380 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) || 381 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { 382 /* 383 * XXX: "badscope" is not very suitable for a multicast source. 384 */ 385 ip6stat.ip6s_badscope++; 386 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 387 goto bad; 388 } 389 if ((IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) || 390 IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) && 391 (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { 392 ip6stat.ip6s_badscope++; 393 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 394 goto bad; 395 } 396 397 /* 398 * The following check is not documented in specs. A malicious 399 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack 400 * and bypass security checks (act as if it was from 127.0.0.1 by using 401 * IPv6 src ::ffff:127.0.0.1). Be cautious. 402 * 403 * This check chokes if we are in an SIIT cloud. As none of BSDs 404 * support IPv4-less kernel compilation, we cannot support SIIT 405 * environment at all. So, it makes more sense for us to reject any 406 * malicious packets for non-SIIT environment, than try to do a 407 * partical support for SIIT environment. 408 */ 409 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 410 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 411 ip6stat.ip6s_badscope++; 412 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 413 goto bad; 414 } 415 #if 0 416 /* 417 * Reject packets with IPv4 compatible addresses (auto tunnel). 418 * 419 * The code forbids auto tunnel relay case in RFC1933 (the check is 420 * stronger than RFC1933). We may want to re-enable it if mech-xx 421 * is revised to forbid relaying case. 422 */ 423 if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) || 424 IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) { 425 ip6stat.ip6s_badscope++; 426 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 427 goto bad; 428 } 429 #endif 430 431 /* drop packets if interface ID portion is already filled */ 432 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { 433 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src) && 434 ip6->ip6_src.s6_addr16[1]) { 435 ip6stat.ip6s_badscope++; 436 goto bad; 437 } 438 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) && 439 ip6->ip6_dst.s6_addr16[1]) { 440 ip6stat.ip6s_badscope++; 441 goto bad; 442 } 443 } 444 445 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) 446 ip6->ip6_src.s6_addr16[1] 447 = htons(m->m_pkthdr.rcvif->if_index); 448 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) 449 ip6->ip6_dst.s6_addr16[1] 450 = htons(m->m_pkthdr.rcvif->if_index); 451 452 #if 0 /* this case seems to be unnecessary. (jinmei, 20010401) */ 453 /* 454 * We use rt->rt_ifp to determine if the address is ours or not. 455 * If rt_ifp is lo0, the address is ours. 456 * The problem here is, rt->rt_ifp for fe80::%lo0/64 is set to lo0, 457 * so any address under fe80::%lo0/64 will be mistakenly considered 458 * local. The special case is supplied to handle the case properly 459 * by actually looking at interface addresses 460 * (using in6ifa_ifpwithaddr). 461 */ 462 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) && 463 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) { 464 if (!in6ifa_ifpwithaddr(m->m_pkthdr.rcvif, &ip6->ip6_dst)) { 465 icmp6_error(m, ICMP6_DST_UNREACH, 466 ICMP6_DST_UNREACH_ADDR, 0); 467 /* m is already freed */ 468 goto bad2; 469 } 470 471 ours = 1; 472 deliverifp = m->m_pkthdr.rcvif; 473 goto hbhcheck; 474 } 475 #endif 476 477 /* 478 * Multicast check 479 */ 480 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 481 struct in6_multi *in6m = 0; 482 483 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast); 484 /* 485 * See if we belong to the destination multicast group on the 486 * arrival interface. 487 */ 488 IN6_LOOKUP_MULTI(ip6->ip6_dst, m->m_pkthdr.rcvif, in6m); 489 if (in6m) 490 ours = 1; 491 else if (!ip6_mrouter) { 492 ip6stat.ip6s_notmember++; 493 ip6stat.ip6s_cantforward++; 494 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 495 goto bad; 496 } 497 deliverifp = m->m_pkthdr.rcvif; 498 goto hbhcheck; 499 } 500 501 /* 502 * Unicast check 503 */ 504 switch (ip6_ours_check_algorithm) { 505 default: 506 /* 507 * XXX: I intentionally broke our indentation rule here, 508 * since this switch-case is just for measurement and 509 * therefore should soon be removed. 510 */ 511 if (ip6_forward_rt.ro_rt != NULL && 512 (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) && 513 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 514 &((struct sockaddr_in6 *)(&ip6_forward_rt.ro_dst))->sin6_addr)) 515 ip6stat.ip6s_forward_cachehit++; 516 else { 517 struct sockaddr_in6 *dst6; 518 519 if (ip6_forward_rt.ro_rt) { 520 /* route is down or destination is different */ 521 ip6stat.ip6s_forward_cachemiss++; 522 RTFREE(ip6_forward_rt.ro_rt); 523 ip6_forward_rt.ro_rt = 0; 524 } 525 526 bzero(&ip6_forward_rt.ro_dst, sizeof(struct sockaddr_in6)); 527 dst6 = &ip6_forward_rt.ro_dst; 528 dst6->sin6_len = sizeof(struct sockaddr_in6); 529 dst6->sin6_family = AF_INET6; 530 dst6->sin6_addr = ip6->ip6_dst; 531 532 rtalloc_ign((struct route *)&ip6_forward_rt, RTF_PRCLONING); 533 } 534 535 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key)) 536 537 /* 538 * Accept the packet if the forwarding interface to the destination 539 * according to the routing table is the loopback interface, 540 * unless the associated route has a gateway. 541 * Note that this approach causes to accept a packet if there is a 542 * route to the loopback interface for the destination of the packet. 543 * But we think it's even useful in some situations, e.g. when using 544 * a special daemon which wants to intercept the packet. 545 * 546 * XXX: some OSes automatically make a cloned route for the destination 547 * of an outgoing packet. If the outgoing interface of the packet 548 * is a loopback one, the kernel would consider the packet to be 549 * accepted, even if we have no such address assinged on the interface. 550 * We check the cloned flag of the route entry to reject such cases, 551 * assuming that route entries for our own addresses are not made by 552 * cloning (it should be true because in6_addloop explicitly installs 553 * the host route). However, we might have to do an explicit check 554 * while it would be less efficient. Or, should we rather install a 555 * reject route for such a case? 556 */ 557 if (ip6_forward_rt.ro_rt && 558 (ip6_forward_rt.ro_rt->rt_flags & 559 (RTF_HOST|RTF_GATEWAY)) == RTF_HOST && 560 #ifdef RTF_WASCLONED 561 !(ip6_forward_rt.ro_rt->rt_flags & RTF_WASCLONED) && 562 #endif 563 #ifdef RTF_CLONED 564 !(ip6_forward_rt.ro_rt->rt_flags & RTF_CLONED) && 565 #endif 566 #if 0 567 /* 568 * The check below is redundant since the comparison of 569 * the destination and the key of the rtentry has 570 * already done through looking up the routing table. 571 */ 572 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 573 &rt6_key(ip6_forward_rt.ro_rt)->sin6_addr) 574 #endif 575 ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_LOOP) { 576 struct in6_ifaddr *ia6 = 577 (struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa; 578 579 /* 580 * record address information into m_aux. 581 */ 582 ip6_setdstifaddr(m, ia6); 583 584 /* 585 * packets to a tentative, duplicated, or somehow invalid 586 * address must not be accepted. 587 */ 588 if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) { 589 /* this address is ready */ 590 ours = 1; 591 deliverifp = ia6->ia_ifp; /* correct? */ 592 /* Count the packet in the ip address stats */ 593 ia6->ia_ifa.if_ipackets++; 594 ia6->ia_ifa.if_ibytes += m->m_pkthdr.len; 595 goto hbhcheck; 596 } else { 597 /* address is not ready, so discard the packet. */ 598 nd6log((LOG_INFO, 599 "ip6_input: packet to an unready address %s->%s\n", 600 ip6_sprintf(&ip6->ip6_src), 601 ip6_sprintf(&ip6->ip6_dst))); 602 603 goto bad; 604 } 605 } 606 } /* XXX indentation (see above) */ 607 608 /* 609 * FAITH(Firewall Aided Internet Translator) 610 */ 611 if (ip6_keepfaith) { 612 if (ip6_forward_rt.ro_rt && ip6_forward_rt.ro_rt->rt_ifp 613 && ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) { 614 /* XXX do we need more sanity checks? */ 615 ours = 1; 616 deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /* faith */ 617 goto hbhcheck; 618 } 619 } 620 621 /* 622 * Now there is no reason to process the packet if it's not our own 623 * and we're not a router. 624 */ 625 if (!ip6_forwarding) { 626 ip6stat.ip6s_cantforward++; 627 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 628 goto bad; 629 } 630 631 hbhcheck: 632 /* 633 * record address information into m_aux, if we don't have one yet. 634 * note that we are unable to record it, if the address is not listed 635 * as our interface address (e.g. multicast addresses, addresses 636 * within FAITH prefixes and such). 637 */ 638 if (deliverifp && !ip6_getdstifaddr(m)) { 639 struct in6_ifaddr *ia6; 640 641 ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst); 642 if (ia6) { 643 if (!ip6_setdstifaddr(m, ia6)) { 644 /* 645 * XXX maybe we should drop the packet here, 646 * as we could not provide enough information 647 * to the upper layers. 648 */ 649 } 650 } 651 } 652 653 /* 654 * Process Hop-by-Hop options header if it's contained. 655 * m may be modified in ip6_hopopts_input(). 656 * If a JumboPayload option is included, plen will also be modified. 657 */ 658 plen = (u_int32_t)ntohs(ip6->ip6_plen); 659 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 660 struct ip6_hbh *hbh; 661 662 if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) { 663 #if 0 /*touches NULL pointer*/ 664 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 665 #endif 666 goto bad2; /* m have already been freed */ 667 } 668 669 /* adjust pointer */ 670 ip6 = mtod(m, struct ip6_hdr *); 671 672 /* 673 * if the payload length field is 0 and the next header field 674 * indicates Hop-by-Hop Options header, then a Jumbo Payload 675 * option MUST be included. 676 */ 677 if (ip6->ip6_plen == 0 && plen == 0) { 678 /* 679 * Note that if a valid jumbo payload option is 680 * contained, ip6_hoptops_input() must set a valid 681 * (non-zero) payload length to the variable plen. 682 */ 683 ip6stat.ip6s_badoptions++; 684 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 685 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 686 icmp6_error(m, ICMP6_PARAM_PROB, 687 ICMP6_PARAMPROB_HEADER, 688 (caddr_t)&ip6->ip6_plen - (caddr_t)ip6); 689 goto bad2; 690 } 691 #ifndef PULLDOWN_TEST 692 /* ip6_hopopts_input() ensures that mbuf is contiguous */ 693 hbh = (struct ip6_hbh *)(ip6 + 1); 694 #else 695 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 696 sizeof(struct ip6_hbh)); 697 if (hbh == NULL) { 698 ip6stat.ip6s_tooshort++; 699 goto bad2; 700 } 701 #endif 702 nxt = hbh->ip6h_nxt; 703 704 /* 705 * If we are acting as a router and the packet contains a 706 * router alert option, see if we know the option value. 707 * Currently, we only support the option value for MLD, in which 708 * case we should pass the packet to the multicast routing 709 * daemon. 710 */ 711 if (rtalert != ~0 && ip6_forwarding) { 712 switch (rtalert) { 713 case IP6OPT_RTALERT_MLD: 714 ours = 1; 715 break; 716 default: 717 /* 718 * RFC2711 requires unrecognized values must be 719 * silently ignored. 720 */ 721 break; 722 } 723 } 724 } else 725 nxt = ip6->ip6_nxt; 726 727 /* 728 * Check that the amount of data in the buffers 729 * is as at least much as the IPv6 header would have us expect. 730 * Trim mbufs if longer than we expect. 731 * Drop packet if shorter than we expect. 732 */ 733 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) { 734 ip6stat.ip6s_tooshort++; 735 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 736 goto bad; 737 } 738 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) { 739 if (m->m_len == m->m_pkthdr.len) { 740 m->m_len = sizeof(struct ip6_hdr) + plen; 741 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen; 742 } else 743 m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len); 744 } 745 746 /* 747 * Forward if desirable. 748 */ 749 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 750 /* 751 * If we are acting as a multicast router, all 752 * incoming multicast packets are passed to the 753 * kernel-level multicast forwarding function. 754 * The packet is returned (relatively) intact; if 755 * ip6_mforward() returns a non-zero value, the packet 756 * must be discarded, else it may be accepted below. 757 */ 758 if (ip6_mrouter && ip6_mforward(ip6, m->m_pkthdr.rcvif, m)) { 759 ip6stat.ip6s_cantforward++; 760 goto bad; 761 } 762 if (!ours) 763 goto bad; 764 } else if (!ours) { 765 ip6_forward(m, srcrt); 766 goto bad2; 767 } 768 769 ip6 = mtod(m, struct ip6_hdr *); 770 771 /* 772 * Malicious party may be able to use IPv4 mapped addr to confuse 773 * tcp/udp stack and bypass security checks (act as if it was from 774 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious. 775 * 776 * For SIIT end node behavior, you may want to disable the check. 777 * However, you will become vulnerable to attacks using IPv4 mapped 778 * source. 779 */ 780 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 781 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 782 ip6stat.ip6s_badscope++; 783 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 784 goto bad; 785 } 786 787 /* 788 * Tell launch routine the next header 789 */ 790 ip6stat.ip6s_delivered++; 791 in6_ifstat_inc(deliverifp, ifs6_in_deliver); 792 nest = 0; 793 794 rh_present = 0; 795 while (nxt != IPPROTO_DONE) { 796 struct protosw *sw6; 797 798 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 799 ip6stat.ip6s_toomanyhdr++; 800 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 801 goto bad; 802 } 803 804 /* 805 * protection against faulty packet - there should be 806 * more sanity checks in header chain processing. 807 */ 808 if (m->m_pkthdr.len < off) { 809 ip6stat.ip6s_tooshort++; 810 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 811 goto bad; 812 } 813 814 #if 0 815 /* 816 * do we need to do it for every header? yeah, other 817 * functions can play with it (like re-allocate and copy). 818 */ 819 mhist = ip6_addaux(m); 820 if (mhist && M_TRAILINGSPACE(mhist) >= sizeof(nxt)) { 821 hist = mtod(mhist, caddr_t) + mhist->m_len; 822 bcopy(&nxt, hist, sizeof(nxt)); 823 mhist->m_len += sizeof(nxt); 824 } else { 825 ip6stat.ip6s_toomanyhdr++; 826 goto bad; 827 } 828 #endif 829 830 if (nxt == IPPROTO_ROUTING) { 831 if (rh_present++) { 832 in6_ifstat_inc(m->m_pkthdr.rcvif, 833 ifs6_in_hdrerr); 834 ip6stat.ip6s_badoptions++; 835 goto bad; 836 } 837 } 838 839 sw6 = &inet6sw[ip6_protox[nxt]]; 840 #ifdef IPSEC 841 /* 842 * enforce IPsec policy checking if we are seeing last header. 843 * note that we do not visit this with protocols with pcb layer 844 * code - like udp/tcp/raw ip. 845 */ 846 if ((sw6->pr_flags & PR_LASTHDR) && ipsec6_in_reject(m, NULL)) { 847 ipsec6stat.in_polvio++; 848 goto bad; 849 } 850 #endif 851 /* 852 * If this is a terminal header forward to the port, otherwise 853 * process synchronously for more headers. 854 */ 855 if (sw6->pr_flags & PR_LASTHDR) { 856 struct netmsg_packet *pmsg; 857 lwkt_port_t port; 858 859 port = cpu_portfn(0); /* XXX */ 860 KKASSERT(port != NULL); 861 pmsg = &m->m_hdr.mh_netmsg; 862 netmsg_init(&pmsg->base, NULL, 863 &netisr_apanic_rport, 864 0, transport6_processing_handler); 865 pmsg->nm_packet = m; 866 pmsg->nm_nxt = nxt; 867 pmsg->base.lmsg.u.ms_result = off; 868 lwkt_sendmsg(port, &pmsg->base.lmsg); 869 /* done with m */ 870 nxt = IPPROTO_DONE; 871 } else { 872 nxt = sw6->pr_input(&m, &off, nxt); 873 } 874 } 875 goto bad2; 876 bad: 877 m_freem(m); 878 bad2: 879 ; 880 /* msg was embedded in the mbuf, do not reply! */ 881 } 882 883 /* 884 * We have to call the pr_input() function from the correct protocol 885 * thread. The sw6->pr_soport() request at the end of ip6_input() 886 * returns the port and we forward a netmsg to the port to execute 887 * this function. 888 */ 889 static void 890 transport6_processing_handler(netmsg_t netmsg) 891 { 892 struct netmsg_packet *pmsg = (struct netmsg_packet *)netmsg; 893 struct protosw *sw6; 894 int hlen; 895 int nxt; 896 897 sw6 = &inet6sw[ip6_protox[pmsg->nm_nxt]]; 898 hlen = pmsg->base.lmsg.u.ms_result; 899 900 nxt = sw6->pr_input(&pmsg->nm_packet, &hlen, pmsg->nm_nxt); 901 KKASSERT(nxt == IPPROTO_DONE); 902 /* netmsg was embedded in the mbuf, do not reply! */ 903 } 904 905 /* 906 * set/grab in6_ifaddr correspond to IPv6 destination address. 907 * XXX backward compatibility wrapper 908 */ 909 static struct ip6aux * 910 ip6_setdstifaddr(struct mbuf *m, struct in6_ifaddr *ia6) 911 { 912 struct ip6aux *n; 913 914 n = ip6_addaux(m); 915 if (n) 916 n->ip6a_dstia6 = ia6; 917 return n; /* NULL if failed to set */ 918 } 919 920 struct in6_ifaddr * 921 ip6_getdstifaddr(struct mbuf *m) 922 { 923 struct ip6aux *n; 924 925 n = ip6_findaux(m); 926 if (n) 927 return n->ip6a_dstia6; 928 else 929 return NULL; 930 } 931 932 /* 933 * Hop-by-Hop options header processing. If a valid jumbo payload option is 934 * included, the real payload length will be stored in plenp. 935 */ 936 static int 937 ip6_hopopts_input(u_int32_t *plenp, 938 u_int32_t *rtalertp,/* XXX: should be stored more smart way */ 939 struct mbuf **mp, 940 int *offp) 941 { 942 struct mbuf *m = *mp; 943 int off = *offp, hbhlen; 944 struct ip6_hbh *hbh; 945 u_int8_t *opt; 946 947 /* validation of the length of the header */ 948 #ifndef PULLDOWN_TEST 949 IP6_EXTHDR_CHECK(m, off, sizeof(*hbh), -1); 950 hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off); 951 hbhlen = (hbh->ip6h_len + 1) << 3; 952 953 IP6_EXTHDR_CHECK(m, off, hbhlen, -1); 954 hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off); 955 #else 956 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, 957 sizeof(struct ip6_hdr), sizeof(struct ip6_hbh)); 958 if (hbh == NULL) { 959 ip6stat.ip6s_tooshort++; 960 return -1; 961 } 962 hbhlen = (hbh->ip6h_len + 1) << 3; 963 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 964 hbhlen); 965 if (hbh == NULL) { 966 ip6stat.ip6s_tooshort++; 967 return -1; 968 } 969 #endif 970 off += hbhlen; 971 hbhlen -= sizeof(struct ip6_hbh); 972 opt = (u_int8_t *)hbh + sizeof(struct ip6_hbh); 973 974 if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh), 975 hbhlen, rtalertp, plenp) < 0) 976 return (-1); 977 978 *offp = off; 979 *mp = m; 980 return (0); 981 } 982 983 /* 984 * Search header for all Hop-by-hop options and process each option. 985 * This function is separate from ip6_hopopts_input() in order to 986 * handle a case where the sending node itself process its hop-by-hop 987 * options header. In such a case, the function is called from ip6_output(). 988 * 989 * The function assumes that hbh header is located right after the IPv6 header 990 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to 991 * opthead + hbhlen is located in continuous memory region. 992 */ 993 int 994 ip6_process_hopopts(struct mbuf *m, u_int8_t *opthead, int hbhlen, 995 u_int32_t *rtalertp, u_int32_t *plenp) 996 { 997 struct ip6_hdr *ip6; 998 int optlen = 0; 999 u_int8_t *opt = opthead; 1000 u_int16_t rtalert_val; 1001 u_int32_t jumboplen; 1002 const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh); 1003 1004 for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) { 1005 switch (*opt) { 1006 case IP6OPT_PAD1: 1007 optlen = 1; 1008 break; 1009 case IP6OPT_PADN: 1010 if (hbhlen < IP6OPT_MINLEN) { 1011 ip6stat.ip6s_toosmall++; 1012 goto bad; 1013 } 1014 optlen = *(opt + 1) + 2; 1015 break; 1016 case IP6OPT_RTALERT: 1017 /* XXX may need check for alignment */ 1018 if (hbhlen < IP6OPT_RTALERT_LEN) { 1019 ip6stat.ip6s_toosmall++; 1020 goto bad; 1021 } 1022 if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) { 1023 /* XXX stat */ 1024 icmp6_error(m, ICMP6_PARAM_PROB, 1025 ICMP6_PARAMPROB_HEADER, 1026 erroff + opt + 1 - opthead); 1027 return (-1); 1028 } 1029 optlen = IP6OPT_RTALERT_LEN; 1030 bcopy((caddr_t)(opt + 2), (caddr_t)&rtalert_val, 2); 1031 *rtalertp = ntohs(rtalert_val); 1032 break; 1033 case IP6OPT_JUMBO: 1034 /* XXX may need check for alignment */ 1035 if (hbhlen < IP6OPT_JUMBO_LEN) { 1036 ip6stat.ip6s_toosmall++; 1037 goto bad; 1038 } 1039 if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) { 1040 /* XXX stat */ 1041 icmp6_error(m, ICMP6_PARAM_PROB, 1042 ICMP6_PARAMPROB_HEADER, 1043 erroff + opt + 1 - opthead); 1044 return (-1); 1045 } 1046 optlen = IP6OPT_JUMBO_LEN; 1047 1048 /* 1049 * IPv6 packets that have non 0 payload length 1050 * must not contain a jumbo payload option. 1051 */ 1052 ip6 = mtod(m, struct ip6_hdr *); 1053 if (ip6->ip6_plen) { 1054 ip6stat.ip6s_badoptions++; 1055 icmp6_error(m, ICMP6_PARAM_PROB, 1056 ICMP6_PARAMPROB_HEADER, 1057 erroff + opt - opthead); 1058 return (-1); 1059 } 1060 1061 /* 1062 * We may see jumbolen in unaligned location, so 1063 * we'd need to perform bcopy(). 1064 */ 1065 bcopy(opt + 2, &jumboplen, sizeof(jumboplen)); 1066 jumboplen = (u_int32_t)htonl(jumboplen); 1067 1068 #if 1 1069 /* 1070 * if there are multiple jumbo payload options, 1071 * *plenp will be non-zero and the packet will be 1072 * rejected. 1073 * the behavior may need some debate in ipngwg - 1074 * multiple options does not make sense, however, 1075 * there's no explicit mention in specification. 1076 */ 1077 if (*plenp != 0) { 1078 ip6stat.ip6s_badoptions++; 1079 icmp6_error(m, ICMP6_PARAM_PROB, 1080 ICMP6_PARAMPROB_HEADER, 1081 erroff + opt + 2 - opthead); 1082 return (-1); 1083 } 1084 #endif 1085 1086 /* 1087 * jumbo payload length must be larger than 65535. 1088 */ 1089 if (jumboplen <= IPV6_MAXPACKET) { 1090 ip6stat.ip6s_badoptions++; 1091 icmp6_error(m, ICMP6_PARAM_PROB, 1092 ICMP6_PARAMPROB_HEADER, 1093 erroff + opt + 2 - opthead); 1094 return (-1); 1095 } 1096 *plenp = jumboplen; 1097 1098 break; 1099 default: /* unknown option */ 1100 if (hbhlen < IP6OPT_MINLEN) { 1101 ip6stat.ip6s_toosmall++; 1102 goto bad; 1103 } 1104 optlen = ip6_unknown_opt(opt, m, 1105 erroff + opt - opthead); 1106 if (optlen == -1) 1107 return (-1); 1108 optlen += 2; 1109 break; 1110 } 1111 } 1112 1113 return (0); 1114 1115 bad: 1116 m_freem(m); 1117 return (-1); 1118 } 1119 1120 /* 1121 * Unknown option processing. 1122 * The third argument `off' is the offset from the IPv6 header to the option, 1123 * which is necessary if the IPv6 header the and option header and IPv6 header 1124 * is not continuous in order to return an ICMPv6 error. 1125 */ 1126 int 1127 ip6_unknown_opt(u_int8_t *optp, struct mbuf *m, int off) 1128 { 1129 struct ip6_hdr *ip6; 1130 1131 switch (IP6OPT_TYPE(*optp)) { 1132 case IP6OPT_TYPE_SKIP: /* ignore the option */ 1133 return ((int)*(optp + 1)); 1134 case IP6OPT_TYPE_DISCARD: /* silently discard */ 1135 m_freem(m); 1136 return (-1); 1137 case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */ 1138 ip6stat.ip6s_badoptions++; 1139 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off); 1140 return (-1); 1141 case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */ 1142 ip6stat.ip6s_badoptions++; 1143 ip6 = mtod(m, struct ip6_hdr *); 1144 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 1145 (m->m_flags & (M_BCAST|M_MCAST))) 1146 m_freem(m); 1147 else 1148 icmp6_error(m, ICMP6_PARAM_PROB, 1149 ICMP6_PARAMPROB_OPTION, off); 1150 return (-1); 1151 } 1152 1153 m_freem(m); /* XXX: NOTREACHED */ 1154 return (-1); 1155 } 1156 1157 /* 1158 * Create the "control" list for this pcb. 1159 * The function will not modify mbuf chain at all. 1160 * 1161 * with KAME mbuf chain restriction: 1162 * The routine will be called from upper layer handlers like tcp6_input(). 1163 * Thus the routine assumes that the caller (tcp6_input) have already 1164 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the 1165 * very first mbuf on the mbuf chain. 1166 */ 1167 void 1168 ip6_savecontrol(struct inpcb *in6p, struct mbuf **mp, struct ip6_hdr *ip6, 1169 struct mbuf *m) 1170 { 1171 #define IS2292(x, y) ((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y)) 1172 struct thread *td = curthread; /* XXX */ 1173 int privileged = 0; 1174 int rthdr_exist = 0; 1175 1176 1177 if (priv_check(td, PRIV_ROOT) == 0) 1178 privileged++; 1179 1180 #ifdef SO_TIMESTAMP 1181 if (in6p->in6p_socket->so_options & SO_TIMESTAMP) { 1182 struct timeval tv; 1183 1184 microtime(&tv); 1185 *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv), 1186 SCM_TIMESTAMP, SOL_SOCKET); 1187 if (*mp) { 1188 mp = &(*mp)->m_next; 1189 } 1190 } 1191 #endif 1192 1193 /* RFC 2292 sec. 5 */ 1194 if (in6p->in6p_flags & IN6P_PKTINFO) { 1195 struct in6_pktinfo pi6; 1196 bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr)); 1197 if (IN6_IS_SCOPE_LINKLOCAL(&pi6.ipi6_addr)) 1198 pi6.ipi6_addr.s6_addr16[1] = 0; 1199 pi6.ipi6_ifindex = (m && m->m_pkthdr.rcvif) 1200 ? m->m_pkthdr.rcvif->if_index 1201 : 0; 1202 *mp = sbcreatecontrol((caddr_t) &pi6, 1203 sizeof(struct in6_pktinfo), IS2292(IPV6_2292PKTINFO, IPV6_PKTINFO), 1204 IPPROTO_IPV6); 1205 if (*mp) 1206 mp = &(*mp)->m_next; 1207 } 1208 1209 if (in6p->in6p_flags & IN6P_HOPLIMIT) { 1210 int hlim = ip6->ip6_hlim & 0xff; 1211 *mp = sbcreatecontrol((caddr_t) &hlim, 1212 sizeof(int), IS2292(IPV6_2292HOPLIMIT, IPV6_HOPLIMIT), IPPROTO_IPV6); 1213 if (*mp) 1214 mp = &(*mp)->m_next; 1215 } 1216 1217 if ((in6p->in6p_flags & IN6P_TCLASS) != 0) { 1218 u_int32_t flowinfo; 1219 int tclass; 1220 1221 flowinfo = (u_int32_t)ntohl(ip6->ip6_flow & IPV6_FLOWINFO_MASK); 1222 flowinfo >>= 20; 1223 1224 tclass = flowinfo & 0xff; 1225 *mp = sbcreatecontrol((caddr_t) &tclass, sizeof(tclass), 1226 IPV6_TCLASS, IPPROTO_IPV6); 1227 if (*mp) 1228 mp = &(*mp)->m_next; 1229 } 1230 1231 /* 1232 * IPV6_HOPOPTS socket option. We require super-user privilege 1233 * for the option, but it might be too strict, since there might 1234 * be some hop-by-hop options which can be returned to normal user. 1235 * See RFC 2292 section 6. 1236 */ 1237 if ((in6p->in6p_flags & IN6P_HOPOPTS) && privileged) { 1238 /* 1239 * Check if a hop-by-hop options header is contatined in the 1240 * received packet, and if so, store the options as ancillary 1241 * data. Note that a hop-by-hop options header must be 1242 * just after the IPv6 header, which fact is assured through 1243 * the IPv6 input processing. 1244 */ 1245 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1246 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 1247 struct ip6_hbh *hbh; 1248 int hbhlen = 0; 1249 #ifdef PULLDOWN_TEST 1250 struct mbuf *ext; 1251 #endif 1252 1253 #ifndef PULLDOWN_TEST 1254 hbh = (struct ip6_hbh *)(ip6 + 1); 1255 hbhlen = (hbh->ip6h_len + 1) << 3; 1256 #else 1257 ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr), 1258 ip6->ip6_nxt); 1259 if (ext == NULL) { 1260 ip6stat.ip6s_tooshort++; 1261 return; 1262 } 1263 hbh = mtod(ext, struct ip6_hbh *); 1264 hbhlen = (hbh->ip6h_len + 1) << 3; 1265 if (hbhlen != ext->m_len) { 1266 m_freem(ext); 1267 ip6stat.ip6s_tooshort++; 1268 return; 1269 } 1270 #endif 1271 1272 /* 1273 * XXX: We copy whole the header even if a jumbo 1274 * payload option is included, which option is to 1275 * be removed before returning in the RFC 2292. 1276 * Note: this constraint is removed in 2292bis. 1277 */ 1278 *mp = sbcreatecontrol((caddr_t)hbh, hbhlen, 1279 IS2292(IPV6_2292HOPOPTS, IPV6_HOPOPTS), IPPROTO_IPV6); 1280 if (*mp) 1281 mp = &(*mp)->m_next; 1282 #ifdef PULLDOWN_TEST 1283 m_freem(ext); 1284 #endif 1285 } 1286 } 1287 1288 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */ 1289 if ((in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDRDSTOPTS)) != 0) { 1290 int proto, off, nxt; 1291 1292 /* 1293 * go through the header chain to see if a routing header is 1294 * contained in the packet. We need this information to store 1295 * destination options headers (if any) properly. 1296 * XXX: performance issue. We should record this info when 1297 * processing extension headers in incoming routine. 1298 * (todo) use m_aux? 1299 */ 1300 proto = IPPROTO_IPV6; 1301 off = 0; 1302 nxt = -1; 1303 while (1) { 1304 int newoff; 1305 1306 newoff = ip6_nexthdr(m, off, proto, &nxt); 1307 if (newoff < 0) 1308 break; 1309 if (newoff < off) /* invalid, check for safety */ 1310 break; 1311 if ((proto = nxt) == IPPROTO_ROUTING) { 1312 rthdr_exist = 1; 1313 break; 1314 } 1315 off = newoff; 1316 } 1317 } 1318 1319 if ((in6p->in6p_flags & 1320 (IN6P_RTHDR | IN6P_DSTOPTS | IN6P_RTHDRDSTOPTS)) != 0) { 1321 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1322 int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr); 1323 1324 /* 1325 * Search for destination options headers or routing 1326 * header(s) through the header chain, and stores each 1327 * header as ancillary data. 1328 * Note that the order of the headers remains in 1329 * the chain of ancillary data. 1330 */ 1331 while (1) { /* is explicit loop prevention necessary? */ 1332 struct ip6_ext *ip6e = NULL; 1333 int elen; 1334 #ifdef PULLDOWN_TEST 1335 struct mbuf *ext = NULL; 1336 #endif 1337 1338 /* 1339 * if it is not an extension header, don't try to 1340 * pull it from the chain. 1341 */ 1342 switch (nxt) { 1343 case IPPROTO_DSTOPTS: 1344 case IPPROTO_ROUTING: 1345 case IPPROTO_HOPOPTS: 1346 case IPPROTO_AH: /* is it possible? */ 1347 break; 1348 default: 1349 goto loopend; 1350 } 1351 1352 #ifndef PULLDOWN_TEST 1353 if (off + sizeof(*ip6e) > m->m_len) 1354 goto loopend; 1355 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off); 1356 if (nxt == IPPROTO_AH) 1357 elen = (ip6e->ip6e_len + 2) << 2; 1358 else 1359 elen = (ip6e->ip6e_len + 1) << 3; 1360 if (off + elen > m->m_len) 1361 goto loopend; 1362 #else 1363 ext = ip6_pullexthdr(m, off, nxt); 1364 if (ext == NULL) { 1365 ip6stat.ip6s_tooshort++; 1366 return; 1367 } 1368 ip6e = mtod(ext, struct ip6_ext *); 1369 if (nxt == IPPROTO_AH) 1370 elen = (ip6e->ip6e_len + 2) << 2; 1371 else 1372 elen = (ip6e->ip6e_len + 1) << 3; 1373 if (elen != ext->m_len) { 1374 m_freem(ext); 1375 ip6stat.ip6s_tooshort++; 1376 return; 1377 } 1378 #endif 1379 1380 switch (nxt) { 1381 case IPPROTO_DSTOPTS: 1382 if ((in6p->in6p_flags & IN6P_DSTOPTS) == 0) 1383 break; 1384 1385 /* 1386 * We also require super-user privilege for 1387 * the option. 1388 * See the comments on IN6_HOPOPTS. 1389 */ 1390 if (!privileged) 1391 break; 1392 1393 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1394 IS2292(IPV6_2292DSTOPTS, IPV6_DSTOPTS), 1395 IPPROTO_IPV6); 1396 if (*mp) 1397 mp = &(*mp)->m_next; 1398 break; 1399 case IPPROTO_ROUTING: 1400 if (!(in6p->in6p_flags & IN6P_RTHDR)) 1401 break; 1402 1403 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1404 IS2292(IPV6_2292RTHDR, IPV6_RTHDR), 1405 IPPROTO_IPV6); 1406 if (*mp) 1407 mp = &(*mp)->m_next; 1408 break; 1409 case IPPROTO_HOPOPTS: 1410 case IPPROTO_AH: /* is it possible? */ 1411 break; 1412 1413 default: 1414 /* 1415 * other cases have been filtered in the above. 1416 * none will visit this case. here we supply 1417 * the code just in case (nxt overwritten or 1418 * other cases). 1419 */ 1420 #ifdef PULLDOWN_TEST 1421 m_freem(ext); 1422 #endif 1423 goto loopend; 1424 1425 } 1426 1427 /* proceed with the next header. */ 1428 off += elen; 1429 nxt = ip6e->ip6e_nxt; 1430 ip6e = NULL; 1431 #ifdef PULLDOWN_TEST 1432 m_freem(ext); 1433 ext = NULL; 1434 #endif 1435 } 1436 loopend: 1437 ; 1438 } 1439 #undef IS2292 1440 } 1441 1442 void 1443 ip6_notify_pmtu(struct inpcb *in6p, struct sockaddr_in6 *dst, u_int32_t *mtu) 1444 { 1445 struct socket *so; 1446 struct mbuf *m_mtu; 1447 struct ip6_mtuinfo mtuctl; 1448 1449 so = in6p->inp_socket; 1450 1451 if (mtu == NULL) 1452 return; 1453 1454 #ifdef DIAGNOSTIC 1455 if (so == NULL) /* I believe this is impossible */ 1456 panic("ip6_notify_pmtu: socket is NULL"); 1457 #endif 1458 1459 bzero(&mtuctl, sizeof(mtuctl)); /* zero-clear for safety */ 1460 mtuctl.ip6m_mtu = *mtu; 1461 mtuctl.ip6m_addr = *dst; 1462 1463 if ((m_mtu = sbcreatecontrol((caddr_t)&mtuctl, sizeof(mtuctl), 1464 IPV6_PATHMTU, IPPROTO_IPV6)) == NULL) 1465 return; 1466 1467 lwkt_gettoken(&so->so_rcv.ssb_token); 1468 if (sbappendaddr(&so->so_rcv.sb, (struct sockaddr *)dst, NULL, m_mtu) 1469 == 0) { 1470 m_freem(m_mtu); 1471 /* XXX: should count statistics */ 1472 } else { 1473 sorwakeup(so); 1474 } 1475 lwkt_reltoken(&so->so_rcv.ssb_token); 1476 } 1477 1478 #ifdef PULLDOWN_TEST 1479 /* 1480 * pull single extension header from mbuf chain. returns single mbuf that 1481 * contains the result, or NULL on error. 1482 */ 1483 static struct mbuf * 1484 ip6_pullexthdr(struct mbuf *m, size_t off, int nxt) 1485 { 1486 struct ip6_ext ip6e; 1487 size_t elen; 1488 struct mbuf *n; 1489 1490 #ifdef DIAGNOSTIC 1491 switch (nxt) { 1492 case IPPROTO_DSTOPTS: 1493 case IPPROTO_ROUTING: 1494 case IPPROTO_HOPOPTS: 1495 case IPPROTO_AH: /* is it possible? */ 1496 break; 1497 default: 1498 kprintf("ip6_pullexthdr: invalid nxt=%d\n", nxt); 1499 } 1500 #endif 1501 1502 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1503 if (nxt == IPPROTO_AH) 1504 elen = (ip6e.ip6e_len + 2) << 2; 1505 else 1506 elen = (ip6e.ip6e_len + 1) << 3; 1507 1508 n = m_getb(elen, MB_DONTWAIT, MT_DATA, 0); 1509 if (n == NULL) 1510 return NULL; 1511 n->m_len = 0; 1512 1513 if (elen >= M_TRAILINGSPACE(n)) { 1514 m_free(n); 1515 return NULL; 1516 } 1517 1518 m_copydata(m, off, elen, mtod(n, caddr_t)); 1519 n->m_len = elen; 1520 return n; 1521 } 1522 #endif 1523 1524 /* 1525 * Get pointer to the previous header followed by the header 1526 * currently processed. 1527 * XXX: This function supposes that 1528 * M includes all headers, 1529 * the next header field and the header length field of each header 1530 * are valid, and 1531 * the sum of each header length equals to OFF. 1532 * Because of these assumptions, this function must be called very 1533 * carefully. Moreover, it will not be used in the near future when 1534 * we develop `neater' mechanism to process extension headers. 1535 */ 1536 char * 1537 ip6_get_prevhdr(struct mbuf *m, int off) 1538 { 1539 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1540 1541 if (off == sizeof(struct ip6_hdr)) 1542 return (&ip6->ip6_nxt); 1543 else { 1544 int len, nxt; 1545 struct ip6_ext *ip6e = NULL; 1546 1547 nxt = ip6->ip6_nxt; 1548 len = sizeof(struct ip6_hdr); 1549 while (len < off) { 1550 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + len); 1551 1552 switch (nxt) { 1553 case IPPROTO_FRAGMENT: 1554 len += sizeof(struct ip6_frag); 1555 break; 1556 case IPPROTO_AH: 1557 len += (ip6e->ip6e_len + 2) << 2; 1558 break; 1559 default: 1560 len += (ip6e->ip6e_len + 1) << 3; 1561 break; 1562 } 1563 nxt = ip6e->ip6e_nxt; 1564 } 1565 if (ip6e) 1566 return (&ip6e->ip6e_nxt); 1567 else 1568 return NULL; 1569 } 1570 } 1571 1572 /* 1573 * get next header offset. m will be retained. 1574 */ 1575 int 1576 ip6_nexthdr(struct mbuf *m, int off, int proto, int *nxtp) 1577 { 1578 struct ip6_hdr ip6; 1579 struct ip6_ext ip6e; 1580 struct ip6_frag fh; 1581 1582 /* just in case */ 1583 if (m == NULL) 1584 panic("ip6_nexthdr: m == NULL"); 1585 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off) 1586 return -1; 1587 1588 switch (proto) { 1589 case IPPROTO_IPV6: 1590 if (m->m_pkthdr.len < off + sizeof(ip6)) 1591 return -1; 1592 m_copydata(m, off, sizeof(ip6), (caddr_t)&ip6); 1593 if (nxtp) 1594 *nxtp = ip6.ip6_nxt; 1595 off += sizeof(ip6); 1596 return off; 1597 1598 case IPPROTO_FRAGMENT: 1599 /* 1600 * terminate parsing if it is not the first fragment, 1601 * it does not make sense to parse through it. 1602 */ 1603 if (m->m_pkthdr.len < off + sizeof(fh)) 1604 return -1; 1605 m_copydata(m, off, sizeof(fh), (caddr_t)&fh); 1606 /* IP6F_OFF_MASK = 0xfff8(BigEndian), 0xf8ff(LittleEndian) */ 1607 if (fh.ip6f_offlg & IP6F_OFF_MASK) 1608 return -1; 1609 if (nxtp) 1610 *nxtp = fh.ip6f_nxt; 1611 off += sizeof(struct ip6_frag); 1612 return off; 1613 1614 case IPPROTO_AH: 1615 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1616 return -1; 1617 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1618 if (nxtp) 1619 *nxtp = ip6e.ip6e_nxt; 1620 off += (ip6e.ip6e_len + 2) << 2; 1621 return off; 1622 1623 case IPPROTO_HOPOPTS: 1624 case IPPROTO_ROUTING: 1625 case IPPROTO_DSTOPTS: 1626 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1627 return -1; 1628 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1629 if (nxtp) 1630 *nxtp = ip6e.ip6e_nxt; 1631 off += (ip6e.ip6e_len + 1) << 3; 1632 return off; 1633 1634 case IPPROTO_NONE: 1635 case IPPROTO_ESP: 1636 case IPPROTO_IPCOMP: 1637 /* give up */ 1638 return -1; 1639 1640 default: 1641 return -1; 1642 } 1643 1644 return -1; 1645 } 1646 1647 /* 1648 * get offset for the last header in the chain. m will be kept untainted. 1649 */ 1650 int 1651 ip6_lasthdr(struct mbuf *m, int off, int proto, int *nxtp) 1652 { 1653 int newoff; 1654 int nxt; 1655 1656 if (!nxtp) { 1657 nxt = -1; 1658 nxtp = &nxt; 1659 } 1660 while (1) { 1661 newoff = ip6_nexthdr(m, off, proto, nxtp); 1662 if (newoff < 0) 1663 return off; 1664 else if (newoff < off) 1665 return -1; /* invalid */ 1666 else if (newoff == off) 1667 return newoff; 1668 1669 off = newoff; 1670 proto = *nxtp; 1671 } 1672 } 1673 1674 struct ip6aux * 1675 ip6_addaux(struct mbuf *m) 1676 { 1677 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1678 if (!tag) { 1679 tag = m_tag_get(PACKET_TAG_IPV6_INPUT, 1680 sizeof (struct ip6aux), 1681 MB_DONTWAIT); 1682 if (tag) 1683 m_tag_prepend(m, tag); 1684 } 1685 if (tag) 1686 bzero(m_tag_data(tag), sizeof (struct ip6aux)); 1687 return tag ? (struct ip6aux *)m_tag_data(tag) : NULL; 1688 } 1689 1690 struct ip6aux * 1691 ip6_findaux(struct mbuf *m) 1692 { 1693 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1694 return tag ? (struct ip6aux*)(tag+1) : NULL; 1695 } 1696 1697 void 1698 ip6_delaux(struct mbuf *m) 1699 { 1700 struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1701 if (tag) 1702 m_tag_delete(m, tag); 1703 } 1704 1705 /* 1706 * System control for IP6 1707 */ 1708 1709 u_char inet6ctlerrmap[PRC_NCMDS] = { 1710 0, 0, 0, 0, 1711 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, 1712 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, 1713 EMSGSIZE, EHOSTUNREACH, 0, 0, 1714 0, 0, 0, 0, 1715 ENOPROTOOPT 1716 }; 1717