1 /* $NetBSD: icmp6.c,v 1.71 2001/11/13 00:56:58 lukem Exp $ */ 2 /* $KAME: icmp6.c,v 1.217 2001/06/20 15:03:29 jinmei Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 /* 34 * Copyright (c) 1982, 1986, 1988, 1993 35 * The Regents of the University of California. All rights reserved. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 3. All advertising materials mentioning features or use of this software 46 * must display the following acknowledgement: 47 * This product includes software developed by the University of 48 * California, Berkeley and its contributors. 49 * 4. Neither the name of the University nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 56 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 63 * SUCH DAMAGE. 64 * 65 * @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94 66 */ 67 68 #include <sys/cdefs.h> 69 __KERNEL_RCSID(0, "$NetBSD: icmp6.c,v 1.71 2001/11/13 00:56:58 lukem Exp $"); 70 71 #include "opt_inet.h" 72 #include "opt_ipsec.h" 73 74 #include <sys/param.h> 75 #include <sys/systm.h> 76 #include <sys/malloc.h> 77 #include <sys/mbuf.h> 78 #include <sys/protosw.h> 79 #include <sys/socket.h> 80 #include <sys/socketvar.h> 81 #include <sys/time.h> 82 #include <sys/kernel.h> 83 #include <sys/syslog.h> 84 #include <sys/domain.h> 85 #include <sys/sysctl.h> 86 87 #include <net/if.h> 88 #include <net/route.h> 89 #include <net/if_dl.h> 90 #include <net/if_types.h> 91 92 #include <netinet/in.h> 93 #include <netinet/in_var.h> 94 #include <netinet/ip6.h> 95 #include <netinet6/ip6_var.h> 96 #include <netinet/icmp6.h> 97 #include <netinet6/mld6_var.h> 98 #include <netinet6/in6_pcb.h> 99 #include <netinet6/nd6.h> 100 #include <netinet6/in6_ifattach.h> 101 #include <netinet6/ip6protosw.h> 102 103 104 #ifdef IPSEC 105 #include <netinet6/ipsec.h> 106 #include <netkey/key.h> 107 #endif 108 109 #include "faith.h" 110 #if defined(NFAITH) && 0 < NFAITH 111 #include <net/if_faith.h> 112 #endif 113 114 #include <net/net_osdep.h> 115 116 extern struct domain inet6domain; 117 118 struct icmp6stat icmp6stat; 119 120 extern struct in6pcb rawin6pcb; 121 extern int icmp6errppslim; 122 static int icmp6errpps_count = 0; 123 static struct timeval icmp6errppslim_last; 124 extern int icmp6_nodeinfo; 125 126 /* 127 * List of callbacks to notify when Path MTU changes are made. 128 */ 129 struct icmp6_mtudisc_callback { 130 LIST_ENTRY(icmp6_mtudisc_callback) mc_list; 131 void (*mc_func) __P((struct in6_addr *)); 132 }; 133 134 LIST_HEAD(, icmp6_mtudisc_callback) icmp6_mtudisc_callbacks = 135 LIST_HEAD_INITIALIZER(&icmp6_mtudisc_callbacks); 136 137 static struct rttimer_queue *icmp6_mtudisc_timeout_q = NULL; 138 extern int pmtu_expire; 139 140 /* XXX do these values make any sense? */ 141 static int icmp6_mtudisc_hiwat = 1280; 142 static int icmp6_mtudisc_lowat = 256; 143 144 /* 145 * keep track of # of redirect routes. 146 */ 147 static struct rttimer_queue *icmp6_redirect_timeout_q = NULL; 148 149 /* XXX experimental, turned off */ 150 static int icmp6_redirect_hiwat = -1; 151 static int icmp6_redirect_lowat = -1; 152 153 static void icmp6_errcount __P((struct icmp6errstat *, int, int)); 154 static int icmp6_rip6_input __P((struct mbuf **, int)); 155 static int icmp6_ratelimit __P((const struct in6_addr *, const int, const int)); 156 static const char *icmp6_redirect_diag __P((struct in6_addr *, 157 struct in6_addr *, struct in6_addr *)); 158 static struct mbuf *ni6_input __P((struct mbuf *, int)); 159 static struct mbuf *ni6_nametodns __P((const char *, int, int)); 160 static int ni6_dnsmatch __P((const char *, int, const char *, int)); 161 static int ni6_addrs __P((struct icmp6_nodeinfo *, struct mbuf *, 162 struct ifnet **, char *)); 163 static int ni6_store_addrs __P((struct icmp6_nodeinfo *, struct icmp6_nodeinfo *, 164 struct ifnet *, int)); 165 static int icmp6_notify_error __P((struct mbuf *, int, int, int)); 166 static struct rtentry *icmp6_mtudisc_clone __P((struct sockaddr *)); 167 static void icmp6_mtudisc_timeout __P((struct rtentry *, struct rttimer *)); 168 static void icmp6_redirect_timeout __P((struct rtentry *, struct rttimer *)); 169 170 void 171 icmp6_init() 172 { 173 mld6_init(); 174 icmp6_mtudisc_timeout_q = rt_timer_queue_create(pmtu_expire); 175 icmp6_redirect_timeout_q = rt_timer_queue_create(icmp6_redirtimeout); 176 } 177 178 static void 179 icmp6_errcount(stat, type, code) 180 struct icmp6errstat *stat; 181 int type, code; 182 { 183 switch (type) { 184 case ICMP6_DST_UNREACH: 185 switch (code) { 186 case ICMP6_DST_UNREACH_NOROUTE: 187 stat->icp6errs_dst_unreach_noroute++; 188 return; 189 case ICMP6_DST_UNREACH_ADMIN: 190 stat->icp6errs_dst_unreach_admin++; 191 return; 192 case ICMP6_DST_UNREACH_BEYONDSCOPE: 193 stat->icp6errs_dst_unreach_beyondscope++; 194 return; 195 case ICMP6_DST_UNREACH_ADDR: 196 stat->icp6errs_dst_unreach_addr++; 197 return; 198 case ICMP6_DST_UNREACH_NOPORT: 199 stat->icp6errs_dst_unreach_noport++; 200 return; 201 } 202 break; 203 case ICMP6_PACKET_TOO_BIG: 204 stat->icp6errs_packet_too_big++; 205 return; 206 case ICMP6_TIME_EXCEEDED: 207 switch (code) { 208 case ICMP6_TIME_EXCEED_TRANSIT: 209 stat->icp6errs_time_exceed_transit++; 210 return; 211 case ICMP6_TIME_EXCEED_REASSEMBLY: 212 stat->icp6errs_time_exceed_reassembly++; 213 return; 214 } 215 break; 216 case ICMP6_PARAM_PROB: 217 switch (code) { 218 case ICMP6_PARAMPROB_HEADER: 219 stat->icp6errs_paramprob_header++; 220 return; 221 case ICMP6_PARAMPROB_NEXTHEADER: 222 stat->icp6errs_paramprob_nextheader++; 223 return; 224 case ICMP6_PARAMPROB_OPTION: 225 stat->icp6errs_paramprob_option++; 226 return; 227 } 228 break; 229 case ND_REDIRECT: 230 stat->icp6errs_redirect++; 231 return; 232 } 233 stat->icp6errs_unknown++; 234 } 235 236 /* 237 * Register a Path MTU Discovery callback. 238 */ 239 void 240 icmp6_mtudisc_callback_register(func) 241 void (*func) __P((struct in6_addr *)); 242 { 243 struct icmp6_mtudisc_callback *mc; 244 245 for (mc = LIST_FIRST(&icmp6_mtudisc_callbacks); mc != NULL; 246 mc = LIST_NEXT(mc, mc_list)) { 247 if (mc->mc_func == func) 248 return; 249 } 250 251 mc = malloc(sizeof(*mc), M_PCB, M_NOWAIT); 252 if (mc == NULL) 253 panic("icmp6_mtudisc_callback_register"); 254 255 mc->mc_func = func; 256 LIST_INSERT_HEAD(&icmp6_mtudisc_callbacks, mc, mc_list); 257 } 258 259 /* 260 * Generate an error packet of type error in response to bad IP6 packet. 261 */ 262 void 263 icmp6_error(m, type, code, param) 264 struct mbuf *m; 265 int type, code, param; 266 { 267 struct ip6_hdr *oip6, *nip6; 268 struct icmp6_hdr *icmp6; 269 u_int preplen; 270 int off; 271 int nxt; 272 273 icmp6stat.icp6s_error++; 274 275 /* count per-type-code statistics */ 276 icmp6_errcount(&icmp6stat.icp6s_outerrhist, type, code); 277 278 if (m->m_flags & M_DECRYPTED) { 279 icmp6stat.icp6s_canterror++; 280 goto freeit; 281 } 282 283 #ifndef PULLDOWN_TEST 284 IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), ); 285 #else 286 if (m->m_len < sizeof(struct ip6_hdr)) { 287 m = m_pullup(m, sizeof(struct ip6_hdr)); 288 if (m == NULL) 289 return; 290 } 291 #endif 292 oip6 = mtod(m, struct ip6_hdr *); 293 294 /* 295 * If the destination address of the erroneous packet is a multicast 296 * address, or the packet was sent using link-layer multicast, 297 * we should basically suppress sending an error (RFC 2463, Section 298 * 2.4). 299 * We have two exceptions (the item e.2 in that section): 300 * - the Pakcet Too Big message can be sent for path MTU discovery. 301 * - the Parameter Problem Message that can be allowed an icmp6 error 302 * in the option type field. This check has been done in 303 * ip6_unknown_opt(), so we can just check the type and code. 304 */ 305 if ((m->m_flags & (M_BCAST|M_MCAST) || 306 IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) && 307 (type != ICMP6_PACKET_TOO_BIG && 308 (type != ICMP6_PARAM_PROB || 309 code != ICMP6_PARAMPROB_OPTION))) 310 goto freeit; 311 312 /* 313 * RFC 2463, 2.4 (e.5): source address check. 314 * XXX: the case of anycast source? 315 */ 316 if (IN6_IS_ADDR_UNSPECIFIED(&oip6->ip6_src) || 317 IN6_IS_ADDR_MULTICAST(&oip6->ip6_src)) 318 goto freeit; 319 320 /* 321 * If we are about to send ICMPv6 against ICMPv6 error/redirect, 322 * don't do it. 323 */ 324 nxt = -1; 325 off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt); 326 if (off >= 0 && nxt == IPPROTO_ICMPV6) { 327 struct icmp6_hdr *icp; 328 329 #ifndef PULLDOWN_TEST 330 IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct icmp6_hdr), ); 331 icp = (struct icmp6_hdr *)(mtod(m, caddr_t) + off); 332 #else 333 IP6_EXTHDR_GET(icp, struct icmp6_hdr *, m, off, 334 sizeof(*icp)); 335 if (icp == NULL) { 336 icmp6stat.icp6s_tooshort++; 337 return; 338 } 339 #endif 340 if (icp->icmp6_type < ICMP6_ECHO_REQUEST || 341 icp->icmp6_type == ND_REDIRECT) { 342 /* 343 * ICMPv6 error 344 * Special case: for redirect (which is 345 * informational) we must not send icmp6 error. 346 */ 347 icmp6stat.icp6s_canterror++; 348 goto freeit; 349 } else { 350 /* ICMPv6 informational - send the error */ 351 } 352 } 353 #if 0 /* controversial */ 354 else if (off >= 0 && nxt == IPPROTO_ESP) { 355 /* 356 * It could be ICMPv6 error inside ESP. Take a safer side, 357 * don't respond. 358 */ 359 icmp6stat.icp6s_canterror++; 360 goto freeit; 361 } 362 #endif 363 else { 364 /* non-ICMPv6 - send the error */ 365 } 366 367 oip6 = mtod(m, struct ip6_hdr *); /* adjust pointer */ 368 369 /* Finally, do rate limitation check. */ 370 if (icmp6_ratelimit(&oip6->ip6_src, type, code)) { 371 icmp6stat.icp6s_toofreq++; 372 goto freeit; 373 } 374 375 /* 376 * OK, ICMP6 can be generated. 377 */ 378 379 if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN) 380 m_adj(m, ICMPV6_PLD_MAXLEN - m->m_pkthdr.len); 381 382 preplen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr); 383 M_PREPEND(m, preplen, M_DONTWAIT); 384 if (m && m->m_len < preplen) 385 m = m_pullup(m, preplen); 386 if (m == NULL) { 387 nd6log((LOG_DEBUG, "ENOBUFS in icmp6_error %d\n", __LINE__)); 388 return; 389 } 390 391 nip6 = mtod(m, struct ip6_hdr *); 392 nip6->ip6_src = oip6->ip6_src; 393 nip6->ip6_dst = oip6->ip6_dst; 394 395 if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_src)) 396 oip6->ip6_src.s6_addr16[1] = 0; 397 if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_dst)) 398 oip6->ip6_dst.s6_addr16[1] = 0; 399 400 icmp6 = (struct icmp6_hdr *)(nip6 + 1); 401 icmp6->icmp6_type = type; 402 icmp6->icmp6_code = code; 403 icmp6->icmp6_pptr = htonl((u_int32_t)param); 404 405 /* 406 * icmp6_reflect() is designed to be in the input path. 407 * icmp6_error() can be called from both input and outut path, 408 * and if we are in output path rcvif could contain bogus value. 409 * clear m->m_pkthdr.rcvif for safety, we should have enough scope 410 * information in ip header (nip6). 411 */ 412 m->m_pkthdr.rcvif = NULL; 413 414 icmp6stat.icp6s_outhist[type]++; 415 icmp6_reflect(m, sizeof(struct ip6_hdr)); /* header order: IPv6 - ICMPv6 */ 416 417 return; 418 419 freeit: 420 /* 421 * If we can't tell wheter or not we can generate ICMP6, free it. 422 */ 423 m_freem(m); 424 } 425 426 /* 427 * Process a received ICMP6 message. 428 */ 429 int 430 icmp6_input(mp, offp, proto) 431 struct mbuf **mp; 432 int *offp, proto; 433 { 434 struct mbuf *m = *mp, *n; 435 struct ip6_hdr *ip6, *nip6; 436 struct icmp6_hdr *icmp6, *nicmp6; 437 int off = *offp; 438 int icmp6len = m->m_pkthdr.len - *offp; 439 int code, sum, noff; 440 441 #ifndef PULLDOWN_TEST 442 IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_hdr), IPPROTO_DONE); 443 /* m might change if M_LOOP. So, call mtod after this */ 444 #endif 445 446 /* 447 * Locate icmp6 structure in mbuf, and check 448 * that not corrupted and of at least minimum length 449 */ 450 451 ip6 = mtod(m, struct ip6_hdr *); 452 if (icmp6len < sizeof(struct icmp6_hdr)) { 453 icmp6stat.icp6s_tooshort++; 454 goto freeit; 455 } 456 457 /* 458 * calculate the checksum 459 */ 460 #ifndef PULLDOWN_TEST 461 icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off); 462 #else 463 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6)); 464 if (icmp6 == NULL) { 465 icmp6stat.icp6s_tooshort++; 466 return IPPROTO_DONE; 467 } 468 #endif 469 code = icmp6->icmp6_code; 470 471 if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) { 472 nd6log((LOG_ERR, 473 "ICMP6 checksum error(%d|%x) %s\n", 474 icmp6->icmp6_type, sum, ip6_sprintf(&ip6->ip6_src))); 475 icmp6stat.icp6s_checksum++; 476 goto freeit; 477 } 478 479 #if defined(NFAITH) && 0 < NFAITH 480 if (faithprefix(&ip6->ip6_dst)) { 481 /* 482 * Deliver very specific ICMP6 type only. 483 * This is important to deilver TOOBIG. Otherwise PMTUD 484 * will not work. 485 */ 486 switch (icmp6->icmp6_type) { 487 case ICMP6_DST_UNREACH: 488 case ICMP6_PACKET_TOO_BIG: 489 case ICMP6_TIME_EXCEEDED: 490 break; 491 default: 492 goto freeit; 493 } 494 } 495 #endif 496 497 icmp6stat.icp6s_inhist[icmp6->icmp6_type]++; 498 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_msg); 499 if (icmp6->icmp6_type < ICMP6_INFOMSG_MASK) 500 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_error); 501 502 switch (icmp6->icmp6_type) { 503 case ICMP6_DST_UNREACH: 504 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_dstunreach); 505 switch (code) { 506 case ICMP6_DST_UNREACH_NOROUTE: 507 code = PRC_UNREACH_NET; 508 break; 509 case ICMP6_DST_UNREACH_ADMIN: 510 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_adminprohib); 511 code = PRC_UNREACH_PROTOCOL; /* is this a good code? */ 512 break; 513 case ICMP6_DST_UNREACH_ADDR: 514 code = PRC_HOSTDEAD; 515 break; 516 #ifdef COMPAT_RFC1885 517 case ICMP6_DST_UNREACH_NOTNEIGHBOR: 518 code = PRC_UNREACH_SRCFAIL; 519 break; 520 #else 521 case ICMP6_DST_UNREACH_BEYONDSCOPE: 522 /* I mean "source address was incorrect." */ 523 code = PRC_UNREACH_NET; 524 break; 525 #endif 526 case ICMP6_DST_UNREACH_NOPORT: 527 code = PRC_UNREACH_PORT; 528 break; 529 default: 530 goto badcode; 531 } 532 goto deliver; 533 break; 534 535 case ICMP6_PACKET_TOO_BIG: 536 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_pkttoobig); 537 if (code != 0) 538 goto badcode; 539 540 code = PRC_MSGSIZE; 541 542 /* 543 * Updating the path MTU will be done after examining 544 * intermediate extension headers. 545 */ 546 goto deliver; 547 break; 548 549 case ICMP6_TIME_EXCEEDED: 550 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_timeexceed); 551 switch (code) { 552 case ICMP6_TIME_EXCEED_TRANSIT: 553 code = PRC_TIMXCEED_INTRANS; 554 break; 555 case ICMP6_TIME_EXCEED_REASSEMBLY: 556 code = PRC_TIMXCEED_REASS; 557 break; 558 default: 559 goto badcode; 560 } 561 goto deliver; 562 break; 563 564 case ICMP6_PARAM_PROB: 565 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_paramprob); 566 switch (code) { 567 case ICMP6_PARAMPROB_NEXTHEADER: 568 code = PRC_UNREACH_PROTOCOL; 569 break; 570 case ICMP6_PARAMPROB_HEADER: 571 case ICMP6_PARAMPROB_OPTION: 572 code = PRC_PARAMPROB; 573 break; 574 default: 575 goto badcode; 576 } 577 goto deliver; 578 break; 579 580 case ICMP6_ECHO_REQUEST: 581 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echo); 582 if (code != 0) 583 goto badcode; 584 /* 585 * Copy mbuf to send to two data paths: userland socket(s), 586 * and to the querier (echo reply). 587 * m: a copy for socket, n: a copy for querier 588 */ 589 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 590 /* Give up local */ 591 n = m; 592 m = NULL; 593 goto deliverecho; 594 } 595 /* 596 * If the first mbuf is shared, or the first mbuf is too short, 597 * copy the first part of the data into a fresh mbuf. 598 * Otherwise, we will wrongly overwrite both copies. 599 */ 600 if ((n->m_flags & M_EXT) != 0 || 601 n->m_len < off + sizeof(struct icmp6_hdr)) { 602 struct mbuf *n0 = n; 603 const int maxlen = sizeof(*nip6) + sizeof(*nicmp6); 604 605 /* 606 * Prepare an internal mbuf. m_pullup() doesn't 607 * always copy the length we specified. 608 */ 609 if (maxlen >= MCLBYTES) { 610 /* Give up remote */ 611 m_freem(n0); 612 break; 613 } 614 MGETHDR(n, M_DONTWAIT, n0->m_type); 615 if (n && maxlen >= MHLEN) { 616 MCLGET(n, M_DONTWAIT); 617 if ((n->m_flags & M_EXT) == 0) { 618 m_free(n); 619 n = NULL; 620 } 621 } 622 if (n == NULL) { 623 /* Give up local */ 624 m_freem(n0); 625 n = m; 626 m = NULL; 627 goto deliverecho; 628 } 629 M_COPY_PKTHDR(n, n0); 630 /* 631 * Copy IPv6 and ICMPv6 only. 632 */ 633 nip6 = mtod(n, struct ip6_hdr *); 634 bcopy(ip6, nip6, sizeof(struct ip6_hdr)); 635 nicmp6 = (struct icmp6_hdr *)(nip6 + 1); 636 bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr)); 637 noff = sizeof(struct ip6_hdr); 638 n->m_len = noff + sizeof(struct icmp6_hdr); 639 /* 640 * Adjust mbuf. ip6_plen will be adjusted in 641 * ip6_output(). 642 * n->m_pkthdr.len == n0->m_pkthdr.len at this point. 643 */ 644 n->m_pkthdr.len += noff + sizeof(struct icmp6_hdr); 645 n->m_pkthdr.len -= (off + sizeof(struct icmp6_hdr)); 646 m_adj(n0, off + sizeof(struct icmp6_hdr)); 647 n->m_next = n0; 648 n0->m_flags &= ~M_PKTHDR; 649 } else { 650 deliverecho: 651 nip6 = mtod(n, struct ip6_hdr *); 652 nicmp6 = (struct icmp6_hdr *)((caddr_t)nip6 + off); 653 noff = off; 654 } 655 nicmp6->icmp6_type = ICMP6_ECHO_REPLY; 656 nicmp6->icmp6_code = 0; 657 if (n) { 658 icmp6stat.icp6s_reflect++; 659 icmp6stat.icp6s_outhist[ICMP6_ECHO_REPLY]++; 660 icmp6_reflect(n, noff); 661 } 662 if (!m) 663 goto freeit; 664 break; 665 666 case ICMP6_ECHO_REPLY: 667 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echoreply); 668 if (code != 0) 669 goto badcode; 670 break; 671 672 case MLD6_LISTENER_QUERY: 673 case MLD6_LISTENER_REPORT: 674 if (icmp6len < sizeof(struct mld6_hdr)) 675 goto badlen; 676 if (icmp6->icmp6_type == MLD6_LISTENER_QUERY) /* XXX: ugly... */ 677 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldquery); 678 else 679 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldreport); 680 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 681 /* give up local */ 682 mld6_input(m, off); 683 m = NULL; 684 goto freeit; 685 } 686 mld6_input(n, off); 687 /* m stays. */ 688 break; 689 690 case MLD6_LISTENER_DONE: 691 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mlddone); 692 if (icmp6len < sizeof(struct mld6_hdr)) /* necessary? */ 693 goto badlen; 694 break; /* nothing to be done in kernel */ 695 696 case MLD6_MTRACE_RESP: 697 case MLD6_MTRACE: 698 /* XXX: these two are experimental. not officially defind. */ 699 /* XXX: per-interface statistics? */ 700 break; /* just pass it to applications */ 701 702 case ICMP6_WRUREQUEST: /* ICMP6_FQDN_QUERY */ 703 { 704 enum { WRU, FQDN } mode; 705 706 if (!icmp6_nodeinfo) 707 break; 708 709 if (icmp6len == sizeof(struct icmp6_hdr) + 4) 710 mode = WRU; 711 else if (icmp6len >= sizeof(struct icmp6_nodeinfo)) 712 mode = FQDN; 713 else 714 goto badlen; 715 716 if (mode == FQDN) { 717 #ifndef PULLDOWN_TEST 718 IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_nodeinfo), 719 IPPROTO_DONE); 720 #endif 721 n = m_copym(m, 0, M_COPYALL, M_DONTWAIT); 722 if (n) 723 n = ni6_input(n, off); 724 /* XXX meaningless if n == NULL */ 725 noff = sizeof(struct ip6_hdr); 726 } else { 727 u_char *p; 728 int maxlen, maxhlen; 729 730 if ((icmp6_nodeinfo & 5) != 5) 731 break; 732 733 if (code != 0) 734 goto badcode; 735 maxlen = sizeof(*nip6) + sizeof(*nicmp6) + 4; 736 if (maxlen >= MCLBYTES) { 737 /* Give up remote */ 738 break; 739 } 740 MGETHDR(n, M_DONTWAIT, m->m_type); 741 if (n && maxlen > MHLEN) { 742 MCLGET(n, M_DONTWAIT); 743 if ((n->m_flags & M_EXT) == 0) { 744 m_free(n); 745 n = NULL; 746 } 747 } 748 if (n == NULL) { 749 /* Give up remote */ 750 break; 751 } 752 n->m_pkthdr.rcvif = NULL; 753 n->m_len = 0; 754 maxhlen = M_TRAILINGSPACE(n) - maxlen; 755 if (maxhlen > hostnamelen) 756 maxhlen = hostnamelen; 757 /* 758 * Copy IPv6 and ICMPv6 only. 759 */ 760 nip6 = mtod(n, struct ip6_hdr *); 761 bcopy(ip6, nip6, sizeof(struct ip6_hdr)); 762 nicmp6 = (struct icmp6_hdr *)(nip6 + 1); 763 bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr)); 764 p = (u_char *)(nicmp6 + 1); 765 bzero(p, 4); 766 bcopy(hostname, p + 4, maxhlen); /* meaningless TTL */ 767 noff = sizeof(struct ip6_hdr); 768 M_COPY_PKTHDR(n, m); /* just for recvif */ 769 n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) + 770 sizeof(struct icmp6_hdr) + 4 + maxhlen; 771 nicmp6->icmp6_type = ICMP6_WRUREPLY; 772 nicmp6->icmp6_code = 0; 773 } 774 #undef hostnamelen 775 if (n) { 776 icmp6stat.icp6s_reflect++; 777 icmp6stat.icp6s_outhist[ICMP6_WRUREPLY]++; 778 icmp6_reflect(n, noff); 779 } 780 break; 781 } 782 783 case ICMP6_WRUREPLY: 784 if (code != 0) 785 goto badcode; 786 break; 787 788 case ND_ROUTER_SOLICIT: 789 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routersolicit); 790 if (code != 0) 791 goto badcode; 792 if (icmp6len < sizeof(struct nd_router_solicit)) 793 goto badlen; 794 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 795 /* give up local */ 796 nd6_rs_input(m, off, icmp6len); 797 m = NULL; 798 goto freeit; 799 } 800 nd6_rs_input(n, off, icmp6len); 801 /* m stays. */ 802 break; 803 804 case ND_ROUTER_ADVERT: 805 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routeradvert); 806 if (code != 0) 807 goto badcode; 808 if (icmp6len < sizeof(struct nd_router_advert)) 809 goto badlen; 810 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 811 /* give up local */ 812 nd6_ra_input(m, off, icmp6len); 813 m = NULL; 814 goto freeit; 815 } 816 nd6_ra_input(n, off, icmp6len); 817 /* m stays. */ 818 break; 819 820 case ND_NEIGHBOR_SOLICIT: 821 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighborsolicit); 822 if (code != 0) 823 goto badcode; 824 if (icmp6len < sizeof(struct nd_neighbor_solicit)) 825 goto badlen; 826 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 827 /* give up local */ 828 nd6_ns_input(m, off, icmp6len); 829 m = NULL; 830 goto freeit; 831 } 832 nd6_ns_input(n, off, icmp6len); 833 /* m stays. */ 834 break; 835 836 case ND_NEIGHBOR_ADVERT: 837 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighboradvert); 838 if (code != 0) 839 goto badcode; 840 if (icmp6len < sizeof(struct nd_neighbor_advert)) 841 goto badlen; 842 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 843 /* give up local */ 844 nd6_na_input(m, off, icmp6len); 845 m = NULL; 846 goto freeit; 847 } 848 nd6_na_input(n, off, icmp6len); 849 /* m stays. */ 850 break; 851 852 case ND_REDIRECT: 853 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_redirect); 854 if (code != 0) 855 goto badcode; 856 if (icmp6len < sizeof(struct nd_redirect)) 857 goto badlen; 858 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 859 /* give up local */ 860 icmp6_redirect_input(m, off); 861 m = NULL; 862 goto freeit; 863 } 864 icmp6_redirect_input(n, off); 865 /* m stays. */ 866 break; 867 868 case ICMP6_ROUTER_RENUMBERING: 869 if (code != ICMP6_ROUTER_RENUMBERING_COMMAND && 870 code != ICMP6_ROUTER_RENUMBERING_RESULT) 871 goto badcode; 872 if (icmp6len < sizeof(struct icmp6_router_renum)) 873 goto badlen; 874 break; 875 876 default: 877 nd6log((LOG_DEBUG, 878 "icmp6_input: unknown type %d(src=%s, dst=%s, ifid=%d)\n", 879 icmp6->icmp6_type, ip6_sprintf(&ip6->ip6_src), 880 ip6_sprintf(&ip6->ip6_dst), 881 m->m_pkthdr.rcvif ? m->m_pkthdr.rcvif->if_index : 0)); 882 if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST) { 883 /* ICMPv6 error: MUST deliver it by spec... */ 884 code = PRC_NCMDS; 885 /* deliver */ 886 } else { 887 /* ICMPv6 informational: MUST not deliver */ 888 break; 889 } 890 deliver: 891 if (icmp6_notify_error(m, off, icmp6len, code)) { 892 /* In this case, m should've been freed. */ 893 return(IPPROTO_DONE); 894 } 895 break; 896 897 badcode: 898 icmp6stat.icp6s_badcode++; 899 break; 900 901 badlen: 902 icmp6stat.icp6s_badlen++; 903 break; 904 } 905 906 /* deliver the packet to appropriate sockets */ 907 icmp6_rip6_input(&m, *offp); 908 909 return IPPROTO_DONE; 910 911 freeit: 912 m_freem(m); 913 return IPPROTO_DONE; 914 } 915 916 static int 917 icmp6_notify_error(m, off, icmp6len, code) 918 struct mbuf *m; 919 int off, icmp6len; 920 { 921 struct icmp6_hdr *icmp6; 922 struct ip6_hdr *eip6; 923 u_int32_t notifymtu; 924 struct sockaddr_in6 icmp6src, icmp6dst; 925 926 if (icmp6len < sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr)) { 927 icmp6stat.icp6s_tooshort++; 928 goto freeit; 929 } 930 #ifndef PULLDOWN_TEST 931 IP6_EXTHDR_CHECK(m, off, 932 sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr), 933 -1); 934 icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off); 935 #else 936 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, 937 sizeof(*icmp6) + sizeof(struct ip6_hdr)); 938 if (icmp6 == NULL) { 939 icmp6stat.icp6s_tooshort++; 940 return(-1); 941 } 942 #endif 943 eip6 = (struct ip6_hdr *)(icmp6 + 1); 944 945 /* Detect the upper level protocol */ 946 { 947 void (*ctlfunc) __P((int, struct sockaddr *, void *)); 948 u_int8_t nxt = eip6->ip6_nxt; 949 int eoff = off + sizeof(struct icmp6_hdr) + 950 sizeof(struct ip6_hdr); 951 struct ip6ctlparam ip6cp; 952 struct in6_addr *finaldst = NULL; 953 int icmp6type = icmp6->icmp6_type; 954 struct ip6_frag *fh; 955 struct ip6_rthdr *rth; 956 struct ip6_rthdr0 *rth0; 957 int rthlen; 958 959 while (1) { /* XXX: should avoid infinite loop explicitly? */ 960 struct ip6_ext *eh; 961 962 switch (nxt) { 963 case IPPROTO_HOPOPTS: 964 case IPPROTO_DSTOPTS: 965 case IPPROTO_AH: 966 #ifndef PULLDOWN_TEST 967 IP6_EXTHDR_CHECK(m, 0, eoff + 968 sizeof(struct ip6_ext), 969 -1); 970 eh = (struct ip6_ext *)(mtod(m, caddr_t) 971 + eoff); 972 #else 973 IP6_EXTHDR_GET(eh, struct ip6_ext *, m, 974 eoff, sizeof(*eh)); 975 if (eh == NULL) { 976 icmp6stat.icp6s_tooshort++; 977 return(-1); 978 } 979 #endif 980 981 if (nxt == IPPROTO_AH) 982 eoff += (eh->ip6e_len + 2) << 2; 983 else 984 eoff += (eh->ip6e_len + 1) << 3; 985 nxt = eh->ip6e_nxt; 986 break; 987 case IPPROTO_ROUTING: 988 /* 989 * When the erroneous packet contains a 990 * routing header, we should examine the 991 * header to determine the final destination. 992 * Otherwise, we can't properly update 993 * information that depends on the final 994 * destination (e.g. path MTU). 995 */ 996 #ifndef PULLDOWN_TEST 997 IP6_EXTHDR_CHECK(m, 0, eoff + sizeof(*rth), 998 -1); 999 rth = (struct ip6_rthdr *)(mtod(m, caddr_t) 1000 + eoff); 1001 #else 1002 IP6_EXTHDR_GET(rth, struct ip6_rthdr *, m, 1003 eoff, sizeof(*rth)); 1004 if (rth == NULL) { 1005 icmp6stat.icp6s_tooshort++; 1006 return(-1); 1007 } 1008 #endif 1009 rthlen = (rth->ip6r_len + 1) << 3; 1010 /* 1011 * XXX: currently there is no 1012 * officially defined type other 1013 * than type-0. 1014 * Note that if the segment left field 1015 * is 0, all intermediate hops must 1016 * have been passed. 1017 */ 1018 if (rth->ip6r_segleft && 1019 rth->ip6r_type == IPV6_RTHDR_TYPE_0) { 1020 int hops; 1021 1022 #ifndef PULLDOWN_TEST 1023 IP6_EXTHDR_CHECK(m, 0, eoff + rthlen, 1024 -1); 1025 rth0 = (struct ip6_rthdr0 *)(mtod(m, caddr_t) + eoff); 1026 #else 1027 IP6_EXTHDR_GET(rth0, 1028 struct ip6_rthdr0 *, m, 1029 eoff, rthlen); 1030 if (rth0 == NULL) { 1031 icmp6stat.icp6s_tooshort++; 1032 return(-1); 1033 } 1034 #endif 1035 /* just ignore a bogus header */ 1036 if ((rth0->ip6r0_len % 2) == 0 && 1037 (hops = rth0->ip6r0_len/2)) 1038 finaldst = (struct in6_addr *)(rth0 + 1) + (hops - 1); 1039 } 1040 eoff += rthlen; 1041 nxt = rth->ip6r_nxt; 1042 break; 1043 case IPPROTO_FRAGMENT: 1044 #ifndef PULLDOWN_TEST 1045 IP6_EXTHDR_CHECK(m, 0, eoff + 1046 sizeof(struct ip6_frag), 1047 -1); 1048 fh = (struct ip6_frag *)(mtod(m, caddr_t) 1049 + eoff); 1050 #else 1051 IP6_EXTHDR_GET(fh, struct ip6_frag *, m, 1052 eoff, sizeof(*fh)); 1053 if (fh == NULL) { 1054 icmp6stat.icp6s_tooshort++; 1055 return(-1); 1056 } 1057 #endif 1058 /* 1059 * Data after a fragment header is meaningless 1060 * unless it is the first fragment, but 1061 * we'll go to the notify label for path MTU 1062 * discovery. 1063 */ 1064 if (fh->ip6f_offlg & IP6F_OFF_MASK) 1065 goto notify; 1066 1067 eoff += sizeof(struct ip6_frag); 1068 nxt = fh->ip6f_nxt; 1069 break; 1070 default: 1071 /* 1072 * This case includes ESP and the No Next 1073 * Header. In such cases going to the notify 1074 * label does not have any meaning 1075 * (i.e. ctlfunc will be NULL), but we go 1076 * anyway since we might have to update 1077 * path MTU information. 1078 */ 1079 goto notify; 1080 } 1081 } 1082 notify: 1083 #ifndef PULLDOWN_TEST 1084 icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off); 1085 #else 1086 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, 1087 sizeof(*icmp6) + sizeof(struct ip6_hdr)); 1088 if (icmp6 == NULL) { 1089 icmp6stat.icp6s_tooshort++; 1090 return(-1); 1091 } 1092 #endif 1093 1094 eip6 = (struct ip6_hdr *)(icmp6 + 1); 1095 bzero(&icmp6dst, sizeof(icmp6dst)); 1096 icmp6dst.sin6_len = sizeof(struct sockaddr_in6); 1097 icmp6dst.sin6_family = AF_INET6; 1098 if (finaldst == NULL) 1099 icmp6dst.sin6_addr = eip6->ip6_dst; 1100 else 1101 icmp6dst.sin6_addr = *finaldst; 1102 icmp6dst.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif, 1103 &icmp6dst.sin6_addr); 1104 #ifndef SCOPEDROUTING 1105 if (in6_embedscope(&icmp6dst.sin6_addr, &icmp6dst, 1106 NULL, NULL)) { 1107 /* should be impossbile */ 1108 nd6log((LOG_DEBUG, 1109 "icmp6_notify_error: in6_embedscope failed\n")); 1110 goto freeit; 1111 } 1112 #endif 1113 1114 /* 1115 * retrieve parameters from the inner IPv6 header, and convert 1116 * them into sockaddr structures. 1117 */ 1118 bzero(&icmp6src, sizeof(icmp6src)); 1119 icmp6src.sin6_len = sizeof(struct sockaddr_in6); 1120 icmp6src.sin6_family = AF_INET6; 1121 icmp6src.sin6_addr = eip6->ip6_src; 1122 icmp6src.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif, 1123 &icmp6src.sin6_addr); 1124 #ifndef SCOPEDROUTING 1125 if (in6_embedscope(&icmp6src.sin6_addr, &icmp6src, 1126 NULL, NULL)) { 1127 /* should be impossbile */ 1128 nd6log((LOG_DEBUG, 1129 "icmp6_notify_error: in6_embedscope failed\n")); 1130 goto freeit; 1131 } 1132 #endif 1133 icmp6src.sin6_flowinfo = 1134 (eip6->ip6_flow & IPV6_FLOWLABEL_MASK); 1135 1136 if (finaldst == NULL) 1137 finaldst = &eip6->ip6_dst; 1138 ip6cp.ip6c_m = m; 1139 ip6cp.ip6c_icmp6 = icmp6; 1140 ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1); 1141 ip6cp.ip6c_off = eoff; 1142 ip6cp.ip6c_finaldst = finaldst; 1143 ip6cp.ip6c_src = &icmp6src; 1144 ip6cp.ip6c_nxt = nxt; 1145 1146 if (icmp6type == ICMP6_PACKET_TOO_BIG) { 1147 notifymtu = ntohl(icmp6->icmp6_mtu); 1148 ip6cp.ip6c_cmdarg = (void *)¬ifymtu; 1149 } 1150 1151 ctlfunc = (void (*) __P((int, struct sockaddr *, void *))) 1152 (inet6sw[ip6_protox[nxt]].pr_ctlinput); 1153 if (ctlfunc) { 1154 (void) (*ctlfunc)(code, (struct sockaddr *)&icmp6dst, 1155 &ip6cp); 1156 } 1157 } 1158 return(0); 1159 1160 freeit: 1161 m_freem(m); 1162 return(-1); 1163 } 1164 1165 void 1166 icmp6_mtudisc_update(ip6cp, validated) 1167 struct ip6ctlparam *ip6cp; 1168 int validated; 1169 { 1170 unsigned long rtcount; 1171 struct icmp6_mtudisc_callback *mc; 1172 struct in6_addr *dst = ip6cp->ip6c_finaldst; 1173 struct icmp6_hdr *icmp6 = ip6cp->ip6c_icmp6; 1174 struct mbuf *m = ip6cp->ip6c_m; /* will be necessary for scope issue */ 1175 u_int mtu = ntohl(icmp6->icmp6_mtu); 1176 struct rtentry *rt = NULL; 1177 struct sockaddr_in6 sin6; 1178 1179 /* 1180 * allow non-validated cases if memory is plenty, to make traffic 1181 * from non-connected pcb happy. 1182 */ 1183 rtcount = rt_timer_count(icmp6_mtudisc_timeout_q); 1184 if (validated) { 1185 if (0 <= icmp6_mtudisc_hiwat && rtcount > icmp6_mtudisc_hiwat) 1186 return; 1187 else if (0 <= icmp6_mtudisc_lowat && 1188 rtcount > icmp6_mtudisc_lowat) { 1189 /* 1190 * XXX nuke a victim, install the new one. 1191 */ 1192 } 1193 } else { 1194 if (0 <= icmp6_mtudisc_lowat && rtcount > icmp6_mtudisc_lowat) 1195 return; 1196 } 1197 1198 bzero(&sin6, sizeof(sin6)); 1199 sin6.sin6_family = PF_INET6; 1200 sin6.sin6_len = sizeof(struct sockaddr_in6); 1201 sin6.sin6_addr = *dst; 1202 /* XXX normally, this won't happen */ 1203 if (IN6_IS_ADDR_LINKLOCAL(dst)) { 1204 sin6.sin6_addr.s6_addr16[1] = 1205 htons(m->m_pkthdr.rcvif->if_index); 1206 } 1207 /* sin6.sin6_scope_id = XXX: should be set if DST is a scoped addr */ 1208 rt = icmp6_mtudisc_clone((struct sockaddr *)&sin6); 1209 1210 if (rt && (rt->rt_flags & RTF_HOST) 1211 && !(rt->rt_rmx.rmx_locks & RTV_MTU)) { 1212 if (mtu < IPV6_MMTU) { 1213 /* xxx */ 1214 rt->rt_rmx.rmx_locks |= RTV_MTU; 1215 } else if (mtu < rt->rt_ifp->if_mtu && 1216 rt->rt_rmx.rmx_mtu > mtu) { 1217 icmp6stat.icp6s_pmtuchg++; 1218 rt->rt_rmx.rmx_mtu = mtu; 1219 } 1220 } 1221 if (rt) { /* XXX: need braces to avoid conflict with else in RTFREE. */ 1222 RTFREE(rt); 1223 } 1224 1225 /* 1226 * Notify protocols that the MTU for this destination 1227 * has changed. 1228 */ 1229 for (mc = LIST_FIRST(&icmp6_mtudisc_callbacks); mc != NULL; 1230 mc = LIST_NEXT(mc, mc_list)) 1231 (*mc->mc_func)(&sin6.sin6_addr); 1232 } 1233 1234 /* 1235 * Process a Node Information Query packet, based on 1236 * draft-ietf-ipngwg-icmp-name-lookups-07. 1237 * 1238 * Spec incompatibilities: 1239 * - IPv6 Subject address handling 1240 * - IPv4 Subject address handling support missing 1241 * - Proxy reply (answer even if it's not for me) 1242 * - joins NI group address at in6_ifattach() time only, does not cope 1243 * with hostname changes by sethostname(3) 1244 */ 1245 #ifndef offsetof /* XXX */ 1246 #define offsetof(type, member) ((size_t)(&((type *)0)->member)) 1247 #endif 1248 static struct mbuf * 1249 ni6_input(m, off) 1250 struct mbuf *m; 1251 int off; 1252 { 1253 struct icmp6_nodeinfo *ni6, *nni6; 1254 struct mbuf *n = NULL; 1255 u_int16_t qtype; 1256 int subjlen; 1257 int replylen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo); 1258 struct ni_reply_fqdn *fqdn; 1259 int addrs; /* for NI_QTYPE_NODEADDR */ 1260 struct ifnet *ifp = NULL; /* for NI_QTYPE_NODEADDR */ 1261 struct sockaddr_in6 sin6; /* double meaning; ip6_dst and subjectaddr */ 1262 struct ip6_hdr *ip6; 1263 int oldfqdn = 0; /* if 1, return pascal string (03 draft) */ 1264 char *subj = NULL; 1265 1266 ip6 = mtod(m, struct ip6_hdr *); 1267 #ifndef PULLDOWN_TEST 1268 ni6 = (struct icmp6_nodeinfo *)(mtod(m, caddr_t) + off); 1269 #else 1270 IP6_EXTHDR_GET(ni6, struct icmp6_nodeinfo *, m, off, sizeof(*ni6)); 1271 if (ni6 == NULL) { 1272 /* m is already reclaimed */ 1273 return NULL; 1274 } 1275 #endif 1276 1277 /* 1278 * Validate IPv6 destination address. 1279 * 1280 * The Responder must discard the Query without further processing 1281 * unless it is one of the Responder's unicast or anycast addresses, or 1282 * a link-local scope multicast address which the Responder has joined. 1283 * [icmp-name-lookups-07, Section 4.] 1284 */ 1285 bzero(&sin6, sizeof(sin6)); 1286 sin6.sin6_family = AF_INET6; 1287 sin6.sin6_len = sizeof(struct sockaddr_in6); 1288 bcopy(&ip6->ip6_dst, &sin6.sin6_addr, sizeof(sin6.sin6_addr)); 1289 /* XXX scopeid */ 1290 if (ifa_ifwithaddr((struct sockaddr *)&sin6)) 1291 ; /* unicast/anycast, fine */ 1292 else if (IN6_IS_ADDR_MC_LINKLOCAL(&sin6.sin6_addr)) 1293 ; /* link-local multicast, fine */ 1294 else 1295 goto bad; 1296 1297 /* validate query Subject field. */ 1298 qtype = ntohs(ni6->ni_qtype); 1299 subjlen = m->m_pkthdr.len - off - sizeof(struct icmp6_nodeinfo); 1300 switch (qtype) { 1301 case NI_QTYPE_NOOP: 1302 case NI_QTYPE_SUPTYPES: 1303 /* 07 draft */ 1304 if (ni6->ni_code == ICMP6_NI_SUBJ_FQDN && subjlen == 0) 1305 break; 1306 /* FALLTHROUGH */ 1307 case NI_QTYPE_FQDN: 1308 case NI_QTYPE_NODEADDR: 1309 switch (ni6->ni_code) { 1310 case ICMP6_NI_SUBJ_IPV6: 1311 #if ICMP6_NI_SUBJ_IPV6 != 0 1312 case 0: 1313 #endif 1314 /* 1315 * backward compatibility - try to accept 03 draft 1316 * format, where no Subject is present. 1317 */ 1318 if (qtype == NI_QTYPE_FQDN && ni6->ni_code == 0 && 1319 subjlen == 0) { 1320 oldfqdn++; 1321 break; 1322 } 1323 #if ICMP6_NI_SUBJ_IPV6 != 0 1324 if (ni6->ni_code != ICMP6_NI_SUBJ_IPV6) 1325 goto bad; 1326 #endif 1327 1328 if (subjlen != sizeof(sin6.sin6_addr)) 1329 goto bad; 1330 1331 /* 1332 * Validate Subject address. 1333 * 1334 * Not sure what exactly "address belongs to the node" 1335 * means in the spec, is it just unicast, or what? 1336 * 1337 * At this moment we consider Subject address as 1338 * "belong to the node" if the Subject address equals 1339 * to the IPv6 destination address; validation for 1340 * IPv6 destination address should have done enough 1341 * check for us. 1342 * 1343 * We do not do proxy at this moment. 1344 */ 1345 /* m_pulldown instead of copy? */ 1346 m_copydata(m, off + sizeof(struct icmp6_nodeinfo), 1347 subjlen, (caddr_t)&sin6.sin6_addr); 1348 /* XXX kame scope hack */ 1349 if (IN6_IS_SCOPE_LINKLOCAL(&sin6.sin6_addr)) { 1350 if ((m->m_flags & M_PKTHDR) != 0 && 1351 m->m_pkthdr.rcvif) { 1352 sin6.sin6_addr.s6_addr16[1] = 1353 htons(m->m_pkthdr.rcvif->if_index); 1354 } 1355 } 1356 subj = (char *)&sin6; 1357 if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &sin6.sin6_addr)) 1358 break; 1359 1360 /* 1361 * XXX if we are to allow other cases, we should really 1362 * be careful about scope here. 1363 * basically, we should disallow queries toward IPv6 1364 * destination X with subject Y, if scope(X) > scope(Y). 1365 * if we allow scope(X) > scope(Y), it will result in 1366 * information leakage across scope boundary. 1367 */ 1368 goto bad; 1369 1370 case ICMP6_NI_SUBJ_FQDN: 1371 /* 1372 * Validate Subject name with gethostname(3). 1373 * 1374 * The behavior may need some debate, since: 1375 * - we are not sure if the node has FQDN as 1376 * hostname (returned by gethostname(3)). 1377 * - the code does wildcard match for truncated names. 1378 * however, we are not sure if we want to perform 1379 * wildcard match, if gethostname(3) side has 1380 * truncated hostname. 1381 */ 1382 n = ni6_nametodns(hostname, hostnamelen, 0); 1383 if (!n || n->m_next || n->m_len == 0) 1384 goto bad; 1385 IP6_EXTHDR_GET(subj, char *, m, 1386 off + sizeof(struct icmp6_nodeinfo), subjlen); 1387 if (subj == NULL) 1388 goto bad; 1389 if (!ni6_dnsmatch(subj, subjlen, mtod(n, const char *), 1390 n->m_len)) { 1391 goto bad; 1392 } 1393 m_freem(n); 1394 n = NULL; 1395 break; 1396 1397 case ICMP6_NI_SUBJ_IPV4: /* XXX: to be implemented? */ 1398 default: 1399 goto bad; 1400 } 1401 break; 1402 } 1403 1404 /* refuse based on configuration. XXX ICMP6_NI_REFUSED? */ 1405 switch (qtype) { 1406 case NI_QTYPE_FQDN: 1407 if ((icmp6_nodeinfo & 1) == 0) 1408 goto bad; 1409 break; 1410 case NI_QTYPE_NODEADDR: 1411 if ((icmp6_nodeinfo & 2) == 0) 1412 goto bad; 1413 break; 1414 } 1415 1416 /* guess reply length */ 1417 switch (qtype) { 1418 case NI_QTYPE_NOOP: 1419 break; /* no reply data */ 1420 case NI_QTYPE_SUPTYPES: 1421 replylen += sizeof(u_int32_t); 1422 break; 1423 case NI_QTYPE_FQDN: 1424 /* XXX will append an mbuf */ 1425 replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_namelen); 1426 break; 1427 case NI_QTYPE_NODEADDR: 1428 addrs = ni6_addrs(ni6, m, &ifp, subj); 1429 if ((replylen += addrs * (sizeof(struct in6_addr) + 1430 sizeof(u_int32_t))) > MCLBYTES) 1431 replylen = MCLBYTES; /* XXX: will truncate pkt later */ 1432 break; 1433 default: 1434 /* 1435 * XXX: We must return a reply with the ICMP6 code 1436 * `unknown Qtype' in this case. However we regard the case 1437 * as an FQDN query for backward compatibility. 1438 * Older versions set a random value to this field, 1439 * so it rarely varies in the defined qtypes. 1440 * But the mechanism is not reliable... 1441 * maybe we should obsolete older versions. 1442 */ 1443 qtype = NI_QTYPE_FQDN; 1444 /* XXX will append an mbuf */ 1445 replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_namelen); 1446 oldfqdn++; 1447 break; 1448 } 1449 1450 /* allocate an mbuf to reply. */ 1451 MGETHDR(n, M_DONTWAIT, m->m_type); 1452 if (n == NULL) { 1453 m_freem(m); 1454 return(NULL); 1455 } 1456 M_COPY_PKTHDR(n, m); /* just for recvif */ 1457 if (replylen > MHLEN) { 1458 if (replylen > MCLBYTES) { 1459 /* 1460 * XXX: should we try to allocate more? But MCLBYTES 1461 * is probably much larger than IPV6_MMTU... 1462 */ 1463 goto bad; 1464 } 1465 MCLGET(n, M_DONTWAIT); 1466 if ((n->m_flags & M_EXT) == 0) { 1467 goto bad; 1468 } 1469 } 1470 n->m_pkthdr.len = n->m_len = replylen; 1471 1472 /* copy mbuf header and IPv6 + Node Information base headers */ 1473 bcopy(mtod(m, caddr_t), mtod(n, caddr_t), sizeof(struct ip6_hdr)); 1474 nni6 = (struct icmp6_nodeinfo *)(mtod(n, struct ip6_hdr *) + 1); 1475 bcopy((caddr_t)ni6, (caddr_t)nni6, sizeof(struct icmp6_nodeinfo)); 1476 1477 /* qtype dependent procedure */ 1478 switch (qtype) { 1479 case NI_QTYPE_NOOP: 1480 nni6->ni_code = ICMP6_NI_SUCCESS; 1481 nni6->ni_flags = 0; 1482 break; 1483 case NI_QTYPE_SUPTYPES: 1484 { 1485 u_int32_t v; 1486 nni6->ni_code = ICMP6_NI_SUCCESS; 1487 nni6->ni_flags = htons(0x0000); /* raw bitmap */ 1488 /* supports NOOP, SUPTYPES, FQDN, and NODEADDR */ 1489 v = (u_int32_t)htonl(0x0000000f); 1490 bcopy(&v, nni6 + 1, sizeof(u_int32_t)); 1491 break; 1492 } 1493 case NI_QTYPE_FQDN: 1494 nni6->ni_code = ICMP6_NI_SUCCESS; 1495 fqdn = (struct ni_reply_fqdn *)(mtod(n, caddr_t) + 1496 sizeof(struct ip6_hdr) + 1497 sizeof(struct icmp6_nodeinfo)); 1498 nni6->ni_flags = 0; /* XXX: meaningless TTL */ 1499 fqdn->ni_fqdn_ttl = 0; /* ditto. */ 1500 /* 1501 * XXX do we really have FQDN in variable "hostname"? 1502 */ 1503 n->m_next = ni6_nametodns(hostname, hostnamelen, oldfqdn); 1504 if (n->m_next == NULL) 1505 goto bad; 1506 /* XXX we assume that n->m_next is not a chain */ 1507 if (n->m_next->m_next != NULL) 1508 goto bad; 1509 n->m_pkthdr.len += n->m_next->m_len; 1510 break; 1511 case NI_QTYPE_NODEADDR: 1512 { 1513 int lenlim, copied; 1514 1515 nni6->ni_code = ICMP6_NI_SUCCESS; 1516 n->m_pkthdr.len = n->m_len = 1517 sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo); 1518 lenlim = M_TRAILINGSPACE(n); 1519 copied = ni6_store_addrs(ni6, nni6, ifp, lenlim); 1520 /* XXX: reset mbuf length */ 1521 n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) + 1522 sizeof(struct icmp6_nodeinfo) + copied; 1523 break; 1524 } 1525 default: 1526 break; /* XXX impossible! */ 1527 } 1528 1529 nni6->ni_type = ICMP6_NI_REPLY; 1530 m_freem(m); 1531 return(n); 1532 1533 bad: 1534 m_freem(m); 1535 if (n) 1536 m_freem(n); 1537 return(NULL); 1538 } 1539 #undef hostnamelen 1540 1541 /* 1542 * make a mbuf with DNS-encoded string. no compression support. 1543 * 1544 * XXX names with less than 2 dots (like "foo" or "foo.section") will be 1545 * treated as truncated name (two \0 at the end). this is a wild guess. 1546 */ 1547 static struct mbuf * 1548 ni6_nametodns(name, namelen, old) 1549 const char *name; 1550 int namelen; 1551 int old; /* return pascal string if non-zero */ 1552 { 1553 struct mbuf *m; 1554 char *cp, *ep; 1555 const char *p, *q; 1556 int i, len, nterm; 1557 1558 if (old) 1559 len = namelen + 1; 1560 else 1561 len = MCLBYTES; 1562 1563 /* because MAXHOSTNAMELEN is usually 256, we use cluster mbuf */ 1564 MGET(m, M_DONTWAIT, MT_DATA); 1565 if (m && len > MLEN) { 1566 MCLGET(m, M_DONTWAIT); 1567 if ((m->m_flags & M_EXT) == 0) 1568 goto fail; 1569 } 1570 if (!m) 1571 goto fail; 1572 m->m_next = NULL; 1573 1574 if (old) { 1575 m->m_len = len; 1576 *mtod(m, char *) = namelen; 1577 bcopy(name, mtod(m, char *) + 1, namelen); 1578 return m; 1579 } else { 1580 m->m_len = 0; 1581 cp = mtod(m, char *); 1582 ep = mtod(m, char *) + M_TRAILINGSPACE(m); 1583 1584 /* if not certain about my name, return empty buffer */ 1585 if (namelen == 0) 1586 return m; 1587 1588 /* 1589 * guess if it looks like shortened hostname, or FQDN. 1590 * shortened hostname needs two trailing "\0". 1591 */ 1592 i = 0; 1593 for (p = name; p < name + namelen; p++) { 1594 if (*p && *p == '.') 1595 i++; 1596 } 1597 if (i < 2) 1598 nterm = 2; 1599 else 1600 nterm = 1; 1601 1602 p = name; 1603 while (cp < ep && p < name + namelen) { 1604 i = 0; 1605 for (q = p; q < name + namelen && *q && *q != '.'; q++) 1606 i++; 1607 /* result does not fit into mbuf */ 1608 if (cp + i + 1 >= ep) 1609 goto fail; 1610 /* 1611 * DNS label length restriction, RFC1035 page 8. 1612 * "i == 0" case is included here to avoid returning 1613 * 0-length label on "foo..bar". 1614 */ 1615 if (i <= 0 || i >= 64) 1616 goto fail; 1617 *cp++ = i; 1618 bcopy(p, cp, i); 1619 cp += i; 1620 p = q; 1621 if (p < name + namelen && *p == '.') 1622 p++; 1623 } 1624 /* termination */ 1625 if (cp + nterm >= ep) 1626 goto fail; 1627 while (nterm-- > 0) 1628 *cp++ = '\0'; 1629 m->m_len = cp - mtod(m, char *); 1630 return m; 1631 } 1632 1633 panic("should not reach here"); 1634 /* NOTREACHED */ 1635 1636 fail: 1637 if (m) 1638 m_freem(m); 1639 return NULL; 1640 } 1641 1642 /* 1643 * check if two DNS-encoded string matches. takes care of truncated 1644 * form (with \0\0 at the end). no compression support. 1645 * XXX upper/lowercase match (see RFC2065) 1646 */ 1647 static int 1648 ni6_dnsmatch(a, alen, b, blen) 1649 const char *a; 1650 int alen; 1651 const char *b; 1652 int blen; 1653 { 1654 const char *a0, *b0; 1655 int l; 1656 1657 /* simplest case - need validation? */ 1658 if (alen == blen && bcmp(a, b, alen) == 0) 1659 return 1; 1660 1661 a0 = a; 1662 b0 = b; 1663 1664 /* termination is mandatory */ 1665 if (alen < 2 || blen < 2) 1666 return 0; 1667 if (a0[alen - 1] != '\0' || b0[blen - 1] != '\0') 1668 return 0; 1669 alen--; 1670 blen--; 1671 1672 while (a - a0 < alen && b - b0 < blen) { 1673 if (a - a0 + 1 > alen || b - b0 + 1 > blen) 1674 return 0; 1675 1676 if ((signed char)a[0] < 0 || (signed char)b[0] < 0) 1677 return 0; 1678 /* we don't support compression yet */ 1679 if (a[0] >= 64 || b[0] >= 64) 1680 return 0; 1681 1682 /* truncated case */ 1683 if (a[0] == 0 && a - a0 == alen - 1) 1684 return 1; 1685 if (b[0] == 0 && b - b0 == blen - 1) 1686 return 1; 1687 if (a[0] == 0 || b[0] == 0) 1688 return 0; 1689 1690 if (a[0] != b[0]) 1691 return 0; 1692 l = a[0]; 1693 if (a - a0 + 1 + l > alen || b - b0 + 1 + l > blen) 1694 return 0; 1695 if (bcmp(a + 1, b + 1, l) != 0) 1696 return 0; 1697 1698 a += 1 + l; 1699 b += 1 + l; 1700 } 1701 1702 if (a - a0 == alen && b - b0 == blen) 1703 return 1; 1704 else 1705 return 0; 1706 } 1707 1708 /* 1709 * calculate the number of addresses to be returned in the node info reply. 1710 */ 1711 static int 1712 ni6_addrs(ni6, m, ifpp, subj) 1713 struct icmp6_nodeinfo *ni6; 1714 struct mbuf *m; 1715 struct ifnet **ifpp; 1716 char *subj; 1717 { 1718 struct ifnet *ifp; 1719 struct in6_ifaddr *ifa6; 1720 struct ifaddr *ifa; 1721 struct sockaddr_in6 *subj_ip6 = NULL; /* XXX pedant */ 1722 int addrs = 0, addrsofif, iffound = 0; 1723 int niflags = ni6->ni_flags; 1724 1725 if ((niflags & NI_NODEADDR_FLAG_ALL) == 0) { 1726 switch (ni6->ni_code) { 1727 case ICMP6_NI_SUBJ_IPV6: 1728 if (subj == NULL) /* must be impossible... */ 1729 return(0); 1730 subj_ip6 = (struct sockaddr_in6 *)subj; 1731 break; 1732 default: 1733 /* 1734 * XXX: we only support IPv6 subject address for 1735 * this Qtype. 1736 */ 1737 return(0); 1738 } 1739 } 1740 1741 for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list)) 1742 { 1743 addrsofif = 0; 1744 for (ifa = ifp->if_addrlist.tqh_first; ifa; 1745 ifa = ifa->ifa_list.tqe_next) 1746 { 1747 if (ifa->ifa_addr->sa_family != AF_INET6) 1748 continue; 1749 ifa6 = (struct in6_ifaddr *)ifa; 1750 1751 if ((niflags & NI_NODEADDR_FLAG_ALL) == 0 && 1752 IN6_ARE_ADDR_EQUAL(&subj_ip6->sin6_addr, 1753 &ifa6->ia_addr.sin6_addr)) 1754 iffound = 1; 1755 1756 /* 1757 * IPv4-mapped addresses can only be returned by a 1758 * Node Information proxy, since they represent 1759 * addresses of IPv4-only nodes, which perforce do 1760 * not implement this protocol. 1761 * [icmp-name-lookups-07, Section 5.4] 1762 * So we don't support NI_NODEADDR_FLAG_COMPAT in 1763 * this function at this moment. 1764 */ 1765 1766 /* What do we have to do about ::1? */ 1767 switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) { 1768 case IPV6_ADDR_SCOPE_LINKLOCAL: 1769 if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0) 1770 continue; 1771 break; 1772 case IPV6_ADDR_SCOPE_SITELOCAL: 1773 if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0) 1774 continue; 1775 break; 1776 case IPV6_ADDR_SCOPE_GLOBAL: 1777 if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0) 1778 continue; 1779 break; 1780 default: 1781 continue; 1782 } 1783 1784 /* 1785 * check if anycast is okay. 1786 * XXX: just experimental. not in the spec. 1787 */ 1788 if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 && 1789 (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0) 1790 continue; /* we need only unicast addresses */ 1791 1792 addrsofif++; /* count the address */ 1793 } 1794 if (iffound) { 1795 *ifpp = ifp; 1796 return(addrsofif); 1797 } 1798 1799 addrs += addrsofif; 1800 } 1801 1802 return(addrs); 1803 } 1804 1805 static int 1806 ni6_store_addrs(ni6, nni6, ifp0, resid) 1807 struct icmp6_nodeinfo *ni6, *nni6; 1808 struct ifnet *ifp0; 1809 int resid; 1810 { 1811 struct ifnet *ifp = ifp0 ? ifp0 : TAILQ_FIRST(&ifnet); 1812 struct in6_ifaddr *ifa6; 1813 struct ifaddr *ifa; 1814 struct ifnet *ifp_dep = NULL; 1815 int copied = 0, allow_deprecated = 0; 1816 u_char *cp = (u_char *)(nni6 + 1); 1817 int niflags = ni6->ni_flags; 1818 u_int32_t ltime; 1819 long time_second = time.tv_sec; 1820 1821 if (ifp0 == NULL && !(niflags & NI_NODEADDR_FLAG_ALL)) 1822 return(0); /* needless to copy */ 1823 1824 again: 1825 1826 for (; ifp; ifp = TAILQ_NEXT(ifp, if_list)) 1827 { 1828 for (ifa = ifp->if_addrlist.tqh_first; ifa; 1829 ifa = ifa->ifa_list.tqe_next) 1830 { 1831 if (ifa->ifa_addr->sa_family != AF_INET6) 1832 continue; 1833 ifa6 = (struct in6_ifaddr *)ifa; 1834 1835 if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) != 0 && 1836 allow_deprecated == 0) { 1837 /* 1838 * prefererred address should be put before 1839 * deprecated addresses. 1840 */ 1841 1842 /* record the interface for later search */ 1843 if (ifp_dep == NULL) 1844 ifp_dep = ifp; 1845 1846 continue; 1847 } 1848 else if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) == 0 && 1849 allow_deprecated != 0) 1850 continue; /* we now collect deprecated addrs */ 1851 1852 /* What do we have to do about ::1? */ 1853 switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) { 1854 case IPV6_ADDR_SCOPE_LINKLOCAL: 1855 if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0) 1856 continue; 1857 break; 1858 case IPV6_ADDR_SCOPE_SITELOCAL: 1859 if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0) 1860 continue; 1861 break; 1862 case IPV6_ADDR_SCOPE_GLOBAL: 1863 if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0) 1864 continue; 1865 break; 1866 default: 1867 continue; 1868 } 1869 1870 /* 1871 * check if anycast is okay. 1872 * XXX: just experimental. not in the spec. 1873 */ 1874 if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 && 1875 (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0) 1876 continue; 1877 1878 /* now we can copy the address */ 1879 if (resid < sizeof(struct in6_addr) + 1880 sizeof(u_int32_t)) { 1881 /* 1882 * We give up much more copy. 1883 * Set the truncate flag and return. 1884 */ 1885 nni6->ni_flags |= 1886 NI_NODEADDR_FLAG_TRUNCATE; 1887 return(copied); 1888 } 1889 1890 /* 1891 * Set the TTL of the address. 1892 * The TTL value should be one of the following 1893 * according to the specification: 1894 * 1895 * 1. The remaining lifetime of a DHCP lease on the 1896 * address, or 1897 * 2. The remaining Valid Lifetime of a prefix from 1898 * which the address was derived through Stateless 1899 * Autoconfiguration. 1900 * 1901 * Note that we currently do not support stateful 1902 * address configuration by DHCPv6, so the former 1903 * case can't happen. 1904 * 1905 * TTL must be 2^31 > TTL >= 0. 1906 */ 1907 if (ifa6->ia6_lifetime.ia6t_expire == 0) 1908 ltime = ND6_INFINITE_LIFETIME; 1909 else { 1910 if (ifa6->ia6_lifetime.ia6t_expire > 1911 time_second) 1912 ltime = ifa6->ia6_lifetime.ia6t_expire - time_second; 1913 else 1914 ltime = 0; 1915 } 1916 if (ltime > 0x7fffffff) 1917 ltime = 0x7fffffff; 1918 ltime = htonl(ltime); 1919 1920 bcopy(<ime, cp, sizeof(u_int32_t)); 1921 cp += sizeof(u_int32_t); 1922 1923 /* copy the address itself */ 1924 bcopy(&ifa6->ia_addr.sin6_addr, cp, 1925 sizeof(struct in6_addr)); 1926 /* XXX: KAME link-local hack; remove ifindex */ 1927 if (IN6_IS_ADDR_LINKLOCAL(&ifa6->ia_addr.sin6_addr)) 1928 ((struct in6_addr *)cp)->s6_addr16[1] = 0; 1929 cp += sizeof(struct in6_addr); 1930 1931 resid -= (sizeof(struct in6_addr) + sizeof(u_int32_t)); 1932 copied += (sizeof(struct in6_addr) + 1933 sizeof(u_int32_t)); 1934 } 1935 if (ifp0) /* we need search only on the specified IF */ 1936 break; 1937 } 1938 1939 if (allow_deprecated == 0 && ifp_dep != NULL) { 1940 ifp = ifp_dep; 1941 allow_deprecated = 1; 1942 1943 goto again; 1944 } 1945 1946 return(copied); 1947 } 1948 1949 /* 1950 * XXX almost dup'ed code with rip6_input. 1951 */ 1952 static int 1953 icmp6_rip6_input(mp, off) 1954 struct mbuf **mp; 1955 int off; 1956 { 1957 struct mbuf *m = *mp; 1958 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1959 struct in6pcb *in6p; 1960 struct in6pcb *last = NULL; 1961 struct sockaddr_in6 rip6src; 1962 struct icmp6_hdr *icmp6; 1963 struct mbuf *opts = NULL; 1964 1965 #ifndef PULLDOWN_TEST 1966 /* this is assumed to be safe. */ 1967 icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off); 1968 #else 1969 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6)); 1970 if (icmp6 == NULL) { 1971 /* m is already reclaimed */ 1972 return IPPROTO_DONE; 1973 } 1974 #endif 1975 1976 bzero(&rip6src, sizeof(rip6src)); 1977 rip6src.sin6_len = sizeof(struct sockaddr_in6); 1978 rip6src.sin6_family = AF_INET6; 1979 /* KAME hack: recover scopeid */ 1980 (void)in6_recoverscope(&rip6src, &ip6->ip6_src, m->m_pkthdr.rcvif); 1981 1982 for (in6p = rawin6pcb.in6p_next; 1983 in6p != &rawin6pcb; in6p = in6p->in6p_next) 1984 { 1985 if (in6p->in6p_ip6_nxt != IPPROTO_ICMPV6) 1986 continue; 1987 if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) && 1988 !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst)) 1989 continue; 1990 if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) && 1991 !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src)) 1992 continue; 1993 if (in6p->in6p_icmp6filt 1994 && ICMP6_FILTER_WILLBLOCK(icmp6->icmp6_type, 1995 in6p->in6p_icmp6filt)) 1996 continue; 1997 if (last) { 1998 struct mbuf *n; 1999 if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) { 2000 if (last->in6p_flags & IN6P_CONTROLOPTS) 2001 ip6_savecontrol(last, &opts, ip6, n); 2002 /* strip intermediate headers */ 2003 m_adj(n, off); 2004 if (sbappendaddr(&last->in6p_socket->so_rcv, 2005 (struct sockaddr *)&rip6src, 2006 n, opts) == 0) { 2007 /* should notify about lost packet */ 2008 m_freem(n); 2009 if (opts) 2010 m_freem(opts); 2011 } else 2012 sorwakeup(last->in6p_socket); 2013 opts = NULL; 2014 } 2015 } 2016 last = in6p; 2017 } 2018 if (last) { 2019 if (last->in6p_flags & IN6P_CONTROLOPTS) 2020 ip6_savecontrol(last, &opts, ip6, m); 2021 /* strip intermediate headers */ 2022 m_adj(m, off); 2023 if (sbappendaddr(&last->in6p_socket->so_rcv, 2024 (struct sockaddr *)&rip6src, m, opts) == 0) { 2025 m_freem(m); 2026 if (opts) 2027 m_freem(opts); 2028 } else 2029 sorwakeup(last->in6p_socket); 2030 } else { 2031 m_freem(m); 2032 ip6stat.ip6s_delivered--; 2033 } 2034 return IPPROTO_DONE; 2035 } 2036 2037 /* 2038 * Reflect the ip6 packet back to the source. 2039 * OFF points to the icmp6 header, counted from the top of the mbuf. 2040 * 2041 * Note: RFC 1885 required that an echo reply should be truncated if it 2042 * did not fit in with (return) path MTU, and KAME code supported the 2043 * behavior. However, as a clarification after the RFC, this limitation 2044 * was removed in a revised version of the spec, RFC 2463. We had kept the 2045 * old behavior, with a (non-default) ifdef block, while the new version of 2046 * the spec was an internet-draft status, and even after the new RFC was 2047 * published. But it would rather make sense to clean the obsoleted part 2048 * up, and to make the code simpler at this stage. 2049 */ 2050 void 2051 icmp6_reflect(m, off) 2052 struct mbuf *m; 2053 size_t off; 2054 { 2055 struct ip6_hdr *ip6; 2056 struct icmp6_hdr *icmp6; 2057 struct in6_ifaddr *ia; 2058 struct in6_addr t, *src = 0; 2059 int plen; 2060 int type, code; 2061 struct ifnet *outif = NULL; 2062 struct sockaddr_in6 sa6_src, sa6_dst; 2063 2064 /* too short to reflect */ 2065 if (off < sizeof(struct ip6_hdr)) { 2066 nd6log((LOG_DEBUG, 2067 "sanity fail: off=%lx, sizeof(ip6)=%lx in %s:%d\n", 2068 (u_long)off, (u_long)sizeof(struct ip6_hdr), 2069 __FILE__, __LINE__)); 2070 goto bad; 2071 } 2072 2073 /* 2074 * If there are extra headers between IPv6 and ICMPv6, strip 2075 * off that header first. 2076 */ 2077 #ifdef DIAGNOSTIC 2078 if (sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) > MHLEN) 2079 panic("assumption failed in icmp6_reflect"); 2080 #endif 2081 if (off > sizeof(struct ip6_hdr)) { 2082 size_t l; 2083 struct ip6_hdr nip6; 2084 2085 l = off - sizeof(struct ip6_hdr); 2086 m_copydata(m, 0, sizeof(nip6), (caddr_t)&nip6); 2087 m_adj(m, l); 2088 l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr); 2089 if (m->m_len < l) { 2090 if ((m = m_pullup(m, l)) == NULL) 2091 return; 2092 } 2093 bcopy((caddr_t)&nip6, mtod(m, caddr_t), sizeof(nip6)); 2094 } else /* off == sizeof(struct ip6_hdr) */ { 2095 size_t l; 2096 l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr); 2097 if (m->m_len < l) { 2098 if ((m = m_pullup(m, l)) == NULL) 2099 return; 2100 } 2101 } 2102 plen = m->m_pkthdr.len - sizeof(struct ip6_hdr); 2103 ip6 = mtod(m, struct ip6_hdr *); 2104 ip6->ip6_nxt = IPPROTO_ICMPV6; 2105 icmp6 = (struct icmp6_hdr *)(ip6 + 1); 2106 type = icmp6->icmp6_type; /* keep type for statistics */ 2107 code = icmp6->icmp6_code; /* ditto. */ 2108 2109 t = ip6->ip6_dst; 2110 /* 2111 * ip6_input() drops a packet if its src is multicast. 2112 * So, the src is never multicast. 2113 */ 2114 ip6->ip6_dst = ip6->ip6_src; 2115 2116 /* 2117 * XXX: make sure to embed scope zone information, using 2118 * already embedded IDs or the received interface (if any). 2119 * Note that rcvif may be NULL. 2120 * TODO: scoped routing case (XXX). 2121 */ 2122 bzero(&sa6_src, sizeof(sa6_src)); 2123 sa6_src.sin6_family = AF_INET6; 2124 sa6_src.sin6_len = sizeof(sa6_src); 2125 sa6_src.sin6_addr = ip6->ip6_dst; 2126 in6_recoverscope(&sa6_src, &ip6->ip6_dst, m->m_pkthdr.rcvif); 2127 in6_embedscope(&sa6_src.sin6_addr, &sa6_src, NULL, NULL); 2128 ip6->ip6_dst = sa6_src.sin6_addr; 2129 2130 bzero(&sa6_dst, sizeof(sa6_dst)); 2131 sa6_dst.sin6_family = AF_INET6; 2132 sa6_dst.sin6_len = sizeof(sa6_dst); 2133 sa6_dst.sin6_addr = t; 2134 in6_recoverscope(&sa6_dst, &t, m->m_pkthdr.rcvif); 2135 in6_embedscope(&t, &sa6_dst, NULL, NULL); 2136 2137 /* 2138 * If the incoming packet was addressed directly to us (i.e. unicast), 2139 * use dst as the src for the reply. 2140 * The IN6_IFF_NOTREADY case would be VERY rare, but is possible 2141 * (for example) when we encounter an error while forwarding procedure 2142 * destined to a duplicated address of ours. 2143 */ 2144 for (ia = in6_ifaddr; ia; ia = ia->ia_next) 2145 if (IN6_ARE_ADDR_EQUAL(&t, &ia->ia_addr.sin6_addr) && 2146 (ia->ia6_flags & (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY)) == 0) { 2147 src = &t; 2148 break; 2149 } 2150 if (ia == NULL && IN6_IS_ADDR_LINKLOCAL(&t) && (m->m_flags & M_LOOP)) { 2151 /* 2152 * This is the case if the dst is our link-local address 2153 * and the sender is also ourselves. 2154 */ 2155 src = &t; 2156 } 2157 2158 if (src == 0) { 2159 int e; 2160 struct route_in6 ro; 2161 2162 /* 2163 * This case matches to multicasts, our anycast, or unicasts 2164 * that we do not own. Select a source address based on the 2165 * source address of the erroneous packet. 2166 */ 2167 bzero(&ro, sizeof(ro)); 2168 src = in6_selectsrc(&sa6_src, NULL, NULL, &ro, NULL, &e); 2169 if (ro.ro_rt) { /* XXX: see comments in icmp6_mtudisc_update */ 2170 RTFREE(ro.ro_rt); /* XXX: we could use this */ 2171 } 2172 if (src == NULL) { 2173 nd6log((LOG_DEBUG, 2174 "icmp6_reflect: source can't be determined: " 2175 "dst=%s, error=%d\n", 2176 ip6_sprintf(&sa6_src.sin6_addr), e)); 2177 goto bad; 2178 } 2179 } 2180 2181 ip6->ip6_src = *src; 2182 2183 ip6->ip6_flow = 0; 2184 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 2185 ip6->ip6_vfc |= IPV6_VERSION; 2186 ip6->ip6_nxt = IPPROTO_ICMPV6; 2187 if (m->m_pkthdr.rcvif) { 2188 /* XXX: This may not be the outgoing interface */ 2189 ip6->ip6_hlim = nd_ifinfo[m->m_pkthdr.rcvif->if_index].chlim; 2190 } else 2191 ip6->ip6_hlim = ip6_defhlim; 2192 2193 icmp6->icmp6_cksum = 0; 2194 icmp6->icmp6_cksum = in6_cksum(m, IPPROTO_ICMPV6, 2195 sizeof(struct ip6_hdr), plen); 2196 2197 /* 2198 * XXX option handling 2199 */ 2200 2201 m->m_flags &= ~(M_BCAST|M_MCAST); 2202 #ifdef IPSEC 2203 /* Don't lookup socket */ 2204 (void)ipsec_setsocket(m, NULL); 2205 #endif /* IPSEC */ 2206 2207 ip6_output(m, NULL, NULL, 0, NULL, &outif); 2208 2209 if (outif) 2210 icmp6_ifoutstat_inc(outif, type, code); 2211 2212 return; 2213 2214 bad: 2215 m_freem(m); 2216 return; 2217 } 2218 2219 void 2220 icmp6_fasttimo() 2221 { 2222 2223 mld6_fasttimeo(); 2224 } 2225 2226 static const char * 2227 icmp6_redirect_diag(src6, dst6, tgt6) 2228 struct in6_addr *src6; 2229 struct in6_addr *dst6; 2230 struct in6_addr *tgt6; 2231 { 2232 static char buf[1024]; 2233 snprintf(buf, sizeof(buf), "(src=%s dst=%s tgt=%s)", 2234 ip6_sprintf(src6), ip6_sprintf(dst6), ip6_sprintf(tgt6)); 2235 return buf; 2236 } 2237 2238 void 2239 icmp6_redirect_input(m, off) 2240 struct mbuf *m; 2241 int off; 2242 { 2243 struct ifnet *ifp = m->m_pkthdr.rcvif; 2244 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 2245 struct nd_redirect *nd_rd; 2246 int icmp6len = ntohs(ip6->ip6_plen); 2247 char *lladdr = NULL; 2248 int lladdrlen = 0; 2249 u_char *redirhdr = NULL; 2250 int redirhdrlen = 0; 2251 struct rtentry *rt = NULL; 2252 int is_router; 2253 int is_onlink; 2254 struct in6_addr src6 = ip6->ip6_src; 2255 struct in6_addr redtgt6; 2256 struct in6_addr reddst6; 2257 union nd_opts ndopts; 2258 2259 if (!m || !ifp) 2260 return; 2261 2262 /* XXX if we are router, we don't update route by icmp6 redirect */ 2263 if (ip6_forwarding) 2264 goto freeit; 2265 if (!icmp6_rediraccept) 2266 goto freeit; 2267 2268 #ifndef PULLDOWN_TEST 2269 IP6_EXTHDR_CHECK(m, off, icmp6len,); 2270 nd_rd = (struct nd_redirect *)((caddr_t)ip6 + off); 2271 #else 2272 IP6_EXTHDR_GET(nd_rd, struct nd_redirect *, m, off, icmp6len); 2273 if (nd_rd == NULL) { 2274 icmp6stat.icp6s_tooshort++; 2275 return; 2276 } 2277 #endif 2278 redtgt6 = nd_rd->nd_rd_target; 2279 reddst6 = nd_rd->nd_rd_dst; 2280 2281 if (IN6_IS_ADDR_LINKLOCAL(&redtgt6)) 2282 redtgt6.s6_addr16[1] = htons(ifp->if_index); 2283 if (IN6_IS_ADDR_LINKLOCAL(&reddst6)) 2284 reddst6.s6_addr16[1] = htons(ifp->if_index); 2285 2286 /* validation */ 2287 if (!IN6_IS_ADDR_LINKLOCAL(&src6)) { 2288 nd6log((LOG_ERR, 2289 "ICMP6 redirect sent from %s rejected; " 2290 "must be from linklocal\n", ip6_sprintf(&src6))); 2291 goto bad; 2292 } 2293 if (ip6->ip6_hlim != 255) { 2294 nd6log((LOG_ERR, 2295 "ICMP6 redirect sent from %s rejected; " 2296 "hlim=%d (must be 255)\n", 2297 ip6_sprintf(&src6), ip6->ip6_hlim)); 2298 goto bad; 2299 } 2300 { 2301 /* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */ 2302 struct sockaddr_in6 sin6; 2303 struct in6_addr *gw6; 2304 2305 bzero(&sin6, sizeof(sin6)); 2306 sin6.sin6_family = AF_INET6; 2307 sin6.sin6_len = sizeof(struct sockaddr_in6); 2308 bcopy(&reddst6, &sin6.sin6_addr, sizeof(reddst6)); 2309 rt = rtalloc1((struct sockaddr *)&sin6, 0); 2310 if (rt) { 2311 if (rt->rt_gateway == NULL || 2312 rt->rt_gateway->sa_family != AF_INET6) { 2313 nd6log((LOG_ERR, 2314 "ICMP6 redirect rejected; no route " 2315 "with inet6 gateway found for redirect dst: %s\n", 2316 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2317 RTFREE(rt); 2318 goto bad; 2319 } 2320 2321 gw6 = &(((struct sockaddr_in6 *)rt->rt_gateway)->sin6_addr); 2322 if (bcmp(&src6, gw6, sizeof(struct in6_addr)) != 0) { 2323 nd6log((LOG_ERR, 2324 "ICMP6 redirect rejected; " 2325 "not equal to gw-for-src=%s (must be same): " 2326 "%s\n", 2327 ip6_sprintf(gw6), 2328 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2329 RTFREE(rt); 2330 goto bad; 2331 } 2332 } else { 2333 nd6log((LOG_ERR, 2334 "ICMP6 redirect rejected; " 2335 "no route found for redirect dst: %s\n", 2336 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2337 goto bad; 2338 } 2339 RTFREE(rt); 2340 rt = NULL; 2341 } 2342 if (IN6_IS_ADDR_MULTICAST(&reddst6)) { 2343 nd6log((LOG_ERR, 2344 "ICMP6 redirect rejected; " 2345 "redirect dst must be unicast: %s\n", 2346 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2347 goto bad; 2348 } 2349 2350 is_router = is_onlink = 0; 2351 if (IN6_IS_ADDR_LINKLOCAL(&redtgt6)) 2352 is_router = 1; /* router case */ 2353 if (bcmp(&redtgt6, &reddst6, sizeof(redtgt6)) == 0) 2354 is_onlink = 1; /* on-link destination case */ 2355 if (!is_router && !is_onlink) { 2356 nd6log((LOG_ERR, 2357 "ICMP6 redirect rejected; " 2358 "neither router case nor onlink case: %s\n", 2359 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2360 goto bad; 2361 } 2362 /* validation passed */ 2363 2364 icmp6len -= sizeof(*nd_rd); 2365 nd6_option_init(nd_rd + 1, icmp6len, &ndopts); 2366 if (nd6_options(&ndopts) < 0) { 2367 nd6log((LOG_INFO, "icmp6_redirect_input: " 2368 "invalid ND option, rejected: %s\n", 2369 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2370 /* nd6_options have incremented stats */ 2371 goto freeit; 2372 } 2373 2374 if (ndopts.nd_opts_tgt_lladdr) { 2375 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1); 2376 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3; 2377 } 2378 2379 if (ndopts.nd_opts_rh) { 2380 redirhdrlen = ndopts.nd_opts_rh->nd_opt_rh_len; 2381 redirhdr = (u_char *)(ndopts.nd_opts_rh + 1); /* xxx */ 2382 } 2383 2384 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 2385 nd6log((LOG_INFO, 2386 "icmp6_redirect_input: lladdrlen mismatch for %s " 2387 "(if %d, icmp6 packet %d): %s\n", 2388 ip6_sprintf(&redtgt6), ifp->if_addrlen, lladdrlen - 2, 2389 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2390 goto bad; 2391 } 2392 2393 /* RFC 2461 8.3 */ 2394 nd6_cache_lladdr(ifp, &redtgt6, lladdr, lladdrlen, ND_REDIRECT, 2395 is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER); 2396 2397 if (!is_onlink) { /* better router case. perform rtredirect. */ 2398 /* perform rtredirect */ 2399 struct sockaddr_in6 sdst; 2400 struct sockaddr_in6 sgw; 2401 struct sockaddr_in6 ssrc; 2402 unsigned long rtcount; 2403 struct rtentry *newrt = NULL; 2404 2405 /* 2406 * do not install redirect route, if the number of entries 2407 * is too much (> hiwat). note that, the node (= host) will 2408 * work just fine even if we do not install redirect route 2409 * (there will be additional hops, though). 2410 */ 2411 rtcount = rt_timer_count(icmp6_redirect_timeout_q); 2412 if (0 <= icmp6_redirect_hiwat && rtcount > icmp6_redirect_hiwat) 2413 return; 2414 else if (0 <= icmp6_redirect_lowat && 2415 rtcount > icmp6_redirect_lowat) { 2416 /* 2417 * XXX nuke a victim, install the new one. 2418 */ 2419 } 2420 2421 bzero(&sdst, sizeof(sdst)); 2422 bzero(&sgw, sizeof(sgw)); 2423 bzero(&ssrc, sizeof(ssrc)); 2424 sdst.sin6_family = sgw.sin6_family = ssrc.sin6_family = AF_INET6; 2425 sdst.sin6_len = sgw.sin6_len = ssrc.sin6_len = 2426 sizeof(struct sockaddr_in6); 2427 bcopy(&redtgt6, &sgw.sin6_addr, sizeof(struct in6_addr)); 2428 bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr)); 2429 bcopy(&src6, &ssrc.sin6_addr, sizeof(struct in6_addr)); 2430 rtredirect((struct sockaddr *)&sdst, (struct sockaddr *)&sgw, 2431 (struct sockaddr *)NULL, RTF_GATEWAY | RTF_HOST, 2432 (struct sockaddr *)&ssrc, 2433 &newrt); 2434 2435 if (newrt) { 2436 (void)rt_timer_add(newrt, icmp6_redirect_timeout, 2437 icmp6_redirect_timeout_q); 2438 rtfree(newrt); 2439 } 2440 } 2441 /* finally update cached route in each socket via pfctlinput */ 2442 { 2443 struct sockaddr_in6 sdst; 2444 2445 bzero(&sdst, sizeof(sdst)); 2446 sdst.sin6_family = AF_INET6; 2447 sdst.sin6_len = sizeof(struct sockaddr_in6); 2448 bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr)); 2449 pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&sdst); 2450 #ifdef IPSEC 2451 key_sa_routechange((struct sockaddr *)&sdst); 2452 #endif 2453 } 2454 2455 freeit: 2456 m_freem(m); 2457 return; 2458 2459 bad: 2460 icmp6stat.icp6s_badredirect++; 2461 m_freem(m); 2462 } 2463 2464 void 2465 icmp6_redirect_output(m0, rt) 2466 struct mbuf *m0; 2467 struct rtentry *rt; 2468 { 2469 struct ifnet *ifp; /* my outgoing interface */ 2470 struct in6_addr *ifp_ll6; 2471 struct in6_addr *router_ll6; 2472 struct ip6_hdr *sip6; /* m0 as struct ip6_hdr */ 2473 struct mbuf *m = NULL; /* newly allocated one */ 2474 struct ip6_hdr *ip6; /* m as struct ip6_hdr */ 2475 struct nd_redirect *nd_rd; 2476 size_t maxlen; 2477 u_char *p; 2478 struct sockaddr_in6 src_sa; 2479 2480 icmp6_errcount(&icmp6stat.icp6s_outerrhist, ND_REDIRECT, 0); 2481 2482 /* if we are not router, we don't send icmp6 redirect */ 2483 if (!ip6_forwarding || ip6_accept_rtadv) 2484 goto fail; 2485 2486 /* sanity check */ 2487 if (!m0 || !rt || !(rt->rt_flags & RTF_UP) || !(ifp = rt->rt_ifp)) 2488 goto fail; 2489 2490 /* 2491 * Address check: 2492 * the source address must identify a neighbor, and 2493 * the destination address must not be a multicast address 2494 * [RFC 2461, sec 8.2] 2495 */ 2496 sip6 = mtod(m0, struct ip6_hdr *); 2497 bzero(&src_sa, sizeof(src_sa)); 2498 src_sa.sin6_family = AF_INET6; 2499 src_sa.sin6_len = sizeof(src_sa); 2500 src_sa.sin6_addr = sip6->ip6_src; 2501 /* we don't currently use sin6_scope_id, but eventually use it */ 2502 src_sa.sin6_scope_id = in6_addr2scopeid(ifp, &sip6->ip6_src); 2503 if (nd6_is_addr_neighbor(&src_sa, ifp) == 0) 2504 goto fail; 2505 if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst)) 2506 goto fail; /* what should we do here? */ 2507 2508 /* rate limit */ 2509 if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0)) 2510 goto fail; 2511 2512 /* 2513 * Since we are going to append up to 1280 bytes (= IPV6_MMTU), 2514 * we almost always ask for an mbuf cluster for simplicity. 2515 * (MHLEN < IPV6_MMTU is almost always true) 2516 */ 2517 #if IPV6_MMTU >= MCLBYTES 2518 # error assumption failed about IPV6_MMTU and MCLBYTES 2519 #endif 2520 MGETHDR(m, M_DONTWAIT, MT_HEADER); 2521 if (m && IPV6_MMTU >= MHLEN) 2522 MCLGET(m, M_DONTWAIT); 2523 if (!m) 2524 goto fail; 2525 m->m_len = 0; 2526 maxlen = M_TRAILINGSPACE(m); 2527 maxlen = min(IPV6_MMTU, maxlen); 2528 /* just for safety */ 2529 if (maxlen < sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) + 2530 ((sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7)) { 2531 goto fail; 2532 } 2533 2534 { 2535 /* get ip6 linklocal address for ifp(my outgoing interface). */ 2536 struct in6_ifaddr *ia; 2537 if ((ia = in6ifa_ifpforlinklocal(ifp, 2538 IN6_IFF_NOTREADY| 2539 IN6_IFF_ANYCAST)) == NULL) 2540 goto fail; 2541 ifp_ll6 = &ia->ia_addr.sin6_addr; 2542 } 2543 2544 /* get ip6 linklocal address for the router. */ 2545 if (rt->rt_gateway && (rt->rt_flags & RTF_GATEWAY)) { 2546 struct sockaddr_in6 *sin6; 2547 sin6 = (struct sockaddr_in6 *)rt->rt_gateway; 2548 router_ll6 = &sin6->sin6_addr; 2549 if (!IN6_IS_ADDR_LINKLOCAL(router_ll6)) 2550 router_ll6 = (struct in6_addr *)NULL; 2551 } else 2552 router_ll6 = (struct in6_addr *)NULL; 2553 2554 /* ip6 */ 2555 ip6 = mtod(m, struct ip6_hdr *); 2556 ip6->ip6_flow = 0; 2557 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 2558 ip6->ip6_vfc |= IPV6_VERSION; 2559 /* ip6->ip6_plen will be set later */ 2560 ip6->ip6_nxt = IPPROTO_ICMPV6; 2561 ip6->ip6_hlim = 255; 2562 /* ip6->ip6_src must be linklocal addr for my outgoing if. */ 2563 bcopy(ifp_ll6, &ip6->ip6_src, sizeof(struct in6_addr)); 2564 bcopy(&sip6->ip6_src, &ip6->ip6_dst, sizeof(struct in6_addr)); 2565 2566 /* ND Redirect */ 2567 nd_rd = (struct nd_redirect *)(ip6 + 1); 2568 nd_rd->nd_rd_type = ND_REDIRECT; 2569 nd_rd->nd_rd_code = 0; 2570 nd_rd->nd_rd_reserved = 0; 2571 if (rt->rt_flags & RTF_GATEWAY) { 2572 /* 2573 * nd_rd->nd_rd_target must be a link-local address in 2574 * better router cases. 2575 */ 2576 if (!router_ll6) 2577 goto fail; 2578 bcopy(router_ll6, &nd_rd->nd_rd_target, 2579 sizeof(nd_rd->nd_rd_target)); 2580 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst, 2581 sizeof(nd_rd->nd_rd_dst)); 2582 } else { 2583 /* make sure redtgt == reddst */ 2584 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_target, 2585 sizeof(nd_rd->nd_rd_target)); 2586 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst, 2587 sizeof(nd_rd->nd_rd_dst)); 2588 } 2589 2590 p = (u_char *)(nd_rd + 1); 2591 2592 if (!router_ll6) 2593 goto nolladdropt; 2594 2595 { 2596 /* target lladdr option */ 2597 struct rtentry *rt_router = NULL; 2598 int len; 2599 struct sockaddr_dl *sdl; 2600 struct nd_opt_hdr *nd_opt; 2601 char *lladdr; 2602 2603 rt_router = nd6_lookup(router_ll6, 0, ifp); 2604 if (!rt_router) 2605 goto nolladdropt; 2606 len = sizeof(*nd_opt) + ifp->if_addrlen; 2607 len = (len + 7) & ~7; /* round by 8 */ 2608 /* safety check */ 2609 if (len + (p - (u_char *)ip6) > maxlen) 2610 goto nolladdropt; 2611 if (!(rt_router->rt_flags & RTF_GATEWAY) && 2612 (rt_router->rt_flags & RTF_LLINFO) && 2613 (rt_router->rt_gateway->sa_family == AF_LINK) && 2614 (sdl = (struct sockaddr_dl *)rt_router->rt_gateway) && 2615 sdl->sdl_alen) { 2616 nd_opt = (struct nd_opt_hdr *)p; 2617 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR; 2618 nd_opt->nd_opt_len = len >> 3; 2619 lladdr = (char *)(nd_opt + 1); 2620 bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen); 2621 p += len; 2622 } 2623 } 2624 nolladdropt:; 2625 2626 m->m_pkthdr.len = m->m_len = p - (u_char *)ip6; 2627 2628 /* just to be safe */ 2629 if (m0->m_flags & M_DECRYPTED) 2630 goto noredhdropt; 2631 if (p - (u_char *)ip6 > maxlen) 2632 goto noredhdropt; 2633 2634 { 2635 /* redirected header option */ 2636 int len; 2637 struct nd_opt_rd_hdr *nd_opt_rh; 2638 2639 /* 2640 * compute the maximum size for icmp6 redirect header option. 2641 * XXX room for auth header? 2642 */ 2643 len = maxlen - (p - (u_char *)ip6); 2644 len &= ~7; 2645 2646 /* This is just for simplicity. */ 2647 if (m0->m_pkthdr.len != m0->m_len) { 2648 if (m0->m_next) { 2649 m_freem(m0->m_next); 2650 m0->m_next = NULL; 2651 } 2652 m0->m_pkthdr.len = m0->m_len; 2653 } 2654 2655 /* 2656 * Redirected header option spec (RFC2461 4.6.3) talks nothing 2657 * about padding/truncate rule for the original IP packet. 2658 * From the discussion on IPv6imp in Feb 1999, the consensus was: 2659 * - "attach as much as possible" is the goal 2660 * - pad if not aligned (original size can be guessed by original 2661 * ip6 header) 2662 * Following code adds the padding if it is simple enough, 2663 * and truncates if not. 2664 */ 2665 if (m0->m_next || m0->m_pkthdr.len != m0->m_len) 2666 panic("assumption failed in %s:%d\n", __FILE__, __LINE__); 2667 2668 if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) { 2669 /* not enough room, truncate */ 2670 m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh); 2671 } else { 2672 /* enough room, pad or truncate */ 2673 size_t extra; 2674 2675 extra = m0->m_pkthdr.len % 8; 2676 if (extra) { 2677 /* pad if easy enough, truncate if not */ 2678 if (8 - extra <= M_TRAILINGSPACE(m0)) { 2679 /* pad */ 2680 m0->m_len += (8 - extra); 2681 m0->m_pkthdr.len += (8 - extra); 2682 } else { 2683 /* truncate */ 2684 m0->m_pkthdr.len -= extra; 2685 m0->m_len -= extra; 2686 } 2687 } 2688 len = m0->m_pkthdr.len + sizeof(*nd_opt_rh); 2689 m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh); 2690 } 2691 2692 nd_opt_rh = (struct nd_opt_rd_hdr *)p; 2693 bzero(nd_opt_rh, sizeof(*nd_opt_rh)); 2694 nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER; 2695 nd_opt_rh->nd_opt_rh_len = len >> 3; 2696 p += sizeof(*nd_opt_rh); 2697 m->m_pkthdr.len = m->m_len = p - (u_char *)ip6; 2698 2699 /* connect m0 to m */ 2700 m->m_next = m0; 2701 m->m_pkthdr.len = m->m_len + m0->m_len; 2702 } 2703 noredhdropt:; 2704 2705 if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_src)) 2706 sip6->ip6_src.s6_addr16[1] = 0; 2707 if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_dst)) 2708 sip6->ip6_dst.s6_addr16[1] = 0; 2709 #if 0 2710 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src)) 2711 ip6->ip6_src.s6_addr16[1] = 0; 2712 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) 2713 ip6->ip6_dst.s6_addr16[1] = 0; 2714 #endif 2715 if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_target)) 2716 nd_rd->nd_rd_target.s6_addr16[1] = 0; 2717 if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_dst)) 2718 nd_rd->nd_rd_dst.s6_addr16[1] = 0; 2719 2720 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 2721 2722 nd_rd->nd_rd_cksum = 0; 2723 nd_rd->nd_rd_cksum 2724 = in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), ntohs(ip6->ip6_plen)); 2725 2726 /* send the packet to outside... */ 2727 #ifdef IPSEC 2728 /* Don't lookup socket */ 2729 (void)ipsec_setsocket(m, NULL); 2730 #endif /* IPSEC */ 2731 ip6_output(m, NULL, NULL, 0, NULL, NULL); 2732 icmp6_ifstat_inc(ifp, ifs6_out_msg); 2733 icmp6_ifstat_inc(ifp, ifs6_out_redirect); 2734 icmp6stat.icp6s_outhist[ND_REDIRECT]++; 2735 2736 return; 2737 2738 fail: 2739 if (m) 2740 m_freem(m); 2741 if (m0) 2742 m_freem(m0); 2743 } 2744 2745 /* 2746 * ICMPv6 socket option processing. 2747 */ 2748 int 2749 icmp6_ctloutput(op, so, level, optname, mp) 2750 int op; 2751 struct socket *so; 2752 int level, optname; 2753 struct mbuf **mp; 2754 { 2755 int error = 0; 2756 int optlen; 2757 struct in6pcb *in6p = sotoin6pcb(so); 2758 struct mbuf *m = *mp; 2759 2760 optlen = m ? m->m_len : 0; 2761 2762 if (level != IPPROTO_ICMPV6) { 2763 if (op == PRCO_SETOPT && m) 2764 (void)m_free(m); 2765 return EINVAL; 2766 } 2767 2768 switch (op) { 2769 case PRCO_SETOPT: 2770 switch (optname) { 2771 case ICMP6_FILTER: 2772 { 2773 struct icmp6_filter *p; 2774 2775 if (optlen != sizeof(*p)) { 2776 error = EMSGSIZE; 2777 break; 2778 } 2779 p = mtod(m, struct icmp6_filter *); 2780 if (!p || !in6p->in6p_icmp6filt) { 2781 error = EINVAL; 2782 break; 2783 } 2784 bcopy(p, in6p->in6p_icmp6filt, 2785 sizeof(struct icmp6_filter)); 2786 error = 0; 2787 break; 2788 } 2789 2790 default: 2791 error = ENOPROTOOPT; 2792 break; 2793 } 2794 if (m) 2795 (void)m_freem(m); 2796 break; 2797 2798 case PRCO_GETOPT: 2799 switch (optname) { 2800 case ICMP6_FILTER: 2801 { 2802 struct icmp6_filter *p; 2803 2804 if (!in6p->in6p_icmp6filt) { 2805 error = EINVAL; 2806 break; 2807 } 2808 *mp = m = m_get(M_WAIT, MT_SOOPTS); 2809 m->m_len = sizeof(struct icmp6_filter); 2810 p = mtod(m, struct icmp6_filter *); 2811 bcopy(in6p->in6p_icmp6filt, p, 2812 sizeof(struct icmp6_filter)); 2813 error = 0; 2814 break; 2815 } 2816 2817 default: 2818 error = ENOPROTOOPT; 2819 break; 2820 } 2821 break; 2822 } 2823 2824 return(error); 2825 } 2826 2827 /* 2828 * Perform rate limit check. 2829 * Returns 0 if it is okay to send the icmp6 packet. 2830 * Returns 1 if the router SHOULD NOT send this icmp6 packet due to rate 2831 * limitation. 2832 * 2833 * XXX per-destination/type check necessary? 2834 */ 2835 static int 2836 icmp6_ratelimit(dst, type, code) 2837 const struct in6_addr *dst; /* not used at this moment */ 2838 const int type; /* not used at this moment */ 2839 const int code; /* not used at this moment */ 2840 { 2841 int ret; 2842 2843 ret = 0; /* okay to send */ 2844 2845 /* PPS limit */ 2846 if (!ppsratecheck(&icmp6errppslim_last, &icmp6errpps_count, 2847 icmp6errppslim)) { 2848 /* The packet is subject to rate limit */ 2849 ret++; 2850 } 2851 2852 return ret; 2853 } 2854 2855 static struct rtentry * 2856 icmp6_mtudisc_clone(dst) 2857 struct sockaddr *dst; 2858 { 2859 struct rtentry *rt; 2860 int error; 2861 2862 rt = rtalloc1(dst, 1); 2863 if (rt == 0) 2864 return NULL; 2865 2866 /* If we didn't get a host route, allocate one */ 2867 if ((rt->rt_flags & RTF_HOST) == 0) { 2868 struct rtentry *nrt; 2869 2870 error = rtrequest((int) RTM_ADD, dst, 2871 (struct sockaddr *) rt->rt_gateway, 2872 (struct sockaddr *) 0, 2873 RTF_GATEWAY | RTF_HOST | RTF_DYNAMIC, &nrt); 2874 if (error) { 2875 rtfree(rt); 2876 return NULL; 2877 } 2878 nrt->rt_rmx = rt->rt_rmx; 2879 rtfree(rt); 2880 rt = nrt; 2881 } 2882 error = rt_timer_add(rt, icmp6_mtudisc_timeout, 2883 icmp6_mtudisc_timeout_q); 2884 if (error) { 2885 rtfree(rt); 2886 return NULL; 2887 } 2888 2889 return rt; /* caller need to call rtfree() */ 2890 } 2891 2892 static void 2893 icmp6_mtudisc_timeout(rt, r) 2894 struct rtentry *rt; 2895 struct rttimer *r; 2896 { 2897 if (rt == NULL) 2898 panic("icmp6_mtudisc_timeout: bad route to timeout"); 2899 if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) == 2900 (RTF_DYNAMIC | RTF_HOST)) { 2901 rtrequest((int) RTM_DELETE, (struct sockaddr *)rt_key(rt), 2902 rt->rt_gateway, rt_mask(rt), rt->rt_flags, 0); 2903 } else { 2904 if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0) 2905 rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu; 2906 } 2907 } 2908 2909 static void 2910 icmp6_redirect_timeout(rt, r) 2911 struct rtentry *rt; 2912 struct rttimer *r; 2913 { 2914 if (rt == NULL) 2915 panic("icmp6_redirect_timeout: bad route to timeout"); 2916 if ((rt->rt_flags & (RTF_GATEWAY | RTF_DYNAMIC | RTF_HOST)) == 2917 (RTF_GATEWAY | RTF_DYNAMIC | RTF_HOST)) { 2918 rtrequest((int) RTM_DELETE, (struct sockaddr *)rt_key(rt), 2919 rt->rt_gateway, rt_mask(rt), rt->rt_flags, 0); 2920 } 2921 } 2922 2923 int 2924 icmp6_sysctl(name, namelen, oldp, oldlenp, newp, newlen) 2925 int *name; 2926 u_int namelen; 2927 void *oldp; 2928 size_t *oldlenp; 2929 void *newp; 2930 size_t newlen; 2931 { 2932 2933 /* All sysctl names at this level are terminal. */ 2934 if (namelen != 1) 2935 return ENOTDIR; 2936 2937 switch (name[0]) { 2938 2939 case ICMPV6CTL_REDIRACCEPT: 2940 return sysctl_int(oldp, oldlenp, newp, newlen, 2941 &icmp6_rediraccept); 2942 case ICMPV6CTL_REDIRTIMEOUT: 2943 return sysctl_int(oldp, oldlenp, newp, newlen, 2944 &icmp6_redirtimeout); 2945 case ICMPV6CTL_STATS: 2946 return sysctl_rdstruct(oldp, oldlenp, newp, 2947 &icmp6stat, sizeof(icmp6stat)); 2948 case ICMPV6CTL_ND6_PRUNE: 2949 return sysctl_int(oldp, oldlenp, newp, newlen, &nd6_prune); 2950 case ICMPV6CTL_ND6_DELAY: 2951 return sysctl_int(oldp, oldlenp, newp, newlen, &nd6_delay); 2952 case ICMPV6CTL_ND6_UMAXTRIES: 2953 return sysctl_int(oldp, oldlenp, newp, newlen, &nd6_umaxtries); 2954 case ICMPV6CTL_ND6_MMAXTRIES: 2955 return sysctl_int(oldp, oldlenp, newp, newlen, &nd6_mmaxtries); 2956 case ICMPV6CTL_ND6_USELOOPBACK: 2957 return sysctl_int(oldp, oldlenp, newp, newlen, 2958 &nd6_useloopback); 2959 case ICMPV6CTL_NODEINFO: 2960 return sysctl_int(oldp, oldlenp, newp, newlen, &icmp6_nodeinfo); 2961 case ICMPV6CTL_ERRPPSLIMIT: 2962 return sysctl_int(oldp, oldlenp, newp, newlen, &icmp6errppslim); 2963 case ICMPV6CTL_ND6_MAXNUDHINT: 2964 return sysctl_int(oldp, oldlenp, newp, newlen, 2965 &nd6_maxnudhint); 2966 case ICMPV6CTL_MTUDISC_HIWAT: 2967 return sysctl_int(oldp, oldlenp, newp, newlen, 2968 &icmp6_mtudisc_hiwat); 2969 case ICMPV6CTL_MTUDISC_LOWAT: 2970 return sysctl_int(oldp, oldlenp, newp, newlen, 2971 &icmp6_mtudisc_lowat); 2972 case ICMPV6CTL_ND6_DEBUG: 2973 return sysctl_int(oldp, oldlenp, newp, newlen, &nd6_debug); 2974 default: 2975 return ENOPROTOOPT; 2976 } 2977 /* NOTREACHED */ 2978 } 2979