xref: /netbsd-src/sys/netinet6/ip6_input.c (revision ce2c90c7c172d95d2402a5b3d96d8f8e6d138a21)
1 /*	$NetBSD: ip6_input.c,v 1.89 2006/10/12 01:32:39 christos Exp $	*/
2 /*	$KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
62  */
63 
64 #include <sys/cdefs.h>
65 __KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.89 2006/10/12 01:32:39 christos Exp $");
66 
67 #include "opt_inet.h"
68 #include "opt_inet6.h"
69 #include "opt_ipsec.h"
70 #include "opt_pfil_hooks.h"
71 
72 #include <sys/param.h>
73 #include <sys/systm.h>
74 #include <sys/malloc.h>
75 #include <sys/mbuf.h>
76 #include <sys/domain.h>
77 #include <sys/protosw.h>
78 #include <sys/socket.h>
79 #include <sys/socketvar.h>
80 #include <sys/errno.h>
81 #include <sys/time.h>
82 #include <sys/kernel.h>
83 #include <sys/syslog.h>
84 #include <sys/proc.h>
85 #include <sys/sysctl.h>
86 
87 #include <net/if.h>
88 #include <net/if_types.h>
89 #include <net/if_dl.h>
90 #include <net/route.h>
91 #include <net/netisr.h>
92 #ifdef PFIL_HOOKS
93 #include <net/pfil.h>
94 #endif
95 
96 #include <netinet/in.h>
97 #include <netinet/in_systm.h>
98 #ifdef INET
99 #include <netinet/ip.h>
100 #include <netinet/ip_icmp.h>
101 #endif /* INET */
102 #include <netinet/ip6.h>
103 #include <netinet6/in6_var.h>
104 #include <netinet6/ip6_var.h>
105 #include <netinet6/in6_pcb.h>
106 #include <netinet/icmp6.h>
107 #include <netinet6/scope6_var.h>
108 #include <netinet6/in6_ifattach.h>
109 #include <netinet6/nd6.h>
110 
111 #ifdef IPSEC
112 #include <netinet6/ipsec.h>
113 #endif
114 
115 #include <netinet6/ip6protosw.h>
116 
117 #include "faith.h"
118 #include "gif.h"
119 
120 #if NGIF > 0
121 #include <netinet6/in6_gif.h>
122 #endif
123 
124 #include <net/net_osdep.h>
125 
126 extern struct domain inet6domain;
127 
128 u_char ip6_protox[IPPROTO_MAX];
129 static int ip6qmaxlen = IFQ_MAXLEN;
130 struct in6_ifaddr *in6_ifaddr;
131 struct ifqueue ip6intrq;
132 
133 extern struct callout in6_tmpaddrtimer_ch;
134 
135 int ip6_forward_srcrt;			/* XXX */
136 int ip6_sourcecheck;			/* XXX */
137 int ip6_sourcecheck_interval;		/* XXX */
138 
139 #ifdef PFIL_HOOKS
140 struct pfil_head inet6_pfil_hook;
141 #endif
142 
143 struct ip6stat ip6stat;
144 
145 static void ip6_init2 __P((void *));
146 static struct m_tag *ip6_setdstifaddr __P((struct mbuf *, struct in6_ifaddr *));
147 
148 static int ip6_hopopts_input __P((u_int32_t *, u_int32_t *, struct mbuf **, int *));
149 static struct mbuf *ip6_pullexthdr __P((struct mbuf *, size_t, int));
150 
151 /*
152  * IP6 initialization: fill in IP6 protocol switch table.
153  * All protocols not implemented in kernel go to raw IP6 protocol handler.
154  */
155 void
156 ip6_init()
157 {
158 	const struct ip6protosw *pr;
159 	int i;
160 
161 	pr = (const struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW);
162 	if (pr == 0)
163 		panic("ip6_init");
164 	for (i = 0; i < IPPROTO_MAX; i++)
165 		ip6_protox[i] = pr - inet6sw;
166 	for (pr = (const struct ip6protosw *)inet6domain.dom_protosw;
167 	    pr < (const struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++)
168 		if (pr->pr_domain->dom_family == PF_INET6 &&
169 		    pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
170 			ip6_protox[pr->pr_protocol] = pr - inet6sw;
171 	ip6intrq.ifq_maxlen = ip6qmaxlen;
172 	scope6_init();
173 	addrsel_policy_init();
174 	nd6_init();
175 	frag6_init();
176 	ip6_desync_factor = arc4random() % MAX_TEMP_DESYNC_FACTOR;
177 
178 	ip6_init2((void *)0);
179 
180 #ifdef PFIL_HOOKS
181 	/* Register our Packet Filter hook. */
182 	inet6_pfil_hook.ph_type = PFIL_TYPE_AF;
183 	inet6_pfil_hook.ph_af   = AF_INET6;
184 	i = pfil_head_register(&inet6_pfil_hook);
185 	if (i != 0)
186 		printf("ip6_init: WARNING: unable to register pfil hook, "
187 		    "error %d\n", i);
188 #endif /* PFIL_HOOKS */
189 }
190 
191 static void
192 ip6_init2(void *dummy __unused)
193 {
194 
195 	/* nd6_timer_init */
196 	callout_init(&nd6_timer_ch);
197 	callout_reset(&nd6_timer_ch, hz, nd6_timer, NULL);
198 
199 	/* timer for regeneranation of temporary addresses randomize ID */
200 	callout_init(&in6_tmpaddrtimer_ch);
201 	callout_reset(&in6_tmpaddrtimer_ch,
202 		      (ip6_temp_preferred_lifetime - ip6_desync_factor -
203 		       ip6_temp_regen_advance) * hz,
204 		      in6_tmpaddrtimer, NULL);
205 }
206 
207 /*
208  * IP6 input interrupt handling. Just pass the packet to ip6_input.
209  */
210 void
211 ip6intr()
212 {
213 	int s;
214 	struct mbuf *m;
215 
216 	for (;;) {
217 		s = splnet();
218 		IF_DEQUEUE(&ip6intrq, m);
219 		splx(s);
220 		if (m == 0)
221 			return;
222 		/* drop the packet if IPv6 operation is disabled on the IF */
223 		if ((ND_IFINFO(m->m_pkthdr.rcvif)->flags & ND6_IFF_IFDISABLED)) {
224 			m_freem(m);
225 			return;
226 		}
227 		ip6_input(m);
228 	}
229 }
230 
231 extern struct	route_in6 ip6_forward_rt;
232 
233 void
234 ip6_input(m)
235 	struct mbuf *m;
236 {
237 	struct ip6_hdr *ip6;
238 	int off = sizeof(struct ip6_hdr), nest;
239 	u_int32_t plen;
240 	u_int32_t rtalert = ~0;
241 	int nxt, ours = 0;
242 	struct ifnet *deliverifp = NULL;
243 	int srcrt = 0;
244 
245 #ifdef IPSEC
246 	/*
247 	 * should the inner packet be considered authentic?
248 	 * see comment in ah4_input().
249 	 */
250 	m->m_flags &= ~M_AUTHIPHDR;
251 	m->m_flags &= ~M_AUTHIPDGM;
252 #endif
253 
254 	/*
255 	 * make sure we don't have onion peering information into m_tag.
256 	 */
257 	ip6_delaux(m);
258 
259 	/*
260 	 * mbuf statistics
261 	 */
262 	if (m->m_flags & M_EXT) {
263 		if (m->m_next)
264 			ip6stat.ip6s_mext2m++;
265 		else
266 			ip6stat.ip6s_mext1++;
267 	} else {
268 #define M2MMAX	(sizeof(ip6stat.ip6s_m2m)/sizeof(ip6stat.ip6s_m2m[0]))
269 		if (m->m_next) {
270 			if (m->m_flags & M_LOOP) {
271 				ip6stat.ip6s_m2m[lo0ifp->if_index]++; /* XXX */
272 			} else if (m->m_pkthdr.rcvif->if_index < M2MMAX)
273 				ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++;
274 			else
275 				ip6stat.ip6s_m2m[0]++;
276 		} else
277 			ip6stat.ip6s_m1++;
278 #undef M2MMAX
279 	}
280 
281 	in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive);
282 	ip6stat.ip6s_total++;
283 
284 	/*
285 	 * If the IPv6 header is not aligned, slurp it up into a new
286 	 * mbuf with space for link headers, in the event we forward
287 	 * it.  Otherwise, if it is aligned, make sure the entire base
288 	 * IPv6 header is in the first mbuf of the chain.
289 	 */
290 	if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
291 		struct ifnet *inifp = m->m_pkthdr.rcvif;
292 		if ((m = m_copyup(m, sizeof(struct ip6_hdr),
293 				  (max_linkhdr + 3) & ~3)) == NULL) {
294 			/* XXXJRT new stat, please */
295 			ip6stat.ip6s_toosmall++;
296 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
297 			return;
298 		}
299 	} else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
300 		struct ifnet *inifp = m->m_pkthdr.rcvif;
301 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
302 			ip6stat.ip6s_toosmall++;
303 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
304 			return;
305 		}
306 	}
307 
308 	ip6 = mtod(m, struct ip6_hdr *);
309 
310 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
311 		ip6stat.ip6s_badvers++;
312 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
313 		goto bad;
314 	}
315 
316 #ifdef PFIL_HOOKS
317 	/*
318 	 * Run through list of hooks for input packets.  If there are any
319 	 * filters which require that additional packets in the flow are
320 	 * not fast-forwarded, they must clear the M_CANFASTFWD flag.
321 	 * Note that filters must _never_ set this flag, as another filter
322 	 * in the list may have previously cleared it.
323 	 */
324 	/*
325 	 * let ipfilter look at packet on the wire,
326 	 * not the decapsulated packet.
327 	 */
328 #ifdef IPSEC
329 	if (!ipsec_getnhist(m))
330 #else
331 	if (1)
332 #endif
333 	{
334 		struct in6_addr odst;
335 
336 		odst = ip6->ip6_dst;
337 		if (pfil_run_hooks(&inet6_pfil_hook, &m, m->m_pkthdr.rcvif,
338 				   PFIL_IN) != 0)
339 			return;
340 		if (m == NULL)
341 			return;
342 		ip6 = mtod(m, struct ip6_hdr *);
343 		srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst);
344 	}
345 #endif /* PFIL_HOOKS */
346 
347 	ip6stat.ip6s_nxthist[ip6->ip6_nxt]++;
348 
349 #ifdef ALTQ
350 	if (altq_input != NULL && (*altq_input)(m, AF_INET6) == 0) {
351 		/* packet is dropped by traffic conditioner */
352 		return;
353 	}
354 #endif
355 
356 	/*
357 	 * Check against address spoofing/corruption.
358 	 */
359 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) ||
360 	    IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) {
361 		/*
362 		 * XXX: "badscope" is not very suitable for a multicast source.
363 		 */
364 		ip6stat.ip6s_badscope++;
365 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
366 		goto bad;
367 	}
368 	/*
369 	 * The following check is not documented in specs.  A malicious
370 	 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
371 	 * and bypass security checks (act as if it was from 127.0.0.1 by using
372 	 * IPv6 src ::ffff:127.0.0.1).  Be cautious.
373 	 *
374 	 * This check chokes if we are in an SIIT cloud.  As none of BSDs
375 	 * support IPv4-less kernel compilation, we cannot support SIIT
376 	 * environment at all.  So, it makes more sense for us to reject any
377 	 * malicious packets for non-SIIT environment, than try to do a
378 	 * partial support for SIIT environment.
379 	 */
380 	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
381 	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
382 		ip6stat.ip6s_badscope++;
383 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
384 		goto bad;
385 	}
386 #if 0
387 	/*
388 	 * Reject packets with IPv4 compatible addresses (auto tunnel).
389 	 *
390 	 * The code forbids auto tunnel relay case in RFC1933 (the check is
391 	 * stronger than RFC1933).  We may want to re-enable it if mech-xx
392 	 * is revised to forbid relaying case.
393 	 */
394 	if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) ||
395 	    IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) {
396 		ip6stat.ip6s_badscope++;
397 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
398 		goto bad;
399 	}
400 #endif
401 
402 	/*
403 	 * Disambiguate address scope zones (if there is ambiguity).
404 	 * We first make sure that the original source or destination address
405 	 * is not in our internal form for scoped addresses.  Such addresses
406 	 * are not necessarily invalid spec-wise, but we cannot accept them due
407 	 * to the usage conflict.
408 	 * in6_setscope() then also checks and rejects the cases where src or
409 	 * dst are the loopback address and the receiving interface
410 	 * is not loopback.
411 	 */
412 	if (__predict_false(
413 	    m_makewritable(&m, 0, sizeof(struct ip6_hdr), M_DONTWAIT)))
414 		goto bad;
415 	ip6 = mtod(m, struct ip6_hdr *);
416 	if (in6_clearscope(&ip6->ip6_src) || in6_clearscope(&ip6->ip6_dst)) {
417 		ip6stat.ip6s_badscope++; /* XXX */
418 		goto bad;
419 	}
420 	if (in6_setscope(&ip6->ip6_src, m->m_pkthdr.rcvif, NULL) ||
421 	    in6_setscope(&ip6->ip6_dst, m->m_pkthdr.rcvif, NULL)) {
422 		ip6stat.ip6s_badscope++;
423 		goto bad;
424 	}
425 
426 	/*
427 	 * Multicast check
428 	 */
429 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
430 	  	struct	in6_multi *in6m = 0;
431 
432 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast);
433 		/*
434 		 * See if we belong to the destination multicast group on the
435 		 * arrival interface.
436 		 */
437 		IN6_LOOKUP_MULTI(ip6->ip6_dst, m->m_pkthdr.rcvif, in6m);
438 		if (in6m)
439 			ours = 1;
440 		else if (!ip6_mrouter) {
441 			ip6stat.ip6s_notmember++;
442 			ip6stat.ip6s_cantforward++;
443 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
444 			goto bad;
445 		}
446 		deliverifp = m->m_pkthdr.rcvif;
447 		goto hbhcheck;
448 	}
449 
450 	/*
451 	 *  Unicast check
452 	 */
453 	if (ip6_forward_rt.ro_rt != NULL &&
454 	    (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) != 0 &&
455 	    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
456 	    &((struct sockaddr_in6 *)(&ip6_forward_rt.ro_dst))->sin6_addr))
457 		ip6stat.ip6s_forward_cachehit++;
458 	else {
459 		struct sockaddr_in6 *dst6;
460 
461 		if (ip6_forward_rt.ro_rt) {
462 			/* route is down or destination is different */
463 			ip6stat.ip6s_forward_cachemiss++;
464 			RTFREE(ip6_forward_rt.ro_rt);
465 			ip6_forward_rt.ro_rt = 0;
466 		}
467 
468 		bzero(&ip6_forward_rt.ro_dst, sizeof(struct sockaddr_in6));
469 		dst6 = (struct sockaddr_in6 *)&ip6_forward_rt.ro_dst;
470 		dst6->sin6_len = sizeof(struct sockaddr_in6);
471 		dst6->sin6_family = AF_INET6;
472 		dst6->sin6_addr = ip6->ip6_dst;
473 
474 		rtalloc((struct route *)&ip6_forward_rt);
475 	}
476 
477 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key))
478 
479 	/*
480 	 * Accept the packet if the forwarding interface to the destination
481 	 * according to the routing table is the loopback interface,
482 	 * unless the associated route has a gateway.
483 	 * Note that this approach causes to accept a packet if there is a
484 	 * route to the loopback interface for the destination of the packet.
485 	 * But we think it's even useful in some situations, e.g. when using
486 	 * a special daemon which wants to intercept the packet.
487 	 */
488 	if (ip6_forward_rt.ro_rt &&
489 	    (ip6_forward_rt.ro_rt->rt_flags &
490 	     (RTF_HOST|RTF_GATEWAY)) == RTF_HOST &&
491 	    !(ip6_forward_rt.ro_rt->rt_flags & RTF_CLONED) &&
492 #if 0
493 	    /*
494 	     * The check below is redundant since the comparison of
495 	     * the destination and the key of the rtentry has
496 	     * already done through looking up the routing table.
497 	     */
498 	    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
499 	    &rt6_key(ip6_forward_rt.ro_rt)->sin6_addr) &&
500 #endif
501 	    ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_LOOP) {
502 		struct in6_ifaddr *ia6 =
503 			(struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa;
504 		if (ia6->ia6_flags & IN6_IFF_ANYCAST)
505 			m->m_flags |= M_ANYCAST6;
506 		/*
507 		 * packets to a tentative, duplicated, or somehow invalid
508 		 * address must not be accepted.
509 		 */
510 		if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) {
511 			/* this address is ready */
512 			ours = 1;
513 			deliverifp = ia6->ia_ifp;	/* correct? */
514 			goto hbhcheck;
515 		} else {
516 			/* address is not ready, so discard the packet. */
517 			nd6log((LOG_INFO,
518 			    "ip6_input: packet to an unready address %s->%s\n",
519 			    ip6_sprintf(&ip6->ip6_src),
520 			    ip6_sprintf(&ip6->ip6_dst)));
521 
522 			goto bad;
523 		}
524 	}
525 
526 	/*
527 	 * FAITH (Firewall Aided Internet Translator)
528 	 */
529 #if defined(NFAITH) && 0 < NFAITH
530 	if (ip6_keepfaith) {
531 		if (ip6_forward_rt.ro_rt && ip6_forward_rt.ro_rt->rt_ifp &&
532 		    ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) {
533 			/* XXX do we need more sanity checks? */
534 			ours = 1;
535 			deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /* faith */
536 			goto hbhcheck;
537 		}
538 	}
539 #endif
540 
541 #if 0
542     {
543 	/*
544 	 * Last resort: check in6_ifaddr for incoming interface.
545 	 * The code is here until I update the "goto ours hack" code above
546 	 * working right.
547 	 */
548 	struct ifaddr *ifa;
549 	for (ifa = m->m_pkthdr.rcvif->if_addrlist.tqh_first;
550 	     ifa;
551 	     ifa = ifa->ifa_list.tqe_next) {
552 		if (ifa->ifa_addr == NULL)
553 			continue;	/* just for safety */
554 		if (ifa->ifa_addr->sa_family != AF_INET6)
555 			continue;
556 		if (IN6_ARE_ADDR_EQUAL(IFA_IN6(ifa), &ip6->ip6_dst)) {
557 			ours = 1;
558 			deliverifp = ifa->ifa_ifp;
559 			goto hbhcheck;
560 		}
561 	}
562     }
563 #endif
564 
565 	/*
566 	 * Now there is no reason to process the packet if it's not our own
567 	 * and we're not a router.
568 	 */
569 	if (!ip6_forwarding) {
570 		ip6stat.ip6s_cantforward++;
571 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
572 		goto bad;
573 	}
574 
575   hbhcheck:
576 	/*
577 	 * record address information into m_tag, if we don't have one yet.
578 	 * note that we are unable to record it, if the address is not listed
579 	 * as our interface address (e.g. multicast addresses, addresses
580 	 * within FAITH prefixes and such).
581 	 */
582 	if (deliverifp && !ip6_getdstifaddr(m)) {
583 		struct in6_ifaddr *ia6;
584 
585 		ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
586 		if (ia6) {
587 			if (!ip6_setdstifaddr(m, ia6)) {
588 				/*
589 				 * XXX maybe we should drop the packet here,
590 				 * as we could not provide enough information
591 				 * to the upper layers.
592 				 */
593 			}
594 		}
595 	}
596 
597 	/*
598 	 * Process Hop-by-Hop options header if it's contained.
599 	 * m may be modified in ip6_hopopts_input().
600 	 * If a JumboPayload option is included, plen will also be modified.
601 	 */
602 	plen = (u_int32_t)ntohs(ip6->ip6_plen);
603 	if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
604 		struct ip6_hbh *hbh;
605 
606 		if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) {
607 #if 0	/*touches NULL pointer*/
608 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
609 #endif
610 			return;	/* m have already been freed */
611 		}
612 
613 		/* adjust pointer */
614 		ip6 = mtod(m, struct ip6_hdr *);
615 
616 		/*
617 		 * if the payload length field is 0 and the next header field
618 		 * indicates Hop-by-Hop Options header, then a Jumbo Payload
619 		 * option MUST be included.
620 		 */
621 		if (ip6->ip6_plen == 0 && plen == 0) {
622 			/*
623 			 * Note that if a valid jumbo payload option is
624 			 * contained, ip6_hopopts_input() must set a valid
625 			 * (non-zero) payload length to the variable plen.
626 			 */
627 			ip6stat.ip6s_badoptions++;
628 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
629 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
630 			icmp6_error(m, ICMP6_PARAM_PROB,
631 				    ICMP6_PARAMPROB_HEADER,
632 				    (caddr_t)&ip6->ip6_plen - (caddr_t)ip6);
633 			return;
634 		}
635 		IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
636 			sizeof(struct ip6_hbh));
637 		if (hbh == NULL) {
638 			ip6stat.ip6s_tooshort++;
639 			return;
640 		}
641 		KASSERT(IP6_HDR_ALIGNED_P(hbh));
642 		nxt = hbh->ip6h_nxt;
643 
644 		/*
645 		 * accept the packet if a router alert option is included
646 		 * and we act as an IPv6 router.
647 		 */
648 		if (rtalert != ~0 && ip6_forwarding)
649 			ours = 1;
650 	} else
651 		nxt = ip6->ip6_nxt;
652 
653 	/*
654 	 * Check that the amount of data in the buffers
655 	 * is as at least much as the IPv6 header would have us expect.
656 	 * Trim mbufs if longer than we expect.
657 	 * Drop packet if shorter than we expect.
658 	 */
659 	if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
660 		ip6stat.ip6s_tooshort++;
661 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
662 		goto bad;
663 	}
664 	if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
665 		if (m->m_len == m->m_pkthdr.len) {
666 			m->m_len = sizeof(struct ip6_hdr) + plen;
667 			m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
668 		} else
669 			m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len);
670 	}
671 
672 	/*
673 	 * Forward if desirable.
674 	 */
675 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
676 		/*
677 		 * If we are acting as a multicast router, all
678 		 * incoming multicast packets are passed to the
679 		 * kernel-level multicast forwarding function.
680 		 * The packet is returned (relatively) intact; if
681 		 * ip6_mforward() returns a non-zero value, the packet
682 		 * must be discarded, else it may be accepted below.
683 		 */
684 		if (ip6_mrouter && ip6_mforward(ip6, m->m_pkthdr.rcvif, m)) {
685 			ip6stat.ip6s_cantforward++;
686 			m_freem(m);
687 			return;
688 		}
689 		if (!ours) {
690 			m_freem(m);
691 			return;
692 		}
693 	} else if (!ours) {
694 		ip6_forward(m, srcrt);
695 		return;
696 	}
697 
698 	ip6 = mtod(m, struct ip6_hdr *);
699 
700 	/*
701 	 * Malicious party may be able to use IPv4 mapped addr to confuse
702 	 * tcp/udp stack and bypass security checks (act as if it was from
703 	 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1).  Be cautious.
704 	 *
705 	 * For SIIT end node behavior, you may want to disable the check.
706 	 * However, you will  become vulnerable to attacks using IPv4 mapped
707 	 * source.
708 	 */
709 	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
710 	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
711 		ip6stat.ip6s_badscope++;
712 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
713 		goto bad;
714 	}
715 
716 	/*
717 	 * Tell launch routine the next header
718 	 */
719 #ifdef IFA_STATS
720 	if (deliverifp != NULL) {
721 		struct in6_ifaddr *ia6;
722 		ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
723 		if (ia6)
724 			ia6->ia_ifa.ifa_data.ifad_inbytes += m->m_pkthdr.len;
725 	}
726 #endif
727 	ip6stat.ip6s_delivered++;
728 	in6_ifstat_inc(deliverifp, ifs6_in_deliver);
729 	nest = 0;
730 
731 	while (nxt != IPPROTO_DONE) {
732 		if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
733 			ip6stat.ip6s_toomanyhdr++;
734 			goto bad;
735 		}
736 
737 		/*
738 		 * protection against faulty packet - there should be
739 		 * more sanity checks in header chain processing.
740 		 */
741 		if (m->m_pkthdr.len < off) {
742 			ip6stat.ip6s_tooshort++;
743 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
744 			goto bad;
745 		}
746 
747 #ifdef IPSEC
748 		/*
749 		 * enforce IPsec policy checking if we are seeing last header.
750 		 * note that we do not visit this with protocols with pcb layer
751 		 * code - like udp/tcp/raw ip.
752 		 */
753 		if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
754 		    ipsec6_in_reject(m, NULL)) {
755 			ipsec6stat.in_polvio++;
756 			goto bad;
757 		}
758 #endif
759 
760 		nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt);
761 	}
762 	return;
763  bad:
764 	m_freem(m);
765 }
766 
767 /*
768  * set/grab in6_ifaddr correspond to IPv6 destination address.
769  */
770 static struct m_tag *
771 ip6_setdstifaddr(m, ia6)
772 	struct mbuf *m;
773 	struct in6_ifaddr *ia6;
774 {
775 	struct m_tag *mtag;
776 
777 	mtag = ip6_addaux(m);
778 	if (mtag)
779 		((struct ip6aux *)(mtag + 1))->ip6a_dstia6 = ia6;
780 	return mtag;	/* NULL if failed to set */
781 }
782 
783 struct in6_ifaddr *
784 ip6_getdstifaddr(m)
785 	struct mbuf *m;
786 {
787 	struct m_tag *mtag;
788 
789 	mtag = ip6_findaux(m);
790 	if (mtag)
791 		return ((struct ip6aux *)(mtag + 1))->ip6a_dstia6;
792 	else
793 		return NULL;
794 }
795 
796 /*
797  * Hop-by-Hop options header processing. If a valid jumbo payload option is
798  * included, the real payload length will be stored in plenp.
799  */
800 static int
801 ip6_hopopts_input(plenp, rtalertp, mp, offp)
802 	u_int32_t *plenp;
803 	u_int32_t *rtalertp;	/* XXX: should be stored more smart way */
804 	struct mbuf **mp;
805 	int *offp;
806 {
807 	struct mbuf *m = *mp;
808 	int off = *offp, hbhlen;
809 	struct ip6_hbh *hbh;
810 
811 	/* validation of the length of the header */
812 	IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m,
813 		sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
814 	if (hbh == NULL) {
815 		ip6stat.ip6s_tooshort++;
816 		return -1;
817 	}
818 	hbhlen = (hbh->ip6h_len + 1) << 3;
819 	IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
820 		hbhlen);
821 	if (hbh == NULL) {
822 		ip6stat.ip6s_tooshort++;
823 		return -1;
824 	}
825 	KASSERT(IP6_HDR_ALIGNED_P(hbh));
826 	off += hbhlen;
827 	hbhlen -= sizeof(struct ip6_hbh);
828 
829 	if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
830 				hbhlen, rtalertp, plenp) < 0)
831 		return (-1);
832 
833 	*offp = off;
834 	*mp = m;
835 	return (0);
836 }
837 
838 /*
839  * Search header for all Hop-by-hop options and process each option.
840  * This function is separate from ip6_hopopts_input() in order to
841  * handle a case where the sending node itself process its hop-by-hop
842  * options header. In such a case, the function is called from ip6_output().
843  *
844  * The function assumes that hbh header is located right after the IPv6 header
845  * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
846  * opthead + hbhlen is located in continuous memory region.
847  */
848 int
849 ip6_process_hopopts(m, opthead, hbhlen, rtalertp, plenp)
850 	struct mbuf *m;
851 	u_int8_t *opthead;
852 	int hbhlen;
853 	u_int32_t *rtalertp;
854 	u_int32_t *plenp;
855 {
856 	struct ip6_hdr *ip6;
857 	int optlen = 0;
858 	u_int8_t *opt = opthead;
859 	u_int16_t rtalert_val;
860 	u_int32_t jumboplen;
861 	const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh);
862 
863 	for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) {
864 		switch (*opt) {
865 		case IP6OPT_PAD1:
866 			optlen = 1;
867 			break;
868 		case IP6OPT_PADN:
869 			if (hbhlen < IP6OPT_MINLEN) {
870 				ip6stat.ip6s_toosmall++;
871 				goto bad;
872 			}
873 			optlen = *(opt + 1) + 2;
874 			break;
875 		case IP6OPT_RTALERT:
876 			/* XXX may need check for alignment */
877 			if (hbhlen < IP6OPT_RTALERT_LEN) {
878 				ip6stat.ip6s_toosmall++;
879 				goto bad;
880 			}
881 			if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) {
882 				/* XXX stat */
883 				icmp6_error(m, ICMP6_PARAM_PROB,
884 				    ICMP6_PARAMPROB_HEADER,
885 				    erroff + opt + 1 - opthead);
886 				return (-1);
887 			}
888 			optlen = IP6OPT_RTALERT_LEN;
889 			bcopy((caddr_t)(opt + 2), (caddr_t)&rtalert_val, 2);
890 			*rtalertp = ntohs(rtalert_val);
891 			break;
892 		case IP6OPT_JUMBO:
893 			/* XXX may need check for alignment */
894 			if (hbhlen < IP6OPT_JUMBO_LEN) {
895 				ip6stat.ip6s_toosmall++;
896 				goto bad;
897 			}
898 			if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) {
899 				/* XXX stat */
900 				icmp6_error(m, ICMP6_PARAM_PROB,
901 				    ICMP6_PARAMPROB_HEADER,
902 				    erroff + opt + 1 - opthead);
903 				return (-1);
904 			}
905 			optlen = IP6OPT_JUMBO_LEN;
906 
907 			/*
908 			 * IPv6 packets that have non 0 payload length
909 			 * must not contain a jumbo payload option.
910 			 */
911 			ip6 = mtod(m, struct ip6_hdr *);
912 			if (ip6->ip6_plen) {
913 				ip6stat.ip6s_badoptions++;
914 				icmp6_error(m, ICMP6_PARAM_PROB,
915 				    ICMP6_PARAMPROB_HEADER,
916 				    erroff + opt - opthead);
917 				return (-1);
918 			}
919 
920 			/*
921 			 * We may see jumbolen in unaligned location, so
922 			 * we'd need to perform bcopy().
923 			 */
924 			bcopy(opt + 2, &jumboplen, sizeof(jumboplen));
925 			jumboplen = (u_int32_t)htonl(jumboplen);
926 
927 #if 1
928 			/*
929 			 * if there are multiple jumbo payload options,
930 			 * *plenp will be non-zero and the packet will be
931 			 * rejected.
932 			 * the behavior may need some debate in ipngwg -
933 			 * multiple options does not make sense, however,
934 			 * there's no explicit mention in specification.
935 			 */
936 			if (*plenp != 0) {
937 				ip6stat.ip6s_badoptions++;
938 				icmp6_error(m, ICMP6_PARAM_PROB,
939 				    ICMP6_PARAMPROB_HEADER,
940 				    erroff + opt + 2 - opthead);
941 				return (-1);
942 			}
943 #endif
944 
945 			/*
946 			 * jumbo payload length must be larger than 65535.
947 			 */
948 			if (jumboplen <= IPV6_MAXPACKET) {
949 				ip6stat.ip6s_badoptions++;
950 				icmp6_error(m, ICMP6_PARAM_PROB,
951 				    ICMP6_PARAMPROB_HEADER,
952 				    erroff + opt + 2 - opthead);
953 				return (-1);
954 			}
955 			*plenp = jumboplen;
956 
957 			break;
958 		default:		/* unknown option */
959 			if (hbhlen < IP6OPT_MINLEN) {
960 				ip6stat.ip6s_toosmall++;
961 				goto bad;
962 			}
963 			optlen = ip6_unknown_opt(opt, m,
964 			    erroff + opt - opthead);
965 			if (optlen == -1)
966 				return (-1);
967 			optlen += 2;
968 			break;
969 		}
970 	}
971 
972 	return (0);
973 
974   bad:
975 	m_freem(m);
976 	return (-1);
977 }
978 
979 /*
980  * Unknown option processing.
981  * The third argument `off' is the offset from the IPv6 header to the option,
982  * which is necessary if the IPv6 header the and option header and IPv6 header
983  * is not continuous in order to return an ICMPv6 error.
984  */
985 int
986 ip6_unknown_opt(optp, m, off)
987 	u_int8_t *optp;
988 	struct mbuf *m;
989 	int off;
990 {
991 	struct ip6_hdr *ip6;
992 
993 	switch (IP6OPT_TYPE(*optp)) {
994 	case IP6OPT_TYPE_SKIP: /* ignore the option */
995 		return ((int)*(optp + 1));
996 	case IP6OPT_TYPE_DISCARD:	/* silently discard */
997 		m_freem(m);
998 		return (-1);
999 	case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */
1000 		ip6stat.ip6s_badoptions++;
1001 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off);
1002 		return (-1);
1003 	case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */
1004 		ip6stat.ip6s_badoptions++;
1005 		ip6 = mtod(m, struct ip6_hdr *);
1006 		if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
1007 		    (m->m_flags & (M_BCAST|M_MCAST)))
1008 			m_freem(m);
1009 		else
1010 			icmp6_error(m, ICMP6_PARAM_PROB,
1011 				    ICMP6_PARAMPROB_OPTION, off);
1012 		return (-1);
1013 	}
1014 
1015 	m_freem(m);		/* XXX: NOTREACHED */
1016 	return (-1);
1017 }
1018 
1019 /*
1020  * Create the "control" list for this pcb.
1021  *
1022  * The routine will be called from upper layer handlers like tcp6_input().
1023  * Thus the routine assumes that the caller (tcp6_input) have already
1024  * called IP6_EXTHDR_CHECK() and all the extension headers are located in the
1025  * very first mbuf on the mbuf chain.
1026  * We may want to add some infinite loop prevention or sanity checks for safety.
1027  * (This applies only when you are using KAME mbuf chain restriction, i.e.
1028  * you are using IP6_EXTHDR_CHECK() not m_pulldown())
1029  */
1030 void
1031 ip6_savecontrol(in6p, mp, ip6, m)
1032 	struct in6pcb *in6p;
1033 	struct mbuf **mp;
1034 	struct ip6_hdr *ip6;
1035 	struct mbuf *m;
1036 {
1037 #ifdef RFC2292
1038 #define IS2292(x, y)	((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y))
1039 #else
1040 #define IS2292(x, y)	(y)
1041 #endif
1042 
1043 #ifdef SO_TIMESTAMP
1044 	if (in6p->in6p_socket->so_options & SO_TIMESTAMP) {
1045 		struct timeval tv;
1046 
1047 		microtime(&tv);
1048 		*mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
1049 		    SCM_TIMESTAMP, SOL_SOCKET);
1050 		if (*mp)
1051 			mp = &(*mp)->m_next;
1052 	}
1053 #endif
1054 
1055 	/* some OSes call this logic with IPv4 packet, for SO_TIMESTAMP */
1056 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION)
1057 		return;
1058 
1059 	/* RFC 2292 sec. 5 */
1060 	if ((in6p->in6p_flags & IN6P_PKTINFO) != 0) {
1061 		struct in6_pktinfo pi6;
1062 
1063 		bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr));
1064 		in6_clearscope(&pi6.ipi6_addr);	/* XXX */
1065 		pi6.ipi6_ifindex = m->m_pkthdr.rcvif ?
1066 		    m->m_pkthdr.rcvif->if_index : 0;
1067 		*mp = sbcreatecontrol((caddr_t) &pi6,
1068 		    sizeof(struct in6_pktinfo),
1069 		    IS2292(IPV6_2292PKTINFO, IPV6_PKTINFO), IPPROTO_IPV6);
1070 		if (*mp)
1071 			mp = &(*mp)->m_next;
1072 	}
1073 
1074 	if (in6p->in6p_flags & IN6P_HOPLIMIT) {
1075 		int hlim = ip6->ip6_hlim & 0xff;
1076 
1077 		*mp = sbcreatecontrol((caddr_t) &hlim, sizeof(int),
1078 		    IS2292(IPV6_2292HOPLIMIT, IPV6_HOPLIMIT), IPPROTO_IPV6);
1079 		if (*mp)
1080 			mp = &(*mp)->m_next;
1081 	}
1082 
1083 	if ((in6p->in6p_flags & IN6P_TCLASS) != 0) {
1084 		u_int32_t flowinfo;
1085 		int tclass;
1086 
1087 		flowinfo = (u_int32_t)ntohl(ip6->ip6_flow & IPV6_FLOWINFO_MASK);
1088 		flowinfo >>= 20;
1089 
1090 		tclass = flowinfo & 0xff;
1091 		*mp = sbcreatecontrol((caddr_t)&tclass, sizeof(tclass),
1092 		    IPV6_TCLASS, IPPROTO_IPV6);
1093 
1094 		if (*mp)
1095 			mp = &(*mp)->m_next;
1096 	}
1097 
1098 	/*
1099 	 * IPV6_HOPOPTS socket option.  Recall that we required super-user
1100 	 * privilege for the option (see ip6_ctloutput), but it might be too
1101 	 * strict, since there might be some hop-by-hop options which can be
1102 	 * returned to normal user.
1103 	 * See also RFC3542 section 8 (or RFC2292 section 6).
1104 	 */
1105 	if ((in6p->in6p_flags & IN6P_HOPOPTS) != 0) {
1106 		/*
1107 		 * Check if a hop-by-hop options header is contatined in the
1108 		 * received packet, and if so, store the options as ancillary
1109 		 * data. Note that a hop-by-hop options header must be
1110 		 * just after the IPv6 header, which fact is assured through
1111 		 * the IPv6 input processing.
1112 		 */
1113 		struct ip6_hdr *xip6 = mtod(m, struct ip6_hdr *);
1114 		if (xip6->ip6_nxt == IPPROTO_HOPOPTS) {
1115 			struct ip6_hbh *hbh;
1116 			int hbhlen;
1117 			struct mbuf *ext;
1118 
1119 			ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr),
1120 			    xip6->ip6_nxt);
1121 			if (ext == NULL) {
1122 				ip6stat.ip6s_tooshort++;
1123 				return;
1124 			}
1125 			hbh = mtod(ext, struct ip6_hbh *);
1126 			hbhlen = (hbh->ip6h_len + 1) << 3;
1127 			if (hbhlen != ext->m_len) {
1128 				m_freem(ext);
1129 				ip6stat.ip6s_tooshort++;
1130 				return;
1131 			}
1132 
1133 			/*
1134 			 * XXX: We copy whole the header even if a jumbo
1135 			 * payload option is included, which option is to
1136 			 * be removed before returning in the RFC 2292.
1137 			 * Note: this constraint is removed in RFC3542.
1138 			 */
1139 			*mp = sbcreatecontrol((caddr_t)hbh, hbhlen,
1140 			    IS2292(IPV6_2292HOPOPTS, IPV6_HOPOPTS),
1141 			    IPPROTO_IPV6);
1142 			if (*mp)
1143 				mp = &(*mp)->m_next;
1144 			m_freem(ext);
1145 		}
1146 	}
1147 
1148 	/* IPV6_DSTOPTS and IPV6_RTHDR socket options */
1149 	if (in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDR)) {
1150 		struct ip6_hdr *xip6 = mtod(m, struct ip6_hdr *);
1151 		int nxt = xip6->ip6_nxt, off = sizeof(struct ip6_hdr);
1152 
1153 		/*
1154 		 * Search for destination options headers or routing
1155 		 * header(s) through the header chain, and stores each
1156 		 * header as ancillary data.
1157 		 * Note that the order of the headers remains in
1158 		 * the chain of ancillary data.
1159 		 */
1160 		for (;;) {	/* is explicit loop prevention necessary? */
1161 			struct ip6_ext *ip6e = NULL;
1162 			int elen;
1163 			struct mbuf *ext = NULL;
1164 
1165 			/*
1166 			 * if it is not an extension header, don't try to
1167 			 * pull it from the chain.
1168 			 */
1169 			switch (nxt) {
1170 			case IPPROTO_DSTOPTS:
1171 			case IPPROTO_ROUTING:
1172 			case IPPROTO_HOPOPTS:
1173 			case IPPROTO_AH: /* is it possible? */
1174 				break;
1175 			default:
1176 				goto loopend;
1177 			}
1178 
1179 			ext = ip6_pullexthdr(m, off, nxt);
1180 			if (ext == NULL) {
1181 				ip6stat.ip6s_tooshort++;
1182 				return;
1183 			}
1184 			ip6e = mtod(ext, struct ip6_ext *);
1185 			if (nxt == IPPROTO_AH)
1186 				elen = (ip6e->ip6e_len + 2) << 2;
1187 			else
1188 				elen = (ip6e->ip6e_len + 1) << 3;
1189 			if (elen != ext->m_len) {
1190 				m_freem(ext);
1191 				ip6stat.ip6s_tooshort++;
1192 				return;
1193 			}
1194 			KASSERT(IP6_HDR_ALIGNED_P(ip6e));
1195 
1196 			switch (nxt) {
1197 			case IPPROTO_DSTOPTS:
1198 				if (!in6p->in6p_flags & IN6P_DSTOPTS)
1199 					break;
1200 
1201 				*mp = sbcreatecontrol((caddr_t)ip6e, elen,
1202 				    IS2292(IPV6_2292DSTOPTS, IPV6_DSTOPTS),
1203 				    IPPROTO_IPV6);
1204 				if (*mp)
1205 					mp = &(*mp)->m_next;
1206 				break;
1207 
1208 			case IPPROTO_ROUTING:
1209 				if (!in6p->in6p_flags & IN6P_RTHDR)
1210 					break;
1211 
1212 				*mp = sbcreatecontrol((caddr_t)ip6e, elen,
1213 				    IS2292(IPV6_2292RTHDR, IPV6_RTHDR),
1214 				    IPPROTO_IPV6);
1215 				if (*mp)
1216 					mp = &(*mp)->m_next;
1217 				break;
1218 
1219 			case IPPROTO_HOPOPTS:
1220 			case IPPROTO_AH: /* is it possible? */
1221 				break;
1222 
1223 			default:
1224 				/*
1225 			 	 * other cases have been filtered in the above.
1226 				 * none will visit this case.  here we supply
1227 				 * the code just in case (nxt overwritten or
1228 				 * other cases).
1229 				 */
1230 				m_freem(ext);
1231 				goto loopend;
1232 
1233 			}
1234 
1235 			/* proceed with the next header. */
1236 			off += elen;
1237 			nxt = ip6e->ip6e_nxt;
1238 			ip6e = NULL;
1239 			m_freem(ext);
1240 			ext = NULL;
1241 		}
1242 	  loopend:
1243 	  	;
1244 	}
1245 }
1246 #undef IS2292
1247 
1248 
1249 void
1250 ip6_notify_pmtu(struct in6pcb *in6p, struct sockaddr_in6 *dst, uint32_t *mtu)
1251 {
1252 	struct socket *so;
1253 	struct mbuf *m_mtu;
1254 	struct ip6_mtuinfo mtuctl;
1255 
1256 	so = in6p->in6p_socket;
1257 
1258 	if (mtu == NULL)
1259 		return;
1260 
1261 #ifdef DIAGNOSTIC
1262 	if (so == NULL)		/* I believe this is impossible */
1263 		panic("ip6_notify_pmtu: socket is NULL");
1264 #endif
1265 
1266 	memset(&mtuctl, 0, sizeof(mtuctl));	/* zero-clear for safety */
1267 	mtuctl.ip6m_mtu = *mtu;
1268 	mtuctl.ip6m_addr = *dst;
1269 	if (sa6_recoverscope(&mtuctl.ip6m_addr))
1270 		return;
1271 
1272 	if ((m_mtu = sbcreatecontrol((caddr_t)&mtuctl, sizeof(mtuctl),
1273 	    IPV6_PATHMTU, IPPROTO_IPV6)) == NULL)
1274 		return;
1275 
1276 	if (sbappendaddr(&so->so_rcv, (struct sockaddr *)dst, NULL, m_mtu)
1277 	    == 0) {
1278 		m_freem(m_mtu);
1279 		/* XXX: should count statistics */
1280 	} else
1281 		sorwakeup(so);
1282 
1283 	return;
1284 }
1285 
1286 /*
1287  * pull single extension header from mbuf chain.  returns single mbuf that
1288  * contains the result, or NULL on error.
1289  */
1290 static struct mbuf *
1291 ip6_pullexthdr(m, off, nxt)
1292 	struct mbuf *m;
1293 	size_t off;
1294 	int nxt;
1295 {
1296 	struct ip6_ext ip6e;
1297 	size_t elen;
1298 	struct mbuf *n;
1299 
1300 #ifdef DIAGNOSTIC
1301 	switch (nxt) {
1302 	case IPPROTO_DSTOPTS:
1303 	case IPPROTO_ROUTING:
1304 	case IPPROTO_HOPOPTS:
1305 	case IPPROTO_AH: /* is it possible? */
1306 		break;
1307 	default:
1308 		printf("ip6_pullexthdr: invalid nxt=%d\n", nxt);
1309 	}
1310 #endif
1311 
1312 	m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
1313 	if (nxt == IPPROTO_AH)
1314 		elen = (ip6e.ip6e_len + 2) << 2;
1315 	else
1316 		elen = (ip6e.ip6e_len + 1) << 3;
1317 
1318 	MGET(n, M_DONTWAIT, MT_DATA);
1319 	if (n && elen >= MLEN) {
1320 		MCLGET(n, M_DONTWAIT);
1321 		if ((n->m_flags & M_EXT) == 0) {
1322 			m_free(n);
1323 			n = NULL;
1324 		}
1325 	}
1326 	if (!n)
1327 		return NULL;
1328 
1329 	n->m_len = 0;
1330 	if (elen >= M_TRAILINGSPACE(n)) {
1331 		m_free(n);
1332 		return NULL;
1333 	}
1334 
1335 	m_copydata(m, off, elen, mtod(n, caddr_t));
1336 	n->m_len = elen;
1337 	return n;
1338 }
1339 
1340 /*
1341  * Get pointer to the previous header followed by the header
1342  * currently processed.
1343  * XXX: This function supposes that
1344  *	M includes all headers,
1345  *	the next header field and the header length field of each header
1346  *	are valid, and
1347  *	the sum of each header length equals to OFF.
1348  * Because of these assumptions, this function must be called very
1349  * carefully. Moreover, it will not be used in the near future when
1350  * we develop `neater' mechanism to process extension headers.
1351  */
1352 u_int8_t *
1353 ip6_get_prevhdr(m, off)
1354 	struct mbuf *m;
1355 	int off;
1356 {
1357 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1358 
1359 	if (off == sizeof(struct ip6_hdr))
1360 		return (&ip6->ip6_nxt);
1361 	else {
1362 		int len, nxt;
1363 		struct ip6_ext *ip6e = NULL;
1364 
1365 		nxt = ip6->ip6_nxt;
1366 		len = sizeof(struct ip6_hdr);
1367 		while (len < off) {
1368 			ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + len);
1369 
1370 			switch (nxt) {
1371 			case IPPROTO_FRAGMENT:
1372 				len += sizeof(struct ip6_frag);
1373 				break;
1374 			case IPPROTO_AH:
1375 				len += (ip6e->ip6e_len + 2) << 2;
1376 				break;
1377 			default:
1378 				len += (ip6e->ip6e_len + 1) << 3;
1379 				break;
1380 			}
1381 			nxt = ip6e->ip6e_nxt;
1382 		}
1383 		if (ip6e)
1384 			return (&ip6e->ip6e_nxt);
1385 		else
1386 			return NULL;
1387 	}
1388 }
1389 
1390 /*
1391  * get next header offset.  m will be retained.
1392  */
1393 int
1394 ip6_nexthdr(m, off, proto, nxtp)
1395 	struct mbuf *m;
1396 	int off;
1397 	int proto;
1398 	int *nxtp;
1399 {
1400 	struct ip6_hdr ip6;
1401 	struct ip6_ext ip6e;
1402 	struct ip6_frag fh;
1403 
1404 	/* just in case */
1405 	if (m == NULL)
1406 		panic("ip6_nexthdr: m == NULL");
1407 	if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off)
1408 		return -1;
1409 
1410 	switch (proto) {
1411 	case IPPROTO_IPV6:
1412 		/* do not chase beyond intermediate IPv6 headers */
1413 		if (off != 0)
1414 			return -1;
1415 		if (m->m_pkthdr.len < off + sizeof(ip6))
1416 			return -1;
1417 		m_copydata(m, off, sizeof(ip6), (caddr_t)&ip6);
1418 		if (nxtp)
1419 			*nxtp = ip6.ip6_nxt;
1420 		off += sizeof(ip6);
1421 		return off;
1422 
1423 	case IPPROTO_FRAGMENT:
1424 		/*
1425 		 * terminate parsing if it is not the first fragment,
1426 		 * it does not make sense to parse through it.
1427 		 */
1428 		if (m->m_pkthdr.len < off + sizeof(fh))
1429 			return -1;
1430 		m_copydata(m, off, sizeof(fh), (caddr_t)&fh);
1431 		if ((fh.ip6f_offlg & IP6F_OFF_MASK) != 0)
1432 			return -1;
1433 		if (nxtp)
1434 			*nxtp = fh.ip6f_nxt;
1435 		off += sizeof(struct ip6_frag);
1436 		return off;
1437 
1438 	case IPPROTO_AH:
1439 		if (m->m_pkthdr.len < off + sizeof(ip6e))
1440 			return -1;
1441 		m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
1442 		if (nxtp)
1443 			*nxtp = ip6e.ip6e_nxt;
1444 		off += (ip6e.ip6e_len + 2) << 2;
1445 		if (m->m_pkthdr.len < off)
1446 			return -1;
1447 		return off;
1448 
1449 	case IPPROTO_HOPOPTS:
1450 	case IPPROTO_ROUTING:
1451 	case IPPROTO_DSTOPTS:
1452 		if (m->m_pkthdr.len < off + sizeof(ip6e))
1453 			return -1;
1454 		m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
1455 		if (nxtp)
1456 			*nxtp = ip6e.ip6e_nxt;
1457 		off += (ip6e.ip6e_len + 1) << 3;
1458 		if (m->m_pkthdr.len < off)
1459 			return -1;
1460 		return off;
1461 
1462 	case IPPROTO_NONE:
1463 	case IPPROTO_ESP:
1464 	case IPPROTO_IPCOMP:
1465 		/* give up */
1466 		return -1;
1467 
1468 	default:
1469 		return -1;
1470 	}
1471 }
1472 
1473 /*
1474  * get offset for the last header in the chain.  m will be kept untainted.
1475  */
1476 int
1477 ip6_lasthdr(m, off, proto, nxtp)
1478 	struct mbuf *m;
1479 	int off;
1480 	int proto;
1481 	int *nxtp;
1482 {
1483 	int newoff;
1484 	int nxt;
1485 
1486 	if (!nxtp) {
1487 		nxt = -1;
1488 		nxtp = &nxt;
1489 	}
1490 	for (;;) {
1491 		newoff = ip6_nexthdr(m, off, proto, nxtp);
1492 		if (newoff < 0)
1493 			return off;
1494 		else if (newoff < off)
1495 			return -1;	/* invalid */
1496 		else if (newoff == off)
1497 			return newoff;
1498 
1499 		off = newoff;
1500 		proto = *nxtp;
1501 	}
1502 }
1503 
1504 struct m_tag *
1505 ip6_addaux(m)
1506 	struct mbuf *m;
1507 {
1508 	struct m_tag *mtag;
1509 
1510 	mtag = m_tag_find(m, PACKET_TAG_INET6, NULL);
1511 	if (!mtag) {
1512 		mtag = m_tag_get(PACKET_TAG_INET6, sizeof(struct ip6aux),
1513 		    M_NOWAIT);
1514 		if (mtag) {
1515 			m_tag_prepend(m, mtag);
1516 			bzero(mtag + 1, sizeof(struct ip6aux));
1517 		}
1518 	}
1519 	return mtag;
1520 }
1521 
1522 struct m_tag *
1523 ip6_findaux(m)
1524 	struct mbuf *m;
1525 {
1526 	struct m_tag *mtag;
1527 
1528 	mtag = m_tag_find(m, PACKET_TAG_INET6, NULL);
1529 	return mtag;
1530 }
1531 
1532 void
1533 ip6_delaux(m)
1534 	struct mbuf *m;
1535 {
1536 	struct m_tag *mtag;
1537 
1538 	mtag = m_tag_find(m, PACKET_TAG_INET6, NULL);
1539 	if (mtag)
1540 		m_tag_delete(m, mtag);
1541 }
1542 
1543 /*
1544  * System control for IP6
1545  */
1546 
1547 u_char	inet6ctlerrmap[PRC_NCMDS] = {
1548 	0,		0,		0,		0,
1549 	0,		EMSGSIZE,	EHOSTDOWN,	EHOSTUNREACH,
1550 	EHOSTUNREACH,	EHOSTUNREACH,	ECONNREFUSED,	ECONNREFUSED,
1551 	EMSGSIZE,	EHOSTUNREACH,	0,		0,
1552 	0,		0,		0,		0,
1553 	ENOPROTOOPT
1554 };
1555 
1556 SYSCTL_SETUP(sysctl_net_inet6_ip6_setup, "sysctl net.inet6.ip6 subtree setup")
1557 {
1558 #ifdef RFC2292
1559 #define IS2292(x, y)	((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y))
1560 #else
1561 #define IS2292(x, y)	(y)
1562 #endif
1563 
1564 	sysctl_createv(clog, 0, NULL, NULL,
1565 		       CTLFLAG_PERMANENT,
1566 		       CTLTYPE_NODE, "net", NULL,
1567 		       NULL, 0, NULL, 0,
1568 		       CTL_NET, CTL_EOL);
1569 	sysctl_createv(clog, 0, NULL, NULL,
1570 		       CTLFLAG_PERMANENT,
1571 		       CTLTYPE_NODE, "inet6",
1572 		       SYSCTL_DESCR("PF_INET6 related settings"),
1573 		       NULL, 0, NULL, 0,
1574 		       CTL_NET, PF_INET6, CTL_EOL);
1575 	sysctl_createv(clog, 0, NULL, NULL,
1576 		       CTLFLAG_PERMANENT,
1577 		       CTLTYPE_NODE, "ip6",
1578 		       SYSCTL_DESCR("IPv6 related settings"),
1579 		       NULL, 0, NULL, 0,
1580 		       CTL_NET, PF_INET6, IPPROTO_IPV6, CTL_EOL);
1581 
1582 	sysctl_createv(clog, 0, NULL, NULL,
1583 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1584 		       CTLTYPE_INT, "forwarding",
1585 		       SYSCTL_DESCR("Enable forwarding of INET6 datagrams"),
1586 		       NULL, 0, &ip6_forwarding, 0,
1587 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1588 		       IPV6CTL_FORWARDING, CTL_EOL);
1589 	sysctl_createv(clog, 0, NULL, NULL,
1590 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1591 		       CTLTYPE_INT, "redirect",
1592 		       SYSCTL_DESCR("Enable sending of ICMPv6 redirect messages"),
1593 		       NULL, 0, &ip6_sendredirects, 0,
1594 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1595 		       IPV6CTL_SENDREDIRECTS, CTL_EOL);
1596 	sysctl_createv(clog, 0, NULL, NULL,
1597 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1598 		       CTLTYPE_INT, "hlim",
1599 		       SYSCTL_DESCR("Hop limit for an INET6 datagram"),
1600 		       NULL, 0, &ip6_defhlim, 0,
1601 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1602 		       IPV6CTL_DEFHLIM, CTL_EOL);
1603 #ifdef notyet
1604 	sysctl_createv(clog, 0, NULL, NULL,
1605 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1606 		       CTLTYPE_INT, "mtu", NULL,
1607 		       NULL, 0, &, 0,
1608 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1609 		       IPV6CTL_DEFMTU, CTL_EOL);
1610 #endif
1611 #ifdef __no_idea__
1612 	sysctl_createv(clog, 0, NULL, NULL,
1613 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1614 		       CTLTYPE_INT, "forwsrcrt", NULL,
1615 		       NULL, 0, &?, 0,
1616 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1617 		       IPV6CTL_FORWSRCRT, CTL_EOL);
1618 	sysctl_createv(clog, 0, NULL, NULL,
1619 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1620 		       CTLTYPE_STRUCT, "mrtstats", NULL,
1621 		       NULL, 0, &?, sizeof(?),
1622 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1623 		       IPV6CTL_MRTSTATS, CTL_EOL);
1624 	sysctl_createv(clog, 0, NULL, NULL,
1625 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1626 		       CTLTYPE_?, "mrtproto", NULL,
1627 		       NULL, 0, &?, sizeof(?),
1628 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1629 		       IPV6CTL_MRTPROTO, CTL_EOL);
1630 #endif
1631 	sysctl_createv(clog, 0, NULL, NULL,
1632 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1633 		       CTLTYPE_INT, "maxfragpackets",
1634 		       SYSCTL_DESCR("Maximum number of fragments to buffer "
1635 				    "for reassembly"),
1636 		       NULL, 0, &ip6_maxfragpackets, 0,
1637 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1638 		       IPV6CTL_MAXFRAGPACKETS, CTL_EOL);
1639 #ifdef __no_idea__
1640 	sysctl_createv(clog, 0, NULL, NULL,
1641 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1642 		       CTLTYPE_INT, "sourcecheck", NULL,
1643 		       NULL, 0, &?, 0,
1644 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1645 		       IPV6CTL_SOURCECHECK, CTL_EOL);
1646 	sysctl_createv(clog, 0, NULL, NULL,
1647 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1648 		       CTLTYPE_INT, "sourcecheck_logint", NULL,
1649 		       NULL, 0, &?, 0,
1650 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1651 		       IPV6CTL_SOURCECHECK_LOGINT, CTL_EOL);
1652 #endif
1653 	sysctl_createv(clog, 0, NULL, NULL,
1654 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1655 		       CTLTYPE_INT, "accept_rtadv",
1656 		       SYSCTL_DESCR("Accept router advertisements"),
1657 		       NULL, 0, &ip6_accept_rtadv, 0,
1658 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1659 		       IPV6CTL_ACCEPT_RTADV, CTL_EOL);
1660 	sysctl_createv(clog, 0, NULL, NULL,
1661 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1662 		       CTLTYPE_INT, "keepfaith",
1663 		       SYSCTL_DESCR("Activate faith interface"),
1664 		       NULL, 0, &ip6_keepfaith, 0,
1665 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1666 		       IPV6CTL_KEEPFAITH, CTL_EOL);
1667 	sysctl_createv(clog, 0, NULL, NULL,
1668 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1669 		       CTLTYPE_INT, "log_interval",
1670 		       SYSCTL_DESCR("Minumum interval between logging "
1671 				    "unroutable packets"),
1672 		       NULL, 0, &ip6_log_interval, 0,
1673 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1674 		       IPV6CTL_LOG_INTERVAL, CTL_EOL);
1675 	sysctl_createv(clog, 0, NULL, NULL,
1676 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1677 		       CTLTYPE_INT, "hdrnestlimit",
1678 		       SYSCTL_DESCR("Maximum number of nested IPv6 headers"),
1679 		       NULL, 0, &ip6_hdrnestlimit, 0,
1680 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1681 		       IPV6CTL_HDRNESTLIMIT, CTL_EOL);
1682 	sysctl_createv(clog, 0, NULL, NULL,
1683 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1684 		       CTLTYPE_INT, "dad_count",
1685 		       SYSCTL_DESCR("Number of Duplicate Address Detection "
1686 				    "probes to send"),
1687 		       NULL, 0, &ip6_dad_count, 0,
1688 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1689 		       IPV6CTL_DAD_COUNT, CTL_EOL);
1690 	sysctl_createv(clog, 0, NULL, NULL,
1691 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1692 		       CTLTYPE_INT, "auto_flowlabel",
1693 		       SYSCTL_DESCR("Assign random IPv6 flow labels"),
1694 		       NULL, 0, &ip6_auto_flowlabel, 0,
1695 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1696 		       IPV6CTL_AUTO_FLOWLABEL, CTL_EOL);
1697 	sysctl_createv(clog, 0, NULL, NULL,
1698 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1699 		       CTLTYPE_INT, "defmcasthlim",
1700 		       SYSCTL_DESCR("Default multicast hop limit"),
1701 		       NULL, 0, &ip6_defmcasthlim, 0,
1702 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1703 		       IPV6CTL_DEFMCASTHLIM, CTL_EOL);
1704 #if NGIF > 0
1705 	sysctl_createv(clog, 0, NULL, NULL,
1706 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1707 		       CTLTYPE_INT, "gifhlim",
1708 		       SYSCTL_DESCR("Default hop limit for a gif tunnel datagram"),
1709 		       NULL, 0, &ip6_gif_hlim, 0,
1710 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1711 		       IPV6CTL_GIF_HLIM, CTL_EOL);
1712 #endif /* NGIF */
1713 	sysctl_createv(clog, 0, NULL, NULL,
1714 		       CTLFLAG_PERMANENT,
1715 		       CTLTYPE_STRING, "kame_version",
1716 		       SYSCTL_DESCR("KAME Version"),
1717 		       NULL, 0, __UNCONST(__KAME_VERSION), 0,
1718 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1719 		       IPV6CTL_KAME_VERSION, CTL_EOL);
1720 	sysctl_createv(clog, 0, NULL, NULL,
1721 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1722 		       CTLTYPE_INT, "use_deprecated",
1723 		       SYSCTL_DESCR("Allow use of deprecated addresses as "
1724 				    "source addresses"),
1725 		       NULL, 0, &ip6_use_deprecated, 0,
1726 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1727 		       IPV6CTL_USE_DEPRECATED, CTL_EOL);
1728 	sysctl_createv(clog, 0, NULL, NULL,
1729 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1730 		       CTLTYPE_INT, "rr_prune", NULL,
1731 		       NULL, 0, &ip6_rr_prune, 0,
1732 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1733 		       IPV6CTL_RR_PRUNE, CTL_EOL);
1734 	sysctl_createv(clog, 0, NULL, NULL,
1735 		       CTLFLAG_PERMANENT
1736 #ifndef INET6_BINDV6ONLY
1737 		       |CTLFLAG_READWRITE,
1738 #endif
1739 		       CTLTYPE_INT, "v6only",
1740 		       SYSCTL_DESCR("Disallow PF_INET6 sockets from connecting "
1741 				    "to PF_INET sockets"),
1742 		       NULL, 0, &ip6_v6only, 0,
1743 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1744 		       IPV6CTL_V6ONLY, CTL_EOL);
1745 	sysctl_createv(clog, 0, NULL, NULL,
1746 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1747 		       CTLTYPE_INT, "anonportmin",
1748 		       SYSCTL_DESCR("Lowest ephemeral port number to assign"),
1749 		       sysctl_net_inet_ip_ports, 0, &ip6_anonportmin, 0,
1750 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1751 		       IPV6CTL_ANONPORTMIN, CTL_EOL);
1752 	sysctl_createv(clog, 0, NULL, NULL,
1753 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1754 		       CTLTYPE_INT, "anonportmax",
1755 		       SYSCTL_DESCR("Highest ephemeral port number to assign"),
1756 		       sysctl_net_inet_ip_ports, 0, &ip6_anonportmax, 0,
1757 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1758 		       IPV6CTL_ANONPORTMAX, CTL_EOL);
1759 #ifndef IPNOPRIVPORTS
1760 	sysctl_createv(clog, 0, NULL, NULL,
1761 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1762 		       CTLTYPE_INT, "lowportmin",
1763 		       SYSCTL_DESCR("Lowest privileged ephemeral port number "
1764 				    "to assign"),
1765 		       sysctl_net_inet_ip_ports, 0, &ip6_lowportmin, 0,
1766 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1767 		       IPV6CTL_LOWPORTMIN, CTL_EOL);
1768 	sysctl_createv(clog, 0, NULL, NULL,
1769 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1770 		       CTLTYPE_INT, "lowportmax",
1771 		       SYSCTL_DESCR("Highest privileged ephemeral port number "
1772 				    "to assign"),
1773 		       sysctl_net_inet_ip_ports, 0, &ip6_lowportmax, 0,
1774 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1775 		       IPV6CTL_LOWPORTMAX, CTL_EOL);
1776 #endif /* IPNOPRIVPORTS */
1777 	sysctl_createv(clog, 0, NULL, NULL,
1778 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1779 		       CTLTYPE_INT, "use_tempaddr",
1780 		       SYSCTL_DESCR("Use temporary address"),
1781 		       NULL, 0, &ip6_use_tempaddr, 0,
1782 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1783 		       CTL_CREATE, CTL_EOL);
1784 	sysctl_createv(clog, 0, NULL, NULL,
1785 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1786 		       CTLTYPE_INT, "temppltime",
1787 		       SYSCTL_DESCR("preferred lifetime of a temporary address"),
1788 		       NULL, 0, &ip6_temp_preferred_lifetime, 0,
1789 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1790 		       CTL_CREATE, CTL_EOL);
1791 	sysctl_createv(clog, 0, NULL, NULL,
1792 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1793 		       CTLTYPE_INT, "tempvltime",
1794 		       SYSCTL_DESCR("valid lifetime of a temporary address"),
1795 		       NULL, 0, &ip6_temp_valid_lifetime, 0,
1796 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1797 		       CTL_CREATE, CTL_EOL);
1798 	sysctl_createv(clog, 0, NULL, NULL,
1799 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1800 		       CTLTYPE_INT, "maxfrags",
1801 		       SYSCTL_DESCR("Maximum fragments in reassembly queue"),
1802 		       NULL, 0, &ip6_maxfrags, 0,
1803 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1804 		       IPV6CTL_MAXFRAGS, CTL_EOL);
1805 	sysctl_createv(clog, 0, NULL, NULL,
1806 		       CTLFLAG_PERMANENT,
1807 		       CTLTYPE_STRUCT, "stats",
1808 		       SYSCTL_DESCR("IPv6 statistics"),
1809 		       NULL, 0, &ip6stat, sizeof(ip6stat),
1810 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1811 		       IPV6CTL_STATS, CTL_EOL);
1812 	sysctl_createv(clog, 0, NULL, NULL,
1813 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1814 		       CTLTYPE_INT, "use_defaultzone",
1815 		       SYSCTL_DESCR("Whether to use the default scope zones"),
1816 		       NULL, 0, &ip6_use_defzone, 0,
1817 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1818 		       IPV6CTL_USE_DEFAULTZONE, CTL_EOL);
1819 	sysctl_createv(clog, 0, NULL, NULL,
1820 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1821 		       CTLTYPE_INT, "mcast_pmtu",
1822 		       SYSCTL_DESCR("Enable pMTU discovery for multicast packet"),
1823 		       NULL, 0, &ip6_mcast_pmtu, 0,
1824 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
1825 		       CTL_CREATE, CTL_EOL);
1826 }
1827