1 /* $NetBSD: ip6_input.c,v 1.63 2003/05/14 14:41:33 itojun Exp $ */ 2 /* $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 /* 34 * Copyright (c) 1982, 1986, 1988, 1993 35 * The Regents of the University of California. All rights reserved. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 3. All advertising materials mentioning features or use of this software 46 * must display the following acknowledgement: 47 * This product includes software developed by the University of 48 * California, Berkeley and its contributors. 49 * 4. Neither the name of the University nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 56 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 63 * SUCH DAMAGE. 64 * 65 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 66 */ 67 68 #include <sys/cdefs.h> 69 __KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.63 2003/05/14 14:41:33 itojun Exp $"); 70 71 #include "opt_inet.h" 72 #include "opt_ipsec.h" 73 #include "opt_pfil_hooks.h" 74 75 #include <sys/param.h> 76 #include <sys/systm.h> 77 #include <sys/malloc.h> 78 #include <sys/mbuf.h> 79 #include <sys/domain.h> 80 #include <sys/protosw.h> 81 #include <sys/socket.h> 82 #include <sys/socketvar.h> 83 #include <sys/errno.h> 84 #include <sys/time.h> 85 #include <sys/kernel.h> 86 #include <sys/syslog.h> 87 #include <sys/proc.h> 88 #include <sys/sysctl.h> 89 90 #include <net/if.h> 91 #include <net/if_types.h> 92 #include <net/if_dl.h> 93 #include <net/route.h> 94 #include <net/netisr.h> 95 #ifdef PFIL_HOOKS 96 #include <net/pfil.h> 97 #endif 98 99 #include <netinet/in.h> 100 #include <netinet/in_systm.h> 101 #ifdef INET 102 #include <netinet/ip.h> 103 #include <netinet/ip_icmp.h> 104 #endif /* INET */ 105 #include <netinet/ip6.h> 106 #include <netinet6/in6_var.h> 107 #include <netinet6/ip6_var.h> 108 #include <netinet6/in6_pcb.h> 109 #include <netinet/icmp6.h> 110 #include <netinet6/in6_ifattach.h> 111 #include <netinet6/nd6.h> 112 113 #ifdef IPSEC 114 #include <netinet6/ipsec.h> 115 #endif 116 117 #include <netinet6/ip6protosw.h> 118 119 /* we need it for NLOOP. */ 120 #include "loop.h" 121 #include "faith.h" 122 #include "gif.h" 123 #include "bpfilter.h" 124 125 #if NGIF > 0 126 #include <netinet6/in6_gif.h> 127 #endif 128 129 #include <net/net_osdep.h> 130 131 extern struct domain inet6domain; 132 133 u_char ip6_protox[IPPROTO_MAX]; 134 static int ip6qmaxlen = IFQ_MAXLEN; 135 struct in6_ifaddr *in6_ifaddr; 136 struct ifqueue ip6intrq; 137 138 extern struct ifnet loif[NLOOP]; 139 int ip6_forward_srcrt; /* XXX */ 140 int ip6_sourcecheck; /* XXX */ 141 int ip6_sourcecheck_interval; /* XXX */ 142 143 #ifdef PFIL_HOOKS 144 struct pfil_head inet6_pfil_hook; 145 #endif 146 147 struct ip6stat ip6stat; 148 149 static void ip6_init2 __P((void *)); 150 151 static int ip6_hopopts_input __P((u_int32_t *, u_int32_t *, struct mbuf **, int *)); 152 static struct mbuf *ip6_pullexthdr __P((struct mbuf *, size_t, int)); 153 154 /* 155 * IP6 initialization: fill in IP6 protocol switch table. 156 * All protocols not implemented in kernel go to raw IP6 protocol handler. 157 */ 158 void 159 ip6_init() 160 { 161 struct ip6protosw *pr; 162 int i; 163 164 pr = (struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW); 165 if (pr == 0) 166 panic("ip6_init"); 167 for (i = 0; i < IPPROTO_MAX; i++) 168 ip6_protox[i] = pr - inet6sw; 169 for (pr = (struct ip6protosw *)inet6domain.dom_protosw; 170 pr < (struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++) 171 if (pr->pr_domain->dom_family == PF_INET6 && 172 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) 173 ip6_protox[pr->pr_protocol] = pr - inet6sw; 174 ip6intrq.ifq_maxlen = ip6qmaxlen; 175 nd6_init(); 176 frag6_init(); 177 ip6_flow_seq = arc4random(); 178 179 ip6_init2((void *)0); 180 181 #ifdef PFIL_HOOKS 182 /* Register our Packet Filter hook. */ 183 inet6_pfil_hook.ph_type = PFIL_TYPE_AF; 184 inet6_pfil_hook.ph_af = AF_INET6; 185 i = pfil_head_register(&inet6_pfil_hook); 186 if (i != 0) 187 printf("ip6_init: WARNING: unable to register pfil hook, " 188 "error %d\n", i); 189 #endif /* PFIL_HOOKS */ 190 } 191 192 static void 193 ip6_init2(dummy) 194 void *dummy; 195 { 196 197 /* nd6_timer_init */ 198 callout_init(&nd6_timer_ch); 199 callout_reset(&nd6_timer_ch, hz, nd6_timer, NULL); 200 } 201 202 /* 203 * IP6 input interrupt handling. Just pass the packet to ip6_input. 204 */ 205 void 206 ip6intr() 207 { 208 int s; 209 struct mbuf *m; 210 211 for (;;) { 212 s = splnet(); 213 IF_DEQUEUE(&ip6intrq, m); 214 splx(s); 215 if (m == 0) 216 return; 217 ip6_input(m); 218 } 219 } 220 221 extern struct route_in6 ip6_forward_rt; 222 223 void 224 ip6_input(m) 225 struct mbuf *m; 226 { 227 struct ip6_hdr *ip6; 228 int off = sizeof(struct ip6_hdr), nest; 229 u_int32_t plen; 230 u_int32_t rtalert = ~0; 231 int nxt, ours = 0; 232 struct ifnet *deliverifp = NULL; 233 234 #ifdef IPSEC 235 /* 236 * should the inner packet be considered authentic? 237 * see comment in ah4_input(). 238 */ 239 m->m_flags &= ~M_AUTHIPHDR; 240 m->m_flags &= ~M_AUTHIPDGM; 241 #endif 242 243 /* 244 * mbuf statistics 245 */ 246 if (m->m_flags & M_EXT) { 247 if (m->m_next) 248 ip6stat.ip6s_mext2m++; 249 else 250 ip6stat.ip6s_mext1++; 251 } else { 252 #define M2MMAX (sizeof(ip6stat.ip6s_m2m)/sizeof(ip6stat.ip6s_m2m[0])) 253 if (m->m_next) { 254 if (m->m_flags & M_LOOP) { 255 ip6stat.ip6s_m2m[loif[0].if_index]++; /* XXX */ 256 } else if (m->m_pkthdr.rcvif->if_index < M2MMAX) 257 ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++; 258 else 259 ip6stat.ip6s_m2m[0]++; 260 } else 261 ip6stat.ip6s_m1++; 262 #undef M2MMAX 263 } 264 265 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive); 266 ip6stat.ip6s_total++; 267 268 /* 269 * If the IPv6 header is not aligned, slurp it up into a new 270 * mbuf with space for link headers, in the event we forward 271 * it. OTherwise, if it is aligned, make sure the entire base 272 * IPv6 header is in the first mbuf of the chain. 273 */ 274 if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) { 275 struct ifnet *inifp = m->m_pkthdr.rcvif; 276 if ((m = m_copyup(m, sizeof(struct ip6_hdr), 277 (max_linkhdr + 3) & ~3)) == NULL) { 278 /* XXXJRT new stat, please */ 279 ip6stat.ip6s_toosmall++; 280 in6_ifstat_inc(inifp, ifs6_in_hdrerr); 281 return; 282 } 283 } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) { 284 struct ifnet *inifp = m->m_pkthdr.rcvif; 285 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 286 ip6stat.ip6s_toosmall++; 287 in6_ifstat_inc(inifp, ifs6_in_hdrerr); 288 return; 289 } 290 } 291 292 ip6 = mtod(m, struct ip6_hdr *); 293 294 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) { 295 ip6stat.ip6s_badvers++; 296 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 297 goto bad; 298 } 299 300 #ifdef PFIL_HOOKS 301 /* 302 * Run through list of hooks for input packets. If there are any 303 * filters which require that additional packets in the flow are 304 * not fast-forwarded, they must clear the M_CANFASTFWD flag. 305 * Note that filters must _never_ set this flag, as another filter 306 * in the list may have previously cleared it. 307 */ 308 /* 309 * let ipfilter look at packet on the wire, 310 * not the decapsulated packet. 311 */ 312 #ifdef IPSEC 313 if (!ipsec_getnhist(m)) 314 #else 315 if (1) 316 #endif 317 { 318 if (pfil_run_hooks(&inet6_pfil_hook, &m, m->m_pkthdr.rcvif, 319 PFIL_IN) != 0) 320 return; 321 if (m == NULL) 322 return; 323 ip6 = mtod(m, struct ip6_hdr *); 324 } 325 #endif /* PFIL_HOOKS */ 326 327 ip6stat.ip6s_nxthist[ip6->ip6_nxt]++; 328 329 #ifdef ALTQ 330 if (altq_input != NULL && (*altq_input)(m, AF_INET6) == 0) { 331 /* packet is dropped by traffic conditioner */ 332 return; 333 } 334 #endif 335 336 /* 337 * Check against address spoofing/corruption. 338 */ 339 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) || 340 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { 341 /* 342 * XXX: "badscope" is not very suitable for a multicast source. 343 */ 344 ip6stat.ip6s_badscope++; 345 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 346 goto bad; 347 } 348 /* 349 * The following check is not documented in specs. A malicious 350 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack 351 * and bypass security checks (act as if it was from 127.0.0.1 by using 352 * IPv6 src ::ffff:127.0.0.1). Be cautious. 353 * 354 * This check chokes if we are in an SIIT cloud. As none of BSDs 355 * support IPv4-less kernel compilation, we cannot support SIIT 356 * environment at all. So, it makes more sense for us to reject any 357 * malicious packets for non-SIIT environment, than try to do a 358 * partial support for SIIT environment. 359 */ 360 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 361 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 362 ip6stat.ip6s_badscope++; 363 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 364 goto bad; 365 } 366 #if 0 367 /* 368 * Reject packets with IPv4 compatible addresses (auto tunnel). 369 * 370 * The code forbids auto tunnel relay case in RFC1933 (the check is 371 * stronger than RFC1933). We may want to re-enable it if mech-xx 372 * is revised to forbid relaying case. 373 */ 374 if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) || 375 IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) { 376 ip6stat.ip6s_badscope++; 377 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 378 goto bad; 379 } 380 #endif 381 382 if (IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) || 383 IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) { 384 if (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) { 385 ours = 1; 386 deliverifp = m->m_pkthdr.rcvif; 387 goto hbhcheck; 388 } else { 389 ip6stat.ip6s_badscope++; 390 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 391 goto bad; 392 } 393 } 394 395 /* drop packets if interface ID portion is already filled */ 396 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { 397 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src) && 398 ip6->ip6_src.s6_addr16[1]) { 399 ip6stat.ip6s_badscope++; 400 goto bad; 401 } 402 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) && 403 ip6->ip6_dst.s6_addr16[1]) { 404 ip6stat.ip6s_badscope++; 405 goto bad; 406 } 407 } 408 409 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) 410 ip6->ip6_src.s6_addr16[1] 411 = htons(m->m_pkthdr.rcvif->if_index); 412 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) 413 ip6->ip6_dst.s6_addr16[1] 414 = htons(m->m_pkthdr.rcvif->if_index); 415 416 /* 417 * We use rt->rt_ifp to determine if the address is ours or not. 418 * If rt_ifp is lo0, the address is ours. 419 * The problem here is, rt->rt_ifp for fe80::%lo0/64 is set to lo0, 420 * so any address under fe80::%lo0/64 will be mistakenly considered 421 * local. The special case is supplied to handle the case properly 422 * by actually looking at interface addresses 423 * (using in6ifa_ifpwithaddr). 424 */ 425 if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) != 0 && 426 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) { 427 if (!in6ifa_ifpwithaddr(m->m_pkthdr.rcvif, &ip6->ip6_dst)) { 428 icmp6_error(m, ICMP6_DST_UNREACH, 429 ICMP6_DST_UNREACH_ADDR, 0); 430 /* m is already freed */ 431 return; 432 } 433 434 ours = 1; 435 deliverifp = m->m_pkthdr.rcvif; 436 goto hbhcheck; 437 } 438 439 /* 440 * Multicast check 441 */ 442 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 443 struct in6_multi *in6m = 0; 444 445 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast); 446 /* 447 * See if we belong to the destination multicast group on the 448 * arrival interface. 449 */ 450 IN6_LOOKUP_MULTI(ip6->ip6_dst, m->m_pkthdr.rcvif, in6m); 451 if (in6m) 452 ours = 1; 453 else if (!ip6_mrouter) { 454 ip6stat.ip6s_notmember++; 455 ip6stat.ip6s_cantforward++; 456 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 457 goto bad; 458 } 459 deliverifp = m->m_pkthdr.rcvif; 460 goto hbhcheck; 461 } 462 463 /* 464 * Unicast check 465 */ 466 if (ip6_forward_rt.ro_rt != NULL && 467 (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) != 0 && 468 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 469 &((struct sockaddr_in6 *)(&ip6_forward_rt.ro_dst))->sin6_addr)) 470 ip6stat.ip6s_forward_cachehit++; 471 else { 472 struct sockaddr_in6 *dst6; 473 474 if (ip6_forward_rt.ro_rt) { 475 /* route is down or destination is different */ 476 ip6stat.ip6s_forward_cachemiss++; 477 RTFREE(ip6_forward_rt.ro_rt); 478 ip6_forward_rt.ro_rt = 0; 479 } 480 481 bzero(&ip6_forward_rt.ro_dst, sizeof(struct sockaddr_in6)); 482 dst6 = (struct sockaddr_in6 *)&ip6_forward_rt.ro_dst; 483 dst6->sin6_len = sizeof(struct sockaddr_in6); 484 dst6->sin6_family = AF_INET6; 485 dst6->sin6_addr = ip6->ip6_dst; 486 487 rtalloc((struct route *)&ip6_forward_rt); 488 } 489 490 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key)) 491 492 /* 493 * Accept the packet if the forwarding interface to the destination 494 * according to the routing table is the loopback interface, 495 * unless the associated route has a gateway. 496 * Note that this approach causes to accept a packet if there is a 497 * route to the loopback interface for the destination of the packet. 498 * But we think it's even useful in some situations, e.g. when using 499 * a special daemon which wants to intercept the packet. 500 */ 501 if (ip6_forward_rt.ro_rt && 502 (ip6_forward_rt.ro_rt->rt_flags & 503 (RTF_HOST|RTF_GATEWAY)) == RTF_HOST && 504 !(ip6_forward_rt.ro_rt->rt_flags & RTF_CLONED) && 505 #if 0 506 /* 507 * The check below is redundant since the comparison of 508 * the destination and the key of the rtentry has 509 * already done through looking up the routing table. 510 */ 511 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 512 &rt6_key(ip6_forward_rt.ro_rt)->sin6_addr) && 513 #endif 514 ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_LOOP) { 515 struct in6_ifaddr *ia6 = 516 (struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa; 517 if (ia6->ia6_flags & IN6_IFF_ANYCAST) 518 m->m_flags |= M_ANYCAST6; 519 /* 520 * packets to a tentative, duplicated, or somehow invalid 521 * address must not be accepted. 522 */ 523 if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) { 524 /* this address is ready */ 525 ours = 1; 526 deliverifp = ia6->ia_ifp; /* correct? */ 527 goto hbhcheck; 528 } else { 529 /* address is not ready, so discard the packet. */ 530 nd6log((LOG_INFO, 531 "ip6_input: packet to an unready address %s->%s\n", 532 ip6_sprintf(&ip6->ip6_src), 533 ip6_sprintf(&ip6->ip6_dst))); 534 535 goto bad; 536 } 537 } 538 539 /* 540 * FAITH (Firewall Aided Internet Translator) 541 */ 542 #if defined(NFAITH) && 0 < NFAITH 543 if (ip6_keepfaith) { 544 if (ip6_forward_rt.ro_rt && ip6_forward_rt.ro_rt->rt_ifp 545 && ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) { 546 /* XXX do we need more sanity checks? */ 547 ours = 1; 548 deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /* faith */ 549 goto hbhcheck; 550 } 551 } 552 #endif 553 554 #if 0 555 { 556 /* 557 * Last resort: check in6_ifaddr for incoming interface. 558 * The code is here until I update the "goto ours hack" code above 559 * working right. 560 */ 561 struct ifaddr *ifa; 562 for (ifa = m->m_pkthdr.rcvif->if_addrlist.tqh_first; 563 ifa; 564 ifa = ifa->ifa_list.tqe_next) { 565 if (ifa->ifa_addr == NULL) 566 continue; /* just for safety */ 567 if (ifa->ifa_addr->sa_family != AF_INET6) 568 continue; 569 if (IN6_ARE_ADDR_EQUAL(IFA_IN6(ifa), &ip6->ip6_dst)) { 570 ours = 1; 571 deliverifp = ifa->ifa_ifp; 572 goto hbhcheck; 573 } 574 } 575 } 576 #endif 577 578 /* 579 * Now there is no reason to process the packet if it's not our own 580 * and we're not a router. 581 */ 582 if (!ip6_forwarding) { 583 ip6stat.ip6s_cantforward++; 584 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 585 goto bad; 586 } 587 588 hbhcheck: 589 /* 590 * Process Hop-by-Hop options header if it's contained. 591 * m may be modified in ip6_hopopts_input(). 592 * If a JumboPayload option is included, plen will also be modified. 593 */ 594 plen = (u_int32_t)ntohs(ip6->ip6_plen); 595 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 596 struct ip6_hbh *hbh; 597 598 if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) { 599 #if 0 /*touches NULL pointer*/ 600 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 601 #endif 602 return; /* m have already been freed */ 603 } 604 605 /* adjust pointer */ 606 ip6 = mtod(m, struct ip6_hdr *); 607 608 /* 609 * if the payload length field is 0 and the next header field 610 * indicates Hop-by-Hop Options header, then a Jumbo Payload 611 * option MUST be included. 612 */ 613 if (ip6->ip6_plen == 0 && plen == 0) { 614 /* 615 * Note that if a valid jumbo payload option is 616 * contained, ip6_hoptops_input() must set a valid 617 * (non-zero) payload length to the variable plen. 618 */ 619 ip6stat.ip6s_badoptions++; 620 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 621 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 622 icmp6_error(m, ICMP6_PARAM_PROB, 623 ICMP6_PARAMPROB_HEADER, 624 (caddr_t)&ip6->ip6_plen - (caddr_t)ip6); 625 return; 626 } 627 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 628 sizeof(struct ip6_hbh)); 629 if (hbh == NULL) { 630 ip6stat.ip6s_tooshort++; 631 return; 632 } 633 KASSERT(IP6_HDR_ALIGNED_P(hbh)); 634 nxt = hbh->ip6h_nxt; 635 636 /* 637 * accept the packet if a router alert option is included 638 * and we act as an IPv6 router. 639 */ 640 if (rtalert != ~0 && ip6_forwarding) 641 ours = 1; 642 } else 643 nxt = ip6->ip6_nxt; 644 645 /* 646 * Check that the amount of data in the buffers 647 * is as at least much as the IPv6 header would have us expect. 648 * Trim mbufs if longer than we expect. 649 * Drop packet if shorter than we expect. 650 */ 651 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) { 652 ip6stat.ip6s_tooshort++; 653 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 654 goto bad; 655 } 656 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) { 657 if (m->m_len == m->m_pkthdr.len) { 658 m->m_len = sizeof(struct ip6_hdr) + plen; 659 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen; 660 } else 661 m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len); 662 } 663 664 /* 665 * Forward if desirable. 666 */ 667 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 668 /* 669 * If we are acting as a multicast router, all 670 * incoming multicast packets are passed to the 671 * kernel-level multicast forwarding function. 672 * The packet is returned (relatively) intact; if 673 * ip6_mforward() returns a non-zero value, the packet 674 * must be discarded, else it may be accepted below. 675 */ 676 if (ip6_mrouter && ip6_mforward(ip6, m->m_pkthdr.rcvif, m)) { 677 ip6stat.ip6s_cantforward++; 678 m_freem(m); 679 return; 680 } 681 if (!ours) { 682 m_freem(m); 683 return; 684 } 685 } else if (!ours) { 686 ip6_forward(m, 0); 687 return; 688 } 689 690 ip6 = mtod(m, struct ip6_hdr *); 691 692 /* 693 * Malicious party may be able to use IPv4 mapped addr to confuse 694 * tcp/udp stack and bypass security checks (act as if it was from 695 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious. 696 * 697 * For SIIT end node behavior, you may want to disable the check. 698 * However, you will become vulnerable to attacks using IPv4 mapped 699 * source. 700 */ 701 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 702 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 703 ip6stat.ip6s_badscope++; 704 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 705 goto bad; 706 } 707 708 /* 709 * Tell launch routine the next header 710 */ 711 #ifdef IFA_STATS 712 if (deliverifp != NULL) { 713 struct in6_ifaddr *ia6; 714 ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst); 715 if (ia6) 716 ia6->ia_ifa.ifa_data.ifad_inbytes += m->m_pkthdr.len; 717 } 718 #endif 719 ip6stat.ip6s_delivered++; 720 in6_ifstat_inc(deliverifp, ifs6_in_deliver); 721 nest = 0; 722 723 while (nxt != IPPROTO_DONE) { 724 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { 725 ip6stat.ip6s_toomanyhdr++; 726 goto bad; 727 } 728 729 /* 730 * protection against faulty packet - there should be 731 * more sanity checks in header chain processing. 732 */ 733 if (m->m_pkthdr.len < off) { 734 ip6stat.ip6s_tooshort++; 735 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 736 goto bad; 737 } 738 739 #ifdef IPSEC 740 /* 741 * enforce IPsec policy checking if we are seeing last header. 742 * note that we do not visit this with protocols with pcb layer 743 * code - like udp/tcp/raw ip. 744 */ 745 if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 && 746 ipsec6_in_reject(m, NULL)) { 747 ipsec6stat.in_polvio++; 748 goto bad; 749 } 750 #endif 751 752 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); 753 } 754 return; 755 bad: 756 m_freem(m); 757 } 758 759 /* 760 * Hop-by-Hop options header processing. If a valid jumbo payload option is 761 * included, the real payload length will be stored in plenp. 762 */ 763 static int 764 ip6_hopopts_input(plenp, rtalertp, mp, offp) 765 u_int32_t *plenp; 766 u_int32_t *rtalertp; /* XXX: should be stored more smart way */ 767 struct mbuf **mp; 768 int *offp; 769 { 770 struct mbuf *m = *mp; 771 int off = *offp, hbhlen; 772 struct ip6_hbh *hbh; 773 u_int8_t *opt; 774 775 /* validation of the length of the header */ 776 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, 777 sizeof(struct ip6_hdr), sizeof(struct ip6_hbh)); 778 if (hbh == NULL) { 779 ip6stat.ip6s_tooshort++; 780 return -1; 781 } 782 hbhlen = (hbh->ip6h_len + 1) << 3; 783 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 784 hbhlen); 785 if (hbh == NULL) { 786 ip6stat.ip6s_tooshort++; 787 return -1; 788 } 789 KASSERT(IP6_HDR_ALIGNED_P(hbh)); 790 off += hbhlen; 791 hbhlen -= sizeof(struct ip6_hbh); 792 opt = (u_int8_t *)hbh + sizeof(struct ip6_hbh); 793 794 if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh), 795 hbhlen, rtalertp, plenp) < 0) 796 return (-1); 797 798 *offp = off; 799 *mp = m; 800 return (0); 801 } 802 803 /* 804 * Search header for all Hop-by-hop options and process each option. 805 * This function is separate from ip6_hopopts_input() in order to 806 * handle a case where the sending node itself process its hop-by-hop 807 * options header. In such a case, the function is called from ip6_output(). 808 * 809 * The function assumes that hbh header is located right after the IPv6 header 810 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to 811 * opthead + hbhlen is located in continuous memory region. 812 */ 813 int 814 ip6_process_hopopts(m, opthead, hbhlen, rtalertp, plenp) 815 struct mbuf *m; 816 u_int8_t *opthead; 817 int hbhlen; 818 u_int32_t *rtalertp; 819 u_int32_t *plenp; 820 { 821 struct ip6_hdr *ip6; 822 int optlen = 0; 823 u_int8_t *opt = opthead; 824 u_int16_t rtalert_val; 825 u_int32_t jumboplen; 826 const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh); 827 828 for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) { 829 switch (*opt) { 830 case IP6OPT_PAD1: 831 optlen = 1; 832 break; 833 case IP6OPT_PADN: 834 if (hbhlen < IP6OPT_MINLEN) { 835 ip6stat.ip6s_toosmall++; 836 goto bad; 837 } 838 optlen = *(opt + 1) + 2; 839 break; 840 case IP6OPT_RTALERT: 841 /* XXX may need check for alignment */ 842 if (hbhlen < IP6OPT_RTALERT_LEN) { 843 ip6stat.ip6s_toosmall++; 844 goto bad; 845 } 846 if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) { 847 /* XXX stat */ 848 icmp6_error(m, ICMP6_PARAM_PROB, 849 ICMP6_PARAMPROB_HEADER, 850 erroff + opt + 1 - opthead); 851 return (-1); 852 } 853 optlen = IP6OPT_RTALERT_LEN; 854 bcopy((caddr_t)(opt + 2), (caddr_t)&rtalert_val, 2); 855 *rtalertp = ntohs(rtalert_val); 856 break; 857 case IP6OPT_JUMBO: 858 /* XXX may need check for alignment */ 859 if (hbhlen < IP6OPT_JUMBO_LEN) { 860 ip6stat.ip6s_toosmall++; 861 goto bad; 862 } 863 if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) { 864 /* XXX stat */ 865 icmp6_error(m, ICMP6_PARAM_PROB, 866 ICMP6_PARAMPROB_HEADER, 867 erroff + opt + 1 - opthead); 868 return (-1); 869 } 870 optlen = IP6OPT_JUMBO_LEN; 871 872 /* 873 * IPv6 packets that have non 0 payload length 874 * must not contain a jumbo payload option. 875 */ 876 ip6 = mtod(m, struct ip6_hdr *); 877 if (ip6->ip6_plen) { 878 ip6stat.ip6s_badoptions++; 879 icmp6_error(m, ICMP6_PARAM_PROB, 880 ICMP6_PARAMPROB_HEADER, 881 erroff + opt - opthead); 882 return (-1); 883 } 884 885 /* 886 * We may see jumbolen in unaligned location, so 887 * we'd need to perform bcopy(). 888 */ 889 bcopy(opt + 2, &jumboplen, sizeof(jumboplen)); 890 jumboplen = (u_int32_t)htonl(jumboplen); 891 892 #if 1 893 /* 894 * if there are multiple jumbo payload options, 895 * *plenp will be non-zero and the packet will be 896 * rejected. 897 * the behavior may need some debate in ipngwg - 898 * multiple options does not make sense, however, 899 * there's no explicit mention in specification. 900 */ 901 if (*plenp != 0) { 902 ip6stat.ip6s_badoptions++; 903 icmp6_error(m, ICMP6_PARAM_PROB, 904 ICMP6_PARAMPROB_HEADER, 905 erroff + opt + 2 - opthead); 906 return (-1); 907 } 908 #endif 909 910 /* 911 * jumbo payload length must be larger than 65535. 912 */ 913 if (jumboplen <= IPV6_MAXPACKET) { 914 ip6stat.ip6s_badoptions++; 915 icmp6_error(m, ICMP6_PARAM_PROB, 916 ICMP6_PARAMPROB_HEADER, 917 erroff + opt + 2 - opthead); 918 return (-1); 919 } 920 *plenp = jumboplen; 921 922 break; 923 default: /* unknown option */ 924 if (hbhlen < IP6OPT_MINLEN) { 925 ip6stat.ip6s_toosmall++; 926 goto bad; 927 } 928 optlen = ip6_unknown_opt(opt, m, 929 erroff + opt - opthead); 930 if (optlen == -1) 931 return (-1); 932 optlen += 2; 933 break; 934 } 935 } 936 937 return (0); 938 939 bad: 940 m_freem(m); 941 return (-1); 942 } 943 944 /* 945 * Unknown option processing. 946 * The third argument `off' is the offset from the IPv6 header to the option, 947 * which is necessary if the IPv6 header the and option header and IPv6 header 948 * is not continuous in order to return an ICMPv6 error. 949 */ 950 int 951 ip6_unknown_opt(optp, m, off) 952 u_int8_t *optp; 953 struct mbuf *m; 954 int off; 955 { 956 struct ip6_hdr *ip6; 957 958 switch (IP6OPT_TYPE(*optp)) { 959 case IP6OPT_TYPE_SKIP: /* ignore the option */ 960 return ((int)*(optp + 1)); 961 case IP6OPT_TYPE_DISCARD: /* silently discard */ 962 m_freem(m); 963 return (-1); 964 case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */ 965 ip6stat.ip6s_badoptions++; 966 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off); 967 return (-1); 968 case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */ 969 ip6stat.ip6s_badoptions++; 970 ip6 = mtod(m, struct ip6_hdr *); 971 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 972 (m->m_flags & (M_BCAST|M_MCAST))) 973 m_freem(m); 974 else 975 icmp6_error(m, ICMP6_PARAM_PROB, 976 ICMP6_PARAMPROB_OPTION, off); 977 return (-1); 978 } 979 980 m_freem(m); /* XXX: NOTREACHED */ 981 return (-1); 982 } 983 984 /* 985 * Create the "control" list for this pcb. 986 * 987 * The routine will be called from upper layer handlers like tcp6_input(). 988 * Thus the routine assumes that the caller (tcp6_input) have already 989 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the 990 * very first mbuf on the mbuf chain. 991 * We may want to add some infinite loop prevention or sanity checks for safety. 992 * (This applies only when you are using KAME mbuf chain restriction, i.e. 993 * you are using IP6_EXTHDR_CHECK() not m_pulldown()) 994 */ 995 void 996 ip6_savecontrol(in6p, mp, ip6, m) 997 struct in6pcb *in6p; 998 struct mbuf **mp; 999 struct ip6_hdr *ip6; 1000 struct mbuf *m; 1001 { 1002 struct proc *p = curproc; /* XXX */ 1003 int privileged; 1004 1005 privileged = 0; 1006 if (p && !suser(p->p_ucred, &p->p_acflag)) 1007 privileged++; 1008 1009 #ifdef SO_TIMESTAMP 1010 if (in6p->in6p_socket->so_options & SO_TIMESTAMP) { 1011 struct timeval tv; 1012 1013 microtime(&tv); 1014 *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv), 1015 SCM_TIMESTAMP, SOL_SOCKET); 1016 if (*mp) 1017 mp = &(*mp)->m_next; 1018 } 1019 #endif 1020 if (in6p->in6p_flags & IN6P_RECVDSTADDR) { 1021 *mp = sbcreatecontrol((caddr_t) &ip6->ip6_dst, 1022 sizeof(struct in6_addr), IPV6_RECVDSTADDR, IPPROTO_IPV6); 1023 if (*mp) 1024 mp = &(*mp)->m_next; 1025 } 1026 1027 #ifdef noyet 1028 /* options were tossed above */ 1029 if (in6p->in6p_flags & IN6P_RECVOPTS) 1030 /* broken */ 1031 /* ip6_srcroute doesn't do what we want here, need to fix */ 1032 if (in6p->in6p_flags & IPV6P_RECVRETOPTS) 1033 /* broken */ 1034 #endif 1035 1036 /* RFC 2292 sec. 5 */ 1037 if ((in6p->in6p_flags & IN6P_PKTINFO) != 0) { 1038 struct in6_pktinfo pi6; 1039 bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr)); 1040 if (IN6_IS_SCOPE_LINKLOCAL(&pi6.ipi6_addr)) 1041 pi6.ipi6_addr.s6_addr16[1] = 0; 1042 pi6.ipi6_ifindex = (m && m->m_pkthdr.rcvif) 1043 ? m->m_pkthdr.rcvif->if_index 1044 : 0; 1045 *mp = sbcreatecontrol((caddr_t) &pi6, 1046 sizeof(struct in6_pktinfo), IPV6_PKTINFO, IPPROTO_IPV6); 1047 if (*mp) 1048 mp = &(*mp)->m_next; 1049 } 1050 if (in6p->in6p_flags & IN6P_HOPLIMIT) { 1051 int hlim = ip6->ip6_hlim & 0xff; 1052 *mp = sbcreatecontrol((caddr_t) &hlim, sizeof(int), 1053 IPV6_HOPLIMIT, IPPROTO_IPV6); 1054 if (*mp) 1055 mp = &(*mp)->m_next; 1056 } 1057 /* IN6P_NEXTHOP - for outgoing packet only */ 1058 1059 /* 1060 * IPV6_HOPOPTS socket option. We require super-user privilege 1061 * for the option, but it might be too strict, since there might 1062 * be some hop-by-hop options which can be returned to normal user. 1063 * See RFC 2292 section 6. 1064 */ 1065 if ((in6p->in6p_flags & IN6P_HOPOPTS) != 0 && privileged) { 1066 /* 1067 * Check if a hop-by-hop options header is contatined in the 1068 * received packet, and if so, store the options as ancillary 1069 * data. Note that a hop-by-hop options header must be 1070 * just after the IPv6 header, which fact is assured through 1071 * the IPv6 input processing. 1072 */ 1073 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1074 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 1075 struct ip6_hbh *hbh; 1076 int hbhlen; 1077 struct mbuf *ext; 1078 1079 ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr), 1080 ip6->ip6_nxt); 1081 if (ext == NULL) { 1082 ip6stat.ip6s_tooshort++; 1083 return; 1084 } 1085 hbh = mtod(ext, struct ip6_hbh *); 1086 hbhlen = (hbh->ip6h_len + 1) << 3; 1087 if (hbhlen != ext->m_len) { 1088 m_freem(ext); 1089 ip6stat.ip6s_tooshort++; 1090 return; 1091 } 1092 1093 /* 1094 * XXX: We copy whole the header even if a jumbo 1095 * payload option is included, which option is to 1096 * be removed before returning in the RFC 2292. 1097 * But it's too painful operation... 1098 */ 1099 *mp = sbcreatecontrol((caddr_t)hbh, hbhlen, 1100 IPV6_HOPOPTS, IPPROTO_IPV6); 1101 if (*mp) 1102 mp = &(*mp)->m_next; 1103 m_freem(ext); 1104 } 1105 } 1106 1107 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */ 1108 if (in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDR)) { 1109 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1110 int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr); 1111 1112 /* 1113 * Search for destination options headers or routing 1114 * header(s) through the header chain, and stores each 1115 * header as ancillary data. 1116 * Note that the order of the headers remains in 1117 * the chain of ancillary data. 1118 */ 1119 while (1) { /* is explicit loop prevention necessary? */ 1120 struct ip6_ext *ip6e = NULL; 1121 int elen; 1122 struct mbuf *ext = NULL; 1123 1124 /* 1125 * if it is not an extension header, don't try to 1126 * pull it from the chain. 1127 */ 1128 switch (nxt) { 1129 case IPPROTO_DSTOPTS: 1130 case IPPROTO_ROUTING: 1131 case IPPROTO_HOPOPTS: 1132 case IPPROTO_AH: /* is it possible? */ 1133 break; 1134 default: 1135 goto loopend; 1136 } 1137 1138 ext = ip6_pullexthdr(m, off, nxt); 1139 if (ext == NULL) { 1140 ip6stat.ip6s_tooshort++; 1141 return; 1142 } 1143 ip6e = mtod(ext, struct ip6_ext *); 1144 if (nxt == IPPROTO_AH) 1145 elen = (ip6e->ip6e_len + 2) << 2; 1146 else 1147 elen = (ip6e->ip6e_len + 1) << 3; 1148 if (elen != ext->m_len) { 1149 m_freem(ext); 1150 ip6stat.ip6s_tooshort++; 1151 return; 1152 } 1153 KASSERT(IP6_HDR_ALIGNED_P(ip6e)); 1154 1155 switch (nxt) { 1156 case IPPROTO_DSTOPTS: 1157 if (!in6p->in6p_flags & IN6P_DSTOPTS) 1158 break; 1159 1160 /* 1161 * We also require super-user privilege for 1162 * the option. 1163 * See the comments on IN6_HOPOPTS. 1164 */ 1165 if (!privileged) 1166 break; 1167 1168 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1169 IPV6_DSTOPTS, IPPROTO_IPV6); 1170 if (*mp) 1171 mp = &(*mp)->m_next; 1172 break; 1173 1174 case IPPROTO_ROUTING: 1175 if (!in6p->in6p_flags & IN6P_RTHDR) 1176 break; 1177 1178 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1179 IPV6_RTHDR, IPPROTO_IPV6); 1180 if (*mp) 1181 mp = &(*mp)->m_next; 1182 break; 1183 1184 case IPPROTO_HOPOPTS: 1185 case IPPROTO_AH: /* is it possible? */ 1186 break; 1187 1188 default: 1189 /* 1190 * other cases have been filtered in the above. 1191 * none will visit this case. here we supply 1192 * the code just in case (nxt overwritten or 1193 * other cases). 1194 */ 1195 m_freem(ext); 1196 goto loopend; 1197 1198 } 1199 1200 /* proceed with the next header. */ 1201 off += elen; 1202 nxt = ip6e->ip6e_nxt; 1203 ip6e = NULL; 1204 m_freem(ext); 1205 ext = NULL; 1206 } 1207 loopend: 1208 ; 1209 } 1210 } 1211 1212 /* 1213 * pull single extension header from mbuf chain. returns single mbuf that 1214 * contains the result, or NULL on error. 1215 */ 1216 static struct mbuf * 1217 ip6_pullexthdr(m, off, nxt) 1218 struct mbuf *m; 1219 size_t off; 1220 int nxt; 1221 { 1222 struct ip6_ext ip6e; 1223 size_t elen; 1224 struct mbuf *n; 1225 1226 #ifdef DIAGNOSTIC 1227 switch (nxt) { 1228 case IPPROTO_DSTOPTS: 1229 case IPPROTO_ROUTING: 1230 case IPPROTO_HOPOPTS: 1231 case IPPROTO_AH: /* is it possible? */ 1232 break; 1233 default: 1234 printf("ip6_pullexthdr: invalid nxt=%d\n", nxt); 1235 } 1236 #endif 1237 1238 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1239 if (nxt == IPPROTO_AH) 1240 elen = (ip6e.ip6e_len + 2) << 2; 1241 else 1242 elen = (ip6e.ip6e_len + 1) << 3; 1243 1244 MGET(n, M_DONTWAIT, MT_DATA); 1245 if (n && elen >= MLEN) { 1246 MCLGET(n, M_DONTWAIT); 1247 if ((n->m_flags & M_EXT) == 0) { 1248 m_free(n); 1249 n = NULL; 1250 } 1251 } 1252 if (!n) 1253 return NULL; 1254 1255 n->m_len = 0; 1256 if (elen >= M_TRAILINGSPACE(n)) { 1257 m_free(n); 1258 return NULL; 1259 } 1260 1261 m_copydata(m, off, elen, mtod(n, caddr_t)); 1262 n->m_len = elen; 1263 return n; 1264 } 1265 1266 /* 1267 * Get pointer to the previous header followed by the header 1268 * currently processed. 1269 * XXX: This function supposes that 1270 * M includes all headers, 1271 * the next header field and the header length field of each header 1272 * are valid, and 1273 * the sum of each header length equals to OFF. 1274 * Because of these assumptions, this function must be called very 1275 * carefully. Moreover, it will not be used in the near future when 1276 * we develop `neater' mechanism to process extension headers. 1277 */ 1278 u_int8_t * 1279 ip6_get_prevhdr(m, off) 1280 struct mbuf *m; 1281 int off; 1282 { 1283 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1284 1285 if (off == sizeof(struct ip6_hdr)) 1286 return (&ip6->ip6_nxt); 1287 else { 1288 int len, nxt; 1289 struct ip6_ext *ip6e = NULL; 1290 1291 nxt = ip6->ip6_nxt; 1292 len = sizeof(struct ip6_hdr); 1293 while (len < off) { 1294 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + len); 1295 1296 switch (nxt) { 1297 case IPPROTO_FRAGMENT: 1298 len += sizeof(struct ip6_frag); 1299 break; 1300 case IPPROTO_AH: 1301 len += (ip6e->ip6e_len + 2) << 2; 1302 break; 1303 default: 1304 len += (ip6e->ip6e_len + 1) << 3; 1305 break; 1306 } 1307 nxt = ip6e->ip6e_nxt; 1308 } 1309 if (ip6e) 1310 return (&ip6e->ip6e_nxt); 1311 else 1312 return NULL; 1313 } 1314 } 1315 1316 /* 1317 * get next header offset. m will be retained. 1318 */ 1319 int 1320 ip6_nexthdr(m, off, proto, nxtp) 1321 struct mbuf *m; 1322 int off; 1323 int proto; 1324 int *nxtp; 1325 { 1326 struct ip6_hdr ip6; 1327 struct ip6_ext ip6e; 1328 struct ip6_frag fh; 1329 1330 /* just in case */ 1331 if (m == NULL) 1332 panic("ip6_nexthdr: m == NULL"); 1333 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off) 1334 return -1; 1335 1336 switch (proto) { 1337 case IPPROTO_IPV6: 1338 if (m->m_pkthdr.len < off + sizeof(ip6)) 1339 return -1; 1340 m_copydata(m, off, sizeof(ip6), (caddr_t)&ip6); 1341 if (nxtp) 1342 *nxtp = ip6.ip6_nxt; 1343 off += sizeof(ip6); 1344 return off; 1345 1346 case IPPROTO_FRAGMENT: 1347 /* 1348 * terminate parsing if it is not the first fragment, 1349 * it does not make sense to parse through it. 1350 */ 1351 if (m->m_pkthdr.len < off + sizeof(fh)) 1352 return -1; 1353 m_copydata(m, off, sizeof(fh), (caddr_t)&fh); 1354 if ((ntohs(fh.ip6f_offlg) & IP6F_OFF_MASK) != 0) 1355 return -1; 1356 if (nxtp) 1357 *nxtp = fh.ip6f_nxt; 1358 off += sizeof(struct ip6_frag); 1359 return off; 1360 1361 case IPPROTO_AH: 1362 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1363 return -1; 1364 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1365 if (nxtp) 1366 *nxtp = ip6e.ip6e_nxt; 1367 off += (ip6e.ip6e_len + 2) << 2; 1368 if (m->m_pkthdr.len < off) 1369 return -1; 1370 return off; 1371 1372 case IPPROTO_HOPOPTS: 1373 case IPPROTO_ROUTING: 1374 case IPPROTO_DSTOPTS: 1375 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1376 return -1; 1377 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1378 if (nxtp) 1379 *nxtp = ip6e.ip6e_nxt; 1380 off += (ip6e.ip6e_len + 1) << 3; 1381 if (m->m_pkthdr.len < off) 1382 return -1; 1383 return off; 1384 1385 case IPPROTO_NONE: 1386 case IPPROTO_ESP: 1387 case IPPROTO_IPCOMP: 1388 /* give up */ 1389 return -1; 1390 1391 default: 1392 return -1; 1393 } 1394 } 1395 1396 /* 1397 * get offset for the last header in the chain. m will be kept untainted. 1398 */ 1399 int 1400 ip6_lasthdr(m, off, proto, nxtp) 1401 struct mbuf *m; 1402 int off; 1403 int proto; 1404 int *nxtp; 1405 { 1406 int newoff; 1407 int nxt; 1408 1409 if (!nxtp) { 1410 nxt = -1; 1411 nxtp = &nxt; 1412 } 1413 while (1) { 1414 newoff = ip6_nexthdr(m, off, proto, nxtp); 1415 if (newoff < 0) 1416 return off; 1417 else if (newoff < off) 1418 return -1; /* invalid */ 1419 else if (newoff == off) 1420 return newoff; 1421 1422 off = newoff; 1423 proto = *nxtp; 1424 } 1425 } 1426 1427 /* 1428 * System control for IP6 1429 */ 1430 1431 u_char inet6ctlerrmap[PRC_NCMDS] = { 1432 0, 0, 0, 0, 1433 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, 1434 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, 1435 EMSGSIZE, EHOSTUNREACH, 0, 0, 1436 0, 0, 0, 0, 1437 ENOPROTOOPT 1438 }; 1439 1440 int 1441 ip6_sysctl(name, namelen, oldp, oldlenp, newp, newlen) 1442 int *name; 1443 u_int namelen; 1444 void *oldp; 1445 size_t *oldlenp; 1446 void *newp; 1447 size_t newlen; 1448 { 1449 int old, error; 1450 1451 /* All sysctl names at this level are terminal. */ 1452 if (namelen != 1) 1453 return ENOTDIR; 1454 1455 switch (name[0]) { 1456 1457 case IPV6CTL_FORWARDING: 1458 return sysctl_int(oldp, oldlenp, newp, newlen, 1459 &ip6_forwarding); 1460 case IPV6CTL_SENDREDIRECTS: 1461 return sysctl_int(oldp, oldlenp, newp, newlen, 1462 &ip6_sendredirects); 1463 case IPV6CTL_DEFHLIM: 1464 return sysctl_int(oldp, oldlenp, newp, newlen, &ip6_defhlim); 1465 case IPV6CTL_MAXFRAGPACKETS: 1466 return sysctl_int(oldp, oldlenp, newp, newlen, 1467 &ip6_maxfragpackets); 1468 case IPV6CTL_ACCEPT_RTADV: 1469 return sysctl_int(oldp, oldlenp, newp, newlen, 1470 &ip6_accept_rtadv); 1471 case IPV6CTL_KEEPFAITH: 1472 return sysctl_int(oldp, oldlenp, newp, newlen, &ip6_keepfaith); 1473 case IPV6CTL_LOG_INTERVAL: 1474 return sysctl_int(oldp, oldlenp, newp, newlen, 1475 &ip6_log_interval); 1476 case IPV6CTL_HDRNESTLIMIT: 1477 return sysctl_int(oldp, oldlenp, newp, newlen, 1478 &ip6_hdrnestlimit); 1479 case IPV6CTL_DAD_COUNT: 1480 return sysctl_int(oldp, oldlenp, newp, newlen, &ip6_dad_count); 1481 case IPV6CTL_AUTO_FLOWLABEL: 1482 return sysctl_int(oldp, oldlenp, newp, newlen, 1483 &ip6_auto_flowlabel); 1484 case IPV6CTL_DEFMCASTHLIM: 1485 return sysctl_int(oldp, oldlenp, newp, newlen, 1486 &ip6_defmcasthlim); 1487 #if NGIF > 0 1488 case IPV6CTL_GIF_HLIM: 1489 return sysctl_int(oldp, oldlenp, newp, newlen, 1490 &ip6_gif_hlim); 1491 #endif 1492 case IPV6CTL_KAME_VERSION: 1493 return sysctl_rdstring(oldp, oldlenp, newp, __KAME_VERSION); 1494 case IPV6CTL_USE_DEPRECATED: 1495 return sysctl_int(oldp, oldlenp, newp, newlen, 1496 &ip6_use_deprecated); 1497 case IPV6CTL_RR_PRUNE: 1498 return sysctl_int(oldp, oldlenp, newp, newlen, &ip6_rr_prune); 1499 case IPV6CTL_V6ONLY: 1500 #ifdef INET6_BINDV6ONLY 1501 return sysctl_rdint(oldp, oldlenp, newp, ip6_v6only); 1502 #else 1503 return sysctl_int(oldp, oldlenp, newp, newlen, &ip6_v6only); 1504 #endif 1505 case IPV6CTL_ANONPORTMIN: 1506 old = ip6_anonportmin; 1507 error = sysctl_int(oldp, oldlenp, newp, newlen, 1508 &ip6_anonportmin); 1509 if (ip6_anonportmin >= ip6_anonportmax || ip6_anonportmin < 0 || 1510 ip6_anonportmin > 65535 1511 #ifndef IPNOPRIVPORTS 1512 || ip6_anonportmin < IPV6PORT_RESERVED 1513 #endif 1514 ) { 1515 ip6_anonportmin = old; 1516 return (EINVAL); 1517 } 1518 return (error); 1519 case IPV6CTL_ANONPORTMAX: 1520 old = ip6_anonportmax; 1521 error = sysctl_int(oldp, oldlenp, newp, newlen, 1522 &ip6_anonportmax); 1523 if (ip6_anonportmin >= ip6_anonportmax || ip6_anonportmax < 0 || 1524 ip6_anonportmax > 65535 1525 #ifndef IPNOPRIVPORTS 1526 || ip6_anonportmax < IPV6PORT_RESERVED 1527 #endif 1528 ) { 1529 ip6_anonportmax = old; 1530 return (EINVAL); 1531 } 1532 return (error); 1533 #ifndef IPNOPRIVPORTS 1534 case IPV6CTL_LOWPORTMIN: 1535 old = ip6_lowportmin; 1536 error = sysctl_int(oldp, oldlenp, newp, newlen, 1537 &ip6_lowportmin); 1538 if (ip6_lowportmin >= ip6_lowportmax || 1539 ip6_lowportmin > IPV6PORT_RESERVEDMAX || 1540 ip6_lowportmin < IPV6PORT_RESERVEDMIN) { 1541 ip6_lowportmin = old; 1542 return (EINVAL); 1543 } 1544 return (error); 1545 case IPV6CTL_LOWPORTMAX: 1546 old = ip6_lowportmax; 1547 error = sysctl_int(oldp, oldlenp, newp, newlen, 1548 &ip6_lowportmax); 1549 if (ip6_lowportmin >= ip6_lowportmax || 1550 ip6_lowportmax > IPV6PORT_RESERVEDMAX || 1551 ip6_lowportmax < IPV6PORT_RESERVEDMIN) { 1552 ip6_lowportmax = old; 1553 return (EINVAL); 1554 } 1555 return (error); 1556 #endif 1557 case IPV6CTL_MAXFRAGS: 1558 return sysctl_int(oldp, oldlenp, newp, newlen, &ip6_maxfrags); 1559 default: 1560 return EOPNOTSUPP; 1561 } 1562 /* NOTREACHED */ 1563 } 1564