Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/bsd/netinet6/icmp6.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* $FreeBSD: src/sys/netinet6/icmp6.c,v 1.6.2.6 2001/07/10 09:44:16 ume Exp $ */ 2 /* $KAME: icmp6.c,v 1.211 2001/04/04 05:56:20 itojun Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 /* 34 * Copyright (c) 1982, 1986, 1988, 1993 35 * The Regents of the University of California. All rights reserved. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 3. All advertising materials mentioning features or use of this software 46 * must display the following acknowledgement: 47 * This product includes software developed by the University of 48 * California, Berkeley and its contributors. 49 * 4. Neither the name of the University nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 56 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 63 * SUCH DAMAGE. 64 * 65 * @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94 66 */ 67 68 69 #include <sys/param.h> 70 #include <sys/systm.h> 71 #include <sys/malloc.h> 72 #include <sys/mbuf.h> 73 #include <sys/protosw.h> 74 #include <sys/socket.h> 75 #include <sys/socketvar.h> 76 #include <sys/time.h> 77 #include <sys/kernel.h> 78 #include <sys/syslog.h> 79 #include <sys/domain.h> 80 81 #include <net/if.h> 82 #include <net/route.h> 83 #include <net/if_dl.h> 84 #include <net/if_types.h> 85 86 #include <netinet/in.h> 87 #include <netinet/in_var.h> 88 #include <netinet/ip6.h> 89 #include <netinet6/ip6_var.h> 90 #include <netinet/icmp6.h> 91 #include <netinet6/mld6_var.h> 92 #include <netinet/in_pcb.h> 93 #include <netinet6/in6_pcb.h> 94 #include <netinet6/nd6.h> 95 #include <netinet6/in6_ifattach.h> 96 #include <netinet6/ip6protosw.h> 97 98 #if IPSEC 99 #include <netinet6/ipsec.h> 100 #include <netkey/key.h> 101 102 extern int ipsec_bypass; 103 #endif 104 105 #include "faith.h" 106 #if defined(NFAITH) && 0 < NFAITH 107 #include <net/if_faith.h> 108 #endif 109 110 #include <net/net_osdep.h> 111 112 #if HAVE_NRL_INPCB 113 /* inpcb members */ 114 #define in6pcb inpcb 115 #define in6p_laddr inp_laddr6 116 #define in6p_faddr inp_faddr6 117 #define in6p_icmp6filt inp_icmp6filt 118 #define in6p_route inp_route 119 #define in6p_socket inp_socket 120 #define in6p_flags inp_flags 121 #define in6p_moptions inp_moptions6 122 #define in6p_outputopts inp_outputopts6 123 #define in6p_ip6 inp_ipv6 124 #define in6p_flowinfo inp_flowinfo 125 #define in6p_sp inp_sp 126 #define in6p_next inp_next 127 #define in6p_prev inp_prev 128 /* macro names */ 129 #define sotoin6pcb sotoinpcb 130 /* function names */ 131 #define in6_pcbdetach in_pcbdetach 132 #define in6_rtchange in_rtchange 133 134 /* 135 * for KAME src sync over BSD*'s. XXX: FreeBSD (>=3) are VERY different from 136 * others... 137 */ 138 #define in6p_ip6_nxt inp_ipv6.ip6_nxt 139 #endif 140 141 extern struct domain inet6domain; 142 extern struct ip6protosw inet6sw[]; 143 extern struct ip6protosw *ip6_protox[]; 144 145 struct icmp6stat icmp6stat; 146 147 extern struct inpcbhead ripcb; 148 extern int icmp6errppslim; 149 static int icmp6errpps_count = 0; 150 static struct timeval icmp6errppslim_last; 151 extern int icmp6_nodeinfo; 152 153 static void icmp6_errcount __P((struct icmp6errstat *, int, int)); 154 static int icmp6_rip6_input __P((struct mbuf **, int)); 155 static int icmp6_ratelimit __P((const struct in6_addr *, const int, const int)); 156 static const char *icmp6_redirect_diag __P((struct in6_addr *, 157 struct in6_addr *, struct in6_addr *)); 158 #ifndef HAVE_PPSRATECHECK 159 static int ppsratecheck __P((struct timeval *, int *, int)); 160 #endif 161 static struct mbuf *ni6_input __P((struct mbuf *, int)); 162 static struct mbuf *ni6_nametodns __P((const char *, int, int)); 163 static int ni6_dnsmatch __P((const char *, int, const char *, int)); 164 static int ni6_addrs __P((struct icmp6_nodeinfo *, struct mbuf *, 165 struct ifnet **, char *)); 166 static int ni6_store_addrs __P((struct icmp6_nodeinfo *, struct icmp6_nodeinfo *, 167 struct ifnet *, int)); 168 static int icmp6_notify_error __P((struct mbuf *, int, int, int)); 169 170 #ifdef COMPAT_RFC1885 171 static struct route_in6 icmp6_reflect_rt; 172 #endif 173 174 175 void 176 icmp6_init() 177 { 178 mld6_init(); 179 } 180 181 static void 182 icmp6_errcount(stat, type, code) 183 struct icmp6errstat *stat; 184 int type, code; 185 { 186 switch (type) { 187 case ICMP6_DST_UNREACH: 188 switch (code) { 189 case ICMP6_DST_UNREACH_NOROUTE: 190 stat->icp6errs_dst_unreach_noroute++; 191 return; 192 case ICMP6_DST_UNREACH_ADMIN: 193 stat->icp6errs_dst_unreach_admin++; 194 return; 195 case ICMP6_DST_UNREACH_BEYONDSCOPE: 196 stat->icp6errs_dst_unreach_beyondscope++; 197 return; 198 case ICMP6_DST_UNREACH_ADDR: 199 stat->icp6errs_dst_unreach_addr++; 200 return; 201 case ICMP6_DST_UNREACH_NOPORT: 202 stat->icp6errs_dst_unreach_noport++; 203 return; 204 } 205 break; 206 case ICMP6_PACKET_TOO_BIG: 207 stat->icp6errs_packet_too_big++; 208 return; 209 case ICMP6_TIME_EXCEEDED: 210 switch (code) { 211 case ICMP6_TIME_EXCEED_TRANSIT: 212 stat->icp6errs_time_exceed_transit++; 213 return; 214 case ICMP6_TIME_EXCEED_REASSEMBLY: 215 stat->icp6errs_time_exceed_reassembly++; 216 return; 217 } 218 break; 219 case ICMP6_PARAM_PROB: 220 switch (code) { 221 case ICMP6_PARAMPROB_HEADER: 222 stat->icp6errs_paramprob_header++; 223 return; 224 case ICMP6_PARAMPROB_NEXTHEADER: 225 stat->icp6errs_paramprob_nextheader++; 226 return; 227 case ICMP6_PARAMPROB_OPTION: 228 stat->icp6errs_paramprob_option++; 229 return; 230 } 231 break; 232 case ND_REDIRECT: 233 stat->icp6errs_redirect++; 234 return; 235 } 236 stat->icp6errs_unknown++; 237 } 238 239 /* 240 * Generate an error packet of type error in response to bad IP6 packet. 241 */ 242 void 243 icmp6_error(m, type, code, param) 244 struct mbuf *m; 245 int type, code, param; 246 { 247 struct ip6_hdr *oip6, *nip6; 248 struct icmp6_hdr *icmp6; 249 u_int preplen; 250 int off; 251 int nxt; 252 253 icmp6stat.icp6s_error++; 254 255 /* count per-type-code statistics */ 256 icmp6_errcount(&icmp6stat.icp6s_outerrhist, type, code); 257 258 #ifdef M_DECRYPTED /*not openbsd*/ 259 if (m->m_flags & M_DECRYPTED) { 260 icmp6stat.icp6s_canterror++; 261 goto freeit; 262 } 263 #endif 264 265 #ifndef PULLDOWN_TEST 266 IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), ); 267 #else 268 if (m->m_len < sizeof(struct ip6_hdr)) { 269 m = m_pullup(m, sizeof(struct ip6_hdr)); 270 if (m == NULL) 271 return; 272 } 273 #endif 274 oip6 = mtod(m, struct ip6_hdr *); 275 276 /* 277 * Multicast destination check. For unrecognized option errors, 278 * this check has already done in ip6_unknown_opt(), so we can 279 * check only for other errors. 280 */ 281 if ((m->m_flags & (M_BCAST|M_MCAST) || 282 IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) && 283 (type != ICMP6_PACKET_TOO_BIG && 284 (type != ICMP6_PARAM_PROB || 285 code != ICMP6_PARAMPROB_OPTION))) 286 goto freeit; 287 288 /* Source address check. XXX: the case of anycast source? */ 289 if (IN6_IS_ADDR_UNSPECIFIED(&oip6->ip6_src) || 290 IN6_IS_ADDR_MULTICAST(&oip6->ip6_src)) 291 goto freeit; 292 293 /* 294 * If we are about to send ICMPv6 against ICMPv6 error/redirect, 295 * don't do it. 296 */ 297 nxt = -1; 298 off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt); 299 if (off >= 0 && nxt == IPPROTO_ICMPV6) { 300 struct icmp6_hdr *icp; 301 302 #ifndef PULLDOWN_TEST 303 IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct icmp6_hdr), ); 304 icp = (struct icmp6_hdr *)(mtod(m, caddr_t) + off); 305 #else 306 IP6_EXTHDR_GET(icp, struct icmp6_hdr *, m, off, 307 sizeof(*icp)); 308 if (icp == NULL) { 309 icmp6stat.icp6s_tooshort++; 310 return; 311 } 312 #endif 313 if (icp->icmp6_type < ICMP6_ECHO_REQUEST || 314 icp->icmp6_type == ND_REDIRECT) { 315 /* 316 * ICMPv6 error 317 * Special case: for redirect (which is 318 * informational) we must not send icmp6 error. 319 */ 320 icmp6stat.icp6s_canterror++; 321 goto freeit; 322 } else { 323 /* ICMPv6 informational - send the error */ 324 } 325 } else { 326 /* non-ICMPv6 - send the error */ 327 } 328 329 oip6 = mtod(m, struct ip6_hdr *); /* adjust pointer */ 330 331 /* Finally, do rate limitation check. */ 332 if (icmp6_ratelimit(&oip6->ip6_src, type, code)) { 333 icmp6stat.icp6s_toofreq++; 334 goto freeit; 335 } 336 337 /* 338 * OK, ICMP6 can be generated. 339 */ 340 341 if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN) 342 m_adj(m, ICMPV6_PLD_MAXLEN - m->m_pkthdr.len); 343 344 preplen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr); 345 M_PREPEND(m, preplen, M_DONTWAIT); 346 if (m && m->m_len < preplen) 347 m = m_pullup(m, preplen); 348 if (m == NULL) { 349 nd6log((LOG_DEBUG, "ENOBUFS in icmp6_error %d\n", __LINE__)); 350 return; 351 } 352 353 nip6 = mtod(m, struct ip6_hdr *); 354 nip6->ip6_src = oip6->ip6_src; 355 nip6->ip6_dst = oip6->ip6_dst; 356 357 if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_src)) 358 oip6->ip6_src.s6_addr16[1] = 0; 359 if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_dst)) 360 oip6->ip6_dst.s6_addr16[1] = 0; 361 362 icmp6 = (struct icmp6_hdr *)(nip6 + 1); 363 icmp6->icmp6_type = type; 364 icmp6->icmp6_code = code; 365 icmp6->icmp6_pptr = htonl((u_int32_t)param); 366 367 /* 368 * icmp6_reflect() is designed to be in the input path. 369 * icmp6_error() can be called from both input and outut path, 370 * and if we are in output path rcvif could contain bogus value. 371 * clear m->m_pkthdr.rcvif for safety, we should have enough scope 372 * information in ip header (nip6). 373 */ 374 m->m_pkthdr.rcvif = NULL; 375 376 icmp6stat.icp6s_outhist[type]++; 377 icmp6_reflect(m, sizeof(struct ip6_hdr)); /* header order: IPv6 - ICMPv6 */ 378 379 return; 380 381 freeit: 382 /* 383 * If we can't tell wheter or not we can generate ICMP6, free it. 384 */ 385 m_freem(m); 386 } 387 388 /* 389 * Process a received ICMP6 message. 390 */ 391 int 392 icmp6_input(mp, offp) 393 struct mbuf **mp; 394 int *offp; 395 { 396 struct mbuf *m = *mp, *n; 397 struct ip6_hdr *ip6, *nip6; 398 struct icmp6_hdr *icmp6, *nicmp6; 399 int off = *offp; 400 int icmp6len = m->m_pkthdr.len - *offp; 401 int code, sum, noff; 402 403 #ifndef PULLDOWN_TEST 404 IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_hdr), IPPROTO_DONE); 405 /* m might change if M_LOOP. So, call mtod after this */ 406 #endif 407 408 /* 409 * Locate icmp6 structure in mbuf, and check 410 * that not corrupted and of at least minimum length 411 */ 412 413 ip6 = mtod(m, struct ip6_hdr *); 414 if (icmp6len < sizeof(struct icmp6_hdr)) { 415 icmp6stat.icp6s_tooshort++; 416 goto freeit; 417 } 418 419 /* 420 * calculate the checksum 421 */ 422 #ifndef PULLDOWN_TEST 423 icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off); 424 #else 425 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6)); 426 if (icmp6 == NULL) { 427 icmp6stat.icp6s_tooshort++; 428 return IPPROTO_DONE; 429 } 430 #endif 431 code = icmp6->icmp6_code; 432 433 if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) { 434 nd6log((LOG_ERR, 435 "ICMP6 checksum error(%d|%x) %s\n", 436 icmp6->icmp6_type, sum, ip6_sprintf(&ip6->ip6_src))); 437 icmp6stat.icp6s_checksum++; 438 goto freeit; 439 } 440 441 #if defined(NFAITH) && 0 < NFAITH 442 if (faithprefix(&ip6->ip6_dst)) { 443 /* 444 * Deliver very specific ICMP6 type only. 445 * This is important to deilver TOOBIG. Otherwise PMTUD 446 * will not work. 447 */ 448 switch (icmp6->icmp6_type) { 449 case ICMP6_DST_UNREACH: 450 case ICMP6_PACKET_TOO_BIG: 451 case ICMP6_TIME_EXCEEDED: 452 break; 453 default: 454 goto freeit; 455 } 456 } 457 #endif 458 459 icmp6stat.icp6s_inhist[icmp6->icmp6_type]++; 460 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_msg); 461 if (icmp6->icmp6_type < ICMP6_INFOMSG_MASK) 462 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_error); 463 464 switch (icmp6->icmp6_type) { 465 case ICMP6_DST_UNREACH: 466 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_dstunreach); 467 switch (code) { 468 case ICMP6_DST_UNREACH_NOROUTE: 469 code = PRC_UNREACH_NET; 470 break; 471 case ICMP6_DST_UNREACH_ADMIN: 472 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_adminprohib); 473 code = PRC_UNREACH_PROTOCOL; /* is this a good code? */ 474 break; 475 case ICMP6_DST_UNREACH_ADDR: 476 code = PRC_HOSTDEAD; 477 break; 478 #ifdef COMPAT_RFC1885 479 case ICMP6_DST_UNREACH_NOTNEIGHBOR: 480 code = PRC_UNREACH_SRCFAIL; 481 break; 482 #else 483 case ICMP6_DST_UNREACH_BEYONDSCOPE: 484 /* I mean "source address was incorrect." */ 485 code = PRC_PARAMPROB; 486 break; 487 #endif 488 case ICMP6_DST_UNREACH_NOPORT: 489 code = PRC_UNREACH_PORT; 490 break; 491 default: 492 goto badcode; 493 } 494 goto deliver; 495 break; 496 497 case ICMP6_PACKET_TOO_BIG: 498 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_pkttoobig); 499 if (code != 0) 500 goto badcode; 501 502 code = PRC_MSGSIZE; 503 504 /* 505 * Updating the path MTU will be done after examining 506 * intermediate extension headers. 507 */ 508 goto deliver; 509 break; 510 511 case ICMP6_TIME_EXCEEDED: 512 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_timeexceed); 513 switch (code) { 514 case ICMP6_TIME_EXCEED_TRANSIT: 515 case ICMP6_TIME_EXCEED_REASSEMBLY: 516 code += PRC_TIMXCEED_INTRANS; 517 break; 518 default: 519 goto badcode; 520 } 521 goto deliver; 522 break; 523 524 case ICMP6_PARAM_PROB: 525 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_paramprob); 526 switch (code) { 527 case ICMP6_PARAMPROB_NEXTHEADER: 528 code = PRC_UNREACH_PROTOCOL; 529 break; 530 case ICMP6_PARAMPROB_HEADER: 531 case ICMP6_PARAMPROB_OPTION: 532 code = PRC_PARAMPROB; 533 break; 534 default: 535 goto badcode; 536 } 537 goto deliver; 538 break; 539 540 case ICMP6_ECHO_REQUEST: 541 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echo); 542 if (code != 0) 543 goto badcode; 544 if ((n = m_copy(m, 0, M_COPYALL)) == NULL) { 545 /* Give up remote */ 546 break; 547 } 548 if ((n->m_flags & M_EXT) != 0 549 || n->m_len < off + sizeof(struct icmp6_hdr)) { 550 struct mbuf *n0 = n; 551 const int maxlen = sizeof(*nip6) + sizeof(*nicmp6); 552 553 /* 554 * Prepare an internal mbuf. m_pullup() doesn't 555 * always copy the length we specified. 556 */ 557 if (maxlen >= MCLBYTES) { 558 /* Give up remote */ 559 m_freem(n0); 560 break; 561 } 562 MGETHDR(n, M_DONTWAIT, n0->m_type); 563 if (n && maxlen >= MHLEN) { 564 MCLGET(n, M_DONTWAIT); 565 if ((n->m_flags & M_EXT) == 0) { 566 m_free(n); 567 n = NULL; 568 } 569 } 570 if (n == NULL) { 571 /* Give up remote */ 572 m_freem(n0); 573 break; 574 } 575 M_COPY_PKTHDR(n, n0); 576 /* 577 * Copy IPv6 and ICMPv6 only. 578 */ 579 nip6 = mtod(n, struct ip6_hdr *); 580 bcopy(ip6, nip6, sizeof(struct ip6_hdr)); 581 nicmp6 = (struct icmp6_hdr *)(nip6 + 1); 582 bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr)); 583 noff = sizeof(struct ip6_hdr); 584 n->m_pkthdr.len = n->m_len = 585 noff + sizeof(struct icmp6_hdr); 586 /* 587 * Adjust mbuf. ip6_plen will be adjusted in 588 * ip6_output(). 589 */ 590 m_adj(n0, off + sizeof(struct icmp6_hdr)); 591 n->m_pkthdr.len += n0->m_pkthdr.len; 592 n->m_next = n0; 593 n0->m_flags &= ~M_PKTHDR; 594 } else { 595 nip6 = mtod(n, struct ip6_hdr *); 596 nicmp6 = (struct icmp6_hdr *)((caddr_t)nip6 + off); 597 noff = off; 598 } 599 nicmp6->icmp6_type = ICMP6_ECHO_REPLY; 600 nicmp6->icmp6_code = 0; 601 if (n) { 602 icmp6stat.icp6s_reflect++; 603 icmp6stat.icp6s_outhist[ICMP6_ECHO_REPLY]++; 604 icmp6_reflect(n, noff); 605 } 606 break; 607 608 case ICMP6_ECHO_REPLY: 609 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echoreply); 610 if (code != 0) 611 goto badcode; 612 break; 613 614 case MLD6_LISTENER_QUERY: 615 case MLD6_LISTENER_REPORT: 616 if (icmp6len < sizeof(struct mld6_hdr)) 617 goto badlen; 618 if (icmp6->icmp6_type == MLD6_LISTENER_QUERY) /* XXX: ugly... */ 619 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldquery); 620 else 621 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldreport); 622 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 623 /* give up local */ 624 mld6_input(m, off); 625 m = NULL; 626 goto freeit; 627 } 628 mld6_input(n, off); 629 /* m stays. */ 630 break; 631 632 case MLD6_LISTENER_DONE: 633 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mlddone); 634 if (icmp6len < sizeof(struct mld6_hdr)) /* necessary? */ 635 goto badlen; 636 break; /* nothing to be done in kernel */ 637 638 case MLD6_MTRACE_RESP: 639 case MLD6_MTRACE: 640 /* XXX: these two are experimental. not officially defind. */ 641 /* XXX: per-interface statistics? */ 642 break; /* just pass it to applications */ 643 644 case ICMP6_WRUREQUEST: /* ICMP6_FQDN_QUERY */ 645 { 646 enum { WRU, FQDN } mode; 647 648 if (!icmp6_nodeinfo) 649 break; 650 651 if (icmp6len == sizeof(struct icmp6_hdr) + 4) 652 mode = WRU; 653 else if (icmp6len >= sizeof(struct icmp6_nodeinfo)) 654 mode = FQDN; 655 else 656 goto badlen; 657 658 #define hostnamelen strlen(hostname) 659 if (mode == FQDN) { 660 #ifndef PULLDOWN_TEST 661 IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_nodeinfo), 662 IPPROTO_DONE); 663 #endif 664 n = m_copy(m, 0, M_COPYALL); 665 if (n) 666 n = ni6_input(n, off); 667 /* XXX meaningless if n == NULL */ 668 noff = sizeof(struct ip6_hdr); 669 } else { 670 u_char *p; 671 int maxlen, maxhlen; 672 673 if ((icmp6_nodeinfo & 5) != 5) 674 break; 675 676 if (code != 0) 677 goto badcode; 678 maxlen = sizeof(*nip6) + sizeof(*nicmp6) + 4; 679 if (maxlen >= MCLBYTES) { 680 /* Give up remote */ 681 break; 682 } 683 MGETHDR(n, M_DONTWAIT, m->m_type); 684 if (n && maxlen > MHLEN) { 685 MCLGET(n, M_DONTWAIT); 686 if ((n->m_flags & M_EXT) == 0) { 687 m_free(n); 688 n = NULL; 689 } 690 } 691 if (n == NULL) { 692 /* Give up remote */ 693 break; 694 } 695 n->m_pkthdr.rcvif = NULL; 696 n->m_len = 0; 697 maxhlen = M_TRAILINGSPACE(n) - maxlen; 698 if (maxhlen > hostnamelen) 699 maxhlen = hostnamelen; 700 /* 701 * Copy IPv6 and ICMPv6 only. 702 */ 703 nip6 = mtod(n, struct ip6_hdr *); 704 bcopy(ip6, nip6, sizeof(struct ip6_hdr)); 705 nicmp6 = (struct icmp6_hdr *)(nip6 + 1); 706 bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr)); 707 p = (u_char *)(nicmp6 + 1); 708 bzero(p, 4); 709 bcopy(hostname, p + 4, maxhlen); /* meaningless TTL */ 710 noff = sizeof(struct ip6_hdr); 711 M_COPY_PKTHDR(n, m); /* just for rcvif */ 712 n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) + 713 sizeof(struct icmp6_hdr) + 4 + maxhlen; 714 nicmp6->icmp6_type = ICMP6_WRUREPLY; 715 nicmp6->icmp6_code = 0; 716 } 717 #undef hostnamelen 718 if (n) { 719 icmp6stat.icp6s_reflect++; 720 icmp6stat.icp6s_outhist[ICMP6_WRUREPLY]++; 721 icmp6_reflect(n, noff); 722 } 723 break; 724 } 725 726 case ICMP6_WRUREPLY: 727 if (code != 0) 728 goto badcode; 729 break; 730 731 case ND_ROUTER_SOLICIT: 732 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routersolicit); 733 if (code != 0) 734 goto badcode; 735 if (icmp6len < sizeof(struct nd_router_solicit)) 736 goto badlen; 737 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 738 /* give up local */ 739 nd6_rs_input(m, off, icmp6len); 740 m = NULL; 741 goto freeit; 742 } 743 nd6_rs_input(n, off, icmp6len); 744 /* m stays. */ 745 break; 746 747 case ND_ROUTER_ADVERT: 748 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routeradvert); 749 if (code != 0) 750 goto badcode; 751 if (icmp6len < sizeof(struct nd_router_advert)) 752 goto badlen; 753 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 754 /* give up local */ 755 nd6_ra_input(m, off, icmp6len); 756 m = NULL; 757 goto freeit; 758 } 759 nd6_ra_input(n, off, icmp6len); 760 /* m stays. */ 761 break; 762 763 case ND_NEIGHBOR_SOLICIT: 764 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighborsolicit); 765 if (code != 0) 766 goto badcode; 767 if (icmp6len < sizeof(struct nd_neighbor_solicit)) 768 goto badlen; 769 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 770 /* give up local */ 771 nd6_ns_input(m, off, icmp6len); 772 m = NULL; 773 goto freeit; 774 } 775 nd6_ns_input(n, off, icmp6len); 776 /* m stays. */ 777 break; 778 779 case ND_NEIGHBOR_ADVERT: 780 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighboradvert); 781 if (code != 0) 782 goto badcode; 783 if (icmp6len < sizeof(struct nd_neighbor_advert)) 784 goto badlen; 785 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 786 /* give up local */ 787 nd6_na_input(m, off, icmp6len); 788 m = NULL; 789 goto freeit; 790 } 791 nd6_na_input(n, off, icmp6len); 792 /* m stays. */ 793 break; 794 795 case ND_REDIRECT: 796 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_redirect); 797 if (code != 0) 798 goto badcode; 799 if (icmp6len < sizeof(struct nd_redirect)) 800 goto badlen; 801 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) { 802 /* give up local */ 803 icmp6_redirect_input(m, off); 804 m = NULL; 805 goto freeit; 806 } 807 icmp6_redirect_input(n, off); 808 /* m stays. */ 809 break; 810 811 case ICMP6_ROUTER_RENUMBERING: 812 if (code != ICMP6_ROUTER_RENUMBERING_COMMAND && 813 code != ICMP6_ROUTER_RENUMBERING_RESULT) 814 goto badcode; 815 if (icmp6len < sizeof(struct icmp6_router_renum)) 816 goto badlen; 817 break; 818 819 default: 820 nd6log((LOG_DEBUG, 821 "icmp6_input: unknown type %d(src=%s, dst=%s, ifid=%d)\n", 822 icmp6->icmp6_type, ip6_sprintf(&ip6->ip6_src), 823 ip6_sprintf(&ip6->ip6_dst), 824 m->m_pkthdr.rcvif ? m->m_pkthdr.rcvif->if_index : 0)); 825 if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST) { 826 /* ICMPv6 error: MUST deliver it by spec... */ 827 code = PRC_NCMDS; 828 /* deliver */ 829 } else { 830 /* ICMPv6 informational: MUST not deliver */ 831 break; 832 } 833 deliver: 834 if (icmp6_notify_error(m, off, icmp6len, code)) { 835 /* In this case, m should've been freed. */ 836 return(IPPROTO_DONE); 837 } 838 break; 839 840 badcode: 841 icmp6stat.icp6s_badcode++; 842 break; 843 844 badlen: 845 icmp6stat.icp6s_badlen++; 846 break; 847 } 848 849 /* deliver the packet to appropriate sockets */ 850 icmp6_rip6_input(&m, *offp); 851 852 return IPPROTO_DONE; 853 854 freeit: 855 m_freem(m); 856 return IPPROTO_DONE; 857 } 858 859 static int 860 icmp6_notify_error(m, off, icmp6len, code) 861 struct mbuf *m; 862 int off, icmp6len, code; 863 { 864 struct icmp6_hdr *icmp6; 865 struct ip6_hdr *eip6; 866 u_int32_t notifymtu; 867 struct sockaddr_in6 icmp6src, icmp6dst; 868 869 if (icmp6len < sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr)) { 870 icmp6stat.icp6s_tooshort++; 871 goto freeit; 872 } 873 #ifndef PULLDOWN_TEST 874 IP6_EXTHDR_CHECK(m, off, 875 sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr), 876 -1); 877 icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off); 878 #else 879 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, 880 sizeof(*icmp6) + sizeof(struct ip6_hdr)); 881 if (icmp6 == NULL) { 882 icmp6stat.icp6s_tooshort++; 883 return(-1); 884 } 885 #endif 886 eip6 = (struct ip6_hdr *)(icmp6 + 1); 887 888 /* Detect the upper level protocol */ 889 { 890 void (*ctlfunc) __P((int, struct sockaddr *, void *)); 891 u_int8_t nxt = eip6->ip6_nxt; 892 int eoff = off + sizeof(struct icmp6_hdr) + 893 sizeof(struct ip6_hdr); 894 struct ip6ctlparam ip6cp; 895 struct in6_addr *finaldst = NULL; 896 int icmp6type = icmp6->icmp6_type; 897 struct ip6_frag *fh; 898 struct ip6_rthdr *rth; 899 struct ip6_rthdr0 *rth0; 900 int rthlen; 901 902 while (1) { /* XXX: should avoid infinite loop explicitly? */ 903 struct ip6_ext *eh; 904 905 switch (nxt) { 906 case IPPROTO_HOPOPTS: 907 case IPPROTO_DSTOPTS: 908 case IPPROTO_AH: 909 #ifndef PULLDOWN_TEST 910 IP6_EXTHDR_CHECK(m, 0, eoff + 911 sizeof(struct ip6_ext), 912 -1); 913 eh = (struct ip6_ext *)(mtod(m, caddr_t) 914 + eoff); 915 #else 916 IP6_EXTHDR_GET(eh, struct ip6_ext *, m, 917 eoff, sizeof(*eh)); 918 if (eh == NULL) { 919 icmp6stat.icp6s_tooshort++; 920 return(-1); 921 } 922 #endif 923 924 if (nxt == IPPROTO_AH) 925 eoff += (eh->ip6e_len + 2) << 2; 926 else 927 eoff += (eh->ip6e_len + 1) << 3; 928 nxt = eh->ip6e_nxt; 929 break; 930 case IPPROTO_ROUTING: 931 /* 932 * When the erroneous packet contains a 933 * routing header, we should examine the 934 * header to determine the final destination. 935 * Otherwise, we can't properly update 936 * information that depends on the final 937 * destination (e.g. path MTU). 938 */ 939 #ifndef PULLDOWN_TEST 940 IP6_EXTHDR_CHECK(m, 0, eoff + sizeof(*rth), 941 -1); 942 rth = (struct ip6_rthdr *)(mtod(m, caddr_t) 943 + eoff); 944 #else 945 IP6_EXTHDR_GET(rth, struct ip6_rthdr *, m, 946 eoff, sizeof(*rth)); 947 if (rth == NULL) { 948 icmp6stat.icp6s_tooshort++; 949 return(-1); 950 } 951 #endif 952 rthlen = (rth->ip6r_len + 1) << 3; 953 /* 954 * XXX: currently there is no 955 * officially defined type other 956 * than type-0. 957 * Note that if the segment left field 958 * is 0, all intermediate hops must 959 * have been passed. 960 */ 961 if (rth->ip6r_segleft && 962 rth->ip6r_type == IPV6_RTHDR_TYPE_0) { 963 int hops; 964 965 #ifndef PULLDOWN_TEST 966 IP6_EXTHDR_CHECK(m, 0, eoff + rthlen, 967 -1); 968 rth0 = (struct ip6_rthdr0 *)(mtod(m, caddr_t) + eoff); 969 #else 970 IP6_EXTHDR_GET(rth0, 971 struct ip6_rthdr0 *, m, 972 eoff, rthlen); 973 if (rth0 == NULL) { 974 icmp6stat.icp6s_tooshort++; 975 return(-1); 976 } 977 #endif 978 /* just ignore a bogus header */ 979 if ((rth0->ip6r0_len % 2) == 0 && 980 (hops = rth0->ip6r0_len/2)) 981 finaldst = (struct in6_addr *)(rth0 + 1) + (hops - 1); 982 } 983 eoff += rthlen; 984 nxt = rth->ip6r_nxt; 985 break; 986 case IPPROTO_FRAGMENT: 987 #ifndef PULLDOWN_TEST 988 IP6_EXTHDR_CHECK(m, 0, eoff + 989 sizeof(struct ip6_frag), 990 -1); 991 fh = (struct ip6_frag *)(mtod(m, caddr_t) 992 + eoff); 993 #else 994 IP6_EXTHDR_GET(fh, struct ip6_frag *, m, 995 eoff, sizeof(*fh)); 996 if (fh == NULL) { 997 icmp6stat.icp6s_tooshort++; 998 return(-1); 999 } 1000 #endif 1001 /* 1002 * Data after a fragment header is meaningless 1003 * unless it is the first fragment, but 1004 * we'll go to the notify label for path MTU 1005 * discovery. 1006 */ 1007 if (fh->ip6f_offlg & IP6F_OFF_MASK) 1008 goto notify; 1009 1010 eoff += sizeof(struct ip6_frag); 1011 nxt = fh->ip6f_nxt; 1012 break; 1013 default: 1014 /* 1015 * This case includes ESP and the No Next 1016 * Header. In such cases going to the notify 1017 * label does not have any meaning 1018 * (i.e. ctlfunc will be NULL), but we go 1019 * anyway since we might have to update 1020 * path MTU information. 1021 */ 1022 goto notify; 1023 } 1024 } 1025 notify: 1026 #ifndef PULLDOWN_TEST 1027 icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off); 1028 #else 1029 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, 1030 sizeof(*icmp6) + sizeof(struct ip6_hdr)); 1031 if (icmp6 == NULL) { 1032 icmp6stat.icp6s_tooshort++; 1033 return(-1); 1034 } 1035 #endif 1036 1037 eip6 = (struct ip6_hdr *)(icmp6 + 1); 1038 bzero(&icmp6dst, sizeof(icmp6dst)); 1039 icmp6dst.sin6_len = sizeof(struct sockaddr_in6); 1040 icmp6dst.sin6_family = AF_INET6; 1041 if (finaldst == NULL) 1042 icmp6dst.sin6_addr = eip6->ip6_dst; 1043 else 1044 icmp6dst.sin6_addr = *finaldst; 1045 icmp6dst.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif, 1046 &icmp6dst.sin6_addr); 1047 #ifndef SCOPEDROUTING 1048 if (in6_embedscope(&icmp6dst.sin6_addr, &icmp6dst, 1049 NULL, NULL)) { 1050 /* should be impossbile */ 1051 nd6log((LOG_DEBUG, 1052 "icmp6_notify_error: in6_embedscope failed\n")); 1053 goto freeit; 1054 } 1055 #endif 1056 1057 /* 1058 * retrieve parameters from the inner IPv6 header, and convert 1059 * them into sockaddr structures. 1060 */ 1061 bzero(&icmp6src, sizeof(icmp6src)); 1062 icmp6src.sin6_len = sizeof(struct sockaddr_in6); 1063 icmp6src.sin6_family = AF_INET6; 1064 icmp6src.sin6_addr = eip6->ip6_src; 1065 icmp6src.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif, 1066 &icmp6src.sin6_addr); 1067 #ifndef SCOPEDROUTING 1068 if (in6_embedscope(&icmp6src.sin6_addr, &icmp6src, 1069 NULL, NULL)) { 1070 /* should be impossbile */ 1071 nd6log((LOG_DEBUG, 1072 "icmp6_notify_error: in6_embedscope failed\n")); 1073 goto freeit; 1074 } 1075 #endif 1076 icmp6src.sin6_flowinfo = 1077 (eip6->ip6_flow & IPV6_FLOWLABEL_MASK); 1078 1079 if (finaldst == NULL) 1080 finaldst = &eip6->ip6_dst; 1081 ip6cp.ip6c_m = m; 1082 ip6cp.ip6c_icmp6 = icmp6; 1083 ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1); 1084 ip6cp.ip6c_off = eoff; 1085 ip6cp.ip6c_finaldst = finaldst; 1086 ip6cp.ip6c_src = &icmp6src; 1087 ip6cp.ip6c_nxt = nxt; 1088 1089 if (icmp6type == ICMP6_PACKET_TOO_BIG) { 1090 notifymtu = ntohl(icmp6->icmp6_mtu); 1091 ip6cp.ip6c_cmdarg = (void *)¬ifymtu; 1092 icmp6_mtudisc_update(&ip6cp, 1); /*XXX*/ 1093 } 1094 1095 ctlfunc = (void (*) __P((int, struct sockaddr *, void *))) 1096 (ip6_protox[nxt]->pr_ctlinput); 1097 if (ctlfunc) { 1098 (void) (*ctlfunc)(code, (struct sockaddr *)&icmp6dst, 1099 &ip6cp); 1100 } 1101 } 1102 return(0); 1103 1104 freeit: 1105 m_freem(m); 1106 return(-1); 1107 } 1108 1109 void 1110 icmp6_mtudisc_update(ip6cp, validated) 1111 struct ip6ctlparam *ip6cp; 1112 int validated; 1113 { 1114 struct in6_addr *dst = ip6cp->ip6c_finaldst; 1115 struct icmp6_hdr *icmp6 = ip6cp->ip6c_icmp6; 1116 struct mbuf *m = ip6cp->ip6c_m; /* will be necessary for scope issue */ 1117 u_int mtu = ntohl(icmp6->icmp6_mtu); 1118 struct rtentry *rt = NULL; 1119 struct sockaddr_in6 sin6; 1120 1121 if (!validated) 1122 return; 1123 1124 bzero(&sin6, sizeof(sin6)); 1125 sin6.sin6_family = PF_INET6; 1126 sin6.sin6_len = sizeof(struct sockaddr_in6); 1127 sin6.sin6_addr = *dst; 1128 /* XXX normally, this won't happen */ 1129 if (IN6_IS_ADDR_LINKLOCAL(dst)) { 1130 sin6.sin6_addr.s6_addr16[1] = 1131 htons(m->m_pkthdr.rcvif->if_index); 1132 } 1133 /* sin6.sin6_scope_id = XXX: should be set if DST is a scoped addr */ 1134 rt = rtalloc1((struct sockaddr *)&sin6, 0, 1135 RTF_CLONING | RTF_PRCLONING); 1136 1137 if (rt && (rt->rt_flags & RTF_HOST) 1138 && !(rt->rt_rmx.rmx_locks & RTV_MTU)) { 1139 if (mtu < IPV6_MMTU) { 1140 /* xxx */ 1141 rt->rt_rmx.rmx_locks |= RTV_MTU; 1142 } else if (mtu < rt->rt_ifp->if_mtu && 1143 rt->rt_rmx.rmx_mtu > mtu) { 1144 icmp6stat.icp6s_pmtuchg++; 1145 rt->rt_rmx.rmx_mtu = mtu; 1146 } 1147 } 1148 if (rt) 1149 rtfree(rt); 1150 } 1151 1152 /* 1153 * Process a Node Information Query packet, based on 1154 * draft-ietf-ipngwg-icmp-name-lookups-07. 1155 * 1156 * Spec incompatibilities: 1157 * - IPv6 Subject address handling 1158 * - IPv4 Subject address handling support missing 1159 * - Proxy reply (answer even if it's not for me) 1160 * - joins NI group address at in6_ifattach() time only, does not cope 1161 * with hostname changes by sethostname(3) 1162 */ 1163 #define hostnamelen strlen(hostname) 1164 static struct mbuf * 1165 ni6_input(m, off) 1166 struct mbuf *m; 1167 int off; 1168 { 1169 struct icmp6_nodeinfo *ni6, *nni6; 1170 struct mbuf *n = NULL; 1171 u_int16_t qtype; 1172 int subjlen; 1173 int replylen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo); 1174 struct ni_reply_fqdn *fqdn; 1175 int addrs; /* for NI_QTYPE_NODEADDR */ 1176 struct ifnet *ifp = NULL; /* for NI_QTYPE_NODEADDR */ 1177 struct sockaddr_in6 sin6; /* double meaning; ip6_dst and subjectaddr */ 1178 struct sockaddr_in6 sin6_d; /* XXX: we should retrieve this from m_aux */ 1179 struct ip6_hdr *ip6; 1180 int oldfqdn = 0; /* if 1, return pascal string (03 draft) */ 1181 char *subj = NULL; 1182 struct in6_ifaddr *ia6 = NULL; 1183 1184 ip6 = mtod(m, struct ip6_hdr *); 1185 #ifndef PULLDOWN_TEST 1186 ni6 = (struct icmp6_nodeinfo *)(mtod(m, caddr_t) + off); 1187 #else 1188 IP6_EXTHDR_GET(ni6, struct icmp6_nodeinfo *, m, off, sizeof(*ni6)); 1189 if (ni6 == NULL) { 1190 /* m is already reclaimed */ 1191 return NULL; 1192 } 1193 #endif 1194 1195 /* 1196 * Validate IPv6 destination address. 1197 * 1198 * The Responder must discard the Query without further processing 1199 * unless it is one of the Responder's unicast or anycast addresses, or 1200 * a link-local scope multicast address which the Responder has joined. 1201 * [icmp-name-lookups-07, Section 4.] 1202 */ 1203 bzero(&sin6, sizeof(sin6)); 1204 sin6.sin6_family = AF_INET6; 1205 sin6.sin6_len = sizeof(struct sockaddr_in6); 1206 bcopy(&ip6->ip6_dst, &sin6.sin6_addr, sizeof(sin6.sin6_addr)); 1207 /* XXX scopeid */ 1208 if ((ia6 = (struct in6_ifaddr *)ifa_ifwithaddr((struct sockaddr *)&sin6)) != NULL) { 1209 /* unicast/anycast, fine */ 1210 if ((ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 && 1211 (icmp6_nodeinfo & 4) == 0) { 1212 nd6log((LOG_DEBUG, "ni6_input: ignore node info to " 1213 "a temporary address in %s:%d", 1214 __FILE__, __LINE__)); 1215 goto bad; 1216 } 1217 } else if (IN6_IS_ADDR_MC_LINKLOCAL(&sin6.sin6_addr)) 1218 ; /* link-local multicast, fine */ 1219 else 1220 goto bad; 1221 1222 /* validate query Subject field. */ 1223 qtype = ntohs(ni6->ni_qtype); 1224 subjlen = m->m_pkthdr.len - off - sizeof(struct icmp6_nodeinfo); 1225 switch (qtype) { 1226 case NI_QTYPE_NOOP: 1227 case NI_QTYPE_SUPTYPES: 1228 /* 07 draft */ 1229 if (ni6->ni_code == ICMP6_NI_SUBJ_FQDN && subjlen == 0) 1230 break; 1231 /* FALLTHROUGH */ 1232 case NI_QTYPE_FQDN: 1233 case NI_QTYPE_NODEADDR: 1234 switch (ni6->ni_code) { 1235 case ICMP6_NI_SUBJ_IPV6: 1236 #if ICMP6_NI_SUBJ_IPV6 != 0 1237 case 0: 1238 #endif 1239 /* 1240 * backward compatibility - try to accept 03 draft 1241 * format, where no Subject is present. 1242 */ 1243 if (qtype == NI_QTYPE_FQDN && ni6->ni_code == 0 && 1244 subjlen == 0) { 1245 oldfqdn++; 1246 break; 1247 } 1248 #if ICMP6_NI_SUBJ_IPV6 != 0 1249 if (ni6->ni_code != ICMP6_NI_SUBJ_IPV6) 1250 goto bad; 1251 #endif 1252 1253 if (subjlen != sizeof(sin6.sin6_addr)) 1254 goto bad; 1255 1256 /* 1257 * Validate Subject address. 1258 * 1259 * Not sure what exactly "address belongs to the node" 1260 * means in the spec, is it just unicast, or what? 1261 * 1262 * At this moment we consider Subject address as 1263 * "belong to the node" if the Subject address equals 1264 * to the IPv6 destination address; validation for 1265 * IPv6 destination address should have done enough 1266 * check for us. 1267 * 1268 * We do not do proxy at this moment. 1269 */ 1270 /* m_pulldown instead of copy? */ 1271 m_copydata(m, off + sizeof(struct icmp6_nodeinfo), 1272 subjlen, (caddr_t)&sin6.sin6_addr); 1273 sin6.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif, 1274 &sin6.sin6_addr); 1275 #ifndef SCOPEDROUTING 1276 in6_embedscope(&sin6.sin6_addr, &sin6, NULL, NULL); 1277 #endif 1278 bzero(&sin6_d, sizeof(sin6_d)); 1279 sin6_d.sin6_family = AF_INET6; /* not used, actually */ 1280 sin6_d.sin6_len = sizeof(sin6_d); /* ditto */ 1281 sin6_d.sin6_addr = ip6->ip6_dst; 1282 sin6_d.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif, 1283 &ip6->ip6_dst); 1284 #ifndef SCOPEDROUTING 1285 in6_embedscope(&sin6_d.sin6_addr, &sin6_d, NULL, NULL); 1286 #endif 1287 subj = (char *)&sin6; 1288 if (SA6_ARE_ADDR_EQUAL(&sin6, &sin6_d)) 1289 break; 1290 1291 /* 1292 * XXX if we are to allow other cases, we should really 1293 * be careful about scope here. 1294 * basically, we should disallow queries toward IPv6 1295 * destination X with subject Y, if scope(X) > scope(Y). 1296 * if we allow scope(X) > scope(Y), it will result in 1297 * information leakage across scope boundary. 1298 */ 1299 goto bad; 1300 1301 case ICMP6_NI_SUBJ_FQDN: 1302 /* 1303 * Validate Subject name with gethostname(3). 1304 * 1305 * The behavior may need some debate, since: 1306 * - we are not sure if the node has FQDN as 1307 * hostname (returned by gethostname(3)). 1308 * - the code does wildcard match for truncated names. 1309 * however, we are not sure if we want to perform 1310 * wildcard match, if gethostname(3) side has 1311 * truncated hostname. 1312 */ 1313 n = ni6_nametodns(hostname, hostnamelen, 0); 1314 if (!n || n->m_next || n->m_len == 0) 1315 goto bad; 1316 IP6_EXTHDR_GET(subj, char *, m, 1317 off + sizeof(struct icmp6_nodeinfo), subjlen); 1318 if (subj == NULL) 1319 goto bad; 1320 if (!ni6_dnsmatch(subj, subjlen, mtod(n, const char *), 1321 n->m_len)) { 1322 goto bad; 1323 } 1324 m_freem(n); 1325 n = NULL; 1326 break; 1327 1328 case ICMP6_NI_SUBJ_IPV4: /* XXX: to be implemented? */ 1329 default: 1330 goto bad; 1331 } 1332 break; 1333 } 1334 1335 /* refuse based on configuration. XXX ICMP6_NI_REFUSED? */ 1336 switch (qtype) { 1337 case NI_QTYPE_FQDN: 1338 if ((icmp6_nodeinfo & 1) == 0) 1339 goto bad; 1340 break; 1341 case NI_QTYPE_NODEADDR: 1342 if ((icmp6_nodeinfo & 2) == 0) 1343 goto bad; 1344 break; 1345 } 1346 1347 /* guess reply length */ 1348 switch (qtype) { 1349 case NI_QTYPE_NOOP: 1350 break; /* no reply data */ 1351 case NI_QTYPE_SUPTYPES: 1352 replylen += sizeof(u_int32_t); 1353 break; 1354 case NI_QTYPE_FQDN: 1355 /* XXX will append an mbuf */ 1356 replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_namelen); 1357 break; 1358 case NI_QTYPE_NODEADDR: 1359 addrs = ni6_addrs(ni6, m, &ifp, subj); 1360 if ((replylen += addrs * (sizeof(struct in6_addr) + 1361 sizeof(u_int32_t))) > MCLBYTES) 1362 replylen = MCLBYTES; /* XXX: will truncate pkt later */ 1363 break; 1364 default: 1365 /* 1366 * XXX: We must return a reply with the ICMP6 code 1367 * `unknown Qtype' in this case. However we regard the case 1368 * as an FQDN query for backward compatibility. 1369 * Older versions set a random value to this field, 1370 * so it rarely varies in the defined qtypes. 1371 * But the mechanism is not reliable... 1372 * maybe we should obsolete older versions. 1373 */ 1374 qtype = NI_QTYPE_FQDN; 1375 /* XXX will append an mbuf */ 1376 replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_namelen); 1377 oldfqdn++; 1378 break; 1379 } 1380 1381 /* allocate an mbuf to reply. */ 1382 MGETHDR(n, M_DONTWAIT, m->m_type); 1383 if (n == NULL) { 1384 m_freem(m); 1385 return(NULL); 1386 } 1387 M_COPY_PKTHDR(n, m); /* just for recvif */ 1388 if (replylen > MHLEN) { 1389 if (replylen > MCLBYTES) { 1390 /* 1391 * XXX: should we try to allocate more? But MCLBYTES 1392 * is probably much larger than IPV6_MMTU... 1393 */ 1394 goto bad; 1395 } 1396 MCLGET(n, M_DONTWAIT); 1397 if ((n->m_flags & M_EXT) == 0) { 1398 goto bad; 1399 } 1400 } 1401 n->m_pkthdr.len = n->m_len = replylen; 1402 1403 /* copy mbuf header and IPv6 + Node Information base headers */ 1404 bcopy(mtod(m, caddr_t), mtod(n, caddr_t), sizeof(struct ip6_hdr)); 1405 nni6 = (struct icmp6_nodeinfo *)(mtod(n, struct ip6_hdr *) + 1); 1406 bcopy((caddr_t)ni6, (caddr_t)nni6, sizeof(struct icmp6_nodeinfo)); 1407 1408 /* qtype dependent procedure */ 1409 switch (qtype) { 1410 case NI_QTYPE_NOOP: 1411 nni6->ni_code = ICMP6_NI_SUCCESS; 1412 nni6->ni_flags = 0; 1413 break; 1414 case NI_QTYPE_SUPTYPES: 1415 { 1416 u_int32_t v; 1417 nni6->ni_code = ICMP6_NI_SUCCESS; 1418 nni6->ni_flags = htons(0x0000); /* raw bitmap */ 1419 /* supports NOOP, SUPTYPES, FQDN, and NODEADDR */ 1420 v = (u_int32_t)htonl(0x0000000f); 1421 bcopy(&v, nni6 + 1, sizeof(u_int32_t)); 1422 break; 1423 } 1424 case NI_QTYPE_FQDN: 1425 nni6->ni_code = ICMP6_NI_SUCCESS; 1426 fqdn = (struct ni_reply_fqdn *)(mtod(n, caddr_t) + 1427 sizeof(struct ip6_hdr) + 1428 sizeof(struct icmp6_nodeinfo)); 1429 nni6->ni_flags = 0; /* XXX: meaningless TTL */ 1430 fqdn->ni_fqdn_ttl = 0; /* ditto. */ 1431 /* 1432 * XXX do we really have FQDN in variable "hostname"? 1433 */ 1434 n->m_next = ni6_nametodns(hostname, hostnamelen, oldfqdn); 1435 if (n->m_next == NULL) 1436 goto bad; 1437 /* XXX we assume that n->m_next is not a chain */ 1438 if (n->m_next->m_next != NULL) 1439 goto bad; 1440 n->m_pkthdr.len += n->m_next->m_len; 1441 break; 1442 case NI_QTYPE_NODEADDR: 1443 { 1444 int lenlim, copied; 1445 1446 nni6->ni_code = ICMP6_NI_SUCCESS; 1447 n->m_pkthdr.len = n->m_len = 1448 sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo); 1449 lenlim = M_TRAILINGSPACE(n); 1450 copied = ni6_store_addrs(ni6, nni6, ifp, lenlim); 1451 /* XXX: reset mbuf length */ 1452 n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) + 1453 sizeof(struct icmp6_nodeinfo) + copied; 1454 break; 1455 } 1456 default: 1457 break; /* XXX impossible! */ 1458 } 1459 1460 nni6->ni_type = ICMP6_NI_REPLY; 1461 m_freem(m); 1462 return(n); 1463 1464 bad: 1465 m_freem(m); 1466 if (n) 1467 m_freem(n); 1468 return(NULL); 1469 } 1470 #undef hostnamelen 1471 1472 /* 1473 * make a mbuf with DNS-encoded string. no compression support. 1474 * 1475 * XXX names with less than 2 dots (like "foo" or "foo.section") will be 1476 * treated as truncated name (two \0 at the end). this is a wild guess. 1477 */ 1478 static struct mbuf * 1479 ni6_nametodns(name, namelen, old) 1480 const char *name; 1481 int namelen; 1482 int old; /* return pascal string if non-zero */ 1483 { 1484 struct mbuf *m; 1485 char *cp, *ep; 1486 const char *p, *q; 1487 int i, len, nterm; 1488 1489 if (old) 1490 len = namelen + 1; 1491 else 1492 len = MCLBYTES; 1493 1494 /* because MAXHOSTNAMELEN is usually 256, we use cluster mbuf */ 1495 MGET(m, M_DONTWAIT, MT_DATA); 1496 if (m && len > MLEN) { 1497 MCLGET(m, M_DONTWAIT); 1498 if ((m->m_flags & M_EXT) == 0) 1499 goto fail; 1500 } 1501 if (!m) 1502 goto fail; 1503 m->m_next = NULL; 1504 1505 if (old) { 1506 m->m_len = len; 1507 *mtod(m, char *) = namelen; 1508 bcopy(name, mtod(m, char *) + 1, namelen); 1509 return m; 1510 } else { 1511 m->m_len = 0; 1512 cp = mtod(m, char *); 1513 ep = mtod(m, char *) + M_TRAILINGSPACE(m); 1514 1515 /* if not certain about my name, return empty buffer */ 1516 if (namelen == 0) 1517 return m; 1518 1519 /* 1520 * guess if it looks like shortened hostname, or FQDN. 1521 * shortened hostname needs two trailing "\0". 1522 */ 1523 i = 0; 1524 for (p = name; p < name + namelen; p++) { 1525 if (*p && *p == '.') 1526 i++; 1527 } 1528 if (i < 2) 1529 nterm = 2; 1530 else 1531 nterm = 1; 1532 1533 p = name; 1534 while (cp < ep && p < name + namelen) { 1535 i = 0; 1536 for (q = p; q < name + namelen && *q && *q != '.'; q++) 1537 i++; 1538 /* result does not fit into mbuf */ 1539 if (cp + i + 1 >= ep) 1540 goto fail; 1541 /* 1542 * DNS label length restriction, RFC1035 page 8. 1543 * "i == 0" case is included here to avoid returning 1544 * 0-length label on "foo..bar". 1545 */ 1546 if (i <= 0 || i >= 64) 1547 goto fail; 1548 *cp++ = i; 1549 bcopy(p, cp, i); 1550 cp += i; 1551 p = q; 1552 if (p < name + namelen && *p == '.') 1553 p++; 1554 } 1555 /* termination */ 1556 if (cp + nterm >= ep) 1557 goto fail; 1558 while (nterm-- > 0) 1559 *cp++ = '\0'; 1560 m->m_len = cp - mtod(m, char *); 1561 return m; 1562 } 1563 1564 panic("should not reach here"); 1565 /* NOTREACHED */ 1566 1567 fail: 1568 if (m) 1569 m_freem(m); 1570 return NULL; 1571 } 1572 1573 /* 1574 * check if two DNS-encoded string matches. takes care of truncated 1575 * form (with \0\0 at the end). no compression support. 1576 * XXX upper/lowercase match (see RFC2065) 1577 */ 1578 static int 1579 ni6_dnsmatch(a, alen, b, blen) 1580 const char *a; 1581 int alen; 1582 const char *b; 1583 int blen; 1584 { 1585 const char *a0, *b0; 1586 int l; 1587 1588 /* simplest case - need validation? */ 1589 if (alen == blen && bcmp(a, b, alen) == 0) 1590 return 1; 1591 1592 a0 = a; 1593 b0 = b; 1594 1595 /* termination is mandatory */ 1596 if (alen < 2 || blen < 2) 1597 return 0; 1598 if (a0[alen - 1] != '\0' || b0[blen - 1] != '\0') 1599 return 0; 1600 alen--; 1601 blen--; 1602 1603 while (a - a0 < alen && b - b0 < blen) { 1604 if (a - a0 + 1 > alen || b - b0 + 1 > blen) 1605 return 0; 1606 1607 if ((signed char)a[0] < 0 || (signed char)b[0] < 0) 1608 return 0; 1609 /* we don't support compression yet */ 1610 if (a[0] >= 64 || b[0] >= 64) 1611 return 0; 1612 1613 /* truncated case */ 1614 if (a[0] == 0 && a - a0 == alen - 1) 1615 return 1; 1616 if (b[0] == 0 && b - b0 == blen - 1) 1617 return 1; 1618 if (a[0] == 0 || b[0] == 0) 1619 return 0; 1620 1621 if (a[0] != b[0]) 1622 return 0; 1623 l = a[0]; 1624 if (a - a0 + 1 + l > alen || b - b0 + 1 + l > blen) 1625 return 0; 1626 if (bcmp(a + 1, b + 1, l) != 0) 1627 return 0; 1628 1629 a += 1 + l; 1630 b += 1 + l; 1631 } 1632 1633 if (a - a0 == alen && b - b0 == blen) 1634 return 1; 1635 else 1636 return 0; 1637 } 1638 1639 /* 1640 * calculate the number of addresses to be returned in the node info reply. 1641 */ 1642 static int 1643 ni6_addrs(ni6, m, ifpp, subj) 1644 struct icmp6_nodeinfo *ni6; 1645 struct mbuf *m; 1646 struct ifnet **ifpp; 1647 char *subj; 1648 { 1649 struct ifnet *ifp; 1650 struct in6_ifaddr *ifa6; 1651 struct ifaddr *ifa; 1652 struct sockaddr_in6 *subj_ip6 = NULL; /* XXX pedant */ 1653 int addrs = 0, addrsofif, iffound = 0; 1654 int niflags = ni6->ni_flags; 1655 1656 if ((niflags & NI_NODEADDR_FLAG_ALL) == 0) { 1657 switch (ni6->ni_code) { 1658 case ICMP6_NI_SUBJ_IPV6: 1659 if (subj == NULL) /* must be impossible... */ 1660 return(0); 1661 subj_ip6 = (struct sockaddr_in6 *)subj; 1662 break; 1663 default: 1664 /* 1665 * XXX: we only support IPv6 subject address for 1666 * this Qtype. 1667 */ 1668 return(0); 1669 } 1670 } 1671 1672 for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list)) 1673 { 1674 addrsofif = 0; 1675 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) 1676 { 1677 if (ifa->ifa_addr->sa_family != AF_INET6) 1678 continue; 1679 ifa6 = (struct in6_ifaddr *)ifa; 1680 1681 if ((niflags & NI_NODEADDR_FLAG_ALL) == 0 && 1682 IN6_ARE_ADDR_EQUAL(&subj_ip6->sin6_addr, 1683 &ifa6->ia_addr.sin6_addr)) 1684 iffound = 1; 1685 1686 /* 1687 * IPv4-mapped addresses can only be returned by a 1688 * Node Information proxy, since they represent 1689 * addresses of IPv4-only nodes, which perforce do 1690 * not implement this protocol. 1691 * [icmp-name-lookups-07, Section 5.4] 1692 * So we don't support NI_NODEADDR_FLAG_COMPAT in 1693 * this function at this moment. 1694 */ 1695 1696 /* What do we have to do about ::1? */ 1697 switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) { 1698 case IPV6_ADDR_SCOPE_LINKLOCAL: 1699 if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0) 1700 continue; 1701 break; 1702 case IPV6_ADDR_SCOPE_SITELOCAL: 1703 if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0) 1704 continue; 1705 break; 1706 case IPV6_ADDR_SCOPE_GLOBAL: 1707 if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0) 1708 continue; 1709 break; 1710 default: 1711 continue; 1712 } 1713 1714 /* 1715 * check if anycast is okay. 1716 * XXX: just experimental. not in the spec. 1717 */ 1718 if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 && 1719 (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0) 1720 continue; /* we need only unicast addresses */ 1721 if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0 && 1722 (icmp6_nodeinfo & 4) == 0) { 1723 continue; 1724 } 1725 addrsofif++; /* count the address */ 1726 } 1727 if (iffound) { 1728 *ifpp = ifp; 1729 return(addrsofif); 1730 } 1731 1732 addrs += addrsofif; 1733 } 1734 1735 return(addrs); 1736 } 1737 1738 static int 1739 ni6_store_addrs(ni6, nni6, ifp0, resid) 1740 struct icmp6_nodeinfo *ni6, *nni6; 1741 struct ifnet *ifp0; 1742 int resid; 1743 { 1744 struct ifnet *ifp = ifp0 ? ifp0 : TAILQ_FIRST(&ifnet); 1745 struct in6_ifaddr *ifa6; 1746 struct ifaddr *ifa; 1747 struct ifnet *ifp_dep = NULL; 1748 int copied = 0, allow_deprecated = 0; 1749 u_char *cp = (u_char *)(nni6 + 1); 1750 int niflags = ni6->ni_flags; 1751 u_int32_t ltime; 1752 1753 if (ifp0 == NULL && !(niflags & NI_NODEADDR_FLAG_ALL)) 1754 return(0); /* needless to copy */ 1755 1756 again: 1757 1758 for (; ifp; ifp = TAILQ_NEXT(ifp, if_list)) 1759 { 1760 for (ifa = ifp->if_addrlist.tqh_first; ifa; 1761 ifa = ifa->ifa_list.tqe_next) 1762 { 1763 if (ifa->ifa_addr->sa_family != AF_INET6) 1764 continue; 1765 ifa6 = (struct in6_ifaddr *)ifa; 1766 1767 if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) != 0 && 1768 allow_deprecated == 0) { 1769 /* 1770 * prefererred address should be put before 1771 * deprecated addresses. 1772 */ 1773 1774 /* record the interface for later search */ 1775 if (ifp_dep == NULL) 1776 ifp_dep = ifp; 1777 1778 continue; 1779 } 1780 else if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) == 0 && 1781 allow_deprecated != 0) 1782 continue; /* we now collect deprecated addrs */ 1783 1784 /* What do we have to do about ::1? */ 1785 switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) { 1786 case IPV6_ADDR_SCOPE_LINKLOCAL: 1787 if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0) 1788 continue; 1789 break; 1790 case IPV6_ADDR_SCOPE_SITELOCAL: 1791 if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0) 1792 continue; 1793 break; 1794 case IPV6_ADDR_SCOPE_GLOBAL: 1795 if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0) 1796 continue; 1797 break; 1798 default: 1799 continue; 1800 } 1801 1802 /* 1803 * check if anycast is okay. 1804 * XXX: just experimental. not in the spec. 1805 */ 1806 if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 && 1807 (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0) 1808 continue; 1809 if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0 && 1810 (icmp6_nodeinfo & 4) == 0) { 1811 continue; 1812 } 1813 1814 /* now we can copy the address */ 1815 if (resid < sizeof(struct in6_addr) + 1816 sizeof(u_int32_t)) { 1817 /* 1818 * We give up much more copy. 1819 * Set the truncate flag and return. 1820 */ 1821 nni6->ni_flags |= 1822 NI_NODEADDR_FLAG_TRUNCATE; 1823 return(copied); 1824 } 1825 1826 /* 1827 * Set the TTL of the address. 1828 * The TTL value should be one of the following 1829 * according to the specification: 1830 * 1831 * 1. The remaining lifetime of a DHCP lease on the 1832 * address, or 1833 * 2. The remaining Valid Lifetime of a prefix from 1834 * which the address was derived through Stateless 1835 * Autoconfiguration. 1836 * 1837 * Note that we currently do not support stateful 1838 * address configuration by DHCPv6, so the former 1839 * case can't happen. 1840 */ 1841 if (ifa6->ia6_lifetime.ia6t_expire == 0) 1842 ltime = ND6_INFINITE_LIFETIME; 1843 else { 1844 if (ifa6->ia6_lifetime.ia6t_expire > 1845 time_second) 1846 ltime = htonl(ifa6->ia6_lifetime.ia6t_expire - time_second); 1847 else 1848 ltime = 0; 1849 } 1850 1851 bcopy(<ime, cp, sizeof(u_int32_t)); 1852 cp += sizeof(u_int32_t); 1853 1854 /* copy the address itself */ 1855 bcopy(&ifa6->ia_addr.sin6_addr, cp, 1856 sizeof(struct in6_addr)); 1857 /* XXX: KAME link-local hack; remove ifindex */ 1858 if (IN6_IS_ADDR_LINKLOCAL(&ifa6->ia_addr.sin6_addr)) 1859 ((struct in6_addr *)cp)->s6_addr16[1] = 0; 1860 cp += sizeof(struct in6_addr); 1861 1862 resid -= (sizeof(struct in6_addr) + sizeof(u_int32_t)); 1863 copied += (sizeof(struct in6_addr) + 1864 sizeof(u_int32_t)); 1865 } 1866 if (ifp0) /* we need search only on the specified IF */ 1867 break; 1868 } 1869 1870 if (allow_deprecated == 0 && ifp_dep != NULL) { 1871 ifp = ifp_dep; 1872 allow_deprecated = 1; 1873 1874 goto again; 1875 } 1876 1877 return(copied); 1878 } 1879 1880 /* 1881 * XXX almost dup'ed code with rip6_input. 1882 */ 1883 static int 1884 icmp6_rip6_input(mp, off) 1885 struct mbuf **mp; 1886 int off; 1887 { 1888 struct mbuf *m = *mp; 1889 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1890 struct in6pcb *in6p; 1891 struct in6pcb *last = NULL; 1892 struct sockaddr_in6 rip6src; 1893 struct icmp6_hdr *icmp6; 1894 struct mbuf *opts = NULL; 1895 1896 #ifndef PULLDOWN_TEST 1897 /* this is assumed to be safe. */ 1898 icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off); 1899 #else 1900 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6)); 1901 if (icmp6 == NULL) { 1902 /* m is already reclaimed */ 1903 return IPPROTO_DONE; 1904 } 1905 #endif 1906 1907 bzero(&rip6src, sizeof(rip6src)); 1908 rip6src.sin6_len = sizeof(struct sockaddr_in6); 1909 rip6src.sin6_family = AF_INET6; 1910 /* KAME hack: recover scopeid */ 1911 (void)in6_recoverscope(&rip6src, &ip6->ip6_src, m->m_pkthdr.rcvif); 1912 1913 LIST_FOREACH(in6p, &ripcb, inp_list) 1914 { 1915 if ((in6p->inp_vflag & INP_IPV6) == 0) 1916 continue; 1917 #if HAVE_NRL_INPCB 1918 if (!(in6p->in6p_flags & INP_IPV6)) 1919 continue; 1920 #endif 1921 if (in6p->in6p_ip6_nxt != IPPROTO_ICMPV6) 1922 continue; 1923 if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) && 1924 !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst)) 1925 continue; 1926 if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) && 1927 !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src)) 1928 continue; 1929 if (in6p->in6p_icmp6filt 1930 && ICMP6_FILTER_WILLBLOCK(icmp6->icmp6_type, 1931 in6p->in6p_icmp6filt)) 1932 continue; 1933 if (last) { 1934 struct mbuf *n; 1935 if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) { 1936 if (last->in6p_flags & IN6P_CONTROLOPTS) 1937 ip6_savecontrol(last, &opts, ip6, n); 1938 /* strip intermediate headers */ 1939 m_adj(n, off); 1940 if (sbappendaddr(&last->in6p_socket->so_rcv, 1941 (struct sockaddr *)&rip6src, 1942 n, opts) == 0) { 1943 /* should notify about lost packet */ 1944 m_freem(n); 1945 if (opts) { 1946 m_freem(opts); 1947 } 1948 } else 1949 sorwakeup(last->in6p_socket); 1950 opts = NULL; 1951 } 1952 } 1953 last = in6p; 1954 } 1955 if (last) { 1956 if (last->in6p_flags & IN6P_CONTROLOPTS) 1957 ip6_savecontrol(last, &opts, ip6, m); 1958 /* strip intermediate headers */ 1959 m_adj(m, off); 1960 if (sbappendaddr(&last->in6p_socket->so_rcv, 1961 (struct sockaddr *)&rip6src, m, opts) == 0) { 1962 m_freem(m); 1963 if (opts) 1964 m_freem(opts); 1965 } else 1966 sorwakeup(last->in6p_socket); 1967 } else { 1968 m_freem(m); 1969 ip6stat.ip6s_delivered--; 1970 } 1971 return IPPROTO_DONE; 1972 } 1973 1974 /* 1975 * Reflect the ip6 packet back to the source. 1976 * OFF points to the icmp6 header, counted from the top of the mbuf. 1977 */ 1978 void 1979 icmp6_reflect(m, off) 1980 struct mbuf *m; 1981 size_t off; 1982 { 1983 struct ip6_hdr *ip6; 1984 struct icmp6_hdr *icmp6; 1985 struct in6_ifaddr *ia; 1986 struct in6_addr t, *src = 0; 1987 int plen; 1988 int type, code; 1989 struct ifnet *outif = NULL; 1990 struct sockaddr_in6 sa6_src, sa6_dst; 1991 #ifdef COMPAT_RFC1885 1992 int mtu = IPV6_MMTU; 1993 struct sockaddr_in6 *sin6 = &icmp6_reflect_rt.ro_dst; 1994 #endif 1995 1996 /* too short to reflect */ 1997 if (off < sizeof(struct ip6_hdr)) { 1998 nd6log((LOG_DEBUG, 1999 "sanity fail: off=%lx, sizeof(ip6)=%lx in %s:%d\n", 2000 (u_long)off, (u_long)sizeof(struct ip6_hdr), 2001 __FILE__, __LINE__)); 2002 goto bad; 2003 } 2004 2005 /* 2006 * If there are extra headers between IPv6 and ICMPv6, strip 2007 * off that header first. 2008 */ 2009 #if DIAGNOSTIC 2010 if (sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) > MHLEN) 2011 panic("assumption failed in icmp6_reflect"); 2012 #endif 2013 if (off > sizeof(struct ip6_hdr)) { 2014 size_t l; 2015 struct ip6_hdr nip6; 2016 2017 l = off - sizeof(struct ip6_hdr); 2018 m_copydata(m, 0, sizeof(nip6), (caddr_t)&nip6); 2019 m_adj(m, l); 2020 l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr); 2021 if (m->m_len < l) { 2022 if ((m = m_pullup(m, l)) == NULL) 2023 return; 2024 } 2025 bcopy((caddr_t)&nip6, mtod(m, caddr_t), sizeof(nip6)); 2026 } else /* off == sizeof(struct ip6_hdr) */ { 2027 size_t l; 2028 l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr); 2029 if (m->m_len < l) { 2030 if ((m = m_pullup(m, l)) == NULL) 2031 return; 2032 } 2033 } 2034 plen = m->m_pkthdr.len - sizeof(struct ip6_hdr); 2035 ip6 = mtod(m, struct ip6_hdr *); 2036 ip6->ip6_nxt = IPPROTO_ICMPV6; 2037 icmp6 = (struct icmp6_hdr *)(ip6 + 1); 2038 type = icmp6->icmp6_type; /* keep type for statistics */ 2039 code = icmp6->icmp6_code; /* ditto. */ 2040 2041 t = ip6->ip6_dst; 2042 /* 2043 * ip6_input() drops a packet if its src is multicast. 2044 * So, the src is never multicast. 2045 */ 2046 ip6->ip6_dst = ip6->ip6_src; 2047 2048 /* 2049 * XXX: make sure to embed scope zone information, using 2050 * already embedded IDs or the received interface (if any). 2051 * Note that rcvif may be NULL. 2052 * TODO: scoped routing case (XXX). 2053 */ 2054 bzero(&sa6_src, sizeof(sa6_src)); 2055 sa6_src.sin6_family = AF_INET6; 2056 sa6_src.sin6_len = sizeof(sa6_src); 2057 sa6_src.sin6_addr = ip6->ip6_dst; 2058 in6_recoverscope(&sa6_src, &ip6->ip6_dst, m->m_pkthdr.rcvif); 2059 in6_embedscope(&ip6->ip6_dst, &sa6_src, NULL, NULL); 2060 bzero(&sa6_dst, sizeof(sa6_dst)); 2061 sa6_dst.sin6_family = AF_INET6; 2062 sa6_dst.sin6_len = sizeof(sa6_dst); 2063 sa6_dst.sin6_addr = t; 2064 in6_recoverscope(&sa6_dst, &t, m->m_pkthdr.rcvif); 2065 in6_embedscope(&t, &sa6_dst, NULL, NULL); 2066 2067 #ifdef COMPAT_RFC1885 2068 /* 2069 * xxx guess MTU 2070 * RFC 1885 requires that echo reply should be truncated if it 2071 * does not fit in with (return) path MTU, but the description was 2072 * removed in the new spec. 2073 */ 2074 if (icmp6_reflect_rt.ro_rt == 0 || 2075 ! (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_dst))) { 2076 if (icmp6_reflect_rt.ro_rt) { 2077 rtfree(icmp6_reflect_rt.ro_rt); 2078 icmp6_reflect_rt.ro_rt = 0; 2079 } 2080 bzero(sin6, sizeof(*sin6)); 2081 sin6->sin6_family = PF_INET6; 2082 sin6->sin6_len = sizeof(struct sockaddr_in6); 2083 sin6->sin6_addr = ip6->ip6_dst; 2084 2085 rtalloc_ign((struct route *)&icmp6_reflect_rt.ro_rt, 2086 RTF_PRCLONING); 2087 } 2088 2089 if (icmp6_reflect_rt.ro_rt == 0) 2090 goto bad; 2091 2092 if ((icmp6_reflect_rt.ro_rt->rt_flags & RTF_HOST) 2093 && mtu < icmp6_reflect_rt.ro_rt->rt_ifp->if_mtu) 2094 mtu = icmp6_reflect_rt.ro_rt->rt_rmx.rmx_mtu; 2095 2096 if (mtu < m->m_pkthdr.len) { 2097 plen -= (m->m_pkthdr.len - mtu); 2098 m_adj(m, mtu - m->m_pkthdr.len); 2099 } 2100 #endif 2101 /* 2102 * If the incoming packet was addressed directly to us(i.e. unicast), 2103 * use dst as the src for the reply. 2104 * The IN6_IFF_NOTREADY case would be VERY rare, but is possible 2105 * (for example) when we encounter an error while forwarding procedure 2106 * destined to a duplicated address of ours. 2107 */ 2108 for (ia = in6_ifaddr; ia; ia = ia->ia_next) 2109 if (IN6_ARE_ADDR_EQUAL(&t, &ia->ia_addr.sin6_addr) && 2110 (ia->ia6_flags & (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY)) == 0) { 2111 src = &t; 2112 break; 2113 } 2114 if (ia == NULL && IN6_IS_ADDR_LINKLOCAL(&t) && (m->m_flags & M_LOOP)) { 2115 /* 2116 * This is the case if the dst is our link-local address 2117 * and the sender is also ourselves. 2118 */ 2119 src = &t; 2120 } 2121 2122 if (src == 0) { 2123 int e; 2124 struct route_in6 ro; 2125 2126 /* 2127 * This case matches to multicasts, our anycast, or unicasts 2128 * that we do not own. Select a source address based on the 2129 * source address of the erroneous packet. 2130 */ 2131 bzero(&ro, sizeof(ro)); 2132 src = in6_selectsrc(&sa6_src, NULL, NULL, &ro, NULL, &e); 2133 if (ro.ro_rt) 2134 rtfree(ro.ro_rt); /* XXX: we could use this */ 2135 if (src == NULL) { 2136 nd6log((LOG_DEBUG, 2137 "icmp6_reflect: source can't be determined: " 2138 "dst=%s, error=%d\n", 2139 ip6_sprintf(&sa6_src.sin6_addr), e)); 2140 goto bad; 2141 } 2142 } 2143 2144 ip6->ip6_src = *src; 2145 2146 ip6->ip6_flow = 0; 2147 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 2148 ip6->ip6_vfc |= IPV6_VERSION; 2149 ip6->ip6_nxt = IPPROTO_ICMPV6; 2150 if (m->m_pkthdr.rcvif) { 2151 /* XXX: This may not be the outgoing interface */ 2152 ip6->ip6_hlim = nd_ifinfo[m->m_pkthdr.rcvif->if_index].chlim; 2153 } else 2154 ip6->ip6_hlim = ip6_defhlim; 2155 2156 icmp6->icmp6_cksum = 0; 2157 icmp6->icmp6_cksum = in6_cksum(m, IPPROTO_ICMPV6, 2158 sizeof(struct ip6_hdr), plen); 2159 2160 /* 2161 * XXX option handling 2162 */ 2163 2164 m->m_flags &= ~(M_BCAST|M_MCAST); 2165 #if IPSEC 2166 /* Don't lookup socket */ 2167 if (ipsec_bypass == 0) 2168 (void)ipsec_setsocket(m, NULL); 2169 #endif /*IPSEC*/ 2170 2171 #ifdef COMPAT_RFC1885 2172 ip6_output(m, NULL, &icmp6_reflect_rt, 0, NULL, &outif); 2173 #else 2174 ip6_output(m, NULL, NULL, 0, NULL, &outif); 2175 #endif 2176 if (outif) 2177 icmp6_ifoutstat_inc(outif, type, code); 2178 2179 return; 2180 2181 bad: 2182 m_freem(m); 2183 return; 2184 } 2185 2186 void 2187 icmp6_fasttimo() 2188 { 2189 2190 mld6_fasttimeo(); 2191 } 2192 2193 static const char * 2194 icmp6_redirect_diag(src6, dst6, tgt6) 2195 struct in6_addr *src6; 2196 struct in6_addr *dst6; 2197 struct in6_addr *tgt6; 2198 { 2199 static char buf[1024]; 2200 snprintf(buf, sizeof(buf), "(src=%s dst=%s tgt=%s)", 2201 ip6_sprintf(src6), ip6_sprintf(dst6), ip6_sprintf(tgt6)); 2202 return buf; 2203 } 2204 2205 void 2206 icmp6_redirect_input(m, off) 2207 struct mbuf *m; 2208 int off; 2209 { 2210 struct ifnet *ifp = m->m_pkthdr.rcvif; 2211 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 2212 struct nd_redirect *nd_rd; 2213 int icmp6len = ntohs(ip6->ip6_plen); 2214 char *lladdr = NULL; 2215 int lladdrlen = 0; 2216 u_char *redirhdr = NULL; 2217 int redirhdrlen = 0; 2218 struct rtentry *rt = NULL; 2219 int is_router; 2220 int is_onlink; 2221 struct in6_addr src6 = ip6->ip6_src; 2222 struct in6_addr redtgt6; 2223 struct in6_addr reddst6; 2224 union nd_opts ndopts; 2225 2226 if (!m || !ifp) 2227 return; 2228 2229 /* XXX if we are router, we don't update route by icmp6 redirect */ 2230 if (ip6_forwarding) 2231 goto freeit; 2232 if (!icmp6_rediraccept) 2233 goto freeit; 2234 2235 #ifndef PULLDOWN_TEST 2236 IP6_EXTHDR_CHECK(m, off, icmp6len,); 2237 nd_rd = (struct nd_redirect *)((caddr_t)ip6 + off); 2238 #else 2239 IP6_EXTHDR_GET(nd_rd, struct nd_redirect *, m, off, icmp6len); 2240 if (nd_rd == NULL) { 2241 icmp6stat.icp6s_tooshort++; 2242 return; 2243 } 2244 #endif 2245 redtgt6 = nd_rd->nd_rd_target; 2246 reddst6 = nd_rd->nd_rd_dst; 2247 2248 if (IN6_IS_ADDR_LINKLOCAL(&redtgt6)) 2249 redtgt6.s6_addr16[1] = htons(ifp->if_index); 2250 if (IN6_IS_ADDR_LINKLOCAL(&reddst6)) 2251 reddst6.s6_addr16[1] = htons(ifp->if_index); 2252 2253 /* validation */ 2254 if (!IN6_IS_ADDR_LINKLOCAL(&src6)) { 2255 nd6log((LOG_ERR, 2256 "ICMP6 redirect sent from %s rejected; " 2257 "must be from linklocal\n", ip6_sprintf(&src6))); 2258 goto bad; 2259 } 2260 if (ip6->ip6_hlim != 255) { 2261 nd6log((LOG_ERR, 2262 "ICMP6 redirect sent from %s rejected; " 2263 "hlim=%d (must be 255)\n", 2264 ip6_sprintf(&src6), ip6->ip6_hlim)); 2265 goto bad; 2266 } 2267 { 2268 /* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */ 2269 struct sockaddr_in6 sin6; 2270 struct in6_addr *gw6; 2271 2272 bzero(&sin6, sizeof(sin6)); 2273 sin6.sin6_family = AF_INET6; 2274 sin6.sin6_len = sizeof(struct sockaddr_in6); 2275 bcopy(&reddst6, &sin6.sin6_addr, sizeof(reddst6)); 2276 rt = rtalloc1((struct sockaddr *)&sin6, 0, 0UL); 2277 if (rt) { 2278 if (rt->rt_gateway == NULL || 2279 rt->rt_gateway->sa_family != AF_INET6) { 2280 nd6log((LOG_ERR, 2281 "ICMP6 redirect rejected; no route " 2282 "with inet6 gateway found for redirect dst: %s\n", 2283 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2284 rtfree(rt); 2285 goto bad; 2286 } 2287 2288 gw6 = &(((struct sockaddr_in6 *)rt->rt_gateway)->sin6_addr); 2289 if (bcmp(&src6, gw6, sizeof(struct in6_addr)) != 0) { 2290 nd6log((LOG_ERR, 2291 "ICMP6 redirect rejected; " 2292 "not equal to gw-for-src=%s (must be same): " 2293 "%s\n", 2294 ip6_sprintf(gw6), 2295 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2296 rtfree(rt); 2297 goto bad; 2298 } 2299 } else { 2300 nd6log((LOG_ERR, 2301 "ICMP6 redirect rejected; " 2302 "no route found for redirect dst: %s\n", 2303 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2304 goto bad; 2305 } 2306 rtfree(rt); 2307 rt = NULL; 2308 } 2309 if (IN6_IS_ADDR_MULTICAST(&reddst6)) { 2310 nd6log((LOG_ERR, 2311 "ICMP6 redirect rejected; " 2312 "redirect dst must be unicast: %s\n", 2313 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2314 goto bad; 2315 } 2316 2317 is_router = is_onlink = 0; 2318 if (IN6_IS_ADDR_LINKLOCAL(&redtgt6)) 2319 is_router = 1; /* router case */ 2320 if (bcmp(&redtgt6, &reddst6, sizeof(redtgt6)) == 0) 2321 is_onlink = 1; /* on-link destination case */ 2322 if (!is_router && !is_onlink) { 2323 nd6log((LOG_ERR, 2324 "ICMP6 redirect rejected; " 2325 "neither router case nor onlink case: %s\n", 2326 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2327 goto bad; 2328 } 2329 /* validation passed */ 2330 2331 icmp6len -= sizeof(*nd_rd); 2332 nd6_option_init(nd_rd + 1, icmp6len, &ndopts); 2333 if (nd6_options(&ndopts) < 0) { 2334 nd6log((LOG_INFO, "icmp6_redirect_input: " 2335 "invalid ND option, rejected: %s\n", 2336 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2337 /* nd6_options have incremented stats */ 2338 goto freeit; 2339 } 2340 2341 if (ndopts.nd_opts_tgt_lladdr) { 2342 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1); 2343 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3; 2344 } 2345 2346 if (ndopts.nd_opts_rh) { 2347 redirhdrlen = ndopts.nd_opts_rh->nd_opt_rh_len; 2348 redirhdr = (u_char *)(ndopts.nd_opts_rh + 1); /* xxx */ 2349 } 2350 2351 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 2352 nd6log((LOG_INFO, 2353 "icmp6_redirect_input: lladdrlen mismatch for %s " 2354 "(if %d, icmp6 packet %d): %s\n", 2355 ip6_sprintf(&redtgt6), ifp->if_addrlen, lladdrlen - 2, 2356 icmp6_redirect_diag(&src6, &reddst6, &redtgt6))); 2357 goto bad; 2358 } 2359 2360 /* RFC 2461 8.3 */ 2361 nd6_cache_lladdr(ifp, &redtgt6, lladdr, lladdrlen, ND_REDIRECT, 2362 is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER); 2363 2364 if (!is_onlink) { /* better router case. perform rtredirect. */ 2365 /* perform rtredirect */ 2366 struct sockaddr_in6 sdst; 2367 struct sockaddr_in6 sgw; 2368 struct sockaddr_in6 ssrc; 2369 2370 bzero(&sdst, sizeof(sdst)); 2371 bzero(&sgw, sizeof(sgw)); 2372 bzero(&ssrc, sizeof(ssrc)); 2373 sdst.sin6_family = sgw.sin6_family = ssrc.sin6_family = AF_INET6; 2374 sdst.sin6_len = sgw.sin6_len = ssrc.sin6_len = 2375 sizeof(struct sockaddr_in6); 2376 bcopy(&redtgt6, &sgw.sin6_addr, sizeof(struct in6_addr)); 2377 bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr)); 2378 bcopy(&src6, &ssrc.sin6_addr, sizeof(struct in6_addr)); 2379 rtredirect((struct sockaddr *)&sdst, (struct sockaddr *)&sgw, 2380 (struct sockaddr *)NULL, RTF_GATEWAY | RTF_HOST, 2381 (struct sockaddr *)&ssrc, 2382 (struct rtentry **)NULL); 2383 } 2384 /* finally update cached route in each socket via pfctlinput */ 2385 { 2386 struct sockaddr_in6 sdst; 2387 2388 bzero(&sdst, sizeof(sdst)); 2389 sdst.sin6_family = AF_INET6; 2390 sdst.sin6_len = sizeof(struct sockaddr_in6); 2391 bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr)); 2392 pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&sdst); 2393 #if IPSEC 2394 key_sa_routechange((struct sockaddr *)&sdst); 2395 #endif 2396 } 2397 2398 freeit: 2399 m_freem(m); 2400 return; 2401 2402 bad: 2403 icmp6stat.icp6s_badredirect++; 2404 m_freem(m); 2405 } 2406 2407 void 2408 icmp6_redirect_output(m0, rt) 2409 struct mbuf *m0; 2410 struct rtentry *rt; 2411 { 2412 struct ifnet *ifp; /* my outgoing interface */ 2413 struct in6_addr *ifp_ll6; 2414 struct in6_addr *router_ll6; 2415 struct ip6_hdr *sip6; /* m0 as struct ip6_hdr */ 2416 struct mbuf *m = NULL; /* newly allocated one */ 2417 struct ip6_hdr *ip6; /* m as struct ip6_hdr */ 2418 struct nd_redirect *nd_rd; 2419 size_t maxlen; 2420 u_char *p; 2421 struct ifnet *outif = NULL; 2422 struct sockaddr_in6 src_sa; 2423 2424 icmp6_errcount(&icmp6stat.icp6s_outerrhist, ND_REDIRECT, 0); 2425 2426 /* sanity check */ 2427 if (!m0 || !rt || !(rt->rt_flags & RTF_UP) || !(ifp = rt->rt_ifp)) 2428 goto fail; 2429 2430 /* if we are not router, we don't send icmp6 redirect */ 2431 if (!ip6_forwarding || ip6_accept_rtadv || (ifp->if_eflags & IFEF_ACCEPT_RTADVD)) 2432 goto fail; 2433 2434 /* 2435 * Address check: 2436 * the source address must identify a neighbor, and 2437 * the destination address must not be a multicast address 2438 * [RFC 2461, sec 8.2] 2439 */ 2440 sip6 = mtod(m0, struct ip6_hdr *); 2441 bzero(&src_sa, sizeof(src_sa)); 2442 src_sa.sin6_family = AF_INET6; 2443 src_sa.sin6_len = sizeof(src_sa); 2444 src_sa.sin6_addr = sip6->ip6_src; 2445 /* we don't currently use sin6_scope_id, but eventually use it */ 2446 src_sa.sin6_scope_id = in6_addr2scopeid(ifp, &sip6->ip6_src); 2447 if (nd6_is_addr_neighbor(&src_sa, ifp) == 0) 2448 goto fail; 2449 if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst)) 2450 goto fail; /* what should we do here? */ 2451 2452 /* rate limit */ 2453 if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0)) 2454 goto fail; 2455 2456 /* 2457 * Since we are going to append up to 1280 bytes (= IPV6_MMTU), 2458 * we almost always ask for an mbuf cluster for simplicity. 2459 * (MHLEN < IPV6_MMTU is almost always true) 2460 */ 2461 #if IPV6_MMTU >= MCLBYTES 2462 # error assumption failed about IPV6_MMTU and MCLBYTES 2463 #endif 2464 MGETHDR(m, M_DONTWAIT, MT_HEADER); 2465 if (m && IPV6_MMTU >= MHLEN) 2466 MCLGET(m, M_DONTWAIT); 2467 if (!m) 2468 goto fail; 2469 m->m_pkthdr.rcvif = NULL; 2470 m->m_len = 0; 2471 maxlen = M_TRAILINGSPACE(m); 2472 maxlen = min(IPV6_MMTU, maxlen); 2473 /* just for safety */ 2474 if (maxlen < sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) + 2475 ((sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7)) { 2476 goto fail; 2477 } 2478 2479 { 2480 /* get ip6 linklocal address for ifp(my outgoing interface). */ 2481 struct in6_ifaddr *ia; 2482 if ((ia = in6ifa_ifpforlinklocal(ifp, 2483 IN6_IFF_NOTREADY| 2484 IN6_IFF_ANYCAST)) == NULL) 2485 goto fail; 2486 ifp_ll6 = &ia->ia_addr.sin6_addr; 2487 } 2488 2489 /* get ip6 linklocal address for the router. */ 2490 if (rt->rt_gateway && (rt->rt_flags & RTF_GATEWAY)) { 2491 struct sockaddr_in6 *sin6; 2492 sin6 = (struct sockaddr_in6 *)rt->rt_gateway; 2493 router_ll6 = &sin6->sin6_addr; 2494 if (!IN6_IS_ADDR_LINKLOCAL(router_ll6)) 2495 router_ll6 = (struct in6_addr *)NULL; 2496 } else 2497 router_ll6 = (struct in6_addr *)NULL; 2498 2499 /* ip6 */ 2500 ip6 = mtod(m, struct ip6_hdr *); 2501 ip6->ip6_flow = 0; 2502 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 2503 ip6->ip6_vfc |= IPV6_VERSION; 2504 /* ip6->ip6_plen will be set later */ 2505 ip6->ip6_nxt = IPPROTO_ICMPV6; 2506 ip6->ip6_hlim = 255; 2507 /* ip6->ip6_src must be linklocal addr for my outgoing if. */ 2508 bcopy(ifp_ll6, &ip6->ip6_src, sizeof(struct in6_addr)); 2509 bcopy(&sip6->ip6_src, &ip6->ip6_dst, sizeof(struct in6_addr)); 2510 2511 /* ND Redirect */ 2512 nd_rd = (struct nd_redirect *)(ip6 + 1); 2513 nd_rd->nd_rd_type = ND_REDIRECT; 2514 nd_rd->nd_rd_code = 0; 2515 nd_rd->nd_rd_reserved = 0; 2516 if (rt->rt_flags & RTF_GATEWAY) { 2517 /* 2518 * nd_rd->nd_rd_target must be a link-local address in 2519 * better router cases. 2520 */ 2521 if (!router_ll6) 2522 goto fail; 2523 bcopy(router_ll6, &nd_rd->nd_rd_target, 2524 sizeof(nd_rd->nd_rd_target)); 2525 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst, 2526 sizeof(nd_rd->nd_rd_dst)); 2527 } else { 2528 /* make sure redtgt == reddst */ 2529 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_target, 2530 sizeof(nd_rd->nd_rd_target)); 2531 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst, 2532 sizeof(nd_rd->nd_rd_dst)); 2533 } 2534 2535 p = (u_char *)(nd_rd + 1); 2536 2537 if (!router_ll6) 2538 goto nolladdropt; 2539 2540 { 2541 /* target lladdr option */ 2542 struct rtentry *rt_router = NULL; 2543 int len; 2544 struct sockaddr_dl *sdl; 2545 struct nd_opt_hdr *nd_opt; 2546 char *lladdr; 2547 2548 rt_router = nd6_lookup(router_ll6, 0, ifp); 2549 if (!rt_router) 2550 goto nolladdropt; 2551 len = sizeof(*nd_opt) + ifp->if_addrlen; 2552 len = (len + 7) & ~7; /* round by 8 */ 2553 /* safety check */ 2554 if (len + (p - (u_char *)ip6) > maxlen) 2555 goto nolladdropt; 2556 if (!(rt_router->rt_flags & RTF_GATEWAY) && 2557 (rt_router->rt_flags & RTF_LLINFO) && 2558 (rt_router->rt_gateway->sa_family == AF_LINK) && 2559 (sdl = (struct sockaddr_dl *)rt_router->rt_gateway) && 2560 sdl->sdl_alen) { 2561 nd_opt = (struct nd_opt_hdr *)p; 2562 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR; 2563 nd_opt->nd_opt_len = len >> 3; 2564 lladdr = (char *)(nd_opt + 1); 2565 bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen); 2566 p += len; 2567 } 2568 } 2569 nolladdropt:; 2570 2571 m->m_pkthdr.len = m->m_len = p - (u_char *)ip6; 2572 2573 /* just to be safe */ 2574 #ifdef M_DECRYPTED /*not openbsd*/ 2575 if (m0->m_flags & M_DECRYPTED) 2576 goto noredhdropt; 2577 #endif 2578 if (p - (u_char *)ip6 > maxlen) 2579 goto noredhdropt; 2580 2581 { 2582 /* redirected header option */ 2583 int len; 2584 struct nd_opt_rd_hdr *nd_opt_rh; 2585 2586 /* 2587 * compute the maximum size for icmp6 redirect header option. 2588 * XXX room for auth header? 2589 */ 2590 len = maxlen - (p - (u_char *)ip6); 2591 len &= ~7; 2592 2593 /* This is just for simplicity. */ 2594 if (m0->m_pkthdr.len != m0->m_len) { 2595 if (m0->m_next) { 2596 m_freem(m0->m_next); 2597 m0->m_next = NULL; 2598 } 2599 m0->m_pkthdr.len = m0->m_len; 2600 } 2601 2602 /* 2603 * Redirected header option spec (RFC2461 4.6.3) talks nothing 2604 * about padding/truncate rule for the original IP packet. 2605 * From the discussion on IPv6imp in Feb 1999, the consensus was: 2606 * - "attach as much as possible" is the goal 2607 * - pad if not aligned (original size can be guessed by original 2608 * ip6 header) 2609 * Following code adds the padding if it is simple enough, 2610 * and truncates if not. 2611 */ 2612 if (m0->m_next || m0->m_pkthdr.len != m0->m_len) 2613 panic("assumption failed in %s:%d\n", __FILE__, __LINE__); 2614 2615 if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) { 2616 /* not enough room, truncate */ 2617 m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh); 2618 } else { 2619 /* enough room, pad or truncate */ 2620 size_t extra; 2621 2622 extra = m0->m_pkthdr.len % 8; 2623 if (extra) { 2624 /* pad if easy enough, truncate if not */ 2625 if (8 - extra <= M_TRAILINGSPACE(m0)) { 2626 /* pad */ 2627 m0->m_len += (8 - extra); 2628 m0->m_pkthdr.len += (8 - extra); 2629 } else { 2630 /* truncate */ 2631 m0->m_pkthdr.len -= extra; 2632 m0->m_len -= extra; 2633 } 2634 } 2635 len = m0->m_pkthdr.len + sizeof(*nd_opt_rh); 2636 m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh); 2637 } 2638 2639 nd_opt_rh = (struct nd_opt_rd_hdr *)p; 2640 bzero(nd_opt_rh, sizeof(*nd_opt_rh)); 2641 nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER; 2642 nd_opt_rh->nd_opt_rh_len = len >> 3; 2643 p += sizeof(*nd_opt_rh); 2644 m->m_pkthdr.len = m->m_len = p - (u_char *)ip6; 2645 2646 /* connect m0 to m */ 2647 m->m_next = m0; 2648 m->m_pkthdr.len = m->m_len + m0->m_len; 2649 } 2650 noredhdropt:; 2651 2652 if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_src)) 2653 sip6->ip6_src.s6_addr16[1] = 0; 2654 if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_dst)) 2655 sip6->ip6_dst.s6_addr16[1] = 0; 2656 #if 0 2657 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src)) 2658 ip6->ip6_src.s6_addr16[1] = 0; 2659 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) 2660 ip6->ip6_dst.s6_addr16[1] = 0; 2661 #endif 2662 if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_target)) 2663 nd_rd->nd_rd_target.s6_addr16[1] = 0; 2664 if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_dst)) 2665 nd_rd->nd_rd_dst.s6_addr16[1] = 0; 2666 2667 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr)); 2668 2669 nd_rd->nd_rd_cksum = 0; 2670 nd_rd->nd_rd_cksum 2671 = in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), ntohs(ip6->ip6_plen)); 2672 2673 /* send the packet to outside... */ 2674 #if IPSEC 2675 /* Don't lookup socket */ 2676 if (ipsec_bypass == 0) 2677 (void)ipsec_setsocket(m, NULL); 2678 #endif /*IPSEC*/ 2679 ip6_output(m, NULL, NULL, 0, NULL, &outif); 2680 if (outif) { 2681 icmp6_ifstat_inc(outif, ifs6_out_msg); 2682 icmp6_ifstat_inc(outif, ifs6_out_redirect); 2683 } 2684 icmp6stat.icp6s_outhist[ND_REDIRECT]++; 2685 2686 return; 2687 2688 fail: 2689 if (m) 2690 m_freem(m); 2691 if (m0) 2692 m_freem(m0); 2693 } 2694 2695 #if HAVE_NRL_INPCB 2696 #define sotoin6pcb sotoinpcb 2697 #define in6pcb inpcb 2698 #define in6p_icmp6filt inp_icmp6filt 2699 #endif 2700 /* 2701 * ICMPv6 socket option processing. 2702 */ 2703 int 2704 icmp6_ctloutput(so, sopt) 2705 struct socket *so; 2706 struct sockopt *sopt; 2707 { 2708 int error = 0; 2709 int optlen; 2710 struct inpcb *inp = sotoinpcb(so); 2711 int level, op, optname; 2712 2713 if (sopt) { 2714 level = sopt->sopt_level; 2715 op = sopt->sopt_dir; 2716 optname = sopt->sopt_name; 2717 optlen = sopt->sopt_valsize; 2718 } else 2719 level = op = optname = optlen = 0; 2720 2721 if (level != IPPROTO_ICMPV6) { 2722 return EINVAL; 2723 } 2724 2725 switch (op) { 2726 case PRCO_SETOPT: 2727 switch (optname) { 2728 case ICMP6_FILTER: 2729 { 2730 struct icmp6_filter *p; 2731 2732 if (optlen != sizeof(*p)) { 2733 error = EMSGSIZE; 2734 break; 2735 } 2736 if (inp->in6p_icmp6filt == NULL) { 2737 error = EINVAL; 2738 break; 2739 } 2740 error = sooptcopyin(sopt, inp->in6p_icmp6filt, optlen, 2741 optlen); 2742 break; 2743 } 2744 2745 default: 2746 error = ENOPROTOOPT; 2747 break; 2748 } 2749 break; 2750 2751 case PRCO_GETOPT: 2752 switch (optname) { 2753 case ICMP6_FILTER: 2754 { 2755 if (inp->in6p_icmp6filt == NULL) { 2756 error = EINVAL; 2757 break; 2758 } 2759 error = sooptcopyout(sopt, inp->in6p_icmp6filt, 2760 sizeof(struct icmp6_filter)); 2761 break; 2762 } 2763 2764 default: 2765 error = ENOPROTOOPT; 2766 break; 2767 } 2768 break; 2769 } 2770 2771 return(error); 2772 } 2773 #if HAVE_NRL_INPCB 2774 #undef sotoin6pcb 2775 #undef in6pcb 2776 #undef in6p_icmp6filt 2777 #endif 2778 2779 #ifndef HAVE_PPSRATECHECK 2780 #ifndef timersub 2781 #define timersub(tvp, uvp, vvp) \ 2782 do { \ 2783 (vvp)->tv_sec = (tvp)->tv_sec - (uvp)->tv_sec; \ 2784 (vvp)->tv_usec = (tvp)->tv_usec - (uvp)->tv_usec; \ 2785 if ((vvp)->tv_usec < 0) { \ 2786 (vvp)->tv_sec--; \ 2787 (vvp)->tv_usec += 1000000; \ 2788 } \ 2789 } while (0) 2790 #endif 2791 2792 /* 2793 * ppsratecheck(): packets (or events) per second limitation. 2794 */ 2795 static int 2796 ppsratecheck(lasttime, curpps, maxpps) 2797 struct timeval *lasttime; 2798 int *curpps; 2799 int maxpps; /* maximum pps allowed */ 2800 { 2801 struct timeval tv, delta; 2802 int s, rv; 2803 2804 s = splclock(); 2805 microtime(&tv); 2806 splx(s); 2807 2808 timersub(&tv, lasttime, &delta); 2809 2810 /* 2811 * Check for 0,0 so that the message will be seen at least once. 2812 * If more than one second has passed since the last update of 2813 * lasttime, reset the counter. 2814 * 2815 * we do increment *curpps even in *curpps < maxpps case, as some may 2816 * try to use *curpps for stat purposes as well. 2817 */ 2818 if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) || 2819 delta.tv_sec >= 1) { 2820 *lasttime = tv; 2821 *curpps = 0; 2822 rv = 1; 2823 } else if (maxpps < 0) 2824 rv = 1; 2825 else if (*curpps < maxpps) 2826 rv = 1; 2827 else 2828 rv = 0; 2829 2830 #if 1 /* DIAGNOSTIC? */ 2831 /* be careful about wrap-around */ 2832 if (*curpps + 1 > *curpps) 2833 *curpps = *curpps + 1; 2834 #else 2835 /* 2836 * assume that there's not too many calls to this function. 2837 * not sure if the assumption holds, as it depends on *caller's* 2838 * behavior, not the behavior of this function. 2839 * IMHO it is wrong to make assumption on the caller's behavior, 2840 * so the above #if is #if 1, not #ifdef DIAGNOSTIC. 2841 */ 2842 *curpps = *curpps + 1; 2843 #endif 2844 2845 return (rv); 2846 } 2847 #endif 2848 2849 /* 2850 * Perform rate limit check. 2851 * Returns 0 if it is okay to send the icmp6 packet. 2852 * Returns 1 if the router SHOULD NOT send this icmp6 packet due to rate 2853 * limitation. 2854 * 2855 * XXX per-destination/type check necessary? 2856 */ 2857 static int 2858 icmp6_ratelimit(dst, type, code) 2859 const struct in6_addr *dst; /* not used at this moment */ 2860 const int type; /* not used at this moment */ 2861 const int code; /* not used at this moment */ 2862 { 2863 int ret; 2864 2865 ret = 0; /* okay to send */ 2866 2867 /* PPS limit */ 2868 if (!ppsratecheck(&icmp6errppslim_last, &icmp6errpps_count, 2869 icmp6errppslim)) { 2870 /* The packet is subject to rate limit */ 2871 ret++; 2872 } 2873 2874 return ret; 2875 }
Cache object: 70523f37ffeb3803dd2eebc98ff15686
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]