FreeBSD/Linux Kernel Cross Reference
sys/netinet6/icmp6.c
1 /* $OpenBSD: icmp6.c,v 1.247 2022/12/10 23:45:51 kn Exp $ */
2 /* $KAME: icmp6.c,v 1.217 2001/06/20 15:03:29 jinmei Exp $ */
3
4 /*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 /*
34 * Copyright (c) 1982, 1986, 1988, 1993
35 * The Regents of the University of California. All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. Neither the name of the University nor the names of its contributors
46 * may be used to endorse or promote products derived from this software
47 * without specific prior written permission.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59 * SUCH DAMAGE.
60 *
61 * @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94
62 */
63
64 #include "carp.h"
65 #include "pf.h"
66
67 #include <sys/param.h>
68 #include <sys/systm.h>
69 #include <sys/malloc.h>
70 #include <sys/mbuf.h>
71 #include <sys/sysctl.h>
72 #include <sys/protosw.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <sys/time.h>
76 #include <sys/kernel.h>
77 #include <sys/syslog.h>
78
79 #include <net/if.h>
80 #include <net/if_var.h>
81 #include <net/route.h>
82 #include <net/if_dl.h>
83 #include <net/if_types.h>
84
85 #include <netinet/in.h>
86 #include <netinet/ip.h>
87 #include <netinet6/in6_var.h>
88 #include <netinet/ip6.h>
89 #include <netinet6/ip6_var.h>
90 #include <netinet/icmp6.h>
91 #include <netinet6/mld6_var.h>
92 #include <netinet/in_pcb.h>
93 #include <netinet6/nd6.h>
94 #include <netinet6/ip6protosw.h>
95
96 #if NCARP > 0
97 #include <netinet/ip_carp.h>
98 #endif
99
100 #if NPF > 0
101 #include <net/pfvar.h>
102 #endif
103
104 struct cpumem *icmp6counters;
105
106 extern int icmp6errppslim;
107 static int icmp6errpps_count = 0;
108 static struct timeval icmp6errppslim_last;
109
110 /*
111 * List of callbacks to notify when Path MTU changes are made.
112 */
113 struct icmp6_mtudisc_callback {
114 LIST_ENTRY(icmp6_mtudisc_callback) mc_list;
115 void (*mc_func)(struct sockaddr_in6 *, u_int);
116 };
117
118 LIST_HEAD(, icmp6_mtudisc_callback) icmp6_mtudisc_callbacks =
119 LIST_HEAD_INITIALIZER(icmp6_mtudisc_callbacks);
120
121 struct rttimer_queue icmp6_mtudisc_timeout_q;
122
123 /* XXX do these values make any sense? */
124 static int icmp6_mtudisc_hiwat = 1280;
125 static int icmp6_mtudisc_lowat = 256;
126
127 /*
128 * keep track of # of redirect routes.
129 */
130 struct rttimer_queue icmp6_redirect_timeout_q;
131
132 void icmp6_errcount(int, int);
133 int icmp6_ratelimit(const struct in6_addr *, const int, const int);
134 const char *icmp6_redirect_diag(struct in6_addr *, struct in6_addr *,
135 struct in6_addr *);
136 int icmp6_notify_error(struct mbuf *, int, int, int);
137 void icmp6_mtudisc_timeout(struct rtentry *, u_int);
138
139 void
140 icmp6_init(void)
141 {
142 mld6_init();
143 rt_timer_queue_init(&icmp6_mtudisc_timeout_q, ip6_mtudisc_timeout,
144 &icmp6_mtudisc_timeout);
145 rt_timer_queue_init(&icmp6_redirect_timeout_q, icmp6_redirtimeout,
146 NULL);
147 icmp6counters = counters_alloc(icp6s_ncounters);
148 }
149
150 void
151 icmp6_errcount(int type, int code)
152 {
153 enum icmp6stat_counters c = icp6s_ounknown;
154
155 switch (type) {
156 case ICMP6_DST_UNREACH:
157 switch (code) {
158 case ICMP6_DST_UNREACH_NOROUTE:
159 c = icp6s_odst_unreach_noroute;
160 break;
161 case ICMP6_DST_UNREACH_ADMIN:
162 c = icp6s_odst_unreach_admin;
163 break;
164 case ICMP6_DST_UNREACH_BEYONDSCOPE:
165 c = icp6s_odst_unreach_beyondscope;
166 break;
167 case ICMP6_DST_UNREACH_ADDR:
168 c = icp6s_odst_unreach_addr;
169 break;
170 case ICMP6_DST_UNREACH_NOPORT:
171 c = icp6s_odst_unreach_noport;
172 break;
173 }
174 break;
175 case ICMP6_PACKET_TOO_BIG:
176 c = icp6s_opacket_too_big;
177 break;
178 case ICMP6_TIME_EXCEEDED:
179 switch (code) {
180 case ICMP6_TIME_EXCEED_TRANSIT:
181 c = icp6s_otime_exceed_transit;
182 break;
183 case ICMP6_TIME_EXCEED_REASSEMBLY:
184 c = icp6s_otime_exceed_reassembly;
185 break;
186 }
187 break;
188 case ICMP6_PARAM_PROB:
189 switch (code) {
190 case ICMP6_PARAMPROB_HEADER:
191 c = icp6s_oparamprob_header;
192 break;
193 case ICMP6_PARAMPROB_NEXTHEADER:
194 c = icp6s_oparamprob_nextheader;
195 break;
196 case ICMP6_PARAMPROB_OPTION:
197 c = icp6s_oparamprob_option;
198 break;
199 }
200 break;
201 case ND_REDIRECT:
202 c = icp6s_oredirect;
203 break;
204 }
205
206 icmp6stat_inc(c);
207 }
208
209 /*
210 * Register a Path MTU Discovery callback.
211 */
212 void
213 icmp6_mtudisc_callback_register(void (*func)(struct sockaddr_in6 *, u_int))
214 {
215 struct icmp6_mtudisc_callback *mc;
216
217 LIST_FOREACH(mc, &icmp6_mtudisc_callbacks, mc_list) {
218 if (mc->mc_func == func)
219 return;
220 }
221
222 mc = malloc(sizeof(*mc), M_PCB, M_NOWAIT);
223 if (mc == NULL)
224 panic("%s", __func__);
225
226 mc->mc_func = func;
227 LIST_INSERT_HEAD(&icmp6_mtudisc_callbacks, mc, mc_list);
228 }
229
230 struct mbuf *
231 icmp6_do_error(struct mbuf *m, int type, int code, int param)
232 {
233 struct ip6_hdr *oip6, *nip6;
234 struct icmp6_hdr *icmp6;
235 u_int preplen;
236 int off;
237 int nxt;
238
239 icmp6stat_inc(icp6s_error);
240
241 /* count per-type-code statistics */
242 icmp6_errcount(type, code);
243
244 if (m->m_len < sizeof(struct ip6_hdr)) {
245 m = m_pullup(m, sizeof(struct ip6_hdr));
246 if (m == NULL)
247 return (NULL);
248 }
249 oip6 = mtod(m, struct ip6_hdr *);
250
251 /*
252 * If the destination address of the erroneous packet is a multicast
253 * address, or the packet was sent using link-layer multicast,
254 * we should basically suppress sending an error (RFC 2463, Section
255 * 2.4).
256 * We have two exceptions (the item e.2 in that section):
257 * - the Packet Too Big message can be sent for path MTU discovery.
258 * - the Parameter Problem Message that can be allowed an icmp6 error
259 * in the option type field. This check has been done in
260 * ip6_unknown_opt(), so we can just check the type and code.
261 */
262 if ((m->m_flags & (M_BCAST|M_MCAST) ||
263 IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) &&
264 (type != ICMP6_PACKET_TOO_BIG &&
265 (type != ICMP6_PARAM_PROB ||
266 code != ICMP6_PARAMPROB_OPTION)))
267 goto freeit;
268
269 /*
270 * RFC 2463, 2.4 (e.5): source address check.
271 * XXX: the case of anycast source?
272 */
273 if (IN6_IS_ADDR_UNSPECIFIED(&oip6->ip6_src) ||
274 IN6_IS_ADDR_MULTICAST(&oip6->ip6_src))
275 goto freeit;
276
277 /*
278 * If we are about to send ICMPv6 against ICMPv6 error/redirect,
279 * don't do it.
280 */
281 nxt = -1;
282 off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
283 if (off >= 0 && nxt == IPPROTO_ICMPV6) {
284 struct icmp6_hdr *icp;
285
286 IP6_EXTHDR_GET(icp, struct icmp6_hdr *, m, off,
287 sizeof(*icp));
288 if (icp == NULL) {
289 icmp6stat_inc(icp6s_tooshort);
290 return (NULL);
291 }
292 if (icp->icmp6_type < ICMP6_ECHO_REQUEST ||
293 icp->icmp6_type == ND_REDIRECT) {
294 /*
295 * ICMPv6 error
296 * Special case: for redirect (which is
297 * informational) we must not send icmp6 error.
298 */
299 icmp6stat_inc(icp6s_canterror);
300 goto freeit;
301 } else {
302 /* ICMPv6 informational - send the error */
303 }
304 }
305 else {
306 /* non-ICMPv6 - send the error */
307 }
308
309 oip6 = mtod(m, struct ip6_hdr *); /* adjust pointer */
310
311 /* Finally, do rate limitation check. */
312 if (icmp6_ratelimit(&oip6->ip6_src, type, code)) {
313 icmp6stat_inc(icp6s_toofreq);
314 goto freeit;
315 }
316
317 /*
318 * OK, ICMP6 can be generated.
319 */
320
321 if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN)
322 m_adj(m, ICMPV6_PLD_MAXLEN - m->m_pkthdr.len);
323
324 preplen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
325 M_PREPEND(m, preplen, M_DONTWAIT);
326 if (m && m->m_len < preplen)
327 m = m_pullup(m, preplen);
328 if (m == NULL) {
329 nd6log((LOG_DEBUG, "ENOBUFS in icmp6_error %d\n", __LINE__));
330 return (NULL);
331 }
332
333 nip6 = mtod(m, struct ip6_hdr *);
334 nip6->ip6_src = oip6->ip6_src;
335 nip6->ip6_dst = oip6->ip6_dst;
336
337 if (IN6_IS_SCOPE_EMBED(&oip6->ip6_src))
338 oip6->ip6_src.s6_addr16[1] = 0;
339 if (IN6_IS_SCOPE_EMBED(&oip6->ip6_dst))
340 oip6->ip6_dst.s6_addr16[1] = 0;
341
342 icmp6 = (struct icmp6_hdr *)(nip6 + 1);
343 icmp6->icmp6_type = type;
344 icmp6->icmp6_code = code;
345 icmp6->icmp6_pptr = htonl((u_int32_t)param);
346
347 /*
348 * icmp6_reflect() is designed to be in the input path.
349 * icmp6_error() can be called from both input and output path,
350 * and if we are in output path rcvif could contain bogus value.
351 * clear m->m_pkthdr.ph_ifidx for safety, we should have enough
352 * scope information in ip header (nip6).
353 */
354 m->m_pkthdr.ph_ifidx = 0;
355
356 icmp6stat_inc(icp6s_outhist + type);
357
358 return (m);
359
360 freeit:
361 /*
362 * If we can't tell whether or not we can generate ICMP6, free it.
363 */
364 return (m_freem(m));
365 }
366
367 /*
368 * Generate an error packet of type error in response to bad IP6 packet.
369 */
370 void
371 icmp6_error(struct mbuf *m, int type, int code, int param)
372 {
373 struct mbuf *n;
374
375 n = icmp6_do_error(m, type, code, param);
376 if (n != NULL) {
377 /* header order: IPv6 - ICMPv6 */
378 if (!icmp6_reflect(&n, sizeof(struct ip6_hdr), NULL))
379 ip6_send(n);
380 }
381 }
382
383 /*
384 * Process a received ICMP6 message.
385 */
386 int
387 icmp6_input(struct mbuf **mp, int *offp, int proto, int af)
388 {
389 #if NCARP > 0
390 struct ifnet *ifp;
391 #endif
392 struct mbuf *m = *mp, *n;
393 struct ip6_hdr *ip6, *nip6;
394 struct icmp6_hdr *icmp6, *nicmp6;
395 int off = *offp;
396 int icmp6len = m->m_pkthdr.len - off;
397 int code, sum, noff;
398 char src[INET6_ADDRSTRLEN], dst[INET6_ADDRSTRLEN];
399
400 /*
401 * Locate icmp6 structure in mbuf, and check
402 * that not corrupted and of at least minimum length
403 */
404
405 ip6 = mtod(m, struct ip6_hdr *);
406 if (icmp6len < sizeof(struct icmp6_hdr)) {
407 icmp6stat_inc(icp6s_tooshort);
408 goto freeit;
409 }
410
411 /*
412 * calculate the checksum
413 */
414 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6));
415 if (icmp6 == NULL) {
416 icmp6stat_inc(icp6s_tooshort);
417 return IPPROTO_DONE;
418 }
419 code = icmp6->icmp6_code;
420
421 if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) {
422 nd6log((LOG_ERR,
423 "ICMP6 checksum error(%d|%x) %s\n",
424 icmp6->icmp6_type, sum,
425 inet_ntop(AF_INET6, &ip6->ip6_src, src, sizeof(src))));
426 icmp6stat_inc(icp6s_checksum);
427 goto freeit;
428 }
429
430 #if NPF > 0
431 if (m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) {
432 switch (icmp6->icmp6_type) {
433 /*
434 * These ICMP6 types map to other connections. They must be
435 * delivered to pr_ctlinput() also for diverted connections.
436 */
437 case ICMP6_DST_UNREACH:
438 case ICMP6_PACKET_TOO_BIG:
439 case ICMP6_TIME_EXCEEDED:
440 case ICMP6_PARAM_PROB:
441 /*
442 * Do not use the divert-to property of the TCP or UDP
443 * rule when doing the PCB lookup for the raw socket.
444 */
445 m->m_pkthdr.pf.flags &=~ PF_TAG_DIVERTED;
446 break;
447 default:
448 goto raw;
449 }
450 }
451 #endif /* NPF */
452
453 #if NCARP > 0
454 ifp = if_get(m->m_pkthdr.ph_ifidx);
455 if (ifp == NULL)
456 goto freeit;
457
458 if (icmp6->icmp6_type == ICMP6_ECHO_REQUEST &&
459 carp_lsdrop(ifp, m, AF_INET6, ip6->ip6_src.s6_addr32,
460 ip6->ip6_dst.s6_addr32, 1)) {
461 if_put(ifp);
462 goto freeit;
463 }
464
465 if_put(ifp);
466 #endif
467 icmp6stat_inc(icp6s_inhist + icmp6->icmp6_type);
468
469 switch (icmp6->icmp6_type) {
470 case ICMP6_DST_UNREACH:
471 switch (code) {
472 case ICMP6_DST_UNREACH_NOROUTE:
473 code = PRC_UNREACH_NET;
474 break;
475 case ICMP6_DST_UNREACH_ADMIN:
476 code = PRC_UNREACH_PROTOCOL; /* is this a good code? */
477 break;
478 case ICMP6_DST_UNREACH_ADDR:
479 code = PRC_HOSTDEAD;
480 break;
481 case ICMP6_DST_UNREACH_BEYONDSCOPE:
482 /* I mean "source address was incorrect." */
483 code = PRC_PARAMPROB;
484 break;
485 case ICMP6_DST_UNREACH_NOPORT:
486 code = PRC_UNREACH_PORT;
487 break;
488 default:
489 goto badcode;
490 }
491 goto deliver;
492
493 case ICMP6_PACKET_TOO_BIG:
494 /* MTU is checked in icmp6_mtudisc_update. */
495 code = PRC_MSGSIZE;
496
497 /*
498 * Updating the path MTU will be done after examining
499 * intermediate extension headers.
500 */
501 goto deliver;
502
503 case ICMP6_TIME_EXCEEDED:
504 switch (code) {
505 case ICMP6_TIME_EXCEED_TRANSIT:
506 code = PRC_TIMXCEED_INTRANS;
507 break;
508 case ICMP6_TIME_EXCEED_REASSEMBLY:
509 code = PRC_TIMXCEED_REASS;
510 break;
511 default:
512 goto badcode;
513 }
514 goto deliver;
515
516 case ICMP6_PARAM_PROB:
517 switch (code) {
518 case ICMP6_PARAMPROB_NEXTHEADER:
519 code = PRC_UNREACH_PROTOCOL;
520 break;
521 case ICMP6_PARAMPROB_HEADER:
522 case ICMP6_PARAMPROB_OPTION:
523 code = PRC_PARAMPROB;
524 break;
525 default:
526 goto badcode;
527 }
528 goto deliver;
529
530 case ICMP6_ECHO_REQUEST:
531 if (code != 0)
532 goto badcode;
533 /*
534 * Copy mbuf to send to two data paths: userland socket(s),
535 * and to the querier (echo reply).
536 * m: a copy for socket, n: a copy for querier
537 */
538 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
539 /* Give up local */
540 n = m;
541 m = *mp = NULL;
542 goto deliverecho;
543 }
544 /*
545 * If the first mbuf is shared, or the first mbuf is too short,
546 * copy the first part of the data into a fresh mbuf.
547 * Otherwise, we will wrongly overwrite both copies.
548 */
549 if ((n->m_flags & M_EXT) != 0 ||
550 n->m_len < off + sizeof(struct icmp6_hdr)) {
551 struct mbuf *n0 = n;
552 const int maxlen = sizeof(*nip6) + sizeof(*nicmp6);
553
554 /*
555 * Prepare an internal mbuf. m_pullup() doesn't
556 * always copy the length we specified.
557 */
558 if (maxlen >= MCLBYTES) {
559 /* Give up remote */
560 m_freem(n0);
561 break;
562 }
563 MGETHDR(n, M_DONTWAIT, n0->m_type);
564 if (n && maxlen >= MHLEN) {
565 MCLGET(n, M_DONTWAIT);
566 if ((n->m_flags & M_EXT) == 0) {
567 m_free(n);
568 n = NULL;
569 }
570 }
571 if (n == NULL) {
572 /* Give up local */
573 m_freem(n0);
574 n = m;
575 m = *mp = NULL;
576 goto deliverecho;
577 }
578 M_MOVE_PKTHDR(n, n0);
579 /*
580 * Copy IPv6 and ICMPv6 only.
581 */
582 nip6 = mtod(n, struct ip6_hdr *);
583 bcopy(ip6, nip6, sizeof(struct ip6_hdr));
584 nicmp6 = (struct icmp6_hdr *)(nip6 + 1);
585 bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr));
586 noff = sizeof(struct ip6_hdr);
587 n->m_len = noff + sizeof(struct icmp6_hdr);
588 /*
589 * Adjust mbuf. ip6_plen will be adjusted in
590 * ip6_output().
591 * n->m_pkthdr.len == n0->m_pkthdr.len at this point.
592 */
593 n->m_pkthdr.len += noff + sizeof(struct icmp6_hdr);
594 n->m_pkthdr.len -= (off + sizeof(struct icmp6_hdr));
595 m_adj(n0, off + sizeof(struct icmp6_hdr));
596 n->m_next = n0;
597 } else {
598 deliverecho:
599 IP6_EXTHDR_GET(nicmp6, struct icmp6_hdr *, n, off,
600 sizeof(*nicmp6));
601 noff = off;
602 }
603 if (n) {
604 nicmp6->icmp6_type = ICMP6_ECHO_REPLY;
605 nicmp6->icmp6_code = 0;
606 icmp6stat_inc(icp6s_reflect);
607 icmp6stat_inc(icp6s_outhist + ICMP6_ECHO_REPLY);
608 if (!icmp6_reflect(&n, noff, NULL))
609 ip6_send(n);
610 }
611 if (!m)
612 goto freeit;
613 break;
614
615 case ICMP6_ECHO_REPLY:
616 if (code != 0)
617 goto badcode;
618 break;
619
620 case MLD_LISTENER_QUERY:
621 case MLD_LISTENER_REPORT:
622 if (icmp6len < sizeof(struct mld_hdr))
623 goto badlen;
624 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
625 /* give up local */
626 mld6_input(m, off);
627 m = NULL;
628 goto freeit;
629 }
630 mld6_input(n, off);
631 /* m stays. */
632 break;
633
634 case MLD_LISTENER_DONE:
635 if (icmp6len < sizeof(struct mld_hdr)) /* necessary? */
636 goto badlen;
637 break; /* nothing to be done in kernel */
638
639 case MLD_MTRACE_RESP:
640 case MLD_MTRACE:
641 /* XXX: these two are experimental. not officially defined. */
642 /* XXX: per-interface statistics? */
643 break; /* just pass it to applications */
644
645 case ICMP6_WRUREQUEST: /* ICMP6_FQDN_QUERY */
646 /* IPv6 Node Information Queries are not supported */
647 break;
648 case ICMP6_WRUREPLY:
649 break;
650
651 case ND_ROUTER_SOLICIT:
652 case ND_ROUTER_ADVERT:
653 if (code != 0)
654 goto badcode;
655 if ((icmp6->icmp6_type == ND_ROUTER_SOLICIT && icmp6len <
656 sizeof(struct nd_router_solicit)) ||
657 (icmp6->icmp6_type == ND_ROUTER_ADVERT && icmp6len <
658 sizeof(struct nd_router_advert)))
659 goto badlen;
660
661 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
662 /* give up local */
663 nd6_rtr_cache(m, off, icmp6len,
664 icmp6->icmp6_type);
665 m = NULL;
666 goto freeit;
667 }
668 nd6_rtr_cache(n, off, icmp6len, icmp6->icmp6_type);
669 /* m stays. */
670 break;
671
672 case ND_NEIGHBOR_SOLICIT:
673 if (code != 0)
674 goto badcode;
675 if (icmp6len < sizeof(struct nd_neighbor_solicit))
676 goto badlen;
677 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
678 /* give up local */
679 nd6_ns_input(m, off, icmp6len);
680 m = NULL;
681 goto freeit;
682 }
683 nd6_ns_input(n, off, icmp6len);
684 /* m stays. */
685 break;
686
687 case ND_NEIGHBOR_ADVERT:
688 if (code != 0)
689 goto badcode;
690 if (icmp6len < sizeof(struct nd_neighbor_advert))
691 goto badlen;
692 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
693 /* give up local */
694 nd6_na_input(m, off, icmp6len);
695 m = NULL;
696 goto freeit;
697 }
698 nd6_na_input(n, off, icmp6len);
699 /* m stays. */
700 break;
701
702 case ND_REDIRECT:
703 if (code != 0)
704 goto badcode;
705 if (icmp6len < sizeof(struct nd_redirect))
706 goto badlen;
707 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
708 /* give up local */
709 icmp6_redirect_input(m, off);
710 m = NULL;
711 goto freeit;
712 }
713 icmp6_redirect_input(n, off);
714 /* m stays. */
715 break;
716
717 case ICMP6_ROUTER_RENUMBERING:
718 if (code != ICMP6_ROUTER_RENUMBERING_COMMAND &&
719 code != ICMP6_ROUTER_RENUMBERING_RESULT)
720 goto badcode;
721 if (icmp6len < sizeof(struct icmp6_router_renum))
722 goto badlen;
723 break;
724
725 default:
726 nd6log((LOG_DEBUG,
727 "icmp6_input: unknown type %d(src=%s, dst=%s, ifid=%u)\n",
728 icmp6->icmp6_type,
729 inet_ntop(AF_INET6, &ip6->ip6_src, src, sizeof(src)),
730 inet_ntop(AF_INET6, &ip6->ip6_dst, dst, sizeof(dst)),
731 m->m_pkthdr.ph_ifidx));
732 if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST) {
733 /* ICMPv6 error: MUST deliver it by spec... */
734 code = PRC_NCMDS;
735 /* deliver */
736 } else {
737 /* ICMPv6 informational: MUST not deliver */
738 break;
739 }
740 deliver:
741 if (icmp6_notify_error(m, off, icmp6len, code)) {
742 /* In this case, m should've been freed. */
743 return (IPPROTO_DONE);
744 }
745 break;
746
747 badcode:
748 icmp6stat_inc(icp6s_badcode);
749 break;
750
751 badlen:
752 icmp6stat_inc(icp6s_badlen);
753 break;
754 }
755
756 #if NPF > 0
757 raw:
758 #endif
759 /* deliver the packet to appropriate sockets */
760 return rip6_input(mp, offp, proto, af);
761
762 freeit:
763 m_freem(m);
764 return IPPROTO_DONE;
765 }
766
767 int
768 icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
769 {
770 struct icmp6_hdr *icmp6;
771 struct ip6_hdr *eip6;
772 u_int32_t notifymtu;
773 struct sockaddr_in6 icmp6src, icmp6dst;
774
775 if (icmp6len < sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr)) {
776 icmp6stat_inc(icp6s_tooshort);
777 goto freeit;
778 }
779 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,
780 sizeof(*icmp6) + sizeof(struct ip6_hdr));
781 if (icmp6 == NULL) {
782 icmp6stat_inc(icp6s_tooshort);
783 return (-1);
784 }
785 eip6 = (struct ip6_hdr *)(icmp6 + 1);
786
787 /* Detect the upper level protocol */
788 {
789 void (*ctlfunc)(int, struct sockaddr *, u_int, void *);
790 u_int8_t nxt = eip6->ip6_nxt;
791 int eoff = off + sizeof(struct icmp6_hdr) +
792 sizeof(struct ip6_hdr);
793 struct ip6ctlparam ip6cp;
794 struct in6_addr *finaldst = NULL;
795 int icmp6type = icmp6->icmp6_type;
796 struct ip6_frag *fh;
797 struct ip6_rthdr *rth;
798 struct ip6_rthdr0 *rth0;
799 int rthlen;
800
801 while (1) { /* XXX: should avoid infinite loop explicitly? */
802 struct ip6_ext *eh;
803
804 switch (nxt) {
805 case IPPROTO_HOPOPTS:
806 case IPPROTO_DSTOPTS:
807 case IPPROTO_AH:
808 IP6_EXTHDR_GET(eh, struct ip6_ext *, m,
809 eoff, sizeof(*eh));
810 if (eh == NULL) {
811 icmp6stat_inc(icp6s_tooshort);
812 return (-1);
813 }
814
815 if (nxt == IPPROTO_AH)
816 eoff += (eh->ip6e_len + 2) << 2;
817 else
818 eoff += (eh->ip6e_len + 1) << 3;
819 nxt = eh->ip6e_nxt;
820 break;
821 case IPPROTO_ROUTING:
822 /*
823 * When the erroneous packet contains a
824 * routing header, we should examine the
825 * header to determine the final destination.
826 * Otherwise, we can't properly update
827 * information that depends on the final
828 * destination (e.g. path MTU).
829 */
830 IP6_EXTHDR_GET(rth, struct ip6_rthdr *, m,
831 eoff, sizeof(*rth));
832 if (rth == NULL) {
833 icmp6stat_inc(icp6s_tooshort);
834 return (-1);
835 }
836 rthlen = (rth->ip6r_len + 1) << 3;
837 /*
838 * XXX: currently there is no
839 * officially defined type other
840 * than type-0.
841 * Note that if the segment left field
842 * is 0, all intermediate hops must
843 * have been passed.
844 */
845 if (rth->ip6r_segleft &&
846 rth->ip6r_type == IPV6_RTHDR_TYPE_0) {
847 int hops;
848
849 IP6_EXTHDR_GET(rth0,
850 struct ip6_rthdr0 *, m,
851 eoff, rthlen);
852 if (rth0 == NULL) {
853 icmp6stat_inc(icp6s_tooshort);
854 return (-1);
855 }
856 /* just ignore a bogus header */
857 if ((rth0->ip6r0_len % 2) == 0 &&
858 (hops = rth0->ip6r0_len/2))
859 finaldst = (struct in6_addr *)(rth0 + 1) + (hops - 1);
860 }
861 eoff += rthlen;
862 nxt = rth->ip6r_nxt;
863 break;
864 case IPPROTO_FRAGMENT:
865 IP6_EXTHDR_GET(fh, struct ip6_frag *, m,
866 eoff, sizeof(*fh));
867 if (fh == NULL) {
868 icmp6stat_inc(icp6s_tooshort);
869 return (-1);
870 }
871 /*
872 * Data after a fragment header is meaningless
873 * unless it is the first fragment, but
874 * we'll go to the notify label for path MTU
875 * discovery.
876 */
877 if (fh->ip6f_offlg & IP6F_OFF_MASK)
878 goto notify;
879
880 eoff += sizeof(struct ip6_frag);
881 nxt = fh->ip6f_nxt;
882 break;
883 default:
884 /*
885 * This case includes ESP and the No Next
886 * Header. In such cases going to the notify
887 * label does not have any meaning
888 * (i.e. ctlfunc will be NULL), but we go
889 * anyway since we might have to update
890 * path MTU information.
891 */
892 goto notify;
893 }
894 }
895 notify:
896 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,
897 sizeof(*icmp6) + sizeof(struct ip6_hdr));
898 if (icmp6 == NULL) {
899 icmp6stat_inc(icp6s_tooshort);
900 return (-1);
901 }
902
903 eip6 = (struct ip6_hdr *)(icmp6 + 1);
904 bzero(&icmp6dst, sizeof(icmp6dst));
905 icmp6dst.sin6_len = sizeof(struct sockaddr_in6);
906 icmp6dst.sin6_family = AF_INET6;
907 if (finaldst == NULL)
908 icmp6dst.sin6_addr = eip6->ip6_dst;
909 else
910 icmp6dst.sin6_addr = *finaldst;
911 icmp6dst.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.ph_ifidx,
912 &icmp6dst.sin6_addr);
913 if (in6_embedscope(&icmp6dst.sin6_addr, &icmp6dst, NULL)) {
914 /* should be impossible */
915 nd6log((LOG_DEBUG,
916 "icmp6_notify_error: in6_embedscope failed\n"));
917 goto freeit;
918 }
919
920 /*
921 * retrieve parameters from the inner IPv6 header, and convert
922 * them into sockaddr structures.
923 */
924 bzero(&icmp6src, sizeof(icmp6src));
925 icmp6src.sin6_len = sizeof(struct sockaddr_in6);
926 icmp6src.sin6_family = AF_INET6;
927 icmp6src.sin6_addr = eip6->ip6_src;
928 icmp6src.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.ph_ifidx,
929 &icmp6src.sin6_addr);
930 if (in6_embedscope(&icmp6src.sin6_addr, &icmp6src, NULL)) {
931 /* should be impossible */
932 nd6log((LOG_DEBUG,
933 "icmp6_notify_error: in6_embedscope failed\n"));
934 goto freeit;
935 }
936 icmp6src.sin6_flowinfo =
937 (eip6->ip6_flow & IPV6_FLOWLABEL_MASK);
938
939 if (finaldst == NULL)
940 finaldst = &eip6->ip6_dst;
941 ip6cp.ip6c_m = m;
942 ip6cp.ip6c_icmp6 = icmp6;
943 ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1);
944 ip6cp.ip6c_off = eoff;
945 ip6cp.ip6c_finaldst = finaldst;
946 ip6cp.ip6c_src = &icmp6src;
947 ip6cp.ip6c_nxt = nxt;
948 #if NPF > 0
949 pf_pkt_addr_changed(m);
950 #endif
951
952 if (icmp6type == ICMP6_PACKET_TOO_BIG) {
953 notifymtu = ntohl(icmp6->icmp6_mtu);
954 ip6cp.ip6c_cmdarg = (void *)¬ifymtu;
955 }
956
957 ctlfunc = inet6sw[ip6_protox[nxt]].pr_ctlinput;
958 if (ctlfunc)
959 (*ctlfunc)(code, sin6tosa(&icmp6dst),
960 m->m_pkthdr.ph_rtableid, &ip6cp);
961 }
962 return (0);
963
964 freeit:
965 m_freem(m);
966 return (-1);
967 }
968
969 void
970 icmp6_mtudisc_update(struct ip6ctlparam *ip6cp, int validated)
971 {
972 unsigned long rtcount;
973 struct icmp6_mtudisc_callback *mc;
974 struct in6_addr *dst = ip6cp->ip6c_finaldst;
975 struct icmp6_hdr *icmp6 = ip6cp->ip6c_icmp6;
976 struct mbuf *m = ip6cp->ip6c_m; /* will be necessary for scope issue */
977 u_int mtu = ntohl(icmp6->icmp6_mtu);
978 struct rtentry *rt = NULL;
979 struct sockaddr_in6 sin6;
980
981 if (mtu < IPV6_MMTU)
982 return;
983
984 /*
985 * allow non-validated cases if memory is plenty, to make traffic
986 * from non-connected pcb happy.
987 */
988 rtcount = rt_timer_queue_count(&icmp6_mtudisc_timeout_q);
989 if (validated) {
990 if (0 <= icmp6_mtudisc_hiwat && rtcount > icmp6_mtudisc_hiwat)
991 return;
992 else if (0 <= icmp6_mtudisc_lowat &&
993 rtcount > icmp6_mtudisc_lowat) {
994 /*
995 * XXX nuke a victim, install the new one.
996 */
997 }
998 } else {
999 if (0 <= icmp6_mtudisc_lowat && rtcount > icmp6_mtudisc_lowat)
1000 return;
1001 }
1002
1003 bzero(&sin6, sizeof(sin6));
1004 sin6.sin6_family = PF_INET6;
1005 sin6.sin6_len = sizeof(struct sockaddr_in6);
1006 sin6.sin6_addr = *dst;
1007 /* XXX normally, this won't happen */
1008 if (IN6_IS_ADDR_LINKLOCAL(dst)) {
1009 sin6.sin6_addr.s6_addr16[1] = htons(m->m_pkthdr.ph_ifidx);
1010 }
1011 sin6.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.ph_ifidx,
1012 &sin6.sin6_addr);
1013
1014 rt = icmp6_mtudisc_clone(&sin6, m->m_pkthdr.ph_rtableid, 0);
1015
1016 if (rt != NULL && ISSET(rt->rt_flags, RTF_HOST) &&
1017 !(rt->rt_locks & RTV_MTU) &&
1018 (rt->rt_mtu > mtu || rt->rt_mtu == 0)) {
1019 struct ifnet *ifp;
1020
1021 ifp = if_get(rt->rt_ifidx);
1022 if (ifp != NULL && mtu < ifp->if_mtu) {
1023 icmp6stat_inc(icp6s_pmtuchg);
1024 rt->rt_mtu = mtu;
1025 }
1026 if_put(ifp);
1027 }
1028 rtfree(rt);
1029
1030 /*
1031 * Notify protocols that the MTU for this destination
1032 * has changed.
1033 */
1034 LIST_FOREACH(mc, &icmp6_mtudisc_callbacks, mc_list)
1035 (*mc->mc_func)(&sin6, m->m_pkthdr.ph_rtableid);
1036 }
1037
1038 /*
1039 * Reflect the ip6 packet back to the source.
1040 * OFF points to the icmp6 header, counted from the top of the mbuf.
1041 */
1042 int
1043 icmp6_reflect(struct mbuf **mp, size_t off, struct sockaddr *sa)
1044 {
1045 struct mbuf *m = *mp;
1046 struct rtentry *rt = NULL;
1047 struct ip6_hdr *ip6;
1048 struct icmp6_hdr *icmp6;
1049 struct in6_addr t, *src = NULL;
1050 struct sockaddr_in6 sa6_src, sa6_dst;
1051 u_int rtableid;
1052 u_int8_t pfflags;
1053
1054 CTASSERT(sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) <= MHLEN);
1055
1056 /* too short to reflect */
1057 if (off < sizeof(struct ip6_hdr)) {
1058 nd6log((LOG_DEBUG,
1059 "sanity fail: off=%lx, sizeof(ip6)=%lx in %s:%d\n",
1060 (u_long)off, (u_long)sizeof(struct ip6_hdr),
1061 __FILE__, __LINE__));
1062 goto bad;
1063 }
1064
1065 if (m->m_pkthdr.ph_loopcnt++ >= M_MAXLOOP) {
1066 m_freemp(mp);
1067 return (ELOOP);
1068 }
1069 rtableid = m->m_pkthdr.ph_rtableid;
1070 pfflags = m->m_pkthdr.pf.flags;
1071 m_resethdr(m);
1072 m->m_pkthdr.ph_rtableid = rtableid;
1073 m->m_pkthdr.pf.flags = pfflags & PF_TAG_GENERATED;
1074
1075 /*
1076 * If there are extra headers between IPv6 and ICMPv6, strip
1077 * off that header first.
1078 */
1079 if (off > sizeof(struct ip6_hdr)) {
1080 size_t l;
1081 struct ip6_hdr nip6;
1082
1083 l = off - sizeof(struct ip6_hdr);
1084 m_copydata(m, 0, sizeof(nip6), (caddr_t)&nip6);
1085 m_adj(m, l);
1086 l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
1087 if (m->m_len < l) {
1088 if ((m = *mp = m_pullup(m, l)) == NULL)
1089 return (EMSGSIZE);
1090 }
1091 memcpy(mtod(m, caddr_t), &nip6, sizeof(nip6));
1092 } else /* off == sizeof(struct ip6_hdr) */ {
1093 size_t l;
1094 l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
1095 if (m->m_len < l) {
1096 if ((m = *mp = m_pullup(m, l)) == NULL)
1097 return (EMSGSIZE);
1098 }
1099 }
1100 ip6 = mtod(m, struct ip6_hdr *);
1101 ip6->ip6_nxt = IPPROTO_ICMPV6;
1102 icmp6 = (struct icmp6_hdr *)(ip6 + 1);
1103
1104 t = ip6->ip6_dst;
1105 /*
1106 * ip6_input() drops a packet if its src is multicast.
1107 * So, the src is never multicast.
1108 */
1109 ip6->ip6_dst = ip6->ip6_src;
1110
1111 /*
1112 * XXX: make sure to embed scope zone information, using
1113 * already embedded IDs or the received interface (if any).
1114 * Note that rcvif may be NULL.
1115 * TODO: scoped routing case (XXX).
1116 */
1117 bzero(&sa6_src, sizeof(sa6_src));
1118 sa6_src.sin6_family = AF_INET6;
1119 sa6_src.sin6_len = sizeof(sa6_src);
1120 sa6_src.sin6_addr = ip6->ip6_dst;
1121 bzero(&sa6_dst, sizeof(sa6_dst));
1122 sa6_dst.sin6_family = AF_INET6;
1123 sa6_dst.sin6_len = sizeof(sa6_dst);
1124 sa6_dst.sin6_addr = t;
1125
1126 if (sa == NULL) {
1127 /*
1128 * If the incoming packet was addressed directly to us (i.e.
1129 * unicast), use dst as the src for the reply. The
1130 * IN6_IFF_TENTATIVE|IN6_IFF_DUPLICATED case would be VERY rare,
1131 * but is possible (for example) when we encounter an error
1132 * while forwarding procedure destined to a duplicated address
1133 * of ours.
1134 */
1135 rt = rtalloc(sin6tosa(&sa6_dst), 0, rtableid);
1136 if (rtisvalid(rt) && ISSET(rt->rt_flags, RTF_LOCAL) &&
1137 !ISSET(ifatoia6(rt->rt_ifa)->ia6_flags,
1138 IN6_IFF_ANYCAST|IN6_IFF_TENTATIVE|IN6_IFF_DUPLICATED)) {
1139 src = &t;
1140 }
1141 rtfree(rt);
1142 rt = NULL;
1143 sa = sin6tosa(&sa6_src);
1144 }
1145
1146 if (src == NULL) {
1147 struct in6_ifaddr *ia6;
1148
1149 /*
1150 * This case matches to multicasts, our anycast, or unicasts
1151 * that we do not own. Select a source address based on the
1152 * source address of the erroneous packet.
1153 */
1154 rt = rtalloc(sa, RT_RESOLVE, rtableid);
1155 if (!rtisvalid(rt)) {
1156 char addr[INET6_ADDRSTRLEN];
1157
1158 nd6log((LOG_DEBUG,
1159 "%s: source can't be determined: dst=%s\n",
1160 __func__, inet_ntop(AF_INET6, &sa6_src.sin6_addr,
1161 addr, sizeof(addr))));
1162 rtfree(rt);
1163 goto bad;
1164 }
1165 ia6 = in6_ifawithscope(rt->rt_ifa->ifa_ifp, &t, rtableid);
1166 if (ia6 != NULL)
1167 src = &ia6->ia_addr.sin6_addr;
1168 if (src == NULL)
1169 src = &ifatoia6(rt->rt_ifa)->ia_addr.sin6_addr;
1170 }
1171
1172 ip6->ip6_src = *src;
1173 rtfree(rt);
1174
1175 ip6->ip6_flow = 0;
1176 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
1177 ip6->ip6_vfc |= IPV6_VERSION;
1178 ip6->ip6_nxt = IPPROTO_ICMPV6;
1179 ip6->ip6_hlim = ip6_defhlim;
1180
1181 icmp6->icmp6_cksum = 0;
1182 m->m_pkthdr.csum_flags = M_ICMP_CSUM_OUT;
1183
1184 /*
1185 * XXX option handling
1186 */
1187
1188 m->m_flags &= ~(M_BCAST|M_MCAST);
1189 return (0);
1190
1191 bad:
1192 m_freemp(mp);
1193 return (EHOSTUNREACH);
1194 }
1195
1196 void
1197 icmp6_fasttimo(void)
1198 {
1199
1200 mld6_fasttimeo();
1201 }
1202
1203 const char *
1204 icmp6_redirect_diag(struct in6_addr *src6, struct in6_addr *dst6,
1205 struct in6_addr *tgt6)
1206 {
1207 static char buf[1024]; /* XXX */
1208 char src[INET6_ADDRSTRLEN];
1209 char dst[INET6_ADDRSTRLEN];
1210 char tgt[INET6_ADDRSTRLEN];
1211
1212 snprintf(buf, sizeof(buf), "(src=%s dst=%s tgt=%s)",
1213 inet_ntop(AF_INET6, src6, src, sizeof(src)),
1214 inet_ntop(AF_INET6, dst6, dst, sizeof(dst)),
1215 inet_ntop(AF_INET6, tgt6, tgt, sizeof(tgt)));
1216 return buf;
1217 }
1218
1219 void
1220 icmp6_redirect_input(struct mbuf *m, int off)
1221 {
1222 struct ifnet *ifp;
1223 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1224 struct nd_redirect *nd_rd;
1225 int icmp6len = ntohs(ip6->ip6_plen);
1226 char *lladdr = NULL;
1227 int lladdrlen = 0;
1228 struct rtentry *rt = NULL;
1229 int is_router;
1230 int is_onlink;
1231 struct in6_addr src6 = ip6->ip6_src;
1232 struct in6_addr redtgt6;
1233 struct in6_addr reddst6;
1234 struct nd_opts ndopts;
1235 char addr[INET6_ADDRSTRLEN];
1236
1237 ifp = if_get(m->m_pkthdr.ph_ifidx);
1238 if (ifp == NULL)
1239 return;
1240
1241 /* XXX if we are router, we don't update route by icmp6 redirect */
1242 if (ip6_forwarding)
1243 goto freeit;
1244 if (!(ifp->if_xflags & IFXF_AUTOCONF6))
1245 goto freeit;
1246
1247 IP6_EXTHDR_GET(nd_rd, struct nd_redirect *, m, off, icmp6len);
1248 if (nd_rd == NULL) {
1249 icmp6stat_inc(icp6s_tooshort);
1250 if_put(ifp);
1251 return;
1252 }
1253 redtgt6 = nd_rd->nd_rd_target;
1254 reddst6 = nd_rd->nd_rd_dst;
1255
1256 if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
1257 redtgt6.s6_addr16[1] = htons(ifp->if_index);
1258 if (IN6_IS_ADDR_LINKLOCAL(&reddst6))
1259 reddst6.s6_addr16[1] = htons(ifp->if_index);
1260
1261 /* validation */
1262 if (!IN6_IS_ADDR_LINKLOCAL(&src6)) {
1263 nd6log((LOG_ERR,
1264 "ICMP6 redirect sent from %s rejected; "
1265 "must be from linklocal\n",
1266 inet_ntop(AF_INET6, &src6, addr, sizeof(addr))));
1267 goto bad;
1268 }
1269 if (ip6->ip6_hlim != 255) {
1270 nd6log((LOG_ERR,
1271 "ICMP6 redirect sent from %s rejected; "
1272 "hlim=%d (must be 255)\n",
1273 inet_ntop(AF_INET6, &src6, addr, sizeof(addr)),
1274 ip6->ip6_hlim));
1275 goto bad;
1276 }
1277 if (IN6_IS_ADDR_MULTICAST(&reddst6)) {
1278 nd6log((LOG_ERR,
1279 "ICMP6 redirect rejected; "
1280 "redirect dst must be unicast: %s\n",
1281 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1282 goto bad;
1283 }
1284 {
1285 /* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */
1286 struct sockaddr_in6 sin6;
1287 struct in6_addr *gw6;
1288
1289 bzero(&sin6, sizeof(sin6));
1290 sin6.sin6_family = AF_INET6;
1291 sin6.sin6_len = sizeof(struct sockaddr_in6);
1292 memcpy(&sin6.sin6_addr, &reddst6, sizeof(reddst6));
1293 rt = rtalloc(sin6tosa(&sin6), 0, m->m_pkthdr.ph_rtableid);
1294 if (rt) {
1295 if (rt->rt_gateway == NULL ||
1296 rt->rt_gateway->sa_family != AF_INET6) {
1297 nd6log((LOG_ERR,
1298 "ICMP6 redirect rejected; no route "
1299 "with inet6 gateway found for redirect dst: %s\n",
1300 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1301 rtfree(rt);
1302 goto bad;
1303 }
1304
1305 gw6 = &(satosin6(rt->rt_gateway)->sin6_addr);
1306 if (bcmp(&src6, gw6, sizeof(struct in6_addr)) != 0) {
1307 nd6log((LOG_ERR,
1308 "ICMP6 redirect rejected; "
1309 "not equal to gw-for-src=%s (must be same): "
1310 "%s\n",
1311 inet_ntop(AF_INET6, gw6, addr, sizeof(addr)),
1312 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1313 rtfree(rt);
1314 goto bad;
1315 }
1316 } else {
1317 nd6log((LOG_ERR,
1318 "ICMP6 redirect rejected; "
1319 "no route found for redirect dst: %s\n",
1320 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1321 goto bad;
1322 }
1323 rtfree(rt);
1324 rt = NULL;
1325 }
1326
1327 is_router = is_onlink = 0;
1328 if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
1329 is_router = 1; /* router case */
1330 if (bcmp(&redtgt6, &reddst6, sizeof(redtgt6)) == 0)
1331 is_onlink = 1; /* on-link destination case */
1332 if (!is_router && !is_onlink) {
1333 nd6log((LOG_ERR,
1334 "ICMP6 redirect rejected; "
1335 "neither router case nor onlink case: %s\n",
1336 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1337 goto bad;
1338 }
1339 /* validation passed */
1340
1341 icmp6len -= sizeof(*nd_rd);
1342 if (nd6_options(nd_rd + 1, icmp6len, &ndopts) < 0) {
1343 nd6log((LOG_INFO, "icmp6_redirect_input: "
1344 "invalid ND option, rejected: %s\n",
1345 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1346 /* nd6_options have incremented stats */
1347 goto freeit;
1348 }
1349
1350 if (ndopts.nd_opts_tgt_lladdr) {
1351 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1);
1352 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
1353 }
1354
1355 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
1356 nd6log((LOG_INFO,
1357 "icmp6_redirect_input: lladdrlen mismatch for %s "
1358 "(if %d, icmp6 packet %d): %s\n",
1359 inet_ntop(AF_INET6, &redtgt6, addr, sizeof(addr)),
1360 ifp->if_addrlen, lladdrlen - 2,
1361 icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
1362 goto bad;
1363 }
1364
1365 /* RFC 2461 8.3 */
1366 nd6_cache_lladdr(ifp, &redtgt6, lladdr, lladdrlen, ND_REDIRECT,
1367 is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER);
1368
1369 if (!is_onlink) { /* better router case. perform rtredirect. */
1370 /* perform rtredirect */
1371 struct sockaddr_in6 sdst;
1372 struct sockaddr_in6 sgw;
1373 struct sockaddr_in6 ssrc;
1374 unsigned long rtcount;
1375 struct rtentry *newrt = NULL;
1376
1377 /*
1378 * do not install redirect route, if the number of entries
1379 * is too much (> hiwat). note that, the node (= host) will
1380 * work just fine even if we do not install redirect route
1381 * (there will be additional hops, though).
1382 */
1383 rtcount = rt_timer_queue_count(&icmp6_redirect_timeout_q);
1384 if (0 <= ip6_maxdynroutes && rtcount >= ip6_maxdynroutes)
1385 goto freeit;
1386
1387 bzero(&sdst, sizeof(sdst));
1388 bzero(&sgw, sizeof(sgw));
1389 bzero(&ssrc, sizeof(ssrc));
1390 sdst.sin6_family = sgw.sin6_family = ssrc.sin6_family = AF_INET6;
1391 sdst.sin6_len = sgw.sin6_len = ssrc.sin6_len =
1392 sizeof(struct sockaddr_in6);
1393 memcpy(&sgw.sin6_addr, &redtgt6, sizeof(struct in6_addr));
1394 memcpy(&sdst.sin6_addr, &reddst6, sizeof(struct in6_addr));
1395 memcpy(&ssrc.sin6_addr, &src6, sizeof(struct in6_addr));
1396 rtredirect(sin6tosa(&sdst), sin6tosa(&sgw), sin6tosa(&ssrc),
1397 &newrt, m->m_pkthdr.ph_rtableid);
1398 if (newrt != NULL && icmp6_redirtimeout > 0) {
1399 rt_timer_add(newrt, &icmp6_redirect_timeout_q,
1400 m->m_pkthdr.ph_rtableid);
1401 }
1402 rtfree(newrt);
1403 }
1404 /* finally update cached route in each socket via pfctlinput */
1405 {
1406 struct sockaddr_in6 sdst;
1407
1408 bzero(&sdst, sizeof(sdst));
1409 sdst.sin6_family = AF_INET6;
1410 sdst.sin6_len = sizeof(struct sockaddr_in6);
1411 memcpy(&sdst.sin6_addr, &reddst6, sizeof(struct in6_addr));
1412 pfctlinput(PRC_REDIRECT_HOST, sin6tosa(&sdst));
1413 }
1414
1415 freeit:
1416 if_put(ifp);
1417 m_freem(m);
1418 return;
1419
1420 bad:
1421 if_put(ifp);
1422 icmp6stat_inc(icp6s_badredirect);
1423 m_freem(m);
1424 }
1425
1426 void
1427 icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
1428 {
1429 struct ifnet *ifp = NULL;
1430 struct in6_addr *ifp_ll6;
1431 struct in6_addr *nexthop;
1432 struct ip6_hdr *sip6; /* m0 as struct ip6_hdr */
1433 struct mbuf *m = NULL; /* newly allocated one */
1434 struct ip6_hdr *ip6; /* m as struct ip6_hdr */
1435 struct nd_redirect *nd_rd;
1436 size_t maxlen;
1437 u_char *p;
1438 struct sockaddr_in6 src_sa;
1439
1440 icmp6_errcount(ND_REDIRECT, 0);
1441
1442 /* if we are not router, we don't send icmp6 redirect */
1443 if (!ip6_forwarding)
1444 goto fail;
1445
1446 /* sanity check */
1447 if (m0 == NULL || !rtisvalid(rt))
1448 goto fail;
1449
1450 ifp = if_get(rt->rt_ifidx);
1451 if (ifp == NULL)
1452 goto fail;
1453
1454 /*
1455 * Address check:
1456 * the source address must identify a neighbor, and
1457 * the destination address must not be a multicast address
1458 * [RFC 2461, sec 8.2]
1459 */
1460 sip6 = mtod(m0, struct ip6_hdr *);
1461 bzero(&src_sa, sizeof(src_sa));
1462 src_sa.sin6_family = AF_INET6;
1463 src_sa.sin6_len = sizeof(src_sa);
1464 src_sa.sin6_addr = sip6->ip6_src;
1465 /* we don't currently use sin6_scope_id, but eventually use it */
1466 src_sa.sin6_scope_id = in6_addr2scopeid(ifp->if_index, &sip6->ip6_src);
1467 if (nd6_is_addr_neighbor(&src_sa, ifp) == 0)
1468 goto fail;
1469 if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst))
1470 goto fail; /* what should we do here? */
1471
1472 /* rate limit */
1473 if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0))
1474 goto fail;
1475
1476 /*
1477 * Since we are going to append up to 1280 bytes (= IPV6_MMTU),
1478 * we almost always ask for an mbuf cluster for simplicity.
1479 * (MHLEN < IPV6_MMTU is almost always true)
1480 */
1481 #if IPV6_MMTU >= MCLBYTES
1482 # error assumption failed about IPV6_MMTU and MCLBYTES
1483 #endif
1484 MGETHDR(m, M_DONTWAIT, MT_HEADER);
1485 if (m && IPV6_MMTU >= MHLEN)
1486 MCLGET(m, M_DONTWAIT);
1487 if (!m)
1488 goto fail;
1489 m->m_pkthdr.ph_ifidx = 0;
1490 m->m_len = 0;
1491 maxlen = m_trailingspace(m);
1492 maxlen = min(IPV6_MMTU, maxlen);
1493 /* just for safety */
1494 if (maxlen < sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) +
1495 ((sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7)) {
1496 goto fail;
1497 }
1498
1499 {
1500 /* get ip6 linklocal address for ifp(my outgoing interface). */
1501 struct in6_ifaddr *ia6;
1502 if ((ia6 = in6ifa_ifpforlinklocal(ifp, IN6_IFF_TENTATIVE|
1503 IN6_IFF_DUPLICATED|IN6_IFF_ANYCAST)) == NULL)
1504 goto fail;
1505 ifp_ll6 = &ia6->ia_addr.sin6_addr;
1506 }
1507
1508 /* get ip6 linklocal address for the router. */
1509 if (rt->rt_gateway && (rt->rt_flags & RTF_GATEWAY)) {
1510 struct sockaddr_in6 *sin6;
1511 sin6 = satosin6(rt->rt_gateway);
1512 nexthop = &sin6->sin6_addr;
1513 if (!IN6_IS_ADDR_LINKLOCAL(nexthop))
1514 nexthop = NULL;
1515 } else
1516 nexthop = NULL;
1517
1518 /* ip6 */
1519 ip6 = mtod(m, struct ip6_hdr *);
1520 ip6->ip6_flow = 0;
1521 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
1522 ip6->ip6_vfc |= IPV6_VERSION;
1523 /* ip6->ip6_plen will be set later */
1524 ip6->ip6_nxt = IPPROTO_ICMPV6;
1525 ip6->ip6_hlim = 255;
1526 /* ip6->ip6_src must be linklocal addr for my outgoing if. */
1527 bcopy(ifp_ll6, &ip6->ip6_src, sizeof(struct in6_addr));
1528 bcopy(&sip6->ip6_src, &ip6->ip6_dst, sizeof(struct in6_addr));
1529
1530 /* ND Redirect */
1531 nd_rd = (struct nd_redirect *)(ip6 + 1);
1532 nd_rd->nd_rd_type = ND_REDIRECT;
1533 nd_rd->nd_rd_code = 0;
1534 nd_rd->nd_rd_reserved = 0;
1535 if (rt->rt_flags & RTF_GATEWAY) {
1536 /*
1537 * nd_rd->nd_rd_target must be a link-local address in
1538 * better router cases.
1539 */
1540 if (!nexthop)
1541 goto fail;
1542 bcopy(nexthop, &nd_rd->nd_rd_target,
1543 sizeof(nd_rd->nd_rd_target));
1544 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
1545 sizeof(nd_rd->nd_rd_dst));
1546 } else {
1547 /* make sure redtgt == reddst */
1548 nexthop = &sip6->ip6_dst;
1549 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_target,
1550 sizeof(nd_rd->nd_rd_target));
1551 bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
1552 sizeof(nd_rd->nd_rd_dst));
1553 }
1554
1555 p = (u_char *)(nd_rd + 1);
1556
1557 {
1558 /* target lladdr option */
1559 struct rtentry *nrt;
1560 int len;
1561 struct sockaddr_dl *sdl;
1562 struct nd_opt_hdr *nd_opt;
1563 char *lladdr;
1564
1565 len = sizeof(*nd_opt) + ifp->if_addrlen;
1566 len = (len + 7) & ~7; /* round by 8 */
1567 /* safety check */
1568 if (len + (p - (u_char *)ip6) > maxlen)
1569 goto nolladdropt;
1570 nrt = nd6_lookup(nexthop, 0, ifp, ifp->if_rdomain);
1571 if ((nrt != NULL) &&
1572 (nrt->rt_flags & (RTF_GATEWAY|RTF_LLINFO)) == RTF_LLINFO &&
1573 (nrt->rt_gateway->sa_family == AF_LINK) &&
1574 (sdl = satosdl(nrt->rt_gateway)) &&
1575 sdl->sdl_alen) {
1576 nd_opt = (struct nd_opt_hdr *)p;
1577 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
1578 nd_opt->nd_opt_len = len >> 3;
1579 lladdr = (char *)(nd_opt + 1);
1580 bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen);
1581 p += len;
1582 }
1583 rtfree(nrt);
1584 }
1585 nolladdropt:;
1586
1587 m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
1588
1589 /* just to be safe */
1590 if (p - (u_char *)ip6 > maxlen)
1591 goto noredhdropt;
1592
1593 {
1594 /* redirected header option */
1595 int len;
1596 struct nd_opt_rd_hdr *nd_opt_rh;
1597
1598 /*
1599 * compute the maximum size for icmp6 redirect header option.
1600 * XXX room for auth header?
1601 */
1602 len = maxlen - (p - (u_char *)ip6);
1603 len &= ~7;
1604
1605 /*
1606 * Redirected header option spec (RFC2461 4.6.3) talks nothing
1607 * about padding/truncate rule for the original IP packet.
1608 * From the discussion on IPv6imp in Feb 1999,
1609 * the consensus was:
1610 * - "attach as much as possible" is the goal
1611 * - pad if not aligned (original size can be guessed by
1612 * original ip6 header)
1613 * Following code adds the padding if it is simple enough,
1614 * and truncates if not.
1615 */
1616 if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) {
1617 /* not enough room, truncate */
1618 m_adj(m0, (len - sizeof(*nd_opt_rh)) -
1619 m0->m_pkthdr.len);
1620 } else {
1621 /*
1622 * enough room, truncate if not aligned.
1623 * we don't pad here for simplicity.
1624 */
1625 size_t extra;
1626
1627 extra = m0->m_pkthdr.len % 8;
1628 if (extra) {
1629 /* truncate */
1630 m_adj(m0, -extra);
1631 }
1632 len = m0->m_pkthdr.len + sizeof(*nd_opt_rh);
1633 }
1634
1635 nd_opt_rh = (struct nd_opt_rd_hdr *)p;
1636 bzero(nd_opt_rh, sizeof(*nd_opt_rh));
1637 nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER;
1638 nd_opt_rh->nd_opt_rh_len = len >> 3;
1639 p += sizeof(*nd_opt_rh);
1640 m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
1641
1642 /* connect m0 to m */
1643 m->m_pkthdr.len += m0->m_pkthdr.len;
1644 m_cat(m, m0);
1645 m0 = NULL;
1646 }
1647 noredhdropt:
1648 m_freem(m0);
1649 m0 = NULL;
1650
1651 sip6 = mtod(m, struct ip6_hdr *);
1652 if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_src))
1653 sip6->ip6_src.s6_addr16[1] = 0;
1654 if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_dst))
1655 sip6->ip6_dst.s6_addr16[1] = 0;
1656 #if 0
1657 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src))
1658 ip6->ip6_src.s6_addr16[1] = 0;
1659 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst))
1660 ip6->ip6_dst.s6_addr16[1] = 0;
1661 #endif
1662 if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_target))
1663 nd_rd->nd_rd_target.s6_addr16[1] = 0;
1664 if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_dst))
1665 nd_rd->nd_rd_dst.s6_addr16[1] = 0;
1666
1667 ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
1668
1669 nd_rd->nd_rd_cksum = 0;
1670 m->m_pkthdr.csum_flags = M_ICMP_CSUM_OUT;
1671
1672 /* send the packet to outside... */
1673 ip6_output(m, NULL, NULL, 0, NULL, NULL);
1674
1675 icmp6stat_inc(icp6s_outhist + ND_REDIRECT);
1676
1677 if_put(ifp);
1678 return;
1679
1680 fail:
1681 if_put(ifp);
1682 m_freem(m);
1683 m_freem(m0);
1684 }
1685
1686 /*
1687 * ICMPv6 socket option processing.
1688 */
1689 int
1690 icmp6_ctloutput(int op, struct socket *so, int level, int optname,
1691 struct mbuf *m)
1692 {
1693 int error = 0;
1694 struct inpcb *in6p = sotoinpcb(so);
1695
1696 if (level != IPPROTO_ICMPV6)
1697 return EINVAL;
1698
1699 switch (op) {
1700 case PRCO_SETOPT:
1701 switch (optname) {
1702 case ICMP6_FILTER:
1703 {
1704 struct icmp6_filter *p;
1705
1706 if (m == NULL || m->m_len != sizeof(*p)) {
1707 error = EMSGSIZE;
1708 break;
1709 }
1710 p = mtod(m, struct icmp6_filter *);
1711 if (!p || !in6p->inp_icmp6filt) {
1712 error = EINVAL;
1713 break;
1714 }
1715 bcopy(p, in6p->inp_icmp6filt,
1716 sizeof(struct icmp6_filter));
1717 error = 0;
1718 break;
1719 }
1720
1721 default:
1722 error = ENOPROTOOPT;
1723 break;
1724 }
1725 break;
1726
1727 case PRCO_GETOPT:
1728 switch (optname) {
1729 case ICMP6_FILTER:
1730 {
1731 struct icmp6_filter *p;
1732
1733 if (!in6p->inp_icmp6filt) {
1734 error = EINVAL;
1735 break;
1736 }
1737 m->m_len = sizeof(struct icmp6_filter);
1738 p = mtod(m, struct icmp6_filter *);
1739 bcopy(in6p->inp_icmp6filt, p,
1740 sizeof(struct icmp6_filter));
1741 error = 0;
1742 break;
1743 }
1744
1745 default:
1746 error = ENOPROTOOPT;
1747 break;
1748 }
1749 break;
1750 }
1751
1752 return (error);
1753 }
1754
1755 /*
1756 * Perform rate limit check.
1757 * Returns 0 if it is okay to send the icmp6 packet.
1758 * Returns 1 if the router SHOULD NOT send this icmp6 packet due to rate
1759 * limitation.
1760 *
1761 * XXX per-destination/type check necessary?
1762 *
1763 * dst - not used at this moment
1764 * type - not used at this moment
1765 * code - not used at this moment
1766 */
1767 int
1768 icmp6_ratelimit(const struct in6_addr *dst, const int type, const int code)
1769 {
1770 /* PPS limit */
1771 if (!ppsratecheck(&icmp6errppslim_last, &icmp6errpps_count,
1772 icmp6errppslim))
1773 return 1; /* The packet is subject to rate limit */
1774 return 0; /* okay to send */
1775 }
1776
1777 struct rtentry *
1778 icmp6_mtudisc_clone(struct sockaddr_in6 *dst, u_int rtableid, int ipsec)
1779 {
1780 struct rtentry *rt;
1781 int error;
1782
1783 rt = rtalloc(sin6tosa(dst), RT_RESOLVE, rtableid);
1784
1785 /* Check if the route is actually usable */
1786 if (!rtisvalid(rt))
1787 goto bad;
1788 /* IPsec needs the route only for PMTU, it can use reject for that */
1789 if (!ipsec && (rt->rt_flags & (RTF_REJECT|RTF_BLACKHOLE)))
1790 goto bad;
1791
1792 /*
1793 * No PMTU for local routes and permanent neighbors,
1794 * ARP and NDP use the same expire timer as the route.
1795 */
1796 if (ISSET(rt->rt_flags, RTF_LOCAL) ||
1797 (ISSET(rt->rt_flags, RTF_LLINFO) && rt->rt_expire == 0))
1798 goto bad;
1799
1800 /* If we didn't get a host route, allocate one */
1801 if ((rt->rt_flags & RTF_HOST) == 0) {
1802 struct rtentry *nrt;
1803 struct rt_addrinfo info;
1804 struct sockaddr_rtlabel sa_rl;
1805
1806 memset(&info, 0, sizeof(info));
1807 info.rti_ifa = rt->rt_ifa;
1808 info.rti_flags = RTF_GATEWAY | RTF_HOST | RTF_DYNAMIC;
1809 info.rti_info[RTAX_DST] = sin6tosa(dst);
1810 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1811 info.rti_info[RTAX_LABEL] =
1812 rtlabel_id2sa(rt->rt_labelid, &sa_rl);
1813
1814 error = rtrequest(RTM_ADD, &info, rt->rt_priority, &nrt,
1815 rtableid);
1816 if (error)
1817 goto bad;
1818 nrt->rt_rmx = rt->rt_rmx;
1819 rtfree(rt);
1820 rt = nrt;
1821 rtm_send(rt, RTM_ADD, 0, rtableid);
1822 }
1823 error = rt_timer_add(rt, &icmp6_mtudisc_timeout_q, rtableid);
1824 if (error)
1825 goto bad;
1826
1827 return (rt);
1828 bad:
1829 rtfree(rt);
1830 return (NULL);
1831 }
1832
1833 void
1834 icmp6_mtudisc_timeout(struct rtentry *rt, u_int rtableid)
1835 {
1836 struct ifnet *ifp;
1837
1838 NET_ASSERT_LOCKED();
1839
1840 ifp = if_get(rt->rt_ifidx);
1841 if (ifp == NULL)
1842 return;
1843
1844 if ((rt->rt_flags & (RTF_DYNAMIC|RTF_HOST)) == (RTF_DYNAMIC|RTF_HOST)) {
1845 rtdeletemsg(rt, ifp, rtableid);
1846 } else {
1847 if (!(rt->rt_locks & RTV_MTU))
1848 rt->rt_mtu = 0;
1849 }
1850
1851 if_put(ifp);
1852 }
1853
1854 const struct sysctl_bounded_args icmpv6ctl_vars[] = {
1855 { ICMPV6CTL_ND6_DELAY, &nd6_delay, 0, INT_MAX },
1856 { ICMPV6CTL_ND6_UMAXTRIES, &nd6_umaxtries, 0, INT_MAX },
1857 { ICMPV6CTL_ND6_MMAXTRIES, &nd6_mmaxtries, 0, INT_MAX },
1858 { ICMPV6CTL_ERRPPSLIMIT, &icmp6errppslim, -1, 1000 },
1859 { ICMPV6CTL_ND6_MAXNUDHINT, &nd6_maxnudhint, 0, INT_MAX },
1860 { ICMPV6CTL_MTUDISC_HIWAT, &icmp6_mtudisc_hiwat, -1, INT_MAX },
1861 { ICMPV6CTL_MTUDISC_LOWAT, &icmp6_mtudisc_lowat, -1, INT_MAX },
1862 { ICMPV6CTL_ND6_DEBUG, &nd6_debug, 0, 1 },
1863 };
1864
1865 int
1866 icmp6_sysctl_icmp6stat(void *oldp, size_t *oldlenp, void *newp)
1867 {
1868 struct icmp6stat *icmp6stat;
1869 int ret;
1870
1871 CTASSERT(sizeof(*icmp6stat) == icp6s_ncounters * sizeof(uint64_t));
1872 icmp6stat = malloc(sizeof(*icmp6stat), M_TEMP, M_WAITOK|M_ZERO);
1873 counters_read(icmp6counters, (uint64_t *)icmp6stat, icp6s_ncounters);
1874 ret = sysctl_rdstruct(oldp, oldlenp, newp,
1875 icmp6stat, sizeof(*icmp6stat));
1876 free(icmp6stat, M_TEMP, sizeof(*icmp6stat));
1877
1878 return (ret);
1879 }
1880
1881 int
1882 icmp6_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp,
1883 void *newp, size_t newlen)
1884 {
1885 int error;
1886
1887 /* All sysctl names at this level are terminal. */
1888 if (namelen != 1)
1889 return (ENOTDIR);
1890
1891 switch (name[0]) {
1892 case ICMPV6CTL_REDIRTIMEOUT:
1893 NET_LOCK();
1894 error = sysctl_int_bounded(oldp, oldlenp, newp, newlen,
1895 &icmp6_redirtimeout, 0, INT_MAX);
1896 rt_timer_queue_change(&icmp6_redirect_timeout_q,
1897 icmp6_redirtimeout);
1898 NET_UNLOCK();
1899 break;
1900
1901 case ICMPV6CTL_STATS:
1902 error = icmp6_sysctl_icmp6stat(oldp, oldlenp, newp);
1903 break;
1904
1905 default:
1906 NET_LOCK();
1907 error = sysctl_bounded_arr(icmpv6ctl_vars,
1908 nitems(icmpv6ctl_vars), name, namelen, oldp, oldlenp, newp,
1909 newlen);
1910 NET_UNLOCK();
1911 break;
1912 }
1913
1914 return (error);
1915 }
Cache object: b4db3ae89c7bfe19b9ef28b7fe3a7041
|