Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netinet6/ip6_input.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the project nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 * 29 * $KAME: ip6_input.c,v 1.259 2002/01/21 04:58:09 jinmei Exp $ 30 */ 31 32 /*- 33 * Copyright (c) 1982, 1986, 1988, 1993 34 * The Regents of the University of California. All rights reserved. 35 * 36 * Redistribution and use in source and binary forms, with or without 37 * modification, are permitted provided that the following conditions 38 * are met: 39 * 1. Redistributions of source code must retain the above copyright 40 * notice, this list of conditions and the following disclaimer. 41 * 2. Redistributions in binary form must reproduce the above copyright 42 * notice, this list of conditions and the following disclaimer in the 43 * documentation and/or other materials provided with the distribution. 44 * 4. Neither the name of the University nor the names of its contributors 45 * may be used to endorse or promote products derived from this software 46 * without specific prior written permission. 47 * 48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 58 * SUCH DAMAGE. 59 * 60 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 61 */ 62 63 #include <sys/cdefs.h> 64 __FBSDID("$FreeBSD: releng/9.0/sys/netinet6/ip6_input.c 236953 2012-06-12 12:10:10Z bz $"); 65 66 #include "opt_inet.h" 67 #include "opt_inet6.h" 68 #include "opt_ipfw.h" 69 #include "opt_ipsec.h" 70 #include "opt_route.h" 71 72 #include <sys/param.h> 73 #include <sys/systm.h> 74 #include <sys/malloc.h> 75 #include <sys/mbuf.h> 76 #include <sys/proc.h> 77 #include <sys/domain.h> 78 #include <sys/protosw.h> 79 #include <sys/socket.h> 80 #include <sys/socketvar.h> 81 #include <sys/errno.h> 82 #include <sys/time.h> 83 #include <sys/kernel.h> 84 #include <sys/syslog.h> 85 86 #include <net/if.h> 87 #include <net/if_types.h> 88 #include <net/if_dl.h> 89 #include <net/route.h> 90 #include <net/netisr.h> 91 #include <net/pfil.h> 92 #include <net/vnet.h> 93 94 #include <netinet/in.h> 95 #include <netinet/ip_var.h> 96 #include <netinet/in_systm.h> 97 #include <net/if_llatbl.h> 98 #ifdef INET 99 #include <netinet/ip.h> 100 #include <netinet/ip_icmp.h> 101 #endif /* INET */ 102 #include <netinet/ip6.h> 103 #include <netinet6/in6_var.h> 104 #include <netinet6/ip6_var.h> 105 #include <netinet/in_pcb.h> 106 #include <netinet/icmp6.h> 107 #include <netinet6/scope6_var.h> 108 #include <netinet6/in6_ifattach.h> 109 #include <netinet6/nd6.h> 110 111 #ifdef IPSEC 112 #include <netipsec/ipsec.h> 113 #include <netinet6/ip6_ipsec.h> 114 #include <netipsec/ipsec6.h> 115 #endif /* IPSEC */ 116 117 #include <netinet6/ip6protosw.h> 118 119 #ifdef FLOWTABLE 120 #include <net/flowtable.h> 121 VNET_DECLARE(int, ip6_output_flowtable_size); 122 #define V_ip6_output_flowtable_size VNET(ip6_output_flowtable_size) 123 #endif 124 125 extern struct domain inet6domain; 126 127 u_char ip6_protox[IPPROTO_MAX]; 128 VNET_DEFINE(struct in6_ifaddrhead, in6_ifaddrhead); 129 130 static struct netisr_handler ip6_nh = { 131 .nh_name = "ip6", 132 .nh_handler = ip6_input, 133 .nh_proto = NETISR_IPV6, 134 .nh_policy = NETISR_POLICY_FLOW, 135 }; 136 137 VNET_DECLARE(struct callout, in6_tmpaddrtimer_ch); 138 #define V_in6_tmpaddrtimer_ch VNET(in6_tmpaddrtimer_ch) 139 140 VNET_DEFINE(struct pfil_head, inet6_pfil_hook); 141 142 VNET_DEFINE(struct ip6stat, ip6stat); 143 144 struct rwlock in6_ifaddr_lock; 145 RW_SYSINIT(in6_ifaddr_lock, &in6_ifaddr_lock, "in6_ifaddr_lock"); 146 147 static void ip6_init2(void *); 148 static struct ip6aux *ip6_setdstifaddr(struct mbuf *, struct in6_ifaddr *); 149 static int ip6_hopopts_input(u_int32_t *, u_int32_t *, struct mbuf **, int *); 150 #ifdef PULLDOWN_TEST 151 static struct mbuf *ip6_pullexthdr(struct mbuf *, size_t, int); 152 #endif 153 154 /* 155 * IP6 initialization: fill in IP6 protocol switch table. 156 * All protocols not implemented in kernel go to raw IP6 protocol handler. 157 */ 158 void 159 ip6_init(void) 160 { 161 struct ip6protosw *pr; 162 int i; 163 164 TUNABLE_INT_FETCH("net.inet6.ip6.auto_linklocal", 165 &V_ip6_auto_linklocal); 166 167 TAILQ_INIT(&V_in6_ifaddrhead); 168 169 /* Initialize packet filter hooks. */ 170 V_inet6_pfil_hook.ph_type = PFIL_TYPE_AF; 171 V_inet6_pfil_hook.ph_af = AF_INET6; 172 if ((i = pfil_head_register(&V_inet6_pfil_hook)) != 0) 173 printf("%s: WARNING: unable to register pfil hook, " 174 "error %d\n", __func__, i); 175 176 scope6_init(); 177 addrsel_policy_init(); 178 nd6_init(); 179 frag6_init(); 180 181 #ifdef FLOWTABLE 182 if (TUNABLE_INT_FETCH("net.inet6.ip6.output_flowtable_size", 183 &V_ip6_output_flowtable_size)) { 184 if (V_ip6_output_flowtable_size < 256) 185 V_ip6_output_flowtable_size = 256; 186 if (!powerof2(V_ip6_output_flowtable_size)) { 187 printf("flowtable must be power of 2 size\n"); 188 V_ip6_output_flowtable_size = 2048; 189 } 190 } else { 191 /* 192 * round up to the next power of 2 193 */ 194 V_ip6_output_flowtable_size = 1 << fls((1024 + maxusers * 64)-1); 195 } 196 V_ip6_ft = flowtable_alloc("ipv6", V_ip6_output_flowtable_size, FL_IPV6|FL_PCPU); 197 #endif 198 199 V_ip6_desync_factor = arc4random() % MAX_TEMP_DESYNC_FACTOR; 200 201 /* Skip global initialization stuff for non-default instances. */ 202 if (!IS_DEFAULT_VNET(curvnet)) 203 return; 204 205 #ifdef DIAGNOSTIC 206 if (sizeof(struct protosw) != sizeof(struct ip6protosw)) 207 panic("sizeof(protosw) != sizeof(ip6protosw)"); 208 #endif 209 pr = (struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW); 210 if (pr == NULL) 211 panic("ip6_init"); 212 213 /* Initialize the entire ip6_protox[] array to IPPROTO_RAW. */ 214 for (i = 0; i < IPPROTO_MAX; i++) 215 ip6_protox[i] = pr - inet6sw; 216 /* 217 * Cycle through IP protocols and put them into the appropriate place 218 * in ip6_protox[]. 219 */ 220 for (pr = (struct ip6protosw *)inet6domain.dom_protosw; 221 pr < (struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++) 222 if (pr->pr_domain->dom_family == PF_INET6 && 223 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) { 224 /* Be careful to only index valid IP protocols. */ 225 if (pr->pr_protocol < IPPROTO_MAX) 226 ip6_protox[pr->pr_protocol] = pr - inet6sw; 227 } 228 229 netisr_register(&ip6_nh); 230 } 231 232 /* 233 * The protocol to be inserted into ip6_protox[] must be already registered 234 * in inet6sw[], either statically or through pf_proto_register(). 235 */ 236 int 237 ip6proto_register(short ip6proto) 238 { 239 struct ip6protosw *pr; 240 241 /* Sanity checks. */ 242 if (ip6proto <= 0 || ip6proto >= IPPROTO_MAX) 243 return (EPROTONOSUPPORT); 244 245 /* 246 * The protocol slot must not be occupied by another protocol 247 * already. An index pointing to IPPROTO_RAW is unused. 248 */ 249 pr = (struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW); 250 if (pr == NULL) 251 return (EPFNOSUPPORT); 252 if (ip6_protox[ip6proto] != pr - inet6sw) /* IPPROTO_RAW */ 253 return (EEXIST); 254 255 /* 256 * Find the protocol position in inet6sw[] and set the index. 257 */ 258 for (pr = (struct ip6protosw *)inet6domain.dom_protosw; 259 pr < (struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++) { 260 if (pr->pr_domain->dom_family == PF_INET6 && 261 pr->pr_protocol && pr->pr_protocol == ip6proto) { 262 ip6_protox[pr->pr_protocol] = pr - inet6sw; 263 return (0); 264 } 265 } 266 return (EPROTONOSUPPORT); 267 } 268 269 int 270 ip6proto_unregister(short ip6proto) 271 { 272 struct ip6protosw *pr; 273 274 /* Sanity checks. */ 275 if (ip6proto <= 0 || ip6proto >= IPPROTO_MAX) 276 return (EPROTONOSUPPORT); 277 278 /* Check if the protocol was indeed registered. */ 279 pr = (struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW); 280 if (pr == NULL) 281 return (EPFNOSUPPORT); 282 if (ip6_protox[ip6proto] == pr - inet6sw) /* IPPROTO_RAW */ 283 return (ENOENT); 284 285 /* Reset the protocol slot to IPPROTO_RAW. */ 286 ip6_protox[ip6proto] = pr - inet6sw; 287 return (0); 288 } 289 290 #ifdef VIMAGE 291 void 292 ip6_destroy() 293 { 294 295 nd6_destroy(); 296 callout_drain(&V_in6_tmpaddrtimer_ch); 297 } 298 #endif 299 300 static int 301 ip6_init2_vnet(const void *unused __unused) 302 { 303 304 /* nd6_timer_init */ 305 callout_init(&V_nd6_timer_ch, 0); 306 callout_reset(&V_nd6_timer_ch, hz, nd6_timer, curvnet); 307 308 /* timer for regeneranation of temporary addresses randomize ID */ 309 callout_init(&V_in6_tmpaddrtimer_ch, 0); 310 callout_reset(&V_in6_tmpaddrtimer_ch, 311 (V_ip6_temp_preferred_lifetime - V_ip6_desync_factor - 312 V_ip6_temp_regen_advance) * hz, 313 in6_tmpaddrtimer, curvnet); 314 315 return (0); 316 } 317 318 static void 319 ip6_init2(void *dummy) 320 { 321 322 ip6_init2_vnet(NULL); 323 } 324 325 /* cheat */ 326 /* This must be after route_init(), which is now SI_ORDER_THIRD */ 327 SYSINIT(netinet6init2, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ip6_init2, NULL); 328 329 void 330 ip6_input(struct mbuf *m) 331 { 332 struct ip6_hdr *ip6; 333 int off = sizeof(struct ip6_hdr), nest; 334 u_int32_t plen; 335 u_int32_t rtalert = ~0; 336 int nxt, ours = 0; 337 struct ifnet *deliverifp = NULL, *ifp = NULL; 338 struct in6_addr odst; 339 struct route_in6 rin6; 340 int srcrt = 0; 341 struct llentry *lle = NULL; 342 struct sockaddr_in6 dst6, *dst; 343 344 bzero(&rin6, sizeof(struct route_in6)); 345 #ifdef IPSEC 346 /* 347 * should the inner packet be considered authentic? 348 * see comment in ah4_input(). 349 * NB: m cannot be NULL when passed to the input routine 350 */ 351 352 m->m_flags &= ~M_AUTHIPHDR; 353 m->m_flags &= ~M_AUTHIPDGM; 354 355 #endif /* IPSEC */ 356 357 /* 358 * make sure we don't have onion peering information into m_tag. 359 */ 360 ip6_delaux(m); 361 362 if (m->m_flags & M_FASTFWD_OURS) { 363 /* 364 * Firewall changed destination to local. 365 */ 366 m->m_flags &= ~M_FASTFWD_OURS; 367 ours = 1; 368 deliverifp = m->m_pkthdr.rcvif; 369 ip6 = mtod(m, struct ip6_hdr *); 370 goto hbhcheck; 371 } 372 373 /* 374 * mbuf statistics 375 */ 376 if (m->m_flags & M_EXT) { 377 if (m->m_next) 378 V_ip6stat.ip6s_mext2m++; 379 else 380 V_ip6stat.ip6s_mext1++; 381 } else { 382 #define M2MMAX (sizeof(V_ip6stat.ip6s_m2m)/sizeof(V_ip6stat.ip6s_m2m[0])) 383 if (m->m_next) { 384 if (m->m_flags & M_LOOP) { 385 V_ip6stat.ip6s_m2m[V_loif->if_index]++; 386 } else if (m->m_pkthdr.rcvif->if_index < M2MMAX) 387 V_ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++; 388 else 389 V_ip6stat.ip6s_m2m[0]++; 390 } else 391 V_ip6stat.ip6s_m1++; 392 #undef M2MMAX 393 } 394 395 /* drop the packet if IPv6 operation is disabled on the IF */ 396 if ((ND_IFINFO(m->m_pkthdr.rcvif)->flags & ND6_IFF_IFDISABLED)) { 397 m_freem(m); 398 return; 399 } 400 401 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive); 402 V_ip6stat.ip6s_total++; 403 404 #ifndef PULLDOWN_TEST 405 /* 406 * L2 bridge code and some other code can return mbuf chain 407 * that does not conform to KAME requirement. too bad. 408 * XXX: fails to join if interface MTU > MCLBYTES. jumbogram? 409 */ 410 if (m && m->m_next != NULL && m->m_pkthdr.len < MCLBYTES) { 411 struct mbuf *n; 412 413 MGETHDR(n, M_DONTWAIT, MT_HEADER); 414 if (n) 415 M_MOVE_PKTHDR(n, m); 416 if (n && n->m_pkthdr.len > MHLEN) { 417 MCLGET(n, M_DONTWAIT); 418 if ((n->m_flags & M_EXT) == 0) { 419 m_freem(n); 420 n = NULL; 421 } 422 } 423 if (n == NULL) { 424 m_freem(m); 425 return; /* ENOBUFS */ 426 } 427 428 m_copydata(m, 0, n->m_pkthdr.len, mtod(n, caddr_t)); 429 n->m_len = n->m_pkthdr.len; 430 m_freem(m); 431 m = n; 432 } 433 IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), /* nothing */); 434 #endif 435 436 if (m->m_len < sizeof(struct ip6_hdr)) { 437 struct ifnet *inifp; 438 inifp = m->m_pkthdr.rcvif; 439 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 440 V_ip6stat.ip6s_toosmall++; 441 in6_ifstat_inc(inifp, ifs6_in_hdrerr); 442 return; 443 } 444 } 445 446 ip6 = mtod(m, struct ip6_hdr *); 447 448 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) { 449 V_ip6stat.ip6s_badvers++; 450 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 451 goto bad; 452 } 453 454 V_ip6stat.ip6s_nxthist[ip6->ip6_nxt]++; 455 456 /* 457 * Check against address spoofing/corruption. 458 */ 459 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) || 460 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { 461 /* 462 * XXX: "badscope" is not very suitable for a multicast source. 463 */ 464 V_ip6stat.ip6s_badscope++; 465 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 466 goto bad; 467 } 468 if (IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst) && 469 !(m->m_flags & M_LOOP)) { 470 /* 471 * In this case, the packet should come from the loopback 472 * interface. However, we cannot just check the if_flags, 473 * because ip6_mloopback() passes the "actual" interface 474 * as the outgoing/incoming interface. 475 */ 476 V_ip6stat.ip6s_badscope++; 477 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 478 goto bad; 479 } 480 481 #ifdef ALTQ 482 if (altq_input != NULL && (*altq_input)(m, AF_INET6) == 0) { 483 /* packet is dropped by traffic conditioner */ 484 return; 485 } 486 #endif 487 /* 488 * The following check is not documented in specs. A malicious 489 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack 490 * and bypass security checks (act as if it was from 127.0.0.1 by using 491 * IPv6 src ::ffff:127.0.0.1). Be cautious. 492 * 493 * This check chokes if we are in an SIIT cloud. As none of BSDs 494 * support IPv4-less kernel compilation, we cannot support SIIT 495 * environment at all. So, it makes more sense for us to reject any 496 * malicious packets for non-SIIT environment, than try to do a 497 * partial support for SIIT environment. 498 */ 499 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 500 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 501 V_ip6stat.ip6s_badscope++; 502 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 503 goto bad; 504 } 505 #if 0 506 /* 507 * Reject packets with IPv4 compatible addresses (auto tunnel). 508 * 509 * The code forbids auto tunnel relay case in RFC1933 (the check is 510 * stronger than RFC1933). We may want to re-enable it if mech-xx 511 * is revised to forbid relaying case. 512 */ 513 if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) || 514 IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) { 515 V_ip6stat.ip6s_badscope++; 516 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 517 goto bad; 518 } 519 #endif 520 #ifdef IPSEC 521 /* 522 * Bypass packet filtering for packets previously handled by IPsec. 523 */ 524 if (ip6_ipsec_filtertunnel(m)) 525 goto passin; 526 #endif /* IPSEC */ 527 528 /* 529 * Run through list of hooks for input packets. 530 * 531 * NB: Beware of the destination address changing 532 * (e.g. by NAT rewriting). When this happens, 533 * tell ip6_forward to do the right thing. 534 */ 535 odst = ip6->ip6_dst; 536 537 /* Jump over all PFIL processing if hooks are not active. */ 538 if (!PFIL_HOOKED(&V_inet6_pfil_hook)) 539 goto passin; 540 541 if (pfil_run_hooks(&V_inet6_pfil_hook, &m, 542 m->m_pkthdr.rcvif, PFIL_IN, NULL)) 543 return; 544 if (m == NULL) /* consumed by filter */ 545 return; 546 ip6 = mtod(m, struct ip6_hdr *); 547 srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst); 548 549 #ifdef IPFIREWALL_FORWARD 550 if (m->m_flags & M_FASTFWD_OURS) { 551 m->m_flags &= ~M_FASTFWD_OURS; 552 ours = 1; 553 deliverifp = m->m_pkthdr.rcvif; 554 goto hbhcheck; 555 } 556 if (m_tag_find(m, PACKET_TAG_IPFORWARD, NULL) != NULL) { 557 /* 558 * Directly ship the packet on. This allows forwarding 559 * packets originally destined to us to some other directly 560 * connected host. 561 */ 562 ip6_forward(m, 1); 563 goto out; 564 } 565 #endif /* IPFIREWALL_FORWARD */ 566 567 passin: 568 /* 569 * Disambiguate address scope zones (if there is ambiguity). 570 * We first make sure that the original source or destination address 571 * is not in our internal form for scoped addresses. Such addresses 572 * are not necessarily invalid spec-wise, but we cannot accept them due 573 * to the usage conflict. 574 * in6_setscope() then also checks and rejects the cases where src or 575 * dst are the loopback address and the receiving interface 576 * is not loopback. 577 */ 578 if (in6_clearscope(&ip6->ip6_src) || in6_clearscope(&ip6->ip6_dst)) { 579 V_ip6stat.ip6s_badscope++; /* XXX */ 580 goto bad; 581 } 582 if (in6_setscope(&ip6->ip6_src, m->m_pkthdr.rcvif, NULL) || 583 in6_setscope(&ip6->ip6_dst, m->m_pkthdr.rcvif, NULL)) { 584 V_ip6stat.ip6s_badscope++; 585 goto bad; 586 } 587 588 /* 589 * Multicast check. Assume packet is for us to avoid 590 * prematurely taking locks. 591 */ 592 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 593 ours = 1; 594 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast); 595 deliverifp = m->m_pkthdr.rcvif; 596 goto hbhcheck; 597 } 598 599 /* 600 * Unicast check 601 */ 602 603 bzero(&dst6, sizeof(dst6)); 604 dst6.sin6_family = AF_INET6; 605 dst6.sin6_len = sizeof(struct sockaddr_in6); 606 dst6.sin6_addr = ip6->ip6_dst; 607 ifp = m->m_pkthdr.rcvif; 608 IF_AFDATA_LOCK(ifp); 609 lle = lla_lookup(LLTABLE6(ifp), 0, 610 (struct sockaddr *)&dst6); 611 IF_AFDATA_UNLOCK(ifp); 612 if ((lle != NULL) && (lle->la_flags & LLE_IFADDR)) { 613 struct ifaddr *ifa; 614 struct in6_ifaddr *ia6; 615 int bad; 616 617 bad = 1; 618 #define sa_equal(a1, a2) \ 619 (bcmp((a1), (a2), ((a1))->sin6_len) == 0) 620 IF_ADDR_LOCK(ifp); 621 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) { 622 if (ifa->ifa_addr->sa_family != dst6.sin6_family) 623 continue; 624 if (sa_equal(&dst6, ifa->ifa_addr)) 625 break; 626 } 627 KASSERT(ifa != NULL, ("%s: ifa not found for lle %p", 628 __func__, lle)); 629 #undef sa_equal 630 631 ia6 = (struct in6_ifaddr *)ifa; 632 if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) { 633 /* Count the packet in the ip address stats */ 634 ia6->ia_ifa.if_ipackets++; 635 ia6->ia_ifa.if_ibytes += m->m_pkthdr.len; 636 637 /* 638 * record address information into m_tag. 639 */ 640 (void)ip6_setdstifaddr(m, ia6); 641 642 bad = 0; 643 } else { 644 char ip6bufs[INET6_ADDRSTRLEN]; 645 char ip6bufd[INET6_ADDRSTRLEN]; 646 /* address is not ready, so discard the packet. */ 647 nd6log((LOG_INFO, 648 "ip6_input: packet to an unready address %s->%s\n", 649 ip6_sprintf(ip6bufs, &ip6->ip6_src), 650 ip6_sprintf(ip6bufd, &ip6->ip6_dst))); 651 } 652 IF_ADDR_UNLOCK(ifp); 653 LLE_RUNLOCK(lle); 654 if (bad) 655 goto bad; 656 else { 657 ours = 1; 658 deliverifp = ifp; 659 goto hbhcheck; 660 } 661 } 662 if (lle != NULL) 663 LLE_RUNLOCK(lle); 664 665 dst = &rin6.ro_dst; 666 dst->sin6_len = sizeof(struct sockaddr_in6); 667 dst->sin6_family = AF_INET6; 668 dst->sin6_addr = ip6->ip6_dst; 669 rin6.ro_rt = rtalloc1((struct sockaddr *)dst, 0, 0); 670 if (rin6.ro_rt) 671 RT_UNLOCK(rin6.ro_rt); 672 673 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key)) 674 675 /* 676 * Accept the packet if the forwarding interface to the destination 677 * according to the routing table is the loopback interface, 678 * unless the associated route has a gateway. 679 * Note that this approach causes to accept a packet if there is a 680 * route to the loopback interface for the destination of the packet. 681 * But we think it's even useful in some situations, e.g. when using 682 * a special daemon which wants to intercept the packet. 683 * 684 * XXX: some OSes automatically make a cloned route for the destination 685 * of an outgoing packet. If the outgoing interface of the packet 686 * is a loopback one, the kernel would consider the packet to be 687 * accepted, even if we have no such address assinged on the interface. 688 * We check the cloned flag of the route entry to reject such cases, 689 * assuming that route entries for our own addresses are not made by 690 * cloning (it should be true because in6_addloop explicitly installs 691 * the host route). However, we might have to do an explicit check 692 * while it would be less efficient. Or, should we rather install a 693 * reject route for such a case? 694 */ 695 if (rin6.ro_rt && 696 (rin6.ro_rt->rt_flags & 697 (RTF_HOST|RTF_GATEWAY)) == RTF_HOST && 698 #ifdef RTF_WASCLONED 699 !(rin6.ro_rt->rt_flags & RTF_WASCLONED) && 700 #endif 701 #ifdef RTF_CLONED 702 !(rin6.ro_rt->rt_flags & RTF_CLONED) && 703 #endif 704 #if 0 705 /* 706 * The check below is redundant since the comparison of 707 * the destination and the key of the rtentry has 708 * already done through looking up the routing table. 709 */ 710 IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, 711 &rt6_key(rin6.ro_rt)->sin6_addr) 712 #endif 713 rin6.ro_rt->rt_ifp->if_type == IFT_LOOP) { 714 int free_ia6 = 0; 715 struct in6_ifaddr *ia6; 716 717 /* 718 * found the loopback route to the interface address 719 */ 720 if (rin6.ro_rt->rt_gateway->sa_family == AF_LINK) { 721 struct sockaddr_in6 dest6; 722 723 bzero(&dest6, sizeof(dest6)); 724 dest6.sin6_family = AF_INET6; 725 dest6.sin6_len = sizeof(dest6); 726 dest6.sin6_addr = ip6->ip6_dst; 727 ia6 = (struct in6_ifaddr *) 728 ifa_ifwithaddr((struct sockaddr *)&dest6); 729 if (ia6 == NULL) 730 goto bad; 731 free_ia6 = 1; 732 } 733 else 734 ia6 = (struct in6_ifaddr *)rin6.ro_rt->rt_ifa; 735 736 /* 737 * record address information into m_tag. 738 */ 739 (void)ip6_setdstifaddr(m, ia6); 740 741 /* 742 * packets to a tentative, duplicated, or somehow invalid 743 * address must not be accepted. 744 */ 745 if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) { 746 /* this address is ready */ 747 ours = 1; 748 deliverifp = ia6->ia_ifp; /* correct? */ 749 /* Count the packet in the ip address stats */ 750 ia6->ia_ifa.if_ipackets++; 751 ia6->ia_ifa.if_ibytes += m->m_pkthdr.len; 752 if (ia6 != NULL && free_ia6 != 0) 753 ifa_free(&ia6->ia_ifa); 754 goto hbhcheck; 755 } else { 756 char ip6bufs[INET6_ADDRSTRLEN]; 757 char ip6bufd[INET6_ADDRSTRLEN]; 758 /* address is not ready, so discard the packet. */ 759 nd6log((LOG_INFO, 760 "ip6_input: packet to an unready address %s->%s\n", 761 ip6_sprintf(ip6bufs, &ip6->ip6_src), 762 ip6_sprintf(ip6bufd, &ip6->ip6_dst))); 763 764 if (ia6 != NULL && free_ia6 != 0) 765 ifa_free(&ia6->ia_ifa); 766 goto bad; 767 } 768 } 769 770 /* 771 * FAITH (Firewall Aided Internet Translator) 772 */ 773 if (V_ip6_keepfaith) { 774 if (rin6.ro_rt && rin6.ro_rt->rt_ifp && 775 rin6.ro_rt->rt_ifp->if_type == IFT_FAITH) { 776 /* XXX do we need more sanity checks? */ 777 ours = 1; 778 deliverifp = rin6.ro_rt->rt_ifp; /* faith */ 779 goto hbhcheck; 780 } 781 } 782 783 /* 784 * Now there is no reason to process the packet if it's not our own 785 * and we're not a router. 786 */ 787 if (!V_ip6_forwarding) { 788 V_ip6stat.ip6s_cantforward++; 789 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 790 goto bad; 791 } 792 793 hbhcheck: 794 /* 795 * record address information into m_tag, if we don't have one yet. 796 * note that we are unable to record it, if the address is not listed 797 * as our interface address (e.g. multicast addresses, addresses 798 * within FAITH prefixes and such). 799 */ 800 if (deliverifp) { 801 struct in6_ifaddr *ia6; 802 803 if ((ia6 = ip6_getdstifaddr(m)) != NULL) { 804 ifa_free(&ia6->ia_ifa); 805 } else { 806 ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst); 807 if (ia6) { 808 if (!ip6_setdstifaddr(m, ia6)) { 809 /* 810 * XXX maybe we should drop the packet here, 811 * as we could not provide enough information 812 * to the upper layers. 813 */ 814 } 815 ifa_free(&ia6->ia_ifa); 816 } 817 } 818 } 819 820 /* 821 * Process Hop-by-Hop options header if it's contained. 822 * m may be modified in ip6_hopopts_input(). 823 * If a JumboPayload option is included, plen will also be modified. 824 */ 825 plen = (u_int32_t)ntohs(ip6->ip6_plen); 826 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 827 struct ip6_hbh *hbh; 828 829 if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) { 830 #if 0 /*touches NULL pointer*/ 831 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 832 #endif 833 goto out; /* m have already been freed */ 834 } 835 836 /* adjust pointer */ 837 ip6 = mtod(m, struct ip6_hdr *); 838 839 /* 840 * if the payload length field is 0 and the next header field 841 * indicates Hop-by-Hop Options header, then a Jumbo Payload 842 * option MUST be included. 843 */ 844 if (ip6->ip6_plen == 0 && plen == 0) { 845 /* 846 * Note that if a valid jumbo payload option is 847 * contained, ip6_hopopts_input() must set a valid 848 * (non-zero) payload length to the variable plen. 849 */ 850 V_ip6stat.ip6s_badoptions++; 851 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 852 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 853 icmp6_error(m, ICMP6_PARAM_PROB, 854 ICMP6_PARAMPROB_HEADER, 855 (caddr_t)&ip6->ip6_plen - (caddr_t)ip6); 856 goto out; 857 } 858 #ifndef PULLDOWN_TEST 859 /* ip6_hopopts_input() ensures that mbuf is contiguous */ 860 hbh = (struct ip6_hbh *)(ip6 + 1); 861 #else 862 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 863 sizeof(struct ip6_hbh)); 864 if (hbh == NULL) { 865 V_ip6stat.ip6s_tooshort++; 866 goto out; 867 } 868 #endif 869 nxt = hbh->ip6h_nxt; 870 871 /* 872 * If we are acting as a router and the packet contains a 873 * router alert option, see if we know the option value. 874 * Currently, we only support the option value for MLD, in which 875 * case we should pass the packet to the multicast routing 876 * daemon. 877 */ 878 if (rtalert != ~0) { 879 switch (rtalert) { 880 case IP6OPT_RTALERT_MLD: 881 if (V_ip6_forwarding) 882 ours = 1; 883 break; 884 default: 885 /* 886 * RFC2711 requires unrecognized values must be 887 * silently ignored. 888 */ 889 break; 890 } 891 } 892 } else 893 nxt = ip6->ip6_nxt; 894 895 /* 896 * Check that the amount of data in the buffers 897 * is as at least much as the IPv6 header would have us expect. 898 * Trim mbufs if longer than we expect. 899 * Drop packet if shorter than we expect. 900 */ 901 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) { 902 V_ip6stat.ip6s_tooshort++; 903 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 904 goto bad; 905 } 906 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) { 907 if (m->m_len == m->m_pkthdr.len) { 908 m->m_len = sizeof(struct ip6_hdr) + plen; 909 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen; 910 } else 911 m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len); 912 } 913 914 /* 915 * Forward if desirable. 916 */ 917 if (V_ip6_mrouter && 918 IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) { 919 /* 920 * If we are acting as a multicast router, all 921 * incoming multicast packets are passed to the 922 * kernel-level multicast forwarding function. 923 * The packet is returned (relatively) intact; if 924 * ip6_mforward() returns a non-zero value, the packet 925 * must be discarded, else it may be accepted below. 926 * 927 * XXX TODO: Check hlim and multicast scope here to avoid 928 * unnecessarily calling into ip6_mforward(). 929 */ 930 if (ip6_mforward && 931 ip6_mforward(ip6, m->m_pkthdr.rcvif, m)) { 932 IP6STAT_INC(ip6s_cantforward); 933 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard); 934 goto bad; 935 } 936 } else if (!ours) { 937 ip6_forward(m, srcrt); 938 goto out; 939 } 940 941 ip6 = mtod(m, struct ip6_hdr *); 942 943 /* 944 * Malicious party may be able to use IPv4 mapped addr to confuse 945 * tcp/udp stack and bypass security checks (act as if it was from 946 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious. 947 * 948 * For SIIT end node behavior, you may want to disable the check. 949 * However, you will become vulnerable to attacks using IPv4 mapped 950 * source. 951 */ 952 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || 953 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { 954 V_ip6stat.ip6s_badscope++; 955 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr); 956 goto bad; 957 } 958 959 /* 960 * Tell launch routine the next header 961 */ 962 V_ip6stat.ip6s_delivered++; 963 in6_ifstat_inc(deliverifp, ifs6_in_deliver); 964 nest = 0; 965 966 while (nxt != IPPROTO_DONE) { 967 if (V_ip6_hdrnestlimit && (++nest > V_ip6_hdrnestlimit)) { 968 V_ip6stat.ip6s_toomanyhdr++; 969 goto bad; 970 } 971 972 /* 973 * protection against faulty packet - there should be 974 * more sanity checks in header chain processing. 975 */ 976 if (m->m_pkthdr.len < off) { 977 V_ip6stat.ip6s_tooshort++; 978 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated); 979 goto bad; 980 } 981 982 #ifdef IPSEC 983 /* 984 * enforce IPsec policy checking if we are seeing last header. 985 * note that we do not visit this with protocols with pcb layer 986 * code - like udp/tcp/raw ip. 987 */ 988 if (ip6_ipsec_input(m, nxt)) 989 goto bad; 990 #endif /* IPSEC */ 991 992 /* 993 * Use mbuf flags to propagate Router Alert option to 994 * ICMPv6 layer, as hop-by-hop options have been stripped. 995 */ 996 if (nxt == IPPROTO_ICMPV6 && rtalert != ~0) 997 m->m_flags |= M_RTALERT_MLD; 998 999 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); 1000 } 1001 goto out; 1002 bad: 1003 m_freem(m); 1004 out: 1005 if (rin6.ro_rt) 1006 RTFREE(rin6.ro_rt); 1007 } 1008 1009 /* 1010 * set/grab in6_ifaddr correspond to IPv6 destination address. 1011 * XXX backward compatibility wrapper 1012 * 1013 * XXXRW: We should bump the refcount on ia6 before sticking it in the m_tag, 1014 * and then bump it when the tag is copied, and release it when the tag is 1015 * freed. Unfortunately, m_tags don't support deep copies (yet), so instead 1016 * we just bump the ia refcount when we receive it. This should be fixed. 1017 */ 1018 static struct ip6aux * 1019 ip6_setdstifaddr(struct mbuf *m, struct in6_ifaddr *ia6) 1020 { 1021 struct ip6aux *ip6a; 1022 1023 ip6a = ip6_addaux(m); 1024 if (ip6a) 1025 ip6a->ip6a_dstia6 = ia6; 1026 return ip6a; /* NULL if failed to set */ 1027 } 1028 1029 struct in6_ifaddr * 1030 ip6_getdstifaddr(struct mbuf *m) 1031 { 1032 struct ip6aux *ip6a; 1033 struct in6_ifaddr *ia; 1034 1035 ip6a = ip6_findaux(m); 1036 if (ip6a) { 1037 ia = ip6a->ip6a_dstia6; 1038 ifa_ref(&ia->ia_ifa); 1039 return ia; 1040 } else 1041 return NULL; 1042 } 1043 1044 /* 1045 * Hop-by-Hop options header processing. If a valid jumbo payload option is 1046 * included, the real payload length will be stored in plenp. 1047 * 1048 * rtalertp - XXX: should be stored more smart way 1049 */ 1050 static int 1051 ip6_hopopts_input(u_int32_t *plenp, u_int32_t *rtalertp, 1052 struct mbuf **mp, int *offp) 1053 { 1054 struct mbuf *m = *mp; 1055 int off = *offp, hbhlen; 1056 struct ip6_hbh *hbh; 1057 u_int8_t *opt; 1058 1059 /* validation of the length of the header */ 1060 #ifndef PULLDOWN_TEST 1061 IP6_EXTHDR_CHECK(m, off, sizeof(*hbh), -1); 1062 hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off); 1063 hbhlen = (hbh->ip6h_len + 1) << 3; 1064 1065 IP6_EXTHDR_CHECK(m, off, hbhlen, -1); 1066 hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off); 1067 #else 1068 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, 1069 sizeof(struct ip6_hdr), sizeof(struct ip6_hbh)); 1070 if (hbh == NULL) { 1071 V_ip6stat.ip6s_tooshort++; 1072 return -1; 1073 } 1074 hbhlen = (hbh->ip6h_len + 1) << 3; 1075 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr), 1076 hbhlen); 1077 if (hbh == NULL) { 1078 V_ip6stat.ip6s_tooshort++; 1079 return -1; 1080 } 1081 #endif 1082 off += hbhlen; 1083 hbhlen -= sizeof(struct ip6_hbh); 1084 opt = (u_int8_t *)hbh + sizeof(struct ip6_hbh); 1085 1086 if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh), 1087 hbhlen, rtalertp, plenp) < 0) 1088 return (-1); 1089 1090 *offp = off; 1091 *mp = m; 1092 return (0); 1093 } 1094 1095 /* 1096 * Search header for all Hop-by-hop options and process each option. 1097 * This function is separate from ip6_hopopts_input() in order to 1098 * handle a case where the sending node itself process its hop-by-hop 1099 * options header. In such a case, the function is called from ip6_output(). 1100 * 1101 * The function assumes that hbh header is located right after the IPv6 header 1102 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to 1103 * opthead + hbhlen is located in contiguous memory region. 1104 */ 1105 int 1106 ip6_process_hopopts(struct mbuf *m, u_int8_t *opthead, int hbhlen, 1107 u_int32_t *rtalertp, u_int32_t *plenp) 1108 { 1109 struct ip6_hdr *ip6; 1110 int optlen = 0; 1111 u_int8_t *opt = opthead; 1112 u_int16_t rtalert_val; 1113 u_int32_t jumboplen; 1114 const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh); 1115 1116 for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) { 1117 switch (*opt) { 1118 case IP6OPT_PAD1: 1119 optlen = 1; 1120 break; 1121 case IP6OPT_PADN: 1122 if (hbhlen < IP6OPT_MINLEN) { 1123 V_ip6stat.ip6s_toosmall++; 1124 goto bad; 1125 } 1126 optlen = *(opt + 1) + 2; 1127 break; 1128 case IP6OPT_ROUTER_ALERT: 1129 /* XXX may need check for alignment */ 1130 if (hbhlen < IP6OPT_RTALERT_LEN) { 1131 V_ip6stat.ip6s_toosmall++; 1132 goto bad; 1133 } 1134 if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) { 1135 /* XXX stat */ 1136 icmp6_error(m, ICMP6_PARAM_PROB, 1137 ICMP6_PARAMPROB_HEADER, 1138 erroff + opt + 1 - opthead); 1139 return (-1); 1140 } 1141 optlen = IP6OPT_RTALERT_LEN; 1142 bcopy((caddr_t)(opt + 2), (caddr_t)&rtalert_val, 2); 1143 *rtalertp = ntohs(rtalert_val); 1144 break; 1145 case IP6OPT_JUMBO: 1146 /* XXX may need check for alignment */ 1147 if (hbhlen < IP6OPT_JUMBO_LEN) { 1148 V_ip6stat.ip6s_toosmall++; 1149 goto bad; 1150 } 1151 if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) { 1152 /* XXX stat */ 1153 icmp6_error(m, ICMP6_PARAM_PROB, 1154 ICMP6_PARAMPROB_HEADER, 1155 erroff + opt + 1 - opthead); 1156 return (-1); 1157 } 1158 optlen = IP6OPT_JUMBO_LEN; 1159 1160 /* 1161 * IPv6 packets that have non 0 payload length 1162 * must not contain a jumbo payload option. 1163 */ 1164 ip6 = mtod(m, struct ip6_hdr *); 1165 if (ip6->ip6_plen) { 1166 V_ip6stat.ip6s_badoptions++; 1167 icmp6_error(m, ICMP6_PARAM_PROB, 1168 ICMP6_PARAMPROB_HEADER, 1169 erroff + opt - opthead); 1170 return (-1); 1171 } 1172 1173 /* 1174 * We may see jumbolen in unaligned location, so 1175 * we'd need to perform bcopy(). 1176 */ 1177 bcopy(opt + 2, &jumboplen, sizeof(jumboplen)); 1178 jumboplen = (u_int32_t)htonl(jumboplen); 1179 1180 #if 1 1181 /* 1182 * if there are multiple jumbo payload options, 1183 * *plenp will be non-zero and the packet will be 1184 * rejected. 1185 * the behavior may need some debate in ipngwg - 1186 * multiple options does not make sense, however, 1187 * there's no explicit mention in specification. 1188 */ 1189 if (*plenp != 0) { 1190 V_ip6stat.ip6s_badoptions++; 1191 icmp6_error(m, ICMP6_PARAM_PROB, 1192 ICMP6_PARAMPROB_HEADER, 1193 erroff + opt + 2 - opthead); 1194 return (-1); 1195 } 1196 #endif 1197 1198 /* 1199 * jumbo payload length must be larger than 65535. 1200 */ 1201 if (jumboplen <= IPV6_MAXPACKET) { 1202 V_ip6stat.ip6s_badoptions++; 1203 icmp6_error(m, ICMP6_PARAM_PROB, 1204 ICMP6_PARAMPROB_HEADER, 1205 erroff + opt + 2 - opthead); 1206 return (-1); 1207 } 1208 *plenp = jumboplen; 1209 1210 break; 1211 default: /* unknown option */ 1212 if (hbhlen < IP6OPT_MINLEN) { 1213 V_ip6stat.ip6s_toosmall++; 1214 goto bad; 1215 } 1216 optlen = ip6_unknown_opt(opt, m, 1217 erroff + opt - opthead); 1218 if (optlen == -1) 1219 return (-1); 1220 optlen += 2; 1221 break; 1222 } 1223 } 1224 1225 return (0); 1226 1227 bad: 1228 m_freem(m); 1229 return (-1); 1230 } 1231 1232 /* 1233 * Unknown option processing. 1234 * The third argument `off' is the offset from the IPv6 header to the option, 1235 * which is necessary if the IPv6 header the and option header and IPv6 header 1236 * is not contiguous in order to return an ICMPv6 error. 1237 */ 1238 int 1239 ip6_unknown_opt(u_int8_t *optp, struct mbuf *m, int off) 1240 { 1241 struct ip6_hdr *ip6; 1242 1243 switch (IP6OPT_TYPE(*optp)) { 1244 case IP6OPT_TYPE_SKIP: /* ignore the option */ 1245 return ((int)*(optp + 1)); 1246 case IP6OPT_TYPE_DISCARD: /* silently discard */ 1247 m_freem(m); 1248 return (-1); 1249 case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */ 1250 V_ip6stat.ip6s_badoptions++; 1251 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off); 1252 return (-1); 1253 case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */ 1254 V_ip6stat.ip6s_badoptions++; 1255 ip6 = mtod(m, struct ip6_hdr *); 1256 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 1257 (m->m_flags & (M_BCAST|M_MCAST))) 1258 m_freem(m); 1259 else 1260 icmp6_error(m, ICMP6_PARAM_PROB, 1261 ICMP6_PARAMPROB_OPTION, off); 1262 return (-1); 1263 } 1264 1265 m_freem(m); /* XXX: NOTREACHED */ 1266 return (-1); 1267 } 1268 1269 /* 1270 * Create the "control" list for this pcb. 1271 * These functions will not modify mbuf chain at all. 1272 * 1273 * With KAME mbuf chain restriction: 1274 * The routine will be called from upper layer handlers like tcp6_input(). 1275 * Thus the routine assumes that the caller (tcp6_input) have already 1276 * called IP6_EXTHDR_CHECK() and all the extension headers are located in the 1277 * very first mbuf on the mbuf chain. 1278 * 1279 * ip6_savecontrol_v4 will handle those options that are possible to be 1280 * set on a v4-mapped socket. 1281 * ip6_savecontrol will directly call ip6_savecontrol_v4 to handle those 1282 * options and handle the v6-only ones itself. 1283 */ 1284 struct mbuf ** 1285 ip6_savecontrol_v4(struct inpcb *inp, struct mbuf *m, struct mbuf **mp, 1286 int *v4only) 1287 { 1288 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1289 1290 #ifdef SO_TIMESTAMP 1291 if ((inp->inp_socket->so_options & SO_TIMESTAMP) != 0) { 1292 struct timeval tv; 1293 1294 microtime(&tv); 1295 *mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv), 1296 SCM_TIMESTAMP, SOL_SOCKET); 1297 if (*mp) 1298 mp = &(*mp)->m_next; 1299 } 1300 #endif 1301 1302 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) { 1303 if (v4only != NULL) 1304 *v4only = 1; 1305 return (mp); 1306 } 1307 1308 #define IS2292(inp, x, y) (((inp)->inp_flags & IN6P_RFC2292) ? (x) : (y)) 1309 /* RFC 2292 sec. 5 */ 1310 if ((inp->inp_flags & IN6P_PKTINFO) != 0) { 1311 struct in6_pktinfo pi6; 1312 1313 bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr)); 1314 in6_clearscope(&pi6.ipi6_addr); /* XXX */ 1315 pi6.ipi6_ifindex = 1316 (m && m->m_pkthdr.rcvif) ? m->m_pkthdr.rcvif->if_index : 0; 1317 1318 *mp = sbcreatecontrol((caddr_t) &pi6, 1319 sizeof(struct in6_pktinfo), 1320 IS2292(inp, IPV6_2292PKTINFO, IPV6_PKTINFO), IPPROTO_IPV6); 1321 if (*mp) 1322 mp = &(*mp)->m_next; 1323 } 1324 1325 if ((inp->inp_flags & IN6P_HOPLIMIT) != 0) { 1326 int hlim = ip6->ip6_hlim & 0xff; 1327 1328 *mp = sbcreatecontrol((caddr_t) &hlim, sizeof(int), 1329 IS2292(inp, IPV6_2292HOPLIMIT, IPV6_HOPLIMIT), 1330 IPPROTO_IPV6); 1331 if (*mp) 1332 mp = &(*mp)->m_next; 1333 } 1334 1335 if (v4only != NULL) 1336 *v4only = 0; 1337 return (mp); 1338 } 1339 1340 void 1341 ip6_savecontrol(struct inpcb *in6p, struct mbuf *m, struct mbuf **mp) 1342 { 1343 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1344 int v4only = 0; 1345 1346 mp = ip6_savecontrol_v4(in6p, m, mp, &v4only); 1347 if (v4only) 1348 return; 1349 1350 if ((in6p->inp_flags & IN6P_TCLASS) != 0) { 1351 u_int32_t flowinfo; 1352 int tclass; 1353 1354 flowinfo = (u_int32_t)ntohl(ip6->ip6_flow & IPV6_FLOWINFO_MASK); 1355 flowinfo >>= 20; 1356 1357 tclass = flowinfo & 0xff; 1358 *mp = sbcreatecontrol((caddr_t) &tclass, sizeof(tclass), 1359 IPV6_TCLASS, IPPROTO_IPV6); 1360 if (*mp) 1361 mp = &(*mp)->m_next; 1362 } 1363 1364 /* 1365 * IPV6_HOPOPTS socket option. Recall that we required super-user 1366 * privilege for the option (see ip6_ctloutput), but it might be too 1367 * strict, since there might be some hop-by-hop options which can be 1368 * returned to normal user. 1369 * See also RFC 2292 section 6 (or RFC 3542 section 8). 1370 */ 1371 if ((in6p->inp_flags & IN6P_HOPOPTS) != 0) { 1372 /* 1373 * Check if a hop-by-hop options header is contatined in the 1374 * received packet, and if so, store the options as ancillary 1375 * data. Note that a hop-by-hop options header must be 1376 * just after the IPv6 header, which is assured through the 1377 * IPv6 input processing. 1378 */ 1379 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) { 1380 struct ip6_hbh *hbh; 1381 int hbhlen = 0; 1382 #ifdef PULLDOWN_TEST 1383 struct mbuf *ext; 1384 #endif 1385 1386 #ifndef PULLDOWN_TEST 1387 hbh = (struct ip6_hbh *)(ip6 + 1); 1388 hbhlen = (hbh->ip6h_len + 1) << 3; 1389 #else 1390 ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr), 1391 ip6->ip6_nxt); 1392 if (ext == NULL) { 1393 V_ip6stat.ip6s_tooshort++; 1394 return; 1395 } 1396 hbh = mtod(ext, struct ip6_hbh *); 1397 hbhlen = (hbh->ip6h_len + 1) << 3; 1398 if (hbhlen != ext->m_len) { 1399 m_freem(ext); 1400 V_ip6stat.ip6s_tooshort++; 1401 return; 1402 } 1403 #endif 1404 1405 /* 1406 * XXX: We copy the whole header even if a 1407 * jumbo payload option is included, the option which 1408 * is to be removed before returning according to 1409 * RFC2292. 1410 * Note: this constraint is removed in RFC3542 1411 */ 1412 *mp = sbcreatecontrol((caddr_t)hbh, hbhlen, 1413 IS2292(in6p, IPV6_2292HOPOPTS, IPV6_HOPOPTS), 1414 IPPROTO_IPV6); 1415 if (*mp) 1416 mp = &(*mp)->m_next; 1417 #ifdef PULLDOWN_TEST 1418 m_freem(ext); 1419 #endif 1420 } 1421 } 1422 1423 if ((in6p->inp_flags & (IN6P_RTHDR | IN6P_DSTOPTS)) != 0) { 1424 int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr); 1425 1426 /* 1427 * Search for destination options headers or routing 1428 * header(s) through the header chain, and stores each 1429 * header as ancillary data. 1430 * Note that the order of the headers remains in 1431 * the chain of ancillary data. 1432 */ 1433 while (1) { /* is explicit loop prevention necessary? */ 1434 struct ip6_ext *ip6e = NULL; 1435 int elen; 1436 #ifdef PULLDOWN_TEST 1437 struct mbuf *ext = NULL; 1438 #endif 1439 1440 /* 1441 * if it is not an extension header, don't try to 1442 * pull it from the chain. 1443 */ 1444 switch (nxt) { 1445 case IPPROTO_DSTOPTS: 1446 case IPPROTO_ROUTING: 1447 case IPPROTO_HOPOPTS: 1448 case IPPROTO_AH: /* is it possible? */ 1449 break; 1450 default: 1451 goto loopend; 1452 } 1453 1454 #ifndef PULLDOWN_TEST 1455 if (off + sizeof(*ip6e) > m->m_len) 1456 goto loopend; 1457 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off); 1458 if (nxt == IPPROTO_AH) 1459 elen = (ip6e->ip6e_len + 2) << 2; 1460 else 1461 elen = (ip6e->ip6e_len + 1) << 3; 1462 if (off + elen > m->m_len) 1463 goto loopend; 1464 #else 1465 ext = ip6_pullexthdr(m, off, nxt); 1466 if (ext == NULL) { 1467 V_ip6stat.ip6s_tooshort++; 1468 return; 1469 } 1470 ip6e = mtod(ext, struct ip6_ext *); 1471 if (nxt == IPPROTO_AH) 1472 elen = (ip6e->ip6e_len + 2) << 2; 1473 else 1474 elen = (ip6e->ip6e_len + 1) << 3; 1475 if (elen != ext->m_len) { 1476 m_freem(ext); 1477 V_ip6stat.ip6s_tooshort++; 1478 return; 1479 } 1480 #endif 1481 1482 switch (nxt) { 1483 case IPPROTO_DSTOPTS: 1484 if (!(in6p->inp_flags & IN6P_DSTOPTS)) 1485 break; 1486 1487 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1488 IS2292(in6p, 1489 IPV6_2292DSTOPTS, IPV6_DSTOPTS), 1490 IPPROTO_IPV6); 1491 if (*mp) 1492 mp = &(*mp)->m_next; 1493 break; 1494 case IPPROTO_ROUTING: 1495 if (!(in6p->inp_flags & IN6P_RTHDR)) 1496 break; 1497 1498 *mp = sbcreatecontrol((caddr_t)ip6e, elen, 1499 IS2292(in6p, IPV6_2292RTHDR, IPV6_RTHDR), 1500 IPPROTO_IPV6); 1501 if (*mp) 1502 mp = &(*mp)->m_next; 1503 break; 1504 case IPPROTO_HOPOPTS: 1505 case IPPROTO_AH: /* is it possible? */ 1506 break; 1507 1508 default: 1509 /* 1510 * other cases have been filtered in the above. 1511 * none will visit this case. here we supply 1512 * the code just in case (nxt overwritten or 1513 * other cases). 1514 */ 1515 #ifdef PULLDOWN_TEST 1516 m_freem(ext); 1517 #endif 1518 goto loopend; 1519 1520 } 1521 1522 /* proceed with the next header. */ 1523 off += elen; 1524 nxt = ip6e->ip6e_nxt; 1525 ip6e = NULL; 1526 #ifdef PULLDOWN_TEST 1527 m_freem(ext); 1528 ext = NULL; 1529 #endif 1530 } 1531 loopend: 1532 ; 1533 } 1534 } 1535 #undef IS2292 1536 1537 void 1538 ip6_notify_pmtu(struct inpcb *in6p, struct sockaddr_in6 *dst, u_int32_t *mtu) 1539 { 1540 struct socket *so; 1541 struct mbuf *m_mtu; 1542 struct ip6_mtuinfo mtuctl; 1543 1544 so = in6p->inp_socket; 1545 1546 if (mtu == NULL) 1547 return; 1548 1549 #ifdef DIAGNOSTIC 1550 if (so == NULL) /* I believe this is impossible */ 1551 panic("ip6_notify_pmtu: socket is NULL"); 1552 #endif 1553 1554 bzero(&mtuctl, sizeof(mtuctl)); /* zero-clear for safety */ 1555 mtuctl.ip6m_mtu = *mtu; 1556 mtuctl.ip6m_addr = *dst; 1557 if (sa6_recoverscope(&mtuctl.ip6m_addr)) 1558 return; 1559 1560 if ((m_mtu = sbcreatecontrol((caddr_t)&mtuctl, sizeof(mtuctl), 1561 IPV6_PATHMTU, IPPROTO_IPV6)) == NULL) 1562 return; 1563 1564 if (sbappendaddr(&so->so_rcv, (struct sockaddr *)dst, NULL, m_mtu) 1565 == 0) { 1566 m_freem(m_mtu); 1567 /* XXX: should count statistics */ 1568 } else 1569 sorwakeup(so); 1570 1571 return; 1572 } 1573 1574 #ifdef PULLDOWN_TEST 1575 /* 1576 * pull single extension header from mbuf chain. returns single mbuf that 1577 * contains the result, or NULL on error. 1578 */ 1579 static struct mbuf * 1580 ip6_pullexthdr(struct mbuf *m, size_t off, int nxt) 1581 { 1582 struct ip6_ext ip6e; 1583 size_t elen; 1584 struct mbuf *n; 1585 1586 #ifdef DIAGNOSTIC 1587 switch (nxt) { 1588 case IPPROTO_DSTOPTS: 1589 case IPPROTO_ROUTING: 1590 case IPPROTO_HOPOPTS: 1591 case IPPROTO_AH: /* is it possible? */ 1592 break; 1593 default: 1594 printf("ip6_pullexthdr: invalid nxt=%d\n", nxt); 1595 } 1596 #endif 1597 1598 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1599 if (nxt == IPPROTO_AH) 1600 elen = (ip6e.ip6e_len + 2) << 2; 1601 else 1602 elen = (ip6e.ip6e_len + 1) << 3; 1603 1604 MGET(n, M_DONTWAIT, MT_DATA); 1605 if (n && elen >= MLEN) { 1606 MCLGET(n, M_DONTWAIT); 1607 if ((n->m_flags & M_EXT) == 0) { 1608 m_free(n); 1609 n = NULL; 1610 } 1611 } 1612 if (!n) 1613 return NULL; 1614 1615 n->m_len = 0; 1616 if (elen >= M_TRAILINGSPACE(n)) { 1617 m_free(n); 1618 return NULL; 1619 } 1620 1621 m_copydata(m, off, elen, mtod(n, caddr_t)); 1622 n->m_len = elen; 1623 return n; 1624 } 1625 #endif 1626 1627 /* 1628 * Get pointer to the previous header followed by the header 1629 * currently processed. 1630 * XXX: This function supposes that 1631 * M includes all headers, 1632 * the next header field and the header length field of each header 1633 * are valid, and 1634 * the sum of each header length equals to OFF. 1635 * Because of these assumptions, this function must be called very 1636 * carefully. Moreover, it will not be used in the near future when 1637 * we develop `neater' mechanism to process extension headers. 1638 */ 1639 char * 1640 ip6_get_prevhdr(struct mbuf *m, int off) 1641 { 1642 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1643 1644 if (off == sizeof(struct ip6_hdr)) 1645 return (&ip6->ip6_nxt); 1646 else { 1647 int len, nxt; 1648 struct ip6_ext *ip6e = NULL; 1649 1650 nxt = ip6->ip6_nxt; 1651 len = sizeof(struct ip6_hdr); 1652 while (len < off) { 1653 ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + len); 1654 1655 switch (nxt) { 1656 case IPPROTO_FRAGMENT: 1657 len += sizeof(struct ip6_frag); 1658 break; 1659 case IPPROTO_AH: 1660 len += (ip6e->ip6e_len + 2) << 2; 1661 break; 1662 default: 1663 len += (ip6e->ip6e_len + 1) << 3; 1664 break; 1665 } 1666 nxt = ip6e->ip6e_nxt; 1667 } 1668 if (ip6e) 1669 return (&ip6e->ip6e_nxt); 1670 else 1671 return NULL; 1672 } 1673 } 1674 1675 /* 1676 * get next header offset. m will be retained. 1677 */ 1678 int 1679 ip6_nexthdr(struct mbuf *m, int off, int proto, int *nxtp) 1680 { 1681 struct ip6_hdr ip6; 1682 struct ip6_ext ip6e; 1683 struct ip6_frag fh; 1684 1685 /* just in case */ 1686 if (m == NULL) 1687 panic("ip6_nexthdr: m == NULL"); 1688 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off) 1689 return -1; 1690 1691 switch (proto) { 1692 case IPPROTO_IPV6: 1693 if (m->m_pkthdr.len < off + sizeof(ip6)) 1694 return -1; 1695 m_copydata(m, off, sizeof(ip6), (caddr_t)&ip6); 1696 if (nxtp) 1697 *nxtp = ip6.ip6_nxt; 1698 off += sizeof(ip6); 1699 return off; 1700 1701 case IPPROTO_FRAGMENT: 1702 /* 1703 * terminate parsing if it is not the first fragment, 1704 * it does not make sense to parse through it. 1705 */ 1706 if (m->m_pkthdr.len < off + sizeof(fh)) 1707 return -1; 1708 m_copydata(m, off, sizeof(fh), (caddr_t)&fh); 1709 /* IP6F_OFF_MASK = 0xfff8(BigEndian), 0xf8ff(LittleEndian) */ 1710 if (fh.ip6f_offlg & IP6F_OFF_MASK) 1711 return -1; 1712 if (nxtp) 1713 *nxtp = fh.ip6f_nxt; 1714 off += sizeof(struct ip6_frag); 1715 return off; 1716 1717 case IPPROTO_AH: 1718 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1719 return -1; 1720 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1721 if (nxtp) 1722 *nxtp = ip6e.ip6e_nxt; 1723 off += (ip6e.ip6e_len + 2) << 2; 1724 return off; 1725 1726 case IPPROTO_HOPOPTS: 1727 case IPPROTO_ROUTING: 1728 case IPPROTO_DSTOPTS: 1729 if (m->m_pkthdr.len < off + sizeof(ip6e)) 1730 return -1; 1731 m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); 1732 if (nxtp) 1733 *nxtp = ip6e.ip6e_nxt; 1734 off += (ip6e.ip6e_len + 1) << 3; 1735 return off; 1736 1737 case IPPROTO_NONE: 1738 case IPPROTO_ESP: 1739 case IPPROTO_IPCOMP: 1740 /* give up */ 1741 return -1; 1742 1743 default: 1744 return -1; 1745 } 1746 1747 return -1; 1748 } 1749 1750 /* 1751 * get offset for the last header in the chain. m will be kept untainted. 1752 */ 1753 int 1754 ip6_lasthdr(struct mbuf *m, int off, int proto, int *nxtp) 1755 { 1756 int newoff; 1757 int nxt; 1758 1759 if (!nxtp) { 1760 nxt = -1; 1761 nxtp = &nxt; 1762 } 1763 while (1) { 1764 newoff = ip6_nexthdr(m, off, proto, nxtp); 1765 if (newoff < 0) 1766 return off; 1767 else if (newoff < off) 1768 return -1; /* invalid */ 1769 else if (newoff == off) 1770 return newoff; 1771 1772 off = newoff; 1773 proto = *nxtp; 1774 } 1775 } 1776 1777 struct ip6aux * 1778 ip6_addaux(struct mbuf *m) 1779 { 1780 struct m_tag *mtag; 1781 1782 mtag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1783 if (!mtag) { 1784 mtag = m_tag_get(PACKET_TAG_IPV6_INPUT, sizeof(struct ip6aux), 1785 M_NOWAIT); 1786 if (mtag) { 1787 m_tag_prepend(m, mtag); 1788 bzero(mtag + 1, sizeof(struct ip6aux)); 1789 } 1790 } 1791 return mtag ? (struct ip6aux *)(mtag + 1) : NULL; 1792 } 1793 1794 struct ip6aux * 1795 ip6_findaux(struct mbuf *m) 1796 { 1797 struct m_tag *mtag; 1798 1799 mtag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1800 return mtag ? (struct ip6aux *)(mtag + 1) : NULL; 1801 } 1802 1803 void 1804 ip6_delaux(struct mbuf *m) 1805 { 1806 struct m_tag *mtag; 1807 1808 mtag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL); 1809 if (mtag) 1810 m_tag_delete(m, mtag); 1811 } 1812 1813 /* 1814 * System control for IP6 1815 */ 1816 1817 u_char inet6ctlerrmap[PRC_NCMDS] = { 1818 0, 0, 0, 0, 1819 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH, 1820 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED, 1821 EMSGSIZE, EHOSTUNREACH, 0, 0, 1822 0, 0, 0, 0, 1823 ENOPROTOOPT 1824 };
Cache object: 104733822a1bae0dbc8f9c59ddd5a061
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]