ip6_input.c revision 1.168 1 1.168 roy /* $NetBSD: ip6_input.c,v 1.168 2016/09/07 15:41:44 roy Exp $ */
2 1.40 itojun /* $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $ */
3 1.3 thorpej
4 1.2 itojun /*
5 1.2 itojun * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 1.2 itojun * All rights reserved.
7 1.21 itojun *
8 1.2 itojun * Redistribution and use in source and binary forms, with or without
9 1.2 itojun * modification, are permitted provided that the following conditions
10 1.2 itojun * are met:
11 1.2 itojun * 1. Redistributions of source code must retain the above copyright
12 1.2 itojun * notice, this list of conditions and the following disclaimer.
13 1.2 itojun * 2. Redistributions in binary form must reproduce the above copyright
14 1.2 itojun * notice, this list of conditions and the following disclaimer in the
15 1.2 itojun * documentation and/or other materials provided with the distribution.
16 1.2 itojun * 3. Neither the name of the project nor the names of its contributors
17 1.2 itojun * may be used to endorse or promote products derived from this software
18 1.2 itojun * without specific prior written permission.
19 1.21 itojun *
20 1.2 itojun * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 1.2 itojun * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 1.2 itojun * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 1.2 itojun * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 1.2 itojun * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 1.2 itojun * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 1.2 itojun * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 1.2 itojun * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 1.2 itojun * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 1.2 itojun * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 1.2 itojun * SUCH DAMAGE.
31 1.2 itojun */
32 1.2 itojun
33 1.2 itojun /*
34 1.2 itojun * Copyright (c) 1982, 1986, 1988, 1993
35 1.2 itojun * The Regents of the University of California. All rights reserved.
36 1.2 itojun *
37 1.2 itojun * Redistribution and use in source and binary forms, with or without
38 1.2 itojun * modification, are permitted provided that the following conditions
39 1.2 itojun * are met:
40 1.2 itojun * 1. Redistributions of source code must retain the above copyright
41 1.2 itojun * notice, this list of conditions and the following disclaimer.
42 1.2 itojun * 2. Redistributions in binary form must reproduce the above copyright
43 1.2 itojun * notice, this list of conditions and the following disclaimer in the
44 1.2 itojun * documentation and/or other materials provided with the distribution.
45 1.65 agc * 3. Neither the name of the University nor the names of its contributors
46 1.2 itojun * may be used to endorse or promote products derived from this software
47 1.2 itojun * without specific prior written permission.
48 1.2 itojun *
49 1.2 itojun * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50 1.2 itojun * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51 1.2 itojun * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52 1.2 itojun * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53 1.2 itojun * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54 1.2 itojun * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55 1.2 itojun * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 1.2 itojun * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 1.2 itojun * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58 1.2 itojun * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59 1.2 itojun * SUCH DAMAGE.
60 1.2 itojun *
61 1.2 itojun * @(#)ip_input.c 8.2 (Berkeley) 1/4/94
62 1.2 itojun */
63 1.48 lukem
64 1.48 lukem #include <sys/cdefs.h>
65 1.168 roy __KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.168 2016/09/07 15:41:44 roy Exp $");
66 1.2 itojun
67 1.152 pooka #ifdef _KERNEL_OPT
68 1.129 joerg #include "opt_gateway.h"
69 1.2 itojun #include "opt_inet.h"
70 1.85 rpaulo #include "opt_inet6.h"
71 1.4 thorpej #include "opt_ipsec.h"
72 1.123 christos #include "opt_compat_netbsd.h"
73 1.152 pooka #endif
74 1.2 itojun
75 1.2 itojun #include <sys/param.h>
76 1.2 itojun #include <sys/systm.h>
77 1.2 itojun #include <sys/malloc.h>
78 1.2 itojun #include <sys/mbuf.h>
79 1.2 itojun #include <sys/domain.h>
80 1.2 itojun #include <sys/protosw.h>
81 1.2 itojun #include <sys/socket.h>
82 1.2 itojun #include <sys/socketvar.h>
83 1.2 itojun #include <sys/errno.h>
84 1.2 itojun #include <sys/time.h>
85 1.2 itojun #include <sys/kernel.h>
86 1.2 itojun #include <sys/syslog.h>
87 1.2 itojun #include <sys/proc.h>
88 1.46 simonb #include <sys/sysctl.h>
89 1.133 tls #include <sys/cprng.h>
90 1.167 ozaki #include <sys/percpu.h>
91 1.2 itojun
92 1.2 itojun #include <net/if.h>
93 1.2 itojun #include <net/if_types.h>
94 1.2 itojun #include <net/if_dl.h>
95 1.2 itojun #include <net/route.h>
96 1.148 rmind #include <net/pktqueue.h>
97 1.15 darrenr #include <net/pfil.h>
98 1.2 itojun
99 1.2 itojun #include <netinet/in.h>
100 1.9 itojun #include <netinet/in_systm.h>
101 1.9 itojun #ifdef INET
102 1.9 itojun #include <netinet/ip.h>
103 1.148 rmind #include <netinet/ip_var.h>
104 1.9 itojun #include <netinet/ip_icmp.h>
105 1.45 itojun #endif /* INET */
106 1.14 itojun #include <netinet/ip6.h>
107 1.140 christos #include <netinet/portalgo.h>
108 1.2 itojun #include <netinet6/in6_var.h>
109 1.11 itojun #include <netinet6/ip6_var.h>
110 1.116 thorpej #include <netinet6/ip6_private.h>
111 1.2 itojun #include <netinet6/in6_pcb.h>
112 1.14 itojun #include <netinet/icmp6.h>
113 1.81 rpaulo #include <netinet6/scope6_var.h>
114 1.2 itojun #include <netinet6/in6_ifattach.h>
115 1.2 itojun #include <netinet6/nd6.h>
116 1.2 itojun
117 1.142 christos #ifdef IPSEC
118 1.94 degroote #include <netipsec/ipsec.h>
119 1.94 degroote #include <netipsec/ipsec6.h>
120 1.94 degroote #include <netipsec/key.h>
121 1.142 christos #endif /* IPSEC */
122 1.94 degroote
123 1.123 christos #ifdef COMPAT_50
124 1.123 christos #include <compat/sys/time.h>
125 1.123 christos #include <compat/sys/socket.h>
126 1.123 christos #endif
127 1.123 christos
128 1.2 itojun #include <netinet6/ip6protosw.h>
129 1.2 itojun
130 1.2 itojun #include "faith.h"
131 1.2 itojun
132 1.9 itojun #include <net/net_osdep.h>
133 1.9 itojun
134 1.2 itojun extern struct domain inet6domain;
135 1.2 itojun
136 1.2 itojun u_char ip6_protox[IPPROTO_MAX];
137 1.148 rmind pktqueue_t *ip6_pktq __read_mostly;
138 1.2 itojun
139 1.2 itojun int ip6_forward_srcrt; /* XXX */
140 1.2 itojun int ip6_sourcecheck; /* XXX */
141 1.2 itojun int ip6_sourcecheck_interval; /* XXX */
142 1.9 itojun
143 1.143 rmind pfil_head_t *inet6_pfil_hook;
144 1.29 thorpej
145 1.116 thorpej percpu_t *ip6stat_percpu;
146 1.2 itojun
147 1.167 ozaki percpu_t *ip6_forward_rt_percpu __cacheline_aligned;
148 1.167 ozaki
149 1.156 ozaki static void ip6_init2(void);
150 1.148 rmind static void ip6intr(void *);
151 1.112 dyoung static struct m_tag *ip6_setdstifaddr(struct mbuf *, const struct in6_ifaddr *);
152 1.2 itojun
153 1.136 drochner static int ip6_process_hopopts(struct mbuf *, u_int8_t *, int, u_int32_t *,
154 1.136 drochner u_int32_t *);
155 1.111 dyoung static struct mbuf *ip6_pullexthdr(struct mbuf *, size_t, int);
156 1.128 pooka static void sysctl_net_inet6_ip6_setup(struct sysctllog **);
157 1.2 itojun
158 1.2 itojun /*
159 1.2 itojun * IP6 initialization: fill in IP6 protocol switch table.
160 1.2 itojun * All protocols not implemented in kernel go to raw IP6 protocol handler.
161 1.2 itojun */
162 1.2 itojun void
163 1.114 matt ip6_init(void)
164 1.2 itojun {
165 1.78 christos const struct ip6protosw *pr;
166 1.35 itojun int i;
167 1.2 itojun
168 1.163 ozaki in6_init();
169 1.162 ozaki
170 1.128 pooka sysctl_net_inet6_ip6_setup(NULL);
171 1.78 christos pr = (const struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW);
172 1.2 itojun if (pr == 0)
173 1.2 itojun panic("ip6_init");
174 1.2 itojun for (i = 0; i < IPPROTO_MAX; i++)
175 1.2 itojun ip6_protox[i] = pr - inet6sw;
176 1.78 christos for (pr = (const struct ip6protosw *)inet6domain.dom_protosw;
177 1.78 christos pr < (const struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++)
178 1.2 itojun if (pr->pr_domain->dom_family == PF_INET6 &&
179 1.2 itojun pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
180 1.2 itojun ip6_protox[pr->pr_protocol] = pr - inet6sw;
181 1.148 rmind
182 1.149 ozaki ip6_pktq = pktq_create(IFQ_MAXLEN, ip6intr, NULL);
183 1.148 rmind KASSERT(ip6_pktq != NULL);
184 1.148 rmind
185 1.81 rpaulo scope6_init();
186 1.81 rpaulo addrsel_policy_init();
187 1.2 itojun nd6_init();
188 1.2 itojun frag6_init();
189 1.133 tls ip6_desync_factor = cprng_fast32() % MAX_TEMP_DESYNC_FACTOR;
190 1.2 itojun
191 1.156 ozaki ip6_init2();
192 1.98 liamjfoy #ifdef GATEWAY
193 1.99 liamjfoy ip6flow_init(ip6_hashsize);
194 1.98 liamjfoy #endif
195 1.29 thorpej /* Register our Packet Filter hook. */
196 1.143 rmind inet6_pfil_hook = pfil_head_create(PFIL_TYPE_AF, (void *)AF_INET6);
197 1.143 rmind KASSERT(inet6_pfil_hook != NULL);
198 1.116 thorpej
199 1.116 thorpej ip6stat_percpu = percpu_alloc(sizeof(uint64_t) * IP6_NSTATS);
200 1.167 ozaki
201 1.167 ozaki ip6_forward_rt_percpu = percpu_alloc(sizeof(struct route));
202 1.167 ozaki if (ip6_forward_rt_percpu == NULL)
203 1.167 ozaki panic("failed to alllocate ip6_forward_rt_percpu");
204 1.2 itojun }
205 1.2 itojun
206 1.2 itojun static void
207 1.156 ozaki ip6_init2(void)
208 1.2 itojun {
209 1.2 itojun
210 1.83 rpaulo /* timer for regeneranation of temporary addresses randomize ID */
211 1.118 ad callout_init(&in6_tmpaddrtimer_ch, CALLOUT_MPSAFE);
212 1.83 rpaulo callout_reset(&in6_tmpaddrtimer_ch,
213 1.83 rpaulo (ip6_temp_preferred_lifetime - ip6_desync_factor -
214 1.83 rpaulo ip6_temp_regen_advance) * hz,
215 1.83 rpaulo in6_tmpaddrtimer, NULL);
216 1.2 itojun }
217 1.2 itojun
218 1.2 itojun /*
219 1.2 itojun * IP6 input interrupt handling. Just pass the packet to ip6_input.
220 1.2 itojun */
221 1.148 rmind static void
222 1.148 rmind ip6intr(void *arg __unused)
223 1.2 itojun {
224 1.2 itojun struct mbuf *m;
225 1.2 itojun
226 1.118 ad mutex_enter(softnet_lock);
227 1.148 rmind while ((m = pktq_dequeue(ip6_pktq)) != NULL) {
228 1.160 ozaki struct psref psref;
229 1.160 ozaki struct ifnet *rcvif = m_get_rcvif_psref(m, &psref);
230 1.148 rmind
231 1.160 ozaki if (rcvif == NULL) {
232 1.160 ozaki m_freem(m);
233 1.160 ozaki continue;
234 1.160 ozaki }
235 1.148 rmind /*
236 1.148 rmind * Drop the packet if IPv6 is disabled on the interface.
237 1.148 rmind */
238 1.160 ozaki if ((ND_IFINFO(rcvif)->flags & ND6_IFF_IFDISABLED)) {
239 1.160 ozaki m_put_rcvif_psref(rcvif, &psref);
240 1.83 rpaulo m_freem(m);
241 1.148 rmind continue;
242 1.83 rpaulo }
243 1.160 ozaki ip6_input(m, rcvif);
244 1.160 ozaki m_put_rcvif_psref(rcvif, &psref);
245 1.2 itojun }
246 1.118 ad mutex_exit(softnet_lock);
247 1.2 itojun }
248 1.2 itojun
249 1.2 itojun void
250 1.160 ozaki ip6_input(struct mbuf *m, struct ifnet *rcvif)
251 1.2 itojun {
252 1.9 itojun struct ip6_hdr *ip6;
253 1.105 dyoung int hit, off = sizeof(struct ip6_hdr), nest;
254 1.2 itojun u_int32_t plen;
255 1.5 itojun u_int32_t rtalert = ~0;
256 1.104 yamt int nxt, ours = 0, rh_present = 0;
257 1.9 itojun struct ifnet *deliverifp = NULL;
258 1.64 itojun int srcrt = 0;
259 1.105 dyoung const struct rtentry *rt;
260 1.105 dyoung union {
261 1.105 dyoung struct sockaddr dst;
262 1.105 dyoung struct sockaddr_in6 dst6;
263 1.105 dyoung } u;
264 1.167 ozaki struct route *ro;
265 1.2 itojun
266 1.2 itojun /*
267 1.81 rpaulo * make sure we don't have onion peering information into m_tag.
268 1.81 rpaulo */
269 1.81 rpaulo ip6_delaux(m);
270 1.81 rpaulo
271 1.81 rpaulo /*
272 1.44 itojun * mbuf statistics
273 1.2 itojun */
274 1.2 itojun if (m->m_flags & M_EXT) {
275 1.2 itojun if (m->m_next)
276 1.116 thorpej IP6_STATINC(IP6_STAT_MEXT2M);
277 1.2 itojun else
278 1.116 thorpej IP6_STATINC(IP6_STAT_MEXT1);
279 1.2 itojun } else {
280 1.115 thorpej #define M2MMAX 32
281 1.2 itojun if (m->m_next) {
282 1.159 ozaki if (m->m_flags & M_LOOP)
283 1.116 thorpej /*XXX*/ IP6_STATINC(IP6_STAT_M2M + lo0ifp->if_index);
284 1.159 ozaki else if (rcvif->if_index < M2MMAX)
285 1.159 ozaki IP6_STATINC(IP6_STAT_M2M + rcvif->if_index);
286 1.159 ozaki else
287 1.116 thorpej IP6_STATINC(IP6_STAT_M2M);
288 1.2 itojun } else
289 1.116 thorpej IP6_STATINC(IP6_STAT_M1);
290 1.40 itojun #undef M2MMAX
291 1.2 itojun }
292 1.2 itojun
293 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_receive);
294 1.116 thorpej IP6_STATINC(IP6_STAT_TOTAL);
295 1.9 itojun
296 1.57 thorpej /*
297 1.57 thorpej * If the IPv6 header is not aligned, slurp it up into a new
298 1.57 thorpej * mbuf with space for link headers, in the event we forward
299 1.81 rpaulo * it. Otherwise, if it is aligned, make sure the entire base
300 1.57 thorpej * IPv6 header is in the first mbuf of the chain.
301 1.57 thorpej */
302 1.97 christos if (IP6_HDR_ALIGNED_P(mtod(m, void *)) == 0) {
303 1.57 thorpej if ((m = m_copyup(m, sizeof(struct ip6_hdr),
304 1.57 thorpej (max_linkhdr + 3) & ~3)) == NULL) {
305 1.57 thorpej /* XXXJRT new stat, please */
306 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSMALL);
307 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
308 1.57 thorpej return;
309 1.57 thorpej }
310 1.57 thorpej } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
311 1.55 itojun if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
312 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSMALL);
313 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
314 1.9 itojun return;
315 1.9 itojun }
316 1.2 itojun }
317 1.2 itojun
318 1.2 itojun ip6 = mtod(m, struct ip6_hdr *);
319 1.2 itojun
320 1.2 itojun if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
321 1.116 thorpej IP6_STATINC(IP6_STAT_BADVERS);
322 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
323 1.2 itojun goto bad;
324 1.2 itojun }
325 1.15 darrenr
326 1.98 liamjfoy /*
327 1.98 liamjfoy * Assume that we can create a fast-forward IP flow entry
328 1.98 liamjfoy * based on this packet.
329 1.98 liamjfoy */
330 1.98 liamjfoy m->m_flags |= M_CANFASTFWD;
331 1.98 liamjfoy
332 1.15 darrenr /*
333 1.15 darrenr * Run through list of hooks for input packets. If there are any
334 1.15 darrenr * filters which require that additional packets in the flow are
335 1.15 darrenr * not fast-forwarded, they must clear the M_CANFASTFWD flag.
336 1.15 darrenr * Note that filters must _never_ set this flag, as another filter
337 1.15 darrenr * in the list may have previously cleared it.
338 1.15 darrenr */
339 1.39 itojun /*
340 1.39 itojun * let ipfilter look at packet on the wire,
341 1.39 itojun * not the decapsulated packet.
342 1.39 itojun */
343 1.142 christos #if defined(IPSEC)
344 1.146 christos if (!ipsec_used || !ipsec_indone(m))
345 1.39 itojun #else
346 1.39 itojun if (1)
347 1.39 itojun #endif
348 1.39 itojun {
349 1.64 itojun struct in6_addr odst;
350 1.64 itojun
351 1.64 itojun odst = ip6->ip6_dst;
352 1.159 ozaki if (pfil_run_hooks(inet6_pfil_hook, &m, rcvif, PFIL_IN) != 0)
353 1.39 itojun return;
354 1.39 itojun if (m == NULL)
355 1.39 itojun return;
356 1.39 itojun ip6 = mtod(m, struct ip6_hdr *);
357 1.64 itojun srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst);
358 1.39 itojun }
359 1.15 darrenr
360 1.116 thorpej IP6_STATINC(IP6_STAT_NXTHIST + ip6->ip6_nxt);
361 1.2 itojun
362 1.30 thorpej #ifdef ALTQ
363 1.30 thorpej if (altq_input != NULL && (*altq_input)(m, AF_INET6) == 0) {
364 1.30 thorpej /* packet is dropped by traffic conditioner */
365 1.30 thorpej return;
366 1.9 itojun }
367 1.9 itojun #endif
368 1.9 itojun
369 1.2 itojun /*
370 1.44 itojun * Check against address spoofing/corruption.
371 1.2 itojun */
372 1.2 itojun if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) ||
373 1.2 itojun IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) {
374 1.55 itojun /*
375 1.55 itojun * XXX: "badscope" is not very suitable for a multicast source.
376 1.55 itojun */
377 1.116 thorpej IP6_STATINC(IP6_STAT_BADSCOPE);
378 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_addrerr);
379 1.2 itojun goto bad;
380 1.2 itojun }
381 1.13 itojun /*
382 1.44 itojun * The following check is not documented in specs. A malicious
383 1.44 itojun * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
384 1.44 itojun * and bypass security checks (act as if it was from 127.0.0.1 by using
385 1.44 itojun * IPv6 src ::ffff:127.0.0.1). Be cautious.
386 1.35 itojun *
387 1.44 itojun * This check chokes if we are in an SIIT cloud. As none of BSDs
388 1.44 itojun * support IPv4-less kernel compilation, we cannot support SIIT
389 1.44 itojun * environment at all. So, it makes more sense for us to reject any
390 1.44 itojun * malicious packets for non-SIIT environment, than try to do a
391 1.52 wiz * partial support for SIIT environment.
392 1.13 itojun */
393 1.13 itojun if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
394 1.13 itojun IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
395 1.116 thorpej IP6_STATINC(IP6_STAT_BADSCOPE);
396 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_addrerr);
397 1.13 itojun goto bad;
398 1.13 itojun }
399 1.17 itojun #if 0
400 1.13 itojun /*
401 1.17 itojun * Reject packets with IPv4 compatible addresses (auto tunnel).
402 1.17 itojun *
403 1.17 itojun * The code forbids auto tunnel relay case in RFC1933 (the check is
404 1.17 itojun * stronger than RFC1933). We may want to re-enable it if mech-xx
405 1.17 itojun * is revised to forbid relaying case.
406 1.13 itojun */
407 1.13 itojun if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) ||
408 1.13 itojun IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) {
409 1.116 thorpej IP6_STATINC(IP6_STAT_BADSCOPE);
410 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_addrerr);
411 1.13 itojun goto bad;
412 1.13 itojun }
413 1.13 itojun #endif
414 1.35 itojun
415 1.2 itojun /*
416 1.82 yamt * Disambiguate address scope zones (if there is ambiguity).
417 1.82 yamt * We first make sure that the original source or destination address
418 1.82 yamt * is not in our internal form for scoped addresses. Such addresses
419 1.82 yamt * are not necessarily invalid spec-wise, but we cannot accept them due
420 1.82 yamt * to the usage conflict.
421 1.82 yamt * in6_setscope() then also checks and rejects the cases where src or
422 1.82 yamt * dst are the loopback address and the receiving interface
423 1.82 yamt * is not loopback.
424 1.82 yamt */
425 1.88 bouyer if (__predict_false(
426 1.88 bouyer m_makewritable(&m, 0, sizeof(struct ip6_hdr), M_DONTWAIT)))
427 1.88 bouyer goto bad;
428 1.88 bouyer ip6 = mtod(m, struct ip6_hdr *);
429 1.82 yamt if (in6_clearscope(&ip6->ip6_src) || in6_clearscope(&ip6->ip6_dst)) {
430 1.116 thorpej IP6_STATINC(IP6_STAT_BADSCOPE); /* XXX */
431 1.82 yamt goto bad;
432 1.82 yamt }
433 1.159 ozaki if (in6_setscope(&ip6->ip6_src, rcvif, NULL) ||
434 1.159 ozaki in6_setscope(&ip6->ip6_dst, rcvif, NULL)) {
435 1.116 thorpej IP6_STATINC(IP6_STAT_BADSCOPE);
436 1.82 yamt goto bad;
437 1.82 yamt }
438 1.82 yamt
439 1.82 yamt /*
440 1.2 itojun * Multicast check
441 1.2 itojun */
442 1.2 itojun if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
443 1.2 itojun struct in6_multi *in6m = 0;
444 1.9 itojun
445 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_mcast);
446 1.2 itojun /*
447 1.2 itojun * See if we belong to the destination multicast group on the
448 1.2 itojun * arrival interface.
449 1.2 itojun */
450 1.159 ozaki IN6_LOOKUP_MULTI(ip6->ip6_dst, rcvif, in6m);
451 1.2 itojun if (in6m)
452 1.2 itojun ours = 1;
453 1.2 itojun else if (!ip6_mrouter) {
454 1.116 thorpej uint64_t *ip6s = IP6_STAT_GETREF();
455 1.116 thorpej ip6s[IP6_STAT_NOTMEMBER]++;
456 1.116 thorpej ip6s[IP6_STAT_CANTFORWARD]++;
457 1.116 thorpej IP6_STAT_PUTREF();
458 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_discard);
459 1.2 itojun goto bad;
460 1.2 itojun }
461 1.159 ozaki deliverifp = rcvif;
462 1.2 itojun goto hbhcheck;
463 1.2 itojun }
464 1.2 itojun
465 1.105 dyoung sockaddr_in6_init(&u.dst6, &ip6->ip6_dst, 0, 0, 0);
466 1.105 dyoung
467 1.2 itojun /*
468 1.2 itojun * Unicast check
469 1.2 itojun */
470 1.167 ozaki ro = percpu_getref(ip6_forward_rt_percpu);
471 1.167 ozaki rt = rtcache_lookup2(ro, &u.dst, 1, &hit);
472 1.167 ozaki percpu_putref(ip6_forward_rt_percpu);
473 1.105 dyoung if (hit)
474 1.116 thorpej IP6_STATINC(IP6_STAT_FORWARD_CACHEHIT);
475 1.93 joerg else
476 1.116 thorpej IP6_STATINC(IP6_STAT_FORWARD_CACHEMISS);
477 1.22 itojun
478 1.109 dyoung #define rt6_getkey(__rt) satocsin6(rt_getkey(__rt))
479 1.2 itojun
480 1.2 itojun /*
481 1.2 itojun * Accept the packet if the forwarding interface to the destination
482 1.2 itojun * according to the routing table is the loopback interface,
483 1.2 itojun * unless the associated route has a gateway.
484 1.2 itojun * Note that this approach causes to accept a packet if there is a
485 1.2 itojun * route to the loopback interface for the destination of the packet.
486 1.2 itojun * But we think it's even useful in some situations, e.g. when using
487 1.2 itojun * a special daemon which wants to intercept the packet.
488 1.2 itojun */
489 1.105 dyoung if (rt != NULL &&
490 1.105 dyoung (rt->rt_flags & (RTF_HOST|RTF_GATEWAY)) == RTF_HOST &&
491 1.2 itojun #if 0
492 1.2 itojun /*
493 1.2 itojun * The check below is redundant since the comparison of
494 1.2 itojun * the destination and the key of the rtentry has
495 1.2 itojun * already done through looking up the routing table.
496 1.2 itojun */
497 1.109 dyoung IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &rt6_getkey(rt)->sin6_addr) &&
498 1.2 itojun #endif
499 1.105 dyoung rt->rt_ifp->if_type == IFT_LOOP) {
500 1.105 dyoung struct in6_ifaddr *ia6 = (struct in6_ifaddr *)rt->rt_ifa;
501 1.2 itojun if (ia6->ia6_flags & IN6_IFF_ANYCAST)
502 1.2 itojun m->m_flags |= M_ANYCAST6;
503 1.24 itojun /*
504 1.24 itojun * packets to a tentative, duplicated, or somehow invalid
505 1.24 itojun * address must not be accepted.
506 1.24 itojun */
507 1.168 roy if (!(ia6->ia6_flags & (IN6_IFF_NOTREADY | IN6_IFF_DETACHED))) {
508 1.24 itojun /* this address is ready */
509 1.2 itojun ours = 1;
510 1.9 itojun deliverifp = ia6->ia_ifp; /* correct? */
511 1.2 itojun goto hbhcheck;
512 1.2 itojun } else {
513 1.24 itojun /* address is not ready, so discard the packet. */
514 1.157 ozaki nd6log(LOG_INFO, "packet to an unready address %s->%s\n",
515 1.24 itojun ip6_sprintf(&ip6->ip6_src),
516 1.157 ozaki ip6_sprintf(&ip6->ip6_dst));
517 1.24 itojun
518 1.24 itojun goto bad;
519 1.2 itojun }
520 1.2 itojun }
521 1.2 itojun
522 1.2 itojun /*
523 1.55 itojun * FAITH (Firewall Aided Internet Translator)
524 1.2 itojun */
525 1.2 itojun #if defined(NFAITH) && 0 < NFAITH
526 1.2 itojun if (ip6_keepfaith) {
527 1.105 dyoung if (rt != NULL && rt->rt_ifp != NULL &&
528 1.105 dyoung rt->rt_ifp->if_type == IFT_FAITH) {
529 1.2 itojun /* XXX do we need more sanity checks? */
530 1.2 itojun ours = 1;
531 1.105 dyoung deliverifp = rt->rt_ifp; /* faith */
532 1.9 itojun goto hbhcheck;
533 1.9 itojun }
534 1.9 itojun }
535 1.9 itojun #endif
536 1.9 itojun
537 1.9 itojun #if 0
538 1.9 itojun {
539 1.9 itojun /*
540 1.9 itojun * Last resort: check in6_ifaddr for incoming interface.
541 1.9 itojun * The code is here until I update the "goto ours hack" code above
542 1.9 itojun * working right.
543 1.9 itojun */
544 1.9 itojun struct ifaddr *ifa;
545 1.164 ozaki IFADDR_READER_FOREACH(ifa, rcvif) {
546 1.9 itojun if (ifa->ifa_addr->sa_family != AF_INET6)
547 1.9 itojun continue;
548 1.9 itojun if (IN6_ARE_ADDR_EQUAL(IFA_IN6(ifa), &ip6->ip6_dst)) {
549 1.9 itojun ours = 1;
550 1.9 itojun deliverifp = ifa->ifa_ifp;
551 1.2 itojun goto hbhcheck;
552 1.2 itojun }
553 1.2 itojun }
554 1.9 itojun }
555 1.2 itojun #endif
556 1.2 itojun
557 1.2 itojun /*
558 1.2 itojun * Now there is no reason to process the packet if it's not our own
559 1.2 itojun * and we're not a router.
560 1.2 itojun */
561 1.2 itojun if (!ip6_forwarding) {
562 1.116 thorpej IP6_STATINC(IP6_STAT_CANTFORWARD);
563 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_discard);
564 1.2 itojun goto bad;
565 1.2 itojun }
566 1.2 itojun
567 1.2 itojun hbhcheck:
568 1.2 itojun /*
569 1.81 rpaulo * record address information into m_tag, if we don't have one yet.
570 1.81 rpaulo * note that we are unable to record it, if the address is not listed
571 1.81 rpaulo * as our interface address (e.g. multicast addresses, addresses
572 1.81 rpaulo * within FAITH prefixes and such).
573 1.81 rpaulo */
574 1.111 dyoung if (deliverifp && ip6_getdstifaddr(m) == NULL) {
575 1.81 rpaulo struct in6_ifaddr *ia6;
576 1.165 ozaki int s = pserialize_read_enter();
577 1.81 rpaulo
578 1.81 rpaulo ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
579 1.165 ozaki /* Depends on ip6_setdstifaddr never sleep */
580 1.111 dyoung if (ia6 != NULL && ip6_setdstifaddr(m, ia6) == NULL) {
581 1.111 dyoung /*
582 1.111 dyoung * XXX maybe we should drop the packet here,
583 1.111 dyoung * as we could not provide enough information
584 1.111 dyoung * to the upper layers.
585 1.111 dyoung */
586 1.81 rpaulo }
587 1.165 ozaki pserialize_read_exit(s);
588 1.81 rpaulo }
589 1.81 rpaulo
590 1.81 rpaulo /*
591 1.2 itojun * Process Hop-by-Hop options header if it's contained.
592 1.2 itojun * m may be modified in ip6_hopopts_input().
593 1.2 itojun * If a JumboPayload option is included, plen will also be modified.
594 1.2 itojun */
595 1.2 itojun plen = (u_int32_t)ntohs(ip6->ip6_plen);
596 1.2 itojun if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
597 1.9 itojun struct ip6_hbh *hbh;
598 1.9 itojun
599 1.9 itojun if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) {
600 1.9 itojun #if 0 /*touches NULL pointer*/
601 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_discard);
602 1.9 itojun #endif
603 1.2 itojun return; /* m have already been freed */
604 1.9 itojun }
605 1.22 itojun
606 1.2 itojun /* adjust pointer */
607 1.2 itojun ip6 = mtod(m, struct ip6_hdr *);
608 1.22 itojun
609 1.22 itojun /*
610 1.49 itojun * if the payload length field is 0 and the next header field
611 1.22 itojun * indicates Hop-by-Hop Options header, then a Jumbo Payload
612 1.22 itojun * option MUST be included.
613 1.22 itojun */
614 1.22 itojun if (ip6->ip6_plen == 0 && plen == 0) {
615 1.22 itojun /*
616 1.22 itojun * Note that if a valid jumbo payload option is
617 1.83 rpaulo * contained, ip6_hopopts_input() must set a valid
618 1.55 itojun * (non-zero) payload length to the variable plen.
619 1.22 itojun */
620 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
621 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_discard);
622 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
623 1.22 itojun icmp6_error(m, ICMP6_PARAM_PROB,
624 1.22 itojun ICMP6_PARAMPROB_HEADER,
625 1.97 christos (char *)&ip6->ip6_plen - (char *)ip6);
626 1.22 itojun return;
627 1.22 itojun }
628 1.9 itojun IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
629 1.9 itojun sizeof(struct ip6_hbh));
630 1.9 itojun if (hbh == NULL) {
631 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
632 1.9 itojun return;
633 1.9 itojun }
634 1.57 thorpej KASSERT(IP6_HDR_ALIGNED_P(hbh));
635 1.9 itojun nxt = hbh->ip6h_nxt;
636 1.2 itojun
637 1.2 itojun /*
638 1.2 itojun * accept the packet if a router alert option is included
639 1.2 itojun * and we act as an IPv6 router.
640 1.2 itojun */
641 1.5 itojun if (rtalert != ~0 && ip6_forwarding)
642 1.2 itojun ours = 1;
643 1.2 itojun } else
644 1.2 itojun nxt = ip6->ip6_nxt;
645 1.2 itojun
646 1.2 itojun /*
647 1.2 itojun * Check that the amount of data in the buffers
648 1.2 itojun * is as at least much as the IPv6 header would have us expect.
649 1.2 itojun * Trim mbufs if longer than we expect.
650 1.2 itojun * Drop packet if shorter than we expect.
651 1.2 itojun */
652 1.2 itojun if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
653 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
654 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_truncated);
655 1.2 itojun goto bad;
656 1.2 itojun }
657 1.2 itojun if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
658 1.2 itojun if (m->m_len == m->m_pkthdr.len) {
659 1.2 itojun m->m_len = sizeof(struct ip6_hdr) + plen;
660 1.2 itojun m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
661 1.2 itojun } else
662 1.2 itojun m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len);
663 1.2 itojun }
664 1.2 itojun
665 1.2 itojun /*
666 1.2 itojun * Forward if desirable.
667 1.2 itojun */
668 1.2 itojun if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
669 1.2 itojun /*
670 1.2 itojun * If we are acting as a multicast router, all
671 1.2 itojun * incoming multicast packets are passed to the
672 1.2 itojun * kernel-level multicast forwarding function.
673 1.2 itojun * The packet is returned (relatively) intact; if
674 1.2 itojun * ip6_mforward() returns a non-zero value, the packet
675 1.2 itojun * must be discarded, else it may be accepted below.
676 1.2 itojun */
677 1.159 ozaki if (ip6_mrouter && ip6_mforward(ip6, rcvif, m)) {
678 1.116 thorpej IP6_STATINC(IP6_STAT_CANTFORWARD);
679 1.2 itojun m_freem(m);
680 1.2 itojun return;
681 1.2 itojun }
682 1.2 itojun if (!ours) {
683 1.2 itojun m_freem(m);
684 1.2 itojun return;
685 1.2 itojun }
686 1.22 itojun } else if (!ours) {
687 1.64 itojun ip6_forward(m, srcrt);
688 1.2 itojun return;
689 1.56 itojun }
690 1.25 itojun
691 1.25 itojun ip6 = mtod(m, struct ip6_hdr *);
692 1.25 itojun
693 1.25 itojun /*
694 1.25 itojun * Malicious party may be able to use IPv4 mapped addr to confuse
695 1.25 itojun * tcp/udp stack and bypass security checks (act as if it was from
696 1.25 itojun * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious.
697 1.25 itojun *
698 1.25 itojun * For SIIT end node behavior, you may want to disable the check.
699 1.25 itojun * However, you will become vulnerable to attacks using IPv4 mapped
700 1.25 itojun * source.
701 1.25 itojun */
702 1.25 itojun if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
703 1.25 itojun IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
704 1.116 thorpej IP6_STATINC(IP6_STAT_BADSCOPE);
705 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_addrerr);
706 1.25 itojun goto bad;
707 1.25 itojun }
708 1.2 itojun
709 1.2 itojun /*
710 1.2 itojun * Tell launch routine the next header
711 1.2 itojun */
712 1.12 itojun #ifdef IFA_STATS
713 1.28 itojun if (deliverifp != NULL) {
714 1.9 itojun struct in6_ifaddr *ia6;
715 1.165 ozaki int s = pserialize_read_enter();
716 1.9 itojun ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
717 1.9 itojun if (ia6)
718 1.9 itojun ia6->ia_ifa.ifa_data.ifad_inbytes += m->m_pkthdr.len;
719 1.165 ozaki pserialize_read_exit(s);
720 1.9 itojun }
721 1.9 itojun #endif
722 1.116 thorpej IP6_STATINC(IP6_STAT_DELIVERED);
723 1.9 itojun in6_ifstat_inc(deliverifp, ifs6_in_deliver);
724 1.2 itojun nest = 0;
725 1.40 itojun
726 1.104 yamt rh_present = 0;
727 1.2 itojun while (nxt != IPPROTO_DONE) {
728 1.2 itojun if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
729 1.116 thorpej IP6_STATINC(IP6_STAT_TOOMANYHDR);
730 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
731 1.2 itojun goto bad;
732 1.2 itojun }
733 1.8 itojun
734 1.8 itojun /*
735 1.8 itojun * protection against faulty packet - there should be
736 1.8 itojun * more sanity checks in header chain processing.
737 1.8 itojun */
738 1.8 itojun if (m->m_pkthdr.len < off) {
739 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
740 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_truncated);
741 1.8 itojun goto bad;
742 1.8 itojun }
743 1.8 itojun
744 1.104 yamt if (nxt == IPPROTO_ROUTING) {
745 1.104 yamt if (rh_present++) {
746 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
747 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
748 1.104 yamt goto bad;
749 1.104 yamt }
750 1.104 yamt }
751 1.104 yamt
752 1.142 christos #ifdef IPSEC
753 1.146 christos if (ipsec_used) {
754 1.94 degroote /*
755 1.146 christos * enforce IPsec policy checking if we are seeing last
756 1.146 christos * header. note that we do not visit this with
757 1.146 christos * protocols with pcb layer code - like udp/tcp/raw ip.
758 1.94 degroote */
759 1.146 christos if ((inet6sw[ip_protox[nxt]].pr_flags
760 1.146 christos & PR_LASTHDR) != 0) {
761 1.151 ozaki int error = ipsec6_input(m);
762 1.146 christos if (error)
763 1.146 christos goto bad;
764 1.146 christos }
765 1.94 degroote }
766 1.142 christos #endif /* IPSEC */
767 1.94 degroote
768 1.2 itojun nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt);
769 1.2 itojun }
770 1.2 itojun return;
771 1.2 itojun bad:
772 1.2 itojun m_freem(m);
773 1.2 itojun }
774 1.2 itojun
775 1.2 itojun /*
776 1.81 rpaulo * set/grab in6_ifaddr correspond to IPv6 destination address.
777 1.81 rpaulo */
778 1.81 rpaulo static struct m_tag *
779 1.112 dyoung ip6_setdstifaddr(struct mbuf *m, const struct in6_ifaddr *ia)
780 1.81 rpaulo {
781 1.81 rpaulo struct m_tag *mtag;
782 1.144 christos struct ip6aux *ip6a;
783 1.81 rpaulo
784 1.81 rpaulo mtag = ip6_addaux(m);
785 1.144 christos if (mtag == NULL)
786 1.144 christos return NULL;
787 1.112 dyoung
788 1.144 christos ip6a = (struct ip6aux *)(mtag + 1);
789 1.144 christos if (in6_setscope(&ip6a->ip6a_src, ia->ia_ifp, &ip6a->ip6a_scope_id)) {
790 1.144 christos IP6_STATINC(IP6_STAT_BADSCOPE);
791 1.144 christos return NULL;
792 1.112 dyoung }
793 1.144 christos
794 1.144 christos ip6a->ip6a_src = ia->ia_addr.sin6_addr;
795 1.144 christos ip6a->ip6a_flags = ia->ia6_flags;
796 1.144 christos return mtag;
797 1.81 rpaulo }
798 1.81 rpaulo
799 1.112 dyoung const struct ip6aux *
800 1.107 christos ip6_getdstifaddr(struct mbuf *m)
801 1.81 rpaulo {
802 1.81 rpaulo struct m_tag *mtag;
803 1.81 rpaulo
804 1.81 rpaulo mtag = ip6_findaux(m);
805 1.112 dyoung if (mtag != NULL)
806 1.112 dyoung return (struct ip6aux *)(mtag + 1);
807 1.81 rpaulo else
808 1.81 rpaulo return NULL;
809 1.81 rpaulo }
810 1.81 rpaulo
811 1.81 rpaulo /*
812 1.2 itojun * Hop-by-Hop options header processing. If a valid jumbo payload option is
813 1.2 itojun * included, the real payload length will be stored in plenp.
814 1.107 christos *
815 1.107 christos * rtalertp - XXX: should be stored more smart way
816 1.2 itojun */
817 1.136 drochner int
818 1.107 christos ip6_hopopts_input(u_int32_t *plenp, u_int32_t *rtalertp,
819 1.107 christos struct mbuf **mp, int *offp)
820 1.2 itojun {
821 1.35 itojun struct mbuf *m = *mp;
822 1.2 itojun int off = *offp, hbhlen;
823 1.2 itojun struct ip6_hbh *hbh;
824 1.2 itojun
825 1.2 itojun /* validation of the length of the header */
826 1.9 itojun IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m,
827 1.9 itojun sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
828 1.9 itojun if (hbh == NULL) {
829 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
830 1.9 itojun return -1;
831 1.9 itojun }
832 1.9 itojun hbhlen = (hbh->ip6h_len + 1) << 3;
833 1.9 itojun IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
834 1.9 itojun hbhlen);
835 1.9 itojun if (hbh == NULL) {
836 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
837 1.9 itojun return -1;
838 1.9 itojun }
839 1.57 thorpej KASSERT(IP6_HDR_ALIGNED_P(hbh));
840 1.2 itojun off += hbhlen;
841 1.2 itojun hbhlen -= sizeof(struct ip6_hbh);
842 1.2 itojun
843 1.2 itojun if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
844 1.2 itojun hbhlen, rtalertp, plenp) < 0)
845 1.58 itojun return (-1);
846 1.2 itojun
847 1.2 itojun *offp = off;
848 1.2 itojun *mp = m;
849 1.58 itojun return (0);
850 1.2 itojun }
851 1.2 itojun
852 1.2 itojun /*
853 1.2 itojun * Search header for all Hop-by-hop options and process each option.
854 1.2 itojun * This function is separate from ip6_hopopts_input() in order to
855 1.2 itojun * handle a case where the sending node itself process its hop-by-hop
856 1.2 itojun * options header. In such a case, the function is called from ip6_output().
857 1.55 itojun *
858 1.55 itojun * The function assumes that hbh header is located right after the IPv6 header
859 1.55 itojun * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
860 1.55 itojun * opthead + hbhlen is located in continuous memory region.
861 1.2 itojun */
862 1.136 drochner static int
863 1.107 christos ip6_process_hopopts(struct mbuf *m, u_int8_t *opthead, int hbhlen,
864 1.107 christos u_int32_t *rtalertp, u_int32_t *plenp)
865 1.2 itojun {
866 1.2 itojun struct ip6_hdr *ip6;
867 1.2 itojun int optlen = 0;
868 1.2 itojun u_int8_t *opt = opthead;
869 1.2 itojun u_int16_t rtalert_val;
870 1.22 itojun u_int32_t jumboplen;
871 1.55 itojun const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh);
872 1.2 itojun
873 1.2 itojun for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) {
874 1.35 itojun switch (*opt) {
875 1.35 itojun case IP6OPT_PAD1:
876 1.35 itojun optlen = 1;
877 1.35 itojun break;
878 1.35 itojun case IP6OPT_PADN:
879 1.35 itojun if (hbhlen < IP6OPT_MINLEN) {
880 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSMALL);
881 1.35 itojun goto bad;
882 1.35 itojun }
883 1.35 itojun optlen = *(opt + 1) + 2;
884 1.35 itojun break;
885 1.35 itojun case IP6OPT_RTALERT:
886 1.35 itojun /* XXX may need check for alignment */
887 1.35 itojun if (hbhlen < IP6OPT_RTALERT_LEN) {
888 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSMALL);
889 1.35 itojun goto bad;
890 1.35 itojun }
891 1.35 itojun if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) {
892 1.55 itojun /* XXX stat */
893 1.55 itojun icmp6_error(m, ICMP6_PARAM_PROB,
894 1.55 itojun ICMP6_PARAMPROB_HEADER,
895 1.55 itojun erroff + opt + 1 - opthead);
896 1.55 itojun return (-1);
897 1.35 itojun }
898 1.35 itojun optlen = IP6OPT_RTALERT_LEN;
899 1.126 tsutsui memcpy((void *)&rtalert_val, (void *)(opt + 2), 2);
900 1.35 itojun *rtalertp = ntohs(rtalert_val);
901 1.35 itojun break;
902 1.35 itojun case IP6OPT_JUMBO:
903 1.22 itojun /* XXX may need check for alignment */
904 1.22 itojun if (hbhlen < IP6OPT_JUMBO_LEN) {
905 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSMALL);
906 1.22 itojun goto bad;
907 1.22 itojun }
908 1.35 itojun if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) {
909 1.55 itojun /* XXX stat */
910 1.55 itojun icmp6_error(m, ICMP6_PARAM_PROB,
911 1.55 itojun ICMP6_PARAMPROB_HEADER,
912 1.55 itojun erroff + opt + 1 - opthead);
913 1.55 itojun return (-1);
914 1.35 itojun }
915 1.22 itojun optlen = IP6OPT_JUMBO_LEN;
916 1.22 itojun
917 1.22 itojun /*
918 1.22 itojun * IPv6 packets that have non 0 payload length
919 1.35 itojun * must not contain a jumbo payload option.
920 1.22 itojun */
921 1.22 itojun ip6 = mtod(m, struct ip6_hdr *);
922 1.22 itojun if (ip6->ip6_plen) {
923 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
924 1.22 itojun icmp6_error(m, ICMP6_PARAM_PROB,
925 1.55 itojun ICMP6_PARAMPROB_HEADER,
926 1.55 itojun erroff + opt - opthead);
927 1.55 itojun return (-1);
928 1.22 itojun }
929 1.2 itojun
930 1.22 itojun /*
931 1.22 itojun * We may see jumbolen in unaligned location, so
932 1.22 itojun * we'd need to perform bcopy().
933 1.22 itojun */
934 1.126 tsutsui memcpy(&jumboplen, opt + 2, sizeof(jumboplen));
935 1.22 itojun jumboplen = (u_int32_t)htonl(jumboplen);
936 1.22 itojun
937 1.22 itojun #if 1
938 1.22 itojun /*
939 1.22 itojun * if there are multiple jumbo payload options,
940 1.22 itojun * *plenp will be non-zero and the packet will be
941 1.22 itojun * rejected.
942 1.22 itojun * the behavior may need some debate in ipngwg -
943 1.22 itojun * multiple options does not make sense, however,
944 1.22 itojun * there's no explicit mention in specification.
945 1.22 itojun */
946 1.22 itojun if (*plenp != 0) {
947 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
948 1.22 itojun icmp6_error(m, ICMP6_PARAM_PROB,
949 1.55 itojun ICMP6_PARAMPROB_HEADER,
950 1.55 itojun erroff + opt + 2 - opthead);
951 1.55 itojun return (-1);
952 1.22 itojun }
953 1.8 itojun #endif
954 1.2 itojun
955 1.22 itojun /*
956 1.22 itojun * jumbo payload length must be larger than 65535.
957 1.22 itojun */
958 1.22 itojun if (jumboplen <= IPV6_MAXPACKET) {
959 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
960 1.22 itojun icmp6_error(m, ICMP6_PARAM_PROB,
961 1.55 itojun ICMP6_PARAMPROB_HEADER,
962 1.55 itojun erroff + opt + 2 - opthead);
963 1.55 itojun return (-1);
964 1.22 itojun }
965 1.22 itojun *plenp = jumboplen;
966 1.22 itojun
967 1.22 itojun break;
968 1.35 itojun default: /* unknown option */
969 1.35 itojun if (hbhlen < IP6OPT_MINLEN) {
970 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSMALL);
971 1.35 itojun goto bad;
972 1.35 itojun }
973 1.55 itojun optlen = ip6_unknown_opt(opt, m,
974 1.55 itojun erroff + opt - opthead);
975 1.55 itojun if (optlen == -1)
976 1.55 itojun return (-1);
977 1.35 itojun optlen += 2;
978 1.35 itojun break;
979 1.2 itojun }
980 1.2 itojun }
981 1.2 itojun
982 1.55 itojun return (0);
983 1.2 itojun
984 1.2 itojun bad:
985 1.2 itojun m_freem(m);
986 1.55 itojun return (-1);
987 1.2 itojun }
988 1.2 itojun
989 1.2 itojun /*
990 1.2 itojun * Unknown option processing.
991 1.2 itojun * The third argument `off' is the offset from the IPv6 header to the option,
992 1.2 itojun * which is necessary if the IPv6 header the and option header and IPv6 header
993 1.2 itojun * is not continuous in order to return an ICMPv6 error.
994 1.2 itojun */
995 1.2 itojun int
996 1.107 christos ip6_unknown_opt(u_int8_t *optp, struct mbuf *m, int off)
997 1.2 itojun {
998 1.2 itojun struct ip6_hdr *ip6;
999 1.2 itojun
1000 1.35 itojun switch (IP6OPT_TYPE(*optp)) {
1001 1.35 itojun case IP6OPT_TYPE_SKIP: /* ignore the option */
1002 1.58 itojun return ((int)*(optp + 1));
1003 1.35 itojun case IP6OPT_TYPE_DISCARD: /* silently discard */
1004 1.35 itojun m_freem(m);
1005 1.58 itojun return (-1);
1006 1.35 itojun case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */
1007 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
1008 1.35 itojun icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off);
1009 1.58 itojun return (-1);
1010 1.35 itojun case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */
1011 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
1012 1.35 itojun ip6 = mtod(m, struct ip6_hdr *);
1013 1.35 itojun if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
1014 1.35 itojun (m->m_flags & (M_BCAST|M_MCAST)))
1015 1.35 itojun m_freem(m);
1016 1.35 itojun else
1017 1.35 itojun icmp6_error(m, ICMP6_PARAM_PROB,
1018 1.35 itojun ICMP6_PARAMPROB_OPTION, off);
1019 1.58 itojun return (-1);
1020 1.2 itojun }
1021 1.2 itojun
1022 1.2 itojun m_freem(m); /* XXX: NOTREACHED */
1023 1.58 itojun return (-1);
1024 1.2 itojun }
1025 1.2 itojun
1026 1.2 itojun /*
1027 1.9 itojun * Create the "control" list for this pcb.
1028 1.9 itojun *
1029 1.9 itojun * The routine will be called from upper layer handlers like tcp6_input().
1030 1.9 itojun * Thus the routine assumes that the caller (tcp6_input) have already
1031 1.9 itojun * called IP6_EXTHDR_CHECK() and all the extension headers are located in the
1032 1.9 itojun * very first mbuf on the mbuf chain.
1033 1.9 itojun * We may want to add some infinite loop prevention or sanity checks for safety.
1034 1.9 itojun * (This applies only when you are using KAME mbuf chain restriction, i.e.
1035 1.9 itojun * you are using IP6_EXTHDR_CHECK() not m_pulldown())
1036 1.2 itojun */
1037 1.2 itojun void
1038 1.107 christos ip6_savecontrol(struct in6pcb *in6p, struct mbuf **mp,
1039 1.107 christos struct ip6_hdr *ip6, struct mbuf *m)
1040 1.2 itojun {
1041 1.85 rpaulo #ifdef RFC2292
1042 1.85 rpaulo #define IS2292(x, y) ((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y))
1043 1.85 rpaulo #else
1044 1.85 rpaulo #define IS2292(x, y) (y)
1045 1.85 rpaulo #endif
1046 1.85 rpaulo
1047 1.123 christos if (in6p->in6p_socket->so_options & SO_TIMESTAMP
1048 1.123 christos #ifdef SO_OTIMESTAMP
1049 1.123 christos || in6p->in6p_socket->so_options & SO_OTIMESTAMP
1050 1.123 christos #endif
1051 1.123 christos ) {
1052 1.2 itojun struct timeval tv;
1053 1.2 itojun
1054 1.2 itojun microtime(&tv);
1055 1.123 christos #ifdef SO_OTIMESTAMP
1056 1.123 christos if (in6p->in6p_socket->so_options & SO_OTIMESTAMP) {
1057 1.123 christos struct timeval50 tv50;
1058 1.123 christos timeval_to_timeval50(&tv, &tv50);
1059 1.123 christos *mp = sbcreatecontrol((void *) &tv50, sizeof(tv50),
1060 1.123 christos SCM_OTIMESTAMP, SOL_SOCKET);
1061 1.123 christos } else
1062 1.123 christos #endif
1063 1.97 christos *mp = sbcreatecontrol((void *) &tv, sizeof(tv),
1064 1.63 itojun SCM_TIMESTAMP, SOL_SOCKET);
1065 1.2 itojun if (*mp)
1066 1.2 itojun mp = &(*mp)->m_next;
1067 1.2 itojun }
1068 1.87 rpaulo
1069 1.87 rpaulo /* some OSes call this logic with IPv4 packet, for SO_TIMESTAMP */
1070 1.87 rpaulo if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION)
1071 1.87 rpaulo return;
1072 1.87 rpaulo
1073 1.2 itojun /* RFC 2292 sec. 5 */
1074 1.35 itojun if ((in6p->in6p_flags & IN6P_PKTINFO) != 0) {
1075 1.2 itojun struct in6_pktinfo pi6;
1076 1.85 rpaulo
1077 1.126 tsutsui memcpy(&pi6.ipi6_addr, &ip6->ip6_dst, sizeof(struct in6_addr));
1078 1.81 rpaulo in6_clearscope(&pi6.ipi6_addr); /* XXX */
1079 1.160 ozaki pi6.ipi6_ifindex = m->m_pkthdr.rcvif_index;
1080 1.97 christos *mp = sbcreatecontrol((void *) &pi6,
1081 1.85 rpaulo sizeof(struct in6_pktinfo),
1082 1.85 rpaulo IS2292(IPV6_2292PKTINFO, IPV6_PKTINFO), IPPROTO_IPV6);
1083 1.2 itojun if (*mp)
1084 1.2 itojun mp = &(*mp)->m_next;
1085 1.2 itojun }
1086 1.85 rpaulo
1087 1.2 itojun if (in6p->in6p_flags & IN6P_HOPLIMIT) {
1088 1.2 itojun int hlim = ip6->ip6_hlim & 0xff;
1089 1.85 rpaulo
1090 1.97 christos *mp = sbcreatecontrol((void *) &hlim, sizeof(int),
1091 1.85 rpaulo IS2292(IPV6_2292HOPLIMIT, IPV6_HOPLIMIT), IPPROTO_IPV6);
1092 1.85 rpaulo if (*mp)
1093 1.85 rpaulo mp = &(*mp)->m_next;
1094 1.85 rpaulo }
1095 1.85 rpaulo
1096 1.85 rpaulo if ((in6p->in6p_flags & IN6P_TCLASS) != 0) {
1097 1.85 rpaulo u_int32_t flowinfo;
1098 1.85 rpaulo int tclass;
1099 1.85 rpaulo
1100 1.85 rpaulo flowinfo = (u_int32_t)ntohl(ip6->ip6_flow & IPV6_FLOWINFO_MASK);
1101 1.85 rpaulo flowinfo >>= 20;
1102 1.85 rpaulo
1103 1.85 rpaulo tclass = flowinfo & 0xff;
1104 1.97 christos *mp = sbcreatecontrol((void *)&tclass, sizeof(tclass),
1105 1.85 rpaulo IPV6_TCLASS, IPPROTO_IPV6);
1106 1.85 rpaulo
1107 1.2 itojun if (*mp)
1108 1.2 itojun mp = &(*mp)->m_next;
1109 1.2 itojun }
1110 1.2 itojun
1111 1.2 itojun /*
1112 1.75 itojun * IPV6_HOPOPTS socket option. Recall that we required super-user
1113 1.75 itojun * privilege for the option (see ip6_ctloutput), but it might be too
1114 1.75 itojun * strict, since there might be some hop-by-hop options which can be
1115 1.75 itojun * returned to normal user.
1116 1.85 rpaulo * See also RFC3542 section 8 (or RFC2292 section 6).
1117 1.2 itojun */
1118 1.75 itojun if ((in6p->in6p_flags & IN6P_HOPOPTS) != 0) {
1119 1.2 itojun /*
1120 1.2 itojun * Check if a hop-by-hop options header is contatined in the
1121 1.2 itojun * received packet, and if so, store the options as ancillary
1122 1.2 itojun * data. Note that a hop-by-hop options header must be
1123 1.2 itojun * just after the IPv6 header, which fact is assured through
1124 1.2 itojun * the IPv6 input processing.
1125 1.2 itojun */
1126 1.78 christos struct ip6_hdr *xip6 = mtod(m, struct ip6_hdr *);
1127 1.78 christos if (xip6->ip6_nxt == IPPROTO_HOPOPTS) {
1128 1.9 itojun struct ip6_hbh *hbh;
1129 1.9 itojun int hbhlen;
1130 1.62 itojun struct mbuf *ext;
1131 1.9 itojun
1132 1.62 itojun ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr),
1133 1.78 christos xip6->ip6_nxt);
1134 1.62 itojun if (ext == NULL) {
1135 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
1136 1.9 itojun return;
1137 1.9 itojun }
1138 1.62 itojun hbh = mtod(ext, struct ip6_hbh *);
1139 1.9 itojun hbhlen = (hbh->ip6h_len + 1) << 3;
1140 1.62 itojun if (hbhlen != ext->m_len) {
1141 1.62 itojun m_freem(ext);
1142 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
1143 1.9 itojun return;
1144 1.9 itojun }
1145 1.2 itojun
1146 1.2 itojun /*
1147 1.2 itojun * XXX: We copy whole the header even if a jumbo
1148 1.2 itojun * payload option is included, which option is to
1149 1.2 itojun * be removed before returning in the RFC 2292.
1150 1.85 rpaulo * Note: this constraint is removed in RFC3542.
1151 1.2 itojun */
1152 1.97 christos *mp = sbcreatecontrol((void *)hbh, hbhlen,
1153 1.85 rpaulo IS2292(IPV6_2292HOPOPTS, IPV6_HOPOPTS),
1154 1.85 rpaulo IPPROTO_IPV6);
1155 1.2 itojun if (*mp)
1156 1.2 itojun mp = &(*mp)->m_next;
1157 1.62 itojun m_freem(ext);
1158 1.2 itojun }
1159 1.2 itojun }
1160 1.2 itojun
1161 1.2 itojun /* IPV6_DSTOPTS and IPV6_RTHDR socket options */
1162 1.2 itojun if (in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDR)) {
1163 1.78 christos struct ip6_hdr *xip6 = mtod(m, struct ip6_hdr *);
1164 1.78 christos int nxt = xip6->ip6_nxt, off = sizeof(struct ip6_hdr);
1165 1.2 itojun
1166 1.2 itojun /*
1167 1.2 itojun * Search for destination options headers or routing
1168 1.2 itojun * header(s) through the header chain, and stores each
1169 1.2 itojun * header as ancillary data.
1170 1.2 itojun * Note that the order of the headers remains in
1171 1.2 itojun * the chain of ancillary data.
1172 1.2 itojun */
1173 1.86 rpaulo for (;;) { /* is explicit loop prevention necessary? */
1174 1.62 itojun struct ip6_ext *ip6e = NULL;
1175 1.9 itojun int elen;
1176 1.62 itojun struct mbuf *ext = NULL;
1177 1.9 itojun
1178 1.62 itojun /*
1179 1.62 itojun * if it is not an extension header, don't try to
1180 1.62 itojun * pull it from the chain.
1181 1.62 itojun */
1182 1.62 itojun switch (nxt) {
1183 1.62 itojun case IPPROTO_DSTOPTS:
1184 1.62 itojun case IPPROTO_ROUTING:
1185 1.62 itojun case IPPROTO_HOPOPTS:
1186 1.62 itojun case IPPROTO_AH: /* is it possible? */
1187 1.62 itojun break;
1188 1.62 itojun default:
1189 1.62 itojun goto loopend;
1190 1.62 itojun }
1191 1.62 itojun
1192 1.62 itojun ext = ip6_pullexthdr(m, off, nxt);
1193 1.62 itojun if (ext == NULL) {
1194 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
1195 1.9 itojun return;
1196 1.9 itojun }
1197 1.62 itojun ip6e = mtod(ext, struct ip6_ext *);
1198 1.9 itojun if (nxt == IPPROTO_AH)
1199 1.9 itojun elen = (ip6e->ip6e_len + 2) << 2;
1200 1.9 itojun else
1201 1.9 itojun elen = (ip6e->ip6e_len + 1) << 3;
1202 1.62 itojun if (elen != ext->m_len) {
1203 1.62 itojun m_freem(ext);
1204 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
1205 1.9 itojun return;
1206 1.9 itojun }
1207 1.57 thorpej KASSERT(IP6_HDR_ALIGNED_P(ip6e));
1208 1.2 itojun
1209 1.35 itojun switch (nxt) {
1210 1.62 itojun case IPPROTO_DSTOPTS:
1211 1.127 martin if (!(in6p->in6p_flags & IN6P_DSTOPTS))
1212 1.35 itojun break;
1213 1.35 itojun
1214 1.97 christos *mp = sbcreatecontrol((void *)ip6e, elen,
1215 1.85 rpaulo IS2292(IPV6_2292DSTOPTS, IPV6_DSTOPTS),
1216 1.85 rpaulo IPPROTO_IPV6);
1217 1.35 itojun if (*mp)
1218 1.35 itojun mp = &(*mp)->m_next;
1219 1.35 itojun break;
1220 1.35 itojun
1221 1.35 itojun case IPPROTO_ROUTING:
1222 1.127 martin if (!(in6p->in6p_flags & IN6P_RTHDR))
1223 1.35 itojun break;
1224 1.35 itojun
1225 1.97 christos *mp = sbcreatecontrol((void *)ip6e, elen,
1226 1.85 rpaulo IS2292(IPV6_2292RTHDR, IPV6_RTHDR),
1227 1.85 rpaulo IPPROTO_IPV6);
1228 1.35 itojun if (*mp)
1229 1.35 itojun mp = &(*mp)->m_next;
1230 1.35 itojun break;
1231 1.35 itojun
1232 1.62 itojun case IPPROTO_HOPOPTS:
1233 1.62 itojun case IPPROTO_AH: /* is it possible? */
1234 1.62 itojun break;
1235 1.62 itojun
1236 1.35 itojun default:
1237 1.35 itojun /*
1238 1.62 itojun * other cases have been filtered in the above.
1239 1.62 itojun * none will visit this case. here we supply
1240 1.62 itojun * the code just in case (nxt overwritten or
1241 1.62 itojun * other cases).
1242 1.35 itojun */
1243 1.62 itojun m_freem(ext);
1244 1.35 itojun goto loopend;
1245 1.35 itojun
1246 1.2 itojun }
1247 1.2 itojun
1248 1.2 itojun /* proceed with the next header. */
1249 1.9 itojun off += elen;
1250 1.2 itojun nxt = ip6e->ip6e_nxt;
1251 1.62 itojun ip6e = NULL;
1252 1.62 itojun m_freem(ext);
1253 1.62 itojun ext = NULL;
1254 1.2 itojun }
1255 1.2 itojun loopend:
1256 1.62 itojun ;
1257 1.2 itojun }
1258 1.62 itojun }
1259 1.85 rpaulo #undef IS2292
1260 1.85 rpaulo
1261 1.85 rpaulo
1262 1.85 rpaulo void
1263 1.95 dyoung ip6_notify_pmtu(struct in6pcb *in6p, const struct sockaddr_in6 *dst,
1264 1.95 dyoung uint32_t *mtu)
1265 1.85 rpaulo {
1266 1.85 rpaulo struct socket *so;
1267 1.85 rpaulo struct mbuf *m_mtu;
1268 1.85 rpaulo struct ip6_mtuinfo mtuctl;
1269 1.85 rpaulo
1270 1.85 rpaulo so = in6p->in6p_socket;
1271 1.85 rpaulo
1272 1.85 rpaulo if (mtu == NULL)
1273 1.85 rpaulo return;
1274 1.85 rpaulo
1275 1.85 rpaulo #ifdef DIAGNOSTIC
1276 1.85 rpaulo if (so == NULL) /* I believe this is impossible */
1277 1.85 rpaulo panic("ip6_notify_pmtu: socket is NULL");
1278 1.85 rpaulo #endif
1279 1.85 rpaulo
1280 1.85 rpaulo memset(&mtuctl, 0, sizeof(mtuctl)); /* zero-clear for safety */
1281 1.85 rpaulo mtuctl.ip6m_mtu = *mtu;
1282 1.85 rpaulo mtuctl.ip6m_addr = *dst;
1283 1.85 rpaulo if (sa6_recoverscope(&mtuctl.ip6m_addr))
1284 1.85 rpaulo return;
1285 1.85 rpaulo
1286 1.97 christos if ((m_mtu = sbcreatecontrol((void *)&mtuctl, sizeof(mtuctl),
1287 1.85 rpaulo IPV6_PATHMTU, IPPROTO_IPV6)) == NULL)
1288 1.85 rpaulo return;
1289 1.85 rpaulo
1290 1.95 dyoung if (sbappendaddr(&so->so_rcv, (const struct sockaddr *)dst, NULL, m_mtu)
1291 1.85 rpaulo == 0) {
1292 1.85 rpaulo m_freem(m_mtu);
1293 1.85 rpaulo /* XXX: should count statistics */
1294 1.85 rpaulo } else
1295 1.85 rpaulo sorwakeup(so);
1296 1.85 rpaulo
1297 1.85 rpaulo return;
1298 1.85 rpaulo }
1299 1.62 itojun
1300 1.62 itojun /*
1301 1.62 itojun * pull single extension header from mbuf chain. returns single mbuf that
1302 1.62 itojun * contains the result, or NULL on error.
1303 1.62 itojun */
1304 1.62 itojun static struct mbuf *
1305 1.107 christos ip6_pullexthdr(struct mbuf *m, size_t off, int nxt)
1306 1.62 itojun {
1307 1.62 itojun struct ip6_ext ip6e;
1308 1.62 itojun size_t elen;
1309 1.62 itojun struct mbuf *n;
1310 1.62 itojun
1311 1.62 itojun #ifdef DIAGNOSTIC
1312 1.62 itojun switch (nxt) {
1313 1.62 itojun case IPPROTO_DSTOPTS:
1314 1.62 itojun case IPPROTO_ROUTING:
1315 1.62 itojun case IPPROTO_HOPOPTS:
1316 1.62 itojun case IPPROTO_AH: /* is it possible? */
1317 1.62 itojun break;
1318 1.62 itojun default:
1319 1.62 itojun printf("ip6_pullexthdr: invalid nxt=%d\n", nxt);
1320 1.2 itojun }
1321 1.62 itojun #endif
1322 1.2 itojun
1323 1.97 christos m_copydata(m, off, sizeof(ip6e), (void *)&ip6e);
1324 1.62 itojun if (nxt == IPPROTO_AH)
1325 1.62 itojun elen = (ip6e.ip6e_len + 2) << 2;
1326 1.62 itojun else
1327 1.62 itojun elen = (ip6e.ip6e_len + 1) << 3;
1328 1.62 itojun
1329 1.62 itojun MGET(n, M_DONTWAIT, MT_DATA);
1330 1.62 itojun if (n && elen >= MLEN) {
1331 1.62 itojun MCLGET(n, M_DONTWAIT);
1332 1.62 itojun if ((n->m_flags & M_EXT) == 0) {
1333 1.62 itojun m_free(n);
1334 1.62 itojun n = NULL;
1335 1.62 itojun }
1336 1.62 itojun }
1337 1.62 itojun if (!n)
1338 1.62 itojun return NULL;
1339 1.62 itojun
1340 1.62 itojun n->m_len = 0;
1341 1.62 itojun if (elen >= M_TRAILINGSPACE(n)) {
1342 1.62 itojun m_free(n);
1343 1.62 itojun return NULL;
1344 1.62 itojun }
1345 1.62 itojun
1346 1.97 christos m_copydata(m, off, elen, mtod(n, void *));
1347 1.62 itojun n->m_len = elen;
1348 1.62 itojun return n;
1349 1.2 itojun }
1350 1.2 itojun
1351 1.2 itojun /*
1352 1.2 itojun * Get pointer to the previous header followed by the header
1353 1.2 itojun * currently processed.
1354 1.2 itojun * XXX: This function supposes that
1355 1.2 itojun * M includes all headers,
1356 1.2 itojun * the next header field and the header length field of each header
1357 1.2 itojun * are valid, and
1358 1.2 itojun * the sum of each header length equals to OFF.
1359 1.2 itojun * Because of these assumptions, this function must be called very
1360 1.2 itojun * carefully. Moreover, it will not be used in the near future when
1361 1.2 itojun * we develop `neater' mechanism to process extension headers.
1362 1.2 itojun */
1363 1.58 itojun u_int8_t *
1364 1.107 christos ip6_get_prevhdr(struct mbuf *m, int off)
1365 1.2 itojun {
1366 1.2 itojun struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1367 1.2 itojun
1368 1.2 itojun if (off == sizeof(struct ip6_hdr))
1369 1.58 itojun return (&ip6->ip6_nxt);
1370 1.2 itojun else {
1371 1.2 itojun int len, nxt;
1372 1.2 itojun struct ip6_ext *ip6e = NULL;
1373 1.2 itojun
1374 1.2 itojun nxt = ip6->ip6_nxt;
1375 1.2 itojun len = sizeof(struct ip6_hdr);
1376 1.2 itojun while (len < off) {
1377 1.97 christos ip6e = (struct ip6_ext *)(mtod(m, char *) + len);
1378 1.2 itojun
1379 1.35 itojun switch (nxt) {
1380 1.2 itojun case IPPROTO_FRAGMENT:
1381 1.2 itojun len += sizeof(struct ip6_frag);
1382 1.2 itojun break;
1383 1.2 itojun case IPPROTO_AH:
1384 1.2 itojun len += (ip6e->ip6e_len + 2) << 2;
1385 1.2 itojun break;
1386 1.2 itojun default:
1387 1.2 itojun len += (ip6e->ip6e_len + 1) << 3;
1388 1.2 itojun break;
1389 1.2 itojun }
1390 1.2 itojun nxt = ip6e->ip6e_nxt;
1391 1.2 itojun }
1392 1.2 itojun if (ip6e)
1393 1.58 itojun return (&ip6e->ip6e_nxt);
1394 1.2 itojun else
1395 1.2 itojun return NULL;
1396 1.18 itojun }
1397 1.18 itojun }
1398 1.18 itojun
1399 1.18 itojun /*
1400 1.18 itojun * get next header offset. m will be retained.
1401 1.18 itojun */
1402 1.18 itojun int
1403 1.107 christos ip6_nexthdr(struct mbuf *m, int off, int proto, int *nxtp)
1404 1.18 itojun {
1405 1.18 itojun struct ip6_hdr ip6;
1406 1.18 itojun struct ip6_ext ip6e;
1407 1.18 itojun struct ip6_frag fh;
1408 1.18 itojun
1409 1.18 itojun /* just in case */
1410 1.18 itojun if (m == NULL)
1411 1.18 itojun panic("ip6_nexthdr: m == NULL");
1412 1.18 itojun if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off)
1413 1.18 itojun return -1;
1414 1.18 itojun
1415 1.18 itojun switch (proto) {
1416 1.18 itojun case IPPROTO_IPV6:
1417 1.83 rpaulo /* do not chase beyond intermediate IPv6 headers */
1418 1.83 rpaulo if (off != 0)
1419 1.83 rpaulo return -1;
1420 1.18 itojun if (m->m_pkthdr.len < off + sizeof(ip6))
1421 1.18 itojun return -1;
1422 1.97 christos m_copydata(m, off, sizeof(ip6), (void *)&ip6);
1423 1.18 itojun if (nxtp)
1424 1.18 itojun *nxtp = ip6.ip6_nxt;
1425 1.18 itojun off += sizeof(ip6);
1426 1.18 itojun return off;
1427 1.18 itojun
1428 1.18 itojun case IPPROTO_FRAGMENT:
1429 1.18 itojun /*
1430 1.18 itojun * terminate parsing if it is not the first fragment,
1431 1.18 itojun * it does not make sense to parse through it.
1432 1.18 itojun */
1433 1.18 itojun if (m->m_pkthdr.len < off + sizeof(fh))
1434 1.18 itojun return -1;
1435 1.97 christos m_copydata(m, off, sizeof(fh), (void *)&fh);
1436 1.67 itojun if ((fh.ip6f_offlg & IP6F_OFF_MASK) != 0)
1437 1.18 itojun return -1;
1438 1.18 itojun if (nxtp)
1439 1.18 itojun *nxtp = fh.ip6f_nxt;
1440 1.18 itojun off += sizeof(struct ip6_frag);
1441 1.18 itojun return off;
1442 1.18 itojun
1443 1.18 itojun case IPPROTO_AH:
1444 1.18 itojun if (m->m_pkthdr.len < off + sizeof(ip6e))
1445 1.18 itojun return -1;
1446 1.97 christos m_copydata(m, off, sizeof(ip6e), (void *)&ip6e);
1447 1.18 itojun if (nxtp)
1448 1.18 itojun *nxtp = ip6e.ip6e_nxt;
1449 1.18 itojun off += (ip6e.ip6e_len + 2) << 2;
1450 1.47 itojun if (m->m_pkthdr.len < off)
1451 1.47 itojun return -1;
1452 1.18 itojun return off;
1453 1.18 itojun
1454 1.18 itojun case IPPROTO_HOPOPTS:
1455 1.18 itojun case IPPROTO_ROUTING:
1456 1.18 itojun case IPPROTO_DSTOPTS:
1457 1.18 itojun if (m->m_pkthdr.len < off + sizeof(ip6e))
1458 1.18 itojun return -1;
1459 1.97 christos m_copydata(m, off, sizeof(ip6e), (void *)&ip6e);
1460 1.18 itojun if (nxtp)
1461 1.18 itojun *nxtp = ip6e.ip6e_nxt;
1462 1.18 itojun off += (ip6e.ip6e_len + 1) << 3;
1463 1.47 itojun if (m->m_pkthdr.len < off)
1464 1.47 itojun return -1;
1465 1.18 itojun return off;
1466 1.18 itojun
1467 1.18 itojun case IPPROTO_NONE:
1468 1.18 itojun case IPPROTO_ESP:
1469 1.18 itojun case IPPROTO_IPCOMP:
1470 1.18 itojun /* give up */
1471 1.18 itojun return -1;
1472 1.18 itojun
1473 1.18 itojun default:
1474 1.18 itojun return -1;
1475 1.18 itojun }
1476 1.18 itojun }
1477 1.18 itojun
1478 1.18 itojun /*
1479 1.18 itojun * get offset for the last header in the chain. m will be kept untainted.
1480 1.18 itojun */
1481 1.18 itojun int
1482 1.107 christos ip6_lasthdr(struct mbuf *m, int off, int proto, int *nxtp)
1483 1.18 itojun {
1484 1.18 itojun int newoff;
1485 1.18 itojun int nxt;
1486 1.18 itojun
1487 1.18 itojun if (!nxtp) {
1488 1.18 itojun nxt = -1;
1489 1.18 itojun nxtp = &nxt;
1490 1.18 itojun }
1491 1.86 rpaulo for (;;) {
1492 1.18 itojun newoff = ip6_nexthdr(m, off, proto, nxtp);
1493 1.18 itojun if (newoff < 0)
1494 1.18 itojun return off;
1495 1.18 itojun else if (newoff < off)
1496 1.18 itojun return -1; /* invalid */
1497 1.18 itojun else if (newoff == off)
1498 1.18 itojun return newoff;
1499 1.18 itojun
1500 1.18 itojun off = newoff;
1501 1.18 itojun proto = *nxtp;
1502 1.2 itojun }
1503 1.2 itojun }
1504 1.2 itojun
1505 1.81 rpaulo struct m_tag *
1506 1.107 christos ip6_addaux(struct mbuf *m)
1507 1.81 rpaulo {
1508 1.81 rpaulo struct m_tag *mtag;
1509 1.81 rpaulo
1510 1.81 rpaulo mtag = m_tag_find(m, PACKET_TAG_INET6, NULL);
1511 1.81 rpaulo if (!mtag) {
1512 1.81 rpaulo mtag = m_tag_get(PACKET_TAG_INET6, sizeof(struct ip6aux),
1513 1.81 rpaulo M_NOWAIT);
1514 1.81 rpaulo if (mtag) {
1515 1.81 rpaulo m_tag_prepend(m, mtag);
1516 1.124 cegger memset(mtag + 1, 0, sizeof(struct ip6aux));
1517 1.81 rpaulo }
1518 1.81 rpaulo }
1519 1.81 rpaulo return mtag;
1520 1.81 rpaulo }
1521 1.81 rpaulo
1522 1.81 rpaulo struct m_tag *
1523 1.107 christos ip6_findaux(struct mbuf *m)
1524 1.81 rpaulo {
1525 1.81 rpaulo struct m_tag *mtag;
1526 1.81 rpaulo
1527 1.81 rpaulo mtag = m_tag_find(m, PACKET_TAG_INET6, NULL);
1528 1.81 rpaulo return mtag;
1529 1.81 rpaulo }
1530 1.81 rpaulo
1531 1.81 rpaulo void
1532 1.107 christos ip6_delaux(struct mbuf *m)
1533 1.81 rpaulo {
1534 1.81 rpaulo struct m_tag *mtag;
1535 1.81 rpaulo
1536 1.81 rpaulo mtag = m_tag_find(m, PACKET_TAG_INET6, NULL);
1537 1.81 rpaulo if (mtag)
1538 1.81 rpaulo m_tag_delete(m, mtag);
1539 1.81 rpaulo }
1540 1.81 rpaulo
1541 1.2 itojun /*
1542 1.2 itojun * System control for IP6
1543 1.2 itojun */
1544 1.2 itojun
1545 1.120 matt const u_char inet6ctlerrmap[PRC_NCMDS] = {
1546 1.2 itojun 0, 0, 0, 0,
1547 1.2 itojun 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH,
1548 1.2 itojun EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED,
1549 1.2 itojun EMSGSIZE, EHOSTUNREACH, 0, 0,
1550 1.2 itojun 0, 0, 0, 0,
1551 1.2 itojun ENOPROTOOPT
1552 1.2 itojun };
1553 1.2 itojun
1554 1.153 christos extern int sysctl_net_inet6_addrctlpolicy(SYSCTLFN_ARGS);
1555 1.153 christos
1556 1.116 thorpej static int
1557 1.116 thorpej sysctl_net_inet6_ip6_stats(SYSCTLFN_ARGS)
1558 1.116 thorpej {
1559 1.116 thorpej
1560 1.119 thorpej return (NETSTAT_SYSCTL(ip6stat_percpu, IP6_NSTATS));
1561 1.116 thorpej }
1562 1.116 thorpej
1563 1.128 pooka static void
1564 1.128 pooka sysctl_net_inet6_ip6_setup(struct sysctllog **clog)
1565 1.2 itojun {
1566 1.85 rpaulo #ifdef RFC2292
1567 1.85 rpaulo #define IS2292(x, y) ((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y))
1568 1.85 rpaulo #else
1569 1.85 rpaulo #define IS2292(x, y) (y)
1570 1.85 rpaulo #endif
1571 1.26 itojun
1572 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1573 1.73 atatat CTLFLAG_PERMANENT,
1574 1.74 atatat CTLTYPE_NODE, "inet6",
1575 1.74 atatat SYSCTL_DESCR("PF_INET6 related settings"),
1576 1.70 atatat NULL, 0, NULL, 0,
1577 1.70 atatat CTL_NET, PF_INET6, CTL_EOL);
1578 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1579 1.73 atatat CTLFLAG_PERMANENT,
1580 1.74 atatat CTLTYPE_NODE, "ip6",
1581 1.74 atatat SYSCTL_DESCR("IPv6 related settings"),
1582 1.70 atatat NULL, 0, NULL, 0,
1583 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6, CTL_EOL);
1584 1.70 atatat
1585 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1586 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1587 1.74 atatat CTLTYPE_INT, "forwarding",
1588 1.74 atatat SYSCTL_DESCR("Enable forwarding of INET6 datagrams"),
1589 1.70 atatat NULL, 0, &ip6_forwarding, 0,
1590 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1591 1.70 atatat IPV6CTL_FORWARDING, CTL_EOL);
1592 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1593 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1594 1.74 atatat CTLTYPE_INT, "redirect",
1595 1.74 atatat SYSCTL_DESCR("Enable sending of ICMPv6 redirect messages"),
1596 1.70 atatat NULL, 0, &ip6_sendredirects, 0,
1597 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1598 1.70 atatat IPV6CTL_SENDREDIRECTS, CTL_EOL);
1599 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1600 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1601 1.74 atatat CTLTYPE_INT, "hlim",
1602 1.74 atatat SYSCTL_DESCR("Hop limit for an INET6 datagram"),
1603 1.70 atatat NULL, 0, &ip6_defhlim, 0,
1604 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1605 1.70 atatat IPV6CTL_DEFHLIM, CTL_EOL);
1606 1.70 atatat #ifdef notyet
1607 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1608 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1609 1.70 atatat CTLTYPE_INT, "mtu", NULL,
1610 1.70 atatat NULL, 0, &, 0,
1611 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1612 1.70 atatat IPV6CTL_DEFMTU, CTL_EOL);
1613 1.70 atatat #endif
1614 1.70 atatat #ifdef __no_idea__
1615 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1616 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1617 1.70 atatat CTLTYPE_INT, "forwsrcrt", NULL,
1618 1.70 atatat NULL, 0, &?, 0,
1619 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1620 1.70 atatat IPV6CTL_FORWSRCRT, CTL_EOL);
1621 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1622 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1623 1.70 atatat CTLTYPE_STRUCT, "mrtstats", NULL,
1624 1.70 atatat NULL, 0, &?, sizeof(?),
1625 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1626 1.70 atatat IPV6CTL_MRTSTATS, CTL_EOL);
1627 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1628 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1629 1.70 atatat CTLTYPE_?, "mrtproto", NULL,
1630 1.70 atatat NULL, 0, &?, sizeof(?),
1631 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1632 1.70 atatat IPV6CTL_MRTPROTO, CTL_EOL);
1633 1.70 atatat #endif
1634 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1635 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1636 1.74 atatat CTLTYPE_INT, "maxfragpackets",
1637 1.74 atatat SYSCTL_DESCR("Maximum number of fragments to buffer "
1638 1.74 atatat "for reassembly"),
1639 1.70 atatat NULL, 0, &ip6_maxfragpackets, 0,
1640 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1641 1.70 atatat IPV6CTL_MAXFRAGPACKETS, CTL_EOL);
1642 1.70 atatat #ifdef __no_idea__
1643 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1644 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1645 1.70 atatat CTLTYPE_INT, "sourcecheck", NULL,
1646 1.70 atatat NULL, 0, &?, 0,
1647 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1648 1.70 atatat IPV6CTL_SOURCECHECK, CTL_EOL);
1649 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1650 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1651 1.70 atatat CTLTYPE_INT, "sourcecheck_logint", NULL,
1652 1.70 atatat NULL, 0, &?, 0,
1653 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1654 1.70 atatat IPV6CTL_SOURCECHECK_LOGINT, CTL_EOL);
1655 1.70 atatat #endif
1656 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1657 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1658 1.74 atatat CTLTYPE_INT, "accept_rtadv",
1659 1.74 atatat SYSCTL_DESCR("Accept router advertisements"),
1660 1.70 atatat NULL, 0, &ip6_accept_rtadv, 0,
1661 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1662 1.70 atatat IPV6CTL_ACCEPT_RTADV, CTL_EOL);
1663 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1664 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1665 1.131 spz CTLTYPE_INT, "rtadv_maxroutes",
1666 1.131 spz SYSCTL_DESCR("Maximum number of routes accepted via router advertisements"),
1667 1.131 spz NULL, 0, &ip6_rtadv_maxroutes, 0,
1668 1.131 spz CTL_NET, PF_INET6, IPPROTO_IPV6,
1669 1.131 spz IPV6CTL_RTADV_MAXROUTES, CTL_EOL);
1670 1.131 spz sysctl_createv(clog, 0, NULL, NULL,
1671 1.131 spz CTLFLAG_PERMANENT,
1672 1.131 spz CTLTYPE_INT, "rtadv_numroutes",
1673 1.131 spz SYSCTL_DESCR("Current number of routes accepted via router advertisements"),
1674 1.131 spz NULL, 0, &nd6_numroutes, 0,
1675 1.131 spz CTL_NET, PF_INET6, IPPROTO_IPV6,
1676 1.131 spz IPV6CTL_RTADV_NUMROUTES, CTL_EOL);
1677 1.131 spz sysctl_createv(clog, 0, NULL, NULL,
1678 1.131 spz CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1679 1.74 atatat CTLTYPE_INT, "keepfaith",
1680 1.74 atatat SYSCTL_DESCR("Activate faith interface"),
1681 1.70 atatat NULL, 0, &ip6_keepfaith, 0,
1682 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1683 1.70 atatat IPV6CTL_KEEPFAITH, CTL_EOL);
1684 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1685 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1686 1.74 atatat CTLTYPE_INT, "log_interval",
1687 1.74 atatat SYSCTL_DESCR("Minumum interval between logging "
1688 1.74 atatat "unroutable packets"),
1689 1.70 atatat NULL, 0, &ip6_log_interval, 0,
1690 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1691 1.70 atatat IPV6CTL_LOG_INTERVAL, CTL_EOL);
1692 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1693 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1694 1.74 atatat CTLTYPE_INT, "hdrnestlimit",
1695 1.74 atatat SYSCTL_DESCR("Maximum number of nested IPv6 headers"),
1696 1.70 atatat NULL, 0, &ip6_hdrnestlimit, 0,
1697 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1698 1.70 atatat IPV6CTL_HDRNESTLIMIT, CTL_EOL);
1699 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1700 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1701 1.74 atatat CTLTYPE_INT, "dad_count",
1702 1.74 atatat SYSCTL_DESCR("Number of Duplicate Address Detection "
1703 1.74 atatat "probes to send"),
1704 1.70 atatat NULL, 0, &ip6_dad_count, 0,
1705 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1706 1.70 atatat IPV6CTL_DAD_COUNT, CTL_EOL);
1707 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1708 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1709 1.74 atatat CTLTYPE_INT, "auto_flowlabel",
1710 1.74 atatat SYSCTL_DESCR("Assign random IPv6 flow labels"),
1711 1.70 atatat NULL, 0, &ip6_auto_flowlabel, 0,
1712 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1713 1.70 atatat IPV6CTL_AUTO_FLOWLABEL, CTL_EOL);
1714 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1715 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1716 1.74 atatat CTLTYPE_INT, "defmcasthlim",
1717 1.74 atatat SYSCTL_DESCR("Default multicast hop limit"),
1718 1.70 atatat NULL, 0, &ip6_defmcasthlim, 0,
1719 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1720 1.70 atatat IPV6CTL_DEFMCASTHLIM, CTL_EOL);
1721 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1722 1.73 atatat CTLFLAG_PERMANENT,
1723 1.74 atatat CTLTYPE_STRING, "kame_version",
1724 1.74 atatat SYSCTL_DESCR("KAME Version"),
1725 1.78 christos NULL, 0, __UNCONST(__KAME_VERSION), 0,
1726 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1727 1.70 atatat IPV6CTL_KAME_VERSION, CTL_EOL);
1728 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1729 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1730 1.74 atatat CTLTYPE_INT, "use_deprecated",
1731 1.74 atatat SYSCTL_DESCR("Allow use of deprecated addresses as "
1732 1.74 atatat "source addresses"),
1733 1.70 atatat NULL, 0, &ip6_use_deprecated, 0,
1734 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1735 1.70 atatat IPV6CTL_USE_DEPRECATED, CTL_EOL);
1736 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1737 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1738 1.70 atatat CTLTYPE_INT, "rr_prune", NULL,
1739 1.70 atatat NULL, 0, &ip6_rr_prune, 0,
1740 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1741 1.70 atatat IPV6CTL_RR_PRUNE, CTL_EOL);
1742 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1743 1.73 atatat CTLFLAG_PERMANENT
1744 1.70 atatat #ifndef INET6_BINDV6ONLY
1745 1.73 atatat |CTLFLAG_READWRITE,
1746 1.70 atatat #endif
1747 1.74 atatat CTLTYPE_INT, "v6only",
1748 1.74 atatat SYSCTL_DESCR("Disallow PF_INET6 sockets from connecting "
1749 1.74 atatat "to PF_INET sockets"),
1750 1.70 atatat NULL, 0, &ip6_v6only, 0,
1751 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1752 1.70 atatat IPV6CTL_V6ONLY, CTL_EOL);
1753 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1754 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1755 1.74 atatat CTLTYPE_INT, "anonportmin",
1756 1.74 atatat SYSCTL_DESCR("Lowest ephemeral port number to assign"),
1757 1.70 atatat sysctl_net_inet_ip_ports, 0, &ip6_anonportmin, 0,
1758 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1759 1.70 atatat IPV6CTL_ANONPORTMIN, CTL_EOL);
1760 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1761 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1762 1.74 atatat CTLTYPE_INT, "anonportmax",
1763 1.74 atatat SYSCTL_DESCR("Highest ephemeral port number to assign"),
1764 1.70 atatat sysctl_net_inet_ip_ports, 0, &ip6_anonportmax, 0,
1765 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1766 1.70 atatat IPV6CTL_ANONPORTMAX, CTL_EOL);
1767 1.26 itojun #ifndef IPNOPRIVPORTS
1768 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1769 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1770 1.74 atatat CTLTYPE_INT, "lowportmin",
1771 1.74 atatat SYSCTL_DESCR("Lowest privileged ephemeral port number "
1772 1.74 atatat "to assign"),
1773 1.70 atatat sysctl_net_inet_ip_ports, 0, &ip6_lowportmin, 0,
1774 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1775 1.70 atatat IPV6CTL_LOWPORTMIN, CTL_EOL);
1776 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1777 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1778 1.74 atatat CTLTYPE_INT, "lowportmax",
1779 1.74 atatat SYSCTL_DESCR("Highest privileged ephemeral port number "
1780 1.74 atatat "to assign"),
1781 1.70 atatat sysctl_net_inet_ip_ports, 0, &ip6_lowportmax, 0,
1782 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1783 1.70 atatat IPV6CTL_LOWPORTMAX, CTL_EOL);
1784 1.70 atatat #endif /* IPNOPRIVPORTS */
1785 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1786 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1787 1.153 christos CTLTYPE_INT, "auto_linklocal",
1788 1.153 christos SYSCTL_DESCR("Default value of per-interface flag for "
1789 1.153 christos "adding an IPv6 link-local address to "
1790 1.153 christos "interfaces when attached"),
1791 1.153 christos NULL, 0, &ip6_auto_linklocal, 0,
1792 1.153 christos CTL_NET, PF_INET6, IPPROTO_IPV6,
1793 1.153 christos IPV6CTL_AUTO_LINKLOCAL, CTL_EOL);
1794 1.153 christos sysctl_createv(clog, 0, NULL, NULL,
1795 1.153 christos CTLFLAG_PERMANENT|CTLFLAG_READONLY,
1796 1.153 christos CTLTYPE_STRUCT, "addctlpolicy",
1797 1.153 christos SYSCTL_DESCR("Return the current address control"
1798 1.153 christos " policy"),
1799 1.153 christos sysctl_net_inet6_addrctlpolicy, 0, NULL, 0,
1800 1.153 christos CTL_NET, PF_INET6, IPPROTO_IPV6,
1801 1.153 christos IPV6CTL_ADDRCTLPOLICY, CTL_EOL);
1802 1.153 christos sysctl_createv(clog, 0, NULL, NULL,
1803 1.153 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1804 1.83 rpaulo CTLTYPE_INT, "use_tempaddr",
1805 1.83 rpaulo SYSCTL_DESCR("Use temporary address"),
1806 1.83 rpaulo NULL, 0, &ip6_use_tempaddr, 0,
1807 1.83 rpaulo CTL_NET, PF_INET6, IPPROTO_IPV6,
1808 1.83 rpaulo CTL_CREATE, CTL_EOL);
1809 1.83 rpaulo sysctl_createv(clog, 0, NULL, NULL,
1810 1.83 rpaulo CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1811 1.150 roy CTLTYPE_INT, "prefer_tempaddr",
1812 1.150 roy SYSCTL_DESCR("Prefer temporary address as source "
1813 1.150 roy "address"),
1814 1.150 roy NULL, 0, &ip6_prefer_tempaddr, 0,
1815 1.150 roy CTL_NET, PF_INET6, IPPROTO_IPV6,
1816 1.150 roy CTL_CREATE, CTL_EOL);
1817 1.150 roy sysctl_createv(clog, 0, NULL, NULL,
1818 1.150 roy CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1819 1.83 rpaulo CTLTYPE_INT, "temppltime",
1820 1.83 rpaulo SYSCTL_DESCR("preferred lifetime of a temporary address"),
1821 1.83 rpaulo NULL, 0, &ip6_temp_preferred_lifetime, 0,
1822 1.83 rpaulo CTL_NET, PF_INET6, IPPROTO_IPV6,
1823 1.83 rpaulo CTL_CREATE, CTL_EOL);
1824 1.83 rpaulo sysctl_createv(clog, 0, NULL, NULL,
1825 1.83 rpaulo CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1826 1.83 rpaulo CTLTYPE_INT, "tempvltime",
1827 1.83 rpaulo SYSCTL_DESCR("valid lifetime of a temporary address"),
1828 1.83 rpaulo NULL, 0, &ip6_temp_valid_lifetime, 0,
1829 1.83 rpaulo CTL_NET, PF_INET6, IPPROTO_IPV6,
1830 1.83 rpaulo CTL_CREATE, CTL_EOL);
1831 1.83 rpaulo sysctl_createv(clog, 0, NULL, NULL,
1832 1.83 rpaulo CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1833 1.74 atatat CTLTYPE_INT, "maxfrags",
1834 1.74 atatat SYSCTL_DESCR("Maximum fragments in reassembly queue"),
1835 1.70 atatat NULL, 0, &ip6_maxfrags, 0,
1836 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1837 1.70 atatat IPV6CTL_MAXFRAGS, CTL_EOL);
1838 1.79 rpaulo sysctl_createv(clog, 0, NULL, NULL,
1839 1.79 rpaulo CTLFLAG_PERMANENT,
1840 1.79 rpaulo CTLTYPE_STRUCT, "stats",
1841 1.79 rpaulo SYSCTL_DESCR("IPv6 statistics"),
1842 1.116 thorpej sysctl_net_inet6_ip6_stats, 0, NULL, 0,
1843 1.79 rpaulo CTL_NET, PF_INET6, IPPROTO_IPV6,
1844 1.79 rpaulo IPV6CTL_STATS, CTL_EOL);
1845 1.81 rpaulo sysctl_createv(clog, 0, NULL, NULL,
1846 1.81 rpaulo CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1847 1.81 rpaulo CTLTYPE_INT, "use_defaultzone",
1848 1.81 rpaulo SYSCTL_DESCR("Whether to use the default scope zones"),
1849 1.81 rpaulo NULL, 0, &ip6_use_defzone, 0,
1850 1.81 rpaulo CTL_NET, PF_INET6, IPPROTO_IPV6,
1851 1.81 rpaulo IPV6CTL_USE_DEFAULTZONE, CTL_EOL);
1852 1.83 rpaulo sysctl_createv(clog, 0, NULL, NULL,
1853 1.83 rpaulo CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1854 1.83 rpaulo CTLTYPE_INT, "mcast_pmtu",
1855 1.83 rpaulo SYSCTL_DESCR("Enable pMTU discovery for multicast packet"),
1856 1.83 rpaulo NULL, 0, &ip6_mcast_pmtu, 0,
1857 1.83 rpaulo CTL_NET, PF_INET6, IPPROTO_IPV6,
1858 1.83 rpaulo CTL_CREATE, CTL_EOL);
1859 1.138 christos /* anonportalgo RFC6056 subtree */
1860 1.140 christos const struct sysctlnode *portalgo_node;
1861 1.140 christos sysctl_createv(clog, 0, NULL, &portalgo_node,
1862 1.138 christos CTLFLAG_PERMANENT,
1863 1.138 christos CTLTYPE_NODE, "anonportalgo",
1864 1.138 christos SYSCTL_DESCR("Anonymous port algorithm selection (RFC 6056)"),
1865 1.138 christos NULL, 0, NULL, 0,
1866 1.138 christos CTL_NET, PF_INET6, IPPROTO_IPV6, CTL_CREATE, CTL_EOL);
1867 1.140 christos sysctl_createv(clog, 0, &portalgo_node, NULL,
1868 1.138 christos CTLFLAG_PERMANENT,
1869 1.138 christos CTLTYPE_STRING, "available",
1870 1.138 christos SYSCTL_DESCR("available algorithms"),
1871 1.140 christos sysctl_portalgo_available, 0, NULL, PORTALGO_MAXLEN,
1872 1.138 christos CTL_CREATE, CTL_EOL);
1873 1.140 christos sysctl_createv(clog, 0, &portalgo_node, NULL,
1874 1.138 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1875 1.138 christos CTLTYPE_STRING, "selected",
1876 1.138 christos SYSCTL_DESCR("selected algorithm"),
1877 1.140 christos sysctl_portalgo_selected6, 0, NULL, PORTALGO_MAXLEN,
1878 1.138 christos CTL_CREATE, CTL_EOL);
1879 1.141 christos sysctl_createv(clog, 0, &portalgo_node, NULL,
1880 1.141 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1881 1.141 christos CTLTYPE_STRUCT, "reserve",
1882 1.141 christos SYSCTL_DESCR("bitmap of reserved ports"),
1883 1.141 christos sysctl_portalgo_reserve6, 0, NULL, 0,
1884 1.141 christos CTL_CREATE, CTL_EOL);
1885 1.139 christos sysctl_createv(clog, 0, NULL, NULL,
1886 1.139 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1887 1.139 christos CTLTYPE_INT, "neighborgcthresh",
1888 1.139 christos SYSCTL_DESCR("Maximum number of entries in neighbor"
1889 1.139 christos " cache"),
1890 1.139 christos NULL, 1, &ip6_neighborgcthresh, 0,
1891 1.139 christos CTL_NET, PF_INET6, IPPROTO_IPV6,
1892 1.139 christos CTL_CREATE, CTL_EOL);
1893 1.139 christos sysctl_createv(clog, 0, NULL, NULL,
1894 1.139 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1895 1.139 christos CTLTYPE_INT, "maxifprefixes",
1896 1.139 christos SYSCTL_DESCR("Maximum number of prefixes created by"
1897 1.139 christos " route advertisement per interface"),
1898 1.139 christos NULL, 1, &ip6_maxifprefixes, 0,
1899 1.139 christos CTL_NET, PF_INET6, IPPROTO_IPV6,
1900 1.139 christos CTL_CREATE, CTL_EOL);
1901 1.139 christos sysctl_createv(clog, 0, NULL, NULL,
1902 1.139 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1903 1.139 christos CTLTYPE_INT, "maxifdefrouters",
1904 1.139 christos SYSCTL_DESCR("Maximum number of default routers created"
1905 1.139 christos " by route advertisement per interface"),
1906 1.139 christos NULL, 1, &ip6_maxifdefrouters, 0,
1907 1.139 christos CTL_NET, PF_INET6, IPPROTO_IPV6,
1908 1.139 christos CTL_CREATE, CTL_EOL);
1909 1.139 christos sysctl_createv(clog, 0, NULL, NULL,
1910 1.139 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1911 1.139 christos CTLTYPE_INT, "maxdynroutes",
1912 1.139 christos SYSCTL_DESCR("Maximum number of routes created via"
1913 1.139 christos " redirect"),
1914 1.139 christos NULL, 1, &ip6_maxdynroutes, 0,
1915 1.139 christos CTL_NET, PF_INET6, IPPROTO_IPV6,
1916 1.139 christos CTL_CREATE, CTL_EOL);
1917 1.2 itojun }
1918 1.116 thorpej
1919 1.116 thorpej void
1920 1.116 thorpej ip6_statinc(u_int stat)
1921 1.116 thorpej {
1922 1.116 thorpej
1923 1.116 thorpej KASSERT(stat < IP6_NSTATS);
1924 1.116 thorpej IP6_STATINC(stat);
1925 1.116 thorpej }
1926