ip6_input.c revision 1.223 1 1.223 christos /* $NetBSD: ip6_input.c,v 1.223 2021/02/14 20:58:35 christos Exp $ */
2 1.40 itojun /* $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $ */
3 1.3 thorpej
4 1.2 itojun /*
5 1.2 itojun * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 1.2 itojun * All rights reserved.
7 1.21 itojun *
8 1.2 itojun * Redistribution and use in source and binary forms, with or without
9 1.2 itojun * modification, are permitted provided that the following conditions
10 1.2 itojun * are met:
11 1.2 itojun * 1. Redistributions of source code must retain the above copyright
12 1.2 itojun * notice, this list of conditions and the following disclaimer.
13 1.2 itojun * 2. Redistributions in binary form must reproduce the above copyright
14 1.2 itojun * notice, this list of conditions and the following disclaimer in the
15 1.2 itojun * documentation and/or other materials provided with the distribution.
16 1.2 itojun * 3. Neither the name of the project nor the names of its contributors
17 1.2 itojun * may be used to endorse or promote products derived from this software
18 1.2 itojun * without specific prior written permission.
19 1.21 itojun *
20 1.2 itojun * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 1.2 itojun * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 1.2 itojun * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 1.2 itojun * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 1.2 itojun * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 1.2 itojun * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 1.2 itojun * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 1.2 itojun * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 1.2 itojun * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 1.2 itojun * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 1.2 itojun * SUCH DAMAGE.
31 1.2 itojun */
32 1.2 itojun
33 1.2 itojun /*
34 1.2 itojun * Copyright (c) 1982, 1986, 1988, 1993
35 1.2 itojun * The Regents of the University of California. All rights reserved.
36 1.2 itojun *
37 1.2 itojun * Redistribution and use in source and binary forms, with or without
38 1.2 itojun * modification, are permitted provided that the following conditions
39 1.2 itojun * are met:
40 1.2 itojun * 1. Redistributions of source code must retain the above copyright
41 1.2 itojun * notice, this list of conditions and the following disclaimer.
42 1.2 itojun * 2. Redistributions in binary form must reproduce the above copyright
43 1.2 itojun * notice, this list of conditions and the following disclaimer in the
44 1.2 itojun * documentation and/or other materials provided with the distribution.
45 1.65 agc * 3. Neither the name of the University nor the names of its contributors
46 1.2 itojun * may be used to endorse or promote products derived from this software
47 1.2 itojun * without specific prior written permission.
48 1.2 itojun *
49 1.2 itojun * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50 1.2 itojun * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51 1.2 itojun * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52 1.2 itojun * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53 1.2 itojun * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54 1.2 itojun * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55 1.2 itojun * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 1.2 itojun * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 1.2 itojun * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58 1.2 itojun * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59 1.2 itojun * SUCH DAMAGE.
60 1.2 itojun *
61 1.2 itojun * @(#)ip_input.c 8.2 (Berkeley) 1/4/94
62 1.2 itojun */
63 1.48 lukem
64 1.48 lukem #include <sys/cdefs.h>
65 1.223 christos __KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.223 2021/02/14 20:58:35 christos Exp $");
66 1.2 itojun
67 1.152 pooka #ifdef _KERNEL_OPT
68 1.129 joerg #include "opt_gateway.h"
69 1.2 itojun #include "opt_inet.h"
70 1.85 rpaulo #include "opt_inet6.h"
71 1.4 thorpej #include "opt_ipsec.h"
72 1.169 ozaki #include "opt_net_mpsafe.h"
73 1.152 pooka #endif
74 1.2 itojun
75 1.2 itojun #include <sys/param.h>
76 1.2 itojun #include <sys/systm.h>
77 1.2 itojun #include <sys/mbuf.h>
78 1.2 itojun #include <sys/domain.h>
79 1.2 itojun #include <sys/protosw.h>
80 1.2 itojun #include <sys/socket.h>
81 1.2 itojun #include <sys/socketvar.h>
82 1.2 itojun #include <sys/errno.h>
83 1.2 itojun #include <sys/time.h>
84 1.2 itojun #include <sys/kernel.h>
85 1.2 itojun #include <sys/syslog.h>
86 1.2 itojun #include <sys/proc.h>
87 1.46 simonb #include <sys/sysctl.h>
88 1.133 tls #include <sys/cprng.h>
89 1.167 ozaki #include <sys/percpu.h>
90 1.2 itojun
91 1.2 itojun #include <net/if.h>
92 1.2 itojun #include <net/if_types.h>
93 1.2 itojun #include <net/if_dl.h>
94 1.2 itojun #include <net/route.h>
95 1.148 rmind #include <net/pktqueue.h>
96 1.15 darrenr #include <net/pfil.h>
97 1.2 itojun
98 1.2 itojun #include <netinet/in.h>
99 1.9 itojun #include <netinet/in_systm.h>
100 1.9 itojun #ifdef INET
101 1.9 itojun #include <netinet/ip.h>
102 1.148 rmind #include <netinet/ip_var.h>
103 1.9 itojun #include <netinet/ip_icmp.h>
104 1.45 itojun #endif /* INET */
105 1.14 itojun #include <netinet/ip6.h>
106 1.140 christos #include <netinet/portalgo.h>
107 1.2 itojun #include <netinet6/in6_var.h>
108 1.11 itojun #include <netinet6/ip6_var.h>
109 1.116 thorpej #include <netinet6/ip6_private.h>
110 1.2 itojun #include <netinet6/in6_pcb.h>
111 1.14 itojun #include <netinet/icmp6.h>
112 1.81 rpaulo #include <netinet6/scope6_var.h>
113 1.2 itojun #include <netinet6/in6_ifattach.h>
114 1.2 itojun #include <netinet6/nd6.h>
115 1.2 itojun
116 1.142 christos #ifdef IPSEC
117 1.94 degroote #include <netipsec/ipsec.h>
118 1.94 degroote #include <netipsec/ipsec6.h>
119 1.94 degroote #include <netipsec/key.h>
120 1.142 christos #endif /* IPSEC */
121 1.94 degroote
122 1.2 itojun #include <netinet6/ip6protosw.h>
123 1.2 itojun
124 1.2 itojun #include "faith.h"
125 1.2 itojun
126 1.2 itojun extern struct domain inet6domain;
127 1.2 itojun
128 1.2 itojun u_char ip6_protox[IPPROTO_MAX];
129 1.148 rmind pktqueue_t *ip6_pktq __read_mostly;
130 1.2 itojun
131 1.143 rmind pfil_head_t *inet6_pfil_hook;
132 1.29 thorpej
133 1.116 thorpej percpu_t *ip6stat_percpu;
134 1.2 itojun
135 1.167 ozaki percpu_t *ip6_forward_rt_percpu __cacheline_aligned;
136 1.167 ozaki
137 1.148 rmind static void ip6intr(void *);
138 1.217 maxv static void ip6_input(struct mbuf *, struct ifnet *);
139 1.199 maxv static bool ip6_badaddr(struct ip6_hdr *);
140 1.112 dyoung static struct m_tag *ip6_setdstifaddr(struct mbuf *, const struct in6_ifaddr *);
141 1.2 itojun
142 1.217 maxv static struct m_tag *ip6_addaux(struct mbuf *);
143 1.217 maxv static struct m_tag *ip6_findaux(struct mbuf *);
144 1.217 maxv static void ip6_delaux(struct mbuf *);
145 1.217 maxv
146 1.136 drochner static int ip6_process_hopopts(struct mbuf *, u_int8_t *, int, u_int32_t *,
147 1.189 maxv u_int32_t *);
148 1.111 dyoung static struct mbuf *ip6_pullexthdr(struct mbuf *, size_t, int);
149 1.128 pooka static void sysctl_net_inet6_ip6_setup(struct sysctllog **);
150 1.2 itojun
151 1.169 ozaki #ifdef NET_MPSAFE
152 1.169 ozaki #define SOFTNET_LOCK() mutex_enter(softnet_lock)
153 1.169 ozaki #define SOFTNET_UNLOCK() mutex_exit(softnet_lock)
154 1.169 ozaki #else
155 1.169 ozaki #define SOFTNET_LOCK() KASSERT(mutex_owned(softnet_lock))
156 1.169 ozaki #define SOFTNET_UNLOCK() KASSERT(mutex_owned(softnet_lock))
157 1.169 ozaki #endif
158 1.169 ozaki
159 1.218 roy /* Ensure that non packed structures are the desired size. */
160 1.218 roy __CTASSERT(sizeof(struct ip6_hdr) == 40);
161 1.218 roy __CTASSERT(sizeof(struct ip6_ext) == 2);
162 1.218 roy __CTASSERT(sizeof(struct ip6_hbh) == 2);
163 1.218 roy __CTASSERT(sizeof(struct ip6_dest) == 2);
164 1.218 roy __CTASSERT(sizeof(struct ip6_opt) == 2);
165 1.218 roy __CTASSERT(sizeof(struct ip6_opt_jumbo) == 6);
166 1.218 roy __CTASSERT(sizeof(struct ip6_opt_nsap) == 4);
167 1.218 roy __CTASSERT(sizeof(struct ip6_opt_tunnel) == 3);
168 1.218 roy __CTASSERT(sizeof(struct ip6_opt_router) == 4);
169 1.218 roy __CTASSERT(sizeof(struct ip6_rthdr) == 4);
170 1.218 roy __CTASSERT(sizeof(struct ip6_rthdr0) == 8);
171 1.218 roy __CTASSERT(sizeof(struct ip6_frag) == 8);
172 1.218 roy
173 1.2 itojun /*
174 1.2 itojun * IP6 initialization: fill in IP6 protocol switch table.
175 1.2 itojun * All protocols not implemented in kernel go to raw IP6 protocol handler.
176 1.2 itojun */
177 1.2 itojun void
178 1.114 matt ip6_init(void)
179 1.2 itojun {
180 1.78 christos const struct ip6protosw *pr;
181 1.35 itojun int i;
182 1.2 itojun
183 1.163 ozaki in6_init();
184 1.162 ozaki
185 1.128 pooka sysctl_net_inet6_ip6_setup(NULL);
186 1.78 christos pr = (const struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW);
187 1.2 itojun if (pr == 0)
188 1.2 itojun panic("ip6_init");
189 1.2 itojun for (i = 0; i < IPPROTO_MAX; i++)
190 1.2 itojun ip6_protox[i] = pr - inet6sw;
191 1.78 christos for (pr = (const struct ip6protosw *)inet6domain.dom_protosw;
192 1.78 christos pr < (const struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++)
193 1.2 itojun if (pr->pr_domain->dom_family == PF_INET6 &&
194 1.2 itojun pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
195 1.2 itojun ip6_protox[pr->pr_protocol] = pr - inet6sw;
196 1.148 rmind
197 1.149 ozaki ip6_pktq = pktq_create(IFQ_MAXLEN, ip6intr, NULL);
198 1.148 rmind KASSERT(ip6_pktq != NULL);
199 1.148 rmind
200 1.81 rpaulo scope6_init();
201 1.81 rpaulo addrsel_policy_init();
202 1.2 itojun nd6_init();
203 1.2 itojun frag6_init();
204 1.2 itojun
205 1.98 liamjfoy #ifdef GATEWAY
206 1.99 liamjfoy ip6flow_init(ip6_hashsize);
207 1.98 liamjfoy #endif
208 1.29 thorpej /* Register our Packet Filter hook. */
209 1.143 rmind inet6_pfil_hook = pfil_head_create(PFIL_TYPE_AF, (void *)AF_INET6);
210 1.143 rmind KASSERT(inet6_pfil_hook != NULL);
211 1.116 thorpej
212 1.116 thorpej ip6stat_percpu = percpu_alloc(sizeof(uint64_t) * IP6_NSTATS);
213 1.210 ozaki ip6_forward_rt_percpu = rtcache_percpu_alloc();
214 1.2 itojun }
215 1.2 itojun
216 1.2 itojun /*
217 1.2 itojun * IP6 input interrupt handling. Just pass the packet to ip6_input.
218 1.2 itojun */
219 1.148 rmind static void
220 1.148 rmind ip6intr(void *arg __unused)
221 1.2 itojun {
222 1.2 itojun struct mbuf *m;
223 1.2 itojun
224 1.193 ozaki SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
225 1.148 rmind while ((m = pktq_dequeue(ip6_pktq)) != NULL) {
226 1.160 ozaki struct psref psref;
227 1.160 ozaki struct ifnet *rcvif = m_get_rcvif_psref(m, &psref);
228 1.148 rmind
229 1.160 ozaki if (rcvif == NULL) {
230 1.222 ozaki IP6_STATINC(IP6_STAT_IFDROP);
231 1.160 ozaki m_freem(m);
232 1.160 ozaki continue;
233 1.160 ozaki }
234 1.148 rmind /*
235 1.148 rmind * Drop the packet if IPv6 is disabled on the interface.
236 1.148 rmind */
237 1.160 ozaki if ((ND_IFINFO(rcvif)->flags & ND6_IFF_IFDISABLED)) {
238 1.160 ozaki m_put_rcvif_psref(rcvif, &psref);
239 1.222 ozaki IP6_STATINC(IP6_STAT_IFDROP);
240 1.83 rpaulo m_freem(m);
241 1.148 rmind continue;
242 1.83 rpaulo }
243 1.160 ozaki ip6_input(m, rcvif);
244 1.160 ozaki m_put_rcvif_psref(rcvif, &psref);
245 1.2 itojun }
246 1.193 ozaki SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
247 1.2 itojun }
248 1.2 itojun
249 1.217 maxv static void
250 1.160 ozaki ip6_input(struct mbuf *m, struct ifnet *rcvif)
251 1.2 itojun {
252 1.9 itojun struct ip6_hdr *ip6;
253 1.105 dyoung int hit, off = sizeof(struct ip6_hdr), nest;
254 1.2 itojun u_int32_t plen;
255 1.5 itojun u_int32_t rtalert = ~0;
256 1.188 maxv int nxt, ours = 0, rh_present = 0, frg_present;
257 1.9 itojun struct ifnet *deliverifp = NULL;
258 1.64 itojun int srcrt = 0;
259 1.171 ozaki struct rtentry *rt = NULL;
260 1.105 dyoung union {
261 1.105 dyoung struct sockaddr dst;
262 1.105 dyoung struct sockaddr_in6 dst6;
263 1.105 dyoung } u;
264 1.167 ozaki struct route *ro;
265 1.2 itojun
266 1.186 maxv KASSERT(rcvif != NULL);
267 1.186 maxv
268 1.2 itojun /*
269 1.81 rpaulo * make sure we don't have onion peering information into m_tag.
270 1.81 rpaulo */
271 1.81 rpaulo ip6_delaux(m);
272 1.81 rpaulo
273 1.81 rpaulo /*
274 1.44 itojun * mbuf statistics
275 1.2 itojun */
276 1.2 itojun if (m->m_flags & M_EXT) {
277 1.2 itojun if (m->m_next)
278 1.116 thorpej IP6_STATINC(IP6_STAT_MEXT2M);
279 1.2 itojun else
280 1.116 thorpej IP6_STATINC(IP6_STAT_MEXT1);
281 1.2 itojun } else {
282 1.115 thorpej #define M2MMAX 32
283 1.2 itojun if (m->m_next) {
284 1.159 ozaki if (m->m_flags & M_LOOP)
285 1.116 thorpej /*XXX*/ IP6_STATINC(IP6_STAT_M2M + lo0ifp->if_index);
286 1.159 ozaki else if (rcvif->if_index < M2MMAX)
287 1.159 ozaki IP6_STATINC(IP6_STAT_M2M + rcvif->if_index);
288 1.159 ozaki else
289 1.116 thorpej IP6_STATINC(IP6_STAT_M2M);
290 1.2 itojun } else
291 1.116 thorpej IP6_STATINC(IP6_STAT_M1);
292 1.40 itojun #undef M2MMAX
293 1.2 itojun }
294 1.2 itojun
295 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_receive);
296 1.116 thorpej IP6_STATINC(IP6_STAT_TOTAL);
297 1.9 itojun
298 1.57 thorpej /*
299 1.57 thorpej * If the IPv6 header is not aligned, slurp it up into a new
300 1.57 thorpej * mbuf with space for link headers, in the event we forward
301 1.81 rpaulo * it. Otherwise, if it is aligned, make sure the entire base
302 1.57 thorpej * IPv6 header is in the first mbuf of the chain.
303 1.57 thorpej */
304 1.223 christos if (m_get_aligned_hdr(&m, IP6_HDR_ALIGNMENT, sizeof(*ip6), true) != 0) {
305 1.223 christos /* XXXJRT new stat, please */
306 1.223 christos IP6_STATINC(IP6_STAT_TOOSMALL);
307 1.223 christos in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
308 1.223 christos return;
309 1.2 itojun }
310 1.2 itojun
311 1.2 itojun ip6 = mtod(m, struct ip6_hdr *);
312 1.2 itojun
313 1.2 itojun if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
314 1.116 thorpej IP6_STATINC(IP6_STAT_BADVERS);
315 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
316 1.2 itojun goto bad;
317 1.2 itojun }
318 1.15 darrenr
319 1.199 maxv if (ip6_badaddr(ip6)) {
320 1.194 maxv IP6_STATINC(IP6_STAT_BADSCOPE);
321 1.194 maxv in6_ifstat_inc(rcvif, ifs6_in_addrerr);
322 1.194 maxv goto bad;
323 1.194 maxv }
324 1.194 maxv
325 1.194 maxv /*
326 1.98 liamjfoy * Assume that we can create a fast-forward IP flow entry
327 1.98 liamjfoy * based on this packet.
328 1.98 liamjfoy */
329 1.98 liamjfoy m->m_flags |= M_CANFASTFWD;
330 1.98 liamjfoy
331 1.15 darrenr /*
332 1.15 darrenr * Run through list of hooks for input packets. If there are any
333 1.15 darrenr * filters which require that additional packets in the flow are
334 1.15 darrenr * not fast-forwarded, they must clear the M_CANFASTFWD flag.
335 1.15 darrenr * Note that filters must _never_ set this flag, as another filter
336 1.15 darrenr * in the list may have previously cleared it.
337 1.196 maxv *
338 1.196 maxv * Don't call hooks if the packet has already been processed by
339 1.196 maxv * IPsec (encapsulated, tunnel mode).
340 1.39 itojun */
341 1.142 christos #if defined(IPSEC)
342 1.207 knakahar if (!ipsec_used || !ipsec_skip_pfil(m))
343 1.39 itojun #else
344 1.39 itojun if (1)
345 1.39 itojun #endif
346 1.39 itojun {
347 1.64 itojun struct in6_addr odst;
348 1.208 ozaki int error;
349 1.64 itojun
350 1.64 itojun odst = ip6->ip6_dst;
351 1.208 ozaki error = pfil_run_hooks(inet6_pfil_hook, &m, rcvif, PFIL_IN);
352 1.208 ozaki if (error != 0 || m == NULL) {
353 1.208 ozaki IP6_STATINC(IP6_STAT_PFILDROP_IN);
354 1.39 itojun return;
355 1.208 ozaki }
356 1.209 bouyer if (m->m_len < sizeof(struct ip6_hdr)) {
357 1.209 bouyer if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
358 1.209 bouyer IP6_STATINC(IP6_STAT_TOOSMALL);
359 1.209 bouyer in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
360 1.209 bouyer return;
361 1.209 bouyer }
362 1.209 bouyer }
363 1.39 itojun ip6 = mtod(m, struct ip6_hdr *);
364 1.64 itojun srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst);
365 1.39 itojun }
366 1.15 darrenr
367 1.116 thorpej IP6_STATINC(IP6_STAT_NXTHIST + ip6->ip6_nxt);
368 1.2 itojun
369 1.30 thorpej #ifdef ALTQ
370 1.169 ozaki if (altq_input != NULL) {
371 1.169 ozaki SOFTNET_LOCK();
372 1.169 ozaki if ((*altq_input)(m, AF_INET6) == 0) {
373 1.169 ozaki SOFTNET_UNLOCK();
374 1.169 ozaki /* packet is dropped by traffic conditioner */
375 1.169 ozaki return;
376 1.169 ozaki }
377 1.169 ozaki SOFTNET_UNLOCK();
378 1.9 itojun }
379 1.9 itojun #endif
380 1.9 itojun
381 1.2 itojun /*
382 1.82 yamt * Disambiguate address scope zones (if there is ambiguity).
383 1.82 yamt * We first make sure that the original source or destination address
384 1.82 yamt * is not in our internal form for scoped addresses. Such addresses
385 1.82 yamt * are not necessarily invalid spec-wise, but we cannot accept them due
386 1.82 yamt * to the usage conflict.
387 1.82 yamt * in6_setscope() then also checks and rejects the cases where src or
388 1.82 yamt * dst are the loopback address and the receiving interface
389 1.186 maxv * is not loopback.
390 1.82 yamt */
391 1.88 bouyer if (__predict_false(
392 1.222 ozaki m_makewritable(&m, 0, sizeof(struct ip6_hdr), M_DONTWAIT))) {
393 1.222 ozaki IP6_STATINC(IP6_STAT_IDROPPED);
394 1.88 bouyer goto bad;
395 1.222 ozaki }
396 1.88 bouyer ip6 = mtod(m, struct ip6_hdr *);
397 1.82 yamt if (in6_clearscope(&ip6->ip6_src) || in6_clearscope(&ip6->ip6_dst)) {
398 1.116 thorpej IP6_STATINC(IP6_STAT_BADSCOPE); /* XXX */
399 1.82 yamt goto bad;
400 1.82 yamt }
401 1.159 ozaki if (in6_setscope(&ip6->ip6_src, rcvif, NULL) ||
402 1.159 ozaki in6_setscope(&ip6->ip6_dst, rcvif, NULL)) {
403 1.116 thorpej IP6_STATINC(IP6_STAT_BADSCOPE);
404 1.82 yamt goto bad;
405 1.82 yamt }
406 1.82 yamt
407 1.211 ozaki ro = rtcache_percpu_getref(ip6_forward_rt_percpu);
408 1.186 maxv
409 1.82 yamt /*
410 1.2 itojun * Multicast check
411 1.2 itojun */
412 1.2 itojun if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
413 1.176 ozaki bool ingroup;
414 1.9 itojun
415 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_mcast);
416 1.2 itojun /*
417 1.2 itojun * See if we belong to the destination multicast group on the
418 1.2 itojun * arrival interface.
419 1.2 itojun */
420 1.176 ozaki ingroup = in6_multi_group(&ip6->ip6_dst, rcvif);
421 1.186 maxv if (ingroup) {
422 1.2 itojun ours = 1;
423 1.186 maxv } else if (!ip6_mrouter) {
424 1.116 thorpej uint64_t *ip6s = IP6_STAT_GETREF();
425 1.116 thorpej ip6s[IP6_STAT_NOTMEMBER]++;
426 1.116 thorpej ip6s[IP6_STAT_CANTFORWARD]++;
427 1.116 thorpej IP6_STAT_PUTREF();
428 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_discard);
429 1.171 ozaki goto bad_unref;
430 1.2 itojun }
431 1.159 ozaki deliverifp = rcvif;
432 1.2 itojun goto hbhcheck;
433 1.2 itojun }
434 1.2 itojun
435 1.105 dyoung sockaddr_in6_init(&u.dst6, &ip6->ip6_dst, 0, 0, 0);
436 1.105 dyoung
437 1.2 itojun /*
438 1.186 maxv * Unicast check
439 1.2 itojun */
440 1.167 ozaki rt = rtcache_lookup2(ro, &u.dst, 1, &hit);
441 1.105 dyoung if (hit)
442 1.116 thorpej IP6_STATINC(IP6_STAT_FORWARD_CACHEHIT);
443 1.93 joerg else
444 1.116 thorpej IP6_STATINC(IP6_STAT_FORWARD_CACHEMISS);
445 1.22 itojun
446 1.2 itojun /*
447 1.2 itojun * Accept the packet if the forwarding interface to the destination
448 1.186 maxv * (according to the routing table) is the loopback interface,
449 1.2 itojun * unless the associated route has a gateway.
450 1.186 maxv *
451 1.186 maxv * We don't explicitly match ip6_dst against an interface here. It
452 1.186 maxv * is already done in rtcache_lookup2: rt->rt_ifp->if_type will be
453 1.186 maxv * IFT_LOOP if the packet is for us.
454 1.186 maxv *
455 1.2 itojun * Note that this approach causes to accept a packet if there is a
456 1.2 itojun * route to the loopback interface for the destination of the packet.
457 1.2 itojun * But we think it's even useful in some situations, e.g. when using
458 1.2 itojun * a special daemon which wants to intercept the packet.
459 1.2 itojun */
460 1.105 dyoung if (rt != NULL &&
461 1.105 dyoung (rt->rt_flags & (RTF_HOST|RTF_GATEWAY)) == RTF_HOST &&
462 1.105 dyoung rt->rt_ifp->if_type == IFT_LOOP) {
463 1.105 dyoung struct in6_ifaddr *ia6 = (struct in6_ifaddr *)rt->rt_ifa;
464 1.184 roy int addrok;
465 1.184 roy
466 1.2 itojun if (ia6->ia6_flags & IN6_IFF_ANYCAST)
467 1.2 itojun m->m_flags |= M_ANYCAST6;
468 1.24 itojun /*
469 1.24 itojun * packets to a tentative, duplicated, or somehow invalid
470 1.24 itojun * address must not be accepted.
471 1.24 itojun */
472 1.184 roy if (ia6->ia6_flags & IN6_IFF_NOTREADY)
473 1.184 roy addrok = 0;
474 1.184 roy else if (ia6->ia6_flags & IN6_IFF_DETACHED &&
475 1.184 roy !IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src))
476 1.184 roy {
477 1.184 roy /* Allow internal traffic to DETACHED addresses */
478 1.184 roy struct sockaddr_in6 sin6;
479 1.184 roy int s;
480 1.184 roy
481 1.184 roy memset(&sin6, 0, sizeof(sin6));
482 1.184 roy sin6.sin6_family = AF_INET6;
483 1.184 roy sin6.sin6_len = sizeof(sin6);
484 1.184 roy sin6.sin6_addr = ip6->ip6_src;
485 1.184 roy s = pserialize_read_enter();
486 1.184 roy addrok = (ifa_ifwithaddr(sin6tosa(&sin6)) != NULL);
487 1.184 roy pserialize_read_exit(s);
488 1.184 roy } else
489 1.185 kre addrok = 1;
490 1.184 roy if (addrok) {
491 1.24 itojun /* this address is ready */
492 1.2 itojun ours = 1;
493 1.9 itojun deliverifp = ia6->ia_ifp; /* correct? */
494 1.2 itojun goto hbhcheck;
495 1.2 itojun } else {
496 1.24 itojun /* address is not ready, so discard the packet. */
497 1.172 ryo char ip6bufs[INET6_ADDRSTRLEN];
498 1.172 ryo char ip6bufd[INET6_ADDRSTRLEN];
499 1.157 ozaki nd6log(LOG_INFO, "packet to an unready address %s->%s\n",
500 1.173 christos IN6_PRINT(ip6bufs, &ip6->ip6_src),
501 1.173 christos IN6_PRINT(ip6bufd, &ip6->ip6_dst));
502 1.24 itojun
503 1.222 ozaki IP6_STATINC(IP6_STAT_IDROPPED);
504 1.171 ozaki goto bad_unref;
505 1.2 itojun }
506 1.2 itojun }
507 1.2 itojun
508 1.2 itojun /*
509 1.55 itojun * FAITH (Firewall Aided Internet Translator)
510 1.2 itojun */
511 1.2 itojun #if defined(NFAITH) && 0 < NFAITH
512 1.2 itojun if (ip6_keepfaith) {
513 1.105 dyoung if (rt != NULL && rt->rt_ifp != NULL &&
514 1.105 dyoung rt->rt_ifp->if_type == IFT_FAITH) {
515 1.2 itojun /* XXX do we need more sanity checks? */
516 1.2 itojun ours = 1;
517 1.105 dyoung deliverifp = rt->rt_ifp; /* faith */
518 1.9 itojun goto hbhcheck;
519 1.9 itojun }
520 1.9 itojun }
521 1.9 itojun #endif
522 1.9 itojun
523 1.2 itojun /*
524 1.2 itojun * Now there is no reason to process the packet if it's not our own
525 1.2 itojun * and we're not a router.
526 1.2 itojun */
527 1.2 itojun if (!ip6_forwarding) {
528 1.116 thorpej IP6_STATINC(IP6_STAT_CANTFORWARD);
529 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_discard);
530 1.171 ozaki goto bad_unref;
531 1.2 itojun }
532 1.2 itojun
533 1.186 maxv hbhcheck:
534 1.2 itojun /*
535 1.186 maxv * Record address information into m_tag, if we don't have one yet.
536 1.186 maxv * Note that we are unable to record it, if the address is not listed
537 1.81 rpaulo * as our interface address (e.g. multicast addresses, addresses
538 1.81 rpaulo * within FAITH prefixes and such).
539 1.81 rpaulo */
540 1.111 dyoung if (deliverifp && ip6_getdstifaddr(m) == NULL) {
541 1.81 rpaulo struct in6_ifaddr *ia6;
542 1.165 ozaki int s = pserialize_read_enter();
543 1.81 rpaulo
544 1.81 rpaulo ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
545 1.165 ozaki /* Depends on ip6_setdstifaddr never sleep */
546 1.111 dyoung if (ia6 != NULL && ip6_setdstifaddr(m, ia6) == NULL) {
547 1.111 dyoung /*
548 1.111 dyoung * XXX maybe we should drop the packet here,
549 1.111 dyoung * as we could not provide enough information
550 1.111 dyoung * to the upper layers.
551 1.111 dyoung */
552 1.81 rpaulo }
553 1.165 ozaki pserialize_read_exit(s);
554 1.81 rpaulo }
555 1.81 rpaulo
556 1.81 rpaulo /*
557 1.2 itojun * Process Hop-by-Hop options header if it's contained.
558 1.2 itojun * m may be modified in ip6_hopopts_input().
559 1.2 itojun * If a JumboPayload option is included, plen will also be modified.
560 1.2 itojun */
561 1.2 itojun plen = (u_int32_t)ntohs(ip6->ip6_plen);
562 1.2 itojun if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
563 1.9 itojun struct ip6_hbh *hbh;
564 1.9 itojun
565 1.9 itojun if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) {
566 1.186 maxv /* m already freed */
567 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_discard);
568 1.171 ozaki rtcache_unref(rt, ro);
569 1.211 ozaki rtcache_percpu_putref(ip6_forward_rt_percpu);
570 1.186 maxv return;
571 1.9 itojun }
572 1.22 itojun
573 1.2 itojun /* adjust pointer */
574 1.2 itojun ip6 = mtod(m, struct ip6_hdr *);
575 1.22 itojun
576 1.22 itojun /*
577 1.49 itojun * if the payload length field is 0 and the next header field
578 1.22 itojun * indicates Hop-by-Hop Options header, then a Jumbo Payload
579 1.22 itojun * option MUST be included.
580 1.22 itojun */
581 1.22 itojun if (ip6->ip6_plen == 0 && plen == 0) {
582 1.22 itojun /*
583 1.22 itojun * Note that if a valid jumbo payload option is
584 1.83 rpaulo * contained, ip6_hopopts_input() must set a valid
585 1.55 itojun * (non-zero) payload length to the variable plen.
586 1.22 itojun */
587 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
588 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_discard);
589 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
590 1.22 itojun icmp6_error(m, ICMP6_PARAM_PROB,
591 1.22 itojun ICMP6_PARAMPROB_HEADER,
592 1.97 christos (char *)&ip6->ip6_plen - (char *)ip6);
593 1.171 ozaki rtcache_unref(rt, ro);
594 1.210 ozaki rtcache_percpu_putref(ip6_forward_rt_percpu);
595 1.22 itojun return;
596 1.22 itojun }
597 1.9 itojun IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
598 1.9 itojun sizeof(struct ip6_hbh));
599 1.9 itojun if (hbh == NULL) {
600 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
601 1.171 ozaki rtcache_unref(rt, ro);
602 1.210 ozaki rtcache_percpu_putref(ip6_forward_rt_percpu);
603 1.9 itojun return;
604 1.9 itojun }
605 1.223 christos KASSERT(POINTER_ALIGNED_P(hbh, IP6_HDR_ALIGNMENT));
606 1.9 itojun nxt = hbh->ip6h_nxt;
607 1.2 itojun
608 1.2 itojun /*
609 1.2 itojun * accept the packet if a router alert option is included
610 1.2 itojun * and we act as an IPv6 router.
611 1.2 itojun */
612 1.5 itojun if (rtalert != ~0 && ip6_forwarding)
613 1.2 itojun ours = 1;
614 1.2 itojun } else
615 1.2 itojun nxt = ip6->ip6_nxt;
616 1.2 itojun
617 1.2 itojun /*
618 1.186 maxv * Check that the amount of data in the buffers is at least much as
619 1.186 maxv * the IPv6 header would have us expect. Trim mbufs if longer than we
620 1.186 maxv * expect. Drop packet if shorter than we expect.
621 1.2 itojun */
622 1.2 itojun if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
623 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
624 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_truncated);
625 1.171 ozaki goto bad_unref;
626 1.2 itojun }
627 1.2 itojun if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
628 1.2 itojun if (m->m_len == m->m_pkthdr.len) {
629 1.2 itojun m->m_len = sizeof(struct ip6_hdr) + plen;
630 1.2 itojun m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
631 1.2 itojun } else
632 1.2 itojun m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len);
633 1.2 itojun }
634 1.2 itojun
635 1.2 itojun /*
636 1.2 itojun * Forward if desirable.
637 1.2 itojun */
638 1.2 itojun if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
639 1.2 itojun /*
640 1.2 itojun * If we are acting as a multicast router, all
641 1.2 itojun * incoming multicast packets are passed to the
642 1.2 itojun * kernel-level multicast forwarding function.
643 1.2 itojun * The packet is returned (relatively) intact; if
644 1.2 itojun * ip6_mforward() returns a non-zero value, the packet
645 1.2 itojun * must be discarded, else it may be accepted below.
646 1.2 itojun */
647 1.169 ozaki if (ip6_mrouter != NULL) {
648 1.169 ozaki int error;
649 1.169 ozaki
650 1.169 ozaki SOFTNET_LOCK();
651 1.169 ozaki error = ip6_mforward(ip6, rcvif, m);
652 1.169 ozaki SOFTNET_UNLOCK();
653 1.169 ozaki
654 1.169 ozaki if (error != 0) {
655 1.171 ozaki rtcache_unref(rt, ro);
656 1.210 ozaki rtcache_percpu_putref(ip6_forward_rt_percpu);
657 1.169 ozaki IP6_STATINC(IP6_STAT_CANTFORWARD);
658 1.170 ozaki goto bad;
659 1.169 ozaki }
660 1.2 itojun }
661 1.222 ozaki if (!ours) {
662 1.222 ozaki IP6_STATINC(IP6_STAT_CANTFORWARD);
663 1.171 ozaki goto bad_unref;
664 1.222 ozaki }
665 1.22 itojun } else if (!ours) {
666 1.171 ozaki rtcache_unref(rt, ro);
667 1.210 ozaki rtcache_percpu_putref(ip6_forward_rt_percpu);
668 1.221 ozaki ip6_forward(m, srcrt, rcvif);
669 1.2 itojun return;
670 1.56 itojun }
671 1.25 itojun
672 1.25 itojun ip6 = mtod(m, struct ip6_hdr *);
673 1.25 itojun
674 1.25 itojun /*
675 1.25 itojun * Malicious party may be able to use IPv4 mapped addr to confuse
676 1.25 itojun * tcp/udp stack and bypass security checks (act as if it was from
677 1.25 itojun * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious.
678 1.25 itojun *
679 1.25 itojun * For SIIT end node behavior, you may want to disable the check.
680 1.25 itojun * However, you will become vulnerable to attacks using IPv4 mapped
681 1.25 itojun * source.
682 1.25 itojun */
683 1.25 itojun if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
684 1.25 itojun IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
685 1.116 thorpej IP6_STATINC(IP6_STAT_BADSCOPE);
686 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_addrerr);
687 1.171 ozaki goto bad_unref;
688 1.25 itojun }
689 1.2 itojun
690 1.12 itojun #ifdef IFA_STATS
691 1.28 itojun if (deliverifp != NULL) {
692 1.9 itojun struct in6_ifaddr *ia6;
693 1.165 ozaki int s = pserialize_read_enter();
694 1.9 itojun ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
695 1.9 itojun if (ia6)
696 1.9 itojun ia6->ia_ifa.ifa_data.ifad_inbytes += m->m_pkthdr.len;
697 1.165 ozaki pserialize_read_exit(s);
698 1.9 itojun }
699 1.9 itojun #endif
700 1.116 thorpej IP6_STATINC(IP6_STAT_DELIVERED);
701 1.9 itojun in6_ifstat_inc(deliverifp, ifs6_in_deliver);
702 1.2 itojun nest = 0;
703 1.40 itojun
704 1.171 ozaki if (rt != NULL) {
705 1.171 ozaki rtcache_unref(rt, ro);
706 1.171 ozaki rt = NULL;
707 1.171 ozaki }
708 1.210 ozaki rtcache_percpu_putref(ip6_forward_rt_percpu);
709 1.171 ozaki
710 1.104 yamt rh_present = 0;
711 1.188 maxv frg_present = 0;
712 1.2 itojun while (nxt != IPPROTO_DONE) {
713 1.2 itojun if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
714 1.116 thorpej IP6_STATINC(IP6_STAT_TOOMANYHDR);
715 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
716 1.2 itojun goto bad;
717 1.2 itojun }
718 1.8 itojun
719 1.197 maxv M_VERIFY_PACKET(m);
720 1.197 maxv
721 1.8 itojun /*
722 1.8 itojun * protection against faulty packet - there should be
723 1.8 itojun * more sanity checks in header chain processing.
724 1.8 itojun */
725 1.8 itojun if (m->m_pkthdr.len < off) {
726 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
727 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_truncated);
728 1.8 itojun goto bad;
729 1.8 itojun }
730 1.8 itojun
731 1.104 yamt if (nxt == IPPROTO_ROUTING) {
732 1.104 yamt if (rh_present++) {
733 1.159 ozaki in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
734 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
735 1.104 yamt goto bad;
736 1.104 yamt }
737 1.188 maxv } else if (nxt == IPPROTO_FRAGMENT) {
738 1.188 maxv if (frg_present++) {
739 1.188 maxv in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
740 1.188 maxv IP6_STATINC(IP6_STAT_BADOPTIONS);
741 1.188 maxv goto bad;
742 1.188 maxv }
743 1.104 yamt }
744 1.104 yamt
745 1.142 christos #ifdef IPSEC
746 1.146 christos if (ipsec_used) {
747 1.94 degroote /*
748 1.186 maxv * Enforce IPsec policy checking if we are seeing last
749 1.186 maxv * header. Note that we do not visit this with
750 1.146 christos * protocols with pcb layer code - like udp/tcp/raw ip.
751 1.94 degroote */
752 1.206 maxv if ((inet6sw[ip6_protox[nxt]].pr_flags
753 1.146 christos & PR_LASTHDR) != 0) {
754 1.169 ozaki int error;
755 1.169 ozaki
756 1.220 ozaki error = ipsec_ip_input_checkpolicy(m, false);
757 1.219 ozaki if (error) {
758 1.219 ozaki IP6_STATINC(IP6_STAT_IPSECDROP_IN);
759 1.146 christos goto bad;
760 1.219 ozaki }
761 1.146 christos }
762 1.94 degroote }
763 1.186 maxv #endif
764 1.94 degroote
765 1.2 itojun nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt);
766 1.2 itojun }
767 1.2 itojun return;
768 1.171 ozaki
769 1.186 maxv bad_unref:
770 1.171 ozaki rtcache_unref(rt, ro);
771 1.211 ozaki rtcache_percpu_putref(ip6_forward_rt_percpu);
772 1.186 maxv bad:
773 1.2 itojun m_freem(m);
774 1.171 ozaki return;
775 1.2 itojun }
776 1.2 itojun
777 1.199 maxv static bool
778 1.199 maxv ip6_badaddr(struct ip6_hdr *ip6)
779 1.199 maxv {
780 1.199 maxv /* Check against address spoofing/corruption. */
781 1.199 maxv if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) ||
782 1.199 maxv IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) {
783 1.199 maxv return true;
784 1.199 maxv }
785 1.199 maxv
786 1.199 maxv /*
787 1.199 maxv * The following check is not documented in specs. A malicious
788 1.199 maxv * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
789 1.199 maxv * and bypass security checks (act as if it was from 127.0.0.1 by using
790 1.199 maxv * IPv6 src ::ffff:127.0.0.1). Be cautious.
791 1.199 maxv *
792 1.199 maxv * This check chokes if we are in an SIIT cloud. As none of BSDs
793 1.199 maxv * support IPv4-less kernel compilation, we cannot support SIIT
794 1.199 maxv * environment at all. So, it makes more sense for us to reject any
795 1.199 maxv * malicious packets for non-SIIT environment, than try to do a
796 1.199 maxv * partial support for SIIT environment.
797 1.199 maxv */
798 1.199 maxv if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
799 1.199 maxv IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
800 1.199 maxv return true;
801 1.199 maxv }
802 1.199 maxv
803 1.199 maxv /*
804 1.199 maxv * Reject packets with IPv4-compatible IPv6 addresses (RFC4291).
805 1.199 maxv */
806 1.199 maxv if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) ||
807 1.199 maxv IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) {
808 1.199 maxv return true;
809 1.199 maxv }
810 1.199 maxv
811 1.199 maxv return false;
812 1.199 maxv }
813 1.199 maxv
814 1.2 itojun /*
815 1.81 rpaulo * set/grab in6_ifaddr correspond to IPv6 destination address.
816 1.81 rpaulo */
817 1.81 rpaulo static struct m_tag *
818 1.112 dyoung ip6_setdstifaddr(struct mbuf *m, const struct in6_ifaddr *ia)
819 1.81 rpaulo {
820 1.81 rpaulo struct m_tag *mtag;
821 1.144 christos struct ip6aux *ip6a;
822 1.81 rpaulo
823 1.81 rpaulo mtag = ip6_addaux(m);
824 1.144 christos if (mtag == NULL)
825 1.144 christos return NULL;
826 1.112 dyoung
827 1.144 christos ip6a = (struct ip6aux *)(mtag + 1);
828 1.144 christos if (in6_setscope(&ip6a->ip6a_src, ia->ia_ifp, &ip6a->ip6a_scope_id)) {
829 1.144 christos IP6_STATINC(IP6_STAT_BADSCOPE);
830 1.144 christos return NULL;
831 1.112 dyoung }
832 1.144 christos
833 1.144 christos ip6a->ip6a_src = ia->ia_addr.sin6_addr;
834 1.144 christos ip6a->ip6a_flags = ia->ia6_flags;
835 1.144 christos return mtag;
836 1.81 rpaulo }
837 1.81 rpaulo
838 1.112 dyoung const struct ip6aux *
839 1.107 christos ip6_getdstifaddr(struct mbuf *m)
840 1.81 rpaulo {
841 1.81 rpaulo struct m_tag *mtag;
842 1.81 rpaulo
843 1.81 rpaulo mtag = ip6_findaux(m);
844 1.112 dyoung if (mtag != NULL)
845 1.112 dyoung return (struct ip6aux *)(mtag + 1);
846 1.81 rpaulo else
847 1.81 rpaulo return NULL;
848 1.81 rpaulo }
849 1.81 rpaulo
850 1.81 rpaulo /*
851 1.2 itojun * Hop-by-Hop options header processing. If a valid jumbo payload option is
852 1.2 itojun * included, the real payload length will be stored in plenp.
853 1.107 christos *
854 1.107 christos * rtalertp - XXX: should be stored more smart way
855 1.2 itojun */
856 1.136 drochner int
857 1.107 christos ip6_hopopts_input(u_int32_t *plenp, u_int32_t *rtalertp,
858 1.107 christos struct mbuf **mp, int *offp)
859 1.2 itojun {
860 1.35 itojun struct mbuf *m = *mp;
861 1.2 itojun int off = *offp, hbhlen;
862 1.2 itojun struct ip6_hbh *hbh;
863 1.2 itojun
864 1.2 itojun /* validation of the length of the header */
865 1.9 itojun IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m,
866 1.189 maxv sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
867 1.9 itojun if (hbh == NULL) {
868 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
869 1.9 itojun return -1;
870 1.9 itojun }
871 1.9 itojun hbhlen = (hbh->ip6h_len + 1) << 3;
872 1.9 itojun IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
873 1.189 maxv hbhlen);
874 1.9 itojun if (hbh == NULL) {
875 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
876 1.9 itojun return -1;
877 1.9 itojun }
878 1.223 christos KASSERT(POINTER_ALIGNED_P(hbh, IP6_HDR_ALIGNMENT));
879 1.2 itojun off += hbhlen;
880 1.2 itojun hbhlen -= sizeof(struct ip6_hbh);
881 1.2 itojun
882 1.2 itojun if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
883 1.189 maxv hbhlen, rtalertp, plenp) < 0)
884 1.189 maxv return -1;
885 1.2 itojun
886 1.2 itojun *offp = off;
887 1.2 itojun *mp = m;
888 1.189 maxv return 0;
889 1.2 itojun }
890 1.2 itojun
891 1.2 itojun /*
892 1.2 itojun * Search header for all Hop-by-hop options and process each option.
893 1.2 itojun * This function is separate from ip6_hopopts_input() in order to
894 1.2 itojun * handle a case where the sending node itself process its hop-by-hop
895 1.2 itojun * options header. In such a case, the function is called from ip6_output().
896 1.55 itojun *
897 1.55 itojun * The function assumes that hbh header is located right after the IPv6 header
898 1.55 itojun * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
899 1.55 itojun * opthead + hbhlen is located in continuous memory region.
900 1.2 itojun */
901 1.136 drochner static int
902 1.107 christos ip6_process_hopopts(struct mbuf *m, u_int8_t *opthead, int hbhlen,
903 1.107 christos u_int32_t *rtalertp, u_int32_t *plenp)
904 1.2 itojun {
905 1.2 itojun struct ip6_hdr *ip6;
906 1.2 itojun int optlen = 0;
907 1.2 itojun u_int8_t *opt = opthead;
908 1.2 itojun u_int16_t rtalert_val;
909 1.22 itojun u_int32_t jumboplen;
910 1.55 itojun const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh);
911 1.2 itojun
912 1.2 itojun for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) {
913 1.35 itojun switch (*opt) {
914 1.35 itojun case IP6OPT_PAD1:
915 1.35 itojun optlen = 1;
916 1.35 itojun break;
917 1.35 itojun case IP6OPT_PADN:
918 1.35 itojun if (hbhlen < IP6OPT_MINLEN) {
919 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSMALL);
920 1.35 itojun goto bad;
921 1.35 itojun }
922 1.35 itojun optlen = *(opt + 1) + 2;
923 1.35 itojun break;
924 1.35 itojun case IP6OPT_RTALERT:
925 1.35 itojun /* XXX may need check for alignment */
926 1.35 itojun if (hbhlen < IP6OPT_RTALERT_LEN) {
927 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSMALL);
928 1.35 itojun goto bad;
929 1.35 itojun }
930 1.35 itojun if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) {
931 1.222 ozaki IP6_STATINC(IP6_STAT_BADOPTIONS);
932 1.55 itojun icmp6_error(m, ICMP6_PARAM_PROB,
933 1.55 itojun ICMP6_PARAMPROB_HEADER,
934 1.55 itojun erroff + opt + 1 - opthead);
935 1.55 itojun return (-1);
936 1.35 itojun }
937 1.35 itojun optlen = IP6OPT_RTALERT_LEN;
938 1.126 tsutsui memcpy((void *)&rtalert_val, (void *)(opt + 2), 2);
939 1.35 itojun *rtalertp = ntohs(rtalert_val);
940 1.35 itojun break;
941 1.35 itojun case IP6OPT_JUMBO:
942 1.22 itojun /* XXX may need check for alignment */
943 1.22 itojun if (hbhlen < IP6OPT_JUMBO_LEN) {
944 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSMALL);
945 1.22 itojun goto bad;
946 1.22 itojun }
947 1.35 itojun if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) {
948 1.222 ozaki IP6_STATINC(IP6_STAT_BADOPTIONS);
949 1.55 itojun icmp6_error(m, ICMP6_PARAM_PROB,
950 1.55 itojun ICMP6_PARAMPROB_HEADER,
951 1.55 itojun erroff + opt + 1 - opthead);
952 1.55 itojun return (-1);
953 1.35 itojun }
954 1.22 itojun optlen = IP6OPT_JUMBO_LEN;
955 1.22 itojun
956 1.22 itojun /*
957 1.22 itojun * IPv6 packets that have non 0 payload length
958 1.35 itojun * must not contain a jumbo payload option.
959 1.22 itojun */
960 1.22 itojun ip6 = mtod(m, struct ip6_hdr *);
961 1.22 itojun if (ip6->ip6_plen) {
962 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
963 1.22 itojun icmp6_error(m, ICMP6_PARAM_PROB,
964 1.55 itojun ICMP6_PARAMPROB_HEADER,
965 1.55 itojun erroff + opt - opthead);
966 1.55 itojun return (-1);
967 1.22 itojun }
968 1.2 itojun
969 1.22 itojun /*
970 1.22 itojun * We may see jumbolen in unaligned location, so
971 1.191 maxv * we'd need to perform memcpy().
972 1.22 itojun */
973 1.126 tsutsui memcpy(&jumboplen, opt + 2, sizeof(jumboplen));
974 1.22 itojun jumboplen = (u_int32_t)htonl(jumboplen);
975 1.22 itojun
976 1.22 itojun #if 1
977 1.22 itojun /*
978 1.22 itojun * if there are multiple jumbo payload options,
979 1.22 itojun * *plenp will be non-zero and the packet will be
980 1.22 itojun * rejected.
981 1.22 itojun * the behavior may need some debate in ipngwg -
982 1.22 itojun * multiple options does not make sense, however,
983 1.22 itojun * there's no explicit mention in specification.
984 1.22 itojun */
985 1.22 itojun if (*plenp != 0) {
986 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
987 1.22 itojun icmp6_error(m, ICMP6_PARAM_PROB,
988 1.55 itojun ICMP6_PARAMPROB_HEADER,
989 1.55 itojun erroff + opt + 2 - opthead);
990 1.55 itojun return (-1);
991 1.22 itojun }
992 1.8 itojun #endif
993 1.2 itojun
994 1.22 itojun /*
995 1.22 itojun * jumbo payload length must be larger than 65535.
996 1.22 itojun */
997 1.22 itojun if (jumboplen <= IPV6_MAXPACKET) {
998 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
999 1.22 itojun icmp6_error(m, ICMP6_PARAM_PROB,
1000 1.55 itojun ICMP6_PARAMPROB_HEADER,
1001 1.55 itojun erroff + opt + 2 - opthead);
1002 1.55 itojun return (-1);
1003 1.22 itojun }
1004 1.22 itojun *plenp = jumboplen;
1005 1.22 itojun
1006 1.22 itojun break;
1007 1.35 itojun default: /* unknown option */
1008 1.35 itojun if (hbhlen < IP6OPT_MINLEN) {
1009 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSMALL);
1010 1.35 itojun goto bad;
1011 1.35 itojun }
1012 1.55 itojun optlen = ip6_unknown_opt(opt, m,
1013 1.55 itojun erroff + opt - opthead);
1014 1.55 itojun if (optlen == -1)
1015 1.55 itojun return (-1);
1016 1.35 itojun optlen += 2;
1017 1.35 itojun break;
1018 1.2 itojun }
1019 1.2 itojun }
1020 1.2 itojun
1021 1.55 itojun return (0);
1022 1.2 itojun
1023 1.2 itojun bad:
1024 1.2 itojun m_freem(m);
1025 1.55 itojun return (-1);
1026 1.2 itojun }
1027 1.2 itojun
1028 1.2 itojun /*
1029 1.2 itojun * Unknown option processing.
1030 1.2 itojun * The third argument `off' is the offset from the IPv6 header to the option,
1031 1.2 itojun * which is necessary if the IPv6 header the and option header and IPv6 header
1032 1.2 itojun * is not continuous in order to return an ICMPv6 error.
1033 1.2 itojun */
1034 1.2 itojun int
1035 1.107 christos ip6_unknown_opt(u_int8_t *optp, struct mbuf *m, int off)
1036 1.2 itojun {
1037 1.2 itojun struct ip6_hdr *ip6;
1038 1.2 itojun
1039 1.35 itojun switch (IP6OPT_TYPE(*optp)) {
1040 1.35 itojun case IP6OPT_TYPE_SKIP: /* ignore the option */
1041 1.58 itojun return ((int)*(optp + 1));
1042 1.35 itojun case IP6OPT_TYPE_DISCARD: /* silently discard */
1043 1.35 itojun m_freem(m);
1044 1.58 itojun return (-1);
1045 1.35 itojun case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */
1046 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
1047 1.35 itojun icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off);
1048 1.58 itojun return (-1);
1049 1.35 itojun case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */
1050 1.116 thorpej IP6_STATINC(IP6_STAT_BADOPTIONS);
1051 1.35 itojun ip6 = mtod(m, struct ip6_hdr *);
1052 1.35 itojun if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
1053 1.35 itojun (m->m_flags & (M_BCAST|M_MCAST)))
1054 1.35 itojun m_freem(m);
1055 1.35 itojun else
1056 1.35 itojun icmp6_error(m, ICMP6_PARAM_PROB,
1057 1.35 itojun ICMP6_PARAMPROB_OPTION, off);
1058 1.58 itojun return (-1);
1059 1.2 itojun }
1060 1.2 itojun
1061 1.2 itojun m_freem(m); /* XXX: NOTREACHED */
1062 1.58 itojun return (-1);
1063 1.2 itojun }
1064 1.2 itojun
1065 1.2 itojun void
1066 1.107 christos ip6_savecontrol(struct in6pcb *in6p, struct mbuf **mp,
1067 1.107 christos struct ip6_hdr *ip6, struct mbuf *m)
1068 1.2 itojun {
1069 1.179 christos struct socket *so = in6p->in6p_socket;
1070 1.85 rpaulo #ifdef RFC2292
1071 1.85 rpaulo #define IS2292(x, y) ((in6p->in6p_flags & IN6P_RFC2292) ? (x) : (y))
1072 1.85 rpaulo #else
1073 1.85 rpaulo #define IS2292(x, y) (y)
1074 1.85 rpaulo #endif
1075 1.85 rpaulo
1076 1.215 maxv KASSERT(m->m_flags & M_PKTHDR);
1077 1.215 maxv
1078 1.179 christos if (SOOPT_TIMESTAMP(so->so_options))
1079 1.200 maxv mp = sbsavetimestamp(so->so_options, mp);
1080 1.87 rpaulo
1081 1.87 rpaulo /* some OSes call this logic with IPv4 packet, for SO_TIMESTAMP */
1082 1.87 rpaulo if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION)
1083 1.87 rpaulo return;
1084 1.87 rpaulo
1085 1.2 itojun /* RFC 2292 sec. 5 */
1086 1.35 itojun if ((in6p->in6p_flags & IN6P_PKTINFO) != 0) {
1087 1.2 itojun struct in6_pktinfo pi6;
1088 1.85 rpaulo
1089 1.126 tsutsui memcpy(&pi6.ipi6_addr, &ip6->ip6_dst, sizeof(struct in6_addr));
1090 1.81 rpaulo in6_clearscope(&pi6.ipi6_addr); /* XXX */
1091 1.160 ozaki pi6.ipi6_ifindex = m->m_pkthdr.rcvif_index;
1092 1.180 christos *mp = sbcreatecontrol(&pi6, sizeof(pi6),
1093 1.85 rpaulo IS2292(IPV6_2292PKTINFO, IPV6_PKTINFO), IPPROTO_IPV6);
1094 1.2 itojun if (*mp)
1095 1.2 itojun mp = &(*mp)->m_next;
1096 1.2 itojun }
1097 1.85 rpaulo
1098 1.2 itojun if (in6p->in6p_flags & IN6P_HOPLIMIT) {
1099 1.2 itojun int hlim = ip6->ip6_hlim & 0xff;
1100 1.85 rpaulo
1101 1.180 christos *mp = sbcreatecontrol(&hlim, sizeof(hlim),
1102 1.85 rpaulo IS2292(IPV6_2292HOPLIMIT, IPV6_HOPLIMIT), IPPROTO_IPV6);
1103 1.85 rpaulo if (*mp)
1104 1.85 rpaulo mp = &(*mp)->m_next;
1105 1.85 rpaulo }
1106 1.85 rpaulo
1107 1.85 rpaulo if ((in6p->in6p_flags & IN6P_TCLASS) != 0) {
1108 1.85 rpaulo u_int32_t flowinfo;
1109 1.85 rpaulo int tclass;
1110 1.85 rpaulo
1111 1.85 rpaulo flowinfo = (u_int32_t)ntohl(ip6->ip6_flow & IPV6_FLOWINFO_MASK);
1112 1.85 rpaulo flowinfo >>= 20;
1113 1.85 rpaulo
1114 1.85 rpaulo tclass = flowinfo & 0xff;
1115 1.180 christos *mp = sbcreatecontrol(&tclass, sizeof(tclass),
1116 1.85 rpaulo IPV6_TCLASS, IPPROTO_IPV6);
1117 1.85 rpaulo
1118 1.2 itojun if (*mp)
1119 1.2 itojun mp = &(*mp)->m_next;
1120 1.2 itojun }
1121 1.2 itojun
1122 1.2 itojun /*
1123 1.75 itojun * IPV6_HOPOPTS socket option. Recall that we required super-user
1124 1.75 itojun * privilege for the option (see ip6_ctloutput), but it might be too
1125 1.75 itojun * strict, since there might be some hop-by-hop options which can be
1126 1.75 itojun * returned to normal user.
1127 1.85 rpaulo * See also RFC3542 section 8 (or RFC2292 section 6).
1128 1.2 itojun */
1129 1.75 itojun if ((in6p->in6p_flags & IN6P_HOPOPTS) != 0) {
1130 1.2 itojun /*
1131 1.2 itojun * Check if a hop-by-hop options header is contatined in the
1132 1.2 itojun * received packet, and if so, store the options as ancillary
1133 1.2 itojun * data. Note that a hop-by-hop options header must be
1134 1.2 itojun * just after the IPv6 header, which fact is assured through
1135 1.2 itojun * the IPv6 input processing.
1136 1.2 itojun */
1137 1.78 christos struct ip6_hdr *xip6 = mtod(m, struct ip6_hdr *);
1138 1.78 christos if (xip6->ip6_nxt == IPPROTO_HOPOPTS) {
1139 1.9 itojun struct ip6_hbh *hbh;
1140 1.9 itojun int hbhlen;
1141 1.62 itojun struct mbuf *ext;
1142 1.9 itojun
1143 1.62 itojun ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr),
1144 1.78 christos xip6->ip6_nxt);
1145 1.62 itojun if (ext == NULL) {
1146 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
1147 1.9 itojun return;
1148 1.9 itojun }
1149 1.62 itojun hbh = mtod(ext, struct ip6_hbh *);
1150 1.9 itojun hbhlen = (hbh->ip6h_len + 1) << 3;
1151 1.62 itojun if (hbhlen != ext->m_len) {
1152 1.62 itojun m_freem(ext);
1153 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
1154 1.9 itojun return;
1155 1.9 itojun }
1156 1.2 itojun
1157 1.2 itojun /*
1158 1.2 itojun * XXX: We copy whole the header even if a jumbo
1159 1.2 itojun * payload option is included, which option is to
1160 1.2 itojun * be removed before returning in the RFC 2292.
1161 1.85 rpaulo * Note: this constraint is removed in RFC3542.
1162 1.2 itojun */
1163 1.180 christos *mp = sbcreatecontrol(hbh, hbhlen,
1164 1.85 rpaulo IS2292(IPV6_2292HOPOPTS, IPV6_HOPOPTS),
1165 1.85 rpaulo IPPROTO_IPV6);
1166 1.2 itojun if (*mp)
1167 1.2 itojun mp = &(*mp)->m_next;
1168 1.62 itojun m_freem(ext);
1169 1.2 itojun }
1170 1.2 itojun }
1171 1.2 itojun
1172 1.2 itojun /* IPV6_DSTOPTS and IPV6_RTHDR socket options */
1173 1.2 itojun if (in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDR)) {
1174 1.78 christos struct ip6_hdr *xip6 = mtod(m, struct ip6_hdr *);
1175 1.78 christos int nxt = xip6->ip6_nxt, off = sizeof(struct ip6_hdr);
1176 1.2 itojun
1177 1.2 itojun /*
1178 1.2 itojun * Search for destination options headers or routing
1179 1.2 itojun * header(s) through the header chain, and stores each
1180 1.2 itojun * header as ancillary data.
1181 1.2 itojun * Note that the order of the headers remains in
1182 1.2 itojun * the chain of ancillary data.
1183 1.2 itojun */
1184 1.86 rpaulo for (;;) { /* is explicit loop prevention necessary? */
1185 1.62 itojun struct ip6_ext *ip6e = NULL;
1186 1.9 itojun int elen;
1187 1.62 itojun struct mbuf *ext = NULL;
1188 1.9 itojun
1189 1.62 itojun /*
1190 1.62 itojun * if it is not an extension header, don't try to
1191 1.62 itojun * pull it from the chain.
1192 1.62 itojun */
1193 1.62 itojun switch (nxt) {
1194 1.62 itojun case IPPROTO_DSTOPTS:
1195 1.62 itojun case IPPROTO_ROUTING:
1196 1.62 itojun case IPPROTO_HOPOPTS:
1197 1.62 itojun case IPPROTO_AH: /* is it possible? */
1198 1.62 itojun break;
1199 1.62 itojun default:
1200 1.62 itojun goto loopend;
1201 1.62 itojun }
1202 1.62 itojun
1203 1.62 itojun ext = ip6_pullexthdr(m, off, nxt);
1204 1.62 itojun if (ext == NULL) {
1205 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
1206 1.9 itojun return;
1207 1.9 itojun }
1208 1.62 itojun ip6e = mtod(ext, struct ip6_ext *);
1209 1.9 itojun if (nxt == IPPROTO_AH)
1210 1.9 itojun elen = (ip6e->ip6e_len + 2) << 2;
1211 1.9 itojun else
1212 1.9 itojun elen = (ip6e->ip6e_len + 1) << 3;
1213 1.62 itojun if (elen != ext->m_len) {
1214 1.62 itojun m_freem(ext);
1215 1.116 thorpej IP6_STATINC(IP6_STAT_TOOSHORT);
1216 1.9 itojun return;
1217 1.9 itojun }
1218 1.223 christos KASSERT(POINTER_ALIGNED_P(ip6e, IP6_HDR_ALIGNMENT));
1219 1.2 itojun
1220 1.35 itojun switch (nxt) {
1221 1.62 itojun case IPPROTO_DSTOPTS:
1222 1.127 martin if (!(in6p->in6p_flags & IN6P_DSTOPTS))
1223 1.35 itojun break;
1224 1.35 itojun
1225 1.180 christos *mp = sbcreatecontrol(ip6e, elen,
1226 1.85 rpaulo IS2292(IPV6_2292DSTOPTS, IPV6_DSTOPTS),
1227 1.85 rpaulo IPPROTO_IPV6);
1228 1.35 itojun if (*mp)
1229 1.35 itojun mp = &(*mp)->m_next;
1230 1.35 itojun break;
1231 1.35 itojun
1232 1.35 itojun case IPPROTO_ROUTING:
1233 1.127 martin if (!(in6p->in6p_flags & IN6P_RTHDR))
1234 1.35 itojun break;
1235 1.35 itojun
1236 1.180 christos *mp = sbcreatecontrol(ip6e, elen,
1237 1.85 rpaulo IS2292(IPV6_2292RTHDR, IPV6_RTHDR),
1238 1.85 rpaulo IPPROTO_IPV6);
1239 1.35 itojun if (*mp)
1240 1.35 itojun mp = &(*mp)->m_next;
1241 1.35 itojun break;
1242 1.35 itojun
1243 1.62 itojun case IPPROTO_HOPOPTS:
1244 1.62 itojun case IPPROTO_AH: /* is it possible? */
1245 1.62 itojun break;
1246 1.62 itojun
1247 1.35 itojun default:
1248 1.35 itojun /*
1249 1.62 itojun * other cases have been filtered in the above.
1250 1.62 itojun * none will visit this case. here we supply
1251 1.62 itojun * the code just in case (nxt overwritten or
1252 1.62 itojun * other cases).
1253 1.35 itojun */
1254 1.62 itojun m_freem(ext);
1255 1.35 itojun goto loopend;
1256 1.35 itojun
1257 1.2 itojun }
1258 1.2 itojun
1259 1.2 itojun /* proceed with the next header. */
1260 1.9 itojun off += elen;
1261 1.2 itojun nxt = ip6e->ip6e_nxt;
1262 1.62 itojun ip6e = NULL;
1263 1.62 itojun m_freem(ext);
1264 1.62 itojun ext = NULL;
1265 1.2 itojun }
1266 1.2 itojun loopend:
1267 1.62 itojun ;
1268 1.2 itojun }
1269 1.62 itojun }
1270 1.85 rpaulo #undef IS2292
1271 1.85 rpaulo
1272 1.85 rpaulo
1273 1.85 rpaulo void
1274 1.95 dyoung ip6_notify_pmtu(struct in6pcb *in6p, const struct sockaddr_in6 *dst,
1275 1.95 dyoung uint32_t *mtu)
1276 1.85 rpaulo {
1277 1.85 rpaulo struct socket *so;
1278 1.85 rpaulo struct mbuf *m_mtu;
1279 1.85 rpaulo struct ip6_mtuinfo mtuctl;
1280 1.85 rpaulo
1281 1.85 rpaulo so = in6p->in6p_socket;
1282 1.85 rpaulo
1283 1.85 rpaulo if (mtu == NULL)
1284 1.85 rpaulo return;
1285 1.85 rpaulo
1286 1.177 ozaki KASSERT(so != NULL);
1287 1.85 rpaulo
1288 1.85 rpaulo memset(&mtuctl, 0, sizeof(mtuctl)); /* zero-clear for safety */
1289 1.85 rpaulo mtuctl.ip6m_mtu = *mtu;
1290 1.85 rpaulo mtuctl.ip6m_addr = *dst;
1291 1.85 rpaulo if (sa6_recoverscope(&mtuctl.ip6m_addr))
1292 1.85 rpaulo return;
1293 1.85 rpaulo
1294 1.180 christos if ((m_mtu = sbcreatecontrol(&mtuctl, sizeof(mtuctl),
1295 1.85 rpaulo IPV6_PATHMTU, IPPROTO_IPV6)) == NULL)
1296 1.85 rpaulo return;
1297 1.85 rpaulo
1298 1.95 dyoung if (sbappendaddr(&so->so_rcv, (const struct sockaddr *)dst, NULL, m_mtu)
1299 1.85 rpaulo == 0) {
1300 1.195 roy soroverflow(so);
1301 1.85 rpaulo m_freem(m_mtu);
1302 1.85 rpaulo } else
1303 1.85 rpaulo sorwakeup(so);
1304 1.85 rpaulo
1305 1.85 rpaulo return;
1306 1.85 rpaulo }
1307 1.62 itojun
1308 1.62 itojun /*
1309 1.62 itojun * pull single extension header from mbuf chain. returns single mbuf that
1310 1.62 itojun * contains the result, or NULL on error.
1311 1.62 itojun */
1312 1.62 itojun static struct mbuf *
1313 1.107 christos ip6_pullexthdr(struct mbuf *m, size_t off, int nxt)
1314 1.62 itojun {
1315 1.62 itojun struct ip6_ext ip6e;
1316 1.62 itojun size_t elen;
1317 1.62 itojun struct mbuf *n;
1318 1.62 itojun
1319 1.215 maxv if (off + sizeof(ip6e) > m->m_pkthdr.len)
1320 1.215 maxv return NULL;
1321 1.215 maxv
1322 1.97 christos m_copydata(m, off, sizeof(ip6e), (void *)&ip6e);
1323 1.62 itojun if (nxt == IPPROTO_AH)
1324 1.62 itojun elen = (ip6e.ip6e_len + 2) << 2;
1325 1.62 itojun else
1326 1.62 itojun elen = (ip6e.ip6e_len + 1) << 3;
1327 1.62 itojun
1328 1.215 maxv if (off + elen > m->m_pkthdr.len)
1329 1.215 maxv return NULL;
1330 1.215 maxv
1331 1.62 itojun MGET(n, M_DONTWAIT, MT_DATA);
1332 1.62 itojun if (n && elen >= MLEN) {
1333 1.62 itojun MCLGET(n, M_DONTWAIT);
1334 1.62 itojun if ((n->m_flags & M_EXT) == 0) {
1335 1.62 itojun m_free(n);
1336 1.62 itojun n = NULL;
1337 1.62 itojun }
1338 1.62 itojun }
1339 1.62 itojun if (!n)
1340 1.62 itojun return NULL;
1341 1.62 itojun
1342 1.62 itojun n->m_len = 0;
1343 1.62 itojun if (elen >= M_TRAILINGSPACE(n)) {
1344 1.62 itojun m_free(n);
1345 1.62 itojun return NULL;
1346 1.62 itojun }
1347 1.62 itojun
1348 1.97 christos m_copydata(m, off, elen, mtod(n, void *));
1349 1.62 itojun n->m_len = elen;
1350 1.62 itojun return n;
1351 1.2 itojun }
1352 1.2 itojun
1353 1.2 itojun /*
1354 1.187 maxv * Get offset to the previous header followed by the header
1355 1.2 itojun * currently processed.
1356 1.2 itojun */
1357 1.187 maxv int
1358 1.107 christos ip6_get_prevhdr(struct mbuf *m, int off)
1359 1.2 itojun {
1360 1.2 itojun struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1361 1.2 itojun
1362 1.187 maxv if (off == sizeof(struct ip6_hdr)) {
1363 1.187 maxv return offsetof(struct ip6_hdr, ip6_nxt);
1364 1.187 maxv } else if (off < sizeof(struct ip6_hdr)) {
1365 1.187 maxv panic("%s: off < sizeof(struct ip6_hdr)", __func__);
1366 1.187 maxv } else {
1367 1.187 maxv int len, nlen, nxt;
1368 1.187 maxv struct ip6_ext ip6e;
1369 1.2 itojun
1370 1.2 itojun nxt = ip6->ip6_nxt;
1371 1.2 itojun len = sizeof(struct ip6_hdr);
1372 1.187 maxv nlen = 0;
1373 1.2 itojun while (len < off) {
1374 1.187 maxv m_copydata(m, len, sizeof(ip6e), &ip6e);
1375 1.2 itojun
1376 1.35 itojun switch (nxt) {
1377 1.2 itojun case IPPROTO_FRAGMENT:
1378 1.187 maxv nlen = sizeof(struct ip6_frag);
1379 1.2 itojun break;
1380 1.2 itojun case IPPROTO_AH:
1381 1.187 maxv nlen = (ip6e.ip6e_len + 2) << 2;
1382 1.2 itojun break;
1383 1.2 itojun default:
1384 1.187 maxv nlen = (ip6e.ip6e_len + 1) << 3;
1385 1.2 itojun break;
1386 1.2 itojun }
1387 1.187 maxv len += nlen;
1388 1.187 maxv nxt = ip6e.ip6e_nxt;
1389 1.2 itojun }
1390 1.187 maxv
1391 1.187 maxv return (len - nlen);
1392 1.18 itojun }
1393 1.18 itojun }
1394 1.18 itojun
1395 1.18 itojun /*
1396 1.18 itojun * get next header offset. m will be retained.
1397 1.18 itojun */
1398 1.192 maxv int
1399 1.107 christos ip6_nexthdr(struct mbuf *m, int off, int proto, int *nxtp)
1400 1.18 itojun {
1401 1.18 itojun struct ip6_hdr ip6;
1402 1.18 itojun struct ip6_ext ip6e;
1403 1.18 itojun struct ip6_frag fh;
1404 1.18 itojun
1405 1.18 itojun /* just in case */
1406 1.18 itojun if (m == NULL)
1407 1.189 maxv panic("%s: m == NULL", __func__);
1408 1.18 itojun if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off)
1409 1.18 itojun return -1;
1410 1.18 itojun
1411 1.18 itojun switch (proto) {
1412 1.18 itojun case IPPROTO_IPV6:
1413 1.83 rpaulo /* do not chase beyond intermediate IPv6 headers */
1414 1.83 rpaulo if (off != 0)
1415 1.83 rpaulo return -1;
1416 1.18 itojun if (m->m_pkthdr.len < off + sizeof(ip6))
1417 1.18 itojun return -1;
1418 1.97 christos m_copydata(m, off, sizeof(ip6), (void *)&ip6);
1419 1.18 itojun if (nxtp)
1420 1.18 itojun *nxtp = ip6.ip6_nxt;
1421 1.18 itojun off += sizeof(ip6);
1422 1.18 itojun return off;
1423 1.18 itojun
1424 1.18 itojun case IPPROTO_FRAGMENT:
1425 1.18 itojun /*
1426 1.18 itojun * terminate parsing if it is not the first fragment,
1427 1.18 itojun * it does not make sense to parse through it.
1428 1.18 itojun */
1429 1.18 itojun if (m->m_pkthdr.len < off + sizeof(fh))
1430 1.18 itojun return -1;
1431 1.97 christos m_copydata(m, off, sizeof(fh), (void *)&fh);
1432 1.67 itojun if ((fh.ip6f_offlg & IP6F_OFF_MASK) != 0)
1433 1.18 itojun return -1;
1434 1.18 itojun if (nxtp)
1435 1.18 itojun *nxtp = fh.ip6f_nxt;
1436 1.18 itojun off += sizeof(struct ip6_frag);
1437 1.18 itojun return off;
1438 1.18 itojun
1439 1.18 itojun case IPPROTO_AH:
1440 1.18 itojun if (m->m_pkthdr.len < off + sizeof(ip6e))
1441 1.18 itojun return -1;
1442 1.97 christos m_copydata(m, off, sizeof(ip6e), (void *)&ip6e);
1443 1.18 itojun if (nxtp)
1444 1.18 itojun *nxtp = ip6e.ip6e_nxt;
1445 1.18 itojun off += (ip6e.ip6e_len + 2) << 2;
1446 1.47 itojun if (m->m_pkthdr.len < off)
1447 1.47 itojun return -1;
1448 1.18 itojun return off;
1449 1.18 itojun
1450 1.18 itojun case IPPROTO_HOPOPTS:
1451 1.18 itojun case IPPROTO_ROUTING:
1452 1.18 itojun case IPPROTO_DSTOPTS:
1453 1.18 itojun if (m->m_pkthdr.len < off + sizeof(ip6e))
1454 1.18 itojun return -1;
1455 1.97 christos m_copydata(m, off, sizeof(ip6e), (void *)&ip6e);
1456 1.18 itojun if (nxtp)
1457 1.18 itojun *nxtp = ip6e.ip6e_nxt;
1458 1.18 itojun off += (ip6e.ip6e_len + 1) << 3;
1459 1.47 itojun if (m->m_pkthdr.len < off)
1460 1.47 itojun return -1;
1461 1.18 itojun return off;
1462 1.18 itojun
1463 1.18 itojun case IPPROTO_NONE:
1464 1.18 itojun case IPPROTO_ESP:
1465 1.18 itojun case IPPROTO_IPCOMP:
1466 1.18 itojun /* give up */
1467 1.18 itojun return -1;
1468 1.18 itojun
1469 1.18 itojun default:
1470 1.18 itojun return -1;
1471 1.18 itojun }
1472 1.18 itojun }
1473 1.18 itojun
1474 1.18 itojun /*
1475 1.18 itojun * get offset for the last header in the chain. m will be kept untainted.
1476 1.18 itojun */
1477 1.18 itojun int
1478 1.107 christos ip6_lasthdr(struct mbuf *m, int off, int proto, int *nxtp)
1479 1.18 itojun {
1480 1.18 itojun int newoff;
1481 1.18 itojun int nxt;
1482 1.18 itojun
1483 1.18 itojun if (!nxtp) {
1484 1.18 itojun nxt = -1;
1485 1.18 itojun nxtp = &nxt;
1486 1.18 itojun }
1487 1.86 rpaulo for (;;) {
1488 1.18 itojun newoff = ip6_nexthdr(m, off, proto, nxtp);
1489 1.18 itojun if (newoff < 0)
1490 1.18 itojun return off;
1491 1.18 itojun else if (newoff < off)
1492 1.18 itojun return -1; /* invalid */
1493 1.18 itojun else if (newoff == off)
1494 1.18 itojun return newoff;
1495 1.18 itojun
1496 1.18 itojun off = newoff;
1497 1.18 itojun proto = *nxtp;
1498 1.2 itojun }
1499 1.2 itojun }
1500 1.2 itojun
1501 1.217 maxv static struct m_tag *
1502 1.107 christos ip6_addaux(struct mbuf *m)
1503 1.81 rpaulo {
1504 1.81 rpaulo struct m_tag *mtag;
1505 1.81 rpaulo
1506 1.205 maxv mtag = m_tag_find(m, PACKET_TAG_INET6);
1507 1.81 rpaulo if (!mtag) {
1508 1.81 rpaulo mtag = m_tag_get(PACKET_TAG_INET6, sizeof(struct ip6aux),
1509 1.81 rpaulo M_NOWAIT);
1510 1.81 rpaulo if (mtag) {
1511 1.81 rpaulo m_tag_prepend(m, mtag);
1512 1.124 cegger memset(mtag + 1, 0, sizeof(struct ip6aux));
1513 1.81 rpaulo }
1514 1.81 rpaulo }
1515 1.81 rpaulo return mtag;
1516 1.81 rpaulo }
1517 1.81 rpaulo
1518 1.217 maxv static struct m_tag *
1519 1.107 christos ip6_findaux(struct mbuf *m)
1520 1.81 rpaulo {
1521 1.81 rpaulo struct m_tag *mtag;
1522 1.81 rpaulo
1523 1.205 maxv mtag = m_tag_find(m, PACKET_TAG_INET6);
1524 1.81 rpaulo return mtag;
1525 1.81 rpaulo }
1526 1.81 rpaulo
1527 1.217 maxv static void
1528 1.107 christos ip6_delaux(struct mbuf *m)
1529 1.81 rpaulo {
1530 1.81 rpaulo struct m_tag *mtag;
1531 1.81 rpaulo
1532 1.205 maxv mtag = m_tag_find(m, PACKET_TAG_INET6);
1533 1.81 rpaulo if (mtag)
1534 1.81 rpaulo m_tag_delete(m, mtag);
1535 1.81 rpaulo }
1536 1.81 rpaulo
1537 1.2 itojun /*
1538 1.2 itojun * System control for IP6
1539 1.2 itojun */
1540 1.2 itojun
1541 1.120 matt const u_char inet6ctlerrmap[PRC_NCMDS] = {
1542 1.2 itojun 0, 0, 0, 0,
1543 1.2 itojun 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH,
1544 1.2 itojun EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED,
1545 1.2 itojun EMSGSIZE, EHOSTUNREACH, 0, 0,
1546 1.2 itojun 0, 0, 0, 0,
1547 1.2 itojun ENOPROTOOPT
1548 1.2 itojun };
1549 1.2 itojun
1550 1.153 christos extern int sysctl_net_inet6_addrctlpolicy(SYSCTLFN_ARGS);
1551 1.153 christos
1552 1.116 thorpej static int
1553 1.116 thorpej sysctl_net_inet6_ip6_stats(SYSCTLFN_ARGS)
1554 1.116 thorpej {
1555 1.116 thorpej
1556 1.119 thorpej return (NETSTAT_SYSCTL(ip6stat_percpu, IP6_NSTATS));
1557 1.116 thorpej }
1558 1.116 thorpej
1559 1.128 pooka static void
1560 1.128 pooka sysctl_net_inet6_ip6_setup(struct sysctllog **clog)
1561 1.2 itojun {
1562 1.26 itojun
1563 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1564 1.73 atatat CTLFLAG_PERMANENT,
1565 1.74 atatat CTLTYPE_NODE, "inet6",
1566 1.74 atatat SYSCTL_DESCR("PF_INET6 related settings"),
1567 1.70 atatat NULL, 0, NULL, 0,
1568 1.70 atatat CTL_NET, PF_INET6, CTL_EOL);
1569 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1570 1.73 atatat CTLFLAG_PERMANENT,
1571 1.74 atatat CTLTYPE_NODE, "ip6",
1572 1.74 atatat SYSCTL_DESCR("IPv6 related settings"),
1573 1.70 atatat NULL, 0, NULL, 0,
1574 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6, CTL_EOL);
1575 1.70 atatat
1576 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1577 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1578 1.74 atatat CTLTYPE_INT, "forwarding",
1579 1.74 atatat SYSCTL_DESCR("Enable forwarding of INET6 datagrams"),
1580 1.70 atatat NULL, 0, &ip6_forwarding, 0,
1581 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1582 1.70 atatat IPV6CTL_FORWARDING, CTL_EOL);
1583 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1584 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1585 1.74 atatat CTLTYPE_INT, "redirect",
1586 1.74 atatat SYSCTL_DESCR("Enable sending of ICMPv6 redirect messages"),
1587 1.70 atatat NULL, 0, &ip6_sendredirects, 0,
1588 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1589 1.70 atatat IPV6CTL_SENDREDIRECTS, CTL_EOL);
1590 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1591 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1592 1.74 atatat CTLTYPE_INT, "hlim",
1593 1.74 atatat SYSCTL_DESCR("Hop limit for an INET6 datagram"),
1594 1.70 atatat NULL, 0, &ip6_defhlim, 0,
1595 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1596 1.70 atatat IPV6CTL_DEFHLIM, CTL_EOL);
1597 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1598 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1599 1.74 atatat CTLTYPE_INT, "maxfragpackets",
1600 1.74 atatat SYSCTL_DESCR("Maximum number of fragments to buffer "
1601 1.74 atatat "for reassembly"),
1602 1.70 atatat NULL, 0, &ip6_maxfragpackets, 0,
1603 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1604 1.70 atatat IPV6CTL_MAXFRAGPACKETS, CTL_EOL);
1605 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1606 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1607 1.74 atatat CTLTYPE_INT, "keepfaith",
1608 1.74 atatat SYSCTL_DESCR("Activate faith interface"),
1609 1.70 atatat NULL, 0, &ip6_keepfaith, 0,
1610 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1611 1.70 atatat IPV6CTL_KEEPFAITH, CTL_EOL);
1612 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1613 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1614 1.74 atatat CTLTYPE_INT, "log_interval",
1615 1.189 maxv SYSCTL_DESCR("Minimum interval between logging "
1616 1.74 atatat "unroutable packets"),
1617 1.70 atatat NULL, 0, &ip6_log_interval, 0,
1618 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1619 1.70 atatat IPV6CTL_LOG_INTERVAL, CTL_EOL);
1620 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1621 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1622 1.74 atatat CTLTYPE_INT, "hdrnestlimit",
1623 1.74 atatat SYSCTL_DESCR("Maximum number of nested IPv6 headers"),
1624 1.70 atatat NULL, 0, &ip6_hdrnestlimit, 0,
1625 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1626 1.70 atatat IPV6CTL_HDRNESTLIMIT, CTL_EOL);
1627 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1628 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1629 1.74 atatat CTLTYPE_INT, "dad_count",
1630 1.74 atatat SYSCTL_DESCR("Number of Duplicate Address Detection "
1631 1.74 atatat "probes to send"),
1632 1.70 atatat NULL, 0, &ip6_dad_count, 0,
1633 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1634 1.70 atatat IPV6CTL_DAD_COUNT, CTL_EOL);
1635 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1636 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1637 1.74 atatat CTLTYPE_INT, "auto_flowlabel",
1638 1.74 atatat SYSCTL_DESCR("Assign random IPv6 flow labels"),
1639 1.70 atatat NULL, 0, &ip6_auto_flowlabel, 0,
1640 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1641 1.70 atatat IPV6CTL_AUTO_FLOWLABEL, CTL_EOL);
1642 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1643 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1644 1.74 atatat CTLTYPE_INT, "defmcasthlim",
1645 1.74 atatat SYSCTL_DESCR("Default multicast hop limit"),
1646 1.70 atatat NULL, 0, &ip6_defmcasthlim, 0,
1647 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1648 1.70 atatat IPV6CTL_DEFMCASTHLIM, CTL_EOL);
1649 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1650 1.73 atatat CTLFLAG_PERMANENT,
1651 1.74 atatat CTLTYPE_STRING, "kame_version",
1652 1.74 atatat SYSCTL_DESCR("KAME Version"),
1653 1.78 christos NULL, 0, __UNCONST(__KAME_VERSION), 0,
1654 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1655 1.70 atatat IPV6CTL_KAME_VERSION, CTL_EOL);
1656 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1657 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1658 1.74 atatat CTLTYPE_INT, "use_deprecated",
1659 1.74 atatat SYSCTL_DESCR("Allow use of deprecated addresses as "
1660 1.74 atatat "source addresses"),
1661 1.70 atatat NULL, 0, &ip6_use_deprecated, 0,
1662 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1663 1.70 atatat IPV6CTL_USE_DEPRECATED, CTL_EOL);
1664 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1665 1.73 atatat CTLFLAG_PERMANENT
1666 1.70 atatat #ifndef INET6_BINDV6ONLY
1667 1.73 atatat |CTLFLAG_READWRITE,
1668 1.70 atatat #endif
1669 1.74 atatat CTLTYPE_INT, "v6only",
1670 1.74 atatat SYSCTL_DESCR("Disallow PF_INET6 sockets from connecting "
1671 1.74 atatat "to PF_INET sockets"),
1672 1.70 atatat NULL, 0, &ip6_v6only, 0,
1673 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1674 1.70 atatat IPV6CTL_V6ONLY, CTL_EOL);
1675 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1676 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1677 1.74 atatat CTLTYPE_INT, "anonportmin",
1678 1.74 atatat SYSCTL_DESCR("Lowest ephemeral port number to assign"),
1679 1.70 atatat sysctl_net_inet_ip_ports, 0, &ip6_anonportmin, 0,
1680 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1681 1.70 atatat IPV6CTL_ANONPORTMIN, CTL_EOL);
1682 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1683 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1684 1.74 atatat CTLTYPE_INT, "anonportmax",
1685 1.74 atatat SYSCTL_DESCR("Highest ephemeral port number to assign"),
1686 1.70 atatat sysctl_net_inet_ip_ports, 0, &ip6_anonportmax, 0,
1687 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1688 1.70 atatat IPV6CTL_ANONPORTMAX, CTL_EOL);
1689 1.26 itojun #ifndef IPNOPRIVPORTS
1690 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1691 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1692 1.74 atatat CTLTYPE_INT, "lowportmin",
1693 1.74 atatat SYSCTL_DESCR("Lowest privileged ephemeral port number "
1694 1.74 atatat "to assign"),
1695 1.70 atatat sysctl_net_inet_ip_ports, 0, &ip6_lowportmin, 0,
1696 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1697 1.70 atatat IPV6CTL_LOWPORTMIN, CTL_EOL);
1698 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1699 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1700 1.74 atatat CTLTYPE_INT, "lowportmax",
1701 1.74 atatat SYSCTL_DESCR("Highest privileged ephemeral port number "
1702 1.74 atatat "to assign"),
1703 1.70 atatat sysctl_net_inet_ip_ports, 0, &ip6_lowportmax, 0,
1704 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1705 1.70 atatat IPV6CTL_LOWPORTMAX, CTL_EOL);
1706 1.70 atatat #endif /* IPNOPRIVPORTS */
1707 1.73 atatat sysctl_createv(clog, 0, NULL, NULL,
1708 1.73 atatat CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1709 1.153 christos CTLTYPE_INT, "auto_linklocal",
1710 1.153 christos SYSCTL_DESCR("Default value of per-interface flag for "
1711 1.153 christos "adding an IPv6 link-local address to "
1712 1.153 christos "interfaces when attached"),
1713 1.153 christos NULL, 0, &ip6_auto_linklocal, 0,
1714 1.153 christos CTL_NET, PF_INET6, IPPROTO_IPV6,
1715 1.153 christos IPV6CTL_AUTO_LINKLOCAL, CTL_EOL);
1716 1.153 christos sysctl_createv(clog, 0, NULL, NULL,
1717 1.153 christos CTLFLAG_PERMANENT|CTLFLAG_READONLY,
1718 1.153 christos CTLTYPE_STRUCT, "addctlpolicy",
1719 1.153 christos SYSCTL_DESCR("Return the current address control"
1720 1.153 christos " policy"),
1721 1.153 christos sysctl_net_inet6_addrctlpolicy, 0, NULL, 0,
1722 1.153 christos CTL_NET, PF_INET6, IPPROTO_IPV6,
1723 1.153 christos IPV6CTL_ADDRCTLPOLICY, CTL_EOL);
1724 1.153 christos sysctl_createv(clog, 0, NULL, NULL,
1725 1.153 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1726 1.150 roy CTLTYPE_INT, "prefer_tempaddr",
1727 1.150 roy SYSCTL_DESCR("Prefer temporary address as source "
1728 1.150 roy "address"),
1729 1.150 roy NULL, 0, &ip6_prefer_tempaddr, 0,
1730 1.150 roy CTL_NET, PF_INET6, IPPROTO_IPV6,
1731 1.150 roy CTL_CREATE, CTL_EOL);
1732 1.150 roy sysctl_createv(clog, 0, NULL, NULL,
1733 1.150 roy CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1734 1.74 atatat CTLTYPE_INT, "maxfrags",
1735 1.74 atatat SYSCTL_DESCR("Maximum fragments in reassembly queue"),
1736 1.70 atatat NULL, 0, &ip6_maxfrags, 0,
1737 1.70 atatat CTL_NET, PF_INET6, IPPROTO_IPV6,
1738 1.70 atatat IPV6CTL_MAXFRAGS, CTL_EOL);
1739 1.79 rpaulo sysctl_createv(clog, 0, NULL, NULL,
1740 1.79 rpaulo CTLFLAG_PERMANENT,
1741 1.79 rpaulo CTLTYPE_STRUCT, "stats",
1742 1.79 rpaulo SYSCTL_DESCR("IPv6 statistics"),
1743 1.116 thorpej sysctl_net_inet6_ip6_stats, 0, NULL, 0,
1744 1.79 rpaulo CTL_NET, PF_INET6, IPPROTO_IPV6,
1745 1.79 rpaulo IPV6CTL_STATS, CTL_EOL);
1746 1.81 rpaulo sysctl_createv(clog, 0, NULL, NULL,
1747 1.81 rpaulo CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1748 1.81 rpaulo CTLTYPE_INT, "use_defaultzone",
1749 1.81 rpaulo SYSCTL_DESCR("Whether to use the default scope zones"),
1750 1.81 rpaulo NULL, 0, &ip6_use_defzone, 0,
1751 1.81 rpaulo CTL_NET, PF_INET6, IPPROTO_IPV6,
1752 1.81 rpaulo IPV6CTL_USE_DEFAULTZONE, CTL_EOL);
1753 1.83 rpaulo sysctl_createv(clog, 0, NULL, NULL,
1754 1.83 rpaulo CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1755 1.83 rpaulo CTLTYPE_INT, "mcast_pmtu",
1756 1.83 rpaulo SYSCTL_DESCR("Enable pMTU discovery for multicast packet"),
1757 1.83 rpaulo NULL, 0, &ip6_mcast_pmtu, 0,
1758 1.83 rpaulo CTL_NET, PF_INET6, IPPROTO_IPV6,
1759 1.83 rpaulo CTL_CREATE, CTL_EOL);
1760 1.138 christos /* anonportalgo RFC6056 subtree */
1761 1.140 christos const struct sysctlnode *portalgo_node;
1762 1.140 christos sysctl_createv(clog, 0, NULL, &portalgo_node,
1763 1.138 christos CTLFLAG_PERMANENT,
1764 1.138 christos CTLTYPE_NODE, "anonportalgo",
1765 1.138 christos SYSCTL_DESCR("Anonymous port algorithm selection (RFC 6056)"),
1766 1.138 christos NULL, 0, NULL, 0,
1767 1.138 christos CTL_NET, PF_INET6, IPPROTO_IPV6, CTL_CREATE, CTL_EOL);
1768 1.140 christos sysctl_createv(clog, 0, &portalgo_node, NULL,
1769 1.138 christos CTLFLAG_PERMANENT,
1770 1.138 christos CTLTYPE_STRING, "available",
1771 1.138 christos SYSCTL_DESCR("available algorithms"),
1772 1.140 christos sysctl_portalgo_available, 0, NULL, PORTALGO_MAXLEN,
1773 1.138 christos CTL_CREATE, CTL_EOL);
1774 1.140 christos sysctl_createv(clog, 0, &portalgo_node, NULL,
1775 1.138 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1776 1.138 christos CTLTYPE_STRING, "selected",
1777 1.138 christos SYSCTL_DESCR("selected algorithm"),
1778 1.140 christos sysctl_portalgo_selected6, 0, NULL, PORTALGO_MAXLEN,
1779 1.138 christos CTL_CREATE, CTL_EOL);
1780 1.141 christos sysctl_createv(clog, 0, &portalgo_node, NULL,
1781 1.141 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1782 1.141 christos CTLTYPE_STRUCT, "reserve",
1783 1.141 christos SYSCTL_DESCR("bitmap of reserved ports"),
1784 1.141 christos sysctl_portalgo_reserve6, 0, NULL, 0,
1785 1.141 christos CTL_CREATE, CTL_EOL);
1786 1.139 christos sysctl_createv(clog, 0, NULL, NULL,
1787 1.139 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1788 1.139 christos CTLTYPE_INT, "neighborgcthresh",
1789 1.139 christos SYSCTL_DESCR("Maximum number of entries in neighbor"
1790 1.139 christos " cache"),
1791 1.139 christos NULL, 1, &ip6_neighborgcthresh, 0,
1792 1.139 christos CTL_NET, PF_INET6, IPPROTO_IPV6,
1793 1.139 christos CTL_CREATE, CTL_EOL);
1794 1.139 christos sysctl_createv(clog, 0, NULL, NULL,
1795 1.139 christos CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1796 1.139 christos CTLTYPE_INT, "maxdynroutes",
1797 1.139 christos SYSCTL_DESCR("Maximum number of routes created via"
1798 1.139 christos " redirect"),
1799 1.139 christos NULL, 1, &ip6_maxdynroutes, 0,
1800 1.139 christos CTL_NET, PF_INET6, IPPROTO_IPV6,
1801 1.139 christos CTL_CREATE, CTL_EOL);
1802 1.2 itojun }
1803 1.116 thorpej
1804 1.116 thorpej void
1805 1.116 thorpej ip6_statinc(u_int stat)
1806 1.116 thorpej {
1807 1.116 thorpej
1808 1.116 thorpej KASSERT(stat < IP6_NSTATS);
1809 1.116 thorpej IP6_STATINC(stat);
1810 1.116 thorpej }
1811