Home | History | Annotate | Line # | Download | only in netinet6
ip6_input.c revision 1.83
      1  1.83    rpaulo /*	$NetBSD: ip6_input.c,v 1.83 2006/03/05 23:47:08 rpaulo Exp $	*/
      2  1.40    itojun /*	$KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $	*/
      3   1.3   thorpej 
      4   1.2    itojun /*
      5   1.2    itojun  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
      6   1.2    itojun  * All rights reserved.
      7  1.21    itojun  *
      8   1.2    itojun  * Redistribution and use in source and binary forms, with or without
      9   1.2    itojun  * modification, are permitted provided that the following conditions
     10   1.2    itojun  * are met:
     11   1.2    itojun  * 1. Redistributions of source code must retain the above copyright
     12   1.2    itojun  *    notice, this list of conditions and the following disclaimer.
     13   1.2    itojun  * 2. Redistributions in binary form must reproduce the above copyright
     14   1.2    itojun  *    notice, this list of conditions and the following disclaimer in the
     15   1.2    itojun  *    documentation and/or other materials provided with the distribution.
     16   1.2    itojun  * 3. Neither the name of the project nor the names of its contributors
     17   1.2    itojun  *    may be used to endorse or promote products derived from this software
     18   1.2    itojun  *    without specific prior written permission.
     19  1.21    itojun  *
     20   1.2    itojun  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     21   1.2    itojun  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     22   1.2    itojun  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     23   1.2    itojun  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     24   1.2    itojun  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     25   1.2    itojun  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     26   1.2    itojun  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     27   1.2    itojun  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     28   1.2    itojun  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     29   1.2    itojun  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     30   1.2    itojun  * SUCH DAMAGE.
     31   1.2    itojun  */
     32   1.2    itojun 
     33   1.2    itojun /*
     34   1.2    itojun  * Copyright (c) 1982, 1986, 1988, 1993
     35   1.2    itojun  *	The Regents of the University of California.  All rights reserved.
     36   1.2    itojun  *
     37   1.2    itojun  * Redistribution and use in source and binary forms, with or without
     38   1.2    itojun  * modification, are permitted provided that the following conditions
     39   1.2    itojun  * are met:
     40   1.2    itojun  * 1. Redistributions of source code must retain the above copyright
     41   1.2    itojun  *    notice, this list of conditions and the following disclaimer.
     42   1.2    itojun  * 2. Redistributions in binary form must reproduce the above copyright
     43   1.2    itojun  *    notice, this list of conditions and the following disclaimer in the
     44   1.2    itojun  *    documentation and/or other materials provided with the distribution.
     45  1.65       agc  * 3. Neither the name of the University nor the names of its contributors
     46   1.2    itojun  *    may be used to endorse or promote products derived from this software
     47   1.2    itojun  *    without specific prior written permission.
     48   1.2    itojun  *
     49   1.2    itojun  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     50   1.2    itojun  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     51   1.2    itojun  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     52   1.2    itojun  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     53   1.2    itojun  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     54   1.2    itojun  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     55   1.2    itojun  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     56   1.2    itojun  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     57   1.2    itojun  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     58   1.2    itojun  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     59   1.2    itojun  * SUCH DAMAGE.
     60   1.2    itojun  *
     61   1.2    itojun  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
     62   1.2    itojun  */
     63  1.48     lukem 
     64  1.48     lukem #include <sys/cdefs.h>
     65  1.83    rpaulo __KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.83 2006/03/05 23:47:08 rpaulo Exp $");
     66   1.2    itojun 
     67   1.2    itojun #include "opt_inet.h"
     68   1.4   thorpej #include "opt_ipsec.h"
     69  1.15   darrenr #include "opt_pfil_hooks.h"
     70   1.2    itojun 
     71   1.2    itojun #include <sys/param.h>
     72   1.2    itojun #include <sys/systm.h>
     73   1.2    itojun #include <sys/malloc.h>
     74   1.2    itojun #include <sys/mbuf.h>
     75   1.2    itojun #include <sys/domain.h>
     76   1.2    itojun #include <sys/protosw.h>
     77   1.2    itojun #include <sys/socket.h>
     78   1.2    itojun #include <sys/socketvar.h>
     79   1.2    itojun #include <sys/errno.h>
     80   1.2    itojun #include <sys/time.h>
     81   1.2    itojun #include <sys/kernel.h>
     82   1.2    itojun #include <sys/syslog.h>
     83   1.2    itojun #include <sys/proc.h>
     84  1.46    simonb #include <sys/sysctl.h>
     85   1.2    itojun 
     86   1.2    itojun #include <net/if.h>
     87   1.2    itojun #include <net/if_types.h>
     88   1.2    itojun #include <net/if_dl.h>
     89   1.2    itojun #include <net/route.h>
     90   1.2    itojun #include <net/netisr.h>
     91  1.15   darrenr #ifdef PFIL_HOOKS
     92  1.15   darrenr #include <net/pfil.h>
     93  1.15   darrenr #endif
     94   1.2    itojun 
     95   1.2    itojun #include <netinet/in.h>
     96   1.9    itojun #include <netinet/in_systm.h>
     97   1.9    itojun #ifdef INET
     98   1.9    itojun #include <netinet/ip.h>
     99   1.9    itojun #include <netinet/ip_icmp.h>
    100  1.45    itojun #endif /* INET */
    101  1.14    itojun #include <netinet/ip6.h>
    102   1.2    itojun #include <netinet6/in6_var.h>
    103  1.11    itojun #include <netinet6/ip6_var.h>
    104   1.2    itojun #include <netinet6/in6_pcb.h>
    105  1.14    itojun #include <netinet/icmp6.h>
    106  1.81    rpaulo #include <netinet6/scope6_var.h>
    107   1.2    itojun #include <netinet6/in6_ifattach.h>
    108   1.2    itojun #include <netinet6/nd6.h>
    109   1.2    itojun 
    110  1.37    itojun #ifdef IPSEC
    111  1.37    itojun #include <netinet6/ipsec.h>
    112  1.37    itojun #endif
    113  1.37    itojun 
    114   1.2    itojun #include <netinet6/ip6protosw.h>
    115   1.2    itojun 
    116   1.2    itojun #include "faith.h"
    117   1.2    itojun #include "gif.h"
    118  1.50    itojun 
    119  1.50    itojun #if NGIF > 0
    120  1.50    itojun #include <netinet6/in6_gif.h>
    121  1.50    itojun #endif
    122   1.2    itojun 
    123   1.9    itojun #include <net/net_osdep.h>
    124   1.9    itojun 
    125   1.2    itojun extern struct domain inet6domain;
    126   1.2    itojun 
    127   1.2    itojun u_char ip6_protox[IPPROTO_MAX];
    128   1.2    itojun static int ip6qmaxlen = IFQ_MAXLEN;
    129   1.2    itojun struct in6_ifaddr *in6_ifaddr;
    130   1.2    itojun struct ifqueue ip6intrq;
    131   1.2    itojun 
    132  1.83    rpaulo extern struct callout in6_tmpaddrtimer_ch;
    133  1.83    rpaulo 
    134   1.2    itojun int ip6_forward_srcrt;			/* XXX */
    135   1.2    itojun int ip6_sourcecheck;			/* XXX */
    136   1.2    itojun int ip6_sourcecheck_interval;		/* XXX */
    137   1.9    itojun 
    138  1.29   thorpej #ifdef PFIL_HOOKS
    139  1.29   thorpej struct pfil_head inet6_pfil_hook;
    140  1.29   thorpej #endif
    141  1.29   thorpej 
    142   1.2    itojun struct ip6stat ip6stat;
    143   1.2    itojun 
    144   1.2    itojun static void ip6_init2 __P((void *));
    145  1.81    rpaulo static struct m_tag *ip6_setdstifaddr __P((struct mbuf *, struct in6_ifaddr *));
    146   1.2    itojun 
    147   1.5    itojun static int ip6_hopopts_input __P((u_int32_t *, u_int32_t *, struct mbuf **, int *));
    148  1.62    itojun static struct mbuf *ip6_pullexthdr __P((struct mbuf *, size_t, int));
    149   1.2    itojun 
    150   1.2    itojun /*
    151   1.2    itojun  * IP6 initialization: fill in IP6 protocol switch table.
    152   1.2    itojun  * All protocols not implemented in kernel go to raw IP6 protocol handler.
    153   1.2    itojun  */
    154   1.2    itojun void
    155   1.2    itojun ip6_init()
    156   1.2    itojun {
    157  1.78  christos 	const struct ip6protosw *pr;
    158  1.35    itojun 	int i;
    159   1.2    itojun 
    160  1.78  christos 	pr = (const struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW);
    161   1.2    itojun 	if (pr == 0)
    162   1.2    itojun 		panic("ip6_init");
    163   1.2    itojun 	for (i = 0; i < IPPROTO_MAX; i++)
    164   1.2    itojun 		ip6_protox[i] = pr - inet6sw;
    165  1.78  christos 	for (pr = (const struct ip6protosw *)inet6domain.dom_protosw;
    166  1.78  christos 	    pr < (const struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++)
    167   1.2    itojun 		if (pr->pr_domain->dom_family == PF_INET6 &&
    168   1.2    itojun 		    pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
    169   1.2    itojun 			ip6_protox[pr->pr_protocol] = pr - inet6sw;
    170   1.2    itojun 	ip6intrq.ifq_maxlen = ip6qmaxlen;
    171  1.81    rpaulo 	scope6_init();
    172  1.81    rpaulo 	addrsel_policy_init();
    173   1.2    itojun 	nd6_init();
    174   1.2    itojun 	frag6_init();
    175  1.83    rpaulo 	ip6_desync_factor = arc4random() % MAX_TEMP_DESYNC_FACTOR;
    176   1.2    itojun 
    177   1.2    itojun 	ip6_init2((void *)0);
    178  1.29   thorpej 
    179  1.29   thorpej #ifdef PFIL_HOOKS
    180  1.29   thorpej 	/* Register our Packet Filter hook. */
    181  1.33   thorpej 	inet6_pfil_hook.ph_type = PFIL_TYPE_AF;
    182  1.33   thorpej 	inet6_pfil_hook.ph_af   = AF_INET6;
    183  1.29   thorpej 	i = pfil_head_register(&inet6_pfil_hook);
    184  1.29   thorpej 	if (i != 0)
    185  1.29   thorpej 		printf("ip6_init: WARNING: unable to register pfil hook, "
    186  1.29   thorpej 		    "error %d\n", i);
    187  1.29   thorpej #endif /* PFIL_HOOKS */
    188   1.2    itojun }
    189   1.2    itojun 
    190   1.2    itojun static void
    191   1.2    itojun ip6_init2(dummy)
    192   1.2    itojun 	void *dummy;
    193   1.2    itojun {
    194   1.2    itojun 
    195   1.2    itojun 	/* nd6_timer_init */
    196  1.19   thorpej 	callout_init(&nd6_timer_ch);
    197  1.19   thorpej 	callout_reset(&nd6_timer_ch, hz, nd6_timer, NULL);
    198  1.83    rpaulo 
    199  1.83    rpaulo 	/* timer for regeneranation of temporary addresses randomize ID */
    200  1.83    rpaulo 	callout_init(&in6_tmpaddrtimer_ch);
    201  1.83    rpaulo 	callout_reset(&in6_tmpaddrtimer_ch,
    202  1.83    rpaulo 		      (ip6_temp_preferred_lifetime - ip6_desync_factor -
    203  1.83    rpaulo 		       ip6_temp_regen_advance) * hz,
    204  1.83    rpaulo 		      in6_tmpaddrtimer, NULL);
    205   1.2    itojun }
    206   1.2    itojun 
    207   1.2    itojun /*
    208   1.2    itojun  * IP6 input interrupt handling. Just pass the packet to ip6_input.
    209   1.2    itojun  */
    210   1.2    itojun void
    211   1.2    itojun ip6intr()
    212   1.2    itojun {
    213   1.2    itojun 	int s;
    214   1.2    itojun 	struct mbuf *m;
    215   1.2    itojun 
    216   1.2    itojun 	for (;;) {
    217  1.41   thorpej 		s = splnet();
    218   1.2    itojun 		IF_DEQUEUE(&ip6intrq, m);
    219   1.2    itojun 		splx(s);
    220   1.2    itojun 		if (m == 0)
    221   1.2    itojun 			return;
    222  1.83    rpaulo 		/* drop the packet if IPv6 operation is disabled on the IF */
    223  1.83    rpaulo 		if ((ND_IFINFO(m->m_pkthdr.rcvif)->flags & ND6_IFF_IFDISABLED)) {
    224  1.83    rpaulo 			m_freem(m);
    225  1.83    rpaulo 			return;
    226  1.83    rpaulo 		}
    227   1.2    itojun 		ip6_input(m);
    228   1.2    itojun 	}
    229   1.2    itojun }
    230   1.2    itojun 
    231   1.2    itojun extern struct	route_in6 ip6_forward_rt;
    232   1.2    itojun 
    233   1.2    itojun void
    234   1.2    itojun ip6_input(m)
    235   1.2    itojun 	struct mbuf *m;
    236   1.2    itojun {
    237   1.9    itojun 	struct ip6_hdr *ip6;
    238   1.2    itojun 	int off = sizeof(struct ip6_hdr), nest;
    239   1.2    itojun 	u_int32_t plen;
    240   1.5    itojun 	u_int32_t rtalert = ~0;
    241   1.2    itojun 	int nxt, ours = 0;
    242   1.9    itojun 	struct ifnet *deliverifp = NULL;
    243  1.64    itojun 	int srcrt = 0;
    244   1.2    itojun 
    245   1.2    itojun #ifdef IPSEC
    246   1.2    itojun 	/*
    247   1.2    itojun 	 * should the inner packet be considered authentic?
    248   1.2    itojun 	 * see comment in ah4_input().
    249   1.2    itojun 	 */
    250  1.49    itojun 	m->m_flags &= ~M_AUTHIPHDR;
    251  1.49    itojun 	m->m_flags &= ~M_AUTHIPDGM;
    252   1.2    itojun #endif
    253   1.9    itojun 
    254   1.2    itojun 	/*
    255  1.81    rpaulo 	 * make sure we don't have onion peering information into m_tag.
    256  1.81    rpaulo 	 */
    257  1.81    rpaulo 	ip6_delaux(m);
    258  1.81    rpaulo 
    259  1.81    rpaulo 	/*
    260  1.44    itojun 	 * mbuf statistics
    261   1.2    itojun 	 */
    262   1.2    itojun 	if (m->m_flags & M_EXT) {
    263   1.2    itojun 		if (m->m_next)
    264   1.2    itojun 			ip6stat.ip6s_mext2m++;
    265   1.2    itojun 		else
    266   1.2    itojun 			ip6stat.ip6s_mext1++;
    267   1.2    itojun 	} else {
    268  1.40    itojun #define M2MMAX	(sizeof(ip6stat.ip6s_m2m)/sizeof(ip6stat.ip6s_m2m[0]))
    269   1.2    itojun 		if (m->m_next) {
    270   1.9    itojun 			if (m->m_flags & M_LOOP) {
    271  1.77     peter 				ip6stat.ip6s_m2m[lo0ifp->if_index]++; /* XXX */
    272  1.40    itojun 			} else if (m->m_pkthdr.rcvif->if_index < M2MMAX)
    273   1.2    itojun 				ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++;
    274   1.2    itojun 			else
    275   1.2    itojun 				ip6stat.ip6s_m2m[0]++;
    276   1.2    itojun 		} else
    277   1.2    itojun 			ip6stat.ip6s_m1++;
    278  1.40    itojun #undef M2MMAX
    279   1.2    itojun 	}
    280   1.2    itojun 
    281   1.9    itojun 	in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive);
    282   1.9    itojun 	ip6stat.ip6s_total++;
    283   1.9    itojun 
    284  1.57   thorpej 	/*
    285  1.57   thorpej 	 * If the IPv6 header is not aligned, slurp it up into a new
    286  1.57   thorpej 	 * mbuf with space for link headers, in the event we forward
    287  1.81    rpaulo 	 * it.  Otherwise, if it is aligned, make sure the entire base
    288  1.57   thorpej 	 * IPv6 header is in the first mbuf of the chain.
    289  1.57   thorpej 	 */
    290  1.57   thorpej 	if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
    291  1.57   thorpej 		struct ifnet *inifp = m->m_pkthdr.rcvif;
    292  1.57   thorpej 		if ((m = m_copyup(m, sizeof(struct ip6_hdr),
    293  1.57   thorpej 				  (max_linkhdr + 3) & ~3)) == NULL) {
    294  1.57   thorpej 			/* XXXJRT new stat, please */
    295  1.57   thorpej 			ip6stat.ip6s_toosmall++;
    296  1.57   thorpej 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
    297  1.57   thorpej 			return;
    298  1.57   thorpej 		}
    299  1.57   thorpej 	} else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
    300  1.57   thorpej 		struct ifnet *inifp = m->m_pkthdr.rcvif;
    301  1.55    itojun 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
    302   1.9    itojun 			ip6stat.ip6s_toosmall++;
    303   1.9    itojun 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
    304   1.9    itojun 			return;
    305   1.9    itojun 		}
    306   1.2    itojun 	}
    307   1.2    itojun 
    308   1.2    itojun 	ip6 = mtod(m, struct ip6_hdr *);
    309   1.2    itojun 
    310   1.2    itojun 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
    311   1.2    itojun 		ip6stat.ip6s_badvers++;
    312   1.9    itojun 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
    313   1.2    itojun 		goto bad;
    314   1.2    itojun 	}
    315  1.15   darrenr 
    316  1.15   darrenr #ifdef PFIL_HOOKS
    317  1.15   darrenr 	/*
    318  1.15   darrenr 	 * Run through list of hooks for input packets.  If there are any
    319  1.15   darrenr 	 * filters which require that additional packets in the flow are
    320  1.15   darrenr 	 * not fast-forwarded, they must clear the M_CANFASTFWD flag.
    321  1.15   darrenr 	 * Note that filters must _never_ set this flag, as another filter
    322  1.15   darrenr 	 * in the list may have previously cleared it.
    323  1.15   darrenr 	 */
    324  1.39    itojun 	/*
    325  1.39    itojun 	 * let ipfilter look at packet on the wire,
    326  1.39    itojun 	 * not the decapsulated packet.
    327  1.39    itojun 	 */
    328  1.39    itojun #ifdef IPSEC
    329  1.42    itojun 	if (!ipsec_getnhist(m))
    330  1.39    itojun #else
    331  1.39    itojun 	if (1)
    332  1.39    itojun #endif
    333  1.39    itojun 	{
    334  1.64    itojun 		struct in6_addr odst;
    335  1.64    itojun 
    336  1.64    itojun 		odst = ip6->ip6_dst;
    337  1.39    itojun 		if (pfil_run_hooks(&inet6_pfil_hook, &m, m->m_pkthdr.rcvif,
    338  1.39    itojun 				   PFIL_IN) != 0)
    339  1.39    itojun 			return;
    340  1.39    itojun 		if (m == NULL)
    341  1.39    itojun 			return;
    342  1.39    itojun 		ip6 = mtod(m, struct ip6_hdr *);
    343  1.64    itojun 		srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst);
    344  1.39    itojun 	}
    345  1.15   darrenr #endif /* PFIL_HOOKS */
    346  1.15   darrenr 
    347   1.2    itojun 	ip6stat.ip6s_nxthist[ip6->ip6_nxt]++;
    348   1.2    itojun 
    349  1.30   thorpej #ifdef ALTQ
    350  1.30   thorpej 	if (altq_input != NULL && (*altq_input)(m, AF_INET6) == 0) {
    351  1.30   thorpej 		/* packet is dropped by traffic conditioner */
    352  1.30   thorpej 		return;
    353   1.9    itojun 	}
    354   1.9    itojun #endif
    355   1.9    itojun 
    356   1.2    itojun 	/*
    357  1.44    itojun 	 * Check against address spoofing/corruption.
    358   1.2    itojun 	 */
    359   1.2    itojun 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) ||
    360   1.2    itojun 	    IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) {
    361  1.55    itojun 		/*
    362  1.55    itojun 		 * XXX: "badscope" is not very suitable for a multicast source.
    363  1.55    itojun 		 */
    364   1.2    itojun 		ip6stat.ip6s_badscope++;
    365   1.9    itojun 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
    366   1.2    itojun 		goto bad;
    367   1.2    itojun 	}
    368  1.13    itojun 	/*
    369  1.44    itojun 	 * The following check is not documented in specs.  A malicious
    370  1.44    itojun 	 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
    371  1.44    itojun 	 * and bypass security checks (act as if it was from 127.0.0.1 by using
    372  1.44    itojun 	 * IPv6 src ::ffff:127.0.0.1).  Be cautious.
    373  1.35    itojun 	 *
    374  1.44    itojun 	 * This check chokes if we are in an SIIT cloud.  As none of BSDs
    375  1.44    itojun 	 * support IPv4-less kernel compilation, we cannot support SIIT
    376  1.44    itojun 	 * environment at all.  So, it makes more sense for us to reject any
    377  1.44    itojun 	 * malicious packets for non-SIIT environment, than try to do a
    378  1.52       wiz 	 * partial support for SIIT environment.
    379  1.13    itojun 	 */
    380  1.13    itojun 	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
    381  1.13    itojun 	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
    382  1.13    itojun 		ip6stat.ip6s_badscope++;
    383  1.13    itojun 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
    384  1.13    itojun 		goto bad;
    385  1.13    itojun 	}
    386  1.17    itojun #if 0
    387  1.13    itojun 	/*
    388  1.17    itojun 	 * Reject packets with IPv4 compatible addresses (auto tunnel).
    389  1.17    itojun 	 *
    390  1.17    itojun 	 * The code forbids auto tunnel relay case in RFC1933 (the check is
    391  1.17    itojun 	 * stronger than RFC1933).  We may want to re-enable it if mech-xx
    392  1.17    itojun 	 * is revised to forbid relaying case.
    393  1.13    itojun 	 */
    394  1.13    itojun 	if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) ||
    395  1.13    itojun 	    IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) {
    396  1.13    itojun 		ip6stat.ip6s_badscope++;
    397  1.13    itojun 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
    398  1.13    itojun 		goto bad;
    399  1.13    itojun 	}
    400  1.13    itojun #endif
    401  1.35    itojun 
    402   1.2    itojun 	/*
    403  1.82      yamt 	 * Disambiguate address scope zones (if there is ambiguity).
    404  1.82      yamt 	 * We first make sure that the original source or destination address
    405  1.82      yamt 	 * is not in our internal form for scoped addresses.  Such addresses
    406  1.82      yamt 	 * are not necessarily invalid spec-wise, but we cannot accept them due
    407  1.82      yamt 	 * to the usage conflict.
    408  1.82      yamt 	 * in6_setscope() then also checks and rejects the cases where src or
    409  1.82      yamt 	 * dst are the loopback address and the receiving interface
    410  1.82      yamt 	 * is not loopback.
    411  1.82      yamt 	 */
    412  1.82      yamt 	if (in6_clearscope(&ip6->ip6_src) || in6_clearscope(&ip6->ip6_dst)) {
    413  1.82      yamt 		ip6stat.ip6s_badscope++; /* XXX */
    414  1.82      yamt 		goto bad;
    415  1.82      yamt 	}
    416  1.82      yamt 	if (in6_setscope(&ip6->ip6_src, m->m_pkthdr.rcvif, NULL) ||
    417  1.82      yamt 	    in6_setscope(&ip6->ip6_dst, m->m_pkthdr.rcvif, NULL)) {
    418  1.82      yamt 		ip6stat.ip6s_badscope++;
    419  1.82      yamt 		goto bad;
    420  1.82      yamt 	}
    421  1.82      yamt 
    422  1.82      yamt 	/*
    423   1.2    itojun 	 * Multicast check
    424   1.2    itojun 	 */
    425   1.2    itojun 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
    426   1.2    itojun 	  	struct	in6_multi *in6m = 0;
    427   1.9    itojun 
    428   1.9    itojun 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast);
    429   1.2    itojun 		/*
    430   1.2    itojun 		 * See if we belong to the destination multicast group on the
    431   1.2    itojun 		 * arrival interface.
    432   1.2    itojun 		 */
    433   1.2    itojun 		IN6_LOOKUP_MULTI(ip6->ip6_dst, m->m_pkthdr.rcvif, in6m);
    434   1.2    itojun 		if (in6m)
    435   1.2    itojun 			ours = 1;
    436   1.2    itojun 		else if (!ip6_mrouter) {
    437   1.2    itojun 			ip6stat.ip6s_notmember++;
    438   1.2    itojun 			ip6stat.ip6s_cantforward++;
    439   1.9    itojun 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
    440   1.2    itojun 			goto bad;
    441   1.2    itojun 		}
    442   1.9    itojun 		deliverifp = m->m_pkthdr.rcvif;
    443   1.2    itojun 		goto hbhcheck;
    444   1.2    itojun 	}
    445   1.2    itojun 
    446   1.2    itojun 	/*
    447   1.2    itojun 	 *  Unicast check
    448   1.2    itojun 	 */
    449  1.22    itojun 	if (ip6_forward_rt.ro_rt != NULL &&
    450  1.55    itojun 	    (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) != 0 &&
    451  1.22    itojun 	    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
    452  1.72    itojun 	    &((struct sockaddr_in6 *)(&ip6_forward_rt.ro_dst))->sin6_addr))
    453  1.25    itojun 		ip6stat.ip6s_forward_cachehit++;
    454  1.22    itojun 	else {
    455  1.35    itojun 		struct sockaddr_in6 *dst6;
    456  1.35    itojun 
    457   1.2    itojun 		if (ip6_forward_rt.ro_rt) {
    458  1.22    itojun 			/* route is down or destination is different */
    459  1.25    itojun 			ip6stat.ip6s_forward_cachemiss++;
    460   1.2    itojun 			RTFREE(ip6_forward_rt.ro_rt);
    461   1.2    itojun 			ip6_forward_rt.ro_rt = 0;
    462   1.2    itojun 		}
    463  1.22    itojun 
    464   1.2    itojun 		bzero(&ip6_forward_rt.ro_dst, sizeof(struct sockaddr_in6));
    465  1.35    itojun 		dst6 = (struct sockaddr_in6 *)&ip6_forward_rt.ro_dst;
    466  1.35    itojun 		dst6->sin6_len = sizeof(struct sockaddr_in6);
    467  1.35    itojun 		dst6->sin6_family = AF_INET6;
    468  1.35    itojun 		dst6->sin6_addr = ip6->ip6_dst;
    469   1.2    itojun 
    470   1.9    itojun 		rtalloc((struct route *)&ip6_forward_rt);
    471   1.2    itojun 	}
    472   1.2    itojun 
    473   1.2    itojun #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key))
    474   1.2    itojun 
    475   1.2    itojun 	/*
    476   1.2    itojun 	 * Accept the packet if the forwarding interface to the destination
    477   1.2    itojun 	 * according to the routing table is the loopback interface,
    478   1.2    itojun 	 * unless the associated route has a gateway.
    479   1.2    itojun 	 * Note that this approach causes to accept a packet if there is a
    480   1.2    itojun 	 * route to the loopback interface for the destination of the packet.
    481   1.2    itojun 	 * But we think it's even useful in some situations, e.g. when using
    482   1.2    itojun 	 * a special daemon which wants to intercept the packet.
    483   1.2    itojun 	 */
    484   1.2    itojun 	if (ip6_forward_rt.ro_rt &&
    485   1.2    itojun 	    (ip6_forward_rt.ro_rt->rt_flags &
    486   1.2    itojun 	     (RTF_HOST|RTF_GATEWAY)) == RTF_HOST &&
    487  1.55    itojun 	    !(ip6_forward_rt.ro_rt->rt_flags & RTF_CLONED) &&
    488   1.2    itojun #if 0
    489   1.2    itojun 	    /*
    490   1.2    itojun 	     * The check below is redundant since the comparison of
    491   1.2    itojun 	     * the destination and the key of the rtentry has
    492   1.2    itojun 	     * already done through looking up the routing table.
    493   1.2    itojun 	     */
    494   1.2    itojun 	    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
    495  1.55    itojun 	    &rt6_key(ip6_forward_rt.ro_rt)->sin6_addr) &&
    496   1.2    itojun #endif
    497   1.9    itojun 	    ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_LOOP) {
    498   1.2    itojun 		struct in6_ifaddr *ia6 =
    499   1.2    itojun 			(struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa;
    500   1.2    itojun 		if (ia6->ia6_flags & IN6_IFF_ANYCAST)
    501   1.2    itojun 			m->m_flags |= M_ANYCAST6;
    502  1.24    itojun 		/*
    503  1.24    itojun 		 * packets to a tentative, duplicated, or somehow invalid
    504  1.24    itojun 		 * address must not be accepted.
    505  1.24    itojun 		 */
    506   1.2    itojun 		if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) {
    507  1.24    itojun 			/* this address is ready */
    508   1.2    itojun 			ours = 1;
    509   1.9    itojun 			deliverifp = ia6->ia_ifp;	/* correct? */
    510   1.2    itojun 			goto hbhcheck;
    511   1.2    itojun 		} else {
    512  1.24    itojun 			/* address is not ready, so discard the packet. */
    513  1.34    itojun 			nd6log((LOG_INFO,
    514  1.27    itojun 			    "ip6_input: packet to an unready address %s->%s\n",
    515  1.24    itojun 			    ip6_sprintf(&ip6->ip6_src),
    516  1.34    itojun 			    ip6_sprintf(&ip6->ip6_dst)));
    517  1.24    itojun 
    518  1.24    itojun 			goto bad;
    519   1.2    itojun 		}
    520   1.2    itojun 	}
    521   1.2    itojun 
    522   1.2    itojun 	/*
    523  1.55    itojun 	 * FAITH (Firewall Aided Internet Translator)
    524   1.2    itojun 	 */
    525   1.2    itojun #if defined(NFAITH) && 0 < NFAITH
    526   1.2    itojun 	if (ip6_keepfaith) {
    527  1.71    itojun 		if (ip6_forward_rt.ro_rt && ip6_forward_rt.ro_rt->rt_ifp &&
    528  1.71    itojun 		    ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) {
    529   1.2    itojun 			/* XXX do we need more sanity checks? */
    530   1.2    itojun 			ours = 1;
    531  1.45    itojun 			deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /* faith */
    532   1.9    itojun 			goto hbhcheck;
    533   1.9    itojun 		}
    534   1.9    itojun 	}
    535   1.9    itojun #endif
    536   1.9    itojun 
    537   1.9    itojun #if 0
    538   1.9    itojun     {
    539   1.9    itojun 	/*
    540   1.9    itojun 	 * Last resort: check in6_ifaddr for incoming interface.
    541   1.9    itojun 	 * The code is here until I update the "goto ours hack" code above
    542   1.9    itojun 	 * working right.
    543   1.9    itojun 	 */
    544   1.9    itojun 	struct ifaddr *ifa;
    545   1.9    itojun 	for (ifa = m->m_pkthdr.rcvif->if_addrlist.tqh_first;
    546   1.9    itojun 	     ifa;
    547   1.9    itojun 	     ifa = ifa->ifa_list.tqe_next) {
    548   1.9    itojun 		if (ifa->ifa_addr == NULL)
    549   1.9    itojun 			continue;	/* just for safety */
    550   1.9    itojun 		if (ifa->ifa_addr->sa_family != AF_INET6)
    551   1.9    itojun 			continue;
    552   1.9    itojun 		if (IN6_ARE_ADDR_EQUAL(IFA_IN6(ifa), &ip6->ip6_dst)) {
    553   1.9    itojun 			ours = 1;
    554   1.9    itojun 			deliverifp = ifa->ifa_ifp;
    555   1.2    itojun 			goto hbhcheck;
    556   1.2    itojun 		}
    557   1.2    itojun 	}
    558   1.9    itojun     }
    559   1.2    itojun #endif
    560   1.2    itojun 
    561   1.2    itojun 	/*
    562   1.2    itojun 	 * Now there is no reason to process the packet if it's not our own
    563   1.2    itojun 	 * and we're not a router.
    564   1.2    itojun 	 */
    565   1.2    itojun 	if (!ip6_forwarding) {
    566   1.2    itojun 		ip6stat.ip6s_cantforward++;
    567   1.9    itojun 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
    568   1.2    itojun 		goto bad;
    569   1.2    itojun 	}
    570   1.2    itojun 
    571   1.2    itojun   hbhcheck:
    572   1.2    itojun 	/*
    573  1.81    rpaulo 	 * record address information into m_tag, if we don't have one yet.
    574  1.81    rpaulo 	 * note that we are unable to record it, if the address is not listed
    575  1.81    rpaulo 	 * as our interface address (e.g. multicast addresses, addresses
    576  1.81    rpaulo 	 * within FAITH prefixes and such).
    577  1.81    rpaulo 	 */
    578  1.81    rpaulo 	if (deliverifp && !ip6_getdstifaddr(m)) {
    579  1.81    rpaulo 		struct in6_ifaddr *ia6;
    580  1.81    rpaulo 
    581  1.81    rpaulo 		ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
    582  1.81    rpaulo 		if (ia6) {
    583  1.81    rpaulo 			if (!ip6_setdstifaddr(m, ia6)) {
    584  1.81    rpaulo 				/*
    585  1.81    rpaulo 				 * XXX maybe we should drop the packet here,
    586  1.81    rpaulo 				 * as we could not provide enough information
    587  1.81    rpaulo 				 * to the upper layers.
    588  1.81    rpaulo 				 */
    589  1.81    rpaulo 			}
    590  1.81    rpaulo 		}
    591  1.81    rpaulo 	}
    592  1.81    rpaulo 
    593  1.81    rpaulo 	/*
    594   1.2    itojun 	 * Process Hop-by-Hop options header if it's contained.
    595   1.2    itojun 	 * m may be modified in ip6_hopopts_input().
    596   1.2    itojun 	 * If a JumboPayload option is included, plen will also be modified.
    597   1.2    itojun 	 */
    598   1.2    itojun 	plen = (u_int32_t)ntohs(ip6->ip6_plen);
    599   1.2    itojun 	if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
    600   1.9    itojun 		struct ip6_hbh *hbh;
    601   1.9    itojun 
    602   1.9    itojun 		if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) {
    603   1.9    itojun #if 0	/*touches NULL pointer*/
    604   1.9    itojun 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
    605   1.9    itojun #endif
    606   1.2    itojun 			return;	/* m have already been freed */
    607   1.9    itojun 		}
    608  1.22    itojun 
    609   1.2    itojun 		/* adjust pointer */
    610   1.2    itojun 		ip6 = mtod(m, struct ip6_hdr *);
    611  1.22    itojun 
    612  1.22    itojun 		/*
    613  1.49    itojun 		 * if the payload length field is 0 and the next header field
    614  1.22    itojun 		 * indicates Hop-by-Hop Options header, then a Jumbo Payload
    615  1.22    itojun 		 * option MUST be included.
    616  1.22    itojun 		 */
    617  1.22    itojun 		if (ip6->ip6_plen == 0 && plen == 0) {
    618  1.22    itojun 			/*
    619  1.22    itojun 			 * Note that if a valid jumbo payload option is
    620  1.83    rpaulo 			 * contained, ip6_hopopts_input() must set a valid
    621  1.55    itojun 			 * (non-zero) payload length to the variable plen.
    622  1.22    itojun 			 */
    623  1.22    itojun 			ip6stat.ip6s_badoptions++;
    624  1.22    itojun 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
    625  1.22    itojun 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
    626  1.22    itojun 			icmp6_error(m, ICMP6_PARAM_PROB,
    627  1.22    itojun 				    ICMP6_PARAMPROB_HEADER,
    628  1.22    itojun 				    (caddr_t)&ip6->ip6_plen - (caddr_t)ip6);
    629  1.22    itojun 			return;
    630  1.22    itojun 		}
    631   1.9    itojun 		IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
    632   1.9    itojun 			sizeof(struct ip6_hbh));
    633   1.9    itojun 		if (hbh == NULL) {
    634   1.9    itojun 			ip6stat.ip6s_tooshort++;
    635   1.9    itojun 			return;
    636   1.9    itojun 		}
    637  1.57   thorpej 		KASSERT(IP6_HDR_ALIGNED_P(hbh));
    638   1.9    itojun 		nxt = hbh->ip6h_nxt;
    639   1.2    itojun 
    640   1.2    itojun 		/*
    641   1.2    itojun 		 * accept the packet if a router alert option is included
    642   1.2    itojun 		 * and we act as an IPv6 router.
    643   1.2    itojun 		 */
    644   1.5    itojun 		if (rtalert != ~0 && ip6_forwarding)
    645   1.2    itojun 			ours = 1;
    646   1.2    itojun 	} else
    647   1.2    itojun 		nxt = ip6->ip6_nxt;
    648   1.2    itojun 
    649   1.2    itojun 	/*
    650   1.2    itojun 	 * Check that the amount of data in the buffers
    651   1.2    itojun 	 * is as at least much as the IPv6 header would have us expect.
    652   1.2    itojun 	 * Trim mbufs if longer than we expect.
    653   1.2    itojun 	 * Drop packet if shorter than we expect.
    654   1.2    itojun 	 */
    655   1.2    itojun 	if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
    656   1.2    itojun 		ip6stat.ip6s_tooshort++;
    657   1.9    itojun 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
    658   1.2    itojun 		goto bad;
    659   1.2    itojun 	}
    660   1.2    itojun 	if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
    661   1.2    itojun 		if (m->m_len == m->m_pkthdr.len) {
    662   1.2    itojun 			m->m_len = sizeof(struct ip6_hdr) + plen;
    663   1.2    itojun 			m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
    664   1.2    itojun 		} else
    665   1.2    itojun 			m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len);
    666   1.2    itojun 	}
    667   1.2    itojun 
    668   1.2    itojun 	/*
    669   1.2    itojun 	 * Forward if desirable.
    670   1.2    itojun 	 */
    671   1.2    itojun 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
    672   1.2    itojun 		/*
    673   1.2    itojun 		 * If we are acting as a multicast router, all
    674   1.2    itojun 		 * incoming multicast packets are passed to the
    675   1.2    itojun 		 * kernel-level multicast forwarding function.
    676   1.2    itojun 		 * The packet is returned (relatively) intact; if
    677   1.2    itojun 		 * ip6_mforward() returns a non-zero value, the packet
    678   1.2    itojun 		 * must be discarded, else it may be accepted below.
    679   1.2    itojun 		 */
    680   1.2    itojun 		if (ip6_mrouter && ip6_mforward(ip6, m->m_pkthdr.rcvif, m)) {
    681   1.2    itojun 			ip6stat.ip6s_cantforward++;
    682   1.2    itojun 			m_freem(m);
    683   1.2    itojun 			return;
    684   1.2    itojun 		}
    685   1.2    itojun 		if (!ours) {
    686   1.2    itojun 			m_freem(m);
    687   1.2    itojun 			return;
    688   1.2    itojun 		}
    689  1.22    itojun 	} else if (!ours) {
    690  1.64    itojun 		ip6_forward(m, srcrt);
    691   1.2    itojun 		return;
    692  1.56    itojun 	}
    693  1.25    itojun 
    694  1.25    itojun 	ip6 = mtod(m, struct ip6_hdr *);
    695  1.25    itojun 
    696  1.25    itojun 	/*
    697  1.25    itojun 	 * Malicious party may be able to use IPv4 mapped addr to confuse
    698  1.25    itojun 	 * tcp/udp stack and bypass security checks (act as if it was from
    699  1.25    itojun 	 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1).  Be cautious.
    700  1.25    itojun 	 *
    701  1.25    itojun 	 * For SIIT end node behavior, you may want to disable the check.
    702  1.25    itojun 	 * However, you will  become vulnerable to attacks using IPv4 mapped
    703  1.25    itojun 	 * source.
    704  1.25    itojun 	 */
    705  1.25    itojun 	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
    706  1.25    itojun 	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
    707  1.25    itojun 		ip6stat.ip6s_badscope++;
    708  1.25    itojun 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
    709  1.25    itojun 		goto bad;
    710  1.25    itojun 	}
    711   1.2    itojun 
    712   1.2    itojun 	/*
    713   1.2    itojun 	 * Tell launch routine the next header
    714   1.2    itojun 	 */
    715  1.12    itojun #ifdef IFA_STATS
    716  1.28    itojun 	if (deliverifp != NULL) {
    717   1.9    itojun 		struct in6_ifaddr *ia6;
    718   1.9    itojun 		ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
    719   1.9    itojun 		if (ia6)
    720   1.9    itojun 			ia6->ia_ifa.ifa_data.ifad_inbytes += m->m_pkthdr.len;
    721   1.9    itojun 	}
    722   1.9    itojun #endif
    723   1.2    itojun 	ip6stat.ip6s_delivered++;
    724   1.9    itojun 	in6_ifstat_inc(deliverifp, ifs6_in_deliver);
    725   1.2    itojun 	nest = 0;
    726  1.40    itojun 
    727   1.2    itojun 	while (nxt != IPPROTO_DONE) {
    728   1.2    itojun 		if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
    729   1.2    itojun 			ip6stat.ip6s_toomanyhdr++;
    730   1.2    itojun 			goto bad;
    731   1.2    itojun 		}
    732   1.8    itojun 
    733   1.8    itojun 		/*
    734   1.8    itojun 		 * protection against faulty packet - there should be
    735   1.8    itojun 		 * more sanity checks in header chain processing.
    736   1.8    itojun 		 */
    737   1.8    itojun 		if (m->m_pkthdr.len < off) {
    738   1.8    itojun 			ip6stat.ip6s_tooshort++;
    739   1.9    itojun 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
    740   1.8    itojun 			goto bad;
    741   1.8    itojun 		}
    742   1.8    itojun 
    743  1.37    itojun #ifdef IPSEC
    744  1.37    itojun 		/*
    745  1.37    itojun 		 * enforce IPsec policy checking if we are seeing last header.
    746  1.37    itojun 		 * note that we do not visit this with protocols with pcb layer
    747  1.37    itojun 		 * code - like udp/tcp/raw ip.
    748  1.37    itojun 		 */
    749  1.37    itojun 		if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
    750  1.37    itojun 		    ipsec6_in_reject(m, NULL)) {
    751  1.37    itojun 			ipsec6stat.in_polvio++;
    752  1.37    itojun 			goto bad;
    753  1.37    itojun 		}
    754  1.37    itojun #endif
    755  1.56    itojun 
    756   1.2    itojun 		nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt);
    757   1.2    itojun 	}
    758   1.2    itojun 	return;
    759   1.2    itojun  bad:
    760   1.2    itojun 	m_freem(m);
    761   1.2    itojun }
    762   1.2    itojun 
    763   1.2    itojun /*
    764  1.81    rpaulo  * set/grab in6_ifaddr correspond to IPv6 destination address.
    765  1.81    rpaulo  */
    766  1.81    rpaulo static struct m_tag *
    767  1.81    rpaulo ip6_setdstifaddr(m, ia6)
    768  1.81    rpaulo 	struct mbuf *m;
    769  1.81    rpaulo 	struct in6_ifaddr *ia6;
    770  1.81    rpaulo {
    771  1.81    rpaulo 	struct m_tag *mtag;
    772  1.81    rpaulo 
    773  1.81    rpaulo 	mtag = ip6_addaux(m);
    774  1.81    rpaulo 	if (mtag)
    775  1.81    rpaulo 		((struct ip6aux *)(mtag + 1))->ip6a_dstia6 = ia6;
    776  1.81    rpaulo 	return mtag;	/* NULL if failed to set */
    777  1.81    rpaulo }
    778  1.81    rpaulo 
    779  1.81    rpaulo struct in6_ifaddr *
    780  1.81    rpaulo ip6_getdstifaddr(m)
    781  1.81    rpaulo 	struct mbuf *m;
    782  1.81    rpaulo {
    783  1.81    rpaulo 	struct m_tag *mtag;
    784  1.81    rpaulo 
    785  1.81    rpaulo 	mtag = ip6_findaux(m);
    786  1.81    rpaulo 	if (mtag)
    787  1.81    rpaulo 		return ((struct ip6aux *)(mtag + 1))->ip6a_dstia6;
    788  1.81    rpaulo 	else
    789  1.81    rpaulo 		return NULL;
    790  1.81    rpaulo }
    791  1.81    rpaulo 
    792  1.81    rpaulo /*
    793   1.2    itojun  * Hop-by-Hop options header processing. If a valid jumbo payload option is
    794   1.2    itojun  * included, the real payload length will be stored in plenp.
    795   1.2    itojun  */
    796   1.2    itojun static int
    797   1.2    itojun ip6_hopopts_input(plenp, rtalertp, mp, offp)
    798   1.2    itojun 	u_int32_t *plenp;
    799   1.5    itojun 	u_int32_t *rtalertp;	/* XXX: should be stored more smart way */
    800   1.2    itojun 	struct mbuf **mp;
    801   1.2    itojun 	int *offp;
    802   1.2    itojun {
    803  1.35    itojun 	struct mbuf *m = *mp;
    804   1.2    itojun 	int off = *offp, hbhlen;
    805   1.2    itojun 	struct ip6_hbh *hbh;
    806   1.2    itojun 
    807   1.2    itojun 	/* validation of the length of the header */
    808   1.9    itojun 	IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m,
    809   1.9    itojun 		sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
    810   1.9    itojun 	if (hbh == NULL) {
    811   1.9    itojun 		ip6stat.ip6s_tooshort++;
    812   1.9    itojun 		return -1;
    813   1.9    itojun 	}
    814   1.9    itojun 	hbhlen = (hbh->ip6h_len + 1) << 3;
    815   1.9    itojun 	IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
    816   1.9    itojun 		hbhlen);
    817   1.9    itojun 	if (hbh == NULL) {
    818   1.9    itojun 		ip6stat.ip6s_tooshort++;
    819   1.9    itojun 		return -1;
    820   1.9    itojun 	}
    821  1.57   thorpej 	KASSERT(IP6_HDR_ALIGNED_P(hbh));
    822   1.2    itojun 	off += hbhlen;
    823   1.2    itojun 	hbhlen -= sizeof(struct ip6_hbh);
    824   1.2    itojun 
    825   1.2    itojun 	if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
    826   1.2    itojun 				hbhlen, rtalertp, plenp) < 0)
    827  1.58    itojun 		return (-1);
    828   1.2    itojun 
    829   1.2    itojun 	*offp = off;
    830   1.2    itojun 	*mp = m;
    831  1.58    itojun 	return (0);
    832   1.2    itojun }
    833   1.2    itojun 
    834   1.2    itojun /*
    835   1.2    itojun  * Search header for all Hop-by-hop options and process each option.
    836   1.2    itojun  * This function is separate from ip6_hopopts_input() in order to
    837   1.2    itojun  * handle a case where the sending node itself process its hop-by-hop
    838   1.2    itojun  * options header. In such a case, the function is called from ip6_output().
    839  1.55    itojun  *
    840  1.55    itojun  * The function assumes that hbh header is located right after the IPv6 header
    841  1.55    itojun  * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
    842  1.55    itojun  * opthead + hbhlen is located in continuous memory region.
    843   1.2    itojun  */
    844   1.2    itojun int
    845   1.2    itojun ip6_process_hopopts(m, opthead, hbhlen, rtalertp, plenp)
    846   1.2    itojun 	struct mbuf *m;
    847   1.2    itojun 	u_int8_t *opthead;
    848   1.2    itojun 	int hbhlen;
    849   1.5    itojun 	u_int32_t *rtalertp;
    850   1.2    itojun 	u_int32_t *plenp;
    851   1.2    itojun {
    852   1.2    itojun 	struct ip6_hdr *ip6;
    853   1.2    itojun 	int optlen = 0;
    854   1.2    itojun 	u_int8_t *opt = opthead;
    855   1.2    itojun 	u_int16_t rtalert_val;
    856  1.22    itojun 	u_int32_t jumboplen;
    857  1.55    itojun 	const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh);
    858   1.2    itojun 
    859   1.2    itojun 	for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) {
    860  1.35    itojun 		switch (*opt) {
    861  1.35    itojun 		case IP6OPT_PAD1:
    862  1.35    itojun 			optlen = 1;
    863  1.35    itojun 			break;
    864  1.35    itojun 		case IP6OPT_PADN:
    865  1.35    itojun 			if (hbhlen < IP6OPT_MINLEN) {
    866  1.35    itojun 				ip6stat.ip6s_toosmall++;
    867  1.35    itojun 				goto bad;
    868  1.35    itojun 			}
    869  1.35    itojun 			optlen = *(opt + 1) + 2;
    870  1.35    itojun 			break;
    871  1.35    itojun 		case IP6OPT_RTALERT:
    872  1.35    itojun 			/* XXX may need check for alignment */
    873  1.35    itojun 			if (hbhlen < IP6OPT_RTALERT_LEN) {
    874  1.35    itojun 				ip6stat.ip6s_toosmall++;
    875  1.35    itojun 				goto bad;
    876  1.35    itojun 			}
    877  1.35    itojun 			if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) {
    878  1.55    itojun 				/* XXX stat */
    879  1.55    itojun 				icmp6_error(m, ICMP6_PARAM_PROB,
    880  1.55    itojun 				    ICMP6_PARAMPROB_HEADER,
    881  1.55    itojun 				    erroff + opt + 1 - opthead);
    882  1.55    itojun 				return (-1);
    883  1.35    itojun 			}
    884  1.35    itojun 			optlen = IP6OPT_RTALERT_LEN;
    885  1.35    itojun 			bcopy((caddr_t)(opt + 2), (caddr_t)&rtalert_val, 2);
    886  1.35    itojun 			*rtalertp = ntohs(rtalert_val);
    887  1.35    itojun 			break;
    888  1.35    itojun 		case IP6OPT_JUMBO:
    889  1.22    itojun 			/* XXX may need check for alignment */
    890  1.22    itojun 			if (hbhlen < IP6OPT_JUMBO_LEN) {
    891  1.22    itojun 				ip6stat.ip6s_toosmall++;
    892  1.22    itojun 				goto bad;
    893  1.22    itojun 			}
    894  1.35    itojun 			if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) {
    895  1.55    itojun 				/* XXX stat */
    896  1.55    itojun 				icmp6_error(m, ICMP6_PARAM_PROB,
    897  1.55    itojun 				    ICMP6_PARAMPROB_HEADER,
    898  1.55    itojun 				    erroff + opt + 1 - opthead);
    899  1.55    itojun 				return (-1);
    900  1.35    itojun 			}
    901  1.22    itojun 			optlen = IP6OPT_JUMBO_LEN;
    902  1.22    itojun 
    903  1.22    itojun 			/*
    904  1.22    itojun 			 * IPv6 packets that have non 0 payload length
    905  1.35    itojun 			 * must not contain a jumbo payload option.
    906  1.22    itojun 			 */
    907  1.22    itojun 			ip6 = mtod(m, struct ip6_hdr *);
    908  1.22    itojun 			if (ip6->ip6_plen) {
    909  1.22    itojun 				ip6stat.ip6s_badoptions++;
    910  1.22    itojun 				icmp6_error(m, ICMP6_PARAM_PROB,
    911  1.55    itojun 				    ICMP6_PARAMPROB_HEADER,
    912  1.55    itojun 				    erroff + opt - opthead);
    913  1.55    itojun 				return (-1);
    914  1.22    itojun 			}
    915   1.2    itojun 
    916  1.22    itojun 			/*
    917  1.22    itojun 			 * We may see jumbolen in unaligned location, so
    918  1.22    itojun 			 * we'd need to perform bcopy().
    919  1.22    itojun 			 */
    920  1.22    itojun 			bcopy(opt + 2, &jumboplen, sizeof(jumboplen));
    921  1.22    itojun 			jumboplen = (u_int32_t)htonl(jumboplen);
    922  1.22    itojun 
    923  1.22    itojun #if 1
    924  1.22    itojun 			/*
    925  1.22    itojun 			 * if there are multiple jumbo payload options,
    926  1.22    itojun 			 * *plenp will be non-zero and the packet will be
    927  1.22    itojun 			 * rejected.
    928  1.22    itojun 			 * the behavior may need some debate in ipngwg -
    929  1.22    itojun 			 * multiple options does not make sense, however,
    930  1.22    itojun 			 * there's no explicit mention in specification.
    931  1.22    itojun 			 */
    932  1.22    itojun 			if (*plenp != 0) {
    933  1.22    itojun 				ip6stat.ip6s_badoptions++;
    934  1.22    itojun 				icmp6_error(m, ICMP6_PARAM_PROB,
    935  1.55    itojun 				    ICMP6_PARAMPROB_HEADER,
    936  1.55    itojun 				    erroff + opt + 2 - opthead);
    937  1.55    itojun 				return (-1);
    938  1.22    itojun 			}
    939   1.8    itojun #endif
    940   1.2    itojun 
    941  1.22    itojun 			/*
    942  1.22    itojun 			 * jumbo payload length must be larger than 65535.
    943  1.22    itojun 			 */
    944  1.22    itojun 			if (jumboplen <= IPV6_MAXPACKET) {
    945  1.22    itojun 				ip6stat.ip6s_badoptions++;
    946  1.22    itojun 				icmp6_error(m, ICMP6_PARAM_PROB,
    947  1.55    itojun 				    ICMP6_PARAMPROB_HEADER,
    948  1.55    itojun 				    erroff + opt + 2 - opthead);
    949  1.55    itojun 				return (-1);
    950  1.22    itojun 			}
    951  1.22    itojun 			*plenp = jumboplen;
    952  1.22    itojun 
    953  1.22    itojun 			break;
    954  1.35    itojun 		default:		/* unknown option */
    955  1.35    itojun 			if (hbhlen < IP6OPT_MINLEN) {
    956  1.35    itojun 				ip6stat.ip6s_toosmall++;
    957  1.35    itojun 				goto bad;
    958  1.35    itojun 			}
    959  1.55    itojun 			optlen = ip6_unknown_opt(opt, m,
    960  1.55    itojun 			    erroff + opt - opthead);
    961  1.55    itojun 			if (optlen == -1)
    962  1.55    itojun 				return (-1);
    963  1.35    itojun 			optlen += 2;
    964  1.35    itojun 			break;
    965   1.2    itojun 		}
    966   1.2    itojun 	}
    967   1.2    itojun 
    968  1.55    itojun 	return (0);
    969   1.2    itojun 
    970   1.2    itojun   bad:
    971   1.2    itojun 	m_freem(m);
    972  1.55    itojun 	return (-1);
    973   1.2    itojun }
    974   1.2    itojun 
    975   1.2    itojun /*
    976   1.2    itojun  * Unknown option processing.
    977   1.2    itojun  * The third argument `off' is the offset from the IPv6 header to the option,
    978   1.2    itojun  * which is necessary if the IPv6 header the and option header and IPv6 header
    979   1.2    itojun  * is not continuous in order to return an ICMPv6 error.
    980   1.2    itojun  */
    981   1.2    itojun int
    982   1.2    itojun ip6_unknown_opt(optp, m, off)
    983   1.2    itojun 	u_int8_t *optp;
    984   1.2    itojun 	struct mbuf *m;
    985   1.2    itojun 	int off;
    986   1.2    itojun {
    987   1.2    itojun 	struct ip6_hdr *ip6;
    988   1.2    itojun 
    989  1.35    itojun 	switch (IP6OPT_TYPE(*optp)) {
    990  1.35    itojun 	case IP6OPT_TYPE_SKIP: /* ignore the option */
    991  1.58    itojun 		return ((int)*(optp + 1));
    992  1.35    itojun 	case IP6OPT_TYPE_DISCARD:	/* silently discard */
    993  1.35    itojun 		m_freem(m);
    994  1.58    itojun 		return (-1);
    995  1.35    itojun 	case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */
    996  1.35    itojun 		ip6stat.ip6s_badoptions++;
    997  1.35    itojun 		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off);
    998  1.58    itojun 		return (-1);
    999  1.35    itojun 	case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */
   1000  1.35    itojun 		ip6stat.ip6s_badoptions++;
   1001  1.35    itojun 		ip6 = mtod(m, struct ip6_hdr *);
   1002  1.35    itojun 		if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
   1003  1.35    itojun 		    (m->m_flags & (M_BCAST|M_MCAST)))
   1004  1.35    itojun 			m_freem(m);
   1005  1.35    itojun 		else
   1006  1.35    itojun 			icmp6_error(m, ICMP6_PARAM_PROB,
   1007  1.35    itojun 				    ICMP6_PARAMPROB_OPTION, off);
   1008  1.58    itojun 		return (-1);
   1009   1.2    itojun 	}
   1010   1.2    itojun 
   1011   1.2    itojun 	m_freem(m);		/* XXX: NOTREACHED */
   1012  1.58    itojun 	return (-1);
   1013   1.2    itojun }
   1014   1.2    itojun 
   1015   1.2    itojun /*
   1016   1.9    itojun  * Create the "control" list for this pcb.
   1017   1.9    itojun  *
   1018   1.9    itojun  * The routine will be called from upper layer handlers like tcp6_input().
   1019   1.9    itojun  * Thus the routine assumes that the caller (tcp6_input) have already
   1020   1.9    itojun  * called IP6_EXTHDR_CHECK() and all the extension headers are located in the
   1021   1.9    itojun  * very first mbuf on the mbuf chain.
   1022   1.9    itojun  * We may want to add some infinite loop prevention or sanity checks for safety.
   1023   1.9    itojun  * (This applies only when you are using KAME mbuf chain restriction, i.e.
   1024   1.9    itojun  * you are using IP6_EXTHDR_CHECK() not m_pulldown())
   1025   1.2    itojun  */
   1026   1.2    itojun void
   1027   1.2    itojun ip6_savecontrol(in6p, mp, ip6, m)
   1028  1.35    itojun 	struct in6pcb *in6p;
   1029  1.35    itojun 	struct mbuf **mp;
   1030  1.35    itojun 	struct ip6_hdr *ip6;
   1031  1.35    itojun 	struct mbuf *m;
   1032   1.2    itojun {
   1033   1.9    itojun 
   1034   1.9    itojun #ifdef SO_TIMESTAMP
   1035   1.2    itojun 	if (in6p->in6p_socket->so_options & SO_TIMESTAMP) {
   1036   1.2    itojun 		struct timeval tv;
   1037   1.2    itojun 
   1038   1.2    itojun 		microtime(&tv);
   1039   1.2    itojun 		*mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
   1040  1.63    itojun 		    SCM_TIMESTAMP, SOL_SOCKET);
   1041   1.2    itojun 		if (*mp)
   1042   1.2    itojun 			mp = &(*mp)->m_next;
   1043   1.2    itojun 	}
   1044   1.9    itojun #endif
   1045   1.2    itojun 	if (in6p->in6p_flags & IN6P_RECVDSTADDR) {
   1046   1.2    itojun 		*mp = sbcreatecontrol((caddr_t) &ip6->ip6_dst,
   1047  1.63    itojun 		    sizeof(struct in6_addr), IPV6_RECVDSTADDR, IPPROTO_IPV6);
   1048   1.2    itojun 		if (*mp)
   1049   1.2    itojun 			mp = &(*mp)->m_next;
   1050   1.2    itojun 	}
   1051   1.2    itojun 
   1052   1.2    itojun #ifdef noyet
   1053   1.2    itojun 	/* options were tossed above */
   1054   1.2    itojun 	if (in6p->in6p_flags & IN6P_RECVOPTS)
   1055   1.2    itojun 		/* broken */
   1056   1.2    itojun 	/* ip6_srcroute doesn't do what we want here, need to fix */
   1057   1.2    itojun 	if (in6p->in6p_flags & IPV6P_RECVRETOPTS)
   1058   1.2    itojun 		/* broken */
   1059   1.2    itojun #endif
   1060   1.2    itojun 
   1061   1.2    itojun 	/* RFC 2292 sec. 5 */
   1062  1.35    itojun 	if ((in6p->in6p_flags & IN6P_PKTINFO) != 0) {
   1063   1.2    itojun 		struct in6_pktinfo pi6;
   1064   1.2    itojun 		bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr));
   1065  1.81    rpaulo 		in6_clearscope(&pi6.ipi6_addr);	/* XXX */
   1066   1.2    itojun 		pi6.ipi6_ifindex = (m && m->m_pkthdr.rcvif)
   1067   1.2    itojun 					? m->m_pkthdr.rcvif->if_index
   1068   1.2    itojun 					: 0;
   1069   1.2    itojun 		*mp = sbcreatecontrol((caddr_t) &pi6,
   1070  1.63    itojun 		    sizeof(struct in6_pktinfo), IPV6_PKTINFO, IPPROTO_IPV6);
   1071   1.2    itojun 		if (*mp)
   1072   1.2    itojun 			mp = &(*mp)->m_next;
   1073   1.2    itojun 	}
   1074   1.2    itojun 	if (in6p->in6p_flags & IN6P_HOPLIMIT) {
   1075   1.2    itojun 		int hlim = ip6->ip6_hlim & 0xff;
   1076  1.63    itojun 		*mp = sbcreatecontrol((caddr_t) &hlim, sizeof(int),
   1077  1.63    itojun 		    IPV6_HOPLIMIT, IPPROTO_IPV6);
   1078   1.2    itojun 		if (*mp)
   1079   1.2    itojun 			mp = &(*mp)->m_next;
   1080   1.2    itojun 	}
   1081   1.2    itojun 	/* IN6P_NEXTHOP - for outgoing packet only */
   1082   1.2    itojun 
   1083   1.2    itojun 	/*
   1084  1.75    itojun 	 * IPV6_HOPOPTS socket option.  Recall that we required super-user
   1085  1.75    itojun 	 * privilege for the option (see ip6_ctloutput), but it might be too
   1086  1.75    itojun 	 * strict, since there might be some hop-by-hop options which can be
   1087  1.75    itojun 	 * returned to normal user.
   1088  1.75    itojun 	 * See also RFC 2292 section 6.
   1089   1.2    itojun 	 */
   1090  1.75    itojun 	if ((in6p->in6p_flags & IN6P_HOPOPTS) != 0) {
   1091   1.2    itojun 		/*
   1092   1.2    itojun 		 * Check if a hop-by-hop options header is contatined in the
   1093   1.2    itojun 		 * received packet, and if so, store the options as ancillary
   1094   1.2    itojun 		 * data. Note that a hop-by-hop options header must be
   1095   1.2    itojun 		 * just after the IPv6 header, which fact is assured through
   1096   1.2    itojun 		 * the IPv6 input processing.
   1097   1.2    itojun 		 */
   1098  1.78  christos 		struct ip6_hdr *xip6 = mtod(m, struct ip6_hdr *);
   1099  1.78  christos 		if (xip6->ip6_nxt == IPPROTO_HOPOPTS) {
   1100   1.9    itojun 			struct ip6_hbh *hbh;
   1101   1.9    itojun 			int hbhlen;
   1102  1.62    itojun 			struct mbuf *ext;
   1103   1.9    itojun 
   1104  1.62    itojun 			ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr),
   1105  1.78  christos 			    xip6->ip6_nxt);
   1106  1.62    itojun 			if (ext == NULL) {
   1107   1.9    itojun 				ip6stat.ip6s_tooshort++;
   1108   1.9    itojun 				return;
   1109   1.9    itojun 			}
   1110  1.62    itojun 			hbh = mtod(ext, struct ip6_hbh *);
   1111   1.9    itojun 			hbhlen = (hbh->ip6h_len + 1) << 3;
   1112  1.62    itojun 			if (hbhlen != ext->m_len) {
   1113  1.62    itojun 				m_freem(ext);
   1114   1.9    itojun 				ip6stat.ip6s_tooshort++;
   1115   1.9    itojun 				return;
   1116   1.9    itojun 			}
   1117   1.2    itojun 
   1118   1.2    itojun 			/*
   1119   1.2    itojun 			 * XXX: We copy whole the header even if a jumbo
   1120   1.2    itojun 			 * payload option is included, which option is to
   1121   1.2    itojun 			 * be removed before returning in the RFC 2292.
   1122   1.2    itojun 			 * But it's too painful operation...
   1123   1.2    itojun 			 */
   1124   1.9    itojun 			*mp = sbcreatecontrol((caddr_t)hbh, hbhlen,
   1125  1.63    itojun 			    IPV6_HOPOPTS, IPPROTO_IPV6);
   1126   1.2    itojun 			if (*mp)
   1127   1.2    itojun 				mp = &(*mp)->m_next;
   1128  1.62    itojun 			m_freem(ext);
   1129   1.2    itojun 		}
   1130   1.2    itojun 	}
   1131   1.2    itojun 
   1132   1.2    itojun 	/* IPV6_DSTOPTS and IPV6_RTHDR socket options */
   1133   1.2    itojun 	if (in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDR)) {
   1134  1.78  christos 		struct ip6_hdr *xip6 = mtod(m, struct ip6_hdr *);
   1135  1.78  christos 		int nxt = xip6->ip6_nxt, off = sizeof(struct ip6_hdr);
   1136   1.2    itojun 
   1137   1.2    itojun 		/*
   1138   1.2    itojun 		 * Search for destination options headers or routing
   1139   1.2    itojun 		 * header(s) through the header chain, and stores each
   1140   1.2    itojun 		 * header as ancillary data.
   1141   1.2    itojun 		 * Note that the order of the headers remains in
   1142   1.2    itojun 		 * the chain of ancillary data.
   1143   1.2    itojun 		 */
   1144  1.35    itojun 		while (1) {	/* is explicit loop prevention necessary? */
   1145  1.62    itojun 			struct ip6_ext *ip6e = NULL;
   1146   1.9    itojun 			int elen;
   1147  1.62    itojun 			struct mbuf *ext = NULL;
   1148   1.9    itojun 
   1149  1.62    itojun 			/*
   1150  1.62    itojun 			 * if it is not an extension header, don't try to
   1151  1.62    itojun 			 * pull it from the chain.
   1152  1.62    itojun 			 */
   1153  1.62    itojun 			switch (nxt) {
   1154  1.62    itojun 			case IPPROTO_DSTOPTS:
   1155  1.62    itojun 			case IPPROTO_ROUTING:
   1156  1.62    itojun 			case IPPROTO_HOPOPTS:
   1157  1.62    itojun 			case IPPROTO_AH: /* is it possible? */
   1158  1.62    itojun 				break;
   1159  1.62    itojun 			default:
   1160  1.62    itojun 				goto loopend;
   1161  1.62    itojun 			}
   1162  1.62    itojun 
   1163  1.62    itojun 			ext = ip6_pullexthdr(m, off, nxt);
   1164  1.62    itojun 			if (ext == NULL) {
   1165   1.9    itojun 				ip6stat.ip6s_tooshort++;
   1166   1.9    itojun 				return;
   1167   1.9    itojun 			}
   1168  1.62    itojun 			ip6e = mtod(ext, struct ip6_ext *);
   1169   1.9    itojun 			if (nxt == IPPROTO_AH)
   1170   1.9    itojun 				elen = (ip6e->ip6e_len + 2) << 2;
   1171   1.9    itojun 			else
   1172   1.9    itojun 				elen = (ip6e->ip6e_len + 1) << 3;
   1173  1.62    itojun 			if (elen != ext->m_len) {
   1174  1.62    itojun 				m_freem(ext);
   1175   1.9    itojun 				ip6stat.ip6s_tooshort++;
   1176   1.9    itojun 				return;
   1177   1.9    itojun 			}
   1178  1.57   thorpej 			KASSERT(IP6_HDR_ALIGNED_P(ip6e));
   1179   1.2    itojun 
   1180  1.35    itojun 			switch (nxt) {
   1181  1.62    itojun 			case IPPROTO_DSTOPTS:
   1182  1.35    itojun 				if (!in6p->in6p_flags & IN6P_DSTOPTS)
   1183  1.35    itojun 					break;
   1184  1.35    itojun 
   1185  1.35    itojun 				*mp = sbcreatecontrol((caddr_t)ip6e, elen,
   1186  1.63    itojun 				    IPV6_DSTOPTS, IPPROTO_IPV6);
   1187  1.35    itojun 				if (*mp)
   1188  1.35    itojun 					mp = &(*mp)->m_next;
   1189  1.35    itojun 				break;
   1190  1.35    itojun 
   1191  1.35    itojun 			case IPPROTO_ROUTING:
   1192  1.35    itojun 				if (!in6p->in6p_flags & IN6P_RTHDR)
   1193  1.35    itojun 					break;
   1194  1.35    itojun 
   1195  1.35    itojun 				*mp = sbcreatecontrol((caddr_t)ip6e, elen,
   1196  1.63    itojun 				    IPV6_RTHDR, IPPROTO_IPV6);
   1197  1.35    itojun 				if (*mp)
   1198  1.35    itojun 					mp = &(*mp)->m_next;
   1199  1.35    itojun 				break;
   1200  1.35    itojun 
   1201  1.62    itojun 			case IPPROTO_HOPOPTS:
   1202  1.62    itojun 			case IPPROTO_AH: /* is it possible? */
   1203  1.62    itojun 				break;
   1204  1.62    itojun 
   1205  1.35    itojun 			default:
   1206  1.35    itojun 				/*
   1207  1.62    itojun 			 	 * other cases have been filtered in the above.
   1208  1.62    itojun 				 * none will visit this case.  here we supply
   1209  1.62    itojun 				 * the code just in case (nxt overwritten or
   1210  1.62    itojun 				 * other cases).
   1211  1.35    itojun 				 */
   1212  1.62    itojun 				m_freem(ext);
   1213  1.35    itojun 				goto loopend;
   1214  1.35    itojun 
   1215   1.2    itojun 			}
   1216   1.2    itojun 
   1217   1.2    itojun 			/* proceed with the next header. */
   1218   1.9    itojun 			off += elen;
   1219   1.2    itojun 			nxt = ip6e->ip6e_nxt;
   1220  1.62    itojun 			ip6e = NULL;
   1221  1.62    itojun 			m_freem(ext);
   1222  1.62    itojun 			ext = NULL;
   1223   1.2    itojun 		}
   1224   1.2    itojun 	  loopend:
   1225  1.62    itojun 	  	;
   1226   1.2    itojun 	}
   1227  1.62    itojun }
   1228  1.62    itojun 
   1229  1.62    itojun /*
   1230  1.62    itojun  * pull single extension header from mbuf chain.  returns single mbuf that
   1231  1.62    itojun  * contains the result, or NULL on error.
   1232  1.62    itojun  */
   1233  1.62    itojun static struct mbuf *
   1234  1.62    itojun ip6_pullexthdr(m, off, nxt)
   1235  1.62    itojun 	struct mbuf *m;
   1236  1.62    itojun 	size_t off;
   1237  1.62    itojun 	int nxt;
   1238  1.62    itojun {
   1239  1.62    itojun 	struct ip6_ext ip6e;
   1240  1.62    itojun 	size_t elen;
   1241  1.62    itojun 	struct mbuf *n;
   1242  1.62    itojun 
   1243  1.62    itojun #ifdef DIAGNOSTIC
   1244  1.62    itojun 	switch (nxt) {
   1245  1.62    itojun 	case IPPROTO_DSTOPTS:
   1246  1.62    itojun 	case IPPROTO_ROUTING:
   1247  1.62    itojun 	case IPPROTO_HOPOPTS:
   1248  1.62    itojun 	case IPPROTO_AH: /* is it possible? */
   1249  1.62    itojun 		break;
   1250  1.62    itojun 	default:
   1251  1.62    itojun 		printf("ip6_pullexthdr: invalid nxt=%d\n", nxt);
   1252   1.2    itojun 	}
   1253  1.62    itojun #endif
   1254   1.2    itojun 
   1255  1.62    itojun 	m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
   1256  1.62    itojun 	if (nxt == IPPROTO_AH)
   1257  1.62    itojun 		elen = (ip6e.ip6e_len + 2) << 2;
   1258  1.62    itojun 	else
   1259  1.62    itojun 		elen = (ip6e.ip6e_len + 1) << 3;
   1260  1.62    itojun 
   1261  1.62    itojun 	MGET(n, M_DONTWAIT, MT_DATA);
   1262  1.62    itojun 	if (n && elen >= MLEN) {
   1263  1.62    itojun 		MCLGET(n, M_DONTWAIT);
   1264  1.62    itojun 		if ((n->m_flags & M_EXT) == 0) {
   1265  1.62    itojun 			m_free(n);
   1266  1.62    itojun 			n = NULL;
   1267  1.62    itojun 		}
   1268  1.62    itojun 	}
   1269  1.62    itojun 	if (!n)
   1270  1.62    itojun 		return NULL;
   1271  1.62    itojun 
   1272  1.62    itojun 	n->m_len = 0;
   1273  1.62    itojun 	if (elen >= M_TRAILINGSPACE(n)) {
   1274  1.62    itojun 		m_free(n);
   1275  1.62    itojun 		return NULL;
   1276  1.62    itojun 	}
   1277  1.62    itojun 
   1278  1.62    itojun 	m_copydata(m, off, elen, mtod(n, caddr_t));
   1279  1.62    itojun 	n->m_len = elen;
   1280  1.62    itojun 	return n;
   1281   1.2    itojun }
   1282   1.2    itojun 
   1283   1.2    itojun /*
   1284   1.2    itojun  * Get pointer to the previous header followed by the header
   1285   1.2    itojun  * currently processed.
   1286   1.2    itojun  * XXX: This function supposes that
   1287   1.2    itojun  *	M includes all headers,
   1288   1.2    itojun  *	the next header field and the header length field of each header
   1289   1.2    itojun  *	are valid, and
   1290   1.2    itojun  *	the sum of each header length equals to OFF.
   1291   1.2    itojun  * Because of these assumptions, this function must be called very
   1292   1.2    itojun  * carefully. Moreover, it will not be used in the near future when
   1293   1.2    itojun  * we develop `neater' mechanism to process extension headers.
   1294   1.2    itojun  */
   1295  1.58    itojun u_int8_t *
   1296   1.2    itojun ip6_get_prevhdr(m, off)
   1297   1.2    itojun 	struct mbuf *m;
   1298   1.2    itojun 	int off;
   1299   1.2    itojun {
   1300   1.2    itojun 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
   1301   1.2    itojun 
   1302   1.2    itojun 	if (off == sizeof(struct ip6_hdr))
   1303  1.58    itojun 		return (&ip6->ip6_nxt);
   1304   1.2    itojun 	else {
   1305   1.2    itojun 		int len, nxt;
   1306   1.2    itojun 		struct ip6_ext *ip6e = NULL;
   1307   1.2    itojun 
   1308   1.2    itojun 		nxt = ip6->ip6_nxt;
   1309   1.2    itojun 		len = sizeof(struct ip6_hdr);
   1310   1.2    itojun 		while (len < off) {
   1311   1.2    itojun 			ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + len);
   1312   1.2    itojun 
   1313  1.35    itojun 			switch (nxt) {
   1314   1.2    itojun 			case IPPROTO_FRAGMENT:
   1315   1.2    itojun 				len += sizeof(struct ip6_frag);
   1316   1.2    itojun 				break;
   1317   1.2    itojun 			case IPPROTO_AH:
   1318   1.2    itojun 				len += (ip6e->ip6e_len + 2) << 2;
   1319   1.2    itojun 				break;
   1320   1.2    itojun 			default:
   1321   1.2    itojun 				len += (ip6e->ip6e_len + 1) << 3;
   1322   1.2    itojun 				break;
   1323   1.2    itojun 			}
   1324   1.2    itojun 			nxt = ip6e->ip6e_nxt;
   1325   1.2    itojun 		}
   1326   1.2    itojun 		if (ip6e)
   1327  1.58    itojun 			return (&ip6e->ip6e_nxt);
   1328   1.2    itojun 		else
   1329   1.2    itojun 			return NULL;
   1330  1.18    itojun 	}
   1331  1.18    itojun }
   1332  1.18    itojun 
   1333  1.18    itojun /*
   1334  1.18    itojun  * get next header offset.  m will be retained.
   1335  1.18    itojun  */
   1336  1.18    itojun int
   1337  1.18    itojun ip6_nexthdr(m, off, proto, nxtp)
   1338  1.18    itojun 	struct mbuf *m;
   1339  1.18    itojun 	int off;
   1340  1.18    itojun 	int proto;
   1341  1.18    itojun 	int *nxtp;
   1342  1.18    itojun {
   1343  1.18    itojun 	struct ip6_hdr ip6;
   1344  1.18    itojun 	struct ip6_ext ip6e;
   1345  1.18    itojun 	struct ip6_frag fh;
   1346  1.18    itojun 
   1347  1.18    itojun 	/* just in case */
   1348  1.18    itojun 	if (m == NULL)
   1349  1.18    itojun 		panic("ip6_nexthdr: m == NULL");
   1350  1.18    itojun 	if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off)
   1351  1.18    itojun 		return -1;
   1352  1.18    itojun 
   1353  1.18    itojun 	switch (proto) {
   1354  1.18    itojun 	case IPPROTO_IPV6:
   1355  1.83    rpaulo 		/* do not chase beyond intermediate IPv6 headers */
   1356  1.83    rpaulo 		if (off != 0)
   1357  1.83    rpaulo 			return -1;
   1358  1.18    itojun 		if (m->m_pkthdr.len < off + sizeof(ip6))
   1359  1.18    itojun 			return -1;
   1360  1.18    itojun 		m_copydata(m, off, sizeof(ip6), (caddr_t)&ip6);
   1361  1.18    itojun 		if (nxtp)
   1362  1.18    itojun 			*nxtp = ip6.ip6_nxt;
   1363  1.18    itojun 		off += sizeof(ip6);
   1364  1.18    itojun 		return off;
   1365  1.18    itojun 
   1366  1.18    itojun 	case IPPROTO_FRAGMENT:
   1367  1.18    itojun 		/*
   1368  1.18    itojun 		 * terminate parsing if it is not the first fragment,
   1369  1.18    itojun 		 * it does not make sense to parse through it.
   1370  1.18    itojun 		 */
   1371  1.18    itojun 		if (m->m_pkthdr.len < off + sizeof(fh))
   1372  1.18    itojun 			return -1;
   1373  1.18    itojun 		m_copydata(m, off, sizeof(fh), (caddr_t)&fh);
   1374  1.67    itojun 		if ((fh.ip6f_offlg & IP6F_OFF_MASK) != 0)
   1375  1.18    itojun 			return -1;
   1376  1.18    itojun 		if (nxtp)
   1377  1.18    itojun 			*nxtp = fh.ip6f_nxt;
   1378  1.18    itojun 		off += sizeof(struct ip6_frag);
   1379  1.18    itojun 		return off;
   1380  1.18    itojun 
   1381  1.18    itojun 	case IPPROTO_AH:
   1382  1.18    itojun 		if (m->m_pkthdr.len < off + sizeof(ip6e))
   1383  1.18    itojun 			return -1;
   1384  1.18    itojun 		m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
   1385  1.18    itojun 		if (nxtp)
   1386  1.18    itojun 			*nxtp = ip6e.ip6e_nxt;
   1387  1.18    itojun 		off += (ip6e.ip6e_len + 2) << 2;
   1388  1.47    itojun 		if (m->m_pkthdr.len < off)
   1389  1.47    itojun 			return -1;
   1390  1.18    itojun 		return off;
   1391  1.18    itojun 
   1392  1.18    itojun 	case IPPROTO_HOPOPTS:
   1393  1.18    itojun 	case IPPROTO_ROUTING:
   1394  1.18    itojun 	case IPPROTO_DSTOPTS:
   1395  1.18    itojun 		if (m->m_pkthdr.len < off + sizeof(ip6e))
   1396  1.18    itojun 			return -1;
   1397  1.18    itojun 		m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
   1398  1.18    itojun 		if (nxtp)
   1399  1.18    itojun 			*nxtp = ip6e.ip6e_nxt;
   1400  1.18    itojun 		off += (ip6e.ip6e_len + 1) << 3;
   1401  1.47    itojun 		if (m->m_pkthdr.len < off)
   1402  1.47    itojun 			return -1;
   1403  1.18    itojun 		return off;
   1404  1.18    itojun 
   1405  1.18    itojun 	case IPPROTO_NONE:
   1406  1.18    itojun 	case IPPROTO_ESP:
   1407  1.18    itojun 	case IPPROTO_IPCOMP:
   1408  1.18    itojun 		/* give up */
   1409  1.18    itojun 		return -1;
   1410  1.18    itojun 
   1411  1.18    itojun 	default:
   1412  1.18    itojun 		return -1;
   1413  1.18    itojun 	}
   1414  1.18    itojun }
   1415  1.18    itojun 
   1416  1.18    itojun /*
   1417  1.18    itojun  * get offset for the last header in the chain.  m will be kept untainted.
   1418  1.18    itojun  */
   1419  1.18    itojun int
   1420  1.18    itojun ip6_lasthdr(m, off, proto, nxtp)
   1421  1.18    itojun 	struct mbuf *m;
   1422  1.18    itojun 	int off;
   1423  1.18    itojun 	int proto;
   1424  1.18    itojun 	int *nxtp;
   1425  1.18    itojun {
   1426  1.18    itojun 	int newoff;
   1427  1.18    itojun 	int nxt;
   1428  1.18    itojun 
   1429  1.18    itojun 	if (!nxtp) {
   1430  1.18    itojun 		nxt = -1;
   1431  1.18    itojun 		nxtp = &nxt;
   1432  1.18    itojun 	}
   1433  1.18    itojun 	while (1) {
   1434  1.18    itojun 		newoff = ip6_nexthdr(m, off, proto, nxtp);
   1435  1.18    itojun 		if (newoff < 0)
   1436  1.18    itojun 			return off;
   1437  1.18    itojun 		else if (newoff < off)
   1438  1.18    itojun 			return -1;	/* invalid */
   1439  1.18    itojun 		else if (newoff == off)
   1440  1.18    itojun 			return newoff;
   1441  1.18    itojun 
   1442  1.18    itojun 		off = newoff;
   1443  1.18    itojun 		proto = *nxtp;
   1444   1.2    itojun 	}
   1445   1.2    itojun }
   1446   1.2    itojun 
   1447  1.81    rpaulo struct m_tag *
   1448  1.81    rpaulo ip6_addaux(m)
   1449  1.81    rpaulo 	struct mbuf *m;
   1450  1.81    rpaulo {
   1451  1.81    rpaulo 	struct m_tag *mtag;
   1452  1.81    rpaulo 
   1453  1.81    rpaulo 	mtag = m_tag_find(m, PACKET_TAG_INET6, NULL);
   1454  1.81    rpaulo 	if (!mtag) {
   1455  1.81    rpaulo 		mtag = m_tag_get(PACKET_TAG_INET6, sizeof(struct ip6aux),
   1456  1.81    rpaulo 		    M_NOWAIT);
   1457  1.81    rpaulo 		if (mtag) {
   1458  1.81    rpaulo 			m_tag_prepend(m, mtag);
   1459  1.81    rpaulo 			bzero(mtag + 1, sizeof(struct ip6aux));
   1460  1.81    rpaulo 		}
   1461  1.81    rpaulo 	}
   1462  1.81    rpaulo 	return mtag;
   1463  1.81    rpaulo }
   1464  1.81    rpaulo 
   1465  1.81    rpaulo struct m_tag *
   1466  1.81    rpaulo ip6_findaux(m)
   1467  1.81    rpaulo 	struct mbuf *m;
   1468  1.81    rpaulo {
   1469  1.81    rpaulo 	struct m_tag *mtag;
   1470  1.81    rpaulo 
   1471  1.81    rpaulo 	mtag = m_tag_find(m, PACKET_TAG_INET6, NULL);
   1472  1.81    rpaulo 	return mtag;
   1473  1.81    rpaulo }
   1474  1.81    rpaulo 
   1475  1.81    rpaulo void
   1476  1.81    rpaulo ip6_delaux(m)
   1477  1.81    rpaulo 	struct mbuf *m;
   1478  1.81    rpaulo {
   1479  1.81    rpaulo 	struct m_tag *mtag;
   1480  1.81    rpaulo 
   1481  1.81    rpaulo 	mtag = m_tag_find(m, PACKET_TAG_INET6, NULL);
   1482  1.81    rpaulo 	if (mtag)
   1483  1.81    rpaulo 		m_tag_delete(m, mtag);
   1484  1.81    rpaulo }
   1485  1.81    rpaulo 
   1486   1.2    itojun /*
   1487   1.2    itojun  * System control for IP6
   1488   1.2    itojun  */
   1489   1.2    itojun 
   1490   1.2    itojun u_char	inet6ctlerrmap[PRC_NCMDS] = {
   1491   1.2    itojun 	0,		0,		0,		0,
   1492   1.2    itojun 	0,		EMSGSIZE,	EHOSTDOWN,	EHOSTUNREACH,
   1493   1.2    itojun 	EHOSTUNREACH,	EHOSTUNREACH,	ECONNREFUSED,	ECONNREFUSED,
   1494   1.2    itojun 	EMSGSIZE,	EHOSTUNREACH,	0,		0,
   1495   1.2    itojun 	0,		0,		0,		0,
   1496   1.2    itojun 	ENOPROTOOPT
   1497   1.2    itojun };
   1498   1.2    itojun 
   1499  1.70    atatat SYSCTL_SETUP(sysctl_net_inet6_ip6_setup, "sysctl net.inet6.ip6 subtree setup")
   1500   1.2    itojun {
   1501  1.26    itojun 
   1502  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1503  1.73    atatat 		       CTLFLAG_PERMANENT,
   1504  1.70    atatat 		       CTLTYPE_NODE, "net", NULL,
   1505  1.70    atatat 		       NULL, 0, NULL, 0,
   1506  1.70    atatat 		       CTL_NET, CTL_EOL);
   1507  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1508  1.73    atatat 		       CTLFLAG_PERMANENT,
   1509  1.74    atatat 		       CTLTYPE_NODE, "inet6",
   1510  1.74    atatat 		       SYSCTL_DESCR("PF_INET6 related settings"),
   1511  1.70    atatat 		       NULL, 0, NULL, 0,
   1512  1.70    atatat 		       CTL_NET, PF_INET6, CTL_EOL);
   1513  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1514  1.73    atatat 		       CTLFLAG_PERMANENT,
   1515  1.74    atatat 		       CTLTYPE_NODE, "ip6",
   1516  1.74    atatat 		       SYSCTL_DESCR("IPv6 related settings"),
   1517  1.70    atatat 		       NULL, 0, NULL, 0,
   1518  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6, CTL_EOL);
   1519  1.70    atatat 
   1520  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1521  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1522  1.74    atatat 		       CTLTYPE_INT, "forwarding",
   1523  1.74    atatat 		       SYSCTL_DESCR("Enable forwarding of INET6 datagrams"),
   1524  1.70    atatat 		       NULL, 0, &ip6_forwarding, 0,
   1525  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1526  1.70    atatat 		       IPV6CTL_FORWARDING, CTL_EOL);
   1527  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1528  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1529  1.74    atatat 		       CTLTYPE_INT, "redirect",
   1530  1.74    atatat 		       SYSCTL_DESCR("Enable sending of ICMPv6 redirect messages"),
   1531  1.70    atatat 		       NULL, 0, &ip6_sendredirects, 0,
   1532  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1533  1.70    atatat 		       IPV6CTL_SENDREDIRECTS, CTL_EOL);
   1534  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1535  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1536  1.74    atatat 		       CTLTYPE_INT, "hlim",
   1537  1.74    atatat 		       SYSCTL_DESCR("Hop limit for an INET6 datagram"),
   1538  1.70    atatat 		       NULL, 0, &ip6_defhlim, 0,
   1539  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1540  1.70    atatat 		       IPV6CTL_DEFHLIM, CTL_EOL);
   1541  1.70    atatat #ifdef notyet
   1542  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1543  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1544  1.70    atatat 		       CTLTYPE_INT, "mtu", NULL,
   1545  1.70    atatat 		       NULL, 0, &, 0,
   1546  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1547  1.70    atatat 		       IPV6CTL_DEFMTU, CTL_EOL);
   1548  1.70    atatat #endif
   1549  1.70    atatat #ifdef __no_idea__
   1550  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1551  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1552  1.70    atatat 		       CTLTYPE_INT, "forwsrcrt", NULL,
   1553  1.70    atatat 		       NULL, 0, &?, 0,
   1554  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1555  1.70    atatat 		       IPV6CTL_FORWSRCRT, CTL_EOL);
   1556  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1557  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1558  1.70    atatat 		       CTLTYPE_STRUCT, "mrtstats", NULL,
   1559  1.70    atatat 		       NULL, 0, &?, sizeof(?),
   1560  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1561  1.70    atatat 		       IPV6CTL_MRTSTATS, CTL_EOL);
   1562  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1563  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1564  1.70    atatat 		       CTLTYPE_?, "mrtproto", NULL,
   1565  1.70    atatat 		       NULL, 0, &?, sizeof(?),
   1566  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1567  1.70    atatat 		       IPV6CTL_MRTPROTO, CTL_EOL);
   1568  1.70    atatat #endif
   1569  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1570  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1571  1.74    atatat 		       CTLTYPE_INT, "maxfragpackets",
   1572  1.74    atatat 		       SYSCTL_DESCR("Maximum number of fragments to buffer "
   1573  1.74    atatat 				    "for reassembly"),
   1574  1.70    atatat 		       NULL, 0, &ip6_maxfragpackets, 0,
   1575  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1576  1.70    atatat 		       IPV6CTL_MAXFRAGPACKETS, CTL_EOL);
   1577  1.70    atatat #ifdef __no_idea__
   1578  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1579  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1580  1.70    atatat 		       CTLTYPE_INT, "sourcecheck", NULL,
   1581  1.70    atatat 		       NULL, 0, &?, 0,
   1582  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1583  1.70    atatat 		       IPV6CTL_SOURCECHECK, CTL_EOL);
   1584  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1585  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1586  1.70    atatat 		       CTLTYPE_INT, "sourcecheck_logint", NULL,
   1587  1.70    atatat 		       NULL, 0, &?, 0,
   1588  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1589  1.70    atatat 		       IPV6CTL_SOURCECHECK_LOGINT, CTL_EOL);
   1590  1.70    atatat #endif
   1591  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1592  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1593  1.74    atatat 		       CTLTYPE_INT, "accept_rtadv",
   1594  1.74    atatat 		       SYSCTL_DESCR("Accept router advertisements"),
   1595  1.70    atatat 		       NULL, 0, &ip6_accept_rtadv, 0,
   1596  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1597  1.70    atatat 		       IPV6CTL_ACCEPT_RTADV, CTL_EOL);
   1598  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1599  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1600  1.74    atatat 		       CTLTYPE_INT, "keepfaith",
   1601  1.74    atatat 		       SYSCTL_DESCR("Activate faith interface"),
   1602  1.70    atatat 		       NULL, 0, &ip6_keepfaith, 0,
   1603  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1604  1.70    atatat 		       IPV6CTL_KEEPFAITH, CTL_EOL);
   1605  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1606  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1607  1.74    atatat 		       CTLTYPE_INT, "log_interval",
   1608  1.74    atatat 		       SYSCTL_DESCR("Minumum interval between logging "
   1609  1.74    atatat 				    "unroutable packets"),
   1610  1.70    atatat 		       NULL, 0, &ip6_log_interval, 0,
   1611  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1612  1.70    atatat 		       IPV6CTL_LOG_INTERVAL, CTL_EOL);
   1613  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1614  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1615  1.74    atatat 		       CTLTYPE_INT, "hdrnestlimit",
   1616  1.74    atatat 		       SYSCTL_DESCR("Maximum number of nested IPv6 headers"),
   1617  1.70    atatat 		       NULL, 0, &ip6_hdrnestlimit, 0,
   1618  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1619  1.70    atatat 		       IPV6CTL_HDRNESTLIMIT, CTL_EOL);
   1620  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1621  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1622  1.74    atatat 		       CTLTYPE_INT, "dad_count",
   1623  1.74    atatat 		       SYSCTL_DESCR("Number of Duplicate Address Detection "
   1624  1.74    atatat 				    "probes to send"),
   1625  1.70    atatat 		       NULL, 0, &ip6_dad_count, 0,
   1626  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1627  1.70    atatat 		       IPV6CTL_DAD_COUNT, CTL_EOL);
   1628  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1629  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1630  1.74    atatat 		       CTLTYPE_INT, "auto_flowlabel",
   1631  1.74    atatat 		       SYSCTL_DESCR("Assign random IPv6 flow labels"),
   1632  1.70    atatat 		       NULL, 0, &ip6_auto_flowlabel, 0,
   1633  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1634  1.70    atatat 		       IPV6CTL_AUTO_FLOWLABEL, CTL_EOL);
   1635  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1636  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1637  1.74    atatat 		       CTLTYPE_INT, "defmcasthlim",
   1638  1.74    atatat 		       SYSCTL_DESCR("Default multicast hop limit"),
   1639  1.70    atatat 		       NULL, 0, &ip6_defmcasthlim, 0,
   1640  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1641  1.70    atatat 		       IPV6CTL_DEFMCASTHLIM, CTL_EOL);
   1642  1.51    itojun #if NGIF > 0
   1643  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1644  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1645  1.74    atatat 		       CTLTYPE_INT, "gifhlim",
   1646  1.74    atatat 		       SYSCTL_DESCR("Default hop limit for a gif tunnel datagram"),
   1647  1.70    atatat 		       NULL, 0, &ip6_gif_hlim, 0,
   1648  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1649  1.70    atatat 		       IPV6CTL_GIF_HLIM, CTL_EOL);
   1650  1.70    atatat #endif /* NGIF */
   1651  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1652  1.73    atatat 		       CTLFLAG_PERMANENT,
   1653  1.74    atatat 		       CTLTYPE_STRING, "kame_version",
   1654  1.74    atatat 		       SYSCTL_DESCR("KAME Version"),
   1655  1.78  christos 		       NULL, 0, __UNCONST(__KAME_VERSION), 0,
   1656  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1657  1.70    atatat 		       IPV6CTL_KAME_VERSION, CTL_EOL);
   1658  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1659  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1660  1.74    atatat 		       CTLTYPE_INT, "use_deprecated",
   1661  1.74    atatat 		       SYSCTL_DESCR("Allow use of deprecated addresses as "
   1662  1.74    atatat 				    "source addresses"),
   1663  1.70    atatat 		       NULL, 0, &ip6_use_deprecated, 0,
   1664  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1665  1.70    atatat 		       IPV6CTL_USE_DEPRECATED, CTL_EOL);
   1666  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1667  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1668  1.70    atatat 		       CTLTYPE_INT, "rr_prune", NULL,
   1669  1.70    atatat 		       NULL, 0, &ip6_rr_prune, 0,
   1670  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1671  1.70    atatat 		       IPV6CTL_RR_PRUNE, CTL_EOL);
   1672  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1673  1.73    atatat 		       CTLFLAG_PERMANENT
   1674  1.70    atatat #ifndef INET6_BINDV6ONLY
   1675  1.73    atatat 		       |CTLFLAG_READWRITE,
   1676  1.70    atatat #endif
   1677  1.74    atatat 		       CTLTYPE_INT, "v6only",
   1678  1.74    atatat 		       SYSCTL_DESCR("Disallow PF_INET6 sockets from connecting "
   1679  1.74    atatat 				    "to PF_INET sockets"),
   1680  1.70    atatat 		       NULL, 0, &ip6_v6only, 0,
   1681  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1682  1.70    atatat 		       IPV6CTL_V6ONLY, CTL_EOL);
   1683  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1684  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1685  1.74    atatat 		       CTLTYPE_INT, "anonportmin",
   1686  1.74    atatat 		       SYSCTL_DESCR("Lowest ephemeral port number to assign"),
   1687  1.70    atatat 		       sysctl_net_inet_ip_ports, 0, &ip6_anonportmin, 0,
   1688  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1689  1.70    atatat 		       IPV6CTL_ANONPORTMIN, CTL_EOL);
   1690  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1691  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1692  1.74    atatat 		       CTLTYPE_INT, "anonportmax",
   1693  1.74    atatat 		       SYSCTL_DESCR("Highest ephemeral port number to assign"),
   1694  1.70    atatat 		       sysctl_net_inet_ip_ports, 0, &ip6_anonportmax, 0,
   1695  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1696  1.70    atatat 		       IPV6CTL_ANONPORTMAX, CTL_EOL);
   1697  1.26    itojun #ifndef IPNOPRIVPORTS
   1698  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1699  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1700  1.74    atatat 		       CTLTYPE_INT, "lowportmin",
   1701  1.74    atatat 		       SYSCTL_DESCR("Lowest privileged ephemeral port number "
   1702  1.74    atatat 				    "to assign"),
   1703  1.70    atatat 		       sysctl_net_inet_ip_ports, 0, &ip6_lowportmin, 0,
   1704  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1705  1.70    atatat 		       IPV6CTL_LOWPORTMIN, CTL_EOL);
   1706  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1707  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1708  1.74    atatat 		       CTLTYPE_INT, "lowportmax",
   1709  1.74    atatat 		       SYSCTL_DESCR("Highest privileged ephemeral port number "
   1710  1.74    atatat 				    "to assign"),
   1711  1.70    atatat 		       sysctl_net_inet_ip_ports, 0, &ip6_lowportmax, 0,
   1712  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1713  1.70    atatat 		       IPV6CTL_LOWPORTMAX, CTL_EOL);
   1714  1.70    atatat #endif /* IPNOPRIVPORTS */
   1715  1.73    atatat 	sysctl_createv(clog, 0, NULL, NULL,
   1716  1.73    atatat 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1717  1.83    rpaulo 		       CTLTYPE_INT, "use_tempaddr",
   1718  1.83    rpaulo 		       SYSCTL_DESCR("Use temporary address"),
   1719  1.83    rpaulo 		       NULL, 0, &ip6_use_tempaddr, 0,
   1720  1.83    rpaulo 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1721  1.83    rpaulo 		       CTL_CREATE, CTL_EOL);
   1722  1.83    rpaulo 	sysctl_createv(clog, 0, NULL, NULL,
   1723  1.83    rpaulo 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1724  1.83    rpaulo 		       CTLTYPE_INT, "temppltime",
   1725  1.83    rpaulo 		       SYSCTL_DESCR("preferred lifetime of a temporary address"),
   1726  1.83    rpaulo 		       NULL, 0, &ip6_temp_preferred_lifetime, 0,
   1727  1.83    rpaulo 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1728  1.83    rpaulo 		       CTL_CREATE, CTL_EOL);
   1729  1.83    rpaulo 	sysctl_createv(clog, 0, NULL, NULL,
   1730  1.83    rpaulo 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1731  1.83    rpaulo 		       CTLTYPE_INT, "tempvltime",
   1732  1.83    rpaulo 		       SYSCTL_DESCR("valid lifetime of a temporary address"),
   1733  1.83    rpaulo 		       NULL, 0, &ip6_temp_valid_lifetime, 0,
   1734  1.83    rpaulo 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1735  1.83    rpaulo 		       CTL_CREATE, CTL_EOL);
   1736  1.83    rpaulo 	sysctl_createv(clog, 0, NULL, NULL,
   1737  1.83    rpaulo 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1738  1.74    atatat 		       CTLTYPE_INT, "maxfrags",
   1739  1.74    atatat 		       SYSCTL_DESCR("Maximum fragments in reassembly queue"),
   1740  1.70    atatat 		       NULL, 0, &ip6_maxfrags, 0,
   1741  1.70    atatat 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1742  1.70    atatat 		       IPV6CTL_MAXFRAGS, CTL_EOL);
   1743  1.79    rpaulo 	sysctl_createv(clog, 0, NULL, NULL,
   1744  1.79    rpaulo 		       CTLFLAG_PERMANENT,
   1745  1.79    rpaulo 		       CTLTYPE_STRUCT, "stats",
   1746  1.79    rpaulo 		       SYSCTL_DESCR("IPv6 statistics"),
   1747  1.79    rpaulo 		       NULL, 0, &ip6stat, sizeof(ip6stat),
   1748  1.79    rpaulo 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1749  1.79    rpaulo 		       IPV6CTL_STATS, CTL_EOL);
   1750  1.81    rpaulo 	sysctl_createv(clog, 0, NULL, NULL,
   1751  1.81    rpaulo 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1752  1.81    rpaulo 		       CTLTYPE_INT, "use_defaultzone",
   1753  1.81    rpaulo 		       SYSCTL_DESCR("Whether to use the default scope zones"),
   1754  1.81    rpaulo 		       NULL, 0, &ip6_use_defzone, 0,
   1755  1.81    rpaulo 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1756  1.81    rpaulo 		       IPV6CTL_USE_DEFAULTZONE, CTL_EOL);
   1757  1.83    rpaulo 	sysctl_createv(clog, 0, NULL, NULL,
   1758  1.83    rpaulo 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
   1759  1.83    rpaulo 		       CTLTYPE_INT, "mcast_pmtu",
   1760  1.83    rpaulo 		       SYSCTL_DESCR("Enable pMTU discovery for multicast packet"),
   1761  1.83    rpaulo 		       NULL, 0, &ip6_mcast_pmtu, 0,
   1762  1.83    rpaulo 		       CTL_NET, PF_INET6, IPPROTO_IPV6,
   1763  1.83    rpaulo 		       CTL_CREATE, CTL_EOL);
   1764   1.2    itojun }
   1765