0a1,3
> /* $FreeBSD: head/sys/netinet6/route6.c 62587 2000-07-04 16:35:15Z itojun $ */
> /* $KAME: route6.c,v 1.15 2000/06/23 16:18:20 itojun Exp $ */
>
28,29d30
< *
< * $FreeBSD: head/sys/netinet6/route6.c 53541 1999-11-22 02:45:11Z shin $
31a33,35
> #include "opt_inet.h"
> #include "opt_inet6.h"
>
34a39
> #include <sys/systm.h>
39d43
< #include <netinet6/in6.h>
41c45
< #include <netinet6/ip6.h>
---
> #include <netinet/ip6.h>
46c50,51
< static int ip6_rthdr0 __P((struct mbuf *, struct ip6_hdr *, struct ip6_rthdr0 *));
---
> static int ip6_rthdr0 __P((struct mbuf *, struct ip6_hdr *,
> struct ip6_rthdr0 *));
57a63
> #ifndef PULLDOWN_TEST
60a67,74
> #else
> ip6 = mtod(m, struct ip6_hdr *);
> IP6_EXTHDR_GET(rh, struct ip6_rthdr *, m, off, sizeof(*rh));
> if (rh == NULL) {
> ip6stat.ip6s_tooshort++;
> return IPPROTO_DONE;
> }
> #endif
62,78c76,113
< switch(rh->ip6r_type) {
< case IPV6_RTHDR_TYPE_0:
< rhlen = (rh->ip6r_len + 1) << 3;
< IP6_EXTHDR_CHECK(m, off, rhlen, IPPROTO_DONE);
< if (ip6_rthdr0(m, ip6, (struct ip6_rthdr0 *)rh))
< return(IPPROTO_DONE);
< break;
< default:
< /* unknown routing type */
< if (rh->ip6r_segleft == 0) {
< rhlen = (rh->ip6r_len + 1) << 3;
< break; /* Final dst. Just ignore the header. */
< }
< ip6stat.ip6s_badoptions++;
< icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
< (caddr_t)&rh->ip6r_type - (caddr_t)ip6);
< return(IPPROTO_DONE);
---
> switch (rh->ip6r_type) {
> case IPV6_RTHDR_TYPE_0:
> rhlen = (rh->ip6r_len + 1) << 3;
> #ifndef PULLDOWN_TEST
> /*
> * note on option length:
> * due to IP6_EXTHDR_CHECK assumption, we cannot handle
> * very big routing header (max rhlen == 2048).
> */
> IP6_EXTHDR_CHECK(m, off, rhlen, IPPROTO_DONE);
> #else
> /*
> * note on option length:
> * maximum rhlen: 2048
> * max mbuf m_pulldown can handle: MCLBYTES == usually 2048
> * so, here we are assuming that m_pulldown can handle
> * rhlen == 2048 case. this may not be a good thing to
> * assume - we may want to avoid pulling it up altogether.
> */
> IP6_EXTHDR_GET(rh, struct ip6_rthdr *, m, off, rhlen);
> if (rh == NULL) {
> ip6stat.ip6s_tooshort++;
> return IPPROTO_DONE;
> }
> #endif
> if (ip6_rthdr0(m, ip6, (struct ip6_rthdr0 *)rh))
> return(IPPROTO_DONE);
> break;
> default:
> /* unknown routing type */
> if (rh->ip6r_segleft == 0) {
> rhlen = (rh->ip6r_len + 1) << 3;
> break; /* Final dst. Just ignore the header. */
> }
> ip6stat.ip6s_badoptions++;
> icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
> (caddr_t)&rh->ip6r_type - (caddr_t)ip6);
> return(IPPROTO_DONE);
125c160
< nextaddr = rh0->ip6r0_addr + index;
---
> nextaddr = ((struct in6_addr *)(rh0 + 1)) + index;
126a162,166
> /*
> * reject invalid addresses. be proactive about malicious use of
> * IPv4 mapped/compat address.
> * XXX need more checks?
> */
128c168,170
< IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
---
> IN6_IS_ADDR_UNSPECIFIED(nextaddr) ||
> IN6_IS_ADDR_V4MAPPED(nextaddr) ||
> IN6_IS_ADDR_V4COMPAT(nextaddr)) {
132a175,182
> if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
> IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst) ||
> IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst) ||
> IN6_IS_ADDR_V4COMPAT(nextaddr)) {
> ip6stat.ip6s_badoptions++;
> m_freem(m);
> return(-1);
> }