ip6_input.c revision 108825
162587Sitojun/*	$FreeBSD: head/sys/netinet6/ip6_input.c 108825 2003-01-06 21:33:54Z sam $	*/
295023Ssuz/*	$KAME: ip6_input.c,v 1.259 2002/01/21 04:58:09 jinmei Exp $	*/
362587Sitojun
453541Sshin/*
553541Sshin * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
653541Sshin * All rights reserved.
753541Sshin *
853541Sshin * Redistribution and use in source and binary forms, with or without
953541Sshin * modification, are permitted provided that the following conditions
1053541Sshin * are met:
1153541Sshin * 1. Redistributions of source code must retain the above copyright
1253541Sshin *    notice, this list of conditions and the following disclaimer.
1353541Sshin * 2. Redistributions in binary form must reproduce the above copyright
1453541Sshin *    notice, this list of conditions and the following disclaimer in the
1553541Sshin *    documentation and/or other materials provided with the distribution.
1653541Sshin * 3. Neither the name of the project nor the names of its contributors
1753541Sshin *    may be used to endorse or promote products derived from this software
1853541Sshin *    without specific prior written permission.
1953541Sshin *
2053541Sshin * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
2153541Sshin * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
2253541Sshin * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
2353541Sshin * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
2453541Sshin * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
2553541Sshin * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
2653541Sshin * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2753541Sshin * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
2853541Sshin * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
2953541Sshin * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
3053541Sshin * SUCH DAMAGE.
3153541Sshin */
3253541Sshin
3353541Sshin/*
3453541Sshin * Copyright (c) 1982, 1986, 1988, 1993
3553541Sshin *	The Regents of the University of California.  All rights reserved.
3653541Sshin *
3753541Sshin * Redistribution and use in source and binary forms, with or without
3853541Sshin * modification, are permitted provided that the following conditions
3953541Sshin * are met:
4053541Sshin * 1. Redistributions of source code must retain the above copyright
4153541Sshin *    notice, this list of conditions and the following disclaimer.
4253541Sshin * 2. Redistributions in binary form must reproduce the above copyright
4353541Sshin *    notice, this list of conditions and the following disclaimer in the
4453541Sshin *    documentation and/or other materials provided with the distribution.
4553541Sshin * 3. All advertising materials mentioning features or use of this software
4653541Sshin *    must display the following acknowledgement:
4753541Sshin *	This product includes software developed by the University of
4853541Sshin *	California, Berkeley and its contributors.
4953541Sshin * 4. Neither the name of the University nor the names of its contributors
5053541Sshin *    may be used to endorse or promote products derived from this software
5153541Sshin *    without specific prior written permission.
5253541Sshin *
5353541Sshin * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
5453541Sshin * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
5553541Sshin * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
5653541Sshin * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
5753541Sshin * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
5853541Sshin * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
5953541Sshin * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
6053541Sshin * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
6153541Sshin * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
6253541Sshin * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
6353541Sshin * SUCH DAMAGE.
6453541Sshin *
6553541Sshin *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
6653541Sshin */
6753541Sshin
6862587Sitojun#include "opt_ip6fw.h"
6962587Sitojun#include "opt_inet.h"
7062587Sitojun#include "opt_inet6.h"
7155009Sshin#include "opt_ipsec.h"
7264060Sdarrenr#include "opt_pfil_hooks.h"
7355009Sshin
7453541Sshin#include <sys/param.h>
7553541Sshin#include <sys/systm.h>
7678064Sume#include <sys/malloc.h>
7753541Sshin#include <sys/mbuf.h>
7883366Sjulian#include <sys/proc.h>
7953541Sshin#include <sys/domain.h>
8053541Sshin#include <sys/protosw.h>
8153541Sshin#include <sys/socket.h>
8253541Sshin#include <sys/socketvar.h>
8353541Sshin#include <sys/errno.h>
8453541Sshin#include <sys/time.h>
8553541Sshin#include <sys/kernel.h>
8653541Sshin#include <sys/syslog.h>
8753541Sshin
8853541Sshin#include <net/if.h>
8953541Sshin#include <net/if_types.h>
9053541Sshin#include <net/if_dl.h>
9153541Sshin#include <net/route.h>
9253541Sshin#include <net/netisr.h>
9356555Sbrian#include <net/intrq.h>
9464060Sdarrenr#ifdef PFIL_HOOKS
9564060Sdarrenr#include <net/pfil.h>
9664060Sdarrenr#endif
9753541Sshin
9853541Sshin#include <netinet/in.h>
9953541Sshin#include <netinet/in_systm.h>
10062587Sitojun#ifdef INET
10153541Sshin#include <netinet/ip.h>
10253541Sshin#include <netinet/ip_icmp.h>
10395023Ssuz#endif /* INET */
10462587Sitojun#include <netinet/ip6.h>
10553541Sshin#include <netinet6/in6_var.h>
10653541Sshin#include <netinet6/ip6_var.h>
10762587Sitojun#include <netinet/in_pcb.h>
10862587Sitojun#include <netinet/icmp6.h>
10953541Sshin#include <netinet6/in6_ifattach.h>
11053541Sshin#include <netinet6/nd6.h>
11153541Sshin#include <netinet6/in6_prefix.h>
11253541Sshin
11378064Sume#ifdef IPSEC
11478064Sume#include <netinet6/ipsec.h>
11578064Sume#ifdef INET6
11678064Sume#include <netinet6/ipsec6.h>
11778064Sume#endif
11878064Sume#endif
11978064Sume
120105199Ssam#ifdef FAST_IPSEC
121105199Ssam#include <netipsec/ipsec.h>
122105199Ssam#include <netipsec/ipsec6.h>
123105199Ssam#define	IPSEC
124105199Ssam#endif /* FAST_IPSEC */
125105199Ssam
12653541Sshin#include <netinet6/ip6_fw.h>
12753541Sshin
12853541Sshin#include <netinet6/ip6protosw.h>
12953541Sshin
13053541Sshin#include <net/net_osdep.h>
13153541Sshin
13262587Sitojunextern struct domain inet6domain;
13353541Sshin
13462587Sitojunu_char ip6_protox[IPPROTO_MAX];
13562587Sitojunstatic int ip6qmaxlen = IFQ_MAXLEN;
13662587Sitojunstruct in6_ifaddr *in6_ifaddr;
13753541Sshin
13878064Sumeextern struct callout in6_tmpaddrtimer_ch;
13978064Sume
14062587Sitojunint ip6_forward_srcrt;			/* XXX */
14162587Sitojunint ip6_sourcecheck;			/* XXX */
14262587Sitojunint ip6_sourcecheck_interval;		/* XXX */
14353541Sshin
14478064Sumeint ip6_ours_check_algorithm;
14578064Sume
14678064Sume
14753541Sshin/* firewall hooks */
14862587Sitojunip6_fw_chk_t *ip6_fw_chk_ptr;
14962587Sitojunip6_fw_ctl_t *ip6_fw_ctl_ptr;
15066303Sumeint ip6_fw_enable = 1;
15153541Sshin
15262587Sitojunstruct ip6stat ip6stat;
15353541Sshin
15462587Sitojunstatic void ip6_init2 __P((void *));
155105194Ssamstatic struct ip6aux *ip6_setdstifaddr __P((struct mbuf *, struct in6_ifaddr *));
15662587Sitojunstatic int ip6_hopopts_input __P((u_int32_t *, u_int32_t *, struct mbuf **, int *));
15762587Sitojun#ifdef PULLDOWN_TEST
15862587Sitojunstatic struct mbuf *ip6_pullexthdr __P((struct mbuf *, size_t, int));
15953541Sshin#endif
16053541Sshin
16178064Sume
16253541Sshin/*
16353541Sshin * IP6 initialization: fill in IP6 protocol switch table.
16453541Sshin * All protocols not implemented in kernel go to raw IP6 protocol handler.
16553541Sshin */
16653541Sshinvoid
16753541Sshinip6_init()
16853541Sshin{
16978064Sume	struct ip6protosw *pr;
17078064Sume	int i;
17153541Sshin	struct timeval tv;
17253541Sshin
17378064Sume#ifdef DIAGNOSTIC
17478064Sume	if (sizeof(struct protosw) != sizeof(struct ip6protosw))
17578064Sume		panic("sizeof(protosw) != sizeof(ip6protosw)");
17678064Sume#endif
17753541Sshin	pr = (struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW);
17853541Sshin	if (pr == 0)
17953541Sshin		panic("ip6_init");
18053541Sshin	for (i = 0; i < IPPROTO_MAX; i++)
18153541Sshin		ip6_protox[i] = pr - inet6sw;
18253541Sshin	for (pr = (struct ip6protosw *)inet6domain.dom_protosw;
18353541Sshin	    pr < (struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++)
18453541Sshin		if (pr->pr_domain->dom_family == PF_INET6 &&
18553541Sshin		    pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
18653541Sshin			ip6_protox[pr->pr_protocol] = pr - inet6sw;
18753541Sshin	ip6intrq.ifq_maxlen = ip6qmaxlen;
18893818Sjhb	mtx_init(&ip6intrq.ifq_mtx, "ip6_inq", NULL, MTX_DEF);
18989069Smsmith	ip6intrq_present = 1;
19057178Speter	register_netisr(NETISR_IPV6, ip6intr);
19153541Sshin	nd6_init();
19253541Sshin	frag6_init();
19353541Sshin	/*
19453541Sshin	 * in many cases, random() here does NOT return random number
19553541Sshin	 * as initialization during bootstrap time occur in fixed order.
19653541Sshin	 */
19753541Sshin	microtime(&tv);
19853541Sshin	ip6_flow_seq = random() ^ tv.tv_usec;
19978064Sume	microtime(&tv);
20078064Sume	ip6_desync_factor = (random() ^ tv.tv_usec) % MAX_TEMP_DESYNC_FACTOR;
20153541Sshin}
20253541Sshin
20353541Sshinstatic void
20453541Sshinip6_init2(dummy)
20553541Sshin	void *dummy;
20653541Sshin{
20753541Sshin
20853541Sshin	/*
20953541Sshin	 * to route local address of p2p link to loopback,
21053541Sshin	 * assign loopback address first.
21153541Sshin	 */
21262587Sitojun	in6_ifattach(&loif[0], NULL);
21353541Sshin
21453541Sshin	/* nd6_timer_init */
21578064Sume	callout_init(&nd6_timer_ch, 0);
21678064Sume	callout_reset(&nd6_timer_ch, hz, nd6_timer, NULL);
21778064Sume
21853541Sshin	/* router renumbering prefix list maintenance */
21978064Sume	callout_init(&in6_rr_timer_ch, 0);
22078064Sume	callout_reset(&in6_rr_timer_ch, hz, in6_rr_timer, NULL);
22178064Sume
22278064Sume	/* timer for regeneranation of temporary addresses randomize ID */
22378064Sume	callout_reset(&in6_tmpaddrtimer_ch,
22478064Sume		      (ip6_temp_preferred_lifetime - ip6_desync_factor -
22578064Sume		       ip6_temp_regen_advance) * hz,
22678064Sume		      in6_tmpaddrtimer, NULL);
22753541Sshin}
22853541Sshin
22953541Sshin/* cheat */
23055009Sshin/* This must be after route_init(), which is now SI_ORDER_THIRD */
23155009SshinSYSINIT(netinet6init2, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ip6_init2, NULL);
23253541Sshin
23353541Sshin/*
23453541Sshin * IP6 input interrupt handling. Just pass the packet to ip6_input.
23553541Sshin */
23653541Sshinvoid
23753541Sshinip6intr()
23853541Sshin{
23953541Sshin	int s;
24053541Sshin	struct mbuf *m;
24153541Sshin
24253541Sshin	for (;;) {
24353541Sshin		s = splimp();
24453541Sshin		IF_DEQUEUE(&ip6intrq, m);
24553541Sshin		splx(s);
24653541Sshin		if (m == 0)
24753541Sshin			return;
24853541Sshin		ip6_input(m);
24953541Sshin	}
25053541Sshin}
25153541Sshin
25253541Sshinextern struct	route_in6 ip6_forward_rt;
25353541Sshin
25453541Sshinvoid
25553541Sshinip6_input(m)
25653541Sshin	struct mbuf *m;
25753541Sshin{
25853541Sshin	struct ip6_hdr *ip6;
25953541Sshin	int off = sizeof(struct ip6_hdr), nest;
26053541Sshin	u_int32_t plen;
26153541Sshin	u_int32_t rtalert = ~0;
26253541Sshin	int nxt, ours = 0;
26353541Sshin	struct ifnet *deliverifp = NULL;
26464060Sdarrenr#ifdef  PFIL_HOOKS
26564060Sdarrenr	struct packet_filter_hook *pfh;
26664060Sdarrenr	struct mbuf *m0;
26764060Sdarrenr	int rv;
26864060Sdarrenr#endif  /* PFIL_HOOKS */
26953541Sshin
27053541Sshin#ifdef IPSEC
27153541Sshin	/*
27253541Sshin	 * should the inner packet be considered authentic?
27353541Sshin	 * see comment in ah4_input().
27453541Sshin	 */
27553541Sshin	if (m) {
27653541Sshin		m->m_flags &= ~M_AUTHIPHDR;
27753541Sshin		m->m_flags &= ~M_AUTHIPDGM;
27853541Sshin	}
27953541Sshin#endif
28053541Sshin
28153541Sshin	/*
28278064Sume	 * make sure we don't have onion peering information into m_aux.
28378064Sume	 */
28478064Sume	ip6_delaux(m);
28578064Sume
28678064Sume	/*
28795023Ssuz	 * mbuf statistics
28853541Sshin	 */
28953541Sshin	if (m->m_flags & M_EXT) {
29053541Sshin		if (m->m_next)
29153541Sshin			ip6stat.ip6s_mext2m++;
29253541Sshin		else
29353541Sshin			ip6stat.ip6s_mext1++;
29453541Sshin	} else {
29578064Sume#define M2MMAX	(sizeof(ip6stat.ip6s_m2m)/sizeof(ip6stat.ip6s_m2m[0]))
29653541Sshin		if (m->m_next) {
29753541Sshin			if (m->m_flags & M_LOOP) {
29895023Ssuz				ip6stat.ip6s_m2m[loif[0].if_index]++;	/* XXX */
29978064Sume			} else if (m->m_pkthdr.rcvif->if_index < M2MMAX)
30053541Sshin				ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++;
30153541Sshin			else
30253541Sshin				ip6stat.ip6s_m2m[0]++;
30353541Sshin		} else
30453541Sshin			ip6stat.ip6s_m1++;
30578064Sume#undef M2MMAX
30653541Sshin	}
30753541Sshin
30853541Sshin	in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive);
30953541Sshin	ip6stat.ip6s_total++;
31053541Sshin
31162587Sitojun#ifndef PULLDOWN_TEST
31274336Skuriyama	/*
31374336Skuriyama	 * L2 bridge code and some other code can return mbuf chain
31474336Skuriyama	 * that does not conform to KAME requirement.  too bad.
31574336Skuriyama	 * XXX: fails to join if interface MTU > MCLBYTES.  jumbogram?
31674336Skuriyama	 */
31774336Skuriyama	if (m && m->m_next != NULL && m->m_pkthdr.len < MCLBYTES) {
31874336Skuriyama		struct mbuf *n;
31974336Skuriyama
32074336Skuriyama		MGETHDR(n, M_DONTWAIT, MT_HEADER);
32177003Sume		if (n)
322108466Ssam			M_MOVE_PKTHDR(n, m);
323108825Ssam		if (n && n->m_pkthdr.len > MHLEN) {
32474336Skuriyama			MCLGET(n, M_DONTWAIT);
32574336Skuriyama			if ((n->m_flags & M_EXT) == 0) {
32674336Skuriyama				m_freem(n);
32774336Skuriyama				n = NULL;
32874336Skuriyama			}
32974336Skuriyama		}
33095023Ssuz		if (n == NULL) {
33177003Sume			m_freem(m);
33274336Skuriyama			return;	/*ENOBUFS*/
33377003Sume		}
33474336Skuriyama
335108825Ssam		m_copydata(m, 0, n->m_pkthdr.len, mtod(n, caddr_t));
336108825Ssam		n->m_len = n->m_pkthdr.len;
33774336Skuriyama		m_freem(m);
33874336Skuriyama		m = n;
33974336Skuriyama	}
34053541Sshin	IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), /*nothing*/);
34162587Sitojun#endif
34253541Sshin
34353541Sshin	if (m->m_len < sizeof(struct ip6_hdr)) {
34453541Sshin		struct ifnet *inifp;
34553541Sshin		inifp = m->m_pkthdr.rcvif;
34653541Sshin		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == 0) {
34753541Sshin			ip6stat.ip6s_toosmall++;
34853541Sshin			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
34953541Sshin			return;
35053541Sshin		}
35153541Sshin	}
35253541Sshin
35353541Sshin	ip6 = mtod(m, struct ip6_hdr *);
35453541Sshin
35553541Sshin	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
35653541Sshin		ip6stat.ip6s_badvers++;
35753541Sshin		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
35853541Sshin		goto bad;
35953541Sshin	}
36053541Sshin
36164060Sdarrenr#ifdef PFIL_HOOKS
36264060Sdarrenr	/*
36364060Sdarrenr	 * Run through list of hooks for input packets.  If there are any
36464060Sdarrenr	 * filters which require that additional packets in the flow are
36564060Sdarrenr	 * not fast-forwarded, they must clear the M_CANFASTFWD flag.
36664060Sdarrenr	 * Note that filters must _never_ set this flag, as another filter
36764060Sdarrenr	 * in the list may have previously cleared it.
36864060Sdarrenr	 */
36964060Sdarrenr	m0 = m;
37064558Sume	pfh = pfil_hook_get(PFIL_IN, &inet6sw[ip6_protox[IPPROTO_IPV6]].pr_pfh);
37164060Sdarrenr	for (; pfh; pfh = pfh->pfil_link.tqe_next)
37264060Sdarrenr		if (pfh->pfil_func) {
37364060Sdarrenr			rv = pfh->pfil_func(ip6, sizeof(*ip6),
37464060Sdarrenr					    m->m_pkthdr.rcvif, 0, &m0);
37564060Sdarrenr			if (rv)
37664060Sdarrenr				return;
37764060Sdarrenr			m = m0;
37864060Sdarrenr			if (m == NULL)
37964060Sdarrenr				return;
38064060Sdarrenr			ip6 = mtod(m, struct ip6_hdr *);
38164060Sdarrenr		}
38264060Sdarrenr#endif /* PFIL_HOOKS */
38364060Sdarrenr
38453541Sshin	ip6stat.ip6s_nxthist[ip6->ip6_nxt]++;
38553541Sshin
38653541Sshin	/*
38753541Sshin	 * Check with the firewall...
38853541Sshin	 */
38966303Sume	if (ip6_fw_enable && ip6_fw_chk_ptr) {
39053541Sshin		u_short port = 0;
39153541Sshin		/* If ipfw says divert, we have to just drop packet */
39253541Sshin		/* use port as a dummy argument */
39353541Sshin		if ((*ip6_fw_chk_ptr)(&ip6, NULL, &port, &m)) {
39453541Sshin			m_freem(m);
39553541Sshin			m = NULL;
39653541Sshin		}
39753541Sshin		if (!m)
39853541Sshin			return;
39953541Sshin	}
40053541Sshin
40153541Sshin	/*
40278064Sume	 * Check against address spoofing/corruption.
40353541Sshin	 */
40453541Sshin	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) ||
40553541Sshin	    IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) {
40678064Sume		/*
40778064Sume		 * XXX: "badscope" is not very suitable for a multicast source.
40878064Sume		 */
40953541Sshin		ip6stat.ip6s_badscope++;
41053541Sshin		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
41153541Sshin		goto bad;
41253541Sshin	}
41378064Sume	if ((IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) ||
41478064Sume	     IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) &&
41578064Sume	    (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) {
41678064Sume		ip6stat.ip6s_badscope++;
41778064Sume		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
41878064Sume		goto bad;
41978064Sume	}
42095023Ssuz
42162587Sitojun	/*
42278064Sume	 * The following check is not documented in specs.  A malicious
42378064Sume	 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
42478064Sume	 * and bypass security checks (act as if it was from 127.0.0.1 by using
42578064Sume	 * IPv6 src ::ffff:127.0.0.1).	Be cautious.
42678064Sume	 *
42778064Sume	 * This check chokes if we are in an SIIT cloud.  As none of BSDs
42878064Sume	 * support IPv4-less kernel compilation, we cannot support SIIT
42978064Sume	 * environment at all.  So, it makes more sense for us to reject any
43078064Sume	 * malicious packets for non-SIIT environment, than try to do a
43178064Sume	 * partical support for SIIT environment.
43262587Sitojun	 */
43378064Sume	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
43478064Sume	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
43578064Sume		ip6stat.ip6s_badscope++;
43678064Sume		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
43778064Sume		goto bad;
43878064Sume	}
43962587Sitojun#if 0
44062587Sitojun	/*
44162587Sitojun	 * Reject packets with IPv4 compatible addresses (auto tunnel).
44262587Sitojun	 *
44362587Sitojun	 * The code forbids auto tunnel relay case in RFC1933 (the check is
44462587Sitojun	 * stronger than RFC1933).  We may want to re-enable it if mech-xx
44562587Sitojun	 * is revised to forbid relaying case.
44662587Sitojun	 */
44762587Sitojun	if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) ||
44862587Sitojun	    IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) {
44962587Sitojun		ip6stat.ip6s_badscope++;
45062587Sitojun		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
45162587Sitojun		goto bad;
45262587Sitojun	}
45362587Sitojun#endif
45475246Sume
45578064Sume	/* drop packets if interface ID portion is already filled */
45678064Sume	if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) {
45778064Sume		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src) &&
45878064Sume		    ip6->ip6_src.s6_addr16[1]) {
45953541Sshin			ip6stat.ip6s_badscope++;
46053541Sshin			goto bad;
46153541Sshin		}
46278064Sume		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) &&
46378064Sume		    ip6->ip6_dst.s6_addr16[1]) {
46478064Sume			ip6stat.ip6s_badscope++;
46578064Sume			goto bad;
46678064Sume		}
46753541Sshin	}
46853541Sshin
46978064Sume	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
47078064Sume		ip6->ip6_src.s6_addr16[1]
47178064Sume			= htons(m->m_pkthdr.rcvif->if_index);
47278064Sume	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
47378064Sume		ip6->ip6_dst.s6_addr16[1]
47478064Sume			= htons(m->m_pkthdr.rcvif->if_index);
47553541Sshin
47678064Sume#if 0 /* this case seems to be unnecessary. (jinmei, 20010401) */
47753541Sshin	/*
47878064Sume	 * We use rt->rt_ifp to determine if the address is ours or not.
47978064Sume	 * If rt_ifp is lo0, the address is ours.
48078064Sume	 * The problem here is, rt->rt_ifp for fe80::%lo0/64 is set to lo0,
48178064Sume	 * so any address under fe80::%lo0/64 will be mistakenly considered
48278064Sume	 * local.  The special case is supplied to handle the case properly
48378064Sume	 * by actually looking at interface addresses
48478064Sume	 * (using in6ifa_ifpwithaddr).
48553541Sshin	 */
48678064Sume	if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) != 0 &&
48778064Sume	    IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) {
48878064Sume		if (!in6ifa_ifpwithaddr(m->m_pkthdr.rcvif, &ip6->ip6_dst)) {
48978064Sume			icmp6_error(m, ICMP6_DST_UNREACH,
49078064Sume			    ICMP6_DST_UNREACH_ADDR, 0);
49178064Sume			/* m is already freed */
49278064Sume			return;
49378064Sume		}
49475246Sume
49578064Sume		ours = 1;
49678064Sume		deliverifp = m->m_pkthdr.rcvif;
49778064Sume		goto hbhcheck;
49878064Sume	}
49975719Sume#endif
50053541Sshin
50153541Sshin	/*
50253541Sshin	 * Multicast check
50353541Sshin	 */
50453541Sshin	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
50553541Sshin	  	struct	in6_multi *in6m = 0;
50653541Sshin
50753541Sshin		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast);
50853541Sshin		/*
50953541Sshin		 * See if we belong to the destination multicast group on the
51053541Sshin		 * arrival interface.
51153541Sshin		 */
51253541Sshin		IN6_LOOKUP_MULTI(ip6->ip6_dst, m->m_pkthdr.rcvif, in6m);
51353541Sshin		if (in6m)
51453541Sshin			ours = 1;
51556723Sshin		else if (!ip6_mrouter) {
51653541Sshin			ip6stat.ip6s_notmember++;
51753541Sshin			ip6stat.ip6s_cantforward++;
51853541Sshin			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
51953541Sshin			goto bad;
52053541Sshin		}
52153541Sshin		deliverifp = m->m_pkthdr.rcvif;
52253541Sshin		goto hbhcheck;
52353541Sshin	}
52453541Sshin
52553541Sshin	/*
52653541Sshin	 *  Unicast check
52753541Sshin	 */
52878064Sume	switch (ip6_ours_check_algorithm) {
52978064Sume	default:
53078064Sume		/*
53178064Sume		 * XXX: I intentionally broke our indentation rule here,
53278064Sume		 *      since this switch-case is just for measurement and
53378064Sume		 *      therefore should soon be removed.
53478064Sume		 */
53562587Sitojun	if (ip6_forward_rt.ro_rt != NULL &&
53662587Sitojun	    (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) != 0 &&
53762587Sitojun	    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
53878064Sume			       &((struct sockaddr_in6 *)(&ip6_forward_rt.ro_dst))->sin6_addr))
53962587Sitojun		ip6stat.ip6s_forward_cachehit++;
54062587Sitojun	else {
54178064Sume		struct sockaddr_in6 *dst6;
54278064Sume
54353541Sshin		if (ip6_forward_rt.ro_rt) {
54462587Sitojun			/* route is down or destination is different */
54562587Sitojun			ip6stat.ip6s_forward_cachemiss++;
54653541Sshin			RTFREE(ip6_forward_rt.ro_rt);
54753541Sshin			ip6_forward_rt.ro_rt = 0;
54853541Sshin		}
54962587Sitojun
55053541Sshin		bzero(&ip6_forward_rt.ro_dst, sizeof(struct sockaddr_in6));
55178064Sume		dst6 = (struct sockaddr_in6 *)&ip6_forward_rt.ro_dst;
55278064Sume		dst6->sin6_len = sizeof(struct sockaddr_in6);
55378064Sume		dst6->sin6_family = AF_INET6;
55478064Sume		dst6->sin6_addr = ip6->ip6_dst;
55562587Sitojun#ifdef SCOPEDROUTING
55662587Sitojun		ip6_forward_rt.ro_dst.sin6_scope_id =
55762587Sitojun			in6_addr2scopeid(m->m_pkthdr.rcvif, &ip6->ip6_dst);
55862587Sitojun#endif
55953541Sshin
56053541Sshin		rtalloc_ign((struct route *)&ip6_forward_rt, RTF_PRCLONING);
56153541Sshin	}
56253541Sshin
56353541Sshin#define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key))
56453541Sshin
56553541Sshin	/*
56653541Sshin	 * Accept the packet if the forwarding interface to the destination
56753541Sshin	 * according to the routing table is the loopback interface,
56853541Sshin	 * unless the associated route has a gateway.
56953541Sshin	 * Note that this approach causes to accept a packet if there is a
57053541Sshin	 * route to the loopback interface for the destination of the packet.
57153541Sshin	 * But we think it's even useful in some situations, e.g. when using
57253541Sshin	 * a special daemon which wants to intercept the packet.
57378064Sume	 *
57478064Sume	 * XXX: some OSes automatically make a cloned route for the destination
57578064Sume	 * of an outgoing packet.  If the outgoing interface of the packet
57678064Sume	 * is a loopback one, the kernel would consider the packet to be
57778064Sume	 * accepted, even if we have no such address assinged on the interface.
57878064Sume	 * We check the cloned flag of the route entry to reject such cases,
57978064Sume	 * assuming that route entries for our own addresses are not made by
58078064Sume	 * cloning (it should be true because in6_addloop explicitly installs
58178064Sume	 * the host route).  However, we might have to do an explicit check
58278064Sume	 * while it would be less efficient.  Or, should we rather install a
58378064Sume	 * reject route for such a case?
58453541Sshin	 */
58553541Sshin	if (ip6_forward_rt.ro_rt &&
58653541Sshin	    (ip6_forward_rt.ro_rt->rt_flags &
58753541Sshin	     (RTF_HOST|RTF_GATEWAY)) == RTF_HOST &&
58878064Sume#ifdef RTF_WASCLONED
58978064Sume	    !(ip6_forward_rt.ro_rt->rt_flags & RTF_WASCLONED) &&
59078064Sume#endif
59178064Sume#ifdef RTF_CLONED
59278064Sume	    !(ip6_forward_rt.ro_rt->rt_flags & RTF_CLONED) &&
59378064Sume#endif
59462587Sitojun#if 0
59553541Sshin	    /*
59662587Sitojun	     * The check below is redundant since the comparison of
59762587Sitojun	     * the destination and the key of the rtentry has
59862587Sitojun	     * already done through looking up the routing table.
59953541Sshin	     */
60062587Sitojun	    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
60178064Sume				&rt6_key(ip6_forward_rt.ro_rt)->sin6_addr)
60262587Sitojun#endif
60353541Sshin	    ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_LOOP) {
60453541Sshin		struct in6_ifaddr *ia6 =
60553541Sshin			(struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa;
60678064Sume
60762587Sitojun		/*
60878064Sume		 * record address information into m_aux.
60978064Sume		 */
61078064Sume		(void)ip6_setdstifaddr(m, ia6);
61178064Sume
61278064Sume		/*
61362587Sitojun		 * packets to a tentative, duplicated, or somehow invalid
61462587Sitojun		 * address must not be accepted.
61562587Sitojun		 */
61653541Sshin		if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) {
61762587Sitojun			/* this address is ready */
61853541Sshin			ours = 1;
61953541Sshin			deliverifp = ia6->ia_ifp;	/* correct? */
62067334Sjoe			/* Count the packet in the ip address stats */
62167334Sjoe			ia6->ia_ifa.if_ipackets++;
62267334Sjoe			ia6->ia_ifa.if_ibytes += m->m_pkthdr.len;
62353541Sshin			goto hbhcheck;
62453541Sshin		} else {
62562587Sitojun			/* address is not ready, so discard the packet. */
62678064Sume			nd6log((LOG_INFO,
62778064Sume			    "ip6_input: packet to an unready address %s->%s\n",
62862587Sitojun			    ip6_sprintf(&ip6->ip6_src),
62978064Sume			    ip6_sprintf(&ip6->ip6_dst)));
63062587Sitojun
63162587Sitojun			goto bad;
63253541Sshin		}
63353541Sshin	}
63478064Sume	} /* XXX indentation (see above) */
63553541Sshin
63653541Sshin	/*
63753541Sshin	 * FAITH(Firewall Aided Internet Translator)
63853541Sshin	 */
63953541Sshin	if (ip6_keepfaith) {
64053541Sshin		if (ip6_forward_rt.ro_rt && ip6_forward_rt.ro_rt->rt_ifp
64153541Sshin		 && ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) {
64253541Sshin			/* XXX do we need more sanity checks? */
64353541Sshin			ours = 1;
64495023Ssuz			deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /* faith */
64553541Sshin			goto hbhcheck;
64653541Sshin		}
64753541Sshin	}
64853541Sshin
64953541Sshin	/*
65053541Sshin	 * Now there is no reason to process the packet if it's not our own
65153541Sshin	 * and we're not a router.
65253541Sshin	 */
65353541Sshin	if (!ip6_forwarding) {
65453541Sshin		ip6stat.ip6s_cantforward++;
65553541Sshin		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
65653541Sshin		goto bad;
65753541Sshin	}
65853541Sshin
65953541Sshin  hbhcheck:
66053541Sshin	/*
66178064Sume	 * record address information into m_aux, if we don't have one yet.
66278064Sume	 * note that we are unable to record it, if the address is not listed
66378064Sume	 * as our interface address (e.g. multicast addresses, addresses
66478064Sume	 * within FAITH prefixes and such).
66578064Sume	 */
66678064Sume	if (deliverifp && !ip6_getdstifaddr(m)) {
66778064Sume		struct in6_ifaddr *ia6;
66878064Sume
66978064Sume		ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
67078064Sume		if (ia6) {
67178064Sume			if (!ip6_setdstifaddr(m, ia6)) {
67278064Sume				/*
67378064Sume				 * XXX maybe we should drop the packet here,
67478064Sume				 * as we could not provide enough information
67578064Sume				 * to the upper layers.
67678064Sume				 */
67778064Sume			}
67878064Sume		}
67978064Sume	}
68078064Sume
68178064Sume	/*
68253541Sshin	 * Process Hop-by-Hop options header if it's contained.
68353541Sshin	 * m may be modified in ip6_hopopts_input().
68453541Sshin	 * If a JumboPayload option is included, plen will also be modified.
68553541Sshin	 */
68653541Sshin	plen = (u_int32_t)ntohs(ip6->ip6_plen);
68753541Sshin	if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
68862587Sitojun		struct ip6_hbh *hbh;
68962587Sitojun
69053541Sshin		if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) {
69162587Sitojun#if 0	/*touches NULL pointer*/
69253541Sshin			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
69362587Sitojun#endif
69453541Sshin			return;	/* m have already been freed */
69553541Sshin		}
69662587Sitojun
69753541Sshin		/* adjust pointer */
69853541Sshin		ip6 = mtod(m, struct ip6_hdr *);
69953541Sshin
70053541Sshin		/*
70195023Ssuz		 * if the payload length field is 0 and the next header field
70262587Sitojun		 * indicates Hop-by-Hop Options header, then a Jumbo Payload
70362587Sitojun		 * option MUST be included.
70462587Sitojun		 */
70562587Sitojun		if (ip6->ip6_plen == 0 && plen == 0) {
70662587Sitojun			/*
70762587Sitojun			 * Note that if a valid jumbo payload option is
70862587Sitojun			 * contained, ip6_hoptops_input() must set a valid
70962587Sitojun			 * (non-zero) payload length to the variable plen.
71062587Sitojun			 */
71162587Sitojun			ip6stat.ip6s_badoptions++;
71262587Sitojun			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
71362587Sitojun			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
71462587Sitojun			icmp6_error(m, ICMP6_PARAM_PROB,
71562587Sitojun				    ICMP6_PARAMPROB_HEADER,
71662587Sitojun				    (caddr_t)&ip6->ip6_plen - (caddr_t)ip6);
71762587Sitojun			return;
71862587Sitojun		}
71962587Sitojun#ifndef PULLDOWN_TEST
72062587Sitojun		/* ip6_hopopts_input() ensures that mbuf is contiguous */
72162587Sitojun		hbh = (struct ip6_hbh *)(ip6 + 1);
72262587Sitojun#else
72362587Sitojun		IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
72462587Sitojun			sizeof(struct ip6_hbh));
72562587Sitojun		if (hbh == NULL) {
72662587Sitojun			ip6stat.ip6s_tooshort++;
72762587Sitojun			return;
72862587Sitojun		}
72962587Sitojun#endif
73062587Sitojun		nxt = hbh->ip6h_nxt;
73162587Sitojun
73262587Sitojun		/*
73353541Sshin		 * accept the packet if a router alert option is included
73453541Sshin		 * and we act as an IPv6 router.
73553541Sshin		 */
73653541Sshin		if (rtalert != ~0 && ip6_forwarding)
73753541Sshin			ours = 1;
73853541Sshin	} else
73953541Sshin		nxt = ip6->ip6_nxt;
74053541Sshin
74153541Sshin	/*
74253541Sshin	 * Check that the amount of data in the buffers
74353541Sshin	 * is as at least much as the IPv6 header would have us expect.
74453541Sshin	 * Trim mbufs if longer than we expect.
74553541Sshin	 * Drop packet if shorter than we expect.
74653541Sshin	 */
74753541Sshin	if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
74853541Sshin		ip6stat.ip6s_tooshort++;
74953541Sshin		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
75053541Sshin		goto bad;
75153541Sshin	}
75253541Sshin	if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
75353541Sshin		if (m->m_len == m->m_pkthdr.len) {
75453541Sshin			m->m_len = sizeof(struct ip6_hdr) + plen;
75553541Sshin			m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
75653541Sshin		} else
75753541Sshin			m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len);
75853541Sshin	}
75953541Sshin
76053541Sshin	/*
76153541Sshin	 * Forward if desirable.
76253541Sshin	 */
76353541Sshin	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
76456723Sshin		/*
76556723Sshin		 * If we are acting as a multicast router, all
76656723Sshin		 * incoming multicast packets are passed to the
76756723Sshin		 * kernel-level multicast forwarding function.
76856723Sshin		 * The packet is returned (relatively) intact; if
76956723Sshin		 * ip6_mforward() returns a non-zero value, the packet
77056723Sshin		 * must be discarded, else it may be accepted below.
77156723Sshin		 */
77256723Sshin		if (ip6_mrouter && ip6_mforward(ip6, m->m_pkthdr.rcvif, m)) {
77356723Sshin			ip6stat.ip6s_cantforward++;
77456723Sshin			m_freem(m);
77556723Sshin			return;
77656723Sshin		}
77753541Sshin		if (!ours) {
77853541Sshin			m_freem(m);
77953541Sshin			return;
78053541Sshin		}
78153541Sshin	} else if (!ours) {
78253541Sshin		ip6_forward(m, 0);
78353541Sshin		return;
78453541Sshin	}
78553541Sshin
78662587Sitojun	ip6 = mtod(m, struct ip6_hdr *);
78762587Sitojun
78853541Sshin	/*
78962587Sitojun	 * Malicious party may be able to use IPv4 mapped addr to confuse
79062587Sitojun	 * tcp/udp stack and bypass security checks (act as if it was from
79162587Sitojun	 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1).  Be cautious.
79262587Sitojun	 *
79362587Sitojun	 * For SIIT end node behavior, you may want to disable the check.
79462587Sitojun	 * However, you will  become vulnerable to attacks using IPv4 mapped
79562587Sitojun	 * source.
79662587Sitojun	 */
79762587Sitojun	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
79862587Sitojun	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
79962587Sitojun		ip6stat.ip6s_badscope++;
80062587Sitojun		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
80162587Sitojun		goto bad;
80262587Sitojun	}
80362587Sitojun
80462587Sitojun	/*
80553541Sshin	 * Tell launch routine the next header
80653541Sshin	 */
80753541Sshin	ip6stat.ip6s_delivered++;
80853541Sshin	in6_ifstat_inc(deliverifp, ifs6_in_deliver);
80953541Sshin	nest = 0;
81078064Sume
81153541Sshin	while (nxt != IPPROTO_DONE) {
81253541Sshin		if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
81353541Sshin			ip6stat.ip6s_toomanyhdr++;
81453541Sshin			goto bad;
81553541Sshin		}
81653541Sshin
81753541Sshin		/*
81853541Sshin		 * protection against faulty packet - there should be
81953541Sshin		 * more sanity checks in header chain processing.
82053541Sshin		 */
82153541Sshin		if (m->m_pkthdr.len < off) {
82253541Sshin			ip6stat.ip6s_tooshort++;
82353541Sshin			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
82453541Sshin			goto bad;
82553541Sshin		}
82653541Sshin
82778064Sume#if 0
82878064Sume		/*
82978064Sume		 * do we need to do it for every header?  yeah, other
83078064Sume		 * functions can play with it (like re-allocate and copy).
83178064Sume		 */
83278064Sume		mhist = ip6_addaux(m);
83378064Sume		if (mhist && M_TRAILINGSPACE(mhist) >= sizeof(nxt)) {
83478064Sume			hist = mtod(mhist, caddr_t) + mhist->m_len;
83578064Sume			bcopy(&nxt, hist, sizeof(nxt));
83678064Sume			mhist->m_len += sizeof(nxt);
83778064Sume		} else {
83878064Sume			ip6stat.ip6s_toomanyhdr++;
83978064Sume			goto bad;
84078064Sume		}
84178064Sume#endif
84278064Sume
84378064Sume#ifdef IPSEC
84478064Sume		/*
84578064Sume		 * enforce IPsec policy checking if we are seeing last header.
84678064Sume		 * note that we do not visit this with protocols with pcb layer
84778064Sume		 * code - like udp/tcp/raw ip.
84878064Sume		 */
84978064Sume		if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
85078064Sume		    ipsec6_in_reject(m, NULL)) {
85178064Sume			ipsec6stat.in_polvio++;
85278064Sume			goto bad;
85378064Sume		}
85478064Sume#endif
85578064Sume
85653541Sshin		nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt);
85753541Sshin	}
85853541Sshin	return;
85953541Sshin bad:
86053541Sshin	m_freem(m);
86153541Sshin}
86253541Sshin
86353541Sshin/*
86478064Sume * set/grab in6_ifaddr correspond to IPv6 destination address.
86578064Sume * XXX backward compatibility wrapper
86678064Sume */
867105194Ssamstatic struct ip6aux *
86878064Sumeip6_setdstifaddr(m, ia6)
86978064Sume	struct mbuf *m;
87078064Sume	struct in6_ifaddr *ia6;
87178064Sume{
872105194Ssam	struct ip6aux *n;
87378064Sume
87478064Sume	n = ip6_addaux(m);
87578064Sume	if (n)
876105194Ssam		n->ip6a_dstia6 = ia6;
87778064Sume	return n;	/* NULL if failed to set */
87878064Sume}
87978064Sume
88078064Sumestruct in6_ifaddr *
88178064Sumeip6_getdstifaddr(m)
88278064Sume	struct mbuf *m;
88378064Sume{
884105194Ssam	struct ip6aux *n;
88578064Sume
88678064Sume	n = ip6_findaux(m);
88778064Sume	if (n)
888105194Ssam		return n->ip6a_dstia6;
88978064Sume	else
89078064Sume		return NULL;
89178064Sume}
89278064Sume
89378064Sume/*
89453541Sshin * Hop-by-Hop options header processing. If a valid jumbo payload option is
89553541Sshin * included, the real payload length will be stored in plenp.
89653541Sshin */
89753541Sshinstatic int
89853541Sshinip6_hopopts_input(plenp, rtalertp, mp, offp)
89953541Sshin	u_int32_t *plenp;
90053541Sshin	u_int32_t *rtalertp;	/* XXX: should be stored more smart way */
90153541Sshin	struct mbuf **mp;
90253541Sshin	int *offp;
90353541Sshin{
90478064Sume	struct mbuf *m = *mp;
90553541Sshin	int off = *offp, hbhlen;
90653541Sshin	struct ip6_hbh *hbh;
90753541Sshin	u_int8_t *opt;
90853541Sshin
90953541Sshin	/* validation of the length of the header */
91062587Sitojun#ifndef PULLDOWN_TEST
91153541Sshin	IP6_EXTHDR_CHECK(m, off, sizeof(*hbh), -1);
91253541Sshin	hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off);
91353541Sshin	hbhlen = (hbh->ip6h_len + 1) << 3;
91453541Sshin
91553541Sshin	IP6_EXTHDR_CHECK(m, off, hbhlen, -1);
91653541Sshin	hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off);
91762587Sitojun#else
91862587Sitojun	IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m,
91962587Sitojun		sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
92062587Sitojun	if (hbh == NULL) {
92162587Sitojun		ip6stat.ip6s_tooshort++;
92262587Sitojun		return -1;
92362587Sitojun	}
92462587Sitojun	hbhlen = (hbh->ip6h_len + 1) << 3;
92562587Sitojun	IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
92662587Sitojun		hbhlen);
92762587Sitojun	if (hbh == NULL) {
92862587Sitojun		ip6stat.ip6s_tooshort++;
92962587Sitojun		return -1;
93062587Sitojun	}
93162587Sitojun#endif
93253541Sshin	off += hbhlen;
93353541Sshin	hbhlen -= sizeof(struct ip6_hbh);
93453541Sshin	opt = (u_int8_t *)hbh + sizeof(struct ip6_hbh);
93553541Sshin
93653541Sshin	if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
93753541Sshin				hbhlen, rtalertp, plenp) < 0)
93853541Sshin		return(-1);
93953541Sshin
94053541Sshin	*offp = off;
94153541Sshin	*mp = m;
94253541Sshin	return(0);
94353541Sshin}
94453541Sshin
94553541Sshin/*
94653541Sshin * Search header for all Hop-by-hop options and process each option.
94753541Sshin * This function is separate from ip6_hopopts_input() in order to
94853541Sshin * handle a case where the sending node itself process its hop-by-hop
94953541Sshin * options header. In such a case, the function is called from ip6_output().
95078064Sume *
95178064Sume * The function assumes that hbh header is located right after the IPv6 header
95278064Sume * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
95378064Sume * opthead + hbhlen is located in continuous memory region.
95453541Sshin */
95553541Sshinint
95653541Sshinip6_process_hopopts(m, opthead, hbhlen, rtalertp, plenp)
95753541Sshin	struct mbuf *m;
95853541Sshin	u_int8_t *opthead;
95953541Sshin	int hbhlen;
96053541Sshin	u_int32_t *rtalertp;
96153541Sshin	u_int32_t *plenp;
96253541Sshin{
96353541Sshin	struct ip6_hdr *ip6;
96453541Sshin	int optlen = 0;
96553541Sshin	u_int8_t *opt = opthead;
96653541Sshin	u_int16_t rtalert_val;
96762587Sitojun	u_int32_t jumboplen;
96878064Sume	const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh);
96953541Sshin
97053541Sshin	for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) {
97178064Sume		switch (*opt) {
97278064Sume		case IP6OPT_PAD1:
97378064Sume			optlen = 1;
97478064Sume			break;
97578064Sume		case IP6OPT_PADN:
97678064Sume			if (hbhlen < IP6OPT_MINLEN) {
97778064Sume				ip6stat.ip6s_toosmall++;
97878064Sume				goto bad;
97978064Sume			}
98078064Sume			optlen = *(opt + 1) + 2;
98178064Sume			break;
98278064Sume		case IP6OPT_RTALERT:
98362587Sitojun			/* XXX may need check for alignment */
98478064Sume			if (hbhlen < IP6OPT_RTALERT_LEN) {
98578064Sume				ip6stat.ip6s_toosmall++;
98678064Sume				goto bad;
98778064Sume			}
98878064Sume			if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) {
98978064Sume				/* XXX stat */
99078064Sume				icmp6_error(m, ICMP6_PARAM_PROB,
99178064Sume					    ICMP6_PARAMPROB_HEADER,
99278064Sume					    erroff + opt + 1 - opthead);
99378064Sume				return(-1);
99478064Sume			}
99578064Sume			optlen = IP6OPT_RTALERT_LEN;
99678064Sume			bcopy((caddr_t)(opt + 2), (caddr_t)&rtalert_val, 2);
99778064Sume			*rtalertp = ntohs(rtalert_val);
99878064Sume			break;
99978064Sume		case IP6OPT_JUMBO:
100078064Sume			/* XXX may need check for alignment */
100162587Sitojun			if (hbhlen < IP6OPT_JUMBO_LEN) {
100262587Sitojun				ip6stat.ip6s_toosmall++;
100362587Sitojun				goto bad;
100462587Sitojun			}
100578064Sume			if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) {
100678064Sume				/* XXX stat */
100778064Sume				icmp6_error(m, ICMP6_PARAM_PROB,
100878064Sume					    ICMP6_PARAMPROB_HEADER,
100978064Sume					    erroff + opt + 1 - opthead);
101078064Sume				return(-1);
101178064Sume			}
101262587Sitojun			optlen = IP6OPT_JUMBO_LEN;
101353541Sshin
101462587Sitojun			/*
101562587Sitojun			 * IPv6 packets that have non 0 payload length
101678064Sume			 * must not contain a jumbo payload option.
101762587Sitojun			 */
101862587Sitojun			ip6 = mtod(m, struct ip6_hdr *);
101962587Sitojun			if (ip6->ip6_plen) {
102062587Sitojun				ip6stat.ip6s_badoptions++;
102162587Sitojun				icmp6_error(m, ICMP6_PARAM_PROB,
102262587Sitojun					    ICMP6_PARAMPROB_HEADER,
102378064Sume					    erroff + opt - opthead);
102462587Sitojun				return(-1);
102562587Sitojun			}
102653541Sshin
102762587Sitojun			/*
102862587Sitojun			 * We may see jumbolen in unaligned location, so
102962587Sitojun			 * we'd need to perform bcopy().
103062587Sitojun			 */
103162587Sitojun			bcopy(opt + 2, &jumboplen, sizeof(jumboplen));
103262587Sitojun			jumboplen = (u_int32_t)htonl(jumboplen);
103362587Sitojun
103462587Sitojun#if 1
103562587Sitojun			/*
103662587Sitojun			 * if there are multiple jumbo payload options,
103762587Sitojun			 * *plenp will be non-zero and the packet will be
103862587Sitojun			 * rejected.
103962587Sitojun			 * the behavior may need some debate in ipngwg -
104062587Sitojun			 * multiple options does not make sense, however,
104162587Sitojun			 * there's no explicit mention in specification.
104262587Sitojun			 */
104362587Sitojun			if (*plenp != 0) {
104462587Sitojun				ip6stat.ip6s_badoptions++;
104562587Sitojun				icmp6_error(m, ICMP6_PARAM_PROB,
104662587Sitojun					    ICMP6_PARAMPROB_HEADER,
104778064Sume					    erroff + opt + 2 - opthead);
104862587Sitojun				return(-1);
104962587Sitojun			}
105062587Sitojun#endif
105162587Sitojun
105262587Sitojun			/*
105362587Sitojun			 * jumbo payload length must be larger than 65535.
105462587Sitojun			 */
105562587Sitojun			if (jumboplen <= IPV6_MAXPACKET) {
105662587Sitojun				ip6stat.ip6s_badoptions++;
105762587Sitojun				icmp6_error(m, ICMP6_PARAM_PROB,
105862587Sitojun					    ICMP6_PARAMPROB_HEADER,
105978064Sume					    erroff + opt + 2 - opthead);
106062587Sitojun				return(-1);
106162587Sitojun			}
106262587Sitojun			*plenp = jumboplen;
106362587Sitojun
106462587Sitojun			break;
106578064Sume		default:		/* unknown option */
106678064Sume			if (hbhlen < IP6OPT_MINLEN) {
106778064Sume				ip6stat.ip6s_toosmall++;
106878064Sume				goto bad;
106978064Sume			}
107078064Sume			optlen = ip6_unknown_opt(opt, m,
107178064Sume			    erroff + opt - opthead);
107278064Sume			if (optlen == -1)
107378064Sume				return(-1);
107478064Sume			optlen += 2;
107578064Sume			break;
107653541Sshin		}
107753541Sshin	}
107853541Sshin
107953541Sshin	return(0);
108053541Sshin
108153541Sshin  bad:
108253541Sshin	m_freem(m);
108353541Sshin	return(-1);
108453541Sshin}
108553541Sshin
108653541Sshin/*
108753541Sshin * Unknown option processing.
108853541Sshin * The third argument `off' is the offset from the IPv6 header to the option,
108953541Sshin * which is necessary if the IPv6 header the and option header and IPv6 header
109053541Sshin * is not continuous in order to return an ICMPv6 error.
109153541Sshin */
109253541Sshinint
109353541Sshinip6_unknown_opt(optp, m, off)
109453541Sshin	u_int8_t *optp;
109553541Sshin	struct mbuf *m;
109653541Sshin	int off;
109753541Sshin{
109853541Sshin	struct ip6_hdr *ip6;
109953541Sshin
110078064Sume	switch (IP6OPT_TYPE(*optp)) {
110178064Sume	case IP6OPT_TYPE_SKIP: /* ignore the option */
110278064Sume		return((int)*(optp + 1));
110378064Sume	case IP6OPT_TYPE_DISCARD:	/* silently discard */
110478064Sume		m_freem(m);
110578064Sume		return(-1);
110678064Sume	case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */
110778064Sume		ip6stat.ip6s_badoptions++;
110878064Sume		icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off);
110978064Sume		return(-1);
111078064Sume	case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */
111178064Sume		ip6stat.ip6s_badoptions++;
111278064Sume		ip6 = mtod(m, struct ip6_hdr *);
111378064Sume		if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
111478064Sume		    (m->m_flags & (M_BCAST|M_MCAST)))
111578064Sume			m_freem(m);
111678064Sume		else
111778064Sume			icmp6_error(m, ICMP6_PARAM_PROB,
111878064Sume				    ICMP6_PARAMPROB_OPTION, off);
111978064Sume		return(-1);
112053541Sshin	}
112153541Sshin
112253541Sshin	m_freem(m);		/* XXX: NOTREACHED */
112353541Sshin	return(-1);
112453541Sshin}
112553541Sshin
112653541Sshin/*
112762587Sitojun * Create the "control" list for this pcb.
112878064Sume * The function will not modify mbuf chain at all.
112962587Sitojun *
113078064Sume * with KAME mbuf chain restriction:
113162587Sitojun * The routine will be called from upper layer handlers like tcp6_input().
113262587Sitojun * Thus the routine assumes that the caller (tcp6_input) have already
113362587Sitojun * called IP6_EXTHDR_CHECK() and all the extension headers are located in the
113462587Sitojun * very first mbuf on the mbuf chain.
113553541Sshin */
113653541Sshinvoid
113753541Sshinip6_savecontrol(in6p, mp, ip6, m)
113878064Sume	struct inpcb *in6p;
113978064Sume	struct mbuf **mp;
114078064Sume	struct ip6_hdr *ip6;
114178064Sume	struct mbuf *m;
114253541Sshin{
114397676Sume#if __FreeBSD_version >= 500000
114493593Sjhb	struct thread *td = curthread;	/* XXX */
114593593Sjhb#else
114693593Sjhb	struct proc *td = curproc;	/* XXX */
114793593Sjhb#endif
114878064Sume	int privileged = 0;
114978064Sume	int rthdr_exist = 0;
115053541Sshin
115178064Sume
115293593Sjhb	if (td && !suser(td))
115378064Sume 		privileged++;
115453541Sshin
115578064Sume#ifdef SO_TIMESTAMP
115678064Sume	if ((in6p->in6p_socket->so_options & SO_TIMESTAMP) != 0) {
115753541Sshin		struct timeval tv;
115853541Sshin
115953541Sshin		microtime(&tv);
116053541Sshin		*mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
116178064Sume				      SCM_TIMESTAMP, SOL_SOCKET);
116278064Sume		if (*mp) {
116353541Sshin			mp = &(*mp)->m_next;
116478064Sume		}
116597658Stanimura	}
116662587Sitojun#endif
116762587Sitojun
116853541Sshin	/* RFC 2292 sec. 5 */
116978064Sume	if ((in6p->in6p_flags & IN6P_PKTINFO) != 0) {
117053541Sshin		struct in6_pktinfo pi6;
117153541Sshin		bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr));
117253541Sshin		if (IN6_IS_SCOPE_LINKLOCAL(&pi6.ipi6_addr))
117353541Sshin			pi6.ipi6_addr.s6_addr16[1] = 0;
117453541Sshin		pi6.ipi6_ifindex = (m && m->m_pkthdr.rcvif)
117553541Sshin					? m->m_pkthdr.rcvif->if_index
117653541Sshin					: 0;
117753541Sshin		*mp = sbcreatecontrol((caddr_t) &pi6,
117853541Sshin			sizeof(struct in6_pktinfo), IPV6_PKTINFO,
117953541Sshin			IPPROTO_IPV6);
118053541Sshin		if (*mp)
118153541Sshin			mp = &(*mp)->m_next;
118253541Sshin	}
118378064Sume
118478064Sume	if ((in6p->in6p_flags & IN6P_HOPLIMIT) != 0) {
118553541Sshin		int hlim = ip6->ip6_hlim & 0xff;
118653541Sshin		*mp = sbcreatecontrol((caddr_t) &hlim,
118753541Sshin			sizeof(int), IPV6_HOPLIMIT, IPPROTO_IPV6);
118853541Sshin		if (*mp)
118953541Sshin			mp = &(*mp)->m_next;
119053541Sshin	}
119153541Sshin
119253541Sshin	/*
119353541Sshin	 * IPV6_HOPOPTS socket option. We require super-user privilege
119453541Sshin	 * for the option, but it might be too strict, since there might
119553541Sshin	 * be some hop-by-hop options which can be returned to normal user.
119653541Sshin	 * See RFC 2292 section 6.
119753541Sshin	 */
119878064Sume	if ((in6p->in6p_flags & IN6P_HOPOPTS) != 0 && privileged) {
119953541Sshin		/*
120053541Sshin		 * Check if a hop-by-hop options header is contatined in the
120153541Sshin		 * received packet, and if so, store the options as ancillary
120253541Sshin		 * data. Note that a hop-by-hop options header must be
120353541Sshin		 * just after the IPv6 header, which fact is assured through
120453541Sshin		 * the IPv6 input processing.
120553541Sshin		 */
120653541Sshin		struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
120753541Sshin		if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
120862587Sitojun			struct ip6_hbh *hbh;
120978064Sume			int hbhlen = 0;
121078064Sume#ifdef PULLDOWN_TEST
121178064Sume			struct mbuf *ext;
121278064Sume#endif
121353541Sshin
121462587Sitojun#ifndef PULLDOWN_TEST
121562587Sitojun			hbh = (struct ip6_hbh *)(ip6 + 1);
121662587Sitojun			hbhlen = (hbh->ip6h_len + 1) << 3;
121762587Sitojun#else
121878064Sume			ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr),
121978064Sume			    ip6->ip6_nxt);
122078064Sume			if (ext == NULL) {
122162587Sitojun				ip6stat.ip6s_tooshort++;
122262587Sitojun				return;
122362587Sitojun			}
122478064Sume			hbh = mtod(ext, struct ip6_hbh *);
122562587Sitojun			hbhlen = (hbh->ip6h_len + 1) << 3;
122678064Sume			if (hbhlen != ext->m_len) {
122778064Sume				m_freem(ext);
122862587Sitojun				ip6stat.ip6s_tooshort++;
122962587Sitojun				return;
123062587Sitojun			}
123162587Sitojun#endif
123262587Sitojun
123353541Sshin			/*
123453541Sshin			 * XXX: We copy whole the header even if a jumbo
123553541Sshin			 * payload option is included, which option is to
123653541Sshin			 * be removed before returning in the RFC 2292.
123778064Sume			 * Note: this constraint is removed in 2292bis.
123853541Sshin			 */
123962587Sitojun			*mp = sbcreatecontrol((caddr_t)hbh, hbhlen,
124053541Sshin					      IPV6_HOPOPTS, IPPROTO_IPV6);
124153541Sshin			if (*mp)
124253541Sshin				mp = &(*mp)->m_next;
124378064Sume#ifdef PULLDOWN_TEST
124478064Sume			m_freem(ext);
124578064Sume#endif
124653541Sshin		}
124753541Sshin	}
124853541Sshin
124953541Sshin	/* IPV6_DSTOPTS and IPV6_RTHDR socket options */
125078064Sume	if ((in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDRDSTOPTS)) != 0) {
125178064Sume		int proto, off, nxt;
125278064Sume
125378064Sume		/*
125478064Sume		 * go through the header chain to see if a routing header is
125578064Sume		 * contained in the packet. We need this information to store
125678064Sume		 * destination options headers (if any) properly.
125778064Sume		 * XXX: performance issue. We should record this info when
125878064Sume		 * processing extension headers in incoming routine.
125978064Sume		 * (todo) use m_aux?
126078064Sume		 */
126178064Sume		proto = IPPROTO_IPV6;
126278064Sume		off = 0;
126378064Sume		nxt = -1;
126478064Sume		while (1) {
126578064Sume			int newoff;
126678064Sume
126778064Sume			newoff = ip6_nexthdr(m, off, proto, &nxt);
126878064Sume			if (newoff < 0)
126978064Sume				break;
127078064Sume			if (newoff < off) /* invalid, check for safety */
127178064Sume				break;
127278064Sume			if ((proto = nxt) == IPPROTO_ROUTING) {
127378064Sume				rthdr_exist = 1;
127478064Sume				break;
127578064Sume			}
127678064Sume			off = newoff;
127778064Sume		}
127878064Sume	}
127978064Sume
128078064Sume	if ((in6p->in6p_flags &
128178064Sume	     (IN6P_RTHDR | IN6P_DSTOPTS | IN6P_RTHDRDSTOPTS)) != 0) {
128253541Sshin		struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
128378064Sume		int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr);
128453541Sshin
128553541Sshin		/*
128653541Sshin		 * Search for destination options headers or routing
128753541Sshin		 * header(s) through the header chain, and stores each
128853541Sshin		 * header as ancillary data.
128953541Sshin		 * Note that the order of the headers remains in
129053541Sshin		 * the chain of ancillary data.
129153541Sshin		 */
129278064Sume		while (1) {	/* is explicit loop prevention necessary? */
129378064Sume			struct ip6_ext *ip6e = NULL;
129462587Sitojun			int elen;
129578064Sume#ifdef PULLDOWN_TEST
129678064Sume			struct mbuf *ext = NULL;
129778064Sume#endif
129853541Sshin
129978064Sume			/*
130078064Sume			 * if it is not an extension header, don't try to
130178064Sume			 * pull it from the chain.
130278064Sume			 */
130378064Sume			switch (nxt) {
130478064Sume			case IPPROTO_DSTOPTS:
130578064Sume			case IPPROTO_ROUTING:
130678064Sume			case IPPROTO_HOPOPTS:
130778064Sume			case IPPROTO_AH: /* is it possible? */
130878064Sume				break;
130978064Sume			default:
131078064Sume				goto loopend;
131178064Sume			}
131278064Sume
131362587Sitojun#ifndef PULLDOWN_TEST
131478064Sume			if (off + sizeof(*ip6e) > m->m_len)
131578064Sume				goto loopend;
131662587Sitojun			ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off);
131762587Sitojun			if (nxt == IPPROTO_AH)
131862587Sitojun				elen = (ip6e->ip6e_len + 2) << 2;
131962587Sitojun			else
132062587Sitojun				elen = (ip6e->ip6e_len + 1) << 3;
132178064Sume			if (off + elen > m->m_len)
132278064Sume				goto loopend;
132362587Sitojun#else
132478064Sume			ext = ip6_pullexthdr(m, off, nxt);
132578064Sume			if (ext == NULL) {
132662587Sitojun				ip6stat.ip6s_tooshort++;
132762587Sitojun				return;
132862587Sitojun			}
132978064Sume			ip6e = mtod(ext, struct ip6_ext *);
133062587Sitojun			if (nxt == IPPROTO_AH)
133162587Sitojun				elen = (ip6e->ip6e_len + 2) << 2;
133262587Sitojun			else
133362587Sitojun				elen = (ip6e->ip6e_len + 1) << 3;
133478064Sume			if (elen != ext->m_len) {
133578064Sume				m_freem(ext);
133662587Sitojun				ip6stat.ip6s_tooshort++;
133762587Sitojun				return;
133862587Sitojun			}
133962587Sitojun#endif
134062587Sitojun
134178064Sume			switch (nxt) {
134278064Sume			case IPPROTO_DSTOPTS:
134378064Sume				if ((in6p->in6p_flags & IN6P_DSTOPTS) == 0)
134478064Sume					break;
134553541Sshin
134678064Sume				/*
134778064Sume				 * We also require super-user privilege for
134878064Sume				 * the option.
134978064Sume				 * See the comments on IN6_HOPOPTS.
135078064Sume				 */
135178064Sume				if (!privileged)
135278064Sume					break;
135353541Sshin
135478064Sume				*mp = sbcreatecontrol((caddr_t)ip6e, elen,
135578064Sume						      IPV6_DSTOPTS,
135678064Sume						      IPPROTO_IPV6);
135778064Sume				if (*mp)
135878064Sume					mp = &(*mp)->m_next;
135978064Sume				break;
136078064Sume			case IPPROTO_ROUTING:
136178064Sume				if (!in6p->in6p_flags & IN6P_RTHDR)
136278064Sume					break;
136353541Sshin
136478064Sume				*mp = sbcreatecontrol((caddr_t)ip6e, elen,
136578064Sume						      IPV6_RTHDR,
136678064Sume						      IPPROTO_IPV6);
136778064Sume				if (*mp)
136878064Sume					mp = &(*mp)->m_next;
136978064Sume				break;
137078064Sume			case IPPROTO_HOPOPTS:
137178064Sume			case IPPROTO_AH: /* is it possible? */
137278064Sume				break;
137353541Sshin
137478064Sume			default:
137578064Sume				/*
137678064Sume			 	 * other cases have been filtered in the above.
137778064Sume				 * none will visit this case.  here we supply
137878064Sume				 * the code just in case (nxt overwritten or
137978064Sume				 * other cases).
138078064Sume				 */
138178064Sume#ifdef PULLDOWN_TEST
138278064Sume				m_freem(ext);
138378064Sume#endif
138478064Sume				goto loopend;
138553541Sshin
138653541Sshin			}
138753541Sshin
138853541Sshin			/* proceed with the next header. */
138962587Sitojun			off += elen;
139053541Sshin			nxt = ip6e->ip6e_nxt;
139178064Sume			ip6e = NULL;
139278064Sume#ifdef PULLDOWN_TEST
139378064Sume			m_freem(ext);
139478064Sume			ext = NULL;
139578064Sume#endif
139653541Sshin		}
139753541Sshin	  loopend:
139878064Sume		;
139953541Sshin	}
140078064Sume
140178064Sume}
140278064Sume
140378064Sume#ifdef PULLDOWN_TEST
140478064Sume/*
140578064Sume * pull single extension header from mbuf chain.  returns single mbuf that
140678064Sume * contains the result, or NULL on error.
140778064Sume */
140878064Sumestatic struct mbuf *
140978064Sumeip6_pullexthdr(m, off, nxt)
141078064Sume	struct mbuf *m;
141178064Sume	size_t off;
141278064Sume	int nxt;
141378064Sume{
141478064Sume	struct ip6_ext ip6e;
141578064Sume	size_t elen;
141678064Sume	struct mbuf *n;
141778064Sume
141878064Sume#ifdef DIAGNOSTIC
141978064Sume	switch (nxt) {
142078064Sume	case IPPROTO_DSTOPTS:
142178064Sume	case IPPROTO_ROUTING:
142278064Sume	case IPPROTO_HOPOPTS:
142378064Sume	case IPPROTO_AH: /* is it possible? */
142478064Sume		break;
142578064Sume	default:
142678064Sume		printf("ip6_pullexthdr: invalid nxt=%d\n", nxt);
142753541Sshin	}
142878064Sume#endif
142978064Sume
143078064Sume	m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
143178064Sume	if (nxt == IPPROTO_AH)
143278064Sume		elen = (ip6e.ip6e_len + 2) << 2;
143378064Sume	else
143478064Sume		elen = (ip6e.ip6e_len + 1) << 3;
143578064Sume
143678064Sume	MGET(n, M_DONTWAIT, MT_DATA);
143778064Sume	if (n && elen >= MLEN) {
143878064Sume		MCLGET(n, M_DONTWAIT);
143978064Sume		if ((n->m_flags & M_EXT) == 0) {
144078064Sume			m_free(n);
144178064Sume			n = NULL;
144278064Sume		}
144353541Sshin	}
144478064Sume	if (!n)
144578064Sume		return NULL;
144662587Sitojun
144778064Sume	n->m_len = 0;
144878064Sume	if (elen >= M_TRAILINGSPACE(n)) {
144978064Sume		m_free(n);
145078064Sume		return NULL;
145178064Sume	}
145278064Sume
145378064Sume	m_copydata(m, off, elen, mtod(n, caddr_t));
145478064Sume	n->m_len = elen;
145578064Sume	return n;
145653541Sshin}
145778064Sume#endif
145853541Sshin
145953541Sshin/*
146053541Sshin * Get pointer to the previous header followed by the header
146153541Sshin * currently processed.
146253541Sshin * XXX: This function supposes that
146353541Sshin *	M includes all headers,
146453541Sshin *	the next header field and the header length field of each header
146553541Sshin *	are valid, and
146653541Sshin *	the sum of each header length equals to OFF.
146753541Sshin * Because of these assumptions, this function must be called very
146853541Sshin * carefully. Moreover, it will not be used in the near future when
146953541Sshin * we develop `neater' mechanism to process extension headers.
147053541Sshin */
147153541Sshinchar *
147253541Sshinip6_get_prevhdr(m, off)
147353541Sshin	struct mbuf *m;
147453541Sshin	int off;
147553541Sshin{
147653541Sshin	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
147753541Sshin
147853541Sshin	if (off == sizeof(struct ip6_hdr))
147953541Sshin		return(&ip6->ip6_nxt);
148053541Sshin	else {
148153541Sshin		int len, nxt;
148253541Sshin		struct ip6_ext *ip6e = NULL;
148353541Sshin
148453541Sshin		nxt = ip6->ip6_nxt;
148553541Sshin		len = sizeof(struct ip6_hdr);
148653541Sshin		while (len < off) {
148753541Sshin			ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + len);
148853541Sshin
148978064Sume			switch (nxt) {
149053541Sshin			case IPPROTO_FRAGMENT:
149153541Sshin				len += sizeof(struct ip6_frag);
149253541Sshin				break;
149353541Sshin			case IPPROTO_AH:
149453541Sshin				len += (ip6e->ip6e_len + 2) << 2;
149553541Sshin				break;
149653541Sshin			default:
149753541Sshin				len += (ip6e->ip6e_len + 1) << 3;
149853541Sshin				break;
149953541Sshin			}
150053541Sshin			nxt = ip6e->ip6e_nxt;
150153541Sshin		}
150253541Sshin		if (ip6e)
150353541Sshin			return(&ip6e->ip6e_nxt);
150453541Sshin		else
150553541Sshin			return NULL;
150653541Sshin	}
150753541Sshin}
150853541Sshin
150953541Sshin/*
151062587Sitojun * get next header offset.  m will be retained.
151162587Sitojun */
151262587Sitojunint
151362587Sitojunip6_nexthdr(m, off, proto, nxtp)
151462587Sitojun	struct mbuf *m;
151562587Sitojun	int off;
151662587Sitojun	int proto;
151762587Sitojun	int *nxtp;
151862587Sitojun{
151962587Sitojun	struct ip6_hdr ip6;
152062587Sitojun	struct ip6_ext ip6e;
152162587Sitojun	struct ip6_frag fh;
152262587Sitojun
152362587Sitojun	/* just in case */
152462587Sitojun	if (m == NULL)
152562587Sitojun		panic("ip6_nexthdr: m == NULL");
152662587Sitojun	if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off)
152762587Sitojun		return -1;
152862587Sitojun
152962587Sitojun	switch (proto) {
153062587Sitojun	case IPPROTO_IPV6:
153162587Sitojun		if (m->m_pkthdr.len < off + sizeof(ip6))
153262587Sitojun			return -1;
153362587Sitojun		m_copydata(m, off, sizeof(ip6), (caddr_t)&ip6);
153462587Sitojun		if (nxtp)
153562587Sitojun			*nxtp = ip6.ip6_nxt;
153662587Sitojun		off += sizeof(ip6);
153762587Sitojun		return off;
153862587Sitojun
153962587Sitojun	case IPPROTO_FRAGMENT:
154062587Sitojun		/*
154162587Sitojun		 * terminate parsing if it is not the first fragment,
154262587Sitojun		 * it does not make sense to parse through it.
154362587Sitojun		 */
154462587Sitojun		if (m->m_pkthdr.len < off + sizeof(fh))
154562587Sitojun			return -1;
154662587Sitojun		m_copydata(m, off, sizeof(fh), (caddr_t)&fh);
154762587Sitojun		if ((ntohs(fh.ip6f_offlg) & IP6F_OFF_MASK) != 0)
154862587Sitojun			return -1;
154962587Sitojun		if (nxtp)
155062587Sitojun			*nxtp = fh.ip6f_nxt;
155162587Sitojun		off += sizeof(struct ip6_frag);
155262587Sitojun		return off;
155362587Sitojun
155462587Sitojun	case IPPROTO_AH:
155562587Sitojun		if (m->m_pkthdr.len < off + sizeof(ip6e))
155662587Sitojun			return -1;
155762587Sitojun		m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
155862587Sitojun		if (nxtp)
155962587Sitojun			*nxtp = ip6e.ip6e_nxt;
156062587Sitojun		off += (ip6e.ip6e_len + 2) << 2;
156162587Sitojun		return off;
156262587Sitojun
156362587Sitojun	case IPPROTO_HOPOPTS:
156462587Sitojun	case IPPROTO_ROUTING:
156562587Sitojun	case IPPROTO_DSTOPTS:
156662587Sitojun		if (m->m_pkthdr.len < off + sizeof(ip6e))
156762587Sitojun			return -1;
156862587Sitojun		m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
156962587Sitojun		if (nxtp)
157062587Sitojun			*nxtp = ip6e.ip6e_nxt;
157162587Sitojun		off += (ip6e.ip6e_len + 1) << 3;
157262587Sitojun		return off;
157362587Sitojun
157462587Sitojun	case IPPROTO_NONE:
157562587Sitojun	case IPPROTO_ESP:
157662587Sitojun	case IPPROTO_IPCOMP:
157762587Sitojun		/* give up */
157862587Sitojun		return -1;
157962587Sitojun
158062587Sitojun	default:
158162587Sitojun		return -1;
158262587Sitojun	}
158362587Sitojun
158462587Sitojun	return -1;
158562587Sitojun}
158662587Sitojun
158762587Sitojun/*
158862587Sitojun * get offset for the last header in the chain.  m will be kept untainted.
158962587Sitojun */
159062587Sitojunint
159162587Sitojunip6_lasthdr(m, off, proto, nxtp)
159262587Sitojun	struct mbuf *m;
159362587Sitojun	int off;
159462587Sitojun	int proto;
159562587Sitojun	int *nxtp;
159662587Sitojun{
159762587Sitojun	int newoff;
159862587Sitojun	int nxt;
159962587Sitojun
160062587Sitojun	if (!nxtp) {
160162587Sitojun		nxt = -1;
160262587Sitojun		nxtp = &nxt;
160362587Sitojun	}
160462587Sitojun	while (1) {
160562587Sitojun		newoff = ip6_nexthdr(m, off, proto, nxtp);
160662587Sitojun		if (newoff < 0)
160762587Sitojun			return off;
160862587Sitojun		else if (newoff < off)
160962587Sitojun			return -1;	/* invalid */
161062587Sitojun		else if (newoff == off)
161162587Sitojun			return newoff;
161262587Sitojun
161362587Sitojun		off = newoff;
161462587Sitojun		proto = *nxtp;
161562587Sitojun	}
161662587Sitojun}
161762587Sitojun
1618105194Ssamstruct ip6aux *
161978064Sumeip6_addaux(m)
162078064Sume	struct mbuf *m;
162178064Sume{
1622105194Ssam	struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL);
1623105194Ssam	if (!tag) {
1624105194Ssam		tag = m_tag_get(PACKET_TAG_IPV6_INPUT,
1625105194Ssam				sizeof (struct ip6aux),
1626108107Sbmilekic				M_DONTWAIT);
1627105194Ssam		if (tag)
1628105194Ssam			m_tag_prepend(m, tag);
162978064Sume	}
1630105194Ssam	if (tag)
1631105194Ssam		bzero(tag+1, sizeof (struct ip6aux));
1632105194Ssam	return tag ? (struct ip6aux*)(tag+1) : NULL;
163378064Sume}
163478064Sume
1635105194Ssamstruct ip6aux *
163678064Sumeip6_findaux(m)
163778064Sume	struct mbuf *m;
163878064Sume{
1639105194Ssam	struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL);
1640105194Ssam	return tag ? (struct ip6aux*)(tag+1) : NULL;
164178064Sume}
164278064Sume
164378064Sumevoid
164478064Sumeip6_delaux(m)
164578064Sume	struct mbuf *m;
164678064Sume{
1647105194Ssam	struct m_tag *tag = m_tag_find(m, PACKET_TAG_IPV6_INPUT, NULL);
1648105194Ssam	if (tag)
1649105194Ssam		m_tag_delete(m, tag);
165078064Sume}
165178064Sume
165262587Sitojun/*
165353541Sshin * System control for IP6
165453541Sshin */
165553541Sshin
165653541Sshinu_char	inet6ctlerrmap[PRC_NCMDS] = {
165753541Sshin	0,		0,		0,		0,
165853541Sshin	0,		EMSGSIZE,	EHOSTDOWN,	EHOSTUNREACH,
165953541Sshin	EHOSTUNREACH,	EHOSTUNREACH,	ECONNREFUSED,	ECONNREFUSED,
166053541Sshin	EMSGSIZE,	EHOSTUNREACH,	0,		0,
166153541Sshin	0,		0,		0,		0,
166253541Sshin	ENOPROTOOPT
166353541Sshin};
1664