1686cdd19SJun-ichiro itojun Hagino /* $FreeBSD$ */ 233841545SHajimu UMEMOTO /* $KAME: ip6_forward.c,v 1.69 2001/05/17 03:48:30 itojun Exp $ */ 3686cdd19SJun-ichiro itojun Hagino 4caf43b02SWarner Losh /*- 582cd038dSYoshinobu Inoue * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 682cd038dSYoshinobu Inoue * All rights reserved. 782cd038dSYoshinobu Inoue * 882cd038dSYoshinobu Inoue * Redistribution and use in source and binary forms, with or without 982cd038dSYoshinobu Inoue * modification, are permitted provided that the following conditions 1082cd038dSYoshinobu Inoue * are met: 1182cd038dSYoshinobu Inoue * 1. Redistributions of source code must retain the above copyright 1282cd038dSYoshinobu Inoue * notice, this list of conditions and the following disclaimer. 1382cd038dSYoshinobu Inoue * 2. Redistributions in binary form must reproduce the above copyright 1482cd038dSYoshinobu Inoue * notice, this list of conditions and the following disclaimer in the 1582cd038dSYoshinobu Inoue * documentation and/or other materials provided with the distribution. 1682cd038dSYoshinobu Inoue * 3. Neither the name of the project nor the names of its contributors 1782cd038dSYoshinobu Inoue * may be used to endorse or promote products derived from this software 1882cd038dSYoshinobu Inoue * without specific prior written permission. 1982cd038dSYoshinobu Inoue * 2082cd038dSYoshinobu Inoue * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 2182cd038dSYoshinobu Inoue * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2282cd038dSYoshinobu Inoue * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2382cd038dSYoshinobu Inoue * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 2482cd038dSYoshinobu Inoue * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2582cd038dSYoshinobu Inoue * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2682cd038dSYoshinobu Inoue * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2782cd038dSYoshinobu Inoue * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2882cd038dSYoshinobu Inoue * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 2982cd038dSYoshinobu Inoue * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3082cd038dSYoshinobu Inoue * SUCH DAMAGE. 3182cd038dSYoshinobu Inoue */ 3282cd038dSYoshinobu Inoue 33686cdd19SJun-ichiro itojun Hagino #include "opt_inet.h" 34686cdd19SJun-ichiro itojun Hagino #include "opt_inet6.h" 356a800098SYoshinobu Inoue #include "opt_ipsec.h" 36f8a8f9caSSUZUKI Shinsuke #include "opt_ipstealth.h" 3782cd038dSYoshinobu Inoue 3882cd038dSYoshinobu Inoue #include <sys/param.h> 3982cd038dSYoshinobu Inoue #include <sys/systm.h> 4033841545SHajimu UMEMOTO #include <sys/malloc.h> 4182cd038dSYoshinobu Inoue #include <sys/mbuf.h> 4282cd038dSYoshinobu Inoue #include <sys/domain.h> 4382cd038dSYoshinobu Inoue #include <sys/protosw.h> 4482cd038dSYoshinobu Inoue #include <sys/socket.h> 4582cd038dSYoshinobu Inoue #include <sys/errno.h> 4682cd038dSYoshinobu Inoue #include <sys/time.h> 4733841545SHajimu UMEMOTO #include <sys/kernel.h> 4882cd038dSYoshinobu Inoue #include <sys/syslog.h> 4982cd038dSYoshinobu Inoue 5082cd038dSYoshinobu Inoue #include <net/if.h> 5182cd038dSYoshinobu Inoue #include <net/route.h> 523a4d67f7SDarren Reed #include <net/pfil.h> 5382cd038dSYoshinobu Inoue 5482cd038dSYoshinobu Inoue #include <netinet/in.h> 5582cd038dSYoshinobu Inoue #include <netinet/in_var.h> 5633841545SHajimu UMEMOTO #include <netinet/in_systm.h> 5733841545SHajimu UMEMOTO #include <netinet/ip.h> 58686cdd19SJun-ichiro itojun Hagino #include <netinet/ip_var.h> 5933841545SHajimu UMEMOTO #include <netinet6/in6_var.h> 60686cdd19SJun-ichiro itojun Hagino #include <netinet/ip6.h> 6182cd038dSYoshinobu Inoue #include <netinet6/ip6_var.h> 62a1f7e5f8SHajimu UMEMOTO #include <netinet6/scope6_var.h> 63686cdd19SJun-ichiro itojun Hagino #include <netinet/icmp6.h> 6482cd038dSYoshinobu Inoue #include <netinet6/nd6.h> 6582cd038dSYoshinobu Inoue 6633841545SHajimu UMEMOTO #include <netinet/in_pcb.h> 6733841545SHajimu UMEMOTO 68059e4684SJun-ichiro itojun Hagino #ifdef IPSEC 6982cd038dSYoshinobu Inoue #include <netinet6/ipsec.h> 7033841545SHajimu UMEMOTO #ifdef INET6 7126121655SJun-ichiro itojun Hagino #include <netinet6/ipsec6.h> 7233841545SHajimu UMEMOTO #endif 7382cd038dSYoshinobu Inoue #include <netkey/key.h> 74059e4684SJun-ichiro itojun Hagino #endif /* IPSEC */ 7582cd038dSYoshinobu Inoue 76b9234fafSSam Leffler #ifdef FAST_IPSEC 77b9234fafSSam Leffler #include <netipsec/ipsec.h> 78b9234fafSSam Leffler #include <netipsec/ipsec6.h> 79b9234fafSSam Leffler #include <netipsec/key.h> 80b9234fafSSam Leffler #define IPSEC 81b9234fafSSam Leffler #endif /* FAST_IPSEC */ 82b9234fafSSam Leffler 833a4d67f7SDarren Reed #include <netinet6/ip6protosw.h> 843a4d67f7SDarren Reed 8582cd038dSYoshinobu Inoue struct route_in6 ip6_forward_rt; 8682cd038dSYoshinobu Inoue 8782cd038dSYoshinobu Inoue /* 8882cd038dSYoshinobu Inoue * Forward a packet. If some error occurs return the sender 8982cd038dSYoshinobu Inoue * an icmp packet. Note we can't always generate a meaningful 9082cd038dSYoshinobu Inoue * icmp message because icmp doesn't have a large enough repertoire 9182cd038dSYoshinobu Inoue * of codes and types. 9282cd038dSYoshinobu Inoue * 9382cd038dSYoshinobu Inoue * If not forwarding, just drop the packet. This could be confusing 9482cd038dSYoshinobu Inoue * if ipforwarding was zero but some routing protocol was advancing 9582cd038dSYoshinobu Inoue * us as a gateway to somewhere. However, we must let the routing 9682cd038dSYoshinobu Inoue * protocol deal with that. 9782cd038dSYoshinobu Inoue * 9882cd038dSYoshinobu Inoue */ 9982cd038dSYoshinobu Inoue 10082cd038dSYoshinobu Inoue void 10182cd038dSYoshinobu Inoue ip6_forward(m, srcrt) 10282cd038dSYoshinobu Inoue struct mbuf *m; 10382cd038dSYoshinobu Inoue int srcrt; 10482cd038dSYoshinobu Inoue { 10582cd038dSYoshinobu Inoue struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1060f9ade71SHajimu UMEMOTO struct sockaddr_in6 *dst = NULL; 1070f9ade71SHajimu UMEMOTO struct rtentry *rt = NULL; 10882cd038dSYoshinobu Inoue int error, type = 0, code = 0; 109686cdd19SJun-ichiro itojun Hagino struct mbuf *mcopy = NULL; 110686cdd19SJun-ichiro itojun Hagino struct ifnet *origifp; /* maybe unnecessary */ 111a1f7e5f8SHajimu UMEMOTO u_int32_t inzone, outzone; 112a1f7e5f8SHajimu UMEMOTO struct in6_addr src_in6, dst_in6; 113059e4684SJun-ichiro itojun Hagino #ifdef IPSEC 11482cd038dSYoshinobu Inoue struct secpolicy *sp = NULL; 1150f9ade71SHajimu UMEMOTO int ipsecrt = 0; 11682cd038dSYoshinobu Inoue #endif 1171d54aa3bSBjoern A. Zeeb char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN]; 11882cd038dSYoshinobu Inoue 1191b34a059SBjoern A. Zeeb GIANT_REQUIRED; /* XXX bz: ip6_forward_rt */ 1201b34a059SBjoern A. Zeeb 121059e4684SJun-ichiro itojun Hagino #ifdef IPSEC 12282cd038dSYoshinobu Inoue /* 12382cd038dSYoshinobu Inoue * Check AH/ESP integrity. 12482cd038dSYoshinobu Inoue */ 12582cd038dSYoshinobu Inoue /* 12682cd038dSYoshinobu Inoue * Don't increment ip6s_cantforward because this is the check 12782cd038dSYoshinobu Inoue * before forwarding packet actually. 12882cd038dSYoshinobu Inoue */ 12982cd038dSYoshinobu Inoue if (ipsec6_in_reject(m, NULL)) { 130b9234fafSSam Leffler #if !defined(FAST_IPSEC) 13182cd038dSYoshinobu Inoue ipsec6stat.in_polvio++; 132b9234fafSSam Leffler #endif 13382cd038dSYoshinobu Inoue m_freem(m); 13482cd038dSYoshinobu Inoue return; 13582cd038dSYoshinobu Inoue } 136059e4684SJun-ichiro itojun Hagino #endif /* IPSEC */ 13782cd038dSYoshinobu Inoue 13833841545SHajimu UMEMOTO /* 13933841545SHajimu UMEMOTO * Do not forward packets to multicast destination (should be handled 14033841545SHajimu UMEMOTO * by ip6_mforward(). 14133841545SHajimu UMEMOTO * Do not forward packets with unspecified source. It was discussed 1427efe5d92SHajimu UMEMOTO * in July 2000, on the ipngwg mailing list. 14333841545SHajimu UMEMOTO */ 144686cdd19SJun-ichiro itojun Hagino if ((m->m_flags & (M_BCAST|M_MCAST)) != 0 || 14533841545SHajimu UMEMOTO IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 14633841545SHajimu UMEMOTO IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { 14782cd038dSYoshinobu Inoue ip6stat.ip6s_cantforward++; 14882cd038dSYoshinobu Inoue /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */ 14982cd038dSYoshinobu Inoue if (ip6_log_time + ip6_log_interval < time_second) { 15082cd038dSYoshinobu Inoue ip6_log_time = time_second; 15182cd038dSYoshinobu Inoue log(LOG_DEBUG, 15282cd038dSYoshinobu Inoue "cannot forward " 15382cd038dSYoshinobu Inoue "from %s to %s nxt %d received on %s\n", 1541d54aa3bSBjoern A. Zeeb ip6_sprintf(ip6bufs, &ip6->ip6_src), 1551d54aa3bSBjoern A. Zeeb ip6_sprintf(ip6bufd, &ip6->ip6_dst), 15682cd038dSYoshinobu Inoue ip6->ip6_nxt, 15782cd038dSYoshinobu Inoue if_name(m->m_pkthdr.rcvif)); 15882cd038dSYoshinobu Inoue } 15982cd038dSYoshinobu Inoue m_freem(m); 16082cd038dSYoshinobu Inoue return; 16182cd038dSYoshinobu Inoue } 16282cd038dSYoshinobu Inoue 163f8a8f9caSSUZUKI Shinsuke #ifdef IPSTEALTH 164f8a8f9caSSUZUKI Shinsuke if (!ip6stealth) { 165f8a8f9caSSUZUKI Shinsuke #endif 16682cd038dSYoshinobu Inoue if (ip6->ip6_hlim <= IPV6_HLIMDEC) { 16782cd038dSYoshinobu Inoue /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */ 16882cd038dSYoshinobu Inoue icmp6_error(m, ICMP6_TIME_EXCEEDED, 16982cd038dSYoshinobu Inoue ICMP6_TIME_EXCEED_TRANSIT, 0); 17082cd038dSYoshinobu Inoue return; 17182cd038dSYoshinobu Inoue } 17282cd038dSYoshinobu Inoue ip6->ip6_hlim -= IPV6_HLIMDEC; 17382cd038dSYoshinobu Inoue 174f8a8f9caSSUZUKI Shinsuke #ifdef IPSTEALTH 175f8a8f9caSSUZUKI Shinsuke } 176f8a8f9caSSUZUKI Shinsuke #endif 177f8a8f9caSSUZUKI Shinsuke 178686cdd19SJun-ichiro itojun Hagino /* 179686cdd19SJun-ichiro itojun Hagino * Save at most ICMPV6_PLD_MAXLEN (= the min IPv6 MTU - 180686cdd19SJun-ichiro itojun Hagino * size of IPv6 + ICMPv6 headers) bytes of the packet in case 181686cdd19SJun-ichiro itojun Hagino * we need to generate an ICMP6 message to the src. 182686cdd19SJun-ichiro itojun Hagino * Thanks to M_EXT, in most cases copy will not occur. 183686cdd19SJun-ichiro itojun Hagino * 184686cdd19SJun-ichiro itojun Hagino * It is important to save it before IPsec processing as IPsec 185686cdd19SJun-ichiro itojun Hagino * processing may modify the mbuf. 186686cdd19SJun-ichiro itojun Hagino */ 187686cdd19SJun-ichiro itojun Hagino mcopy = m_copy(m, 0, imin(m->m_pkthdr.len, ICMPV6_PLD_MAXLEN)); 188686cdd19SJun-ichiro itojun Hagino 189059e4684SJun-ichiro itojun Hagino #ifdef IPSEC 19082cd038dSYoshinobu Inoue /* get a security policy for this packet */ 1917efe5d92SHajimu UMEMOTO sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, 1927efe5d92SHajimu UMEMOTO IP_FORWARDING, &error); 19382cd038dSYoshinobu Inoue if (sp == NULL) { 19482cd038dSYoshinobu Inoue ipsec6stat.out_inval++; 19582cd038dSYoshinobu Inoue ip6stat.ip6s_cantforward++; 196686cdd19SJun-ichiro itojun Hagino if (mcopy) { 197686cdd19SJun-ichiro itojun Hagino #if 0 198686cdd19SJun-ichiro itojun Hagino /* XXX: what icmp ? */ 199686cdd19SJun-ichiro itojun Hagino #else 200686cdd19SJun-ichiro itojun Hagino m_freem(mcopy); 201686cdd19SJun-ichiro itojun Hagino #endif 202686cdd19SJun-ichiro itojun Hagino } 20382cd038dSYoshinobu Inoue m_freem(m); 20482cd038dSYoshinobu Inoue return; 20582cd038dSYoshinobu Inoue } 20682cd038dSYoshinobu Inoue 20782cd038dSYoshinobu Inoue error = 0; 20882cd038dSYoshinobu Inoue 20982cd038dSYoshinobu Inoue /* check policy */ 21082cd038dSYoshinobu Inoue switch (sp->policy) { 21182cd038dSYoshinobu Inoue case IPSEC_POLICY_DISCARD: 21282cd038dSYoshinobu Inoue /* 21382cd038dSYoshinobu Inoue * This packet is just discarded. 21482cd038dSYoshinobu Inoue */ 21582cd038dSYoshinobu Inoue ipsec6stat.out_polvio++; 21682cd038dSYoshinobu Inoue ip6stat.ip6s_cantforward++; 21782cd038dSYoshinobu Inoue key_freesp(sp); 218686cdd19SJun-ichiro itojun Hagino if (mcopy) { 219686cdd19SJun-ichiro itojun Hagino #if 0 220686cdd19SJun-ichiro itojun Hagino /* XXX: what icmp ? */ 221686cdd19SJun-ichiro itojun Hagino #else 222686cdd19SJun-ichiro itojun Hagino m_freem(mcopy); 223686cdd19SJun-ichiro itojun Hagino #endif 224686cdd19SJun-ichiro itojun Hagino } 22582cd038dSYoshinobu Inoue m_freem(m); 22682cd038dSYoshinobu Inoue return; 22782cd038dSYoshinobu Inoue 22882cd038dSYoshinobu Inoue case IPSEC_POLICY_BYPASS: 22982cd038dSYoshinobu Inoue case IPSEC_POLICY_NONE: 23082cd038dSYoshinobu Inoue /* no need to do IPsec. */ 23182cd038dSYoshinobu Inoue key_freesp(sp); 23282cd038dSYoshinobu Inoue goto skip_ipsec; 23382cd038dSYoshinobu Inoue 23482cd038dSYoshinobu Inoue case IPSEC_POLICY_IPSEC: 23582cd038dSYoshinobu Inoue if (sp->req == NULL) { 23682cd038dSYoshinobu Inoue /* XXX should be panic ? */ 23782cd038dSYoshinobu Inoue printf("ip6_forward: No IPsec request specified.\n"); 23882cd038dSYoshinobu Inoue ip6stat.ip6s_cantforward++; 23982cd038dSYoshinobu Inoue key_freesp(sp); 240686cdd19SJun-ichiro itojun Hagino if (mcopy) { 241686cdd19SJun-ichiro itojun Hagino #if 0 242686cdd19SJun-ichiro itojun Hagino /* XXX: what icmp ? */ 243686cdd19SJun-ichiro itojun Hagino #else 244686cdd19SJun-ichiro itojun Hagino m_freem(mcopy); 245686cdd19SJun-ichiro itojun Hagino #endif 246686cdd19SJun-ichiro itojun Hagino } 24782cd038dSYoshinobu Inoue m_freem(m); 24882cd038dSYoshinobu Inoue return; 24982cd038dSYoshinobu Inoue } 25082cd038dSYoshinobu Inoue /* do IPsec */ 25182cd038dSYoshinobu Inoue break; 25282cd038dSYoshinobu Inoue 25382cd038dSYoshinobu Inoue case IPSEC_POLICY_ENTRUST: 25482cd038dSYoshinobu Inoue default: 25582cd038dSYoshinobu Inoue /* should be panic ?? */ 25682cd038dSYoshinobu Inoue printf("ip6_forward: Invalid policy found. %d\n", sp->policy); 25782cd038dSYoshinobu Inoue key_freesp(sp); 25882cd038dSYoshinobu Inoue goto skip_ipsec; 25982cd038dSYoshinobu Inoue } 26082cd038dSYoshinobu Inoue 26182cd038dSYoshinobu Inoue { 2620f9ade71SHajimu UMEMOTO struct ipsecrequest *isr = NULL; 26382cd038dSYoshinobu Inoue struct ipsec_output_state state; 26482cd038dSYoshinobu Inoue 26582cd038dSYoshinobu Inoue /* 2660f9ade71SHajimu UMEMOTO * when the kernel forwards a packet, it is not proper to apply 2670f9ade71SHajimu UMEMOTO * IPsec transport mode to the packet is not proper. this check 2680f9ade71SHajimu UMEMOTO * avoid from this. 2690f9ade71SHajimu UMEMOTO * at present, if there is even a transport mode SA request in the 2700f9ade71SHajimu UMEMOTO * security policy, the kernel does not apply IPsec to the packet. 2710f9ade71SHajimu UMEMOTO * this check is not enough because the following case is valid. 2720f9ade71SHajimu UMEMOTO * ipsec esp/tunnel/xxx-xxx/require esp/transport//require; 2730f9ade71SHajimu UMEMOTO */ 2740f9ade71SHajimu UMEMOTO for (isr = sp->req; isr; isr = isr->next) { 275931282ceSHajimu UMEMOTO if (isr->saidx.mode == IPSEC_MODE_ANY) 276931282ceSHajimu UMEMOTO goto doipsectunnel; 277931282ceSHajimu UMEMOTO if (isr->saidx.mode == IPSEC_MODE_TUNNEL) 278931282ceSHajimu UMEMOTO goto doipsectunnel; 2790f9ade71SHajimu UMEMOTO } 2800f9ade71SHajimu UMEMOTO 2810f9ade71SHajimu UMEMOTO /* 282931282ceSHajimu UMEMOTO * if there's no need for tunnel mode IPsec, skip. 283931282ceSHajimu UMEMOTO */ 284931282ceSHajimu UMEMOTO if (!isr) 285931282ceSHajimu UMEMOTO goto skip_ipsec; 286931282ceSHajimu UMEMOTO 287931282ceSHajimu UMEMOTO doipsectunnel: 288931282ceSHajimu UMEMOTO /* 28982cd038dSYoshinobu Inoue * All the extension headers will become inaccessible 29082cd038dSYoshinobu Inoue * (since they can be encrypted). 29182cd038dSYoshinobu Inoue * Don't panic, we need no more updates to extension headers 29282cd038dSYoshinobu Inoue * on inner IPv6 packet (since they are now encapsulated). 29382cd038dSYoshinobu Inoue * 29482cd038dSYoshinobu Inoue * IPv6 [ESP|AH] IPv6 [extension headers] payload 29582cd038dSYoshinobu Inoue */ 29682cd038dSYoshinobu Inoue bzero(&state, sizeof(state)); 29782cd038dSYoshinobu Inoue state.m = m; 29882cd038dSYoshinobu Inoue state.ro = NULL; /* update at ipsec6_output_tunnel() */ 29982cd038dSYoshinobu Inoue state.dst = NULL; /* update at ipsec6_output_tunnel() */ 30082cd038dSYoshinobu Inoue 30182cd038dSYoshinobu Inoue error = ipsec6_output_tunnel(&state, sp, 0); 30282cd038dSYoshinobu Inoue 30382cd038dSYoshinobu Inoue m = state.m; 30482cd038dSYoshinobu Inoue key_freesp(sp); 30582cd038dSYoshinobu Inoue 30682cd038dSYoshinobu Inoue if (error) { 30782cd038dSYoshinobu Inoue /* mbuf is already reclaimed in ipsec6_output_tunnel. */ 30882cd038dSYoshinobu Inoue switch (error) { 30982cd038dSYoshinobu Inoue case EHOSTUNREACH: 31082cd038dSYoshinobu Inoue case ENETUNREACH: 31182cd038dSYoshinobu Inoue case EMSGSIZE: 31282cd038dSYoshinobu Inoue case ENOBUFS: 31382cd038dSYoshinobu Inoue case ENOMEM: 31482cd038dSYoshinobu Inoue break; 31582cd038dSYoshinobu Inoue default: 31682cd038dSYoshinobu Inoue printf("ip6_output (ipsec): error code %d\n", error); 3177efe5d92SHajimu UMEMOTO /* FALLTHROUGH */ 31882cd038dSYoshinobu Inoue case ENOENT: 31982cd038dSYoshinobu Inoue /* don't show these error codes to the user */ 32082cd038dSYoshinobu Inoue break; 32182cd038dSYoshinobu Inoue } 32282cd038dSYoshinobu Inoue ip6stat.ip6s_cantforward++; 323686cdd19SJun-ichiro itojun Hagino if (mcopy) { 324686cdd19SJun-ichiro itojun Hagino #if 0 325686cdd19SJun-ichiro itojun Hagino /* XXX: what icmp ? */ 326686cdd19SJun-ichiro itojun Hagino #else 327686cdd19SJun-ichiro itojun Hagino m_freem(mcopy); 328686cdd19SJun-ichiro itojun Hagino #endif 329686cdd19SJun-ichiro itojun Hagino } 33082cd038dSYoshinobu Inoue m_freem(m); 33182cd038dSYoshinobu Inoue return; 33282cd038dSYoshinobu Inoue } 3330f9ade71SHajimu UMEMOTO 334931282ceSHajimu UMEMOTO if (ip6 != mtod(m, struct ip6_hdr *)) { 335931282ceSHajimu UMEMOTO /* 336931282ceSHajimu UMEMOTO * now tunnel mode headers are added. we are originating 337931282ceSHajimu UMEMOTO * packet instead of forwarding the packet. 338931282ceSHajimu UMEMOTO */ 339931282ceSHajimu UMEMOTO ip6_output(m, NULL, NULL, IPV6_FORWARDING/*XXX*/, NULL, NULL, 340931282ceSHajimu UMEMOTO NULL); 341931282ceSHajimu UMEMOTO goto freecopy; 342931282ceSHajimu UMEMOTO } 343931282ceSHajimu UMEMOTO 3440f9ade71SHajimu UMEMOTO /* adjust pointer */ 3450f9ade71SHajimu UMEMOTO dst = (struct sockaddr_in6 *)state.dst; 3460f9ade71SHajimu UMEMOTO rt = state.ro ? state.ro->ro_rt : NULL; 3470f9ade71SHajimu UMEMOTO if (dst != NULL && rt != NULL) 3480f9ade71SHajimu UMEMOTO ipsecrt = 1; 34982cd038dSYoshinobu Inoue } 35082cd038dSYoshinobu Inoue skip_ipsec: 351059e4684SJun-ichiro itojun Hagino #endif /* IPSEC */ 35282cd038dSYoshinobu Inoue 3530f9ade71SHajimu UMEMOTO #ifdef IPSEC 3540f9ade71SHajimu UMEMOTO if (ipsecrt) 3550f9ade71SHajimu UMEMOTO goto skip_routing; 3560f9ade71SHajimu UMEMOTO #endif 3570f9ade71SHajimu UMEMOTO 35833841545SHajimu UMEMOTO dst = (struct sockaddr_in6 *)&ip6_forward_rt.ro_dst; 35982cd038dSYoshinobu Inoue if (!srcrt) { 3607efe5d92SHajimu UMEMOTO /* ip6_forward_rt.ro_dst.sin6_addr is equal to ip6->ip6_dst */ 36182cd038dSYoshinobu Inoue if (ip6_forward_rt.ro_rt == 0 || 36282cd038dSYoshinobu Inoue (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) == 0) { 36382cd038dSYoshinobu Inoue if (ip6_forward_rt.ro_rt) { 36482cd038dSYoshinobu Inoue RTFREE(ip6_forward_rt.ro_rt); 36582cd038dSYoshinobu Inoue ip6_forward_rt.ro_rt = 0; 36682cd038dSYoshinobu Inoue } 3677efe5d92SHajimu UMEMOTO 36882cd038dSYoshinobu Inoue /* this probably fails but give it a try again */ 36926d02ca7SAndre Oppermann rtalloc((struct route *)&ip6_forward_rt); 37082cd038dSYoshinobu Inoue } 37182cd038dSYoshinobu Inoue 37282cd038dSYoshinobu Inoue if (ip6_forward_rt.ro_rt == 0) { 37382cd038dSYoshinobu Inoue ip6stat.ip6s_noroute++; 37433841545SHajimu UMEMOTO in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_noroute); 375686cdd19SJun-ichiro itojun Hagino if (mcopy) { 376686cdd19SJun-ichiro itojun Hagino icmp6_error(mcopy, ICMP6_DST_UNREACH, 37782cd038dSYoshinobu Inoue ICMP6_DST_UNREACH_NOROUTE, 0); 378686cdd19SJun-ichiro itojun Hagino } 379686cdd19SJun-ichiro itojun Hagino m_freem(m); 38082cd038dSYoshinobu Inoue return; 38182cd038dSYoshinobu Inoue } 38282cd038dSYoshinobu Inoue } else if ((rt = ip6_forward_rt.ro_rt) == 0 || 38382cd038dSYoshinobu Inoue !IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst->sin6_addr)) { 38482cd038dSYoshinobu Inoue if (ip6_forward_rt.ro_rt) { 38582cd038dSYoshinobu Inoue RTFREE(ip6_forward_rt.ro_rt); 38682cd038dSYoshinobu Inoue ip6_forward_rt.ro_rt = 0; 38782cd038dSYoshinobu Inoue } 38882cd038dSYoshinobu Inoue bzero(dst, sizeof(*dst)); 38982cd038dSYoshinobu Inoue dst->sin6_len = sizeof(struct sockaddr_in6); 39082cd038dSYoshinobu Inoue dst->sin6_family = AF_INET6; 39182cd038dSYoshinobu Inoue dst->sin6_addr = ip6->ip6_dst; 39282cd038dSYoshinobu Inoue 39326d02ca7SAndre Oppermann rtalloc((struct route *)&ip6_forward_rt); 39482cd038dSYoshinobu Inoue if (ip6_forward_rt.ro_rt == 0) { 39582cd038dSYoshinobu Inoue ip6stat.ip6s_noroute++; 39633841545SHajimu UMEMOTO in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_noroute); 397686cdd19SJun-ichiro itojun Hagino if (mcopy) { 398686cdd19SJun-ichiro itojun Hagino icmp6_error(mcopy, ICMP6_DST_UNREACH, 39982cd038dSYoshinobu Inoue ICMP6_DST_UNREACH_NOROUTE, 0); 400686cdd19SJun-ichiro itojun Hagino } 401686cdd19SJun-ichiro itojun Hagino m_freem(m); 40282cd038dSYoshinobu Inoue return; 40382cd038dSYoshinobu Inoue } 40482cd038dSYoshinobu Inoue } 40582cd038dSYoshinobu Inoue rt = ip6_forward_rt.ro_rt; 4060f9ade71SHajimu UMEMOTO #ifdef IPSEC 4070f9ade71SHajimu UMEMOTO skip_routing:; 4080f9ade71SHajimu UMEMOTO #endif 409686cdd19SJun-ichiro itojun Hagino 410686cdd19SJun-ichiro itojun Hagino /* 411a1f7e5f8SHajimu UMEMOTO * Source scope check: if a packet can't be delivered to its 412a1f7e5f8SHajimu UMEMOTO * destination for the reason that the destination is beyond the scope 413a1f7e5f8SHajimu UMEMOTO * of the source address, discard the packet and return an icmp6 414a1f7e5f8SHajimu UMEMOTO * destination unreachable error with Code 2 (beyond scope of source 415a1f7e5f8SHajimu UMEMOTO * address). We use a local copy of ip6_src, since in6_setscope() 416a1f7e5f8SHajimu UMEMOTO * will possibly modify its first argument. 417a1f7e5f8SHajimu UMEMOTO * [draft-ietf-ipngwg-icmp-v3-04.txt, Section 3.1] 418686cdd19SJun-ichiro itojun Hagino */ 419a1f7e5f8SHajimu UMEMOTO src_in6 = ip6->ip6_src; 420a1f7e5f8SHajimu UMEMOTO if (in6_setscope(&src_in6, rt->rt_ifp, &outzone)) { 4210f9ade71SHajimu UMEMOTO /* XXX: this should not happen */ 4220f9ade71SHajimu UMEMOTO ip6stat.ip6s_cantforward++; 4230f9ade71SHajimu UMEMOTO ip6stat.ip6s_badscope++; 4240f9ade71SHajimu UMEMOTO m_freem(m); 4250f9ade71SHajimu UMEMOTO return; 4260f9ade71SHajimu UMEMOTO } 427a1f7e5f8SHajimu UMEMOTO if (in6_setscope(&src_in6, m->m_pkthdr.rcvif, &inzone)) { 428a1f7e5f8SHajimu UMEMOTO ip6stat.ip6s_cantforward++; 429a1f7e5f8SHajimu UMEMOTO ip6stat.ip6s_badscope++; 430a1f7e5f8SHajimu UMEMOTO m_freem(m); 431a1f7e5f8SHajimu UMEMOTO return; 432a1f7e5f8SHajimu UMEMOTO } 433a1f7e5f8SHajimu UMEMOTO if (inzone != outzone 4340f9ade71SHajimu UMEMOTO #ifdef IPSEC 4350f9ade71SHajimu UMEMOTO && !ipsecrt 4360f9ade71SHajimu UMEMOTO #endif 4370f9ade71SHajimu UMEMOTO ) { 438686cdd19SJun-ichiro itojun Hagino ip6stat.ip6s_cantforward++; 439686cdd19SJun-ichiro itojun Hagino ip6stat.ip6s_badscope++; 440686cdd19SJun-ichiro itojun Hagino in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard); 441686cdd19SJun-ichiro itojun Hagino 442686cdd19SJun-ichiro itojun Hagino if (ip6_log_time + ip6_log_interval < time_second) { 443686cdd19SJun-ichiro itojun Hagino ip6_log_time = time_second; 444686cdd19SJun-ichiro itojun Hagino log(LOG_DEBUG, 445686cdd19SJun-ichiro itojun Hagino "cannot forward " 446686cdd19SJun-ichiro itojun Hagino "src %s, dst %s, nxt %d, rcvif %s, outif %s\n", 4471d54aa3bSBjoern A. Zeeb ip6_sprintf(ip6bufs, &ip6->ip6_src), 4481d54aa3bSBjoern A. Zeeb ip6_sprintf(ip6bufd, &ip6->ip6_dst), 449686cdd19SJun-ichiro itojun Hagino ip6->ip6_nxt, 450686cdd19SJun-ichiro itojun Hagino if_name(m->m_pkthdr.rcvif), if_name(rt->rt_ifp)); 451686cdd19SJun-ichiro itojun Hagino } 452686cdd19SJun-ichiro itojun Hagino if (mcopy) 453686cdd19SJun-ichiro itojun Hagino icmp6_error(mcopy, ICMP6_DST_UNREACH, 454686cdd19SJun-ichiro itojun Hagino ICMP6_DST_UNREACH_BEYONDSCOPE, 0); 455686cdd19SJun-ichiro itojun Hagino m_freem(m); 456686cdd19SJun-ichiro itojun Hagino return; 457686cdd19SJun-ichiro itojun Hagino } 458686cdd19SJun-ichiro itojun Hagino 459a1f7e5f8SHajimu UMEMOTO /* 460a1f7e5f8SHajimu UMEMOTO * Destination scope check: if a packet is going to break the scope 461a1f7e5f8SHajimu UMEMOTO * zone of packet's destination address, discard it. This case should 462a1f7e5f8SHajimu UMEMOTO * usually be prevented by appropriately-configured routing table, but 463a1f7e5f8SHajimu UMEMOTO * we need an explicit check because we may mistakenly forward the 464a1f7e5f8SHajimu UMEMOTO * packet to a different zone by (e.g.) a default route. 465a1f7e5f8SHajimu UMEMOTO */ 466a1f7e5f8SHajimu UMEMOTO dst_in6 = ip6->ip6_dst; 467a1f7e5f8SHajimu UMEMOTO if (in6_setscope(&dst_in6, m->m_pkthdr.rcvif, &inzone) != 0 || 468a1f7e5f8SHajimu UMEMOTO in6_setscope(&dst_in6, rt->rt_ifp, &outzone) != 0 || 469a1f7e5f8SHajimu UMEMOTO inzone != outzone) { 470a1f7e5f8SHajimu UMEMOTO ip6stat.ip6s_cantforward++; 471a1f7e5f8SHajimu UMEMOTO ip6stat.ip6s_badscope++; 472a1f7e5f8SHajimu UMEMOTO m_freem(m); 473a1f7e5f8SHajimu UMEMOTO return; 474a1f7e5f8SHajimu UMEMOTO } 475a1f7e5f8SHajimu UMEMOTO 47631b3783cSHajimu UMEMOTO if (m->m_pkthdr.len > IN6_LINKMTU(rt->rt_ifp)) { 47782cd038dSYoshinobu Inoue in6_ifstat_inc(rt->rt_ifp, ifs6_in_toobig); 478686cdd19SJun-ichiro itojun Hagino if (mcopy) { 479686cdd19SJun-ichiro itojun Hagino u_long mtu; 480059e4684SJun-ichiro itojun Hagino #ifdef IPSEC 481686cdd19SJun-ichiro itojun Hagino struct secpolicy *sp; 482686cdd19SJun-ichiro itojun Hagino int ipsecerror; 483686cdd19SJun-ichiro itojun Hagino size_t ipsechdrsiz; 484686cdd19SJun-ichiro itojun Hagino #endif 485686cdd19SJun-ichiro itojun Hagino 48631b3783cSHajimu UMEMOTO mtu = IN6_LINKMTU(rt->rt_ifp); 487059e4684SJun-ichiro itojun Hagino #ifdef IPSEC 488686cdd19SJun-ichiro itojun Hagino /* 489686cdd19SJun-ichiro itojun Hagino * When we do IPsec tunnel ingress, we need to play 4900f9ade71SHajimu UMEMOTO * with the link value (decrement IPsec header size 491686cdd19SJun-ichiro itojun Hagino * from mtu value). The code is much simpler than v4 492686cdd19SJun-ichiro itojun Hagino * case, as we have the outgoing interface for 493686cdd19SJun-ichiro itojun Hagino * encapsulated packet as "rt->rt_ifp". 494686cdd19SJun-ichiro itojun Hagino */ 495686cdd19SJun-ichiro itojun Hagino sp = ipsec6_getpolicybyaddr(mcopy, IPSEC_DIR_OUTBOUND, 496686cdd19SJun-ichiro itojun Hagino IP_FORWARDING, &ipsecerror); 497686cdd19SJun-ichiro itojun Hagino if (sp) { 498686cdd19SJun-ichiro itojun Hagino ipsechdrsiz = ipsec6_hdrsiz(mcopy, 499686cdd19SJun-ichiro itojun Hagino IPSEC_DIR_OUTBOUND, NULL); 500686cdd19SJun-ichiro itojun Hagino if (ipsechdrsiz < mtu) 501686cdd19SJun-ichiro itojun Hagino mtu -= ipsechdrsiz; 502686cdd19SJun-ichiro itojun Hagino } 503686cdd19SJun-ichiro itojun Hagino 504686cdd19SJun-ichiro itojun Hagino /* 505686cdd19SJun-ichiro itojun Hagino * if mtu becomes less than minimum MTU, 506686cdd19SJun-ichiro itojun Hagino * tell minimum MTU (and I'll need to fragment it). 507686cdd19SJun-ichiro itojun Hagino */ 508686cdd19SJun-ichiro itojun Hagino if (mtu < IPV6_MMTU) 509686cdd19SJun-ichiro itojun Hagino mtu = IPV6_MMTU; 510686cdd19SJun-ichiro itojun Hagino #endif 511686cdd19SJun-ichiro itojun Hagino icmp6_error(mcopy, ICMP6_PACKET_TOO_BIG, 0, mtu); 512686cdd19SJun-ichiro itojun Hagino } 513686cdd19SJun-ichiro itojun Hagino m_freem(m); 51482cd038dSYoshinobu Inoue return; 51582cd038dSYoshinobu Inoue } 51682cd038dSYoshinobu Inoue 51782cd038dSYoshinobu Inoue if (rt->rt_flags & RTF_GATEWAY) 51882cd038dSYoshinobu Inoue dst = (struct sockaddr_in6 *)rt->rt_gateway; 51982cd038dSYoshinobu Inoue 52082cd038dSYoshinobu Inoue /* 52182cd038dSYoshinobu Inoue * If we are to forward the packet using the same interface 52282cd038dSYoshinobu Inoue * as one we got the packet from, perhaps we should send a redirect 52382cd038dSYoshinobu Inoue * to sender to shortcut a hop. 52482cd038dSYoshinobu Inoue * Only send redirect if source is sending directly to us, 52582cd038dSYoshinobu Inoue * and if packet was not source routed (or has any options). 52682cd038dSYoshinobu Inoue * Also, don't send redirect if forwarding using a route 52782cd038dSYoshinobu Inoue * modified by a redirect. 52882cd038dSYoshinobu Inoue */ 52980a684e0SJohn Hay if (ip6_sendredirects && rt->rt_ifp == m->m_pkthdr.rcvif && !srcrt && 5300f9ade71SHajimu UMEMOTO #ifdef IPSEC 5310f9ade71SHajimu UMEMOTO !ipsecrt && 5320f9ade71SHajimu UMEMOTO #endif 53333841545SHajimu UMEMOTO (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0) { 53433841545SHajimu UMEMOTO if ((rt->rt_ifp->if_flags & IFF_POINTOPOINT) != 0) { 53533841545SHajimu UMEMOTO /* 53633841545SHajimu UMEMOTO * If the incoming interface is equal to the outgoing 53733841545SHajimu UMEMOTO * one, and the link attached to the interface is 53833841545SHajimu UMEMOTO * point-to-point, then it will be highly probable 53933841545SHajimu UMEMOTO * that a routing loop occurs. Thus, we immediately 54033841545SHajimu UMEMOTO * drop the packet and send an ICMPv6 error message. 54133841545SHajimu UMEMOTO * 54233841545SHajimu UMEMOTO * type/code is based on suggestion by Rich Draves. 54333841545SHajimu UMEMOTO * not sure if it is the best pick. 54433841545SHajimu UMEMOTO */ 54533841545SHajimu UMEMOTO icmp6_error(mcopy, ICMP6_DST_UNREACH, 54633841545SHajimu UMEMOTO ICMP6_DST_UNREACH_ADDR, 0); 54733841545SHajimu UMEMOTO m_freem(m); 54833841545SHajimu UMEMOTO return; 54933841545SHajimu UMEMOTO } 55082cd038dSYoshinobu Inoue type = ND_REDIRECT; 55133841545SHajimu UMEMOTO } 55282cd038dSYoshinobu Inoue 55382cd038dSYoshinobu Inoue /* 554686cdd19SJun-ichiro itojun Hagino * Fake scoped addresses. Note that even link-local source or 555686cdd19SJun-ichiro itojun Hagino * destinaion can appear, if the originating node just sends the 556686cdd19SJun-ichiro itojun Hagino * packet to us (without address resolution for the destination). 557686cdd19SJun-ichiro itojun Hagino * Since both icmp6_error and icmp6_redirect_output fill the embedded 55833841545SHajimu UMEMOTO * link identifiers, we can do this stuff after making a copy for 55933841545SHajimu UMEMOTO * returning an error. 560686cdd19SJun-ichiro itojun Hagino */ 561686cdd19SJun-ichiro itojun Hagino if ((rt->rt_ifp->if_flags & IFF_LOOPBACK) != 0) { 562686cdd19SJun-ichiro itojun Hagino /* 563686cdd19SJun-ichiro itojun Hagino * See corresponding comments in ip6_output. 564686cdd19SJun-ichiro itojun Hagino * XXX: but is it possible that ip6_forward() sends a packet 565686cdd19SJun-ichiro itojun Hagino * to a loopback interface? I don't think so, and thus 566686cdd19SJun-ichiro itojun Hagino * I bark here. (jinmei@kame.net) 567686cdd19SJun-ichiro itojun Hagino * XXX: it is common to route invalid packets to loopback. 568686cdd19SJun-ichiro itojun Hagino * also, the codepath will be visited on use of ::1 in 569686cdd19SJun-ichiro itojun Hagino * rthdr. (itojun) 570686cdd19SJun-ichiro itojun Hagino */ 571686cdd19SJun-ichiro itojun Hagino #if 1 572686cdd19SJun-ichiro itojun Hagino if (0) 573686cdd19SJun-ichiro itojun Hagino #else 574686cdd19SJun-ichiro itojun Hagino if ((rt->rt_flags & (RTF_BLACKHOLE|RTF_REJECT)) == 0) 575686cdd19SJun-ichiro itojun Hagino #endif 576686cdd19SJun-ichiro itojun Hagino { 577686cdd19SJun-ichiro itojun Hagino printf("ip6_forward: outgoing interface is loopback. " 578686cdd19SJun-ichiro itojun Hagino "src %s, dst %s, nxt %d, rcvif %s, outif %s\n", 5791d54aa3bSBjoern A. Zeeb ip6_sprintf(ip6bufs, &ip6->ip6_src), 5801d54aa3bSBjoern A. Zeeb ip6_sprintf(ip6bufd, &ip6->ip6_dst), 581686cdd19SJun-ichiro itojun Hagino ip6->ip6_nxt, if_name(m->m_pkthdr.rcvif), 582686cdd19SJun-ichiro itojun Hagino if_name(rt->rt_ifp)); 583686cdd19SJun-ichiro itojun Hagino } 584686cdd19SJun-ichiro itojun Hagino 58533841545SHajimu UMEMOTO /* we can just use rcvif in forwarding. */ 58633841545SHajimu UMEMOTO origifp = m->m_pkthdr.rcvif; 587686cdd19SJun-ichiro itojun Hagino } 588686cdd19SJun-ichiro itojun Hagino else 589686cdd19SJun-ichiro itojun Hagino origifp = rt->rt_ifp; 59033841545SHajimu UMEMOTO /* 59133841545SHajimu UMEMOTO * clear embedded scope identifiers if necessary. 59233841545SHajimu UMEMOTO * in6_clearscope will touch the addresses only when necessary. 59333841545SHajimu UMEMOTO */ 59433841545SHajimu UMEMOTO in6_clearscope(&ip6->ip6_src); 59533841545SHajimu UMEMOTO in6_clearscope(&ip6->ip6_dst); 596686cdd19SJun-ichiro itojun Hagino 597c21fd232SAndre Oppermann /* Jump over all PFIL processing if hooks are not active. */ 598604afec4SChristian S.J. Peron if (!PFIL_HOOKED(&inet6_pfil_hook)) 599c21fd232SAndre Oppermann goto pass; 600c21fd232SAndre Oppermann 601c21fd232SAndre Oppermann /* Run through list of hooks for output packets. */ 602d6a8d588SMax Laier error = pfil_run_hooks(&inet6_pfil_hook, &m, rt->rt_ifp, PFIL_OUT, NULL); 603b140bc1fSSam Leffler if (error != 0) 604b140bc1fSSam Leffler goto senderr; 6053a4d67f7SDarren Reed if (m == NULL) 6063a4d67f7SDarren Reed goto freecopy; 6073a4d67f7SDarren Reed ip6 = mtod(m, struct ip6_hdr *); 6083a4d67f7SDarren Reed 609c21fd232SAndre Oppermann pass: 610686cdd19SJun-ichiro itojun Hagino error = nd6_output(rt->rt_ifp, origifp, m, dst, rt); 61182cd038dSYoshinobu Inoue if (error) { 61282cd038dSYoshinobu Inoue in6_ifstat_inc(rt->rt_ifp, ifs6_out_discard); 61382cd038dSYoshinobu Inoue ip6stat.ip6s_cantforward++; 61482cd038dSYoshinobu Inoue } else { 61582cd038dSYoshinobu Inoue ip6stat.ip6s_forward++; 61682cd038dSYoshinobu Inoue in6_ifstat_inc(rt->rt_ifp, ifs6_out_forward); 61782cd038dSYoshinobu Inoue if (type) 61882cd038dSYoshinobu Inoue ip6stat.ip6s_redirectsent++; 61982cd038dSYoshinobu Inoue else { 62082cd038dSYoshinobu Inoue if (mcopy) 62182cd038dSYoshinobu Inoue goto freecopy; 62282cd038dSYoshinobu Inoue } 62382cd038dSYoshinobu Inoue } 6247efe5d92SHajimu UMEMOTO 625b140bc1fSSam Leffler senderr: 62682cd038dSYoshinobu Inoue if (mcopy == NULL) 62782cd038dSYoshinobu Inoue return; 62882cd038dSYoshinobu Inoue switch (error) { 62982cd038dSYoshinobu Inoue case 0: 63082cd038dSYoshinobu Inoue if (type == ND_REDIRECT) { 63182cd038dSYoshinobu Inoue icmp6_redirect_output(mcopy, rt); 63282cd038dSYoshinobu Inoue return; 63382cd038dSYoshinobu Inoue } 63482cd038dSYoshinobu Inoue goto freecopy; 63582cd038dSYoshinobu Inoue 63682cd038dSYoshinobu Inoue case EMSGSIZE: 63782cd038dSYoshinobu Inoue /* xxx MTU is constant in PPP? */ 63882cd038dSYoshinobu Inoue goto freecopy; 63982cd038dSYoshinobu Inoue 64082cd038dSYoshinobu Inoue case ENOBUFS: 64182cd038dSYoshinobu Inoue /* Tell source to slow down like source quench in IP? */ 64282cd038dSYoshinobu Inoue goto freecopy; 64382cd038dSYoshinobu Inoue 64482cd038dSYoshinobu Inoue case ENETUNREACH: /* shouldn't happen, checked above */ 64582cd038dSYoshinobu Inoue case EHOSTUNREACH: 64682cd038dSYoshinobu Inoue case ENETDOWN: 64782cd038dSYoshinobu Inoue case EHOSTDOWN: 64882cd038dSYoshinobu Inoue default: 64982cd038dSYoshinobu Inoue type = ICMP6_DST_UNREACH; 65082cd038dSYoshinobu Inoue code = ICMP6_DST_UNREACH_ADDR; 65182cd038dSYoshinobu Inoue break; 65282cd038dSYoshinobu Inoue } 65382cd038dSYoshinobu Inoue icmp6_error(mcopy, type, code, 0); 65482cd038dSYoshinobu Inoue return; 65582cd038dSYoshinobu Inoue 65682cd038dSYoshinobu Inoue freecopy: 65782cd038dSYoshinobu Inoue m_freem(mcopy); 65882cd038dSYoshinobu Inoue return; 65982cd038dSYoshinobu Inoue } 660