xref: /freebsd/sys/netinet6/ip6_input.c (revision 77a0943ded95b9e6438f7db70c4a28e4d93946d4)
1 /*	$FreeBSD$	*/
2 /*	$KAME: ip6_input.c,v 1.95 2000/07/02 07:49:37 jinmei Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. All advertising materials mentioning features or use of this software
46  *    must display the following acknowledgement:
47  *	This product includes software developed by the University of
48  *	California, Berkeley and its contributors.
49  * 4. Neither the name of the University nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63  * SUCH DAMAGE.
64  *
65  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
66  */
67 
68 #include "opt_ip6fw.h"
69 #include "opt_inet.h"
70 #include "opt_inet6.h"
71 #include "opt_ipsec.h"
72 #include "opt_pfil_hooks.h"
73 
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/mbuf.h>
77 #include <sys/domain.h>
78 #include <sys/protosw.h>
79 #include <sys/socket.h>
80 #include <sys/socketvar.h>
81 #include <sys/errno.h>
82 #include <sys/time.h>
83 #include <sys/kernel.h>
84 #include <sys/syslog.h>
85 
86 #include <net/if.h>
87 #include <net/if_types.h>
88 #include <net/if_dl.h>
89 #include <net/route.h>
90 #include <net/netisr.h>
91 #include <net/intrq.h>
92 #ifdef PFIL_HOOKS
93 #include <net/pfil.h>
94 #endif
95 
96 #include <netinet/in.h>
97 #include <netinet/in_systm.h>
98 #ifdef INET
99 #include <netinet/ip.h>
100 #include <netinet/ip_icmp.h>
101 #endif /*INET*/
102 #include <netinet/ip6.h>
103 #include <netinet6/in6_var.h>
104 #include <netinet6/ip6_var.h>
105 #include <netinet/in_pcb.h>
106 #include <netinet/icmp6.h>
107 #include <netinet6/in6_ifattach.h>
108 #include <netinet6/nd6.h>
109 #include <netinet6/in6_prefix.h>
110 
111 #include <netinet6/ip6_fw.h>
112 
113 #include <netinet6/ip6protosw.h>
114 
115 /* we need it for NLOOP. */
116 #include "loop.h"
117 #include "faith.h"
118 #include "gif.h"
119 
120 #include <net/net_osdep.h>
121 
122 extern struct domain inet6domain;
123 extern struct ip6protosw inet6sw[];
124 
125 u_char ip6_protox[IPPROTO_MAX];
126 static int ip6qmaxlen = IFQ_MAXLEN;
127 struct in6_ifaddr *in6_ifaddr;
128 
129 int ip6_forward_srcrt;			/* XXX */
130 int ip6_sourcecheck;			/* XXX */
131 int ip6_sourcecheck_interval;		/* XXX */
132 const int int6intrq_present = 1;
133 
134 /* firewall hooks */
135 ip6_fw_chk_t *ip6_fw_chk_ptr;
136 ip6_fw_ctl_t *ip6_fw_ctl_ptr;
137 int ip6_fw_enable = 1;
138 
139 struct ip6stat ip6stat;
140 
141 static void ip6_init2 __P((void *));
142 
143 static int ip6_hopopts_input __P((u_int32_t *, u_int32_t *, struct mbuf **, int *));
144 #ifdef PULLDOWN_TEST
145 static struct mbuf *ip6_pullexthdr __P((struct mbuf *, size_t, int));
146 #endif
147 
148 /*
149  * IP6 initialization: fill in IP6 protocol switch table.
150  * All protocols not implemented in kernel go to raw IP6 protocol handler.
151  */
152 void
153 ip6_init()
154 {
155 	register struct ip6protosw *pr;
156 	register int i;
157 	struct timeval tv;
158 
159 	pr = (struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW);
160 	if (pr == 0)
161 		panic("ip6_init");
162 	for (i = 0; i < IPPROTO_MAX; i++)
163 		ip6_protox[i] = pr - inet6sw;
164 	for (pr = (struct ip6protosw *)inet6domain.dom_protosw;
165 	    pr < (struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++)
166 		if (pr->pr_domain->dom_family == PF_INET6 &&
167 		    pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
168 			ip6_protox[pr->pr_protocol] = pr - inet6sw;
169 	ip6intrq.ifq_maxlen = ip6qmaxlen;
170 	mtx_init(&ip6intrq.ifq_mtx, "ip6_inq", MTX_DEF);
171 	register_netisr(NETISR_IPV6, ip6intr);
172 	nd6_init();
173 	frag6_init();
174 	/*
175 	 * in many cases, random() here does NOT return random number
176 	 * as initialization during bootstrap time occur in fixed order.
177 	 */
178 	microtime(&tv);
179 	ip6_flow_seq = random() ^ tv.tv_usec;
180 }
181 
182 static void
183 ip6_init2(dummy)
184 	void *dummy;
185 {
186 
187 	/*
188 	 * to route local address of p2p link to loopback,
189 	 * assign loopback address first.
190 	 */
191 	in6_ifattach(&loif[0], NULL);
192 
193 	/* nd6_timer_init */
194 	timeout(nd6_timer, (caddr_t)0, hz);
195 	/* router renumbering prefix list maintenance */
196 	timeout(in6_rr_timer, (caddr_t)0, hz);
197 }
198 
199 /* cheat */
200 /* This must be after route_init(), which is now SI_ORDER_THIRD */
201 SYSINIT(netinet6init2, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ip6_init2, NULL);
202 
203 /*
204  * IP6 input interrupt handling. Just pass the packet to ip6_input.
205  */
206 void
207 ip6intr()
208 {
209 	int s;
210 	struct mbuf *m;
211 
212 	for (;;) {
213 		s = splimp();
214 		IF_DEQUEUE(&ip6intrq, m);
215 		splx(s);
216 		if (m == 0)
217 			return;
218 		ip6_input(m);
219 	}
220 }
221 
222 extern struct	route_in6 ip6_forward_rt;
223 
224 void
225 ip6_input(m)
226 	struct mbuf *m;
227 {
228 	struct ip6_hdr *ip6;
229 	int off = sizeof(struct ip6_hdr), nest;
230 	u_int32_t plen;
231 	u_int32_t rtalert = ~0;
232 	int nxt, ours = 0;
233 	struct ifnet *deliverifp = NULL;
234 #ifdef  PFIL_HOOKS
235 	struct packet_filter_hook *pfh;
236 	struct mbuf *m0;
237 	int rv;
238 #endif  /* PFIL_HOOKS */
239 
240 #ifdef IPSEC
241 	/*
242 	 * should the inner packet be considered authentic?
243 	 * see comment in ah4_input().
244 	 */
245 	if (m) {
246 		m->m_flags &= ~M_AUTHIPHDR;
247 		m->m_flags &= ~M_AUTHIPDGM;
248 	}
249 #endif
250 
251 	/*
252 	 * mbuf statistics by kazu
253 	 */
254 	if (m->m_flags & M_EXT) {
255 		if (m->m_next)
256 			ip6stat.ip6s_mext2m++;
257 		else
258 			ip6stat.ip6s_mext1++;
259 	} else {
260 		if (m->m_next) {
261 			if (m->m_flags & M_LOOP) {
262 				ip6stat.ip6s_m2m[loif[0].if_index]++;	/*XXX*/
263 			} else if (m->m_pkthdr.rcvif->if_index <= 31)
264 				ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++;
265 			else
266 				ip6stat.ip6s_m2m[0]++;
267 		} else
268 			ip6stat.ip6s_m1++;
269 	}
270 
271 	in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive);
272 	ip6stat.ip6s_total++;
273 
274 #ifndef PULLDOWN_TEST
275 	/* XXX is the line really necessary? */
276 	IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), /*nothing*/);
277 #endif
278 
279 	if (m->m_len < sizeof(struct ip6_hdr)) {
280 		struct ifnet *inifp;
281 		inifp = m->m_pkthdr.rcvif;
282 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == 0) {
283 			ip6stat.ip6s_toosmall++;
284 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
285 			return;
286 		}
287 	}
288 
289 	ip6 = mtod(m, struct ip6_hdr *);
290 
291 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
292 		ip6stat.ip6s_badvers++;
293 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
294 		goto bad;
295 	}
296 
297 #ifdef PFIL_HOOKS
298 	/*
299 	 * Run through list of hooks for input packets.  If there are any
300 	 * filters which require that additional packets in the flow are
301 	 * not fast-forwarded, they must clear the M_CANFASTFWD flag.
302 	 * Note that filters must _never_ set this flag, as another filter
303 	 * in the list may have previously cleared it.
304 	 */
305 	m0 = m;
306 	pfh = pfil_hook_get(PFIL_IN, &inet6sw[ip6_protox[IPPROTO_IPV6]].pr_pfh);
307 	for (; pfh; pfh = pfh->pfil_link.tqe_next)
308 		if (pfh->pfil_func) {
309 			rv = pfh->pfil_func(ip6, sizeof(*ip6),
310 					    m->m_pkthdr.rcvif, 0, &m0);
311 			if (rv)
312 				return;
313 			m = m0;
314 			if (m == NULL)
315 				return;
316 			ip6 = mtod(m, struct ip6_hdr *);
317 		}
318 #endif /* PFIL_HOOKS */
319 
320 	ip6stat.ip6s_nxthist[ip6->ip6_nxt]++;
321 
322 	/*
323 	 * Check with the firewall...
324 	 */
325 	if (ip6_fw_enable && ip6_fw_chk_ptr) {
326 		u_short port = 0;
327 		/* If ipfw says divert, we have to just drop packet */
328 		/* use port as a dummy argument */
329 		if ((*ip6_fw_chk_ptr)(&ip6, NULL, &port, &m)) {
330 			m_freem(m);
331 			m = NULL;
332 		}
333 		if (!m)
334 			return;
335 	}
336 
337 	/*
338 	 * Scope check
339 	 */
340 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) ||
341 	    IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) {
342 		ip6stat.ip6s_badscope++;
343 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
344 		goto bad;
345 	}
346 
347 	/*
348 	 * Don't check IPv4 mapped address here.  SIIT assumes that
349 	 * routers would forward IPv6 native packets with IPv4 mapped
350 	 * address normally.
351 	 */
352 #if 0
353 	/*
354 	 * Reject packets with IPv4 compatible addresses (auto tunnel).
355 	 *
356 	 * The code forbids auto tunnel relay case in RFC1933 (the check is
357 	 * stronger than RFC1933).  We may want to re-enable it if mech-xx
358 	 * is revised to forbid relaying case.
359 	 */
360 	if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) ||
361 	    IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) {
362 		ip6stat.ip6s_badscope++;
363 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
364 		goto bad;
365 	}
366 #endif
367 	if (IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) ||
368 	    IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) {
369 		if (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) {
370 			ours = 1;
371 			deliverifp = m->m_pkthdr.rcvif;
372 			goto hbhcheck;
373 		} else {
374 			ip6stat.ip6s_badscope++;
375 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
376 			goto bad;
377 		}
378 	}
379 
380 #ifndef FAKE_LOOPBACK_IF
381 	if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0)
382 #else
383 	if (1)
384 #endif
385 	{
386 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
387 			ip6->ip6_src.s6_addr16[1]
388 				= htons(m->m_pkthdr.rcvif->if_index);
389 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
390 			ip6->ip6_dst.s6_addr16[1]
391 				= htons(m->m_pkthdr.rcvif->if_index);
392 	}
393 
394 	/*
395 	 * XXX we need this since we do not have "goto ours" hack route
396 	 * for some of our ifaddrs on loopback interface.
397 	 * we should correct it by changing in6_ifattach to install
398 	 * "goto ours" hack route.
399 	 */
400 	if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) != 0) {
401 		if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) {
402 			ours = 1;
403 			deliverifp = m->m_pkthdr.rcvif;
404 			goto hbhcheck;
405 		}
406 	}
407 
408 	/*
409 	 * Multicast check
410 	 */
411 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
412 	  	struct	in6_multi *in6m = 0;
413 
414 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast);
415 		/*
416 		 * See if we belong to the destination multicast group on the
417 		 * arrival interface.
418 		 */
419 		IN6_LOOKUP_MULTI(ip6->ip6_dst, m->m_pkthdr.rcvif, in6m);
420 		if (in6m)
421 			ours = 1;
422 		else if (!ip6_mrouter) {
423 			ip6stat.ip6s_notmember++;
424 			ip6stat.ip6s_cantforward++;
425 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
426 			goto bad;
427 		}
428 		deliverifp = m->m_pkthdr.rcvif;
429 		goto hbhcheck;
430 	}
431 
432 	/*
433 	 *  Unicast check
434 	 */
435 	if (ip6_forward_rt.ro_rt != NULL &&
436 	    (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) != 0 &&
437 	    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
438 			       &ip6_forward_rt.ro_dst.sin6_addr))
439 		ip6stat.ip6s_forward_cachehit++;
440 	else {
441 		if (ip6_forward_rt.ro_rt) {
442 			/* route is down or destination is different */
443 			ip6stat.ip6s_forward_cachemiss++;
444 			RTFREE(ip6_forward_rt.ro_rt);
445 			ip6_forward_rt.ro_rt = 0;
446 		}
447 
448 		bzero(&ip6_forward_rt.ro_dst, sizeof(struct sockaddr_in6));
449 		ip6_forward_rt.ro_dst.sin6_len = sizeof(struct sockaddr_in6);
450 		ip6_forward_rt.ro_dst.sin6_family = AF_INET6;
451 		ip6_forward_rt.ro_dst.sin6_addr = ip6->ip6_dst;
452 #ifdef SCOPEDROUTING
453 		ip6_forward_rt.ro_dst.sin6_scope_id =
454 			in6_addr2scopeid(m->m_pkthdr.rcvif, &ip6->ip6_dst);
455 #endif
456 
457 		rtalloc_ign((struct route *)&ip6_forward_rt, RTF_PRCLONING);
458 	}
459 
460 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key))
461 
462 	/*
463 	 * Accept the packet if the forwarding interface to the destination
464 	 * according to the routing table is the loopback interface,
465 	 * unless the associated route has a gateway.
466 	 * Note that this approach causes to accept a packet if there is a
467 	 * route to the loopback interface for the destination of the packet.
468 	 * But we think it's even useful in some situations, e.g. when using
469 	 * a special daemon which wants to intercept the packet.
470 	 */
471 	if (ip6_forward_rt.ro_rt &&
472 	    (ip6_forward_rt.ro_rt->rt_flags &
473 	     (RTF_HOST|RTF_GATEWAY)) == RTF_HOST &&
474 #if 0
475 	    /*
476 	     * The check below is redundant since the comparison of
477 	     * the destination and the key of the rtentry has
478 	     * already done through looking up the routing table.
479 	     */
480 	    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
481 			       &rt6_key(ip6_forward_rt.ro_rt)->sin6_addr) &&
482 #endif
483 	    ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_LOOP) {
484 		struct in6_ifaddr *ia6 =
485 			(struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa;
486 		if (ia6->ia6_flags & IN6_IFF_ANYCAST)
487 			m->m_flags |= M_ANYCAST6;
488 		/*
489 		 * packets to a tentative, duplicated, or somehow invalid
490 		 * address must not be accepted.
491 		 */
492 		if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) {
493 			/* this address is ready */
494 			ours = 1;
495 			deliverifp = ia6->ia_ifp;	/* correct? */
496 
497 			/* Count the packet in the ip address stats */
498 			ia6->ia_ifa.if_ipackets++;
499 			ia6->ia_ifa.if_ibytes += m->m_pkthdr.len;
500 
501 			goto hbhcheck;
502 		} else {
503 			/* address is not ready, so discard the packet. */
504 			log(LOG_INFO,
505 			    "ip6_input: packet to an unready address %s->%s",
506 			    ip6_sprintf(&ip6->ip6_src),
507 			    ip6_sprintf(&ip6->ip6_dst));
508 
509 			goto bad;
510 		}
511 	}
512 
513 	/*
514 	 * FAITH(Firewall Aided Internet Translator)
515 	 */
516 #if defined(NFAITH) && 0 < NFAITH
517 	if (ip6_keepfaith) {
518 		if (ip6_forward_rt.ro_rt && ip6_forward_rt.ro_rt->rt_ifp
519 		 && ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) {
520 			/* XXX do we need more sanity checks? */
521 			ours = 1;
522 			deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /*faith*/
523 			goto hbhcheck;
524 		}
525 	}
526 #endif
527 
528 	/*
529 	 * Now there is no reason to process the packet if it's not our own
530 	 * and we're not a router.
531 	 */
532 	if (!ip6_forwarding) {
533 		ip6stat.ip6s_cantforward++;
534 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
535 		goto bad;
536 	}
537 
538   hbhcheck:
539 	/*
540 	 * Process Hop-by-Hop options header if it's contained.
541 	 * m may be modified in ip6_hopopts_input().
542 	 * If a JumboPayload option is included, plen will also be modified.
543 	 */
544 	plen = (u_int32_t)ntohs(ip6->ip6_plen);
545 	if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
546 		struct ip6_hbh *hbh;
547 
548 		if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) {
549 #if 0	/*touches NULL pointer*/
550 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
551 #endif
552 			return;	/* m have already been freed */
553 		}
554 
555 		/* adjust pointer */
556 		ip6 = mtod(m, struct ip6_hdr *);
557 
558 		/*
559 		 * if the payload length field is 0 and the next header field
560 		 * indicates Hop-by-Hop Options header, then a Jumbo Payload
561 		 * option MUST be included.
562 		 */
563 		if (ip6->ip6_plen == 0 && plen == 0) {
564 			/*
565 			 * Note that if a valid jumbo payload option is
566 			 * contained, ip6_hoptops_input() must set a valid
567 			 * (non-zero) payload length to the variable plen.
568 			 */
569 			ip6stat.ip6s_badoptions++;
570 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
571 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
572 			icmp6_error(m, ICMP6_PARAM_PROB,
573 				    ICMP6_PARAMPROB_HEADER,
574 				    (caddr_t)&ip6->ip6_plen - (caddr_t)ip6);
575 			return;
576 		}
577 #ifndef PULLDOWN_TEST
578 		/* ip6_hopopts_input() ensures that mbuf is contiguous */
579 		hbh = (struct ip6_hbh *)(ip6 + 1);
580 #else
581 		IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
582 			sizeof(struct ip6_hbh));
583 		if (hbh == NULL) {
584 			ip6stat.ip6s_tooshort++;
585 			return;
586 		}
587 #endif
588 		nxt = hbh->ip6h_nxt;
589 
590 		/*
591 		 * accept the packet if a router alert option is included
592 		 * and we act as an IPv6 router.
593 		 */
594 		if (rtalert != ~0 && ip6_forwarding)
595 			ours = 1;
596 	} else
597 		nxt = ip6->ip6_nxt;
598 
599 	/*
600 	 * Check that the amount of data in the buffers
601 	 * is as at least much as the IPv6 header would have us expect.
602 	 * Trim mbufs if longer than we expect.
603 	 * Drop packet if shorter than we expect.
604 	 */
605 	if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
606 		ip6stat.ip6s_tooshort++;
607 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
608 		goto bad;
609 	}
610 	if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
611 		if (m->m_len == m->m_pkthdr.len) {
612 			m->m_len = sizeof(struct ip6_hdr) + plen;
613 			m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
614 		} else
615 			m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len);
616 	}
617 
618 	/*
619 	 * Forward if desirable.
620 	 */
621 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
622 		/*
623 		 * If we are acting as a multicast router, all
624 		 * incoming multicast packets are passed to the
625 		 * kernel-level multicast forwarding function.
626 		 * The packet is returned (relatively) intact; if
627 		 * ip6_mforward() returns a non-zero value, the packet
628 		 * must be discarded, else it may be accepted below.
629 		 */
630 		if (ip6_mrouter && ip6_mforward(ip6, m->m_pkthdr.rcvif, m)) {
631 			ip6stat.ip6s_cantforward++;
632 			m_freem(m);
633 			return;
634 		}
635 		if (!ours) {
636 			m_freem(m);
637 			return;
638 		}
639 	} else if (!ours) {
640 		ip6_forward(m, 0);
641 		return;
642 	}
643 
644 	ip6 = mtod(m, struct ip6_hdr *);
645 
646 	/*
647 	 * Malicious party may be able to use IPv4 mapped addr to confuse
648 	 * tcp/udp stack and bypass security checks (act as if it was from
649 	 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1).  Be cautious.
650 	 *
651 	 * For SIIT end node behavior, you may want to disable the check.
652 	 * However, you will  become vulnerable to attacks using IPv4 mapped
653 	 * source.
654 	 */
655 	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
656 	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
657 		ip6stat.ip6s_badscope++;
658 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
659 		goto bad;
660 	}
661 
662 	/*
663 	 * Tell launch routine the next header
664 	 */
665 	ip6stat.ip6s_delivered++;
666 	in6_ifstat_inc(deliverifp, ifs6_in_deliver);
667 	nest = 0;
668 	while (nxt != IPPROTO_DONE) {
669 		if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
670 			ip6stat.ip6s_toomanyhdr++;
671 			goto bad;
672 		}
673 
674 		/*
675 		 * protection against faulty packet - there should be
676 		 * more sanity checks in header chain processing.
677 		 */
678 		if (m->m_pkthdr.len < off) {
679 			ip6stat.ip6s_tooshort++;
680 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
681 			goto bad;
682 		}
683 
684 		nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt);
685 	}
686 	return;
687  bad:
688 	m_freem(m);
689 }
690 
691 /*
692  * Hop-by-Hop options header processing. If a valid jumbo payload option is
693  * included, the real payload length will be stored in plenp.
694  */
695 static int
696 ip6_hopopts_input(plenp, rtalertp, mp, offp)
697 	u_int32_t *plenp;
698 	u_int32_t *rtalertp;	/* XXX: should be stored more smart way */
699 	struct mbuf **mp;
700 	int *offp;
701 {
702 	register struct mbuf *m = *mp;
703 	int off = *offp, hbhlen;
704 	struct ip6_hbh *hbh;
705 	u_int8_t *opt;
706 
707 	/* validation of the length of the header */
708 #ifndef PULLDOWN_TEST
709 	IP6_EXTHDR_CHECK(m, off, sizeof(*hbh), -1);
710 	hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off);
711 	hbhlen = (hbh->ip6h_len + 1) << 3;
712 
713 	IP6_EXTHDR_CHECK(m, off, hbhlen, -1);
714 	hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off);
715 #else
716 	IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m,
717 		sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
718 	if (hbh == NULL) {
719 		ip6stat.ip6s_tooshort++;
720 		return -1;
721 	}
722 	hbhlen = (hbh->ip6h_len + 1) << 3;
723 	IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
724 		hbhlen);
725 	if (hbh == NULL) {
726 		ip6stat.ip6s_tooshort++;
727 		return -1;
728 	}
729 #endif
730 	off += hbhlen;
731 	hbhlen -= sizeof(struct ip6_hbh);
732 	opt = (u_int8_t *)hbh + sizeof(struct ip6_hbh);
733 
734 	if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
735 				hbhlen, rtalertp, plenp) < 0)
736 		return(-1);
737 
738 	*offp = off;
739 	*mp = m;
740 	return(0);
741 }
742 
743 /*
744  * Search header for all Hop-by-hop options and process each option.
745  * This function is separate from ip6_hopopts_input() in order to
746  * handle a case where the sending node itself process its hop-by-hop
747  * options header. In such a case, the function is called from ip6_output().
748  */
749 int
750 ip6_process_hopopts(m, opthead, hbhlen, rtalertp, plenp)
751 	struct mbuf *m;
752 	u_int8_t *opthead;
753 	int hbhlen;
754 	u_int32_t *rtalertp;
755 	u_int32_t *plenp;
756 {
757 	struct ip6_hdr *ip6;
758 	int optlen = 0;
759 	u_int8_t *opt = opthead;
760 	u_int16_t rtalert_val;
761 	u_int32_t jumboplen;
762 
763 	for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) {
764 		switch(*opt) {
765 		 case IP6OPT_PAD1:
766 			 optlen = 1;
767 			 break;
768 		 case IP6OPT_PADN:
769 			 if (hbhlen < IP6OPT_MINLEN) {
770 				 ip6stat.ip6s_toosmall++;
771 				 goto bad;
772 			 }
773 			 optlen = *(opt + 1) + 2;
774 			 break;
775 		 case IP6OPT_RTALERT:
776 			 /* XXX may need check for alignment */
777 			 if (hbhlen < IP6OPT_RTALERT_LEN) {
778 				 ip6stat.ip6s_toosmall++;
779 				 goto bad;
780 			 }
781 			 if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2)
782 				  /* XXX: should we discard the packet? */
783 				 log(LOG_ERR, "length of router alert opt is inconsitent(%d)",
784 				     *(opt + 1));
785 			 optlen = IP6OPT_RTALERT_LEN;
786 			 bcopy((caddr_t)(opt + 2), (caddr_t)&rtalert_val, 2);
787 			 *rtalertp = ntohs(rtalert_val);
788 			 break;
789 		 case IP6OPT_JUMBO:
790 			/* XXX may need check for alignment */
791 			if (hbhlen < IP6OPT_JUMBO_LEN) {
792 				ip6stat.ip6s_toosmall++;
793 				goto bad;
794 			}
795 			if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2)
796 				 /* XXX: should we discard the packet? */
797 				log(LOG_ERR, "length of jumbopayload opt "
798 				    "is inconsistent(%d)",
799 				    *(opt + 1));
800 			optlen = IP6OPT_JUMBO_LEN;
801 
802 			/*
803 			 * IPv6 packets that have non 0 payload length
804 			 * must not contain a jumbo paylod option.
805 			 */
806 			ip6 = mtod(m, struct ip6_hdr *);
807 			if (ip6->ip6_plen) {
808 				ip6stat.ip6s_badoptions++;
809 				icmp6_error(m, ICMP6_PARAM_PROB,
810 					    ICMP6_PARAMPROB_HEADER,
811 					    sizeof(struct ip6_hdr) +
812 					    sizeof(struct ip6_hbh) +
813 					    opt - opthead);
814 				return(-1);
815 			}
816 
817 			/*
818 			 * We may see jumbolen in unaligned location, so
819 			 * we'd need to perform bcopy().
820 			 */
821 			bcopy(opt + 2, &jumboplen, sizeof(jumboplen));
822 			jumboplen = (u_int32_t)htonl(jumboplen);
823 
824 #if 1
825 			/*
826 			 * if there are multiple jumbo payload options,
827 			 * *plenp will be non-zero and the packet will be
828 			 * rejected.
829 			 * the behavior may need some debate in ipngwg -
830 			 * multiple options does not make sense, however,
831 			 * there's no explicit mention in specification.
832 			 */
833 			if (*plenp != 0) {
834 				ip6stat.ip6s_badoptions++;
835 				icmp6_error(m, ICMP6_PARAM_PROB,
836 					    ICMP6_PARAMPROB_HEADER,
837 					    sizeof(struct ip6_hdr) +
838 					    sizeof(struct ip6_hbh) +
839 					    opt + 2 - opthead);
840 				return(-1);
841 			}
842 #endif
843 
844 			/*
845 			 * jumbo payload length must be larger than 65535.
846 			 */
847 			if (jumboplen <= IPV6_MAXPACKET) {
848 				ip6stat.ip6s_badoptions++;
849 				icmp6_error(m, ICMP6_PARAM_PROB,
850 					    ICMP6_PARAMPROB_HEADER,
851 					    sizeof(struct ip6_hdr) +
852 					    sizeof(struct ip6_hbh) +
853 					    opt + 2 - opthead);
854 				return(-1);
855 			}
856 			*plenp = jumboplen;
857 
858 			break;
859 		 default:		/* unknown option */
860 			 if (hbhlen < IP6OPT_MINLEN) {
861 				 ip6stat.ip6s_toosmall++;
862 				 goto bad;
863 			 }
864 			 if ((optlen = ip6_unknown_opt(opt, m,
865 						       sizeof(struct ip6_hdr) +
866 						       sizeof(struct ip6_hbh) +
867 						       opt - opthead)) == -1)
868 				 return(-1);
869 			 optlen += 2;
870 			 break;
871 		}
872 	}
873 
874 	return(0);
875 
876   bad:
877 	m_freem(m);
878 	return(-1);
879 }
880 
881 /*
882  * Unknown option processing.
883  * The third argument `off' is the offset from the IPv6 header to the option,
884  * which is necessary if the IPv6 header the and option header and IPv6 header
885  * is not continuous in order to return an ICMPv6 error.
886  */
887 int
888 ip6_unknown_opt(optp, m, off)
889 	u_int8_t *optp;
890 	struct mbuf *m;
891 	int off;
892 {
893 	struct ip6_hdr *ip6;
894 
895 	switch(IP6OPT_TYPE(*optp)) {
896 	 case IP6OPT_TYPE_SKIP: /* ignore the option */
897 		 return((int)*(optp + 1));
898 	 case IP6OPT_TYPE_DISCARD:	/* silently discard */
899 		 m_freem(m);
900 		 return(-1);
901 	 case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */
902 		 ip6stat.ip6s_badoptions++;
903 		 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off);
904 		 return(-1);
905 	 case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */
906 		 ip6stat.ip6s_badoptions++;
907 		 ip6 = mtod(m, struct ip6_hdr *);
908 		 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
909 		     (m->m_flags & (M_BCAST|M_MCAST)))
910 			 m_freem(m);
911 		 else
912 			 icmp6_error(m, ICMP6_PARAM_PROB,
913 				     ICMP6_PARAMPROB_OPTION, off);
914 		 return(-1);
915 	}
916 
917 	m_freem(m);		/* XXX: NOTREACHED */
918 	return(-1);
919 }
920 
921 /*
922  * Create the "control" list for this pcb.
923  *
924  * The routine will be called from upper layer handlers like tcp6_input().
925  * Thus the routine assumes that the caller (tcp6_input) have already
926  * called IP6_EXTHDR_CHECK() and all the extension headers are located in the
927  * very first mbuf on the mbuf chain.
928  * We may want to add some infinite loop prevention or sanity checks for safety.
929  * (This applies only when you are using KAME mbuf chain restriction, i.e.
930  * you are using IP6_EXTHDR_CHECK() not m_pulldown())
931  */
932 void
933 ip6_savecontrol(in6p, mp, ip6, m)
934 	register struct in6pcb *in6p;
935 	register struct mbuf **mp;
936 	register struct ip6_hdr *ip6;
937 	register struct mbuf *m;
938 {
939 	struct proc *p = curproc;	/* XXX */
940 	int privileged;
941 
942 	privileged = 0;
943 	if (p && !suser(p))
944 		privileged++;
945 
946 	if (in6p->in6p_socket->so_options & SO_TIMESTAMP) {
947 		struct timeval tv;
948 
949 		microtime(&tv);
950 		*mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
951 			SCM_TIMESTAMP, SOL_SOCKET);
952 		if (*mp)
953 			mp = &(*mp)->m_next;
954 	}
955 
956 #ifdef noyet
957 	/* options were tossed above */
958 	if (in6p->in6p_flags & IN6P_RECVOPTS)
959 		/* broken */
960 	/* ip6_srcroute doesn't do what we want here, need to fix */
961 	if (in6p->in6p_flags & IPV6P_RECVRETOPTS)
962 		/* broken */
963 #endif
964 
965 	/* RFC 2292 sec. 5 */
966 	if (in6p->in6p_flags & IN6P_PKTINFO) {
967 		struct in6_pktinfo pi6;
968 		bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr));
969 		if (IN6_IS_SCOPE_LINKLOCAL(&pi6.ipi6_addr))
970 			pi6.ipi6_addr.s6_addr16[1] = 0;
971 		pi6.ipi6_ifindex = (m && m->m_pkthdr.rcvif)
972 					? m->m_pkthdr.rcvif->if_index
973 					: 0;
974 		*mp = sbcreatecontrol((caddr_t) &pi6,
975 			sizeof(struct in6_pktinfo), IPV6_PKTINFO,
976 			IPPROTO_IPV6);
977 		if (*mp)
978 			mp = &(*mp)->m_next;
979 	}
980 	if (in6p->in6p_flags & IN6P_HOPLIMIT) {
981 		int hlim = ip6->ip6_hlim & 0xff;
982 		*mp = sbcreatecontrol((caddr_t) &hlim,
983 			sizeof(int), IPV6_HOPLIMIT, IPPROTO_IPV6);
984 		if (*mp)
985 			mp = &(*mp)->m_next;
986 	}
987 	/* IN6P_NEXTHOP - for outgoing packet only */
988 
989 	/*
990 	 * IPV6_HOPOPTS socket option. We require super-user privilege
991 	 * for the option, but it might be too strict, since there might
992 	 * be some hop-by-hop options which can be returned to normal user.
993 	 * See RFC 2292 section 6.
994 	 */
995 	if ((in6p->in6p_flags & IN6P_HOPOPTS) && privileged) {
996 		/*
997 		 * Check if a hop-by-hop options header is contatined in the
998 		 * received packet, and if so, store the options as ancillary
999 		 * data. Note that a hop-by-hop options header must be
1000 		 * just after the IPv6 header, which fact is assured through
1001 		 * the IPv6 input processing.
1002 		 */
1003 		struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1004 		if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
1005 			struct ip6_hbh *hbh;
1006 			int hbhlen;
1007 
1008 #ifndef PULLDOWN_TEST
1009 			hbh = (struct ip6_hbh *)(ip6 + 1);
1010 			hbhlen = (hbh->ip6h_len + 1) << 3;
1011 #else
1012 			IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m,
1013 				sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
1014 			if (hbh == NULL) {
1015 				ip6stat.ip6s_tooshort++;
1016 				return;
1017 			}
1018 			hbhlen = (hbh->ip6h_len + 1) << 3;
1019 			IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m,
1020 				sizeof(struct ip6_hdr), hbhlen);
1021 			if (hbh == NULL) {
1022 				ip6stat.ip6s_tooshort++;
1023 				return;
1024 			}
1025 #endif
1026 
1027 			/*
1028 			 * XXX: We copy whole the header even if a jumbo
1029 			 * payload option is included, which option is to
1030 			 * be removed before returning in the RFC 2292.
1031 			 * But it's too painful operation...
1032 			 */
1033 			*mp = sbcreatecontrol((caddr_t)hbh, hbhlen,
1034 					      IPV6_HOPOPTS, IPPROTO_IPV6);
1035 			if (*mp)
1036 				mp = &(*mp)->m_next;
1037 		}
1038 	}
1039 
1040 	/* IPV6_DSTOPTS and IPV6_RTHDR socket options */
1041 	if (in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDR)) {
1042 		struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1043 		int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr);;
1044 
1045 		/*
1046 		 * Search for destination options headers or routing
1047 		 * header(s) through the header chain, and stores each
1048 		 * header as ancillary data.
1049 		 * Note that the order of the headers remains in
1050 		 * the chain of ancillary data.
1051 		 */
1052 		while(1) {	/* is explicit loop prevention necessary? */
1053 			struct ip6_ext *ip6e;
1054 			int elen;
1055 
1056 #ifndef PULLDOWN_TEST
1057 			ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off);
1058 			if (nxt == IPPROTO_AH)
1059 				elen = (ip6e->ip6e_len + 2) << 2;
1060 			else
1061 				elen = (ip6e->ip6e_len + 1) << 3;
1062 #else
1063 			IP6_EXTHDR_GET(ip6e, struct ip6_ext *, m, off,
1064 				sizeof(struct ip6_ext));
1065 			if (ip6e == NULL) {
1066 				ip6stat.ip6s_tooshort++;
1067 				return;
1068 			}
1069 			if (nxt == IPPROTO_AH)
1070 				elen = (ip6e->ip6e_len + 2) << 2;
1071 			else
1072 				elen = (ip6e->ip6e_len + 1) << 3;
1073 			IP6_EXTHDR_GET(ip6e, struct ip6_ext *, m, off, elen);
1074 			if (ip6e == NULL) {
1075 				ip6stat.ip6s_tooshort++;
1076 				return;
1077 			}
1078 #endif
1079 
1080 			switch(nxt) {
1081 		         case IPPROTO_DSTOPTS:
1082 				 if (!in6p->in6p_flags & IN6P_DSTOPTS)
1083 					 break;
1084 
1085 				 /*
1086 				  * We also require super-user privilege for
1087 				  * the option.
1088 				  * See the comments on IN6_HOPOPTS.
1089 				  */
1090 				 if (!privileged)
1091 					 break;
1092 
1093 				 *mp = sbcreatecontrol((caddr_t)ip6e, elen,
1094 						       IPV6_DSTOPTS,
1095 						       IPPROTO_IPV6);
1096 				 if (*mp)
1097 					 mp = &(*mp)->m_next;
1098 				 break;
1099 
1100 			 case IPPROTO_ROUTING:
1101 				 if (!in6p->in6p_flags & IN6P_RTHDR)
1102 					 break;
1103 
1104 				 *mp = sbcreatecontrol((caddr_t)ip6e, elen,
1105 						       IPV6_RTHDR,
1106 						       IPPROTO_IPV6);
1107 				 if (*mp)
1108 					 mp = &(*mp)->m_next;
1109 				 break;
1110 
1111 			 case IPPROTO_UDP:
1112 			 case IPPROTO_TCP:
1113 			 case IPPROTO_ICMPV6:
1114 			 default:
1115 				 /*
1116 				  * stop search if we encounter an upper
1117 				  * layer protocol headers.
1118 				  */
1119 				 goto loopend;
1120 
1121 			 case IPPROTO_HOPOPTS:
1122 			 case IPPROTO_AH: /* is it possible? */
1123 				 break;
1124 			}
1125 
1126 			/* proceed with the next header. */
1127 			off += elen;
1128 			nxt = ip6e->ip6e_nxt;
1129 		}
1130 	  loopend:
1131 	}
1132 	if ((in6p->in6p_flags & IN6P_HOPOPTS) && privileged) {
1133 		/* to be done */
1134 	}
1135 	if ((in6p->in6p_flags & IN6P_DSTOPTS) && privileged) {
1136 		/* to be done */
1137 	}
1138 	/* IN6P_RTHDR - to be done */
1139 
1140 }
1141 
1142 /*
1143  * Get pointer to the previous header followed by the header
1144  * currently processed.
1145  * XXX: This function supposes that
1146  *	M includes all headers,
1147  *	the next header field and the header length field of each header
1148  *	are valid, and
1149  *	the sum of each header length equals to OFF.
1150  * Because of these assumptions, this function must be called very
1151  * carefully. Moreover, it will not be used in the near future when
1152  * we develop `neater' mechanism to process extension headers.
1153  */
1154 char *
1155 ip6_get_prevhdr(m, off)
1156 	struct mbuf *m;
1157 	int off;
1158 {
1159 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1160 
1161 	if (off == sizeof(struct ip6_hdr))
1162 		return(&ip6->ip6_nxt);
1163 	else {
1164 		int len, nxt;
1165 		struct ip6_ext *ip6e = NULL;
1166 
1167 		nxt = ip6->ip6_nxt;
1168 		len = sizeof(struct ip6_hdr);
1169 		while (len < off) {
1170 			ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + len);
1171 
1172 			switch(nxt) {
1173 			case IPPROTO_FRAGMENT:
1174 				len += sizeof(struct ip6_frag);
1175 				break;
1176 			case IPPROTO_AH:
1177 				len += (ip6e->ip6e_len + 2) << 2;
1178 				break;
1179 			default:
1180 				len += (ip6e->ip6e_len + 1) << 3;
1181 				break;
1182 			}
1183 			nxt = ip6e->ip6e_nxt;
1184 		}
1185 		if (ip6e)
1186 			return(&ip6e->ip6e_nxt);
1187 		else
1188 			return NULL;
1189 	}
1190 }
1191 
1192 /*
1193  * get next header offset.  m will be retained.
1194  */
1195 int
1196 ip6_nexthdr(m, off, proto, nxtp)
1197 	struct mbuf *m;
1198 	int off;
1199 	int proto;
1200 	int *nxtp;
1201 {
1202 	struct ip6_hdr ip6;
1203 	struct ip6_ext ip6e;
1204 	struct ip6_frag fh;
1205 
1206 	/* just in case */
1207 	if (m == NULL)
1208 		panic("ip6_nexthdr: m == NULL");
1209 	if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off)
1210 		return -1;
1211 
1212 	switch (proto) {
1213 	case IPPROTO_IPV6:
1214 		if (m->m_pkthdr.len < off + sizeof(ip6))
1215 			return -1;
1216 		m_copydata(m, off, sizeof(ip6), (caddr_t)&ip6);
1217 		if (nxtp)
1218 			*nxtp = ip6.ip6_nxt;
1219 		off += sizeof(ip6);
1220 		return off;
1221 
1222 	case IPPROTO_FRAGMENT:
1223 		/*
1224 		 * terminate parsing if it is not the first fragment,
1225 		 * it does not make sense to parse through it.
1226 		 */
1227 		if (m->m_pkthdr.len < off + sizeof(fh))
1228 			return -1;
1229 		m_copydata(m, off, sizeof(fh), (caddr_t)&fh);
1230 		if ((ntohs(fh.ip6f_offlg) & IP6F_OFF_MASK) != 0)
1231 			return -1;
1232 		if (nxtp)
1233 			*nxtp = fh.ip6f_nxt;
1234 		off += sizeof(struct ip6_frag);
1235 		return off;
1236 
1237 	case IPPROTO_AH:
1238 		if (m->m_pkthdr.len < off + sizeof(ip6e))
1239 			return -1;
1240 		m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
1241 		if (nxtp)
1242 			*nxtp = ip6e.ip6e_nxt;
1243 		off += (ip6e.ip6e_len + 2) << 2;
1244 		return off;
1245 
1246 	case IPPROTO_HOPOPTS:
1247 	case IPPROTO_ROUTING:
1248 	case IPPROTO_DSTOPTS:
1249 		if (m->m_pkthdr.len < off + sizeof(ip6e))
1250 			return -1;
1251 		m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e);
1252 		if (nxtp)
1253 			*nxtp = ip6e.ip6e_nxt;
1254 		off += (ip6e.ip6e_len + 1) << 3;
1255 		return off;
1256 
1257 	case IPPROTO_NONE:
1258 	case IPPROTO_ESP:
1259 	case IPPROTO_IPCOMP:
1260 		/* give up */
1261 		return -1;
1262 
1263 	default:
1264 		return -1;
1265 	}
1266 
1267 	return -1;
1268 }
1269 
1270 /*
1271  * get offset for the last header in the chain.  m will be kept untainted.
1272  */
1273 int
1274 ip6_lasthdr(m, off, proto, nxtp)
1275 	struct mbuf *m;
1276 	int off;
1277 	int proto;
1278 	int *nxtp;
1279 {
1280 	int newoff;
1281 	int nxt;
1282 
1283 	if (!nxtp) {
1284 		nxt = -1;
1285 		nxtp = &nxt;
1286 	}
1287 	while (1) {
1288 		newoff = ip6_nexthdr(m, off, proto, nxtp);
1289 		if (newoff < 0)
1290 			return off;
1291 		else if (newoff < off)
1292 			return -1;	/* invalid */
1293 		else if (newoff == off)
1294 			return newoff;
1295 
1296 		off = newoff;
1297 		proto = *nxtp;
1298 	}
1299 }
1300 
1301 /*
1302  * System control for IP6
1303  */
1304 
1305 u_char	inet6ctlerrmap[PRC_NCMDS] = {
1306 	0,		0,		0,		0,
1307 	0,		EMSGSIZE,	EHOSTDOWN,	EHOSTUNREACH,
1308 	EHOSTUNREACH,	EHOSTUNREACH,	ECONNREFUSED,	ECONNREFUSED,
1309 	EMSGSIZE,	EHOSTUNREACH,	0,		0,
1310 	0,		0,		0,		0,
1311 	ENOPROTOOPT
1312 };
1313