xref: /freebsd/sys/netinet6/ip6_input.c (revision e63a2405763dc40dbb83dedb7c6907dc23d46cb3)
1 /*
2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the project nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 /*
33  * Copyright (c) 1982, 1986, 1988, 1993
34  *	The Regents of the University of California.  All rights reserved.
35  *
36  * Redistribution and use in source and binary forms, with or without
37  * modification, are permitted provided that the following conditions
38  * are met:
39  * 1. Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  * 2. Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in the
43  *    documentation and/or other materials provided with the distribution.
44  * 3. All advertising materials mentioning features or use of this software
45  *    must display the following acknowledgement:
46  *	This product includes software developed by the University of
47  *	California, Berkeley and its contributors.
48  * 4. Neither the name of the University nor the names of its contributors
49  *    may be used to endorse or promote products derived from this software
50  *    without specific prior written permission.
51  *
52  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
53  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
54  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
55  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
56  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
57  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
58  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
59  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
60  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
61  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
62  * SUCH DAMAGE.
63  *
64  *	@(#)ip_input.c	8.2 (Berkeley) 1/4/94
65  */
66 
67 #include "opt_ipsec.h"
68 
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/malloc.h>
72 #include <sys/mbuf.h>
73 #include <sys/domain.h>
74 #include <sys/protosw.h>
75 #include <sys/socket.h>
76 #include <sys/socketvar.h>
77 #include <sys/errno.h>
78 #include <sys/time.h>
79 #include <sys/kernel.h>
80 #include <sys/syslog.h>
81 #include <sys/proc.h>
82 
83 #include <net/if.h>
84 #include <net/if_types.h>
85 #include <net/if_dl.h>
86 #include <net/route.h>
87 #include <net/netisr.h>
88 
89 #include <netinet/in.h>
90 #include <netinet/in_systm.h>
91 #include <netinet/ip.h>
92 #include <netinet/ip_icmp.h>
93 #include <netinet/in_pcb.h>
94 #include <netinet6/in6_var.h>
95 #include <netinet6/ip6.h>
96 #include <netinet6/ip6_var.h>
97 #include <netinet6/icmp6.h>
98 #include <netinet6/in6_ifattach.h>
99 #include <netinet6/nd6.h>
100 #include <netinet6/in6_prefix.h>
101 
102 #ifdef IPV6FIREWALL
103 #include <netinet6/ip6_fw.h>
104 #endif
105 
106 #ifdef ALTQ
107 #include <netinet/altq_cdnr.h>
108 #endif
109 
110 #include <netinet6/ip6protosw.h>
111 
112 /* we need it for NLOOP. */
113 #include "loop.h"
114 
115 #include "faith.h"
116 #include "gif.h"
117 
118 #include <net/net_osdep.h>
119 
120 extern struct	domain inet6domain;
121 extern struct	ip6protosw inet6sw[];
122 
123 u_char	ip6_protox[IPPROTO_MAX];
124 static int	ip6qmaxlen = IFQ_MAXLEN;
125 struct	in6_ifaddr *in6_ifaddr;
126 struct	ifqueue ip6intrq;
127 
128 int	ip6_forward_srcrt;			/* XXX */
129 int	ip6_sourcecheck;			/* XXX */
130 int	ip6_sourcecheck_interval;		/* XXX */
131 
132 #ifdef IPV6FIREWALL
133 /* firewall hooks */
134 ip6_fw_chk_t	*ip6_fw_chk_ptr;
135 ip6_fw_ctl_t	*ip6_fw_ctl_ptr;
136 #endif
137 
138 struct	ip6stat ip6stat;
139 
140 static void	ip6_init2 __P((void *));
141 
142 static int	ip6_hopopts_input __P((u_int32_t *, u_int32_t *, struct mbuf **, int *));
143 
144 #if defined(PTR)
145 extern int	ip6_protocol_tr;
146 
147 int	ptr_in6		__P((struct mbuf *, struct mbuf **));
148 extern void	ip_forward __P((struct mbuf *, int));
149 #endif
150 
151 /*
152  * IP6 initialization: fill in IP6 protocol switch table.
153  * All protocols not implemented in kernel go to raw IP6 protocol handler.
154  */
155 void
156 ip6_init()
157 {
158 	register struct ip6protosw *pr;
159 	register int i;
160 	struct timeval tv;
161 
162 	pr = (struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW);
163 	if (pr == 0)
164 		panic("ip6_init");
165 	for (i = 0; i < IPPROTO_MAX; i++)
166 		ip6_protox[i] = pr - inet6sw;
167 	for (pr = (struct ip6protosw *)inet6domain.dom_protosw;
168 	    pr < (struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++)
169 		if (pr->pr_domain->dom_family == PF_INET6 &&
170 		    pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
171 			ip6_protox[pr->pr_protocol] = pr - inet6sw;
172 	ip6intrq.ifq_maxlen = ip6qmaxlen;
173 	nd6_init();
174 	frag6_init();
175 #ifdef IPV6FIREWALL
176 	ip6_fw_init();
177 #endif
178 	/*
179 	 * in many cases, random() here does NOT return random number
180 	 * as initialization during bootstrap time occur in fixed order.
181 	 */
182 	microtime(&tv);
183 	ip6_flow_seq = random() ^ tv.tv_usec;
184 }
185 
186 static void
187 ip6_init2(dummy)
188 	void *dummy;
189 {
190 	int i;
191 	int ret;
192 
193 	/* get EUI64 from somewhere */
194 	ret = in6_ifattach_getifid(NULL);
195 
196 	/*
197 	 * to route local address of p2p link to loopback,
198 	 * assign loopback address first.
199 	 */
200 	for (i = 0; i < NLOOP; i++)
201 		in6_ifattach(&loif[i], IN6_IFT_LOOP, NULL, 0);
202 
203 	/* attach pseudo interfaces */
204 	if (ret == 0)
205 		in6_ifattach_p2p();
206 
207 	/* nd6_timer_init */
208 	timeout(nd6_timer, (caddr_t)0, hz);
209 	/* router renumbering prefix list maintenance */
210 	timeout(in6_rr_timer, (caddr_t)0, hz);
211 }
212 
213 /* cheat */
214 /* This must be after route_init(), which is now SI_ORDER_THIRD */
215 SYSINIT(netinet6init2, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ip6_init2, NULL);
216 
217 /*
218  * IP6 input interrupt handling. Just pass the packet to ip6_input.
219  */
220 void
221 ip6intr()
222 {
223 	int s;
224 	struct mbuf *m;
225 
226 	for (;;) {
227 		s = splimp();
228 		IF_DEQUEUE(&ip6intrq, m);
229 		splx(s);
230 		if (m == 0)
231 			return;
232 		ip6_input(m);
233 	}
234 }
235 
236 NETISR_SET(NETISR_IPV6, ip6intr);
237 
238 extern struct	route_in6 ip6_forward_rt;
239 
240 void
241 ip6_input(m)
242 	struct mbuf *m;
243 {
244 	struct ip6_hdr *ip6;
245 	int off = sizeof(struct ip6_hdr), nest;
246 	u_int32_t plen;
247 	u_int32_t rtalert = ~0;
248 	int nxt, ours = 0;
249 	struct ifnet *deliverifp = NULL;
250 
251 #ifdef IPSEC
252 	/*
253 	 * should the inner packet be considered authentic?
254 	 * see comment in ah4_input().
255 	 */
256 	if (m) {
257 		m->m_flags &= ~M_AUTHIPHDR;
258 		m->m_flags &= ~M_AUTHIPDGM;
259 	}
260 #endif
261 
262 	/*
263 	 * mbuf statistics by kazu
264 	 */
265 	if (m->m_flags & M_EXT) {
266 		if (m->m_next)
267 			ip6stat.ip6s_mext2m++;
268 		else
269 			ip6stat.ip6s_mext1++;
270 	} else {
271 		if (m->m_next) {
272 			if (m->m_flags & M_LOOP) {
273 				ip6stat.ip6s_m2m[loif[0].if_index]++;	/*XXX*/
274 			} else if (m->m_pkthdr.rcvif->if_index <= 31)
275 				ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++;
276 			else
277 				ip6stat.ip6s_m2m[0]++;
278 		} else
279 			ip6stat.ip6s_m1++;
280 	}
281 
282 	in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive);
283 	ip6stat.ip6s_total++;
284 
285 	IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), /*nothing*/);
286 
287 	if (m->m_len < sizeof(struct ip6_hdr)) {
288 		struct ifnet *inifp;
289 		inifp = m->m_pkthdr.rcvif;
290 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == 0) {
291 			ip6stat.ip6s_toosmall++;
292 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
293 			return;
294 		}
295 	}
296 
297 	ip6 = mtod(m, struct ip6_hdr *);
298 
299 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
300 		ip6stat.ip6s_badvers++;
301 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
302 		goto bad;
303 	}
304 
305 	ip6stat.ip6s_nxthist[ip6->ip6_nxt]++;
306 
307 #ifdef IPV6FIREWALL
308 	/*
309 	 * Check with the firewall...
310 	 */
311 	if (ip6_fw_chk_ptr) {
312 		u_short port = 0;
313 		/* If ipfw says divert, we have to just drop packet */
314 		/* use port as a dummy argument */
315 		if ((*ip6_fw_chk_ptr)(&ip6, NULL, &port, &m)) {
316 			m_freem(m);
317 			m = NULL;
318 		}
319 		if (!m)
320 			return;
321 	}
322 #endif
323 
324 #ifdef ALTQ
325 	if (altq_input != NULL && (*altq_input)(m, AF_INET6) == 0) {
326 		/* packet is dropped by traffic conditioner */
327 		return;
328 	}
329 #endif
330 
331 	/*
332 	 * Scope check
333 	 */
334 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) ||
335 	    IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) {
336 		ip6stat.ip6s_badscope++;
337 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
338 		goto bad;
339 	}
340 	if (IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) ||
341 	    IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) {
342 		if (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) {
343 			ours = 1;
344 			deliverifp = m->m_pkthdr.rcvif;
345 			goto hbhcheck;
346 		} else {
347 			ip6stat.ip6s_badscope++;
348 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
349 			goto bad;
350 		}
351 	}
352 
353 	if (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) {
354 		if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) {
355 			ours = 1;
356 			deliverifp = m->m_pkthdr.rcvif;
357 			goto hbhcheck;
358 		}
359 	} else {
360 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
361 			ip6->ip6_src.s6_addr16[1]
362 				= htons(m->m_pkthdr.rcvif->if_index);
363 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
364 			ip6->ip6_dst.s6_addr16[1]
365 				= htons(m->m_pkthdr.rcvif->if_index);
366 	}
367 
368 #if defined(PTR)
369 	/*
370 	 *
371 	 */
372 	if (ip6_protocol_tr)
373 	{
374 	    struct mbuf *m1 = NULL;
375 
376 	    switch (ptr_in6(m, &m1))
377 	    {
378 	      case IPPROTO_IP:					goto mcastcheck;
379 	      case IPPROTO_IPV4:	ip_forward(m1, 0);	break;
380 	      case IPPROTO_IPV6:	ip6_forward(m1, 0);	break;
381 	      case IPPROTO_MAX:			/* discard this packet	*/
382 	      default:
383 	    }
384 
385 	    if (m != m1)
386 		m_freem(m);
387 
388 	    return;
389 	}
390 
391   mcastcheck:
392 #endif
393 
394 	/*
395 	 * Multicast check
396 	 */
397 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
398 	  	struct	in6_multi *in6m = 0;
399 
400 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast);
401 		/*
402 		 * See if we belong to the destination multicast group on the
403 		 * arrival interface.
404 		 */
405 		IN6_LOOKUP_MULTI(ip6->ip6_dst, m->m_pkthdr.rcvif, in6m);
406 		if (in6m)
407 			ours = 1;
408 		else {
409 			ip6stat.ip6s_notmember++;
410 			ip6stat.ip6s_cantforward++;
411 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
412 			goto bad;
413 		}
414 		deliverifp = m->m_pkthdr.rcvif;
415 		goto hbhcheck;
416 	}
417 
418 	/*
419 	 *  Unicast check
420 	 */
421 	if (ip6_forward_rt.ro_rt == 0 ||
422 	    !IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
423 				&ip6_forward_rt.ro_dst.sin6_addr)) {
424 		if (ip6_forward_rt.ro_rt) {
425 			RTFREE(ip6_forward_rt.ro_rt);
426 			ip6_forward_rt.ro_rt = 0;
427 		}
428 		bzero(&ip6_forward_rt.ro_dst, sizeof(struct sockaddr_in6));
429 		ip6_forward_rt.ro_dst.sin6_len = sizeof(struct sockaddr_in6);
430 		ip6_forward_rt.ro_dst.sin6_family = AF_INET6;
431 		ip6_forward_rt.ro_dst.sin6_addr = ip6->ip6_dst;
432 
433 		rtalloc_ign((struct route *)&ip6_forward_rt, RTF_PRCLONING);
434 	}
435 
436 #define rt6_key(r) ((struct sockaddr_in6 *)((r)->rt_nodes->rn_key))
437 
438 	/*
439 	 * Accept the packet if the forwarding interface to the destination
440 	 * according to the routing table is the loopback interface,
441 	 * unless the associated route has a gateway.
442 	 * Note that this approach causes to accept a packet if there is a
443 	 * route to the loopback interface for the destination of the packet.
444 	 * But we think it's even useful in some situations, e.g. when using
445 	 * a special daemon which wants to intercept the packet.
446 	 */
447 	if (ip6_forward_rt.ro_rt &&
448 	    (ip6_forward_rt.ro_rt->rt_flags &
449 	     (RTF_HOST|RTF_GATEWAY)) == RTF_HOST &&
450 	    /*
451 	     * The comparison of the destination and the key of the rtentry
452 	     * has already done through looking up the routing table,
453 	     * so no need to do such a comparison here again.
454 	     */
455 	    ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_LOOP) {
456 		struct in6_ifaddr *ia6 =
457 			(struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa;
458 		/* packet to tentative address must not be received */
459 		if (ia6->ia6_flags & IN6_IFF_ANYCAST)
460 			m->m_flags |= M_ANYCAST6;
461 		if (!(ia6->ia6_flags & IN6_IFF_NOTREADY)) {
462 			/* this interface is ready */
463 			ours = 1;
464 			deliverifp = ia6->ia_ifp;	/* correct? */
465 			goto hbhcheck;
466 		} else {
467 			/* this interface is not ready, fall through */
468 		}
469 	}
470 
471 	/*
472 	 * FAITH(Firewall Aided Internet Translator)
473 	 */
474 #if defined(NFAITH) && 0 < NFAITH
475 	if (ip6_keepfaith) {
476 		if (ip6_forward_rt.ro_rt && ip6_forward_rt.ro_rt->rt_ifp
477 		 && ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) {
478 			/* XXX do we need more sanity checks? */
479 			ours = 1;
480 			deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /*faith*/
481 			goto hbhcheck;
482 		}
483 	}
484 #endif
485 
486 	/*
487 	 * Now there is no reason to process the packet if it's not our own
488 	 * and we're not a router.
489 	 */
490 	if (!ip6_forwarding) {
491 		ip6stat.ip6s_cantforward++;
492 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
493 		goto bad;
494 	}
495 
496   hbhcheck:
497 	/*
498 	 * Process Hop-by-Hop options header if it's contained.
499 	 * m may be modified in ip6_hopopts_input().
500 	 * If a JumboPayload option is included, plen will also be modified.
501 	 */
502 	plen = (u_int32_t)ntohs(ip6->ip6_plen);
503 	if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
504 		if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) {
505 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
506 			return;	/* m have already been freed */
507 		}
508 		/* adjust pointer */
509 		ip6 = mtod(m, struct ip6_hdr *);
510 		nxt = ((struct ip6_hbh *)(ip6 + 1))->ip6h_nxt;
511 
512 		/*
513 		 * accept the packet if a router alert option is included
514 		 * and we act as an IPv6 router.
515 		 */
516 		if (rtalert != ~0 && ip6_forwarding)
517 			ours = 1;
518 	} else
519 		nxt = ip6->ip6_nxt;
520 
521 	/*
522 	 * Check that the amount of data in the buffers
523 	 * is as at least much as the IPv6 header would have us expect.
524 	 * Trim mbufs if longer than we expect.
525 	 * Drop packet if shorter than we expect.
526 	 */
527 	if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
528 		ip6stat.ip6s_tooshort++;
529 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
530 		goto bad;
531 	}
532 	if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
533 		if (m->m_len == m->m_pkthdr.len) {
534 			m->m_len = sizeof(struct ip6_hdr) + plen;
535 			m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
536 		} else
537 			m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len);
538 	}
539 
540 	/*
541 	 * Forward if desirable.
542 	 */
543 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
544 		if (!ours) {
545 			m_freem(m);
546 			return;
547 		}
548 	} else if (!ours) {
549 		ip6_forward(m, 0);
550 		return;
551 	}
552 
553 	/*
554 	 * Tell launch routine the next header
555 	 */
556 #if defined(__NetBSD__) && defined(IFA_STATS)
557 	if (IFA_STATS && deliverifp != NULL) {
558 		struct in6_ifaddr *ia6;
559 		ip6 = mtod(m, struct ip6_hdr *);
560 		ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
561 		if (ia6)
562 			ia6->ia_ifa.ifa_data.ifad_inbytes += m->m_pkthdr.len;
563 	}
564 #endif
565 	ip6stat.ip6s_delivered++;
566 	in6_ifstat_inc(deliverifp, ifs6_in_deliver);
567 	nest = 0;
568 	while (nxt != IPPROTO_DONE) {
569 		if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
570 			ip6stat.ip6s_toomanyhdr++;
571 			goto bad;
572 		}
573 
574 		/*
575 		 * protection against faulty packet - there should be
576 		 * more sanity checks in header chain processing.
577 		 */
578 		if (m->m_pkthdr.len < off) {
579 			ip6stat.ip6s_tooshort++;
580 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
581 			goto bad;
582 		}
583 
584 		nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt);
585 	}
586 	return;
587  bad:
588 	m_freem(m);
589 }
590 
591 /*
592  * Hop-by-Hop options header processing. If a valid jumbo payload option is
593  * included, the real payload length will be stored in plenp.
594  */
595 static int
596 ip6_hopopts_input(plenp, rtalertp, mp, offp)
597 	u_int32_t *plenp;
598 	u_int32_t *rtalertp;	/* XXX: should be stored more smart way */
599 	struct mbuf **mp;
600 	int *offp;
601 {
602 	register struct mbuf *m = *mp;
603 	int off = *offp, hbhlen;
604 	struct ip6_hbh *hbh;
605 	u_int8_t *opt;
606 
607 	/* validation of the length of the header */
608 	IP6_EXTHDR_CHECK(m, off, sizeof(*hbh), -1);
609 	hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off);
610 	hbhlen = (hbh->ip6h_len + 1) << 3;
611 
612 	IP6_EXTHDR_CHECK(m, off, hbhlen, -1);
613 	hbh = (struct ip6_hbh *)(mtod(m, caddr_t) + off);
614 	off += hbhlen;
615 	hbhlen -= sizeof(struct ip6_hbh);
616 	opt = (u_int8_t *)hbh + sizeof(struct ip6_hbh);
617 
618 	if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
619 				hbhlen, rtalertp, plenp) < 0)
620 		return(-1);
621 
622 	*offp = off;
623 	*mp = m;
624 	return(0);
625 }
626 
627 /*
628  * Search header for all Hop-by-hop options and process each option.
629  * This function is separate from ip6_hopopts_input() in order to
630  * handle a case where the sending node itself process its hop-by-hop
631  * options header. In such a case, the function is called from ip6_output().
632  */
633 int
634 ip6_process_hopopts(m, opthead, hbhlen, rtalertp, plenp)
635 	struct mbuf *m;
636 	u_int8_t *opthead;
637 	int hbhlen;
638 	u_int32_t *rtalertp;
639 	u_int32_t *plenp;
640 {
641 	struct ip6_hdr *ip6;
642 	int optlen = 0;
643 	u_int8_t *opt = opthead;
644 	u_int16_t rtalert_val;
645 
646 	for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) {
647 		switch(*opt) {
648 		 case IP6OPT_PAD1:
649 			 optlen = 1;
650 			 break;
651 		 case IP6OPT_PADN:
652 			 if (hbhlen < IP6OPT_MINLEN) {
653 				 ip6stat.ip6s_toosmall++;
654 				 goto bad;
655 			 }
656 			 optlen = *(opt + 1) + 2;
657 			 break;
658 		 case IP6OPT_RTALERT:
659 			 /* XXX may need check for alignment */
660 			 if (hbhlen < IP6OPT_RTALERT_LEN) {
661 				 ip6stat.ip6s_toosmall++;
662 				 goto bad;
663 			 }
664 			 if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2)
665 				  /* XXX: should we discard the packet? */
666 				 log(LOG_ERR, "length of router alert opt is inconsitent(%d)",
667 				     *(opt + 1));
668 			 optlen = IP6OPT_RTALERT_LEN;
669 			 bcopy((caddr_t)(opt + 2), (caddr_t)&rtalert_val, 2);
670 			 *rtalertp = ntohs(rtalert_val);
671 			 break;
672 		 case IP6OPT_JUMBO:
673 			 /* XXX may need check for alignment */
674 			 if (hbhlen < IP6OPT_JUMBO_LEN) {
675 				 ip6stat.ip6s_toosmall++;
676 				 goto bad;
677 			 }
678 			 if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2)
679 				  /* XXX: should we discard the packet? */
680 				 log(LOG_ERR, "length of jumbopayload opt "
681 				     "is inconsistent(%d)",
682 				     *(opt + 1));
683 			 optlen = IP6OPT_JUMBO_LEN;
684 
685 			 bcopy(opt + 2, plenp, sizeof(*plenp));
686 			 *plenp = htonl(*plenp);
687 			 if (*plenp <= IPV6_MAXPACKET) {
688 				 /*
689 				  * jumbo payload length must be larger
690 				  * than 65535
691 				  */
692 				 ip6stat.ip6s_badoptions++;
693 				 icmp6_error(m, ICMP6_PARAM_PROB,
694 					     ICMP6_PARAMPROB_HEADER,
695 					     sizeof(struct ip6_hdr) +
696 					     sizeof(struct ip6_hbh) +
697 					     opt + 2 - opthead);
698 				 return(-1);
699 			 }
700 
701 			 ip6 = mtod(m, struct ip6_hdr *);
702 			 if (ip6->ip6_plen) {
703 				 /*
704 				  * IPv6 packets that have non 0 payload length
705 				  * must not contain a jumbo paylod option.
706 				  */
707 				 ip6stat.ip6s_badoptions++;
708 				 icmp6_error(m, ICMP6_PARAM_PROB,
709 					     ICMP6_PARAMPROB_HEADER,
710 					     sizeof(struct ip6_hdr) +
711 					     sizeof(struct ip6_hbh) +
712 					     opt - opthead);
713 				 return(-1);
714 			 }
715 			 break;
716 		 default:		/* unknown option */
717 			 if (hbhlen < IP6OPT_MINLEN) {
718 				 ip6stat.ip6s_toosmall++;
719 				 goto bad;
720 			 }
721 			 if ((optlen = ip6_unknown_opt(opt, m,
722 						       sizeof(struct ip6_hdr) +
723 						       sizeof(struct ip6_hbh) +
724 						       opt - opthead)) == -1)
725 				 return(-1);
726 			 optlen += 2;
727 			 break;
728 		}
729 	}
730 
731 	return(0);
732 
733   bad:
734 	m_freem(m);
735 	return(-1);
736 }
737 
738 /*
739  * Unknown option processing.
740  * The third argument `off' is the offset from the IPv6 header to the option,
741  * which is necessary if the IPv6 header the and option header and IPv6 header
742  * is not continuous in order to return an ICMPv6 error.
743  */
744 int
745 ip6_unknown_opt(optp, m, off)
746 	u_int8_t *optp;
747 	struct mbuf *m;
748 	int off;
749 {
750 	struct ip6_hdr *ip6;
751 
752 	switch(IP6OPT_TYPE(*optp)) {
753 	 case IP6OPT_TYPE_SKIP: /* ignore the option */
754 		 return((int)*(optp + 1));
755 	 case IP6OPT_TYPE_DISCARD:	/* silently discard */
756 		 m_freem(m);
757 		 return(-1);
758 	 case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */
759 		 ip6stat.ip6s_badoptions++;
760 		 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off);
761 		 return(-1);
762 	 case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */
763 		 ip6stat.ip6s_badoptions++;
764 		 ip6 = mtod(m, struct ip6_hdr *);
765 		 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
766 		     (m->m_flags & (M_BCAST|M_MCAST)))
767 			 m_freem(m);
768 		 else
769 			 icmp6_error(m, ICMP6_PARAM_PROB,
770 				     ICMP6_PARAMPROB_OPTION, off);
771 		 return(-1);
772 	}
773 
774 	m_freem(m);		/* XXX: NOTREACHED */
775 	return(-1);
776 }
777 
778 /*
779  * Create the "control" list for this pcb
780  */
781 void
782 ip6_savecontrol(in6p, mp, ip6, m)
783 	register struct inpcb *in6p;
784 	register struct mbuf **mp;
785 	register struct ip6_hdr *ip6;
786 	register struct mbuf *m;
787 {
788 	struct proc *p = curproc;	/* XXX */
789 	int privileged;
790 
791 	privileged = 0;
792 	if (p && !suser(p))
793 		privileged++;
794 
795 	if (in6p->in6p_socket->so_options & SO_TIMESTAMP) {
796 		struct timeval tv;
797 
798 		microtime(&tv);
799 		*mp = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
800 			SCM_TIMESTAMP, SOL_SOCKET);
801 		if (*mp)
802 			mp = &(*mp)->m_next;
803 	}
804 	if (in6p->in6p_flags & IN6P_RECVDSTADDR) {
805 		*mp = sbcreatecontrol((caddr_t) &ip6->ip6_dst,
806 			sizeof(struct in6_addr), IPV6_RECVDSTADDR,
807 			IPPROTO_IPV6);
808 		if (*mp)
809 			mp = &(*mp)->m_next;
810 	}
811 
812 	/* RFC 2292 sec. 5 */
813 	if (in6p->in6p_flags & IN6P_PKTINFO) {
814 		struct in6_pktinfo pi6;
815 		bcopy(&ip6->ip6_dst, &pi6.ipi6_addr, sizeof(struct in6_addr));
816 		if (IN6_IS_SCOPE_LINKLOCAL(&pi6.ipi6_addr))
817 			pi6.ipi6_addr.s6_addr16[1] = 0;
818 		pi6.ipi6_ifindex = (m && m->m_pkthdr.rcvif)
819 					? m->m_pkthdr.rcvif->if_index
820 					: 0;
821 		*mp = sbcreatecontrol((caddr_t) &pi6,
822 			sizeof(struct in6_pktinfo), IPV6_PKTINFO,
823 			IPPROTO_IPV6);
824 		if (*mp)
825 			mp = &(*mp)->m_next;
826 	}
827 	if (in6p->in6p_flags & IN6P_HOPLIMIT) {
828 		int hlim = ip6->ip6_hlim & 0xff;
829 		*mp = sbcreatecontrol((caddr_t) &hlim,
830 			sizeof(int), IPV6_HOPLIMIT, IPPROTO_IPV6);
831 		if (*mp)
832 			mp = &(*mp)->m_next;
833 	}
834 	/* IN6P_NEXTHOP - for outgoing packet only */
835 
836 	/*
837 	 * IPV6_HOPOPTS socket option. We require super-user privilege
838 	 * for the option, but it might be too strict, since there might
839 	 * be some hop-by-hop options which can be returned to normal user.
840 	 * See RFC 2292 section 6.
841 	 */
842 	if ((in6p->in6p_flags & IN6P_HOPOPTS) && privileged) {
843 		/*
844 		 * Check if a hop-by-hop options header is contatined in the
845 		 * received packet, and if so, store the options as ancillary
846 		 * data. Note that a hop-by-hop options header must be
847 		 * just after the IPv6 header, which fact is assured through
848 		 * the IPv6 input processing.
849 		 */
850 		struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
851 		if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
852 			struct ip6_hbh *hbh = (struct ip6_hbh *)(ip6 + 1);
853 
854 			/*
855 			 * XXX: We copy whole the header even if a jumbo
856 			 * payload option is included, which option is to
857 			 * be removed before returning in the RFC 2292.
858 			 * But it's too painful operation...
859 			 */
860 			*mp = sbcreatecontrol((caddr_t)hbh,
861 					      (hbh->ip6h_len + 1) << 3,
862 					      IPV6_HOPOPTS, IPPROTO_IPV6);
863 			if (*mp)
864 				mp = &(*mp)->m_next;
865 		}
866 	}
867 
868 	/* IPV6_DSTOPTS and IPV6_RTHDR socket options */
869 	if (in6p->in6p_flags & (IN6P_DSTOPTS | IN6P_RTHDR)) {
870 		struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
871 		int nxt = ip6->ip6_nxt, off = sizeof(struct ip6_hdr);;
872 
873 		/*
874 		 * Search for destination options headers or routing
875 		 * header(s) through the header chain, and stores each
876 		 * header as ancillary data.
877 		 * Note that the order of the headers remains in
878 		 * the chain of ancillary data.
879 		 */
880 		while(1) {	/* is explicit loop prevention necessary? */
881 			struct ip6_ext *ip6e =
882 				(struct ip6_ext *)(mtod(m, caddr_t) + off);
883 
884 			switch(nxt) {
885 		         case IPPROTO_DSTOPTS:
886 				 if (!in6p->in6p_flags & IN6P_DSTOPTS)
887 					 break;
888 
889 				 /*
890 				  * We also require super-user privilege for
891 				  * the option.
892 				  * See the comments on IN6_HOPOPTS.
893 				  */
894 				 if (!privileged)
895 					 break;
896 
897 				 *mp = sbcreatecontrol((caddr_t)ip6e,
898 						       (ip6e->ip6e_len + 1) << 3,
899 						       IPV6_DSTOPTS,
900 						       IPPROTO_IPV6);
901 				 if (*mp)
902 					 mp = &(*mp)->m_next;
903 				 break;
904 
905 			 case IPPROTO_ROUTING:
906 				 if (!in6p->in6p_flags & IN6P_RTHDR)
907 					 break;
908 
909 				 *mp = sbcreatecontrol((caddr_t)ip6e,
910 						       (ip6e->ip6e_len + 1) << 3,
911 						       IPV6_RTHDR,
912 						       IPPROTO_IPV6);
913 				 if (*mp)
914 					 mp = &(*mp)->m_next;
915 				 break;
916 
917 			 case IPPROTO_UDP:
918 			 case IPPROTO_TCP:
919 			 case IPPROTO_ICMPV6:
920 			 default:
921 				 /*
922 				  * stop search if we encounter an upper
923 				  * layer protocol headers.
924 				  */
925 				 goto loopend;
926 
927 			 case IPPROTO_HOPOPTS:
928 			 case IPPROTO_AH: /* is it possible? */
929 				 break;
930 			}
931 
932 			/* proceed with the next header. */
933 			if (nxt == IPPROTO_AH)
934 				off += (ip6e->ip6e_len + 2) << 2;
935 			else
936 				off += (ip6e->ip6e_len + 1) << 3;
937 			nxt = ip6e->ip6e_nxt;
938 		}
939 	  loopend:
940 	}
941 	if ((in6p->in6p_flags & IN6P_HOPOPTS) && privileged) {
942 		/* to be done */
943 	}
944 	if ((in6p->in6p_flags & IN6P_DSTOPTS) && privileged) {
945 		/* to be done */
946 	}
947 	/* IN6P_RTHDR - to be done */
948 }
949 
950 /*
951  * Get pointer to the previous header followed by the header
952  * currently processed.
953  * XXX: This function supposes that
954  *	M includes all headers,
955  *	the next header field and the header length field of each header
956  *	are valid, and
957  *	the sum of each header length equals to OFF.
958  * Because of these assumptions, this function must be called very
959  * carefully. Moreover, it will not be used in the near future when
960  * we develop `neater' mechanism to process extension headers.
961  */
962 char *
963 ip6_get_prevhdr(m, off)
964 	struct mbuf *m;
965 	int off;
966 {
967 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
968 
969 	if (off == sizeof(struct ip6_hdr))
970 		return(&ip6->ip6_nxt);
971 	else {
972 		int len, nxt;
973 		struct ip6_ext *ip6e = NULL;
974 
975 		nxt = ip6->ip6_nxt;
976 		len = sizeof(struct ip6_hdr);
977 		while (len < off) {
978 			ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + len);
979 
980 			switch(nxt) {
981 			case IPPROTO_FRAGMENT:
982 				len += sizeof(struct ip6_frag);
983 				break;
984 			case IPPROTO_AH:
985 				len += (ip6e->ip6e_len + 2) << 2;
986 				break;
987 			default:
988 				len += (ip6e->ip6e_len + 1) << 3;
989 				break;
990 			}
991 			nxt = ip6e->ip6e_nxt;
992 		}
993 		if (ip6e)
994 			return(&ip6e->ip6e_nxt);
995 		else
996 			return NULL;
997 	}
998 }
999 
1000 /*
1001  * System control for IP6
1002  */
1003 
1004 u_char	inet6ctlerrmap[PRC_NCMDS] = {
1005 	0,		0,		0,		0,
1006 	0,		EMSGSIZE,	EHOSTDOWN,	EHOSTUNREACH,
1007 	EHOSTUNREACH,	EHOSTUNREACH,	ECONNREFUSED,	ECONNREFUSED,
1008 	EMSGSIZE,	EHOSTUNREACH,	0,		0,
1009 	0,		0,		0,		0,
1010 	ENOPROTOOPT
1011 };
1012