1 /* $NetBSD: ip6_input.c,v 1.228 2024/06/29 13:00:44 riastradh Exp $ */
2 /* $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $ */
3
4 /*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 /*
34 * Copyright (c) 1982, 1986, 1988, 1993
35 * The Regents of the University of California. All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. Neither the name of the University nor the names of its contributors
46 * may be used to endorse or promote products derived from this software
47 * without specific prior written permission.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59 * SUCH DAMAGE.
60 *
61 * @(#)ip_input.c 8.2 (Berkeley) 1/4/94
62 */
63
64 #include <sys/cdefs.h>
65 __KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.228 2024/06/29 13:00:44 riastradh Exp $");
66
67 #ifdef _KERNEL_OPT
68 #include "opt_gateway.h"
69 #include "opt_inet.h"
70 #include "opt_inet6.h"
71 #include "opt_ipsec.h"
72 #include "opt_net_mpsafe.h"
73 #endif
74
75 #include <sys/param.h>
76 #include <sys/systm.h>
77 #include <sys/mbuf.h>
78 #include <sys/domain.h>
79 #include <sys/protosw.h>
80 #include <sys/socket.h>
81 #include <sys/socketvar.h>
82 #include <sys/errno.h>
83 #include <sys/time.h>
84 #include <sys/kernel.h>
85 #include <sys/syslog.h>
86 #include <sys/proc.h>
87 #include <sys/sysctl.h>
88 #include <sys/cprng.h>
89 #include <sys/percpu.h>
90
91 #include <net/if.h>
92 #include <net/if_types.h>
93 #include <net/if_dl.h>
94 #include <net/route.h>
95 #include <net/pktqueue.h>
96 #include <net/pfil.h>
97
98 #include <netinet/in.h>
99 #include <netinet/in_systm.h>
100 #ifdef INET
101 #include <netinet/ip.h>
102 #include <netinet/ip_var.h>
103 #include <netinet/ip_icmp.h>
104 #endif /* INET */
105 #include <netinet/ip6.h>
106 #include <netinet/portalgo.h>
107 #include <netinet6/in6_var.h>
108 #include <netinet6/ip6_var.h>
109 #include <netinet6/ip6_private.h>
110 #include <netinet6/in6_pcb.h>
111 #include <netinet/icmp6.h>
112 #include <netinet6/scope6_var.h>
113 #include <netinet6/in6_ifattach.h>
114 #include <netinet6/nd6.h>
115
116 #ifdef IPSEC
117 #include <netipsec/ipsec.h>
118 #include <netipsec/ipsec6.h>
119 #include <netipsec/key.h>
120 #endif /* IPSEC */
121
122 #include <netinet6/ip6protosw.h>
123
124 #include "faith.h"
125
126 extern struct domain inet6domain;
127
128 u_char ip6_protox[IPPROTO_MAX];
129 pktqueue_t *ip6_pktq __read_mostly;
130
131 pfil_head_t *inet6_pfil_hook;
132
133 percpu_t *ip6stat_percpu;
134
135 percpu_t *ip6_forward_rt_percpu __cacheline_aligned;
136
137 static void ip6intr(void *);
138 static void ip6_input(struct mbuf *, struct ifnet *);
139 static bool ip6_badaddr(struct ip6_hdr *);
140 static struct m_tag *ip6_setdstifaddr(struct mbuf *, const struct in6_ifaddr *);
141
142 static struct m_tag *ip6_addaux(struct mbuf *);
143 static struct m_tag *ip6_findaux(struct mbuf *);
144 static void ip6_delaux(struct mbuf *);
145
146 static int ip6_process_hopopts(struct mbuf *, u_int8_t *, int, u_int32_t *,
147 u_int32_t *);
148 static struct mbuf *ip6_pullexthdr(struct mbuf *, size_t, int);
149 static void sysctl_net_inet6_ip6_setup(struct sysctllog **);
150
151 #ifdef NET_MPSAFE
152 #define SOFTNET_LOCK() mutex_enter(softnet_lock)
153 #define SOFTNET_UNLOCK() mutex_exit(softnet_lock)
154 #else
155 #define SOFTNET_LOCK() KASSERT(mutex_owned(softnet_lock))
156 #define SOFTNET_UNLOCK() KASSERT(mutex_owned(softnet_lock))
157 #endif
158
159 /* Ensure that non packed structures are the desired size. */
160 __CTASSERT(sizeof(struct ip6_hdr) == 40);
161 __CTASSERT(sizeof(struct ip6_ext) == 2);
162 __CTASSERT(sizeof(struct ip6_hbh) == 2);
163 __CTASSERT(sizeof(struct ip6_dest) == 2);
164 __CTASSERT(sizeof(struct ip6_opt) == 2);
165 __CTASSERT(sizeof(struct ip6_opt_jumbo) == 6);
166 __CTASSERT(sizeof(struct ip6_opt_nsap) == 4);
167 __CTASSERT(sizeof(struct ip6_opt_tunnel) == 3);
168 __CTASSERT(sizeof(struct ip6_opt_router) == 4);
169 __CTASSERT(sizeof(struct ip6_rthdr) == 4);
170 __CTASSERT(sizeof(struct ip6_rthdr0) == 8);
171 __CTASSERT(sizeof(struct ip6_frag) == 8);
172
173 /*
174 * IP6 initialization: fill in IP6 protocol switch table.
175 * All protocols not implemented in kernel go to raw IP6 protocol handler.
176 */
177 void
ip6_init(void)178 ip6_init(void)
179 {
180 const struct ip6protosw *pr;
181 int i;
182
183 in6_init();
184
185 ip6_pktq = pktq_create(IFQ_MAXLEN, ip6intr, NULL);
186 KASSERT(ip6_pktq != NULL);
187
188 sysctl_net_inet6_ip6_setup(NULL);
189 pr = (const struct ip6protosw *)pffindproto(PF_INET6, IPPROTO_RAW, SOCK_RAW);
190 if (pr == 0)
191 panic("ip6_init");
192 for (i = 0; i < IPPROTO_MAX; i++)
193 ip6_protox[i] = pr - inet6sw;
194 for (pr = (const struct ip6protosw *)inet6domain.dom_protosw;
195 pr < (const struct ip6protosw *)inet6domain.dom_protoswNPROTOSW; pr++)
196 if (pr->pr_domain->dom_family == PF_INET6 &&
197 pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW)
198 ip6_protox[pr->pr_protocol] = pr - inet6sw;
199
200 scope6_init();
201 addrsel_policy_init();
202 nd6_init();
203 frag6_init();
204
205 #ifdef GATEWAY
206 ip6flow_init(ip6_hashsize);
207 #endif
208 /* Register our Packet Filter hook. */
209 inet6_pfil_hook = pfil_head_create(PFIL_TYPE_AF, (void *)AF_INET6);
210 KASSERT(inet6_pfil_hook != NULL);
211
212 ip6stat_percpu = percpu_alloc(sizeof(uint64_t) * IP6_NSTATS);
213 ip6_forward_rt_percpu = rtcache_percpu_alloc();
214 }
215
216 /*
217 * IP6 input interrupt handling. Just pass the packet to ip6_input.
218 */
219 static void
ip6intr(void * arg __unused)220 ip6intr(void *arg __unused)
221 {
222 struct mbuf *m;
223
224 SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
225 while ((m = pktq_dequeue(ip6_pktq)) != NULL) {
226 struct psref psref;
227 struct ifnet *rcvif = m_get_rcvif_psref(m, &psref);
228
229 if (rcvif == NULL) {
230 IP6_STATINC(IP6_STAT_IFDROP);
231 m_freem(m);
232 continue;
233 }
234 /*
235 * Drop the packet if IPv6 is disabled on the interface.
236 */
237 if ((ND_IFINFO(rcvif)->flags & ND6_IFF_IFDISABLED)) {
238 m_put_rcvif_psref(rcvif, &psref);
239 IP6_STATINC(IP6_STAT_IFDROP);
240 m_freem(m);
241 continue;
242 }
243 ip6_input(m, rcvif);
244 m_put_rcvif_psref(rcvif, &psref);
245 }
246 SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
247 }
248
249 static void
ip6_input(struct mbuf * m,struct ifnet * rcvif)250 ip6_input(struct mbuf *m, struct ifnet *rcvif)
251 {
252 struct ip6_hdr *ip6;
253 int hit, off = sizeof(struct ip6_hdr), nest;
254 u_int32_t plen;
255 u_int32_t rtalert = ~0;
256 int nxt, ours = 0, rh_present = 0, frg_present;
257 struct ifnet *deliverifp = NULL;
258 int srcrt = 0;
259 struct rtentry *rt = NULL;
260 union {
261 struct sockaddr dst;
262 struct sockaddr_in6 dst6;
263 } u;
264 struct route *ro;
265
266 KASSERT(rcvif != NULL);
267
268 /*
269 * make sure we don't have onion peering information into m_tag.
270 */
271 ip6_delaux(m);
272
273 /*
274 * mbuf statistics
275 */
276 if (m->m_flags & M_EXT) {
277 if (m->m_next)
278 IP6_STATINC(IP6_STAT_MEXT2M);
279 else
280 IP6_STATINC(IP6_STAT_MEXT1);
281 } else {
282 #define M2MMAX 32
283 if (m->m_next) {
284 if (m->m_flags & M_LOOP)
285 /*XXX*/ IP6_STATINC(IP6_STAT_M2M + lo0ifp->if_index);
286 else if (rcvif->if_index < M2MMAX)
287 IP6_STATINC(IP6_STAT_M2M + rcvif->if_index);
288 else
289 IP6_STATINC(IP6_STAT_M2M);
290 } else
291 IP6_STATINC(IP6_STAT_M1);
292 #undef M2MMAX
293 }
294
295 in6_ifstat_inc(rcvif, ifs6_in_receive);
296 IP6_STATINC(IP6_STAT_TOTAL);
297
298 /*
299 * If the IPv6 header is not aligned, slurp it up into a new
300 * mbuf with space for link headers, in the event we forward
301 * it. Otherwise, if it is aligned, make sure the entire base
302 * IPv6 header is in the first mbuf of the chain.
303 */
304 if (M_GET_ALIGNED_HDR(&m, struct ip6_hdr, true) != 0) {
305 /* XXXJRT new stat, please */
306 IP6_STATINC(IP6_STAT_TOOSMALL);
307 in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
308 return;
309 }
310
311 ip6 = mtod(m, struct ip6_hdr *);
312
313 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
314 IP6_STATINC(IP6_STAT_BADVERS);
315 in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
316 goto bad;
317 }
318
319 if (ip6_badaddr(ip6)) {
320 IP6_STATINC(IP6_STAT_BADSCOPE);
321 in6_ifstat_inc(rcvif, ifs6_in_addrerr);
322 goto bad;
323 }
324
325 /*
326 * Assume that we can create a fast-forward IP flow entry
327 * based on this packet.
328 */
329 m->m_flags |= M_CANFASTFWD;
330
331 /*
332 * Run through list of hooks for input packets. If there are any
333 * filters which require that additional packets in the flow are
334 * not fast-forwarded, they must clear the M_CANFASTFWD flag.
335 * Note that filters must _never_ set this flag, as another filter
336 * in the list may have previously cleared it.
337 *
338 * Don't call hooks if the packet has already been processed by
339 * IPsec (encapsulated, tunnel mode).
340 */
341 #if defined(IPSEC)
342 if (!ipsec_used || !ipsec_skip_pfil(m))
343 #else
344 if (1)
345 #endif
346 {
347 struct in6_addr odst;
348 int error;
349
350 odst = ip6->ip6_dst;
351 error = pfil_run_hooks(inet6_pfil_hook, &m, rcvif, PFIL_IN);
352 if (error != 0 || m == NULL) {
353 IP6_STATINC(IP6_STAT_PFILDROP_IN);
354 return;
355 }
356 if (m->m_len < sizeof(struct ip6_hdr)) {
357 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
358 IP6_STATINC(IP6_STAT_TOOSMALL);
359 in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
360 return;
361 }
362 }
363 ip6 = mtod(m, struct ip6_hdr *);
364 srcrt = !IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst);
365 }
366
367 IP6_STATINC(IP6_STAT_NXTHIST + ip6->ip6_nxt);
368
369 #ifdef ALTQ
370 if (altq_input != NULL) {
371 SOFTNET_LOCK();
372 if ((*altq_input)(m, AF_INET6) == 0) {
373 SOFTNET_UNLOCK();
374 /* packet is dropped by traffic conditioner */
375 return;
376 }
377 SOFTNET_UNLOCK();
378 }
379 #endif
380
381 /*
382 * Disambiguate address scope zones (if there is ambiguity).
383 * We first make sure that the original source or destination address
384 * is not in our internal form for scoped addresses. Such addresses
385 * are not necessarily invalid spec-wise, but we cannot accept them due
386 * to the usage conflict.
387 * in6_setscope() then also checks and rejects the cases where src or
388 * dst are the loopback address and the receiving interface
389 * is not loopback.
390 */
391 if (__predict_false(
392 m_makewritable(&m, 0, sizeof(struct ip6_hdr), M_DONTWAIT))) {
393 IP6_STATINC(IP6_STAT_IDROPPED);
394 goto bad;
395 }
396 ip6 = mtod(m, struct ip6_hdr *);
397 if (in6_clearscope(&ip6->ip6_src) || in6_clearscope(&ip6->ip6_dst)) {
398 IP6_STATINC(IP6_STAT_BADSCOPE); /* XXX */
399 goto bad;
400 }
401 if (in6_setscope(&ip6->ip6_src, rcvif, NULL) ||
402 in6_setscope(&ip6->ip6_dst, rcvif, NULL)) {
403 IP6_STATINC(IP6_STAT_BADSCOPE);
404 goto bad;
405 }
406
407 ro = rtcache_percpu_getref(ip6_forward_rt_percpu);
408
409 /*
410 * Multicast check
411 */
412 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
413 bool ingroup;
414
415 in6_ifstat_inc(rcvif, ifs6_in_mcast);
416 /*
417 * See if we belong to the destination multicast group on the
418 * arrival interface.
419 */
420 ingroup = in6_multi_group(&ip6->ip6_dst, rcvif);
421 if (ingroup) {
422 ours = 1;
423 } else if (!ip6_mrouter) {
424 net_stat_ref_t ip6s = IP6_STAT_GETREF();
425 _NET_STATINC_REF(ip6s, IP6_STAT_NOTMEMBER);
426 _NET_STATINC_REF(ip6s, IP6_STAT_CANTFORWARD);
427 IP6_STAT_PUTREF();
428 in6_ifstat_inc(rcvif, ifs6_in_discard);
429 goto bad_unref;
430 }
431 deliverifp = rcvif;
432 goto hbhcheck;
433 }
434
435 sockaddr_in6_init(&u.dst6, &ip6->ip6_dst, 0, 0, 0);
436
437 /*
438 * Unicast check
439 */
440 rt = rtcache_lookup2(ro, &u.dst, 1, &hit);
441 if (hit)
442 IP6_STATINC(IP6_STAT_FORWARD_CACHEHIT);
443 else
444 IP6_STATINC(IP6_STAT_FORWARD_CACHEMISS);
445
446 /*
447 * Accept the packet if the forwarding interface to the destination
448 * (according to the routing table) is the loopback interface,
449 * unless the associated route has a gateway.
450 *
451 * We don't explicitly match ip6_dst against an interface here. It
452 * is already done in rtcache_lookup2: rt->rt_ifp->if_type will be
453 * IFT_LOOP if the packet is for us.
454 *
455 * Note that this approach causes to accept a packet if there is a
456 * route to the loopback interface for the destination of the packet.
457 * But we think it's even useful in some situations, e.g. when using
458 * a special daemon which wants to intercept the packet.
459 */
460 if (rt != NULL &&
461 (rt->rt_flags & (RTF_HOST|RTF_GATEWAY)) == RTF_HOST &&
462 rt->rt_ifp->if_type == IFT_LOOP) {
463 struct in6_ifaddr *ia6 = (struct in6_ifaddr *)rt->rt_ifa;
464 int addrok;
465
466 if (ia6->ia6_flags & IN6_IFF_ANYCAST)
467 m->m_flags |= M_ANYCAST6;
468 /*
469 * packets to a tentative, duplicated, or somehow invalid
470 * address must not be accepted.
471 */
472 if (ia6->ia6_flags & IN6_IFF_NOTREADY)
473 addrok = 0;
474 else if (ia6->ia6_flags & IN6_IFF_DETACHED &&
475 !IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src))
476 {
477 /* Allow internal traffic to DETACHED addresses */
478 struct sockaddr_in6 sin6;
479 int s;
480
481 memset(&sin6, 0, sizeof(sin6));
482 sin6.sin6_family = AF_INET6;
483 sin6.sin6_len = sizeof(sin6);
484 sin6.sin6_addr = ip6->ip6_src;
485 s = pserialize_read_enter();
486 addrok = (ifa_ifwithaddr(sin6tosa(&sin6)) != NULL);
487 pserialize_read_exit(s);
488 } else
489 addrok = 1;
490 if (addrok) {
491 /* this address is ready */
492 ours = 1;
493 deliverifp = ia6->ia_ifp; /* correct? */
494 goto hbhcheck;
495 } else {
496 /* address is not ready, so discard the packet. */
497 char ip6bufs[INET6_ADDRSTRLEN];
498 char ip6bufd[INET6_ADDRSTRLEN];
499 nd6log(LOG_INFO, "packet to an unready address %s->%s\n",
500 IN6_PRINT(ip6bufs, &ip6->ip6_src),
501 IN6_PRINT(ip6bufd, &ip6->ip6_dst));
502
503 IP6_STATINC(IP6_STAT_IDROPPED);
504 goto bad_unref;
505 }
506 }
507
508 /*
509 * FAITH (Firewall Aided Internet Translator)
510 */
511 #if defined(NFAITH) && 0 < NFAITH
512 if (ip6_keepfaith) {
513 if (rt != NULL && rt->rt_ifp != NULL &&
514 rt->rt_ifp->if_type == IFT_FAITH) {
515 /* XXX do we need more sanity checks? */
516 ours = 1;
517 deliverifp = rt->rt_ifp; /* faith */
518 goto hbhcheck;
519 }
520 }
521 #endif
522
523 /*
524 * Now there is no reason to process the packet if it's not our own
525 * and we're not a router.
526 */
527 if (!ip6_forwarding) {
528 IP6_STATINC(IP6_STAT_CANTFORWARD);
529 in6_ifstat_inc(rcvif, ifs6_in_discard);
530 goto bad_unref;
531 }
532
533 hbhcheck:
534 /*
535 * Record address information into m_tag, if we don't have one yet.
536 * Note that we are unable to record it, if the address is not listed
537 * as our interface address (e.g. multicast addresses, addresses
538 * within FAITH prefixes and such).
539 */
540 if (deliverifp && ip6_getdstifaddr(m) == NULL) {
541 struct in6_ifaddr *ia6;
542 int s = pserialize_read_enter();
543
544 ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
545 /* Depends on ip6_setdstifaddr never sleep */
546 if (ia6 != NULL && ip6_setdstifaddr(m, ia6) == NULL) {
547 /*
548 * XXX maybe we should drop the packet here,
549 * as we could not provide enough information
550 * to the upper layers.
551 */
552 }
553 pserialize_read_exit(s);
554 }
555
556 /*
557 * Process Hop-by-Hop options header if it's contained.
558 * m may be modified in ip6_hopopts_input().
559 * If a JumboPayload option is included, plen will also be modified.
560 */
561 plen = (u_int32_t)ntohs(ip6->ip6_plen);
562 if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
563 struct ip6_hbh *hbh;
564
565 if (ip6_hopopts_input(&plen, &rtalert, &m, &off)) {
566 /* m already freed */
567 in6_ifstat_inc(rcvif, ifs6_in_discard);
568 rtcache_unref(rt, ro);
569 rtcache_percpu_putref(ip6_forward_rt_percpu);
570 return;
571 }
572
573 /* adjust pointer */
574 ip6 = mtod(m, struct ip6_hdr *);
575
576 /*
577 * if the payload length field is 0 and the next header field
578 * indicates Hop-by-Hop Options header, then a Jumbo Payload
579 * option MUST be included.
580 */
581 if (ip6->ip6_plen == 0 && plen == 0) {
582 /*
583 * Note that if a valid jumbo payload option is
584 * contained, ip6_hopopts_input() must set a valid
585 * (non-zero) payload length to the variable plen.
586 */
587 IP6_STATINC(IP6_STAT_BADOPTIONS);
588 in6_ifstat_inc(rcvif, ifs6_in_discard);
589 in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
590 icmp6_error(m, ICMP6_PARAM_PROB,
591 ICMP6_PARAMPROB_HEADER,
592 (char *)&ip6->ip6_plen - (char *)ip6);
593 rtcache_unref(rt, ro);
594 rtcache_percpu_putref(ip6_forward_rt_percpu);
595 return;
596 }
597 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
598 sizeof(struct ip6_hbh));
599 if (hbh == NULL) {
600 IP6_STATINC(IP6_STAT_TOOSHORT);
601 rtcache_unref(rt, ro);
602 rtcache_percpu_putref(ip6_forward_rt_percpu);
603 return;
604 }
605 KASSERT(ACCESSIBLE_POINTER(hbh, struct ip6_hdr));
606 nxt = hbh->ip6h_nxt;
607
608 /*
609 * accept the packet if a router alert option is included
610 * and we act as an IPv6 router.
611 */
612 if (rtalert != ~0 && ip6_forwarding)
613 ours = 1;
614 } else
615 nxt = ip6->ip6_nxt;
616
617 /*
618 * Check that the amount of data in the buffers is at least much as
619 * the IPv6 header would have us expect. Trim mbufs if longer than we
620 * expect. Drop packet if shorter than we expect.
621 */
622 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
623 IP6_STATINC(IP6_STAT_TOOSHORT);
624 in6_ifstat_inc(rcvif, ifs6_in_truncated);
625 goto bad_unref;
626 }
627 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
628 if (m->m_len == m->m_pkthdr.len) {
629 m->m_len = sizeof(struct ip6_hdr) + plen;
630 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
631 } else
632 m_adj(m, sizeof(struct ip6_hdr) + plen - m->m_pkthdr.len);
633 }
634
635 /*
636 * Forward if desirable.
637 */
638 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
639 /*
640 * If we are acting as a multicast router, all
641 * incoming multicast packets are passed to the
642 * kernel-level multicast forwarding function.
643 * The packet is returned (relatively) intact; if
644 * ip6_mforward() returns a non-zero value, the packet
645 * must be discarded, else it may be accepted below.
646 */
647 if (ip6_mrouter != NULL) {
648 int error;
649
650 SOFTNET_LOCK();
651 error = ip6_mforward(ip6, rcvif, m);
652 SOFTNET_UNLOCK();
653
654 if (error != 0) {
655 rtcache_unref(rt, ro);
656 rtcache_percpu_putref(ip6_forward_rt_percpu);
657 IP6_STATINC(IP6_STAT_CANTFORWARD);
658 goto bad;
659 }
660 }
661 if (!ours) {
662 IP6_STATINC(IP6_STAT_CANTFORWARD);
663 goto bad_unref;
664 }
665 } else if (!ours) {
666 rtcache_unref(rt, ro);
667 rtcache_percpu_putref(ip6_forward_rt_percpu);
668 ip6_forward(m, srcrt, rcvif);
669 return;
670 }
671
672 ip6 = mtod(m, struct ip6_hdr *);
673
674 /*
675 * Malicious party may be able to use IPv4 mapped addr to confuse
676 * tcp/udp stack and bypass security checks (act as if it was from
677 * 127.0.0.1 by using IPv6 src ::ffff:127.0.0.1). Be cautious.
678 *
679 * For SIIT end node behavior, you may want to disable the check.
680 * However, you will become vulnerable to attacks using IPv4 mapped
681 * source.
682 */
683 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
684 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
685 IP6_STATINC(IP6_STAT_BADSCOPE);
686 in6_ifstat_inc(rcvif, ifs6_in_addrerr);
687 goto bad_unref;
688 }
689
690 #ifdef IFA_STATS
691 if (deliverifp != NULL) {
692 struct in6_ifaddr *ia6;
693 int s = pserialize_read_enter();
694 ia6 = in6_ifawithifp(deliverifp, &ip6->ip6_dst);
695 if (ia6)
696 ia6->ia_ifa.ifa_data.ifad_inbytes += m->m_pkthdr.len;
697 pserialize_read_exit(s);
698 }
699 #endif
700 IP6_STATINC(IP6_STAT_DELIVERED);
701 in6_ifstat_inc(deliverifp, ifs6_in_deliver);
702 nest = 0;
703
704 if (rt != NULL) {
705 rtcache_unref(rt, ro);
706 rt = NULL;
707 }
708 rtcache_percpu_putref(ip6_forward_rt_percpu);
709
710 rh_present = 0;
711 frg_present = 0;
712 while (nxt != IPPROTO_DONE) {
713 if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
714 IP6_STATINC(IP6_STAT_TOOMANYHDR);
715 in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
716 goto bad;
717 }
718
719 M_VERIFY_PACKET(m);
720
721 /*
722 * protection against faulty packet - there should be
723 * more sanity checks in header chain processing.
724 */
725 if (m->m_pkthdr.len < off) {
726 IP6_STATINC(IP6_STAT_TOOSHORT);
727 in6_ifstat_inc(rcvif, ifs6_in_truncated);
728 goto bad;
729 }
730
731 if (nxt == IPPROTO_ROUTING) {
732 if (rh_present++) {
733 in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
734 IP6_STATINC(IP6_STAT_BADOPTIONS);
735 goto bad;
736 }
737 } else if (nxt == IPPROTO_FRAGMENT) {
738 if (frg_present++) {
739 in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
740 IP6_STATINC(IP6_STAT_BADOPTIONS);
741 goto bad;
742 }
743 }
744
745 #ifdef IPSEC
746 if (ipsec_used) {
747 /*
748 * Enforce IPsec policy checking if we are seeing last
749 * header. Note that we do not visit this with
750 * protocols with pcb layer code - like udp/tcp/raw ip.
751 */
752 if ((inet6sw[ip6_protox[nxt]].pr_flags
753 & PR_LASTHDR) != 0) {
754 int error;
755
756 error = ipsec_ip_input_checkpolicy(m, false);
757 if (error) {
758 IP6_STATINC(IP6_STAT_IPSECDROP_IN);
759 goto bad;
760 }
761 }
762 }
763 #endif
764
765 nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt);
766 }
767 return;
768
769 bad_unref:
770 rtcache_unref(rt, ro);
771 rtcache_percpu_putref(ip6_forward_rt_percpu);
772 bad:
773 m_freem(m);
774 return;
775 }
776
777 static bool
ip6_badaddr(struct ip6_hdr * ip6)778 ip6_badaddr(struct ip6_hdr *ip6)
779 {
780 /* Check against address spoofing/corruption. */
781 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) ||
782 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) {
783 return true;
784 }
785
786 /*
787 * The following check is not documented in specs. A malicious
788 * party may be able to use IPv4 mapped addr to confuse tcp/udp stack
789 * and bypass security checks (act as if it was from 127.0.0.1 by using
790 * IPv6 src ::ffff:127.0.0.1). Be cautious.
791 *
792 * This check chokes if we are in an SIIT cloud. As none of BSDs
793 * support IPv4-less kernel compilation, we cannot support SIIT
794 * environment at all. So, it makes more sense for us to reject any
795 * malicious packets for non-SIIT environment, than try to do a
796 * partial support for SIIT environment.
797 */
798 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
799 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
800 return true;
801 }
802
803 /*
804 * Reject packets with IPv4-compatible IPv6 addresses (RFC4291).
805 */
806 if (IN6_IS_ADDR_V4COMPAT(&ip6->ip6_src) ||
807 IN6_IS_ADDR_V4COMPAT(&ip6->ip6_dst)) {
808 return true;
809 }
810
811 return false;
812 }
813
814 /*
815 * set/grab in6_ifaddr correspond to IPv6 destination address.
816 */
817 static struct m_tag *
ip6_setdstifaddr(struct mbuf * m,const struct in6_ifaddr * ia)818 ip6_setdstifaddr(struct mbuf *m, const struct in6_ifaddr *ia)
819 {
820 struct m_tag *mtag;
821 struct ip6aux *ip6a;
822
823 mtag = ip6_addaux(m);
824 if (mtag == NULL)
825 return NULL;
826
827 ip6a = (struct ip6aux *)(mtag + 1);
828 if (in6_setscope(&ip6a->ip6a_src, ia->ia_ifp, &ip6a->ip6a_scope_id)) {
829 IP6_STATINC(IP6_STAT_BADSCOPE);
830 return NULL;
831 }
832
833 ip6a->ip6a_src = ia->ia_addr.sin6_addr;
834 ip6a->ip6a_flags = ia->ia6_flags;
835 return mtag;
836 }
837
838 const struct ip6aux *
ip6_getdstifaddr(struct mbuf * m)839 ip6_getdstifaddr(struct mbuf *m)
840 {
841 struct m_tag *mtag;
842
843 mtag = ip6_findaux(m);
844 if (mtag != NULL)
845 return (struct ip6aux *)(mtag + 1);
846 else
847 return NULL;
848 }
849
850 /*
851 * Hop-by-Hop options header processing. If a valid jumbo payload option is
852 * included, the real payload length will be stored in plenp.
853 *
854 * rtalertp - XXX: should be stored more smart way
855 */
856 int
ip6_hopopts_input(u_int32_t * plenp,u_int32_t * rtalertp,struct mbuf ** mp,int * offp)857 ip6_hopopts_input(u_int32_t *plenp, u_int32_t *rtalertp,
858 struct mbuf **mp, int *offp)
859 {
860 struct mbuf *m = *mp;
861 int off = *offp, hbhlen;
862 struct ip6_hbh *hbh;
863
864 /* validation of the length of the header */
865 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m,
866 sizeof(struct ip6_hdr), sizeof(struct ip6_hbh));
867 if (hbh == NULL) {
868 IP6_STATINC(IP6_STAT_TOOSHORT);
869 return -1;
870 }
871 hbhlen = (hbh->ip6h_len + 1) << 3;
872 IP6_EXTHDR_GET(hbh, struct ip6_hbh *, m, sizeof(struct ip6_hdr),
873 hbhlen);
874 if (hbh == NULL) {
875 IP6_STATINC(IP6_STAT_TOOSHORT);
876 return -1;
877 }
878 KASSERT(ACCESSIBLE_POINTER(hbh, struct ip6_hdr));
879 off += hbhlen;
880 hbhlen -= sizeof(struct ip6_hbh);
881
882 if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
883 hbhlen, rtalertp, plenp) < 0)
884 return -1;
885
886 *offp = off;
887 *mp = m;
888 return 0;
889 }
890
891 /*
892 * Search header for all Hop-by-hop options and process each option.
893 * This function is separate from ip6_hopopts_input() in order to
894 * handle a case where the sending node itself process its hop-by-hop
895 * options header. In such a case, the function is called from ip6_output().
896 *
897 * The function assumes that hbh header is located right after the IPv6 header
898 * (RFC2460 p7), opthead is pointer into data content in m, and opthead to
899 * opthead + hbhlen is located in continuous memory region.
900 */
901 static int
ip6_process_hopopts(struct mbuf * m,u_int8_t * opthead,int hbhlen,u_int32_t * rtalertp,u_int32_t * plenp)902 ip6_process_hopopts(struct mbuf *m, u_int8_t *opthead, int hbhlen,
903 u_int32_t *rtalertp, u_int32_t *plenp)
904 {
905 struct ip6_hdr *ip6;
906 int optlen = 0;
907 u_int8_t *opt = opthead;
908 u_int16_t rtalert_val;
909 u_int32_t jumboplen;
910 const int erroff = sizeof(struct ip6_hdr) + sizeof(struct ip6_hbh);
911
912 for (; hbhlen > 0; hbhlen -= optlen, opt += optlen) {
913 switch (*opt) {
914 case IP6OPT_PAD1:
915 optlen = 1;
916 break;
917 case IP6OPT_PADN:
918 if (hbhlen < IP6OPT_MINLEN) {
919 IP6_STATINC(IP6_STAT_TOOSMALL);
920 goto bad;
921 }
922 optlen = *(opt + 1) + 2;
923 break;
924 case IP6OPT_RTALERT:
925 /* XXX may need check for alignment */
926 if (hbhlen < IP6OPT_RTALERT_LEN) {
927 IP6_STATINC(IP6_STAT_TOOSMALL);
928 goto bad;
929 }
930 if (*(opt + 1) != IP6OPT_RTALERT_LEN - 2) {
931 IP6_STATINC(IP6_STAT_BADOPTIONS);
932 icmp6_error(m, ICMP6_PARAM_PROB,
933 ICMP6_PARAMPROB_HEADER,
934 erroff + opt + 1 - opthead);
935 return (-1);
936 }
937 optlen = IP6OPT_RTALERT_LEN;
938 memcpy((void *)&rtalert_val, (void *)(opt + 2), 2);
939 *rtalertp = ntohs(rtalert_val);
940 break;
941 case IP6OPT_JUMBO:
942 /* XXX may need check for alignment */
943 if (hbhlen < IP6OPT_JUMBO_LEN) {
944 IP6_STATINC(IP6_STAT_TOOSMALL);
945 goto bad;
946 }
947 if (*(opt + 1) != IP6OPT_JUMBO_LEN - 2) {
948 IP6_STATINC(IP6_STAT_BADOPTIONS);
949 icmp6_error(m, ICMP6_PARAM_PROB,
950 ICMP6_PARAMPROB_HEADER,
951 erroff + opt + 1 - opthead);
952 return (-1);
953 }
954 optlen = IP6OPT_JUMBO_LEN;
955
956 /*
957 * IPv6 packets that have non 0 payload length
958 * must not contain a jumbo payload option.
959 */
960 ip6 = mtod(m, struct ip6_hdr *);
961 if (ip6->ip6_plen) {
962 IP6_STATINC(IP6_STAT_BADOPTIONS);
963 icmp6_error(m, ICMP6_PARAM_PROB,
964 ICMP6_PARAMPROB_HEADER,
965 erroff + opt - opthead);
966 return (-1);
967 }
968
969 /*
970 * We may see jumbolen in unaligned location, so
971 * we'd need to perform memcpy().
972 */
973 memcpy(&jumboplen, opt + 2, sizeof(jumboplen));
974 jumboplen = (u_int32_t)htonl(jumboplen);
975
976 #if 1
977 /*
978 * if there are multiple jumbo payload options,
979 * *plenp will be non-zero and the packet will be
980 * rejected.
981 * the behavior may need some debate in ipngwg -
982 * multiple options does not make sense, however,
983 * there's no explicit mention in specification.
984 */
985 if (*plenp != 0) {
986 IP6_STATINC(IP6_STAT_BADOPTIONS);
987 icmp6_error(m, ICMP6_PARAM_PROB,
988 ICMP6_PARAMPROB_HEADER,
989 erroff + opt + 2 - opthead);
990 return (-1);
991 }
992 #endif
993
994 /*
995 * jumbo payload length must be larger than 65535.
996 */
997 if (jumboplen <= IPV6_MAXPACKET) {
998 IP6_STATINC(IP6_STAT_BADOPTIONS);
999 icmp6_error(m, ICMP6_PARAM_PROB,
1000 ICMP6_PARAMPROB_HEADER,
1001 erroff + opt + 2 - opthead);
1002 return (-1);
1003 }
1004 *plenp = jumboplen;
1005
1006 break;
1007 default: /* unknown option */
1008 if (hbhlen < IP6OPT_MINLEN) {
1009 IP6_STATINC(IP6_STAT_TOOSMALL);
1010 goto bad;
1011 }
1012 optlen = ip6_unknown_opt(opt, m,
1013 erroff + opt - opthead);
1014 if (optlen == -1)
1015 return (-1);
1016 optlen += 2;
1017 break;
1018 }
1019 }
1020
1021 return (0);
1022
1023 bad:
1024 m_freem(m);
1025 return (-1);
1026 }
1027
1028 /*
1029 * Unknown option processing.
1030 * The third argument `off' is the offset from the IPv6 header to the option,
1031 * which is necessary if the IPv6 header the and option header and IPv6 header
1032 * is not continuous in order to return an ICMPv6 error.
1033 */
1034 int
ip6_unknown_opt(u_int8_t * optp,struct mbuf * m,int off)1035 ip6_unknown_opt(u_int8_t *optp, struct mbuf *m, int off)
1036 {
1037 struct ip6_hdr *ip6;
1038
1039 switch (IP6OPT_TYPE(*optp)) {
1040 case IP6OPT_TYPE_SKIP: /* ignore the option */
1041 return ((int)*(optp + 1));
1042 case IP6OPT_TYPE_DISCARD: /* silently discard */
1043 m_freem(m);
1044 return (-1);
1045 case IP6OPT_TYPE_FORCEICMP: /* send ICMP even if multicasted */
1046 IP6_STATINC(IP6_STAT_BADOPTIONS);
1047 icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_OPTION, off);
1048 return (-1);
1049 case IP6OPT_TYPE_ICMP: /* send ICMP if not multicasted */
1050 IP6_STATINC(IP6_STAT_BADOPTIONS);
1051 ip6 = mtod(m, struct ip6_hdr *);
1052 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
1053 (m->m_flags & (M_BCAST|M_MCAST)))
1054 m_freem(m);
1055 else
1056 icmp6_error(m, ICMP6_PARAM_PROB,
1057 ICMP6_PARAMPROB_OPTION, off);
1058 return (-1);
1059 }
1060
1061 m_freem(m); /* XXX: NOTREACHED */
1062 return (-1);
1063 }
1064
1065 void
ip6_savecontrol(struct inpcb * inp,struct mbuf ** mp,struct ip6_hdr * ip6,struct mbuf * m)1066 ip6_savecontrol(struct inpcb *inp, struct mbuf **mp,
1067 struct ip6_hdr *ip6, struct mbuf *m)
1068 {
1069 struct socket *so = inp->inp_socket;
1070 #ifdef RFC2292
1071 #define IS2292(x, y) ((inp->inp_flags & IN6P_RFC2292) ? (x) : (y))
1072 #else
1073 #define IS2292(x, y) (y)
1074 #endif
1075
1076 KASSERT(m->m_flags & M_PKTHDR);
1077
1078 if (SOOPT_TIMESTAMP(so->so_options))
1079 mp = sbsavetimestamp(so->so_options, mp);
1080
1081 /* some OSes call this logic with IPv4 packet, for SO_TIMESTAMP */
1082 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION)
1083 return;
1084
1085 /* RFC 2292 sec. 5 */
1086 if ((inp->inp_flags & IN6P_PKTINFO) != 0) {
1087 struct in6_pktinfo pi6;
1088
1089 memcpy(&pi6.ipi6_addr, &ip6->ip6_dst, sizeof(struct in6_addr));
1090 in6_clearscope(&pi6.ipi6_addr); /* XXX */
1091 pi6.ipi6_ifindex = m->m_pkthdr.rcvif_index;
1092 *mp = sbcreatecontrol(&pi6, sizeof(pi6),
1093 IS2292(IPV6_2292PKTINFO, IPV6_PKTINFO), IPPROTO_IPV6);
1094 if (*mp)
1095 mp = &(*mp)->m_next;
1096 }
1097
1098 if (inp->inp_flags & IN6P_HOPLIMIT) {
1099 int hlim = ip6->ip6_hlim & 0xff;
1100
1101 *mp = sbcreatecontrol(&hlim, sizeof(hlim),
1102 IS2292(IPV6_2292HOPLIMIT, IPV6_HOPLIMIT), IPPROTO_IPV6);
1103 if (*mp)
1104 mp = &(*mp)->m_next;
1105 }
1106
1107 if ((inp->inp_flags & IN6P_TCLASS) != 0) {
1108 u_int32_t flowinfo;
1109 int tclass;
1110
1111 flowinfo = (u_int32_t)ntohl(ip6->ip6_flow & IPV6_FLOWINFO_MASK);
1112 flowinfo >>= 20;
1113
1114 tclass = flowinfo & 0xff;
1115 *mp = sbcreatecontrol(&tclass, sizeof(tclass),
1116 IPV6_TCLASS, IPPROTO_IPV6);
1117
1118 if (*mp)
1119 mp = &(*mp)->m_next;
1120 }
1121
1122 /*
1123 * IPV6_HOPOPTS socket option. Recall that we required super-user
1124 * privilege for the option (see ip6_ctloutput), but it might be too
1125 * strict, since there might be some hop-by-hop options which can be
1126 * returned to normal user.
1127 * See also RFC3542 section 8 (or RFC2292 section 6).
1128 */
1129 if ((inp->inp_flags & IN6P_HOPOPTS) != 0) {
1130 /*
1131 * Check if a hop-by-hop options header is contatined in the
1132 * received packet, and if so, store the options as ancillary
1133 * data. Note that a hop-by-hop options header must be
1134 * just after the IPv6 header, which fact is assured through
1135 * the IPv6 input processing.
1136 */
1137 struct ip6_hdr *xip6 = mtod(m, struct ip6_hdr *);
1138 if (xip6->ip6_nxt == IPPROTO_HOPOPTS) {
1139 struct ip6_hbh *hbh;
1140 int hbhlen;
1141 struct mbuf *ext;
1142
1143 ext = ip6_pullexthdr(m, sizeof(struct ip6_hdr),
1144 xip6->ip6_nxt);
1145 if (ext == NULL) {
1146 IP6_STATINC(IP6_STAT_TOOSHORT);
1147 return;
1148 }
1149 hbh = mtod(ext, struct ip6_hbh *);
1150 hbhlen = (hbh->ip6h_len + 1) << 3;
1151 if (hbhlen != ext->m_len) {
1152 m_freem(ext);
1153 IP6_STATINC(IP6_STAT_TOOSHORT);
1154 return;
1155 }
1156
1157 /*
1158 * XXX: We copy whole the header even if a jumbo
1159 * payload option is included, which option is to
1160 * be removed before returning in the RFC 2292.
1161 * Note: this constraint is removed in RFC3542.
1162 */
1163 *mp = sbcreatecontrol(hbh, hbhlen,
1164 IS2292(IPV6_2292HOPOPTS, IPV6_HOPOPTS),
1165 IPPROTO_IPV6);
1166 if (*mp)
1167 mp = &(*mp)->m_next;
1168 m_freem(ext);
1169 }
1170 }
1171
1172 /* IPV6_DSTOPTS and IPV6_RTHDR socket options */
1173 if (inp->inp_flags & (IN6P_DSTOPTS | IN6P_RTHDR)) {
1174 struct ip6_hdr *xip6 = mtod(m, struct ip6_hdr *);
1175 int nxt = xip6->ip6_nxt, off = sizeof(struct ip6_hdr);
1176
1177 /*
1178 * Search for destination options headers or routing
1179 * header(s) through the header chain, and stores each
1180 * header as ancillary data.
1181 * Note that the order of the headers remains in
1182 * the chain of ancillary data.
1183 */
1184 for (;;) { /* is explicit loop prevention necessary? */
1185 struct ip6_ext *ip6e = NULL;
1186 int elen;
1187 struct mbuf *ext = NULL;
1188
1189 /*
1190 * if it is not an extension header, don't try to
1191 * pull it from the chain.
1192 */
1193 switch (nxt) {
1194 case IPPROTO_DSTOPTS:
1195 case IPPROTO_ROUTING:
1196 case IPPROTO_HOPOPTS:
1197 case IPPROTO_AH: /* is it possible? */
1198 break;
1199 default:
1200 goto loopend;
1201 }
1202
1203 ext = ip6_pullexthdr(m, off, nxt);
1204 if (ext == NULL) {
1205 IP6_STATINC(IP6_STAT_TOOSHORT);
1206 return;
1207 }
1208 ip6e = mtod(ext, struct ip6_ext *);
1209 if (nxt == IPPROTO_AH)
1210 elen = (ip6e->ip6e_len + 2) << 2;
1211 else
1212 elen = (ip6e->ip6e_len + 1) << 3;
1213 if (elen != ext->m_len) {
1214 m_freem(ext);
1215 IP6_STATINC(IP6_STAT_TOOSHORT);
1216 return;
1217 }
1218 KASSERT(ACCESSIBLE_POINTER(ip6e, struct ip6_hdr));
1219
1220 switch (nxt) {
1221 case IPPROTO_DSTOPTS:
1222 if (!(inp->inp_flags & IN6P_DSTOPTS))
1223 break;
1224
1225 *mp = sbcreatecontrol(ip6e, elen,
1226 IS2292(IPV6_2292DSTOPTS, IPV6_DSTOPTS),
1227 IPPROTO_IPV6);
1228 if (*mp)
1229 mp = &(*mp)->m_next;
1230 break;
1231
1232 case IPPROTO_ROUTING:
1233 if (!(inp->inp_flags & IN6P_RTHDR))
1234 break;
1235
1236 *mp = sbcreatecontrol(ip6e, elen,
1237 IS2292(IPV6_2292RTHDR, IPV6_RTHDR),
1238 IPPROTO_IPV6);
1239 if (*mp)
1240 mp = &(*mp)->m_next;
1241 break;
1242
1243 case IPPROTO_HOPOPTS:
1244 case IPPROTO_AH: /* is it possible? */
1245 break;
1246
1247 default:
1248 /*
1249 * other cases have been filtered in the above.
1250 * none will visit this case. here we supply
1251 * the code just in case (nxt overwritten or
1252 * other cases).
1253 */
1254 m_freem(ext);
1255 goto loopend;
1256
1257 }
1258
1259 /* proceed with the next header. */
1260 off += elen;
1261 nxt = ip6e->ip6e_nxt;
1262 ip6e = NULL;
1263 m_freem(ext);
1264 ext = NULL;
1265 }
1266 loopend:
1267 ;
1268 }
1269 }
1270 #undef IS2292
1271
1272
1273 void
ip6_notify_pmtu(struct inpcb * inp,const struct sockaddr_in6 * dst,uint32_t * mtu)1274 ip6_notify_pmtu(struct inpcb *inp, const struct sockaddr_in6 *dst,
1275 uint32_t *mtu)
1276 {
1277 struct socket *so;
1278 struct mbuf *m_mtu;
1279 struct ip6_mtuinfo mtuctl;
1280
1281 so = inp->inp_socket;
1282
1283 if (mtu == NULL)
1284 return;
1285
1286 KASSERT(so != NULL);
1287
1288 memset(&mtuctl, 0, sizeof(mtuctl)); /* zero-clear for safety */
1289 mtuctl.ip6m_mtu = *mtu;
1290 mtuctl.ip6m_addr = *dst;
1291 if (sa6_recoverscope(&mtuctl.ip6m_addr))
1292 return;
1293
1294 if ((m_mtu = sbcreatecontrol(&mtuctl, sizeof(mtuctl),
1295 IPV6_PATHMTU, IPPROTO_IPV6)) == NULL)
1296 return;
1297
1298 if (sbappendaddr(&so->so_rcv, (const struct sockaddr *)dst, NULL, m_mtu)
1299 == 0) {
1300 soroverflow(so);
1301 m_freem(m_mtu);
1302 } else
1303 sorwakeup(so);
1304
1305 return;
1306 }
1307
1308 /*
1309 * pull single extension header from mbuf chain. returns single mbuf that
1310 * contains the result, or NULL on error.
1311 */
1312 static struct mbuf *
ip6_pullexthdr(struct mbuf * m,size_t off,int nxt)1313 ip6_pullexthdr(struct mbuf *m, size_t off, int nxt)
1314 {
1315 struct ip6_ext ip6e;
1316 size_t elen;
1317 struct mbuf *n;
1318
1319 if (off + sizeof(ip6e) > m->m_pkthdr.len)
1320 return NULL;
1321
1322 m_copydata(m, off, sizeof(ip6e), (void *)&ip6e);
1323 if (nxt == IPPROTO_AH)
1324 elen = (ip6e.ip6e_len + 2) << 2;
1325 else
1326 elen = (ip6e.ip6e_len + 1) << 3;
1327
1328 if (off + elen > m->m_pkthdr.len)
1329 return NULL;
1330
1331 MGET(n, M_DONTWAIT, MT_DATA);
1332 if (n && elen >= MLEN) {
1333 MCLGET(n, M_DONTWAIT);
1334 if ((n->m_flags & M_EXT) == 0) {
1335 m_free(n);
1336 n = NULL;
1337 }
1338 }
1339 if (!n)
1340 return NULL;
1341
1342 n->m_len = 0;
1343 if (elen >= M_TRAILINGSPACE(n)) {
1344 m_free(n);
1345 return NULL;
1346 }
1347
1348 m_copydata(m, off, elen, mtod(n, void *));
1349 n->m_len = elen;
1350 return n;
1351 }
1352
1353 /*
1354 * Get offset to the previous header followed by the header
1355 * currently processed.
1356 */
1357 int
ip6_get_prevhdr(struct mbuf * m,int off)1358 ip6_get_prevhdr(struct mbuf *m, int off)
1359 {
1360 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1361
1362 if (off == sizeof(struct ip6_hdr)) {
1363 return offsetof(struct ip6_hdr, ip6_nxt);
1364 } else if (off < sizeof(struct ip6_hdr)) {
1365 panic("%s: off < sizeof(struct ip6_hdr)", __func__);
1366 } else {
1367 int len, nlen, nxt;
1368 struct ip6_ext ip6e;
1369
1370 nxt = ip6->ip6_nxt;
1371 len = sizeof(struct ip6_hdr);
1372 nlen = 0;
1373 while (len < off) {
1374 m_copydata(m, len, sizeof(ip6e), &ip6e);
1375
1376 switch (nxt) {
1377 case IPPROTO_FRAGMENT:
1378 nlen = sizeof(struct ip6_frag);
1379 break;
1380 case IPPROTO_AH:
1381 nlen = (ip6e.ip6e_len + 2) << 2;
1382 break;
1383 default:
1384 nlen = (ip6e.ip6e_len + 1) << 3;
1385 break;
1386 }
1387 len += nlen;
1388 nxt = ip6e.ip6e_nxt;
1389 }
1390
1391 return (len - nlen);
1392 }
1393 }
1394
1395 /*
1396 * get next header offset. m will be retained.
1397 */
1398 int
ip6_nexthdr(struct mbuf * m,int off,int proto,int * nxtp)1399 ip6_nexthdr(struct mbuf *m, int off, int proto, int *nxtp)
1400 {
1401 struct ip6_hdr ip6;
1402 struct ip6_ext ip6e;
1403 struct ip6_frag fh;
1404
1405 /* just in case */
1406 if (m == NULL)
1407 panic("%s: m == NULL", __func__);
1408 if ((m->m_flags & M_PKTHDR) == 0 || m->m_pkthdr.len < off)
1409 return -1;
1410
1411 switch (proto) {
1412 case IPPROTO_IPV6:
1413 /* do not chase beyond intermediate IPv6 headers */
1414 if (off != 0)
1415 return -1;
1416 if (m->m_pkthdr.len < off + sizeof(ip6))
1417 return -1;
1418 m_copydata(m, off, sizeof(ip6), (void *)&ip6);
1419 if (nxtp)
1420 *nxtp = ip6.ip6_nxt;
1421 off += sizeof(ip6);
1422 return off;
1423
1424 case IPPROTO_FRAGMENT:
1425 /*
1426 * terminate parsing if it is not the first fragment,
1427 * it does not make sense to parse through it.
1428 */
1429 if (m->m_pkthdr.len < off + sizeof(fh))
1430 return -1;
1431 m_copydata(m, off, sizeof(fh), (void *)&fh);
1432 if ((fh.ip6f_offlg & IP6F_OFF_MASK) != 0)
1433 return -1;
1434 if (nxtp)
1435 *nxtp = fh.ip6f_nxt;
1436 off += sizeof(struct ip6_frag);
1437 return off;
1438
1439 case IPPROTO_AH:
1440 if (m->m_pkthdr.len < off + sizeof(ip6e))
1441 return -1;
1442 m_copydata(m, off, sizeof(ip6e), (void *)&ip6e);
1443 if (nxtp)
1444 *nxtp = ip6e.ip6e_nxt;
1445 off += (ip6e.ip6e_len + 2) << 2;
1446 if (m->m_pkthdr.len < off)
1447 return -1;
1448 return off;
1449
1450 case IPPROTO_HOPOPTS:
1451 case IPPROTO_ROUTING:
1452 case IPPROTO_DSTOPTS:
1453 if (m->m_pkthdr.len < off + sizeof(ip6e))
1454 return -1;
1455 m_copydata(m, off, sizeof(ip6e), (void *)&ip6e);
1456 if (nxtp)
1457 *nxtp = ip6e.ip6e_nxt;
1458 off += (ip6e.ip6e_len + 1) << 3;
1459 if (m->m_pkthdr.len < off)
1460 return -1;
1461 return off;
1462
1463 case IPPROTO_NONE:
1464 case IPPROTO_ESP:
1465 case IPPROTO_IPCOMP:
1466 /* give up */
1467 return -1;
1468
1469 default:
1470 return -1;
1471 }
1472 }
1473
1474 /*
1475 * get offset for the last header in the chain. m will be kept untainted.
1476 */
1477 int
ip6_lasthdr(struct mbuf * m,int off,int proto,int * nxtp)1478 ip6_lasthdr(struct mbuf *m, int off, int proto, int *nxtp)
1479 {
1480 int newoff;
1481 int nxt;
1482
1483 if (!nxtp) {
1484 nxt = -1;
1485 nxtp = &nxt;
1486 }
1487 for (;;) {
1488 newoff = ip6_nexthdr(m, off, proto, nxtp);
1489 if (newoff < 0)
1490 return off;
1491 else if (newoff < off)
1492 return -1; /* invalid */
1493 else if (newoff == off)
1494 return newoff;
1495
1496 off = newoff;
1497 proto = *nxtp;
1498 }
1499 }
1500
1501 static struct m_tag *
ip6_addaux(struct mbuf * m)1502 ip6_addaux(struct mbuf *m)
1503 {
1504 struct m_tag *mtag;
1505
1506 mtag = m_tag_find(m, PACKET_TAG_INET6);
1507 if (!mtag) {
1508 mtag = m_tag_get(PACKET_TAG_INET6, sizeof(struct ip6aux),
1509 M_NOWAIT);
1510 if (mtag) {
1511 m_tag_prepend(m, mtag);
1512 memset(mtag + 1, 0, sizeof(struct ip6aux));
1513 }
1514 }
1515 return mtag;
1516 }
1517
1518 static struct m_tag *
ip6_findaux(struct mbuf * m)1519 ip6_findaux(struct mbuf *m)
1520 {
1521 struct m_tag *mtag;
1522
1523 mtag = m_tag_find(m, PACKET_TAG_INET6);
1524 return mtag;
1525 }
1526
1527 static void
ip6_delaux(struct mbuf * m)1528 ip6_delaux(struct mbuf *m)
1529 {
1530 struct m_tag *mtag;
1531
1532 mtag = m_tag_find(m, PACKET_TAG_INET6);
1533 if (mtag)
1534 m_tag_delete(m, mtag);
1535 }
1536
1537 /*
1538 * System control for IP6
1539 */
1540
1541 const u_char inet6ctlerrmap[PRC_NCMDS] = {
1542 0, 0, 0, 0,
1543 0, EMSGSIZE, EHOSTDOWN, EHOSTUNREACH,
1544 EHOSTUNREACH, EHOSTUNREACH, ECONNREFUSED, ECONNREFUSED,
1545 EMSGSIZE, EHOSTUNREACH, 0, 0,
1546 0, 0, 0, 0,
1547 ENOPROTOOPT
1548 };
1549
1550 extern int sysctl_net_inet6_addrctlpolicy(SYSCTLFN_ARGS);
1551
1552 static int
sysctl_net_inet6_ip6_stats(SYSCTLFN_ARGS)1553 sysctl_net_inet6_ip6_stats(SYSCTLFN_ARGS)
1554 {
1555
1556 return (NETSTAT_SYSCTL(ip6stat_percpu, IP6_NSTATS));
1557 }
1558
1559 static void
sysctl_net_inet6_ip6_setup(struct sysctllog ** clog)1560 sysctl_net_inet6_ip6_setup(struct sysctllog **clog)
1561 {
1562 const struct sysctlnode *ip6_node;
1563
1564 sysctl_createv(clog, 0, NULL, NULL,
1565 CTLFLAG_PERMANENT,
1566 CTLTYPE_NODE, "inet6",
1567 SYSCTL_DESCR("PF_INET6 related settings"),
1568 NULL, 0, NULL, 0,
1569 CTL_NET, PF_INET6, CTL_EOL);
1570 sysctl_createv(clog, 0, NULL, &ip6_node,
1571 CTLFLAG_PERMANENT,
1572 CTLTYPE_NODE, "ip6",
1573 SYSCTL_DESCR("IPv6 related settings"),
1574 NULL, 0, NULL, 0,
1575 CTL_NET, PF_INET6, IPPROTO_IPV6, CTL_EOL);
1576
1577 sysctl_createv(clog, 0, NULL, NULL,
1578 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1579 CTLTYPE_INT, "forwarding",
1580 SYSCTL_DESCR("Enable forwarding of INET6 datagrams"),
1581 NULL, 0, &ip6_forwarding, 0,
1582 CTL_NET, PF_INET6, IPPROTO_IPV6,
1583 IPV6CTL_FORWARDING, CTL_EOL);
1584 sysctl_createv(clog, 0, NULL, NULL,
1585 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1586 CTLTYPE_INT, "redirect",
1587 SYSCTL_DESCR("Enable sending of ICMPv6 redirect messages"),
1588 NULL, 0, &ip6_sendredirects, 0,
1589 CTL_NET, PF_INET6, IPPROTO_IPV6,
1590 IPV6CTL_SENDREDIRECTS, CTL_EOL);
1591 sysctl_createv(clog, 0, NULL, NULL,
1592 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1593 CTLTYPE_INT, "hlim",
1594 SYSCTL_DESCR("Hop limit for an INET6 datagram"),
1595 NULL, 0, &ip6_defhlim, 0,
1596 CTL_NET, PF_INET6, IPPROTO_IPV6,
1597 IPV6CTL_DEFHLIM, CTL_EOL);
1598 sysctl_createv(clog, 0, NULL, NULL,
1599 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1600 CTLTYPE_INT, "maxfragpackets",
1601 SYSCTL_DESCR("Maximum number of fragments to buffer "
1602 "for reassembly"),
1603 NULL, 0, &ip6_maxfragpackets, 0,
1604 CTL_NET, PF_INET6, IPPROTO_IPV6,
1605 IPV6CTL_MAXFRAGPACKETS, CTL_EOL);
1606
1607 pktq_sysctl_setup(ip6_pktq, clog, ip6_node, IPV6CTL_IFQ);
1608
1609 sysctl_createv(clog, 0, NULL, NULL,
1610 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1611 CTLTYPE_INT, "keepfaith",
1612 SYSCTL_DESCR("Activate faith interface"),
1613 NULL, 0, &ip6_keepfaith, 0,
1614 CTL_NET, PF_INET6, IPPROTO_IPV6,
1615 IPV6CTL_KEEPFAITH, CTL_EOL);
1616 sysctl_createv(clog, 0, NULL, NULL,
1617 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1618 CTLTYPE_INT, "log_interval",
1619 SYSCTL_DESCR("Minimum interval between logging "
1620 "unroutable packets"),
1621 NULL, 0, &ip6_log_interval, 0,
1622 CTL_NET, PF_INET6, IPPROTO_IPV6,
1623 IPV6CTL_LOG_INTERVAL, CTL_EOL);
1624 sysctl_createv(clog, 0, NULL, NULL,
1625 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1626 CTLTYPE_INT, "hdrnestlimit",
1627 SYSCTL_DESCR("Maximum number of nested IPv6 headers"),
1628 NULL, 0, &ip6_hdrnestlimit, 0,
1629 CTL_NET, PF_INET6, IPPROTO_IPV6,
1630 IPV6CTL_HDRNESTLIMIT, CTL_EOL);
1631 sysctl_createv(clog, 0, NULL, NULL,
1632 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1633 CTLTYPE_INT, "dad_count",
1634 SYSCTL_DESCR("Number of Duplicate Address Detection "
1635 "probes to send"),
1636 NULL, 0, &ip6_dad_count, 0,
1637 CTL_NET, PF_INET6, IPPROTO_IPV6,
1638 IPV6CTL_DAD_COUNT, CTL_EOL);
1639 sysctl_createv(clog, 0, NULL, NULL,
1640 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1641 CTLTYPE_INT, "auto_flowlabel",
1642 SYSCTL_DESCR("Assign random IPv6 flow labels"),
1643 NULL, 0, &ip6_auto_flowlabel, 0,
1644 CTL_NET, PF_INET6, IPPROTO_IPV6,
1645 IPV6CTL_AUTO_FLOWLABEL, CTL_EOL);
1646 sysctl_createv(clog, 0, NULL, NULL,
1647 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1648 CTLTYPE_INT, "defmcasthlim",
1649 SYSCTL_DESCR("Default multicast hop limit"),
1650 NULL, 0, &ip6_defmcasthlim, 0,
1651 CTL_NET, PF_INET6, IPPROTO_IPV6,
1652 IPV6CTL_DEFMCASTHLIM, CTL_EOL);
1653 sysctl_createv(clog, 0, NULL, NULL,
1654 CTLFLAG_PERMANENT,
1655 CTLTYPE_STRING, "kame_version",
1656 SYSCTL_DESCR("KAME Version"),
1657 NULL, 0, __UNCONST(__KAME_VERSION), 0,
1658 CTL_NET, PF_INET6, IPPROTO_IPV6,
1659 IPV6CTL_KAME_VERSION, CTL_EOL);
1660 sysctl_createv(clog, 0, NULL, NULL,
1661 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1662 CTLTYPE_INT, "use_deprecated",
1663 SYSCTL_DESCR("Allow use of deprecated addresses as "
1664 "source addresses"),
1665 NULL, 0, &ip6_use_deprecated, 0,
1666 CTL_NET, PF_INET6, IPPROTO_IPV6,
1667 IPV6CTL_USE_DEPRECATED, CTL_EOL);
1668 sysctl_createv(clog, 0, NULL, NULL,
1669 CTLFLAG_PERMANENT
1670 #ifndef INET6_BINDV6ONLY
1671 |CTLFLAG_READWRITE,
1672 #endif
1673 CTLTYPE_INT, "v6only",
1674 SYSCTL_DESCR("Disallow PF_INET6 sockets from connecting "
1675 "to PF_INET sockets"),
1676 NULL, 0, &ip6_v6only, 0,
1677 CTL_NET, PF_INET6, IPPROTO_IPV6,
1678 IPV6CTL_V6ONLY, CTL_EOL);
1679 sysctl_createv(clog, 0, NULL, NULL,
1680 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1681 CTLTYPE_INT, "anonportmin",
1682 SYSCTL_DESCR("Lowest ephemeral port number to assign"),
1683 sysctl_net_inet_ip_ports, 0, &ip6_anonportmin, 0,
1684 CTL_NET, PF_INET6, IPPROTO_IPV6,
1685 IPV6CTL_ANONPORTMIN, CTL_EOL);
1686 sysctl_createv(clog, 0, NULL, NULL,
1687 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1688 CTLTYPE_INT, "anonportmax",
1689 SYSCTL_DESCR("Highest ephemeral port number to assign"),
1690 sysctl_net_inet_ip_ports, 0, &ip6_anonportmax, 0,
1691 CTL_NET, PF_INET6, IPPROTO_IPV6,
1692 IPV6CTL_ANONPORTMAX, CTL_EOL);
1693 #ifndef IPNOPRIVPORTS
1694 sysctl_createv(clog, 0, NULL, NULL,
1695 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1696 CTLTYPE_INT, "lowportmin",
1697 SYSCTL_DESCR("Lowest privileged ephemeral port number "
1698 "to assign"),
1699 sysctl_net_inet_ip_ports, 0, &ip6_lowportmin, 0,
1700 CTL_NET, PF_INET6, IPPROTO_IPV6,
1701 IPV6CTL_LOWPORTMIN, CTL_EOL);
1702 sysctl_createv(clog, 0, NULL, NULL,
1703 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1704 CTLTYPE_INT, "lowportmax",
1705 SYSCTL_DESCR("Highest privileged ephemeral port number "
1706 "to assign"),
1707 sysctl_net_inet_ip_ports, 0, &ip6_lowportmax, 0,
1708 CTL_NET, PF_INET6, IPPROTO_IPV6,
1709 IPV6CTL_LOWPORTMAX, CTL_EOL);
1710 #endif /* IPNOPRIVPORTS */
1711 sysctl_createv(clog, 0, NULL, NULL,
1712 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1713 CTLTYPE_INT, "auto_linklocal",
1714 SYSCTL_DESCR("Default value of per-interface flag for "
1715 "adding an IPv6 link-local address to "
1716 "interfaces when attached"),
1717 NULL, 0, &ip6_auto_linklocal, 0,
1718 CTL_NET, PF_INET6, IPPROTO_IPV6,
1719 IPV6CTL_AUTO_LINKLOCAL, CTL_EOL);
1720 sysctl_createv(clog, 0, NULL, NULL,
1721 CTLFLAG_PERMANENT|CTLFLAG_READONLY,
1722 CTLTYPE_STRUCT, "addctlpolicy",
1723 SYSCTL_DESCR("Return the current address control"
1724 " policy"),
1725 sysctl_net_inet6_addrctlpolicy, 0, NULL, 0,
1726 CTL_NET, PF_INET6, IPPROTO_IPV6,
1727 IPV6CTL_ADDRCTLPOLICY, CTL_EOL);
1728 sysctl_createv(clog, 0, NULL, NULL,
1729 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1730 CTLTYPE_INT, "prefer_tempaddr",
1731 SYSCTL_DESCR("Prefer temporary address as source "
1732 "address"),
1733 NULL, 0, &ip6_prefer_tempaddr, 0,
1734 CTL_NET, PF_INET6, IPPROTO_IPV6,
1735 CTL_CREATE, CTL_EOL);
1736 sysctl_createv(clog, 0, NULL, NULL,
1737 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1738 CTLTYPE_INT, "maxfrags",
1739 SYSCTL_DESCR("Maximum fragments in reassembly queue"),
1740 NULL, 0, &ip6_maxfrags, 0,
1741 CTL_NET, PF_INET6, IPPROTO_IPV6,
1742 IPV6CTL_MAXFRAGS, CTL_EOL);
1743 sysctl_createv(clog, 0, NULL, NULL,
1744 CTLFLAG_PERMANENT,
1745 CTLTYPE_STRUCT, "stats",
1746 SYSCTL_DESCR("IPv6 statistics"),
1747 sysctl_net_inet6_ip6_stats, 0, NULL, 0,
1748 CTL_NET, PF_INET6, IPPROTO_IPV6,
1749 IPV6CTL_STATS, CTL_EOL);
1750 sysctl_createv(clog, 0, NULL, NULL,
1751 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1752 CTLTYPE_INT, "use_defaultzone",
1753 SYSCTL_DESCR("Whether to use the default scope zones"),
1754 NULL, 0, &ip6_use_defzone, 0,
1755 CTL_NET, PF_INET6, IPPROTO_IPV6,
1756 IPV6CTL_USE_DEFAULTZONE, CTL_EOL);
1757 sysctl_createv(clog, 0, NULL, NULL,
1758 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1759 CTLTYPE_INT, "mcast_pmtu",
1760 SYSCTL_DESCR("Enable pMTU discovery for multicast packet"),
1761 NULL, 0, &ip6_mcast_pmtu, 0,
1762 CTL_NET, PF_INET6, IPPROTO_IPV6,
1763 CTL_CREATE, CTL_EOL);
1764 /* anonportalgo RFC6056 subtree */
1765 const struct sysctlnode *portalgo_node;
1766 sysctl_createv(clog, 0, NULL, &portalgo_node,
1767 CTLFLAG_PERMANENT,
1768 CTLTYPE_NODE, "anonportalgo",
1769 SYSCTL_DESCR("Anonymous port algorithm selection (RFC 6056)"),
1770 NULL, 0, NULL, 0,
1771 CTL_NET, PF_INET6, IPPROTO_IPV6, CTL_CREATE, CTL_EOL);
1772 sysctl_createv(clog, 0, &portalgo_node, NULL,
1773 CTLFLAG_PERMANENT,
1774 CTLTYPE_STRING, "available",
1775 SYSCTL_DESCR("available algorithms"),
1776 sysctl_portalgo_available, 0, NULL, PORTALGO_MAXLEN,
1777 CTL_CREATE, CTL_EOL);
1778 sysctl_createv(clog, 0, &portalgo_node, NULL,
1779 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1780 CTLTYPE_STRING, "selected",
1781 SYSCTL_DESCR("selected algorithm"),
1782 sysctl_portalgo_selected6, 0, NULL, PORTALGO_MAXLEN,
1783 CTL_CREATE, CTL_EOL);
1784 sysctl_createv(clog, 0, &portalgo_node, NULL,
1785 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1786 CTLTYPE_STRUCT, "reserve",
1787 SYSCTL_DESCR("bitmap of reserved ports"),
1788 sysctl_portalgo_reserve6, 0, NULL, 0,
1789 CTL_CREATE, CTL_EOL);
1790 sysctl_createv(clog, 0, NULL, NULL,
1791 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1792 CTLTYPE_INT, "neighborgcthresh",
1793 SYSCTL_DESCR("Maximum number of entries in neighbor"
1794 " cache"),
1795 NULL, 1, &ip6_neighborgcthresh, 0,
1796 CTL_NET, PF_INET6, IPPROTO_IPV6,
1797 CTL_CREATE, CTL_EOL);
1798 sysctl_createv(clog, 0, NULL, NULL,
1799 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1800 CTLTYPE_INT, "maxdynroutes",
1801 SYSCTL_DESCR("Maximum number of routes created via"
1802 " redirect"),
1803 NULL, 1, &ip6_maxdynroutes, 0,
1804 CTL_NET, PF_INET6, IPPROTO_IPV6,
1805 CTL_CREATE, CTL_EOL);
1806 sysctl_createv(clog, 0, NULL, NULL,
1807 CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1808 CTLTYPE_INT, "param_rt_msg",
1809 SYSCTL_DESCR("How to send parameter changing"
1810 " routing message"),
1811 NULL, 0, &ip6_param_rt_msg, 0,
1812 CTL_NET, PF_INET6, IPPROTO_IPV6,
1813 CTL_CREATE, CTL_EOL);
1814 }
1815
1816 void
ip6_statinc(u_int stat)1817 ip6_statinc(u_int stat)
1818 {
1819
1820 KASSERT(stat < IP6_NSTATS);
1821 IP6_STATINC(stat);
1822 }
1823