1/*
2 * Copyright (c) 2000-2022 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29/* $FreeBSD: src/sys/netinet6/icmp6.c,v 1.6.2.6 2001/07/10 09:44:16 ume Exp $ */
30/* $KAME: icmp6.c,v 1.211 2001/04/04 05:56:20 itojun Exp $ */
31
32/*
33 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
34 * All rights reserved.
35 *
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
38 * are met:
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. Neither the name of the project nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 */
60
61/*
62 * Copyright (c) 1982, 1986, 1988, 1993
63 * The Regents of the University of California. All rights reserved.
64 *
65 * Redistribution and use in source and binary forms, with or without
66 * modification, are permitted provided that the following conditions
67 * are met:
68 * 1. Redistributions of source code must retain the above copyright
69 * notice, this list of conditions and the following disclaimer.
70 * 2. Redistributions in binary form must reproduce the above copyright
71 * notice, this list of conditions and the following disclaimer in the
72 * documentation and/or other materials provided with the distribution.
73 * 3. All advertising materials mentioning features or use of this software
74 * must display the following acknowledgement:
75 * This product includes software developed by the University of
76 * California, Berkeley and its contributors.
77 * 4. Neither the name of the University nor the names of its contributors
78 * may be used to endorse or promote products derived from this software
79 * without specific prior written permission.
80 *
81 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
82 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
83 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
84 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
85 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
86 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
87 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
88 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
89 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
90 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
91 * SUCH DAMAGE.
92 *
93 * @(#)ip_icmp.c 8.2 (Berkeley) 1/4/94
94 */
95
96
97#include <sys/param.h>
98#include <sys/systm.h>
99#include <sys/lock.h>
100#include <sys/malloc.h>
101#include <sys/mcache.h>
102#include <sys/mbuf.h>
103#include <sys/protosw.h>
104#include <sys/socket.h>
105#include <sys/socketvar.h>
106#include <sys/time.h>
107#include <sys/kernel.h>
108#include <sys/syslog.h>
109#include <sys/domain.h>
110#include <sys/kauth.h>
111
112#include <net/if.h>
113#include <net/route.h>
114#include <net/if_dl.h>
115#include <net/if_types.h>
116
117#include <netinet/in.h>
118#include <netinet/in_var.h>
119#include <netinet/ip6.h>
120#include <netinet6/ip6_var.h>
121#include <netinet/icmp6.h>
122#include <netinet6/mld6_var.h>
123#include <netinet/in_pcb.h>
124#include <netinet6/in6_pcb.h>
125#include <netinet6/in6_var.h>
126#include <netinet6/nd6.h>
127#include <netinet6/in6_ifattach.h>
128#include <netinet6/ip6protosw.h>
129#include <netinet6/scope6_var.h>
130
131#if IPSEC
132#include <netinet6/ipsec.h>
133#include <netkey/key.h>
134#endif
135
136#include <net/net_osdep.h>
137
138#if NECP
139#include <net/necp.h>
140#endif
141
142extern struct ip6protosw *ip6_protox[];
143
144extern uint32_t rip_sendspace;
145extern uint32_t rip_recvspace;
146
147struct icmp6stat icmp6stat;
148
149extern struct inpcbhead ripcb;
150extern int icmp6errppslim;
151extern int icmp6errppslim_random_incr;
152extern int icmp6rappslim;
153static int icmp6errpps_count = 0;
154static int icmp6rapps_count = 0;
155static struct timeval icmp6errppslim_last;
156static struct timeval icmp6rappslim_last;
157extern int icmp6_nodeinfo;
158extern struct inpcbinfo ripcbinfo;
159
160static void icmp6_errcount(struct icmp6errstat *, int, int);
161static int icmp6_rip6_input(struct mbuf **, int);
162static int icmp6_ratelimit(const struct in6_addr *, const int, const int);
163static const char *icmp6_redirect_diag(struct in6_addr *,
164 struct in6_addr *, struct in6_addr *);
165static struct mbuf *ni6_input(struct mbuf *, int);
166static struct mbuf *ni6_nametodns(const char *, uint32_t, int);
167static int ni6_dnsmatch(const char *, int, const char *, int);
168static int ni6_addrs(struct icmp6_nodeinfo *,
169 struct ifnet **, char *);
170static int ni6_store_addrs(struct icmp6_nodeinfo *, struct icmp6_nodeinfo *,
171 struct ifnet *, int);
172static int icmp6_notify_error(struct mbuf *, int, int, int);
173
174
175
176void
177icmp6_init(struct ip6protosw *pp, struct domain *dp)
178{
179#pragma unused(dp)
180 static int icmp6_initialized = 0;
181
182 /* Also called from ip6_init() without pp */
183 VERIFY(pp == NULL ||
184 (pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
185
186 /* This gets called by more than one protocols, so initialize once */
187 if (!icmp6_initialized) {
188 icmp6_initialized = 1;
189 mld_init();
190 if (icmp6errppslim >= 0 &&
191 icmp6errppslim_random_incr > 0 &&
192 icmp6errppslim <= INT32_MAX - (icmp6errppslim_random_incr + 1)) {
193 icmp6errppslim += (random() % icmp6errppslim_random_incr) + 1;
194 }
195 }
196}
197
198static void
199icmp6_errcount(struct icmp6errstat *stat, int type, int code)
200{
201 switch (type) {
202 case ICMP6_DST_UNREACH:
203 switch (code) {
204 case ICMP6_DST_UNREACH_NOROUTE:
205 stat->icp6errs_dst_unreach_noroute++;
206 return;
207 case ICMP6_DST_UNREACH_ADMIN:
208 stat->icp6errs_dst_unreach_admin++;
209 return;
210 case ICMP6_DST_UNREACH_BEYONDSCOPE:
211 stat->icp6errs_dst_unreach_beyondscope++;
212 return;
213 case ICMP6_DST_UNREACH_ADDR:
214 stat->icp6errs_dst_unreach_addr++;
215 return;
216 case ICMP6_DST_UNREACH_NOPORT:
217 stat->icp6errs_dst_unreach_noport++;
218 return;
219 }
220 break;
221 case ICMP6_PACKET_TOO_BIG:
222 stat->icp6errs_packet_too_big++;
223 return;
224 case ICMP6_TIME_EXCEEDED:
225 switch (code) {
226 case ICMP6_TIME_EXCEED_TRANSIT:
227 stat->icp6errs_time_exceed_transit++;
228 return;
229 case ICMP6_TIME_EXCEED_REASSEMBLY:
230 stat->icp6errs_time_exceed_reassembly++;
231 return;
232 }
233 break;
234 case ICMP6_PARAM_PROB:
235 switch (code) {
236 case ICMP6_PARAMPROB_HEADER:
237 stat->icp6errs_paramprob_header++;
238 return;
239 case ICMP6_PARAMPROB_NEXTHEADER:
240 stat->icp6errs_paramprob_nextheader++;
241 return;
242 case ICMP6_PARAMPROB_OPTION:
243 stat->icp6errs_paramprob_option++;
244 return;
245 }
246 break;
247 case ND_REDIRECT:
248 stat->icp6errs_redirect++;
249 return;
250 }
251 stat->icp6errs_unknown++;
252}
253
254/*
255 * Generate packet gencount for ICMPv6 for a given error type
256 * and code.
257 */
258static uint32_t
259icmp6_error_packet_gencount(int type, int code)
260{
261 return (PF_INET6 << 24) | (type << 16) | (code << 8);
262}
263
264static int suppress_icmp6_port_unreach = 0;
265
266SYSCTL_DECL(_net_inet6_icmp6);
267SYSCTL_INT(_net_inet6_icmp6, OID_AUTO, suppress_icmp6_port_unreach, CTLFLAG_RW | CTLFLAG_LOCKED,
268 &suppress_icmp6_port_unreach, 0,
269 "Suppress ICMPv6 destination unreachable type with code port unreachable");
270
271/*
272 * Generate an error packet of type error in response to bad IP6 packet.
273 */
274void
275icmp6_error(struct mbuf *m, int type, int code, int param)
276{
277 icmp6_error_flag(m, type, code, param, ICMP6_ERROR_RST_MRCVIF);
278}
279
280void
281icmp6_error_flag(struct mbuf *m, int type, int code, int param, int flags)
282{
283 struct ip6_hdr *oip6, *nip6;
284 struct icmp6_hdr *icmp6;
285 u_int preplen;
286 int off;
287
288 icmp6stat.icp6s_error++;
289
290 /* count per-type-code statistics */
291 icmp6_errcount(stat: &icmp6stat.icp6s_outerrhist, type, code);
292
293 if (suppress_icmp6_port_unreach && type == ICMP6_DST_UNREACH &&
294 code == ICMP6_DST_UNREACH_NOPORT) {
295 goto freeit;
296 }
297
298#ifdef M_DECRYPTED /*not openbsd*/
299 if (m->m_flags & M_DECRYPTED) {
300 icmp6stat.icp6s_canterror++;
301 goto freeit;
302 }
303#endif
304
305#ifndef PULLDOWN_TEST
306 IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), return );
307#else
308 if (m->m_len < sizeof(struct ip6_hdr)) {
309 m = m_pullup(m, sizeof(struct ip6_hdr));
310 if (m == NULL) {
311 return;
312 }
313 }
314#endif
315 oip6 = mtod(m, struct ip6_hdr *);
316
317 /*
318 * If the destination address of the erroneous packet is a multicast
319 * address, or the packet was sent using link-layer multicast,
320 * we should basically suppress sending an error (RFC 2463, Section
321 * 2.4).
322 * We have two exceptions (the item e.2 in that section):
323 * - the Pakcet Too Big message can be sent for path MTU discovery.
324 * - the Parameter Problem Message that can be allowed an icmp6 error
325 * in the option type field. This check has been done in
326 * ip6_unknown_opt(), so we can just check the type and code.
327 */
328 if ((m->m_flags & (M_BCAST | M_MCAST) ||
329 IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) &&
330 (type != ICMP6_PACKET_TOO_BIG &&
331 (type != ICMP6_PARAM_PROB ||
332 code != ICMP6_PARAMPROB_OPTION))) {
333 goto freeit;
334 }
335
336 /*
337 * RFC 2463, 2.4 (e.5): source address check.
338 * XXX: the case of anycast source?
339 */
340 if (IN6_IS_ADDR_UNSPECIFIED(&oip6->ip6_src) ||
341 IN6_IS_ADDR_MULTICAST(&oip6->ip6_src)) {
342 goto freeit;
343 }
344
345 /*
346 * If we are about to send ICMPv6 against ICMPv6 error/redirect,
347 * don't do it.
348 *
349 * We want to check for that for all ICMP error types, other than
350 * ICMP6_PARAM_PROB when it is being sent in response of first frag
351 * with incomplete header.
352 * That also includes the case when the first frag has incomplete ICMPv6
353 * header. The check below in that case would fail the IP6_EXTHDR_CHECK
354 * and would otherwise prevent us from sending the error back.
355 */
356 if (type != ICMP6_PARAM_PROB ||
357 code != ICMP6_PARAMPROB_FIRSTFRAG_INCOMP_HDR) {
358 int nxt = -1;
359 off = ip6_lasthdr(m, 0, IPPROTO_IPV6, &nxt);
360 if (off >= 0 && nxt == IPPROTO_ICMPV6) {
361 struct icmp6_hdr *icp;
362
363#ifndef PULLDOWN_TEST
364 IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct icmp6_hdr), return );
365 icp = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
366#else
367 IP6_EXTHDR_GET(icp, struct icmp6_hdr *, m, off,
368 sizeof(*icp));
369 if (icp == NULL) {
370 icmp6stat.icp6s_tooshort++;
371 return;
372 }
373#endif
374 if (icp->icmp6_type < ICMP6_ECHO_REQUEST ||
375 icp->icmp6_type == ND_REDIRECT) {
376 /*
377 * ICMPv6 error
378 * Special case: for redirect (which is
379 * informational) we must not send icmp6 error.
380 */
381 icmp6stat.icp6s_canterror++;
382 goto freeit;
383 } else {
384 /* ICMPv6 informational - send the error */
385 }
386 } else {
387 /* non-ICMPv6 - send the error */
388 }
389 }
390
391 oip6 = mtod(m, struct ip6_hdr *); /* adjust pointer */
392
393 /*
394 * OK, ICMP6 can be generated.
395 */
396
397 if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN) {
398 m_adj(m, ICMPV6_PLD_MAXLEN - m->m_pkthdr.len);
399 }
400
401 /*
402 * To avoid some flavors of port scanning and other attacks,
403 * use packet suppression without using any other sort of
404 * rate limiting with static bounds.
405 * XXX Not setting PKTF_FLOW_ID here because we were concerned
406 * about it triggering regression elsewhere outside of network stack
407 * where there might be an assumption around flow ID being non-zero.
408 * It should be noted though that previously if PKTF_FLOW_ID was not
409 * set, PF would have generated flow hash irrespective of ICMPv4/v6
410 * type. That doesn't happen now and PF only computes hash for ICMP
411 * types that need state creation (which is not true of error types).
412 * It would have been a problem because we really want all the ICMP
413 * error type packets to share the same flow ID for global suppression.
414 */
415 m->m_pkthdr.comp_gencnt = icmp6_error_packet_gencount(type, code);
416
417 preplen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
418 M_PREPEND(m, preplen, M_DONTWAIT, 1);
419 if (m == NULL) {
420 nd6log(debug, "ENOBUFS in icmp6_error %d\n", __LINE__);
421 return;
422 }
423
424 nip6 = mtod(m, struct ip6_hdr *);
425 nip6->ip6_src = oip6->ip6_src;
426 nip6->ip6_dst = oip6->ip6_dst;
427
428 in6_clearscope(&oip6->ip6_src);
429 in6_clearscope(&oip6->ip6_dst);
430
431 icmp6 = (struct icmp6_hdr *)(nip6 + 1);
432 icmp6->icmp6_type = (uint8_t)type;
433 icmp6->icmp6_code = (uint8_t)code;
434 icmp6->icmp6_pptr = htonl((u_int32_t)param);
435
436 /*
437 * icmp6_reflect() is designed to be in the input path.
438 * icmp6_error() can be called from both input and output path,
439 * and if we are in output path rcvif could contain bogus value.
440 * clear m->m_pkthdr.rcvif for safety, we should have enough scope
441 * information in ip header (nip6).
442 */
443 if (flags & ICMP6_ERROR_RST_MRCVIF) {
444 m->m_pkthdr.rcvif = NULL;
445 }
446
447 icmp6stat.icp6s_outhist[type]++;
448 icmp6_reflect(m, sizeof(struct ip6_hdr)); /* header order: IPv6 - ICMPv6 */
449
450 return;
451
452freeit:
453 /*
454 * If we can't tell whether or not we can generate ICMP6, free it.
455 */
456 m_freem(m);
457}
458
459/*
460 * Process a received ICMP6 message.
461 */
462int
463icmp6_input(struct mbuf **mp, int *offp, int proto)
464{
465#pragma unused(proto)
466 struct mbuf *m = *mp, *n;
467 struct ifnet *ifp;
468 struct ip6_hdr *ip6, *nip6;
469 struct icmp6_hdr *icmp6, *nicmp6;
470 int off = *offp;
471 int icmp6len = m->m_pkthdr.len - *offp;
472 int code, sum, noff, proxy = 0;
473
474 ifp = m->m_pkthdr.rcvif;
475
476#ifndef PULLDOWN_TEST
477 IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_hdr), return IPPROTO_DONE);
478 /* m might change if M_LOOP. So, call mtod after this */
479#endif
480
481 /* Expect 32-bit aligned data pointer on strict-align platforms */
482 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
483
484 /*
485 * Locate icmp6 structure in mbuf, and check
486 * that not corrupted and of at least minimum length
487 */
488 ip6 = mtod(m, struct ip6_hdr *);
489 if (icmp6len < sizeof(struct icmp6_hdr)) {
490 icmp6stat.icp6s_tooshort++;
491 goto freeit;
492 }
493
494#ifndef PULLDOWN_TEST
495 icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);
496#else
497 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6));
498 if (icmp6 == NULL) {
499 icmp6stat.icp6s_tooshort++;
500 return IPPROTO_DONE;
501 }
502#endif
503 code = icmp6->icmp6_code;
504
505 /*
506 * Early check for RFC 6980
507 * Drop certain NDP packets if they came in fragmented
508 */
509 switch (icmp6->icmp6_type) {
510 case ND_ROUTER_SOLICIT:
511 case ND_ROUTER_ADVERT:
512 case ND_NEIGHBOR_SOLICIT:
513 case ND_NEIGHBOR_ADVERT:
514 case ND_REDIRECT:
515 if (m->m_pkthdr.pkt_flags & PKTF_REASSEMBLED) {
516 icmp6stat.icp6s_rfc6980_drop++;
517 goto freeit;
518 }
519 break;
520 default:
521 break;
522 }
523
524 /* Apply rate limit before checksum validation. */
525 if (icmp6_ratelimit(&ip6->ip6_dst, icmp6->icmp6_type, code)) {
526 icmp6stat.icp6s_toofreq++;
527 goto freeit;
528 }
529
530 /*
531 * Check multicast group membership.
532 * Note: SSM filters are not applied for ICMPv6 traffic.
533 */
534 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
535 struct in6_multi *inm;
536
537 in6_multihead_lock_shared();
538 IN6_LOOKUP_MULTI(&ip6->ip6_dst, ifp, inm);
539 in6_multihead_lock_done();
540
541 if (inm == NULL) {
542 /*
543 * Don't discard if this is a Neighbor Solicitation
544 * that needs to be proxied (see check down below.)
545 */
546 if (!(m->m_pkthdr.pkt_flags & PKTF_PROXY_DST)) {
547 ip6stat.ip6s_notmember++;
548 in6_ifstat_inc(m->m_pkthdr.rcvif,
549 ifs6_in_discard);
550 goto freeit;
551 }
552 } else {
553 IN6M_REMREF(inm);
554 }
555 }
556
557 /*
558 * calculate the checksum
559 */
560 if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) {
561 nd6log(error,
562 "ICMP6 checksum error(%d|%x) %s\n",
563 icmp6->icmp6_type, sum, ip6_sprintf(&ip6->ip6_src));
564 icmp6stat.icp6s_checksum++;
565 goto freeit;
566 }
567
568 if (m->m_pkthdr.pkt_flags & PKTF_PROXY_DST) {
569 /*
570 * This is the special case of proxying NS (dst is either
571 * solicited-node multicast or unicast); process it locally
572 * but don't deliver it to sockets. It practically lets us
573 * steer the packet to nd6_prproxy_ns_input, where more
574 * specific tests and actions will be taken.
575 */
576 switch (icmp6->icmp6_type) {
577 case ND_NEIGHBOR_SOLICIT:
578 proxy = 1;
579 break;
580 default:
581 goto freeit;
582 }
583 }
584
585 icmp6stat.icp6s_inhist[icmp6->icmp6_type]++;
586 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_msg);
587 if (icmp6->icmp6_type < ICMP6_INFOMSG_MASK) {
588 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_error);
589 }
590
591 switch (icmp6->icmp6_type) {
592 case ICMP6_DST_UNREACH:
593 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_dstunreach);
594 switch (code) {
595 case ICMP6_DST_UNREACH_NOROUTE:
596 case ICMP6_DST_UNREACH_ADDR: /* PRC_HOSTDEAD is a DOS */
597 code = PRC_UNREACH_NET;
598 break;
599 case ICMP6_DST_UNREACH_ADMIN:
600 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_adminprohib);
601 code = PRC_UNREACH_PROTOCOL; /* is this a good code? */
602 break;
603 case ICMP6_DST_UNREACH_BEYONDSCOPE:
604 /* I mean "source address was incorrect." */
605 code = PRC_PARAMPROB;
606 break;
607 case ICMP6_DST_UNREACH_NOPORT:
608 code = PRC_UNREACH_PORT;
609 break;
610 default:
611 goto badcode;
612 }
613 goto deliver;
614
615 case ICMP6_PACKET_TOO_BIG:
616 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_pkttoobig);
617 if (ntohl(icmp6->icmp6_mtu) < IPV6_MMTU) {
618 icmp6stat.icp6s_badpkttoobig++;
619 goto freeit;
620 }
621
622 code = PRC_MSGSIZE;
623
624 /*
625 * Updating the path MTU will be done after examining
626 * intermediate extension headers.
627 */
628 goto deliver;
629
630 case ICMP6_TIME_EXCEEDED:
631 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_timeexceed);
632 switch (code) {
633 case ICMP6_TIME_EXCEED_TRANSIT:
634 code = PRC_TIMXCEED_INTRANS;
635 break;
636 case ICMP6_TIME_EXCEED_REASSEMBLY:
637 code = PRC_TIMXCEED_REASS;
638 break;
639 default:
640 goto badcode;
641 }
642 goto deliver;
643
644 case ICMP6_PARAM_PROB:
645 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_paramprob);
646 switch (code) {
647 case ICMP6_PARAMPROB_NEXTHEADER:
648 code = PRC_UNREACH_PROTOCOL;
649 break;
650 case ICMP6_PARAMPROB_HEADER:
651 case ICMP6_PARAMPROB_OPTION:
652 code = PRC_PARAMPROB;
653 break;
654 default:
655 goto badcode;
656 }
657 goto deliver;
658
659 case ICMP6_ECHO_REQUEST:
660 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echo);
661 if (code != 0) {
662 goto badcode;
663 }
664
665 if ((n = m_copy(m, 0, M_COPYALL)) == NULL) {
666 /* Give up remote */
667 goto rate_limit_checked;
668 }
669 if ((n->m_flags & M_EXT) != 0
670 || n->m_len < off + sizeof(struct icmp6_hdr)) {
671 struct mbuf *n0 = n;
672 const int maxlen = sizeof(*nip6) + sizeof(*nicmp6);
673
674 /*
675 * Prepare an internal mbuf. m_pullup() doesn't
676 * always copy the length we specified.
677 */
678 if (maxlen >= MCLBYTES) {
679 /* Give up remote */
680 m_freem(n0);
681 goto rate_limit_checked;
682 }
683 MGETHDR(n, M_DONTWAIT, n0->m_type); /* MAC-OK */
684 if (n && maxlen >= MHLEN) {
685 MCLGET(n, M_DONTWAIT);
686 if ((n->m_flags & M_EXT) == 0) {
687 m_free(n);
688 n = NULL;
689 }
690 }
691 if (n == NULL) {
692 /* Give up remote */
693 m_freem(n0);
694 goto rate_limit_checked;
695 }
696 M_COPY_PKTHDR(n, n0);
697 /*
698 * Copy IPv6 and ICMPv6 only.
699 */
700 nip6 = mtod(n, struct ip6_hdr *);
701 bcopy(src: ip6, dst: nip6, n: sizeof(struct ip6_hdr));
702 nicmp6 = (struct icmp6_hdr *)(nip6 + 1);
703 bcopy(src: icmp6, dst: nicmp6, n: sizeof(struct icmp6_hdr));
704 noff = sizeof(struct ip6_hdr);
705 n->m_pkthdr.len = n->m_len =
706 noff + sizeof(struct icmp6_hdr);
707 /*
708 * Adjust mbuf. ip6_plen will be adjusted in
709 * ip6_output().
710 */
711 m_adj(n0, off + sizeof(struct icmp6_hdr));
712 n->m_pkthdr.len += n0->m_pkthdr.len;
713 n->m_next = n0;
714 n0->m_flags &= ~M_PKTHDR;
715 } else {
716 nip6 = mtod(n, struct ip6_hdr *);
717 IP6_EXTHDR_GET(nicmp6, struct icmp6_hdr *, n, off,
718 sizeof(*nicmp6));
719 noff = off;
720 }
721 if (nicmp6 == NULL) {
722 panic("nicmp6 is NULL in %s, which isn't good!", __FUNCTION__);
723 } else {
724 nicmp6->icmp6_type = ICMP6_ECHO_REPLY;
725 nicmp6->icmp6_code = 0;
726 }
727 if (n) {
728 icmp6stat.icp6s_reflect++;
729 icmp6stat.icp6s_outhist[ICMP6_ECHO_REPLY]++;
730 icmp6_reflect(n, noff);
731 }
732 goto rate_limit_checked;
733
734 case ICMP6_ECHO_REPLY:
735 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echoreply);
736 if (code != 0) {
737 goto badcode;
738 }
739 break;
740
741 case MLD_LISTENER_QUERY:
742 case MLD_LISTENER_REPORT:
743
744 if (icmp6len < sizeof(struct mld_hdr)) {
745 goto badlen;
746 }
747 if (icmp6->icmp6_type == MLD_LISTENER_QUERY) { /* XXX: ugly... */
748 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldquery);
749 } else {
750 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldreport);
751 }
752
753 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
754 /* give up local */
755 if (mld_input(m, off, icmp6len) == IPPROTO_DONE) {
756 m = NULL;
757 }
758 goto freeit;
759 }
760 if (mld_input(n, off, icmp6len) != IPPROTO_DONE) {
761 m_freem(n);
762 }
763 /* m stays. */
764 goto rate_limit_checked;
765
766 case MLD_LISTENER_DONE:
767 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mlddone);
768 if (icmp6len < sizeof(struct mld_hdr)) { /* necessary? */
769 goto badlen;
770 }
771 break; /* nothing to be done in kernel */
772
773 case MLD_MTRACE_RESP:
774 case MLD_MTRACE:
775 /* XXX: these two are experimental. not officially defined. */
776 /* XXX: per-interface statistics? */
777 break; /* just pass it to applications */
778
779 case ICMP6_NI_QUERY:
780 if (!icmp6_nodeinfo) {
781 break;
782 }
783//### LD 10/20 Check fbsd differences here. Not sure we're more advanced or not.
784 /* By RFC 4620 refuse to answer queries from global scope addresses */
785 if ((icmp6_nodeinfo & 8) != 8 && in6_addrscope(&ip6->ip6_src) == IPV6_ADDR_SCOPE_GLOBAL) {
786 break;
787 }
788
789 if (icmp6len < sizeof(struct icmp6_nodeinfo)) {
790 goto badlen;
791 }
792
793#ifndef PULLDOWN_TEST
794 IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_nodeinfo),
795 return IPPROTO_DONE);
796#endif
797
798 n = m_copy(m, 0, M_COPYALL);
799 if (n) {
800 n = ni6_input(n, off);
801 }
802 if (n) {
803 noff = sizeof(struct ip6_hdr);
804 icmp6stat.icp6s_reflect++;
805 icmp6stat.icp6s_outhist[ICMP6_WRUREPLY]++;
806 icmp6_reflect(n, noff);
807 }
808 goto rate_limit_checked;
809
810 case ICMP6_WRUREPLY:
811 if (code != 0) {
812 goto badcode;
813 }
814 break;
815
816 case ND_ROUTER_SOLICIT:
817 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routersolicit);
818 if (code != 0) {
819 goto badcode;
820 }
821 if (icmp6len < sizeof(struct nd_router_solicit)) {
822 goto badlen;
823 }
824
825 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
826 /* give up local */
827 nd6_rs_input(m, off, icmp6len);
828 m = NULL;
829 goto freeit;
830 }
831 nd6_rs_input(n, off, icmp6len);
832 /* m stays. */
833 goto rate_limit_checked;
834
835 case ND_ROUTER_ADVERT:
836 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routeradvert);
837 if (code != 0) {
838 goto badcode;
839 }
840 if (icmp6len < sizeof(struct nd_router_advert)) {
841 goto badlen;
842 }
843
844 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
845 /* give up local */
846 nd6_ra_input(m, off, icmp6len);
847 m = NULL;
848 goto freeit;
849 }
850 nd6_ra_input(n, off, icmp6len);
851 /* m stays. */
852 goto rate_limit_checked;
853
854 case ND_NEIGHBOR_SOLICIT:
855 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighborsolicit);
856 if (code != 0) {
857 goto badcode;
858 }
859 if (icmp6len < sizeof(struct nd_neighbor_solicit)) {
860 goto badlen;
861 }
862
863 if (proxy ||
864 ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL)) {
865 /* give up local */
866 nd6_ns_input(m, off, icmp6len);
867 m = NULL;
868 goto freeit;
869 }
870 nd6_ns_input(n, off, icmp6len);
871 /* m stays. */
872 goto rate_limit_checked;
873
874 case ND_NEIGHBOR_ADVERT:
875 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighboradvert);
876 if (code != 0) {
877 goto badcode;
878 }
879 if (icmp6len < sizeof(struct nd_neighbor_advert)) {
880 goto badlen;
881 }
882
883 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
884 /* give up local */
885 nd6_na_input(m, off, icmp6len);
886 m = NULL;
887 goto freeit;
888 }
889 nd6_na_input(n, off, icmp6len);
890 /* m stays. */
891 goto rate_limit_checked;
892
893 case ND_REDIRECT:
894 icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_redirect);
895 if (code != 0) {
896 goto badcode;
897 }
898 if (icmp6len < sizeof(struct nd_redirect)) {
899 goto badlen;
900 }
901
902 if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
903 /* give up local */
904 icmp6_redirect_input(m, off, icmp6len);
905 m = NULL;
906 goto freeit;
907 }
908 icmp6_redirect_input(n, off, icmp6len);
909 /* m stays. */
910 goto rate_limit_checked;
911
912 case ICMP6_ROUTER_RENUMBERING:
913 if (code != ICMP6_ROUTER_RENUMBERING_COMMAND &&
914 code != ICMP6_ROUTER_RENUMBERING_RESULT) {
915 goto badcode;
916 }
917 if (icmp6len < sizeof(struct icmp6_router_renum)) {
918 goto badlen;
919 }
920 break;
921
922 default:
923 nd6log(debug,
924 "icmp6_input: unknown type %d(src=%s, dst=%s, ifid=%d)\n",
925 icmp6->icmp6_type, ip6_sprintf(&ip6->ip6_src),
926 ip6_sprintf(&ip6->ip6_dst),
927 m->m_pkthdr.rcvif ? m->m_pkthdr.rcvif->if_index : 0);
928 if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST) {
929 /* ICMPv6 error: MUST deliver it by spec... */
930 code = PRC_NCMDS;
931 /* deliver */
932 } else {
933 /* ICMPv6 informational: MUST not deliver */
934 goto rate_limit_checked;
935 }
936deliver:
937 if (icmp6_notify_error(m, off, icmp6len, code)) {
938 /* In this case, m should've been freed. */
939 return IPPROTO_DONE;
940 }
941 break;
942
943badcode:
944 icmp6stat.icp6s_badcode++;
945 break;
946
947badlen:
948 icmp6stat.icp6s_badlen++;
949 break;
950 }
951
952rate_limit_checked:
953 icmp6_rip6_input(&m, *offp);
954 return IPPROTO_DONE;
955
956freeit:
957 m_freem(m);
958 return IPPROTO_DONE;
959}
960
961static int
962icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)
963{
964 struct icmp6_hdr *icmp6;
965 struct ip6_hdr *eip6;
966 u_int32_t notifymtu;
967 struct sockaddr_in6 icmp6src, icmp6dst;
968
969 if (icmp6len < sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr)) {
970 icmp6stat.icp6s_tooshort++;
971 goto freeit;
972 }
973#ifndef PULLDOWN_TEST
974 IP6_EXTHDR_CHECK(m, off,
975 sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr),
976 return -1);
977 icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
978#else
979 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,
980 sizeof(*icmp6) + sizeof(struct ip6_hdr));
981 if (icmp6 == NULL) {
982 icmp6stat.icp6s_tooshort++;
983 return -1;
984 }
985#endif
986 eip6 = (struct ip6_hdr *)(icmp6 + 1);
987 bzero(s: &icmp6dst, n: sizeof(icmp6dst));
988
989 /* Detect the upper level protocol */
990 {
991 void (*ctlfunc)(int, struct sockaddr *, void *, struct ifnet *);
992 u_int8_t nxt = eip6->ip6_nxt;
993 int eoff = off + sizeof(struct icmp6_hdr) +
994 sizeof(struct ip6_hdr);
995 struct ip6ctlparam ip6cp;
996 int icmp6type = icmp6->icmp6_type;
997 struct ip6_frag *fh;
998 struct ip6_rthdr *rth;
999 struct ip6_rthdr0 *rth0;
1000 int rthlen;
1001
1002 while (1) { /* XXX: should avoid infinite loop explicitly? */
1003 struct ip6_ext *eh;
1004
1005 switch (nxt) {
1006 case IPPROTO_HOPOPTS:
1007 case IPPROTO_DSTOPTS:
1008 case IPPROTO_AH:
1009#ifndef PULLDOWN_TEST
1010 IP6_EXTHDR_CHECK(m, 0,
1011 eoff + sizeof(struct ip6_ext), return -1);
1012 eh = (struct ip6_ext *)(mtod(m, caddr_t)
1013 + eoff);
1014#else
1015 IP6_EXTHDR_GET(eh, struct ip6_ext *, m,
1016 eoff, sizeof(*eh));
1017 if (eh == NULL) {
1018 icmp6stat.icp6s_tooshort++;
1019 return -1;
1020 }
1021#endif
1022
1023 if (nxt == IPPROTO_AH) {
1024 eoff += (eh->ip6e_len + 2) << 2;
1025 } else {
1026 eoff += (eh->ip6e_len + 1) << 3;
1027 }
1028 nxt = eh->ip6e_nxt;
1029 break;
1030 case IPPROTO_ROUTING:
1031 /*
1032 * When the erroneous packet contains a
1033 * routing header, we should examine the
1034 * header to determine the final destination.
1035 * Otherwise, we can't properly update
1036 * information that depends on the final
1037 * destination (e.g. path MTU).
1038 */
1039#ifndef PULLDOWN_TEST
1040 IP6_EXTHDR_CHECK(m, 0, eoff + sizeof(*rth),
1041 return -1);
1042 rth = (struct ip6_rthdr *)
1043 (mtod(m, caddr_t) + eoff);
1044#else
1045 IP6_EXTHDR_GET(rth, struct ip6_rthdr *, m,
1046 eoff, sizeof(*rth));
1047 if (rth == NULL) {
1048 icmp6stat.icp6s_tooshort++;
1049 return -1;
1050 }
1051#endif
1052 rthlen = (rth->ip6r_len + 1) << 3;
1053 /*
1054 * XXX: currently there is no
1055 * officially defined type other
1056 * than type-0.
1057 * Note that if the segment left field
1058 * is 0, all intermediate hops must
1059 * have been passed.
1060 */
1061 if (rth->ip6r_segleft &&
1062 rth->ip6r_type == IPV6_RTHDR_TYPE_0) {
1063 int hops;
1064
1065#ifndef PULLDOWN_TEST
1066 IP6_EXTHDR_CHECK(m, 0, eoff + rthlen,
1067 return -1);
1068 rth0 = (struct ip6_rthdr0 *)(mtod(m, caddr_t) + eoff);
1069#else
1070 IP6_EXTHDR_GET(rth0,
1071 struct ip6_rthdr0 *, m,
1072 eoff, rthlen);
1073 if (rth0 == NULL) {
1074 icmp6stat.icp6s_tooshort++;
1075 return -1;
1076 }
1077#endif
1078 /* just ignore a bogus header */
1079 if ((rth0->ip6r0_len % 2) == 0 &&
1080 (hops = rth0->ip6r0_len / 2)) {
1081 icmp6dst.sin6_addr = *((struct in6_addr *)(void *)(rth0 + 1) + (hops - 1));
1082 }
1083 }
1084 eoff += rthlen;
1085 nxt = rth->ip6r_nxt;
1086 break;
1087 case IPPROTO_FRAGMENT:
1088#ifndef PULLDOWN_TEST
1089 IP6_EXTHDR_CHECK(m, 0, eoff +
1090 sizeof(struct ip6_frag),
1091 return -1);
1092 fh = (struct ip6_frag *)(mtod(m, caddr_t)
1093 + eoff);
1094#else
1095 IP6_EXTHDR_GET(fh, struct ip6_frag *, m,
1096 eoff, sizeof(*fh));
1097 if (fh == NULL) {
1098 icmp6stat.icp6s_tooshort++;
1099 return -1;
1100 }
1101#endif
1102 /*
1103 * Data after a fragment header is meaningless
1104 * unless it is the first fragment, but
1105 * we'll go to the notify label for path MTU
1106 * discovery.
1107 */
1108 if (fh->ip6f_offlg & IP6F_OFF_MASK) {
1109 goto notify;
1110 }
1111
1112 eoff += sizeof(struct ip6_frag);
1113 nxt = fh->ip6f_nxt;
1114 break;
1115 default:
1116 /*
1117 * This case includes ESP and the No Next
1118 * Header. In such cases going to the notify
1119 * label does not have any meaning
1120 * (i.e. ctlfunc will be NULL), but we go
1121 * anyway since we might have to update
1122 * path MTU information.
1123 */
1124 goto notify;
1125 }
1126 }
1127notify:
1128#ifndef PULLDOWN_TEST
1129 icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
1130#else
1131 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,
1132 sizeof(*icmp6) + sizeof(struct ip6_hdr));
1133 if (icmp6 == NULL) {
1134 icmp6stat.icp6s_tooshort++;
1135 return -1;
1136 }
1137#endif
1138
1139 /*
1140 * retrieve parameters from the inner IPv6 header, and convert
1141 * them into sockaddr structures.
1142 * XXX: there is no guarantee that the source or destination
1143 * addresses of the inner packet are in the same scope as
1144 * the addresses of the icmp packet. But there is no other
1145 * way to determine the zone.
1146 */
1147 eip6 = (struct ip6_hdr *)(icmp6 + 1);
1148
1149 icmp6dst.sin6_len = sizeof(struct sockaddr_in6);
1150 icmp6dst.sin6_family = AF_INET6;
1151 if (IN6_IS_ADDR_UNSPECIFIED(&icmp6dst.sin6_addr)) {
1152 icmp6dst.sin6_addr = eip6->ip6_dst;
1153 }
1154 if (in6_setscope(&icmp6dst.sin6_addr, m->m_pkthdr.rcvif, IN6_NULL_IF_EMBEDDED_SCOPE(&icmp6dst.sin6_scope_id))) {
1155 goto freeit;
1156 }
1157 bzero(s: &icmp6src, n: sizeof(icmp6src));
1158 icmp6src.sin6_len = sizeof(struct sockaddr_in6);
1159 icmp6src.sin6_family = AF_INET6;
1160 icmp6src.sin6_addr = eip6->ip6_src;
1161 if (in6_setscope(&icmp6src.sin6_addr, m->m_pkthdr.rcvif, IN6_NULL_IF_EMBEDDED_SCOPE(&icmp6dst.sin6_scope_id))) {
1162 goto freeit;
1163 }
1164 icmp6src.sin6_flowinfo =
1165 (eip6->ip6_flow & IPV6_FLOWLABEL_MASK);
1166
1167 ip6cp.ip6c_m = m;
1168 ip6cp.ip6c_icmp6 = icmp6;
1169 ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1);
1170 ip6cp.ip6c_off = eoff;
1171 ip6cp.ip6c_finaldst = &icmp6dst.sin6_addr;
1172 ip6cp.ip6c_src = &icmp6src;
1173 ip6cp.ip6c_nxt = nxt;
1174
1175 if (icmp6type == ICMP6_PACKET_TOO_BIG) {
1176 notifymtu = ntohl(icmp6->icmp6_mtu);
1177 ip6cp.ip6c_cmdarg = (void *)&notifymtu;
1178 icmp6_mtudisc_update(&ip6cp, 1); /*XXX*/
1179 }
1180
1181 ctlfunc = ip6_protox[nxt]->pr_ctlinput;
1182 if (ctlfunc) {
1183 LCK_MTX_ASSERT(inet6_domain_mutex, LCK_MTX_ASSERT_OWNED);
1184
1185 lck_mtx_unlock(lck: inet6_domain_mutex);
1186
1187 (void) (*ctlfunc)(code, (struct sockaddr *)&icmp6dst,
1188 &ip6cp, m->m_pkthdr.rcvif);
1189
1190 lck_mtx_lock(lck: inet6_domain_mutex);
1191 }
1192 }
1193 return 0;
1194
1195freeit:
1196 m_freem(m);
1197 return -1;
1198}
1199
1200void
1201icmp6_mtudisc_update(struct ip6ctlparam *ip6cp, int validated)
1202{
1203 struct in6_addr *dst = ip6cp->ip6c_finaldst;
1204 struct icmp6_hdr *icmp6 = ip6cp->ip6c_icmp6;
1205 struct mbuf *m = ip6cp->ip6c_m; /* will be necessary for scope issue */
1206 u_int mtu = ntohl(icmp6->icmp6_mtu);
1207 struct rtentry *rt = NULL;
1208 struct sockaddr_in6 sin6;
1209 /*
1210 * we reject ICMPv6 too big with abnormally small value.
1211 * XXX what is the good definition of "abnormally small"?
1212 */
1213 if (mtu < sizeof(struct ip6_hdr) + sizeof(struct ip6_frag) + 8) {
1214 return;
1215 }
1216
1217 if (!validated) {
1218 return;
1219 }
1220
1221 /* Limit the MTU to the minimum IPv6 MTU */
1222 if (mtu < IPV6_MMTU) {
1223 mtu = IPV6_MMTU;
1224 }
1225
1226 bzero(s: &sin6, n: sizeof(sin6));
1227 sin6.sin6_family = PF_INET6;
1228 sin6.sin6_len = sizeof(struct sockaddr_in6);
1229 sin6.sin6_addr = *dst;
1230 /* XXX normally, this won't happen */
1231 if (in6_embedded_scope && IN6_IS_ADDR_LINKLOCAL(dst)) {
1232 sin6.sin6_addr.s6_addr16[1] =
1233 htons(m->m_pkthdr.rcvif->if_index);
1234 }
1235 /* sin6.sin6_scope_id = XXX: should be set if DST is a scoped addr */
1236 /*
1237 * XXX On a side note, for asymmetric data-path
1238 * the lookup on receive interace is probably not
1239 * what we want to do.
1240 * That requires looking at the cached route for the
1241 * protocol control block.
1242 */
1243 rt = rtalloc1_scoped((struct sockaddr *)&sin6, 0,
1244 RTF_CLONING | RTF_PRCLONING, m->m_pkthdr.rcvif->if_index);
1245 if (rt != NULL) {
1246 RT_LOCK(rt);
1247 if ((rt->rt_flags & RTF_HOST) &&
1248 !(rt->rt_rmx.rmx_locks & RTV_MTU) &&
1249 mtu < IN6_LINKMTU(rt->rt_ifp) &&
1250 rt->rt_rmx.rmx_mtu > mtu) {
1251 icmp6stat.icp6s_pmtuchg++;
1252 rt->rt_rmx.rmx_mtu = mtu;
1253 }
1254 RT_UNLOCK(rt);
1255 rtfree(rt);
1256 }
1257}
1258
1259/*
1260 * Process a Node Information Query packet, based on
1261 * draft-ietf-ipngwg-icmp-name-lookups-07.
1262 *
1263 * Spec incompatibilities:
1264 * - IPv6 Subject address handling
1265 * - IPv4 Subject address handling support missing
1266 * - Proxy reply (answer even if it's not for me)
1267 * - joins NI group address at in6_ifattach() time only, does not cope
1268 * with hostname changes by sethostname(3)
1269 */
1270#define hostnamelen (uint32_t)strlen(hostname)
1271static struct mbuf *
1272ni6_input(struct mbuf *m, int off)
1273{
1274 struct icmp6_nodeinfo *ni6, *nni6;
1275 struct mbuf *n = NULL;
1276 u_int16_t qtype;
1277 int subjlen;
1278 int replylen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo);
1279 struct ni_reply_fqdn *fqdn;
1280 int addrs; /* for NI_QTYPE_NODEADDR */
1281 struct ifnet *ifp = NULL; /* for NI_QTYPE_NODEADDR */
1282 struct sockaddr_in6 sin6; /* double meaning; ip6_dst and subjectaddr */
1283 struct sockaddr_in6 sin6_d; /* XXX: we should retrieve this from m_aux */
1284 struct ip6_hdr *ip6;
1285 int oldfqdn = 0; /* if 1, return pascal string (03 draft) */
1286 char *subj = NULL;
1287
1288 ip6 = mtod(m, struct ip6_hdr *);
1289#ifndef PULLDOWN_TEST
1290 ni6 = (struct icmp6_nodeinfo *)(mtod(m, caddr_t) + off);
1291#else
1292 IP6_EXTHDR_GET(ni6, struct icmp6_nodeinfo *, m, off, sizeof(*ni6));
1293 if (ni6 == NULL) {
1294 /* m is already reclaimed */
1295 return NULL;
1296 }
1297#endif
1298
1299 /*
1300 * Validate IPv6 source address.
1301 * The default configuration MUST be to refuse answering queries from
1302 * global-scope addresses according to RFC4602.
1303 * Notes:
1304 * - it's not very clear what "refuse" means; this implementation
1305 * simply drops it.
1306 * - it's not very easy to identify global-scope (unicast) addresses
1307 * since there are many prefixes for them. It should be safer
1308 * and in practice sufficient to check "all" but loopback and
1309 * link-local (note that site-local unicast was deprecated and
1310 * ULA is defined as global scope-wise)
1311 */
1312 if ((icmp6_nodeinfo & ICMP6_NODEINFO_GLOBALOK) == 0 &&
1313 !IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) &&
1314 !IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src)) {
1315 goto bad;
1316 }
1317
1318 /*
1319 * Validate IPv6 destination address.
1320 *
1321 * The Responder must discard the Query without further processing
1322 * unless it is one of the Responder's unicast or anycast addresses, or
1323 * a link-local scope multicast address which the Responder has joined.
1324 * [RFC4602, Section 5.]
1325 */
1326 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1327 if (!IN6_IS_ADDR_MC_LINKLOCAL(&ip6->ip6_dst) &&
1328 !IN6_IS_ADDR_MC_UNICAST_BASED_LINKLOCAL(&ip6->ip6_dst)) {
1329 goto bad;
1330 }
1331 /* else it's a link-local multicast, fine */
1332 } else { /* unicast or anycast */
1333 uint32_t ia6_flags;
1334
1335 if (ip6_getdstifaddr_info(m, NULL, &ia6_flags) != 0) {
1336 goto bad; /* XXX impossible */
1337 }
1338 if ((ia6_flags & IN6_IFF_TEMPORARY) &&
1339 !(icmp6_nodeinfo & ICMP6_NODEINFO_TMPADDROK)) {
1340 nd6log(debug, "ni6_input: ignore node info to a temporary address in %s:%d",
1341 __func__, __LINE__);
1342 goto bad;
1343 }
1344 }
1345
1346 /* validate query Subject field. */
1347 qtype = ntohs(ni6->ni_qtype);
1348 subjlen = m->m_pkthdr.len - off - sizeof(struct icmp6_nodeinfo);
1349 switch (qtype) {
1350 case NI_QTYPE_NOOP:
1351 case NI_QTYPE_SUPTYPES:
1352 /* 07 draft */
1353 if (ni6->ni_code == ICMP6_NI_SUBJ_FQDN && subjlen == 0) {
1354 break;
1355 }
1356 OS_FALLTHROUGH;
1357 case NI_QTYPE_FQDN:
1358 case NI_QTYPE_NODEADDR:
1359 case NI_QTYPE_IPV4ADDR:
1360 switch (ni6->ni_code) {
1361 case ICMP6_NI_SUBJ_IPV6:
1362#if ICMP6_NI_SUBJ_IPV6 != 0
1363 case 0:
1364#endif
1365 /*
1366 * backward compatibility - try to accept 03 draft
1367 * format, where no Subject is present.
1368 */
1369 if (qtype == NI_QTYPE_FQDN && ni6->ni_code == 0 &&
1370 subjlen == 0) {
1371 oldfqdn++;
1372 break;
1373 }
1374#if ICMP6_NI_SUBJ_IPV6 != 0
1375 if (ni6->ni_code != ICMP6_NI_SUBJ_IPV6) {
1376 goto bad;
1377 }
1378#endif
1379
1380 if (subjlen != sizeof(struct in6_addr)) {
1381 goto bad;
1382 }
1383
1384 /*
1385 * Validate Subject address.
1386 *
1387 * Not sure what exactly "address belongs to the node"
1388 * means in the spec, is it just unicast, or what?
1389 *
1390 * At this moment we consider Subject address as
1391 * "belong to the node" if the Subject address equals
1392 * to the IPv6 destination address; validation for
1393 * IPv6 destination address should have done enough
1394 * check for us.
1395 *
1396 * We do not do proxy at this moment.
1397 */
1398 /* m_pulldown instead of copy? */
1399 m_copydata(m, off + sizeof(struct icmp6_nodeinfo),
1400 subjlen, (caddr_t)&sin6.sin6_addr);
1401 sin6.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif,
1402 &sin6.sin6_addr);
1403 in6_embedscope(&sin6.sin6_addr, &sin6, NULL, NULL,
1404 NULL, IN6_NULL_IF_EMBEDDED_SCOPE(&sin6.sin6_scope_id));
1405 bzero(s: &sin6_d, n: sizeof(sin6_d));
1406 sin6_d.sin6_family = AF_INET6; /* not used, actually */
1407 sin6_d.sin6_len = sizeof(sin6_d); /* ditto */
1408 sin6_d.sin6_addr = ip6->ip6_dst;
1409 sin6_d.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif,
1410 &ip6->ip6_dst);
1411 in6_embedscope(&sin6_d.sin6_addr, &sin6_d, NULL, NULL,
1412 NULL, IN6_NULL_IF_EMBEDDED_SCOPE(&sin6_d.sin6_scope_id));
1413 subj = (char *)&sin6;
1414 if (SA6_ARE_ADDR_EQUAL(&sin6, &sin6_d)) {
1415 break;
1416 }
1417
1418 /*
1419 * XXX if we are to allow other cases, we should really
1420 * be careful about scope here.
1421 * basically, we should disallow queries toward IPv6
1422 * destination X with subject Y,
1423 * if scope(X) > scope(Y).
1424 * if we allow scope(X) > scope(Y), it will result in
1425 * information leakage across scope boundary.
1426 */
1427 goto bad;
1428
1429 case ICMP6_NI_SUBJ_FQDN:
1430 /*
1431 * Validate Subject name with gethostname(3).
1432 *
1433 * The behavior may need some debate, since:
1434 * - we are not sure if the node has FQDN as
1435 * hostname (returned by gethostname(3)).
1436 * - the code does wildcard match for truncated names.
1437 * however, we are not sure if we want to perform
1438 * wildcard match, if gethostname(3) side has
1439 * truncated hostname.
1440 */
1441 lck_mtx_lock(lck: &hostname_lock);
1442 n = ni6_nametodns(hostname, hostnamelen, 0);
1443 lck_mtx_unlock(lck: &hostname_lock);
1444 if (!n || n->m_next || n->m_len == 0) {
1445 goto bad;
1446 }
1447 IP6_EXTHDR_GET(subj, char *, m,
1448 off + sizeof(struct icmp6_nodeinfo), subjlen);
1449 if (subj == NULL) {
1450 goto bad;
1451 }
1452 if (!ni6_dnsmatch(subj, subjlen, mtod(n, const char *),
1453 n->m_len)) {
1454 goto bad;
1455 }
1456 m_freem(n);
1457 n = NULL;
1458 break;
1459
1460 case ICMP6_NI_SUBJ_IPV4: /* XXX: to be implemented? */
1461 default:
1462 goto bad;
1463 }
1464 break;
1465 }
1466
1467 /* refuse based on configuration. XXX ICMP6_NI_REFUSED? */
1468 switch (qtype) {
1469 case NI_QTYPE_FQDN:
1470 if ((icmp6_nodeinfo & ICMP6_NODEINFO_FQDNOK) == 0) {
1471 goto bad;
1472 }
1473 break;
1474 case NI_QTYPE_NODEADDR:
1475 case NI_QTYPE_IPV4ADDR:
1476 if ((icmp6_nodeinfo & ICMP6_NODEINFO_NODEADDROK) == 0) {
1477 goto bad;
1478 }
1479 break;
1480 }
1481
1482 /* guess reply length */
1483 switch (qtype) {
1484 case NI_QTYPE_NOOP:
1485 break; /* no reply data */
1486 case NI_QTYPE_SUPTYPES:
1487 replylen += sizeof(u_int32_t);
1488 break;
1489 case NI_QTYPE_FQDN:
1490 /* XXX will append an mbuf */
1491 replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_namelen);
1492 break;
1493 case NI_QTYPE_NODEADDR:
1494 addrs = ni6_addrs(ni6, &ifp, subj);
1495 if ((replylen += addrs * (sizeof(struct in6_addr) +
1496 sizeof(u_int32_t))) > MCLBYTES) {
1497 replylen = MCLBYTES; /* XXX: will truncate pkt later */
1498 }
1499 break;
1500 case NI_QTYPE_IPV4ADDR:
1501 /* unsupported - should respond with unknown Qtype? */
1502 break;
1503 default:
1504 /*
1505 * XXX: We must return a reply with the ICMP6 code
1506 * `unknown Qtype' in this case. However we regard the case
1507 * as an FQDN query for backward compatibility.
1508 * Older versions set a random value to this field,
1509 * so it rarely varies in the defined qtypes.
1510 * But the mechanism is not reliable...
1511 * maybe we should obsolete older versions.
1512 */
1513 qtype = NI_QTYPE_FQDN;
1514 /* XXX will append an mbuf */
1515 replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_namelen);
1516 oldfqdn++;
1517 break;
1518 }
1519
1520 /* allocate an mbuf to reply. */
1521 MGETHDR(n, M_DONTWAIT, m->m_type); /* MAC-OK */
1522 if (n == NULL) {
1523 m_freem(m);
1524 if (ifp != NULL) {
1525 ifnet_release(interface: ifp);
1526 }
1527 return NULL;
1528 }
1529 M_COPY_PKTHDR(n, m); /* just for recvif */
1530 if (replylen > MHLEN) {
1531 if (replylen > MCLBYTES) {
1532 /*
1533 * XXX: should we try to allocate more? But MCLBYTES
1534 * is probably much larger than IPV6_MMTU...
1535 */
1536 goto bad;
1537 }
1538 MCLGET(n, M_DONTWAIT);
1539 if ((n->m_flags & M_EXT) == 0) {
1540 goto bad;
1541 }
1542 }
1543 n->m_pkthdr.len = n->m_len = replylen;
1544
1545 /* copy mbuf header and IPv6 + Node Information base headers */
1546 bcopy(mtod(m, caddr_t), mtod(n, caddr_t), n: sizeof(struct ip6_hdr));
1547 nni6 = (struct icmp6_nodeinfo *)(mtod(n, struct ip6_hdr *) + 1);
1548 bcopy(src: (caddr_t)ni6, dst: (caddr_t)nni6, n: sizeof(struct icmp6_nodeinfo));
1549
1550 /* qtype dependent procedure */
1551 switch (qtype) {
1552 case NI_QTYPE_NOOP:
1553 nni6->ni_code = ICMP6_NI_SUCCESS;
1554 nni6->ni_flags = 0;
1555 break;
1556 case NI_QTYPE_SUPTYPES:
1557 {
1558 u_int32_t v;
1559 nni6->ni_code = ICMP6_NI_SUCCESS;
1560 nni6->ni_flags = htons(0x0000); /* raw bitmap */
1561 /* supports NOOP, SUPTYPES, FQDN, and NODEADDR */
1562 v = (u_int32_t)htonl(0x0000000f);
1563 bcopy(src: &v, dst: nni6 + 1, n: sizeof(u_int32_t));
1564 break;
1565 }
1566 case NI_QTYPE_FQDN:
1567 nni6->ni_code = ICMP6_NI_SUCCESS;
1568 fqdn = (struct ni_reply_fqdn *)(mtod(n, caddr_t) +
1569 sizeof(struct ip6_hdr) +
1570 sizeof(struct icmp6_nodeinfo));
1571 nni6->ni_flags = 0; /* XXX: meaningless TTL */
1572 fqdn->ni_fqdn_ttl = 0; /* ditto. */
1573 /*
1574 * XXX do we really have FQDN in variable "hostname"?
1575 */
1576 lck_mtx_lock(lck: &hostname_lock);
1577 n->m_next = ni6_nametodns(hostname, hostnamelen, oldfqdn);
1578 lck_mtx_unlock(lck: &hostname_lock);
1579 if (n->m_next == NULL) {
1580 goto bad;
1581 }
1582 /* XXX we assume that n->m_next is not a chain */
1583 if (n->m_next->m_next != NULL) {
1584 goto bad;
1585 }
1586 n->m_pkthdr.len += n->m_next->m_len;
1587 break;
1588 case NI_QTYPE_NODEADDR:
1589 {
1590 int lenlim, copied;
1591
1592 nni6->ni_code = ICMP6_NI_SUCCESS;
1593 n->m_pkthdr.len = n->m_len =
1594 sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo);
1595 lenlim = (int)M_TRAILINGSPACE(n);
1596 copied = ni6_store_addrs(ni6, nni6, ifp, lenlim);
1597 /* XXX: reset mbuf length */
1598 n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) +
1599 sizeof(struct icmp6_nodeinfo) + copied;
1600 break;
1601 }
1602 default:
1603 break; /* XXX impossible! */
1604 }
1605
1606 nni6->ni_type = ICMP6_NI_REPLY;
1607 m_freem(m);
1608 if (ifp != NULL) {
1609 ifnet_release(interface: ifp);
1610 }
1611 return n;
1612
1613bad:
1614 m_freem(m);
1615 if (n) {
1616 m_freem(n);
1617 }
1618 if (ifp != NULL) {
1619 ifnet_release(interface: ifp);
1620 }
1621 return NULL;
1622}
1623#undef hostnamelen
1624
1625/*
1626 * make a mbuf with DNS-encoded string. no compression support.
1627 *
1628 * XXX names with less than 2 dots (like "foo" or "foo.section") will be
1629 * treated as truncated name (two \0 at the end). this is a wild guess.
1630 */
1631static struct mbuf *
1632ni6_nametodns(
1633 const char *name,
1634 uint32_t namelen,
1635 int old) /* return pascal string if non-zero */
1636{
1637 struct mbuf *m;
1638 char *cp, *ep;
1639 const char *p, *q;
1640 int i, nterm;
1641 uint32_t len;
1642
1643 if (old) {
1644 len = namelen + 1;
1645 } else {
1646 len = MCLBYTES;
1647 }
1648
1649 /* because MAXHOSTNAMELEN is usually 256, we use cluster mbuf */
1650 MGET(m, M_DONTWAIT, MT_DATA);
1651 if (m && len > MLEN) {
1652 MCLGET(m, M_DONTWAIT);
1653 if ((m->m_flags & M_EXT) == 0) {
1654 goto fail;
1655 }
1656 }
1657 if (!m) {
1658 goto fail;
1659 }
1660 m->m_next = NULL;
1661
1662 if (old) {
1663 m->m_len = len;
1664 *mtod(m, char *) = (char)namelen;
1665 bcopy(src: name, mtod(m, char *) + 1, n: namelen);
1666 return m;
1667 } else {
1668 m->m_len = 0;
1669 cp = mtod(m, char *);
1670 ep = mtod(m, char *) + M_TRAILINGSPACE(m);
1671
1672 /* if not certain about my name, return empty buffer */
1673 if (namelen == 0) {
1674 return m;
1675 }
1676
1677 /*
1678 * guess if it looks like shortened hostname, or FQDN.
1679 * shortened hostname needs two trailing "\0".
1680 */
1681 i = 0;
1682 for (p = name; p < name + namelen; p++) {
1683 if (*p && *p == '.') {
1684 i++;
1685 }
1686 }
1687 if (i < 2) {
1688 nterm = 2;
1689 } else {
1690 nterm = 1;
1691 }
1692
1693 p = name;
1694 while (cp < ep && p < name + namelen) {
1695 i = 0;
1696 for (q = p; q < name + namelen && *q && *q != '.'; q++) {
1697 i++;
1698 }
1699 /* result does not fit into mbuf */
1700 if (cp + i + 1 >= ep) {
1701 goto fail;
1702 }
1703 /*
1704 * DNS label length restriction, RFC1035 page 8.
1705 * "i == 0" case is included here to avoid returning
1706 * 0-length label on "foo..bar".
1707 */
1708 if (i <= 0 || i >= 64) {
1709 goto fail;
1710 }
1711 *cp++ = (char)i;
1712 bcopy(src: p, dst: cp, n: i);
1713 cp += i;
1714 p = q;
1715 if (p < name + namelen && *p == '.') {
1716 p++;
1717 }
1718 }
1719 /* termination */
1720 if (cp + nterm >= ep) {
1721 goto fail;
1722 }
1723 while (nterm-- > 0) {
1724 *cp++ = '\0';
1725 }
1726 m->m_len = (int32_t)(cp - mtod(m, char *));
1727 return m;
1728 }
1729
1730 panic("should not reach here");
1731 /* NOTREACHED */
1732
1733fail:
1734 if (m) {
1735 m_freem(m);
1736 }
1737 return NULL;
1738}
1739
1740/*
1741 * check if two DNS-encoded string matches. takes care of truncated
1742 * form (with \0\0 at the end). no compression support.
1743 * XXX upper/lowercase match (see RFC2065)
1744 */
1745static int
1746ni6_dnsmatch(const char *a, int alen, const char *b, int blen)
1747{
1748 const char *a0, *b0;
1749 int l;
1750
1751 /* simplest case - need validation? */
1752 if (alen == blen && bcmp(s1: a, s2: b, n: alen) == 0) {
1753 return 1;
1754 }
1755
1756 a0 = a;
1757 b0 = b;
1758
1759 /* termination is mandatory */
1760 if (alen < 2 || blen < 2) {
1761 return 0;
1762 }
1763 if (a0[alen - 1] != '\0' || b0[blen - 1] != '\0') {
1764 return 0;
1765 }
1766 alen--;
1767 blen--;
1768
1769 while (a - a0 < alen && b - b0 < blen) {
1770 if (a - a0 + 1 > alen || b - b0 + 1 > blen) {
1771 return 0;
1772 }
1773
1774 if ((signed char)a[0] < 0 || (signed char)b[0] < 0) {
1775 return 0;
1776 }
1777 /* we don't support compression yet */
1778 if (a[0] >= 64 || b[0] >= 64) {
1779 return 0;
1780 }
1781
1782 /* truncated case */
1783 if (a[0] == 0 && a - a0 == alen - 1) {
1784 return 1;
1785 }
1786 if (b[0] == 0 && b - b0 == blen - 1) {
1787 return 1;
1788 }
1789 if (a[0] == 0 || b[0] == 0) {
1790 return 0;
1791 }
1792
1793 if (a[0] != b[0]) {
1794 return 0;
1795 }
1796 l = a[0];
1797 if (a - a0 + 1 + l > alen || b - b0 + 1 + l > blen) {
1798 return 0;
1799 }
1800 if (bcmp(s1: a + 1, s2: b + 1, n: l) != 0) {
1801 return 0;
1802 }
1803
1804 a += 1 + l;
1805 b += 1 + l;
1806 }
1807
1808 if (a - a0 == alen && b - b0 == blen) {
1809 return 1;
1810 } else {
1811 return 0;
1812 }
1813}
1814
1815/*
1816 * calculate the number of addresses to be returned in the node info reply.
1817 */
1818static int
1819ni6_addrs(struct icmp6_nodeinfo *ni6, struct ifnet **ifpp, char *subj)
1820{
1821 struct ifnet *ifp;
1822 struct in6_ifaddr *ifa6;
1823 struct ifaddr *ifa;
1824 struct sockaddr_in6 *subj_ip6 = NULL; /* XXX pedant */
1825 int addrs = 0, addrsofif, iffound = 0;
1826 int niflags = ni6->ni_flags;
1827
1828 if (ifpp != NULL) {
1829 *ifpp = NULL;
1830 }
1831
1832 if ((niflags & NI_NODEADDR_FLAG_ALL) == 0) {
1833 switch (ni6->ni_code) {
1834 case ICMP6_NI_SUBJ_IPV6:
1835 if (subj == NULL) { /* must be impossible... */
1836 return 0;
1837 }
1838 subj_ip6 = (struct sockaddr_in6 *)(void *)subj;
1839 break;
1840 default:
1841 /*
1842 * XXX: we only support IPv6 subject address for
1843 * this Qtype.
1844 */
1845 return 0;
1846 }
1847 }
1848
1849 ifnet_head_lock_shared();
1850 TAILQ_FOREACH(ifp, &ifnet_head, if_list) {
1851 addrsofif = 0;
1852 ifnet_lock_shared(ifp);
1853 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
1854 {
1855 IFA_LOCK(ifa);
1856 if (ifa->ifa_addr->sa_family != AF_INET6) {
1857 IFA_UNLOCK(ifa);
1858 continue;
1859 }
1860 ifa6 = (struct in6_ifaddr *)ifa;
1861
1862 if ((niflags & NI_NODEADDR_FLAG_ALL) == 0 &&
1863 IN6_ARE_ADDR_EQUAL(&subj_ip6->sin6_addr,
1864 &ifa6->ia_addr.sin6_addr)) {
1865 iffound = 1;
1866 }
1867
1868 /*
1869 * IPv4-mapped addresses can only be returned by a
1870 * Node Information proxy, since they represent
1871 * addresses of IPv4-only nodes, which perforce do
1872 * not implement this protocol.
1873 * [icmp-name-lookups-07, Section 5.4]
1874 * So we don't support NI_NODEADDR_FLAG_COMPAT in
1875 * this function at this moment.
1876 */
1877
1878 /* What do we have to do about ::1? */
1879 switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
1880 case IPV6_ADDR_SCOPE_LINKLOCAL:
1881 if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0) {
1882 IFA_UNLOCK(ifa);
1883 continue;
1884 }
1885 break;
1886 case IPV6_ADDR_SCOPE_SITELOCAL:
1887 if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0) {
1888 IFA_UNLOCK(ifa);
1889 continue;
1890 }
1891 break;
1892 case IPV6_ADDR_SCOPE_GLOBAL:
1893 if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0) {
1894 IFA_UNLOCK(ifa);
1895 continue;
1896 }
1897 break;
1898 default:
1899 IFA_UNLOCK(ifa);
1900 continue;
1901 }
1902
1903 /*
1904 * check if anycast is okay.
1905 * XXX: just experimental. not in the spec.
1906 */
1907 if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 &&
1908 (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0) {
1909 IFA_UNLOCK(ifa);
1910 continue; /* we need only unicast addresses */
1911 }
1912 if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
1913 (icmp6_nodeinfo & ICMP6_NODEINFO_TMPADDROK) == 0) {
1914 IFA_UNLOCK(ifa);
1915 continue;
1916 }
1917 addrsofif++; /* count the address */
1918 IFA_UNLOCK(ifa);
1919 }
1920 ifnet_lock_done(ifp);
1921 if (iffound) {
1922 if (ifpp != NULL) {
1923 *ifpp = ifp;
1924 ifnet_reference(interface: ifp);
1925 }
1926 ifnet_head_done();
1927 return addrsofif;
1928 }
1929
1930 addrs += addrsofif;
1931 }
1932 ifnet_head_done();
1933
1934 return addrs;
1935}
1936
1937static int
1938ni6_store_addrs(struct icmp6_nodeinfo *ni6, struct icmp6_nodeinfo *nni6,
1939 struct ifnet *ifp0, int resid)
1940{
1941 struct ifnet *ifp = ifp0;
1942 struct in6_ifaddr *ifa6;
1943 struct ifaddr *ifa;
1944 struct ifnet *ifp_dep = NULL;
1945 int copied = 0, allow_deprecated = 0;
1946 u_char *cp = (u_char *)(nni6 + 1);
1947 int niflags = ni6->ni_flags;
1948 u_int32_t ltime;
1949 uint64_t now = net_uptime();
1950
1951 if (ifp0 == NULL && !(niflags & NI_NODEADDR_FLAG_ALL)) {
1952 return 0; /* needless to copy */
1953 }
1954again:
1955
1956 ifnet_head_lock_shared();
1957 if (ifp == NULL) {
1958 ifp = TAILQ_FIRST(&ifnet_head);
1959 }
1960
1961 for (; ifp; ifp = TAILQ_NEXT(ifp, if_list)) {
1962 ifnet_lock_shared(ifp);
1963 for (ifa = ifp->if_addrlist.tqh_first; ifa;
1964 ifa = ifa->ifa_list.tqe_next) {
1965 struct in6_addrlifetime_i *lt;
1966
1967 IFA_LOCK(ifa);
1968 if (ifa->ifa_addr->sa_family != AF_INET6) {
1969 IFA_UNLOCK(ifa);
1970 continue;
1971 }
1972 ifa6 = (struct in6_ifaddr *)ifa;
1973
1974 if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) != 0 &&
1975 allow_deprecated == 0) {
1976 /*
1977 * prefererred address should be put before
1978 * deprecated addresses.
1979 */
1980
1981 /* record the interface for later search */
1982 if (ifp_dep == NULL) {
1983 ifp_dep = ifp;
1984 }
1985
1986 IFA_UNLOCK(ifa);
1987 continue;
1988 } else if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) == 0 &&
1989 allow_deprecated != 0) {
1990 IFA_UNLOCK(ifa);
1991 continue; /* we now collect deprecated addrs */
1992 }
1993 /* What do we have to do about ::1? */
1994 switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
1995 case IPV6_ADDR_SCOPE_LINKLOCAL:
1996 if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0) {
1997 IFA_UNLOCK(ifa);
1998 continue;
1999 }
2000 break;
2001 case IPV6_ADDR_SCOPE_SITELOCAL:
2002 if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0) {
2003 IFA_UNLOCK(ifa);
2004 continue;
2005 }
2006 break;
2007 case IPV6_ADDR_SCOPE_GLOBAL:
2008 if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0) {
2009 IFA_UNLOCK(ifa);
2010 continue;
2011 }
2012 break;
2013 default:
2014 IFA_UNLOCK(ifa);
2015 continue;
2016 }
2017
2018 /*
2019 * check if anycast is okay.
2020 * XXX: just experimental. not in the spec.
2021 */
2022 if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 &&
2023 (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0) {
2024 IFA_UNLOCK(ifa);
2025 continue;
2026 }
2027 if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
2028 (icmp6_nodeinfo & ICMP6_NODEINFO_TMPADDROK) == 0) {
2029 IFA_UNLOCK(ifa);
2030 continue;
2031 }
2032
2033 /* now we can copy the address */
2034 if (resid < sizeof(struct in6_addr) +
2035 sizeof(u_int32_t)) {
2036 IFA_UNLOCK(ifa);
2037 /*
2038 * We give up much more copy.
2039 * Set the truncate flag and return.
2040 */
2041 nni6->ni_flags |=
2042 NI_NODEADDR_FLAG_TRUNCATE;
2043 ifnet_lock_done(ifp);
2044 ifnet_head_done();
2045 return copied;
2046 }
2047
2048 /*
2049 * Set the TTL of the address.
2050 * The TTL value should be one of the following
2051 * according to the specification:
2052 *
2053 * 1. The remaining lifetime of a DHCP lease on the
2054 * address, or
2055 * 2. The remaining Valid Lifetime of a prefix from
2056 * which the address was derived through Stateless
2057 * Autoconfiguration.
2058 *
2059 * Note that we currently do not support stateful
2060 * address configuration by DHCPv6, so the former
2061 * case can't happen.
2062 */
2063 lt = &ifa6->ia6_lifetime;
2064 if (lt->ia6ti_expire == 0) {
2065 ltime = ND6_INFINITE_LIFETIME;
2066 } else {
2067 if (lt->ia6ti_expire > now) {
2068 ltime = htonl((uint32_t)(lt->ia6ti_expire - now));
2069 } else {
2070 ltime = 0;
2071 }
2072 }
2073
2074 bcopy(src: &ltime, dst: cp, n: sizeof(u_int32_t));
2075 cp += sizeof(u_int32_t);
2076
2077 /* copy the address itself */
2078 bcopy(src: &ifa6->ia_addr.sin6_addr, dst: cp,
2079 n: sizeof(struct in6_addr));
2080 /* XXX: KAME link-local hack; remove ifindex */
2081 if (IN6_IS_ADDR_LINKLOCAL(&ifa6->ia_addr.sin6_addr)) {
2082 ((struct in6_addr *)(void *)cp)->s6_addr16[1] = 0;
2083 }
2084 cp += sizeof(struct in6_addr);
2085
2086 resid -= (sizeof(struct in6_addr) + sizeof(u_int32_t));
2087 copied += (sizeof(struct in6_addr) +
2088 sizeof(u_int32_t));
2089 IFA_UNLOCK(ifa);
2090 }
2091 ifnet_lock_done(ifp);
2092 if (ifp0) { /* we need search only on the specified IF */
2093 break;
2094 }
2095 }
2096 ifnet_head_done();
2097
2098 if (allow_deprecated == 0 && ifp_dep != NULL) {
2099 ifp = ifp_dep;
2100 allow_deprecated = 1;
2101
2102 goto again;
2103 }
2104
2105 return copied;
2106}
2107
2108/*
2109 * XXX almost dup'ed code with rip6_input.
2110 */
2111static int
2112icmp6_rip6_input(struct mbuf **mp, int off)
2113{
2114 struct mbuf *m = *mp;
2115 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
2116 struct in6pcb *in6p;
2117 struct in6pcb *last = NULL;
2118 struct sockaddr_in6 rip6src;
2119 struct icmp6_hdr *icmp6;
2120 struct mbuf *opts = NULL;
2121 int ret = 0;
2122 struct ifnet *ifp = m->m_pkthdr.rcvif;
2123
2124#ifndef PULLDOWN_TEST
2125 /* this is assumed to be safe. */
2126 icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);
2127#else
2128 IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off, sizeof(*icmp6));
2129 if (icmp6 == NULL) {
2130 /* m is already reclaimed */
2131 return IPPROTO_DONE;
2132 }
2133#endif
2134
2135 /*
2136 * XXX: the address may have embedded scope zone ID, which should be
2137 * hidden from applications.
2138 */
2139 bzero(s: &rip6src, n: sizeof(rip6src));
2140 rip6src.sin6_family = AF_INET6;
2141 rip6src.sin6_len = sizeof(struct sockaddr_in6);
2142 rip6src.sin6_addr = ip6->ip6_src;
2143 if (!in6_embedded_scope) {
2144 rip6src.sin6_scope_id = IN6_IS_SCOPE_EMBED(&rip6src.sin6_addr) ? ip6_input_getsrcifscope(m) : IFSCOPE_NONE;
2145 }
2146 if (sa6_recoverscope(&rip6src, TRUE)) {
2147 return IPPROTO_DONE;
2148 }
2149
2150 lck_rw_lock_shared(lck: &ripcbinfo.ipi_lock);
2151 LIST_FOREACH(in6p, &ripcb, inp_list)
2152 {
2153 if ((in6p->inp_vflag & INP_IPV6) == 0) {
2154 continue;
2155 }
2156 if (in6p->in6p_ip6_nxt != IPPROTO_ICMPV6) {
2157 continue;
2158 }
2159 if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) &&
2160 !in6_are_addr_equal_scoped(&in6p->in6p_laddr, &ip6->ip6_dst, in6p->inp_lifscope, ifp->if_index)) {
2161 continue;
2162 }
2163 if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) &&
2164 !in6_are_addr_equal_scoped(&in6p->in6p_faddr, &ip6->ip6_src, in6p->inp_fifscope, ifp->if_index)) {
2165 continue;
2166 }
2167 if (in6p->in6p_icmp6filt
2168 && ICMP6_FILTER_WILLBLOCK(icmp6->icmp6_type,
2169 in6p->in6p_icmp6filt)) {
2170 continue;
2171 }
2172
2173 if (inp_restricted_recv(in6p, ifp)) {
2174 continue;
2175 }
2176
2177 if (last) {
2178 struct mbuf *n;
2179 if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
2180 if ((last->in6p_flags & INP_CONTROLOPTS) != 0 ||
2181 SOFLOW_ENABLED(last->in6p_socket) ||
2182 SO_RECV_CONTROL_OPTS(last->inp_socket)) {
2183 ret = ip6_savecontrol(last, n, &opts);
2184 if (ret != 0) {
2185 m_freem(n);
2186 m_freem(opts);
2187 last = in6p;
2188 continue;
2189 }
2190 }
2191 /* strip intermediate headers */
2192 m_adj(n, off);
2193 so_recv_data_stat(last->in6p_socket, m, 0);
2194 if (sbappendaddr(sb: &last->in6p_socket->so_rcv,
2195 asa: (struct sockaddr *)&rip6src,
2196 m0: n, control: opts, NULL) != 0) {
2197 sorwakeup(so: last->in6p_socket);
2198 }
2199 opts = NULL;
2200 }
2201 }
2202 last = in6p;
2203 }
2204 if (last) {
2205 if ((last->in6p_flags & INP_CONTROLOPTS) != 0 ||
2206 SOFLOW_ENABLED(last->in6p_socket) ||
2207 SO_RECV_CONTROL_OPTS(last->inp_socket)) {
2208 ret = ip6_savecontrol(last, m, &opts);
2209 if (ret != 0) {
2210 goto error;
2211 }
2212 }
2213 /* strip intermediate headers */
2214 m_adj(m, off);
2215 so_recv_data_stat(last->in6p_socket, m, 0);
2216 if (sbappendaddr(sb: &last->in6p_socket->so_rcv,
2217 asa: (struct sockaddr *)&rip6src, m0: m, control: opts, NULL) != 0) {
2218 sorwakeup(so: last->in6p_socket);
2219 }
2220 } else {
2221 goto error;
2222 }
2223 lck_rw_done(lck: &ripcbinfo.ipi_lock);
2224 return IPPROTO_DONE;
2225
2226error:
2227 lck_rw_done(lck: &ripcbinfo.ipi_lock);
2228 m_freem(m);
2229 m_freem(opts);
2230 ip6stat.ip6s_delivered--;
2231 return IPPROTO_DONE;
2232}
2233
2234/*
2235 * Reflect the ip6 packet back to the source.
2236 * OFF points to the icmp6 header, counted from the top of the mbuf.
2237 */
2238void
2239icmp6_reflect(struct mbuf *m, size_t off)
2240{
2241 struct mbuf *m_ip6hdr = m;
2242 struct ip6_hdr *ip6;
2243 struct icmp6_hdr *icmp6;
2244 struct in6_ifaddr *ia;
2245 struct in6_addr t, src_storage, *src = 0;
2246 int plen;
2247 int type, code;
2248 struct ifnet *outif = NULL;
2249 struct sockaddr_in6 sa6_src, sa6_dst;
2250 struct nd_ifinfo *ndi = NULL;
2251 u_int32_t oflow;
2252 uint32_t sifscope = IFSCOPE_NONE;
2253 uint32_t fifscope = IFSCOPE_NONE;
2254 uint32_t tifscope;
2255 struct ip6_out_args ip6oa;
2256
2257 bzero(s: &ip6oa, n: sizeof(ip6oa));
2258 ip6oa.ip6oa_boundif = IFSCOPE_NONE;
2259 ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR |
2260 IP6OAF_INTCOPROC_ALLOWED | IP6OAF_AWDL_UNRESTRICTED |
2261 IP6OAF_MANAGEMENT_ALLOWED;
2262 ip6oa.ip6oa_sotc = SO_TC_UNSPEC;
2263 ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
2264
2265 if (!(m->m_pkthdr.pkt_flags & PKTF_LOOP) && m->m_pkthdr.rcvif != NULL) {
2266 ip6oa.ip6oa_boundif = m->m_pkthdr.rcvif->if_index;
2267 ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
2268 }
2269
2270 /* too short to reflect */
2271 if (off < sizeof(struct ip6_hdr)) {
2272 nd6log(debug,
2273 "sanity fail: off=%x, sizeof(ip6)=%x in %s:%d\n",
2274 (u_int32_t)off, (u_int32_t)sizeof(struct ip6_hdr),
2275 __func__, __LINE__);
2276 goto bad;
2277 }
2278
2279 /*
2280 * If there are extra headers between IPv6 and ICMPv6, strip
2281 * off that header first.
2282 */
2283 if (off > sizeof(struct ip6_hdr)) {
2284 size_t l;
2285 struct ip6_hdr nip6;
2286
2287 l = off - sizeof(struct ip6_hdr);
2288 m_copydata(m, 0, sizeof(nip6), (caddr_t)&nip6);
2289 m_adj(m, (int)l);
2290 l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
2291 if (m->m_len < l) {
2292 if ((m_ip6hdr = m_pulldown(m, 0, (int)l, NULL)) == NULL) {
2293 return;
2294 }
2295 }
2296 bcopy(src: (caddr_t)&nip6, mtod(m, caddr_t), n: sizeof(nip6));
2297 } else { /* off == sizeof(struct ip6_hdr) */
2298 size_t l;
2299 l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
2300 if (m->m_len < l) {
2301 if ((m_ip6hdr = m_pulldown(m, 0, (int)l, NULL)) == NULL) {
2302 return;
2303 }
2304 }
2305 }
2306 plen = m->m_pkthdr.len - sizeof(struct ip6_hdr);
2307 ip6 = mtod(m_ip6hdr, struct ip6_hdr *);
2308 ip6->ip6_nxt = IPPROTO_ICMPV6;
2309 icmp6 = (struct icmp6_hdr *)(ip6 + 1);
2310 type = icmp6->icmp6_type; /* keep type for statistics */
2311 code = icmp6->icmp6_code; /* ditto. */
2312 if (m->m_pkthdr.rcvif != NULL) {
2313 fifscope = m->m_pkthdr.rcvif->if_index;
2314 sifscope = m->m_pkthdr.rcvif->if_index;
2315 } else if (m->m_pkthdr.pkt_flags & PKTF_IFAINFO) {
2316 ip6_getsrcifaddr_info(m, &fifscope, NULL);
2317 ip6_getdstifaddr_info(m, &sifscope, NULL);
2318 } else if (m->m_pkthdr.pkt_ext_flags & PKTF_EXT_OUTPUT_SCOPE) {
2319 fifscope = ip6_output_getsrcifscope(m);
2320 sifscope = ip6_output_getdstifscope(m);
2321 }
2322 fifscope = IN6_IS_SCOPE_EMBED(&ip6->ip6_src) ? fifscope : IFSCOPE_NONE;
2323 sifscope = IN6_IS_SCOPE_EMBED(&ip6->ip6_dst) ? sifscope : IFSCOPE_NONE;
2324 if (!in6_embedded_scope) {
2325 m->m_pkthdr.pkt_flags &= ~PKTF_IFAINFO;
2326 }
2327
2328 t = ip6->ip6_dst;
2329 /*
2330 * ip6_input() drops a packet if its src is multicast.
2331 * So, the src is never multicast.
2332 */
2333 ip6->ip6_dst = ip6->ip6_src;
2334 /*
2335 * XXX: make sure to embed scope zone information, using
2336 * already embedded IDs or the received interface (if any).
2337 * Note that rcvif may be NULL.
2338 */
2339 bzero(s: &sa6_src, n: sizeof(sa6_src));
2340 sa6_src.sin6_family = AF_INET6;
2341 sa6_src.sin6_len = sizeof(sa6_src);
2342 sa6_src.sin6_addr = ip6->ip6_dst;
2343 if (!in6_embedded_scope) {
2344 sa6_src.sin6_scope_id = fifscope;
2345 }
2346 in6_recoverscope(&sa6_src, &ip6->ip6_dst, m->m_pkthdr.rcvif);
2347 in6_embedscope(&ip6->ip6_dst, &sa6_src, NULL, NULL, NULL, IN6_NULL_IF_EMBEDDED_SCOPE(&sa6_src.sin6_scope_id));
2348 in6_verify_ifscope(&ip6->ip6_dst, sa6_src.sin6_scope_id);
2349 ip6_output_setdstifscope(m, sa6_src.sin6_scope_id, NULL);
2350
2351 if (!in6_embedded_scope &&
2352 (ip6oa.ip6oa_flags & IP6OAF_BOUND_IF) == 0 &&
2353 IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
2354 ip6oa.ip6oa_boundif = sa6_src.sin6_scope_id;
2355 ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
2356 }
2357
2358 bzero(s: &sa6_dst, n: sizeof(sa6_dst));
2359 sa6_dst.sin6_family = AF_INET6;
2360 sa6_dst.sin6_len = sizeof(sa6_dst);
2361 sa6_dst.sin6_addr = t;
2362 if (!in6_embedded_scope) {
2363 sa6_dst.sin6_scope_id = sifscope;
2364 }
2365 in6_recoverscope(&sa6_dst, &t, m->m_pkthdr.rcvif);
2366 in6_embedscope(&t, &sa6_dst, NULL, NULL, NULL, IN6_NULL_IF_EMBEDDED_SCOPE(&sa6_dst.sin6_scope_id));
2367 tifscope = sa6_dst.sin6_scope_id;
2368 /*
2369 * If the incoming packet was addressed directly to us(i.e. unicast),
2370 * use dst as the src for the reply.
2371 * The IN6_IFF_NOTREADY case should be VERY rare, but is possible
2372 * (for example) when we encounter an error while forwarding procedure
2373 * destined to a duplicated address of ours.
2374 * Note that ip6_getdstifaddr() may fail if we are in an error handling
2375 * procedure of an outgoing packet of our own, in which case we need
2376 * to search in the ifaddr list.
2377 */
2378 lck_rw_lock_shared(lck: &in6_ifaddr_rwlock);
2379 TAILQ_FOREACH(ia, IN6ADDR_HASH(&t), ia6_hash) {
2380 IFA_LOCK(&ia->ia_ifa);
2381 if (in6_are_addr_equal_scoped(&t, &ia->ia_addr.sin6_addr, tifscope, ia->ia_addr.sin6_scope_id) &&
2382 (ia->ia6_flags & (IN6_IFF_ANYCAST | IN6_IFF_NOTREADY | IN6_IFF_CLAT46)) == 0) {
2383 IFA_UNLOCK(&ia->ia_ifa);
2384 src = &t;
2385 sifscope = tifscope;
2386 break;
2387 }
2388 IFA_UNLOCK(&ia->ia_ifa);
2389 }
2390 lck_rw_done(lck: &in6_ifaddr_rwlock);
2391 if (ia == NULL && IN6_IS_ADDR_LINKLOCAL(&t) &&
2392 ((m->m_flags & M_LOOP) || (m->m_pkthdr.pkt_flags & PKTF_LOOP))) {
2393 /*
2394 * This is the case if the dst is our link-local address
2395 * and the sender is also ourselves. Here we test for both
2396 * M_LOOP and PKTF_LOOP, since the former may have been set
2397 * in ip6_output() and that we get here as part of callling
2398 * ip6_process_hopopts(). See comments in <sys/mbuf.h>
2399 */
2400 src = &t;
2401 sifscope = tifscope;
2402 }
2403
2404 if (src == NULL) {
2405 int e;
2406 struct sockaddr_in6 sin6;
2407 struct route_in6 ro;
2408
2409 /*
2410 * This case matches to multicasts, our anycast, or unicasts
2411 * that we do not own. Select a source address based on the
2412 * source address of the erroneous packet.
2413 */
2414 bzero(s: &sin6, n: sizeof(sin6));
2415 sin6.sin6_family = AF_INET6;
2416 sin6.sin6_len = sizeof(sin6);
2417 sin6.sin6_addr = ip6->ip6_dst; /* zone ID should be embedded */
2418 if (!in6_embedded_scope) {
2419 sin6.sin6_scope_id = fifscope;
2420 }
2421
2422 bzero(s: &ro, n: sizeof(ro));
2423 /*
2424 * in6_selectsrc() might return outif with its reference held
2425 * even in the error case, so we always need to release it
2426 * if non-NULL.
2427 */
2428 src = in6_selectsrc(&sin6, NULL, NULL, &ro, &outif,
2429 &src_storage, ip6oa.ip6oa_boundif, &e);
2430 ROUTE_RELEASE(&ro);
2431 if (src == NULL) {
2432 nd6log(debug,
2433 "icmp6_reflect: source can't be determined: "
2434 "dst=%s, error=%d\n",
2435 ip6_sprintf(&sa6_src.sin6_addr), e);
2436 goto bad;
2437 }
2438 if (outif != NULL) {
2439 sifscope = outif->if_index;
2440 }
2441 }
2442 oflow = ip6->ip6_flow; /* Save for later */
2443 ip6->ip6_src = *src;
2444 ip6->ip6_flow = 0;
2445 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
2446 ip6->ip6_vfc |= IPV6_VERSION;
2447 ip6_output_setsrcifscope(m, sifscope, NULL);
2448 in6_verify_ifscope(&ip6->ip6_src, sifscope);
2449
2450 if (icmp6->icmp6_type == ICMP6_ECHO_REPLY && icmp6->icmp6_code == 0) {
2451 ip6->ip6_flow |= (oflow & htonl(0x0ff00000));
2452 }
2453 ip6->ip6_nxt = IPPROTO_ICMPV6;
2454 if (outif != NULL && (ndi = ND_IFINFO(outif)) != NULL &&
2455 ndi->initialized) {
2456 lck_mtx_lock(lck: &ndi->lock);
2457 ip6->ip6_hlim = ndi->chlim;
2458 lck_mtx_unlock(lck: &ndi->lock);
2459 }
2460 if (m->m_pkthdr.rcvif != NULL &&
2461 (ndi = ND_IFINFO(m->m_pkthdr.rcvif)) != NULL &&
2462 ndi->initialized) {
2463 /* XXX: This may not be the outgoing interface */
2464 lck_mtx_lock(lck: &ndi->lock);
2465 ip6->ip6_hlim = ndi->chlim;
2466 lck_mtx_unlock(lck: &ndi->lock);
2467 } else {
2468 ip6->ip6_hlim = (uint8_t)ip6_defhlim;
2469 }
2470 /* Use the same traffic class as in the request to match IPv4 */
2471 icmp6->icmp6_cksum = 0;
2472 icmp6->icmp6_cksum = in6_cksum(m, IPPROTO_ICMPV6,
2473 sizeof(struct ip6_hdr), plen);
2474
2475 /*
2476 * XXX option handling
2477 */
2478 m->m_flags &= ~(M_BCAST | M_MCAST);
2479
2480 if (outif != NULL) {
2481 ifnet_release(interface: outif);
2482 outif = NULL;
2483 }
2484
2485 m->m_pkthdr.csum_data = 0;
2486 m->m_pkthdr.csum_flags = 0;
2487 ip6_output(m, NULL, NULL, IPV6_OUTARGS, NULL, &outif, &ip6oa);
2488 if (outif != NULL) {
2489 icmp6_ifoutstat_inc(outif, type, code);
2490 ifnet_release(interface: outif);
2491 }
2492 return;
2493
2494bad:
2495 m_freem(m);
2496 if (outif != NULL) {
2497 ifnet_release(interface: outif);
2498 }
2499 return;
2500}
2501
2502static const char *
2503icmp6_redirect_diag(struct in6_addr *src6,
2504 struct in6_addr *dst6,
2505 struct in6_addr *tgt6)
2506{
2507 static char buf[1024];
2508 snprintf(buf, count: sizeof(buf), "(src=%s dst=%s tgt=%s)",
2509 ip6_sprintf(src6), ip6_sprintf(dst6), ip6_sprintf(tgt6));
2510 return buf;
2511}
2512
2513void
2514icmp6_redirect_input(struct mbuf *m, int off, int icmp6len)
2515{
2516 struct ifnet *ifp = NULL;
2517 struct ip6_hdr *ip6 = NULL;
2518 struct nd_redirect *nd_rd = NULL;
2519 char *lladdr = NULL;
2520 int lladdrlen = 0;
2521 u_char *redirhdr = NULL;
2522 int redirhdrlen = 0;
2523 struct rtentry *rt = NULL;
2524 int is_router = 0;
2525 int is_onlink = 0;
2526 struct in6_addr src6 = {};
2527 struct in6_addr redtgt6 = {};
2528 struct in6_addr reddst6 = {};
2529 uint32_t src_ifscope = IFSCOPE_NONE, redtgt_ifscope = IFSCOPE_NONE, reddst_ifscope = IFSCOPE_NONE;
2530 union nd_opts ndopts = {};
2531
2532 if (m == NULL) {
2533 return;
2534 }
2535
2536 ifp = m->m_pkthdr.rcvif;
2537 if (ifp == NULL) {
2538 goto freeit;
2539 }
2540
2541 /*
2542 * If we are an advertising router on this interface,
2543 * don't update route by icmp6 redirect.
2544 */
2545 if (ifp->if_ipv6_router_mode == IPV6_ROUTER_MODE_EXCLUSIVE) {
2546 goto freeit;
2547 }
2548 if (!icmp6_rediraccept) {
2549 goto freeit;
2550 }
2551
2552 ip6 = mtod(m, struct ip6_hdr *);
2553 src6 = ip6->ip6_src;
2554 src_ifscope = in6_addr2scopeid(ifp, &src6);
2555#ifndef PULLDOWN_TEST
2556 IP6_EXTHDR_CHECK(m, off, icmp6len, return );
2557 nd_rd = (struct nd_redirect *)(mtod(m, caddr_t) + off);
2558#else
2559 IP6_EXTHDR_GET(nd_rd, struct nd_redirect *, m, off, icmp6len);
2560 if (nd_rd == NULL) {
2561 icmp6stat.icp6s_tooshort++;
2562 goto freeit;
2563 }
2564#endif
2565 ip6 = mtod(m, struct ip6_hdr *);
2566
2567 redtgt6 = nd_rd->nd_rd_target;
2568 reddst6 = nd_rd->nd_rd_dst;
2569
2570 if (in6_setscope(&redtgt6, m->m_pkthdr.rcvif, &redtgt_ifscope) ||
2571 in6_setscope(&reddst6, m->m_pkthdr.rcvif, &reddst_ifscope)) {
2572 goto freeit;
2573 }
2574
2575 /* validation */
2576 if (!IN6_IS_ADDR_LINKLOCAL(&src6)) {
2577 nd6log(error,
2578 "ICMP6 redirect sent from %s rejected; "
2579 "must be from linklocal\n", ip6_sprintf(&src6));
2580 goto bad;
2581 }
2582 if (ip6->ip6_hlim != IPV6_MAXHLIM) {
2583 nd6log(error,
2584 "ICMP6 redirect sent from %s rejected; "
2585 "hlim=%d (must be 255)\n",
2586 ip6_sprintf(&src6), ip6->ip6_hlim);
2587 goto bad;
2588 }
2589 {
2590 /* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */
2591 struct sockaddr_in6 sin6;
2592 struct in6_addr *gw6;
2593
2594 bzero(s: &sin6, n: sizeof(sin6));
2595 sin6.sin6_family = AF_INET6;
2596 sin6.sin6_len = sizeof(struct sockaddr_in6);
2597 if (!in6_embedded_scope) {
2598 sin6.sin6_scope_id = reddst_ifscope;
2599 }
2600 bcopy(src: &reddst6, dst: &sin6.sin6_addr, n: sizeof(reddst6));
2601 rt = rtalloc1_scoped((struct sockaddr *)&sin6, 0, 0, ifp->if_index);
2602 if (rt) {
2603 RT_LOCK(rt);
2604 if (rt->rt_gateway == NULL ||
2605 rt->rt_gateway->sa_family != AF_INET6) {
2606 nd6log(error,
2607 "ICMP6 redirect rejected; no route "
2608 "with inet6 gateway found for redirect dst: %s\n",
2609 icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
2610 RT_UNLOCK(rt);
2611 rtfree(rt);
2612 goto bad;
2613 }
2614
2615 gw6 = &(((struct sockaddr_in6 *)(void *)
2616 rt->rt_gateway)->sin6_addr);
2617 if (!in6_are_addr_equal_scoped(&src6, gw6, src_ifscope, ((struct sockaddr_in6 *)(void *)
2618 rt->rt_gateway)->sin6_scope_id)) {
2619 nd6log(error,
2620 "ICMP6 redirect rejected; "
2621 "not equal to gw-for-src=%s (must be same): "
2622 "%s\n",
2623 ip6_sprintf(gw6),
2624 icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
2625 RT_UNLOCK(rt);
2626 rtfree(rt);
2627 goto bad;
2628 }
2629 } else {
2630 nd6log(error,
2631 "ICMP6 redirect rejected; "
2632 "no route found for redirect dst: %s\n",
2633 icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
2634 goto bad;
2635 }
2636 RT_UNLOCK(rt);
2637 rtfree(rt);
2638 rt = NULL;
2639 }
2640 if (IN6_IS_ADDR_MULTICAST(&reddst6)) {
2641 nd6log(error,
2642 "ICMP6 redirect rejected; "
2643 "redirect dst must be unicast: %s\n",
2644 icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
2645 goto bad;
2646 }
2647
2648 is_router = is_onlink = 0;
2649 if (IN6_IS_ADDR_LINKLOCAL(&redtgt6)) {
2650 is_router = 1; /* router case */
2651 }
2652 if (bcmp(s1: &redtgt6, s2: &reddst6, n: sizeof(redtgt6)) == 0) {
2653 is_onlink = 1; /* on-link destination case */
2654 }
2655 if (!is_router && !is_onlink) {
2656 nd6log(error,
2657 "ICMP6 redirect rejected; "
2658 "neither router case nor onlink case: %s\n",
2659 icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
2660 goto bad;
2661 }
2662 /* validation passed */
2663
2664 icmp6len -= sizeof(*nd_rd);
2665 nd6_option_init(nd_rd + 1, icmp6len, &ndopts);
2666 if (nd6_options(&ndopts) < 0) {
2667 nd6log(info, "icmp6_redirect_input: "
2668 "invalid ND option, rejected: %s\n",
2669 icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
2670 /* nd6_options have incremented stats */
2671 goto freeit;
2672 }
2673
2674 if (ndopts.nd_opts_tgt_lladdr) {
2675 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1);
2676 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
2677 }
2678
2679 if (ndopts.nd_opts_rh) {
2680 redirhdrlen = ndopts.nd_opts_rh->nd_opt_rh_len;
2681 redirhdr = (u_char *)(ndopts.nd_opts_rh + 1); /* xxx */
2682 }
2683
2684 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
2685 nd6log(info,
2686 "icmp6_redirect_input: lladdrlen mismatch for %s "
2687 "(if %d, icmp6 packet %d): %s\n",
2688 ip6_sprintf(&redtgt6), ifp->if_addrlen, lladdrlen - 2,
2689 icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
2690 goto bad;
2691 }
2692
2693 /* RFC 2461 8.3 */
2694 nd6_cache_lladdr(ifp, &redtgt6, lladdr, lladdrlen, ND_REDIRECT,
2695 is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER, NULL);
2696
2697 if (!is_onlink) { /* better router case. perform rtredirect. */
2698 /* perform rtredirect */
2699 struct sockaddr_in6 sdst;
2700 struct sockaddr_in6 sgw;
2701 struct sockaddr_in6 ssrc;
2702
2703 bzero(s: &sdst, n: sizeof(sdst));
2704 bzero(s: &sgw, n: sizeof(sgw));
2705 bzero(s: &ssrc, n: sizeof(ssrc));
2706 sdst.sin6_family = sgw.sin6_family = ssrc.sin6_family = AF_INET6;
2707 sdst.sin6_len = sgw.sin6_len = ssrc.sin6_len =
2708 sizeof(struct sockaddr_in6);
2709 if (!in6_embedded_scope) {
2710 sdst.sin6_scope_id = reddst_ifscope;
2711 sgw.sin6_scope_id = redtgt_ifscope;
2712 ssrc.sin6_scope_id = src_ifscope;
2713 }
2714 bcopy(src: &redtgt6, dst: &sgw.sin6_addr, n: sizeof(struct in6_addr));
2715 bcopy(src: &reddst6, dst: &sdst.sin6_addr, n: sizeof(struct in6_addr));
2716 bcopy(src: &src6, dst: &ssrc.sin6_addr, n: sizeof(struct in6_addr));
2717
2718 rtredirect(ifp, (struct sockaddr *)&sdst,
2719 (struct sockaddr *)&sgw, NULL, RTF_GATEWAY | RTF_HOST,
2720 (struct sockaddr *)&ssrc, NULL);
2721 }
2722 /* finally update cached route in each socket via pfctlinput */
2723 {
2724 struct sockaddr_in6 sdst;
2725
2726 bzero(s: &sdst, n: sizeof(sdst));
2727 sdst.sin6_family = AF_INET6;
2728 sdst.sin6_len = sizeof(struct sockaddr_in6);
2729 if (!in6_embedded_scope) {
2730 sdst.sin6_scope_id = reddst_ifscope;
2731 }
2732 bcopy(src: &reddst6, dst: &sdst.sin6_addr, n: sizeof(struct in6_addr));
2733
2734 pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&sdst);
2735#if IPSEC
2736 key_sa_routechange((struct sockaddr *)&sdst);
2737#endif
2738 }
2739
2740freeit:
2741 m_freem(m);
2742 return;
2743
2744bad:
2745 icmp6stat.icp6s_badredirect++;
2746 m_freem(m);
2747}
2748
2749void
2750icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
2751{
2752 struct ifnet *ifp; /* my outgoing interface */
2753 struct in6_addr ifp_ll6;
2754 struct in6_addr *router_ll6;
2755 struct ip6_hdr *sip6; /* m0 as struct ip6_hdr */
2756 struct mbuf *m = NULL; /* newly allocated one */
2757 struct ip6_hdr *ip6; /* m as struct ip6_hdr */
2758 struct nd_redirect *nd_rd;
2759 size_t maxlen;
2760 u_char *p;
2761 struct ifnet *outif = NULL;
2762 struct sockaddr_in6 src_sa;
2763 struct ip6_out_args ip6oa;
2764
2765 bzero(s: &ip6oa, n: sizeof(ip6oa));
2766 ip6oa.ip6oa_boundif = IFSCOPE_NONE;
2767 ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR;
2768 ip6oa.ip6oa_sotc = SO_TC_UNSPEC;
2769 ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
2770
2771 icmp6_errcount(stat: &icmp6stat.icp6s_outerrhist, ND_REDIRECT, code: 0);
2772
2773 if (rt != NULL) {
2774 RT_LOCK(rt);
2775 }
2776
2777 /* sanity check */
2778 if (!m0 || !rt || !(rt->rt_flags & RTF_UP) || !(ifp = rt->rt_ifp)) {
2779 goto fail;
2780 }
2781
2782 /*
2783 * If we are not a router to begin with, or not an advertising
2784 * router on this interface, don't send icmp6 redirect.
2785 */
2786 if (!ip6_forwarding || ifp->if_ipv6_router_mode != IPV6_ROUTER_MODE_EXCLUSIVE) {
2787 goto fail;
2788 }
2789
2790 /*
2791 * Address check:
2792 * the source address must identify a neighbor, and
2793 * the destination address must not be a multicast address
2794 * [RFC 2461, sec 8.2]
2795 */
2796 sip6 = mtod(m0, struct ip6_hdr *);
2797 bzero(s: &src_sa, n: sizeof(src_sa));
2798 src_sa.sin6_family = AF_INET6;
2799 src_sa.sin6_len = sizeof(src_sa);
2800 src_sa.sin6_addr = sip6->ip6_src;
2801 /* we don't currently use sin6_scope_id, but eventually use it */
2802 src_sa.sin6_scope_id = in6_addr2scopeid(ifp, &sip6->ip6_src);
2803
2804 RT_UNLOCK(rt);
2805 if (nd6_is_addr_neighbor(&src_sa, ifp, 0) == 0) {
2806 /* already unlocked */
2807 rt = NULL;
2808 goto fail;
2809 }
2810 RT_LOCK(rt);
2811 if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst)) {
2812 goto fail; /* what should we do here? */
2813 }
2814 /* rate limit */
2815 if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0)) {
2816 goto fail;
2817 }
2818
2819 /*
2820 * Since we are going to append up to 1280 bytes (= IPV6_MMTU),
2821 * we almost always ask for an mbuf cluster for simplicity.
2822 * (MHLEN < IPV6_MMTU is almost always true)
2823 */
2824#if IPV6_MMTU >= MCLBYTES
2825# error assumption failed about IPV6_MMTU and MCLBYTES
2826#endif
2827 MGETHDR(m, M_DONTWAIT, MT_HEADER); /* MAC-OK */
2828 if (m && IPV6_MMTU >= MHLEN) {
2829 MCLGET(m, M_DONTWAIT);
2830 }
2831 if (!m) {
2832 goto fail;
2833 }
2834 m->m_pkthdr.rcvif = NULL;
2835 m->m_len = 0;
2836 maxlen = M_TRAILINGSPACE(m);
2837 maxlen = MIN(IPV6_MMTU, maxlen);
2838 /* just for safety */
2839 if (maxlen < sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) +
2840 ((sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7)) {
2841 goto fail;
2842 }
2843
2844 {
2845 /* get ip6 linklocal address for ifp(my outgoing interface). */
2846 struct in6_ifaddr *ia;
2847 if ((ia = in6ifa_ifpforlinklocal(ifp,
2848 IN6_IFF_NOTREADY |
2849 IN6_IFF_ANYCAST)) == NULL) {
2850 goto fail;
2851 }
2852 IFA_LOCK(&ia->ia_ifa);
2853 ifp_ll6 = ia->ia_addr.sin6_addr;
2854 IFA_UNLOCK(&ia->ia_ifa);
2855 ifa_remref(ifa: &ia->ia_ifa);
2856 }
2857
2858 /* get ip6 linklocal address for the router. */
2859 if (rt->rt_gateway && (rt->rt_flags & RTF_GATEWAY)) {
2860 struct sockaddr_in6 *sin6;
2861 sin6 = (struct sockaddr_in6 *)(void *)rt->rt_gateway;
2862 router_ll6 = &sin6->sin6_addr;
2863 if (!IN6_IS_ADDR_LINKLOCAL(router_ll6)) {
2864 router_ll6 = (struct in6_addr *)NULL;
2865 }
2866 } else {
2867 router_ll6 = (struct in6_addr *)NULL;
2868 }
2869
2870 /* ip6 */
2871 ip6 = mtod(m, struct ip6_hdr *);
2872 ip6->ip6_flow = 0;
2873 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
2874 ip6->ip6_vfc |= IPV6_VERSION;
2875 /* ip6->ip6_plen will be set later */
2876 ip6->ip6_nxt = IPPROTO_ICMPV6;
2877 ip6->ip6_hlim = IPV6_MAXHLIM;
2878 /* ip6->ip6_src must be linklocal addr for my outgoing if. */
2879 bcopy(src: &ifp_ll6, dst: &ip6->ip6_src, n: sizeof(struct in6_addr));
2880 bcopy(src: &sip6->ip6_src, dst: &ip6->ip6_dst, n: sizeof(struct in6_addr));
2881
2882 /* ND Redirect */
2883 nd_rd = (struct nd_redirect *)(ip6 + 1);
2884 nd_rd->nd_rd_type = ND_REDIRECT;
2885 nd_rd->nd_rd_code = 0;
2886 nd_rd->nd_rd_reserved = 0;
2887 if (rt->rt_flags & RTF_GATEWAY) {
2888 /*
2889 * nd_rd->nd_rd_target must be a link-local address in
2890 * better router cases.
2891 */
2892 if (!router_ll6) {
2893 goto fail;
2894 }
2895 bcopy(src: router_ll6, dst: &nd_rd->nd_rd_target,
2896 n: sizeof(nd_rd->nd_rd_target));
2897 bcopy(src: &sip6->ip6_dst, dst: &nd_rd->nd_rd_dst,
2898 n: sizeof(nd_rd->nd_rd_dst));
2899 } else {
2900 /* make sure redtgt == reddst */
2901 bcopy(src: &sip6->ip6_dst, dst: &nd_rd->nd_rd_target,
2902 n: sizeof(nd_rd->nd_rd_target));
2903 bcopy(src: &sip6->ip6_dst, dst: &nd_rd->nd_rd_dst,
2904 n: sizeof(nd_rd->nd_rd_dst));
2905 }
2906 RT_UNLOCK(rt);
2907 rt = NULL;
2908
2909 p = (u_char *)(nd_rd + 1);
2910
2911 if (!router_ll6) {
2912 goto nolladdropt;
2913 }
2914
2915 {
2916 /* target lladdr option */
2917 struct rtentry *rt_router = NULL;
2918 int len;
2919 struct sockaddr_dl *sdl;
2920 struct nd_opt_hdr *nd_opt;
2921 char *lladdr;
2922
2923 /* Callee returns a locked route upon success */
2924 rt_router = nd6_lookup(router_ll6, 0, ifp, 0);
2925 if (!rt_router) {
2926 goto nolladdropt;
2927 }
2928 RT_LOCK_ASSERT_HELD(rt_router);
2929 len = sizeof(*nd_opt) + ifp->if_addrlen;
2930 len = (len + 7) & ~7; /* round by 8 */
2931 /* safety check */
2932 if (len + (p - (u_char *)ip6) > maxlen) {
2933 RT_REMREF_LOCKED(rt_router);
2934 RT_UNLOCK(rt_router);
2935 goto nolladdropt;
2936 }
2937
2938 if (!(rt_router->rt_flags & RTF_GATEWAY) &&
2939 (rt_router->rt_flags & RTF_LLINFO) &&
2940 (rt_router->rt_gateway->sa_family == AF_LINK) &&
2941 (sdl = (struct sockaddr_dl *)(void *)
2942 rt_router->rt_gateway) && sdl->sdl_alen) {
2943 nd_opt = (struct nd_opt_hdr *)p;
2944 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
2945 nd_opt->nd_opt_len = (uint8_t)(len >> 3);
2946 lladdr = (char *)(nd_opt + 1);
2947 bcopy(LLADDR(sdl), dst: lladdr, n: ifp->if_addrlen);
2948 p += len;
2949 }
2950 RT_REMREF_LOCKED(rt_router);
2951 RT_UNLOCK(rt_router);
2952 }
2953
2954nolladdropt:;
2955
2956 m->m_pkthdr.len = m->m_len = (int32_t)(p - (u_char *)ip6);
2957
2958 /* just to be safe */
2959#ifdef M_DECRYPTED /*not openbsd*/
2960 if (m0->m_flags & M_DECRYPTED) {
2961 goto noredhdropt;
2962 }
2963#endif
2964 if (p - (u_char *)ip6 > maxlen) {
2965 goto noredhdropt;
2966 }
2967
2968 {
2969 /* redirected header option */
2970 int len;
2971 struct nd_opt_rd_hdr *nd_opt_rh;
2972
2973 /*
2974 * compute the maximum size for icmp6 redirect header option.
2975 * XXX room for auth header?
2976 */
2977 len = (int)(maxlen - (p - (u_char *)ip6));
2978 len &= ~7;
2979
2980 /* This is just for simplicity. */
2981 if (m0->m_pkthdr.len != m0->m_len) {
2982 if (m0->m_next) {
2983 m_freem(m0->m_next);
2984 m0->m_next = NULL;
2985 }
2986 m0->m_pkthdr.len = m0->m_len;
2987 }
2988
2989 /*
2990 * Redirected header option spec (RFC2461 4.6.3) talks nothing
2991 * about padding/truncate rule for the original IP packet.
2992 * From the discussion on IPv6imp in Feb 1999, the consensus was:
2993 * - "attach as much as possible" is the goal
2994 * - pad if not aligned (original size can be guessed by original
2995 * ip6 header)
2996 * Following code adds the padding if it is simple enough,
2997 * and truncates if not.
2998 */
2999 if (m0->m_next || m0->m_pkthdr.len != m0->m_len) {
3000 panic("assumption failed in %s:%d", __func__, __LINE__);
3001 }
3002
3003 if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) {
3004 /* not enough room, truncate */
3005 m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
3006 } else {
3007 /* enough room, pad or truncate */
3008 size_t extra;
3009
3010 extra = m0->m_pkthdr.len % 8;
3011 if (extra) {
3012 /* pad if easy enough, truncate if not */
3013 if (8 - extra <= M_TRAILINGSPACE(m0)) {
3014 /* pad */
3015 m0->m_len += (8 - extra);
3016 m0->m_pkthdr.len += (8 - extra);
3017 } else {
3018 /* truncate */
3019 m0->m_pkthdr.len -= extra;
3020 m0->m_len -= extra;
3021 }
3022 }
3023 len = m0->m_pkthdr.len + sizeof(*nd_opt_rh);
3024 m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
3025 }
3026
3027 nd_opt_rh = (struct nd_opt_rd_hdr *)p;
3028 bzero(s: nd_opt_rh, n: sizeof(*nd_opt_rh));
3029 nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER;
3030 nd_opt_rh->nd_opt_rh_len = (uint8_t)(len >> 3);
3031 p += sizeof(*nd_opt_rh);
3032 m->m_pkthdr.len = m->m_len = (int32_t)(p - (u_char *)ip6);
3033
3034 /* connect m0 to m */
3035 m->m_next = m0;
3036 m->m_pkthdr.len = m->m_len + m0->m_len;
3037 }
3038noredhdropt:;
3039
3040 /* XXX: clear embedded link IDs in the inner header */
3041 in6_clearscope(&sip6->ip6_src);
3042 in6_clearscope(&sip6->ip6_dst);
3043 in6_clearscope(&nd_rd->nd_rd_target);
3044 in6_clearscope(&nd_rd->nd_rd_dst);
3045
3046 ip6->ip6_plen = htons((uint16_t)(m->m_pkthdr.len - sizeof(struct ip6_hdr)));
3047
3048 nd_rd->nd_rd_cksum = 0;
3049 nd_rd->nd_rd_cksum
3050 = in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), ntohs(ip6->ip6_plen));
3051
3052 /* send the packet to outside... */
3053 ip6oa.ip6oa_boundif = ifp->if_index;
3054 ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
3055 ip6oa.ip6oa_flags |= IP6OAF_DONT_FRAG;
3056
3057 ip6_output_setsrcifscope(m, ifp->if_index, NULL);
3058 ip6_output_setdstifscope(m, ifp->if_index, NULL);
3059
3060 ip6_output(m, NULL, NULL, IPV6_OUTARGS, NULL, &outif, &ip6oa);
3061 if (outif) {
3062 icmp6_ifstat_inc(outif, ifs6_out_msg);
3063 icmp6_ifstat_inc(outif, ifs6_out_redirect);
3064 ifnet_release(interface: outif);
3065 }
3066 icmp6stat.icp6s_outhist[ND_REDIRECT]++;
3067
3068 return;
3069
3070fail:
3071 if (rt != NULL) {
3072 RT_UNLOCK(rt);
3073 }
3074 if (m) {
3075 m_freem(m);
3076 }
3077 if (m0) {
3078 m_freem(m0);
3079 }
3080}
3081
3082/*
3083 * ICMPv6 socket option processing.
3084 */
3085int
3086icmp6_ctloutput(struct socket *so, struct sockopt *sopt)
3087{
3088 int error = 0;
3089 size_t optlen;
3090 struct inpcb *inp = sotoinpcb(so);
3091 int level, op, optname;
3092
3093 if (sopt) {
3094 level = sopt->sopt_level;
3095 op = sopt->sopt_dir;
3096 optname = sopt->sopt_name;
3097 optlen = sopt->sopt_valsize;
3098 } else {
3099 level = op = optname = optlen = 0;
3100 }
3101
3102 if (level != IPPROTO_ICMPV6) {
3103 return EINVAL;
3104 }
3105
3106 switch (op) {
3107 case PRCO_SETOPT:
3108 switch (optname) {
3109 case ICMP6_FILTER:
3110 {
3111 struct icmp6_filter *p;
3112
3113 if (optlen != 0 && optlen != sizeof(*p)) {
3114 error = EMSGSIZE;
3115 break;
3116 }
3117 if (inp->in6p_icmp6filt == NULL) {
3118 error = EINVAL;
3119 break;
3120 }
3121
3122 if (optlen == 0) {
3123 /* According to RFC 3542, an installed filter can be
3124 * cleared by issuing a setsockopt for ICMP6_FILTER
3125 * with a zero length.
3126 */
3127 ICMP6_FILTER_SETPASSALL(inp->in6p_icmp6filt);
3128 } else {
3129 error = sooptcopyin(sopt, inp->in6p_icmp6filt, len: optlen,
3130 minlen: optlen);
3131 }
3132 break;
3133 }
3134
3135 default:
3136 error = ENOPROTOOPT;
3137 break;
3138 }
3139 break;
3140
3141 case PRCO_GETOPT:
3142 switch (optname) {
3143 case ICMP6_FILTER:
3144 {
3145 if (inp->in6p_icmp6filt == NULL) {
3146 error = EINVAL;
3147 break;
3148 }
3149 error = sooptcopyout(sopt, data: inp->in6p_icmp6filt,
3150 MIN(sizeof(struct icmp6_filter), optlen));
3151 break;
3152 }
3153
3154 default:
3155 error = ENOPROTOOPT;
3156 break;
3157 }
3158 break;
3159 }
3160
3161 return error;
3162}
3163
3164/*
3165 * ICMPv6 socket datagram option processing.
3166 */
3167int
3168icmp6_dgram_ctloutput(struct socket *so, struct sockopt *sopt)
3169{
3170 /*
3171 * For { SOCK_RAW, IPPROTO_ICMPV6 } the pr_ctloutput is
3172 * rip6_ctloutput() and not icmp6_ctloutput()
3173 */
3174 if (kauth_cred_issuser(cred: so->so_cred)) {
3175 return rip6_ctloutput(so, sopt);
3176 }
3177
3178 if (sopt->sopt_level == IPPROTO_ICMPV6) {
3179 switch (sopt->sopt_name) {
3180 case ICMP6_FILTER:
3181 return icmp6_ctloutput(so, sopt);
3182 default:
3183 return EPERM;
3184 }
3185 }
3186
3187 if (sopt->sopt_level != IPPROTO_IPV6) {
3188 return EINVAL;
3189 }
3190
3191 switch (sopt->sopt_name) {
3192 case IPV6_UNICAST_HOPS:
3193 case IPV6_CHECKSUM:
3194 case IPV6_V6ONLY:
3195 case IPV6_USE_MIN_MTU:
3196 case IPV6_RECVRTHDR:
3197 case IPV6_RECVPKTINFO:
3198 case IPV6_RECVHOPLIMIT:
3199 case IPV6_PATHMTU:
3200 case IPV6_PKTINFO:
3201 case IPV6_HOPLIMIT:
3202 case IPV6_HOPOPTS:
3203 case IPV6_DSTOPTS:
3204 case IPV6_MULTICAST_IF:
3205 case IPV6_MULTICAST_HOPS:
3206 case IPV6_MULTICAST_LOOP:
3207 case IPV6_JOIN_GROUP:
3208 case IPV6_LEAVE_GROUP:
3209 case IPV6_PORTRANGE:
3210 case IPV6_IPSEC_POLICY:
3211 case IPV6_RECVTCLASS:
3212 case IPV6_TCLASS:
3213 case IPV6_2292PKTOPTIONS:
3214 case IPV6_2292PKTINFO:
3215 case IPV6_2292HOPLIMIT:
3216 case IPV6_2292HOPOPTS:
3217 case IPV6_2292DSTOPTS:
3218 case IPV6_2292RTHDR:
3219 case IPV6_BOUND_IF:
3220 case IPV6_NO_IFT_CELLULAR:
3221 return ip6_ctloutput(so, sopt);
3222
3223 default:
3224 return EPERM;
3225 }
3226}
3227
3228__private_extern__ int
3229icmp6_dgram_send(struct socket *so, int flags, struct mbuf *m,
3230 struct sockaddr *nam, struct mbuf *control, struct proc *p)
3231{
3232#pragma unused(flags, p)
3233 int error = 0;
3234 struct inpcb *inp = sotoinpcb(so);
3235 struct icmp6_hdr *icmp6;
3236
3237 if (inp == NULL
3238#if NECP
3239 || (necp_socket_should_use_flow_divert(inp))
3240#endif /* NECP */
3241 ) {
3242 error = (inp == NULL ? EINVAL : EPROTOTYPE);
3243 goto bad;
3244 }
3245
3246 if (kauth_cred_issuser(cred: so->so_cred)) {
3247 return rip6_output(m, so, SIN6(nam), control, 0);
3248 }
3249
3250 /*
3251 * For an ICMPv6 packet, we should know its type and code
3252 */
3253 if (SOCK_PROTO(so) == IPPROTO_ICMPV6) {
3254 if (m->m_len < sizeof(struct icmp6_hdr) &&
3255 (m = m_pullup(m, sizeof(struct icmp6_hdr))) == NULL) {
3256 error = ENOBUFS;
3257 goto bad;
3258 }
3259 icmp6 = mtod(m, struct icmp6_hdr *);
3260
3261 /*
3262 * Allow only to send echo request and node information request
3263 * See RFC 2463 for Echo Request Message format
3264 */
3265 if ((icmp6->icmp6_type == ICMP6_ECHO_REQUEST &&
3266 icmp6->icmp6_code == 0) ||
3267 (icmp6->icmp6_type == ICMP6_NI_QUERY &&
3268 (icmp6->icmp6_code == ICMP6_NI_SUBJ_IPV6 ||
3269 icmp6->icmp6_code == ICMP6_NI_SUBJ_FQDN))) {
3270 /* Good */
3271 ;
3272 } else {
3273 error = EPERM;
3274 goto bad;
3275 }
3276 }
3277
3278 return rip6_output(m, so, SIN6(nam), control, 0);
3279bad:
3280 VERIFY(error != 0);
3281
3282 if (m != NULL) {
3283 m_freem(m);
3284 }
3285 if (control != NULL) {
3286 m_freem(control);
3287 }
3288
3289 return error;
3290}
3291
3292/* Like rip6_attach but without root privilege enforcement */
3293__private_extern__ int
3294icmp6_dgram_attach(struct socket *so, int proto, struct proc *p)
3295{
3296 struct inpcb *inp;
3297 int error;
3298
3299 inp = sotoinpcb(so);
3300 if (inp) {
3301 panic("icmp6_dgram_attach");
3302 }
3303
3304 if (proto != IPPROTO_ICMPV6) {
3305 return EINVAL;
3306 }
3307
3308 error = soreserve(so, sndcc: rip_sendspace, rcvcc: rip_recvspace);
3309 if (error) {
3310 return error;
3311 }
3312 error = in_pcballoc(so, &ripcbinfo, p);
3313 if (error) {
3314 return error;
3315 }
3316 inp = (struct inpcb *)so->so_pcb;
3317 inp->inp_vflag |= INP_IPV6;
3318 inp->in6p_ip6_nxt = IPPROTO_ICMPV6;
3319 inp->in6p_hops = -1; /* use kernel default */
3320 inp->in6p_cksum = -1;
3321 inp->in6p_icmp6filt = kalloc_type(struct icmp6_filter,
3322 Z_WAITOK | Z_NOFAIL);
3323 ICMP6_FILTER_SETPASSALL(inp->in6p_icmp6filt);
3324 return 0;
3325}
3326
3327
3328/*
3329 * Perform rate limit check.
3330 * Returns 0 if it is okay to send the icmp6 packet.
3331 * Returns 1 if the router SHOULD NOT send this icmp6 packet due to rate
3332 * limitation.
3333 *
3334 * XXX per-destination check necessary?
3335 */
3336static int
3337icmp6_ratelimit(
3338 __unused const struct in6_addr *dst, /* not used at this moment */
3339 const int type,
3340 __unused const int code)
3341{
3342 int ret;
3343
3344 ret = 0; /* okay to send */
3345
3346 /* PPS limit */
3347 if (type == ND_ROUTER_ADVERT) {
3348 if (!ppsratecheck(lasttime: &icmp6rappslim_last, curpps: &icmp6rapps_count,
3349 maxpps: icmp6rappslim)) {
3350 ret++;
3351 }
3352 } else if (!ppsratecheck(lasttime: &icmp6errppslim_last, curpps: &icmp6errpps_count,
3353 maxpps: icmp6errppslim)) {
3354 /*
3355 * We add some randomness here to still generate ICMPv6 error
3356 * post icmp6errppslim limit with a probability that goes down
3357 * with increased value of icmp6errpps_count.
3358 */
3359 if (icmp6errpps_count > 0 && icmp6errppslim > 0 &&
3360 icmp6errpps_count > icmp6errppslim &&
3361 (random() % (icmp6errpps_count - icmp6errppslim)) != 0) {
3362 /* The packet is subject to rate limit */
3363 ret++;
3364 }
3365 }
3366
3367 return ret;
3368}
3369