version 1.132.2.4, 2014/05/22 11:41:10 |
version 1.149.2.1, 2015/01/23 09:27:15 |
Line 90 __KERNEL_RCSID(0, "$NetBSD$"); |
|
Line 90 __KERNEL_RCSID(0, "$NetBSD$"); |
|
#include <net/if_types.h> |
#include <net/if_types.h> |
#include <net/if_dl.h> |
#include <net/if_dl.h> |
#include <net/route.h> |
#include <net/route.h> |
#include <net/netisr.h> |
#include <net/pktqueue.h> |
#include <net/pfil.h> |
#include <net/pfil.h> |
|
|
#include <netinet/in.h> |
#include <netinet/in.h> |
#include <netinet/in_systm.h> |
#include <netinet/in_systm.h> |
#ifdef INET |
#ifdef INET |
#include <netinet/ip.h> |
#include <netinet/ip.h> |
|
#include <netinet/ip_var.h> |
#include <netinet/ip_icmp.h> |
#include <netinet/ip_icmp.h> |
#endif /* INET */ |
#endif /* INET */ |
#include <netinet/ip6.h> |
#include <netinet/ip6.h> |
Line 135 __KERNEL_RCSID(0, "$NetBSD$"); |
|
Line 136 __KERNEL_RCSID(0, "$NetBSD$"); |
|
extern struct domain inet6domain; |
extern struct domain inet6domain; |
|
|
u_char ip6_protox[IPPROTO_MAX]; |
u_char ip6_protox[IPPROTO_MAX]; |
static int ip6qmaxlen = IFQ_MAXLEN; |
|
struct in6_ifaddr *in6_ifaddr; |
struct in6_ifaddr *in6_ifaddr; |
struct ifqueue ip6intrq; |
pktqueue_t *ip6_pktq __read_mostly; |
|
|
extern callout_t in6_tmpaddrtimer_ch; |
extern callout_t in6_tmpaddrtimer_ch; |
|
|
Line 150 pfil_head_t *inet6_pfil_hook; |
|
Line 150 pfil_head_t *inet6_pfil_hook; |
|
percpu_t *ip6stat_percpu; |
percpu_t *ip6stat_percpu; |
|
|
static void ip6_init2(void *); |
static void ip6_init2(void *); |
|
static void ip6intr(void *); |
static struct m_tag *ip6_setdstifaddr(struct mbuf *, const struct in6_ifaddr *); |
static struct m_tag *ip6_setdstifaddr(struct mbuf *, const struct in6_ifaddr *); |
|
|
static int ip6_process_hopopts(struct mbuf *, u_int8_t *, int, u_int32_t *, |
static int ip6_process_hopopts(struct mbuf *, u_int8_t *, int, u_int32_t *, |
|
|
if (pr->pr_domain->dom_family == PF_INET6 && |
if (pr->pr_domain->dom_family == PF_INET6 && |
pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) |
pr->pr_protocol && pr->pr_protocol != IPPROTO_RAW) |
ip6_protox[pr->pr_protocol] = pr - inet6sw; |
ip6_protox[pr->pr_protocol] = pr - inet6sw; |
ip6intrq.ifq_maxlen = ip6qmaxlen; |
|
|
ip6_pktq = pktq_create(IFQ_MAXLEN, ip6intr, NULL); |
|
KASSERT(ip6_pktq != NULL); |
|
|
scope6_init(); |
scope6_init(); |
addrsel_policy_init(); |
addrsel_policy_init(); |
nd6_init(); |
nd6_init(); |
Line 215 ip6_init2(void *dummy) |
|
Line 219 ip6_init2(void *dummy) |
|
/* |
/* |
* IP6 input interrupt handling. Just pass the packet to ip6_input. |
* IP6 input interrupt handling. Just pass the packet to ip6_input. |
*/ |
*/ |
void |
static void |
ip6intr(void) |
ip6intr(void *arg __unused) |
{ |
{ |
int s; |
|
struct mbuf *m; |
struct mbuf *m; |
|
|
mutex_enter(softnet_lock); |
mutex_enter(softnet_lock); |
KERNEL_LOCK(1, NULL); |
while ((m = pktq_dequeue(ip6_pktq)) != NULL) { |
for (;;) { |
const ifnet_t *ifp = m->m_pkthdr.rcvif; |
s = splnet(); |
|
IF_DEQUEUE(&ip6intrq, m); |
/* |
splx(s); |
* Drop the packet if IPv6 is disabled on the interface. |
if (m == 0) |
*/ |
break; |
if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) { |
/* drop the packet if IPv6 operation is disabled on the IF */ |
|
if ((ND_IFINFO(m->m_pkthdr.rcvif)->flags & ND6_IFF_IFDISABLED)) { |
|
m_freem(m); |
m_freem(m); |
break; |
continue; |
} |
} |
ip6_input(m); |
ip6_input(m); |
} |
} |
KERNEL_UNLOCK_ONE(NULL); |
|
mutex_exit(softnet_lock); |
mutex_exit(softnet_lock); |
} |
} |
|
|
Line 257 ip6_input(struct mbuf *m) |
|
Line 257 ip6_input(struct mbuf *m) |
|
struct sockaddr dst; |
struct sockaddr dst; |
struct sockaddr_in6 dst6; |
struct sockaddr_in6 dst6; |
} u; |
} u; |
#ifdef IPSEC |
|
struct m_tag *mtag; |
|
struct tdb_ident *tdbi; |
|
struct secpolicy *sp; |
|
int s, error; |
|
#endif |
|
|
|
/* |
/* |
* make sure we don't have onion peering information into m_tag. |
* make sure we don't have onion peering information into m_tag. |
Line 345 ip6_input(struct mbuf *m) |
|
Line 339 ip6_input(struct mbuf *m) |
|
* not the decapsulated packet. |
* not the decapsulated packet. |
*/ |
*/ |
#if defined(IPSEC) |
#if defined(IPSEC) |
if (!ipsec_indone(m)) |
if (!ipsec_used || !ipsec_indone(m)) |
#else |
#else |
if (1) |
if (1) |
#endif |
#endif |
Line 753 ip6_input(struct mbuf *m) |
|
Line 747 ip6_input(struct mbuf *m) |
|
} |
} |
|
|
#ifdef IPSEC |
#ifdef IPSEC |
/* |
if (ipsec_used) { |
* enforce IPsec policy checking if we are seeing last header. |
struct m_tag *mtag; |
* note that we do not visit this with protocols with pcb layer |
struct tdb_ident *tdbi; |
* code - like udp/tcp/raw ip. |
struct secpolicy *sp; |
*/ |
int s, error; |
if ((inet6sw[ip_protox[nxt]].pr_flags & PR_LASTHDR) != 0) { |
|
/* |
|
* Check if the packet has already had IPsec processing |
|
* done. If so, then just pass it along. This tag gets |
|
* set during AH, ESP, etc. input handling, before the |
|
* packet is returned to the ip input queue for delivery. |
|
*/ |
|
mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); |
|
s = splsoftnet(); |
|
if (mtag != NULL) { |
|
tdbi = (struct tdb_ident *)(mtag + 1); |
|
sp = ipsec_getpolicy(tdbi, IPSEC_DIR_INBOUND); |
|
} else { |
|
sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_INBOUND, |
|
IP_FORWARDING, &error); |
|
} |
|
if (sp != NULL) { |
|
/* |
/* |
* Check security policy against packet attributes. |
* enforce IPsec policy checking if we are seeing last |
|
* header. note that we do not visit this with |
|
* protocols with pcb layer code - like udp/tcp/raw ip. |
*/ |
*/ |
error = ipsec_in_reject(sp, m); |
if ((inet6sw[ip_protox[nxt]].pr_flags |
KEY_FREESP(&sp); |
& PR_LASTHDR) != 0) { |
} else { |
/* |
/* XXX error stat??? */ |
* Check if the packet has already had IPsec |
error = EINVAL; |
* processing done. If so, then just pass it |
DPRINTF(("ip6_input: no SP, packet discarded\n"));/*XXX*/ |
* along. This tag gets set during AH, ESP, |
|
* etc. input handling, before the packet is |
|
* returned to the ip input queue for delivery. |
|
*/ |
|
mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, |
|
NULL); |
|
s = splsoftnet(); |
|
if (mtag != NULL) { |
|
tdbi = (struct tdb_ident *)(mtag + 1); |
|
sp = ipsec_getpolicy(tdbi, |
|
IPSEC_DIR_INBOUND); |
|
} else { |
|
sp = ipsec_getpolicybyaddr(m, |
|
IPSEC_DIR_INBOUND, IP_FORWARDING, |
|
&error); |
|
} |
|
if (sp != NULL) { |
|
/* |
|
* Check security policy against packet |
|
* attributes. |
|
*/ |
|
error = ipsec_in_reject(sp, m); |
|
KEY_FREESP(&sp); |
|
} else { |
|
/* XXX error stat??? */ |
|
error = EINVAL; |
|
DPRINTF(("ip6_input: no SP, packet" |
|
" discarded\n"));/*XXX*/ |
|
} |
|
splx(s); |
|
if (error) |
|
goto bad; |
|
} |
} |
} |
splx(s); |
|
if (error) |
|
goto bad; |
|
} |
|
#endif /* IPSEC */ |
#endif /* IPSEC */ |
|
|
|
|
nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); |
nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &off, nxt); |
} |
} |
return; |
return; |
Line 1847 sysctl_net_inet6_ip6_setup(struct sysctl |
|
Line 1854 sysctl_net_inet6_ip6_setup(struct sysctl |
|
IPV6CTL_V6ONLY, CTL_EOL); |
IPV6CTL_V6ONLY, CTL_EOL); |
sysctl_createv(clog, 0, NULL, NULL, |
sysctl_createv(clog, 0, NULL, NULL, |
CTLFLAG_PERMANENT|CTLFLAG_READWRITE, |
CTLFLAG_PERMANENT|CTLFLAG_READWRITE, |
|
CTLTYPE_INT, "auto_linklocal", |
|
SYSCTL_DESCR("Default value of per-interface flag for " |
|
"adding an IPv6 link-local address to " |
|
"interfaces when attached"), |
|
NULL, 0, &ip6_auto_linklocal, 0, |
|
CTL_NET, PF_INET6, IPPROTO_IPV6, |
|
IPV6CTL_AUTO_LINKLOCAL, CTL_EOL); |
|
sysctl_createv(clog, 0, NULL, NULL, |
|
CTLFLAG_PERMANENT|CTLFLAG_READWRITE, |
CTLTYPE_INT, "anonportmin", |
CTLTYPE_INT, "anonportmin", |
SYSCTL_DESCR("Lowest ephemeral port number to assign"), |
SYSCTL_DESCR("Lowest ephemeral port number to assign"), |
sysctl_net_inet_ip_ports, 0, &ip6_anonportmin, 0, |
sysctl_net_inet_ip_ports, 0, &ip6_anonportmin, 0, |
Line 1886 sysctl_net_inet6_ip6_setup(struct sysctl |
|
Line 1902 sysctl_net_inet6_ip6_setup(struct sysctl |
|
CTL_CREATE, CTL_EOL); |
CTL_CREATE, CTL_EOL); |
sysctl_createv(clog, 0, NULL, NULL, |
sysctl_createv(clog, 0, NULL, NULL, |
CTLFLAG_PERMANENT|CTLFLAG_READWRITE, |
CTLFLAG_PERMANENT|CTLFLAG_READWRITE, |
|
CTLTYPE_INT, "prefer_tempaddr", |
|
SYSCTL_DESCR("Prefer temporary address as source " |
|
"address"), |
|
NULL, 0, &ip6_prefer_tempaddr, 0, |
|
CTL_NET, PF_INET6, IPPROTO_IPV6, |
|
CTL_CREATE, CTL_EOL); |
|
sysctl_createv(clog, 0, NULL, NULL, |
|
CTLFLAG_PERMANENT|CTLFLAG_READWRITE, |
CTLTYPE_INT, "temppltime", |
CTLTYPE_INT, "temppltime", |
SYSCTL_DESCR("preferred lifetime of a temporary address"), |
SYSCTL_DESCR("preferred lifetime of a temporary address"), |
NULL, 0, &ip6_temp_preferred_lifetime, 0, |
NULL, 0, &ip6_temp_preferred_lifetime, 0, |