Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. =================================================================== RCS file: /ftp/cvs/cvsroot/src/sys/netinet6/ip6_input.c,v rcsdiff: /ftp/cvs/cvsroot/src/sys/netinet6/ip6_input.c,v: warning: Unknown phrases like `commitid ...;' are present. retrieving revision 1.37.2.2 retrieving revision 1.41.2.2 diff -u -p -r1.37.2.2 -r1.41.2.2 --- src/sys/netinet6/ip6_input.c 2001/03/13 20:29:50 1.37.2.2 +++ src/sys/netinet6/ip6_input.c 2002/01/10 20:03:20 1.41.2.2 @@ -1,5 +1,5 @@ -/* $NetBSD: ip6_input.c,v 1.37.2.2 2001/03/13 20:29:50 nathanw Exp $ */ -/* $KAME: ip6_input.c,v 1.183 2001/03/01 15:15:23 itojun Exp $ */ +/* $NetBSD: ip6_input.c,v 1.41.2.2 2002/01/10 20:03:20 thorpej Exp $ */ +/* $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $ */ /* * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. @@ -65,6 +65,9 @@ * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 */ +#include +__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.41.2.2 2002/01/10 20:03:20 thorpej Exp $"); + #include "opt_inet.h" #include "opt_ipsec.h" #include "opt_pfil_hooks.h" @@ -81,8 +84,8 @@ #include #include #include -#include #include +#include #include #include @@ -98,7 +101,7 @@ #ifdef INET #include #include -#endif /*INET*/ +#endif /* INET */ #include #include #include @@ -117,10 +120,13 @@ /* we need it for NLOOP. */ #include "loop.h" #include "faith.h" - #include "gif.h" #include "bpfilter.h" +#if NGIF > 0 +#include +#endif + #include extern struct domain inet6domain; @@ -217,7 +223,7 @@ ip6intr() struct mbuf *m; for (;;) { - s = splimp(); + s = splnet(); IF_DEQUEUE(&ip6intrq, m); splx(s); if (m == 0) @@ -244,14 +250,12 @@ ip6_input(m) * should the inner packet be considered authentic? * see comment in ah4_input(). */ - if (m) { - m->m_flags &= ~M_AUTHIPHDR; - m->m_flags &= ~M_AUTHIPDGM; - } + m->m_flags &= ~M_AUTHIPHDR; + m->m_flags &= ~M_AUTHIPDGM; #endif /* - * mbuf statistics by kazu + * mbuf statistics */ if (m->m_flags & M_EXT) { if (m->m_next) @@ -259,15 +263,17 @@ ip6_input(m) else ip6stat.ip6s_mext1++; } else { +#define M2MMAX (sizeof(ip6stat.ip6s_m2m)/sizeof(ip6stat.ip6s_m2m[0])) if (m->m_next) { if (m->m_flags & M_LOOP) { - ip6stat.ip6s_m2m[loif[0].if_index]++; /*XXX*/ - } else if (m->m_pkthdr.rcvif->if_index <= 31) + ip6stat.ip6s_m2m[loif[0].if_index]++; /* XXX */ + } else if (m->m_pkthdr.rcvif->if_index < M2MMAX) ip6stat.ip6s_m2m[m->m_pkthdr.rcvif->if_index]++; else ip6stat.ip6s_m2m[0]++; } else ip6stat.ip6s_m1++; +#undef M2MMAX } in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive); @@ -304,19 +310,28 @@ ip6_input(m) * Note that filters must _never_ set this flag, as another filter * in the list may have previously cleared it. */ - if (pfil_run_hooks(&inet6_pfil_hook, &m, m->m_pkthdr.rcvif, - PFIL_IN) != 0) - return; - if (m == NULL) - return; - ip6 = mtod(m, struct ip6_hdr *); + /* + * let ipfilter look at packet on the wire, + * not the decapsulated packet. + */ +#ifdef IPSEC + if (!ipsec_getnhist(m)) +#else + if (1) +#endif + { + if (pfil_run_hooks(&inet6_pfil_hook, &m, m->m_pkthdr.rcvif, + PFIL_IN) != 0) + return; + if (m == NULL) + return; + ip6 = mtod(m, struct ip6_hdr *); + } #endif /* PFIL_HOOKS */ - ip6stat.ip6s_nxthist[ip6->ip6_nxt]++; #ifdef ALTQ - /* XXX Temporary until ALTQ is changed to use a pfil hook */ if (altq_input != NULL && (*altq_input)(m, AF_INET6) == 0) { /* packet is dropped by traffic conditioner */ return; @@ -324,7 +339,7 @@ ip6_input(m) #endif /* - * Scope check + * Check against address spoofing/corruption. */ if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src) || IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst)) { @@ -333,16 +348,16 @@ ip6_input(m) goto bad; } /* - * The following check is not documented in the spec. Malicious party - * may be able to use IPv4 mapped addr to confuse tcp/udp stack and - * bypass security checks (act as if it was from 127.0.0.1 by using - * IPv6 src ::ffff:127.0.0.1). Be cautious. + * The following check is not documented in specs. A malicious + * party may be able to use IPv4 mapped addr to confuse tcp/udp stack + * and bypass security checks (act as if it was from 127.0.0.1 by using + * IPv6 src ::ffff:127.0.0.1). Be cautious. * - * This check chokes if we are in SIIT cloud. As none of BSDs support - * IPv4-less kernel compilation, we cannot support SIIT environment - * at all. So, it makes more sense for us to reject any malicious - * packets for non-SIIT environment, than try to do a partical support - * for SIIT environment. + * This check chokes if we are in an SIIT cloud. As none of BSDs + * support IPv4-less kernel compilation, we cannot support SIIT + * environment at all. So, it makes more sense for us to reject any + * malicious packets for non-SIIT environment, than try to do a + * partical support for SIIT environment. */ if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) || IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) { @@ -379,32 +394,48 @@ ip6_input(m) } } -#ifndef FAKE_LOOPBACK_IF - if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) -#else - if (1) -#endif - { - if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) - ip6->ip6_src.s6_addr16[1] - = htons(m->m_pkthdr.rcvif->if_index); - if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) - ip6->ip6_dst.s6_addr16[1] - = htons(m->m_pkthdr.rcvif->if_index); + /* drop packets if interface ID portion is already filled */ + if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) == 0) { + if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src) && + ip6->ip6_src.s6_addr16[1]) { + ip6stat.ip6s_badscope++; + goto bad; + } + if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) && + ip6->ip6_dst.s6_addr16[1]) { + ip6stat.ip6s_badscope++; + goto bad; + } } - /* - * XXX we need this since we do not have "goto ours" hack route - * for some of our ifaddrs on loopback interface. - * we should correct it by changing in6_ifattach to install - * "goto ours" hack route. - */ - if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) != 0) { - if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) { - ours = 1; - deliverifp = m->m_pkthdr.rcvif; - goto hbhcheck; + if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) + ip6->ip6_src.s6_addr16[1] + = htons(m->m_pkthdr.rcvif->if_index); + if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) + ip6->ip6_dst.s6_addr16[1] + = htons(m->m_pkthdr.rcvif->if_index); + + /* + * We use rt->rt_ifp to determine if the address is ours or not. + * If rt_ifp is lo0, the address is ours. + * The problem here is, rt->rt_ifp for fe80::%lo0/64 is set to lo0, + * so any address under fe80::%lo0/64 will be mistakenly considered + * local. The special case is supplied to handle the case properly + * by actually looking at interface addresses + * (using in6ifa_ifpwithaddr). + */ + if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) != 0 && + IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) { + if (!in6ifa_ifpwithaddr(m->m_pkthdr.rcvif, &ip6->ip6_dst)) { + icmp6_error(m, ICMP6_DST_UNREACH, + ICMP6_DST_UNREACH_ADDR, 0); + /* m is already freed */ + return; } + + ours = 1; + deliverifp = m->m_pkthdr.rcvif; + goto hbhcheck; } /* @@ -515,7 +546,7 @@ ip6_input(m) && ip6_forward_rt.ro_rt->rt_ifp->if_type == IFT_FAITH) { /* XXX do we need more sanity checks? */ ours = 1; - deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /*faith*/ + deliverifp = ip6_forward_rt.ro_rt->rt_ifp; /* faith */ goto hbhcheck; } } @@ -576,7 +607,7 @@ ip6_input(m) ip6 = mtod(m, struct ip6_hdr *); /* - * if the payload length field is 0 and the next header field + * if the payload length field is 0 and the next header field * indicates Hop-by-Hop Options header, then a Jumbo Payload * option MUST be included. */ @@ -693,6 +724,7 @@ ip6_input(m) ip6stat.ip6s_delivered++; in6_ifstat_inc(deliverifp, ifs6_in_deliver); nest = 0; + while (nxt != IPPROTO_DONE) { if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) { ip6stat.ip6s_toomanyhdr++; @@ -979,7 +1011,7 @@ ip6_savecontrol(in6p, mp, ip6, m) struct ip6_hdr *ip6; struct mbuf *m; { - struct proc *p = (curproc ? curproc->l_proc : 0); /* XXX */ + struct proc *p = curproc; /* XXX */ int privileged; privileged = 0; @@ -1294,6 +1326,8 @@ ip6_nexthdr(m, off, proto, nxtp) if (nxtp) *nxtp = ip6e.ip6e_nxt; off += (ip6e.ip6e_len + 2) << 2; + if (m->m_pkthdr.len < off) + return -1; return off; case IPPROTO_HOPOPTS: @@ -1305,6 +1339,8 @@ ip6_nexthdr(m, off, proto, nxtp) if (nxtp) *nxtp = ip6e.ip6e_nxt; off += (ip6e.ip6e_len + 1) << 3; + if (m->m_pkthdr.len < off) + return -1; return off; case IPPROTO_NONE: @@ -1364,9 +1400,6 @@ u_char inet6ctlerrmap[PRC_NCMDS] = { ENOPROTOOPT }; -#include -#include - int ip6_sysctl(name, namelen, oldp, oldlenp, newp, newlen) int *name; @@ -1414,9 +1447,11 @@ ip6_sysctl(name, namelen, oldp, oldlenp, case IPV6CTL_DEFMCASTHLIM: return sysctl_int(oldp, oldlenp, newp, newlen, &ip6_defmcasthlim); +#if NGIF > 0 case IPV6CTL_GIF_HLIM: return sysctl_int(oldp, oldlenp, newp, newlen, &ip6_gif_hlim); +#endif case IPV6CTL_KAME_VERSION: return sysctl_rdstring(oldp, oldlenp, newp, __KAME_VERSION); case IPV6CTL_USE_DEPRECATED: @@ -1424,10 +1459,11 @@ ip6_sysctl(name, namelen, oldp, oldlenp, &ip6_use_deprecated); case IPV6CTL_RR_PRUNE: return sysctl_int(oldp, oldlenp, newp, newlen, &ip6_rr_prune); -#ifndef INET6_BINDV6ONLY - case IPV6CTL_BINDV6ONLY: - return sysctl_int(oldp, oldlenp, newp, newlen, - &ip6_bindv6only); + case IPV6CTL_V6ONLY: +#ifdef INET6_BINDV6ONLY + return sysctl_rdint(oldp, oldlenp, newp, ip6_v6only); +#else + return sysctl_int(oldp, oldlenp, newp, newlen, &ip6_v6only); #endif case IPV6CTL_ANONPORTMIN: old = ip6_anonportmin;