[apple/xnu.git] / bsd / netinet6 / in6_gif.c

/*	$FreeBSD: src/sys/netinet6/in6_gif.c,v 1.2.2.3 2001/07/03 11:01:52 ume Exp $	*/
/*	$KAME: in6_gif.c,v 1.49 2001/05/14 14:02:17 itojun Exp $	*/

/*
 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the project nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */


#include <sys/param.h>
#include <sys/systm.h>
#include <sys/socket.h>
#include <sys/sockio.h>
#include <sys/mbuf.h>
#include <sys/errno.h>
#include <sys/queue.h>
#include <sys/syslog.h>

#include <sys/malloc.h>
#include <sys/protosw.h>

#include <net/if.h>
#include <net/route.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#if INET
#include <netinet/ip.h>
#endif
#include <netinet/ip_encap.h>
#if INET6
#include <netinet/ip6.h>
#include <netinet6/ip6_var.h>
#include <netinet6/in6_gif.h>
#include <netinet6/in6_var.h>
#endif
#include <netinet/ip_ecn.h>
#if INET6
#include <netinet6/ip6_ecn.h>
#endif

#include <net/if_gif.h>

#include <net/net_osdep.h>

int
in6_gif_output(ifp, family, m, rt)
	struct ifnet *ifp;
	int family; /* family of the packet to be encapsulate. */
	struct mbuf *m;
	struct rtentry *rt;
{
	struct gif_softc *sc = (struct gif_softc*)ifp;
	struct sockaddr_in6 *dst = (struct sockaddr_in6 *)&sc->gif_ro6.ro_dst;
	struct sockaddr_in6 *sin6_src = (struct sockaddr_in6 *)sc->gif_psrc;
	struct sockaddr_in6 *sin6_dst = (struct sockaddr_in6 *)sc->gif_pdst;
	struct ip6_hdr *ip6;
	int proto;
	u_int8_t itos, otos;

	if (sin6_src == NULL || sin6_dst == NULL ||
	    sin6_src->sin6_family != AF_INET6 ||
	    sin6_dst->sin6_family != AF_INET6) {
		m_freem(m);
		return EAFNOSUPPORT;
	}

	switch (family) {
#if INET
	case AF_INET:
	    {
		struct ip *ip;

		proto = IPPROTO_IPV4;
		if (m->m_len < sizeof(*ip)) {
			m = m_pullup(m, sizeof(*ip));
			if (!m)
				return ENOBUFS;
		}
		ip = mtod(m, struct ip *);
		itos = ip->ip_tos;
		break;
	    }
#endif
#if INET6
	case AF_INET6:
	    {
		struct ip6_hdr *ip6;
		proto = IPPROTO_IPV6;
		if (m->m_len < sizeof(*ip6)) {
			m = m_pullup(m, sizeof(*ip6));
			if (!m)
				return ENOBUFS;
		}
		ip6 = mtod(m, struct ip6_hdr *);
		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
		break;
	    }
#endif
	default:
#if DEBUG
		printf("in6_gif_output: warning: unknown family %d passed\n",
			family);
#endif
		m_freem(m);
		return EAFNOSUPPORT;
	}
	
	/* prepend new IP header */
	M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
	if (m && m->m_len < sizeof(struct ip6_hdr))
		m = m_pullup(m, sizeof(struct ip6_hdr));
	if (m == NULL) {
		printf("ENOBUFS in in6_gif_output %d\n", __LINE__);
		return ENOBUFS;
	}

	ip6 = mtod(m, struct ip6_hdr *);
	ip6->ip6_flow	= 0;
	ip6->ip6_vfc	&= ~IPV6_VERSION_MASK;
	ip6->ip6_vfc	|= IPV6_VERSION;
	ip6->ip6_plen	= htons((u_short)m->m_pkthdr.len);
	ip6->ip6_nxt	= proto;
	ip6->ip6_hlim	= ip6_gif_hlim;
	ip6->ip6_src	= sin6_src->sin6_addr;
	/* bidirectional configured tunnel mode */
	if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr))
		ip6->ip6_dst = sin6_dst->sin6_addr;
	else  {
		m_freem(m);
		return ENETUNREACH;
	}
	if (ifp->if_flags & IFF_LINK1)
		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
	else
		ip_ecn_ingress(ECN_NOCARE, &otos, &itos);
	ip6->ip6_flow &= ~ntohl(0xff00000);
	ip6->ip6_flow |= htonl((u_int32_t)otos << 20);

	if (dst->sin6_family != sin6_dst->sin6_family ||
	     !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &sin6_dst->sin6_addr)) {
		/* cache route doesn't match */
		bzero(dst, sizeof(*dst));
		dst->sin6_family = sin6_dst->sin6_family;
		dst->sin6_len = sizeof(struct sockaddr_in6);
		dst->sin6_addr = sin6_dst->sin6_addr;
		if (sc->gif_ro6.ro_rt) {
			rtfree(sc->gif_ro6.ro_rt);
			sc->gif_ro6.ro_rt = NULL;
		}
#if 0
		sc->gif_if.if_mtu = GIF_MTU;
#endif
	}

	if (sc->gif_ro6.ro_rt == NULL) {
		rtalloc((struct route *)&sc->gif_ro6);
		if (sc->gif_ro6.ro_rt == NULL) {
			m_freem(m);
			return ENETUNREACH;
		}

		/* if it constitutes infinite encapsulation, punt. */
		if (sc->gif_ro.ro_rt->rt_ifp == ifp) {
			m_freem(m);
			return ENETUNREACH;	/*XXX*/
		}
#if 0
		ifp->if_mtu = sc->gif_ro6.ro_rt->rt_ifp->if_mtu
			- sizeof(struct ip6_hdr);
#endif
	}
	
#if IPV6_MINMTU
	/*
	 * force fragmentation to minimum MTU, to avoid path MTU discovery.
	 * it is too painful to ask for resend of inner packet, to achieve
	 * path MTU discovery for encapsulated packets.
	 */
	return(ip6_output(m, 0, &sc->gif_ro6, IPV6_MINMTU, 0, NULL));
#else
	return(ip6_output(m, 0, &sc->gif_ro6, 0, 0, NULL));
#endif
}

int in6_gif_input(mp, offp)
	struct mbuf **mp;
	int *offp;
{
	struct mbuf *m = *mp;
	struct ifnet *gifp = NULL;
	struct ip6_hdr *ip6;
	int af = 0;
	u_int32_t otos;
	u_int8_t proto;

	ip6 = mtod(m, struct ip6_hdr *);

	gifp = (struct ifnet *)encap_getarg(m);

	if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) {
		m_freem(m);
		ip6stat.ip6s_nogif++;
		return IPPROTO_DONE;
	}

	proto = ip6->ip6_nxt;
	otos = ip6->ip6_flow;
	m_adj(m, *offp);

	switch (proto) {
#if INET
	case IPPROTO_IPV4:
	    {
		struct ip *ip;
		u_int8_t otos8;
		af = AF_INET;
		otos8 = (ntohl(otos) >> 20) & 0xff;
		if (m->m_len < sizeof(*ip)) {
			m = m_pullup(m, sizeof(*ip));
			if (!m)
				return IPPROTO_DONE;
		}
		ip = mtod(m, struct ip *);
		if (gifp->if_flags & IFF_LINK1)
			ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos);
		else
			ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos);
		break;
	    }
#endif /* INET */
#if INET6
	case IPPROTO_IPV6:
	    {
		struct ip6_hdr *ip6;
		af = AF_INET6;
		if (m->m_len < sizeof(*ip6)) {
			m = m_pullup(m, sizeof(*ip6));
			if (!m)
				return IPPROTO_DONE;
		}
		ip6 = mtod(m, struct ip6_hdr *);
		if (gifp->if_flags & IFF_LINK1)
			ip6_ecn_egress(ECN_ALLOWED, &otos, &ip6->ip6_flow);
		else
			ip6_ecn_egress(ECN_NOCARE, &otos, &ip6->ip6_flow);
		break;
	    }
#endif
	default:
		ip6stat.ip6s_nogif++;
		m_freem(m);
		return IPPROTO_DONE;
	}
		
	dlil_input(gifp, m, m);
	return IPPROTO_DONE;
}

/*
 * validate outer address.
 */
static int
gif_validate6(ip6, sc, ifp)
	const struct ip6_hdr *ip6;
	struct gif_softc *sc;
	struct ifnet *ifp;
{
	struct sockaddr_in6 *src, *dst;

	src = (struct sockaddr_in6 *)sc->gif_psrc;
	dst = (struct sockaddr_in6 *)sc->gif_pdst;

	/*
	 * Check for address match.  Note that the check is for an incoming
	 * packet.  We should compare the *source* address in our configuration
	 * and the *destination* address of the packet, and vice versa.
	 */
	if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) ||
	    !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src))
		return 0;

	/* martian filters on outer source - done in ip6_input */

	/* ingress filters on outer source */
	if ((sc->gif_if.if_flags & IFF_LINK2) == 0 && ifp) {
		struct sockaddr_in6 sin6;
		struct rtentry *rt;

		bzero(&sin6, sizeof(sin6));
		sin6.sin6_family = AF_INET6;
		sin6.sin6_len = sizeof(struct sockaddr_in6);
		sin6.sin6_addr = ip6->ip6_src;
#ifndef SCOPEDROUTING
		sin6.sin6_scope_id = 0; /* XXX */
#endif

		rt = rtalloc1((struct sockaddr *)&sin6, 0, 0UL);
		if (!rt || rt->rt_ifp != ifp) {
#if 0
			log(LOG_WARNING, "%s: packet from %s dropped "
			    "due to ingress filter\n", if_name(&sc->gif_if),
			    ip6_sprintf(&sin6.sin6_addr));
#endif
			if (rt)
				rtfree(rt);
			return 0;
		}
		rtfree(rt);
	}

	return 128 * 2;
}

/*
 * we know that we are in IFF_UP, outer address available, and outer family
 * matched the physical addr family.  see gif_encapcheck().
 * sanity check for arg should have been done in the caller.
 */
int
gif_encapcheck6(m, off, proto, arg)
	const struct mbuf *m;
	int off;
	int proto;
	void *arg;
{
	struct ip6_hdr ip6;
	struct gif_softc *sc;
	struct ifnet *ifp;

	/* sanity check done in caller */
	sc = (struct gif_softc *)arg;

	/* LINTED const cast */
	m_copydata(m, 0, sizeof(ip6), (caddr_t)&ip6);
	ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL;

	return gif_validate6(&ip6, sc, ifp);
}
Commit	Line	Data
9bccf70c A	1	/* $FreeBSD: src/sys/netinet6/in6_gif.c,v 1.2.2.3 2001/07/03 11:01:52 ume Exp $ */
9bccf70c A	2	/* $KAME: in6_gif.c,v 1.49 2001/05/14 14:02:17 itojun Exp $ */
1c79356b A	3
	4	/*
	5	* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
	6	* All rights reserved.
	7	*
	8	* Redistribution and use in source and binary forms, with or without
	9	* modification, are permitted provided that the following conditions
	10	* are met:
	11	* 1. Redistributions of source code must retain the above copyright
	12	* notice, this list of conditions and the following disclaimer.
	13	* 2. Redistributions in binary form must reproduce the above copyright
	14	* notice, this list of conditions and the following disclaimer in the
	15	* documentation and/or other materials provided with the distribution.
	16	* 3. Neither the name of the project nor the names of its contributors
	17	* may be used to endorse or promote products derived from this software
	18	* without specific prior written permission.
	19	*
	20	* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
	21	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	22	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	23	* ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
	24	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	25	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	26	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	27	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	28	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	29	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	30	* SUCH DAMAGE.
	31	*/
	32
1c79356b A	33
	34	#include <sys/param.h>
	35	#include <sys/systm.h>
	36	#include <sys/socket.h>
	37	#include <sys/sockio.h>
	38	#include <sys/mbuf.h>
	39	#include <sys/errno.h>
9bccf70c A	40	#include <sys/queue.h>
	41	#include <sys/syslog.h>
	42
1c79356b A	43	#include <sys/malloc.h>
	44	#include <sys/protosw.h>
	45
	46	#include <net/if.h>
	47	#include <net/route.h>
	48
	49	#include <netinet/in.h>
	50	#include <netinet/in_systm.h>
	51	#if INET
	52	#include <netinet/ip.h>
	53	#endif
	54	#include <netinet/ip_encap.h>
	55	#if INET6
	56	#include <netinet/ip6.h>
	57	#include <netinet6/ip6_var.h>
	58	#include <netinet6/in6_gif.h>
	59	#include <netinet6/in6_var.h>
1c79356b A	60	#endif
1c79356b A	61	#include <netinet/ip_ecn.h>
9bccf70c A	62	#if INET6
	63	#include <netinet6/ip6_ecn.h>
	64	#endif
1c79356b A	65
	66	#include <net/if_gif.h>
	67
	68	#include <net/net_osdep.h>
	69
1c79356b A	70	int
	71	in6_gif_output(ifp, family, m, rt)
	72	struct ifnet *ifp;
	73	int family; /* family of the packet to be encapsulate. */
	74	struct mbuf *m;
	75	struct rtentry *rt;
	76	{
	77	struct gif_softc sc = (struct gif_softc)ifp;
	78	struct sockaddr_in6 dst = (struct sockaddr_in6 )&sc->gif_ro6.ro_dst;
	79	struct sockaddr_in6 sin6_src = (struct sockaddr_in6 )sc->gif_psrc;
	80	struct sockaddr_in6 sin6_dst = (struct sockaddr_in6 )sc->gif_pdst;
	81	struct ip6_hdr *ip6;
	82	int proto;
	83	u_int8_t itos, otos;
	84
	85	if (sin6_src == NULL \|\| sin6_dst == NULL \|\|
	86	sin6_src->sin6_family != AF_INET6 \|\|
	87	sin6_dst->sin6_family != AF_INET6) {
	88	m_freem(m);
	89	return EAFNOSUPPORT;
	90	}
	91
	92	switch (family) {
	93	#if INET
	94	case AF_INET:
	95	{
	96	struct ip *ip;
	97
	98	proto = IPPROTO_IPV4;
	99	if (m->m_len < sizeof(*ip)) {
	100	m = m_pullup(m, sizeof(*ip));
	101	if (!m)
	102	return ENOBUFS;
	103	}
	104	ip = mtod(m, struct ip *);
	105	itos = ip->ip_tos;
	106	break;
	107	}
	108	#endif
	109	#if INET6
	110	case AF_INET6:
	111	{
	112	struct ip6_hdr *ip6;
	113	proto = IPPROTO_IPV6;
	114	if (m->m_len < sizeof(*ip6)) {
	115	m = m_pullup(m, sizeof(*ip6));
	116	if (!m)
	117	return ENOBUFS;
	118	}
	119	ip6 = mtod(m, struct ip6_hdr *);
	120	itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
	121	break;
	122	}
	123	#endif
	124	default:
	125	#if DEBUG
	126	printf("in6_gif_output: warning: unknown family %d passed\n",
	127	family);
	128	#endif
	129	m_freem(m);
	130	return EAFNOSUPPORT;
	131	}
	132
	133	/* prepend new IP header */
134	M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
135	if (m && m->m_len < sizeof(struct ip6_hdr))
136	m = m_pullup(m, sizeof(struct ip6_hdr));
137	if (m == NULL) {
138	printf("ENOBUFS in in6_gif_output %d\n", __LINE__);
139	return ENOBUFS;
140	}
141
142	ip6 = mtod(m, struct ip6_hdr *);
143	ip6->ip6_flow = 0;
144	ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
145	ip6->ip6_vfc \|= IPV6_VERSION;
146	ip6->ip6_plen = htons((u_short)m->m_pkthdr.len);
147	ip6->ip6_nxt = proto;
148	ip6->ip6_hlim = ip6_gif_hlim;
149	ip6->ip6_src = sin6_src->sin6_addr;
9bccf70c A	150	/* bidirectional configured tunnel mode */
	151	if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr))
	152	ip6->ip6_dst = sin6_dst->sin6_addr;
	153	else {
	154	m_freem(m);
	155	return ENETUNREACH;
1c79356b	156	}
9bccf70c	157	if (ifp->if_flags & IFF_LINK1)
1c79356b	158	ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
9bccf70c A	159	else
	160	ip_ecn_ingress(ECN_NOCARE, &otos, &itos);
	161	ip6->ip6_flow &= ~ntohl(0xff00000);
	162	ip6->ip6_flow \|= htonl((u_int32_t)otos << 20);
1c79356b A	163
	164	if (dst->sin6_family != sin6_dst->sin6_family \|\|
	165	!IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &sin6_dst->sin6_addr)) {
	166	/* cache route doesn't match */
	167	bzero(dst, sizeof(*dst));
	168	dst->sin6_family = sin6_dst->sin6_family;
	169	dst->sin6_len = sizeof(struct sockaddr_in6);
	170	dst->sin6_addr = sin6_dst->sin6_addr;
	171	if (sc->gif_ro6.ro_rt) {
9bccf70c	172	rtfree(sc->gif_ro6.ro_rt);
1c79356b A	173	sc->gif_ro6.ro_rt = NULL;
	174	}
	175	#if 0
	176	sc->gif_if.if_mtu = GIF_MTU;
	177	#endif
	178	}
	179
	180	if (sc->gif_ro6.ro_rt == NULL) {
	181	rtalloc((struct route *)&sc->gif_ro6);
	182	if (sc->gif_ro6.ro_rt == NULL) {
	183	m_freem(m);
	184	return ENETUNREACH;
	185	}
9bccf70c A	186
	187	/* if it constitutes infinite encapsulation, punt. */
	188	if (sc->gif_ro.ro_rt->rt_ifp == ifp) {
	189	m_freem(m);
	190	return ENETUNREACH; /XXX/
	191	}
1c79356b A	192	#if 0
	193	ifp->if_mtu = sc->gif_ro6.ro_rt->rt_ifp->if_mtu
	194	- sizeof(struct ip6_hdr);
	195	#endif
	196	}
	197
9bccf70c A	198	#if IPV6_MINMTU
	199	/*
	200	* force fragmentation to minimum MTU, to avoid path MTU discovery.
	201	* it is too painful to ask for resend of inner packet, to achieve
	202	* path MTU discovery for encapsulated packets.
	203	*/
	204	return(ip6_output(m, 0, &sc->gif_ro6, IPV6_MINMTU, 0, NULL));
	205	#else
1c79356b	206	return(ip6_output(m, 0, &sc->gif_ro6, 0, 0, NULL));
9bccf70c	207	#endif
1c79356b A	208	}
1c79356b A	209
9bccf70c	210	int in6_gif_input(mp, offp)
1c79356b	211	struct mbuf **mp;
9bccf70c	212	int *offp;
1c79356b A	213	{
1c79356b A	214	struct mbuf m = mp;
1c79356b A	215	struct ifnet *gifp = NULL;
1c79356b A	216	struct ip6_hdr *ip6;
1c79356b A	217	int af = 0;
1c79356b A	218	u_int32_t otos;
9bccf70c	219	u_int8_t proto;
1c79356b A	220
	221	ip6 = mtod(m, struct ip6_hdr *);
	222
1c79356b	223	gifp = (struct ifnet *)encap_getarg(m);
1c79356b	224
9bccf70c	225	if (gifp == NULL \|\| (gifp->if_flags & IFF_UP) == 0) {
1c79356b A	226	m_freem(m);
	227	ip6stat.ip6s_nogif++;
	228	return IPPROTO_DONE;
	229	}
	230
9bccf70c	231	proto = ip6->ip6_nxt;
1c79356b A	232	otos = ip6->ip6_flow;
	233	m_adj(m, *offp);
	234
	235	switch (proto) {
	236	#if INET
	237	case IPPROTO_IPV4:
	238	{
	239	struct ip *ip;
	240	u_int8_t otos8;
	241	af = AF_INET;
	242	otos8 = (ntohl(otos) >> 20) & 0xff;
	243	if (m->m_len < sizeof(*ip)) {
	244	m = m_pullup(m, sizeof(*ip));
	245	if (!m)
	246	return IPPROTO_DONE;
	247	}
	248	ip = mtod(m, struct ip *);
	249	if (gifp->if_flags & IFF_LINK1)
	250	ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos);
9bccf70c A	251	else
9bccf70c A	252	ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos);
1c79356b A	253	break;
	254	}
	255	#endif /* INET */
	256	#if INET6
	257	case IPPROTO_IPV6:
	258	{
	259	struct ip6_hdr *ip6;
	260	af = AF_INET6;
	261	if (m->m_len < sizeof(*ip6)) {
	262	m = m_pullup(m, sizeof(*ip6));
	263	if (!m)
	264	return IPPROTO_DONE;
	265	}
	266	ip6 = mtod(m, struct ip6_hdr *);
	267	if (gifp->if_flags & IFF_LINK1)
	268	ip6_ecn_egress(ECN_ALLOWED, &otos, &ip6->ip6_flow);
9bccf70c A	269	else
9bccf70c A	270	ip6_ecn_egress(ECN_NOCARE, &otos, &ip6->ip6_flow);
1c79356b A	271	break;
	272	}
	273	#endif
	274	default:
	275	ip6stat.ip6s_nogif++;
	276	m_freem(m);
	277	return IPPROTO_DONE;
	278	}
	279
9bccf70c	280	dlil_input(gifp, m, m);
1c79356b A	281	return IPPROTO_DONE;
	282	}
	283
9bccf70c	284	/*
55e303ae	285	* validate outer address.
9bccf70c	286	*/
55e303ae A	287	static int
	288	gif_validate6(ip6, sc, ifp)
	289	const struct ip6_hdr *ip6;
9bccf70c	290	struct gif_softc *sc;
55e303ae A	291	struct ifnet *ifp;
55e303ae A	292	{
9bccf70c	293	struct sockaddr_in6 src, dst;
9bccf70c	294
9bccf70c A	295	src = (struct sockaddr_in6 *)sc->gif_psrc;
	296	dst = (struct sockaddr_in6 *)sc->gif_pdst;
	297
55e303ae A	298	/*
	299	* Check for address match. Note that the check is for an incoming
	300	* packet. We should compare the source address in our configuration
	301	* and the destination address of the packet, and vice versa.
	302	*/
	303	if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) \|\|
	304	!IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src))
9bccf70c A	305	return 0;
	306
	307	/* martian filters on outer source - done in ip6_input */
	308
	309	/* ingress filters on outer source */
55e303ae	310	if ((sc->gif_if.if_flags & IFF_LINK2) == 0 && ifp) {
9bccf70c A	311	struct sockaddr_in6 sin6;
	312	struct rtentry *rt;
	313
	314	bzero(&sin6, sizeof(sin6));
	315	sin6.sin6_family = AF_INET6;
	316	sin6.sin6_len = sizeof(struct sockaddr_in6);
55e303ae A	317	sin6.sin6_addr = ip6->ip6_src;
	318	#ifndef SCOPEDROUTING
	319	sin6.sin6_scope_id = 0; /* XXX */
	320	#endif
	321
9bccf70c	322	rt = rtalloc1((struct sockaddr *)&sin6, 0, 0UL);
55e303ae	323	if (!rt \|\| rt->rt_ifp != ifp) {
9bccf70c A	324	#if 0
	325	log(LOG_WARNING, "%s: packet from %s dropped "
	326	"due to ingress filter\n", if_name(&sc->gif_if),
	327	ip6_sprintf(&sin6.sin6_addr));
1c79356b	328	#endif
9bccf70c A	329	if (rt)
	330	rtfree(rt);
	331	return 0;
1c79356b	332	}
9bccf70c	333	rtfree(rt);
1c79356b A	334	}
1c79356b A	335
9bccf70c	336	return 128 * 2;
1c79356b	337	}
55e303ae A	338
	339	/*
	340	* we know that we are in IFF_UP, outer address available, and outer family
	341	* matched the physical addr family. see gif_encapcheck().
	342	* sanity check for arg should have been done in the caller.
	343	*/
	344	int
	345	gif_encapcheck6(m, off, proto, arg)
	346	const struct mbuf *m;
	347	int off;
	348	int proto;
	349	void *arg;
	350	{
	351	struct ip6_hdr ip6;
	352	struct gif_softc *sc;
	353	struct ifnet *ifp;
	354
	355	/* sanity check done in caller */
	356	sc = (struct gif_softc *)arg;
	357
	358	/* LINTED const cast */
	359	m_copydata(m, 0, sizeof(ip6), (caddr_t)&ip6);
	360	ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL;
	361
	362	return gif_validate6(&ip6, sc, ifp);
	363	}