| 1008 | |
| 1009 | #ifdef SIFTR_IPV6 |
| 1010 | static int |
| 1011 | siftr_chkpkt6(struct mbuf **m, struct ifnet *ifp, int flags, struct inpcb *inp) |
| 1012 | { |
| 1013 | struct pkt_node *pn; |
| 1014 | struct ip6_hdr *ip6; |
| 1015 | struct tcphdr *th; |
| 1016 | struct tcpcb *tp; |
| 1017 | struct siftr_stats *ss; |
| 1018 | unsigned int ip6_hl; |
| 1019 | int inp_locally_locked, dir; |
| 1020 | |
| 1021 | inp_locally_locked = 0; |
| 1022 | dir = PFIL_DIR(flags); |
| 1023 | ss = DPCPU_PTR(ss); |
| 1024 | |
| 1025 | /* |
| 1026 | * m_pullup is not required here because ip6_{input|output} |
| 1027 | * already do the heavy lifting for us. |
| 1028 | */ |
| 1029 | |
| 1030 | ip6 = mtod(*m, struct ip6_hdr *); |
| 1031 | |
| 1032 | /* |
| 1033 | * Only continue processing if the packet is TCP |
| 1034 | * XXX: We should follow the next header fields |
| 1035 | * as shown on Pg 6 RFC 2460, but right now we'll |
| 1036 | * only check pkts that have no extension headers. |
| 1037 | */ |
| 1038 | if (ip6->ip6_nxt != IPPROTO_TCP) |
| 1039 | goto ret6; |
| 1040 | |
| 1041 | /* |
| 1042 | * If a kernel subsystem reinjects packets into the stack, our pfil |
| 1043 | * hook will be called multiple times for the same packet. |
| 1044 | * Make sure we only process unique packets. |
| 1045 | */ |
| 1046 | if (siftr_chkreinject(*m, dir, ss)) |
| 1047 | goto ret6; |
| 1048 | |
| 1049 | if (dir == PFIL_IN) |
| 1050 | ss->n_in++; |
| 1051 | else |
| 1052 | ss->n_out++; |
| 1053 | |
| 1054 | ip6_hl = sizeof(struct ip6_hdr); |
| 1055 | |
| 1056 | /* |
| 1057 | * Create a tcphdr struct starting at the correct offset |
| 1058 | * in the ipv6 packet. ip->ip_hl gives the ip header length |
| 1059 | * in 4-byte words, so multiply it to get the size in bytes. |
| 1060 | */ |
| 1061 | th = (struct tcphdr *)((caddr_t)ip6 + ip6_hl); |
| 1062 | |
| 1063 | /* |
| 1064 | * For inbound packets, the pfil hooks don't provide a pointer to the |
| 1065 | * inpcb, so we need to find it ourselves and lock it. |
| 1066 | */ |
| 1067 | if (!inp) { |
nothing calls this directly
no test coverage detected