don't embed scope id before running packet filters.

Reported by:	YAMAMOTO Takashi <yamt__at__mwd.biglobe.ne.jp>
Obtained from:	NetBSD
MFC after:	1 week

1 files changed, 20 insertions, 20 deletions

diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c
index 757b1d1..3b34557 100644
--- a/sys/netinet6/ip6_input.c
+++ b/sys/netinet6/ip6_input.c
@@ -405,26 +405,6 @@ ip6_input(m)
 #endif
 
 	/*
-	 * Disambiguate address scope zones (if there is ambiguity).
-	 * We first make sure that the original source or destination address
-	 * is not in our internal form for scoped addresses.  Such addresses
-	 * are not necessarily invalid spec-wise, but we cannot accept them due
-	 * to the usage conflict.
-	 * in6_setscope() then also checks and rejects the cases where src or
-	 * dst are the loopback address and the receiving interface
-	 * is not loopback. 
-	 */
-	if (in6_clearscope(&ip6->ip6_src) || in6_clearscope(&ip6->ip6_dst)) {
-		ip6stat.ip6s_badscope++; /* XXX */
-		goto bad;
-	}
-	if (in6_setscope(&ip6->ip6_src, m->m_pkthdr.rcvif, NULL) ||
-	    in6_setscope(&ip6->ip6_dst, m->m_pkthdr.rcvif, NULL)) {
-		ip6stat.ip6s_badscope++;
-		goto bad;
-	}
-
-	/*
 	 * Run through list of hooks for input packets.
 	 *
 	 * NB: Beware of the destination address changing
@@ -461,6 +441,26 @@ passin:
 	}
 
 	/*
+	 * Disambiguate address scope zones (if there is ambiguity).
+	 * We first make sure that the original source or destination address
+	 * is not in our internal form for scoped addresses.  Such addresses
+	 * are not necessarily invalid spec-wise, but we cannot accept them due
+	 * to the usage conflict.
+	 * in6_setscope() then also checks and rejects the cases where src or
+	 * dst are the loopback address and the receiving interface
+	 * is not loopback.
+	 */
+	if (in6_clearscope(&ip6->ip6_src) || in6_clearscope(&ip6->ip6_dst)) {
+		ip6stat.ip6s_badscope++; /* XXX */
+		goto bad;
+	}
+	if (in6_setscope(&ip6->ip6_src, m->m_pkthdr.rcvif, NULL) ||
+	    in6_setscope(&ip6->ip6_dst, m->m_pkthdr.rcvif, NULL)) {
+		ip6stat.ip6s_badscope++;
+		goto bad;
+	}
+
+	/*
 	 * Multicast check
 	 */
 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {