- correct logic of per-address input packet counts for lo0

- reject packets to fe80::xxxx%lo0 (xxxx != 1)

Submitted by:	JINMEI Tatuya <jinmei@isl.rdc.toshiba.co.jp>

1 files changed, 29 insertions, 16 deletions

diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c
index 20c84a3..b1de716 100644
--- a/sys/netinet6/ip6_input.c
+++ b/sys/netinet6/ip6_input.c
@@ -391,17 +391,24 @@ ip6_input(m)
 	if (IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) ||
 	    IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst)) {
 		if (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) {
-			if (ip6_forward_rt.ro_rt != NULL &&
-			    (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) != 0 &&
-	    		    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6_forward_rt.ro_dst.sin6_addr)) {
-				struct in6_ifaddr *ia6 =
-					(struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa;
+			struct in6_ifaddr *ia6;
+
+			if ((ia6 = in6ifa_ifpwithaddr(m->m_pkthdr.rcvif,
+						      &ip6->ip6_dst)) != NULL) {
 				ia6->ia_ifa.if_ipackets++;
 				ia6->ia_ifa.if_ibytes += m->m_pkthdr.len;
-				ours = 1;
-				deliverifp = m->m_pkthdr.rcvif;
-				goto hbhcheck;
+			} else {
+				/*
+				 * The packet is looped back, but we do not
+				 * have the destination address for some
+				 * reason.
+				 * XXX: should we return an icmp6 error?
+				 */
+				goto bad;
 			}
+			ours = 1;
+			deliverifp = m->m_pkthdr.rcvif;
+			goto hbhcheck;
 		} else {
 			ip6stat.ip6s_badscope++;
 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
@@ -431,17 +438,23 @@ ip6_input(m)
 	 */
 	if ((m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) != 0) {
 		if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) {
-			if (ip6_forward_rt.ro_rt != NULL &&
-			    (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) != 0 &&
-	    		    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6_forward_rt.ro_dst.sin6_addr)) {
-				struct in6_ifaddr *ia6 =
-					(struct in6_ifaddr *)ip6_forward_rt.ro_rt->rt_ifa;
+			struct in6_ifaddr *ia6;
+
+			if ((ia6 = in6ifa_ifpwithaddr(m->m_pkthdr.rcvif,
+						      &ip6->ip6_dst)) != NULL) {
 				ia6->ia_ifa.if_ipackets++;
 				ia6->ia_ifa.if_ibytes += m->m_pkthdr.len;
-				ours = 1;
-				deliverifp = m->m_pkthdr.rcvif;
-				goto hbhcheck;
+			} else {
+				/*
+				 * We do not have the link-local address
+				 * specified as the destination.
+				 * XXX: should we return an icmp6 error?
+				 */
+				goto bad;
 			}
+			ours = 1;
+			deliverifp = m->m_pkthdr.rcvif;
+			goto hbhcheck;
 		}
 	}