Subversion Repositories openrisc_me

//==========================================================================

//

//      src/sys/netinet6/ip6_fw.c

//

//==========================================================================

//####BSDCOPYRIGHTBEGIN####

//

// -------------------------------------------

//

// Portions of this software may have been derived from OpenBSD, 

// FreeBSD or other sources, and are covered by the appropriate

// copyright disclaimers included herein.

//

// Portions created by Red Hat are

// Copyright (C) 2002 Red Hat, Inc. All Rights Reserved.

//

// -------------------------------------------

//

//####BSDCOPYRIGHTEND####

//==========================================================================

/*      $KAME: ip6_fw.c,v 1.29 2001/12/18 02:23:44 itojun Exp $ */

/*

 * Copyright (C) 1998, 1999, 2000 and 2001 WIDE Project.

 * All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 * 3. Neither the name of the project nor the names of its contributors

 *    may be used to endorse or promote products derived from this software

 *    without specific prior written permission.

 *

 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND

 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE

 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

 * SUCH DAMAGE.

 */

/*

 * Copyright (c) 1993 Daniel Boulet

 * Copyright (c) 1994 Ugen J.S.Antsilevich

 * Copyright (c) 1996 Alex Nash

 *

 * Redistribution and use in source forms, with and without modification,

 * are permitted provided that this entire comment appears intact.

 *

 * Redistribution in binary form may occur without any restrictions.

 * Obviously, it would be nice if you gave credit where credit is due

 * but requiring it would be too onerous.

 *

 * This software is provided ``AS IS'' without any warranties of any kind.

 */

/*

 * Implement IPv6 packet firewall

 */

#ifdef IP6DIVERT

#error "NOT SUPPORTED IPV6 DIVERT"

#endif

#ifdef IP6FW_DIVERT_RESTART

#error "NOT SUPPORTED IPV6 DIVERT"

#endif

#include <sys/param.h>

#include <sys/systm.h>

#include <sys/malloc.h>

#include <sys/mbuf.h>

#include <sys/queue.h>

#include <sys/kernel.h>

#include <sys/socket.h>

#if defined(__FreeBSD__) && __FreeBSD__ >= 3

#include <sys/socketvar.h>

#endif

#include <sys/syslog.h>

#include <sys/time.h>

#include <net/if.h>

#include <net/route.h>

#include <netinet/in_systm.h>

#include <netinet/in.h>

#include <netinet/ip.h>

#include <netinet/ip6.h>

#include <netinet6/ip6_var.h>

#include <netinet6/in6_var.h>

#include <netinet/icmp6.h>

#include <netinet/in_pcb.h>

#include <netinet6/ip6_fw.h>

#ifdef TCP6

#include <netinet6/tcp6.h>

#include <netinet6/tcp6_timer.h>

#include <netinet6/tcp6_var.h>

#endif

#include <netinet/ip_var.h>

#include <netinet/tcp.h>

#include <netinet/tcp_seq.h>

#include <netinet/tcp_timer.h>

#include <netinet/tcp_var.h>

#include <netinet/udp.h>

#if defined(__NetBSD__) || defined(__OpenBSD__)

#include <vm/vm.h>

#endif

#ifdef __FreeBSD__

#include <sys/sysctl.h>

#endif

#include <net/net_osdep.h>

#if defined(__FreeBSD__) && __FreeBSD__ >= 3

MALLOC_DEFINE(M_IP6FW, "Ip6Fw/Ip6Acct", "Ip6Fw/Ip6Acct chain's");

#else

#ifndef M_IP6FW

#define M_IP6FW M_TEMP

#endif

#endif

#ifndef LOG_SECURITY

#define LOG_SECURITY LOG_AUTH

#endif

static int fw6_debug = 1;

#ifdef IPV6FIREWALL_VERBOSE

static int fw6_verbose = 1;

#else

static int fw6_verbose = 0;

#endif

#ifdef IPV6FIREWALL_VERBOSE_LIMIT

static int fw6_verbose_limit = IPV6FIREWALL_VERBOSE_LIMIT;

#else

static int fw6_verbose_limit = 0;

#endif

LIST_HEAD (ip6_fw_head, ip6_fw_chain) ip6_fw_chain;

#ifdef SYSCTL_NODE

#if defined(__FreeBSD__) && __FreeBSD__ >= 4

SYSCTL_DECL(_net_inet6_ip6);

#endif

SYSCTL_NODE(_net_inet6_ip6, OID_AUTO, fw, CTLFLAG_RW, 0, "Firewall");

#if defined(__FreeBSD__) && __FreeBSD__ >= 4

SYSCTL_INT(_net_inet6_ip6_fw, OID_AUTO, enable, CTLFLAG_RW,

        &ip6_fw_enable, 0, "Enable ip6fw");

#endif

SYSCTL_INT(_net_inet6_ip6_fw, OID_AUTO, debug, CTLFLAG_RW, &fw6_debug, 0, "");

SYSCTL_INT(_net_inet6_ip6_fw, OID_AUTO, verbose, CTLFLAG_RW, &fw6_verbose, 0, "");

SYSCTL_INT(_net_inet6_ip6_fw, OID_AUTO, verbose_limit, CTLFLAG_RW, &fw6_verbose_limit, 0, "");

#endif

#define dprintf(a)      do {                                            \

                                if (fw6_debug)                          \

                                        printf a;                       \

                        } while (0)

#define SNPARGS(buf, len) buf + len, sizeof(buf) > len ? sizeof(buf) - len : 0

static int      add_entry6 __P((struct ip6_fw_head *chainptr, struct ip6_fw *frwl));

static int      del_entry6 __P((struct ip6_fw_head *chainptr, u_short number));

static int      zero_entry6 __P((struct mbuf *m));

static struct ip6_fw *check_ip6fw_struct __P((struct ip6_fw *m));

static struct ip6_fw *check_ip6fw_mbuf __P((struct mbuf *fw));

static int      ip6opts_match __P((struct ip6_hdr **ip6, struct ip6_fw *f,

                                   struct mbuf **m,

                                   int *off, int *nxt, u_short *offset));

static int      port_match6 __P((u_short *portptr, int nports, u_short port,

                                int range_flag));

static int      tcp6flg_match __P((struct tcphdr *tcp6, struct ip6_fw *f));

static int      icmp6type_match __P((struct icmp6_hdr *  icmp, struct ip6_fw * f));

static void     ip6fw_report __P((struct ip6_fw *f, struct ip6_hdr *ip6,

                                struct ifnet *rif, struct ifnet *oif, int off, int nxt));

static int      ip6_fw_chk __P((struct ip6_hdr **pip6, struct ifnet *oif,

                                struct mbuf **m));

static int      ip6_fw_ctl __P((int stage, struct mbuf **mm));

static char err_prefix[] = "ip6_fw_ctl:";

/*

 * Returns 1 if the port is matched by the vector, 0 otherwise

 */

static

#if defined(__FreeBSD__) && __FreeBSD__ >= 3

__inline

#else

inline

#endif

int

port_match6(u_short *portptr, int nports, u_short port, int range_flag)

{

        if (!nports)

                return 1;

        if (range_flag) {

                if (portptr[0] <= port && port <= portptr[1]) {

                        return 1;

                }

                nports -= 2;

                portptr += 2;

        }

        while (nports-- > 0) {

                if (*portptr++ == port) {

                        return 1;

                }

        }

        return 0;

}

static int

tcp6flg_match(struct tcphdr *tcp6, struct ip6_fw *f)

{

        u_char          flg_set, flg_clr;

        /*

         * If an established connection is required, reject packets that

         * have only SYN of RST|ACK|SYN set.  Otherwise, fall through to

         * other flag requirements.

         */

        if ((f->fw_ipflg & IPV6_FW_IF_TCPEST) &&

            ((tcp6->th_flags & (IPV6_FW_TCPF_RST | IPV6_FW_TCPF_ACK |

            IPV6_FW_TCPF_SYN)) == IPV6_FW_TCPF_SYN))

                return 0;

        flg_set = tcp6->th_flags & f->fw_tcpf;

        flg_clr = tcp6->th_flags & f->fw_tcpnf;

        if (flg_set != f->fw_tcpf)

                return 0;

        if (flg_clr)

                return 0;

        return 1;

}

static int

icmp6type_match(struct icmp6_hdr *icmp6, struct ip6_fw *f)

{

        int type;

        if (!(f->fw_flg & IPV6_FW_F_ICMPBIT))

                return(1);

        type = icmp6->icmp6_type;

        /* check for matching type in the bitmap */

        if (type < IPV6_FW_ICMPTYPES_DIM * sizeof(unsigned) * 8 &&

                (f->fw_icmp6types[type / (sizeof(unsigned) * 8)] &

                (1U << (type % (8 * sizeof(unsigned))))))

                return(1);

        return(0); /* no match */

}

static int

is_icmp6_query(struct ip6_hdr *ip6, int off)

{

        const struct icmp6_hdr *icmp6;

        int icmp6_type;

        icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);

        icmp6_type = icmp6->icmp6_type;

        if (icmp6_type == ICMP6_ECHO_REQUEST ||

            icmp6_type == ICMP6_MEMBERSHIP_QUERY ||

            icmp6_type == ICMP6_WRUREQUEST ||

            icmp6_type == ICMP6_FQDN_QUERY ||

            icmp6_type == ICMP6_NI_QUERY)

                return(1);

        return(0);

}

static int

ip6opts_match(struct ip6_hdr **pip6, struct ip6_fw *f, struct mbuf **m,

              int *off, int *nxt, u_short *offset)

{

        int len;

        struct ip6_hdr *ip6 = *pip6;

        struct ip6_ext *ip6e;

        u_char  opts, nopts, nopts_sve;

        opts = f->fw_ip6opt;

        nopts = nopts_sve = f->fw_ip6nopt;

        *nxt = ip6->ip6_nxt;

        *off = sizeof(struct ip6_hdr);

        len = ntohs(ip6->ip6_plen) + sizeof(struct ip6_hdr);

        while (*off < len) {

                ip6e = (struct ip6_ext *)((caddr_t) ip6 + *off);

                if ((*m)->m_len < *off + sizeof(*ip6e))

                        goto opts_check;        /* XXX */

                switch (*nxt) {

                case IPPROTO_FRAGMENT:

                        if ((*m)->m_len >= *off + sizeof(struct ip6_frag)) {

                                struct ip6_frag *ip6f;

                                ip6f = (struct ip6_frag *) ((caddr_t)ip6 + *off);

                                *offset = ip6f->ip6f_offlg & IP6F_OFF_MASK;

                        }

                        opts &= ~IPV6_FW_IP6OPT_FRAG;

                        nopts &= ~IPV6_FW_IP6OPT_FRAG;

                        *off += sizeof(struct ip6_frag);

                        break;

                case IPPROTO_AH:

                        opts &= ~IPV6_FW_IP6OPT_AH;

                        nopts &= ~IPV6_FW_IP6OPT_AH;

                        *off += (ip6e->ip6e_len + 2) << 2;

                        break;

                default:

                        switch (*nxt) {

                        case IPPROTO_HOPOPTS:

                                opts &= ~IPV6_FW_IP6OPT_HOPOPT;

                                nopts &= ~IPV6_FW_IP6OPT_HOPOPT;

                                break;

                        case IPPROTO_ROUTING:

                                opts &= ~IPV6_FW_IP6OPT_ROUTE;

                                nopts &= ~IPV6_FW_IP6OPT_ROUTE;

                                break;

                        case IPPROTO_ESP:

                                opts &= ~IPV6_FW_IP6OPT_ESP;

                                nopts &= ~IPV6_FW_IP6OPT_ESP;

                                break;

                        case IPPROTO_NONE:

                                opts &= ~IPV6_FW_IP6OPT_NONXT;

                                nopts &= ~IPV6_FW_IP6OPT_NONXT;

                                goto opts_check;

                                break;

                        case IPPROTO_DSTOPTS:

                                opts &= ~IPV6_FW_IP6OPT_OPTS;

                                nopts &= ~IPV6_FW_IP6OPT_OPTS;

                                break;

                        default:

                                goto opts_check;

                                break;

                        }

                        *off += (ip6e->ip6e_len + 1) << 3;

                        break;

                }

                *nxt = ip6e->ip6e_nxt;

        }

 opts_check:

        if (f->fw_ip6opt == f->fw_ip6nopt)      /* XXX */

                return 1;

        if (opts == 0 && nopts == nopts_sve)

                return 1;

        else

                return 0;

}

static

#if defined(__FreeBSD__) && __FreeBSD__ >= 3

__inline

#else

inline

#endif

int

iface_match(struct ifnet *ifp, union ip6_fw_if *ifu, int byname)

{

        /* Check by name or by IP address */

        if (byname) {

#ifdef __NetBSD__

            {

                char xname[IFNAMSIZ];

                snprintf(xname, sizeof(xname), "%s%d", ifu->fu_via_if.name,

                        ifu->fu_via_if.unit);

                if (strcmp(ifp->if_xname, xname))

                        return(0);

            }

#else

                /* Check unit number (-1 is wildcard) */

                if (ifu->fu_via_if.unit != -1

                    && ifp->if_unit != ifu->fu_via_if.unit)

                        return(0);

                /* Check name */

                if (strncmp(ifp->if_name, ifu->fu_via_if.name, IP6FW_IFNLEN))

                        return(0);

#endif

                return(1);

        } else if (!IN6_IS_ADDR_UNSPECIFIED(&ifu->fu_via_ip6)) {        /* Zero == wildcard */

                struct ifaddr *ia;

#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)

                for (ia = ifp->if_addrlist; ia; ia = ia->ifa_next)

#else

                for (ia = ifp->if_addrlist.tqh_first; ia; ia = ia->ifa_list.tqe_next)

#endif

                {

                        if (ia->ifa_addr == NULL)

                                continue;

                        if (ia->ifa_addr->sa_family != AF_INET6)

                                continue;

                        if (!IN6_ARE_ADDR_EQUAL(&ifu->fu_via_ip6,

                            &(((struct sockaddr_in6 *)

                            (ia->ifa_addr))->sin6_addr)))

                                continue;

                        return(1);

                }

                return(0);

        }

        return(1);

}

static void

ip6fw_report(struct ip6_fw *f, struct ip6_hdr *ip6,

        struct ifnet *rif, struct ifnet *oif, int off, int nxt)

{

        static int counter;

        struct tcphdr *const tcp6 = (struct tcphdr *) ((caddr_t) ip6+ off);

        struct udphdr *const udp = (struct udphdr *) ((caddr_t) ip6+ off);

        struct icmp6_hdr *const icmp6 = (struct icmp6_hdr *) ((caddr_t) ip6+ off);

        int count;

        char *action;

        char action2[32], proto[102], name[18];

        int len;

        count = f ? f->fw_pcnt : ++counter;

        if (fw6_verbose_limit != 0 && count > fw6_verbose_limit)

                return;

        /* Print command name */

        snprintf(SNPARGS(name, 0), "ip6fw: %d", f ? f->fw_number : -1);

        action = action2;

        if (!f)

                action = "Refuse";

        else {

                switch (f->fw_flg & IPV6_FW_F_COMMAND) {

                case IPV6_FW_F_DENY:

                        action = "Deny";

                        break;

                case IPV6_FW_F_REJECT:

                        if (f->fw_reject_code == IPV6_FW_REJECT_RST)

                                action = "Reset";

                        else

                                action = "Unreach";

                        break;

                case IPV6_FW_F_ACCEPT:

                        action = "Accept";

                        break;

                case IPV6_FW_F_COUNT:

                        action = "Count";

                        break;

                case IPV6_FW_F_DIVERT:

                        snprintf(SNPARGS(action2, 0), "Divert %d",

                            f->fw_divert_port);

                        break;

                case IPV6_FW_F_TEE:

                        snprintf(SNPARGS(action2, 0), "Tee %d",

                            f->fw_divert_port);

                        break;

                case IPV6_FW_F_SKIPTO:

                        snprintf(SNPARGS(action2, 0), "SkipTo %d",

                            f->fw_skipto_rule);

                        break;

                default:

                        action = "UNKNOWN";

                        break;

                }

        }

        switch (nxt) {

        case IPPROTO_TCP:

                len = snprintf(SNPARGS(proto, 0), "TCP [%s]",

                    ip6_sprintf(&ip6->ip6_src));

                if (off > 0)

                        len += snprintf(SNPARGS(proto, len), ":%d ",

                            ntohs(tcp6->th_sport));

                else

                        len += snprintf(SNPARGS(proto, len), " ");

                len += snprintf(SNPARGS(proto, len), "[%s]",

                    ip6_sprintf(&ip6->ip6_dst));

                if (off > 0)

                        snprintf(SNPARGS(proto, len), ":%d",

                            ntohs(tcp6->th_dport));

                break;

        case IPPROTO_UDP:

                len = snprintf(SNPARGS(proto, 0), "UDP [%s]",

                    ip6_sprintf(&ip6->ip6_src));

                if (off > 0)

                        len += snprintf(SNPARGS(proto, len), ":%d ",

                            ntohs(udp->uh_sport));

                else

                    len += snprintf(SNPARGS(proto, len), " ");

                len += snprintf(SNPARGS(proto, len), "[%s]",

                    ip6_sprintf(&ip6->ip6_dst));

                if (off > 0)

                        snprintf(SNPARGS(proto, len), ":%d",

                            ntohs(udp->uh_dport));

                break;

        case IPPROTO_ICMPV6:

                if (off > 0)

                        len = snprintf(SNPARGS(proto, 0), "IPV6-ICMP:%u.%u ",

                            icmp6->icmp6_type, icmp6->icmp6_code);

                else

                        len = snprintf(SNPARGS(proto, 0), "IPV6-ICMP ");

                len += snprintf(SNPARGS(proto, len), "[%s]",

                    ip6_sprintf(&ip6->ip6_src));

                snprintf(SNPARGS(proto, len), " [%s]",

                    ip6_sprintf(&ip6->ip6_dst));

                break;

        default:

                len = snprintf(SNPARGS(proto, 0), "P:%d [%s]", nxt,

                    ip6_sprintf(&ip6->ip6_src));

                snprintf(SNPARGS(proto, len), " [%s]",

                    ip6_sprintf(&ip6->ip6_dst));

                break;

        }

        if (oif)

                log(LOG_SECURITY | LOG_INFO, "%s %s %s out via %s\n",

                    name, action, proto, if_name(oif));

        else if (rif)

                log(LOG_SECURITY | LOG_INFO, "%s %s %s in via %s\n",

                    name, action, proto, if_name(rif));

        else

                log(LOG_SECURITY | LOG_INFO, "%s %s %s",

                    name, action, proto);

        if (fw6_verbose_limit != 0 && count == fw6_verbose_limit)

            log(LOG_SECURITY | LOG_INFO, "ip6fw: limit reached on entry %d\n",

                f ? f->fw_number : -1);

}

/*

 * Parameters:

 *

 *      ip      Pointer to packet header (struct ip6_hdr *)

 *      hlen    Packet header length

 *      oif     Outgoing interface, or NULL if packet is incoming

 *      *m      The packet; we set to NULL when/if we nuke it.

 *

 * Return value:

 *

 *      0        The packet is to be accepted and routed normally OR

 *              the packet was denied/rejected and has been dropped;

 *              in the latter case, *m is equal to NULL upon return.

 *      port    Divert the packet to port.

 */

static int

ip6_fw_chk(struct ip6_hdr **pip6,

        struct ifnet *oif, struct mbuf **m)

{

        struct ip6_fw_chain *chain;

        struct ip6_fw *rule = NULL;

        struct ip6_hdr *ip6 = *pip6;

        struct ifnet *const rif = (*m)->m_pkthdr.rcvif;

        u_short offset = 0;

        int off = sizeof(struct ip6_hdr), nxt = ip6->ip6_nxt;

        u_short src_port, dst_port;

#ifdef  IP6FW_DIVERT_RESTART

        u_int16_t skipto = 0;

#else

        u_int16_t ignport = 0;

#endif

        /*

         * Go down the chain, looking for enlightment

         * #ifdef IP6FW_DIVERT_RESTART

         * If we've been asked to start at a given rule immediatly, do so.

         * #endif

         */

        chain = LIST_FIRST(&ip6_fw_chain);

#ifdef IP6FW_DIVERT_RESTART

        if (skipto) {

                if (skipto >= 65535)

                        goto dropit;

                while (chain && (chain->rule->fw_number <= skipto)) {

                        chain = LIST_NEXT(chain, chain);

                }

                if (! chain) goto dropit;

        }

#endif /* IP6FW_DIVERT_RESTART */

        for (; chain; chain = LIST_NEXT(chain, chain)) {

                struct ip6_fw *const f = chain->rule;

                if (oif) {

                        /* Check direction outbound */

                        if (!(f->fw_flg & IPV6_FW_F_OUT))

                                continue;

                } else {

                        /* Check direction inbound */

                        if (!(f->fw_flg & IPV6_FW_F_IN))

                                continue;

                }

#define IN6_ARE_ADDR_MASKEQUAL(x,y,z) (\

        (((x)->s6_addr32[0] & (y)->s6_addr32[0]) == (z)->s6_addr32[0]) && \

        (((x)->s6_addr32[1] & (y)->s6_addr32[1]) == (z)->s6_addr32[1]) && \

        (((x)->s6_addr32[2] & (y)->s6_addr32[2]) == (z)->s6_addr32[2]) && \

        (((x)->s6_addr32[3] & (y)->s6_addr32[3]) == (z)->s6_addr32[3]))

                /* If src-addr doesn't match, not this rule. */

                if (((f->fw_flg & IPV6_FW_F_INVSRC) != 0) ^

                        (!IN6_ARE_ADDR_MASKEQUAL(&ip6->ip6_src,&f->fw_smsk,&f->fw_src)))

                        continue;

                /* If dest-addr doesn't match, not this rule. */

                if (((f->fw_flg & IPV6_FW_F_INVDST) != 0) ^

                        (!IN6_ARE_ADDR_MASKEQUAL(&ip6->ip6_dst,&f->fw_dmsk,&f->fw_dst)))

                        continue;

#undef IN6_ARE_ADDR_MASKEQUAL

                /* Interface check */

                if ((f->fw_flg & IF6_FW_F_VIAHACK) == IF6_FW_F_VIAHACK) {

                        struct ifnet *const iface = oif ? oif : rif;

                        /* Backwards compatibility hack for "via" */

                        if (!iface || !iface_match(iface,

                            &f->fw_in_if, f->fw_flg & IPV6_FW_F_OIFNAME))

                                continue;

                } else {

                        /* Check receive interface */

                        if ((f->fw_flg & IPV6_FW_F_IIFACE)

                            && (!rif || !iface_match(rif,

                              &f->fw_in_if, f->fw_flg & IPV6_FW_F_IIFNAME)))

                                continue;

                        /* Check outgoing interface */

                        if ((f->fw_flg & IPV6_FW_F_OIFACE)

                            && (!oif || !iface_match(oif,

                              &f->fw_out_if, f->fw_flg & IPV6_FW_F_OIFNAME)))

                                continue;

                }

                /* Check IP options */

                if (!ip6opts_match(&ip6, f, m, &off, &nxt, &offset))

                        continue;

                /* Fragments */

                if ((f->fw_flg & IPV6_FW_F_FRAG) && !offset)