windows-nt/Source/XPSP1/NT/net/tcpip/tpipv6/tcpip6/ip6/icmp.c

1547 lines
48 KiB
C
Raw Normal View History

2020-09-26 03:20:57 -05:00
// -*- mode: C++; tab-width: 4; indent-tabs-mode: nil -*- (for GNU Emacs)
//
// Copyright (c) 1985-2000 Microsoft Corporation
//
// This file is part of the Microsoft Research IPv6 Network Protocol Stack.
// You should have received a copy of the Microsoft End-User License Agreement
// for this software along with this release; see the file "license.txt".
// If not, please see http://www.research.microsoft.com/msripv6/license.htm,
// or write to Microsoft Research, One Microsoft Way, Redmond, WA 98052-6399.
//
// Abstract:
//
// Internet Control Message Protocol for Internet Protocol Version 6.
// See RFC 1885 for details.
//
#include "oscfg.h"
#include "ndis.h"
#include "ip6imp.h"
#include "ip6def.h"
#include "route.h"
#include "icmp.h"
#include "ntddip6.h"
#include "neighbor.h"
#include "mld.h"
#include "security.h"
//
// Ping support. We have a list of EchoControl blocks, one per outstanding
// echo request message. Incoming echo replies are matched to requests via
// a unique sequence number.
//
KSPIN_LOCK ICMPv6EchoLock;
EchoControl *ICMPv6OutstandingEchos;
long ICMPv6EchoSeq; // Protected with interlocked operations.
//
// Statistics kept for netstat and MIBs.
//
ICMPv6Stats ICMPv6InStats;
ICMPv6Stats ICMPv6OutStats;
//* ICMPv6Init - Initialize ICMPv6.
//
// Set the starting values of various things.
//
void
ICMPv6Init(void)
{
//
// Initialize in-kernel ping support.
//
ICMPv6OutstandingEchos = NULL;
ICMPv6EchoSeq = 0;
KeInitializeSpinLock(&ICMPv6EchoLock);
//
// Initialize Multicast Listener Discovery protocol.
//
MLDInit();
}
//* ICMPv6Send - Low-level send routine for ICMPv6 packets.
//
// Common ICMPv6 message transmission functionality is performed here.
// The message is expected to be completely formed (with the exception
// of the checksum) when this routine is called.
//
// Used for all ICMP packets, except for Neighbor Discovery.
//
void
ICMPv6Send(
RouteCacheEntry *RCE, // RCE to send on
PNDIS_PACKET Packet, // Packet to send.
uint IPv6Offset, // Offset to IPv6 header in packet.
uint ICMPv6Offset, // Offset to ICMPv6 header in packet.
IPv6Header UNALIGNED *IP, // Pointer to IPv6 header.
uint PayloadLength, // Length of IPv6 payload in bytes.
ICMPv6Header UNALIGNED *ICMP) // Pointer to ICMPv6 header.
{
uint ChecksumDataLength;
ICMPv6OutStats.icmps_msgs++;
//
// Calculate the ICMPv6 checksum. It covers the entire ICMPv6 message
// starting with the ICMPv6 header, plus the IPv6 pseudo-header.
//
// Recalculate the payload length to exclude any option headers.
//
ChecksumDataLength = PayloadLength -
(ICMPv6Offset - IPv6Offset) + sizeof(IPv6Header);
ICMP->Checksum = 0;
ICMP->Checksum = ChecksumPacket(Packet, ICMPv6Offset, NULL,
ChecksumDataLength,
AlignAddr(&IP->Source),
AlignAddr(&IP->Dest),
IP_PROTOCOL_ICMPv6);
if (ICMP->Checksum == 0) {
//
// ChecksumPacket failed, so abort the transmission.
//
ICMPv6OutStats.icmps_errors++;
IPv6SendComplete(NULL, Packet, IP_NO_RESOURCES);
return;
}
ICMPv6OutStats.icmps_typecount[ICMP->Type]++;
//
// Hand the packet down to IP for transmission.
//
IPv6Send(Packet, IPv6Offset, IP, PayloadLength, RCE, 0,
IP_PROTOCOL_ICMPv6, 0, 0);
}
//* ICMPv6SendEchoReply - Send an Echo Reply message.
//
// Basically what we do here is slap an ICMPv6 header on the front
// of the invoking packet and send it back where it came from.
//
void
ICMPv6SendEchoReply(
IPv6Packet *Packet) // Packet handed to us by ICMPv6Receive.
{
NDIS_STATUS NdisStatus;
PNDIS_PACKET ReplyPacket;
uint Offset;
uchar *Mem;
uint MemLen;
uint ICMPLength;
uint DataLength;
IPv6Header UNALIGNED *ReplyIP;
ICMPv6Header UNALIGNED *ReplyICMP;
const IPv6Addr *Dest;
IP_STATUS Status;
RouteCacheEntry *RCE;
//
// Take our reply's destination address from the source address
// of the incoming packet.
//
// Note that the specs specifically say that we're not to reverse
// the path on source routed packets. Just reply directly.
//
// IPv6HeaderReceive should protect us from replying to most forms
// of bogus addresses. We ASSERT this in checked builds.
//
Dest = Packet->SrcAddr;
ASSERT(!IsInvalidSourceAddress(Dest));
//
// Get the reply route to the destination.
// Under normal circumstances, the reply will go out
// the incoming interface. RouteToDestination
// will figure out the appropriate ScopeId.
//
Status = RouteToDestination(Dest, 0, Packet->NTEorIF,
RTD_FLAG_NORMAL, &RCE);
if (Status != IP_SUCCESS) {
//
// No route - drop the packet.
//
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_INTERNAL_ERROR,
"ICMPv6SendEchoReply - no route: %x\n", Status));
return;
}
//
// Calculate the length of the ICMP header
// and how much data we will include following the ICMP header.
//
ICMPLength = sizeof(ICMPv6Header);
DataLength = Packet->TotalSize;
Offset = RCE->NCE->IF->LinkHeaderSize;
MemLen = Offset + sizeof(IPv6Header) + ICMPLength + DataLength;
//
// Allocate the reply packet.
//
NdisStatus = IPv6AllocatePacket(MemLen, &ReplyPacket, &Mem);
if (NdisStatus != NDIS_STATUS_SUCCESS) {
ReleaseRCE(RCE);
return;
}
//
// Prepare IP header of reply packet.
//
ReplyIP = (IPv6Header UNALIGNED *)(Mem + Offset);
ReplyIP->VersClassFlow = IP_VERSION;
ReplyIP->NextHeader = IP_PROTOCOL_ICMPv6;
ReplyIP->HopLimit = (uchar)RCE->NCE->IF->CurHopLimit;
//
// Take our reply's source address from the receiving NTE,
// or use the best source address for this destination
// if we don't have a receiving NTE.
//
ReplyIP->Source = (IsNTE(Packet->NTEorIF) ?
CastToNTE(Packet->NTEorIF) : RCE->NTE)
->Address;
ReplyIP->Dest = *Dest;
//
// Prepare ICMP header.
//
// REVIEW: Do this in ICMPv6Send?
//
ReplyICMP = (ICMPv6Header UNALIGNED *)(ReplyIP + 1);
ReplyICMP->Type = ICMPv6_ECHO_REPLY;
ReplyICMP->Code = 0;
// ReplyICMP->Checksum - ICMPv6Send will calculate.
//
// Copy incoming packet data to outgoing.
//
CopyPacketToBuffer((uchar *)(ReplyICMP + 1), Packet, DataLength,
Packet->Position);
ICMPv6Send(RCE, ReplyPacket, Offset,
Offset + sizeof(IPv6Header), ReplyIP,
ICMPLength + DataLength, ReplyICMP);
ReleaseRCE(RCE);
}
//* ICMPv6CheckError
//
// Check if a packet is an ICMP error message.
// This is a "best effort" check, given that
// the packet may well have syntactical errors.
//
// We return FALSE if we can't tell.
//
int
ICMPv6CheckError(IPv6Packet *Packet, uint NextHeader)
{
for (;;) {
uint HdrLen;
switch (NextHeader) {
case IP_PROTOCOL_HOP_BY_HOP:
case IP_PROTOCOL_DEST_OPTS:
case IP_PROTOCOL_ROUTING: {
ExtensionHeader *Hdr;
if (! PacketPullup(Packet, sizeof *Hdr,
__builtin_alignof(ExtensionHeader), 0)) {
//
// Pullup failed. We can't continue parsing.
//
return FALSE;
}
Hdr = (ExtensionHeader *) Packet->Data;
HdrLen = (Hdr->HeaderExtLength + 1) * EXT_LEN_UNIT;
//
// REVIEW - We don't actually want to look at the remaining
// data in the extension header. Perhaps use PositionPacketAt?
//
if (! PacketPullup(Packet, HdrLen, 1, 0)) {
//
// Pullup failed. We can't continue parsing.
//
return FALSE;
}
NextHeader = Hdr->NextHeader;
break;
}
case IP_PROTOCOL_FRAGMENT: {
FragmentHeader UNALIGNED *Hdr;
if (! PacketPullup(Packet, sizeof *Hdr, 1, 0)) {
//
// Pullup failed. We can't continue parsing.
//
return FALSE;
}
Hdr = (FragmentHeader UNALIGNED *) Packet->Data;
//
// We can only continue parsing if this is the first fragment.
//
if ((Hdr->OffsetFlag & FRAGMENT_OFFSET_MASK) != 0)
return FALSE;
HdrLen = sizeof *Hdr;
NextHeader = Hdr->NextHeader;
break;
}
case IP_PROTOCOL_ICMPv6: {
ICMPv6Header *Hdr;
if (! PacketPullup(Packet, sizeof *Hdr,
__builtin_alignof(ICMPv6Header), 0)) {
//
// Pullup failed. We can't continue parsing.
//
return FALSE;
}
//
// This is an ICMPv6 message, so we can check
// to see if it is an error message.
// We treat Redirects as errors here.
//
Hdr = (ICMPv6Header *) Packet->Data;
return (ICMPv6_ERROR_TYPE(Hdr->Type) ||
(Hdr->Type == ICMPv6_REDIRECT));
}
default:
return FALSE;
}
//
// Move past this extension header.
//
AdjustPacketParams(Packet, HdrLen);
}
}
//* ICMPv6RateLimit
//
// Returns TRUE if an ICMP error should NOT be sent to this destination
// because of rate-limiting.
//
int
ICMPv6RateLimit(RouteCacheEntry *RCE)
{
uint Now = IPv6TickCount;
//
// This arithmetic will handle wraps of the IPv6 tick counter.
//
if ((uint)(Now - RCE->LastError) < ICMP_MIN_ERROR_INTERVAL)
return TRUE;
RCE->LastError = Now;
return FALSE;
}
//* ICMPv6SendError - Generate an error in response to an incoming packet.
//
// Send an ICMPv6 message of the given Type and Code to the source of the
// offending/invoking packet. The reply includes as much of the incoming
// packet as will fit inside the minimal IPv6 MTU.
//
// Basically what we do here is slap an ICMPv6 header on the front
// of the invoking packet and send it back where it came from.
//
// REVIEW - Much of the code looks like ICMPv6SendEchoReply.
// Could it be shared?
//
// The current position in the Packet must be at a header boundary.
// The NextHeader parameter specifies the type of header following.
// This information is used to parse the remainder of the invoking Packet,
// to see if it is an ICMP error. We MUST avoid sending an error
// in response to an error. NextHeader may be IP_PROTOCOL_NONE.
//
// The MulticastOverride parameter allows override of another check.
// Normally we MUST avoid sending an error in response to a packet
// sent to a multicast destination. But there are a couple exceptions.
//
void
ICMPv6SendError(
IPv6Packet *Packet, // Offending/Invoking packet.
uchar ICMPType, // ICMP error type.
uchar ICMPCode, // ICMP error code.
ulong ErrorParameter, // Parameter for error message.
uint NextHeader, // Type of hdr following in Packet.
int MulticastOverride) // Allow replies to mcast packets?
{
NDIS_STATUS NdisStatus;
PNDIS_PACKET ReplyPacket;
uint Offset;
uchar *Mem;
uint MemLen;
uint ICMPLength;
uint DataLength;
IPv6Header UNALIGNED *ReplyIP;
ICMPv6Header UNALIGNED *ReplyICMP;
const IPv6Addr *Dest;
IP_STATUS Status;
RouteCacheEntry *RCE;
//
// We must not send an ICMP error message
// as a result of an ICMP error.
//
if ((Packet->Flags & PACKET_ICMP_ERROR) ||
ICMPv6CheckError(Packet, NextHeader)) {
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
"ICMPv6SendError: no reply to error\n"));
return;
}
//
// We must not send an ICMP error message as a result
// of receiving any kind of multicast or broadcast.
// There are a couple exceptions so we have MulticastOverride.
//
if (IsMulticast(AlignAddr(&Packet->IP->Dest)) ||
(Packet->Flags & PACKET_NOT_LINK_UNICAST)) {
if (!MulticastOverride) {
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
"ICMPv6SendError: no reply to broadcast/multicast\n"));
return;
}
}
//
// Take our reply's destination address from the source address
// of the incoming packet.
//
// Note that the specs specifically say that we're not to reverse
// the path on source routed packets. Just reply directly.
//
// IPv6HeaderReceive should protect us from replying to most forms
// of bogus addresses. We ASSERT this in checked builds.
//
Dest = Packet->SrcAddr;
ASSERT(!IsInvalidSourceAddress(Dest));
//
// Get the reply route to the destination.
// Under normal circumstances, the reply will go out
// the incoming interface. RouteToDestination
// will figure out the appropriate ScopeId.
//
Status = RouteToDestination(Dest, 0, Packet->NTEorIF,
RTD_FLAG_NORMAL, &RCE);
if (Status != IP_SUCCESS) {
//
// No route - drop the packet.
//
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_INTERNAL_ERROR,
"ICMPv6SendError - no route: %x\n", Status));
return;
}
//
// We must rate-limit ICMP error messages.
//
if (ICMPv6RateLimit(RCE)) {
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
"ICMPv6SendError - rate limit %s\n",
FormatV6Address(&RCE->Destination)));
ReleaseRCE(RCE);
return;
}
//
// Calculate the length of the ICMP header
// and how much data we will include following the ICMP header.
// Include space for an error value after the header proper.
//
ICMPLength = sizeof(ICMPv6Header) + sizeof(uint);
//
// We want to include data from the IP header on.
//
DataLength = Packet->TotalSize +
(Packet->Position - Packet->IPPosition);
//
// But limit the error packet size.
//
if (DataLength > ICMPv6_ERROR_MAX_DATA_LEN)
DataLength = ICMPv6_ERROR_MAX_DATA_LEN;
//
// Calculate buffer length.
//
Offset = RCE->NCE->IF->LinkHeaderSize;
MemLen = Offset + sizeof(IPv6Header) + ICMPLength + DataLength;
ASSERT(MemLen - Offset <= IPv6_MINIMUM_MTU);
//
// Allocate the reply packet.
//
NdisStatus = IPv6AllocatePacket(MemLen, &ReplyPacket, &Mem);
if (NdisStatus != NDIS_STATUS_SUCCESS) {
ReleaseRCE(RCE);
return;
}
//
// Prepare IP header of reply packet.
//
ReplyIP = (IPv6Header UNALIGNED *)(Mem + Offset);
ReplyIP->VersClassFlow = IP_VERSION;
ReplyIP->NextHeader = IP_PROTOCOL_ICMPv6;
ReplyIP->HopLimit = (uchar)RCE->NCE->IF->CurHopLimit;
//
// Take our reply's source address from the receiving NTE,
// or use the best source address for this destination
// if we don't have a receiving NTE.
//
ReplyIP->Source = (IsNTE(Packet->NTEorIF) ?
CastToNTE(Packet->NTEorIF) : RCE->NTE)
->Address;
ReplyIP->Dest = *Dest;
//
// Prepare ICMP header.
//
// REVIEW: Do this in ICMPv6Send?
//
ReplyICMP = (ICMPv6Header UNALIGNED *)(ReplyIP + 1);
ReplyICMP->Type = ICMPType;
ReplyICMP->Code = ICMPCode;
// ReplyICMP->Checksum - ICMPv6Send will calculate.
//
// ICMP Error Messages have a 32-bit field (content of which
// varies depending upon the error type) following the ICMP header.
//
*(ulong UNALIGNED *)(ReplyICMP + 1) = net_long(ErrorParameter);
//
// Copy invoking packet (from IPv6 header onward) to outgoing.
//
CopyPacketToBuffer((uchar *)(ReplyICMP + 1) + sizeof(ErrorParameter),
Packet, DataLength, Packet->IPPosition);
ICMPv6Send(RCE, ReplyPacket, Offset,
Offset + sizeof(IPv6Header), ReplyIP,
ICMPLength + DataLength, ReplyICMP);
ReleaseRCE(RCE);
}
//* ICMPv6ProcessTunnelError
//
// Called when we receive an ICMPv4 error and there is insufficient
// information to translate to an ICMPv6 error. We make a best effort
// to complete outstanding echo requests that were sent to the IPv4
// address that was the original IPv4 tunnel destination.
//
void
ICMPv6ProcessTunnelError(
IPAddr V4Dest, // Destination of our tunneled packet.
IPv6Addr *V6Src, // Address to use as the source of the error.
uint ScopeId, // Scope-id of V6Src.
IP_STATUS Status) // Status of the response.
{
EchoControl *This, **PrevPtr;
EchoControl *List = NULL;
KIRQL OldIrql;
//
// Find the EchoControl blocks on our list of outstanding echoes that
// have a matching IPv4 destination and call their completion function.
// We do not have sufficient information to identify a unique request.
//
KeAcquireSpinLock(&ICMPv6EchoLock, &OldIrql);
for (This = ICMPv6OutstandingEchos, PrevPtr = &ICMPv6OutstandingEchos;
This != NULL; This = This->Next) {
if (This->V4Dest == V4Dest) {
//
// Found matching control block. Extract it from the list
// and put it on our own list.
//
*PrevPtr = This->Next;
This->Next = List;
List = This;
break;
}
PrevPtr = &This->Next;
}
KeReleaseSpinLock(&ICMPv6EchoLock, OldIrql);
while ((This = List) != NULL) {
//
// Remove this request from our list.
//
List = This->Next;
//
// Call OS-specific completion routine.
//
(*This->CompleteRoutine)(This, Status,
V6Src, ScopeId,
NULL, 0);
}
}
//* ICMPv6ProcessEchoReply
//
// Called either when an echo reply arrives, or
// a hop-count-exceeded error responding to an echo request arrives.
//
// Looks up the echo request structure and completes
// the echo request operation.
//
// Note that the echo reply payload data must be contiguous.
// Callers should use PacketPullup if necessary.
//
void
ICMPv6ProcessEchoReply(
ulong Seq, // Echo sequence number.
IP_STATUS Status, // Status of the response.
IPv6Packet *Packet, // Echo reply packet.
void *Current, // Pointer to the buffered data area.
uint PayloadLength) // Size of remaining payload data.
{
EchoControl *This, **PrevPtr;
KIRQL OldIrql;
uint ICMPPosition;
//
// Find the EchoControl block on our list of outstanding echoes that
// has a matching sequence number and call it's completion function.
//
KeAcquireSpinLock(&ICMPv6EchoLock, &OldIrql);
for (This = ICMPv6OutstandingEchos, PrevPtr = &ICMPv6OutstandingEchos;
This != NULL; This = This->Next) {
if (This->Seq == Seq) {
//
// Found matching control block. Extract it from list.
//
*PrevPtr = This->Next;
break;
}
PrevPtr = &This->Next;
}
KeReleaseSpinLock(&ICMPv6EchoLock, OldIrql);
//
// Check to see if we ran off the end of the outstanding echoes list.
//
if (This == NULL) {
//
// We received a response with a sequence number that doesn't match
// one of the echo requests we still have outstanding. Drop it.
//
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
"ICMPv6ProcessEchoReply: Received echo response "
"with bogus/expired sequence number 0x%x\n", Seq));
if (Current != NULL) {
//
// If this is a normal Echo Reply (not a error message sent in
// response to one of our Echo Replies) first see if any raw
// receivers want to look at it.
//
ICMPPosition = Packet->Position - sizeof(ICMPv6Header);
PositionPacketAt(Packet, ICMPPosition);
(void) RawReceive(Packet, IP_PROTOCOL_ICMPv6);
}
return;
}
//
// Call OS-specific completion routine.
//
(*This->CompleteRoutine)(This, Status,
Packet->SrcAddr,
DetermineScopeId(Packet->SrcAddr,
Packet->NTEorIF->IF),
Current, PayloadLength);
}
//* ICMPv6EchoReplyReceive - Receive a reply to an earlier echo of our's.
//
// Called by ICMPv6Receive when an echo reply message arrives.
//
// REVIEW: Should we also verify the receiving NTE is the same as the one
// REVIEW: we sent on?
//
void
ICMPv6EchoReplyReceive(IPv6Packet *Packet)
{
ulong Seq;
//
// The next four bytes should consist of a two byte Identifier field
// and a two byte Sequence Number. We just treat the whole thing as
// a four byte sequence number. Make sure these bytes are contiguous.
//
if (! PacketPullup(Packet, sizeof Seq, 1, 0)) {
// Pullup failed.
if (Packet->TotalSize < sizeof(Seq)) {
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
"ICMPv6: Received small Echo Reply %u\n",
Packet->TotalSize));
ICMPv6SendError(Packet,
ICMPv6_PARAMETER_PROBLEM,
ICMPv6_ERRONEOUS_HEADER_FIELD,
FIELD_OFFSET(IPv6Header, PayloadLength),
IP_PROTOCOL_NONE, FALSE);
}
return; // Drop packet.
}
//
// We're received a reply message to one of our echo requests.
// Extract its sequence number so that we can identify it.
//
Seq = net_long(*(ulong UNALIGNED *)Packet->Data);
AdjustPacketParams(Packet, sizeof Seq);
//
// REVIEW: The ICMPv6ProcessEchoReply interface expects a contiguous data
// REVIEW: region for the rest of the packet. This requires us to
// REVIEW: pullup the remainder of the packet here. Fix this someday.
//
if (! PacketPullup(Packet, Packet->TotalSize, 1, 0)) {
// Pullup failed.
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NTOS_ERROR,
"ICMPv6: Couldn't pullup echo data\n"));
return; // Drop packet.
}
ICMPv6ProcessEchoReply(Seq, IP_SUCCESS, Packet,
Packet->Data, Packet->TotalSize);
}
//* ICMPv6ErrorReceive - Generic ICMPv6 error processing.
//
// Called by ICMPv6Receive when an error message arrives.
// Returns FALSE if we were unable to process it for some reason.
//
int
ICMPv6ErrorReceive(
IPv6Packet *Packet, // Packet handed to us by ICMPv6Receive.
ICMPv6Header UNALIGNED *ICMP) // ICMP Header.
{
ulong Parameter;
IP_STATUS Status;
StatusArg StatArg;
IPv6Header UNALIGNED *InvokingIP;
ProtoControlRecvProc *Handler = NULL;
uchar NextHeader;
int Handled = TRUE;
//
// First mark the packet as an ICMP error.
// This will inhibit any generation of ICMP errors
// as a result of this packet.
//
Packet->Flags |= PACKET_ICMP_ERROR;
//
// All ICMPv6 error messages consist of the base ICMPv6 header,
// followed by a 32 bit type-specific field, followed by as much
// of the invoking packet as fit without causing this ICMPv6 packet
// to exceed 576 octets.
//
// We already consumed the base ICMPv6 header back in ICMPv6Receive.
// Pull out the 32 bit type-specific field in case the upper layer's
// ControlReceive routine cares about it.
//
if (! PacketPullup(Packet, sizeof Parameter, 1, 0)) {
// Pullup failed.
if (Packet->TotalSize < sizeof Parameter)
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
"ICMPv6ErrorReceive: "
"Packet too small to contain error field\n"));
return FALSE; // Drop packet.
}
Parameter = *(ulong UNALIGNED *)Packet->Data;
AdjustPacketParams(Packet, sizeof Parameter);
//
// Next up should be the IPv6 header of the invoking packet.
//
if (! PacketPullup(Packet, sizeof *InvokingIP,
__builtin_alignof(IPv6Addr), 0)) {
// Pullup failed.
if (Packet->TotalSize < sizeof *InvokingIP)
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
"ICMPv6ErrorReceive (from %s): "
"Packet too small to contain IPv6 "
"header from invoking packet\n",
FormatV6Address(AlignAddr(&Packet->IP->Source))));
return FALSE; // Drop packet.
}
InvokingIP = (IPv6Header UNALIGNED *)Packet->Data;
AdjustPacketParams(Packet, sizeof *InvokingIP);
//
// First we perform any specific processing of the error,
// and convert the error type/code to a status value.
//
switch (ICMP->Type) {
case ICMPv6_DESTINATION_UNREACHABLE:
switch (ICMP->Code) {
case ICMPv6_NO_ROUTE_TO_DESTINATION:
Status = IP_DEST_NO_ROUTE;
break;
case ICMPv6_COMMUNICATION_PROHIBITED:
Status = IP_DEST_PROHIBITED;
break;
case ICMPv6_SCOPE_MISMATCH:
Status = IP_DEST_SCOPE_MISMATCH;
break;
case ICMPv6_ADDRESS_UNREACHABLE:
Status = IP_DEST_ADDR_UNREACHABLE;
break;
case ICMPv6_PORT_UNREACHABLE:
Status = IP_DEST_PORT_UNREACHABLE;
break;
default:
Status = IP_DEST_UNREACHABLE;
break;
}
break;
case ICMPv6_PACKET_TOO_BIG: {
uint PMTU;
//
// Packet Too Big messages contain the bottleneck MTU value.
// Update the path MTU in the route cache.
// Change Parameter value to indicate whether PMTU changed.
//
PMTU = net_long(Parameter);
Parameter = UpdatePathMTU(Packet->NTEorIF->IF,
AlignAddr(&InvokingIP->Dest), PMTU);
Status = IP_PACKET_TOO_BIG;
break;
}
case ICMPv6_TIME_EXCEEDED:
switch (ICMP->Code) {
case ICMPv6_HOP_LIMIT_EXCEEDED:
Status = IP_HOP_LIMIT_EXCEEDED;
break;
case ICMPv6_REASSEMBLY_TIME_EXCEEDED:
Status = IP_REASSEMBLY_TIME_EXCEEDED;
break;
default:
Status = IP_TIME_EXCEEDED;
break;
}
break;
case ICMPv6_PARAMETER_PROBLEM:
switch (ICMP->Code) {
case ICMPv6_ERRONEOUS_HEADER_FIELD:
Status = IP_BAD_HEADER;
break;
case ICMPv6_UNRECOGNIZED_NEXT_HEADER:
Status = IP_UNRECOGNIZED_NEXT_HEADER;
break;
case ICMPv6_UNRECOGNIZED_OPTION:
Status = IP_BAD_OPTION;
break;
default:
Status = IP_PARAMETER_PROBLEM;
break;
}
break;
default:
//
// We don't understand this error type.
//
Status = IP_ICMP_ERROR;
Handled = FALSE;
break;
}
//
// Deliver ICMP Error to higher layers. This is a MUST, even if we
// don't recognize the specific error message.
//
// Iteratively switch out to the handler for each successive next header
// until we reach a handler that reports no more headers follow it.
//
NextHeader = InvokingIP->NextHeader;
while (NextHeader != IP_PROTOCOL_NONE) {
//
// Current header indicates that another header follows.
// See if we have a handler for it.
//
Handler = ProtocolSwitchTable[NextHeader].ControlReceive;
if (Handler == NULL) {
//
// If we don't have a handler for this header type,
// we just drop the packet.
//
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
"IPv6ErrorReceive: No handler for NextHeader type %u.\n",
NextHeader));
break;
}
StatArg.Status = Status;
StatArg.Arg = Parameter;
StatArg.IP = InvokingIP;
NextHeader = (*Handler)(Packet, &StatArg);
}
return Handled;
}
//* ICMPv6ControlReceive - handler for ICMPv6 control messages.
//
// This routine is called if we receive an ICMPv6 error message that
// was generated by some remote site as a result of receiving an ICMPv6
// packet from us.
//
uchar
ICMPv6ControlReceive(
IPv6Packet *Packet, // Packet handed to us by ICMPv6Receive.
StatusArg *StatArg) // ICMP Error Code, etc.
{
ICMPv6Header *InvokingICMP;
ulong Seq;
//
// The next thing in the packet should be the ICMP header of the
// original packet which invoked this error.
//
if (! PacketPullup(Packet, sizeof *InvokingICMP,
__builtin_alignof(ICMPv6Header), 0)) {
// Pullup failed.
if (Packet->TotalSize < sizeof *InvokingICMP)
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
"ICMPv6: Packet too small to contain ICMPv6 header "
"from invoking packet\n"));
return IP_PROTOCOL_NONE; // Drop packet.
}
InvokingICMP = (ICMPv6Header *)Packet->Data;
AdjustPacketParams(Packet, sizeof *InvokingICMP);
//
// All we currently handle is errors caused by echo requests.
//
if ((InvokingICMP->Type != ICMPv6_ECHO_REQUEST) ||
(InvokingICMP->Code != 0))
return IP_PROTOCOL_NONE; // Drop packet.
//
// The next four bytes should consist of a two byte Identifier field
// and a two byte Sequence Number. We just treat the whole thing as
// a four byte sequence number. Make sure these bytes are contiguous.
//
if (! PacketPullup(Packet, sizeof Seq, 1, 0)) {
// Pullup failed.
if (Packet->TotalSize < sizeof Seq)
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
"ICMPv6: Packet too small to contain ICMPv6 header "
"from invoking packet\n"));
return IP_PROTOCOL_NONE; // Drop packet.
}
//
// Extract the sequence number so that we can identify
// the matching echo request.
//
Seq = net_long(*(ulong UNALIGNED *)Packet->Data);
AdjustPacketParams(Packet, sizeof Seq);
//
// Complete the corresponding echo request with an error.
//
ICMPv6ProcessEchoReply(Seq, StatArg->Status, Packet,
NULL, 0);
return IP_PROTOCOL_NONE; // Done with packet.
}
//* ICMPv6Receive - Receive an incoming ICMPv6 packet.
//
// This is the routine called by IPv6 when it receives a complete IPv6
// packet with a Next Header value of 58.
//
uchar
ICMPv6Receive(
IPv6Packet *Packet) // Packet handed to us by IPv6Receive.
{
ICMPv6Header *ICMP;
ushort Checksum;
uint ICMPPosition;
ICMPv6InStats.icmps_msgs++;
//
// Verify IPSec was performed.
//
if (InboundSecurityCheck(Packet, IP_PROTOCOL_ICMPv6, 0, 0,
Packet->NTEorIF->IF) != TRUE) {
//
// No policy was found or the policy indicated to drop the packet.
//
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
"ICMPv6: IPSec lookup failed\n"));
ICMPv6InStats.icmps_errors++;
return IP_PROTOCOL_NONE; // Drop packet.
}
//
// Verify that we have enough contiguous data to overlay a ICMPv6Header
// structure on the incoming packet. Then do so.
//
if (! PacketPullup(Packet, sizeof *ICMP,
__builtin_alignof(ICMPv6Header), 0)) {
// Pullup failed.
ICMPv6InStats.icmps_errors++;
if (Packet->TotalSize < sizeof *ICMP) {
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
"ICMPv6: Packet too small to contain ICMP header\n"));
ICMPv6SendError(Packet,
ICMPv6_PARAMETER_PROBLEM,
ICMPv6_ERRONEOUS_HEADER_FIELD,
FIELD_OFFSET(IPv6Header, PayloadLength),
IP_PROTOCOL_NONE, FALSE);
}
return IP_PROTOCOL_NONE; // Drop packet.
}
ICMP = (ICMPv6Header *)Packet->Data;
ICMPPosition = Packet->Position;
//
// Verify checksum.
//
Checksum = ChecksumPacket(Packet->NdisPacket, Packet->Position,
Packet->FlatData, Packet->TotalSize,
Packet->SrcAddr, AlignAddr(&Packet->IP->Dest),
IP_PROTOCOL_ICMPv6);
if (Checksum != 0xffff) {
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
"ICMPv6: Checksum failed %0x\n", Checksum));
ICMPv6InStats.icmps_errors++;
return IP_PROTOCOL_NONE; // Drop packet.
}
//
// Skip over base ICMP header.
//
AdjustPacketParams(Packet, sizeof *ICMP);
//
// Ignore Neighbor Discovery packets
// if the interface is so configured.
// (Pseudo-interfaces don't do Neighbor Discovery.)
//
if (!(Packet->NTEorIF->IF->Flags & IF_FLAG_NEIGHBOR_DISCOVERS)) {
if ((ICMP->Type == ICMPv6_NEIGHBOR_SOLICIT) ||
(ICMP->Type == ICMPv6_NEIGHBOR_ADVERT)) {
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
"ICMPv6Receive: ND on pseudo-interface\n"));
ICMPv6InStats.icmps_errors++;
return IP_PROTOCOL_NONE; // Drop packet.
}
}
//
// Ignore Router Discovery packets
// if the interface is so configured.
//
if (!(Packet->NTEorIF->IF->Flags & IF_FLAG_ROUTER_DISCOVERS)) {
if ((ICMP->Type == ICMPv6_ROUTER_SOLICIT) ||
(ICMP->Type == ICMPv6_ROUTER_ADVERT) ||
(ICMP->Type == ICMPv6_REDIRECT)) {
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
"ICMPv6Receive: RD on pseudo-interface\n"));
ICMPv6InStats.icmps_errors++;
return IP_PROTOCOL_NONE; // Drop packet.
}
}
ICMPv6InStats.icmps_typecount[ICMP->Type]++;
//
// We have a separate routine to handle error messages.
//
if (ICMPv6_ERROR_TYPE(ICMP->Type)) {
if (!ICMPv6ErrorReceive(Packet, ICMP))
goto unrecognized;
return IP_PROTOCOL_NONE;
}
//
// Handle specific informational message types.
// Just use a switch statement for now. If this is later deemed to be
// too inefficient, we can change it to use a type switch table instead.
//
switch(ICMP->Type) {
case ICMPv6_ECHO_REQUEST:
ICMPv6SendEchoReply(Packet);
break;
case ICMPv6_ECHO_REPLY:
ICMPv6EchoReplyReceive(Packet);
break;
case ICMPv6_MULTICAST_LISTENER_QUERY:
MLDQueryReceive(Packet);
break;
case ICMPv6_MULTICAST_LISTENER_REPORT:
MLDReportReceive(Packet);
break;
case ICMPv6_MULTICAST_LISTENER_DONE:
break;
// Following are all Neighbor Discovery messages.
case ICMPv6_ROUTER_SOLICIT:
RouterSolicitReceive(Packet, ICMP);
break;
case ICMPv6_ROUTER_ADVERT:
RouterAdvertReceive(Packet, ICMP);
break;
case ICMPv6_NEIGHBOR_SOLICIT:
NeighborSolicitReceive(Packet, ICMP);
break;
case ICMPv6_NEIGHBOR_ADVERT:
NeighborAdvertReceive(Packet, ICMP);
break;
case ICMPv6_REDIRECT:
RedirectReceive(Packet, ICMP);
break;
default:
//
// Don't recognize the specific message type.
// This is an unknown informational message.
// We MUST silently discard it.
//
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
"ICMPv6: Received unknown informational message"
"(%u/%u) from %s\n", ICMP->Type, ICMP->Code,
FormatV6Address(AlignAddr(&Packet->IP->Source))));
//
// But first see if any raw receivers want to look at it.
// NOTE: We don't get any feedback from raw receivers,
// NOTE: so we can't tell if any of them knew this type.
//
unrecognized:
PositionPacketAt(Packet, ICMPPosition);
(void) RawReceive(Packet, IP_PROTOCOL_ICMPv6);
break;
}
return IP_PROTOCOL_NONE;
}
//* ICMPv6EchoRequest - Common dispatch routine for echo requests.
//
// This is the routine called by the OS-specific code on behalf of a user
// to issue an echo request. Validate the request, place control block
// on list of outstanding echo requests, and send echo request message.
//
void
ICMPv6EchoRequest(
void *InputBuffer, // Pointer to an ICMPV6_ECHO_REQUEST structure.
uint InputBufferLength, // Size in bytes of the InputBuffer.
EchoControl *ControlBlock, // Pointer to an EchoControl structure.
EchoRtn Callback) // Called when request responds or times out.
{
NetTableEntry *NTE = NULL;
PICMPV6_ECHO_REQUEST RequestBuffer;
KIRQL OldIrql;
IP_STATUS Status;
ulong Seq;
NDIS_STATUS NdisStatus;
PNDIS_PACKET Packet;
uint Offset;
uchar *Mem;
uint MemLen;
IPv6Header UNALIGNED *IP;
ICMPv6Header UNALIGNED *ICMP;
void *Data;
uint DataSize;
uint RtHdrSize;
RouteCacheEntry *RCE = NULL;
const IPv6Addr *FinalDest, *FirstDest;
const IPv6Addr *DstAddress, *SrcAddress;
uint DstScopeId, SrcScopeId;
ICMPv6OutStats.icmps_msgs++;
RequestBuffer = (PICMPV6_ECHO_REQUEST) InputBuffer;
//
// Validate the request.
//
if (InputBufferLength < sizeof *RequestBuffer) {
Status = IP_BUF_TOO_SMALL;
goto common_echo_exit;
}
Data = RequestBuffer + 1;
DataSize = InputBufferLength - sizeof *RequestBuffer;
//
// Extract address information from the TDI addresses
// in the request.
//
DstAddress = (const IPv6Addr *) RequestBuffer->DstAddress.sin6_addr;
DstScopeId = RequestBuffer->DstAddress.sin6_scope_id;
SrcAddress = (const IPv6Addr *) RequestBuffer->SrcAddress.sin6_addr;
SrcScopeId = RequestBuffer->SrcAddress.sin6_scope_id;
//
// Determine which NTE will send the request,
// if the user has specified a source address.
//
if (! IsUnspecified(SrcAddress)) {
//
// Convert the source address to an NTE.
//
NTE = FindNetworkWithAddress(SrcAddress, SrcScopeId);
if (NTE == NULL) {
Status = IP_BAD_ROUTE;
goto common_echo_exit;
}
Status = RouteToDestination(DstAddress, DstScopeId,
CastFromNTE(NTE),
RTD_FLAG_NORMAL, &RCE);
if (Status != IP_SUCCESS)
goto common_echo_exit;
} else {
//
// Get the source address from the outgoing interface.
//
Status = RouteToDestination(DstAddress, DstScopeId,
NULL,
RTD_FLAG_NORMAL, &RCE);
if (Status != IP_SUCCESS)
goto common_echo_exit;
NTE = RCE->NTE;
AddRefNTE(NTE);
}
//
// Should we use a routing header to send
// a "round-trip" echo request to ourself?
//
if (RequestBuffer->Flags & ICMPV6_ECHO_REQUEST_FLAG_REVERSE) {
//
// Use a routing header.
//
FinalDest = &NTE->Address;
FirstDest = DstAddress;
RtHdrSize = sizeof(IPv6RoutingHeader) + sizeof(IPv6Addr);
}
else {
//
// No routing header.
//
FinalDest = FirstDest = DstAddress;
RtHdrSize = 0;
}
//
// Allocate the Echo Request packet.
//
Offset = RCE->NCE->IF->LinkHeaderSize;
MemLen = Offset + sizeof(IPv6Header) + RtHdrSize + sizeof(ICMPv6Header) +
sizeof Seq + DataSize;
NdisStatus = IPv6AllocatePacket(MemLen, &Packet, &Mem);
if (NdisStatus != NDIS_STATUS_SUCCESS) {
Status = IP_NO_RESOURCES;
goto common_echo_exit;
}
//
// Prepare IP header of Echo Request packet.
//
IP = (IPv6Header UNALIGNED *)(Mem + Offset);
IP->VersClassFlow = IP_VERSION;
IP->NextHeader = IP_PROTOCOL_ICMPv6;
IP->Source = NTE->Address;
IP->Dest = *FirstDest;
IP->HopLimit = RequestBuffer->TTL;
if (IP->HopLimit == 0)
IP->HopLimit = (uchar)RCE->NCE->IF->CurHopLimit;
//
// Prepare the routing header.
// The packet will travel to the destination and then
// be routed back to the source.
//
if (RtHdrSize != 0) {
IPv6RoutingHeader *RtHdr = (IPv6RoutingHeader *)(IP + 1);
IP->NextHeader = IP_PROTOCOL_ROUTING;
RtHdr->NextHeader = IP_PROTOCOL_ICMPv6;
RtHdr->HeaderExtLength = 2;
RtHdr->RoutingType = 0;
RtHdr->SegmentsLeft = 1;
RtlZeroMemory(&RtHdr->Reserved, sizeof RtHdr->Reserved);
((IPv6Addr *)(RtHdr + 1))[0] = *FinalDest;
}
//
// Prepare ICMP header.
//
ICMP = (ICMPv6Header UNALIGNED *)
((uchar *)IP + sizeof(IPv6Header) + RtHdrSize);
ICMP->Type = ICMPv6_ECHO_REQUEST;
ICMP->Code = 0;
ICMP->Checksum = 0; // Calculated below.
//
// Insert Echo sequence number. Technically, this is 16 bits of
// "Identifier" and 16 bits of "Sequence Number", but we just treat
// the whole thing as one 32 bit sequence number field.
//
Seq = InterlockedIncrement(&ICMPv6EchoSeq);
Mem = (uchar *)(ICMP + 1);
*(ulong UNALIGNED *)Mem = net_long(Seq);
Mem += sizeof(ulong);
//
// Copy the user data into the packet.
//
RtlCopyMemory(Mem, Data, DataSize);
//
// We calculate the checksum here, because
// of routing header complications -
// we need to use the final destination.
//
ICMP->Checksum = ChecksumPacket(
NULL, 0, (uchar *)ICMP, sizeof(ICMPv6Header) + sizeof Seq + DataSize,
AlignAddr(&IP->Source), FinalDest, IP_PROTOCOL_ICMPv6);
if (ICMP->Checksum == 0) {
//
// ChecksumPacket failed, so abort the transmission.
//
IPv6FreePacket(Packet);
Status = IP_NO_RESOURCES;
goto common_echo_exit;
}
//
// If this Echo Request is being tunneled to an IPv4 destination,
// remember the IPv4 destination address. We use this later
// if we receive an ICMPv4 error with insufficient information
// to translate to an ICMPv6 error.
//
ControlBlock->V4Dest = GetV4Destination(RCE);
//
// Prepare the control block and link it onto the list.
// Once we've unlocked the list, the control block might
// be completed at any time. Hence it's very important
// that we not access RequestBuffer after this point.
// Also we can not return a failure code. To clean up the
// outstanding request properly, we must use ICMPv6ProcessEchoReply.
//
ControlBlock->TimeoutTimer = ConvertMillisToTicks(RequestBuffer->Timeout);
ControlBlock->CompleteRoutine = Callback;
ControlBlock->Seq = Seq;
if (ControlBlock->TimeoutTimer == 0) {
IPv6FreePacket(Packet);
Status = IP_REQ_TIMED_OUT;
goto common_echo_exit;
}
KeAcquireSpinLock(&ICMPv6EchoLock, &OldIrql);
ControlBlock->Next = ICMPv6OutstandingEchos;
ICMPv6OutstandingEchos = ControlBlock;
KeReleaseSpinLock(&ICMPv6EchoLock, OldIrql);
ICMPv6OutStats.icmps_typecount[ICMPv6_ECHO_REQUEST]++;
//
// Hand the packet down to IP for transmission.
// We can't use ICMPv6Send
// because of routing header complications.
//
IPv6Send(Packet, Offset, IP,
RtHdrSize + sizeof(ICMPv6Header) + sizeof Seq + DataSize,
RCE, 0, IP_PROTOCOL_ICMPv6, 0, 0);
common_echo_cleanup:
if (RCE != NULL)
ReleaseRCE(RCE);
if (NTE != NULL)
ReleaseNTE(NTE);
return;
common_echo_exit:
//
// Complete the echo request with an error,
// before it has been placed on our outstanding echoes list.
//
ICMPv6OutStats.icmps_errors++;
(*Callback)(ControlBlock, Status, &UnspecifiedAddr, 0, NULL, 0);
goto common_echo_cleanup;
} // ICMPv6EchoRequest
//* ICMPv6EchoComplete - Common completion routine for echo requests.
//
// This is the routine is called by the OS-specific code to process an
// ICMP echo response.
//
NTSTATUS
ICMPv6EchoComplete(
EchoControl *ControlBlock, // ControlBlock of completed request.
IP_STATUS Status, // Status of the reply.
const IPv6Addr *Address, // Source of the reply.
uint ScopeId, // Scope of the reply.
void *Data, // Reply data (may be NULL).
uint DataSize, // Amount of reply data.
ULONG_PTR *BytesReturned) // Total user bytes returned.
{
PICMPV6_ECHO_REPLY ReplyBuffer;
LARGE_INTEGER Now, Freq;
//
// Sanity check our reply buffer length.
//
if (ControlBlock->ReplyBufLen < sizeof *ReplyBuffer) {
*BytesReturned = 0;
return STATUS_BUFFER_TOO_SMALL;
}
ReplyBuffer = (PICMPV6_ECHO_REPLY) ControlBlock->ReplyBuf;
//
// Fill in fields to return.
//
ReplyBuffer->Address.sin6_port = 0;
ReplyBuffer->Address.sin6_flowinfo = 0;
RtlCopyMemory(ReplyBuffer->Address.sin6_addr, Address, sizeof *Address);
ReplyBuffer->Address.sin6_scope_id = ScopeId;
ReplyBuffer->Status = Status;
//
// Return the elapsed time in milliseconds.
//
Now = KeQueryPerformanceCounter(&Freq);
ReplyBuffer->RoundTripTime = (uint)
((1000 * (Now.QuadPart - ControlBlock->WhenIssued.QuadPart)) /
Freq.QuadPart);
//
// Verify we have enough space in the reply buffer for the reply data.
//
if (ControlBlock->ReplyBufLen < sizeof *ReplyBuffer + DataSize) {
*BytesReturned = sizeof *ReplyBuffer;
return STATUS_BUFFER_TOO_SMALL;
}
//
// Copy the reply data to follow the reply buffer.
//
RtlCopyMemory(ReplyBuffer + 1, Data, DataSize);
*BytesReturned = sizeof *ReplyBuffer + DataSize;
return STATUS_SUCCESS;
} // ICMPv6EchoComplete
//* ICMPv6EchoTimeout - expire aging unanswered echo requests.
//
// IPv6Timeout calls this routine whenever it thinks we might have
// echo requests outstanding.
//
// Callable from DPC context, not from thread context.
// Called with no locks held.
//
void
ICMPv6EchoTimeout(void)
{
EchoControl *This, **PrevPtr, *TimedOut;
TimedOut = NULL;
//
// Grab the outstanding echo list lock and run through the list looking
// for requests that have timed out.
//
KeAcquireSpinLockAtDpcLevel(&ICMPv6EchoLock);
for (This = ICMPv6OutstandingEchos, PrevPtr = &ICMPv6OutstandingEchos;
This != (EchoControl *)NULL; This = This->Next) {
if (This->TimeoutTimer != 0) {
//
// Timer is running. Decrement and check for expiration.
//
if (--This->TimeoutTimer == 0) {
//
// This echo request has been sent and timed out without
// being answered. Move it to our timed out list.
//
*PrevPtr = This->Next;
This->Next = TimedOut;
TimedOut = This;
} else {
PrevPtr = &This->Next;
}
}
}
KeReleaseSpinLockFromDpcLevel(&ICMPv6EchoLock);
//
// Run through the list of timed out echoes, calling the completion
// routine on each. The completion routine is responsible for
// freeing the EchoControl block structure.
//
while (TimedOut != NULL) {
This = TimedOut;
TimedOut = This->Next;
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
"ICMPv6EchoTimeout: seq number 0x%x timed out\n", This->Seq));
(*This->CompleteRoutine)(This, IP_REQ_TIMED_OUT,
&UnspecifiedAddr, 0, NULL, 0);
}
}