The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet6/ip6_output.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*      $FreeBSD: src/sys/netinet6/ip6_output.c,v 1.13.2.18 2003/01/24 05:11:35 sam Exp $       */
    2 /*      $KAME: ip6_output.c,v 1.279 2002/01/26 06:12:30 jinmei Exp $    */
    3 
    4 /*
    5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
    6  * All rights reserved.
    7  *
    8  * Redistribution and use in source and binary forms, with or without
    9  * modification, are permitted provided that the following conditions
   10  * are met:
   11  * 1. Redistributions of source code must retain the above copyright
   12  *    notice, this list of conditions and the following disclaimer.
   13  * 2. Redistributions in binary form must reproduce the above copyright
   14  *    notice, this list of conditions and the following disclaimer in the
   15  *    documentation and/or other materials provided with the distribution.
   16  * 3. Neither the name of the project nor the names of its contributors
   17  *    may be used to endorse or promote products derived from this software
   18  *    without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
   21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
   24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   30  * SUCH DAMAGE.
   31  */
   32 
   33 /*
   34  * Copyright (c) 1982, 1986, 1988, 1990, 1993
   35  *      The Regents of the University of California.  All rights reserved.
   36  *
   37  * Redistribution and use in source and binary forms, with or without
   38  * modification, are permitted provided that the following conditions
   39  * are met:
   40  * 1. Redistributions of source code must retain the above copyright
   41  *    notice, this list of conditions and the following disclaimer.
   42  * 2. Redistributions in binary form must reproduce the above copyright
   43  *    notice, this list of conditions and the following disclaimer in the
   44  *    documentation and/or other materials provided with the distribution.
   45  * 3. Neither the name of the University nor the names of its contributors
   46  *    may be used to endorse or promote products derived from this software
   47  *    without specific prior written permission.
   48  *
   49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   59  * SUCH DAMAGE.
   60  *
   61  *      @(#)ip_output.c 8.3 (Berkeley) 1/21/94
   62  */
   63 
   64 #include "opt_ip6fw.h"
   65 #include "opt_inet.h"
   66 #include "opt_inet6.h"
   67 #include "opt_ipsec.h"
   68 
   69 #include <sys/param.h>
   70 #include <sys/malloc.h>
   71 #include <sys/mbuf.h>
   72 #include <sys/errno.h>
   73 #include <sys/protosw.h>
   74 #include <sys/socket.h>
   75 #include <sys/socketvar.h>
   76 #include <sys/systm.h>
   77 #include <sys/kernel.h>
   78 #include <sys/proc.h>
   79 #include <sys/priv.h>
   80 
   81 #include <sys/thread2.h>
   82 #include <sys/msgport2.h>
   83 
   84 #include <net/if.h>
   85 #include <net/route.h>
   86 #include <net/pfil.h>
   87 
   88 #include <netinet/in.h>
   89 #include <netinet/in_var.h>
   90 #include <netinet6/in6_var.h>
   91 #include <netinet/ip6.h>
   92 #include <netinet/icmp6.h>
   93 #include <netinet6/ip6_var.h>
   94 #include <netinet/in_pcb.h>
   95 #include <netinet6/nd6.h>
   96 #include <netinet6/ip6protosw.h>
   97 
   98 #ifdef IPSEC
   99 #include <netinet6/ipsec.h>
  100 #ifdef INET6
  101 #include <netinet6/ipsec6.h>
  102 #endif
  103 #include <netproto/key/key.h>
  104 #endif /* IPSEC */
  105 
  106 #ifdef FAST_IPSEC
  107 #include <netproto/ipsec/ipsec.h>
  108 #include <netproto/ipsec/ipsec6.h>
  109 #include <netproto/ipsec/key.h>
  110 #endif
  111 
  112 #include <net/ip6fw/ip6_fw.h>
  113 
  114 #include <net/net_osdep.h>
  115 
  116 static MALLOC_DEFINE(M_IPMOPTS, "ip6_moptions", "internet multicast options");
  117 
  118 struct ip6_exthdrs {
  119         struct mbuf *ip6e_ip6;
  120         struct mbuf *ip6e_hbh;
  121         struct mbuf *ip6e_dest1;
  122         struct mbuf *ip6e_rthdr;
  123         struct mbuf *ip6e_dest2;
  124 };
  125 
  126 static int ip6_pcbopt (int, u_char *, int, struct ip6_pktopts **, int);
  127 static int ip6_setpktoption (int, u_char *, int, struct ip6_pktopts *,
  128          int, int, int, int);
  129 static int ip6_pcbopts (struct ip6_pktopts **, struct mbuf *,
  130                             struct socket *, struct sockopt *);
  131 static int ip6_getpcbopt(struct ip6_pktopts *, int, struct sockopt *);
  132 static int ip6_setmoptions (int, struct ip6_moptions **, struct mbuf *);
  133 static int ip6_getmoptions (int, struct ip6_moptions *, struct mbuf **);
  134 static int ip6_getpmtu(struct route_in6 *, struct route_in6 *,
  135         struct ifnet *, struct in6_addr *, u_long *, int *);
  136 static int copyexthdr (void *, struct mbuf **);
  137 static int ip6_insertfraghdr (struct mbuf *, struct mbuf *, int,
  138                                   struct ip6_frag **);
  139 static int ip6_insert_jumboopt (struct ip6_exthdrs *, u_int32_t);
  140 static struct mbuf *ip6_splithdr (struct mbuf *);
  141 static int copypktopts(struct ip6_pktopts *, struct ip6_pktopts *, int);
  142 
  143 /*
  144  * IP6 output. The packet in mbuf chain m contains a skeletal IP6
  145  * header (with pri, len, nxt, hlim, src, dst).
  146  * This function may modify ver and hlim only.
  147  * The mbuf chain containing the packet will be freed.
  148  * The mbuf opt, if present, will not be freed.
  149  *
  150  * type of "mtu": rt_rmx.rmx_mtu is u_long, ifnet.ifr_mtu is int, and
  151  * nd_ifinfo.linkmtu is u_int32_t.  so we use u_long to hold largest one,
  152  * which is rt_rmx.rmx_mtu.
  153  */
  154 int
  155 ip6_output(struct mbuf *m0, struct ip6_pktopts *opt, struct route_in6 *ro,
  156            int flags, struct ip6_moptions *im6o,
  157            struct ifnet **ifpp,         /* XXX: just for statistics */
  158            struct inpcb *inp)
  159 {
  160         struct ip6_hdr *ip6, *mhip6;
  161         struct ifnet *ifp, *origifp;
  162         struct mbuf *m = m0;
  163         struct mbuf *mprev;
  164         u_char *nexthdrp;
  165         int hlen, tlen, len, off;
  166         struct route_in6 ip6route;
  167         struct sockaddr_in6 *dst;
  168         int error = 0;
  169         struct in6_ifaddr *ia = NULL;
  170         u_long mtu;
  171         int alwaysfrag, dontfrag;
  172         u_int32_t optlen, plen = 0, unfragpartlen;
  173         struct ip6_exthdrs exthdrs;
  174         struct in6_addr finaldst;
  175         struct route_in6 *ro_pmtu = NULL;
  176         boolean_t hdrsplit = FALSE;
  177         boolean_t needipsec = FALSE;
  178 #ifdef IPSEC
  179         boolean_t needipsectun = FALSE;
  180         struct secpolicy *sp = NULL;
  181         struct socket *so = inp ? inp->inp_socket : NULL;
  182 
  183         ip6 = mtod(m, struct ip6_hdr *);
  184 #endif
  185 #ifdef FAST_IPSEC
  186         boolean_t needipsectun = FALSE;
  187         struct secpolicy *sp = NULL;
  188 
  189         ip6 = mtod(m, struct ip6_hdr *);
  190 #endif
  191 
  192         bzero(&exthdrs, sizeof exthdrs);
  193 
  194         if (opt) {
  195                 if ((error = copyexthdr(opt->ip6po_hbh, &exthdrs.ip6e_hbh)))
  196                         goto freehdrs;
  197                 if ((error = copyexthdr(opt->ip6po_dest1, &exthdrs.ip6e_dest1)))
  198                         goto freehdrs;
  199                 if ((error = copyexthdr(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr)))
  200                         goto freehdrs;
  201                 if ((error = copyexthdr(opt->ip6po_dest2, &exthdrs.ip6e_dest2)))
  202                         goto freehdrs;
  203         }
  204 
  205 #ifdef IPSEC
  206         /* get a security policy for this packet */
  207         if (so == NULL)
  208                 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, 0, &error);
  209         else
  210                 sp = ipsec6_getpolicybysock(m, IPSEC_DIR_OUTBOUND, so, &error);
  211 
  212         if (sp == NULL) {
  213                 ipsec6stat.out_inval++;
  214                 goto freehdrs;
  215         }
  216 
  217         error = 0;
  218 
  219         /* check policy */
  220         switch (sp->policy) {
  221         case IPSEC_POLICY_DISCARD:
  222                 /*
  223                  * This packet is just discarded.
  224                  */
  225                 ipsec6stat.out_polvio++;
  226                 goto freehdrs;
  227 
  228         case IPSEC_POLICY_BYPASS:
  229         case IPSEC_POLICY_NONE:
  230                 /* no need to do IPsec. */
  231                 needipsec = FALSE;
  232                 break;
  233 
  234         case IPSEC_POLICY_IPSEC:
  235                 if (sp->req == NULL) {
  236                         error = key_spdacquire(sp);     /* acquire a policy */
  237                         goto freehdrs;
  238                 }
  239                 needipsec = TRUE;
  240                 break;
  241 
  242         case IPSEC_POLICY_ENTRUST:
  243         default:
  244                 kprintf("ip6_output: Invalid policy found. %d\n", sp->policy);
  245         }
  246 #endif /* IPSEC */
  247 #ifdef FAST_IPSEC
  248         /* get a security policy for this packet */
  249         if (inp == NULL)
  250                 sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, 0, &error);
  251         else
  252                 sp = ipsec_getpolicybysock(m, IPSEC_DIR_OUTBOUND, inp, &error);
  253 
  254         if (sp == NULL) {
  255                 newipsecstat.ips_out_inval++;
  256                 goto freehdrs;
  257         }
  258 
  259         error = 0;
  260 
  261         /* check policy */
  262         switch (sp->policy) {
  263         case IPSEC_POLICY_DISCARD:
  264                 /*
  265                  * This packet is just discarded.
  266                  */
  267                 newipsecstat.ips_out_polvio++;
  268                 goto freehdrs;
  269 
  270         case IPSEC_POLICY_BYPASS:
  271         case IPSEC_POLICY_NONE:
  272                 /* no need to do IPsec. */
  273                 needipsec = FALSE;
  274                 break;
  275 
  276         case IPSEC_POLICY_IPSEC:
  277                 if (sp->req == NULL) {
  278                         error = key_spdacquire(sp);     /* acquire a policy */
  279                         goto freehdrs;
  280                 }
  281                 needipsec = TRUE;
  282                 break;
  283 
  284         case IPSEC_POLICY_ENTRUST:
  285         default:
  286                 kprintf("ip6_output: Invalid policy found. %d\n", sp->policy);
  287         }
  288 #endif /* FAST_IPSEC */
  289 
  290         /*
  291          * Calculate the total length of the extension header chain.
  292          * Keep the length of the unfragmentable part for fragmentation.
  293          */
  294         optlen = m_lengthm(exthdrs.ip6e_hbh, NULL) +
  295             m_lengthm(exthdrs.ip6e_dest1, NULL) +
  296             m_lengthm(exthdrs.ip6e_rthdr, NULL);
  297 
  298         unfragpartlen = optlen + sizeof(struct ip6_hdr);
  299 
  300         /* NOTE: we don't add AH/ESP length here. do that later. */
  301         optlen += m_lengthm(exthdrs.ip6e_dest2, NULL);
  302 
  303         /*
  304          * If we need IPsec, or there is at least one extension header,
  305          * separate IP6 header from the payload.
  306          */
  307         if ((needipsec || optlen) && !hdrsplit) {
  308                 exthdrs.ip6e_ip6 = ip6_splithdr(m);
  309                 if (exthdrs.ip6e_ip6 == NULL) {
  310                         error = ENOBUFS;
  311                         goto freehdrs;
  312                 }
  313                 m = exthdrs.ip6e_ip6;
  314                 hdrsplit = TRUE;
  315         }
  316 
  317         /* adjust pointer */
  318         ip6 = mtod(m, struct ip6_hdr *);
  319 
  320         /* adjust mbuf packet header length */
  321         m->m_pkthdr.len += optlen;
  322         plen = m->m_pkthdr.len - sizeof(*ip6);
  323 
  324         /* If this is a jumbo payload, insert a jumbo payload option. */
  325         if (plen > IPV6_MAXPACKET) {
  326                 if (!hdrsplit) {
  327                         exthdrs.ip6e_ip6 = ip6_splithdr(m);
  328                         if (exthdrs.ip6e_ip6 == NULL) {
  329                                 error = ENOBUFS;
  330                                 goto freehdrs;
  331                         }
  332                         m = exthdrs.ip6e_ip6;
  333                         hdrsplit = TRUE;
  334                 }
  335                 /* adjust pointer */
  336                 ip6 = mtod(m, struct ip6_hdr *);
  337                 if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
  338                         goto freehdrs;
  339                 ip6->ip6_plen = 0;
  340         } else
  341                 ip6->ip6_plen = htons(plen);
  342 
  343         /*
  344          * Concatenate headers and fill in next header fields.
  345          * Here we have, on "m"
  346          *      IPv6 payload
  347          * and we insert headers accordingly.  Finally, we should be getting:
  348          *      IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
  349          *
  350          * during the header composing process, "m" points to IPv6 header.
  351          * "mprev" points to an extension header prior to esp.
  352          */
  353 
  354         nexthdrp = &ip6->ip6_nxt;
  355         mprev = m;
  356 
  357         /*
  358          * we treat dest2 specially.  this makes IPsec processing
  359          * much easier.  the goal here is to make mprev point the
  360          * mbuf prior to dest2.
  361          *
  362          * result: IPv6 dest2 payload
  363          * m and mprev will point to IPv6 header.
  364          */
  365         if (exthdrs.ip6e_dest2) {
  366                 if (!hdrsplit)
  367                         panic("assumption failed: hdr not split");
  368                 exthdrs.ip6e_dest2->m_next = m->m_next;
  369                 m->m_next = exthdrs.ip6e_dest2;
  370                 *mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
  371                 ip6->ip6_nxt = IPPROTO_DSTOPTS;
  372         }
  373 
  374 /*
  375  * Place m1 after mprev.
  376  */
  377 #define MAKE_CHAIN(m1, mprev, nexthdrp, i)\
  378     do {\
  379         if (m1) {\
  380                 if (!hdrsplit)\
  381                         panic("assumption failed: hdr not split");\
  382                 *mtod(m1, u_char *) = *nexthdrp;\
  383                 *nexthdrp = (i);\
  384                 nexthdrp = mtod(m1, u_char *);\
  385                 m1->m_next = mprev->m_next;\
  386                 mprev->m_next = m1;\
  387                 mprev = m1;\
  388         }\
  389     } while (0)
  390 
  391         /*
  392          * result: IPv6 hbh dest1 rthdr dest2 payload
  393          * m will point to IPv6 header.  mprev will point to the
  394          * extension header prior to dest2 (rthdr in the above case).
  395          */
  396         MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
  397         MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp, IPPROTO_DSTOPTS);
  398         MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp, IPPROTO_ROUTING);
  399 
  400 #if defined(IPSEC) || defined(FAST_IPSEC)
  401         if (needipsec) {
  402                 struct ipsec_output_state state;
  403                 int segleft_org = 0;
  404                 struct ip6_rthdr *rh = NULL;
  405 
  406                 /*
  407                  * pointers after IPsec headers are not valid any more.
  408                  * other pointers need a great care too.
  409                  * (IPsec routines should not mangle mbufs prior to AH/ESP)
  410                  */
  411                 exthdrs.ip6e_dest2 = NULL;
  412 
  413                 if (exthdrs.ip6e_rthdr) {
  414                         rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
  415                         segleft_org = rh->ip6r_segleft;
  416                         rh->ip6r_segleft = 0;
  417                 }
  418 
  419                 bzero(&state, sizeof state);
  420                 state.m = m;
  421                 error = ipsec6_output_trans(&state, nexthdrp, mprev, sp, flags,
  422                                             &needipsectun);
  423                 m = state.m;
  424                 if (error) {
  425                         /* mbuf is already reclaimed in ipsec6_output_trans. */
  426                         m = NULL;
  427                         switch (error) {
  428                         case EHOSTUNREACH:
  429                         case ENETUNREACH:
  430                         case EMSGSIZE:
  431                         case ENOBUFS:
  432                         case ENOMEM:
  433                                 break;
  434                         default:
  435                                 kprintf("ip6_output (ipsec): error code %d\n",
  436                                        error);
  437                                 /* fall through */
  438                         case ENOENT:
  439                                 /* don't show these error codes to the user */
  440                                 error = 0;
  441                                 break;
  442                         }
  443                         goto bad;
  444                 }
  445                 if (exthdrs.ip6e_rthdr) {
  446                         /* ah6_output doesn't modify mbuf chain */
  447                         rh->ip6r_segleft = segleft_org;
  448                 }
  449         }
  450 #endif
  451 
  452         /*
  453          * If there is a routing header, replace destination address field
  454          * with the first hop of the routing header.
  455          */
  456         if (exthdrs.ip6e_rthdr) {
  457                 struct ip6_rthdr *rh;
  458 
  459                 finaldst = ip6->ip6_dst;
  460                 rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
  461                 switch (rh->ip6r_type) {
  462                 default:        /* is it possible? */
  463                          error = EINVAL;
  464                          goto bad;
  465                 }
  466         }
  467 
  468         /* Source address validation */
  469         if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
  470             !(flags & IPV6_DADOUTPUT)) {
  471                 error = EOPNOTSUPP;
  472                 ip6stat.ip6s_badscope++;
  473                 goto bad;
  474         }
  475         if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
  476                 error = EOPNOTSUPP;
  477                 ip6stat.ip6s_badscope++;
  478                 goto bad;
  479         }
  480 
  481         ip6stat.ip6s_localout++;
  482 
  483         /*
  484          * Route packet.
  485          */
  486         if (ro == NULL) {
  487                 ro = &ip6route;
  488                 bzero(ro, sizeof(*ro));
  489         }
  490         ro_pmtu = ro;
  491         if (opt && opt->ip6po_rthdr)
  492                 ro = &opt->ip6po_route;
  493         dst = (struct sockaddr_in6 *)&ro->ro_dst;
  494         /*
  495          * If there is a cached route,
  496          * check that it is to the same destination
  497          * and is still up. If not, free it and try again.
  498          */
  499         if (ro->ro_rt != NULL &&
  500             (!(ro->ro_rt->rt_flags & RTF_UP) || dst->sin6_family != AF_INET6 ||
  501              !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst))) {
  502                 RTFREE(ro->ro_rt);
  503                 ro->ro_rt = NULL;
  504         }
  505         if (ro->ro_rt == NULL) {
  506                 bzero(dst, sizeof(*dst));
  507                 dst->sin6_family = AF_INET6;
  508                 dst->sin6_len = sizeof(struct sockaddr_in6);
  509                 dst->sin6_addr = ip6->ip6_dst;
  510         }
  511 #if defined(IPSEC) || defined(FAST_IPSEC)
  512         if (needipsec && needipsectun) {
  513                 struct ipsec_output_state state;
  514 
  515                 /*
  516                  * All the extension headers will become inaccessible
  517                  * (since they can be encrypted).
  518                  * Don't panic, we need no more updates to extension headers
  519                  * on inner IPv6 packet (since they are now encapsulated).
  520                  *
  521                  * IPv6 [ESP|AH] IPv6 [extension headers] payload
  522                  */
  523                 bzero(&exthdrs, sizeof(exthdrs));
  524                 exthdrs.ip6e_ip6 = m;
  525 
  526                 bzero(&state, sizeof(state));
  527                 state.m = m;
  528                 state.ro = (struct route *)ro;
  529                 state.dst = (struct sockaddr *)dst;
  530 
  531                 error = ipsec6_output_tunnel(&state, sp, flags);
  532 
  533                 m = state.m;
  534                 ro = (struct route_in6 *)state.ro;
  535                 dst = (struct sockaddr_in6 *)state.dst;
  536                 if (error) {
  537                         /* mbuf is already reclaimed in ipsec6_output_tunnel. */
  538                         m0 = m = NULL;
  539                         m = NULL;
  540                         switch (error) {
  541                         case EHOSTUNREACH:
  542                         case ENETUNREACH:
  543                         case EMSGSIZE:
  544                         case ENOBUFS:
  545                         case ENOMEM:
  546                                 break;
  547                         default:
  548                                 kprintf("ip6_output (ipsec): error code %d\n", error);
  549                                 /* fall through */
  550                         case ENOENT:
  551                                 /* don't show these error codes to the user */
  552                                 error = 0;
  553                                 break;
  554                         }
  555                         goto bad;
  556                 }
  557 
  558                 exthdrs.ip6e_ip6 = m;
  559         }
  560 #endif
  561 
  562         if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
  563                 /* Unicast */
  564 
  565 #define ifatoia6(ifa)   ((struct in6_ifaddr *)(ifa))
  566 #define sin6tosa(sin6)  ((struct sockaddr *)(sin6))
  567                 /* xxx
  568                  * interface selection comes here
  569                  * if an interface is specified from an upper layer,
  570                  * ifp must point it.
  571                  */
  572                 if (ro->ro_rt == NULL) {
  573                         /*
  574                          * non-bsdi always clone routes, if parent is
  575                          * PRF_CLONING.
  576                          */
  577                         rtalloc((struct route *)ro);
  578                 }
  579                 if (ro->ro_rt == NULL) {
  580                         ip6stat.ip6s_noroute++;
  581                         error = EHOSTUNREACH;
  582                         /* XXX in6_ifstat_inc(ifp, ifs6_out_discard); */
  583                         goto bad;
  584                 }
  585                 ia = ifatoia6(ro->ro_rt->rt_ifa);
  586                 ifp = ro->ro_rt->rt_ifp;
  587                 ro->ro_rt->rt_use++;
  588                 if (ro->ro_rt->rt_flags & RTF_GATEWAY)
  589                         dst = (struct sockaddr_in6 *)ro->ro_rt->rt_gateway;
  590                 m->m_flags &= ~(M_BCAST | M_MCAST);     /* just in case */
  591 
  592                 in6_ifstat_inc(ifp, ifs6_out_request);
  593 
  594                 /*
  595                  * Check if the outgoing interface conflicts with
  596                  * the interface specified by ifi6_ifindex (if specified).
  597                  * Note that loopback interface is always okay.
  598                  * (this may happen when we are sending a packet to one of
  599                  *  our own addresses.)
  600                  */
  601                 if (opt && opt->ip6po_pktinfo
  602                  && opt->ip6po_pktinfo->ipi6_ifindex) {
  603                         if (!(ifp->if_flags & IFF_LOOPBACK)
  604                          && ifp->if_index != opt->ip6po_pktinfo->ipi6_ifindex) {
  605                                 ip6stat.ip6s_noroute++;
  606                                 in6_ifstat_inc(ifp, ifs6_out_discard);
  607                                 error = EHOSTUNREACH;
  608                                 goto bad;
  609                         }
  610                 }
  611 
  612                 if (opt && opt->ip6po_hlim != -1)
  613                         ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
  614         } else {
  615                 /* Multicast */
  616                 struct  in6_multi *in6m;
  617 
  618                 m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
  619 
  620                 /*
  621                  * See if the caller provided any multicast options
  622                  */
  623                 ifp = NULL;
  624                 if (im6o != NULL) {
  625                         ip6->ip6_hlim = im6o->im6o_multicast_hlim;
  626                         if (im6o->im6o_multicast_ifp != NULL)
  627                                 ifp = im6o->im6o_multicast_ifp;
  628                 } else
  629                         ip6->ip6_hlim = ip6_defmcasthlim;
  630 
  631                 /*
  632                  * See if the caller provided the outgoing interface
  633                  * as an ancillary data.
  634                  * Boundary check for ifindex is assumed to be already done.
  635                  */
  636                 if (opt && opt->ip6po_pktinfo && opt->ip6po_pktinfo->ipi6_ifindex)
  637                         ifp = ifindex2ifnet[opt->ip6po_pktinfo->ipi6_ifindex];
  638 
  639                 /*
  640                  * If the destination is a node-local scope multicast,
  641                  * the packet should be loop-backed only.
  642                  */
  643                 if (IN6_IS_ADDR_MC_NODELOCAL(&ip6->ip6_dst)) {
  644                         /*
  645                          * If the outgoing interface is already specified,
  646                          * it should be a loopback interface.
  647                          */
  648                         if (ifp && !(ifp->if_flags & IFF_LOOPBACK)) {
  649                                 ip6stat.ip6s_badscope++;
  650                                 error = ENETUNREACH; /* XXX: better error? */
  651                                 /* XXX correct ifp? */
  652                                 in6_ifstat_inc(ifp, ifs6_out_discard);
  653                                 goto bad;
  654                         } else {
  655                                 ifp = &loif[0];
  656                         }
  657                 }
  658 
  659                 if (opt && opt->ip6po_hlim != -1)
  660                         ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
  661 
  662                 /*
  663                  * If caller did not provide an interface lookup a
  664                  * default in the routing table.  This is either a
  665                  * default for the speicfied group (i.e. a host
  666                  * route), or a multicast default (a route for the
  667                  * ``net'' ff00::/8).
  668                  */
  669                 if (ifp == NULL) {
  670                         if (ro->ro_rt == NULL) {
  671                                 ro->ro_rt =
  672                                   rtpurelookup((struct sockaddr *)&ro->ro_dst);
  673                         }
  674                         if (ro->ro_rt == NULL) {
  675                                 ip6stat.ip6s_noroute++;
  676                                 error = EHOSTUNREACH;
  677                                 /* XXX in6_ifstat_inc(ifp, ifs6_out_discard) */
  678                                 goto bad;
  679                         }
  680                         ia = ifatoia6(ro->ro_rt->rt_ifa);
  681                         ifp = ro->ro_rt->rt_ifp;
  682                         ro->ro_rt->rt_use++;
  683                 }
  684 
  685                 if (!(flags & IPV6_FORWARDING))
  686                         in6_ifstat_inc(ifp, ifs6_out_request);
  687                 in6_ifstat_inc(ifp, ifs6_out_mcast);
  688 
  689                 /*
  690                  * Confirm that the outgoing interface supports multicast.
  691                  */
  692                 if (!(ifp->if_flags & IFF_MULTICAST)) {
  693                         ip6stat.ip6s_noroute++;
  694                         in6_ifstat_inc(ifp, ifs6_out_discard);
  695                         error = ENETUNREACH;
  696                         goto bad;
  697                 }
  698                 IN6_LOOKUP_MULTI(ip6->ip6_dst, ifp, in6m);
  699                 if (in6m != NULL &&
  700                    (im6o == NULL || im6o->im6o_multicast_loop)) {
  701                         /*
  702                          * If we belong to the destination multicast group
  703                          * on the outgoing interface, and the caller did not
  704                          * forbid loopback, loop back a copy.
  705                          */
  706                         ip6_mloopback(ifp, m, dst);
  707                 } else {
  708                         /*
  709                          * If we are acting as a multicast router, perform
  710                          * multicast forwarding as if the packet had just
  711                          * arrived on the interface to which we are about
  712                          * to send.  The multicast forwarding function
  713                          * recursively calls this function, using the
  714                          * IPV6_FORWARDING flag to prevent infinite recursion.
  715                          *
  716                          * Multicasts that are looped back by ip6_mloopback(),
  717                          * above, will be forwarded by the ip6_input() routine,
  718                          * if necessary.
  719                          */
  720                         if (ip6_mrouter && !(flags & IPV6_FORWARDING)) {
  721                                 if (ip6_mforward(ip6, ifp, m) != 0) {
  722                                         m_freem(m);
  723                                         goto done;
  724                                 }
  725                         }
  726                 }
  727                 /*
  728                  * Multicasts with a hoplimit of zero may be looped back,
  729                  * above, but must not be transmitted on a network.
  730                  * Also, multicasts addressed to the loopback interface
  731                  * are not sent -- the above call to ip6_mloopback() will
  732                  * loop back a copy if this host actually belongs to the
  733                  * destination group on the loopback interface.
  734                  */
  735                 if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK)) {
  736                         m_freem(m);
  737                         goto done;
  738                 }
  739         }
  740 
  741         /*
  742          * Fill the outgoing inteface to tell the upper layer
  743          * to increment per-interface statistics.
  744          */
  745         if (ifpp)
  746                 *ifpp = ifp;
  747 
  748         /* Determine path MTU. */
  749         if ((error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, &mtu,
  750             &alwaysfrag)) != 0)
  751                 goto bad;
  752 
  753         /*
  754          * The caller of this function may specify to use the minimum MTU
  755          * in some cases.
  756          * An advanced API option (IPV6_USE_MIN_MTU) can also override MTU
  757          * setting.  The logic is a bit complicated; by default, unicast
  758          * packets will follow path MTU while multicast packets will be sent at
  759          * the minimum MTU.  If IP6PO_MINMTU_ALL is specified, all packets
  760          * including unicast ones will be sent at the minimum MTU.  Multicast
  761          * packets will always be sent at the minimum MTU unless
  762          * IP6PO_MINMTU_DISABLE is explicitly specified.
  763          * See RFC 3542 for more details.
  764          */
  765         if (mtu > IPV6_MMTU) {
  766                 if ((flags & IPV6_MINMTU))
  767                         mtu = IPV6_MMTU;
  768                 else if (opt && opt->ip6po_minmtu == IP6PO_MINMTU_ALL)
  769                         mtu = IPV6_MMTU;
  770                 else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
  771                          (opt == NULL ||
  772                           opt->ip6po_minmtu != IP6PO_MINMTU_DISABLE)) {
  773                         mtu = IPV6_MMTU;
  774                 }
  775         }
  776 
  777         /* Fake scoped addresses */
  778         if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
  779                 /*
  780                  * If source or destination address is a scoped address, and
  781                  * the packet is going to be sent to a loopback interface,
  782                  * we should keep the original interface.
  783                  */
  784 
  785                 /*
  786                  * XXX: this is a very experimental and temporary solution.
  787                  * We eventually have sockaddr_in6 and use the sin6_scope_id
  788                  * field of the structure here.
  789                  * We rely on the consistency between two scope zone ids
  790                  * of source and destination, which should already be assured.
  791                  * Larger scopes than link will be supported in the future.
  792                  */
  793                 origifp = NULL;
  794                 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
  795                         origifp = ifindex2ifnet[ntohs(ip6->ip6_src.s6_addr16[1])];
  796                 else if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
  797                         origifp = ifindex2ifnet[ntohs(ip6->ip6_dst.s6_addr16[1])];
  798                 /*
  799                  * XXX: origifp can be NULL even in those two cases above.
  800                  * For example, if we remove the (only) link-local address
  801                  * from the loopback interface, and try to send a link-local
  802                  * address without link-id information.  Then the source
  803                  * address is ::1, and the destination address is the
  804                  * link-local address with its s6_addr16[1] being zero.
  805                  * What is worse, if the packet goes to the loopback interface
  806                  * by a default rejected route, the null pointer would be
  807                  * passed to looutput, and the kernel would hang.
  808                  * The following last resort would prevent such disaster.
  809                  */
  810                 if (origifp == NULL)
  811                         origifp = ifp;
  812         }
  813         else
  814                 origifp = ifp;
  815         /*
  816          * clear embedded scope identifiers if necessary.
  817          * in6_clearscope will touch the addresses only when necessary.
  818          */
  819         in6_clearscope(&ip6->ip6_src);
  820         in6_clearscope(&ip6->ip6_dst);
  821 
  822         /*
  823          * Check with the firewall...
  824          */
  825         if (ip6_fw_enable && ip6_fw_chk_ptr) {
  826                 u_short port = 0;
  827 
  828                 m->m_pkthdr.rcvif = NULL;       /* XXX */
  829                 /* If ipfw says divert, we have to just drop packet */
  830                 if ((*ip6_fw_chk_ptr)(&ip6, ifp, &port, &m)) {
  831                         m_freem(m);
  832                         goto done;
  833                 }
  834                 if (!m) {
  835                         error = EACCES;
  836                         goto done;
  837                 }
  838         }
  839 
  840         /*
  841          * If the outgoing packet contains a hop-by-hop options header,
  842          * it must be examined and processed even by the source node.
  843          * (RFC 2460, section 4.)
  844          */
  845         if (exthdrs.ip6e_hbh) {
  846                 struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh, struct ip6_hbh *);
  847                 u_int32_t dummy1; /* XXX unused */
  848                 u_int32_t dummy2; /* XXX unused */
  849 
  850 #ifdef DIAGNOSTIC
  851                 if ((hbh->ip6h_len + 1) << 3 > exthdrs.ip6e_hbh->m_len)
  852                         panic("ip6e_hbh is not continuous");
  853 #endif
  854                 /*
  855                  *  XXX: if we have to send an ICMPv6 error to the sender,
  856                  *       we need the M_LOOP flag since icmp6_error() expects
  857                  *       the IPv6 and the hop-by-hop options header are
  858                  *       continuous unless the flag is set.
  859                  */
  860                 m->m_flags |= M_LOOP;
  861                 m->m_pkthdr.rcvif = ifp;
  862                 if (ip6_process_hopopts(m,
  863                                         (u_int8_t *)(hbh + 1),
  864                                         ((hbh->ip6h_len + 1) << 3) -
  865                                         sizeof(struct ip6_hbh),
  866                                         &dummy1, &dummy2) < 0) {
  867                         /* m was already freed at this point */
  868                         error = EINVAL;/* better error? */
  869                         goto done;
  870                 }
  871                 m->m_flags &= ~M_LOOP; /* XXX */
  872                 m->m_pkthdr.rcvif = NULL;
  873         }
  874 
  875         /*
  876          * Run through list of hooks for output packets.
  877          */
  878         if (pfil_has_hooks(&inet6_pfil_hook)) {
  879                 error = pfil_run_hooks(&inet6_pfil_hook, &m, ifp, PFIL_OUT);
  880                 if (error != 0 || m == NULL)
  881                         goto done;
  882                 ip6 = mtod(m, struct ip6_hdr *);
  883         }
  884 
  885         /*
  886          * Send the packet to the outgoing interface.
  887          * If necessary, do IPv6 fragmentation before sending.
  888          *
  889          * the logic here is rather complex:
  890          * 1: normal case (dontfrag == 0, alwaysfrag == 0)
  891          * 1-a: send as is if tlen <= path mtu
  892          * 1-b: fragment if tlen > path mtu
  893          *
  894          * 2: if user asks us not to fragment (dontfrag == 1)
  895          * 2-a: send as is if tlen <= interface mtu
  896          * 2-b: error if tlen > interface mtu
  897          *
  898          * 3: if we always need to attach fragment header (alwaysfrag == 1)
  899          *      always fragment
  900          *
  901          * 4: if dontfrag == 1 && alwaysfrag == 1
  902          *      error, as we cannot handle this conflicting request
  903          */
  904         tlen = m->m_pkthdr.len;
  905 
  906         if (opt && (opt->ip6po_flags & IP6PO_DONTFRAG))
  907                 dontfrag = 1;
  908         else
  909                 dontfrag = 0;
  910         if (dontfrag && alwaysfrag) {   /* case 4 */
  911                 /* conflicting request - can't transmit */
  912                 error = EMSGSIZE;
  913                 goto bad;
  914         }
  915         if (dontfrag && tlen > IN6_LINKMTU(ifp)) {      /* case 2-b */
  916                 /*
  917                  * Even if the DONTFRAG option is specified, we cannot send the
  918                  * packet when the data length is larger than the MTU of the
  919                  * outgoing interface.
  920                  * Notify the error by sending IPV6_PATHMTU ancillary data as
  921                  * well as returning an error code (the latter is not described
  922                  * in the API spec.)
  923                  */
  924                 u_int32_t mtu32;
  925                 struct ip6ctlparam ip6cp;
  926 
  927                 mtu32 = (u_int32_t)mtu;
  928                 bzero(&ip6cp, sizeof(ip6cp));
  929                 ip6cp.ip6c_cmdarg = (void *)&mtu32;
  930                 kpfctlinput2(PRC_MSGSIZE, (struct sockaddr *)&ro_pmtu->ro_dst,
  931                     (void *)&ip6cp);
  932 
  933                 error = EMSGSIZE;
  934                 goto bad;
  935         }
  936 
  937         /*
  938          * transmit packet without fragmentation
  939          */
  940         if (dontfrag || (!alwaysfrag && tlen <= mtu)) { /* case 1-a and 2-a */
  941                 struct in6_ifaddr *ia6;
  942 
  943                 ip6 = mtod(m, struct ip6_hdr *);
  944                 ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
  945                 if (ia6) {
  946                         /* Record statistics for this interface address. */
  947                         IFA_STAT_INC(&ia6->ia_ifa, opackets, 1);
  948                         IFA_STAT_INC(&ia6->ia_ifa, obytes, m->m_pkthdr.len);
  949                 }
  950 #ifdef IPSEC
  951                 /* clean ipsec history once it goes out of the node */
  952                 ipsec_delaux(m);
  953 #endif
  954                 error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
  955                 goto done;
  956         } 
  957 
  958         /*
  959          * try to fragment the packet.  case 1-b and 3
  960          */
  961         if (mtu < IPV6_MMTU) {
  962                 /*
  963                  * note that path MTU is never less than IPV6_MMTU
  964                  * (see icmp6_input).
  965                  */
  966                 error = EMSGSIZE;
  967                 in6_ifstat_inc(ifp, ifs6_out_fragfail);
  968                 goto bad;
  969         } else if (ip6->ip6_plen == 0) { /* jumbo payload cannot be fragmented */
  970                 error = EMSGSIZE;
  971                 in6_ifstat_inc(ifp, ifs6_out_fragfail);
  972                 goto bad;
  973         } else {
  974                 struct mbuf **mnext, *m_frgpart;
  975                 struct ip6_frag *ip6f;
  976                 u_int32_t id = htonl(ip6_id++);
  977                 u_char nextproto;
  978 
  979                 /*
  980                  * Too large for the destination or interface;
  981                  * fragment if possible.
  982                  * Must be able to put at least 8 bytes per fragment.
  983                  */
  984                 hlen = unfragpartlen;
  985                 if (mtu > IPV6_MAXPACKET)
  986                         mtu = IPV6_MAXPACKET;
  987 
  988                 len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
  989                 if (len < 8) {
  990                         error = EMSGSIZE;
  991                         in6_ifstat_inc(ifp, ifs6_out_fragfail);
  992                         goto bad;
  993                 }
  994 
  995                 mnext = &m->m_nextpkt;
  996 
  997                 /*
  998                  * Change the next header field of the last header in the
  999                  * unfragmentable part.
 1000                  */
 1001                 if (exthdrs.ip6e_rthdr) {
 1002                         nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
 1003                         *mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
 1004                 } else if (exthdrs.ip6e_dest1) {
 1005                         nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
 1006                         *mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
 1007                 } else if (exthdrs.ip6e_hbh) {
 1008                         nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
 1009                         *mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
 1010                 } else {
 1011                         nextproto = ip6->ip6_nxt;
 1012                         ip6->ip6_nxt = IPPROTO_FRAGMENT;
 1013                 }
 1014 
 1015                 /*
 1016                  * Loop through length of segment after first fragment,
 1017                  * make new header and copy data of each part and link onto
 1018                  * chain.
 1019                  */
 1020                 m0 = m;
 1021                 for (off = hlen; off < tlen; off += len) {
 1022                         MGETHDR(m, MB_DONTWAIT, MT_HEADER);
 1023                         if (!m) {
 1024                                 error = ENOBUFS;
 1025                                 ip6stat.ip6s_odropped++;
 1026                                 goto sendorfree;
 1027                         }
 1028                         m->m_pkthdr.rcvif = NULL;
 1029                         m->m_flags = m0->m_flags & M_COPYFLAGS;
 1030                         *mnext = m;
 1031                         mnext = &m->m_nextpkt;
 1032                         m->m_data += max_linkhdr;
 1033                         mhip6 = mtod(m, struct ip6_hdr *);
 1034                         *mhip6 = *ip6;
 1035                         m->m_len = sizeof(*mhip6);
 1036                         error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
 1037                         if (error) {
 1038                                 ip6stat.ip6s_odropped++;
 1039                                 goto sendorfree;
 1040                         }
 1041                         ip6f->ip6f_offlg = htons((u_short)((off - hlen) & ~7));
 1042                         if (off + len >= tlen)
 1043                                 len = tlen - off;
 1044                         else
 1045                                 ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
 1046                         mhip6->ip6_plen = htons((u_short)(len + hlen +
 1047                                                           sizeof(*ip6f) -
 1048                                                           sizeof(struct ip6_hdr)));
 1049                         if ((m_frgpart = m_copy(m0, off, len)) == NULL) {
 1050                                 error = ENOBUFS;
 1051                                 ip6stat.ip6s_odropped++;
 1052                                 goto sendorfree;
 1053                         }
 1054                         m_cat(m, m_frgpart);
 1055                         m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
 1056                         m->m_pkthdr.rcvif = NULL;
 1057                         ip6f->ip6f_reserved = 0;
 1058                         ip6f->ip6f_ident = id;
 1059                         ip6f->ip6f_nxt = nextproto;
 1060                         ip6stat.ip6s_ofragments++;
 1061                         in6_ifstat_inc(ifp, ifs6_out_fragcreat);
 1062                 }
 1063 
 1064                 in6_ifstat_inc(ifp, ifs6_out_fragok);
 1065         }
 1066 
 1067         /*
 1068          * Remove leading garbages.
 1069          */
 1070 sendorfree:
 1071         m = m0->m_nextpkt;
 1072         m0->m_nextpkt = NULL;
 1073         m_freem(m0);
 1074         for (m0 = m; m; m = m0) {
 1075                 m0 = m->m_nextpkt;
 1076                 m->m_nextpkt = NULL;
 1077                 if (error == 0) {
 1078                         /* Record statistics for this interface address. */
 1079                         if (ia) {
 1080                                 IFA_STAT_INC(&ia->ia_ifa, opackets, 1);
 1081                                 IFA_STAT_INC(&ia->ia_ifa, obytes,
 1082                                     m->m_pkthdr.len);
 1083                         }
 1084 #ifdef IPSEC
 1085                         /* clean ipsec history once it goes out of the node */
 1086                         ipsec_delaux(m);
 1087 #endif
 1088                         error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
 1089                 } else
 1090                         m_freem(m);
 1091         }
 1092 
 1093         if (error == 0)
 1094                 ip6stat.ip6s_fragmented++;
 1095 
 1096 done:
 1097         if (ro == &ip6route && ro->ro_rt) { /* brace necessary for RTFREE */
 1098                 RTFREE(ro->ro_rt);
 1099         } else if (ro_pmtu == &ip6route && ro_pmtu->ro_rt) {
 1100                 RTFREE(ro_pmtu->ro_rt);
 1101         }
 1102 
 1103 #ifdef IPSEC
 1104         if (sp != NULL)
 1105                 key_freesp(sp);
 1106 #endif
 1107 #ifdef FAST_IPSEC
 1108         if (sp != NULL)
 1109                 KEY_FREESP(&sp);
 1110 #endif
 1111 
 1112         return (error);
 1113 
 1114 freehdrs:
 1115         m_freem(exthdrs.ip6e_hbh);      /* m_freem will check if mbuf is 0 */
 1116         m_freem(exthdrs.ip6e_dest1);
 1117         m_freem(exthdrs.ip6e_rthdr);
 1118         m_freem(exthdrs.ip6e_dest2);
 1119         /* fall through */
 1120 bad:
 1121         m_freem(m);
 1122         goto done;
 1123 }
 1124 
 1125 static int
 1126 copyexthdr(void *h, struct mbuf **mp)
 1127 {
 1128         struct ip6_ext *hdr = h;
 1129         int hlen;
 1130         struct mbuf *m;
 1131 
 1132         if (hdr == NULL)
 1133                 return 0;
 1134 
 1135         hlen = (hdr->ip6e_len + 1) * 8;
 1136         if (hlen > MCLBYTES)
 1137                 return ENOBUFS; /* XXX */
 1138 
 1139         m = m_getb(hlen, MB_DONTWAIT, MT_DATA, 0);
 1140         if (!m)
 1141                 return ENOBUFS;
 1142         m->m_len = hlen;
 1143 
 1144         bcopy(hdr, mtod(m, caddr_t), hlen);
 1145 
 1146         *mp = m;
 1147         return 0;
 1148 }
 1149 
 1150 /*
 1151  * Insert jumbo payload option.
 1152  */
 1153 static int
 1154 ip6_insert_jumboopt(struct ip6_exthdrs *exthdrs, u_int32_t plen)
 1155 {
 1156         struct mbuf *mopt;
 1157         u_char *optbuf;
 1158         u_int32_t v;
 1159 
 1160 #define JUMBOOPTLEN     8       /* length of jumbo payload option and padding */
 1161 
 1162         /*
 1163          * If there is no hop-by-hop options header, allocate new one.
 1164          * If there is one but it doesn't have enough space to store the
 1165          * jumbo payload option, allocate a cluster to store the whole options.
 1166          * Otherwise, use it to store the options.
 1167          */
 1168         if (exthdrs->ip6e_hbh == NULL) {
 1169                 MGET(mopt, MB_DONTWAIT, MT_DATA);
 1170                 if (mopt == NULL)
 1171                         return (ENOBUFS);
 1172                 mopt->m_len = JUMBOOPTLEN;
 1173                 optbuf = mtod(mopt, u_char *);
 1174                 optbuf[1] = 0;  /* = ((JUMBOOPTLEN) >> 3) - 1 */
 1175                 exthdrs->ip6e_hbh = mopt;
 1176         } else {
 1177                 struct ip6_hbh *hbh;
 1178 
 1179                 mopt = exthdrs->ip6e_hbh;
 1180                 if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
 1181                         /*
 1182                          * XXX assumption:
 1183                          * - exthdrs->ip6e_hbh is not referenced from places
 1184                          *   other than exthdrs.
 1185                          * - exthdrs->ip6e_hbh is not an mbuf chain.
 1186                          */
 1187                         int oldoptlen = mopt->m_len;
 1188                         struct mbuf *n;
 1189 
 1190                         /*
 1191                          * XXX: give up if the whole (new) hbh header does
 1192                          * not fit even in an mbuf cluster.
 1193                          */
 1194                         if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
 1195                                 return (ENOBUFS);
 1196 
 1197                         /*
 1198                          * As a consequence, we must always prepare a cluster
 1199                          * at this point.
 1200                          */
 1201                         n = m_getcl(MB_DONTWAIT, MT_DATA, 0);
 1202                         if (!n)
 1203                                 return (ENOBUFS);
 1204                         n->m_len = oldoptlen + JUMBOOPTLEN;
 1205                         bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t), oldoptlen);
 1206                         optbuf = mtod(n, caddr_t) + oldoptlen;
 1207                         m_freem(mopt);
 1208                         mopt = exthdrs->ip6e_hbh = n;
 1209                 } else {
 1210                         optbuf = mtod(mopt, u_char *) + mopt->m_len;
 1211                         mopt->m_len += JUMBOOPTLEN;
 1212                 }
 1213                 optbuf[0] = IP6OPT_PADN;
 1214                 optbuf[1] = 1;
 1215 
 1216                 /*
 1217                  * Adjust the header length according to the pad and
 1218                  * the jumbo payload option.
 1219                  */
 1220                 hbh = mtod(mopt, struct ip6_hbh *);
 1221                 hbh->ip6h_len += (JUMBOOPTLEN >> 3);
 1222         }
 1223 
 1224         /* fill in the option. */
 1225         optbuf[2] = IP6OPT_JUMBO;
 1226         optbuf[3] = 4;
 1227         v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
 1228         bcopy(&v, &optbuf[4], sizeof(u_int32_t));
 1229 
 1230         /* finally, adjust the packet header length */
 1231         exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
 1232 
 1233         return (0);
 1234 #undef JUMBOOPTLEN
 1235 }
 1236 
 1237 /*
 1238  * Insert fragment header and copy unfragmentable header portions.
 1239  */
 1240 static int
 1241 ip6_insertfraghdr(struct mbuf *m0, struct mbuf *m, int hlen,
 1242                   struct ip6_frag **frghdrp)
 1243 {
 1244         struct mbuf *n, *mlast;
 1245 
 1246         if (hlen > sizeof(struct ip6_hdr)) {
 1247                 n = m_copym(m0, sizeof(struct ip6_hdr),
 1248                             hlen - sizeof(struct ip6_hdr), MB_DONTWAIT);
 1249                 if (n == NULL)
 1250                         return (ENOBUFS);
 1251                 m->m_next = n;
 1252         } else
 1253                 n = m;
 1254 
 1255         /* Search for the last mbuf of unfragmentable part. */
 1256         for (mlast = n; mlast->m_next; mlast = mlast->m_next)
 1257                 ;
 1258 
 1259         if (!(mlast->m_flags & M_EXT) &&
 1260             M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
 1261                 /* use the trailing space of the last mbuf for the fragment hdr */
 1262                 *frghdrp =
 1263                         (struct ip6_frag *)(mtod(mlast, caddr_t) + mlast->m_len);
 1264                 mlast->m_len += sizeof(struct ip6_frag);
 1265                 m->m_pkthdr.len += sizeof(struct ip6_frag);
 1266         } else {
 1267                 /* allocate a new mbuf for the fragment header */
 1268                 struct mbuf *mfrg;
 1269 
 1270                 MGET(mfrg, MB_DONTWAIT, MT_DATA);
 1271                 if (mfrg == NULL)
 1272                         return (ENOBUFS);
 1273                 mfrg->m_len = sizeof(struct ip6_frag);
 1274                 *frghdrp = mtod(mfrg, struct ip6_frag *);
 1275                 mlast->m_next = mfrg;
 1276         }
 1277 
 1278         return (0);
 1279 }
 1280 
 1281 static int
 1282 ip6_getpmtu(struct route_in6 *ro_pmtu, struct route_in6 *ro,
 1283     struct ifnet *ifp, struct in6_addr *dst, u_long *mtup,
 1284     int *alwaysfragp)
 1285 {
 1286         u_int32_t mtu = 0;
 1287         int alwaysfrag = 0;
 1288         int error = 0;
 1289 
 1290         if (ro_pmtu != ro) {
 1291                 /* The first hop and the final destination may differ. */
 1292                 struct sockaddr_in6 *sa6_dst =
 1293                     (struct sockaddr_in6 *)&ro_pmtu->ro_dst;
 1294                 if (ro_pmtu->ro_rt &&
 1295                     ((ro_pmtu->ro_rt->rt_flags & RTF_UP) == 0 ||
 1296                      !IN6_ARE_ADDR_EQUAL(&sa6_dst->sin6_addr, dst))) {
 1297                         RTFREE(ro_pmtu->ro_rt);
 1298                         ro_pmtu->ro_rt = NULL;
 1299                 }
 1300                 if (ro_pmtu->ro_rt == NULL) {
 1301                         bzero(sa6_dst, sizeof(*sa6_dst));
 1302                         sa6_dst->sin6_family = AF_INET6;
 1303                         sa6_dst->sin6_len = sizeof(struct sockaddr_in6);
 1304                         sa6_dst->sin6_addr = *dst;
 1305 
 1306                         rtalloc((struct route *)ro_pmtu);
 1307                 }
 1308         }
 1309         if (ro_pmtu->ro_rt) {
 1310                 u_int32_t ifmtu;
 1311                 struct in_conninfo inc;
 1312 
 1313                 bzero(&inc, sizeof(inc));
 1314                 inc.inc_flags = 1; /* IPv6 */
 1315                 inc.inc6_faddr = *dst;
 1316 
 1317                 if (ifp == NULL)
 1318                         ifp = ro_pmtu->ro_rt->rt_ifp;
 1319                 ifmtu = IN6_LINKMTU(ifp);
 1320                 mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
 1321                 if (mtu == 0)
 1322                         mtu = ifmtu;
 1323                 else if (mtu < IPV6_MMTU) {
 1324                         /*
 1325                          * RFC2460 section 5, last paragraph:
 1326                          * if we record ICMPv6 too big message with
 1327                          * mtu < IPV6_MMTU, transmit packets sized IPV6_MMTU
 1328                          * or smaller, with framgent header attached.
 1329                          * (fragment header is needed regardless from the
 1330                          * packet size, for translators to identify packets)
 1331                          */
 1332                         alwaysfrag = 1;
 1333                         mtu = IPV6_MMTU;
 1334                 } else if (mtu > ifmtu) {
 1335                         /*
 1336                          * The MTU on the route is larger than the MTU on
 1337                          * the interface!  This shouldn't happen, unless the
 1338                          * MTU of the interface has been changed after the
 1339                          * interface was brought up.  Change the MTU in the
 1340                          * route to match the interface MTU (as long as the
 1341                          * field isn't locked).
 1342                          */
 1343                         mtu = ifmtu;
 1344                         ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu;
 1345                 }
 1346         } else if (ifp) {
 1347                 mtu = IN6_LINKMTU(ifp);
 1348         } else
 1349                 error = EHOSTUNREACH; /* XXX */
 1350 
 1351         *mtup = mtu;
 1352         if (alwaysfragp)
 1353                 *alwaysfragp = alwaysfrag;
 1354         return (error);
 1355 }
 1356 
 1357 /*
 1358  * IP6 socket option processing.
 1359  */
 1360 void
 1361 ip6_ctloutput_dispatch(netmsg_t msg)
 1362 {
 1363         int error;
 1364 
 1365         error = ip6_ctloutput(msg->ctloutput.base.nm_so,
 1366                               msg->ctloutput.nm_sopt);
 1367         lwkt_replymsg(&msg->ctloutput.base.lmsg, error);
 1368 }
 1369 
 1370 int
 1371 ip6_ctloutput(struct socket *so, struct sockopt *sopt)
 1372 {
 1373         int optdatalen,uproto;
 1374         int privileged;
 1375         struct inpcb *in6p = so->so_pcb;
 1376         void *optdata;
 1377         int error, optval;
 1378         int level, op, optname;
 1379         int optlen;
 1380         struct thread *td;
 1381 
 1382         if (sopt) {
 1383                 level = sopt->sopt_level;
 1384                 op = sopt->sopt_dir;
 1385                 optname = sopt->sopt_name;
 1386                 optlen = sopt->sopt_valsize;
 1387                 td = sopt->sopt_td;
 1388         } else {
 1389                 panic("ip6_ctloutput: arg soopt is NULL");
 1390                 /* NOT REACHED */
 1391                 td = NULL;
 1392         }
 1393         error = optval = 0;
 1394 
 1395         uproto = (int)so->so_proto->pr_protocol;
 1396         privileged = (td == NULL || priv_check(td, PRIV_ROOT)) ? 0 : 1;
 1397 
 1398         if (level == IPPROTO_IPV6) {
 1399                 switch (op) {
 1400 
 1401                 case SOPT_SET:
 1402                         switch (optname) {
 1403                         case IPV6_2292PKTOPTIONS:
 1404 #ifdef IPV6_PKTOPTIONS
 1405                         case IPV6_PKTOPTIONS:
 1406 #endif
 1407                         {
 1408                                 struct mbuf *m;
 1409 
 1410                                 error = soopt_getm(sopt, &m); /* XXX */
 1411                                 if (error != 0)
 1412                                         break;
 1413                                 soopt_to_mbuf(sopt, m); /* XXX */
 1414                                 error = ip6_pcbopts(&in6p->in6p_outputopts,
 1415                                                     m, so, sopt);
 1416                                 m_freem(m); /* XXX */
 1417                                 break;
 1418                         }
 1419 
 1420                         /*
 1421                          * Use of some Hop-by-Hop options or some
 1422                          * Destination options, might require special
 1423                          * privilege.  That is, normal applications
 1424                          * (without special privilege) might be forbidden
 1425                          * from setting certain options in outgoing packets,
 1426                          * and might never see certain options in received
 1427                          * packets. [RFC 2292 Section 6]
 1428                          * KAME specific note:
 1429                          *  KAME prevents non-privileged users from sending or
 1430                          *  receiving ANY hbh/dst options in order to avoid
 1431                          *  overhead of parsing options in the kernel.
 1432                          */
 1433                         case IPV6_RECVHOPOPTS:
 1434                         case IPV6_RECVDSTOPTS:
 1435                         case IPV6_RECVRTHDRDSTOPTS:
 1436                                 if (!privileged)
 1437                                         return (EPERM);
 1438                         case IPV6_RECVPKTINFO:
 1439                         case IPV6_RECVHOPLIMIT:
 1440                         case IPV6_RECVRTHDR:
 1441                         case IPV6_RECVPATHMTU:
 1442                         case IPV6_RECVTCLASS:
 1443                         case IPV6_AUTOFLOWLABEL:
 1444                         case IPV6_HOPLIMIT:
 1445                         /* FALLTHROUGH */
 1446                         case IPV6_UNICAST_HOPS:
 1447                         case IPV6_FAITH:
 1448 
 1449                         case IPV6_V6ONLY:
 1450                                 if (optlen != sizeof(int)) {
 1451                                         error = EINVAL;
 1452                                         break;
 1453                                 }
 1454                                 error = soopt_to_kbuf(sopt, &optval,
 1455                                         sizeof optval, sizeof optval);
 1456                                 if (error)
 1457                                         break;
 1458                                 switch (optname) {
 1459 
 1460                                 case IPV6_UNICAST_HOPS:
 1461                                         if (optval < -1 || optval >= 256)
 1462                                                 error = EINVAL;
 1463                                         else {
 1464                                                 /* -1 = kernel default */
 1465                                                 in6p->in6p_hops = optval;
 1466 
 1467                                                 if ((in6p->in6p_vflag &
 1468                                                      INP_IPV4) != 0)
 1469                                                         in6p->inp_ip_ttl = optval;
 1470                                         }
 1471                                         break;
 1472 #define OPTSET(bit) \
 1473 do { \
 1474         if (optval) \
 1475                 in6p->in6p_flags |= (bit); \
 1476         else \
 1477                 in6p->in6p_flags &= ~(bit); \
 1478 } while (0)
 1479 #define OPTBIT(bit) (in6p->in6p_flags & (bit) ? 1 : 0)
 1480 /* 
 1481  * Although changed to RFC3542, It's better to also support RFC2292 API 
 1482  */
 1483 #define OPTSET2292(bit) \
 1484 do { \
 1485         in6p->in6p_flags |= IN6P_RFC2292; \
 1486         if (optval) \
 1487                 in6p->in6p_flags |= (bit); \
 1488         else \
 1489                 in6p->in6p_flags &= ~(bit); \
 1490 } while (/*CONSTCOND*/ 0)
 1491 
 1492                                 case IPV6_RECVPKTINFO:
 1493                                         /* cannot mix with RFC2292 */
 1494                                         if (OPTBIT(IN6P_RFC2292)) {
 1495                                                 error = EINVAL;
 1496                                                 break;
 1497                                         }
 1498                                         OPTSET(IN6P_PKTINFO);
 1499                                         break;
 1500 
 1501                                 case IPV6_HOPLIMIT:
 1502                                 {
 1503                                         struct ip6_pktopts **optp;
 1504 
 1505                                         /* cannot mix with RFC2292 */
 1506                                         if (OPTBIT(IN6P_RFC2292)) {
 1507                                                 error = EINVAL;
 1508                                                 break;
 1509                                         }
 1510                                         optp = &in6p->in6p_outputopts;
 1511                                         error = ip6_pcbopt(IPV6_HOPLIMIT,
 1512                                             (u_char *)&optval, sizeof(optval),
 1513                                             optp, uproto);
 1514                                         break;
 1515                                 }
 1516 
 1517                                 case IPV6_RECVHOPLIMIT:
 1518                                         /* cannot mix with RFC2292 */
 1519                                         if (OPTBIT(IN6P_RFC2292)) {
 1520                                                 error = EINVAL;
 1521                                                 break;
 1522                                         }
 1523                                         OPTSET(IN6P_HOPLIMIT);
 1524                                         break;
 1525 
 1526                                 case IPV6_RECVHOPOPTS:
 1527                                         /* cannot mix with RFC2292 */
 1528                                         if (OPTBIT(IN6P_RFC2292)) {
 1529                                                 error = EINVAL;
 1530                                                 break;
 1531                                         }
 1532                                         OPTSET(IN6P_HOPOPTS);
 1533                                         break;
 1534 
 1535                                 case IPV6_RECVDSTOPTS:
 1536                                         /* cannot mix with RFC2292 */
 1537                                         if (OPTBIT(IN6P_RFC2292)) {
 1538                                                 error = EINVAL;
 1539                                                 break;
 1540                                         }
 1541                                         OPTSET(IN6P_DSTOPTS);
 1542                                         break;
 1543 
 1544                                 case IPV6_RECVRTHDRDSTOPTS:
 1545                                         /* cannot mix with RFC2292 */
 1546                                         if (OPTBIT(IN6P_RFC2292)) {
 1547                                                 error = EINVAL;
 1548                                                 break;
 1549                                         }
 1550                                         OPTSET(IN6P_RTHDRDSTOPTS);
 1551                                         break;
 1552 
 1553                                 case IPV6_RECVRTHDR:
 1554                                         /* cannot mix with RFC2292 */
 1555                                         if (OPTBIT(IN6P_RFC2292)) {
 1556                                                 error = EINVAL;
 1557                                                 break;
 1558                                         }
 1559                                         OPTSET(IN6P_RTHDR);
 1560                                         break;
 1561 
 1562                                 case IPV6_RECVPATHMTU:
 1563                                         /*
 1564                                          * We ignore this option for TCP
 1565                                          * sockets.
 1566                                          * (RFC3542 leaves this case
 1567                                          * unspecified.)
 1568                                          */
 1569                                         if (uproto != IPPROTO_TCP)
 1570                                                 OPTSET(IN6P_MTU);
 1571                                         break;
 1572 
 1573                                 case IPV6_RECVTCLASS:
 1574                                         /* cannot mix with RFC2292 XXX */
 1575                                         if (OPTBIT(IN6P_RFC2292)) {
 1576                                                 error = EINVAL;
 1577                                                 break;
 1578                                         }
 1579                                         OPTSET(IN6P_TCLASS);
 1580                                         break;
 1581 
 1582                                 case IPV6_AUTOFLOWLABEL:
 1583                                         OPTSET(IN6P_AUTOFLOWLABEL);
 1584                                         break;
 1585 
 1586                                 case IPV6_FAITH:
 1587                                         OPTSET(IN6P_FAITH);
 1588                                         break;
 1589 
 1590                                 case IPV6_V6ONLY:
 1591                                         /*
 1592                                          * make setsockopt(IPV6_V6ONLY)
 1593                                          * available only prior to bind(2).
 1594                                          */
 1595                                         if (in6p->in6p_lport ||
 1596                                             !IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr))
 1597                                         {
 1598                                                 error = EINVAL;
 1599                                                 break;
 1600                                         }
 1601                                         OPTSET(IN6P_IPV6_V6ONLY);
 1602                                         if (optval)
 1603                                                 in6p->in6p_vflag &= ~INP_IPV4;
 1604                                         else
 1605                                                 in6p->in6p_vflag |= INP_IPV4;
 1606                                         break;
 1607                                 }
 1608                                 break;
 1609 
 1610                         case IPV6_TCLASS:
 1611                         case IPV6_DONTFRAG:
 1612                         case IPV6_USE_MIN_MTU:
 1613                         case IPV6_PREFER_TEMPADDR:
 1614                                 if (optlen != sizeof(optval)) {
 1615                                         error = EINVAL;
 1616                                         break;
 1617                                 }
 1618                                 error = soopt_to_kbuf(sopt, &optval,
 1619                                         sizeof optval, sizeof optval);
 1620                                 if (error)
 1621                                         break;
 1622                                 {
 1623                                         struct ip6_pktopts **optp;
 1624                                         optp = &in6p->in6p_outputopts;
 1625                                         error = ip6_pcbopt(optname,
 1626                                             (u_char *)&optval, sizeof(optval),
 1627                                             optp, uproto);
 1628                                         break;
 1629                                 }
 1630 
 1631                         case IPV6_2292PKTINFO:
 1632                         case IPV6_2292HOPLIMIT:
 1633                         case IPV6_2292HOPOPTS:
 1634                         case IPV6_2292DSTOPTS:
 1635                         case IPV6_2292RTHDR:
 1636                                 /* RFC 2292 */
 1637                                 if (optlen != sizeof(int)) {
 1638                                         error = EINVAL;
 1639                                         break;
 1640                                 }
 1641                                 error = soopt_to_kbuf(sopt, &optval,
 1642                                         sizeof optval, sizeof optval);
 1643                                 if (error)
 1644                                         break;
 1645                                 switch (optname) {
 1646                                 case IPV6_2292PKTINFO:
 1647                                         OPTSET2292(IN6P_PKTINFO);
 1648                                         break;
 1649                                 case IPV6_2292HOPLIMIT:
 1650                                         OPTSET2292(IN6P_HOPLIMIT);
 1651                                         break;
 1652                                 case IPV6_2292HOPOPTS:
 1653                                         /*
 1654                                          * Check super-user privilege.
 1655                                          * See comments for IPV6_RECVHOPOPTS.
 1656                                          */
 1657                                         if (!privileged)
 1658                                                 return (EPERM);
 1659                                         OPTSET2292(IN6P_HOPOPTS);
 1660                                         break;
 1661                                 case IPV6_2292DSTOPTS:
 1662                                         if (!privileged)
 1663                                                 return (EPERM);
 1664                                         OPTSET2292(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS); /* XXX */
 1665                                         break;
 1666                                 case IPV6_2292RTHDR:
 1667                                         OPTSET2292(IN6P_RTHDR);
 1668                                         break;
 1669                                 }
 1670                                 break;
 1671 
 1672                         case IPV6_PKTINFO:
 1673                         case IPV6_HOPOPTS:
 1674                         case IPV6_RTHDR:
 1675                         case IPV6_DSTOPTS:
 1676                         case IPV6_RTHDRDSTOPTS:
 1677                         case IPV6_NEXTHOP:
 1678                         {
 1679                                 /* 
 1680                                  * New advanced API (RFC3542) 
 1681                                  */
 1682                                 u_char *optbuf;
 1683                                 u_char optbuf_storage[MCLBYTES];
 1684                                 int optlen;
 1685                                 struct ip6_pktopts **optp;
 1686 
 1687                                 /* cannot mix with RFC2292 */
 1688                                 if (OPTBIT(IN6P_RFC2292)) {
 1689                                         error = EINVAL;
 1690                                         break;
 1691                                 }
 1692 
 1693                                 /*
 1694                                  * We only ensure valsize is not too large
 1695                                  * here.  Further validation will be done
 1696                                  * later.
 1697                                  */
 1698                                 error = soopt_to_kbuf(sopt, optbuf_storage,
 1699                                     sizeof(optbuf_storage), 0);
 1700                                 if (error)
 1701                                         break;
 1702                                 optlen = sopt->sopt_valsize;
 1703                                 optbuf = optbuf_storage;
 1704                                 optp = &in6p->in6p_outputopts;
 1705                                 error = ip6_pcbopt(optname, optbuf, optlen,
 1706                                     optp, uproto);
 1707                                 break;
 1708                         }       
 1709 #undef OPTSET
 1710 
 1711                         case IPV6_MULTICAST_IF:
 1712                         case IPV6_MULTICAST_HOPS:
 1713                         case IPV6_MULTICAST_LOOP:
 1714                         case IPV6_JOIN_GROUP:
 1715                         case IPV6_LEAVE_GROUP:
 1716                             {
 1717                                 struct mbuf *m;
 1718                                 if (sopt->sopt_valsize > MLEN) {
 1719                                         error = EMSGSIZE;
 1720                                         break;
 1721                                 }
 1722                                 /* XXX */
 1723                                 MGET(m, sopt->sopt_td ? MB_WAIT : MB_DONTWAIT, MT_HEADER);
 1724                                 if (m == NULL) {
 1725                                         error = ENOBUFS;
 1726                                         break;
 1727                                 }
 1728                                 m->m_len = sopt->sopt_valsize;
 1729                                 error = soopt_to_kbuf(sopt, mtod(m, char *),
 1730                                                     m->m_len, m->m_len);
 1731                                 error = ip6_setmoptions(sopt->sopt_name,
 1732                                                         &in6p->in6p_moptions,
 1733                                                         m);
 1734                                 m_free(m);
 1735                             }
 1736                                 break;
 1737 
 1738                         case IPV6_PORTRANGE:
 1739                                 error = soopt_to_kbuf(sopt, &optval,
 1740                                     sizeof optval, sizeof optval);
 1741                                 if (error)
 1742                                         break;
 1743 
 1744                                 switch (optval) {
 1745                                 case IPV6_PORTRANGE_DEFAULT:
 1746                                         in6p->in6p_flags &= ~(IN6P_LOWPORT);
 1747                                         in6p->in6p_flags &= ~(IN6P_HIGHPORT);
 1748                                         break;
 1749 
 1750                                 case IPV6_PORTRANGE_HIGH:
 1751                                         in6p->in6p_flags &= ~(IN6P_LOWPORT);
 1752                                         in6p->in6p_flags |= IN6P_HIGHPORT;
 1753                                         break;
 1754 
 1755                                 case IPV6_PORTRANGE_LOW:
 1756                                         in6p->in6p_flags &= ~(IN6P_HIGHPORT);
 1757                                         in6p->in6p_flags |= IN6P_LOWPORT;
 1758                                         break;
 1759 
 1760                                 default:
 1761                                         error = EINVAL;
 1762                                         break;
 1763                                 }
 1764                                 break;
 1765 
 1766 #if defined(IPSEC) || defined(FAST_IPSEC)
 1767                         case IPV6_IPSEC_POLICY:
 1768                             {
 1769                                 caddr_t req = NULL;
 1770                                 size_t len = 0;
 1771                                 struct mbuf *m;
 1772 
 1773                                 if ((error = soopt_getm(sopt, &m)) != 0) /* XXX */
 1774                                         break;
 1775                                 soopt_to_mbuf(sopt, m);         /* XXX */
 1776                                 if (m) {
 1777                                         req = mtod(m, caddr_t);
 1778                                         len = m->m_len;
 1779                                 }
 1780                                 error = ipsec6_set_policy(in6p, optname, req,
 1781                                                           len, privileged);
 1782                                 m_freem(m);
 1783                             }
 1784                                 break;
 1785 #endif /* KAME IPSEC */
 1786 
 1787                         case IPV6_FW_ADD:
 1788                         case IPV6_FW_DEL:
 1789                         case IPV6_FW_FLUSH:
 1790                         case IPV6_FW_ZERO:
 1791                             {
 1792                                 struct mbuf *m;
 1793                                 struct mbuf **mp = &m;
 1794 
 1795                                 if (ip6_fw_ctl_ptr == NULL)
 1796                                         return EINVAL;
 1797                                 /* XXX */
 1798                                 if ((error = soopt_getm(sopt, &m)) != 0)
 1799                                         break;
 1800                                 /* XXX */
 1801                                 soopt_to_mbuf(sopt, m);
 1802                                 error = (*ip6_fw_ctl_ptr)(optname, mp);
 1803                                 m = *mp;
 1804                             }
 1805                                 break;
 1806 
 1807                         default:
 1808                                 error = ENOPROTOOPT;
 1809                                 break;
 1810                         }
 1811                         break;
 1812 
 1813                 case SOPT_GET:
 1814                         switch (optname) {
 1815                         case IPV6_2292PKTOPTIONS:
 1816 #ifdef IPV6_PKTOPTIONS
 1817                         case IPV6_PKTOPTIONS:
 1818 #endif
 1819                                 /*
 1820                                  * RFC3542 (effectively) deprecated the
 1821                                  * semantics of the 2292-style pktoptions.
 1822                                  * Since it was not reliable in nature (i.e.,
 1823                                  * applications had to expect the lack of some
 1824                                  * information after all), it would make sense
 1825                                  * to simplify this part by always returning
 1826                                  * empty data.
 1827                                  */
 1828                                 if (in6p->in6p_options) {
 1829                                         struct mbuf *m;
 1830                                         m = m_copym(in6p->in6p_options,
 1831                                             0, M_COPYALL, MB_WAIT);
 1832                                         error = soopt_from_mbuf(sopt, m);
 1833                                         if (error == 0)
 1834                                                 m_freem(m);
 1835                                 } else
 1836                                         sopt->sopt_valsize = 0;
 1837                                 break;
 1838                 
 1839                         case IPV6_RECVHOPOPTS:
 1840                         case IPV6_RECVDSTOPTS:
 1841                         case IPV6_RECVRTHDRDSTOPTS:
 1842                         case IPV6_UNICAST_HOPS:
 1843                         case IPV6_RECVPKTINFO:
 1844                         case IPV6_RECVHOPLIMIT:
 1845                         case IPV6_RECVRTHDR:
 1846                         case IPV6_RECVPATHMTU:
 1847                         case IPV6_RECVTCLASS:
 1848                         case IPV6_AUTOFLOWLABEL:
 1849                         case IPV6_FAITH:
 1850                         case IPV6_V6ONLY:
 1851                         case IPV6_PORTRANGE:
 1852                                 switch (optname) {
 1853 
 1854                                 case IPV6_RECVHOPOPTS:
 1855                                         optval = OPTBIT(IN6P_HOPOPTS);
 1856                                         break;
 1857 
 1858                                 case IPV6_RECVDSTOPTS:
 1859                                         optval = OPTBIT(IN6P_DSTOPTS);
 1860                                         break;
 1861 
 1862                                 case IPV6_RECVRTHDRDSTOPTS:
 1863                                         optval = OPTBIT(IN6P_RTHDRDSTOPTS);
 1864                                         break;
 1865 
 1866                                 case IPV6_RECVPKTINFO:
 1867                                         optval = OPTBIT(IN6P_PKTINFO);
 1868                                         break;
 1869 
 1870                                 case IPV6_RECVHOPLIMIT:
 1871                                         optval = OPTBIT(IN6P_HOPLIMIT);
 1872                                         break;
 1873 
 1874                                 case IPV6_RECVRTHDR:
 1875                                         optval = OPTBIT(IN6P_RTHDR);
 1876                                         break;
 1877 
 1878                                 case IPV6_RECVPATHMTU:
 1879                                         optval = OPTBIT(IN6P_MTU);
 1880                                         break;
 1881 
 1882                                 case IPV6_RECVTCLASS:
 1883                                         optval = OPTBIT(IN6P_TCLASS);
 1884                                         break;
 1885 
 1886                                 case IPV6_AUTOFLOWLABEL:
 1887                                         optval = OPTBIT(IN6P_AUTOFLOWLABEL);
 1888                                         break;
 1889 
 1890 
 1891                                 case IPV6_UNICAST_HOPS:
 1892                                         optval = in6p->in6p_hops;
 1893                                         break;
 1894 
 1895                                 case IPV6_FAITH:
 1896                                         optval = OPTBIT(IN6P_FAITH);
 1897                                         break;
 1898 
 1899                                 case IPV6_V6ONLY:
 1900                                         optval = OPTBIT(IN6P_IPV6_V6ONLY);
 1901                                         break;
 1902 
 1903                                 case IPV6_PORTRANGE:
 1904                                     {
 1905                                         int flags;
 1906                                         flags = in6p->in6p_flags;
 1907                                         if (flags & IN6P_HIGHPORT)
 1908                                                 optval = IPV6_PORTRANGE_HIGH;
 1909                                         else if (flags & IN6P_LOWPORT)
 1910                                                 optval = IPV6_PORTRANGE_LOW;
 1911                                         else
 1912                                                 optval = 0;
 1913                                         break;
 1914                                     }
 1915                                 }
 1916                                 soopt_from_kbuf(sopt, &optval,
 1917                                         sizeof optval);
 1918                                 break;
 1919 
 1920                         case IPV6_PATHMTU:
 1921                         {
 1922                                 u_long pmtu = 0;
 1923                                 struct ip6_mtuinfo mtuinfo;
 1924                                 struct route_in6 sro;
 1925 
 1926                                 bzero(&sro, sizeof(sro));
 1927 
 1928                                 if (!(so->so_state & SS_ISCONNECTED))
 1929                                         return (ENOTCONN);
 1930                                 /*
 1931                                  * XXX: we dot not consider the case of source
 1932                                  * routing, or optional information to specify
 1933                                  * the outgoing interface.
 1934                                  */
 1935                                 error = ip6_getpmtu(&sro, NULL, NULL,
 1936                                     &in6p->in6p_faddr, &pmtu, NULL);
 1937                                 if (sro.ro_rt)
 1938                                         RTFREE(sro.ro_rt);
 1939                                 if (error)
 1940                                         break;
 1941                                 if (pmtu > IPV6_MAXPACKET)
 1942                                         pmtu = IPV6_MAXPACKET;
 1943 
 1944                                 bzero(&mtuinfo, sizeof(mtuinfo));
 1945                                 mtuinfo.ip6m_mtu = (u_int32_t)pmtu;
 1946                                 optdata = (void *)&mtuinfo;
 1947                                 optdatalen = sizeof(mtuinfo);
 1948                                 soopt_from_kbuf(sopt, optdata,
 1949                                     optdatalen);
 1950                                 break;
 1951                         }
 1952 
 1953                         case IPV6_2292PKTINFO:
 1954                         case IPV6_2292HOPLIMIT:
 1955                         case IPV6_2292HOPOPTS:
 1956                         case IPV6_2292RTHDR:
 1957                         case IPV6_2292DSTOPTS:
 1958                                 if (optname == IPV6_2292HOPOPTS ||
 1959                                     optname == IPV6_2292DSTOPTS ||
 1960                                     !privileged)
 1961                                         return (EPERM);
 1962                                 switch (optname) {
 1963                                 case IPV6_2292PKTINFO:
 1964                                         optval = OPTBIT(IN6P_PKTINFO);
 1965                                         break;
 1966                                 case IPV6_2292HOPLIMIT:
 1967                                         optval = OPTBIT(IN6P_HOPLIMIT);
 1968                                         break;
 1969                                 case IPV6_2292HOPOPTS:
 1970                                         if (!privileged)
 1971                                                 return (EPERM);
 1972                                         optval = OPTBIT(IN6P_HOPOPTS);
 1973                                         break;
 1974                                 case IPV6_2292RTHDR:
 1975                                         optval = OPTBIT(IN6P_RTHDR);
 1976                                         break;
 1977                                 case IPV6_2292DSTOPTS:
 1978                                         if (!privileged)
 1979                                                 return (EPERM);
 1980                                         optval = OPTBIT(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS);
 1981                                         break;
 1982                                 }
 1983                                 soopt_from_kbuf(sopt, &optval,
 1984                                         sizeof optval);
 1985                                 break;
 1986 
 1987                         case IPV6_PKTINFO:
 1988                         case IPV6_HOPOPTS:
 1989                         case IPV6_RTHDR:
 1990                         case IPV6_DSTOPTS:
 1991                         case IPV6_RTHDRDSTOPTS:
 1992                         case IPV6_NEXTHOP:
 1993                         case IPV6_TCLASS:
 1994                         case IPV6_DONTFRAG:
 1995                         case IPV6_USE_MIN_MTU:
 1996                         case IPV6_PREFER_TEMPADDR:
 1997                                 error = ip6_getpcbopt(in6p->in6p_outputopts,
 1998                                     optname, sopt);
 1999                                 break;
 2000 
 2001                         case IPV6_MULTICAST_IF:
 2002                         case IPV6_MULTICAST_HOPS:
 2003                         case IPV6_MULTICAST_LOOP:
 2004                         case IPV6_JOIN_GROUP:
 2005                         case IPV6_LEAVE_GROUP:
 2006                             {
 2007                                 struct mbuf *m;
 2008                                 error = ip6_getmoptions(sopt->sopt_name,
 2009                                                 in6p->in6p_moptions, &m);
 2010                                 if (error == 0)
 2011                                         soopt_from_kbuf(sopt,
 2012                                                 mtod(m, char *), m->m_len);
 2013                                 m_freem(m);
 2014                             }
 2015                                 break;
 2016 
 2017 #if defined(IPSEC) || defined(FAST_IPSEC)
 2018                         case IPV6_IPSEC_POLICY:
 2019                           {
 2020                                 caddr_t req = NULL;
 2021                                 size_t len = 0;
 2022                                 struct mbuf *m = NULL;
 2023                                 struct mbuf **mp = &m;
 2024 
 2025                                 error = soopt_getm(sopt, &m); /* XXX */
 2026                                 if (error != 0)
 2027                                         break;
 2028                                 soopt_to_mbuf(sopt, m); /* XXX */
 2029                                 if (m) {
 2030                                         req = mtod(m, caddr_t);
 2031                                         len = m->m_len;
 2032                                 }
 2033                                 error = ipsec6_get_policy(in6p, req, len, mp);
 2034                                 if (error == 0)
 2035                                         error = soopt_from_mbuf(sopt, m); /*XXX*/
 2036                                 if (error == 0 && m != NULL)
 2037                                         m_freem(m);
 2038                                 break;
 2039                           }
 2040 #endif /* KAME IPSEC */
 2041 
 2042                         case IPV6_FW_GET:
 2043                           {
 2044                                 struct mbuf *m;
 2045                                 struct mbuf **mp = &m;
 2046 
 2047                                 if (ip6_fw_ctl_ptr == NULL)
 2048                                 {
 2049                                         return EINVAL;
 2050                                 }
 2051                                 error = (*ip6_fw_ctl_ptr)(optname, mp);
 2052                                 if (error == 0)
 2053                                         error = soopt_from_mbuf(sopt, m); /* XXX */
 2054                                 if (error == 0 && m != NULL)
 2055                                         m_freem(m);
 2056                           }
 2057                                 break;
 2058 
 2059                         default:
 2060                                 error = ENOPROTOOPT;
 2061                                 break;
 2062                         }
 2063                         break;
 2064                 }
 2065         } else {
 2066                 error = EINVAL;
 2067         }
 2068         return (error);
 2069 }
 2070 
 2071 int
 2072 ip6_raw_ctloutput(struct socket *so, struct sockopt *sopt)
 2073 {
 2074         int error = 0, optval, optlen;
 2075         const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
 2076         struct in6pcb *in6p = sotoin6pcb(so);
 2077         int level, op, optname;
 2078 
 2079         if (sopt) {
 2080                 level = sopt->sopt_level;
 2081                 op = sopt->sopt_dir;
 2082                 optname = sopt->sopt_name;
 2083                 optlen = sopt->sopt_valsize;
 2084         } else
 2085                 panic("ip6_raw_ctloutput: arg soopt is NULL");
 2086 
 2087         if (level != IPPROTO_IPV6) {
 2088                 return (EINVAL);
 2089         }
 2090 
 2091         switch (optname) {
 2092         case IPV6_CHECKSUM:
 2093                 /*
 2094                  * For ICMPv6 sockets, no modification allowed for checksum
 2095                  * offset, permit "no change" values to help existing apps.
 2096                  *
 2097                  * RFC3542 says: "An attempt to set IPV6_CHECKSUM
 2098                  * for an ICMPv6 socket will fail."
 2099                  * The current behavior does not meet RFC3542.
 2100                  */
 2101                 switch (op) {
 2102                 case SOPT_SET:
 2103                         if (optlen != sizeof(int)) {
 2104                                 error = EINVAL;
 2105                                 break;
 2106                         }
 2107                         error = soopt_to_kbuf(sopt, &optval,
 2108                                     sizeof optval, sizeof optval);
 2109                         if (error)
 2110                                 break;
 2111                         if ((optval % 2) != 0) {
 2112                                 /* the API assumes even offset values */
 2113                                 error = EINVAL;
 2114                         } else if (so->so_proto->pr_protocol ==
 2115                             IPPROTO_ICMPV6) {
 2116                                 if (optval != icmp6off)
 2117                                         error = EINVAL;
 2118                         } else
 2119                                 in6p->in6p_cksum = optval;
 2120                         break;
 2121 
 2122                 case SOPT_GET:
 2123                         if (so->so_proto->pr_protocol == IPPROTO_ICMPV6)
 2124                                 optval = icmp6off;
 2125                         else
 2126                                 optval = in6p->in6p_cksum;
 2127 
 2128                         soopt_from_kbuf(sopt, &optval, sizeof(optval));
 2129                         break;
 2130 
 2131                 default:
 2132                         error = EINVAL;
 2133                         break;
 2134                 }
 2135                 break;
 2136 
 2137         default:
 2138                 error = ENOPROTOOPT;
 2139                 break;
 2140         }
 2141 
 2142         return (error);
 2143 }
 2144 
 2145 /*
 2146  * Set up IP6 options in pcb for insertion in output packets or
 2147  * specifying behavior of outgoing packets.
 2148  */
 2149 static int
 2150 ip6_pcbopts(struct ip6_pktopts **pktopt, struct mbuf *m,
 2151     struct socket *so, struct sockopt *sopt)
 2152 {
 2153         int priv = 0;
 2154         struct ip6_pktopts *opt = *pktopt;
 2155         int error = 0;
 2156 
 2157         /* turn off any old options. */
 2158         if (opt) {
 2159 #ifdef DIAGNOSTIC
 2160                 if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
 2161                     opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
 2162                     opt->ip6po_rhinfo.ip6po_rhi_rthdr)
 2163                         kprintf("ip6_pcbopts: all specified options are cleared.\n");
 2164 #endif
 2165                 ip6_clearpktopts(opt, -1);
 2166         } else
 2167                 opt = kmalloc(sizeof(*opt), M_IP6OPT, M_WAITOK);
 2168         *pktopt = NULL;
 2169 
 2170         if (!m || m->m_len == 0) {
 2171                 /*
 2172                  * Only turning off any previous options, regardless of
 2173                  * whether the opt is just created or given.
 2174                  */
 2175                 kfree(opt, M_IP6OPT);
 2176                 return (0);
 2177         }
 2178 
 2179         /*  set options specified by user. */
 2180         if ((error = ip6_setpktoptions(m, opt, NULL, so->so_proto->pr_protocol, priv)) != 0) {
 2181                 ip6_clearpktopts(opt, -1); /* XXX: discard all options */
 2182                 kfree(opt, M_IP6OPT);
 2183                 return (error);
 2184         }
 2185         *pktopt = opt;
 2186         return (0);
 2187 }
 2188 
 2189 
 2190 /*
 2191  * Below three functions are introduced by merge to RFC3542
 2192  */
 2193 
 2194 static int
 2195 ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct sockopt *sopt)
 2196 {
 2197         void *optdata = NULL;
 2198         int optdatalen = 0;
 2199         struct ip6_ext *ip6e;
 2200         int error = 0;
 2201         struct in6_pktinfo null_pktinfo;
 2202         int deftclass = 0, on;
 2203         int defminmtu = IP6PO_MINMTU_MCASTONLY;
 2204         int defpreftemp = IP6PO_TEMPADDR_SYSTEM;
 2205 
 2206         switch (optname) {
 2207         case IPV6_PKTINFO:
 2208                 if (pktopt && pktopt->ip6po_pktinfo)
 2209                         optdata = (void *)pktopt->ip6po_pktinfo;
 2210                 else {
 2211                         /* XXX: we don't have to do this every time... */
 2212                         bzero(&null_pktinfo, sizeof(null_pktinfo));
 2213                         optdata = (void *)&null_pktinfo;
 2214                 }
 2215                 optdatalen = sizeof(struct in6_pktinfo);
 2216                 break;
 2217         case IPV6_TCLASS:
 2218                 if (pktopt && pktopt->ip6po_tclass >= 0)
 2219                         optdata = (void *)&pktopt->ip6po_tclass;
 2220                 else
 2221                         optdata = (void *)&deftclass;
 2222                 optdatalen = sizeof(int);
 2223                 break;
 2224         case IPV6_HOPOPTS:
 2225                 if (pktopt && pktopt->ip6po_hbh) {
 2226                         optdata = (void *)pktopt->ip6po_hbh;
 2227                         ip6e = (struct ip6_ext *)pktopt->ip6po_hbh;
 2228                         optdatalen = (ip6e->ip6e_len + 1) << 3;
 2229                 }
 2230                 break;
 2231         case IPV6_RTHDR:
 2232                 if (pktopt && pktopt->ip6po_rthdr) {
 2233                         optdata = (void *)pktopt->ip6po_rthdr;
 2234                         ip6e = (struct ip6_ext *)pktopt->ip6po_rthdr;
 2235                         optdatalen = (ip6e->ip6e_len + 1) << 3;
 2236                 }
 2237                 break;
 2238         case IPV6_RTHDRDSTOPTS:
 2239                 if (pktopt && pktopt->ip6po_dest1) {
 2240                         optdata = (void *)pktopt->ip6po_dest1;
 2241                         ip6e = (struct ip6_ext *)pktopt->ip6po_dest1;
 2242                         optdatalen = (ip6e->ip6e_len + 1) << 3;
 2243                 }
 2244                 break;
 2245         case IPV6_DSTOPTS:
 2246                 if (pktopt && pktopt->ip6po_dest2) {
 2247                         optdata = (void *)pktopt->ip6po_dest2;
 2248                         ip6e = (struct ip6_ext *)pktopt->ip6po_dest2;
 2249                         optdatalen = (ip6e->ip6e_len + 1) << 3;
 2250                 }
 2251                 break;
 2252         case IPV6_NEXTHOP:
 2253                 if (pktopt && pktopt->ip6po_nexthop) {
 2254                         optdata = (void *)pktopt->ip6po_nexthop;
 2255                         optdatalen = pktopt->ip6po_nexthop->sa_len;
 2256                 }
 2257                 break;
 2258         case IPV6_USE_MIN_MTU:
 2259                 if (pktopt)
 2260                         optdata = (void *)&pktopt->ip6po_minmtu;
 2261                 else
 2262                         optdata = (void *)&defminmtu;
 2263                 optdatalen = sizeof(int);
 2264                 break;
 2265         case IPV6_DONTFRAG:
 2266                 if (pktopt && ((pktopt->ip6po_flags) & IP6PO_DONTFRAG))
 2267                         on = 1;
 2268                 else
 2269                         on = 0;
 2270                 optdata = (void *)&on;
 2271                 optdatalen = sizeof(on);
 2272                 break;
 2273         case IPV6_PREFER_TEMPADDR:
 2274                 if (pktopt)
 2275                         optdata = (void *)&pktopt->ip6po_prefer_tempaddr;
 2276                 else
 2277                         optdata = (void *)&defpreftemp;
 2278                 optdatalen = sizeof(int);
 2279                 break;
 2280         default:                /* should not happen */
 2281 #ifdef DIAGNOSTIC
 2282                 panic("ip6_getpcbopt: unexpected option");
 2283 #endif
 2284                 return (ENOPROTOOPT);
 2285         }
 2286 
 2287         soopt_from_kbuf(sopt, optdata, optdatalen);
 2288 
 2289         return (error);
 2290 }
 2291 
 2292 /*
 2293  * initialize ip6_pktopts.  beware that there are non-zero default values in
 2294  * the struct.
 2295  */
 2296 
 2297 static int
 2298 ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt, int uproto)
 2299 {
 2300         struct ip6_pktopts *opt;
 2301         int priv =0;
 2302         if (*pktopt == NULL) {
 2303                 *pktopt = kmalloc(sizeof(*opt), M_IP6OPT, M_WAITOK);
 2304                 init_ip6pktopts(*pktopt);
 2305         }
 2306         opt = *pktopt;
 2307 
 2308         return (ip6_setpktoption(optname, buf, len, opt, 1, 0, uproto, priv));
 2309 }
 2310 
 2311 /*
 2312  * initialize ip6_pktopts.  beware that there are non-zero default values in
 2313  * the struct.
 2314  */
 2315 void
 2316 init_ip6pktopts(struct ip6_pktopts *opt)
 2317 {
 2318 
 2319         bzero(opt, sizeof(*opt));
 2320         opt->ip6po_hlim = -1;   /* -1 means default hop limit */
 2321         opt->ip6po_tclass = -1; /* -1 means default traffic class */
 2322         opt->ip6po_minmtu = IP6PO_MINMTU_MCASTONLY;
 2323         opt->ip6po_prefer_tempaddr = IP6PO_TEMPADDR_SYSTEM;
 2324 }
 2325 
 2326 void
 2327 ip6_clearpktopts(struct ip6_pktopts *pktopt, int optname)
 2328 {
 2329         if (pktopt == NULL)
 2330                 return;
 2331 
 2332         if (optname == -1 || optname == IPV6_PKTINFO) {
 2333                 if (pktopt->ip6po_pktinfo)
 2334                         kfree(pktopt->ip6po_pktinfo, M_IP6OPT);
 2335                 pktopt->ip6po_pktinfo = NULL;
 2336         }
 2337         if (optname == -1 || optname == IPV6_HOPLIMIT)
 2338                 pktopt->ip6po_hlim = -1;
 2339         if (optname == -1 || optname == IPV6_TCLASS)
 2340                 pktopt->ip6po_tclass = -1;
 2341         if (optname == -1 || optname == IPV6_NEXTHOP) {
 2342                 if (pktopt->ip6po_nextroute.ro_rt) {
 2343                         RTFREE(pktopt->ip6po_nextroute.ro_rt);
 2344                         pktopt->ip6po_nextroute.ro_rt = NULL;
 2345                 }
 2346                 if (pktopt->ip6po_nexthop)
 2347                         kfree(pktopt->ip6po_nexthop, M_IP6OPT);
 2348                 pktopt->ip6po_nexthop = NULL;
 2349         }
 2350         if (optname == -1 || optname == IPV6_HOPOPTS) {
 2351                 if (pktopt->ip6po_hbh)
 2352                         kfree(pktopt->ip6po_hbh, M_IP6OPT);
 2353                 pktopt->ip6po_hbh = NULL;
 2354         }
 2355         if (optname == -1 || optname == IPV6_RTHDRDSTOPTS) {
 2356                 if (pktopt->ip6po_dest1)
 2357                         kfree(pktopt->ip6po_dest1, M_IP6OPT);
 2358                 pktopt->ip6po_dest1 = NULL;
 2359         }
 2360         if (optname == -1 || optname == IPV6_RTHDR) {
 2361                 if (pktopt->ip6po_rhinfo.ip6po_rhi_rthdr)
 2362                         kfree(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr, M_IP6OPT);
 2363                 pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
 2364                 if (pktopt->ip6po_route.ro_rt) {
 2365                         RTFREE(pktopt->ip6po_route.ro_rt);
 2366                         pktopt->ip6po_route.ro_rt = NULL;
 2367                 }
 2368         }
 2369         if (optname == -1 || optname == IPV6_DSTOPTS) {
 2370                 if (pktopt->ip6po_dest2)
 2371                         kfree(pktopt->ip6po_dest2, M_IP6OPT);
 2372                 pktopt->ip6po_dest2 = NULL;
 2373         }
 2374 }
 2375 
 2376 #define PKTOPT_EXTHDRCPY(type) \
 2377 do {\
 2378         if (src->type) {\
 2379                 int hlen =\
 2380                         (((struct ip6_ext *)src->type)->ip6e_len + 1) << 3;\
 2381                 dst->type = kmalloc(hlen, M_IP6OPT, canwait);\
 2382                 if (dst->type == NULL)\
 2383                         goto bad;\
 2384                 bcopy(src->type, dst->type, hlen);\
 2385         }\
 2386 } while (0)
 2387 
 2388 struct ip6_pktopts *
 2389 ip6_copypktopts(struct ip6_pktopts *src, int canwait)
 2390 {
 2391         struct ip6_pktopts *dst;
 2392 
 2393         if (src == NULL) {
 2394                 kprintf("ip6_clearpktopts: invalid argument\n");
 2395                 return (NULL);
 2396         }
 2397 
 2398         dst = kmalloc(sizeof(*dst), M_IP6OPT, canwait | M_ZERO);
 2399         if (dst == NULL)
 2400                 return (NULL);
 2401 
 2402         dst->ip6po_hlim = src->ip6po_hlim;
 2403         if (src->ip6po_pktinfo) {
 2404                 dst->ip6po_pktinfo = kmalloc(sizeof(*dst->ip6po_pktinfo),
 2405                                             M_IP6OPT, canwait);
 2406                 if (dst->ip6po_pktinfo == NULL)
 2407                         goto bad;
 2408                 *dst->ip6po_pktinfo = *src->ip6po_pktinfo;
 2409         }
 2410         if (src->ip6po_nexthop) {
 2411                 dst->ip6po_nexthop = kmalloc(src->ip6po_nexthop->sa_len,
 2412                                             M_IP6OPT, canwait);
 2413                 if (dst->ip6po_nexthop == NULL)
 2414                         goto bad;
 2415                 bcopy(src->ip6po_nexthop, dst->ip6po_nexthop,
 2416                       src->ip6po_nexthop->sa_len);
 2417         }
 2418         PKTOPT_EXTHDRCPY(ip6po_hbh);
 2419         PKTOPT_EXTHDRCPY(ip6po_dest1);
 2420         PKTOPT_EXTHDRCPY(ip6po_dest2);
 2421         PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
 2422         return (dst);
 2423 
 2424 bad:
 2425         if (dst->ip6po_pktinfo) kfree(dst->ip6po_pktinfo, M_IP6OPT);
 2426         if (dst->ip6po_nexthop) kfree(dst->ip6po_nexthop, M_IP6OPT);
 2427         if (dst->ip6po_hbh) kfree(dst->ip6po_hbh, M_IP6OPT);
 2428         if (dst->ip6po_dest1) kfree(dst->ip6po_dest1, M_IP6OPT);
 2429         if (dst->ip6po_dest2) kfree(dst->ip6po_dest2, M_IP6OPT);
 2430         if (dst->ip6po_rthdr) kfree(dst->ip6po_rthdr, M_IP6OPT);
 2431         kfree(dst, M_IP6OPT);
 2432         return (NULL);
 2433 }
 2434 
 2435 static int
 2436 copypktopts(struct ip6_pktopts *dst, struct ip6_pktopts *src, int canwait)
 2437 {
 2438         if (dst == NULL || src == NULL)  {
 2439 #ifdef DIAGNOSTIC
 2440                 kprintf("ip6_clearpktopts: invalid argument\n");
 2441 #endif
 2442                 return (EINVAL);
 2443         }
 2444 
 2445         dst->ip6po_hlim = src->ip6po_hlim;
 2446         dst->ip6po_tclass = src->ip6po_tclass;
 2447         dst->ip6po_flags = src->ip6po_flags;
 2448         if (src->ip6po_pktinfo) {
 2449                 dst->ip6po_pktinfo = kmalloc(sizeof(*dst->ip6po_pktinfo),
 2450                     M_IP6OPT, canwait);
 2451                 if (dst->ip6po_pktinfo == NULL)
 2452                         goto bad;
 2453                 *dst->ip6po_pktinfo = *src->ip6po_pktinfo;
 2454         }
 2455         if (src->ip6po_nexthop) {
 2456                 dst->ip6po_nexthop = kmalloc(src->ip6po_nexthop->sa_len,
 2457                     M_IP6OPT, canwait);
 2458                 if (dst->ip6po_nexthop == NULL)
 2459                         goto bad;
 2460                 bcopy(src->ip6po_nexthop, dst->ip6po_nexthop,
 2461                     src->ip6po_nexthop->sa_len);
 2462         }
 2463         PKTOPT_EXTHDRCPY(ip6po_hbh);
 2464         PKTOPT_EXTHDRCPY(ip6po_dest1);
 2465         PKTOPT_EXTHDRCPY(ip6po_dest2);
 2466         PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
 2467         return (0);
 2468 
 2469   bad:
 2470         ip6_clearpktopts(dst, -1);
 2471         return (ENOBUFS);
 2472 }
 2473 #undef PKTOPT_EXTHDRCPY
 2474 
 2475 void
 2476 ip6_freepcbopts(struct ip6_pktopts *pktopt)
 2477 {
 2478         if (pktopt == NULL)
 2479                 return;
 2480 
 2481         ip6_clearpktopts(pktopt, -1);
 2482 
 2483         kfree(pktopt, M_IP6OPT);
 2484 }
 2485 
 2486 /*
 2487  * Set the IP6 multicast options in response to user setsockopt().
 2488  */
 2489 static int
 2490 ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
 2491 {
 2492         int error = 0;
 2493         u_int loop, ifindex;
 2494         struct ipv6_mreq *mreq;
 2495         struct ifnet *ifp;
 2496         struct ip6_moptions *im6o = *im6op;
 2497         struct route_in6 ro;
 2498         struct sockaddr_in6 *dst;
 2499         struct in6_multi_mship *imm;
 2500         struct thread *td = curthread;  /* XXX */
 2501 
 2502         if (im6o == NULL) {
 2503                 /*
 2504                  * No multicast option buffer attached to the pcb;
 2505                  * allocate one and initialize to default values.
 2506                  */
 2507                 im6o = (struct ip6_moptions *)
 2508                         kmalloc(sizeof(*im6o), M_IPMOPTS, M_WAITOK);
 2509 
 2510                 *im6op = im6o;
 2511                 im6o->im6o_multicast_ifp = NULL;
 2512                 im6o->im6o_multicast_hlim = ip6_defmcasthlim;
 2513                 im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
 2514                 LIST_INIT(&im6o->im6o_memberships);
 2515         }
 2516 
 2517         switch (optname) {
 2518 
 2519         case IPV6_MULTICAST_IF:
 2520                 /*
 2521                  * Select the interface for outgoing multicast packets.
 2522                  */
 2523                 if (m == NULL || m->m_len != sizeof(u_int)) {
 2524                         error = EINVAL;
 2525                         break;
 2526                 }
 2527                 bcopy(mtod(m, u_int *), &ifindex, sizeof(ifindex));
 2528                 if (ifindex < 0 || if_index < ifindex) {
 2529                         error = ENXIO;  /* XXX EINVAL? */
 2530                         break;
 2531                 }
 2532                 ifp = ifindex2ifnet[ifindex];
 2533                 if (ifp == NULL || !(ifp->if_flags & IFF_MULTICAST)) {
 2534                         error = EADDRNOTAVAIL;
 2535                         break;
 2536                 }
 2537                 im6o->im6o_multicast_ifp = ifp;
 2538                 break;
 2539 
 2540         case IPV6_MULTICAST_HOPS:
 2541             {
 2542                 /*
 2543                  * Set the IP6 hoplimit for outgoing multicast packets.
 2544                  */
 2545                 int optval;
 2546                 if (m == NULL || m->m_len != sizeof(int)) {
 2547                         error = EINVAL;
 2548                         break;
 2549                 }
 2550                 bcopy(mtod(m, u_int *), &optval, sizeof(optval));
 2551                 if (optval < -1 || optval >= 256)
 2552                         error = EINVAL;
 2553                 else if (optval == -1)
 2554                         im6o->im6o_multicast_hlim = ip6_defmcasthlim;
 2555                 else
 2556                         im6o->im6o_multicast_hlim = optval;
 2557                 break;
 2558             }
 2559 
 2560         case IPV6_MULTICAST_LOOP:
 2561                 /*
 2562                  * Set the loopback flag for outgoing multicast packets.
 2563                  * Must be zero or one.
 2564                  */
 2565                 if (m == NULL || m->m_len != sizeof(u_int)) {
 2566                         error = EINVAL;
 2567                         break;
 2568                 }
 2569                 bcopy(mtod(m, u_int *), &loop, sizeof(loop));
 2570                 if (loop > 1) {
 2571                         error = EINVAL;
 2572                         break;
 2573                 }
 2574                 im6o->im6o_multicast_loop = loop;
 2575                 break;
 2576 
 2577         case IPV6_JOIN_GROUP:
 2578                 /*
 2579                  * Add a multicast group membership.
 2580                  * Group must be a valid IP6 multicast address.
 2581                  */
 2582                 if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
 2583                         error = EINVAL;
 2584                         break;
 2585                 }
 2586                 mreq = mtod(m, struct ipv6_mreq *);
 2587                 if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
 2588                         /*
 2589                          * We use the unspecified address to specify to accept
 2590                          * all multicast addresses. Only super user is allowed
 2591                          * to do this.
 2592                          */
 2593                         if (priv_check(td, PRIV_ROOT))
 2594                         {
 2595                                 error = EACCES;
 2596                                 break;
 2597                         }
 2598                 } else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
 2599                         error = EINVAL;
 2600                         break;
 2601                 }
 2602 
 2603                 /*
 2604                  * If the interface is specified, validate it.
 2605                  */
 2606                 if (mreq->ipv6mr_interface < 0
 2607                  || if_index < mreq->ipv6mr_interface) {
 2608                         error = ENXIO;  /* XXX EINVAL? */
 2609                         break;
 2610                 }
 2611                 /*
 2612                  * If no interface was explicitly specified, choose an
 2613                  * appropriate one according to the given multicast address.
 2614                  */
 2615                 if (mreq->ipv6mr_interface == 0) {
 2616                         /*
 2617                          * If the multicast address is in node-local scope,
 2618                          * the interface should be a loopback interface.
 2619                          * Otherwise, look up the routing table for the
 2620                          * address, and choose the outgoing interface.
 2621                          *   XXX: is it a good approach?
 2622                          */
 2623                         if (IN6_IS_ADDR_MC_NODELOCAL(&mreq->ipv6mr_multiaddr)) {
 2624                                 ifp = &loif[0];
 2625                         } else {
 2626                                 ro.ro_rt = NULL;
 2627                                 dst = (struct sockaddr_in6 *)&ro.ro_dst;
 2628                                 bzero(dst, sizeof(*dst));
 2629                                 dst->sin6_len = sizeof(struct sockaddr_in6);
 2630                                 dst->sin6_family = AF_INET6;
 2631                                 dst->sin6_addr = mreq->ipv6mr_multiaddr;
 2632                                 rtalloc((struct route *)&ro);
 2633                                 if (ro.ro_rt == NULL) {
 2634                                         error = EADDRNOTAVAIL;
 2635                                         break;
 2636                                 }
 2637                                 ifp = ro.ro_rt->rt_ifp;
 2638                                 rtfree(ro.ro_rt);
 2639                         }
 2640                 } else
 2641                         ifp = ifindex2ifnet[mreq->ipv6mr_interface];
 2642 
 2643                 /*
 2644                  * See if we found an interface, and confirm that it
 2645                  * supports multicast
 2646                  */
 2647                 if (ifp == NULL || !(ifp->if_flags & IFF_MULTICAST)) {
 2648                         error = EADDRNOTAVAIL;
 2649                         break;
 2650                 }
 2651                 /*
 2652                  * Put interface index into the multicast address,
 2653                  * if the address has link-local scope.
 2654                  */
 2655                 if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
 2656                         mreq->ipv6mr_multiaddr.s6_addr16[1]
 2657                                 = htons(mreq->ipv6mr_interface);
 2658                 }
 2659                 /*
 2660                  * See if the membership already exists.
 2661                  */
 2662                 for (imm = im6o->im6o_memberships.lh_first;
 2663                      imm != NULL; imm = imm->i6mm_chain.le_next)
 2664                         if (imm->i6mm_maddr->in6m_ifp == ifp &&
 2665                             IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
 2666                                                &mreq->ipv6mr_multiaddr))
 2667                                 break;
 2668                 if (imm != NULL) {
 2669                         error = EADDRINUSE;
 2670                         break;
 2671                 }
 2672                 /*
 2673                  * Everything looks good; add a new record to the multicast
 2674                  * address list for the given interface.
 2675                  */
 2676                 imm = kmalloc(sizeof(*imm), M_IPMADDR, M_WAITOK);
 2677                 if ((imm->i6mm_maddr =
 2678                      in6_addmulti(&mreq->ipv6mr_multiaddr, ifp, &error)) == NULL) {
 2679                         kfree(imm, M_IPMADDR);
 2680                         break;
 2681                 }
 2682                 LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
 2683                 break;
 2684 
 2685         case IPV6_LEAVE_GROUP:
 2686                 /*
 2687                  * Drop a multicast group membership.
 2688                  * Group must be a valid IP6 multicast address.
 2689                  */
 2690                 if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
 2691                         error = EINVAL;
 2692                         break;
 2693                 }
 2694                 mreq = mtod(m, struct ipv6_mreq *);
 2695                 if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
 2696                         if (priv_check(td, PRIV_ROOT)) {
 2697                                 error = EACCES;
 2698                                 break;
 2699                         }
 2700                 } else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
 2701                         error = EINVAL;
 2702                         break;
 2703                 }
 2704                 /*
 2705                  * If an interface address was specified, get a pointer
 2706                  * to its ifnet structure.
 2707                  */
 2708                 if (mreq->ipv6mr_interface < 0
 2709                  || if_index < mreq->ipv6mr_interface) {
 2710                         error = ENXIO;  /* XXX EINVAL? */
 2711                         break;
 2712                 }
 2713                 ifp = ifindex2ifnet[mreq->ipv6mr_interface];
 2714                 /*
 2715                  * Put interface index into the multicast address,
 2716                  * if the address has link-local scope.
 2717                  */
 2718                 if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
 2719                         mreq->ipv6mr_multiaddr.s6_addr16[1]
 2720                                 = htons(mreq->ipv6mr_interface);
 2721                 }
 2722                 /*
 2723                  * Find the membership in the membership list.
 2724                  */
 2725                 for (imm = im6o->im6o_memberships.lh_first;
 2726                      imm != NULL; imm = imm->i6mm_chain.le_next) {
 2727                         if ((ifp == NULL ||
 2728                              imm->i6mm_maddr->in6m_ifp == ifp) &&
 2729                             IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
 2730                                                &mreq->ipv6mr_multiaddr))
 2731                                 break;
 2732                 }
 2733                 if (imm == NULL) {
 2734                         /* Unable to resolve interface */
 2735                         error = EADDRNOTAVAIL;
 2736                         break;
 2737                 }
 2738                 /*
 2739                  * Give up the multicast address record to which the
 2740                  * membership points.
 2741                  */
 2742                 LIST_REMOVE(imm, i6mm_chain);
 2743                 in6_delmulti(imm->i6mm_maddr);
 2744                 kfree(imm, M_IPMADDR);
 2745                 break;
 2746 
 2747         default:
 2748                 error = EOPNOTSUPP;
 2749                 break;
 2750         }
 2751 
 2752         /*
 2753          * If all options have default values, no need to keep the mbuf.
 2754          */
 2755         if (im6o->im6o_multicast_ifp == NULL &&
 2756             im6o->im6o_multicast_hlim == ip6_defmcasthlim &&
 2757             im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
 2758             im6o->im6o_memberships.lh_first == NULL) {
 2759                 kfree(*im6op, M_IPMOPTS);
 2760                 *im6op = NULL;
 2761         }
 2762 
 2763         return (error);
 2764 }
 2765 
 2766 /*
 2767  * Return the IP6 multicast options in response to user getsockopt().
 2768  */
 2769 static int
 2770 ip6_getmoptions(int optname, struct ip6_moptions *im6o, struct mbuf **mp)
 2771 {
 2772         u_int *hlim, *loop, *ifindex;
 2773 
 2774         *mp = m_get(MB_WAIT, MT_HEADER);                /* XXX */
 2775 
 2776         switch (optname) {
 2777 
 2778         case IPV6_MULTICAST_IF:
 2779                 ifindex = mtod(*mp, u_int *);
 2780                 (*mp)->m_len = sizeof(u_int);
 2781                 if (im6o == NULL || im6o->im6o_multicast_ifp == NULL)
 2782                         *ifindex = 0;
 2783                 else
 2784                         *ifindex = im6o->im6o_multicast_ifp->if_index;
 2785                 return (0);
 2786 
 2787         case IPV6_MULTICAST_HOPS:
 2788                 hlim = mtod(*mp, u_int *);
 2789                 (*mp)->m_len = sizeof(u_int);
 2790                 if (im6o == NULL)
 2791                         *hlim = ip6_defmcasthlim;
 2792                 else
 2793                         *hlim = im6o->im6o_multicast_hlim;
 2794                 return (0);
 2795 
 2796         case IPV6_MULTICAST_LOOP:
 2797                 loop = mtod(*mp, u_int *);
 2798                 (*mp)->m_len = sizeof(u_int);
 2799                 if (im6o == NULL)
 2800                         *loop = ip6_defmcasthlim;
 2801                 else
 2802                         *loop = im6o->im6o_multicast_loop;
 2803                 return (0);
 2804 
 2805         default:
 2806                 return (EOPNOTSUPP);
 2807         }
 2808 }
 2809 
 2810 /*
 2811  * Discard the IP6 multicast options.
 2812  */
 2813 void
 2814 ip6_freemoptions(struct ip6_moptions *im6o)
 2815 {
 2816         struct in6_multi_mship *imm;
 2817 
 2818         if (im6o == NULL)
 2819                 return;
 2820 
 2821         while ((imm = im6o->im6o_memberships.lh_first) != NULL) {
 2822                 LIST_REMOVE(imm, i6mm_chain);
 2823                 if (imm->i6mm_maddr)
 2824                         in6_delmulti(imm->i6mm_maddr);
 2825                 kfree(imm, M_IPMADDR);
 2826         }
 2827         kfree(im6o, M_IPMOPTS);
 2828 }
 2829 
 2830 /*
 2831  * Set a particular packet option, as a sticky option or an ancillary data
 2832  * item.  "len" can be 0 only when it's a sticky option.
 2833  * We have 4 cases of combination of "sticky" and "cmsg":
 2834  * "sticky=0, cmsg=0": impossible
 2835  * "sticky=0, cmsg=1": RFC2292 or RFC3542 ancillary data
 2836  * "sticky=1, cmsg=0": RFC3542 socket option
 2837  * "sticky=1, cmsg=1": RFC2292 socket option
 2838  */
 2839 static int
 2840 ip6_setpktoption(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
 2841      int sticky, int cmsg, int uproto, int priv)
 2842 {
 2843         int minmtupolicy, preftemp;
 2844         //int error;
 2845 
 2846         if (!sticky && !cmsg) {
 2847                 kprintf("ip6_setpktoption: impossible case\n");
 2848                 return (EINVAL);
 2849         }
 2850 
 2851         /*
 2852          * IPV6_2292xxx is for backward compatibility to RFC2292, and should
 2853          * not be specified in the context of RFC3542.  Conversely,
 2854          * RFC3542 types should not be specified in the context of RFC2292.
 2855          */
 2856         if (!cmsg) {
 2857                 switch (optname) {
 2858                 case IPV6_2292PKTINFO:
 2859                 case IPV6_2292HOPLIMIT:
 2860                 case IPV6_2292NEXTHOP:
 2861                 case IPV6_2292HOPOPTS:
 2862                 case IPV6_2292DSTOPTS:
 2863                 case IPV6_2292RTHDR:
 2864                 case IPV6_2292PKTOPTIONS:
 2865                         return (ENOPROTOOPT);
 2866                 }
 2867         }
 2868         if (sticky && cmsg) {
 2869                 switch (optname) {
 2870                 case IPV6_PKTINFO:
 2871                 case IPV6_HOPLIMIT:
 2872                 case IPV6_NEXTHOP:
 2873                 case IPV6_HOPOPTS:
 2874                 case IPV6_DSTOPTS:
 2875                 case IPV6_RTHDRDSTOPTS:
 2876                 case IPV6_RTHDR:
 2877                 case IPV6_USE_MIN_MTU:
 2878                 case IPV6_DONTFRAG:
 2879                 case IPV6_TCLASS:
 2880                 case IPV6_PREFER_TEMPADDR: /* XXX: not an RFC3542 option */
 2881                         return (ENOPROTOOPT);
 2882                 }
 2883         }
 2884 
 2885         switch (optname) {
 2886         case IPV6_2292PKTINFO:
 2887         case IPV6_PKTINFO:
 2888         {
 2889                 struct in6_pktinfo *pktinfo;
 2890                 if (len != sizeof(struct in6_pktinfo))
 2891                         return (EINVAL);
 2892                 pktinfo = (struct in6_pktinfo *)buf;
 2893 
 2894                 /*
 2895                  * An application can clear any sticky IPV6_PKTINFO option by
 2896                  * doing a "regular" setsockopt with ipi6_addr being
 2897                  * in6addr_any and ipi6_ifindex being zero.
 2898                  * [RFC 3542, Section 6]
 2899                  */
 2900                 if (optname == IPV6_PKTINFO && opt->ip6po_pktinfo &&
 2901                     pktinfo->ipi6_ifindex == 0 &&
 2902                     IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
 2903                         ip6_clearpktopts(opt, optname);
 2904                         break;
 2905                 }
 2906 
 2907                 if (uproto == IPPROTO_TCP && optname == IPV6_PKTINFO &&
 2908                     sticky && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
 2909                         return (EINVAL);
 2910                 }
 2911 
 2912                 /* validate the interface index if specified. */
 2913                 if (pktinfo->ipi6_ifindex > if_index ||
 2914                     pktinfo->ipi6_ifindex < 0) {
 2915                          return (ENXIO);
 2916                 }
 2917                 /*
 2918                  * Check if the requested source address is indeed a
 2919                  * unicast address assigned to the node, and can be
 2920                  * used as the packet's source address.
 2921                  */
 2922                 if (opt->ip6po_pktinfo != NULL &&
 2923                     !IN6_IS_ADDR_UNSPECIFIED(&opt->ip6po_pktinfo->ipi6_addr)) {
 2924                         struct in6_ifaddr *ia6;
 2925                         struct sockaddr_in6 sin6;
 2926 
 2927                         bzero(&sin6, sizeof(sin6));
 2928                         sin6.sin6_len = sizeof(sin6);
 2929                         sin6.sin6_family = AF_INET6;
 2930                         sin6.sin6_addr =
 2931                         opt->ip6po_pktinfo->ipi6_addr;
 2932                         ia6 = (struct in6_ifaddr *)ifa_ifwithaddr(sin6tosa(&sin6));
 2933                         if (ia6 == NULL ||
 2934                                 (ia6->ia6_flags & (IN6_IFF_ANYCAST |
 2935                                         IN6_IFF_NOTREADY)) != 0)
 2936                         return (EADDRNOTAVAIL);
 2937                 }
 2938 
 2939                 /*
 2940                  * We store the address anyway, and let in6_selectsrc()
 2941                  * validate the specified address.  This is because ipi6_addr
 2942                  * may not have enough information about its scope zone, and
 2943                  * we may need additional information (such as outgoing
 2944                  * interface or the scope zone of a destination address) to
 2945                  * disambiguate the scope.
 2946                  * XXX: the delay of the validation may confuse the
 2947                  * application when it is used as a sticky option.
 2948                  */
 2949                 if (opt->ip6po_pktinfo == NULL) {
 2950                         opt->ip6po_pktinfo = kmalloc(sizeof(*pktinfo),
 2951                             M_IP6OPT, M_NOWAIT);
 2952                         if (opt->ip6po_pktinfo == NULL)
 2953                                 return (ENOBUFS);
 2954                 }
 2955                 bcopy(pktinfo, opt->ip6po_pktinfo, sizeof(*pktinfo));
 2956                 break;
 2957         }
 2958 
 2959         case IPV6_2292HOPLIMIT:
 2960         case IPV6_HOPLIMIT:
 2961         {
 2962                 int *hlimp;
 2963 
 2964                 /*
 2965                  * RFC 3542 deprecated the usage of sticky IPV6_HOPLIMIT
 2966                  * to simplify the ordering among hoplimit options.
 2967                  */
 2968                 if (optname == IPV6_HOPLIMIT && sticky)
 2969                         return (ENOPROTOOPT);
 2970 
 2971                 if (len != sizeof(int))
 2972                         return (EINVAL);
 2973                 hlimp = (int *)buf;
 2974                 if (*hlimp < -1 || *hlimp > 255)
 2975                         return (EINVAL);
 2976 
 2977                 opt->ip6po_hlim = *hlimp;
 2978                 break;
 2979         }
 2980 
 2981         case IPV6_TCLASS:
 2982         {
 2983                 int tclass;
 2984 
 2985                 if (len != sizeof(int))
 2986                         return (EINVAL);
 2987                 tclass = *(int *)buf;
 2988                 if (tclass < -1 || tclass > 255)
 2989                         return (EINVAL);
 2990 
 2991                 opt->ip6po_tclass = tclass;
 2992                 break;
 2993         }
 2994 
 2995         case IPV6_2292NEXTHOP:
 2996         case IPV6_NEXTHOP:
 2997                 if (!priv)
 2998                         return (EPERM);
 2999 
 3000                 if (len == 0) { /* just remove the option */
 3001                         ip6_clearpktopts(opt, IPV6_NEXTHOP);
 3002                         break;
 3003                 }
 3004 
 3005                 /* check if cmsg_len is large enough for sa_len */
 3006                 if (len < sizeof(struct sockaddr) || len < *buf)
 3007                         return (EINVAL);
 3008 
 3009                 switch (((struct sockaddr *)buf)->sa_family) {
 3010                 case AF_INET6:
 3011                 {
 3012                         struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)buf;
 3013                         //int error;
 3014 
 3015                         if (sa6->sin6_len != sizeof(struct sockaddr_in6))
 3016                                 return (EINVAL);
 3017 
 3018                         if (IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
 3019                             IN6_IS_ADDR_MULTICAST(&sa6->sin6_addr)) {
 3020                                 return (EINVAL);
 3021                         }
 3022                         break;
 3023                 }
 3024                 case AF_LINK:   /* should eventually be supported */
 3025                 default:
 3026                         return (EAFNOSUPPORT);
 3027                 }
 3028 
 3029                 /* turn off the previous option, then set the new option. */
 3030                 ip6_clearpktopts(opt, IPV6_NEXTHOP);
 3031                 opt->ip6po_nexthop = kmalloc(*buf, M_IP6OPT, M_NOWAIT);
 3032                 if (opt->ip6po_nexthop == NULL)
 3033                         return (ENOBUFS);
 3034                 bcopy(buf, opt->ip6po_nexthop, *buf);
 3035                 break;
 3036 
 3037         case IPV6_2292HOPOPTS:
 3038         case IPV6_HOPOPTS:
 3039         {
 3040                 struct ip6_hbh *hbh;
 3041                 int hbhlen;
 3042 
 3043                 /*
 3044                  * XXX: We don't allow a non-privileged user to set ANY HbH
 3045                  * options, since per-option restriction has too much
 3046                  * overhead.
 3047                  */
 3048                 if (!priv)
 3049                         return (EPERM);
 3050                 if (len == 0) {
 3051                         ip6_clearpktopts(opt, IPV6_HOPOPTS);
 3052                         break;  /* just remove the option */
 3053                 }
 3054 
 3055                 /* message length validation */
 3056                 if (len < sizeof(struct ip6_hbh))
 3057                         return (EINVAL);
 3058                 hbh = (struct ip6_hbh *)buf;
 3059                 hbhlen = (hbh->ip6h_len + 1) << 3;
 3060                 if (len != hbhlen)
 3061                         return (EINVAL);
 3062 
 3063                 /* turn off the previous option, then set the new option. */
 3064                 ip6_clearpktopts(opt, IPV6_HOPOPTS);
 3065                 opt->ip6po_hbh = kmalloc(hbhlen, M_IP6OPT, M_NOWAIT);
 3066                 if (opt->ip6po_hbh == NULL)
 3067                         return (ENOBUFS);
 3068                 bcopy(hbh, opt->ip6po_hbh, hbhlen);
 3069 
 3070                 break;
 3071         }
 3072 
 3073         case IPV6_2292DSTOPTS:
 3074         case IPV6_DSTOPTS:
 3075         case IPV6_RTHDRDSTOPTS:
 3076         {
 3077                 struct ip6_dest *dest, **newdest = NULL;
 3078                 int destlen;
 3079                 if (!priv)
 3080                         return (EPERM);
 3081 
 3082                 if (len == 0) {
 3083                         ip6_clearpktopts(opt, optname);
 3084                         break;  /* just remove the option */
 3085                 }
 3086 
 3087                 /* message length validation */
 3088                 if (len < sizeof(struct ip6_dest))
 3089                         return (EINVAL);
 3090                 dest = (struct ip6_dest *)buf;
 3091                 destlen = (dest->ip6d_len + 1) << 3;
 3092                 if (len != destlen)
 3093                         return (EINVAL);
 3094 
 3095                 /*
 3096                  * Determine the position that the destination options header
 3097                  * should be inserted; before or after the routing header.
 3098                  */
 3099                 switch (optname) {
 3100                 case IPV6_2292DSTOPTS:
 3101                         /*
 3102                          * The old advacned API is ambiguous on this point.
 3103                          * Our approach is to determine the position based
 3104                          * according to the existence of a routing header.
 3105                          * Note, however, that this depends on the order of the
 3106                          * extension headers in the ancillary data; the 1st
 3107                          * part of the destination options header must appear
 3108                          * before the routing header in the ancillary data,
 3109                          * too.
 3110                          * RFC3542 solved the ambiguity by introducing
 3111                          * separate ancillary data or option types.
 3112                          */
 3113                         if (opt->ip6po_rthdr == NULL)
 3114                                 newdest = &opt->ip6po_dest1;
 3115                         else
 3116                                 newdest = &opt->ip6po_dest2;
 3117                         break;
 3118                 case IPV6_RTHDRDSTOPTS:
 3119                         newdest = &opt->ip6po_dest1;
 3120                         break;
 3121                 case IPV6_DSTOPTS:
 3122                         newdest = &opt->ip6po_dest2;
 3123                         break;
 3124                 }
 3125 
 3126                 /* turn off the previous option, then set the new option. */
 3127                 ip6_clearpktopts(opt, optname);
 3128                 *newdest = kmalloc(destlen, M_IP6OPT, M_NOWAIT);
 3129                 if (*newdest == NULL)
 3130                         return (ENOBUFS);
 3131                 bcopy(dest, *newdest, destlen);
 3132 
 3133                 break;
 3134         }
 3135 
 3136         case IPV6_2292RTHDR:
 3137         case IPV6_RTHDR:
 3138         {
 3139                 struct ip6_rthdr *rth;
 3140                 int rthlen;
 3141 
 3142                 if (len == 0) {
 3143                         ip6_clearpktopts(opt, IPV6_RTHDR);
 3144                         break;  /* just remove the option */
 3145                 }
 3146 
 3147                 /* message length validation */
 3148                 if (len < sizeof(struct ip6_rthdr))
 3149                         return (EINVAL);
 3150                 rth = (struct ip6_rthdr *)buf;
 3151                 rthlen = (rth->ip6r_len + 1) << 3;
 3152                 if (len != rthlen)
 3153                         return (EINVAL);
 3154 
 3155                 switch (rth->ip6r_type) {
 3156                 default:
 3157                         return (EINVAL);        /* not supported */
 3158                 }
 3159 
 3160                 /* turn off the previous option */
 3161                 ip6_clearpktopts(opt, IPV6_RTHDR);
 3162                 opt->ip6po_rthdr = kmalloc(rthlen, M_IP6OPT, M_NOWAIT);
 3163                 if (opt->ip6po_rthdr == NULL)
 3164                         return (ENOBUFS);
 3165                 bcopy(rth, opt->ip6po_rthdr, rthlen);
 3166 
 3167                 break;
 3168         }
 3169 
 3170         case IPV6_USE_MIN_MTU:
 3171                 if (len != sizeof(int))
 3172                         return (EINVAL);
 3173                 minmtupolicy = *(int *)buf;
 3174                 if (minmtupolicy != IP6PO_MINMTU_MCASTONLY &&
 3175                     minmtupolicy != IP6PO_MINMTU_DISABLE &&
 3176                     minmtupolicy != IP6PO_MINMTU_ALL) {
 3177                         return (EINVAL);
 3178                 }
 3179                 opt->ip6po_minmtu = minmtupolicy;
 3180                 break;
 3181 
 3182         case IPV6_DONTFRAG:
 3183                 if (len != sizeof(int))
 3184                         return (EINVAL);
 3185 
 3186                 if (uproto == IPPROTO_TCP || *(int *)buf == 0) {
 3187                         /*
 3188                          * we ignore this option for TCP sockets.
 3189                          * (RFC3542 leaves this case unspecified.)
 3190                          */
 3191                         opt->ip6po_flags &= ~IP6PO_DONTFRAG;
 3192                 } else
 3193                         opt->ip6po_flags |= IP6PO_DONTFRAG;
 3194                 break;
 3195 
 3196         case IPV6_PREFER_TEMPADDR:
 3197                 if (len != sizeof(int))
 3198                         return (EINVAL);
 3199                 preftemp = *(int *)buf;
 3200                 if (preftemp != IP6PO_TEMPADDR_SYSTEM &&
 3201                     preftemp != IP6PO_TEMPADDR_NOTPREFER &&
 3202                     preftemp != IP6PO_TEMPADDR_PREFER) {
 3203                         return (EINVAL);
 3204                 }
 3205                 opt->ip6po_prefer_tempaddr = preftemp;
 3206                 break;
 3207 
 3208         default:
 3209                 return (ENOPROTOOPT);
 3210         } /* end of switch */
 3211 
 3212         return (0);
 3213 }
 3214 
 3215 
 3216 /*
 3217  * Set IPv6 outgoing packet options based on advanced API.
 3218  */
 3219 int
 3220 ip6_setpktoptions(struct mbuf *control, struct ip6_pktopts *opt,
 3221     struct ip6_pktopts *stickyopt, int uproto, int priv)
 3222 {
 3223         struct cmsghdr *cm = NULL;
 3224 
 3225         if (control == NULL || opt == NULL)
 3226                 return (EINVAL);
 3227 
 3228         init_ip6pktopts(opt);
 3229 
 3230         /*
 3231          * XXX: Currently, we assume all the optional information is stored
 3232          * in a single mbuf.
 3233          */
 3234         if (stickyopt) {
 3235                 int error;
 3236 
 3237                 /*
 3238                  * If stickyopt is provided, make a local copy of the options
 3239                  * for this particular packet, then override them by ancillary
 3240                  * objects.
 3241                  * XXX: copypktopts() does not copy the cached route to a next
 3242                  * hop (if any).  This is not very good in terms of efficiency,
 3243                  * but we can allow this since this option should be rarely
 3244                  * used.
 3245                  */
 3246                 if ((error = copypktopts(opt, stickyopt, M_NOWAIT)) != 0)
 3247                         return (error);
 3248         }
 3249 
 3250         /*
 3251          * XXX: Currently, we assume all the optional information is stored
 3252          * in a single mbuf.
 3253          */
 3254         if (control->m_next)
 3255                 return (EINVAL);
 3256 
 3257         for (; control->m_len; control->m_data += CMSG_ALIGN(cm->cmsg_len),
 3258             control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
 3259                 int error;
 3260 
 3261                 if (control->m_len < CMSG_LEN(0))
 3262                         return (EINVAL);
 3263 
 3264                 cm = mtod(control, struct cmsghdr *);
 3265                 if (cm->cmsg_len == 0 || cm->cmsg_len > control->m_len)
 3266                         return (EINVAL);
 3267                 if (cm->cmsg_level != IPPROTO_IPV6)
 3268                         continue;
 3269 
 3270                 error = ip6_setpktoption(cm->cmsg_type, CMSG_DATA(cm),
 3271                     cm->cmsg_len - CMSG_LEN(0), opt, 0, 1, uproto, priv);
 3272                 if (error)
 3273                         return (error);
 3274         }
 3275 
 3276         return (0);
 3277 }
 3278 
 3279 /*
 3280  * Routine called from ip6_output() to loop back a copy of an IP6 multicast
 3281  * packet to the input queue of a specified interface.  Note that this
 3282  * calls the output routine of the loopback "driver", but with an interface
 3283  * pointer that might NOT be &loif -- easier than replicating that code here.
 3284  */
 3285 void
 3286 ip6_mloopback(struct ifnet *ifp, struct mbuf *m, struct sockaddr_in6 *dst)
 3287 {
 3288         struct mbuf *copym;
 3289         struct ip6_hdr *ip6;
 3290 
 3291         copym = m_copy(m, 0, M_COPYALL);
 3292         if (copym == NULL)
 3293                 return;
 3294 
 3295         /*
 3296          * Make sure to deep-copy IPv6 header portion in case the data
 3297          * is in an mbuf cluster, so that we can safely override the IPv6
 3298          * header portion later.
 3299          */
 3300         if ((copym->m_flags & M_EXT) != 0 ||
 3301             copym->m_len < sizeof(struct ip6_hdr)) {
 3302                 copym = m_pullup(copym, sizeof(struct ip6_hdr));
 3303                 if (copym == NULL)
 3304                         return;
 3305         }
 3306 
 3307 #ifdef DIAGNOSTIC
 3308         if (copym->m_len < sizeof(*ip6)) {
 3309                 m_freem(copym);
 3310                 return;
 3311         }
 3312 #endif
 3313 
 3314         ip6 = mtod(copym, struct ip6_hdr *);
 3315         /*
 3316          * clear embedded scope identifiers if necessary.
 3317          * in6_clearscope will touch the addresses only when necessary.
 3318          */
 3319         in6_clearscope(&ip6->ip6_src);
 3320         in6_clearscope(&ip6->ip6_dst);
 3321 
 3322         if_simloop(ifp, copym, dst->sin6_family, 0);
 3323 }
 3324 
 3325 /*
 3326  * Separate the IPv6 header from the payload into its own mbuf.
 3327  *
 3328  * Returns the new mbuf chain or the original mbuf if no payload.
 3329  * Returns NULL if can't allocate new mbuf for header.
 3330  */
 3331 static struct mbuf *
 3332 ip6_splithdr(struct mbuf *m)
 3333 {
 3334         struct mbuf *mh;
 3335 
 3336         if (m->m_len <= sizeof(struct ip6_hdr))         /* no payload */
 3337                 return (m);
 3338 
 3339         MGETHDR(mh, MB_DONTWAIT, MT_HEADER);
 3340         if (mh == NULL)
 3341                 return (NULL);
 3342         mh->m_len = sizeof(struct ip6_hdr);
 3343         M_MOVE_PKTHDR(mh, m);
 3344         MH_ALIGN(mh, sizeof(struct ip6_hdr));
 3345         bcopy(mtod(m, caddr_t), mtod(mh, caddr_t), sizeof(struct ip6_hdr));
 3346         m->m_data += sizeof(struct ip6_hdr);
 3347         m->m_len -= sizeof(struct ip6_hdr);
 3348         mh->m_next = m;
 3349         return (mh);
 3350 }
 3351 
 3352 /*
 3353  * Compute IPv6 extension header length.
 3354  */
 3355 int
 3356 ip6_optlen(struct in6pcb *in6p)
 3357 {
 3358         int len;
 3359 
 3360         if (!in6p->in6p_outputopts)
 3361                 return 0;
 3362 
 3363         len = 0;
 3364 #define elen(x) \
 3365     (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
 3366 
 3367         len += elen(in6p->in6p_outputopts->ip6po_hbh);
 3368         if (in6p->in6p_outputopts->ip6po_rthdr)
 3369                 /* dest1 is valid with rthdr only */
 3370                 len += elen(in6p->in6p_outputopts->ip6po_dest1);
 3371         len += elen(in6p->in6p_outputopts->ip6po_rthdr);
 3372         len += elen(in6p->in6p_outputopts->ip6po_dest2);
 3373         return len;
 3374 #undef elen
 3375 }

Cache object: b7167de80e6aed39e9a07828893886cb


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.