xref: /netbsd-src/sys/netinet6/ip6_forward.c (revision 7f21db1c0118155e0dd40b75182e30c589d9f63e)
1 /*	$NetBSD: ip6_forward.c,v 1.68 2010/02/04 21:48:35 joerg Exp $	*/
2 /*	$KAME: ip6_forward.c,v 1.109 2002/09/11 08:10:17 sakane Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __KERNEL_RCSID(0, "$NetBSD: ip6_forward.c,v 1.68 2010/02/04 21:48:35 joerg Exp $");
35 
36 #include "opt_gateway.h"
37 #include "opt_ipsec.h"
38 #include "opt_pfil_hooks.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/malloc.h>
43 #include <sys/mbuf.h>
44 #include <sys/domain.h>
45 #include <sys/protosw.h>
46 #include <sys/socket.h>
47 #include <sys/errno.h>
48 #include <sys/time.h>
49 #include <sys/kernel.h>
50 #include <sys/syslog.h>
51 
52 #include <net/if.h>
53 #include <net/route.h>
54 
55 #include <netinet/in.h>
56 #include <netinet/in_var.h>
57 #include <netinet/ip_var.h>
58 #include <netinet/ip6.h>
59 #include <netinet6/ip6_var.h>
60 #include <netinet6/ip6_private.h>
61 #include <netinet6/scope6_var.h>
62 #include <netinet/icmp6.h>
63 #include <netinet6/nd6.h>
64 
65 #ifdef IPSEC
66 #include <netinet6/ipsec.h>
67 #include <netinet6/ipsec_private.h>
68 #include <netkey/key.h>
69 #endif /* IPSEC */
70 
71 #ifdef FAST_IPSEC
72 #include <netipsec/ipsec.h>
73 #include <netipsec/ipsec6.h>
74 #include <netipsec/key.h>
75 #include <netipsec/xform.h>
76 #endif /* FAST_IPSEC */
77 
78 #ifdef PFIL_HOOKS
79 #include <net/pfil.h>
80 #endif
81 
82 #include <net/net_osdep.h>
83 
84 struct	route ip6_forward_rt;
85 
86 #ifdef PFIL_HOOKS
87 extern struct pfil_head inet6_pfil_hook;	/* XXX */
88 #endif
89 
90 /*
91  * Forward a packet.  If some error occurs return the sender
92  * an icmp packet.  Note we can't always generate a meaningful
93  * icmp message because icmp doesn't have a large enough repertoire
94  * of codes and types.
95  *
96  * If not forwarding, just drop the packet.  This could be confusing
97  * if ipforwarding was zero but some routing protocol was advancing
98  * us as a gateway to somewhere.  However, we must let the routing
99  * protocol deal with that.
100  *
101  */
102 
103 void
104 ip6_forward(struct mbuf *m, int srcrt)
105 {
106 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
107 	const struct sockaddr_in6 *dst;
108 	struct rtentry *rt;
109 	int error = 0, type = 0, code = 0;
110 	struct mbuf *mcopy = NULL;
111 	struct ifnet *origifp;	/* maybe unnecessary */
112 	u_int32_t inzone, outzone;
113 	struct in6_addr src_in6, dst_in6;
114 #ifdef IPSEC
115 	struct secpolicy *sp = NULL;
116 	int ipsecrt = 0;
117 #endif
118 #ifdef FAST_IPSEC
119     struct secpolicy *sp = NULL;
120     int needipsec = 0;
121     int s;
122 #endif
123 
124 	/*
125 	 * Clear any in-bound checksum flags for this packet.
126 	 */
127 	m->m_pkthdr.csum_flags = 0;
128 
129 #ifdef IPSEC
130 	/*
131 	 * Check AH/ESP integrity.
132 	 */
133 	/*
134 	 * Don't increment ip6s_cantforward because this is the check
135 	 * before forwarding packet actually.
136 	 */
137 	if (ipsec6_in_reject(m, NULL)) {
138 		IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
139 		m_freem(m);
140 		return;
141 	}
142 #endif /* IPSEC */
143 
144 	/*
145 	 * Do not forward packets to multicast destination (should be handled
146 	 * by ip6_mforward().
147 	 * Do not forward packets with unspecified source.  It was discussed
148 	 * in July 2000, on ipngwg mailing list.
149 	 */
150 	if ((m->m_flags & (M_BCAST|M_MCAST)) != 0 ||
151 	    IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
152 	    IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
153 		IP6_STATINC(IP6_STAT_CANTFORWARD);
154 		/* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */
155 		if (ip6_log_time + ip6_log_interval < time_second) {
156 			ip6_log_time = time_second;
157 			log(LOG_DEBUG,
158 			    "cannot forward "
159 			    "from %s to %s nxt %d received on %s\n",
160 			    ip6_sprintf(&ip6->ip6_src),
161 			    ip6_sprintf(&ip6->ip6_dst),
162 			    ip6->ip6_nxt,
163 			    if_name(m->m_pkthdr.rcvif));
164 		}
165 		m_freem(m);
166 		return;
167 	}
168 
169 	if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
170 		/* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */
171 		icmp6_error(m, ICMP6_TIME_EXCEEDED,
172 				ICMP6_TIME_EXCEED_TRANSIT, 0);
173 		return;
174 	}
175 	ip6->ip6_hlim -= IPV6_HLIMDEC;
176 
177 	/*
178 	 * Save at most ICMPV6_PLD_MAXLEN (= the min IPv6 MTU -
179 	 * size of IPv6 + ICMPv6 headers) bytes of the packet in case
180 	 * we need to generate an ICMP6 message to the src.
181 	 * Thanks to M_EXT, in most cases copy will not occur.
182 	 *
183 	 * It is important to save it before IPsec processing as IPsec
184 	 * processing may modify the mbuf.
185 	 */
186 	mcopy = m_copy(m, 0, imin(m->m_pkthdr.len, ICMPV6_PLD_MAXLEN));
187 
188 #ifdef IPSEC
189 	/* get a security policy for this packet */
190 	sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND,
191 	    IP_FORWARDING, &error);
192 	if (sp == NULL) {
193 		IPSEC6_STATINC(IPSEC_STAT_OUT_INVAL);
194 		IP6_STATINC(IP6_STAT_CANTFORWARD);
195 		if (mcopy) {
196 #if 0
197 			/* XXX: what icmp ? */
198 #else
199 			m_freem(mcopy);
200 #endif
201 		}
202 		m_freem(m);
203 		return;
204 	}
205 
206 	error = 0;
207 
208 	/* check policy */
209 	switch (sp->policy) {
210 	case IPSEC_POLICY_DISCARD:
211 		/*
212 		 * This packet is just discarded.
213 		 */
214 		IPSEC6_STATINC(IPSEC_STAT_OUT_POLVIO);
215 		IP6_STATINC(IP6_STAT_CANTFORWARD);
216 		key_freesp(sp);
217 		if (mcopy) {
218 #if 0
219 			/* XXX: what icmp ? */
220 #else
221 			m_freem(mcopy);
222 #endif
223 		}
224 		m_freem(m);
225 		return;
226 
227 	case IPSEC_POLICY_BYPASS:
228 	case IPSEC_POLICY_NONE:
229 		/* no need to do IPsec. */
230 		key_freesp(sp);
231 		goto skip_ipsec;
232 
233 	case IPSEC_POLICY_IPSEC:
234 		if (sp->req == NULL) {
235 			/* XXX should be panic ? */
236 			printf("ip6_forward: No IPsec request specified.\n");
237 			IP6_STATINC(IP6_STAT_CANTFORWARD);
238 			key_freesp(sp);
239 			if (mcopy) {
240 #if 0
241 				/* XXX: what icmp ? */
242 #else
243 				m_freem(mcopy);
244 #endif
245 			}
246 			m_freem(m);
247 			return;
248 		}
249 		/* do IPsec */
250 		break;
251 
252 	case IPSEC_POLICY_ENTRUST:
253 	default:
254 		/* should be panic ?? */
255 		printf("ip6_forward: Invalid policy found. %d\n", sp->policy);
256 		key_freesp(sp);
257 		goto skip_ipsec;
258 	}
259 
260     {
261 	struct ipsecrequest *isr = NULL;
262 	struct ipsec_output_state state;
263 
264 	/*
265 	 * when the kernel forwards a packet, it is not proper to apply
266 	 * IPsec transport mode to the packet is not proper.  this check
267 	 * avoid from this.
268 	 * at present, if there is even a transport mode SA request in the
269 	 * security policy, the kernel does not apply IPsec to the packet.
270 	 * this check is not enough because the following case is valid.
271 	 *      ipsec esp/tunnel/xxx-xxx/require esp/transport//require;
272 	 */
273 	for (isr = sp->req; isr; isr = isr->next) {
274 		if (isr->saidx.mode == IPSEC_MODE_ANY)
275 			goto doipsectunnel;
276 		if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
277 			goto doipsectunnel;
278 	}
279 
280 	/*
281 	 * if there's no need for tunnel mode IPsec, skip.
282 	 */
283 	if (!isr)
284 		goto skip_ipsec;
285 
286     doipsectunnel:
287 	/*
288 	 * All the extension headers will become inaccessible
289 	 * (since they can be encrypted).
290 	 * Don't panic, we need no more updates to extension headers
291 	 * on inner IPv6 packet (since they are now encapsulated).
292 	 *
293 	 * IPv6 [ESP|AH] IPv6 [extension headers] payload
294 	 */
295 	memset(&state, 0, sizeof(state));
296 	state.m = m;
297 	state.ro = NULL;	/* update at ipsec6_output_tunnel() */
298 	state.dst = NULL;	/* update at ipsec6_output_tunnel() */
299 
300 	error = ipsec6_output_tunnel(&state, sp, 0);
301 
302 	m = state.m;
303 	key_freesp(sp);
304 
305 	if (error) {
306 		/* mbuf is already reclaimed in ipsec6_output_tunnel. */
307 		switch (error) {
308 		case EHOSTUNREACH:
309 		case ENETUNREACH:
310 		case EMSGSIZE:
311 		case ENOBUFS:
312 		case ENOMEM:
313 			break;
314 		default:
315 			printf("ip6_forward (ipsec): error code %d\n", error);
316 			/* FALLTHROUGH */
317 		case ENOENT:
318 			/* don't show these error codes to the user */
319 			break;
320 		}
321 		IP6_STATINC(IP6_STAT_CANTFORWARD);
322 		if (mcopy) {
323 #if 0
324 			/* XXX: what icmp ? */
325 #else
326 			m_freem(mcopy);
327 #endif
328 		}
329 		m_freem(m);
330 		return;
331 	}
332 
333 	if (ip6 != mtod(m, struct ip6_hdr *)) {
334 		/*
335 		 * now tunnel mode headers are added.  we are originating
336 		 * packet instead of forwarding the packet.
337 		 */
338 		ip6_output(m, NULL, NULL, IPV6_FORWARDING/*XXX*/, NULL, NULL,
339 		    NULL);
340 		goto freecopy;
341 	}
342 
343 	/* adjust pointer */
344 	rt = state.ro ? rtcache_validate(state.ro) : NULL;
345 	dst = (const struct sockaddr_in6 *)state.dst;
346 	if (dst != NULL && rt != NULL) {
347 		ipsecrt = 1;
348 		goto skip_routing;
349 	}
350     }
351     skip_ipsec:
352 #endif /* IPSEC */
353 #ifdef FAST_IPSEC
354 	/* Check the security policy (SP) for the packet */
355 
356 	sp = ipsec6_check_policy(m,NULL,0,&needipsec,&error);
357 	if (error != 0) {
358 		/*
359 		 * Hack: -EINVAL is used to signal that a packet
360 		 * should be silently discarded.  This is typically
361 		 * because we asked key management for an SA and
362 		 * it was delayed (e.g. kicked up to IKE).
363 		 */
364 	if (error == -EINVAL)
365 		error = 0;
366 	goto freecopy;
367 	}
368 #endif /* FAST_IPSEC */
369 
370 	if (srcrt) {
371 		union {
372 			struct sockaddr		dst;
373 			struct sockaddr_in6	dst6;
374 		} u;
375 
376 		sockaddr_in6_init(&u.dst6, &ip6->ip6_dst, 0, 0, 0);
377 		if ((rt = rtcache_lookup(&ip6_forward_rt, &u.dst)) == NULL) {
378 			IP6_STATINC(IP6_STAT_NOROUTE);
379 			/* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_noroute) */
380 			if (mcopy) {
381 				icmp6_error(mcopy, ICMP6_DST_UNREACH,
382 					    ICMP6_DST_UNREACH_NOROUTE, 0);
383 			}
384 			m_freem(m);
385 			return;
386 		}
387 	} else if ((rt = rtcache_validate(&ip6_forward_rt)) == NULL &&
388 	           (rt = rtcache_update(&ip6_forward_rt, 1)) == NULL) {
389 		/*
390 		 * rtcache_getdst(ip6_forward_rt)->sin6_addr was equal to
391 		 * ip6->ip6_dst
392 		 */
393 		IP6_STATINC(IP6_STAT_NOROUTE);
394 		/* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_noroute) */
395 		if (mcopy) {
396 			icmp6_error(mcopy, ICMP6_DST_UNREACH,
397 			    ICMP6_DST_UNREACH_NOROUTE, 0);
398 		}
399 		m_freem(m);
400 		return;
401 	}
402 	dst = satocsin6(rtcache_getdst(&ip6_forward_rt));
403 #ifdef IPSEC
404     skip_routing:;
405 #endif /* IPSEC */
406 
407 	/*
408 	 * Source scope check: if a packet can't be delivered to its
409 	 * destination for the reason that the destination is beyond the scope
410 	 * of the source address, discard the packet and return an icmp6
411 	 * destination unreachable error with Code 2 (beyond scope of source
412 	 * address).  We use a local copy of ip6_src, since in6_setscope()
413 	 * will possibly modify its first argument.
414 	 * [draft-ietf-ipngwg-icmp-v3-07, Section 3.1]
415 	 */
416 	src_in6 = ip6->ip6_src;
417 	if (in6_setscope(&src_in6, rt->rt_ifp, &outzone)) {
418 		/* XXX: this should not happen */
419 		uint64_t *ip6s = IP6_STAT_GETREF();
420 		ip6s[IP6_STAT_CANTFORWARD]++;
421 		ip6s[IP6_STAT_BADSCOPE]++;
422 		IP6_STAT_PUTREF();
423 		m_freem(m);
424 		return;
425 	}
426 	if (in6_setscope(&src_in6, m->m_pkthdr.rcvif, &inzone)) {
427 		uint64_t *ip6s = IP6_STAT_GETREF();
428 		ip6s[IP6_STAT_CANTFORWARD]++;
429 		ip6s[IP6_STAT_BADSCOPE]++;
430 		IP6_STAT_PUTREF();
431 		m_freem(m);
432 		return;
433 	}
434 	if (inzone != outzone
435 #ifdef IPSEC
436 	    && !ipsecrt
437 #endif
438 	    ) {
439 		uint64_t *ip6s = IP6_STAT_GETREF();
440 		ip6s[IP6_STAT_CANTFORWARD]++;
441 		ip6s[IP6_STAT_BADSCOPE]++;
442 		IP6_STAT_PUTREF();
443 		in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard);
444 
445 		if (ip6_log_time + ip6_log_interval < time_second) {
446 			ip6_log_time = time_second;
447 			log(LOG_DEBUG,
448 			    "cannot forward "
449 			    "src %s, dst %s, nxt %d, rcvif %s, outif %s\n",
450 			    ip6_sprintf(&ip6->ip6_src),
451 			    ip6_sprintf(&ip6->ip6_dst),
452 			    ip6->ip6_nxt,
453 			    if_name(m->m_pkthdr.rcvif), if_name(rt->rt_ifp));
454 		}
455 		if (mcopy)
456 			icmp6_error(mcopy, ICMP6_DST_UNREACH,
457 				    ICMP6_DST_UNREACH_BEYONDSCOPE, 0);
458 		m_freem(m);
459 		return;
460 	}
461 #ifdef FAST_IPSEC
462     /*
463      * If we need to encapsulate the packet, do it here
464      * ipsec6_proces_packet will send the packet using ip6_output
465      */
466 	if (needipsec) {
467 		s = splsoftnet();
468 		error = ipsec6_process_packet(m,sp->req);
469 		splx(s);
470 		if (mcopy)
471 			goto freecopy;
472     }
473 #endif
474 
475 
476 
477 	/*
478 	 * Destination scope check: if a packet is going to break the scope
479 	 * zone of packet's destination address, discard it.  This case should
480 	 * usually be prevented by appropriately-configured routing table, but
481 	 * we need an explicit check because we may mistakenly forward the
482 	 * packet to a different zone by (e.g.) a default route.
483 	 */
484 	dst_in6 = ip6->ip6_dst;
485 	if (in6_setscope(&dst_in6, m->m_pkthdr.rcvif, &inzone) != 0 ||
486 	    in6_setscope(&dst_in6, rt->rt_ifp, &outzone) != 0 ||
487 	    inzone != outzone) {
488 		uint64_t *ip6s = IP6_STAT_GETREF();
489 		ip6s[IP6_STAT_CANTFORWARD]++;
490 		ip6s[IP6_STAT_BADSCOPE]++;
491 		IP6_STAT_PUTREF();
492 		m_freem(m);
493 		return;
494 	}
495 
496 	if (m->m_pkthdr.len > IN6_LINKMTU(rt->rt_ifp)) {
497 		in6_ifstat_inc(rt->rt_ifp, ifs6_in_toobig);
498 		if (mcopy) {
499 			u_long mtu;
500 #ifdef IPSEC
501 			struct secpolicy *xsp;
502 			int ipsecerror;
503 			size_t ipsechdrsiz;
504 #endif
505 
506 			mtu = IN6_LINKMTU(rt->rt_ifp);
507 #ifdef IPSEC
508 			/*
509 			 * When we do IPsec tunnel ingress, we need to play
510 			 * with the link value (decrement IPsec header size
511 			 * from mtu value).  The code is much simpler than v4
512 			 * case, as we have the outgoing interface for
513 			 * encapsulated packet as "rt->rt_ifp".
514 			 */
515 			xsp = ipsec6_getpolicybyaddr(mcopy, IPSEC_DIR_OUTBOUND,
516 				IP_FORWARDING, &ipsecerror);
517 			if (xsp) {
518 				ipsechdrsiz = ipsec6_hdrsiz(mcopy,
519 					IPSEC_DIR_OUTBOUND, NULL);
520 				if (ipsechdrsiz < mtu)
521 					mtu -= ipsechdrsiz;
522 			}
523 
524 			/*
525 			 * if mtu becomes less than minimum MTU,
526 			 * tell minimum MTU (and I'll need to fragment it).
527 			 */
528 			if (mtu < IPV6_MMTU)
529 				mtu = IPV6_MMTU;
530 #endif
531 			icmp6_error(mcopy, ICMP6_PACKET_TOO_BIG, 0, mtu);
532 		}
533 		m_freem(m);
534 		return;
535 	}
536 
537 	if (rt->rt_flags & RTF_GATEWAY)
538 		dst = (struct sockaddr_in6 *)rt->rt_gateway;
539 
540 	/*
541 	 * If we are to forward the packet using the same interface
542 	 * as one we got the packet from, perhaps we should send a redirect
543 	 * to sender to shortcut a hop.
544 	 * Only send redirect if source is sending directly to us,
545 	 * and if packet was not source routed (or has any options).
546 	 * Also, don't send redirect if forwarding using a route
547 	 * modified by a redirect.
548 	 */
549 	if (rt->rt_ifp == m->m_pkthdr.rcvif && !srcrt && ip6_sendredirects &&
550 #ifdef IPSEC
551 	    !ipsecrt &&
552 #endif
553 	    (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0) {
554 		if ((rt->rt_ifp->if_flags & IFF_POINTOPOINT) &&
555 		    nd6_is_addr_neighbor(
556 		        satocsin6(rtcache_getdst(&ip6_forward_rt)),
557 			rt->rt_ifp)) {
558 			/*
559 			 * If the incoming interface is equal to the outgoing
560 			 * one, the link attached to the interface is
561 			 * point-to-point, and the IPv6 destination is
562 			 * regarded as on-link on the link, then it will be
563 			 * highly probable that the destination address does
564 			 * not exist on the link and that the packet is going
565 			 * to loop.  Thus, we immediately drop the packet and
566 			 * send an ICMPv6 error message.
567 			 * For other routing loops, we dare to let the packet
568 			 * go to the loop, so that a remote diagnosing host
569 			 * can detect the loop by traceroute.
570 			 * type/code is based on suggestion by Rich Draves.
571 			 * not sure if it is the best pick.
572 			 */
573 			icmp6_error(mcopy, ICMP6_DST_UNREACH,
574 				    ICMP6_DST_UNREACH_ADDR, 0);
575 			m_freem(m);
576 			return;
577 		}
578 		type = ND_REDIRECT;
579 	}
580 
581 	/*
582 	 * Fake scoped addresses. Note that even link-local source or
583 	 * destinaion can appear, if the originating node just sends the
584 	 * packet to us (without address resolution for the destination).
585 	 * Since both icmp6_error and icmp6_redirect_output fill the embedded
586 	 * link identifiers, we can do this stuff after making a copy for
587 	 * returning an error.
588 	 */
589 	if ((rt->rt_ifp->if_flags & IFF_LOOPBACK) != 0) {
590 		/*
591 		 * See corresponding comments in ip6_output.
592 		 * XXX: but is it possible that ip6_forward() sends a packet
593 		 *      to a loopback interface? I don't think so, and thus
594 		 *      I bark here. (jinmei@kame.net)
595 		 * XXX: it is common to route invalid packets to loopback.
596 		 *	also, the codepath will be visited on use of ::1 in
597 		 *	rthdr. (itojun)
598 		 */
599 #if 1
600 		if (0)
601 #else
602 		if ((rt->rt_flags & (RTF_BLACKHOLE|RTF_REJECT)) == 0)
603 #endif
604 		{
605 			printf("ip6_forward: outgoing interface is loopback. "
606 			       "src %s, dst %s, nxt %d, rcvif %s, outif %s\n",
607 			       ip6_sprintf(&ip6->ip6_src),
608 			       ip6_sprintf(&ip6->ip6_dst),
609 			       ip6->ip6_nxt, if_name(m->m_pkthdr.rcvif),
610 			       if_name(rt->rt_ifp));
611 		}
612 
613 		/* we can just use rcvif in forwarding. */
614 		origifp = m->m_pkthdr.rcvif;
615 	}
616 	else
617 		origifp = rt->rt_ifp;
618 	/*
619 	 * clear embedded scope identifiers if necessary.
620 	 * in6_clearscope will touch the addresses only when necessary.
621 	 */
622 	in6_clearscope(&ip6->ip6_src);
623 	in6_clearscope(&ip6->ip6_dst);
624 
625 #ifdef PFIL_HOOKS
626 	/*
627 	 * Run through list of hooks for output packets.
628 	 */
629 	if ((error = pfil_run_hooks(&inet6_pfil_hook, &m, rt->rt_ifp,
630 	    PFIL_OUT)) != 0)
631 		goto senderr;
632 	if (m == NULL)
633 		goto freecopy;
634 	ip6 = mtod(m, struct ip6_hdr *);
635 #endif /* PFIL_HOOKS */
636 
637 	error = nd6_output(rt->rt_ifp, origifp, m, dst, rt);
638 	if (error) {
639 		in6_ifstat_inc(rt->rt_ifp, ifs6_out_discard);
640 		IP6_STATINC(IP6_STAT_CANTFORWARD);
641 	} else {
642 		IP6_STATINC(IP6_STAT_FORWARD);
643 		in6_ifstat_inc(rt->rt_ifp, ifs6_out_forward);
644 		if (type)
645 			IP6_STATINC(IP6_STAT_REDIRECTSENT);
646 		else {
647 #ifdef GATEWAY
648 			if (m->m_flags & M_CANFASTFWD)
649 				ip6flow_create(&ip6_forward_rt, m);
650 #endif
651 			if (mcopy)
652 				goto freecopy;
653 		}
654 	}
655 
656 #ifdef PFIL_HOOKS
657  senderr:
658 #endif
659 	if (mcopy == NULL)
660 		return;
661 	switch (error) {
662 	case 0:
663 		if (type == ND_REDIRECT) {
664 			icmp6_redirect_output(mcopy, rt);
665 			return;
666 		}
667 		goto freecopy;
668 
669 	case EMSGSIZE:
670 		/* xxx MTU is constant in PPP? */
671 		goto freecopy;
672 
673 	case ENOBUFS:
674 		/* Tell source to slow down like source quench in IP? */
675 		goto freecopy;
676 
677 	case ENETUNREACH:	/* shouldn't happen, checked above */
678 	case EHOSTUNREACH:
679 	case ENETDOWN:
680 	case EHOSTDOWN:
681 	default:
682 		type = ICMP6_DST_UNREACH;
683 		code = ICMP6_DST_UNREACH_ADDR;
684 		break;
685 	}
686 	icmp6_error(mcopy, type, code, 0);
687 	return;
688 
689  freecopy:
690 	m_freem(mcopy);
691 	return;
692 }
693