xref: /netbsd-src/sys/netinet6/ip6_output.c (revision 1921cb5602567cfc8401cc953be22fe9d74238f2)
1 /*	$NetBSD: ip6_output.c,v 1.102 2006/08/30 17:15:22 christos Exp $	*/
2 /*	$KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1990, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
62  */
63 
64 #include <sys/cdefs.h>
65 __KERNEL_RCSID(0, "$NetBSD: ip6_output.c,v 1.102 2006/08/30 17:15:22 christos Exp $");
66 
67 #include "opt_inet.h"
68 #include "opt_inet6.h"
69 #include "opt_ipsec.h"
70 #include "opt_pfil_hooks.h"
71 
72 #include <sys/param.h>
73 #include <sys/malloc.h>
74 #include <sys/mbuf.h>
75 #include <sys/errno.h>
76 #include <sys/protosw.h>
77 #include <sys/socket.h>
78 #include <sys/socketvar.h>
79 #include <sys/systm.h>
80 #include <sys/proc.h>
81 #include <sys/kauth.h>
82 
83 #include <net/if.h>
84 #include <net/route.h>
85 #ifdef PFIL_HOOKS
86 #include <net/pfil.h>
87 #endif
88 
89 #include <netinet/in.h>
90 #include <netinet/in_var.h>
91 #include <netinet/ip6.h>
92 #include <netinet/icmp6.h>
93 #include <netinet/in_offload.h>
94 #include <netinet6/ip6_var.h>
95 #include <netinet6/in6_pcb.h>
96 #include <netinet6/nd6.h>
97 #include <netinet6/ip6protosw.h>
98 #include <netinet6/scope6_var.h>
99 
100 #ifdef IPSEC
101 #include <netinet6/ipsec.h>
102 #include <netkey/key.h>
103 #endif /* IPSEC */
104 
105 #include <net/net_osdep.h>
106 
107 #ifdef PFIL_HOOKS
108 extern struct pfil_head inet6_pfil_hook;	/* XXX */
109 #endif
110 
111 struct ip6_exthdrs {
112 	struct mbuf *ip6e_ip6;
113 	struct mbuf *ip6e_hbh;
114 	struct mbuf *ip6e_dest1;
115 	struct mbuf *ip6e_rthdr;
116 	struct mbuf *ip6e_dest2;
117 };
118 
119 static int ip6_pcbopt __P((int, u_char *, int, struct ip6_pktopts **,
120 	int, int));
121 static int ip6_getpcbopt __P((struct ip6_pktopts *, int, struct mbuf **));
122 static int ip6_setpktopt __P((int, u_char *, int, struct ip6_pktopts *, int,
123 	int, int, int));
124 static int ip6_setmoptions __P((int, struct ip6_moptions **, struct mbuf *));
125 static int ip6_getmoptions __P((int, struct ip6_moptions *, struct mbuf **));
126 static int ip6_copyexthdr __P((struct mbuf **, caddr_t, int));
127 static int ip6_insertfraghdr __P((struct mbuf *, struct mbuf *, int,
128 	struct ip6_frag **));
129 static int ip6_insert_jumboopt __P((struct ip6_exthdrs *, u_int32_t));
130 static int ip6_splithdr __P((struct mbuf *, struct ip6_exthdrs *));
131 static int ip6_getpmtu __P((struct route_in6 *, struct route_in6 *,
132 	struct ifnet *, struct in6_addr *, u_long *, int *));
133 static int copypktopts __P((struct ip6_pktopts *, struct ip6_pktopts *, int));
134 
135 #ifdef RFC2292
136 static int ip6_pcbopts __P((struct ip6_pktopts **, struct mbuf *,
137 	struct socket *));
138 #endif
139 
140 #define	IN6_NEED_CHECKSUM(ifp, csum_flags) \
141 	(__predict_true(((ifp)->if_flags & IFF_LOOPBACK) == 0 || \
142 	(((csum_flags) & M_CSUM_UDPv6) != 0 && udp_do_loopback_cksum) || \
143 	(((csum_flags) & M_CSUM_TCPv6) != 0 && tcp_do_loopback_cksum)))
144 
145 /*
146  * IP6 output. The packet in mbuf chain m contains a skeletal IP6
147  * header (with pri, len, nxt, hlim, src, dst).
148  * This function may modify ver and hlim only.
149  * The mbuf chain containing the packet will be freed.
150  * The mbuf opt, if present, will not be freed.
151  *
152  * type of "mtu": rt_rmx.rmx_mtu is u_long, ifnet.ifr_mtu is int, and
153  * nd_ifinfo.linkmtu is u_int32_t.  so we use u_long to hold largest one,
154  * which is rt_rmx.rmx_mtu.
155  */
156 int
157 ip6_output(m0, opt, ro, flags, im6o, so, ifpp)
158 	struct mbuf *m0;
159 	struct ip6_pktopts *opt;
160 	struct route_in6 *ro;
161 	int flags;
162 	struct ip6_moptions *im6o;
163 	struct socket *so;
164 	struct ifnet **ifpp;		/* XXX: just for statistics */
165 {
166 	struct ip6_hdr *ip6, *mhip6;
167 	struct ifnet *ifp, *origifp;
168 	struct mbuf *m = m0;
169 	int hlen, tlen, len, off;
170 	struct route_in6 ip6route;
171 	struct rtentry *rt = NULL;
172 	struct sockaddr_in6 *dst, src_sa, dst_sa;
173 	int error = 0;
174 	struct in6_ifaddr *ia = NULL;
175 	u_long mtu;
176 	int alwaysfrag, dontfrag;
177 	u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
178 	struct ip6_exthdrs exthdrs;
179 	struct in6_addr finaldst, src0, dst0;
180 	u_int32_t zone;
181 	struct route_in6 *ro_pmtu = NULL;
182 	int hdrsplit = 0;
183 	int needipsec = 0;
184 #ifdef IPSEC
185 	int needipsectun = 0;
186 	struct secpolicy *sp = NULL;
187 
188 	ip6 = mtod(m, struct ip6_hdr *);
189 #endif /* IPSEC */
190 
191 #ifdef  DIAGNOSTIC
192 	if ((m->m_flags & M_PKTHDR) == 0)
193 		panic("ip6_output: no HDR");
194 
195 	if ((m->m_pkthdr.csum_flags &
196 	    (M_CSUM_TCPv4|M_CSUM_UDPv4|M_CSUM_TSOv4)) != 0) {
197 		panic("ip6_output: IPv4 checksum offload flags: %d",
198 		    m->m_pkthdr.csum_flags);
199 	}
200 
201 	if ((m->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) ==
202 	    (M_CSUM_TCPv6|M_CSUM_UDPv6)) {
203 		panic("ip6_output: conflicting checksum offload flags: %d",
204 		    m->m_pkthdr.csum_flags);
205 	}
206 #endif
207 
208 	M_CSUM_DATA_IPv6_HL_SET(m->m_pkthdr.csum_data, sizeof(struct ip6_hdr));
209 
210 #define MAKE_EXTHDR(hp, mp)						\
211     do {								\
212 	if (hp) {							\
213 		struct ip6_ext *eh = (struct ip6_ext *)(hp);		\
214 		error = ip6_copyexthdr((mp), (caddr_t)(hp), 		\
215 		    ((eh)->ip6e_len + 1) << 3);				\
216 		if (error)						\
217 			goto freehdrs;					\
218 	}								\
219     } while (/*CONSTCOND*/ 0)
220 
221 	bzero(&exthdrs, sizeof(exthdrs));
222 	if (opt) {
223 		/* Hop-by-Hop options header */
224 		MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
225 		/* Destination options header(1st part) */
226 		MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
227 		/* Routing header */
228 		MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
229 		/* Destination options header(2nd part) */
230 		MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
231 	}
232 
233 #ifdef IPSEC
234 	if ((flags & IPV6_FORWARDING) != 0) {
235 		needipsec = 0;
236 		goto skippolicycheck;
237 	}
238 
239 	/* get a security policy for this packet */
240 	if (so == NULL)
241 		sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, 0, &error);
242 	else {
243 		if (IPSEC_PCB_SKIP_IPSEC(sotoinpcb_hdr(so)->inph_sp,
244 					 IPSEC_DIR_OUTBOUND)) {
245 			needipsec = 0;
246 			goto skippolicycheck;
247 		}
248 		sp = ipsec6_getpolicybysock(m, IPSEC_DIR_OUTBOUND, so, &error);
249 	}
250 
251 	if (sp == NULL) {
252 		ipsec6stat.out_inval++;
253 		goto freehdrs;
254 	}
255 
256 	error = 0;
257 
258 	/* check policy */
259 	switch (sp->policy) {
260 	case IPSEC_POLICY_DISCARD:
261 		/*
262 		 * This packet is just discarded.
263 		 */
264 		ipsec6stat.out_polvio++;
265 		goto freehdrs;
266 
267 	case IPSEC_POLICY_BYPASS:
268 	case IPSEC_POLICY_NONE:
269 		/* no need to do IPsec. */
270 		needipsec = 0;
271 		break;
272 
273 	case IPSEC_POLICY_IPSEC:
274 		if (sp->req == NULL) {
275 			/* XXX should be panic ? */
276 			printf("ip6_output: No IPsec request specified.\n");
277 			error = EINVAL;
278 			goto freehdrs;
279 		}
280 		needipsec = 1;
281 		break;
282 
283 	case IPSEC_POLICY_ENTRUST:
284 	default:
285 		printf("ip6_output: Invalid policy found. %d\n", sp->policy);
286 	}
287 
288   skippolicycheck:;
289 #endif /* IPSEC */
290 
291 	if (needipsec &&
292 	    (m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0) {
293 		in6_delayed_cksum(m);
294 		m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
295 	}
296 
297 	/*
298 	 * Calculate the total length of the extension header chain.
299 	 * Keep the length of the unfragmentable part for fragmentation.
300 	 */
301 	optlen = 0;
302 	if (exthdrs.ip6e_hbh) optlen += exthdrs.ip6e_hbh->m_len;
303 	if (exthdrs.ip6e_dest1) optlen += exthdrs.ip6e_dest1->m_len;
304 	if (exthdrs.ip6e_rthdr) optlen += exthdrs.ip6e_rthdr->m_len;
305 	unfragpartlen = optlen + sizeof(struct ip6_hdr);
306 	/* NOTE: we don't add AH/ESP length here. do that later. */
307 	if (exthdrs.ip6e_dest2) optlen += exthdrs.ip6e_dest2->m_len;
308 
309 	/*
310 	 * If we need IPsec, or there is at least one extension header,
311 	 * separate IP6 header from the payload.
312 	 */
313 	if ((needipsec || optlen) && !hdrsplit) {
314 		if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
315 			m = NULL;
316 			goto freehdrs;
317 		}
318 		m = exthdrs.ip6e_ip6;
319 		hdrsplit++;
320 	}
321 
322 	/* adjust pointer */
323 	ip6 = mtod(m, struct ip6_hdr *);
324 
325 	/* adjust mbuf packet header length */
326 	m->m_pkthdr.len += optlen;
327 	plen = m->m_pkthdr.len - sizeof(*ip6);
328 
329 	/* If this is a jumbo payload, insert a jumbo payload option. */
330 	if (plen > IPV6_MAXPACKET) {
331 		if (!hdrsplit) {
332 			if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
333 				m = NULL;
334 				goto freehdrs;
335 			}
336 			m = exthdrs.ip6e_ip6;
337 			hdrsplit++;
338 		}
339 		/* adjust pointer */
340 		ip6 = mtod(m, struct ip6_hdr *);
341 		if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
342 			goto freehdrs;
343 		optlen += 8; /* XXX JUMBOOPTLEN */
344 		ip6->ip6_plen = 0;
345 	} else
346 		ip6->ip6_plen = htons(plen);
347 
348 	/*
349 	 * Concatenate headers and fill in next header fields.
350 	 * Here we have, on "m"
351 	 *	IPv6 payload
352 	 * and we insert headers accordingly.  Finally, we should be getting:
353 	 *	IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
354 	 *
355 	 * during the header composing process, "m" points to IPv6 header.
356 	 * "mprev" points to an extension header prior to esp.
357 	 */
358 	{
359 		u_char *nexthdrp = &ip6->ip6_nxt;
360 		struct mbuf *mprev = m;
361 
362 		/*
363 		 * we treat dest2 specially.  this makes IPsec processing
364 		 * much easier.  the goal here is to make mprev point the
365 		 * mbuf prior to dest2.
366 		 *
367 		 * result: IPv6 dest2 payload
368 		 * m and mprev will point to IPv6 header.
369 		 */
370 		if (exthdrs.ip6e_dest2) {
371 			if (!hdrsplit)
372 				panic("assumption failed: hdr not split");
373 			exthdrs.ip6e_dest2->m_next = m->m_next;
374 			m->m_next = exthdrs.ip6e_dest2;
375 			*mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
376 			ip6->ip6_nxt = IPPROTO_DSTOPTS;
377 		}
378 
379 #define MAKE_CHAIN(m, mp, p, i)\
380     do {\
381 	if (m) {\
382 		if (!hdrsplit) \
383 			panic("assumption failed: hdr not split"); \
384 		*mtod((m), u_char *) = *(p);\
385 		*(p) = (i);\
386 		p = mtod((m), u_char *);\
387 		(m)->m_next = (mp)->m_next;\
388 		(mp)->m_next = (m);\
389 		(mp) = (m);\
390 	}\
391     } while (/*CONSTCOND*/ 0)
392 		/*
393 		 * result: IPv6 hbh dest1 rthdr dest2 payload
394 		 * m will point to IPv6 header.  mprev will point to the
395 		 * extension header prior to dest2 (rthdr in the above case).
396 		 */
397 		MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
398 		MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp,
399 		    IPPROTO_DSTOPTS);
400 		MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp,
401 		    IPPROTO_ROUTING);
402 
403 		M_CSUM_DATA_IPv6_HL_SET(m->m_pkthdr.csum_data,
404 		    sizeof(struct ip6_hdr) + optlen);
405 
406 #ifdef IPSEC
407 		if (!needipsec)
408 			goto skip_ipsec2;
409 
410 		/*
411 		 * pointers after IPsec headers are not valid any more.
412 		 * other pointers need a great care too.
413 		 * (IPsec routines should not mangle mbufs prior to AH/ESP)
414 		 */
415 		exthdrs.ip6e_dest2 = NULL;
416 
417 	    {
418 		struct ip6_rthdr *rh = NULL;
419 		int segleft_org = 0;
420 		struct ipsec_output_state state;
421 
422 		if (exthdrs.ip6e_rthdr) {
423 			rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
424 			segleft_org = rh->ip6r_segleft;
425 			rh->ip6r_segleft = 0;
426 		}
427 
428 		bzero(&state, sizeof(state));
429 		state.m = m;
430 		error = ipsec6_output_trans(&state, nexthdrp, mprev, sp, flags,
431 		    &needipsectun);
432 		m = state.m;
433 		if (error) {
434 			/* mbuf is already reclaimed in ipsec6_output_trans. */
435 			m = NULL;
436 			switch (error) {
437 			case EHOSTUNREACH:
438 			case ENETUNREACH:
439 			case EMSGSIZE:
440 			case ENOBUFS:
441 			case ENOMEM:
442 				break;
443 			default:
444 				printf("ip6_output (ipsec): error code %d\n", error);
445 				/* FALLTHROUGH */
446 			case ENOENT:
447 				/* don't show these error codes to the user */
448 				error = 0;
449 				break;
450 			}
451 			goto bad;
452 		}
453 		if (exthdrs.ip6e_rthdr) {
454 			/* ah6_output doesn't modify mbuf chain */
455 			rh->ip6r_segleft = segleft_org;
456 		}
457 	    }
458 skip_ipsec2:;
459 #endif
460 	}
461 
462 	/*
463 	 * If there is a routing header, replace destination address field
464 	 * with the first hop of the routing header.
465 	 */
466 	if (exthdrs.ip6e_rthdr) {
467 		struct ip6_rthdr *rh;
468 		struct ip6_rthdr0 *rh0;
469 		struct in6_addr *addr;
470 		struct sockaddr_in6 sa;
471 
472 		rh = (struct ip6_rthdr *)(mtod(exthdrs.ip6e_rthdr,
473 		    struct ip6_rthdr *));
474 		finaldst = ip6->ip6_dst;
475 		switch (rh->ip6r_type) {
476 		case IPV6_RTHDR_TYPE_0:
477 			 rh0 = (struct ip6_rthdr0 *)rh;
478 			 addr = (struct in6_addr *)(rh0 + 1);
479 
480 			 /*
481 			  * construct a sockaddr_in6 form of
482 			  * the first hop.
483 			  *
484 			  * XXX: we may not have enough
485 			  * information about its scope zone;
486 			  * there is no standard API to pass
487 			  * the information from the
488 			  * application.
489 			  */
490 			 bzero(&sa, sizeof(sa));
491 			 sa.sin6_family = AF_INET6;
492 			 sa.sin6_len = sizeof(sa);
493 			 sa.sin6_addr = addr[0];
494 			 if ((error = sa6_embedscope(&sa,
495 			     ip6_use_defzone)) != 0) {
496 				 goto bad;
497 			 }
498 			 ip6->ip6_dst = sa.sin6_addr;
499 			 (void)memmove(&addr[0], &addr[1],
500 			     sizeof(struct in6_addr) *
501 			     (rh0->ip6r0_segleft - 1));
502 			 addr[rh0->ip6r0_segleft - 1] = finaldst;
503 			 /* XXX */
504 			 in6_clearscope(addr + rh0->ip6r0_segleft - 1);
505 			 break;
506 		default:	/* is it possible? */
507 			 error = EINVAL;
508 			 goto bad;
509 		}
510 	}
511 
512 	/* Source address validation */
513 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
514 	    (flags & IPV6_UNSPECSRC) == 0) {
515 		error = EOPNOTSUPP;
516 		ip6stat.ip6s_badscope++;
517 		goto bad;
518 	}
519 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
520 		error = EOPNOTSUPP;
521 		ip6stat.ip6s_badscope++;
522 		goto bad;
523 	}
524 
525 	ip6stat.ip6s_localout++;
526 
527 	/*
528 	 * Route packet.
529 	 */
530 	/* initialize cached route */
531 	if (ro == 0) {
532 		ro = &ip6route;
533 		bzero((caddr_t)ro, sizeof(*ro));
534 	}
535 	ro_pmtu = ro;
536 	if (opt && opt->ip6po_rthdr)
537 		ro = &opt->ip6po_route;
538 	dst = (struct sockaddr_in6 *)&ro->ro_dst;
539 
540  	/*
541 	 * if specified, try to fill in the traffic class field.
542 	 * do not override if a non-zero value is already set.
543 	 * we check the diffserv field and the ecn field separately.
544 	 */
545 	if (opt && opt->ip6po_tclass >= 0) {
546 		int mask = 0;
547 
548 		if ((ip6->ip6_flow & htonl(0xfc << 20)) == 0)
549 			mask |= 0xfc;
550 		if ((ip6->ip6_flow & htonl(0x03 << 20)) == 0)
551 			mask |= 0x03;
552 		if (mask != 0)
553 			ip6->ip6_flow |= htonl((opt->ip6po_tclass & mask) << 20);
554 	}
555 
556 	/* fill in or override the hop limit field, if necessary. */
557 	if (opt && opt->ip6po_hlim != -1)
558 		ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
559 	else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
560 		if (im6o != NULL)
561 			ip6->ip6_hlim = im6o->im6o_multicast_hlim;
562 		else
563 			ip6->ip6_hlim = ip6_defmcasthlim;
564 	}
565 
566 #ifdef IPSEC
567 	if (needipsec && needipsectun) {
568 		struct ipsec_output_state state;
569 
570 		/*
571 		 * All the extension headers will become inaccessible
572 		 * (since they can be encrypted).
573 		 * Don't panic, we need no more updates to extension headers
574 		 * on inner IPv6 packet (since they are now encapsulated).
575 		 *
576 		 * IPv6 [ESP|AH] IPv6 [extension headers] payload
577 		 */
578 		bzero(&exthdrs, sizeof(exthdrs));
579 		exthdrs.ip6e_ip6 = m;
580 
581 		bzero(&state, sizeof(state));
582 		state.m = m;
583 		state.ro = (struct route *)ro;
584 		state.dst = (struct sockaddr *)dst;
585 
586 		error = ipsec6_output_tunnel(&state, sp, flags);
587 
588 		m = state.m;
589 		ro_pmtu = ro = (struct route_in6 *)state.ro;
590 		dst = (struct sockaddr_in6 *)state.dst;
591 		if (error) {
592 			/* mbuf is already reclaimed in ipsec6_output_tunnel. */
593 			m0 = m = NULL;
594 			m = NULL;
595 			switch (error) {
596 			case EHOSTUNREACH:
597 			case ENETUNREACH:
598 			case EMSGSIZE:
599 			case ENOBUFS:
600 			case ENOMEM:
601 				break;
602 			default:
603 				printf("ip6_output (ipsec): error code %d\n", error);
604 				/* FALLTHROUGH */
605 			case ENOENT:
606 				/* don't show these error codes to the user */
607 				error = 0;
608 				break;
609 			}
610 			goto bad;
611 		}
612 
613 		exthdrs.ip6e_ip6 = m;
614 	}
615 #endif /* IPSEC */
616 
617 	/* adjust pointer */
618 	ip6 = mtod(m, struct ip6_hdr *);
619 
620 	bzero(&dst_sa, sizeof(dst_sa));
621 	dst_sa.sin6_family = AF_INET6;
622 	dst_sa.sin6_len = sizeof(dst_sa);
623 	dst_sa.sin6_addr = ip6->ip6_dst;
624 	if ((error = in6_selectroute(&dst_sa, opt, im6o, ro, &ifp, &rt, 0))
625 	    != 0) {
626 		switch (error) {
627 		case EHOSTUNREACH:
628 			ip6stat.ip6s_noroute++;
629 			break;
630 		case EADDRNOTAVAIL:
631 		default:
632 			break; /* XXX statistics? */
633 		}
634 		if (ifp != NULL)
635 			in6_ifstat_inc(ifp, ifs6_out_discard);
636 		goto bad;
637 	}
638 	if (rt == NULL) {
639 		/*
640 		 * If in6_selectroute() does not return a route entry,
641 		 * dst may not have been updated.
642 		 */
643 		*dst = dst_sa;	/* XXX */
644 	}
645 
646 	/*
647 	 * then rt (for unicast) and ifp must be non-NULL valid values.
648 	 */
649 	if ((flags & IPV6_FORWARDING) == 0) {
650 		/* XXX: the FORWARDING flag can be set for mrouting. */
651 		in6_ifstat_inc(ifp, ifs6_out_request);
652 	}
653 	if (rt != NULL) {
654 		ia = (struct in6_ifaddr *)(rt->rt_ifa);
655 		rt->rt_use++;
656 	}
657 
658 	/*
659 	 * The outgoing interface must be in the zone of source and
660 	 * destination addresses.  We should use ia_ifp to support the
661 	 * case of sending packets to an address of our own.
662 	 */
663 	if (ia != NULL && ia->ia_ifp)
664 		origifp = ia->ia_ifp;
665 	else
666 		origifp = ifp;
667 
668 	src0 = ip6->ip6_src;
669 	if (in6_setscope(&src0, origifp, &zone))
670 		goto badscope;
671 	bzero(&src_sa, sizeof(src_sa));
672 	src_sa.sin6_family = AF_INET6;
673 	src_sa.sin6_len = sizeof(src_sa);
674 	src_sa.sin6_addr = ip6->ip6_src;
675 	if (sa6_recoverscope(&src_sa) || zone != src_sa.sin6_scope_id)
676 		goto badscope;
677 
678 	dst0 = ip6->ip6_dst;
679 	if (in6_setscope(&dst0, origifp, &zone))
680 		goto badscope;
681 	/* re-initialize to be sure */
682 	bzero(&dst_sa, sizeof(dst_sa));
683 	dst_sa.sin6_family = AF_INET6;
684 	dst_sa.sin6_len = sizeof(dst_sa);
685 	dst_sa.sin6_addr = ip6->ip6_dst;
686 	if (sa6_recoverscope(&dst_sa) || zone != dst_sa.sin6_scope_id)
687 		goto badscope;
688 
689 	/* scope check is done. */
690 	goto routefound;
691 
692   badscope:
693 	ip6stat.ip6s_badscope++;
694 	in6_ifstat_inc(origifp, ifs6_out_discard);
695 	if (error == 0)
696 		error = EHOSTUNREACH; /* XXX */
697 	goto bad;
698 
699   routefound:
700 	if (rt && !IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
701 		if (opt && opt->ip6po_nextroute.ro_rt) {
702 			/*
703 			 * The nexthop is explicitly specified by the
704 			 * application.  We assume the next hop is an IPv6
705 			 * address.
706 			 */
707 			dst = (struct sockaddr_in6 *)opt->ip6po_nexthop;
708 		} else if ((rt->rt_flags & RTF_GATEWAY))
709 			dst = (struct sockaddr_in6 *)rt->rt_gateway;
710 	}
711 
712 	/*
713 	 * XXXXXX: original code follows:
714 	 */
715 	if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
716 		m->m_flags &= ~(M_BCAST | M_MCAST);	/* just in case */
717 	else {
718 		struct	in6_multi *in6m;
719 
720 		m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
721 
722 		in6_ifstat_inc(ifp, ifs6_out_mcast);
723 
724 		/*
725 		 * Confirm that the outgoing interface supports multicast.
726 		 */
727 		if (!(ifp->if_flags & IFF_MULTICAST)) {
728 			ip6stat.ip6s_noroute++;
729 			in6_ifstat_inc(ifp, ifs6_out_discard);
730 			error = ENETUNREACH;
731 			goto bad;
732 		}
733 
734 		IN6_LOOKUP_MULTI(ip6->ip6_dst, ifp, in6m);
735 		if (in6m != NULL &&
736 		   (im6o == NULL || im6o->im6o_multicast_loop)) {
737 			/*
738 			 * If we belong to the destination multicast group
739 			 * on the outgoing interface, and the caller did not
740 			 * forbid loopback, loop back a copy.
741 			 */
742 			ip6_mloopback(ifp, m, dst);
743 		} else {
744 			/*
745 			 * If we are acting as a multicast router, perform
746 			 * multicast forwarding as if the packet had just
747 			 * arrived on the interface to which we are about
748 			 * to send.  The multicast forwarding function
749 			 * recursively calls this function, using the
750 			 * IPV6_FORWARDING flag to prevent infinite recursion.
751 			 *
752 			 * Multicasts that are looped back by ip6_mloopback(),
753 			 * above, will be forwarded by the ip6_input() routine,
754 			 * if necessary.
755 			 */
756 			if (ip6_mrouter && (flags & IPV6_FORWARDING) == 0) {
757 				if (ip6_mforward(ip6, ifp, m) != 0) {
758 					m_freem(m);
759 					goto done;
760 				}
761 			}
762 		}
763 		/*
764 		 * Multicasts with a hoplimit of zero may be looped back,
765 		 * above, but must not be transmitted on a network.
766 		 * Also, multicasts addressed to the loopback interface
767 		 * are not sent -- the above call to ip6_mloopback() will
768 		 * loop back a copy if this host actually belongs to the
769 		 * destination group on the loopback interface.
770 		 */
771 		if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK) ||
772 		    IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst)) {
773 			m_freem(m);
774 			goto done;
775 		}
776 	}
777 
778 	/*
779 	 * Fill the outgoing inteface to tell the upper layer
780 	 * to increment per-interface statistics.
781 	 */
782 	if (ifpp)
783 		*ifpp = ifp;
784 
785 	/* Determine path MTU. */
786 	if ((error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, &mtu,
787 	    &alwaysfrag)) != 0)
788 		goto bad;
789 #ifdef IPSEC
790 	if (needipsectun)
791 		mtu = IPV6_MMTU;
792 #endif
793 
794 	/*
795 	 * The caller of this function may specify to use the minimum MTU
796 	 * in some cases.
797 	 * An advanced API option (IPV6_USE_MIN_MTU) can also override MTU
798 	 * setting.  The logic is a bit complicated; by default, unicast
799 	 * packets will follow path MTU while multicast packets will be sent at
800 	 * the minimum MTU.  If IP6PO_MINMTU_ALL is specified, all packets
801 	 * including unicast ones will be sent at the minimum MTU.  Multicast
802 	 * packets will always be sent at the minimum MTU unless
803 	 * IP6PO_MINMTU_DISABLE is explicitly specified.
804 	 * See RFC 3542 for more details.
805 	 */
806 	if (mtu > IPV6_MMTU) {
807 		if ((flags & IPV6_MINMTU))
808 			mtu = IPV6_MMTU;
809 		else if (opt && opt->ip6po_minmtu == IP6PO_MINMTU_ALL)
810 			mtu = IPV6_MMTU;
811 		else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
812 			 (opt == NULL ||
813 			  opt->ip6po_minmtu != IP6PO_MINMTU_DISABLE)) {
814 			mtu = IPV6_MMTU;
815 		}
816 	}
817 
818 	/*
819 	 * clear embedded scope identifiers if necessary.
820 	 * in6_clearscope will touch the addresses only when necessary.
821 	 */
822 	in6_clearscope(&ip6->ip6_src);
823 	in6_clearscope(&ip6->ip6_dst);
824 
825 	/*
826 	 * If the outgoing packet contains a hop-by-hop options header,
827 	 * it must be examined and processed even by the source node.
828 	 * (RFC 2460, section 4.)
829 	 */
830 	if (exthdrs.ip6e_hbh) {
831 		struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh, struct ip6_hbh *);
832 		u_int32_t dummy1; /* XXX unused */
833 		u_int32_t dummy2; /* XXX unused */
834 
835 		/*
836 		 *  XXX: if we have to send an ICMPv6 error to the sender,
837 		 *       we need the M_LOOP flag since icmp6_error() expects
838 		 *       the IPv6 and the hop-by-hop options header are
839 		 *       continuous unless the flag is set.
840 		 */
841 		m->m_flags |= M_LOOP;
842 		m->m_pkthdr.rcvif = ifp;
843 		if (ip6_process_hopopts(m, (u_int8_t *)(hbh + 1),
844 		    ((hbh->ip6h_len + 1) << 3) - sizeof(struct ip6_hbh),
845 		    &dummy1, &dummy2) < 0) {
846 			/* m was already freed at this point */
847 			error = EINVAL;/* better error? */
848 			goto done;
849 		}
850 		m->m_flags &= ~M_LOOP; /* XXX */
851 		m->m_pkthdr.rcvif = NULL;
852 	}
853 
854 #ifdef PFIL_HOOKS
855 	/*
856 	 * Run through list of hooks for output packets.
857 	 */
858 	if ((error = pfil_run_hooks(&inet6_pfil_hook, &m, ifp, PFIL_OUT)) != 0)
859 		goto done;
860 	if (m == NULL)
861 		goto done;
862 	ip6 = mtod(m, struct ip6_hdr *);
863 #endif /* PFIL_HOOKS */
864 	/*
865 	 * Send the packet to the outgoing interface.
866 	 * If necessary, do IPv6 fragmentation before sending.
867 	 *
868 	 * the logic here is rather complex:
869 	 * 1: normal case (dontfrag == 0, alwaysfrag == 0)
870 	 * 1-a:	send as is if tlen <= path mtu
871 	 * 1-b:	fragment if tlen > path mtu
872 	 *
873 	 * 2: if user asks us not to fragment (dontfrag == 1)
874 	 * 2-a:	send as is if tlen <= interface mtu
875 	 * 2-b:	error if tlen > interface mtu
876 	 *
877 	 * 3: if we always need to attach fragment header (alwaysfrag == 1)
878 	 *	always fragment
879 	 *
880 	 * 4: if dontfrag == 1 && alwaysfrag == 1
881 	 *	error, as we cannot handle this conflicting request
882 	 */
883 	tlen = m->m_pkthdr.len;
884 
885 	if (opt && (opt->ip6po_flags & IP6PO_DONTFRAG))
886 		dontfrag = 1;
887 	else
888 		dontfrag = 0;
889 
890 	if (dontfrag && alwaysfrag) {	/* case 4 */
891 		/* conflicting request - can't transmit */
892 		error = EMSGSIZE;
893 		goto bad;
894 	}
895 	if (dontfrag && tlen > IN6_LINKMTU(ifp)) {	/* case 2-b */
896 		/*
897 		 * Even if the DONTFRAG option is specified, we cannot send the
898 		 * packet when the data length is larger than the MTU of the
899 		 * outgoing interface.
900 		 * Notify the error by sending IPV6_PATHMTU ancillary data as
901 		 * well as returning an error code (the latter is not described
902 		 * in the API spec.)
903 		 */
904 		u_int32_t mtu32;
905 		struct ip6ctlparam ip6cp;
906 
907 		mtu32 = (u_int32_t)mtu;
908 		bzero(&ip6cp, sizeof(ip6cp));
909 		ip6cp.ip6c_cmdarg = (void *)&mtu32;
910 		pfctlinput2(PRC_MSGSIZE, (struct sockaddr *)&ro_pmtu->ro_dst,
911 		    (void *)&ip6cp);
912 
913 		error = EMSGSIZE;
914 		goto bad;
915 	}
916 
917 	/*
918 	 * transmit packet without fragmentation
919 	 */
920 	if (dontfrag || (!alwaysfrag && tlen <= mtu)) {	/* case 1-a and 2-a */
921 		struct in6_ifaddr *ia6;
922 		int sw_csum;
923 
924 		ip6 = mtod(m, struct ip6_hdr *);
925 		ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
926 		if (ia6) {
927 			/* Record statistics for this interface address. */
928 			ia6->ia_ifa.ifa_data.ifad_outbytes += m->m_pkthdr.len;
929 		}
930 #ifdef IPSEC
931 		/* clean ipsec history once it goes out of the node */
932 		ipsec_delaux(m);
933 #endif
934 
935 		sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_csum_flags_tx;
936 		if ((sw_csum & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0) {
937 			if (IN6_NEED_CHECKSUM(ifp,
938 			    sw_csum & (M_CSUM_UDPv6|M_CSUM_TCPv6))) {
939 				in6_delayed_cksum(m);
940 			}
941 			m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
942 		}
943 
944 		error = nd6_output(ifp, origifp, m, dst, rt);
945 		goto done;
946 	}
947 
948 	/*
949 	 * try to fragment the packet.  case 1-b and 3
950 	 */
951 	if (mtu < IPV6_MMTU) {
952 		/* path MTU cannot be less than IPV6_MMTU */
953 		error = EMSGSIZE;
954 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
955 		goto bad;
956 	} else if (ip6->ip6_plen == 0) {
957 		/* jumbo payload cannot be fragmented */
958 		error = EMSGSIZE;
959 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
960 		goto bad;
961 	} else {
962 		struct mbuf **mnext, *m_frgpart;
963 		struct ip6_frag *ip6f;
964 		u_int32_t id = htonl(ip6_randomid());
965 		u_char nextproto;
966 #if 0				/* see below */
967 		struct ip6ctlparam ip6cp;
968 		u_int32_t mtu32;
969 #endif
970 
971 		/*
972 		 * Too large for the destination or interface;
973 		 * fragment if possible.
974 		 * Must be able to put at least 8 bytes per fragment.
975 		 */
976 		hlen = unfragpartlen;
977 		if (mtu > IPV6_MAXPACKET)
978 			mtu = IPV6_MAXPACKET;
979 
980 #if 0
981 		/*
982 		 * It is believed this code is a leftover from the
983 		 * development of the IPV6_RECVPATHMTU sockopt and
984 		 * associated work to implement RFC3542.
985 		 * It's not entirely clear what the intent of the API
986 		 * is at this point, so disable this code for now.
987 		 * The IPV6_RECVPATHMTU sockopt and/or IPV6_DONTFRAG
988 		 * will send notifications if the application requests.
989 		 */
990 
991 		/* Notify a proper path MTU to applications. */
992 		mtu32 = (u_int32_t)mtu;
993 		bzero(&ip6cp, sizeof(ip6cp));
994 		ip6cp.ip6c_cmdarg = (void *)&mtu32;
995 		pfctlinput2(PRC_MSGSIZE, (struct sockaddr *)&ro_pmtu->ro_dst,
996 		    (void *)&ip6cp);
997 #endif
998 
999 		len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
1000 		if (len < 8) {
1001 			error = EMSGSIZE;
1002 			in6_ifstat_inc(ifp, ifs6_out_fragfail);
1003 			goto bad;
1004 		}
1005 
1006 		mnext = &m->m_nextpkt;
1007 
1008 		/*
1009 		 * Change the next header field of the last header in the
1010 		 * unfragmentable part.
1011 		 */
1012 		if (exthdrs.ip6e_rthdr) {
1013 			nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
1014 			*mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
1015 		} else if (exthdrs.ip6e_dest1) {
1016 			nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
1017 			*mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
1018 		} else if (exthdrs.ip6e_hbh) {
1019 			nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
1020 			*mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
1021 		} else {
1022 			nextproto = ip6->ip6_nxt;
1023 			ip6->ip6_nxt = IPPROTO_FRAGMENT;
1024 		}
1025 
1026 		if ((m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6))
1027 		    != 0) {
1028 			if (IN6_NEED_CHECKSUM(ifp,
1029 			    m->m_pkthdr.csum_flags &
1030 			    (M_CSUM_UDPv6|M_CSUM_TCPv6))) {
1031 				in6_delayed_cksum(m);
1032 			}
1033 			m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
1034 		}
1035 
1036 		/*
1037 		 * Loop through length of segment after first fragment,
1038 		 * make new header and copy data of each part and link onto
1039 		 * chain.
1040 		 */
1041 		m0 = m;
1042 		for (off = hlen; off < tlen; off += len) {
1043 			struct mbuf *mlast;
1044 
1045 			MGETHDR(m, M_DONTWAIT, MT_HEADER);
1046 			if (!m) {
1047 				error = ENOBUFS;
1048 				ip6stat.ip6s_odropped++;
1049 				goto sendorfree;
1050 			}
1051 			m->m_pkthdr.rcvif = NULL;
1052 			m->m_flags = m0->m_flags & M_COPYFLAGS;
1053 			*mnext = m;
1054 			mnext = &m->m_nextpkt;
1055 			m->m_data += max_linkhdr;
1056 			mhip6 = mtod(m, struct ip6_hdr *);
1057 			*mhip6 = *ip6;
1058 			m->m_len = sizeof(*mhip6);
1059 			error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
1060 			if (error) {
1061 				ip6stat.ip6s_odropped++;
1062 				goto sendorfree;
1063 			}
1064 			ip6f->ip6f_offlg = htons((u_int16_t)((off - hlen) & ~7));
1065 			if (off + len >= tlen)
1066 				len = tlen - off;
1067 			else
1068 				ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
1069 			mhip6->ip6_plen = htons((u_int16_t)(len + hlen +
1070 			    sizeof(*ip6f) - sizeof(struct ip6_hdr)));
1071 			if ((m_frgpart = m_copy(m0, off, len)) == 0) {
1072 				error = ENOBUFS;
1073 				ip6stat.ip6s_odropped++;
1074 				goto sendorfree;
1075 			}
1076 			for (mlast = m; mlast->m_next; mlast = mlast->m_next)
1077 				;
1078 			mlast->m_next = m_frgpart;
1079 			m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
1080 			m->m_pkthdr.rcvif = (struct ifnet *)0;
1081 			ip6f->ip6f_reserved = 0;
1082 			ip6f->ip6f_ident = id;
1083 			ip6f->ip6f_nxt = nextproto;
1084 			ip6stat.ip6s_ofragments++;
1085 			in6_ifstat_inc(ifp, ifs6_out_fragcreat);
1086 		}
1087 
1088 		in6_ifstat_inc(ifp, ifs6_out_fragok);
1089 	}
1090 
1091 	/*
1092 	 * Remove leading garbages.
1093 	 */
1094 sendorfree:
1095 	m = m0->m_nextpkt;
1096 	m0->m_nextpkt = 0;
1097 	m_freem(m0);
1098 	for (m0 = m; m; m = m0) {
1099 		m0 = m->m_nextpkt;
1100 		m->m_nextpkt = 0;
1101 		if (error == 0) {
1102 			struct in6_ifaddr *ia6;
1103 			ip6 = mtod(m, struct ip6_hdr *);
1104 			ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
1105 			if (ia6) {
1106 				/*
1107 				 * Record statistics for this interface
1108 				 * address.
1109 				 */
1110 				ia6->ia_ifa.ifa_data.ifad_outbytes +=
1111 				    m->m_pkthdr.len;
1112 			}
1113 #ifdef IPSEC
1114 			/* clean ipsec history once it goes out of the node */
1115 			ipsec_delaux(m);
1116 #endif
1117 			error = nd6_output(ifp, origifp, m, dst, rt);
1118 		} else
1119 			m_freem(m);
1120 	}
1121 
1122 	if (error == 0)
1123 		ip6stat.ip6s_fragmented++;
1124 
1125 done:
1126 	if (ro == &ip6route && ro->ro_rt) { /* brace necessary for RTFREE */
1127 		RTFREE(ro->ro_rt);
1128 	} else if (ro_pmtu == &ip6route && ro_pmtu->ro_rt) {
1129 		RTFREE(ro_pmtu->ro_rt);
1130 	}
1131 
1132 #ifdef IPSEC
1133 	if (sp != NULL)
1134 		key_freesp(sp);
1135 #endif /* IPSEC */
1136 
1137 	return (error);
1138 
1139 freehdrs:
1140 	m_freem(exthdrs.ip6e_hbh);	/* m_freem will check if mbuf is 0 */
1141 	m_freem(exthdrs.ip6e_dest1);
1142 	m_freem(exthdrs.ip6e_rthdr);
1143 	m_freem(exthdrs.ip6e_dest2);
1144 	/* FALLTHROUGH */
1145 bad:
1146 	m_freem(m);
1147 	goto done;
1148 }
1149 
1150 static int
1151 ip6_copyexthdr(mp, hdr, hlen)
1152 	struct mbuf **mp;
1153 	caddr_t hdr;
1154 	int hlen;
1155 {
1156 	struct mbuf *m;
1157 
1158 	if (hlen > MCLBYTES)
1159 		return (ENOBUFS); /* XXX */
1160 
1161 	MGET(m, M_DONTWAIT, MT_DATA);
1162 	if (!m)
1163 		return (ENOBUFS);
1164 
1165 	if (hlen > MLEN) {
1166 		MCLGET(m, M_DONTWAIT);
1167 		if ((m->m_flags & M_EXT) == 0) {
1168 			m_free(m);
1169 			return (ENOBUFS);
1170 		}
1171 	}
1172 	m->m_len = hlen;
1173 	if (hdr)
1174 		bcopy(hdr, mtod(m, caddr_t), hlen);
1175 
1176 	*mp = m;
1177 	return (0);
1178 }
1179 
1180 /*
1181  * Process a delayed payload checksum calculation.
1182  */
1183 void
1184 in6_delayed_cksum(struct mbuf *m)
1185 {
1186 	uint16_t csum, offset;
1187 
1188 	KASSERT((m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0);
1189 	KASSERT((~m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0);
1190 	KASSERT((m->m_pkthdr.csum_flags
1191 	    & (M_CSUM_UDPv4|M_CSUM_TCPv4|M_CSUM_TSOv4)) == 0);
1192 
1193 	offset = M_CSUM_DATA_IPv6_HL(m->m_pkthdr.csum_data);
1194 	csum = in6_cksum(m, 0, offset, m->m_pkthdr.len - offset);
1195 	if (csum == 0 && (m->m_pkthdr.csum_flags & M_CSUM_UDPv6) != 0) {
1196 		csum = 0xffff;
1197 	}
1198 
1199 	offset += M_CSUM_DATA_IPv6_OFFSET(m->m_pkthdr.csum_data);
1200 	if ((offset + sizeof(csum)) > m->m_len) {
1201 		m_copyback(m, offset, sizeof(csum), &csum);
1202 	} else {
1203 		*(uint16_t *)(mtod(m, caddr_t) + offset) = csum;
1204 	}
1205 }
1206 
1207 /*
1208  * Insert jumbo payload option.
1209  */
1210 static int
1211 ip6_insert_jumboopt(exthdrs, plen)
1212 	struct ip6_exthdrs *exthdrs;
1213 	u_int32_t plen;
1214 {
1215 	struct mbuf *mopt;
1216 	u_int8_t *optbuf;
1217 	u_int32_t v;
1218 
1219 #define JUMBOOPTLEN	8	/* length of jumbo payload option and padding */
1220 
1221 	/*
1222 	 * If there is no hop-by-hop options header, allocate new one.
1223 	 * If there is one but it doesn't have enough space to store the
1224 	 * jumbo payload option, allocate a cluster to store the whole options.
1225 	 * Otherwise, use it to store the options.
1226 	 */
1227 	if (exthdrs->ip6e_hbh == 0) {
1228 		MGET(mopt, M_DONTWAIT, MT_DATA);
1229 		if (mopt == 0)
1230 			return (ENOBUFS);
1231 		mopt->m_len = JUMBOOPTLEN;
1232 		optbuf = mtod(mopt, u_int8_t *);
1233 		optbuf[1] = 0;	/* = ((JUMBOOPTLEN) >> 3) - 1 */
1234 		exthdrs->ip6e_hbh = mopt;
1235 	} else {
1236 		struct ip6_hbh *hbh;
1237 
1238 		mopt = exthdrs->ip6e_hbh;
1239 		if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
1240 			/*
1241 			 * XXX assumption:
1242 			 * - exthdrs->ip6e_hbh is not referenced from places
1243 			 *   other than exthdrs.
1244 			 * - exthdrs->ip6e_hbh is not an mbuf chain.
1245 			 */
1246 			int oldoptlen = mopt->m_len;
1247 			struct mbuf *n;
1248 
1249 			/*
1250 			 * XXX: give up if the whole (new) hbh header does
1251 			 * not fit even in an mbuf cluster.
1252 			 */
1253 			if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
1254 				return (ENOBUFS);
1255 
1256 			/*
1257 			 * As a consequence, we must always prepare a cluster
1258 			 * at this point.
1259 			 */
1260 			MGET(n, M_DONTWAIT, MT_DATA);
1261 			if (n) {
1262 				MCLGET(n, M_DONTWAIT);
1263 				if ((n->m_flags & M_EXT) == 0) {
1264 					m_freem(n);
1265 					n = NULL;
1266 				}
1267 			}
1268 			if (!n)
1269 				return (ENOBUFS);
1270 			n->m_len = oldoptlen + JUMBOOPTLEN;
1271 			bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t),
1272 			    oldoptlen);
1273 			optbuf = mtod(n, u_int8_t *) + oldoptlen;
1274 			m_freem(mopt);
1275 			mopt = exthdrs->ip6e_hbh = n;
1276 		} else {
1277 			optbuf = mtod(mopt, u_int8_t *) + mopt->m_len;
1278 			mopt->m_len += JUMBOOPTLEN;
1279 		}
1280 		optbuf[0] = IP6OPT_PADN;
1281 		optbuf[1] = 0;
1282 
1283 		/*
1284 		 * Adjust the header length according to the pad and
1285 		 * the jumbo payload option.
1286 		 */
1287 		hbh = mtod(mopt, struct ip6_hbh *);
1288 		hbh->ip6h_len += (JUMBOOPTLEN >> 3);
1289 	}
1290 
1291 	/* fill in the option. */
1292 	optbuf[2] = IP6OPT_JUMBO;
1293 	optbuf[3] = 4;
1294 	v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
1295 	bcopy(&v, &optbuf[4], sizeof(u_int32_t));
1296 
1297 	/* finally, adjust the packet header length */
1298 	exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
1299 
1300 	return (0);
1301 #undef JUMBOOPTLEN
1302 }
1303 
1304 /*
1305  * Insert fragment header and copy unfragmentable header portions.
1306  */
1307 static int
1308 ip6_insertfraghdr(m0, m, hlen, frghdrp)
1309 	struct mbuf *m0, *m;
1310 	int hlen;
1311 	struct ip6_frag **frghdrp;
1312 {
1313 	struct mbuf *n, *mlast;
1314 
1315 	if (hlen > sizeof(struct ip6_hdr)) {
1316 		n = m_copym(m0, sizeof(struct ip6_hdr),
1317 		    hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
1318 		if (n == 0)
1319 			return (ENOBUFS);
1320 		m->m_next = n;
1321 	} else
1322 		n = m;
1323 
1324 	/* Search for the last mbuf of unfragmentable part. */
1325 	for (mlast = n; mlast->m_next; mlast = mlast->m_next)
1326 		;
1327 
1328 	if ((mlast->m_flags & M_EXT) == 0 &&
1329 	    M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
1330 		/* use the trailing space of the last mbuf for the fragment hdr */
1331 		*frghdrp = (struct ip6_frag *)(mtod(mlast, caddr_t) +
1332 		    mlast->m_len);
1333 		mlast->m_len += sizeof(struct ip6_frag);
1334 		m->m_pkthdr.len += sizeof(struct ip6_frag);
1335 	} else {
1336 		/* allocate a new mbuf for the fragment header */
1337 		struct mbuf *mfrg;
1338 
1339 		MGET(mfrg, M_DONTWAIT, MT_DATA);
1340 		if (mfrg == 0)
1341 			return (ENOBUFS);
1342 		mfrg->m_len = sizeof(struct ip6_frag);
1343 		*frghdrp = mtod(mfrg, struct ip6_frag *);
1344 		mlast->m_next = mfrg;
1345 	}
1346 
1347 	return (0);
1348 }
1349 
1350 static int
1351 ip6_getpmtu(ro_pmtu, ro, ifp, dst, mtup, alwaysfragp)
1352 	struct route_in6 *ro_pmtu, *ro;
1353 	struct ifnet *ifp;
1354 	struct in6_addr *dst;
1355 	u_long *mtup;
1356 	int *alwaysfragp;
1357 {
1358 	u_int32_t mtu = 0;
1359 	int alwaysfrag = 0;
1360 	int error = 0;
1361 
1362 	if (ro_pmtu != ro) {
1363 		/* The first hop and the final destination may differ. */
1364 		struct sockaddr_in6 *sa6_dst =
1365 		    (struct sockaddr_in6 *)&ro_pmtu->ro_dst;
1366 		if (ro_pmtu->ro_rt &&
1367 		    ((ro_pmtu->ro_rt->rt_flags & RTF_UP) == 0 ||
1368 		      !IN6_ARE_ADDR_EQUAL(&sa6_dst->sin6_addr, dst))) {
1369 			RTFREE(ro_pmtu->ro_rt);
1370 			ro_pmtu->ro_rt = (struct rtentry *)NULL;
1371 		}
1372 		if (ro_pmtu->ro_rt == NULL) {
1373 			bzero(sa6_dst, sizeof(*sa6_dst)); /* for safety */
1374 			sa6_dst->sin6_family = AF_INET6;
1375 			sa6_dst->sin6_len = sizeof(struct sockaddr_in6);
1376 			sa6_dst->sin6_addr = *dst;
1377 
1378 			rtalloc((struct route *)ro_pmtu);
1379 		}
1380 	}
1381 	if (ro_pmtu->ro_rt) {
1382 		u_int32_t ifmtu;
1383 
1384 		if (ifp == NULL)
1385 			ifp = ro_pmtu->ro_rt->rt_ifp;
1386 		ifmtu = IN6_LINKMTU(ifp);
1387 		mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
1388 		if (mtu == 0)
1389 			mtu = ifmtu;
1390 		else if (mtu < IPV6_MMTU) {
1391 			/*
1392 			 * RFC2460 section 5, last paragraph:
1393 			 * if we record ICMPv6 too big message with
1394 			 * mtu < IPV6_MMTU, transmit packets sized IPV6_MMTU
1395 			 * or smaller, with fragment header attached.
1396 			 * (fragment header is needed regardless from the
1397 			 * packet size, for translators to identify packets)
1398 			 */
1399 			alwaysfrag = 1;
1400 			mtu = IPV6_MMTU;
1401 		} else if (mtu > ifmtu) {
1402 			/*
1403 			 * The MTU on the route is larger than the MTU on
1404 			 * the interface!  This shouldn't happen, unless the
1405 			 * MTU of the interface has been changed after the
1406 			 * interface was brought up.  Change the MTU in the
1407 			 * route to match the interface MTU (as long as the
1408 			 * field isn't locked).
1409 			 */
1410 			mtu = ifmtu;
1411 			if (!(ro_pmtu->ro_rt->rt_rmx.rmx_locks & RTV_MTU))
1412 				ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu;
1413 		}
1414 	} else if (ifp) {
1415 		mtu = IN6_LINKMTU(ifp);
1416 	} else
1417 		error = EHOSTUNREACH; /* XXX */
1418 
1419 	*mtup = mtu;
1420 	if (alwaysfragp)
1421 		*alwaysfragp = alwaysfrag;
1422 	return (error);
1423 }
1424 
1425 /*
1426  * IP6 socket option processing.
1427  */
1428 int
1429 ip6_ctloutput(op, so, level, optname, mp)
1430 	int op;
1431 	struct socket *so;
1432 	int level, optname;
1433 	struct mbuf **mp;
1434 {
1435 	int privileged, optdatalen, uproto;
1436 	void *optdata;
1437 	struct in6pcb *in6p = sotoin6pcb(so);
1438 	struct mbuf *m = *mp;
1439 	int error, optval;
1440 	int optlen;
1441 	struct lwp *l = curlwp;	/* XXX */
1442 
1443 	optlen = m ? m->m_len : 0;
1444 	error = optval = 0;
1445 	privileged = (l == 0 || kauth_authorize_generic(l->l_cred,
1446 	    KAUTH_GENERIC_ISSUSER, &l->l_acflag)) ? 0 : 1;
1447 	uproto = (int)so->so_proto->pr_protocol;
1448 
1449 	if (level == IPPROTO_IPV6) {
1450 		switch (op) {
1451 		case PRCO_SETOPT:
1452 			switch (optname) {
1453 #ifdef RFC2292
1454 			case IPV6_2292PKTOPTIONS:
1455 				/* m is freed in ip6_pcbopts */
1456 				error = ip6_pcbopts(&in6p->in6p_outputopts,
1457 				    m, so);
1458 				break;
1459 #endif
1460 
1461 			/*
1462 			 * Use of some Hop-by-Hop options or some
1463 			 * Destination options, might require special
1464 			 * privilege.  That is, normal applications
1465 			 * (without special privilege) might be forbidden
1466 			 * from setting certain options in outgoing packets,
1467 			 * and might never see certain options in received
1468 			 * packets. [RFC 2292 Section 6]
1469 			 * KAME specific note:
1470 			 *  KAME prevents non-privileged users from sending or
1471 			 *  receiving ANY hbh/dst options in order to avoid
1472 			 *  overhead of parsing options in the kernel.
1473 			 */
1474 			case IPV6_RECVHOPOPTS:
1475 			case IPV6_RECVDSTOPTS:
1476 			case IPV6_RECVRTHDRDSTOPTS:
1477 				if (!privileged) {
1478 					error = EPERM;
1479 					break;
1480 				}
1481 				/* FALLTHROUGH */
1482 			case IPV6_UNICAST_HOPS:
1483 			case IPV6_HOPLIMIT:
1484 			case IPV6_FAITH:
1485 
1486 			case IPV6_RECVPKTINFO:
1487 			case IPV6_RECVHOPLIMIT:
1488 			case IPV6_RECVRTHDR:
1489 			case IPV6_RECVPATHMTU:
1490 			case IPV6_RECVTCLASS:
1491 			case IPV6_V6ONLY:
1492 				if (optlen != sizeof(int)) {
1493 					error = EINVAL;
1494 					break;
1495 				}
1496 				optval = *mtod(m, int *);
1497 				switch (optname) {
1498 
1499 				case IPV6_UNICAST_HOPS:
1500 					if (optval < -1 || optval >= 256)
1501 						error = EINVAL;
1502 					else {
1503 						/* -1 = kernel default */
1504 						in6p->in6p_hops = optval;
1505 					}
1506 					break;
1507 #define OPTSET(bit) \
1508 do { \
1509 	if (optval) \
1510 		in6p->in6p_flags |= (bit); \
1511 	else \
1512 		in6p->in6p_flags &= ~(bit); \
1513 } while (/*CONSTCOND*/ 0)
1514 
1515 #ifdef RFC2292
1516 #define OPTSET2292(bit) 			\
1517 do { 						\
1518 	in6p->in6p_flags |= IN6P_RFC2292; 	\
1519 	if (optval) 				\
1520 		in6p->in6p_flags |= (bit); 	\
1521 	else 					\
1522 		in6p->in6p_flags &= ~(bit); 	\
1523 } while (/*CONSTCOND*/ 0)
1524 #endif
1525 
1526 #define OPTBIT(bit) (in6p->in6p_flags & (bit) ? 1 : 0)
1527 
1528 				case IPV6_RECVPKTINFO:
1529 #ifdef RFC2292
1530 					/* cannot mix with RFC2292 */
1531 					if (OPTBIT(IN6P_RFC2292)) {
1532 						error = EINVAL;
1533 						break;
1534 					}
1535 #endif
1536 					OPTSET(IN6P_PKTINFO);
1537 					break;
1538 
1539 				case IPV6_HOPLIMIT:
1540 				{
1541 					struct ip6_pktopts **optp;
1542 
1543 #ifdef RFC2292
1544 					/* cannot mix with RFC2292 */
1545 					if (OPTBIT(IN6P_RFC2292)) {
1546 						error = EINVAL;
1547 						break;
1548 					}
1549 #endif
1550 					optp = &in6p->in6p_outputopts;
1551 					error = ip6_pcbopt(IPV6_HOPLIMIT,
1552 							   (u_char *)&optval,
1553 							   sizeof(optval),
1554 							   optp,
1555 							   privileged, uproto);
1556 					break;
1557 				}
1558 
1559 				case IPV6_RECVHOPLIMIT:
1560 #ifdef RFC2292
1561 					/* cannot mix with RFC2292 */
1562 					if (OPTBIT(IN6P_RFC2292)) {
1563 						error = EINVAL;
1564 						break;
1565 					}
1566 #endif
1567 					OPTSET(IN6P_HOPLIMIT);
1568 					break;
1569 
1570 				case IPV6_RECVHOPOPTS:
1571 #ifdef RFC2292
1572 					/* cannot mix with RFC2292 */
1573 					if (OPTBIT(IN6P_RFC2292)) {
1574 						error = EINVAL;
1575 						break;
1576 					}
1577 #endif
1578 					OPTSET(IN6P_HOPOPTS);
1579 					break;
1580 
1581 				case IPV6_RECVDSTOPTS:
1582 #ifdef RFC2292
1583 					/* cannot mix with RFC2292 */
1584 					if (OPTBIT(IN6P_RFC2292)) {
1585 						error = EINVAL;
1586 						break;
1587 					}
1588 #endif
1589 					OPTSET(IN6P_DSTOPTS);
1590 					break;
1591 
1592 				case IPV6_RECVRTHDRDSTOPTS:
1593 #ifdef RFC2292
1594 					/* cannot mix with RFC2292 */
1595 					if (OPTBIT(IN6P_RFC2292)) {
1596 						error = EINVAL;
1597 						break;
1598 					}
1599 #endif
1600 					OPTSET(IN6P_RTHDRDSTOPTS);
1601 					break;
1602 
1603 				case IPV6_RECVRTHDR:
1604 #ifdef RFC2292
1605 					/* cannot mix with RFC2292 */
1606 					if (OPTBIT(IN6P_RFC2292)) {
1607 						error = EINVAL;
1608 						break;
1609 					}
1610 #endif
1611 					OPTSET(IN6P_RTHDR);
1612 					break;
1613 
1614 				case IPV6_FAITH:
1615 					OPTSET(IN6P_FAITH);
1616 					break;
1617 
1618 				case IPV6_RECVPATHMTU:
1619 					/*
1620 					 * We ignore this option for TCP
1621 					 * sockets.
1622 					 * (RFC3542 leaves this case
1623 					 * unspecified.)
1624 					 */
1625 					if (uproto != IPPROTO_TCP)
1626 						OPTSET(IN6P_MTU);
1627 					break;
1628 
1629 				case IPV6_V6ONLY:
1630 					/*
1631 					 * make setsockopt(IPV6_V6ONLY)
1632 					 * available only prior to bind(2).
1633 					 * see ipng mailing list, Jun 22 2001.
1634 					 */
1635 					if (in6p->in6p_lport ||
1636 					    !IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr)) {
1637 						error = EINVAL;
1638 						break;
1639 					}
1640 #ifdef INET6_BINDV6ONLY
1641 					if (!optval)
1642 						error = EINVAL;
1643 #else
1644 					OPTSET(IN6P_IPV6_V6ONLY);
1645 #endif
1646 					break;
1647 				case IPV6_RECVTCLASS:
1648 #ifdef RFC2292
1649 					/* cannot mix with RFC2292 XXX */
1650 					if (OPTBIT(IN6P_RFC2292)) {
1651 						error = EINVAL;
1652 						break;
1653 					}
1654 #endif
1655 					OPTSET(IN6P_TCLASS);
1656 					break;
1657 
1658 				}
1659 				break;
1660 
1661 			case IPV6_OTCLASS:
1662 			{
1663 				struct ip6_pktopts **optp;
1664 				u_int8_t tclass;
1665 
1666 				if (optlen != sizeof(tclass)) {
1667 					error = EINVAL;
1668 					break;
1669 				}
1670 				tclass = *mtod(m, u_int8_t *);
1671 				optp = &in6p->in6p_outputopts;
1672 				error = ip6_pcbopt(optname,
1673 						   (u_char *)&tclass,
1674 						   sizeof(tclass),
1675 						   optp,
1676 						   privileged, uproto);
1677 				break;
1678 			}
1679 
1680 			case IPV6_TCLASS:
1681 			case IPV6_DONTFRAG:
1682 			case IPV6_USE_MIN_MTU:
1683 				if (optlen != sizeof(optval)) {
1684 					error = EINVAL;
1685 					break;
1686 				}
1687 				optval = *mtod(m, int *);
1688 				{
1689 					struct ip6_pktopts **optp;
1690 					optp = &in6p->in6p_outputopts;
1691 					error = ip6_pcbopt(optname,
1692 							   (u_char *)&optval,
1693 							   sizeof(optval),
1694 							   optp,
1695 							   privileged, uproto);
1696 					break;
1697 				}
1698 
1699 #ifdef RFC2292
1700 			case IPV6_2292PKTINFO:
1701 			case IPV6_2292HOPLIMIT:
1702 			case IPV6_2292HOPOPTS:
1703 			case IPV6_2292DSTOPTS:
1704 			case IPV6_2292RTHDR:
1705 				/* RFC 2292 */
1706 				if (optlen != sizeof(int)) {
1707 					error = EINVAL;
1708 					break;
1709 				}
1710 				optval = *mtod(m, int *);
1711 				switch (optname) {
1712 				case IPV6_2292PKTINFO:
1713 					OPTSET2292(IN6P_PKTINFO);
1714 					break;
1715 				case IPV6_2292HOPLIMIT:
1716 					OPTSET2292(IN6P_HOPLIMIT);
1717 					break;
1718 				case IPV6_2292HOPOPTS:
1719 					/*
1720 					 * Check super-user privilege.
1721 					 * See comments for IPV6_RECVHOPOPTS.
1722 					 */
1723 					if (!privileged)
1724 						return (EPERM);
1725 					OPTSET2292(IN6P_HOPOPTS);
1726 					break;
1727 				case IPV6_2292DSTOPTS:
1728 					if (!privileged)
1729 						return (EPERM);
1730 					OPTSET2292(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS); /* XXX */
1731 					break;
1732 				case IPV6_2292RTHDR:
1733 					OPTSET2292(IN6P_RTHDR);
1734 					break;
1735 				}
1736 				break;
1737 #endif
1738 			case IPV6_PKTINFO:
1739 			case IPV6_HOPOPTS:
1740 			case IPV6_RTHDR:
1741 			case IPV6_DSTOPTS:
1742 			case IPV6_RTHDRDSTOPTS:
1743 			case IPV6_NEXTHOP:
1744 			{
1745 				/* new advanced API (RFC3542) */
1746 				u_char *optbuf;
1747 				int optbuflen;
1748 				struct ip6_pktopts **optp;
1749 
1750 #ifdef RFC2292
1751 				/* cannot mix with RFC2292 */
1752 				if (OPTBIT(IN6P_RFC2292)) {
1753 					error = EINVAL;
1754 					break;
1755 				}
1756 #endif
1757 
1758 				if (m && m->m_next) {
1759 					error = EINVAL;	/* XXX */
1760 					break;
1761 				}
1762 				if (m) {
1763 					optbuf = mtod(m, u_char *);
1764 					optbuflen = m->m_len;
1765 				} else {
1766 					optbuf = NULL;
1767 					optbuflen = 0;
1768 				}
1769 				optp = &in6p->in6p_outputopts;
1770 				error = ip6_pcbopt(optname,
1771 						   optbuf, optbuflen,
1772 						   optp, privileged, uproto);
1773 				break;
1774 			}
1775 #undef OPTSET
1776 
1777 			case IPV6_MULTICAST_IF:
1778 			case IPV6_MULTICAST_HOPS:
1779 			case IPV6_MULTICAST_LOOP:
1780 			case IPV6_JOIN_GROUP:
1781 			case IPV6_LEAVE_GROUP:
1782                                 error = ip6_setmoptions(optname,
1783 				    &in6p->in6p_moptions, m);
1784 				break;
1785 
1786 			case IPV6_PORTRANGE:
1787 				optval = *mtod(m, int *);
1788 
1789 				switch (optval) {
1790 				case IPV6_PORTRANGE_DEFAULT:
1791 					in6p->in6p_flags &= ~(IN6P_LOWPORT);
1792 					in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1793 					break;
1794 
1795 				case IPV6_PORTRANGE_HIGH:
1796 					in6p->in6p_flags &= ~(IN6P_LOWPORT);
1797 					in6p->in6p_flags |= IN6P_HIGHPORT;
1798 					break;
1799 
1800 				case IPV6_PORTRANGE_LOW:
1801 					in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1802 					in6p->in6p_flags |= IN6P_LOWPORT;
1803 					break;
1804 
1805 				default:
1806 					error = EINVAL;
1807 					break;
1808 				}
1809 				break;
1810 
1811 #ifdef IPSEC
1812 			case IPV6_IPSEC_POLICY:
1813 			{
1814 				caddr_t req = NULL;
1815 				size_t len = 0;
1816 				if (m) {
1817 					req = mtod(m, caddr_t);
1818 					len = m->m_len;
1819 				}
1820 				error = ipsec6_set_policy(in6p, optname, req,
1821 							  len, privileged);
1822 			}
1823 				break;
1824 #endif /* IPSEC */
1825 
1826 			default:
1827 				error = ENOPROTOOPT;
1828 				break;
1829 			}
1830 			if (m)
1831 				(void)m_free(m);
1832 			break;
1833 
1834 		case PRCO_GETOPT:
1835 			switch (optname) {
1836 #ifdef RFC2292
1837 			case IPV6_2292PKTOPTIONS:
1838 				/*
1839 				 * RFC3542 (effectively) deprecated the
1840 				 * semantics of the 2292-style pktoptions.
1841 				 * Since it was not reliable in nature (i.e.,
1842 				 * applications had to expect the lack of some
1843 				 * information after all), it would make sense
1844 				 * to simplify this part by always returning
1845 				 * empty data.
1846 				 */
1847 				*mp = m_get(M_WAIT, MT_SOOPTS);
1848 				(*mp)->m_len = 0;
1849 				break;
1850 #endif
1851 
1852 			case IPV6_RECVHOPOPTS:
1853 			case IPV6_RECVDSTOPTS:
1854 			case IPV6_RECVRTHDRDSTOPTS:
1855 			case IPV6_UNICAST_HOPS:
1856 			case IPV6_RECVPKTINFO:
1857 			case IPV6_RECVHOPLIMIT:
1858 			case IPV6_RECVRTHDR:
1859 			case IPV6_RECVPATHMTU:
1860 
1861 			case IPV6_FAITH:
1862 			case IPV6_V6ONLY:
1863 			case IPV6_PORTRANGE:
1864 			case IPV6_RECVTCLASS:
1865 				switch (optname) {
1866 
1867 				case IPV6_RECVHOPOPTS:
1868 					optval = OPTBIT(IN6P_HOPOPTS);
1869 					break;
1870 
1871 				case IPV6_RECVDSTOPTS:
1872 					optval = OPTBIT(IN6P_DSTOPTS);
1873 					break;
1874 
1875 				case IPV6_RECVRTHDRDSTOPTS:
1876 					optval = OPTBIT(IN6P_RTHDRDSTOPTS);
1877 					break;
1878 
1879 				case IPV6_UNICAST_HOPS:
1880 					optval = in6p->in6p_hops;
1881 					break;
1882 
1883 				case IPV6_RECVPKTINFO:
1884 					optval = OPTBIT(IN6P_PKTINFO);
1885 					break;
1886 
1887 				case IPV6_RECVHOPLIMIT:
1888 					optval = OPTBIT(IN6P_HOPLIMIT);
1889 					break;
1890 
1891 				case IPV6_RECVRTHDR:
1892 					optval = OPTBIT(IN6P_RTHDR);
1893 					break;
1894 
1895 				case IPV6_RECVPATHMTU:
1896 					optval = OPTBIT(IN6P_MTU);
1897 					break;
1898 
1899 				case IPV6_FAITH:
1900 					optval = OPTBIT(IN6P_FAITH);
1901 					break;
1902 
1903 				case IPV6_V6ONLY:
1904 					optval = OPTBIT(IN6P_IPV6_V6ONLY);
1905 					break;
1906 
1907 				case IPV6_PORTRANGE:
1908 				    {
1909 					int flags;
1910 					flags = in6p->in6p_flags;
1911 					if (flags & IN6P_HIGHPORT)
1912 						optval = IPV6_PORTRANGE_HIGH;
1913 					else if (flags & IN6P_LOWPORT)
1914 						optval = IPV6_PORTRANGE_LOW;
1915 					else
1916 						optval = 0;
1917 					break;
1918 				    }
1919 				case IPV6_RECVTCLASS:
1920 					optval = OPTBIT(IN6P_TCLASS);
1921 					break;
1922 
1923 				}
1924 				if (error)
1925 					break;
1926 				*mp = m = m_get(M_WAIT, MT_SOOPTS);
1927 				m->m_len = sizeof(int);
1928 				*mtod(m, int *) = optval;
1929 				break;
1930 
1931 			case IPV6_PATHMTU:
1932 			    {
1933 				u_long pmtu = 0;
1934 				struct ip6_mtuinfo mtuinfo;
1935 				struct route_in6 *ro = (struct route_in6 *)&in6p
1936 ->in6p_route;
1937 
1938 				if (!(so->so_state & SS_ISCONNECTED))
1939 					return (ENOTCONN);
1940 				/*
1941 				 * XXX: we dot not consider the case of source
1942 				 * routing, or optional information to specify
1943 				 * the outgoing interface.
1944 				 */
1945 				error = ip6_getpmtu(ro, NULL, NULL,
1946 				    &in6p->in6p_faddr, &pmtu, NULL);
1947 				if (error)
1948 					break;
1949 				if (pmtu > IPV6_MAXPACKET)
1950 					pmtu = IPV6_MAXPACKET;
1951 
1952 				memset(&mtuinfo, 0, sizeof(mtuinfo));
1953 				mtuinfo.ip6m_mtu = (u_int32_t)pmtu;
1954 				optdata = (void *)&mtuinfo;
1955 				optdatalen = sizeof(mtuinfo);
1956 				if (optdatalen > MCLBYTES)
1957 					return (EMSGSIZE); /* XXX */
1958 				*mp = m = m_get(M_WAIT, MT_SOOPTS);
1959 				if (optdatalen > MLEN)
1960 					MCLGET(m, M_WAIT);
1961 				m->m_len = optdatalen;
1962 				memcpy(mtod(m, void *), optdata, optdatalen);
1963 				break;
1964 			    }
1965 
1966 #ifdef RFC2292
1967 			case IPV6_2292PKTINFO:
1968 			case IPV6_2292HOPLIMIT:
1969 			case IPV6_2292HOPOPTS:
1970 			case IPV6_2292RTHDR:
1971 			case IPV6_2292DSTOPTS:
1972 				switch (optname) {
1973 				case IPV6_2292PKTINFO:
1974 					optval = OPTBIT(IN6P_PKTINFO);
1975 					break;
1976 				case IPV6_2292HOPLIMIT:
1977 					optval = OPTBIT(IN6P_HOPLIMIT);
1978 					break;
1979 				case IPV6_2292HOPOPTS:
1980 					optval = OPTBIT(IN6P_HOPOPTS);
1981 					break;
1982 				case IPV6_2292RTHDR:
1983 					optval = OPTBIT(IN6P_RTHDR);
1984 					break;
1985 				case IPV6_2292DSTOPTS:
1986 					optval = OPTBIT(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS);
1987 					break;
1988 				}
1989 				*mp = m = m_get(M_WAIT, MT_SOOPTS);
1990 				m->m_len = sizeof(int);
1991 				*mtod(m, int *) = optval;
1992 				break;
1993 #endif
1994 			case IPV6_PKTINFO:
1995 			case IPV6_HOPOPTS:
1996 			case IPV6_RTHDR:
1997 			case IPV6_DSTOPTS:
1998 			case IPV6_RTHDRDSTOPTS:
1999 			case IPV6_NEXTHOP:
2000 			case IPV6_OTCLASS:
2001 			case IPV6_TCLASS:
2002 			case IPV6_DONTFRAG:
2003 			case IPV6_USE_MIN_MTU:
2004 				error = ip6_getpcbopt(in6p->in6p_outputopts,
2005 				    optname, mp);
2006 				break;
2007 
2008 			case IPV6_MULTICAST_IF:
2009 			case IPV6_MULTICAST_HOPS:
2010 			case IPV6_MULTICAST_LOOP:
2011 			case IPV6_JOIN_GROUP:
2012 			case IPV6_LEAVE_GROUP:
2013 				error = ip6_getmoptions(optname,
2014 				    in6p->in6p_moptions, mp);
2015 				break;
2016 
2017 #ifdef IPSEC
2018 			case IPV6_IPSEC_POLICY:
2019 			    {
2020 				caddr_t req = NULL;
2021 				size_t len = 0;
2022 				if (m) {
2023 					req = mtod(m, caddr_t);
2024 					len = m->m_len;
2025 				}
2026 				error = ipsec6_get_policy(in6p, req, len, mp);
2027 				break;
2028 			    }
2029 #endif /* IPSEC */
2030 
2031 
2032 
2033 
2034 			default:
2035 				error = ENOPROTOOPT;
2036 				break;
2037 			}
2038 			break;
2039 		}
2040 	} else {
2041 		error = EINVAL;
2042 		if (op == PRCO_SETOPT && *mp)
2043 			(void)m_free(*mp);
2044 	}
2045 	return (error);
2046 }
2047 
2048 int
2049 ip6_raw_ctloutput(op, so, level, optname, mp)
2050 	int op;
2051 	struct socket *so;
2052 	int level, optname;
2053 	struct mbuf **mp;
2054 {
2055 	int error = 0, optval, optlen;
2056 	const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
2057 	struct in6pcb *in6p = sotoin6pcb(so);
2058 	struct mbuf *m = *mp;
2059 
2060 	optlen = m ? m->m_len : 0;
2061 
2062 	if (level != IPPROTO_IPV6) {
2063 		if (op == PRCO_SETOPT && *mp)
2064 			(void)m_free(*mp);
2065 		return (EINVAL);
2066 	}
2067 
2068 	switch (optname) {
2069 	case IPV6_CHECKSUM:
2070 		/*
2071 		 * For ICMPv6 sockets, no modification allowed for checksum
2072 		 * offset, permit "no change" values to help existing apps.
2073 		 *
2074 		 * XXX RFC3542 says: "An attempt to set IPV6_CHECKSUM
2075 		 * for an ICMPv6 socket will fail."  The current
2076 		 * behavior does not meet RFC3542.
2077 		 */
2078 		switch (op) {
2079 		case PRCO_SETOPT:
2080 			if (optlen != sizeof(int)) {
2081 				error = EINVAL;
2082 				break;
2083 			}
2084 			optval = *mtod(m, int *);
2085 			if ((optval % 2) != 0) {
2086 				/* the API assumes even offset values */
2087 				error = EINVAL;
2088 			} else if (so->so_proto->pr_protocol ==
2089 			    IPPROTO_ICMPV6) {
2090 				if (optval != icmp6off)
2091 					error = EINVAL;
2092 			} else
2093 				in6p->in6p_cksum = optval;
2094 			break;
2095 
2096 		case PRCO_GETOPT:
2097 			if (so->so_proto->pr_protocol == IPPROTO_ICMPV6)
2098 				optval = icmp6off;
2099 			else
2100 				optval = in6p->in6p_cksum;
2101 
2102 			*mp = m = m_get(M_WAIT, MT_SOOPTS);
2103 			m->m_len = sizeof(int);
2104 			*mtod(m, int *) = optval;
2105 			break;
2106 
2107 		default:
2108 			error = EINVAL;
2109 			break;
2110 		}
2111 		break;
2112 
2113 	default:
2114 		error = ENOPROTOOPT;
2115 		break;
2116 	}
2117 
2118 	if (op == PRCO_SETOPT && m)
2119 		(void)m_free(m);
2120 
2121 	return (error);
2122 }
2123 
2124 #ifdef RFC2292
2125 /*
2126  * Set up IP6 options in pcb for insertion in output packets or
2127  * specifying behavior of outgoing packets.
2128  */
2129 static int
2130 ip6_pcbopts(pktopt, m, so)
2131 	struct ip6_pktopts **pktopt;
2132 	struct mbuf *m;
2133 	struct socket *so;
2134 {
2135 	struct ip6_pktopts *opt = *pktopt;
2136 	int error = 0;
2137 	struct lwp *l = curlwp;	/* XXX */
2138 	int priv = 0;
2139 
2140 	/* turn off any old options. */
2141 	if (opt) {
2142 #ifdef DIAGNOSTIC
2143 	    if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
2144 		opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
2145 		opt->ip6po_rhinfo.ip6po_rhi_rthdr)
2146 		    printf("ip6_pcbopts: all specified options are cleared.\n");
2147 #endif
2148 		ip6_clearpktopts(opt, -1);
2149 	} else
2150 		opt = malloc(sizeof(*opt), M_IP6OPT, M_WAITOK);
2151 	*pktopt = NULL;
2152 
2153 	if (!m || m->m_len == 0) {
2154 		/*
2155 		 * Only turning off any previous options, regardless of
2156 		 * whether the opt is just created or given.
2157 		 */
2158 		free(opt, M_IP6OPT);
2159 		return (0);
2160 	}
2161 
2162 	/*  set options specified by user. */
2163 	if (l && !kauth_authorize_generic(l->l_cred, KAUTH_GENERIC_ISSUSER,
2164 	    &l->l_acflag))
2165 		priv = 1;
2166 	if ((error = ip6_setpktopts(m, opt, NULL, priv,
2167 	    so->so_proto->pr_protocol)) != 0) {
2168 		ip6_clearpktopts(opt, -1); /* XXX: discard all options */
2169 		free(opt, M_IP6OPT);
2170 		return (error);
2171 	}
2172 	*pktopt = opt;
2173 	return (0);
2174 }
2175 #endif
2176 
2177 /*
2178  * initialize ip6_pktopts.  beware that there are non-zero default values in
2179  * the struct.
2180  */
2181 void
2182 ip6_initpktopts(struct ip6_pktopts *opt)
2183 {
2184 
2185 	memset(opt, 0, sizeof(*opt));
2186 	opt->ip6po_hlim = -1;	/* -1 means default hop limit */
2187 	opt->ip6po_tclass = -1;	/* -1 means default traffic class */
2188 	opt->ip6po_minmtu = IP6PO_MINMTU_MCASTONLY;
2189 }
2190 
2191 #define sin6tosa(sin6)	((struct sockaddr *)(sin6)) /* XXX */
2192 static int
2193 ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt,
2194     int priv, int uproto)
2195 {
2196 	struct ip6_pktopts *opt;
2197 
2198 	if (*pktopt == NULL) {
2199 		*pktopt = malloc(sizeof(struct ip6_pktopts), M_IP6OPT,
2200 		    M_WAITOK);
2201 		ip6_initpktopts(*pktopt);
2202 	}
2203 	opt = *pktopt;
2204 
2205 	return (ip6_setpktopt(optname, buf, len, opt, priv, 1, 0, uproto));
2206 }
2207 
2208 static int
2209 ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct mbuf **mp)
2210 {
2211 	void *optdata = NULL;
2212 	int optdatalen = 0;
2213 	struct ip6_ext *ip6e;
2214 	int error = 0;
2215 	struct in6_pktinfo null_pktinfo;
2216 	int deftclass = 0, on;
2217 	int defminmtu = IP6PO_MINMTU_MCASTONLY;
2218 	struct mbuf *m;
2219 
2220 	switch (optname) {
2221 	case IPV6_PKTINFO:
2222 		if (pktopt && pktopt->ip6po_pktinfo)
2223 			optdata = (void *)pktopt->ip6po_pktinfo;
2224 		else {
2225 			/* XXX: we don't have to do this every time... */
2226 			memset(&null_pktinfo, 0, sizeof(null_pktinfo));
2227 			optdata = (void *)&null_pktinfo;
2228 		}
2229 		optdatalen = sizeof(struct in6_pktinfo);
2230 		break;
2231 	case IPV6_OTCLASS:
2232 		/* XXX */
2233 		return (EINVAL);
2234 	case IPV6_TCLASS:
2235 		if (pktopt && pktopt->ip6po_tclass >= 0)
2236 			optdata = (void *)&pktopt->ip6po_tclass;
2237 		else
2238 			optdata = (void *)&deftclass;
2239 		optdatalen = sizeof(int);
2240 		break;
2241 	case IPV6_HOPOPTS:
2242 		if (pktopt && pktopt->ip6po_hbh) {
2243 			optdata = (void *)pktopt->ip6po_hbh;
2244 			ip6e = (struct ip6_ext *)pktopt->ip6po_hbh;
2245 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2246 		}
2247 		break;
2248 	case IPV6_RTHDR:
2249 		if (pktopt && pktopt->ip6po_rthdr) {
2250 			optdata = (void *)pktopt->ip6po_rthdr;
2251 			ip6e = (struct ip6_ext *)pktopt->ip6po_rthdr;
2252 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2253 		}
2254 		break;
2255 	case IPV6_RTHDRDSTOPTS:
2256 		if (pktopt && pktopt->ip6po_dest1) {
2257 			optdata = (void *)pktopt->ip6po_dest1;
2258 			ip6e = (struct ip6_ext *)pktopt->ip6po_dest1;
2259 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2260 		}
2261 		break;
2262 	case IPV6_DSTOPTS:
2263 		if (pktopt && pktopt->ip6po_dest2) {
2264 			optdata = (void *)pktopt->ip6po_dest2;
2265 			ip6e = (struct ip6_ext *)pktopt->ip6po_dest2;
2266 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2267 		}
2268 		break;
2269 	case IPV6_NEXTHOP:
2270 		if (pktopt && pktopt->ip6po_nexthop) {
2271 			optdata = (void *)pktopt->ip6po_nexthop;
2272 			optdatalen = pktopt->ip6po_nexthop->sa_len;
2273 		}
2274 		break;
2275 	case IPV6_USE_MIN_MTU:
2276 		if (pktopt)
2277 			optdata = (void *)&pktopt->ip6po_minmtu;
2278 		else
2279 			optdata = (void *)&defminmtu;
2280 		optdatalen = sizeof(int);
2281 		break;
2282 	case IPV6_DONTFRAG:
2283 		if (pktopt && ((pktopt->ip6po_flags) & IP6PO_DONTFRAG))
2284 			on = 1;
2285 		else
2286 			on = 0;
2287 		optdata = (void *)&on;
2288 		optdatalen = sizeof(on);
2289 		break;
2290 	default:		/* should not happen */
2291 #ifdef DIAGNOSTIC
2292 		panic("ip6_getpcbopt: unexpected option\n");
2293 #endif
2294 		return (ENOPROTOOPT);
2295 	}
2296 
2297 	if (optdatalen > MCLBYTES)
2298 		return (EMSGSIZE); /* XXX */
2299 	*mp = m = m_get(M_WAIT, MT_SOOPTS);
2300 	if (optdatalen > MLEN)
2301 		MCLGET(m, M_WAIT);
2302 	m->m_len = optdatalen;
2303 	if (optdatalen)
2304 		memcpy(mtod(m, void *), optdata, optdatalen);
2305 
2306 	return (error);
2307 }
2308 
2309 void
2310 ip6_clearpktopts(struct ip6_pktopts *pktopt, int optname)
2311 {
2312 	if (optname == -1 || optname == IPV6_PKTINFO) {
2313 		if (pktopt->ip6po_pktinfo)
2314 			free(pktopt->ip6po_pktinfo, M_IP6OPT);
2315 		pktopt->ip6po_pktinfo = NULL;
2316 	}
2317 	if (optname == -1 || optname == IPV6_HOPLIMIT)
2318 		pktopt->ip6po_hlim = -1;
2319 	if (optname == -1 || optname == IPV6_TCLASS)
2320 		pktopt->ip6po_tclass = -1;
2321 	if (optname == -1 || optname == IPV6_NEXTHOP) {
2322 		if (pktopt->ip6po_nextroute.ro_rt) {
2323 			RTFREE(pktopt->ip6po_nextroute.ro_rt);
2324 			pktopt->ip6po_nextroute.ro_rt = NULL;
2325 		}
2326 		if (pktopt->ip6po_nexthop)
2327 			free(pktopt->ip6po_nexthop, M_IP6OPT);
2328 		pktopt->ip6po_nexthop = NULL;
2329 	}
2330 	if (optname == -1 || optname == IPV6_HOPOPTS) {
2331 		if (pktopt->ip6po_hbh)
2332 			free(pktopt->ip6po_hbh, M_IP6OPT);
2333 		pktopt->ip6po_hbh = NULL;
2334 	}
2335 	if (optname == -1 || optname == IPV6_RTHDRDSTOPTS) {
2336 		if (pktopt->ip6po_dest1)
2337 			free(pktopt->ip6po_dest1, M_IP6OPT);
2338 		pktopt->ip6po_dest1 = NULL;
2339 	}
2340 	if (optname == -1 || optname == IPV6_RTHDR) {
2341 		if (pktopt->ip6po_rhinfo.ip6po_rhi_rthdr)
2342 			free(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr, M_IP6OPT);
2343 		pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
2344 		if (pktopt->ip6po_route.ro_rt) {
2345 			RTFREE(pktopt->ip6po_route.ro_rt);
2346 			pktopt->ip6po_route.ro_rt = NULL;
2347 		}
2348 	}
2349 	if (optname == -1 || optname == IPV6_DSTOPTS) {
2350 		if (pktopt->ip6po_dest2)
2351 			free(pktopt->ip6po_dest2, M_IP6OPT);
2352 		pktopt->ip6po_dest2 = NULL;
2353 	}
2354 }
2355 
2356 #define PKTOPT_EXTHDRCPY(type) 					\
2357 do {								\
2358 	if (src->type) {					\
2359 		int hlen = (((struct ip6_ext *)src->type)->ip6e_len + 1) << 3;\
2360 		dst->type = malloc(hlen, M_IP6OPT, canwait);	\
2361 		if (dst->type == NULL && canwait == M_NOWAIT)	\
2362 			goto bad;				\
2363 		memcpy(dst->type, src->type, hlen);		\
2364 	}							\
2365 } while (/*CONSTCOND*/ 0)
2366 
2367 static int
2368 copypktopts(struct ip6_pktopts *dst, struct ip6_pktopts *src, int canwait)
2369 {
2370 	dst->ip6po_hlim = src->ip6po_hlim;
2371 	dst->ip6po_tclass = src->ip6po_tclass;
2372 	dst->ip6po_flags = src->ip6po_flags;
2373 	if (src->ip6po_pktinfo) {
2374 		dst->ip6po_pktinfo = malloc(sizeof(*dst->ip6po_pktinfo),
2375 		    M_IP6OPT, canwait);
2376 		if (dst->ip6po_pktinfo == NULL && canwait == M_NOWAIT)
2377 			goto bad;
2378 		*dst->ip6po_pktinfo = *src->ip6po_pktinfo;
2379 	}
2380 	if (src->ip6po_nexthop) {
2381 		dst->ip6po_nexthop = malloc(src->ip6po_nexthop->sa_len,
2382 		    M_IP6OPT, canwait);
2383 		if (dst->ip6po_nexthop == NULL && canwait == M_NOWAIT)
2384 			goto bad;
2385 		memcpy(dst->ip6po_nexthop, src->ip6po_nexthop,
2386 		    src->ip6po_nexthop->sa_len);
2387 	}
2388 	PKTOPT_EXTHDRCPY(ip6po_hbh);
2389 	PKTOPT_EXTHDRCPY(ip6po_dest1);
2390 	PKTOPT_EXTHDRCPY(ip6po_dest2);
2391 	PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
2392 	return (0);
2393 
2394   bad:
2395 	if (dst->ip6po_pktinfo) free(dst->ip6po_pktinfo, M_IP6OPT);
2396 	if (dst->ip6po_nexthop) free(dst->ip6po_nexthop, M_IP6OPT);
2397 	if (dst->ip6po_hbh) free(dst->ip6po_hbh, M_IP6OPT);
2398 	if (dst->ip6po_dest1) free(dst->ip6po_dest1, M_IP6OPT);
2399 	if (dst->ip6po_dest2) free(dst->ip6po_dest2, M_IP6OPT);
2400 	if (dst->ip6po_rthdr) free(dst->ip6po_rthdr, M_IP6OPT);
2401 
2402 	return (ENOBUFS);
2403 }
2404 #undef PKTOPT_EXTHDRCPY
2405 
2406 struct ip6_pktopts *
2407 ip6_copypktopts(struct ip6_pktopts *src, int canwait)
2408 {
2409 	int error;
2410 	struct ip6_pktopts *dst;
2411 
2412 	dst = malloc(sizeof(*dst), M_IP6OPT, canwait);
2413 	if (dst == NULL && canwait == M_NOWAIT)
2414 		return (NULL);
2415 	ip6_initpktopts(dst);
2416 
2417 	if ((error = copypktopts(dst, src, canwait)) != 0) {
2418 		free(dst, M_IP6OPT);
2419 		return (NULL);
2420 	}
2421 
2422 	return (dst);
2423 }
2424 
2425 void
2426 ip6_freepcbopts(struct ip6_pktopts *pktopt)
2427 {
2428 	if (pktopt == NULL)
2429 		return;
2430 
2431 	ip6_clearpktopts(pktopt, -1);
2432 
2433 	free(pktopt, M_IP6OPT);
2434 }
2435 
2436 /*
2437  * Set the IP6 multicast options in response to user setsockopt().
2438  */
2439 static int
2440 ip6_setmoptions(optname, im6op, m)
2441 	int optname;
2442 	struct ip6_moptions **im6op;
2443 	struct mbuf *m;
2444 {
2445 	int error = 0;
2446 	u_int loop, ifindex;
2447 	struct ipv6_mreq *mreq;
2448 	struct ifnet *ifp;
2449 	struct ip6_moptions *im6o = *im6op;
2450 	struct route_in6 ro;
2451 	struct in6_multi_mship *imm;
2452 	struct lwp *l = curlwp;	/* XXX */
2453 
2454 	if (im6o == NULL) {
2455 		/*
2456 		 * No multicast option buffer attached to the pcb;
2457 		 * allocate one and initialize to default values.
2458 		 */
2459 		im6o = (struct ip6_moptions *)
2460 			malloc(sizeof(*im6o), M_IPMOPTS, M_WAITOK);
2461 
2462 		if (im6o == NULL)
2463 			return (ENOBUFS);
2464 		*im6op = im6o;
2465 		im6o->im6o_multicast_ifp = NULL;
2466 		im6o->im6o_multicast_hlim = ip6_defmcasthlim;
2467 		im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
2468 		LIST_INIT(&im6o->im6o_memberships);
2469 	}
2470 
2471 	switch (optname) {
2472 
2473 	case IPV6_MULTICAST_IF:
2474 		/*
2475 		 * Select the interface for outgoing multicast packets.
2476 		 */
2477 		if (m == NULL || m->m_len != sizeof(u_int)) {
2478 			error = EINVAL;
2479 			break;
2480 		}
2481 		bcopy(mtod(m, u_int *), &ifindex, sizeof(ifindex));
2482 		if (ifindex != 0) {
2483 			if (if_indexlim <= ifindex || !ifindex2ifnet[ifindex]) {
2484 				error = ENXIO;	/* XXX EINVAL? */
2485 				break;
2486 			}
2487 			ifp = ifindex2ifnet[ifindex];
2488 			if ((ifp->if_flags & IFF_MULTICAST) == 0) {
2489 				error = EADDRNOTAVAIL;
2490 				break;
2491 			}
2492 		} else
2493 			ifp = NULL;
2494 		im6o->im6o_multicast_ifp = ifp;
2495 		break;
2496 
2497 	case IPV6_MULTICAST_HOPS:
2498 	    {
2499 		/*
2500 		 * Set the IP6 hoplimit for outgoing multicast packets.
2501 		 */
2502 		int optval;
2503 		if (m == NULL || m->m_len != sizeof(int)) {
2504 			error = EINVAL;
2505 			break;
2506 		}
2507 		bcopy(mtod(m, u_int *), &optval, sizeof(optval));
2508 		if (optval < -1 || optval >= 256)
2509 			error = EINVAL;
2510 		else if (optval == -1)
2511 			im6o->im6o_multicast_hlim = ip6_defmcasthlim;
2512 		else
2513 			im6o->im6o_multicast_hlim = optval;
2514 		break;
2515 	    }
2516 
2517 	case IPV6_MULTICAST_LOOP:
2518 		/*
2519 		 * Set the loopback flag for outgoing multicast packets.
2520 		 * Must be zero or one.
2521 		 */
2522 		if (m == NULL || m->m_len != sizeof(u_int)) {
2523 			error = EINVAL;
2524 			break;
2525 		}
2526 		bcopy(mtod(m, u_int *), &loop, sizeof(loop));
2527 		if (loop > 1) {
2528 			error = EINVAL;
2529 			break;
2530 		}
2531 		im6o->im6o_multicast_loop = loop;
2532 		break;
2533 
2534 	case IPV6_JOIN_GROUP:
2535 		/*
2536 		 * Add a multicast group membership.
2537 		 * Group must be a valid IP6 multicast address.
2538 		 */
2539 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
2540 			error = EINVAL;
2541 			break;
2542 		}
2543 		mreq = mtod(m, struct ipv6_mreq *);
2544 		if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
2545 			/*
2546 			 * We use the unspecified address to specify to accept
2547 			 * all multicast addresses. Only super user is allowed
2548 			 * to do this.
2549 			 */
2550 			if (kauth_authorize_generic(l->l_cred,
2551 			    KAUTH_GENERIC_ISSUSER, &l->l_acflag))
2552 			{
2553 				error = EACCES;
2554 				break;
2555 			}
2556 		} else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
2557 			error = EINVAL;
2558 			break;
2559 		}
2560 
2561 		/*
2562 		 * If no interface was explicitly specified, choose an
2563 		 * appropriate one according to the given multicast address.
2564 		 */
2565 		if (mreq->ipv6mr_interface == 0) {
2566 			struct sockaddr_in6 *dst;
2567 
2568 			/*
2569 			 * Look up the routing table for the
2570 			 * address, and choose the outgoing interface.
2571 			 *   XXX: is it a good approach?
2572 			 */
2573 			ro.ro_rt = NULL;
2574 			dst = (struct sockaddr_in6 *)&ro.ro_dst;
2575 			bzero(dst, sizeof(*dst));
2576 			dst->sin6_family = AF_INET6;
2577 			dst->sin6_len = sizeof(*dst);
2578 			dst->sin6_addr = mreq->ipv6mr_multiaddr;
2579 			rtalloc((struct route *)&ro);
2580 			if (ro.ro_rt == NULL) {
2581 				error = EADDRNOTAVAIL;
2582 				break;
2583 			}
2584 			ifp = ro.ro_rt->rt_ifp;
2585 			rtfree(ro.ro_rt);
2586 		} else {
2587 			/*
2588 			 * If the interface is specified, validate it.
2589 			 */
2590 			if (if_indexlim <= mreq->ipv6mr_interface ||
2591 			    !ifindex2ifnet[mreq->ipv6mr_interface]) {
2592 				error = ENXIO;	/* XXX EINVAL? */
2593 				break;
2594 			}
2595 			ifp = ifindex2ifnet[mreq->ipv6mr_interface];
2596 		}
2597 
2598 		/*
2599 		 * See if we found an interface, and confirm that it
2600 		 * supports multicast
2601 		 */
2602 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2603 			error = EADDRNOTAVAIL;
2604 			break;
2605 		}
2606 
2607 		if (in6_setscope(&mreq->ipv6mr_multiaddr, ifp, NULL)) {
2608 			error = EADDRNOTAVAIL; /* XXX: should not happen */
2609 			break;
2610 		}
2611 
2612 		/*
2613 		 * See if the membership already exists.
2614 		 */
2615 		for (imm = im6o->im6o_memberships.lh_first;
2616 		     imm != NULL; imm = imm->i6mm_chain.le_next)
2617 			if (imm->i6mm_maddr->in6m_ifp == ifp &&
2618 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2619 			    &mreq->ipv6mr_multiaddr))
2620 				break;
2621 		if (imm != NULL) {
2622 			error = EADDRINUSE;
2623 			break;
2624 		}
2625 		/*
2626 		 * Everything looks good; add a new record to the multicast
2627 		 * address list for the given interface.
2628 		 */
2629 		imm = in6_joingroup(ifp, &mreq->ipv6mr_multiaddr, &error, 0);
2630 		if (imm == NULL)
2631 			break;
2632 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
2633 		break;
2634 
2635 	case IPV6_LEAVE_GROUP:
2636 		/*
2637 		 * Drop a multicast group membership.
2638 		 * Group must be a valid IP6 multicast address.
2639 		 */
2640 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
2641 			error = EINVAL;
2642 			break;
2643 		}
2644 		mreq = mtod(m, struct ipv6_mreq *);
2645 
2646 		/*
2647 		 * If an interface address was specified, get a pointer
2648 		 * to its ifnet structure.
2649 		 */
2650 		if (mreq->ipv6mr_interface != 0) {
2651 			if (if_indexlim <= mreq->ipv6mr_interface ||
2652 			    !ifindex2ifnet[mreq->ipv6mr_interface]) {
2653 				error = ENXIO;	/* XXX EINVAL? */
2654 				break;
2655 			}
2656 			ifp = ifindex2ifnet[mreq->ipv6mr_interface];
2657 		} else
2658 			ifp = NULL;
2659 
2660 		/* Fill in the scope zone ID */
2661 		if (ifp) {
2662 			if (in6_setscope(&mreq->ipv6mr_multiaddr, ifp, NULL)) {
2663 				/* XXX: should not happen */
2664 				error = EADDRNOTAVAIL;
2665 				break;
2666 			}
2667 		} else if (mreq->ipv6mr_interface != 0) {
2668 			/*
2669 			 * XXX: This case would happens when the (positive)
2670 			 * index is in the valid range, but the corresponding
2671 			 * interface has been detached dynamically.  The above
2672 			 * check probably avoids such case to happen here, but
2673 			 * we check it explicitly for safety.
2674 			 */
2675 			error = EADDRNOTAVAIL;
2676 			break;
2677 		} else {	/* ipv6mr_interface == 0 */
2678 			struct sockaddr_in6 sa6_mc;
2679 
2680 			/*
2681 			 * The API spec says as follows:
2682 			 *  If the interface index is specified as 0, the
2683 			 *  system may choose a multicast group membership to
2684 			 *  drop by matching the multicast address only.
2685 			 * On the other hand, we cannot disambiguate the scope
2686 			 * zone unless an interface is provided.  Thus, we
2687 			 * check if there's ambiguity with the default scope
2688 			 * zone as the last resort.
2689 			 */
2690 			bzero(&sa6_mc, sizeof(sa6_mc));
2691 			sa6_mc.sin6_family = AF_INET6;
2692 			sa6_mc.sin6_len = sizeof(sa6_mc);
2693 			sa6_mc.sin6_addr = mreq->ipv6mr_multiaddr;
2694 			error = sa6_embedscope(&sa6_mc, ip6_use_defzone);
2695 			if (error != 0)
2696 				break;
2697 			mreq->ipv6mr_multiaddr = sa6_mc.sin6_addr;
2698 		}
2699 
2700 		/*
2701 		 * Find the membership in the membership list.
2702 		 */
2703 		for (imm = im6o->im6o_memberships.lh_first;
2704 		     imm != NULL; imm = imm->i6mm_chain.le_next) {
2705 			if ((ifp == NULL || imm->i6mm_maddr->in6m_ifp == ifp) &&
2706 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2707 			    &mreq->ipv6mr_multiaddr))
2708 				break;
2709 		}
2710 		if (imm == NULL) {
2711 			/* Unable to resolve interface */
2712 			error = EADDRNOTAVAIL;
2713 			break;
2714 		}
2715 		/*
2716 		 * Give up the multicast address record to which the
2717 		 * membership points.
2718 		 */
2719 		LIST_REMOVE(imm, i6mm_chain);
2720 		in6_leavegroup(imm);
2721 		break;
2722 
2723 	default:
2724 		error = EOPNOTSUPP;
2725 		break;
2726 	}
2727 
2728 	/*
2729 	 * If all options have default values, no need to keep the mbuf.
2730 	 */
2731 	if (im6o->im6o_multicast_ifp == NULL &&
2732 	    im6o->im6o_multicast_hlim == ip6_defmcasthlim &&
2733 	    im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
2734 	    im6o->im6o_memberships.lh_first == NULL) {
2735 		free(*im6op, M_IPMOPTS);
2736 		*im6op = NULL;
2737 	}
2738 
2739 	return (error);
2740 }
2741 
2742 /*
2743  * Return the IP6 multicast options in response to user getsockopt().
2744  */
2745 static int
2746 ip6_getmoptions(optname, im6o, mp)
2747 	int optname;
2748 	struct ip6_moptions *im6o;
2749 	struct mbuf **mp;
2750 {
2751 	u_int *hlim, *loop, *ifindex;
2752 
2753 	*mp = m_get(M_WAIT, MT_SOOPTS);
2754 
2755 	switch (optname) {
2756 
2757 	case IPV6_MULTICAST_IF:
2758 		ifindex = mtod(*mp, u_int *);
2759 		(*mp)->m_len = sizeof(u_int);
2760 		if (im6o == NULL || im6o->im6o_multicast_ifp == NULL)
2761 			*ifindex = 0;
2762 		else
2763 			*ifindex = im6o->im6o_multicast_ifp->if_index;
2764 		return (0);
2765 
2766 	case IPV6_MULTICAST_HOPS:
2767 		hlim = mtod(*mp, u_int *);
2768 		(*mp)->m_len = sizeof(u_int);
2769 		if (im6o == NULL)
2770 			*hlim = ip6_defmcasthlim;
2771 		else
2772 			*hlim = im6o->im6o_multicast_hlim;
2773 		return (0);
2774 
2775 	case IPV6_MULTICAST_LOOP:
2776 		loop = mtod(*mp, u_int *);
2777 		(*mp)->m_len = sizeof(u_int);
2778 		if (im6o == NULL)
2779 			*loop = ip6_defmcasthlim;
2780 		else
2781 			*loop = im6o->im6o_multicast_loop;
2782 		return (0);
2783 
2784 	default:
2785 		return (EOPNOTSUPP);
2786 	}
2787 }
2788 
2789 /*
2790  * Discard the IP6 multicast options.
2791  */
2792 void
2793 ip6_freemoptions(im6o)
2794 	struct ip6_moptions *im6o;
2795 {
2796 	struct in6_multi_mship *imm;
2797 
2798 	if (im6o == NULL)
2799 		return;
2800 
2801 	while ((imm = im6o->im6o_memberships.lh_first) != NULL) {
2802 		LIST_REMOVE(imm, i6mm_chain);
2803 		in6_leavegroup(imm);
2804 	}
2805 	free(im6o, M_IPMOPTS);
2806 }
2807 
2808 /*
2809  * Set IPv6 outgoing packet options based on advanced API.
2810  */
2811 int
2812 ip6_setpktopts(control, opt, stickyopt, priv, uproto)
2813 	struct mbuf *control;
2814 	struct ip6_pktopts *opt, *stickyopt;
2815 	int priv, uproto;
2816 {
2817 	struct cmsghdr *cm = 0;
2818 
2819 	if (control == NULL || opt == NULL)
2820 		return (EINVAL);
2821 
2822 	ip6_initpktopts(opt);
2823 	if (stickyopt) {
2824 		int error;
2825 
2826 		/*
2827 		 * If stickyopt is provided, make a local copy of the options
2828 		 * for this particular packet, then override them by ancillary
2829 		 * objects.
2830 		 * XXX: copypktopts() does not copy the cached route to a next
2831 		 * hop (if any).  This is not very good in terms of efficiency,
2832 		 * but we can allow this since this option should be rarely
2833 		 * used.
2834 		 */
2835 		if ((error = copypktopts(opt, stickyopt, M_NOWAIT)) != 0)
2836 			return (error);
2837 	}
2838 
2839 	/*
2840 	 * XXX: Currently, we assume all the optional information is stored
2841 	 * in a single mbuf.
2842 	 */
2843 	if (control->m_next)
2844 		return (EINVAL);
2845 
2846 	for (; control->m_len; control->m_data += CMSG_ALIGN(cm->cmsg_len),
2847 	    control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
2848 		int error;
2849 
2850 		if (control->m_len < CMSG_LEN(0))
2851 			return (EINVAL);
2852 
2853 		cm = mtod(control, struct cmsghdr *);
2854 		if (cm->cmsg_len == 0 || cm->cmsg_len > control->m_len)
2855 			return (EINVAL);
2856 		if (cm->cmsg_level != IPPROTO_IPV6)
2857 			continue;
2858 
2859 		error = ip6_setpktopt(cm->cmsg_type, CMSG_DATA(cm),
2860 		    cm->cmsg_len - CMSG_LEN(0), opt, priv, 0, 1, uproto);
2861 		if (error)
2862 			return (error);
2863 	}
2864 
2865 	return (0);
2866 }
2867 
2868 /*
2869  * Set a particular packet option, as a sticky option or an ancillary data
2870  * item.  "len" can be 0 only when it's a sticky option.
2871  * We have 4 cases of combination of "sticky" and "cmsg":
2872  * "sticky=0, cmsg=0": impossible
2873  * "sticky=0, cmsg=1": RFC2292 or RFC3542 ancillary data
2874  * "sticky=1, cmsg=0": RFC3542 socket option
2875  * "sticky=1, cmsg=1": RFC2292 socket option
2876  */
2877 static int
2878 ip6_setpktopt(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
2879     int priv, int sticky, int cmsg, int uproto)
2880 {
2881 	int minmtupolicy;
2882 
2883 	if (!sticky && !cmsg) {
2884 #ifdef DIAGNOSTIC
2885 		printf("ip6_setpktopt: impossible case\n");
2886 #endif
2887 		return (EINVAL);
2888 	}
2889 
2890 	/*
2891 	 * IPV6_2292xxx is for backward compatibility to RFC2292, and should
2892 	 * not be specified in the context of RFC3542.  Conversely,
2893 	 * RFC3542 types should not be specified in the context of RFC2292.
2894 	 */
2895 	if (!cmsg) {
2896 		switch (optname) {
2897 		case IPV6_2292PKTINFO:
2898 		case IPV6_2292HOPLIMIT:
2899 		case IPV6_2292NEXTHOP:
2900 		case IPV6_2292HOPOPTS:
2901 		case IPV6_2292DSTOPTS:
2902 		case IPV6_2292RTHDR:
2903 		case IPV6_2292PKTOPTIONS:
2904 			return (ENOPROTOOPT);
2905 		}
2906 	}
2907 	if (sticky && cmsg) {
2908 		switch (optname) {
2909 		case IPV6_PKTINFO:
2910 		case IPV6_HOPLIMIT:
2911 		case IPV6_NEXTHOP:
2912 		case IPV6_HOPOPTS:
2913 		case IPV6_DSTOPTS:
2914 		case IPV6_RTHDRDSTOPTS:
2915 		case IPV6_RTHDR:
2916 		case IPV6_USE_MIN_MTU:
2917 		case IPV6_DONTFRAG:
2918 		case IPV6_OTCLASS:
2919 		case IPV6_TCLASS:
2920 			return (ENOPROTOOPT);
2921 		}
2922 	}
2923 
2924 	switch (optname) {
2925 #ifdef RFC2292
2926 	case IPV6_2292PKTINFO:
2927 #endif
2928 	case IPV6_PKTINFO:
2929 	{
2930 		struct ifnet *ifp = NULL;
2931 		struct in6_pktinfo *pktinfo;
2932 
2933 		if (len != sizeof(struct in6_pktinfo))
2934 			return (EINVAL);
2935 
2936 		pktinfo = (struct in6_pktinfo *)buf;
2937 
2938 		/*
2939 		 * An application can clear any sticky IPV6_PKTINFO option by
2940 		 * doing a "regular" setsockopt with ipi6_addr being
2941 		 * in6addr_any and ipi6_ifindex being zero.
2942 		 * [RFC 3542, Section 6]
2943 		 */
2944 		if (optname == IPV6_PKTINFO && opt->ip6po_pktinfo &&
2945 		    pktinfo->ipi6_ifindex == 0 &&
2946 		    IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
2947 			ip6_clearpktopts(opt, optname);
2948 			break;
2949 		}
2950 
2951 		if (uproto == IPPROTO_TCP && optname == IPV6_PKTINFO &&
2952 		    sticky && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
2953 			return (EINVAL);
2954 		}
2955 
2956 		/* validate the interface index if specified. */
2957 		if (pktinfo->ipi6_ifindex >= if_indexlim) {
2958 			 return (ENXIO);
2959 		}
2960 		if (pktinfo->ipi6_ifindex) {
2961 			ifp = ifindex2ifnet[pktinfo->ipi6_ifindex];
2962 			if (ifp == NULL)
2963 				return (ENXIO);
2964 		}
2965 
2966 		/*
2967 		 * We store the address anyway, and let in6_selectsrc()
2968 		 * validate the specified address.  This is because ipi6_addr
2969 		 * may not have enough information about its scope zone, and
2970 		 * we may need additional information (such as outgoing
2971 		 * interface or the scope zone of a destination address) to
2972 		 * disambiguate the scope.
2973 		 * XXX: the delay of the validation may confuse the
2974 		 * application when it is used as a sticky option.
2975 		 */
2976 		if (opt->ip6po_pktinfo == NULL) {
2977 			opt->ip6po_pktinfo = malloc(sizeof(*pktinfo),
2978 			    M_IP6OPT, M_NOWAIT);
2979 			if (opt->ip6po_pktinfo == NULL)
2980 				return (ENOBUFS);
2981 		}
2982 		memcpy(opt->ip6po_pktinfo, pktinfo, sizeof(*pktinfo));
2983 		break;
2984 	}
2985 
2986 #ifdef RFC2292
2987 	case IPV6_2292HOPLIMIT:
2988 #endif
2989 	case IPV6_HOPLIMIT:
2990 	{
2991 		int *hlimp;
2992 
2993 		/*
2994 		 * RFC 3542 deprecated the usage of sticky IPV6_HOPLIMIT
2995 		 * to simplify the ordering among hoplimit options.
2996 		 */
2997 		if (optname == IPV6_HOPLIMIT && sticky)
2998 			return (ENOPROTOOPT);
2999 
3000 		if (len != sizeof(int))
3001 			return (EINVAL);
3002 		hlimp = (int *)buf;
3003 		if (*hlimp < -1 || *hlimp > 255)
3004 			return (EINVAL);
3005 
3006 		opt->ip6po_hlim = *hlimp;
3007 		break;
3008 	}
3009 
3010 	case IPV6_OTCLASS:
3011 		if (len != sizeof(u_int8_t))
3012 			return (EINVAL);
3013 
3014 		opt->ip6po_tclass = *(u_int8_t *)buf;
3015 		break;
3016 
3017 	case IPV6_TCLASS:
3018 	{
3019 		int tclass;
3020 
3021 		if (len != sizeof(int))
3022 			return (EINVAL);
3023 		tclass = *(int *)buf;
3024 		if (tclass < -1 || tclass > 255)
3025 			return (EINVAL);
3026 
3027 		opt->ip6po_tclass = tclass;
3028 		break;
3029 	}
3030 
3031 #ifdef RFC2292
3032 	case IPV6_2292NEXTHOP:
3033 #endif
3034 	case IPV6_NEXTHOP:
3035 		if (!priv)
3036 			return (EPERM);
3037 
3038 		if (len == 0) {	/* just remove the option */
3039 			ip6_clearpktopts(opt, IPV6_NEXTHOP);
3040 			break;
3041 		}
3042 
3043 		/* check if cmsg_len is large enough for sa_len */
3044 		if (len < sizeof(struct sockaddr) || len < *buf)
3045 			return (EINVAL);
3046 
3047 		switch (((struct sockaddr *)buf)->sa_family) {
3048 		case AF_INET6:
3049 		{
3050 			struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)buf;
3051 			int error;
3052 
3053 			if (sa6->sin6_len != sizeof(struct sockaddr_in6))
3054 				return (EINVAL);
3055 
3056 			if (IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
3057 			    IN6_IS_ADDR_MULTICAST(&sa6->sin6_addr)) {
3058 				return (EINVAL);
3059 			}
3060 			if ((error = sa6_embedscope(sa6, ip6_use_defzone))
3061 			    != 0) {
3062 				return (error);
3063 			}
3064 			break;
3065 		}
3066 		case AF_LINK:	/* eventually be supported? */
3067 		default:
3068 			return (EAFNOSUPPORT);
3069 		}
3070 
3071 		/* turn off the previous option, then set the new option. */
3072 		ip6_clearpktopts(opt, IPV6_NEXTHOP);
3073 		opt->ip6po_nexthop = malloc(*buf, M_IP6OPT, M_NOWAIT);
3074 		if (opt->ip6po_nexthop == NULL)
3075 			return (ENOBUFS);
3076 		memcpy(opt->ip6po_nexthop, buf, *buf);
3077 		break;
3078 
3079 #ifdef RFC2292
3080 	case IPV6_2292HOPOPTS:
3081 #endif
3082 	case IPV6_HOPOPTS:
3083 	{
3084 		struct ip6_hbh *hbh;
3085 		int hbhlen;
3086 
3087 		/*
3088 		 * XXX: We don't allow a non-privileged user to set ANY HbH
3089 		 * options, since per-option restriction has too much
3090 		 * overhead.
3091 		 */
3092 		if (!priv)
3093 			return (EPERM);
3094 
3095 		if (len == 0) {
3096 			ip6_clearpktopts(opt, IPV6_HOPOPTS);
3097 			break;	/* just remove the option */
3098 		}
3099 
3100 		/* message length validation */
3101 		if (len < sizeof(struct ip6_hbh))
3102 			return (EINVAL);
3103 		hbh = (struct ip6_hbh *)buf;
3104 		hbhlen = (hbh->ip6h_len + 1) << 3;
3105 		if (len != hbhlen)
3106 			return (EINVAL);
3107 
3108 		/* turn off the previous option, then set the new option. */
3109 		ip6_clearpktopts(opt, IPV6_HOPOPTS);
3110 		opt->ip6po_hbh = malloc(hbhlen, M_IP6OPT, M_NOWAIT);
3111 		if (opt->ip6po_hbh == NULL)
3112 			return (ENOBUFS);
3113 		memcpy(opt->ip6po_hbh, hbh, hbhlen);
3114 
3115 		break;
3116 	}
3117 
3118 #ifdef RFC2292
3119 	case IPV6_2292DSTOPTS:
3120 #endif
3121 	case IPV6_DSTOPTS:
3122 	case IPV6_RTHDRDSTOPTS:
3123 	{
3124 		struct ip6_dest *dest, **newdest = NULL;
3125 		int destlen;
3126 
3127 		if (!priv)	/* XXX: see the comment for IPV6_HOPOPTS */
3128 			return (EPERM);
3129 
3130 		if (len == 0) {
3131 			ip6_clearpktopts(opt, optname);
3132 			break;	/* just remove the option */
3133 		}
3134 
3135 		/* message length validation */
3136 		if (len < sizeof(struct ip6_dest))
3137 			return (EINVAL);
3138 		dest = (struct ip6_dest *)buf;
3139 		destlen = (dest->ip6d_len + 1) << 3;
3140 		if (len != destlen)
3141 			return (EINVAL);
3142 		/*
3143 		 * Determine the position that the destination options header
3144 		 * should be inserted; before or after the routing header.
3145 		 */
3146 		switch (optname) {
3147 		case IPV6_2292DSTOPTS:
3148 			/*
3149 			 * The old advanced API is ambiguous on this point.
3150 			 * Our approach is to determine the position based
3151 			 * according to the existence of a routing header.
3152 			 * Note, however, that this depends on the order of the
3153 			 * extension headers in the ancillary data; the 1st
3154 			 * part of the destination options header must appear
3155 			 * before the routing header in the ancillary data,
3156 			 * too.
3157 			 * RFC3542 solved the ambiguity by introducing
3158 			 * separate ancillary data or option types.
3159 			 */
3160 			if (opt->ip6po_rthdr == NULL)
3161 				newdest = &opt->ip6po_dest1;
3162 			else
3163 				newdest = &opt->ip6po_dest2;
3164 			break;
3165 		case IPV6_RTHDRDSTOPTS:
3166 			newdest = &opt->ip6po_dest1;
3167 			break;
3168 		case IPV6_DSTOPTS:
3169 			newdest = &opt->ip6po_dest2;
3170 			break;
3171 		}
3172 
3173 		/* turn off the previous option, then set the new option. */
3174 		ip6_clearpktopts(opt, optname);
3175 		*newdest = malloc(destlen, M_IP6OPT, M_NOWAIT);
3176 		if (*newdest == NULL)
3177 			return (ENOBUFS);
3178 		memcpy(*newdest, dest, destlen);
3179 
3180 		break;
3181 	}
3182 
3183 #ifdef RFC2292
3184 	case IPV6_2292RTHDR:
3185 #endif
3186 	case IPV6_RTHDR:
3187 	{
3188 		struct ip6_rthdr *rth;
3189 		int rthlen;
3190 
3191 		if (len == 0) {
3192 			ip6_clearpktopts(opt, IPV6_RTHDR);
3193 			break;	/* just remove the option */
3194 		}
3195 
3196 		/* message length validation */
3197 		if (len < sizeof(struct ip6_rthdr))
3198 			return (EINVAL);
3199 		rth = (struct ip6_rthdr *)buf;
3200 		rthlen = (rth->ip6r_len + 1) << 3;
3201 		if (len != rthlen)
3202 			return (EINVAL);
3203 		switch (rth->ip6r_type) {
3204 		case IPV6_RTHDR_TYPE_0:
3205 			if (rth->ip6r_len == 0)	/* must contain one addr */
3206 				return (EINVAL);
3207 			if (rth->ip6r_len % 2) /* length must be even */
3208 				return (EINVAL);
3209 			if (rth->ip6r_len / 2 != rth->ip6r_segleft)
3210 				return (EINVAL);
3211 			break;
3212 		default:
3213 			return (EINVAL);	/* not supported */
3214 		}
3215 		/* turn off the previous option */
3216 		ip6_clearpktopts(opt, IPV6_RTHDR);
3217 		opt->ip6po_rthdr = malloc(rthlen, M_IP6OPT, M_NOWAIT);
3218 		if (opt->ip6po_rthdr == NULL)
3219 			return (ENOBUFS);
3220 		memcpy(opt->ip6po_rthdr, rth, rthlen);
3221 		break;
3222 	}
3223 
3224 	case IPV6_USE_MIN_MTU:
3225 		if (len != sizeof(int))
3226 			return (EINVAL);
3227 		minmtupolicy = *(int *)buf;
3228 		if (minmtupolicy != IP6PO_MINMTU_MCASTONLY &&
3229 		    minmtupolicy != IP6PO_MINMTU_DISABLE &&
3230 		    minmtupolicy != IP6PO_MINMTU_ALL) {
3231 			return (EINVAL);
3232 		}
3233 		opt->ip6po_minmtu = minmtupolicy;
3234 		break;
3235 
3236 	case IPV6_DONTFRAG:
3237 		if (len != sizeof(int))
3238 			return (EINVAL);
3239 
3240 		if (uproto == IPPROTO_TCP || *(int *)buf == 0) {
3241 			/*
3242 			 * we ignore this option for TCP sockets.
3243 			 * (RFC3542 leaves this case unspecified.)
3244 			 */
3245 			opt->ip6po_flags &= ~IP6PO_DONTFRAG;
3246 		} else
3247 			opt->ip6po_flags |= IP6PO_DONTFRAG;
3248 		break;
3249 
3250 	default:
3251 		return (ENOPROTOOPT);
3252 	} /* end of switch */
3253 
3254 	return (0);
3255 }
3256 
3257 /*
3258  * Routine called from ip6_output() to loop back a copy of an IP6 multicast
3259  * packet to the input queue of a specified interface.  Note that this
3260  * calls the output routine of the loopback "driver", but with an interface
3261  * pointer that might NOT be lo0ifp -- easier than replicating that code here.
3262  */
3263 void
3264 ip6_mloopback(ifp, m, dst)
3265 	struct ifnet *ifp;
3266 	struct mbuf *m;
3267 	struct sockaddr_in6 *dst;
3268 {
3269 	struct mbuf *copym;
3270 	struct ip6_hdr *ip6;
3271 
3272 	copym = m_copy(m, 0, M_COPYALL);
3273 	if (copym == NULL)
3274 		return;
3275 
3276 	/*
3277 	 * Make sure to deep-copy IPv6 header portion in case the data
3278 	 * is in an mbuf cluster, so that we can safely override the IPv6
3279 	 * header portion later.
3280 	 */
3281 	if ((copym->m_flags & M_EXT) != 0 ||
3282 	    copym->m_len < sizeof(struct ip6_hdr)) {
3283 		copym = m_pullup(copym, sizeof(struct ip6_hdr));
3284 		if (copym == NULL)
3285 			return;
3286 	}
3287 
3288 #ifdef DIAGNOSTIC
3289 	if (copym->m_len < sizeof(*ip6)) {
3290 		m_freem(copym);
3291 		return;
3292 	}
3293 #endif
3294 
3295 	ip6 = mtod(copym, struct ip6_hdr *);
3296 	/*
3297 	 * clear embedded scope identifiers if necessary.
3298 	 * in6_clearscope will touch the addresses only when necessary.
3299 	 */
3300 	in6_clearscope(&ip6->ip6_src);
3301 	in6_clearscope(&ip6->ip6_dst);
3302 
3303 	(void)looutput(ifp, copym, (struct sockaddr *)dst, NULL);
3304 }
3305 
3306 /*
3307  * Chop IPv6 header off from the payload.
3308  */
3309 static int
3310 ip6_splithdr(m, exthdrs)
3311 	struct mbuf *m;
3312 	struct ip6_exthdrs *exthdrs;
3313 {
3314 	struct mbuf *mh;
3315 	struct ip6_hdr *ip6;
3316 
3317 	ip6 = mtod(m, struct ip6_hdr *);
3318 	if (m->m_len > sizeof(*ip6)) {
3319 		MGETHDR(mh, M_DONTWAIT, MT_HEADER);
3320 		if (mh == 0) {
3321 			m_freem(m);
3322 			return ENOBUFS;
3323 		}
3324 		M_MOVE_PKTHDR(mh, m);
3325 		MH_ALIGN(mh, sizeof(*ip6));
3326 		m->m_len -= sizeof(*ip6);
3327 		m->m_data += sizeof(*ip6);
3328 		mh->m_next = m;
3329 		m = mh;
3330 		m->m_len = sizeof(*ip6);
3331 		bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof(*ip6));
3332 	}
3333 	exthdrs->ip6e_ip6 = m;
3334 	return 0;
3335 }
3336 
3337 /*
3338  * Compute IPv6 extension header length.
3339  */
3340 int
3341 ip6_optlen(in6p)
3342 	struct in6pcb *in6p;
3343 {
3344 	int len;
3345 
3346 	if (!in6p->in6p_outputopts)
3347 		return 0;
3348 
3349 	len = 0;
3350 #define elen(x) \
3351     (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
3352 
3353 	len += elen(in6p->in6p_outputopts->ip6po_hbh);
3354 	len += elen(in6p->in6p_outputopts->ip6po_dest1);
3355 	len += elen(in6p->in6p_outputopts->ip6po_rthdr);
3356 	len += elen(in6p->in6p_outputopts->ip6po_dest2);
3357 	return len;
3358 #undef elen
3359 }
3360