xref: /netbsd-src/sys/netinet6/ip6_output.c (revision 7330f729ccf0bd976a06f95fad452fe774fc7fd1)
1 /*	$NetBSD: ip6_output.c,v 1.221 2019/11/01 04:23:21 knakahara Exp $	*/
2 /*	$KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1990, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
62  */
63 
64 #include <sys/cdefs.h>
65 __KERNEL_RCSID(0, "$NetBSD: ip6_output.c,v 1.221 2019/11/01 04:23:21 knakahara Exp $");
66 
67 #ifdef _KERNEL_OPT
68 #include "opt_inet.h"
69 #include "opt_inet6.h"
70 #include "opt_ipsec.h"
71 #endif
72 
73 #include <sys/param.h>
74 #include <sys/malloc.h>
75 #include <sys/mbuf.h>
76 #include <sys/errno.h>
77 #include <sys/socket.h>
78 #include <sys/socketvar.h>
79 #include <sys/syslog.h>
80 #include <sys/systm.h>
81 #include <sys/proc.h>
82 #include <sys/kauth.h>
83 
84 #include <net/if.h>
85 #include <net/route.h>
86 #include <net/pfil.h>
87 
88 #include <netinet/in.h>
89 #include <netinet/in_var.h>
90 #include <netinet/ip6.h>
91 #include <netinet/ip_var.h>
92 #include <netinet/icmp6.h>
93 #include <netinet/in_offload.h>
94 #include <netinet/portalgo.h>
95 #include <netinet6/in6_offload.h>
96 #include <netinet6/ip6_var.h>
97 #include <netinet6/ip6_private.h>
98 #include <netinet6/in6_pcb.h>
99 #include <netinet6/nd6.h>
100 #include <netinet6/ip6protosw.h>
101 #include <netinet6/scope6_var.h>
102 
103 #ifdef IPSEC
104 #include <netipsec/ipsec.h>
105 #include <netipsec/ipsec6.h>
106 #include <netipsec/key.h>
107 #endif
108 
109 extern pfil_head_t *inet6_pfil_hook;	/* XXX */
110 
111 struct ip6_exthdrs {
112 	struct mbuf *ip6e_ip6;
113 	struct mbuf *ip6e_hbh;
114 	struct mbuf *ip6e_dest1;
115 	struct mbuf *ip6e_rthdr;
116 	struct mbuf *ip6e_dest2;
117 };
118 
119 static int ip6_pcbopt(int, u_char *, int, struct ip6_pktopts **,
120 	kauth_cred_t, int);
121 static int ip6_getpcbopt(struct ip6_pktopts *, int, struct sockopt *);
122 static int ip6_setpktopt(int, u_char *, int, struct ip6_pktopts *, kauth_cred_t,
123 	int, int, int);
124 static int ip6_setmoptions(const struct sockopt *, struct in6pcb *);
125 static int ip6_getmoptions(struct sockopt *, struct in6pcb *);
126 static int ip6_copyexthdr(struct mbuf **, void *, int);
127 static int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
128 	struct ip6_frag **);
129 static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
130 static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
131 static int ip6_getpmtu(struct rtentry *, struct ifnet *, u_long *, int *);
132 static int copypktopts(struct ip6_pktopts *, struct ip6_pktopts *, int);
133 static int ip6_ifaddrvalid(const struct in6_addr *, const struct in6_addr *);
134 static int ip6_handle_rthdr(struct ip6_rthdr *, struct ip6_hdr *);
135 
136 #ifdef RFC2292
137 static int ip6_pcbopts(struct ip6_pktopts **, struct socket *, struct sockopt *);
138 #endif
139 
140 static int
141 ip6_handle_rthdr(struct ip6_rthdr *rh, struct ip6_hdr *ip6)
142 {
143 	int error = 0;
144 
145 	switch (rh->ip6r_type) {
146 	case IPV6_RTHDR_TYPE_0:
147 		/* Dropped, RFC5095. */
148 	default:	/* is it possible? */
149 		error = EINVAL;
150 	}
151 
152 	return error;
153 }
154 
155 /*
156  * Send an IP packet to a host.
157  */
158 int
159 ip6_if_output(struct ifnet * const ifp, struct ifnet * const origifp,
160     struct mbuf * const m, const struct sockaddr_in6 * const dst,
161     const struct rtentry *rt)
162 {
163 	int error = 0;
164 
165 	if (rt != NULL) {
166 		error = rt_check_reject_route(rt, ifp);
167 		if (error != 0) {
168 			m_freem(m);
169 			return error;
170 		}
171 	}
172 
173 	if ((ifp->if_flags & IFF_LOOPBACK) != 0)
174 		error = if_output_lock(ifp, origifp, m, sin6tocsa(dst), rt);
175 	else
176 		error = if_output_lock(ifp, ifp, m, sin6tocsa(dst), rt);
177 	return error;
178 }
179 
180 /*
181  * IP6 output. The packet in mbuf chain m contains a skeletal IP6
182  * header (with pri, len, nxt, hlim, src, dst).
183  *
184  * This function may modify ver and hlim only. The mbuf chain containing the
185  * packet will be freed. The mbuf opt, if present, will not be freed.
186  *
187  * Type of "mtu": rt_rmx.rmx_mtu is u_long, ifnet.ifr_mtu is int, and
188  * nd_ifinfo.linkmtu is u_int32_t. So we use u_long to hold largest one,
189  * which is rt_rmx.rmx_mtu.
190  */
191 int
192 ip6_output(
193     struct mbuf *m0,
194     struct ip6_pktopts *opt,
195     struct route *ro,
196     int flags,
197     struct ip6_moptions *im6o,
198     struct in6pcb *in6p,
199     struct ifnet **ifpp		/* XXX: just for statistics */
200 )
201 {
202 	struct ip6_hdr *ip6, *mhip6;
203 	struct ifnet *ifp = NULL, *origifp = NULL;
204 	struct mbuf *m = m0;
205 	int tlen, len, off;
206 	bool tso;
207 	struct route ip6route;
208 	struct rtentry *rt = NULL, *rt_pmtu;
209 	const struct sockaddr_in6 *dst;
210 	struct sockaddr_in6 src_sa, dst_sa;
211 	int error = 0;
212 	struct in6_ifaddr *ia = NULL;
213 	u_long mtu;
214 	int alwaysfrag, dontfrag;
215 	u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
216 	struct ip6_exthdrs exthdrs;
217 	struct in6_addr finaldst, src0, dst0;
218 	u_int32_t zone;
219 	struct route *ro_pmtu = NULL;
220 	int hdrsplit = 0;
221 	int needipsec = 0;
222 #ifdef IPSEC
223 	struct secpolicy *sp = NULL;
224 #endif
225 	struct psref psref, psref_ia;
226 	int bound = curlwp_bind();
227 	bool release_psref_ia = false;
228 
229 #ifdef DIAGNOSTIC
230 	if ((m->m_flags & M_PKTHDR) == 0)
231 		panic("ip6_output: no HDR");
232 	if ((m->m_pkthdr.csum_flags &
233 	    (M_CSUM_TCPv4|M_CSUM_UDPv4|M_CSUM_TSOv4)) != 0) {
234 		panic("ip6_output: IPv4 checksum offload flags: %d",
235 		    m->m_pkthdr.csum_flags);
236 	}
237 	if ((m->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) ==
238 	    (M_CSUM_TCPv6|M_CSUM_UDPv6)) {
239 		panic("ip6_output: conflicting checksum offload flags: %d",
240 		    m->m_pkthdr.csum_flags);
241 	}
242 #endif
243 
244 	M_CSUM_DATA_IPv6_SET(m->m_pkthdr.csum_data, sizeof(struct ip6_hdr));
245 
246 #define MAKE_EXTHDR(hp, mp)						\
247     do {								\
248 	if (hp) {							\
249 		struct ip6_ext *eh = (struct ip6_ext *)(hp);		\
250 		error = ip6_copyexthdr((mp), (void *)(hp), 		\
251 		    ((eh)->ip6e_len + 1) << 3);				\
252 		if (error)						\
253 			goto freehdrs;					\
254 	}								\
255     } while (/*CONSTCOND*/ 0)
256 
257 	memset(&exthdrs, 0, sizeof(exthdrs));
258 	if (opt) {
259 		/* Hop-by-Hop options header */
260 		MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
261 		/* Destination options header (1st part) */
262 		MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
263 		/* Routing header */
264 		MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
265 		/* Destination options header (2nd part) */
266 		MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
267 	}
268 
269 	/*
270 	 * Calculate the total length of the extension header chain.
271 	 * Keep the length of the unfragmentable part for fragmentation.
272 	 */
273 	optlen = 0;
274 	if (exthdrs.ip6e_hbh)
275 		optlen += exthdrs.ip6e_hbh->m_len;
276 	if (exthdrs.ip6e_dest1)
277 		optlen += exthdrs.ip6e_dest1->m_len;
278 	if (exthdrs.ip6e_rthdr)
279 		optlen += exthdrs.ip6e_rthdr->m_len;
280 	unfragpartlen = optlen + sizeof(struct ip6_hdr);
281 	/* NOTE: we don't add AH/ESP length here. do that later. */
282 	if (exthdrs.ip6e_dest2)
283 		optlen += exthdrs.ip6e_dest2->m_len;
284 
285 #ifdef IPSEC
286 	if (ipsec_used) {
287 		/* Check the security policy (SP) for the packet */
288 		sp = ipsec6_check_policy(m, in6p, flags, &needipsec, &error);
289 		if (error != 0) {
290 			/*
291 			 * Hack: -EINVAL is used to signal that a packet
292 			 * should be silently discarded.  This is typically
293 			 * because we asked key management for an SA and
294 			 * it was delayed (e.g. kicked up to IKE).
295 			 */
296 			if (error == -EINVAL)
297 				error = 0;
298 			goto freehdrs;
299 		}
300 	}
301 #endif
302 
303 	if (needipsec &&
304 	    (m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0) {
305 		in6_undefer_cksum_tcpudp(m);
306 		m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
307 	}
308 
309 	/*
310 	 * If we need IPsec, or there is at least one extension header,
311 	 * separate IP6 header from the payload.
312 	 */
313 	if ((needipsec || optlen) && !hdrsplit) {
314 		if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
315 			m = NULL;
316 			goto freehdrs;
317 		}
318 		m = exthdrs.ip6e_ip6;
319 		hdrsplit++;
320 	}
321 
322 	/* adjust pointer */
323 	ip6 = mtod(m, struct ip6_hdr *);
324 
325 	/* adjust mbuf packet header length */
326 	m->m_pkthdr.len += optlen;
327 	plen = m->m_pkthdr.len - sizeof(*ip6);
328 
329 	/* If this is a jumbo payload, insert a jumbo payload option. */
330 	if (plen > IPV6_MAXPACKET) {
331 		if (!hdrsplit) {
332 			if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
333 				m = NULL;
334 				goto freehdrs;
335 			}
336 			m = exthdrs.ip6e_ip6;
337 			hdrsplit++;
338 		}
339 		/* adjust pointer */
340 		ip6 = mtod(m, struct ip6_hdr *);
341 		if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
342 			goto freehdrs;
343 		optlen += 8; /* XXX JUMBOOPTLEN */
344 		ip6->ip6_plen = 0;
345 	} else
346 		ip6->ip6_plen = htons(plen);
347 
348 	/*
349 	 * Concatenate headers and fill in next header fields.
350 	 * Here we have, on "m"
351 	 *	IPv6 payload
352 	 * and we insert headers accordingly.  Finally, we should be getting:
353 	 *	IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
354 	 *
355 	 * during the header composing process, "m" points to IPv6 header.
356 	 * "mprev" points to an extension header prior to esp.
357 	 */
358 	{
359 		u_char *nexthdrp = &ip6->ip6_nxt;
360 		struct mbuf *mprev = m;
361 
362 		/*
363 		 * we treat dest2 specially.  this makes IPsec processing
364 		 * much easier.  the goal here is to make mprev point the
365 		 * mbuf prior to dest2.
366 		 *
367 		 * result: IPv6 dest2 payload
368 		 * m and mprev will point to IPv6 header.
369 		 */
370 		if (exthdrs.ip6e_dest2) {
371 			if (!hdrsplit)
372 				panic("assumption failed: hdr not split");
373 			exthdrs.ip6e_dest2->m_next = m->m_next;
374 			m->m_next = exthdrs.ip6e_dest2;
375 			*mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
376 			ip6->ip6_nxt = IPPROTO_DSTOPTS;
377 		}
378 
379 #define MAKE_CHAIN(m, mp, p, i)\
380     do {\
381 	if (m) {\
382 		if (!hdrsplit) \
383 			panic("assumption failed: hdr not split"); \
384 		*mtod((m), u_char *) = *(p);\
385 		*(p) = (i);\
386 		p = mtod((m), u_char *);\
387 		(m)->m_next = (mp)->m_next;\
388 		(mp)->m_next = (m);\
389 		(mp) = (m);\
390 	}\
391     } while (/*CONSTCOND*/ 0)
392 		/*
393 		 * result: IPv6 hbh dest1 rthdr dest2 payload
394 		 * m will point to IPv6 header.  mprev will point to the
395 		 * extension header prior to dest2 (rthdr in the above case).
396 		 */
397 		MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
398 		MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp,
399 		    IPPROTO_DSTOPTS);
400 		MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp,
401 		    IPPROTO_ROUTING);
402 
403 		M_CSUM_DATA_IPv6_SET(m->m_pkthdr.csum_data,
404 		    sizeof(struct ip6_hdr) + optlen);
405 	}
406 
407 	/* Need to save for pmtu */
408 	finaldst = ip6->ip6_dst;
409 
410 	/*
411 	 * If there is a routing header, replace destination address field
412 	 * with the first hop of the routing header.
413 	 */
414 	if (exthdrs.ip6e_rthdr) {
415 		struct ip6_rthdr *rh;
416 
417 		rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
418 
419 		error = ip6_handle_rthdr(rh, ip6);
420 		if (error != 0)
421 			goto bad;
422 	}
423 
424 	/* Source address validation */
425 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
426 	    (flags & IPV6_UNSPECSRC) == 0) {
427 		error = EOPNOTSUPP;
428 		IP6_STATINC(IP6_STAT_BADSCOPE);
429 		goto bad;
430 	}
431 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
432 		error = EOPNOTSUPP;
433 		IP6_STATINC(IP6_STAT_BADSCOPE);
434 		goto bad;
435 	}
436 
437 	IP6_STATINC(IP6_STAT_LOCALOUT);
438 
439 	/*
440 	 * Route packet.
441 	 */
442 	/* initialize cached route */
443 	if (ro == NULL) {
444 		memset(&ip6route, 0, sizeof(ip6route));
445 		ro = &ip6route;
446 	}
447 	ro_pmtu = ro;
448 	if (opt && opt->ip6po_rthdr)
449 		ro = &opt->ip6po_route;
450 
451 	/*
452 	 * if specified, try to fill in the traffic class field.
453 	 * do not override if a non-zero value is already set.
454 	 * we check the diffserv field and the ecn field separately.
455 	 */
456 	if (opt && opt->ip6po_tclass >= 0) {
457 		int mask = 0;
458 
459 		if ((ip6->ip6_flow & htonl(0xfc << 20)) == 0)
460 			mask |= 0xfc;
461 		if ((ip6->ip6_flow & htonl(0x03 << 20)) == 0)
462 			mask |= 0x03;
463 		if (mask != 0)
464 			ip6->ip6_flow |= htonl((opt->ip6po_tclass & mask) << 20);
465 	}
466 
467 	/* fill in or override the hop limit field, if necessary. */
468 	if (opt && opt->ip6po_hlim != -1)
469 		ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
470 	else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
471 		if (im6o != NULL)
472 			ip6->ip6_hlim = im6o->im6o_multicast_hlim;
473 		else
474 			ip6->ip6_hlim = ip6_defmcasthlim;
475 	}
476 
477 #ifdef IPSEC
478 	if (needipsec) {
479 		int s = splsoftnet();
480 		error = ipsec6_process_packet(m, sp->req, flags);
481 		splx(s);
482 
483 		/*
484 		 * Preserve KAME behaviour: ENOENT can be returned
485 		 * when an SA acquire is in progress.  Don't propagate
486 		 * this to user-level; it confuses applications.
487 		 * XXX this will go away when the SADB is redone.
488 		 */
489 		if (error == ENOENT)
490 			error = 0;
491 
492 		goto done;
493 	}
494 #endif
495 
496 	/* adjust pointer */
497 	ip6 = mtod(m, struct ip6_hdr *);
498 
499 	sockaddr_in6_init(&dst_sa, &ip6->ip6_dst, 0, 0, 0);
500 
501 	/* We do not need a route for multicast */
502 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
503 		struct in6_pktinfo *pi = NULL;
504 
505 		/*
506 		 * If the outgoing interface for the address is specified by
507 		 * the caller, use it.
508 		 */
509 		if (opt && (pi = opt->ip6po_pktinfo) != NULL) {
510 			/* XXX boundary check is assumed to be already done. */
511 			ifp = if_get_byindex(pi->ipi6_ifindex, &psref);
512 		} else if (im6o != NULL) {
513 			ifp = if_get_byindex(im6o->im6o_multicast_if_index,
514 			    &psref);
515 		}
516 	}
517 
518 	if (ifp == NULL) {
519 		error = in6_selectroute(&dst_sa, opt, &ro, &rt, true);
520 		if (error != 0)
521 			goto bad;
522 		ifp = if_get_byindex(rt->rt_ifp->if_index, &psref);
523 	}
524 
525 	if (rt == NULL) {
526 		/*
527 		 * If in6_selectroute() does not return a route entry,
528 		 * dst may not have been updated.
529 		 */
530 		error = rtcache_setdst(ro, sin6tosa(&dst_sa));
531 		if (error) {
532 			goto bad;
533 		}
534 	}
535 
536 	/*
537 	 * then rt (for unicast) and ifp must be non-NULL valid values.
538 	 */
539 	if ((flags & IPV6_FORWARDING) == 0) {
540 		/* XXX: the FORWARDING flag can be set for mrouting. */
541 		in6_ifstat_inc(ifp, ifs6_out_request);
542 	}
543 	if (rt != NULL) {
544 		ia = (struct in6_ifaddr *)(rt->rt_ifa);
545 		rt->rt_use++;
546 	}
547 
548 	/*
549 	 * The outgoing interface must be in the zone of source and
550 	 * destination addresses.  We should use ia_ifp to support the
551 	 * case of sending packets to an address of our own.
552 	 */
553 	if (ia != NULL && ia->ia_ifp) {
554 		origifp = ia->ia_ifp;
555 		if (if_is_deactivated(origifp))
556 			goto bad;
557 		if_acquire(origifp, &psref_ia);
558 		release_psref_ia = true;
559 	} else
560 		origifp = ifp;
561 
562 	src0 = ip6->ip6_src;
563 	if (in6_setscope(&src0, origifp, &zone))
564 		goto badscope;
565 	sockaddr_in6_init(&src_sa, &ip6->ip6_src, 0, 0, 0);
566 	if (sa6_recoverscope(&src_sa) || zone != src_sa.sin6_scope_id)
567 		goto badscope;
568 
569 	dst0 = ip6->ip6_dst;
570 	if (in6_setscope(&dst0, origifp, &zone))
571 		goto badscope;
572 	/* re-initialize to be sure */
573 	sockaddr_in6_init(&dst_sa, &ip6->ip6_dst, 0, 0, 0);
574 	if (sa6_recoverscope(&dst_sa) || zone != dst_sa.sin6_scope_id)
575 		goto badscope;
576 
577 	/* scope check is done. */
578 
579 	/* Ensure we only send from a valid address. */
580 	if ((ifp->if_flags & IFF_LOOPBACK) == 0 &&
581 	    (flags & IPV6_FORWARDING) == 0 &&
582 	    (error = ip6_ifaddrvalid(&src0, &dst0)) != 0)
583 	{
584 		char ip6buf[INET6_ADDRSTRLEN];
585 		nd6log(LOG_ERR,
586 		    "refusing to send from invalid address %s (pid %d)\n",
587 		    IN6_PRINT(ip6buf, &src0), curproc->p_pid);
588 		IP6_STATINC(IP6_STAT_ODROPPED);
589 		in6_ifstat_inc(origifp, ifs6_out_discard);
590 		if (error == 1)
591 			/*
592 			 * Address exists, but is tentative or detached.
593 			 * We can't send from it because it's invalid,
594 			 * so we drop the packet.
595 			 */
596 			error = 0;
597 		else
598 			error = EADDRNOTAVAIL;
599 		goto bad;
600 	}
601 
602 	if (rt != NULL && (rt->rt_flags & RTF_GATEWAY) &&
603 	    !IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
604 		dst = satocsin6(rt->rt_gateway);
605 	else
606 		dst = satocsin6(rtcache_getdst(ro));
607 
608 	/*
609 	 * XXXXXX: original code follows:
610 	 */
611 	if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
612 		m->m_flags &= ~(M_BCAST | M_MCAST);	/* just in case */
613 	else {
614 		bool ingroup;
615 
616 		m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
617 
618 		in6_ifstat_inc(ifp, ifs6_out_mcast);
619 
620 		/*
621 		 * Confirm that the outgoing interface supports multicast.
622 		 */
623 		if (!(ifp->if_flags & IFF_MULTICAST)) {
624 			IP6_STATINC(IP6_STAT_NOROUTE);
625 			in6_ifstat_inc(ifp, ifs6_out_discard);
626 			error = ENETUNREACH;
627 			goto bad;
628 		}
629 
630 		ingroup = in6_multi_group(&ip6->ip6_dst, ifp);
631 		if (ingroup && (im6o == NULL || im6o->im6o_multicast_loop)) {
632 			/*
633 			 * If we belong to the destination multicast group
634 			 * on the outgoing interface, and the caller did not
635 			 * forbid loopback, loop back a copy.
636 			 */
637 			KASSERT(dst != NULL);
638 			ip6_mloopback(ifp, m, dst);
639 		} else {
640 			/*
641 			 * If we are acting as a multicast router, perform
642 			 * multicast forwarding as if the packet had just
643 			 * arrived on the interface to which we are about
644 			 * to send.  The multicast forwarding function
645 			 * recursively calls this function, using the
646 			 * IPV6_FORWARDING flag to prevent infinite recursion.
647 			 *
648 			 * Multicasts that are looped back by ip6_mloopback(),
649 			 * above, will be forwarded by the ip6_input() routine,
650 			 * if necessary.
651 			 */
652 			if (ip6_mrouter && (flags & IPV6_FORWARDING) == 0) {
653 				if (ip6_mforward(ip6, ifp, m) != 0) {
654 					m_freem(m);
655 					goto done;
656 				}
657 			}
658 		}
659 		/*
660 		 * Multicasts with a hoplimit of zero may be looped back,
661 		 * above, but must not be transmitted on a network.
662 		 * Also, multicasts addressed to the loopback interface
663 		 * are not sent -- the above call to ip6_mloopback() will
664 		 * loop back a copy if this host actually belongs to the
665 		 * destination group on the loopback interface.
666 		 */
667 		if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK) ||
668 		    IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst)) {
669 			m_freem(m);
670 			goto done;
671 		}
672 	}
673 
674 	/*
675 	 * Fill the outgoing inteface to tell the upper layer
676 	 * to increment per-interface statistics.
677 	 */
678 	if (ifpp)
679 		*ifpp = ifp;
680 
681 	/* Determine path MTU. */
682 	/*
683 	 * ro_pmtu represent final destination while
684 	 * ro might represent immediate destination.
685 	 * Use ro_pmtu destination since MTU might differ.
686 	 */
687 	if (ro_pmtu != ro) {
688 		union {
689 			struct sockaddr		dst;
690 			struct sockaddr_in6	dst6;
691 		} u;
692 
693 		/* ro_pmtu may not have a cache */
694 		sockaddr_in6_init(&u.dst6, &finaldst, 0, 0, 0);
695 		rt_pmtu = rtcache_lookup(ro_pmtu, &u.dst);
696 	} else
697 		rt_pmtu = rt;
698 	error = ip6_getpmtu(rt_pmtu, ifp, &mtu, &alwaysfrag);
699 	if (rt_pmtu != NULL && rt_pmtu != rt)
700 		rtcache_unref(rt_pmtu, ro_pmtu);
701 	if (error != 0)
702 		goto bad;
703 
704 	/*
705 	 * The caller of this function may specify to use the minimum MTU
706 	 * in some cases.
707 	 * An advanced API option (IPV6_USE_MIN_MTU) can also override MTU
708 	 * setting.  The logic is a bit complicated; by default, unicast
709 	 * packets will follow path MTU while multicast packets will be sent at
710 	 * the minimum MTU.  If IP6PO_MINMTU_ALL is specified, all packets
711 	 * including unicast ones will be sent at the minimum MTU.  Multicast
712 	 * packets will always be sent at the minimum MTU unless
713 	 * IP6PO_MINMTU_DISABLE is explicitly specified.
714 	 * See RFC 3542 for more details.
715 	 */
716 	if (mtu > IPV6_MMTU) {
717 		if ((flags & IPV6_MINMTU))
718 			mtu = IPV6_MMTU;
719 		else if (opt && opt->ip6po_minmtu == IP6PO_MINMTU_ALL)
720 			mtu = IPV6_MMTU;
721 		else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
722 			 (opt == NULL ||
723 			  opt->ip6po_minmtu != IP6PO_MINMTU_DISABLE)) {
724 			mtu = IPV6_MMTU;
725 		}
726 	}
727 
728 	/*
729 	 * clear embedded scope identifiers if necessary.
730 	 * in6_clearscope will touch the addresses only when necessary.
731 	 */
732 	in6_clearscope(&ip6->ip6_src);
733 	in6_clearscope(&ip6->ip6_dst);
734 
735 	/*
736 	 * If the outgoing packet contains a hop-by-hop options header,
737 	 * it must be examined and processed even by the source node.
738 	 * (RFC 2460, section 4.)
739 	 *
740 	 * XXX Is this really necessary?
741 	 */
742 	if (ip6->ip6_nxt == IPPROTO_HOPOPTS) {
743 		u_int32_t dummy1; /* XXX unused */
744 		u_int32_t dummy2; /* XXX unused */
745 		int hoff = sizeof(struct ip6_hdr);
746 
747 		if (ip6_hopopts_input(&dummy1, &dummy2, &m, &hoff)) {
748 			/* m was already freed at this point */
749 			error = EINVAL;
750 			goto done;
751 		}
752 
753 		ip6 = mtod(m, struct ip6_hdr *);
754 	}
755 
756 	/*
757 	 * Run through list of hooks for output packets.
758 	 */
759 	error = pfil_run_hooks(inet6_pfil_hook, &m, ifp, PFIL_OUT);
760 	if (error != 0 || m == NULL) {
761 		IP6_STATINC(IP6_STAT_PFILDROP_OUT);
762 		goto done;
763 	}
764 	ip6 = mtod(m, struct ip6_hdr *);
765 
766 	/*
767 	 * Send the packet to the outgoing interface.
768 	 * If necessary, do IPv6 fragmentation before sending.
769 	 *
770 	 * the logic here is rather complex:
771 	 * 1: normal case (dontfrag == 0, alwaysfrag == 0)
772 	 * 1-a:	send as is if tlen <= path mtu
773 	 * 1-b:	fragment if tlen > path mtu
774 	 *
775 	 * 2: if user asks us not to fragment (dontfrag == 1)
776 	 * 2-a:	send as is if tlen <= interface mtu
777 	 * 2-b:	error if tlen > interface mtu
778 	 *
779 	 * 3: if we always need to attach fragment header (alwaysfrag == 1)
780 	 *	always fragment
781 	 *
782 	 * 4: if dontfrag == 1 && alwaysfrag == 1
783 	 *	error, as we cannot handle this conflicting request
784 	 */
785 	tlen = m->m_pkthdr.len;
786 	tso = (m->m_pkthdr.csum_flags & M_CSUM_TSOv6) != 0;
787 	if (opt && (opt->ip6po_flags & IP6PO_DONTFRAG))
788 		dontfrag = 1;
789 	else
790 		dontfrag = 0;
791 
792 	if (dontfrag && alwaysfrag) {	/* case 4 */
793 		/* conflicting request - can't transmit */
794 		error = EMSGSIZE;
795 		goto bad;
796 	}
797 	if (dontfrag && (!tso && tlen > IN6_LINKMTU(ifp))) {	/* case 2-b */
798 		/*
799 		 * Even if the DONTFRAG option is specified, we cannot send the
800 		 * packet when the data length is larger than the MTU of the
801 		 * outgoing interface.
802 		 * Notify the error by sending IPV6_PATHMTU ancillary data as
803 		 * well as returning an error code (the latter is not described
804 		 * in the API spec.)
805 		 */
806 		u_int32_t mtu32;
807 		struct ip6ctlparam ip6cp;
808 
809 		mtu32 = (u_int32_t)mtu;
810 		memset(&ip6cp, 0, sizeof(ip6cp));
811 		ip6cp.ip6c_cmdarg = (void *)&mtu32;
812 		pfctlinput2(PRC_MSGSIZE,
813 		    rtcache_getdst(ro_pmtu), &ip6cp);
814 
815 		error = EMSGSIZE;
816 		goto bad;
817 	}
818 
819 	/*
820 	 * transmit packet without fragmentation
821 	 */
822 	if (dontfrag || (!alwaysfrag && (tlen <= mtu || tso))) {
823 		/* case 1-a and 2-a */
824 		struct in6_ifaddr *ia6;
825 		int sw_csum;
826 		int s;
827 
828 		ip6 = mtod(m, struct ip6_hdr *);
829 		s = pserialize_read_enter();
830 		ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
831 		if (ia6) {
832 			/* Record statistics for this interface address. */
833 			ia6->ia_ifa.ifa_data.ifad_outbytes += m->m_pkthdr.len;
834 		}
835 		pserialize_read_exit(s);
836 
837 		sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_csum_flags_tx;
838 		if ((sw_csum & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0) {
839 			if (IN6_NEED_CHECKSUM(ifp,
840 			    sw_csum & (M_CSUM_UDPv6|M_CSUM_TCPv6))) {
841 				in6_undefer_cksum_tcpudp(m);
842 			}
843 			m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
844 		}
845 
846 		KASSERT(dst != NULL);
847 		if (__predict_false(sw_csum & M_CSUM_TSOv6)) {
848 			/*
849 			 * TSO6 is required by a packet, but disabled for
850 			 * the interface.
851 			 */
852 			error = ip6_tso_output(ifp, origifp, m, dst, rt);
853 		} else
854 			error = ip6_if_output(ifp, origifp, m, dst, rt);
855 		goto done;
856 	}
857 
858 	if (tso) {
859 		error = EINVAL; /* XXX */
860 		goto bad;
861 	}
862 
863 	/*
864 	 * try to fragment the packet.  case 1-b and 3
865 	 */
866 	if (mtu < IPV6_MMTU) {
867 		/* path MTU cannot be less than IPV6_MMTU */
868 		error = EMSGSIZE;
869 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
870 		goto bad;
871 	} else if (ip6->ip6_plen == 0) {
872 		/* jumbo payload cannot be fragmented */
873 		error = EMSGSIZE;
874 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
875 		goto bad;
876 	} else {
877 		const u_int32_t id = htonl(ip6_randomid());
878 		struct mbuf **mnext, *m_frgpart;
879 		const int hlen = unfragpartlen;
880 		struct ip6_frag *ip6f;
881 		u_char nextproto;
882 
883 		if (mtu > IPV6_MAXPACKET)
884 			mtu = IPV6_MAXPACKET;
885 
886 		/*
887 		 * Must be able to put at least 8 bytes per fragment.
888 		 */
889 		len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
890 		if (len < 8) {
891 			error = EMSGSIZE;
892 			in6_ifstat_inc(ifp, ifs6_out_fragfail);
893 			goto bad;
894 		}
895 
896 		mnext = &m->m_nextpkt;
897 
898 		/*
899 		 * Change the next header field of the last header in the
900 		 * unfragmentable part.
901 		 */
902 		if (exthdrs.ip6e_rthdr) {
903 			nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
904 			*mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
905 		} else if (exthdrs.ip6e_dest1) {
906 			nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
907 			*mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
908 		} else if (exthdrs.ip6e_hbh) {
909 			nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
910 			*mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
911 		} else {
912 			nextproto = ip6->ip6_nxt;
913 			ip6->ip6_nxt = IPPROTO_FRAGMENT;
914 		}
915 
916 		if ((m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6))
917 		    != 0) {
918 			if (IN6_NEED_CHECKSUM(ifp,
919 			    m->m_pkthdr.csum_flags &
920 			    (M_CSUM_UDPv6|M_CSUM_TCPv6))) {
921 				in6_undefer_cksum_tcpudp(m);
922 			}
923 			m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
924 		}
925 
926 		/*
927 		 * Loop through length of segment after first fragment,
928 		 * make new header and copy data of each part and link onto
929 		 * chain.
930 		 */
931 		m0 = m;
932 		for (off = hlen; off < tlen; off += len) {
933 			struct mbuf *mlast;
934 
935 			MGETHDR(m, M_DONTWAIT, MT_HEADER);
936 			if (!m) {
937 				error = ENOBUFS;
938 				IP6_STATINC(IP6_STAT_ODROPPED);
939 				goto sendorfree;
940 			}
941 			m_reset_rcvif(m);
942 			m->m_flags = m0->m_flags & M_COPYFLAGS;
943 			*mnext = m;
944 			mnext = &m->m_nextpkt;
945 			m->m_data += max_linkhdr;
946 			mhip6 = mtod(m, struct ip6_hdr *);
947 			*mhip6 = *ip6;
948 			m->m_len = sizeof(*mhip6);
949 
950 			ip6f = NULL;
951 			error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
952 			if (error) {
953 				IP6_STATINC(IP6_STAT_ODROPPED);
954 				goto sendorfree;
955 			}
956 
957 			/* Fill in the Frag6 Header */
958 			ip6f->ip6f_offlg = htons((u_int16_t)((off - hlen) & ~7));
959 			if (off + len >= tlen)
960 				len = tlen - off;
961 			else
962 				ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
963 			ip6f->ip6f_reserved = 0;
964 			ip6f->ip6f_ident = id;
965 			ip6f->ip6f_nxt = nextproto;
966 
967 			mhip6->ip6_plen = htons((u_int16_t)(len + hlen +
968 			    sizeof(*ip6f) - sizeof(struct ip6_hdr)));
969 			if ((m_frgpart = m_copym(m0, off, len, M_DONTWAIT)) == NULL) {
970 				error = ENOBUFS;
971 				IP6_STATINC(IP6_STAT_ODROPPED);
972 				goto sendorfree;
973 			}
974 			for (mlast = m; mlast->m_next; mlast = mlast->m_next)
975 				;
976 			mlast->m_next = m_frgpart;
977 
978 			m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
979 			m_reset_rcvif(m);
980 			IP6_STATINC(IP6_STAT_OFRAGMENTS);
981 			in6_ifstat_inc(ifp, ifs6_out_fragcreat);
982 		}
983 
984 		in6_ifstat_inc(ifp, ifs6_out_fragok);
985 	}
986 
987 sendorfree:
988 	m = m0->m_nextpkt;
989 	m0->m_nextpkt = 0;
990 	m_freem(m0);
991 	for (m0 = m; m; m = m0) {
992 		m0 = m->m_nextpkt;
993 		m->m_nextpkt = 0;
994 		if (error == 0) {
995 			struct in6_ifaddr *ia6;
996 			int s;
997 			ip6 = mtod(m, struct ip6_hdr *);
998 			s = pserialize_read_enter();
999 			ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
1000 			if (ia6) {
1001 				/*
1002 				 * Record statistics for this interface
1003 				 * address.
1004 				 */
1005 				ia6->ia_ifa.ifa_data.ifad_outbytes +=
1006 				    m->m_pkthdr.len;
1007 			}
1008 			pserialize_read_exit(s);
1009 			KASSERT(dst != NULL);
1010 			error = ip6_if_output(ifp, origifp, m, dst, rt);
1011 		} else
1012 			m_freem(m);
1013 	}
1014 
1015 	if (error == 0)
1016 		IP6_STATINC(IP6_STAT_FRAGMENTED);
1017 
1018 done:
1019 	rtcache_unref(rt, ro);
1020 	if (ro == &ip6route)
1021 		rtcache_free(&ip6route);
1022 #ifdef IPSEC
1023 	if (sp != NULL)
1024 		KEY_SP_UNREF(&sp);
1025 #endif
1026 	if_put(ifp, &psref);
1027 	if (release_psref_ia)
1028 		if_put(origifp, &psref_ia);
1029 	curlwp_bindx(bound);
1030 
1031 	return error;
1032 
1033 freehdrs:
1034 	m_freem(exthdrs.ip6e_hbh);
1035 	m_freem(exthdrs.ip6e_dest1);
1036 	m_freem(exthdrs.ip6e_rthdr);
1037 	m_freem(exthdrs.ip6e_dest2);
1038 	/* FALLTHROUGH */
1039 bad:
1040 	m_freem(m);
1041 	goto done;
1042 
1043 badscope:
1044 	IP6_STATINC(IP6_STAT_BADSCOPE);
1045 	in6_ifstat_inc(origifp, ifs6_out_discard);
1046 	if (error == 0)
1047 		error = EHOSTUNREACH; /* XXX */
1048 	goto bad;
1049 }
1050 
1051 static int
1052 ip6_copyexthdr(struct mbuf **mp, void *hdr, int hlen)
1053 {
1054 	struct mbuf *m;
1055 
1056 	if (hlen > MCLBYTES)
1057 		return ENOBUFS; /* XXX */
1058 
1059 	MGET(m, M_DONTWAIT, MT_DATA);
1060 	if (!m)
1061 		return ENOBUFS;
1062 
1063 	if (hlen > MLEN) {
1064 		MCLGET(m, M_DONTWAIT);
1065 		if ((m->m_flags & M_EXT) == 0) {
1066 			m_free(m);
1067 			return ENOBUFS;
1068 		}
1069 	}
1070 	m->m_len = hlen;
1071 	if (hdr)
1072 		memcpy(mtod(m, void *), hdr, hlen);
1073 
1074 	*mp = m;
1075 	return 0;
1076 }
1077 
1078 /*
1079  * Insert jumbo payload option.
1080  */
1081 static int
1082 ip6_insert_jumboopt(struct ip6_exthdrs *exthdrs, u_int32_t plen)
1083 {
1084 	struct mbuf *mopt;
1085 	u_int8_t *optbuf;
1086 	u_int32_t v;
1087 
1088 #define JUMBOOPTLEN	8	/* length of jumbo payload option and padding */
1089 
1090 	/*
1091 	 * If there is no hop-by-hop options header, allocate new one.
1092 	 * If there is one but it doesn't have enough space to store the
1093 	 * jumbo payload option, allocate a cluster to store the whole options.
1094 	 * Otherwise, use it to store the options.
1095 	 */
1096 	if (exthdrs->ip6e_hbh == NULL) {
1097 		MGET(mopt, M_DONTWAIT, MT_DATA);
1098 		if (mopt == 0)
1099 			return (ENOBUFS);
1100 		mopt->m_len = JUMBOOPTLEN;
1101 		optbuf = mtod(mopt, u_int8_t *);
1102 		optbuf[1] = 0;	/* = ((JUMBOOPTLEN) >> 3) - 1 */
1103 		exthdrs->ip6e_hbh = mopt;
1104 	} else {
1105 		struct ip6_hbh *hbh;
1106 
1107 		mopt = exthdrs->ip6e_hbh;
1108 		if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
1109 			const int oldoptlen = mopt->m_len;
1110 			struct mbuf *n;
1111 
1112 			/*
1113 			 * Assumptions:
1114 			 * - exthdrs->ip6e_hbh is not referenced from places
1115 			 *   other than exthdrs.
1116 			 * - exthdrs->ip6e_hbh is not an mbuf chain.
1117 			 */
1118 			KASSERT(mopt->m_next == NULL);
1119 
1120 			/*
1121 			 * Give up if the whole (new) hbh header does not fit
1122 			 * even in an mbuf cluster.
1123 			 */
1124 			if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
1125 				return ENOBUFS;
1126 
1127 			/*
1128 			 * At this point, we must always prepare a cluster.
1129 			 */
1130 			MGET(n, M_DONTWAIT, MT_DATA);
1131 			if (n) {
1132 				MCLGET(n, M_DONTWAIT);
1133 				if ((n->m_flags & M_EXT) == 0) {
1134 					m_freem(n);
1135 					n = NULL;
1136 				}
1137 			}
1138 			if (!n)
1139 				return ENOBUFS;
1140 
1141 			n->m_len = oldoptlen + JUMBOOPTLEN;
1142 			bcopy(mtod(mopt, void *), mtod(n, void *),
1143 			    oldoptlen);
1144 			optbuf = mtod(n, u_int8_t *) + oldoptlen;
1145 			m_freem(mopt);
1146 			mopt = exthdrs->ip6e_hbh = n;
1147 		} else {
1148 			optbuf = mtod(mopt, u_int8_t *) + mopt->m_len;
1149 			mopt->m_len += JUMBOOPTLEN;
1150 		}
1151 		optbuf[0] = IP6OPT_PADN;
1152 		optbuf[1] = 0;
1153 
1154 		/*
1155 		 * Adjust the header length according to the pad and
1156 		 * the jumbo payload option.
1157 		 */
1158 		hbh = mtod(mopt, struct ip6_hbh *);
1159 		hbh->ip6h_len += (JUMBOOPTLEN >> 3);
1160 	}
1161 
1162 	/* fill in the option. */
1163 	optbuf[2] = IP6OPT_JUMBO;
1164 	optbuf[3] = 4;
1165 	v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
1166 	memcpy(&optbuf[4], &v, sizeof(u_int32_t));
1167 
1168 	/* finally, adjust the packet header length */
1169 	exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
1170 
1171 	return 0;
1172 #undef JUMBOOPTLEN
1173 }
1174 
1175 /*
1176  * Insert fragment header and copy unfragmentable header portions.
1177  *
1178  * *frghdrp will not be read, and it is guaranteed that either an
1179  * error is returned or that *frghdrp will point to space allocated
1180  * for the fragment header.
1181  *
1182  * On entry, m contains:
1183  *     IPv6 Header
1184  * On exit, it contains:
1185  *     IPv6 Header -> Unfragmentable Part -> Frag6 Header
1186  */
1187 static int
1188 ip6_insertfraghdr(struct mbuf *m0, struct mbuf *m, int hlen,
1189 	struct ip6_frag **frghdrp)
1190 {
1191 	struct mbuf *n, *mlast;
1192 
1193 	if (hlen > sizeof(struct ip6_hdr)) {
1194 		n = m_copym(m0, sizeof(struct ip6_hdr),
1195 		    hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
1196 		if (n == NULL)
1197 			return ENOBUFS;
1198 		m->m_next = n;
1199 	} else
1200 		n = m;
1201 
1202 	/* Search for the last mbuf of unfragmentable part. */
1203 	for (mlast = n; mlast->m_next; mlast = mlast->m_next)
1204 		;
1205 
1206 	if ((mlast->m_flags & M_EXT) == 0 &&
1207 	    M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
1208 		/* use the trailing space of the last mbuf for the fragment hdr */
1209 		*frghdrp = (struct ip6_frag *)(mtod(mlast, char *) +
1210 		    mlast->m_len);
1211 		mlast->m_len += sizeof(struct ip6_frag);
1212 	} else {
1213 		/* allocate a new mbuf for the fragment header */
1214 		struct mbuf *mfrg;
1215 
1216 		MGET(mfrg, M_DONTWAIT, MT_DATA);
1217 		if (mfrg == NULL)
1218 			return ENOBUFS;
1219 		mfrg->m_len = sizeof(struct ip6_frag);
1220 		*frghdrp = mtod(mfrg, struct ip6_frag *);
1221 		mlast->m_next = mfrg;
1222 	}
1223 
1224 	return 0;
1225 }
1226 
1227 static int
1228 ip6_getpmtu(struct rtentry *rt, struct ifnet *ifp, u_long *mtup,
1229     int *alwaysfragp)
1230 {
1231 	u_int32_t mtu = 0;
1232 	int alwaysfrag = 0;
1233 	int error = 0;
1234 
1235 	if (rt != NULL) {
1236 		u_int32_t ifmtu;
1237 
1238 		if (ifp == NULL)
1239 			ifp = rt->rt_ifp;
1240 		ifmtu = IN6_LINKMTU(ifp);
1241 		mtu = rt->rt_rmx.rmx_mtu;
1242 		if (mtu == 0)
1243 			mtu = ifmtu;
1244 		else if (mtu < IPV6_MMTU) {
1245 			/*
1246 			 * RFC2460 section 5, last paragraph:
1247 			 * if we record ICMPv6 too big message with
1248 			 * mtu < IPV6_MMTU, transmit packets sized IPV6_MMTU
1249 			 * or smaller, with fragment header attached.
1250 			 * (fragment header is needed regardless from the
1251 			 * packet size, for translators to identify packets)
1252 			 */
1253 			alwaysfrag = 1;
1254 			mtu = IPV6_MMTU;
1255 		} else if (mtu > ifmtu) {
1256 			/*
1257 			 * The MTU on the route is larger than the MTU on
1258 			 * the interface!  This shouldn't happen, unless the
1259 			 * MTU of the interface has been changed after the
1260 			 * interface was brought up.  Change the MTU in the
1261 			 * route to match the interface MTU (as long as the
1262 			 * field isn't locked).
1263 			 */
1264 			mtu = ifmtu;
1265 			if (!(rt->rt_rmx.rmx_locks & RTV_MTU))
1266 				rt->rt_rmx.rmx_mtu = mtu;
1267 		}
1268 	} else if (ifp) {
1269 		mtu = IN6_LINKMTU(ifp);
1270 	} else
1271 		error = EHOSTUNREACH; /* XXX */
1272 
1273 	*mtup = mtu;
1274 	if (alwaysfragp)
1275 		*alwaysfragp = alwaysfrag;
1276 	return (error);
1277 }
1278 
1279 /*
1280  * IP6 socket option processing.
1281  */
1282 int
1283 ip6_ctloutput(int op, struct socket *so, struct sockopt *sopt)
1284 {
1285 	int optdatalen, uproto;
1286 	void *optdata;
1287 	struct in6pcb *in6p = sotoin6pcb(so);
1288 	struct ip_moptions **mopts;
1289 	int error, optval;
1290 	int level, optname;
1291 
1292 	KASSERT(solocked(so));
1293 	KASSERT(sopt != NULL);
1294 
1295 	level = sopt->sopt_level;
1296 	optname = sopt->sopt_name;
1297 
1298 	error = optval = 0;
1299 	uproto = (int)so->so_proto->pr_protocol;
1300 
1301 	switch (level) {
1302 	case IPPROTO_IP:
1303 		switch (optname) {
1304 		case IP_ADD_MEMBERSHIP:
1305 		case IP_DROP_MEMBERSHIP:
1306 		case IP_MULTICAST_IF:
1307 		case IP_MULTICAST_LOOP:
1308 		case IP_MULTICAST_TTL:
1309 			mopts = &in6p->in6p_v4moptions;
1310 			switch (op) {
1311 			case PRCO_GETOPT:
1312 				return ip_getmoptions(*mopts, sopt);
1313 			case PRCO_SETOPT:
1314 				return ip_setmoptions(mopts, sopt);
1315 			default:
1316 				return EINVAL;
1317 			}
1318 		default:
1319 			return ENOPROTOOPT;
1320 		}
1321 	case IPPROTO_IPV6:
1322 		break;
1323 	default:
1324 		return ENOPROTOOPT;
1325 	}
1326 	switch (op) {
1327 	case PRCO_SETOPT:
1328 		switch (optname) {
1329 #ifdef RFC2292
1330 		case IPV6_2292PKTOPTIONS:
1331 			error = ip6_pcbopts(&in6p->in6p_outputopts, so, sopt);
1332 			break;
1333 #endif
1334 
1335 		/*
1336 		 * Use of some Hop-by-Hop options or some
1337 		 * Destination options, might require special
1338 		 * privilege.  That is, normal applications
1339 		 * (without special privilege) might be forbidden
1340 		 * from setting certain options in outgoing packets,
1341 		 * and might never see certain options in received
1342 		 * packets. [RFC 2292 Section 6]
1343 		 * KAME specific note:
1344 		 *  KAME prevents non-privileged users from sending or
1345 		 *  receiving ANY hbh/dst options in order to avoid
1346 		 *  overhead of parsing options in the kernel.
1347 		 */
1348 		case IPV6_RECVHOPOPTS:
1349 		case IPV6_RECVDSTOPTS:
1350 		case IPV6_RECVRTHDRDSTOPTS:
1351 			error = kauth_authorize_network(kauth_cred_get(),
1352 			    KAUTH_NETWORK_IPV6, KAUTH_REQ_NETWORK_IPV6_HOPBYHOP,
1353 			    NULL, NULL, NULL);
1354 			if (error)
1355 				break;
1356 			/* FALLTHROUGH */
1357 		case IPV6_UNICAST_HOPS:
1358 		case IPV6_HOPLIMIT:
1359 		case IPV6_FAITH:
1360 
1361 		case IPV6_RECVPKTINFO:
1362 		case IPV6_RECVHOPLIMIT:
1363 		case IPV6_RECVRTHDR:
1364 		case IPV6_RECVPATHMTU:
1365 		case IPV6_RECVTCLASS:
1366 		case IPV6_V6ONLY:
1367 			error = sockopt_getint(sopt, &optval);
1368 			if (error)
1369 				break;
1370 			switch (optname) {
1371 			case IPV6_UNICAST_HOPS:
1372 				if (optval < -1 || optval >= 256)
1373 					error = EINVAL;
1374 				else {
1375 					/* -1 = kernel default */
1376 					in6p->in6p_hops = optval;
1377 				}
1378 				break;
1379 #define OPTSET(bit) \
1380 do { \
1381 if (optval) \
1382 	in6p->in6p_flags |= (bit); \
1383 else \
1384 	in6p->in6p_flags &= ~(bit); \
1385 } while (/*CONSTCOND*/ 0)
1386 
1387 #ifdef RFC2292
1388 #define OPTSET2292(bit) 			\
1389 do { 						\
1390 in6p->in6p_flags |= IN6P_RFC2292; 	\
1391 if (optval) 				\
1392 	in6p->in6p_flags |= (bit); 	\
1393 else 					\
1394 	in6p->in6p_flags &= ~(bit); 	\
1395 } while (/*CONSTCOND*/ 0)
1396 #endif
1397 
1398 #define OPTBIT(bit) (in6p->in6p_flags & (bit) ? 1 : 0)
1399 
1400 			case IPV6_RECVPKTINFO:
1401 #ifdef RFC2292
1402 				/* cannot mix with RFC2292 */
1403 				if (OPTBIT(IN6P_RFC2292)) {
1404 					error = EINVAL;
1405 					break;
1406 				}
1407 #endif
1408 				OPTSET(IN6P_PKTINFO);
1409 				break;
1410 
1411 			case IPV6_HOPLIMIT:
1412 			{
1413 				struct ip6_pktopts **optp;
1414 
1415 #ifdef RFC2292
1416 				/* cannot mix with RFC2292 */
1417 				if (OPTBIT(IN6P_RFC2292)) {
1418 					error = EINVAL;
1419 					break;
1420 				}
1421 #endif
1422 				optp = &in6p->in6p_outputopts;
1423 				error = ip6_pcbopt(IPV6_HOPLIMIT,
1424 						   (u_char *)&optval,
1425 						   sizeof(optval),
1426 						   optp,
1427 						   kauth_cred_get(), uproto);
1428 				break;
1429 			}
1430 
1431 			case IPV6_RECVHOPLIMIT:
1432 #ifdef RFC2292
1433 				/* cannot mix with RFC2292 */
1434 				if (OPTBIT(IN6P_RFC2292)) {
1435 					error = EINVAL;
1436 					break;
1437 				}
1438 #endif
1439 				OPTSET(IN6P_HOPLIMIT);
1440 				break;
1441 
1442 			case IPV6_RECVHOPOPTS:
1443 #ifdef RFC2292
1444 				/* cannot mix with RFC2292 */
1445 				if (OPTBIT(IN6P_RFC2292)) {
1446 					error = EINVAL;
1447 					break;
1448 				}
1449 #endif
1450 				OPTSET(IN6P_HOPOPTS);
1451 				break;
1452 
1453 			case IPV6_RECVDSTOPTS:
1454 #ifdef RFC2292
1455 				/* cannot mix with RFC2292 */
1456 				if (OPTBIT(IN6P_RFC2292)) {
1457 					error = EINVAL;
1458 					break;
1459 				}
1460 #endif
1461 				OPTSET(IN6P_DSTOPTS);
1462 				break;
1463 
1464 			case IPV6_RECVRTHDRDSTOPTS:
1465 #ifdef RFC2292
1466 				/* cannot mix with RFC2292 */
1467 				if (OPTBIT(IN6P_RFC2292)) {
1468 					error = EINVAL;
1469 					break;
1470 				}
1471 #endif
1472 				OPTSET(IN6P_RTHDRDSTOPTS);
1473 				break;
1474 
1475 			case IPV6_RECVRTHDR:
1476 #ifdef RFC2292
1477 				/* cannot mix with RFC2292 */
1478 				if (OPTBIT(IN6P_RFC2292)) {
1479 					error = EINVAL;
1480 					break;
1481 				}
1482 #endif
1483 				OPTSET(IN6P_RTHDR);
1484 				break;
1485 
1486 			case IPV6_FAITH:
1487 				OPTSET(IN6P_FAITH);
1488 				break;
1489 
1490 			case IPV6_RECVPATHMTU:
1491 				/*
1492 				 * We ignore this option for TCP
1493 				 * sockets.
1494 				 * (RFC3542 leaves this case
1495 				 * unspecified.)
1496 				 */
1497 				if (uproto != IPPROTO_TCP)
1498 					OPTSET(IN6P_MTU);
1499 				break;
1500 
1501 			case IPV6_V6ONLY:
1502 				/*
1503 				 * make setsockopt(IPV6_V6ONLY)
1504 				 * available only prior to bind(2).
1505 				 * see ipng mailing list, Jun 22 2001.
1506 				 */
1507 				if (in6p->in6p_lport ||
1508 				    !IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr)) {
1509 					error = EINVAL;
1510 					break;
1511 				}
1512 #ifdef INET6_BINDV6ONLY
1513 				if (!optval)
1514 					error = EINVAL;
1515 #else
1516 				OPTSET(IN6P_IPV6_V6ONLY);
1517 #endif
1518 				break;
1519 			case IPV6_RECVTCLASS:
1520 #ifdef RFC2292
1521 				/* cannot mix with RFC2292 XXX */
1522 				if (OPTBIT(IN6P_RFC2292)) {
1523 					error = EINVAL;
1524 					break;
1525 				}
1526 #endif
1527 				OPTSET(IN6P_TCLASS);
1528 				break;
1529 
1530 			}
1531 			break;
1532 
1533 		case IPV6_OTCLASS:
1534 		{
1535 			struct ip6_pktopts **optp;
1536 			u_int8_t tclass;
1537 
1538 			error = sockopt_get(sopt, &tclass, sizeof(tclass));
1539 			if (error)
1540 				break;
1541 			optp = &in6p->in6p_outputopts;
1542 			error = ip6_pcbopt(optname,
1543 					   (u_char *)&tclass,
1544 					   sizeof(tclass),
1545 					   optp,
1546 					   kauth_cred_get(), uproto);
1547 			break;
1548 		}
1549 
1550 		case IPV6_TCLASS:
1551 		case IPV6_DONTFRAG:
1552 		case IPV6_USE_MIN_MTU:
1553 		case IPV6_PREFER_TEMPADDR:
1554 			error = sockopt_getint(sopt, &optval);
1555 			if (error)
1556 				break;
1557 			{
1558 				struct ip6_pktopts **optp;
1559 				optp = &in6p->in6p_outputopts;
1560 				error = ip6_pcbopt(optname,
1561 						   (u_char *)&optval,
1562 						   sizeof(optval),
1563 						   optp,
1564 						   kauth_cred_get(), uproto);
1565 				break;
1566 			}
1567 
1568 #ifdef RFC2292
1569 		case IPV6_2292PKTINFO:
1570 		case IPV6_2292HOPLIMIT:
1571 		case IPV6_2292HOPOPTS:
1572 		case IPV6_2292DSTOPTS:
1573 		case IPV6_2292RTHDR:
1574 			/* RFC 2292 */
1575 			error = sockopt_getint(sopt, &optval);
1576 			if (error)
1577 				break;
1578 
1579 			switch (optname) {
1580 			case IPV6_2292PKTINFO:
1581 				OPTSET2292(IN6P_PKTINFO);
1582 				break;
1583 			case IPV6_2292HOPLIMIT:
1584 				OPTSET2292(IN6P_HOPLIMIT);
1585 				break;
1586 			case IPV6_2292HOPOPTS:
1587 				/*
1588 				 * Check super-user privilege.
1589 				 * See comments for IPV6_RECVHOPOPTS.
1590 				 */
1591 				error =
1592 				    kauth_authorize_network(kauth_cred_get(),
1593 				    KAUTH_NETWORK_IPV6,
1594 				    KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL,
1595 				    NULL, NULL);
1596 				if (error)
1597 					return (error);
1598 				OPTSET2292(IN6P_HOPOPTS);
1599 				break;
1600 			case IPV6_2292DSTOPTS:
1601 				error =
1602 				    kauth_authorize_network(kauth_cred_get(),
1603 				    KAUTH_NETWORK_IPV6,
1604 				    KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL,
1605 				    NULL, NULL);
1606 				if (error)
1607 					return (error);
1608 				OPTSET2292(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS); /* XXX */
1609 				break;
1610 			case IPV6_2292RTHDR:
1611 				OPTSET2292(IN6P_RTHDR);
1612 				break;
1613 			}
1614 			break;
1615 #endif
1616 		case IPV6_PKTINFO:
1617 		case IPV6_HOPOPTS:
1618 		case IPV6_RTHDR:
1619 		case IPV6_DSTOPTS:
1620 		case IPV6_RTHDRDSTOPTS:
1621 		case IPV6_NEXTHOP: {
1622 			/* new advanced API (RFC3542) */
1623 			void *optbuf;
1624 			int optbuflen;
1625 			struct ip6_pktopts **optp;
1626 
1627 #ifdef RFC2292
1628 			/* cannot mix with RFC2292 */
1629 			if (OPTBIT(IN6P_RFC2292)) {
1630 				error = EINVAL;
1631 				break;
1632 			}
1633 #endif
1634 
1635 			optbuflen = sopt->sopt_size;
1636 			optbuf = malloc(optbuflen, M_IP6OPT, M_NOWAIT);
1637 			if (optbuf == NULL) {
1638 				error = ENOBUFS;
1639 				break;
1640 			}
1641 
1642 			error = sockopt_get(sopt, optbuf, optbuflen);
1643 			if (error) {
1644 				free(optbuf, M_IP6OPT);
1645 				break;
1646 			}
1647 			optp = &in6p->in6p_outputopts;
1648 			error = ip6_pcbopt(optname, optbuf, optbuflen,
1649 			    optp, kauth_cred_get(), uproto);
1650 
1651 			free(optbuf, M_IP6OPT);
1652 			break;
1653 			}
1654 #undef OPTSET
1655 
1656 		case IPV6_MULTICAST_IF:
1657 		case IPV6_MULTICAST_HOPS:
1658 		case IPV6_MULTICAST_LOOP:
1659 		case IPV6_JOIN_GROUP:
1660 		case IPV6_LEAVE_GROUP:
1661 			error = ip6_setmoptions(sopt, in6p);
1662 			break;
1663 
1664 		case IPV6_PORTRANGE:
1665 			error = sockopt_getint(sopt, &optval);
1666 			if (error)
1667 				break;
1668 
1669 			switch (optval) {
1670 			case IPV6_PORTRANGE_DEFAULT:
1671 				in6p->in6p_flags &= ~(IN6P_LOWPORT);
1672 				in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1673 				break;
1674 
1675 			case IPV6_PORTRANGE_HIGH:
1676 				in6p->in6p_flags &= ~(IN6P_LOWPORT);
1677 				in6p->in6p_flags |= IN6P_HIGHPORT;
1678 				break;
1679 
1680 			case IPV6_PORTRANGE_LOW:
1681 				in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1682 				in6p->in6p_flags |= IN6P_LOWPORT;
1683 				break;
1684 
1685 			default:
1686 				error = EINVAL;
1687 				break;
1688 			}
1689 			break;
1690 
1691 		case IPV6_PORTALGO:
1692 			error = sockopt_getint(sopt, &optval);
1693 			if (error)
1694 				break;
1695 
1696 			error = portalgo_algo_index_select(
1697 			    (struct inpcb_hdr *)in6p, optval);
1698 			break;
1699 
1700 #if defined(IPSEC)
1701 		case IPV6_IPSEC_POLICY:
1702 			if (ipsec_enabled) {
1703 				error = ipsec_set_policy(in6p,
1704 				    sopt->sopt_data, sopt->sopt_size,
1705 				    kauth_cred_get());
1706 			} else
1707 				error = ENOPROTOOPT;
1708 			break;
1709 #endif /* IPSEC */
1710 
1711 		default:
1712 			error = ENOPROTOOPT;
1713 			break;
1714 		}
1715 		break;
1716 
1717 	case PRCO_GETOPT:
1718 		switch (optname) {
1719 #ifdef RFC2292
1720 		case IPV6_2292PKTOPTIONS:
1721 			/*
1722 			 * RFC3542 (effectively) deprecated the
1723 			 * semantics of the 2292-style pktoptions.
1724 			 * Since it was not reliable in nature (i.e.,
1725 			 * applications had to expect the lack of some
1726 			 * information after all), it would make sense
1727 			 * to simplify this part by always returning
1728 			 * empty data.
1729 			 */
1730 			break;
1731 #endif
1732 
1733 		case IPV6_RECVHOPOPTS:
1734 		case IPV6_RECVDSTOPTS:
1735 		case IPV6_RECVRTHDRDSTOPTS:
1736 		case IPV6_UNICAST_HOPS:
1737 		case IPV6_RECVPKTINFO:
1738 		case IPV6_RECVHOPLIMIT:
1739 		case IPV6_RECVRTHDR:
1740 		case IPV6_RECVPATHMTU:
1741 
1742 		case IPV6_FAITH:
1743 		case IPV6_V6ONLY:
1744 		case IPV6_PORTRANGE:
1745 		case IPV6_RECVTCLASS:
1746 			switch (optname) {
1747 
1748 			case IPV6_RECVHOPOPTS:
1749 				optval = OPTBIT(IN6P_HOPOPTS);
1750 				break;
1751 
1752 			case IPV6_RECVDSTOPTS:
1753 				optval = OPTBIT(IN6P_DSTOPTS);
1754 				break;
1755 
1756 			case IPV6_RECVRTHDRDSTOPTS:
1757 				optval = OPTBIT(IN6P_RTHDRDSTOPTS);
1758 				break;
1759 
1760 			case IPV6_UNICAST_HOPS:
1761 				optval = in6p->in6p_hops;
1762 				break;
1763 
1764 			case IPV6_RECVPKTINFO:
1765 				optval = OPTBIT(IN6P_PKTINFO);
1766 				break;
1767 
1768 			case IPV6_RECVHOPLIMIT:
1769 				optval = OPTBIT(IN6P_HOPLIMIT);
1770 				break;
1771 
1772 			case IPV6_RECVRTHDR:
1773 				optval = OPTBIT(IN6P_RTHDR);
1774 				break;
1775 
1776 			case IPV6_RECVPATHMTU:
1777 				optval = OPTBIT(IN6P_MTU);
1778 				break;
1779 
1780 			case IPV6_FAITH:
1781 				optval = OPTBIT(IN6P_FAITH);
1782 				break;
1783 
1784 			case IPV6_V6ONLY:
1785 				optval = OPTBIT(IN6P_IPV6_V6ONLY);
1786 				break;
1787 
1788 			case IPV6_PORTRANGE:
1789 			    {
1790 				int flags;
1791 				flags = in6p->in6p_flags;
1792 				if (flags & IN6P_HIGHPORT)
1793 					optval = IPV6_PORTRANGE_HIGH;
1794 				else if (flags & IN6P_LOWPORT)
1795 					optval = IPV6_PORTRANGE_LOW;
1796 				else
1797 					optval = 0;
1798 				break;
1799 			    }
1800 			case IPV6_RECVTCLASS:
1801 				optval = OPTBIT(IN6P_TCLASS);
1802 				break;
1803 
1804 			}
1805 			if (error)
1806 				break;
1807 			error = sockopt_setint(sopt, optval);
1808 			break;
1809 
1810 		case IPV6_PATHMTU:
1811 		    {
1812 			u_long pmtu = 0;
1813 			struct ip6_mtuinfo mtuinfo;
1814 			struct route *ro = &in6p->in6p_route;
1815 			struct rtentry *rt;
1816 			union {
1817 				struct sockaddr		dst;
1818 				struct sockaddr_in6	dst6;
1819 			} u;
1820 
1821 			if (!(so->so_state & SS_ISCONNECTED))
1822 				return (ENOTCONN);
1823 			/*
1824 			 * XXX: we dot not consider the case of source
1825 			 * routing, or optional information to specify
1826 			 * the outgoing interface.
1827 			 */
1828 			sockaddr_in6_init(&u.dst6, &in6p->in6p_faddr, 0, 0, 0);
1829 			rt = rtcache_lookup(ro, &u.dst);
1830 			error = ip6_getpmtu(rt, NULL, &pmtu, NULL);
1831 			rtcache_unref(rt, ro);
1832 			if (error)
1833 				break;
1834 			if (pmtu > IPV6_MAXPACKET)
1835 				pmtu = IPV6_MAXPACKET;
1836 
1837 			memset(&mtuinfo, 0, sizeof(mtuinfo));
1838 			mtuinfo.ip6m_mtu = (u_int32_t)pmtu;
1839 			optdata = (void *)&mtuinfo;
1840 			optdatalen = sizeof(mtuinfo);
1841 			if (optdatalen > MCLBYTES)
1842 				return (EMSGSIZE); /* XXX */
1843 			error = sockopt_set(sopt, optdata, optdatalen);
1844 			break;
1845 		    }
1846 
1847 #ifdef RFC2292
1848 		case IPV6_2292PKTINFO:
1849 		case IPV6_2292HOPLIMIT:
1850 		case IPV6_2292HOPOPTS:
1851 		case IPV6_2292RTHDR:
1852 		case IPV6_2292DSTOPTS:
1853 			switch (optname) {
1854 			case IPV6_2292PKTINFO:
1855 				optval = OPTBIT(IN6P_PKTINFO);
1856 				break;
1857 			case IPV6_2292HOPLIMIT:
1858 				optval = OPTBIT(IN6P_HOPLIMIT);
1859 				break;
1860 			case IPV6_2292HOPOPTS:
1861 				optval = OPTBIT(IN6P_HOPOPTS);
1862 				break;
1863 			case IPV6_2292RTHDR:
1864 				optval = OPTBIT(IN6P_RTHDR);
1865 				break;
1866 			case IPV6_2292DSTOPTS:
1867 				optval = OPTBIT(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS);
1868 				break;
1869 			}
1870 			error = sockopt_setint(sopt, optval);
1871 			break;
1872 #endif
1873 		case IPV6_PKTINFO:
1874 		case IPV6_HOPOPTS:
1875 		case IPV6_RTHDR:
1876 		case IPV6_DSTOPTS:
1877 		case IPV6_RTHDRDSTOPTS:
1878 		case IPV6_NEXTHOP:
1879 		case IPV6_OTCLASS:
1880 		case IPV6_TCLASS:
1881 		case IPV6_DONTFRAG:
1882 		case IPV6_USE_MIN_MTU:
1883 		case IPV6_PREFER_TEMPADDR:
1884 			error = ip6_getpcbopt(in6p->in6p_outputopts,
1885 			    optname, sopt);
1886 			break;
1887 
1888 		case IPV6_MULTICAST_IF:
1889 		case IPV6_MULTICAST_HOPS:
1890 		case IPV6_MULTICAST_LOOP:
1891 		case IPV6_JOIN_GROUP:
1892 		case IPV6_LEAVE_GROUP:
1893 			error = ip6_getmoptions(sopt, in6p);
1894 			break;
1895 
1896 		case IPV6_PORTALGO:
1897 			optval = ((struct inpcb_hdr *)in6p)->inph_portalgo;
1898 			error = sockopt_setint(sopt, optval);
1899 			break;
1900 
1901 #if defined(IPSEC)
1902 		case IPV6_IPSEC_POLICY:
1903 			if (ipsec_used) {
1904 				struct mbuf *m = NULL;
1905 
1906 				/*
1907 				 * XXX: this will return EINVAL as sopt is
1908 				 * empty
1909 				 */
1910 				error = ipsec_get_policy(in6p, sopt->sopt_data,
1911 				    sopt->sopt_size, &m);
1912 				if (!error)
1913 					error = sockopt_setmbuf(sopt, m);
1914 			} else
1915 				error = ENOPROTOOPT;
1916 			break;
1917 #endif /* IPSEC */
1918 
1919 		default:
1920 			error = ENOPROTOOPT;
1921 			break;
1922 		}
1923 		break;
1924 	}
1925 	return (error);
1926 }
1927 
1928 int
1929 ip6_raw_ctloutput(int op, struct socket *so, struct sockopt *sopt)
1930 {
1931 	int error = 0, optval;
1932 	const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
1933 	struct in6pcb *in6p = sotoin6pcb(so);
1934 	int level, optname;
1935 
1936 	KASSERT(sopt != NULL);
1937 
1938 	level = sopt->sopt_level;
1939 	optname = sopt->sopt_name;
1940 
1941 	if (level != IPPROTO_IPV6) {
1942 		return ENOPROTOOPT;
1943 	}
1944 
1945 	switch (optname) {
1946 	case IPV6_CHECKSUM:
1947 		/*
1948 		 * For ICMPv6 sockets, no modification allowed for checksum
1949 		 * offset, permit "no change" values to help existing apps.
1950 		 *
1951 		 * XXX RFC3542 says: "An attempt to set IPV6_CHECKSUM
1952 		 * for an ICMPv6 socket will fail."  The current
1953 		 * behavior does not meet RFC3542.
1954 		 */
1955 		switch (op) {
1956 		case PRCO_SETOPT:
1957 			error = sockopt_getint(sopt, &optval);
1958 			if (error)
1959 				break;
1960 			if ((optval % 2) != 0) {
1961 				/* the API assumes even offset values */
1962 				error = EINVAL;
1963 			} else if (so->so_proto->pr_protocol ==
1964 			    IPPROTO_ICMPV6) {
1965 				if (optval != icmp6off)
1966 					error = EINVAL;
1967 			} else
1968 				in6p->in6p_cksum = optval;
1969 			break;
1970 
1971 		case PRCO_GETOPT:
1972 			if (so->so_proto->pr_protocol == IPPROTO_ICMPV6)
1973 				optval = icmp6off;
1974 			else
1975 				optval = in6p->in6p_cksum;
1976 
1977 			error = sockopt_setint(sopt, optval);
1978 			break;
1979 
1980 		default:
1981 			error = EINVAL;
1982 			break;
1983 		}
1984 		break;
1985 
1986 	default:
1987 		error = ENOPROTOOPT;
1988 		break;
1989 	}
1990 
1991 	return (error);
1992 }
1993 
1994 #ifdef RFC2292
1995 /*
1996  * Set up IP6 options in pcb for insertion in output packets or
1997  * specifying behavior of outgoing packets.
1998  */
1999 static int
2000 ip6_pcbopts(struct ip6_pktopts **pktopt, struct socket *so,
2001     struct sockopt *sopt)
2002 {
2003 	struct ip6_pktopts *opt = *pktopt;
2004 	struct mbuf *m;
2005 	int error = 0;
2006 
2007 	KASSERT(solocked(so));
2008 
2009 	/* turn off any old options. */
2010 	if (opt) {
2011 #ifdef DIAGNOSTIC
2012 	    if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
2013 		opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
2014 		opt->ip6po_rhinfo.ip6po_rhi_rthdr)
2015 		    printf("ip6_pcbopts: all specified options are cleared.\n");
2016 #endif
2017 		ip6_clearpktopts(opt, -1);
2018 	} else {
2019 		opt = malloc(sizeof(*opt), M_IP6OPT, M_NOWAIT);
2020 		if (opt == NULL)
2021 			return (ENOBUFS);
2022 	}
2023 	*pktopt = NULL;
2024 
2025 	if (sopt == NULL || sopt->sopt_size == 0) {
2026 		/*
2027 		 * Only turning off any previous options, regardless of
2028 		 * whether the opt is just created or given.
2029 		 */
2030 		free(opt, M_IP6OPT);
2031 		return (0);
2032 	}
2033 
2034 	/*  set options specified by user. */
2035 	m = sockopt_getmbuf(sopt);
2036 	if (m == NULL) {
2037 		free(opt, M_IP6OPT);
2038 		return (ENOBUFS);
2039 	}
2040 
2041 	error = ip6_setpktopts(m, opt, NULL, kauth_cred_get(),
2042 	    so->so_proto->pr_protocol);
2043 	m_freem(m);
2044 	if (error != 0) {
2045 		ip6_clearpktopts(opt, -1); /* XXX: discard all options */
2046 		free(opt, M_IP6OPT);
2047 		return (error);
2048 	}
2049 	*pktopt = opt;
2050 	return (0);
2051 }
2052 #endif
2053 
2054 /*
2055  * initialize ip6_pktopts.  beware that there are non-zero default values in
2056  * the struct.
2057  */
2058 void
2059 ip6_initpktopts(struct ip6_pktopts *opt)
2060 {
2061 
2062 	memset(opt, 0, sizeof(*opt));
2063 	opt->ip6po_hlim = -1;	/* -1 means default hop limit */
2064 	opt->ip6po_tclass = -1;	/* -1 means default traffic class */
2065 	opt->ip6po_minmtu = IP6PO_MINMTU_MCASTONLY;
2066 	opt->ip6po_prefer_tempaddr = IP6PO_TEMPADDR_SYSTEM;
2067 }
2068 
2069 #define sin6tosa(sin6)	((struct sockaddr *)(sin6)) /* XXX */
2070 static int
2071 ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt,
2072     kauth_cred_t cred, int uproto)
2073 {
2074 	struct ip6_pktopts *opt;
2075 
2076 	if (*pktopt == NULL) {
2077 		*pktopt = malloc(sizeof(struct ip6_pktopts), M_IP6OPT,
2078 		    M_NOWAIT);
2079 		if (*pktopt == NULL)
2080 			return (ENOBUFS);
2081 
2082 		ip6_initpktopts(*pktopt);
2083 	}
2084 	opt = *pktopt;
2085 
2086 	return (ip6_setpktopt(optname, buf, len, opt, cred, 1, 0, uproto));
2087 }
2088 
2089 static int
2090 ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct sockopt *sopt)
2091 {
2092 	void *optdata = NULL;
2093 	int optdatalen = 0;
2094 	struct ip6_ext *ip6e;
2095 	int error = 0;
2096 	struct in6_pktinfo null_pktinfo;
2097 	int deftclass = 0, on;
2098 	int defminmtu = IP6PO_MINMTU_MCASTONLY;
2099 	int defpreftemp = IP6PO_TEMPADDR_SYSTEM;
2100 
2101 	switch (optname) {
2102 	case IPV6_PKTINFO:
2103 		if (pktopt && pktopt->ip6po_pktinfo)
2104 			optdata = (void *)pktopt->ip6po_pktinfo;
2105 		else {
2106 			/* XXX: we don't have to do this every time... */
2107 			memset(&null_pktinfo, 0, sizeof(null_pktinfo));
2108 			optdata = (void *)&null_pktinfo;
2109 		}
2110 		optdatalen = sizeof(struct in6_pktinfo);
2111 		break;
2112 	case IPV6_OTCLASS:
2113 		/* XXX */
2114 		return (EINVAL);
2115 	case IPV6_TCLASS:
2116 		if (pktopt && pktopt->ip6po_tclass >= 0)
2117 			optdata = (void *)&pktopt->ip6po_tclass;
2118 		else
2119 			optdata = (void *)&deftclass;
2120 		optdatalen = sizeof(int);
2121 		break;
2122 	case IPV6_HOPOPTS:
2123 		if (pktopt && pktopt->ip6po_hbh) {
2124 			optdata = (void *)pktopt->ip6po_hbh;
2125 			ip6e = (struct ip6_ext *)pktopt->ip6po_hbh;
2126 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2127 		}
2128 		break;
2129 	case IPV6_RTHDR:
2130 		if (pktopt && pktopt->ip6po_rthdr) {
2131 			optdata = (void *)pktopt->ip6po_rthdr;
2132 			ip6e = (struct ip6_ext *)pktopt->ip6po_rthdr;
2133 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2134 		}
2135 		break;
2136 	case IPV6_RTHDRDSTOPTS:
2137 		if (pktopt && pktopt->ip6po_dest1) {
2138 			optdata = (void *)pktopt->ip6po_dest1;
2139 			ip6e = (struct ip6_ext *)pktopt->ip6po_dest1;
2140 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2141 		}
2142 		break;
2143 	case IPV6_DSTOPTS:
2144 		if (pktopt && pktopt->ip6po_dest2) {
2145 			optdata = (void *)pktopt->ip6po_dest2;
2146 			ip6e = (struct ip6_ext *)pktopt->ip6po_dest2;
2147 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2148 		}
2149 		break;
2150 	case IPV6_NEXTHOP:
2151 		if (pktopt && pktopt->ip6po_nexthop) {
2152 			optdata = (void *)pktopt->ip6po_nexthop;
2153 			optdatalen = pktopt->ip6po_nexthop->sa_len;
2154 		}
2155 		break;
2156 	case IPV6_USE_MIN_MTU:
2157 		if (pktopt)
2158 			optdata = (void *)&pktopt->ip6po_minmtu;
2159 		else
2160 			optdata = (void *)&defminmtu;
2161 		optdatalen = sizeof(int);
2162 		break;
2163 	case IPV6_DONTFRAG:
2164 		if (pktopt && ((pktopt->ip6po_flags) & IP6PO_DONTFRAG))
2165 			on = 1;
2166 		else
2167 			on = 0;
2168 		optdata = (void *)&on;
2169 		optdatalen = sizeof(on);
2170 		break;
2171 	case IPV6_PREFER_TEMPADDR:
2172 		if (pktopt)
2173 			optdata = (void *)&pktopt->ip6po_prefer_tempaddr;
2174 		else
2175 			optdata = (void *)&defpreftemp;
2176 		optdatalen = sizeof(int);
2177 		break;
2178 	default:		/* should not happen */
2179 #ifdef DIAGNOSTIC
2180 		panic("ip6_getpcbopt: unexpected option\n");
2181 #endif
2182 		return (ENOPROTOOPT);
2183 	}
2184 
2185 	error = sockopt_set(sopt, optdata, optdatalen);
2186 
2187 	return (error);
2188 }
2189 
2190 void
2191 ip6_clearpktopts(struct ip6_pktopts *pktopt, int optname)
2192 {
2193 	if (optname == -1 || optname == IPV6_PKTINFO) {
2194 		if (pktopt->ip6po_pktinfo)
2195 			free(pktopt->ip6po_pktinfo, M_IP6OPT);
2196 		pktopt->ip6po_pktinfo = NULL;
2197 	}
2198 	if (optname == -1 || optname == IPV6_HOPLIMIT)
2199 		pktopt->ip6po_hlim = -1;
2200 	if (optname == -1 || optname == IPV6_TCLASS)
2201 		pktopt->ip6po_tclass = -1;
2202 	if (optname == -1 || optname == IPV6_NEXTHOP) {
2203 		rtcache_free(&pktopt->ip6po_nextroute);
2204 		if (pktopt->ip6po_nexthop)
2205 			free(pktopt->ip6po_nexthop, M_IP6OPT);
2206 		pktopt->ip6po_nexthop = NULL;
2207 	}
2208 	if (optname == -1 || optname == IPV6_HOPOPTS) {
2209 		if (pktopt->ip6po_hbh)
2210 			free(pktopt->ip6po_hbh, M_IP6OPT);
2211 		pktopt->ip6po_hbh = NULL;
2212 	}
2213 	if (optname == -1 || optname == IPV6_RTHDRDSTOPTS) {
2214 		if (pktopt->ip6po_dest1)
2215 			free(pktopt->ip6po_dest1, M_IP6OPT);
2216 		pktopt->ip6po_dest1 = NULL;
2217 	}
2218 	if (optname == -1 || optname == IPV6_RTHDR) {
2219 		if (pktopt->ip6po_rhinfo.ip6po_rhi_rthdr)
2220 			free(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr, M_IP6OPT);
2221 		pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
2222 		rtcache_free(&pktopt->ip6po_route);
2223 	}
2224 	if (optname == -1 || optname == IPV6_DSTOPTS) {
2225 		if (pktopt->ip6po_dest2)
2226 			free(pktopt->ip6po_dest2, M_IP6OPT);
2227 		pktopt->ip6po_dest2 = NULL;
2228 	}
2229 }
2230 
2231 #define PKTOPT_EXTHDRCPY(type) 					\
2232 do {								\
2233 	if (src->type) {					\
2234 		int hlen = (((struct ip6_ext *)src->type)->ip6e_len + 1) << 3;\
2235 		dst->type = malloc(hlen, M_IP6OPT, canwait);	\
2236 		if (dst->type == NULL)				\
2237 			goto bad;				\
2238 		memcpy(dst->type, src->type, hlen);		\
2239 	}							\
2240 } while (/*CONSTCOND*/ 0)
2241 
2242 static int
2243 copypktopts(struct ip6_pktopts *dst, struct ip6_pktopts *src, int canwait)
2244 {
2245 	dst->ip6po_hlim = src->ip6po_hlim;
2246 	dst->ip6po_tclass = src->ip6po_tclass;
2247 	dst->ip6po_flags = src->ip6po_flags;
2248 	dst->ip6po_minmtu = src->ip6po_minmtu;
2249 	dst->ip6po_prefer_tempaddr = src->ip6po_prefer_tempaddr;
2250 	if (src->ip6po_pktinfo) {
2251 		dst->ip6po_pktinfo = malloc(sizeof(*dst->ip6po_pktinfo),
2252 		    M_IP6OPT, canwait);
2253 		if (dst->ip6po_pktinfo == NULL)
2254 			goto bad;
2255 		*dst->ip6po_pktinfo = *src->ip6po_pktinfo;
2256 	}
2257 	if (src->ip6po_nexthop) {
2258 		dst->ip6po_nexthop = malloc(src->ip6po_nexthop->sa_len,
2259 		    M_IP6OPT, canwait);
2260 		if (dst->ip6po_nexthop == NULL)
2261 			goto bad;
2262 		memcpy(dst->ip6po_nexthop, src->ip6po_nexthop,
2263 		    src->ip6po_nexthop->sa_len);
2264 	}
2265 	PKTOPT_EXTHDRCPY(ip6po_hbh);
2266 	PKTOPT_EXTHDRCPY(ip6po_dest1);
2267 	PKTOPT_EXTHDRCPY(ip6po_dest2);
2268 	PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
2269 	return (0);
2270 
2271   bad:
2272 	if (dst->ip6po_pktinfo) free(dst->ip6po_pktinfo, M_IP6OPT);
2273 	if (dst->ip6po_nexthop) free(dst->ip6po_nexthop, M_IP6OPT);
2274 	if (dst->ip6po_hbh) free(dst->ip6po_hbh, M_IP6OPT);
2275 	if (dst->ip6po_dest1) free(dst->ip6po_dest1, M_IP6OPT);
2276 	if (dst->ip6po_dest2) free(dst->ip6po_dest2, M_IP6OPT);
2277 	if (dst->ip6po_rthdr) free(dst->ip6po_rthdr, M_IP6OPT);
2278 
2279 	return (ENOBUFS);
2280 }
2281 #undef PKTOPT_EXTHDRCPY
2282 
2283 struct ip6_pktopts *
2284 ip6_copypktopts(struct ip6_pktopts *src, int canwait)
2285 {
2286 	int error;
2287 	struct ip6_pktopts *dst;
2288 
2289 	dst = malloc(sizeof(*dst), M_IP6OPT, canwait);
2290 	if (dst == NULL)
2291 		return (NULL);
2292 	ip6_initpktopts(dst);
2293 
2294 	if ((error = copypktopts(dst, src, canwait)) != 0) {
2295 		free(dst, M_IP6OPT);
2296 		return (NULL);
2297 	}
2298 
2299 	return (dst);
2300 }
2301 
2302 void
2303 ip6_freepcbopts(struct ip6_pktopts *pktopt)
2304 {
2305 	if (pktopt == NULL)
2306 		return;
2307 
2308 	ip6_clearpktopts(pktopt, -1);
2309 
2310 	free(pktopt, M_IP6OPT);
2311 }
2312 
2313 int
2314 ip6_get_membership(const struct sockopt *sopt, struct ifnet **ifp,
2315     struct psref *psref, void *v, size_t l)
2316 {
2317 	struct ipv6_mreq mreq;
2318 	int error;
2319 	struct in6_addr *ia = &mreq.ipv6mr_multiaddr;
2320 	struct in_addr *ia4 = (void *)&ia->s6_addr32[3];
2321 
2322 	error = sockopt_get(sopt, &mreq, sizeof(mreq));
2323 	if (error != 0)
2324 		return error;
2325 
2326 	if (IN6_IS_ADDR_UNSPECIFIED(ia)) {
2327 		/*
2328 		 * We use the unspecified address to specify to accept
2329 		 * all multicast addresses. Only super user is allowed
2330 		 * to do this.
2331 		 */
2332 		if (kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_IPV6,
2333 		    KAUTH_REQ_NETWORK_IPV6_JOIN_MULTICAST, NULL, NULL, NULL))
2334 			return EACCES;
2335 	} else if (IN6_IS_ADDR_V4MAPPED(ia)) {
2336 		// Don't bother if we are not going to use ifp.
2337 		if (l == sizeof(*ia)) {
2338 			memcpy(v, ia, l);
2339 			return 0;
2340 		}
2341 	} else if (!IN6_IS_ADDR_MULTICAST(ia)) {
2342 		return EINVAL;
2343 	}
2344 
2345 	/*
2346 	 * If no interface was explicitly specified, choose an
2347 	 * appropriate one according to the given multicast address.
2348 	 */
2349 	if (mreq.ipv6mr_interface == 0) {
2350 		struct rtentry *rt;
2351 		union {
2352 			struct sockaddr		dst;
2353 			struct sockaddr_in	dst4;
2354 			struct sockaddr_in6	dst6;
2355 		} u;
2356 		struct route ro;
2357 
2358 		/*
2359 		 * Look up the routing table for the
2360 		 * address, and choose the outgoing interface.
2361 		 *   XXX: is it a good approach?
2362 		 */
2363 		memset(&ro, 0, sizeof(ro));
2364 		if (IN6_IS_ADDR_V4MAPPED(ia))
2365 			sockaddr_in_init(&u.dst4, ia4, 0);
2366 		else
2367 			sockaddr_in6_init(&u.dst6, ia, 0, 0, 0);
2368 		error = rtcache_setdst(&ro, &u.dst);
2369 		if (error != 0)
2370 			return error;
2371 		rt = rtcache_init(&ro);
2372 		*ifp = rt != NULL ?
2373 		    if_get_byindex(rt->rt_ifp->if_index, psref) : NULL;
2374 		rtcache_unref(rt, &ro);
2375 		rtcache_free(&ro);
2376 	} else {
2377 		/*
2378 		 * If the interface is specified, validate it.
2379 		 */
2380 		*ifp = if_get_byindex(mreq.ipv6mr_interface, psref);
2381 		if (*ifp == NULL)
2382 			return ENXIO;	/* XXX EINVAL? */
2383 	}
2384 	if (sizeof(*ia) == l)
2385 		memcpy(v, ia, l);
2386 	else
2387 		memcpy(v, ia4, l);
2388 	return 0;
2389 }
2390 
2391 /*
2392  * Set the IP6 multicast options in response to user setsockopt().
2393  */
2394 static int
2395 ip6_setmoptions(const struct sockopt *sopt, struct in6pcb *in6p)
2396 {
2397 	int error = 0;
2398 	u_int loop, ifindex;
2399 	struct ipv6_mreq mreq;
2400 	struct in6_addr ia;
2401 	struct ifnet *ifp;
2402 	struct ip6_moptions *im6o = in6p->in6p_moptions;
2403 	struct in6_multi_mship *imm;
2404 
2405 	KASSERT(in6p_locked(in6p));
2406 
2407 	if (im6o == NULL) {
2408 		/*
2409 		 * No multicast option buffer attached to the pcb;
2410 		 * allocate one and initialize to default values.
2411 		 */
2412 		im6o = malloc(sizeof(*im6o), M_IPMOPTS, M_NOWAIT);
2413 		if (im6o == NULL)
2414 			return (ENOBUFS);
2415 		in6p->in6p_moptions = im6o;
2416 		im6o->im6o_multicast_if_index = 0;
2417 		im6o->im6o_multicast_hlim = ip6_defmcasthlim;
2418 		im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
2419 		LIST_INIT(&im6o->im6o_memberships);
2420 	}
2421 
2422 	switch (sopt->sopt_name) {
2423 
2424 	case IPV6_MULTICAST_IF: {
2425 		int s;
2426 		/*
2427 		 * Select the interface for outgoing multicast packets.
2428 		 */
2429 		error = sockopt_get(sopt, &ifindex, sizeof(ifindex));
2430 		if (error != 0)
2431 			break;
2432 
2433 		s = pserialize_read_enter();
2434 		if (ifindex != 0) {
2435 			if ((ifp = if_byindex(ifindex)) == NULL) {
2436 				pserialize_read_exit(s);
2437 				error = ENXIO;	/* XXX EINVAL? */
2438 				break;
2439 			}
2440 			if ((ifp->if_flags & IFF_MULTICAST) == 0) {
2441 				pserialize_read_exit(s);
2442 				error = EADDRNOTAVAIL;
2443 				break;
2444 			}
2445 		} else
2446 			ifp = NULL;
2447 		im6o->im6o_multicast_if_index = if_get_index(ifp);
2448 		pserialize_read_exit(s);
2449 		break;
2450 	    }
2451 
2452 	case IPV6_MULTICAST_HOPS:
2453 	    {
2454 		/*
2455 		 * Set the IP6 hoplimit for outgoing multicast packets.
2456 		 */
2457 		int optval;
2458 
2459 		error = sockopt_getint(sopt, &optval);
2460 		if (error != 0)
2461 			break;
2462 
2463 		if (optval < -1 || optval >= 256)
2464 			error = EINVAL;
2465 		else if (optval == -1)
2466 			im6o->im6o_multicast_hlim = ip6_defmcasthlim;
2467 		else
2468 			im6o->im6o_multicast_hlim = optval;
2469 		break;
2470 	    }
2471 
2472 	case IPV6_MULTICAST_LOOP:
2473 		/*
2474 		 * Set the loopback flag for outgoing multicast packets.
2475 		 * Must be zero or one.
2476 		 */
2477 		error = sockopt_get(sopt, &loop, sizeof(loop));
2478 		if (error != 0)
2479 			break;
2480 		if (loop > 1) {
2481 			error = EINVAL;
2482 			break;
2483 		}
2484 		im6o->im6o_multicast_loop = loop;
2485 		break;
2486 
2487 	case IPV6_JOIN_GROUP: {
2488 		int bound;
2489 		struct psref psref;
2490 		/*
2491 		 * Add a multicast group membership.
2492 		 * Group must be a valid IP6 multicast address.
2493 		 */
2494 		bound = curlwp_bind();
2495 		ifp = NULL;
2496 		error = ip6_get_membership(sopt, &ifp, &psref, &ia, sizeof(ia));
2497 		if (error != 0) {
2498 			KASSERT(ifp == NULL);
2499 			curlwp_bindx(bound);
2500 			return error;
2501 		}
2502 
2503 		if (IN6_IS_ADDR_V4MAPPED(&ia)) {
2504 			error = ip_setmoptions(&in6p->in6p_v4moptions, sopt);
2505 			goto put_break;
2506 		}
2507 		/*
2508 		 * See if we found an interface, and confirm that it
2509 		 * supports multicast
2510 		 */
2511 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2512 			error = EADDRNOTAVAIL;
2513 			goto put_break;
2514 		}
2515 
2516 		if (in6_setscope(&ia, ifp, NULL)) {
2517 			error = EADDRNOTAVAIL; /* XXX: should not happen */
2518 			goto put_break;
2519 		}
2520 
2521 		/*
2522 		 * See if the membership already exists.
2523 		 */
2524 		LIST_FOREACH(imm, &im6o->im6o_memberships, i6mm_chain) {
2525 			if (imm->i6mm_maddr->in6m_ifp == ifp &&
2526 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2527 			    &ia))
2528 				goto put_break;
2529 		}
2530 		if (imm != NULL) {
2531 			error = EADDRINUSE;
2532 			goto put_break;
2533 		}
2534 		/*
2535 		 * Everything looks good; add a new record to the multicast
2536 		 * address list for the given interface.
2537 		 */
2538 		imm = in6_joingroup(ifp, &ia, &error, 0);
2539 		if (imm == NULL)
2540 			goto put_break;
2541 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
2542 	    put_break:
2543 		if_put(ifp, &psref);
2544 		curlwp_bindx(bound);
2545 		break;
2546 	    }
2547 
2548 	case IPV6_LEAVE_GROUP: {
2549 		/*
2550 		 * Drop a multicast group membership.
2551 		 * Group must be a valid IP6 multicast address.
2552 		 */
2553 		error = sockopt_get(sopt, &mreq, sizeof(mreq));
2554 		if (error != 0)
2555 			break;
2556 
2557 		if (IN6_IS_ADDR_V4MAPPED(&mreq.ipv6mr_multiaddr)) {
2558 			error = ip_setmoptions(&in6p->in6p_v4moptions, sopt);
2559 			break;
2560 		}
2561 		/*
2562 		 * If an interface address was specified, get a pointer
2563 		 * to its ifnet structure.
2564 		 */
2565 		if (mreq.ipv6mr_interface != 0) {
2566 			if ((ifp = if_byindex(mreq.ipv6mr_interface)) == NULL) {
2567 				error = ENXIO;	/* XXX EINVAL? */
2568 				break;
2569 			}
2570 		} else
2571 			ifp = NULL;
2572 
2573 		/* Fill in the scope zone ID */
2574 		if (ifp) {
2575 			if (in6_setscope(&mreq.ipv6mr_multiaddr, ifp, NULL)) {
2576 				/* XXX: should not happen */
2577 				error = EADDRNOTAVAIL;
2578 				break;
2579 			}
2580 		} else if (mreq.ipv6mr_interface != 0) {
2581 			/*
2582 			 * XXX: This case would happens when the (positive)
2583 			 * index is in the valid range, but the corresponding
2584 			 * interface has been detached dynamically.  The above
2585 			 * check probably avoids such case to happen here, but
2586 			 * we check it explicitly for safety.
2587 			 */
2588 			error = EADDRNOTAVAIL;
2589 			break;
2590 		} else {	/* ipv6mr_interface == 0 */
2591 			struct sockaddr_in6 sa6_mc;
2592 
2593 			/*
2594 			 * The API spec says as follows:
2595 			 *  If the interface index is specified as 0, the
2596 			 *  system may choose a multicast group membership to
2597 			 *  drop by matching the multicast address only.
2598 			 * On the other hand, we cannot disambiguate the scope
2599 			 * zone unless an interface is provided.  Thus, we
2600 			 * check if there's ambiguity with the default scope
2601 			 * zone as the last resort.
2602 			 */
2603 			sockaddr_in6_init(&sa6_mc, &mreq.ipv6mr_multiaddr,
2604 			    0, 0, 0);
2605 			error = sa6_embedscope(&sa6_mc, ip6_use_defzone);
2606 			if (error != 0)
2607 				break;
2608 			mreq.ipv6mr_multiaddr = sa6_mc.sin6_addr;
2609 		}
2610 
2611 		/*
2612 		 * Find the membership in the membership list.
2613 		 */
2614 		LIST_FOREACH(imm, &im6o->im6o_memberships, i6mm_chain) {
2615 			if ((ifp == NULL || imm->i6mm_maddr->in6m_ifp == ifp) &&
2616 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2617 			    &mreq.ipv6mr_multiaddr))
2618 				break;
2619 		}
2620 		if (imm == NULL) {
2621 			/* Unable to resolve interface */
2622 			error = EADDRNOTAVAIL;
2623 			break;
2624 		}
2625 		/*
2626 		 * Give up the multicast address record to which the
2627 		 * membership points.
2628 		 */
2629 		LIST_REMOVE(imm, i6mm_chain);
2630 		in6_leavegroup(imm);
2631 		/* in6m_ifp should not leave thanks to in6p_lock */
2632 		break;
2633 	    }
2634 
2635 	default:
2636 		error = EOPNOTSUPP;
2637 		break;
2638 	}
2639 
2640 	/*
2641 	 * If all options have default values, no need to keep the mbuf.
2642 	 */
2643 	if (im6o->im6o_multicast_if_index == 0 &&
2644 	    im6o->im6o_multicast_hlim == ip6_defmcasthlim &&
2645 	    im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
2646 	    LIST_EMPTY(&im6o->im6o_memberships)) {
2647 		free(in6p->in6p_moptions, M_IPMOPTS);
2648 		in6p->in6p_moptions = NULL;
2649 	}
2650 
2651 	return (error);
2652 }
2653 
2654 /*
2655  * Return the IP6 multicast options in response to user getsockopt().
2656  */
2657 static int
2658 ip6_getmoptions(struct sockopt *sopt, struct in6pcb *in6p)
2659 {
2660 	u_int optval;
2661 	int error;
2662 	struct ip6_moptions *im6o = in6p->in6p_moptions;
2663 
2664 	switch (sopt->sopt_name) {
2665 	case IPV6_MULTICAST_IF:
2666 		if (im6o == NULL || im6o->im6o_multicast_if_index == 0)
2667 			optval = 0;
2668 		else
2669 			optval = im6o->im6o_multicast_if_index;
2670 
2671 		error = sockopt_set(sopt, &optval, sizeof(optval));
2672 		break;
2673 
2674 	case IPV6_MULTICAST_HOPS:
2675 		if (im6o == NULL)
2676 			optval = ip6_defmcasthlim;
2677 		else
2678 			optval = im6o->im6o_multicast_hlim;
2679 
2680 		error = sockopt_set(sopt, &optval, sizeof(optval));
2681 		break;
2682 
2683 	case IPV6_MULTICAST_LOOP:
2684 		if (im6o == NULL)
2685 			optval = IPV6_DEFAULT_MULTICAST_LOOP;
2686 		else
2687 			optval = im6o->im6o_multicast_loop;
2688 
2689 		error = sockopt_set(sopt, &optval, sizeof(optval));
2690 		break;
2691 
2692 	default:
2693 		error = EOPNOTSUPP;
2694 	}
2695 
2696 	return (error);
2697 }
2698 
2699 /*
2700  * Discard the IP6 multicast options.
2701  */
2702 void
2703 ip6_freemoptions(struct ip6_moptions *im6o)
2704 {
2705 	struct in6_multi_mship *imm, *nimm;
2706 
2707 	if (im6o == NULL)
2708 		return;
2709 
2710 	/* The owner of im6o (in6p) should be protected by solock */
2711 	LIST_FOREACH_SAFE(imm, &im6o->im6o_memberships, i6mm_chain, nimm) {
2712 		LIST_REMOVE(imm, i6mm_chain);
2713 		in6_leavegroup(imm);
2714 	}
2715 	free(im6o, M_IPMOPTS);
2716 }
2717 
2718 /*
2719  * Set IPv6 outgoing packet options based on advanced API.
2720  */
2721 int
2722 ip6_setpktopts(struct mbuf *control, struct ip6_pktopts *opt,
2723 	struct ip6_pktopts *stickyopt, kauth_cred_t cred, int uproto)
2724 {
2725 	struct cmsghdr *cm = 0;
2726 
2727 	if (control == NULL || opt == NULL)
2728 		return (EINVAL);
2729 
2730 	ip6_initpktopts(opt);
2731 	if (stickyopt) {
2732 		int error;
2733 
2734 		/*
2735 		 * If stickyopt is provided, make a local copy of the options
2736 		 * for this particular packet, then override them by ancillary
2737 		 * objects.
2738 		 * XXX: copypktopts() does not copy the cached route to a next
2739 		 * hop (if any).  This is not very good in terms of efficiency,
2740 		 * but we can allow this since this option should be rarely
2741 		 * used.
2742 		 */
2743 		if ((error = copypktopts(opt, stickyopt, M_NOWAIT)) != 0)
2744 			return (error);
2745 	}
2746 
2747 	/*
2748 	 * XXX: Currently, we assume all the optional information is stored
2749 	 * in a single mbuf.
2750 	 */
2751 	if (control->m_next)
2752 		return (EINVAL);
2753 
2754 	/* XXX if cm->cmsg_len is not aligned, control->m_len can become <0 */
2755 	for (; control->m_len > 0; control->m_data += CMSG_ALIGN(cm->cmsg_len),
2756 	    control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
2757 		int error;
2758 
2759 		if (control->m_len < CMSG_LEN(0))
2760 			return (EINVAL);
2761 
2762 		cm = mtod(control, struct cmsghdr *);
2763 		if (cm->cmsg_len < CMSG_LEN(0) || cm->cmsg_len > control->m_len)
2764 			return (EINVAL);
2765 		if (cm->cmsg_level != IPPROTO_IPV6)
2766 			continue;
2767 
2768 		error = ip6_setpktopt(cm->cmsg_type, CMSG_DATA(cm),
2769 		    cm->cmsg_len - CMSG_LEN(0), opt, cred, 0, 1, uproto);
2770 		if (error)
2771 			return (error);
2772 	}
2773 
2774 	return (0);
2775 }
2776 
2777 /*
2778  * Set a particular packet option, as a sticky option or an ancillary data
2779  * item.  "len" can be 0 only when it's a sticky option.
2780  * We have 4 cases of combination of "sticky" and "cmsg":
2781  * "sticky=0, cmsg=0": impossible
2782  * "sticky=0, cmsg=1": RFC2292 or RFC3542 ancillary data
2783  * "sticky=1, cmsg=0": RFC3542 socket option
2784  * "sticky=1, cmsg=1": RFC2292 socket option
2785  */
2786 static int
2787 ip6_setpktopt(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
2788     kauth_cred_t cred, int sticky, int cmsg, int uproto)
2789 {
2790 	int minmtupolicy;
2791 	int error;
2792 
2793 	if (!sticky && !cmsg) {
2794 #ifdef DIAGNOSTIC
2795 		printf("ip6_setpktopt: impossible case\n");
2796 #endif
2797 		return (EINVAL);
2798 	}
2799 
2800 	/*
2801 	 * IPV6_2292xxx is for backward compatibility to RFC2292, and should
2802 	 * not be specified in the context of RFC3542.  Conversely,
2803 	 * RFC3542 types should not be specified in the context of RFC2292.
2804 	 */
2805 	if (!cmsg) {
2806 		switch (optname) {
2807 		case IPV6_2292PKTINFO:
2808 		case IPV6_2292HOPLIMIT:
2809 		case IPV6_2292NEXTHOP:
2810 		case IPV6_2292HOPOPTS:
2811 		case IPV6_2292DSTOPTS:
2812 		case IPV6_2292RTHDR:
2813 		case IPV6_2292PKTOPTIONS:
2814 			return (ENOPROTOOPT);
2815 		}
2816 	}
2817 	if (sticky && cmsg) {
2818 		switch (optname) {
2819 		case IPV6_PKTINFO:
2820 		case IPV6_HOPLIMIT:
2821 		case IPV6_NEXTHOP:
2822 		case IPV6_HOPOPTS:
2823 		case IPV6_DSTOPTS:
2824 		case IPV6_RTHDRDSTOPTS:
2825 		case IPV6_RTHDR:
2826 		case IPV6_USE_MIN_MTU:
2827 		case IPV6_DONTFRAG:
2828 		case IPV6_OTCLASS:
2829 		case IPV6_TCLASS:
2830 		case IPV6_PREFER_TEMPADDR: /* XXX not an RFC3542 option */
2831 			return (ENOPROTOOPT);
2832 		}
2833 	}
2834 
2835 	switch (optname) {
2836 #ifdef RFC2292
2837 	case IPV6_2292PKTINFO:
2838 #endif
2839 	case IPV6_PKTINFO:
2840 	{
2841 		struct in6_pktinfo *pktinfo;
2842 
2843 		if (len != sizeof(struct in6_pktinfo))
2844 			return (EINVAL);
2845 
2846 		pktinfo = (struct in6_pktinfo *)buf;
2847 
2848 		/*
2849 		 * An application can clear any sticky IPV6_PKTINFO option by
2850 		 * doing a "regular" setsockopt with ipi6_addr being
2851 		 * in6addr_any and ipi6_ifindex being zero.
2852 		 * [RFC 3542, Section 6]
2853 		 */
2854 		if (optname == IPV6_PKTINFO && opt->ip6po_pktinfo &&
2855 		    pktinfo->ipi6_ifindex == 0 &&
2856 		    IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
2857 			ip6_clearpktopts(opt, optname);
2858 			break;
2859 		}
2860 
2861 		if (uproto == IPPROTO_TCP && optname == IPV6_PKTINFO &&
2862 		    sticky && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
2863 			return (EINVAL);
2864 		}
2865 
2866 		/* Validate the interface index if specified. */
2867 		if (pktinfo->ipi6_ifindex) {
2868 			struct ifnet *ifp;
2869 			int s = pserialize_read_enter();
2870 			ifp = if_byindex(pktinfo->ipi6_ifindex);
2871 			if (ifp == NULL) {
2872 				pserialize_read_exit(s);
2873 				return ENXIO;
2874 			}
2875 			pserialize_read_exit(s);
2876 		}
2877 
2878 		/*
2879 		 * We store the address anyway, and let in6_selectsrc()
2880 		 * validate the specified address.  This is because ipi6_addr
2881 		 * may not have enough information about its scope zone, and
2882 		 * we may need additional information (such as outgoing
2883 		 * interface or the scope zone of a destination address) to
2884 		 * disambiguate the scope.
2885 		 * XXX: the delay of the validation may confuse the
2886 		 * application when it is used as a sticky option.
2887 		 */
2888 		if (opt->ip6po_pktinfo == NULL) {
2889 			opt->ip6po_pktinfo = malloc(sizeof(*pktinfo),
2890 			    M_IP6OPT, M_NOWAIT);
2891 			if (opt->ip6po_pktinfo == NULL)
2892 				return (ENOBUFS);
2893 		}
2894 		memcpy(opt->ip6po_pktinfo, pktinfo, sizeof(*pktinfo));
2895 		break;
2896 	}
2897 
2898 #ifdef RFC2292
2899 	case IPV6_2292HOPLIMIT:
2900 #endif
2901 	case IPV6_HOPLIMIT:
2902 	{
2903 		int *hlimp;
2904 
2905 		/*
2906 		 * RFC 3542 deprecated the usage of sticky IPV6_HOPLIMIT
2907 		 * to simplify the ordering among hoplimit options.
2908 		 */
2909 		if (optname == IPV6_HOPLIMIT && sticky)
2910 			return (ENOPROTOOPT);
2911 
2912 		if (len != sizeof(int))
2913 			return (EINVAL);
2914 		hlimp = (int *)buf;
2915 		if (*hlimp < -1 || *hlimp > 255)
2916 			return (EINVAL);
2917 
2918 		opt->ip6po_hlim = *hlimp;
2919 		break;
2920 	}
2921 
2922 	case IPV6_OTCLASS:
2923 		if (len != sizeof(u_int8_t))
2924 			return (EINVAL);
2925 
2926 		opt->ip6po_tclass = *(u_int8_t *)buf;
2927 		break;
2928 
2929 	case IPV6_TCLASS:
2930 	{
2931 		int tclass;
2932 
2933 		if (len != sizeof(int))
2934 			return (EINVAL);
2935 		tclass = *(int *)buf;
2936 		if (tclass < -1 || tclass > 255)
2937 			return (EINVAL);
2938 
2939 		opt->ip6po_tclass = tclass;
2940 		break;
2941 	}
2942 
2943 #ifdef RFC2292
2944 	case IPV6_2292NEXTHOP:
2945 #endif
2946 	case IPV6_NEXTHOP:
2947 		error = kauth_authorize_network(cred, KAUTH_NETWORK_IPV6,
2948 		    KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL, NULL, NULL);
2949 		if (error)
2950 			return (error);
2951 
2952 		if (len == 0) {	/* just remove the option */
2953 			ip6_clearpktopts(opt, IPV6_NEXTHOP);
2954 			break;
2955 		}
2956 
2957 		/* check if cmsg_len is large enough for sa_len */
2958 		if (len < sizeof(struct sockaddr) || len < *buf)
2959 			return (EINVAL);
2960 
2961 		switch (((struct sockaddr *)buf)->sa_family) {
2962 		case AF_INET6:
2963 		{
2964 			struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)buf;
2965 
2966 			if (sa6->sin6_len != sizeof(struct sockaddr_in6))
2967 				return (EINVAL);
2968 
2969 			if (IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
2970 			    IN6_IS_ADDR_MULTICAST(&sa6->sin6_addr)) {
2971 				return (EINVAL);
2972 			}
2973 			if ((error = sa6_embedscope(sa6, ip6_use_defzone))
2974 			    != 0) {
2975 				return (error);
2976 			}
2977 			break;
2978 		}
2979 		case AF_LINK:	/* eventually be supported? */
2980 		default:
2981 			return (EAFNOSUPPORT);
2982 		}
2983 
2984 		/* turn off the previous option, then set the new option. */
2985 		ip6_clearpktopts(opt, IPV6_NEXTHOP);
2986 		opt->ip6po_nexthop = malloc(*buf, M_IP6OPT, M_NOWAIT);
2987 		if (opt->ip6po_nexthop == NULL)
2988 			return (ENOBUFS);
2989 		memcpy(opt->ip6po_nexthop, buf, *buf);
2990 		break;
2991 
2992 #ifdef RFC2292
2993 	case IPV6_2292HOPOPTS:
2994 #endif
2995 	case IPV6_HOPOPTS:
2996 	{
2997 		struct ip6_hbh *hbh;
2998 		int hbhlen;
2999 
3000 		/*
3001 		 * XXX: We don't allow a non-privileged user to set ANY HbH
3002 		 * options, since per-option restriction has too much
3003 		 * overhead.
3004 		 */
3005 		error = kauth_authorize_network(cred, KAUTH_NETWORK_IPV6,
3006 		    KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL, NULL, NULL);
3007 		if (error)
3008 			return (error);
3009 
3010 		if (len == 0) {
3011 			ip6_clearpktopts(opt, IPV6_HOPOPTS);
3012 			break;	/* just remove the option */
3013 		}
3014 
3015 		/* message length validation */
3016 		if (len < sizeof(struct ip6_hbh))
3017 			return (EINVAL);
3018 		hbh = (struct ip6_hbh *)buf;
3019 		hbhlen = (hbh->ip6h_len + 1) << 3;
3020 		if (len != hbhlen)
3021 			return (EINVAL);
3022 
3023 		/* turn off the previous option, then set the new option. */
3024 		ip6_clearpktopts(opt, IPV6_HOPOPTS);
3025 		opt->ip6po_hbh = malloc(hbhlen, M_IP6OPT, M_NOWAIT);
3026 		if (opt->ip6po_hbh == NULL)
3027 			return (ENOBUFS);
3028 		memcpy(opt->ip6po_hbh, hbh, hbhlen);
3029 
3030 		break;
3031 	}
3032 
3033 #ifdef RFC2292
3034 	case IPV6_2292DSTOPTS:
3035 #endif
3036 	case IPV6_DSTOPTS:
3037 	case IPV6_RTHDRDSTOPTS:
3038 	{
3039 		struct ip6_dest *dest, **newdest = NULL;
3040 		int destlen;
3041 
3042 		/* XXX: see the comment for IPV6_HOPOPTS */
3043 		error = kauth_authorize_network(cred, KAUTH_NETWORK_IPV6,
3044 		    KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL, NULL, NULL);
3045 		if (error)
3046 			return (error);
3047 
3048 		if (len == 0) {
3049 			ip6_clearpktopts(opt, optname);
3050 			break;	/* just remove the option */
3051 		}
3052 
3053 		/* message length validation */
3054 		if (len < sizeof(struct ip6_dest))
3055 			return (EINVAL);
3056 		dest = (struct ip6_dest *)buf;
3057 		destlen = (dest->ip6d_len + 1) << 3;
3058 		if (len != destlen)
3059 			return (EINVAL);
3060 		/*
3061 		 * Determine the position that the destination options header
3062 		 * should be inserted; before or after the routing header.
3063 		 */
3064 		switch (optname) {
3065 		case IPV6_2292DSTOPTS:
3066 			/*
3067 			 * The old advanced API is ambiguous on this point.
3068 			 * Our approach is to determine the position based
3069 			 * according to the existence of a routing header.
3070 			 * Note, however, that this depends on the order of the
3071 			 * extension headers in the ancillary data; the 1st
3072 			 * part of the destination options header must appear
3073 			 * before the routing header in the ancillary data,
3074 			 * too.
3075 			 * RFC3542 solved the ambiguity by introducing
3076 			 * separate ancillary data or option types.
3077 			 */
3078 			if (opt->ip6po_rthdr == NULL)
3079 				newdest = &opt->ip6po_dest1;
3080 			else
3081 				newdest = &opt->ip6po_dest2;
3082 			break;
3083 		case IPV6_RTHDRDSTOPTS:
3084 			newdest = &opt->ip6po_dest1;
3085 			break;
3086 		case IPV6_DSTOPTS:
3087 			newdest = &opt->ip6po_dest2;
3088 			break;
3089 		}
3090 
3091 		/* turn off the previous option, then set the new option. */
3092 		ip6_clearpktopts(opt, optname);
3093 		*newdest = malloc(destlen, M_IP6OPT, M_NOWAIT);
3094 		if (*newdest == NULL)
3095 			return (ENOBUFS);
3096 		memcpy(*newdest, dest, destlen);
3097 
3098 		break;
3099 	}
3100 
3101 #ifdef RFC2292
3102 	case IPV6_2292RTHDR:
3103 #endif
3104 	case IPV6_RTHDR:
3105 	{
3106 		struct ip6_rthdr *rth;
3107 		int rthlen;
3108 
3109 		if (len == 0) {
3110 			ip6_clearpktopts(opt, IPV6_RTHDR);
3111 			break;	/* just remove the option */
3112 		}
3113 
3114 		/* message length validation */
3115 		if (len < sizeof(struct ip6_rthdr))
3116 			return (EINVAL);
3117 		rth = (struct ip6_rthdr *)buf;
3118 		rthlen = (rth->ip6r_len + 1) << 3;
3119 		if (len != rthlen)
3120 			return (EINVAL);
3121 		switch (rth->ip6r_type) {
3122 		case IPV6_RTHDR_TYPE_0:
3123 			/* Dropped, RFC5095. */
3124 		default:
3125 			return (EINVAL);	/* not supported */
3126 		}
3127 		/* turn off the previous option */
3128 		ip6_clearpktopts(opt, IPV6_RTHDR);
3129 		opt->ip6po_rthdr = malloc(rthlen, M_IP6OPT, M_NOWAIT);
3130 		if (opt->ip6po_rthdr == NULL)
3131 			return (ENOBUFS);
3132 		memcpy(opt->ip6po_rthdr, rth, rthlen);
3133 		break;
3134 	}
3135 
3136 	case IPV6_USE_MIN_MTU:
3137 		if (len != sizeof(int))
3138 			return (EINVAL);
3139 		minmtupolicy = *(int *)buf;
3140 		if (minmtupolicy != IP6PO_MINMTU_MCASTONLY &&
3141 		    minmtupolicy != IP6PO_MINMTU_DISABLE &&
3142 		    minmtupolicy != IP6PO_MINMTU_ALL) {
3143 			return (EINVAL);
3144 		}
3145 		opt->ip6po_minmtu = minmtupolicy;
3146 		break;
3147 
3148 	case IPV6_DONTFRAG:
3149 		if (len != sizeof(int))
3150 			return (EINVAL);
3151 
3152 		if (uproto == IPPROTO_TCP || *(int *)buf == 0) {
3153 			/*
3154 			 * we ignore this option for TCP sockets.
3155 			 * (RFC3542 leaves this case unspecified.)
3156 			 */
3157 			opt->ip6po_flags &= ~IP6PO_DONTFRAG;
3158 		} else
3159 			opt->ip6po_flags |= IP6PO_DONTFRAG;
3160 		break;
3161 
3162 	case IPV6_PREFER_TEMPADDR:
3163 	{
3164 		int preftemp;
3165 
3166 		if (len != sizeof(int))
3167 			return (EINVAL);
3168 		preftemp = *(int *)buf;
3169 		switch (preftemp) {
3170 		case IP6PO_TEMPADDR_SYSTEM:
3171 		case IP6PO_TEMPADDR_NOTPREFER:
3172 		case IP6PO_TEMPADDR_PREFER:
3173 			break;
3174 		default:
3175 			return (EINVAL);
3176 		}
3177 		opt->ip6po_prefer_tempaddr = preftemp;
3178 		break;
3179 	}
3180 
3181 	default:
3182 		return (ENOPROTOOPT);
3183 	} /* end of switch */
3184 
3185 	return (0);
3186 }
3187 
3188 /*
3189  * Routine called from ip6_output() to loop back a copy of an IP6 multicast
3190  * packet to the input queue of a specified interface.  Note that this
3191  * calls the output routine of the loopback "driver", but with an interface
3192  * pointer that might NOT be lo0ifp -- easier than replicating that code here.
3193  */
3194 void
3195 ip6_mloopback(struct ifnet *ifp, struct mbuf *m,
3196 	const struct sockaddr_in6 *dst)
3197 {
3198 	struct mbuf *copym;
3199 	struct ip6_hdr *ip6;
3200 
3201 	copym = m_copypacket(m, M_DONTWAIT);
3202 	if (copym == NULL)
3203 		return;
3204 
3205 	/*
3206 	 * Make sure to deep-copy IPv6 header portion in case the data
3207 	 * is in an mbuf cluster, so that we can safely override the IPv6
3208 	 * header portion later.
3209 	 */
3210 	if ((copym->m_flags & M_EXT) != 0 ||
3211 	    copym->m_len < sizeof(struct ip6_hdr)) {
3212 		copym = m_pullup(copym, sizeof(struct ip6_hdr));
3213 		if (copym == NULL)
3214 			return;
3215 	}
3216 
3217 #ifdef DIAGNOSTIC
3218 	if (copym->m_len < sizeof(*ip6)) {
3219 		m_freem(copym);
3220 		return;
3221 	}
3222 #endif
3223 
3224 	ip6 = mtod(copym, struct ip6_hdr *);
3225 	/*
3226 	 * clear embedded scope identifiers if necessary.
3227 	 * in6_clearscope will touch the addresses only when necessary.
3228 	 */
3229 	in6_clearscope(&ip6->ip6_src);
3230 	in6_clearscope(&ip6->ip6_dst);
3231 
3232 	(void)looutput(ifp, copym, (const struct sockaddr *)dst, NULL);
3233 }
3234 
3235 /*
3236  * Chop IPv6 header off from the payload.
3237  */
3238 static int
3239 ip6_splithdr(struct mbuf *m, struct ip6_exthdrs *exthdrs)
3240 {
3241 	struct mbuf *mh;
3242 	struct ip6_hdr *ip6;
3243 
3244 	ip6 = mtod(m, struct ip6_hdr *);
3245 	if (m->m_len > sizeof(*ip6)) {
3246 		MGETHDR(mh, M_DONTWAIT, MT_HEADER);
3247 		if (mh == NULL) {
3248 			m_freem(m);
3249 			return ENOBUFS;
3250 		}
3251 		m_move_pkthdr(mh, m);
3252 		m_align(mh, sizeof(*ip6));
3253 		m->m_len -= sizeof(*ip6);
3254 		m->m_data += sizeof(*ip6);
3255 		mh->m_next = m;
3256 		mh->m_len = sizeof(*ip6);
3257 		memcpy(mtod(mh, void *), (void *)ip6, sizeof(*ip6));
3258 		m = mh;
3259 	}
3260 	exthdrs->ip6e_ip6 = m;
3261 	return 0;
3262 }
3263 
3264 /*
3265  * Compute IPv6 extension header length.
3266  */
3267 int
3268 ip6_optlen(struct in6pcb *in6p)
3269 {
3270 	int len;
3271 
3272 	if (!in6p->in6p_outputopts)
3273 		return 0;
3274 
3275 	len = 0;
3276 #define elen(x) \
3277     (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
3278 
3279 	len += elen(in6p->in6p_outputopts->ip6po_hbh);
3280 	len += elen(in6p->in6p_outputopts->ip6po_dest1);
3281 	len += elen(in6p->in6p_outputopts->ip6po_rthdr);
3282 	len += elen(in6p->in6p_outputopts->ip6po_dest2);
3283 	return len;
3284 #undef elen
3285 }
3286 
3287 /*
3288  * Ensure sending address is valid.
3289  * Returns 0 on success, -1 if an error should be sent back or 1
3290  * if the packet could be dropped without error (protocol dependent).
3291  */
3292 static int
3293 ip6_ifaddrvalid(const struct in6_addr *src, const struct in6_addr *dst)
3294 {
3295 	struct sockaddr_in6 sin6;
3296 	int s, error;
3297 	struct ifaddr *ifa;
3298 	struct in6_ifaddr *ia6;
3299 
3300 	if (IN6_IS_ADDR_UNSPECIFIED(src))
3301 		return 0;
3302 
3303 	memset(&sin6, 0, sizeof(sin6));
3304 	sin6.sin6_family = AF_INET6;
3305 	sin6.sin6_len = sizeof(sin6);
3306 	sin6.sin6_addr = *src;
3307 
3308 	s = pserialize_read_enter();
3309 	ifa = ifa_ifwithaddr(sin6tosa(&sin6));
3310 	if ((ia6 = ifatoia6(ifa)) == NULL ||
3311 	    ia6->ia6_flags & (IN6_IFF_ANYCAST | IN6_IFF_DUPLICATED))
3312 		error = -1;
3313 	else if (ia6->ia6_flags & IN6_IFF_TENTATIVE)
3314 		error = 1;
3315 	else if (ia6->ia6_flags & IN6_IFF_DETACHED &&
3316 	    (sin6.sin6_addr = *dst, ifa_ifwithaddr(sin6tosa(&sin6)) == NULL))
3317 		/* Allow internal traffic to DETACHED addresses */
3318 		error = 1;
3319 	else
3320 		error = 0;
3321 	pserialize_read_exit(s);
3322 
3323 	return error;
3324 }
3325