xref: /netbsd-src/sys/netinet6/ip6_output.c (revision 95d875fb90b1458e4f1de6950286ddcd6644bc61)
1 /*	$NetBSD: ip6_output.c,v 1.9 1999/12/13 15:17:23 itojun Exp $	*/
2 
3 /*
4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the project nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 /*
33  * Copyright (c) 1982, 1986, 1988, 1990, 1993
34  *	The Regents of the University of California.  All rights reserved.
35  *
36  * Redistribution and use in source and binary forms, with or without
37  * modification, are permitted provided that the following conditions
38  * are met:
39  * 1. Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  * 2. Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in the
43  *    documentation and/or other materials provided with the distribution.
44  * 3. All advertising materials mentioning features or use of this software
45  *    must display the following acknowledgement:
46  *	This product includes software developed by the University of
47  *	California, Berkeley and its contributors.
48  * 4. Neither the name of the University nor the names of its contributors
49  *    may be used to endorse or promote products derived from this software
50  *    without specific prior written permission.
51  *
52  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
53  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
54  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
55  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
56  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
57  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
58  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
59  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
60  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
61  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
62  * SUCH DAMAGE.
63  *
64  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
65  */
66 
67 #ifdef __FreeBSD__
68 #include "opt_ip6fw.h"
69 #endif
70 #if (defined(__FreeBSD__) && __FreeBSD__ >= 3) || defined(__NetBSD__)
71 #include "opt_inet.h"
72 #ifdef __NetBSD__	/*XXX*/
73 #include "opt_ipsec.h"
74 #endif
75 #endif
76 
77 #include <sys/param.h>
78 #include <sys/malloc.h>
79 #include <sys/mbuf.h>
80 #include <sys/errno.h>
81 #include <sys/protosw.h>
82 #include <sys/socket.h>
83 #include <sys/socketvar.h>
84 #include <sys/systm.h>
85 #if (defined(__FreeBSD__) && __FreeBSD__ >= 3)
86 #include <sys/kernel.h>
87 #endif
88 #if defined(__bsdi__) && _BSDI_VERSION >= 199802
89 #include <machine/pcpu.h>
90 #endif
91 #include <sys/proc.h>
92 
93 #include <net/if.h>
94 #include <net/route.h>
95 
96 #include <netinet/in.h>
97 #include <netinet/in_var.h>
98 #if defined(__OpenBSD__) || (defined(__bsdi__) && _BSDI_VERSION >= 199802)
99 #include <netinet/in_systm.h>
100 #include <netinet/ip.h>
101 #endif
102 #include <netinet6/ip6.h>
103 #include <netinet6/icmp6.h>
104 #if (defined(__FreeBSD__) && __FreeBSD__ >= 3) || defined(__OpenBSD__) || (defined(__bsdi__) && _BSDI_VERSION >= 199802)
105 #include <netinet/in_pcb.h>
106 #else
107 #include <netinet6/in6_pcb.h>
108 #endif
109 #include <netinet6/ip6_var.h>
110 #include <netinet6/nd6.h>
111 
112 #ifdef __OpenBSD__ /*KAME IPSEC*/
113 #undef IPSEC
114 #endif
115 
116 #ifdef IPSEC
117 #include <netinet6/ipsec.h>
118 #include <netkey/key.h>
119 #include <netkey/key_debug.h>
120 #endif /* IPSEC */
121 
122 #ifndef __bsdi__
123 #include "loop.h"
124 #endif
125 
126 #include <net/net_osdep.h>
127 
128 #ifdef IPV6FIREWALL
129 #include <netinet6/ip6_fw.h>
130 #endif
131 
132 #if defined(__FreeBSD__) && __FreeBSD__ >= 3
133 static MALLOC_DEFINE(M_IPMOPTS, "ip6_moptions", "internet multicast options");
134 #endif
135 
136 struct ip6_exthdrs {
137 	struct mbuf *ip6e_ip6;
138 	struct mbuf *ip6e_hbh;
139 	struct mbuf *ip6e_dest1;
140 	struct mbuf *ip6e_rthdr;
141 	struct mbuf *ip6e_dest2;
142 };
143 
144 static int ip6_pcbopts __P((struct ip6_pktopts **, struct mbuf *,
145 			    struct socket *));
146 static int ip6_setmoptions __P((int, struct ip6_moptions **, struct mbuf *));
147 static int ip6_getmoptions __P((int, struct ip6_moptions *, struct mbuf **));
148 static int ip6_copyexthdr __P((struct mbuf **, caddr_t, int));
149 static int ip6_insertfraghdr __P((struct mbuf *, struct mbuf *, int,
150 				  struct ip6_frag **));
151 static int ip6_insert_jumboopt __P((struct ip6_exthdrs *, u_int32_t));
152 static int ip6_splithdr __P((struct mbuf *, struct ip6_exthdrs *));
153 #if (defined(__bsdi__) && _BSDI_VERSION < 199802) || defined(__OpenBSD__)
154 extern struct ifnet loif;
155 struct ifnet *loifp = &loif;
156 #endif
157 #if defined(__bsdi__) && _BSDI_VERSION >= 199802
158 extern struct ifnet *loifp;
159 #endif
160 
161 #ifdef __NetBSD__
162 extern struct ifnet **ifindex2ifnet;
163 extern struct ifnet loif[NLOOP];
164 #endif
165 
166 /*
167  * IP6 output. The packet in mbuf chain m contains a skeletal IP6
168  * header (with pri, len, nxt, hlim, src, dst).
169  * This function may modify ver and hlim only.
170  * The mbuf chain containing the packet will be freed.
171  * The mbuf opt, if present, will not be freed.
172  */
173 int
174 ip6_output(m0, opt, ro, flags, im6o, ifpp)
175 	struct mbuf *m0;
176 	struct ip6_pktopts *opt;
177 	struct route_in6 *ro;
178 	int flags;
179 	struct ip6_moptions *im6o;
180 	struct ifnet **ifpp;		/* XXX: just for statistics */
181 {
182 	struct ip6_hdr *ip6, *mhip6;
183 	struct ifnet *ifp;
184 	struct mbuf *m = m0;
185 	int hlen, tlen, len, off;
186 	struct route_in6 ip6route;
187 	struct sockaddr_in6 *dst;
188 	int error = 0;
189 	struct in6_ifaddr *ia;
190 	u_long mtu;
191 	u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
192 	struct ip6_exthdrs exthdrs;
193 	struct in6_addr finaldst;
194 	struct route_in6 *ro_pmtu = NULL;
195 	int hdrsplit = 0;
196 	int needipsec = 0;
197 #ifdef IPSEC
198 	int needipsectun = 0;
199 	struct socket *so;
200 	struct secpolicy *sp = NULL;
201 
202 	/* for AH processing. stupid to have "socket" variable in IP layer... */
203 	so = (struct socket *)m->m_pkthdr.rcvif;
204 	m->m_pkthdr.rcvif = NULL;
205 	ip6 = mtod(m, struct ip6_hdr *);
206 #endif /* IPSEC */
207 
208 #define MAKE_EXTHDR(hp,mp)						\
209     {									\
210 	if (hp) {							\
211 		struct ip6_ext *eh = (struct ip6_ext *)(hp);		\
212 		error = ip6_copyexthdr((mp), (caddr_t)(hp), 		\
213 				       ((eh)->ip6e_len + 1) << 3);	\
214 		if (error)						\
215 			goto freehdrs;					\
216 	}								\
217     }
218 
219 	bzero(&exthdrs, sizeof(exthdrs));
220 	if (opt) {
221 		/* Hop-by-Hop options header */
222 		MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
223 		/* Destination options header(1st part) */
224 		MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
225 		/* Routing header */
226 		MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
227 		/* Destination options header(2nd part) */
228 		MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
229 	}
230 
231 #ifdef IPSEC
232 	/* get a security policy for this packet */
233 	if (so == NULL)
234 		sp = ipsec6_getpolicybyaddr(m, 0, &error);
235 	else
236 		sp = ipsec6_getpolicybysock(m, so, &error);
237 
238 	if (sp == NULL) {
239 		ipsec6stat.out_inval++;
240 		goto bad;
241 	}
242 
243 	error = 0;
244 
245 	/* check policy */
246 	switch (sp->policy) {
247 	case IPSEC_POLICY_DISCARD:
248 		/*
249 		 * This packet is just discarded.
250 		 */
251 		ipsec6stat.out_polvio++;
252 		goto bad;
253 
254 	case IPSEC_POLICY_BYPASS:
255 	case IPSEC_POLICY_NONE:
256 		/* no need to do IPsec. */
257 		needipsec = 0;
258 		break;
259 
260 	case IPSEC_POLICY_IPSEC:
261 		if (sp->req == NULL) {
262 			/* XXX should be panic ? */
263 			printf("ip6_output: No IPsec request specified.\n");
264 			error = EINVAL;
265 			goto bad;
266 		}
267 		needipsec = 1;
268 		break;
269 
270 	case IPSEC_POLICY_ENTRUST:
271 	default:
272 		printf("ip6_output: Invalid policy found. %d\n", sp->policy);
273 	}
274 #endif /* IPSEC */
275 
276 	/*
277 	 * Calculate the total length of the extension header chain.
278 	 * Keep the length of the unfragmentable part for fragmentation.
279 	 */
280 	optlen = 0;
281 	if (exthdrs.ip6e_hbh) optlen += exthdrs.ip6e_hbh->m_len;
282 	if (exthdrs.ip6e_dest1) optlen += exthdrs.ip6e_dest1->m_len;
283 	if (exthdrs.ip6e_rthdr) optlen += exthdrs.ip6e_rthdr->m_len;
284 	unfragpartlen = optlen + sizeof(struct ip6_hdr);
285 	/* NOTE: we don't add AH/ESP length here. do that later. */
286 	if (exthdrs.ip6e_dest2) optlen += exthdrs.ip6e_dest2->m_len;
287 
288 	/*
289 	 * If we need IPsec, or there is at least one extension header,
290 	 * separate IP6 header from the payload.
291 	 */
292 	if ((needipsec || optlen) && !hdrsplit) {
293 		if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
294 			m = NULL;
295 			goto freehdrs;
296 		}
297 		m = exthdrs.ip6e_ip6;
298 		hdrsplit++;
299 	}
300 
301 	/* adjust pointer */
302 	ip6 = mtod(m, struct ip6_hdr *);
303 
304 	/* adjust mbuf packet header length */
305 	m->m_pkthdr.len += optlen;
306 	plen = m->m_pkthdr.len - sizeof(*ip6);
307 
308 	/* If this is a jumbo payload, insert a jumbo payload option. */
309 	if (plen > IPV6_MAXPACKET) {
310 		if (!hdrsplit) {
311 			if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
312 				m = NULL;
313 				goto freehdrs;
314 			}
315 			m = exthdrs.ip6e_ip6;
316 			hdrsplit++;
317 		}
318 		/* adjust pointer */
319 		ip6 = mtod(m, struct ip6_hdr *);
320 		if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
321 			goto freehdrs;
322 		ip6->ip6_plen = 0;
323 	} else
324 		ip6->ip6_plen = htons(plen);
325 
326 	/*
327 	 * Concatenate headers and fill in next header fields.
328 	 * Here we have, on "m"
329 	 *	IPv6 payload
330 	 * and we insert headers accordingly.  Finally, we should be getting:
331 	 *	IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
332 	 *
333 	 * during the header composing process, "m" points to IPv6 header.
334 	 * "mprev" points to an extension header prior to esp.
335 	 */
336 	{
337 		u_char *nexthdrp = &ip6->ip6_nxt;
338 		struct mbuf *mprev = m;
339 
340 		/*
341 		 * we treat dest2 specially.  this makes IPsec processing
342 		 * much easier.
343 		 *
344 		 * result: IPv6 dest2 payload
345 		 * m and mprev will point to IPv6 header.
346 		 */
347 		if (exthdrs.ip6e_dest2) {
348 			if (!hdrsplit)
349 				panic("assumption failed: hdr not split");
350 			exthdrs.ip6e_dest2->m_next = m->m_next;
351 			m->m_next = exthdrs.ip6e_dest2;
352 			*mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
353 			ip6->ip6_nxt = IPPROTO_DSTOPTS;
354 		}
355 
356 #define MAKE_CHAIN(m,mp,p,i)\
357     {\
358 	if (m) {\
359 		if (!hdrsplit) \
360 			panic("assumption failed: hdr not split"); \
361 		*mtod((m), u_char *) = *(p);\
362 		*(p) = (i);\
363 		p = mtod((m), u_char *);\
364 		(m)->m_next = (mp)->m_next;\
365 		(mp)->m_next = (m);\
366 		(mp) = (m);\
367 	}\
368     }
369 		/*
370 		 * result: IPv6 hbh dest1 rthdr dest2 payload
371 		 * m will point to IPv6 header.  mprev will point to the
372 		 * extension header prior to dest2 (rthdr in the above case).
373 		 */
374 		MAKE_CHAIN(exthdrs.ip6e_hbh, mprev,
375 			   nexthdrp, IPPROTO_HOPOPTS);
376 		MAKE_CHAIN(exthdrs.ip6e_dest1, mprev,
377 			   nexthdrp, IPPROTO_DSTOPTS);
378 		MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev,
379 			   nexthdrp, IPPROTO_ROUTING);
380 
381 #ifdef IPSEC
382 		if (!needipsec)
383 			goto skip_ipsec2;
384 
385 		/*
386 		 * pointers after IPsec headers are not valid any more.
387 		 * other pointers need a great care too.
388 		 * (IPsec routines should not mangle mbufs prior to AH/ESP)
389 		 */
390 		exthdrs.ip6e_dest2 = NULL;
391 
392 	    {
393 		struct ip6_rthdr *rh = NULL;
394 		int segleft_org = 0;
395 		struct ipsec_output_state state;
396 
397 		if (exthdrs.ip6e_rthdr) {
398 			rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
399 			segleft_org = rh->ip6r_segleft;
400 			rh->ip6r_segleft = 0;
401 		}
402 
403 		bzero(&state, sizeof(state));
404 		state.m = m;
405 		error = ipsec6_output_trans(&state, nexthdrp, mprev, sp, flags,
406 			&needipsectun);
407 		m = state.m;
408 		if (error) {
409 			/* mbuf is already reclaimed in ipsec6_output_trans. */
410 			m = NULL;
411 			switch (error) {
412 			case EHOSTUNREACH:
413 			case ENETUNREACH:
414 			case EMSGSIZE:
415 			case ENOBUFS:
416 			case ENOMEM:
417 				break;
418 			default:
419 				printf("ip6_output (ipsec): error code %d\n", error);
420 				/*fall through*/
421 			case ENOENT:
422 				/* don't show these error codes to the user */
423 				error = 0;
424 				break;
425 			}
426 			goto bad;
427 		}
428 		if (exthdrs.ip6e_rthdr) {
429 			/* ah6_output doesn't modify mbuf chain */
430 			rh->ip6r_segleft = segleft_org;
431 		}
432 	    }
433 skip_ipsec2:;
434 #endif
435 	}
436 
437 	/*
438 	 * If there is a routing header, replace destination address field
439 	 * with the first hop of the routing header.
440 	 */
441 	if (exthdrs.ip6e_rthdr) {
442 		struct ip6_rthdr *rh =
443 			(struct ip6_rthdr *)(mtod(exthdrs.ip6e_rthdr,
444 						  struct ip6_rthdr *));
445 		struct ip6_rthdr0 *rh0;
446 
447 		finaldst = ip6->ip6_dst;
448 		switch(rh->ip6r_type) {
449 		case IPV6_RTHDR_TYPE_0:
450 			 rh0 = (struct ip6_rthdr0 *)rh;
451 			 ip6->ip6_dst = rh0->ip6r0_addr[0];
452 			 bcopy((caddr_t)&rh0->ip6r0_addr[1],
453 				 (caddr_t)&rh0->ip6r0_addr[0],
454 				 sizeof(struct in6_addr)*(rh0->ip6r0_segleft - 1)
455 				 );
456 			 rh0->ip6r0_addr[rh0->ip6r0_segleft - 1] = finaldst;
457 			 break;
458 		default:	/* is it possible? */
459 			 error = EINVAL;
460 			 goto bad;
461 		}
462 	}
463 
464 	/* Source address validation */
465 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
466 	    (flags & IPV6_DADOUTPUT) == 0) {
467 		error = EOPNOTSUPP;
468 		ip6stat.ip6s_badscope++;
469 		goto bad;
470 	}
471 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
472 		error = EOPNOTSUPP;
473 		ip6stat.ip6s_badscope++;
474 		goto bad;
475 	}
476 
477 	ip6stat.ip6s_localout++;
478 
479 	/*
480 	 * Route packet.
481 	 */
482 	if (ro == 0) {
483 		ro = &ip6route;
484 		bzero((caddr_t)ro, sizeof(*ro));
485 	}
486 	ro_pmtu = ro;
487 	if (opt && opt->ip6po_rthdr)
488 		ro = &opt->ip6po_route;
489 	dst = (struct sockaddr_in6 *)&ro->ro_dst;
490 	/*
491 	 * If there is a cached route,
492 	 * check that it is to the same destination
493 	 * and is still up. If not, free it and try again.
494 	 */
495 	if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
496 			 !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst))) {
497 		RTFREE(ro->ro_rt);
498 		ro->ro_rt = (struct rtentry *)0;
499 	}
500 	if (ro->ro_rt == 0) {
501 		bzero(dst, sizeof(*dst));
502 		dst->sin6_family = AF_INET6;
503 		dst->sin6_len = sizeof(struct sockaddr_in6);
504 		dst->sin6_addr = ip6->ip6_dst;
505 	}
506 #ifdef IPSEC
507 	if (needipsec && needipsectun) {
508 		struct ipsec_output_state state;
509 
510 		/*
511 		 * All the extension headers will become inaccessible
512 		 * (since they can be encrypted).
513 		 * Don't panic, we need no more updates to extension headers
514 		 * on inner IPv6 packet (since they are now encapsulated).
515 		 *
516 		 * IPv6 [ESP|AH] IPv6 [extension headers] payload
517 		 */
518 		bzero(&exthdrs, sizeof(exthdrs));
519 		exthdrs.ip6e_ip6 = m;
520 
521 		bzero(&state, sizeof(state));
522 		state.m = m;
523 		state.ro = (struct route *)ro;
524 		state.dst = (struct sockaddr *)dst;
525 
526 		error = ipsec6_output_tunnel(&state, sp, flags);
527 
528 		m = state.m;
529 		ro = (struct route_in6 *)state.ro;
530 		dst = (struct sockaddr_in6 *)state.dst;
531 		if (error) {
532 			/* mbuf is already reclaimed in ipsec6_output_tunnel. */
533 			m0 = m = NULL;
534 			m = NULL;
535 			switch (error) {
536 			case EHOSTUNREACH:
537 			case ENETUNREACH:
538 			case EMSGSIZE:
539 			case ENOBUFS:
540 			case ENOMEM:
541 				break;
542 			default:
543 				printf("ip6_output (ipsec): error code %d\n", error);
544 				/*fall through*/
545 			case ENOENT:
546 				/* don't show these error codes to the user */
547 				error = 0;
548 				break;
549 			}
550 			goto bad;
551 		}
552 
553 		exthdrs.ip6e_ip6 = m;
554 	}
555 #endif /*IPESC*/
556 
557 	if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
558 		/* Unicast */
559 
560 #define ifatoia6(ifa)	((struct in6_ifaddr *)(ifa))
561 #define sin6tosa(sin6)	((struct sockaddr *)(sin6))
562 		/* xxx
563 		 * interface selection comes here
564 		 * if an interface is specified from an upper layer,
565 		 * ifp must point it.
566 		 */
567 		if (ro->ro_rt == 0) {
568 #if defined(__NetBSD__) || defined(__OpenBSD__)
569 			/*
570 			 * NetBSD/OpenBSD always clones routes, if parent is
571 			 * PRF_CLONING.
572 			 */
573 			rtalloc((struct route *)ro);
574 #else
575 			if (ro == &ip6route)	/* xxx kazu */
576 				rtalloc((struct route *)ro);
577 			else
578 				rtcalloc((struct route *)ro);
579 #endif
580 		}
581 		if (ro->ro_rt == 0) {
582 			ip6stat.ip6s_noroute++;
583 			error = EHOSTUNREACH;
584 			/* XXX in6_ifstat_inc(ifp, ifs6_out_discard); */
585 			goto bad;
586 		}
587 		ia = ifatoia6(ro->ro_rt->rt_ifa);
588 		ifp = ro->ro_rt->rt_ifp;
589 		ro->ro_rt->rt_use++;
590 		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
591 			dst = (struct sockaddr_in6 *)ro->ro_rt->rt_gateway;
592 		m->m_flags &= ~(M_BCAST | M_MCAST);	/* just in case */
593 
594 		in6_ifstat_inc(ifp, ifs6_out_request);
595 
596 		/*
597 		 * Check if there is the outgoing interface conflicts with
598 		 * the interface specified by ifi6_ifindex(if specified).
599 		 * Note that loopback interface is always okay.
600 		 * (this happens when we are sending packet toward my
601 		 * interface)
602 		 */
603 		if (opt && opt->ip6po_pktinfo
604 		 && opt->ip6po_pktinfo->ipi6_ifindex) {
605 			if (!(ifp->if_flags & IFF_LOOPBACK)
606 			 && ifp->if_index != opt->ip6po_pktinfo->ipi6_ifindex) {
607 				ip6stat.ip6s_noroute++;
608 				in6_ifstat_inc(ifp, ifs6_out_discard);
609 				error = EHOSTUNREACH;
610 				goto bad;
611 			}
612 		}
613 
614 		if (opt && opt->ip6po_hlim != -1)
615 			ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
616 	} else {
617 		/* Multicast */
618 		struct	in6_multi *in6m;
619 
620 		m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
621 
622 		/*
623 		 * See if the caller provided any multicast options
624 		 */
625 		ifp = NULL;
626 		if (im6o != NULL) {
627 			ip6->ip6_hlim = im6o->im6o_multicast_hlim;
628 			if (im6o->im6o_multicast_ifp != NULL)
629 				ifp = im6o->im6o_multicast_ifp;
630 		} else
631 			ip6->ip6_hlim = ip6_defmcasthlim;
632 
633 		/*
634 		 * See if the caller provided the outgoing interface
635 		 * as an ancillary data.
636 		 * Boundary check for ifindex is assumed to be already done.
637 		 */
638 		if (opt && opt->ip6po_pktinfo && opt->ip6po_pktinfo->ipi6_ifindex)
639 			ifp = ifindex2ifnet[opt->ip6po_pktinfo->ipi6_ifindex];
640 
641 		/*
642 		 * If the destination is a node-local scope multicast,
643 		 * the packet should be loop-backed only.
644 		 */
645 		if (IN6_IS_ADDR_MC_NODELOCAL(&ip6->ip6_dst)) {
646 			/*
647 			 * If the outgoing interface is already specified,
648 			 * it should be a loopback interface.
649 			 */
650 			if (ifp && (ifp->if_flags & IFF_LOOPBACK) == 0) {
651 				ip6stat.ip6s_badscope++;
652 				error = ENETUNREACH; /* XXX: better error? */
653 				/* XXX correct ifp? */
654 				in6_ifstat_inc(ifp, ifs6_out_discard);
655 				goto bad;
656 			}
657 			else {
658 #ifdef __bsdi__
659 				ifp = &loif;
660 #else
661 				ifp = &loif[0];
662 #endif
663 			}
664 		}
665 
666 		if (opt && opt->ip6po_hlim != -1)
667 			ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
668 
669 		/*
670 		 * If caller did not provide an interface lookup a
671 		 * default in the routing table.  This is either a
672 		 * default for the speicfied group (i.e. a host
673 		 * route), or a multicast default (a route for the
674 		 * ``net'' ff00::/8).
675 		 */
676 		if (ifp == NULL) {
677 			if (ro->ro_rt == 0) {
678 				ro->ro_rt = rtalloc1((struct sockaddr *)
679 						&ro->ro_dst, 0
680 #ifdef __FreeBSD__
681 						, 0UL
682 #endif
683 						);
684 			}
685 			if (ro->ro_rt == 0) {
686 				ip6stat.ip6s_noroute++;
687 				error = EHOSTUNREACH;
688 				/* XXX in6_ifstat_inc(ifp, ifs6_out_discard) */
689 				goto bad;
690 			}
691 			ia = ifatoia6(ro->ro_rt->rt_ifa);
692 			ifp = ro->ro_rt->rt_ifp;
693 			ro->ro_rt->rt_use++;
694 		}
695 
696 		if ((flags & IPV6_FORWARDING) == 0)
697 			in6_ifstat_inc(ifp, ifs6_out_request);
698 		in6_ifstat_inc(ifp, ifs6_out_mcast);
699 
700 		/*
701 		 * Confirm that the outgoing interface supports multicast.
702 		 */
703 		if ((ifp->if_flags & IFF_MULTICAST) == 0) {
704 			ip6stat.ip6s_noroute++;
705 			in6_ifstat_inc(ifp, ifs6_out_discard);
706 			error = ENETUNREACH;
707 			goto bad;
708 		}
709 		IN6_LOOKUP_MULTI(ip6->ip6_dst, ifp, in6m);
710 		if (in6m != NULL &&
711 		   (im6o == NULL || im6o->im6o_multicast_loop)) {
712 			/*
713 			 * If we belong to the destination multicast group
714 			 * on the outgoing interface, and the caller did not
715 			 * forbid loopback, loop back a copy.
716 			 */
717 			ip6_mloopback(ifp, m, dst);
718 		} else {
719 			/*
720 			 * If we are acting as a multicast router, perform
721 			 * multicast forwarding as if the packet had just
722 			 * arrived on the interface to which we are about
723 			 * to send.  The multicast forwarding function
724 			 * recursively calls this function, using the
725 			 * IPV6_FORWARDING flag to prevent infinite recursion.
726 			 *
727 			 * Multicasts that are looped back by ip6_mloopback(),
728 			 * above, will be forwarded by the ip6_input() routine,
729 			 * if necessary.
730 			 */
731 			if (ip6_mrouter && (flags & IPV6_FORWARDING) == 0) {
732 				if (ip6_mforward(ip6, ifp, m) != NULL) {
733 					m_freem(m);
734 					goto done;
735 				}
736 			}
737 		}
738 		/*
739 		 * Multicasts with a hoplimit of zero may be looped back,
740 		 * above, but must not be transmitted on a network.
741 		 * Also, multicasts addressed to the loopback interface
742 		 * are not sent -- the above call to ip6_mloopback() will
743 		 * loop back a copy if this host actually belongs to the
744 		 * destination group on the loopback interface.
745 		 */
746 		if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK)) {
747 			m_freem(m);
748 			goto done;
749 		}
750 	}
751 
752 	/*
753 	 * Fill the outgoing inteface to tell the upper layer
754 	 * to increment per-interface statistics.
755 	 */
756 	if (ifpp)
757 		*ifpp = ifp;
758 
759 	/*
760 	 * Determine path MTU.
761 	 */
762 	if (ro_pmtu != ro) {
763 		/* The first hop and the final destination may differ. */
764 		struct sockaddr_in6 *sin6_fin =
765 			(struct sockaddr_in6 *)&ro_pmtu->ro_dst;
766 		if (ro_pmtu->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
767 				       !IN6_ARE_ADDR_EQUAL(&sin6_fin->sin6_addr,
768 							   &finaldst))) {
769 			RTFREE(ro_pmtu->ro_rt);
770 			ro_pmtu->ro_rt = (struct rtentry *)0;
771 		}
772 		if (ro_pmtu->ro_rt == 0) {
773 			bzero(sin6_fin, sizeof(*sin6_fin));
774 			sin6_fin->sin6_family = AF_INET6;
775 			sin6_fin->sin6_len = sizeof(struct sockaddr_in6);
776 			sin6_fin->sin6_addr = finaldst;
777 
778 #ifdef __FreeBSD__
779 			rtcalloc((struct route *)ro_pmtu);
780 #else
781 			rtalloc((struct route *)ro_pmtu);
782 #endif
783 		}
784 	}
785 	if (ro_pmtu->ro_rt != NULL) {
786 		u_int32_t ifmtu = nd_ifinfo[ifp->if_index].linkmtu;
787 
788 		mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
789 		if (mtu > ifmtu) {
790 			/*
791 			 * The MTU on the route is larger than the MTU on
792 			 * the interface!  This shouldn't happen, unless the
793 			 * MTU of the interface has been changed after the
794 			 * interface was brought up.  Change the MTU in the
795 			 * route to match the interface MTU (as long as the
796 			 * field isn't locked).
797 			 */
798 			 mtu = ifmtu;
799 			 if ((ro_pmtu->ro_rt->rt_rmx.rmx_locks & RTV_MTU) == 0)
800 				 ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu; /* XXX */
801 		}
802 	} else {
803 		mtu = nd_ifinfo[ifp->if_index].linkmtu;
804 	}
805 
806 	/*
807 	 * Fake link-local scope-class addresses
808 	 */
809 	if ((ifp->if_flags & IFF_LOOPBACK) == 0) {
810 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
811 			ip6->ip6_src.s6_addr16[1] = 0;
812 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
813 			ip6->ip6_dst.s6_addr16[1] = 0;
814 	}
815 
816 	/*
817 	 * If the outgoing packet contains a hop-by-hop options header,
818 	 * it must be examined and processed even by the source node.
819 	 * (RFC 2460, section 4.)
820 	 */
821 	if (exthdrs.ip6e_hbh) {
822 		struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh,
823 					   struct ip6_hbh *);
824 		u_int32_t dummy1; /* XXX unused */
825 		u_int32_t dummy2; /* XXX unused */
826 
827 		/*
828 		 *  XXX: if we have to send an ICMPv6 error to the sender,
829 		 *       we need the M_LOOP flag since icmp6_error() expects
830 		 *       the IPv6 and the hop-by-hop options header are
831 		 *       continuous unless the flag is set.
832 		 */
833 		m->m_flags |= M_LOOP;
834 		m->m_pkthdr.rcvif = ifp;
835 		if (ip6_process_hopopts(m,
836 					(u_int8_t *)(hbh + 1),
837 					((hbh->ip6h_len + 1) << 3) -
838 					sizeof(struct ip6_hbh),
839 					&dummy1, &dummy2) < 0) {
840 			/* m was already freed at this point */
841 			error = EINVAL;/* better error? */
842 			goto done;
843 		}
844 		m->m_flags &= ~M_LOOP; /* XXX */
845 		m->m_pkthdr.rcvif = NULL;
846 	}
847 
848 	/*
849 	 * Send the packet to the outgoing interface.
850 	 * If necessary, do IPv6 fragmentation before sending.
851 	 */
852 	tlen = m->m_pkthdr.len;
853 	if (tlen <= mtu
854 #ifdef notyet
855 	    /*
856 	     * On any link that cannot convey a 1280-octet packet in one piece,
857 	     * link-specific fragmentation and reassembly must be provided at
858 	     * a layer below IPv6. [RFC 2460, sec.5]
859 	     * Thus if the interface has ability of link-level fragmentation,
860 	     * we can just send the packet even if the packet size is
861 	     * larger than the link's MTU.
862 	     * XXX: IFF_FRAGMENTABLE (or such) flag has not been defined yet...
863 	     */
864 
865 	    || ifp->if_flags & IFF_FRAGMENTABLE
866 #endif
867 	    )
868 	{
869 #if defined(__NetBSD__) && defined(IFA_STATS)
870 		if (IFA_STATS) {
871 			struct in6_ifaddr *ia6;
872 			ip6 = mtod(m, struct ip6_hdr *);
873 			ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
874 			if (ia6) {
875 				ia->ia_ifa.ifa_data.ifad_outbytes +=
876 					m->m_pkthdr.len;
877 			}
878 		}
879 #endif
880 #ifdef OLDIP6OUTPUT
881 		error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst,
882 					  ro->ro_rt);
883 #else
884 		error = nd6_output(ifp, m, dst, ro->ro_rt);
885 #endif
886 		goto done;
887 	} else if (mtu < IPV6_MMTU) {
888 		/*
889 		 * note that path MTU is never less than IPV6_MMTU
890 		 * (see icmp6_input).
891 		 */
892 		error = EMSGSIZE;
893 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
894 		goto bad;
895 	} else if (ip6->ip6_plen == 0) { /* jumbo payload cannot be fragmented */
896 		error = EMSGSIZE;
897 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
898 		goto bad;
899 	} else {
900 		struct mbuf **mnext, *m_frgpart;
901 		struct ip6_frag *ip6f;
902 		u_int32_t id = htonl(ip6_id++);
903 		u_char nextproto;
904 
905 		/*
906 		 * Too large for the destination or interface;
907 		 * fragment if possible.
908 		 * Must be able to put at least 8 bytes per fragment.
909 		 */
910 		hlen = unfragpartlen;
911 		if (mtu > IPV6_MAXPACKET)
912 			mtu = IPV6_MAXPACKET;
913 		len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
914 		if (len < 8) {
915 			error = EMSGSIZE;
916 			in6_ifstat_inc(ifp, ifs6_out_fragfail);
917 			goto bad;
918 		}
919 
920 		mnext = &m->m_nextpkt;
921 
922 		/*
923 		 * Change the next header field of the last header in the
924 		 * unfragmentable part.
925 		 */
926 		if (exthdrs.ip6e_rthdr) {
927 			nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
928 			*mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
929 		}
930 		else if (exthdrs.ip6e_dest1) {
931 			nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
932 			*mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
933 		}
934 		else if (exthdrs.ip6e_hbh) {
935 			nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
936 			*mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
937 		}
938 		else {
939 			nextproto = ip6->ip6_nxt;
940 			ip6->ip6_nxt = IPPROTO_FRAGMENT;
941 		}
942 
943 		/*
944 		 * Loop through length of segment after first fragment,
945 		 * make new header and copy data of each part and link onto chain.
946 		 */
947 		m0 = m;
948 		for (off = hlen; off < tlen; off += len) {
949 			MGETHDR(m, M_DONTWAIT, MT_HEADER);
950 			if (!m) {
951 				error = ENOBUFS;
952 				ip6stat.ip6s_odropped++;
953 				goto sendorfree;
954 			}
955 			m->m_flags = m0->m_flags & M_COPYFLAGS;
956 			*mnext = m;
957 			mnext = &m->m_nextpkt;
958 			m->m_data += max_linkhdr;
959 			mhip6 = mtod(m, struct ip6_hdr *);
960 			*mhip6 = *ip6;
961 			m->m_len = sizeof(*mhip6);
962  			error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
963  			if (error) {
964 				ip6stat.ip6s_odropped++;
965 				goto sendorfree;
966 			}
967 			ip6f->ip6f_offlg = htons((u_short)((off - hlen) & ~7));
968 			if (off + len >= tlen)
969 				len = tlen - off;
970 			else
971 				ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
972 			mhip6->ip6_plen = htons((u_short)(len + hlen +
973 							  sizeof(*ip6f) -
974 							  sizeof(struct ip6_hdr)));
975 			if ((m_frgpart = m_copy(m0, off, len)) == 0) {
976 				error = ENOBUFS;
977 				ip6stat.ip6s_odropped++;
978 				goto sendorfree;
979 			}
980 			m_cat(m, m_frgpart);
981 			m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
982 			m->m_pkthdr.rcvif = (struct ifnet *)0;
983 			ip6f->ip6f_reserved = 0;
984 			ip6f->ip6f_ident = id;
985 			ip6f->ip6f_nxt = nextproto;
986 			ip6stat.ip6s_ofragments++;
987 			in6_ifstat_inc(ifp, ifs6_out_fragcreat);
988 		}
989 
990 		in6_ifstat_inc(ifp, ifs6_out_fragok);
991 	}
992 
993 	/*
994 	 * Remove leading garbages.
995 	 */
996 sendorfree:
997 	m = m0->m_nextpkt;
998 	m0->m_nextpkt = 0;
999 	m_freem(m0);
1000 	for (m0 = m; m; m = m0) {
1001 		m0 = m->m_nextpkt;
1002 		m->m_nextpkt = 0;
1003 		if (error == 0) {
1004 #if defined(__NetBSD__) && defined(IFA_STATS)
1005 			if (IFA_STATS) {
1006 				struct in6_ifaddr *ia6;
1007 				ip6 = mtod(m, struct ip6_hdr *);
1008 				ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
1009 				if (ia6) {
1010 					ia->ia_ifa.ifa_data.ifad_outbytes +=
1011 						m->m_pkthdr.len;
1012 				}
1013 			}
1014 #endif
1015 #ifdef OLDIP6OUTPUT
1016 			error = (*ifp->if_output)(ifp, m,
1017 						  (struct sockaddr *)dst,
1018 						  ro->ro_rt);
1019 #else
1020 			error = nd6_output(ifp, m, dst, ro->ro_rt);
1021 #endif
1022 		}
1023 		else
1024 			m_freem(m);
1025 	}
1026 
1027 	if (error == 0)
1028 		ip6stat.ip6s_fragmented++;
1029 
1030 done:
1031 	if (ro == &ip6route && ro->ro_rt) { /* brace necessary for RTFREE */
1032 		RTFREE(ro->ro_rt);
1033 	} else if (ro_pmtu == &ip6route && ro_pmtu->ro_rt) {
1034 		RTFREE(ro_pmtu->ro_rt);
1035 	}
1036 
1037 #ifdef IPSEC
1038 	if (sp != NULL)
1039 		key_freesp(sp);
1040 #endif /* IPSEC */
1041 
1042 	return(error);
1043 
1044 freehdrs:
1045 	m_freem(exthdrs.ip6e_hbh);	/* m_freem will check if mbuf is 0 */
1046 	m_freem(exthdrs.ip6e_dest1);
1047 	m_freem(exthdrs.ip6e_rthdr);
1048 	m_freem(exthdrs.ip6e_dest2);
1049 	/* fall through */
1050 bad:
1051 	m_freem(m);
1052 	goto done;
1053 }
1054 
1055 static int
1056 ip6_copyexthdr(mp, hdr, hlen)
1057 	struct mbuf **mp;
1058 	caddr_t hdr;
1059 	int hlen;
1060 {
1061 	struct mbuf *m;
1062 
1063 	if (hlen > MCLBYTES)
1064 		return(ENOBUFS); /* XXX */
1065 
1066 	MGET(m, M_DONTWAIT, MT_DATA);
1067 	if (!m)
1068 		return(ENOBUFS);
1069 
1070 	if (hlen > MLEN) {
1071 		MCLGET(m, M_DONTWAIT);
1072 		if ((m->m_flags & M_EXT) == 0) {
1073 			m_free(m);
1074 			return(ENOBUFS);
1075 		}
1076 	}
1077 	m->m_len = hlen;
1078 	if (hdr)
1079 		bcopy(hdr, mtod(m, caddr_t), hlen);
1080 
1081 	*mp = m;
1082 	return(0);
1083 }
1084 
1085 /*
1086  * Insert jumbo payload option.
1087  */
1088 static int
1089 ip6_insert_jumboopt(exthdrs, plen)
1090 	struct ip6_exthdrs *exthdrs;
1091 	u_int32_t plen;
1092 {
1093 	struct mbuf *mopt;
1094 	u_char *optbuf;
1095 
1096 #define JUMBOOPTLEN	8	/* length of jumbo payload option and padding */
1097 
1098 	/*
1099 	 * If there is no hop-by-hop options header, allocate new one.
1100 	 * If there is one but it doesn't have enough space to store the
1101 	 * jumbo payload option, allocate a cluster to store the whole options.
1102 	 * Otherwise, use it to store the options.
1103 	 */
1104 	if (exthdrs->ip6e_hbh == 0) {
1105 		MGET(mopt, M_DONTWAIT, MT_DATA);
1106 		if (mopt == 0)
1107 			return(ENOBUFS);
1108 		mopt->m_len = JUMBOOPTLEN;
1109 		optbuf = mtod(mopt, u_char *);
1110 		optbuf[1] = 0;	/* = ((JUMBOOPTLEN) >> 3) - 1 */
1111 		exthdrs->ip6e_hbh = mopt;
1112 	}
1113 	else {
1114 		struct ip6_hbh *hbh;
1115 
1116 		mopt = exthdrs->ip6e_hbh;
1117 		if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
1118 			caddr_t oldoptp = mtod(mopt, caddr_t);
1119 			int oldoptlen = mopt->m_len;
1120 
1121 			if (mopt->m_flags & M_EXT)
1122 				return(ENOBUFS); /* XXX */
1123 			MCLGET(mopt, M_DONTWAIT);
1124 			if ((mopt->m_flags & M_EXT) == 0)
1125 				return(ENOBUFS);
1126 
1127 			bcopy(oldoptp, mtod(mopt, caddr_t), oldoptlen);
1128 			optbuf = mtod(mopt, caddr_t) + oldoptlen;
1129 			mopt->m_len = oldoptlen + JUMBOOPTLEN;
1130 		}
1131 		else {
1132 			optbuf = mtod(mopt, u_char *) + mopt->m_len;
1133 			mopt->m_len += JUMBOOPTLEN;
1134 		}
1135 		optbuf[0] = IP6OPT_PADN;
1136 		optbuf[1] = 1;
1137 
1138 		/*
1139 		 * Adjust the header length according to the pad and
1140 		 * the jumbo payload option.
1141 		 */
1142 		hbh = mtod(mopt, struct ip6_hbh *);
1143 		hbh->ip6h_len += (JUMBOOPTLEN >> 3);
1144 	}
1145 
1146 	/* fill in the option. */
1147 	optbuf[2] = IP6OPT_JUMBO;
1148 	optbuf[3] = 4;
1149 	*(u_int32_t *)&optbuf[4] = htonl(plen + JUMBOOPTLEN);
1150 
1151 	/* finally, adjust the packet header length */
1152 	exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
1153 
1154 	return(0);
1155 #undef JUMBOOPTLEN
1156 }
1157 
1158 /*
1159  * Insert fragment header and copy unfragmentable header portions.
1160  */
1161 static int
1162 ip6_insertfraghdr(m0, m, hlen, frghdrp)
1163 	struct mbuf *m0, *m;
1164 	int hlen;
1165 	struct ip6_frag **frghdrp;
1166 {
1167 	struct mbuf *n, *mlast;
1168 
1169 	if (hlen > sizeof(struct ip6_hdr)) {
1170 		n = m_copym(m0, sizeof(struct ip6_hdr),
1171 			    hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
1172 		if (n == 0)
1173 			return(ENOBUFS);
1174 		m->m_next = n;
1175 	}
1176 	else
1177 		n = m;
1178 
1179 	/* Search for the last mbuf of unfragmentable part. */
1180 	for (mlast = n; mlast->m_next; mlast = mlast->m_next)
1181 		;
1182 
1183 	if ((mlast->m_flags & M_EXT) == 0 &&
1184 	    M_TRAILINGSPACE(mlast) < sizeof(struct ip6_frag)) {
1185 		/* use the trailing space of the last mbuf for the fragment hdr */
1186 		*frghdrp =
1187 			(struct ip6_frag *)(mtod(mlast, caddr_t) + mlast->m_len);
1188 		mlast->m_len += sizeof(struct ip6_frag);
1189 		m->m_pkthdr.len += sizeof(struct ip6_frag);
1190 	}
1191 	else {
1192 		/* allocate a new mbuf for the fragment header */
1193 		struct mbuf *mfrg;
1194 
1195 		MGET(mfrg, M_DONTWAIT, MT_DATA);
1196 		if (mfrg == 0)
1197 			return(ENOBUFS);
1198 		mfrg->m_len = sizeof(struct ip6_frag);
1199 		*frghdrp = mtod(mfrg, struct ip6_frag *);
1200 		mlast->m_next = mfrg;
1201 	}
1202 
1203 	return(0);
1204 }
1205 
1206 /*
1207  * IP6 socket option processing.
1208  */
1209 int
1210 ip6_ctloutput(op, so, level, optname, mp)
1211 	int op;
1212 	struct socket *so;
1213 	int level, optname;
1214 	struct mbuf **mp;
1215 {
1216 	register struct in6pcb *in6p = sotoin6pcb(so);
1217 	register struct mbuf *m = *mp;
1218 	register int optval = 0;
1219 	int error = 0;
1220 	struct proc *p = curproc;	/* XXX */
1221 
1222 	if (level == IPPROTO_IPV6)
1223 		switch (op) {
1224 
1225 		case PRCO_SETOPT:
1226 			switch (optname) {
1227 			case IPV6_PKTOPTIONS:
1228 				return(ip6_pcbopts(&in6p->in6p_outputopts,
1229 						   m, so));
1230 			case IPV6_HOPOPTS:
1231 			case IPV6_DSTOPTS:
1232 				if (p == 0 || suser(p->p_ucred, &p->p_acflag)) {
1233 					error = EPERM;
1234 					break;
1235 				}
1236 				/* fall through */
1237 			case IPV6_UNICAST_HOPS:
1238 			case IPV6_RECVOPTS:
1239 			case IPV6_RECVRETOPTS:
1240 			case IPV6_RECVDSTADDR:
1241 			case IPV6_PKTINFO:
1242 			case IPV6_HOPLIMIT:
1243 			case IPV6_RTHDR:
1244 			case IPV6_CHECKSUM:
1245 			case IPV6_FAITH:
1246 				if (!m || m->m_len != sizeof(int))
1247 					error = EINVAL;
1248 				else {
1249 					optval = *mtod(m, int *);
1250 					switch (optname) {
1251 
1252 					case IPV6_UNICAST_HOPS:
1253 						if (optval < -1 || optval >= 256)
1254 							error = EINVAL;
1255 						else {
1256 							/* -1 = kernel default */
1257 							in6p->in6p_hops = optval;
1258 						}
1259 						break;
1260 #define OPTSET(bit) \
1261 	if (optval) \
1262 		in6p->in6p_flags |= bit; \
1263 	else \
1264 		in6p->in6p_flags &= ~bit;
1265 
1266 					case IPV6_RECVOPTS:
1267 						OPTSET(IN6P_RECVOPTS);
1268 						break;
1269 
1270 					case IPV6_RECVRETOPTS:
1271 						OPTSET(IN6P_RECVRETOPTS);
1272 						break;
1273 
1274 					case IPV6_RECVDSTADDR:
1275 						OPTSET(IN6P_RECVDSTADDR);
1276 						break;
1277 
1278 					case IPV6_PKTINFO:
1279 						OPTSET(IN6P_PKTINFO);
1280 						break;
1281 
1282 					case IPV6_HOPLIMIT:
1283 						OPTSET(IN6P_HOPLIMIT);
1284 						break;
1285 
1286 					case IPV6_HOPOPTS:
1287 						OPTSET(IN6P_HOPOPTS);
1288 						break;
1289 
1290 					case IPV6_DSTOPTS:
1291 						OPTSET(IN6P_DSTOPTS);
1292 						break;
1293 
1294 					case IPV6_RTHDR:
1295 						OPTSET(IN6P_RTHDR);
1296 						break;
1297 
1298 					case IPV6_CHECKSUM:
1299 						in6p->in6p_cksum = optval;
1300 						break;
1301 
1302 					case IPV6_FAITH:
1303 						OPTSET(IN6P_FAITH);
1304 						break;
1305 					}
1306 				}
1307 				break;
1308 #undef OPTSET
1309 
1310 			case IPV6_MULTICAST_IF:
1311 			case IPV6_MULTICAST_HOPS:
1312 			case IPV6_MULTICAST_LOOP:
1313 			case IPV6_JOIN_GROUP:
1314 			case IPV6_LEAVE_GROUP:
1315 				error =	ip6_setmoptions(optname, &in6p->in6p_moptions, m);
1316 				break;
1317 
1318 #ifdef IPSEC
1319 			case IPV6_IPSEC_POLICY:
1320 			    {
1321 				caddr_t req = NULL;
1322 				int len = 0;
1323 				int priv = 0;
1324 #ifdef __NetBSD__
1325 				if (p == 0 || suser(p->p_ucred, &p->p_acflag))
1326 					priv = 0;
1327 				else
1328 					priv = 1;
1329 #else
1330 				priv = (in6p->in6p_socket->so_state & SS_PRIV);
1331 #endif
1332 				if (m != 0) {
1333 					req = mtod(m, caddr_t);
1334 					len = m->m_len;
1335 				}
1336 				error = ipsec_set_policy(&in6p->in6p_sp,
1337 				                   optname, req, len,
1338 				                   priv);
1339 			    }
1340 				break;
1341 #endif /* IPSEC */
1342 
1343 			default:
1344 				error = ENOPROTOOPT;
1345 				break;
1346 			}
1347 			if (m)
1348 				(void)m_free(m);
1349 			break;
1350 
1351 		case PRCO_GETOPT:
1352 			switch (optname) {
1353 
1354 			case IPV6_OPTIONS:
1355 			case IPV6_RETOPTS:
1356 #if 0
1357 				*mp = m = m_get(M_WAIT, MT_SOOPTS);
1358 				if (in6p->in6p_options) {
1359 					m->m_len = in6p->in6p_options->m_len;
1360 					bcopy(mtod(in6p->in6p_options, caddr_t),
1361 					      mtod(m, caddr_t),
1362 					      (unsigned)m->m_len);
1363 				} else
1364 					m->m_len = 0;
1365 				break;
1366 #else
1367 				error = ENOPROTOOPT;
1368 				break;
1369 #endif
1370 
1371 			case IPV6_PKTOPTIONS:
1372 				if (in6p->in6p_options) {
1373 					*mp = m_copym(in6p->in6p_options, 0,
1374 						      M_COPYALL, M_WAIT);
1375 				} else {
1376 					*mp = m_get(M_WAIT, MT_SOOPTS);
1377 					(*mp)->m_len = 0;
1378 				}
1379 				break;
1380 
1381 			case IPV6_HOPOPTS:
1382 			case IPV6_DSTOPTS:
1383 				if (p == 0 || suser(p->p_ucred, &p->p_acflag)) {
1384 					error = EPERM;
1385 					break;
1386 				}
1387 				/* fall through */
1388 			case IPV6_UNICAST_HOPS:
1389 			case IPV6_RECVOPTS:
1390 			case IPV6_RECVRETOPTS:
1391 			case IPV6_RECVDSTADDR:
1392 			case IPV6_PKTINFO:
1393 			case IPV6_HOPLIMIT:
1394 			case IPV6_RTHDR:
1395 			case IPV6_CHECKSUM:
1396 			case IPV6_FAITH:
1397 				*mp = m = m_get(M_WAIT, MT_SOOPTS);
1398 				m->m_len = sizeof(int);
1399 				switch (optname) {
1400 
1401 				case IPV6_UNICAST_HOPS:
1402 					optval = in6p->in6p_hops;
1403 					break;
1404 
1405 #define OPTBIT(bit) (in6p->in6p_flags & bit ? 1 : 0)
1406 
1407 				case IPV6_RECVOPTS:
1408 					optval = OPTBIT(IN6P_RECVOPTS);
1409 					break;
1410 
1411 				case IPV6_RECVRETOPTS:
1412 					optval = OPTBIT(IN6P_RECVRETOPTS);
1413 					break;
1414 
1415 				case IPV6_RECVDSTADDR:
1416 					optval = OPTBIT(IN6P_RECVDSTADDR);
1417 					break;
1418 
1419 				case IPV6_PKTINFO:
1420 					optval = OPTBIT(IN6P_PKTINFO);
1421 					break;
1422 
1423 				case IPV6_HOPLIMIT:
1424 					optval = OPTBIT(IN6P_HOPLIMIT);
1425 					break;
1426 
1427 				case IPV6_HOPOPTS:
1428 					optval = OPTBIT(IN6P_HOPOPTS);
1429 					break;
1430 
1431 				case IPV6_DSTOPTS:
1432 					optval = OPTBIT(IN6P_DSTOPTS);
1433 					break;
1434 
1435 				case IPV6_RTHDR:
1436 					optval = OPTBIT(IN6P_RTHDR);
1437 					break;
1438 
1439 				case IPV6_CHECKSUM:
1440 					optval = in6p->in6p_cksum;
1441 					break;
1442 
1443 				case IPV6_FAITH:
1444 					optval = OPTBIT(IN6P_FAITH);
1445 					break;
1446 				}
1447 				*mtod(m, int *) = optval;
1448 				break;
1449 
1450 			case IPV6_MULTICAST_IF:
1451 			case IPV6_MULTICAST_HOPS:
1452 			case IPV6_MULTICAST_LOOP:
1453 			case IPV6_JOIN_GROUP:
1454 			case IPV6_LEAVE_GROUP:
1455 				error = ip6_getmoptions(optname, in6p->in6p_moptions, mp);
1456 				break;
1457 
1458 #ifdef IPSEC
1459 			case IPV6_IPSEC_POLICY:
1460 				error = ipsec_get_policy(in6p->in6p_sp, mp);
1461 				break;
1462 #endif /* IPSEC */
1463 
1464 			default:
1465 				error = ENOPROTOOPT;
1466 				break;
1467 			}
1468 			break;
1469 		}
1470 	else {
1471 		error = EINVAL;
1472 		if (op == PRCO_SETOPT && *mp)
1473 			(void)m_free(*mp);
1474 	}
1475 	return(error);
1476 }
1477 
1478 /*
1479  * Set up IP6 options in pcb for insertion in output packets.
1480  * Store in mbuf with pointer in pcbopt, adding pseudo-option
1481  * with destination address if source routed.
1482  */
1483 static int
1484 ip6_pcbopts(pktopt, m, so)
1485 	struct ip6_pktopts **pktopt;
1486 	register struct mbuf *m;
1487 	struct socket *so;
1488 {
1489 	register struct ip6_pktopts *opt = *pktopt;
1490 	int error = 0;
1491 	struct proc *p = curproc;	/* XXX */
1492 	int priv = 0;
1493 
1494 	/* turn off any old options. */
1495 	if (opt) {
1496 		if (opt->ip6po_m)
1497 			(void)m_free(opt->ip6po_m);
1498 	}
1499 	else
1500 		opt = malloc(sizeof(*opt), M_IP6OPT, M_WAITOK);
1501 	*pktopt = 0;
1502 
1503 	if (!m || m->m_len == 0) {
1504 		/*
1505 		 * Only turning off any previous options.
1506 		 */
1507 		if (opt)
1508 			free(opt, M_IP6OPT);
1509 		if (m)
1510 			(void)m_free(m);
1511 		return(0);
1512 	}
1513 
1514 	/*  set options specified by user. */
1515 	if (p && !suser(p->p_ucred, &p->p_acflag))
1516 		priv = 1;
1517 	if ((error = ip6_setpktoptions(m, opt, priv)) != 0) {
1518 		(void)m_free(m);
1519 		return(error);
1520 	}
1521 	*pktopt = opt;
1522 	return(0);
1523 }
1524 
1525 /*
1526  * Set the IP6 multicast options in response to user setsockopt().
1527  */
1528 static int
1529 ip6_setmoptions(optname, im6op, m)
1530 	int optname;
1531 	struct ip6_moptions **im6op;
1532 	struct mbuf *m;
1533 {
1534 	int error = 0;
1535 	u_int loop, ifindex;
1536 	struct ipv6_mreq *mreq;
1537 	struct ifnet *ifp;
1538 	struct ip6_moptions *im6o = *im6op;
1539 	struct route_in6 ro;
1540 	struct sockaddr_in6 *dst;
1541 	struct in6_multi_mship *imm;
1542 	struct proc *p = curproc;	/* XXX */
1543 
1544 	if (im6o == NULL) {
1545 		/*
1546 		 * No multicast option buffer attached to the pcb;
1547 		 * allocate one and initialize to default values.
1548 		 */
1549 		im6o = (struct ip6_moptions *)
1550 			malloc(sizeof(*im6o), M_IPMOPTS, M_WAITOK);
1551 
1552 		if (im6o == NULL)
1553 			return(ENOBUFS);
1554 		*im6op = im6o;
1555 		im6o->im6o_multicast_ifp = NULL;
1556 		im6o->im6o_multicast_hlim = ip6_defmcasthlim;
1557 		im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
1558 		LIST_INIT(&im6o->im6o_memberships);
1559 	}
1560 
1561 	switch (optname) {
1562 
1563 	case IPV6_MULTICAST_IF:
1564 		/*
1565 		 * Select the interface for outgoing multicast packets.
1566 		 */
1567 		if (m == NULL || m->m_len != sizeof(u_int)) {
1568 			error = EINVAL;
1569 			break;
1570 		}
1571 		ifindex = *(mtod(m, u_int *));
1572 		if (ifindex < 0 || if_index < ifindex) {
1573 			error = ENXIO;	/* XXX EINVAL? */
1574 			break;
1575 		}
1576 		ifp = ifindex2ifnet[ifindex];
1577 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1578 			error = EADDRNOTAVAIL;
1579 			break;
1580 		}
1581 		im6o->im6o_multicast_ifp = ifp;
1582 		break;
1583 
1584 	case IPV6_MULTICAST_HOPS:
1585 	    {
1586 		/*
1587 		 * Set the IP6 hoplimit for outgoing multicast packets.
1588 		 */
1589 		int optval;
1590 		if (m == NULL || m->m_len != sizeof(int)) {
1591 			error = EINVAL;
1592 			break;
1593 		}
1594 		optval = *(mtod(m, u_int *));
1595 		if (optval < -1 || optval >= 256)
1596 			error = EINVAL;
1597 		else if (optval == -1)
1598 			im6o->im6o_multicast_hlim = ip6_defmcasthlim;
1599 		else
1600 			im6o->im6o_multicast_hlim = optval;
1601 		break;
1602 	    }
1603 
1604 	case IPV6_MULTICAST_LOOP:
1605 		/*
1606 		 * Set the loopback flag for outgoing multicast packets.
1607 		 * Must be zero or one.
1608 		 */
1609 		if (m == NULL || m->m_len != sizeof(u_int) ||
1610 		   (loop = *(mtod(m, u_int *))) > 1) {
1611 			error = EINVAL;
1612 			break;
1613 		}
1614 		im6o->im6o_multicast_loop = loop;
1615 		break;
1616 
1617 	case IPV6_JOIN_GROUP:
1618 		/*
1619 		 * Add a multicast group membership.
1620 		 * Group must be a valid IP6 multicast address.
1621 		 */
1622 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
1623 			error = EINVAL;
1624 			break;
1625 		}
1626 		mreq = mtod(m, struct ipv6_mreq *);
1627 		if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
1628 			/*
1629 			 * We use the unspecified address to specify to accept
1630 			 * all multicast addresses. Only super user is allowed
1631 			 * to do this.
1632 			 */
1633 			if (suser(p->p_ucred, &p->p_acflag)) {
1634 				error = EACCES;
1635 				break;
1636 			}
1637 		} else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
1638 			error = EINVAL;
1639 			break;
1640 		}
1641 
1642 		/*
1643 		 * If the interface is specified, validate it.
1644 		 */
1645 		if (mreq->ipv6mr_interface < 0
1646 		 || if_index < mreq->ipv6mr_interface) {
1647 			error = ENXIO;	/* XXX EINVAL? */
1648 			break;
1649 		}
1650 		/*
1651 		 * If no interface was explicitly specified, choose an
1652 		 * appropriate one according to the given multicast address.
1653 		 */
1654 		if (mreq->ipv6mr_interface == 0) {
1655 			/*
1656 			 * If the multicast address is in node-local scope,
1657 			 * the interface should be a loopback interface.
1658 			 * Otherwise, look up the routing table for the
1659 			 * address, and choose the outgoing interface.
1660 			 *   XXX: is it a good approach?
1661 			 */
1662 			if (IN6_IS_ADDR_MC_NODELOCAL(&mreq->ipv6mr_multiaddr)) {
1663 #ifdef __bsdi__
1664 				ifp = &loif;
1665 #else
1666 				ifp = &loif[0];
1667 #endif
1668 			}
1669 			else {
1670 				ro.ro_rt = NULL;
1671 				dst = (struct sockaddr_in6 *)&ro.ro_dst;
1672 				bzero(dst, sizeof(*dst));
1673 				dst->sin6_len = sizeof(struct sockaddr_in6);
1674 				dst->sin6_family = AF_INET6;
1675 				dst->sin6_addr = mreq->ipv6mr_multiaddr;
1676 				rtalloc((struct route *)&ro);
1677 				if (ro.ro_rt == NULL) {
1678 					error = EADDRNOTAVAIL;
1679 					break;
1680 				}
1681 				ifp = ro.ro_rt->rt_ifp;
1682 				rtfree(ro.ro_rt);
1683 			}
1684 		} else
1685 			ifp = ifindex2ifnet[mreq->ipv6mr_interface];
1686 
1687 		/*
1688 		 * See if we found an interface, and confirm that it
1689 		 * supports multicast
1690 		 */
1691 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1692 			error = EADDRNOTAVAIL;
1693 			break;
1694 		}
1695 		/*
1696 		 * Put interface index into the multicast address,
1697 		 * if the address has link-local scope.
1698 		 */
1699 		if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
1700 			mreq->ipv6mr_multiaddr.s6_addr16[1]
1701 				= htons(mreq->ipv6mr_interface);
1702 		}
1703 		/*
1704 		 * See if the membership already exists.
1705 		 */
1706 		for (imm = im6o->im6o_memberships.lh_first;
1707 		     imm != NULL; imm = imm->i6mm_chain.le_next)
1708 			if (imm->i6mm_maddr->in6m_ifp == ifp &&
1709 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
1710 					       &mreq->ipv6mr_multiaddr))
1711 				break;
1712 		if (imm != NULL) {
1713 			error = EADDRINUSE;
1714 			break;
1715 		}
1716 		/*
1717 		 * Everything looks good; add a new record to the multicast
1718 		 * address list for the given interface.
1719 		 */
1720 		imm = malloc(sizeof(*imm), M_IPMADDR, M_WAITOK);
1721 		if (imm == NULL) {
1722 			error = ENOBUFS;
1723 			break;
1724 		}
1725 		if ((imm->i6mm_maddr =
1726 		     in6_addmulti(&mreq->ipv6mr_multiaddr, ifp, &error)) == NULL) {
1727 			free(imm, M_IPMADDR);
1728 			break;
1729 		}
1730 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
1731 		break;
1732 
1733 	case IPV6_LEAVE_GROUP:
1734 		/*
1735 		 * Drop a multicast group membership.
1736 		 * Group must be a valid IP6 multicast address.
1737 		 */
1738 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
1739 			error = EINVAL;
1740 			break;
1741 		}
1742 		mreq = mtod(m, struct ipv6_mreq *);
1743 		if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
1744 			if (suser(p->p_ucred, &p->p_acflag)) {
1745 				error = EACCES;
1746 				break;
1747 			}
1748 		} else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
1749 			error = EINVAL;
1750 			break;
1751 		}
1752 		/*
1753 		 * If an interface address was specified, get a pointer
1754 		 * to its ifnet structure.
1755 		 */
1756 		if (mreq->ipv6mr_interface < 0
1757 		 || if_index < mreq->ipv6mr_interface) {
1758 			error = ENXIO;	/* XXX EINVAL? */
1759 			break;
1760 		}
1761 		ifp = ifindex2ifnet[mreq->ipv6mr_interface];
1762 		/*
1763 		 * Put interface index into the multicast address,
1764 		 * if the address has link-local scope.
1765 		 */
1766 		if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
1767 			mreq->ipv6mr_multiaddr.s6_addr16[1]
1768 				= htons(mreq->ipv6mr_interface);
1769 		}
1770 		/*
1771 		 * Find the membership in the membership list.
1772 		 */
1773 		for (imm = im6o->im6o_memberships.lh_first;
1774 		     imm != NULL; imm = imm->i6mm_chain.le_next) {
1775 			if ((ifp == NULL ||
1776 			     imm->i6mm_maddr->in6m_ifp == ifp) &&
1777 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
1778 					       &mreq->ipv6mr_multiaddr))
1779 				break;
1780 		}
1781 		if (imm == NULL) {
1782 			/* Unable to resolve interface */
1783 			error = EADDRNOTAVAIL;
1784 			break;
1785 		}
1786 		/*
1787 		 * Give up the multicast address record to which the
1788 		 * membership points.
1789 		 */
1790 		LIST_REMOVE(imm, i6mm_chain);
1791 		in6_delmulti(imm->i6mm_maddr);
1792 		free(imm, M_IPMADDR);
1793 		break;
1794 
1795 	default:
1796 		error = EOPNOTSUPP;
1797 		break;
1798 	}
1799 
1800 	/*
1801 	 * If all options have default values, no need to keep the mbuf.
1802 	 */
1803 	if (im6o->im6o_multicast_ifp == NULL &&
1804 	    im6o->im6o_multicast_hlim == ip6_defmcasthlim &&
1805 	    im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
1806 	    im6o->im6o_memberships.lh_first == NULL) {
1807 		free(*im6op, M_IPMOPTS);
1808 		*im6op = NULL;
1809 	}
1810 
1811 	return(error);
1812 }
1813 
1814 /*
1815  * Return the IP6 multicast options in response to user getsockopt().
1816  */
1817 static int
1818 ip6_getmoptions(optname, im6o, mp)
1819 	int optname;
1820 	register struct ip6_moptions *im6o;
1821 	register struct mbuf **mp;
1822 {
1823 	u_int *hlim, *loop, *ifindex;
1824 
1825 	*mp = m_get(M_WAIT, MT_SOOPTS);
1826 
1827 	switch (optname) {
1828 
1829 	case IPV6_MULTICAST_IF:
1830 		ifindex = mtod(*mp, u_int *);
1831 		(*mp)->m_len = sizeof(u_int);
1832 		if (im6o == NULL || im6o->im6o_multicast_ifp == NULL)
1833 			*ifindex = 0;
1834 		else
1835 			*ifindex = im6o->im6o_multicast_ifp->if_index;
1836 		return(0);
1837 
1838 	case IPV6_MULTICAST_HOPS:
1839 		hlim = mtod(*mp, u_int *);
1840 		(*mp)->m_len = sizeof(u_int);
1841 		if (im6o == NULL)
1842 			*hlim = ip6_defmcasthlim;
1843 		else
1844 			*hlim = im6o->im6o_multicast_hlim;
1845 		return(0);
1846 
1847 	case IPV6_MULTICAST_LOOP:
1848 		loop = mtod(*mp, u_int *);
1849 		(*mp)->m_len = sizeof(u_int);
1850 		if (im6o == NULL)
1851 			*loop = ip6_defmcasthlim;
1852 		else
1853 			*loop = im6o->im6o_multicast_loop;
1854 		return(0);
1855 
1856 	default:
1857 		return(EOPNOTSUPP);
1858 	}
1859 }
1860 
1861 /*
1862  * Discard the IP6 multicast options.
1863  */
1864 void
1865 ip6_freemoptions(im6o)
1866 	register struct ip6_moptions *im6o;
1867 {
1868 	struct in6_multi_mship *imm;
1869 
1870 	if (im6o == NULL)
1871 		return;
1872 
1873 	while ((imm = im6o->im6o_memberships.lh_first) != NULL) {
1874 		LIST_REMOVE(imm, i6mm_chain);
1875 		if (imm->i6mm_maddr)
1876 			in6_delmulti(imm->i6mm_maddr);
1877 		free(imm, M_IPMADDR);
1878 	}
1879 	free(im6o, M_IPMOPTS);
1880 }
1881 
1882 /*
1883  * Set IPv6 outgoing packet options based on advanced API.
1884  */
1885 int
1886 ip6_setpktoptions(control, opt, priv)
1887 	struct mbuf *control;
1888 	struct ip6_pktopts *opt;
1889 	int priv;
1890 {
1891 	register struct cmsghdr *cm = 0;
1892 
1893 	if (control == 0 || opt == 0)
1894 		return(EINVAL);
1895 
1896 	bzero(opt, sizeof(*opt));
1897 	opt->ip6po_hlim = -1; /* -1 means to use default hop limit */
1898 
1899 	/*
1900 	 * XXX: Currently, we assume all the optional information is stored
1901 	 * in a single mbuf.
1902 	 */
1903 	if (control->m_next)
1904 		return(EINVAL);
1905 
1906 	opt->ip6po_m = control;
1907 
1908 	for (; control->m_len; control->m_data += CMSG_ALIGN(cm->cmsg_len),
1909 		     control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
1910 		cm = mtod(control, struct cmsghdr *);
1911 		if (cm->cmsg_len == 0 || cm->cmsg_len > control->m_len)
1912 			return(EINVAL);
1913 		if (cm->cmsg_level != IPPROTO_IPV6)
1914 			continue;
1915 
1916 		switch(cm->cmsg_type) {
1917 		case IPV6_PKTINFO:
1918 			if (cm->cmsg_len != CMSG_LEN(sizeof(struct in6_pktinfo)))
1919 				return(EINVAL);
1920 			opt->ip6po_pktinfo = (struct in6_pktinfo *)CMSG_DATA(cm);
1921 			if (opt->ip6po_pktinfo->ipi6_ifindex &&
1922 			    IN6_IS_ADDR_LINKLOCAL(&opt->ip6po_pktinfo->ipi6_addr))
1923 				opt->ip6po_pktinfo->ipi6_addr.s6_addr16[1] =
1924 					htons(opt->ip6po_pktinfo->ipi6_ifindex);
1925 
1926 			if (opt->ip6po_pktinfo->ipi6_ifindex > if_index
1927 			 || opt->ip6po_pktinfo->ipi6_ifindex < 0) {
1928 				return(ENXIO);
1929 			}
1930 
1931 			if (!IN6_IS_ADDR_UNSPECIFIED(&opt->ip6po_pktinfo->ipi6_addr)) {
1932 				struct ifaddr *ia;
1933 				struct sockaddr_in6 sin6;
1934 
1935 				bzero(&sin6, sizeof(sin6));
1936 				sin6.sin6_len = sizeof(sin6);
1937 				sin6.sin6_family = AF_INET6;
1938 				sin6.sin6_addr =
1939 					opt->ip6po_pktinfo->ipi6_addr;
1940 				ia = ifa_ifwithaddr(sin6tosa(&sin6));
1941 				if (ia == NULL ||
1942 				    (opt->ip6po_pktinfo->ipi6_ifindex &&
1943 				     (ia->ifa_ifp->if_index !=
1944 				      opt->ip6po_pktinfo->ipi6_ifindex))) {
1945 					return(EADDRNOTAVAIL);
1946 				}
1947 				/*
1948 				 * Check if the requested source address is
1949 				 * indeed a unicast address assigned to the
1950 				 * node.
1951 				 */
1952 				if (IN6_IS_ADDR_MULTICAST(&opt->ip6po_pktinfo->ipi6_addr))
1953 					return(EADDRNOTAVAIL);
1954 			}
1955 			break;
1956 
1957 		case IPV6_HOPLIMIT:
1958 			if (cm->cmsg_len != CMSG_LEN(sizeof(int)))
1959 				return(EINVAL);
1960 
1961 			opt->ip6po_hlim = *(int *)CMSG_DATA(cm);
1962 			if (opt->ip6po_hlim < -1 || opt->ip6po_hlim > 255)
1963 				return(EINVAL);
1964 			break;
1965 
1966 		case IPV6_NEXTHOP:
1967 			if (!priv)
1968 				return(EPERM);
1969 			if (cm->cmsg_len < sizeof(u_char) ||
1970 			    cm->cmsg_len < CMSG_LEN(*CMSG_DATA(cm)))
1971 				return(EINVAL);
1972 
1973 			opt->ip6po_nexthop = (struct sockaddr *)CMSG_DATA(cm);
1974 
1975 			break;
1976 
1977 		case IPV6_HOPOPTS:
1978 			if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_hbh)))
1979 				return(EINVAL);
1980 			opt->ip6po_hbh = (struct ip6_hbh *)CMSG_DATA(cm);
1981 			if (cm->cmsg_len !=
1982 			    CMSG_LEN((opt->ip6po_hbh->ip6h_len + 1) << 3))
1983 				return(EINVAL);
1984 			break;
1985 
1986 		case IPV6_DSTOPTS:
1987 			if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_dest)))
1988 				return(EINVAL);
1989 
1990 			/*
1991 			 * If there is no routing header yet, the destination
1992 			 * options header should be put on the 1st part.
1993 			 * Otherwise, the header should be on the 2nd part.
1994 			 * (See RFC 2460, section 4.1)
1995 			 */
1996 			if (opt->ip6po_rthdr == NULL) {
1997 				opt->ip6po_dest1 =
1998 					(struct ip6_dest *)CMSG_DATA(cm);
1999 				if (cm->cmsg_len !=
2000 				    CMSG_LEN((opt->ip6po_dest1->ip6d_len + 1)
2001 					     << 3))
2002 					return(EINVAL);
2003 			}
2004 			else {
2005 				opt->ip6po_dest2 =
2006 					(struct ip6_dest *)CMSG_DATA(cm);
2007 				if (cm->cmsg_len !=
2008 				    CMSG_LEN((opt->ip6po_dest2->ip6d_len + 1)
2009 					     << 3))
2010 					return(EINVAL);
2011 			}
2012 			break;
2013 
2014 		case IPV6_RTHDR:
2015 			if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_rthdr)))
2016 				return(EINVAL);
2017 			opt->ip6po_rthdr = (struct ip6_rthdr *)CMSG_DATA(cm);
2018 			if (cm->cmsg_len !=
2019 			    CMSG_LEN((opt->ip6po_rthdr->ip6r_len + 1) << 3))
2020 				return(EINVAL);
2021 			switch(opt->ip6po_rthdr->ip6r_type) {
2022 			case IPV6_RTHDR_TYPE_0:
2023 				if (opt->ip6po_rthdr->ip6r_segleft == 0)
2024 					return(EINVAL);
2025 				break;
2026 			default:
2027 				return(EINVAL);
2028 			}
2029 			break;
2030 
2031 		default:
2032 			return(ENOPROTOOPT);
2033 		}
2034 	}
2035 
2036 	return(0);
2037 }
2038 
2039 /*
2040  * Routine called from ip6_output() to loop back a copy of an IP6 multicast
2041  * packet to the input queue of a specified interface.  Note that this
2042  * calls the output routine of the loopback "driver", but with an interface
2043  * pointer that might NOT be &loif -- easier than replicating that code here.
2044  */
2045 void
2046 ip6_mloopback(ifp, m, dst)
2047 	struct ifnet *ifp;
2048 	register struct mbuf *m;
2049 	register struct sockaddr_in6 *dst;
2050 {
2051 	struct	mbuf *copym;
2052 
2053 	copym = m_copy(m, 0, M_COPYALL);
2054 	if (copym != NULL)
2055 		(void)looutput(ifp, copym, (struct sockaddr *)dst, NULL);
2056 }
2057 
2058 /*
2059  * Chop IPv6 header off from the payload.
2060  */
2061 static int
2062 ip6_splithdr(m, exthdrs)
2063 	struct mbuf *m;
2064 	struct ip6_exthdrs *exthdrs;
2065 {
2066 	struct mbuf *mh;
2067 	struct ip6_hdr *ip6;
2068 
2069 	ip6 = mtod(m, struct ip6_hdr *);
2070 	if (m->m_len > sizeof(*ip6)) {
2071 		MGETHDR(mh, M_DONTWAIT, MT_HEADER);
2072 		if (mh == 0) {
2073 			m_freem(m);
2074 			return ENOBUFS;
2075 		}
2076 		M_COPY_PKTHDR(mh, m);
2077 		MH_ALIGN(mh, sizeof(*ip6));
2078 		m->m_flags &= ~M_PKTHDR;
2079 		m->m_len -= sizeof(*ip6);
2080 		m->m_data += sizeof(*ip6);
2081 		mh->m_next = m;
2082 		m = mh;
2083 		m->m_len = sizeof(*ip6);
2084 		bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof(*ip6));
2085 	}
2086 	exthdrs->ip6e_ip6 = m;
2087 	return 0;
2088 }
2089 
2090 /*
2091  * Compute IPv6 extension header length.
2092  */
2093 int
2094 ip6_optlen(in6p)
2095 	struct in6pcb *in6p;
2096 {
2097 	int len;
2098 
2099 	if (!in6p->in6p_outputopts)
2100 		return 0;
2101 
2102 	len = 0;
2103 #define elen(x) \
2104     (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
2105 
2106 	len += elen(in6p->in6p_outputopts->ip6po_hbh);
2107 	len += elen(in6p->in6p_outputopts->ip6po_dest1);
2108 	len += elen(in6p->in6p_outputopts->ip6po_rthdr);
2109 	len += elen(in6p->in6p_outputopts->ip6po_dest2);
2110 	return len;
2111 #undef elen
2112 }
2113