xref: /netbsd-src/sys/netinet6/ip6_output.c (revision f89f6560d453f5e37386cc7938c072d2f528b9fa)
1 /*	$NetBSD: ip6_output.c,v 1.163 2015/02/02 03:14:02 christos Exp $	*/
2 /*	$KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1990, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
62  */
63 
64 #include <sys/cdefs.h>
65 __KERNEL_RCSID(0, "$NetBSD: ip6_output.c,v 1.163 2015/02/02 03:14:02 christos Exp $");
66 
67 #include "opt_inet.h"
68 #include "opt_inet6.h"
69 #include "opt_ipsec.h"
70 
71 #include <sys/param.h>
72 #include <sys/malloc.h>
73 #include <sys/mbuf.h>
74 #include <sys/errno.h>
75 #include <sys/protosw.h>
76 #include <sys/socket.h>
77 #include <sys/socketvar.h>
78 #include <sys/systm.h>
79 #include <sys/proc.h>
80 #include <sys/kauth.h>
81 
82 #include <net/if.h>
83 #include <net/route.h>
84 #include <net/pfil.h>
85 
86 #include <netinet/in.h>
87 #include <netinet/in_var.h>
88 #include <netinet/ip6.h>
89 #include <netinet/ip_var.h>
90 #include <netinet/icmp6.h>
91 #include <netinet/in_offload.h>
92 #include <netinet/portalgo.h>
93 #include <netinet6/in6_offload.h>
94 #include <netinet6/ip6_var.h>
95 #include <netinet6/ip6_private.h>
96 #include <netinet6/in6_pcb.h>
97 #include <netinet6/nd6.h>
98 #include <netinet6/ip6protosw.h>
99 #include <netinet6/scope6_var.h>
100 
101 #ifdef IPSEC
102 #include <netipsec/ipsec.h>
103 #include <netipsec/ipsec6.h>
104 #include <netipsec/key.h>
105 #include <netipsec/xform.h>
106 #endif
107 
108 
109 #include <net/net_osdep.h>
110 
111 extern pfil_head_t *inet6_pfil_hook;	/* XXX */
112 
113 struct ip6_exthdrs {
114 	struct mbuf *ip6e_ip6;
115 	struct mbuf *ip6e_hbh;
116 	struct mbuf *ip6e_dest1;
117 	struct mbuf *ip6e_rthdr;
118 	struct mbuf *ip6e_dest2;
119 };
120 
121 static int ip6_pcbopt(int, u_char *, int, struct ip6_pktopts **,
122 	kauth_cred_t, int);
123 static int ip6_getpcbopt(struct ip6_pktopts *, int, struct sockopt *);
124 static int ip6_setpktopt(int, u_char *, int, struct ip6_pktopts *, kauth_cred_t,
125 	int, int, int);
126 static int ip6_setmoptions(const struct sockopt *, struct in6pcb *);
127 static int ip6_getmoptions(struct sockopt *, struct in6pcb *);
128 static int ip6_copyexthdr(struct mbuf **, void *, int);
129 static int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
130 	struct ip6_frag **);
131 static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
132 static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
133 static int ip6_getpmtu(struct route *, struct route *, struct ifnet *,
134     const struct in6_addr *, u_long *, int *);
135 static int copypktopts(struct ip6_pktopts *, struct ip6_pktopts *, int);
136 
137 #ifdef RFC2292
138 static int ip6_pcbopts(struct ip6_pktopts **, struct socket *, struct sockopt *);
139 #endif
140 
141 /*
142  * IP6 output. The packet in mbuf chain m contains a skeletal IP6
143  * header (with pri, len, nxt, hlim, src, dst).
144  * This function may modify ver and hlim only.
145  * The mbuf chain containing the packet will be freed.
146  * The mbuf opt, if present, will not be freed.
147  *
148  * type of "mtu": rt_rmx.rmx_mtu is u_long, ifnet.ifr_mtu is int, and
149  * nd_ifinfo.linkmtu is u_int32_t.  so we use u_long to hold largest one,
150  * which is rt_rmx.rmx_mtu.
151  */
152 int
153 ip6_output(
154     struct mbuf *m0,
155     struct ip6_pktopts *opt,
156     struct route *ro,
157     int flags,
158     struct ip6_moptions *im6o,
159     struct socket *so,
160     struct ifnet **ifpp		/* XXX: just for statistics */
161 )
162 {
163 	struct ip6_hdr *ip6, *mhip6;
164 	struct ifnet *ifp, *origifp;
165 	struct mbuf *m = m0;
166 	int hlen, tlen, len, off;
167 	bool tso;
168 	struct route ip6route;
169 	struct rtentry *rt = NULL;
170 	const struct sockaddr_in6 *dst = NULL;
171 	struct sockaddr_in6 src_sa, dst_sa;
172 	int error = 0;
173 	struct in6_ifaddr *ia = NULL;
174 	u_long mtu;
175 	int alwaysfrag, dontfrag;
176 	u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
177 	struct ip6_exthdrs exthdrs;
178 	struct in6_addr finaldst, src0, dst0;
179 	u_int32_t zone;
180 	struct route *ro_pmtu = NULL;
181 	int hdrsplit = 0;
182 	int needipsec = 0;
183 #ifdef IPSEC
184 	struct secpolicy *sp = NULL;
185 #endif
186 
187 	memset(&ip6route, 0, sizeof(ip6route));
188 
189 #ifdef  DIAGNOSTIC
190 	if ((m->m_flags & M_PKTHDR) == 0)
191 		panic("ip6_output: no HDR");
192 
193 	if ((m->m_pkthdr.csum_flags &
194 	    (M_CSUM_TCPv4|M_CSUM_UDPv4|M_CSUM_TSOv4)) != 0) {
195 		panic("ip6_output: IPv4 checksum offload flags: %d",
196 		    m->m_pkthdr.csum_flags);
197 	}
198 
199 	if ((m->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) ==
200 	    (M_CSUM_TCPv6|M_CSUM_UDPv6)) {
201 		panic("ip6_output: conflicting checksum offload flags: %d",
202 		    m->m_pkthdr.csum_flags);
203 	}
204 #endif
205 
206 	M_CSUM_DATA_IPv6_HL_SET(m->m_pkthdr.csum_data, sizeof(struct ip6_hdr));
207 
208 #define MAKE_EXTHDR(hp, mp)						\
209     do {								\
210 	if (hp) {							\
211 		struct ip6_ext *eh = (struct ip6_ext *)(hp);		\
212 		error = ip6_copyexthdr((mp), (void *)(hp), 		\
213 		    ((eh)->ip6e_len + 1) << 3);				\
214 		if (error)						\
215 			goto freehdrs;					\
216 	}								\
217     } while (/*CONSTCOND*/ 0)
218 
219 	memset(&exthdrs, 0, sizeof(exthdrs));
220 	if (opt) {
221 		/* Hop-by-Hop options header */
222 		MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
223 		/* Destination options header(1st part) */
224 		MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
225 		/* Routing header */
226 		MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
227 		/* Destination options header(2nd part) */
228 		MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
229 	}
230 
231 	/*
232 	 * Calculate the total length of the extension header chain.
233 	 * Keep the length of the unfragmentable part for fragmentation.
234 	 */
235 	optlen = 0;
236 	if (exthdrs.ip6e_hbh) optlen += exthdrs.ip6e_hbh->m_len;
237 	if (exthdrs.ip6e_dest1) optlen += exthdrs.ip6e_dest1->m_len;
238 	if (exthdrs.ip6e_rthdr) optlen += exthdrs.ip6e_rthdr->m_len;
239 	unfragpartlen = optlen + sizeof(struct ip6_hdr);
240 	/* NOTE: we don't add AH/ESP length here. do that later. */
241 	if (exthdrs.ip6e_dest2) optlen += exthdrs.ip6e_dest2->m_len;
242 
243 #ifdef IPSEC
244 	if (ipsec_used) {
245 		/* Check the security policy (SP) for the packet */
246 
247 		sp = ipsec6_check_policy(m, so, flags, &needipsec, &error);
248 		if (error != 0) {
249 			/*
250 			 * Hack: -EINVAL is used to signal that a packet
251 			 * should be silently discarded.  This is typically
252 			 * because we asked key management for an SA and
253 			 * it was delayed (e.g. kicked up to IKE).
254 			 */
255 			if (error == -EINVAL)
256 				error = 0;
257 			goto freehdrs;
258 		}
259 	}
260 #endif /* IPSEC */
261 
262 
263 	if (needipsec &&
264 	    (m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0) {
265 		in6_delayed_cksum(m);
266 		m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
267 	}
268 
269 
270 	/*
271 	 * If we need IPsec, or there is at least one extension header,
272 	 * separate IP6 header from the payload.
273 	 */
274 	if ((needipsec || optlen) && !hdrsplit) {
275 		if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
276 			m = NULL;
277 			goto freehdrs;
278 		}
279 		m = exthdrs.ip6e_ip6;
280 		hdrsplit++;
281 	}
282 
283 	/* adjust pointer */
284 	ip6 = mtod(m, struct ip6_hdr *);
285 
286 	/* adjust mbuf packet header length */
287 	m->m_pkthdr.len += optlen;
288 	plen = m->m_pkthdr.len - sizeof(*ip6);
289 
290 	/* If this is a jumbo payload, insert a jumbo payload option. */
291 	if (plen > IPV6_MAXPACKET) {
292 		if (!hdrsplit) {
293 			if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
294 				m = NULL;
295 				goto freehdrs;
296 			}
297 			m = exthdrs.ip6e_ip6;
298 			hdrsplit++;
299 		}
300 		/* adjust pointer */
301 		ip6 = mtod(m, struct ip6_hdr *);
302 		if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
303 			goto freehdrs;
304 		optlen += 8; /* XXX JUMBOOPTLEN */
305 		ip6->ip6_plen = 0;
306 	} else
307 		ip6->ip6_plen = htons(plen);
308 
309 	/*
310 	 * Concatenate headers and fill in next header fields.
311 	 * Here we have, on "m"
312 	 *	IPv6 payload
313 	 * and we insert headers accordingly.  Finally, we should be getting:
314 	 *	IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
315 	 *
316 	 * during the header composing process, "m" points to IPv6 header.
317 	 * "mprev" points to an extension header prior to esp.
318 	 */
319 	{
320 		u_char *nexthdrp = &ip6->ip6_nxt;
321 		struct mbuf *mprev = m;
322 
323 		/*
324 		 * we treat dest2 specially.  this makes IPsec processing
325 		 * much easier.  the goal here is to make mprev point the
326 		 * mbuf prior to dest2.
327 		 *
328 		 * result: IPv6 dest2 payload
329 		 * m and mprev will point to IPv6 header.
330 		 */
331 		if (exthdrs.ip6e_dest2) {
332 			if (!hdrsplit)
333 				panic("assumption failed: hdr not split");
334 			exthdrs.ip6e_dest2->m_next = m->m_next;
335 			m->m_next = exthdrs.ip6e_dest2;
336 			*mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
337 			ip6->ip6_nxt = IPPROTO_DSTOPTS;
338 		}
339 
340 #define MAKE_CHAIN(m, mp, p, i)\
341     do {\
342 	if (m) {\
343 		if (!hdrsplit) \
344 			panic("assumption failed: hdr not split"); \
345 		*mtod((m), u_char *) = *(p);\
346 		*(p) = (i);\
347 		p = mtod((m), u_char *);\
348 		(m)->m_next = (mp)->m_next;\
349 		(mp)->m_next = (m);\
350 		(mp) = (m);\
351 	}\
352     } while (/*CONSTCOND*/ 0)
353 		/*
354 		 * result: IPv6 hbh dest1 rthdr dest2 payload
355 		 * m will point to IPv6 header.  mprev will point to the
356 		 * extension header prior to dest2 (rthdr in the above case).
357 		 */
358 		MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
359 		MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp,
360 		    IPPROTO_DSTOPTS);
361 		MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp,
362 		    IPPROTO_ROUTING);
363 
364 		M_CSUM_DATA_IPv6_HL_SET(m->m_pkthdr.csum_data,
365 		    sizeof(struct ip6_hdr) + optlen);
366 	}
367 
368 	/*
369 	 * If there is a routing header, replace destination address field
370 	 * with the first hop of the routing header.
371 	 */
372 	if (exthdrs.ip6e_rthdr) {
373 		struct ip6_rthdr *rh;
374 		struct ip6_rthdr0 *rh0;
375 		struct in6_addr *addr;
376 		struct sockaddr_in6 sa;
377 
378 		rh = (struct ip6_rthdr *)(mtod(exthdrs.ip6e_rthdr,
379 		    struct ip6_rthdr *));
380 		finaldst = ip6->ip6_dst;
381 		switch (rh->ip6r_type) {
382 		case IPV6_RTHDR_TYPE_0:
383 			 rh0 = (struct ip6_rthdr0 *)rh;
384 			 addr = (struct in6_addr *)(rh0 + 1);
385 
386 			 /*
387 			  * construct a sockaddr_in6 form of
388 			  * the first hop.
389 			  *
390 			  * XXX: we may not have enough
391 			  * information about its scope zone;
392 			  * there is no standard API to pass
393 			  * the information from the
394 			  * application.
395 			  */
396 			 sockaddr_in6_init(&sa, addr, 0, 0, 0);
397 			 if ((error = sa6_embedscope(&sa,
398 			     ip6_use_defzone)) != 0) {
399 				 goto bad;
400 			 }
401 			 ip6->ip6_dst = sa.sin6_addr;
402 			 (void)memmove(&addr[0], &addr[1],
403 			     sizeof(struct in6_addr) *
404 			     (rh0->ip6r0_segleft - 1));
405 			 addr[rh0->ip6r0_segleft - 1] = finaldst;
406 			 /* XXX */
407 			 in6_clearscope(addr + rh0->ip6r0_segleft - 1);
408 			 break;
409 		default:	/* is it possible? */
410 			 error = EINVAL;
411 			 goto bad;
412 		}
413 	}
414 
415 	/* Source address validation */
416 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
417 	    (flags & IPV6_UNSPECSRC) == 0) {
418 		error = EOPNOTSUPP;
419 		IP6_STATINC(IP6_STAT_BADSCOPE);
420 		goto bad;
421 	}
422 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
423 		error = EOPNOTSUPP;
424 		IP6_STATINC(IP6_STAT_BADSCOPE);
425 		goto bad;
426 	}
427 
428 	IP6_STATINC(IP6_STAT_LOCALOUT);
429 
430 	/*
431 	 * Route packet.
432 	 */
433 	/* initialize cached route */
434 	if (ro == NULL) {
435 		ro = &ip6route;
436 	}
437 	ro_pmtu = ro;
438 	if (opt && opt->ip6po_rthdr)
439 		ro = &opt->ip6po_route;
440 
441  	/*
442 	 * if specified, try to fill in the traffic class field.
443 	 * do not override if a non-zero value is already set.
444 	 * we check the diffserv field and the ecn field separately.
445 	 */
446 	if (opt && opt->ip6po_tclass >= 0) {
447 		int mask = 0;
448 
449 		if ((ip6->ip6_flow & htonl(0xfc << 20)) == 0)
450 			mask |= 0xfc;
451 		if ((ip6->ip6_flow & htonl(0x03 << 20)) == 0)
452 			mask |= 0x03;
453 		if (mask != 0)
454 			ip6->ip6_flow |= htonl((opt->ip6po_tclass & mask) << 20);
455 	}
456 
457 	/* fill in or override the hop limit field, if necessary. */
458 	if (opt && opt->ip6po_hlim != -1)
459 		ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
460 	else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
461 		if (im6o != NULL)
462 			ip6->ip6_hlim = im6o->im6o_multicast_hlim;
463 		else
464 			ip6->ip6_hlim = ip6_defmcasthlim;
465 	}
466 
467 #ifdef IPSEC
468 	if (needipsec) {
469 		int s = splsoftnet();
470 		error = ipsec6_process_packet(m, sp->req);
471 
472 		/*
473 		 * Preserve KAME behaviour: ENOENT can be returned
474 		 * when an SA acquire is in progress.  Don't propagate
475 		 * this to user-level; it confuses applications.
476 		 * XXX this will go away when the SADB is redone.
477 		 */
478 		if (error == ENOENT)
479 			error = 0;
480 		splx(s);
481 		goto done;
482 	}
483 #endif /* IPSEC */
484 
485 	/* adjust pointer */
486 	ip6 = mtod(m, struct ip6_hdr *);
487 
488 	sockaddr_in6_init(&dst_sa, &ip6->ip6_dst, 0, 0, 0);
489 	if ((error = in6_selectroute(&dst_sa, opt, im6o, ro,
490 	    &ifp, &rt, 0)) != 0) {
491 		if (ifp != NULL)
492 			in6_ifstat_inc(ifp, ifs6_out_discard);
493 		goto bad;
494 	}
495 	if (rt == NULL) {
496 		/*
497 		 * If in6_selectroute() does not return a route entry,
498 		 * dst may not have been updated.
499 		 */
500 		error = rtcache_setdst(ro, sin6tosa(&dst_sa));
501 		if (error) {
502 			goto bad;
503 		}
504 	}
505 
506 	/*
507 	 * then rt (for unicast) and ifp must be non-NULL valid values.
508 	 */
509 	if ((flags & IPV6_FORWARDING) == 0) {
510 		/* XXX: the FORWARDING flag can be set for mrouting. */
511 		in6_ifstat_inc(ifp, ifs6_out_request);
512 	}
513 	if (rt != NULL) {
514 		ia = (struct in6_ifaddr *)(rt->rt_ifa);
515 		rt->rt_use++;
516 	}
517 
518 	/*
519 	 * The outgoing interface must be in the zone of source and
520 	 * destination addresses.  We should use ia_ifp to support the
521 	 * case of sending packets to an address of our own.
522 	 */
523 	if (ia != NULL && ia->ia_ifp)
524 		origifp = ia->ia_ifp;
525 	else
526 		origifp = ifp;
527 
528 	src0 = ip6->ip6_src;
529 	if (in6_setscope(&src0, origifp, &zone))
530 		goto badscope;
531 	sockaddr_in6_init(&src_sa, &ip6->ip6_src, 0, 0, 0);
532 	if (sa6_recoverscope(&src_sa) || zone != src_sa.sin6_scope_id)
533 		goto badscope;
534 
535 	dst0 = ip6->ip6_dst;
536 	if (in6_setscope(&dst0, origifp, &zone))
537 		goto badscope;
538 	/* re-initialize to be sure */
539 	sockaddr_in6_init(&dst_sa, &ip6->ip6_dst, 0, 0, 0);
540 	if (sa6_recoverscope(&dst_sa) || zone != dst_sa.sin6_scope_id)
541 		goto badscope;
542 
543 	/* scope check is done. */
544 
545 	if (rt == NULL || IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
546 		if (dst == NULL)
547 			dst = satocsin6(rtcache_getdst(ro));
548 		KASSERT(dst != NULL);
549 	} else if (opt && rtcache_validate(&opt->ip6po_nextroute) != NULL) {
550 		/*
551 		 * The nexthop is explicitly specified by the
552 		 * application.  We assume the next hop is an IPv6
553 		 * address.
554 		 */
555 		dst = (struct sockaddr_in6 *)opt->ip6po_nexthop;
556 	} else if ((rt->rt_flags & RTF_GATEWAY))
557 		dst = (struct sockaddr_in6 *)rt->rt_gateway;
558 	else if (dst == NULL)
559 		dst = satocsin6(rtcache_getdst(ro));
560 
561 	/*
562 	 * XXXXXX: original code follows:
563 	 */
564 	if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
565 		m->m_flags &= ~(M_BCAST | M_MCAST);	/* just in case */
566 	else {
567 		struct	in6_multi *in6m;
568 
569 		m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
570 
571 		in6_ifstat_inc(ifp, ifs6_out_mcast);
572 
573 		/*
574 		 * Confirm that the outgoing interface supports multicast.
575 		 */
576 		if (!(ifp->if_flags & IFF_MULTICAST)) {
577 			IP6_STATINC(IP6_STAT_NOROUTE);
578 			in6_ifstat_inc(ifp, ifs6_out_discard);
579 			error = ENETUNREACH;
580 			goto bad;
581 		}
582 
583 		IN6_LOOKUP_MULTI(ip6->ip6_dst, ifp, in6m);
584 		if (in6m != NULL &&
585 		   (im6o == NULL || im6o->im6o_multicast_loop)) {
586 			/*
587 			 * If we belong to the destination multicast group
588 			 * on the outgoing interface, and the caller did not
589 			 * forbid loopback, loop back a copy.
590 			 */
591 			KASSERT(dst != NULL);
592 			ip6_mloopback(ifp, m, dst);
593 		} else {
594 			/*
595 			 * If we are acting as a multicast router, perform
596 			 * multicast forwarding as if the packet had just
597 			 * arrived on the interface to which we are about
598 			 * to send.  The multicast forwarding function
599 			 * recursively calls this function, using the
600 			 * IPV6_FORWARDING flag to prevent infinite recursion.
601 			 *
602 			 * Multicasts that are looped back by ip6_mloopback(),
603 			 * above, will be forwarded by the ip6_input() routine,
604 			 * if necessary.
605 			 */
606 			if (ip6_mrouter && (flags & IPV6_FORWARDING) == 0) {
607 				if (ip6_mforward(ip6, ifp, m) != 0) {
608 					m_freem(m);
609 					goto done;
610 				}
611 			}
612 		}
613 		/*
614 		 * Multicasts with a hoplimit of zero may be looped back,
615 		 * above, but must not be transmitted on a network.
616 		 * Also, multicasts addressed to the loopback interface
617 		 * are not sent -- the above call to ip6_mloopback() will
618 		 * loop back a copy if this host actually belongs to the
619 		 * destination group on the loopback interface.
620 		 */
621 		if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK) ||
622 		    IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst)) {
623 			m_freem(m);
624 			goto done;
625 		}
626 	}
627 
628 	/*
629 	 * Fill the outgoing inteface to tell the upper layer
630 	 * to increment per-interface statistics.
631 	 */
632 	if (ifpp)
633 		*ifpp = ifp;
634 
635 	/* Determine path MTU. */
636 	if ((error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, &mtu,
637 	    &alwaysfrag)) != 0)
638 		goto bad;
639 
640 	/*
641 	 * The caller of this function may specify to use the minimum MTU
642 	 * in some cases.
643 	 * An advanced API option (IPV6_USE_MIN_MTU) can also override MTU
644 	 * setting.  The logic is a bit complicated; by default, unicast
645 	 * packets will follow path MTU while multicast packets will be sent at
646 	 * the minimum MTU.  If IP6PO_MINMTU_ALL is specified, all packets
647 	 * including unicast ones will be sent at the minimum MTU.  Multicast
648 	 * packets will always be sent at the minimum MTU unless
649 	 * IP6PO_MINMTU_DISABLE is explicitly specified.
650 	 * See RFC 3542 for more details.
651 	 */
652 	if (mtu > IPV6_MMTU) {
653 		if ((flags & IPV6_MINMTU))
654 			mtu = IPV6_MMTU;
655 		else if (opt && opt->ip6po_minmtu == IP6PO_MINMTU_ALL)
656 			mtu = IPV6_MMTU;
657 		else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
658 			 (opt == NULL ||
659 			  opt->ip6po_minmtu != IP6PO_MINMTU_DISABLE)) {
660 			mtu = IPV6_MMTU;
661 		}
662 	}
663 
664 	/*
665 	 * clear embedded scope identifiers if necessary.
666 	 * in6_clearscope will touch the addresses only when necessary.
667 	 */
668 	in6_clearscope(&ip6->ip6_src);
669 	in6_clearscope(&ip6->ip6_dst);
670 
671 	/*
672 	 * If the outgoing packet contains a hop-by-hop options header,
673 	 * it must be examined and processed even by the source node.
674 	 * (RFC 2460, section 4.)
675 	 */
676 	if (ip6->ip6_nxt == IPV6_HOPOPTS) {
677 		u_int32_t dummy1; /* XXX unused */
678 		u_int32_t dummy2; /* XXX unused */
679 		int hoff = sizeof(struct ip6_hdr);
680 
681 		if (ip6_hopopts_input(&dummy1, &dummy2, &m, &hoff)) {
682 			/* m was already freed at this point */
683 			error = EINVAL;/* better error? */
684 			goto done;
685 		}
686 
687 		ip6 = mtod(m, struct ip6_hdr *);
688 	}
689 
690 	/*
691 	 * Run through list of hooks for output packets.
692 	 */
693 	if ((error = pfil_run_hooks(inet6_pfil_hook, &m, ifp, PFIL_OUT)) != 0)
694 		goto done;
695 	if (m == NULL)
696 		goto done;
697 	ip6 = mtod(m, struct ip6_hdr *);
698 
699 	/*
700 	 * Send the packet to the outgoing interface.
701 	 * If necessary, do IPv6 fragmentation before sending.
702 	 *
703 	 * the logic here is rather complex:
704 	 * 1: normal case (dontfrag == 0, alwaysfrag == 0)
705 	 * 1-a:	send as is if tlen <= path mtu
706 	 * 1-b:	fragment if tlen > path mtu
707 	 *
708 	 * 2: if user asks us not to fragment (dontfrag == 1)
709 	 * 2-a:	send as is if tlen <= interface mtu
710 	 * 2-b:	error if tlen > interface mtu
711 	 *
712 	 * 3: if we always need to attach fragment header (alwaysfrag == 1)
713 	 *	always fragment
714 	 *
715 	 * 4: if dontfrag == 1 && alwaysfrag == 1
716 	 *	error, as we cannot handle this conflicting request
717 	 */
718 	tlen = m->m_pkthdr.len;
719 	tso = (m->m_pkthdr.csum_flags & M_CSUM_TSOv6) != 0;
720 	if (opt && (opt->ip6po_flags & IP6PO_DONTFRAG))
721 		dontfrag = 1;
722 	else
723 		dontfrag = 0;
724 
725 	if (dontfrag && alwaysfrag) {	/* case 4 */
726 		/* conflicting request - can't transmit */
727 		error = EMSGSIZE;
728 		goto bad;
729 	}
730 	if (dontfrag && (!tso && tlen > IN6_LINKMTU(ifp))) {	/* case 2-b */
731 		/*
732 		 * Even if the DONTFRAG option is specified, we cannot send the
733 		 * packet when the data length is larger than the MTU of the
734 		 * outgoing interface.
735 		 * Notify the error by sending IPV6_PATHMTU ancillary data as
736 		 * well as returning an error code (the latter is not described
737 		 * in the API spec.)
738 		 */
739 		u_int32_t mtu32;
740 		struct ip6ctlparam ip6cp;
741 
742 		mtu32 = (u_int32_t)mtu;
743 		memset(&ip6cp, 0, sizeof(ip6cp));
744 		ip6cp.ip6c_cmdarg = (void *)&mtu32;
745 		pfctlinput2(PRC_MSGSIZE,
746 		    rtcache_getdst(ro_pmtu), &ip6cp);
747 
748 		error = EMSGSIZE;
749 		goto bad;
750 	}
751 
752 	/*
753 	 * transmit packet without fragmentation
754 	 */
755 	if (dontfrag || (!alwaysfrag && (tlen <= mtu || tso))) {
756 		/* case 1-a and 2-a */
757 		struct in6_ifaddr *ia6;
758 		int sw_csum;
759 
760 		ip6 = mtod(m, struct ip6_hdr *);
761 		ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
762 		if (ia6) {
763 			/* Record statistics for this interface address. */
764 			ia6->ia_ifa.ifa_data.ifad_outbytes += m->m_pkthdr.len;
765 		}
766 
767 		sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_csum_flags_tx;
768 		if ((sw_csum & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0) {
769 			if (IN6_NEED_CHECKSUM(ifp,
770 			    sw_csum & (M_CSUM_UDPv6|M_CSUM_TCPv6))) {
771 				in6_delayed_cksum(m);
772 			}
773 			m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
774 		}
775 
776 		KASSERT(dst != NULL);
777 		if (__predict_true(!tso ||
778 		    (ifp->if_capenable & IFCAP_TSOv6) != 0)) {
779 			error = nd6_output(ifp, origifp, m, dst, rt);
780 		} else {
781 			error = ip6_tso_output(ifp, origifp, m, dst, rt);
782 		}
783 		goto done;
784 	}
785 
786 	if (tso) {
787 		error = EINVAL; /* XXX */
788 		goto bad;
789 	}
790 
791 	/*
792 	 * try to fragment the packet.  case 1-b and 3
793 	 */
794 	if (mtu < IPV6_MMTU) {
795 		/* path MTU cannot be less than IPV6_MMTU */
796 		error = EMSGSIZE;
797 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
798 		goto bad;
799 	} else if (ip6->ip6_plen == 0) {
800 		/* jumbo payload cannot be fragmented */
801 		error = EMSGSIZE;
802 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
803 		goto bad;
804 	} else {
805 		struct mbuf **mnext, *m_frgpart;
806 		struct ip6_frag *ip6f;
807 		u_int32_t id = htonl(ip6_randomid());
808 		u_char nextproto;
809 #if 0				/* see below */
810 		struct ip6ctlparam ip6cp;
811 		u_int32_t mtu32;
812 #endif
813 
814 		/*
815 		 * Too large for the destination or interface;
816 		 * fragment if possible.
817 		 * Must be able to put at least 8 bytes per fragment.
818 		 */
819 		hlen = unfragpartlen;
820 		if (mtu > IPV6_MAXPACKET)
821 			mtu = IPV6_MAXPACKET;
822 
823 #if 0
824 		/*
825 		 * It is believed this code is a leftover from the
826 		 * development of the IPV6_RECVPATHMTU sockopt and
827 		 * associated work to implement RFC3542.
828 		 * It's not entirely clear what the intent of the API
829 		 * is at this point, so disable this code for now.
830 		 * The IPV6_RECVPATHMTU sockopt and/or IPV6_DONTFRAG
831 		 * will send notifications if the application requests.
832 		 */
833 
834 		/* Notify a proper path MTU to applications. */
835 		mtu32 = (u_int32_t)mtu;
836 		memset(&ip6cp, 0, sizeof(ip6cp));
837 		ip6cp.ip6c_cmdarg = (void *)&mtu32;
838 		pfctlinput2(PRC_MSGSIZE,
839 		    rtcache_getdst(ro_pmtu), &ip6cp);
840 #endif
841 
842 		len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
843 		if (len < 8) {
844 			error = EMSGSIZE;
845 			in6_ifstat_inc(ifp, ifs6_out_fragfail);
846 			goto bad;
847 		}
848 
849 		mnext = &m->m_nextpkt;
850 
851 		/*
852 		 * Change the next header field of the last header in the
853 		 * unfragmentable part.
854 		 */
855 		if (exthdrs.ip6e_rthdr) {
856 			nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
857 			*mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
858 		} else if (exthdrs.ip6e_dest1) {
859 			nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
860 			*mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
861 		} else if (exthdrs.ip6e_hbh) {
862 			nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
863 			*mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
864 		} else {
865 			nextproto = ip6->ip6_nxt;
866 			ip6->ip6_nxt = IPPROTO_FRAGMENT;
867 		}
868 
869 		if ((m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6))
870 		    != 0) {
871 			if (IN6_NEED_CHECKSUM(ifp,
872 			    m->m_pkthdr.csum_flags &
873 			    (M_CSUM_UDPv6|M_CSUM_TCPv6))) {
874 				in6_delayed_cksum(m);
875 			}
876 			m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
877 		}
878 
879 		/*
880 		 * Loop through length of segment after first fragment,
881 		 * make new header and copy data of each part and link onto
882 		 * chain.
883 		 */
884 		m0 = m;
885 		for (off = hlen; off < tlen; off += len) {
886 			struct mbuf *mlast;
887 
888 			MGETHDR(m, M_DONTWAIT, MT_HEADER);
889 			if (!m) {
890 				error = ENOBUFS;
891 				IP6_STATINC(IP6_STAT_ODROPPED);
892 				goto sendorfree;
893 			}
894 			m->m_pkthdr.rcvif = NULL;
895 			m->m_flags = m0->m_flags & M_COPYFLAGS;
896 			*mnext = m;
897 			mnext = &m->m_nextpkt;
898 			m->m_data += max_linkhdr;
899 			mhip6 = mtod(m, struct ip6_hdr *);
900 			*mhip6 = *ip6;
901 			m->m_len = sizeof(*mhip6);
902 			/*
903 			 * ip6f must be valid if error is 0.  But how
904 			 * can a compiler be expected to infer this?
905 			 */
906 			ip6f = NULL;
907 			error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
908 			if (error) {
909 				IP6_STATINC(IP6_STAT_ODROPPED);
910 				goto sendorfree;
911 			}
912 			ip6f->ip6f_offlg = htons((u_int16_t)((off - hlen) & ~7));
913 			if (off + len >= tlen)
914 				len = tlen - off;
915 			else
916 				ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
917 			mhip6->ip6_plen = htons((u_int16_t)(len + hlen +
918 			    sizeof(*ip6f) - sizeof(struct ip6_hdr)));
919 			if ((m_frgpart = m_copy(m0, off, len)) == 0) {
920 				error = ENOBUFS;
921 				IP6_STATINC(IP6_STAT_ODROPPED);
922 				goto sendorfree;
923 			}
924 			for (mlast = m; mlast->m_next; mlast = mlast->m_next)
925 				;
926 			mlast->m_next = m_frgpart;
927 			m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
928 			m->m_pkthdr.rcvif = NULL;
929 			ip6f->ip6f_reserved = 0;
930 			ip6f->ip6f_ident = id;
931 			ip6f->ip6f_nxt = nextproto;
932 			IP6_STATINC(IP6_STAT_OFRAGMENTS);
933 			in6_ifstat_inc(ifp, ifs6_out_fragcreat);
934 		}
935 
936 		in6_ifstat_inc(ifp, ifs6_out_fragok);
937 	}
938 
939 	/*
940 	 * Remove leading garbages.
941 	 */
942 sendorfree:
943 	m = m0->m_nextpkt;
944 	m0->m_nextpkt = 0;
945 	m_freem(m0);
946 	for (m0 = m; m; m = m0) {
947 		m0 = m->m_nextpkt;
948 		m->m_nextpkt = 0;
949 		if (error == 0) {
950 			struct in6_ifaddr *ia6;
951 			ip6 = mtod(m, struct ip6_hdr *);
952 			ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
953 			if (ia6) {
954 				/*
955 				 * Record statistics for this interface
956 				 * address.
957 				 */
958 				ia6->ia_ifa.ifa_data.ifad_outbytes +=
959 				    m->m_pkthdr.len;
960 			}
961 			KASSERT(dst != NULL);
962 			error = nd6_output(ifp, origifp, m, dst, rt);
963 		} else
964 			m_freem(m);
965 	}
966 
967 	if (error == 0)
968 		IP6_STATINC(IP6_STAT_FRAGMENTED);
969 
970 done:
971 	rtcache_free(&ip6route);
972 
973 #ifdef IPSEC
974 	if (sp != NULL)
975 		KEY_FREESP(&sp);
976 #endif /* IPSEC */
977 
978 
979 	return (error);
980 
981 freehdrs:
982 	m_freem(exthdrs.ip6e_hbh);	/* m_freem will check if mbuf is 0 */
983 	m_freem(exthdrs.ip6e_dest1);
984 	m_freem(exthdrs.ip6e_rthdr);
985 	m_freem(exthdrs.ip6e_dest2);
986 	/* FALLTHROUGH */
987 bad:
988 	m_freem(m);
989 	goto done;
990 badscope:
991 	IP6_STATINC(IP6_STAT_BADSCOPE);
992 	in6_ifstat_inc(origifp, ifs6_out_discard);
993 	if (error == 0)
994 		error = EHOSTUNREACH; /* XXX */
995 	goto bad;
996 }
997 
998 static int
999 ip6_copyexthdr(struct mbuf **mp, void *hdr, int hlen)
1000 {
1001 	struct mbuf *m;
1002 
1003 	if (hlen > MCLBYTES)
1004 		return (ENOBUFS); /* XXX */
1005 
1006 	MGET(m, M_DONTWAIT, MT_DATA);
1007 	if (!m)
1008 		return (ENOBUFS);
1009 
1010 	if (hlen > MLEN) {
1011 		MCLGET(m, M_DONTWAIT);
1012 		if ((m->m_flags & M_EXT) == 0) {
1013 			m_free(m);
1014 			return (ENOBUFS);
1015 		}
1016 	}
1017 	m->m_len = hlen;
1018 	if (hdr)
1019 		bcopy(hdr, mtod(m, void *), hlen);
1020 
1021 	*mp = m;
1022 	return (0);
1023 }
1024 
1025 /*
1026  * Process a delayed payload checksum calculation.
1027  */
1028 void
1029 in6_delayed_cksum(struct mbuf *m)
1030 {
1031 	uint16_t csum, offset;
1032 
1033 	KASSERT((m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0);
1034 	KASSERT((~m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0);
1035 	KASSERT((m->m_pkthdr.csum_flags
1036 	    & (M_CSUM_UDPv4|M_CSUM_TCPv4|M_CSUM_TSOv4)) == 0);
1037 
1038 	offset = M_CSUM_DATA_IPv6_HL(m->m_pkthdr.csum_data);
1039 	csum = in6_cksum(m, 0, offset, m->m_pkthdr.len - offset);
1040 	if (csum == 0 && (m->m_pkthdr.csum_flags & M_CSUM_UDPv6) != 0) {
1041 		csum = 0xffff;
1042 	}
1043 
1044 	offset += M_CSUM_DATA_IPv6_OFFSET(m->m_pkthdr.csum_data);
1045 	if ((offset + sizeof(csum)) > m->m_len) {
1046 		m_copyback(m, offset, sizeof(csum), &csum);
1047 	} else {
1048 		*(uint16_t *)(mtod(m, char *) + offset) = csum;
1049 	}
1050 }
1051 
1052 /*
1053  * Insert jumbo payload option.
1054  */
1055 static int
1056 ip6_insert_jumboopt(struct ip6_exthdrs *exthdrs, u_int32_t plen)
1057 {
1058 	struct mbuf *mopt;
1059 	u_int8_t *optbuf;
1060 	u_int32_t v;
1061 
1062 #define JUMBOOPTLEN	8	/* length of jumbo payload option and padding */
1063 
1064 	/*
1065 	 * If there is no hop-by-hop options header, allocate new one.
1066 	 * If there is one but it doesn't have enough space to store the
1067 	 * jumbo payload option, allocate a cluster to store the whole options.
1068 	 * Otherwise, use it to store the options.
1069 	 */
1070 	if (exthdrs->ip6e_hbh == 0) {
1071 		MGET(mopt, M_DONTWAIT, MT_DATA);
1072 		if (mopt == 0)
1073 			return (ENOBUFS);
1074 		mopt->m_len = JUMBOOPTLEN;
1075 		optbuf = mtod(mopt, u_int8_t *);
1076 		optbuf[1] = 0;	/* = ((JUMBOOPTLEN) >> 3) - 1 */
1077 		exthdrs->ip6e_hbh = mopt;
1078 	} else {
1079 		struct ip6_hbh *hbh;
1080 
1081 		mopt = exthdrs->ip6e_hbh;
1082 		if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
1083 			/*
1084 			 * XXX assumption:
1085 			 * - exthdrs->ip6e_hbh is not referenced from places
1086 			 *   other than exthdrs.
1087 			 * - exthdrs->ip6e_hbh is not an mbuf chain.
1088 			 */
1089 			int oldoptlen = mopt->m_len;
1090 			struct mbuf *n;
1091 
1092 			/*
1093 			 * XXX: give up if the whole (new) hbh header does
1094 			 * not fit even in an mbuf cluster.
1095 			 */
1096 			if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
1097 				return (ENOBUFS);
1098 
1099 			/*
1100 			 * As a consequence, we must always prepare a cluster
1101 			 * at this point.
1102 			 */
1103 			MGET(n, M_DONTWAIT, MT_DATA);
1104 			if (n) {
1105 				MCLGET(n, M_DONTWAIT);
1106 				if ((n->m_flags & M_EXT) == 0) {
1107 					m_freem(n);
1108 					n = NULL;
1109 				}
1110 			}
1111 			if (!n)
1112 				return (ENOBUFS);
1113 			n->m_len = oldoptlen + JUMBOOPTLEN;
1114 			bcopy(mtod(mopt, void *), mtod(n, void *),
1115 			    oldoptlen);
1116 			optbuf = mtod(n, u_int8_t *) + oldoptlen;
1117 			m_freem(mopt);
1118 			mopt = exthdrs->ip6e_hbh = n;
1119 		} else {
1120 			optbuf = mtod(mopt, u_int8_t *) + mopt->m_len;
1121 			mopt->m_len += JUMBOOPTLEN;
1122 		}
1123 		optbuf[0] = IP6OPT_PADN;
1124 		optbuf[1] = 0;
1125 
1126 		/*
1127 		 * Adjust the header length according to the pad and
1128 		 * the jumbo payload option.
1129 		 */
1130 		hbh = mtod(mopt, struct ip6_hbh *);
1131 		hbh->ip6h_len += (JUMBOOPTLEN >> 3);
1132 	}
1133 
1134 	/* fill in the option. */
1135 	optbuf[2] = IP6OPT_JUMBO;
1136 	optbuf[3] = 4;
1137 	v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
1138 	bcopy(&v, &optbuf[4], sizeof(u_int32_t));
1139 
1140 	/* finally, adjust the packet header length */
1141 	exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
1142 
1143 	return (0);
1144 #undef JUMBOOPTLEN
1145 }
1146 
1147 /*
1148  * Insert fragment header and copy unfragmentable header portions.
1149  *
1150  * *frghdrp will not be read, and it is guaranteed that either an
1151  * error is returned or that *frghdrp will point to space allocated
1152  * for the fragment header.
1153  */
1154 static int
1155 ip6_insertfraghdr(struct mbuf *m0, struct mbuf *m, int hlen,
1156 	struct ip6_frag **frghdrp)
1157 {
1158 	struct mbuf *n, *mlast;
1159 
1160 	if (hlen > sizeof(struct ip6_hdr)) {
1161 		n = m_copym(m0, sizeof(struct ip6_hdr),
1162 		    hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
1163 		if (n == 0)
1164 			return (ENOBUFS);
1165 		m->m_next = n;
1166 	} else
1167 		n = m;
1168 
1169 	/* Search for the last mbuf of unfragmentable part. */
1170 	for (mlast = n; mlast->m_next; mlast = mlast->m_next)
1171 		;
1172 
1173 	if ((mlast->m_flags & M_EXT) == 0 &&
1174 	    M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
1175 		/* use the trailing space of the last mbuf for the fragment hdr */
1176 		*frghdrp = (struct ip6_frag *)(mtod(mlast, char *) +
1177 		    mlast->m_len);
1178 		mlast->m_len += sizeof(struct ip6_frag);
1179 		m->m_pkthdr.len += sizeof(struct ip6_frag);
1180 	} else {
1181 		/* allocate a new mbuf for the fragment header */
1182 		struct mbuf *mfrg;
1183 
1184 		MGET(mfrg, M_DONTWAIT, MT_DATA);
1185 		if (mfrg == 0)
1186 			return (ENOBUFS);
1187 		mfrg->m_len = sizeof(struct ip6_frag);
1188 		*frghdrp = mtod(mfrg, struct ip6_frag *);
1189 		mlast->m_next = mfrg;
1190 	}
1191 
1192 	return (0);
1193 }
1194 
1195 static int
1196 ip6_getpmtu(struct route *ro_pmtu, struct route *ro, struct ifnet *ifp,
1197     const struct in6_addr *dst, u_long *mtup, int *alwaysfragp)
1198 {
1199 	struct rtentry *rt;
1200 	u_int32_t mtu = 0;
1201 	int alwaysfrag = 0;
1202 	int error = 0;
1203 
1204 	if (ro_pmtu != ro) {
1205 		union {
1206 			struct sockaddr		dst;
1207 			struct sockaddr_in6	dst6;
1208 		} u;
1209 
1210 		/* The first hop and the final destination may differ. */
1211 		sockaddr_in6_init(&u.dst6, dst, 0, 0, 0);
1212 		rt = rtcache_lookup(ro_pmtu, &u.dst);
1213 	} else
1214 		rt = rtcache_validate(ro_pmtu);
1215 	if (rt != NULL) {
1216 		u_int32_t ifmtu;
1217 
1218 		if (ifp == NULL)
1219 			ifp = rt->rt_ifp;
1220 		ifmtu = IN6_LINKMTU(ifp);
1221 		mtu = rt->rt_rmx.rmx_mtu;
1222 		if (mtu == 0)
1223 			mtu = ifmtu;
1224 		else if (mtu < IPV6_MMTU) {
1225 			/*
1226 			 * RFC2460 section 5, last paragraph:
1227 			 * if we record ICMPv6 too big message with
1228 			 * mtu < IPV6_MMTU, transmit packets sized IPV6_MMTU
1229 			 * or smaller, with fragment header attached.
1230 			 * (fragment header is needed regardless from the
1231 			 * packet size, for translators to identify packets)
1232 			 */
1233 			alwaysfrag = 1;
1234 			mtu = IPV6_MMTU;
1235 		} else if (mtu > ifmtu) {
1236 			/*
1237 			 * The MTU on the route is larger than the MTU on
1238 			 * the interface!  This shouldn't happen, unless the
1239 			 * MTU of the interface has been changed after the
1240 			 * interface was brought up.  Change the MTU in the
1241 			 * route to match the interface MTU (as long as the
1242 			 * field isn't locked).
1243 			 */
1244 			mtu = ifmtu;
1245 			if (!(rt->rt_rmx.rmx_locks & RTV_MTU))
1246 				rt->rt_rmx.rmx_mtu = mtu;
1247 		}
1248 	} else if (ifp) {
1249 		mtu = IN6_LINKMTU(ifp);
1250 	} else
1251 		error = EHOSTUNREACH; /* XXX */
1252 
1253 	*mtup = mtu;
1254 	if (alwaysfragp)
1255 		*alwaysfragp = alwaysfrag;
1256 	return (error);
1257 }
1258 
1259 /*
1260  * IP6 socket option processing.
1261  */
1262 int
1263 ip6_ctloutput(int op, struct socket *so, struct sockopt *sopt)
1264 {
1265 	int optdatalen, uproto;
1266 	void *optdata;
1267 	struct in6pcb *in6p = sotoin6pcb(so);
1268 	struct ip_moptions **mopts;
1269 	int error, optval;
1270 	int level, optname;
1271 
1272 	KASSERT(sopt != NULL);
1273 
1274 	level = sopt->sopt_level;
1275 	optname = sopt->sopt_name;
1276 
1277 	error = optval = 0;
1278 	uproto = (int)so->so_proto->pr_protocol;
1279 
1280 	switch (level) {
1281 	case IPPROTO_IP:
1282 		switch (optname) {
1283 		case IP_ADD_MEMBERSHIP:
1284 		case IP_DROP_MEMBERSHIP:
1285 		case IP_MULTICAST_IF:
1286 		case IP_MULTICAST_LOOP:
1287 		case IP_MULTICAST_TTL:
1288 			mopts = &in6p->in6p_v4moptions;
1289 			switch (op) {
1290 			case PRCO_GETOPT:
1291 				return ip_getmoptions(*mopts, sopt);
1292 			case PRCO_SETOPT:
1293 				return ip_setmoptions(mopts, sopt);
1294 			default:
1295 				return EINVAL;
1296 			}
1297 		default:
1298 			return ENOPROTOOPT;
1299 		}
1300 	case IPPROTO_IPV6:
1301 		break;
1302 	default:
1303 		return ENOPROTOOPT;
1304 	}
1305 	switch (op) {
1306 	case PRCO_SETOPT:
1307 		switch (optname) {
1308 #ifdef RFC2292
1309 		case IPV6_2292PKTOPTIONS:
1310 			error = ip6_pcbopts(&in6p->in6p_outputopts, so, sopt);
1311 			break;
1312 #endif
1313 
1314 		/*
1315 		 * Use of some Hop-by-Hop options or some
1316 		 * Destination options, might require special
1317 		 * privilege.  That is, normal applications
1318 		 * (without special privilege) might be forbidden
1319 		 * from setting certain options in outgoing packets,
1320 		 * and might never see certain options in received
1321 		 * packets. [RFC 2292 Section 6]
1322 		 * KAME specific note:
1323 		 *  KAME prevents non-privileged users from sending or
1324 		 *  receiving ANY hbh/dst options in order to avoid
1325 		 *  overhead of parsing options in the kernel.
1326 		 */
1327 		case IPV6_RECVHOPOPTS:
1328 		case IPV6_RECVDSTOPTS:
1329 		case IPV6_RECVRTHDRDSTOPTS:
1330 			error = kauth_authorize_network(kauth_cred_get(),
1331 			    KAUTH_NETWORK_IPV6, KAUTH_REQ_NETWORK_IPV6_HOPBYHOP,
1332 			    NULL, NULL, NULL);
1333 			if (error)
1334 				break;
1335 			/* FALLTHROUGH */
1336 		case IPV6_UNICAST_HOPS:
1337 		case IPV6_HOPLIMIT:
1338 		case IPV6_FAITH:
1339 
1340 		case IPV6_RECVPKTINFO:
1341 		case IPV6_RECVHOPLIMIT:
1342 		case IPV6_RECVRTHDR:
1343 		case IPV6_RECVPATHMTU:
1344 		case IPV6_RECVTCLASS:
1345 		case IPV6_V6ONLY:
1346 			error = sockopt_getint(sopt, &optval);
1347 			if (error)
1348 				break;
1349 			switch (optname) {
1350 			case IPV6_UNICAST_HOPS:
1351 				if (optval < -1 || optval >= 256)
1352 					error = EINVAL;
1353 				else {
1354 					/* -1 = kernel default */
1355 					in6p->in6p_hops = optval;
1356 				}
1357 				break;
1358 #define OPTSET(bit) \
1359 do { \
1360 if (optval) \
1361 	in6p->in6p_flags |= (bit); \
1362 else \
1363 	in6p->in6p_flags &= ~(bit); \
1364 } while (/*CONSTCOND*/ 0)
1365 
1366 #ifdef RFC2292
1367 #define OPTSET2292(bit) 			\
1368 do { 						\
1369 in6p->in6p_flags |= IN6P_RFC2292; 	\
1370 if (optval) 				\
1371 	in6p->in6p_flags |= (bit); 	\
1372 else 					\
1373 	in6p->in6p_flags &= ~(bit); 	\
1374 } while (/*CONSTCOND*/ 0)
1375 #endif
1376 
1377 #define OPTBIT(bit) (in6p->in6p_flags & (bit) ? 1 : 0)
1378 
1379 			case IPV6_RECVPKTINFO:
1380 #ifdef RFC2292
1381 				/* cannot mix with RFC2292 */
1382 				if (OPTBIT(IN6P_RFC2292)) {
1383 					error = EINVAL;
1384 					break;
1385 				}
1386 #endif
1387 				OPTSET(IN6P_PKTINFO);
1388 				break;
1389 
1390 			case IPV6_HOPLIMIT:
1391 			{
1392 				struct ip6_pktopts **optp;
1393 
1394 #ifdef RFC2292
1395 				/* cannot mix with RFC2292 */
1396 				if (OPTBIT(IN6P_RFC2292)) {
1397 					error = EINVAL;
1398 					break;
1399 				}
1400 #endif
1401 				optp = &in6p->in6p_outputopts;
1402 				error = ip6_pcbopt(IPV6_HOPLIMIT,
1403 						   (u_char *)&optval,
1404 						   sizeof(optval),
1405 						   optp,
1406 						   kauth_cred_get(), uproto);
1407 				break;
1408 			}
1409 
1410 			case IPV6_RECVHOPLIMIT:
1411 #ifdef RFC2292
1412 				/* cannot mix with RFC2292 */
1413 				if (OPTBIT(IN6P_RFC2292)) {
1414 					error = EINVAL;
1415 					break;
1416 				}
1417 #endif
1418 				OPTSET(IN6P_HOPLIMIT);
1419 				break;
1420 
1421 			case IPV6_RECVHOPOPTS:
1422 #ifdef RFC2292
1423 				/* cannot mix with RFC2292 */
1424 				if (OPTBIT(IN6P_RFC2292)) {
1425 					error = EINVAL;
1426 					break;
1427 				}
1428 #endif
1429 				OPTSET(IN6P_HOPOPTS);
1430 				break;
1431 
1432 			case IPV6_RECVDSTOPTS:
1433 #ifdef RFC2292
1434 				/* cannot mix with RFC2292 */
1435 				if (OPTBIT(IN6P_RFC2292)) {
1436 					error = EINVAL;
1437 					break;
1438 				}
1439 #endif
1440 				OPTSET(IN6P_DSTOPTS);
1441 				break;
1442 
1443 			case IPV6_RECVRTHDRDSTOPTS:
1444 #ifdef RFC2292
1445 				/* cannot mix with RFC2292 */
1446 				if (OPTBIT(IN6P_RFC2292)) {
1447 					error = EINVAL;
1448 					break;
1449 				}
1450 #endif
1451 				OPTSET(IN6P_RTHDRDSTOPTS);
1452 				break;
1453 
1454 			case IPV6_RECVRTHDR:
1455 #ifdef RFC2292
1456 				/* cannot mix with RFC2292 */
1457 				if (OPTBIT(IN6P_RFC2292)) {
1458 					error = EINVAL;
1459 					break;
1460 				}
1461 #endif
1462 				OPTSET(IN6P_RTHDR);
1463 				break;
1464 
1465 			case IPV6_FAITH:
1466 				OPTSET(IN6P_FAITH);
1467 				break;
1468 
1469 			case IPV6_RECVPATHMTU:
1470 				/*
1471 				 * We ignore this option for TCP
1472 				 * sockets.
1473 				 * (RFC3542 leaves this case
1474 				 * unspecified.)
1475 				 */
1476 				if (uproto != IPPROTO_TCP)
1477 					OPTSET(IN6P_MTU);
1478 				break;
1479 
1480 			case IPV6_V6ONLY:
1481 				/*
1482 				 * make setsockopt(IPV6_V6ONLY)
1483 				 * available only prior to bind(2).
1484 				 * see ipng mailing list, Jun 22 2001.
1485 				 */
1486 				if (in6p->in6p_lport ||
1487 				    !IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr)) {
1488 					error = EINVAL;
1489 					break;
1490 				}
1491 #ifdef INET6_BINDV6ONLY
1492 				if (!optval)
1493 					error = EINVAL;
1494 #else
1495 				OPTSET(IN6P_IPV6_V6ONLY);
1496 #endif
1497 				break;
1498 			case IPV6_RECVTCLASS:
1499 #ifdef RFC2292
1500 				/* cannot mix with RFC2292 XXX */
1501 				if (OPTBIT(IN6P_RFC2292)) {
1502 					error = EINVAL;
1503 					break;
1504 				}
1505 #endif
1506 				OPTSET(IN6P_TCLASS);
1507 				break;
1508 
1509 			}
1510 			break;
1511 
1512 		case IPV6_OTCLASS:
1513 		{
1514 			struct ip6_pktopts **optp;
1515 			u_int8_t tclass;
1516 
1517 			error = sockopt_get(sopt, &tclass, sizeof(tclass));
1518 			if (error)
1519 				break;
1520 			optp = &in6p->in6p_outputopts;
1521 			error = ip6_pcbopt(optname,
1522 					   (u_char *)&tclass,
1523 					   sizeof(tclass),
1524 					   optp,
1525 					   kauth_cred_get(), uproto);
1526 			break;
1527 		}
1528 
1529 		case IPV6_TCLASS:
1530 		case IPV6_DONTFRAG:
1531 		case IPV6_USE_MIN_MTU:
1532 		case IPV6_PREFER_TEMPADDR:
1533 			error = sockopt_getint(sopt, &optval);
1534 			if (error)
1535 				break;
1536 			{
1537 				struct ip6_pktopts **optp;
1538 				optp = &in6p->in6p_outputopts;
1539 				error = ip6_pcbopt(optname,
1540 						   (u_char *)&optval,
1541 						   sizeof(optval),
1542 						   optp,
1543 						   kauth_cred_get(), uproto);
1544 				break;
1545 			}
1546 
1547 #ifdef RFC2292
1548 		case IPV6_2292PKTINFO:
1549 		case IPV6_2292HOPLIMIT:
1550 		case IPV6_2292HOPOPTS:
1551 		case IPV6_2292DSTOPTS:
1552 		case IPV6_2292RTHDR:
1553 			/* RFC 2292 */
1554 			error = sockopt_getint(sopt, &optval);
1555 			if (error)
1556 				break;
1557 
1558 			switch (optname) {
1559 			case IPV6_2292PKTINFO:
1560 				OPTSET2292(IN6P_PKTINFO);
1561 				break;
1562 			case IPV6_2292HOPLIMIT:
1563 				OPTSET2292(IN6P_HOPLIMIT);
1564 				break;
1565 			case IPV6_2292HOPOPTS:
1566 				/*
1567 				 * Check super-user privilege.
1568 				 * See comments for IPV6_RECVHOPOPTS.
1569 				 */
1570 				error =
1571 				    kauth_authorize_network(kauth_cred_get(),
1572 				    KAUTH_NETWORK_IPV6,
1573 				    KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL,
1574 				    NULL, NULL);
1575 				if (error)
1576 					return (error);
1577 				OPTSET2292(IN6P_HOPOPTS);
1578 				break;
1579 			case IPV6_2292DSTOPTS:
1580 				error =
1581 				    kauth_authorize_network(kauth_cred_get(),
1582 				    KAUTH_NETWORK_IPV6,
1583 				    KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL,
1584 				    NULL, NULL);
1585 				if (error)
1586 					return (error);
1587 				OPTSET2292(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS); /* XXX */
1588 				break;
1589 			case IPV6_2292RTHDR:
1590 				OPTSET2292(IN6P_RTHDR);
1591 				break;
1592 			}
1593 			break;
1594 #endif
1595 		case IPV6_PKTINFO:
1596 		case IPV6_HOPOPTS:
1597 		case IPV6_RTHDR:
1598 		case IPV6_DSTOPTS:
1599 		case IPV6_RTHDRDSTOPTS:
1600 		case IPV6_NEXTHOP: {
1601 			/* new advanced API (RFC3542) */
1602 			void *optbuf;
1603 			int optbuflen;
1604 			struct ip6_pktopts **optp;
1605 
1606 #ifdef RFC2292
1607 			/* cannot mix with RFC2292 */
1608 			if (OPTBIT(IN6P_RFC2292)) {
1609 				error = EINVAL;
1610 				break;
1611 			}
1612 #endif
1613 
1614 			optbuflen = sopt->sopt_size;
1615 			optbuf = malloc(optbuflen, M_IP6OPT, M_NOWAIT);
1616 			if (optbuf == NULL) {
1617 				error = ENOBUFS;
1618 				break;
1619 			}
1620 
1621 			error = sockopt_get(sopt, optbuf, optbuflen);
1622 			if (error) {
1623 				free(optbuf, M_IP6OPT);
1624 				break;
1625 			}
1626 			optp = &in6p->in6p_outputopts;
1627 			error = ip6_pcbopt(optname, optbuf, optbuflen,
1628 			    optp, kauth_cred_get(), uproto);
1629 
1630 			free(optbuf, M_IP6OPT);
1631 			break;
1632 			}
1633 #undef OPTSET
1634 
1635 		case IPV6_MULTICAST_IF:
1636 		case IPV6_MULTICAST_HOPS:
1637 		case IPV6_MULTICAST_LOOP:
1638 		case IPV6_JOIN_GROUP:
1639 		case IPV6_LEAVE_GROUP:
1640 			error = ip6_setmoptions(sopt, in6p);
1641 			break;
1642 
1643 		case IPV6_PORTRANGE:
1644 			error = sockopt_getint(sopt, &optval);
1645 			if (error)
1646 				break;
1647 
1648 			switch (optval) {
1649 			case IPV6_PORTRANGE_DEFAULT:
1650 				in6p->in6p_flags &= ~(IN6P_LOWPORT);
1651 				in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1652 				break;
1653 
1654 			case IPV6_PORTRANGE_HIGH:
1655 				in6p->in6p_flags &= ~(IN6P_LOWPORT);
1656 				in6p->in6p_flags |= IN6P_HIGHPORT;
1657 				break;
1658 
1659 			case IPV6_PORTRANGE_LOW:
1660 				in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1661 				in6p->in6p_flags |= IN6P_LOWPORT;
1662 				break;
1663 
1664 			default:
1665 				error = EINVAL;
1666 				break;
1667 			}
1668 			break;
1669 
1670 		case IPV6_PORTALGO:
1671 			error = sockopt_getint(sopt, &optval);
1672 			if (error)
1673 				break;
1674 
1675 			error = portalgo_algo_index_select(
1676 			    (struct inpcb_hdr *)in6p, optval);
1677 			break;
1678 
1679 #if defined(IPSEC)
1680 		case IPV6_IPSEC_POLICY:
1681 			if (ipsec_enabled) {
1682 				error = ipsec6_set_policy(in6p, optname,
1683 				    sopt->sopt_data, sopt->sopt_size,
1684 				    kauth_cred_get());
1685 				break;
1686 			}
1687 			/*FALLTHROUGH*/
1688 #endif /* IPSEC */
1689 
1690 		default:
1691 			error = ENOPROTOOPT;
1692 			break;
1693 		}
1694 		break;
1695 
1696 	case PRCO_GETOPT:
1697 		switch (optname) {
1698 #ifdef RFC2292
1699 		case IPV6_2292PKTOPTIONS:
1700 			/*
1701 			 * RFC3542 (effectively) deprecated the
1702 			 * semantics of the 2292-style pktoptions.
1703 			 * Since it was not reliable in nature (i.e.,
1704 			 * applications had to expect the lack of some
1705 			 * information after all), it would make sense
1706 			 * to simplify this part by always returning
1707 			 * empty data.
1708 			 */
1709 			break;
1710 #endif
1711 
1712 		case IPV6_RECVHOPOPTS:
1713 		case IPV6_RECVDSTOPTS:
1714 		case IPV6_RECVRTHDRDSTOPTS:
1715 		case IPV6_UNICAST_HOPS:
1716 		case IPV6_RECVPKTINFO:
1717 		case IPV6_RECVHOPLIMIT:
1718 		case IPV6_RECVRTHDR:
1719 		case IPV6_RECVPATHMTU:
1720 
1721 		case IPV6_FAITH:
1722 		case IPV6_V6ONLY:
1723 		case IPV6_PORTRANGE:
1724 		case IPV6_RECVTCLASS:
1725 			switch (optname) {
1726 
1727 			case IPV6_RECVHOPOPTS:
1728 				optval = OPTBIT(IN6P_HOPOPTS);
1729 				break;
1730 
1731 			case IPV6_RECVDSTOPTS:
1732 				optval = OPTBIT(IN6P_DSTOPTS);
1733 				break;
1734 
1735 			case IPV6_RECVRTHDRDSTOPTS:
1736 				optval = OPTBIT(IN6P_RTHDRDSTOPTS);
1737 				break;
1738 
1739 			case IPV6_UNICAST_HOPS:
1740 				optval = in6p->in6p_hops;
1741 				break;
1742 
1743 			case IPV6_RECVPKTINFO:
1744 				optval = OPTBIT(IN6P_PKTINFO);
1745 				break;
1746 
1747 			case IPV6_RECVHOPLIMIT:
1748 				optval = OPTBIT(IN6P_HOPLIMIT);
1749 				break;
1750 
1751 			case IPV6_RECVRTHDR:
1752 				optval = OPTBIT(IN6P_RTHDR);
1753 				break;
1754 
1755 			case IPV6_RECVPATHMTU:
1756 				optval = OPTBIT(IN6P_MTU);
1757 				break;
1758 
1759 			case IPV6_FAITH:
1760 				optval = OPTBIT(IN6P_FAITH);
1761 				break;
1762 
1763 			case IPV6_V6ONLY:
1764 				optval = OPTBIT(IN6P_IPV6_V6ONLY);
1765 				break;
1766 
1767 			case IPV6_PORTRANGE:
1768 			    {
1769 				int flags;
1770 				flags = in6p->in6p_flags;
1771 				if (flags & IN6P_HIGHPORT)
1772 					optval = IPV6_PORTRANGE_HIGH;
1773 				else if (flags & IN6P_LOWPORT)
1774 					optval = IPV6_PORTRANGE_LOW;
1775 				else
1776 					optval = 0;
1777 				break;
1778 			    }
1779 			case IPV6_RECVTCLASS:
1780 				optval = OPTBIT(IN6P_TCLASS);
1781 				break;
1782 
1783 			}
1784 			if (error)
1785 				break;
1786 			error = sockopt_setint(sopt, optval);
1787 			break;
1788 
1789 		case IPV6_PATHMTU:
1790 		    {
1791 			u_long pmtu = 0;
1792 			struct ip6_mtuinfo mtuinfo;
1793 			struct route *ro = &in6p->in6p_route;
1794 
1795 			if (!(so->so_state & SS_ISCONNECTED))
1796 				return (ENOTCONN);
1797 			/*
1798 			 * XXX: we dot not consider the case of source
1799 			 * routing, or optional information to specify
1800 			 * the outgoing interface.
1801 			 */
1802 			error = ip6_getpmtu(ro, NULL, NULL,
1803 			    &in6p->in6p_faddr, &pmtu, NULL);
1804 			if (error)
1805 				break;
1806 			if (pmtu > IPV6_MAXPACKET)
1807 				pmtu = IPV6_MAXPACKET;
1808 
1809 			memset(&mtuinfo, 0, sizeof(mtuinfo));
1810 			mtuinfo.ip6m_mtu = (u_int32_t)pmtu;
1811 			optdata = (void *)&mtuinfo;
1812 			optdatalen = sizeof(mtuinfo);
1813 			if (optdatalen > MCLBYTES)
1814 				return (EMSGSIZE); /* XXX */
1815 			error = sockopt_set(sopt, optdata, optdatalen);
1816 			break;
1817 		    }
1818 
1819 #ifdef RFC2292
1820 		case IPV6_2292PKTINFO:
1821 		case IPV6_2292HOPLIMIT:
1822 		case IPV6_2292HOPOPTS:
1823 		case IPV6_2292RTHDR:
1824 		case IPV6_2292DSTOPTS:
1825 			switch (optname) {
1826 			case IPV6_2292PKTINFO:
1827 				optval = OPTBIT(IN6P_PKTINFO);
1828 				break;
1829 			case IPV6_2292HOPLIMIT:
1830 				optval = OPTBIT(IN6P_HOPLIMIT);
1831 				break;
1832 			case IPV6_2292HOPOPTS:
1833 				optval = OPTBIT(IN6P_HOPOPTS);
1834 				break;
1835 			case IPV6_2292RTHDR:
1836 				optval = OPTBIT(IN6P_RTHDR);
1837 				break;
1838 			case IPV6_2292DSTOPTS:
1839 				optval = OPTBIT(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS);
1840 				break;
1841 			}
1842 			error = sockopt_setint(sopt, optval);
1843 			break;
1844 #endif
1845 		case IPV6_PKTINFO:
1846 		case IPV6_HOPOPTS:
1847 		case IPV6_RTHDR:
1848 		case IPV6_DSTOPTS:
1849 		case IPV6_RTHDRDSTOPTS:
1850 		case IPV6_NEXTHOP:
1851 		case IPV6_OTCLASS:
1852 		case IPV6_TCLASS:
1853 		case IPV6_DONTFRAG:
1854 		case IPV6_USE_MIN_MTU:
1855 		case IPV6_PREFER_TEMPADDR:
1856 			error = ip6_getpcbopt(in6p->in6p_outputopts,
1857 			    optname, sopt);
1858 			break;
1859 
1860 		case IPV6_MULTICAST_IF:
1861 		case IPV6_MULTICAST_HOPS:
1862 		case IPV6_MULTICAST_LOOP:
1863 		case IPV6_JOIN_GROUP:
1864 		case IPV6_LEAVE_GROUP:
1865 			error = ip6_getmoptions(sopt, in6p);
1866 			break;
1867 
1868 		case IPV6_PORTALGO:
1869 			optval = ((struct inpcb_hdr *)in6p)->inph_portalgo;
1870 			error = sockopt_setint(sopt, optval);
1871 			break;
1872 
1873 #if defined(IPSEC)
1874 		case IPV6_IPSEC_POLICY:
1875 			if (ipsec_used) {
1876 				struct mbuf *m = NULL;
1877 
1878 				/*
1879 				 * XXX: this will return EINVAL as sopt is
1880 				 * empty
1881 				 */
1882 				error = ipsec6_get_policy(in6p, sopt->sopt_data,
1883 				    sopt->sopt_size, &m);
1884 				if (!error)
1885 					error = sockopt_setmbuf(sopt, m);
1886 				break;
1887 			}
1888 			/*FALLTHROUGH*/
1889 #endif /* IPSEC */
1890 
1891 		default:
1892 			error = ENOPROTOOPT;
1893 			break;
1894 		}
1895 		break;
1896 	}
1897 	return (error);
1898 }
1899 
1900 int
1901 ip6_raw_ctloutput(int op, struct socket *so, struct sockopt *sopt)
1902 {
1903 	int error = 0, optval;
1904 	const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
1905 	struct in6pcb *in6p = sotoin6pcb(so);
1906 	int level, optname;
1907 
1908 	KASSERT(sopt != NULL);
1909 
1910 	level = sopt->sopt_level;
1911 	optname = sopt->sopt_name;
1912 
1913 	if (level != IPPROTO_IPV6) {
1914 		return ENOPROTOOPT;
1915 	}
1916 
1917 	switch (optname) {
1918 	case IPV6_CHECKSUM:
1919 		/*
1920 		 * For ICMPv6 sockets, no modification allowed for checksum
1921 		 * offset, permit "no change" values to help existing apps.
1922 		 *
1923 		 * XXX RFC3542 says: "An attempt to set IPV6_CHECKSUM
1924 		 * for an ICMPv6 socket will fail."  The current
1925 		 * behavior does not meet RFC3542.
1926 		 */
1927 		switch (op) {
1928 		case PRCO_SETOPT:
1929 			error = sockopt_getint(sopt, &optval);
1930 			if (error)
1931 				break;
1932 			if ((optval % 2) != 0) {
1933 				/* the API assumes even offset values */
1934 				error = EINVAL;
1935 			} else if (so->so_proto->pr_protocol ==
1936 			    IPPROTO_ICMPV6) {
1937 				if (optval != icmp6off)
1938 					error = EINVAL;
1939 			} else
1940 				in6p->in6p_cksum = optval;
1941 			break;
1942 
1943 		case PRCO_GETOPT:
1944 			if (so->so_proto->pr_protocol == IPPROTO_ICMPV6)
1945 				optval = icmp6off;
1946 			else
1947 				optval = in6p->in6p_cksum;
1948 
1949 			error = sockopt_setint(sopt, optval);
1950 			break;
1951 
1952 		default:
1953 			error = EINVAL;
1954 			break;
1955 		}
1956 		break;
1957 
1958 	default:
1959 		error = ENOPROTOOPT;
1960 		break;
1961 	}
1962 
1963 	return (error);
1964 }
1965 
1966 #ifdef RFC2292
1967 /*
1968  * Set up IP6 options in pcb for insertion in output packets or
1969  * specifying behavior of outgoing packets.
1970  */
1971 static int
1972 ip6_pcbopts(struct ip6_pktopts **pktopt, struct socket *so,
1973     struct sockopt *sopt)
1974 {
1975 	struct ip6_pktopts *opt = *pktopt;
1976 	struct mbuf *m;
1977 	int error = 0;
1978 
1979 	/* turn off any old options. */
1980 	if (opt) {
1981 #ifdef DIAGNOSTIC
1982 	    if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
1983 		opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
1984 		opt->ip6po_rhinfo.ip6po_rhi_rthdr)
1985 		    printf("ip6_pcbopts: all specified options are cleared.\n");
1986 #endif
1987 		ip6_clearpktopts(opt, -1);
1988 	} else {
1989 		opt = malloc(sizeof(*opt), M_IP6OPT, M_NOWAIT);
1990 		if (opt == NULL)
1991 			return (ENOBUFS);
1992 	}
1993 	*pktopt = NULL;
1994 
1995 	if (sopt == NULL || sopt->sopt_size == 0) {
1996 		/*
1997 		 * Only turning off any previous options, regardless of
1998 		 * whether the opt is just created or given.
1999 		 */
2000 		free(opt, M_IP6OPT);
2001 		return (0);
2002 	}
2003 
2004 	/*  set options specified by user. */
2005 	m = sockopt_getmbuf(sopt);
2006 	if (m == NULL) {
2007 		free(opt, M_IP6OPT);
2008 		return (ENOBUFS);
2009 	}
2010 
2011 	error = ip6_setpktopts(m, opt, NULL, kauth_cred_get(),
2012 	    so->so_proto->pr_protocol);
2013 	m_freem(m);
2014 	if (error != 0) {
2015 		ip6_clearpktopts(opt, -1); /* XXX: discard all options */
2016 		free(opt, M_IP6OPT);
2017 		return (error);
2018 	}
2019 	*pktopt = opt;
2020 	return (0);
2021 }
2022 #endif
2023 
2024 /*
2025  * initialize ip6_pktopts.  beware that there are non-zero default values in
2026  * the struct.
2027  */
2028 void
2029 ip6_initpktopts(struct ip6_pktopts *opt)
2030 {
2031 
2032 	memset(opt, 0, sizeof(*opt));
2033 	opt->ip6po_hlim = -1;	/* -1 means default hop limit */
2034 	opt->ip6po_tclass = -1;	/* -1 means default traffic class */
2035 	opt->ip6po_minmtu = IP6PO_MINMTU_MCASTONLY;
2036 	opt->ip6po_prefer_tempaddr = IP6PO_TEMPADDR_SYSTEM;
2037 }
2038 
2039 #define sin6tosa(sin6)	((struct sockaddr *)(sin6)) /* XXX */
2040 static int
2041 ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt,
2042     kauth_cred_t cred, int uproto)
2043 {
2044 	struct ip6_pktopts *opt;
2045 
2046 	if (*pktopt == NULL) {
2047 		*pktopt = malloc(sizeof(struct ip6_pktopts), M_IP6OPT,
2048 		    M_NOWAIT);
2049 		if (*pktopt == NULL)
2050 			return (ENOBUFS);
2051 
2052 		ip6_initpktopts(*pktopt);
2053 	}
2054 	opt = *pktopt;
2055 
2056 	return (ip6_setpktopt(optname, buf, len, opt, cred, 1, 0, uproto));
2057 }
2058 
2059 static int
2060 ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct sockopt *sopt)
2061 {
2062 	void *optdata = NULL;
2063 	int optdatalen = 0;
2064 	struct ip6_ext *ip6e;
2065 	int error = 0;
2066 	struct in6_pktinfo null_pktinfo;
2067 	int deftclass = 0, on;
2068 	int defminmtu = IP6PO_MINMTU_MCASTONLY;
2069 	int defpreftemp = IP6PO_TEMPADDR_SYSTEM;
2070 
2071 	switch (optname) {
2072 	case IPV6_PKTINFO:
2073 		if (pktopt && pktopt->ip6po_pktinfo)
2074 			optdata = (void *)pktopt->ip6po_pktinfo;
2075 		else {
2076 			/* XXX: we don't have to do this every time... */
2077 			memset(&null_pktinfo, 0, sizeof(null_pktinfo));
2078 			optdata = (void *)&null_pktinfo;
2079 		}
2080 		optdatalen = sizeof(struct in6_pktinfo);
2081 		break;
2082 	case IPV6_OTCLASS:
2083 		/* XXX */
2084 		return (EINVAL);
2085 	case IPV6_TCLASS:
2086 		if (pktopt && pktopt->ip6po_tclass >= 0)
2087 			optdata = (void *)&pktopt->ip6po_tclass;
2088 		else
2089 			optdata = (void *)&deftclass;
2090 		optdatalen = sizeof(int);
2091 		break;
2092 	case IPV6_HOPOPTS:
2093 		if (pktopt && pktopt->ip6po_hbh) {
2094 			optdata = (void *)pktopt->ip6po_hbh;
2095 			ip6e = (struct ip6_ext *)pktopt->ip6po_hbh;
2096 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2097 		}
2098 		break;
2099 	case IPV6_RTHDR:
2100 		if (pktopt && pktopt->ip6po_rthdr) {
2101 			optdata = (void *)pktopt->ip6po_rthdr;
2102 			ip6e = (struct ip6_ext *)pktopt->ip6po_rthdr;
2103 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2104 		}
2105 		break;
2106 	case IPV6_RTHDRDSTOPTS:
2107 		if (pktopt && pktopt->ip6po_dest1) {
2108 			optdata = (void *)pktopt->ip6po_dest1;
2109 			ip6e = (struct ip6_ext *)pktopt->ip6po_dest1;
2110 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2111 		}
2112 		break;
2113 	case IPV6_DSTOPTS:
2114 		if (pktopt && pktopt->ip6po_dest2) {
2115 			optdata = (void *)pktopt->ip6po_dest2;
2116 			ip6e = (struct ip6_ext *)pktopt->ip6po_dest2;
2117 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2118 		}
2119 		break;
2120 	case IPV6_NEXTHOP:
2121 		if (pktopt && pktopt->ip6po_nexthop) {
2122 			optdata = (void *)pktopt->ip6po_nexthop;
2123 			optdatalen = pktopt->ip6po_nexthop->sa_len;
2124 		}
2125 		break;
2126 	case IPV6_USE_MIN_MTU:
2127 		if (pktopt)
2128 			optdata = (void *)&pktopt->ip6po_minmtu;
2129 		else
2130 			optdata = (void *)&defminmtu;
2131 		optdatalen = sizeof(int);
2132 		break;
2133 	case IPV6_DONTFRAG:
2134 		if (pktopt && ((pktopt->ip6po_flags) & IP6PO_DONTFRAG))
2135 			on = 1;
2136 		else
2137 			on = 0;
2138 		optdata = (void *)&on;
2139 		optdatalen = sizeof(on);
2140 		break;
2141 	case IPV6_PREFER_TEMPADDR:
2142 		if (pktopt)
2143 			optdata = (void *)&pktopt->ip6po_prefer_tempaddr;
2144 		else
2145 			optdata = (void *)&defpreftemp;
2146 		optdatalen = sizeof(int);
2147 		break;
2148 	default:		/* should not happen */
2149 #ifdef DIAGNOSTIC
2150 		panic("ip6_getpcbopt: unexpected option\n");
2151 #endif
2152 		return (ENOPROTOOPT);
2153 	}
2154 
2155 	error = sockopt_set(sopt, optdata, optdatalen);
2156 
2157 	return (error);
2158 }
2159 
2160 void
2161 ip6_clearpktopts(struct ip6_pktopts *pktopt, int optname)
2162 {
2163 	if (optname == -1 || optname == IPV6_PKTINFO) {
2164 		if (pktopt->ip6po_pktinfo)
2165 			free(pktopt->ip6po_pktinfo, M_IP6OPT);
2166 		pktopt->ip6po_pktinfo = NULL;
2167 	}
2168 	if (optname == -1 || optname == IPV6_HOPLIMIT)
2169 		pktopt->ip6po_hlim = -1;
2170 	if (optname == -1 || optname == IPV6_TCLASS)
2171 		pktopt->ip6po_tclass = -1;
2172 	if (optname == -1 || optname == IPV6_NEXTHOP) {
2173 		rtcache_free(&pktopt->ip6po_nextroute);
2174 		if (pktopt->ip6po_nexthop)
2175 			free(pktopt->ip6po_nexthop, M_IP6OPT);
2176 		pktopt->ip6po_nexthop = NULL;
2177 	}
2178 	if (optname == -1 || optname == IPV6_HOPOPTS) {
2179 		if (pktopt->ip6po_hbh)
2180 			free(pktopt->ip6po_hbh, M_IP6OPT);
2181 		pktopt->ip6po_hbh = NULL;
2182 	}
2183 	if (optname == -1 || optname == IPV6_RTHDRDSTOPTS) {
2184 		if (pktopt->ip6po_dest1)
2185 			free(pktopt->ip6po_dest1, M_IP6OPT);
2186 		pktopt->ip6po_dest1 = NULL;
2187 	}
2188 	if (optname == -1 || optname == IPV6_RTHDR) {
2189 		if (pktopt->ip6po_rhinfo.ip6po_rhi_rthdr)
2190 			free(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr, M_IP6OPT);
2191 		pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
2192 		rtcache_free(&pktopt->ip6po_route);
2193 	}
2194 	if (optname == -1 || optname == IPV6_DSTOPTS) {
2195 		if (pktopt->ip6po_dest2)
2196 			free(pktopt->ip6po_dest2, M_IP6OPT);
2197 		pktopt->ip6po_dest2 = NULL;
2198 	}
2199 }
2200 
2201 #define PKTOPT_EXTHDRCPY(type) 					\
2202 do {								\
2203 	if (src->type) {					\
2204 		int hlen = (((struct ip6_ext *)src->type)->ip6e_len + 1) << 3;\
2205 		dst->type = malloc(hlen, M_IP6OPT, canwait);	\
2206 		if (dst->type == NULL)				\
2207 			goto bad;				\
2208 		memcpy(dst->type, src->type, hlen);		\
2209 	}							\
2210 } while (/*CONSTCOND*/ 0)
2211 
2212 static int
2213 copypktopts(struct ip6_pktopts *dst, struct ip6_pktopts *src, int canwait)
2214 {
2215 	dst->ip6po_hlim = src->ip6po_hlim;
2216 	dst->ip6po_tclass = src->ip6po_tclass;
2217 	dst->ip6po_flags = src->ip6po_flags;
2218 	dst->ip6po_minmtu = src->ip6po_minmtu;
2219 	dst->ip6po_prefer_tempaddr = src->ip6po_prefer_tempaddr;
2220 	if (src->ip6po_pktinfo) {
2221 		dst->ip6po_pktinfo = malloc(sizeof(*dst->ip6po_pktinfo),
2222 		    M_IP6OPT, canwait);
2223 		if (dst->ip6po_pktinfo == NULL)
2224 			goto bad;
2225 		*dst->ip6po_pktinfo = *src->ip6po_pktinfo;
2226 	}
2227 	if (src->ip6po_nexthop) {
2228 		dst->ip6po_nexthop = malloc(src->ip6po_nexthop->sa_len,
2229 		    M_IP6OPT, canwait);
2230 		if (dst->ip6po_nexthop == NULL)
2231 			goto bad;
2232 		memcpy(dst->ip6po_nexthop, src->ip6po_nexthop,
2233 		    src->ip6po_nexthop->sa_len);
2234 	}
2235 	PKTOPT_EXTHDRCPY(ip6po_hbh);
2236 	PKTOPT_EXTHDRCPY(ip6po_dest1);
2237 	PKTOPT_EXTHDRCPY(ip6po_dest2);
2238 	PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
2239 	return (0);
2240 
2241   bad:
2242 	if (dst->ip6po_pktinfo) free(dst->ip6po_pktinfo, M_IP6OPT);
2243 	if (dst->ip6po_nexthop) free(dst->ip6po_nexthop, M_IP6OPT);
2244 	if (dst->ip6po_hbh) free(dst->ip6po_hbh, M_IP6OPT);
2245 	if (dst->ip6po_dest1) free(dst->ip6po_dest1, M_IP6OPT);
2246 	if (dst->ip6po_dest2) free(dst->ip6po_dest2, M_IP6OPT);
2247 	if (dst->ip6po_rthdr) free(dst->ip6po_rthdr, M_IP6OPT);
2248 
2249 	return (ENOBUFS);
2250 }
2251 #undef PKTOPT_EXTHDRCPY
2252 
2253 struct ip6_pktopts *
2254 ip6_copypktopts(struct ip6_pktopts *src, int canwait)
2255 {
2256 	int error;
2257 	struct ip6_pktopts *dst;
2258 
2259 	dst = malloc(sizeof(*dst), M_IP6OPT, canwait);
2260 	if (dst == NULL)
2261 		return (NULL);
2262 	ip6_initpktopts(dst);
2263 
2264 	if ((error = copypktopts(dst, src, canwait)) != 0) {
2265 		free(dst, M_IP6OPT);
2266 		return (NULL);
2267 	}
2268 
2269 	return (dst);
2270 }
2271 
2272 void
2273 ip6_freepcbopts(struct ip6_pktopts *pktopt)
2274 {
2275 	if (pktopt == NULL)
2276 		return;
2277 
2278 	ip6_clearpktopts(pktopt, -1);
2279 
2280 	free(pktopt, M_IP6OPT);
2281 }
2282 
2283 int
2284 ip6_get_membership(const struct sockopt *sopt, struct ifnet **ifp, void *v,
2285     size_t l)
2286 {
2287 	struct ipv6_mreq mreq;
2288 	int error;
2289 	struct in6_addr *ia = &mreq.ipv6mr_multiaddr;
2290 	struct in_addr *ia4 = (void *)&ia->s6_addr32[3];
2291 	error = sockopt_get(sopt, &mreq, sizeof(mreq));
2292 	if (error != 0)
2293 		return error;
2294 
2295 	if (IN6_IS_ADDR_UNSPECIFIED(ia)) {
2296 		/*
2297 		 * We use the unspecified address to specify to accept
2298 		 * all multicast addresses. Only super user is allowed
2299 		 * to do this.
2300 		 */
2301 		if (kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_IPV6,
2302 		    KAUTH_REQ_NETWORK_IPV6_JOIN_MULTICAST, NULL, NULL, NULL))
2303 			return EACCES;
2304 	} else if (IN6_IS_ADDR_V4MAPPED(ia)) {
2305 		// Don't bother if we are not going to use ifp.
2306 		if (l == sizeof(*ia)) {
2307 			memcpy(v, ia, l);
2308 			return 0;
2309 		}
2310 	} else if (!IN6_IS_ADDR_MULTICAST(ia)) {
2311 		return EINVAL;
2312 	}
2313 
2314 	/*
2315 	 * If no interface was explicitly specified, choose an
2316 	 * appropriate one according to the given multicast address.
2317 	 */
2318 	if (mreq.ipv6mr_interface == 0) {
2319 		struct rtentry *rt;
2320 		union {
2321 			struct sockaddr		dst;
2322 			struct sockaddr_in	dst4;
2323 			struct sockaddr_in6	dst6;
2324 		} u;
2325 		struct route ro;
2326 
2327 		/*
2328 		 * Look up the routing table for the
2329 		 * address, and choose the outgoing interface.
2330 		 *   XXX: is it a good approach?
2331 		 */
2332 		memset(&ro, 0, sizeof(ro));
2333 		if (IN6_IS_ADDR_V4MAPPED(ia))
2334 			sockaddr_in_init(&u.dst4, ia4, 0);
2335 		else
2336 			sockaddr_in6_init(&u.dst6, ia, 0, 0, 0);
2337 		rtcache_setdst(&ro, &u.dst);
2338 		*ifp = (rt = rtcache_init(&ro)) != NULL ? rt->rt_ifp : NULL;
2339 		rtcache_free(&ro);
2340 	} else {
2341 		/*
2342 		 * If the interface is specified, validate it.
2343 		 */
2344 		if ((*ifp = if_byindex(mreq.ipv6mr_interface)) == NULL)
2345 			return ENXIO;	/* XXX EINVAL? */
2346 	}
2347 	if (sizeof(*ia) == l)
2348 		memcpy(v, ia, l);
2349 	else
2350 		memcpy(v, ia4, l);
2351 	return 0;
2352 }
2353 
2354 /*
2355  * Set the IP6 multicast options in response to user setsockopt().
2356  */
2357 static int
2358 ip6_setmoptions(const struct sockopt *sopt, struct in6pcb *in6p)
2359 {
2360 	int error = 0;
2361 	u_int loop, ifindex;
2362 	struct ipv6_mreq mreq;
2363 	struct in6_addr ia;
2364 	struct ifnet *ifp;
2365 	struct ip6_moptions *im6o = in6p->in6p_moptions;
2366 	struct in6_multi_mship *imm;
2367 
2368 	if (im6o == NULL) {
2369 		/*
2370 		 * No multicast option buffer attached to the pcb;
2371 		 * allocate one and initialize to default values.
2372 		 */
2373 		im6o = malloc(sizeof(*im6o), M_IPMOPTS, M_NOWAIT);
2374 		if (im6o == NULL)
2375 			return (ENOBUFS);
2376 		in6p->in6p_moptions = im6o;
2377 		im6o->im6o_multicast_ifp = NULL;
2378 		im6o->im6o_multicast_hlim = ip6_defmcasthlim;
2379 		im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
2380 		LIST_INIT(&im6o->im6o_memberships);
2381 	}
2382 
2383 	switch (sopt->sopt_name) {
2384 
2385 	case IPV6_MULTICAST_IF:
2386 		/*
2387 		 * Select the interface for outgoing multicast packets.
2388 		 */
2389 		error = sockopt_get(sopt, &ifindex, sizeof(ifindex));
2390 		if (error != 0)
2391 			break;
2392 
2393 		if (ifindex != 0) {
2394 			if ((ifp = if_byindex(ifindex)) == NULL) {
2395 				error = ENXIO;	/* XXX EINVAL? */
2396 				break;
2397 			}
2398 			if ((ifp->if_flags & IFF_MULTICAST) == 0) {
2399 				error = EADDRNOTAVAIL;
2400 				break;
2401 			}
2402 		} else
2403 			ifp = NULL;
2404 		im6o->im6o_multicast_ifp = ifp;
2405 		break;
2406 
2407 	case IPV6_MULTICAST_HOPS:
2408 	    {
2409 		/*
2410 		 * Set the IP6 hoplimit for outgoing multicast packets.
2411 		 */
2412 		int optval;
2413 
2414 		error = sockopt_getint(sopt, &optval);
2415 		if (error != 0)
2416 			break;
2417 
2418 		if (optval < -1 || optval >= 256)
2419 			error = EINVAL;
2420 		else if (optval == -1)
2421 			im6o->im6o_multicast_hlim = ip6_defmcasthlim;
2422 		else
2423 			im6o->im6o_multicast_hlim = optval;
2424 		break;
2425 	    }
2426 
2427 	case IPV6_MULTICAST_LOOP:
2428 		/*
2429 		 * Set the loopback flag for outgoing multicast packets.
2430 		 * Must be zero or one.
2431 		 */
2432 		error = sockopt_get(sopt, &loop, sizeof(loop));
2433 		if (error != 0)
2434 			break;
2435 		if (loop > 1) {
2436 			error = EINVAL;
2437 			break;
2438 		}
2439 		im6o->im6o_multicast_loop = loop;
2440 		break;
2441 
2442 	case IPV6_JOIN_GROUP:
2443 		/*
2444 		 * Add a multicast group membership.
2445 		 * Group must be a valid IP6 multicast address.
2446 		 */
2447 		if ((error = ip6_get_membership(sopt, &ifp, &ia, sizeof(ia))))
2448 			return error;
2449 
2450 		if (IN6_IS_ADDR_V4MAPPED(&ia)) {
2451 			error = ip_setmoptions(&in6p->in6p_v4moptions, sopt);
2452 			break;
2453 		}
2454 		/*
2455 		 * See if we found an interface, and confirm that it
2456 		 * supports multicast
2457 		 */
2458 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2459 			error = EADDRNOTAVAIL;
2460 			break;
2461 		}
2462 
2463 		if (in6_setscope(&ia, ifp, NULL)) {
2464 			error = EADDRNOTAVAIL; /* XXX: should not happen */
2465 			break;
2466 		}
2467 
2468 		/*
2469 		 * See if the membership already exists.
2470 		 */
2471 		for (imm = im6o->im6o_memberships.lh_first;
2472 		     imm != NULL; imm = imm->i6mm_chain.le_next)
2473 			if (imm->i6mm_maddr->in6m_ifp == ifp &&
2474 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2475 			    &ia))
2476 				break;
2477 		if (imm != NULL) {
2478 			error = EADDRINUSE;
2479 			break;
2480 		}
2481 		/*
2482 		 * Everything looks good; add a new record to the multicast
2483 		 * address list for the given interface.
2484 		 */
2485 		imm = in6_joingroup(ifp, &ia, &error, 0);
2486 		if (imm == NULL)
2487 			break;
2488 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
2489 		break;
2490 
2491 	case IPV6_LEAVE_GROUP:
2492 		/*
2493 		 * Drop a multicast group membership.
2494 		 * Group must be a valid IP6 multicast address.
2495 		 */
2496 		error = sockopt_get(sopt, &mreq, sizeof(mreq));
2497 		if (error != 0)
2498 			break;
2499 
2500 		if (IN6_IS_ADDR_V4MAPPED(&mreq.ipv6mr_multiaddr)) {
2501 			error = ip_setmoptions(&in6p->in6p_v4moptions, sopt);
2502 			break;
2503 		}
2504 		/*
2505 		 * If an interface address was specified, get a pointer
2506 		 * to its ifnet structure.
2507 		 */
2508 		if (mreq.ipv6mr_interface != 0) {
2509 			if ((ifp = if_byindex(mreq.ipv6mr_interface)) == NULL) {
2510 				error = ENXIO;	/* XXX EINVAL? */
2511 				break;
2512 			}
2513 		} else
2514 			ifp = NULL;
2515 
2516 		/* Fill in the scope zone ID */
2517 		if (ifp) {
2518 			if (in6_setscope(&mreq.ipv6mr_multiaddr, ifp, NULL)) {
2519 				/* XXX: should not happen */
2520 				error = EADDRNOTAVAIL;
2521 				break;
2522 			}
2523 		} else if (mreq.ipv6mr_interface != 0) {
2524 			/*
2525 			 * XXX: This case would happens when the (positive)
2526 			 * index is in the valid range, but the corresponding
2527 			 * interface has been detached dynamically.  The above
2528 			 * check probably avoids such case to happen here, but
2529 			 * we check it explicitly for safety.
2530 			 */
2531 			error = EADDRNOTAVAIL;
2532 			break;
2533 		} else {	/* ipv6mr_interface == 0 */
2534 			struct sockaddr_in6 sa6_mc;
2535 
2536 			/*
2537 			 * The API spec says as follows:
2538 			 *  If the interface index is specified as 0, the
2539 			 *  system may choose a multicast group membership to
2540 			 *  drop by matching the multicast address only.
2541 			 * On the other hand, we cannot disambiguate the scope
2542 			 * zone unless an interface is provided.  Thus, we
2543 			 * check if there's ambiguity with the default scope
2544 			 * zone as the last resort.
2545 			 */
2546 			sockaddr_in6_init(&sa6_mc, &mreq.ipv6mr_multiaddr,
2547 			    0, 0, 0);
2548 			error = sa6_embedscope(&sa6_mc, ip6_use_defzone);
2549 			if (error != 0)
2550 				break;
2551 			mreq.ipv6mr_multiaddr = sa6_mc.sin6_addr;
2552 		}
2553 
2554 		/*
2555 		 * Find the membership in the membership list.
2556 		 */
2557 		for (imm = im6o->im6o_memberships.lh_first;
2558 		     imm != NULL; imm = imm->i6mm_chain.le_next) {
2559 			if ((ifp == NULL || imm->i6mm_maddr->in6m_ifp == ifp) &&
2560 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2561 			    &mreq.ipv6mr_multiaddr))
2562 				break;
2563 		}
2564 		if (imm == NULL) {
2565 			/* Unable to resolve interface */
2566 			error = EADDRNOTAVAIL;
2567 			break;
2568 		}
2569 		/*
2570 		 * Give up the multicast address record to which the
2571 		 * membership points.
2572 		 */
2573 		LIST_REMOVE(imm, i6mm_chain);
2574 		in6_leavegroup(imm);
2575 		break;
2576 
2577 	default:
2578 		error = EOPNOTSUPP;
2579 		break;
2580 	}
2581 
2582 	/*
2583 	 * If all options have default values, no need to keep the mbuf.
2584 	 */
2585 	if (im6o->im6o_multicast_ifp == NULL &&
2586 	    im6o->im6o_multicast_hlim == ip6_defmcasthlim &&
2587 	    im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
2588 	    im6o->im6o_memberships.lh_first == NULL) {
2589 		free(in6p->in6p_moptions, M_IPMOPTS);
2590 		in6p->in6p_moptions = NULL;
2591 	}
2592 
2593 	return (error);
2594 }
2595 
2596 /*
2597  * Return the IP6 multicast options in response to user getsockopt().
2598  */
2599 static int
2600 ip6_getmoptions(struct sockopt *sopt, struct in6pcb *in6p)
2601 {
2602 	u_int optval;
2603 	int error;
2604 	struct ip6_moptions *im6o = in6p->in6p_moptions;
2605 
2606 	switch (sopt->sopt_name) {
2607 	case IPV6_MULTICAST_IF:
2608 		if (im6o == NULL || im6o->im6o_multicast_ifp == NULL)
2609 			optval = 0;
2610 		else
2611 			optval = im6o->im6o_multicast_ifp->if_index;
2612 
2613 		error = sockopt_set(sopt, &optval, sizeof(optval));
2614 		break;
2615 
2616 	case IPV6_MULTICAST_HOPS:
2617 		if (im6o == NULL)
2618 			optval = ip6_defmcasthlim;
2619 		else
2620 			optval = im6o->im6o_multicast_hlim;
2621 
2622 		error = sockopt_set(sopt, &optval, sizeof(optval));
2623 		break;
2624 
2625 	case IPV6_MULTICAST_LOOP:
2626 		if (im6o == NULL)
2627 			optval = IPV6_DEFAULT_MULTICAST_LOOP;
2628 		else
2629 			optval = im6o->im6o_multicast_loop;
2630 
2631 		error = sockopt_set(sopt, &optval, sizeof(optval));
2632 		break;
2633 
2634 	default:
2635 		error = EOPNOTSUPP;
2636 	}
2637 
2638 	return (error);
2639 }
2640 
2641 /*
2642  * Discard the IP6 multicast options.
2643  */
2644 void
2645 ip6_freemoptions(struct ip6_moptions *im6o)
2646 {
2647 	struct in6_multi_mship *imm;
2648 
2649 	if (im6o == NULL)
2650 		return;
2651 
2652 	while ((imm = im6o->im6o_memberships.lh_first) != NULL) {
2653 		LIST_REMOVE(imm, i6mm_chain);
2654 		in6_leavegroup(imm);
2655 	}
2656 	free(im6o, M_IPMOPTS);
2657 }
2658 
2659 /*
2660  * Set IPv6 outgoing packet options based on advanced API.
2661  */
2662 int
2663 ip6_setpktopts(struct mbuf *control, struct ip6_pktopts *opt,
2664 	struct ip6_pktopts *stickyopt, kauth_cred_t cred, int uproto)
2665 {
2666 	struct cmsghdr *cm = 0;
2667 
2668 	if (control == NULL || opt == NULL)
2669 		return (EINVAL);
2670 
2671 	ip6_initpktopts(opt);
2672 	if (stickyopt) {
2673 		int error;
2674 
2675 		/*
2676 		 * If stickyopt is provided, make a local copy of the options
2677 		 * for this particular packet, then override them by ancillary
2678 		 * objects.
2679 		 * XXX: copypktopts() does not copy the cached route to a next
2680 		 * hop (if any).  This is not very good in terms of efficiency,
2681 		 * but we can allow this since this option should be rarely
2682 		 * used.
2683 		 */
2684 		if ((error = copypktopts(opt, stickyopt, M_NOWAIT)) != 0)
2685 			return (error);
2686 	}
2687 
2688 	/*
2689 	 * XXX: Currently, we assume all the optional information is stored
2690 	 * in a single mbuf.
2691 	 */
2692 	if (control->m_next)
2693 		return (EINVAL);
2694 
2695 	/* XXX if cm->cmsg_len is not aligned, control->m_len can become <0 */
2696 	for (; control->m_len > 0; control->m_data += CMSG_ALIGN(cm->cmsg_len),
2697 	    control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
2698 		int error;
2699 
2700 		if (control->m_len < CMSG_LEN(0))
2701 			return (EINVAL);
2702 
2703 		cm = mtod(control, struct cmsghdr *);
2704 		if (cm->cmsg_len == 0 || cm->cmsg_len > control->m_len)
2705 			return (EINVAL);
2706 		if (cm->cmsg_level != IPPROTO_IPV6)
2707 			continue;
2708 
2709 		error = ip6_setpktopt(cm->cmsg_type, CMSG_DATA(cm),
2710 		    cm->cmsg_len - CMSG_LEN(0), opt, cred, 0, 1, uproto);
2711 		if (error)
2712 			return (error);
2713 	}
2714 
2715 	return (0);
2716 }
2717 
2718 /*
2719  * Set a particular packet option, as a sticky option or an ancillary data
2720  * item.  "len" can be 0 only when it's a sticky option.
2721  * We have 4 cases of combination of "sticky" and "cmsg":
2722  * "sticky=0, cmsg=0": impossible
2723  * "sticky=0, cmsg=1": RFC2292 or RFC3542 ancillary data
2724  * "sticky=1, cmsg=0": RFC3542 socket option
2725  * "sticky=1, cmsg=1": RFC2292 socket option
2726  */
2727 static int
2728 ip6_setpktopt(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
2729     kauth_cred_t cred, int sticky, int cmsg, int uproto)
2730 {
2731 	int minmtupolicy;
2732 	int error;
2733 
2734 	if (!sticky && !cmsg) {
2735 #ifdef DIAGNOSTIC
2736 		printf("ip6_setpktopt: impossible case\n");
2737 #endif
2738 		return (EINVAL);
2739 	}
2740 
2741 	/*
2742 	 * IPV6_2292xxx is for backward compatibility to RFC2292, and should
2743 	 * not be specified in the context of RFC3542.  Conversely,
2744 	 * RFC3542 types should not be specified in the context of RFC2292.
2745 	 */
2746 	if (!cmsg) {
2747 		switch (optname) {
2748 		case IPV6_2292PKTINFO:
2749 		case IPV6_2292HOPLIMIT:
2750 		case IPV6_2292NEXTHOP:
2751 		case IPV6_2292HOPOPTS:
2752 		case IPV6_2292DSTOPTS:
2753 		case IPV6_2292RTHDR:
2754 		case IPV6_2292PKTOPTIONS:
2755 			return (ENOPROTOOPT);
2756 		}
2757 	}
2758 	if (sticky && cmsg) {
2759 		switch (optname) {
2760 		case IPV6_PKTINFO:
2761 		case IPV6_HOPLIMIT:
2762 		case IPV6_NEXTHOP:
2763 		case IPV6_HOPOPTS:
2764 		case IPV6_DSTOPTS:
2765 		case IPV6_RTHDRDSTOPTS:
2766 		case IPV6_RTHDR:
2767 		case IPV6_USE_MIN_MTU:
2768 		case IPV6_DONTFRAG:
2769 		case IPV6_OTCLASS:
2770 		case IPV6_TCLASS:
2771 		case IPV6_PREFER_TEMPADDR: /* XXX not an RFC3542 option */
2772 			return (ENOPROTOOPT);
2773 		}
2774 	}
2775 
2776 	switch (optname) {
2777 #ifdef RFC2292
2778 	case IPV6_2292PKTINFO:
2779 #endif
2780 	case IPV6_PKTINFO:
2781 	{
2782 		struct ifnet *ifp = NULL;
2783 		struct in6_pktinfo *pktinfo;
2784 
2785 		if (len != sizeof(struct in6_pktinfo))
2786 			return (EINVAL);
2787 
2788 		pktinfo = (struct in6_pktinfo *)buf;
2789 
2790 		/*
2791 		 * An application can clear any sticky IPV6_PKTINFO option by
2792 		 * doing a "regular" setsockopt with ipi6_addr being
2793 		 * in6addr_any and ipi6_ifindex being zero.
2794 		 * [RFC 3542, Section 6]
2795 		 */
2796 		if (optname == IPV6_PKTINFO && opt->ip6po_pktinfo &&
2797 		    pktinfo->ipi6_ifindex == 0 &&
2798 		    IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
2799 			ip6_clearpktopts(opt, optname);
2800 			break;
2801 		}
2802 
2803 		if (uproto == IPPROTO_TCP && optname == IPV6_PKTINFO &&
2804 		    sticky && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
2805 			return (EINVAL);
2806 		}
2807 
2808 		/* Validate the interface index if specified. */
2809 		if (pktinfo->ipi6_ifindex) {
2810 			ifp = if_byindex(pktinfo->ipi6_ifindex);
2811 			if (ifp == NULL)
2812 				return (ENXIO);
2813 		}
2814 
2815 		/*
2816 		 * We store the address anyway, and let in6_selectsrc()
2817 		 * validate the specified address.  This is because ipi6_addr
2818 		 * may not have enough information about its scope zone, and
2819 		 * we may need additional information (such as outgoing
2820 		 * interface or the scope zone of a destination address) to
2821 		 * disambiguate the scope.
2822 		 * XXX: the delay of the validation may confuse the
2823 		 * application when it is used as a sticky option.
2824 		 */
2825 		if (opt->ip6po_pktinfo == NULL) {
2826 			opt->ip6po_pktinfo = malloc(sizeof(*pktinfo),
2827 			    M_IP6OPT, M_NOWAIT);
2828 			if (opt->ip6po_pktinfo == NULL)
2829 				return (ENOBUFS);
2830 		}
2831 		memcpy(opt->ip6po_pktinfo, pktinfo, sizeof(*pktinfo));
2832 		break;
2833 	}
2834 
2835 #ifdef RFC2292
2836 	case IPV6_2292HOPLIMIT:
2837 #endif
2838 	case IPV6_HOPLIMIT:
2839 	{
2840 		int *hlimp;
2841 
2842 		/*
2843 		 * RFC 3542 deprecated the usage of sticky IPV6_HOPLIMIT
2844 		 * to simplify the ordering among hoplimit options.
2845 		 */
2846 		if (optname == IPV6_HOPLIMIT && sticky)
2847 			return (ENOPROTOOPT);
2848 
2849 		if (len != sizeof(int))
2850 			return (EINVAL);
2851 		hlimp = (int *)buf;
2852 		if (*hlimp < -1 || *hlimp > 255)
2853 			return (EINVAL);
2854 
2855 		opt->ip6po_hlim = *hlimp;
2856 		break;
2857 	}
2858 
2859 	case IPV6_OTCLASS:
2860 		if (len != sizeof(u_int8_t))
2861 			return (EINVAL);
2862 
2863 		opt->ip6po_tclass = *(u_int8_t *)buf;
2864 		break;
2865 
2866 	case IPV6_TCLASS:
2867 	{
2868 		int tclass;
2869 
2870 		if (len != sizeof(int))
2871 			return (EINVAL);
2872 		tclass = *(int *)buf;
2873 		if (tclass < -1 || tclass > 255)
2874 			return (EINVAL);
2875 
2876 		opt->ip6po_tclass = tclass;
2877 		break;
2878 	}
2879 
2880 #ifdef RFC2292
2881 	case IPV6_2292NEXTHOP:
2882 #endif
2883 	case IPV6_NEXTHOP:
2884 		error = kauth_authorize_network(cred, KAUTH_NETWORK_IPV6,
2885 		    KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL, NULL, NULL);
2886 		if (error)
2887 			return (error);
2888 
2889 		if (len == 0) {	/* just remove the option */
2890 			ip6_clearpktopts(opt, IPV6_NEXTHOP);
2891 			break;
2892 		}
2893 
2894 		/* check if cmsg_len is large enough for sa_len */
2895 		if (len < sizeof(struct sockaddr) || len < *buf)
2896 			return (EINVAL);
2897 
2898 		switch (((struct sockaddr *)buf)->sa_family) {
2899 		case AF_INET6:
2900 		{
2901 			struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)buf;
2902 
2903 			if (sa6->sin6_len != sizeof(struct sockaddr_in6))
2904 				return (EINVAL);
2905 
2906 			if (IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
2907 			    IN6_IS_ADDR_MULTICAST(&sa6->sin6_addr)) {
2908 				return (EINVAL);
2909 			}
2910 			if ((error = sa6_embedscope(sa6, ip6_use_defzone))
2911 			    != 0) {
2912 				return (error);
2913 			}
2914 			break;
2915 		}
2916 		case AF_LINK:	/* eventually be supported? */
2917 		default:
2918 			return (EAFNOSUPPORT);
2919 		}
2920 
2921 		/* turn off the previous option, then set the new option. */
2922 		ip6_clearpktopts(opt, IPV6_NEXTHOP);
2923 		opt->ip6po_nexthop = malloc(*buf, M_IP6OPT, M_NOWAIT);
2924 		if (opt->ip6po_nexthop == NULL)
2925 			return (ENOBUFS);
2926 		memcpy(opt->ip6po_nexthop, buf, *buf);
2927 		break;
2928 
2929 #ifdef RFC2292
2930 	case IPV6_2292HOPOPTS:
2931 #endif
2932 	case IPV6_HOPOPTS:
2933 	{
2934 		struct ip6_hbh *hbh;
2935 		int hbhlen;
2936 
2937 		/*
2938 		 * XXX: We don't allow a non-privileged user to set ANY HbH
2939 		 * options, since per-option restriction has too much
2940 		 * overhead.
2941 		 */
2942 		error = kauth_authorize_network(cred, KAUTH_NETWORK_IPV6,
2943 		    KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL, NULL, NULL);
2944 		if (error)
2945 			return (error);
2946 
2947 		if (len == 0) {
2948 			ip6_clearpktopts(opt, IPV6_HOPOPTS);
2949 			break;	/* just remove the option */
2950 		}
2951 
2952 		/* message length validation */
2953 		if (len < sizeof(struct ip6_hbh))
2954 			return (EINVAL);
2955 		hbh = (struct ip6_hbh *)buf;
2956 		hbhlen = (hbh->ip6h_len + 1) << 3;
2957 		if (len != hbhlen)
2958 			return (EINVAL);
2959 
2960 		/* turn off the previous option, then set the new option. */
2961 		ip6_clearpktopts(opt, IPV6_HOPOPTS);
2962 		opt->ip6po_hbh = malloc(hbhlen, M_IP6OPT, M_NOWAIT);
2963 		if (opt->ip6po_hbh == NULL)
2964 			return (ENOBUFS);
2965 		memcpy(opt->ip6po_hbh, hbh, hbhlen);
2966 
2967 		break;
2968 	}
2969 
2970 #ifdef RFC2292
2971 	case IPV6_2292DSTOPTS:
2972 #endif
2973 	case IPV6_DSTOPTS:
2974 	case IPV6_RTHDRDSTOPTS:
2975 	{
2976 		struct ip6_dest *dest, **newdest = NULL;
2977 		int destlen;
2978 
2979 		/* XXX: see the comment for IPV6_HOPOPTS */
2980 		error = kauth_authorize_network(cred, KAUTH_NETWORK_IPV6,
2981 		    KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL, NULL, NULL);
2982 		if (error)
2983 			return (error);
2984 
2985 		if (len == 0) {
2986 			ip6_clearpktopts(opt, optname);
2987 			break;	/* just remove the option */
2988 		}
2989 
2990 		/* message length validation */
2991 		if (len < sizeof(struct ip6_dest))
2992 			return (EINVAL);
2993 		dest = (struct ip6_dest *)buf;
2994 		destlen = (dest->ip6d_len + 1) << 3;
2995 		if (len != destlen)
2996 			return (EINVAL);
2997 		/*
2998 		 * Determine the position that the destination options header
2999 		 * should be inserted; before or after the routing header.
3000 		 */
3001 		switch (optname) {
3002 		case IPV6_2292DSTOPTS:
3003 			/*
3004 			 * The old advanced API is ambiguous on this point.
3005 			 * Our approach is to determine the position based
3006 			 * according to the existence of a routing header.
3007 			 * Note, however, that this depends on the order of the
3008 			 * extension headers in the ancillary data; the 1st
3009 			 * part of the destination options header must appear
3010 			 * before the routing header in the ancillary data,
3011 			 * too.
3012 			 * RFC3542 solved the ambiguity by introducing
3013 			 * separate ancillary data or option types.
3014 			 */
3015 			if (opt->ip6po_rthdr == NULL)
3016 				newdest = &opt->ip6po_dest1;
3017 			else
3018 				newdest = &opt->ip6po_dest2;
3019 			break;
3020 		case IPV6_RTHDRDSTOPTS:
3021 			newdest = &opt->ip6po_dest1;
3022 			break;
3023 		case IPV6_DSTOPTS:
3024 			newdest = &opt->ip6po_dest2;
3025 			break;
3026 		}
3027 
3028 		/* turn off the previous option, then set the new option. */
3029 		ip6_clearpktopts(opt, optname);
3030 		*newdest = malloc(destlen, M_IP6OPT, M_NOWAIT);
3031 		if (*newdest == NULL)
3032 			return (ENOBUFS);
3033 		memcpy(*newdest, dest, destlen);
3034 
3035 		break;
3036 	}
3037 
3038 #ifdef RFC2292
3039 	case IPV6_2292RTHDR:
3040 #endif
3041 	case IPV6_RTHDR:
3042 	{
3043 		struct ip6_rthdr *rth;
3044 		int rthlen;
3045 
3046 		if (len == 0) {
3047 			ip6_clearpktopts(opt, IPV6_RTHDR);
3048 			break;	/* just remove the option */
3049 		}
3050 
3051 		/* message length validation */
3052 		if (len < sizeof(struct ip6_rthdr))
3053 			return (EINVAL);
3054 		rth = (struct ip6_rthdr *)buf;
3055 		rthlen = (rth->ip6r_len + 1) << 3;
3056 		if (len != rthlen)
3057 			return (EINVAL);
3058 		switch (rth->ip6r_type) {
3059 		case IPV6_RTHDR_TYPE_0:
3060 			if (rth->ip6r_len == 0)	/* must contain one addr */
3061 				return (EINVAL);
3062 			if (rth->ip6r_len % 2) /* length must be even */
3063 				return (EINVAL);
3064 			if (rth->ip6r_len / 2 != rth->ip6r_segleft)
3065 				return (EINVAL);
3066 			break;
3067 		default:
3068 			return (EINVAL);	/* not supported */
3069 		}
3070 		/* turn off the previous option */
3071 		ip6_clearpktopts(opt, IPV6_RTHDR);
3072 		opt->ip6po_rthdr = malloc(rthlen, M_IP6OPT, M_NOWAIT);
3073 		if (opt->ip6po_rthdr == NULL)
3074 			return (ENOBUFS);
3075 		memcpy(opt->ip6po_rthdr, rth, rthlen);
3076 		break;
3077 	}
3078 
3079 	case IPV6_USE_MIN_MTU:
3080 		if (len != sizeof(int))
3081 			return (EINVAL);
3082 		minmtupolicy = *(int *)buf;
3083 		if (minmtupolicy != IP6PO_MINMTU_MCASTONLY &&
3084 		    minmtupolicy != IP6PO_MINMTU_DISABLE &&
3085 		    minmtupolicy != IP6PO_MINMTU_ALL) {
3086 			return (EINVAL);
3087 		}
3088 		opt->ip6po_minmtu = minmtupolicy;
3089 		break;
3090 
3091 	case IPV6_DONTFRAG:
3092 		if (len != sizeof(int))
3093 			return (EINVAL);
3094 
3095 		if (uproto == IPPROTO_TCP || *(int *)buf == 0) {
3096 			/*
3097 			 * we ignore this option for TCP sockets.
3098 			 * (RFC3542 leaves this case unspecified.)
3099 			 */
3100 			opt->ip6po_flags &= ~IP6PO_DONTFRAG;
3101 		} else
3102 			opt->ip6po_flags |= IP6PO_DONTFRAG;
3103 		break;
3104 
3105 	case IPV6_PREFER_TEMPADDR:
3106 	{
3107 		int preftemp;
3108 
3109 		if (len != sizeof(int))
3110 			return (EINVAL);
3111 		preftemp = *(int *)buf;
3112 		switch (preftemp) {
3113 		case IP6PO_TEMPADDR_SYSTEM:
3114 		case IP6PO_TEMPADDR_NOTPREFER:
3115 		case IP6PO_TEMPADDR_PREFER:
3116 			break;
3117 		default:
3118 			return (EINVAL);
3119 		}
3120 		opt->ip6po_prefer_tempaddr = preftemp;
3121 		break;
3122 	}
3123 
3124 	default:
3125 		return (ENOPROTOOPT);
3126 	} /* end of switch */
3127 
3128 	return (0);
3129 }
3130 
3131 /*
3132  * Routine called from ip6_output() to loop back a copy of an IP6 multicast
3133  * packet to the input queue of a specified interface.  Note that this
3134  * calls the output routine of the loopback "driver", but with an interface
3135  * pointer that might NOT be lo0ifp -- easier than replicating that code here.
3136  */
3137 void
3138 ip6_mloopback(struct ifnet *ifp, struct mbuf *m,
3139 	const struct sockaddr_in6 *dst)
3140 {
3141 	struct mbuf *copym;
3142 	struct ip6_hdr *ip6;
3143 
3144 	copym = m_copy(m, 0, M_COPYALL);
3145 	if (copym == NULL)
3146 		return;
3147 
3148 	/*
3149 	 * Make sure to deep-copy IPv6 header portion in case the data
3150 	 * is in an mbuf cluster, so that we can safely override the IPv6
3151 	 * header portion later.
3152 	 */
3153 	if ((copym->m_flags & M_EXT) != 0 ||
3154 	    copym->m_len < sizeof(struct ip6_hdr)) {
3155 		copym = m_pullup(copym, sizeof(struct ip6_hdr));
3156 		if (copym == NULL)
3157 			return;
3158 	}
3159 
3160 #ifdef DIAGNOSTIC
3161 	if (copym->m_len < sizeof(*ip6)) {
3162 		m_freem(copym);
3163 		return;
3164 	}
3165 #endif
3166 
3167 	ip6 = mtod(copym, struct ip6_hdr *);
3168 	/*
3169 	 * clear embedded scope identifiers if necessary.
3170 	 * in6_clearscope will touch the addresses only when necessary.
3171 	 */
3172 	in6_clearscope(&ip6->ip6_src);
3173 	in6_clearscope(&ip6->ip6_dst);
3174 
3175 	(void)looutput(ifp, copym, (const struct sockaddr *)dst, NULL);
3176 }
3177 
3178 /*
3179  * Chop IPv6 header off from the payload.
3180  */
3181 static int
3182 ip6_splithdr(struct mbuf *m,  struct ip6_exthdrs *exthdrs)
3183 {
3184 	struct mbuf *mh;
3185 	struct ip6_hdr *ip6;
3186 
3187 	ip6 = mtod(m, struct ip6_hdr *);
3188 	if (m->m_len > sizeof(*ip6)) {
3189 		MGETHDR(mh, M_DONTWAIT, MT_HEADER);
3190 		if (mh == 0) {
3191 			m_freem(m);
3192 			return ENOBUFS;
3193 		}
3194 		M_MOVE_PKTHDR(mh, m);
3195 		MH_ALIGN(mh, sizeof(*ip6));
3196 		m->m_len -= sizeof(*ip6);
3197 		m->m_data += sizeof(*ip6);
3198 		mh->m_next = m;
3199 		m = mh;
3200 		m->m_len = sizeof(*ip6);
3201 		bcopy((void *)ip6, mtod(m, void *), sizeof(*ip6));
3202 	}
3203 	exthdrs->ip6e_ip6 = m;
3204 	return 0;
3205 }
3206 
3207 /*
3208  * Compute IPv6 extension header length.
3209  */
3210 int
3211 ip6_optlen(struct in6pcb *in6p)
3212 {
3213 	int len;
3214 
3215 	if (!in6p->in6p_outputopts)
3216 		return 0;
3217 
3218 	len = 0;
3219 #define elen(x) \
3220     (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
3221 
3222 	len += elen(in6p->in6p_outputopts->ip6po_hbh);
3223 	len += elen(in6p->in6p_outputopts->ip6po_dest1);
3224 	len += elen(in6p->in6p_outputopts->ip6po_rthdr);
3225 	len += elen(in6p->in6p_outputopts->ip6po_dest2);
3226 	return len;
3227 #undef elen
3228 }
3229