xref: /netbsd-src/sys/netinet6/raw_ip6.c (revision 6a493d6bc668897c91594964a732d38505b70cbb)
1 /*	$NetBSD: raw_ip6.c,v 1.112 2013/11/23 14:20:22 christos Exp $	*/
2 /*	$KAME: raw_ip6.c,v 1.82 2001/07/23 18:57:56 jinmei Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)raw_ip.c	8.2 (Berkeley) 1/4/94
62  */
63 
64 #include <sys/cdefs.h>
65 __KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.112 2013/11/23 14:20:22 christos Exp $");
66 
67 #include "opt_ipsec.h"
68 
69 #include <sys/param.h>
70 #include <sys/sysctl.h>
71 #include <sys/malloc.h>
72 #include <sys/mbuf.h>
73 #include <sys/socket.h>
74 #include <sys/protosw.h>
75 #include <sys/socketvar.h>
76 #include <sys/errno.h>
77 #include <sys/systm.h>
78 #include <sys/proc.h>
79 #include <sys/kauth.h>
80 
81 #include <net/if.h>
82 #include <net/route.h>
83 #include <net/if_types.h>
84 #include <net/net_stats.h>
85 
86 #include <netinet/in.h>
87 #include <netinet/in_var.h>
88 #include <netinet/ip6.h>
89 #include <netinet6/ip6_var.h>
90 #include <netinet6/ip6_private.h>
91 #include <netinet6/ip6_mroute.h>
92 #include <netinet/icmp6.h>
93 #include <netinet6/icmp6_private.h>
94 #include <netinet6/in6_pcb.h>
95 #include <netinet6/nd6.h>
96 #include <netinet6/ip6protosw.h>
97 #include <netinet6/scope6_var.h>
98 #include <netinet6/raw_ip6.h>
99 
100 #ifdef IPSEC
101 #include <netipsec/ipsec.h>
102 #include <netipsec/ipsec_var.h>
103 #include <netipsec/ipsec_private.h>
104 #include <netipsec/ipsec6.h>
105 #endif
106 
107 #include "faith.h"
108 #if defined(NFAITH) && 0 < NFAITH
109 #include <net/if_faith.h>
110 #endif
111 
112 extern struct inpcbtable rawcbtable;
113 struct	inpcbtable raw6cbtable;
114 #define ifatoia6(ifa)	((struct in6_ifaddr *)(ifa))
115 
116 /*
117  * Raw interface to IP6 protocol.
118  */
119 
120 static percpu_t *rip6stat_percpu;
121 
122 #define	RIP6_STATINC(x)		_NET_STATINC(rip6stat_percpu, x)
123 
124 static void sysctl_net_inet6_raw6_setup(struct sysctllog **);
125 
126 /*
127  * Initialize raw connection block queue.
128  */
129 void
130 rip6_init(void)
131 {
132 
133 	sysctl_net_inet6_raw6_setup(NULL);
134 	in6_pcbinit(&raw6cbtable, 1, 1);
135 
136 	rip6stat_percpu = percpu_alloc(sizeof(uint64_t) * RIP6_NSTATS);
137 }
138 
139 /*
140  * Setup generic address and protocol structures
141  * for raw_input routine, then pass them along with
142  * mbuf chain.
143  */
144 int
145 rip6_input(struct mbuf **mp, int *offp, int proto)
146 {
147 	struct mbuf *m = *mp;
148 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
149 	struct inpcb_hdr *inph;
150 	struct in6pcb *in6p;
151 	struct in6pcb *last = NULL;
152 	struct sockaddr_in6 rip6src;
153 	struct mbuf *opts = NULL;
154 
155 	RIP6_STATINC(RIP6_STAT_IPACKETS);
156 
157 #if defined(NFAITH) && 0 < NFAITH
158 	if (faithprefix(&ip6->ip6_dst)) {
159 		/* send icmp6 host unreach? */
160 		m_freem(m);
161 		return IPPROTO_DONE;
162 	}
163 #endif
164 
165 	/* Be proactive about malicious use of IPv4 mapped address */
166 	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
167 	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
168 		/* XXX stat */
169 		m_freem(m);
170 		return IPPROTO_DONE;
171 	}
172 
173 	sockaddr_in6_init(&rip6src, &ip6->ip6_src, 0, 0, 0);
174 	if (sa6_recoverscope(&rip6src) != 0) {
175 		/* XXX: should be impossible. */
176 		m_freem(m);
177 		return IPPROTO_DONE;
178 	}
179 
180 	TAILQ_FOREACH(inph, &raw6cbtable.inpt_queue, inph_queue) {
181 		in6p = (struct in6pcb *)inph;
182 		if (in6p->in6p_af != AF_INET6)
183 			continue;
184 		if (in6p->in6p_ip6.ip6_nxt &&
185 		    in6p->in6p_ip6.ip6_nxt != proto)
186 			continue;
187 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) &&
188 		    !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst))
189 			continue;
190 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) &&
191 		    !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src))
192 			continue;
193 		if (in6p->in6p_cksum != -1) {
194 			RIP6_STATINC(RIP6_STAT_ISUM);
195 			if (in6_cksum(m, proto, *offp,
196 			    m->m_pkthdr.len - *offp)) {
197 				RIP6_STATINC(RIP6_STAT_BADSUM);
198 				continue;
199 			}
200 		}
201 		if (last) {
202 			struct	mbuf *n;
203 
204 #ifdef IPSEC
205 			/*
206 			 * Check AH/ESP integrity
207 			 */
208 			if (!ipsec6_in_reject(m,last))
209 #endif /* IPSEC */
210 			if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
211 				if (last->in6p_flags & IN6P_CONTROLOPTS)
212 					ip6_savecontrol(last, &opts, ip6, n);
213 				/* strip intermediate headers */
214 				m_adj(n, *offp);
215 				if (sbappendaddr(&last->in6p_socket->so_rcv,
216 				    (struct sockaddr *)&rip6src, n, opts) == 0) {
217 					/* should notify about lost packet */
218 					m_freem(n);
219 					if (opts)
220 						m_freem(opts);
221 					RIP6_STATINC(RIP6_STAT_FULLSOCK);
222 				} else
223 					sorwakeup(last->in6p_socket);
224 				opts = NULL;
225 			}
226 		}
227 		last = in6p;
228 	}
229 #ifdef IPSEC
230 	if (last && ipsec6_in_reject(m, last)) {
231 		m_freem(m);
232 		/*
233 		 * XXX ipsec6_in_reject update stat if there is an error
234 		 * so we just need to update stats by hand in the case of last is
235 		 * NULL
236 		 */
237 		if (!last)
238 			IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
239 			IP6_STATDEC(IP6_STAT_DELIVERED);
240 			/* do not inject data into pcb */
241 		} else
242 #endif /* IPSEC */
243 	if (last) {
244 		if (last->in6p_flags & IN6P_CONTROLOPTS)
245 			ip6_savecontrol(last, &opts, ip6, m);
246 		/* strip intermediate headers */
247 		m_adj(m, *offp);
248 		if (sbappendaddr(&last->in6p_socket->so_rcv,
249 		    (struct sockaddr *)&rip6src, m, opts) == 0) {
250 			m_freem(m);
251 			if (opts)
252 				m_freem(opts);
253 			RIP6_STATINC(RIP6_STAT_FULLSOCK);
254 		} else
255 			sorwakeup(last->in6p_socket);
256 	} else {
257 		RIP6_STATINC(RIP6_STAT_NOSOCK);
258 		if (m->m_flags & M_MCAST)
259 			RIP6_STATINC(RIP6_STAT_NOSOCKMCAST);
260 		if (proto == IPPROTO_NONE)
261 			m_freem(m);
262 		else {
263 			u_int8_t *prvnxtp = ip6_get_prevhdr(m, *offp); /* XXX */
264 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_protounknown);
265 			icmp6_error(m, ICMP6_PARAM_PROB,
266 			    ICMP6_PARAMPROB_NEXTHEADER,
267 			    prvnxtp - mtod(m, u_int8_t *));
268 		}
269 		IP6_STATDEC(IP6_STAT_DELIVERED);
270 	}
271 	return IPPROTO_DONE;
272 }
273 
274 void *
275 rip6_ctlinput(int cmd, const struct sockaddr *sa, void *d)
276 {
277 	struct ip6_hdr *ip6;
278 	struct ip6ctlparam *ip6cp = NULL;
279 	const struct sockaddr_in6 *sa6_src = NULL;
280 	void *cmdarg;
281 	void (*notify)(struct in6pcb *, int) = in6_rtchange;
282 	int nxt;
283 
284 	if (sa->sa_family != AF_INET6 ||
285 	    sa->sa_len != sizeof(struct sockaddr_in6))
286 		return NULL;
287 
288 	if ((unsigned)cmd >= PRC_NCMDS)
289 		return NULL;
290 	if (PRC_IS_REDIRECT(cmd))
291 		notify = in6_rtchange, d = NULL;
292 	else if (cmd == PRC_HOSTDEAD)
293 		d = NULL;
294 	else if (cmd == PRC_MSGSIZE)
295 		; /* special code is present, see below */
296 	else if (inet6ctlerrmap[cmd] == 0)
297 		return NULL;
298 
299 	/* if the parameter is from icmp6, decode it. */
300 	if (d != NULL) {
301 		ip6cp = (struct ip6ctlparam *)d;
302 		ip6 = ip6cp->ip6c_ip6;
303 		cmdarg = ip6cp->ip6c_cmdarg;
304 		sa6_src = ip6cp->ip6c_src;
305 		nxt = ip6cp->ip6c_nxt;
306 	} else {
307 		ip6 = NULL;
308 		cmdarg = NULL;
309 		sa6_src = &sa6_any;
310 		nxt = -1;
311 	}
312 
313 	if (ip6 && cmd == PRC_MSGSIZE) {
314 		const struct sockaddr_in6 *sa6 = (const struct sockaddr_in6 *)sa;
315 		int valid = 0;
316 		struct in6pcb *in6p;
317 
318 		/*
319 		 * Check to see if we have a valid raw IPv6 socket
320 		 * corresponding to the address in the ICMPv6 message
321 		 * payload, and the protocol (ip6_nxt) meets the socket.
322 		 * XXX chase extension headers, or pass final nxt value
323 		 * from icmp6_notify_error()
324 		 */
325 		in6p = NULL;
326 		in6p = in6_pcblookup_connect(&raw6cbtable, &sa6->sin6_addr, 0,
327 					     (const struct in6_addr *)&sa6_src->sin6_addr, 0, 0, 0);
328 #if 0
329 		if (!in6p) {
330 			/*
331 			 * As the use of sendto(2) is fairly popular,
332 			 * we may want to allow non-connected pcb too.
333 			 * But it could be too weak against attacks...
334 			 * We should at least check if the local
335 			 * address (= s) is really ours.
336 			 */
337 			in6p = in6_pcblookup_bind(&raw6cbtable,
338 			    &sa6->sin6_addr, 0, 0);
339 		}
340 #endif
341 
342 		if (in6p && in6p->in6p_ip6.ip6_nxt &&
343 		    in6p->in6p_ip6.ip6_nxt == nxt)
344 			valid++;
345 
346 		/*
347 		 * Depending on the value of "valid" and routing table
348 		 * size (mtudisc_{hi,lo}wat), we will:
349 		 * - recalculate the new MTU and create the
350 		 *   corresponding routing entry, or
351 		 * - ignore the MTU change notification.
352 		 */
353 		icmp6_mtudisc_update((struct ip6ctlparam *)d, valid);
354 
355 		/*
356 		 * regardless of if we called icmp6_mtudisc_update(),
357 		 * we need to call in6_pcbnotify(), to notify path MTU
358 		 * change to the userland (RFC3542), because some
359 		 * unconnected sockets may share the same destination
360 		 * and want to know the path MTU.
361 		 */
362 	}
363 
364 	(void) in6_pcbnotify(&raw6cbtable, sa, 0,
365 	    (const struct sockaddr *)sa6_src, 0, cmd, cmdarg, notify);
366 	return NULL;
367 }
368 
369 /*
370  * Generate IPv6 header and pass packet to ip6_output.
371  * Tack on options user may have setup with control call.
372  */
373 int
374 rip6_output(struct mbuf *m, struct socket * const so,
375     struct sockaddr_in6 * const dstsock, struct mbuf * const control)
376 {
377 	struct in6_addr *dst;
378 	struct ip6_hdr *ip6;
379 	struct in6pcb *in6p;
380 	u_int	plen = m->m_pkthdr.len;
381 	int error = 0;
382 	struct ip6_pktopts opt, *optp = NULL;
383 	struct ifnet *oifp = NULL;
384 	int type, code;		/* for ICMPv6 output statistics only */
385 	int scope_ambiguous = 0;
386 	struct in6_addr *in6a;
387 
388 	in6p = sotoin6pcb(so);
389 
390 	dst = &dstsock->sin6_addr;
391 	if (control) {
392 		if ((error = ip6_setpktopts(control, &opt,
393 		    in6p->in6p_outputopts,
394 		    kauth_cred_get(), so->so_proto->pr_protocol)) != 0) {
395 			goto bad;
396 		}
397 		optp = &opt;
398 	} else
399 		optp = in6p->in6p_outputopts;
400 
401 	/*
402 	 * Check and convert scope zone ID into internal form.
403 	 * XXX: we may still need to determine the zone later.
404 	 */
405 	if (!(so->so_state & SS_ISCONNECTED)) {
406 		if (dstsock->sin6_scope_id == 0 && !ip6_use_defzone)
407 			scope_ambiguous = 1;
408 		if ((error = sa6_embedscope(dstsock, ip6_use_defzone)) != 0)
409 			goto bad;
410 	}
411 
412 	/*
413 	 * For an ICMPv6 packet, we should know its type and code
414 	 * to update statistics.
415 	 */
416 	if (so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
417 		struct icmp6_hdr *icmp6;
418 		if (m->m_len < sizeof(struct icmp6_hdr) &&
419 		    (m = m_pullup(m, sizeof(struct icmp6_hdr))) == NULL) {
420 			error = ENOBUFS;
421 			goto bad;
422 		}
423 		icmp6 = mtod(m, struct icmp6_hdr *);
424 		type = icmp6->icmp6_type;
425 		code = icmp6->icmp6_code;
426 	} else {
427 		type = 0;
428 		code = 0;
429 	}
430 
431 	M_PREPEND(m, sizeof(*ip6), M_DONTWAIT);
432 	if (!m) {
433 		error = ENOBUFS;
434 		goto bad;
435 	}
436 	ip6 = mtod(m, struct ip6_hdr *);
437 
438 	/*
439 	 * Next header might not be ICMP6 but use its pseudo header anyway.
440 	 */
441 	ip6->ip6_dst = *dst;
442 
443 	/*
444 	 * Source address selection.
445 	 */
446 	if ((in6a = in6_selectsrc(dstsock, optp, in6p->in6p_moptions,
447 	    &in6p->in6p_route, &in6p->in6p_laddr, &oifp,
448 	    &error)) == 0) {
449 		if (error == 0)
450 			error = EADDRNOTAVAIL;
451 		goto bad;
452 	}
453 	ip6->ip6_src = *in6a;
454 
455 	if (oifp && scope_ambiguous) {
456 		/*
457 		 * Application should provide a proper zone ID or the use of
458 		 * default zone IDs should be enabled.  Unfortunately, some
459 		 * applications do not behave as it should, so we need a
460 		 * workaround.  Even if an appropriate ID is not determined
461 		 * (when it's required), if we can determine the outgoing
462 		 * interface. determine the zone ID based on the interface.
463 		 */
464 		error = in6_setscope(&dstsock->sin6_addr, oifp, NULL);
465 		if (error != 0)
466 			goto bad;
467 	}
468 	ip6->ip6_dst = dstsock->sin6_addr;
469 
470 	/* fill in the rest of the IPv6 header fields */
471 	ip6->ip6_flow = in6p->in6p_flowinfo & IPV6_FLOWINFO_MASK;
472 	ip6->ip6_vfc  &= ~IPV6_VERSION_MASK;
473 	ip6->ip6_vfc  |= IPV6_VERSION;
474 	/* ip6_plen will be filled in ip6_output, so not fill it here. */
475 	ip6->ip6_nxt   = in6p->in6p_ip6.ip6_nxt;
476 	ip6->ip6_hlim = in6_selecthlim(in6p, oifp);
477 
478 	if (so->so_proto->pr_protocol == IPPROTO_ICMPV6 ||
479 	    in6p->in6p_cksum != -1) {
480 		int off;
481 		u_int16_t sum;
482 
483 		/* compute checksum */
484 		if (so->so_proto->pr_protocol == IPPROTO_ICMPV6)
485 			off = offsetof(struct icmp6_hdr, icmp6_cksum);
486 		else
487 			off = in6p->in6p_cksum;
488 		if (plen < off + 1) {
489 			error = EINVAL;
490 			goto bad;
491 		}
492 		off += sizeof(struct ip6_hdr);
493 
494 		sum = 0;
495 		m = m_copyback_cow(m, off, sizeof(sum), (void *)&sum,
496 		    M_DONTWAIT);
497 		if (m == NULL) {
498 			error = ENOBUFS;
499 			goto bad;
500 		}
501 		sum = in6_cksum(m, ip6->ip6_nxt, sizeof(*ip6), plen);
502 		m = m_copyback_cow(m, off, sizeof(sum), (void *)&sum,
503 		    M_DONTWAIT);
504 		if (m == NULL) {
505 			error = ENOBUFS;
506 			goto bad;
507 		}
508 	}
509 
510 	error = ip6_output(m, optp, &in6p->in6p_route, 0,
511 	    in6p->in6p_moptions, so, &oifp);
512 	if (so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
513 		if (oifp)
514 			icmp6_ifoutstat_inc(oifp, type, code);
515 		ICMP6_STATINC(ICMP6_STAT_OUTHIST + type);
516 	} else
517 		RIP6_STATINC(RIP6_STAT_OPACKETS);
518 
519 	goto freectl;
520 
521  bad:
522 	if (m)
523 		m_freem(m);
524 
525  freectl:
526 	if (control) {
527 		ip6_clearpktopts(&opt, -1);
528 		m_freem(control);
529 	}
530 	return error;
531 }
532 
533 /*
534  * Raw IPv6 socket option processing.
535  */
536 int
537 rip6_ctloutput(int op, struct socket *so, struct sockopt *sopt)
538 {
539 	int error = 0;
540 
541 	if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_NOHEADER) {
542 		int optval;
543 
544 		/* need to fiddle w/ opt(IPPROTO_IPV6, IPV6_CHECKSUM)? */
545 		if (op == PRCO_GETOPT) {
546 			optval = 1;
547 			error = sockopt_set(sopt, &optval, sizeof(optval));
548 		} else if (op == PRCO_SETOPT) {
549 			error = sockopt_getint(sopt, &optval);
550 			if (error)
551 				goto out;
552 			if (optval == 0)
553 				error = EINVAL;
554 		}
555 
556 		goto out;
557 	} else if (sopt->sopt_level != IPPROTO_IPV6)
558 		return ip6_ctloutput(op, so, sopt);
559 
560 	switch (sopt->sopt_name) {
561 	case MRT6_INIT:
562 	case MRT6_DONE:
563 	case MRT6_ADD_MIF:
564 	case MRT6_DEL_MIF:
565 	case MRT6_ADD_MFC:
566 	case MRT6_DEL_MFC:
567 	case MRT6_PIM:
568 		if (op == PRCO_SETOPT)
569 			error = ip6_mrouter_set(so, sopt);
570 		else if (op == PRCO_GETOPT)
571 			error = ip6_mrouter_get(so, sopt);
572 		else
573 			error = EINVAL;
574 		break;
575 	case IPV6_CHECKSUM:
576 		return ip6_raw_ctloutput(op, so, sopt);
577 	default:
578 		return ip6_ctloutput(op, so, sopt);
579 	}
580  out:
581 	return error;
582 }
583 
584 extern	u_long rip6_sendspace;
585 extern	u_long rip6_recvspace;
586 
587 int
588 rip6_usrreq(struct socket *so, int req, struct mbuf *m,
589 	struct mbuf *nam, struct mbuf *control, struct lwp *l)
590 {
591 	struct in6pcb *in6p = sotoin6pcb(so);
592 	int s;
593 	int error = 0;
594 
595 	if (req == PRU_CONTROL)
596 		return in6_control(so, (u_long)m, (void *)nam,
597 		    (struct ifnet *)control, l);
598 
599 	if (req == PRU_PURGEIF) {
600 		mutex_enter(softnet_lock);
601 		in6_pcbpurgeif0(&raw6cbtable, (struct ifnet *)control);
602 		in6_purgeif((struct ifnet *)control);
603 		in6_pcbpurgeif(&raw6cbtable, (struct ifnet *)control);
604 		mutex_exit(softnet_lock);
605 		return 0;
606 	}
607 
608 	switch (req) {
609 	case PRU_ATTACH:
610 		error = kauth_authorize_network(l->l_cred,
611 		    KAUTH_NETWORK_SOCKET, KAUTH_REQ_NETWORK_SOCKET_RAWSOCK,
612 		    KAUTH_ARG(AF_INET6),
613 		    KAUTH_ARG(SOCK_RAW),
614 		    KAUTH_ARG(so->so_proto->pr_protocol));
615 		sosetlock(so);
616 		if (in6p != NULL)
617 			panic("rip6_attach");
618 		if (error) {
619 			break;
620 		}
621 		s = splsoftnet();
622 		error = soreserve(so, rip6_sendspace, rip6_recvspace);
623 		if (error != 0) {
624 			splx(s);
625 			break;
626 		}
627 		if ((error = in6_pcballoc(so, &raw6cbtable)) != 0) {
628 			splx(s);
629 			break;
630 		}
631 		splx(s);
632 		in6p = sotoin6pcb(so);
633 		in6p->in6p_ip6.ip6_nxt = (long)nam;
634 		in6p->in6p_cksum = -1;
635 
636 		in6p->in6p_icmp6filt = malloc(sizeof(struct icmp6_filter),
637 			M_PCB, M_NOWAIT);
638 		if (in6p->in6p_icmp6filt == NULL) {
639 			in6_pcbdetach(in6p);
640 			error = ENOMEM;
641 			break;
642 		}
643 		ICMP6_FILTER_SETPASSALL(in6p->in6p_icmp6filt);
644 		break;
645 
646 	case PRU_DISCONNECT:
647 		if ((so->so_state & SS_ISCONNECTED) == 0) {
648 			error = ENOTCONN;
649 			break;
650 		}
651 		in6p->in6p_faddr = in6addr_any;
652 		so->so_state &= ~SS_ISCONNECTED;	/* XXX */
653 		break;
654 
655 	case PRU_ABORT:
656 		soisdisconnected(so);
657 		/* Fallthrough */
658 	case PRU_DETACH:
659 		if (in6p == NULL)
660 			panic("rip6_detach");
661 		if (so == ip6_mrouter)
662 			ip6_mrouter_done();
663 		/* xxx: RSVP */
664 		if (in6p->in6p_icmp6filt != NULL) {
665 			free(in6p->in6p_icmp6filt, M_PCB);
666 			in6p->in6p_icmp6filt = NULL;
667 		}
668 		in6_pcbdetach(in6p);
669 		break;
670 
671 	case PRU_BIND:
672 	    {
673 		struct sockaddr_in6 *addr = mtod(nam, struct sockaddr_in6 *);
674 		struct ifaddr *ia = NULL;
675 
676 		if (nam->m_len != sizeof(*addr)) {
677 			error = EINVAL;
678 			break;
679 		}
680 		if (TAILQ_EMPTY(&ifnet) || addr->sin6_family != AF_INET6) {
681 			error = EADDRNOTAVAIL;
682 			break;
683 		}
684 		if ((error = sa6_embedscope(addr, ip6_use_defzone)) != 0)
685 			break;
686 
687 		/*
688 		 * we don't support mapped address here, it would confuse
689 		 * users so reject it
690 		 */
691 		if (IN6_IS_ADDR_V4MAPPED(&addr->sin6_addr)) {
692 			error = EADDRNOTAVAIL;
693 			break;
694 		}
695 		if (!IN6_IS_ADDR_UNSPECIFIED(&addr->sin6_addr) &&
696 		    (ia = ifa_ifwithaddr((struct sockaddr *)addr)) == 0) {
697 			error = EADDRNOTAVAIL;
698 			break;
699 		}
700 		if (ia && ((struct in6_ifaddr *)ia)->ia6_flags &
701 		    (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY|
702 		     IN6_IFF_DETACHED|IN6_IFF_DEPRECATED)) {
703 			error = EADDRNOTAVAIL;
704 			break;
705 		}
706 		in6p->in6p_laddr = addr->sin6_addr;
707 		break;
708 	    }
709 
710 	case PRU_CONNECT:
711 	{
712 		struct sockaddr_in6 *addr = mtod(nam, struct sockaddr_in6 *);
713 		struct in6_addr *in6a = NULL;
714 		struct ifnet *ifp = NULL;
715 		int scope_ambiguous = 0;
716 
717 		if (nam->m_len != sizeof(*addr)) {
718 			error = EINVAL;
719 			break;
720 		}
721 		if (TAILQ_EMPTY(&ifnet)) {
722 			error = EADDRNOTAVAIL;
723 			break;
724 		}
725 		if (addr->sin6_family != AF_INET6) {
726 			error = EAFNOSUPPORT;
727 			break;
728 		}
729 
730 		/*
731 		 * Application should provide a proper zone ID or the use of
732 		 * default zone IDs should be enabled.  Unfortunately, some
733 		 * applications do not behave as it should, so we need a
734 		 * workaround.  Even if an appropriate ID is not determined,
735 		 * we'll see if we can determine the outgoing interface.  If we
736 		 * can, determine the zone ID based on the interface below.
737 		 */
738 		if (addr->sin6_scope_id == 0 && !ip6_use_defzone)
739 			scope_ambiguous = 1;
740 		if ((error = sa6_embedscope(addr, ip6_use_defzone)) != 0)
741 			return error;
742 
743 		/* Source address selection. XXX: need pcblookup? */
744 		in6a = in6_selectsrc(addr, in6p->in6p_outputopts,
745 		    in6p->in6p_moptions, &in6p->in6p_route,
746 		    &in6p->in6p_laddr, &ifp, &error);
747 		if (in6a == NULL) {
748 			if (error == 0)
749 				error = EADDRNOTAVAIL;
750 			break;
751 		}
752 		/* XXX: see above */
753 		if (ifp && scope_ambiguous &&
754 		    (error = in6_setscope(&addr->sin6_addr, ifp, NULL)) != 0) {
755 			break;
756 		}
757 		in6p->in6p_laddr = *in6a;
758 		in6p->in6p_faddr = addr->sin6_addr;
759 		soisconnected(so);
760 		break;
761 	}
762 
763 	case PRU_CONNECT2:
764 		error = EOPNOTSUPP;
765 		break;
766 
767 	/*
768 	 * Mark the connection as being incapable of futther input.
769 	 */
770 	case PRU_SHUTDOWN:
771 		socantsendmore(so);
772 		break;
773 	/*
774 	 * Ship a packet out. The appropriate raw output
775 	 * routine handles any messaging necessary.
776 	 */
777 	case PRU_SEND:
778 	{
779 		struct sockaddr_in6 tmp;
780 		struct sockaddr_in6 *dst;
781 
782 		/* always copy sockaddr to avoid overwrites */
783 		if (so->so_state & SS_ISCONNECTED) {
784 			if (nam) {
785 				error = EISCONN;
786 				break;
787 			}
788 			/* XXX */
789 			sockaddr_in6_init(&tmp, &in6p->in6p_faddr, 0, 0, 0);
790 			dst = &tmp;
791 		} else {
792 			if (nam == NULL) {
793 				error = ENOTCONN;
794 				break;
795 			}
796 			if (nam->m_len != sizeof(tmp)) {
797 				error = EINVAL;
798 				break;
799 			}
800 
801 			tmp = *mtod(nam, struct sockaddr_in6 *);
802 			dst = &tmp;
803 
804 			if (dst->sin6_family != AF_INET6) {
805 				error = EAFNOSUPPORT;
806 				break;
807 			}
808 		}
809 		error = rip6_output(m, so, dst, control);
810 		m = NULL;
811 		break;
812 	}
813 
814 	case PRU_SENSE:
815 		/*
816 		 * stat: don't bother with a blocksize
817 		 */
818 		return 0;
819 	/*
820 	 * Not supported.
821 	 */
822 	case PRU_RCVOOB:
823 	case PRU_RCVD:
824 	case PRU_LISTEN:
825 	case PRU_ACCEPT:
826 	case PRU_SENDOOB:
827 		error = EOPNOTSUPP;
828 		break;
829 
830 	case PRU_SOCKADDR:
831 		in6_setsockaddr(in6p, nam);
832 		break;
833 
834 	case PRU_PEERADDR:
835 		in6_setpeeraddr(in6p, nam);
836 		break;
837 
838 	default:
839 		panic("rip6_usrreq");
840 	}
841 	if (m != NULL)
842 		m_freem(m);
843 	return error;
844 }
845 
846 static int
847 sysctl_net_inet6_raw6_stats(SYSCTLFN_ARGS)
848 {
849 
850 	return (NETSTAT_SYSCTL(rip6stat_percpu, RIP6_NSTATS));
851 }
852 
853 static void
854 sysctl_net_inet6_raw6_setup(struct sysctllog **clog)
855 {
856 
857 	sysctl_createv(clog, 0, NULL, NULL,
858 		       CTLFLAG_PERMANENT,
859 		       CTLTYPE_NODE, "net", NULL,
860 		       NULL, 0, NULL, 0,
861 		       CTL_NET, CTL_EOL);
862 	sysctl_createv(clog, 0, NULL, NULL,
863 		       CTLFLAG_PERMANENT,
864 		       CTLTYPE_NODE, "inet6", NULL,
865 		       NULL, 0, NULL, 0,
866 		       CTL_NET, PF_INET6, CTL_EOL);
867 	sysctl_createv(clog, 0, NULL, NULL,
868 		       CTLFLAG_PERMANENT,
869 		       CTLTYPE_NODE, "raw6",
870 		       SYSCTL_DESCR("Raw IPv6 settings"),
871 		       NULL, 0, NULL, 0,
872 		       CTL_NET, PF_INET6, IPPROTO_RAW, CTL_EOL);
873 
874 	sysctl_createv(clog, 0, NULL, NULL,
875 		       CTLFLAG_PERMANENT,
876 		       CTLTYPE_STRUCT, "pcblist",
877 		       SYSCTL_DESCR("Raw IPv6 control block list"),
878 		       sysctl_inpcblist, 0, &raw6cbtable, 0,
879 		       CTL_NET, PF_INET6, IPPROTO_RAW,
880 		       CTL_CREATE, CTL_EOL);
881 	sysctl_createv(clog, 0, NULL, NULL,
882 		       CTLFLAG_PERMANENT,
883 		       CTLTYPE_STRUCT, "stats",
884 		       SYSCTL_DESCR("Raw IPv6 statistics"),
885 		       sysctl_net_inet6_raw6_stats, 0, NULL, 0,
886 		       CTL_NET, PF_INET6, IPPROTO_RAW, RAW6CTL_STATS,
887 		       CTL_EOL);
888 }
889