xref: /netbsd-src/sys/netinet6/raw_ip6.c (revision c38e7cc395b1472a774ff828e46123de44c628e9)
1 /*	$NetBSD: raw_ip6.c,v 1.171 2018/04/29 07:05:13 maxv Exp $	*/
2 /*	$KAME: raw_ip6.c,v 1.82 2001/07/23 18:57:56 jinmei Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)raw_ip.c	8.2 (Berkeley) 1/4/94
62  */
63 
64 #include <sys/cdefs.h>
65 __KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.171 2018/04/29 07:05:13 maxv Exp $");
66 
67 #ifdef _KERNEL_OPT
68 #include "opt_ipsec.h"
69 #include "opt_net_mpsafe.h"
70 #endif
71 
72 #include <sys/param.h>
73 #include <sys/sysctl.h>
74 #include <sys/mbuf.h>
75 #include <sys/socket.h>
76 #include <sys/protosw.h>
77 #include <sys/socketvar.h>
78 #include <sys/systm.h>
79 #include <sys/proc.h>
80 #include <sys/kauth.h>
81 #include <sys/kmem.h>
82 
83 #include <net/if.h>
84 #include <net/if_types.h>
85 #include <net/net_stats.h>
86 
87 #include <netinet/in.h>
88 #include <netinet/in_var.h>
89 #include <netinet/ip6.h>
90 #include <netinet6/ip6_var.h>
91 #include <netinet6/ip6_private.h>
92 #include <netinet6/ip6_mroute.h>
93 #include <netinet/icmp6.h>
94 #include <netinet6/icmp6_private.h>
95 #include <netinet6/in6_pcb.h>
96 #include <netinet6/ip6protosw.h>
97 #include <netinet6/scope6_var.h>
98 #include <netinet6/raw_ip6.h>
99 
100 #ifdef IPSEC
101 #include <netipsec/ipsec.h>
102 #include <netipsec/ipsec6.h>
103 #endif
104 
105 #include "faith.h"
106 #if defined(NFAITH) && 0 < NFAITH
107 #include <net/if_faith.h>
108 #endif
109 
110 extern struct inpcbtable rawcbtable;
111 struct	inpcbtable raw6cbtable;
112 #define ifatoia6(ifa)	((struct in6_ifaddr *)(ifa))
113 
114 /*
115  * Raw interface to IP6 protocol.
116  */
117 
118 static percpu_t *rip6stat_percpu;
119 
120 #define	RIP6_STATINC(x)		_NET_STATINC(rip6stat_percpu, x)
121 
122 static void sysctl_net_inet6_raw6_setup(struct sysctllog **);
123 
124 /*
125  * Initialize raw connection block queue.
126  */
127 void
128 rip6_init(void)
129 {
130 
131 	sysctl_net_inet6_raw6_setup(NULL);
132 	in6_pcbinit(&raw6cbtable, 1, 1);
133 
134 	rip6stat_percpu = percpu_alloc(sizeof(uint64_t) * RIP6_NSTATS);
135 }
136 
137 /*
138  * Setup generic address and protocol structures
139  * for raw_input routine, then pass them along with
140  * mbuf chain.
141  */
142 int
143 rip6_input(struct mbuf **mp, int *offp, int proto)
144 {
145 	struct mbuf *m = *mp;
146 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
147 	struct inpcb_hdr *inph;
148 	struct in6pcb *in6p;
149 	struct in6pcb *last = NULL;
150 	struct sockaddr_in6 rip6src;
151 	struct mbuf *n, *opts = NULL;
152 
153 	RIP6_STATINC(RIP6_STAT_IPACKETS);
154 
155 #if defined(NFAITH) && 0 < NFAITH
156 	if (faithprefix(&ip6->ip6_dst)) {
157 		/* send icmp6 host unreach? */
158 		m_freem(m);
159 		return IPPROTO_DONE;
160 	}
161 #endif
162 
163 	sockaddr_in6_init(&rip6src, &ip6->ip6_src, 0, 0, 0);
164 	if (sa6_recoverscope(&rip6src) != 0) {
165 		/* XXX: should be impossible. */
166 		m_freem(m);
167 		return IPPROTO_DONE;
168 	}
169 
170 	TAILQ_FOREACH(inph, &raw6cbtable.inpt_queue, inph_queue) {
171 		in6p = (struct in6pcb *)inph;
172 		if (in6p->in6p_af != AF_INET6)
173 			continue;
174 		if (in6p->in6p_ip6.ip6_nxt &&
175 		    in6p->in6p_ip6.ip6_nxt != proto)
176 			continue;
177 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) &&
178 		    !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst))
179 			continue;
180 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) &&
181 		    !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src))
182 			continue;
183 		if (in6p->in6p_cksum != -1) {
184 			RIP6_STATINC(RIP6_STAT_ISUM);
185 			if (in6_cksum(m, proto, *offp,
186 			    m->m_pkthdr.len - *offp)) {
187 				RIP6_STATINC(RIP6_STAT_BADSUM);
188 				continue;
189 			}
190 		}
191 
192 		if (last == NULL) {
193 			;
194 		}
195 #ifdef IPSEC
196 		else if (ipsec_used && ipsec_in_reject(m, last)) {
197 			/* do not inject data into pcb */
198 		}
199 #endif
200 		else if ((n = m_copypacket(m, M_DONTWAIT)) != NULL) {
201 			if (last->in6p_flags & IN6P_CONTROLOPTS)
202 				ip6_savecontrol(last, &opts, ip6, n);
203 			/* strip intermediate headers */
204 			m_adj(n, *offp);
205 			if (sbappendaddr(&last->in6p_socket->so_rcv,
206 			    sin6tosa(&rip6src), n, opts) == 0) {
207 				soroverflow(last->in6p_socket);
208 				m_freem(n);
209 				if (opts)
210 					m_freem(opts);
211 				RIP6_STATINC(RIP6_STAT_FULLSOCK);
212 			} else {
213 				sorwakeup(last->in6p_socket);
214 			}
215 			opts = NULL;
216 		}
217 
218 		last = in6p;
219 	}
220 
221 #ifdef IPSEC
222 	if (ipsec_used && last && ipsec_in_reject(m, last)) {
223 		m_freem(m);
224 		IP6_STATDEC(IP6_STAT_DELIVERED);
225 		/* do not inject data into pcb */
226 	} else
227 #endif
228 	if (last) {
229 		if (last->in6p_flags & IN6P_CONTROLOPTS)
230 			ip6_savecontrol(last, &opts, ip6, m);
231 		/* strip intermediate headers */
232 		m_adj(m, *offp);
233 		if (sbappendaddr(&last->in6p_socket->so_rcv,
234 		    sin6tosa(&rip6src), m, opts) == 0) {
235 			soroverflow(last->in6p_socket);
236 			m_freem(m);
237 			if (opts)
238 				m_freem(opts);
239 			RIP6_STATINC(RIP6_STAT_FULLSOCK);
240 		} else
241 			sorwakeup(last->in6p_socket);
242 	} else {
243 		RIP6_STATINC(RIP6_STAT_NOSOCK);
244 		if (m->m_flags & M_MCAST)
245 			RIP6_STATINC(RIP6_STAT_NOSOCKMCAST);
246 		if (proto == IPPROTO_NONE)
247 			m_freem(m);
248 		else {
249 			int s;
250 			struct ifnet *rcvif = m_get_rcvif(m, &s);
251 			const int prvnxt = ip6_get_prevhdr(m, *offp);
252 			in6_ifstat_inc(rcvif, ifs6_in_protounknown);
253 			m_put_rcvif(rcvif, &s);
254 			icmp6_error(m, ICMP6_PARAM_PROB,
255 			    ICMP6_PARAMPROB_NEXTHEADER,
256 			    prvnxt);
257 		}
258 		IP6_STATDEC(IP6_STAT_DELIVERED);
259 	}
260 	return IPPROTO_DONE;
261 }
262 
263 void *
264 rip6_ctlinput(int cmd, const struct sockaddr *sa, void *d)
265 {
266 	struct ip6_hdr *ip6;
267 	struct ip6ctlparam *ip6cp = NULL;
268 	const struct sockaddr_in6 *sa6_src = NULL;
269 	void *cmdarg;
270 	void (*notify)(struct in6pcb *, int) = in6_rtchange;
271 	int nxt;
272 
273 	if (sa->sa_family != AF_INET6 ||
274 	    sa->sa_len != sizeof(struct sockaddr_in6))
275 		return NULL;
276 
277 	if ((unsigned)cmd >= PRC_NCMDS)
278 		return NULL;
279 	if (PRC_IS_REDIRECT(cmd))
280 		notify = in6_rtchange, d = NULL;
281 	else if (cmd == PRC_HOSTDEAD)
282 		d = NULL;
283 	else if (cmd == PRC_MSGSIZE)
284 		; /* special code is present, see below */
285 	else if (inet6ctlerrmap[cmd] == 0)
286 		return NULL;
287 
288 	/* if the parameter is from icmp6, decode it. */
289 	if (d != NULL) {
290 		ip6cp = (struct ip6ctlparam *)d;
291 		ip6 = ip6cp->ip6c_ip6;
292 		cmdarg = ip6cp->ip6c_cmdarg;
293 		sa6_src = ip6cp->ip6c_src;
294 		nxt = ip6cp->ip6c_nxt;
295 	} else {
296 		ip6 = NULL;
297 		cmdarg = NULL;
298 		sa6_src = &sa6_any;
299 		nxt = -1;
300 	}
301 
302 	if (ip6 && cmd == PRC_MSGSIZE) {
303 		const struct sockaddr_in6 *sa6 = (const struct sockaddr_in6 *)sa;
304 		int valid = 0;
305 		struct in6pcb *in6p;
306 
307 		/*
308 		 * Check to see if we have a valid raw IPv6 socket
309 		 * corresponding to the address in the ICMPv6 message
310 		 * payload, and the protocol (ip6_nxt) meets the socket.
311 		 * XXX chase extension headers, or pass final nxt value
312 		 * from icmp6_notify_error()
313 		 */
314 		in6p = NULL;
315 		in6p = in6_pcblookup_connect(&raw6cbtable, &sa6->sin6_addr, 0,
316 					     (const struct in6_addr *)&sa6_src->sin6_addr, 0, 0, 0);
317 #if 0
318 		if (!in6p) {
319 			/*
320 			 * As the use of sendto(2) is fairly popular,
321 			 * we may want to allow non-connected pcb too.
322 			 * But it could be too weak against attacks...
323 			 * We should at least check if the local
324 			 * address (= s) is really ours.
325 			 */
326 			in6p = in6_pcblookup_bind(&raw6cbtable,
327 			    &sa6->sin6_addr, 0, 0);
328 		}
329 #endif
330 
331 		if (in6p && in6p->in6p_ip6.ip6_nxt &&
332 		    in6p->in6p_ip6.ip6_nxt == nxt)
333 			valid++;
334 
335 		/*
336 		 * Depending on the value of "valid" and routing table
337 		 * size (mtudisc_{hi,lo}wat), we will:
338 		 * - recalculate the new MTU and create the
339 		 *   corresponding routing entry, or
340 		 * - ignore the MTU change notification.
341 		 */
342 		icmp6_mtudisc_update((struct ip6ctlparam *)d, valid);
343 
344 		/*
345 		 * regardless of if we called icmp6_mtudisc_update(),
346 		 * we need to call in6_pcbnotify(), to notify path MTU
347 		 * change to the userland (RFC3542), because some
348 		 * unconnected sockets may share the same destination
349 		 * and want to know the path MTU.
350 		 */
351 	}
352 
353 	(void) in6_pcbnotify(&raw6cbtable, sa, 0,
354 	    sin6tocsa(sa6_src), 0, cmd, cmdarg, notify);
355 	return NULL;
356 }
357 
358 /*
359  * Generate IPv6 header and pass packet to ip6_output.
360  * Tack on options user may have setup with control call.
361  */
362 int
363 rip6_output(struct mbuf *m, struct socket * const so,
364     struct sockaddr_in6 * const dstsock, struct mbuf * const control)
365 {
366 	struct in6_addr *dst;
367 	struct ip6_hdr *ip6;
368 	struct in6pcb *in6p;
369 	u_int	plen = m->m_pkthdr.len;
370 	int error = 0;
371 	struct ip6_pktopts opt, *optp = NULL;
372 	struct ifnet *oifp = NULL;
373 	int type, code;		/* for ICMPv6 output statistics only */
374 	int scope_ambiguous = 0;
375 	int bound = curlwp_bind();
376 	struct psref psref;
377 
378 	in6p = sotoin6pcb(so);
379 
380 	dst = &dstsock->sin6_addr;
381 	if (control) {
382 		if ((error = ip6_setpktopts(control, &opt,
383 		    in6p->in6p_outputopts,
384 		    kauth_cred_get(), so->so_proto->pr_protocol)) != 0) {
385 			goto bad;
386 		}
387 		optp = &opt;
388 	} else
389 		optp = in6p->in6p_outputopts;
390 
391 	/*
392 	 * Check and convert scope zone ID into internal form.
393 	 * XXX: we may still need to determine the zone later.
394 	 */
395 	if (!(so->so_state & SS_ISCONNECTED)) {
396 		if (dstsock->sin6_scope_id == 0 && !ip6_use_defzone)
397 			scope_ambiguous = 1;
398 		if ((error = sa6_embedscope(dstsock, ip6_use_defzone)) != 0)
399 			goto bad;
400 	}
401 
402 	/*
403 	 * For an ICMPv6 packet, we should know its type and code
404 	 * to update statistics.
405 	 */
406 	if (so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
407 		struct icmp6_hdr *icmp6;
408 		if (m->m_len < sizeof(struct icmp6_hdr) &&
409 		    (m = m_pullup(m, sizeof(struct icmp6_hdr))) == NULL) {
410 			error = ENOBUFS;
411 			goto bad;
412 		}
413 		icmp6 = mtod(m, struct icmp6_hdr *);
414 		type = icmp6->icmp6_type;
415 		code = icmp6->icmp6_code;
416 	} else {
417 		type = 0;
418 		code = 0;
419 	}
420 
421 	M_PREPEND(m, sizeof(*ip6), M_DONTWAIT);
422 	if (!m) {
423 		error = ENOBUFS;
424 		goto bad;
425 	}
426 	ip6 = mtod(m, struct ip6_hdr *);
427 
428 	/*
429 	 * Next header might not be ICMP6 but use its pseudo header anyway.
430 	 */
431 	ip6->ip6_dst = *dst;
432 
433 	/*
434 	 * Source address selection.
435 	 */
436 	error = in6_selectsrc(dstsock, optp, in6p->in6p_moptions,
437 	    &in6p->in6p_route, &in6p->in6p_laddr, &oifp, &psref, &ip6->ip6_src);
438 	if (error != 0)
439 		goto bad;
440 
441 	if (oifp && scope_ambiguous) {
442 		/*
443 		 * Application should provide a proper zone ID or the use of
444 		 * default zone IDs should be enabled.  Unfortunately, some
445 		 * applications do not behave as it should, so we need a
446 		 * workaround.  Even if an appropriate ID is not determined
447 		 * (when it's required), if we can determine the outgoing
448 		 * interface. determine the zone ID based on the interface.
449 		 */
450 		error = in6_setscope(&dstsock->sin6_addr, oifp, NULL);
451 		if (error != 0)
452 			goto bad;
453 	}
454 	ip6->ip6_dst = dstsock->sin6_addr;
455 
456 	/* fill in the rest of the IPv6 header fields */
457 	ip6->ip6_flow = in6p->in6p_flowinfo & IPV6_FLOWINFO_MASK;
458 	ip6->ip6_vfc  &= ~IPV6_VERSION_MASK;
459 	ip6->ip6_vfc  |= IPV6_VERSION;
460 	/* ip6_plen will be filled in ip6_output, so not fill it here. */
461 	ip6->ip6_nxt   = in6p->in6p_ip6.ip6_nxt;
462 	ip6->ip6_hlim = in6_selecthlim(in6p, oifp);
463 
464 	if_put(oifp, &psref);
465 	oifp = NULL;
466 
467 	if (so->so_proto->pr_protocol == IPPROTO_ICMPV6 ||
468 	    in6p->in6p_cksum != -1) {
469 		const uint8_t nxt = ip6->ip6_nxt;
470 		int off;
471 		u_int16_t sum;
472 
473 		/* compute checksum */
474 		if (so->so_proto->pr_protocol == IPPROTO_ICMPV6)
475 			off = offsetof(struct icmp6_hdr, icmp6_cksum);
476 		else
477 			off = in6p->in6p_cksum;
478 		if (plen < off + 1) {
479 			error = EINVAL;
480 			goto bad;
481 		}
482 		off += sizeof(struct ip6_hdr);
483 
484 		sum = 0;
485 		m = m_copyback_cow(m, off, sizeof(sum), (void *)&sum,
486 		    M_DONTWAIT);
487 		if (m == NULL) {
488 			error = ENOBUFS;
489 			goto bad;
490 		}
491 		sum = in6_cksum(m, nxt, sizeof(*ip6), plen);
492 		m = m_copyback_cow(m, off, sizeof(sum), (void *)&sum,
493 		    M_DONTWAIT);
494 		if (m == NULL) {
495 			error = ENOBUFS;
496 			goto bad;
497 		}
498 	}
499 
500 	{
501 		struct ifnet *ret_oifp = NULL;
502 
503 		error = ip6_output(m, optp, &in6p->in6p_route, 0,
504 		    in6p->in6p_moptions, in6p, &ret_oifp);
505 		if (so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
506 			if (ret_oifp)
507 				icmp6_ifoutstat_inc(ret_oifp, type, code);
508 			ICMP6_STATINC(ICMP6_STAT_OUTHIST + type);
509 		} else
510 			RIP6_STATINC(RIP6_STAT_OPACKETS);
511 	}
512 
513 	goto freectl;
514 
515  bad:
516 	if (m)
517 		m_freem(m);
518 
519  freectl:
520 	if (control) {
521 		ip6_clearpktopts(&opt, -1);
522 		m_freem(control);
523 	}
524 	if_put(oifp, &psref);
525 	curlwp_bindx(bound);
526 	return error;
527 }
528 
529 /*
530  * Raw IPv6 socket option processing.
531  */
532 int
533 rip6_ctloutput(int op, struct socket *so, struct sockopt *sopt)
534 {
535 	int error = 0;
536 
537 	if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_NOHEADER) {
538 		int optval;
539 
540 		/* need to fiddle w/ opt(IPPROTO_IPV6, IPV6_CHECKSUM)? */
541 		if (op == PRCO_GETOPT) {
542 			optval = 1;
543 			error = sockopt_set(sopt, &optval, sizeof(optval));
544 		} else if (op == PRCO_SETOPT) {
545 			error = sockopt_getint(sopt, &optval);
546 			if (error)
547 				goto out;
548 			if (optval == 0)
549 				error = EINVAL;
550 		}
551 
552 		goto out;
553 	} else if (sopt->sopt_level != IPPROTO_IPV6)
554 		return ip6_ctloutput(op, so, sopt);
555 
556 	switch (sopt->sopt_name) {
557 	case MRT6_INIT:
558 	case MRT6_DONE:
559 	case MRT6_ADD_MIF:
560 	case MRT6_DEL_MIF:
561 	case MRT6_ADD_MFC:
562 	case MRT6_DEL_MFC:
563 	case MRT6_PIM:
564 		if (op == PRCO_SETOPT)
565 			error = ip6_mrouter_set(so, sopt);
566 		else if (op == PRCO_GETOPT)
567 			error = ip6_mrouter_get(so, sopt);
568 		else
569 			error = EINVAL;
570 		break;
571 	case IPV6_CHECKSUM:
572 		return ip6_raw_ctloutput(op, so, sopt);
573 	default:
574 		return ip6_ctloutput(op, so, sopt);
575 	}
576  out:
577 	return error;
578 }
579 
580 extern	u_long rip6_sendspace;
581 extern	u_long rip6_recvspace;
582 
583 int
584 rip6_attach(struct socket *so, int proto)
585 {
586 	struct in6pcb *in6p;
587 	int s, error;
588 
589 	KASSERT(sotoin6pcb(so) == NULL);
590 	sosetlock(so);
591 
592 	error = kauth_authorize_network(curlwp->l_cred,
593 	    KAUTH_NETWORK_SOCKET, KAUTH_REQ_NETWORK_SOCKET_RAWSOCK,
594 	    KAUTH_ARG(AF_INET6),
595 	    KAUTH_ARG(SOCK_RAW),
596 	    KAUTH_ARG(so->so_proto->pr_protocol));
597 	if (error) {
598 		return error;
599 	}
600 	s = splsoftnet();
601 	error = soreserve(so, rip6_sendspace, rip6_recvspace);
602 	if (error) {
603 		splx(s);
604 		return error;
605 	}
606 	if ((error = in6_pcballoc(so, &raw6cbtable)) != 0) {
607 		splx(s);
608 		return error;
609 	}
610 	splx(s);
611 	in6p = sotoin6pcb(so);
612 	in6p->in6p_ip6.ip6_nxt = proto;
613 	in6p->in6p_cksum = -1;
614 
615 	in6p->in6p_icmp6filt = kmem_alloc(sizeof(struct icmp6_filter), KM_SLEEP);
616 	ICMP6_FILTER_SETPASSALL(in6p->in6p_icmp6filt);
617 	KASSERT(solocked(so));
618 	return error;
619 }
620 
621 static void
622 rip6_detach(struct socket *so)
623 {
624 	struct in6pcb *in6p = sotoin6pcb(so);
625 
626 	KASSERT(solocked(so));
627 	KASSERT(in6p != NULL);
628 
629 	if (so == ip6_mrouter) {
630 		ip6_mrouter_done();
631 	}
632 	/* xxx: RSVP */
633 	if (in6p->in6p_icmp6filt != NULL) {
634 		kmem_free(in6p->in6p_icmp6filt, sizeof(struct icmp6_filter));
635 		in6p->in6p_icmp6filt = NULL;
636 	}
637 	in6_pcbdetach(in6p);
638 }
639 
640 static int
641 rip6_accept(struct socket *so, struct sockaddr *nam)
642 {
643 	KASSERT(solocked(so));
644 
645 	return EOPNOTSUPP;
646 }
647 
648 static int
649 rip6_bind(struct socket *so, struct sockaddr *nam, struct lwp *l)
650 {
651 	struct in6pcb *in6p = sotoin6pcb(so);
652 	struct sockaddr_in6 *addr = (struct sockaddr_in6 *)nam;
653 	struct ifaddr *ifa = NULL;
654 	int error = 0;
655 	int s;
656 
657 	KASSERT(solocked(so));
658 	KASSERT(in6p != NULL);
659 	KASSERT(nam != NULL);
660 
661 	if (addr->sin6_len != sizeof(*addr))
662 		return EINVAL;
663 	if (IFNET_READER_EMPTY() || addr->sin6_family != AF_INET6)
664 		return EADDRNOTAVAIL;
665 
666 	if ((error = sa6_embedscope(addr, ip6_use_defzone)) != 0)
667 		return error;
668 
669 	/*
670 	 * we don't support mapped address here, it would confuse
671 	 * users so reject it
672 	 */
673 	if (IN6_IS_ADDR_V4MAPPED(&addr->sin6_addr))
674 		return EADDRNOTAVAIL;
675 	s = pserialize_read_enter();
676 	if (!IN6_IS_ADDR_UNSPECIFIED(&addr->sin6_addr) &&
677 	    (ifa = ifa_ifwithaddr(sin6tosa(addr))) == NULL) {
678 		error = EADDRNOTAVAIL;
679 		goto out;
680 	}
681 	if (ifa && (ifatoia6(ifa))->ia6_flags &
682 	    (IN6_IFF_ANYCAST | IN6_IFF_DUPLICATED)) {
683 		error = EADDRNOTAVAIL;
684 		goto out;
685 	}
686 
687 	in6p->in6p_laddr = addr->sin6_addr;
688 	error = 0;
689 out:
690 	pserialize_read_exit(s);
691 	return error;
692 }
693 
694 static int
695 rip6_listen(struct socket *so, struct lwp *l)
696 {
697 	KASSERT(solocked(so));
698 
699 	return EOPNOTSUPP;
700 }
701 
702 static int
703 rip6_connect(struct socket *so, struct sockaddr *nam, struct lwp *l)
704 {
705 	struct in6pcb *in6p = sotoin6pcb(so);
706 	struct sockaddr_in6 *addr = (struct sockaddr_in6 *)nam;
707 	struct in6_addr in6a;
708 	struct ifnet *ifp = NULL;
709 	int scope_ambiguous = 0;
710 	int error = 0;
711 	struct psref psref;
712 	int bound;
713 
714 	KASSERT(solocked(so));
715 	KASSERT(in6p != NULL);
716 	KASSERT(nam != NULL);
717 
718 	if (IFNET_READER_EMPTY())
719 		return EADDRNOTAVAIL;
720 	if (addr->sin6_family != AF_INET6)
721 		return EAFNOSUPPORT;
722 
723 	/*
724 	 * Application should provide a proper zone ID or the use of
725 	 * default zone IDs should be enabled.  Unfortunately, some
726 	 * applications do not behave as it should, so we need a
727 	 * workaround.  Even if an appropriate ID is not determined,
728 	 * we'll see if we can determine the outgoing interface.  If we
729 	 * can, determine the zone ID based on the interface below.
730 	 */
731 	if (addr->sin6_scope_id == 0 && !ip6_use_defzone)
732 		scope_ambiguous = 1;
733 	if ((error = sa6_embedscope(addr, ip6_use_defzone)) != 0)
734 		return error;
735 
736 	bound = curlwp_bind();
737 	/* Source address selection. XXX: need pcblookup? */
738 	error = in6_selectsrc(addr, in6p->in6p_outputopts,
739 	    in6p->in6p_moptions, &in6p->in6p_route,
740 	    &in6p->in6p_laddr, &ifp, &psref, &in6a);
741 	if (error != 0)
742 		goto out;
743 	/* XXX: see above */
744 	if (ifp && scope_ambiguous &&
745 	    (error = in6_setscope(&addr->sin6_addr, ifp, NULL)) != 0) {
746 		goto out;
747 	}
748 	in6p->in6p_laddr = in6a;
749 	in6p->in6p_faddr = addr->sin6_addr;
750 	soisconnected(so);
751 out:
752 	if_put(ifp, &psref);
753 	curlwp_bindx(bound);
754 	return error;
755 }
756 
757 static int
758 rip6_connect2(struct socket *so, struct socket *so2)
759 {
760 	KASSERT(solocked(so));
761 
762 	return EOPNOTSUPP;
763 }
764 
765 static int
766 rip6_disconnect(struct socket *so)
767 {
768 	struct in6pcb *in6p = sotoin6pcb(so);
769 
770 	KASSERT(solocked(so));
771 	KASSERT(in6p != NULL);
772 
773 	if ((so->so_state & SS_ISCONNECTED) == 0)
774 		return ENOTCONN;
775 
776 	in6p->in6p_faddr = in6addr_any;
777 	so->so_state &= ~SS_ISCONNECTED;	/* XXX */
778 	return 0;
779 }
780 
781 static int
782 rip6_shutdown(struct socket *so)
783 {
784 	KASSERT(solocked(so));
785 
786 	/*
787 	 * Mark the connection as being incapable of futther input.
788 	 */
789 	socantsendmore(so);
790 	return 0;
791 }
792 
793 static int
794 rip6_abort(struct socket *so)
795 {
796 	KASSERT(solocked(so));
797 
798 	soisdisconnected(so);
799 	rip6_detach(so);
800 	return 0;
801 }
802 
803 static int
804 rip6_ioctl(struct socket *so, u_long cmd, void *nam, struct ifnet *ifp)
805 {
806 	return in6_control(so, cmd, nam, ifp);
807 }
808 
809 static int
810 rip6_stat(struct socket *so, struct stat *ub)
811 {
812 	KASSERT(solocked(so));
813 
814 	/* stat: don't bother with a blocksize */
815 	return 0;
816 }
817 
818 static int
819 rip6_peeraddr(struct socket *so, struct sockaddr *nam)
820 {
821 	KASSERT(solocked(so));
822 	KASSERT(sotoin6pcb(so) != NULL);
823 	KASSERT(nam != NULL);
824 
825 	in6_setpeeraddr(sotoin6pcb(so), (struct sockaddr_in6 *)nam);
826 	return 0;
827 }
828 
829 static int
830 rip6_sockaddr(struct socket *so, struct sockaddr *nam)
831 {
832 	KASSERT(solocked(so));
833 	KASSERT(sotoin6pcb(so) != NULL);
834 	KASSERT(nam != NULL);
835 
836 	in6_setsockaddr(sotoin6pcb(so), (struct sockaddr_in6 *)nam);
837 	return 0;
838 }
839 
840 static int
841 rip6_rcvd(struct socket *so, int flags, struct lwp *l)
842 {
843 	KASSERT(solocked(so));
844 
845 	return EOPNOTSUPP;
846 }
847 
848 static int
849 rip6_recvoob(struct socket *so, struct mbuf *m, int flags)
850 {
851 	KASSERT(solocked(so));
852 
853 	return EOPNOTSUPP;
854 }
855 
856 static int
857 rip6_send(struct socket *so, struct mbuf *m, struct sockaddr *nam,
858     struct mbuf *control, struct lwp *l)
859 {
860 	struct in6pcb *in6p = sotoin6pcb(so);
861 	struct sockaddr_in6 tmp;
862 	struct sockaddr_in6 *dst;
863 	int error = 0;
864 
865 	KASSERT(solocked(so));
866 	KASSERT(in6p != NULL);
867 	KASSERT(m != NULL);
868 
869 	/*
870 	 * Ship a packet out. The appropriate raw output
871 	 * routine handles any messaging necessary.
872 	 */
873 
874 	/* always copy sockaddr to avoid overwrites */
875 	if (so->so_state & SS_ISCONNECTED) {
876 		if (nam) {
877 			error = EISCONN;
878 			goto release;
879 		}
880 		/* XXX */
881 		sockaddr_in6_init(&tmp, &in6p->in6p_faddr, 0, 0, 0);
882 		dst = &tmp;
883 	} else {
884 		if (nam == NULL) {
885 			error = ENOTCONN;
886 			goto release;
887 		}
888 		tmp = *(struct sockaddr_in6 *)nam;
889 		dst = &tmp;
890 
891 		if (dst->sin6_family != AF_INET6) {
892 			error = EAFNOSUPPORT;
893 			goto release;
894 		}
895 	}
896 	error = rip6_output(m, so, dst, control);
897 	m = NULL;
898 
899 release:
900 	if (m)
901 		m_freem(m);
902 
903 	return error;
904 }
905 
906 static int
907 rip6_sendoob(struct socket *so, struct mbuf *m, struct mbuf *control)
908 {
909 	KASSERT(solocked(so));
910 
911 	if (m)
912 	 	m_freem(m);
913 
914 	return EOPNOTSUPP;
915 }
916 
917 static int
918 rip6_purgeif(struct socket *so, struct ifnet *ifp)
919 {
920 
921 	mutex_enter(softnet_lock);
922 	in6_pcbpurgeif0(&raw6cbtable, ifp);
923 #ifdef NET_MPSAFE
924 	mutex_exit(softnet_lock);
925 #endif
926 	in6_purgeif(ifp);
927 #ifdef NET_MPSAFE
928 	mutex_enter(softnet_lock);
929 #endif
930 	in6_pcbpurgeif(&raw6cbtable, ifp);
931 	mutex_exit(softnet_lock);
932 
933 	return 0;
934 }
935 
936 static int
937 sysctl_net_inet6_raw6_stats(SYSCTLFN_ARGS)
938 {
939 
940 	return (NETSTAT_SYSCTL(rip6stat_percpu, RIP6_NSTATS));
941 }
942 
943 static void
944 sysctl_net_inet6_raw6_setup(struct sysctllog **clog)
945 {
946 
947 	sysctl_createv(clog, 0, NULL, NULL,
948 		       CTLFLAG_PERMANENT,
949 		       CTLTYPE_NODE, "inet6", NULL,
950 		       NULL, 0, NULL, 0,
951 		       CTL_NET, PF_INET6, CTL_EOL);
952 	sysctl_createv(clog, 0, NULL, NULL,
953 		       CTLFLAG_PERMANENT,
954 		       CTLTYPE_NODE, "raw6",
955 		       SYSCTL_DESCR("Raw IPv6 settings"),
956 		       NULL, 0, NULL, 0,
957 		       CTL_NET, PF_INET6, IPPROTO_RAW, CTL_EOL);
958 
959 	sysctl_createv(clog, 0, NULL, NULL,
960 		       CTLFLAG_PERMANENT,
961 		       CTLTYPE_STRUCT, "pcblist",
962 		       SYSCTL_DESCR("Raw IPv6 control block list"),
963 		       sysctl_inpcblist, 0, &raw6cbtable, 0,
964 		       CTL_NET, PF_INET6, IPPROTO_RAW,
965 		       CTL_CREATE, CTL_EOL);
966 	sysctl_createv(clog, 0, NULL, NULL,
967 		       CTLFLAG_PERMANENT,
968 		       CTLTYPE_STRUCT, "stats",
969 		       SYSCTL_DESCR("Raw IPv6 statistics"),
970 		       sysctl_net_inet6_raw6_stats, 0, NULL, 0,
971 		       CTL_NET, PF_INET6, IPPROTO_RAW, RAW6CTL_STATS,
972 		       CTL_EOL);
973 }
974 
975 PR_WRAP_USRREQS(rip6)
976 #define	rip6_attach		rip6_attach_wrapper
977 #define	rip6_detach		rip6_detach_wrapper
978 #define	rip6_accept		rip6_accept_wrapper
979 #define	rip6_bind		rip6_bind_wrapper
980 #define	rip6_listen		rip6_listen_wrapper
981 #define	rip6_connect		rip6_connect_wrapper
982 #define	rip6_connect2		rip6_connect2_wrapper
983 #define	rip6_disconnect		rip6_disconnect_wrapper
984 #define	rip6_shutdown		rip6_shutdown_wrapper
985 #define	rip6_abort		rip6_abort_wrapper
986 #define	rip6_ioctl		rip6_ioctl_wrapper
987 #define	rip6_stat		rip6_stat_wrapper
988 #define	rip6_peeraddr		rip6_peeraddr_wrapper
989 #define	rip6_sockaddr		rip6_sockaddr_wrapper
990 #define	rip6_rcvd		rip6_rcvd_wrapper
991 #define	rip6_recvoob		rip6_recvoob_wrapper
992 #define	rip6_send		rip6_send_wrapper
993 #define	rip6_sendoob		rip6_sendoob_wrapper
994 #define	rip6_purgeif		rip6_purgeif_wrapper
995 
996 const struct pr_usrreqs rip6_usrreqs = {
997 	.pr_attach	= rip6_attach,
998 	.pr_detach	= rip6_detach,
999 	.pr_accept	= rip6_accept,
1000 	.pr_bind	= rip6_bind,
1001 	.pr_listen	= rip6_listen,
1002 	.pr_connect	= rip6_connect,
1003 	.pr_connect2	= rip6_connect2,
1004 	.pr_disconnect	= rip6_disconnect,
1005 	.pr_shutdown	= rip6_shutdown,
1006 	.pr_abort	= rip6_abort,
1007 	.pr_ioctl	= rip6_ioctl,
1008 	.pr_stat	= rip6_stat,
1009 	.pr_peeraddr	= rip6_peeraddr,
1010 	.pr_sockaddr	= rip6_sockaddr,
1011 	.pr_rcvd	= rip6_rcvd,
1012 	.pr_recvoob	= rip6_recvoob,
1013 	.pr_send	= rip6_send,
1014 	.pr_sendoob	= rip6_sendoob,
1015 	.pr_purgeif	= rip6_purgeif,
1016 };
1017