xref: /openbsd-src/sys/netinet6/ip6_output.c (revision 2badd5e3f47d2d4252969cd98d7042b4e701b5ac)
1 /*	$OpenBSD: ip6_output.c,v 1.49 2001/08/22 14:18:36 niklas Exp $	*/
2 /*	$KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1990, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. All advertising materials mentioning features or use of this software
46  *    must display the following acknowledgement:
47  *	This product includes software developed by the University of
48  *	California, Berkeley and its contributors.
49  * 4. Neither the name of the University nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63  * SUCH DAMAGE.
64  *
65  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
66  */
67 
68 #include <sys/param.h>
69 #include <sys/malloc.h>
70 #include <sys/mbuf.h>
71 #include <sys/errno.h>
72 #include <sys/protosw.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <sys/systm.h>
76 #include <sys/proc.h>
77 
78 #include <net/if.h>
79 #include <net/route.h>
80 
81 #include <netinet/in.h>
82 #include <netinet/in_var.h>
83 #include <netinet/in_systm.h>
84 #include <netinet/ip.h>
85 #include <netinet/in_pcb.h>
86 
87 #include <netinet/ip6.h>
88 #include <netinet/icmp6.h>
89 #include <netinet6/ip6_var.h>
90 #include <netinet6/nd6.h>
91 
92 #ifdef IPSEC
93 #include <netinet/ip_ah.h>
94 #include <netinet/ip_esp.h>
95 #include <netinet/udp.h>
96 #include <netinet/tcp.h>
97 #include <net/pfkeyv2.h>
98 
99 extern u_int8_t get_sa_require  __P((struct inpcb *));
100 
101 extern int ipsec_auth_default_level;
102 extern int ipsec_esp_trans_default_level;
103 extern int ipsec_esp_network_default_level;
104 extern int ipsec_ipcomp_default_level;
105 #endif /* IPSEC */
106 
107 struct ip6_exthdrs {
108 	struct mbuf *ip6e_ip6;
109 	struct mbuf *ip6e_hbh;
110 	struct mbuf *ip6e_dest1;
111 	struct mbuf *ip6e_rthdr;
112 	struct mbuf *ip6e_dest2;
113 };
114 
115 static int ip6_pcbopts __P((struct ip6_pktopts **, struct mbuf *,
116 			    struct socket *));
117 static int ip6_setmoptions __P((int, struct ip6_moptions **, struct mbuf *));
118 static int ip6_getmoptions __P((int, struct ip6_moptions *, struct mbuf **));
119 static int ip6_copyexthdr __P((struct mbuf **, caddr_t, int));
120 static int ip6_insertfraghdr __P((struct mbuf *, struct mbuf *, int,
121 				  struct ip6_frag **));
122 static int ip6_insert_jumboopt __P((struct ip6_exthdrs *, u_int32_t));
123 static int ip6_splithdr __P((struct mbuf *, struct ip6_exthdrs *));
124 
125 /*
126  * IP6 output. The packet in mbuf chain m contains a skeletal IP6
127  * header (with pri, len, nxt, hlim, src, dst).
128  * This function may modify ver and hlim only.
129  * The mbuf chain containing the packet will be freed.
130  * The mbuf opt, if present, will not be freed.
131  *
132  * type of "mtu": rt_rmx.rmx_mtu is u_long, ifnet.ifr_mtu is int, and
133  * nd_ifinfo.linkmtu is u_int32_t.  so we use u_long to hold largest one,
134  * which is rt_rmx.rmx_mtu.
135  */
136 int
137 ip6_output(m0, opt, ro, flags, im6o, ifpp)
138 	struct mbuf *m0;
139 	struct ip6_pktopts *opt;
140 	struct route_in6 *ro;
141 	int flags;
142 	struct ip6_moptions *im6o;
143 	struct ifnet **ifpp;		/* XXX: just for statistics */
144 {
145 	struct ip6_hdr *ip6, *mhip6;
146 	struct ifnet *ifp, *origifp;
147 	struct mbuf *m = m0;
148 	int hlen, tlen, len, off;
149 	struct route_in6 ip6route;
150 	struct sockaddr_in6 *dst;
151 	int error = 0;
152 	struct in6_ifaddr *ia;
153 	u_long mtu;
154 	u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
155 	struct ip6_exthdrs exthdrs;
156 	struct in6_addr finaldst;
157 	struct route_in6 *ro_pmtu = NULL;
158 	int hdrsplit = 0;
159 	u_int8_t sproto = 0;
160 #ifdef IPSEC
161 	struct m_tag *mtag;
162 	union sockaddr_union sdst;
163 	struct tdb_ident *tdbi;
164 	u_int32_t sspi;
165 	struct inpcb *inp;
166 	struct tdb *tdb;
167 	int s;
168 #endif /* IPSEC */
169 
170 #ifdef IPSEC
171 	inp = NULL;	/*XXX*/
172 	if (inp && (inp->inp_flags & INP_IPV6) == 0)
173 		panic("ip6_output: IPv4 pcb is passed");
174 #endif /* IPSEC */
175 
176 #define MAKE_EXTHDR(hp, mp)						\
177     do {								\
178 	if (hp) {							\
179 		struct ip6_ext *eh = (struct ip6_ext *)(hp);		\
180 		error = ip6_copyexthdr((mp), (caddr_t)(hp), 		\
181 				       ((eh)->ip6e_len + 1) << 3);	\
182 		if (error)						\
183 			goto freehdrs;					\
184 	}								\
185     } while (0)
186 
187 	bzero(&exthdrs, sizeof(exthdrs));
188 	if (opt) {
189 		/* Hop-by-Hop options header */
190 		MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
191 		/* Destination options header(1st part) */
192 		MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
193 		/* Routing header */
194 		MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
195 		/* Destination options header(2nd part) */
196 		MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
197 	}
198 
199 #ifdef IPSEC
200 	/*
201 	 * splnet is chosen over spltdb because we are not allowed to
202 	 * lower the level, and udp6_output calls us in splnet(). XXX check
203 	 */
204 	s = splnet();
205 
206 	/*
207 	 * Check if there was an outgoing SA bound to the flow
208 	 * from a transport protocol.
209 	 */
210 	ip6 = mtod(m, struct ip6_hdr *);
211 
212 	/* Do we have any pending SAs to apply ? */
213 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL);
214 	if (mtag != NULL) {
215 #ifdef DIAGNOSTIC
216 		if (mtag->m_tag_len != sizeof (struct tdb_ident))
217 			panic("ip6_output: tag of length %d (should be %d",
218 			    mtag->m_tag_len, sizeof (struct tdb_ident));
219 #endif
220 		tdbi = (struct tdb_ident *)(mtag + 1);
221 		tdb = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto);
222 		if (tdb == NULL)
223 			error = -EINVAL;
224 		m_tag_delete(m, mtag);
225 	}
226 	else
227 		tdb = ipsp_spd_lookup(m, AF_INET6, sizeof(struct ip6_hdr),
228 		    &error, IPSP_DIRECTION_OUT, NULL, inp);
229 
230 	if (tdb == NULL) {
231 	        splx(s);
232 
233 		if (error == 0) {
234 		        /*
235 			 * No IPsec processing required, we'll just send the
236 			 * packet out.
237 			 */
238 		        sproto = 0;
239 
240 			/* Fall through to routing/multicast handling */
241 		} else {
242 		        /*
243 			 * -EINVAL is used to indicate that the packet should
244 			 * be silently dropped, typically because we've asked
245 			 * key management for an SA.
246 			 */
247 		        if (error == -EINVAL) /* Should silently drop packet */
248 				error = 0;
249 
250 			goto freehdrs;
251 		}
252 	} else {
253 		/* Loop detection */
254 		for (mtag = m_tag_first(m); mtag != NULL;
255 		    mtag = m_tag_next(m, mtag)) {
256 			if (mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_DONE &&
257 			    mtag->m_tag_id !=
258 			    PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED)
259 				continue;
260 			tdbi = (struct tdb_ident *)(mtag + 1);
261 			if (tdbi->spi == tdb->tdb_spi &&
262 			    tdbi->proto == tdb->tdb_sproto &&
263 			    !bcmp(&tdbi->dst, &tdb->tdb_dst,
264 			    sizeof(union sockaddr_union))) {
265 				splx(s);
266 				sproto = 0; /* mark as no-IPsec-needed */
267 				goto done_spd;
268 			}
269 		}
270 
271 	        /* We need to do IPsec */
272 	        bcopy(&tdb->tdb_dst, &sdst, sizeof(sdst));
273 		sspi = tdb->tdb_spi;
274 		sproto = tdb->tdb_sproto;
275 	        splx(s);
276 
277 #if 1 /* XXX */
278 		/* if we have any extension header, we cannot perform IPsec */
279 		if (exthdrs.ip6e_hbh || exthdrs.ip6e_dest1 ||
280 		    exthdrs.ip6e_rthdr || exthdrs.ip6e_dest2) {
281 			error = EHOSTUNREACH;
282 			goto freehdrs;
283 		}
284 #endif
285 	}
286 
287 	/* Fall through to the routing/multicast handling code */
288  done_spd:
289 #endif /* IPSEC */
290 
291 	/*
292 	 * Calculate the total length of the extension header chain.
293 	 * Keep the length of the unfragmentable part for fragmentation.
294 	 */
295 	optlen = 0;
296 	if (exthdrs.ip6e_hbh) optlen += exthdrs.ip6e_hbh->m_len;
297 	if (exthdrs.ip6e_dest1) optlen += exthdrs.ip6e_dest1->m_len;
298 	if (exthdrs.ip6e_rthdr) optlen += exthdrs.ip6e_rthdr->m_len;
299 	unfragpartlen = optlen + sizeof(struct ip6_hdr);
300 	/* NOTE: we don't add AH/ESP length here. do that later. */
301 	if (exthdrs.ip6e_dest2) optlen += exthdrs.ip6e_dest2->m_len;
302 
303 	/*
304 	 * If we need IPsec, or there is at least one extension header,
305 	 * separate IP6 header from the payload.
306 	 */
307 	if ((sproto || optlen) && !hdrsplit) {
308 		if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
309 			m = NULL;
310 			goto freehdrs;
311 		}
312 		m = exthdrs.ip6e_ip6;
313 		hdrsplit++;
314 	}
315 
316 	/* adjust pointer */
317 	ip6 = mtod(m, struct ip6_hdr *);
318 
319 	/* adjust mbuf packet header length */
320 	m->m_pkthdr.len += optlen;
321 	plen = m->m_pkthdr.len - sizeof(*ip6);
322 
323 	/* If this is a jumbo payload, insert a jumbo payload option. */
324 	if (plen > IPV6_MAXPACKET) {
325 		if (!hdrsplit) {
326 			if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
327 				m = NULL;
328 				goto freehdrs;
329 			}
330 			m = exthdrs.ip6e_ip6;
331 			hdrsplit++;
332 		}
333 		/* adjust pointer */
334 		ip6 = mtod(m, struct ip6_hdr *);
335 		if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
336 			goto freehdrs;
337 		ip6->ip6_plen = 0;
338 	} else
339 		ip6->ip6_plen = htons(plen);
340 
341 	/*
342 	 * Concatenate headers and fill in next header fields.
343 	 * Here we have, on "m"
344 	 *	IPv6 payload
345 	 * and we insert headers accordingly.  Finally, we should be getting:
346 	 *	IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
347 	 *
348 	 * during the header composing process, "m" points to IPv6 header.
349 	 * "mprev" points to an extension header prior to esp.
350 	 */
351 	{
352 		u_char *nexthdrp = &ip6->ip6_nxt;
353 		struct mbuf *mprev = m;
354 
355 		/*
356 		 * we treat dest2 specially.  this makes IPsec processing
357 		 * much easier.
358 		 *
359 		 * result: IPv6 dest2 payload
360 		 * m and mprev will point to IPv6 header.
361 		 */
362 		if (exthdrs.ip6e_dest2) {
363 			if (!hdrsplit)
364 				panic("assumption failed: hdr not split");
365 			exthdrs.ip6e_dest2->m_next = m->m_next;
366 			m->m_next = exthdrs.ip6e_dest2;
367 			*mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
368 			ip6->ip6_nxt = IPPROTO_DSTOPTS;
369 		}
370 
371 #define MAKE_CHAIN(m, mp, p, i)\
372     do {\
373 	if (m) {\
374 		if (!hdrsplit) \
375 			panic("assumption failed: hdr not split"); \
376 		*mtod((m), u_char *) = *(p);\
377 		*(p) = (i);\
378 		p = mtod((m), u_char *);\
379 		(m)->m_next = (mp)->m_next;\
380 		(mp)->m_next = (m);\
381 		(mp) = (m);\
382 	}\
383     } while (0)
384 		/*
385 		 * result: IPv6 hbh dest1 rthdr dest2 payload
386 		 * m will point to IPv6 header.  mprev will point to the
387 		 * extension header prior to dest2 (rthdr in the above case).
388 		 */
389 		MAKE_CHAIN(exthdrs.ip6e_hbh, mprev,
390 			   nexthdrp, IPPROTO_HOPOPTS);
391 		MAKE_CHAIN(exthdrs.ip6e_dest1, mprev,
392 			   nexthdrp, IPPROTO_DSTOPTS);
393 		MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev,
394 			   nexthdrp, IPPROTO_ROUTING);
395 
396 #if 0 /*KAME IPSEC*/
397 		if (!needipsec)
398 			goto skip_ipsec2;
399 
400 		/*
401 		 * pointers after IPsec headers are not valid any more.
402 		 * other pointers need a great care too.
403 		 * (IPsec routines should not mangle mbufs prior to AH/ESP)
404 		 */
405 		exthdrs.ip6e_dest2 = NULL;
406 
407 	    {
408 		struct ip6_rthdr *rh = NULL;
409 		int segleft_org = 0;
410 		struct ipsec_output_state state;
411 
412 		if (exthdrs.ip6e_rthdr) {
413 			rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
414 			segleft_org = rh->ip6r_segleft;
415 			rh->ip6r_segleft = 0;
416 		}
417 
418 		bzero(&state, sizeof(state));
419 		state.m = m;
420 		error = ipsec6_output_trans(&state, nexthdrp, mprev, sp, flags,
421 			&needipsectun);
422 		m = state.m;
423 		if (error) {
424 			/* mbuf is already reclaimed in ipsec6_output_trans. */
425 			m = NULL;
426 			switch (error) {
427 			case EHOSTUNREACH:
428 			case ENETUNREACH:
429 			case EMSGSIZE:
430 			case ENOBUFS:
431 			case ENOMEM:
432 				break;
433 			default:
434 				printf("ip6_output (ipsec): error code %d\n", error);
435 				/*fall through*/
436 			case ENOENT:
437 				/* don't show these error codes to the user */
438 				error = 0;
439 				break;
440 			}
441 			goto bad;
442 		}
443 		if (exthdrs.ip6e_rthdr) {
444 			/* ah6_output doesn't modify mbuf chain */
445 			rh->ip6r_segleft = segleft_org;
446 		}
447 	    }
448 skip_ipsec2:;
449 #endif
450 	}
451 
452 	/*
453 	 * If there is a routing header, replace destination address field
454 	 * with the first hop of the routing header.
455 	 */
456 	if (exthdrs.ip6e_rthdr) {
457 		struct ip6_rthdr *rh =
458 			(struct ip6_rthdr *)(mtod(exthdrs.ip6e_rthdr,
459 						  struct ip6_rthdr *));
460 		struct ip6_rthdr0 *rh0;
461 
462 		finaldst = ip6->ip6_dst;
463 		switch(rh->ip6r_type) {
464 		case IPV6_RTHDR_TYPE_0:
465 			 rh0 = (struct ip6_rthdr0 *)rh;
466 			 ip6->ip6_dst = rh0->ip6r0_addr[0];
467 			 bcopy((caddr_t)&rh0->ip6r0_addr[1],
468 				 (caddr_t)&rh0->ip6r0_addr[0],
469 				 sizeof(struct in6_addr)*(rh0->ip6r0_segleft - 1)
470 				 );
471 			 rh0->ip6r0_addr[rh0->ip6r0_segleft - 1] = finaldst;
472 			 break;
473 		default:	/* is it possible? */
474 			 error = EINVAL;
475 			 goto bad;
476 		}
477 	}
478 
479 	/* Source address validation */
480 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
481 	    (flags & IPV6_DADOUTPUT) == 0) {
482 		error = EOPNOTSUPP;
483 		ip6stat.ip6s_badscope++;
484 		goto bad;
485 	}
486 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
487 		error = EOPNOTSUPP;
488 		ip6stat.ip6s_badscope++;
489 		goto bad;
490 	}
491 
492 	ip6stat.ip6s_localout++;
493 
494 	/*
495 	 * Route packet.
496 	 */
497 	if (ro == 0) {
498 		ro = &ip6route;
499 		bzero((caddr_t)ro, sizeof(*ro));
500 	}
501 	ro_pmtu = ro;
502 	if (opt && opt->ip6po_rthdr)
503 		ro = &opt->ip6po_route;
504 	dst = (struct sockaddr_in6 *)&ro->ro_dst;
505 	/*
506 	 * If there is a cached route,
507 	 * check that it is to the same destination
508 	 * and is still up. If not, free it and try again.
509 	 */
510 	if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
511 			 !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst))) {
512 		RTFREE(ro->ro_rt);
513 		ro->ro_rt = (struct rtentry *)0;
514 	}
515 	if (ro->ro_rt == 0) {
516 		bzero(dst, sizeof(*dst));
517 		dst->sin6_family = AF_INET6;
518 		dst->sin6_len = sizeof(struct sockaddr_in6);
519 		dst->sin6_addr = ip6->ip6_dst;
520 	}
521 #ifdef IPSEC
522 	/*
523 	 * Check if the packet needs encapsulation.
524 	 * ipsp_process_packet will never come back to here.
525 	 */
526 	if (sproto != 0) {
527 	        s = splnet();
528 
529 		/* fill in IPv6 header which would be filled later */
530 		if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
531 			if (opt && opt->ip6po_hlim != -1)
532 				ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
533 		} else {
534 			if (im6o != NULL)
535 				ip6->ip6_hlim = im6o->im6o_multicast_hlim;
536 			else
537 				ip6->ip6_hlim = ip6_defmcasthlim;
538 			if (opt && opt->ip6po_hlim != -1)
539 				ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
540 
541 			/*
542 			 * XXX what should we do if ip6_hlim == 0 and the
543 			 * packet gets tunnelled?
544 			 */
545 		}
546 
547 		tdb = gettdb(sspi, &sdst, sproto);
548 		if (tdb == NULL) {
549 			splx(s);
550 			error = EHOSTUNREACH;
551 			m_freem(m);
552 			goto done;
553 		}
554 
555 		/* Latch to PCB */
556 		if (inp)
557 		        tdb_add_inp(tdb, inp, 0);
558 
559 		m->m_flags &= ~(M_BCAST | M_MCAST);	/* just in case */
560 
561 		/* Callee frees mbuf */
562 		error = ipsp_process_packet(m, tdb, AF_INET6, 0);
563 		splx(s);
564 		return error;  /* Nothing more to be done */
565 	}
566 #endif /* IPSEC */
567 
568 	if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
569 		/* Unicast */
570 
571 #define ifatoia6(ifa)	((struct in6_ifaddr *)(ifa))
572 #define sin6tosa(sin6)	((struct sockaddr *)(sin6))
573 		/* xxx
574 		 * interface selection comes here
575 		 * if an interface is specified from an upper layer,
576 		 * ifp must point it.
577 		 */
578 		if (ro->ro_rt == 0) {
579 			/*
580 			 * non-bsdi always clone routes, if parent is
581 			 * PRF_CLONING.
582 			 */
583 			rtalloc((struct route *)ro);
584 		}
585 		if (ro->ro_rt == 0) {
586 			ip6stat.ip6s_noroute++;
587 			error = EHOSTUNREACH;
588 			/* XXX in6_ifstat_inc(ifp, ifs6_out_discard); */
589 			goto bad;
590 		}
591 		ia = ifatoia6(ro->ro_rt->rt_ifa);
592 		ifp = ro->ro_rt->rt_ifp;
593 		ro->ro_rt->rt_use++;
594 		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
595 			dst = (struct sockaddr_in6 *)ro->ro_rt->rt_gateway;
596 		m->m_flags &= ~(M_BCAST | M_MCAST);	/* just in case */
597 
598 		in6_ifstat_inc(ifp, ifs6_out_request);
599 
600 		/*
601 		 * Check if the outgoing interface conflicts with
602 		 * the interface specified by ifi6_ifindex (if specified).
603 		 * Note that loopback interface is always okay.
604 		 * (this may happen when we are sending a packet to one of
605 		 *  our own addresses.)
606 		 */
607 		if (opt && opt->ip6po_pktinfo
608 		 && opt->ip6po_pktinfo->ipi6_ifindex) {
609 			if (!(ifp->if_flags & IFF_LOOPBACK)
610 			 && ifp->if_index != opt->ip6po_pktinfo->ipi6_ifindex) {
611 				ip6stat.ip6s_noroute++;
612 				in6_ifstat_inc(ifp, ifs6_out_discard);
613 				error = EHOSTUNREACH;
614 				goto bad;
615 			}
616 		}
617 
618 		if (opt && opt->ip6po_hlim != -1)
619 			ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
620 	} else {
621 		/* Multicast */
622 		struct	in6_multi *in6m;
623 
624 		m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
625 
626 		/*
627 		 * See if the caller provided any multicast options
628 		 */
629 		ifp = NULL;
630 		if (im6o != NULL) {
631 			ip6->ip6_hlim = im6o->im6o_multicast_hlim;
632 			if (im6o->im6o_multicast_ifp != NULL)
633 				ifp = im6o->im6o_multicast_ifp;
634 		} else
635 			ip6->ip6_hlim = ip6_defmcasthlim;
636 
637 		/*
638 		 * See if the caller provided the outgoing interface
639 		 * as an ancillary data.
640 		 * Boundary check for ifindex is assumed to be already done.
641 		 */
642 		if (opt && opt->ip6po_pktinfo && opt->ip6po_pktinfo->ipi6_ifindex)
643 			ifp = ifindex2ifnet[opt->ip6po_pktinfo->ipi6_ifindex];
644 
645 		/*
646 		 * If the destination is a node-local scope multicast,
647 		 * the packet should be loop-backed only.
648 		 */
649 		if (IN6_IS_ADDR_MC_NODELOCAL(&ip6->ip6_dst)) {
650 			/*
651 			 * If the outgoing interface is already specified,
652 			 * it should be a loopback interface.
653 			 */
654 			if (ifp && (ifp->if_flags & IFF_LOOPBACK) == 0) {
655 				ip6stat.ip6s_badscope++;
656 				error = ENETUNREACH; /* XXX: better error? */
657 				/* XXX correct ifp? */
658 				in6_ifstat_inc(ifp, ifs6_out_discard);
659 				goto bad;
660 			}
661 			else {
662 				ifp = lo0ifp;
663 			}
664 		}
665 
666 		if (opt && opt->ip6po_hlim != -1)
667 			ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
668 
669 		/*
670 		 * If caller did not provide an interface lookup a
671 		 * default in the routing table.  This is either a
672 		 * default for the speicfied group (i.e. a host
673 		 * route), or a multicast default (a route for the
674 		 * ``net'' ff00::/8).
675 		 */
676 		if (ifp == NULL) {
677 			if (ro->ro_rt == 0) {
678 				ro->ro_rt = rtalloc1((struct sockaddr *)
679 						&ro->ro_dst, 0);
680 			}
681 			if (ro->ro_rt == 0) {
682 				ip6stat.ip6s_noroute++;
683 				error = EHOSTUNREACH;
684 				/* XXX in6_ifstat_inc(ifp, ifs6_out_discard) */
685 				goto bad;
686 			}
687 			ia = ifatoia6(ro->ro_rt->rt_ifa);
688 			ifp = ro->ro_rt->rt_ifp;
689 			ro->ro_rt->rt_use++;
690 		}
691 
692 		if ((flags & IPV6_FORWARDING) == 0)
693 			in6_ifstat_inc(ifp, ifs6_out_request);
694 		in6_ifstat_inc(ifp, ifs6_out_mcast);
695 
696 		/*
697 		 * Confirm that the outgoing interface supports multicast.
698 		 */
699 		if ((ifp->if_flags & IFF_MULTICAST) == 0) {
700 			ip6stat.ip6s_noroute++;
701 			in6_ifstat_inc(ifp, ifs6_out_discard);
702 			error = ENETUNREACH;
703 			goto bad;
704 		}
705 		IN6_LOOKUP_MULTI(ip6->ip6_dst, ifp, in6m);
706 		if (in6m != NULL &&
707 		   (im6o == NULL || im6o->im6o_multicast_loop)) {
708 			/*
709 			 * If we belong to the destination multicast group
710 			 * on the outgoing interface, and the caller did not
711 			 * forbid loopback, loop back a copy.
712 			 */
713 			ip6_mloopback(ifp, m, dst);
714 		} else {
715 			/*
716 			 * If we are acting as a multicast router, perform
717 			 * multicast forwarding as if the packet had just
718 			 * arrived on the interface to which we are about
719 			 * to send.  The multicast forwarding function
720 			 * recursively calls this function, using the
721 			 * IPV6_FORWARDING flag to prevent infinite recursion.
722 			 *
723 			 * Multicasts that are looped back by ip6_mloopback(),
724 			 * above, will be forwarded by the ip6_input() routine,
725 			 * if necessary.
726 			 */
727 			if (ip6_mrouter && (flags & IPV6_FORWARDING) == 0) {
728 				if (ip6_mforward(ip6, ifp, m) != 0) {
729 					m_freem(m);
730 					goto done;
731 				}
732 			}
733 		}
734 		/*
735 		 * Multicasts with a hoplimit of zero may be looped back,
736 		 * above, but must not be transmitted on a network.
737 		 * Also, multicasts addressed to the loopback interface
738 		 * are not sent -- the above call to ip6_mloopback() will
739 		 * loop back a copy if this host actually belongs to the
740 		 * destination group on the loopback interface.
741 		 */
742 		if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK)) {
743 			m_freem(m);
744 			goto done;
745 		}
746 	}
747 
748 	/*
749 	 * Fill the outgoing inteface to tell the upper layer
750 	 * to increment per-interface statistics.
751 	 */
752 	if (ifpp)
753 		*ifpp = ifp;
754 
755 	/*
756 	 * Determine path MTU.
757 	 */
758 	if (ro_pmtu != ro) {
759 		/* The first hop and the final destination may differ. */
760 		struct sockaddr_in6 *sin6_fin =
761 			(struct sockaddr_in6 *)&ro_pmtu->ro_dst;
762 		if (ro_pmtu->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
763 				       !IN6_ARE_ADDR_EQUAL(&sin6_fin->sin6_addr,
764 							   &finaldst))) {
765 			RTFREE(ro_pmtu->ro_rt);
766 			ro_pmtu->ro_rt = (struct rtentry *)0;
767 		}
768 		if (ro_pmtu->ro_rt == 0) {
769 			bzero(sin6_fin, sizeof(*sin6_fin));
770 			sin6_fin->sin6_family = AF_INET6;
771 			sin6_fin->sin6_len = sizeof(struct sockaddr_in6);
772 			sin6_fin->sin6_addr = finaldst;
773 
774 			rtalloc((struct route *)ro_pmtu);
775 		}
776 	}
777 	if (ro_pmtu->ro_rt != NULL) {
778 		u_int32_t ifmtu = nd_ifinfo[ifp->if_index].linkmtu;
779 
780 		mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
781 		if (mtu > ifmtu || mtu == 0) {
782 			/*
783 			 * The MTU on the route is larger than the MTU on
784 			 * the interface!  This shouldn't happen, unless the
785 			 * MTU of the interface has been changed after the
786 			 * interface was brought up.  Change the MTU in the
787 			 * route to match the interface MTU (as long as the
788 			 * field isn't locked).
789 			 *
790 			 * if MTU on the route is 0, we need to fix the MTU.
791 			 * this case happens with path MTU discovery timeouts.
792 			 */
793 			 mtu = ifmtu;
794 			 if ((ro_pmtu->ro_rt->rt_rmx.rmx_locks & RTV_MTU) == 0)
795 				 ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu; /* XXX */
796 		}
797 	} else {
798 		mtu = nd_ifinfo[ifp->if_index].linkmtu;
799 	}
800 
801 	/* Fake scoped addresses */
802 	if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
803 		/*
804 		 * If source or destination address is a scoped address, and
805 		 * the packet is going to be sent to a loopback interface,
806 		 * we should keep the original interface.
807 		 */
808 
809 		/*
810 		 * XXX: this is a very experimental and temporary solution.
811 		 * We eventually have sockaddr_in6 and use the sin6_scope_id
812 		 * field of the structure here.
813 		 * We rely on the consistency between two scope zone ids
814 		 * of source add destination, which should already be assured
815 		 * Larger scopes than link will be supported in the near
816 		 * future.
817 		 */
818 		origifp = NULL;
819 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
820 			origifp = ifindex2ifnet[ntohs(ip6->ip6_src.s6_addr16[1])];
821 		else if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
822 			origifp = ifindex2ifnet[ntohs(ip6->ip6_dst.s6_addr16[1])];
823 		/*
824 		 * XXX: origifp can be NULL even in those two cases above.
825 		 * For example, if we remove the (only) link-local address
826 		 * from the loopback interface, and try to send a link-local
827 		 * address without link-id information.  Then the source
828 		 * address is ::1, and the destination address is the
829 		 * link-local address with its s6_addr16[1] being zero.
830 		 * What is worse, if the packet goes to the loopback interface
831 		 * by a default rejected route, the null pointer would be
832 		 * passed to looutput, and the kernel would hang.
833 		 * The following last resort would prevent such disaster.
834 		 */
835 		if (origifp == NULL)
836 			origifp = ifp;
837 	}
838 	else
839 		origifp = ifp;
840 	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
841 		ip6->ip6_src.s6_addr16[1] = 0;
842 	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
843 		ip6->ip6_dst.s6_addr16[1] = 0;
844 
845 	/*
846 	 * If the outgoing packet contains a hop-by-hop options header,
847 	 * it must be examined and processed even by the source node.
848 	 * (RFC 2460, section 4.)
849 	 */
850 	if (exthdrs.ip6e_hbh) {
851 		struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh,
852 					   struct ip6_hbh *);
853 		u_int32_t dummy1; /* XXX unused */
854 		u_int32_t dummy2; /* XXX unused */
855 
856 		/*
857 		 *  XXX: if we have to send an ICMPv6 error to the sender,
858 		 *       we need the M_LOOP flag since icmp6_error() expects
859 		 *       the IPv6 and the hop-by-hop options header are
860 		 *       continuous unless the flag is set.
861 		 */
862 		m->m_flags |= M_LOOP;
863 		m->m_pkthdr.rcvif = ifp;
864 		if (ip6_process_hopopts(m,
865 					(u_int8_t *)(hbh + 1),
866 					((hbh->ip6h_len + 1) << 3) -
867 					sizeof(struct ip6_hbh),
868 					&dummy1, &dummy2) < 0) {
869 			/* m was already freed at this point */
870 			error = EINVAL;/* better error? */
871 			goto done;
872 		}
873 		m->m_flags &= ~M_LOOP; /* XXX */
874 		m->m_pkthdr.rcvif = NULL;
875 	}
876 
877 	/*
878 	 * Send the packet to the outgoing interface.
879 	 * If necessary, do IPv6 fragmentation before sending.
880 	 */
881 	tlen = m->m_pkthdr.len;
882 	if (tlen <= mtu
883 #ifdef notyet
884 	    /*
885 	     * On any link that cannot convey a 1280-octet packet in one piece,
886 	     * link-specific fragmentation and reassembly must be provided at
887 	     * a layer below IPv6. [RFC 2460, sec.5]
888 	     * Thus if the interface has ability of link-level fragmentation,
889 	     * we can just send the packet even if the packet size is
890 	     * larger than the link's MTU.
891 	     * XXX: IFF_FRAGMENTABLE (or such) flag has not been defined yet...
892 	     */
893 
894 	    || ifp->if_flags & IFF_FRAGMENTABLE
895 #endif
896 	    )
897 	{
898 #ifdef OLDIP6OUTPUT
899 		error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst,
900 					  ro->ro_rt);
901 #else
902 		error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
903 #endif
904 		goto done;
905 	} else if (mtu < IPV6_MMTU) {
906 		/*
907 		 * note that path MTU is never less than IPV6_MMTU
908 		 * (see icmp6_input).
909 		 */
910 		error = EMSGSIZE;
911 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
912 		goto bad;
913 	} else if (ip6->ip6_plen == 0) { /* jumbo payload cannot be fragmented */
914 		error = EMSGSIZE;
915 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
916 		goto bad;
917 	} else {
918 		struct mbuf **mnext, *m_frgpart;
919 		struct ip6_frag *ip6f;
920 		u_int32_t id = htonl(ip6_id++);
921 		u_char nextproto;
922 
923 		/*
924 		 * Too large for the destination or interface;
925 		 * fragment if possible.
926 		 * Must be able to put at least 8 bytes per fragment.
927 		 */
928 		hlen = unfragpartlen;
929 		if (mtu > IPV6_MAXPACKET)
930 			mtu = IPV6_MAXPACKET;
931 		len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
932 		if (len < 8) {
933 			error = EMSGSIZE;
934 			in6_ifstat_inc(ifp, ifs6_out_fragfail);
935 			goto bad;
936 		}
937 
938 		mnext = &m->m_nextpkt;
939 
940 		/*
941 		 * Change the next header field of the last header in the
942 		 * unfragmentable part.
943 		 */
944 		if (exthdrs.ip6e_rthdr) {
945 			nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
946 			*mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
947 		} else if (exthdrs.ip6e_dest1) {
948 			nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
949 			*mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
950 		} else if (exthdrs.ip6e_hbh) {
951 			nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
952 			*mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
953 		} else {
954 			nextproto = ip6->ip6_nxt;
955 			ip6->ip6_nxt = IPPROTO_FRAGMENT;
956 		}
957 
958 		/*
959 		 * Loop through length of segment after first fragment,
960 		 * make new header and copy data of each part and link onto chain.
961 		 */
962 		m0 = m;
963 		for (off = hlen; off < tlen; off += len) {
964 			MGETHDR(m, M_DONTWAIT, MT_HEADER);
965 			if (!m) {
966 				error = ENOBUFS;
967 				ip6stat.ip6s_odropped++;
968 				goto sendorfree;
969 			}
970 			m->m_flags = m0->m_flags & M_COPYFLAGS;
971 			*mnext = m;
972 			mnext = &m->m_nextpkt;
973 			m->m_data += max_linkhdr;
974 			mhip6 = mtod(m, struct ip6_hdr *);
975 			*mhip6 = *ip6;
976 			m->m_len = sizeof(*mhip6);
977  			error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
978  			if (error) {
979 				ip6stat.ip6s_odropped++;
980 				goto sendorfree;
981 			}
982 			ip6f->ip6f_offlg = htons((u_short)((off - hlen) & ~7));
983 			if (off + len >= tlen)
984 				len = tlen - off;
985 			else
986 				ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
987 			mhip6->ip6_plen = htons((u_short)(len + hlen +
988 							  sizeof(*ip6f) -
989 							  sizeof(struct ip6_hdr)));
990 			if ((m_frgpart = m_copy(m0, off, len)) == 0) {
991 				error = ENOBUFS;
992 				ip6stat.ip6s_odropped++;
993 				goto sendorfree;
994 			}
995 			m_cat(m, m_frgpart);
996 			m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
997 			m->m_pkthdr.rcvif = (struct ifnet *)0;
998 			ip6f->ip6f_reserved = 0;
999 			ip6f->ip6f_ident = id;
1000 			ip6f->ip6f_nxt = nextproto;
1001 			ip6stat.ip6s_ofragments++;
1002 			in6_ifstat_inc(ifp, ifs6_out_fragcreat);
1003 		}
1004 
1005 		in6_ifstat_inc(ifp, ifs6_out_fragok);
1006 	}
1007 
1008 	/*
1009 	 * Remove leading garbages.
1010 	 */
1011 sendorfree:
1012 	m = m0->m_nextpkt;
1013 	m0->m_nextpkt = 0;
1014 	m_freem(m0);
1015 	for (m0 = m; m; m = m0) {
1016 		m0 = m->m_nextpkt;
1017 		m->m_nextpkt = 0;
1018 		if (error == 0) {
1019 #ifdef OLDIP6OUTPUT
1020 			error = (*ifp->if_output)(ifp, m,
1021 						  (struct sockaddr *)dst,
1022 						  ro->ro_rt);
1023 #else
1024 			error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
1025 #endif
1026 		} else
1027 			m_freem(m);
1028 	}
1029 
1030 	if (error == 0)
1031 		ip6stat.ip6s_fragmented++;
1032 
1033 done:
1034 	if (ro == &ip6route && ro->ro_rt) { /* brace necessary for RTFREE */
1035 		RTFREE(ro->ro_rt);
1036 	} else if (ro_pmtu == &ip6route && ro_pmtu->ro_rt) {
1037 		RTFREE(ro_pmtu->ro_rt);
1038 	}
1039 
1040 	return(error);
1041 
1042 freehdrs:
1043 	m_freem(exthdrs.ip6e_hbh);	/* m_freem will check if mbuf is 0 */
1044 	m_freem(exthdrs.ip6e_dest1);
1045 	m_freem(exthdrs.ip6e_rthdr);
1046 	m_freem(exthdrs.ip6e_dest2);
1047 	/* fall through */
1048 bad:
1049 	m_freem(m);
1050 	goto done;
1051 }
1052 
1053 static int
1054 ip6_copyexthdr(mp, hdr, hlen)
1055 	struct mbuf **mp;
1056 	caddr_t hdr;
1057 	int hlen;
1058 {
1059 	struct mbuf *m;
1060 
1061 	if (hlen > MCLBYTES)
1062 		return(ENOBUFS); /* XXX */
1063 
1064 	MGET(m, M_DONTWAIT, MT_DATA);
1065 	if (!m)
1066 		return(ENOBUFS);
1067 
1068 	if (hlen > MLEN) {
1069 		MCLGET(m, M_DONTWAIT);
1070 		if ((m->m_flags & M_EXT) == 0) {
1071 			m_free(m);
1072 			return(ENOBUFS);
1073 		}
1074 	}
1075 	m->m_len = hlen;
1076 	if (hdr)
1077 		bcopy(hdr, mtod(m, caddr_t), hlen);
1078 
1079 	*mp = m;
1080 	return(0);
1081 }
1082 
1083 /*
1084  * Insert jumbo payload option.
1085  */
1086 static int
1087 ip6_insert_jumboopt(exthdrs, plen)
1088 	struct ip6_exthdrs *exthdrs;
1089 	u_int32_t plen;
1090 {
1091 	struct mbuf *mopt;
1092 	u_char *optbuf;
1093 	u_int32_t v;
1094 
1095 #define JUMBOOPTLEN	8	/* length of jumbo payload option and padding */
1096 
1097 	/*
1098 	 * If there is no hop-by-hop options header, allocate new one.
1099 	 * If there is one but it doesn't have enough space to store the
1100 	 * jumbo payload option, allocate a cluster to store the whole options.
1101 	 * Otherwise, use it to store the options.
1102 	 */
1103 	if (exthdrs->ip6e_hbh == 0) {
1104 		MGET(mopt, M_DONTWAIT, MT_DATA);
1105 		if (mopt == 0)
1106 			return(ENOBUFS);
1107 		mopt->m_len = JUMBOOPTLEN;
1108 		optbuf = mtod(mopt, u_char *);
1109 		optbuf[1] = 0;	/* = ((JUMBOOPTLEN) >> 3) - 1 */
1110 		exthdrs->ip6e_hbh = mopt;
1111 	} else {
1112 		struct ip6_hbh *hbh;
1113 
1114 		mopt = exthdrs->ip6e_hbh;
1115 		if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
1116 			/*
1117 			 * XXX assumption:
1118 			 * - exthdrs->ip6e_hbh is not referenced from places
1119 			 *   other than exthdrs.
1120 			 * - exthdrs->ip6e_hbh is not an mbuf chain.
1121 			 */
1122 			int oldoptlen = mopt->m_len;
1123 			struct mbuf *n;
1124 
1125 			/*
1126 			 * XXX: give up if the whole (new) hbh header does
1127 			 * not fit even in an mbuf cluster.
1128 			 */
1129 			if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
1130 				return(ENOBUFS);
1131 
1132 			/*
1133 			 * As a consequence, we must always prepare a cluster
1134 			 * at this point.
1135 			 */
1136 			MGET(n, M_DONTWAIT, MT_DATA);
1137 			if (n) {
1138 				MCLGET(n, M_DONTWAIT);
1139 				if ((n->m_flags & M_EXT) == 0) {
1140 					m_freem(n);
1141 					n = NULL;
1142 				}
1143 			}
1144 			if (!n)
1145 				return(ENOBUFS);
1146 			n->m_len = oldoptlen + JUMBOOPTLEN;
1147 			bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t),
1148 			      oldoptlen);
1149 			optbuf = mtod(n, caddr_t) + oldoptlen;
1150 			m_freem(mopt);
1151 			mopt = exthdrs->ip6e_hbh = n;
1152 		} else {
1153 			optbuf = mtod(mopt, u_char *) + mopt->m_len;
1154 			mopt->m_len += JUMBOOPTLEN;
1155 		}
1156 		optbuf[0] = IP6OPT_PADN;
1157 		optbuf[1] = 1;
1158 
1159 		/*
1160 		 * Adjust the header length according to the pad and
1161 		 * the jumbo payload option.
1162 		 */
1163 		hbh = mtod(mopt, struct ip6_hbh *);
1164 		hbh->ip6h_len += (JUMBOOPTLEN >> 3);
1165 	}
1166 
1167 	/* fill in the option. */
1168 	optbuf[2] = IP6OPT_JUMBO;
1169 	optbuf[3] = 4;
1170 	v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
1171 	bcopy(&v, &optbuf[4], sizeof(u_int32_t));
1172 
1173 	/* finally, adjust the packet header length */
1174 	exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
1175 
1176 	return(0);
1177 #undef JUMBOOPTLEN
1178 }
1179 
1180 /*
1181  * Insert fragment header and copy unfragmentable header portions.
1182  */
1183 static int
1184 ip6_insertfraghdr(m0, m, hlen, frghdrp)
1185 	struct mbuf *m0, *m;
1186 	int hlen;
1187 	struct ip6_frag **frghdrp;
1188 {
1189 	struct mbuf *n, *mlast;
1190 
1191 	if (hlen > sizeof(struct ip6_hdr)) {
1192 		n = m_copym(m0, sizeof(struct ip6_hdr),
1193 			    hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
1194 		if (n == 0)
1195 			return(ENOBUFS);
1196 		m->m_next = n;
1197 	} else
1198 		n = m;
1199 
1200 	/* Search for the last mbuf of unfragmentable part. */
1201 	for (mlast = n; mlast->m_next; mlast = mlast->m_next)
1202 		;
1203 
1204 	if ((mlast->m_flags & M_EXT) == 0 &&
1205 	    M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
1206 		/* use the trailing space of the last mbuf for the fragment hdr */
1207 		*frghdrp =
1208 			(struct ip6_frag *)(mtod(mlast, caddr_t) + mlast->m_len);
1209 		mlast->m_len += sizeof(struct ip6_frag);
1210 		m->m_pkthdr.len += sizeof(struct ip6_frag);
1211 	} else {
1212 		/* allocate a new mbuf for the fragment header */
1213 		struct mbuf *mfrg;
1214 
1215 		MGET(mfrg, M_DONTWAIT, MT_DATA);
1216 		if (mfrg == 0)
1217 			return(ENOBUFS);
1218 		mfrg->m_len = sizeof(struct ip6_frag);
1219 		*frghdrp = mtod(mfrg, struct ip6_frag *);
1220 		mlast->m_next = mfrg;
1221 	}
1222 
1223 	return(0);
1224 }
1225 
1226 /*
1227  * IP6 socket option processing.
1228  */
1229 int
1230 ip6_ctloutput(op, so, level, optname, mp)
1231 	int op;
1232 	struct socket *so;
1233 	int level, optname;
1234 	struct mbuf **mp;
1235 {
1236 	int privileged;
1237 	struct inpcb *inp = sotoinpcb(so);
1238 	struct mbuf *m = *mp;
1239 	int error, optval;
1240 	int optlen;
1241 #ifdef IPSEC
1242 	struct proc *p = curproc; /* XXX */
1243 	struct tdb *tdb;
1244 	struct tdb_ident *tdbip, tdbi;
1245 	int s;
1246 #endif
1247 
1248 	optlen = m ? m->m_len : 0;
1249 	error = optval = 0;
1250 
1251 	privileged = (inp->inp_socket->so_state & SS_PRIV);
1252 
1253 	if (level == IPPROTO_IPV6) {
1254 		switch (op) {
1255 		case PRCO_SETOPT:
1256 			switch (optname) {
1257 			case IPV6_PKTOPTIONS:
1258 				/* m is freed in ip6_pcbopts */
1259 				return(ip6_pcbopts(&inp->inp_outputopts6,
1260 						   m, so));
1261 			case IPV6_HOPOPTS:
1262 			case IPV6_DSTOPTS:
1263 				if (!privileged) {
1264 					error = EPERM;
1265 					break;
1266 				}
1267 				/* fall through */
1268 			case IPV6_UNICAST_HOPS:
1269 			case IPV6_RECVOPTS:
1270 			case IPV6_RECVRETOPTS:
1271 			case IPV6_RECVDSTADDR:
1272 			case IPV6_PKTINFO:
1273 			case IPV6_HOPLIMIT:
1274 			case IPV6_RTHDR:
1275 			case IPV6_CHECKSUM:
1276 			case IPV6_FAITH:
1277 				if (optlen != sizeof(int))
1278 					error = EINVAL;
1279 				else {
1280 					optval = *mtod(m, int *);
1281 					switch (optname) {
1282 
1283 					case IPV6_UNICAST_HOPS:
1284 						if (optval < -1 || optval >= 256)
1285 							error = EINVAL;
1286 						else {
1287 							/* -1 = kernel default */
1288 							inp->inp_hops = optval;
1289 						}
1290 						break;
1291 #define OPTSET(bit) \
1292 	if (optval) \
1293 		inp->inp_flags |= bit; \
1294 	else \
1295 		inp->inp_flags &= ~bit;
1296 					case IPV6_RECVOPTS:
1297 						OPTSET(IN6P_RECVOPTS);
1298 						break;
1299 
1300 					case IPV6_RECVRETOPTS:
1301 						OPTSET(IN6P_RECVRETOPTS);
1302 						break;
1303 
1304 					case IPV6_RECVDSTADDR:
1305 						OPTSET(IN6P_RECVDSTADDR);
1306 						break;
1307 
1308 					case IPV6_PKTINFO:
1309 						OPTSET(IN6P_PKTINFO);
1310 						break;
1311 
1312 					case IPV6_HOPLIMIT:
1313 						OPTSET(IN6P_HOPLIMIT);
1314 						break;
1315 
1316 					case IPV6_HOPOPTS:
1317 						OPTSET(IN6P_HOPOPTS);
1318 						break;
1319 
1320 					case IPV6_DSTOPTS:
1321 						OPTSET(IN6P_DSTOPTS);
1322 						break;
1323 
1324 					case IPV6_RTHDR:
1325 						OPTSET(IN6P_RTHDR);
1326 						break;
1327 
1328 					case IPV6_CHECKSUM:
1329 						inp->in6p_cksum = optval;
1330 						break;
1331 
1332 					case IPV6_FAITH:
1333 						OPTSET(IN6P_FAITH);
1334 						break;
1335 					}
1336 				}
1337 				break;
1338 #undef OPTSET
1339 
1340 			case IPV6_MULTICAST_IF:
1341 			case IPV6_MULTICAST_HOPS:
1342 			case IPV6_MULTICAST_LOOP:
1343 			case IPV6_JOIN_GROUP:
1344 			case IPV6_LEAVE_GROUP:
1345 				error =	ip6_setmoptions(optname,
1346 					&inp->inp_moptions6, m);
1347 				break;
1348 
1349 			case IPV6_PORTRANGE:
1350 				optval = *mtod(m, int *);
1351 
1352 # define in6p		inp
1353 # define in6p_flags	inp_flags
1354 				switch (optval) {
1355 				case IPV6_PORTRANGE_DEFAULT:
1356 					in6p->in6p_flags &= ~(IN6P_LOWPORT);
1357 					in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1358 					break;
1359 
1360 				case IPV6_PORTRANGE_HIGH:
1361 					in6p->in6p_flags &= ~(IN6P_LOWPORT);
1362 					in6p->in6p_flags |= IN6P_HIGHPORT;
1363 					break;
1364 
1365 				case IPV6_PORTRANGE_LOW:
1366 					in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1367 					in6p->in6p_flags |= IN6P_LOWPORT;
1368 					break;
1369 
1370 				default:
1371 					error = EINVAL;
1372 					break;
1373 				}
1374 # undef in6p
1375 # undef in6p_flags
1376 				break;
1377 
1378 #if 0 /*KAME IPSEC*/
1379 			case IPV6_IPSEC_POLICY:
1380 			    {
1381 				caddr_t req = NULL;
1382 				if (m != 0)
1383 					req = mtod(m, caddr_t);
1384 				error = ipsec6_set_policy(in6p, optname, req,
1385 				                          privileged);
1386 			    }
1387 				break;
1388 #endif /* IPSEC */
1389 
1390 			case IPSEC6_OUTSA:
1391 #ifndef IPSEC
1392 				error = EINVAL;
1393 #else
1394 				s = spltdb();
1395 				if (m == 0 || m->m_len != sizeof(struct tdb_ident)) {
1396 					error = EINVAL;
1397 				} else {
1398 					tdbip = mtod(m, struct tdb_ident *);
1399 					tdb = gettdb(tdbip->spi, &tdbip->dst,
1400 						     tdbip->proto);
1401 					if (tdb == NULL)
1402 						error = ESRCH;
1403 					else
1404 						tdb_add_inp(tdb, inp, 0);
1405 				}
1406 				splx(s);
1407 #endif /* IPSEC */
1408 				break;
1409 
1410 			case IPV6_AUTH_LEVEL:
1411 			case IPV6_ESP_TRANS_LEVEL:
1412 			case IPV6_ESP_NETWORK_LEVEL:
1413 			case IPV6_IPCOMP_LEVEL:
1414 #ifndef IPSEC
1415 				error = EINVAL;
1416 #else
1417 				if (m == 0 || m->m_len != sizeof(int)) {
1418 					error = EINVAL;
1419 					break;
1420 				}
1421 				optval = *mtod(m, int *);
1422 
1423 				if (optval < IPSEC_LEVEL_BYPASS ||
1424 				    optval > IPSEC_LEVEL_UNIQUE) {
1425 					error = EINVAL;
1426 					break;
1427 				}
1428 
1429 				switch (optname) {
1430 				case IPV6_AUTH_LEVEL:
1431 				        if (optval < ipsec_auth_default_level &&
1432 					    suser(p->p_ucred, &p->p_acflag)) {
1433 						error = EACCES;
1434 						break;
1435 					}
1436 					inp->inp_seclevel[SL_AUTH] = optval;
1437 					break;
1438 
1439 				case IPV6_ESP_TRANS_LEVEL:
1440 				        if (optval < ipsec_esp_trans_default_level &&
1441 					    suser(p->p_ucred, &p->p_acflag)) {
1442 						error = EACCES;
1443 						break;
1444 					}
1445 					inp->inp_seclevel[SL_ESP_TRANS] = optval;
1446 					break;
1447 
1448 				case IPV6_ESP_NETWORK_LEVEL:
1449 				        if (optval < ipsec_esp_network_default_level &&
1450 					    suser(p->p_ucred, &p->p_acflag)) {
1451 						error = EACCES;
1452 						break;
1453 					}
1454 					inp->inp_seclevel[SL_ESP_NETWORK] = optval;
1455 					break;
1456 
1457 				case IPV6_IPCOMP_LEVEL:
1458 				        if (optval < ipsec_ipcomp_default_level &&
1459 					    suser(p->p_ucred, &p->p_acflag)) {
1460 						error = EACCES;
1461 						break;
1462 					}
1463 					inp->inp_seclevel[SL_IPCOMP] = optval;
1464 					break;
1465 				}
1466 				if (!error)
1467 					inp->inp_secrequire = get_sa_require(inp);
1468 #endif
1469 				break;
1470 
1471 
1472 			default:
1473 				error = ENOPROTOOPT;
1474 				break;
1475 			}
1476 			if (m)
1477 				(void)m_free(m);
1478 			break;
1479 
1480 		case PRCO_GETOPT:
1481 			switch (optname) {
1482 
1483 			case IPV6_OPTIONS:
1484 			case IPV6_RETOPTS:
1485 #if 0
1486 				*mp = m = m_get(M_WAIT, MT_SOOPTS);
1487 				if (in6p->in6p_options) {
1488 					m->m_len = in6p->in6p_options->m_len;
1489 					bcopy(mtod(in6p->in6p_options, caddr_t),
1490 					      mtod(m, caddr_t),
1491 					      (unsigned)m->m_len);
1492 				} else
1493 					m->m_len = 0;
1494 				break;
1495 #else
1496 				error = ENOPROTOOPT;
1497 				break;
1498 #endif
1499 
1500 			case IPV6_PKTOPTIONS:
1501 				if (inp->inp_options) {
1502 					*mp = m_copym(inp->inp_options, 0,
1503 						      M_COPYALL, M_WAIT);
1504 				} else {
1505 					*mp = m_get(M_WAIT, MT_SOOPTS);
1506 					(*mp)->m_len = 0;
1507 				}
1508 				break;
1509 
1510 			case IPV6_HOPOPTS:
1511 			case IPV6_DSTOPTS:
1512 				if (!privileged) {
1513 					error = EPERM;
1514 					break;
1515 				}
1516 				/* fall through */
1517 			case IPV6_UNICAST_HOPS:
1518 			case IPV6_RECVOPTS:
1519 			case IPV6_RECVRETOPTS:
1520 			case IPV6_RECVDSTADDR:
1521 			case IPV6_PKTINFO:
1522 			case IPV6_HOPLIMIT:
1523 			case IPV6_RTHDR:
1524 			case IPV6_CHECKSUM:
1525 			case IPV6_FAITH:
1526 			case IPV6_PORTRANGE:
1527 				switch (optname) {
1528 
1529 				case IPV6_UNICAST_HOPS:
1530 					optval = inp->inp_hops;
1531 					break;
1532 
1533 #define OPTBIT(bit) (inp->inp_flags & bit ? 1 : 0)
1534 
1535 				case IPV6_RECVOPTS:
1536 					optval = OPTBIT(IN6P_RECVOPTS);
1537 					break;
1538 
1539 				case IPV6_RECVRETOPTS:
1540 					optval = OPTBIT(IN6P_RECVRETOPTS);
1541 					break;
1542 
1543 				case IPV6_RECVDSTADDR:
1544 					optval = OPTBIT(IN6P_RECVDSTADDR);
1545 					break;
1546 
1547 				case IPV6_PKTINFO:
1548 					optval = OPTBIT(IN6P_PKTINFO);
1549 					break;
1550 
1551 				case IPV6_HOPLIMIT:
1552 					optval = OPTBIT(IN6P_HOPLIMIT);
1553 					break;
1554 
1555 				case IPV6_HOPOPTS:
1556 					optval = OPTBIT(IN6P_HOPOPTS);
1557 					break;
1558 
1559 				case IPV6_DSTOPTS:
1560 					optval = OPTBIT(IN6P_DSTOPTS);
1561 					break;
1562 
1563 				case IPV6_RTHDR:
1564 					optval = OPTBIT(IN6P_RTHDR);
1565 					break;
1566 
1567 				case IPV6_CHECKSUM:
1568 					optval = inp->in6p_cksum;
1569 					break;
1570 
1571 				case IPV6_FAITH:
1572 					optval = OPTBIT(IN6P_FAITH);
1573 					break;
1574 
1575 				case IPV6_PORTRANGE:
1576 				    {
1577 					int flags;
1578 
1579 					flags = inp->inp_flags;
1580 					if (flags & IN6P_HIGHPORT)
1581 						optval = IPV6_PORTRANGE_HIGH;
1582 					else if (flags & IN6P_LOWPORT)
1583 						optval = IPV6_PORTRANGE_LOW;
1584 					else
1585 						optval = 0;
1586 					break;
1587 				    }
1588 				}
1589 				*mp = m = m_get(M_WAIT, MT_SOOPTS);
1590 				m->m_len = sizeof(int);
1591 				*mtod(m, int *) = optval;
1592 				break;
1593 
1594 			case IPV6_MULTICAST_IF:
1595 			case IPV6_MULTICAST_HOPS:
1596 			case IPV6_MULTICAST_LOOP:
1597 			case IPV6_JOIN_GROUP:
1598 			case IPV6_LEAVE_GROUP:
1599 				error = ip6_getmoptions(optname, inp->inp_moptions6, mp);
1600 				break;
1601 
1602 #if 0 /*KAME IPSEC*/
1603 			case IPV6_IPSEC_POLICY:
1604 			  {
1605 				caddr_t req = NULL;
1606 				int len = 0;
1607 
1608 				if (m != 0) {
1609 					req = mtod(m, caddr_t);
1610 					len = m->m_len;
1611 				}
1612 				error = ipsec6_get_policy(in6p, req, mp);
1613 				break;
1614 			  }
1615 #endif /* IPSEC */
1616 
1617 			case IPSEC6_OUTSA:
1618 #ifndef IPSEC
1619 				error = EINVAL;
1620 #else
1621 				s = spltdb();
1622 				if (inp->inp_tdb_out == NULL) {
1623 					error = ENOENT;
1624 				} else {
1625 					tdbi.spi = inp->inp_tdb_out->tdb_spi;
1626 					tdbi.dst = inp->inp_tdb_out->tdb_dst;
1627 					tdbi.proto = inp->inp_tdb_out->tdb_sproto;
1628 					*mp = m = m_get(M_WAIT, MT_SOOPTS);
1629 					m->m_len = sizeof(tdbi);
1630 					bcopy((caddr_t)&tdbi, mtod(m, caddr_t),
1631 					    (unsigned)m->m_len);
1632 				}
1633 				splx(s);
1634 #endif /* IPSEC */
1635 				break;
1636 
1637 			case IPV6_AUTH_LEVEL:
1638 			case IPV6_ESP_TRANS_LEVEL:
1639 			case IPV6_ESP_NETWORK_LEVEL:
1640 			case IPV6_IPCOMP_LEVEL:
1641 #ifndef IPSEC
1642 				m->m_len = sizeof(int);
1643 				*mtod(m, int *) = IPSEC_LEVEL_NONE;
1644 #else
1645 				m->m_len = sizeof(int);
1646 				switch (optname) {
1647 				case IP_AUTH_LEVEL:
1648 					optval = inp->inp_seclevel[SL_AUTH];
1649 					break;
1650 
1651 				case IP_ESP_TRANS_LEVEL:
1652 					optval =
1653 					    inp->inp_seclevel[SL_ESP_TRANS];
1654 					break;
1655 
1656 				case IP_ESP_NETWORK_LEVEL:
1657 					optval =
1658 					    inp->inp_seclevel[SL_ESP_NETWORK];
1659 					break;
1660 
1661 				case IP_IPCOMP_LEVEL:
1662 					optval = inp->inp_seclevel[SL_IPCOMP];
1663 					break;
1664 				}
1665 				*mtod(m, int *) = optval;
1666 #endif
1667 				break;
1668 
1669 			default:
1670 				error = ENOPROTOOPT;
1671 				break;
1672 			}
1673 			break;
1674 		}
1675 	} else {
1676 		error = EINVAL;
1677 		if (op == PRCO_SETOPT && *mp)
1678 			(void)m_free(*mp);
1679 	}
1680 	return(error);
1681 }
1682 
1683 /*
1684  * Set up IP6 options in pcb for insertion in output packets.
1685  * Store in mbuf with pointer in pcbopt, adding pseudo-option
1686  * with destination address if source routed.
1687  */
1688 static int
1689 ip6_pcbopts(pktopt, m, so)
1690 	struct ip6_pktopts **pktopt;
1691 	struct mbuf *m;
1692 	struct socket *so;
1693 {
1694 	struct ip6_pktopts *opt = *pktopt;
1695 	int error = 0;
1696 	struct proc *p = curproc;	/* XXX */
1697 	int priv = 0;
1698 
1699 	/* turn off any old options. */
1700 	if (opt) {
1701 		if (opt->ip6po_m)
1702 			(void)m_free(opt->ip6po_m);
1703 	}
1704 	else
1705 		opt = malloc(sizeof(*opt), M_IP6OPT, M_WAITOK);
1706 	*pktopt = 0;
1707 
1708 	if (!m || m->m_len == 0) {
1709 		/*
1710 		 * Only turning off any previous options.
1711 		 */
1712 		if (opt)
1713 			free(opt, M_IP6OPT);
1714 		if (m)
1715 			(void)m_free(m);
1716 		return(0);
1717 	}
1718 
1719 	/*  set options specified by user. */
1720 	if (p && !suser(p->p_ucred, &p->p_acflag))
1721 		priv = 1;
1722 	if ((error = ip6_setpktoptions(m, opt, priv)) != 0) {
1723 		(void)m_free(m);
1724 		return(error);
1725 	}
1726 	*pktopt = opt;
1727 	return(0);
1728 }
1729 
1730 /*
1731  * Set the IP6 multicast options in response to user setsockopt().
1732  */
1733 static int
1734 ip6_setmoptions(optname, im6op, m)
1735 	int optname;
1736 	struct ip6_moptions **im6op;
1737 	struct mbuf *m;
1738 {
1739 	int error = 0;
1740 	u_int loop, ifindex;
1741 	struct ipv6_mreq *mreq;
1742 	struct ifnet *ifp;
1743 	struct ip6_moptions *im6o = *im6op;
1744 	struct route_in6 ro;
1745 	struct sockaddr_in6 *dst;
1746 	struct in6_multi_mship *imm;
1747 	struct proc *p = curproc;	/* XXX */
1748 
1749 	if (im6o == NULL) {
1750 		/*
1751 		 * No multicast option buffer attached to the pcb;
1752 		 * allocate one and initialize to default values.
1753 		 */
1754 		im6o = (struct ip6_moptions *)
1755 			malloc(sizeof(*im6o), M_IPMOPTS, M_WAITOK);
1756 
1757 		*im6op = im6o;
1758 		im6o->im6o_multicast_ifp = NULL;
1759 		im6o->im6o_multicast_hlim = ip6_defmcasthlim;
1760 		im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
1761 		LIST_INIT(&im6o->im6o_memberships);
1762 	}
1763 
1764 	switch (optname) {
1765 
1766 	case IPV6_MULTICAST_IF:
1767 		/*
1768 		 * Select the interface for outgoing multicast packets.
1769 		 */
1770 		if (m == NULL || m->m_len != sizeof(u_int)) {
1771 			error = EINVAL;
1772 			break;
1773 		}
1774 		ifindex = *(mtod(m, u_int *));
1775 		if (ifindex < 0 || if_index < ifindex) {
1776 			error = ENXIO;	/* XXX EINVAL? */
1777 			break;
1778 		}
1779 		ifp = ifindex2ifnet[ifindex];
1780 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1781 			error = EADDRNOTAVAIL;
1782 			break;
1783 		}
1784 		im6o->im6o_multicast_ifp = ifp;
1785 		break;
1786 
1787 	case IPV6_MULTICAST_HOPS:
1788 	    {
1789 		/*
1790 		 * Set the IP6 hoplimit for outgoing multicast packets.
1791 		 */
1792 		int optval;
1793 		if (m == NULL || m->m_len != sizeof(int)) {
1794 			error = EINVAL;
1795 			break;
1796 		}
1797 		optval = *(mtod(m, u_int *));
1798 		if (optval < -1 || optval >= 256)
1799 			error = EINVAL;
1800 		else if (optval == -1)
1801 			im6o->im6o_multicast_hlim = ip6_defmcasthlim;
1802 		else
1803 			im6o->im6o_multicast_hlim = optval;
1804 		break;
1805 	    }
1806 
1807 	case IPV6_MULTICAST_LOOP:
1808 		/*
1809 		 * Set the loopback flag for outgoing multicast packets.
1810 		 * Must be zero or one.
1811 		 */
1812 		if (m == NULL || m->m_len != sizeof(u_int) ||
1813 		   (loop = *(mtod(m, u_int *))) > 1) {
1814 			error = EINVAL;
1815 			break;
1816 		}
1817 		im6o->im6o_multicast_loop = loop;
1818 		break;
1819 
1820 	case IPV6_JOIN_GROUP:
1821 		/*
1822 		 * Add a multicast group membership.
1823 		 * Group must be a valid IP6 multicast address.
1824 		 */
1825 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
1826 			error = EINVAL;
1827 			break;
1828 		}
1829 		mreq = mtod(m, struct ipv6_mreq *);
1830 		if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
1831 			/*
1832 			 * We use the unspecified address to specify to accept
1833 			 * all multicast addresses. Only super user is allowed
1834 			 * to do this.
1835 			 */
1836 			if (suser(p->p_ucred, &p->p_acflag)) {
1837 				error = EACCES;
1838 				break;
1839 			}
1840 		} else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
1841 			error = EINVAL;
1842 			break;
1843 		}
1844 
1845 		/*
1846 		 * If the interface is specified, validate it.
1847 		 */
1848 		if (mreq->ipv6mr_interface < 0
1849 		 || if_index < mreq->ipv6mr_interface) {
1850 			error = ENXIO;	/* XXX EINVAL? */
1851 			break;
1852 		}
1853 		/*
1854 		 * If no interface was explicitly specified, choose an
1855 		 * appropriate one according to the given multicast address.
1856 		 */
1857 		if (mreq->ipv6mr_interface == 0) {
1858 			/*
1859 			 * If the multicast address is in node-local scope,
1860 			 * the interface should be a loopback interface.
1861 			 * Otherwise, look up the routing table for the
1862 			 * address, and choose the outgoing interface.
1863 			 *   XXX: is it a good approach?
1864 			 */
1865 			if (IN6_IS_ADDR_MC_NODELOCAL(&mreq->ipv6mr_multiaddr)) {
1866 				ifp = lo0ifp;
1867 			}
1868 			else {
1869 				ro.ro_rt = NULL;
1870 				dst = (struct sockaddr_in6 *)&ro.ro_dst;
1871 				bzero(dst, sizeof(*dst));
1872 				dst->sin6_len = sizeof(struct sockaddr_in6);
1873 				dst->sin6_family = AF_INET6;
1874 				dst->sin6_addr = mreq->ipv6mr_multiaddr;
1875 				rtalloc((struct route *)&ro);
1876 				if (ro.ro_rt == NULL) {
1877 					error = EADDRNOTAVAIL;
1878 					break;
1879 				}
1880 				ifp = ro.ro_rt->rt_ifp;
1881 				rtfree(ro.ro_rt);
1882 			}
1883 		} else
1884 			ifp = ifindex2ifnet[mreq->ipv6mr_interface];
1885 
1886 		/*
1887 		 * See if we found an interface, and confirm that it
1888 		 * supports multicast
1889 		 */
1890 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1891 			error = EADDRNOTAVAIL;
1892 			break;
1893 		}
1894 		/*
1895 		 * Put interface index into the multicast address,
1896 		 * if the address has link-local scope.
1897 		 */
1898 		if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
1899 			mreq->ipv6mr_multiaddr.s6_addr16[1]
1900 				= htons(mreq->ipv6mr_interface);
1901 		}
1902 		/*
1903 		 * See if the membership already exists.
1904 		 */
1905 		for (imm = im6o->im6o_memberships.lh_first;
1906 		     imm != NULL; imm = imm->i6mm_chain.le_next)
1907 			if (imm->i6mm_maddr->in6m_ifp == ifp &&
1908 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
1909 					       &mreq->ipv6mr_multiaddr))
1910 				break;
1911 		if (imm != NULL) {
1912 			error = EADDRINUSE;
1913 			break;
1914 		}
1915 		/*
1916 		 * Everything looks good; add a new record to the multicast
1917 		 * address list for the given interface.
1918 		 */
1919 		imm = malloc(sizeof(*imm), M_IPMADDR, M_WAITOK);
1920 
1921 		if ((imm->i6mm_maddr =
1922 		     in6_addmulti(&mreq->ipv6mr_multiaddr, ifp, &error)) == NULL) {
1923 			free(imm, M_IPMADDR);
1924 			break;
1925 		}
1926 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
1927 		break;
1928 
1929 	case IPV6_LEAVE_GROUP:
1930 		/*
1931 		 * Drop a multicast group membership.
1932 		 * Group must be a valid IP6 multicast address.
1933 		 */
1934 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
1935 			error = EINVAL;
1936 			break;
1937 		}
1938 		mreq = mtod(m, struct ipv6_mreq *);
1939 		if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
1940 			if (suser(p->p_ucred, &p->p_acflag)) {
1941 				error = EACCES;
1942 				break;
1943 			}
1944 		} else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
1945 			error = EINVAL;
1946 			break;
1947 		}
1948 		/*
1949 		 * If an interface address was specified, get a pointer
1950 		 * to its ifnet structure.
1951 		 */
1952 		if (mreq->ipv6mr_interface < 0
1953 		 || if_index < mreq->ipv6mr_interface) {
1954 			error = ENXIO;	/* XXX EINVAL? */
1955 			break;
1956 		}
1957 		ifp = ifindex2ifnet[mreq->ipv6mr_interface];
1958 		/*
1959 		 * Put interface index into the multicast address,
1960 		 * if the address has link-local scope.
1961 		 */
1962 		if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
1963 			mreq->ipv6mr_multiaddr.s6_addr16[1]
1964 				= htons(mreq->ipv6mr_interface);
1965 		}
1966 		/*
1967 		 * Find the membership in the membership list.
1968 		 */
1969 		for (imm = im6o->im6o_memberships.lh_first;
1970 		     imm != NULL; imm = imm->i6mm_chain.le_next) {
1971 			if ((ifp == NULL ||
1972 			     imm->i6mm_maddr->in6m_ifp == ifp) &&
1973 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
1974 					       &mreq->ipv6mr_multiaddr))
1975 				break;
1976 		}
1977 		if (imm == NULL) {
1978 			/* Unable to resolve interface */
1979 			error = EADDRNOTAVAIL;
1980 			break;
1981 		}
1982 		/*
1983 		 * Give up the multicast address record to which the
1984 		 * membership points.
1985 		 */
1986 		LIST_REMOVE(imm, i6mm_chain);
1987 		in6_delmulti(imm->i6mm_maddr);
1988 		free(imm, M_IPMADDR);
1989 		break;
1990 
1991 	default:
1992 		error = EOPNOTSUPP;
1993 		break;
1994 	}
1995 
1996 	/*
1997 	 * If all options have default values, no need to keep the mbuf.
1998 	 */
1999 	if (im6o->im6o_multicast_ifp == NULL &&
2000 	    im6o->im6o_multicast_hlim == ip6_defmcasthlim &&
2001 	    im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
2002 	    im6o->im6o_memberships.lh_first == NULL) {
2003 		free(*im6op, M_IPMOPTS);
2004 		*im6op = NULL;
2005 	}
2006 
2007 	return(error);
2008 }
2009 
2010 /*
2011  * Return the IP6 multicast options in response to user getsockopt().
2012  */
2013 static int
2014 ip6_getmoptions(optname, im6o, mp)
2015 	int optname;
2016 	struct ip6_moptions *im6o;
2017 	struct mbuf **mp;
2018 {
2019 	u_int *hlim, *loop, *ifindex;
2020 
2021 	*mp = m_get(M_WAIT, MT_SOOPTS);
2022 
2023 	switch (optname) {
2024 
2025 	case IPV6_MULTICAST_IF:
2026 		ifindex = mtod(*mp, u_int *);
2027 		(*mp)->m_len = sizeof(u_int);
2028 		if (im6o == NULL || im6o->im6o_multicast_ifp == NULL)
2029 			*ifindex = 0;
2030 		else
2031 			*ifindex = im6o->im6o_multicast_ifp->if_index;
2032 		return(0);
2033 
2034 	case IPV6_MULTICAST_HOPS:
2035 		hlim = mtod(*mp, u_int *);
2036 		(*mp)->m_len = sizeof(u_int);
2037 		if (im6o == NULL)
2038 			*hlim = ip6_defmcasthlim;
2039 		else
2040 			*hlim = im6o->im6o_multicast_hlim;
2041 		return(0);
2042 
2043 	case IPV6_MULTICAST_LOOP:
2044 		loop = mtod(*mp, u_int *);
2045 		(*mp)->m_len = sizeof(u_int);
2046 		if (im6o == NULL)
2047 			*loop = ip6_defmcasthlim;
2048 		else
2049 			*loop = im6o->im6o_multicast_loop;
2050 		return(0);
2051 
2052 	default:
2053 		return(EOPNOTSUPP);
2054 	}
2055 }
2056 
2057 /*
2058  * Discard the IP6 multicast options.
2059  */
2060 void
2061 ip6_freemoptions(im6o)
2062 	struct ip6_moptions *im6o;
2063 {
2064 	struct in6_multi_mship *imm;
2065 
2066 	if (im6o == NULL)
2067 		return;
2068 
2069 	while ((imm = im6o->im6o_memberships.lh_first) != NULL) {
2070 		LIST_REMOVE(imm, i6mm_chain);
2071 		if (imm->i6mm_maddr)
2072 			in6_delmulti(imm->i6mm_maddr);
2073 		free(imm, M_IPMADDR);
2074 	}
2075 	free(im6o, M_IPMOPTS);
2076 }
2077 
2078 /*
2079  * Set IPv6 outgoing packet options based on advanced API.
2080  */
2081 int
2082 ip6_setpktoptions(control, opt, priv)
2083 	struct mbuf *control;
2084 	struct ip6_pktopts *opt;
2085 	int priv;
2086 {
2087 	struct cmsghdr *cm = 0;
2088 
2089 	if (control == 0 || opt == 0)
2090 		return(EINVAL);
2091 
2092 	bzero(opt, sizeof(*opt));
2093 	opt->ip6po_hlim = -1; /* -1 means to use default hop limit */
2094 
2095 	/*
2096 	 * XXX: Currently, we assume all the optional information is stored
2097 	 * in a single mbuf.
2098 	 */
2099 	if (control->m_next)
2100 		return(EINVAL);
2101 
2102 	opt->ip6po_m = control;
2103 
2104 	for (; control->m_len; control->m_data += CMSG_ALIGN(cm->cmsg_len),
2105 		     control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
2106 		cm = mtod(control, struct cmsghdr *);
2107 		if (cm->cmsg_len == 0 || cm->cmsg_len > control->m_len)
2108 			return(EINVAL);
2109 		if (cm->cmsg_level != IPPROTO_IPV6)
2110 			continue;
2111 
2112 		switch(cm->cmsg_type) {
2113 		case IPV6_PKTINFO:
2114 			if (cm->cmsg_len != CMSG_LEN(sizeof(struct in6_pktinfo)))
2115 				return(EINVAL);
2116 			opt->ip6po_pktinfo = (struct in6_pktinfo *)CMSG_DATA(cm);
2117 			if (opt->ip6po_pktinfo->ipi6_ifindex &&
2118 			    IN6_IS_ADDR_LINKLOCAL(&opt->ip6po_pktinfo->ipi6_addr))
2119 				opt->ip6po_pktinfo->ipi6_addr.s6_addr16[1] =
2120 					htons(opt->ip6po_pktinfo->ipi6_ifindex);
2121 
2122 			if (opt->ip6po_pktinfo->ipi6_ifindex > if_index
2123 			 || opt->ip6po_pktinfo->ipi6_ifindex < 0) {
2124 				return(ENXIO);
2125 			}
2126 
2127 			/*
2128 			 * Check if the requested source address is indeed a
2129 			 * unicast address assigned to the node, and can be
2130 			 * used as the packet's source address.
2131 			 */
2132 			if (!IN6_IS_ADDR_UNSPECIFIED(&opt->ip6po_pktinfo->ipi6_addr)) {
2133 				struct ifaddr *ia;
2134 				struct in6_ifaddr *ia6;
2135 				struct sockaddr_in6 sin6;
2136 
2137 				bzero(&sin6, sizeof(sin6));
2138 				sin6.sin6_len = sizeof(sin6);
2139 				sin6.sin6_family = AF_INET6;
2140 				sin6.sin6_addr =
2141 					opt->ip6po_pktinfo->ipi6_addr;
2142 				ia = ifa_ifwithaddr(sin6tosa(&sin6));
2143 				if (ia == NULL ||
2144 				    (opt->ip6po_pktinfo->ipi6_ifindex &&
2145 				     (ia->ifa_ifp->if_index !=
2146 				      opt->ip6po_pktinfo->ipi6_ifindex))) {
2147 					return(EADDRNOTAVAIL);
2148 				}
2149 				ia6 = (struct in6_ifaddr *)ia;
2150 				if ((ia6->ia6_flags & (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY)) != 0) {
2151 					return(EADDRNOTAVAIL);
2152 				}
2153 
2154 				/*
2155 				 * Check if the requested source address is
2156 				 * indeed a unicast address assigned to the
2157 				 * node.
2158 				 */
2159 				if (IN6_IS_ADDR_MULTICAST(&opt->ip6po_pktinfo->ipi6_addr))
2160 					return(EADDRNOTAVAIL);
2161 			}
2162 			break;
2163 
2164 		case IPV6_HOPLIMIT:
2165 			if (cm->cmsg_len != CMSG_LEN(sizeof(int)))
2166 				return(EINVAL);
2167 
2168 			opt->ip6po_hlim = *(int *)CMSG_DATA(cm);
2169 			if (opt->ip6po_hlim < -1 || opt->ip6po_hlim > 255)
2170 				return(EINVAL);
2171 			break;
2172 
2173 		case IPV6_NEXTHOP:
2174 			if (!priv)
2175 				return(EPERM);
2176 
2177 			if (cm->cmsg_len < sizeof(u_char) ||
2178 			    /* check if cmsg_len is large enough for sa_len */
2179 			    cm->cmsg_len < CMSG_LEN(*CMSG_DATA(cm)))
2180 				return(EINVAL);
2181 
2182 			opt->ip6po_nexthop = (struct sockaddr *)CMSG_DATA(cm);
2183 
2184 			break;
2185 
2186 		case IPV6_HOPOPTS:
2187 			if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_hbh)))
2188 				return(EINVAL);
2189 			opt->ip6po_hbh = (struct ip6_hbh *)CMSG_DATA(cm);
2190 			if (cm->cmsg_len !=
2191 			    CMSG_LEN((opt->ip6po_hbh->ip6h_len + 1) << 3))
2192 				return(EINVAL);
2193 			break;
2194 
2195 		case IPV6_DSTOPTS:
2196 			if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_dest)))
2197 				return(EINVAL);
2198 
2199 			/*
2200 			 * If there is no routing header yet, the destination
2201 			 * options header should be put on the 1st part.
2202 			 * Otherwise, the header should be on the 2nd part.
2203 			 * (See RFC 2460, section 4.1)
2204 			 */
2205 			if (opt->ip6po_rthdr == NULL) {
2206 				opt->ip6po_dest1 =
2207 					(struct ip6_dest *)CMSG_DATA(cm);
2208 				if (cm->cmsg_len !=
2209 				    CMSG_LEN((opt->ip6po_dest1->ip6d_len + 1)
2210 					     << 3))
2211 					return(EINVAL);
2212 			}
2213 			else {
2214 				opt->ip6po_dest2 =
2215 					(struct ip6_dest *)CMSG_DATA(cm);
2216 				if (cm->cmsg_len !=
2217 				    CMSG_LEN((opt->ip6po_dest2->ip6d_len + 1)
2218 					     << 3))
2219 					return(EINVAL);
2220 			}
2221 			break;
2222 
2223 		case IPV6_RTHDR:
2224 			if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_rthdr)))
2225 				return(EINVAL);
2226 			opt->ip6po_rthdr = (struct ip6_rthdr *)CMSG_DATA(cm);
2227 			if (cm->cmsg_len !=
2228 			    CMSG_LEN((opt->ip6po_rthdr->ip6r_len + 1) << 3))
2229 				return(EINVAL);
2230 			switch(opt->ip6po_rthdr->ip6r_type) {
2231 			case IPV6_RTHDR_TYPE_0:
2232 				if (opt->ip6po_rthdr->ip6r_segleft == 0)
2233 					return(EINVAL);
2234 				break;
2235 			default:
2236 				return(EINVAL);
2237 			}
2238 			break;
2239 
2240 		default:
2241 			return(ENOPROTOOPT);
2242 		}
2243 	}
2244 
2245 	return(0);
2246 }
2247 
2248 /*
2249  * Routine called from ip6_output() to loop back a copy of an IP6 multicast
2250  * packet to the input queue of a specified interface.  Note that this
2251  * calls the output routine of the loopback "driver", but with an interface
2252  * pointer that might NOT be lo0ifp -- easier than replicating that code here.
2253  */
2254 void
2255 ip6_mloopback(ifp, m, dst)
2256 	struct ifnet *ifp;
2257 	struct mbuf *m;
2258 	struct sockaddr_in6 *dst;
2259 {
2260 	struct mbuf *copym;
2261 	struct ip6_hdr *ip6;
2262 
2263 	copym = m_copy(m, 0, M_COPYALL);
2264 	if (copym == NULL)
2265 		return;
2266 
2267 	/*
2268 	 * Make sure to deep-copy IPv6 header portion in case the data
2269 	 * is in an mbuf cluster, so that we can safely override the IPv6
2270 	 * header portion later.
2271 	 */
2272 	if ((copym->m_flags & M_EXT) != 0 ||
2273 	    copym->m_len < sizeof(struct ip6_hdr)) {
2274 		copym = m_pullup(copym, sizeof(struct ip6_hdr));
2275 		if (copym == NULL)
2276 			return;
2277 	}
2278 
2279 #ifdef DIAGNOSTIC
2280 	if (copym->m_len < sizeof(*ip6)) {
2281 		m_freem(copym);
2282 		return;
2283 	}
2284 #endif
2285 
2286 	ip6 = mtod(copym, struct ip6_hdr *);
2287 	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
2288 		ip6->ip6_src.s6_addr16[1] = 0;
2289 	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
2290 		ip6->ip6_dst.s6_addr16[1] = 0;
2291 
2292 	(void)looutput(ifp, copym, (struct sockaddr *)dst, NULL);
2293 }
2294 
2295 /*
2296  * Chop IPv6 header off from the payload.
2297  */
2298 static int
2299 ip6_splithdr(m, exthdrs)
2300 	struct mbuf *m;
2301 	struct ip6_exthdrs *exthdrs;
2302 {
2303 	struct mbuf *mh;
2304 	struct ip6_hdr *ip6;
2305 
2306 	ip6 = mtod(m, struct ip6_hdr *);
2307 	if (m->m_len > sizeof(*ip6)) {
2308 		MGETHDR(mh, M_DONTWAIT, MT_HEADER);
2309 		if (mh == 0) {
2310 			m_freem(m);
2311 			return ENOBUFS;
2312 		}
2313 		M_MOVE_PKTHDR(mh, m);
2314 		MH_ALIGN(mh, sizeof(*ip6));
2315 		m->m_len -= sizeof(*ip6);
2316 		m->m_data += sizeof(*ip6);
2317 		mh->m_next = m;
2318 		m = mh;
2319 		m->m_len = sizeof(*ip6);
2320 		bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof(*ip6));
2321 	}
2322 	exthdrs->ip6e_ip6 = m;
2323 	return 0;
2324 }
2325 
2326 /*
2327  * Compute IPv6 extension header length.
2328  */
2329 # define in6pcb	inpcb
2330 # define in6p_outputopts	inp_outputopts6
2331 int
2332 ip6_optlen(in6p)
2333 	struct in6pcb *in6p;
2334 {
2335 	int len;
2336 
2337 	if (!in6p->in6p_outputopts)
2338 		return 0;
2339 
2340 	len = 0;
2341 #define elen(x) \
2342     (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
2343 
2344 	len += elen(in6p->in6p_outputopts->ip6po_hbh);
2345 	len += elen(in6p->in6p_outputopts->ip6po_dest1);
2346 	len += elen(in6p->in6p_outputopts->ip6po_rthdr);
2347 	len += elen(in6p->in6p_outputopts->ip6po_dest2);
2348 	return len;
2349 #undef elen
2350 }
2351 # undef in6pcb
2352 # undef in6p_outputopts
2353