xref: /openbsd-src/sys/netinet6/ip6_output.c (revision b2ea75c1b17e1a9a339660e7ed45cd24946b230e)
1 /*	$OpenBSD: ip6_output.c,v 1.46 2001/06/27 03:49:54 angelos Exp $	*/
2 /*	$KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1988, 1990, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. All advertising materials mentioning features or use of this software
46  *    must display the following acknowledgement:
47  *	This product includes software developed by the University of
48  *	California, Berkeley and its contributors.
49  * 4. Neither the name of the University nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63  * SUCH DAMAGE.
64  *
65  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
66  */
67 
68 #include <sys/param.h>
69 #include <sys/malloc.h>
70 #include <sys/mbuf.h>
71 #include <sys/errno.h>
72 #include <sys/protosw.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <sys/systm.h>
76 #include <sys/proc.h>
77 
78 #include <net/if.h>
79 #include <net/route.h>
80 
81 #include <netinet/in.h>
82 #include <netinet/in_var.h>
83 #include <netinet/in_systm.h>
84 #include <netinet/ip.h>
85 #include <netinet/in_pcb.h>
86 
87 #include <netinet/ip6.h>
88 #include <netinet/icmp6.h>
89 #include <netinet6/ip6_var.h>
90 #include <netinet6/nd6.h>
91 
92 #ifdef IPSEC
93 #include <netinet/ip_ah.h>
94 #include <netinet/ip_esp.h>
95 #include <netinet/udp.h>
96 #include <netinet/tcp.h>
97 #include <net/pfkeyv2.h>
98 
99 extern u_int8_t get_sa_require  __P((struct inpcb *));
100 
101 extern int ipsec_auth_default_level;
102 extern int ipsec_esp_trans_default_level;
103 extern int ipsec_esp_network_default_level;
104 #endif /* IPSEC */
105 
106 struct ip6_exthdrs {
107 	struct mbuf *ip6e_ip6;
108 	struct mbuf *ip6e_hbh;
109 	struct mbuf *ip6e_dest1;
110 	struct mbuf *ip6e_rthdr;
111 	struct mbuf *ip6e_dest2;
112 };
113 
114 static int ip6_pcbopts __P((struct ip6_pktopts **, struct mbuf *,
115 			    struct socket *));
116 static int ip6_setmoptions __P((int, struct ip6_moptions **, struct mbuf *));
117 static int ip6_getmoptions __P((int, struct ip6_moptions *, struct mbuf **));
118 static int ip6_copyexthdr __P((struct mbuf **, caddr_t, int));
119 static int ip6_insertfraghdr __P((struct mbuf *, struct mbuf *, int,
120 				  struct ip6_frag **));
121 static int ip6_insert_jumboopt __P((struct ip6_exthdrs *, u_int32_t));
122 static int ip6_splithdr __P((struct mbuf *, struct ip6_exthdrs *));
123 
124 /*
125  * IP6 output. The packet in mbuf chain m contains a skeletal IP6
126  * header (with pri, len, nxt, hlim, src, dst).
127  * This function may modify ver and hlim only.
128  * The mbuf chain containing the packet will be freed.
129  * The mbuf opt, if present, will not be freed.
130  *
131  * type of "mtu": rt_rmx.rmx_mtu is u_long, ifnet.ifr_mtu is int, and
132  * nd_ifinfo.linkmtu is u_int32_t.  so we use u_long to hold largest one,
133  * which is rt_rmx.rmx_mtu.
134  */
135 int
136 ip6_output(m0, opt, ro, flags, im6o, ifpp)
137 	struct mbuf *m0;
138 	struct ip6_pktopts *opt;
139 	struct route_in6 *ro;
140 	int flags;
141 	struct ip6_moptions *im6o;
142 	struct ifnet **ifpp;		/* XXX: just for statistics */
143 {
144 	struct ip6_hdr *ip6, *mhip6;
145 	struct ifnet *ifp, *origifp;
146 	struct mbuf *m = m0;
147 	int hlen, tlen, len, off;
148 	struct route_in6 ip6route;
149 	struct sockaddr_in6 *dst;
150 	int error = 0;
151 	struct in6_ifaddr *ia;
152 	u_long mtu;
153 	u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
154 	struct ip6_exthdrs exthdrs;
155 	struct in6_addr finaldst;
156 	struct route_in6 *ro_pmtu = NULL;
157 	int hdrsplit = 0;
158 	u_int8_t sproto = 0;
159 #ifdef IPSEC
160 	struct m_tag *mtag;
161 	union sockaddr_union sdst;
162 	struct tdb_ident *tdbi;
163 	u_int32_t sspi;
164 	struct inpcb *inp;
165 	struct tdb *tdb;
166 	int s;
167 #endif /* IPSEC */
168 
169 #ifdef IPSEC
170 	inp = NULL;	/*XXX*/
171 	if (inp && (inp->inp_flags & INP_IPV6) == 0)
172 		panic("ip6_output: IPv4 pcb is passed");
173 #endif /* IPSEC */
174 
175 #define MAKE_EXTHDR(hp, mp)						\
176     do {								\
177 	if (hp) {							\
178 		struct ip6_ext *eh = (struct ip6_ext *)(hp);		\
179 		error = ip6_copyexthdr((mp), (caddr_t)(hp), 		\
180 				       ((eh)->ip6e_len + 1) << 3);	\
181 		if (error)						\
182 			goto freehdrs;					\
183 	}								\
184     } while (0)
185 
186 	bzero(&exthdrs, sizeof(exthdrs));
187 	if (opt) {
188 		/* Hop-by-Hop options header */
189 		MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
190 		/* Destination options header(1st part) */
191 		MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
192 		/* Routing header */
193 		MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
194 		/* Destination options header(2nd part) */
195 		MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
196 	}
197 
198 #ifdef IPSEC
199 	/*
200 	 * splnet is chosen over spltdb because we are not allowed to
201 	 * lower the level, and udp6_output calls us in splnet(). XXX check
202 	 */
203 	s = splnet();
204 
205 	/*
206 	 * Check if there was an outgoing SA bound to the flow
207 	 * from a transport protocol.
208 	 */
209 	ip6 = mtod(m, struct ip6_hdr *);
210 
211 	/* Do we have any pending SAs to apply ? */
212 	mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL);
213 	if (mtag != NULL) {
214 #ifdef DIAGNOSTIC
215 		if (mtag->m_tag_len != sizeof (struct tdb_ident))
216 			panic("ip6_output: tag of length %d (should be %d",
217 			    mtag->m_tag_len, sizeof (struct tdb_ident));
218 #endif
219 		tdbi = (struct tdb_ident *)(mtag + 1);
220 		tdb = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto);
221 		if (tdb == NULL)
222 			error = -EINVAL;
223 		m_tag_delete(m, mtag);
224 	}
225 	else
226 		tdb = ipsp_spd_lookup(m, AF_INET6, sizeof(struct ip6_hdr),
227 		    &error, IPSP_DIRECTION_OUT, NULL, inp);
228 
229 	if (tdb == NULL) {
230 	        splx(s);
231 
232 		if (error == 0) {
233 		        /*
234 			 * No IPsec processing required, we'll just send the
235 			 * packet out.
236 			 */
237 		        sproto = 0;
238 
239 			/* Fall through to routing/multicast handling */
240 		} else {
241 		        /*
242 			 * -EINVAL is used to indicate that the packet should
243 			 * be silently dropped, typically because we've asked
244 			 * key management for an SA.
245 			 */
246 		        if (error == -EINVAL) /* Should silently drop packet */
247 				error = 0;
248 
249 			goto freehdrs;
250 		}
251 	} else {
252 		/*
253 		 * If the socket has set the bypass flags and SA destination
254 		 * matches the IP destination, skip IPsec. This allows
255 		 * IKE packets to travel through IPsec tunnels.
256 		 */
257 		if (inp != NULL &&
258 		    inp->inp_seclevel[SL_AUTH] == IPSEC_LEVEL_BYPASS &&
259 		    inp->inp_seclevel[SL_ESP_TRANS] == IPSEC_LEVEL_BYPASS &&
260 		    inp->inp_seclevel[SL_ESP_NETWORK] == IPSEC_LEVEL_BYPASS &&
261 		    sdst.sa.sa_family == AF_INET6 &&
262 		    IN6_ARE_ADDR_EQUAL(&sdst.sin6.sin6_addr, &ip6->ip6_dst)) {
263 			splx(s);
264 		        sproto = 0; /* mark as no-IPsec-needed */
265 			goto done_spd;
266 		}
267 
268 		/* Loop detection */
269 		for (mtag = m_tag_first(m); mtag != NULL;
270 		    mtag = m_tag_next(m, mtag)) {
271 			if (mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_DONE &&
272 			    mtag->m_tag_id !=
273 			    PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED)
274 				continue;
275 			tdbi = (struct tdb_ident *)(mtag + 1);
276 			if (tdbi->spi == tdb->tdb_spi &&
277 			    tdbi->proto == tdb->tdb_sproto &&
278 			    !bcmp(&tdbi->dst, &tdb->tdb_dst,
279 			    sizeof(union sockaddr_union))) {
280 				splx(s);
281 				sproto = 0; /* mark as no-IPsec-needed */
282 				goto done_spd;
283 			}
284 		}
285 
286 	        /* We need to do IPsec */
287 	        bcopy(&tdb->tdb_dst, &sdst, sizeof(sdst));
288 		sspi = tdb->tdb_spi;
289 		sproto = tdb->tdb_sproto;
290 	        splx(s);
291 
292 #if 1 /* XXX */
293 		/* if we have any extension header, we cannot perform IPsec */
294 		if (exthdrs.ip6e_hbh || exthdrs.ip6e_dest1 ||
295 		    exthdrs.ip6e_rthdr || exthdrs.ip6e_dest2) {
296 			error = EHOSTUNREACH;
297 			goto freehdrs;
298 		}
299 #endif
300 	}
301 
302 	/* Fall through to the routing/multicast handling code */
303  done_spd:
304 #endif /* IPSEC */
305 
306 	/*
307 	 * Calculate the total length of the extension header chain.
308 	 * Keep the length of the unfragmentable part for fragmentation.
309 	 */
310 	optlen = 0;
311 	if (exthdrs.ip6e_hbh) optlen += exthdrs.ip6e_hbh->m_len;
312 	if (exthdrs.ip6e_dest1) optlen += exthdrs.ip6e_dest1->m_len;
313 	if (exthdrs.ip6e_rthdr) optlen += exthdrs.ip6e_rthdr->m_len;
314 	unfragpartlen = optlen + sizeof(struct ip6_hdr);
315 	/* NOTE: we don't add AH/ESP length here. do that later. */
316 	if (exthdrs.ip6e_dest2) optlen += exthdrs.ip6e_dest2->m_len;
317 
318 	/*
319 	 * If we need IPsec, or there is at least one extension header,
320 	 * separate IP6 header from the payload.
321 	 */
322 	if ((sproto || optlen) && !hdrsplit) {
323 		if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
324 			m = NULL;
325 			goto freehdrs;
326 		}
327 		m = exthdrs.ip6e_ip6;
328 		hdrsplit++;
329 	}
330 
331 	/* adjust pointer */
332 	ip6 = mtod(m, struct ip6_hdr *);
333 
334 	/* adjust mbuf packet header length */
335 	m->m_pkthdr.len += optlen;
336 	plen = m->m_pkthdr.len - sizeof(*ip6);
337 
338 	/* If this is a jumbo payload, insert a jumbo payload option. */
339 	if (plen > IPV6_MAXPACKET) {
340 		if (!hdrsplit) {
341 			if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
342 				m = NULL;
343 				goto freehdrs;
344 			}
345 			m = exthdrs.ip6e_ip6;
346 			hdrsplit++;
347 		}
348 		/* adjust pointer */
349 		ip6 = mtod(m, struct ip6_hdr *);
350 		if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
351 			goto freehdrs;
352 		ip6->ip6_plen = 0;
353 	} else
354 		ip6->ip6_plen = htons(plen);
355 
356 	/*
357 	 * Concatenate headers and fill in next header fields.
358 	 * Here we have, on "m"
359 	 *	IPv6 payload
360 	 * and we insert headers accordingly.  Finally, we should be getting:
361 	 *	IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
362 	 *
363 	 * during the header composing process, "m" points to IPv6 header.
364 	 * "mprev" points to an extension header prior to esp.
365 	 */
366 	{
367 		u_char *nexthdrp = &ip6->ip6_nxt;
368 		struct mbuf *mprev = m;
369 
370 		/*
371 		 * we treat dest2 specially.  this makes IPsec processing
372 		 * much easier.
373 		 *
374 		 * result: IPv6 dest2 payload
375 		 * m and mprev will point to IPv6 header.
376 		 */
377 		if (exthdrs.ip6e_dest2) {
378 			if (!hdrsplit)
379 				panic("assumption failed: hdr not split");
380 			exthdrs.ip6e_dest2->m_next = m->m_next;
381 			m->m_next = exthdrs.ip6e_dest2;
382 			*mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
383 			ip6->ip6_nxt = IPPROTO_DSTOPTS;
384 		}
385 
386 #define MAKE_CHAIN(m, mp, p, i)\
387     do {\
388 	if (m) {\
389 		if (!hdrsplit) \
390 			panic("assumption failed: hdr not split"); \
391 		*mtod((m), u_char *) = *(p);\
392 		*(p) = (i);\
393 		p = mtod((m), u_char *);\
394 		(m)->m_next = (mp)->m_next;\
395 		(mp)->m_next = (m);\
396 		(mp) = (m);\
397 	}\
398     } while (0)
399 		/*
400 		 * result: IPv6 hbh dest1 rthdr dest2 payload
401 		 * m will point to IPv6 header.  mprev will point to the
402 		 * extension header prior to dest2 (rthdr in the above case).
403 		 */
404 		MAKE_CHAIN(exthdrs.ip6e_hbh, mprev,
405 			   nexthdrp, IPPROTO_HOPOPTS);
406 		MAKE_CHAIN(exthdrs.ip6e_dest1, mprev,
407 			   nexthdrp, IPPROTO_DSTOPTS);
408 		MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev,
409 			   nexthdrp, IPPROTO_ROUTING);
410 
411 #if 0 /*KAME IPSEC*/
412 		if (!needipsec)
413 			goto skip_ipsec2;
414 
415 		/*
416 		 * pointers after IPsec headers are not valid any more.
417 		 * other pointers need a great care too.
418 		 * (IPsec routines should not mangle mbufs prior to AH/ESP)
419 		 */
420 		exthdrs.ip6e_dest2 = NULL;
421 
422 	    {
423 		struct ip6_rthdr *rh = NULL;
424 		int segleft_org = 0;
425 		struct ipsec_output_state state;
426 
427 		if (exthdrs.ip6e_rthdr) {
428 			rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
429 			segleft_org = rh->ip6r_segleft;
430 			rh->ip6r_segleft = 0;
431 		}
432 
433 		bzero(&state, sizeof(state));
434 		state.m = m;
435 		error = ipsec6_output_trans(&state, nexthdrp, mprev, sp, flags,
436 			&needipsectun);
437 		m = state.m;
438 		if (error) {
439 			/* mbuf is already reclaimed in ipsec6_output_trans. */
440 			m = NULL;
441 			switch (error) {
442 			case EHOSTUNREACH:
443 			case ENETUNREACH:
444 			case EMSGSIZE:
445 			case ENOBUFS:
446 			case ENOMEM:
447 				break;
448 			default:
449 				printf("ip6_output (ipsec): error code %d\n", error);
450 				/*fall through*/
451 			case ENOENT:
452 				/* don't show these error codes to the user */
453 				error = 0;
454 				break;
455 			}
456 			goto bad;
457 		}
458 		if (exthdrs.ip6e_rthdr) {
459 			/* ah6_output doesn't modify mbuf chain */
460 			rh->ip6r_segleft = segleft_org;
461 		}
462 	    }
463 skip_ipsec2:;
464 #endif
465 	}
466 
467 	/*
468 	 * If there is a routing header, replace destination address field
469 	 * with the first hop of the routing header.
470 	 */
471 	if (exthdrs.ip6e_rthdr) {
472 		struct ip6_rthdr *rh =
473 			(struct ip6_rthdr *)(mtod(exthdrs.ip6e_rthdr,
474 						  struct ip6_rthdr *));
475 		struct ip6_rthdr0 *rh0;
476 
477 		finaldst = ip6->ip6_dst;
478 		switch(rh->ip6r_type) {
479 		case IPV6_RTHDR_TYPE_0:
480 			 rh0 = (struct ip6_rthdr0 *)rh;
481 			 ip6->ip6_dst = rh0->ip6r0_addr[0];
482 			 bcopy((caddr_t)&rh0->ip6r0_addr[1],
483 				 (caddr_t)&rh0->ip6r0_addr[0],
484 				 sizeof(struct in6_addr)*(rh0->ip6r0_segleft - 1)
485 				 );
486 			 rh0->ip6r0_addr[rh0->ip6r0_segleft - 1] = finaldst;
487 			 break;
488 		default:	/* is it possible? */
489 			 error = EINVAL;
490 			 goto bad;
491 		}
492 	}
493 
494 	/* Source address validation */
495 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
496 	    (flags & IPV6_DADOUTPUT) == 0) {
497 		error = EOPNOTSUPP;
498 		ip6stat.ip6s_badscope++;
499 		goto bad;
500 	}
501 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
502 		error = EOPNOTSUPP;
503 		ip6stat.ip6s_badscope++;
504 		goto bad;
505 	}
506 
507 	ip6stat.ip6s_localout++;
508 
509 	/*
510 	 * Route packet.
511 	 */
512 	if (ro == 0) {
513 		ro = &ip6route;
514 		bzero((caddr_t)ro, sizeof(*ro));
515 	}
516 	ro_pmtu = ro;
517 	if (opt && opt->ip6po_rthdr)
518 		ro = &opt->ip6po_route;
519 	dst = (struct sockaddr_in6 *)&ro->ro_dst;
520 	/*
521 	 * If there is a cached route,
522 	 * check that it is to the same destination
523 	 * and is still up. If not, free it and try again.
524 	 */
525 	if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
526 			 !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst))) {
527 		RTFREE(ro->ro_rt);
528 		ro->ro_rt = (struct rtentry *)0;
529 	}
530 	if (ro->ro_rt == 0) {
531 		bzero(dst, sizeof(*dst));
532 		dst->sin6_family = AF_INET6;
533 		dst->sin6_len = sizeof(struct sockaddr_in6);
534 		dst->sin6_addr = ip6->ip6_dst;
535 	}
536 #ifdef IPSEC
537 	/*
538 	 * Check if the packet needs encapsulation.
539 	 * ipsp_process_packet will never come back to here.
540 	 */
541 	if (sproto != 0) {
542 	        s = splnet();
543 
544 		/* fill in IPv6 header which would be filled later */
545 		if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
546 			if (opt && opt->ip6po_hlim != -1)
547 				ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
548 		} else {
549 			if (im6o != NULL)
550 				ip6->ip6_hlim = im6o->im6o_multicast_hlim;
551 			else
552 				ip6->ip6_hlim = ip6_defmcasthlim;
553 			if (opt && opt->ip6po_hlim != -1)
554 				ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
555 
556 			/*
557 			 * XXX what should we do if ip6_hlim == 0 and the
558 			 * packet gets tunnelled?
559 			 */
560 		}
561 
562 		tdb = gettdb(sspi, &sdst, sproto);
563 		if (tdb == NULL) {
564 			splx(s);
565 			error = EHOSTUNREACH;
566 			m_freem(m);
567 			goto done;
568 		}
569 
570 		/* Latch to PCB */
571 		if (inp)
572 		        tdb_add_inp(tdb, inp, 0);
573 
574 		m->m_flags &= ~(M_BCAST | M_MCAST);	/* just in case */
575 
576 		/* Callee frees mbuf */
577 		error = ipsp_process_packet(m, tdb, AF_INET6, 0);
578 		splx(s);
579 		return error;  /* Nothing more to be done */
580 	}
581 #endif /* IPSEC */
582 
583 	if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
584 		/* Unicast */
585 
586 #define ifatoia6(ifa)	((struct in6_ifaddr *)(ifa))
587 #define sin6tosa(sin6)	((struct sockaddr *)(sin6))
588 		/* xxx
589 		 * interface selection comes here
590 		 * if an interface is specified from an upper layer,
591 		 * ifp must point it.
592 		 */
593 		if (ro->ro_rt == 0) {
594 			/*
595 			 * non-bsdi always clone routes, if parent is
596 			 * PRF_CLONING.
597 			 */
598 			rtalloc((struct route *)ro);
599 		}
600 		if (ro->ro_rt == 0) {
601 			ip6stat.ip6s_noroute++;
602 			error = EHOSTUNREACH;
603 			/* XXX in6_ifstat_inc(ifp, ifs6_out_discard); */
604 			goto bad;
605 		}
606 		ia = ifatoia6(ro->ro_rt->rt_ifa);
607 		ifp = ro->ro_rt->rt_ifp;
608 		ro->ro_rt->rt_use++;
609 		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
610 			dst = (struct sockaddr_in6 *)ro->ro_rt->rt_gateway;
611 		m->m_flags &= ~(M_BCAST | M_MCAST);	/* just in case */
612 
613 		in6_ifstat_inc(ifp, ifs6_out_request);
614 
615 		/*
616 		 * Check if the outgoing interface conflicts with
617 		 * the interface specified by ifi6_ifindex (if specified).
618 		 * Note that loopback interface is always okay.
619 		 * (this may happen when we are sending a packet to one of
620 		 *  our own addresses.)
621 		 */
622 		if (opt && opt->ip6po_pktinfo
623 		 && opt->ip6po_pktinfo->ipi6_ifindex) {
624 			if (!(ifp->if_flags & IFF_LOOPBACK)
625 			 && ifp->if_index != opt->ip6po_pktinfo->ipi6_ifindex) {
626 				ip6stat.ip6s_noroute++;
627 				in6_ifstat_inc(ifp, ifs6_out_discard);
628 				error = EHOSTUNREACH;
629 				goto bad;
630 			}
631 		}
632 
633 		if (opt && opt->ip6po_hlim != -1)
634 			ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
635 	} else {
636 		/* Multicast */
637 		struct	in6_multi *in6m;
638 
639 		m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
640 
641 		/*
642 		 * See if the caller provided any multicast options
643 		 */
644 		ifp = NULL;
645 		if (im6o != NULL) {
646 			ip6->ip6_hlim = im6o->im6o_multicast_hlim;
647 			if (im6o->im6o_multicast_ifp != NULL)
648 				ifp = im6o->im6o_multicast_ifp;
649 		} else
650 			ip6->ip6_hlim = ip6_defmcasthlim;
651 
652 		/*
653 		 * See if the caller provided the outgoing interface
654 		 * as an ancillary data.
655 		 * Boundary check for ifindex is assumed to be already done.
656 		 */
657 		if (opt && opt->ip6po_pktinfo && opt->ip6po_pktinfo->ipi6_ifindex)
658 			ifp = ifindex2ifnet[opt->ip6po_pktinfo->ipi6_ifindex];
659 
660 		/*
661 		 * If the destination is a node-local scope multicast,
662 		 * the packet should be loop-backed only.
663 		 */
664 		if (IN6_IS_ADDR_MC_NODELOCAL(&ip6->ip6_dst)) {
665 			/*
666 			 * If the outgoing interface is already specified,
667 			 * it should be a loopback interface.
668 			 */
669 			if (ifp && (ifp->if_flags & IFF_LOOPBACK) == 0) {
670 				ip6stat.ip6s_badscope++;
671 				error = ENETUNREACH; /* XXX: better error? */
672 				/* XXX correct ifp? */
673 				in6_ifstat_inc(ifp, ifs6_out_discard);
674 				goto bad;
675 			}
676 			else {
677 				ifp = lo0ifp;
678 			}
679 		}
680 
681 		if (opt && opt->ip6po_hlim != -1)
682 			ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
683 
684 		/*
685 		 * If caller did not provide an interface lookup a
686 		 * default in the routing table.  This is either a
687 		 * default for the speicfied group (i.e. a host
688 		 * route), or a multicast default (a route for the
689 		 * ``net'' ff00::/8).
690 		 */
691 		if (ifp == NULL) {
692 			if (ro->ro_rt == 0) {
693 				ro->ro_rt = rtalloc1((struct sockaddr *)
694 						&ro->ro_dst, 0);
695 			}
696 			if (ro->ro_rt == 0) {
697 				ip6stat.ip6s_noroute++;
698 				error = EHOSTUNREACH;
699 				/* XXX in6_ifstat_inc(ifp, ifs6_out_discard) */
700 				goto bad;
701 			}
702 			ia = ifatoia6(ro->ro_rt->rt_ifa);
703 			ifp = ro->ro_rt->rt_ifp;
704 			ro->ro_rt->rt_use++;
705 		}
706 
707 		if ((flags & IPV6_FORWARDING) == 0)
708 			in6_ifstat_inc(ifp, ifs6_out_request);
709 		in6_ifstat_inc(ifp, ifs6_out_mcast);
710 
711 		/*
712 		 * Confirm that the outgoing interface supports multicast.
713 		 */
714 		if ((ifp->if_flags & IFF_MULTICAST) == 0) {
715 			ip6stat.ip6s_noroute++;
716 			in6_ifstat_inc(ifp, ifs6_out_discard);
717 			error = ENETUNREACH;
718 			goto bad;
719 		}
720 		IN6_LOOKUP_MULTI(ip6->ip6_dst, ifp, in6m);
721 		if (in6m != NULL &&
722 		   (im6o == NULL || im6o->im6o_multicast_loop)) {
723 			/*
724 			 * If we belong to the destination multicast group
725 			 * on the outgoing interface, and the caller did not
726 			 * forbid loopback, loop back a copy.
727 			 */
728 			ip6_mloopback(ifp, m, dst);
729 		} else {
730 			/*
731 			 * If we are acting as a multicast router, perform
732 			 * multicast forwarding as if the packet had just
733 			 * arrived on the interface to which we are about
734 			 * to send.  The multicast forwarding function
735 			 * recursively calls this function, using the
736 			 * IPV6_FORWARDING flag to prevent infinite recursion.
737 			 *
738 			 * Multicasts that are looped back by ip6_mloopback(),
739 			 * above, will be forwarded by the ip6_input() routine,
740 			 * if necessary.
741 			 */
742 			if (ip6_mrouter && (flags & IPV6_FORWARDING) == 0) {
743 				if (ip6_mforward(ip6, ifp, m) != 0) {
744 					m_freem(m);
745 					goto done;
746 				}
747 			}
748 		}
749 		/*
750 		 * Multicasts with a hoplimit of zero may be looped back,
751 		 * above, but must not be transmitted on a network.
752 		 * Also, multicasts addressed to the loopback interface
753 		 * are not sent -- the above call to ip6_mloopback() will
754 		 * loop back a copy if this host actually belongs to the
755 		 * destination group on the loopback interface.
756 		 */
757 		if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK)) {
758 			m_freem(m);
759 			goto done;
760 		}
761 	}
762 
763 	/*
764 	 * Fill the outgoing inteface to tell the upper layer
765 	 * to increment per-interface statistics.
766 	 */
767 	if (ifpp)
768 		*ifpp = ifp;
769 
770 	/*
771 	 * Determine path MTU.
772 	 */
773 	if (ro_pmtu != ro) {
774 		/* The first hop and the final destination may differ. */
775 		struct sockaddr_in6 *sin6_fin =
776 			(struct sockaddr_in6 *)&ro_pmtu->ro_dst;
777 		if (ro_pmtu->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
778 				       !IN6_ARE_ADDR_EQUAL(&sin6_fin->sin6_addr,
779 							   &finaldst))) {
780 			RTFREE(ro_pmtu->ro_rt);
781 			ro_pmtu->ro_rt = (struct rtentry *)0;
782 		}
783 		if (ro_pmtu->ro_rt == 0) {
784 			bzero(sin6_fin, sizeof(*sin6_fin));
785 			sin6_fin->sin6_family = AF_INET6;
786 			sin6_fin->sin6_len = sizeof(struct sockaddr_in6);
787 			sin6_fin->sin6_addr = finaldst;
788 
789 			rtalloc((struct route *)ro_pmtu);
790 		}
791 	}
792 	if (ro_pmtu->ro_rt != NULL) {
793 		u_int32_t ifmtu = nd_ifinfo[ifp->if_index].linkmtu;
794 
795 		mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
796 		if (mtu > ifmtu || mtu == 0) {
797 			/*
798 			 * The MTU on the route is larger than the MTU on
799 			 * the interface!  This shouldn't happen, unless the
800 			 * MTU of the interface has been changed after the
801 			 * interface was brought up.  Change the MTU in the
802 			 * route to match the interface MTU (as long as the
803 			 * field isn't locked).
804 			 *
805 			 * if MTU on the route is 0, we need to fix the MTU.
806 			 * this case happens with path MTU discovery timeouts.
807 			 */
808 			 mtu = ifmtu;
809 			 if ((ro_pmtu->ro_rt->rt_rmx.rmx_locks & RTV_MTU) == 0)
810 				 ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu; /* XXX */
811 		}
812 	} else {
813 		mtu = nd_ifinfo[ifp->if_index].linkmtu;
814 	}
815 
816 	/* Fake scoped addresses */
817 	if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
818 		/*
819 		 * If source or destination address is a scoped address, and
820 		 * the packet is going to be sent to a loopback interface,
821 		 * we should keep the original interface.
822 		 */
823 
824 		/*
825 		 * XXX: this is a very experimental and temporary solution.
826 		 * We eventually have sockaddr_in6 and use the sin6_scope_id
827 		 * field of the structure here.
828 		 * We rely on the consistency between two scope zone ids
829 		 * of source add destination, which should already be assured
830 		 * Larger scopes than link will be supported in the near
831 		 * future.
832 		 */
833 		origifp = NULL;
834 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
835 			origifp = ifindex2ifnet[ntohs(ip6->ip6_src.s6_addr16[1])];
836 		else if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
837 			origifp = ifindex2ifnet[ntohs(ip6->ip6_dst.s6_addr16[1])];
838 		/*
839 		 * XXX: origifp can be NULL even in those two cases above.
840 		 * For example, if we remove the (only) link-local address
841 		 * from the loopback interface, and try to send a link-local
842 		 * address without link-id information.  Then the source
843 		 * address is ::1, and the destination address is the
844 		 * link-local address with its s6_addr16[1] being zero.
845 		 * What is worse, if the packet goes to the loopback interface
846 		 * by a default rejected route, the null pointer would be
847 		 * passed to looutput, and the kernel would hang.
848 		 * The following last resort would prevent such disaster.
849 		 */
850 		if (origifp == NULL)
851 			origifp = ifp;
852 	}
853 	else
854 		origifp = ifp;
855 	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
856 		ip6->ip6_src.s6_addr16[1] = 0;
857 	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
858 		ip6->ip6_dst.s6_addr16[1] = 0;
859 
860 	/*
861 	 * If the outgoing packet contains a hop-by-hop options header,
862 	 * it must be examined and processed even by the source node.
863 	 * (RFC 2460, section 4.)
864 	 */
865 	if (exthdrs.ip6e_hbh) {
866 		struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh,
867 					   struct ip6_hbh *);
868 		u_int32_t dummy1; /* XXX unused */
869 		u_int32_t dummy2; /* XXX unused */
870 
871 		/*
872 		 *  XXX: if we have to send an ICMPv6 error to the sender,
873 		 *       we need the M_LOOP flag since icmp6_error() expects
874 		 *       the IPv6 and the hop-by-hop options header are
875 		 *       continuous unless the flag is set.
876 		 */
877 		m->m_flags |= M_LOOP;
878 		m->m_pkthdr.rcvif = ifp;
879 		if (ip6_process_hopopts(m,
880 					(u_int8_t *)(hbh + 1),
881 					((hbh->ip6h_len + 1) << 3) -
882 					sizeof(struct ip6_hbh),
883 					&dummy1, &dummy2) < 0) {
884 			/* m was already freed at this point */
885 			error = EINVAL;/* better error? */
886 			goto done;
887 		}
888 		m->m_flags &= ~M_LOOP; /* XXX */
889 		m->m_pkthdr.rcvif = NULL;
890 	}
891 
892 	/*
893 	 * Send the packet to the outgoing interface.
894 	 * If necessary, do IPv6 fragmentation before sending.
895 	 */
896 	tlen = m->m_pkthdr.len;
897 	if (tlen <= mtu
898 #ifdef notyet
899 	    /*
900 	     * On any link that cannot convey a 1280-octet packet in one piece,
901 	     * link-specific fragmentation and reassembly must be provided at
902 	     * a layer below IPv6. [RFC 2460, sec.5]
903 	     * Thus if the interface has ability of link-level fragmentation,
904 	     * we can just send the packet even if the packet size is
905 	     * larger than the link's MTU.
906 	     * XXX: IFF_FRAGMENTABLE (or such) flag has not been defined yet...
907 	     */
908 
909 	    || ifp->if_flags & IFF_FRAGMENTABLE
910 #endif
911 	    )
912 	{
913 #ifdef OLDIP6OUTPUT
914 		error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst,
915 					  ro->ro_rt);
916 #else
917 		error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
918 #endif
919 		goto done;
920 	} else if (mtu < IPV6_MMTU) {
921 		/*
922 		 * note that path MTU is never less than IPV6_MMTU
923 		 * (see icmp6_input).
924 		 */
925 		error = EMSGSIZE;
926 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
927 		goto bad;
928 	} else if (ip6->ip6_plen == 0) { /* jumbo payload cannot be fragmented */
929 		error = EMSGSIZE;
930 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
931 		goto bad;
932 	} else {
933 		struct mbuf **mnext, *m_frgpart;
934 		struct ip6_frag *ip6f;
935 		u_int32_t id = htonl(ip6_id++);
936 		u_char nextproto;
937 
938 		/*
939 		 * Too large for the destination or interface;
940 		 * fragment if possible.
941 		 * Must be able to put at least 8 bytes per fragment.
942 		 */
943 		hlen = unfragpartlen;
944 		if (mtu > IPV6_MAXPACKET)
945 			mtu = IPV6_MAXPACKET;
946 		len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
947 		if (len < 8) {
948 			error = EMSGSIZE;
949 			in6_ifstat_inc(ifp, ifs6_out_fragfail);
950 			goto bad;
951 		}
952 
953 		mnext = &m->m_nextpkt;
954 
955 		/*
956 		 * Change the next header field of the last header in the
957 		 * unfragmentable part.
958 		 */
959 		if (exthdrs.ip6e_rthdr) {
960 			nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
961 			*mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
962 		} else if (exthdrs.ip6e_dest1) {
963 			nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
964 			*mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
965 		} else if (exthdrs.ip6e_hbh) {
966 			nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
967 			*mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
968 		} else {
969 			nextproto = ip6->ip6_nxt;
970 			ip6->ip6_nxt = IPPROTO_FRAGMENT;
971 		}
972 
973 		/*
974 		 * Loop through length of segment after first fragment,
975 		 * make new header and copy data of each part and link onto chain.
976 		 */
977 		m0 = m;
978 		for (off = hlen; off < tlen; off += len) {
979 			MGETHDR(m, M_DONTWAIT, MT_HEADER);
980 			if (!m) {
981 				error = ENOBUFS;
982 				ip6stat.ip6s_odropped++;
983 				goto sendorfree;
984 			}
985 			m->m_flags = m0->m_flags & M_COPYFLAGS;
986 			*mnext = m;
987 			mnext = &m->m_nextpkt;
988 			m->m_data += max_linkhdr;
989 			mhip6 = mtod(m, struct ip6_hdr *);
990 			*mhip6 = *ip6;
991 			m->m_len = sizeof(*mhip6);
992  			error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
993  			if (error) {
994 				ip6stat.ip6s_odropped++;
995 				goto sendorfree;
996 			}
997 			ip6f->ip6f_offlg = htons((u_short)((off - hlen) & ~7));
998 			if (off + len >= tlen)
999 				len = tlen - off;
1000 			else
1001 				ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
1002 			mhip6->ip6_plen = htons((u_short)(len + hlen +
1003 							  sizeof(*ip6f) -
1004 							  sizeof(struct ip6_hdr)));
1005 			if ((m_frgpart = m_copy(m0, off, len)) == 0) {
1006 				error = ENOBUFS;
1007 				ip6stat.ip6s_odropped++;
1008 				goto sendorfree;
1009 			}
1010 			m_cat(m, m_frgpart);
1011 			m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
1012 			m->m_pkthdr.rcvif = (struct ifnet *)0;
1013 			ip6f->ip6f_reserved = 0;
1014 			ip6f->ip6f_ident = id;
1015 			ip6f->ip6f_nxt = nextproto;
1016 			ip6stat.ip6s_ofragments++;
1017 			in6_ifstat_inc(ifp, ifs6_out_fragcreat);
1018 		}
1019 
1020 		in6_ifstat_inc(ifp, ifs6_out_fragok);
1021 	}
1022 
1023 	/*
1024 	 * Remove leading garbages.
1025 	 */
1026 sendorfree:
1027 	m = m0->m_nextpkt;
1028 	m0->m_nextpkt = 0;
1029 	m_freem(m0);
1030 	for (m0 = m; m; m = m0) {
1031 		m0 = m->m_nextpkt;
1032 		m->m_nextpkt = 0;
1033 		if (error == 0) {
1034 #ifdef OLDIP6OUTPUT
1035 			error = (*ifp->if_output)(ifp, m,
1036 						  (struct sockaddr *)dst,
1037 						  ro->ro_rt);
1038 #else
1039 			error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
1040 #endif
1041 		} else
1042 			m_freem(m);
1043 	}
1044 
1045 	if (error == 0)
1046 		ip6stat.ip6s_fragmented++;
1047 
1048 done:
1049 	if (ro == &ip6route && ro->ro_rt) { /* brace necessary for RTFREE */
1050 		RTFREE(ro->ro_rt);
1051 	} else if (ro_pmtu == &ip6route && ro_pmtu->ro_rt) {
1052 		RTFREE(ro_pmtu->ro_rt);
1053 	}
1054 
1055 	return(error);
1056 
1057 freehdrs:
1058 	m_freem(exthdrs.ip6e_hbh);	/* m_freem will check if mbuf is 0 */
1059 	m_freem(exthdrs.ip6e_dest1);
1060 	m_freem(exthdrs.ip6e_rthdr);
1061 	m_freem(exthdrs.ip6e_dest2);
1062 	/* fall through */
1063 bad:
1064 	m_freem(m);
1065 	goto done;
1066 }
1067 
1068 static int
1069 ip6_copyexthdr(mp, hdr, hlen)
1070 	struct mbuf **mp;
1071 	caddr_t hdr;
1072 	int hlen;
1073 {
1074 	struct mbuf *m;
1075 
1076 	if (hlen > MCLBYTES)
1077 		return(ENOBUFS); /* XXX */
1078 
1079 	MGET(m, M_DONTWAIT, MT_DATA);
1080 	if (!m)
1081 		return(ENOBUFS);
1082 
1083 	if (hlen > MLEN) {
1084 		MCLGET(m, M_DONTWAIT);
1085 		if ((m->m_flags & M_EXT) == 0) {
1086 			m_free(m);
1087 			return(ENOBUFS);
1088 		}
1089 	}
1090 	m->m_len = hlen;
1091 	if (hdr)
1092 		bcopy(hdr, mtod(m, caddr_t), hlen);
1093 
1094 	*mp = m;
1095 	return(0);
1096 }
1097 
1098 /*
1099  * Insert jumbo payload option.
1100  */
1101 static int
1102 ip6_insert_jumboopt(exthdrs, plen)
1103 	struct ip6_exthdrs *exthdrs;
1104 	u_int32_t plen;
1105 {
1106 	struct mbuf *mopt;
1107 	u_char *optbuf;
1108 	u_int32_t v;
1109 
1110 #define JUMBOOPTLEN	8	/* length of jumbo payload option and padding */
1111 
1112 	/*
1113 	 * If there is no hop-by-hop options header, allocate new one.
1114 	 * If there is one but it doesn't have enough space to store the
1115 	 * jumbo payload option, allocate a cluster to store the whole options.
1116 	 * Otherwise, use it to store the options.
1117 	 */
1118 	if (exthdrs->ip6e_hbh == 0) {
1119 		MGET(mopt, M_DONTWAIT, MT_DATA);
1120 		if (mopt == 0)
1121 			return(ENOBUFS);
1122 		mopt->m_len = JUMBOOPTLEN;
1123 		optbuf = mtod(mopt, u_char *);
1124 		optbuf[1] = 0;	/* = ((JUMBOOPTLEN) >> 3) - 1 */
1125 		exthdrs->ip6e_hbh = mopt;
1126 	} else {
1127 		struct ip6_hbh *hbh;
1128 
1129 		mopt = exthdrs->ip6e_hbh;
1130 		if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
1131 			/*
1132 			 * XXX assumption:
1133 			 * - exthdrs->ip6e_hbh is not referenced from places
1134 			 *   other than exthdrs.
1135 			 * - exthdrs->ip6e_hbh is not an mbuf chain.
1136 			 */
1137 			int oldoptlen = mopt->m_len;
1138 			struct mbuf *n;
1139 
1140 			/*
1141 			 * XXX: give up if the whole (new) hbh header does
1142 			 * not fit even in an mbuf cluster.
1143 			 */
1144 			if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
1145 				return(ENOBUFS);
1146 
1147 			/*
1148 			 * As a consequence, we must always prepare a cluster
1149 			 * at this point.
1150 			 */
1151 			MGET(n, M_DONTWAIT, MT_DATA);
1152 			if (n) {
1153 				MCLGET(n, M_DONTWAIT);
1154 				if ((n->m_flags & M_EXT) == 0) {
1155 					m_freem(n);
1156 					n = NULL;
1157 				}
1158 			}
1159 			if (!n)
1160 				return(ENOBUFS);
1161 			n->m_len = oldoptlen + JUMBOOPTLEN;
1162 			bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t),
1163 			      oldoptlen);
1164 			optbuf = mtod(n, caddr_t) + oldoptlen;
1165 			m_freem(mopt);
1166 			mopt = exthdrs->ip6e_hbh = n;
1167 		} else {
1168 			optbuf = mtod(mopt, u_char *) + mopt->m_len;
1169 			mopt->m_len += JUMBOOPTLEN;
1170 		}
1171 		optbuf[0] = IP6OPT_PADN;
1172 		optbuf[1] = 1;
1173 
1174 		/*
1175 		 * Adjust the header length according to the pad and
1176 		 * the jumbo payload option.
1177 		 */
1178 		hbh = mtod(mopt, struct ip6_hbh *);
1179 		hbh->ip6h_len += (JUMBOOPTLEN >> 3);
1180 	}
1181 
1182 	/* fill in the option. */
1183 	optbuf[2] = IP6OPT_JUMBO;
1184 	optbuf[3] = 4;
1185 	v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
1186 	bcopy(&v, &optbuf[4], sizeof(u_int32_t));
1187 
1188 	/* finally, adjust the packet header length */
1189 	exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
1190 
1191 	return(0);
1192 #undef JUMBOOPTLEN
1193 }
1194 
1195 /*
1196  * Insert fragment header and copy unfragmentable header portions.
1197  */
1198 static int
1199 ip6_insertfraghdr(m0, m, hlen, frghdrp)
1200 	struct mbuf *m0, *m;
1201 	int hlen;
1202 	struct ip6_frag **frghdrp;
1203 {
1204 	struct mbuf *n, *mlast;
1205 
1206 	if (hlen > sizeof(struct ip6_hdr)) {
1207 		n = m_copym(m0, sizeof(struct ip6_hdr),
1208 			    hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
1209 		if (n == 0)
1210 			return(ENOBUFS);
1211 		m->m_next = n;
1212 	} else
1213 		n = m;
1214 
1215 	/* Search for the last mbuf of unfragmentable part. */
1216 	for (mlast = n; mlast->m_next; mlast = mlast->m_next)
1217 		;
1218 
1219 	if ((mlast->m_flags & M_EXT) == 0 &&
1220 	    M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
1221 		/* use the trailing space of the last mbuf for the fragment hdr */
1222 		*frghdrp =
1223 			(struct ip6_frag *)(mtod(mlast, caddr_t) + mlast->m_len);
1224 		mlast->m_len += sizeof(struct ip6_frag);
1225 		m->m_pkthdr.len += sizeof(struct ip6_frag);
1226 	} else {
1227 		/* allocate a new mbuf for the fragment header */
1228 		struct mbuf *mfrg;
1229 
1230 		MGET(mfrg, M_DONTWAIT, MT_DATA);
1231 		if (mfrg == 0)
1232 			return(ENOBUFS);
1233 		mfrg->m_len = sizeof(struct ip6_frag);
1234 		*frghdrp = mtod(mfrg, struct ip6_frag *);
1235 		mlast->m_next = mfrg;
1236 	}
1237 
1238 	return(0);
1239 }
1240 
1241 /*
1242  * IP6 socket option processing.
1243  */
1244 int
1245 ip6_ctloutput(op, so, level, optname, mp)
1246 	int op;
1247 	struct socket *so;
1248 	int level, optname;
1249 	struct mbuf **mp;
1250 {
1251 	int privileged;
1252 	struct inpcb *inp = sotoinpcb(so);
1253 	struct mbuf *m = *mp;
1254 	int error, optval;
1255 	int optlen;
1256 #ifdef IPSEC
1257 	struct proc *p = curproc; /* XXX */
1258 	struct tdb *tdb;
1259 	struct tdb_ident *tdbip, tdbi;
1260 	int s;
1261 #endif
1262 
1263 	optlen = m ? m->m_len : 0;
1264 	error = optval = 0;
1265 
1266 	privileged = (inp->inp_socket->so_state & SS_PRIV);
1267 
1268 	if (level == IPPROTO_IPV6) {
1269 		switch (op) {
1270 		case PRCO_SETOPT:
1271 			switch (optname) {
1272 			case IPV6_PKTOPTIONS:
1273 				/* m is freed in ip6_pcbopts */
1274 				return(ip6_pcbopts(&inp->inp_outputopts6,
1275 						   m, so));
1276 			case IPV6_HOPOPTS:
1277 			case IPV6_DSTOPTS:
1278 				if (!privileged) {
1279 					error = EPERM;
1280 					break;
1281 				}
1282 				/* fall through */
1283 			case IPV6_UNICAST_HOPS:
1284 			case IPV6_RECVOPTS:
1285 			case IPV6_RECVRETOPTS:
1286 			case IPV6_RECVDSTADDR:
1287 			case IPV6_PKTINFO:
1288 			case IPV6_HOPLIMIT:
1289 			case IPV6_RTHDR:
1290 			case IPV6_CHECKSUM:
1291 			case IPV6_FAITH:
1292 				if (optlen != sizeof(int))
1293 					error = EINVAL;
1294 				else {
1295 					optval = *mtod(m, int *);
1296 					switch (optname) {
1297 
1298 					case IPV6_UNICAST_HOPS:
1299 						if (optval < -1 || optval >= 256)
1300 							error = EINVAL;
1301 						else {
1302 							/* -1 = kernel default */
1303 							inp->inp_hops = optval;
1304 						}
1305 						break;
1306 #define OPTSET(bit) \
1307 	if (optval) \
1308 		inp->inp_flags |= bit; \
1309 	else \
1310 		inp->inp_flags &= ~bit;
1311 					case IPV6_RECVOPTS:
1312 						OPTSET(IN6P_RECVOPTS);
1313 						break;
1314 
1315 					case IPV6_RECVRETOPTS:
1316 						OPTSET(IN6P_RECVRETOPTS);
1317 						break;
1318 
1319 					case IPV6_RECVDSTADDR:
1320 						OPTSET(IN6P_RECVDSTADDR);
1321 						break;
1322 
1323 					case IPV6_PKTINFO:
1324 						OPTSET(IN6P_PKTINFO);
1325 						break;
1326 
1327 					case IPV6_HOPLIMIT:
1328 						OPTSET(IN6P_HOPLIMIT);
1329 						break;
1330 
1331 					case IPV6_HOPOPTS:
1332 						OPTSET(IN6P_HOPOPTS);
1333 						break;
1334 
1335 					case IPV6_DSTOPTS:
1336 						OPTSET(IN6P_DSTOPTS);
1337 						break;
1338 
1339 					case IPV6_RTHDR:
1340 						OPTSET(IN6P_RTHDR);
1341 						break;
1342 
1343 					case IPV6_CHECKSUM:
1344 						inp->in6p_cksum = optval;
1345 						break;
1346 
1347 					case IPV6_FAITH:
1348 						OPTSET(IN6P_FAITH);
1349 						break;
1350 					}
1351 				}
1352 				break;
1353 #undef OPTSET
1354 
1355 			case IPV6_MULTICAST_IF:
1356 			case IPV6_MULTICAST_HOPS:
1357 			case IPV6_MULTICAST_LOOP:
1358 			case IPV6_JOIN_GROUP:
1359 			case IPV6_LEAVE_GROUP:
1360 				error =	ip6_setmoptions(optname,
1361 					&inp->inp_moptions6, m);
1362 				break;
1363 
1364 			case IPV6_PORTRANGE:
1365 				optval = *mtod(m, int *);
1366 
1367 # define in6p		inp
1368 # define in6p_flags	inp_flags
1369 				switch (optval) {
1370 				case IPV6_PORTRANGE_DEFAULT:
1371 					in6p->in6p_flags &= ~(IN6P_LOWPORT);
1372 					in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1373 					break;
1374 
1375 				case IPV6_PORTRANGE_HIGH:
1376 					in6p->in6p_flags &= ~(IN6P_LOWPORT);
1377 					in6p->in6p_flags |= IN6P_HIGHPORT;
1378 					break;
1379 
1380 				case IPV6_PORTRANGE_LOW:
1381 					in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1382 					in6p->in6p_flags |= IN6P_LOWPORT;
1383 					break;
1384 
1385 				default:
1386 					error = EINVAL;
1387 					break;
1388 				}
1389 # undef in6p
1390 # undef in6p_flags
1391 				break;
1392 
1393 #if 0 /*KAME IPSEC*/
1394 			case IPV6_IPSEC_POLICY:
1395 			    {
1396 				caddr_t req = NULL;
1397 				if (m != 0)
1398 					req = mtod(m, caddr_t);
1399 				error = ipsec6_set_policy(in6p, optname, req,
1400 				                          privileged);
1401 			    }
1402 				break;
1403 #endif /* IPSEC */
1404 
1405 			case IPSEC6_OUTSA:
1406 #ifndef IPSEC
1407 				error = EINVAL;
1408 #else
1409 				s = spltdb();
1410 				if (m == 0 || m->m_len != sizeof(struct tdb_ident)) {
1411 					error = EINVAL;
1412 				} else {
1413 					tdbip = mtod(m, struct tdb_ident *);
1414 					tdb = gettdb(tdbip->spi, &tdbip->dst,
1415 						     tdbip->proto);
1416 					if (tdb == NULL)
1417 						error = ESRCH;
1418 					else
1419 						tdb_add_inp(tdb, inp, 0);
1420 				}
1421 				splx(s);
1422 #endif /* IPSEC */
1423 				break;
1424 
1425 			case IPV6_AUTH_LEVEL:
1426 			case IPV6_ESP_TRANS_LEVEL:
1427 			case IPV6_ESP_NETWORK_LEVEL:
1428 #ifndef IPSEC
1429 				error = EINVAL;
1430 #else
1431 				if (m == 0 || m->m_len != sizeof(int)) {
1432 					error = EINVAL;
1433 					break;
1434 				}
1435 				optval = *mtod(m, int *);
1436 
1437 				if (optval < IPSEC_LEVEL_BYPASS ||
1438 				    optval > IPSEC_LEVEL_UNIQUE) {
1439 					error = EINVAL;
1440 					break;
1441 				}
1442 
1443 				switch (optname) {
1444 				case IP_AUTH_LEVEL:
1445 				        if (optval < ipsec_auth_default_level &&
1446 					    suser(p->p_ucred, &p->p_acflag)) {
1447 						error = EACCES;
1448 						break;
1449 					}
1450 					inp->inp_seclevel[SL_AUTH] = optval;
1451 					break;
1452 
1453 				case IP_ESP_TRANS_LEVEL:
1454 				        if (optval < ipsec_esp_trans_default_level &&
1455 					    suser(p->p_ucred, &p->p_acflag)) {
1456 						error = EACCES;
1457 						break;
1458 					}
1459 					inp->inp_seclevel[SL_ESP_TRANS] = optval;
1460 					break;
1461 
1462 				case IP_ESP_NETWORK_LEVEL:
1463 				        if (optval < ipsec_esp_network_default_level &&
1464 					    suser(p->p_ucred, &p->p_acflag)) {
1465 						error = EACCES;
1466 						break;
1467 					}
1468 					inp->inp_seclevel[SL_ESP_NETWORK] = optval;
1469 					break;
1470 				}
1471 				if (!error)
1472 					inp->inp_secrequire = get_sa_require(inp);
1473 #endif
1474 				break;
1475 
1476 
1477 			default:
1478 				error = ENOPROTOOPT;
1479 				break;
1480 			}
1481 			if (m)
1482 				(void)m_free(m);
1483 			break;
1484 
1485 		case PRCO_GETOPT:
1486 			switch (optname) {
1487 
1488 			case IPV6_OPTIONS:
1489 			case IPV6_RETOPTS:
1490 #if 0
1491 				*mp = m = m_get(M_WAIT, MT_SOOPTS);
1492 				if (in6p->in6p_options) {
1493 					m->m_len = in6p->in6p_options->m_len;
1494 					bcopy(mtod(in6p->in6p_options, caddr_t),
1495 					      mtod(m, caddr_t),
1496 					      (unsigned)m->m_len);
1497 				} else
1498 					m->m_len = 0;
1499 				break;
1500 #else
1501 				error = ENOPROTOOPT;
1502 				break;
1503 #endif
1504 
1505 			case IPV6_PKTOPTIONS:
1506 				if (inp->inp_options) {
1507 					*mp = m_copym(inp->inp_options, 0,
1508 						      M_COPYALL, M_WAIT);
1509 				} else {
1510 					*mp = m_get(M_WAIT, MT_SOOPTS);
1511 					(*mp)->m_len = 0;
1512 				}
1513 				break;
1514 
1515 			case IPV6_HOPOPTS:
1516 			case IPV6_DSTOPTS:
1517 				if (!privileged) {
1518 					error = EPERM;
1519 					break;
1520 				}
1521 				/* fall through */
1522 			case IPV6_UNICAST_HOPS:
1523 			case IPV6_RECVOPTS:
1524 			case IPV6_RECVRETOPTS:
1525 			case IPV6_RECVDSTADDR:
1526 			case IPV6_PKTINFO:
1527 			case IPV6_HOPLIMIT:
1528 			case IPV6_RTHDR:
1529 			case IPV6_CHECKSUM:
1530 			case IPV6_FAITH:
1531 			case IPV6_PORTRANGE:
1532 				switch (optname) {
1533 
1534 				case IPV6_UNICAST_HOPS:
1535 					optval = inp->inp_hops;
1536 					break;
1537 
1538 #define OPTBIT(bit) (inp->inp_flags & bit ? 1 : 0)
1539 
1540 				case IPV6_RECVOPTS:
1541 					optval = OPTBIT(IN6P_RECVOPTS);
1542 					break;
1543 
1544 				case IPV6_RECVRETOPTS:
1545 					optval = OPTBIT(IN6P_RECVRETOPTS);
1546 					break;
1547 
1548 				case IPV6_RECVDSTADDR:
1549 					optval = OPTBIT(IN6P_RECVDSTADDR);
1550 					break;
1551 
1552 				case IPV6_PKTINFO:
1553 					optval = OPTBIT(IN6P_PKTINFO);
1554 					break;
1555 
1556 				case IPV6_HOPLIMIT:
1557 					optval = OPTBIT(IN6P_HOPLIMIT);
1558 					break;
1559 
1560 				case IPV6_HOPOPTS:
1561 					optval = OPTBIT(IN6P_HOPOPTS);
1562 					break;
1563 
1564 				case IPV6_DSTOPTS:
1565 					optval = OPTBIT(IN6P_DSTOPTS);
1566 					break;
1567 
1568 				case IPV6_RTHDR:
1569 					optval = OPTBIT(IN6P_RTHDR);
1570 					break;
1571 
1572 				case IPV6_CHECKSUM:
1573 					optval = inp->in6p_cksum;
1574 					break;
1575 
1576 				case IPV6_FAITH:
1577 					optval = OPTBIT(IN6P_FAITH);
1578 					break;
1579 
1580 				case IPV6_PORTRANGE:
1581 				    {
1582 					int flags;
1583 
1584 					flags = inp->inp_flags;
1585 					if (flags & IN6P_HIGHPORT)
1586 						optval = IPV6_PORTRANGE_HIGH;
1587 					else if (flags & IN6P_LOWPORT)
1588 						optval = IPV6_PORTRANGE_LOW;
1589 					else
1590 						optval = 0;
1591 					break;
1592 				    }
1593 				}
1594 				*mp = m = m_get(M_WAIT, MT_SOOPTS);
1595 				m->m_len = sizeof(int);
1596 				*mtod(m, int *) = optval;
1597 				break;
1598 
1599 			case IPV6_MULTICAST_IF:
1600 			case IPV6_MULTICAST_HOPS:
1601 			case IPV6_MULTICAST_LOOP:
1602 			case IPV6_JOIN_GROUP:
1603 			case IPV6_LEAVE_GROUP:
1604 				error = ip6_getmoptions(optname, inp->inp_moptions6, mp);
1605 				break;
1606 
1607 #if 0 /*KAME IPSEC*/
1608 			case IPV6_IPSEC_POLICY:
1609 			  {
1610 				caddr_t req = NULL;
1611 				int len = 0;
1612 
1613 				if (m != 0) {
1614 					req = mtod(m, caddr_t);
1615 					len = m->m_len;
1616 				}
1617 				error = ipsec6_get_policy(in6p, req, mp);
1618 				break;
1619 			  }
1620 #endif /* IPSEC */
1621 
1622 			case IPSEC6_OUTSA:
1623 #ifndef IPSEC
1624 				error = EINVAL;
1625 #else
1626 				s = spltdb();
1627 				if (inp->inp_tdb_out == NULL) {
1628 					error = ENOENT;
1629 				} else {
1630 					tdbi.spi = inp->inp_tdb_out->tdb_spi;
1631 					tdbi.dst = inp->inp_tdb_out->tdb_dst;
1632 					tdbi.proto = inp->inp_tdb_out->tdb_sproto;
1633 					*mp = m = m_get(M_WAIT, MT_SOOPTS);
1634 					m->m_len = sizeof(tdbi);
1635 					bcopy((caddr_t)&tdbi, mtod(m, caddr_t),
1636 					    (unsigned)m->m_len);
1637 				}
1638 				splx(s);
1639 #endif /* IPSEC */
1640 				break;
1641 
1642 			case IPV6_AUTH_LEVEL:
1643 			case IPV6_ESP_TRANS_LEVEL:
1644 			case IPV6_ESP_NETWORK_LEVEL:
1645 #ifndef IPSEC
1646 				m->m_len = sizeof(int);
1647 				*mtod(m, int *) = IPSEC_LEVEL_NONE;
1648 #else
1649 				m->m_len = sizeof(int);
1650 				switch (optname) {
1651 				case IP_AUTH_LEVEL:
1652 					optval = inp->inp_seclevel[SL_AUTH];
1653 					break;
1654 
1655 				case IP_ESP_TRANS_LEVEL:
1656 					optval =
1657 					    inp->inp_seclevel[SL_ESP_TRANS];
1658 					break;
1659 
1660 				case IP_ESP_NETWORK_LEVEL:
1661 					optval =
1662 					    inp->inp_seclevel[SL_ESP_NETWORK];
1663 					break;
1664 				}
1665 				*mtod(m, int *) = optval;
1666 #endif
1667 				break;
1668 
1669 			default:
1670 				error = ENOPROTOOPT;
1671 				break;
1672 			}
1673 			break;
1674 		}
1675 	} else {
1676 		error = EINVAL;
1677 		if (op == PRCO_SETOPT && *mp)
1678 			(void)m_free(*mp);
1679 	}
1680 	return(error);
1681 }
1682 
1683 /*
1684  * Set up IP6 options in pcb for insertion in output packets.
1685  * Store in mbuf with pointer in pcbopt, adding pseudo-option
1686  * with destination address if source routed.
1687  */
1688 static int
1689 ip6_pcbopts(pktopt, m, so)
1690 	struct ip6_pktopts **pktopt;
1691 	struct mbuf *m;
1692 	struct socket *so;
1693 {
1694 	struct ip6_pktopts *opt = *pktopt;
1695 	int error = 0;
1696 	struct proc *p = curproc;	/* XXX */
1697 	int priv = 0;
1698 
1699 	/* turn off any old options. */
1700 	if (opt) {
1701 		if (opt->ip6po_m)
1702 			(void)m_free(opt->ip6po_m);
1703 	}
1704 	else
1705 		opt = malloc(sizeof(*opt), M_IP6OPT, M_WAITOK);
1706 	*pktopt = 0;
1707 
1708 	if (!m || m->m_len == 0) {
1709 		/*
1710 		 * Only turning off any previous options.
1711 		 */
1712 		if (opt)
1713 			free(opt, M_IP6OPT);
1714 		if (m)
1715 			(void)m_free(m);
1716 		return(0);
1717 	}
1718 
1719 	/*  set options specified by user. */
1720 	if (p && !suser(p->p_ucred, &p->p_acflag))
1721 		priv = 1;
1722 	if ((error = ip6_setpktoptions(m, opt, priv)) != 0) {
1723 		(void)m_free(m);
1724 		return(error);
1725 	}
1726 	*pktopt = opt;
1727 	return(0);
1728 }
1729 
1730 /*
1731  * Set the IP6 multicast options in response to user setsockopt().
1732  */
1733 static int
1734 ip6_setmoptions(optname, im6op, m)
1735 	int optname;
1736 	struct ip6_moptions **im6op;
1737 	struct mbuf *m;
1738 {
1739 	int error = 0;
1740 	u_int loop, ifindex;
1741 	struct ipv6_mreq *mreq;
1742 	struct ifnet *ifp;
1743 	struct ip6_moptions *im6o = *im6op;
1744 	struct route_in6 ro;
1745 	struct sockaddr_in6 *dst;
1746 	struct in6_multi_mship *imm;
1747 	struct proc *p = curproc;	/* XXX */
1748 
1749 	if (im6o == NULL) {
1750 		/*
1751 		 * No multicast option buffer attached to the pcb;
1752 		 * allocate one and initialize to default values.
1753 		 */
1754 		im6o = (struct ip6_moptions *)
1755 			malloc(sizeof(*im6o), M_IPMOPTS, M_WAITOK);
1756 
1757 		*im6op = im6o;
1758 		im6o->im6o_multicast_ifp = NULL;
1759 		im6o->im6o_multicast_hlim = ip6_defmcasthlim;
1760 		im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
1761 		LIST_INIT(&im6o->im6o_memberships);
1762 	}
1763 
1764 	switch (optname) {
1765 
1766 	case IPV6_MULTICAST_IF:
1767 		/*
1768 		 * Select the interface for outgoing multicast packets.
1769 		 */
1770 		if (m == NULL || m->m_len != sizeof(u_int)) {
1771 			error = EINVAL;
1772 			break;
1773 		}
1774 		ifindex = *(mtod(m, u_int *));
1775 		if (ifindex < 0 || if_index < ifindex) {
1776 			error = ENXIO;	/* XXX EINVAL? */
1777 			break;
1778 		}
1779 		ifp = ifindex2ifnet[ifindex];
1780 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1781 			error = EADDRNOTAVAIL;
1782 			break;
1783 		}
1784 		im6o->im6o_multicast_ifp = ifp;
1785 		break;
1786 
1787 	case IPV6_MULTICAST_HOPS:
1788 	    {
1789 		/*
1790 		 * Set the IP6 hoplimit for outgoing multicast packets.
1791 		 */
1792 		int optval;
1793 		if (m == NULL || m->m_len != sizeof(int)) {
1794 			error = EINVAL;
1795 			break;
1796 		}
1797 		optval = *(mtod(m, u_int *));
1798 		if (optval < -1 || optval >= 256)
1799 			error = EINVAL;
1800 		else if (optval == -1)
1801 			im6o->im6o_multicast_hlim = ip6_defmcasthlim;
1802 		else
1803 			im6o->im6o_multicast_hlim = optval;
1804 		break;
1805 	    }
1806 
1807 	case IPV6_MULTICAST_LOOP:
1808 		/*
1809 		 * Set the loopback flag for outgoing multicast packets.
1810 		 * Must be zero or one.
1811 		 */
1812 		if (m == NULL || m->m_len != sizeof(u_int) ||
1813 		   (loop = *(mtod(m, u_int *))) > 1) {
1814 			error = EINVAL;
1815 			break;
1816 		}
1817 		im6o->im6o_multicast_loop = loop;
1818 		break;
1819 
1820 	case IPV6_JOIN_GROUP:
1821 		/*
1822 		 * Add a multicast group membership.
1823 		 * Group must be a valid IP6 multicast address.
1824 		 */
1825 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
1826 			error = EINVAL;
1827 			break;
1828 		}
1829 		mreq = mtod(m, struct ipv6_mreq *);
1830 		if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
1831 			/*
1832 			 * We use the unspecified address to specify to accept
1833 			 * all multicast addresses. Only super user is allowed
1834 			 * to do this.
1835 			 */
1836 			if (suser(p->p_ucred, &p->p_acflag)) {
1837 				error = EACCES;
1838 				break;
1839 			}
1840 		} else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
1841 			error = EINVAL;
1842 			break;
1843 		}
1844 
1845 		/*
1846 		 * If the interface is specified, validate it.
1847 		 */
1848 		if (mreq->ipv6mr_interface < 0
1849 		 || if_index < mreq->ipv6mr_interface) {
1850 			error = ENXIO;	/* XXX EINVAL? */
1851 			break;
1852 		}
1853 		/*
1854 		 * If no interface was explicitly specified, choose an
1855 		 * appropriate one according to the given multicast address.
1856 		 */
1857 		if (mreq->ipv6mr_interface == 0) {
1858 			/*
1859 			 * If the multicast address is in node-local scope,
1860 			 * the interface should be a loopback interface.
1861 			 * Otherwise, look up the routing table for the
1862 			 * address, and choose the outgoing interface.
1863 			 *   XXX: is it a good approach?
1864 			 */
1865 			if (IN6_IS_ADDR_MC_NODELOCAL(&mreq->ipv6mr_multiaddr)) {
1866 				ifp = lo0ifp;
1867 			}
1868 			else {
1869 				ro.ro_rt = NULL;
1870 				dst = (struct sockaddr_in6 *)&ro.ro_dst;
1871 				bzero(dst, sizeof(*dst));
1872 				dst->sin6_len = sizeof(struct sockaddr_in6);
1873 				dst->sin6_family = AF_INET6;
1874 				dst->sin6_addr = mreq->ipv6mr_multiaddr;
1875 				rtalloc((struct route *)&ro);
1876 				if (ro.ro_rt == NULL) {
1877 					error = EADDRNOTAVAIL;
1878 					break;
1879 				}
1880 				ifp = ro.ro_rt->rt_ifp;
1881 				rtfree(ro.ro_rt);
1882 			}
1883 		} else
1884 			ifp = ifindex2ifnet[mreq->ipv6mr_interface];
1885 
1886 		/*
1887 		 * See if we found an interface, and confirm that it
1888 		 * supports multicast
1889 		 */
1890 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1891 			error = EADDRNOTAVAIL;
1892 			break;
1893 		}
1894 		/*
1895 		 * Put interface index into the multicast address,
1896 		 * if the address has link-local scope.
1897 		 */
1898 		if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
1899 			mreq->ipv6mr_multiaddr.s6_addr16[1]
1900 				= htons(mreq->ipv6mr_interface);
1901 		}
1902 		/*
1903 		 * See if the membership already exists.
1904 		 */
1905 		for (imm = im6o->im6o_memberships.lh_first;
1906 		     imm != NULL; imm = imm->i6mm_chain.le_next)
1907 			if (imm->i6mm_maddr->in6m_ifp == ifp &&
1908 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
1909 					       &mreq->ipv6mr_multiaddr))
1910 				break;
1911 		if (imm != NULL) {
1912 			error = EADDRINUSE;
1913 			break;
1914 		}
1915 		/*
1916 		 * Everything looks good; add a new record to the multicast
1917 		 * address list for the given interface.
1918 		 */
1919 		imm = malloc(sizeof(*imm), M_IPMADDR, M_WAITOK);
1920 
1921 		if ((imm->i6mm_maddr =
1922 		     in6_addmulti(&mreq->ipv6mr_multiaddr, ifp, &error)) == NULL) {
1923 			free(imm, M_IPMADDR);
1924 			break;
1925 		}
1926 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
1927 		break;
1928 
1929 	case IPV6_LEAVE_GROUP:
1930 		/*
1931 		 * Drop a multicast group membership.
1932 		 * Group must be a valid IP6 multicast address.
1933 		 */
1934 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
1935 			error = EINVAL;
1936 			break;
1937 		}
1938 		mreq = mtod(m, struct ipv6_mreq *);
1939 		if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
1940 			if (suser(p->p_ucred, &p->p_acflag)) {
1941 				error = EACCES;
1942 				break;
1943 			}
1944 		} else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
1945 			error = EINVAL;
1946 			break;
1947 		}
1948 		/*
1949 		 * If an interface address was specified, get a pointer
1950 		 * to its ifnet structure.
1951 		 */
1952 		if (mreq->ipv6mr_interface < 0
1953 		 || if_index < mreq->ipv6mr_interface) {
1954 			error = ENXIO;	/* XXX EINVAL? */
1955 			break;
1956 		}
1957 		ifp = ifindex2ifnet[mreq->ipv6mr_interface];
1958 		/*
1959 		 * Put interface index into the multicast address,
1960 		 * if the address has link-local scope.
1961 		 */
1962 		if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
1963 			mreq->ipv6mr_multiaddr.s6_addr16[1]
1964 				= htons(mreq->ipv6mr_interface);
1965 		}
1966 		/*
1967 		 * Find the membership in the membership list.
1968 		 */
1969 		for (imm = im6o->im6o_memberships.lh_first;
1970 		     imm != NULL; imm = imm->i6mm_chain.le_next) {
1971 			if ((ifp == NULL ||
1972 			     imm->i6mm_maddr->in6m_ifp == ifp) &&
1973 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
1974 					       &mreq->ipv6mr_multiaddr))
1975 				break;
1976 		}
1977 		if (imm == NULL) {
1978 			/* Unable to resolve interface */
1979 			error = EADDRNOTAVAIL;
1980 			break;
1981 		}
1982 		/*
1983 		 * Give up the multicast address record to which the
1984 		 * membership points.
1985 		 */
1986 		LIST_REMOVE(imm, i6mm_chain);
1987 		in6_delmulti(imm->i6mm_maddr);
1988 		free(imm, M_IPMADDR);
1989 		break;
1990 
1991 	default:
1992 		error = EOPNOTSUPP;
1993 		break;
1994 	}
1995 
1996 	/*
1997 	 * If all options have default values, no need to keep the mbuf.
1998 	 */
1999 	if (im6o->im6o_multicast_ifp == NULL &&
2000 	    im6o->im6o_multicast_hlim == ip6_defmcasthlim &&
2001 	    im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
2002 	    im6o->im6o_memberships.lh_first == NULL) {
2003 		free(*im6op, M_IPMOPTS);
2004 		*im6op = NULL;
2005 	}
2006 
2007 	return(error);
2008 }
2009 
2010 /*
2011  * Return the IP6 multicast options in response to user getsockopt().
2012  */
2013 static int
2014 ip6_getmoptions(optname, im6o, mp)
2015 	int optname;
2016 	struct ip6_moptions *im6o;
2017 	struct mbuf **mp;
2018 {
2019 	u_int *hlim, *loop, *ifindex;
2020 
2021 	*mp = m_get(M_WAIT, MT_SOOPTS);
2022 
2023 	switch (optname) {
2024 
2025 	case IPV6_MULTICAST_IF:
2026 		ifindex = mtod(*mp, u_int *);
2027 		(*mp)->m_len = sizeof(u_int);
2028 		if (im6o == NULL || im6o->im6o_multicast_ifp == NULL)
2029 			*ifindex = 0;
2030 		else
2031 			*ifindex = im6o->im6o_multicast_ifp->if_index;
2032 		return(0);
2033 
2034 	case IPV6_MULTICAST_HOPS:
2035 		hlim = mtod(*mp, u_int *);
2036 		(*mp)->m_len = sizeof(u_int);
2037 		if (im6o == NULL)
2038 			*hlim = ip6_defmcasthlim;
2039 		else
2040 			*hlim = im6o->im6o_multicast_hlim;
2041 		return(0);
2042 
2043 	case IPV6_MULTICAST_LOOP:
2044 		loop = mtod(*mp, u_int *);
2045 		(*mp)->m_len = sizeof(u_int);
2046 		if (im6o == NULL)
2047 			*loop = ip6_defmcasthlim;
2048 		else
2049 			*loop = im6o->im6o_multicast_loop;
2050 		return(0);
2051 
2052 	default:
2053 		return(EOPNOTSUPP);
2054 	}
2055 }
2056 
2057 /*
2058  * Discard the IP6 multicast options.
2059  */
2060 void
2061 ip6_freemoptions(im6o)
2062 	struct ip6_moptions *im6o;
2063 {
2064 	struct in6_multi_mship *imm;
2065 
2066 	if (im6o == NULL)
2067 		return;
2068 
2069 	while ((imm = im6o->im6o_memberships.lh_first) != NULL) {
2070 		LIST_REMOVE(imm, i6mm_chain);
2071 		if (imm->i6mm_maddr)
2072 			in6_delmulti(imm->i6mm_maddr);
2073 		free(imm, M_IPMADDR);
2074 	}
2075 	free(im6o, M_IPMOPTS);
2076 }
2077 
2078 /*
2079  * Set IPv6 outgoing packet options based on advanced API.
2080  */
2081 int
2082 ip6_setpktoptions(control, opt, priv)
2083 	struct mbuf *control;
2084 	struct ip6_pktopts *opt;
2085 	int priv;
2086 {
2087 	struct cmsghdr *cm = 0;
2088 
2089 	if (control == 0 || opt == 0)
2090 		return(EINVAL);
2091 
2092 	bzero(opt, sizeof(*opt));
2093 	opt->ip6po_hlim = -1; /* -1 means to use default hop limit */
2094 
2095 	/*
2096 	 * XXX: Currently, we assume all the optional information is stored
2097 	 * in a single mbuf.
2098 	 */
2099 	if (control->m_next)
2100 		return(EINVAL);
2101 
2102 	opt->ip6po_m = control;
2103 
2104 	for (; control->m_len; control->m_data += CMSG_ALIGN(cm->cmsg_len),
2105 		     control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
2106 		cm = mtod(control, struct cmsghdr *);
2107 		if (cm->cmsg_len == 0 || cm->cmsg_len > control->m_len)
2108 			return(EINVAL);
2109 		if (cm->cmsg_level != IPPROTO_IPV6)
2110 			continue;
2111 
2112 		switch(cm->cmsg_type) {
2113 		case IPV6_PKTINFO:
2114 			if (cm->cmsg_len != CMSG_LEN(sizeof(struct in6_pktinfo)))
2115 				return(EINVAL);
2116 			opt->ip6po_pktinfo = (struct in6_pktinfo *)CMSG_DATA(cm);
2117 			if (opt->ip6po_pktinfo->ipi6_ifindex &&
2118 			    IN6_IS_ADDR_LINKLOCAL(&opt->ip6po_pktinfo->ipi6_addr))
2119 				opt->ip6po_pktinfo->ipi6_addr.s6_addr16[1] =
2120 					htons(opt->ip6po_pktinfo->ipi6_ifindex);
2121 
2122 			if (opt->ip6po_pktinfo->ipi6_ifindex > if_index
2123 			 || opt->ip6po_pktinfo->ipi6_ifindex < 0) {
2124 				return(ENXIO);
2125 			}
2126 
2127 			/*
2128 			 * Check if the requested source address is indeed a
2129 			 * unicast address assigned to the node, and can be
2130 			 * used as the packet's source address.
2131 			 */
2132 			if (!IN6_IS_ADDR_UNSPECIFIED(&opt->ip6po_pktinfo->ipi6_addr)) {
2133 				struct ifaddr *ia;
2134 				struct in6_ifaddr *ia6;
2135 				struct sockaddr_in6 sin6;
2136 
2137 				bzero(&sin6, sizeof(sin6));
2138 				sin6.sin6_len = sizeof(sin6);
2139 				sin6.sin6_family = AF_INET6;
2140 				sin6.sin6_addr =
2141 					opt->ip6po_pktinfo->ipi6_addr;
2142 				ia = ifa_ifwithaddr(sin6tosa(&sin6));
2143 				if (ia == NULL ||
2144 				    (opt->ip6po_pktinfo->ipi6_ifindex &&
2145 				     (ia->ifa_ifp->if_index !=
2146 				      opt->ip6po_pktinfo->ipi6_ifindex))) {
2147 					return(EADDRNOTAVAIL);
2148 				}
2149 				ia6 = (struct in6_ifaddr *)ia;
2150 				if ((ia6->ia6_flags & (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY)) != 0) {
2151 					return(EADDRNOTAVAIL);
2152 				}
2153 
2154 				/*
2155 				 * Check if the requested source address is
2156 				 * indeed a unicast address assigned to the
2157 				 * node.
2158 				 */
2159 				if (IN6_IS_ADDR_MULTICAST(&opt->ip6po_pktinfo->ipi6_addr))
2160 					return(EADDRNOTAVAIL);
2161 			}
2162 			break;
2163 
2164 		case IPV6_HOPLIMIT:
2165 			if (cm->cmsg_len != CMSG_LEN(sizeof(int)))
2166 				return(EINVAL);
2167 
2168 			opt->ip6po_hlim = *(int *)CMSG_DATA(cm);
2169 			if (opt->ip6po_hlim < -1 || opt->ip6po_hlim > 255)
2170 				return(EINVAL);
2171 			break;
2172 
2173 		case IPV6_NEXTHOP:
2174 			if (!priv)
2175 				return(EPERM);
2176 
2177 			if (cm->cmsg_len < sizeof(u_char) ||
2178 			    /* check if cmsg_len is large enough for sa_len */
2179 			    cm->cmsg_len < CMSG_LEN(*CMSG_DATA(cm)))
2180 				return(EINVAL);
2181 
2182 			opt->ip6po_nexthop = (struct sockaddr *)CMSG_DATA(cm);
2183 
2184 			break;
2185 
2186 		case IPV6_HOPOPTS:
2187 			if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_hbh)))
2188 				return(EINVAL);
2189 			opt->ip6po_hbh = (struct ip6_hbh *)CMSG_DATA(cm);
2190 			if (cm->cmsg_len !=
2191 			    CMSG_LEN((opt->ip6po_hbh->ip6h_len + 1) << 3))
2192 				return(EINVAL);
2193 			break;
2194 
2195 		case IPV6_DSTOPTS:
2196 			if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_dest)))
2197 				return(EINVAL);
2198 
2199 			/*
2200 			 * If there is no routing header yet, the destination
2201 			 * options header should be put on the 1st part.
2202 			 * Otherwise, the header should be on the 2nd part.
2203 			 * (See RFC 2460, section 4.1)
2204 			 */
2205 			if (opt->ip6po_rthdr == NULL) {
2206 				opt->ip6po_dest1 =
2207 					(struct ip6_dest *)CMSG_DATA(cm);
2208 				if (cm->cmsg_len !=
2209 				    CMSG_LEN((opt->ip6po_dest1->ip6d_len + 1)
2210 					     << 3))
2211 					return(EINVAL);
2212 			}
2213 			else {
2214 				opt->ip6po_dest2 =
2215 					(struct ip6_dest *)CMSG_DATA(cm);
2216 				if (cm->cmsg_len !=
2217 				    CMSG_LEN((opt->ip6po_dest2->ip6d_len + 1)
2218 					     << 3))
2219 					return(EINVAL);
2220 			}
2221 			break;
2222 
2223 		case IPV6_RTHDR:
2224 			if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_rthdr)))
2225 				return(EINVAL);
2226 			opt->ip6po_rthdr = (struct ip6_rthdr *)CMSG_DATA(cm);
2227 			if (cm->cmsg_len !=
2228 			    CMSG_LEN((opt->ip6po_rthdr->ip6r_len + 1) << 3))
2229 				return(EINVAL);
2230 			switch(opt->ip6po_rthdr->ip6r_type) {
2231 			case IPV6_RTHDR_TYPE_0:
2232 				if (opt->ip6po_rthdr->ip6r_segleft == 0)
2233 					return(EINVAL);
2234 				break;
2235 			default:
2236 				return(EINVAL);
2237 			}
2238 			break;
2239 
2240 		default:
2241 			return(ENOPROTOOPT);
2242 		}
2243 	}
2244 
2245 	return(0);
2246 }
2247 
2248 /*
2249  * Routine called from ip6_output() to loop back a copy of an IP6 multicast
2250  * packet to the input queue of a specified interface.  Note that this
2251  * calls the output routine of the loopback "driver", but with an interface
2252  * pointer that might NOT be lo0ifp -- easier than replicating that code here.
2253  */
2254 void
2255 ip6_mloopback(ifp, m, dst)
2256 	struct ifnet *ifp;
2257 	struct mbuf *m;
2258 	struct sockaddr_in6 *dst;
2259 {
2260 	struct mbuf *copym;
2261 	struct ip6_hdr *ip6;
2262 
2263 	copym = m_copy(m, 0, M_COPYALL);
2264 	if (copym == NULL)
2265 		return;
2266 
2267 	/*
2268 	 * Make sure to deep-copy IPv6 header portion in case the data
2269 	 * is in an mbuf cluster, so that we can safely override the IPv6
2270 	 * header portion later.
2271 	 */
2272 	if ((copym->m_flags & M_EXT) != 0 ||
2273 	    copym->m_len < sizeof(struct ip6_hdr)) {
2274 		copym = m_pullup(copym, sizeof(struct ip6_hdr));
2275 		if (copym == NULL)
2276 			return;
2277 	}
2278 
2279 #ifdef DIAGNOSTIC
2280 	if (copym->m_len < sizeof(*ip6)) {
2281 		m_freem(copym);
2282 		return;
2283 	}
2284 #endif
2285 
2286 	ip6 = mtod(copym, struct ip6_hdr *);
2287 	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
2288 		ip6->ip6_src.s6_addr16[1] = 0;
2289 	if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
2290 		ip6->ip6_dst.s6_addr16[1] = 0;
2291 
2292 	(void)looutput(ifp, copym, (struct sockaddr *)dst, NULL);
2293 }
2294 
2295 /*
2296  * Chop IPv6 header off from the payload.
2297  */
2298 static int
2299 ip6_splithdr(m, exthdrs)
2300 	struct mbuf *m;
2301 	struct ip6_exthdrs *exthdrs;
2302 {
2303 	struct mbuf *mh;
2304 	struct ip6_hdr *ip6;
2305 
2306 	ip6 = mtod(m, struct ip6_hdr *);
2307 	if (m->m_len > sizeof(*ip6)) {
2308 		MGETHDR(mh, M_DONTWAIT, MT_HEADER);
2309 		if (mh == 0) {
2310 			m_freem(m);
2311 			return ENOBUFS;
2312 		}
2313 		M_MOVE_PKTHDR(mh, m);
2314 		MH_ALIGN(mh, sizeof(*ip6));
2315 		m->m_len -= sizeof(*ip6);
2316 		m->m_data += sizeof(*ip6);
2317 		mh->m_next = m;
2318 		m = mh;
2319 		m->m_len = sizeof(*ip6);
2320 		bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof(*ip6));
2321 	}
2322 	exthdrs->ip6e_ip6 = m;
2323 	return 0;
2324 }
2325 
2326 /*
2327  * Compute IPv6 extension header length.
2328  */
2329 # define in6pcb	inpcb
2330 # define in6p_outputopts	inp_outputopts6
2331 int
2332 ip6_optlen(in6p)
2333 	struct in6pcb *in6p;
2334 {
2335 	int len;
2336 
2337 	if (!in6p->in6p_outputopts)
2338 		return 0;
2339 
2340 	len = 0;
2341 #define elen(x) \
2342     (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
2343 
2344 	len += elen(in6p->in6p_outputopts->ip6po_hbh);
2345 	len += elen(in6p->in6p_outputopts->ip6po_dest1);
2346 	len += elen(in6p->in6p_outputopts->ip6po_rthdr);
2347 	len += elen(in6p->in6p_outputopts->ip6po_dest2);
2348 	return len;
2349 #undef elen
2350 }
2351 # undef in6pcb
2352 # undef in6p_outputopts
2353