1 /* $OpenBSD: ip6_output.c,v 1.87 2005/01/11 08:57:24 djm Exp $ */
2 /* $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $ */
3
4 /*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 /*
34 * Copyright (c) 1982, 1986, 1988, 1990, 1993
35 * The Regents of the University of California. All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. Neither the name of the University nor the names of its contributors
46 * may be used to endorse or promote products derived from this software
47 * without specific prior written permission.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59 * SUCH DAMAGE.
60 *
61 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
62 */
63
64 #include "pf.h"
65
66 #include <sys/param.h>
67 #include <sys/malloc.h>
68 #include <sys/mbuf.h>
69 #include <sys/errno.h>
70 #include <sys/protosw.h>
71 #include <sys/socket.h>
72 #include <sys/socketvar.h>
73 #include <sys/systm.h>
74 #include <sys/proc.h>
75
76 #include <net/if.h>
77 #include <net/route.h>
78
79 #include <netinet/in.h>
80 #include <netinet/in_var.h>
81 #include <netinet/in_systm.h>
82 #include <netinet/ip.h>
83 #include <netinet/in_pcb.h>
84
85 #include <netinet/ip6.h>
86 #include <netinet/icmp6.h>
87 #include <netinet6/ip6_var.h>
88 #include <netinet6/nd6.h>
89 #include <netinet6/ip6protosw.h>
90
91 #if NPF > 0
92 #include <net/pfvar.h>
93 #endif
94
95 #ifdef IPSEC
96 #include <netinet/ip_ipsp.h>
97 #include <netinet/ip_ah.h>
98 #include <netinet/ip_esp.h>
99 #include <netinet/udp.h>
100 #include <netinet/tcp.h>
101 #include <net/pfkeyv2.h>
102
103 extern u_int8_t get_sa_require(struct inpcb *);
104
105 extern int ipsec_auth_default_level;
106 extern int ipsec_esp_trans_default_level;
107 extern int ipsec_esp_network_default_level;
108 extern int ipsec_ipcomp_default_level;
109 #endif /* IPSEC */
110
111 struct ip6_exthdrs {
112 struct mbuf *ip6e_ip6;
113 struct mbuf *ip6e_hbh;
114 struct mbuf *ip6e_dest1;
115 struct mbuf *ip6e_rthdr;
116 struct mbuf *ip6e_dest2;
117 };
118
119 static int ip6_pcbopts(struct ip6_pktopts **, struct mbuf *, struct socket *);
120 static int ip6_setmoptions(int, struct ip6_moptions **, struct mbuf *);
121 static int ip6_getmoptions(int, struct ip6_moptions *, struct mbuf **);
122 static int ip6_copyexthdr(struct mbuf **, caddr_t, int);
123 static int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
124 struct ip6_frag **);
125 static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
126 static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
127 static int ip6_getpmtu(struct route_in6 *, struct route_in6 *,
128 struct ifnet *, struct in6_addr *, u_long *, int *);
129
130 /*
131 * IP6 output. The packet in mbuf chain m contains a skeletal IP6
132 * header (with pri, len, nxt, hlim, src, dst).
133 * This function may modify ver and hlim only.
134 * The mbuf chain containing the packet will be freed.
135 * The mbuf opt, if present, will not be freed.
136 *
137 * type of "mtu": rt_rmx.rmx_mtu is u_long, ifnet.ifr_mtu is int, and
138 * nd_ifinfo.linkmtu is u_int32_t. so we use u_long to hold largest one,
139 * which is rt_rmx.rmx_mtu.
140 */
141 int
ip6_output(m0,opt,ro,flags,im6o,ifpp)142 ip6_output(m0, opt, ro, flags, im6o, ifpp)
143 struct mbuf *m0;
144 struct ip6_pktopts *opt;
145 struct route_in6 *ro;
146 int flags;
147 struct ip6_moptions *im6o;
148 struct ifnet **ifpp; /* XXX: just for statistics */
149 {
150 struct ip6_hdr *ip6, *mhip6;
151 struct ifnet *ifp, *origifp;
152 struct mbuf *m = m0;
153 int hlen, tlen, len, off;
154 struct route_in6 ip6route;
155 struct sockaddr_in6 *dst;
156 int error = 0;
157 struct in6_ifaddr *ia;
158 u_long mtu;
159 int alwaysfrag, dontfrag;
160 u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
161 struct ip6_exthdrs exthdrs;
162 struct in6_addr finaldst;
163 struct route_in6 *ro_pmtu = NULL;
164 int hdrsplit = 0;
165 u_int8_t sproto = 0;
166 #ifdef IPSEC
167 struct m_tag *mtag;
168 union sockaddr_union sdst;
169 struct tdb_ident *tdbi;
170 u_int32_t sspi = 0;
171 struct inpcb *inp;
172 struct tdb *tdb;
173 int s;
174 #endif /* IPSEC */
175
176 #ifdef IPSEC
177 inp = NULL; /*XXX*/
178 if (inp && (inp->inp_flags & INP_IPV6) == 0)
179 panic("ip6_output: IPv4 pcb is passed");
180 #endif /* IPSEC */
181
182 #define MAKE_EXTHDR(hp, mp) \
183 do { \
184 if (hp) { \
185 struct ip6_ext *eh = (struct ip6_ext *)(hp); \
186 error = ip6_copyexthdr((mp), (caddr_t)(hp), \
187 ((eh)->ip6e_len + 1) << 3); \
188 if (error) \
189 goto freehdrs; \
190 } \
191 } while (0)
192
193 bzero(&exthdrs, sizeof(exthdrs));
194 if (opt) {
195 /* Hop-by-Hop options header */
196 MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
197 /* Destination options header(1st part) */
198 MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
199 /* Routing header */
200 MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
201 /* Destination options header(2nd part) */
202 MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
203 }
204
205 #ifdef IPSEC
206 /*
207 * splnet is chosen over spltdb because we are not allowed to
208 * lower the level, and udp6_output calls us in splnet(). XXX check
209 */
210 s = splnet();
211
212 /*
213 * Check if there was an outgoing SA bound to the flow
214 * from a transport protocol.
215 */
216 ip6 = mtod(m, struct ip6_hdr *);
217
218 /* Do we have any pending SAs to apply ? */
219 mtag = m_tag_find(m, PACKET_TAG_IPSEC_PENDING_TDB, NULL);
220 if (mtag != NULL) {
221 #ifdef DIAGNOSTIC
222 if (mtag->m_tag_len != sizeof (struct tdb_ident))
223 panic("ip6_output: tag of length %d (should be %d",
224 mtag->m_tag_len, (int)sizeof (struct tdb_ident));
225 #endif
226 tdbi = (struct tdb_ident *)(mtag + 1);
227 tdb = gettdb(tdbi->spi, &tdbi->dst, tdbi->proto);
228 if (tdb == NULL)
229 error = -EINVAL;
230 m_tag_delete(m, mtag);
231 } else
232 tdb = ipsp_spd_lookup(m, AF_INET6, sizeof(struct ip6_hdr),
233 &error, IPSP_DIRECTION_OUT, NULL, inp);
234
235 if (tdb == NULL) {
236 splx(s);
237
238 if (error == 0) {
239 /*
240 * No IPsec processing required, we'll just send the
241 * packet out.
242 */
243 sproto = 0;
244
245 /* Fall through to routing/multicast handling */
246 } else {
247 /*
248 * -EINVAL is used to indicate that the packet should
249 * be silently dropped, typically because we've asked
250 * key management for an SA.
251 */
252 if (error == -EINVAL) /* Should silently drop packet */
253 error = 0;
254
255 goto freehdrs;
256 }
257 } else {
258 /* Loop detection */
259 for (mtag = m_tag_first(m); mtag != NULL;
260 mtag = m_tag_next(m, mtag)) {
261 if (mtag->m_tag_id != PACKET_TAG_IPSEC_OUT_DONE &&
262 mtag->m_tag_id !=
263 PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED)
264 continue;
265 tdbi = (struct tdb_ident *)(mtag + 1);
266 if (tdbi->spi == tdb->tdb_spi &&
267 tdbi->proto == tdb->tdb_sproto &&
268 !bcmp(&tdbi->dst, &tdb->tdb_dst,
269 sizeof(union sockaddr_union))) {
270 splx(s);
271 sproto = 0; /* mark as no-IPsec-needed */
272 goto done_spd;
273 }
274 }
275
276 /* We need to do IPsec */
277 bcopy(&tdb->tdb_dst, &sdst, sizeof(sdst));
278 sspi = tdb->tdb_spi;
279 sproto = tdb->tdb_sproto;
280 splx(s);
281
282 #if 1 /* XXX */
283 /* if we have any extension header, we cannot perform IPsec */
284 if (exthdrs.ip6e_hbh || exthdrs.ip6e_dest1 ||
285 exthdrs.ip6e_rthdr || exthdrs.ip6e_dest2) {
286 error = EHOSTUNREACH;
287 goto freehdrs;
288 }
289 #endif
290 }
291
292 /* Fall through to the routing/multicast handling code */
293 done_spd:
294 #endif /* IPSEC */
295
296 /*
297 * Calculate the total length of the extension header chain.
298 * Keep the length of the unfragmentable part for fragmentation.
299 */
300 optlen = 0;
301 if (exthdrs.ip6e_hbh) optlen += exthdrs.ip6e_hbh->m_len;
302 if (exthdrs.ip6e_dest1) optlen += exthdrs.ip6e_dest1->m_len;
303 if (exthdrs.ip6e_rthdr) optlen += exthdrs.ip6e_rthdr->m_len;
304 unfragpartlen = optlen + sizeof(struct ip6_hdr);
305 /* NOTE: we don't add AH/ESP length here. do that later. */
306 if (exthdrs.ip6e_dest2) optlen += exthdrs.ip6e_dest2->m_len;
307
308 /*
309 * If we need IPsec, or there is at least one extension header,
310 * separate IP6 header from the payload.
311 */
312 if ((sproto || optlen) && !hdrsplit) {
313 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
314 m = NULL;
315 goto freehdrs;
316 }
317 m = exthdrs.ip6e_ip6;
318 hdrsplit++;
319 }
320
321 /* adjust pointer */
322 ip6 = mtod(m, struct ip6_hdr *);
323
324 /* adjust mbuf packet header length */
325 m->m_pkthdr.len += optlen;
326 plen = m->m_pkthdr.len - sizeof(*ip6);
327
328 /* If this is a jumbo payload, insert a jumbo payload option. */
329 if (plen > IPV6_MAXPACKET) {
330 if (!hdrsplit) {
331 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
332 m = NULL;
333 goto freehdrs;
334 }
335 m = exthdrs.ip6e_ip6;
336 hdrsplit++;
337 }
338 /* adjust pointer */
339 ip6 = mtod(m, struct ip6_hdr *);
340 if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
341 goto freehdrs;
342 ip6->ip6_plen = 0;
343 } else
344 ip6->ip6_plen = htons(plen);
345
346 /*
347 * Concatenate headers and fill in next header fields.
348 * Here we have, on "m"
349 * IPv6 payload
350 * and we insert headers accordingly. Finally, we should be getting:
351 * IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
352 *
353 * during the header composing process, "m" points to IPv6 header.
354 * "mprev" points to an extension header prior to esp.
355 */
356 {
357 u_char *nexthdrp = &ip6->ip6_nxt;
358 struct mbuf *mprev = m;
359
360 /*
361 * we treat dest2 specially. this makes IPsec processing
362 * much easier.
363 *
364 * result: IPv6 dest2 payload
365 * m and mprev will point to IPv6 header.
366 */
367 if (exthdrs.ip6e_dest2) {
368 if (!hdrsplit)
369 panic("assumption failed: hdr not split");
370 exthdrs.ip6e_dest2->m_next = m->m_next;
371 m->m_next = exthdrs.ip6e_dest2;
372 *mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
373 ip6->ip6_nxt = IPPROTO_DSTOPTS;
374 }
375
376 #define MAKE_CHAIN(m, mp, p, i)\
377 do {\
378 if (m) {\
379 if (!hdrsplit) \
380 panic("assumption failed: hdr not split"); \
381 *mtod((m), u_char *) = *(p);\
382 *(p) = (i);\
383 p = mtod((m), u_char *);\
384 (m)->m_next = (mp)->m_next;\
385 (mp)->m_next = (m);\
386 (mp) = (m);\
387 }\
388 } while (0)
389 /*
390 * result: IPv6 hbh dest1 rthdr dest2 payload
391 * m will point to IPv6 header. mprev will point to the
392 * extension header prior to dest2 (rthdr in the above case).
393 */
394 MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
395 MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp,
396 IPPROTO_DSTOPTS);
397 MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp,
398 IPPROTO_ROUTING);
399 }
400
401 /*
402 * If there is a routing header, replace destination address field
403 * with the first hop of the routing header.
404 */
405 if (exthdrs.ip6e_rthdr) {
406 struct ip6_rthdr *rh;
407 struct ip6_rthdr0 *rh0;
408 struct in6_addr *addr;
409
410 rh = (struct ip6_rthdr *)(mtod(exthdrs.ip6e_rthdr,
411 struct ip6_rthdr *));
412 finaldst = ip6->ip6_dst;
413 switch (rh->ip6r_type) {
414 case IPV6_RTHDR_TYPE_0:
415 rh0 = (struct ip6_rthdr0 *)rh;
416 addr = (struct in6_addr *)(rh0 + 1);
417 ip6->ip6_dst = addr[0];
418 bcopy(&addr[1], &addr[0],
419 sizeof(struct in6_addr) * (rh0->ip6r0_segleft - 1));
420 addr[rh0->ip6r0_segleft - 1] = finaldst;
421 break;
422 default: /* is it possible? */
423 error = EINVAL;
424 goto bad;
425 }
426 }
427
428 /* Source address validation */
429 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
430 (flags & IPV6_UNSPECSRC) == 0) {
431 error = EOPNOTSUPP;
432 ip6stat.ip6s_badscope++;
433 goto bad;
434 }
435 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
436 error = EOPNOTSUPP;
437 ip6stat.ip6s_badscope++;
438 goto bad;
439 }
440
441 ip6stat.ip6s_localout++;
442
443 /*
444 * Route packet.
445 */
446 if (ro == 0) {
447 ro = &ip6route;
448 bzero((caddr_t)ro, sizeof(*ro));
449 }
450 ro_pmtu = ro;
451 if (opt && opt->ip6po_rthdr)
452 ro = &opt->ip6po_route;
453 dst = (struct sockaddr_in6 *)&ro->ro_dst;
454 /*
455 * If there is a cached route,
456 * check that it is to the same destination
457 * and is still up. If not, free it and try again.
458 */
459 if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
460 dst->sin6_family != AF_INET6 ||
461 !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst))) {
462 RTFREE(ro->ro_rt);
463 ro->ro_rt = (struct rtentry *)0;
464 }
465 if (ro->ro_rt == 0) {
466 bzero(dst, sizeof(*dst));
467 dst->sin6_family = AF_INET6;
468 dst->sin6_len = sizeof(struct sockaddr_in6);
469 dst->sin6_addr = ip6->ip6_dst;
470 }
471 #ifdef IPSEC
472 /*
473 * Check if the packet needs encapsulation.
474 * ipsp_process_packet will never come back to here.
475 */
476 if (sproto != 0) {
477 s = splnet();
478
479 /* fill in IPv6 header which would be filled later */
480 if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
481 if (opt && opt->ip6po_hlim != -1)
482 ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
483 } else {
484 if (im6o != NULL)
485 ip6->ip6_hlim = im6o->im6o_multicast_hlim;
486 else
487 ip6->ip6_hlim = ip6_defmcasthlim;
488 if (opt && opt->ip6po_hlim != -1)
489 ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
490
491 /*
492 * XXX what should we do if ip6_hlim == 0 and the
493 * packet gets tunnelled?
494 */
495 }
496
497 tdb = gettdb(sspi, &sdst, sproto);
498 if (tdb == NULL) {
499 splx(s);
500 error = EHOSTUNREACH;
501 m_freem(m);
502 goto done;
503 }
504
505 /* Latch to PCB */
506 if (inp)
507 tdb_add_inp(tdb, inp, 0);
508
509 m->m_flags &= ~(M_BCAST | M_MCAST); /* just in case */
510
511 /* Callee frees mbuf */
512 error = ipsp_process_packet(m, tdb, AF_INET6, 0);
513 splx(s);
514 return error; /* Nothing more to be done */
515 }
516 #endif /* IPSEC */
517
518 if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
519 /* Unicast */
520
521 #define ifatoia6(ifa) ((struct in6_ifaddr *)(ifa))
522 #define sin6tosa(sin6) ((struct sockaddr *)(sin6))
523 /* xxx
524 * interface selection comes here
525 * if an interface is specified from an upper layer,
526 * ifp must point it.
527 */
528 if (ro->ro_rt == 0) {
529 /*
530 * non-bsdi always clone routes, if parent is
531 * PRF_CLONING.
532 */
533 rtalloc((struct route *)ro);
534 }
535 if (ro->ro_rt == 0) {
536 ip6stat.ip6s_noroute++;
537 error = EHOSTUNREACH;
538 /* XXX in6_ifstat_inc(ifp, ifs6_out_discard); */
539 goto bad;
540 }
541 ia = ifatoia6(ro->ro_rt->rt_ifa);
542 ifp = ro->ro_rt->rt_ifp;
543 ro->ro_rt->rt_use++;
544 if (ro->ro_rt->rt_flags & RTF_GATEWAY)
545 dst = (struct sockaddr_in6 *)ro->ro_rt->rt_gateway;
546 m->m_flags &= ~(M_BCAST | M_MCAST); /* just in case */
547
548 in6_ifstat_inc(ifp, ifs6_out_request);
549
550 /*
551 * Check if the outgoing interface conflicts with
552 * the interface specified by ifi6_ifindex (if specified).
553 * Note that loopback interface is always okay.
554 * (this may happen when we are sending a packet to one of
555 * our own addresses.)
556 */
557 if (opt && opt->ip6po_pktinfo &&
558 opt->ip6po_pktinfo->ipi6_ifindex) {
559 if (!(ifp->if_flags & IFF_LOOPBACK) &&
560 ifp->if_index != opt->ip6po_pktinfo->ipi6_ifindex) {
561 ip6stat.ip6s_noroute++;
562 in6_ifstat_inc(ifp, ifs6_out_discard);
563 error = EHOSTUNREACH;
564 goto bad;
565 }
566 }
567
568 if (opt && opt->ip6po_hlim != -1)
569 ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
570 } else {
571 /* Multicast */
572 struct in6_multi *in6m;
573
574 m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
575
576 /*
577 * See if the caller provided any multicast options
578 */
579 ifp = NULL;
580 if (im6o != NULL) {
581 ip6->ip6_hlim = im6o->im6o_multicast_hlim;
582 if (im6o->im6o_multicast_ifp != NULL)
583 ifp = im6o->im6o_multicast_ifp;
584 } else
585 ip6->ip6_hlim = ip6_defmcasthlim;
586
587 /*
588 * See if the caller provided the outgoing interface
589 * as an ancillary data.
590 * Boundary check for ifindex is assumed to be already done.
591 */
592 if (opt && opt->ip6po_pktinfo && opt->ip6po_pktinfo->ipi6_ifindex)
593 ifp = ifindex2ifnet[opt->ip6po_pktinfo->ipi6_ifindex];
594
595 /*
596 * If the destination is a node-local scope multicast,
597 * the packet should be loop-backed only.
598 */
599 if (IN6_IS_ADDR_MC_NODELOCAL(&ip6->ip6_dst)) {
600 /*
601 * If the outgoing interface is already specified,
602 * it should be a loopback interface.
603 */
604 if (ifp && (ifp->if_flags & IFF_LOOPBACK) == 0) {
605 ip6stat.ip6s_badscope++;
606 error = ENETUNREACH; /* XXX: better error? */
607 /* XXX correct ifp? */
608 in6_ifstat_inc(ifp, ifs6_out_discard);
609 goto bad;
610 } else {
611 ifp = lo0ifp;
612 }
613 }
614
615 if (opt && opt->ip6po_hlim != -1)
616 ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
617
618 /*
619 * If caller did not provide an interface lookup a
620 * default in the routing table. This is either a
621 * default for the speicfied group (i.e. a host
622 * route), or a multicast default (a route for the
623 * ``net'' ff00::/8).
624 */
625 if (ifp == NULL) {
626 if (ro->ro_rt == 0) {
627 ro->ro_rt = rtalloc1((struct sockaddr *)
628 &ro->ro_dst, 0);
629 }
630 if (ro->ro_rt == 0) {
631 ip6stat.ip6s_noroute++;
632 error = EHOSTUNREACH;
633 /* XXX in6_ifstat_inc(ifp, ifs6_out_discard) */
634 goto bad;
635 }
636 ia = ifatoia6(ro->ro_rt->rt_ifa);
637 ifp = ro->ro_rt->rt_ifp;
638 ro->ro_rt->rt_use++;
639 }
640
641 if ((flags & IPV6_FORWARDING) == 0)
642 in6_ifstat_inc(ifp, ifs6_out_request);
643 in6_ifstat_inc(ifp, ifs6_out_mcast);
644
645 /*
646 * Confirm that the outgoing interface supports multicast.
647 */
648 if ((ifp->if_flags & IFF_MULTICAST) == 0) {
649 ip6stat.ip6s_noroute++;
650 in6_ifstat_inc(ifp, ifs6_out_discard);
651 error = ENETUNREACH;
652 goto bad;
653 }
654 IN6_LOOKUP_MULTI(ip6->ip6_dst, ifp, in6m);
655 if (in6m != NULL &&
656 (im6o == NULL || im6o->im6o_multicast_loop)) {
657 /*
658 * If we belong to the destination multicast group
659 * on the outgoing interface, and the caller did not
660 * forbid loopback, loop back a copy.
661 */
662 ip6_mloopback(ifp, m, dst);
663 } else {
664 /*
665 * If we are acting as a multicast router, perform
666 * multicast forwarding as if the packet had just
667 * arrived on the interface to which we are about
668 * to send. The multicast forwarding function
669 * recursively calls this function, using the
670 * IPV6_FORWARDING flag to prevent infinite recursion.
671 *
672 * Multicasts that are looped back by ip6_mloopback(),
673 * above, will be forwarded by the ip6_input() routine,
674 * if necessary.
675 */
676 if (ip6_mrouter && (flags & IPV6_FORWARDING) == 0) {
677 if (ip6_mforward(ip6, ifp, m) != 0) {
678 m_freem(m);
679 goto done;
680 }
681 }
682 }
683 /*
684 * Multicasts with a hoplimit of zero may be looped back,
685 * above, but must not be transmitted on a network.
686 * Also, multicasts addressed to the loopback interface
687 * are not sent -- the above call to ip6_mloopback() will
688 * loop back a copy if this host actually belongs to the
689 * destination group on the loopback interface.
690 */
691 if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK)) {
692 m_freem(m);
693 goto done;
694 }
695 }
696
697 /*
698 * Fill the outgoing inteface to tell the upper layer
699 * to increment per-interface statistics.
700 */
701 if (ifpp)
702 *ifpp = ifp;
703
704 /* Determine path MTU. */
705 if ((error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, &mtu,
706 &alwaysfrag)) != 0)
707 goto bad;
708
709 /*
710 * The caller of this function may specify to use the minimum MTU
711 * in some cases.
712 */
713 if (mtu > IPV6_MMTU) {
714 if ((flags & IPV6_MINMTU))
715 mtu = IPV6_MMTU;
716 }
717
718 /* Fake scoped addresses */
719 if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
720 /*
721 * If source or destination address is a scoped address, and
722 * the packet is going to be sent to a loopback interface,
723 * we should keep the original interface.
724 */
725
726 /*
727 * XXX: this is a very experimental and temporary solution.
728 * We eventually have sockaddr_in6 and use the sin6_scope_id
729 * field of the structure here.
730 * We rely on the consistency between two scope zone ids
731 * of source add destination, which should already be assured
732 * Larger scopes than link will be supported in the near
733 * future.
734 */
735 origifp = NULL;
736 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
737 origifp = ifindex2ifnet[ntohs(ip6->ip6_src.s6_addr16[1])];
738 else if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
739 origifp = ifindex2ifnet[ntohs(ip6->ip6_dst.s6_addr16[1])];
740 /*
741 * XXX: origifp can be NULL even in those two cases above.
742 * For example, if we remove the (only) link-local address
743 * from the loopback interface, and try to send a link-local
744 * address without link-id information. Then the source
745 * address is ::1, and the destination address is the
746 * link-local address with its s6_addr16[1] being zero.
747 * What is worse, if the packet goes to the loopback interface
748 * by a default rejected route, the null pointer would be
749 * passed to looutput, and the kernel would hang.
750 * The following last resort would prevent such disaster.
751 */
752 if (origifp == NULL)
753 origifp = ifp;
754 } else
755 origifp = ifp;
756 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
757 ip6->ip6_src.s6_addr16[1] = 0;
758 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
759 ip6->ip6_dst.s6_addr16[1] = 0;
760
761 /*
762 * If the outgoing packet contains a hop-by-hop options header,
763 * it must be examined and processed even by the source node.
764 * (RFC 2460, section 4.)
765 */
766 if (exthdrs.ip6e_hbh) {
767 struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh, struct ip6_hbh *);
768 u_int32_t dummy1; /* XXX unused */
769 u_int32_t dummy2; /* XXX unused */
770
771 /*
772 * XXX: if we have to send an ICMPv6 error to the sender,
773 * we need the M_LOOP flag since icmp6_error() expects
774 * the IPv6 and the hop-by-hop options header are
775 * continuous unless the flag is set.
776 */
777 m->m_flags |= M_LOOP;
778 m->m_pkthdr.rcvif = ifp;
779 if (ip6_process_hopopts(m, (u_int8_t *)(hbh + 1),
780 ((hbh->ip6h_len + 1) << 3) - sizeof(struct ip6_hbh),
781 &dummy1, &dummy2) < 0) {
782 /* m was already freed at this point */
783 error = EINVAL;/* better error? */
784 goto done;
785 }
786 m->m_flags &= ~M_LOOP; /* XXX */
787 m->m_pkthdr.rcvif = NULL;
788 }
789
790 #if NPF > 0
791 if (pf_test6(PF_OUT, ifp, &m) != PF_PASS) {
792 error = EHOSTUNREACH;
793 m_freem(m);
794 goto done;
795 }
796 if (m == NULL)
797 goto done;
798 ip6 = mtod(m, struct ip6_hdr *);
799 #endif
800
801 /*
802 * Send the packet to the outgoing interface.
803 * If necessary, do IPv6 fragmentation before sending.
804 *
805 * the logic here is rather complex:
806 * 1: normal case (dontfrag == 0, alwaysfrag == 0)
807 * 1-a: send as is if tlen <= path mtu
808 * 1-b: fragment if tlen > path mtu
809 *
810 * 2: if user asks us not to fragment (dontfrag == 1)
811 * 2-a: send as is if tlen <= interface mtu
812 * 2-b: error if tlen > interface mtu
813 *
814 * 3: if we always need to attach fragment header (alwaysfrag == 1)
815 * always fragment
816 *
817 * 4: if dontfrag == 1 && alwaysfrag == 1
818 * error, as we cannot handle this conflicting request
819 */
820 tlen = m->m_pkthdr.len;
821
822 dontfrag = 0;
823 if (dontfrag && alwaysfrag) { /* case 4 */
824 /* conflicting request - can't transmit */
825 error = EMSGSIZE;
826 goto bad;
827 }
828 if (dontfrag && tlen > IN6_LINKMTU(ifp)) { /* case 2-b */
829 /*
830 * Even if the DONTFRAG option is specified, we cannot send the
831 * packet when the data length is larger than the MTU of the
832 * outgoing interface.
833 * Notify the error by sending IPV6_PATHMTU ancillary data as
834 * well as returning an error code (the latter is not described
835 * in the API spec.)
836 */
837 #if 0
838 u_int32_t mtu32;
839 struct ip6ctlparam ip6cp;
840
841 mtu32 = (u_int32_t)mtu;
842 bzero(&ip6cp, sizeof(ip6cp));
843 ip6cp.ip6c_cmdarg = (void *)&mtu32;
844 pfctlinput2(PRC_MSGSIZE, (struct sockaddr *)&ro_pmtu->ro_dst,
845 (void *)&ip6cp);
846 #endif
847
848 error = EMSGSIZE;
849 goto bad;
850 }
851
852 /*
853 * transmit packet without fragmentation
854 */
855 if (dontfrag || (!alwaysfrag && tlen <= mtu)) { /* case 1-a and 2-a */
856 error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
857 goto done;
858 }
859
860 /*
861 * try to fragment the packet. case 1-b and 3
862 */
863 if (mtu < IPV6_MMTU) {
864 /* path MTU cannot be less than IPV6_MMTU */
865 error = EMSGSIZE;
866 in6_ifstat_inc(ifp, ifs6_out_fragfail);
867 goto bad;
868 } else if (ip6->ip6_plen == 0) {
869 /* jumbo payload cannot be fragmented */
870 error = EMSGSIZE;
871 in6_ifstat_inc(ifp, ifs6_out_fragfail);
872 goto bad;
873 } else {
874 struct mbuf **mnext, *m_frgpart;
875 struct ip6_frag *ip6f;
876 u_int32_t id = htonl(ip6_randomid());
877 u_char nextproto;
878 #if 0
879 struct ip6ctlparam ip6cp;
880 u_int32_t mtu32;
881 #endif
882
883 /*
884 * Too large for the destination or interface;
885 * fragment if possible.
886 * Must be able to put at least 8 bytes per fragment.
887 */
888 hlen = unfragpartlen;
889 if (mtu > IPV6_MAXPACKET)
890 mtu = IPV6_MAXPACKET;
891
892 #if 0
893 /* Notify a proper path MTU to applications. */
894 mtu32 = (u_int32_t)mtu;
895 bzero(&ip6cp, sizeof(ip6cp));
896 ip6cp.ip6c_cmdarg = (void *)&mtu32;
897 pfctlinput2(PRC_MSGSIZE, (struct sockaddr *)&ro_pmtu->ro_dst,
898 (void *)&ip6cp);
899 #endif
900
901 len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
902 if (len < 8) {
903 error = EMSGSIZE;
904 in6_ifstat_inc(ifp, ifs6_out_fragfail);
905 goto bad;
906 }
907
908 mnext = &m->m_nextpkt;
909
910 /*
911 * Change the next header field of the last header in the
912 * unfragmentable part.
913 */
914 if (exthdrs.ip6e_rthdr) {
915 nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
916 *mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
917 } else if (exthdrs.ip6e_dest1) {
918 nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
919 *mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
920 } else if (exthdrs.ip6e_hbh) {
921 nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
922 *mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
923 } else {
924 nextproto = ip6->ip6_nxt;
925 ip6->ip6_nxt = IPPROTO_FRAGMENT;
926 }
927
928 /*
929 * Loop through length of segment after first fragment,
930 * make new header and copy data of each part and link onto
931 * chain.
932 */
933 m0 = m;
934 for (off = hlen; off < tlen; off += len) {
935 struct mbuf *mlast;
936
937 MGETHDR(m, M_DONTWAIT, MT_HEADER);
938 if (!m) {
939 error = ENOBUFS;
940 ip6stat.ip6s_odropped++;
941 goto sendorfree;
942 }
943 m->m_pkthdr.rcvif = NULL;
944 m->m_flags = m0->m_flags & M_COPYFLAGS;
945 *mnext = m;
946 mnext = &m->m_nextpkt;
947 m->m_data += max_linkhdr;
948 mhip6 = mtod(m, struct ip6_hdr *);
949 *mhip6 = *ip6;
950 m->m_len = sizeof(*mhip6);
951 error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
952 if (error) {
953 ip6stat.ip6s_odropped++;
954 goto sendorfree;
955 }
956 ip6f->ip6f_offlg = htons((u_int16_t)((off - hlen) & ~7));
957 if (off + len >= tlen)
958 len = tlen - off;
959 else
960 ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
961 mhip6->ip6_plen = htons((u_int16_t)(len + hlen +
962 sizeof(*ip6f) - sizeof(struct ip6_hdr)));
963 if ((m_frgpart = m_copy(m0, off, len)) == 0) {
964 error = ENOBUFS;
965 ip6stat.ip6s_odropped++;
966 goto sendorfree;
967 }
968 for (mlast = m; mlast->m_next; mlast = mlast->m_next)
969 ;
970 mlast->m_next = m_frgpart;
971 m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
972 m->m_pkthdr.rcvif = (struct ifnet *)0;
973 ip6f->ip6f_reserved = 0;
974 ip6f->ip6f_ident = id;
975 ip6f->ip6f_nxt = nextproto;
976 ip6stat.ip6s_ofragments++;
977 in6_ifstat_inc(ifp, ifs6_out_fragcreat);
978 }
979
980 in6_ifstat_inc(ifp, ifs6_out_fragok);
981 }
982
983 /*
984 * Remove leading garbages.
985 */
986 sendorfree:
987 m = m0->m_nextpkt;
988 m0->m_nextpkt = 0;
989 m_freem(m0);
990 for (m0 = m; m; m = m0) {
991 m0 = m->m_nextpkt;
992 m->m_nextpkt = 0;
993 if (error == 0) {
994 error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
995 } else
996 m_freem(m);
997 }
998
999 if (error == 0)
1000 ip6stat.ip6s_fragmented++;
1001
1002 done:
1003 if (ro == &ip6route && ro->ro_rt) { /* brace necessary for RTFREE */
1004 RTFREE(ro->ro_rt);
1005 } else if (ro_pmtu == &ip6route && ro_pmtu->ro_rt) {
1006 RTFREE(ro_pmtu->ro_rt);
1007 }
1008
1009 return (error);
1010
1011 freehdrs:
1012 m_freem(exthdrs.ip6e_hbh); /* m_freem will check if mbuf is 0 */
1013 m_freem(exthdrs.ip6e_dest1);
1014 m_freem(exthdrs.ip6e_rthdr);
1015 m_freem(exthdrs.ip6e_dest2);
1016 /* FALLTHROUGH */
1017 bad:
1018 m_freem(m);
1019 goto done;
1020 }
1021
1022 static int
ip6_copyexthdr(mp,hdr,hlen)1023 ip6_copyexthdr(mp, hdr, hlen)
1024 struct mbuf **mp;
1025 caddr_t hdr;
1026 int hlen;
1027 {
1028 struct mbuf *m;
1029
1030 if (hlen > MCLBYTES)
1031 return (ENOBUFS); /* XXX */
1032
1033 MGET(m, M_DONTWAIT, MT_DATA);
1034 if (!m)
1035 return (ENOBUFS);
1036
1037 if (hlen > MLEN) {
1038 MCLGET(m, M_DONTWAIT);
1039 if ((m->m_flags & M_EXT) == 0) {
1040 m_free(m);
1041 return (ENOBUFS);
1042 }
1043 }
1044 m->m_len = hlen;
1045 if (hdr)
1046 bcopy(hdr, mtod(m, caddr_t), hlen);
1047
1048 *mp = m;
1049 return (0);
1050 }
1051
1052 /*
1053 * Insert jumbo payload option.
1054 */
1055 static int
ip6_insert_jumboopt(exthdrs,plen)1056 ip6_insert_jumboopt(exthdrs, plen)
1057 struct ip6_exthdrs *exthdrs;
1058 u_int32_t plen;
1059 {
1060 struct mbuf *mopt;
1061 u_int8_t *optbuf;
1062 u_int32_t v;
1063
1064 #define JUMBOOPTLEN 8 /* length of jumbo payload option and padding */
1065
1066 /*
1067 * If there is no hop-by-hop options header, allocate new one.
1068 * If there is one but it doesn't have enough space to store the
1069 * jumbo payload option, allocate a cluster to store the whole options.
1070 * Otherwise, use it to store the options.
1071 */
1072 if (exthdrs->ip6e_hbh == 0) {
1073 MGET(mopt, M_DONTWAIT, MT_DATA);
1074 if (mopt == 0)
1075 return (ENOBUFS);
1076 mopt->m_len = JUMBOOPTLEN;
1077 optbuf = mtod(mopt, u_int8_t *);
1078 optbuf[1] = 0; /* = ((JUMBOOPTLEN) >> 3) - 1 */
1079 exthdrs->ip6e_hbh = mopt;
1080 } else {
1081 struct ip6_hbh *hbh;
1082
1083 mopt = exthdrs->ip6e_hbh;
1084 if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
1085 /*
1086 * XXX assumption:
1087 * - exthdrs->ip6e_hbh is not referenced from places
1088 * other than exthdrs.
1089 * - exthdrs->ip6e_hbh is not an mbuf chain.
1090 */
1091 int oldoptlen = mopt->m_len;
1092 struct mbuf *n;
1093
1094 /*
1095 * XXX: give up if the whole (new) hbh header does
1096 * not fit even in an mbuf cluster.
1097 */
1098 if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
1099 return (ENOBUFS);
1100
1101 /*
1102 * As a consequence, we must always prepare a cluster
1103 * at this point.
1104 */
1105 MGET(n, M_DONTWAIT, MT_DATA);
1106 if (n) {
1107 MCLGET(n, M_DONTWAIT);
1108 if ((n->m_flags & M_EXT) == 0) {
1109 m_freem(n);
1110 n = NULL;
1111 }
1112 }
1113 if (!n)
1114 return (ENOBUFS);
1115 n->m_len = oldoptlen + JUMBOOPTLEN;
1116 bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t),
1117 oldoptlen);
1118 optbuf = mtod(n, u_int8_t *) + oldoptlen;
1119 m_freem(mopt);
1120 mopt = exthdrs->ip6e_hbh = n;
1121 } else {
1122 optbuf = mtod(mopt, u_int8_t *) + mopt->m_len;
1123 mopt->m_len += JUMBOOPTLEN;
1124 }
1125 optbuf[0] = IP6OPT_PADN;
1126 optbuf[1] = 0;
1127
1128 /*
1129 * Adjust the header length according to the pad and
1130 * the jumbo payload option.
1131 */
1132 hbh = mtod(mopt, struct ip6_hbh *);
1133 hbh->ip6h_len += (JUMBOOPTLEN >> 3);
1134 }
1135
1136 /* fill in the option. */
1137 optbuf[2] = IP6OPT_JUMBO;
1138 optbuf[3] = 4;
1139 v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
1140 bcopy(&v, &optbuf[4], sizeof(u_int32_t));
1141
1142 /* finally, adjust the packet header length */
1143 exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
1144
1145 return (0);
1146 #undef JUMBOOPTLEN
1147 }
1148
1149 /*
1150 * Insert fragment header and copy unfragmentable header portions.
1151 */
1152 static int
ip6_insertfraghdr(m0,m,hlen,frghdrp)1153 ip6_insertfraghdr(m0, m, hlen, frghdrp)
1154 struct mbuf *m0, *m;
1155 int hlen;
1156 struct ip6_frag **frghdrp;
1157 {
1158 struct mbuf *n, *mlast;
1159
1160 if (hlen > sizeof(struct ip6_hdr)) {
1161 n = m_copym(m0, sizeof(struct ip6_hdr),
1162 hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
1163 if (n == 0)
1164 return (ENOBUFS);
1165 m->m_next = n;
1166 } else
1167 n = m;
1168
1169 /* Search for the last mbuf of unfragmentable part. */
1170 for (mlast = n; mlast->m_next; mlast = mlast->m_next)
1171 ;
1172
1173 if ((mlast->m_flags & M_EXT) == 0 &&
1174 M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
1175 /* use the trailing space of the last mbuf for the fragment hdr */
1176 *frghdrp = (struct ip6_frag *)(mtod(mlast, caddr_t) +
1177 mlast->m_len);
1178 mlast->m_len += sizeof(struct ip6_frag);
1179 m->m_pkthdr.len += sizeof(struct ip6_frag);
1180 } else {
1181 /* allocate a new mbuf for the fragment header */
1182 struct mbuf *mfrg;
1183
1184 MGET(mfrg, M_DONTWAIT, MT_DATA);
1185 if (mfrg == 0)
1186 return (ENOBUFS);
1187 mfrg->m_len = sizeof(struct ip6_frag);
1188 *frghdrp = mtod(mfrg, struct ip6_frag *);
1189 mlast->m_next = mfrg;
1190 }
1191
1192 return (0);
1193 }
1194
1195 static int
ip6_getpmtu(ro_pmtu,ro,ifp,dst,mtup,alwaysfragp)1196 ip6_getpmtu(ro_pmtu, ro, ifp, dst, mtup, alwaysfragp)
1197 struct route_in6 *ro_pmtu, *ro;
1198 struct ifnet *ifp;
1199 struct in6_addr *dst;
1200 u_long *mtup;
1201 int *alwaysfragp;
1202 {
1203 u_int32_t mtu = 0;
1204 int alwaysfrag = 0;
1205 int error = 0;
1206
1207 if (ro_pmtu != ro) {
1208 /* The first hop and the final destination may differ. */
1209 struct sockaddr_in6 *sa6_dst =
1210 (struct sockaddr_in6 *)&ro_pmtu->ro_dst;
1211 if (ro_pmtu->ro_rt &&
1212 ((ro_pmtu->ro_rt->rt_flags & RTF_UP) == 0 ||
1213 !IN6_ARE_ADDR_EQUAL(&sa6_dst->sin6_addr, dst))) {
1214 RTFREE(ro_pmtu->ro_rt);
1215 ro_pmtu->ro_rt = (struct rtentry *)NULL;
1216 }
1217 if (ro_pmtu->ro_rt == 0) {
1218 bzero(sa6_dst, sizeof(*sa6_dst));
1219 sa6_dst->sin6_family = AF_INET6;
1220 sa6_dst->sin6_len = sizeof(struct sockaddr_in6);
1221 sa6_dst->sin6_addr = *dst;
1222
1223 rtalloc((struct route *)ro_pmtu);
1224 }
1225 }
1226 if (ro_pmtu->ro_rt) {
1227 u_int32_t ifmtu;
1228
1229 if (ifp == NULL)
1230 ifp = ro_pmtu->ro_rt->rt_ifp;
1231 ifmtu = IN6_LINKMTU(ifp);
1232 mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
1233 if (mtu == 0)
1234 mtu = ifmtu;
1235 else if (mtu < IPV6_MMTU) {
1236 /*
1237 * RFC2460 section 5, last paragraph:
1238 * if we record ICMPv6 too big message with
1239 * mtu < IPV6_MMTU, transmit packets sized IPV6_MMTU
1240 * or smaller, with fragment header attached.
1241 * (fragment header is needed regardless from the
1242 * packet size, for translators to identify packets)
1243 */
1244 alwaysfrag = 1;
1245 mtu = IPV6_MMTU;
1246 } else if (mtu > ifmtu) {
1247 /*
1248 * The MTU on the route is larger than the MTU on
1249 * the interface! This shouldn't happen, unless the
1250 * MTU of the interface has been changed after the
1251 * interface was brought up. Change the MTU in the
1252 * route to match the interface MTU (as long as the
1253 * field isn't locked).
1254 */
1255 mtu = ifmtu;
1256 if (!(ro_pmtu->ro_rt->rt_rmx.rmx_locks & RTV_MTU))
1257 ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu;
1258 }
1259 } else if (ifp) {
1260 mtu = IN6_LINKMTU(ifp);
1261 } else
1262 error = EHOSTUNREACH; /* XXX */
1263
1264 *mtup = mtu;
1265 if (alwaysfragp)
1266 *alwaysfragp = alwaysfrag;
1267 return (error);
1268 }
1269
1270 /*
1271 * IP6 socket option processing.
1272 */
1273 int
ip6_ctloutput(op,so,level,optname,mp)1274 ip6_ctloutput(op, so, level, optname, mp)
1275 int op;
1276 struct socket *so;
1277 int level, optname;
1278 struct mbuf **mp;
1279 {
1280 int privileged;
1281 struct inpcb *inp = sotoinpcb(so);
1282 struct mbuf *m = *mp;
1283 int error, optval;
1284 int optlen;
1285 #ifdef IPSEC
1286 struct proc *p = curproc; /* XXX */
1287 struct tdb *tdb;
1288 struct tdb_ident *tdbip, tdbi;
1289 int s;
1290 #endif
1291
1292 optlen = m ? m->m_len : 0;
1293 error = optval = 0;
1294
1295 privileged = (inp->inp_socket->so_state & SS_PRIV);
1296
1297 if (level == IPPROTO_IPV6) {
1298 switch (op) {
1299 case PRCO_SETOPT:
1300 switch (optname) {
1301 case IPV6_PKTOPTIONS:
1302 /* m is freed in ip6_pcbopts */
1303 return (ip6_pcbopts(&inp->inp_outputopts6,
1304 m, so));
1305 case IPV6_HOPOPTS:
1306 case IPV6_DSTOPTS:
1307 if (!privileged) {
1308 error = EPERM;
1309 break;
1310 }
1311 /* FALLTHROUGH */
1312 case IPV6_UNICAST_HOPS:
1313 case IPV6_RECVOPTS:
1314 case IPV6_RECVRETOPTS:
1315 case IPV6_RECVDSTADDR:
1316 case IPV6_PKTINFO:
1317 case IPV6_HOPLIMIT:
1318 case IPV6_RTHDR:
1319 case IPV6_FAITH:
1320 case IPV6_V6ONLY:
1321 case IPV6_USE_MIN_MTU:
1322 if (optlen != sizeof(int)) {
1323 error = EINVAL;
1324 break;
1325 }
1326 optval = *mtod(m, int *);
1327 switch (optname) {
1328
1329 case IPV6_UNICAST_HOPS:
1330 if (optval < -1 || optval >= 256)
1331 error = EINVAL;
1332 else {
1333 /* -1 = kernel default */
1334 inp->inp_hops = optval;
1335 }
1336 break;
1337 #define OPTSET(bit) \
1338 do { \
1339 if (optval) \
1340 inp->inp_flags |= (bit); \
1341 else \
1342 inp->inp_flags &= ~(bit); \
1343 } while (0)
1344 case IPV6_RECVOPTS:
1345 OPTSET(IN6P_RECVOPTS);
1346 break;
1347
1348 case IPV6_RECVRETOPTS:
1349 OPTSET(IN6P_RECVRETOPTS);
1350 break;
1351
1352 case IPV6_RECVDSTADDR:
1353 OPTSET(IN6P_RECVDSTADDR);
1354 break;
1355
1356 case IPV6_PKTINFO:
1357 OPTSET(IN6P_PKTINFO);
1358 break;
1359
1360 case IPV6_HOPLIMIT:
1361 OPTSET(IN6P_HOPLIMIT);
1362 break;
1363
1364 case IPV6_HOPOPTS:
1365 OPTSET(IN6P_HOPOPTS);
1366 break;
1367
1368 case IPV6_DSTOPTS:
1369 OPTSET(IN6P_DSTOPTS);
1370 break;
1371
1372 case IPV6_RTHDR:
1373 OPTSET(IN6P_RTHDR);
1374 break;
1375
1376 case IPV6_FAITH:
1377 OPTSET(IN6P_FAITH);
1378 break;
1379
1380 case IPV6_USE_MIN_MTU:
1381 OPTSET(IN6P_MINMTU);
1382 break;
1383
1384 case IPV6_V6ONLY:
1385 if (!optval)
1386 error = EINVAL;
1387 break;
1388 }
1389 break;
1390 #undef OPTSET
1391
1392 case IPV6_MULTICAST_IF:
1393 case IPV6_MULTICAST_HOPS:
1394 case IPV6_MULTICAST_LOOP:
1395 case IPV6_JOIN_GROUP:
1396 case IPV6_LEAVE_GROUP:
1397 error = ip6_setmoptions(optname,
1398 &inp->inp_moptions6, m);
1399 break;
1400
1401 case IPV6_PORTRANGE:
1402 optval = *mtod(m, int *);
1403
1404 switch (optval) {
1405 case IPV6_PORTRANGE_DEFAULT:
1406 inp->inp_flags &= ~(IN6P_LOWPORT);
1407 inp->inp_flags &= ~(IN6P_HIGHPORT);
1408 break;
1409
1410 case IPV6_PORTRANGE_HIGH:
1411 inp->inp_flags &= ~(IN6P_LOWPORT);
1412 inp->inp_flags |= IN6P_HIGHPORT;
1413 break;
1414
1415 case IPV6_PORTRANGE_LOW:
1416 inp->inp_flags &= ~(IN6P_HIGHPORT);
1417 inp->inp_flags |= IN6P_LOWPORT;
1418 break;
1419
1420 default:
1421 error = EINVAL;
1422 break;
1423 }
1424 break;
1425
1426 case IPSEC6_OUTSA:
1427 #ifndef IPSEC
1428 error = EINVAL;
1429 #else
1430 s = spltdb();
1431 if (m == 0 || m->m_len != sizeof(struct tdb_ident)) {
1432 error = EINVAL;
1433 } else {
1434 tdbip = mtod(m, struct tdb_ident *);
1435 tdb = gettdb(tdbip->spi, &tdbip->dst,
1436 tdbip->proto);
1437 if (tdb == NULL)
1438 error = ESRCH;
1439 else
1440 tdb_add_inp(tdb, inp, 0);
1441 }
1442 splx(s);
1443 #endif /* IPSEC */
1444 break;
1445
1446 case IPV6_AUTH_LEVEL:
1447 case IPV6_ESP_TRANS_LEVEL:
1448 case IPV6_ESP_NETWORK_LEVEL:
1449 case IPV6_IPCOMP_LEVEL:
1450 *mp = m = m_get(M_WAIT, MT_SOOPTS);
1451 #ifndef IPSEC
1452 error = EINVAL;
1453 #else
1454 if (m == 0 || m->m_len != sizeof(int)) {
1455 error = EINVAL;
1456 break;
1457 }
1458 optval = *mtod(m, int *);
1459
1460 if (optval < IPSEC_LEVEL_BYPASS ||
1461 optval > IPSEC_LEVEL_UNIQUE) {
1462 error = EINVAL;
1463 break;
1464 }
1465
1466 switch (optname) {
1467 case IPV6_AUTH_LEVEL:
1468 if (optval < ipsec_auth_default_level &&
1469 suser(p, 0)) {
1470 error = EACCES;
1471 break;
1472 }
1473 inp->inp_seclevel[SL_AUTH] = optval;
1474 break;
1475
1476 case IPV6_ESP_TRANS_LEVEL:
1477 if (optval < ipsec_esp_trans_default_level &&
1478 suser(p, 0)) {
1479 error = EACCES;
1480 break;
1481 }
1482 inp->inp_seclevel[SL_ESP_TRANS] = optval;
1483 break;
1484
1485 case IPV6_ESP_NETWORK_LEVEL:
1486 if (optval < ipsec_esp_network_default_level &&
1487 suser(p, 0)) {
1488 error = EACCES;
1489 break;
1490 }
1491 inp->inp_seclevel[SL_ESP_NETWORK] = optval;
1492 break;
1493
1494 case IPV6_IPCOMP_LEVEL:
1495 if (optval < ipsec_ipcomp_default_level &&
1496 suser(p, 0)) {
1497 error = EACCES;
1498 break;
1499 }
1500 inp->inp_seclevel[SL_IPCOMP] = optval;
1501 break;
1502 }
1503 if (!error)
1504 inp->inp_secrequire = get_sa_require(inp);
1505 #endif
1506 break;
1507
1508
1509 default:
1510 error = ENOPROTOOPT;
1511 break;
1512 }
1513 if (m)
1514 (void)m_free(m);
1515 break;
1516
1517 case PRCO_GETOPT:
1518 switch (optname) {
1519
1520 case IPV6_OPTIONS:
1521 case IPV6_RETOPTS:
1522 error = ENOPROTOOPT;
1523 break;
1524
1525 case IPV6_PKTOPTIONS:
1526 if (inp->inp_options) {
1527 *mp = m_copym(inp->inp_options, 0,
1528 M_COPYALL, M_WAIT);
1529 } else {
1530 *mp = m_get(M_WAIT, MT_SOOPTS);
1531 (*mp)->m_len = 0;
1532 }
1533 break;
1534
1535 case IPV6_HOPOPTS:
1536 case IPV6_DSTOPTS:
1537 if (!privileged) {
1538 error = EPERM;
1539 break;
1540 }
1541 /* FALLTHROUGH */
1542 case IPV6_UNICAST_HOPS:
1543 case IPV6_RECVOPTS:
1544 case IPV6_RECVRETOPTS:
1545 case IPV6_RECVDSTADDR:
1546 case IPV6_PKTINFO:
1547 case IPV6_HOPLIMIT:
1548 case IPV6_RTHDR:
1549 case IPV6_FAITH:
1550 case IPV6_V6ONLY:
1551 case IPV6_PORTRANGE:
1552 case IPV6_USE_MIN_MTU:
1553 switch (optname) {
1554
1555 case IPV6_UNICAST_HOPS:
1556 optval = inp->inp_hops;
1557 break;
1558
1559 #define OPTBIT(bit) (inp->inp_flags & bit ? 1 : 0)
1560
1561 case IPV6_RECVOPTS:
1562 optval = OPTBIT(IN6P_RECVOPTS);
1563 break;
1564
1565 case IPV6_RECVRETOPTS:
1566 optval = OPTBIT(IN6P_RECVRETOPTS);
1567 break;
1568
1569 case IPV6_RECVDSTADDR:
1570 optval = OPTBIT(IN6P_RECVDSTADDR);
1571 break;
1572
1573 case IPV6_PKTINFO:
1574 optval = OPTBIT(IN6P_PKTINFO);
1575 break;
1576
1577 case IPV6_HOPLIMIT:
1578 optval = OPTBIT(IN6P_HOPLIMIT);
1579 break;
1580
1581 case IPV6_HOPOPTS:
1582 optval = OPTBIT(IN6P_HOPOPTS);
1583 break;
1584
1585 case IPV6_DSTOPTS:
1586 optval = OPTBIT(IN6P_DSTOPTS);
1587 break;
1588
1589 case IPV6_RTHDR:
1590 optval = OPTBIT(IN6P_RTHDR);
1591 break;
1592
1593 case IPV6_FAITH:
1594 optval = OPTBIT(IN6P_FAITH);
1595 break;
1596
1597 case IPV6_V6ONLY:
1598 optval = (ip6_v6only != 0); /* XXX */
1599 break;
1600
1601 case IPV6_PORTRANGE:
1602 {
1603 int flags;
1604
1605 flags = inp->inp_flags;
1606 if (flags & IN6P_HIGHPORT)
1607 optval = IPV6_PORTRANGE_HIGH;
1608 else if (flags & IN6P_LOWPORT)
1609 optval = IPV6_PORTRANGE_LOW;
1610 else
1611 optval = 0;
1612 break;
1613 }
1614
1615 case IPV6_USE_MIN_MTU:
1616 optval = OPTBIT(IN6P_MINMTU);
1617 break;
1618 }
1619 *mp = m = m_get(M_WAIT, MT_SOOPTS);
1620 m->m_len = sizeof(int);
1621 *mtod(m, int *) = optval;
1622 break;
1623
1624 case IPV6_MULTICAST_IF:
1625 case IPV6_MULTICAST_HOPS:
1626 case IPV6_MULTICAST_LOOP:
1627 case IPV6_JOIN_GROUP:
1628 case IPV6_LEAVE_GROUP:
1629 error = ip6_getmoptions(optname, inp->inp_moptions6, mp);
1630 break;
1631
1632 case IPSEC6_OUTSA:
1633 #ifndef IPSEC
1634 error = EINVAL;
1635 #else
1636 s = spltdb();
1637 if (inp->inp_tdb_out == NULL) {
1638 error = ENOENT;
1639 } else {
1640 tdbi.spi = inp->inp_tdb_out->tdb_spi;
1641 tdbi.dst = inp->inp_tdb_out->tdb_dst;
1642 tdbi.proto = inp->inp_tdb_out->tdb_sproto;
1643 *mp = m = m_get(M_WAIT, MT_SOOPTS);
1644 m->m_len = sizeof(tdbi);
1645 bcopy((caddr_t)&tdbi, mtod(m, caddr_t),
1646 (unsigned)m->m_len);
1647 }
1648 splx(s);
1649 #endif /* IPSEC */
1650 break;
1651
1652 case IPV6_AUTH_LEVEL:
1653 case IPV6_ESP_TRANS_LEVEL:
1654 case IPV6_ESP_NETWORK_LEVEL:
1655 case IPV6_IPCOMP_LEVEL:
1656 #ifndef IPSEC
1657 m->m_len = sizeof(int);
1658 *mtod(m, int *) = IPSEC_LEVEL_NONE;
1659 #else
1660 m->m_len = sizeof(int);
1661 switch (optname) {
1662 case IPV6_AUTH_LEVEL:
1663 optval = inp->inp_seclevel[SL_AUTH];
1664 break;
1665
1666 case IPV6_ESP_TRANS_LEVEL:
1667 optval =
1668 inp->inp_seclevel[SL_ESP_TRANS];
1669 break;
1670
1671 case IPV6_ESP_NETWORK_LEVEL:
1672 optval =
1673 inp->inp_seclevel[SL_ESP_NETWORK];
1674 break;
1675
1676 case IPV6_IPCOMP_LEVEL:
1677 optval = inp->inp_seclevel[SL_IPCOMP];
1678 break;
1679 }
1680 *mtod(m, int *) = optval;
1681 #endif
1682 break;
1683
1684 default:
1685 error = ENOPROTOOPT;
1686 break;
1687 }
1688 break;
1689 }
1690 } else {
1691 error = EINVAL;
1692 if (op == PRCO_SETOPT && *mp)
1693 (void)m_free(*mp);
1694 }
1695 return (error);
1696 }
1697
1698 int
ip6_raw_ctloutput(op,so,level,optname,mp)1699 ip6_raw_ctloutput(op, so, level, optname, mp)
1700 int op;
1701 struct socket *so;
1702 int level, optname;
1703 struct mbuf **mp;
1704 {
1705 int error = 0, optval, optlen;
1706 const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
1707 struct inpcb *inp = sotoinpcb(so);
1708 struct mbuf *m = *mp;
1709
1710 optlen = m ? m->m_len : 0;
1711
1712 if (level != IPPROTO_IPV6) {
1713 if (op == PRCO_SETOPT && *mp)
1714 (void)m_free(*mp);
1715 return (EINVAL);
1716 }
1717
1718 switch (optname) {
1719 case IPV6_CHECKSUM:
1720 /*
1721 * For ICMPv6 sockets, no modification allowed for checksum
1722 * offset, permit "no change" values to help existing apps.
1723 *
1724 * XXX 2292bis says: "An attempt to set IPV6_CHECKSUM
1725 * for an ICMPv6 socket will fail."
1726 * The current behavior does not meet 2292bis.
1727 */
1728 switch (op) {
1729 case PRCO_SETOPT:
1730 if (optlen != sizeof(int)) {
1731 error = EINVAL;
1732 break;
1733 }
1734 optval = *mtod(m, int *);
1735 if ((optval % 2) != 0) {
1736 /* the API assumes even offset values */
1737 error = EINVAL;
1738 } else if (so->so_proto->pr_protocol ==
1739 IPPROTO_ICMPV6) {
1740 if (optval != icmp6off)
1741 error = EINVAL;
1742 } else
1743 inp->in6p_cksum = optval;
1744 break;
1745
1746 case PRCO_GETOPT:
1747 if (so->so_proto->pr_protocol == IPPROTO_ICMPV6)
1748 optval = icmp6off;
1749 else
1750 optval = inp->in6p_cksum;
1751
1752 *mp = m = m_get(M_WAIT, MT_SOOPTS);
1753 m->m_len = sizeof(int);
1754 *mtod(m, int *) = optval;
1755 break;
1756
1757 default:
1758 error = EINVAL;
1759 break;
1760 }
1761 break;
1762
1763 default:
1764 error = ENOPROTOOPT;
1765 break;
1766 }
1767
1768 if (op == PRCO_SETOPT && m)
1769 (void)m_free(m);
1770
1771 return (error);
1772 }
1773
1774 /*
1775 * Set up IP6 options in pcb for insertion in output packets.
1776 * Store in mbuf with pointer in pcbopt, adding pseudo-option
1777 * with destination address if source routed.
1778 */
1779 static int
ip6_pcbopts(pktopt,m,so)1780 ip6_pcbopts(pktopt, m, so)
1781 struct ip6_pktopts **pktopt;
1782 struct mbuf *m;
1783 struct socket *so;
1784 {
1785 struct ip6_pktopts *opt = *pktopt;
1786 int error = 0;
1787 struct proc *p = curproc; /* XXX */
1788 int priv = 0;
1789
1790 /* turn off any old options. */
1791 if (opt) {
1792 if (opt->ip6po_m)
1793 (void)m_free(opt->ip6po_m);
1794 } else
1795 opt = malloc(sizeof(*opt), M_IP6OPT, M_WAITOK);
1796 *pktopt = 0;
1797
1798 if (!m || m->m_len == 0) {
1799 /*
1800 * Only turning off any previous options.
1801 */
1802 free(opt, M_IP6OPT);
1803 if (m)
1804 (void)m_free(m);
1805 return (0);
1806 }
1807
1808 /* set options specified by user. */
1809 if (p && !suser(p, 0))
1810 priv = 1;
1811 if ((error = ip6_setpktoptions(m, opt, priv)) != 0) {
1812 (void)m_free(m);
1813 free(opt, M_IP6OPT);
1814 return (error);
1815 }
1816 *pktopt = opt;
1817 return (0);
1818 }
1819
1820 /*
1821 * Set the IP6 multicast options in response to user setsockopt().
1822 */
1823 static int
ip6_setmoptions(optname,im6op,m)1824 ip6_setmoptions(optname, im6op, m)
1825 int optname;
1826 struct ip6_moptions **im6op;
1827 struct mbuf *m;
1828 {
1829 int error = 0;
1830 u_int loop, ifindex;
1831 struct ipv6_mreq *mreq;
1832 struct ifnet *ifp;
1833 struct ip6_moptions *im6o = *im6op;
1834 struct route_in6 ro;
1835 struct sockaddr_in6 *dst;
1836 struct in6_multi_mship *imm;
1837 struct proc *p = curproc; /* XXX */
1838
1839 if (im6o == NULL) {
1840 /*
1841 * No multicast option buffer attached to the pcb;
1842 * allocate one and initialize to default values.
1843 */
1844 im6o = (struct ip6_moptions *)
1845 malloc(sizeof(*im6o), M_IPMOPTS, M_WAITOK);
1846
1847 if (im6o == NULL)
1848 return (ENOBUFS);
1849 *im6op = im6o;
1850 im6o->im6o_multicast_ifp = NULL;
1851 im6o->im6o_multicast_hlim = ip6_defmcasthlim;
1852 im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
1853 LIST_INIT(&im6o->im6o_memberships);
1854 }
1855
1856 switch (optname) {
1857
1858 case IPV6_MULTICAST_IF:
1859 /*
1860 * Select the interface for outgoing multicast packets.
1861 */
1862 if (m == NULL || m->m_len != sizeof(u_int)) {
1863 error = EINVAL;
1864 break;
1865 }
1866 bcopy(mtod(m, u_int *), &ifindex, sizeof(ifindex));
1867 if (ifindex == 0)
1868 ifp = NULL;
1869 else {
1870 if (ifindex < 0 || if_indexlim <= ifindex ||
1871 !ifindex2ifnet[ifindex]) {
1872 error = ENXIO; /* XXX EINVAL? */
1873 break;
1874 }
1875 ifp = ifindex2ifnet[ifindex];
1876 if (ifp == NULL ||
1877 (ifp->if_flags & IFF_MULTICAST) == 0) {
1878 error = EADDRNOTAVAIL;
1879 break;
1880 }
1881 }
1882 im6o->im6o_multicast_ifp = ifp;
1883 break;
1884
1885 case IPV6_MULTICAST_HOPS:
1886 {
1887 /*
1888 * Set the IP6 hoplimit for outgoing multicast packets.
1889 */
1890 int optval;
1891 if (m == NULL || m->m_len != sizeof(int)) {
1892 error = EINVAL;
1893 break;
1894 }
1895 bcopy(mtod(m, u_int *), &optval, sizeof(optval));
1896 if (optval < -1 || optval >= 256)
1897 error = EINVAL;
1898 else if (optval == -1)
1899 im6o->im6o_multicast_hlim = ip6_defmcasthlim;
1900 else
1901 im6o->im6o_multicast_hlim = optval;
1902 break;
1903 }
1904
1905 case IPV6_MULTICAST_LOOP:
1906 /*
1907 * Set the loopback flag for outgoing multicast packets.
1908 * Must be zero or one.
1909 */
1910 if (m == NULL || m->m_len != sizeof(u_int)) {
1911 error = EINVAL;
1912 break;
1913 }
1914 bcopy(mtod(m, u_int *), &loop, sizeof(loop));
1915 if (loop > 1) {
1916 error = EINVAL;
1917 break;
1918 }
1919 im6o->im6o_multicast_loop = loop;
1920 break;
1921
1922 case IPV6_JOIN_GROUP:
1923 /*
1924 * Add a multicast group membership.
1925 * Group must be a valid IP6 multicast address.
1926 */
1927 if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
1928 error = EINVAL;
1929 break;
1930 }
1931 mreq = mtod(m, struct ipv6_mreq *);
1932 if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
1933 /*
1934 * We use the unspecified address to specify to accept
1935 * all multicast addresses. Only super user is allowed
1936 * to do this.
1937 */
1938 if (suser(p, 0))
1939 {
1940 error = EACCES;
1941 break;
1942 }
1943 } else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
1944 error = EINVAL;
1945 break;
1946 }
1947
1948 /*
1949 * If no interface was explicitly specified, choose an
1950 * appropriate one according to the given multicast address.
1951 */
1952 if (mreq->ipv6mr_interface == 0) {
1953 /*
1954 * If the multicast address is in node-local scope,
1955 * the interface should be a loopback interface.
1956 * Otherwise, look up the routing table for the
1957 * address, and choose the outgoing interface.
1958 * XXX: is it a good approach?
1959 */
1960 if (IN6_IS_ADDR_MC_NODELOCAL(&mreq->ipv6mr_multiaddr)) {
1961 ifp = lo0ifp;
1962 } else {
1963 ro.ro_rt = NULL;
1964 dst = (struct sockaddr_in6 *)&ro.ro_dst;
1965 bzero(dst, sizeof(*dst));
1966 dst->sin6_len = sizeof(struct sockaddr_in6);
1967 dst->sin6_family = AF_INET6;
1968 dst->sin6_addr = mreq->ipv6mr_multiaddr;
1969 rtalloc((struct route *)&ro);
1970 if (ro.ro_rt == NULL) {
1971 error = EADDRNOTAVAIL;
1972 break;
1973 }
1974 ifp = ro.ro_rt->rt_ifp;
1975 rtfree(ro.ro_rt);
1976 }
1977 } else {
1978 /*
1979 * If the interface is specified, validate it.
1980 */
1981 if (mreq->ipv6mr_interface < 0 ||
1982 if_indexlim <= mreq->ipv6mr_interface ||
1983 !ifindex2ifnet[mreq->ipv6mr_interface]) {
1984 error = ENXIO; /* XXX EINVAL? */
1985 break;
1986 }
1987 ifp = ifindex2ifnet[mreq->ipv6mr_interface];
1988 }
1989
1990 /*
1991 * See if we found an interface, and confirm that it
1992 * supports multicast
1993 */
1994 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
1995 error = EADDRNOTAVAIL;
1996 break;
1997 }
1998 /*
1999 * Put interface index into the multicast address,
2000 * if the address has link-local scope.
2001 */
2002 if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
2003 mreq->ipv6mr_multiaddr.s6_addr16[1] =
2004 htons(ifp->if_index);
2005 }
2006 /*
2007 * See if the membership already exists.
2008 */
2009 for (imm = im6o->im6o_memberships.lh_first;
2010 imm != NULL; imm = imm->i6mm_chain.le_next)
2011 if (imm->i6mm_maddr->in6m_ifp == ifp &&
2012 IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2013 &mreq->ipv6mr_multiaddr))
2014 break;
2015 if (imm != NULL) {
2016 error = EADDRINUSE;
2017 break;
2018 }
2019 /*
2020 * Everything looks good; add a new record to the multicast
2021 * address list for the given interface.
2022 */
2023 imm = in6_joingroup(ifp, &mreq->ipv6mr_multiaddr, &error);
2024 if (!imm)
2025 break;
2026 LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
2027 break;
2028
2029 case IPV6_LEAVE_GROUP:
2030 /*
2031 * Drop a multicast group membership.
2032 * Group must be a valid IP6 multicast address.
2033 */
2034 if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
2035 error = EINVAL;
2036 break;
2037 }
2038 mreq = mtod(m, struct ipv6_mreq *);
2039 if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
2040 if (suser(p, 0))
2041 {
2042 error = EACCES;
2043 break;
2044 }
2045 } else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
2046 error = EINVAL;
2047 break;
2048 }
2049 /*
2050 * If an interface address was specified, get a pointer
2051 * to its ifnet structure.
2052 */
2053 if (mreq->ipv6mr_interface == 0)
2054 ifp = NULL;
2055 else {
2056 if (mreq->ipv6mr_interface < 0 ||
2057 if_indexlim <= mreq->ipv6mr_interface ||
2058 !ifindex2ifnet[mreq->ipv6mr_interface]) {
2059 error = ENXIO; /* XXX EINVAL? */
2060 break;
2061 }
2062 ifp = ifindex2ifnet[mreq->ipv6mr_interface];
2063 }
2064
2065 /*
2066 * Put interface index into the multicast address,
2067 * if the address has link-local scope.
2068 */
2069 if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
2070 mreq->ipv6mr_multiaddr.s6_addr16[1] =
2071 htons(mreq->ipv6mr_interface);
2072 }
2073 /*
2074 * Find the membership in the membership list.
2075 */
2076 for (imm = im6o->im6o_memberships.lh_first;
2077 imm != NULL; imm = imm->i6mm_chain.le_next) {
2078 if ((ifp == NULL || imm->i6mm_maddr->in6m_ifp == ifp) &&
2079 IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2080 &mreq->ipv6mr_multiaddr))
2081 break;
2082 }
2083 if (imm == NULL) {
2084 /* Unable to resolve interface */
2085 error = EADDRNOTAVAIL;
2086 break;
2087 }
2088 /*
2089 * Give up the multicast address record to which the
2090 * membership points.
2091 */
2092 LIST_REMOVE(imm, i6mm_chain);
2093 in6_leavegroup(imm);
2094 break;
2095
2096 default:
2097 error = EOPNOTSUPP;
2098 break;
2099 }
2100
2101 /*
2102 * If all options have default values, no need to keep the mbuf.
2103 */
2104 if (im6o->im6o_multicast_ifp == NULL &&
2105 im6o->im6o_multicast_hlim == ip6_defmcasthlim &&
2106 im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
2107 im6o->im6o_memberships.lh_first == NULL) {
2108 free(*im6op, M_IPMOPTS);
2109 *im6op = NULL;
2110 }
2111
2112 return (error);
2113 }
2114
2115 /*
2116 * Return the IP6 multicast options in response to user getsockopt().
2117 */
2118 static int
ip6_getmoptions(optname,im6o,mp)2119 ip6_getmoptions(optname, im6o, mp)
2120 int optname;
2121 struct ip6_moptions *im6o;
2122 struct mbuf **mp;
2123 {
2124 u_int *hlim, *loop, *ifindex;
2125
2126 *mp = m_get(M_WAIT, MT_SOOPTS);
2127
2128 switch (optname) {
2129
2130 case IPV6_MULTICAST_IF:
2131 ifindex = mtod(*mp, u_int *);
2132 (*mp)->m_len = sizeof(u_int);
2133 if (im6o == NULL || im6o->im6o_multicast_ifp == NULL)
2134 *ifindex = 0;
2135 else
2136 *ifindex = im6o->im6o_multicast_ifp->if_index;
2137 return (0);
2138
2139 case IPV6_MULTICAST_HOPS:
2140 hlim = mtod(*mp, u_int *);
2141 (*mp)->m_len = sizeof(u_int);
2142 if (im6o == NULL)
2143 *hlim = ip6_defmcasthlim;
2144 else
2145 *hlim = im6o->im6o_multicast_hlim;
2146 return (0);
2147
2148 case IPV6_MULTICAST_LOOP:
2149 loop = mtod(*mp, u_int *);
2150 (*mp)->m_len = sizeof(u_int);
2151 if (im6o == NULL)
2152 *loop = ip6_defmcasthlim;
2153 else
2154 *loop = im6o->im6o_multicast_loop;
2155 return (0);
2156
2157 default:
2158 return (EOPNOTSUPP);
2159 }
2160 }
2161
2162 /*
2163 * Discard the IP6 multicast options.
2164 */
2165 void
ip6_freemoptions(im6o)2166 ip6_freemoptions(im6o)
2167 struct ip6_moptions *im6o;
2168 {
2169 struct in6_multi_mship *imm;
2170
2171 if (im6o == NULL)
2172 return;
2173
2174 while ((imm = im6o->im6o_memberships.lh_first) != NULL) {
2175 LIST_REMOVE(imm, i6mm_chain);
2176 in6_leavegroup(imm);
2177 }
2178 free(im6o, M_IPMOPTS);
2179 }
2180
2181 /*
2182 * Set IPv6 outgoing packet options based on advanced API.
2183 */
2184 int
ip6_setpktoptions(control,opt,priv)2185 ip6_setpktoptions(control, opt, priv)
2186 struct mbuf *control;
2187 struct ip6_pktopts *opt;
2188 int priv;
2189 {
2190 struct cmsghdr *cm = 0;
2191
2192 if (control == 0 || opt == 0)
2193 return (EINVAL);
2194
2195 bzero(opt, sizeof(*opt));
2196 opt->ip6po_hlim = -1; /* -1 means to use default hop limit */
2197
2198 /*
2199 * XXX: Currently, we assume all the optional information is stored
2200 * in a single mbuf.
2201 */
2202 if (control->m_next)
2203 return (EINVAL);
2204
2205 opt->ip6po_m = control;
2206
2207 for (; control->m_len; control->m_data += CMSG_ALIGN(cm->cmsg_len),
2208 control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
2209 cm = mtod(control, struct cmsghdr *);
2210 if (cm->cmsg_len == 0 || cm->cmsg_len > control->m_len)
2211 return (EINVAL);
2212 if (cm->cmsg_level != IPPROTO_IPV6)
2213 continue;
2214
2215 switch (cm->cmsg_type) {
2216 case IPV6_PKTINFO:
2217 if (cm->cmsg_len != CMSG_LEN(sizeof(struct in6_pktinfo)))
2218 return (EINVAL);
2219 opt->ip6po_pktinfo = (struct in6_pktinfo *)CMSG_DATA(cm);
2220 if (opt->ip6po_pktinfo->ipi6_ifindex &&
2221 IN6_IS_ADDR_LINKLOCAL(&opt->ip6po_pktinfo->ipi6_addr))
2222 opt->ip6po_pktinfo->ipi6_addr.s6_addr16[1] =
2223 htons(opt->ip6po_pktinfo->ipi6_ifindex);
2224
2225 if (opt->ip6po_pktinfo->ipi6_ifindex >= if_indexlim ||
2226 opt->ip6po_pktinfo->ipi6_ifindex < 0) {
2227 return (ENXIO);
2228 }
2229 if (opt->ip6po_pktinfo->ipi6_ifindex > 0 &&
2230 !ifindex2ifnet[opt->ip6po_pktinfo->ipi6_ifindex]) {
2231 return (ENXIO);
2232 }
2233
2234 /*
2235 * Check if the requested source address is indeed a
2236 * unicast address assigned to the node, and can be
2237 * used as the packet's source address.
2238 */
2239 if (!IN6_IS_ADDR_UNSPECIFIED(&opt->ip6po_pktinfo->ipi6_addr)) {
2240 struct ifaddr *ia;
2241 struct in6_ifaddr *ia6;
2242 struct sockaddr_in6 sin6;
2243
2244 bzero(&sin6, sizeof(sin6));
2245 sin6.sin6_len = sizeof(sin6);
2246 sin6.sin6_family = AF_INET6;
2247 sin6.sin6_addr =
2248 opt->ip6po_pktinfo->ipi6_addr;
2249 ia = ifa_ifwithaddr(sin6tosa(&sin6));
2250 if (ia == NULL ||
2251 (opt->ip6po_pktinfo->ipi6_ifindex &&
2252 (ia->ifa_ifp->if_index !=
2253 opt->ip6po_pktinfo->ipi6_ifindex))) {
2254 return (EADDRNOTAVAIL);
2255 }
2256 ia6 = (struct in6_ifaddr *)ia;
2257 if ((ia6->ia6_flags & (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY)) != 0) {
2258 return (EADDRNOTAVAIL);
2259 }
2260
2261 /*
2262 * Check if the requested source address is
2263 * indeed a unicast address assigned to the
2264 * node.
2265 */
2266 if (IN6_IS_ADDR_MULTICAST(&opt->ip6po_pktinfo->ipi6_addr))
2267 return (EADDRNOTAVAIL);
2268 }
2269 break;
2270
2271 case IPV6_HOPLIMIT:
2272 if (cm->cmsg_len != CMSG_LEN(sizeof(int)))
2273 return (EINVAL);
2274
2275 bcopy(CMSG_DATA(cm), &opt->ip6po_hlim,
2276 sizeof(opt->ip6po_hlim));
2277 if (opt->ip6po_hlim < -1 || opt->ip6po_hlim > 255)
2278 return (EINVAL);
2279 break;
2280
2281 case IPV6_NEXTHOP:
2282 if (!priv)
2283 return (EPERM);
2284
2285 /* check if cmsg_len is large enough for sa_len */
2286 if (cm->cmsg_len < sizeof(u_char) ||
2287 cm->cmsg_len < CMSG_LEN(*CMSG_DATA(cm)))
2288 return (EINVAL);
2289
2290 opt->ip6po_nexthop = (struct sockaddr *)CMSG_DATA(cm);
2291
2292 break;
2293
2294 case IPV6_HOPOPTS:
2295 if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_hbh)))
2296 return (EINVAL);
2297 opt->ip6po_hbh = (struct ip6_hbh *)CMSG_DATA(cm);
2298 if (cm->cmsg_len !=
2299 CMSG_LEN((opt->ip6po_hbh->ip6h_len + 1) << 3))
2300 return (EINVAL);
2301 break;
2302
2303 case IPV6_DSTOPTS:
2304 if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_dest)))
2305 return (EINVAL);
2306
2307 /*
2308 * If there is no routing header yet, the destination
2309 * options header should be put on the 1st part.
2310 * Otherwise, the header should be on the 2nd part.
2311 * (See RFC 2460, section 4.1)
2312 */
2313 if (opt->ip6po_rthdr == NULL) {
2314 opt->ip6po_dest1 =
2315 (struct ip6_dest *)CMSG_DATA(cm);
2316 if (cm->cmsg_len !=
2317 CMSG_LEN((opt->ip6po_dest1->ip6d_len + 1) << 3));
2318 return (EINVAL);
2319 }
2320 else {
2321 opt->ip6po_dest2 =
2322 (struct ip6_dest *)CMSG_DATA(cm);
2323 if (cm->cmsg_len !=
2324 CMSG_LEN((opt->ip6po_dest2->ip6d_len + 1) << 3))
2325 return (EINVAL);
2326 }
2327 break;
2328
2329 case IPV6_RTHDR:
2330 if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_rthdr)))
2331 return (EINVAL);
2332 opt->ip6po_rthdr = (struct ip6_rthdr *)CMSG_DATA(cm);
2333 if (cm->cmsg_len !=
2334 CMSG_LEN((opt->ip6po_rthdr->ip6r_len + 1) << 3))
2335 return (EINVAL);
2336 switch (opt->ip6po_rthdr->ip6r_type) {
2337 case IPV6_RTHDR_TYPE_0:
2338 if (opt->ip6po_rthdr->ip6r_segleft == 0)
2339 return (EINVAL);
2340 break;
2341 default:
2342 return (EINVAL);
2343 }
2344 break;
2345
2346 default:
2347 return (ENOPROTOOPT);
2348 }
2349 }
2350
2351 return (0);
2352 }
2353
2354 /*
2355 * Routine called from ip6_output() to loop back a copy of an IP6 multicast
2356 * packet to the input queue of a specified interface. Note that this
2357 * calls the output routine of the loopback "driver", but with an interface
2358 * pointer that might NOT be lo0ifp -- easier than replicating that code here.
2359 */
2360 void
ip6_mloopback(ifp,m,dst)2361 ip6_mloopback(ifp, m, dst)
2362 struct ifnet *ifp;
2363 struct mbuf *m;
2364 struct sockaddr_in6 *dst;
2365 {
2366 struct mbuf *copym;
2367 struct ip6_hdr *ip6;
2368
2369 copym = m_copy(m, 0, M_COPYALL);
2370 if (copym == NULL)
2371 return;
2372
2373 /*
2374 * Make sure to deep-copy IPv6 header portion in case the data
2375 * is in an mbuf cluster, so that we can safely override the IPv6
2376 * header portion later.
2377 */
2378 if ((copym->m_flags & M_EXT) != 0 ||
2379 copym->m_len < sizeof(struct ip6_hdr)) {
2380 copym = m_pullup(copym, sizeof(struct ip6_hdr));
2381 if (copym == NULL)
2382 return;
2383 }
2384
2385 #ifdef DIAGNOSTIC
2386 if (copym->m_len < sizeof(*ip6)) {
2387 m_freem(copym);
2388 return;
2389 }
2390 #endif
2391
2392 ip6 = mtod(copym, struct ip6_hdr *);
2393 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
2394 ip6->ip6_src.s6_addr16[1] = 0;
2395 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
2396 ip6->ip6_dst.s6_addr16[1] = 0;
2397
2398 (void)looutput(ifp, copym, (struct sockaddr *)dst, NULL);
2399 }
2400
2401 /*
2402 * Chop IPv6 header off from the payload.
2403 */
2404 static int
ip6_splithdr(m,exthdrs)2405 ip6_splithdr(m, exthdrs)
2406 struct mbuf *m;
2407 struct ip6_exthdrs *exthdrs;
2408 {
2409 struct mbuf *mh;
2410 struct ip6_hdr *ip6;
2411
2412 ip6 = mtod(m, struct ip6_hdr *);
2413 if (m->m_len > sizeof(*ip6)) {
2414 MGETHDR(mh, M_DONTWAIT, MT_HEADER);
2415 if (mh == 0) {
2416 m_freem(m);
2417 return ENOBUFS;
2418 }
2419 M_MOVE_PKTHDR(mh, m);
2420 MH_ALIGN(mh, sizeof(*ip6));
2421 m->m_len -= sizeof(*ip6);
2422 m->m_data += sizeof(*ip6);
2423 mh->m_next = m;
2424 m = mh;
2425 m->m_len = sizeof(*ip6);
2426 bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof(*ip6));
2427 }
2428 exthdrs->ip6e_ip6 = m;
2429 return 0;
2430 }
2431
2432 /*
2433 * Compute IPv6 extension header length.
2434 */
2435 int
ip6_optlen(inp)2436 ip6_optlen(inp)
2437 struct inpcb *inp;
2438 {
2439 int len;
2440
2441 if (!inp->inp_outputopts6)
2442 return 0;
2443
2444 len = 0;
2445 #define elen(x) \
2446 (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
2447
2448 len += elen(inp->inp_outputopts6->ip6po_hbh);
2449 len += elen(inp->inp_outputopts6->ip6po_dest1);
2450 len += elen(inp->inp_outputopts6->ip6po_rthdr);
2451 len += elen(inp->inp_outputopts6->ip6po_dest2);
2452 return len;
2453 #undef elen
2454 }
2455