xref: /freebsd/sys/netinet6/icmp6.c (revision 23f282aa31e9b6fceacd449020e936e98d6f2298)
1 /*
2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the project nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 /*
33  * Copyright (c) 1982, 1986, 1988, 1993
34  *	The Regents of the University of California.  All rights reserved.
35  *
36  * Redistribution and use in source and binary forms, with or without
37  * modification, are permitted provided that the following conditions
38  * are met:
39  * 1. Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  * 2. Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in the
43  *    documentation and/or other materials provided with the distribution.
44  * 3. All advertising materials mentioning features or use of this software
45  *    must display the following acknowledgement:
46  *	This product includes software developed by the University of
47  *	California, Berkeley and its contributors.
48  * 4. Neither the name of the University nor the names of its contributors
49  *    may be used to endorse or promote products derived from this software
50  *    without specific prior written permission.
51  *
52  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
53  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
54  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
55  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
56  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
57  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
58  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
59  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
60  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
61  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
62  * SUCH DAMAGE.
63  *
64  *	@(#)ip_icmp.c	8.2 (Berkeley) 1/4/94
65  */
66 
67 #include "opt_ipsec.h"
68 
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/mbuf.h>
72 #include <sys/protosw.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <sys/time.h>
76 #include <sys/kernel.h>
77 #include <sys/syslog.h>
78 #include <sys/domain.h>
79 
80 #include <net/if.h>
81 #include <net/route.h>
82 #include <net/if_dl.h>
83 #include <net/if_types.h>
84 
85 #include <netinet/in.h>
86 #include <netinet/in_var.h>
87 #include <netinet6/ip6.h>
88 #include <netinet6/ip6_var.h>
89 #include <netinet6/icmp6.h>
90 #include <netinet6/mld6_var.h>
91 #include <netinet/in_pcb.h>
92 #include <netinet6/nd6.h>
93 #include <netinet6/in6_ifattach.h>
94 #include <netinet6/ip6protosw.h>
95 
96 #ifdef IPSEC
97 #include <netinet6/ipsec.h>
98 #include <netinet6/ah.h>
99 #include <netinet6/ipsec6.h>
100 #include <netinet6/ah6.h>
101 #include <netkey/key.h>
102 #ifdef IPSEC_DEBUG
103 #include <netkey/key_debug.h>
104 #else
105 #define KEYDEBUG(lev,arg)
106 #endif
107 #endif /* IPSEC */
108 
109 #include "faith.h"
110 
111 #include <net/net_osdep.h>
112 
113 extern struct	domain inet6domain;
114 extern struct	ip6protosw inet6sw[];
115 extern u_char	ip6_protox[];
116 
117 struct	icmp6stat icmp6stat;
118 
119 extern struct	inpcbhead ripcb;
120 extern u_int	icmp6errratelim;
121 
122 static int	icmp6_rip6_input __P((struct mbuf **, int));
123 static int	icmp6_ratelimit __P((const struct in6_addr *, const int, const int));
124 static const char	*icmp6_redirect_diag __P((struct in6_addr *,
125 						  struct in6_addr *,
126 						  struct in6_addr *));
127 static struct	mbuf *ni6_input __P((struct mbuf *, int));
128 static int	ni6_addrs __P((struct icmp6_nodeinfo *, struct mbuf *,
129 			       struct ifnet **));
130 static int	ni6_store_addrs __P((struct icmp6_nodeinfo *,
131 				     struct icmp6_nodeinfo *,
132 				     struct ifnet *, int));
133 
134 #ifdef COMPAT_RFC1885
135 static struct	route_in6 icmp6_reflect_rt;
136 #endif
137 static struct	timeval icmp6_nextsend = {0, 0};
138 
139 void
140 icmp6_init()
141 {
142 	mld6_init();
143 }
144 
145 /*
146  * Generate an error packet of type error in response to bad IP6 packet.
147  */
148 void
149 icmp6_error(m, type, code, param)
150 	struct mbuf *m;
151 	int type, code, param;
152 {
153 	struct ip6_hdr *oip6, *nip6;
154 	struct icmp6_hdr *icmp6;
155 	u_int prep;
156 	int off;
157 	u_char nxt;
158 
159 	icmp6stat.icp6s_error++;
160 
161 	if (m->m_flags & M_DECRYPTED)
162 		goto freeit;
163 
164 	oip6 = mtod(m, struct ip6_hdr *);
165 
166 	/*
167 	 * Multicast destination check. For unrecognized option errors,
168 	 * this check has already done in ip6_unknown_opt(), so we can
169 	 * check only for other errors.
170 	 */
171 	if ((m->m_flags & (M_BCAST|M_MCAST) ||
172 	     IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) &&
173 	    (type != ICMP6_PACKET_TOO_BIG &&
174 	     (type != ICMP6_PARAM_PROB ||
175 	      code != ICMP6_PARAMPROB_OPTION)))
176 		goto freeit;
177 
178 	/* Source address check. XXX: the case of anycast source? */
179 	if (IN6_IS_ADDR_UNSPECIFIED(&oip6->ip6_src) ||
180 	    IN6_IS_ADDR_MULTICAST(&oip6->ip6_src))
181 		goto freeit;
182 
183 	/*
184 	 * If the erroneous packet is also an ICMP error, discard it.
185 	 */
186 	IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), );
187 	off = sizeof(struct ip6_hdr);
188 	nxt = oip6->ip6_nxt;
189 	while(1) {		/* XXX: should avoid inf. loop explicitly? */
190 		struct ip6_ext *ip6e;
191 		struct icmp6_hdr *icp;
192 
193 		switch(nxt) {
194 		case IPPROTO_IPV6:
195 		case IPPROTO_IPV4:
196 		case IPPROTO_UDP:
197 		case IPPROTO_TCP:
198 		case IPPROTO_ESP:
199 		case IPPROTO_FRAGMENT:
200 			/*
201 			 * ICMPv6 error must not be fragmented.
202 			 * XXX: but can we trust the sender?
203 			 */
204 		default:
205 			/* What if unknown header followed by ICMP error? */
206 			goto generate;
207 		case IPPROTO_ICMPV6:
208 			IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct icmp6_hdr), );
209 			icp = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
210 			if (icp->icmp6_type < ICMP6_ECHO_REQUEST
211 			 || icp->icmp6_type == ND_REDIRECT) {
212 				/*
213 				 * ICMPv6 error
214 				 * Special case: for redirect (which is
215 				 * informational) we must not send icmp6 error.
216 				 */
217 				icmp6stat.icp6s_canterror++;
218 				goto freeit;
219 			} else {
220 				/* ICMPv6 informational */
221 				goto generate;
222 			}
223 		case IPPROTO_HOPOPTS:
224 		case IPPROTO_DSTOPTS:
225 		case IPPROTO_ROUTING:
226 		case IPPROTO_AH:
227 			IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct ip6_ext), );
228 			ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off);
229 			if (nxt == IPPROTO_AH)
230 				off += (ip6e->ip6e_len + 2) << 2;
231 			else
232 				off += (ip6e->ip6e_len + 1) << 3;
233 			nxt = ip6e->ip6e_nxt;
234 			break;
235 		}
236 	}
237 
238   freeit:
239 	/*
240 	 * If we can't tell wheter or not we can generate ICMP6, free it.
241 	 */
242 	m_freem(m);
243 	return;
244 
245   generate:
246 	oip6 = mtod(m, struct ip6_hdr *); /* adjust pointer */
247 
248 	/* Finally, do rate limitation check. */
249 	if (icmp6_ratelimit(&oip6->ip6_src, type, code)) {
250 		icmp6stat.icp6s_toofreq++;
251 		goto freeit;
252 	}
253 
254 	/*
255 	 * OK, ICMP6 can be generated.
256 	 */
257 
258 	if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN)
259 		m_adj(m, ICMPV6_PLD_MAXLEN - m->m_pkthdr.len);
260 
261 	prep = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
262 	M_PREPEND(m, prep, M_DONTWAIT);
263 	if (m && m->m_len < prep)
264 		m = m_pullup(m, prep);
265 	if (m == NULL) {
266 		printf("ENOBUFS in icmp6_error %d\n", __LINE__);
267 		return;
268 	}
269 
270 	nip6 = mtod(m, struct ip6_hdr *);
271 	nip6->ip6_src  = oip6->ip6_src;
272 	nip6->ip6_dst  = oip6->ip6_dst;
273 
274 	if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_src))
275 		oip6->ip6_src.s6_addr16[1] = 0;
276 	if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_dst))
277 		oip6->ip6_dst.s6_addr16[1] = 0;
278 
279 	icmp6 = (struct icmp6_hdr *)(nip6 + 1);
280 	icmp6->icmp6_type = type;
281 	icmp6->icmp6_code = code;
282 	icmp6->icmp6_pptr = htonl((u_int32_t)param);
283 
284 	icmp6stat.icp6s_outhist[type]++;
285 	icmp6_reflect(m, sizeof(struct ip6_hdr)); /*header order: IPv6 - ICMPv6*/
286 }
287 
288 /*
289  * Process a received ICMP6 message.
290  */
291 int
292 icmp6_input(mp, offp, proto)
293 	struct mbuf **mp;
294 	int *offp, proto;
295 {
296 	struct mbuf *m = *mp, *n;
297 	struct ip6_hdr *ip6, *nip6;
298 	struct icmp6_hdr *icmp6, *nicmp6;
299 	int off = *offp;
300 	int icmp6len = m->m_pkthdr.len - *offp;
301 	int code, sum, noff;
302 	struct sockaddr_in6 icmp6src;
303 
304 	IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_hdr), IPPROTO_DONE);
305 	/* m might change if M_LOOP. So, call mtod after this */
306 
307 	/*
308 	 * Locate icmp6 structure in mbuf, and check
309 	 * that not corrupted and of at least minimum length
310 	 */
311 
312 	ip6 = mtod(m, struct ip6_hdr *);
313 	if (icmp6len < sizeof(struct icmp6_hdr)) {
314 		icmp6stat.icp6s_tooshort++;
315 		goto freeit;
316 	}
317 
318 	/*
319 	 * calculate the checksum
320 	 */
321 
322 	icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);
323 	code = icmp6->icmp6_code;
324 
325 	if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) {
326 		log(LOG_ERR,
327 		    "ICMP6 checksum error(%d|%x) %s\n",
328 		    icmp6->icmp6_type,
329 		    sum,
330 		    ip6_sprintf(&ip6->ip6_src));
331 		icmp6stat.icp6s_checksum++;
332 		goto freeit;
333 	}
334 
335 #if defined(NFAITH) && 0 < NFAITH
336 	if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
337 		/*
338 		 * Deliver very specific ICMP6 type only.
339 		 * This is important to deilver TOOBIG.  Otherwise PMTUD
340 		 * will not work.
341 		 */
342 		switch (icmp6->icmp6_type) {
343 		case ICMP6_DST_UNREACH:
344 		case ICMP6_PACKET_TOO_BIG:
345 		case ICMP6_TIME_EXCEEDED:
346 			break;
347 		default:
348 			goto freeit;
349 		}
350 	}
351 #endif
352 
353 #ifdef IPSEC
354 	/* drop it if it does not match the default policy */
355 	if (ipsec6_in_reject(m, NULL)) {
356 		ipsecstat.in_polvio++;
357 		goto freeit;
358 	}
359 #endif
360 
361 	icmp6stat.icp6s_inhist[icmp6->icmp6_type]++;
362 	icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_msg);
363 	if (icmp6->icmp6_type < ICMP6_INFOMSG_MASK)
364 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_error);
365 
366 	switch (icmp6->icmp6_type) {
367 
368 	case ICMP6_DST_UNREACH:
369 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_dstunreach);
370 		switch (code) {
371 		case ICMP6_DST_UNREACH_NOROUTE:
372 			code = PRC_UNREACH_NET;
373 			break;
374 		case ICMP6_DST_UNREACH_ADMIN:
375 			icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_adminprohib);
376 		case ICMP6_DST_UNREACH_ADDR:
377 			code = PRC_UNREACH_HOST;
378 			break;
379 		case ICMP6_DST_UNREACH_NOTNEIGHBOR:
380 			code = PRC_UNREACH_SRCFAIL;
381 			break;
382 		case ICMP6_DST_UNREACH_NOPORT:
383 			code = PRC_UNREACH_PORT;
384 			break;
385 		default:
386 			goto badcode;
387 		}
388 		goto deliver;
389 		break;
390 
391 	case ICMP6_PACKET_TOO_BIG:
392 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_pkttoobig);
393 		if (code != 0)
394 			goto badcode;
395 	    {
396 		u_int mtu = ntohl(icmp6->icmp6_mtu);
397 		struct rtentry *rt = NULL;
398 		struct sockaddr_in6 sin6;
399 
400 		code = PRC_MSGSIZE;
401 		bzero(&sin6, sizeof(sin6));
402 		sin6.sin6_family = PF_INET6;
403 		sin6.sin6_len = sizeof(struct sockaddr_in6);
404 		sin6.sin6_addr = ((struct ip6_hdr *)(icmp6 + 1))->ip6_dst;
405 		rt = rtalloc1((struct sockaddr *)&sin6, 0,
406 			RTF_CLONING | RTF_PRCLONING);
407 		if (rt && (rt->rt_flags & RTF_HOST)
408 		    && !(rt->rt_rmx.rmx_locks & RTV_MTU)) {
409 			if (mtu < IPV6_MMTU) {
410 				/* xxx */
411 				rt->rt_rmx.rmx_locks |= RTV_MTU;
412 			} else if (mtu < rt->rt_ifp->if_mtu &&
413 				   rt->rt_rmx.rmx_mtu > mtu) {
414 				rt->rt_rmx.rmx_mtu = mtu;
415 			}
416 		}
417 		if (rt)
418 			RTFREE(rt);
419 
420 		goto deliver;
421 	    }
422 		break;
423 
424 	case ICMP6_TIME_EXCEEDED:
425 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_timeexceed);
426 		switch (code) {
427 		case ICMP6_TIME_EXCEED_TRANSIT:
428 		case ICMP6_TIME_EXCEED_REASSEMBLY:
429 			code += PRC_TIMXCEED_INTRANS;
430 			break;
431 		default:
432 			goto badcode;
433 		}
434 		goto deliver;
435 		break;
436 
437 	case ICMP6_PARAM_PROB:
438 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_paramprob);
439 		switch (code) {
440 		case ICMP6_PARAMPROB_NEXTHEADER:
441 			code = PRC_UNREACH_PROTOCOL;
442 			break;
443 		case ICMP6_PARAMPROB_HEADER:
444 		case ICMP6_PARAMPROB_OPTION:
445 			code = PRC_PARAMPROB;
446 			break;
447 		default:
448 			goto badcode;
449 		}
450 		goto deliver;
451 		break;
452 
453 	case ICMP6_ECHO_REQUEST:
454 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echo);
455 		if (code != 0)
456 			goto badcode;
457 		if ((n = m_copy(m, 0, M_COPYALL)) == NULL) {
458 			/* Give up remote */
459 			break;
460 		}
461 		if (n->m_flags & M_EXT) {
462 			int gap, move;
463 			struct mbuf *n0 = n;
464 
465 			/*
466 			 * Prepare an internal mbuf. m_pullup() doesn't
467 			 * always copy the length we specified.
468 			 */
469 			MGETHDR(n, M_DONTWAIT, n0->m_type);
470 			if (n == NULL) {
471 				/* Give up remote */
472 				m_freem(n0);
473 				break;
474 			}
475 			M_COPY_PKTHDR(n, n0);
476 			n0->m_flags &= ~M_PKTHDR;
477 			n->m_next = n0;
478 			/*
479 			 * Copy IPv6 and ICMPv6 only.
480 			 */
481 			nip6 = mtod(n, struct ip6_hdr *);
482 			bcopy(ip6, nip6, sizeof(struct ip6_hdr));
483 			nicmp6 = (struct icmp6_hdr *)(nip6 + 1);
484 			bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr));
485 			/*
486 			 * Adjust mbuf. ip6_plen will be adjusted.
487 			 */
488 			noff = sizeof(struct ip6_hdr);
489 			n->m_len = noff + sizeof(struct icmp6_hdr);
490 			move = off + sizeof(struct icmp6_hdr);
491 			n0->m_len -= move;
492 			n0->m_data += move;
493 			gap = off - noff;
494 			n->m_pkthdr.len -= gap;
495 		} else {
496 			nip6 = mtod(n, struct ip6_hdr *);
497 			nicmp6 = (struct icmp6_hdr *)((caddr_t)nip6 + off);
498 			noff = off;
499 		}
500 		nicmp6->icmp6_type = ICMP6_ECHO_REPLY;
501 		nicmp6->icmp6_code = 0;
502 		if (n) {
503 			icmp6stat.icp6s_reflect++;
504 			icmp6stat.icp6s_outhist[ICMP6_ECHO_REPLY]++;
505 			icmp6_reflect(n, noff);
506 		}
507 		break;
508 
509 	case ICMP6_ECHO_REPLY:
510 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echoreply);
511 		if (code != 0)
512 			goto badcode;
513 		break;
514 
515 	case MLD6_LISTENER_QUERY:
516 	case MLD6_LISTENER_REPORT:
517 		if (icmp6len < sizeof(struct mld6_hdr))
518 			goto badlen;
519 		if (icmp6->icmp6_type == MLD6_LISTENER_QUERY) /* XXX: ugly... */
520 			icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldquery);
521 		else
522 			icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldreport);
523 		IP6_EXTHDR_CHECK(m, off, icmp6len, IPPROTO_DONE);
524 		mld6_input(m, off);
525 		/* m stays. */
526 		break;
527 
528 	case MLD6_LISTENER_DONE:
529 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mlddone);
530 		if (icmp6len < sizeof(struct mld6_hdr))	/* necessary? */
531 			goto badlen;
532 		break;		/* nothing to be done in kernel */
533 
534 	case MLD6_MTRACE_RESP:
535 	case MLD6_MTRACE:
536 		/* XXX: these two are experimental. not officially defind. */
537 		/* XXX: per-interface statistics? */
538 		break;		/* just pass it to the userland daemon */
539 
540 	case ICMP6_WRUREQUEST:	/* ICMP6_FQDN_QUERY */
541 	    {
542 		enum { WRU, FQDN } mode;
543 
544 		if (code != 0)
545 			goto badcode;
546 		if (icmp6len == sizeof(struct icmp6_hdr) + 4)
547 			mode = WRU;
548 		else if (icmp6len >= sizeof(struct icmp6_hdr) + 8) /* XXX */
549 			mode = FQDN;
550 		else
551 			goto badlen;
552 
553 #define hostnamelen	strlen(hostname)
554 		if (mode == FQDN) {
555 			IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_nodeinfo),
556 					 IPPROTO_DONE);
557 			n = ni6_input(m, off);
558 			noff = sizeof(struct ip6_hdr);
559 		} else {
560 			u_char *p;
561 
562 			MGETHDR(n, M_DONTWAIT, m->m_type);
563 			if (n == NULL) {
564 				/* Give up remote */
565 				break;
566 			}
567 			/*
568 			 * Copy IPv6 and ICMPv6 only.
569 			 */
570 			nip6 = mtod(n, struct ip6_hdr *);
571 			bcopy(ip6, nip6, sizeof(struct ip6_hdr));
572 			nicmp6 = (struct icmp6_hdr *)(nip6 + 1);
573 			bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr));
574 			p = (u_char *)(nicmp6 + 1);
575 			bzero(p, 4);
576 			bcopy(hostname, p + 4, hostnamelen);
577 			noff = sizeof(struct ip6_hdr);
578 			M_COPY_PKTHDR(n, m); /* just for recvif */
579 			n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) +
580 				sizeof(struct icmp6_hdr) + 4 + hostnamelen;
581 			nicmp6->icmp6_type = ICMP6_WRUREPLY;
582 			nicmp6->icmp6_code = 0;
583 		}
584 #undef hostnamelen
585 		if (n) {
586 			icmp6stat.icp6s_reflect++;
587 			icmp6stat.icp6s_outhist[ICMP6_WRUREPLY]++;
588 			icmp6_reflect(n, noff);
589 		}
590 		break;
591 	    }
592 
593 	case ICMP6_WRUREPLY:
594 		if (code != 0)
595 			goto badcode;
596 		break;
597 
598 	case ND_ROUTER_SOLICIT:
599 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routersolicit);
600 		if (code != 0)
601 			goto badcode;
602 		if (icmp6len < sizeof(struct nd_router_solicit))
603 			goto badlen;
604 		IP6_EXTHDR_CHECK(m, off, icmp6len, IPPROTO_DONE);
605 		nd6_rs_input(m, off, icmp6len);
606 		/* m stays. */
607 		break;
608 
609 	case ND_ROUTER_ADVERT:
610 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routeradvert);
611 		if (code != 0)
612 			goto badcode;
613 		if (icmp6len < sizeof(struct nd_router_advert))
614 			goto badlen;
615 		IP6_EXTHDR_CHECK(m, off, icmp6len, IPPROTO_DONE);
616 		nd6_ra_input(m, off, icmp6len);
617 		/* m stays. */
618 		break;
619 
620 	case ND_NEIGHBOR_SOLICIT:
621 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighborsolicit);
622 		if (code != 0)
623 			goto badcode;
624 		if (icmp6len < sizeof(struct nd_neighbor_solicit))
625 			goto badlen;
626 		IP6_EXTHDR_CHECK(m, off, icmp6len, IPPROTO_DONE);
627 		nd6_ns_input(m, off, icmp6len);
628 		/* m stays. */
629 		break;
630 
631 	case ND_NEIGHBOR_ADVERT:
632 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighboradvert);
633 		if (code != 0)
634 			goto badcode;
635 		if (icmp6len < sizeof(struct nd_neighbor_advert))
636 			goto badlen;
637 		IP6_EXTHDR_CHECK(m, off, icmp6len, IPPROTO_DONE);
638 		nd6_na_input(m, off, icmp6len);
639 		/* m stays. */
640 		break;
641 
642 	case ND_REDIRECT:
643 		icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_redirect);
644 		if (code != 0)
645 			goto badcode;
646 		if (icmp6len < sizeof(struct nd_redirect))
647 			goto badlen;
648 		icmp6_redirect_input(m, off);
649 		/* m stays. */
650 		break;
651 
652 	case ICMP6_ROUTER_RENUMBERING:
653 		if (code != ICMP6_ROUTER_RENUMBERING_COMMAND &&
654 		    code != ICMP6_ROUTER_RENUMBERING_RESULT)
655 			goto badcode;
656 		if (icmp6len < sizeof(struct icmp6_router_renum))
657 			goto badlen;
658 		break;
659 
660 	default:
661 		printf("icmp6_input: unknown type %d(src=%s, dst=%s, ifid=%d)\n",
662 		       icmp6->icmp6_type, ip6_sprintf(&ip6->ip6_src),
663 		       ip6_sprintf(&ip6->ip6_dst),
664 		       m->m_pkthdr.rcvif ? m->m_pkthdr.rcvif->if_index : 0);
665 		if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST) {
666 			/* ICMPv6 error: MUST deliver it by spec... */
667 			code = PRC_NCMDS;
668 			/* deliver */
669 		} else {
670 			/* ICMPv6 informational: MUST not deliver */
671 			break;
672 		}
673 	deliver:
674 		if (icmp6len < sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr)) {
675 			icmp6stat.icp6s_tooshort++;
676 			goto freeit;
677 		}
678 		IP6_EXTHDR_CHECK(m, off,
679 			sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr),
680 			IPPROTO_DONE);
681 		icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
682 		bzero(&icmp6src, sizeof(icmp6src));
683 		icmp6src.sin6_len = sizeof(struct sockaddr_in6);
684 		icmp6src.sin6_family = AF_INET6;
685 		icmp6src.sin6_addr = ((struct ip6_hdr *)(icmp6 + 1))->ip6_dst;
686 
687 		/* Detect the upper level protocol */
688 	    {
689 		void (*ctlfunc) __P((int, struct sockaddr *, void *));
690 		struct ip6_hdr *eip6 = (struct ip6_hdr *)(icmp6 + 1);
691 		u_int8_t nxt = eip6->ip6_nxt;
692 		int eoff = off + sizeof(struct icmp6_hdr) +
693 			sizeof(struct ip6_hdr);
694 		struct ip6ctlparam ip6cp;
695 
696 		while (1) { /* XXX: should avoid inf. loop explicitly? */
697 			struct ip6_ext *eh;
698 
699 			switch(nxt) {
700 			case IPPROTO_ESP:
701 			case IPPROTO_NONE:
702 				goto passit;
703 			case IPPROTO_HOPOPTS:
704 			case IPPROTO_DSTOPTS:
705 			case IPPROTO_ROUTING:
706 			case IPPROTO_AH:
707 			case IPPROTO_FRAGMENT:
708 				IP6_EXTHDR_CHECK(m, 0, eoff +
709 						 sizeof(struct ip6_ext),
710 						 IPPROTO_DONE);
711 				eh = (struct ip6_ext *)(mtod(m, caddr_t)
712 							+ eoff);
713 				if (nxt == IPPROTO_AH)
714 					eoff += (eh->ip6e_len + 2) << 2;
715 				else if (nxt == IPPROTO_FRAGMENT)
716 					eoff += sizeof(struct ip6_frag);
717 				else
718 					eoff += (eh->ip6e_len + 1) << 3;
719 				nxt = eh->ip6e_nxt;
720 				break;
721 			default:
722 				goto notify;
723 			}
724 		}
725 	    notify:
726 		icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
727 		ctlfunc = (void (*) __P((int, struct sockaddr *, void *)))
728 			(inet6sw[ip6_protox[nxt]].pr_ctlinput);
729 		if (ctlfunc) {
730 			ip6cp.ip6c_m = m;
731 			ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1);
732 			ip6cp.ip6c_off = eoff;
733 			(*ctlfunc)(code, (struct sockaddr *)&icmp6src, &ip6cp);
734 		}
735 	    }
736 		break;
737 
738 	badcode:
739 		icmp6stat.icp6s_badcode++;
740 		break;
741 
742 	badlen:
743 		icmp6stat.icp6s_badlen++;
744 		break;
745 	}
746 
747  passit:
748 	icmp6_rip6_input(&m, *offp);
749 	return IPPROTO_DONE;
750 
751  freeit:
752 	m_freem(m);
753 	return IPPROTO_DONE;
754 }
755 
756 /*
757  * Process a Node Information Query
758  */
759 #define	hostnamelen	strlen(hostname)
760 #ifndef offsetof		/* XXX */
761 #define	offsetof(type, member)	((size_t)(&((type *)0)->member))
762 #endif
763 
764 static struct mbuf *
765 ni6_input(m, off)
766 	struct mbuf *m;
767 	int off;
768 {
769 	struct icmp6_nodeinfo *ni6 =
770 		(struct icmp6_nodeinfo *)(mtod(m, caddr_t) + off), *nni6;
771 	struct mbuf *n = NULL;
772 	u_int16_t qtype = ntohs(ni6->ni_qtype);
773 	int replylen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo);
774 	struct ni_reply_fqdn *fqdn;
775 	int addrs;		/* for NI_QTYPE_NODEADDR */
776 	struct ifnet *ifp = NULL; /* for NI_QTYPE_NODEADDR */
777 
778 	switch(qtype) {
779 	 case NI_QTYPE_NOOP:
780 		 break;		/* no reply data */
781 	 case NI_QTYPE_SUPTYPES:
782 		 goto bad;	/* xxx: to be implemented */
783 		 break;
784 	 case NI_QTYPE_FQDN:
785 		 replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_name) +
786 			 hostnamelen;
787 		 break;
788 	 case NI_QTYPE_NODEADDR:
789 		 addrs = ni6_addrs(ni6, m, &ifp);
790 		 if ((replylen += addrs * sizeof(struct in6_addr)) > MCLBYTES)
791 			 replylen = MCLBYTES; /* XXX: we'll truncate later */
792 
793 		 break;
794 	 default:
795 		 /*
796 		  * XXX: We must return a reply with the ICMP6 code
797 		  * `unknown Qtype' in this case. However we regard the case
798 		  * as an FQDN query for backward compatibility.
799 		  * Older versions set a random value to this field,
800 		  * so it rarely varies in the defined qtypes.
801 		  * But the mechanism is not reliable...
802 		  * maybe we should obsolete older versions.
803 		  */
804 		 qtype = NI_QTYPE_FQDN;
805 		 replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_name) +
806 			 hostnamelen;
807 		 break;
808 	}
809 
810 	/* allocate a mbuf to reply. */
811 	MGETHDR(n, M_DONTWAIT, m->m_type);
812 	if (n == NULL)
813 		return(NULL);
814 	M_COPY_PKTHDR(n, m); /* just for recvif */
815 	if (replylen > MHLEN) {
816 		if (replylen > MCLBYTES)
817 			 /*
818 			  * XXX: should we try to allocate more? But MCLBYTES is
819 			  * probably much larger than IPV6_MMTU...
820 			  */
821 			goto bad;
822 		MCLGET(n, M_DONTWAIT);
823 		if ((n->m_flags & M_EXT) == 0) {
824 			goto bad;
825 		}
826 	}
827 	n->m_pkthdr.len = n->m_len = replylen;
828 
829 	/* copy mbuf header and IPv6 + Node Information base headers */
830 	bcopy(mtod(m, caddr_t), mtod(n, caddr_t), sizeof(struct ip6_hdr));
831 	nni6 = (struct icmp6_nodeinfo *)(mtod(n, struct ip6_hdr *) + 1);
832 	bcopy(mtod(m, caddr_t) + off, (caddr_t)nni6, sizeof(struct icmp6_nodeinfo));
833 
834 	/* qtype dependent procedure */
835 	switch (qtype) {
836 	 case NI_QTYPE_NOOP:
837 		 nni6->ni_flags = 0;
838 		 break;
839 	 case NI_QTYPE_SUPTYPES:
840 		 goto bad;	/* xxx: to be implemented */
841 		 break;
842 	 case NI_QTYPE_FQDN:
843 		 if (hostnamelen > 255) { /* XXX: rare case, but may happen */
844 			 printf("ni6_input: "
845 				"hostname length(%d) is too large for reply\n",
846 				hostnamelen);
847 			 goto bad;
848 		 }
849 		 fqdn = (struct ni_reply_fqdn *)(mtod(n, caddr_t) +
850 						 sizeof(struct ip6_hdr) +
851 						 sizeof(struct icmp6_nodeinfo));
852 		 nni6->ni_flags = 0; /* XXX: meaningless TTL */
853 		 fqdn->ni_fqdn_ttl = 0;	/* ditto. */
854 		 fqdn->ni_fqdn_namelen = hostnamelen;
855 		 bcopy(hostname, &fqdn->ni_fqdn_name[0], hostnamelen);
856 		 break;
857 	 case NI_QTYPE_NODEADDR:
858 	 {
859 		 int lenlim, copied;
860 
861 		 if (n->m_flags & M_EXT)
862 			 lenlim = MCLBYTES - sizeof(struct ip6_hdr) -
863 				 sizeof(struct icmp6_nodeinfo);
864 		 else
865 			 lenlim = MHLEN - sizeof(struct ip6_hdr) -
866 				 sizeof(struct icmp6_nodeinfo);
867 		 copied = ni6_store_addrs(ni6, nni6, ifp, lenlim);
868 		 /* XXX: reset mbuf length */
869 		 n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) +
870 			 sizeof(struct icmp6_nodeinfo) + copied;
871 		 break;
872 	 }
873 	 default:
874 		 break;		/* XXX impossible! */
875 	}
876 
877 	nni6->ni_type = ICMP6_NI_REPLY;
878 	nni6->ni_code = ICMP6_NI_SUCESS;
879 	return(n);
880 
881   bad:
882 	if (n)
883 		m_freem(n);
884 	return(NULL);
885 }
886 #undef hostnamelen
887 
888 /*
889  * calculate the number of addresses to be returned in the node info reply.
890  */
891 static int
892 ni6_addrs(ni6, m, ifpp)
893 	struct icmp6_nodeinfo *ni6;
894 	struct mbuf *m;
895 	struct ifnet **ifpp;
896 {
897 	register struct ifnet *ifp;
898 	register struct in6_ifaddr *ifa6;
899 	register struct ifaddr *ifa;
900 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
901 	int addrs = 0, addrsofif, iffound = 0;
902 
903 	for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list))
904 	{
905 		addrsofif = 0;
906 		TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
907 		{
908 			if (ifa->ifa_addr->sa_family != AF_INET6)
909 				continue;
910 			ifa6 = (struct in6_ifaddr *)ifa;
911 
912 			if (!(ni6->ni_flags & NI_NODEADDR_FLAG_ALL) &&
913 			    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
914 					       &ifa6->ia_addr.sin6_addr))
915 				iffound = 1;
916 
917 			if (ifa6->ia6_flags & IN6_IFF_ANYCAST) {
918 				if ((ni6->ni_flags & NI_NODEADDR_FLAG_ANYCAST)
919 				    != 0)
920 					addrsofif++;
921 				continue; /* we need only unicast addresses */
922 			}
923 
924 			if ((ni6->ni_flags & (NI_NODEADDR_FLAG_LINKLOCAL |
925 					      NI_NODEADDR_FLAG_SITELOCAL |
926 					      NI_NODEADDR_FLAG_GLOBAL)) == 0)
927 				continue;
928 
929 			/* What do we have to do about ::1? */
930 			switch(in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
931 			 case IPV6_ADDR_SCOPE_LINKLOCAL:
932 				if (ni6->ni_flags & NI_NODEADDR_FLAG_LINKLOCAL)
933 					addrsofif++;
934 				break;
935 			 case IPV6_ADDR_SCOPE_SITELOCAL:
936 				if (ni6->ni_flags & NI_NODEADDR_FLAG_SITELOCAL)
937 					addrsofif++;
938 				break;
939 			 case IPV6_ADDR_SCOPE_GLOBAL:
940 				 if (ni6->ni_flags & NI_NODEADDR_FLAG_GLOBAL)
941 					 addrsofif++;
942 				 break;
943 			 default:
944 				 continue;
945 			}
946 		}
947 		if (iffound) {
948 			*ifpp = ifp;
949 			return(addrsofif);
950 		}
951 
952 		addrs += addrsofif;
953 	}
954 
955 	return(addrs);
956 }
957 
958 static int
959 ni6_store_addrs(ni6, nni6, ifp0, resid)
960 	struct icmp6_nodeinfo *ni6, *nni6;
961 	struct ifnet *ifp0;
962 	int resid;
963 {
964 	register struct ifnet *ifp = ifp0 ? ifp0 : TAILQ_FIRST(&ifnet);
965 	register struct in6_ifaddr *ifa6;
966 	register struct ifaddr *ifa;
967 	int docopy, copied = 0;
968 	u_char *cp = (u_char *)(nni6 + 1);
969 
970 	if (ifp0 == NULL && !(ni6->ni_flags & NI_NODEADDR_FLAG_ALL))
971 		return(0);	/* needless to copy */
972 
973 	for (; ifp; ifp = TAILQ_NEXT(ifp, if_list))
974 	{
975 		TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
976 		{
977 			docopy = 0;
978 
979 			if (ifa->ifa_addr->sa_family != AF_INET6)
980 				continue;
981 			ifa6 = (struct in6_ifaddr *)ifa;
982 
983 			if (ifa6->ia6_flags & IN6_IFF_ANYCAST) {
984 				/* just experimental. not in the spec. */
985 				if (ni6->ni_flags & NI_NODEADDR_FLAG_ANYCAST)
986 					docopy = 1;
987 				else
988 					continue;
989 			} else {	/* unicast address */
990 				if (ni6->ni_flags & NI_NODEADDR_FLAG_ANYCAST)
991 					continue;
992 			}
993 
994 			/* What do we have to do about ::1? */
995 			switch(in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
996 			 case IPV6_ADDR_SCOPE_LINKLOCAL:
997 				if (ni6->ni_flags & NI_NODEADDR_FLAG_LINKLOCAL)
998 					docopy = 1;
999 				break;
1000 			 case IPV6_ADDR_SCOPE_SITELOCAL:
1001 				if (ni6->ni_flags & NI_NODEADDR_FLAG_SITELOCAL)
1002 					docopy = 1;
1003 				break;
1004 			 case IPV6_ADDR_SCOPE_GLOBAL:
1005 				 if (ni6->ni_flags & NI_NODEADDR_FLAG_GLOBAL)
1006 					 docopy = 1;
1007 				 break;
1008 			 default:
1009 				 continue;
1010 			}
1011 
1012 			if (docopy) {
1013 				if (resid < sizeof(struct in6_addr)) {
1014 					/*
1015 					 * We give up much more copy.
1016 					 * Set the truncate flag and return.
1017 					 */
1018 					nni6->ni_flags |=
1019 						NI_NODEADDR_FLAG_TRUNCATE;
1020 					return(copied);
1021 				}
1022 				bcopy(&ifa6->ia_addr.sin6_addr, cp,
1023 				      sizeof(struct in6_addr));
1024 				/* XXX: KAME link-local hack; remove ifindex */
1025 				if (IN6_IS_ADDR_LINKLOCAL(&ifa6->ia_addr.sin6_addr))
1026 					((struct in6_addr *)cp)->s6_addr16[1] = 0;
1027 				cp += sizeof(struct in6_addr);
1028 				resid -= sizeof(struct in6_addr);
1029 				copied += sizeof(struct in6_addr);
1030 			}
1031 		}
1032 		if (ifp0)	/* we need search only on the specified IF */
1033 			break;
1034 	}
1035 
1036 	return(copied);
1037 }
1038 
1039 /*
1040  * XXX almost dup'ed code with rip6_input.
1041  */
1042 static int
1043 icmp6_rip6_input(mp, off)
1044 	struct	mbuf **mp;
1045 	int	off;
1046 {
1047 	struct mbuf *m = *mp;
1048 	register struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1049 	register struct in6pcb *in6p;
1050 	struct in6pcb *last = NULL;
1051 	struct sockaddr_in6 rip6src;
1052 	struct icmp6_hdr *icmp6;
1053 	struct mbuf *opts = NULL;
1054 
1055 	/* this is assumed to be safe. */
1056 	icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);
1057 
1058 	bzero(&rip6src, sizeof(rip6src));
1059 	rip6src.sin6_len = sizeof(struct sockaddr_in6);
1060 	rip6src.sin6_family = AF_INET6;
1061 	rip6src.sin6_addr = ip6->ip6_src;
1062 	if (IN6_IS_SCOPE_LINKLOCAL(&rip6src.sin6_addr))
1063 		rip6src.sin6_addr.s6_addr16[1] = 0;
1064 	if (m->m_pkthdr.rcvif) {
1065 		if (IN6_IS_SCOPE_LINKLOCAL(&rip6src.sin6_addr))
1066 			rip6src.sin6_scope_id = m->m_pkthdr.rcvif->if_index;
1067 		else
1068 			rip6src.sin6_scope_id = 0;
1069 	} else
1070 		rip6src.sin6_scope_id = 0;
1071 
1072 	LIST_FOREACH(in6p, &ripcb, inp_list)
1073 	{
1074 		if ((in6p->inp_vflag & INP_IPV6) == 0)
1075 			continue;
1076 		if (in6p->in6p_ip6_nxt != IPPROTO_ICMPV6)
1077 			continue;
1078 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) &&
1079 		   !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst))
1080 			continue;
1081 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) &&
1082 		   !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src))
1083 			continue;
1084 		if (in6p->in6p_icmp6filt
1085 		    && ICMP6_FILTER_WILLBLOCK(icmp6->icmp6_type,
1086 				 in6p->in6p_icmp6filt))
1087 			continue;
1088 		if (last) {
1089 			struct	mbuf *n;
1090 			if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
1091 				if (last->in6p_flags & IN6P_CONTROLOPTS)
1092 					ip6_savecontrol(last, &opts, ip6, n);
1093 				/* strip intermediate headers */
1094 				m_adj(n, off);
1095 				if (sbappendaddr(&last->in6p_socket->so_rcv,
1096 						 (struct sockaddr *)&rip6src,
1097 						 n, opts) == 0) {
1098 					/* should notify about lost packet */
1099 					m_freem(n);
1100 					if (opts)
1101 						m_freem(opts);
1102 				} else
1103 					sorwakeup(last->in6p_socket);
1104 				opts = NULL;
1105 			}
1106 		}
1107 		last = in6p;
1108 	}
1109 	if (last) {
1110 		if (last->in6p_flags & IN6P_CONTROLOPTS)
1111 			ip6_savecontrol(last, &opts, ip6, m);
1112 		/* strip intermediate headers */
1113 		m_adj(m, off);
1114 		if (sbappendaddr(&last->in6p_socket->so_rcv,
1115 				(struct sockaddr *)&rip6src, m, opts) == 0) {
1116 			m_freem(m);
1117 			if (opts)
1118 				m_freem(opts);
1119 		} else
1120 			sorwakeup(last->in6p_socket);
1121 	} else {
1122 		m_freem(m);
1123 		ip6stat.ip6s_delivered--;
1124 	}
1125 	return IPPROTO_DONE;
1126 }
1127 
1128 /*
1129  * Reflect the ip6 packet back to the source.
1130  * The caller MUST check if the destination is multicast or not.
1131  * This function is usually called with a unicast destination which
1132  * can be safely the source of the reply packet. But some exceptions
1133  * exist(e.g. ECHOREPLY, PATCKET_TOOBIG, "10" in OPTION type).
1134  * ``off'' points to the icmp6 header, counted from the top of the mbuf.
1135  */
1136 void
1137 icmp6_reflect(m, off)
1138 	struct	mbuf *m;
1139 	size_t off;
1140 {
1141 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1142 	struct icmp6_hdr *icmp6;
1143 	struct in6_ifaddr *ia;
1144 	struct in6_addr t, *src = 0;
1145 	int plen = m->m_pkthdr.len - sizeof(struct ip6_hdr);
1146 	int type, code;
1147 	struct ifnet *outif = NULL;
1148 #ifdef COMPAT_RFC1885
1149 	int mtu = IPV6_MMTU;
1150 	struct sockaddr_in6 *sin6 = &icmp6_reflect_rt.ro_dst;
1151 #endif
1152 
1153 	/*
1154 	 * If there are extra headers between IPv6 and ICMPv6, strip
1155 	 * off that header first.
1156 	 */
1157 	if (off != sizeof(struct ip6_hdr)) {
1158 		size_t siz;
1159 
1160 		/* sanity checks */
1161 		if (off < sizeof(struct ip6_hdr)) {
1162 			printf("sanity fail: off=%x, sizeof(ip6)=%x in %s:%d\n",
1163 			       (unsigned int)off,
1164 			       (unsigned int)sizeof(struct ip6_hdr),
1165 			       __FILE__, __LINE__);
1166 			goto bad;
1167 		}
1168 		siz = off - sizeof(struct ip6_hdr);
1169 		if (plen < siz) {
1170 			printf("sanity fail: siz=%x, payloadlen=%x in %s:%d\n",
1171 			       (unsigned int)siz, plen, __FILE__, __LINE__);
1172 			goto bad;
1173 		}
1174 		IP6_EXTHDR_CHECK(m, 0, off, /*nothing*/);
1175 		IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_hdr), /*nothing*/);
1176 
1177 		ovbcopy((caddr_t)ip6,
1178 			(caddr_t)(mtod(m, u_char *) + siz),
1179 			sizeof(struct ip6_hdr));
1180 		m->m_data += siz;
1181 		m->m_len -= siz;
1182 		m->m_pkthdr.len -= siz;
1183 		ip6 = mtod(m, struct ip6_hdr *);
1184 		ip6->ip6_nxt = IPPROTO_ICMPV6;
1185 		plen -= siz;
1186 	}
1187 
1188 	icmp6 = (struct icmp6_hdr *)(ip6 + 1);
1189 	type = icmp6->icmp6_type; /* keep type for statistics */
1190 	code = icmp6->icmp6_code; /* ditto. */
1191 
1192 	t = ip6->ip6_dst;
1193 	/*
1194 	 * ip6_input() drops a packet if its src is multicast.
1195 	 * So, the src is never multicast.
1196 	 */
1197 	ip6->ip6_dst = ip6->ip6_src;
1198 
1199 	/* XXX hack for link-local addresses */
1200 	if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst))
1201 		ip6->ip6_dst.s6_addr16[1] =
1202 			htons(m->m_pkthdr.rcvif->if_index);
1203 	if (IN6_IS_ADDR_LINKLOCAL(&t))
1204 		t.s6_addr16[1] = htons(m->m_pkthdr.rcvif->if_index);
1205 
1206 #ifdef COMPAT_RFC1885
1207 	/*
1208 	 * xxx guess MTU
1209 	 * RFC 1885 requires that echo reply should be truncated if it
1210 	 * does not fit in with (return) path MTU, but the description was
1211 	 * removed in the new spec.
1212 	 */
1213 	if (icmp6_reflect_rt.ro_rt == 0 ||
1214 	    ! (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_dst))) {
1215 		if (icmp6_reflect_rt.ro_rt) {
1216 			RTFREE(icmp6_reflect_rt.ro_rt);
1217 			icmp6_reflect_rt.ro_rt = 0;
1218 		}
1219 		bzero(sin6, sizeof(*sin6));
1220 		sin6->sin6_family = PF_INET6;
1221 		sin6->sin6_len = sizeof(struct sockaddr_in6);
1222 		sin6->sin6_addr = ip6->ip6_dst;
1223 
1224 		rtalloc_ign((struct route *)&icmp6_reflect_rt.ro_rt,
1225 			    RTF_PRCLONING);
1226 	}
1227 
1228 	if (icmp6_reflect_rt.ro_rt == 0)
1229 		goto bad;
1230 
1231 	if ((icmp6_reflect_rt.ro_rt->rt_flags & RTF_HOST)
1232 	    && mtu < icmp6_reflect_rt.ro_rt->rt_ifp->if_mtu)
1233 		mtu = icmp6_reflect_rt.ro_rt->rt_rmx.rmx_mtu;
1234 
1235 	if (mtu < m->m_pkthdr.len) {
1236 		plen -= (m->m_pkthdr.len - mtu);
1237 		m_adj(m, mtu - m->m_pkthdr.len);
1238 	}
1239 #endif
1240 	/*
1241 	 * If the incoming packet was addressed directly to us(i.e. unicast),
1242 	 * use dst as the src for the reply.
1243 	 */
1244 	for (ia = in6_ifaddr; ia; ia = ia->ia_next)
1245 		if (IN6_ARE_ADDR_EQUAL(&t, &ia->ia_addr.sin6_addr) &&
1246 		    (ia->ia6_flags & IN6_IFF_ANYCAST) == 0) {
1247 			src = &t;
1248 			break;
1249 		}
1250 	if (ia == NULL && IN6_IS_ADDR_LINKLOCAL(&t) && (m->m_flags & M_LOOP)) {
1251 		/*
1252 		 * This is the case if the dst is our link-local address
1253 		 * and the sender is also ourseleves.
1254 		 */
1255 		src = &t;
1256 	}
1257 
1258 	if (src == 0)
1259 		/*
1260 		 * We have not multicast routing yet. So this case matches
1261 		 * to our multicast, our anycast or not to our unicast.
1262 		 * Select a source address which has the same scope.
1263 		 */
1264 		if ((ia = in6_ifawithscope(m->m_pkthdr.rcvif, &t)) != 0)
1265 			src = &IA6_SIN6(ia)->sin6_addr;
1266 
1267 	if (src == 0)
1268 		goto bad;
1269 
1270 	ip6->ip6_src = *src;
1271 
1272 	ip6->ip6_flow = 0;
1273 	ip6->ip6_vfc = IPV6_VERSION;
1274 	ip6->ip6_nxt = IPPROTO_ICMPV6;
1275 	if (m->m_pkthdr.rcvif) {
1276 		/* XXX: This may not be the outgoing interface */
1277 		ip6->ip6_hlim = nd_ifinfo[m->m_pkthdr.rcvif->if_index].chlim;
1278 	}
1279 
1280 	icmp6->icmp6_cksum = 0;
1281 	icmp6->icmp6_cksum = in6_cksum(m, IPPROTO_ICMPV6,
1282 					sizeof(struct ip6_hdr), plen);
1283 
1284 	/*
1285 	 * xxx option handling
1286 	 */
1287 
1288 	m->m_flags &= ~(M_BCAST|M_MCAST);
1289 
1290 #ifdef COMPAT_RFC1885
1291 	ip6_output(m, NULL, &icmp6_reflect_rt, 0, NULL, &outif);
1292 #else
1293 	ip6_output(m, NULL, NULL, 0, NULL, &outif);
1294 #endif
1295 	if (outif)
1296 		icmp6_ifoutstat_inc(outif, type, code);
1297 
1298 	return;
1299 
1300  bad:
1301 	m_freem(m);
1302 	return;
1303 }
1304 
1305 void
1306 icmp6_fasttimo()
1307 {
1308 	mld6_fasttimeo();
1309 }
1310 
1311 static const char *
1312 icmp6_redirect_diag(src6, dst6, tgt6)
1313 	struct in6_addr *src6;
1314 	struct in6_addr *dst6;
1315 	struct in6_addr *tgt6;
1316 {
1317 	static char buf[1024];
1318 	snprintf(buf, sizeof(buf), "(src=%s dst=%s tgt=%s)",
1319 		ip6_sprintf(src6), ip6_sprintf(dst6), ip6_sprintf(tgt6));
1320 	return buf;
1321 }
1322 
1323 void
1324 icmp6_redirect_input(m, off)
1325 	register struct mbuf *m;
1326 	int off;
1327 {
1328 	struct ifnet *ifp = m->m_pkthdr.rcvif;
1329 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1330 	struct nd_redirect *nd_rd = (struct nd_redirect *)((caddr_t)ip6 + off);
1331 	int icmp6len = ntohs(ip6->ip6_plen);
1332 	char *lladdr = NULL;
1333 	int lladdrlen = 0;
1334 	u_char *redirhdr = NULL;
1335 	int redirhdrlen = 0;
1336 	struct rtentry *rt = NULL;
1337 	int is_router;
1338 	int is_onlink;
1339 	struct in6_addr src6 = ip6->ip6_src;
1340 	struct in6_addr redtgt6 = nd_rd->nd_rd_target;
1341 	struct in6_addr reddst6 = nd_rd->nd_rd_dst;
1342 	union nd_opts ndopts;
1343 
1344 	if (!m || !ifp)
1345 		return;
1346 
1347 	/* XXX if we are router, we don't update route by icmp6 redirect */
1348 	if (ip6_forwarding)
1349 		return;
1350 	if (!icmp6_rediraccept)
1351 		return;
1352 
1353 	if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
1354 		redtgt6.s6_addr16[1] = htons(ifp->if_index);
1355 	if (IN6_IS_ADDR_LINKLOCAL(&reddst6))
1356 		reddst6.s6_addr16[1] = htons(ifp->if_index);
1357 
1358 	/* validation */
1359 	if (!IN6_IS_ADDR_LINKLOCAL(&src6)) {
1360 		log(LOG_ERR,
1361 			"ICMP6 redirect sent from %s rejected; "
1362 			"must be from linklocal\n", ip6_sprintf(&src6));
1363 		return;
1364 	}
1365 	if (ip6->ip6_hlim != 255) {
1366 		log(LOG_ERR,
1367 			"ICMP6 redirect sent from %s rejected; "
1368 			"hlim=%d (must be 255)\n",
1369 			ip6_sprintf(&src6), ip6->ip6_hlim);
1370 		return;
1371 	}
1372     {
1373 	/* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */
1374 	struct sockaddr_in6 sin6;
1375 	struct in6_addr *gw6;
1376 
1377 	bzero(&sin6, sizeof(sin6));
1378 	sin6.sin6_family = AF_INET6;
1379 	sin6.sin6_len = sizeof(struct sockaddr_in6);
1380 	bcopy(&reddst6, &sin6.sin6_addr, sizeof(reddst6));
1381 	rt = rtalloc1((struct sockaddr *)&sin6, 0, 0UL);
1382 	if (rt) {
1383 		gw6 = &(((struct sockaddr_in6 *)rt->rt_gateway)->sin6_addr);
1384 		if (bcmp(&src6, gw6, sizeof(struct in6_addr)) != 0) {
1385 			log(LOG_ERR,
1386 				"ICMP6 redirect rejected; "
1387 				"not equal to gw-for-src=%s (must be same): "
1388 				"%s\n",
1389 				ip6_sprintf(gw6),
1390 				icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
1391 			RTFREE(rt);
1392 			return;
1393 		}
1394 	} else {
1395 		log(LOG_ERR,
1396 			"ICMP6 redirect rejected; "
1397 			"no route found for redirect dst: %s\n",
1398 			icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
1399 		return;
1400 	}
1401 	RTFREE(rt);
1402 	rt = NULL;
1403     }
1404 	if (IN6_IS_ADDR_MULTICAST(&reddst6)) {
1405 		log(LOG_ERR,
1406 			"ICMP6 redirect rejected; "
1407 			"redirect dst must be unicast: %s\n",
1408 			icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
1409 		return;
1410 	}
1411 
1412 	is_router = is_onlink = 0;
1413 	if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
1414 		is_router = 1;	/* router case */
1415 	if (bcmp(&redtgt6, &reddst6, sizeof(redtgt6)) == 0)
1416 		is_onlink = 1;	/* on-link destination case */
1417 	if (!is_router && !is_onlink) {
1418 		log(LOG_ERR,
1419 			"ICMP6 redirect rejected; "
1420 			"neither router case nor onlink case: %s\n",
1421 			icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
1422 		return;
1423 	}
1424 	/* validation passed */
1425 
1426 	icmp6len -= sizeof(*nd_rd);
1427 	nd6_option_init(nd_rd + 1, icmp6len, &ndopts);
1428 	if (nd6_options(&ndopts) < 0) {
1429 		log(LOG_INFO, "icmp6_redirect_input: "
1430 			"invalid ND option, rejected: %s\n",
1431 			icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
1432 		return;
1433 	}
1434 
1435 	if (ndopts.nd_opts_tgt_lladdr) {
1436 		lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1);
1437 		lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
1438 	}
1439 
1440 	if (ndopts.nd_opts_rh) {
1441 		redirhdrlen = ndopts.nd_opts_rh->nd_opt_rh_len;
1442 		redirhdr = (u_char *)(ndopts.nd_opts_rh + 1); /* xxx */
1443 	}
1444 
1445 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
1446 		log(LOG_INFO,
1447 			"icmp6_redirect_input: lladdrlen mismatch for %s "
1448 			"(if %d, icmp6 packet %d): %s\n",
1449 			ip6_sprintf(&redtgt6), ifp->if_addrlen, lladdrlen - 2,
1450 			icmp6_redirect_diag(&src6, &reddst6, &redtgt6));
1451 	}
1452 
1453 	/* RFC 2461 8.3 */
1454 	nd6_cache_lladdr(ifp, &redtgt6, lladdr, lladdrlen, ND_REDIRECT,
1455 			 is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER);
1456 
1457 	if (!is_onlink) {	/* better router case. perform rtredirect. */
1458 		/* perform rtredirect */
1459 		struct sockaddr_in6 sdst;
1460 		struct sockaddr_in6 sgw;
1461 		struct sockaddr_in6 ssrc;
1462 
1463 		bzero(&sdst, sizeof(sdst));
1464 		bzero(&sgw, sizeof(sgw));
1465 		bzero(&ssrc, sizeof(ssrc));
1466 		sdst.sin6_family = sgw.sin6_family = ssrc.sin6_family = AF_INET6;
1467 		sdst.sin6_len = sgw.sin6_len = ssrc.sin6_len =
1468 			sizeof(struct sockaddr_in6);
1469 		bcopy(&redtgt6, &sgw.sin6_addr, sizeof(struct in6_addr));
1470 		bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
1471 		bcopy(&src6, &ssrc.sin6_addr, sizeof(struct in6_addr));
1472 		rtredirect((struct sockaddr *)&sdst, (struct sockaddr *)&sgw,
1473 			   (struct sockaddr *)NULL, RTF_GATEWAY | RTF_HOST,
1474 			   (struct sockaddr *)&ssrc,
1475 			   (struct rtentry **)NULL);
1476 	}
1477 	/* finally update cached route in each socket via pfctlinput */
1478     {
1479 	struct sockaddr_in6 sdst;
1480 
1481 	bzero(&sdst, sizeof(sdst));
1482 	sdst.sin6_family = AF_INET6;
1483 	sdst.sin6_len = sizeof(struct sockaddr_in6);
1484 	bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
1485 	pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&sdst);
1486 #ifdef IPSEC
1487 	key_sa_routechange((struct sockaddr *)&sdst);
1488 #endif
1489     }
1490 }
1491 
1492 void
1493 icmp6_redirect_output(m0, rt)
1494 	struct mbuf *m0;
1495 	struct rtentry *rt;
1496 {
1497 	struct ifnet *ifp;	/* my outgoing interface */
1498 	struct in6_addr *ifp_ll6;
1499 	struct in6_addr *router_ll6;
1500 	struct ip6_hdr *sip6;	/* m0 as struct ip6_hdr */
1501 	struct mbuf *m = NULL;	/* newly allocated one */
1502 	struct ip6_hdr *ip6;	/* m as struct ip6_hdr */
1503 	struct nd_redirect *nd_rd;
1504 	size_t maxlen;
1505 	u_char *p;
1506 	struct ifnet *outif = NULL;
1507 
1508 	/* if we are not router, we don't send icmp6 redirect */
1509 	if (!ip6_forwarding || ip6_accept_rtadv)
1510 		goto fail;
1511 
1512 	/* sanity check */
1513 	if (!m0 || !rt || !(rt->rt_flags & RTF_UP) || !(ifp = rt->rt_ifp))
1514 		goto fail;
1515 
1516 	/*
1517 	 * Address check:
1518 	 *  the source address must identify a neighbor, and
1519 	 *  the destination address must not be a multicast address
1520 	 *  [RFC 2461, sec 8.2]
1521 	 */
1522 	sip6 = mtod(m0, struct ip6_hdr *);
1523 	if (nd6_is_addr_neighbor(&sip6->ip6_src, ifp) == 0)
1524 		goto fail;
1525 	if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst))
1526 		goto fail;	/* what should we do here? */
1527 
1528 	/* rate limit */
1529 	if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0))
1530 		goto fail;
1531 
1532 	/*
1533 	 * Since we are going to append up to 1280 bytes (= IPV6_MMTU),
1534 	 * we almost always ask for an mbuf cluster for simplicity.
1535 	 * (MHLEN < IPV6_MMTU is almost always true)
1536 	 */
1537 	MGETHDR(m, M_DONTWAIT, MT_HEADER);
1538 	if (!m)
1539 		goto fail;
1540 	if (MHLEN < IPV6_MMTU)
1541 		MCLGET(m, M_DONTWAIT);
1542 	maxlen = (m->m_flags & M_EXT) ? MCLBYTES : MHLEN;
1543 	maxlen = min(IPV6_MMTU, maxlen);
1544 	/* just for safety */
1545 	if (maxlen < sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr))
1546 		goto fail;
1547 
1548 	{
1549 		/* get ip6 linklocal address for ifp(my outgoing interface). */
1550 		struct in6_ifaddr *ia = in6ifa_ifpforlinklocal(ifp);
1551 		if (ia == NULL)
1552 			goto fail;
1553 		ifp_ll6 = &ia->ia_addr.sin6_addr;
1554 	}
1555 
1556 	/* get ip6 linklocal address for the router. */
1557 	if (rt->rt_gateway && (rt->rt_flags & RTF_GATEWAY)) {
1558 		struct sockaddr_in6 *sin6;
1559 		sin6 = (struct sockaddr_in6 *)rt->rt_gateway;
1560 		router_ll6 = &sin6->sin6_addr;
1561 		if (!IN6_IS_ADDR_LINKLOCAL(router_ll6))
1562 			router_ll6 = (struct in6_addr *)NULL;
1563 	} else
1564 		router_ll6 = (struct in6_addr *)NULL;
1565 
1566 	/* ip6 */
1567 	ip6 = mtod(m, struct ip6_hdr *);
1568 	ip6->ip6_flow = 0;
1569 	ip6->ip6_vfc = IPV6_VERSION;
1570 	/* ip6->ip6_plen will be set later */
1571 	ip6->ip6_nxt = IPPROTO_ICMPV6;
1572 	ip6->ip6_hlim = 255;
1573 	/* ip6->ip6_src must be linklocal addr for my outgoing if. */
1574 	bcopy(ifp_ll6, &ip6->ip6_src, sizeof(struct in6_addr));
1575 	bcopy(&sip6->ip6_src, &ip6->ip6_dst, sizeof(struct in6_addr));
1576 
1577 	/* ND Redirect */
1578 	nd_rd = (struct nd_redirect *)(ip6 + 1);
1579 	nd_rd->nd_rd_type = ND_REDIRECT;
1580 	nd_rd->nd_rd_code = 0;
1581 	nd_rd->nd_rd_reserved = 0;
1582 	if (rt->rt_flags & RTF_GATEWAY) {
1583 		/*
1584 		 * nd_rd->nd_rd_target must be a link-local address in
1585 		 * better router cases.
1586 		 */
1587 		if (!router_ll6)
1588 			goto fail;
1589 		bcopy(router_ll6, &nd_rd->nd_rd_target,
1590 		      sizeof(nd_rd->nd_rd_target));
1591 		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
1592 		      sizeof(nd_rd->nd_rd_dst));
1593 	} else {
1594 		/* make sure redtgt == reddst */
1595 		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_target,
1596 		      sizeof(nd_rd->nd_rd_target));
1597 		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
1598 		      sizeof(nd_rd->nd_rd_dst));
1599 	}
1600 
1601 	p = (u_char *)(nd_rd + 1);
1602 
1603 	if (!router_ll6)
1604 		goto nolladdropt;
1605 
1606     {
1607 	/* target lladdr option */
1608 	struct rtentry *rt_router = NULL;
1609 	int len;
1610 	struct sockaddr_dl *sdl;
1611 	struct nd_opt_hdr *nd_opt;
1612 	char *lladdr;
1613 
1614 	rt_router = nd6_lookup(router_ll6, 0, ifp);
1615 	if (!rt_router)
1616 		goto nolladdropt;
1617 	if (!(rt_router->rt_flags & RTF_GATEWAY)
1618 	 && (rt_router->rt_flags & RTF_LLINFO)
1619 	 && (rt_router->rt_gateway->sa_family == AF_LINK)
1620 	 && (sdl = (struct sockaddr_dl *)rt_router->rt_gateway)) {
1621 		nd_opt = (struct nd_opt_hdr *)p;
1622 		nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
1623 		len = 2 + ifp->if_addrlen;
1624 		len = (len + 7) & ~7;	/*round by 8*/
1625 		nd_opt->nd_opt_len = len >> 3;
1626 		p += len;
1627 		lladdr = (char *)(nd_opt + 1);
1628 		bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen);
1629 	}
1630     }
1631 nolladdropt:;
1632 
1633 	m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
1634 
1635 	/* just to be safe */
1636 	if (m0->m_flags & M_DECRYPTED)
1637 		goto noredhdropt;
1638 
1639     {
1640 	/* redirected header option */
1641 	int len;
1642 	struct nd_opt_rd_hdr *nd_opt_rh;
1643 
1644 	/*
1645 	 * compute the maximum size for icmp6 redirect header option.
1646 	 * XXX room for auth header?
1647 	 */
1648 	len = maxlen - (p - (u_char *)ip6);
1649 	len &= ~7;
1650 
1651 	/* This is just for simplicity. */
1652 	if (m0->m_pkthdr.len != m0->m_len) {
1653 		if (m0->m_next) {
1654 			m_freem(m0->m_next);
1655 			m0->m_next = NULL;
1656 		}
1657 		m0->m_pkthdr.len = m0->m_len;
1658 	}
1659 
1660 	/*
1661 	 * Redirected header option spec (RFC2461 4.6.3) talks nothing
1662 	 * about padding/truncate rule for the original IP packet.
1663 	 * From the discussion on IPv6imp in Feb 1999, the consensus was:
1664 	 * - "attach as much as possible" is the goal
1665 	 * - pad if not aligned (original size can be guessed by original
1666 	 *   ip6 header)
1667 	 * Following code adds the padding if it is simple enough,
1668 	 * and truncates if not.
1669 	 */
1670 	if (m0->m_next || m0->m_pkthdr.len != m0->m_len)
1671 		panic("assumption failed in %s:%d\n", __FILE__, __LINE__);
1672 
1673 	if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) {
1674 		/* not enough room, truncate */
1675 		m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
1676 	} else {
1677 		/* enough room, pad or truncate */
1678 		size_t extra;
1679 
1680 		extra = m0->m_pkthdr.len % 8;
1681 		if (extra) {
1682 			/* pad if easy enough, truncate if not */
1683 			if (8 - extra <= M_TRAILINGSPACE(m0)) {
1684 				/* pad */
1685 				m0->m_len += (8 - extra);
1686 				m0->m_pkthdr.len += (8 - extra);
1687 			} else {
1688 				/* truncate */
1689 				m0->m_pkthdr.len -= extra;
1690 				m0->m_len -= extra;
1691 			}
1692 		}
1693 		len = m0->m_pkthdr.len + sizeof(*nd_opt_rh);
1694 		m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
1695 	}
1696 
1697 	nd_opt_rh = (struct nd_opt_rd_hdr *)p;
1698 	bzero(nd_opt_rh, sizeof(*nd_opt_rh));
1699 	nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER;
1700 	nd_opt_rh->nd_opt_rh_len = len >> 3;
1701 	p += sizeof(*nd_opt_rh);
1702 	m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
1703 
1704 	/* connect m0 to m */
1705 	m->m_next = m0;
1706 	m->m_pkthdr.len = m->m_len + m0->m_len;
1707     }
1708 noredhdropt:;
1709 
1710 	if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_src))
1711 		sip6->ip6_src.s6_addr16[1] = 0;
1712 	if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_dst))
1713 		sip6->ip6_dst.s6_addr16[1] = 0;
1714 	if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_target))
1715 		nd_rd->nd_rd_target.s6_addr16[1] = 0;
1716 	if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_dst))
1717 		nd_rd->nd_rd_dst.s6_addr16[1] = 0;
1718 
1719 	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
1720 
1721 	nd_rd->nd_rd_cksum = 0;
1722 	nd_rd->nd_rd_cksum
1723 		= in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), ntohs(ip6->ip6_plen));
1724 
1725 	/* send the packet to outside... */
1726 	ip6_output(m, NULL, NULL, 0, NULL, &outif);
1727 	if (outif) {
1728 		icmp6_ifstat_inc(outif, ifs6_out_msg);
1729 		icmp6_ifstat_inc(outif, ifs6_out_redirect);
1730 	}
1731 	icmp6stat.icp6s_outhist[ND_REDIRECT]++;
1732 
1733 	return;
1734 
1735 fail:
1736 	if (m)
1737 		m_freem(m);
1738 	if (m0)
1739 		m_freem(m0);
1740 }
1741 
1742 /*
1743  * ICMPv6 socket option processing.
1744  */
1745 int
1746 icmp6_ctloutput(so, sopt)
1747 	struct socket *so;
1748 	struct sockopt *sopt;
1749 {
1750 	int error = 0;
1751 	int optlen;
1752 	register struct inpcb *inp = sotoinpcb(so);
1753 	int level, op, optname;
1754 
1755 	if (sopt) {
1756 		level = sopt->sopt_level;
1757 		op = sopt->sopt_dir;
1758 		optname = sopt->sopt_name;
1759 		optlen = sopt->sopt_valsize;
1760 	} else
1761 		level = op = optname = optlen = 0;
1762 	if (level != IPPROTO_ICMPV6) {
1763 		return EINVAL;
1764 	}
1765 
1766 	switch(op) {
1767 	case PRCO_SETOPT:
1768 		switch (optname) {
1769 		case ICMP6_FILTER:
1770 		    {
1771 			struct icmp6_filter *p;
1772 
1773 			if (optlen != sizeof(*p)) {
1774 				error = EMSGSIZE;
1775 				break;
1776 			}
1777 			if (inp->in6p_icmp6filt == NULL) {
1778 				error = EINVAL;
1779 				break;
1780 			}
1781 			error = sooptcopyin(sopt, inp->in6p_icmp6filt, optlen,
1782 				optlen);
1783 			break;
1784 		    }
1785 
1786 		default:
1787 			error = ENOPROTOOPT;
1788 			break;
1789 		}
1790 		break;
1791 
1792 	case PRCO_GETOPT:
1793 		switch (optname) {
1794 		case ICMP6_FILTER:
1795 		    {
1796 			if (inp->in6p_icmp6filt == NULL) {
1797 				error = EINVAL;
1798 				break;
1799 			}
1800 			error = sooptcopyout(sopt, inp->in6p_icmp6filt,
1801 				sizeof(struct icmp6_filter));
1802 			break;
1803 		    }
1804 
1805 		default:
1806 			error = ENOPROTOOPT;
1807 			break;
1808 		}
1809 		break;
1810 	}
1811 
1812 	return(error);
1813 }
1814 
1815 /*
1816  * Perform rate limit check.
1817  * Returns 0 if it is okay to send the icmp6 packet.
1818  * Returns 1 if the router SHOULD NOT send this icmp6 packet due to rate
1819  * limitation.
1820  *
1821  * XXX per-destination/type check necessary?
1822  */
1823 static int
1824 icmp6_ratelimit(dst, type, code)
1825 	const struct in6_addr *dst;	/* not used at this moment */
1826 	const int type;			/* not used at this moment */
1827 	const int code;			/* not used at this moment */
1828 {
1829 	struct timeval tp;
1830 	long sec_diff, usec_diff;
1831 
1832 	/* If we are not doing rate limitation, it is always okay to send */
1833 	if (!icmp6errratelim)
1834 		return 0;
1835 
1836 	microtime(&tp);
1837 	tp.tv_sec = time_second;
1838 	if (tp.tv_sec < icmp6_nextsend.tv_sec
1839 	 || (tp.tv_sec == icmp6_nextsend.tv_sec
1840 	  && tp.tv_usec < icmp6_nextsend.tv_usec)) {
1841 		/* The packet is subject to rate limit */
1842 		return 1;
1843 	}
1844 	sec_diff = icmp6errratelim / 1000000;
1845 	usec_diff = icmp6errratelim % 1000000;
1846 	icmp6_nextsend.tv_sec = tp.tv_sec + sec_diff;
1847 	if ((tp.tv_usec = tp.tv_usec + usec_diff) >= 1000000) {
1848 		icmp6_nextsend.tv_sec++;
1849 		icmp6_nextsend.tv_usec -= 1000000;
1850 	}
1851 
1852 	/* it is okay to send this */
1853 	return 0;
1854 }
1855