xref: /freebsd/sys/netinet6/in6_src.c (revision d6385b1c0b5e0246956c3c1abc6eb0f75cea93f0)
1686cdd19SJun-ichiro itojun Hagino /*	$FreeBSD$	*/
2d6385b1cSHajimu UMEMOTO /*	$KAME: in6_src.c,v 1.132 2003/08/26 04:42:27 keiichi Exp $	*/
3686cdd19SJun-ichiro itojun Hagino 
4686cdd19SJun-ichiro itojun Hagino /*
5686cdd19SJun-ichiro itojun Hagino  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6686cdd19SJun-ichiro itojun Hagino  * All rights reserved.
7686cdd19SJun-ichiro itojun Hagino  *
8686cdd19SJun-ichiro itojun Hagino  * Redistribution and use in source and binary forms, with or without
9686cdd19SJun-ichiro itojun Hagino  * modification, are permitted provided that the following conditions
10686cdd19SJun-ichiro itojun Hagino  * are met:
11686cdd19SJun-ichiro itojun Hagino  * 1. Redistributions of source code must retain the above copyright
12686cdd19SJun-ichiro itojun Hagino  *    notice, this list of conditions and the following disclaimer.
13686cdd19SJun-ichiro itojun Hagino  * 2. Redistributions in binary form must reproduce the above copyright
14686cdd19SJun-ichiro itojun Hagino  *    notice, this list of conditions and the following disclaimer in the
15686cdd19SJun-ichiro itojun Hagino  *    documentation and/or other materials provided with the distribution.
16686cdd19SJun-ichiro itojun Hagino  * 3. Neither the name of the project nor the names of its contributors
17686cdd19SJun-ichiro itojun Hagino  *    may be used to endorse or promote products derived from this software
18686cdd19SJun-ichiro itojun Hagino  *    without specific prior written permission.
19686cdd19SJun-ichiro itojun Hagino  *
20686cdd19SJun-ichiro itojun Hagino  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21686cdd19SJun-ichiro itojun Hagino  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22686cdd19SJun-ichiro itojun Hagino  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23686cdd19SJun-ichiro itojun Hagino  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24686cdd19SJun-ichiro itojun Hagino  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25686cdd19SJun-ichiro itojun Hagino  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26686cdd19SJun-ichiro itojun Hagino  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27686cdd19SJun-ichiro itojun Hagino  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28686cdd19SJun-ichiro itojun Hagino  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29686cdd19SJun-ichiro itojun Hagino  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30686cdd19SJun-ichiro itojun Hagino  * SUCH DAMAGE.
31686cdd19SJun-ichiro itojun Hagino  */
32686cdd19SJun-ichiro itojun Hagino 
33686cdd19SJun-ichiro itojun Hagino /*
34686cdd19SJun-ichiro itojun Hagino  * Copyright (c) 1982, 1986, 1991, 1993
35686cdd19SJun-ichiro itojun Hagino  *	The Regents of the University of California.  All rights reserved.
36686cdd19SJun-ichiro itojun Hagino  *
37686cdd19SJun-ichiro itojun Hagino  * Redistribution and use in source and binary forms, with or without
38686cdd19SJun-ichiro itojun Hagino  * modification, are permitted provided that the following conditions
39686cdd19SJun-ichiro itojun Hagino  * are met:
40686cdd19SJun-ichiro itojun Hagino  * 1. Redistributions of source code must retain the above copyright
41686cdd19SJun-ichiro itojun Hagino  *    notice, this list of conditions and the following disclaimer.
42686cdd19SJun-ichiro itojun Hagino  * 2. Redistributions in binary form must reproduce the above copyright
43686cdd19SJun-ichiro itojun Hagino  *    notice, this list of conditions and the following disclaimer in the
44686cdd19SJun-ichiro itojun Hagino  *    documentation and/or other materials provided with the distribution.
45686cdd19SJun-ichiro itojun Hagino  * 3. All advertising materials mentioning features or use of this software
46686cdd19SJun-ichiro itojun Hagino  *    must display the following acknowledgement:
47686cdd19SJun-ichiro itojun Hagino  *	This product includes software developed by the University of
48686cdd19SJun-ichiro itojun Hagino  *	California, Berkeley and its contributors.
49686cdd19SJun-ichiro itojun Hagino  * 4. Neither the name of the University nor the names of its contributors
50686cdd19SJun-ichiro itojun Hagino  *    may be used to endorse or promote products derived from this software
51686cdd19SJun-ichiro itojun Hagino  *    without specific prior written permission.
52686cdd19SJun-ichiro itojun Hagino  *
53686cdd19SJun-ichiro itojun Hagino  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54686cdd19SJun-ichiro itojun Hagino  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55686cdd19SJun-ichiro itojun Hagino  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56686cdd19SJun-ichiro itojun Hagino  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57686cdd19SJun-ichiro itojun Hagino  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58686cdd19SJun-ichiro itojun Hagino  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59686cdd19SJun-ichiro itojun Hagino  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60686cdd19SJun-ichiro itojun Hagino  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61686cdd19SJun-ichiro itojun Hagino  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62686cdd19SJun-ichiro itojun Hagino  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63686cdd19SJun-ichiro itojun Hagino  * SUCH DAMAGE.
64686cdd19SJun-ichiro itojun Hagino  *
65686cdd19SJun-ichiro itojun Hagino  *	@(#)in_pcb.c	8.2 (Berkeley) 1/4/94
66686cdd19SJun-ichiro itojun Hagino  */
67686cdd19SJun-ichiro itojun Hagino 
68686cdd19SJun-ichiro itojun Hagino #include "opt_inet.h"
69686cdd19SJun-ichiro itojun Hagino #include "opt_inet6.h"
70686cdd19SJun-ichiro itojun Hagino 
71686cdd19SJun-ichiro itojun Hagino #include <sys/param.h>
72686cdd19SJun-ichiro itojun Hagino #include <sys/systm.h>
7333841545SHajimu UMEMOTO #include <sys/malloc.h>
74686cdd19SJun-ichiro itojun Hagino #include <sys/mbuf.h>
75686cdd19SJun-ichiro itojun Hagino #include <sys/protosw.h>
76686cdd19SJun-ichiro itojun Hagino #include <sys/socket.h>
77686cdd19SJun-ichiro itojun Hagino #include <sys/socketvar.h>
787fc91b3fSHajimu UMEMOTO #include <sys/sockio.h>
797fc91b3fSHajimu UMEMOTO #include <sys/sysctl.h>
80686cdd19SJun-ichiro itojun Hagino #include <sys/errno.h>
81686cdd19SJun-ichiro itojun Hagino #include <sys/time.h>
824a201dfcSHajimu UMEMOTO #include <sys/kernel.h>
83686cdd19SJun-ichiro itojun Hagino 
84686cdd19SJun-ichiro itojun Hagino #include <net/if.h>
85686cdd19SJun-ichiro itojun Hagino #include <net/route.h>
86686cdd19SJun-ichiro itojun Hagino 
87686cdd19SJun-ichiro itojun Hagino #include <netinet/in.h>
88686cdd19SJun-ichiro itojun Hagino #include <netinet/in_var.h>
89686cdd19SJun-ichiro itojun Hagino #include <netinet/in_systm.h>
90686cdd19SJun-ichiro itojun Hagino #include <netinet/ip.h>
91686cdd19SJun-ichiro itojun Hagino #include <netinet/in_pcb.h>
92686cdd19SJun-ichiro itojun Hagino #include <netinet6/in6_var.h>
93686cdd19SJun-ichiro itojun Hagino #include <netinet/ip6.h>
94686cdd19SJun-ichiro itojun Hagino #include <netinet6/in6_pcb.h>
95686cdd19SJun-ichiro itojun Hagino #include <netinet6/ip6_var.h>
96686cdd19SJun-ichiro itojun Hagino #include <netinet6/nd6.h>
97686cdd19SJun-ichiro itojun Hagino #ifdef ENABLE_DEFAULT_SCOPE
98686cdd19SJun-ichiro itojun Hagino #include <netinet6/scope6_var.h>
99686cdd19SJun-ichiro itojun Hagino #endif
100686cdd19SJun-ichiro itojun Hagino 
101686cdd19SJun-ichiro itojun Hagino #include <net/net_osdep.h>
102686cdd19SJun-ichiro itojun Hagino 
1037fc91b3fSHajimu UMEMOTO static struct mtx addrsel_lock;
1047fc91b3fSHajimu UMEMOTO #define	ADDRSEL_LOCK_INIT()	mtx_init(&addrsel_lock, "addrsel_lock", NULL, MTX_DEF)
1057fc91b3fSHajimu UMEMOTO #define	ADDRSEL_LOCK()		mtx_lock(&addrsel_lock)
1067fc91b3fSHajimu UMEMOTO #define	ADDRSEL_UNLOCK()	mtx_unlock(&addrsel_lock)
1077fc91b3fSHajimu UMEMOTO #define	ADDRSEL_LOCK_ASSERT()	mtx_assert(&addrsel_lock, MA_OWNED)
1087fc91b3fSHajimu UMEMOTO 
1097fc91b3fSHajimu UMEMOTO #define ADDR_LABEL_NOTAPP (-1)
1107fc91b3fSHajimu UMEMOTO struct in6_addrpolicy defaultaddrpolicy;
1117fc91b3fSHajimu UMEMOTO 
112d6385b1cSHajimu UMEMOTO int ip6_prefer_tempaddr = 0;
113d6385b1cSHajimu UMEMOTO 
114d6385b1cSHajimu UMEMOTO static int in6_selectif __P((struct sockaddr_in6 *, struct ip6_pktopts *,
115d6385b1cSHajimu UMEMOTO 			     struct ip6_moptions *,
116d6385b1cSHajimu UMEMOTO 			     struct route_in6 *ro,
117d6385b1cSHajimu UMEMOTO 			     struct ifnet **));
118d6385b1cSHajimu UMEMOTO 
119d6385b1cSHajimu UMEMOTO static struct in6_addrpolicy *lookup_addrsel_policy __P((struct sockaddr_in6 *));
120d6385b1cSHajimu UMEMOTO 
1217fc91b3fSHajimu UMEMOTO static void init_policy_queue __P((void));
1227fc91b3fSHajimu UMEMOTO static int add_addrsel_policyent __P((struct in6_addrpolicy *));
1237fc91b3fSHajimu UMEMOTO static int delete_addrsel_policyent __P((struct in6_addrpolicy *));
1247fc91b3fSHajimu UMEMOTO static int walk_addrsel_policy __P((int (*)(struct in6_addrpolicy *, void *),
1257fc91b3fSHajimu UMEMOTO 				    void *));
1267fc91b3fSHajimu UMEMOTO static int dump_addrsel_policyent __P((struct in6_addrpolicy *, void *));
127d6385b1cSHajimu UMEMOTO static struct in6_addrpolicy *match_addrsel_policy __P((struct sockaddr_in6 *));
1287fc91b3fSHajimu UMEMOTO 
129686cdd19SJun-ichiro itojun Hagino /*
13033841545SHajimu UMEMOTO  * Return an IPv6 address, which is the most appropriate for a given
131686cdd19SJun-ichiro itojun Hagino  * destination and user specified options.
13233841545SHajimu UMEMOTO  * If necessary, this function lookups the routing table and returns
133686cdd19SJun-ichiro itojun Hagino  * an entry to the caller for later use.
134686cdd19SJun-ichiro itojun Hagino  */
135d6385b1cSHajimu UMEMOTO #define REPLACE(r) do {\
136d6385b1cSHajimu UMEMOTO 	if ((r) < sizeof(ip6stat.ip6s_sources_rule) / \
137d6385b1cSHajimu UMEMOTO 		sizeof(ip6stat.ip6s_sources_rule[0])) /* check for safety */ \
138d6385b1cSHajimu UMEMOTO 		ip6stat.ip6s_sources_rule[(r)]++; \
139d6385b1cSHajimu UMEMOTO 	/* printf("in6_selectsrc: replace %s with %s by %d\n", ia_best ? ip6_sprintf(&ia_best->ia_addr.sin6_addr) : "none", ip6_sprintf(&ia->ia_addr.sin6_addr), (r)); */ \
140d6385b1cSHajimu UMEMOTO 	goto replace; \
141d6385b1cSHajimu UMEMOTO } while(0)
142d6385b1cSHajimu UMEMOTO #define NEXT(r) do {\
143d6385b1cSHajimu UMEMOTO 	if ((r) < sizeof(ip6stat.ip6s_sources_rule) / \
144d6385b1cSHajimu UMEMOTO 		sizeof(ip6stat.ip6s_sources_rule[0])) /* check for safety */ \
145d6385b1cSHajimu UMEMOTO 		ip6stat.ip6s_sources_rule[(r)]++; \
146d6385b1cSHajimu UMEMOTO 	/* printf("in6_selectsrc: keep %s against %s by %d\n", ia_best ? ip6_sprintf(&ia_best->ia_addr.sin6_addr) : "none", ip6_sprintf(&ia->ia_addr.sin6_addr), (r)); */ \
147d6385b1cSHajimu UMEMOTO 	goto next; 		/* XXX: we can't use 'continue' here */ \
148d6385b1cSHajimu UMEMOTO } while(0)
149d6385b1cSHajimu UMEMOTO #define BREAK(r) do { \
150d6385b1cSHajimu UMEMOTO 	if ((r) < sizeof(ip6stat.ip6s_sources_rule) / \
151d6385b1cSHajimu UMEMOTO 		sizeof(ip6stat.ip6s_sources_rule[0])) /* check for safety */ \
152d6385b1cSHajimu UMEMOTO 		ip6stat.ip6s_sources_rule[(r)]++; \
153d6385b1cSHajimu UMEMOTO 	goto out; 		/* XXX: we can't use 'break' here */ \
154d6385b1cSHajimu UMEMOTO } while(0)
155d6385b1cSHajimu UMEMOTO 
156686cdd19SJun-ichiro itojun Hagino struct in6_addr *
157686cdd19SJun-ichiro itojun Hagino in6_selectsrc(dstsock, opts, mopts, ro, laddr, errorp)
158686cdd19SJun-ichiro itojun Hagino 	struct sockaddr_in6 *dstsock;
159686cdd19SJun-ichiro itojun Hagino 	struct ip6_pktopts *opts;
160686cdd19SJun-ichiro itojun Hagino 	struct ip6_moptions *mopts;
161686cdd19SJun-ichiro itojun Hagino 	struct route_in6 *ro;
162686cdd19SJun-ichiro itojun Hagino 	struct in6_addr *laddr;
163686cdd19SJun-ichiro itojun Hagino 	int *errorp;
164686cdd19SJun-ichiro itojun Hagino {
165686cdd19SJun-ichiro itojun Hagino 	struct in6_addr *dst;
166d6385b1cSHajimu UMEMOTO 	struct ifnet *ifp = NULL;
167d6385b1cSHajimu UMEMOTO 	struct in6_ifaddr *ia = NULL, *ia_best = NULL;
168686cdd19SJun-ichiro itojun Hagino 	struct in6_pktinfo *pi = NULL;
169d6385b1cSHajimu UMEMOTO 	int dst_scope = -1, best_scope = -1, best_matchlen = -1;
170d6385b1cSHajimu UMEMOTO 	struct in6_addrpolicy *dst_policy = NULL, *best_policy = NULL;
171d6385b1cSHajimu UMEMOTO 	u_int32_t odstzone;
172d6385b1cSHajimu UMEMOTO 	int prefer_tempaddr;
173686cdd19SJun-ichiro itojun Hagino 
174686cdd19SJun-ichiro itojun Hagino 	dst = &dstsock->sin6_addr;
175686cdd19SJun-ichiro itojun Hagino 	*errorp = 0;
176686cdd19SJun-ichiro itojun Hagino 
177686cdd19SJun-ichiro itojun Hagino 	/*
178686cdd19SJun-ichiro itojun Hagino 	 * If the source address is explicitly specified by the caller,
179d6385b1cSHajimu UMEMOTO 	 * check if the requested source address is indeed a unicast address
180d6385b1cSHajimu UMEMOTO 	 * assigned to the node, and can be used as the packet's source
181d6385b1cSHajimu UMEMOTO 	 * address.  If everything is okay, use the address as source.
182686cdd19SJun-ichiro itojun Hagino 	 */
183686cdd19SJun-ichiro itojun Hagino 	if (opts && (pi = opts->ip6po_pktinfo) &&
184d6385b1cSHajimu UMEMOTO 	    !IN6_IS_ADDR_UNSPECIFIED(&pi->ipi6_addr)) {
185d6385b1cSHajimu UMEMOTO 		struct sockaddr_in6 srcsock;
186d6385b1cSHajimu UMEMOTO 		struct in6_ifaddr *ia6;
187d6385b1cSHajimu UMEMOTO 
188d6385b1cSHajimu UMEMOTO 		/* get the outgoing interface */
189d6385b1cSHajimu UMEMOTO 		if ((*errorp = in6_selectif(dstsock, opts, mopts, ro, &ifp))
190d6385b1cSHajimu UMEMOTO 		    != 0) {
191d6385b1cSHajimu UMEMOTO 			return (NULL);
192d6385b1cSHajimu UMEMOTO 		}
193686cdd19SJun-ichiro itojun Hagino 
194686cdd19SJun-ichiro itojun Hagino 		/*
195d6385b1cSHajimu UMEMOTO 		 * determine the appropriate zone id of the source based on
196d6385b1cSHajimu UMEMOTO 		 * the zone of the destination and the outgoing interface.
197d6385b1cSHajimu UMEMOTO 		 */
198d6385b1cSHajimu UMEMOTO 		bzero(&srcsock, sizeof(srcsock));
199d6385b1cSHajimu UMEMOTO 		srcsock.sin6_family = AF_INET6;
200d6385b1cSHajimu UMEMOTO 		srcsock.sin6_len = sizeof(srcsock);
201d6385b1cSHajimu UMEMOTO 		srcsock.sin6_addr = pi->ipi6_addr;
202d6385b1cSHajimu UMEMOTO 		if (ifp) {
203d6385b1cSHajimu UMEMOTO 			if (in6_addr2zoneid(ifp, &pi->ipi6_addr,
204d6385b1cSHajimu UMEMOTO 					    &srcsock.sin6_scope_id)) {
205d6385b1cSHajimu UMEMOTO 				*errorp = EINVAL; /* XXX */
206d6385b1cSHajimu UMEMOTO 				return (NULL);
207d6385b1cSHajimu UMEMOTO 			}
208d6385b1cSHajimu UMEMOTO 		}
209d6385b1cSHajimu UMEMOTO 		if ((*errorp = in6_embedscope(&srcsock.sin6_addr, &srcsock,
210d6385b1cSHajimu UMEMOTO 		    NULL, NULL)) != 0) {
211d6385b1cSHajimu UMEMOTO 			return (NULL);
212d6385b1cSHajimu UMEMOTO 		}
213d6385b1cSHajimu UMEMOTO 		srcsock.sin6_scope_id = 0; /* XXX: ifa_ifwithaddr expects 0 */
214d6385b1cSHajimu UMEMOTO 		ia6 = (struct in6_ifaddr *)ifa_ifwithaddr((struct sockaddr *)(&srcsock));
215d6385b1cSHajimu UMEMOTO 		if (ia6 == NULL ||
216d6385b1cSHajimu UMEMOTO 		    (ia6->ia6_flags & (IN6_IFF_ANYCAST | IN6_IFF_NOTREADY))) {
217d6385b1cSHajimu UMEMOTO 			*errorp = EADDRNOTAVAIL;
218d6385b1cSHajimu UMEMOTO 			return (NULL);
219d6385b1cSHajimu UMEMOTO 		}
220d6385b1cSHajimu UMEMOTO 		pi->ipi6_addr = srcsock.sin6_addr; /* XXX: this overrides pi */
221d6385b1cSHajimu UMEMOTO 		return (&ia6->ia_addr.sin6_addr);
222d6385b1cSHajimu UMEMOTO 	}
223d6385b1cSHajimu UMEMOTO 
224d6385b1cSHajimu UMEMOTO 	/*
225d6385b1cSHajimu UMEMOTO 	 * Otherwise, if the socket has already bound the source, just use it.
226686cdd19SJun-ichiro itojun Hagino 	 */
227686cdd19SJun-ichiro itojun Hagino 	if (laddr && !IN6_IS_ADDR_UNSPECIFIED(laddr))
228686cdd19SJun-ichiro itojun Hagino 		return (laddr);
229686cdd19SJun-ichiro itojun Hagino 
230686cdd19SJun-ichiro itojun Hagino 	/*
231686cdd19SJun-ichiro itojun Hagino 	 * If the destination address is a link-local unicast address or
232686cdd19SJun-ichiro itojun Hagino 	 * a multicast address, and if the outgoing interface is specified
233686cdd19SJun-ichiro itojun Hagino 	 * by the sin6_scope_id filed, use an address associated with the
234686cdd19SJun-ichiro itojun Hagino 	 * interface.
235686cdd19SJun-ichiro itojun Hagino 	 * XXX: We're now trying to define more specific semantics of
236686cdd19SJun-ichiro itojun Hagino 	 *      sin6_scope_id field, so this part will be rewritten in
237686cdd19SJun-ichiro itojun Hagino 	 *      the near future.
238686cdd19SJun-ichiro itojun Hagino 	 */
239686cdd19SJun-ichiro itojun Hagino 	if ((IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst)) &&
240686cdd19SJun-ichiro itojun Hagino 	    dstsock->sin6_scope_id) {
241686cdd19SJun-ichiro itojun Hagino 		/*
242686cdd19SJun-ichiro itojun Hagino 		 * I'm not sure if boundary check for scope_id is done
243686cdd19SJun-ichiro itojun Hagino 		 * somewhere...
244686cdd19SJun-ichiro itojun Hagino 		 */
245686cdd19SJun-ichiro itojun Hagino 		if (dstsock->sin6_scope_id < 0 ||
246686cdd19SJun-ichiro itojun Hagino 		    if_index < dstsock->sin6_scope_id) {
247686cdd19SJun-ichiro itojun Hagino 			*errorp = ENXIO; /* XXX: better error? */
248686cdd19SJun-ichiro itojun Hagino 			return (0);
249686cdd19SJun-ichiro itojun Hagino 		}
250d6385b1cSHajimu UMEMOTO 		ia = in6_ifawithscope(ifnet_byindex(dstsock->sin6_scope_id),
251686cdd19SJun-ichiro itojun Hagino 				      dst);
252d6385b1cSHajimu UMEMOTO 		if (ia == 0) {
253686cdd19SJun-ichiro itojun Hagino 			*errorp = EADDRNOTAVAIL;
254686cdd19SJun-ichiro itojun Hagino 			return (0);
255686cdd19SJun-ichiro itojun Hagino 		}
256d6385b1cSHajimu UMEMOTO 		return (&ia->ia_addr.sin6_addr);
257686cdd19SJun-ichiro itojun Hagino 	}
258686cdd19SJun-ichiro itojun Hagino 
259686cdd19SJun-ichiro itojun Hagino 	/*
260d6385b1cSHajimu UMEMOTO 	 * If the address is not specified, choose the best one based on
261d6385b1cSHajimu UMEMOTO 	 * the outgoing interface and the destination address.
262686cdd19SJun-ichiro itojun Hagino 	 */
263d6385b1cSHajimu UMEMOTO 	/* get the outgoing interface */
264d6385b1cSHajimu UMEMOTO 	if ((*errorp = in6_selectif(dstsock, opts, mopts, ro, &ifp)) != 0)
265d6385b1cSHajimu UMEMOTO 		return (NULL);
266686cdd19SJun-ichiro itojun Hagino 
267d6385b1cSHajimu UMEMOTO #ifdef DIAGNOSTIC
268d6385b1cSHajimu UMEMOTO 	if (ifp == NULL)	/* this should not happen */
269d6385b1cSHajimu UMEMOTO 		panic("in6_selectsrc: NULL ifp");
270d6385b1cSHajimu UMEMOTO #endif
271d6385b1cSHajimu UMEMOTO 	if (in6_addr2zoneid(ifp, dst, &odstzone)) { /* impossible */
272d6385b1cSHajimu UMEMOTO 		*errorp = EIO;	/* XXX */
273d6385b1cSHajimu UMEMOTO 		return (NULL);
274d6385b1cSHajimu UMEMOTO 	}
275d6385b1cSHajimu UMEMOTO 	for (ia = in6_ifaddr; ia; ia = ia->ia_next) {
276d6385b1cSHajimu UMEMOTO 		int new_scope = -1, new_matchlen = -1;
277d6385b1cSHajimu UMEMOTO 		struct in6_addrpolicy *new_policy = NULL;
278d6385b1cSHajimu UMEMOTO 		u_int32_t srczone, osrczone, dstzone;
279d6385b1cSHajimu UMEMOTO 		struct ifnet *ifp1 = ia->ia_ifp;
280d6385b1cSHajimu UMEMOTO 
281d6385b1cSHajimu UMEMOTO 		/*
282d6385b1cSHajimu UMEMOTO 		 * We'll never take an address that breaks the scope zone
283d6385b1cSHajimu UMEMOTO 		 * of the destination.  We also skip an address if its zone
284d6385b1cSHajimu UMEMOTO 		 * does not contain the outgoing interface.
285d6385b1cSHajimu UMEMOTO 		 * XXX: we should probably use sin6_scope_id here.
286d6385b1cSHajimu UMEMOTO 		 */
287d6385b1cSHajimu UMEMOTO 		if (in6_addr2zoneid(ifp1, dst, &dstzone) ||
288d6385b1cSHajimu UMEMOTO 		    odstzone != dstzone) {
289d6385b1cSHajimu UMEMOTO 			continue;
290d6385b1cSHajimu UMEMOTO 		}
291d6385b1cSHajimu UMEMOTO 		if (in6_addr2zoneid(ifp, &ia->ia_addr.sin6_addr, &osrczone) ||
292d6385b1cSHajimu UMEMOTO 		    in6_addr2zoneid(ifp1, &ia->ia_addr.sin6_addr, &srczone) ||
293d6385b1cSHajimu UMEMOTO 		    osrczone != srczone) {
294d6385b1cSHajimu UMEMOTO 			continue;
295686cdd19SJun-ichiro itojun Hagino 		}
296686cdd19SJun-ichiro itojun Hagino 
297d6385b1cSHajimu UMEMOTO 		/* avoid unusable addresses */
298d6385b1cSHajimu UMEMOTO 		if ((ia->ia6_flags &
299d6385b1cSHajimu UMEMOTO 		     (IN6_IFF_NOTREADY | IN6_IFF_ANYCAST | IN6_IFF_DETACHED))) {
300d6385b1cSHajimu UMEMOTO 				continue;
301d6385b1cSHajimu UMEMOTO 		}
302d6385b1cSHajimu UMEMOTO 		if (!ip6_use_deprecated && IFA6_IS_DEPRECATED(ia))
303d6385b1cSHajimu UMEMOTO 			continue;
304d6385b1cSHajimu UMEMOTO 
305d6385b1cSHajimu UMEMOTO 		/* Rule 1: Prefer same address */
306d6385b1cSHajimu UMEMOTO 		if (IN6_ARE_ADDR_EQUAL(dst, &ia->ia_addr.sin6_addr)) {
307d6385b1cSHajimu UMEMOTO 			ia_best = ia;
308d6385b1cSHajimu UMEMOTO 			BREAK(1); /* there should be no better candidate */
309d6385b1cSHajimu UMEMOTO 		}
310d6385b1cSHajimu UMEMOTO 
311d6385b1cSHajimu UMEMOTO 		if (ia_best == NULL)
312d6385b1cSHajimu UMEMOTO 			REPLACE(0);
313d6385b1cSHajimu UMEMOTO 
314d6385b1cSHajimu UMEMOTO 		/* Rule 2: Prefer appropriate scope */
315d6385b1cSHajimu UMEMOTO 		if (dst_scope < 0)
316d6385b1cSHajimu UMEMOTO 			dst_scope = in6_addrscope(dst);
317d6385b1cSHajimu UMEMOTO 		new_scope = in6_addrscope(&ia->ia_addr.sin6_addr);
318d6385b1cSHajimu UMEMOTO 		if (IN6_ARE_SCOPE_CMP(best_scope, new_scope) < 0) {
319d6385b1cSHajimu UMEMOTO 			if (IN6_ARE_SCOPE_CMP(best_scope, dst_scope) < 0)
320d6385b1cSHajimu UMEMOTO 				REPLACE(2);
321d6385b1cSHajimu UMEMOTO 			NEXT(2);
322d6385b1cSHajimu UMEMOTO 		} else if (IN6_ARE_SCOPE_CMP(new_scope, best_scope) < 0) {
323d6385b1cSHajimu UMEMOTO 			if (IN6_ARE_SCOPE_CMP(new_scope, dst_scope) < 0)
324d6385b1cSHajimu UMEMOTO 				NEXT(2);
325d6385b1cSHajimu UMEMOTO 			REPLACE(2);
326d6385b1cSHajimu UMEMOTO 		}
327d6385b1cSHajimu UMEMOTO 
328d6385b1cSHajimu UMEMOTO 		/*
329d6385b1cSHajimu UMEMOTO 		 * Rule 3: Avoid deprecated addresses.  Note that the case of
330d6385b1cSHajimu UMEMOTO 		 * !ip6_use_deprecated is already rejected above.
331d6385b1cSHajimu UMEMOTO 		 */
332d6385b1cSHajimu UMEMOTO 		if (!IFA6_IS_DEPRECATED(ia_best) && IFA6_IS_DEPRECATED(ia))
333d6385b1cSHajimu UMEMOTO 			NEXT(3);
334d6385b1cSHajimu UMEMOTO 		if (IFA6_IS_DEPRECATED(ia_best) && !IFA6_IS_DEPRECATED(ia))
335d6385b1cSHajimu UMEMOTO 			REPLACE(3);
336d6385b1cSHajimu UMEMOTO 
337d6385b1cSHajimu UMEMOTO 		/* Rule 4: Prefer home addresses */
338d6385b1cSHajimu UMEMOTO 		/*
339d6385b1cSHajimu UMEMOTO 		 * XXX: This is a TODO.  We should probably merge the MIP6
340d6385b1cSHajimu UMEMOTO 		 * case above.
341d6385b1cSHajimu UMEMOTO 		 */
342d6385b1cSHajimu UMEMOTO 
343d6385b1cSHajimu UMEMOTO 		/* Rule 5: Prefer outgoing interface */
344d6385b1cSHajimu UMEMOTO 		if (ia_best->ia_ifp == ifp && ia->ia_ifp != ifp)
345d6385b1cSHajimu UMEMOTO 			NEXT(5);
346d6385b1cSHajimu UMEMOTO 		if (ia_best->ia_ifp != ifp && ia->ia_ifp == ifp)
347d6385b1cSHajimu UMEMOTO 			REPLACE(5);
348d6385b1cSHajimu UMEMOTO 
349d6385b1cSHajimu UMEMOTO 		/*
350d6385b1cSHajimu UMEMOTO 		 * Rule 6: Prefer matching label
351d6385b1cSHajimu UMEMOTO 		 * Note that best_policy should be non-NULL here.
352d6385b1cSHajimu UMEMOTO 		 */
353d6385b1cSHajimu UMEMOTO 		if (dst_policy == NULL)
354d6385b1cSHajimu UMEMOTO 			dst_policy = lookup_addrsel_policy(dstsock);
355d6385b1cSHajimu UMEMOTO 		if (dst_policy->label != ADDR_LABEL_NOTAPP) {
356d6385b1cSHajimu UMEMOTO 			new_policy = lookup_addrsel_policy(&ia->ia_addr);
357d6385b1cSHajimu UMEMOTO 			if (dst_policy->label == best_policy->label &&
358d6385b1cSHajimu UMEMOTO 			    dst_policy->label != new_policy->label)
359d6385b1cSHajimu UMEMOTO 				NEXT(6);
360d6385b1cSHajimu UMEMOTO 			if (dst_policy->label != best_policy->label &&
361d6385b1cSHajimu UMEMOTO 			    dst_policy->label == new_policy->label)
362d6385b1cSHajimu UMEMOTO 				REPLACE(6);
363d6385b1cSHajimu UMEMOTO 		}
364d6385b1cSHajimu UMEMOTO 
365d6385b1cSHajimu UMEMOTO 		/*
366d6385b1cSHajimu UMEMOTO 		 * Rule 7: Prefer public addresses.
367d6385b1cSHajimu UMEMOTO 		 * We allow users to reverse the logic by configuring
368d6385b1cSHajimu UMEMOTO 		 * a sysctl variable, so that privacy conscious users can
369d6385b1cSHajimu UMEMOTO 		 * always prefer temporary addresses.
370d6385b1cSHajimu UMEMOTO 		 */
371d6385b1cSHajimu UMEMOTO 		if (opts == NULL ||
372d6385b1cSHajimu UMEMOTO 		    opts->ip6po_prefer_tempaddr == IP6PO_TEMPADDR_SYSTEM) {
373d6385b1cSHajimu UMEMOTO 			prefer_tempaddr = ip6_prefer_tempaddr;
374d6385b1cSHajimu UMEMOTO 		} else if (opts->ip6po_prefer_tempaddr ==
375d6385b1cSHajimu UMEMOTO 		    IP6PO_TEMPADDR_NOTPREFER) {
376d6385b1cSHajimu UMEMOTO 			prefer_tempaddr = 0;
377d6385b1cSHajimu UMEMOTO 		} else
378d6385b1cSHajimu UMEMOTO 			prefer_tempaddr = 1;
379d6385b1cSHajimu UMEMOTO 		if (!(ia_best->ia6_flags & IN6_IFF_TEMPORARY) &&
380d6385b1cSHajimu UMEMOTO 		    (ia->ia6_flags & IN6_IFF_TEMPORARY)) {
381d6385b1cSHajimu UMEMOTO 			if (prefer_tempaddr)
382d6385b1cSHajimu UMEMOTO 				REPLACE(7);
383d6385b1cSHajimu UMEMOTO 			else
384d6385b1cSHajimu UMEMOTO 				NEXT(7);
385d6385b1cSHajimu UMEMOTO 		}
386d6385b1cSHajimu UMEMOTO 		if ((ia_best->ia6_flags & IN6_IFF_TEMPORARY) &&
387d6385b1cSHajimu UMEMOTO 		    !(ia->ia6_flags & IN6_IFF_TEMPORARY)) {
388d6385b1cSHajimu UMEMOTO 			if (prefer_tempaddr)
389d6385b1cSHajimu UMEMOTO 				NEXT(7);
390d6385b1cSHajimu UMEMOTO 			else
391d6385b1cSHajimu UMEMOTO 				REPLACE(7);
392d6385b1cSHajimu UMEMOTO 		}
393d6385b1cSHajimu UMEMOTO 
394d6385b1cSHajimu UMEMOTO 		/*
395d6385b1cSHajimu UMEMOTO 		 * Rule 8: prefer addresses on alive interfaces.
396d6385b1cSHajimu UMEMOTO 		 * This is a KAME specific rule.
397d6385b1cSHajimu UMEMOTO 		 */
398d6385b1cSHajimu UMEMOTO 		if ((ia_best->ia_ifp->if_flags & IFF_UP) &&
399d6385b1cSHajimu UMEMOTO 		    !(ia->ia_ifp->if_flags & IFF_UP))
400d6385b1cSHajimu UMEMOTO 			NEXT(8);
401d6385b1cSHajimu UMEMOTO 		if (!(ia_best->ia_ifp->if_flags & IFF_UP) &&
402d6385b1cSHajimu UMEMOTO 		    (ia->ia_ifp->if_flags & IFF_UP))
403d6385b1cSHajimu UMEMOTO 			REPLACE(8);
404d6385b1cSHajimu UMEMOTO 
405d6385b1cSHajimu UMEMOTO 		/*
406d6385b1cSHajimu UMEMOTO 		 * Rule 14: Use longest matching prefix.
407d6385b1cSHajimu UMEMOTO 		 * Note: in the address selection draft, this rule is
408d6385b1cSHajimu UMEMOTO 		 * documented as "Rule 8".  However, since it is also
409d6385b1cSHajimu UMEMOTO 		 * documented that this rule can be overridden, we assign
410d6385b1cSHajimu UMEMOTO 		 * a large number so that it is easy to assign smaller numbers
411d6385b1cSHajimu UMEMOTO 		 * to more preferred rules.
412d6385b1cSHajimu UMEMOTO 		 */
413d6385b1cSHajimu UMEMOTO 		new_matchlen = in6_matchlen(&ia->ia_addr.sin6_addr, dst);
414d6385b1cSHajimu UMEMOTO 		if (best_matchlen < new_matchlen)
415d6385b1cSHajimu UMEMOTO 			REPLACE(14);
416d6385b1cSHajimu UMEMOTO 		if (new_matchlen < best_matchlen)
417d6385b1cSHajimu UMEMOTO 			NEXT(14);
418d6385b1cSHajimu UMEMOTO 
419d6385b1cSHajimu UMEMOTO 		/* Rule 15 is reserved. */
420d6385b1cSHajimu UMEMOTO 
421d6385b1cSHajimu UMEMOTO 		/*
422d6385b1cSHajimu UMEMOTO 		 * Last resort: just keep the current candidate.
423d6385b1cSHajimu UMEMOTO 		 * Or, do we need more rules?
424d6385b1cSHajimu UMEMOTO 		 */
425d6385b1cSHajimu UMEMOTO 		continue;
426d6385b1cSHajimu UMEMOTO 
427d6385b1cSHajimu UMEMOTO 	  replace:
428d6385b1cSHajimu UMEMOTO 		ia_best = ia;
429d6385b1cSHajimu UMEMOTO 		best_scope = (new_scope >= 0 ? new_scope :
430d6385b1cSHajimu UMEMOTO 			      in6_addrscope(&ia_best->ia_addr.sin6_addr));
431d6385b1cSHajimu UMEMOTO 		best_policy = (new_policy ? new_policy :
432d6385b1cSHajimu UMEMOTO 			       lookup_addrsel_policy(&ia_best->ia_addr));
433d6385b1cSHajimu UMEMOTO 		best_matchlen = (new_matchlen >= 0 ? new_matchlen :
434d6385b1cSHajimu UMEMOTO 				 in6_matchlen(&ia_best->ia_addr.sin6_addr,
435d6385b1cSHajimu UMEMOTO 					      dst));
436d6385b1cSHajimu UMEMOTO 
437d6385b1cSHajimu UMEMOTO 	  next:
438d6385b1cSHajimu UMEMOTO 		continue;
439d6385b1cSHajimu UMEMOTO 
440d6385b1cSHajimu UMEMOTO 	  out:
441d6385b1cSHajimu UMEMOTO 		break;
442d6385b1cSHajimu UMEMOTO 	}
443d6385b1cSHajimu UMEMOTO 
444d6385b1cSHajimu UMEMOTO 	if ((ia = ia_best) == NULL) {
445686cdd19SJun-ichiro itojun Hagino 		*errorp = EADDRNOTAVAIL;
446d6385b1cSHajimu UMEMOTO 		return (NULL);
447686cdd19SJun-ichiro itojun Hagino 	}
448686cdd19SJun-ichiro itojun Hagino 
449d6385b1cSHajimu UMEMOTO 	return (&ia->ia_addr.sin6_addr);
450d6385b1cSHajimu UMEMOTO }
451d6385b1cSHajimu UMEMOTO 
452d6385b1cSHajimu UMEMOTO static int
453d6385b1cSHajimu UMEMOTO in6_selectif(dstsock, opts, mopts, ro, retifp)
454d6385b1cSHajimu UMEMOTO 	struct sockaddr_in6 *dstsock;
455d6385b1cSHajimu UMEMOTO 	struct ip6_pktopts *opts;
456d6385b1cSHajimu UMEMOTO 	struct ip6_moptions *mopts;
457d6385b1cSHajimu UMEMOTO 	struct route_in6 *ro;
458d6385b1cSHajimu UMEMOTO 	struct ifnet **retifp;
459686cdd19SJun-ichiro itojun Hagino {
460d6385b1cSHajimu UMEMOTO 	int error, clone;
461d6385b1cSHajimu UMEMOTO 	struct rtentry *rt = NULL;
462686cdd19SJun-ichiro itojun Hagino 
463d6385b1cSHajimu UMEMOTO 	clone = IN6_IS_ADDR_MULTICAST(&dstsock->sin6_addr) ? 0 : 1;
464d6385b1cSHajimu UMEMOTO 	if ((error = in6_selectroute(dstsock, opts, mopts, ro, retifp,
465d6385b1cSHajimu UMEMOTO 				     &rt, clone)) != 0) {
466d6385b1cSHajimu UMEMOTO 		return (error);
467686cdd19SJun-ichiro itojun Hagino 	}
468686cdd19SJun-ichiro itojun Hagino 
469686cdd19SJun-ichiro itojun Hagino 	/*
470d6385b1cSHajimu UMEMOTO 	 * do not use a rejected or black hole route.
471d6385b1cSHajimu UMEMOTO 	 * XXX: this check should be done in the L2 output routine.
472d6385b1cSHajimu UMEMOTO 	 * However, if we skipped this check here, we'd see the following
473d6385b1cSHajimu UMEMOTO 	 * scenario:
474d6385b1cSHajimu UMEMOTO 	 * - install a rejected route for a scoped address prefix
475d6385b1cSHajimu UMEMOTO 	 *   (like fe80::/10)
476d6385b1cSHajimu UMEMOTO 	 * - send a packet to a destination that matches the scoped prefix,
477d6385b1cSHajimu UMEMOTO 	 *   with ambiguity about the scope zone.
478d6385b1cSHajimu UMEMOTO 	 * - pick the outgoing interface from the route, and disambiguate the
479d6385b1cSHajimu UMEMOTO 	 *   scope zone with the interface.
480d6385b1cSHajimu UMEMOTO 	 * - ip6_output() would try to get another route with the "new"
481d6385b1cSHajimu UMEMOTO 	 *   destination, which may be valid.
482d6385b1cSHajimu UMEMOTO 	 * - we'd see no error on output.
483d6385b1cSHajimu UMEMOTO 	 * Although this may not be very harmful, it should still be confusing.
484d6385b1cSHajimu UMEMOTO 	 * We thus reject the case here.
485d6385b1cSHajimu UMEMOTO 	 */
486d6385b1cSHajimu UMEMOTO 	if (rt && (rt->rt_flags & (RTF_REJECT | RTF_BLACKHOLE))) {
487d6385b1cSHajimu UMEMOTO 		return (rt->rt_flags & RTF_HOST ? EHOSTUNREACH : ENETUNREACH);
488d6385b1cSHajimu UMEMOTO 	}
489d6385b1cSHajimu UMEMOTO 
490d6385b1cSHajimu UMEMOTO 	/*
491d6385b1cSHajimu UMEMOTO 	 * Adjust the "outgoing" interface.  If we're going to loop the packet
492d6385b1cSHajimu UMEMOTO 	 * back to ourselves, the ifp would be the loopback interface.
493d6385b1cSHajimu UMEMOTO 	 * However, we'd rather know the interface associated to the
494d6385b1cSHajimu UMEMOTO 	 * destination address (which should probably be one of our own
495d6385b1cSHajimu UMEMOTO 	 * addresses.)
496d6385b1cSHajimu UMEMOTO 	 */
497d6385b1cSHajimu UMEMOTO 	if (rt && rt->rt_ifa && rt->rt_ifa->ifa_ifp)
498d6385b1cSHajimu UMEMOTO 		*retifp = rt->rt_ifa->ifa_ifp;
499d6385b1cSHajimu UMEMOTO 
500d6385b1cSHajimu UMEMOTO 	return (0);
501d6385b1cSHajimu UMEMOTO }
502d6385b1cSHajimu UMEMOTO 
503d6385b1cSHajimu UMEMOTO int
504d6385b1cSHajimu UMEMOTO in6_selectroute(dstsock, opts, mopts, ro, retifp, retrt, clone)
505d6385b1cSHajimu UMEMOTO 	struct sockaddr_in6 *dstsock;
506d6385b1cSHajimu UMEMOTO 	struct ip6_pktopts *opts;
507d6385b1cSHajimu UMEMOTO 	struct ip6_moptions *mopts;
508d6385b1cSHajimu UMEMOTO 	struct route_in6 *ro;
509d6385b1cSHajimu UMEMOTO 	struct ifnet **retifp;
510d6385b1cSHajimu UMEMOTO 	struct rtentry **retrt;
511d6385b1cSHajimu UMEMOTO 	int clone;		/* meaningful only for bsdi and freebsd. */
512d6385b1cSHajimu UMEMOTO {
513d6385b1cSHajimu UMEMOTO 	int error = 0;
514d6385b1cSHajimu UMEMOTO 	struct ifnet *ifp = NULL;
515d6385b1cSHajimu UMEMOTO 	struct rtentry *rt = NULL;
516d6385b1cSHajimu UMEMOTO 	struct sockaddr_in6 *sin6_next;
517d6385b1cSHajimu UMEMOTO 	struct in6_pktinfo *pi = NULL;
518d6385b1cSHajimu UMEMOTO 	struct in6_addr *dst = &dstsock->sin6_addr;
519d6385b1cSHajimu UMEMOTO 
520d6385b1cSHajimu UMEMOTO #if 0
521d6385b1cSHajimu UMEMOTO 	if (dstsock->sin6_addr.s6_addr32[0] == 0 &&
522d6385b1cSHajimu UMEMOTO 	    dstsock->sin6_addr.s6_addr32[1] == 0 &&
523d6385b1cSHajimu UMEMOTO 	    !IN6_IS_ADDR_LOOPBACK(&dstsock->sin6_addr)) {
524d6385b1cSHajimu UMEMOTO 		printf("in6_selectroute: strange destination %s\n",
525d6385b1cSHajimu UMEMOTO 		       ip6_sprintf(&dstsock->sin6_addr));
526d6385b1cSHajimu UMEMOTO 	} else {
527d6385b1cSHajimu UMEMOTO 		printf("in6_selectroute: destination = %s%%%d\n",
528d6385b1cSHajimu UMEMOTO 		       ip6_sprintf(&dstsock->sin6_addr),
529d6385b1cSHajimu UMEMOTO 		       dstsock->sin6_scope_id); /* for debug */
530d6385b1cSHajimu UMEMOTO 	}
531d6385b1cSHajimu UMEMOTO #endif
532d6385b1cSHajimu UMEMOTO 
533d6385b1cSHajimu UMEMOTO 	/* If the caller specify the outgoing interface explicitly, use it. */
534d6385b1cSHajimu UMEMOTO 	if (opts && (pi = opts->ip6po_pktinfo) != NULL && pi->ipi6_ifindex) {
535d6385b1cSHajimu UMEMOTO 		/* XXX boundary check is assumed to be already done. */
536d6385b1cSHajimu UMEMOTO 		ifp = ifnet_byindex(pi->ipi6_ifindex);
537d6385b1cSHajimu UMEMOTO 		if (ifp != NULL &&
538d6385b1cSHajimu UMEMOTO 		    (retrt == NULL || IN6_IS_ADDR_MULTICAST(dst))) {
539d6385b1cSHajimu UMEMOTO 			/*
540d6385b1cSHajimu UMEMOTO 			 * we do not have to check nor get the route for
541d6385b1cSHajimu UMEMOTO 			 * multicast.
542d6385b1cSHajimu UMEMOTO 			 */
543d6385b1cSHajimu UMEMOTO 			goto done;
544d6385b1cSHajimu UMEMOTO 		} else
545d6385b1cSHajimu UMEMOTO 			goto getroute;
546d6385b1cSHajimu UMEMOTO 	}
547d6385b1cSHajimu UMEMOTO 
548d6385b1cSHajimu UMEMOTO 	/*
549d6385b1cSHajimu UMEMOTO 	 * If the destination address is a multicast address and the outgoing
550d6385b1cSHajimu UMEMOTO 	 * interface for the address is specified by the caller, use it.
551d6385b1cSHajimu UMEMOTO 	 */
552d6385b1cSHajimu UMEMOTO 	if (IN6_IS_ADDR_MULTICAST(dst) &&
553d6385b1cSHajimu UMEMOTO 	    mopts != NULL && (ifp = mopts->im6o_multicast_ifp) != NULL) {
554d6385b1cSHajimu UMEMOTO 		goto done; /* we do not need a route for multicast. */
555d6385b1cSHajimu UMEMOTO 	}
556d6385b1cSHajimu UMEMOTO 
557d6385b1cSHajimu UMEMOTO   getroute:
558d6385b1cSHajimu UMEMOTO 	/*
559d6385b1cSHajimu UMEMOTO 	 * If the next hop address for the packet is specified by the caller,
560d6385b1cSHajimu UMEMOTO 	 * use it as the gateway.
561d6385b1cSHajimu UMEMOTO 	 */
562d6385b1cSHajimu UMEMOTO 	if (opts && opts->ip6po_nexthop) {
563d6385b1cSHajimu UMEMOTO 		struct route_in6 *ron;
564d6385b1cSHajimu UMEMOTO 
565d6385b1cSHajimu UMEMOTO 		sin6_next = satosin6(opts->ip6po_nexthop);
566d6385b1cSHajimu UMEMOTO 
567d6385b1cSHajimu UMEMOTO 		/* at this moment, we only support AF_INET6 next hops */
568d6385b1cSHajimu UMEMOTO 		if (sin6_next->sin6_family != AF_INET6) {
569d6385b1cSHajimu UMEMOTO 			error = EAFNOSUPPORT; /* or should we proceed? */
570d6385b1cSHajimu UMEMOTO 			goto done;
571d6385b1cSHajimu UMEMOTO 		}
572d6385b1cSHajimu UMEMOTO 
573d6385b1cSHajimu UMEMOTO 		/*
574d6385b1cSHajimu UMEMOTO 		 * If the next hop is an IPv6 address, then the node identified
575d6385b1cSHajimu UMEMOTO 		 * by that address must be a neighbor of the sending host.
576d6385b1cSHajimu UMEMOTO 		 */
577d6385b1cSHajimu UMEMOTO 		ron = &opts->ip6po_nextroute;
578d6385b1cSHajimu UMEMOTO 		if ((ron->ro_rt &&
579d6385b1cSHajimu UMEMOTO 		     (ron->ro_rt->rt_flags & (RTF_UP | RTF_LLINFO)) !=
580d6385b1cSHajimu UMEMOTO 		     (RTF_UP | RTF_LLINFO)) ||
581d6385b1cSHajimu UMEMOTO 		    !SA6_ARE_ADDR_EQUAL(satosin6(&ron->ro_dst), sin6_next)) {
582d6385b1cSHajimu UMEMOTO 			if (ron->ro_rt) {
583d6385b1cSHajimu UMEMOTO 				RTFREE(ron->ro_rt);
584d6385b1cSHajimu UMEMOTO 				ron->ro_rt = NULL;
585d6385b1cSHajimu UMEMOTO 			}
586d6385b1cSHajimu UMEMOTO 			*satosin6(&ron->ro_dst) = *sin6_next;
587d6385b1cSHajimu UMEMOTO 		}
588d6385b1cSHajimu UMEMOTO 		if (ron->ro_rt == NULL) {
589d6385b1cSHajimu UMEMOTO 			rtalloc((struct route *)ron); /* multi path case? */
590d6385b1cSHajimu UMEMOTO 			if (ron->ro_rt == NULL ||
591d6385b1cSHajimu UMEMOTO 			    !(ron->ro_rt->rt_flags & RTF_LLINFO)) {
592d6385b1cSHajimu UMEMOTO 				if (ron->ro_rt) {
593d6385b1cSHajimu UMEMOTO 					RTFREE(ron->ro_rt);
594d6385b1cSHajimu UMEMOTO 					ron->ro_rt = NULL;
595d6385b1cSHajimu UMEMOTO 				}
596d6385b1cSHajimu UMEMOTO 				error = EHOSTUNREACH;
597d6385b1cSHajimu UMEMOTO 				goto done;
598d6385b1cSHajimu UMEMOTO 			}
599d6385b1cSHajimu UMEMOTO 		}
600d6385b1cSHajimu UMEMOTO 		rt = ron->ro_rt;
601d6385b1cSHajimu UMEMOTO 		ifp = rt->rt_ifp;
602d6385b1cSHajimu UMEMOTO 
603d6385b1cSHajimu UMEMOTO 		/*
604d6385b1cSHajimu UMEMOTO 		 * When cloning is required, try to allocate a route to the
605d6385b1cSHajimu UMEMOTO 		 * destination so that the caller can store path MTU
606d6385b1cSHajimu UMEMOTO 		 * information.
607d6385b1cSHajimu UMEMOTO 		 */
608d6385b1cSHajimu UMEMOTO 		if (!clone)
609d6385b1cSHajimu UMEMOTO 			goto done;
610d6385b1cSHajimu UMEMOTO 	}
611d6385b1cSHajimu UMEMOTO 
612d6385b1cSHajimu UMEMOTO 	/*
613d6385b1cSHajimu UMEMOTO 	 * Use a cached route if it exists and is valid, else try to allocate
614d6385b1cSHajimu UMEMOTO 	 * a new one.  Note that we should check the address family of the
615d6385b1cSHajimu UMEMOTO 	 * cached destination, in case of sharing the cache with IPv4.
616686cdd19SJun-ichiro itojun Hagino 	 */
617686cdd19SJun-ichiro itojun Hagino 	if (ro) {
618686cdd19SJun-ichiro itojun Hagino 		if (ro->ro_rt &&
61954c1b882SHajimu UMEMOTO 		    (!(ro->ro_rt->rt_flags & RTF_UP) ||
620d6385b1cSHajimu UMEMOTO 		     ((struct sockaddr *)(&ro->ro_dst))->sa_family != AF_INET6 ||
62154c1b882SHajimu UMEMOTO 		     !IN6_ARE_ADDR_EQUAL(&satosin6(&ro->ro_dst)->sin6_addr,
62254c1b882SHajimu UMEMOTO 					 dst))) {
623686cdd19SJun-ichiro itojun Hagino 			RTFREE(ro->ro_rt);
624d6385b1cSHajimu UMEMOTO 			ro->ro_rt = (struct rtentry *)NULL;
625686cdd19SJun-ichiro itojun Hagino 		}
626d6385b1cSHajimu UMEMOTO 		if (ro->ro_rt == (struct rtentry *)NULL) {
62733841545SHajimu UMEMOTO 			struct sockaddr_in6 *sa6;
62833841545SHajimu UMEMOTO 
629686cdd19SJun-ichiro itojun Hagino 			/* No route yet, so try to acquire one */
630686cdd19SJun-ichiro itojun Hagino 			bzero(&ro->ro_dst, sizeof(struct sockaddr_in6));
63133841545SHajimu UMEMOTO 			sa6 = (struct sockaddr_in6 *)&ro->ro_dst;
632d6385b1cSHajimu UMEMOTO 			*sa6 = *dstsock;
633d6385b1cSHajimu UMEMOTO 			if (clone) {
634d6385b1cSHajimu UMEMOTO 				rtalloc((struct route *)ro);
635d6385b1cSHajimu UMEMOTO 			} else {
636686cdd19SJun-ichiro itojun Hagino 				ro->ro_rt = rtalloc1(&((struct route *)ro)
637d6385b1cSHajimu UMEMOTO 						     ->ro_dst, NULL, 0UL);
63837bdc280SSam Leffler 				if (ro->ro_rt)
639d1dd20beSSam Leffler 					RT_UNLOCK(ro->ro_rt);
640686cdd19SJun-ichiro itojun Hagino 			}
641686cdd19SJun-ichiro itojun Hagino 		}
642686cdd19SJun-ichiro itojun Hagino 
643686cdd19SJun-ichiro itojun Hagino 		/*
644d6385b1cSHajimu UMEMOTO 		 * do not care about the result if we have the nexthop
645d6385b1cSHajimu UMEMOTO 		 * explicitly specified.
646686cdd19SJun-ichiro itojun Hagino 		 */
647d6385b1cSHajimu UMEMOTO 		if (opts && opts->ip6po_nexthop)
648d6385b1cSHajimu UMEMOTO 			goto done;
649686cdd19SJun-ichiro itojun Hagino 
650686cdd19SJun-ichiro itojun Hagino 		if (ro->ro_rt) {
651d6385b1cSHajimu UMEMOTO 			ifp = ro->ro_rt->rt_ifp;
652d6385b1cSHajimu UMEMOTO 
653d6385b1cSHajimu UMEMOTO 			if (ifp == NULL) { /* can this really happen? */
654d6385b1cSHajimu UMEMOTO 				RTFREE(ro->ro_rt);
655d6385b1cSHajimu UMEMOTO 				ro->ro_rt = NULL;
656686cdd19SJun-ichiro itojun Hagino 			}
657686cdd19SJun-ichiro itojun Hagino 		}
658d6385b1cSHajimu UMEMOTO 		if (ro->ro_rt == NULL)
659d6385b1cSHajimu UMEMOTO 			error = EHOSTUNREACH;
660d6385b1cSHajimu UMEMOTO 		rt = ro->ro_rt;
661d6385b1cSHajimu UMEMOTO 
662d6385b1cSHajimu UMEMOTO 		/*
663d6385b1cSHajimu UMEMOTO 		 * Check if the outgoing interface conflicts with
664d6385b1cSHajimu UMEMOTO 		 * the interface specified by ipi6_ifindex (if specified).
665d6385b1cSHajimu UMEMOTO 		 * Note that loopback interface is always okay.
666d6385b1cSHajimu UMEMOTO 		 * (this may happen when we are sending a packet to one of
667d6385b1cSHajimu UMEMOTO 		 *  our own addresses.)
668d6385b1cSHajimu UMEMOTO 		 */
669d6385b1cSHajimu UMEMOTO 		if (opts && opts->ip6po_pktinfo
670d6385b1cSHajimu UMEMOTO 		    && opts->ip6po_pktinfo->ipi6_ifindex) {
671d6385b1cSHajimu UMEMOTO 			if (!(ifp->if_flags & IFF_LOOPBACK) &&
672d6385b1cSHajimu UMEMOTO 			    ifp->if_index !=
673d6385b1cSHajimu UMEMOTO 			    opts->ip6po_pktinfo->ipi6_ifindex) {
674d6385b1cSHajimu UMEMOTO 				error = EHOSTUNREACH;
675d6385b1cSHajimu UMEMOTO 				goto done;
676d6385b1cSHajimu UMEMOTO 			}
677d6385b1cSHajimu UMEMOTO 		}
678686cdd19SJun-ichiro itojun Hagino 	}
679686cdd19SJun-ichiro itojun Hagino 
680d6385b1cSHajimu UMEMOTO   done:
681d6385b1cSHajimu UMEMOTO 	if (ifp == NULL && rt == NULL) {
682d6385b1cSHajimu UMEMOTO 		/*
683d6385b1cSHajimu UMEMOTO 		 * This can happen if the caller did not pass a cached route
684d6385b1cSHajimu UMEMOTO 		 * nor any other hints.  We treat this case an error.
685d6385b1cSHajimu UMEMOTO 		 */
686d6385b1cSHajimu UMEMOTO 		error = EHOSTUNREACH;
687d6385b1cSHajimu UMEMOTO 	}
688d6385b1cSHajimu UMEMOTO 	if (error == EHOSTUNREACH)
689d6385b1cSHajimu UMEMOTO 		ip6stat.ip6s_noroute++;
690d6385b1cSHajimu UMEMOTO 
691d6385b1cSHajimu UMEMOTO 	if (retifp != NULL)
692d6385b1cSHajimu UMEMOTO 		*retifp = ifp;
693d6385b1cSHajimu UMEMOTO 	if (retrt != NULL)
694d6385b1cSHajimu UMEMOTO 		*retrt = rt;	/* rt may be NULL */
695d6385b1cSHajimu UMEMOTO 
696d6385b1cSHajimu UMEMOTO 	return (error);
697686cdd19SJun-ichiro itojun Hagino }
698686cdd19SJun-ichiro itojun Hagino 
699686cdd19SJun-ichiro itojun Hagino /*
700686cdd19SJun-ichiro itojun Hagino  * Default hop limit selection. The precedence is as follows:
701686cdd19SJun-ichiro itojun Hagino  * 1. Hoplimit value specified via ioctl.
702686cdd19SJun-ichiro itojun Hagino  * 2. (If the outgoing interface is detected) the current
703686cdd19SJun-ichiro itojun Hagino  *     hop limit of the interface specified by router advertisement.
704686cdd19SJun-ichiro itojun Hagino  * 3. The system default hoplimit.
705686cdd19SJun-ichiro itojun Hagino */
706686cdd19SJun-ichiro itojun Hagino int
707686cdd19SJun-ichiro itojun Hagino in6_selecthlim(in6p, ifp)
708686cdd19SJun-ichiro itojun Hagino 	struct in6pcb *in6p;
709686cdd19SJun-ichiro itojun Hagino 	struct ifnet *ifp;
710686cdd19SJun-ichiro itojun Hagino {
711686cdd19SJun-ichiro itojun Hagino 	if (in6p && in6p->in6p_hops >= 0)
712686cdd19SJun-ichiro itojun Hagino 		return (in6p->in6p_hops);
713686cdd19SJun-ichiro itojun Hagino 	else if (ifp)
71431b1bfe1SHajimu UMEMOTO 		return (ND_IFINFO(ifp)->chlim);
715686cdd19SJun-ichiro itojun Hagino 	else
716686cdd19SJun-ichiro itojun Hagino 		return (ip6_defhlim);
717686cdd19SJun-ichiro itojun Hagino }
718686cdd19SJun-ichiro itojun Hagino 
719686cdd19SJun-ichiro itojun Hagino /*
720686cdd19SJun-ichiro itojun Hagino  * XXX: this is borrowed from in6_pcbbind(). If possible, we should
721686cdd19SJun-ichiro itojun Hagino  * share this function by all *bsd*...
722686cdd19SJun-ichiro itojun Hagino  */
723686cdd19SJun-ichiro itojun Hagino int
724b40ce416SJulian Elischer in6_pcbsetport(laddr, inp, td)
725686cdd19SJun-ichiro itojun Hagino 	struct in6_addr *laddr;
726686cdd19SJun-ichiro itojun Hagino 	struct inpcb *inp;
727b40ce416SJulian Elischer 	struct thread *td;
728686cdd19SJun-ichiro itojun Hagino {
729686cdd19SJun-ichiro itojun Hagino 	struct socket *so = inp->inp_socket;
730686cdd19SJun-ichiro itojun Hagino 	u_int16_t lport = 0, first, last, *lastport;
731686cdd19SJun-ichiro itojun Hagino 	int count, error = 0, wild = 0;
732686cdd19SJun-ichiro itojun Hagino 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
733686cdd19SJun-ichiro itojun Hagino 
734686cdd19SJun-ichiro itojun Hagino 	/* XXX: this is redundant when called from in6_pcbbind */
735686cdd19SJun-ichiro itojun Hagino 	if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0)
736686cdd19SJun-ichiro itojun Hagino 		wild = INPLOOKUP_WILDCARD;
737686cdd19SJun-ichiro itojun Hagino 
738686cdd19SJun-ichiro itojun Hagino 	inp->inp_flags |= INP_ANONPORT;
739686cdd19SJun-ichiro itojun Hagino 
740686cdd19SJun-ichiro itojun Hagino 	if (inp->inp_flags & INP_HIGHPORT) {
741686cdd19SJun-ichiro itojun Hagino 		first = ipport_hifirstauto;	/* sysctl */
742686cdd19SJun-ichiro itojun Hagino 		last  = ipport_hilastauto;
743686cdd19SJun-ichiro itojun Hagino 		lastport = &pcbinfo->lasthi;
744686cdd19SJun-ichiro itojun Hagino 	} else if (inp->inp_flags & INP_LOWPORT) {
74544731cabSJohn Baldwin 		if (td && (error = suser(td)))
746686cdd19SJun-ichiro itojun Hagino 			return error;
747686cdd19SJun-ichiro itojun Hagino 		first = ipport_lowfirstauto;	/* 1023 */
748686cdd19SJun-ichiro itojun Hagino 		last  = ipport_lowlastauto;	/* 600 */
749686cdd19SJun-ichiro itojun Hagino 		lastport = &pcbinfo->lastlow;
750686cdd19SJun-ichiro itojun Hagino 	} else {
751686cdd19SJun-ichiro itojun Hagino 		first = ipport_firstauto;	/* sysctl */
752686cdd19SJun-ichiro itojun Hagino 		last  = ipport_lastauto;
753686cdd19SJun-ichiro itojun Hagino 		lastport = &pcbinfo->lastport;
754686cdd19SJun-ichiro itojun Hagino 	}
755686cdd19SJun-ichiro itojun Hagino 	/*
756686cdd19SJun-ichiro itojun Hagino 	 * Simple check to ensure all ports are not used up causing
757686cdd19SJun-ichiro itojun Hagino 	 * a deadlock here.
758686cdd19SJun-ichiro itojun Hagino 	 *
759686cdd19SJun-ichiro itojun Hagino 	 * We split the two cases (up and down) so that the direction
760686cdd19SJun-ichiro itojun Hagino 	 * is not being tested on each round of the loop.
761686cdd19SJun-ichiro itojun Hagino 	 */
762686cdd19SJun-ichiro itojun Hagino 	if (first > last) {
763686cdd19SJun-ichiro itojun Hagino 		/*
764686cdd19SJun-ichiro itojun Hagino 		 * counting down
765686cdd19SJun-ichiro itojun Hagino 		 */
766686cdd19SJun-ichiro itojun Hagino 		count = first - last;
767686cdd19SJun-ichiro itojun Hagino 
768686cdd19SJun-ichiro itojun Hagino 		do {
769686cdd19SJun-ichiro itojun Hagino 			if (count-- < 0) {	/* completely used? */
770686cdd19SJun-ichiro itojun Hagino 				/*
771686cdd19SJun-ichiro itojun Hagino 				 * Undo any address bind that may have
772686cdd19SJun-ichiro itojun Hagino 				 * occurred above.
773686cdd19SJun-ichiro itojun Hagino 				 */
774686cdd19SJun-ichiro itojun Hagino 				inp->in6p_laddr = in6addr_any;
775686cdd19SJun-ichiro itojun Hagino 				return (EAGAIN);
776686cdd19SJun-ichiro itojun Hagino 			}
777686cdd19SJun-ichiro itojun Hagino 			--*lastport;
778686cdd19SJun-ichiro itojun Hagino 			if (*lastport > first || *lastport < last)
779686cdd19SJun-ichiro itojun Hagino 				*lastport = first;
780686cdd19SJun-ichiro itojun Hagino 			lport = htons(*lastport);
781686cdd19SJun-ichiro itojun Hagino 		} while (in6_pcblookup_local(pcbinfo,
782686cdd19SJun-ichiro itojun Hagino 					     &inp->in6p_laddr, lport, wild));
783686cdd19SJun-ichiro itojun Hagino 	} else {
784686cdd19SJun-ichiro itojun Hagino 		/*
785686cdd19SJun-ichiro itojun Hagino 			 * counting up
786686cdd19SJun-ichiro itojun Hagino 			 */
787686cdd19SJun-ichiro itojun Hagino 		count = last - first;
788686cdd19SJun-ichiro itojun Hagino 
789686cdd19SJun-ichiro itojun Hagino 		do {
790686cdd19SJun-ichiro itojun Hagino 			if (count-- < 0) {	/* completely used? */
791686cdd19SJun-ichiro itojun Hagino 				/*
792686cdd19SJun-ichiro itojun Hagino 				 * Undo any address bind that may have
793686cdd19SJun-ichiro itojun Hagino 				 * occurred above.
794686cdd19SJun-ichiro itojun Hagino 				 */
795686cdd19SJun-ichiro itojun Hagino 				inp->in6p_laddr = in6addr_any;
796686cdd19SJun-ichiro itojun Hagino 				return (EAGAIN);
797686cdd19SJun-ichiro itojun Hagino 			}
798686cdd19SJun-ichiro itojun Hagino 			++*lastport;
799686cdd19SJun-ichiro itojun Hagino 			if (*lastport < first || *lastport > last)
800686cdd19SJun-ichiro itojun Hagino 				*lastport = first;
801686cdd19SJun-ichiro itojun Hagino 			lport = htons(*lastport);
802686cdd19SJun-ichiro itojun Hagino 		} while (in6_pcblookup_local(pcbinfo,
803686cdd19SJun-ichiro itojun Hagino 					     &inp->in6p_laddr, lport, wild));
804686cdd19SJun-ichiro itojun Hagino 	}
805686cdd19SJun-ichiro itojun Hagino 
806686cdd19SJun-ichiro itojun Hagino 	inp->inp_lport = lport;
807686cdd19SJun-ichiro itojun Hagino 	if (in_pcbinshash(inp) != 0) {
808686cdd19SJun-ichiro itojun Hagino 		inp->in6p_laddr = in6addr_any;
809686cdd19SJun-ichiro itojun Hagino 		inp->inp_lport = 0;
810686cdd19SJun-ichiro itojun Hagino 		return (EAGAIN);
811686cdd19SJun-ichiro itojun Hagino 	}
812686cdd19SJun-ichiro itojun Hagino 
813686cdd19SJun-ichiro itojun Hagino 	return (0);
814686cdd19SJun-ichiro itojun Hagino }
815686cdd19SJun-ichiro itojun Hagino 
816686cdd19SJun-ichiro itojun Hagino /*
8177efe5d92SHajimu UMEMOTO  * Generate kernel-internal form (scopeid embedded into s6_addr16[1]).
818686cdd19SJun-ichiro itojun Hagino  * If the address scope of is link-local, embed the interface index in the
819686cdd19SJun-ichiro itojun Hagino  * address.  The routine determines our precedence
820686cdd19SJun-ichiro itojun Hagino  * between advanced API scope/interface specification and basic API
821686cdd19SJun-ichiro itojun Hagino  * specification.
822686cdd19SJun-ichiro itojun Hagino  *
8237efe5d92SHajimu UMEMOTO  * This function should be nuked in the future, when we get rid of embedded
8247efe5d92SHajimu UMEMOTO  * scopeid thing.
825686cdd19SJun-ichiro itojun Hagino  *
826686cdd19SJun-ichiro itojun Hagino  * XXX actually, it is over-specification to return ifp against sin6_scope_id.
827686cdd19SJun-ichiro itojun Hagino  * there can be multiple interfaces that belong to a particular scope zone
828686cdd19SJun-ichiro itojun Hagino  * (in specification, we have 1:N mapping between a scope zone and interfaces).
829686cdd19SJun-ichiro itojun Hagino  * we may want to change the function to return something other than ifp.
830686cdd19SJun-ichiro itojun Hagino  */
831686cdd19SJun-ichiro itojun Hagino int
832686cdd19SJun-ichiro itojun Hagino in6_embedscope(in6, sin6, in6p, ifpp)
833686cdd19SJun-ichiro itojun Hagino 	struct in6_addr *in6;
834686cdd19SJun-ichiro itojun Hagino 	const struct sockaddr_in6 *sin6;
835686cdd19SJun-ichiro itojun Hagino 	struct in6pcb *in6p;
836686cdd19SJun-ichiro itojun Hagino 	struct ifnet **ifpp;
837686cdd19SJun-ichiro itojun Hagino {
838686cdd19SJun-ichiro itojun Hagino 	struct ifnet *ifp = NULL;
839d6385b1cSHajimu UMEMOTO 	u_int32_t zoneid = sin6->sin6_scope_id;
840686cdd19SJun-ichiro itojun Hagino 
841686cdd19SJun-ichiro itojun Hagino 	*in6 = sin6->sin6_addr;
842686cdd19SJun-ichiro itojun Hagino 	if (ifpp)
843686cdd19SJun-ichiro itojun Hagino 		*ifpp = NULL;
844686cdd19SJun-ichiro itojun Hagino 
845686cdd19SJun-ichiro itojun Hagino 	/*
846686cdd19SJun-ichiro itojun Hagino 	 * don't try to read sin6->sin6_addr beyond here, since the caller may
847686cdd19SJun-ichiro itojun Hagino 	 * ask us to overwrite existing sockaddr_in6
848686cdd19SJun-ichiro itojun Hagino 	 */
849686cdd19SJun-ichiro itojun Hagino 
850686cdd19SJun-ichiro itojun Hagino #ifdef ENABLE_DEFAULT_SCOPE
851d6385b1cSHajimu UMEMOTO 	if (zoneid == 0)
852d6385b1cSHajimu UMEMOTO 		zoneid = scope6_addr2default(in6);
853686cdd19SJun-ichiro itojun Hagino #endif
854686cdd19SJun-ichiro itojun Hagino 
855d6385b1cSHajimu UMEMOTO 	if (IN6_IS_SCOPE_LINKLOCAL(in6) || IN6_IS_ADDR_MC_INTFACELOCAL(in6)) {
856686cdd19SJun-ichiro itojun Hagino 		struct in6_pktinfo *pi;
857686cdd19SJun-ichiro itojun Hagino 
858d6385b1cSHajimu UMEMOTO 		/* KAME assumption: link id == interface id */
859686cdd19SJun-ichiro itojun Hagino 		if (in6p && in6p->in6p_outputopts &&
860686cdd19SJun-ichiro itojun Hagino 		    (pi = in6p->in6p_outputopts->ip6po_pktinfo) &&
861686cdd19SJun-ichiro itojun Hagino 		    pi->ipi6_ifindex) {
862f9132cebSJonathan Lemon 			ifp = ifnet_byindex(pi->ipi6_ifindex);
863686cdd19SJun-ichiro itojun Hagino 			in6->s6_addr16[1] = htons(pi->ipi6_ifindex);
864686cdd19SJun-ichiro itojun Hagino 		} else if (in6p && IN6_IS_ADDR_MULTICAST(in6) &&
865686cdd19SJun-ichiro itojun Hagino 			   in6p->in6p_moptions &&
866686cdd19SJun-ichiro itojun Hagino 			   in6p->in6p_moptions->im6o_multicast_ifp) {
867686cdd19SJun-ichiro itojun Hagino 			ifp = in6p->in6p_moptions->im6o_multicast_ifp;
868686cdd19SJun-ichiro itojun Hagino 			in6->s6_addr16[1] = htons(ifp->if_index);
869d6385b1cSHajimu UMEMOTO 		} else if (zoneid) {
870d6385b1cSHajimu UMEMOTO 			if (if_index < zoneid)
871d6385b1cSHajimu UMEMOTO 				return (ENXIO);  /* XXX EINVAL? */
872d6385b1cSHajimu UMEMOTO 			ifp = ifnet_byindex(zoneid);
873d6385b1cSHajimu UMEMOTO 
874686cdd19SJun-ichiro itojun Hagino 			/* XXX assignment to 16bit from 32bit variable */
875d6385b1cSHajimu UMEMOTO 			in6->s6_addr16[1] = htons(zoneid & 0xffff);
876686cdd19SJun-ichiro itojun Hagino 		}
877686cdd19SJun-ichiro itojun Hagino 
878686cdd19SJun-ichiro itojun Hagino 		if (ifpp)
879686cdd19SJun-ichiro itojun Hagino 			*ifpp = ifp;
880686cdd19SJun-ichiro itojun Hagino 	}
881686cdd19SJun-ichiro itojun Hagino 
882686cdd19SJun-ichiro itojun Hagino 	return 0;
883686cdd19SJun-ichiro itojun Hagino }
884686cdd19SJun-ichiro itojun Hagino 
885686cdd19SJun-ichiro itojun Hagino /*
886686cdd19SJun-ichiro itojun Hagino  * generate standard sockaddr_in6 from embedded form.
887686cdd19SJun-ichiro itojun Hagino  * touches sin6_addr and sin6_scope_id only.
888686cdd19SJun-ichiro itojun Hagino  *
889686cdd19SJun-ichiro itojun Hagino  * this function should be nuked in the future, when we get rid of
890686cdd19SJun-ichiro itojun Hagino  * embedded scopeid thing.
891686cdd19SJun-ichiro itojun Hagino  */
892686cdd19SJun-ichiro itojun Hagino int
893686cdd19SJun-ichiro itojun Hagino in6_recoverscope(sin6, in6, ifp)
894686cdd19SJun-ichiro itojun Hagino 	struct sockaddr_in6 *sin6;
895686cdd19SJun-ichiro itojun Hagino 	const struct in6_addr *in6;
896686cdd19SJun-ichiro itojun Hagino 	struct ifnet *ifp;
897686cdd19SJun-ichiro itojun Hagino {
8989a4f9608SHajimu UMEMOTO 	u_int32_t zoneid;
899686cdd19SJun-ichiro itojun Hagino 
900686cdd19SJun-ichiro itojun Hagino 	sin6->sin6_addr = *in6;
901686cdd19SJun-ichiro itojun Hagino 
902686cdd19SJun-ichiro itojun Hagino 	/*
903686cdd19SJun-ichiro itojun Hagino 	 * don't try to read *in6 beyond here, since the caller may
904686cdd19SJun-ichiro itojun Hagino 	 * ask us to overwrite existing sockaddr_in6
905686cdd19SJun-ichiro itojun Hagino 	 */
906686cdd19SJun-ichiro itojun Hagino 
907686cdd19SJun-ichiro itojun Hagino 	sin6->sin6_scope_id = 0;
9089a4f9608SHajimu UMEMOTO 	if (IN6_IS_SCOPE_LINKLOCAL(in6) || IN6_IS_ADDR_MC_INTFACELOCAL(in6)) {
909686cdd19SJun-ichiro itojun Hagino 		/*
910686cdd19SJun-ichiro itojun Hagino 		 * KAME assumption: link id == interface id
911686cdd19SJun-ichiro itojun Hagino 		 */
9129a4f9608SHajimu UMEMOTO 		zoneid = ntohs(sin6->sin6_addr.s6_addr16[1]);
9139a4f9608SHajimu UMEMOTO 		if (zoneid) {
914686cdd19SJun-ichiro itojun Hagino 			/* sanity check */
9159a4f9608SHajimu UMEMOTO 			if (zoneid < 0 || if_index < zoneid)
916686cdd19SJun-ichiro itojun Hagino 				return ENXIO;
9179a4f9608SHajimu UMEMOTO 			if (ifp && ifp->if_index != zoneid)
918686cdd19SJun-ichiro itojun Hagino 				return ENXIO;
919686cdd19SJun-ichiro itojun Hagino 			sin6->sin6_addr.s6_addr16[1] = 0;
9209a4f9608SHajimu UMEMOTO 			sin6->sin6_scope_id = zoneid;
921686cdd19SJun-ichiro itojun Hagino 		}
922686cdd19SJun-ichiro itojun Hagino 	}
923686cdd19SJun-ichiro itojun Hagino 
924686cdd19SJun-ichiro itojun Hagino 	return 0;
925686cdd19SJun-ichiro itojun Hagino }
92633841545SHajimu UMEMOTO 
92733841545SHajimu UMEMOTO /*
9287efe5d92SHajimu UMEMOTO  * just clear the embedded scope identifier.
92933841545SHajimu UMEMOTO  */
93033841545SHajimu UMEMOTO void
93133841545SHajimu UMEMOTO in6_clearscope(addr)
93233841545SHajimu UMEMOTO 	struct in6_addr *addr;
93333841545SHajimu UMEMOTO {
9349a4f9608SHajimu UMEMOTO 	if (IN6_IS_SCOPE_LINKLOCAL(addr) || IN6_IS_ADDR_MC_INTFACELOCAL(addr))
93533841545SHajimu UMEMOTO 		addr->s6_addr16[1] = 0;
93633841545SHajimu UMEMOTO }
9377fc91b3fSHajimu UMEMOTO 
9387fc91b3fSHajimu UMEMOTO void
9397fc91b3fSHajimu UMEMOTO addrsel_policy_init()
9407fc91b3fSHajimu UMEMOTO {
9417fc91b3fSHajimu UMEMOTO 	ADDRSEL_LOCK_INIT();
9427fc91b3fSHajimu UMEMOTO 
9437fc91b3fSHajimu UMEMOTO 	init_policy_queue();
9447fc91b3fSHajimu UMEMOTO 
9457fc91b3fSHajimu UMEMOTO 	/* initialize the "last resort" policy */
9467fc91b3fSHajimu UMEMOTO 	bzero(&defaultaddrpolicy, sizeof(defaultaddrpolicy));
9477fc91b3fSHajimu UMEMOTO 	defaultaddrpolicy.label = ADDR_LABEL_NOTAPP;
9487fc91b3fSHajimu UMEMOTO }
9497fc91b3fSHajimu UMEMOTO 
950d6385b1cSHajimu UMEMOTO static struct in6_addrpolicy *
951d6385b1cSHajimu UMEMOTO lookup_addrsel_policy(key)
952d6385b1cSHajimu UMEMOTO 	struct sockaddr_in6 *key;
953d6385b1cSHajimu UMEMOTO {
954d6385b1cSHajimu UMEMOTO 	struct in6_addrpolicy *match = NULL;
955d6385b1cSHajimu UMEMOTO 
956d6385b1cSHajimu UMEMOTO 	ADDRSEL_LOCK();
957d6385b1cSHajimu UMEMOTO 	match = match_addrsel_policy(key);
958d6385b1cSHajimu UMEMOTO 
959d6385b1cSHajimu UMEMOTO 	if (match == NULL)
960d6385b1cSHajimu UMEMOTO 		match = &defaultaddrpolicy;
961d6385b1cSHajimu UMEMOTO 	else
962d6385b1cSHajimu UMEMOTO 		match->use++;
963d6385b1cSHajimu UMEMOTO 	ADDRSEL_UNLOCK();
964d6385b1cSHajimu UMEMOTO 
965d6385b1cSHajimu UMEMOTO 	return (match);
966d6385b1cSHajimu UMEMOTO }
967d6385b1cSHajimu UMEMOTO 
9687fc91b3fSHajimu UMEMOTO /*
9697fc91b3fSHajimu UMEMOTO  * Subroutines to manage the address selection policy table via sysctl.
9707fc91b3fSHajimu UMEMOTO  */
9717fc91b3fSHajimu UMEMOTO struct walkarg {
9727fc91b3fSHajimu UMEMOTO 	struct sysctl_req *w_req;
9737fc91b3fSHajimu UMEMOTO };
9747fc91b3fSHajimu UMEMOTO 
9757fc91b3fSHajimu UMEMOTO static int in6_src_sysctl(SYSCTL_HANDLER_ARGS);
9767fc91b3fSHajimu UMEMOTO SYSCTL_DECL(_net_inet6_ip6);
9777fc91b3fSHajimu UMEMOTO SYSCTL_NODE(_net_inet6_ip6, IPV6CTL_ADDRCTLPOLICY, addrctlpolicy,
9787fc91b3fSHajimu UMEMOTO 	CTLFLAG_RD, in6_src_sysctl, "");
9797fc91b3fSHajimu UMEMOTO 
9807fc91b3fSHajimu UMEMOTO static int
9817fc91b3fSHajimu UMEMOTO in6_src_sysctl(SYSCTL_HANDLER_ARGS)
9827fc91b3fSHajimu UMEMOTO {
9837fc91b3fSHajimu UMEMOTO 	struct walkarg w;
9847fc91b3fSHajimu UMEMOTO 
9857fc91b3fSHajimu UMEMOTO 	if (req->newptr)
9867fc91b3fSHajimu UMEMOTO 		return EPERM;
9877fc91b3fSHajimu UMEMOTO 
9887fc91b3fSHajimu UMEMOTO 	bzero(&w, sizeof(w));
9897fc91b3fSHajimu UMEMOTO 	w.w_req = req;
9907fc91b3fSHajimu UMEMOTO 
9917fc91b3fSHajimu UMEMOTO 	return (walk_addrsel_policy(dump_addrsel_policyent, &w));
9927fc91b3fSHajimu UMEMOTO }
9937fc91b3fSHajimu UMEMOTO 
9947fc91b3fSHajimu UMEMOTO int
9957fc91b3fSHajimu UMEMOTO in6_src_ioctl(cmd, data)
9967fc91b3fSHajimu UMEMOTO 	u_long cmd;
9977fc91b3fSHajimu UMEMOTO 	caddr_t data;
9987fc91b3fSHajimu UMEMOTO {
9997fc91b3fSHajimu UMEMOTO 	int i;
10007fc91b3fSHajimu UMEMOTO 	struct in6_addrpolicy ent0;
10017fc91b3fSHajimu UMEMOTO 
10027fc91b3fSHajimu UMEMOTO 	if (cmd != SIOCAADDRCTL_POLICY && cmd != SIOCDADDRCTL_POLICY)
10037fc91b3fSHajimu UMEMOTO 		return (EOPNOTSUPP); /* check for safety */
10047fc91b3fSHajimu UMEMOTO 
10057fc91b3fSHajimu UMEMOTO 	ent0 = *(struct in6_addrpolicy *)data;
10067fc91b3fSHajimu UMEMOTO 
10077fc91b3fSHajimu UMEMOTO 	if (ent0.label == ADDR_LABEL_NOTAPP)
10087fc91b3fSHajimu UMEMOTO 		return (EINVAL);
10097fc91b3fSHajimu UMEMOTO 	/* check if the prefix mask is consecutive. */
10107fc91b3fSHajimu UMEMOTO 	if (in6_mask2len(&ent0.addrmask.sin6_addr, NULL) < 0)
10117fc91b3fSHajimu UMEMOTO 		return (EINVAL);
10127fc91b3fSHajimu UMEMOTO 	/* clear trailing garbages (if any) of the prefix address. */
10137fc91b3fSHajimu UMEMOTO 	for (i = 0; i < 4; i++) {
10147fc91b3fSHajimu UMEMOTO 		ent0.addr.sin6_addr.s6_addr32[i] &=
10157fc91b3fSHajimu UMEMOTO 			ent0.addrmask.sin6_addr.s6_addr32[i];
10167fc91b3fSHajimu UMEMOTO 	}
10177fc91b3fSHajimu UMEMOTO 	ent0.use = 0;
10187fc91b3fSHajimu UMEMOTO 
10197fc91b3fSHajimu UMEMOTO 	switch (cmd) {
10207fc91b3fSHajimu UMEMOTO 	case SIOCAADDRCTL_POLICY:
10217fc91b3fSHajimu UMEMOTO 		return (add_addrsel_policyent(&ent0));
10227fc91b3fSHajimu UMEMOTO 	case SIOCDADDRCTL_POLICY:
10237fc91b3fSHajimu UMEMOTO 		return (delete_addrsel_policyent(&ent0));
10247fc91b3fSHajimu UMEMOTO 	}
10257fc91b3fSHajimu UMEMOTO 
10267fc91b3fSHajimu UMEMOTO 	return (0);		/* XXX: compromise compilers */
10277fc91b3fSHajimu UMEMOTO }
10287fc91b3fSHajimu UMEMOTO 
10297fc91b3fSHajimu UMEMOTO /*
10307fc91b3fSHajimu UMEMOTO  * The followings are implementation of the policy table using a
10317fc91b3fSHajimu UMEMOTO  * simple tail queue.
10327fc91b3fSHajimu UMEMOTO  * XXX such details should be hidden.
10337fc91b3fSHajimu UMEMOTO  * XXX implementation using binary tree should be more efficient.
10347fc91b3fSHajimu UMEMOTO  */
10357fc91b3fSHajimu UMEMOTO struct addrsel_policyent {
10367fc91b3fSHajimu UMEMOTO 	TAILQ_ENTRY(addrsel_policyent) ape_entry;
10377fc91b3fSHajimu UMEMOTO 	struct in6_addrpolicy ape_policy;
10387fc91b3fSHajimu UMEMOTO };
10397fc91b3fSHajimu UMEMOTO 
10407fc91b3fSHajimu UMEMOTO TAILQ_HEAD(addrsel_policyhead, addrsel_policyent);
10417fc91b3fSHajimu UMEMOTO 
10427fc91b3fSHajimu UMEMOTO struct addrsel_policyhead addrsel_policytab;
10437fc91b3fSHajimu UMEMOTO 
10447fc91b3fSHajimu UMEMOTO static void
10457fc91b3fSHajimu UMEMOTO init_policy_queue()
10467fc91b3fSHajimu UMEMOTO {
10477fc91b3fSHajimu UMEMOTO 	TAILQ_INIT(&addrsel_policytab);
10487fc91b3fSHajimu UMEMOTO }
10497fc91b3fSHajimu UMEMOTO 
10507fc91b3fSHajimu UMEMOTO static int
10517fc91b3fSHajimu UMEMOTO add_addrsel_policyent(newpolicy)
10527fc91b3fSHajimu UMEMOTO 	struct in6_addrpolicy *newpolicy;
10537fc91b3fSHajimu UMEMOTO {
10547fc91b3fSHajimu UMEMOTO 	struct addrsel_policyent *new, *pol;
10557fc91b3fSHajimu UMEMOTO 
1056349b668aSHajimu UMEMOTO 	MALLOC(new, struct addrsel_policyent *, sizeof(*new), M_IFADDR,
1057349b668aSHajimu UMEMOTO 	       M_WAITOK);
10587fc91b3fSHajimu UMEMOTO 	ADDRSEL_LOCK();
10597fc91b3fSHajimu UMEMOTO 
10607fc91b3fSHajimu UMEMOTO 	/* duplication check */
10617fc91b3fSHajimu UMEMOTO 	for (pol = TAILQ_FIRST(&addrsel_policytab); pol;
10627fc91b3fSHajimu UMEMOTO 	     pol = TAILQ_NEXT(pol, ape_entry)) {
10637fc91b3fSHajimu UMEMOTO 		if (SA6_ARE_ADDR_EQUAL(&newpolicy->addr,
10647fc91b3fSHajimu UMEMOTO 				       &pol->ape_policy.addr) &&
10657fc91b3fSHajimu UMEMOTO 		    SA6_ARE_ADDR_EQUAL(&newpolicy->addrmask,
10667fc91b3fSHajimu UMEMOTO 				       &pol->ape_policy.addrmask)) {
1067349b668aSHajimu UMEMOTO 			ADDRSEL_UNLOCK();
1068349b668aSHajimu UMEMOTO 			FREE(new, M_IFADDR);
10697fc91b3fSHajimu UMEMOTO 			return (EEXIST);	/* or override it? */
10707fc91b3fSHajimu UMEMOTO 		}
10717fc91b3fSHajimu UMEMOTO 	}
10727fc91b3fSHajimu UMEMOTO 
10737fc91b3fSHajimu UMEMOTO 	bzero(new, sizeof(*new));
10747fc91b3fSHajimu UMEMOTO 
10757fc91b3fSHajimu UMEMOTO 	/* XXX: should validate entry */
10767fc91b3fSHajimu UMEMOTO 	new->ape_policy = *newpolicy;
10777fc91b3fSHajimu UMEMOTO 
10787fc91b3fSHajimu UMEMOTO 	TAILQ_INSERT_TAIL(&addrsel_policytab, new, ape_entry);
10797fc91b3fSHajimu UMEMOTO 	ADDRSEL_UNLOCK();
10807fc91b3fSHajimu UMEMOTO 
10817fc91b3fSHajimu UMEMOTO 	return (0);
10827fc91b3fSHajimu UMEMOTO }
10837fc91b3fSHajimu UMEMOTO 
10847fc91b3fSHajimu UMEMOTO static int
10857fc91b3fSHajimu UMEMOTO delete_addrsel_policyent(key)
10867fc91b3fSHajimu UMEMOTO 	struct in6_addrpolicy *key;
10877fc91b3fSHajimu UMEMOTO {
10887fc91b3fSHajimu UMEMOTO 	struct addrsel_policyent *pol;
10897fc91b3fSHajimu UMEMOTO 
10907fc91b3fSHajimu UMEMOTO 	ADDRSEL_LOCK();
10917fc91b3fSHajimu UMEMOTO 
10927fc91b3fSHajimu UMEMOTO 	/* search for the entry in the table */
10937fc91b3fSHajimu UMEMOTO 	for (pol = TAILQ_FIRST(&addrsel_policytab); pol;
10947fc91b3fSHajimu UMEMOTO 	     pol = TAILQ_NEXT(pol, ape_entry)) {
10957fc91b3fSHajimu UMEMOTO 		if (SA6_ARE_ADDR_EQUAL(&key->addr, &pol->ape_policy.addr) &&
10967fc91b3fSHajimu UMEMOTO 		    SA6_ARE_ADDR_EQUAL(&key->addrmask,
10977fc91b3fSHajimu UMEMOTO 				       &pol->ape_policy.addrmask)) {
10987fc91b3fSHajimu UMEMOTO 			break;
10997fc91b3fSHajimu UMEMOTO 		}
11007fc91b3fSHajimu UMEMOTO 	}
1101349b668aSHajimu UMEMOTO 	if (pol == NULL) {
1102349b668aSHajimu UMEMOTO 		ADDRSEL_UNLOCK();
11037fc91b3fSHajimu UMEMOTO 		return (ESRCH);
1104349b668aSHajimu UMEMOTO 	}
11057fc91b3fSHajimu UMEMOTO 
11067fc91b3fSHajimu UMEMOTO 	TAILQ_REMOVE(&addrsel_policytab, pol, ape_entry);
11077fc91b3fSHajimu UMEMOTO 	ADDRSEL_UNLOCK();
11087fc91b3fSHajimu UMEMOTO 
11097fc91b3fSHajimu UMEMOTO 	return (0);
11107fc91b3fSHajimu UMEMOTO }
11117fc91b3fSHajimu UMEMOTO 
11127fc91b3fSHajimu UMEMOTO static int
11137fc91b3fSHajimu UMEMOTO walk_addrsel_policy(callback, w)
11147fc91b3fSHajimu UMEMOTO 	int (*callback) __P((struct in6_addrpolicy *, void *));
11157fc91b3fSHajimu UMEMOTO 	void *w;
11167fc91b3fSHajimu UMEMOTO {
11177fc91b3fSHajimu UMEMOTO 	struct addrsel_policyent *pol;
11187fc91b3fSHajimu UMEMOTO 	int error = 0;
11197fc91b3fSHajimu UMEMOTO 
11207fc91b3fSHajimu UMEMOTO 	ADDRSEL_LOCK();
11217fc91b3fSHajimu UMEMOTO 	for (pol = TAILQ_FIRST(&addrsel_policytab); pol;
11227fc91b3fSHajimu UMEMOTO 	     pol = TAILQ_NEXT(pol, ape_entry)) {
1123349b668aSHajimu UMEMOTO 		if ((error = (*callback)(&pol->ape_policy, w)) != 0) {
1124349b668aSHajimu UMEMOTO 			ADDRSEL_UNLOCK();
11257fc91b3fSHajimu UMEMOTO 			return (error);
11267fc91b3fSHajimu UMEMOTO 		}
1127349b668aSHajimu UMEMOTO 	}
11287fc91b3fSHajimu UMEMOTO 	ADDRSEL_UNLOCK();
11297fc91b3fSHajimu UMEMOTO 
11307fc91b3fSHajimu UMEMOTO 	return (error);
11317fc91b3fSHajimu UMEMOTO }
11327fc91b3fSHajimu UMEMOTO 
11337fc91b3fSHajimu UMEMOTO static int
11347fc91b3fSHajimu UMEMOTO dump_addrsel_policyent(pol, arg)
11357fc91b3fSHajimu UMEMOTO 	struct in6_addrpolicy *pol;
11367fc91b3fSHajimu UMEMOTO 	void *arg;
11377fc91b3fSHajimu UMEMOTO {
11387fc91b3fSHajimu UMEMOTO 	int error = 0;
11397fc91b3fSHajimu UMEMOTO 	struct walkarg *w = arg;
11407fc91b3fSHajimu UMEMOTO 
11417fc91b3fSHajimu UMEMOTO 	error = SYSCTL_OUT(w->w_req, pol, sizeof(*pol));
11427fc91b3fSHajimu UMEMOTO 
11437fc91b3fSHajimu UMEMOTO 	return (error);
11447fc91b3fSHajimu UMEMOTO }
1145d6385b1cSHajimu UMEMOTO 
1146d6385b1cSHajimu UMEMOTO static struct in6_addrpolicy *
1147d6385b1cSHajimu UMEMOTO match_addrsel_policy(key)
1148d6385b1cSHajimu UMEMOTO 	struct sockaddr_in6 *key;
1149d6385b1cSHajimu UMEMOTO {
1150d6385b1cSHajimu UMEMOTO 	struct addrsel_policyent *pent;
1151d6385b1cSHajimu UMEMOTO 	struct in6_addrpolicy *bestpol = NULL, *pol;
1152d6385b1cSHajimu UMEMOTO 	int matchlen, bestmatchlen = -1;
1153d6385b1cSHajimu UMEMOTO 	u_char *mp, *ep, *k, *p, m;
1154d6385b1cSHajimu UMEMOTO 
1155d6385b1cSHajimu UMEMOTO 	for (pent = TAILQ_FIRST(&addrsel_policytab); pent;
1156d6385b1cSHajimu UMEMOTO 	     pent = TAILQ_NEXT(pent, ape_entry)) {
1157d6385b1cSHajimu UMEMOTO 		matchlen = 0;
1158d6385b1cSHajimu UMEMOTO 
1159d6385b1cSHajimu UMEMOTO 		pol = &pent->ape_policy;
1160d6385b1cSHajimu UMEMOTO 		mp = (u_char *)&pol->addrmask.sin6_addr;
1161d6385b1cSHajimu UMEMOTO 		ep = mp + 16;	/* XXX: scope field? */
1162d6385b1cSHajimu UMEMOTO 		k = (u_char *)&key->sin6_addr;
1163d6385b1cSHajimu UMEMOTO 		p = (u_char *)&pol->addr.sin6_addr;
1164d6385b1cSHajimu UMEMOTO 		for (; mp < ep && *mp; mp++, k++, p++) {
1165d6385b1cSHajimu UMEMOTO 			m = *mp;
1166d6385b1cSHajimu UMEMOTO 			if ((*k & m) != *p)
1167d6385b1cSHajimu UMEMOTO 				goto next; /* not match */
1168d6385b1cSHajimu UMEMOTO 			if (m == 0xff) /* short cut for a typical case */
1169d6385b1cSHajimu UMEMOTO 				matchlen += 8;
1170d6385b1cSHajimu UMEMOTO 			else {
1171d6385b1cSHajimu UMEMOTO 				while (m >= 0x80) {
1172d6385b1cSHajimu UMEMOTO 					matchlen++;
1173d6385b1cSHajimu UMEMOTO 					m <<= 1;
1174d6385b1cSHajimu UMEMOTO 				}
1175d6385b1cSHajimu UMEMOTO 			}
1176d6385b1cSHajimu UMEMOTO 		}
1177d6385b1cSHajimu UMEMOTO 
1178d6385b1cSHajimu UMEMOTO 		/* matched.  check if this is better than the current best. */
1179d6385b1cSHajimu UMEMOTO 		if (bestpol == NULL ||
1180d6385b1cSHajimu UMEMOTO 		    matchlen > bestmatchlen) {
1181d6385b1cSHajimu UMEMOTO 			bestpol = pol;
1182d6385b1cSHajimu UMEMOTO 			bestmatchlen = matchlen;
1183d6385b1cSHajimu UMEMOTO 		}
1184d6385b1cSHajimu UMEMOTO 
1185d6385b1cSHajimu UMEMOTO 	  next:
1186d6385b1cSHajimu UMEMOTO 		continue;
1187d6385b1cSHajimu UMEMOTO 	}
1188d6385b1cSHajimu UMEMOTO 
1189d6385b1cSHajimu UMEMOTO 	return (bestpol);
1190d6385b1cSHajimu UMEMOTO }
1191