xref: /freebsd/sys/netinet6/ip6_output.c (revision 6356dba0b403daa023dec24559ab1f8e602e4f14)
1 /*-
2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the project nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	$KAME: ip6_output.c,v 1.279 2002/01/26 06:12:30 jinmei Exp $
30  */
31 
32 /*-
33  * Copyright (c) 1982, 1986, 1988, 1990, 1993
34  *	The Regents of the University of California.  All rights reserved.
35  *
36  * Redistribution and use in source and binary forms, with or without
37  * modification, are permitted provided that the following conditions
38  * are met:
39  * 1. Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  * 2. Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in the
43  *    documentation and/or other materials provided with the distribution.
44  * 4. Neither the name of the University nor the names of its contributors
45  *    may be used to endorse or promote products derived from this software
46  *    without specific prior written permission.
47  *
48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58  * SUCH DAMAGE.
59  *
60  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
61  */
62 
63 #include <sys/cdefs.h>
64 __FBSDID("$FreeBSD$");
65 
66 #include "opt_inet.h"
67 #include "opt_inet6.h"
68 #include "opt_ipsec.h"
69 
70 #include <sys/param.h>
71 #include <sys/kernel.h>
72 #include <sys/malloc.h>
73 #include <sys/mbuf.h>
74 #include <sys/errno.h>
75 #include <sys/priv.h>
76 #include <sys/proc.h>
77 #include <sys/protosw.h>
78 #include <sys/socket.h>
79 #include <sys/socketvar.h>
80 #include <sys/ucred.h>
81 #include <sys/vimage.h>
82 
83 #include <net/if.h>
84 #include <net/netisr.h>
85 #include <net/route.h>
86 #include <net/pfil.h>
87 
88 #include <netinet/in.h>
89 #include <netinet/in_var.h>
90 #include <netinet6/in6_var.h>
91 #include <netinet/ip6.h>
92 #include <netinet/icmp6.h>
93 #include <netinet6/ip6_var.h>
94 #include <netinet/in_pcb.h>
95 #include <netinet/tcp_var.h>
96 #include <netinet6/nd6.h>
97 
98 #ifdef IPSEC
99 #include <netipsec/ipsec.h>
100 #include <netipsec/ipsec6.h>
101 #include <netipsec/key.h>
102 #include <netinet6/ip6_ipsec.h>
103 #endif /* IPSEC */
104 
105 #include <netinet6/ip6protosw.h>
106 #include <netinet6/scope6_var.h>
107 
108 static MALLOC_DEFINE(M_IP6MOPTS, "ip6_moptions", "internet multicast options");
109 
110 struct ip6_exthdrs {
111 	struct mbuf *ip6e_ip6;
112 	struct mbuf *ip6e_hbh;
113 	struct mbuf *ip6e_dest1;
114 	struct mbuf *ip6e_rthdr;
115 	struct mbuf *ip6e_dest2;
116 };
117 
118 static int ip6_pcbopt __P((int, u_char *, int, struct ip6_pktopts **,
119 			   struct ucred *, int));
120 static int ip6_pcbopts __P((struct ip6_pktopts **, struct mbuf *,
121 	struct socket *, struct sockopt *));
122 static int ip6_getpcbopt(struct ip6_pktopts *, int, struct sockopt *);
123 static int ip6_setpktopt __P((int, u_char *, int, struct ip6_pktopts *,
124 	struct ucred *, int, int, int));
125 
126 static int ip6_setmoptions(int, struct ip6_moptions **, struct mbuf *);
127 static int ip6_getmoptions(int, struct ip6_moptions *, struct mbuf **);
128 static int ip6_copyexthdr(struct mbuf **, caddr_t, int);
129 static int ip6_insertfraghdr __P((struct mbuf *, struct mbuf *, int,
130 	struct ip6_frag **));
131 static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
132 static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
133 static int ip6_getpmtu __P((struct route_in6 *, struct route_in6 *,
134 	struct ifnet *, struct in6_addr *, u_long *, int *));
135 static int copypktopts(struct ip6_pktopts *, struct ip6_pktopts *, int);
136 
137 
138 /*
139  * Make an extension header from option data.  hp is the source, and
140  * mp is the destination.
141  */
142 #define MAKE_EXTHDR(hp, mp)						\
143     do {								\
144 	if (hp) {							\
145 		struct ip6_ext *eh = (struct ip6_ext *)(hp);		\
146 		error = ip6_copyexthdr((mp), (caddr_t)(hp),		\
147 		    ((eh)->ip6e_len + 1) << 3);				\
148 		if (error)						\
149 			goto freehdrs;					\
150 	}								\
151     } while (/*CONSTCOND*/ 0)
152 
153 /*
154  * Form a chain of extension headers.
155  * m is the extension header mbuf
156  * mp is the previous mbuf in the chain
157  * p is the next header
158  * i is the type of option.
159  */
160 #define MAKE_CHAIN(m, mp, p, i)\
161     do {\
162 	if (m) {\
163 		if (!hdrsplit) \
164 			panic("assumption failed: hdr not split"); \
165 		*mtod((m), u_char *) = *(p);\
166 		*(p) = (i);\
167 		p = mtod((m), u_char *);\
168 		(m)->m_next = (mp)->m_next;\
169 		(mp)->m_next = (m);\
170 		(mp) = (m);\
171 	}\
172     } while (/*CONSTCOND*/ 0)
173 
174 /*
175  * IP6 output. The packet in mbuf chain m contains a skeletal IP6
176  * header (with pri, len, nxt, hlim, src, dst).
177  * This function may modify ver and hlim only.
178  * The mbuf chain containing the packet will be freed.
179  * The mbuf opt, if present, will not be freed.
180  *
181  * type of "mtu": rt_rmx.rmx_mtu is u_long, ifnet.ifr_mtu is int, and
182  * nd_ifinfo.linkmtu is u_int32_t.  so we use u_long to hold largest one,
183  * which is rt_rmx.rmx_mtu.
184  *
185  * ifpp - XXX: just for statistics
186  */
187 int
188 ip6_output(struct mbuf *m0, struct ip6_pktopts *opt,
189     struct route_in6 *ro, int flags, struct ip6_moptions *im6o,
190     struct ifnet **ifpp, struct inpcb *inp)
191 {
192 	struct ip6_hdr *ip6, *mhip6;
193 	struct ifnet *ifp, *origifp;
194 	struct mbuf *m = m0;
195 	struct mbuf *mprev = NULL;
196 	int hlen, tlen, len, off;
197 	struct route_in6 ip6route;
198 	struct rtentry *rt = NULL;
199 	struct sockaddr_in6 *dst, src_sa, dst_sa;
200 	struct in6_addr odst;
201 	int error = 0;
202 	struct in6_ifaddr *ia = NULL;
203 	u_long mtu;
204 	int alwaysfrag, dontfrag;
205 	u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
206 	struct ip6_exthdrs exthdrs;
207 	struct in6_addr finaldst, src0, dst0;
208 	u_int32_t zone;
209 	struct route_in6 *ro_pmtu = NULL;
210 	int hdrsplit = 0;
211 	int needipsec = 0;
212 #ifdef IPSEC
213 	struct ipsec_output_state state;
214 	struct ip6_rthdr *rh = NULL;
215 	int needipsectun = 0;
216 	int segleft_org = 0;
217 	struct secpolicy *sp = NULL;
218 #endif /* IPSEC */
219 
220 	ip6 = mtod(m, struct ip6_hdr *);
221 	if (ip6 == NULL) {
222 		printf ("ip6 is NULL");
223 		goto bad;
224 	}
225 
226 	finaldst = ip6->ip6_dst;
227 
228 	bzero(&exthdrs, sizeof(exthdrs));
229 
230 	if (opt) {
231 		/* Hop-by-Hop options header */
232 		MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
233 		/* Destination options header(1st part) */
234 		if (opt->ip6po_rthdr) {
235 			/*
236 			 * Destination options header(1st part)
237 			 * This only makes sense with a routing header.
238 			 * See Section 9.2 of RFC 3542.
239 			 * Disabling this part just for MIP6 convenience is
240 			 * a bad idea.  We need to think carefully about a
241 			 * way to make the advanced API coexist with MIP6
242 			 * options, which might automatically be inserted in
243 			 * the kernel.
244 			 */
245 			MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
246 		}
247 		/* Routing header */
248 		MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
249 		/* Destination options header(2nd part) */
250 		MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
251 	}
252 
253 	/*
254 	 * IPSec checking which handles several cases.
255 	 * FAST IPSEC: We re-injected the packet.
256 	 */
257 #ifdef IPSEC
258 	switch(ip6_ipsec_output(&m, inp, &flags, &error, &ifp, &sp))
259 	{
260 	case 1:                 /* Bad packet */
261 		goto freehdrs;
262 	case -1:                /* Do IPSec */
263 		needipsec = 1;
264 	case 0:                 /* No IPSec */
265 	default:
266 		break;
267 	}
268 #endif /* IPSEC */
269 
270 	/*
271 	 * Calculate the total length of the extension header chain.
272 	 * Keep the length of the unfragmentable part for fragmentation.
273 	 */
274 	optlen = 0;
275 	if (exthdrs.ip6e_hbh)
276 		optlen += exthdrs.ip6e_hbh->m_len;
277 	if (exthdrs.ip6e_dest1)
278 		optlen += exthdrs.ip6e_dest1->m_len;
279 	if (exthdrs.ip6e_rthdr)
280 		optlen += exthdrs.ip6e_rthdr->m_len;
281 	unfragpartlen = optlen + sizeof(struct ip6_hdr);
282 
283 	/* NOTE: we don't add AH/ESP length here. do that later. */
284 	if (exthdrs.ip6e_dest2)
285 		optlen += exthdrs.ip6e_dest2->m_len;
286 
287 	/*
288 	 * If we need IPsec, or there is at least one extension header,
289 	 * separate IP6 header from the payload.
290 	 */
291 	if ((needipsec || optlen) && !hdrsplit) {
292 		if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
293 			m = NULL;
294 			goto freehdrs;
295 		}
296 		m = exthdrs.ip6e_ip6;
297 		hdrsplit++;
298 	}
299 
300 	/* adjust pointer */
301 	ip6 = mtod(m, struct ip6_hdr *);
302 
303 	/* adjust mbuf packet header length */
304 	m->m_pkthdr.len += optlen;
305 	plen = m->m_pkthdr.len - sizeof(*ip6);
306 
307 	/* If this is a jumbo payload, insert a jumbo payload option. */
308 	if (plen > IPV6_MAXPACKET) {
309 		if (!hdrsplit) {
310 			if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
311 				m = NULL;
312 				goto freehdrs;
313 			}
314 			m = exthdrs.ip6e_ip6;
315 			hdrsplit++;
316 		}
317 		/* adjust pointer */
318 		ip6 = mtod(m, struct ip6_hdr *);
319 		if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
320 			goto freehdrs;
321 		ip6->ip6_plen = 0;
322 	} else
323 		ip6->ip6_plen = htons(plen);
324 
325 	/*
326 	 * Concatenate headers and fill in next header fields.
327 	 * Here we have, on "m"
328 	 *	IPv6 payload
329 	 * and we insert headers accordingly.  Finally, we should be getting:
330 	 *	IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
331 	 *
332 	 * during the header composing process, "m" points to IPv6 header.
333 	 * "mprev" points to an extension header prior to esp.
334 	 */
335 	u_char *nexthdrp = &ip6->ip6_nxt;
336 	mprev = m;
337 
338 	/*
339 	 * we treat dest2 specially.  this makes IPsec processing
340 	 * much easier.  the goal here is to make mprev point the
341 	 * mbuf prior to dest2.
342 	 *
343 	 * result: IPv6 dest2 payload
344 	 * m and mprev will point to IPv6 header.
345 	 */
346 	if (exthdrs.ip6e_dest2) {
347 		if (!hdrsplit)
348 			panic("assumption failed: hdr not split");
349 		exthdrs.ip6e_dest2->m_next = m->m_next;
350 		m->m_next = exthdrs.ip6e_dest2;
351 		*mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
352 		ip6->ip6_nxt = IPPROTO_DSTOPTS;
353 	}
354 
355 	/*
356 	 * result: IPv6 hbh dest1 rthdr dest2 payload
357 	 * m will point to IPv6 header.  mprev will point to the
358 	 * extension header prior to dest2 (rthdr in the above case).
359 	 */
360 	MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
361 	MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp,
362 		   IPPROTO_DSTOPTS);
363 	MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp,
364 		   IPPROTO_ROUTING);
365 
366 #ifdef IPSEC
367 	if (!needipsec)
368 		goto skip_ipsec2;
369 
370 	/*
371 	 * pointers after IPsec headers are not valid any more.
372 	 * other pointers need a great care too.
373 	 * (IPsec routines should not mangle mbufs prior to AH/ESP)
374 	 */
375 	exthdrs.ip6e_dest2 = NULL;
376 
377 	if (exthdrs.ip6e_rthdr) {
378 		rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
379 		segleft_org = rh->ip6r_segleft;
380 		rh->ip6r_segleft = 0;
381 	}
382 
383 	bzero(&state, sizeof(state));
384 	state.m = m;
385 	error = ipsec6_output_trans(&state, nexthdrp, mprev, sp, flags,
386 				    &needipsectun);
387 	m = state.m;
388 	if (error == EJUSTRETURN) {
389 		/*
390 		 * We had a SP with a level of 'use' and no SA. We
391 		 * will just continue to process the packet without
392 		 * IPsec processing.
393 		 */
394 		;
395 	} else if (error) {
396 		/* mbuf is already reclaimed in ipsec6_output_trans. */
397 		m = NULL;
398 		switch (error) {
399 		case EHOSTUNREACH:
400 		case ENETUNREACH:
401 		case EMSGSIZE:
402 		case ENOBUFS:
403 		case ENOMEM:
404 			break;
405 		default:
406 			printf("[%s:%d] (ipsec): error code %d\n",
407 			    __func__, __LINE__, error);
408 			/* FALLTHROUGH */
409 		case ENOENT:
410 			/* don't show these error codes to the user */
411 			error = 0;
412 			break;
413 		}
414 		goto bad;
415 	} else if (!needipsectun) {
416 		/*
417 		 * In the FAST IPSec case we have already
418 		 * re-injected the packet and it has been freed
419 		 * by the ipsec_done() function.  So, just clean
420 		 * up after ourselves.
421 		 */
422 		m = NULL;
423 		goto done;
424 	}
425 	if (exthdrs.ip6e_rthdr) {
426 		/* ah6_output doesn't modify mbuf chain */
427 		rh->ip6r_segleft = segleft_org;
428 	}
429 skip_ipsec2:;
430 #endif /* IPSEC */
431 
432 	/*
433 	 * If there is a routing header, replace the destination address field
434 	 * with the first hop of the routing header.
435 	 */
436 	if (exthdrs.ip6e_rthdr) {
437 		struct ip6_rthdr *rh =
438 			(struct ip6_rthdr *)(mtod(exthdrs.ip6e_rthdr,
439 						  struct ip6_rthdr *));
440 		struct ip6_rthdr0 *rh0;
441 		struct in6_addr *addr;
442 		struct sockaddr_in6 sa;
443 
444 		switch (rh->ip6r_type) {
445 		case IPV6_RTHDR_TYPE_0:
446 			 rh0 = (struct ip6_rthdr0 *)rh;
447 			 addr = (struct in6_addr *)(rh0 + 1);
448 
449 			 /*
450 			  * construct a sockaddr_in6 form of
451 			  * the first hop.
452 			  *
453 			  * XXX: we may not have enough
454 			  * information about its scope zone;
455 			  * there is no standard API to pass
456 			  * the information from the
457 			  * application.
458 			  */
459 			 bzero(&sa, sizeof(sa));
460 			 sa.sin6_family = AF_INET6;
461 			 sa.sin6_len = sizeof(sa);
462 			 sa.sin6_addr = addr[0];
463 			 if ((error = sa6_embedscope(&sa,
464 			     V_ip6_use_defzone)) != 0) {
465 				 goto bad;
466 			 }
467 			 ip6->ip6_dst = sa.sin6_addr;
468 			 bcopy(&addr[1], &addr[0], sizeof(struct in6_addr)
469 			     * (rh0->ip6r0_segleft - 1));
470 			 addr[rh0->ip6r0_segleft - 1] = finaldst;
471 			 /* XXX */
472 			 in6_clearscope(addr + rh0->ip6r0_segleft - 1);
473 			 break;
474 		default:	/* is it possible? */
475 			 error = EINVAL;
476 			 goto bad;
477 		}
478 	}
479 
480 	/* Source address validation */
481 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
482 	    (flags & IPV6_UNSPECSRC) == 0) {
483 		error = EOPNOTSUPP;
484 		V_ip6stat.ip6s_badscope++;
485 		goto bad;
486 	}
487 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
488 		error = EOPNOTSUPP;
489 		V_ip6stat.ip6s_badscope++;
490 		goto bad;
491 	}
492 
493 	V_ip6stat.ip6s_localout++;
494 
495 	/*
496 	 * Route packet.
497 	 */
498 	if (ro == 0) {
499 		ro = &ip6route;
500 		bzero((caddr_t)ro, sizeof(*ro));
501 	}
502 	ro_pmtu = ro;
503 	if (opt && opt->ip6po_rthdr)
504 		ro = &opt->ip6po_route;
505 	dst = (struct sockaddr_in6 *)&ro->ro_dst;
506 
507 again:
508 	/*
509 	 * if specified, try to fill in the traffic class field.
510 	 * do not override if a non-zero value is already set.
511 	 * we check the diffserv field and the ecn field separately.
512 	 */
513 	if (opt && opt->ip6po_tclass >= 0) {
514 		int mask = 0;
515 
516 		if ((ip6->ip6_flow & htonl(0xfc << 20)) == 0)
517 			mask |= 0xfc;
518 		if ((ip6->ip6_flow & htonl(0x03 << 20)) == 0)
519 			mask |= 0x03;
520 		if (mask != 0)
521 			ip6->ip6_flow |= htonl((opt->ip6po_tclass & mask) << 20);
522 	}
523 
524 	/* fill in or override the hop limit field, if necessary. */
525 	if (opt && opt->ip6po_hlim != -1)
526 		ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
527 	else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
528 		if (im6o != NULL)
529 			ip6->ip6_hlim = im6o->im6o_multicast_hlim;
530 		else
531 			ip6->ip6_hlim = V_ip6_defmcasthlim;
532 	}
533 
534 #ifdef IPSEC
535 	/*
536 	 * We may re-inject packets into the stack here.
537 	 */
538 	if (needipsec && needipsectun) {
539 		struct ipsec_output_state state;
540 
541 		/*
542 		 * All the extension headers will become inaccessible
543 		 * (since they can be encrypted).
544 		 * Don't panic, we need no more updates to extension headers
545 		 * on inner IPv6 packet (since they are now encapsulated).
546 		 *
547 		 * IPv6 [ESP|AH] IPv6 [extension headers] payload
548 		 */
549 		bzero(&exthdrs, sizeof(exthdrs));
550 		exthdrs.ip6e_ip6 = m;
551 
552 		bzero(&state, sizeof(state));
553 		state.m = m;
554 		state.ro = (struct route *)ro;
555 		state.dst = (struct sockaddr *)dst;
556 
557 		error = ipsec6_output_tunnel(&state, sp, flags);
558 
559 		m = state.m;
560 		ro = (struct route_in6 *)state.ro;
561 		dst = (struct sockaddr_in6 *)state.dst;
562 		if (error == EJUSTRETURN) {
563 			/*
564 			 * We had a SP with a level of 'use' and no SA. We
565 			 * will just continue to process the packet without
566 			 * IPsec processing.
567 			 */
568 			;
569 		} else if (error) {
570 			/* mbuf is already reclaimed in ipsec6_output_tunnel. */
571 			m0 = m = NULL;
572 			m = NULL;
573 			switch (error) {
574 			case EHOSTUNREACH:
575 			case ENETUNREACH:
576 			case EMSGSIZE:
577 			case ENOBUFS:
578 			case ENOMEM:
579 				break;
580 			default:
581 				printf("[%s:%d] (ipsec): error code %d\n",
582 				    __func__, __LINE__, error);
583 				/* FALLTHROUGH */
584 			case ENOENT:
585 				/* don't show these error codes to the user */
586 				error = 0;
587 				break;
588 			}
589 			goto bad;
590 		} else {
591 			/*
592 			 * In the FAST IPSec case we have already
593 			 * re-injected the packet and it has been freed
594 			 * by the ipsec_done() function.  So, just clean
595 			 * up after ourselves.
596 			 */
597 			m = NULL;
598 			goto done;
599 		}
600 
601 		exthdrs.ip6e_ip6 = m;
602 	}
603 #endif /* IPSEC */
604 
605 	/* adjust pointer */
606 	ip6 = mtod(m, struct ip6_hdr *);
607 
608 	bzero(&dst_sa, sizeof(dst_sa));
609 	dst_sa.sin6_family = AF_INET6;
610 	dst_sa.sin6_len = sizeof(dst_sa);
611 	dst_sa.sin6_addr = ip6->ip6_dst;
612 	if ((error = in6_selectroute(&dst_sa, opt, im6o, ro,
613 	    &ifp, &rt, 0)) != 0) {
614 		switch (error) {
615 		case EHOSTUNREACH:
616 			V_ip6stat.ip6s_noroute++;
617 			break;
618 		case EADDRNOTAVAIL:
619 		default:
620 			break; /* XXX statistics? */
621 		}
622 		if (ifp != NULL)
623 			in6_ifstat_inc(ifp, ifs6_out_discard);
624 		goto bad;
625 	}
626 	if (rt == NULL) {
627 		/*
628 		 * If in6_selectroute() does not return a route entry,
629 		 * dst may not have been updated.
630 		 */
631 		*dst = dst_sa;	/* XXX */
632 	}
633 
634 	/*
635 	 * then rt (for unicast) and ifp must be non-NULL valid values.
636 	 */
637 	if ((flags & IPV6_FORWARDING) == 0) {
638 		/* XXX: the FORWARDING flag can be set for mrouting. */
639 		in6_ifstat_inc(ifp, ifs6_out_request);
640 	}
641 	if (rt != NULL) {
642 		ia = (struct in6_ifaddr *)(rt->rt_ifa);
643 		rt->rt_use++;
644 	}
645 
646 	/*
647 	 * The outgoing interface must be in the zone of source and
648 	 * destination addresses.  We should use ia_ifp to support the
649 	 * case of sending packets to an address of our own.
650 	 */
651 	if (ia != NULL && ia->ia_ifp)
652 		origifp = ia->ia_ifp;
653 	else
654 		origifp = ifp;
655 
656 	src0 = ip6->ip6_src;
657 	if (in6_setscope(&src0, origifp, &zone))
658 		goto badscope;
659 	bzero(&src_sa, sizeof(src_sa));
660 	src_sa.sin6_family = AF_INET6;
661 	src_sa.sin6_len = sizeof(src_sa);
662 	src_sa.sin6_addr = ip6->ip6_src;
663 	if (sa6_recoverscope(&src_sa) || zone != src_sa.sin6_scope_id)
664 		goto badscope;
665 
666 	dst0 = ip6->ip6_dst;
667 	if (in6_setscope(&dst0, origifp, &zone))
668 		goto badscope;
669 	/* re-initialize to be sure */
670 	bzero(&dst_sa, sizeof(dst_sa));
671 	dst_sa.sin6_family = AF_INET6;
672 	dst_sa.sin6_len = sizeof(dst_sa);
673 	dst_sa.sin6_addr = ip6->ip6_dst;
674 	if (sa6_recoverscope(&dst_sa) || zone != dst_sa.sin6_scope_id) {
675 		goto badscope;
676 	}
677 
678 	/* scope check is done. */
679 	goto routefound;
680 
681   badscope:
682 	V_ip6stat.ip6s_badscope++;
683 	in6_ifstat_inc(origifp, ifs6_out_discard);
684 	if (error == 0)
685 		error = EHOSTUNREACH; /* XXX */
686 	goto bad;
687 
688   routefound:
689 	if (rt && !IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
690 		if (opt && opt->ip6po_nextroute.ro_rt) {
691 			/*
692 			 * The nexthop is explicitly specified by the
693 			 * application.  We assume the next hop is an IPv6
694 			 * address.
695 			 */
696 			dst = (struct sockaddr_in6 *)opt->ip6po_nexthop;
697 		}
698 		else if ((rt->rt_flags & RTF_GATEWAY))
699 			dst = (struct sockaddr_in6 *)rt->rt_gateway;
700 	}
701 
702 	if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
703 		m->m_flags &= ~(M_BCAST | M_MCAST); /* just in case */
704 	} else {
705 		struct	in6_multi *in6m;
706 
707 		m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
708 
709 		in6_ifstat_inc(ifp, ifs6_out_mcast);
710 
711 		/*
712 		 * Confirm that the outgoing interface supports multicast.
713 		 */
714 		if (!(ifp->if_flags & IFF_MULTICAST)) {
715 			V_ip6stat.ip6s_noroute++;
716 			in6_ifstat_inc(ifp, ifs6_out_discard);
717 			error = ENETUNREACH;
718 			goto bad;
719 		}
720 		IN6_LOOKUP_MULTI(ip6->ip6_dst, ifp, in6m);
721 		if (in6m != NULL &&
722 		   (im6o == NULL || im6o->im6o_multicast_loop)) {
723 			/*
724 			 * If we belong to the destination multicast group
725 			 * on the outgoing interface, and the caller did not
726 			 * forbid loopback, loop back a copy.
727 			 */
728 			ip6_mloopback(ifp, m, dst);
729 		} else {
730 			/*
731 			 * If we are acting as a multicast router, perform
732 			 * multicast forwarding as if the packet had just
733 			 * arrived on the interface to which we are about
734 			 * to send.  The multicast forwarding function
735 			 * recursively calls this function, using the
736 			 * IPV6_FORWARDING flag to prevent infinite recursion.
737 			 *
738 			 * Multicasts that are looped back by ip6_mloopback(),
739 			 * above, will be forwarded by the ip6_input() routine,
740 			 * if necessary.
741 			 */
742 			if (ip6_mrouter && (flags & IPV6_FORWARDING) == 0) {
743 				/*
744 				 * XXX: ip6_mforward expects that rcvif is NULL
745 				 * when it is called from the originating path.
746 				 * However, it is not always the case, since
747 				 * some versions of MGETHDR() does not
748 				 * initialize the field.
749 				 */
750 				m->m_pkthdr.rcvif = NULL;
751 				if (ip6_mforward(ip6, ifp, m) != 0) {
752 					m_freem(m);
753 					goto done;
754 				}
755 			}
756 		}
757 		/*
758 		 * Multicasts with a hoplimit of zero may be looped back,
759 		 * above, but must not be transmitted on a network.
760 		 * Also, multicasts addressed to the loopback interface
761 		 * are not sent -- the above call to ip6_mloopback() will
762 		 * loop back a copy if this host actually belongs to the
763 		 * destination group on the loopback interface.
764 		 */
765 		if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK) ||
766 		    IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst)) {
767 			m_freem(m);
768 			goto done;
769 		}
770 	}
771 
772 	/*
773 	 * Fill the outgoing inteface to tell the upper layer
774 	 * to increment per-interface statistics.
775 	 */
776 	if (ifpp)
777 		*ifpp = ifp;
778 
779 	/* Determine path MTU. */
780 	if ((error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, &mtu,
781 	    &alwaysfrag)) != 0)
782 		goto bad;
783 
784 	/*
785 	 * The caller of this function may specify to use the minimum MTU
786 	 * in some cases.
787 	 * An advanced API option (IPV6_USE_MIN_MTU) can also override MTU
788 	 * setting.  The logic is a bit complicated; by default, unicast
789 	 * packets will follow path MTU while multicast packets will be sent at
790 	 * the minimum MTU.  If IP6PO_MINMTU_ALL is specified, all packets
791 	 * including unicast ones will be sent at the minimum MTU.  Multicast
792 	 * packets will always be sent at the minimum MTU unless
793 	 * IP6PO_MINMTU_DISABLE is explicitly specified.
794 	 * See RFC 3542 for more details.
795 	 */
796 	if (mtu > IPV6_MMTU) {
797 		if ((flags & IPV6_MINMTU))
798 			mtu = IPV6_MMTU;
799 		else if (opt && opt->ip6po_minmtu == IP6PO_MINMTU_ALL)
800 			mtu = IPV6_MMTU;
801 		else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
802 			 (opt == NULL ||
803 			  opt->ip6po_minmtu != IP6PO_MINMTU_DISABLE)) {
804 			mtu = IPV6_MMTU;
805 		}
806 	}
807 
808 	/*
809 	 * clear embedded scope identifiers if necessary.
810 	 * in6_clearscope will touch the addresses only when necessary.
811 	 */
812 	in6_clearscope(&ip6->ip6_src);
813 	in6_clearscope(&ip6->ip6_dst);
814 
815 	/*
816 	 * If the outgoing packet contains a hop-by-hop options header,
817 	 * it must be examined and processed even by the source node.
818 	 * (RFC 2460, section 4.)
819 	 */
820 	if (exthdrs.ip6e_hbh) {
821 		struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh, struct ip6_hbh *);
822 		u_int32_t dummy; /* XXX unused */
823 		u_int32_t plen = 0; /* XXX: ip6_process will check the value */
824 
825 #ifdef DIAGNOSTIC
826 		if ((hbh->ip6h_len + 1) << 3 > exthdrs.ip6e_hbh->m_len)
827 			panic("ip6e_hbh is not continuous");
828 #endif
829 		/*
830 		 *  XXX: if we have to send an ICMPv6 error to the sender,
831 		 *       we need the M_LOOP flag since icmp6_error() expects
832 		 *       the IPv6 and the hop-by-hop options header are
833 		 *       continuous unless the flag is set.
834 		 */
835 		m->m_flags |= M_LOOP;
836 		m->m_pkthdr.rcvif = ifp;
837 		if (ip6_process_hopopts(m, (u_int8_t *)(hbh + 1),
838 		    ((hbh->ip6h_len + 1) << 3) - sizeof(struct ip6_hbh),
839 		    &dummy, &plen) < 0) {
840 			/* m was already freed at this point */
841 			error = EINVAL;/* better error? */
842 			goto done;
843 		}
844 		m->m_flags &= ~M_LOOP; /* XXX */
845 		m->m_pkthdr.rcvif = NULL;
846 	}
847 
848 	/* Jump over all PFIL processing if hooks are not active. */
849 	if (!PFIL_HOOKED(&inet6_pfil_hook))
850 		goto passout;
851 
852 	odst = ip6->ip6_dst;
853 	/* Run through list of hooks for output packets. */
854 	error = pfil_run_hooks(&inet6_pfil_hook, &m, ifp, PFIL_OUT, inp);
855 	if (error != 0 || m == NULL)
856 		goto done;
857 	ip6 = mtod(m, struct ip6_hdr *);
858 
859 	/* See if destination IP address was changed by packet filter. */
860 	if (!IN6_ARE_ADDR_EQUAL(&odst, &ip6->ip6_dst)) {
861 		m->m_flags |= M_SKIP_FIREWALL;
862 		/* If destination is now ourself drop to ip6_input(). */
863 		if (in6_localaddr(&ip6->ip6_dst)) {
864 			if (m->m_pkthdr.rcvif == NULL)
865 				m->m_pkthdr.rcvif = V_loif;
866 			if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
867 				m->m_pkthdr.csum_flags |=
868 				    CSUM_DATA_VALID | CSUM_PSEUDO_HDR;
869 				m->m_pkthdr.csum_data = 0xffff;
870 			}
871 			m->m_pkthdr.csum_flags |=
872 			    CSUM_IP_CHECKED | CSUM_IP_VALID;
873 			error = netisr_queue(NETISR_IPV6, m);
874 			goto done;
875 		} else
876 			goto again;	/* Redo the routing table lookup. */
877 	}
878 
879 	/* XXX: IPFIREWALL_FORWARD */
880 
881 passout:
882 	/*
883 	 * Send the packet to the outgoing interface.
884 	 * If necessary, do IPv6 fragmentation before sending.
885 	 *
886 	 * the logic here is rather complex:
887 	 * 1: normal case (dontfrag == 0, alwaysfrag == 0)
888 	 * 1-a:	send as is if tlen <= path mtu
889 	 * 1-b:	fragment if tlen > path mtu
890 	 *
891 	 * 2: if user asks us not to fragment (dontfrag == 1)
892 	 * 2-a:	send as is if tlen <= interface mtu
893 	 * 2-b:	error if tlen > interface mtu
894 	 *
895 	 * 3: if we always need to attach fragment header (alwaysfrag == 1)
896 	 *	always fragment
897 	 *
898 	 * 4: if dontfrag == 1 && alwaysfrag == 1
899 	 *	error, as we cannot handle this conflicting request
900 	 */
901 	tlen = m->m_pkthdr.len;
902 
903 	if (opt && (opt->ip6po_flags & IP6PO_DONTFRAG))
904 		dontfrag = 1;
905 	else
906 		dontfrag = 0;
907 	if (dontfrag && alwaysfrag) {	/* case 4 */
908 		/* conflicting request - can't transmit */
909 		error = EMSGSIZE;
910 		goto bad;
911 	}
912 	if (dontfrag && tlen > IN6_LINKMTU(ifp)) {	/* case 2-b */
913 		/*
914 		 * Even if the DONTFRAG option is specified, we cannot send the
915 		 * packet when the data length is larger than the MTU of the
916 		 * outgoing interface.
917 		 * Notify the error by sending IPV6_PATHMTU ancillary data as
918 		 * well as returning an error code (the latter is not described
919 		 * in the API spec.)
920 		 */
921 		u_int32_t mtu32;
922 		struct ip6ctlparam ip6cp;
923 
924 		mtu32 = (u_int32_t)mtu;
925 		bzero(&ip6cp, sizeof(ip6cp));
926 		ip6cp.ip6c_cmdarg = (void *)&mtu32;
927 		pfctlinput2(PRC_MSGSIZE, (struct sockaddr *)&ro_pmtu->ro_dst,
928 		    (void *)&ip6cp);
929 
930 		error = EMSGSIZE;
931 		goto bad;
932 	}
933 
934 	/*
935 	 * transmit packet without fragmentation
936 	 */
937 	if (dontfrag || (!alwaysfrag && tlen <= mtu)) {	/* case 1-a and 2-a */
938 		struct in6_ifaddr *ia6;
939 
940 		ip6 = mtod(m, struct ip6_hdr *);
941 		ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
942 		if (ia6) {
943 			/* Record statistics for this interface address. */
944 			ia6->ia_ifa.if_opackets++;
945 			ia6->ia_ifa.if_obytes += m->m_pkthdr.len;
946 		}
947 		error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
948 		goto done;
949 	}
950 
951 	/*
952 	 * try to fragment the packet.  case 1-b and 3
953 	 */
954 	if (mtu < IPV6_MMTU) {
955 		/* path MTU cannot be less than IPV6_MMTU */
956 		error = EMSGSIZE;
957 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
958 		goto bad;
959 	} else if (ip6->ip6_plen == 0) {
960 		/* jumbo payload cannot be fragmented */
961 		error = EMSGSIZE;
962 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
963 		goto bad;
964 	} else {
965 		struct mbuf **mnext, *m_frgpart;
966 		struct ip6_frag *ip6f;
967 		u_int32_t id = htonl(ip6_randomid());
968 		u_char nextproto;
969 
970 		int qslots = ifp->if_snd.ifq_maxlen - ifp->if_snd.ifq_len;
971 
972 		/*
973 		 * Too large for the destination or interface;
974 		 * fragment if possible.
975 		 * Must be able to put at least 8 bytes per fragment.
976 		 */
977 		hlen = unfragpartlen;
978 		if (mtu > IPV6_MAXPACKET)
979 			mtu = IPV6_MAXPACKET;
980 
981 		len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
982 		if (len < 8) {
983 			error = EMSGSIZE;
984 			in6_ifstat_inc(ifp, ifs6_out_fragfail);
985 			goto bad;
986 		}
987 
988 		/*
989 		 * Verify that we have any chance at all of being able to queue
990 		 *      the packet or packet fragments
991 		 */
992 		if (qslots <= 0 || ((u_int)qslots * (mtu - hlen)
993 		    < tlen  /* - hlen */)) {
994 			error = ENOBUFS;
995 			V_ip6stat.ip6s_odropped++;
996 			goto bad;
997 		}
998 
999 		mnext = &m->m_nextpkt;
1000 
1001 		/*
1002 		 * Change the next header field of the last header in the
1003 		 * unfragmentable part.
1004 		 */
1005 		if (exthdrs.ip6e_rthdr) {
1006 			nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
1007 			*mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
1008 		} else if (exthdrs.ip6e_dest1) {
1009 			nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
1010 			*mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
1011 		} else if (exthdrs.ip6e_hbh) {
1012 			nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
1013 			*mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
1014 		} else {
1015 			nextproto = ip6->ip6_nxt;
1016 			ip6->ip6_nxt = IPPROTO_FRAGMENT;
1017 		}
1018 
1019 		/*
1020 		 * Loop through length of segment after first fragment,
1021 		 * make new header and copy data of each part and link onto
1022 		 * chain.
1023 		 */
1024 		m0 = m;
1025 		for (off = hlen; off < tlen; off += len) {
1026 			MGETHDR(m, M_DONTWAIT, MT_HEADER);
1027 			if (!m) {
1028 				error = ENOBUFS;
1029 				V_ip6stat.ip6s_odropped++;
1030 				goto sendorfree;
1031 			}
1032 			m->m_pkthdr.rcvif = NULL;
1033 			m->m_flags = m0->m_flags & M_COPYFLAGS;
1034 			*mnext = m;
1035 			mnext = &m->m_nextpkt;
1036 			m->m_data += max_linkhdr;
1037 			mhip6 = mtod(m, struct ip6_hdr *);
1038 			*mhip6 = *ip6;
1039 			m->m_len = sizeof(*mhip6);
1040 			error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
1041 			if (error) {
1042 				V_ip6stat.ip6s_odropped++;
1043 				goto sendorfree;
1044 			}
1045 			ip6f->ip6f_offlg = htons((u_short)((off - hlen) & ~7));
1046 			if (off + len >= tlen)
1047 				len = tlen - off;
1048 			else
1049 				ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
1050 			mhip6->ip6_plen = htons((u_short)(len + hlen +
1051 			    sizeof(*ip6f) - sizeof(struct ip6_hdr)));
1052 			if ((m_frgpart = m_copy(m0, off, len)) == 0) {
1053 				error = ENOBUFS;
1054 				V_ip6stat.ip6s_odropped++;
1055 				goto sendorfree;
1056 			}
1057 			m_cat(m, m_frgpart);
1058 			m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
1059 			m->m_pkthdr.rcvif = NULL;
1060 			ip6f->ip6f_reserved = 0;
1061 			ip6f->ip6f_ident = id;
1062 			ip6f->ip6f_nxt = nextproto;
1063 			V_ip6stat.ip6s_ofragments++;
1064 			in6_ifstat_inc(ifp, ifs6_out_fragcreat);
1065 		}
1066 
1067 		in6_ifstat_inc(ifp, ifs6_out_fragok);
1068 	}
1069 
1070 	/*
1071 	 * Remove leading garbages.
1072 	 */
1073 sendorfree:
1074 	m = m0->m_nextpkt;
1075 	m0->m_nextpkt = 0;
1076 	m_freem(m0);
1077 	for (m0 = m; m; m = m0) {
1078 		m0 = m->m_nextpkt;
1079 		m->m_nextpkt = 0;
1080 		if (error == 0) {
1081 			/* Record statistics for this interface address. */
1082 			if (ia) {
1083 				ia->ia_ifa.if_opackets++;
1084 				ia->ia_ifa.if_obytes += m->m_pkthdr.len;
1085 			}
1086 			error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
1087 		} else
1088 			m_freem(m);
1089 	}
1090 
1091 	if (error == 0)
1092 		V_ip6stat.ip6s_fragmented++;
1093 
1094 done:
1095 	if (ro == &ip6route && ro->ro_rt) { /* brace necessary for RTFREE */
1096 		RTFREE(ro->ro_rt);
1097 	} else if (ro_pmtu == &ip6route && ro_pmtu->ro_rt) {
1098 		RTFREE(ro_pmtu->ro_rt);
1099 	}
1100 #ifdef IPSEC
1101 	if (sp != NULL)
1102 		KEY_FREESP(&sp);
1103 #endif
1104 
1105 	return (error);
1106 
1107 freehdrs:
1108 	m_freem(exthdrs.ip6e_hbh);	/* m_freem will check if mbuf is 0 */
1109 	m_freem(exthdrs.ip6e_dest1);
1110 	m_freem(exthdrs.ip6e_rthdr);
1111 	m_freem(exthdrs.ip6e_dest2);
1112 	/* FALLTHROUGH */
1113 bad:
1114 	if (m)
1115 		m_freem(m);
1116 	goto done;
1117 }
1118 
1119 static int
1120 ip6_copyexthdr(struct mbuf **mp, caddr_t hdr, int hlen)
1121 {
1122 	struct mbuf *m;
1123 
1124 	if (hlen > MCLBYTES)
1125 		return (ENOBUFS); /* XXX */
1126 
1127 	MGET(m, M_DONTWAIT, MT_DATA);
1128 	if (!m)
1129 		return (ENOBUFS);
1130 
1131 	if (hlen > MLEN) {
1132 		MCLGET(m, M_DONTWAIT);
1133 		if ((m->m_flags & M_EXT) == 0) {
1134 			m_free(m);
1135 			return (ENOBUFS);
1136 		}
1137 	}
1138 	m->m_len = hlen;
1139 	if (hdr)
1140 		bcopy(hdr, mtod(m, caddr_t), hlen);
1141 
1142 	*mp = m;
1143 	return (0);
1144 }
1145 
1146 /*
1147  * Insert jumbo payload option.
1148  */
1149 static int
1150 ip6_insert_jumboopt(struct ip6_exthdrs *exthdrs, u_int32_t plen)
1151 {
1152 	struct mbuf *mopt;
1153 	u_char *optbuf;
1154 	u_int32_t v;
1155 
1156 #define JUMBOOPTLEN	8	/* length of jumbo payload option and padding */
1157 
1158 	/*
1159 	 * If there is no hop-by-hop options header, allocate new one.
1160 	 * If there is one but it doesn't have enough space to store the
1161 	 * jumbo payload option, allocate a cluster to store the whole options.
1162 	 * Otherwise, use it to store the options.
1163 	 */
1164 	if (exthdrs->ip6e_hbh == 0) {
1165 		MGET(mopt, M_DONTWAIT, MT_DATA);
1166 		if (mopt == 0)
1167 			return (ENOBUFS);
1168 		mopt->m_len = JUMBOOPTLEN;
1169 		optbuf = mtod(mopt, u_char *);
1170 		optbuf[1] = 0;	/* = ((JUMBOOPTLEN) >> 3) - 1 */
1171 		exthdrs->ip6e_hbh = mopt;
1172 	} else {
1173 		struct ip6_hbh *hbh;
1174 
1175 		mopt = exthdrs->ip6e_hbh;
1176 		if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
1177 			/*
1178 			 * XXX assumption:
1179 			 * - exthdrs->ip6e_hbh is not referenced from places
1180 			 *   other than exthdrs.
1181 			 * - exthdrs->ip6e_hbh is not an mbuf chain.
1182 			 */
1183 			int oldoptlen = mopt->m_len;
1184 			struct mbuf *n;
1185 
1186 			/*
1187 			 * XXX: give up if the whole (new) hbh header does
1188 			 * not fit even in an mbuf cluster.
1189 			 */
1190 			if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
1191 				return (ENOBUFS);
1192 
1193 			/*
1194 			 * As a consequence, we must always prepare a cluster
1195 			 * at this point.
1196 			 */
1197 			MGET(n, M_DONTWAIT, MT_DATA);
1198 			if (n) {
1199 				MCLGET(n, M_DONTWAIT);
1200 				if ((n->m_flags & M_EXT) == 0) {
1201 					m_freem(n);
1202 					n = NULL;
1203 				}
1204 			}
1205 			if (!n)
1206 				return (ENOBUFS);
1207 			n->m_len = oldoptlen + JUMBOOPTLEN;
1208 			bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t),
1209 			    oldoptlen);
1210 			optbuf = mtod(n, caddr_t) + oldoptlen;
1211 			m_freem(mopt);
1212 			mopt = exthdrs->ip6e_hbh = n;
1213 		} else {
1214 			optbuf = mtod(mopt, u_char *) + mopt->m_len;
1215 			mopt->m_len += JUMBOOPTLEN;
1216 		}
1217 		optbuf[0] = IP6OPT_PADN;
1218 		optbuf[1] = 1;
1219 
1220 		/*
1221 		 * Adjust the header length according to the pad and
1222 		 * the jumbo payload option.
1223 		 */
1224 		hbh = mtod(mopt, struct ip6_hbh *);
1225 		hbh->ip6h_len += (JUMBOOPTLEN >> 3);
1226 	}
1227 
1228 	/* fill in the option. */
1229 	optbuf[2] = IP6OPT_JUMBO;
1230 	optbuf[3] = 4;
1231 	v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
1232 	bcopy(&v, &optbuf[4], sizeof(u_int32_t));
1233 
1234 	/* finally, adjust the packet header length */
1235 	exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
1236 
1237 	return (0);
1238 #undef JUMBOOPTLEN
1239 }
1240 
1241 /*
1242  * Insert fragment header and copy unfragmentable header portions.
1243  */
1244 static int
1245 ip6_insertfraghdr(struct mbuf *m0, struct mbuf *m, int hlen,
1246     struct ip6_frag **frghdrp)
1247 {
1248 	struct mbuf *n, *mlast;
1249 
1250 	if (hlen > sizeof(struct ip6_hdr)) {
1251 		n = m_copym(m0, sizeof(struct ip6_hdr),
1252 		    hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
1253 		if (n == 0)
1254 			return (ENOBUFS);
1255 		m->m_next = n;
1256 	} else
1257 		n = m;
1258 
1259 	/* Search for the last mbuf of unfragmentable part. */
1260 	for (mlast = n; mlast->m_next; mlast = mlast->m_next)
1261 		;
1262 
1263 	if ((mlast->m_flags & M_EXT) == 0 &&
1264 	    M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
1265 		/* use the trailing space of the last mbuf for the fragment hdr */
1266 		*frghdrp = (struct ip6_frag *)(mtod(mlast, caddr_t) +
1267 		    mlast->m_len);
1268 		mlast->m_len += sizeof(struct ip6_frag);
1269 		m->m_pkthdr.len += sizeof(struct ip6_frag);
1270 	} else {
1271 		/* allocate a new mbuf for the fragment header */
1272 		struct mbuf *mfrg;
1273 
1274 		MGET(mfrg, M_DONTWAIT, MT_DATA);
1275 		if (mfrg == 0)
1276 			return (ENOBUFS);
1277 		mfrg->m_len = sizeof(struct ip6_frag);
1278 		*frghdrp = mtod(mfrg, struct ip6_frag *);
1279 		mlast->m_next = mfrg;
1280 	}
1281 
1282 	return (0);
1283 }
1284 
1285 static int
1286 ip6_getpmtu(struct route_in6 *ro_pmtu, struct route_in6 *ro,
1287     struct ifnet *ifp, struct in6_addr *dst, u_long *mtup,
1288     int *alwaysfragp)
1289 {
1290 	u_int32_t mtu = 0;
1291 	int alwaysfrag = 0;
1292 	int error = 0;
1293 
1294 	if (ro_pmtu != ro) {
1295 		/* The first hop and the final destination may differ. */
1296 		struct sockaddr_in6 *sa6_dst =
1297 		    (struct sockaddr_in6 *)&ro_pmtu->ro_dst;
1298 		if (ro_pmtu->ro_rt &&
1299 		    ((ro_pmtu->ro_rt->rt_flags & RTF_UP) == 0 ||
1300 		     !IN6_ARE_ADDR_EQUAL(&sa6_dst->sin6_addr, dst))) {
1301 			RTFREE(ro_pmtu->ro_rt);
1302 			ro_pmtu->ro_rt = (struct rtentry *)NULL;
1303 		}
1304 		if (ro_pmtu->ro_rt == NULL) {
1305 			bzero(sa6_dst, sizeof(*sa6_dst));
1306 			sa6_dst->sin6_family = AF_INET6;
1307 			sa6_dst->sin6_len = sizeof(struct sockaddr_in6);
1308 			sa6_dst->sin6_addr = *dst;
1309 
1310 			rtalloc((struct route *)ro_pmtu);
1311 		}
1312 	}
1313 	if (ro_pmtu->ro_rt) {
1314 		u_int32_t ifmtu;
1315 		struct in_conninfo inc;
1316 
1317 		bzero(&inc, sizeof(inc));
1318 		inc.inc_flags = 1; /* IPv6 */
1319 		inc.inc6_faddr = *dst;
1320 
1321 		if (ifp == NULL)
1322 			ifp = ro_pmtu->ro_rt->rt_ifp;
1323 		ifmtu = IN6_LINKMTU(ifp);
1324 		mtu = tcp_hc_getmtu(&inc);
1325 		if (mtu)
1326 			mtu = min(mtu, ro_pmtu->ro_rt->rt_rmx.rmx_mtu);
1327 		else
1328 			mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
1329 		if (mtu == 0)
1330 			mtu = ifmtu;
1331 		else if (mtu < IPV6_MMTU) {
1332 			/*
1333 			 * RFC2460 section 5, last paragraph:
1334 			 * if we record ICMPv6 too big message with
1335 			 * mtu < IPV6_MMTU, transmit packets sized IPV6_MMTU
1336 			 * or smaller, with framgent header attached.
1337 			 * (fragment header is needed regardless from the
1338 			 * packet size, for translators to identify packets)
1339 			 */
1340 			alwaysfrag = 1;
1341 			mtu = IPV6_MMTU;
1342 		} else if (mtu > ifmtu) {
1343 			/*
1344 			 * The MTU on the route is larger than the MTU on
1345 			 * the interface!  This shouldn't happen, unless the
1346 			 * MTU of the interface has been changed after the
1347 			 * interface was brought up.  Change the MTU in the
1348 			 * route to match the interface MTU (as long as the
1349 			 * field isn't locked).
1350 			 */
1351 			mtu = ifmtu;
1352 			ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu;
1353 		}
1354 	} else if (ifp) {
1355 		mtu = IN6_LINKMTU(ifp);
1356 	} else
1357 		error = EHOSTUNREACH; /* XXX */
1358 
1359 	*mtup = mtu;
1360 	if (alwaysfragp)
1361 		*alwaysfragp = alwaysfrag;
1362 	return (error);
1363 }
1364 
1365 /*
1366  * IP6 socket option processing.
1367  */
1368 int
1369 ip6_ctloutput(struct socket *so, struct sockopt *sopt)
1370 {
1371 	int optdatalen, uproto;
1372 	void *optdata;
1373 	struct inpcb *in6p = sotoinpcb(so);
1374 	int error, optval;
1375 	int level, op, optname;
1376 	int optlen;
1377 	struct thread *td;
1378 
1379 	level = sopt->sopt_level;
1380 	op = sopt->sopt_dir;
1381 	optname = sopt->sopt_name;
1382 	optlen = sopt->sopt_valsize;
1383 	td = sopt->sopt_td;
1384 	error = 0;
1385 	optval = 0;
1386 	uproto = (int)so->so_proto->pr_protocol;
1387 
1388 	if (level == IPPROTO_IPV6) {
1389 		switch (op) {
1390 
1391 		case SOPT_SET:
1392 			switch (optname) {
1393 			case IPV6_2292PKTOPTIONS:
1394 #ifdef IPV6_PKTOPTIONS
1395 			case IPV6_PKTOPTIONS:
1396 #endif
1397 			{
1398 				struct mbuf *m;
1399 
1400 				error = soopt_getm(sopt, &m); /* XXX */
1401 				if (error != 0)
1402 					break;
1403 				error = soopt_mcopyin(sopt, m); /* XXX */
1404 				if (error != 0)
1405 					break;
1406 				error = ip6_pcbopts(&in6p->in6p_outputopts,
1407 						    m, so, sopt);
1408 				m_freem(m); /* XXX */
1409 				break;
1410 			}
1411 
1412 			/*
1413 			 * Use of some Hop-by-Hop options or some
1414 			 * Destination options, might require special
1415 			 * privilege.  That is, normal applications
1416 			 * (without special privilege) might be forbidden
1417 			 * from setting certain options in outgoing packets,
1418 			 * and might never see certain options in received
1419 			 * packets. [RFC 2292 Section 6]
1420 			 * KAME specific note:
1421 			 *  KAME prevents non-privileged users from sending or
1422 			 *  receiving ANY hbh/dst options in order to avoid
1423 			 *  overhead of parsing options in the kernel.
1424 			 */
1425 			case IPV6_RECVHOPOPTS:
1426 			case IPV6_RECVDSTOPTS:
1427 			case IPV6_RECVRTHDRDSTOPTS:
1428 				if (td != NULL) {
1429 					error = priv_check(td,
1430 					    PRIV_NETINET_SETHDROPTS);
1431 					if (error)
1432 						break;
1433 				}
1434 				/* FALLTHROUGH */
1435 			case IPV6_UNICAST_HOPS:
1436 			case IPV6_HOPLIMIT:
1437 			case IPV6_FAITH:
1438 
1439 			case IPV6_RECVPKTINFO:
1440 			case IPV6_RECVHOPLIMIT:
1441 			case IPV6_RECVRTHDR:
1442 			case IPV6_RECVPATHMTU:
1443 			case IPV6_RECVTCLASS:
1444 			case IPV6_V6ONLY:
1445 			case IPV6_AUTOFLOWLABEL:
1446 				if (optlen != sizeof(int)) {
1447 					error = EINVAL;
1448 					break;
1449 				}
1450 				error = sooptcopyin(sopt, &optval,
1451 					sizeof optval, sizeof optval);
1452 				if (error)
1453 					break;
1454 				switch (optname) {
1455 
1456 				case IPV6_UNICAST_HOPS:
1457 					if (optval < -1 || optval >= 256)
1458 						error = EINVAL;
1459 					else {
1460 						/* -1 = kernel default */
1461 						in6p->in6p_hops = optval;
1462 						if ((in6p->in6p_vflag &
1463 						     INP_IPV4) != 0)
1464 							in6p->inp_ip_ttl = optval;
1465 					}
1466 					break;
1467 #define OPTSET(bit) \
1468 do { \
1469 	if (optval) \
1470 		in6p->in6p_flags |= (bit); \
1471 	else \
1472 		in6p->in6p_flags &= ~(bit); \
1473 } while (/*CONSTCOND*/ 0)
1474 #define OPTSET2292(bit) \
1475 do { \
1476 	in6p->in6p_flags |= IN6P_RFC2292; \
1477 	if (optval) \
1478 		in6p->in6p_flags |= (bit); \
1479 	else \
1480 		in6p->in6p_flags &= ~(bit); \
1481 } while (/*CONSTCOND*/ 0)
1482 #define OPTBIT(bit) (in6p->in6p_flags & (bit) ? 1 : 0)
1483 
1484 				case IPV6_RECVPKTINFO:
1485 					/* cannot mix with RFC2292 */
1486 					if (OPTBIT(IN6P_RFC2292)) {
1487 						error = EINVAL;
1488 						break;
1489 					}
1490 					OPTSET(IN6P_PKTINFO);
1491 					break;
1492 
1493 				case IPV6_HOPLIMIT:
1494 				{
1495 					struct ip6_pktopts **optp;
1496 
1497 					/* cannot mix with RFC2292 */
1498 					if (OPTBIT(IN6P_RFC2292)) {
1499 						error = EINVAL;
1500 						break;
1501 					}
1502 					optp = &in6p->in6p_outputopts;
1503 					error = ip6_pcbopt(IPV6_HOPLIMIT,
1504 					    (u_char *)&optval, sizeof(optval),
1505 					    optp, (td != NULL) ? td->td_ucred :
1506 					    NULL, uproto);
1507 					break;
1508 				}
1509 
1510 				case IPV6_RECVHOPLIMIT:
1511 					/* cannot mix with RFC2292 */
1512 					if (OPTBIT(IN6P_RFC2292)) {
1513 						error = EINVAL;
1514 						break;
1515 					}
1516 					OPTSET(IN6P_HOPLIMIT);
1517 					break;
1518 
1519 				case IPV6_RECVHOPOPTS:
1520 					/* cannot mix with RFC2292 */
1521 					if (OPTBIT(IN6P_RFC2292)) {
1522 						error = EINVAL;
1523 						break;
1524 					}
1525 					OPTSET(IN6P_HOPOPTS);
1526 					break;
1527 
1528 				case IPV6_RECVDSTOPTS:
1529 					/* cannot mix with RFC2292 */
1530 					if (OPTBIT(IN6P_RFC2292)) {
1531 						error = EINVAL;
1532 						break;
1533 					}
1534 					OPTSET(IN6P_DSTOPTS);
1535 					break;
1536 
1537 				case IPV6_RECVRTHDRDSTOPTS:
1538 					/* cannot mix with RFC2292 */
1539 					if (OPTBIT(IN6P_RFC2292)) {
1540 						error = EINVAL;
1541 						break;
1542 					}
1543 					OPTSET(IN6P_RTHDRDSTOPTS);
1544 					break;
1545 
1546 				case IPV6_RECVRTHDR:
1547 					/* cannot mix with RFC2292 */
1548 					if (OPTBIT(IN6P_RFC2292)) {
1549 						error = EINVAL;
1550 						break;
1551 					}
1552 					OPTSET(IN6P_RTHDR);
1553 					break;
1554 
1555 				case IPV6_FAITH:
1556 					OPTSET(IN6P_FAITH);
1557 					break;
1558 
1559 				case IPV6_RECVPATHMTU:
1560 					/*
1561 					 * We ignore this option for TCP
1562 					 * sockets.
1563 					 * (RFC3542 leaves this case
1564 					 * unspecified.)
1565 					 */
1566 					if (uproto != IPPROTO_TCP)
1567 						OPTSET(IN6P_MTU);
1568 					break;
1569 
1570 				case IPV6_V6ONLY:
1571 					/*
1572 					 * make setsockopt(IPV6_V6ONLY)
1573 					 * available only prior to bind(2).
1574 					 * see ipng mailing list, Jun 22 2001.
1575 					 */
1576 					if (in6p->in6p_lport ||
1577 					    !IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr)) {
1578 						error = EINVAL;
1579 						break;
1580 					}
1581 					OPTSET(IN6P_IPV6_V6ONLY);
1582 					if (optval)
1583 						in6p->in6p_vflag &= ~INP_IPV4;
1584 					else
1585 						in6p->in6p_vflag |= INP_IPV4;
1586 					break;
1587 				case IPV6_RECVTCLASS:
1588 					/* cannot mix with RFC2292 XXX */
1589 					if (OPTBIT(IN6P_RFC2292)) {
1590 						error = EINVAL;
1591 						break;
1592 					}
1593 					OPTSET(IN6P_TCLASS);
1594 					break;
1595 				case IPV6_AUTOFLOWLABEL:
1596 					OPTSET(IN6P_AUTOFLOWLABEL);
1597 					break;
1598 
1599 				}
1600 				break;
1601 
1602 			case IPV6_TCLASS:
1603 			case IPV6_DONTFRAG:
1604 			case IPV6_USE_MIN_MTU:
1605 			case IPV6_PREFER_TEMPADDR:
1606 				if (optlen != sizeof(optval)) {
1607 					error = EINVAL;
1608 					break;
1609 				}
1610 				error = sooptcopyin(sopt, &optval,
1611 					sizeof optval, sizeof optval);
1612 				if (error)
1613 					break;
1614 				{
1615 					struct ip6_pktopts **optp;
1616 					optp = &in6p->in6p_outputopts;
1617 					error = ip6_pcbopt(optname,
1618 					    (u_char *)&optval, sizeof(optval),
1619 					    optp, (td != NULL) ? td->td_ucred :
1620 					    NULL, uproto);
1621 					break;
1622 				}
1623 
1624 			case IPV6_2292PKTINFO:
1625 			case IPV6_2292HOPLIMIT:
1626 			case IPV6_2292HOPOPTS:
1627 			case IPV6_2292DSTOPTS:
1628 			case IPV6_2292RTHDR:
1629 				/* RFC 2292 */
1630 				if (optlen != sizeof(int)) {
1631 					error = EINVAL;
1632 					break;
1633 				}
1634 				error = sooptcopyin(sopt, &optval,
1635 					sizeof optval, sizeof optval);
1636 				if (error)
1637 					break;
1638 				switch (optname) {
1639 				case IPV6_2292PKTINFO:
1640 					OPTSET2292(IN6P_PKTINFO);
1641 					break;
1642 				case IPV6_2292HOPLIMIT:
1643 					OPTSET2292(IN6P_HOPLIMIT);
1644 					break;
1645 				case IPV6_2292HOPOPTS:
1646 					/*
1647 					 * Check super-user privilege.
1648 					 * See comments for IPV6_RECVHOPOPTS.
1649 					 */
1650 					if (td != NULL) {
1651 						error = priv_check(td,
1652 						    PRIV_NETINET_SETHDROPTS);
1653 						if (error)
1654 							return (error);
1655 					}
1656 					OPTSET2292(IN6P_HOPOPTS);
1657 					break;
1658 				case IPV6_2292DSTOPTS:
1659 					if (td != NULL) {
1660 						error = priv_check(td,
1661 						    PRIV_NETINET_SETHDROPTS);
1662 						if (error)
1663 							return (error);
1664 					}
1665 					OPTSET2292(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS); /* XXX */
1666 					break;
1667 				case IPV6_2292RTHDR:
1668 					OPTSET2292(IN6P_RTHDR);
1669 					break;
1670 				}
1671 				break;
1672 			case IPV6_PKTINFO:
1673 			case IPV6_HOPOPTS:
1674 			case IPV6_RTHDR:
1675 			case IPV6_DSTOPTS:
1676 			case IPV6_RTHDRDSTOPTS:
1677 			case IPV6_NEXTHOP:
1678 			{
1679 				/* new advanced API (RFC3542) */
1680 				u_char *optbuf;
1681 				u_char optbuf_storage[MCLBYTES];
1682 				int optlen;
1683 				struct ip6_pktopts **optp;
1684 
1685 				/* cannot mix with RFC2292 */
1686 				if (OPTBIT(IN6P_RFC2292)) {
1687 					error = EINVAL;
1688 					break;
1689 				}
1690 
1691 				/*
1692 				 * We only ensure valsize is not too large
1693 				 * here.  Further validation will be done
1694 				 * later.
1695 				 */
1696 				error = sooptcopyin(sopt, optbuf_storage,
1697 				    sizeof(optbuf_storage), 0);
1698 				if (error)
1699 					break;
1700 				optlen = sopt->sopt_valsize;
1701 				optbuf = optbuf_storage;
1702 				optp = &in6p->in6p_outputopts;
1703 				error = ip6_pcbopt(optname, optbuf, optlen,
1704 				    optp, (td != NULL) ? td->td_ucred : NULL,
1705 				    uproto);
1706 				break;
1707 			}
1708 #undef OPTSET
1709 
1710 			case IPV6_MULTICAST_IF:
1711 			case IPV6_MULTICAST_HOPS:
1712 			case IPV6_MULTICAST_LOOP:
1713 			case IPV6_JOIN_GROUP:
1714 			case IPV6_LEAVE_GROUP:
1715 			    {
1716 				if (sopt->sopt_valsize > MLEN) {
1717 					error = EMSGSIZE;
1718 					break;
1719 				}
1720 				/* XXX */
1721 			    }
1722 			    /* FALLTHROUGH */
1723 			    {
1724 				struct mbuf *m;
1725 
1726 				if (sopt->sopt_valsize > MCLBYTES) {
1727 					error = EMSGSIZE;
1728 					break;
1729 				}
1730 				/* XXX */
1731 				MGET(m, sopt->sopt_td ? M_WAIT : M_DONTWAIT, MT_DATA);
1732 				if (m == 0) {
1733 					error = ENOBUFS;
1734 					break;
1735 				}
1736 				if (sopt->sopt_valsize > MLEN) {
1737 					MCLGET(m, sopt->sopt_td ? M_WAIT : M_DONTWAIT);
1738 					if ((m->m_flags & M_EXT) == 0) {
1739 						m_free(m);
1740 						error = ENOBUFS;
1741 						break;
1742 					}
1743 				}
1744 				m->m_len = sopt->sopt_valsize;
1745 				error = sooptcopyin(sopt, mtod(m, char *),
1746 						    m->m_len, m->m_len);
1747 				if (error) {
1748 					(void)m_free(m);
1749 					break;
1750 				}
1751 				error =	ip6_setmoptions(sopt->sopt_name,
1752 							&in6p->in6p_moptions,
1753 							m);
1754 				(void)m_free(m);
1755 			    }
1756 				break;
1757 
1758 			case IPV6_PORTRANGE:
1759 				error = sooptcopyin(sopt, &optval,
1760 				    sizeof optval, sizeof optval);
1761 				if (error)
1762 					break;
1763 
1764 				switch (optval) {
1765 				case IPV6_PORTRANGE_DEFAULT:
1766 					in6p->in6p_flags &= ~(IN6P_LOWPORT);
1767 					in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1768 					break;
1769 
1770 				case IPV6_PORTRANGE_HIGH:
1771 					in6p->in6p_flags &= ~(IN6P_LOWPORT);
1772 					in6p->in6p_flags |= IN6P_HIGHPORT;
1773 					break;
1774 
1775 				case IPV6_PORTRANGE_LOW:
1776 					in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1777 					in6p->in6p_flags |= IN6P_LOWPORT;
1778 					break;
1779 
1780 				default:
1781 					error = EINVAL;
1782 					break;
1783 				}
1784 				break;
1785 
1786 #ifdef IPSEC
1787 			case IPV6_IPSEC_POLICY:
1788 			{
1789 				caddr_t req;
1790 				struct mbuf *m;
1791 
1792 				if ((error = soopt_getm(sopt, &m)) != 0) /* XXX */
1793 					break;
1794 				if ((error = soopt_mcopyin(sopt, m)) != 0) /* XXX */
1795 					break;
1796 				req = mtod(m, caddr_t);
1797 				error = ipsec6_set_policy(in6p, optname, req,
1798 				    m->m_len, (sopt->sopt_td != NULL) ?
1799 				    sopt->sopt_td->td_ucred : NULL);
1800 				m_freem(m);
1801 				break;
1802 			}
1803 #endif /* IPSEC */
1804 
1805 			default:
1806 				error = ENOPROTOOPT;
1807 				break;
1808 			}
1809 			break;
1810 
1811 		case SOPT_GET:
1812 			switch (optname) {
1813 
1814 			case IPV6_2292PKTOPTIONS:
1815 #ifdef IPV6_PKTOPTIONS
1816 			case IPV6_PKTOPTIONS:
1817 #endif
1818 				/*
1819 				 * RFC3542 (effectively) deprecated the
1820 				 * semantics of the 2292-style pktoptions.
1821 				 * Since it was not reliable in nature (i.e.,
1822 				 * applications had to expect the lack of some
1823 				 * information after all), it would make sense
1824 				 * to simplify this part by always returning
1825 				 * empty data.
1826 				 */
1827 				sopt->sopt_valsize = 0;
1828 				break;
1829 
1830 			case IPV6_RECVHOPOPTS:
1831 			case IPV6_RECVDSTOPTS:
1832 			case IPV6_RECVRTHDRDSTOPTS:
1833 			case IPV6_UNICAST_HOPS:
1834 			case IPV6_RECVPKTINFO:
1835 			case IPV6_RECVHOPLIMIT:
1836 			case IPV6_RECVRTHDR:
1837 			case IPV6_RECVPATHMTU:
1838 
1839 			case IPV6_FAITH:
1840 			case IPV6_V6ONLY:
1841 			case IPV6_PORTRANGE:
1842 			case IPV6_RECVTCLASS:
1843 			case IPV6_AUTOFLOWLABEL:
1844 				switch (optname) {
1845 
1846 				case IPV6_RECVHOPOPTS:
1847 					optval = OPTBIT(IN6P_HOPOPTS);
1848 					break;
1849 
1850 				case IPV6_RECVDSTOPTS:
1851 					optval = OPTBIT(IN6P_DSTOPTS);
1852 					break;
1853 
1854 				case IPV6_RECVRTHDRDSTOPTS:
1855 					optval = OPTBIT(IN6P_RTHDRDSTOPTS);
1856 					break;
1857 
1858 				case IPV6_UNICAST_HOPS:
1859 					optval = in6p->in6p_hops;
1860 					break;
1861 
1862 				case IPV6_RECVPKTINFO:
1863 					optval = OPTBIT(IN6P_PKTINFO);
1864 					break;
1865 
1866 				case IPV6_RECVHOPLIMIT:
1867 					optval = OPTBIT(IN6P_HOPLIMIT);
1868 					break;
1869 
1870 				case IPV6_RECVRTHDR:
1871 					optval = OPTBIT(IN6P_RTHDR);
1872 					break;
1873 
1874 				case IPV6_RECVPATHMTU:
1875 					optval = OPTBIT(IN6P_MTU);
1876 					break;
1877 
1878 				case IPV6_FAITH:
1879 					optval = OPTBIT(IN6P_FAITH);
1880 					break;
1881 
1882 				case IPV6_V6ONLY:
1883 					optval = OPTBIT(IN6P_IPV6_V6ONLY);
1884 					break;
1885 
1886 				case IPV6_PORTRANGE:
1887 				    {
1888 					int flags;
1889 					flags = in6p->in6p_flags;
1890 					if (flags & IN6P_HIGHPORT)
1891 						optval = IPV6_PORTRANGE_HIGH;
1892 					else if (flags & IN6P_LOWPORT)
1893 						optval = IPV6_PORTRANGE_LOW;
1894 					else
1895 						optval = 0;
1896 					break;
1897 				    }
1898 				case IPV6_RECVTCLASS:
1899 					optval = OPTBIT(IN6P_TCLASS);
1900 					break;
1901 
1902 				case IPV6_AUTOFLOWLABEL:
1903 					optval = OPTBIT(IN6P_AUTOFLOWLABEL);
1904 					break;
1905 				}
1906 				if (error)
1907 					break;
1908 				error = sooptcopyout(sopt, &optval,
1909 					sizeof optval);
1910 				break;
1911 
1912 			case IPV6_PATHMTU:
1913 			{
1914 				u_long pmtu = 0;
1915 				struct ip6_mtuinfo mtuinfo;
1916 				struct route_in6 sro;
1917 
1918 				bzero(&sro, sizeof(sro));
1919 
1920 				if (!(so->so_state & SS_ISCONNECTED))
1921 					return (ENOTCONN);
1922 				/*
1923 				 * XXX: we dot not consider the case of source
1924 				 * routing, or optional information to specify
1925 				 * the outgoing interface.
1926 				 */
1927 				error = ip6_getpmtu(&sro, NULL, NULL,
1928 				    &in6p->in6p_faddr, &pmtu, NULL);
1929 				if (sro.ro_rt)
1930 					RTFREE(sro.ro_rt);
1931 				if (error)
1932 					break;
1933 				if (pmtu > IPV6_MAXPACKET)
1934 					pmtu = IPV6_MAXPACKET;
1935 
1936 				bzero(&mtuinfo, sizeof(mtuinfo));
1937 				mtuinfo.ip6m_mtu = (u_int32_t)pmtu;
1938 				optdata = (void *)&mtuinfo;
1939 				optdatalen = sizeof(mtuinfo);
1940 				error = sooptcopyout(sopt, optdata,
1941 				    optdatalen);
1942 				break;
1943 			}
1944 
1945 			case IPV6_2292PKTINFO:
1946 			case IPV6_2292HOPLIMIT:
1947 			case IPV6_2292HOPOPTS:
1948 			case IPV6_2292RTHDR:
1949 			case IPV6_2292DSTOPTS:
1950 				switch (optname) {
1951 				case IPV6_2292PKTINFO:
1952 					optval = OPTBIT(IN6P_PKTINFO);
1953 					break;
1954 				case IPV6_2292HOPLIMIT:
1955 					optval = OPTBIT(IN6P_HOPLIMIT);
1956 					break;
1957 				case IPV6_2292HOPOPTS:
1958 					optval = OPTBIT(IN6P_HOPOPTS);
1959 					break;
1960 				case IPV6_2292RTHDR:
1961 					optval = OPTBIT(IN6P_RTHDR);
1962 					break;
1963 				case IPV6_2292DSTOPTS:
1964 					optval = OPTBIT(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS);
1965 					break;
1966 				}
1967 				error = sooptcopyout(sopt, &optval,
1968 				    sizeof optval);
1969 				break;
1970 			case IPV6_PKTINFO:
1971 			case IPV6_HOPOPTS:
1972 			case IPV6_RTHDR:
1973 			case IPV6_DSTOPTS:
1974 			case IPV6_RTHDRDSTOPTS:
1975 			case IPV6_NEXTHOP:
1976 			case IPV6_TCLASS:
1977 			case IPV6_DONTFRAG:
1978 			case IPV6_USE_MIN_MTU:
1979 			case IPV6_PREFER_TEMPADDR:
1980 				error = ip6_getpcbopt(in6p->in6p_outputopts,
1981 				    optname, sopt);
1982 				break;
1983 
1984 			case IPV6_MULTICAST_IF:
1985 			case IPV6_MULTICAST_HOPS:
1986 			case IPV6_MULTICAST_LOOP:
1987 			case IPV6_JOIN_GROUP:
1988 			case IPV6_LEAVE_GROUP:
1989 			    {
1990 				struct mbuf *m;
1991 				error = ip6_getmoptions(sopt->sopt_name,
1992 				    in6p->in6p_moptions, &m);
1993 				if (error == 0)
1994 					error = sooptcopyout(sopt,
1995 					    mtod(m, char *), m->m_len);
1996 				m_freem(m);
1997 			    }
1998 				break;
1999 
2000 #ifdef IPSEC
2001 			case IPV6_IPSEC_POLICY:
2002 			  {
2003 				caddr_t req = NULL;
2004 				size_t len = 0;
2005 				struct mbuf *m = NULL;
2006 				struct mbuf **mp = &m;
2007 				size_t ovalsize = sopt->sopt_valsize;
2008 				caddr_t oval = (caddr_t)sopt->sopt_val;
2009 
2010 				error = soopt_getm(sopt, &m); /* XXX */
2011 				if (error != 0)
2012 					break;
2013 				error = soopt_mcopyin(sopt, m); /* XXX */
2014 				if (error != 0)
2015 					break;
2016 				sopt->sopt_valsize = ovalsize;
2017 				sopt->sopt_val = oval;
2018 				if (m) {
2019 					req = mtod(m, caddr_t);
2020 					len = m->m_len;
2021 				}
2022 				error = ipsec6_get_policy(in6p, req, len, mp);
2023 				if (error == 0)
2024 					error = soopt_mcopyout(sopt, m); /* XXX */
2025 				if (error == 0 && m)
2026 					m_freem(m);
2027 				break;
2028 			  }
2029 #endif /* IPSEC */
2030 
2031 			default:
2032 				error = ENOPROTOOPT;
2033 				break;
2034 			}
2035 			break;
2036 		}
2037 	} else {		/* level != IPPROTO_IPV6 */
2038 		error = EINVAL;
2039 	}
2040 	return (error);
2041 }
2042 
2043 int
2044 ip6_raw_ctloutput(struct socket *so, struct sockopt *sopt)
2045 {
2046 	int error = 0, optval, optlen;
2047 	const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
2048 	struct in6pcb *in6p = sotoin6pcb(so);
2049 	int level, op, optname;
2050 
2051 	level = sopt->sopt_level;
2052 	op = sopt->sopt_dir;
2053 	optname = sopt->sopt_name;
2054 	optlen = sopt->sopt_valsize;
2055 
2056 	if (level != IPPROTO_IPV6) {
2057 		return (EINVAL);
2058 	}
2059 
2060 	switch (optname) {
2061 	case IPV6_CHECKSUM:
2062 		/*
2063 		 * For ICMPv6 sockets, no modification allowed for checksum
2064 		 * offset, permit "no change" values to help existing apps.
2065 		 *
2066 		 * RFC3542 says: "An attempt to set IPV6_CHECKSUM
2067 		 * for an ICMPv6 socket will fail."
2068 		 * The current behavior does not meet RFC3542.
2069 		 */
2070 		switch (op) {
2071 		case SOPT_SET:
2072 			if (optlen != sizeof(int)) {
2073 				error = EINVAL;
2074 				break;
2075 			}
2076 			error = sooptcopyin(sopt, &optval, sizeof(optval),
2077 					    sizeof(optval));
2078 			if (error)
2079 				break;
2080 			if ((optval % 2) != 0) {
2081 				/* the API assumes even offset values */
2082 				error = EINVAL;
2083 			} else if (so->so_proto->pr_protocol ==
2084 			    IPPROTO_ICMPV6) {
2085 				if (optval != icmp6off)
2086 					error = EINVAL;
2087 			} else
2088 				in6p->in6p_cksum = optval;
2089 			break;
2090 
2091 		case SOPT_GET:
2092 			if (so->so_proto->pr_protocol == IPPROTO_ICMPV6)
2093 				optval = icmp6off;
2094 			else
2095 				optval = in6p->in6p_cksum;
2096 
2097 			error = sooptcopyout(sopt, &optval, sizeof(optval));
2098 			break;
2099 
2100 		default:
2101 			error = EINVAL;
2102 			break;
2103 		}
2104 		break;
2105 
2106 	default:
2107 		error = ENOPROTOOPT;
2108 		break;
2109 	}
2110 
2111 	return (error);
2112 }
2113 
2114 /*
2115  * Set up IP6 options in pcb for insertion in output packets or
2116  * specifying behavior of outgoing packets.
2117  */
2118 static int
2119 ip6_pcbopts(struct ip6_pktopts **pktopt, struct mbuf *m,
2120     struct socket *so, struct sockopt *sopt)
2121 {
2122 	struct ip6_pktopts *opt = *pktopt;
2123 	int error = 0;
2124 	struct thread *td = sopt->sopt_td;
2125 
2126 	/* turn off any old options. */
2127 	if (opt) {
2128 #ifdef DIAGNOSTIC
2129 		if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
2130 		    opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
2131 		    opt->ip6po_rhinfo.ip6po_rhi_rthdr)
2132 			printf("ip6_pcbopts: all specified options are cleared.\n");
2133 #endif
2134 		ip6_clearpktopts(opt, -1);
2135 	} else
2136 		opt = malloc(sizeof(*opt), M_IP6OPT, M_WAITOK);
2137 	*pktopt = NULL;
2138 
2139 	if (!m || m->m_len == 0) {
2140 		/*
2141 		 * Only turning off any previous options, regardless of
2142 		 * whether the opt is just created or given.
2143 		 */
2144 		free(opt, M_IP6OPT);
2145 		return (0);
2146 	}
2147 
2148 	/*  set options specified by user. */
2149 	if ((error = ip6_setpktopts(m, opt, NULL, (td != NULL) ?
2150 	    td->td_ucred : NULL, so->so_proto->pr_protocol)) != 0) {
2151 		ip6_clearpktopts(opt, -1); /* XXX: discard all options */
2152 		free(opt, M_IP6OPT);
2153 		return (error);
2154 	}
2155 	*pktopt = opt;
2156 	return (0);
2157 }
2158 
2159 /*
2160  * initialize ip6_pktopts.  beware that there are non-zero default values in
2161  * the struct.
2162  */
2163 void
2164 ip6_initpktopts(struct ip6_pktopts *opt)
2165 {
2166 
2167 	bzero(opt, sizeof(*opt));
2168 	opt->ip6po_hlim = -1;	/* -1 means default hop limit */
2169 	opt->ip6po_tclass = -1;	/* -1 means default traffic class */
2170 	opt->ip6po_minmtu = IP6PO_MINMTU_MCASTONLY;
2171 	opt->ip6po_prefer_tempaddr = IP6PO_TEMPADDR_SYSTEM;
2172 }
2173 
2174 static int
2175 ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt,
2176     struct ucred *cred, int uproto)
2177 {
2178 	struct ip6_pktopts *opt;
2179 
2180 	if (*pktopt == NULL) {
2181 		*pktopt = malloc(sizeof(struct ip6_pktopts), M_IP6OPT,
2182 		    M_WAITOK);
2183 		ip6_initpktopts(*pktopt);
2184 	}
2185 	opt = *pktopt;
2186 
2187 	return (ip6_setpktopt(optname, buf, len, opt, cred, 1, 0, uproto));
2188 }
2189 
2190 static int
2191 ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct sockopt *sopt)
2192 {
2193 	void *optdata = NULL;
2194 	int optdatalen = 0;
2195 	struct ip6_ext *ip6e;
2196 	int error = 0;
2197 	struct in6_pktinfo null_pktinfo;
2198 	int deftclass = 0, on;
2199 	int defminmtu = IP6PO_MINMTU_MCASTONLY;
2200 	int defpreftemp = IP6PO_TEMPADDR_SYSTEM;
2201 
2202 	switch (optname) {
2203 	case IPV6_PKTINFO:
2204 		if (pktopt && pktopt->ip6po_pktinfo)
2205 			optdata = (void *)pktopt->ip6po_pktinfo;
2206 		else {
2207 			/* XXX: we don't have to do this every time... */
2208 			bzero(&null_pktinfo, sizeof(null_pktinfo));
2209 			optdata = (void *)&null_pktinfo;
2210 		}
2211 		optdatalen = sizeof(struct in6_pktinfo);
2212 		break;
2213 	case IPV6_TCLASS:
2214 		if (pktopt && pktopt->ip6po_tclass >= 0)
2215 			optdata = (void *)&pktopt->ip6po_tclass;
2216 		else
2217 			optdata = (void *)&deftclass;
2218 		optdatalen = sizeof(int);
2219 		break;
2220 	case IPV6_HOPOPTS:
2221 		if (pktopt && pktopt->ip6po_hbh) {
2222 			optdata = (void *)pktopt->ip6po_hbh;
2223 			ip6e = (struct ip6_ext *)pktopt->ip6po_hbh;
2224 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2225 		}
2226 		break;
2227 	case IPV6_RTHDR:
2228 		if (pktopt && pktopt->ip6po_rthdr) {
2229 			optdata = (void *)pktopt->ip6po_rthdr;
2230 			ip6e = (struct ip6_ext *)pktopt->ip6po_rthdr;
2231 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2232 		}
2233 		break;
2234 	case IPV6_RTHDRDSTOPTS:
2235 		if (pktopt && pktopt->ip6po_dest1) {
2236 			optdata = (void *)pktopt->ip6po_dest1;
2237 			ip6e = (struct ip6_ext *)pktopt->ip6po_dest1;
2238 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2239 		}
2240 		break;
2241 	case IPV6_DSTOPTS:
2242 		if (pktopt && pktopt->ip6po_dest2) {
2243 			optdata = (void *)pktopt->ip6po_dest2;
2244 			ip6e = (struct ip6_ext *)pktopt->ip6po_dest2;
2245 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2246 		}
2247 		break;
2248 	case IPV6_NEXTHOP:
2249 		if (pktopt && pktopt->ip6po_nexthop) {
2250 			optdata = (void *)pktopt->ip6po_nexthop;
2251 			optdatalen = pktopt->ip6po_nexthop->sa_len;
2252 		}
2253 		break;
2254 	case IPV6_USE_MIN_MTU:
2255 		if (pktopt)
2256 			optdata = (void *)&pktopt->ip6po_minmtu;
2257 		else
2258 			optdata = (void *)&defminmtu;
2259 		optdatalen = sizeof(int);
2260 		break;
2261 	case IPV6_DONTFRAG:
2262 		if (pktopt && ((pktopt->ip6po_flags) & IP6PO_DONTFRAG))
2263 			on = 1;
2264 		else
2265 			on = 0;
2266 		optdata = (void *)&on;
2267 		optdatalen = sizeof(on);
2268 		break;
2269 	case IPV6_PREFER_TEMPADDR:
2270 		if (pktopt)
2271 			optdata = (void *)&pktopt->ip6po_prefer_tempaddr;
2272 		else
2273 			optdata = (void *)&defpreftemp;
2274 		optdatalen = sizeof(int);
2275 		break;
2276 	default:		/* should not happen */
2277 #ifdef DIAGNOSTIC
2278 		panic("ip6_getpcbopt: unexpected option\n");
2279 #endif
2280 		return (ENOPROTOOPT);
2281 	}
2282 
2283 	error = sooptcopyout(sopt, optdata, optdatalen);
2284 
2285 	return (error);
2286 }
2287 
2288 void
2289 ip6_clearpktopts(struct ip6_pktopts *pktopt, int optname)
2290 {
2291 	if (pktopt == NULL)
2292 		return;
2293 
2294 	if (optname == -1 || optname == IPV6_PKTINFO) {
2295 		if (pktopt->ip6po_pktinfo)
2296 			free(pktopt->ip6po_pktinfo, M_IP6OPT);
2297 		pktopt->ip6po_pktinfo = NULL;
2298 	}
2299 	if (optname == -1 || optname == IPV6_HOPLIMIT)
2300 		pktopt->ip6po_hlim = -1;
2301 	if (optname == -1 || optname == IPV6_TCLASS)
2302 		pktopt->ip6po_tclass = -1;
2303 	if (optname == -1 || optname == IPV6_NEXTHOP) {
2304 		if (pktopt->ip6po_nextroute.ro_rt) {
2305 			RTFREE(pktopt->ip6po_nextroute.ro_rt);
2306 			pktopt->ip6po_nextroute.ro_rt = NULL;
2307 		}
2308 		if (pktopt->ip6po_nexthop)
2309 			free(pktopt->ip6po_nexthop, M_IP6OPT);
2310 		pktopt->ip6po_nexthop = NULL;
2311 	}
2312 	if (optname == -1 || optname == IPV6_HOPOPTS) {
2313 		if (pktopt->ip6po_hbh)
2314 			free(pktopt->ip6po_hbh, M_IP6OPT);
2315 		pktopt->ip6po_hbh = NULL;
2316 	}
2317 	if (optname == -1 || optname == IPV6_RTHDRDSTOPTS) {
2318 		if (pktopt->ip6po_dest1)
2319 			free(pktopt->ip6po_dest1, M_IP6OPT);
2320 		pktopt->ip6po_dest1 = NULL;
2321 	}
2322 	if (optname == -1 || optname == IPV6_RTHDR) {
2323 		if (pktopt->ip6po_rhinfo.ip6po_rhi_rthdr)
2324 			free(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr, M_IP6OPT);
2325 		pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
2326 		if (pktopt->ip6po_route.ro_rt) {
2327 			RTFREE(pktopt->ip6po_route.ro_rt);
2328 			pktopt->ip6po_route.ro_rt = NULL;
2329 		}
2330 	}
2331 	if (optname == -1 || optname == IPV6_DSTOPTS) {
2332 		if (pktopt->ip6po_dest2)
2333 			free(pktopt->ip6po_dest2, M_IP6OPT);
2334 		pktopt->ip6po_dest2 = NULL;
2335 	}
2336 }
2337 
2338 #define PKTOPT_EXTHDRCPY(type) \
2339 do {\
2340 	if (src->type) {\
2341 		int hlen = (((struct ip6_ext *)src->type)->ip6e_len + 1) << 3;\
2342 		dst->type = malloc(hlen, M_IP6OPT, canwait);\
2343 		if (dst->type == NULL && canwait == M_NOWAIT)\
2344 			goto bad;\
2345 		bcopy(src->type, dst->type, hlen);\
2346 	}\
2347 } while (/*CONSTCOND*/ 0)
2348 
2349 static int
2350 copypktopts(struct ip6_pktopts *dst, struct ip6_pktopts *src, int canwait)
2351 {
2352 	if (dst == NULL || src == NULL)  {
2353 		printf("ip6_clearpktopts: invalid argument\n");
2354 		return (EINVAL);
2355 	}
2356 
2357 	dst->ip6po_hlim = src->ip6po_hlim;
2358 	dst->ip6po_tclass = src->ip6po_tclass;
2359 	dst->ip6po_flags = src->ip6po_flags;
2360 	if (src->ip6po_pktinfo) {
2361 		dst->ip6po_pktinfo = malloc(sizeof(*dst->ip6po_pktinfo),
2362 		    M_IP6OPT, canwait);
2363 		if (dst->ip6po_pktinfo == NULL)
2364 			goto bad;
2365 		*dst->ip6po_pktinfo = *src->ip6po_pktinfo;
2366 	}
2367 	if (src->ip6po_nexthop) {
2368 		dst->ip6po_nexthop = malloc(src->ip6po_nexthop->sa_len,
2369 		    M_IP6OPT, canwait);
2370 		if (dst->ip6po_nexthop == NULL)
2371 			goto bad;
2372 		bcopy(src->ip6po_nexthop, dst->ip6po_nexthop,
2373 		    src->ip6po_nexthop->sa_len);
2374 	}
2375 	PKTOPT_EXTHDRCPY(ip6po_hbh);
2376 	PKTOPT_EXTHDRCPY(ip6po_dest1);
2377 	PKTOPT_EXTHDRCPY(ip6po_dest2);
2378 	PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
2379 	return (0);
2380 
2381   bad:
2382 	ip6_clearpktopts(dst, -1);
2383 	return (ENOBUFS);
2384 }
2385 #undef PKTOPT_EXTHDRCPY
2386 
2387 struct ip6_pktopts *
2388 ip6_copypktopts(struct ip6_pktopts *src, int canwait)
2389 {
2390 	int error;
2391 	struct ip6_pktopts *dst;
2392 
2393 	dst = malloc(sizeof(*dst), M_IP6OPT, canwait);
2394 	if (dst == NULL)
2395 		return (NULL);
2396 	ip6_initpktopts(dst);
2397 
2398 	if ((error = copypktopts(dst, src, canwait)) != 0) {
2399 		free(dst, M_IP6OPT);
2400 		return (NULL);
2401 	}
2402 
2403 	return (dst);
2404 }
2405 
2406 void
2407 ip6_freepcbopts(struct ip6_pktopts *pktopt)
2408 {
2409 	if (pktopt == NULL)
2410 		return;
2411 
2412 	ip6_clearpktopts(pktopt, -1);
2413 
2414 	free(pktopt, M_IP6OPT);
2415 }
2416 
2417 /*
2418  * Set the IP6 multicast options in response to user setsockopt().
2419  */
2420 static int
2421 ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
2422 {
2423 	int error = 0;
2424 	u_int loop, ifindex;
2425 	struct ipv6_mreq *mreq;
2426 	struct ifnet *ifp;
2427 	struct ip6_moptions *im6o = *im6op;
2428 	struct route_in6 ro;
2429 	struct in6_multi_mship *imm;
2430 
2431 	if (im6o == NULL) {
2432 		/*
2433 		 * No multicast option buffer attached to the pcb;
2434 		 * allocate one and initialize to default values.
2435 		 */
2436 		im6o = (struct ip6_moptions *)
2437 			malloc(sizeof(*im6o), M_IP6MOPTS, M_WAITOK);
2438 
2439 		if (im6o == NULL)
2440 			return (ENOBUFS);
2441 		*im6op = im6o;
2442 		im6o->im6o_multicast_ifp = NULL;
2443 		im6o->im6o_multicast_hlim = V_ip6_defmcasthlim;
2444 		im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
2445 		LIST_INIT(&im6o->im6o_memberships);
2446 	}
2447 
2448 	switch (optname) {
2449 
2450 	case IPV6_MULTICAST_IF:
2451 		/*
2452 		 * Select the interface for outgoing multicast packets.
2453 		 */
2454 		if (m == NULL || m->m_len != sizeof(u_int)) {
2455 			error = EINVAL;
2456 			break;
2457 		}
2458 		bcopy(mtod(m, u_int *), &ifindex, sizeof(ifindex));
2459 		if (ifindex < 0 || V_if_index < ifindex) {
2460 			error = ENXIO;	/* XXX EINVAL? */
2461 			break;
2462 		}
2463 		ifp = ifnet_byindex(ifindex);
2464 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2465 			error = EADDRNOTAVAIL;
2466 			break;
2467 		}
2468 		im6o->im6o_multicast_ifp = ifp;
2469 		break;
2470 
2471 	case IPV6_MULTICAST_HOPS:
2472 	    {
2473 		/*
2474 		 * Set the IP6 hoplimit for outgoing multicast packets.
2475 		 */
2476 		int optval;
2477 		if (m == NULL || m->m_len != sizeof(int)) {
2478 			error = EINVAL;
2479 			break;
2480 		}
2481 		bcopy(mtod(m, u_int *), &optval, sizeof(optval));
2482 		if (optval < -1 || optval >= 256)
2483 			error = EINVAL;
2484 		else if (optval == -1)
2485 			im6o->im6o_multicast_hlim = V_ip6_defmcasthlim;
2486 		else
2487 			im6o->im6o_multicast_hlim = optval;
2488 		break;
2489 	    }
2490 
2491 	case IPV6_MULTICAST_LOOP:
2492 		/*
2493 		 * Set the loopback flag for outgoing multicast packets.
2494 		 * Must be zero or one.
2495 		 */
2496 		if (m == NULL || m->m_len != sizeof(u_int)) {
2497 			error = EINVAL;
2498 			break;
2499 		}
2500 		bcopy(mtod(m, u_int *), &loop, sizeof(loop));
2501 		if (loop > 1) {
2502 			error = EINVAL;
2503 			break;
2504 		}
2505 		im6o->im6o_multicast_loop = loop;
2506 		break;
2507 
2508 	case IPV6_JOIN_GROUP:
2509 		/*
2510 		 * Add a multicast group membership.
2511 		 * Group must be a valid IP6 multicast address.
2512 		 */
2513 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
2514 			error = EINVAL;
2515 			break;
2516 		}
2517 		mreq = mtod(m, struct ipv6_mreq *);
2518 
2519 		if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
2520 			/*
2521 			 * We use the unspecified address to specify to accept
2522 			 * all multicast addresses. Only super user is allowed
2523 			 * to do this.
2524 			 */
2525 			/* XXX-BZ might need a better PRIV_NETINET_x for this */
2526 			error = priv_check(curthread, PRIV_NETINET_MROUTE);
2527 			if (error)
2528 				break;
2529 		} else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
2530 			error = EINVAL;
2531 			break;
2532 		}
2533 
2534 		/*
2535 		 * If no interface was explicitly specified, choose an
2536 		 * appropriate one according to the given multicast address.
2537 		 */
2538 		if (mreq->ipv6mr_interface == 0) {
2539 			struct sockaddr_in6 *dst;
2540 
2541 			/*
2542 			 * Look up the routing table for the
2543 			 * address, and choose the outgoing interface.
2544 			 *   XXX: is it a good approach?
2545 			 */
2546 			ro.ro_rt = NULL;
2547 			dst = (struct sockaddr_in6 *)&ro.ro_dst;
2548 			bzero(dst, sizeof(*dst));
2549 			dst->sin6_family = AF_INET6;
2550 			dst->sin6_len = sizeof(*dst);
2551 			dst->sin6_addr = mreq->ipv6mr_multiaddr;
2552 			rtalloc((struct route *)&ro);
2553 			if (ro.ro_rt == NULL) {
2554 				error = EADDRNOTAVAIL;
2555 				break;
2556 			}
2557 			ifp = ro.ro_rt->rt_ifp;
2558 			RTFREE(ro.ro_rt);
2559 		} else {
2560 			/*
2561 			 * If the interface is specified, validate it.
2562 			 */
2563 			if (mreq->ipv6mr_interface < 0 ||
2564 			    V_if_index < mreq->ipv6mr_interface) {
2565 				error = ENXIO;	/* XXX EINVAL? */
2566 				break;
2567 			}
2568 			ifp = ifnet_byindex(mreq->ipv6mr_interface);
2569 			if (!ifp) {
2570 				error = ENXIO;	/* XXX EINVAL? */
2571 				break;
2572 			}
2573 		}
2574 
2575 		/*
2576 		 * See if we found an interface, and confirm that it
2577 		 * supports multicast
2578 		 */
2579 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2580 			error = EADDRNOTAVAIL;
2581 			break;
2582 		}
2583 
2584 		if (in6_setscope(&mreq->ipv6mr_multiaddr, ifp, NULL)) {
2585 			error = EADDRNOTAVAIL; /* XXX: should not happen */
2586 			break;
2587 		}
2588 
2589 		/*
2590 		 * See if the membership already exists.
2591 		 */
2592 		for (imm = im6o->im6o_memberships.lh_first;
2593 		     imm != NULL; imm = imm->i6mm_chain.le_next)
2594 			if (imm->i6mm_maddr->in6m_ifp == ifp &&
2595 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2596 					       &mreq->ipv6mr_multiaddr))
2597 				break;
2598 		if (imm != NULL) {
2599 			error = EADDRINUSE;
2600 			break;
2601 		}
2602 		/*
2603 		 * Everything looks good; add a new record to the multicast
2604 		 * address list for the given interface.
2605 		 */
2606 		imm = in6_joingroup(ifp, &mreq->ipv6mr_multiaddr,  &error, 0);
2607 		if (imm == NULL)
2608 			break;
2609 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
2610 		break;
2611 
2612 	case IPV6_LEAVE_GROUP:
2613 		/*
2614 		 * Drop a multicast group membership.
2615 		 * Group must be a valid IP6 multicast address.
2616 		 */
2617 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
2618 			error = EINVAL;
2619 			break;
2620 		}
2621 		mreq = mtod(m, struct ipv6_mreq *);
2622 
2623 		/*
2624 		 * If an interface address was specified, get a pointer
2625 		 * to its ifnet structure.
2626 		 */
2627 		if (mreq->ipv6mr_interface < 0 ||
2628 		    V_if_index < mreq->ipv6mr_interface) {
2629 			error = ENXIO;	/* XXX EINVAL? */
2630 			break;
2631 		}
2632 		if (mreq->ipv6mr_interface == 0)
2633 			ifp = NULL;
2634 		else
2635 			ifp = ifnet_byindex(mreq->ipv6mr_interface);
2636 
2637 		/* Fill in the scope zone ID */
2638 		if (ifp) {
2639 			if (in6_setscope(&mreq->ipv6mr_multiaddr, ifp, NULL)) {
2640 				/* XXX: should not happen */
2641 				error = EADDRNOTAVAIL;
2642 				break;
2643 			}
2644 		} else if (mreq->ipv6mr_interface != 0) {
2645 			/*
2646 			 * This case happens when the (positive) index is in
2647 			 * the valid range, but the corresponding interface has
2648 			 * been detached dynamically (XXX).
2649 			 */
2650 			error = EADDRNOTAVAIL;
2651 			break;
2652 		} else {	/* ipv6mr_interface == 0 */
2653 			struct sockaddr_in6 sa6_mc;
2654 
2655 			/*
2656 			 * The API spec says as follows:
2657 			 *  If the interface index is specified as 0, the
2658 			 *  system may choose a multicast group membership to
2659 			 *  drop by matching the multicast address only.
2660 			 * On the other hand, we cannot disambiguate the scope
2661 			 * zone unless an interface is provided.  Thus, we
2662 			 * check if there's ambiguity with the default scope
2663 			 * zone as the last resort.
2664 			 */
2665 			bzero(&sa6_mc, sizeof(sa6_mc));
2666 			sa6_mc.sin6_family = AF_INET6;
2667 			sa6_mc.sin6_len = sizeof(sa6_mc);
2668 			sa6_mc.sin6_addr = mreq->ipv6mr_multiaddr;
2669 			error = sa6_embedscope(&sa6_mc, V_ip6_use_defzone);
2670 			if (error != 0)
2671 				break;
2672 			mreq->ipv6mr_multiaddr = sa6_mc.sin6_addr;
2673 		}
2674 
2675 		/*
2676 		 * Find the membership in the membership list.
2677 		 */
2678 		for (imm = im6o->im6o_memberships.lh_first;
2679 		     imm != NULL; imm = imm->i6mm_chain.le_next) {
2680 			if ((ifp == NULL || imm->i6mm_maddr->in6m_ifp == ifp) &&
2681 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2682 			    &mreq->ipv6mr_multiaddr))
2683 				break;
2684 		}
2685 		if (imm == NULL) {
2686 			/* Unable to resolve interface */
2687 			error = EADDRNOTAVAIL;
2688 			break;
2689 		}
2690 		/*
2691 		 * Give up the multicast address record to which the
2692 		 * membership points.
2693 		 */
2694 		LIST_REMOVE(imm, i6mm_chain);
2695 		in6_delmulti(imm->i6mm_maddr);
2696 		free(imm, M_IP6MADDR);
2697 		break;
2698 
2699 	default:
2700 		error = EOPNOTSUPP;
2701 		break;
2702 	}
2703 
2704 	/*
2705 	 * If all options have default values, no need to keep the mbuf.
2706 	 */
2707 	if (im6o->im6o_multicast_ifp == NULL &&
2708 	    im6o->im6o_multicast_hlim == V_ip6_defmcasthlim &&
2709 	    im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
2710 	    im6o->im6o_memberships.lh_first == NULL) {
2711 		free(*im6op, M_IP6MOPTS);
2712 		*im6op = NULL;
2713 	}
2714 
2715 	return (error);
2716 }
2717 
2718 /*
2719  * Return the IP6 multicast options in response to user getsockopt().
2720  */
2721 static int
2722 ip6_getmoptions(int optname, struct ip6_moptions *im6o, struct mbuf **mp)
2723 {
2724 	u_int *hlim, *loop, *ifindex;
2725 
2726 	*mp = m_get(M_WAIT, MT_HEADER);		/* XXX */
2727 
2728 	switch (optname) {
2729 
2730 	case IPV6_MULTICAST_IF:
2731 		ifindex = mtod(*mp, u_int *);
2732 		(*mp)->m_len = sizeof(u_int);
2733 		if (im6o == NULL || im6o->im6o_multicast_ifp == NULL)
2734 			*ifindex = 0;
2735 		else
2736 			*ifindex = im6o->im6o_multicast_ifp->if_index;
2737 		return (0);
2738 
2739 	case IPV6_MULTICAST_HOPS:
2740 		hlim = mtod(*mp, u_int *);
2741 		(*mp)->m_len = sizeof(u_int);
2742 		if (im6o == NULL)
2743 			*hlim = V_ip6_defmcasthlim;
2744 		else
2745 			*hlim = im6o->im6o_multicast_hlim;
2746 		return (0);
2747 
2748 	case IPV6_MULTICAST_LOOP:
2749 		loop = mtod(*mp, u_int *);
2750 		(*mp)->m_len = sizeof(u_int);
2751 		if (im6o == NULL)
2752 			*loop = V_ip6_defmcasthlim;
2753 		else
2754 			*loop = im6o->im6o_multicast_loop;
2755 		return (0);
2756 
2757 	default:
2758 		return (EOPNOTSUPP);
2759 	}
2760 }
2761 
2762 /*
2763  * Discard the IP6 multicast options.
2764  */
2765 void
2766 ip6_freemoptions(struct ip6_moptions *im6o)
2767 {
2768 	struct in6_multi_mship *imm;
2769 
2770 	if (im6o == NULL)
2771 		return;
2772 
2773 	while ((imm = im6o->im6o_memberships.lh_first) != NULL) {
2774 		LIST_REMOVE(imm, i6mm_chain);
2775 		if (imm->i6mm_maddr)
2776 			in6_delmulti(imm->i6mm_maddr);
2777 		free(imm, M_IP6MADDR);
2778 	}
2779 	free(im6o, M_IP6MOPTS);
2780 }
2781 
2782 /*
2783  * Set IPv6 outgoing packet options based on advanced API.
2784  */
2785 int
2786 ip6_setpktopts(struct mbuf *control, struct ip6_pktopts *opt,
2787     struct ip6_pktopts *stickyopt, struct ucred *cred, int uproto)
2788 {
2789 	struct cmsghdr *cm = 0;
2790 
2791 	if (control == NULL || opt == NULL)
2792 		return (EINVAL);
2793 
2794 	ip6_initpktopts(opt);
2795 	if (stickyopt) {
2796 		int error;
2797 
2798 		/*
2799 		 * If stickyopt is provided, make a local copy of the options
2800 		 * for this particular packet, then override them by ancillary
2801 		 * objects.
2802 		 * XXX: copypktopts() does not copy the cached route to a next
2803 		 * hop (if any).  This is not very good in terms of efficiency,
2804 		 * but we can allow this since this option should be rarely
2805 		 * used.
2806 		 */
2807 		if ((error = copypktopts(opt, stickyopt, M_NOWAIT)) != 0)
2808 			return (error);
2809 	}
2810 
2811 	/*
2812 	 * XXX: Currently, we assume all the optional information is stored
2813 	 * in a single mbuf.
2814 	 */
2815 	if (control->m_next)
2816 		return (EINVAL);
2817 
2818 	for (; control->m_len; control->m_data += CMSG_ALIGN(cm->cmsg_len),
2819 	    control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
2820 		int error;
2821 
2822 		if (control->m_len < CMSG_LEN(0))
2823 			return (EINVAL);
2824 
2825 		cm = mtod(control, struct cmsghdr *);
2826 		if (cm->cmsg_len == 0 || cm->cmsg_len > control->m_len)
2827 			return (EINVAL);
2828 		if (cm->cmsg_level != IPPROTO_IPV6)
2829 			continue;
2830 
2831 		error = ip6_setpktopt(cm->cmsg_type, CMSG_DATA(cm),
2832 		    cm->cmsg_len - CMSG_LEN(0), opt, cred, 0, 1, uproto);
2833 		if (error)
2834 			return (error);
2835 	}
2836 
2837 	return (0);
2838 }
2839 
2840 /*
2841  * Set a particular packet option, as a sticky option or an ancillary data
2842  * item.  "len" can be 0 only when it's a sticky option.
2843  * We have 4 cases of combination of "sticky" and "cmsg":
2844  * "sticky=0, cmsg=0": impossible
2845  * "sticky=0, cmsg=1": RFC2292 or RFC3542 ancillary data
2846  * "sticky=1, cmsg=0": RFC3542 socket option
2847  * "sticky=1, cmsg=1": RFC2292 socket option
2848  */
2849 static int
2850 ip6_setpktopt(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
2851     struct ucred *cred, int sticky, int cmsg, int uproto)
2852 {
2853 	int minmtupolicy, preftemp;
2854 	int error;
2855 
2856 	if (!sticky && !cmsg) {
2857 #ifdef DIAGNOSTIC
2858 		printf("ip6_setpktopt: impossible case\n");
2859 #endif
2860 		return (EINVAL);
2861 	}
2862 
2863 	/*
2864 	 * IPV6_2292xxx is for backward compatibility to RFC2292, and should
2865 	 * not be specified in the context of RFC3542.  Conversely,
2866 	 * RFC3542 types should not be specified in the context of RFC2292.
2867 	 */
2868 	if (!cmsg) {
2869 		switch (optname) {
2870 		case IPV6_2292PKTINFO:
2871 		case IPV6_2292HOPLIMIT:
2872 		case IPV6_2292NEXTHOP:
2873 		case IPV6_2292HOPOPTS:
2874 		case IPV6_2292DSTOPTS:
2875 		case IPV6_2292RTHDR:
2876 		case IPV6_2292PKTOPTIONS:
2877 			return (ENOPROTOOPT);
2878 		}
2879 	}
2880 	if (sticky && cmsg) {
2881 		switch (optname) {
2882 		case IPV6_PKTINFO:
2883 		case IPV6_HOPLIMIT:
2884 		case IPV6_NEXTHOP:
2885 		case IPV6_HOPOPTS:
2886 		case IPV6_DSTOPTS:
2887 		case IPV6_RTHDRDSTOPTS:
2888 		case IPV6_RTHDR:
2889 		case IPV6_USE_MIN_MTU:
2890 		case IPV6_DONTFRAG:
2891 		case IPV6_TCLASS:
2892 		case IPV6_PREFER_TEMPADDR: /* XXX: not an RFC3542 option */
2893 			return (ENOPROTOOPT);
2894 		}
2895 	}
2896 
2897 	switch (optname) {
2898 	case IPV6_2292PKTINFO:
2899 	case IPV6_PKTINFO:
2900 	{
2901 		struct ifnet *ifp = NULL;
2902 		struct in6_pktinfo *pktinfo;
2903 
2904 		if (len != sizeof(struct in6_pktinfo))
2905 			return (EINVAL);
2906 
2907 		pktinfo = (struct in6_pktinfo *)buf;
2908 
2909 		/*
2910 		 * An application can clear any sticky IPV6_PKTINFO option by
2911 		 * doing a "regular" setsockopt with ipi6_addr being
2912 		 * in6addr_any and ipi6_ifindex being zero.
2913 		 * [RFC 3542, Section 6]
2914 		 */
2915 		if (optname == IPV6_PKTINFO && opt->ip6po_pktinfo &&
2916 		    pktinfo->ipi6_ifindex == 0 &&
2917 		    IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
2918 			ip6_clearpktopts(opt, optname);
2919 			break;
2920 		}
2921 
2922 		if (uproto == IPPROTO_TCP && optname == IPV6_PKTINFO &&
2923 		    sticky && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
2924 			return (EINVAL);
2925 		}
2926 
2927 		/* validate the interface index if specified. */
2928 		if (pktinfo->ipi6_ifindex > V_if_index ||
2929 		    pktinfo->ipi6_ifindex < 0) {
2930 			 return (ENXIO);
2931 		}
2932 		if (pktinfo->ipi6_ifindex) {
2933 			ifp = ifnet_byindex(pktinfo->ipi6_ifindex);
2934 			if (ifp == NULL)
2935 				return (ENXIO);
2936 		}
2937 
2938 		/*
2939 		 * We store the address anyway, and let in6_selectsrc()
2940 		 * validate the specified address.  This is because ipi6_addr
2941 		 * may not have enough information about its scope zone, and
2942 		 * we may need additional information (such as outgoing
2943 		 * interface or the scope zone of a destination address) to
2944 		 * disambiguate the scope.
2945 		 * XXX: the delay of the validation may confuse the
2946 		 * application when it is used as a sticky option.
2947 		 */
2948 		if (opt->ip6po_pktinfo == NULL) {
2949 			opt->ip6po_pktinfo = malloc(sizeof(*pktinfo),
2950 			    M_IP6OPT, M_NOWAIT);
2951 			if (opt->ip6po_pktinfo == NULL)
2952 				return (ENOBUFS);
2953 		}
2954 		bcopy(pktinfo, opt->ip6po_pktinfo, sizeof(*pktinfo));
2955 		break;
2956 	}
2957 
2958 	case IPV6_2292HOPLIMIT:
2959 	case IPV6_HOPLIMIT:
2960 	{
2961 		int *hlimp;
2962 
2963 		/*
2964 		 * RFC 3542 deprecated the usage of sticky IPV6_HOPLIMIT
2965 		 * to simplify the ordering among hoplimit options.
2966 		 */
2967 		if (optname == IPV6_HOPLIMIT && sticky)
2968 			return (ENOPROTOOPT);
2969 
2970 		if (len != sizeof(int))
2971 			return (EINVAL);
2972 		hlimp = (int *)buf;
2973 		if (*hlimp < -1 || *hlimp > 255)
2974 			return (EINVAL);
2975 
2976 		opt->ip6po_hlim = *hlimp;
2977 		break;
2978 	}
2979 
2980 	case IPV6_TCLASS:
2981 	{
2982 		int tclass;
2983 
2984 		if (len != sizeof(int))
2985 			return (EINVAL);
2986 		tclass = *(int *)buf;
2987 		if (tclass < -1 || tclass > 255)
2988 			return (EINVAL);
2989 
2990 		opt->ip6po_tclass = tclass;
2991 		break;
2992 	}
2993 
2994 	case IPV6_2292NEXTHOP:
2995 	case IPV6_NEXTHOP:
2996 		if (cred != NULL) {
2997 			error = priv_check_cred(cred,
2998 			    PRIV_NETINET_SETHDROPTS, 0);
2999 			if (error)
3000 				return (error);
3001 		}
3002 
3003 		if (len == 0) {	/* just remove the option */
3004 			ip6_clearpktopts(opt, IPV6_NEXTHOP);
3005 			break;
3006 		}
3007 
3008 		/* check if cmsg_len is large enough for sa_len */
3009 		if (len < sizeof(struct sockaddr) || len < *buf)
3010 			return (EINVAL);
3011 
3012 		switch (((struct sockaddr *)buf)->sa_family) {
3013 		case AF_INET6:
3014 		{
3015 			struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)buf;
3016 			int error;
3017 
3018 			if (sa6->sin6_len != sizeof(struct sockaddr_in6))
3019 				return (EINVAL);
3020 
3021 			if (IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
3022 			    IN6_IS_ADDR_MULTICAST(&sa6->sin6_addr)) {
3023 				return (EINVAL);
3024 			}
3025 			if ((error = sa6_embedscope(sa6, V_ip6_use_defzone))
3026 			    != 0) {
3027 				return (error);
3028 			}
3029 			break;
3030 		}
3031 		case AF_LINK:	/* should eventually be supported */
3032 		default:
3033 			return (EAFNOSUPPORT);
3034 		}
3035 
3036 		/* turn off the previous option, then set the new option. */
3037 		ip6_clearpktopts(opt, IPV6_NEXTHOP);
3038 		opt->ip6po_nexthop = malloc(*buf, M_IP6OPT, M_NOWAIT);
3039 		if (opt->ip6po_nexthop == NULL)
3040 			return (ENOBUFS);
3041 		bcopy(buf, opt->ip6po_nexthop, *buf);
3042 		break;
3043 
3044 	case IPV6_2292HOPOPTS:
3045 	case IPV6_HOPOPTS:
3046 	{
3047 		struct ip6_hbh *hbh;
3048 		int hbhlen;
3049 
3050 		/*
3051 		 * XXX: We don't allow a non-privileged user to set ANY HbH
3052 		 * options, since per-option restriction has too much
3053 		 * overhead.
3054 		 */
3055 		if (cred != NULL) {
3056 			error = priv_check_cred(cred,
3057 			    PRIV_NETINET_SETHDROPTS, 0);
3058 			if (error)
3059 				return (error);
3060 		}
3061 
3062 		if (len == 0) {
3063 			ip6_clearpktopts(opt, IPV6_HOPOPTS);
3064 			break;	/* just remove the option */
3065 		}
3066 
3067 		/* message length validation */
3068 		if (len < sizeof(struct ip6_hbh))
3069 			return (EINVAL);
3070 		hbh = (struct ip6_hbh *)buf;
3071 		hbhlen = (hbh->ip6h_len + 1) << 3;
3072 		if (len != hbhlen)
3073 			return (EINVAL);
3074 
3075 		/* turn off the previous option, then set the new option. */
3076 		ip6_clearpktopts(opt, IPV6_HOPOPTS);
3077 		opt->ip6po_hbh = malloc(hbhlen, M_IP6OPT, M_NOWAIT);
3078 		if (opt->ip6po_hbh == NULL)
3079 			return (ENOBUFS);
3080 		bcopy(hbh, opt->ip6po_hbh, hbhlen);
3081 
3082 		break;
3083 	}
3084 
3085 	case IPV6_2292DSTOPTS:
3086 	case IPV6_DSTOPTS:
3087 	case IPV6_RTHDRDSTOPTS:
3088 	{
3089 		struct ip6_dest *dest, **newdest = NULL;
3090 		int destlen;
3091 
3092 		if (cred != NULL) { /* XXX: see the comment for IPV6_HOPOPTS */
3093 			error = priv_check_cred(cred,
3094 			    PRIV_NETINET_SETHDROPTS, 0);
3095 			if (error)
3096 				return (error);
3097 		}
3098 
3099 		if (len == 0) {
3100 			ip6_clearpktopts(opt, optname);
3101 			break;	/* just remove the option */
3102 		}
3103 
3104 		/* message length validation */
3105 		if (len < sizeof(struct ip6_dest))
3106 			return (EINVAL);
3107 		dest = (struct ip6_dest *)buf;
3108 		destlen = (dest->ip6d_len + 1) << 3;
3109 		if (len != destlen)
3110 			return (EINVAL);
3111 
3112 		/*
3113 		 * Determine the position that the destination options header
3114 		 * should be inserted; before or after the routing header.
3115 		 */
3116 		switch (optname) {
3117 		case IPV6_2292DSTOPTS:
3118 			/*
3119 			 * The old advacned API is ambiguous on this point.
3120 			 * Our approach is to determine the position based
3121 			 * according to the existence of a routing header.
3122 			 * Note, however, that this depends on the order of the
3123 			 * extension headers in the ancillary data; the 1st
3124 			 * part of the destination options header must appear
3125 			 * before the routing header in the ancillary data,
3126 			 * too.
3127 			 * RFC3542 solved the ambiguity by introducing
3128 			 * separate ancillary data or option types.
3129 			 */
3130 			if (opt->ip6po_rthdr == NULL)
3131 				newdest = &opt->ip6po_dest1;
3132 			else
3133 				newdest = &opt->ip6po_dest2;
3134 			break;
3135 		case IPV6_RTHDRDSTOPTS:
3136 			newdest = &opt->ip6po_dest1;
3137 			break;
3138 		case IPV6_DSTOPTS:
3139 			newdest = &opt->ip6po_dest2;
3140 			break;
3141 		}
3142 
3143 		/* turn off the previous option, then set the new option. */
3144 		ip6_clearpktopts(opt, optname);
3145 		*newdest = malloc(destlen, M_IP6OPT, M_NOWAIT);
3146 		if (*newdest == NULL)
3147 			return (ENOBUFS);
3148 		bcopy(dest, *newdest, destlen);
3149 
3150 		break;
3151 	}
3152 
3153 	case IPV6_2292RTHDR:
3154 	case IPV6_RTHDR:
3155 	{
3156 		struct ip6_rthdr *rth;
3157 		int rthlen;
3158 
3159 		if (len == 0) {
3160 			ip6_clearpktopts(opt, IPV6_RTHDR);
3161 			break;	/* just remove the option */
3162 		}
3163 
3164 		/* message length validation */
3165 		if (len < sizeof(struct ip6_rthdr))
3166 			return (EINVAL);
3167 		rth = (struct ip6_rthdr *)buf;
3168 		rthlen = (rth->ip6r_len + 1) << 3;
3169 		if (len != rthlen)
3170 			return (EINVAL);
3171 
3172 		switch (rth->ip6r_type) {
3173 		case IPV6_RTHDR_TYPE_0:
3174 			if (rth->ip6r_len == 0)	/* must contain one addr */
3175 				return (EINVAL);
3176 			if (rth->ip6r_len % 2) /* length must be even */
3177 				return (EINVAL);
3178 			if (rth->ip6r_len / 2 != rth->ip6r_segleft)
3179 				return (EINVAL);
3180 			break;
3181 		default:
3182 			return (EINVAL);	/* not supported */
3183 		}
3184 
3185 		/* turn off the previous option */
3186 		ip6_clearpktopts(opt, IPV6_RTHDR);
3187 		opt->ip6po_rthdr = malloc(rthlen, M_IP6OPT, M_NOWAIT);
3188 		if (opt->ip6po_rthdr == NULL)
3189 			return (ENOBUFS);
3190 		bcopy(rth, opt->ip6po_rthdr, rthlen);
3191 
3192 		break;
3193 	}
3194 
3195 	case IPV6_USE_MIN_MTU:
3196 		if (len != sizeof(int))
3197 			return (EINVAL);
3198 		minmtupolicy = *(int *)buf;
3199 		if (minmtupolicy != IP6PO_MINMTU_MCASTONLY &&
3200 		    minmtupolicy != IP6PO_MINMTU_DISABLE &&
3201 		    minmtupolicy != IP6PO_MINMTU_ALL) {
3202 			return (EINVAL);
3203 		}
3204 		opt->ip6po_minmtu = minmtupolicy;
3205 		break;
3206 
3207 	case IPV6_DONTFRAG:
3208 		if (len != sizeof(int))
3209 			return (EINVAL);
3210 
3211 		if (uproto == IPPROTO_TCP || *(int *)buf == 0) {
3212 			/*
3213 			 * we ignore this option for TCP sockets.
3214 			 * (RFC3542 leaves this case unspecified.)
3215 			 */
3216 			opt->ip6po_flags &= ~IP6PO_DONTFRAG;
3217 		} else
3218 			opt->ip6po_flags |= IP6PO_DONTFRAG;
3219 		break;
3220 
3221 	case IPV6_PREFER_TEMPADDR:
3222 		if (len != sizeof(int))
3223 			return (EINVAL);
3224 		preftemp = *(int *)buf;
3225 		if (preftemp != IP6PO_TEMPADDR_SYSTEM &&
3226 		    preftemp != IP6PO_TEMPADDR_NOTPREFER &&
3227 		    preftemp != IP6PO_TEMPADDR_PREFER) {
3228 			return (EINVAL);
3229 		}
3230 		opt->ip6po_prefer_tempaddr = preftemp;
3231 		break;
3232 
3233 	default:
3234 		return (ENOPROTOOPT);
3235 	} /* end of switch */
3236 
3237 	return (0);
3238 }
3239 
3240 /*
3241  * Routine called from ip6_output() to loop back a copy of an IP6 multicast
3242  * packet to the input queue of a specified interface.  Note that this
3243  * calls the output routine of the loopback "driver", but with an interface
3244  * pointer that might NOT be &loif -- easier than replicating that code here.
3245  */
3246 void
3247 ip6_mloopback(struct ifnet *ifp, struct mbuf *m, struct sockaddr_in6 *dst)
3248 {
3249 	struct mbuf *copym;
3250 	struct ip6_hdr *ip6;
3251 
3252 	copym = m_copy(m, 0, M_COPYALL);
3253 	if (copym == NULL)
3254 		return;
3255 
3256 	/*
3257 	 * Make sure to deep-copy IPv6 header portion in case the data
3258 	 * is in an mbuf cluster, so that we can safely override the IPv6
3259 	 * header portion later.
3260 	 */
3261 	if ((copym->m_flags & M_EXT) != 0 ||
3262 	    copym->m_len < sizeof(struct ip6_hdr)) {
3263 		copym = m_pullup(copym, sizeof(struct ip6_hdr));
3264 		if (copym == NULL)
3265 			return;
3266 	}
3267 
3268 #ifdef DIAGNOSTIC
3269 	if (copym->m_len < sizeof(*ip6)) {
3270 		m_freem(copym);
3271 		return;
3272 	}
3273 #endif
3274 
3275 	ip6 = mtod(copym, struct ip6_hdr *);
3276 	/*
3277 	 * clear embedded scope identifiers if necessary.
3278 	 * in6_clearscope will touch the addresses only when necessary.
3279 	 */
3280 	in6_clearscope(&ip6->ip6_src);
3281 	in6_clearscope(&ip6->ip6_dst);
3282 
3283 	(void)if_simloop(ifp, copym, dst->sin6_family, 0);
3284 }
3285 
3286 /*
3287  * Chop IPv6 header off from the payload.
3288  */
3289 static int
3290 ip6_splithdr(struct mbuf *m, struct ip6_exthdrs *exthdrs)
3291 {
3292 	struct mbuf *mh;
3293 	struct ip6_hdr *ip6;
3294 
3295 	ip6 = mtod(m, struct ip6_hdr *);
3296 	if (m->m_len > sizeof(*ip6)) {
3297 		MGETHDR(mh, M_DONTWAIT, MT_HEADER);
3298 		if (mh == 0) {
3299 			m_freem(m);
3300 			return ENOBUFS;
3301 		}
3302 		M_MOVE_PKTHDR(mh, m);
3303 		MH_ALIGN(mh, sizeof(*ip6));
3304 		m->m_len -= sizeof(*ip6);
3305 		m->m_data += sizeof(*ip6);
3306 		mh->m_next = m;
3307 		m = mh;
3308 		m->m_len = sizeof(*ip6);
3309 		bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof(*ip6));
3310 	}
3311 	exthdrs->ip6e_ip6 = m;
3312 	return 0;
3313 }
3314 
3315 /*
3316  * Compute IPv6 extension header length.
3317  */
3318 int
3319 ip6_optlen(struct in6pcb *in6p)
3320 {
3321 	int len;
3322 
3323 	if (!in6p->in6p_outputopts)
3324 		return 0;
3325 
3326 	len = 0;
3327 #define elen(x) \
3328     (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
3329 
3330 	len += elen(in6p->in6p_outputopts->ip6po_hbh);
3331 	if (in6p->in6p_outputopts->ip6po_rthdr)
3332 		/* dest1 is valid with rthdr only */
3333 		len += elen(in6p->in6p_outputopts->ip6po_dest1);
3334 	len += elen(in6p->in6p_outputopts->ip6po_rthdr);
3335 	len += elen(in6p->in6p_outputopts->ip6po_dest2);
3336 	return len;
3337 #undef elen
3338 }
3339