xref: /freebsd/sys/netinet6/ip6_output.c (revision 6af83ee0d2941d18880b6aaa2b4facd1d30c6106)
1 /*	$FreeBSD$	*/
2 /*	$KAME: ip6_output.c,v 1.279 2002/01/26 06:12:30 jinmei Exp $	*/
3 
4 /*-
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 /*-
34  * Copyright (c) 1982, 1986, 1988, 1990, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 4. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)ip_output.c	8.3 (Berkeley) 1/21/94
62  */
63 
64 #include "opt_ip6fw.h"
65 #include "opt_inet.h"
66 #include "opt_inet6.h"
67 #include "opt_ipsec.h"
68 
69 #include <sys/param.h>
70 #include <sys/malloc.h>
71 #include <sys/mbuf.h>
72 #include <sys/proc.h>
73 #include <sys/errno.h>
74 #include <sys/protosw.h>
75 #include <sys/socket.h>
76 #include <sys/socketvar.h>
77 #include <sys/systm.h>
78 #include <sys/kernel.h>
79 
80 #include <net/if.h>
81 #include <net/route.h>
82 #include <net/pfil.h>
83 
84 #include <netinet/in.h>
85 #include <netinet/in_var.h>
86 #include <netinet6/in6_var.h>
87 #include <netinet/ip6.h>
88 #include <netinet/icmp6.h>
89 #include <netinet6/ip6_var.h>
90 #include <netinet/in_pcb.h>
91 #include <netinet/tcp_var.h>
92 #include <netinet6/nd6.h>
93 
94 #ifdef IPSEC
95 #include <netinet6/ipsec.h>
96 #ifdef INET6
97 #include <netinet6/ipsec6.h>
98 #endif
99 #include <netkey/key.h>
100 #endif /* IPSEC */
101 
102 #ifdef FAST_IPSEC
103 #include <netipsec/ipsec.h>
104 #include <netipsec/ipsec6.h>
105 #include <netipsec/key.h>
106 #endif /* FAST_IPSEC */
107 
108 #include <netinet6/ip6_fw.h>
109 
110 #include <net/net_osdep.h>
111 
112 #include <netinet6/ip6protosw.h>
113 
114 static MALLOC_DEFINE(M_IPMOPTS, "ip6_moptions", "internet multicast options");
115 
116 struct ip6_exthdrs {
117 	struct mbuf *ip6e_ip6;
118 	struct mbuf *ip6e_hbh;
119 	struct mbuf *ip6e_dest1;
120 	struct mbuf *ip6e_rthdr;
121 	struct mbuf *ip6e_dest2;
122 };
123 
124 static int ip6_pcbopt __P((int, u_char *, int, struct ip6_pktopts **,
125 			   int, int));
126 static int ip6_pcbopts __P((struct ip6_pktopts **, struct mbuf *,
127 	struct socket *, struct sockopt *));
128 static int ip6_getpcbopt __P((struct ip6_pktopts *, int, struct sockopt *));
129 static int ip6_setpktoption __P((int, u_char *, int, struct ip6_pktopts *, int,
130 	int, int, int));
131 
132 static int ip6_setmoptions __P((int, struct ip6_moptions **, struct mbuf *));
133 static int ip6_getmoptions __P((int, struct ip6_moptions *, struct mbuf **));
134 static int ip6_copyexthdr __P((struct mbuf **, caddr_t, int));
135 static int ip6_insertfraghdr __P((struct mbuf *, struct mbuf *, int,
136 	struct ip6_frag **));
137 static int ip6_insert_jumboopt __P((struct ip6_exthdrs *, u_int32_t));
138 static int ip6_splithdr __P((struct mbuf *, struct ip6_exthdrs *));
139 static int ip6_getpmtu __P((struct route_in6 *, struct route_in6 *,
140 	struct ifnet *, struct in6_addr *, u_long *, int *));
141 
142 
143 /*
144  * IP6 output. The packet in mbuf chain m contains a skeletal IP6
145  * header (with pri, len, nxt, hlim, src, dst).
146  * This function may modify ver and hlim only.
147  * The mbuf chain containing the packet will be freed.
148  * The mbuf opt, if present, will not be freed.
149  *
150  * type of "mtu": rt_rmx.rmx_mtu is u_long, ifnet.ifr_mtu is int, and
151  * nd_ifinfo.linkmtu is u_int32_t.  so we use u_long to hold largest one,
152  * which is rt_rmx.rmx_mtu.
153  */
154 int
155 ip6_output(m0, opt, ro, flags, im6o, ifpp, inp)
156 	struct mbuf *m0;
157 	struct ip6_pktopts *opt;
158 	struct route_in6 *ro;
159 	int flags;
160 	struct ip6_moptions *im6o;
161 	struct ifnet **ifpp;		/* XXX: just for statistics */
162 	struct inpcb *inp;
163 {
164 	struct ip6_hdr *ip6, *mhip6;
165 	struct ifnet *ifp, *origifp;
166 	struct mbuf *m = m0;
167 	int hlen, tlen, len, off;
168 	struct route_in6 ip6route;
169 	struct sockaddr_in6 *dst;
170 	int error = 0;
171 	struct in6_ifaddr *ia = NULL;
172 	u_long mtu;
173 	int alwaysfrag, dontfrag;
174 	u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
175 	struct ip6_exthdrs exthdrs;
176 	struct in6_addr finaldst;
177 	struct route_in6 *ro_pmtu = NULL;
178 	int hdrsplit = 0;
179 	int needipsec = 0;
180 #if defined(IPSEC) || defined(FAST_IPSEC)
181 	int needipsectun = 0;
182 	struct secpolicy *sp = NULL;
183 #endif /*IPSEC || FAST_IPSEC*/
184 
185 	ip6 = mtod(m, struct ip6_hdr *);
186 	finaldst = ip6->ip6_dst;
187 
188 #define MAKE_EXTHDR(hp, mp)						\
189     do {								\
190 	if (hp) {							\
191 		struct ip6_ext *eh = (struct ip6_ext *)(hp);		\
192 		error = ip6_copyexthdr((mp), (caddr_t)(hp),		\
193 		    ((eh)->ip6e_len + 1) << 3);				\
194 		if (error)						\
195 			goto freehdrs;					\
196 	}								\
197     } while (/*CONSTCOND*/ 0)
198 
199 	bzero(&exthdrs, sizeof(exthdrs));
200 
201 	if (opt) {
202 		/* Hop-by-Hop options header */
203 		MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
204 		/* Destination options header(1st part) */
205 		if (opt->ip6po_rthdr) {
206 			/*
207 			 * Destination options header(1st part)
208 			 * This only makes sence with a routing header.
209 			 * See Section 9.2 of RFC 3542.
210 			 * Disabling this part just for MIP6 convenience is
211 			 * a bad idea.  We need to think carefully about a
212 			 * way to make the advanced API coexist with MIP6
213 			 * options, which might automatically be inserted in
214 			 * the kernel.
215 			 */
216 			MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
217 		}
218 		/* Routing header */
219 		MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
220 		/* Destination options header(2nd part) */
221 		MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
222 	}
223 
224 #ifdef IPSEC
225 	/* get a security policy for this packet */
226 	if (inp == NULL)
227 		sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, 0, &error);
228 	else
229 		sp = ipsec6_getpolicybypcb(m, IPSEC_DIR_OUTBOUND, inp, &error);
230 
231 	if (sp == NULL) {
232 		ipsec6stat.out_inval++;
233 		goto freehdrs;
234 	}
235 
236 	error = 0;
237 
238 	/* check policy */
239 	switch (sp->policy) {
240 	case IPSEC_POLICY_DISCARD:
241 		/*
242 		 * This packet is just discarded.
243 		 */
244 		ipsec6stat.out_polvio++;
245 		goto freehdrs;
246 
247 	case IPSEC_POLICY_BYPASS:
248 	case IPSEC_POLICY_NONE:
249 		/* no need to do IPsec. */
250 		needipsec = 0;
251 		break;
252 
253 	case IPSEC_POLICY_IPSEC:
254 		if (sp->req == NULL) {
255 			/* acquire a policy */
256 			error = key_spdacquire(sp);
257 			goto freehdrs;
258 		}
259 		needipsec = 1;
260 		break;
261 
262 	case IPSEC_POLICY_ENTRUST:
263 	default:
264 		printf("ip6_output: Invalid policy found. %d\n", sp->policy);
265 	}
266 #endif /* IPSEC */
267 #ifdef FAST_IPSEC
268 	/* get a security policy for this packet */
269 	if (inp == NULL)
270 		sp = ipsec_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, 0, &error);
271 	else
272 		sp = ipsec_getpolicybysock(m, IPSEC_DIR_OUTBOUND, inp, &error);
273 
274 	if (sp == NULL) {
275 		newipsecstat.ips_out_inval++;
276 		goto freehdrs;
277 	}
278 
279 	error = 0;
280 
281 	/* check policy */
282 	switch (sp->policy) {
283 	case IPSEC_POLICY_DISCARD:
284 		/*
285 		 * This packet is just discarded.
286 		 */
287 		newipsecstat.ips_out_polvio++;
288 		goto freehdrs;
289 
290 	case IPSEC_POLICY_BYPASS:
291 	case IPSEC_POLICY_NONE:
292 		/* no need to do IPsec. */
293 		needipsec = 0;
294 		break;
295 
296 	case IPSEC_POLICY_IPSEC:
297 		if (sp->req == NULL) {
298 			/* acquire a policy */
299 			error = key_spdacquire(sp);
300 			goto freehdrs;
301 		}
302 		needipsec = 1;
303 		break;
304 
305 	case IPSEC_POLICY_ENTRUST:
306 	default:
307 		printf("ip6_output: Invalid policy found. %d\n", sp->policy);
308 	}
309 #endif /* FAST_IPSEC */
310 
311 	/*
312 	 * Calculate the total length of the extension header chain.
313 	 * Keep the length of the unfragmentable part for fragmentation.
314 	 */
315 	optlen = 0;
316 	if (exthdrs.ip6e_hbh) optlen += exthdrs.ip6e_hbh->m_len;
317 	if (exthdrs.ip6e_dest1) optlen += exthdrs.ip6e_dest1->m_len;
318 	if (exthdrs.ip6e_rthdr) optlen += exthdrs.ip6e_rthdr->m_len;
319 	unfragpartlen = optlen + sizeof(struct ip6_hdr);
320 	/* NOTE: we don't add AH/ESP length here. do that later. */
321 	if (exthdrs.ip6e_dest2) optlen += exthdrs.ip6e_dest2->m_len;
322 
323 	/*
324 	 * If we need IPsec, or there is at least one extension header,
325 	 * separate IP6 header from the payload.
326 	 */
327 	if ((needipsec || optlen) && !hdrsplit) {
328 		if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
329 			m = NULL;
330 			goto freehdrs;
331 		}
332 		m = exthdrs.ip6e_ip6;
333 		hdrsplit++;
334 	}
335 
336 	/* adjust pointer */
337 	ip6 = mtod(m, struct ip6_hdr *);
338 
339 	/* adjust mbuf packet header length */
340 	m->m_pkthdr.len += optlen;
341 	plen = m->m_pkthdr.len - sizeof(*ip6);
342 
343 	/* If this is a jumbo payload, insert a jumbo payload option. */
344 	if (plen > IPV6_MAXPACKET) {
345 		if (!hdrsplit) {
346 			if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
347 				m = NULL;
348 				goto freehdrs;
349 			}
350 			m = exthdrs.ip6e_ip6;
351 			hdrsplit++;
352 		}
353 		/* adjust pointer */
354 		ip6 = mtod(m, struct ip6_hdr *);
355 		if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
356 			goto freehdrs;
357 		ip6->ip6_plen = 0;
358 	} else
359 		ip6->ip6_plen = htons(plen);
360 
361 	/*
362 	 * Concatenate headers and fill in next header fields.
363 	 * Here we have, on "m"
364 	 *	IPv6 payload
365 	 * and we insert headers accordingly.  Finally, we should be getting:
366 	 *	IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
367 	 *
368 	 * during the header composing process, "m" points to IPv6 header.
369 	 * "mprev" points to an extension header prior to esp.
370 	 */
371 	{
372 		u_char *nexthdrp = &ip6->ip6_nxt;
373 		struct mbuf *mprev = m;
374 
375 		/*
376 		 * we treat dest2 specially.  this makes IPsec processing
377 		 * much easier.  the goal here is to make mprev point the
378 		 * mbuf prior to dest2.
379 		 *
380 		 * result: IPv6 dest2 payload
381 		 * m and mprev will point to IPv6 header.
382 		 */
383 		if (exthdrs.ip6e_dest2) {
384 			if (!hdrsplit)
385 				panic("assumption failed: hdr not split");
386 			exthdrs.ip6e_dest2->m_next = m->m_next;
387 			m->m_next = exthdrs.ip6e_dest2;
388 			*mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
389 			ip6->ip6_nxt = IPPROTO_DSTOPTS;
390 		}
391 
392 #define MAKE_CHAIN(m, mp, p, i)\
393     do {\
394 	if (m) {\
395 		if (!hdrsplit) \
396 			panic("assumption failed: hdr not split"); \
397 		*mtod((m), u_char *) = *(p);\
398 		*(p) = (i);\
399 		p = mtod((m), u_char *);\
400 		(m)->m_next = (mp)->m_next;\
401 		(mp)->m_next = (m);\
402 		(mp) = (m);\
403 	}\
404     } while (/*CONSTCOND*/ 0)
405 		/*
406 		 * result: IPv6 hbh dest1 rthdr dest2 payload
407 		 * m will point to IPv6 header.  mprev will point to the
408 		 * extension header prior to dest2 (rthdr in the above case).
409 		 */
410 		MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
411 		MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp,
412 		    IPPROTO_DSTOPTS);
413 		MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp,
414 		    IPPROTO_ROUTING);
415 
416 #if defined(IPSEC) || defined(FAST_IPSEC)
417 		if (!needipsec)
418 			goto skip_ipsec2;
419 
420 		/*
421 		 * pointers after IPsec headers are not valid any more.
422 		 * other pointers need a great care too.
423 		 * (IPsec routines should not mangle mbufs prior to AH/ESP)
424 		 */
425 		exthdrs.ip6e_dest2 = NULL;
426 
427 	    {
428 		struct ip6_rthdr *rh = NULL;
429 		int segleft_org = 0;
430 		struct ipsec_output_state state;
431 
432 		if (exthdrs.ip6e_rthdr) {
433 			rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
434 			segleft_org = rh->ip6r_segleft;
435 			rh->ip6r_segleft = 0;
436 		}
437 
438 		bzero(&state, sizeof(state));
439 		state.m = m;
440 		error = ipsec6_output_trans(&state, nexthdrp, mprev, sp, flags,
441 		    &needipsectun);
442 		m = state.m;
443 		if (error) {
444 			/* mbuf is already reclaimed in ipsec6_output_trans. */
445 			m = NULL;
446 			switch (error) {
447 			case EHOSTUNREACH:
448 			case ENETUNREACH:
449 			case EMSGSIZE:
450 			case ENOBUFS:
451 			case ENOMEM:
452 				break;
453 			default:
454 				printf("ip6_output (ipsec): error code %d\n", error);
455 				/* FALLTHROUGH */
456 			case ENOENT:
457 				/* don't show these error codes to the user */
458 				error = 0;
459 				break;
460 			}
461 			goto bad;
462 		}
463 		if (exthdrs.ip6e_rthdr) {
464 			/* ah6_output doesn't modify mbuf chain */
465 			rh->ip6r_segleft = segleft_org;
466 		}
467 	    }
468 skip_ipsec2:;
469 #endif
470 	}
471 
472 	/*
473 	 * If there is a routing header, replace the destination address field
474 	 * with the first hop of the routing header.
475 	 */
476 	if (exthdrs.ip6e_rthdr) {
477 		struct ip6_rthdr *rh =
478 			(struct ip6_rthdr *)(mtod(exthdrs.ip6e_rthdr,
479 						  struct ip6_rthdr *));
480 		struct ip6_rthdr0 *rh0;
481 		struct in6_addr *addrs;
482 
483 		switch (rh->ip6r_type) {
484 		case IPV6_RTHDR_TYPE_0:
485 			 rh0 = (struct ip6_rthdr0 *)rh;
486 			 addrs = (struct in6_addr *)(rh0 + 1);
487 
488 			 ip6->ip6_dst = *addrs;
489 			 bcopy((caddr_t)(addrs + 1), (caddr_t)addrs,
490 			       sizeof(struct in6_addr)*(rh0->ip6r0_segleft - 1)
491 				 );
492 			 *(addrs + rh0->ip6r0_segleft - 1) = finaldst;
493 			 break;
494 		default:	/* is it possible? */
495 			 error = EINVAL;
496 			 goto bad;
497 		}
498 	}
499 
500 	/* Source address validation */
501 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
502 	    (flags & IPV6_DADOUTPUT) == 0) {
503 		error = EOPNOTSUPP;
504 		ip6stat.ip6s_badscope++;
505 		goto bad;
506 	}
507 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
508 		error = EOPNOTSUPP;
509 		ip6stat.ip6s_badscope++;
510 		goto bad;
511 	}
512 
513 	ip6stat.ip6s_localout++;
514 
515 	/*
516 	 * Route packet.
517 	 */
518 	if (ro == 0) {
519 		ro = &ip6route;
520 		bzero((caddr_t)ro, sizeof(*ro));
521 	}
522 	ro_pmtu = ro;
523 	if (opt && opt->ip6po_rthdr)
524 		ro = &opt->ip6po_route;
525 	dst = (struct sockaddr_in6 *)&ro->ro_dst;
526 
527 	/*
528 	 * If there is a cached route,
529 	 * check that it is to the same destination
530 	 * and is still up. If not, free it and try again.
531 	 */
532 	if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
533 			 dst->sin6_family != AF_INET6 ||
534 			 !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst))) {
535 		RTFREE(ro->ro_rt);
536 		ro->ro_rt = (struct rtentry *)0;
537 	}
538 	if (ro->ro_rt == 0) {
539 		bzero(dst, sizeof(*dst));
540 		dst->sin6_family = AF_INET6;
541 		dst->sin6_len = sizeof(struct sockaddr_in6);
542 		dst->sin6_addr = ip6->ip6_dst;
543 	}
544 
545  	/*
546 	 * if specified, try to fill in the traffic class field.
547 	 * do not override if a non-zero value is already set.
548 	 * we check the diffserv field and the ecn field separately.
549 	 */
550 	if (opt && opt->ip6po_tclass >= 0) {
551 		int mask = 0;
552 
553 		if ((ip6->ip6_flow & htonl(0xfc << 20)) == 0)
554 			mask |= 0xfc;
555 		if ((ip6->ip6_flow & htonl(0x03 << 20)) == 0)
556 			mask |= 0x03;
557 		if (mask != 0)
558 			ip6->ip6_flow |= htonl((opt->ip6po_tclass & mask) << 20);
559 	}
560 
561 	/* fill in or override the hop limit field, if necessary. */
562 	if (opt && opt->ip6po_hlim != -1)
563 		ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
564 	else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
565 		if (im6o != NULL)
566 			ip6->ip6_hlim = im6o->im6o_multicast_hlim;
567 		else
568 			ip6->ip6_hlim = ip6_defmcasthlim;
569 	}
570 
571 #if defined(IPSEC) || defined(FAST_IPSEC)
572 	if (needipsec && needipsectun) {
573 		struct ipsec_output_state state;
574 
575 		/*
576 		 * All the extension headers will become inaccessible
577 		 * (since they can be encrypted).
578 		 * Don't panic, we need no more updates to extension headers
579 		 * on inner IPv6 packet (since they are now encapsulated).
580 		 *
581 		 * IPv6 [ESP|AH] IPv6 [extension headers] payload
582 		 */
583 		bzero(&exthdrs, sizeof(exthdrs));
584 		exthdrs.ip6e_ip6 = m;
585 
586 		bzero(&state, sizeof(state));
587 		state.m = m;
588 		state.ro = (struct route *)ro;
589 		state.dst = (struct sockaddr *)dst;
590 
591 		error = ipsec6_output_tunnel(&state, sp, flags);
592 
593 		m = state.m;
594 		ro = (struct route_in6 *)state.ro;
595 		dst = (struct sockaddr_in6 *)state.dst;
596 		if (error) {
597 			/* mbuf is already reclaimed in ipsec6_output_tunnel. */
598 			m0 = m = NULL;
599 			m = NULL;
600 			switch (error) {
601 			case EHOSTUNREACH:
602 			case ENETUNREACH:
603 			case EMSGSIZE:
604 			case ENOBUFS:
605 			case ENOMEM:
606 				break;
607 			default:
608 				printf("ip6_output (ipsec): error code %d\n", error);
609 				/* FALLTHROUGH */
610 			case ENOENT:
611 				/* don't show these error codes to the user */
612 				error = 0;
613 				break;
614 			}
615 			goto bad;
616 		}
617 
618 		exthdrs.ip6e_ip6 = m;
619 	}
620 #endif /* IPSEC */
621 
622 	if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
623 		/* Unicast */
624 
625 #define ifatoia6(ifa)	((struct in6_ifaddr *)(ifa))
626 #define sin6tosa(sin6)	((struct sockaddr *)(sin6))
627 		/* xxx
628 		 * interface selection comes here
629 		 * if an interface is specified from an upper layer,
630 		 * ifp must point it.
631 		 */
632 		if (ro->ro_rt == 0) {
633 			/*
634 			 * non-bsdi always clone routes, if parent is
635 			 * PRF_CLONING.
636 			 */
637 			rtalloc((struct route *)ro);
638 		}
639 		if (ro->ro_rt == 0) {
640 			ip6stat.ip6s_noroute++;
641 			error = EHOSTUNREACH;
642 			/* XXX in6_ifstat_inc(ifp, ifs6_out_discard); */
643 			goto bad;
644 		}
645 		/* XXX rt not locked */
646 		ia = ifatoia6(ro->ro_rt->rt_ifa);
647 		ifp = ro->ro_rt->rt_ifp;
648 		ro->ro_rt->rt_rmx.rmx_pksent++;
649 		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
650 			dst = (struct sockaddr_in6 *)ro->ro_rt->rt_gateway;
651 		m->m_flags &= ~(M_BCAST | M_MCAST);	/* just in case */
652 
653 		in6_ifstat_inc(ifp, ifs6_out_request);
654 
655 		/*
656 		 * Check if the outgoing interface conflicts with
657 		 * the interface specified by ifi6_ifindex (if specified).
658 		 * Note that loopback interface is always okay.
659 		 * (this may happen when we are sending a packet to one of
660 		 *  our own addresses.)
661 		 */
662 		if (opt && opt->ip6po_pktinfo
663 		 && opt->ip6po_pktinfo->ipi6_ifindex) {
664 			if (!(ifp->if_flags & IFF_LOOPBACK)
665 			 && ifp->if_index != opt->ip6po_pktinfo->ipi6_ifindex) {
666 				ip6stat.ip6s_noroute++;
667 				in6_ifstat_inc(ifp, ifs6_out_discard);
668 				error = EHOSTUNREACH;
669 				goto bad;
670 			}
671 		}
672 
673 		if (opt && opt->ip6po_hlim != -1)
674 			ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
675 	} else {
676 		/* Multicast */
677 		struct	in6_multi *in6m;
678 
679 		m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
680 
681 		/*
682 		 * See if the caller provided any multicast options
683 		 */
684 		ifp = NULL;
685 		if (im6o != NULL) {
686 			ip6->ip6_hlim = im6o->im6o_multicast_hlim;
687 			if (im6o->im6o_multicast_ifp != NULL)
688 				ifp = im6o->im6o_multicast_ifp;
689 		} else
690 			ip6->ip6_hlim = ip6_defmcasthlim;
691 
692 		/*
693 		 * See if the caller provided the outgoing interface
694 		 * as an ancillary data.
695 		 * Boundary check for ifindex is assumed to be already done.
696 		 */
697 		if (opt && opt->ip6po_pktinfo && opt->ip6po_pktinfo->ipi6_ifindex)
698 			ifp = ifnet_byindex(opt->ip6po_pktinfo->ipi6_ifindex);
699 
700 		/*
701 		 * If the destination is a node-local scope multicast,
702 		 * the packet should be loop-backed only.
703 		 */
704 		if (IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst)) {
705 			/*
706 			 * If the outgoing interface is already specified,
707 			 * it should be a loopback interface.
708 			 */
709 			if (ifp && (ifp->if_flags & IFF_LOOPBACK) == 0) {
710 				ip6stat.ip6s_badscope++;
711 				error = ENETUNREACH; /* XXX: better error? */
712 				/* XXX correct ifp? */
713 				in6_ifstat_inc(ifp, ifs6_out_discard);
714 				goto bad;
715 			} else {
716 				ifp = &loif[0];
717 			}
718 		}
719 
720 		if (opt && opt->ip6po_hlim != -1)
721 			ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
722 
723 		/*
724 		 * If caller did not provide an interface lookup a
725 		 * default in the routing table.  This is either a
726 		 * default for the speicfied group (i.e. a host
727 		 * route), or a multicast default (a route for the
728 		 * ``net'' ff00::/8).
729 		 */
730 		if (ifp == NULL) {
731 			if (ro->ro_rt == 0)
732 				ro->ro_rt = rtalloc1((struct sockaddr *)
733 						&ro->ro_dst, 0, 0UL);
734 			else
735 				RT_LOCK(ro->ro_rt);
736 			if (ro->ro_rt == 0) {
737 				ip6stat.ip6s_noroute++;
738 				error = EHOSTUNREACH;
739 				/* XXX in6_ifstat_inc(ifp, ifs6_out_discard) */
740 				goto bad;
741 			}
742 			ia = ifatoia6(ro->ro_rt->rt_ifa);
743 			ifp = ro->ro_rt->rt_ifp;
744 			ro->ro_rt->rt_rmx.rmx_pksent++;
745 			RT_UNLOCK(ro->ro_rt);
746 		}
747 
748 		if ((flags & IPV6_FORWARDING) == 0)
749 			in6_ifstat_inc(ifp, ifs6_out_request);
750 		in6_ifstat_inc(ifp, ifs6_out_mcast);
751 
752 		/*
753 		 * Confirm that the outgoing interface supports multicast.
754 		 */
755 		if ((ifp->if_flags & IFF_MULTICAST) == 0) {
756 			ip6stat.ip6s_noroute++;
757 			in6_ifstat_inc(ifp, ifs6_out_discard);
758 			error = ENETUNREACH;
759 			goto bad;
760 		}
761 		IN6_LOOKUP_MULTI(ip6->ip6_dst, ifp, in6m);
762 		if (in6m != NULL &&
763 		   (im6o == NULL || im6o->im6o_multicast_loop)) {
764 			/*
765 			 * If we belong to the destination multicast group
766 			 * on the outgoing interface, and the caller did not
767 			 * forbid loopback, loop back a copy.
768 			 */
769 			ip6_mloopback(ifp, m, dst);
770 		} else {
771 			/*
772 			 * If we are acting as a multicast router, perform
773 			 * multicast forwarding as if the packet had just
774 			 * arrived on the interface to which we are about
775 			 * to send.  The multicast forwarding function
776 			 * recursively calls this function, using the
777 			 * IPV6_FORWARDING flag to prevent infinite recursion.
778 			 *
779 			 * Multicasts that are looped back by ip6_mloopback(),
780 			 * above, will be forwarded by the ip6_input() routine,
781 			 * if necessary.
782 			 */
783 			if (ip6_mrouter && (flags & IPV6_FORWARDING) == 0) {
784 				if (ip6_mforward(ip6, ifp, m) != 0) {
785 					m_freem(m);
786 					goto done;
787 				}
788 			}
789 		}
790 		/*
791 		 * Multicasts with a hoplimit of zero may be looped back,
792 		 * above, but must not be transmitted on a network.
793 		 * Also, multicasts addressed to the loopback interface
794 		 * are not sent -- the above call to ip6_mloopback() will
795 		 * loop back a copy if this host actually belongs to the
796 		 * destination group on the loopback interface.
797 		 */
798 		if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK) ||
799 		    IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst)) {
800 			m_freem(m);
801 			goto done;
802 		}
803 	}
804 
805 	/*
806 	 * Fill the outgoing inteface to tell the upper layer
807 	 * to increment per-interface statistics.
808 	 */
809 	if (ifpp)
810 		*ifpp = ifp;
811 
812 	/* Determine path MTU. */
813 	if ((error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, &mtu,
814 	    &alwaysfrag)) != 0)
815 		goto bad;
816 
817 	/*
818 	 * The caller of this function may specify to use the minimum MTU
819 	 * in some cases.
820 	 * An advanced API option (IPV6_USE_MIN_MTU) can also override MTU
821 	 * setting.  The logic is a bit complicated; by default, unicast
822 	 * packets will follow path MTU while multicast packets will be sent at
823 	 * the minimum MTU.  If IP6PO_MINMTU_ALL is specified, all packets
824 	 * including unicast ones will be sent at the minimum MTU.  Multicast
825 	 * packets will always be sent at the minimum MTU unless
826 	 * IP6PO_MINMTU_DISABLE is explicitly specified.
827 	 * See RFC 3542 for more details.
828 	 */
829 	if (mtu > IPV6_MMTU) {
830 		if ((flags & IPV6_MINMTU))
831 			mtu = IPV6_MMTU;
832 		else if (opt && opt->ip6po_minmtu == IP6PO_MINMTU_ALL)
833 			mtu = IPV6_MMTU;
834 		else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
835 			 (opt == NULL ||
836 			  opt->ip6po_minmtu != IP6PO_MINMTU_DISABLE)) {
837 			mtu = IPV6_MMTU;
838 		}
839 	}
840 
841 	/* Fake scoped addresses */
842 	if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
843 		/*
844 		 * If source or destination address is a scoped address, and
845 		 * the packet is going to be sent to a loopback interface,
846 		 * we should keep the original interface.
847 		 */
848 
849 		/*
850 		 * XXX: this is a very experimental and temporary solution.
851 		 * We eventually have sockaddr_in6 and use the sin6_scope_id
852 		 * field of the structure here.
853 		 * We rely on the consistency between two scope zone ids
854 		 * of source and destination, which should already be assured.
855 		 * Larger scopes than link will be supported in the future.
856 		 */
857 		origifp = NULL;
858 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
859 			origifp = ifnet_byindex(ntohs(ip6->ip6_src.s6_addr16[1]));
860 		else if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
861 			origifp = ifnet_byindex(ntohs(ip6->ip6_dst.s6_addr16[1]));
862 		/*
863 		 * XXX: origifp can be NULL even in those two cases above.
864 		 * For example, if we remove the (only) link-local address
865 		 * from the loopback interface, and try to send a link-local
866 		 * address without link-id information.  Then the source
867 		 * address is ::1, and the destination address is the
868 		 * link-local address with its s6_addr16[1] being zero.
869 		 * What is worse, if the packet goes to the loopback interface
870 		 * by a default rejected route, the null pointer would be
871 		 * passed to looutput, and the kernel would hang.
872 		 * The following last resort would prevent such disaster.
873 		 */
874 		if (origifp == NULL)
875 			origifp = ifp;
876 	}
877 	else
878 		origifp = ifp;
879 	/*
880 	 * clear embedded scope identifiers if necessary.
881 	 * in6_clearscope will touch the addresses only when necessary.
882 	 */
883 	in6_clearscope(&ip6->ip6_src);
884 	in6_clearscope(&ip6->ip6_dst);
885 
886 	/*
887 	 * Check with the firewall...
888 	 */
889 	if (ip6_fw_enable && ip6_fw_chk_ptr) {
890 		u_short port = 0;
891 		m->m_pkthdr.rcvif = NULL;	/* XXX */
892 		/* If ipfw says divert, we have to just drop packet */
893 		if ((*ip6_fw_chk_ptr)(&ip6, ifp, &port, &m)) {
894 			m_freem(m);
895 			goto done;
896 		}
897 		if (!m) {
898 			error = EACCES;
899 			goto done;
900 		}
901 	}
902 
903 	/*
904 	 * If the outgoing packet contains a hop-by-hop options header,
905 	 * it must be examined and processed even by the source node.
906 	 * (RFC 2460, section 4.)
907 	 */
908 	if (exthdrs.ip6e_hbh) {
909 		struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh, struct ip6_hbh *);
910 		u_int32_t dummy1; /* XXX unused */
911 		u_int32_t dummy2; /* XXX unused */
912 
913 #ifdef DIAGNOSTIC
914 		if ((hbh->ip6h_len + 1) << 3 > exthdrs.ip6e_hbh->m_len)
915 			panic("ip6e_hbh is not continuous");
916 #endif
917 		/*
918 		 *  XXX: if we have to send an ICMPv6 error to the sender,
919 		 *       we need the M_LOOP flag since icmp6_error() expects
920 		 *       the IPv6 and the hop-by-hop options header are
921 		 *       continuous unless the flag is set.
922 		 */
923 		m->m_flags |= M_LOOP;
924 		m->m_pkthdr.rcvif = ifp;
925 		if (ip6_process_hopopts(m, (u_int8_t *)(hbh + 1),
926 		    ((hbh->ip6h_len + 1) << 3) - sizeof(struct ip6_hbh),
927 		    &dummy1, &dummy2) < 0) {
928 			/* m was already freed at this point */
929 			error = EINVAL;/* better error? */
930 			goto done;
931 		}
932 		m->m_flags &= ~M_LOOP; /* XXX */
933 		m->m_pkthdr.rcvif = NULL;
934 	}
935 
936 	/* Jump over all PFIL processing if hooks are not active. */
937 	if (inet6_pfil_hook.ph_busy_count == -1)
938 		goto passout;
939 
940 	/* Run through list of hooks for output packets. */
941 	error = pfil_run_hooks(&inet6_pfil_hook, &m, ifp, PFIL_OUT, inp);
942 	if (error != 0 || m == NULL)
943 		goto done;
944 	ip6 = mtod(m, struct ip6_hdr *);
945 
946 passout:
947 	/*
948 	 * Send the packet to the outgoing interface.
949 	 * If necessary, do IPv6 fragmentation before sending.
950 	 *
951 	 * the logic here is rather complex:
952 	 * 1: normal case (dontfrag == 0, alwaysfrag == 0)
953 	 * 1-a:	send as is if tlen <= path mtu
954 	 * 1-b:	fragment if tlen > path mtu
955 	 *
956 	 * 2: if user asks us not to fragment (dontfrag == 1)
957 	 * 2-a:	send as is if tlen <= interface mtu
958 	 * 2-b:	error if tlen > interface mtu
959 	 *
960 	 * 3: if we always need to attach fragment header (alwaysfrag == 1)
961 	 *	always fragment
962 	 *
963 	 * 4: if dontfrag == 1 && alwaysfrag == 1
964 	 *	error, as we cannot handle this conflicting request
965 	 */
966 	tlen = m->m_pkthdr.len;
967 
968 	if (opt && (opt->ip6po_flags & IP6PO_DONTFRAG))
969 		dontfrag = 1;
970 	else
971 		dontfrag = 0;
972 	if (dontfrag && alwaysfrag) {	/* case 4 */
973 		/* conflicting request - can't transmit */
974 		error = EMSGSIZE;
975 		goto bad;
976 	}
977 	if (dontfrag && tlen > IN6_LINKMTU(ifp)) {	/* case 2-b */
978 		/*
979 		 * Even if the DONTFRAG option is specified, we cannot send the
980 		 * packet when the data length is larger than the MTU of the
981 		 * outgoing interface.
982 		 * Notify the error by sending IPV6_PATHMTU ancillary data as
983 		 * well as returning an error code (the latter is not described
984 		 * in the API spec.)
985 		 */
986 		u_int32_t mtu32;
987 		struct ip6ctlparam ip6cp;
988 
989 		mtu32 = (u_int32_t)mtu;
990 		bzero(&ip6cp, sizeof(ip6cp));
991 		ip6cp.ip6c_cmdarg = (void *)&mtu32;
992 		pfctlinput2(PRC_MSGSIZE, (struct sockaddr *)&ro_pmtu->ro_dst,
993 		    (void *)&ip6cp);
994 
995 		error = EMSGSIZE;
996 		goto bad;
997 	}
998 
999 	/*
1000 	 * transmit packet without fragmentation
1001 	 */
1002 	if (dontfrag || (!alwaysfrag && tlen <= mtu)) {	/* case 1-a and 2-a */
1003 		struct in6_ifaddr *ia6;
1004 
1005 		ip6 = mtod(m, struct ip6_hdr *);
1006 		ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
1007 		if (ia6) {
1008 			/* Record statistics for this interface address. */
1009 			ia6->ia_ifa.if_opackets++;
1010 			ia6->ia_ifa.if_obytes += m->m_pkthdr.len;
1011 		}
1012 #ifdef IPSEC
1013 		/* clean ipsec history once it goes out of the node */
1014 		ipsec_delaux(m);
1015 #endif
1016 		error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
1017 		goto done;
1018 	}
1019 
1020 	/*
1021 	 * try to fragment the packet.  case 1-b and 3
1022 	 */
1023 	if (mtu < IPV6_MMTU) {
1024 		/* path MTU cannot be less than IPV6_MMTU */
1025 		error = EMSGSIZE;
1026 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
1027 		goto bad;
1028 	} else if (ip6->ip6_plen == 0) {
1029 		/* jumbo payload cannot be fragmented */
1030 		error = EMSGSIZE;
1031 		in6_ifstat_inc(ifp, ifs6_out_fragfail);
1032 		goto bad;
1033 	} else {
1034 		struct mbuf **mnext, *m_frgpart;
1035 		struct ip6_frag *ip6f;
1036 		u_int32_t id = htonl(ip6_randomid());
1037 		u_char nextproto;
1038 #if 0
1039 		struct ip6ctlparam ip6cp;
1040 		u_int32_t mtu32;
1041 #endif
1042 		int qslots = ifp->if_snd.ifq_maxlen - ifp->if_snd.ifq_len;
1043 
1044 		/*
1045 		 * Too large for the destination or interface;
1046 		 * fragment if possible.
1047 		 * Must be able to put at least 8 bytes per fragment.
1048 		 */
1049 		hlen = unfragpartlen;
1050 		if (mtu > IPV6_MAXPACKET)
1051 			mtu = IPV6_MAXPACKET;
1052 
1053 #if 0
1054 		/*
1055 		 * It is believed this code is a leftover from the
1056 		 * development of the IPV6_RECVPATHMTU sockopt and
1057 		 * associated work to implement RFC3542.
1058 		 * It's not entirely clear what the intent of the API
1059 		 * is at this point, so disable this code for now.
1060 		 * The IPV6_RECVPATHMTU sockopt and/or IPV6_DONTFRAG
1061 		 * will send notifications if the application requests.
1062 		 */
1063 
1064 		/* Notify a proper path MTU to applications. */
1065 		mtu32 = (u_int32_t)mtu;
1066 		bzero(&ip6cp, sizeof(ip6cp));
1067 		ip6cp.ip6c_cmdarg = (void *)&mtu32;
1068 		pfctlinput2(PRC_MSGSIZE, (struct sockaddr *)&ro_pmtu->ro_dst,
1069 		    (void *)&ip6cp);
1070 #endif
1071 
1072 		len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
1073 		if (len < 8) {
1074 			error = EMSGSIZE;
1075 			in6_ifstat_inc(ifp, ifs6_out_fragfail);
1076 			goto bad;
1077 		}
1078 
1079 		/*
1080 		 * Verify that we have any chance at all of being able to queue
1081 		 *      the packet or packet fragments
1082 		 */
1083 		if (qslots <= 0 || ((u_int)qslots * (mtu - hlen)
1084 		    < tlen  /* - hlen */)) {
1085 			error = ENOBUFS;
1086 			ip6stat.ip6s_odropped++;
1087 			goto bad;
1088 		}
1089 
1090 		mnext = &m->m_nextpkt;
1091 
1092 		/*
1093 		 * Change the next header field of the last header in the
1094 		 * unfragmentable part.
1095 		 */
1096 		if (exthdrs.ip6e_rthdr) {
1097 			nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
1098 			*mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
1099 		} else if (exthdrs.ip6e_dest1) {
1100 			nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
1101 			*mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
1102 		} else if (exthdrs.ip6e_hbh) {
1103 			nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
1104 			*mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
1105 		} else {
1106 			nextproto = ip6->ip6_nxt;
1107 			ip6->ip6_nxt = IPPROTO_FRAGMENT;
1108 		}
1109 
1110 		/*
1111 		 * Loop through length of segment after first fragment,
1112 		 * make new header and copy data of each part and link onto
1113 		 * chain.
1114 		 */
1115 		m0 = m;
1116 		for (off = hlen; off < tlen; off += len) {
1117 			MGETHDR(m, M_DONTWAIT, MT_HEADER);
1118 			if (!m) {
1119 				error = ENOBUFS;
1120 				ip6stat.ip6s_odropped++;
1121 				goto sendorfree;
1122 			}
1123 			m->m_pkthdr.rcvif = NULL;
1124 			m->m_flags = m0->m_flags & M_COPYFLAGS;
1125 			*mnext = m;
1126 			mnext = &m->m_nextpkt;
1127 			m->m_data += max_linkhdr;
1128 			mhip6 = mtod(m, struct ip6_hdr *);
1129 			*mhip6 = *ip6;
1130 			m->m_len = sizeof(*mhip6);
1131 			error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
1132 			if (error) {
1133 				ip6stat.ip6s_odropped++;
1134 				goto sendorfree;
1135 			}
1136 			ip6f->ip6f_offlg = htons((u_short)((off - hlen) & ~7));
1137 			if (off + len >= tlen)
1138 				len = tlen - off;
1139 			else
1140 				ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
1141 			mhip6->ip6_plen = htons((u_short)(len + hlen +
1142 			    sizeof(*ip6f) - sizeof(struct ip6_hdr)));
1143 			if ((m_frgpart = m_copy(m0, off, len)) == 0) {
1144 				error = ENOBUFS;
1145 				ip6stat.ip6s_odropped++;
1146 				goto sendorfree;
1147 			}
1148 			m_cat(m, m_frgpart);
1149 			m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
1150 			m->m_pkthdr.rcvif = (struct ifnet *)0;
1151 			ip6f->ip6f_reserved = 0;
1152 			ip6f->ip6f_ident = id;
1153 			ip6f->ip6f_nxt = nextproto;
1154 			ip6stat.ip6s_ofragments++;
1155 			in6_ifstat_inc(ifp, ifs6_out_fragcreat);
1156 		}
1157 
1158 		in6_ifstat_inc(ifp, ifs6_out_fragok);
1159 	}
1160 
1161 	/*
1162 	 * Remove leading garbages.
1163 	 */
1164 sendorfree:
1165 	m = m0->m_nextpkt;
1166 	m0->m_nextpkt = 0;
1167 	m_freem(m0);
1168 	for (m0 = m; m; m = m0) {
1169 		m0 = m->m_nextpkt;
1170 		m->m_nextpkt = 0;
1171 		if (error == 0) {
1172  			/* Record statistics for this interface address. */
1173  			if (ia) {
1174  				ia->ia_ifa.if_opackets++;
1175  				ia->ia_ifa.if_obytes += m->m_pkthdr.len;
1176  			}
1177 #ifdef IPSEC
1178 			/* clean ipsec history once it goes out of the node */
1179 			ipsec_delaux(m);
1180 #endif
1181 			error = nd6_output(ifp, origifp, m, dst, ro->ro_rt);
1182 		} else
1183 			m_freem(m);
1184 	}
1185 
1186 	if (error == 0)
1187 		ip6stat.ip6s_fragmented++;
1188 
1189 done:
1190 	if (ro == &ip6route && ro->ro_rt) { /* brace necessary for RTFREE */
1191 		RTFREE(ro->ro_rt);
1192 	} else if (ro_pmtu == &ip6route && ro_pmtu->ro_rt) {
1193 		RTFREE(ro_pmtu->ro_rt);
1194 	}
1195 
1196 #ifdef IPSEC
1197 	if (sp != NULL)
1198 		key_freesp(sp);
1199 #endif /* IPSEC */
1200 #ifdef FAST_IPSEC
1201 	if (sp != NULL)
1202 		KEY_FREESP(&sp);
1203 #endif /* FAST_IPSEC */
1204 
1205 	return (error);
1206 
1207 freehdrs:
1208 	m_freem(exthdrs.ip6e_hbh);	/* m_freem will check if mbuf is 0 */
1209 	m_freem(exthdrs.ip6e_dest1);
1210 	m_freem(exthdrs.ip6e_rthdr);
1211 	m_freem(exthdrs.ip6e_dest2);
1212 	/* FALLTHROUGH */
1213 bad:
1214 	m_freem(m);
1215 	goto done;
1216 }
1217 
1218 static int
1219 ip6_copyexthdr(mp, hdr, hlen)
1220 	struct mbuf **mp;
1221 	caddr_t hdr;
1222 	int hlen;
1223 {
1224 	struct mbuf *m;
1225 
1226 	if (hlen > MCLBYTES)
1227 		return (ENOBUFS); /* XXX */
1228 
1229 	MGET(m, M_DONTWAIT, MT_DATA);
1230 	if (!m)
1231 		return (ENOBUFS);
1232 
1233 	if (hlen > MLEN) {
1234 		MCLGET(m, M_DONTWAIT);
1235 		if ((m->m_flags & M_EXT) == 0) {
1236 			m_free(m);
1237 			return (ENOBUFS);
1238 		}
1239 	}
1240 	m->m_len = hlen;
1241 	if (hdr)
1242 		bcopy(hdr, mtod(m, caddr_t), hlen);
1243 
1244 	*mp = m;
1245 	return (0);
1246 }
1247 
1248 /*
1249  * Insert jumbo payload option.
1250  */
1251 static int
1252 ip6_insert_jumboopt(exthdrs, plen)
1253 	struct ip6_exthdrs *exthdrs;
1254 	u_int32_t plen;
1255 {
1256 	struct mbuf *mopt;
1257 	u_char *optbuf;
1258 	u_int32_t v;
1259 
1260 #define JUMBOOPTLEN	8	/* length of jumbo payload option and padding */
1261 
1262 	/*
1263 	 * If there is no hop-by-hop options header, allocate new one.
1264 	 * If there is one but it doesn't have enough space to store the
1265 	 * jumbo payload option, allocate a cluster to store the whole options.
1266 	 * Otherwise, use it to store the options.
1267 	 */
1268 	if (exthdrs->ip6e_hbh == 0) {
1269 		MGET(mopt, M_DONTWAIT, MT_DATA);
1270 		if (mopt == 0)
1271 			return (ENOBUFS);
1272 		mopt->m_len = JUMBOOPTLEN;
1273 		optbuf = mtod(mopt, u_char *);
1274 		optbuf[1] = 0;	/* = ((JUMBOOPTLEN) >> 3) - 1 */
1275 		exthdrs->ip6e_hbh = mopt;
1276 	} else {
1277 		struct ip6_hbh *hbh;
1278 
1279 		mopt = exthdrs->ip6e_hbh;
1280 		if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
1281 			/*
1282 			 * XXX assumption:
1283 			 * - exthdrs->ip6e_hbh is not referenced from places
1284 			 *   other than exthdrs.
1285 			 * - exthdrs->ip6e_hbh is not an mbuf chain.
1286 			 */
1287 			int oldoptlen = mopt->m_len;
1288 			struct mbuf *n;
1289 
1290 			/*
1291 			 * XXX: give up if the whole (new) hbh header does
1292 			 * not fit even in an mbuf cluster.
1293 			 */
1294 			if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
1295 				return (ENOBUFS);
1296 
1297 			/*
1298 			 * As a consequence, we must always prepare a cluster
1299 			 * at this point.
1300 			 */
1301 			MGET(n, M_DONTWAIT, MT_DATA);
1302 			if (n) {
1303 				MCLGET(n, M_DONTWAIT);
1304 				if ((n->m_flags & M_EXT) == 0) {
1305 					m_freem(n);
1306 					n = NULL;
1307 				}
1308 			}
1309 			if (!n)
1310 				return (ENOBUFS);
1311 			n->m_len = oldoptlen + JUMBOOPTLEN;
1312 			bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t),
1313 			    oldoptlen);
1314 			optbuf = mtod(n, caddr_t) + oldoptlen;
1315 			m_freem(mopt);
1316 			mopt = exthdrs->ip6e_hbh = n;
1317 		} else {
1318 			optbuf = mtod(mopt, u_char *) + mopt->m_len;
1319 			mopt->m_len += JUMBOOPTLEN;
1320 		}
1321 		optbuf[0] = IP6OPT_PADN;
1322 		optbuf[1] = 1;
1323 
1324 		/*
1325 		 * Adjust the header length according to the pad and
1326 		 * the jumbo payload option.
1327 		 */
1328 		hbh = mtod(mopt, struct ip6_hbh *);
1329 		hbh->ip6h_len += (JUMBOOPTLEN >> 3);
1330 	}
1331 
1332 	/* fill in the option. */
1333 	optbuf[2] = IP6OPT_JUMBO;
1334 	optbuf[3] = 4;
1335 	v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
1336 	bcopy(&v, &optbuf[4], sizeof(u_int32_t));
1337 
1338 	/* finally, adjust the packet header length */
1339 	exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
1340 
1341 	return (0);
1342 #undef JUMBOOPTLEN
1343 }
1344 
1345 /*
1346  * Insert fragment header and copy unfragmentable header portions.
1347  */
1348 static int
1349 ip6_insertfraghdr(m0, m, hlen, frghdrp)
1350 	struct mbuf *m0, *m;
1351 	int hlen;
1352 	struct ip6_frag **frghdrp;
1353 {
1354 	struct mbuf *n, *mlast;
1355 
1356 	if (hlen > sizeof(struct ip6_hdr)) {
1357 		n = m_copym(m0, sizeof(struct ip6_hdr),
1358 		    hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
1359 		if (n == 0)
1360 			return (ENOBUFS);
1361 		m->m_next = n;
1362 	} else
1363 		n = m;
1364 
1365 	/* Search for the last mbuf of unfragmentable part. */
1366 	for (mlast = n; mlast->m_next; mlast = mlast->m_next)
1367 		;
1368 
1369 	if ((mlast->m_flags & M_EXT) == 0 &&
1370 	    M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
1371 		/* use the trailing space of the last mbuf for the fragment hdr */
1372 		*frghdrp = (struct ip6_frag *)(mtod(mlast, caddr_t) +
1373 		    mlast->m_len);
1374 		mlast->m_len += sizeof(struct ip6_frag);
1375 		m->m_pkthdr.len += sizeof(struct ip6_frag);
1376 	} else {
1377 		/* allocate a new mbuf for the fragment header */
1378 		struct mbuf *mfrg;
1379 
1380 		MGET(mfrg, M_DONTWAIT, MT_DATA);
1381 		if (mfrg == 0)
1382 			return (ENOBUFS);
1383 		mfrg->m_len = sizeof(struct ip6_frag);
1384 		*frghdrp = mtod(mfrg, struct ip6_frag *);
1385 		mlast->m_next = mfrg;
1386 	}
1387 
1388 	return (0);
1389 }
1390 
1391 static int
1392 ip6_getpmtu(ro_pmtu, ro, ifp, dst, mtup, alwaysfragp)
1393 	struct route_in6 *ro_pmtu, *ro;
1394 	struct ifnet *ifp;
1395 	struct in6_addr *dst;
1396 	u_long *mtup;
1397 	int *alwaysfragp;
1398 {
1399 	u_int32_t mtu = 0;
1400 	int alwaysfrag = 0;
1401 	int error = 0;
1402 
1403 	if (ro_pmtu != ro) {
1404 		/* The first hop and the final destination may differ. */
1405 		struct sockaddr_in6 *sa6_dst =
1406 		    (struct sockaddr_in6 *)&ro_pmtu->ro_dst;
1407 		if (ro_pmtu->ro_rt &&
1408 		    ((ro_pmtu->ro_rt->rt_flags & RTF_UP) == 0 ||
1409 		     !IN6_ARE_ADDR_EQUAL(&sa6_dst->sin6_addr, dst))) {
1410 			RTFREE(ro_pmtu->ro_rt);
1411 			ro_pmtu->ro_rt = (struct rtentry *)NULL;
1412 		}
1413 		if (ro_pmtu->ro_rt == NULL) {
1414 			bzero(sa6_dst, sizeof(*sa6_dst));
1415 			sa6_dst->sin6_family = AF_INET6;
1416 			sa6_dst->sin6_len = sizeof(struct sockaddr_in6);
1417 			sa6_dst->sin6_addr = *dst;
1418 
1419 			rtalloc((struct route *)ro_pmtu);
1420 		}
1421 	}
1422 	if (ro_pmtu->ro_rt) {
1423 		u_int32_t ifmtu;
1424 		struct in_conninfo inc;
1425 
1426 		bzero(&inc, sizeof(inc));
1427 		inc.inc_flags = 1; /* IPv6 */
1428 		inc.inc6_faddr = *dst;
1429 
1430 		if (ifp == NULL)
1431 			ifp = ro_pmtu->ro_rt->rt_ifp;
1432 		ifmtu = IN6_LINKMTU(ifp);
1433 		mtu = tcp_hc_getmtu(&inc);
1434 		if (mtu)
1435 			mtu = min(mtu, ro_pmtu->ro_rt->rt_rmx.rmx_mtu);
1436 		else
1437 			mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
1438 		if (mtu == 0)
1439 			mtu = ifmtu;
1440 		else if (mtu < IPV6_MMTU) {
1441 			/*
1442 			 * RFC2460 section 5, last paragraph:
1443 			 * if we record ICMPv6 too big message with
1444 			 * mtu < IPV6_MMTU, transmit packets sized IPV6_MMTU
1445 			 * or smaller, with framgent header attached.
1446 			 * (fragment header is needed regardless from the
1447 			 * packet size, for translators to identify packets)
1448 			 */
1449 			alwaysfrag = 1;
1450 			mtu = IPV6_MMTU;
1451 		} else if (mtu > ifmtu) {
1452 			/*
1453 			 * The MTU on the route is larger than the MTU on
1454 			 * the interface!  This shouldn't happen, unless the
1455 			 * MTU of the interface has been changed after the
1456 			 * interface was brought up.  Change the MTU in the
1457 			 * route to match the interface MTU (as long as the
1458 			 * field isn't locked).
1459 			 */
1460 			mtu = ifmtu;
1461 			ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu;
1462 		}
1463 	} else if (ifp) {
1464 		mtu = IN6_LINKMTU(ifp);
1465 	} else
1466 		error = EHOSTUNREACH; /* XXX */
1467 
1468 	*mtup = mtu;
1469 	if (alwaysfragp)
1470 		*alwaysfragp = alwaysfrag;
1471 	return (error);
1472 }
1473 
1474 /*
1475  * IP6 socket option processing.
1476  */
1477 int
1478 ip6_ctloutput(so, sopt)
1479 	struct socket *so;
1480 	struct sockopt *sopt;
1481 {
1482 	int privileged, optdatalen, uproto;
1483 	void *optdata;
1484 	struct inpcb *in6p = sotoinpcb(so);
1485 	int error, optval;
1486 	int level, op, optname;
1487 	int optlen;
1488 	struct thread *td;
1489 
1490 	if (sopt) {
1491 		level = sopt->sopt_level;
1492 		op = sopt->sopt_dir;
1493 		optname = sopt->sopt_name;
1494 		optlen = sopt->sopt_valsize;
1495 		td = sopt->sopt_td;
1496 	} else {
1497 		panic("ip6_ctloutput: arg soopt is NULL");
1498 	}
1499 	error = optval = 0;
1500 
1501 	privileged = (td == 0 || suser(td)) ? 0 : 1;
1502 	uproto = (int)so->so_proto->pr_protocol;
1503 
1504 	if (level == IPPROTO_IPV6) {
1505 		switch (op) {
1506 
1507 		case SOPT_SET:
1508 			switch (optname) {
1509 			case IPV6_2292PKTOPTIONS:
1510 #ifdef IPV6_PKTOPTIONS
1511 			case IPV6_PKTOPTIONS:
1512 #endif
1513 			{
1514 				struct mbuf *m;
1515 
1516 				error = soopt_getm(sopt, &m); /* XXX */
1517 				if (error != 0)
1518 					break;
1519 				error = soopt_mcopyin(sopt, m); /* XXX */
1520 				if (error != 0)
1521 					break;
1522 				error = ip6_pcbopts(&in6p->in6p_outputopts,
1523 						    m, so, sopt);
1524 				m_freem(m); /* XXX */
1525 				break;
1526 			}
1527 
1528 			/*
1529 			 * Use of some Hop-by-Hop options or some
1530 			 * Destination options, might require special
1531 			 * privilege.  That is, normal applications
1532 			 * (without special privilege) might be forbidden
1533 			 * from setting certain options in outgoing packets,
1534 			 * and might never see certain options in received
1535 			 * packets. [RFC 2292 Section 6]
1536 			 * KAME specific note:
1537 			 *  KAME prevents non-privileged users from sending or
1538 			 *  receiving ANY hbh/dst options in order to avoid
1539 			 *  overhead of parsing options in the kernel.
1540 			 */
1541 			case IPV6_RECVHOPOPTS:
1542 			case IPV6_RECVDSTOPTS:
1543 			case IPV6_RECVRTHDRDSTOPTS:
1544 				if (!privileged) {
1545 					error = EPERM;
1546 					break;
1547 				}
1548 				/* FALLTHROUGH */
1549 			case IPV6_UNICAST_HOPS:
1550 			case IPV6_HOPLIMIT:
1551 			case IPV6_FAITH:
1552 
1553 			case IPV6_RECVPKTINFO:
1554 			case IPV6_RECVHOPLIMIT:
1555 			case IPV6_RECVRTHDR:
1556 			case IPV6_RECVPATHMTU:
1557 			case IPV6_RECVTCLASS:
1558 			case IPV6_V6ONLY:
1559 			case IPV6_AUTOFLOWLABEL:
1560 				if (optlen != sizeof(int)) {
1561 					error = EINVAL;
1562 					break;
1563 				}
1564 				error = sooptcopyin(sopt, &optval,
1565 					sizeof optval, sizeof optval);
1566 				if (error)
1567 					break;
1568 				switch (optname) {
1569 
1570 				case IPV6_UNICAST_HOPS:
1571 					if (optval < -1 || optval >= 256)
1572 						error = EINVAL;
1573 					else {
1574 						/* -1 = kernel default */
1575 						in6p->in6p_hops = optval;
1576 						if ((in6p->in6p_vflag &
1577 						     INP_IPV4) != 0)
1578 							in6p->inp_ip_ttl = optval;
1579 					}
1580 					break;
1581 #define OPTSET(bit) \
1582 do { \
1583 	if (optval) \
1584 		in6p->in6p_flags |= (bit); \
1585 	else \
1586 		in6p->in6p_flags &= ~(bit); \
1587 } while (/*CONSTCOND*/ 0)
1588 #define OPTSET2292(bit) \
1589 do { \
1590 	in6p->in6p_flags |= IN6P_RFC2292; \
1591 	if (optval) \
1592 		in6p->in6p_flags |= (bit); \
1593 	else \
1594 		in6p->in6p_flags &= ~(bit); \
1595 } while (/*CONSTCOND*/ 0)
1596 #define OPTBIT(bit) (in6p->in6p_flags & (bit) ? 1 : 0)
1597 
1598 				case IPV6_RECVPKTINFO:
1599 					/* cannot mix with RFC2292 */
1600 					if (OPTBIT(IN6P_RFC2292)) {
1601 						error = EINVAL;
1602 						break;
1603 					}
1604 					OPTSET(IN6P_PKTINFO);
1605 					break;
1606 
1607 				case IPV6_HOPLIMIT:
1608 				{
1609 					struct ip6_pktopts **optp;
1610 
1611 					/* cannot mix with RFC2292 */
1612 					if (OPTBIT(IN6P_RFC2292)) {
1613 						error = EINVAL;
1614 						break;
1615 					}
1616 					optp = &in6p->in6p_outputopts;
1617 					error = ip6_pcbopt(IPV6_HOPLIMIT,
1618 							   (u_char *)&optval,
1619 							   sizeof(optval),
1620 							   optp,
1621 							   privileged, uproto);
1622 					break;
1623 				}
1624 
1625 				case IPV6_RECVHOPLIMIT:
1626 					/* cannot mix with RFC2292 */
1627 					if (OPTBIT(IN6P_RFC2292)) {
1628 						error = EINVAL;
1629 						break;
1630 					}
1631 					OPTSET(IN6P_HOPLIMIT);
1632 					break;
1633 
1634 				case IPV6_RECVHOPOPTS:
1635 					/* cannot mix with RFC2292 */
1636 					if (OPTBIT(IN6P_RFC2292)) {
1637 						error = EINVAL;
1638 						break;
1639 					}
1640 					OPTSET(IN6P_HOPOPTS);
1641 					break;
1642 
1643 				case IPV6_RECVDSTOPTS:
1644 					/* cannot mix with RFC2292 */
1645 					if (OPTBIT(IN6P_RFC2292)) {
1646 						error = EINVAL;
1647 						break;
1648 					}
1649 					OPTSET(IN6P_DSTOPTS);
1650 					break;
1651 
1652 				case IPV6_RECVRTHDRDSTOPTS:
1653 					/* cannot mix with RFC2292 */
1654 					if (OPTBIT(IN6P_RFC2292)) {
1655 						error = EINVAL;
1656 						break;
1657 					}
1658 					OPTSET(IN6P_RTHDRDSTOPTS);
1659 					break;
1660 
1661 				case IPV6_RECVRTHDR:
1662 					/* cannot mix with RFC2292 */
1663 					if (OPTBIT(IN6P_RFC2292)) {
1664 						error = EINVAL;
1665 						break;
1666 					}
1667 					OPTSET(IN6P_RTHDR);
1668 					break;
1669 
1670 				case IPV6_FAITH:
1671 					OPTSET(IN6P_FAITH);
1672 					break;
1673 
1674 				case IPV6_RECVPATHMTU:
1675 					/*
1676 					 * We ignore this option for TCP
1677 					 * sockets.
1678 					 * (rfc2292bis leaves this case
1679 					 * unspecified.)
1680 					 */
1681 					if (uproto != IPPROTO_TCP)
1682 						OPTSET(IN6P_MTU);
1683 					break;
1684 
1685 				case IPV6_V6ONLY:
1686 					/*
1687 					 * make setsockopt(IPV6_V6ONLY)
1688 					 * available only prior to bind(2).
1689 					 * see ipng mailing list, Jun 22 2001.
1690 					 */
1691 					if (in6p->in6p_lport ||
1692 					    !IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr)) {
1693 						error = EINVAL;
1694 						break;
1695 					}
1696 					OPTSET(IN6P_IPV6_V6ONLY);
1697 					if (optval)
1698 						in6p->in6p_vflag &= ~INP_IPV4;
1699 					else
1700 						in6p->in6p_vflag |= INP_IPV4;
1701 					break;
1702 				case IPV6_RECVTCLASS:
1703 					/* cannot mix with RFC2292 XXX */
1704 					if (OPTBIT(IN6P_RFC2292)) {
1705 						error = EINVAL;
1706 						break;
1707 					}
1708 					OPTSET(IN6P_TCLASS);
1709 					break;
1710 				case IPV6_AUTOFLOWLABEL:
1711 					OPTSET(IN6P_AUTOFLOWLABEL);
1712 					break;
1713 
1714 				}
1715 				break;
1716 
1717 			case IPV6_TCLASS:
1718 			case IPV6_DONTFRAG:
1719 			case IPV6_USE_MIN_MTU:
1720 			case IPV6_PREFER_TEMPADDR:
1721 				if (optlen != sizeof(optval)) {
1722 					error = EINVAL;
1723 					break;
1724 				}
1725 				error = sooptcopyin(sopt, &optval,
1726 					sizeof optval, sizeof optval);
1727 				if (error)
1728 					break;
1729 				{
1730 					struct ip6_pktopts **optp;
1731 					optp = &in6p->in6p_outputopts;
1732 					error = ip6_pcbopt(optname,
1733 							   (u_char *)&optval,
1734 							   sizeof(optval),
1735 							   optp,
1736 							   privileged, uproto);
1737 					break;
1738 				}
1739 
1740 			case IPV6_2292PKTINFO:
1741 			case IPV6_2292HOPLIMIT:
1742 			case IPV6_2292HOPOPTS:
1743 			case IPV6_2292DSTOPTS:
1744 			case IPV6_2292RTHDR:
1745 				/* RFC 2292 */
1746 				if (optlen != sizeof(int)) {
1747 					error = EINVAL;
1748 					break;
1749 				}
1750 				error = sooptcopyin(sopt, &optval,
1751 					sizeof optval, sizeof optval);
1752 				if (error)
1753 					break;
1754 				switch (optname) {
1755 				case IPV6_2292PKTINFO:
1756 					OPTSET2292(IN6P_PKTINFO);
1757 					break;
1758 				case IPV6_2292HOPLIMIT:
1759 					OPTSET2292(IN6P_HOPLIMIT);
1760 					break;
1761 				case IPV6_2292HOPOPTS:
1762 					/*
1763 					 * Check super-user privilege.
1764 					 * See comments for IPV6_RECVHOPOPTS.
1765 					 */
1766 					if (!privileged)
1767 						return (EPERM);
1768 					OPTSET2292(IN6P_HOPOPTS);
1769 					break;
1770 				case IPV6_2292DSTOPTS:
1771 					if (!privileged)
1772 						return (EPERM);
1773 					OPTSET2292(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS); /* XXX */
1774 					break;
1775 				case IPV6_2292RTHDR:
1776 					OPTSET2292(IN6P_RTHDR);
1777 					break;
1778 				}
1779 				break;
1780 			case IPV6_PKTINFO:
1781 			case IPV6_HOPOPTS:
1782 			case IPV6_RTHDR:
1783 			case IPV6_DSTOPTS:
1784 			case IPV6_RTHDRDSTOPTS:
1785 			case IPV6_NEXTHOP:
1786 			{
1787 				/* new advanced API (2292bis) */
1788 				u_char *optbuf;
1789 				int optlen;
1790 				struct ip6_pktopts **optp;
1791 
1792 				/* cannot mix with RFC2292 */
1793 				if (OPTBIT(IN6P_RFC2292)) {
1794 					error = EINVAL;
1795 					break;
1796 				}
1797 
1798 				switch (optname) {
1799 				case IPV6_HOPOPTS:
1800 				case IPV6_DSTOPTS:
1801 				case IPV6_RTHDRDSTOPTS:
1802 				case IPV6_NEXTHOP:
1803 					if (!privileged)
1804 						error = EPERM;
1805 					break;
1806 				}
1807 				if (error)
1808 					break;
1809 
1810 				switch (optname) {
1811 				case IPV6_PKTINFO:
1812 					optlen = sizeof(struct in6_pktinfo);
1813 					break;
1814 				case IPV6_NEXTHOP:
1815 					optlen = SOCK_MAXADDRLEN;
1816 					break;
1817 				default:
1818 					optlen = IPV6_MAXOPTHDR;
1819 					break;
1820 				}
1821 				if (sopt->sopt_valsize > optlen) {
1822 					error = EINVAL;
1823 					break;
1824 				}
1825 
1826 				optlen = sopt->sopt_valsize;
1827 				optbuf = malloc(optlen, M_TEMP, M_WAITOK);
1828 				error = sooptcopyin(sopt, optbuf, optlen,
1829 				    optlen);
1830 				if (error) {
1831 					free(optbuf, M_TEMP);
1832 					break;
1833 				}
1834 
1835 				optp = &in6p->in6p_outputopts;
1836 				error = ip6_pcbopt(optname,
1837 						   optbuf, optlen,
1838 						   optp, privileged, uproto);
1839 				free(optbuf, M_TEMP);
1840 				break;
1841 			}
1842 #undef OPTSET
1843 
1844 			case IPV6_MULTICAST_IF:
1845 			case IPV6_MULTICAST_HOPS:
1846 			case IPV6_MULTICAST_LOOP:
1847 			case IPV6_JOIN_GROUP:
1848 			case IPV6_LEAVE_GROUP:
1849 			    {
1850 				if (sopt->sopt_valsize > MLEN) {
1851 					error = EMSGSIZE;
1852 					break;
1853 				}
1854 				/* XXX */
1855 			    }
1856 			    /* FALLTHROUGH */
1857 			    {
1858 				struct mbuf *m;
1859 
1860 				if (sopt->sopt_valsize > MCLBYTES) {
1861 					error = EMSGSIZE;
1862 					break;
1863 				}
1864 				/* XXX */
1865 				MGET(m, sopt->sopt_td ? M_WAIT : M_DONTWAIT, MT_HEADER);
1866 				if (m == 0) {
1867 					error = ENOBUFS;
1868 					break;
1869 				}
1870 				if (sopt->sopt_valsize > MLEN) {
1871 					MCLGET(m, sopt->sopt_td ? M_WAIT : M_DONTWAIT);
1872 					if ((m->m_flags & M_EXT) == 0) {
1873 						m_free(m);
1874 						error = ENOBUFS;
1875 						break;
1876 					}
1877 				}
1878 				m->m_len = sopt->sopt_valsize;
1879 				error = sooptcopyin(sopt, mtod(m, char *),
1880 						    m->m_len, m->m_len);
1881 				if (error) {
1882 					(void)m_free(m);
1883 					break;
1884 				}
1885 				error =	ip6_setmoptions(sopt->sopt_name,
1886 							&in6p->in6p_moptions,
1887 							m);
1888 				(void)m_free(m);
1889 			    }
1890 				break;
1891 
1892 			case IPV6_PORTRANGE:
1893 				error = sooptcopyin(sopt, &optval,
1894 				    sizeof optval, sizeof optval);
1895 				if (error)
1896 					break;
1897 
1898 				switch (optval) {
1899 				case IPV6_PORTRANGE_DEFAULT:
1900 					in6p->in6p_flags &= ~(IN6P_LOWPORT);
1901 					in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1902 					break;
1903 
1904 				case IPV6_PORTRANGE_HIGH:
1905 					in6p->in6p_flags &= ~(IN6P_LOWPORT);
1906 					in6p->in6p_flags |= IN6P_HIGHPORT;
1907 					break;
1908 
1909 				case IPV6_PORTRANGE_LOW:
1910 					in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1911 					in6p->in6p_flags |= IN6P_LOWPORT;
1912 					break;
1913 
1914 				default:
1915 					error = EINVAL;
1916 					break;
1917 				}
1918 				break;
1919 
1920 #if defined(IPSEC) || defined(FAST_IPSEC)
1921 			case IPV6_IPSEC_POLICY:
1922 			    {
1923 				caddr_t req = NULL;
1924 				size_t len = 0;
1925 				struct mbuf *m;
1926 
1927 				if ((error = soopt_getm(sopt, &m)) != 0) /* XXX */
1928 					break;
1929 				if ((error = soopt_mcopyin(sopt, m)) != 0) /* XXX */
1930 					break;
1931 				if (m) {
1932 					req = mtod(m, caddr_t);
1933 					len = m->m_len;
1934 				}
1935 				error = ipsec6_set_policy(in6p, optname, req,
1936 							  len, privileged);
1937 				m_freem(m);
1938 			    }
1939 				break;
1940 #endif /* KAME IPSEC */
1941 
1942 			case IPV6_FW_ADD:
1943 			case IPV6_FW_DEL:
1944 			case IPV6_FW_FLUSH:
1945 			case IPV6_FW_ZERO:
1946 			    {
1947 				struct mbuf *m;
1948 				struct mbuf **mp = &m;
1949 
1950 				if (ip6_fw_ctl_ptr == NULL)
1951 					return EINVAL;
1952 				/* XXX */
1953 				if ((error = soopt_getm(sopt, &m)) != 0)
1954 					break;
1955 				/* XXX */
1956 				if ((error = soopt_mcopyin(sopt, m)) != 0)
1957 					break;
1958 				error = (*ip6_fw_ctl_ptr)(optname, mp);
1959 				m = *mp;
1960 			    }
1961 				break;
1962 
1963 			default:
1964 				error = ENOPROTOOPT;
1965 				break;
1966 			}
1967 			break;
1968 
1969 		case SOPT_GET:
1970 			switch (optname) {
1971 
1972 			case IPV6_2292PKTOPTIONS:
1973 #ifdef IPV6_PKTOPTIONS
1974 			case IPV6_PKTOPTIONS:
1975 #endif
1976 				/*
1977 				 * RFC3542 (effectively) deprecated the
1978 				 * semantics of the 2292-style pktoptions.
1979 				 * Since it was not reliable in nature (i.e.,
1980 				 * applications had to expect the lack of some
1981 				 * information after all), it would make sense
1982 				 * to simplify this part by always returning
1983 				 * empty data.
1984 				 */
1985 				sopt->sopt_valsize = 0;
1986 				break;
1987 
1988 			case IPV6_RECVHOPOPTS:
1989 			case IPV6_RECVDSTOPTS:
1990 			case IPV6_RECVRTHDRDSTOPTS:
1991 			case IPV6_UNICAST_HOPS:
1992 			case IPV6_RECVPKTINFO:
1993 			case IPV6_RECVHOPLIMIT:
1994 			case IPV6_RECVRTHDR:
1995 			case IPV6_RECVPATHMTU:
1996 
1997 			case IPV6_FAITH:
1998 			case IPV6_V6ONLY:
1999 			case IPV6_PORTRANGE:
2000 			case IPV6_RECVTCLASS:
2001 			case IPV6_AUTOFLOWLABEL:
2002 				switch (optname) {
2003 
2004 				case IPV6_RECVHOPOPTS:
2005 					optval = OPTBIT(IN6P_HOPOPTS);
2006 					break;
2007 
2008 				case IPV6_RECVDSTOPTS:
2009 					optval = OPTBIT(IN6P_DSTOPTS);
2010 					break;
2011 
2012 				case IPV6_RECVRTHDRDSTOPTS:
2013 					optval = OPTBIT(IN6P_RTHDRDSTOPTS);
2014 					break;
2015 
2016 				case IPV6_UNICAST_HOPS:
2017 					optval = in6p->in6p_hops;
2018 					break;
2019 
2020 				case IPV6_RECVPKTINFO:
2021 					optval = OPTBIT(IN6P_PKTINFO);
2022 					break;
2023 
2024 				case IPV6_RECVHOPLIMIT:
2025 					optval = OPTBIT(IN6P_HOPLIMIT);
2026 					break;
2027 
2028 				case IPV6_RECVRTHDR:
2029 					optval = OPTBIT(IN6P_RTHDR);
2030 					break;
2031 
2032 				case IPV6_RECVPATHMTU:
2033 					optval = OPTBIT(IN6P_MTU);
2034 					break;
2035 
2036 				case IPV6_FAITH:
2037 					optval = OPTBIT(IN6P_FAITH);
2038 					break;
2039 
2040 				case IPV6_V6ONLY:
2041 					optval = OPTBIT(IN6P_IPV6_V6ONLY);
2042 					break;
2043 
2044 				case IPV6_PORTRANGE:
2045 				    {
2046 					int flags;
2047 					flags = in6p->in6p_flags;
2048 					if (flags & IN6P_HIGHPORT)
2049 						optval = IPV6_PORTRANGE_HIGH;
2050 					else if (flags & IN6P_LOWPORT)
2051 						optval = IPV6_PORTRANGE_LOW;
2052 					else
2053 						optval = 0;
2054 					break;
2055 				    }
2056 				case IPV6_RECVTCLASS:
2057 					optval = OPTBIT(IN6P_TCLASS);
2058 					break;
2059 
2060 				case IPV6_AUTOFLOWLABEL:
2061 					optval = OPTBIT(IN6P_AUTOFLOWLABEL);
2062 					break;
2063 				}
2064 				if (error)
2065 					break;
2066 				error = sooptcopyout(sopt, &optval,
2067 					sizeof optval);
2068 				break;
2069 
2070 			case IPV6_PATHMTU:
2071 			{
2072 				u_long pmtu = 0;
2073 				struct ip6_mtuinfo mtuinfo;
2074 				struct route_in6 sro;
2075 
2076 				bzero(&sro, sizeof(sro));
2077 
2078 				if (!(so->so_state & SS_ISCONNECTED))
2079 					return (ENOTCONN);
2080 				/*
2081 				 * XXX: we dot not consider the case of source
2082 				 * routing, or optional information to specify
2083 				 * the outgoing interface.
2084 				 */
2085 				error = ip6_getpmtu(&sro, NULL, NULL,
2086 				    &in6p->in6p_faddr, &pmtu, NULL);
2087 				if (sro.ro_rt)
2088 					RTFREE(sro.ro_rt);
2089 				if (error)
2090 					break;
2091 				if (pmtu > IPV6_MAXPACKET)
2092 					pmtu = IPV6_MAXPACKET;
2093 
2094 				bzero(&mtuinfo, sizeof(mtuinfo));
2095 				mtuinfo.ip6m_mtu = (u_int32_t)pmtu;
2096 				optdata = (void *)&mtuinfo;
2097 				optdatalen = sizeof(mtuinfo);
2098 				error = sooptcopyout(sopt, optdata,
2099 				    optdatalen);
2100 				break;
2101 			}
2102 
2103 			case IPV6_2292PKTINFO:
2104 			case IPV6_2292HOPLIMIT:
2105 			case IPV6_2292HOPOPTS:
2106 			case IPV6_2292RTHDR:
2107 			case IPV6_2292DSTOPTS:
2108 				switch (optname) {
2109 				case IPV6_2292PKTINFO:
2110 					optval = OPTBIT(IN6P_PKTINFO);
2111 					break;
2112 				case IPV6_2292HOPLIMIT:
2113 					optval = OPTBIT(IN6P_HOPLIMIT);
2114 					break;
2115 				case IPV6_2292HOPOPTS:
2116 					optval = OPTBIT(IN6P_HOPOPTS);
2117 					break;
2118 				case IPV6_2292RTHDR:
2119 					optval = OPTBIT(IN6P_RTHDR);
2120 					break;
2121 				case IPV6_2292DSTOPTS:
2122 					optval = OPTBIT(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS);
2123 					break;
2124 				}
2125 				error = sooptcopyout(sopt, &optval,
2126 				    sizeof optval);
2127 				break;
2128 			case IPV6_PKTINFO:
2129 			case IPV6_HOPOPTS:
2130 			case IPV6_RTHDR:
2131 			case IPV6_DSTOPTS:
2132 			case IPV6_RTHDRDSTOPTS:
2133 			case IPV6_NEXTHOP:
2134 			case IPV6_TCLASS:
2135 			case IPV6_DONTFRAG:
2136 			case IPV6_USE_MIN_MTU:
2137 			case IPV6_PREFER_TEMPADDR:
2138 				error = ip6_getpcbopt(in6p->in6p_outputopts,
2139 				    optname, sopt);
2140 				break;
2141 
2142 			case IPV6_MULTICAST_IF:
2143 			case IPV6_MULTICAST_HOPS:
2144 			case IPV6_MULTICAST_LOOP:
2145 			case IPV6_JOIN_GROUP:
2146 			case IPV6_LEAVE_GROUP:
2147 			    {
2148 				struct mbuf *m;
2149 				error = ip6_getmoptions(sopt->sopt_name,
2150 				    in6p->in6p_moptions, &m);
2151 				if (error == 0)
2152 					error = sooptcopyout(sopt,
2153 					    mtod(m, char *), m->m_len);
2154 				m_freem(m);
2155 			    }
2156 				break;
2157 
2158 #if defined(IPSEC) || defined(FAST_IPSEC)
2159 			case IPV6_IPSEC_POLICY:
2160 			  {
2161 				caddr_t req = NULL;
2162 				size_t len = 0;
2163 				struct mbuf *m = NULL;
2164 				struct mbuf **mp = &m;
2165 				size_t ovalsize = sopt->sopt_valsize;
2166 				caddr_t oval = (caddr_t)sopt->sopt_val;
2167 
2168 				error = soopt_getm(sopt, &m); /* XXX */
2169 				if (error != 0)
2170 					break;
2171 				error = soopt_mcopyin(sopt, m); /* XXX */
2172 				if (error != 0)
2173 					break;
2174 				sopt->sopt_valsize = ovalsize;
2175 				sopt->sopt_val = oval;
2176 				if (m) {
2177 					req = mtod(m, caddr_t);
2178 					len = m->m_len;
2179 				}
2180 				error = ipsec6_get_policy(in6p, req, len, mp);
2181 				if (error == 0)
2182 					error = soopt_mcopyout(sopt, m); /* XXX */
2183 				if (error == 0 && m)
2184 					m_freem(m);
2185 				break;
2186 			  }
2187 #endif /* KAME IPSEC */
2188 
2189 			case IPV6_FW_GET:
2190 			  {
2191 				struct mbuf *m;
2192 				struct mbuf **mp = &m;
2193 
2194 				if (ip6_fw_ctl_ptr == NULL)
2195 			        {
2196 					return EINVAL;
2197 				}
2198 				error = (*ip6_fw_ctl_ptr)(optname, mp);
2199 				if (error == 0)
2200 					error = soopt_mcopyout(sopt, m); /* XXX */
2201 				if (error == 0 && m)
2202 					m_freem(m);
2203 			  }
2204 				break;
2205 
2206 			default:
2207 				error = ENOPROTOOPT;
2208 				break;
2209 			}
2210 			break;
2211 		}
2212 	} else {		/* level != IPPROTO_IPV6 */
2213 		error = EINVAL;
2214 	}
2215 	return (error);
2216 }
2217 
2218 int
2219 ip6_raw_ctloutput(so, sopt)
2220 	struct socket *so;
2221 	struct sockopt *sopt;
2222 {
2223 	int error = 0, optval, optlen;
2224 	const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
2225 	struct in6pcb *in6p = sotoin6pcb(so);
2226 	int level, op, optname;
2227 
2228 	if (sopt) {
2229 		level = sopt->sopt_level;
2230 		op = sopt->sopt_dir;
2231 		optname = sopt->sopt_name;
2232 		optlen = sopt->sopt_valsize;
2233 	} else
2234 		panic("ip6_raw_ctloutput: arg soopt is NULL");
2235 
2236 	if (level != IPPROTO_IPV6) {
2237 		return (EINVAL);
2238 	}
2239 
2240 	switch (optname) {
2241 	case IPV6_CHECKSUM:
2242 		/*
2243 		 * For ICMPv6 sockets, no modification allowed for checksum
2244 		 * offset, permit "no change" values to help existing apps.
2245 		 *
2246 		 * XXX 2292bis says: "An attempt to set IPV6_CHECKSUM
2247 		 * for an ICMPv6 socket will fail."
2248 		 * The current behavior does not meet 2292bis.
2249 		 */
2250 		switch (op) {
2251 		case SOPT_SET:
2252 			if (optlen != sizeof(int)) {
2253 				error = EINVAL;
2254 				break;
2255 			}
2256 			error = sooptcopyin(sopt, &optval, sizeof(optval),
2257 					    sizeof(optval));
2258 			if (error)
2259 				break;
2260 			if ((optval % 2) != 0) {
2261 				/* the API assumes even offset values */
2262 				error = EINVAL;
2263 			} else if (so->so_proto->pr_protocol ==
2264 			    IPPROTO_ICMPV6) {
2265 				if (optval != icmp6off)
2266 					error = EINVAL;
2267 			} else
2268 				in6p->in6p_cksum = optval;
2269 			break;
2270 
2271 		case SOPT_GET:
2272 			if (so->so_proto->pr_protocol == IPPROTO_ICMPV6)
2273 				optval = icmp6off;
2274 			else
2275 				optval = in6p->in6p_cksum;
2276 
2277 			error = sooptcopyout(sopt, &optval, sizeof(optval));
2278 			break;
2279 
2280 		default:
2281 			error = EINVAL;
2282 			break;
2283 		}
2284 		break;
2285 
2286 	default:
2287 		error = ENOPROTOOPT;
2288 		break;
2289 	}
2290 
2291 	return (error);
2292 }
2293 
2294 /*
2295  * Set up IP6 options in pcb for insertion in output packets or
2296  * specifying behavior of outgoing packets.
2297  */
2298 static int
2299 ip6_pcbopts(pktopt, m, so, sopt)
2300 	struct ip6_pktopts **pktopt;
2301 	struct mbuf *m;
2302 	struct socket *so;
2303 	struct sockopt *sopt;
2304 {
2305 	struct ip6_pktopts *opt = *pktopt;
2306 	int error = 0;
2307 	struct thread *td = sopt->sopt_td;
2308 	int priv = 0;
2309 
2310 	/* turn off any old options. */
2311 	if (opt) {
2312 #ifdef DIAGNOSTIC
2313 		if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
2314 		    opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
2315 		    opt->ip6po_rhinfo.ip6po_rhi_rthdr)
2316 			printf("ip6_pcbopts: all specified options are cleared.\n");
2317 #endif
2318 		ip6_clearpktopts(opt, -1);
2319 	} else
2320 		opt = malloc(sizeof(*opt), M_IP6OPT, M_WAITOK);
2321 	*pktopt = NULL;
2322 
2323 	if (!m || m->m_len == 0) {
2324 		/*
2325 		 * Only turning off any previous options, regardless of
2326 		 * whether the opt is just created or given.
2327 		 */
2328 		free(opt, M_IP6OPT);
2329 		return (0);
2330 	}
2331 
2332 	/*  set options specified by user. */
2333 	if (td && !suser(td))
2334 		priv = 1;
2335 	if ((error = ip6_setpktoptions(m, opt, NULL, priv, 1,
2336 	    so->so_proto->pr_protocol)) != 0) {
2337 		ip6_clearpktopts(opt, -1); /* XXX: discard all options */
2338 		free(opt, M_IP6OPT);
2339 		return (error);
2340 	}
2341 	*pktopt = opt;
2342 	return (0);
2343 }
2344 
2345 /*
2346  * initialize ip6_pktopts.  beware that there are non-zero default values in
2347  * the struct.
2348  */
2349 void
2350 init_ip6pktopts(opt)
2351 	struct ip6_pktopts *opt;
2352 {
2353 
2354 	bzero(opt, sizeof(*opt));
2355 	opt->ip6po_hlim = -1;	/* -1 means default hop limit */
2356 	opt->ip6po_tclass = -1;	/* -1 means default traffic class */
2357 	opt->ip6po_minmtu = IP6PO_MINMTU_MCASTONLY;
2358 	opt->ip6po_prefer_tempaddr = IP6PO_TEMPADDR_SYSTEM;
2359 }
2360 
2361 static int
2362 ip6_pcbopt(optname, buf, len, pktopt, priv, uproto)
2363 	int optname, len, priv;
2364 	u_char *buf;
2365 	struct ip6_pktopts **pktopt;
2366 	int uproto;
2367 {
2368 	struct ip6_pktopts *opt;
2369 
2370 	if (*pktopt == NULL) {
2371 		*pktopt = malloc(sizeof(struct ip6_pktopts), M_IP6OPT,
2372 		    M_WAITOK);
2373 		init_ip6pktopts(*pktopt);
2374 		(*pktopt)->needfree = 1;
2375 	}
2376 	opt = *pktopt;
2377 
2378 	return (ip6_setpktoption(optname, buf, len, opt, priv, 1, 0, uproto));
2379 }
2380 
2381 static int
2382 ip6_getpcbopt(pktopt, optname, sopt)
2383 	struct ip6_pktopts *pktopt;
2384 	struct sockopt *sopt;
2385 	int optname;
2386 {
2387 	void *optdata = NULL;
2388 	int optdatalen = 0;
2389 	struct ip6_ext *ip6e;
2390 	int error = 0;
2391 	struct in6_pktinfo null_pktinfo;
2392 	int deftclass = 0, on;
2393 	int defminmtu = IP6PO_MINMTU_MCASTONLY;
2394 	int defpreftemp = IP6PO_TEMPADDR_SYSTEM;
2395 
2396 	switch (optname) {
2397 	case IPV6_PKTINFO:
2398 		if (pktopt && pktopt->ip6po_pktinfo)
2399 			optdata = (void *)pktopt->ip6po_pktinfo;
2400 		else {
2401 			/* XXX: we don't have to do this every time... */
2402 			bzero(&null_pktinfo, sizeof(null_pktinfo));
2403 			optdata = (void *)&null_pktinfo;
2404 		}
2405 		optdatalen = sizeof(struct in6_pktinfo);
2406 		break;
2407 	case IPV6_TCLASS:
2408 		if (pktopt && pktopt->ip6po_tclass >= 0)
2409 			optdata = (void *)&pktopt->ip6po_tclass;
2410 		else
2411 			optdata = (void *)&deftclass;
2412 		optdatalen = sizeof(int);
2413 		break;
2414 	case IPV6_HOPOPTS:
2415 		if (pktopt && pktopt->ip6po_hbh) {
2416 			optdata = (void *)pktopt->ip6po_hbh;
2417 			ip6e = (struct ip6_ext *)pktopt->ip6po_hbh;
2418 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2419 		}
2420 		break;
2421 	case IPV6_RTHDR:
2422 		if (pktopt && pktopt->ip6po_rthdr) {
2423 			optdata = (void *)pktopt->ip6po_rthdr;
2424 			ip6e = (struct ip6_ext *)pktopt->ip6po_rthdr;
2425 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2426 		}
2427 		break;
2428 	case IPV6_RTHDRDSTOPTS:
2429 		if (pktopt && pktopt->ip6po_dest1) {
2430 			optdata = (void *)pktopt->ip6po_dest1;
2431 			ip6e = (struct ip6_ext *)pktopt->ip6po_dest1;
2432 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2433 		}
2434 		break;
2435 	case IPV6_DSTOPTS:
2436 		if (pktopt && pktopt->ip6po_dest2) {
2437 			optdata = (void *)pktopt->ip6po_dest2;
2438 			ip6e = (struct ip6_ext *)pktopt->ip6po_dest2;
2439 			optdatalen = (ip6e->ip6e_len + 1) << 3;
2440 		}
2441 		break;
2442 	case IPV6_NEXTHOP:
2443 		if (pktopt && pktopt->ip6po_nexthop) {
2444 			optdata = (void *)pktopt->ip6po_nexthop;
2445 			optdatalen = pktopt->ip6po_nexthop->sa_len;
2446 		}
2447 		break;
2448 	case IPV6_USE_MIN_MTU:
2449 		if (pktopt)
2450 			optdata = (void *)&pktopt->ip6po_minmtu;
2451 		else
2452 			optdata = (void *)&defminmtu;
2453 		optdatalen = sizeof(int);
2454 		break;
2455 	case IPV6_DONTFRAG:
2456 		if (pktopt && ((pktopt->ip6po_flags) & IP6PO_DONTFRAG))
2457 			on = 1;
2458 		else
2459 			on = 0;
2460 		optdata = (void *)&on;
2461 		optdatalen = sizeof(on);
2462 		break;
2463 	case IPV6_PREFER_TEMPADDR:
2464 		if (pktopt)
2465 			optdata = (void *)&pktopt->ip6po_prefer_tempaddr;
2466 		else
2467 			optdata = (void *)&defpreftemp;
2468 		optdatalen = sizeof(int);
2469 		break;
2470 	default:		/* should not happen */
2471 #ifdef DIAGNOSTIC
2472 		panic("ip6_getpcbopt: unexpected option\n");
2473 #endif
2474 		return (ENOPROTOOPT);
2475 	}
2476 
2477 	error = sooptcopyout(sopt, optdata, optdatalen);
2478 
2479 	return (error);
2480 }
2481 
2482 void
2483 ip6_clearpktopts(pktopt, optname)
2484 	struct ip6_pktopts *pktopt;
2485 	int optname;
2486 {
2487 	int needfree;
2488 
2489 	if (pktopt == NULL)
2490 		return;
2491 
2492 	needfree = pktopt->needfree;
2493 
2494 	if (optname == -1 || optname == IPV6_PKTINFO) {
2495 		if (needfree && pktopt->ip6po_pktinfo)
2496 			free(pktopt->ip6po_pktinfo, M_IP6OPT);
2497 		pktopt->ip6po_pktinfo = NULL;
2498 	}
2499 	if (optname == -1 || optname == IPV6_HOPLIMIT)
2500 		pktopt->ip6po_hlim = -1;
2501 	if (optname == -1 || optname == IPV6_TCLASS)
2502 		pktopt->ip6po_tclass = -1;
2503 	if (optname == -1 || optname == IPV6_NEXTHOP) {
2504 		if (pktopt->ip6po_nextroute.ro_rt) {
2505 			RTFREE(pktopt->ip6po_nextroute.ro_rt);
2506 			pktopt->ip6po_nextroute.ro_rt = NULL;
2507 		}
2508 		if (needfree && pktopt->ip6po_nexthop)
2509 			free(pktopt->ip6po_nexthop, M_IP6OPT);
2510 		pktopt->ip6po_nexthop = NULL;
2511 	}
2512 	if (optname == -1 || optname == IPV6_HOPOPTS) {
2513 		if (needfree && pktopt->ip6po_hbh)
2514 			free(pktopt->ip6po_hbh, M_IP6OPT);
2515 		pktopt->ip6po_hbh = NULL;
2516 	}
2517 	if (optname == -1 || optname == IPV6_RTHDRDSTOPTS) {
2518 		if (needfree && pktopt->ip6po_dest1)
2519 			free(pktopt->ip6po_dest1, M_IP6OPT);
2520 		pktopt->ip6po_dest1 = NULL;
2521 	}
2522 	if (optname == -1 || optname == IPV6_RTHDR) {
2523 		if (needfree && pktopt->ip6po_rhinfo.ip6po_rhi_rthdr)
2524 			free(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr, M_IP6OPT);
2525 		pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
2526 		if (pktopt->ip6po_route.ro_rt) {
2527 			RTFREE(pktopt->ip6po_route.ro_rt);
2528 			pktopt->ip6po_route.ro_rt = NULL;
2529 		}
2530 	}
2531 	if (optname == -1 || optname == IPV6_DSTOPTS) {
2532 		if (needfree && pktopt->ip6po_dest2)
2533 			free(pktopt->ip6po_dest2, M_IP6OPT);
2534 		pktopt->ip6po_dest2 = NULL;
2535 	}
2536 }
2537 
2538 #define PKTOPT_EXTHDRCPY(type) \
2539 do {\
2540 	if (src->type) {\
2541 		int hlen = (((struct ip6_ext *)src->type)->ip6e_len + 1) << 3;\
2542 		dst->type = malloc(hlen, M_IP6OPT, canwait);\
2543 		if (dst->type == NULL && canwait == M_NOWAIT)\
2544 			goto bad;\
2545 		bcopy(src->type, dst->type, hlen);\
2546 	}\
2547 } while (/*CONSTCOND*/ 0)
2548 
2549 struct ip6_pktopts *
2550 ip6_copypktopts(src, canwait)
2551 	struct ip6_pktopts *src;
2552 	int canwait;
2553 {
2554 	struct ip6_pktopts *dst;
2555 
2556 	if (src == NULL) {
2557 		printf("ip6_clearpktopts: invalid argument\n");
2558 		return (NULL);
2559 	}
2560 
2561 	dst = malloc(sizeof(*dst), M_IP6OPT, canwait);
2562 	if (dst == NULL && canwait == M_NOWAIT)
2563 		return (NULL);
2564 	bzero(dst, sizeof(*dst));
2565 	dst->needfree = 1;
2566 
2567 	dst->ip6po_hlim = src->ip6po_hlim;
2568 	dst->ip6po_tclass = src->ip6po_tclass;
2569 	dst->ip6po_flags = src->ip6po_flags;
2570 	if (src->ip6po_pktinfo) {
2571 		dst->ip6po_pktinfo = malloc(sizeof(*dst->ip6po_pktinfo),
2572 		    M_IP6OPT, canwait);
2573 		if (dst->ip6po_pktinfo == NULL && canwait == M_NOWAIT)
2574 			goto bad;
2575 		*dst->ip6po_pktinfo = *src->ip6po_pktinfo;
2576 	}
2577 	if (src->ip6po_nexthop) {
2578 		dst->ip6po_nexthop = malloc(src->ip6po_nexthop->sa_len,
2579 		    M_IP6OPT, canwait);
2580 		if (dst->ip6po_nexthop == NULL && canwait == M_NOWAIT)
2581 			goto bad;
2582 		bcopy(src->ip6po_nexthop, dst->ip6po_nexthop,
2583 		    src->ip6po_nexthop->sa_len);
2584 	}
2585 	PKTOPT_EXTHDRCPY(ip6po_hbh);
2586 	PKTOPT_EXTHDRCPY(ip6po_dest1);
2587 	PKTOPT_EXTHDRCPY(ip6po_dest2);
2588 	PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
2589 	return (dst);
2590 
2591   bad:
2592 	if (dst->ip6po_pktinfo) free(dst->ip6po_pktinfo, M_IP6OPT);
2593 	if (dst->ip6po_nexthop) free(dst->ip6po_nexthop, M_IP6OPT);
2594 	if (dst->ip6po_hbh) free(dst->ip6po_hbh, M_IP6OPT);
2595 	if (dst->ip6po_dest1) free(dst->ip6po_dest1, M_IP6OPT);
2596 	if (dst->ip6po_dest2) free(dst->ip6po_dest2, M_IP6OPT);
2597 	if (dst->ip6po_rthdr) free(dst->ip6po_rthdr, M_IP6OPT);
2598 	free(dst, M_IP6OPT);
2599 	return (NULL);
2600 }
2601 #undef PKTOPT_EXTHDRCPY
2602 
2603 void
2604 ip6_freepcbopts(pktopt)
2605 	struct ip6_pktopts *pktopt;
2606 {
2607 	if (pktopt == NULL)
2608 		return;
2609 
2610 	ip6_clearpktopts(pktopt, -1);
2611 
2612 	free(pktopt, M_IP6OPT);
2613 }
2614 
2615 /*
2616  * Set the IP6 multicast options in response to user setsockopt().
2617  */
2618 static int
2619 ip6_setmoptions(optname, im6op, m)
2620 	int optname;
2621 	struct ip6_moptions **im6op;
2622 	struct mbuf *m;
2623 {
2624 	int error = 0;
2625 	u_int loop, ifindex;
2626 	struct ipv6_mreq *mreq;
2627 	struct ifnet *ifp;
2628 	struct ip6_moptions *im6o = *im6op;
2629 	struct route_in6 ro;
2630 	struct sockaddr_in6 *dst;
2631 	struct in6_multi_mship *imm;
2632 	struct thread *td = curthread;
2633 
2634 	if (im6o == NULL) {
2635 		/*
2636 		 * No multicast option buffer attached to the pcb;
2637 		 * allocate one and initialize to default values.
2638 		 */
2639 		im6o = (struct ip6_moptions *)
2640 			malloc(sizeof(*im6o), M_IPMOPTS, M_WAITOK);
2641 
2642 		if (im6o == NULL)
2643 			return (ENOBUFS);
2644 		*im6op = im6o;
2645 		im6o->im6o_multicast_ifp = NULL;
2646 		im6o->im6o_multicast_hlim = ip6_defmcasthlim;
2647 		im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
2648 		LIST_INIT(&im6o->im6o_memberships);
2649 	}
2650 
2651 	switch (optname) {
2652 
2653 	case IPV6_MULTICAST_IF:
2654 		/*
2655 		 * Select the interface for outgoing multicast packets.
2656 		 */
2657 		if (m == NULL || m->m_len != sizeof(u_int)) {
2658 			error = EINVAL;
2659 			break;
2660 		}
2661 		bcopy(mtod(m, u_int *), &ifindex, sizeof(ifindex));
2662 		if (ifindex < 0 || if_index < ifindex) {
2663 			error = ENXIO;	/* XXX EINVAL? */
2664 			break;
2665 		}
2666 		ifp = ifnet_byindex(ifindex);
2667 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2668 			error = EADDRNOTAVAIL;
2669 			break;
2670 		}
2671 		im6o->im6o_multicast_ifp = ifp;
2672 		break;
2673 
2674 	case IPV6_MULTICAST_HOPS:
2675 	    {
2676 		/*
2677 		 * Set the IP6 hoplimit for outgoing multicast packets.
2678 		 */
2679 		int optval;
2680 		if (m == NULL || m->m_len != sizeof(int)) {
2681 			error = EINVAL;
2682 			break;
2683 		}
2684 		bcopy(mtod(m, u_int *), &optval, sizeof(optval));
2685 		if (optval < -1 || optval >= 256)
2686 			error = EINVAL;
2687 		else if (optval == -1)
2688 			im6o->im6o_multicast_hlim = ip6_defmcasthlim;
2689 		else
2690 			im6o->im6o_multicast_hlim = optval;
2691 		break;
2692 	    }
2693 
2694 	case IPV6_MULTICAST_LOOP:
2695 		/*
2696 		 * Set the loopback flag for outgoing multicast packets.
2697 		 * Must be zero or one.
2698 		 */
2699 		if (m == NULL || m->m_len != sizeof(u_int)) {
2700 			error = EINVAL;
2701 			break;
2702 		}
2703 		bcopy(mtod(m, u_int *), &loop, sizeof(loop));
2704 		if (loop > 1) {
2705 			error = EINVAL;
2706 			break;
2707 		}
2708 		im6o->im6o_multicast_loop = loop;
2709 		break;
2710 
2711 	case IPV6_JOIN_GROUP:
2712 		/*
2713 		 * Add a multicast group membership.
2714 		 * Group must be a valid IP6 multicast address.
2715 		 */
2716 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
2717 			error = EINVAL;
2718 			break;
2719 		}
2720 		mreq = mtod(m, struct ipv6_mreq *);
2721 		if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
2722 			/*
2723 			 * We use the unspecified address to specify to accept
2724 			 * all multicast addresses. Only super user is allowed
2725 			 * to do this.
2726 			 */
2727 			if (suser(td)) {
2728 				error = EACCES;
2729 				break;
2730 			}
2731 		} else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
2732 			error = EINVAL;
2733 			break;
2734 		}
2735 
2736 		/*
2737 		 * If the interface is specified, validate it.
2738 		 */
2739 		if (mreq->ipv6mr_interface < 0 ||
2740 		    if_index < mreq->ipv6mr_interface) {
2741 			error = ENXIO;	/* XXX EINVAL? */
2742 			break;
2743 		}
2744 		/*
2745 		 * If no interface was explicitly specified, choose an
2746 		 * appropriate one according to the given multicast address.
2747 		 */
2748 		if (mreq->ipv6mr_interface == 0) {
2749 			/*
2750 			 * If the multicast address is in node-local scope,
2751 			 * the interface should be a loopback interface.
2752 			 * Otherwise, look up the routing table for the
2753 			 * address, and choose the outgoing interface.
2754 			 *   XXX: is it a good approach?
2755 			 */
2756 			if (IN6_IS_ADDR_MC_INTFACELOCAL(&mreq->ipv6mr_multiaddr)) {
2757 				ifp = &loif[0];
2758 			} else {
2759 				ro.ro_rt = NULL;
2760 				dst = (struct sockaddr_in6 *)&ro.ro_dst;
2761 				bzero(dst, sizeof(*dst));
2762 				dst->sin6_len = sizeof(struct sockaddr_in6);
2763 				dst->sin6_family = AF_INET6;
2764 				dst->sin6_addr = mreq->ipv6mr_multiaddr;
2765 				rtalloc((struct route *)&ro);
2766 				if (ro.ro_rt == NULL) {
2767 					error = EADDRNOTAVAIL;
2768 					break;
2769 				}
2770 				ifp = ro.ro_rt->rt_ifp;
2771 				RTFREE(ro.ro_rt);
2772 			}
2773 		} else
2774 			ifp = ifnet_byindex(mreq->ipv6mr_interface);
2775 
2776 		/*
2777 		 * See if we found an interface, and confirm that it
2778 		 * supports multicast
2779 		 */
2780 		if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2781 			error = EADDRNOTAVAIL;
2782 			break;
2783 		}
2784 		/*
2785 		 * Put interface index into the multicast address,
2786 		 * if the address has link-local scope.
2787 		 */
2788 		if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
2789 			mreq->ipv6mr_multiaddr.s6_addr16[1] =
2790 			    htons(ifp->if_index);
2791 		}
2792 		/*
2793 		 * See if the membership already exists.
2794 		 */
2795 		for (imm = im6o->im6o_memberships.lh_first;
2796 		     imm != NULL; imm = imm->i6mm_chain.le_next)
2797 			if (imm->i6mm_maddr->in6m_ifp == ifp &&
2798 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2799 					       &mreq->ipv6mr_multiaddr))
2800 				break;
2801 		if (imm != NULL) {
2802 			error = EADDRINUSE;
2803 			break;
2804 		}
2805 		/*
2806 		 * Everything looks good; add a new record to the multicast
2807 		 * address list for the given interface.
2808 		 */
2809 		imm = malloc(sizeof(*imm), M_IPMADDR, M_WAITOK);
2810 		if (imm == NULL) {
2811 			error = ENOBUFS;
2812 			break;
2813 		}
2814 		if ((imm->i6mm_maddr =
2815 		     in6_addmulti(&mreq->ipv6mr_multiaddr, ifp, &error)) == NULL) {
2816 			free(imm, M_IPMADDR);
2817 			break;
2818 		}
2819 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
2820 		break;
2821 
2822 	case IPV6_LEAVE_GROUP:
2823 		/*
2824 		 * Drop a multicast group membership.
2825 		 * Group must be a valid IP6 multicast address.
2826 		 */
2827 		if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
2828 			error = EINVAL;
2829 			break;
2830 		}
2831 		mreq = mtod(m, struct ipv6_mreq *);
2832 		if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
2833 			if (suser(td)) {
2834 				error = EACCES;
2835 				break;
2836 			}
2837 		} else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
2838 			error = EINVAL;
2839 			break;
2840 		}
2841 		/*
2842 		 * If an interface address was specified, get a pointer
2843 		 * to its ifnet structure.
2844 		 */
2845 		if (mreq->ipv6mr_interface < 0
2846 		 || if_index < mreq->ipv6mr_interface) {
2847 			error = ENXIO;	/* XXX EINVAL? */
2848 			break;
2849 		}
2850 		ifp = ifnet_byindex(mreq->ipv6mr_interface);
2851 		/*
2852 		 * Put interface index into the multicast address,
2853 		 * if the address has link-local scope.
2854 		 */
2855 		if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
2856 			mreq->ipv6mr_multiaddr.s6_addr16[1]
2857 				= htons(mreq->ipv6mr_interface);
2858 		}
2859 
2860 		/*
2861 		 * Find the membership in the membership list.
2862 		 */
2863 		for (imm = im6o->im6o_memberships.lh_first;
2864 		     imm != NULL; imm = imm->i6mm_chain.le_next) {
2865 			if ((ifp == NULL || imm->i6mm_maddr->in6m_ifp == ifp) &&
2866 			    IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2867 			    &mreq->ipv6mr_multiaddr))
2868 				break;
2869 		}
2870 		if (imm == NULL) {
2871 			/* Unable to resolve interface */
2872 			error = EADDRNOTAVAIL;
2873 			break;
2874 		}
2875 		/*
2876 		 * Give up the multicast address record to which the
2877 		 * membership points.
2878 		 */
2879 		LIST_REMOVE(imm, i6mm_chain);
2880 		in6_delmulti(imm->i6mm_maddr);
2881 		free(imm, M_IPMADDR);
2882 		break;
2883 
2884 	default:
2885 		error = EOPNOTSUPP;
2886 		break;
2887 	}
2888 
2889 	/*
2890 	 * If all options have default values, no need to keep the mbuf.
2891 	 */
2892 	if (im6o->im6o_multicast_ifp == NULL &&
2893 	    im6o->im6o_multicast_hlim == ip6_defmcasthlim &&
2894 	    im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
2895 	    im6o->im6o_memberships.lh_first == NULL) {
2896 		free(*im6op, M_IPMOPTS);
2897 		*im6op = NULL;
2898 	}
2899 
2900 	return (error);
2901 }
2902 
2903 /*
2904  * Return the IP6 multicast options in response to user getsockopt().
2905  */
2906 static int
2907 ip6_getmoptions(optname, im6o, mp)
2908 	int optname;
2909 	struct ip6_moptions *im6o;
2910 	struct mbuf **mp;
2911 {
2912 	u_int *hlim, *loop, *ifindex;
2913 
2914 	*mp = m_get(M_TRYWAIT, MT_HEADER);		/* XXX */
2915 
2916 	switch (optname) {
2917 
2918 	case IPV6_MULTICAST_IF:
2919 		ifindex = mtod(*mp, u_int *);
2920 		(*mp)->m_len = sizeof(u_int);
2921 		if (im6o == NULL || im6o->im6o_multicast_ifp == NULL)
2922 			*ifindex = 0;
2923 		else
2924 			*ifindex = im6o->im6o_multicast_ifp->if_index;
2925 		return (0);
2926 
2927 	case IPV6_MULTICAST_HOPS:
2928 		hlim = mtod(*mp, u_int *);
2929 		(*mp)->m_len = sizeof(u_int);
2930 		if (im6o == NULL)
2931 			*hlim = ip6_defmcasthlim;
2932 		else
2933 			*hlim = im6o->im6o_multicast_hlim;
2934 		return (0);
2935 
2936 	case IPV6_MULTICAST_LOOP:
2937 		loop = mtod(*mp, u_int *);
2938 		(*mp)->m_len = sizeof(u_int);
2939 		if (im6o == NULL)
2940 			*loop = ip6_defmcasthlim;
2941 		else
2942 			*loop = im6o->im6o_multicast_loop;
2943 		return (0);
2944 
2945 	default:
2946 		return (EOPNOTSUPP);
2947 	}
2948 }
2949 
2950 /*
2951  * Discard the IP6 multicast options.
2952  */
2953 void
2954 ip6_freemoptions(im6o)
2955 	struct ip6_moptions *im6o;
2956 {
2957 	struct in6_multi_mship *imm;
2958 
2959 	if (im6o == NULL)
2960 		return;
2961 
2962 	while ((imm = im6o->im6o_memberships.lh_first) != NULL) {
2963 		LIST_REMOVE(imm, i6mm_chain);
2964 		if (imm->i6mm_maddr)
2965 			in6_delmulti(imm->i6mm_maddr);
2966 		free(imm, M_IPMADDR);
2967 	}
2968 	free(im6o, M_IPMOPTS);
2969 }
2970 
2971 /*
2972  * Set IPv6 outgoing packet options based on advanced API.
2973  */
2974 int
2975 ip6_setpktoptions(control, opt, stickyopt, priv, needcopy, uproto)
2976 	struct mbuf *control;
2977 	struct ip6_pktopts *opt, *stickyopt;
2978 	int priv, needcopy, uproto;
2979 {
2980 	struct cmsghdr *cm = 0;
2981 
2982 	if (control == 0 || opt == 0)
2983 		return (EINVAL);
2984 
2985 	if (stickyopt) {
2986 		/*
2987 		 * If stickyopt is provided, make a local copy of the options
2988 		 * for this particular packet, then override them by ancillary
2989 		 * objects.
2990 		 * XXX: need to gain a reference for the cached route of the
2991 		 * next hop in case of the overriding.
2992 		 */
2993 		*opt = *stickyopt;
2994 		if (opt->ip6po_nextroute.ro_rt) {
2995 			RT_LOCK(opt->ip6po_nextroute.ro_rt);
2996 			RT_ADDREF(opt->ip6po_nextroute.ro_rt);
2997 			RT_UNLOCK(opt->ip6po_nextroute.ro_rt);
2998 		}
2999 	} else
3000 		init_ip6pktopts(opt);
3001 	opt->needfree = needcopy;
3002 
3003 	/*
3004 	 * XXX: Currently, we assume all the optional information is stored
3005 	 * in a single mbuf.
3006 	 */
3007 	if (control->m_next)
3008 		return (EINVAL);
3009 
3010 	for (; control->m_len; control->m_data += CMSG_ALIGN(cm->cmsg_len),
3011 	    control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
3012 		int error;
3013 
3014 		if (control->m_len < CMSG_LEN(0))
3015 			return (EINVAL);
3016 
3017 		cm = mtod(control, struct cmsghdr *);
3018 		if (cm->cmsg_len == 0 || cm->cmsg_len > control->m_len)
3019 			return (EINVAL);
3020 		if (cm->cmsg_level != IPPROTO_IPV6)
3021 			continue;
3022 
3023 		error = ip6_setpktoption(cm->cmsg_type, CMSG_DATA(cm),
3024 		    cm->cmsg_len - CMSG_LEN(0), opt, priv, needcopy, 1, uproto);
3025 		if (error)
3026 			return (error);
3027 	}
3028 
3029 	return (0);
3030 }
3031 
3032 /*
3033  * Set a particular packet option, as a sticky option or an ancillary data
3034  * item.  "len" can be 0 only when it's a sticky option.
3035  * We have 4 cases of combination of "sticky" and "cmsg":
3036  * "sticky=0, cmsg=0": impossible
3037  * "sticky=0, cmsg=1": RFC2292 or rfc2292bis ancillary data
3038  * "sticky=1, cmsg=0": rfc2292bis socket option
3039  * "sticky=1, cmsg=1": RFC2292 socket option
3040  */
3041 static int
3042 ip6_setpktoption(optname, buf, len, opt, priv, sticky, cmsg, uproto)
3043 	int optname, len, priv, sticky, cmsg, uproto;
3044 	u_char *buf;
3045 	struct ip6_pktopts *opt;
3046 {
3047 	int minmtupolicy, preftemp;
3048 
3049 	if (!sticky && !cmsg) {
3050 #ifdef DIAGNOSTIC
3051 		printf("ip6_setpktoption: impossible case\n");
3052 #endif
3053 		return (EINVAL);
3054 	}
3055 
3056 	/*
3057 	 * IPV6_2292xxx is for backward compatibility to RFC2292, and should
3058 	 * not be specified in the context of rfc2292bis.  Conversely,
3059 	 * rfc2292bis types should not be specified in the context of RFC2292.
3060 	 */
3061 	if (!cmsg) {
3062 		switch (optname) {
3063 		case IPV6_2292PKTINFO:
3064 		case IPV6_2292HOPLIMIT:
3065 		case IPV6_2292NEXTHOP:
3066 		case IPV6_2292HOPOPTS:
3067 		case IPV6_2292DSTOPTS:
3068 		case IPV6_2292RTHDR:
3069 		case IPV6_2292PKTOPTIONS:
3070 			return (ENOPROTOOPT);
3071 		}
3072 	}
3073 	if (sticky && cmsg) {
3074 		switch (optname) {
3075 		case IPV6_PKTINFO:
3076 		case IPV6_HOPLIMIT:
3077 		case IPV6_NEXTHOP:
3078 		case IPV6_HOPOPTS:
3079 		case IPV6_DSTOPTS:
3080 		case IPV6_RTHDRDSTOPTS:
3081 		case IPV6_RTHDR:
3082 		case IPV6_USE_MIN_MTU:
3083 		case IPV6_DONTFRAG:
3084 		case IPV6_TCLASS:
3085 		case IPV6_PREFER_TEMPADDR: /* XXX: not an rfc2292bis option */
3086 			return (ENOPROTOOPT);
3087 		}
3088 	}
3089 
3090 	switch (optname) {
3091 	case IPV6_2292PKTINFO:
3092 	case IPV6_PKTINFO:
3093 	{
3094 		struct ifnet *ifp = NULL;
3095 		struct in6_pktinfo *pktinfo;
3096 
3097 		if (len != sizeof(struct in6_pktinfo))
3098 			return (EINVAL);
3099 
3100 		pktinfo = (struct in6_pktinfo *)buf;
3101 
3102 		/*
3103 		 * An application can clear any sticky IPV6_PKTINFO option by
3104 		 * doing a "regular" setsockopt with ipi6_addr being
3105 		 * in6addr_any and ipi6_ifindex being zero.
3106 		 * [RFC 3542, Section 6]
3107 		 */
3108 		if (optname == IPV6_PKTINFO && opt->ip6po_pktinfo &&
3109 		    pktinfo->ipi6_ifindex == 0 &&
3110 		    IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
3111 			ip6_clearpktopts(opt, optname);
3112 			break;
3113 		}
3114 
3115 		if (uproto == IPPROTO_TCP && optname == IPV6_PKTINFO &&
3116 		    sticky && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
3117 			return (EINVAL);
3118 		}
3119 
3120 		/* validate the interface index if specified. */
3121 		if (pktinfo->ipi6_ifindex > if_index ||
3122 		    pktinfo->ipi6_ifindex < 0) {
3123 			 return (ENXIO);
3124 		}
3125 		if (pktinfo->ipi6_ifindex) {
3126 			ifp = ifnet_byindex(pktinfo->ipi6_ifindex);
3127 			if (ifp == NULL)
3128 				return (ENXIO);
3129 		}
3130 
3131 		/*
3132 		 * We store the address anyway, and let in6_selectsrc()
3133 		 * validate the specified address.  This is because ipi6_addr
3134 		 * may not have enough information about its scope zone, and
3135 		 * we may need additional information (such as outgoing
3136 		 * interface or the scope zone of a destination address) to
3137 		 * disambiguate the scope.
3138 		 * XXX: the delay of the validation may confuse the
3139 		 * application when it is used as a sticky option.
3140 		 */
3141 		if (sticky) {
3142 			if (opt->ip6po_pktinfo == NULL) {
3143 				opt->ip6po_pktinfo = malloc(sizeof(*pktinfo),
3144 				    M_IP6OPT, M_WAITOK);
3145 			}
3146 			bcopy(pktinfo, opt->ip6po_pktinfo, sizeof(*pktinfo));
3147 		} else
3148 			opt->ip6po_pktinfo = pktinfo;
3149 		break;
3150 	}
3151 
3152 	case IPV6_2292HOPLIMIT:
3153 	case IPV6_HOPLIMIT:
3154 	{
3155 		int *hlimp;
3156 
3157 		/*
3158 		 * RFC 3542 deprecated the usage of sticky IPV6_HOPLIMIT
3159 		 * to simplify the ordering among hoplimit options.
3160 		 */
3161 		if (optname == IPV6_HOPLIMIT && sticky)
3162 			return (ENOPROTOOPT);
3163 
3164 		if (len != sizeof(int))
3165 			return (EINVAL);
3166 		hlimp = (int *)buf;
3167 		if (*hlimp < -1 || *hlimp > 255)
3168 			return (EINVAL);
3169 
3170 		opt->ip6po_hlim = *hlimp;
3171 		break;
3172 	}
3173 
3174 	case IPV6_TCLASS:
3175 	{
3176 		int tclass;
3177 
3178 		if (len != sizeof(int))
3179 			return (EINVAL);
3180 		tclass = *(int *)buf;
3181 		if (tclass < -1 || tclass > 255)
3182 			return (EINVAL);
3183 
3184 		opt->ip6po_tclass = tclass;
3185 		break;
3186 	}
3187 
3188 	case IPV6_2292NEXTHOP:
3189 	case IPV6_NEXTHOP:
3190 		if (!priv)
3191 			return (EPERM);
3192 
3193 		if (len == 0) {	/* just remove the option */
3194 			ip6_clearpktopts(opt, IPV6_NEXTHOP);
3195 			break;
3196 		}
3197 
3198 		/* check if cmsg_len is large enough for sa_len */
3199 		if (len < sizeof(struct sockaddr) || len < *buf)
3200 			return (EINVAL);
3201 
3202 		switch (((struct sockaddr *)buf)->sa_family) {
3203 		case AF_INET6:
3204 		{
3205 			struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)buf;
3206 #if 0
3207 			int error;
3208 #endif
3209 
3210 			if (sa6->sin6_len != sizeof(struct sockaddr_in6))
3211 				return (EINVAL);
3212 
3213 			if (IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
3214 			    IN6_IS_ADDR_MULTICAST(&sa6->sin6_addr)) {
3215 				return (EINVAL);
3216 			}
3217 #if 0
3218 			if ((error = scope6_check_id(sa6, ip6_use_defzone))
3219 			    != 0) {
3220 				return (error);
3221 			}
3222 #endif
3223 			sa6->sin6_scope_id = 0; /* XXX */
3224 			break;
3225 		}
3226 		case AF_LINK:	/* should eventually be supported */
3227 		default:
3228 			return (EAFNOSUPPORT);
3229 		}
3230 
3231 		/* turn off the previous option, then set the new option. */
3232 		ip6_clearpktopts(opt, IPV6_NEXTHOP);
3233 		if (sticky) {
3234 			opt->ip6po_nexthop = malloc(*buf, M_IP6OPT, M_WAITOK);
3235 			bcopy(buf, opt->ip6po_nexthop, *buf);
3236 		} else
3237 			opt->ip6po_nexthop = (struct sockaddr *)buf;
3238 		break;
3239 
3240 	case IPV6_2292HOPOPTS:
3241 	case IPV6_HOPOPTS:
3242 	{
3243 		struct ip6_hbh *hbh;
3244 		int hbhlen;
3245 
3246 		/*
3247 		 * XXX: We don't allow a non-privileged user to set ANY HbH
3248 		 * options, since per-option restriction has too much
3249 		 * overhead.
3250 		 */
3251 		if (!priv)
3252 			return (EPERM);
3253 
3254 		if (len == 0) {
3255 			ip6_clearpktopts(opt, IPV6_HOPOPTS);
3256 			break;	/* just remove the option */
3257 		}
3258 
3259 		/* message length validation */
3260 		if (len < sizeof(struct ip6_hbh))
3261 			return (EINVAL);
3262 		hbh = (struct ip6_hbh *)buf;
3263 		hbhlen = (hbh->ip6h_len + 1) << 3;
3264 		if (len != hbhlen)
3265 			return (EINVAL);
3266 
3267 		/* turn off the previous option, then set the new option. */
3268 		ip6_clearpktopts(opt, IPV6_HOPOPTS);
3269 		if (sticky) {
3270 			opt->ip6po_hbh = malloc(hbhlen, M_IP6OPT, M_WAITOK);
3271 			bcopy(hbh, opt->ip6po_hbh, hbhlen);
3272 		} else
3273 			opt->ip6po_hbh = hbh;
3274 
3275 		break;
3276 	}
3277 
3278 	case IPV6_2292DSTOPTS:
3279 	case IPV6_DSTOPTS:
3280 	case IPV6_RTHDRDSTOPTS:
3281 	{
3282 		struct ip6_dest *dest, **newdest = NULL;
3283 		int destlen;
3284 
3285 		if (!priv)	/* XXX: see the comment for IPV6_HOPOPTS */
3286 			return (EPERM);
3287 
3288 		if (len == 0) {
3289 			ip6_clearpktopts(opt, optname);
3290 			break;	/* just remove the option */
3291 		}
3292 
3293 		/* message length validation */
3294 		if (len < sizeof(struct ip6_dest))
3295 			return (EINVAL);
3296 		dest = (struct ip6_dest *)buf;
3297 		destlen = (dest->ip6d_len + 1) << 3;
3298 		if (len != destlen)
3299 			return (EINVAL);
3300 
3301 		/*
3302 		 * Determine the position that the destination options header
3303 		 * should be inserted; before or after the routing header.
3304 		 */
3305 		switch (optname) {
3306 		case IPV6_2292DSTOPTS:
3307 			/*
3308 			 * The old advacned API is ambiguous on this point.
3309 			 * Our approach is to determine the position based
3310 			 * according to the existence of a routing header.
3311 			 * Note, however, that this depends on the order of the
3312 			 * extension headers in the ancillary data; the 1st
3313 			 * part of the destination options header must appear
3314 			 * before the routing header in the ancillary data,
3315 			 * too.
3316 			 * RFC2292bis solved the ambiguity by introducing
3317 			 * separate ancillary data or option types.
3318 			 */
3319 			if (opt->ip6po_rthdr == NULL)
3320 				newdest = &opt->ip6po_dest1;
3321 			else
3322 				newdest = &opt->ip6po_dest2;
3323 			break;
3324 		case IPV6_RTHDRDSTOPTS:
3325 			newdest = &opt->ip6po_dest1;
3326 			break;
3327 		case IPV6_DSTOPTS:
3328 			newdest = &opt->ip6po_dest2;
3329 			break;
3330 		}
3331 
3332 		/* turn off the previous option, then set the new option. */
3333 		ip6_clearpktopts(opt, optname);
3334 		if (sticky) {
3335 			*newdest = malloc(destlen, M_IP6OPT, M_WAITOK);
3336 			bcopy(dest, *newdest, destlen);
3337 		} else
3338 			*newdest = dest;
3339 
3340 		break;
3341 	}
3342 
3343 	case IPV6_2292RTHDR:
3344 	case IPV6_RTHDR:
3345 	{
3346 		struct ip6_rthdr *rth;
3347 		int rthlen;
3348 
3349 		if (len == 0) {
3350 			ip6_clearpktopts(opt, IPV6_RTHDR);
3351 			break;	/* just remove the option */
3352 		}
3353 
3354 		/* message length validation */
3355 		if (len < sizeof(struct ip6_rthdr))
3356 			return (EINVAL);
3357 		rth = (struct ip6_rthdr *)buf;
3358 		rthlen = (rth->ip6r_len + 1) << 3;
3359 		if (len != rthlen)
3360 			return (EINVAL);
3361 
3362 		switch (rth->ip6r_type) {
3363 		case IPV6_RTHDR_TYPE_0:
3364 			if (rth->ip6r_len == 0)	/* must contain one addr */
3365 				return (EINVAL);
3366 			if (rth->ip6r_len % 2) /* length must be even */
3367 				return (EINVAL);
3368 			if (rth->ip6r_len / 2 != rth->ip6r_segleft)
3369 				return (EINVAL);
3370 			break;
3371 		default:
3372 			return (EINVAL);	/* not supported */
3373 		}
3374 
3375 		/* turn off the previous option */
3376 		ip6_clearpktopts(opt, IPV6_RTHDR);
3377 		if (sticky) {
3378 			opt->ip6po_rthdr = malloc(rthlen, M_IP6OPT, M_WAITOK);
3379 			bcopy(rth, opt->ip6po_rthdr, rthlen);
3380 		} else
3381 			opt->ip6po_rthdr = rth;
3382 
3383 		break;
3384 	}
3385 
3386 	case IPV6_USE_MIN_MTU:
3387 		if (len != sizeof(int))
3388 			return (EINVAL);
3389 		minmtupolicy = *(int *)buf;
3390 		if (minmtupolicy != IP6PO_MINMTU_MCASTONLY &&
3391 		    minmtupolicy != IP6PO_MINMTU_DISABLE &&
3392 		    minmtupolicy != IP6PO_MINMTU_ALL) {
3393 			return (EINVAL);
3394 		}
3395 		opt->ip6po_minmtu = minmtupolicy;
3396 		break;
3397 
3398 	case IPV6_DONTFRAG:
3399 		if (len != sizeof(int))
3400 			return (EINVAL);
3401 
3402 		if (uproto == IPPROTO_TCP || *(int *)buf == 0) {
3403 			/*
3404 			 * we ignore this option for TCP sockets.
3405 			 * (rfc2292bis leaves this case unspecified.)
3406 			 */
3407 			opt->ip6po_flags &= ~IP6PO_DONTFRAG;
3408 		} else
3409 			opt->ip6po_flags |= IP6PO_DONTFRAG;
3410 		break;
3411 
3412 	case IPV6_PREFER_TEMPADDR:
3413 		if (len != sizeof(int))
3414 			return (EINVAL);
3415 		preftemp = *(int *)buf;
3416 		if (preftemp != IP6PO_TEMPADDR_SYSTEM &&
3417 		    preftemp != IP6PO_TEMPADDR_NOTPREFER &&
3418 		    preftemp != IP6PO_TEMPADDR_PREFER) {
3419 			return (EINVAL);
3420 		}
3421 		opt->ip6po_prefer_tempaddr = preftemp;
3422 		break;
3423 
3424 	default:
3425 		return (ENOPROTOOPT);
3426 	} /* end of switch */
3427 
3428 	return (0);
3429 }
3430 
3431 /*
3432  * Routine called from ip6_output() to loop back a copy of an IP6 multicast
3433  * packet to the input queue of a specified interface.  Note that this
3434  * calls the output routine of the loopback "driver", but with an interface
3435  * pointer that might NOT be &loif -- easier than replicating that code here.
3436  */
3437 void
3438 ip6_mloopback(ifp, m, dst)
3439 	struct ifnet *ifp;
3440 	struct mbuf *m;
3441 	struct sockaddr_in6 *dst;
3442 {
3443 	struct mbuf *copym;
3444 	struct ip6_hdr *ip6;
3445 
3446 	copym = m_copy(m, 0, M_COPYALL);
3447 	if (copym == NULL)
3448 		return;
3449 
3450 	/*
3451 	 * Make sure to deep-copy IPv6 header portion in case the data
3452 	 * is in an mbuf cluster, so that we can safely override the IPv6
3453 	 * header portion later.
3454 	 */
3455 	if ((copym->m_flags & M_EXT) != 0 ||
3456 	    copym->m_len < sizeof(struct ip6_hdr)) {
3457 		copym = m_pullup(copym, sizeof(struct ip6_hdr));
3458 		if (copym == NULL)
3459 			return;
3460 	}
3461 
3462 #ifdef DIAGNOSTIC
3463 	if (copym->m_len < sizeof(*ip6)) {
3464 		m_freem(copym);
3465 		return;
3466 	}
3467 #endif
3468 
3469 	ip6 = mtod(copym, struct ip6_hdr *);
3470 	/*
3471 	 * clear embedded scope identifiers if necessary.
3472 	 * in6_clearscope will touch the addresses only when necessary.
3473 	 */
3474 	in6_clearscope(&ip6->ip6_src);
3475 	in6_clearscope(&ip6->ip6_dst);
3476 
3477 	(void)if_simloop(ifp, copym, dst->sin6_family, 0);
3478 }
3479 
3480 /*
3481  * Chop IPv6 header off from the payload.
3482  */
3483 static int
3484 ip6_splithdr(m, exthdrs)
3485 	struct mbuf *m;
3486 	struct ip6_exthdrs *exthdrs;
3487 {
3488 	struct mbuf *mh;
3489 	struct ip6_hdr *ip6;
3490 
3491 	ip6 = mtod(m, struct ip6_hdr *);
3492 	if (m->m_len > sizeof(*ip6)) {
3493 		MGETHDR(mh, M_DONTWAIT, MT_HEADER);
3494 		if (mh == 0) {
3495 			m_freem(m);
3496 			return ENOBUFS;
3497 		}
3498 		M_MOVE_PKTHDR(mh, m);
3499 		MH_ALIGN(mh, sizeof(*ip6));
3500 		m->m_len -= sizeof(*ip6);
3501 		m->m_data += sizeof(*ip6);
3502 		mh->m_next = m;
3503 		m = mh;
3504 		m->m_len = sizeof(*ip6);
3505 		bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof(*ip6));
3506 	}
3507 	exthdrs->ip6e_ip6 = m;
3508 	return 0;
3509 }
3510 
3511 /*
3512  * Compute IPv6 extension header length.
3513  */
3514 int
3515 ip6_optlen(in6p)
3516 	struct in6pcb *in6p;
3517 {
3518 	int len;
3519 
3520 	if (!in6p->in6p_outputopts)
3521 		return 0;
3522 
3523 	len = 0;
3524 #define elen(x) \
3525     (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
3526 
3527 	len += elen(in6p->in6p_outputopts->ip6po_hbh);
3528 	if (in6p->in6p_outputopts->ip6po_rthdr)
3529 		/* dest1 is valid with rthdr only */
3530 		len += elen(in6p->in6p_outputopts->ip6po_dest1);
3531 	len += elen(in6p->in6p_outputopts->ip6po_rthdr);
3532 	len += elen(in6p->in6p_outputopts->ip6po_dest2);
3533 	return len;
3534 #undef elen
3535 }
3536