bsd/netinet6/mld6.c

   1 /*
   2  * Copyright (c) 2008 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 /*      $FreeBSD: src/sys/netinet6/mld6.c,v 1.4.2.2 2001/07/03 11:01:54 ume Exp $       */
  30 /*      $KAME: mld6.c,v 1.27 2001/04/04 05:17:30 itojun Exp $   */
  31
  32 /*
  33  * Copyright (C) 1998 WIDE Project.
  34  * All rights reserved.
  35  *
  36  * Redistribution and use in source and binary forms, with or without
  37  * modification, are permitted provided that the following conditions
  38  * are met:
  39  * 1. Redistributions of source code must retain the above copyright
  40  *    notice, this list of conditions and the following disclaimer.
  41  * 2. Redistributions in binary form must reproduce the above copyright
  42  *    notice, this list of conditions and the following disclaimer in the
  43  *    documentation and/or other materials provided with the distribution.
  44  * 3. Neither the name of the project nor the names of its contributors
  45  *    may be used to endorse or promote products derived from this software
  46  *    without specific prior written permission.
  47  *
  48  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  58  * SUCH DAMAGE.
  59  */
  60
  61 /*
  62  * Copyright (c) 1988 Stephen Deering.
  63  * Copyright (c) 1992, 1993
  64  *      The Regents of the University of California.  All rights reserved.
  65  *
  66  * This code is derived from software contributed to Berkeley by
  67  * Stephen Deering of Stanford University.
  68  *
  69  * Redistribution and use in source and binary forms, with or without
  70  * modification, are permitted provided that the following conditions
  71  * are met:
  72  * 1. Redistributions of source code must retain the above copyright
  73  *    notice, this list of conditions and the following disclaimer.
  74  * 2. Redistributions in binary form must reproduce the above copyright
  75  *    notice, this list of conditions and the following disclaimer in the
  76  *    documentation and/or other materials provided with the distribution.
  77  * 3. All advertising materials mentioning features or use of this software
  78  *    must display the following acknowledgement:
  79  *      This product includes software developed by the University of
  80  *      California, Berkeley and its contributors.
  81  * 4. Neither the name of the University nor the names of its contributors
  82  *    may be used to endorse or promote products derived from this software
  83  *    without specific prior written permission.
  84  *
  85  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  86  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  87  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  88  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  89  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  90  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  91  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  92  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  93  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  94  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  95  * SUCH DAMAGE.
  96  *
  97  *      @(#)igmp.c      8.1 (Berkeley) 7/19/93
  98  */
  99 /*
 100  * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
 101  * support for mandatory and extensible security protections.  This notice
 102  * is included in support of clause 2.2 (b) of the Apple Public License,
 103  * Version 2.0.
 104  */
 105
 106 #include <sys/param.h>
 107 #include <sys/systm.h>
 108 #include <sys/mbuf.h>
 109 #include <sys/socket.h>
 110 #include <sys/protosw.h>
 111 #include <sys/syslog.h>
 112
 113 #include <net/if.h>
 114
 115 #include <netinet/in.h>
 116 #include <netinet/in_var.h>
 117 #include <netinet/ip6.h>
 118 #include <netinet6/ip6_var.h>
 119 #include <netinet/icmp6.h>
 120 #include <netinet6/mld6_var.h>
 121
 122 #include <net/net_osdep.h>
 123
 124 #if CONFIG_MACF_NET
 125 #include <security/mac.h>
 126 #endif /* MAC_NET */
 127
 128 /*
 129  * Protocol constants
 130  */
 131
 132 /* denotes that the MLD max response delay field specifies time in milliseconds */
 133 #define MLD6_TIMER_SCALE        1000
 134 /*
 135  * time between repetitions of a node's initial report of interest in a
 136  * multicast address(in seconds)
 137  */
 138 #define MLD6_UNSOLICITED_REPORT_INTERVAL        10
 139
 140 extern lck_mtx_t *nd6_mutex;
 141 static struct ip6_pktopts ip6_opts;
 142 static int mld6_timers_are_running;
 143 static int mld6_init_done = 0 ;
 144 /* XXX: These are necessary for KAME's link-local hack */
 145 static struct in6_addr mld6_all_nodes_linklocal = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
 146 static struct in6_addr mld6_all_routers_linklocal = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
 147
 148 static void mld6_sendpkt(struct in6_multi *, int, const struct in6_addr *);
 149
 150 void
 151 mld6_init()
 152 {
 153         static u_int8_t hbh_buf[8];
 154         struct ip6_hbh *hbh = (struct ip6_hbh *)hbh_buf;
 155         u_int16_t rtalert_code = htons((u_int16_t)IP6OPT_RTALERT_MLD);
 156
 157         if (mld6_init_done)
 158                 return;
 159
 160         mld6_init_done = 1;
 161         mld6_timers_are_running = 0;
 162
 163         /* ip6h_nxt will be fill in later */
 164         hbh->ip6h_len = 0;      /* (8 >> 3) - 1 */
 165
 166         /* XXX: grotty hard coding... */
 167         hbh_buf[2] = IP6OPT_PADN;       /* 2 byte padding */
 168         hbh_buf[3] = 0;
 169         hbh_buf[4] = IP6OPT_RTALERT;
 170         hbh_buf[5] = IP6OPT_RTALERT_LEN - 2;
 171         bcopy((caddr_t)&rtalert_code, &hbh_buf[6], sizeof(u_int16_t));
 172
 173         ip6_initpktopts(&ip6_opts);
 174         ip6_opts.ip6po_hbh = hbh;
 175 }
 176
 177 void
 178 mld6_start_listening(
 179         struct in6_multi *in6m)
 180 {
 181         /*
 182          * RFC2710 page 10:
 183          * The node never sends a Report or Done for the link-scope all-nodes
 184          * address.
 185          * MLD messages are never sent for multicast addresses whose scope is 0
 186          * (reserved) or 1 (node-local).
 187          */
 188         mld6_all_nodes_linklocal.s6_addr16[1] =
 189                 htons(in6m->in6m_ifp->if_index); /* XXX */
 190         if (IN6_ARE_ADDR_EQUAL(&in6m->in6m_addr, &mld6_all_nodes_linklocal) ||
 191             IPV6_ADDR_MC_SCOPE(&in6m->in6m_addr) < IPV6_ADDR_SCOPE_LINKLOCAL) {
 192                 in6m->in6m_timer = 0;
 193                 in6m->in6m_state = MLD6_OTHERLISTENER;
 194         } else {
 195                 mld6_sendpkt(in6m, MLD6_LISTENER_REPORT, NULL);
 196                 in6m->in6m_timer = MLD6_RANDOM_DELAY(
 197                         MLD6_UNSOLICITED_REPORT_INTERVAL * PR_FASTHZ);
 198                 in6m->in6m_state = MLD6_IREPORTEDLAST;
 199                 mld6_timers_are_running = 1;
 200         }
 201 }
 202
 203 void
 204 mld6_stop_listening(
 205         struct in6_multi *in6m)
 206 {
 207         mld6_all_nodes_linklocal.s6_addr16[1] =
 208                 htons(in6m->in6m_ifp->if_index); /* XXX */
 209         mld6_all_routers_linklocal.s6_addr16[1] =
 210                 htons(in6m->in6m_ifp->if_index); /* XXX: necessary when mrouting */
 211
 212         if (in6m->in6m_state == MLD6_IREPORTEDLAST &&
 213             (!IN6_ARE_ADDR_EQUAL(&in6m->in6m_addr, &mld6_all_nodes_linklocal)) &&
 214             IPV6_ADDR_MC_SCOPE(&in6m->in6m_addr) > IPV6_ADDR_SCOPE_NODELOCAL)
 215                 mld6_sendpkt(in6m, MLD6_LISTENER_DONE,
 216                              &mld6_all_routers_linklocal);
 217 }
 218
 219 void
 220 mld6_input(
 221         struct mbuf *m,
 222         int off)
 223 {
 224         struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
 225         struct mld6_hdr *mldh;
 226         struct ifnet *ifp = m->m_pkthdr.rcvif;
 227         struct in6_multi *in6m;
 228         struct in6_ifaddr *ia;
 229         struct ifmultiaddr *ifma;
 230         int timer;              /* timer value in the MLD query header */
 231
 232 #ifndef PULLDOWN_TEST
 233         IP6_EXTHDR_CHECK(m, off, sizeof(*mldh), return);
 234         mldh = (struct mld6_hdr *)(mtod(m, caddr_t) + off);
 235 #else
 236         IP6_EXTHDR_GET(mldh, struct mld6_hdr *, m, off, sizeof(*mldh));
 237         if (mldh == NULL) {
 238                 icmp6stat.icp6s_tooshort++;
 239                 return;
 240         }
 241 #endif
 242
 243         /* source address validation */
 244         ip6 = mtod(m, struct ip6_hdr *);/* in case mpullup */
 245         if (!IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src)) {
 246                 log(LOG_ERR,
 247                     "mld6_input: src %s is not link-local (grp=%s)\n",
 248                     ip6_sprintf(&ip6->ip6_src),
 249                     ip6_sprintf(&mldh->mld6_addr));
 250                 /*
 251                  * spec (RFC2710) does not explicitly
 252                  * specify to discard the packet from a non link-local
 253                  * source address. But we believe it's expected to do so.
 254                  * XXX: do we have to allow :: as source?
 255                  */
 256                 m_freem(m);
 257                 return;
 258         }
 259
 260         /*
 261          * In the MLD6 specification, there are 3 states and a flag.
 262          *
 263          * In Non-Listener state, we simply don't have a membership record.
 264          * In Delaying Listener state, our timer is running (in6m->in6m_timer)
 265          * In Idle Listener state, our timer is not running (in6m->in6m_timer==0)
 266          *
 267          * The flag is in6m->in6m_state, it is set to MLD6_OTHERLISTENER if
 268          * we have heard a report from another member, or MLD6_IREPORTEDLAST
 269          * if we sent the last report.
 270          */
 271         switch(mldh->mld6_type) {
 272         case MLD6_LISTENER_QUERY:
 273                 if (ifp->if_flags & IFF_LOOPBACK)
 274                         break;
 275
 276                 if (!IN6_IS_ADDR_UNSPECIFIED(&mldh->mld6_addr) &&
 277                     !IN6_IS_ADDR_MULTICAST(&mldh->mld6_addr))
 278                         break;  /* print error or log stat? */
 279                 if (IN6_IS_ADDR_MC_LINKLOCAL(&mldh->mld6_addr))
 280                         mldh->mld6_addr.s6_addr16[1] =
 281                                 htons(ifp->if_index); /* XXX */
 282
 283                 /*
 284                  * - Start the timers in all of our membership records
 285                  *   that the query applies to for the interface on
 286                  *   which the query arrived excl. those that belong
 287                  *   to the "all-nodes" group (ff02::1).
 288                  * - Restart any timer that is already running but has
 289                  *   A value longer than the requested timeout.
 290                  * - Use the value specified in the query message as
 291                  *   the maximum timeout.
 292                  */
 293                 ifnet_lock_exclusive(ifp);
 294                 IFP_TO_IA6(ifp, ia);
 295                 if (ia == NULL)
 296                         break;
 297
 298                 /*
 299                  * XXX: System timer resolution is too low to handle Max
 300                  * Response Delay, so set 1 to the internal timer even if
 301                  * the calculated value equals to zero when Max Response
 302                  * Delay is positive.
 303                  */
 304                 timer = ntohs(mldh->mld6_maxdelay)*PR_FASTHZ/MLD6_TIMER_SCALE;
 305                 if (timer == 0 && mldh->mld6_maxdelay)
 306                         timer = 1;
 307                 mld6_all_nodes_linklocal.s6_addr16[1] =
 308                         htons(ifp->if_index); /* XXX */
 309
 310                 LIST_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link)
 311                 {
 312                         if (ifma->ifma_addr->sa_family != AF_INET6)
 313                                 continue;
 314                         in6m = (struct in6_multi *)ifma->ifma_protospec;
 315                         if (IN6_ARE_ADDR_EQUAL(&in6m->in6m_addr,
 316                                         &mld6_all_nodes_linklocal) ||
 317                             IPV6_ADDR_MC_SCOPE(&in6m->in6m_addr) <
 318                             IPV6_ADDR_SCOPE_LINKLOCAL)
 319                                 continue;
 320
 321                         if (IN6_IS_ADDR_UNSPECIFIED(&mldh->mld6_addr) ||
 322                             IN6_ARE_ADDR_EQUAL(&mldh->mld6_addr,
 323                                                 &in6m->in6m_addr))
 324                         {
 325                                 if (timer == 0) {
 326                                         /* send a report immediately */
 327                                         mld6_sendpkt(in6m, MLD6_LISTENER_REPORT,
 328                                                 NULL);
 329                                         in6m->in6m_timer = 0; /* reset timer */
 330                                         in6m->in6m_state = MLD6_IREPORTEDLAST;
 331                                 }
 332                                 else if (in6m->in6m_timer == 0 || /*idle state*/
 333                                         in6m->in6m_timer > timer) {
 334                                         in6m->in6m_timer =
 335                                                 MLD6_RANDOM_DELAY(timer);
 336                                         mld6_timers_are_running = 1;
 337                                 }
 338                         }
 339                 }
 340                 ifnet_lock_done(ifp);
 341
 342                 if (IN6_IS_ADDR_MC_LINKLOCAL(&mldh->mld6_addr))
 343                         mldh->mld6_addr.s6_addr16[1] = 0; /* XXX */
 344                 break;
 345         case MLD6_LISTENER_REPORT:
 346                 /*
 347                  * For fast leave to work, we have to know that we are the
 348                  * last person to send a report for this group.  Reports
 349                  * can potentially get looped back if we are a multicast
 350                  * router, so discard reports sourced by me.
 351                  * Note that it is impossible to check IFF_LOOPBACK flag of
 352                  * ifp for this purpose, since ip6_mloopback pass the physical
 353                  * interface to looutput.
 354                  */
 355                 if (m->m_flags & M_LOOP) /* XXX: grotty flag, but efficient */
 356                         break;
 357
 358                 if (!IN6_IS_ADDR_MULTICAST(&mldh->mld6_addr))
 359                         break;
 360
 361                 if (IN6_IS_ADDR_MC_LINKLOCAL(&mldh->mld6_addr))
 362                         mldh->mld6_addr.s6_addr16[1] =
 363                                 htons(ifp->if_index); /* XXX */
 364                 /*
 365                  * If we belong to the group being reported, stop
 366                  * our timer for that group.
 367                  */
 368                 ifnet_lock_shared(ifp);
 369                 IN6_LOOKUP_MULTI(mldh->mld6_addr, ifp, in6m);
 370                 if (in6m) {
 371                         in6m->in6m_timer = 0; /* transit to idle state */
 372                         in6m->in6m_state = MLD6_OTHERLISTENER; /* clear flag */
 373                 }
 374                 ifnet_lock_done(ifp);
 375
 376                 if (IN6_IS_ADDR_MC_LINKLOCAL(&mldh->mld6_addr))
 377                         mldh->mld6_addr.s6_addr16[1] = 0; /* XXX */
 378                 break;
 379         default:                /* this is impossible */
 380                 log(LOG_ERR, "mld6_input: illegal type(%d)", mldh->mld6_type);
 381                 break;
 382         }
 383
 384         m_freem(m);
 385 }
 386
 387 void
 388 mld6_fasttimeo()
 389 {
 390         struct in6_multi *in6m;
 391         struct in6_multistep step;
 392
 393         /*
 394          * Quick check to see if any work needs to be done, in order
 395          * to minimize the overhead of fasttimo processing.
 396          */
 397         if (!mld6_timers_are_running)
 398                 return;
 399
 400         lck_mtx_lock(nd6_mutex);
 401         mld6_timers_are_running = 0;
 402         IN6_FIRST_MULTI(step, in6m);
 403         while (in6m != NULL) {
 404                 if (in6m->in6m_timer == 0) {
 405                         /* do nothing */
 406                 } else if (--in6m->in6m_timer == 0) {
 407                         mld6_sendpkt(in6m, MLD6_LISTENER_REPORT, NULL);
 408                         in6m->in6m_state = MLD6_IREPORTEDLAST;
 409                 } else {
 410                         mld6_timers_are_running = 1;
 411                 }
 412                 IN6_NEXT_MULTI(step, in6m);
 413         }
 414         lck_mtx_unlock(nd6_mutex);
 415 }
 416
 417 static void
 418 mld6_sendpkt(
 419         struct in6_multi *in6m,
 420         int type,
 421         const struct in6_addr *dst)
 422 {
 423         struct mbuf *mh, *md;
 424         struct mld6_hdr *mldh;
 425         struct ip6_hdr *ip6;
 426         struct ip6_moptions im6o;
 427         struct in6_ifaddr *ia;
 428         struct ifnet *ifp = in6m->in6m_ifp;
 429         struct ifnet *outif = NULL;
 430
 431         /*
 432          * At first, find a link local address on the outgoing interface
 433          * to use as the source address of the MLD packet.
 434          */
 435         if ((ia = in6ifa_ifpforlinklocal(ifp, IN6_IFF_NOTREADY|IN6_IFF_ANYCAST))
 436             == NULL)
 437                 return;
 438
 439         /*
 440          * Allocate mbufs to store ip6 header and MLD header.
 441          * We allocate 2 mbufs and make chain in advance because
 442          * it is more convenient when inserting the hop-by-hop option later.
 443          */
 444         MGETHDR(mh, M_DONTWAIT, MT_HEADER);
 445         if (mh == NULL) {
 446                 ifafree(&ia->ia_ifa);
 447                 return;
 448         }
 449         MGET(md, M_DONTWAIT, MT_DATA);
 450         if (md == NULL) {
 451                 m_free(mh);
 452                 ifafree(&ia->ia_ifa);
 453                 return;
 454         }
 455         mh->m_next = md;
 456
 457         mh->m_pkthdr.rcvif = NULL;
 458 #ifdef __darwin8_notyet
 459 #if CONFIG_MACF_NET
 460         mac_create_mbuf_linklayer(in6m->in6m_ifp, m);
 461 #endif
 462 #endif
 463         mh->m_pkthdr.len = sizeof(struct ip6_hdr) + sizeof(struct mld6_hdr);
 464         mh->m_len = sizeof(struct ip6_hdr);
 465         MH_ALIGN(mh, sizeof(struct ip6_hdr));
 466
 467         /* fill in the ip6 header */
 468         ip6 = mtod(mh, struct ip6_hdr *);
 469         ip6->ip6_flow = 0;
 470         ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
 471         ip6->ip6_vfc |= IPV6_VERSION;
 472         /* ip6_plen will be set later */
 473         ip6->ip6_nxt = IPPROTO_ICMPV6;
 474         /* ip6_hlim will be set by im6o.im6o_multicast_hlim */
 475         ip6->ip6_src = ia->ia_addr.sin6_addr;
 476         ip6->ip6_dst = dst ? *dst : in6m->in6m_addr;
 477
 478         /* fill in the MLD header */
 479         md->m_len = sizeof(struct mld6_hdr);
 480         mldh = mtod(md, struct mld6_hdr *);
 481         mldh->mld6_type = type;
 482         mldh->mld6_code = 0;
 483         mldh->mld6_cksum = 0;
 484         /* XXX: we assume the function will not be called for query messages */
 485         mldh->mld6_maxdelay = 0;
 486         mldh->mld6_reserved = 0;
 487         mldh->mld6_addr = in6m->in6m_addr;
 488         if (IN6_IS_ADDR_MC_LINKLOCAL(&mldh->mld6_addr))
 489                 mldh->mld6_addr.s6_addr16[1] = 0; /* XXX */
 490         mldh->mld6_cksum = in6_cksum(mh, IPPROTO_ICMPV6, sizeof(struct ip6_hdr),
 491                                      sizeof(struct mld6_hdr));
 492
 493         /* construct multicast option */
 494         bzero(&im6o, sizeof(im6o));
 495         im6o.im6o_multicast_ifp = ifp;
 496         im6o.im6o_multicast_hlim = 1;
 497
 498         /*
 499          * Request loopback of the report if we are acting as a multicast
 500          * router, so that the process-level routing daemon can hear it.
 501          */
 502 #if MROUTING
 503         im6o.im6o_multicast_loop = (ip6_mrouter != NULL);
 504 #else
 505         im6o.im6o_multicast_loop = 0;
 506 #endif
 507
 508         /* increment output statictics */
 509         icmp6stat.icp6s_outhist[type]++;
 510
 511         ip6_output(mh, &ip6_opts, NULL, 0, &im6o, &outif, 0);
 512         if (outif) {
 513                 icmp6_ifstat_inc(outif, ifs6_out_msg);
 514                 switch (type) {
 515                 case MLD6_LISTENER_QUERY:
 516                         icmp6_ifstat_inc(outif, ifs6_out_mldquery);
 517                         break;
 518                 case MLD6_LISTENER_REPORT:
 519                         icmp6_ifstat_inc(outif, ifs6_out_mldreport);
 520                         break;
 521                 case MLD6_LISTENER_DONE:
 522                         icmp6_ifstat_inc(outif, ifs6_out_mlddone);
 523                         break;
 524                 }
 525         }
 526         ifafree(&ia->ia_ifa);
 527 }
 528