]> git.saurik.com Git - apple/xnu.git/blob - bsd/netinet6/ip6_output.c
projects / apple / xnu.git / blob
? search:


73a66159e4109fa15b81ef42626f1351ede9a37f
[apple/xnu.git] / bsd / netinet6 / ip6_output.c
1 /*
2 * Copyright (c) 2000-2017 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /*
30 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
31 * All rights reserved.
32 *
33 * Redistribution and use in source and binary forms, with or without
34 * modification, are permitted provided that the following conditions
35 * are met:
36 * 1. Redistributions of source code must retain the above copyright
37 * notice, this list of conditions and the following disclaimer.
38 * 2. Redistributions in binary form must reproduce the above copyright
39 * notice, this list of conditions and the following disclaimer in the
40 * documentation and/or other materials provided with the distribution.
41 * 3. Neither the name of the project nor the names of its contributors
42 * may be used to endorse or promote products derived from this software
43 * without specific prior written permission.
44 *
45 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
48 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
55 * SUCH DAMAGE.
56 */
57
58 /*
59 * Copyright (c) 1982, 1986, 1988, 1990, 1993
60 * The Regents of the University of California. All rights reserved.
61 *
62 * Redistribution and use in source and binary forms, with or without
63 * modification, are permitted provided that the following conditions
64 * are met:
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in the
69 * documentation and/or other materials provided with the distribution.
70 * 3. All advertising materials mentioning features or use of this software
71 * must display the following acknowledgement:
72 * This product includes software developed by the University of
73 * California, Berkeley and its contributors.
74 * 4. Neither the name of the University nor the names of its contributors
75 * may be used to endorse or promote products derived from this software
76 * without specific prior written permission.
77 *
78 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
79 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
80 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
81 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
82 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
83 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
84 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
85 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
86 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
87 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
88 * SUCH DAMAGE.
89 *
90 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
91 */
92 /*
93 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
94 * support for mandatory and extensible security protections. This notice
95 * is included in support of clause 2.2 (b) of the Apple Public License,
96 * Version 2.0.
97 */
98
99 #include <sys/param.h>
100 #include <sys/malloc.h>
101 #include <sys/mbuf.h>
102 #include <sys/errno.h>
103 #include <sys/protosw.h>
104 #include <sys/socket.h>
105 #include <sys/socketvar.h>
106 #include <sys/systm.h>
107 #include <sys/kernel.h>
108 #include <sys/proc.h>
109 #include <sys/kauth.h>
110 #include <sys/mcache.h>
111 #include <sys/sysctl.h>
112 #include <kern/zalloc.h>
113 #include <libkern/OSByteOrder.h>
114
115 #include <pexpert/pexpert.h>
116 #include <mach/sdt.h>
117
118 #include <net/if.h>
119 #include <net/route.h>
120 #include <net/dlil.h>
121 #include <net/net_api_stats.h>
122 #include <net/net_osdep.h>
123 #include <net/net_perf.h>
124
125 #include <netinet/in.h>
126 #include <netinet/in_var.h>
127 #include <netinet/ip_var.h>
128 #include <netinet6/in6_var.h>
129 #include <netinet/ip6.h>
130 #include <netinet/kpi_ipfilter_var.h>
131 #include <netinet/in_tclass.h>
132
133 #include <netinet6/ip6protosw.h>
134 #include <netinet/icmp6.h>
135 #include <netinet6/ip6_var.h>
136 #include <netinet/in_pcb.h>
137 #include <netinet6/nd6.h>
138 #include <netinet6/scope6_var.h>
139 #if IPSEC
140 #include <netinet6/ipsec.h>
141 #include <netinet6/ipsec6.h>
142 #include <netkey/key.h>
143 extern int ipsec_bypass;
144 #endif /* IPSEC */
145
146 #if NECP
147 #include <net/necp.h>
148 #endif /* NECP */
149
150 #if CONFIG_MACF_NET
151 #include <security/mac.h>
152 #endif /* CONFIG_MACF_NET */
153
154 #if DUMMYNET
155 #include <netinet/ip_fw.h>
156 #include <netinet/ip_dummynet.h>
157 #endif /* DUMMYNET */
158
159 #if PF
160 #include <net/pfvar.h>
161 #endif /* PF */
162
163 static int sysctl_reset_ip6_output_stats SYSCTL_HANDLER_ARGS;
164 static int sysctl_ip6_output_measure_bins SYSCTL_HANDLER_ARGS;
165 static int sysctl_ip6_output_getperf SYSCTL_HANDLER_ARGS;
166 static int ip6_copyexthdr(struct mbuf **, caddr_t, int);
167 static void ip6_out_cksum_stats(int, u_int32_t);
168 static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
169 static int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
170 struct ip6_frag **);
171 static int ip6_getpmtu(struct route_in6 *, struct route_in6 *,
172 struct ifnet *, struct in6_addr *, u_int32_t *, boolean_t *);
173 static int ip6_pcbopts(struct ip6_pktopts **, struct mbuf *, struct socket *,
174 struct sockopt *sopt);
175 static int ip6_pcbopt(int, u_char *, int, struct ip6_pktopts **, int);
176 static int ip6_getpcbopt(struct ip6_pktopts *, int, struct sockopt *);
177 static int copypktopts(struct ip6_pktopts *, struct ip6_pktopts *, int);
178 static void im6o_trace(struct ip6_moptions *, int);
179 static int ip6_setpktopt(int, u_char *, int, struct ip6_pktopts *, int,
180 int, int);
181 static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
182 static void ip6_output_checksum(struct ifnet *, uint32_t, struct mbuf *,
183 int, uint32_t, uint32_t);
184 extern int udp_ctloutput(struct socket *, struct sockopt *);
185 static int ip6_fragment_packet(struct mbuf **m,
186 struct ip6_pktopts *opt, struct ip6_exthdrs *exthdrsp, struct ifnet *ifp,
187 uint32_t mtu, boolean_t alwaysfrag, uint32_t unfragpartlen,
188 struct route_in6 *ro_pmtu, int nxt0, uint32_t optlen);
189
190 SYSCTL_DECL(_net_inet6_ip6);
191
192 static int ip6_output_measure = 0;
193 SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf,
194 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
195 &ip6_output_measure, 0, sysctl_reset_ip6_output_stats, "I", "Do time measurement");
196
197 static uint64_t ip6_output_measure_bins = 0;
198 SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf_bins,
199 CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_output_measure_bins, 0,
200 sysctl_ip6_output_measure_bins, "I",
201 "bins for chaining performance data histogram");
202
203 static net_perf_t net_perf;
204 SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf_data,
205 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
206 0, 0, sysctl_ip6_output_getperf, "S,net_perf",
207 "IP6 output performance data (struct net_perf, net/net_perf.h)");
208
209 #define IM6O_TRACE_HIST_SIZE 32 /* size of trace history */
210
211 /* For gdb */
212 __private_extern__ unsigned int im6o_trace_hist_size = IM6O_TRACE_HIST_SIZE;
213
214 struct ip6_moptions_dbg {
215 struct ip6_moptions im6o; /* ip6_moptions */
216 u_int16_t im6o_refhold_cnt; /* # of IM6O_ADDREF */
217 u_int16_t im6o_refrele_cnt; /* # of IM6O_REMREF */
218 /*
219 * Alloc and free callers.
220 */
221 ctrace_t im6o_alloc;
222 ctrace_t im6o_free;
223 /*
224 * Circular lists of IM6O_ADDREF and IM6O_REMREF callers.
225 */
226 ctrace_t im6o_refhold[IM6O_TRACE_HIST_SIZE];
227 ctrace_t im6o_refrele[IM6O_TRACE_HIST_SIZE];
228 };
229
230 #if DEBUG
231 static unsigned int im6o_debug = 1; /* debugging (enabled) */
232 #else
233 static unsigned int im6o_debug; /* debugging (disabled) */
234 #endif /* !DEBUG */
235
236 static unsigned int im6o_size; /* size of zone element */
237 static struct zone *im6o_zone; /* zone for ip6_moptions */
238
239 #define IM6O_ZONE_MAX 64 /* maximum elements in zone */
240 #define IM6O_ZONE_NAME "ip6_moptions" /* zone name */
241
242 /*
243 * ip6_output() calls ip6_output_list() to do the work
244 */
245 int
246 ip6_output(struct mbuf *m0, struct ip6_pktopts *opt,
247 struct route_in6 *ro, int flags, struct ip6_moptions *im6o,
248 struct ifnet **ifpp, struct ip6_out_args *ip6oa)
249 {
250 return ip6_output_list(m0, 0, opt, ro, flags, im6o, ifpp, ip6oa);
251 }
252
253 /*
254 * IP6 output. Each packet in mbuf chain m contains a skeletal IP6
255 * header (with pri, len, nxt, hlim, src, dst).
256 * This function may modify ver and hlim only.
257 * The mbuf chain containing the packet will be freed.
258 * The mbuf opt, if present, will not be freed.
259 *
260 * If ro is non-NULL and has valid ro->ro_rt, route lookup would be
261 * skipped and ro->ro_rt would be used. Otherwise the result of route
262 * lookup is stored in ro->ro_rt.
263 *
264 * type of "mtu": rt_rmx.rmx_mtu is u_int32_t, ifnet.ifr_mtu is int, and
265 * nd_ifinfo.linkmtu is u_int32_t. so we use u_int32_t to hold largest one,
266 * which is rt_rmx.rmx_mtu.
267 */
268 int
269 ip6_output_list(struct mbuf *m0, int packetchain, struct ip6_pktopts *opt,
270 struct route_in6 *ro, int flags, struct ip6_moptions *im6o,
271 struct ifnet **ifpp, struct ip6_out_args *ip6oa)
272 {
273 struct ip6_hdr *ip6;
274 u_char *nexthdrp;
275 struct ifnet *ifp = NULL, *origifp = NULL; /* refcnt'd */
276 struct ifnet **ifpp_save = ifpp;
277 struct mbuf *m, *mprev;
278 struct mbuf *sendchain = NULL, *sendchain_last = NULL;
279 struct mbuf *inputchain = NULL;
280 int nxt0 = 0;
281 struct route_in6 *ro_pmtu = NULL;
282 struct rtentry *rt = NULL;
283 struct sockaddr_in6 *dst = NULL, src_sa, dst_sa;
284 int error = 0;
285 struct in6_ifaddr *ia = NULL, *src_ia = NULL;
286 u_int32_t mtu = 0;
287 boolean_t alwaysfrag = FALSE;
288 u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
289 struct ip6_rthdr *rh;
290 struct in6_addr finaldst;
291 ipfilter_t inject_filter_ref;
292 struct ipf_pktopts *ippo = NULL;
293 struct flowadv *adv = NULL;
294 uint32_t pktcnt = 0;
295 uint32_t packets_processed = 0;
296 struct timeval start_tv;
297 #if DUMMYNET
298 struct m_tag *tag;
299 struct ip6_out_args saved_ip6oa;
300 struct sockaddr_in6 dst_buf;
301 #endif /* DUMMYNET */
302 #if IPSEC
303 struct socket *so = NULL;
304 struct secpolicy *sp = NULL;
305 struct route_in6 *ipsec_saved_route = NULL;
306 boolean_t needipsectun = FALSE;
307 #endif /* IPSEC */
308 #if NECP
309 necp_kernel_policy_result necp_result = 0;
310 necp_kernel_policy_result_parameter necp_result_parameter;
311 necp_kernel_policy_id necp_matched_policy_id = 0;
312 #endif /* NECP */
313 struct {
314 struct ipf_pktopts ipf_pktopts;
315 struct ip6_exthdrs exthdrs;
316 struct route_in6 ip6route;
317 #if IPSEC
318 struct ipsec_output_state ipsec_state;
319 #endif /* IPSEC */
320 #if NECP
321 struct route_in6 necp_route;
322 #endif /* NECP */
323 #if DUMMYNET
324 struct route_in6 saved_route;
325 struct route_in6 saved_ro_pmtu;
326 struct ip_fw_args args;
327 #endif /* DUMMYNET */
328 } ip6obz;
329 #define ipf_pktopts ip6obz.ipf_pktopts
330 #define exthdrs ip6obz.exthdrs
331 #define ip6route ip6obz.ip6route
332 #define ipsec_state ip6obz.ipsec_state
333 #define necp_route ip6obz.necp_route
334 #define saved_route ip6obz.saved_route
335 #define saved_ro_pmtu ip6obz.saved_ro_pmtu
336 #define args ip6obz.args
337 union {
338 struct {
339 boolean_t select_srcif : 1;
340 boolean_t hdrsplit : 1;
341 boolean_t route_selected : 1;
342 boolean_t dontfrag : 1;
343 #if IPSEC
344 boolean_t needipsec : 1;
345 boolean_t noipsec : 1;
346 #endif /* IPSEC */
347 };
348 uint32_t raw;
349 } ip6obf = { .raw = 0 };
350
351 if (ip6_output_measure)
352 net_perf_start_time(&net_perf, &start_tv);
353
354 VERIFY(m0->m_flags & M_PKTHDR);
355
356 /* zero out {saved_route, saved_ro_pmtu, ip6route, exthdrs, args} */
357 bzero(&ip6obz, sizeof (ip6obz));
358
359 #if DUMMYNET
360 if (SLIST_EMPTY(&m0->m_pkthdr.tags))
361 goto tags_done;
362
363 /* Grab info from mtags prepended to the chain */
364 if ((tag = m_tag_locate(m0, KERNEL_MODULE_TAG_ID,
365 KERNEL_TAG_TYPE_DUMMYNET, NULL)) != NULL) {
366 struct dn_pkt_tag *dn_tag;
367
368 /*
369 * ip6_output_list() cannot handle chains of packets reinjected
370 * by dummynet. The same restriction applies to
371 * ip_output_list().
372 */
373 VERIFY(0 == packetchain);
374
375 dn_tag = (struct dn_pkt_tag *)(tag+1);
376 args.fwa_pf_rule = dn_tag->dn_pf_rule;
377
378 bcopy(&dn_tag->dn_dst6, &dst_buf, sizeof (dst_buf));
379 dst = &dst_buf;
380 ifp = dn_tag->dn_ifp;
381 if (ifp != NULL)
382 ifnet_reference(ifp);
383 flags = dn_tag->dn_flags;
384 if (dn_tag->dn_flags & IPV6_OUTARGS) {
385 saved_ip6oa = dn_tag->dn_ip6oa;
386 ip6oa = &saved_ip6oa;
387 }
388
389 saved_route = dn_tag->dn_ro6;
390 ro = &saved_route;
391 saved_ro_pmtu = dn_tag->dn_ro6_pmtu;
392 ro_pmtu = &saved_ro_pmtu;
393 origifp = dn_tag->dn_origifp;
394 if (origifp != NULL)
395 ifnet_reference(origifp);
396 mtu = dn_tag->dn_mtu;
397 alwaysfrag = (dn_tag->dn_alwaysfrag != 0);
398 unfragpartlen = dn_tag->dn_unfragpartlen;
399
400 bcopy(&dn_tag->dn_exthdrs, &exthdrs, sizeof (exthdrs));
401
402 m_tag_delete(m0, tag);
403 }
404
405 tags_done:
406 #endif /* DUMMYNET */
407
408 m = m0;
409
410 #if IPSEC
411 if (ipsec_bypass == 0) {
412 so = ipsec_getsocket(m);
413 if (so != NULL) {
414 (void) ipsec_setsocket(m, NULL);
415 }
416 /* If packet is bound to an interface, check bound policies */
417 if ((flags & IPV6_OUTARGS) &&
418 (ip6oa->ip6oa_flags & IP6OAF_BOUND_IF) &&
419 ip6oa->ip6oa_boundif != IFSCOPE_NONE) {
420 /* ip6obf.noipsec is a bitfield, use temp integer */
421 int noipsec = 0;
422
423 if (ipsec6_getpolicybyinterface(m, IPSEC_DIR_OUTBOUND,
424 flags, ip6oa, &noipsec, &sp) != 0)
425 goto bad;
426
427 ip6obf.noipsec = (noipsec != 0);
428 }
429 }
430 #endif /* IPSEC */
431
432 ippo = &ipf_pktopts;
433
434 if (flags & IPV6_OUTARGS) {
435 /*
436 * In the forwarding case, only the ifscope value is used,
437 * as source interface selection doesn't take place.
438 */
439 if ((ip6obf.select_srcif = (!(flags & (IPV6_FORWARDING |
440 IPV6_UNSPECSRC | IPV6_FLAG_NOSRCIFSEL)) &&
441 (ip6oa->ip6oa_flags & IP6OAF_SELECT_SRCIF))))
442 ipf_pktopts.ippo_flags |= IPPOF_SELECT_SRCIF;
443
444 if ((ip6oa->ip6oa_flags & IP6OAF_BOUND_IF) &&
445 ip6oa->ip6oa_boundif != IFSCOPE_NONE) {
446 ipf_pktopts.ippo_flags |= (IPPOF_BOUND_IF |
447 (ip6oa->ip6oa_boundif << IPPOF_SHIFT_IFSCOPE));
448 }
449
450 if (ip6oa->ip6oa_flags & IP6OAF_BOUND_SRCADDR)
451 ipf_pktopts.ippo_flags |= IPPOF_BOUND_SRCADDR;
452 } else {
453 ip6obf.select_srcif = FALSE;
454 if (flags & IPV6_OUTARGS) {
455 ip6oa->ip6oa_boundif = IFSCOPE_NONE;
456 ip6oa->ip6oa_flags &= ~(IP6OAF_SELECT_SRCIF |
457 IP6OAF_BOUND_IF | IP6OAF_BOUND_SRCADDR);
458 }
459 }
460
461 if (flags & IPV6_OUTARGS) {
462 if (ip6oa->ip6oa_flags & IP6OAF_NO_CELLULAR)
463 ipf_pktopts.ippo_flags |= IPPOF_NO_IFT_CELLULAR;
464 if (ip6oa->ip6oa_flags & IP6OAF_NO_EXPENSIVE)
465 ipf_pktopts.ippo_flags |= IPPOF_NO_IFF_EXPENSIVE;
466 adv = &ip6oa->ip6oa_flowadv;
467 adv->code = FADV_SUCCESS;
468 ip6oa->ip6oa_retflags = 0;
469 }
470
471 /*
472 * Clear out ifpp to be filled in after determining route. ifpp_save is
473 * used to keep old value to release reference properly and dtrace
474 * ipsec tunnel traffic properly.
475 */
476 if (ifpp != NULL && *ifpp != NULL)
477 *ifpp = NULL;
478
479 #if DUMMYNET
480 if (args.fwa_pf_rule) {
481 ip6 = mtod(m, struct ip6_hdr *);
482 VERIFY(ro != NULL); /* ro == saved_route */
483 goto check_with_pf;
484 }
485 #endif /* DUMMYNET */
486
487 #if NECP
488 /*
489 * Since all packets are assumed to come from same socket, necp lookup
490 * only needs to happen once per function entry.
491 */
492 necp_matched_policy_id = necp_ip6_output_find_policy_match(m, flags,
493 (flags & IPV6_OUTARGS) ? ip6oa : NULL, &necp_result,
494 &necp_result_parameter);
495 #endif /* NECP */
496
497 /*
498 * If a chain was passed in, prepare for ther first iteration. For all
499 * other iterations, this work will be done at evaluateloop: label.
500 */
501 if (packetchain) {
502 /*
503 * Remove m from the chain during processing to avoid
504 * accidental frees on entire list.
505 */
506 inputchain = m->m_nextpkt;
507 m->m_nextpkt = NULL;
508 }
509
510 loopit:
511 packets_processed++;
512 m->m_pkthdr.pkt_flags &= ~(PKTF_LOOP|PKTF_IFAINFO);
513 ip6 = mtod(m, struct ip6_hdr *);
514 nxt0 = ip6->ip6_nxt;
515 finaldst = ip6->ip6_dst;
516 ip6obf.hdrsplit = FALSE;
517 ro_pmtu = NULL;
518
519 if (!SLIST_EMPTY(&m->m_pkthdr.tags))
520 inject_filter_ref = ipf_get_inject_filter(m);
521 else
522 inject_filter_ref = NULL;
523
524 #define MAKE_EXTHDR(hp, mp) do { \
525 if (hp != NULL) { \
526 struct ip6_ext *eh = (struct ip6_ext *)(hp); \
527 error = ip6_copyexthdr((mp), (caddr_t)(hp), \
528 ((eh)->ip6e_len + 1) << 3); \
529 if (error) \
530 goto freehdrs; \
531 } \
532 } while (0)
533
534 if (opt != NULL) {
535 /* Hop-by-Hop options header */
536 MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
537 /* Destination options header(1st part) */
538 if (opt->ip6po_rthdr) {
539 /*
540 * Destination options header(1st part)
541 * This only makes sense with a routing header.
542 * See Section 9.2 of RFC 3542.
543 * Disabling this part just for MIP6 convenience is
544 * a bad idea. We need to think carefully about a
545 * way to make the advanced API coexist with MIP6
546 * options, which might automatically be inserted in
547 * the kernel.
548 */
549 MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
550 }
551 /* Routing header */
552 MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
553 /* Destination options header(2nd part) */
554 MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
555 }
556
557 #undef MAKE_EXTHDR
558
559 #if NECP
560 if (necp_matched_policy_id) {
561 necp_mark_packet_from_ip(m, necp_matched_policy_id);
562
563 switch (necp_result) {
564 case NECP_KERNEL_POLICY_RESULT_PASS:
565 goto skip_ipsec;
566 case NECP_KERNEL_POLICY_RESULT_DROP:
567 case NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT:
568 /*
569 * Flow divert packets should be blocked at the IP
570 * layer.
571 */
572 error = EHOSTUNREACH;
573 ip6stat.ip6s_necp_policy_drop++;
574 goto freehdrs;
575 case NECP_KERNEL_POLICY_RESULT_IP_TUNNEL: {
576 /*
577 * Verify that the packet is being routed to the tunnel
578 */
579 struct ifnet *policy_ifp =
580 necp_get_ifnet_from_result_parameter(
581 &necp_result_parameter);
582
583 if (policy_ifp == ifp) {
584 goto skip_ipsec;
585 } else {
586 if (necp_packet_can_rebind_to_ifnet(m,
587 policy_ifp, (struct route *)&necp_route,
588 AF_INET6)) {
589 /*
590 * Set scoped index to the tunnel
591 * interface, since it is compatible
592 * with the packet. This will only work
593 * for callers who pass IPV6_OUTARGS,
594 * but that covers all of the clients
595 * we care about today.
596 */
597 if (flags & IPV6_OUTARGS) {
598 ip6oa->ip6oa_boundif =
599 policy_ifp->if_index;
600 ip6oa->ip6oa_flags |=
601 IP6OAF_BOUND_IF;
602 }
603 if (opt != NULL
604 && opt->ip6po_pktinfo != NULL) {
605 opt->ip6po_pktinfo->
606 ipi6_ifindex =
607 policy_ifp->if_index;
608 }
609 ro = &necp_route;
610 goto skip_ipsec;
611 } else {
612 error = ENETUNREACH;
613 ip6stat.ip6s_necp_policy_drop++;
614 goto freehdrs;
615 }
616 }
617 }
618 default:
619 break;
620 }
621 }
622 #endif /* NECP */
623
624 #if IPSEC
625 if (ipsec_bypass != 0 || ip6obf.noipsec)
626 goto skip_ipsec;
627
628 if (sp == NULL) {
629 /* get a security policy for this packet */
630 if (so != NULL) {
631 sp = ipsec6_getpolicybysock(m, IPSEC_DIR_OUTBOUND,
632 so, &error);
633 } else {
634 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND,
635 0, &error);
636 }
637 if (sp == NULL) {
638 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
639 goto freehdrs;
640 }
641 }
642
643 error = 0;
644
645 /* check policy */
646 switch (sp->policy) {
647 case IPSEC_POLICY_DISCARD:
648 case IPSEC_POLICY_GENERATE:
649 /*
650 * This packet is just discarded.
651 */
652 IPSEC_STAT_INCREMENT(ipsec6stat.out_polvio);
653 goto freehdrs;
654
655 case IPSEC_POLICY_BYPASS:
656 case IPSEC_POLICY_NONE:
657 /* no need to do IPsec. */
658 ip6obf.needipsec = FALSE;
659 break;
660
661 case IPSEC_POLICY_IPSEC:
662 if (sp->req == NULL) {
663 /* acquire a policy */
664 error = key_spdacquire(sp);
665 goto freehdrs;
666 }
667 if (sp->ipsec_if) {
668 goto skip_ipsec;
669 } else {
670 ip6obf.needipsec = TRUE;
671 }
672 break;
673
674 case IPSEC_POLICY_ENTRUST:
675 default:
676 printf("%s: Invalid policy found: %d\n", __func__, sp->policy);
677 break;
678 }
679 skip_ipsec:
680 #endif /* IPSEC */
681
682 /*
683 * Calculate the total length of the extension header chain.
684 * Keep the length of the unfragmentable part for fragmentation.
685 */
686 optlen = 0;
687 if (exthdrs.ip6e_hbh != NULL)
688 optlen += exthdrs.ip6e_hbh->m_len;
689 if (exthdrs.ip6e_dest1 != NULL)
690 optlen += exthdrs.ip6e_dest1->m_len;
691 if (exthdrs.ip6e_rthdr != NULL)
692 optlen += exthdrs.ip6e_rthdr->m_len;
693 unfragpartlen = optlen + sizeof (struct ip6_hdr);
694
695 /* NOTE: we don't add AH/ESP length here. do that later. */
696 if (exthdrs.ip6e_dest2 != NULL)
697 optlen += exthdrs.ip6e_dest2->m_len;
698
699 /*
700 * If we need IPsec, or there is at least one extension header,
701 * separate IP6 header from the payload.
702 */
703 if ((
704 #if IPSEC
705 ip6obf.needipsec ||
706 #endif /* IPSEC */
707 optlen) && !ip6obf.hdrsplit) {
708 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
709 m = NULL;
710 goto freehdrs;
711 }
712 m = exthdrs.ip6e_ip6;
713 ip6obf.hdrsplit = TRUE;
714 }
715
716 /* adjust pointer */
717 ip6 = mtod(m, struct ip6_hdr *);
718
719 /* adjust mbuf packet header length */
720 m->m_pkthdr.len += optlen;
721 plen = m->m_pkthdr.len - sizeof (*ip6);
722
723 /* If this is a jumbo payload, insert a jumbo payload option. */
724 if (plen > IPV6_MAXPACKET) {
725 if (!ip6obf.hdrsplit) {
726 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
727 m = NULL;
728 goto freehdrs;
729 }
730 m = exthdrs.ip6e_ip6;
731 ip6obf.hdrsplit = TRUE;
732 }
733 /* adjust pointer */
734 ip6 = mtod(m, struct ip6_hdr *);
735 if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
736 goto freehdrs;
737 ip6->ip6_plen = 0;
738 } else {
739 ip6->ip6_plen = htons(plen);
740 }
741 /*
742 * Concatenate headers and fill in next header fields.
743 * Here we have, on "m"
744 * IPv6 payload
745 * and we insert headers accordingly. Finally, we should be getting:
746 * IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
747 *
748 * during the header composing process, "m" points to IPv6 header.
749 * "mprev" points to an extension header prior to esp.
750 */
751 nexthdrp = &ip6->ip6_nxt;
752 mprev = m;
753
754 /*
755 * we treat dest2 specially. this makes IPsec processing
756 * much easier. the goal here is to make mprev point the
757 * mbuf prior to dest2.
758 *
759 * result: IPv6 dest2 payload
760 * m and mprev will point to IPv6 header.
761 */
762 if (exthdrs.ip6e_dest2 != NULL) {
763 if (!ip6obf.hdrsplit) {
764 panic("assumption failed: hdr not split");
765 /* NOTREACHED */
766 }
767 exthdrs.ip6e_dest2->m_next = m->m_next;
768 m->m_next = exthdrs.ip6e_dest2;
769 *mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
770 ip6->ip6_nxt = IPPROTO_DSTOPTS;
771 }
772
773 #define MAKE_CHAIN(m, mp, p, i) do { \
774 if (m != NULL) { \
775 if (!ip6obf.hdrsplit) { \
776 panic("assumption failed: hdr not split"); \
777 /* NOTREACHED */ \
778 } \
779 *mtod((m), u_char *) = *(p); \
780 *(p) = (i); \
781 p = mtod((m), u_char *); \
782 (m)->m_next = (mp)->m_next; \
783 (mp)->m_next = (m); \
784 (mp) = (m); \
785 } \
786 } while (0)
787 /*
788 * result: IPv6 hbh dest1 rthdr dest2 payload
789 * m will point to IPv6 header. mprev will point to the
790 * extension header prior to dest2 (rthdr in the above case).
791 */
792 MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
793 MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp, IPPROTO_DSTOPTS);
794 MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp, IPPROTO_ROUTING);
795
796 /* It is no longer safe to free the pointers in exthdrs. */
797 exthdrs.merged = TRUE;
798
799 #undef MAKE_CHAIN
800
801 #if IPSEC
802 if (ip6obf.needipsec && (m->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA))
803 in6_delayed_cksum_offset(m, 0, optlen, nxt0);
804 #endif /* IPSEC */
805
806 if (!TAILQ_EMPTY(&ipv6_filters) &&
807 !((flags & IPV6_OUTARGS) &&
808 (ip6oa->ip6oa_flags & IP6OAF_INTCOPROC_ALLOWED))) {
809 struct ipfilter *filter;
810 int seen = (inject_filter_ref == NULL);
811 int fixscope = 0;
812
813 if (im6o != NULL && IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
814 ippo->ippo_flags |= IPPOF_MCAST_OPTS;
815 IM6O_LOCK(im6o);
816 ippo->ippo_mcast_ifnet = im6o->im6o_multicast_ifp;
817 ippo->ippo_mcast_ttl = im6o->im6o_multicast_hlim;
818 ippo->ippo_mcast_loop = im6o->im6o_multicast_loop;
819 IM6O_UNLOCK(im6o);
820 }
821
822 /* Hack: embed the scope_id in the destination */
823 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) &&
824 (ip6->ip6_dst.s6_addr16[1] == 0) && (ro != NULL)) {
825 fixscope = 1;
826 ip6->ip6_dst.s6_addr16[1] =
827 htons(ro->ro_dst.sin6_scope_id);
828 }
829
830 ipf_ref();
831 TAILQ_FOREACH(filter, &ipv6_filters, ipf_link) {
832 /*
833 * Don't process packet twice if we've already seen it.
834 */
835 if (seen == 0) {
836 if ((struct ipfilter *)inject_filter_ref ==
837 filter)
838 seen = 1;
839 } else if (filter->ipf_filter.ipf_output != NULL) {
840 errno_t result;
841
842 result = filter->ipf_filter.ipf_output(
843 filter->ipf_filter.cookie,
844 (mbuf_t *)&m, ippo);
845 if (result == EJUSTRETURN) {
846 ipf_unref();
847 m = NULL;
848 goto evaluateloop;
849 }
850 if (result != 0) {
851 ipf_unref();
852 goto bad;
853 }
854 }
855 }
856 ipf_unref();
857
858 ip6 = mtod(m, struct ip6_hdr *);
859 /* Hack: cleanup embedded scope_id if we put it there */
860 if (fixscope)
861 ip6->ip6_dst.s6_addr16[1] = 0;
862 }
863
864 #if IPSEC
865 if (ip6obf.needipsec) {
866 int segleft_org;
867
868 /*
869 * pointers after IPsec headers are not valid any more.
870 * other pointers need a great care too.
871 * (IPsec routines should not mangle mbufs prior to AH/ESP)
872 */
873 exthdrs.ip6e_dest2 = NULL;
874
875 if (exthdrs.ip6e_rthdr != NULL) {
876 rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
877 segleft_org = rh->ip6r_segleft;
878 rh->ip6r_segleft = 0;
879 } else {
880 rh = NULL;
881 segleft_org = 0;
882 }
883
884 ipsec_state.m = m;
885 error = ipsec6_output_trans(&ipsec_state, nexthdrp, mprev,
886 sp, flags, &needipsectun);
887 m = ipsec_state.m;
888 if (error) {
889 /* mbuf is already reclaimed in ipsec6_output_trans. */
890 m = NULL;
891 switch (error) {
892 case EHOSTUNREACH:
893 case ENETUNREACH:
894 case EMSGSIZE:
895 case ENOBUFS:
896 case ENOMEM:
897 break;
898 default:
899 printf("ip6_output (ipsec): error code %d\n",
900 error);
901 /* FALLTHRU */
902 case ENOENT:
903 /* don't show these error codes to the user */
904 error = 0;
905 break;
906 }
907 goto bad;
908 }
909 if (exthdrs.ip6e_rthdr != NULL) {
910 /* ah6_output doesn't modify mbuf chain */
911 rh->ip6r_segleft = segleft_org;
912 }
913 }
914 #endif /* IPSEC */
915
916 /*
917 * If there is a routing header, replace the destination address field
918 * with the first hop of the routing header.
919 */
920 if (exthdrs.ip6e_rthdr != NULL) {
921 struct ip6_rthdr0 *rh0;
922 struct in6_addr *addr;
923 struct sockaddr_in6 sa;
924
925 rh = (struct ip6_rthdr *)
926 (mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *));
927 switch (rh->ip6r_type) {
928 case IPV6_RTHDR_TYPE_0:
929 rh0 = (struct ip6_rthdr0 *)rh;
930 addr = (struct in6_addr *)(void *)(rh0 + 1);
931
932 /*
933 * construct a sockaddr_in6 form of
934 * the first hop.
935 *
936 * XXX: we may not have enough
937 * information about its scope zone;
938 * there is no standard API to pass
939 * the information from the
940 * application.
941 */
942 bzero(&sa, sizeof (sa));
943 sa.sin6_family = AF_INET6;
944 sa.sin6_len = sizeof (sa);
945 sa.sin6_addr = addr[0];
946 if ((error = sa6_embedscope(&sa,
947 ip6_use_defzone)) != 0) {
948 goto bad;
949 }
950 ip6->ip6_dst = sa.sin6_addr;
951 bcopy(&addr[1], &addr[0], sizeof (struct in6_addr) *
952 (rh0->ip6r0_segleft - 1));
953 addr[rh0->ip6r0_segleft - 1] = finaldst;
954 /* XXX */
955 in6_clearscope(addr + rh0->ip6r0_segleft - 1);
956 break;
957 default: /* is it possible? */
958 error = EINVAL;
959 goto bad;
960 }
961 }
962
963 /* Source address validation */
964 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
965 !(flags & IPV6_UNSPECSRC)) {
966 error = EOPNOTSUPP;
967 ip6stat.ip6s_badscope++;
968 goto bad;
969 }
970 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
971 error = EOPNOTSUPP;
972 ip6stat.ip6s_badscope++;
973 goto bad;
974 }
975
976 ip6stat.ip6s_localout++;
977
978 /*
979 * Route packet.
980 */
981 if (ro == NULL) {
982 ro = &ip6route;
983 bzero((caddr_t)ro, sizeof (*ro));
984 }
985 ro_pmtu = ro;
986 if (opt != NULL && opt->ip6po_rthdr)
987 ro = &opt->ip6po_route;
988 dst = SIN6(&ro->ro_dst);
989
990 if (ro->ro_rt != NULL)
991 RT_LOCK_ASSERT_NOTHELD(ro->ro_rt);
992 /*
993 * if specified, try to fill in the traffic class field.
994 * do not override if a non-zero value is already set.
995 * we check the diffserv field and the ecn field separately.
996 */
997 if (opt != NULL && opt->ip6po_tclass >= 0) {
998 int mask = 0;
999
1000 if ((ip6->ip6_flow & htonl(0xfc << 20)) == 0)
1001 mask |= 0xfc;
1002 if ((ip6->ip6_flow & htonl(0x03 << 20)) == 0)
1003 mask |= 0x03;
1004 if (mask != 0) {
1005 ip6->ip6_flow |=
1006 htonl((opt->ip6po_tclass & mask) << 20);
1007 }
1008 }
1009
1010 /* fill in or override the hop limit field, if necessary. */
1011 if (opt && opt->ip6po_hlim != -1) {
1012 ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
1013 } else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1014 if (im6o != NULL) {
1015 IM6O_LOCK(im6o);
1016 ip6->ip6_hlim = im6o->im6o_multicast_hlim;
1017 IM6O_UNLOCK(im6o);
1018 } else {
1019 ip6->ip6_hlim = ip6_defmcasthlim;
1020 }
1021 }
1022
1023 /*
1024 * If there is a cached route, check that it is to the same
1025 * destination and is still up. If not, free it and try again.
1026 * Test rt_flags without holding rt_lock for performance reasons;
1027 * if the route is down it will hopefully be caught by the layer
1028 * below (since it uses this route as a hint) or during the
1029 * next transmit.
1030 */
1031 if (ROUTE_UNUSABLE(ro) || dst->sin6_family != AF_INET6 ||
1032 !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst))
1033 ROUTE_RELEASE(ro);
1034
1035 if (ro->ro_rt == NULL) {
1036 bzero(dst, sizeof (*dst));
1037 dst->sin6_family = AF_INET6;
1038 dst->sin6_len = sizeof (struct sockaddr_in6);
1039 dst->sin6_addr = ip6->ip6_dst;
1040 }
1041 #if IPSEC
1042 if (ip6obf.needipsec && needipsectun) {
1043 #if CONFIG_DTRACE
1044 struct ifnet *trace_ifp = (ifpp_save != NULL) ? (*ifpp_save) : NULL;
1045 #endif /* CONFIG_DTRACE */
1046 /*
1047 * All the extension headers will become inaccessible
1048 * (since they can be encrypted).
1049 * Don't panic, we need no more updates to extension headers
1050 * on inner IPv6 packet (since they are now encapsulated).
1051 *
1052 * IPv6 [ESP|AH] IPv6 [extension headers] payload
1053 */
1054 bzero(&exthdrs, sizeof (exthdrs));
1055 exthdrs.ip6e_ip6 = m;
1056
1057 ipsec_state.m = m;
1058 route_copyout((struct route *)&ipsec_state.ro, (struct route *)ro,
1059 sizeof (struct route_in6));
1060 ipsec_state.dst = SA(dst);
1061
1062 /* So that we can see packets inside the tunnel */
1063 DTRACE_IP6(send, struct mbuf *, m, struct inpcb *, NULL,
1064 struct ip6_hdr *, ip6, struct ifnet *, trace_ifp,
1065 struct ip *, NULL, struct ip6_hdr *, ip6);
1066
1067 error = ipsec6_output_tunnel(&ipsec_state, sp, flags);
1068 /* tunneled in IPv4? packet is gone */
1069 if (ipsec_state.tunneled == 4) {
1070 m = NULL;
1071 goto evaluateloop;
1072 }
1073 m = ipsec_state.m;
1074 ipsec_saved_route = ro;
1075 ro = (struct route_in6 *)&ipsec_state.ro;
1076 dst = SIN6(ipsec_state.dst);
1077 if (error) {
1078 /* mbuf is already reclaimed in ipsec6_output_tunnel. */
1079 m = NULL;
1080 switch (error) {
1081 case EHOSTUNREACH:
1082 case ENETUNREACH:
1083 case EMSGSIZE:
1084 case ENOBUFS:
1085 case ENOMEM:
1086 break;
1087 default:
1088 printf("ip6_output (ipsec): error code %d\n",
1089 error);
1090 /* FALLTHRU */
1091 case ENOENT:
1092 /* don't show these error codes to the user */
1093 error = 0;
1094 break;
1095 }
1096 goto bad;
1097 }
1098 /*
1099 * The packet has been encapsulated so the ifscope
1100 * is no longer valid since it does not apply to the
1101 * outer address: ignore the ifscope.
1102 */
1103 if (flags & IPV6_OUTARGS) {
1104 ip6oa->ip6oa_boundif = IFSCOPE_NONE;
1105 ip6oa->ip6oa_flags &= ~IP6OAF_BOUND_IF;
1106 }
1107 if (opt != NULL && opt->ip6po_pktinfo != NULL) {
1108 if (opt->ip6po_pktinfo->ipi6_ifindex != IFSCOPE_NONE)
1109 opt->ip6po_pktinfo->ipi6_ifindex = IFSCOPE_NONE;
1110 }
1111 exthdrs.ip6e_ip6 = m;
1112 }
1113 #endif /* IPSEC */
1114
1115 /*
1116 * ifp should only be filled in for dummy net packets which will jump
1117 * to check_with_pf label.
1118 */
1119 if (ifp != NULL) {
1120 VERIFY(ip6obf.route_selected);
1121 }
1122
1123 /* adjust pointer */
1124 ip6 = mtod(m, struct ip6_hdr *);
1125
1126 if (ip6obf.select_srcif) {
1127 bzero(&src_sa, sizeof (src_sa));
1128 src_sa.sin6_family = AF_INET6;
1129 src_sa.sin6_len = sizeof (src_sa);
1130 src_sa.sin6_addr = ip6->ip6_src;
1131 }
1132 bzero(&dst_sa, sizeof (dst_sa));
1133 dst_sa.sin6_family = AF_INET6;
1134 dst_sa.sin6_len = sizeof (dst_sa);
1135 dst_sa.sin6_addr = ip6->ip6_dst;
1136
1137 /*
1138 * Only call in6_selectroute() on first iteration to avoid taking
1139 * multiple references on ifp and rt.
1140 *
1141 * in6_selectroute() might return an ifp with its reference held
1142 * even in the error case, so make sure to release its reference.
1143 * ip6oa may be NULL if IPV6_OUTARGS isn't set.
1144 */
1145 if (!ip6obf.route_selected) {
1146 error = in6_selectroute( ip6obf.select_srcif ? &src_sa : NULL,
1147 &dst_sa, opt, im6o, &src_ia, ro, &ifp, &rt, 0, ip6oa);
1148
1149 if (error != 0) {
1150 switch (error) {
1151 case EHOSTUNREACH:
1152 ip6stat.ip6s_noroute++;
1153 break;
1154 case EADDRNOTAVAIL:
1155 default:
1156 break; /* XXX statistics? */
1157 }
1158 if (ifp != NULL)
1159 in6_ifstat_inc(ifp, ifs6_out_discard);
1160 /* ifp (if non-NULL) will be released at the end */
1161 goto bad;
1162 }
1163 ip6obf.route_selected = TRUE;
1164 }
1165 if (rt == NULL) {
1166 /*
1167 * If in6_selectroute() does not return a route entry,
1168 * dst may not have been updated.
1169 */
1170 *dst = dst_sa; /* XXX */
1171 }
1172
1173 #if NECP
1174 /* Catch-all to check if the interface is allowed */
1175 if (!necp_packet_is_allowed_over_interface(m, ifp)) {
1176 error = EHOSTUNREACH;
1177 ip6stat.ip6s_necp_policy_drop++;
1178 goto bad;
1179 }
1180 #endif /* NECP */
1181
1182 /*
1183 * then rt (for unicast) and ifp must be non-NULL valid values.
1184 */
1185 if (!(flags & IPV6_FORWARDING)) {
1186 in6_ifstat_inc_na(ifp, ifs6_out_request);
1187 }
1188 if (rt != NULL) {
1189 RT_LOCK(rt);
1190 if (ia == NULL) {
1191 ia = (struct in6_ifaddr *)(rt->rt_ifa);
1192 if (ia != NULL)
1193 IFA_ADDREF(&ia->ia_ifa);
1194 }
1195 rt->rt_use++;
1196 RT_UNLOCK(rt);
1197 }
1198
1199 /*
1200 * The outgoing interface must be in the zone of source and
1201 * destination addresses (except local/loopback). We should
1202 * use ia_ifp to support the case of sending packets to an
1203 * address of our own.
1204 */
1205 if (ia != NULL && ia->ia_ifp) {
1206 ifnet_reference(ia->ia_ifp); /* for origifp */
1207 if (origifp != NULL)
1208 ifnet_release(origifp);
1209 origifp = ia->ia_ifp;
1210 } else {
1211 if (ifp != NULL)
1212 ifnet_reference(ifp); /* for origifp */
1213 if (origifp != NULL)
1214 ifnet_release(origifp);
1215 origifp = ifp;
1216 }
1217
1218 /* skip scope enforcements for local/loopback route */
1219 if (rt == NULL || !(rt->rt_ifp->if_flags & IFF_LOOPBACK)) {
1220 struct in6_addr src0, dst0;
1221 u_int32_t zone;
1222
1223 src0 = ip6->ip6_src;
1224 if (in6_setscope(&src0, origifp, &zone))
1225 goto badscope;
1226 bzero(&src_sa, sizeof (src_sa));
1227 src_sa.sin6_family = AF_INET6;
1228 src_sa.sin6_len = sizeof (src_sa);
1229 src_sa.sin6_addr = ip6->ip6_src;
1230 if ((sa6_recoverscope(&src_sa, TRUE) ||
1231 zone != src_sa.sin6_scope_id))
1232 goto badscope;
1233
1234 dst0 = ip6->ip6_dst;
1235 if ((in6_setscope(&dst0, origifp, &zone)))
1236 goto badscope;
1237 /* re-initialize to be sure */
1238 bzero(&dst_sa, sizeof (dst_sa));
1239 dst_sa.sin6_family = AF_INET6;
1240 dst_sa.sin6_len = sizeof (dst_sa);
1241 dst_sa.sin6_addr = ip6->ip6_dst;
1242 if ((sa6_recoverscope(&dst_sa, TRUE) ||
1243 zone != dst_sa.sin6_scope_id))
1244 goto badscope;
1245
1246 /* scope check is done. */
1247 goto routefound;
1248
1249 badscope:
1250 ip6stat.ip6s_badscope++;
1251 in6_ifstat_inc(origifp, ifs6_out_discard);
1252 if (error == 0)
1253 error = EHOSTUNREACH; /* XXX */
1254 goto bad;
1255 }
1256
1257 routefound:
1258 if (rt != NULL && !IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1259 if (opt != NULL && opt->ip6po_nextroute.ro_rt) {
1260 /*
1261 * The nexthop is explicitly specified by the
1262 * application. We assume the next hop is an IPv6
1263 * address.
1264 */
1265 dst = SIN6(opt->ip6po_nexthop);
1266 } else if ((rt->rt_flags & RTF_GATEWAY)) {
1267 dst = SIN6(rt->rt_gateway);
1268 }
1269 /*
1270 * For packets destined to local/loopback, record the
1271 * source the source interface (which owns the source
1272 * address), as well as the output interface. This is
1273 * needed to reconstruct the embedded zone for the
1274 * link-local address case in ip6_input().
1275 */
1276 if (ia != NULL && (ifp->if_flags & IFF_LOOPBACK)) {
1277 uint32_t srcidx;
1278
1279 if (src_ia != NULL)
1280 srcidx = src_ia->ia_ifp->if_index;
1281 else if (ro->ro_srcia != NULL)
1282 srcidx = ro->ro_srcia->ifa_ifp->if_index;
1283 else
1284 srcidx = 0;
1285
1286 ip6_setsrcifaddr_info(m, srcidx, NULL);
1287 ip6_setdstifaddr_info(m, 0, ia);
1288 }
1289 }
1290
1291 if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1292 m->m_flags &= ~(M_BCAST | M_MCAST); /* just in case */
1293 } else {
1294 struct in6_multi *in6m;
1295
1296 m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
1297 in6_ifstat_inc_na(ifp, ifs6_out_mcast);
1298
1299 /*
1300 * Confirm that the outgoing interface supports multicast.
1301 */
1302 if (!(ifp->if_flags & IFF_MULTICAST)) {
1303 ip6stat.ip6s_noroute++;
1304 in6_ifstat_inc(ifp, ifs6_out_discard);
1305 error = ENETUNREACH;
1306 goto bad;
1307 }
1308 in6_multihead_lock_shared();
1309 IN6_LOOKUP_MULTI(&ip6->ip6_dst, ifp, in6m);
1310 in6_multihead_lock_done();
1311 if (im6o != NULL)
1312 IM6O_LOCK(im6o);
1313 if (in6m != NULL &&
1314 (im6o == NULL || im6o->im6o_multicast_loop)) {
1315 if (im6o != NULL)
1316 IM6O_UNLOCK(im6o);
1317 /*
1318 * If we belong to the destination multicast group
1319 * on the outgoing interface, and the caller did not
1320 * forbid loopback, loop back a copy.
1321 */
1322 ip6_mloopback(NULL, ifp, m, dst, optlen, nxt0);
1323 } else if (im6o != NULL)
1324 IM6O_UNLOCK(im6o);
1325 if (in6m != NULL)
1326 IN6M_REMREF(in6m);
1327 /*
1328 * Multicasts with a hoplimit of zero may be looped back,
1329 * above, but must not be transmitted on a network.
1330 * Also, multicasts addressed to the loopback interface
1331 * are not sent -- the above call to ip6_mloopback() will
1332 * loop back a copy if this host actually belongs to the
1333 * destination group on the loopback interface.
1334 */
1335 if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK) ||
1336 IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst)) {
1337 /* remove m from the packetchain and continue looping */
1338 if (m != NULL)
1339 m_freem(m);
1340 m = NULL;
1341 goto evaluateloop;
1342 }
1343 }
1344
1345 /*
1346 * Fill the outgoing inteface to tell the upper layer
1347 * to increment per-interface statistics.
1348 */
1349 if (ifpp != NULL && *ifpp == NULL) {
1350 ifnet_reference(ifp); /* for caller */
1351 *ifpp = ifp;
1352 }
1353
1354 /* Determine path MTU. */
1355 if ((error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, &mtu,
1356 &alwaysfrag)) != 0)
1357 goto bad;
1358
1359 /*
1360 * The caller of this function may specify to use the minimum MTU
1361 * in some cases.
1362 * An advanced API option (IPV6_USE_MIN_MTU) can also override MTU
1363 * setting. The logic is a bit complicated; by default, unicast
1364 * packets will follow path MTU while multicast packets will be sent at
1365 * the minimum MTU. If IP6PO_MINMTU_ALL is specified, all packets
1366 * including unicast ones will be sent at the minimum MTU. Multicast
1367 * packets will always be sent at the minimum MTU unless
1368 * IP6PO_MINMTU_DISABLE is explicitly specified.
1369 * See RFC 3542 for more details.
1370 */
1371 if (mtu > IPV6_MMTU) {
1372 if ((flags & IPV6_MINMTU)) {
1373 mtu = IPV6_MMTU;
1374 } else if (opt && opt->ip6po_minmtu == IP6PO_MINMTU_ALL) {
1375 mtu = IPV6_MMTU;
1376 } else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
1377 (opt == NULL ||
1378 opt->ip6po_minmtu != IP6PO_MINMTU_DISABLE)) {
1379 mtu = IPV6_MMTU;
1380 }
1381 }
1382
1383 /*
1384 * clear embedded scope identifiers if necessary.
1385 * in6_clearscope will touch the addresses only when necessary.
1386 */
1387 in6_clearscope(&ip6->ip6_src);
1388 in6_clearscope(&ip6->ip6_dst);
1389 /*
1390 * If the outgoing packet contains a hop-by-hop options header,
1391 * it must be examined and processed even by the source node.
1392 * (RFC 2460, section 4.)
1393 */
1394 if (exthdrs.ip6e_hbh != NULL) {
1395 struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh, struct ip6_hbh *);
1396 u_int32_t dummy; /* XXX unused */
1397 uint32_t oplen = 0; /* for ip6_process_hopopts() */
1398 #if DIAGNOSTIC
1399 if ((hbh->ip6h_len + 1) << 3 > exthdrs.ip6e_hbh->m_len)
1400 panic("ip6e_hbh is not continuous");
1401 #endif
1402 /*
1403 * XXX: If we have to send an ICMPv6 error to the sender,
1404 * we need the M_LOOP flag since icmp6_error() expects
1405 * the IPv6 and the hop-by-hop options header are
1406 * continuous unless the flag is set.
1407 */
1408 m->m_flags |= M_LOOP;
1409 m->m_pkthdr.rcvif = ifp;
1410 if (ip6_process_hopopts(m, (u_int8_t *)(hbh + 1),
1411 ((hbh->ip6h_len + 1) << 3) - sizeof (struct ip6_hbh),
1412 &dummy, &oplen) < 0) {
1413 /*
1414 * m was already freed at this point. Set to NULL so it
1415 * is not re-freed at end of ip6_output_list.
1416 */
1417 m = NULL;
1418 error = EINVAL; /* better error? */
1419 goto bad;
1420 }
1421 m->m_flags &= ~M_LOOP; /* XXX */
1422 m->m_pkthdr.rcvif = NULL;
1423 }
1424
1425 #if DUMMYNET
1426 check_with_pf:
1427 #endif /* DUMMYNET */
1428 #if PF
1429 if (PF_IS_ENABLED) {
1430 #if DUMMYNET
1431
1432 /*
1433 * TODO: Need to save opt->ip6po_flags for reinjection
1434 * rdar://10434993
1435 */
1436 args.fwa_m = m;
1437 args.fwa_oif = ifp;
1438 args.fwa_oflags = flags;
1439 if (flags & IPV6_OUTARGS)
1440 args.fwa_ip6oa = ip6oa;
1441 args.fwa_ro6 = ro;
1442 args.fwa_dst6 = dst;
1443 args.fwa_ro6_pmtu = ro_pmtu;
1444 args.fwa_origifp = origifp;
1445 args.fwa_mtu = mtu;
1446 args.fwa_alwaysfrag = alwaysfrag;
1447 args.fwa_unfragpartlen = unfragpartlen;
1448 args.fwa_exthdrs = &exthdrs;
1449 /* Invoke outbound packet filter */
1450 error = pf_af_hook(ifp, NULL, &m, AF_INET6, FALSE, &args);
1451 #else /* !DUMMYNET */
1452 error = pf_af_hook(ifp, NULL, &m, AF_INET6, FALSE, NULL);
1453 #endif /* !DUMMYNET */
1454
1455 if (error != 0 || m == NULL) {
1456 if (m != NULL) {
1457 panic("%s: unexpected packet %p\n",
1458 __func__, m);
1459 /* NOTREACHED */
1460 }
1461 /* m was already freed by callee and is now NULL. */
1462 goto evaluateloop;
1463 }
1464 ip6 = mtod(m, struct ip6_hdr *);
1465 }
1466 #endif /* PF */
1467
1468 #ifdef IPSEC
1469 /* clean ipsec history before fragmentation */
1470 ipsec_delaux(m);
1471 #endif /* IPSEC */
1472
1473 if (ip6oa != NULL) {
1474 u_int8_t dscp;
1475
1476 dscp = (ntohl(ip6->ip6_flow) & IP6FLOW_DSCP_MASK) >> IP6FLOW_DSCP_SHIFT;
1477
1478 error = set_packet_qos(m, ifp,
1479 ip6oa->ip6oa_flags & IP6OAF_QOSMARKING_ALLOWED ? TRUE : FALSE,
1480 ip6oa->ip6oa_sotc, ip6oa->ip6oa_netsvctype, &dscp);
1481 if (error == 0) {
1482 ip6->ip6_flow &= ~htonl(IP6FLOW_DSCP_MASK);
1483 ip6->ip6_flow |= htonl((u_int32_t)dscp << IP6FLOW_DSCP_SHIFT);
1484 } else {
1485 printf("%s if_dscp_for_mbuf() error %d\n", __func__, error);
1486 error = 0;
1487 }
1488 }
1489 /*
1490 * Determine whether fragmentation is necessary. If so, m is passed
1491 * back as a chain of packets and original mbuf is freed. Otherwise, m
1492 * is unchanged.
1493 */
1494 error = ip6_fragment_packet(&m, opt,
1495 &exthdrs, ifp, mtu, alwaysfrag, unfragpartlen, ro_pmtu, nxt0,
1496 optlen);
1497
1498 if (error)
1499 goto bad;
1500
1501 /*
1502 * The evaluateloop label is where we decide whether to continue looping over
1503 * packets or call into nd code to send.
1504 */
1505 evaluateloop:
1506
1507 /*
1508 * m may be NULL when we jump to the evaluateloop label from PF or
1509 * other code that can drop packets.
1510 */
1511 if (m != NULL) {
1512 /*
1513 * If we already have a chain to send, tack m onto the end.
1514 * Otherwise make m the start and end of the to-be-sent chain.
1515 */
1516 if (sendchain != NULL) {
1517 sendchain_last->m_nextpkt = m;
1518 } else {
1519 sendchain = m;
1520 }
1521
1522 /* Fragmentation may mean m is a chain. Find the last packet. */
1523 while (m->m_nextpkt)
1524 m = m->m_nextpkt;
1525 sendchain_last = m;
1526 pktcnt++;
1527 }
1528
1529 /* Fill in next m from inputchain as appropriate. */
1530 m = inputchain;
1531 if (m != NULL) {
1532 /* Isolate m from rest of input chain. */
1533 inputchain = m->m_nextpkt;
1534 m->m_nextpkt = NULL;
1535
1536 /*
1537 * Clear exthdrs and ipsec_state so stale contents are not
1538 * reused. Note this also clears the exthdrs.merged flag.
1539 */
1540 bzero(&exthdrs, sizeof(exthdrs));
1541 bzero(&ipsec_state, sizeof(ipsec_state));
1542
1543 /* Continue looping. */
1544 goto loopit;
1545 }
1546
1547 /*
1548 * If we get here, there's no more mbufs in inputchain, so send the
1549 * sendchain if there is one.
1550 */
1551 if (pktcnt > 0) {
1552 error = nd6_output_list(ifp, origifp, sendchain, dst,
1553 ro->ro_rt, adv);
1554 /*
1555 * Fall through to done label even in error case because
1556 * nd6_output_list frees packetchain in both success and
1557 * failure cases.
1558 */
1559 }
1560
1561 done:
1562 if (ifpp_save != NULL && *ifpp_save != NULL) {
1563 ifnet_release(*ifpp_save);
1564 *ifpp_save = NULL;
1565 }
1566 ROUTE_RELEASE(&ip6route);
1567 #if IPSEC
1568 ROUTE_RELEASE(&ipsec_state.ro);
1569 if (sp != NULL)
1570 key_freesp(sp, KEY_SADB_UNLOCKED);
1571 #endif /* IPSEC */
1572 #if NECP
1573 ROUTE_RELEASE(&necp_route);
1574 #endif /* NECP */
1575 #if DUMMYNET
1576 ROUTE_RELEASE(&saved_route);
1577 ROUTE_RELEASE(&saved_ro_pmtu);
1578 #endif /* DUMMYNET */
1579
1580 if (ia != NULL)
1581 IFA_REMREF(&ia->ia_ifa);
1582 if (src_ia != NULL)
1583 IFA_REMREF(&src_ia->ia_ifa);
1584 if (ifp != NULL)
1585 ifnet_release(ifp);
1586 if (origifp != NULL)
1587 ifnet_release(origifp);
1588 if (ip6_output_measure) {
1589 net_perf_measure_time(&net_perf, &start_tv, packets_processed);
1590 net_perf_histogram(&net_perf, packets_processed);
1591 }
1592 return (error);
1593
1594 freehdrs:
1595 if (exthdrs.ip6e_hbh != NULL) {
1596 if (exthdrs.merged)
1597 panic("Double free of ip6e_hbh");
1598 m_freem(exthdrs.ip6e_hbh);
1599 }
1600 if (exthdrs.ip6e_dest1 != NULL) {
1601 if (exthdrs.merged)
1602 panic("Double free of ip6e_dest1");
1603 m_freem(exthdrs.ip6e_dest1);
1604 }
1605 if (exthdrs.ip6e_rthdr != NULL) {
1606 if (exthdrs.merged)
1607 panic("Double free of ip6e_rthdr");
1608 m_freem(exthdrs.ip6e_rthdr);
1609 }
1610 if (exthdrs.ip6e_dest2 != NULL) {
1611 if (exthdrs.merged)
1612 panic("Double free of ip6e_dest2");
1613 m_freem(exthdrs.ip6e_dest2);
1614 }
1615 /* FALLTHRU */
1616 bad:
1617 if (inputchain != NULL)
1618 m_freem_list(inputchain);
1619 if (sendchain != NULL)
1620 m_freem_list(sendchain);
1621 if (m != NULL)
1622 m_freem(m);
1623
1624 goto done;
1625
1626 #undef ipf_pktopts
1627 #undef exthdrs
1628 #undef ip6route
1629 #undef ipsec_state
1630 #undef saved_route
1631 #undef saved_ro_pmtu
1632 #undef args
1633 }
1634
1635 /* ip6_fragment_packet
1636 *
1637 * The fragmentation logic is rather complex:
1638 * 1: normal case (dontfrag == 0, alwaysfrag == 0)
1639 * 1-a: send as is if tlen <= path mtu
1640 * 1-b: fragment if tlen > path mtu
1641 *
1642 * 2: if user asks us not to fragment (dontfrag == 1)
1643 * 2-a: send as is if tlen <= interface mtu
1644 * 2-b: error if tlen > interface mtu
1645 *
1646 * 3: if we always need to attach fragment header (alwaysfrag == 1)
1647 * always fragment
1648 *
1649 * 4: if dontfrag == 1 && alwaysfrag == 1
1650 * error, as we cannot handle this conflicting request
1651 */
1652
1653 static int
1654 ip6_fragment_packet(struct mbuf **mptr, struct ip6_pktopts *opt,
1655 struct ip6_exthdrs *exthdrsp, struct ifnet *ifp, uint32_t mtu,
1656 boolean_t alwaysfrag, uint32_t unfragpartlen, struct route_in6 *ro_pmtu,
1657 int nxt0, uint32_t optlen)
1658 {
1659 VERIFY(NULL != mptr);
1660 struct mbuf *m = *mptr;
1661 int error = 0;
1662 size_t tlen = m->m_pkthdr.len;
1663 boolean_t dontfrag = (opt != NULL && (opt->ip6po_flags & IP6PO_DONTFRAG));
1664
1665 if (m->m_pkthdr.pkt_flags & PKTF_FORWARDED) {
1666 dontfrag = TRUE;
1667 /*
1668 * Discard partial sum information if this packet originated
1669 * from another interface; the packet would already have the
1670 * final checksum and we shouldn't recompute it.
1671 */
1672 if ((m->m_pkthdr.csum_flags & (CSUM_DATA_VALID|CSUM_PARTIAL)) ==
1673 (CSUM_DATA_VALID|CSUM_PARTIAL)) {
1674 m->m_pkthdr.csum_flags &= ~CSUM_TX_FLAGS;
1675 m->m_pkthdr.csum_data = 0;
1676 }
1677 }
1678
1679 if (dontfrag && alwaysfrag) { /* case 4 */
1680 /* conflicting request - can't transmit */
1681 return EMSGSIZE;
1682 }
1683
1684 /* Access without acquiring nd_ifinfo lock for performance */
1685 if (dontfrag && tlen > IN6_LINKMTU(ifp)) { /* case 2-b */
1686 /*
1687 * Even if the DONTFRAG option is specified, we cannot send the
1688 * packet when the data length is larger than the MTU of the
1689 * outgoing interface.
1690 * Notify the error by sending IPV6_PATHMTU ancillary data as
1691 * well as returning an error code (the latter is not described
1692 * in the API spec.)
1693 */
1694 u_int32_t mtu32;
1695 struct ip6ctlparam ip6cp;
1696
1697 mtu32 = (u_int32_t)mtu;
1698 bzero(&ip6cp, sizeof (ip6cp));
1699 ip6cp.ip6c_cmdarg = (void *)&mtu32;
1700 pfctlinput2(PRC_MSGSIZE, SA(&ro_pmtu->ro_dst), (void *)&ip6cp);
1701 return EMSGSIZE;
1702 }
1703
1704 /*
1705 * transmit packet without fragmentation
1706 */
1707 if (dontfrag || (!alwaysfrag && /* case 1-a and 2-a */
1708 (tlen <= mtu || TSO_IPV6_OK(ifp, m) ||
1709 (ifp->if_hwassist & CSUM_FRAGMENT_IPV6)))) {
1710 /*
1711 * mppn not updated in this case because no new chain is formed
1712 * and inserted
1713 */
1714 ip6_output_checksum(ifp, mtu, m, nxt0, tlen, optlen);
1715 } else {
1716 /*
1717 * time to fragment - cases 1-b and 3 are handled inside
1718 * ip6_do_fragmentation().
1719 * mppn is passed down to be updated to point at fragment chain.
1720 */
1721 error = ip6_do_fragmentation(mptr, optlen, ifp,
1722 unfragpartlen, mtod(m, struct ip6_hdr *), exthdrsp, mtu, nxt0);
1723 }
1724
1725 return error;
1726 }
1727
1728 /*
1729 * ip6_do_fragmentation() is called by ip6_fragment_packet() after determining
1730 * the packet needs to be fragmented. on success, morig is freed and a chain
1731 * of fragments is linked into the packet chain where morig existed. Otherwise,
1732 * an errno is returned.
1733 */
1734 int
1735 ip6_do_fragmentation(struct mbuf **mptr, uint32_t optlen, struct ifnet *ifp,
1736 uint32_t unfragpartlen, struct ip6_hdr *ip6, struct ip6_exthdrs *exthdrsp,
1737 uint32_t mtu, int nxt0)
1738 {
1739 VERIFY(NULL != mptr);
1740 int error = 0;
1741
1742 struct mbuf *morig = *mptr;
1743 struct mbuf *first_mbufp = NULL;
1744 struct mbuf *last_mbufp = NULL;
1745
1746 size_t tlen = morig->m_pkthdr.len;
1747
1748 /*
1749 * try to fragment the packet. case 1-b and 3
1750 */
1751 if ((morig->m_pkthdr.csum_flags & CSUM_TSO_IPV6)) {
1752 /* TSO and fragment aren't compatible */
1753 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1754 return EMSGSIZE;
1755 } else if (mtu < IPV6_MMTU) {
1756 /* path MTU cannot be less than IPV6_MMTU */
1757 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1758 return EMSGSIZE;
1759 } else if (ip6->ip6_plen == 0) {
1760 /* jumbo payload cannot be fragmented */
1761 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1762 return EMSGSIZE;
1763 } else {
1764 size_t hlen, len, off;
1765 struct mbuf **mnext = NULL;
1766 struct ip6_frag *ip6f;
1767 u_int32_t id = htonl(ip6_randomid());
1768 u_char nextproto;
1769
1770 /*
1771 * Too large for the destination or interface;
1772 * fragment if possible.
1773 * Must be able to put at least 8 bytes per fragment.
1774 */
1775 hlen = unfragpartlen;
1776 if (mtu > IPV6_MAXPACKET)
1777 mtu = IPV6_MAXPACKET;
1778
1779 len = (mtu - hlen - sizeof (struct ip6_frag)) & ~7;
1780 if (len < 8) {
1781 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1782 return EMSGSIZE;
1783 }
1784
1785 /*
1786 * Change the next header field of the last header in the
1787 * unfragmentable part.
1788 */
1789 if (exthdrsp->ip6e_rthdr != NULL) {
1790 nextproto = *mtod(exthdrsp->ip6e_rthdr, u_char *);
1791 *mtod(exthdrsp->ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
1792 } else if (exthdrsp->ip6e_dest1 != NULL) {
1793 nextproto = *mtod(exthdrsp->ip6e_dest1, u_char *);
1794 *mtod(exthdrsp->ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
1795 } else if (exthdrsp->ip6e_hbh != NULL) {
1796 nextproto = *mtod(exthdrsp->ip6e_hbh, u_char *);
1797 *mtod(exthdrsp->ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
1798 } else {
1799 nextproto = ip6->ip6_nxt;
1800 ip6->ip6_nxt = IPPROTO_FRAGMENT;
1801 }
1802
1803 if (morig->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA)
1804 in6_delayed_cksum_offset(morig, 0, optlen, nxt0);
1805
1806 /*
1807 * Loop through length of segment after first fragment,
1808 * make new header and copy data of each part and link onto
1809 * chain.
1810 */
1811 for (off = hlen; off < tlen; off += len) {
1812 struct ip6_hdr *new_mhip6;
1813 struct mbuf *new_m;
1814 struct mbuf *m_frgpart;
1815
1816 MGETHDR(new_m, M_DONTWAIT, MT_HEADER); /* MAC-OK */
1817 if (new_m == NULL) {
1818 error = ENOBUFS;
1819 ip6stat.ip6s_odropped++;
1820 break;
1821 }
1822 new_m->m_pkthdr.rcvif = NULL;
1823 new_m->m_flags = morig->m_flags & M_COPYFLAGS;
1824
1825 if (first_mbufp != NULL) {
1826 /* Every pass through loop but first */
1827 *mnext = new_m;
1828 last_mbufp = new_m;
1829 } else {
1830 /* This is the first element of the fragment chain */
1831 first_mbufp = new_m;
1832 last_mbufp = new_m;
1833 }
1834 mnext = &new_m->m_nextpkt;
1835
1836 new_m->m_data += max_linkhdr;
1837 new_mhip6 = mtod(new_m, struct ip6_hdr *);
1838 *new_mhip6 = *ip6;
1839 new_m->m_len = sizeof (*new_mhip6);
1840
1841 error = ip6_insertfraghdr(morig, new_m, hlen, &ip6f);
1842 if (error) {
1843 ip6stat.ip6s_odropped++;
1844 break;
1845 }
1846
1847 ip6f->ip6f_offlg = htons((u_short)((off - hlen) & ~7));
1848 if (off + len >= tlen)
1849 len = tlen - off;
1850 else
1851 ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
1852 new_mhip6->ip6_plen = htons((u_short)(len + hlen +
1853 sizeof (*ip6f) - sizeof (struct ip6_hdr)));
1854
1855 if ((m_frgpart = m_copy(morig, off, len)) == NULL) {
1856 error = ENOBUFS;
1857 ip6stat.ip6s_odropped++;
1858 break;
1859 }
1860 m_cat(new_m, m_frgpart);
1861 new_m->m_pkthdr.len = len + hlen + sizeof (*ip6f);
1862 new_m->m_pkthdr.rcvif = NULL;
1863
1864 M_COPY_CLASSIFIER(new_m, morig);
1865 M_COPY_PFTAG(new_m, morig);
1866
1867 #ifdef notyet
1868 #if CONFIG_MACF_NET
1869 mac_create_fragment(morig, new_m);
1870 #endif /* CONFIG_MACF_NET */
1871 #endif /* notyet */
1872
1873 ip6f->ip6f_reserved = 0;
1874 ip6f->ip6f_ident = id;
1875 ip6f->ip6f_nxt = nextproto;
1876 ip6stat.ip6s_ofragments++;
1877 in6_ifstat_inc(ifp, ifs6_out_fragcreat);
1878 }
1879
1880 if (error) {
1881 /* free all the fragments created */
1882 if (first_mbufp != NULL) {
1883 m_freem_list(first_mbufp);
1884 first_mbufp = NULL;
1885 }
1886 last_mbufp = NULL;
1887 } else {
1888 /* successful fragmenting */
1889 m_freem(morig);
1890 *mptr = first_mbufp;
1891 last_mbufp->m_nextpkt = NULL;
1892 ip6stat.ip6s_fragmented++;
1893 in6_ifstat_inc(ifp, ifs6_out_fragok);
1894 }
1895 }
1896 return error;
1897 }
1898
1899 static int
1900 ip6_copyexthdr(struct mbuf **mp, caddr_t hdr, int hlen)
1901 {
1902 struct mbuf *m;
1903
1904 if (hlen > MCLBYTES)
1905 return (ENOBUFS); /* XXX */
1906
1907 MGET(m, M_DONTWAIT, MT_DATA);
1908 if (m == NULL)
1909 return (ENOBUFS);
1910
1911 if (hlen > MLEN) {
1912 MCLGET(m, M_DONTWAIT);
1913 if (!(m->m_flags & M_EXT)) {
1914 m_free(m);
1915 return (ENOBUFS);
1916 }
1917 }
1918 m->m_len = hlen;
1919 if (hdr != NULL)
1920 bcopy(hdr, mtod(m, caddr_t), hlen);
1921
1922 *mp = m;
1923 return (0);
1924 }
1925
1926 static void
1927 ip6_out_cksum_stats(int proto, u_int32_t len)
1928 {
1929 switch (proto) {
1930 case IPPROTO_TCP:
1931 tcp_out6_cksum_stats(len);
1932 break;
1933 case IPPROTO_UDP:
1934 udp_out6_cksum_stats(len);
1935 break;
1936 default:
1937 /* keep only TCP or UDP stats for now */
1938 break;
1939 }
1940 }
1941
1942 /*
1943 * Process a delayed payload checksum calculation (outbound path.)
1944 *
1945 * hoff is the number of bytes beyond the mbuf data pointer which
1946 * points to the IPv6 header. optlen is the number of bytes, if any,
1947 * between the end of IPv6 header and the beginning of the ULP payload
1948 * header, which represents the extension headers. If optlen is less
1949 * than zero, this routine will bail when it detects extension headers.
1950 *
1951 * Returns a bitmask representing all the work done in software.
1952 */
1953 uint32_t
1954 in6_finalize_cksum(struct mbuf *m, uint32_t hoff, int32_t optlen,
1955 int32_t nxt0, uint32_t csum_flags)
1956 {
1957 unsigned char buf[sizeof (struct ip6_hdr)] __attribute__((aligned(8)));
1958 struct ip6_hdr *ip6;
1959 uint32_t offset, mlen, hlen, olen, sw_csum;
1960 uint16_t csum, ulpoff, plen;
1961 uint8_t nxt;
1962
1963 _CASSERT(sizeof (csum) == sizeof (uint16_t));
1964 VERIFY(m->m_flags & M_PKTHDR);
1965
1966 sw_csum = (csum_flags & m->m_pkthdr.csum_flags);
1967
1968 if ((sw_csum &= CSUM_DELAY_IPV6_DATA) == 0)
1969 goto done;
1970
1971 mlen = m->m_pkthdr.len; /* total mbuf len */
1972 hlen = sizeof (*ip6); /* IPv6 header len */
1973
1974 /* sanity check (need at least IPv6 header) */
1975 if (mlen < (hoff + hlen)) {
1976 panic("%s: mbuf %p pkt len (%u) < hoff+ip6_hdr "
1977 "(%u+%u)\n", __func__, m, mlen, hoff, hlen);
1978 /* NOTREACHED */
1979 }
1980
1981 /*
1982 * In case the IPv6 header is not contiguous, or not 32-bit
1983 * aligned, copy it to a local buffer.
1984 */
1985 if ((hoff + hlen) > m->m_len ||
1986 !IP6_HDR_ALIGNED_P(mtod(m, caddr_t) + hoff)) {
1987 m_copydata(m, hoff, hlen, (caddr_t)buf);
1988 ip6 = (struct ip6_hdr *)(void *)buf;
1989 } else {
1990 ip6 = (struct ip6_hdr *)(void *)(m->m_data + hoff);
1991 }
1992
1993 nxt = ip6->ip6_nxt;
1994 plen = ntohs(ip6->ip6_plen);
1995 if (plen != (mlen - (hoff + hlen))) {
1996 plen = OSSwapInt16(plen);
1997 if (plen != (mlen - (hoff + hlen))) {
1998 /* Don't complain for jumbograms */
1999 if (plen != 0 || nxt != IPPROTO_HOPOPTS) {
2000 printf("%s: mbuf 0x%llx proto %d IPv6 "
2001 "plen %d (%x) [swapped %d (%x)] doesn't "
2002 "match actual packet length; %d is used "
2003 "instead\n", __func__,
2004 (uint64_t)VM_KERNEL_ADDRPERM(m), nxt,
2005 ip6->ip6_plen, ip6->ip6_plen, plen, plen,
2006 (mlen - (hoff + hlen)));
2007 }
2008 plen = mlen - (hoff + hlen);
2009 }
2010 }
2011
2012 if (optlen < 0) {
2013 /* next header isn't TCP/UDP and we don't know optlen, bail */
2014 if (nxt != IPPROTO_TCP && nxt != IPPROTO_UDP) {
2015 sw_csum = 0;
2016 goto done;
2017 }
2018 olen = 0;
2019 } else {
2020 /* caller supplied the original transport number; use it */
2021 if (nxt0 >= 0)
2022 nxt = nxt0;
2023 olen = optlen;
2024 }
2025
2026 offset = hoff + hlen + olen; /* ULP header */
2027
2028 /* sanity check */
2029 if (mlen < offset) {
2030 panic("%s: mbuf %p pkt len (%u) < hoff+ip6_hdr+ext_hdr "
2031 "(%u+%u+%u)\n", __func__, m, mlen, hoff, hlen, olen);
2032 /* NOTREACHED */
2033 }
2034
2035 /*
2036 * offset is added to the lower 16-bit value of csum_data,
2037 * which is expected to contain the ULP offset; therefore
2038 * CSUM_PARTIAL offset adjustment must be undone.
2039 */
2040 if ((m->m_pkthdr.csum_flags & (CSUM_PARTIAL|CSUM_DATA_VALID)) ==
2041 (CSUM_PARTIAL|CSUM_DATA_VALID)) {
2042 /*
2043 * Get back the original ULP offset (this will
2044 * undo the CSUM_PARTIAL logic in ip6_output.)
2045 */
2046 m->m_pkthdr.csum_data = (m->m_pkthdr.csum_tx_stuff -
2047 m->m_pkthdr.csum_tx_start);
2048 }
2049
2050 ulpoff = (m->m_pkthdr.csum_data & 0xffff); /* ULP csum offset */
2051
2052 if (mlen < (ulpoff + sizeof (csum))) {
2053 panic("%s: mbuf %p pkt len (%u) proto %d invalid ULP "
2054 "cksum offset (%u) cksum flags 0x%x\n", __func__,
2055 m, mlen, nxt, ulpoff, m->m_pkthdr.csum_flags);
2056 /* NOTREACHED */
2057 }
2058
2059 csum = inet6_cksum(m, 0, offset, plen - olen);
2060
2061 /* Update stats */
2062 ip6_out_cksum_stats(nxt, plen - olen);
2063
2064 /* RFC1122 4.1.3.4 */
2065 if (csum == 0 &&
2066 (m->m_pkthdr.csum_flags & (CSUM_UDPIPV6|CSUM_ZERO_INVERT)))
2067 csum = 0xffff;
2068
2069 /* Insert the checksum in the ULP csum field */
2070 offset += ulpoff;
2071 if ((offset + sizeof (csum)) > m->m_len) {
2072 m_copyback(m, offset, sizeof (csum), &csum);
2073 } else if (IP6_HDR_ALIGNED_P(mtod(m, char *) + hoff)) {
2074 *(uint16_t *)(void *)(mtod(m, char *) + offset) = csum;
2075 } else {
2076 bcopy(&csum, (mtod(m, char *) + offset), sizeof (csum));
2077 }
2078 m->m_pkthdr.csum_flags &= ~(CSUM_DELAY_IPV6_DATA | CSUM_DATA_VALID |
2079 CSUM_PARTIAL | CSUM_ZERO_INVERT);
2080
2081 done:
2082 return (sw_csum);
2083 }
2084
2085 /*
2086 * Insert jumbo payload option.
2087 */
2088 static int
2089 ip6_insert_jumboopt(struct ip6_exthdrs *exthdrs, u_int32_t plen)
2090 {
2091 struct mbuf *mopt;
2092 u_char *optbuf;
2093 u_int32_t v;
2094
2095 #define JUMBOOPTLEN 8 /* length of jumbo payload option and padding */
2096
2097 /*
2098 * If there is no hop-by-hop options header, allocate new one.
2099 * If there is one but it doesn't have enough space to store the
2100 * jumbo payload option, allocate a cluster to store the whole options.
2101 * Otherwise, use it to store the options.
2102 */
2103 if (exthdrs->ip6e_hbh == NULL) {
2104 MGET(mopt, M_DONTWAIT, MT_DATA);
2105 if (mopt == NULL)
2106 return (ENOBUFS);
2107 mopt->m_len = JUMBOOPTLEN;
2108 optbuf = mtod(mopt, u_char *);
2109 optbuf[1] = 0; /* = ((JUMBOOPTLEN) >> 3) - 1 */
2110 exthdrs->ip6e_hbh = mopt;
2111 } else {
2112 struct ip6_hbh *hbh;
2113
2114 mopt = exthdrs->ip6e_hbh;
2115 if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
2116 /*
2117 * XXX assumption:
2118 * - exthdrs->ip6e_hbh is not referenced from places
2119 * other than exthdrs.
2120 * - exthdrs->ip6e_hbh is not an mbuf chain.
2121 */
2122 u_int32_t oldoptlen = mopt->m_len;
2123 struct mbuf *n;
2124
2125 /*
2126 * XXX: give up if the whole (new) hbh header does
2127 * not fit even in an mbuf cluster.
2128 */
2129 if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
2130 return (ENOBUFS);
2131
2132 /*
2133 * As a consequence, we must always prepare a cluster
2134 * at this point.
2135 */
2136 MGET(n, M_DONTWAIT, MT_DATA);
2137 if (n != NULL) {
2138 MCLGET(n, M_DONTWAIT);
2139 if (!(n->m_flags & M_EXT)) {
2140 m_freem(n);
2141 n = NULL;
2142 }
2143 }
2144 if (n == NULL)
2145 return (ENOBUFS);
2146 n->m_len = oldoptlen + JUMBOOPTLEN;
2147 bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t),
2148 oldoptlen);
2149 optbuf = mtod(n, u_char *) + oldoptlen;
2150 m_freem(mopt);
2151 mopt = exthdrs->ip6e_hbh = n;
2152 } else {
2153 optbuf = mtod(mopt, u_char *) + mopt->m_len;
2154 mopt->m_len += JUMBOOPTLEN;
2155 }
2156 optbuf[0] = IP6OPT_PADN;
2157 optbuf[1] = 1;
2158
2159 /*
2160 * Adjust the header length according to the pad and
2161 * the jumbo payload option.
2162 */
2163 hbh = mtod(mopt, struct ip6_hbh *);
2164 hbh->ip6h_len += (JUMBOOPTLEN >> 3);
2165 }
2166
2167 /* fill in the option. */
2168 optbuf[2] = IP6OPT_JUMBO;
2169 optbuf[3] = 4;
2170 v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
2171 bcopy(&v, &optbuf[4], sizeof (u_int32_t));
2172
2173 /* finally, adjust the packet header length */
2174 exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
2175
2176 return (0);
2177 #undef JUMBOOPTLEN
2178 }
2179
2180 /*
2181 * Insert fragment header and copy unfragmentable header portions.
2182 */
2183 static int
2184 ip6_insertfraghdr(struct mbuf *m0, struct mbuf *m, int hlen,
2185 struct ip6_frag **frghdrp)
2186 {
2187 struct mbuf *n, *mlast;
2188
2189 if (hlen > sizeof (struct ip6_hdr)) {
2190 n = m_copym(m0, sizeof (struct ip6_hdr),
2191 hlen - sizeof (struct ip6_hdr), M_DONTWAIT);
2192 if (n == NULL)
2193 return (ENOBUFS);
2194 m->m_next = n;
2195 } else
2196 n = m;
2197
2198 /* Search for the last mbuf of unfragmentable part. */
2199 for (mlast = n; mlast->m_next; mlast = mlast->m_next)
2200 ;
2201
2202 if (!(mlast->m_flags & M_EXT) &&
2203 M_TRAILINGSPACE(mlast) >= sizeof (struct ip6_frag)) {
2204 /* use the trailing space of the last mbuf for the frag hdr */
2205 *frghdrp = (struct ip6_frag *)(mtod(mlast, caddr_t) +
2206 mlast->m_len);
2207 mlast->m_len += sizeof (struct ip6_frag);
2208 m->m_pkthdr.len += sizeof (struct ip6_frag);
2209 } else {
2210 /* allocate a new mbuf for the fragment header */
2211 struct mbuf *mfrg;
2212
2213 MGET(mfrg, M_DONTWAIT, MT_DATA);
2214 if (mfrg == NULL)
2215 return (ENOBUFS);
2216 mfrg->m_len = sizeof (struct ip6_frag);
2217 *frghdrp = mtod(mfrg, struct ip6_frag *);
2218 mlast->m_next = mfrg;
2219 }
2220
2221 return (0);
2222 }
2223
2224 static int
2225 ip6_getpmtu(struct route_in6 *ro_pmtu, struct route_in6 *ro,
2226 struct ifnet *ifp, struct in6_addr *dst, u_int32_t *mtup,
2227 boolean_t *alwaysfragp)
2228 {
2229 u_int32_t mtu = 0;
2230 boolean_t alwaysfrag = FALSE;
2231 int error = 0;
2232 boolean_t is_local = FALSE;
2233
2234 if (IN6_IS_SCOPE_LINKLOCAL(dst))
2235 is_local = TRUE;
2236
2237 if (ro_pmtu != ro) {
2238 /* The first hop and the final destination may differ. */
2239 struct sockaddr_in6 *sa6_dst = SIN6(&ro_pmtu->ro_dst);
2240 if (ROUTE_UNUSABLE(ro_pmtu) ||
2241 !IN6_ARE_ADDR_EQUAL(&sa6_dst->sin6_addr, dst))
2242 ROUTE_RELEASE(ro_pmtu);
2243
2244 if (ro_pmtu->ro_rt == NULL) {
2245 bzero(sa6_dst, sizeof (*sa6_dst));
2246 sa6_dst->sin6_family = AF_INET6;
2247 sa6_dst->sin6_len = sizeof (struct sockaddr_in6);
2248 sa6_dst->sin6_addr = *dst;
2249
2250 rtalloc_scoped((struct route *)ro_pmtu,
2251 ifp != NULL ? ifp->if_index : IFSCOPE_NONE);
2252 }
2253 }
2254
2255 if (ro_pmtu->ro_rt != NULL) {
2256 u_int32_t ifmtu;
2257
2258 if (ifp == NULL)
2259 ifp = ro_pmtu->ro_rt->rt_ifp;
2260 /* Access without acquiring nd_ifinfo lock for performance */
2261 ifmtu = IN6_LINKMTU(ifp);
2262
2263 /*
2264 * Access rmx_mtu without holding the route entry lock,
2265 * for performance; this isn't something that changes
2266 * often, so optimize.
2267 */
2268 mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
2269 if (mtu > ifmtu || mtu == 0) {
2270 /*
2271 * The MTU on the route is larger than the MTU on
2272 * the interface! This shouldn't happen, unless the
2273 * MTU of the interface has been changed after the
2274 * interface was brought up. Change the MTU in the
2275 * route to match the interface MTU (as long as the
2276 * field isn't locked).
2277 *
2278 * if MTU on the route is 0, we need to fix the MTU.
2279 * this case happens with path MTU discovery timeouts.
2280 */
2281 mtu = ifmtu;
2282 if (!(ro_pmtu->ro_rt->rt_rmx.rmx_locks & RTV_MTU))
2283 ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu; /* XXX */
2284 } else if (mtu < IPV6_MMTU) {
2285 /*
2286 * RFC2460 section 5, last paragraph:
2287 * if we record ICMPv6 too big message with
2288 * mtu < IPV6_MMTU, transmit packets sized IPV6_MMTU
2289 * or smaller, with framgent header attached.
2290 * (fragment header is needed regardless from the
2291 * packet size, for translators to identify packets)
2292 */
2293 alwaysfrag = TRUE;
2294 mtu = IPV6_MMTU;
2295 }
2296 } else {
2297 if (ifp) {
2298 /* Don't hold nd_ifinfo lock for performance */
2299 mtu = IN6_LINKMTU(ifp);
2300 } else {
2301 error = EHOSTUNREACH; /* XXX */
2302 }
2303 }
2304
2305 *mtup = mtu;
2306 if ((alwaysfragp != NULL) && !is_local)
2307 *alwaysfragp = alwaysfrag;
2308 return (error);
2309 }
2310
2311 /*
2312 * IP6 socket option processing.
2313 */
2314 int
2315 ip6_ctloutput(struct socket *so, struct sockopt *sopt)
2316 {
2317 int optdatalen, uproto;
2318 void *optdata;
2319 int privileged;
2320 struct inpcb *in6p = sotoinpcb(so);
2321 int error = 0, optval = 0;
2322 int level, op = -1, optname = 0;
2323 int optlen = 0;
2324 struct proc *p;
2325
2326 VERIFY(sopt != NULL);
2327
2328 level = sopt->sopt_level;
2329 op = sopt->sopt_dir;
2330 optname = sopt->sopt_name;
2331 optlen = sopt->sopt_valsize;
2332 p = sopt->sopt_p;
2333 uproto = (int)SOCK_PROTO(so);
2334
2335 privileged = (proc_suser(p) == 0);
2336
2337 if (level == IPPROTO_IPV6) {
2338 boolean_t capture_exthdrstat_in = FALSE;
2339 switch (op) {
2340 case SOPT_SET:
2341 switch (optname) {
2342 case IPV6_2292PKTOPTIONS: {
2343 struct mbuf *m;
2344
2345 error = soopt_getm(sopt, &m);
2346 if (error != 0)
2347 break;
2348 error = soopt_mcopyin(sopt, m);
2349 if (error != 0)
2350 break;
2351 error = ip6_pcbopts(&in6p->in6p_outputopts,
2352 m, so, sopt);
2353 m_freem(m);
2354 break;
2355 }
2356
2357 /*
2358 * Use of some Hop-by-Hop options or some
2359 * Destination options, might require special
2360 * privilege. That is, normal applications
2361 * (without special privilege) might be forbidden
2362 * from setting certain options in outgoing packets,
2363 * and might never see certain options in received
2364 * packets. [RFC 2292 Section 6]
2365 * KAME specific note:
2366 * KAME prevents non-privileged users from sending or
2367 * receiving ANY hbh/dst options in order to avoid
2368 * overhead of parsing options in the kernel.
2369 */
2370 case IPV6_RECVHOPOPTS:
2371 case IPV6_RECVDSTOPTS:
2372 case IPV6_RECVRTHDRDSTOPTS:
2373 if (!privileged)
2374 break;
2375 /* FALLTHROUGH */
2376 case IPV6_UNICAST_HOPS:
2377 case IPV6_HOPLIMIT:
2378 case IPV6_RECVPKTINFO:
2379 case IPV6_RECVHOPLIMIT:
2380 case IPV6_RECVRTHDR:
2381 case IPV6_RECVPATHMTU:
2382 case IPV6_RECVTCLASS:
2383 case IPV6_V6ONLY:
2384 case IPV6_AUTOFLOWLABEL:
2385 if (optlen != sizeof (int)) {
2386 error = EINVAL;
2387 break;
2388 }
2389 error = sooptcopyin(sopt, &optval,
2390 sizeof (optval), sizeof (optval));
2391 if (error)
2392 break;
2393
2394 switch (optname) {
2395 case IPV6_UNICAST_HOPS:
2396 if (optval < -1 || optval >= 256) {
2397 error = EINVAL;
2398 } else {
2399 /* -1 = kernel default */
2400 in6p->in6p_hops = optval;
2401 if (in6p->inp_vflag &
2402 INP_IPV4) {
2403 in6p->inp_ip_ttl =
2404 optval;
2405 }
2406 }
2407 break;
2408 #define OPTSET(bit) do { \
2409 if (optval) \
2410 in6p->inp_flags |= (bit); \
2411 else \
2412 in6p->inp_flags &= ~(bit); \
2413 } while (0)
2414
2415 #define OPTSET2292(bit) do { \
2416 in6p->inp_flags |= IN6P_RFC2292; \
2417 if (optval) \
2418 in6p->inp_flags |= (bit); \
2419 else \
2420 in6p->inp_flags &= ~(bit); \
2421 } while (0)
2422
2423 #define OPTBIT(bit) (in6p->inp_flags & (bit) ? 1 : 0)
2424
2425 case IPV6_RECVPKTINFO:
2426 /* cannot mix with RFC2292 */
2427 if (OPTBIT(IN6P_RFC2292)) {
2428 error = EINVAL;
2429 break;
2430 }
2431 OPTSET(IN6P_PKTINFO);
2432 break;
2433
2434 case IPV6_HOPLIMIT: {
2435 struct ip6_pktopts **optp;
2436
2437 /* cannot mix with RFC2292 */
2438 if (OPTBIT(IN6P_RFC2292)) {
2439 error = EINVAL;
2440 break;
2441 }
2442 optp = &in6p->in6p_outputopts;
2443 error = ip6_pcbopt(IPV6_HOPLIMIT,
2444 (u_char *)&optval, sizeof (optval),
2445 optp, uproto);
2446 break;
2447 }
2448
2449 case IPV6_RECVHOPLIMIT:
2450 /* cannot mix with RFC2292 */
2451 if (OPTBIT(IN6P_RFC2292)) {
2452 error = EINVAL;
2453 break;
2454 }
2455 OPTSET(IN6P_HOPLIMIT);
2456 break;
2457
2458 case IPV6_RECVHOPOPTS:
2459 /* cannot mix with RFC2292 */
2460 if (OPTBIT(IN6P_RFC2292)) {
2461 error = EINVAL;
2462 break;
2463 }
2464 OPTSET(IN6P_HOPOPTS);
2465 capture_exthdrstat_in = TRUE;
2466 break;
2467
2468 case IPV6_RECVDSTOPTS:
2469 /* cannot mix with RFC2292 */
2470 if (OPTBIT(IN6P_RFC2292)) {
2471 error = EINVAL;
2472 break;
2473 }
2474 OPTSET(IN6P_DSTOPTS);
2475 capture_exthdrstat_in = TRUE;
2476 break;
2477
2478 case IPV6_RECVRTHDRDSTOPTS:
2479 /* cannot mix with RFC2292 */
2480 if (OPTBIT(IN6P_RFC2292)) {
2481 error = EINVAL;
2482 break;
2483 }
2484 OPTSET(IN6P_RTHDRDSTOPTS);
2485 capture_exthdrstat_in = TRUE;
2486 break;
2487
2488 case IPV6_RECVRTHDR:
2489 /* cannot mix with RFC2292 */
2490 if (OPTBIT(IN6P_RFC2292)) {
2491 error = EINVAL;
2492 break;
2493 }
2494 OPTSET(IN6P_RTHDR);
2495 capture_exthdrstat_in = TRUE;
2496 break;
2497
2498 case IPV6_RECVPATHMTU:
2499 /*
2500 * We ignore this option for TCP
2501 * sockets.
2502 * (RFC3542 leaves this case
2503 * unspecified.)
2504 */
2505 if (uproto != IPPROTO_TCP)
2506 OPTSET(IN6P_MTU);
2507 break;
2508
2509 case IPV6_V6ONLY:
2510 /*
2511 * make setsockopt(IPV6_V6ONLY)
2512 * available only prior to bind(2).
2513 * see ipng mailing list, Jun 22 2001.
2514 */
2515 if (in6p->inp_lport ||
2516 !IN6_IS_ADDR_UNSPECIFIED(
2517 &in6p->in6p_laddr)) {
2518 error = EINVAL;
2519 break;
2520 }
2521 OPTSET(IN6P_IPV6_V6ONLY);
2522 if (optval)
2523 in6p->inp_vflag &= ~INP_IPV4;
2524 else
2525 in6p->inp_vflag |= INP_IPV4;
2526 break;
2527
2528 case IPV6_RECVTCLASS:
2529 /* we can mix with RFC2292 */
2530 OPTSET(IN6P_TCLASS);
2531 break;
2532
2533 case IPV6_AUTOFLOWLABEL:
2534 OPTSET(IN6P_AUTOFLOWLABEL);
2535 break;
2536
2537 }
2538 break;
2539
2540 case IPV6_TCLASS:
2541 case IPV6_DONTFRAG:
2542 case IPV6_USE_MIN_MTU:
2543 case IPV6_PREFER_TEMPADDR: {
2544 struct ip6_pktopts **optp;
2545
2546 if (optlen != sizeof (optval)) {
2547 error = EINVAL;
2548 break;
2549 }
2550 error = sooptcopyin(sopt, &optval,
2551 sizeof (optval), sizeof (optval));
2552 if (error)
2553 break;
2554
2555 optp = &in6p->in6p_outputopts;
2556 error = ip6_pcbopt(optname, (u_char *)&optval,
2557 sizeof (optval), optp, uproto);
2558 break;
2559 }
2560
2561 case IPV6_2292PKTINFO:
2562 case IPV6_2292HOPLIMIT:
2563 case IPV6_2292HOPOPTS:
2564 case IPV6_2292DSTOPTS:
2565 case IPV6_2292RTHDR:
2566 /* RFC 2292 */
2567 if (optlen != sizeof (int)) {
2568 error = EINVAL;
2569 break;
2570 }
2571 error = sooptcopyin(sopt, &optval,
2572 sizeof (optval), sizeof (optval));
2573 if (error)
2574 break;
2575 switch (optname) {
2576 case IPV6_2292PKTINFO:
2577 OPTSET2292(IN6P_PKTINFO);
2578 break;
2579 case IPV6_2292HOPLIMIT:
2580 OPTSET2292(IN6P_HOPLIMIT);
2581 break;
2582 case IPV6_2292HOPOPTS:
2583 /*
2584 * Check super-user privilege.
2585 * See comments for IPV6_RECVHOPOPTS.
2586 */
2587 if (!privileged)
2588 return (EPERM);
2589 OPTSET2292(IN6P_HOPOPTS);
2590 capture_exthdrstat_in = TRUE;
2591 break;
2592 case IPV6_2292DSTOPTS:
2593 if (!privileged)
2594 return (EPERM);
2595 OPTSET2292(IN6P_DSTOPTS|
2596 IN6P_RTHDRDSTOPTS); /* XXX */
2597 capture_exthdrstat_in = TRUE;
2598 break;
2599 case IPV6_2292RTHDR:
2600 OPTSET2292(IN6P_RTHDR);
2601 capture_exthdrstat_in = TRUE;
2602 break;
2603 }
2604 break;
2605
2606 case IPV6_3542PKTINFO:
2607 case IPV6_3542HOPOPTS:
2608 case IPV6_3542RTHDR:
2609 case IPV6_3542DSTOPTS:
2610 case IPV6_RTHDRDSTOPTS:
2611 case IPV6_3542NEXTHOP: {
2612 struct ip6_pktopts **optp;
2613 /* new advanced API (RFC3542) */
2614 struct mbuf *m;
2615
2616 /* cannot mix with RFC2292 */
2617 if (OPTBIT(IN6P_RFC2292)) {
2618 error = EINVAL;
2619 break;
2620 }
2621 error = soopt_getm(sopt, &m);
2622 if (error != 0)
2623 break;
2624 error = soopt_mcopyin(sopt, m);
2625 if (error != 0)
2626 break;
2627
2628 optp = &in6p->in6p_outputopts;
2629 error = ip6_pcbopt(optname, mtod(m, u_char *),
2630 m->m_len, optp, uproto);
2631 m_freem(m);
2632 break;
2633 }
2634 #undef OPTSET
2635 case IPV6_MULTICAST_IF:
2636 case IPV6_MULTICAST_HOPS:
2637 case IPV6_MULTICAST_LOOP:
2638 case IPV6_JOIN_GROUP:
2639 case IPV6_LEAVE_GROUP:
2640 case IPV6_MSFILTER:
2641 case MCAST_BLOCK_SOURCE:
2642 case MCAST_UNBLOCK_SOURCE:
2643 case MCAST_JOIN_GROUP:
2644 case MCAST_LEAVE_GROUP:
2645 case MCAST_JOIN_SOURCE_GROUP:
2646 case MCAST_LEAVE_SOURCE_GROUP:
2647 error = ip6_setmoptions(in6p, sopt);
2648 break;
2649
2650 case IPV6_PORTRANGE:
2651 error = sooptcopyin(sopt, &optval,
2652 sizeof (optval), sizeof (optval));
2653 if (error)
2654 break;
2655
2656 switch (optval) {
2657 case IPV6_PORTRANGE_DEFAULT:
2658 in6p->inp_flags &= ~(INP_LOWPORT);
2659 in6p->inp_flags &= ~(INP_HIGHPORT);
2660 break;
2661
2662 case IPV6_PORTRANGE_HIGH:
2663 in6p->inp_flags &= ~(INP_LOWPORT);
2664 in6p->inp_flags |= INP_HIGHPORT;
2665 break;
2666
2667 case IPV6_PORTRANGE_LOW:
2668 in6p->inp_flags &= ~(INP_HIGHPORT);
2669 in6p->inp_flags |= INP_LOWPORT;
2670 break;
2671
2672 default:
2673 error = EINVAL;
2674 break;
2675 }
2676 break;
2677 #if IPSEC
2678 case IPV6_IPSEC_POLICY: {
2679 caddr_t req = NULL;
2680 size_t len = 0;
2681 struct mbuf *m;
2682
2683 if ((error = soopt_getm(sopt, &m)) != 0)
2684 break;
2685 if ((error = soopt_mcopyin(sopt, m)) != 0)
2686 break;
2687
2688 req = mtod(m, caddr_t);
2689 len = m->m_len;
2690 error = ipsec6_set_policy(in6p, optname, req,
2691 len, privileged);
2692 m_freem(m);
2693 break;
2694 }
2695 #endif /* IPSEC */
2696 /*
2697 * IPv6 variant of IP_BOUND_IF; for details see
2698 * comments on IP_BOUND_IF in ip_ctloutput().
2699 */
2700 case IPV6_BOUND_IF:
2701 /* This option is settable only on IPv6 */
2702 if (!(in6p->inp_vflag & INP_IPV6)) {
2703 error = EINVAL;
2704 break;
2705 }
2706
2707 error = sooptcopyin(sopt, &optval,
2708 sizeof (optval), sizeof (optval));
2709
2710 if (error)
2711 break;
2712
2713 error = inp_bindif(in6p, optval, NULL);
2714 break;
2715
2716 case IPV6_NO_IFT_CELLULAR:
2717 /* This option is settable only for IPv6 */
2718 if (!(in6p->inp_vflag & INP_IPV6)) {
2719 error = EINVAL;
2720 break;
2721 }
2722
2723 error = sooptcopyin(sopt, &optval,
2724 sizeof (optval), sizeof (optval));
2725
2726 if (error)
2727 break;
2728
2729 /* once set, it cannot be unset */
2730 if (!optval && INP_NO_CELLULAR(in6p)) {
2731 error = EINVAL;
2732 break;
2733 }
2734
2735 error = so_set_restrictions(so,
2736 SO_RESTRICT_DENY_CELLULAR);
2737 break;
2738
2739 case IPV6_OUT_IF:
2740 /* This option is not settable */
2741 error = EINVAL;
2742 break;
2743
2744 default:
2745 error = ENOPROTOOPT;
2746 break;
2747 }
2748 if (capture_exthdrstat_in) {
2749 if (uproto == IPPROTO_TCP) {
2750 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_stream_exthdr_in);
2751 } else if (uproto == IPPROTO_UDP) {
2752 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_dgram_exthdr_in);
2753 }
2754 }
2755 break;
2756
2757 case SOPT_GET:
2758 switch (optname) {
2759
2760 case IPV6_2292PKTOPTIONS:
2761 /*
2762 * RFC3542 (effectively) deprecated the
2763 * semantics of the 2292-style pktoptions.
2764 * Since it was not reliable in nature (i.e.,
2765 * applications had to expect the lack of some
2766 * information after all), it would make sense
2767 * to simplify this part by always returning
2768 * empty data.
2769 */
2770 sopt->sopt_valsize = 0;
2771 break;
2772
2773 case IPV6_RECVHOPOPTS:
2774 case IPV6_RECVDSTOPTS:
2775 case IPV6_RECVRTHDRDSTOPTS:
2776 case IPV6_UNICAST_HOPS:
2777 case IPV6_RECVPKTINFO:
2778 case IPV6_RECVHOPLIMIT:
2779 case IPV6_RECVRTHDR:
2780 case IPV6_RECVPATHMTU:
2781 case IPV6_V6ONLY:
2782 case IPV6_PORTRANGE:
2783 case IPV6_RECVTCLASS:
2784 case IPV6_AUTOFLOWLABEL:
2785 switch (optname) {
2786
2787 case IPV6_RECVHOPOPTS:
2788 optval = OPTBIT(IN6P_HOPOPTS);
2789 break;
2790
2791 case IPV6_RECVDSTOPTS:
2792 optval = OPTBIT(IN6P_DSTOPTS);
2793 break;
2794
2795 case IPV6_RECVRTHDRDSTOPTS:
2796 optval = OPTBIT(IN6P_RTHDRDSTOPTS);
2797 break;
2798
2799 case IPV6_UNICAST_HOPS:
2800 optval = in6p->in6p_hops;
2801 break;
2802
2803 case IPV6_RECVPKTINFO:
2804 optval = OPTBIT(IN6P_PKTINFO);
2805 break;
2806
2807 case IPV6_RECVHOPLIMIT:
2808 optval = OPTBIT(IN6P_HOPLIMIT);
2809 break;
2810
2811 case IPV6_RECVRTHDR:
2812 optval = OPTBIT(IN6P_RTHDR);
2813 break;
2814
2815 case IPV6_RECVPATHMTU:
2816 optval = OPTBIT(IN6P_MTU);
2817 break;
2818
2819 case IPV6_V6ONLY:
2820 optval = OPTBIT(IN6P_IPV6_V6ONLY);
2821 break;
2822
2823 case IPV6_PORTRANGE: {
2824 int flags;
2825 flags = in6p->inp_flags;
2826 if (flags & INP_HIGHPORT)
2827 optval = IPV6_PORTRANGE_HIGH;
2828 else if (flags & INP_LOWPORT)
2829 optval = IPV6_PORTRANGE_LOW;
2830 else
2831 optval = 0;
2832 break;
2833 }
2834 case IPV6_RECVTCLASS:
2835 optval = OPTBIT(IN6P_TCLASS);
2836 break;
2837
2838 case IPV6_AUTOFLOWLABEL:
2839 optval = OPTBIT(IN6P_AUTOFLOWLABEL);
2840 break;
2841 }
2842 if (error)
2843 break;
2844 error = sooptcopyout(sopt, &optval,
2845 sizeof (optval));
2846 break;
2847
2848 case IPV6_PATHMTU: {
2849 u_int32_t pmtu = 0;
2850 struct ip6_mtuinfo mtuinfo;
2851 struct route_in6 sro;
2852
2853 bzero(&sro, sizeof (sro));
2854
2855 if (!(so->so_state & SS_ISCONNECTED))
2856 return (ENOTCONN);
2857 /*
2858 * XXX: we dot not consider the case of source
2859 * routing, or optional information to specify
2860 * the outgoing interface.
2861 */
2862 error = ip6_getpmtu(&sro, NULL, NULL,
2863 &in6p->in6p_faddr, &pmtu, NULL);
2864 ROUTE_RELEASE(&sro);
2865 if (error)
2866 break;
2867 if (pmtu > IPV6_MAXPACKET)
2868 pmtu = IPV6_MAXPACKET;
2869
2870 bzero(&mtuinfo, sizeof (mtuinfo));
2871 mtuinfo.ip6m_mtu = (u_int32_t)pmtu;
2872 optdata = (void *)&mtuinfo;
2873 optdatalen = sizeof (mtuinfo);
2874 error = sooptcopyout(sopt, optdata,
2875 optdatalen);
2876 break;
2877 }
2878
2879 case IPV6_2292PKTINFO:
2880 case IPV6_2292HOPLIMIT:
2881 case IPV6_2292HOPOPTS:
2882 case IPV6_2292RTHDR:
2883 case IPV6_2292DSTOPTS:
2884 switch (optname) {
2885 case IPV6_2292PKTINFO:
2886 optval = OPTBIT(IN6P_PKTINFO);
2887 break;
2888 case IPV6_2292HOPLIMIT:
2889 optval = OPTBIT(IN6P_HOPLIMIT);
2890 break;
2891 case IPV6_2292HOPOPTS:
2892 optval = OPTBIT(IN6P_HOPOPTS);
2893 break;
2894 case IPV6_2292RTHDR:
2895 optval = OPTBIT(IN6P_RTHDR);
2896 break;
2897 case IPV6_2292DSTOPTS:
2898 optval = OPTBIT(IN6P_DSTOPTS|
2899 IN6P_RTHDRDSTOPTS);
2900 break;
2901 }
2902 error = sooptcopyout(sopt, &optval,
2903 sizeof (optval));
2904 break;
2905
2906 case IPV6_PKTINFO:
2907 case IPV6_HOPOPTS:
2908 case IPV6_RTHDR:
2909 case IPV6_DSTOPTS:
2910 case IPV6_RTHDRDSTOPTS:
2911 case IPV6_NEXTHOP:
2912 case IPV6_TCLASS:
2913 case IPV6_DONTFRAG:
2914 case IPV6_USE_MIN_MTU:
2915 case IPV6_PREFER_TEMPADDR:
2916 error = ip6_getpcbopt(in6p->in6p_outputopts,
2917 optname, sopt);
2918 break;
2919
2920 case IPV6_MULTICAST_IF:
2921 case IPV6_MULTICAST_HOPS:
2922 case IPV6_MULTICAST_LOOP:
2923 case IPV6_MSFILTER:
2924 error = ip6_getmoptions(in6p, sopt);
2925 break;
2926 #if IPSEC
2927 case IPV6_IPSEC_POLICY: {
2928 error = 0; /* This option is no longer supported */
2929 break;
2930 }
2931 #endif /* IPSEC */
2932 case IPV6_BOUND_IF:
2933 if (in6p->inp_flags & INP_BOUND_IF)
2934 optval = in6p->inp_boundifp->if_index;
2935 error = sooptcopyout(sopt, &optval,
2936 sizeof (optval));
2937 break;
2938
2939 case IPV6_NO_IFT_CELLULAR:
2940 optval = INP_NO_CELLULAR(in6p) ? 1 : 0;
2941 error = sooptcopyout(sopt, &optval,
2942 sizeof (optval));
2943 break;
2944
2945 case IPV6_OUT_IF:
2946 optval = (in6p->in6p_last_outifp != NULL) ?
2947 in6p->in6p_last_outifp->if_index : 0;
2948 error = sooptcopyout(sopt, &optval,
2949 sizeof (optval));
2950 break;
2951
2952 default:
2953 error = ENOPROTOOPT;
2954 break;
2955 }
2956 break;
2957 }
2958 } else if (level == IPPROTO_UDP) {
2959 error = udp_ctloutput(so, sopt);
2960 } else {
2961 error = EINVAL;
2962 }
2963 return (error);
2964 }
2965
2966 int
2967 ip6_raw_ctloutput(struct socket *so, struct sockopt *sopt)
2968 {
2969 int error = 0, optval, optlen;
2970 const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
2971 struct inpcb *in6p = sotoinpcb(so);
2972 int level, op, optname;
2973
2974 level = sopt->sopt_level;
2975 op = sopt->sopt_dir;
2976 optname = sopt->sopt_name;
2977 optlen = sopt->sopt_valsize;
2978
2979 if (level != IPPROTO_IPV6)
2980 return (EINVAL);
2981
2982 switch (optname) {
2983 case IPV6_CHECKSUM:
2984 /*
2985 * For ICMPv6 sockets, no modification allowed for checksum
2986 * offset, permit "no change" values to help existing apps.
2987 *
2988 * RFC3542 says: "An attempt to set IPV6_CHECKSUM
2989 * for an ICMPv6 socket will fail."
2990 * The current behavior does not meet RFC3542.
2991 */
2992 switch (op) {
2993 case SOPT_SET:
2994 if (optlen != sizeof (int)) {
2995 error = EINVAL;
2996 break;
2997 }
2998 error = sooptcopyin(sopt, &optval, sizeof (optval),
2999 sizeof (optval));
3000 if (error)
3001 break;
3002 if ((optval % 2) != 0) {
3003 /* the API assumes even offset values */
3004 error = EINVAL;
3005 } else if (SOCK_PROTO(so) == IPPROTO_ICMPV6) {
3006 if (optval != icmp6off)
3007 error = EINVAL;
3008 } else {
3009 in6p->in6p_cksum = optval;
3010 }
3011 break;
3012
3013 case SOPT_GET:
3014 if (SOCK_PROTO(so) == IPPROTO_ICMPV6)
3015 optval = icmp6off;
3016 else
3017 optval = in6p->in6p_cksum;
3018
3019 error = sooptcopyout(sopt, &optval, sizeof (optval));
3020 break;
3021
3022 default:
3023 error = EINVAL;
3024 break;
3025 }
3026 break;
3027
3028 default:
3029 error = ENOPROTOOPT;
3030 break;
3031 }
3032
3033 return (error);
3034 }
3035
3036 /*
3037 * Set up IP6 options in pcb for insertion in output packets or
3038 * specifying behavior of outgoing packets.
3039 */
3040 static int
3041 ip6_pcbopts(struct ip6_pktopts **pktopt, struct mbuf *m, struct socket *so,
3042 struct sockopt *sopt)
3043 {
3044 #pragma unused(sopt)
3045 struct ip6_pktopts *opt = *pktopt;
3046 int error = 0;
3047
3048 /* turn off any old options. */
3049 if (opt != NULL) {
3050 #if DIAGNOSTIC
3051 if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
3052 opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
3053 opt->ip6po_rhinfo.ip6po_rhi_rthdr)
3054 printf("%s: all specified options are cleared.\n",
3055 __func__);
3056 #endif
3057 ip6_clearpktopts(opt, -1);
3058 } else {
3059 opt = _MALLOC(sizeof (*opt), M_IP6OPT, M_WAITOK);
3060 if (opt == NULL)
3061 return (ENOBUFS);
3062 }
3063 *pktopt = NULL;
3064
3065 if (m == NULL || m->m_len == 0) {
3066 /*
3067 * Only turning off any previous options, regardless of
3068 * whether the opt is just created or given.
3069 */
3070 if (opt != NULL)
3071 FREE(opt, M_IP6OPT);
3072 return (0);
3073 }
3074
3075 /* set options specified by user. */
3076 if ((error = ip6_setpktopts(m, opt, NULL, SOCK_PROTO(so))) != 0) {
3077 ip6_clearpktopts(opt, -1); /* XXX: discard all options */
3078 FREE(opt, M_IP6OPT);
3079 return (error);
3080 }
3081 *pktopt = opt;
3082 return (0);
3083 }
3084
3085 /*
3086 * initialize ip6_pktopts. beware that there are non-zero default values in
3087 * the struct.
3088 */
3089 void
3090 ip6_initpktopts(struct ip6_pktopts *opt)
3091 {
3092
3093 bzero(opt, sizeof (*opt));
3094 opt->ip6po_hlim = -1; /* -1 means default hop limit */
3095 opt->ip6po_tclass = -1; /* -1 means default traffic class */
3096 opt->ip6po_minmtu = IP6PO_MINMTU_MCASTONLY;
3097 opt->ip6po_prefer_tempaddr = IP6PO_TEMPADDR_SYSTEM;
3098 }
3099
3100 static int
3101 ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt,
3102 int uproto)
3103 {
3104 struct ip6_pktopts *opt;
3105
3106 opt = *pktopt;
3107 if (opt == NULL) {
3108 opt = _MALLOC(sizeof (*opt), M_IP6OPT, M_WAITOK);
3109 if (opt == NULL)
3110 return (ENOBUFS);
3111 ip6_initpktopts(opt);
3112 *pktopt = opt;
3113 }
3114
3115 return (ip6_setpktopt(optname, buf, len, opt, 1, 0, uproto));
3116 }
3117
3118 static int
3119 ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct sockopt *sopt)
3120 {
3121 void *optdata = NULL;
3122 int optdatalen = 0;
3123 struct ip6_ext *ip6e;
3124 struct in6_pktinfo null_pktinfo;
3125 int deftclass = 0, on;
3126 int defminmtu = IP6PO_MINMTU_MCASTONLY;
3127 int defpreftemp = IP6PO_TEMPADDR_SYSTEM;
3128
3129
3130 switch (optname) {
3131 case IPV6_PKTINFO:
3132 if (pktopt && pktopt->ip6po_pktinfo)
3133 optdata = (void *)pktopt->ip6po_pktinfo;
3134 else {
3135 /* XXX: we don't have to do this every time... */
3136 bzero(&null_pktinfo, sizeof (null_pktinfo));
3137 optdata = (void *)&null_pktinfo;
3138 }
3139 optdatalen = sizeof (struct in6_pktinfo);
3140 break;
3141
3142 case IPV6_TCLASS:
3143 if (pktopt && pktopt->ip6po_tclass >= 0)
3144 optdata = (void *)&pktopt->ip6po_tclass;
3145 else
3146 optdata = (void *)&deftclass;
3147 optdatalen = sizeof (int);
3148 break;
3149
3150 case IPV6_HOPOPTS:
3151 if (pktopt && pktopt->ip6po_hbh) {
3152 optdata = (void *)pktopt->ip6po_hbh;
3153 ip6e = (struct ip6_ext *)pktopt->ip6po_hbh;
3154 optdatalen = (ip6e->ip6e_len + 1) << 3;
3155 }
3156 break;
3157
3158 case IPV6_RTHDR:
3159 if (pktopt && pktopt->ip6po_rthdr) {
3160 optdata = (void *)pktopt->ip6po_rthdr;
3161 ip6e = (struct ip6_ext *)pktopt->ip6po_rthdr;
3162 optdatalen = (ip6e->ip6e_len + 1) << 3;
3163 }
3164 break;
3165
3166 case IPV6_RTHDRDSTOPTS:
3167 if (pktopt && pktopt->ip6po_dest1) {
3168 optdata = (void *)pktopt->ip6po_dest1;
3169 ip6e = (struct ip6_ext *)pktopt->ip6po_dest1;
3170 optdatalen = (ip6e->ip6e_len + 1) << 3;
3171 }
3172 break;
3173
3174 case IPV6_DSTOPTS:
3175 if (pktopt && pktopt->ip6po_dest2) {
3176 optdata = (void *)pktopt->ip6po_dest2;
3177 ip6e = (struct ip6_ext *)pktopt->ip6po_dest2;
3178 optdatalen = (ip6e->ip6e_len + 1) << 3;
3179 }
3180 break;
3181
3182 case IPV6_NEXTHOP:
3183 if (pktopt && pktopt->ip6po_nexthop) {
3184 optdata = (void *)pktopt->ip6po_nexthop;
3185 optdatalen = pktopt->ip6po_nexthop->sa_len;
3186 }
3187 break;
3188
3189 case IPV6_USE_MIN_MTU:
3190 if (pktopt)
3191 optdata = (void *)&pktopt->ip6po_minmtu;
3192 else
3193 optdata = (void *)&defminmtu;
3194 optdatalen = sizeof (int);
3195 break;
3196
3197 case IPV6_DONTFRAG:
3198 if (pktopt && ((pktopt->ip6po_flags) & IP6PO_DONTFRAG))
3199 on = 1;
3200 else
3201 on = 0;
3202 optdata = (void *)&on;
3203 optdatalen = sizeof (on);
3204 break;
3205
3206 case IPV6_PREFER_TEMPADDR:
3207 if (pktopt)
3208 optdata = (void *)&pktopt->ip6po_prefer_tempaddr;
3209 else
3210 optdata = (void *)&defpreftemp;
3211 optdatalen = sizeof (int);
3212 break;
3213
3214 default: /* should not happen */
3215 #ifdef DIAGNOSTIC
3216 panic("ip6_getpcbopt: unexpected option\n");
3217 #endif
3218 return (ENOPROTOOPT);
3219 }
3220
3221 return (sooptcopyout(sopt, optdata, optdatalen));
3222 }
3223
3224 void
3225 ip6_clearpktopts(struct ip6_pktopts *pktopt, int optname)
3226 {
3227 if (pktopt == NULL)
3228 return;
3229
3230 if (optname == -1 || optname == IPV6_PKTINFO) {
3231 if (pktopt->ip6po_pktinfo)
3232 FREE(pktopt->ip6po_pktinfo, M_IP6OPT);
3233 pktopt->ip6po_pktinfo = NULL;
3234 }
3235 if (optname == -1 || optname == IPV6_HOPLIMIT)
3236 pktopt->ip6po_hlim = -1;
3237 if (optname == -1 || optname == IPV6_TCLASS)
3238 pktopt->ip6po_tclass = -1;
3239 if (optname == -1 || optname == IPV6_NEXTHOP) {
3240 ROUTE_RELEASE(&pktopt->ip6po_nextroute);
3241 if (pktopt->ip6po_nexthop)
3242 FREE(pktopt->ip6po_nexthop, M_IP6OPT);
3243 pktopt->ip6po_nexthop = NULL;
3244 }
3245 if (optname == -1 || optname == IPV6_HOPOPTS) {
3246 if (pktopt->ip6po_hbh)
3247 FREE(pktopt->ip6po_hbh, M_IP6OPT);
3248 pktopt->ip6po_hbh = NULL;
3249 }
3250 if (optname == -1 || optname == IPV6_RTHDRDSTOPTS) {
3251 if (pktopt->ip6po_dest1)
3252 FREE(pktopt->ip6po_dest1, M_IP6OPT);
3253 pktopt->ip6po_dest1 = NULL;
3254 }
3255 if (optname == -1 || optname == IPV6_RTHDR) {
3256 if (pktopt->ip6po_rhinfo.ip6po_rhi_rthdr)
3257 FREE(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr, M_IP6OPT);
3258 pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
3259 ROUTE_RELEASE(&pktopt->ip6po_route);
3260 }
3261 if (optname == -1 || optname == IPV6_DSTOPTS) {
3262 if (pktopt->ip6po_dest2)
3263 FREE(pktopt->ip6po_dest2, M_IP6OPT);
3264 pktopt->ip6po_dest2 = NULL;
3265 }
3266 }
3267
3268 #define PKTOPT_EXTHDRCPY(type) do { \
3269 if (src->type) { \
3270 int hlen = \
3271 (((struct ip6_ext *)src->type)->ip6e_len + 1) << 3; \
3272 dst->type = _MALLOC(hlen, M_IP6OPT, canwait); \
3273 if (dst->type == NULL && canwait == M_NOWAIT) \
3274 goto bad; \
3275 bcopy(src->type, dst->type, hlen); \
3276 } \
3277 } while (0)
3278
3279 static int
3280 copypktopts(struct ip6_pktopts *dst, struct ip6_pktopts *src, int canwait)
3281 {
3282 if (dst == NULL || src == NULL) {
3283 printf("copypktopts: invalid argument\n");
3284 return (EINVAL);
3285 }
3286
3287 dst->ip6po_hlim = src->ip6po_hlim;
3288 dst->ip6po_tclass = src->ip6po_tclass;
3289 dst->ip6po_flags = src->ip6po_flags;
3290 if (src->ip6po_pktinfo) {
3291 dst->ip6po_pktinfo = _MALLOC(sizeof (*dst->ip6po_pktinfo),
3292 M_IP6OPT, canwait);
3293 if (dst->ip6po_pktinfo == NULL && canwait == M_NOWAIT)
3294 goto bad;
3295 *dst->ip6po_pktinfo = *src->ip6po_pktinfo;
3296 }
3297 if (src->ip6po_nexthop) {
3298 dst->ip6po_nexthop = _MALLOC(src->ip6po_nexthop->sa_len,
3299 M_IP6OPT, canwait);
3300 if (dst->ip6po_nexthop == NULL && canwait == M_NOWAIT)
3301 goto bad;
3302 bcopy(src->ip6po_nexthop, dst->ip6po_nexthop,
3303 src->ip6po_nexthop->sa_len);
3304 }
3305 PKTOPT_EXTHDRCPY(ip6po_hbh);
3306 PKTOPT_EXTHDRCPY(ip6po_dest1);
3307 PKTOPT_EXTHDRCPY(ip6po_dest2);
3308 PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
3309 return (0);
3310
3311 bad:
3312 ip6_clearpktopts(dst, -1);
3313 return (ENOBUFS);
3314 }
3315 #undef PKTOPT_EXTHDRCPY
3316
3317 struct ip6_pktopts *
3318 ip6_copypktopts(struct ip6_pktopts *src, int canwait)
3319 {
3320 int error;
3321 struct ip6_pktopts *dst;
3322
3323 dst = _MALLOC(sizeof (*dst), M_IP6OPT, canwait);
3324 if (dst == NULL)
3325 return (NULL);
3326 ip6_initpktopts(dst);
3327
3328 if ((error = copypktopts(dst, src, canwait)) != 0) {
3329 FREE(dst, M_IP6OPT);
3330 return (NULL);
3331 }
3332
3333 return (dst);
3334 }
3335
3336 void
3337 ip6_freepcbopts(struct ip6_pktopts *pktopt)
3338 {
3339 if (pktopt == NULL)
3340 return;
3341
3342 ip6_clearpktopts(pktopt, -1);
3343
3344 FREE(pktopt, M_IP6OPT);
3345 }
3346
3347 void
3348 ip6_moptions_init(void)
3349 {
3350 PE_parse_boot_argn("ifa_debug", &im6o_debug, sizeof (im6o_debug));
3351
3352 im6o_size = (im6o_debug == 0) ? sizeof (struct ip6_moptions) :
3353 sizeof (struct ip6_moptions_dbg);
3354
3355 im6o_zone = zinit(im6o_size, IM6O_ZONE_MAX * im6o_size, 0,
3356 IM6O_ZONE_NAME);
3357 if (im6o_zone == NULL) {
3358 panic("%s: failed allocating %s", __func__, IM6O_ZONE_NAME);
3359 /* NOTREACHED */
3360 }
3361 zone_change(im6o_zone, Z_EXPAND, TRUE);
3362 }
3363
3364 void
3365 im6o_addref(struct ip6_moptions *im6o, int locked)
3366 {
3367 if (!locked)
3368 IM6O_LOCK(im6o);
3369 else
3370 IM6O_LOCK_ASSERT_HELD(im6o);
3371
3372 if (++im6o->im6o_refcnt == 0) {
3373 panic("%s: im6o %p wraparound refcnt\n", __func__, im6o);
3374 /* NOTREACHED */
3375 } else if (im6o->im6o_trace != NULL) {
3376 (*im6o->im6o_trace)(im6o, TRUE);
3377 }
3378
3379 if (!locked)
3380 IM6O_UNLOCK(im6o);
3381 }
3382
3383 void
3384 im6o_remref(struct ip6_moptions *im6o)
3385 {
3386 int i;
3387
3388 IM6O_LOCK(im6o);
3389 if (im6o->im6o_refcnt == 0) {
3390 panic("%s: im6o %p negative refcnt", __func__, im6o);
3391 /* NOTREACHED */
3392 } else if (im6o->im6o_trace != NULL) {
3393 (*im6o->im6o_trace)(im6o, FALSE);
3394 }
3395
3396 --im6o->im6o_refcnt;
3397 if (im6o->im6o_refcnt > 0) {
3398 IM6O_UNLOCK(im6o);
3399 return;
3400 }
3401
3402 for (i = 0; i < im6o->im6o_num_memberships; ++i) {
3403 struct in6_mfilter *imf;
3404
3405 imf = im6o->im6o_mfilters ? &im6o->im6o_mfilters[i] : NULL;
3406 if (imf != NULL)
3407 im6f_leave(imf);
3408
3409 (void) in6_mc_leave(im6o->im6o_membership[i], imf);
3410
3411 if (imf != NULL)
3412 im6f_purge(imf);
3413
3414 IN6M_REMREF(im6o->im6o_membership[i]);
3415 im6o->im6o_membership[i] = NULL;
3416 }
3417 im6o->im6o_num_memberships = 0;
3418 if (im6o->im6o_mfilters != NULL) {
3419 FREE(im6o->im6o_mfilters, M_IN6MFILTER);
3420 im6o->im6o_mfilters = NULL;
3421 }
3422 if (im6o->im6o_membership != NULL) {
3423 FREE(im6o->im6o_membership, M_IP6MOPTS);
3424 im6o->im6o_membership = NULL;
3425 }
3426 IM6O_UNLOCK(im6o);
3427
3428 lck_mtx_destroy(&im6o->im6o_lock, ifa_mtx_grp);
3429
3430 if (!(im6o->im6o_debug & IFD_ALLOC)) {
3431 panic("%s: im6o %p cannot be freed", __func__, im6o);
3432 /* NOTREACHED */
3433 }
3434 zfree(im6o_zone, im6o);
3435 }
3436
3437 static void
3438 im6o_trace(struct ip6_moptions *im6o, int refhold)
3439 {
3440 struct ip6_moptions_dbg *im6o_dbg = (struct ip6_moptions_dbg *)im6o;
3441 ctrace_t *tr;
3442 u_int32_t idx;
3443 u_int16_t *cnt;
3444
3445 if (!(im6o->im6o_debug & IFD_DEBUG)) {
3446 panic("%s: im6o %p has no debug structure", __func__, im6o);
3447 /* NOTREACHED */
3448 }
3449 if (refhold) {
3450 cnt = &im6o_dbg->im6o_refhold_cnt;
3451 tr = im6o_dbg->im6o_refhold;
3452 } else {
3453 cnt = &im6o_dbg->im6o_refrele_cnt;
3454 tr = im6o_dbg->im6o_refrele;
3455 }
3456
3457 idx = atomic_add_16_ov(cnt, 1) % IM6O_TRACE_HIST_SIZE;
3458 ctrace_record(&tr[idx]);
3459 }
3460
3461 struct ip6_moptions *
3462 ip6_allocmoptions(int how)
3463 {
3464 struct ip6_moptions *im6o;
3465
3466 im6o = (how == M_WAITOK) ?
3467 zalloc(im6o_zone) : zalloc_noblock(im6o_zone);
3468 if (im6o != NULL) {
3469 bzero(im6o, im6o_size);
3470 lck_mtx_init(&im6o->im6o_lock, ifa_mtx_grp, ifa_mtx_attr);
3471 im6o->im6o_debug |= IFD_ALLOC;
3472 if (im6o_debug != 0) {
3473 im6o->im6o_debug |= IFD_DEBUG;
3474 im6o->im6o_trace = im6o_trace;
3475 }
3476 IM6O_ADDREF(im6o);
3477 }
3478
3479 return (im6o);
3480 }
3481
3482 /*
3483 * Set IPv6 outgoing packet options based on advanced API.
3484 */
3485 int
3486 ip6_setpktopts(struct mbuf *control, struct ip6_pktopts *opt,
3487 struct ip6_pktopts *stickyopt, int uproto)
3488 {
3489 struct cmsghdr *cm = NULL;
3490
3491 if (control == NULL || opt == NULL)
3492 return (EINVAL);
3493
3494 ip6_initpktopts(opt);
3495 if (stickyopt) {
3496 int error;
3497
3498 /*
3499 * If stickyopt is provided, make a local copy of the options
3500 * for this particular packet, then override them by ancillary
3501 * objects.
3502 * XXX: copypktopts() does not copy the cached route to a next
3503 * hop (if any). This is not very good in terms of efficiency,
3504 * but we can allow this since this option should be rarely
3505 * used.
3506 */
3507 if ((error = copypktopts(opt, stickyopt, M_NOWAIT)) != 0)
3508 return (error);
3509 }
3510
3511 /*
3512 * XXX: Currently, we assume all the optional information is stored
3513 * in a single mbuf.
3514 */
3515 if (control->m_next)
3516 return (EINVAL);
3517
3518 if (control->m_len < CMSG_LEN(0))
3519 return (EINVAL);
3520
3521 for (cm = M_FIRST_CMSGHDR(control); cm != NULL;
3522 cm = M_NXT_CMSGHDR(control, cm)) {
3523 int error;
3524
3525 if (cm->cmsg_len < sizeof (struct cmsghdr) ||
3526 cm->cmsg_len > control->m_len)
3527 return (EINVAL);
3528 if (cm->cmsg_level != IPPROTO_IPV6)
3529 continue;
3530
3531 error = ip6_setpktopt(cm->cmsg_type, CMSG_DATA(cm),
3532 cm->cmsg_len - CMSG_LEN(0), opt, 0, 1, uproto);
3533 if (error)
3534 return (error);
3535 }
3536
3537 return (0);
3538 }
3539 /*
3540 * Set a particular packet option, as a sticky option or an ancillary data
3541 * item. "len" can be 0 only when it's a sticky option.
3542 * We have 4 cases of combination of "sticky" and "cmsg":
3543 * "sticky=0, cmsg=0": impossible
3544 * "sticky=0, cmsg=1": RFC2292 or RFC3542 ancillary data
3545 * "sticky=1, cmsg=0": RFC3542 socket option
3546 * "sticky=1, cmsg=1": RFC2292 socket option
3547 */
3548 static int
3549 ip6_setpktopt(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
3550 int sticky, int cmsg, int uproto)
3551 {
3552 int minmtupolicy, preftemp;
3553 int error;
3554 boolean_t capture_exthdrstat_out = FALSE;
3555
3556 if (!sticky && !cmsg) {
3557 #ifdef DIAGNOSTIC
3558 printf("ip6_setpktopt: impossible case\n");
3559 #endif
3560 return (EINVAL);
3561 }
3562
3563 /*
3564 * Caller must have ensured that the buffer is at least
3565 * aligned on 32-bit boundary.
3566 */
3567 VERIFY(IS_P2ALIGNED(buf, sizeof (u_int32_t)));
3568
3569 /*
3570 * IPV6_2292xxx is for backward compatibility to RFC2292, and should
3571 * not be specified in the context of RFC3542. Conversely,
3572 * RFC3542 types should not be specified in the context of RFC2292.
3573 */
3574 if (!cmsg) {
3575 switch (optname) {
3576 case IPV6_2292PKTINFO:
3577 case IPV6_2292HOPLIMIT:
3578 case IPV6_2292NEXTHOP:
3579 case IPV6_2292HOPOPTS:
3580 case IPV6_2292DSTOPTS:
3581 case IPV6_2292RTHDR:
3582 case IPV6_2292PKTOPTIONS:
3583 return (ENOPROTOOPT);
3584 }
3585 }
3586 if (sticky && cmsg) {
3587 switch (optname) {
3588 case IPV6_PKTINFO:
3589 case IPV6_HOPLIMIT:
3590 case IPV6_NEXTHOP:
3591 case IPV6_HOPOPTS:
3592 case IPV6_DSTOPTS:
3593 case IPV6_RTHDRDSTOPTS:
3594 case IPV6_RTHDR:
3595 case IPV6_USE_MIN_MTU:
3596 case IPV6_DONTFRAG:
3597 case IPV6_TCLASS:
3598 case IPV6_PREFER_TEMPADDR: /* XXX: not an RFC3542 option */
3599 return (ENOPROTOOPT);
3600 }
3601 }
3602
3603 switch (optname) {
3604 case IPV6_2292PKTINFO:
3605 case IPV6_PKTINFO: {
3606 struct ifnet *ifp = NULL;
3607 struct in6_pktinfo *pktinfo;
3608
3609 if (len != sizeof (struct in6_pktinfo))
3610 return (EINVAL);
3611
3612 pktinfo = (struct in6_pktinfo *)(void *)buf;
3613
3614 /*
3615 * An application can clear any sticky IPV6_PKTINFO option by
3616 * doing a "regular" setsockopt with ipi6_addr being
3617 * in6addr_any and ipi6_ifindex being zero.
3618 * [RFC 3542, Section 6]
3619 */
3620 if (optname == IPV6_PKTINFO && opt->ip6po_pktinfo &&
3621 pktinfo->ipi6_ifindex == 0 &&
3622 IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
3623 ip6_clearpktopts(opt, optname);
3624 break;
3625 }
3626
3627 if (uproto == IPPROTO_TCP && optname == IPV6_PKTINFO &&
3628 sticky && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
3629 return (EINVAL);
3630 }
3631
3632 /* validate the interface index if specified. */
3633 ifnet_head_lock_shared();
3634
3635 if (pktinfo->ipi6_ifindex > if_index) {
3636 ifnet_head_done();
3637 return (ENXIO);
3638 }
3639
3640 if (pktinfo->ipi6_ifindex) {
3641 ifp = ifindex2ifnet[pktinfo->ipi6_ifindex];
3642 if (ifp == NULL) {
3643 ifnet_head_done();
3644 return (ENXIO);
3645 }
3646 }
3647
3648 ifnet_head_done();
3649
3650 /*
3651 * We store the address anyway, and let in6_selectsrc()
3652 * validate the specified address. This is because ipi6_addr
3653 * may not have enough information about its scope zone, and
3654 * we may need additional information (such as outgoing
3655 * interface or the scope zone of a destination address) to
3656 * disambiguate the scope.
3657 * XXX: the delay of the validation may confuse the
3658 * application when it is used as a sticky option.
3659 */
3660 if (opt->ip6po_pktinfo == NULL) {
3661 opt->ip6po_pktinfo = _MALLOC(sizeof (*pktinfo),
3662 M_IP6OPT, M_NOWAIT);
3663 if (opt->ip6po_pktinfo == NULL)
3664 return (ENOBUFS);
3665 }
3666 bcopy(pktinfo, opt->ip6po_pktinfo, sizeof (*pktinfo));
3667 break;
3668 }
3669
3670 case IPV6_2292HOPLIMIT:
3671 case IPV6_HOPLIMIT: {
3672 int *hlimp;
3673
3674 /*
3675 * RFC 3542 deprecated the usage of sticky IPV6_HOPLIMIT
3676 * to simplify the ordering among hoplimit options.
3677 */
3678 if (optname == IPV6_HOPLIMIT && sticky)
3679 return (ENOPROTOOPT);
3680
3681 if (len != sizeof (int))
3682 return (EINVAL);
3683 hlimp = (int *)(void *)buf;
3684 if (*hlimp < -1 || *hlimp > 255)
3685 return (EINVAL);
3686
3687 opt->ip6po_hlim = *hlimp;
3688 break;
3689 }
3690
3691 case IPV6_TCLASS: {
3692 int tclass;
3693
3694 if (len != sizeof (int))
3695 return (EINVAL);
3696 tclass = *(int *)(void *)buf;
3697 if (tclass < -1 || tclass > 255)
3698 return (EINVAL);
3699
3700 opt->ip6po_tclass = tclass;
3701 break;
3702 }
3703
3704 case IPV6_2292NEXTHOP:
3705 case IPV6_NEXTHOP:
3706 error = suser(kauth_cred_get(), 0);
3707 if (error)
3708 return (EACCES);
3709
3710 if (len == 0) { /* just remove the option */
3711 ip6_clearpktopts(opt, IPV6_NEXTHOP);
3712 break;
3713 }
3714
3715 /* check if cmsg_len is large enough for sa_len */
3716 if (len < sizeof (struct sockaddr) || len < *buf)
3717 return (EINVAL);
3718
3719 switch (SA(buf)->sa_family) {
3720 case AF_INET6: {
3721 struct sockaddr_in6 *sa6 = SIN6(buf);
3722
3723 if (sa6->sin6_len != sizeof (struct sockaddr_in6))
3724 return (EINVAL);
3725
3726 if (IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
3727 IN6_IS_ADDR_MULTICAST(&sa6->sin6_addr)) {
3728 return (EINVAL);
3729 }
3730 if ((error = sa6_embedscope(sa6, ip6_use_defzone))
3731 != 0) {
3732 return (error);
3733 }
3734 break;
3735 }
3736 case AF_LINK: /* should eventually be supported */
3737 default:
3738 return (EAFNOSUPPORT);
3739 }
3740
3741 /* turn off the previous option, then set the new option. */
3742 ip6_clearpktopts(opt, IPV6_NEXTHOP);
3743 opt->ip6po_nexthop = _MALLOC(*buf, M_IP6OPT, M_NOWAIT);
3744 if (opt->ip6po_nexthop == NULL)
3745 return (ENOBUFS);
3746 bcopy(buf, opt->ip6po_nexthop, *buf);
3747 break;
3748
3749 case IPV6_2292HOPOPTS:
3750 case IPV6_HOPOPTS: {
3751 struct ip6_hbh *hbh;
3752 int hbhlen;
3753
3754 /*
3755 * XXX: We don't allow a non-privileged user to set ANY HbH
3756 * options, since per-option restriction has too much
3757 * overhead.
3758 */
3759 error = suser(kauth_cred_get(), 0);
3760 if (error)
3761 return (EACCES);
3762
3763 if (len == 0) {
3764 ip6_clearpktopts(opt, IPV6_HOPOPTS);
3765 break; /* just remove the option */
3766 }
3767
3768 /* message length validation */
3769 if (len < sizeof (struct ip6_hbh))
3770 return (EINVAL);
3771 hbh = (struct ip6_hbh *)(void *)buf;
3772 hbhlen = (hbh->ip6h_len + 1) << 3;
3773 if (len != hbhlen)
3774 return (EINVAL);
3775
3776 /* turn off the previous option, then set the new option. */
3777 ip6_clearpktopts(opt, IPV6_HOPOPTS);
3778 opt->ip6po_hbh = _MALLOC(hbhlen, M_IP6OPT, M_NOWAIT);
3779 if (opt->ip6po_hbh == NULL)
3780 return (ENOBUFS);
3781 bcopy(hbh, opt->ip6po_hbh, hbhlen);
3782 capture_exthdrstat_out = TRUE;
3783 break;
3784 }
3785
3786 case IPV6_2292DSTOPTS:
3787 case IPV6_DSTOPTS:
3788 case IPV6_RTHDRDSTOPTS: {
3789 struct ip6_dest *dest, **newdest = NULL;
3790 int destlen;
3791
3792 error = suser(kauth_cred_get(), 0);
3793 if (error)
3794 return (EACCES);
3795
3796 if (len == 0) {
3797 ip6_clearpktopts(opt, optname);
3798 break; /* just remove the option */
3799 }
3800
3801 /* message length validation */
3802 if (len < sizeof (struct ip6_dest))
3803 return (EINVAL);
3804 dest = (struct ip6_dest *)(void *)buf;
3805 destlen = (dest->ip6d_len + 1) << 3;
3806 if (len != destlen)
3807 return (EINVAL);
3808
3809 /*
3810 * Determine the position that the destination options header
3811 * should be inserted; before or after the routing header.
3812 */
3813 switch (optname) {
3814 case IPV6_2292DSTOPTS:
3815 /*
3816 * The old advacned API is ambiguous on this point.
3817 * Our approach is to determine the position based
3818 * according to the existence of a routing header.
3819 * Note, however, that this depends on the order of the
3820 * extension headers in the ancillary data; the 1st
3821 * part of the destination options header must appear
3822 * before the routing header in the ancillary data,
3823 * too.
3824 * RFC3542 solved the ambiguity by introducing
3825 * separate ancillary data or option types.
3826 */
3827 if (opt->ip6po_rthdr == NULL)
3828 newdest = &opt->ip6po_dest1;
3829 else
3830 newdest = &opt->ip6po_dest2;
3831 break;
3832 case IPV6_RTHDRDSTOPTS:
3833 newdest = &opt->ip6po_dest1;
3834 break;
3835 case IPV6_DSTOPTS:
3836 newdest = &opt->ip6po_dest2;
3837 break;
3838 }
3839
3840 /* turn off the previous option, then set the new option. */
3841 ip6_clearpktopts(opt, optname);
3842 *newdest = _MALLOC(destlen, M_IP6OPT, M_NOWAIT);
3843 if (*newdest == NULL)
3844 return (ENOBUFS);
3845 bcopy(dest, *newdest, destlen);
3846 capture_exthdrstat_out = TRUE;
3847 break;
3848 }
3849
3850 case IPV6_2292RTHDR:
3851 case IPV6_RTHDR: {
3852 struct ip6_rthdr *rth;
3853 int rthlen;
3854
3855 if (len == 0) {
3856 ip6_clearpktopts(opt, IPV6_RTHDR);
3857 break; /* just remove the option */
3858 }
3859
3860 /* message length validation */
3861 if (len < sizeof (struct ip6_rthdr))
3862 return (EINVAL);
3863 rth = (struct ip6_rthdr *)(void *)buf;
3864 rthlen = (rth->ip6r_len + 1) << 3;
3865 if (len != rthlen)
3866 return (EINVAL);
3867
3868 switch (rth->ip6r_type) {
3869 case IPV6_RTHDR_TYPE_0:
3870 if (rth->ip6r_len == 0) /* must contain one addr */
3871 return (EINVAL);
3872 if (rth->ip6r_len % 2) /* length must be even */
3873 return (EINVAL);
3874 if (rth->ip6r_len / 2 != rth->ip6r_segleft)
3875 return (EINVAL);
3876 break;
3877 default:
3878 return (EINVAL); /* not supported */
3879 }
3880
3881 /* turn off the previous option */
3882 ip6_clearpktopts(opt, IPV6_RTHDR);
3883 opt->ip6po_rthdr = _MALLOC(rthlen, M_IP6OPT, M_NOWAIT);
3884 if (opt->ip6po_rthdr == NULL)
3885 return (ENOBUFS);
3886 bcopy(rth, opt->ip6po_rthdr, rthlen);
3887 capture_exthdrstat_out = TRUE;
3888 break;
3889 }
3890
3891 case IPV6_USE_MIN_MTU:
3892 if (len != sizeof (int))
3893 return (EINVAL);
3894 minmtupolicy = *(int *)(void *)buf;
3895 if (minmtupolicy != IP6PO_MINMTU_MCASTONLY &&
3896 minmtupolicy != IP6PO_MINMTU_DISABLE &&
3897 minmtupolicy != IP6PO_MINMTU_ALL) {
3898 return (EINVAL);
3899 }
3900 opt->ip6po_minmtu = minmtupolicy;
3901 break;
3902
3903 case IPV6_DONTFRAG:
3904 if (len != sizeof (int))
3905 return (EINVAL);
3906
3907 if (uproto == IPPROTO_TCP || *(int *)(void *)buf == 0) {
3908 /*
3909 * we ignore this option for TCP sockets.
3910 * (RFC3542 leaves this case unspecified.)
3911 */
3912 opt->ip6po_flags &= ~IP6PO_DONTFRAG;
3913 } else {
3914 opt->ip6po_flags |= IP6PO_DONTFRAG;
3915 }
3916 break;
3917
3918 case IPV6_PREFER_TEMPADDR:
3919 if (len != sizeof (int))
3920 return (EINVAL);
3921 preftemp = *(int *)(void *)buf;
3922 if (preftemp != IP6PO_TEMPADDR_SYSTEM &&
3923 preftemp != IP6PO_TEMPADDR_NOTPREFER &&
3924 preftemp != IP6PO_TEMPADDR_PREFER) {
3925 return (EINVAL);
3926 }
3927 opt->ip6po_prefer_tempaddr = preftemp;
3928 break;
3929
3930 default:
3931 return (ENOPROTOOPT);
3932 } /* end of switch */
3933
3934 if (capture_exthdrstat_out) {
3935 if (uproto == IPPROTO_TCP) {
3936 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_stream_exthdr_out);
3937 } else if (uproto == IPPROTO_UDP) {
3938 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_dgram_exthdr_out);
3939 }
3940 }
3941
3942 return (0);
3943 }
3944
3945 /*
3946 * Routine called from ip6_output() to loop back a copy of an IP6 multicast
3947 * packet to the input queue of a specified interface. Note that this
3948 * calls the output routine of the loopback "driver", but with an interface
3949 * pointer that might NOT be &loif -- easier than replicating that code here.
3950 */
3951 void
3952 ip6_mloopback(struct ifnet *srcifp, struct ifnet *origifp, struct mbuf *m,
3953 struct sockaddr_in6 *dst, uint32_t optlen, int32_t nxt0)
3954 {
3955 struct mbuf *copym;
3956 struct ip6_hdr *ip6;
3957 struct in6_addr src;
3958
3959 if (lo_ifp == NULL)
3960 return;
3961
3962 /*
3963 * Copy the packet header as it's needed for the checksum.
3964 * Make sure to deep-copy IPv6 header portion in case the data
3965 * is in an mbuf cluster, so that we can safely override the IPv6
3966 * header portion later.
3967 */
3968 copym = m_copym_mode(m, 0, M_COPYALL, M_DONTWAIT, M_COPYM_COPY_HDR);
3969 if (copym != NULL && ((copym->m_flags & M_EXT) ||
3970 copym->m_len < sizeof (struct ip6_hdr)))
3971 copym = m_pullup(copym, sizeof (struct ip6_hdr));
3972
3973 if (copym == NULL)
3974 return;
3975
3976 ip6 = mtod(copym, struct ip6_hdr *);
3977 src = ip6->ip6_src;
3978 /*
3979 * clear embedded scope identifiers if necessary.
3980 * in6_clearscope will touch the addresses only when necessary.
3981 */
3982 in6_clearscope(&ip6->ip6_src);
3983 in6_clearscope(&ip6->ip6_dst);
3984
3985 if (copym->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA)
3986 in6_delayed_cksum_offset(copym, 0, optlen, nxt0);
3987
3988 /*
3989 * Stuff the 'real' ifp into the pkthdr, to be used in matching
3990 * in ip6_input(); we need the loopback ifp/dl_tag passed as args
3991 * to make the loopback driver compliant with the data link
3992 * requirements.
3993 */
3994 copym->m_pkthdr.rcvif = origifp;
3995
3996 /*
3997 * Also record the source interface (which owns the source address).
3998 * This is basically a stripped down version of ifa_foraddr6().
3999 */
4000 if (srcifp == NULL) {
4001 struct in6_ifaddr *ia;
4002
4003 lck_rw_lock_shared(&in6_ifaddr_rwlock);
4004 for (ia = in6_ifaddrs; ia != NULL; ia = ia->ia_next) {
4005 IFA_LOCK_SPIN(&ia->ia_ifa);
4006 /* compare against src addr with embedded scope */
4007 if (IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &src)) {
4008 srcifp = ia->ia_ifp;
4009 IFA_UNLOCK(&ia->ia_ifa);
4010 break;
4011 }
4012 IFA_UNLOCK(&ia->ia_ifa);
4013 }
4014 lck_rw_done(&in6_ifaddr_rwlock);
4015 }
4016 if (srcifp != NULL)
4017 ip6_setsrcifaddr_info(copym, srcifp->if_index, NULL);
4018 ip6_setdstifaddr_info(copym, origifp->if_index, NULL);
4019
4020 dlil_output(lo_ifp, PF_INET6, copym, NULL, SA(dst), 0, NULL);
4021 }
4022
4023 /*
4024 * Chop IPv6 header off from the payload.
4025 */
4026 static int
4027 ip6_splithdr(struct mbuf *m, struct ip6_exthdrs *exthdrs)
4028 {
4029 struct mbuf *mh;
4030 struct ip6_hdr *ip6;
4031
4032 ip6 = mtod(m, struct ip6_hdr *);
4033 if (m->m_len > sizeof (*ip6)) {
4034 MGETHDR(mh, M_DONTWAIT, MT_HEADER); /* MAC-OK */
4035 if (mh == NULL) {
4036 m_freem(m);
4037 return (ENOBUFS);
4038 }
4039 M_COPY_PKTHDR(mh, m);
4040 MH_ALIGN(mh, sizeof (*ip6));
4041 m->m_flags &= ~M_PKTHDR;
4042 m->m_len -= sizeof (*ip6);
4043 m->m_data += sizeof (*ip6);
4044 mh->m_next = m;
4045 m = mh;
4046 m->m_len = sizeof (*ip6);
4047 bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof (*ip6));
4048 }
4049 exthdrs->ip6e_ip6 = m;
4050 return (0);
4051 }
4052
4053 static void
4054 ip6_output_checksum(struct ifnet *ifp, uint32_t mtu, struct mbuf *m,
4055 int nxt0, uint32_t tlen, uint32_t optlen)
4056 {
4057 uint32_t sw_csum, hwcap = ifp->if_hwassist;
4058 int tso = TSO_IPV6_OK(ifp, m);
4059
4060 if (!hwcksum_tx) {
4061 /* do all in software; checksum offload is disabled */
4062 sw_csum = CSUM_DELAY_IPV6_DATA & m->m_pkthdr.csum_flags;
4063 } else {
4064 /* do in software what the hardware cannot */
4065 sw_csum = m->m_pkthdr.csum_flags &
4066 ~IF_HWASSIST_CSUM_FLAGS(hwcap);
4067 }
4068
4069 if (optlen != 0) {
4070 sw_csum |= (CSUM_DELAY_IPV6_DATA &
4071 m->m_pkthdr.csum_flags);
4072 } else if (!(sw_csum & CSUM_DELAY_IPV6_DATA) &&
4073 (hwcap & CSUM_PARTIAL)) {
4074 /*
4075 * Partial checksum offload, ere), if no extension headers,
4076 * and TCP only (no UDP support, as the hardware may not be
4077 * able to convert +0 to -0 (0xffff) per RFC1122 4.1.3.4.
4078 * unless the interface supports "invert zero" capability.)
4079 */
4080 if (hwcksum_tx && !tso &&
4081 ((m->m_pkthdr.csum_flags & CSUM_TCPIPV6) ||
4082 ((hwcap & CSUM_ZERO_INVERT) &&
4083 (m->m_pkthdr.csum_flags & CSUM_ZERO_INVERT))) &&
4084 tlen <= mtu) {
4085 uint16_t start = sizeof (struct ip6_hdr);
4086 uint16_t ulpoff =
4087 m->m_pkthdr.csum_data & 0xffff;
4088 m->m_pkthdr.csum_flags |=
4089 (CSUM_DATA_VALID | CSUM_PARTIAL);
4090 m->m_pkthdr.csum_tx_stuff = (ulpoff + start);
4091 m->m_pkthdr.csum_tx_start = start;
4092 sw_csum = 0;
4093 } else {
4094 sw_csum |= (CSUM_DELAY_IPV6_DATA &
4095 m->m_pkthdr.csum_flags);
4096 }
4097 }
4098
4099 if (sw_csum & CSUM_DELAY_IPV6_DATA) {
4100 in6_delayed_cksum_offset(m, 0, optlen, nxt0);
4101 sw_csum &= ~CSUM_DELAY_IPV6_DATA;
4102 }
4103
4104 if (hwcksum_tx) {
4105 /*
4106 * Drop off bits that aren't supported by hardware;
4107 * also make sure to preserve non-checksum related bits.
4108 */
4109 m->m_pkthdr.csum_flags =
4110 ((m->m_pkthdr.csum_flags &
4111 (IF_HWASSIST_CSUM_FLAGS(hwcap) | CSUM_DATA_VALID)) |
4112 (m->m_pkthdr.csum_flags & ~IF_HWASSIST_CSUM_MASK));
4113 } else {
4114 /* drop all bits; checksum offload is disabled */
4115 m->m_pkthdr.csum_flags = 0;
4116 }
4117 }
4118
4119 /*
4120 * Compute IPv6 extension header length.
4121 */
4122 int
4123 ip6_optlen(struct in6pcb *in6p)
4124 {
4125 int len;
4126
4127 if (!in6p->in6p_outputopts)
4128 return (0);
4129
4130 len = 0;
4131 #define elen(x) \
4132 (((struct ip6_ext *)(x)) ? \
4133 (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
4134
4135 len += elen(in6p->in6p_outputopts->ip6po_hbh);
4136 if (in6p->in6p_outputopts->ip6po_rthdr) {
4137 /* dest1 is valid with rthdr only */
4138 len += elen(in6p->in6p_outputopts->ip6po_dest1);
4139 }
4140 len += elen(in6p->in6p_outputopts->ip6po_rthdr);
4141 len += elen(in6p->in6p_outputopts->ip6po_dest2);
4142 return (len);
4143 #undef elen
4144 }
4145
4146 static int
4147 sysctl_reset_ip6_output_stats SYSCTL_HANDLER_ARGS
4148 {
4149 #pragma unused(arg1, arg2)
4150 int error, i;
4151
4152 i = ip6_output_measure;
4153 error = sysctl_handle_int(oidp, &i, 0, req);
4154 if (error || req->newptr == USER_ADDR_NULL)
4155 goto done;
4156 /* impose bounds */
4157 if (i < 0 || i > 1) {
4158 error = EINVAL;
4159 goto done;
4160 }
4161 if (ip6_output_measure != i && i == 1) {
4162 net_perf_initialize(&net_perf, ip6_output_measure_bins);
4163 }
4164 ip6_output_measure = i;
4165 done:
4166 return (error);
4167 }
4168
4169 static int
4170 sysctl_ip6_output_measure_bins SYSCTL_HANDLER_ARGS
4171 {
4172 #pragma unused(arg1, arg2)
4173 int error;
4174 uint64_t i;
4175
4176 i = ip6_output_measure_bins;
4177 error = sysctl_handle_quad(oidp, &i, 0, req);
4178 if (error || req->newptr == USER_ADDR_NULL)
4179 goto done;
4180 /* validate data */
4181 if (!net_perf_validate_bins(i)) {
4182 error = EINVAL;
4183 goto done;
4184 }
4185 ip6_output_measure_bins = i;
4186 done:
4187 return (error);
4188 }
4189
4190 static int
4191 sysctl_ip6_output_getperf SYSCTL_HANDLER_ARGS
4192 {
4193 #pragma unused(oidp, arg1, arg2)
4194 if (req->oldptr == USER_ADDR_NULL)
4195 req->oldlen = (size_t)sizeof (struct ipstat);
4196
4197 return (SYSCTL_OUT(req, &net_perf, MIN(sizeof (net_perf), req->oldlen)));
4198 }
mirror of XNU