]> git.saurik.com Git - apple/xnu.git/blob - bsd/netinet6/ip6_output.c
projects / apple / xnu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
xnu-792.6.70.tar.gz
[apple/xnu.git] / bsd / netinet6 / ip6_output.c
1 /* $FreeBSD: src/sys/netinet6/ip6_output.c,v 1.43 2002/10/31 19:45:48 ume Exp $ */
2 /* $KAME: ip6_output.c,v 1.279 2002/01/26 06:12:30 jinmei Exp $ */
3
4 /*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 /*
34 * Copyright (c) 1982, 1986, 1988, 1990, 1993
35 * The Regents of the University of California. All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. All advertising materials mentioning features or use of this software
46 * must display the following acknowledgement:
47 * This product includes software developed by the University of
48 * California, Berkeley and its contributors.
49 * 4. Neither the name of the University nor the names of its contributors
50 * may be used to endorse or promote products derived from this software
51 * without specific prior written permission.
52 *
53 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63 * SUCH DAMAGE.
64 *
65 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
66 */
67
68
69 #include <sys/param.h>
70 #include <sys/malloc.h>
71 #include <sys/mbuf.h>
72 #include <sys/errno.h>
73 #include <sys/protosw.h>
74 #include <sys/socket.h>
75 #include <sys/socketvar.h>
76 #include <sys/systm.h>
77 #include <sys/kernel.h>
78 #include <sys/proc.h>
79 #include <sys/kauth.h>
80
81 #include <net/if.h>
82 #include <net/route.h>
83
84 #include <netinet/in.h>
85 #include <netinet/in_var.h>
86 #include <netinet/ip_var.h>
87 #include <netinet6/in6_var.h>
88 #include <netinet/ip6.h>
89 #include <netinet/icmp6.h>
90 #include <netinet6/ip6_var.h>
91 #include <netinet/in_pcb.h>
92 #include <netinet6/nd6.h>
93
94 #if IPSEC
95 #include <netinet6/ipsec.h>
96 #if INET6
97 #include <netinet6/ipsec6.h>
98 #endif
99 #include <netkey/key.h>
100 extern int ipsec_bypass;
101 extern lck_mtx_t *sadb_mutex;
102 extern lck_mtx_t *nd6_mutex;
103 #endif /* IPSEC */
104
105 #include <netinet6/ip6_fw.h>
106
107 #include <net/net_osdep.h>
108
109 #include <netinet/kpi_ipfilter_var.h>
110
111 #ifndef __APPLE__
112 static MALLOC_DEFINE(M_IPMOPTS, "ip6_moptions", "internet multicast options");
113 #endif
114
115
116 extern u_long route_generation;
117
118 struct ip6_exthdrs {
119 struct mbuf *ip6e_ip6;
120 struct mbuf *ip6e_hbh;
121 struct mbuf *ip6e_dest1;
122 struct mbuf *ip6e_rthdr;
123 struct mbuf *ip6e_dest2;
124 };
125
126 static int ip6_pcbopts(struct ip6_pktopts **, struct mbuf *,
127 struct socket *, struct sockopt *sopt);
128 static int ip6_setmoptions(int, struct inpcb *, struct mbuf *);
129 static int ip6_getmoptions(int, struct ip6_moptions *, struct mbuf **);
130 static int ip6_copyexthdr(struct mbuf **, caddr_t, int);
131 static int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
132 struct ip6_frag **);
133 static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
134 static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
135
136 extern int ip_createmoptions(struct ip_moptions **imop);
137 extern int ip_addmembership(struct ip_moptions *imo, struct ip_mreq *mreq);
138 extern int ip_dropmembership(struct ip_moptions *imo, struct ip_mreq *mreq);
139 extern lck_mtx_t *ip6_mutex;
140
141 /*
142 * IP6 output. The packet in mbuf chain m contains a skeletal IP6
143 * header (with pri, len, nxt, hlim, src, dst).
144 * This function may modify ver and hlim only.
145 * The mbuf chain containing the packet will be freed.
146 * The mbuf opt, if present, will not be freed.
147 *
148 * type of "mtu": rt_rmx.rmx_mtu is u_long, ifnet.ifr_mtu is int, and
149 * nd_ifinfo.linkmtu is u_int32_t. so we use u_long to hold largest one,
150 * which is rt_rmx.rmx_mtu.
151 */
152 int
153 ip6_output(
154 struct mbuf *m0,
155 struct ip6_pktopts *opt,
156 struct route_in6 *ro,
157 int flags,
158 struct ip6_moptions *im6o,
159 struct ifnet **ifpp, /* XXX: just for statistics */
160 int locked)
161 {
162 struct ip6_hdr *ip6, *mhip6;
163 struct ifnet *ifp, *origifp;
164 struct mbuf *m = m0;
165 int hlen, tlen, len, off;
166 struct route_in6 ip6route;
167 struct sockaddr_in6 *dst;
168 int error = 0;
169 struct in6_ifaddr *ia = NULL;
170 u_long mtu;
171 u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
172 struct ip6_exthdrs exthdrs;
173 struct in6_addr finaldst;
174 struct route_in6 *ro_pmtu = NULL;
175 int hdrsplit = 0;
176 int needipsec = 0;
177 ipfilter_t inject_filter_ref;
178
179 #if IPSEC
180 int needipsectun = 0;
181 struct socket *so = NULL;
182 struct secpolicy *sp = NULL;
183
184 if (!locked)
185 lck_mtx_lock(ip6_mutex);
186 /* for AH processing. stupid to have "socket" variable in IP layer... */
187 if (ipsec_bypass == 0)
188 {
189 so = ipsec_getsocket(m);
190 (void)ipsec_setsocket(m, NULL);
191 }
192 #endif /* IPSEC */
193
194 ip6 = mtod(m, struct ip6_hdr *);
195 inject_filter_ref = ipf_get_inject_filter(m);
196
197 #define MAKE_EXTHDR(hp, mp) \
198 do { \
199 if (hp) { \
200 struct ip6_ext *eh = (struct ip6_ext *)(hp); \
201 error = ip6_copyexthdr((mp), (caddr_t)(hp), \
202 ((eh)->ip6e_len + 1) << 3); \
203 if (error) \
204 goto freehdrs; \
205 } \
206 } while (0)
207
208 bzero(&exthdrs, sizeof(exthdrs));
209
210 if (opt) {
211 /* Hop-by-Hop options header */
212 MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
213 /* Destination options header(1st part) */
214 MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
215 /* Routing header */
216 MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
217 /* Destination options header(2nd part) */
218 MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
219 }
220
221 #if IPSEC
222 if (ipsec_bypass != 0)
223 goto skip_ipsec;
224
225 lck_mtx_lock(sadb_mutex);
226 /* get a security policy for this packet */
227 if (so == NULL)
228 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, 0, &error);
229 else
230 sp = ipsec6_getpolicybysock(m, IPSEC_DIR_OUTBOUND, so, &error);
231
232 if (sp == NULL) {
233 ipsec6stat.out_inval++;
234 lck_mtx_unlock(sadb_mutex);
235 goto freehdrs;
236 }
237
238 error = 0;
239
240 /* check policy */
241 switch (sp->policy) {
242 case IPSEC_POLICY_DISCARD:
243 /*
244 * This packet is just discarded.
245 */
246 ipsec6stat.out_polvio++;
247 lck_mtx_unlock(sadb_mutex);
248 goto freehdrs;
249
250 case IPSEC_POLICY_BYPASS:
251 case IPSEC_POLICY_NONE:
252 /* no need to do IPsec. */
253 needipsec = 0;
254 break;
255
256 case IPSEC_POLICY_IPSEC:
257 if (sp->req == NULL) {
258 /* acquire a policy */
259 error = key_spdacquire(sp);
260 lck_mtx_unlock(sadb_mutex);
261 goto freehdrs;
262 }
263 needipsec = 1;
264 break;
265
266 case IPSEC_POLICY_ENTRUST:
267 default:
268 printf("ip6_output: Invalid policy found. %d\n", sp->policy);
269 }
270 lck_mtx_unlock(sadb_mutex);
271 skip_ipsec:
272 #endif /* IPSEC */
273
274 /*
275 * Calculate the total length of the extension header chain.
276 * Keep the length of the unfragmentable part for fragmentation.
277 */
278 optlen = 0;
279 if (exthdrs.ip6e_hbh) optlen += exthdrs.ip6e_hbh->m_len;
280 if (exthdrs.ip6e_dest1) optlen += exthdrs.ip6e_dest1->m_len;
281 if (exthdrs.ip6e_rthdr) optlen += exthdrs.ip6e_rthdr->m_len;
282 unfragpartlen = optlen + sizeof(struct ip6_hdr);
283 /* NOTE: we don't add AH/ESP length here. do that later. */
284 if (exthdrs.ip6e_dest2) optlen += exthdrs.ip6e_dest2->m_len;
285
286 /*
287 * If we need IPsec, or there is at least one extension header,
288 * separate IP6 header from the payload.
289 */
290 if ((needipsec || optlen) && !hdrsplit) {
291 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
292 m = NULL;
293 goto freehdrs;
294 }
295 m = exthdrs.ip6e_ip6;
296 hdrsplit++;
297 }
298
299 /* adjust pointer */
300 ip6 = mtod(m, struct ip6_hdr *);
301
302 /* adjust mbuf packet header length */
303 m->m_pkthdr.len += optlen;
304 plen = m->m_pkthdr.len - sizeof(*ip6);
305
306 /* If this is a jumbo payload, insert a jumbo payload option. */
307 if (plen > IPV6_MAXPACKET) {
308 if (!hdrsplit) {
309 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
310 m = NULL;
311 goto freehdrs;
312 }
313 m = exthdrs.ip6e_ip6;
314 hdrsplit++;
315 }
316 /* adjust pointer */
317 ip6 = mtod(m, struct ip6_hdr *);
318 if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
319 goto freehdrs;
320 ip6->ip6_plen = 0;
321 } else
322 ip6->ip6_plen = htons(plen);
323
324 /*
325 * Concatenate headers and fill in next header fields.
326 * Here we have, on "m"
327 * IPv6 payload
328 * and we insert headers accordingly. Finally, we should be getting:
329 * IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
330 *
331 * during the header composing process, "m" points to IPv6 header.
332 * "mprev" points to an extension header prior to esp.
333 */
334 {
335 u_char *nexthdrp = &ip6->ip6_nxt;
336 struct mbuf *mprev = m;
337
338 /*
339 * we treat dest2 specially. this makes IPsec processing
340 * much easier. the goal here is to make mprev point the
341 * mbuf prior to dest2.
342 *
343 * result: IPv6 dest2 payload
344 * m and mprev will point to IPv6 header.
345 */
346 if (exthdrs.ip6e_dest2) {
347 if (!hdrsplit)
348 panic("assumption failed: hdr not split");
349 exthdrs.ip6e_dest2->m_next = m->m_next;
350 m->m_next = exthdrs.ip6e_dest2;
351 *mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
352 ip6->ip6_nxt = IPPROTO_DSTOPTS;
353 }
354
355 #define MAKE_CHAIN(m, mp, p, i)\
356 do {\
357 if (m) {\
358 if (!hdrsplit) \
359 panic("assumption failed: hdr not split"); \
360 *mtod((m), u_char *) = *(p);\
361 *(p) = (i);\
362 p = mtod((m), u_char *);\
363 (m)->m_next = (mp)->m_next;\
364 (mp)->m_next = (m);\
365 (mp) = (m);\
366 }\
367 } while (0)
368 /*
369 * result: IPv6 hbh dest1 rthdr dest2 payload
370 * m will point to IPv6 header. mprev will point to the
371 * extension header prior to dest2 (rthdr in the above case).
372 */
373 MAKE_CHAIN(exthdrs.ip6e_hbh, mprev,
374 nexthdrp, IPPROTO_HOPOPTS);
375 MAKE_CHAIN(exthdrs.ip6e_dest1, mprev,
376 nexthdrp, IPPROTO_DSTOPTS);
377 MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev,
378 nexthdrp, IPPROTO_ROUTING);
379
380 if (!TAILQ_EMPTY(&ipv6_filters)) {
381 struct ipfilter *filter;
382 int seen = (inject_filter_ref == 0);
383 int fixscope = 0;
384 struct ipf_pktopts *ippo = 0, ipf_pktopts;
385
386 if (im6o != NULL && IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
387 ippo = &ipf_pktopts;
388 ippo->ippo_flags = IPPOF_MCAST_OPTS;
389 ippo->ippo_mcast_ifnet = im6o->im6o_multicast_ifp;
390 ippo->ippo_mcast_ttl = im6o->im6o_multicast_hlim;
391 ippo->ippo_mcast_loop = im6o->im6o_multicast_loop;
392 }
393
394 /* Hack: embed the scope_id in the destination */
395 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) &&
396 (ip6->ip6_dst.s6_addr16[1] == 0) && (ro != NULL)) {
397 fixscope = 1;
398 ip6->ip6_dst.s6_addr16[1] = htons(ro->ro_dst.sin6_scope_id);
399 }
400 {
401 lck_mtx_unlock(ip6_mutex);
402 ipf_ref();
403 TAILQ_FOREACH(filter, &ipv6_filters, ipf_link) {
404 /*
405 * No need to proccess packet twice if we've
406 * already seen it
407 */
408 if (seen == 0) {
409 if ((struct ipfilter *)inject_filter_ref == filter)
410 seen = 1;
411 } else if (filter->ipf_filter.ipf_output) {
412 errno_t result;
413
414 result = filter->ipf_filter.ipf_output(filter->ipf_filter.cookie, (mbuf_t*)&m, ippo);
415 if (result == EJUSTRETURN) {
416 ipf_unref();
417 locked = 1; /* Don't want to take lock to unlock it right away */
418 goto done;
419 }
420 if (result != 0) {
421 ipf_unref();
422 locked = 1; /* Don't want to take lock to unlock it right away */
423 goto bad;
424 }
425 }
426 }
427 ipf_unref();
428 lck_mtx_lock(ip6_mutex);
429 }
430 /* Hack: cleanup embedded scope_id if we put it there */
431 if (fixscope)
432 ip6->ip6_dst.s6_addr16[1] = 0;
433 }
434
435 #if IPSEC
436 if (!needipsec)
437 goto skip_ipsec2;
438
439 /*
440 * pointers after IPsec headers are not valid any more.
441 * other pointers need a great care too.
442 * (IPsec routines should not mangle mbufs prior to AH/ESP)
443 */
444 exthdrs.ip6e_dest2 = NULL;
445
446 {
447 struct ip6_rthdr *rh = NULL;
448 int segleft_org = 0;
449 struct ipsec_output_state state;
450
451 if (exthdrs.ip6e_rthdr) {
452 rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
453 segleft_org = rh->ip6r_segleft;
454 rh->ip6r_segleft = 0;
455 }
456
457 bzero(&state, sizeof(state));
458 state.m = m;
459 error = ipsec6_output_trans(&state, nexthdrp, mprev, sp, flags,
460 &needipsectun);
461 m = state.m;
462 if (error) {
463 /* mbuf is already reclaimed in ipsec6_output_trans. */
464 m = NULL;
465 switch (error) {
466 case EHOSTUNREACH:
467 case ENETUNREACH:
468 case EMSGSIZE:
469 case ENOBUFS:
470 case ENOMEM:
471 break;
472 default:
473 printf("ip6_output (ipsec): error code %d\n", error);
474 /* fall through */
475 case ENOENT:
476 /* don't show these error codes to the user */
477 error = 0;
478 break;
479 }
480 goto bad;
481 }
482 if (exthdrs.ip6e_rthdr) {
483 /* ah6_output doesn't modify mbuf chain */
484 rh->ip6r_segleft = segleft_org;
485 }
486 }
487 skip_ipsec2:;
488 #endif
489 }
490
491 /*
492 * If there is a routing header, replace destination address field
493 * with the first hop of the routing header.
494 */
495 if (exthdrs.ip6e_rthdr) {
496 struct ip6_rthdr *rh =
497 (struct ip6_rthdr *)(mtod(exthdrs.ip6e_rthdr,
498 struct ip6_rthdr *));
499 struct ip6_rthdr0 *rh0;
500
501 finaldst = ip6->ip6_dst;
502 switch (rh->ip6r_type) {
503 case IPV6_RTHDR_TYPE_0:
504 rh0 = (struct ip6_rthdr0 *)rh;
505 ip6->ip6_dst = rh0->ip6r0_addr[0];
506 bcopy((caddr_t)&rh0->ip6r0_addr[1],
507 (caddr_t)&rh0->ip6r0_addr[0],
508 sizeof(struct in6_addr)*(rh0->ip6r0_segleft - 1)
509 );
510 rh0->ip6r0_addr[rh0->ip6r0_segleft - 1] = finaldst;
511 break;
512 default: /* is it possible? */
513 error = EINVAL;
514 goto bad;
515 }
516 }
517
518 /* Source address validation */
519 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
520 (flags & IPV6_DADOUTPUT) == 0) {
521 error = EOPNOTSUPP;
522 ip6stat.ip6s_badscope++;
523 goto bad;
524 }
525 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
526 error = EOPNOTSUPP;
527 ip6stat.ip6s_badscope++;
528 goto bad;
529 }
530
531 ip6stat.ip6s_localout++;
532
533 /*
534 * Route packet.
535 */
536 if (ro == 0) {
537 ro = &ip6route;
538 bzero((caddr_t)ro, sizeof(*ro));
539 }
540 ro_pmtu = ro;
541 if (opt && opt->ip6po_rthdr)
542 ro = &opt->ip6po_route;
543 dst = (struct sockaddr_in6 *)&ro->ro_dst;
544 /*
545 * If there is a cached route,
546 * check that it is to the same destination
547 * and is still up. If not, free it and try again.
548 */
549 if (ro->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
550 dst->sin6_family != AF_INET6 ||
551 !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst) ||
552 ro->ro_rt->generation_id != route_generation)) {
553 rtfree(ro->ro_rt);
554 ro->ro_rt = (struct rtentry *)0;
555 }
556 if (ro->ro_rt == 0) {
557 bzero(dst, sizeof(*dst));
558 dst->sin6_family = AF_INET6;
559 dst->sin6_len = sizeof(struct sockaddr_in6);
560 dst->sin6_addr = ip6->ip6_dst;
561 #if SCOPEDROUTING
562 /* XXX: sin6_scope_id should already be fixed at this point */
563 if (IN6_IS_SCOPE_LINKLOCAL(&dst->sin6_addr))
564 dst->sin6_scope_id = ntohs(dst->sin6_addr.s6_addr16[1]);
565 #endif
566 }
567 #if IPSEC
568 if (needipsec && needipsectun) {
569 struct ipsec_output_state state;
570
571 /*
572 * All the extension headers will become inaccessible
573 * (since they can be encrypted).
574 * Don't panic, we need no more updates to extension headers
575 * on inner IPv6 packet (since they are now encapsulated).
576 *
577 * IPv6 [ESP|AH] IPv6 [extension headers] payload
578 */
579 bzero(&exthdrs, sizeof(exthdrs));
580 exthdrs.ip6e_ip6 = m;
581
582 bzero(&state, sizeof(state));
583 state.m = m;
584 state.ro = (struct route *)ro;
585 state.dst = (struct sockaddr *)dst;
586
587 lck_mtx_lock(sadb_mutex);
588 error = ipsec6_output_tunnel(&state, sp, flags);
589 lck_mtx_unlock(sadb_mutex);
590 m = state.m;
591 ro = (struct route_in6 *)state.ro;
592 dst = (struct sockaddr_in6 *)state.dst;
593 if (error) {
594 /* mbuf is already reclaimed in ipsec6_output_tunnel. */
595 m0 = m = NULL;
596 m = NULL;
597 switch (error) {
598 case EHOSTUNREACH:
599 case ENETUNREACH:
600 case EMSGSIZE:
601 case ENOBUFS:
602 case ENOMEM:
603 break;
604 default:
605 printf("ip6_output (ipsec): error code %d\n", error);
606 /* fall through */
607 case ENOENT:
608 /* don't show these error codes to the user */
609 error = 0;
610 break;
611 }
612 lck_mtx_unlock(sadb_mutex);
613 goto bad;
614 }
615
616 exthdrs.ip6e_ip6 = m;
617 }
618 #endif /* IPSEC */
619
620 if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
621 /* Unicast */
622
623 #define ifatoia6(ifa) ((struct in6_ifaddr *)(ifa))
624 #define sin6tosa(sin6) ((struct sockaddr *)(sin6))
625 /* xxx
626 * interface selection comes here
627 * if an interface is specified from an upper layer,
628 * ifp must point it.
629 */
630 lck_mtx_lock(rt_mtx);
631 if (ro->ro_rt == 0) {
632 /*
633 * non-bsdi always clone routes, if parent is
634 * PRF_CLONING.
635 */
636 rtalloc_ign_locked((struct route *)ro, 0UL);
637 }
638 if (ro->ro_rt == 0) {
639 ip6stat.ip6s_noroute++;
640 error = EHOSTUNREACH;
641 lck_mtx_unlock(rt_mtx);
642 /* XXX in6_ifstat_inc(ifp, ifs6_out_discard); */
643 goto bad;
644 }
645 ia = ifatoia6(ro->ro_rt->rt_ifa);
646 ifp = ro->ro_rt->rt_ifp;
647 ro->ro_rt->rt_use++;
648 if (ro->ro_rt->rt_flags & RTF_GATEWAY)
649 dst = (struct sockaddr_in6 *)ro->ro_rt->rt_gateway;
650 lck_mtx_unlock(rt_mtx);
651 m->m_flags &= ~(M_BCAST | M_MCAST); /* just in case */
652
653 in6_ifstat_inc(ifp, ifs6_out_request);
654
655 /*
656 * Check if the outgoing interface conflicts with
657 * the interface specified by ifi6_ifindex (if specified).
658 * Note that loopback interface is always okay.
659 * (this may happen when we are sending a packet to one of
660 * our own addresses.)
661 */
662 if (opt && opt->ip6po_pktinfo
663 && opt->ip6po_pktinfo->ipi6_ifindex) {
664 if (!(ifp->if_flags & IFF_LOOPBACK)
665 && ifp->if_index != opt->ip6po_pktinfo->ipi6_ifindex) {
666 ip6stat.ip6s_noroute++;
667 in6_ifstat_inc(ifp, ifs6_out_discard);
668 error = EHOSTUNREACH;
669 goto bad;
670 }
671 }
672
673 if (opt && opt->ip6po_hlim != -1)
674 ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
675 } else {
676 /* Multicast */
677 struct in6_multi *in6m;
678
679 m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
680
681 /*
682 * See if the caller provided any multicast options
683 */
684 ifp = NULL;
685 if (im6o != NULL) {
686 ip6->ip6_hlim = im6o->im6o_multicast_hlim;
687 if (im6o->im6o_multicast_ifp != NULL)
688 ifp = im6o->im6o_multicast_ifp;
689 } else
690 ip6->ip6_hlim = ip6_defmcasthlim;
691
692 /*
693 * See if the caller provided the outgoing interface
694 * as an ancillary data.
695 * Boundary check for ifindex is assumed to be already done.
696 */
697 if (opt && opt->ip6po_pktinfo && opt->ip6po_pktinfo->ipi6_ifindex)
698 ifp = ifindex2ifnet[opt->ip6po_pktinfo->ipi6_ifindex];
699
700 /*
701 * If the destination is a node-local scope multicast,
702 * the packet should be loop-backed only.
703 */
704 if (IN6_IS_ADDR_MC_NODELOCAL(&ip6->ip6_dst)) {
705 /*
706 * If the outgoing interface is already specified,
707 * it should be a loopback interface.
708 */
709 if (ifp && (ifp->if_flags & IFF_LOOPBACK) == 0) {
710 ip6stat.ip6s_badscope++;
711 error = ENETUNREACH; /* XXX: better error? */
712 /* XXX correct ifp? */
713 in6_ifstat_inc(ifp, ifs6_out_discard);
714 goto bad;
715 } else {
716 ifp = &loif[0];
717 }
718 }
719
720 if (opt && opt->ip6po_hlim != -1)
721 ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
722
723 /*
724 * If caller did not provide an interface lookup a
725 * default in the routing table. This is either a
726 * default for the speicfied group (i.e. a host
727 * route), or a multicast default (a route for the
728 * ``net'' ff00::/8).
729 */
730 if (ifp == NULL) {
731 lck_mtx_lock(rt_mtx);
732 if (ro->ro_rt == 0) {
733 ro->ro_rt = rtalloc1_locked((struct sockaddr *)
734 &ro->ro_dst, 0, 0UL);
735 }
736 if (ro->ro_rt == 0) {
737 ip6stat.ip6s_noroute++;
738 lck_mtx_unlock(rt_mtx);
739 error = EHOSTUNREACH;
740 /* XXX in6_ifstat_inc(ifp, ifs6_out_discard) */
741 goto bad;
742 }
743 ia = ifatoia6(ro->ro_rt->rt_ifa);
744 ifp = ro->ro_rt->rt_ifp;
745 ro->ro_rt->rt_use++;
746 lck_mtx_unlock(rt_mtx);
747 }
748
749 if ((flags & IPV6_FORWARDING) == 0)
750 in6_ifstat_inc(ifp, ifs6_out_request);
751 in6_ifstat_inc(ifp, ifs6_out_mcast);
752
753 /*
754 * Confirm that the outgoing interface supports multicast.
755 */
756 if ((ifp->if_flags & IFF_MULTICAST) == 0) {
757 ip6stat.ip6s_noroute++;
758 in6_ifstat_inc(ifp, ifs6_out_discard);
759 error = ENETUNREACH;
760 goto bad;
761 }
762 ifnet_lock_shared(ifp);
763 IN6_LOOKUP_MULTI(ip6->ip6_dst, ifp, in6m);
764 ifnet_lock_done(ifp);
765 if (in6m != NULL &&
766 (im6o == NULL || im6o->im6o_multicast_loop)) {
767 /*
768 * If we belong to the destination multicast group
769 * on the outgoing interface, and the caller did not
770 * forbid loopback, loop back a copy.
771 */
772 ip6_mloopback(ifp, m, dst);
773 } else {
774 /*
775 * If we are acting as a multicast router, perform
776 * multicast forwarding as if the packet had just
777 * arrived on the interface to which we are about
778 * to send. The multicast forwarding function
779 * recursively calls this function, using the
780 * IPV6_FORWARDING flag to prevent infinite recursion.
781 *
782 * Multicasts that are looped back by ip6_mloopback(),
783 * above, will be forwarded by the ip6_input() routine,
784 * if necessary.
785 */
786 if (ip6_mrouter && (flags & IPV6_FORWARDING) == 0) {
787 if (ip6_mforward(ip6, ifp, m) != NULL) {
788 m_freem(m);
789 goto done;
790 }
791 }
792 }
793 /*
794 * Multicasts with a hoplimit of zero may be looped back,
795 * above, but must not be transmitted on a network.
796 * Also, multicasts addressed to the loopback interface
797 * are not sent -- the above call to ip6_mloopback() will
798 * loop back a copy if this host actually belongs to the
799 * destination group on the loopback interface.
800 */
801 if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK)) {
802 m_freem(m);
803 goto done;
804 }
805 }
806
807 /*
808 * Fill the outgoing inteface to tell the upper layer
809 * to increment per-interface statistics.
810 */
811 if (ifpp)
812 *ifpp = ifp;
813
814 /*
815 * Determine path MTU.
816 */
817 if (ro_pmtu != ro) {
818 /* The first hop and the final destination may differ. */
819 struct sockaddr_in6 *sin6_fin =
820 (struct sockaddr_in6 *)&ro_pmtu->ro_dst;
821 if (ro_pmtu->ro_rt && ((ro->ro_rt->rt_flags & RTF_UP) == 0 ||
822 !IN6_ARE_ADDR_EQUAL(&sin6_fin->sin6_addr,
823 &finaldst))) {
824 rtfree(ro_pmtu->ro_rt);
825 ro_pmtu->ro_rt = (struct rtentry *)0;
826 }
827 if (ro_pmtu->ro_rt == 0) {
828 bzero(sin6_fin, sizeof(*sin6_fin));
829 sin6_fin->sin6_family = AF_INET6;
830 sin6_fin->sin6_len = sizeof(struct sockaddr_in6);
831 sin6_fin->sin6_addr = finaldst;
832
833 rtalloc((struct route *)ro_pmtu);
834 }
835 }
836 if (ro_pmtu->ro_rt != NULL) {
837 u_int32_t ifmtu = nd_ifinfo[ifp->if_index].linkmtu;
838
839 mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
840 if (mtu > ifmtu || mtu == 0) {
841 /*
842 * The MTU on the route is larger than the MTU on
843 * the interface! This shouldn't happen, unless the
844 * MTU of the interface has been changed after the
845 * interface was brought up. Change the MTU in the
846 * route to match the interface MTU (as long as the
847 * field isn't locked).
848 *
849 * if MTU on the route is 0, we need to fix the MTU.
850 * this case happens with path MTU discovery timeouts.
851 */
852 mtu = ifmtu;
853 if ((ro_pmtu->ro_rt->rt_rmx.rmx_locks & RTV_MTU) == 0)
854 ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu; /* XXX */
855 }
856 } else {
857 mtu = nd_ifinfo[ifp->if_index].linkmtu;
858 }
859
860 /*
861 * advanced API (IPV6_USE_MIN_MTU) overrides mtu setting
862 */
863 if ((flags & IPV6_MINMTU) != 0 && mtu > IPV6_MMTU)
864 mtu = IPV6_MMTU;
865
866 /* Fake scoped addresses */
867 if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
868 /*
869 * If source or destination address is a scoped address, and
870 * the packet is going to be sent to a loopback interface,
871 * we should keep the original interface.
872 */
873
874 /*
875 * XXX: this is a very experimental and temporary solution.
876 * We eventually have sockaddr_in6 and use the sin6_scope_id
877 * field of the structure here.
878 * We rely on the consistency between two scope zone ids
879 * of source and destination, which should already be assured.
880 * Larger scopes than link will be supported in the future.
881 */
882 origifp = NULL;
883 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
884 origifp = ifindex2ifnet[ntohs(ip6->ip6_src.s6_addr16[1])];
885 else if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
886 origifp = ifindex2ifnet[ntohs(ip6->ip6_dst.s6_addr16[1])];
887 /*
888 * XXX: origifp can be NULL even in those two cases above.
889 * For example, if we remove the (only) link-local address
890 * from the loopback interface, and try to send a link-local
891 * address without link-id information. Then the source
892 * address is ::1, and the destination address is the
893 * link-local address with its s6_addr16[1] being zero.
894 * What is worse, if the packet goes to the loopback interface
895 * by a default rejected route, the null pointer would be
896 * passed to looutput, and the kernel would hang.
897 * The following last resort would prevent such disaster.
898 */
899 if (origifp == NULL)
900 origifp = ifp;
901 }
902 else
903 origifp = ifp;
904 #ifndef SCOPEDROUTING
905 /*
906 * clear embedded scope identifiers if necessary.
907 * in6_clearscope will touch the addresses only when necessary.
908 */
909 in6_clearscope(&ip6->ip6_src);
910 in6_clearscope(&ip6->ip6_dst);
911 #endif
912
913 /*
914 * Check with the firewall...
915 */
916 if (ip6_fw_enable && ip6_fw_chk_ptr) {
917 u_short port = 0;
918 m->m_pkthdr.rcvif = NULL; /* XXX */
919 /* If ipfw says divert, we have to just drop packet */
920 if (ip6_fw_chk_ptr(&ip6, ifp, &port, &m)) {
921 m_freem(m);
922 goto done;
923 }
924 if (!m) {
925 error = EACCES;
926 goto done;
927 }
928 }
929
930 /*
931 * If the outgoing packet contains a hop-by-hop options header,
932 * it must be examined and processed even by the source node.
933 * (RFC 2460, section 4.)
934 */
935 if (exthdrs.ip6e_hbh) {
936 struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh, struct ip6_hbh *);
937 u_int32_t dummy1; /* XXX unused */
938 u_int32_t dummy2; /* XXX unused */
939
940 #if DIAGNOSTIC
941 if ((hbh->ip6h_len + 1) << 3 > exthdrs.ip6e_hbh->m_len)
942 panic("ip6e_hbh is not continuous");
943 #endif
944 /*
945 * XXX: if we have to send an ICMPv6 error to the sender,
946 * we need the M_LOOP flag since icmp6_error() expects
947 * the IPv6 and the hop-by-hop options header are
948 * continuous unless the flag is set.
949 */
950 m->m_flags |= M_LOOP;
951 m->m_pkthdr.rcvif = ifp;
952 if (ip6_process_hopopts(m,
953 (u_int8_t *)(hbh + 1),
954 ((hbh->ip6h_len + 1) << 3) -
955 sizeof(struct ip6_hbh),
956 &dummy1, &dummy2) < 0) {
957 /* m was already freed at this point */
958 error = EINVAL;/* better error? */
959 goto done;
960 }
961 m->m_flags &= ~M_LOOP; /* XXX */
962 m->m_pkthdr.rcvif = NULL;
963 }
964
965 /*
966 * Send the packet to the outgoing interface.
967 * If necessary, do IPv6 fragmentation before sending.
968 */
969 tlen = m->m_pkthdr.len;
970 if (tlen <= mtu
971 #if notyet
972 /*
973 * On any link that cannot convey a 1280-octet packet in one piece,
974 * link-specific fragmentation and reassembly must be provided at
975 * a layer below IPv6. [RFC 2460, sec.5]
976 * Thus if the interface has ability of link-level fragmentation,
977 * we can just send the packet even if the packet size is
978 * larger than the link's MTU.
979 * XXX: IFF_FRAGMENTABLE (or such) flag has not been defined yet...
980 */
981
982 || ifp->if_flags & IFF_FRAGMENTABLE
983 #endif
984 )
985 {
986 /* Record statistics for this interface address. */
987 if (ia && !(flags & IPV6_FORWARDING)) {
988 #ifndef __APPLE__
989 ia->ia_ifa.if_opackets++;
990 ia->ia_ifa.if_obytes += m->m_pkthdr.len;
991 #endif
992 }
993 #ifdef IPSEC
994 /* clean ipsec history once it goes out of the node */
995 ipsec_delaux(m);
996 #endif
997
998 error = nd6_output(ifp, origifp, m, dst, ro->ro_rt, 1);
999 goto done;
1000 } else if (mtu < IPV6_MMTU) {
1001 /*
1002 * note that path MTU is never less than IPV6_MMTU
1003 * (see icmp6_input).
1004 */
1005 error = EMSGSIZE;
1006 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1007 goto bad;
1008 } else if (ip6->ip6_plen == 0) { /* jumbo payload cannot be fragmented */
1009 error = EMSGSIZE;
1010 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1011 goto bad;
1012 } else {
1013 struct mbuf **mnext, *m_frgpart;
1014 struct ip6_frag *ip6f;
1015 u_int32_t id = htonl(ip6_id++);
1016 u_char nextproto;
1017
1018 /*
1019 * Too large for the destination or interface;
1020 * fragment if possible.
1021 * Must be able to put at least 8 bytes per fragment.
1022 */
1023 hlen = unfragpartlen;
1024 if (mtu > IPV6_MAXPACKET)
1025 mtu = IPV6_MAXPACKET;
1026
1027 len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
1028 if (len < 8) {
1029 error = EMSGSIZE;
1030 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1031 goto bad;
1032 }
1033
1034 mnext = &m->m_nextpkt;
1035
1036 /*
1037 * Change the next header field of the last header in the
1038 * unfragmentable part.
1039 */
1040 if (exthdrs.ip6e_rthdr) {
1041 nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
1042 *mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
1043 } else if (exthdrs.ip6e_dest1) {
1044 nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
1045 *mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
1046 } else if (exthdrs.ip6e_hbh) {
1047 nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
1048 *mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
1049 } else {
1050 nextproto = ip6->ip6_nxt;
1051 ip6->ip6_nxt = IPPROTO_FRAGMENT;
1052 }
1053
1054 /*
1055 * Loop through length of segment after first fragment,
1056 * make new header and copy data of each part and link onto
1057 * chain.
1058 */
1059 m0 = m;
1060 for (off = hlen; off < tlen; off += len) {
1061 MGETHDR(m, M_DONTWAIT, MT_HEADER);
1062 if (!m) {
1063 error = ENOBUFS;
1064 ip6stat.ip6s_odropped++;
1065 goto sendorfree;
1066 }
1067 m->m_pkthdr.rcvif = NULL;
1068 m->m_flags = m0->m_flags & M_COPYFLAGS;
1069 *mnext = m;
1070 mnext = &m->m_nextpkt;
1071 m->m_data += max_linkhdr;
1072 mhip6 = mtod(m, struct ip6_hdr *);
1073 *mhip6 = *ip6;
1074 m->m_len = sizeof(*mhip6);
1075 error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
1076 if (error) {
1077 ip6stat.ip6s_odropped++;
1078 goto sendorfree;
1079 }
1080 ip6f->ip6f_offlg = htons((u_short)((off - hlen) & ~7));
1081 if (off + len >= tlen)
1082 len = tlen - off;
1083 else
1084 ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
1085 mhip6->ip6_plen = htons((u_short)(len + hlen +
1086 sizeof(*ip6f) -
1087 sizeof(struct ip6_hdr)));
1088 if ((m_frgpart = m_copy(m0, off, len)) == 0) {
1089 error = ENOBUFS;
1090 ip6stat.ip6s_odropped++;
1091 goto sendorfree;
1092 }
1093 m_cat(m, m_frgpart);
1094 m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
1095 m->m_pkthdr.rcvif = 0;
1096 m->m_pkthdr.socket_id = m0->m_pkthdr.socket_id;
1097 ip6f->ip6f_reserved = 0;
1098 ip6f->ip6f_ident = id;
1099 ip6f->ip6f_nxt = nextproto;
1100 ip6stat.ip6s_ofragments++;
1101 in6_ifstat_inc(ifp, ifs6_out_fragcreat);
1102 }
1103
1104 in6_ifstat_inc(ifp, ifs6_out_fragok);
1105 }
1106
1107 /*
1108 * Remove leading garbages.
1109 */
1110 sendorfree:
1111 m = m0->m_nextpkt;
1112 m0->m_nextpkt = 0;
1113 m_freem(m0);
1114 for (m0 = m; m; m = m0) {
1115 m0 = m->m_nextpkt;
1116 m->m_nextpkt = 0;
1117 if (error == 0) {
1118 /* Record statistics for this interface address. */
1119 if (ia) {
1120 #ifndef __APPLE__
1121 ia->ia_ifa.if_opackets++;
1122 ia->ia_ifa.if_obytes += m->m_pkthdr.len;
1123 #endif
1124 }
1125 #if IPSEC
1126 /* clean ipsec history once it goes out of the node */
1127 ipsec_delaux(m);
1128 #endif
1129 error = nd6_output(ifp, origifp, m, dst, ro->ro_rt, 1);
1130
1131 } else
1132 m_freem(m);
1133 }
1134
1135 if (error == 0)
1136 ip6stat.ip6s_fragmented++;
1137
1138 done:
1139 if (!locked)
1140 lck_mtx_unlock(ip6_mutex);
1141 if (ro == &ip6route && ro->ro_rt) { /* brace necessary for rtfree */
1142 rtfree(ro->ro_rt);
1143 } else if (ro_pmtu == &ip6route && ro_pmtu->ro_rt) {
1144 rtfree(ro_pmtu->ro_rt);
1145 }
1146
1147 #if IPSEC
1148 if (sp != NULL) {
1149 lck_mtx_lock(sadb_mutex);
1150 key_freesp(sp);
1151 lck_mtx_unlock(sadb_mutex);
1152 }
1153 #endif /* IPSEC */
1154
1155 return(error);
1156
1157 freehdrs:
1158 m_freem(exthdrs.ip6e_hbh); /* m_freem will check if mbuf is 0 */
1159 m_freem(exthdrs.ip6e_dest1);
1160 m_freem(exthdrs.ip6e_rthdr);
1161 m_freem(exthdrs.ip6e_dest2);
1162 /* fall through */
1163 bad:
1164 m_freem(m);
1165 goto done;
1166 }
1167
1168 static int
1169 ip6_copyexthdr(mp, hdr, hlen)
1170 struct mbuf **mp;
1171 caddr_t hdr;
1172 int hlen;
1173 {
1174 struct mbuf *m;
1175
1176 if (hlen > MCLBYTES)
1177 return(ENOBUFS); /* XXX */
1178
1179 MGET(m, M_DONTWAIT, MT_DATA);
1180 if (!m)
1181 return(ENOBUFS);
1182
1183 if (hlen > MLEN) {
1184 MCLGET(m, M_DONTWAIT);
1185 if ((m->m_flags & M_EXT) == 0) {
1186 m_free(m);
1187 return(ENOBUFS);
1188 }
1189 }
1190 m->m_len = hlen;
1191 if (hdr)
1192 bcopy(hdr, mtod(m, caddr_t), hlen);
1193
1194 *mp = m;
1195 return(0);
1196 }
1197
1198 /*
1199 * Insert jumbo payload option.
1200 */
1201 static int
1202 ip6_insert_jumboopt(exthdrs, plen)
1203 struct ip6_exthdrs *exthdrs;
1204 u_int32_t plen;
1205 {
1206 struct mbuf *mopt;
1207 u_char *optbuf;
1208 u_int32_t v;
1209
1210 #define JUMBOOPTLEN 8 /* length of jumbo payload option and padding */
1211
1212 /*
1213 * If there is no hop-by-hop options header, allocate new one.
1214 * If there is one but it doesn't have enough space to store the
1215 * jumbo payload option, allocate a cluster to store the whole options.
1216 * Otherwise, use it to store the options.
1217 */
1218 if (exthdrs->ip6e_hbh == 0) {
1219 MGET(mopt, M_DONTWAIT, MT_DATA);
1220 if (mopt == 0)
1221 return(ENOBUFS);
1222 mopt->m_len = JUMBOOPTLEN;
1223 optbuf = mtod(mopt, u_char *);
1224 optbuf[1] = 0; /* = ((JUMBOOPTLEN) >> 3) - 1 */
1225 exthdrs->ip6e_hbh = mopt;
1226 } else {
1227 struct ip6_hbh *hbh;
1228
1229 mopt = exthdrs->ip6e_hbh;
1230 if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
1231 /*
1232 * XXX assumption:
1233 * - exthdrs->ip6e_hbh is not referenced from places
1234 * other than exthdrs.
1235 * - exthdrs->ip6e_hbh is not an mbuf chain.
1236 */
1237 int oldoptlen = mopt->m_len;
1238 struct mbuf *n;
1239
1240 /*
1241 * XXX: give up if the whole (new) hbh header does
1242 * not fit even in an mbuf cluster.
1243 */
1244 if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
1245 return(ENOBUFS);
1246
1247 /*
1248 * As a consequence, we must always prepare a cluster
1249 * at this point.
1250 */
1251 MGET(n, M_DONTWAIT, MT_DATA);
1252 if (n) {
1253 MCLGET(n, M_DONTWAIT);
1254 if ((n->m_flags & M_EXT) == 0) {
1255 m_freem(n);
1256 n = NULL;
1257 }
1258 }
1259 if (!n)
1260 return(ENOBUFS);
1261 n->m_len = oldoptlen + JUMBOOPTLEN;
1262 bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t),
1263 oldoptlen);
1264 optbuf = mtod(n, caddr_t) + oldoptlen;
1265 m_freem(mopt);
1266 mopt = exthdrs->ip6e_hbh = n;
1267 } else {
1268 optbuf = mtod(mopt, u_char *) + mopt->m_len;
1269 mopt->m_len += JUMBOOPTLEN;
1270 }
1271 optbuf[0] = IP6OPT_PADN;
1272 optbuf[1] = 1;
1273
1274 /*
1275 * Adjust the header length according to the pad and
1276 * the jumbo payload option.
1277 */
1278 hbh = mtod(mopt, struct ip6_hbh *);
1279 hbh->ip6h_len += (JUMBOOPTLEN >> 3);
1280 }
1281
1282 /* fill in the option. */
1283 optbuf[2] = IP6OPT_JUMBO;
1284 optbuf[3] = 4;
1285 v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
1286 bcopy(&v, &optbuf[4], sizeof(u_int32_t));
1287
1288 /* finally, adjust the packet header length */
1289 exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
1290
1291 return(0);
1292 #undef JUMBOOPTLEN
1293 }
1294
1295 /*
1296 * Insert fragment header and copy unfragmentable header portions.
1297 */
1298 static int
1299 ip6_insertfraghdr(m0, m, hlen, frghdrp)
1300 struct mbuf *m0, *m;
1301 int hlen;
1302 struct ip6_frag **frghdrp;
1303 {
1304 struct mbuf *n, *mlast;
1305
1306 if (hlen > sizeof(struct ip6_hdr)) {
1307 n = m_copym(m0, sizeof(struct ip6_hdr),
1308 hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
1309 if (n == 0)
1310 return(ENOBUFS);
1311 m->m_next = n;
1312 } else
1313 n = m;
1314
1315 /* Search for the last mbuf of unfragmentable part. */
1316 for (mlast = n; mlast->m_next; mlast = mlast->m_next)
1317 ;
1318
1319 if ((mlast->m_flags & M_EXT) == 0 &&
1320 M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
1321 /* use the trailing space of the last mbuf for the fragment hdr */
1322 *frghdrp =
1323 (struct ip6_frag *)(mtod(mlast, caddr_t) + mlast->m_len);
1324 mlast->m_len += sizeof(struct ip6_frag);
1325 m->m_pkthdr.len += sizeof(struct ip6_frag);
1326 } else {
1327 /* allocate a new mbuf for the fragment header */
1328 struct mbuf *mfrg;
1329
1330 MGET(mfrg, M_DONTWAIT, MT_DATA);
1331 if (mfrg == 0)
1332 return(ENOBUFS);
1333 mfrg->m_len = sizeof(struct ip6_frag);
1334 *frghdrp = mtod(mfrg, struct ip6_frag *);
1335 mlast->m_next = mfrg;
1336 }
1337
1338 return(0);
1339 }
1340
1341 extern int load_ipfw();
1342
1343 /*
1344 * IP6 socket option processing.
1345 */
1346 int
1347 ip6_ctloutput(so, sopt)
1348 struct socket *so;
1349 struct sockopt *sopt;
1350 {
1351 int privileged;
1352 struct inpcb *in6p = sotoinpcb(so);
1353 int error, optval;
1354 int level, op, optname;
1355 int optlen;
1356 struct proc *p;
1357
1358 level = error = optval = 0;
1359 if (sopt == NULL)
1360 panic("ip6_ctloutput: arg soopt is NULL");
1361 else {
1362 level = sopt->sopt_level;
1363 op = sopt->sopt_dir;
1364 optname = sopt->sopt_name;
1365 optlen = sopt->sopt_valsize;
1366 p = sopt->sopt_p;
1367 }
1368
1369 privileged = (p == 0 || proc_suser(p)) ? 0 : 1;
1370
1371 if (level == IPPROTO_IPV6) {
1372 switch (op) {
1373
1374 case SOPT_SET:
1375 switch (optname) {
1376 case IPV6_PKTOPTIONS:
1377 {
1378 struct mbuf *m;
1379
1380 if (sopt->sopt_valsize > MCLBYTES) {
1381 error = EMSGSIZE;
1382 break;
1383 }
1384 error = soopt_getm(sopt, &m); /* XXX */
1385 if (error != NULL)
1386 break;
1387 error = soopt_mcopyin(sopt, m); /* XXX */
1388 if (error != NULL)
1389 break;
1390 error = ip6_pcbopts(&in6p->in6p_outputopts,
1391 m, so, sopt);
1392 m_freem(m); /* XXX */
1393 break;
1394 }
1395
1396 /*
1397 * Use of some Hop-by-Hop options or some
1398 * Destination options, might require special
1399 * privilege. That is, normal applications
1400 * (without special privilege) might be forbidden
1401 * from setting certain options in outgoing packets,
1402 * and might never see certain options in received
1403 * packets. [RFC 2292 Section 6]
1404 * KAME specific note:
1405 * KAME prevents non-privileged users from sending or
1406 * receiving ANY hbh/dst options in order to avoid
1407 * overhead of parsing options in the kernel.
1408 */
1409 case IPV6_UNICAST_HOPS:
1410 case IPV6_CHECKSUM:
1411 case IPV6_FAITH:
1412
1413 case IPV6_V6ONLY:
1414 if (optlen != sizeof(int)) {
1415 error = EINVAL;
1416 break;
1417 }
1418 error = sooptcopyin(sopt, &optval,
1419 sizeof optval, sizeof optval);
1420 if (error)
1421 break;
1422 switch (optname) {
1423
1424 case IPV6_UNICAST_HOPS:
1425 if (optval < -1 || optval >= 256)
1426 error = EINVAL;
1427 else {
1428 /* -1 = kernel default */
1429 in6p->in6p_hops = optval;
1430
1431 if ((in6p->in6p_vflag &
1432 INP_IPV4) != 0)
1433 in6p->inp_ip_ttl = optval;
1434 }
1435 break;
1436 #define OPTSET(bit) \
1437 do { \
1438 if (optval) \
1439 in6p->in6p_flags |= (bit); \
1440 else \
1441 in6p->in6p_flags &= ~(bit); \
1442 } while (0)
1443 #define OPTBIT(bit) (in6p->in6p_flags & (bit) ? 1 : 0)
1444
1445 case IPV6_CHECKSUM:
1446 in6p->in6p_cksum = optval;
1447 break;
1448
1449 case IPV6_FAITH:
1450 OPTSET(IN6P_FAITH);
1451 break;
1452
1453 case IPV6_V6ONLY:
1454 /*
1455 * make setsockopt(IPV6_V6ONLY)
1456 * available only prior to bind(2).
1457 * see ipng mailing list, Jun 22 2001.
1458 */
1459 if (in6p->in6p_lport ||
1460 !IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr))
1461 {
1462 error = EINVAL;
1463 break;
1464 }
1465 OPTSET(IN6P_IPV6_V6ONLY);
1466 if (optval)
1467 in6p->in6p_vflag &= ~INP_IPV4;
1468 else
1469 in6p->in6p_vflag |= INP_IPV4;
1470 break;
1471 }
1472 break;
1473
1474 case IPV6_PKTINFO:
1475 case IPV6_HOPLIMIT:
1476 case IPV6_HOPOPTS:
1477 case IPV6_DSTOPTS:
1478 case IPV6_RTHDR:
1479 /* RFC 2292 */
1480 if (optlen != sizeof(int)) {
1481 error = EINVAL;
1482 break;
1483 }
1484 error = sooptcopyin(sopt, &optval,
1485 sizeof optval, sizeof optval);
1486 if (error)
1487 break;
1488 switch (optname) {
1489 case IPV6_PKTINFO:
1490 OPTSET(IN6P_PKTINFO);
1491 break;
1492 case IPV6_HOPLIMIT:
1493 OPTSET(IN6P_HOPLIMIT);
1494 break;
1495 case IPV6_HOPOPTS:
1496 /*
1497 * Check super-user privilege.
1498 * See comments for IPV6_RECVHOPOPTS.
1499 */
1500 if (!privileged)
1501 return(EPERM);
1502 OPTSET(IN6P_HOPOPTS);
1503 break;
1504 case IPV6_DSTOPTS:
1505 if (!privileged)
1506 return(EPERM);
1507 OPTSET(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS); /* XXX */
1508 break;
1509 case IPV6_RTHDR:
1510 OPTSET(IN6P_RTHDR);
1511 break;
1512 }
1513 break;
1514 #undef OPTSET
1515
1516 case IPV6_MULTICAST_IF:
1517 case IPV6_MULTICAST_HOPS:
1518 case IPV6_MULTICAST_LOOP:
1519 case IPV6_JOIN_GROUP:
1520 case IPV6_LEAVE_GROUP:
1521 {
1522 struct mbuf *m;
1523 if (sopt->sopt_valsize > MLEN) {
1524 error = EMSGSIZE;
1525 break;
1526 }
1527 /* XXX */
1528 MGET(m, sopt->sopt_p ? M_WAIT : M_DONTWAIT, MT_HEADER);
1529 if (m == 0) {
1530 error = ENOBUFS;
1531 break;
1532 }
1533 m->m_len = sopt->sopt_valsize;
1534 error = sooptcopyin(sopt, mtod(m, char *),
1535 m->m_len, m->m_len);
1536 error = ip6_setmoptions(sopt->sopt_name, in6p, m);
1537 (void)m_free(m);
1538 }
1539 break;
1540
1541 case IPV6_PORTRANGE:
1542 error = sooptcopyin(sopt, &optval,
1543 sizeof optval, sizeof optval);
1544 if (error)
1545 break;
1546
1547 switch (optval) {
1548 case IPV6_PORTRANGE_DEFAULT:
1549 in6p->in6p_flags &= ~(IN6P_LOWPORT);
1550 in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1551 break;
1552
1553 case IPV6_PORTRANGE_HIGH:
1554 in6p->in6p_flags &= ~(IN6P_LOWPORT);
1555 in6p->in6p_flags |= IN6P_HIGHPORT;
1556 break;
1557
1558 case IPV6_PORTRANGE_LOW:
1559 in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1560 in6p->in6p_flags |= IN6P_LOWPORT;
1561 break;
1562
1563 default:
1564 error = EINVAL;
1565 break;
1566 }
1567 break;
1568
1569 #if IPSEC
1570 case IPV6_IPSEC_POLICY:
1571 {
1572 caddr_t req = NULL;
1573 size_t len = 0;
1574 struct mbuf *m;
1575
1576 if (sopt->sopt_valsize > MCLBYTES) {
1577 error = EMSGSIZE;
1578 break;
1579 }
1580 if ((error = soopt_getm(sopt, &m)) != 0) /* XXX */
1581 break;
1582 if ((error = soopt_mcopyin(sopt, m)) != 0) /* XXX */
1583 break;
1584 if (m) {
1585 req = mtod(m, caddr_t);
1586 len = m->m_len;
1587 }
1588 lck_mtx_lock(sadb_mutex);
1589 error = ipsec6_set_policy(in6p, optname, req,
1590 len, privileged);
1591 lck_mtx_unlock(sadb_mutex);
1592 m_freem(m);
1593 }
1594 break;
1595 #endif /* KAME IPSEC */
1596
1597 case IPV6_FW_ADD:
1598 case IPV6_FW_DEL:
1599 case IPV6_FW_FLUSH:
1600 case IPV6_FW_ZERO:
1601 {
1602 if (ip6_fw_ctl_ptr == NULL && load_ipfw() != 0)
1603 return EINVAL;
1604
1605 error = (*ip6_fw_ctl_ptr)(sopt);
1606 }
1607 break;
1608
1609 default:
1610 error = ENOPROTOOPT;
1611 break;
1612 }
1613 break;
1614
1615 case SOPT_GET:
1616 switch (optname) {
1617
1618 case IPV6_PKTOPTIONS:
1619 if (in6p->in6p_options) {
1620 struct mbuf *m;
1621 m = m_copym(in6p->in6p_options,
1622 0, M_COPYALL, M_WAIT);
1623 error = soopt_mcopyout(sopt, m);
1624 if (error == 0)
1625 m_freem(m);
1626 } else
1627 sopt->sopt_valsize = 0;
1628 break;
1629
1630 case IPV6_UNICAST_HOPS:
1631 case IPV6_CHECKSUM:
1632
1633 case IPV6_FAITH:
1634 case IPV6_V6ONLY:
1635 case IPV6_PORTRANGE:
1636 switch (optname) {
1637
1638 case IPV6_UNICAST_HOPS:
1639 optval = in6p->in6p_hops;
1640 break;
1641
1642 case IPV6_CHECKSUM:
1643 optval = in6p->in6p_cksum;
1644 break;
1645
1646 case IPV6_FAITH:
1647 optval = OPTBIT(IN6P_FAITH);
1648 break;
1649
1650 case IPV6_V6ONLY:
1651 optval = OPTBIT(IN6P_IPV6_V6ONLY);
1652 break;
1653
1654 case IPV6_PORTRANGE:
1655 {
1656 int flags;
1657 flags = in6p->in6p_flags;
1658 if (flags & IN6P_HIGHPORT)
1659 optval = IPV6_PORTRANGE_HIGH;
1660 else if (flags & IN6P_LOWPORT)
1661 optval = IPV6_PORTRANGE_LOW;
1662 else
1663 optval = 0;
1664 break;
1665 }
1666 }
1667 error = sooptcopyout(sopt, &optval,
1668 sizeof optval);
1669 break;
1670
1671 case IPV6_PKTINFO:
1672 case IPV6_HOPLIMIT:
1673 case IPV6_HOPOPTS:
1674 case IPV6_RTHDR:
1675 case IPV6_DSTOPTS:
1676 if ((optname == IPV6_HOPOPTS ||
1677 optname == IPV6_DSTOPTS) &&
1678 !privileged)
1679 return(EPERM);
1680 switch (optname) {
1681 case IPV6_PKTINFO:
1682 optval = OPTBIT(IN6P_PKTINFO);
1683 break;
1684 case IPV6_HOPLIMIT:
1685 optval = OPTBIT(IN6P_HOPLIMIT);
1686 break;
1687 case IPV6_HOPOPTS:
1688 if (!privileged)
1689 return(EPERM);
1690 optval = OPTBIT(IN6P_HOPOPTS);
1691 break;
1692 case IPV6_RTHDR:
1693 optval = OPTBIT(IN6P_RTHDR);
1694 break;
1695 case IPV6_DSTOPTS:
1696 if (!privileged)
1697 return(EPERM);
1698 optval = OPTBIT(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS);
1699 break;
1700 }
1701 error = sooptcopyout(sopt, &optval,
1702 sizeof optval);
1703 break;
1704
1705 case IPV6_MULTICAST_IF:
1706 case IPV6_MULTICAST_HOPS:
1707 case IPV6_MULTICAST_LOOP:
1708 case IPV6_JOIN_GROUP:
1709 case IPV6_LEAVE_GROUP:
1710 {
1711 struct mbuf *m;
1712 error = ip6_getmoptions(sopt->sopt_name,
1713 in6p->in6p_moptions, &m);
1714 if (error == 0)
1715 error = sooptcopyout(sopt,
1716 mtod(m, char *), m->m_len);
1717 m_freem(m);
1718 }
1719 break;
1720
1721 #if IPSEC
1722 case IPV6_IPSEC_POLICY:
1723 {
1724 caddr_t req = NULL;
1725 size_t len = 0;
1726 struct mbuf *m = NULL;
1727 struct mbuf **mp = &m;
1728
1729 if (sopt->sopt_valsize > MCLBYTES) {
1730 error = EMSGSIZE;
1731 break;
1732 }
1733 error = soopt_getm(sopt, &m); /* XXX */
1734 if (error != NULL)
1735 break;
1736 error = soopt_mcopyin(sopt, m); /* XXX */
1737 if (error != NULL)
1738 break;
1739 if (m) {
1740 req = mtod(m, caddr_t);
1741 len = m->m_len;
1742 }
1743 lck_mtx_lock(sadb_mutex);
1744 error = ipsec6_get_policy(in6p, req, len, mp);
1745 lck_mtx_unlock(sadb_mutex);
1746 if (error == 0)
1747 error = soopt_mcopyout(sopt, m); /*XXX*/
1748 if (error == 0 && m)
1749 m_freem(m);
1750 break;
1751 }
1752 #endif /* KAME IPSEC */
1753
1754 case IPV6_FW_GET:
1755 {
1756 if (ip6_fw_ctl_ptr == NULL && load_ipfw() != 0)
1757 return EINVAL;
1758
1759 error = (*ip6_fw_ctl_ptr)(sopt);
1760 }
1761 break;
1762
1763 default:
1764 error = ENOPROTOOPT;
1765 break;
1766 }
1767 break;
1768 }
1769 } else {
1770 error = EINVAL;
1771 }
1772 return(error);
1773 }
1774
1775 /*
1776 * Set up IP6 options in pcb for insertion in output packets or
1777 * specifying behavior of outgoing packets.
1778 */
1779 static int
1780 ip6_pcbopts(pktopt, m, so, sopt)
1781 struct ip6_pktopts **pktopt;
1782 struct mbuf *m;
1783 struct socket *so;
1784 struct sockopt *sopt;
1785 {
1786 struct ip6_pktopts *opt = *pktopt;
1787 int error = 0;
1788 struct proc *p = sopt->sopt_p;
1789 int priv = 0;
1790
1791 /* turn off any old options. */
1792 if (opt) {
1793 #if DIAGNOSTIC
1794 if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
1795 opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
1796 opt->ip6po_rhinfo.ip6po_rhi_rthdr)
1797 printf("ip6_pcbopts: all specified options are cleared.\n");
1798 #endif
1799 ip6_clearpktopts(opt, 1, -1);
1800 } else
1801 opt = _MALLOC(sizeof(*opt), M_IP6OPT, M_WAITOK);
1802 *pktopt = NULL;
1803
1804 if (!m || m->m_len == 0) {
1805 /*
1806 * Only turning off any previous options, regardless of
1807 * whether the opt is just created or given.
1808 */
1809 if (opt)
1810 FREE(opt, M_IP6OPT);
1811 return(0);
1812 }
1813
1814 /* set options specified by user. */
1815 if (p && !proc_suser(p))
1816 priv = 1;
1817 if ((error = ip6_setpktoptions(m, opt, priv, 1)) != 0) {
1818 ip6_clearpktopts(opt, 1, -1); /* XXX: discard all options */
1819 FREE(opt, M_IP6OPT);
1820 return(error);
1821 }
1822 *pktopt = opt;
1823 return(0);
1824 }
1825
1826 /*
1827 * initialize ip6_pktopts. beware that there are non-zero default values in
1828 * the struct.
1829 */
1830 void
1831 init_ip6pktopts(opt)
1832 struct ip6_pktopts *opt;
1833 {
1834
1835 bzero(opt, sizeof(*opt));
1836 opt->ip6po_hlim = -1; /* -1 means default hop limit */
1837 }
1838
1839 void
1840 ip6_clearpktopts(pktopt, needfree, optname)
1841 struct ip6_pktopts *pktopt;
1842 int needfree, optname;
1843 {
1844 if (pktopt == NULL)
1845 return;
1846
1847 if (optname == -1) {
1848 if (needfree && pktopt->ip6po_pktinfo)
1849 FREE(pktopt->ip6po_pktinfo, M_IP6OPT);
1850 pktopt->ip6po_pktinfo = NULL;
1851 }
1852 if (optname == -1)
1853 pktopt->ip6po_hlim = -1;
1854 if (optname == -1) {
1855 if (needfree && pktopt->ip6po_nexthop)
1856 FREE(pktopt->ip6po_nexthop, M_IP6OPT);
1857 pktopt->ip6po_nexthop = NULL;
1858 }
1859 if (optname == -1) {
1860 if (needfree && pktopt->ip6po_hbh)
1861 FREE(pktopt->ip6po_hbh, M_IP6OPT);
1862 pktopt->ip6po_hbh = NULL;
1863 }
1864 if (optname == -1) {
1865 if (needfree && pktopt->ip6po_dest1)
1866 FREE(pktopt->ip6po_dest1, M_IP6OPT);
1867 pktopt->ip6po_dest1 = NULL;
1868 }
1869 if (optname == -1) {
1870 if (needfree && pktopt->ip6po_rhinfo.ip6po_rhi_rthdr)
1871 FREE(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr, M_IP6OPT);
1872 pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
1873 if (pktopt->ip6po_route.ro_rt) {
1874 rtfree(pktopt->ip6po_route.ro_rt);
1875 pktopt->ip6po_route.ro_rt = NULL;
1876 }
1877 }
1878 if (optname == -1) {
1879 if (needfree && pktopt->ip6po_dest2)
1880 FREE(pktopt->ip6po_dest2, M_IP6OPT);
1881 pktopt->ip6po_dest2 = NULL;
1882 }
1883 }
1884
1885 #define PKTOPT_EXTHDRCPY(type) \
1886 do {\
1887 if (src->type) {\
1888 int hlen =\
1889 (((struct ip6_ext *)src->type)->ip6e_len + 1) << 3;\
1890 dst->type = _MALLOC(hlen, M_IP6OPT, canwait);\
1891 if (dst->type == NULL && canwait == M_NOWAIT)\
1892 goto bad;\
1893 bcopy(src->type, dst->type, hlen);\
1894 }\
1895 } while (0)
1896
1897 struct ip6_pktopts *
1898 ip6_copypktopts(src, canwait)
1899 struct ip6_pktopts *src;
1900 int canwait;
1901 {
1902 struct ip6_pktopts *dst;
1903
1904 if (src == NULL) {
1905 printf("ip6_clearpktopts: invalid argument\n");
1906 return(NULL);
1907 }
1908
1909 dst = _MALLOC(sizeof(*dst), M_IP6OPT, canwait);
1910 if (dst == NULL && canwait == M_NOWAIT)
1911 return (NULL);
1912 bzero(dst, sizeof(*dst));
1913
1914 dst->ip6po_hlim = src->ip6po_hlim;
1915 if (src->ip6po_pktinfo) {
1916 dst->ip6po_pktinfo = _MALLOC(sizeof(*dst->ip6po_pktinfo),
1917 M_IP6OPT, canwait);
1918 if (dst->ip6po_pktinfo == NULL && canwait == M_NOWAIT)
1919 goto bad;
1920 *dst->ip6po_pktinfo = *src->ip6po_pktinfo;
1921 }
1922 if (src->ip6po_nexthop) {
1923 dst->ip6po_nexthop = _MALLOC(src->ip6po_nexthop->sa_len,
1924 M_IP6OPT, canwait);
1925 if (dst->ip6po_nexthop == NULL && canwait == M_NOWAIT)
1926 goto bad;
1927 bcopy(src->ip6po_nexthop, dst->ip6po_nexthop,
1928 src->ip6po_nexthop->sa_len);
1929 }
1930 PKTOPT_EXTHDRCPY(ip6po_hbh);
1931 PKTOPT_EXTHDRCPY(ip6po_dest1);
1932 PKTOPT_EXTHDRCPY(ip6po_dest2);
1933 PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
1934 return(dst);
1935
1936 bad:
1937 if (dst->ip6po_pktinfo) FREE(dst->ip6po_pktinfo, M_IP6OPT);
1938 if (dst->ip6po_nexthop) FREE(dst->ip6po_nexthop, M_IP6OPT);
1939 if (dst->ip6po_hbh) FREE(dst->ip6po_hbh, M_IP6OPT);
1940 if (dst->ip6po_dest1) FREE(dst->ip6po_dest1, M_IP6OPT);
1941 if (dst->ip6po_dest2) FREE(dst->ip6po_dest2, M_IP6OPT);
1942 if (dst->ip6po_rthdr) FREE(dst->ip6po_rthdr, M_IP6OPT);
1943 FREE(dst, M_IP6OPT);
1944 return(NULL);
1945 }
1946 #undef PKTOPT_EXTHDRCPY
1947
1948 void
1949 ip6_freepcbopts(pktopt)
1950 struct ip6_pktopts *pktopt;
1951 {
1952 if (pktopt == NULL)
1953 return;
1954
1955 ip6_clearpktopts(pktopt, 1, -1);
1956
1957 FREE(pktopt, M_IP6OPT);
1958 }
1959
1960 /*
1961 * Set the IP6 multicast options in response to user setsockopt().
1962 */
1963 static int
1964 ip6_setmoptions(
1965 int optname,
1966 struct inpcb* in6p,
1967 struct mbuf *m)
1968 {
1969 int error = 0;
1970 u_int loop, ifindex;
1971 struct ipv6_mreq *mreq;
1972 struct ifnet *ifp;
1973 struct ip6_moptions **im6op = &in6p->in6p_moptions;
1974 struct ip6_moptions *im6o = *im6op;
1975 struct ip_moptions *imo;
1976 struct route_in6 ro;
1977 struct sockaddr_in6 *dst;
1978 struct in6_multi_mship *imm;
1979 struct proc *p = current_proc(); /* XXX */
1980
1981 if (im6o == NULL) {
1982 /*
1983 * No multicast option buffer attached to the pcb;
1984 * allocate one and initialize to default values.
1985 */
1986 im6o = (struct ip6_moptions *)
1987 _MALLOC(sizeof(*im6o), M_IPMOPTS, M_WAITOK);
1988
1989 if (im6o == NULL)
1990 return(ENOBUFS);
1991 *im6op = im6o;
1992 im6o->im6o_multicast_ifp = NULL;
1993 im6o->im6o_multicast_hlim = ip6_defmcasthlim;
1994 im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
1995 LIST_INIT(&im6o->im6o_memberships);
1996 }
1997
1998 if (in6p->inp_moptions == NULL) {
1999 /*
2000 * No IPv4 multicast option buffer attached to the pcb;
2001 * call ip_createmoptions to allocate one and initialize
2002 * to default values.
2003 */
2004 error = ip_createmoptions(&in6p->inp_moptions);
2005 if (error != 0)
2006 return error;
2007 }
2008 imo = in6p->inp_moptions;
2009
2010 switch (optname) {
2011
2012 case IPV6_MULTICAST_IF:
2013 /*
2014 * Select the interface for outgoing multicast packets.
2015 */
2016 if (m == NULL || m->m_len != sizeof(u_int)) {
2017 error = EINVAL;
2018 break;
2019 }
2020 bcopy(mtod(m, u_int *), &ifindex, sizeof(ifindex));
2021 if (ifindex < 0 || if_index < ifindex) {
2022 error = ENXIO; /* XXX EINVAL? */
2023 break;
2024 }
2025 ifp = ifindex2ifnet[ifindex];
2026 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2027 error = EADDRNOTAVAIL;
2028 break;
2029 }
2030 im6o->im6o_multicast_ifp = ifp;
2031 imo->imo_multicast_ifp = ifp;
2032 break;
2033
2034 case IPV6_MULTICAST_HOPS:
2035 {
2036 /*
2037 * Set the IP6 hoplimit for outgoing multicast packets.
2038 */
2039 int optval;
2040 if (m == NULL || m->m_len != sizeof(int)) {
2041 error = EINVAL;
2042 break;
2043 }
2044 bcopy(mtod(m, u_int *), &optval, sizeof(optval));
2045 if (optval < -1 || optval >= 256)
2046 error = EINVAL;
2047 else if (optval == -1) {
2048 im6o->im6o_multicast_hlim = ip6_defmcasthlim;
2049 imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
2050 } else {
2051 im6o->im6o_multicast_hlim = optval;
2052 imo->imo_multicast_ttl = optval;
2053 }
2054 break;
2055 }
2056
2057 case IPV6_MULTICAST_LOOP:
2058 /*
2059 * Set the loopback flag for outgoing multicast packets.
2060 * Must be zero or one.
2061 */
2062 if (m == NULL || m->m_len != sizeof(u_int)) {
2063 error = EINVAL;
2064 break;
2065 }
2066 bcopy(mtod(m, u_int *), &loop, sizeof(loop));
2067 if (loop > 1) {
2068 error = EINVAL;
2069 break;
2070 }
2071 im6o->im6o_multicast_loop = loop;
2072 imo->imo_multicast_loop = loop;
2073 break;
2074
2075 case IPV6_JOIN_GROUP:
2076 /*
2077 * Add a multicast group membership.
2078 * Group must be a valid IP6 multicast address.
2079 */
2080 if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
2081 error = EINVAL;
2082 break;
2083 }
2084 mreq = mtod(m, struct ipv6_mreq *);
2085 /*
2086 * If the interface is specified, validate it.
2087 */
2088 if (mreq->ipv6mr_interface < 0
2089 || if_index < mreq->ipv6mr_interface) {
2090 error = ENXIO; /* XXX EINVAL? */
2091 break;
2092 }
2093
2094 if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
2095 /*
2096 * We use the unspecified address to specify to accept
2097 * all multicast addresses. Only super user is allowed
2098 * to do this.
2099 */
2100 if (suser(kauth_cred_get(), 0))
2101 {
2102 error = EACCES;
2103 break;
2104 }
2105 } else if (IN6_IS_ADDR_V4MAPPED(&mreq->ipv6mr_multiaddr)) {
2106 struct ip_mreq v4req;
2107
2108 v4req.imr_multiaddr.s_addr = mreq->ipv6mr_multiaddr.s6_addr32[3];
2109 v4req.imr_interface.s_addr = INADDR_ANY;
2110
2111 /* Find an IPv4 address on the specified interface. */
2112 if (mreq->ipv6mr_interface != 0) {
2113 struct in_ifaddr *ifa;
2114
2115 ifp = ifindex2ifnet[mreq->ipv6mr_interface];
2116
2117 lck_mtx_lock(rt_mtx);
2118 TAILQ_FOREACH(ifa, &in_ifaddrhead, ia_link) {
2119 if (ifa->ia_ifp == ifp) {
2120 v4req.imr_interface = IA_SIN(ifa)->sin_addr;
2121 break;
2122 }
2123 }
2124 lck_mtx_unlock(rt_mtx);
2125
2126 if (v4req.imr_multiaddr.s_addr == 0) {
2127 /* Interface has no IPv4 address. */
2128 error = EINVAL;
2129 break;
2130 }
2131 }
2132
2133 error = ip_addmembership(imo, &v4req);
2134 break;
2135 } else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
2136 error = EINVAL;
2137 break;
2138 }
2139 /*
2140 * If no interface was explicitly specified, choose an
2141 * appropriate one according to the given multicast address.
2142 */
2143 if (mreq->ipv6mr_interface == 0) {
2144 /*
2145 * If the multicast address is in node-local scope,
2146 * the interface should be a loopback interface.
2147 * Otherwise, look up the routing table for the
2148 * address, and choose the outgoing interface.
2149 * XXX: is it a good approach?
2150 */
2151 if (IN6_IS_ADDR_MC_NODELOCAL(&mreq->ipv6mr_multiaddr)) {
2152 ifp = &loif[0];
2153 } else {
2154 ro.ro_rt = NULL;
2155 dst = (struct sockaddr_in6 *)&ro.ro_dst;
2156 bzero(dst, sizeof(*dst));
2157 dst->sin6_len = sizeof(struct sockaddr_in6);
2158 dst->sin6_family = AF_INET6;
2159 dst->sin6_addr = mreq->ipv6mr_multiaddr;
2160 rtalloc((struct route *)&ro);
2161 if (ro.ro_rt == NULL) {
2162 error = EADDRNOTAVAIL;
2163 break;
2164 }
2165 ifp = ro.ro_rt->rt_ifp;
2166 rtfree(ro.ro_rt);
2167 }
2168 } else
2169 ifp = ifindex2ifnet[mreq->ipv6mr_interface];
2170
2171 /*
2172 * See if we found an interface, and confirm that it
2173 * supports multicast
2174 */
2175 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2176 error = EADDRNOTAVAIL;
2177 break;
2178 }
2179 /*
2180 * Put interface index into the multicast address,
2181 * if the address has link-local scope.
2182 */
2183 if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
2184 mreq->ipv6mr_multiaddr.s6_addr16[1]
2185 = htons(mreq->ipv6mr_interface);
2186 }
2187 /*
2188 * See if the membership already exists.
2189 */
2190 lck_mtx_lock(nd6_mutex);
2191 for (imm = im6o->im6o_memberships.lh_first;
2192 imm != NULL; imm = imm->i6mm_chain.le_next)
2193 if (imm->i6mm_maddr->in6m_ifp == ifp &&
2194 IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2195 &mreq->ipv6mr_multiaddr))
2196 break;
2197 if (imm != NULL) {
2198 error = EADDRINUSE;
2199 lck_mtx_unlock(nd6_mutex);
2200 break;
2201 }
2202 /*
2203 * Everything looks good; add a new record to the multicast
2204 * address list for the given interface.
2205 */
2206 imm = _MALLOC(sizeof(*imm), M_IPMADDR, M_WAITOK);
2207 if (imm == NULL) {
2208 error = ENOBUFS;
2209 lck_mtx_unlock(nd6_mutex);
2210 break;
2211 }
2212 if ((imm->i6mm_maddr =
2213 in6_addmulti(&mreq->ipv6mr_multiaddr, ifp, &error, 1)) == NULL) {
2214 FREE(imm, M_IPMADDR);
2215 lck_mtx_unlock(nd6_mutex);
2216 break;
2217 }
2218 LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
2219 lck_mtx_unlock(nd6_mutex);
2220 break;
2221
2222 case IPV6_LEAVE_GROUP:
2223 /*
2224 * Drop a multicast group membership.
2225 * Group must be a valid IP6 multicast address.
2226 */
2227 if (m == NULL || m->m_len != sizeof(struct ipv6_mreq)) {
2228 error = EINVAL;
2229 break;
2230 }
2231 mreq = mtod(m, struct ipv6_mreq *);
2232 /*
2233 * If an interface address was specified, get a pointer
2234 * to its ifnet structure.
2235 */
2236 if (mreq->ipv6mr_interface < 0
2237 || if_index < mreq->ipv6mr_interface) {
2238 error = ENXIO; /* XXX EINVAL? */
2239 break;
2240 }
2241 ifp = ifindex2ifnet[mreq->ipv6mr_interface];
2242
2243 if (IN6_IS_ADDR_UNSPECIFIED(&mreq->ipv6mr_multiaddr)) {
2244 if (suser(kauth_cred_get(), 0)) {
2245 error = EACCES;
2246 break;
2247 }
2248 } else if (IN6_IS_ADDR_V4MAPPED(&mreq->ipv6mr_multiaddr)) {
2249 struct ip_mreq v4req;
2250
2251 v4req.imr_multiaddr.s_addr = mreq->ipv6mr_multiaddr.s6_addr32[3];
2252 v4req.imr_interface.s_addr = INADDR_ANY;
2253
2254 if (ifp != NULL) {
2255 struct in_ifaddr *ifa;
2256
2257 lck_mtx_lock(rt_mtx);
2258 TAILQ_FOREACH(ifa, &in_ifaddrhead, ia_link) {
2259 if (ifa->ia_ifp == ifp) {
2260 v4req.imr_interface = IA_SIN(ifa)->sin_addr;
2261 break;
2262 }
2263 }
2264 lck_mtx_unlock(rt_mtx);
2265 }
2266
2267 error = ip_dropmembership(imo, &v4req);
2268 break;
2269 } else if (!IN6_IS_ADDR_MULTICAST(&mreq->ipv6mr_multiaddr)) {
2270 error = EINVAL;
2271 break;
2272 }
2273 /*
2274 * Put interface index into the multicast address,
2275 * if the address has link-local scope.
2276 */
2277 if (IN6_IS_ADDR_MC_LINKLOCAL(&mreq->ipv6mr_multiaddr)) {
2278 mreq->ipv6mr_multiaddr.s6_addr16[1]
2279 = htons(mreq->ipv6mr_interface);
2280 }
2281 /*
2282 * Find the membership in the membership list.
2283 */
2284 lck_mtx_lock(nd6_mutex);
2285 for (imm = im6o->im6o_memberships.lh_first;
2286 imm != NULL; imm = imm->i6mm_chain.le_next) {
2287 if ((ifp == NULL ||
2288 imm->i6mm_maddr->in6m_ifp == ifp) &&
2289 IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2290 &mreq->ipv6mr_multiaddr))
2291 break;
2292 }
2293 if (imm == NULL) {
2294 /* Unable to resolve interface */
2295 error = EADDRNOTAVAIL;
2296 lck_mtx_unlock(nd6_mutex);
2297 break;
2298 }
2299 /*
2300 * Give up the multicast address record to which the
2301 * membership points.
2302 */
2303 LIST_REMOVE(imm, i6mm_chain);
2304 in6_delmulti(imm->i6mm_maddr, 1);
2305 lck_mtx_unlock(nd6_mutex);
2306 FREE(imm, M_IPMADDR);
2307 break;
2308
2309 default:
2310 error = EOPNOTSUPP;
2311 break;
2312 }
2313
2314 /*
2315 * If all options have default values, no need to keep the mbuf.
2316 */
2317 lck_mtx_lock(nd6_mutex);
2318 if (im6o->im6o_multicast_ifp == NULL &&
2319 im6o->im6o_multicast_hlim == ip6_defmcasthlim &&
2320 im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
2321 im6o->im6o_memberships.lh_first == NULL) {
2322 FREE(*im6op, M_IPMOPTS);
2323 *im6op = NULL;
2324 }
2325 if (imo->imo_multicast_ifp == NULL &&
2326 imo->imo_multicast_vif == -1 &&
2327 imo->imo_multicast_ttl == IP_DEFAULT_MULTICAST_TTL &&
2328 imo->imo_multicast_loop == IP_DEFAULT_MULTICAST_LOOP &&
2329 imo->imo_num_memberships == 0) {
2330 ip_freemoptions(imo);
2331 in6p->inp_moptions = 0;
2332 }
2333 lck_mtx_unlock(nd6_mutex);
2334
2335 return(error);
2336 }
2337
2338 /*
2339 * Return the IP6 multicast options in response to user getsockopt().
2340 */
2341 static int
2342 ip6_getmoptions(optname, im6o, mp)
2343 int optname;
2344 struct ip6_moptions *im6o;
2345 struct mbuf **mp;
2346 {
2347 u_int *hlim, *loop, *ifindex;
2348
2349 *mp = m_get(M_WAIT, MT_HEADER); /*XXX*/
2350
2351 switch (optname) {
2352
2353 case IPV6_MULTICAST_IF:
2354 ifindex = mtod(*mp, u_int *);
2355 (*mp)->m_len = sizeof(u_int);
2356 if (im6o == NULL || im6o->im6o_multicast_ifp == NULL)
2357 *ifindex = 0;
2358 else
2359 *ifindex = im6o->im6o_multicast_ifp->if_index;
2360 return(0);
2361
2362 case IPV6_MULTICAST_HOPS:
2363 hlim = mtod(*mp, u_int *);
2364 (*mp)->m_len = sizeof(u_int);
2365 if (im6o == NULL)
2366 *hlim = ip6_defmcasthlim;
2367 else
2368 *hlim = im6o->im6o_multicast_hlim;
2369 return(0);
2370
2371 case IPV6_MULTICAST_LOOP:
2372 loop = mtod(*mp, u_int *);
2373 (*mp)->m_len = sizeof(u_int);
2374 if (im6o == NULL)
2375 *loop = ip6_defmcasthlim;
2376 else
2377 *loop = im6o->im6o_multicast_loop;
2378 return(0);
2379
2380 default:
2381 return(EOPNOTSUPP);
2382 }
2383 }
2384
2385 /*
2386 * Discard the IP6 multicast options.
2387 */
2388 void
2389 ip6_freemoptions(im6o)
2390 struct ip6_moptions *im6o;
2391 {
2392 struct in6_multi_mship *imm;
2393
2394 if (im6o == NULL)
2395 return;
2396
2397 lck_mtx_lock(nd6_mutex);
2398 while ((imm = im6o->im6o_memberships.lh_first) != NULL) {
2399 LIST_REMOVE(imm, i6mm_chain);
2400 if (imm->i6mm_maddr)
2401 in6_delmulti(imm->i6mm_maddr, 1);
2402 FREE(imm, M_IPMADDR);
2403 }
2404 lck_mtx_unlock(nd6_mutex);
2405 FREE(im6o, M_IPMOPTS);
2406 }
2407
2408 /*
2409 * Set IPv6 outgoing packet options based on advanced API.
2410 */
2411 int
2412 ip6_setpktoptions(control, opt, priv, needcopy)
2413 struct mbuf *control;
2414 struct ip6_pktopts *opt;
2415 int priv, needcopy;
2416 {
2417 struct cmsghdr *cm = 0;
2418
2419 if (control == 0 || opt == 0)
2420 return(EINVAL);
2421
2422 init_ip6pktopts(opt);
2423
2424 /*
2425 * XXX: Currently, we assume all the optional information is stored
2426 * in a single mbuf.
2427 */
2428 if (control->m_next)
2429 return(EINVAL);
2430
2431 for (; control->m_len; control->m_data += CMSG_ALIGN(cm->cmsg_len),
2432 control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
2433 cm = mtod(control, struct cmsghdr *);
2434 if (cm->cmsg_len == 0 || cm->cmsg_len > control->m_len)
2435 return(EINVAL);
2436 if (cm->cmsg_level != IPPROTO_IPV6)
2437 continue;
2438
2439 /*
2440 * XXX should check if RFC2292 API is mixed with 2292bis API
2441 */
2442 switch (cm->cmsg_type) {
2443 case IPV6_PKTINFO:
2444 if (cm->cmsg_len != CMSG_LEN(sizeof(struct in6_pktinfo)))
2445 return(EINVAL);
2446 if (needcopy) {
2447 /* XXX: Is it really WAITOK? */
2448 opt->ip6po_pktinfo =
2449 _MALLOC(sizeof(struct in6_pktinfo),
2450 M_IP6OPT, M_WAITOK);
2451 bcopy(CMSG_DATA(cm), opt->ip6po_pktinfo,
2452 sizeof(struct in6_pktinfo));
2453 } else
2454 opt->ip6po_pktinfo =
2455 (struct in6_pktinfo *)CMSG_DATA(cm);
2456 if (opt->ip6po_pktinfo->ipi6_ifindex &&
2457 IN6_IS_ADDR_LINKLOCAL(&opt->ip6po_pktinfo->ipi6_addr))
2458 opt->ip6po_pktinfo->ipi6_addr.s6_addr16[1] =
2459 htons(opt->ip6po_pktinfo->ipi6_ifindex);
2460
2461 if (opt->ip6po_pktinfo->ipi6_ifindex > if_index
2462 || opt->ip6po_pktinfo->ipi6_ifindex < 0) {
2463 return(ENXIO);
2464 }
2465
2466 /*
2467 * Check if the requested source address is indeed a
2468 * unicast address assigned to the node, and can be
2469 * used as the packet's source address.
2470 */
2471 if (!IN6_IS_ADDR_UNSPECIFIED(&opt->ip6po_pktinfo->ipi6_addr)) {
2472 struct in6_ifaddr *ia6;
2473 struct sockaddr_in6 sin6;
2474
2475 bzero(&sin6, sizeof(sin6));
2476 sin6.sin6_len = sizeof(sin6);
2477 sin6.sin6_family = AF_INET6;
2478 sin6.sin6_addr =
2479 opt->ip6po_pktinfo->ipi6_addr;
2480 ia6 = (struct in6_ifaddr *)ifa_ifwithaddr(sin6tosa(&sin6));
2481 if (ia6 == NULL ||
2482 (ia6->ia6_flags & (IN6_IFF_ANYCAST |
2483 IN6_IFF_NOTREADY)) != 0) {
2484 if (ia6) ifafree(&ia6->ia_ifa);
2485 return(EADDRNOTAVAIL);
2486 }
2487 ifafree(&ia6->ia_ifa);
2488 ia6 = NULL;
2489 }
2490 break;
2491
2492 case IPV6_HOPLIMIT:
2493 if (cm->cmsg_len != CMSG_LEN(sizeof(int)))
2494 return(EINVAL);
2495
2496 opt->ip6po_hlim = *(int *)CMSG_DATA(cm);
2497 if (opt->ip6po_hlim < -1 || opt->ip6po_hlim > 255)
2498 return(EINVAL);
2499 break;
2500
2501 case IPV6_NEXTHOP:
2502 if (!priv)
2503 return(EPERM);
2504
2505 if (cm->cmsg_len < sizeof(u_char) ||
2506 /* check if cmsg_len is large enough for sa_len */
2507 cm->cmsg_len < CMSG_LEN(*CMSG_DATA(cm)))
2508 return(EINVAL);
2509
2510 if (needcopy) {
2511 opt->ip6po_nexthop =
2512 _MALLOC(*CMSG_DATA(cm),
2513 M_IP6OPT, M_WAITOK);
2514 bcopy(CMSG_DATA(cm),
2515 opt->ip6po_nexthop,
2516 *CMSG_DATA(cm));
2517 } else
2518 opt->ip6po_nexthop =
2519 (struct sockaddr *)CMSG_DATA(cm);
2520 break;
2521
2522 case IPV6_HOPOPTS:
2523 {
2524 struct ip6_hbh *hbh;
2525 int hbhlen;
2526
2527 if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_hbh)))
2528 return(EINVAL);
2529 hbh = (struct ip6_hbh *)CMSG_DATA(cm);
2530 hbhlen = (hbh->ip6h_len + 1) << 3;
2531 if (cm->cmsg_len != CMSG_LEN(hbhlen))
2532 return(EINVAL);
2533
2534 if (needcopy) {
2535 opt->ip6po_hbh =
2536 _MALLOC(hbhlen, M_IP6OPT, M_WAITOK);
2537 bcopy(hbh, opt->ip6po_hbh, hbhlen);
2538 } else
2539 opt->ip6po_hbh = hbh;
2540 break;
2541 }
2542
2543 case IPV6_DSTOPTS:
2544 {
2545 struct ip6_dest *dest, **newdest;
2546 int destlen;
2547
2548 if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_dest)))
2549 return(EINVAL);
2550 dest = (struct ip6_dest *)CMSG_DATA(cm);
2551 destlen = (dest->ip6d_len + 1) << 3;
2552 if (cm->cmsg_len != CMSG_LEN(destlen))
2553 return(EINVAL);
2554
2555 /*
2556 * The old advacned API is ambiguous on this
2557 * point. Our approach is to determine the
2558 * position based according to the existence
2559 * of a routing header. Note, however, that
2560 * this depends on the order of the extension
2561 * headers in the ancillary data; the 1st part
2562 * of the destination options header must
2563 * appear before the routing header in the
2564 * ancillary data, too.
2565 * RFC2292bis solved the ambiguity by
2566 * introducing separate cmsg types.
2567 */
2568 if (opt->ip6po_rthdr == NULL)
2569 newdest = &opt->ip6po_dest1;
2570 else
2571 newdest = &opt->ip6po_dest2;
2572
2573 if (needcopy) {
2574 *newdest = _MALLOC(destlen, M_IP6OPT, M_WAITOK);
2575 bcopy(dest, *newdest, destlen);
2576 } else
2577 *newdest = dest;
2578
2579 break;
2580 }
2581
2582 case IPV6_RTHDR:
2583 {
2584 struct ip6_rthdr *rth;
2585 int rthlen;
2586
2587 if (cm->cmsg_len < CMSG_LEN(sizeof(struct ip6_rthdr)))
2588 return(EINVAL);
2589 rth = (struct ip6_rthdr *)CMSG_DATA(cm);
2590 rthlen = (rth->ip6r_len + 1) << 3;
2591 if (cm->cmsg_len != CMSG_LEN(rthlen))
2592 return(EINVAL);
2593
2594 switch (rth->ip6r_type) {
2595 case IPV6_RTHDR_TYPE_0:
2596 /* must contain one addr */
2597 if (rth->ip6r_len == 0)
2598 return(EINVAL);
2599 /* length must be even */
2600 if (rth->ip6r_len % 2)
2601 return(EINVAL);
2602 if (rth->ip6r_len / 2 != rth->ip6r_segleft)
2603 return(EINVAL);
2604 break;
2605 default:
2606 return(EINVAL); /* not supported */
2607 }
2608
2609 if (needcopy) {
2610 opt->ip6po_rthdr = _MALLOC(rthlen, M_IP6OPT,
2611 M_WAITOK);
2612 bcopy(rth, opt->ip6po_rthdr, rthlen);
2613 } else
2614 opt->ip6po_rthdr = rth;
2615
2616 break;
2617 }
2618
2619 default:
2620 return(ENOPROTOOPT);
2621 }
2622 }
2623
2624 return(0);
2625 }
2626
2627 /*
2628 * Routine called from ip6_output() to loop back a copy of an IP6 multicast
2629 * packet to the input queue of a specified interface. Note that this
2630 * calls the output routine of the loopback "driver", but with an interface
2631 * pointer that might NOT be &loif -- easier than replicating that code here.
2632 */
2633 void
2634 ip6_mloopback(
2635 struct ifnet *ifp,
2636 struct mbuf *m,
2637 struct sockaddr_in6 *dst)
2638 {
2639 struct mbuf *copym;
2640 struct ip6_hdr *ip6;
2641
2642 copym = m_copy(m, 0, M_COPYALL);
2643 if (copym == NULL)
2644 return;
2645
2646 /*
2647 * Make sure to deep-copy IPv6 header portion in case the data
2648 * is in an mbuf cluster, so that we can safely override the IPv6
2649 * header portion later.
2650 */
2651 if ((copym->m_flags & M_EXT) != 0 ||
2652 copym->m_len < sizeof(struct ip6_hdr)) {
2653 copym = m_pullup(copym, sizeof(struct ip6_hdr));
2654 if (copym == NULL)
2655 return;
2656 }
2657
2658 #if DIAGNOSTIC
2659 if (copym->m_len < sizeof(*ip6)) {
2660 m_freem(copym);
2661 return;
2662 }
2663 #endif
2664
2665 ip6 = mtod(copym, struct ip6_hdr *);
2666 #ifndef SCOPEDROUTING
2667 /*
2668 * clear embedded scope identifiers if necessary.
2669 * in6_clearscope will touch the addresses only when necessary.
2670 */
2671 in6_clearscope(&ip6->ip6_src);
2672 in6_clearscope(&ip6->ip6_dst);
2673 #endif
2674
2675 #ifdef __APPLE__
2676
2677 /* Makes sure the HW checksum flags are cleaned before sending the packet */
2678
2679 copym->m_pkthdr.rcvif = 0;
2680 copym->m_pkthdr.csum_data = 0;
2681 copym->m_pkthdr.csum_flags = 0;
2682
2683 if (lo_ifp) {
2684 copym->m_pkthdr.rcvif = ifp;
2685 lck_mtx_unlock(ip6_mutex);
2686 dlil_output(lo_ifp, PF_INET6, copym, 0, (struct sockaddr *)dst, 0);
2687 lck_mtx_lock(ip6_mutex);
2688 } else
2689 m_free(copym);
2690 #else
2691 (void)if_simloop(ifp, copym, dst->sin6_family, NULL);
2692 #endif
2693 }
2694
2695 /*
2696 * Chop IPv6 header off from the payload.
2697 */
2698 static int
2699 ip6_splithdr(m, exthdrs)
2700 struct mbuf *m;
2701 struct ip6_exthdrs *exthdrs;
2702 {
2703 struct mbuf *mh;
2704 struct ip6_hdr *ip6;
2705
2706 ip6 = mtod(m, struct ip6_hdr *);
2707 if (m->m_len > sizeof(*ip6)) {
2708 MGETHDR(mh, M_DONTWAIT, MT_HEADER);
2709 if (mh == 0) {
2710 m_freem(m);
2711 return ENOBUFS;
2712 }
2713 M_COPY_PKTHDR(mh, m);
2714 MH_ALIGN(mh, sizeof(*ip6));
2715 m->m_flags &= ~M_PKTHDR;
2716 m->m_len -= sizeof(*ip6);
2717 m->m_data += sizeof(*ip6);
2718 mh->m_next = m;
2719 m = mh;
2720 m->m_len = sizeof(*ip6);
2721 bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof(*ip6));
2722 }
2723 exthdrs->ip6e_ip6 = m;
2724 return 0;
2725 }
2726
2727 /*
2728 * Compute IPv6 extension header length.
2729 */
2730 int
2731 ip6_optlen(in6p)
2732 struct in6pcb *in6p;
2733 {
2734 int len;
2735
2736 if (!in6p->in6p_outputopts)
2737 return 0;
2738
2739 len = 0;
2740 #define elen(x) \
2741 (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
2742
2743 len += elen(in6p->in6p_outputopts->ip6po_hbh);
2744 if (in6p->in6p_outputopts->ip6po_rthdr)
2745 /* dest1 is valid with rthdr only */
2746 len += elen(in6p->in6p_outputopts->ip6po_dest1);
2747 len += elen(in6p->in6p_outputopts->ip6po_rthdr);
2748 len += elen(in6p->in6p_outputopts->ip6po_dest2);
2749 return len;
2750 #undef elen
2751 }
mirror of XNU